]> git.ipfire.org Git - thirdparty/grsecurity-scrape.git/blob - test/grsecurity-2.2.2-3.0.8-201110250925.patch
projects / thirdparty / grsecurity-scrape.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Auto commit, 1 new patch{es}.
[thirdparty/grsecurity-scrape.git] / test / grsecurity-2.2.2-3.0.8-201110250925.patch
1 diff -urNp linux-3.0.8/arch/alpha/include/asm/elf.h linux-3.0.8/arch/alpha/include/asm/elf.h
2 --- linux-3.0.8/arch/alpha/include/asm/elf.h 2011-07-21 22:17:23.000000000 -0400
3 +++ linux-3.0.8/arch/alpha/include/asm/elf.h 2011-08-23 21:47:55.000000000 -0400
4 @@ -90,6 +90,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
5
6 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
7
8 +#ifdef CONFIG_PAX_ASLR
9 +#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
10 +
11 +#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
12 +#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
13 +#endif
14 +
15 /* $0 is set by ld.so to a pointer to a function which might be
16 registered using atexit. This provides a mean for the dynamic
17 linker to call DT_FINI functions for shared libraries that have
18 diff -urNp linux-3.0.8/arch/alpha/include/asm/pgtable.h linux-3.0.8/arch/alpha/include/asm/pgtable.h
19 --- linux-3.0.8/arch/alpha/include/asm/pgtable.h 2011-07-21 22:17:23.000000000 -0400
20 +++ linux-3.0.8/arch/alpha/include/asm/pgtable.h 2011-08-23 21:47:55.000000000 -0400
21 @@ -101,6 +101,17 @@ struct vm_area_struct;
22 #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
23 #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
24 #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
25 +
26 +#ifdef CONFIG_PAX_PAGEEXEC
27 +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
28 +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
29 +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
30 +#else
31 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
32 +# define PAGE_COPY_NOEXEC PAGE_COPY
33 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
34 +#endif
35 +
36 #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
37
38 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
39 diff -urNp linux-3.0.8/arch/alpha/kernel/module.c linux-3.0.8/arch/alpha/kernel/module.c
40 --- linux-3.0.8/arch/alpha/kernel/module.c 2011-07-21 22:17:23.000000000 -0400
41 +++ linux-3.0.8/arch/alpha/kernel/module.c 2011-08-23 21:47:55.000000000 -0400
42 @@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs,
43
44 /* The small sections were sorted to the end of the segment.
45 The following should definitely cover them. */
46 - gp = (u64)me->module_core + me->core_size - 0x8000;
47 + gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
48 got = sechdrs[me->arch.gotsecindex].sh_addr;
49
50 for (i = 0; i < n; i++) {
51 diff -urNp linux-3.0.8/arch/alpha/kernel/osf_sys.c linux-3.0.8/arch/alpha/kernel/osf_sys.c
52 --- linux-3.0.8/arch/alpha/kernel/osf_sys.c 2011-07-21 22:17:23.000000000 -0400
53 +++ linux-3.0.8/arch/alpha/kernel/osf_sys.c 2011-08-23 21:47:55.000000000 -0400
54 @@ -1145,7 +1145,7 @@ arch_get_unmapped_area_1(unsigned long a
55 /* At this point: (!vma || addr < vma->vm_end). */
56 if (limit - len < addr)
57 return -ENOMEM;
58 - if (!vma || addr + len <= vma->vm_start)
59 + if (check_heap_stack_gap(vma, addr, len))
60 return addr;
61 addr = vma->vm_end;
62 vma = vma->vm_next;
63 @@ -1181,6 +1181,10 @@ arch_get_unmapped_area(struct file *filp
64 merely specific addresses, but regions of memory -- perhaps
65 this feature should be incorporated into all ports? */
66
67 +#ifdef CONFIG_PAX_RANDMMAP
68 + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
69 +#endif
70 +
71 if (addr) {
72 addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
73 if (addr != (unsigned long) -ENOMEM)
74 @@ -1188,8 +1192,8 @@ arch_get_unmapped_area(struct file *filp
75 }
76
77 /* Next, try allocating at TASK_UNMAPPED_BASE. */
78 - addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
79 - len, limit);
80 + addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
81 +
82 if (addr != (unsigned long) -ENOMEM)
83 return addr;
84
85 diff -urNp linux-3.0.8/arch/alpha/mm/fault.c linux-3.0.8/arch/alpha/mm/fault.c
86 --- linux-3.0.8/arch/alpha/mm/fault.c 2011-07-21 22:17:23.000000000 -0400
87 +++ linux-3.0.8/arch/alpha/mm/fault.c 2011-08-23 21:47:55.000000000 -0400
88 @@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
89 __reload_thread(pcb);
90 }
91
92 +#ifdef CONFIG_PAX_PAGEEXEC
93 +/*
94 + * PaX: decide what to do with offenders (regs->pc = fault address)
95 + *
96 + * returns 1 when task should be killed
97 + * 2 when patched PLT trampoline was detected
98 + * 3 when unpatched PLT trampoline was detected
99 + */
100 +static int pax_handle_fetch_fault(struct pt_regs *regs)
101 +{
102 +
103 +#ifdef CONFIG_PAX_EMUPLT
104 + int err;
105 +
106 + do { /* PaX: patched PLT emulation #1 */
107 + unsigned int ldah, ldq, jmp;
108 +
109 + err = get_user(ldah, (unsigned int *)regs->pc);
110 + err |= get_user(ldq, (unsigned int *)(regs->pc+4));
111 + err |= get_user(jmp, (unsigned int *)(regs->pc+8));
112 +
113 + if (err)
114 + break;
115 +
116 + if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
117 + (ldq & 0xFFFF0000U) == 0xA77B0000U &&
118 + jmp == 0x6BFB0000U)
119 + {
120 + unsigned long r27, addr;
121 + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
122 + unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
123 +
124 + addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
125 + err = get_user(r27, (unsigned long *)addr);
126 + if (err)
127 + break;
128 +
129 + regs->r27 = r27;
130 + regs->pc = r27;
131 + return 2;
132 + }
133 + } while (0);
134 +
135 + do { /* PaX: patched PLT emulation #2 */
136 + unsigned int ldah, lda, br;
137 +
138 + err = get_user(ldah, (unsigned int *)regs->pc);
139 + err |= get_user(lda, (unsigned int *)(regs->pc+4));
140 + err |= get_user(br, (unsigned int *)(regs->pc+8));
141 +
142 + if (err)
143 + break;
144 +
145 + if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
146 + (lda & 0xFFFF0000U) == 0xA77B0000U &&
147 + (br & 0xFFE00000U) == 0xC3E00000U)
148 + {
149 + unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
150 + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
151 + unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
152 +
153 + regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
154 + regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
155 + return 2;
156 + }
157 + } while (0);
158 +
159 + do { /* PaX: unpatched PLT emulation */
160 + unsigned int br;
161 +
162 + err = get_user(br, (unsigned int *)regs->pc);
163 +
164 + if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
165 + unsigned int br2, ldq, nop, jmp;
166 + unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
167 +
168 + addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
169 + err = get_user(br2, (unsigned int *)addr);
170 + err |= get_user(ldq, (unsigned int *)(addr+4));
171 + err |= get_user(nop, (unsigned int *)(addr+8));
172 + err |= get_user(jmp, (unsigned int *)(addr+12));
173 + err |= get_user(resolver, (unsigned long *)(addr+16));
174 +
175 + if (err)
176 + break;
177 +
178 + if (br2 == 0xC3600000U &&
179 + ldq == 0xA77B000CU &&
180 + nop == 0x47FF041FU &&
181 + jmp == 0x6B7B0000U)
182 + {
183 + regs->r28 = regs->pc+4;
184 + regs->r27 = addr+16;
185 + regs->pc = resolver;
186 + return 3;
187 + }
188 + }
189 + } while (0);
190 +#endif
191 +
192 + return 1;
193 +}
194 +
195 +void pax_report_insns(void *pc, void *sp)
196 +{
197 + unsigned long i;
198 +
199 + printk(KERN_ERR "PAX: bytes at PC: ");
200 + for (i = 0; i < 5; i++) {
201 + unsigned int c;
202 + if (get_user(c, (unsigned int *)pc+i))
203 + printk(KERN_CONT "???????? ");
204 + else
205 + printk(KERN_CONT "%08x ", c);
206 + }
207 + printk("\n");
208 +}
209 +#endif
210
211 /*
212 * This routine handles page faults. It determines the address,
213 @@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns
214 good_area:
215 si_code = SEGV_ACCERR;
216 if (cause < 0) {
217 - if (!(vma->vm_flags & VM_EXEC))
218 + if (!(vma->vm_flags & VM_EXEC)) {
219 +
220 +#ifdef CONFIG_PAX_PAGEEXEC
221 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
222 + goto bad_area;
223 +
224 + up_read(&mm->mmap_sem);
225 + switch (pax_handle_fetch_fault(regs)) {
226 +
227 +#ifdef CONFIG_PAX_EMUPLT
228 + case 2:
229 + case 3:
230 + return;
231 +#endif
232 +
233 + }
234 + pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
235 + do_group_exit(SIGKILL);
236 +#else
237 goto bad_area;
238 +#endif
239 +
240 + }
241 } else if (!cause) {
242 /* Allow reads even for write-only mappings */
243 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
244 diff -urNp linux-3.0.8/arch/arm/include/asm/elf.h linux-3.0.8/arch/arm/include/asm/elf.h
245 --- linux-3.0.8/arch/arm/include/asm/elf.h 2011-07-21 22:17:23.000000000 -0400
246 +++ linux-3.0.8/arch/arm/include/asm/elf.h 2011-08-23 21:47:55.000000000 -0400
247 @@ -116,7 +116,14 @@ int dump_task_regs(struct task_struct *t
248 the loader. We need to make sure that it is out of the way of the program
249 that it will "exec", and that there is sufficient room for the brk. */
250
251 -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
252 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
253 +
254 +#ifdef CONFIG_PAX_ASLR
255 +#define PAX_ELF_ET_DYN_BASE 0x00008000UL
256 +
257 +#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
258 +#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
259 +#endif
260
261 /* When the program starts, a1 contains a pointer to a function to be
262 registered with atexit, as per the SVR4 ABI. A value of 0 means we
263 @@ -126,10 +133,6 @@ int dump_task_regs(struct task_struct *t
264 extern void elf_set_personality(const struct elf32_hdr *);
265 #define SET_PERSONALITY(ex) elf_set_personality(&(ex))
266
267 -struct mm_struct;
268 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
269 -#define arch_randomize_brk arch_randomize_brk
270 -
271 extern int vectors_user_mapping(void);
272 #define arch_setup_additional_pages(bprm, uses_interp) vectors_user_mapping()
273 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES
274 diff -urNp linux-3.0.8/arch/arm/include/asm/kmap_types.h linux-3.0.8/arch/arm/include/asm/kmap_types.h
275 --- linux-3.0.8/arch/arm/include/asm/kmap_types.h 2011-07-21 22:17:23.000000000 -0400
276 +++ linux-3.0.8/arch/arm/include/asm/kmap_types.h 2011-08-23 21:47:55.000000000 -0400
277 @@ -21,6 +21,7 @@ enum km_type {
278 KM_L1_CACHE,
279 KM_L2_CACHE,
280 KM_KDB,
281 + KM_CLEARPAGE,
282 KM_TYPE_NR
283 };
284
285 diff -urNp linux-3.0.8/arch/arm/include/asm/uaccess.h linux-3.0.8/arch/arm/include/asm/uaccess.h
286 --- linux-3.0.8/arch/arm/include/asm/uaccess.h 2011-07-21 22:17:23.000000000 -0400
287 +++ linux-3.0.8/arch/arm/include/asm/uaccess.h 2011-08-23 21:47:55.000000000 -0400
288 @@ -22,6 +22,8 @@
289 #define VERIFY_READ 0
290 #define VERIFY_WRITE 1
291
292 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
293 +
294 /*
295 * The exception table consists of pairs of addresses: the first is the
296 * address of an instruction that is allowed to fault, and the second is
297 @@ -387,8 +389,23 @@ do { \
298
299
300 #ifdef CONFIG_MMU
301 -extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
302 -extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
303 +extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n);
304 +extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n);
305 +
306 +static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
307 +{
308 + if (!__builtin_constant_p(n))
309 + check_object_size(to, n, false);
310 + return ___copy_from_user(to, from, n);
311 +}
312 +
313 +static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
314 +{
315 + if (!__builtin_constant_p(n))
316 + check_object_size(from, n, true);
317 + return ___copy_to_user(to, from, n);
318 +}
319 +
320 extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
321 extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
322 extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
323 @@ -403,6 +420,9 @@ extern unsigned long __must_check __strn
324
325 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
326 {
327 + if ((long)n < 0)
328 + return n;
329 +
330 if (access_ok(VERIFY_READ, from, n))
331 n = __copy_from_user(to, from, n);
332 else /* security hole - plug it */
333 @@ -412,6 +432,9 @@ static inline unsigned long __must_check
334
335 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
336 {
337 + if ((long)n < 0)
338 + return n;
339 +
340 if (access_ok(VERIFY_WRITE, to, n))
341 n = __copy_to_user(to, from, n);
342 return n;
343 diff -urNp linux-3.0.8/arch/arm/kernel/armksyms.c linux-3.0.8/arch/arm/kernel/armksyms.c
344 --- linux-3.0.8/arch/arm/kernel/armksyms.c 2011-07-21 22:17:23.000000000 -0400
345 +++ linux-3.0.8/arch/arm/kernel/armksyms.c 2011-08-23 21:47:55.000000000 -0400
346 @@ -98,8 +98,8 @@ EXPORT_SYMBOL(__strncpy_from_user);
347 #ifdef CONFIG_MMU
348 EXPORT_SYMBOL(copy_page);
349
350 -EXPORT_SYMBOL(__copy_from_user);
351 -EXPORT_SYMBOL(__copy_to_user);
352 +EXPORT_SYMBOL(___copy_from_user);
353 +EXPORT_SYMBOL(___copy_to_user);
354 EXPORT_SYMBOL(__clear_user);
355
356 EXPORT_SYMBOL(__get_user_1);
357 diff -urNp linux-3.0.8/arch/arm/kernel/process.c linux-3.0.8/arch/arm/kernel/process.c
358 --- linux-3.0.8/arch/arm/kernel/process.c 2011-07-21 22:17:23.000000000 -0400
359 +++ linux-3.0.8/arch/arm/kernel/process.c 2011-08-23 21:47:55.000000000 -0400
360 @@ -28,7 +28,6 @@
361 #include <linux/tick.h>
362 #include <linux/utsname.h>
363 #include <linux/uaccess.h>
364 -#include <linux/random.h>
365 #include <linux/hw_breakpoint.h>
366
367 #include <asm/cacheflush.h>
368 @@ -479,12 +478,6 @@ unsigned long get_wchan(struct task_stru
369 return 0;
370 }
371
372 -unsigned long arch_randomize_brk(struct mm_struct *mm)
373 -{
374 - unsigned long range_end = mm->brk + 0x02000000;
375 - return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
376 -}
377 -
378 #ifdef CONFIG_MMU
379 /*
380 * The vectors page is always readable from user space for the
381 diff -urNp linux-3.0.8/arch/arm/kernel/traps.c linux-3.0.8/arch/arm/kernel/traps.c
382 --- linux-3.0.8/arch/arm/kernel/traps.c 2011-07-21 22:17:23.000000000 -0400
383 +++ linux-3.0.8/arch/arm/kernel/traps.c 2011-08-23 21:48:14.000000000 -0400
384 @@ -257,6 +257,8 @@ static int __die(const char *str, int er
385
386 static DEFINE_SPINLOCK(die_lock);
387
388 +extern void gr_handle_kernel_exploit(void);
389 +
390 /*
391 * This function is protected against re-entrancy.
392 */
393 @@ -284,6 +286,9 @@ void die(const char *str, struct pt_regs
394 panic("Fatal exception in interrupt");
395 if (panic_on_oops)
396 panic("Fatal exception");
397 +
398 + gr_handle_kernel_exploit();
399 +
400 if (ret != NOTIFY_STOP)
401 do_exit(SIGSEGV);
402 }
403 diff -urNp linux-3.0.8/arch/arm/lib/copy_from_user.S linux-3.0.8/arch/arm/lib/copy_from_user.S
404 --- linux-3.0.8/arch/arm/lib/copy_from_user.S 2011-07-21 22:17:23.000000000 -0400
405 +++ linux-3.0.8/arch/arm/lib/copy_from_user.S 2011-08-23 21:47:55.000000000 -0400
406 @@ -16,7 +16,7 @@
407 /*
408 * Prototype:
409 *
410 - * size_t __copy_from_user(void *to, const void *from, size_t n)
411 + * size_t ___copy_from_user(void *to, const void *from, size_t n)
412 *
413 * Purpose:
414 *
415 @@ -84,11 +84,11 @@
416
417 .text
418
419 -ENTRY(__copy_from_user)
420 +ENTRY(___copy_from_user)
421
422 #include "copy_template.S"
423
424 -ENDPROC(__copy_from_user)
425 +ENDPROC(___copy_from_user)
426
427 .pushsection .fixup,"ax"
428 .align 0
429 diff -urNp linux-3.0.8/arch/arm/lib/copy_to_user.S linux-3.0.8/arch/arm/lib/copy_to_user.S
430 --- linux-3.0.8/arch/arm/lib/copy_to_user.S 2011-07-21 22:17:23.000000000 -0400
431 +++ linux-3.0.8/arch/arm/lib/copy_to_user.S 2011-08-23 21:47:55.000000000 -0400
432 @@ -16,7 +16,7 @@
433 /*
434 * Prototype:
435 *
436 - * size_t __copy_to_user(void *to, const void *from, size_t n)
437 + * size_t ___copy_to_user(void *to, const void *from, size_t n)
438 *
439 * Purpose:
440 *
441 @@ -88,11 +88,11 @@
442 .text
443
444 ENTRY(__copy_to_user_std)
445 -WEAK(__copy_to_user)
446 +WEAK(___copy_to_user)
447
448 #include "copy_template.S"
449
450 -ENDPROC(__copy_to_user)
451 +ENDPROC(___copy_to_user)
452 ENDPROC(__copy_to_user_std)
453
454 .pushsection .fixup,"ax"
455 diff -urNp linux-3.0.8/arch/arm/lib/uaccess.S linux-3.0.8/arch/arm/lib/uaccess.S
456 --- linux-3.0.8/arch/arm/lib/uaccess.S 2011-07-21 22:17:23.000000000 -0400
457 +++ linux-3.0.8/arch/arm/lib/uaccess.S 2011-08-23 21:47:55.000000000 -0400
458 @@ -20,7 +20,7 @@
459
460 #define PAGE_SHIFT 12
461
462 -/* Prototype: int __copy_to_user(void *to, const char *from, size_t n)
463 +/* Prototype: int ___copy_to_user(void *to, const char *from, size_t n)
464 * Purpose : copy a block to user memory from kernel memory
465 * Params : to - user memory
466 * : from - kernel memory
467 @@ -40,7 +40,7 @@ USER( T(strgtb) r3, [r0], #1) @ May f
468 sub r2, r2, ip
469 b .Lc2u_dest_aligned
470
471 -ENTRY(__copy_to_user)
472 +ENTRY(___copy_to_user)
473 stmfd sp!, {r2, r4 - r7, lr}
474 cmp r2, #4
475 blt .Lc2u_not_enough
476 @@ -278,14 +278,14 @@ USER( T(strgeb) r3, [r0], #1) @ May f
477 ldrgtb r3, [r1], #0
478 USER( T(strgtb) r3, [r0], #1) @ May fault
479 b .Lc2u_finished
480 -ENDPROC(__copy_to_user)
481 +ENDPROC(___copy_to_user)
482
483 .pushsection .fixup,"ax"
484 .align 0
485 9001: ldmfd sp!, {r0, r4 - r7, pc}
486 .popsection
487
488 -/* Prototype: unsigned long __copy_from_user(void *to,const void *from,unsigned long n);
489 +/* Prototype: unsigned long ___copy_from_user(void *to,const void *from,unsigned long n);
490 * Purpose : copy a block from user memory to kernel memory
491 * Params : to - kernel memory
492 * : from - user memory
493 @@ -304,7 +304,7 @@ USER( T(ldrgtb) r3, [r1], #1) @ May f
494 sub r2, r2, ip
495 b .Lcfu_dest_aligned
496
497 -ENTRY(__copy_from_user)
498 +ENTRY(___copy_from_user)
499 stmfd sp!, {r0, r2, r4 - r7, lr}
500 cmp r2, #4
501 blt .Lcfu_not_enough
502 @@ -544,7 +544,7 @@ USER( T(ldrgeb) r3, [r1], #1) @ May f
503 USER( T(ldrgtb) r3, [r1], #1) @ May fault
504 strgtb r3, [r0], #1
505 b .Lcfu_finished
506 -ENDPROC(__copy_from_user)
507 +ENDPROC(___copy_from_user)
508
509 .pushsection .fixup,"ax"
510 .align 0
511 diff -urNp linux-3.0.8/arch/arm/lib/uaccess_with_memcpy.c linux-3.0.8/arch/arm/lib/uaccess_with_memcpy.c
512 --- linux-3.0.8/arch/arm/lib/uaccess_with_memcpy.c 2011-07-21 22:17:23.000000000 -0400
513 +++ linux-3.0.8/arch/arm/lib/uaccess_with_memcpy.c 2011-08-23 21:47:55.000000000 -0400
514 @@ -103,7 +103,7 @@ out:
515 }
516
517 unsigned long
518 -__copy_to_user(void __user *to, const void *from, unsigned long n)
519 +___copy_to_user(void __user *to, const void *from, unsigned long n)
520 {
521 /*
522 * This test is stubbed out of the main function above to keep
523 diff -urNp linux-3.0.8/arch/arm/mach-ux500/mbox-db5500.c linux-3.0.8/arch/arm/mach-ux500/mbox-db5500.c
524 --- linux-3.0.8/arch/arm/mach-ux500/mbox-db5500.c 2011-07-21 22:17:23.000000000 -0400
525 +++ linux-3.0.8/arch/arm/mach-ux500/mbox-db5500.c 2011-08-23 21:48:14.000000000 -0400
526 @@ -168,7 +168,7 @@ static ssize_t mbox_read_fifo(struct dev
527 return sprintf(buf, "0x%X\n", mbox_value);
528 }
529
530 -static DEVICE_ATTR(fifo, S_IWUGO | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
531 +static DEVICE_ATTR(fifo, S_IWUSR | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
532
533 static int mbox_show(struct seq_file *s, void *data)
534 {
535 diff -urNp linux-3.0.8/arch/arm/mm/fault.c linux-3.0.8/arch/arm/mm/fault.c
536 --- linux-3.0.8/arch/arm/mm/fault.c 2011-07-21 22:17:23.000000000 -0400
537 +++ linux-3.0.8/arch/arm/mm/fault.c 2011-08-23 21:47:55.000000000 -0400
538 @@ -182,6 +182,13 @@ __do_user_fault(struct task_struct *tsk,
539 }
540 #endif
541
542 +#ifdef CONFIG_PAX_PAGEEXEC
543 + if (fsr & FSR_LNX_PF) {
544 + pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
545 + do_group_exit(SIGKILL);
546 + }
547 +#endif
548 +
549 tsk->thread.address = addr;
550 tsk->thread.error_code = fsr;
551 tsk->thread.trap_no = 14;
552 @@ -379,6 +386,33 @@ do_page_fault(unsigned long addr, unsign
553 }
554 #endif /* CONFIG_MMU */
555
556 +#ifdef CONFIG_PAX_PAGEEXEC
557 +void pax_report_insns(void *pc, void *sp)
558 +{
559 + long i;
560 +
561 + printk(KERN_ERR "PAX: bytes at PC: ");
562 + for (i = 0; i < 20; i++) {
563 + unsigned char c;
564 + if (get_user(c, (__force unsigned char __user *)pc+i))
565 + printk(KERN_CONT "?? ");
566 + else
567 + printk(KERN_CONT "%02x ", c);
568 + }
569 + printk("\n");
570 +
571 + printk(KERN_ERR "PAX: bytes at SP-4: ");
572 + for (i = -1; i < 20; i++) {
573 + unsigned long c;
574 + if (get_user(c, (__force unsigned long __user *)sp+i))
575 + printk(KERN_CONT "???????? ");
576 + else
577 + printk(KERN_CONT "%08lx ", c);
578 + }
579 + printk("\n");
580 +}
581 +#endif
582 +
583 /*
584 * First Level Translation Fault Handler
585 *
586 diff -urNp linux-3.0.8/arch/arm/mm/mmap.c linux-3.0.8/arch/arm/mm/mmap.c
587 --- linux-3.0.8/arch/arm/mm/mmap.c 2011-07-21 22:17:23.000000000 -0400
588 +++ linux-3.0.8/arch/arm/mm/mmap.c 2011-08-23 21:47:55.000000000 -0400
589 @@ -65,6 +65,10 @@ arch_get_unmapped_area(struct file *filp
590 if (len > TASK_SIZE)
591 return -ENOMEM;
592
593 +#ifdef CONFIG_PAX_RANDMMAP
594 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
595 +#endif
596 +
597 if (addr) {
598 if (do_align)
599 addr = COLOUR_ALIGN(addr, pgoff);
600 @@ -72,15 +76,14 @@ arch_get_unmapped_area(struct file *filp
601 addr = PAGE_ALIGN(addr);
602
603 vma = find_vma(mm, addr);
604 - if (TASK_SIZE - len >= addr &&
605 - (!vma || addr + len <= vma->vm_start))
606 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
607 return addr;
608 }
609 if (len > mm->cached_hole_size) {
610 - start_addr = addr = mm->free_area_cache;
611 + start_addr = addr = mm->free_area_cache;
612 } else {
613 - start_addr = addr = TASK_UNMAPPED_BASE;
614 - mm->cached_hole_size = 0;
615 + start_addr = addr = mm->mmap_base;
616 + mm->cached_hole_size = 0;
617 }
618 /* 8 bits of randomness in 20 address space bits */
619 if ((current->flags & PF_RANDOMIZE) &&
620 @@ -100,14 +103,14 @@ full_search:
621 * Start a new search - just in case we missed
622 * some holes.
623 */
624 - if (start_addr != TASK_UNMAPPED_BASE) {
625 - start_addr = addr = TASK_UNMAPPED_BASE;
626 + if (start_addr != mm->mmap_base) {
627 + start_addr = addr = mm->mmap_base;
628 mm->cached_hole_size = 0;
629 goto full_search;
630 }
631 return -ENOMEM;
632 }
633 - if (!vma || addr + len <= vma->vm_start) {
634 + if (check_heap_stack_gap(vma, addr, len)) {
635 /*
636 * Remember the place where we stopped the search:
637 */
638 diff -urNp linux-3.0.8/arch/avr32/include/asm/elf.h linux-3.0.8/arch/avr32/include/asm/elf.h
639 --- linux-3.0.8/arch/avr32/include/asm/elf.h 2011-07-21 22:17:23.000000000 -0400
640 +++ linux-3.0.8/arch/avr32/include/asm/elf.h 2011-08-23 21:47:55.000000000 -0400
641 @@ -84,8 +84,14 @@ typedef struct user_fpu_struct elf_fpreg
642 the loader. We need to make sure that it is out of the way of the program
643 that it will "exec", and that there is sufficient room for the brk. */
644
645 -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
646 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
647
648 +#ifdef CONFIG_PAX_ASLR
649 +#define PAX_ELF_ET_DYN_BASE 0x00001000UL
650 +
651 +#define PAX_DELTA_MMAP_LEN 15
652 +#define PAX_DELTA_STACK_LEN 15
653 +#endif
654
655 /* This yields a mask that user programs can use to figure out what
656 instruction set this CPU supports. This could be done in user space,
657 diff -urNp linux-3.0.8/arch/avr32/include/asm/kmap_types.h linux-3.0.8/arch/avr32/include/asm/kmap_types.h
658 --- linux-3.0.8/arch/avr32/include/asm/kmap_types.h 2011-07-21 22:17:23.000000000 -0400
659 +++ linux-3.0.8/arch/avr32/include/asm/kmap_types.h 2011-08-23 21:47:55.000000000 -0400
660 @@ -22,7 +22,8 @@ D(10) KM_IRQ0,
661 D(11) KM_IRQ1,
662 D(12) KM_SOFTIRQ0,
663 D(13) KM_SOFTIRQ1,
664 -D(14) KM_TYPE_NR
665 +D(14) KM_CLEARPAGE,
666 +D(15) KM_TYPE_NR
667 };
668
669 #undef D
670 diff -urNp linux-3.0.8/arch/avr32/mm/fault.c linux-3.0.8/arch/avr32/mm/fault.c
671 --- linux-3.0.8/arch/avr32/mm/fault.c 2011-07-21 22:17:23.000000000 -0400
672 +++ linux-3.0.8/arch/avr32/mm/fault.c 2011-08-23 21:47:55.000000000 -0400
673 @@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
674
675 int exception_trace = 1;
676
677 +#ifdef CONFIG_PAX_PAGEEXEC
678 +void pax_report_insns(void *pc, void *sp)
679 +{
680 + unsigned long i;
681 +
682 + printk(KERN_ERR "PAX: bytes at PC: ");
683 + for (i = 0; i < 20; i++) {
684 + unsigned char c;
685 + if (get_user(c, (unsigned char *)pc+i))
686 + printk(KERN_CONT "???????? ");
687 + else
688 + printk(KERN_CONT "%02x ", c);
689 + }
690 + printk("\n");
691 +}
692 +#endif
693 +
694 /*
695 * This routine handles page faults. It determines the address and the
696 * problem, and then passes it off to one of the appropriate routines.
697 @@ -156,6 +173,16 @@ bad_area:
698 up_read(&mm->mmap_sem);
699
700 if (user_mode(regs)) {
701 +
702 +#ifdef CONFIG_PAX_PAGEEXEC
703 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
704 + if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
705 + pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
706 + do_group_exit(SIGKILL);
707 + }
708 + }
709 +#endif
710 +
711 if (exception_trace && printk_ratelimit())
712 printk("%s%s[%d]: segfault at %08lx pc %08lx "
713 "sp %08lx ecr %lu\n",
714 diff -urNp linux-3.0.8/arch/frv/include/asm/kmap_types.h linux-3.0.8/arch/frv/include/asm/kmap_types.h
715 --- linux-3.0.8/arch/frv/include/asm/kmap_types.h 2011-07-21 22:17:23.000000000 -0400
716 +++ linux-3.0.8/arch/frv/include/asm/kmap_types.h 2011-08-23 21:47:55.000000000 -0400
717 @@ -23,6 +23,7 @@ enum km_type {
718 KM_IRQ1,
719 KM_SOFTIRQ0,
720 KM_SOFTIRQ1,
721 + KM_CLEARPAGE,
722 KM_TYPE_NR
723 };
724
725 diff -urNp linux-3.0.8/arch/frv/mm/elf-fdpic.c linux-3.0.8/arch/frv/mm/elf-fdpic.c
726 --- linux-3.0.8/arch/frv/mm/elf-fdpic.c 2011-07-21 22:17:23.000000000 -0400
727 +++ linux-3.0.8/arch/frv/mm/elf-fdpic.c 2011-08-23 21:47:55.000000000 -0400
728 @@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(str
729 if (addr) {
730 addr = PAGE_ALIGN(addr);
731 vma = find_vma(current->mm, addr);
732 - if (TASK_SIZE - len >= addr &&
733 - (!vma || addr + len <= vma->vm_start))
734 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
735 goto success;
736 }
737
738 @@ -89,7 +88,7 @@ unsigned long arch_get_unmapped_area(str
739 for (; vma; vma = vma->vm_next) {
740 if (addr > limit)
741 break;
742 - if (addr + len <= vma->vm_start)
743 + if (check_heap_stack_gap(vma, addr, len))
744 goto success;
745 addr = vma->vm_end;
746 }
747 @@ -104,7 +103,7 @@ unsigned long arch_get_unmapped_area(str
748 for (; vma; vma = vma->vm_next) {
749 if (addr > limit)
750 break;
751 - if (addr + len <= vma->vm_start)
752 + if (check_heap_stack_gap(vma, addr, len))
753 goto success;
754 addr = vma->vm_end;
755 }
756 diff -urNp linux-3.0.8/arch/ia64/include/asm/elf.h linux-3.0.8/arch/ia64/include/asm/elf.h
757 --- linux-3.0.8/arch/ia64/include/asm/elf.h 2011-07-21 22:17:23.000000000 -0400
758 +++ linux-3.0.8/arch/ia64/include/asm/elf.h 2011-08-23 21:47:55.000000000 -0400
759 @@ -42,6 +42,13 @@
760 */
761 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
762
763 +#ifdef CONFIG_PAX_ASLR
764 +#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
765 +
766 +#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
767 +#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
768 +#endif
769 +
770 #define PT_IA_64_UNWIND 0x70000001
771
772 /* IA-64 relocations: */
773 diff -urNp linux-3.0.8/arch/ia64/include/asm/pgtable.h linux-3.0.8/arch/ia64/include/asm/pgtable.h
774 --- linux-3.0.8/arch/ia64/include/asm/pgtable.h 2011-07-21 22:17:23.000000000 -0400
775 +++ linux-3.0.8/arch/ia64/include/asm/pgtable.h 2011-08-23 21:47:55.000000000 -0400
776 @@ -12,7 +12,7 @@
777 * David Mosberger-Tang <davidm@hpl.hp.com>
778 */
779
780 -
781 +#include <linux/const.h>
782 #include <asm/mman.h>
783 #include <asm/page.h>
784 #include <asm/processor.h>
785 @@ -143,6 +143,17 @@
786 #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
787 #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
788 #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
789 +
790 +#ifdef CONFIG_PAX_PAGEEXEC
791 +# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
792 +# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
793 +# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
794 +#else
795 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
796 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
797 +# define PAGE_COPY_NOEXEC PAGE_COPY
798 +#endif
799 +
800 #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
801 #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
802 #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
803 diff -urNp linux-3.0.8/arch/ia64/include/asm/spinlock.h linux-3.0.8/arch/ia64/include/asm/spinlock.h
804 --- linux-3.0.8/arch/ia64/include/asm/spinlock.h 2011-07-21 22:17:23.000000000 -0400
805 +++ linux-3.0.8/arch/ia64/include/asm/spinlock.h 2011-08-23 21:47:55.000000000 -0400
806 @@ -72,7 +72,7 @@ static __always_inline void __ticket_spi
807 unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
808
809 asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
810 - ACCESS_ONCE(*p) = (tmp + 2) & ~1;
811 + ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
812 }
813
814 static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
815 diff -urNp linux-3.0.8/arch/ia64/include/asm/uaccess.h linux-3.0.8/arch/ia64/include/asm/uaccess.h
816 --- linux-3.0.8/arch/ia64/include/asm/uaccess.h 2011-07-21 22:17:23.000000000 -0400
817 +++ linux-3.0.8/arch/ia64/include/asm/uaccess.h 2011-08-23 21:47:55.000000000 -0400
818 @@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
819 const void *__cu_from = (from); \
820 long __cu_len = (n); \
821 \
822 - if (__access_ok(__cu_to, __cu_len, get_fs())) \
823 + if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) \
824 __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
825 __cu_len; \
826 })
827 @@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _
828 long __cu_len = (n); \
829 \
830 __chk_user_ptr(__cu_from); \
831 - if (__access_ok(__cu_from, __cu_len, get_fs())) \
832 + if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) \
833 __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
834 __cu_len; \
835 })
836 diff -urNp linux-3.0.8/arch/ia64/kernel/module.c linux-3.0.8/arch/ia64/kernel/module.c
837 --- linux-3.0.8/arch/ia64/kernel/module.c 2011-07-21 22:17:23.000000000 -0400
838 +++ linux-3.0.8/arch/ia64/kernel/module.c 2011-08-23 21:47:55.000000000 -0400
839 @@ -315,8 +315,7 @@ module_alloc (unsigned long size)
840 void
841 module_free (struct module *mod, void *module_region)
842 {
843 - if (mod && mod->arch.init_unw_table &&
844 - module_region == mod->module_init) {
845 + if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
846 unw_remove_unwind_table(mod->arch.init_unw_table);
847 mod->arch.init_unw_table = NULL;
848 }
849 @@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
850 }
851
852 static inline int
853 +in_init_rx (const struct module *mod, uint64_t addr)
854 +{
855 + return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
856 +}
857 +
858 +static inline int
859 +in_init_rw (const struct module *mod, uint64_t addr)
860 +{
861 + return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
862 +}
863 +
864 +static inline int
865 in_init (const struct module *mod, uint64_t addr)
866 {
867 - return addr - (uint64_t) mod->module_init < mod->init_size;
868 + return in_init_rx(mod, addr) || in_init_rw(mod, addr);
869 +}
870 +
871 +static inline int
872 +in_core_rx (const struct module *mod, uint64_t addr)
873 +{
874 + return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
875 +}
876 +
877 +static inline int
878 +in_core_rw (const struct module *mod, uint64_t addr)
879 +{
880 + return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
881 }
882
883 static inline int
884 in_core (const struct module *mod, uint64_t addr)
885 {
886 - return addr - (uint64_t) mod->module_core < mod->core_size;
887 + return in_core_rx(mod, addr) || in_core_rw(mod, addr);
888 }
889
890 static inline int
891 @@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_
892 break;
893
894 case RV_BDREL:
895 - val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
896 + if (in_init_rx(mod, val))
897 + val -= (uint64_t) mod->module_init_rx;
898 + else if (in_init_rw(mod, val))
899 + val -= (uint64_t) mod->module_init_rw;
900 + else if (in_core_rx(mod, val))
901 + val -= (uint64_t) mod->module_core_rx;
902 + else if (in_core_rw(mod, val))
903 + val -= (uint64_t) mod->module_core_rw;
904 break;
905
906 case RV_LTV:
907 @@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
908 * addresses have been selected...
909 */
910 uint64_t gp;
911 - if (mod->core_size > MAX_LTOFF)
912 + if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
913 /*
914 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
915 * at the end of the module.
916 */
917 - gp = mod->core_size - MAX_LTOFF / 2;
918 + gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
919 else
920 - gp = mod->core_size / 2;
921 - gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
922 + gp = (mod->core_size_rx + mod->core_size_rw) / 2;
923 + gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
924 mod->arch.gp = gp;
925 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
926 }
927 diff -urNp linux-3.0.8/arch/ia64/kernel/sys_ia64.c linux-3.0.8/arch/ia64/kernel/sys_ia64.c
928 --- linux-3.0.8/arch/ia64/kernel/sys_ia64.c 2011-07-21 22:17:23.000000000 -0400
929 +++ linux-3.0.8/arch/ia64/kernel/sys_ia64.c 2011-08-23 21:47:55.000000000 -0400
930 @@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
931 if (REGION_NUMBER(addr) == RGN_HPAGE)
932 addr = 0;
933 #endif
934 +
935 +#ifdef CONFIG_PAX_RANDMMAP
936 + if (mm->pax_flags & MF_PAX_RANDMMAP)
937 + addr = mm->free_area_cache;
938 + else
939 +#endif
940 +
941 if (!addr)
942 addr = mm->free_area_cache;
943
944 @@ -61,14 +68,14 @@ arch_get_unmapped_area (struct file *fil
945 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
946 /* At this point: (!vma || addr < vma->vm_end). */
947 if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
948 - if (start_addr != TASK_UNMAPPED_BASE) {
949 + if (start_addr != mm->mmap_base) {
950 /* Start a new search --- just in case we missed some holes. */
951 - addr = TASK_UNMAPPED_BASE;
952 + addr = mm->mmap_base;
953 goto full_search;
954 }
955 return -ENOMEM;
956 }
957 - if (!vma || addr + len <= vma->vm_start) {
958 + if (check_heap_stack_gap(vma, addr, len)) {
959 /* Remember the address where we stopped this search: */
960 mm->free_area_cache = addr + len;
961 return addr;
962 diff -urNp linux-3.0.8/arch/ia64/kernel/vmlinux.lds.S linux-3.0.8/arch/ia64/kernel/vmlinux.lds.S
963 --- linux-3.0.8/arch/ia64/kernel/vmlinux.lds.S 2011-07-21 22:17:23.000000000 -0400
964 +++ linux-3.0.8/arch/ia64/kernel/vmlinux.lds.S 2011-08-23 21:47:55.000000000 -0400
965 @@ -199,7 +199,7 @@ SECTIONS {
966 /* Per-cpu data: */
967 . = ALIGN(PERCPU_PAGE_SIZE);
968 PERCPU_VADDR(SMP_CACHE_BYTES, PERCPU_ADDR, :percpu)
969 - __phys_per_cpu_start = __per_cpu_load;
970 + __phys_per_cpu_start = per_cpu_load;
971 /*
972 * ensure percpu data fits
973 * into percpu page size
974 diff -urNp linux-3.0.8/arch/ia64/mm/fault.c linux-3.0.8/arch/ia64/mm/fault.c
975 --- linux-3.0.8/arch/ia64/mm/fault.c 2011-07-21 22:17:23.000000000 -0400
976 +++ linux-3.0.8/arch/ia64/mm/fault.c 2011-08-23 21:47:55.000000000 -0400
977 @@ -73,6 +73,23 @@ mapped_kernel_page_is_present (unsigned
978 return pte_present(pte);
979 }
980
981 +#ifdef CONFIG_PAX_PAGEEXEC
982 +void pax_report_insns(void *pc, void *sp)
983 +{
984 + unsigned long i;
985 +
986 + printk(KERN_ERR "PAX: bytes at PC: ");
987 + for (i = 0; i < 8; i++) {
988 + unsigned int c;
989 + if (get_user(c, (unsigned int *)pc+i))
990 + printk(KERN_CONT "???????? ");
991 + else
992 + printk(KERN_CONT "%08x ", c);
993 + }
994 + printk("\n");
995 +}
996 +#endif
997 +
998 void __kprobes
999 ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
1000 {
1001 @@ -146,9 +163,23 @@ ia64_do_page_fault (unsigned long addres
1002 mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
1003 | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
1004
1005 - if ((vma->vm_flags & mask) != mask)
1006 + if ((vma->vm_flags & mask) != mask) {
1007 +
1008 +#ifdef CONFIG_PAX_PAGEEXEC
1009 + if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
1010 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
1011 + goto bad_area;
1012 +
1013 + up_read(&mm->mmap_sem);
1014 + pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
1015 + do_group_exit(SIGKILL);
1016 + }
1017 +#endif
1018 +
1019 goto bad_area;
1020
1021 + }
1022 +
1023 /*
1024 * If for any reason at all we couldn't handle the fault, make
1025 * sure we exit gracefully rather than endlessly redo the
1026 diff -urNp linux-3.0.8/arch/ia64/mm/hugetlbpage.c linux-3.0.8/arch/ia64/mm/hugetlbpage.c
1027 --- linux-3.0.8/arch/ia64/mm/hugetlbpage.c 2011-07-21 22:17:23.000000000 -0400
1028 +++ linux-3.0.8/arch/ia64/mm/hugetlbpage.c 2011-08-23 21:47:55.000000000 -0400
1029 @@ -171,7 +171,7 @@ unsigned long hugetlb_get_unmapped_area(
1030 /* At this point: (!vmm || addr < vmm->vm_end). */
1031 if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
1032 return -ENOMEM;
1033 - if (!vmm || (addr + len) <= vmm->vm_start)
1034 + if (check_heap_stack_gap(vmm, addr, len))
1035 return addr;
1036 addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
1037 }
1038 diff -urNp linux-3.0.8/arch/ia64/mm/init.c linux-3.0.8/arch/ia64/mm/init.c
1039 --- linux-3.0.8/arch/ia64/mm/init.c 2011-07-21 22:17:23.000000000 -0400
1040 +++ linux-3.0.8/arch/ia64/mm/init.c 2011-08-23 21:47:55.000000000 -0400
1041 @@ -120,6 +120,19 @@ ia64_init_addr_space (void)
1042 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
1043 vma->vm_end = vma->vm_start + PAGE_SIZE;
1044 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
1045 +
1046 +#ifdef CONFIG_PAX_PAGEEXEC
1047 + if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
1048 + vma->vm_flags &= ~VM_EXEC;
1049 +
1050 +#ifdef CONFIG_PAX_MPROTECT
1051 + if (current->mm->pax_flags & MF_PAX_MPROTECT)
1052 + vma->vm_flags &= ~VM_MAYEXEC;
1053 +#endif
1054 +
1055 + }
1056 +#endif
1057 +
1058 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
1059 down_write(&current->mm->mmap_sem);
1060 if (insert_vm_struct(current->mm, vma)) {
1061 diff -urNp linux-3.0.8/arch/m32r/lib/usercopy.c linux-3.0.8/arch/m32r/lib/usercopy.c
1062 --- linux-3.0.8/arch/m32r/lib/usercopy.c 2011-07-21 22:17:23.000000000 -0400
1063 +++ linux-3.0.8/arch/m32r/lib/usercopy.c 2011-08-23 21:47:55.000000000 -0400
1064 @@ -14,6 +14,9 @@
1065 unsigned long
1066 __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1067 {
1068 + if ((long)n < 0)
1069 + return n;
1070 +
1071 prefetch(from);
1072 if (access_ok(VERIFY_WRITE, to, n))
1073 __copy_user(to,from,n);
1074 @@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to,
1075 unsigned long
1076 __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
1077 {
1078 + if ((long)n < 0)
1079 + return n;
1080 +
1081 prefetchw(to);
1082 if (access_ok(VERIFY_READ, from, n))
1083 __copy_user_zeroing(to,from,n);
1084 diff -urNp linux-3.0.8/arch/mips/include/asm/elf.h linux-3.0.8/arch/mips/include/asm/elf.h
1085 --- linux-3.0.8/arch/mips/include/asm/elf.h 2011-07-21 22:17:23.000000000 -0400
1086 +++ linux-3.0.8/arch/mips/include/asm/elf.h 2011-08-23 21:47:55.000000000 -0400
1087 @@ -372,13 +372,16 @@ extern const char *__elf_platform;
1088 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1089 #endif
1090
1091 +#ifdef CONFIG_PAX_ASLR
1092 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
1093 +
1094 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1095 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1096 +#endif
1097 +
1098 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
1099 struct linux_binprm;
1100 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
1101 int uses_interp);
1102
1103 -struct mm_struct;
1104 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
1105 -#define arch_randomize_brk arch_randomize_brk
1106 -
1107 #endif /* _ASM_ELF_H */
1108 diff -urNp linux-3.0.8/arch/mips/include/asm/page.h linux-3.0.8/arch/mips/include/asm/page.h
1109 --- linux-3.0.8/arch/mips/include/asm/page.h 2011-07-21 22:17:23.000000000 -0400
1110 +++ linux-3.0.8/arch/mips/include/asm/page.h 2011-08-23 21:47:55.000000000 -0400
1111 @@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
1112 #ifdef CONFIG_CPU_MIPS32
1113 typedef struct { unsigned long pte_low, pte_high; } pte_t;
1114 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
1115 - #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
1116 + #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
1117 #else
1118 typedef struct { unsigned long long pte; } pte_t;
1119 #define pte_val(x) ((x).pte)
1120 diff -urNp linux-3.0.8/arch/mips/include/asm/system.h linux-3.0.8/arch/mips/include/asm/system.h
1121 --- linux-3.0.8/arch/mips/include/asm/system.h 2011-07-21 22:17:23.000000000 -0400
1122 +++ linux-3.0.8/arch/mips/include/asm/system.h 2011-08-23 21:47:55.000000000 -0400
1123 @@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
1124 */
1125 #define __ARCH_WANT_UNLOCKED_CTXSW
1126
1127 -extern unsigned long arch_align_stack(unsigned long sp);
1128 +#define arch_align_stack(x) ((x) & ~0xfUL)
1129
1130 #endif /* _ASM_SYSTEM_H */
1131 diff -urNp linux-3.0.8/arch/mips/kernel/binfmt_elfn32.c linux-3.0.8/arch/mips/kernel/binfmt_elfn32.c
1132 --- linux-3.0.8/arch/mips/kernel/binfmt_elfn32.c 2011-07-21 22:17:23.000000000 -0400
1133 +++ linux-3.0.8/arch/mips/kernel/binfmt_elfn32.c 2011-08-23 21:47:55.000000000 -0400
1134 @@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
1135 #undef ELF_ET_DYN_BASE
1136 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
1137
1138 +#ifdef CONFIG_PAX_ASLR
1139 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
1140 +
1141 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1142 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1143 +#endif
1144 +
1145 #include <asm/processor.h>
1146 #include <linux/module.h>
1147 #include <linux/elfcore.h>
1148 diff -urNp linux-3.0.8/arch/mips/kernel/binfmt_elfo32.c linux-3.0.8/arch/mips/kernel/binfmt_elfo32.c
1149 --- linux-3.0.8/arch/mips/kernel/binfmt_elfo32.c 2011-07-21 22:17:23.000000000 -0400
1150 +++ linux-3.0.8/arch/mips/kernel/binfmt_elfo32.c 2011-08-23 21:47:55.000000000 -0400
1151 @@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
1152 #undef ELF_ET_DYN_BASE
1153 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
1154
1155 +#ifdef CONFIG_PAX_ASLR
1156 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
1157 +
1158 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1159 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1160 +#endif
1161 +
1162 #include <asm/processor.h>
1163
1164 /*
1165 diff -urNp linux-3.0.8/arch/mips/kernel/process.c linux-3.0.8/arch/mips/kernel/process.c
1166 --- linux-3.0.8/arch/mips/kernel/process.c 2011-07-21 22:17:23.000000000 -0400
1167 +++ linux-3.0.8/arch/mips/kernel/process.c 2011-08-23 21:47:55.000000000 -0400
1168 @@ -473,15 +473,3 @@ unsigned long get_wchan(struct task_stru
1169 out:
1170 return pc;
1171 }
1172 -
1173 -/*
1174 - * Don't forget that the stack pointer must be aligned on a 8 bytes
1175 - * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
1176 - */
1177 -unsigned long arch_align_stack(unsigned long sp)
1178 -{
1179 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
1180 - sp -= get_random_int() & ~PAGE_MASK;
1181 -
1182 - return sp & ALMASK;
1183 -}
1184 diff -urNp linux-3.0.8/arch/mips/mm/fault.c linux-3.0.8/arch/mips/mm/fault.c
1185 --- linux-3.0.8/arch/mips/mm/fault.c 2011-07-21 22:17:23.000000000 -0400
1186 +++ linux-3.0.8/arch/mips/mm/fault.c 2011-08-23 21:47:55.000000000 -0400
1187 @@ -28,6 +28,23 @@
1188 #include <asm/highmem.h> /* For VMALLOC_END */
1189 #include <linux/kdebug.h>
1190
1191 +#ifdef CONFIG_PAX_PAGEEXEC
1192 +void pax_report_insns(void *pc, void *sp)
1193 +{
1194 + unsigned long i;
1195 +
1196 + printk(KERN_ERR "PAX: bytes at PC: ");
1197 + for (i = 0; i < 5; i++) {
1198 + unsigned int c;
1199 + if (get_user(c, (unsigned int *)pc+i))
1200 + printk(KERN_CONT "???????? ");
1201 + else
1202 + printk(KERN_CONT "%08x ", c);
1203 + }
1204 + printk("\n");
1205 +}
1206 +#endif
1207 +
1208 /*
1209 * This routine handles page faults. It determines the address,
1210 * and the problem, and then passes it off to one of the appropriate
1211 diff -urNp linux-3.0.8/arch/mips/mm/mmap.c linux-3.0.8/arch/mips/mm/mmap.c
1212 --- linux-3.0.8/arch/mips/mm/mmap.c 2011-07-21 22:17:23.000000000 -0400
1213 +++ linux-3.0.8/arch/mips/mm/mmap.c 2011-08-23 21:47:55.000000000 -0400
1214 @@ -48,14 +48,18 @@ unsigned long arch_get_unmapped_area(str
1215 do_color_align = 0;
1216 if (filp || (flags & MAP_SHARED))
1217 do_color_align = 1;
1218 +
1219 +#ifdef CONFIG_PAX_RANDMMAP
1220 + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
1221 +#endif
1222 +
1223 if (addr) {
1224 if (do_color_align)
1225 addr = COLOUR_ALIGN(addr, pgoff);
1226 else
1227 addr = PAGE_ALIGN(addr);
1228 vmm = find_vma(current->mm, addr);
1229 - if (TASK_SIZE - len >= addr &&
1230 - (!vmm || addr + len <= vmm->vm_start))
1231 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vmm, addr, len))
1232 return addr;
1233 }
1234 addr = current->mm->mmap_base;
1235 @@ -68,7 +72,7 @@ unsigned long arch_get_unmapped_area(str
1236 /* At this point: (!vmm || addr < vmm->vm_end). */
1237 if (TASK_SIZE - len < addr)
1238 return -ENOMEM;
1239 - if (!vmm || addr + len <= vmm->vm_start)
1240 + if (check_heap_stack_gap(vmm, addr, len))
1241 return addr;
1242 addr = vmm->vm_end;
1243 if (do_color_align)
1244 @@ -93,30 +97,3 @@ void arch_pick_mmap_layout(struct mm_str
1245 mm->get_unmapped_area = arch_get_unmapped_area;
1246 mm->unmap_area = arch_unmap_area;
1247 }
1248 -
1249 -static inline unsigned long brk_rnd(void)
1250 -{
1251 - unsigned long rnd = get_random_int();
1252 -
1253 - rnd = rnd << PAGE_SHIFT;
1254 - /* 8MB for 32bit, 256MB for 64bit */
1255 - if (TASK_IS_32BIT_ADDR)
1256 - rnd = rnd & 0x7ffffful;
1257 - else
1258 - rnd = rnd & 0xffffffful;
1259 -
1260 - return rnd;
1261 -}
1262 -
1263 -unsigned long arch_randomize_brk(struct mm_struct *mm)
1264 -{
1265 - unsigned long base = mm->brk;
1266 - unsigned long ret;
1267 -
1268 - ret = PAGE_ALIGN(base + brk_rnd());
1269 -
1270 - if (ret < mm->brk)
1271 - return mm->brk;
1272 -
1273 - return ret;
1274 -}
1275 diff -urNp linux-3.0.8/arch/parisc/include/asm/elf.h linux-3.0.8/arch/parisc/include/asm/elf.h
1276 --- linux-3.0.8/arch/parisc/include/asm/elf.h 2011-07-21 22:17:23.000000000 -0400
1277 +++ linux-3.0.8/arch/parisc/include/asm/elf.h 2011-08-23 21:47:55.000000000 -0400
1278 @@ -342,6 +342,13 @@ struct pt_regs; /* forward declaration..
1279
1280 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
1281
1282 +#ifdef CONFIG_PAX_ASLR
1283 +#define PAX_ELF_ET_DYN_BASE 0x10000UL
1284 +
1285 +#define PAX_DELTA_MMAP_LEN 16
1286 +#define PAX_DELTA_STACK_LEN 16
1287 +#endif
1288 +
1289 /* This yields a mask that user programs can use to figure out what
1290 instruction set this CPU supports. This could be done in user space,
1291 but it's not easy, and we've already done it here. */
1292 diff -urNp linux-3.0.8/arch/parisc/include/asm/pgtable.h linux-3.0.8/arch/parisc/include/asm/pgtable.h
1293 --- linux-3.0.8/arch/parisc/include/asm/pgtable.h 2011-07-21 22:17:23.000000000 -0400
1294 +++ linux-3.0.8/arch/parisc/include/asm/pgtable.h 2011-08-23 21:47:55.000000000 -0400
1295 @@ -210,6 +210,17 @@ struct vm_area_struct;
1296 #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
1297 #define PAGE_COPY PAGE_EXECREAD
1298 #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
1299 +
1300 +#ifdef CONFIG_PAX_PAGEEXEC
1301 +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
1302 +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1303 +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1304 +#else
1305 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
1306 +# define PAGE_COPY_NOEXEC PAGE_COPY
1307 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
1308 +#endif
1309 +
1310 #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
1311 #define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL_EXEC)
1312 #define PAGE_KERNEL_RWX __pgprot(_PAGE_KERNEL_RWX)
1313 diff -urNp linux-3.0.8/arch/parisc/kernel/module.c linux-3.0.8/arch/parisc/kernel/module.c
1314 --- linux-3.0.8/arch/parisc/kernel/module.c 2011-07-21 22:17:23.000000000 -0400
1315 +++ linux-3.0.8/arch/parisc/kernel/module.c 2011-08-23 21:47:55.000000000 -0400
1316 @@ -98,16 +98,38 @@
1317
1318 /* three functions to determine where in the module core
1319 * or init pieces the location is */
1320 +static inline int in_init_rx(struct module *me, void *loc)
1321 +{
1322 + return (loc >= me->module_init_rx &&
1323 + loc < (me->module_init_rx + me->init_size_rx));
1324 +}
1325 +
1326 +static inline int in_init_rw(struct module *me, void *loc)
1327 +{
1328 + return (loc >= me->module_init_rw &&
1329 + loc < (me->module_init_rw + me->init_size_rw));
1330 +}
1331 +
1332 static inline int in_init(struct module *me, void *loc)
1333 {
1334 - return (loc >= me->module_init &&
1335 - loc <= (me->module_init + me->init_size));
1336 + return in_init_rx(me, loc) || in_init_rw(me, loc);
1337 +}
1338 +
1339 +static inline int in_core_rx(struct module *me, void *loc)
1340 +{
1341 + return (loc >= me->module_core_rx &&
1342 + loc < (me->module_core_rx + me->core_size_rx));
1343 +}
1344 +
1345 +static inline int in_core_rw(struct module *me, void *loc)
1346 +{
1347 + return (loc >= me->module_core_rw &&
1348 + loc < (me->module_core_rw + me->core_size_rw));
1349 }
1350
1351 static inline int in_core(struct module *me, void *loc)
1352 {
1353 - return (loc >= me->module_core &&
1354 - loc <= (me->module_core + me->core_size));
1355 + return in_core_rx(me, loc) || in_core_rw(me, loc);
1356 }
1357
1358 static inline int in_local(struct module *me, void *loc)
1359 @@ -373,13 +395,13 @@ int module_frob_arch_sections(CONST Elf_
1360 }
1361
1362 /* align things a bit */
1363 - me->core_size = ALIGN(me->core_size, 16);
1364 - me->arch.got_offset = me->core_size;
1365 - me->core_size += gots * sizeof(struct got_entry);
1366 -
1367 - me->core_size = ALIGN(me->core_size, 16);
1368 - me->arch.fdesc_offset = me->core_size;
1369 - me->core_size += fdescs * sizeof(Elf_Fdesc);
1370 + me->core_size_rw = ALIGN(me->core_size_rw, 16);
1371 + me->arch.got_offset = me->core_size_rw;
1372 + me->core_size_rw += gots * sizeof(struct got_entry);
1373 +
1374 + me->core_size_rw = ALIGN(me->core_size_rw, 16);
1375 + me->arch.fdesc_offset = me->core_size_rw;
1376 + me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
1377
1378 me->arch.got_max = gots;
1379 me->arch.fdesc_max = fdescs;
1380 @@ -397,7 +419,7 @@ static Elf64_Word get_got(struct module
1381
1382 BUG_ON(value == 0);
1383
1384 - got = me->module_core + me->arch.got_offset;
1385 + got = me->module_core_rw + me->arch.got_offset;
1386 for (i = 0; got[i].addr; i++)
1387 if (got[i].addr == value)
1388 goto out;
1389 @@ -415,7 +437,7 @@ static Elf64_Word get_got(struct module
1390 #ifdef CONFIG_64BIT
1391 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
1392 {
1393 - Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
1394 + Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
1395
1396 if (!value) {
1397 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
1398 @@ -433,7 +455,7 @@ static Elf_Addr get_fdesc(struct module
1399
1400 /* Create new one */
1401 fdesc->addr = value;
1402 - fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1403 + fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1404 return (Elf_Addr)fdesc;
1405 }
1406 #endif /* CONFIG_64BIT */
1407 @@ -857,7 +879,7 @@ register_unwind_table(struct module *me,
1408
1409 table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
1410 end = table + sechdrs[me->arch.unwind_section].sh_size;
1411 - gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1412 + gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1413
1414 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
1415 me->arch.unwind_section, table, end, gp);
1416 diff -urNp linux-3.0.8/arch/parisc/kernel/sys_parisc.c linux-3.0.8/arch/parisc/kernel/sys_parisc.c
1417 --- linux-3.0.8/arch/parisc/kernel/sys_parisc.c 2011-07-21 22:17:23.000000000 -0400
1418 +++ linux-3.0.8/arch/parisc/kernel/sys_parisc.c 2011-08-23 21:47:55.000000000 -0400
1419 @@ -43,7 +43,7 @@ static unsigned long get_unshared_area(u
1420 /* At this point: (!vma || addr < vma->vm_end). */
1421 if (TASK_SIZE - len < addr)
1422 return -ENOMEM;
1423 - if (!vma || addr + len <= vma->vm_start)
1424 + if (check_heap_stack_gap(vma, addr, len))
1425 return addr;
1426 addr = vma->vm_end;
1427 }
1428 @@ -79,7 +79,7 @@ static unsigned long get_shared_area(str
1429 /* At this point: (!vma || addr < vma->vm_end). */
1430 if (TASK_SIZE - len < addr)
1431 return -ENOMEM;
1432 - if (!vma || addr + len <= vma->vm_start)
1433 + if (check_heap_stack_gap(vma, addr, len))
1434 return addr;
1435 addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
1436 if (addr < vma->vm_end) /* handle wraparound */
1437 @@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str
1438 if (flags & MAP_FIXED)
1439 return addr;
1440 if (!addr)
1441 - addr = TASK_UNMAPPED_BASE;
1442 + addr = current->mm->mmap_base;
1443
1444 if (filp) {
1445 addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
1446 diff -urNp linux-3.0.8/arch/parisc/kernel/traps.c linux-3.0.8/arch/parisc/kernel/traps.c
1447 --- linux-3.0.8/arch/parisc/kernel/traps.c 2011-07-21 22:17:23.000000000 -0400
1448 +++ linux-3.0.8/arch/parisc/kernel/traps.c 2011-08-23 21:47:55.000000000 -0400
1449 @@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
1450
1451 down_read(&current->mm->mmap_sem);
1452 vma = find_vma(current->mm,regs->iaoq[0]);
1453 - if (vma && (regs->iaoq[0] >= vma->vm_start)
1454 - && (vma->vm_flags & VM_EXEC)) {
1455 -
1456 + if (vma && (regs->iaoq[0] >= vma->vm_start)) {
1457 fault_address = regs->iaoq[0];
1458 fault_space = regs->iasq[0];
1459
1460 diff -urNp linux-3.0.8/arch/parisc/mm/fault.c linux-3.0.8/arch/parisc/mm/fault.c
1461 --- linux-3.0.8/arch/parisc/mm/fault.c 2011-07-21 22:17:23.000000000 -0400
1462 +++ linux-3.0.8/arch/parisc/mm/fault.c 2011-08-23 21:47:55.000000000 -0400
1463 @@ -15,6 +15,7 @@
1464 #include <linux/sched.h>
1465 #include <linux/interrupt.h>
1466 #include <linux/module.h>
1467 +#include <linux/unistd.h>
1468
1469 #include <asm/uaccess.h>
1470 #include <asm/traps.h>
1471 @@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex
1472 static unsigned long
1473 parisc_acctyp(unsigned long code, unsigned int inst)
1474 {
1475 - if (code == 6 || code == 16)
1476 + if (code == 6 || code == 7 || code == 16)
1477 return VM_EXEC;
1478
1479 switch (inst & 0xf0000000) {
1480 @@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign
1481 }
1482 #endif
1483
1484 +#ifdef CONFIG_PAX_PAGEEXEC
1485 +/*
1486 + * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
1487 + *
1488 + * returns 1 when task should be killed
1489 + * 2 when rt_sigreturn trampoline was detected
1490 + * 3 when unpatched PLT trampoline was detected
1491 + */
1492 +static int pax_handle_fetch_fault(struct pt_regs *regs)
1493 +{
1494 +
1495 +#ifdef CONFIG_PAX_EMUPLT
1496 + int err;
1497 +
1498 + do { /* PaX: unpatched PLT emulation */
1499 + unsigned int bl, depwi;
1500 +
1501 + err = get_user(bl, (unsigned int *)instruction_pointer(regs));
1502 + err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
1503 +
1504 + if (err)
1505 + break;
1506 +
1507 + if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
1508 + unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
1509 +
1510 + err = get_user(ldw, (unsigned int *)addr);
1511 + err |= get_user(bv, (unsigned int *)(addr+4));
1512 + err |= get_user(ldw2, (unsigned int *)(addr+8));
1513 +
1514 + if (err)
1515 + break;
1516 +
1517 + if (ldw == 0x0E801096U &&
1518 + bv == 0xEAC0C000U &&
1519 + ldw2 == 0x0E881095U)
1520 + {
1521 + unsigned int resolver, map;
1522 +
1523 + err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
1524 + err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
1525 + if (err)
1526 + break;
1527 +
1528 + regs->gr[20] = instruction_pointer(regs)+8;
1529 + regs->gr[21] = map;
1530 + regs->gr[22] = resolver;
1531 + regs->iaoq[0] = resolver | 3UL;
1532 + regs->iaoq[1] = regs->iaoq[0] + 4;
1533 + return 3;
1534 + }
1535 + }
1536 + } while (0);
1537 +#endif
1538 +
1539 +#ifdef CONFIG_PAX_EMUTRAMP
1540 +
1541 +#ifndef CONFIG_PAX_EMUSIGRT
1542 + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
1543 + return 1;
1544 +#endif
1545 +
1546 + do { /* PaX: rt_sigreturn emulation */
1547 + unsigned int ldi1, ldi2, bel, nop;
1548 +
1549 + err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
1550 + err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
1551 + err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
1552 + err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
1553 +
1554 + if (err)
1555 + break;
1556 +
1557 + if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
1558 + ldi2 == 0x3414015AU &&
1559 + bel == 0xE4008200U &&
1560 + nop == 0x08000240U)
1561 + {
1562 + regs->gr[25] = (ldi1 & 2) >> 1;
1563 + regs->gr[20] = __NR_rt_sigreturn;
1564 + regs->gr[31] = regs->iaoq[1] + 16;
1565 + regs->sr[0] = regs->iasq[1];
1566 + regs->iaoq[0] = 0x100UL;
1567 + regs->iaoq[1] = regs->iaoq[0] + 4;
1568 + regs->iasq[0] = regs->sr[2];
1569 + regs->iasq[1] = regs->sr[2];
1570 + return 2;
1571 + }
1572 + } while (0);
1573 +#endif
1574 +
1575 + return 1;
1576 +}
1577 +
1578 +void pax_report_insns(void *pc, void *sp)
1579 +{
1580 + unsigned long i;
1581 +
1582 + printk(KERN_ERR "PAX: bytes at PC: ");
1583 + for (i = 0; i < 5; i++) {
1584 + unsigned int c;
1585 + if (get_user(c, (unsigned int *)pc+i))
1586 + printk(KERN_CONT "???????? ");
1587 + else
1588 + printk(KERN_CONT "%08x ", c);
1589 + }
1590 + printk("\n");
1591 +}
1592 +#endif
1593 +
1594 int fixup_exception(struct pt_regs *regs)
1595 {
1596 const struct exception_table_entry *fix;
1597 @@ -192,8 +303,33 @@ good_area:
1598
1599 acc_type = parisc_acctyp(code,regs->iir);
1600
1601 - if ((vma->vm_flags & acc_type) != acc_type)
1602 + if ((vma->vm_flags & acc_type) != acc_type) {
1603 +
1604 +#ifdef CONFIG_PAX_PAGEEXEC
1605 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
1606 + (address & ~3UL) == instruction_pointer(regs))
1607 + {
1608 + up_read(&mm->mmap_sem);
1609 + switch (pax_handle_fetch_fault(regs)) {
1610 +
1611 +#ifdef CONFIG_PAX_EMUPLT
1612 + case 3:
1613 + return;
1614 +#endif
1615 +
1616 +#ifdef CONFIG_PAX_EMUTRAMP
1617 + case 2:
1618 + return;
1619 +#endif
1620 +
1621 + }
1622 + pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
1623 + do_group_exit(SIGKILL);
1624 + }
1625 +#endif
1626 +
1627 goto bad_area;
1628 + }
1629
1630 /*
1631 * If for any reason at all we couldn't handle the fault, make
1632 diff -urNp linux-3.0.8/arch/powerpc/include/asm/elf.h linux-3.0.8/arch/powerpc/include/asm/elf.h
1633 --- linux-3.0.8/arch/powerpc/include/asm/elf.h 2011-07-21 22:17:23.000000000 -0400
1634 +++ linux-3.0.8/arch/powerpc/include/asm/elf.h 2011-08-23 21:47:55.000000000 -0400
1635 @@ -178,8 +178,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
1636 the loader. We need to make sure that it is out of the way of the program
1637 that it will "exec", and that there is sufficient room for the brk. */
1638
1639 -extern unsigned long randomize_et_dyn(unsigned long base);
1640 -#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
1641 +#define ELF_ET_DYN_BASE (0x20000000)
1642 +
1643 +#ifdef CONFIG_PAX_ASLR
1644 +#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
1645 +
1646 +#ifdef __powerpc64__
1647 +#define PAX_DELTA_MMAP_LEN (is_32bit_task() ? 16 : 28)
1648 +#define PAX_DELTA_STACK_LEN (is_32bit_task() ? 16 : 28)
1649 +#else
1650 +#define PAX_DELTA_MMAP_LEN 15
1651 +#define PAX_DELTA_STACK_LEN 15
1652 +#endif
1653 +#endif
1654
1655 /*
1656 * Our registers are always unsigned longs, whether we're a 32 bit
1657 @@ -274,9 +285,6 @@ extern int arch_setup_additional_pages(s
1658 (0x7ff >> (PAGE_SHIFT - 12)) : \
1659 (0x3ffff >> (PAGE_SHIFT - 12)))
1660
1661 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
1662 -#define arch_randomize_brk arch_randomize_brk
1663 -
1664 #endif /* __KERNEL__ */
1665
1666 /*
1667 diff -urNp linux-3.0.8/arch/powerpc/include/asm/kmap_types.h linux-3.0.8/arch/powerpc/include/asm/kmap_types.h
1668 --- linux-3.0.8/arch/powerpc/include/asm/kmap_types.h 2011-07-21 22:17:23.000000000 -0400
1669 +++ linux-3.0.8/arch/powerpc/include/asm/kmap_types.h 2011-08-23 21:47:55.000000000 -0400
1670 @@ -27,6 +27,7 @@ enum km_type {
1671 KM_PPC_SYNC_PAGE,
1672 KM_PPC_SYNC_ICACHE,
1673 KM_KDB,
1674 + KM_CLEARPAGE,
1675 KM_TYPE_NR
1676 };
1677
1678 diff -urNp linux-3.0.8/arch/powerpc/include/asm/mman.h linux-3.0.8/arch/powerpc/include/asm/mman.h
1679 --- linux-3.0.8/arch/powerpc/include/asm/mman.h 2011-07-21 22:17:23.000000000 -0400
1680 +++ linux-3.0.8/arch/powerpc/include/asm/mman.h 2011-08-23 21:47:55.000000000 -0400
1681 @@ -44,7 +44,7 @@ static inline unsigned long arch_calc_vm
1682 }
1683 #define arch_calc_vm_prot_bits(prot) arch_calc_vm_prot_bits(prot)
1684
1685 -static inline pgprot_t arch_vm_get_page_prot(unsigned long vm_flags)
1686 +static inline pgprot_t arch_vm_get_page_prot(vm_flags_t vm_flags)
1687 {
1688 return (vm_flags & VM_SAO) ? __pgprot(_PAGE_SAO) : __pgprot(0);
1689 }
1690 diff -urNp linux-3.0.8/arch/powerpc/include/asm/page_64.h linux-3.0.8/arch/powerpc/include/asm/page_64.h
1691 --- linux-3.0.8/arch/powerpc/include/asm/page_64.h 2011-07-21 22:17:23.000000000 -0400
1692 +++ linux-3.0.8/arch/powerpc/include/asm/page_64.h 2011-08-23 21:47:55.000000000 -0400
1693 @@ -155,15 +155,18 @@ do { \
1694 * stack by default, so in the absence of a PT_GNU_STACK program header
1695 * we turn execute permission off.
1696 */
1697 -#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
1698 - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
1699 +#define VM_STACK_DEFAULT_FLAGS32 \
1700 + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
1701 + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
1702
1703 #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
1704 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
1705
1706 +#ifndef CONFIG_PAX_PAGEEXEC
1707 #define VM_STACK_DEFAULT_FLAGS \
1708 (is_32bit_task() ? \
1709 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
1710 +#endif
1711
1712 #include <asm-generic/getorder.h>
1713
1714 diff -urNp linux-3.0.8/arch/powerpc/include/asm/page.h linux-3.0.8/arch/powerpc/include/asm/page.h
1715 --- linux-3.0.8/arch/powerpc/include/asm/page.h 2011-07-21 22:17:23.000000000 -0400
1716 +++ linux-3.0.8/arch/powerpc/include/asm/page.h 2011-08-23 21:47:55.000000000 -0400
1717 @@ -129,8 +129,9 @@ extern phys_addr_t kernstart_addr;
1718 * and needs to be executable. This means the whole heap ends
1719 * up being executable.
1720 */
1721 -#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
1722 - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
1723 +#define VM_DATA_DEFAULT_FLAGS32 \
1724 + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
1725 + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
1726
1727 #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
1728 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
1729 @@ -158,6 +159,9 @@ extern phys_addr_t kernstart_addr;
1730 #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
1731 #endif
1732
1733 +#define ktla_ktva(addr) (addr)
1734 +#define ktva_ktla(addr) (addr)
1735 +
1736 #ifndef __ASSEMBLY__
1737
1738 #undef STRICT_MM_TYPECHECKS
1739 diff -urNp linux-3.0.8/arch/powerpc/include/asm/pgtable.h linux-3.0.8/arch/powerpc/include/asm/pgtable.h
1740 --- linux-3.0.8/arch/powerpc/include/asm/pgtable.h 2011-07-21 22:17:23.000000000 -0400
1741 +++ linux-3.0.8/arch/powerpc/include/asm/pgtable.h 2011-08-23 21:47:55.000000000 -0400
1742 @@ -2,6 +2,7 @@
1743 #define _ASM_POWERPC_PGTABLE_H
1744 #ifdef __KERNEL__
1745
1746 +#include <linux/const.h>
1747 #ifndef __ASSEMBLY__
1748 #include <asm/processor.h> /* For TASK_SIZE */
1749 #include <asm/mmu.h>
1750 diff -urNp linux-3.0.8/arch/powerpc/include/asm/pte-hash32.h linux-3.0.8/arch/powerpc/include/asm/pte-hash32.h
1751 --- linux-3.0.8/arch/powerpc/include/asm/pte-hash32.h 2011-07-21 22:17:23.000000000 -0400
1752 +++ linux-3.0.8/arch/powerpc/include/asm/pte-hash32.h 2011-08-23 21:47:55.000000000 -0400
1753 @@ -21,6 +21,7 @@
1754 #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
1755 #define _PAGE_USER 0x004 /* usermode access allowed */
1756 #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
1757 +#define _PAGE_EXEC _PAGE_GUARDED
1758 #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
1759 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
1760 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
1761 diff -urNp linux-3.0.8/arch/powerpc/include/asm/reg.h linux-3.0.8/arch/powerpc/include/asm/reg.h
1762 --- linux-3.0.8/arch/powerpc/include/asm/reg.h 2011-07-21 22:17:23.000000000 -0400
1763 +++ linux-3.0.8/arch/powerpc/include/asm/reg.h 2011-08-23 21:47:55.000000000 -0400
1764 @@ -209,6 +209,7 @@
1765 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
1766 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
1767 #define DSISR_NOHPTE 0x40000000 /* no translation found */
1768 +#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
1769 #define DSISR_PROTFAULT 0x08000000 /* protection fault */
1770 #define DSISR_ISSTORE 0x02000000 /* access was a store */
1771 #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
1772 diff -urNp linux-3.0.8/arch/powerpc/include/asm/system.h linux-3.0.8/arch/powerpc/include/asm/system.h
1773 --- linux-3.0.8/arch/powerpc/include/asm/system.h 2011-07-21 22:17:23.000000000 -0400
1774 +++ linux-3.0.8/arch/powerpc/include/asm/system.h 2011-08-23 21:47:55.000000000 -0400
1775 @@ -531,7 +531,7 @@ __cmpxchg_local(volatile void *ptr, unsi
1776 #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
1777 #endif
1778
1779 -extern unsigned long arch_align_stack(unsigned long sp);
1780 +#define arch_align_stack(x) ((x) & ~0xfUL)
1781
1782 /* Used in very early kernel initialization. */
1783 extern unsigned long reloc_offset(void);
1784 diff -urNp linux-3.0.8/arch/powerpc/include/asm/uaccess.h linux-3.0.8/arch/powerpc/include/asm/uaccess.h
1785 --- linux-3.0.8/arch/powerpc/include/asm/uaccess.h 2011-07-21 22:17:23.000000000 -0400
1786 +++ linux-3.0.8/arch/powerpc/include/asm/uaccess.h 2011-08-23 21:47:55.000000000 -0400
1787 @@ -13,6 +13,8 @@
1788 #define VERIFY_READ 0
1789 #define VERIFY_WRITE 1
1790
1791 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
1792 +
1793 /*
1794 * The fs value determines whether argument validity checking should be
1795 * performed or not. If get_fs() == USER_DS, checking is performed, with
1796 @@ -327,52 +329,6 @@ do { \
1797 extern unsigned long __copy_tofrom_user(void __user *to,
1798 const void __user *from, unsigned long size);
1799
1800 -#ifndef __powerpc64__
1801 -
1802 -static inline unsigned long copy_from_user(void *to,
1803 - const void __user *from, unsigned long n)
1804 -{
1805 - unsigned long over;
1806 -
1807 - if (access_ok(VERIFY_READ, from, n))
1808 - return __copy_tofrom_user((__force void __user *)to, from, n);
1809 - if ((unsigned long)from < TASK_SIZE) {
1810 - over = (unsigned long)from + n - TASK_SIZE;
1811 - return __copy_tofrom_user((__force void __user *)to, from,
1812 - n - over) + over;
1813 - }
1814 - return n;
1815 -}
1816 -
1817 -static inline unsigned long copy_to_user(void __user *to,
1818 - const void *from, unsigned long n)
1819 -{
1820 - unsigned long over;
1821 -
1822 - if (access_ok(VERIFY_WRITE, to, n))
1823 - return __copy_tofrom_user(to, (__force void __user *)from, n);
1824 - if ((unsigned long)to < TASK_SIZE) {
1825 - over = (unsigned long)to + n - TASK_SIZE;
1826 - return __copy_tofrom_user(to, (__force void __user *)from,
1827 - n - over) + over;
1828 - }
1829 - return n;
1830 -}
1831 -
1832 -#else /* __powerpc64__ */
1833 -
1834 -#define __copy_in_user(to, from, size) \
1835 - __copy_tofrom_user((to), (from), (size))
1836 -
1837 -extern unsigned long copy_from_user(void *to, const void __user *from,
1838 - unsigned long n);
1839 -extern unsigned long copy_to_user(void __user *to, const void *from,
1840 - unsigned long n);
1841 -extern unsigned long copy_in_user(void __user *to, const void __user *from,
1842 - unsigned long n);
1843 -
1844 -#endif /* __powerpc64__ */
1845 -
1846 static inline unsigned long __copy_from_user_inatomic(void *to,
1847 const void __user *from, unsigned long n)
1848 {
1849 @@ -396,6 +352,10 @@ static inline unsigned long __copy_from_
1850 if (ret == 0)
1851 return 0;
1852 }
1853 +
1854 + if (!__builtin_constant_p(n))
1855 + check_object_size(to, n, false);
1856 +
1857 return __copy_tofrom_user((__force void __user *)to, from, n);
1858 }
1859
1860 @@ -422,6 +382,10 @@ static inline unsigned long __copy_to_us
1861 if (ret == 0)
1862 return 0;
1863 }
1864 +
1865 + if (!__builtin_constant_p(n))
1866 + check_object_size(from, n, true);
1867 +
1868 return __copy_tofrom_user(to, (__force const void __user *)from, n);
1869 }
1870
1871 @@ -439,6 +403,92 @@ static inline unsigned long __copy_to_us
1872 return __copy_to_user_inatomic(to, from, size);
1873 }
1874
1875 +#ifndef __powerpc64__
1876 +
1877 +static inline unsigned long __must_check copy_from_user(void *to,
1878 + const void __user *from, unsigned long n)
1879 +{
1880 + unsigned long over;
1881 +
1882 + if ((long)n < 0)
1883 + return n;
1884 +
1885 + if (access_ok(VERIFY_READ, from, n)) {
1886 + if (!__builtin_constant_p(n))
1887 + check_object_size(to, n, false);
1888 + return __copy_tofrom_user((__force void __user *)to, from, n);
1889 + }
1890 + if ((unsigned long)from < TASK_SIZE) {
1891 + over = (unsigned long)from + n - TASK_SIZE;
1892 + if (!__builtin_constant_p(n - over))
1893 + check_object_size(to, n - over, false);
1894 + return __copy_tofrom_user((__force void __user *)to, from,
1895 + n - over) + over;
1896 + }
1897 + return n;
1898 +}
1899 +
1900 +static inline unsigned long __must_check copy_to_user(void __user *to,
1901 + const void *from, unsigned long n)
1902 +{
1903 + unsigned long over;
1904 +
1905 + if ((long)n < 0)
1906 + return n;
1907 +
1908 + if (access_ok(VERIFY_WRITE, to, n)) {
1909 + if (!__builtin_constant_p(n))
1910 + check_object_size(from, n, true);
1911 + return __copy_tofrom_user(to, (__force void __user *)from, n);
1912 + }
1913 + if ((unsigned long)to < TASK_SIZE) {
1914 + over = (unsigned long)to + n - TASK_SIZE;
1915 + if (!__builtin_constant_p(n))
1916 + check_object_size(from, n - over, true);
1917 + return __copy_tofrom_user(to, (__force void __user *)from,
1918 + n - over) + over;
1919 + }
1920 + return n;
1921 +}
1922 +
1923 +#else /* __powerpc64__ */
1924 +
1925 +#define __copy_in_user(to, from, size) \
1926 + __copy_tofrom_user((to), (from), (size))
1927 +
1928 +static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
1929 +{
1930 + if ((long)n < 0 || n > INT_MAX)
1931 + return n;
1932 +
1933 + if (!__builtin_constant_p(n))
1934 + check_object_size(to, n, false);
1935 +
1936 + if (likely(access_ok(VERIFY_READ, from, n)))
1937 + n = __copy_from_user(to, from, n);
1938 + else
1939 + memset(to, 0, n);
1940 + return n;
1941 +}
1942 +
1943 +static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
1944 +{
1945 + if ((long)n < 0 || n > INT_MAX)
1946 + return n;
1947 +
1948 + if (likely(access_ok(VERIFY_WRITE, to, n))) {
1949 + if (!__builtin_constant_p(n))
1950 + check_object_size(from, n, true);
1951 + n = __copy_to_user(to, from, n);
1952 + }
1953 + return n;
1954 +}
1955 +
1956 +extern unsigned long copy_in_user(void __user *to, const void __user *from,
1957 + unsigned long n);
1958 +
1959 +#endif /* __powerpc64__ */
1960 +
1961 extern unsigned long __clear_user(void __user *addr, unsigned long size);
1962
1963 static inline unsigned long clear_user(void __user *addr, unsigned long size)
1964 diff -urNp linux-3.0.8/arch/powerpc/kernel/exceptions-64e.S linux-3.0.8/arch/powerpc/kernel/exceptions-64e.S
1965 --- linux-3.0.8/arch/powerpc/kernel/exceptions-64e.S 2011-07-21 22:17:23.000000000 -0400
1966 +++ linux-3.0.8/arch/powerpc/kernel/exceptions-64e.S 2011-08-23 21:47:55.000000000 -0400
1967 @@ -567,6 +567,7 @@ storage_fault_common:
1968 std r14,_DAR(r1)
1969 std r15,_DSISR(r1)
1970 addi r3,r1,STACK_FRAME_OVERHEAD
1971 + bl .save_nvgprs
1972 mr r4,r14
1973 mr r5,r15
1974 ld r14,PACA_EXGEN+EX_R14(r13)
1975 @@ -576,8 +577,7 @@ storage_fault_common:
1976 cmpdi r3,0
1977 bne- 1f
1978 b .ret_from_except_lite
1979 -1: bl .save_nvgprs
1980 - mr r5,r3
1981 +1: mr r5,r3
1982 addi r3,r1,STACK_FRAME_OVERHEAD
1983 ld r4,_DAR(r1)
1984 bl .bad_page_fault
1985 diff -urNp linux-3.0.8/arch/powerpc/kernel/exceptions-64s.S linux-3.0.8/arch/powerpc/kernel/exceptions-64s.S
1986 --- linux-3.0.8/arch/powerpc/kernel/exceptions-64s.S 2011-07-21 22:17:23.000000000 -0400
1987 +++ linux-3.0.8/arch/powerpc/kernel/exceptions-64s.S 2011-08-23 21:47:55.000000000 -0400
1988 @@ -956,10 +956,10 @@ handle_page_fault:
1989 11: ld r4,_DAR(r1)
1990 ld r5,_DSISR(r1)
1991 addi r3,r1,STACK_FRAME_OVERHEAD
1992 + bl .save_nvgprs
1993 bl .do_page_fault
1994 cmpdi r3,0
1995 beq+ 13f
1996 - bl .save_nvgprs
1997 mr r5,r3
1998 addi r3,r1,STACK_FRAME_OVERHEAD
1999 lwz r4,_DAR(r1)
2000 diff -urNp linux-3.0.8/arch/powerpc/kernel/module_32.c linux-3.0.8/arch/powerpc/kernel/module_32.c
2001 --- linux-3.0.8/arch/powerpc/kernel/module_32.c 2011-07-21 22:17:23.000000000 -0400
2002 +++ linux-3.0.8/arch/powerpc/kernel/module_32.c 2011-08-23 21:47:55.000000000 -0400
2003 @@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
2004 me->arch.core_plt_section = i;
2005 }
2006 if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
2007 - printk("Module doesn't contain .plt or .init.plt sections.\n");
2008 + printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
2009 return -ENOEXEC;
2010 }
2011
2012 @@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati
2013
2014 DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
2015 /* Init, or core PLT? */
2016 - if (location >= mod->module_core
2017 - && location < mod->module_core + mod->core_size)
2018 + if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
2019 + (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
2020 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
2021 - else
2022 + else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
2023 + (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
2024 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
2025 + else {
2026 + printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
2027 + return ~0UL;
2028 + }
2029
2030 /* Find this entry, or if that fails, the next avail. entry */
2031 while (entry->jump[0]) {
2032 diff -urNp linux-3.0.8/arch/powerpc/kernel/module.c linux-3.0.8/arch/powerpc/kernel/module.c
2033 --- linux-3.0.8/arch/powerpc/kernel/module.c 2011-07-21 22:17:23.000000000 -0400
2034 +++ linux-3.0.8/arch/powerpc/kernel/module.c 2011-08-23 21:47:55.000000000 -0400
2035 @@ -31,11 +31,24 @@
2036
2037 LIST_HEAD(module_bug_list);
2038
2039 +#ifdef CONFIG_PAX_KERNEXEC
2040 void *module_alloc(unsigned long size)
2041 {
2042 if (size == 0)
2043 return NULL;
2044
2045 + return vmalloc(size);
2046 +}
2047 +
2048 +void *module_alloc_exec(unsigned long size)
2049 +#else
2050 +void *module_alloc(unsigned long size)
2051 +#endif
2052 +
2053 +{
2054 + if (size == 0)
2055 + return NULL;
2056 +
2057 return vmalloc_exec(size);
2058 }
2059
2060 @@ -45,6 +58,13 @@ void module_free(struct module *mod, voi
2061 vfree(module_region);
2062 }
2063
2064 +#ifdef CONFIG_PAX_KERNEXEC
2065 +void module_free_exec(struct module *mod, void *module_region)
2066 +{
2067 + module_free(mod, module_region);
2068 +}
2069 +#endif
2070 +
2071 static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
2072 const Elf_Shdr *sechdrs,
2073 const char *name)
2074 diff -urNp linux-3.0.8/arch/powerpc/kernel/process.c linux-3.0.8/arch/powerpc/kernel/process.c
2075 --- linux-3.0.8/arch/powerpc/kernel/process.c 2011-07-21 22:17:23.000000000 -0400
2076 +++ linux-3.0.8/arch/powerpc/kernel/process.c 2011-08-23 21:48:14.000000000 -0400
2077 @@ -676,8 +676,8 @@ void show_regs(struct pt_regs * regs)
2078 * Lookup NIP late so we have the best change of getting the
2079 * above info out without failing
2080 */
2081 - printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
2082 - printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
2083 + printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
2084 + printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
2085 #endif
2086 show_stack(current, (unsigned long *) regs->gpr[1]);
2087 if (!user_mode(regs))
2088 @@ -1183,10 +1183,10 @@ void show_stack(struct task_struct *tsk,
2089 newsp = stack[0];
2090 ip = stack[STACK_FRAME_LR_SAVE];
2091 if (!firstframe || ip != lr) {
2092 - printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
2093 + printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
2094 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
2095 if ((ip == rth || ip == mrth) && curr_frame >= 0) {
2096 - printk(" (%pS)",
2097 + printk(" (%pA)",
2098 (void *)current->ret_stack[curr_frame].ret);
2099 curr_frame--;
2100 }
2101 @@ -1206,7 +1206,7 @@ void show_stack(struct task_struct *tsk,
2102 struct pt_regs *regs = (struct pt_regs *)
2103 (sp + STACK_FRAME_OVERHEAD);
2104 lr = regs->link;
2105 - printk("--- Exception: %lx at %pS\n LR = %pS\n",
2106 + printk("--- Exception: %lx at %pA\n LR = %pA\n",
2107 regs->trap, (void *)regs->nip, (void *)lr);
2108 firstframe = 1;
2109 }
2110 @@ -1281,58 +1281,3 @@ void thread_info_cache_init(void)
2111 }
2112
2113 #endif /* THREAD_SHIFT < PAGE_SHIFT */
2114 -
2115 -unsigned long arch_align_stack(unsigned long sp)
2116 -{
2117 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
2118 - sp -= get_random_int() & ~PAGE_MASK;
2119 - return sp & ~0xf;
2120 -}
2121 -
2122 -static inline unsigned long brk_rnd(void)
2123 -{
2124 - unsigned long rnd = 0;
2125 -
2126 - /* 8MB for 32bit, 1GB for 64bit */
2127 - if (is_32bit_task())
2128 - rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
2129 - else
2130 - rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
2131 -
2132 - return rnd << PAGE_SHIFT;
2133 -}
2134 -
2135 -unsigned long arch_randomize_brk(struct mm_struct *mm)
2136 -{
2137 - unsigned long base = mm->brk;
2138 - unsigned long ret;
2139 -
2140 -#ifdef CONFIG_PPC_STD_MMU_64
2141 - /*
2142 - * If we are using 1TB segments and we are allowed to randomise
2143 - * the heap, we can put it above 1TB so it is backed by a 1TB
2144 - * segment. Otherwise the heap will be in the bottom 1TB
2145 - * which always uses 256MB segments and this may result in a
2146 - * performance penalty.
2147 - */
2148 - if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
2149 - base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
2150 -#endif
2151 -
2152 - ret = PAGE_ALIGN(base + brk_rnd());
2153 -
2154 - if (ret < mm->brk)
2155 - return mm->brk;
2156 -
2157 - return ret;
2158 -}
2159 -
2160 -unsigned long randomize_et_dyn(unsigned long base)
2161 -{
2162 - unsigned long ret = PAGE_ALIGN(base + brk_rnd());
2163 -
2164 - if (ret < base)
2165 - return base;
2166 -
2167 - return ret;
2168 -}
2169 diff -urNp linux-3.0.8/arch/powerpc/kernel/signal_32.c linux-3.0.8/arch/powerpc/kernel/signal_32.c
2170 --- linux-3.0.8/arch/powerpc/kernel/signal_32.c 2011-07-21 22:17:23.000000000 -0400
2171 +++ linux-3.0.8/arch/powerpc/kernel/signal_32.c 2011-08-23 21:47:55.000000000 -0400
2172 @@ -859,7 +859,7 @@ int handle_rt_signal32(unsigned long sig
2173 /* Save user registers on the stack */
2174 frame = &rt_sf->uc.uc_mcontext;
2175 addr = frame;
2176 - if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
2177 + if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2178 if (save_user_regs(regs, frame, 0, 1))
2179 goto badframe;
2180 regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
2181 diff -urNp linux-3.0.8/arch/powerpc/kernel/signal_64.c linux-3.0.8/arch/powerpc/kernel/signal_64.c
2182 --- linux-3.0.8/arch/powerpc/kernel/signal_64.c 2011-07-21 22:17:23.000000000 -0400
2183 +++ linux-3.0.8/arch/powerpc/kernel/signal_64.c 2011-08-23 21:47:55.000000000 -0400
2184 @@ -430,7 +430,7 @@ int handle_rt_signal64(int signr, struct
2185 current->thread.fpscr.val = 0;
2186
2187 /* Set up to return from userspace. */
2188 - if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
2189 + if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2190 regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
2191 } else {
2192 err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
2193 diff -urNp linux-3.0.8/arch/powerpc/kernel/traps.c linux-3.0.8/arch/powerpc/kernel/traps.c
2194 --- linux-3.0.8/arch/powerpc/kernel/traps.c 2011-07-21 22:17:23.000000000 -0400
2195 +++ linux-3.0.8/arch/powerpc/kernel/traps.c 2011-08-23 21:48:14.000000000 -0400
2196 @@ -98,6 +98,8 @@ static void pmac_backlight_unblank(void)
2197 static inline void pmac_backlight_unblank(void) { }
2198 #endif
2199
2200 +extern void gr_handle_kernel_exploit(void);
2201 +
2202 int die(const char *str, struct pt_regs *regs, long err)
2203 {
2204 static struct {
2205 @@ -171,6 +173,8 @@ int die(const char *str, struct pt_regs
2206 if (panic_on_oops)
2207 panic("Fatal exception");
2208
2209 + gr_handle_kernel_exploit();
2210 +
2211 oops_exit();
2212 do_exit(err);
2213
2214 diff -urNp linux-3.0.8/arch/powerpc/kernel/vdso.c linux-3.0.8/arch/powerpc/kernel/vdso.c
2215 --- linux-3.0.8/arch/powerpc/kernel/vdso.c 2011-07-21 22:17:23.000000000 -0400
2216 +++ linux-3.0.8/arch/powerpc/kernel/vdso.c 2011-08-23 21:47:55.000000000 -0400
2217 @@ -36,6 +36,7 @@
2218 #include <asm/firmware.h>
2219 #include <asm/vdso.h>
2220 #include <asm/vdso_datapage.h>
2221 +#include <asm/mman.h>
2222
2223 #include "setup.h"
2224
2225 @@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l
2226 vdso_base = VDSO32_MBASE;
2227 #endif
2228
2229 - current->mm->context.vdso_base = 0;
2230 + current->mm->context.vdso_base = ~0UL;
2231
2232 /* vDSO has a problem and was disabled, just don't "enable" it for the
2233 * process
2234 @@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l
2235 vdso_base = get_unmapped_area(NULL, vdso_base,
2236 (vdso_pages << PAGE_SHIFT) +
2237 ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
2238 - 0, 0);
2239 + 0, MAP_PRIVATE | MAP_EXECUTABLE);
2240 if (IS_ERR_VALUE(vdso_base)) {
2241 rc = vdso_base;
2242 goto fail_mmapsem;
2243 diff -urNp linux-3.0.8/arch/powerpc/lib/usercopy_64.c linux-3.0.8/arch/powerpc/lib/usercopy_64.c
2244 --- linux-3.0.8/arch/powerpc/lib/usercopy_64.c 2011-07-21 22:17:23.000000000 -0400
2245 +++ linux-3.0.8/arch/powerpc/lib/usercopy_64.c 2011-08-23 21:47:55.000000000 -0400
2246 @@ -9,22 +9,6 @@
2247 #include <linux/module.h>
2248 #include <asm/uaccess.h>
2249
2250 -unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
2251 -{
2252 - if (likely(access_ok(VERIFY_READ, from, n)))
2253 - n = __copy_from_user(to, from, n);
2254 - else
2255 - memset(to, 0, n);
2256 - return n;
2257 -}
2258 -
2259 -unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
2260 -{
2261 - if (likely(access_ok(VERIFY_WRITE, to, n)))
2262 - n = __copy_to_user(to, from, n);
2263 - return n;
2264 -}
2265 -
2266 unsigned long copy_in_user(void __user *to, const void __user *from,
2267 unsigned long n)
2268 {
2269 @@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *
2270 return n;
2271 }
2272
2273 -EXPORT_SYMBOL(copy_from_user);
2274 -EXPORT_SYMBOL(copy_to_user);
2275 EXPORT_SYMBOL(copy_in_user);
2276
2277 diff -urNp linux-3.0.8/arch/powerpc/mm/fault.c linux-3.0.8/arch/powerpc/mm/fault.c
2278 --- linux-3.0.8/arch/powerpc/mm/fault.c 2011-07-21 22:17:23.000000000 -0400
2279 +++ linux-3.0.8/arch/powerpc/mm/fault.c 2011-08-23 21:47:55.000000000 -0400
2280 @@ -32,6 +32,10 @@
2281 #include <linux/perf_event.h>
2282 #include <linux/magic.h>
2283 #include <linux/ratelimit.h>
2284 +#include <linux/slab.h>
2285 +#include <linux/pagemap.h>
2286 +#include <linux/compiler.h>
2287 +#include <linux/unistd.h>
2288
2289 #include <asm/firmware.h>
2290 #include <asm/page.h>
2291 @@ -43,6 +47,7 @@
2292 #include <asm/tlbflush.h>
2293 #include <asm/siginfo.h>
2294 #include <mm/mmu_decl.h>
2295 +#include <asm/ptrace.h>
2296
2297 #ifdef CONFIG_KPROBES
2298 static inline int notify_page_fault(struct pt_regs *regs)
2299 @@ -66,6 +71,33 @@ static inline int notify_page_fault(stru
2300 }
2301 #endif
2302
2303 +#ifdef CONFIG_PAX_PAGEEXEC
2304 +/*
2305 + * PaX: decide what to do with offenders (regs->nip = fault address)
2306 + *
2307 + * returns 1 when task should be killed
2308 + */
2309 +static int pax_handle_fetch_fault(struct pt_regs *regs)
2310 +{
2311 + return 1;
2312 +}
2313 +
2314 +void pax_report_insns(void *pc, void *sp)
2315 +{
2316 + unsigned long i;
2317 +
2318 + printk(KERN_ERR "PAX: bytes at PC: ");
2319 + for (i = 0; i < 5; i++) {
2320 + unsigned int c;
2321 + if (get_user(c, (unsigned int __user *)pc+i))
2322 + printk(KERN_CONT "???????? ");
2323 + else
2324 + printk(KERN_CONT "%08x ", c);
2325 + }
2326 + printk("\n");
2327 +}
2328 +#endif
2329 +
2330 /*
2331 * Check whether the instruction at regs->nip is a store using
2332 * an update addressing form which will update r1.
2333 @@ -136,7 +168,7 @@ int __kprobes do_page_fault(struct pt_re
2334 * indicate errors in DSISR but can validly be set in SRR1.
2335 */
2336 if (trap == 0x400)
2337 - error_code &= 0x48200000;
2338 + error_code &= 0x58200000;
2339 else
2340 is_write = error_code & DSISR_ISSTORE;
2341 #else
2342 @@ -259,7 +291,7 @@ good_area:
2343 * "undefined". Of those that can be set, this is the only
2344 * one which seems bad.
2345 */
2346 - if (error_code & 0x10000000)
2347 + if (error_code & DSISR_GUARDED)
2348 /* Guarded storage error. */
2349 goto bad_area;
2350 #endif /* CONFIG_8xx */
2351 @@ -274,7 +306,7 @@ good_area:
2352 * processors use the same I/D cache coherency mechanism
2353 * as embedded.
2354 */
2355 - if (error_code & DSISR_PROTFAULT)
2356 + if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
2357 goto bad_area;
2358 #endif /* CONFIG_PPC_STD_MMU */
2359
2360 @@ -343,6 +375,23 @@ bad_area:
2361 bad_area_nosemaphore:
2362 /* User mode accesses cause a SIGSEGV */
2363 if (user_mode(regs)) {
2364 +
2365 +#ifdef CONFIG_PAX_PAGEEXEC
2366 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
2367 +#ifdef CONFIG_PPC_STD_MMU
2368 + if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
2369 +#else
2370 + if (is_exec && regs->nip == address) {
2371 +#endif
2372 + switch (pax_handle_fetch_fault(regs)) {
2373 + }
2374 +
2375 + pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
2376 + do_group_exit(SIGKILL);
2377 + }
2378 + }
2379 +#endif
2380 +
2381 _exception(SIGSEGV, regs, code, address);
2382 return 0;
2383 }
2384 diff -urNp linux-3.0.8/arch/powerpc/mm/mmap_64.c linux-3.0.8/arch/powerpc/mm/mmap_64.c
2385 --- linux-3.0.8/arch/powerpc/mm/mmap_64.c 2011-07-21 22:17:23.000000000 -0400
2386 +++ linux-3.0.8/arch/powerpc/mm/mmap_64.c 2011-08-23 21:47:55.000000000 -0400
2387 @@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
2388 */
2389 if (mmap_is_legacy()) {
2390 mm->mmap_base = TASK_UNMAPPED_BASE;
2391 +
2392 +#ifdef CONFIG_PAX_RANDMMAP
2393 + if (mm->pax_flags & MF_PAX_RANDMMAP)
2394 + mm->mmap_base += mm->delta_mmap;
2395 +#endif
2396 +
2397 mm->get_unmapped_area = arch_get_unmapped_area;
2398 mm->unmap_area = arch_unmap_area;
2399 } else {
2400 mm->mmap_base = mmap_base();
2401 +
2402 +#ifdef CONFIG_PAX_RANDMMAP
2403 + if (mm->pax_flags & MF_PAX_RANDMMAP)
2404 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
2405 +#endif
2406 +
2407 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
2408 mm->unmap_area = arch_unmap_area_topdown;
2409 }
2410 diff -urNp linux-3.0.8/arch/powerpc/mm/slice.c linux-3.0.8/arch/powerpc/mm/slice.c
2411 --- linux-3.0.8/arch/powerpc/mm/slice.c 2011-07-21 22:17:23.000000000 -0400
2412 +++ linux-3.0.8/arch/powerpc/mm/slice.c 2011-08-23 21:47:55.000000000 -0400
2413 @@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_
2414 if ((mm->task_size - len) < addr)
2415 return 0;
2416 vma = find_vma(mm, addr);
2417 - return (!vma || (addr + len) <= vma->vm_start);
2418 + return check_heap_stack_gap(vma, addr, len);
2419 }
2420
2421 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
2422 @@ -256,7 +256,7 @@ full_search:
2423 addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT);
2424 continue;
2425 }
2426 - if (!vma || addr + len <= vma->vm_start) {
2427 + if (check_heap_stack_gap(vma, addr, len)) {
2428 /*
2429 * Remember the place where we stopped the search:
2430 */
2431 @@ -313,10 +313,14 @@ static unsigned long slice_find_area_top
2432 }
2433 }
2434
2435 - addr = mm->mmap_base;
2436 - while (addr > len) {
2437 + if (mm->mmap_base < len)
2438 + addr = -ENOMEM;
2439 + else
2440 + addr = mm->mmap_base - len;
2441 +
2442 + while (!IS_ERR_VALUE(addr)) {
2443 /* Go down by chunk size */
2444 - addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
2445 + addr = _ALIGN_DOWN(addr, 1ul << pshift);
2446
2447 /* Check for hit with different page size */
2448 mask = slice_range_to_mask(addr, len);
2449 @@ -336,7 +340,7 @@ static unsigned long slice_find_area_top
2450 * return with success:
2451 */
2452 vma = find_vma(mm, addr);
2453 - if (!vma || (addr + len) <= vma->vm_start) {
2454 + if (check_heap_stack_gap(vma, addr, len)) {
2455 /* remember the address as a hint for next time */
2456 if (use_cache)
2457 mm->free_area_cache = addr;
2458 @@ -348,7 +352,7 @@ static unsigned long slice_find_area_top
2459 mm->cached_hole_size = vma->vm_start - addr;
2460
2461 /* try just below the current vma->vm_start */
2462 - addr = vma->vm_start;
2463 + addr = skip_heap_stack_gap(vma, len);
2464 }
2465
2466 /*
2467 @@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(un
2468 if (fixed && addr > (mm->task_size - len))
2469 return -EINVAL;
2470
2471 +#ifdef CONFIG_PAX_RANDMMAP
2472 + if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
2473 + addr = 0;
2474 +#endif
2475 +
2476 /* If hint, make sure it matches our alignment restrictions */
2477 if (!fixed && addr) {
2478 addr = _ALIGN_UP(addr, 1ul << pshift);
2479 diff -urNp linux-3.0.8/arch/s390/include/asm/elf.h linux-3.0.8/arch/s390/include/asm/elf.h
2480 --- linux-3.0.8/arch/s390/include/asm/elf.h 2011-07-21 22:17:23.000000000 -0400
2481 +++ linux-3.0.8/arch/s390/include/asm/elf.h 2011-08-23 21:47:55.000000000 -0400
2482 @@ -162,8 +162,14 @@ extern unsigned int vdso_enabled;
2483 the loader. We need to make sure that it is out of the way of the program
2484 that it will "exec", and that there is sufficient room for the brk. */
2485
2486 -extern unsigned long randomize_et_dyn(unsigned long base);
2487 -#define ELF_ET_DYN_BASE (randomize_et_dyn(STACK_TOP / 3 * 2))
2488 +#define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
2489 +
2490 +#ifdef CONFIG_PAX_ASLR
2491 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
2492 +
2493 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
2494 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
2495 +#endif
2496
2497 /* This yields a mask that user programs can use to figure out what
2498 instruction set this CPU supports. */
2499 @@ -210,7 +216,4 @@ struct linux_binprm;
2500 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
2501 int arch_setup_additional_pages(struct linux_binprm *, int);
2502
2503 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2504 -#define arch_randomize_brk arch_randomize_brk
2505 -
2506 #endif
2507 diff -urNp linux-3.0.8/arch/s390/include/asm/system.h linux-3.0.8/arch/s390/include/asm/system.h
2508 --- linux-3.0.8/arch/s390/include/asm/system.h 2011-07-21 22:17:23.000000000 -0400
2509 +++ linux-3.0.8/arch/s390/include/asm/system.h 2011-08-23 21:47:55.000000000 -0400
2510 @@ -255,7 +255,7 @@ extern void (*_machine_restart)(char *co
2511 extern void (*_machine_halt)(void);
2512 extern void (*_machine_power_off)(void);
2513
2514 -extern unsigned long arch_align_stack(unsigned long sp);
2515 +#define arch_align_stack(x) ((x) & ~0xfUL)
2516
2517 static inline int tprot(unsigned long addr)
2518 {
2519 diff -urNp linux-3.0.8/arch/s390/include/asm/uaccess.h linux-3.0.8/arch/s390/include/asm/uaccess.h
2520 --- linux-3.0.8/arch/s390/include/asm/uaccess.h 2011-07-21 22:17:23.000000000 -0400
2521 +++ linux-3.0.8/arch/s390/include/asm/uaccess.h 2011-08-23 21:47:55.000000000 -0400
2522 @@ -235,6 +235,10 @@ static inline unsigned long __must_check
2523 copy_to_user(void __user *to, const void *from, unsigned long n)
2524 {
2525 might_fault();
2526 +
2527 + if ((long)n < 0)
2528 + return n;
2529 +
2530 if (access_ok(VERIFY_WRITE, to, n))
2531 n = __copy_to_user(to, from, n);
2532 return n;
2533 @@ -260,6 +264,9 @@ copy_to_user(void __user *to, const void
2534 static inline unsigned long __must_check
2535 __copy_from_user(void *to, const void __user *from, unsigned long n)
2536 {
2537 + if ((long)n < 0)
2538 + return n;
2539 +
2540 if (__builtin_constant_p(n) && (n <= 256))
2541 return uaccess.copy_from_user_small(n, from, to);
2542 else
2543 @@ -294,6 +301,10 @@ copy_from_user(void *to, const void __us
2544 unsigned int sz = __compiletime_object_size(to);
2545
2546 might_fault();
2547 +
2548 + if ((long)n < 0)
2549 + return n;
2550 +
2551 if (unlikely(sz != -1 && sz < n)) {
2552 copy_from_user_overflow();
2553 return n;
2554 diff -urNp linux-3.0.8/arch/s390/kernel/module.c linux-3.0.8/arch/s390/kernel/module.c
2555 --- linux-3.0.8/arch/s390/kernel/module.c 2011-07-21 22:17:23.000000000 -0400
2556 +++ linux-3.0.8/arch/s390/kernel/module.c 2011-08-23 21:47:55.000000000 -0400
2557 @@ -168,11 +168,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
2558
2559 /* Increase core size by size of got & plt and set start
2560 offsets for got and plt. */
2561 - me->core_size = ALIGN(me->core_size, 4);
2562 - me->arch.got_offset = me->core_size;
2563 - me->core_size += me->arch.got_size;
2564 - me->arch.plt_offset = me->core_size;
2565 - me->core_size += me->arch.plt_size;
2566 + me->core_size_rw = ALIGN(me->core_size_rw, 4);
2567 + me->arch.got_offset = me->core_size_rw;
2568 + me->core_size_rw += me->arch.got_size;
2569 + me->arch.plt_offset = me->core_size_rx;
2570 + me->core_size_rx += me->arch.plt_size;
2571 return 0;
2572 }
2573
2574 @@ -258,7 +258,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
2575 if (info->got_initialized == 0) {
2576 Elf_Addr *gotent;
2577
2578 - gotent = me->module_core + me->arch.got_offset +
2579 + gotent = me->module_core_rw + me->arch.got_offset +
2580 info->got_offset;
2581 *gotent = val;
2582 info->got_initialized = 1;
2583 @@ -282,7 +282,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
2584 else if (r_type == R_390_GOTENT ||
2585 r_type == R_390_GOTPLTENT)
2586 *(unsigned int *) loc =
2587 - (val + (Elf_Addr) me->module_core - loc) >> 1;
2588 + (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
2589 else if (r_type == R_390_GOT64 ||
2590 r_type == R_390_GOTPLT64)
2591 *(unsigned long *) loc = val;
2592 @@ -296,7 +296,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
2593 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
2594 if (info->plt_initialized == 0) {
2595 unsigned int *ip;
2596 - ip = me->module_core + me->arch.plt_offset +
2597 + ip = me->module_core_rx + me->arch.plt_offset +
2598 info->plt_offset;
2599 #ifndef CONFIG_64BIT
2600 ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
2601 @@ -321,7 +321,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
2602 val - loc + 0xffffUL < 0x1ffffeUL) ||
2603 (r_type == R_390_PLT32DBL &&
2604 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
2605 - val = (Elf_Addr) me->module_core +
2606 + val = (Elf_Addr) me->module_core_rx +
2607 me->arch.plt_offset +
2608 info->plt_offset;
2609 val += rela->r_addend - loc;
2610 @@ -343,7 +343,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
2611 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
2612 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
2613 val = val + rela->r_addend -
2614 - ((Elf_Addr) me->module_core + me->arch.got_offset);
2615 + ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
2616 if (r_type == R_390_GOTOFF16)
2617 *(unsigned short *) loc = val;
2618 else if (r_type == R_390_GOTOFF32)
2619 @@ -353,7 +353,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
2620 break;
2621 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
2622 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
2623 - val = (Elf_Addr) me->module_core + me->arch.got_offset +
2624 + val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
2625 rela->r_addend - loc;
2626 if (r_type == R_390_GOTPC)
2627 *(unsigned int *) loc = val;
2628 diff -urNp linux-3.0.8/arch/s390/kernel/process.c linux-3.0.8/arch/s390/kernel/process.c
2629 --- linux-3.0.8/arch/s390/kernel/process.c 2011-07-21 22:17:23.000000000 -0400
2630 +++ linux-3.0.8/arch/s390/kernel/process.c 2011-08-23 21:47:55.000000000 -0400
2631 @@ -319,39 +319,3 @@ unsigned long get_wchan(struct task_stru
2632 }
2633 return 0;
2634 }
2635 -
2636 -unsigned long arch_align_stack(unsigned long sp)
2637 -{
2638 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
2639 - sp -= get_random_int() & ~PAGE_MASK;
2640 - return sp & ~0xf;
2641 -}
2642 -
2643 -static inline unsigned long brk_rnd(void)
2644 -{
2645 - /* 8MB for 32bit, 1GB for 64bit */
2646 - if (is_32bit_task())
2647 - return (get_random_int() & 0x7ffUL) << PAGE_SHIFT;
2648 - else
2649 - return (get_random_int() & 0x3ffffUL) << PAGE_SHIFT;
2650 -}
2651 -
2652 -unsigned long arch_randomize_brk(struct mm_struct *mm)
2653 -{
2654 - unsigned long ret = PAGE_ALIGN(mm->brk + brk_rnd());
2655 -
2656 - if (ret < mm->brk)
2657 - return mm->brk;
2658 - return ret;
2659 -}
2660 -
2661 -unsigned long randomize_et_dyn(unsigned long base)
2662 -{
2663 - unsigned long ret = PAGE_ALIGN(base + brk_rnd());
2664 -
2665 - if (!(current->flags & PF_RANDOMIZE))
2666 - return base;
2667 - if (ret < base)
2668 - return base;
2669 - return ret;
2670 -}
2671 diff -urNp linux-3.0.8/arch/s390/kernel/setup.c linux-3.0.8/arch/s390/kernel/setup.c
2672 --- linux-3.0.8/arch/s390/kernel/setup.c 2011-07-21 22:17:23.000000000 -0400
2673 +++ linux-3.0.8/arch/s390/kernel/setup.c 2011-08-23 21:47:55.000000000 -0400
2674 @@ -271,7 +271,7 @@ static int __init early_parse_mem(char *
2675 }
2676 early_param("mem", early_parse_mem);
2677
2678 -unsigned int user_mode = HOME_SPACE_MODE;
2679 +unsigned int user_mode = SECONDARY_SPACE_MODE;
2680 EXPORT_SYMBOL_GPL(user_mode);
2681
2682 static int set_amode_and_uaccess(unsigned long user_amode,
2683 diff -urNp linux-3.0.8/arch/s390/mm/mmap.c linux-3.0.8/arch/s390/mm/mmap.c
2684 --- linux-3.0.8/arch/s390/mm/mmap.c 2011-07-21 22:17:23.000000000 -0400
2685 +++ linux-3.0.8/arch/s390/mm/mmap.c 2011-08-23 21:47:55.000000000 -0400
2686 @@ -91,10 +91,22 @@ void arch_pick_mmap_layout(struct mm_str
2687 */
2688 if (mmap_is_legacy()) {
2689 mm->mmap_base = TASK_UNMAPPED_BASE;
2690 +
2691 +#ifdef CONFIG_PAX_RANDMMAP
2692 + if (mm->pax_flags & MF_PAX_RANDMMAP)
2693 + mm->mmap_base += mm->delta_mmap;
2694 +#endif
2695 +
2696 mm->get_unmapped_area = arch_get_unmapped_area;
2697 mm->unmap_area = arch_unmap_area;
2698 } else {
2699 mm->mmap_base = mmap_base();
2700 +
2701 +#ifdef CONFIG_PAX_RANDMMAP
2702 + if (mm->pax_flags & MF_PAX_RANDMMAP)
2703 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
2704 +#endif
2705 +
2706 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
2707 mm->unmap_area = arch_unmap_area_topdown;
2708 }
2709 @@ -166,10 +178,22 @@ void arch_pick_mmap_layout(struct mm_str
2710 */
2711 if (mmap_is_legacy()) {
2712 mm->mmap_base = TASK_UNMAPPED_BASE;
2713 +
2714 +#ifdef CONFIG_PAX_RANDMMAP
2715 + if (mm->pax_flags & MF_PAX_RANDMMAP)
2716 + mm->mmap_base += mm->delta_mmap;
2717 +#endif
2718 +
2719 mm->get_unmapped_area = s390_get_unmapped_area;
2720 mm->unmap_area = arch_unmap_area;
2721 } else {
2722 mm->mmap_base = mmap_base();
2723 +
2724 +#ifdef CONFIG_PAX_RANDMMAP
2725 + if (mm->pax_flags & MF_PAX_RANDMMAP)
2726 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
2727 +#endif
2728 +
2729 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
2730 mm->unmap_area = arch_unmap_area_topdown;
2731 }
2732 diff -urNp linux-3.0.8/arch/score/include/asm/system.h linux-3.0.8/arch/score/include/asm/system.h
2733 --- linux-3.0.8/arch/score/include/asm/system.h 2011-07-21 22:17:23.000000000 -0400
2734 +++ linux-3.0.8/arch/score/include/asm/system.h 2011-08-23 21:47:55.000000000 -0400
2735 @@ -17,7 +17,7 @@ do { \
2736 #define finish_arch_switch(prev) do {} while (0)
2737
2738 typedef void (*vi_handler_t)(void);
2739 -extern unsigned long arch_align_stack(unsigned long sp);
2740 +#define arch_align_stack(x) (x)
2741
2742 #define mb() barrier()
2743 #define rmb() barrier()
2744 diff -urNp linux-3.0.8/arch/score/kernel/process.c linux-3.0.8/arch/score/kernel/process.c
2745 --- linux-3.0.8/arch/score/kernel/process.c 2011-07-21 22:17:23.000000000 -0400
2746 +++ linux-3.0.8/arch/score/kernel/process.c 2011-08-23 21:47:55.000000000 -0400
2747 @@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_stru
2748
2749 return task_pt_regs(task)->cp0_epc;
2750 }
2751 -
2752 -unsigned long arch_align_stack(unsigned long sp)
2753 -{
2754 - return sp;
2755 -}
2756 diff -urNp linux-3.0.8/arch/sh/mm/mmap.c linux-3.0.8/arch/sh/mm/mmap.c
2757 --- linux-3.0.8/arch/sh/mm/mmap.c 2011-07-21 22:17:23.000000000 -0400
2758 +++ linux-3.0.8/arch/sh/mm/mmap.c 2011-08-23 21:47:55.000000000 -0400
2759 @@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(str
2760 addr = PAGE_ALIGN(addr);
2761
2762 vma = find_vma(mm, addr);
2763 - if (TASK_SIZE - len >= addr &&
2764 - (!vma || addr + len <= vma->vm_start))
2765 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
2766 return addr;
2767 }
2768
2769 @@ -106,7 +105,7 @@ full_search:
2770 }
2771 return -ENOMEM;
2772 }
2773 - if (likely(!vma || addr + len <= vma->vm_start)) {
2774 + if (likely(check_heap_stack_gap(vma, addr, len))) {
2775 /*
2776 * Remember the place where we stopped the search:
2777 */
2778 @@ -157,8 +156,7 @@ arch_get_unmapped_area_topdown(struct fi
2779 addr = PAGE_ALIGN(addr);
2780
2781 vma = find_vma(mm, addr);
2782 - if (TASK_SIZE - len >= addr &&
2783 - (!vma || addr + len <= vma->vm_start))
2784 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
2785 return addr;
2786 }
2787
2788 @@ -179,7 +177,7 @@ arch_get_unmapped_area_topdown(struct fi
2789 /* make sure it can fit in the remaining address space */
2790 if (likely(addr > len)) {
2791 vma = find_vma(mm, addr-len);
2792 - if (!vma || addr <= vma->vm_start) {
2793 + if (check_heap_stack_gap(vma, addr - len, len)) {
2794 /* remember the address as a hint for next time */
2795 return (mm->free_area_cache = addr-len);
2796 }
2797 @@ -188,18 +186,18 @@ arch_get_unmapped_area_topdown(struct fi
2798 if (unlikely(mm->mmap_base < len))
2799 goto bottomup;
2800
2801 - addr = mm->mmap_base-len;
2802 - if (do_colour_align)
2803 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
2804 + addr = mm->mmap_base - len;
2805
2806 do {
2807 + if (do_colour_align)
2808 + addr = COLOUR_ALIGN_DOWN(addr, pgoff);
2809 /*
2810 * Lookup failure means no vma is above this address,
2811 * else if new region fits below vma->vm_start,
2812 * return with success:
2813 */
2814 vma = find_vma(mm, addr);
2815 - if (likely(!vma || addr+len <= vma->vm_start)) {
2816 + if (likely(check_heap_stack_gap(vma, addr, len))) {
2817 /* remember the address as a hint for next time */
2818 return (mm->free_area_cache = addr);
2819 }
2820 @@ -209,10 +207,8 @@ arch_get_unmapped_area_topdown(struct fi
2821 mm->cached_hole_size = vma->vm_start - addr;
2822
2823 /* try just below the current vma->vm_start */
2824 - addr = vma->vm_start-len;
2825 - if (do_colour_align)
2826 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
2827 - } while (likely(len < vma->vm_start));
2828 + addr = skip_heap_stack_gap(vma, len);
2829 + } while (!IS_ERR_VALUE(addr));
2830
2831 bottomup:
2832 /*
2833 diff -urNp linux-3.0.8/arch/sparc/include/asm/atomic_64.h linux-3.0.8/arch/sparc/include/asm/atomic_64.h
2834 --- linux-3.0.8/arch/sparc/include/asm/atomic_64.h 2011-07-21 22:17:23.000000000 -0400
2835 +++ linux-3.0.8/arch/sparc/include/asm/atomic_64.h 2011-08-23 21:48:14.000000000 -0400
2836 @@ -14,18 +14,40 @@
2837 #define ATOMIC64_INIT(i) { (i) }
2838
2839 #define atomic_read(v) (*(volatile int *)&(v)->counter)
2840 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
2841 +{
2842 + return v->counter;
2843 +}
2844 #define atomic64_read(v) (*(volatile long *)&(v)->counter)
2845 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
2846 +{
2847 + return v->counter;
2848 +}
2849
2850 #define atomic_set(v, i) (((v)->counter) = i)
2851 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
2852 +{
2853 + v->counter = i;
2854 +}
2855 #define atomic64_set(v, i) (((v)->counter) = i)
2856 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
2857 +{
2858 + v->counter = i;
2859 +}
2860
2861 extern void atomic_add(int, atomic_t *);
2862 +extern void atomic_add_unchecked(int, atomic_unchecked_t *);
2863 extern void atomic64_add(long, atomic64_t *);
2864 +extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
2865 extern void atomic_sub(int, atomic_t *);
2866 +extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
2867 extern void atomic64_sub(long, atomic64_t *);
2868 +extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
2869
2870 extern int atomic_add_ret(int, atomic_t *);
2871 +extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
2872 extern long atomic64_add_ret(long, atomic64_t *);
2873 +extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
2874 extern int atomic_sub_ret(int, atomic_t *);
2875 extern long atomic64_sub_ret(long, atomic64_t *);
2876
2877 @@ -33,13 +55,29 @@ extern long atomic64_sub_ret(long, atomi
2878 #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
2879
2880 #define atomic_inc_return(v) atomic_add_ret(1, v)
2881 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
2882 +{
2883 + return atomic_add_ret_unchecked(1, v);
2884 +}
2885 #define atomic64_inc_return(v) atomic64_add_ret(1, v)
2886 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
2887 +{
2888 + return atomic64_add_ret_unchecked(1, v);
2889 +}
2890
2891 #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
2892 #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
2893
2894 #define atomic_add_return(i, v) atomic_add_ret(i, v)
2895 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
2896 +{
2897 + return atomic_add_ret_unchecked(i, v);
2898 +}
2899 #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
2900 +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
2901 +{
2902 + return atomic64_add_ret_unchecked(i, v);
2903 +}
2904
2905 /*
2906 * atomic_inc_and_test - increment and test
2907 @@ -50,6 +88,10 @@ extern long atomic64_sub_ret(long, atomi
2908 * other cases.
2909 */
2910 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
2911 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
2912 +{
2913 + return atomic_inc_return_unchecked(v) == 0;
2914 +}
2915 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
2916
2917 #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
2918 @@ -59,30 +101,65 @@ extern long atomic64_sub_ret(long, atomi
2919 #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
2920
2921 #define atomic_inc(v) atomic_add(1, v)
2922 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
2923 +{
2924 + atomic_add_unchecked(1, v);
2925 +}
2926 #define atomic64_inc(v) atomic64_add(1, v)
2927 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
2928 +{
2929 + atomic64_add_unchecked(1, v);
2930 +}
2931
2932 #define atomic_dec(v) atomic_sub(1, v)
2933 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
2934 +{
2935 + atomic_sub_unchecked(1, v);
2936 +}
2937 #define atomic64_dec(v) atomic64_sub(1, v)
2938 +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
2939 +{
2940 + atomic64_sub_unchecked(1, v);
2941 +}
2942
2943 #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
2944 #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
2945
2946 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
2947 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
2948 +{
2949 + return cmpxchg(&v->counter, old, new);
2950 +}
2951 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
2952 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
2953 +{
2954 + return xchg(&v->counter, new);
2955 +}
2956
2957 static inline int atomic_add_unless(atomic_t *v, int a, int u)
2958 {
2959 - int c, old;
2960 + int c, old, new;
2961 c = atomic_read(v);
2962 for (;;) {
2963 - if (unlikely(c == (u)))
2964 + if (unlikely(c == u))
2965 break;
2966 - old = atomic_cmpxchg((v), c, c + (a));
2967 +
2968 + asm volatile("addcc %2, %0, %0\n"
2969 +
2970 +#ifdef CONFIG_PAX_REFCOUNT
2971 + "tvs %%icc, 6\n"
2972 +#endif
2973 +
2974 + : "=r" (new)
2975 + : "0" (c), "ir" (a)
2976 + : "cc");
2977 +
2978 + old = atomic_cmpxchg(v, c, new);
2979 if (likely(old == c))
2980 break;
2981 c = old;
2982 }
2983 - return c != (u);
2984 + return c != u;
2985 }
2986
2987 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
2988 @@ -90,20 +167,35 @@ static inline int atomic_add_unless(atom
2989 #define atomic64_cmpxchg(v, o, n) \
2990 ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
2991 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
2992 +static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
2993 +{
2994 + return xchg(&v->counter, new);
2995 +}
2996
2997 static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
2998 {
2999 - long c, old;
3000 + long c, old, new;
3001 c = atomic64_read(v);
3002 for (;;) {
3003 - if (unlikely(c == (u)))
3004 + if (unlikely(c == u))
3005 break;
3006 - old = atomic64_cmpxchg((v), c, c + (a));
3007 +
3008 + asm volatile("addcc %2, %0, %0\n"
3009 +
3010 +#ifdef CONFIG_PAX_REFCOUNT
3011 + "tvs %%xcc, 6\n"
3012 +#endif
3013 +
3014 + : "=r" (new)
3015 + : "0" (c), "ir" (a)
3016 + : "cc");
3017 +
3018 + old = atomic64_cmpxchg(v, c, new);
3019 if (likely(old == c))
3020 break;
3021 c = old;
3022 }
3023 - return c != (u);
3024 + return c != u;
3025 }
3026
3027 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
3028 diff -urNp linux-3.0.8/arch/sparc/include/asm/cache.h linux-3.0.8/arch/sparc/include/asm/cache.h
3029 --- linux-3.0.8/arch/sparc/include/asm/cache.h 2011-07-21 22:17:23.000000000 -0400
3030 +++ linux-3.0.8/arch/sparc/include/asm/cache.h 2011-08-23 21:47:55.000000000 -0400
3031 @@ -10,7 +10,7 @@
3032 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
3033
3034 #define L1_CACHE_SHIFT 5
3035 -#define L1_CACHE_BYTES 32
3036 +#define L1_CACHE_BYTES 32UL
3037
3038 #ifdef CONFIG_SPARC32
3039 #define SMP_CACHE_BYTES_SHIFT 5
3040 diff -urNp linux-3.0.8/arch/sparc/include/asm/elf_32.h linux-3.0.8/arch/sparc/include/asm/elf_32.h
3041 --- linux-3.0.8/arch/sparc/include/asm/elf_32.h 2011-07-21 22:17:23.000000000 -0400
3042 +++ linux-3.0.8/arch/sparc/include/asm/elf_32.h 2011-08-23 21:47:55.000000000 -0400
3043 @@ -114,6 +114,13 @@ typedef struct {
3044
3045 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
3046
3047 +#ifdef CONFIG_PAX_ASLR
3048 +#define PAX_ELF_ET_DYN_BASE 0x10000UL
3049 +
3050 +#define PAX_DELTA_MMAP_LEN 16
3051 +#define PAX_DELTA_STACK_LEN 16
3052 +#endif
3053 +
3054 /* This yields a mask that user programs can use to figure out what
3055 instruction set this cpu supports. This can NOT be done in userspace
3056 on Sparc. */
3057 diff -urNp linux-3.0.8/arch/sparc/include/asm/elf_64.h linux-3.0.8/arch/sparc/include/asm/elf_64.h
3058 --- linux-3.0.8/arch/sparc/include/asm/elf_64.h 2011-10-24 08:05:21.000000000 -0400
3059 +++ linux-3.0.8/arch/sparc/include/asm/elf_64.h 2011-08-23 21:47:55.000000000 -0400
3060 @@ -180,6 +180,13 @@ typedef struct {
3061 #define ELF_ET_DYN_BASE 0x0000010000000000UL
3062 #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
3063
3064 +#ifdef CONFIG_PAX_ASLR
3065 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
3066 +
3067 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
3068 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
3069 +#endif
3070 +
3071 extern unsigned long sparc64_elf_hwcap;
3072 #define ELF_HWCAP sparc64_elf_hwcap
3073
3074 diff -urNp linux-3.0.8/arch/sparc/include/asm/pgtable_32.h linux-3.0.8/arch/sparc/include/asm/pgtable_32.h
3075 --- linux-3.0.8/arch/sparc/include/asm/pgtable_32.h 2011-07-21 22:17:23.000000000 -0400
3076 +++ linux-3.0.8/arch/sparc/include/asm/pgtable_32.h 2011-08-23 21:47:55.000000000 -0400
3077 @@ -45,6 +45,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
3078 BTFIXUPDEF_INT(page_none)
3079 BTFIXUPDEF_INT(page_copy)
3080 BTFIXUPDEF_INT(page_readonly)
3081 +
3082 +#ifdef CONFIG_PAX_PAGEEXEC
3083 +BTFIXUPDEF_INT(page_shared_noexec)
3084 +BTFIXUPDEF_INT(page_copy_noexec)
3085 +BTFIXUPDEF_INT(page_readonly_noexec)
3086 +#endif
3087 +
3088 BTFIXUPDEF_INT(page_kernel)
3089
3090 #define PMD_SHIFT SUN4C_PMD_SHIFT
3091 @@ -66,6 +73,16 @@ extern pgprot_t PAGE_SHARED;
3092 #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy))
3093 #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly))
3094
3095 +#ifdef CONFIG_PAX_PAGEEXEC
3096 +extern pgprot_t PAGE_SHARED_NOEXEC;
3097 +# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec))
3098 +# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec))
3099 +#else
3100 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
3101 +# define PAGE_COPY_NOEXEC PAGE_COPY
3102 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
3103 +#endif
3104 +
3105 extern unsigned long page_kernel;
3106
3107 #ifdef MODULE
3108 diff -urNp linux-3.0.8/arch/sparc/include/asm/pgtsrmmu.h linux-3.0.8/arch/sparc/include/asm/pgtsrmmu.h
3109 --- linux-3.0.8/arch/sparc/include/asm/pgtsrmmu.h 2011-07-21 22:17:23.000000000 -0400
3110 +++ linux-3.0.8/arch/sparc/include/asm/pgtsrmmu.h 2011-08-23 21:47:55.000000000 -0400
3111 @@ -115,6 +115,13 @@
3112 SRMMU_EXEC | SRMMU_REF)
3113 #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
3114 SRMMU_EXEC | SRMMU_REF)
3115 +
3116 +#ifdef CONFIG_PAX_PAGEEXEC
3117 +#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
3118 +#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
3119 +#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
3120 +#endif
3121 +
3122 #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
3123 SRMMU_DIRTY | SRMMU_REF)
3124
3125 diff -urNp linux-3.0.8/arch/sparc/include/asm/spinlock_64.h linux-3.0.8/arch/sparc/include/asm/spinlock_64.h
3126 --- linux-3.0.8/arch/sparc/include/asm/spinlock_64.h 2011-10-24 08:05:30.000000000 -0400
3127 +++ linux-3.0.8/arch/sparc/include/asm/spinlock_64.h 2011-10-16 21:55:27.000000000 -0400
3128 @@ -92,14 +92,19 @@ static inline void arch_spin_lock_flags(
3129
3130 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
3131
3132 -static void inline arch_read_lock(arch_rwlock_t *lock)
3133 +static inline void arch_read_lock(arch_rwlock_t *lock)
3134 {
3135 unsigned long tmp1, tmp2;
3136
3137 __asm__ __volatile__ (
3138 "1: ldsw [%2], %0\n"
3139 " brlz,pn %0, 2f\n"
3140 -"4: add %0, 1, %1\n"
3141 +"4: addcc %0, 1, %1\n"
3142 +
3143 +#ifdef CONFIG_PAX_REFCOUNT
3144 +" tvs %%icc, 6\n"
3145 +#endif
3146 +
3147 " cas [%2], %0, %1\n"
3148 " cmp %0, %1\n"
3149 " bne,pn %%icc, 1b\n"
3150 @@ -112,10 +117,10 @@ static void inline arch_read_lock(arch_r
3151 " .previous"
3152 : "=&r" (tmp1), "=&r" (tmp2)
3153 : "r" (lock)
3154 - : "memory");
3155 + : "memory", "cc");
3156 }
3157
3158 -static int inline arch_read_trylock(arch_rwlock_t *lock)
3159 +static inline int arch_read_trylock(arch_rwlock_t *lock)
3160 {
3161 int tmp1, tmp2;
3162
3163 @@ -123,7 +128,12 @@ static int inline arch_read_trylock(arch
3164 "1: ldsw [%2], %0\n"
3165 " brlz,a,pn %0, 2f\n"
3166 " mov 0, %0\n"
3167 -" add %0, 1, %1\n"
3168 +" addcc %0, 1, %1\n"
3169 +
3170 +#ifdef CONFIG_PAX_REFCOUNT
3171 +" tvs %%icc, 6\n"
3172 +#endif
3173 +
3174 " cas [%2], %0, %1\n"
3175 " cmp %0, %1\n"
3176 " bne,pn %%icc, 1b\n"
3177 @@ -136,13 +146,18 @@ static int inline arch_read_trylock(arch
3178 return tmp1;
3179 }
3180
3181 -static void inline arch_read_unlock(arch_rwlock_t *lock)
3182 +static inline void arch_read_unlock(arch_rwlock_t *lock)
3183 {
3184 unsigned long tmp1, tmp2;
3185
3186 __asm__ __volatile__(
3187 "1: lduw [%2], %0\n"
3188 -" sub %0, 1, %1\n"
3189 +" subcc %0, 1, %1\n"
3190 +
3191 +#ifdef CONFIG_PAX_REFCOUNT
3192 +" tvs %%icc, 6\n"
3193 +#endif
3194 +
3195 " cas [%2], %0, %1\n"
3196 " cmp %0, %1\n"
3197 " bne,pn %%xcc, 1b\n"
3198 @@ -152,7 +167,7 @@ static void inline arch_read_unlock(arch
3199 : "memory");
3200 }
3201
3202 -static void inline arch_write_lock(arch_rwlock_t *lock)
3203 +static inline void arch_write_lock(arch_rwlock_t *lock)
3204 {
3205 unsigned long mask, tmp1, tmp2;
3206
3207 @@ -177,7 +192,7 @@ static void inline arch_write_lock(arch_
3208 : "memory");
3209 }
3210
3211 -static void inline arch_write_unlock(arch_rwlock_t *lock)
3212 +static inline void arch_write_unlock(arch_rwlock_t *lock)
3213 {
3214 __asm__ __volatile__(
3215 " stw %%g0, [%0]"
3216 @@ -186,7 +201,7 @@ static void inline arch_write_unlock(arc
3217 : "memory");
3218 }
3219
3220 -static int inline arch_write_trylock(arch_rwlock_t *lock)
3221 +static inline int arch_write_trylock(arch_rwlock_t *lock)
3222 {
3223 unsigned long mask, tmp1, tmp2, result;
3224
3225 diff -urNp linux-3.0.8/arch/sparc/include/asm/thread_info_32.h linux-3.0.8/arch/sparc/include/asm/thread_info_32.h
3226 --- linux-3.0.8/arch/sparc/include/asm/thread_info_32.h 2011-07-21 22:17:23.000000000 -0400
3227 +++ linux-3.0.8/arch/sparc/include/asm/thread_info_32.h 2011-08-23 21:47:55.000000000 -0400
3228 @@ -50,6 +50,8 @@ struct thread_info {
3229 unsigned long w_saved;
3230
3231 struct restart_block restart_block;
3232 +
3233 + unsigned long lowest_stack;
3234 };
3235
3236 /*
3237 diff -urNp linux-3.0.8/arch/sparc/include/asm/thread_info_64.h linux-3.0.8/arch/sparc/include/asm/thread_info_64.h
3238 --- linux-3.0.8/arch/sparc/include/asm/thread_info_64.h 2011-07-21 22:17:23.000000000 -0400
3239 +++ linux-3.0.8/arch/sparc/include/asm/thread_info_64.h 2011-08-23 21:47:55.000000000 -0400
3240 @@ -63,6 +63,8 @@ struct thread_info {
3241 struct pt_regs *kern_una_regs;
3242 unsigned int kern_una_insn;
3243
3244 + unsigned long lowest_stack;
3245 +
3246 unsigned long fpregs[0] __attribute__ ((aligned(64)));
3247 };
3248
3249 diff -urNp linux-3.0.8/arch/sparc/include/asm/uaccess_32.h linux-3.0.8/arch/sparc/include/asm/uaccess_32.h
3250 --- linux-3.0.8/arch/sparc/include/asm/uaccess_32.h 2011-07-21 22:17:23.000000000 -0400
3251 +++ linux-3.0.8/arch/sparc/include/asm/uaccess_32.h 2011-08-23 21:47:55.000000000 -0400
3252 @@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
3253
3254 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
3255 {
3256 - if (n && __access_ok((unsigned long) to, n))
3257 + if ((long)n < 0)
3258 + return n;
3259 +
3260 + if (n && __access_ok((unsigned long) to, n)) {
3261 + if (!__builtin_constant_p(n))
3262 + check_object_size(from, n, true);
3263 return __copy_user(to, (__force void __user *) from, n);
3264 - else
3265 + } else
3266 return n;
3267 }
3268
3269 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
3270 {
3271 + if ((long)n < 0)
3272 + return n;
3273 +
3274 + if (!__builtin_constant_p(n))
3275 + check_object_size(from, n, true);
3276 +
3277 return __copy_user(to, (__force void __user *) from, n);
3278 }
3279
3280 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
3281 {
3282 - if (n && __access_ok((unsigned long) from, n))
3283 + if ((long)n < 0)
3284 + return n;
3285 +
3286 + if (n && __access_ok((unsigned long) from, n)) {
3287 + if (!__builtin_constant_p(n))
3288 + check_object_size(to, n, false);
3289 return __copy_user((__force void __user *) to, from, n);
3290 - else
3291 + } else
3292 return n;
3293 }
3294
3295 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
3296 {
3297 + if ((long)n < 0)
3298 + return n;
3299 +
3300 return __copy_user((__force void __user *) to, from, n);
3301 }
3302
3303 diff -urNp linux-3.0.8/arch/sparc/include/asm/uaccess_64.h linux-3.0.8/arch/sparc/include/asm/uaccess_64.h
3304 --- linux-3.0.8/arch/sparc/include/asm/uaccess_64.h 2011-07-21 22:17:23.000000000 -0400
3305 +++ linux-3.0.8/arch/sparc/include/asm/uaccess_64.h 2011-08-23 21:47:55.000000000 -0400
3306 @@ -10,6 +10,7 @@
3307 #include <linux/compiler.h>
3308 #include <linux/string.h>
3309 #include <linux/thread_info.h>
3310 +#include <linux/kernel.h>
3311 #include <asm/asi.h>
3312 #include <asm/system.h>
3313 #include <asm/spitfire.h>
3314 @@ -213,8 +214,15 @@ extern unsigned long copy_from_user_fixu
3315 static inline unsigned long __must_check
3316 copy_from_user(void *to, const void __user *from, unsigned long size)
3317 {
3318 - unsigned long ret = ___copy_from_user(to, from, size);
3319 + unsigned long ret;
3320
3321 + if ((long)size < 0 || size > INT_MAX)
3322 + return size;
3323 +
3324 + if (!__builtin_constant_p(size))
3325 + check_object_size(to, size, false);
3326 +
3327 + ret = ___copy_from_user(to, from, size);
3328 if (unlikely(ret))
3329 ret = copy_from_user_fixup(to, from, size);
3330
3331 @@ -230,8 +238,15 @@ extern unsigned long copy_to_user_fixup(
3332 static inline unsigned long __must_check
3333 copy_to_user(void __user *to, const void *from, unsigned long size)
3334 {
3335 - unsigned long ret = ___copy_to_user(to, from, size);
3336 + unsigned long ret;
3337 +
3338 + if ((long)size < 0 || size > INT_MAX)
3339 + return size;
3340 +
3341 + if (!__builtin_constant_p(size))
3342 + check_object_size(from, size, true);
3343
3344 + ret = ___copy_to_user(to, from, size);
3345 if (unlikely(ret))
3346 ret = copy_to_user_fixup(to, from, size);
3347 return ret;
3348 diff -urNp linux-3.0.8/arch/sparc/include/asm/uaccess.h linux-3.0.8/arch/sparc/include/asm/uaccess.h
3349 --- linux-3.0.8/arch/sparc/include/asm/uaccess.h 2011-07-21 22:17:23.000000000 -0400
3350 +++ linux-3.0.8/arch/sparc/include/asm/uaccess.h 2011-08-23 21:47:55.000000000 -0400
3351 @@ -1,5 +1,13 @@
3352 #ifndef ___ASM_SPARC_UACCESS_H
3353 #define ___ASM_SPARC_UACCESS_H
3354 +
3355 +#ifdef __KERNEL__
3356 +#ifndef __ASSEMBLY__
3357 +#include <linux/types.h>
3358 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
3359 +#endif
3360 +#endif
3361 +
3362 #if defined(__sparc__) && defined(__arch64__)
3363 #include <asm/uaccess_64.h>
3364 #else
3365 diff -urNp linux-3.0.8/arch/sparc/kernel/Makefile linux-3.0.8/arch/sparc/kernel/Makefile
3366 --- linux-3.0.8/arch/sparc/kernel/Makefile 2011-10-24 08:05:30.000000000 -0400
3367 +++ linux-3.0.8/arch/sparc/kernel/Makefile 2011-10-16 21:55:27.000000000 -0400
3368 @@ -3,7 +3,7 @@
3369 #
3370
3371 asflags-y := -ansi
3372 -ccflags-y := -Werror
3373 +#ccflags-y := -Werror
3374
3375 extra-y := head_$(BITS).o
3376 extra-y += init_task.o
3377 diff -urNp linux-3.0.8/arch/sparc/kernel/process_32.c linux-3.0.8/arch/sparc/kernel/process_32.c
3378 --- linux-3.0.8/arch/sparc/kernel/process_32.c 2011-07-21 22:17:23.000000000 -0400
3379 +++ linux-3.0.8/arch/sparc/kernel/process_32.c 2011-08-23 21:48:14.000000000 -0400
3380 @@ -204,7 +204,7 @@ void __show_backtrace(unsigned long fp)
3381 rw->ins[4], rw->ins[5],
3382 rw->ins[6],
3383 rw->ins[7]);
3384 - printk("%pS\n", (void *) rw->ins[7]);
3385 + printk("%pA\n", (void *) rw->ins[7]);
3386 rw = (struct reg_window32 *) rw->ins[6];
3387 }
3388 spin_unlock_irqrestore(&sparc_backtrace_lock, flags);
3389 @@ -271,14 +271,14 @@ void show_regs(struct pt_regs *r)
3390
3391 printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
3392 r->psr, r->pc, r->npc, r->y, print_tainted());
3393 - printk("PC: <%pS>\n", (void *) r->pc);
3394 + printk("PC: <%pA>\n", (void *) r->pc);
3395 printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
3396 r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
3397 r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
3398 printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
3399 r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
3400 r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
3401 - printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
3402 + printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
3403
3404 printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
3405 rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
3406 @@ -313,7 +313,7 @@ void show_stack(struct task_struct *tsk,
3407 rw = (struct reg_window32 *) fp;
3408 pc = rw->ins[7];
3409 printk("[%08lx : ", pc);
3410 - printk("%pS ] ", (void *) pc);
3411 + printk("%pA ] ", (void *) pc);
3412 fp = rw->ins[6];
3413 } while (++count < 16);
3414 printk("\n");
3415 diff -urNp linux-3.0.8/arch/sparc/kernel/process_64.c linux-3.0.8/arch/sparc/kernel/process_64.c
3416 --- linux-3.0.8/arch/sparc/kernel/process_64.c 2011-07-21 22:17:23.000000000 -0400
3417 +++ linux-3.0.8/arch/sparc/kernel/process_64.c 2011-08-23 21:48:14.000000000 -0400
3418 @@ -180,14 +180,14 @@ static void show_regwindow(struct pt_reg
3419 printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
3420 rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
3421 if (regs->tstate & TSTATE_PRIV)
3422 - printk("I7: <%pS>\n", (void *) rwk->ins[7]);
3423 + printk("I7: <%pA>\n", (void *) rwk->ins[7]);
3424 }
3425
3426 void show_regs(struct pt_regs *regs)
3427 {
3428 printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
3429 regs->tpc, regs->tnpc, regs->y, print_tainted());
3430 - printk("TPC: <%pS>\n", (void *) regs->tpc);
3431 + printk("TPC: <%pA>\n", (void *) regs->tpc);
3432 printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
3433 regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
3434 regs->u_regs[3]);
3435 @@ -200,7 +200,7 @@ void show_regs(struct pt_regs *regs)
3436 printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
3437 regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
3438 regs->u_regs[15]);
3439 - printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
3440 + printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
3441 show_regwindow(regs);
3442 show_stack(current, (unsigned long *) regs->u_regs[UREG_FP]);
3443 }
3444 @@ -285,7 +285,7 @@ void arch_trigger_all_cpu_backtrace(void
3445 ((tp && tp->task) ? tp->task->pid : -1));
3446
3447 if (gp->tstate & TSTATE_PRIV) {
3448 - printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
3449 + printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
3450 (void *) gp->tpc,
3451 (void *) gp->o7,
3452 (void *) gp->i7,
3453 diff -urNp linux-3.0.8/arch/sparc/kernel/sys_sparc_32.c linux-3.0.8/arch/sparc/kernel/sys_sparc_32.c
3454 --- linux-3.0.8/arch/sparc/kernel/sys_sparc_32.c 2011-07-21 22:17:23.000000000 -0400
3455 +++ linux-3.0.8/arch/sparc/kernel/sys_sparc_32.c 2011-08-23 21:47:55.000000000 -0400
3456 @@ -56,7 +56,7 @@ unsigned long arch_get_unmapped_area(str
3457 if (ARCH_SUN4C && len > 0x20000000)
3458 return -ENOMEM;
3459 if (!addr)
3460 - addr = TASK_UNMAPPED_BASE;
3461 + addr = current->mm->mmap_base;
3462
3463 if (flags & MAP_SHARED)
3464 addr = COLOUR_ALIGN(addr);
3465 @@ -71,7 +71,7 @@ unsigned long arch_get_unmapped_area(str
3466 }
3467 if (TASK_SIZE - PAGE_SIZE - len < addr)
3468 return -ENOMEM;
3469 - if (!vmm || addr + len <= vmm->vm_start)
3470 + if (check_heap_stack_gap(vmm, addr, len))
3471 return addr;
3472 addr = vmm->vm_end;
3473 if (flags & MAP_SHARED)
3474 diff -urNp linux-3.0.8/arch/sparc/kernel/sys_sparc_64.c linux-3.0.8/arch/sparc/kernel/sys_sparc_64.c
3475 --- linux-3.0.8/arch/sparc/kernel/sys_sparc_64.c 2011-07-21 22:17:23.000000000 -0400
3476 +++ linux-3.0.8/arch/sparc/kernel/sys_sparc_64.c 2011-08-23 21:47:55.000000000 -0400
3477 @@ -124,7 +124,7 @@ unsigned long arch_get_unmapped_area(str
3478 /* We do not accept a shared mapping if it would violate
3479 * cache aliasing constraints.
3480 */
3481 - if ((flags & MAP_SHARED) &&
3482 + if ((filp || (flags & MAP_SHARED)) &&
3483 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
3484 return -EINVAL;
3485 return addr;
3486 @@ -139,6 +139,10 @@ unsigned long arch_get_unmapped_area(str
3487 if (filp || (flags & MAP_SHARED))
3488 do_color_align = 1;
3489
3490 +#ifdef CONFIG_PAX_RANDMMAP
3491 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
3492 +#endif
3493 +
3494 if (addr) {
3495 if (do_color_align)
3496 addr = COLOUR_ALIGN(addr, pgoff);
3497 @@ -146,15 +150,14 @@ unsigned long arch_get_unmapped_area(str
3498 addr = PAGE_ALIGN(addr);
3499
3500 vma = find_vma(mm, addr);
3501 - if (task_size - len >= addr &&
3502 - (!vma || addr + len <= vma->vm_start))
3503 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
3504 return addr;
3505 }
3506
3507 if (len > mm->cached_hole_size) {
3508 - start_addr = addr = mm->free_area_cache;
3509 + start_addr = addr = mm->free_area_cache;
3510 } else {
3511 - start_addr = addr = TASK_UNMAPPED_BASE;
3512 + start_addr = addr = mm->mmap_base;
3513 mm->cached_hole_size = 0;
3514 }
3515
3516 @@ -174,14 +177,14 @@ full_search:
3517 vma = find_vma(mm, VA_EXCLUDE_END);
3518 }
3519 if (unlikely(task_size < addr)) {
3520 - if (start_addr != TASK_UNMAPPED_BASE) {
3521 - start_addr = addr = TASK_UNMAPPED_BASE;
3522 + if (start_addr != mm->mmap_base) {
3523 + start_addr = addr = mm->mmap_base;
3524 mm->cached_hole_size = 0;
3525 goto full_search;
3526 }
3527 return -ENOMEM;
3528 }
3529 - if (likely(!vma || addr + len <= vma->vm_start)) {
3530 + if (likely(check_heap_stack_gap(vma, addr, len))) {
3531 /*
3532 * Remember the place where we stopped the search:
3533 */
3534 @@ -215,7 +218,7 @@ arch_get_unmapped_area_topdown(struct fi
3535 /* We do not accept a shared mapping if it would violate
3536 * cache aliasing constraints.
3537 */
3538 - if ((flags & MAP_SHARED) &&
3539 + if ((filp || (flags & MAP_SHARED)) &&
3540 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
3541 return -EINVAL;
3542 return addr;
3543 @@ -236,8 +239,7 @@ arch_get_unmapped_area_topdown(struct fi
3544 addr = PAGE_ALIGN(addr);
3545
3546 vma = find_vma(mm, addr);
3547 - if (task_size - len >= addr &&
3548 - (!vma || addr + len <= vma->vm_start))
3549 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
3550 return addr;
3551 }
3552
3553 @@ -258,7 +260,7 @@ arch_get_unmapped_area_topdown(struct fi
3554 /* make sure it can fit in the remaining address space */
3555 if (likely(addr > len)) {
3556 vma = find_vma(mm, addr-len);
3557 - if (!vma || addr <= vma->vm_start) {
3558 + if (check_heap_stack_gap(vma, addr - len, len)) {
3559 /* remember the address as a hint for next time */
3560 return (mm->free_area_cache = addr-len);
3561 }
3562 @@ -267,18 +269,18 @@ arch_get_unmapped_area_topdown(struct fi
3563 if (unlikely(mm->mmap_base < len))
3564 goto bottomup;
3565
3566 - addr = mm->mmap_base-len;
3567 - if (do_color_align)
3568 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3569 + addr = mm->mmap_base - len;
3570
3571 do {
3572 + if (do_color_align)
3573 + addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3574 /*
3575 * Lookup failure means no vma is above this address,
3576 * else if new region fits below vma->vm_start,
3577 * return with success:
3578 */
3579 vma = find_vma(mm, addr);
3580 - if (likely(!vma || addr+len <= vma->vm_start)) {
3581 + if (likely(check_heap_stack_gap(vma, addr, len))) {
3582 /* remember the address as a hint for next time */
3583 return (mm->free_area_cache = addr);
3584 }
3585 @@ -288,10 +290,8 @@ arch_get_unmapped_area_topdown(struct fi
3586 mm->cached_hole_size = vma->vm_start - addr;
3587
3588 /* try just below the current vma->vm_start */
3589 - addr = vma->vm_start-len;
3590 - if (do_color_align)
3591 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3592 - } while (likely(len < vma->vm_start));
3593 + addr = skip_heap_stack_gap(vma, len);
3594 + } while (!IS_ERR_VALUE(addr));
3595
3596 bottomup:
3597 /*
3598 @@ -390,6 +390,12 @@ void arch_pick_mmap_layout(struct mm_str
3599 gap == RLIM_INFINITY ||
3600 sysctl_legacy_va_layout) {
3601 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
3602 +
3603 +#ifdef CONFIG_PAX_RANDMMAP
3604 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3605 + mm->mmap_base += mm->delta_mmap;
3606 +#endif
3607 +
3608 mm->get_unmapped_area = arch_get_unmapped_area;
3609 mm->unmap_area = arch_unmap_area;
3610 } else {
3611 @@ -402,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_str
3612 gap = (task_size / 6 * 5);
3613
3614 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
3615 +
3616 +#ifdef CONFIG_PAX_RANDMMAP
3617 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3618 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3619 +#endif
3620 +
3621 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
3622 mm->unmap_area = arch_unmap_area_topdown;
3623 }
3624 diff -urNp linux-3.0.8/arch/sparc/kernel/traps_32.c linux-3.0.8/arch/sparc/kernel/traps_32.c
3625 --- linux-3.0.8/arch/sparc/kernel/traps_32.c 2011-07-21 22:17:23.000000000 -0400
3626 +++ linux-3.0.8/arch/sparc/kernel/traps_32.c 2011-08-23 21:48:14.000000000 -0400
3627 @@ -44,6 +44,8 @@ static void instruction_dump(unsigned lo
3628 #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
3629 #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
3630
3631 +extern void gr_handle_kernel_exploit(void);
3632 +
3633 void die_if_kernel(char *str, struct pt_regs *regs)
3634 {
3635 static int die_counter;
3636 @@ -76,15 +78,17 @@ void die_if_kernel(char *str, struct pt_
3637 count++ < 30 &&
3638 (((unsigned long) rw) >= PAGE_OFFSET) &&
3639 !(((unsigned long) rw) & 0x7)) {
3640 - printk("Caller[%08lx]: %pS\n", rw->ins[7],
3641 + printk("Caller[%08lx]: %pA\n", rw->ins[7],
3642 (void *) rw->ins[7]);
3643 rw = (struct reg_window32 *)rw->ins[6];
3644 }
3645 }
3646 printk("Instruction DUMP:");
3647 instruction_dump ((unsigned long *) regs->pc);
3648 - if(regs->psr & PSR_PS)
3649 + if(regs->psr & PSR_PS) {
3650 + gr_handle_kernel_exploit();
3651 do_exit(SIGKILL);
3652 + }
3653 do_exit(SIGSEGV);
3654 }
3655
3656 diff -urNp linux-3.0.8/arch/sparc/kernel/traps_64.c linux-3.0.8/arch/sparc/kernel/traps_64.c
3657 --- linux-3.0.8/arch/sparc/kernel/traps_64.c 2011-07-21 22:17:23.000000000 -0400
3658 +++ linux-3.0.8/arch/sparc/kernel/traps_64.c 2011-08-23 21:48:14.000000000 -0400
3659 @@ -75,7 +75,7 @@ static void dump_tl1_traplog(struct tl1_
3660 i + 1,
3661 p->trapstack[i].tstate, p->trapstack[i].tpc,
3662 p->trapstack[i].tnpc, p->trapstack[i].tt);
3663 - printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
3664 + printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
3665 }
3666 }
3667
3668 @@ -95,6 +95,12 @@ void bad_trap(struct pt_regs *regs, long
3669
3670 lvl -= 0x100;
3671 if (regs->tstate & TSTATE_PRIV) {
3672 +
3673 +#ifdef CONFIG_PAX_REFCOUNT
3674 + if (lvl == 6)
3675 + pax_report_refcount_overflow(regs);
3676 +#endif
3677 +
3678 sprintf(buffer, "Kernel bad sw trap %lx", lvl);
3679 die_if_kernel(buffer, regs);
3680 }
3681 @@ -113,11 +119,16 @@ void bad_trap(struct pt_regs *regs, long
3682 void bad_trap_tl1(struct pt_regs *regs, long lvl)
3683 {
3684 char buffer[32];
3685 -
3686 +
3687 if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
3688 0, lvl, SIGTRAP) == NOTIFY_STOP)
3689 return;
3690
3691 +#ifdef CONFIG_PAX_REFCOUNT
3692 + if (lvl == 6)
3693 + pax_report_refcount_overflow(regs);
3694 +#endif
3695 +
3696 dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
3697
3698 sprintf (buffer, "Bad trap %lx at tl>0", lvl);
3699 @@ -1141,7 +1152,7 @@ static void cheetah_log_errors(struct pt
3700 regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
3701 printk("%s" "ERROR(%d): ",
3702 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
3703 - printk("TPC<%pS>\n", (void *) regs->tpc);
3704 + printk("TPC<%pA>\n", (void *) regs->tpc);
3705 printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
3706 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
3707 (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
3708 @@ -1748,7 +1759,7 @@ void cheetah_plus_parity_error(int type,
3709 smp_processor_id(),
3710 (type & 0x1) ? 'I' : 'D',
3711 regs->tpc);
3712 - printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
3713 + printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
3714 panic("Irrecoverable Cheetah+ parity error.");
3715 }
3716
3717 @@ -1756,7 +1767,7 @@ void cheetah_plus_parity_error(int type,
3718 smp_processor_id(),
3719 (type & 0x1) ? 'I' : 'D',
3720 regs->tpc);
3721 - printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
3722 + printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
3723 }
3724
3725 struct sun4v_error_entry {
3726 @@ -1963,9 +1974,9 @@ void sun4v_itlb_error_report(struct pt_r
3727
3728 printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
3729 regs->tpc, tl);
3730 - printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
3731 + printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
3732 printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
3733 - printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
3734 + printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
3735 (void *) regs->u_regs[UREG_I7]);
3736 printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
3737 "pte[%lx] error[%lx]\n",
3738 @@ -1987,9 +1998,9 @@ void sun4v_dtlb_error_report(struct pt_r
3739
3740 printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
3741 regs->tpc, tl);
3742 - printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
3743 + printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
3744 printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
3745 - printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
3746 + printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
3747 (void *) regs->u_regs[UREG_I7]);
3748 printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
3749 "pte[%lx] error[%lx]\n",
3750 @@ -2195,13 +2206,13 @@ void show_stack(struct task_struct *tsk,
3751 fp = (unsigned long)sf->fp + STACK_BIAS;
3752 }
3753
3754 - printk(" [%016lx] %pS\n", pc, (void *) pc);
3755 + printk(" [%016lx] %pA\n", pc, (void *) pc);
3756 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
3757 if ((pc + 8UL) == (unsigned long) &return_to_handler) {
3758 int index = tsk->curr_ret_stack;
3759 if (tsk->ret_stack && index >= graph) {
3760 pc = tsk->ret_stack[index - graph].ret;
3761 - printk(" [%016lx] %pS\n", pc, (void *) pc);
3762 + printk(" [%016lx] %pA\n", pc, (void *) pc);
3763 graph++;
3764 }
3765 }
3766 @@ -2226,6 +2237,8 @@ static inline struct reg_window *kernel_
3767 return (struct reg_window *) (fp + STACK_BIAS);
3768 }
3769
3770 +extern void gr_handle_kernel_exploit(void);
3771 +
3772 void die_if_kernel(char *str, struct pt_regs *regs)
3773 {
3774 static int die_counter;
3775 @@ -2254,7 +2267,7 @@ void die_if_kernel(char *str, struct pt_
3776 while (rw &&
3777 count++ < 30 &&
3778 kstack_valid(tp, (unsigned long) rw)) {
3779 - printk("Caller[%016lx]: %pS\n", rw->ins[7],
3780 + printk("Caller[%016lx]: %pA\n", rw->ins[7],
3781 (void *) rw->ins[7]);
3782
3783 rw = kernel_stack_up(rw);
3784 @@ -2267,8 +2280,10 @@ void die_if_kernel(char *str, struct pt_
3785 }
3786 user_instruction_dump ((unsigned int __user *) regs->tpc);
3787 }
3788 - if (regs->tstate & TSTATE_PRIV)
3789 + if (regs->tstate & TSTATE_PRIV) {
3790 + gr_handle_kernel_exploit();
3791 do_exit(SIGKILL);
3792 + }
3793 do_exit(SIGSEGV);
3794 }
3795 EXPORT_SYMBOL(die_if_kernel);
3796 diff -urNp linux-3.0.8/arch/sparc/kernel/unaligned_64.c linux-3.0.8/arch/sparc/kernel/unaligned_64.c
3797 --- linux-3.0.8/arch/sparc/kernel/unaligned_64.c 2011-10-24 08:05:21.000000000 -0400
3798 +++ linux-3.0.8/arch/sparc/kernel/unaligned_64.c 2011-08-23 21:48:14.000000000 -0400
3799 @@ -279,7 +279,7 @@ static void log_unaligned(struct pt_regs
3800 static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
3801
3802 if (__ratelimit(&ratelimit)) {
3803 - printk("Kernel unaligned access at TPC[%lx] %pS\n",
3804 + printk("Kernel unaligned access at TPC[%lx] %pA\n",
3805 regs->tpc, (void *) regs->tpc);
3806 }
3807 }
3808 diff -urNp linux-3.0.8/arch/sparc/lib/atomic_64.S linux-3.0.8/arch/sparc/lib/atomic_64.S
3809 --- linux-3.0.8/arch/sparc/lib/atomic_64.S 2011-07-21 22:17:23.000000000 -0400
3810 +++ linux-3.0.8/arch/sparc/lib/atomic_64.S 2011-08-23 21:47:55.000000000 -0400
3811 @@ -18,7 +18,12 @@
3812 atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
3813 BACKOFF_SETUP(%o2)
3814 1: lduw [%o1], %g1
3815 - add %g1, %o0, %g7
3816 + addcc %g1, %o0, %g7
3817 +
3818 +#ifdef CONFIG_PAX_REFCOUNT
3819 + tvs %icc, 6
3820 +#endif
3821 +
3822 cas [%o1], %g1, %g7
3823 cmp %g1, %g7
3824 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
3825 @@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at
3826 2: BACKOFF_SPIN(%o2, %o3, 1b)
3827 .size atomic_add, .-atomic_add
3828
3829 + .globl atomic_add_unchecked
3830 + .type atomic_add_unchecked,#function
3831 +atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
3832 + BACKOFF_SETUP(%o2)
3833 +1: lduw [%o1], %g1
3834 + add %g1, %o0, %g7
3835 + cas [%o1], %g1, %g7
3836 + cmp %g1, %g7
3837 + bne,pn %icc, 2f
3838 + nop
3839 + retl
3840 + nop
3841 +2: BACKOFF_SPIN(%o2, %o3, 1b)
3842 + .size atomic_add_unchecked, .-atomic_add_unchecked
3843 +
3844 .globl atomic_sub
3845 .type atomic_sub,#function
3846 atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
3847 BACKOFF_SETUP(%o2)
3848 1: lduw [%o1], %g1
3849 - sub %g1, %o0, %g7
3850 + subcc %g1, %o0, %g7
3851 +
3852 +#ifdef CONFIG_PAX_REFCOUNT
3853 + tvs %icc, 6
3854 +#endif
3855 +
3856 cas [%o1], %g1, %g7
3857 cmp %g1, %g7
3858 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
3859 @@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at
3860 2: BACKOFF_SPIN(%o2, %o3, 1b)
3861 .size atomic_sub, .-atomic_sub
3862
3863 + .globl atomic_sub_unchecked
3864 + .type atomic_sub_unchecked,#function
3865 +atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
3866 + BACKOFF_SETUP(%o2)
3867 +1: lduw [%o1], %g1
3868 + sub %g1, %o0, %g7
3869 + cas [%o1], %g1, %g7
3870 + cmp %g1, %g7
3871 + bne,pn %icc, 2f
3872 + nop
3873 + retl
3874 + nop
3875 +2: BACKOFF_SPIN(%o2, %o3, 1b)
3876 + .size atomic_sub_unchecked, .-atomic_sub_unchecked
3877 +
3878 .globl atomic_add_ret
3879 .type atomic_add_ret,#function
3880 atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
3881 BACKOFF_SETUP(%o2)
3882 1: lduw [%o1], %g1
3883 - add %g1, %o0, %g7
3884 + addcc %g1, %o0, %g7
3885 +
3886 +#ifdef CONFIG_PAX_REFCOUNT
3887 + tvs %icc, 6
3888 +#endif
3889 +
3890 cas [%o1], %g1, %g7
3891 cmp %g1, %g7
3892 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
3893 @@ -58,12 +103,33 @@ atomic_add_ret: /* %o0 = increment, %o1
3894 2: BACKOFF_SPIN(%o2, %o3, 1b)
3895 .size atomic_add_ret, .-atomic_add_ret
3896
3897 + .globl atomic_add_ret_unchecked
3898 + .type atomic_add_ret_unchecked,#function
3899 +atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
3900 + BACKOFF_SETUP(%o2)
3901 +1: lduw [%o1], %g1
3902 + addcc %g1, %o0, %g7
3903 + cas [%o1], %g1, %g7
3904 + cmp %g1, %g7
3905 + bne,pn %icc, 2f
3906 + add %g7, %o0, %g7
3907 + sra %g7, 0, %o0
3908 + retl
3909 + nop
3910 +2: BACKOFF_SPIN(%o2, %o3, 1b)
3911 + .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked
3912 +
3913 .globl atomic_sub_ret
3914 .type atomic_sub_ret,#function
3915 atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
3916 BACKOFF_SETUP(%o2)
3917 1: lduw [%o1], %g1
3918 - sub %g1, %o0, %g7
3919 + subcc %g1, %o0, %g7
3920 +
3921 +#ifdef CONFIG_PAX_REFCOUNT
3922 + tvs %icc, 6
3923 +#endif
3924 +
3925 cas [%o1], %g1, %g7
3926 cmp %g1, %g7
3927 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
3928 @@ -78,7 +144,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1
3929 atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
3930 BACKOFF_SETUP(%o2)
3931 1: ldx [%o1], %g1
3932 - add %g1, %o0, %g7
3933 + addcc %g1, %o0, %g7
3934 +
3935 +#ifdef CONFIG_PAX_REFCOUNT
3936 + tvs %xcc, 6
3937 +#endif
3938 +
3939 casx [%o1], %g1, %g7
3940 cmp %g1, %g7
3941 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
3942 @@ -88,12 +159,32 @@ atomic64_add: /* %o0 = increment, %o1 =
3943 2: BACKOFF_SPIN(%o2, %o3, 1b)
3944 .size atomic64_add, .-atomic64_add
3945
3946 + .globl atomic64_add_unchecked
3947 + .type atomic64_add_unchecked,#function
3948 +atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
3949 + BACKOFF_SETUP(%o2)
3950 +1: ldx [%o1], %g1
3951 + addcc %g1, %o0, %g7
3952 + casx [%o1], %g1, %g7
3953 + cmp %g1, %g7
3954 + bne,pn %xcc, 2f
3955 + nop
3956 + retl
3957 + nop
3958 +2: BACKOFF_SPIN(%o2, %o3, 1b)
3959 + .size atomic64_add_unchecked, .-atomic64_add_unchecked
3960 +
3961 .globl atomic64_sub
3962 .type atomic64_sub,#function
3963 atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
3964 BACKOFF_SETUP(%o2)
3965 1: ldx [%o1], %g1
3966 - sub %g1, %o0, %g7
3967 + subcc %g1, %o0, %g7
3968 +
3969 +#ifdef CONFIG_PAX_REFCOUNT
3970 + tvs %xcc, 6
3971 +#endif
3972 +
3973 casx [%o1], %g1, %g7
3974 cmp %g1, %g7
3975 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
3976 @@ -103,12 +194,32 @@ atomic64_sub: /* %o0 = decrement, %o1 =
3977 2: BACKOFF_SPIN(%o2, %o3, 1b)
3978 .size atomic64_sub, .-atomic64_sub
3979
3980 + .globl atomic64_sub_unchecked
3981 + .type atomic64_sub_unchecked,#function
3982 +atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
3983 + BACKOFF_SETUP(%o2)
3984 +1: ldx [%o1], %g1
3985 + subcc %g1, %o0, %g7
3986 + casx [%o1], %g1, %g7
3987 + cmp %g1, %g7
3988 + bne,pn %xcc, 2f
3989 + nop
3990 + retl
3991 + nop
3992 +2: BACKOFF_SPIN(%o2, %o3, 1b)
3993 + .size atomic64_sub_unchecked, .-atomic64_sub_unchecked
3994 +
3995 .globl atomic64_add_ret
3996 .type atomic64_add_ret,#function
3997 atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
3998 BACKOFF_SETUP(%o2)
3999 1: ldx [%o1], %g1
4000 - add %g1, %o0, %g7
4001 + addcc %g1, %o0, %g7
4002 +
4003 +#ifdef CONFIG_PAX_REFCOUNT
4004 + tvs %xcc, 6
4005 +#endif
4006 +
4007 casx [%o1], %g1, %g7
4008 cmp %g1, %g7
4009 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4010 @@ -118,12 +229,33 @@ atomic64_add_ret: /* %o0 = increment, %o
4011 2: BACKOFF_SPIN(%o2, %o3, 1b)
4012 .size atomic64_add_ret, .-atomic64_add_ret
4013
4014 + .globl atomic64_add_ret_unchecked
4015 + .type atomic64_add_ret_unchecked,#function
4016 +atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4017 + BACKOFF_SETUP(%o2)
4018 +1: ldx [%o1], %g1
4019 + addcc %g1, %o0, %g7
4020 + casx [%o1], %g1, %g7
4021 + cmp %g1, %g7
4022 + bne,pn %xcc, 2f
4023 + add %g7, %o0, %g7
4024 + mov %g7, %o0
4025 + retl
4026 + nop
4027 +2: BACKOFF_SPIN(%o2, %o3, 1b)
4028 + .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
4029 +
4030 .globl atomic64_sub_ret
4031 .type atomic64_sub_ret,#function
4032 atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
4033 BACKOFF_SETUP(%o2)
4034 1: ldx [%o1], %g1
4035 - sub %g1, %o0, %g7
4036 + subcc %g1, %o0, %g7
4037 +
4038 +#ifdef CONFIG_PAX_REFCOUNT
4039 + tvs %xcc, 6
4040 +#endif
4041 +
4042 casx [%o1], %g1, %g7
4043 cmp %g1, %g7
4044 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4045 diff -urNp linux-3.0.8/arch/sparc/lib/ksyms.c linux-3.0.8/arch/sparc/lib/ksyms.c
4046 --- linux-3.0.8/arch/sparc/lib/ksyms.c 2011-07-21 22:17:23.000000000 -0400
4047 +++ linux-3.0.8/arch/sparc/lib/ksyms.c 2011-08-23 21:48:14.000000000 -0400
4048 @@ -142,12 +142,18 @@ EXPORT_SYMBOL(__downgrade_write);
4049
4050 /* Atomic counter implementation. */
4051 EXPORT_SYMBOL(atomic_add);
4052 +EXPORT_SYMBOL(atomic_add_unchecked);
4053 EXPORT_SYMBOL(atomic_add_ret);
4054 +EXPORT_SYMBOL(atomic_add_ret_unchecked);
4055 EXPORT_SYMBOL(atomic_sub);
4056 +EXPORT_SYMBOL(atomic_sub_unchecked);
4057 EXPORT_SYMBOL(atomic_sub_ret);
4058 EXPORT_SYMBOL(atomic64_add);
4059 +EXPORT_SYMBOL(atomic64_add_unchecked);
4060 EXPORT_SYMBOL(atomic64_add_ret);
4061 +EXPORT_SYMBOL(atomic64_add_ret_unchecked);
4062 EXPORT_SYMBOL(atomic64_sub);
4063 +EXPORT_SYMBOL(atomic64_sub_unchecked);
4064 EXPORT_SYMBOL(atomic64_sub_ret);
4065
4066 /* Atomic bit operations. */
4067 diff -urNp linux-3.0.8/arch/sparc/lib/Makefile linux-3.0.8/arch/sparc/lib/Makefile
4068 --- linux-3.0.8/arch/sparc/lib/Makefile 2011-10-24 08:05:21.000000000 -0400
4069 +++ linux-3.0.8/arch/sparc/lib/Makefile 2011-08-23 21:47:55.000000000 -0400
4070 @@ -2,7 +2,7 @@
4071 #
4072
4073 asflags-y := -ansi -DST_DIV0=0x02
4074 -ccflags-y := -Werror
4075 +#ccflags-y := -Werror
4076
4077 lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
4078 lib-$(CONFIG_SPARC32) += memcpy.o memset.o
4079 diff -urNp linux-3.0.8/arch/sparc/Makefile linux-3.0.8/arch/sparc/Makefile
4080 --- linux-3.0.8/arch/sparc/Makefile 2011-07-21 22:17:23.000000000 -0400
4081 +++ linux-3.0.8/arch/sparc/Makefile 2011-08-23 21:48:14.000000000 -0400
4082 @@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc
4083 # Export what is needed by arch/sparc/boot/Makefile
4084 export VMLINUX_INIT VMLINUX_MAIN
4085 VMLINUX_INIT := $(head-y) $(init-y)
4086 -VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
4087 +VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
4088 VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
4089 VMLINUX_MAIN += $(drivers-y) $(net-y)
4090
4091 diff -urNp linux-3.0.8/arch/sparc/mm/fault_32.c linux-3.0.8/arch/sparc/mm/fault_32.c
4092 --- linux-3.0.8/arch/sparc/mm/fault_32.c 2011-07-21 22:17:23.000000000 -0400
4093 +++ linux-3.0.8/arch/sparc/mm/fault_32.c 2011-08-23 21:47:55.000000000 -0400
4094 @@ -22,6 +22,9 @@
4095 #include <linux/interrupt.h>
4096 #include <linux/module.h>
4097 #include <linux/kdebug.h>
4098 +#include <linux/slab.h>
4099 +#include <linux/pagemap.h>
4100 +#include <linux/compiler.h>
4101
4102 #include <asm/system.h>
4103 #include <asm/page.h>
4104 @@ -209,6 +212,268 @@ static unsigned long compute_si_addr(str
4105 return safe_compute_effective_address(regs, insn);
4106 }
4107
4108 +#ifdef CONFIG_PAX_PAGEEXEC
4109 +#ifdef CONFIG_PAX_DLRESOLVE
4110 +static void pax_emuplt_close(struct vm_area_struct *vma)
4111 +{
4112 + vma->vm_mm->call_dl_resolve = 0UL;
4113 +}
4114 +
4115 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
4116 +{
4117 + unsigned int *kaddr;
4118 +
4119 + vmf->page = alloc_page(GFP_HIGHUSER);
4120 + if (!vmf->page)
4121 + return VM_FAULT_OOM;
4122 +
4123 + kaddr = kmap(vmf->page);
4124 + memset(kaddr, 0, PAGE_SIZE);
4125 + kaddr[0] = 0x9DE3BFA8U; /* save */
4126 + flush_dcache_page(vmf->page);
4127 + kunmap(vmf->page);
4128 + return VM_FAULT_MAJOR;
4129 +}
4130 +
4131 +static const struct vm_operations_struct pax_vm_ops = {
4132 + .close = pax_emuplt_close,
4133 + .fault = pax_emuplt_fault
4134 +};
4135 +
4136 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
4137 +{
4138 + int ret;
4139 +
4140 + INIT_LIST_HEAD(&vma->anon_vma_chain);
4141 + vma->vm_mm = current->mm;
4142 + vma->vm_start = addr;
4143 + vma->vm_end = addr + PAGE_SIZE;
4144 + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
4145 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
4146 + vma->vm_ops = &pax_vm_ops;
4147 +
4148 + ret = insert_vm_struct(current->mm, vma);
4149 + if (ret)
4150 + return ret;
4151 +
4152 + ++current->mm->total_vm;
4153 + return 0;
4154 +}
4155 +#endif
4156 +
4157 +/*
4158 + * PaX: decide what to do with offenders (regs->pc = fault address)
4159 + *
4160 + * returns 1 when task should be killed
4161 + * 2 when patched PLT trampoline was detected
4162 + * 3 when unpatched PLT trampoline was detected
4163 + */
4164 +static int pax_handle_fetch_fault(struct pt_regs *regs)
4165 +{
4166 +
4167 +#ifdef CONFIG_PAX_EMUPLT
4168 + int err;
4169 +
4170 + do { /* PaX: patched PLT emulation #1 */
4171 + unsigned int sethi1, sethi2, jmpl;
4172 +
4173 + err = get_user(sethi1, (unsigned int *)regs->pc);
4174 + err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
4175 + err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
4176 +
4177 + if (err)
4178 + break;
4179 +
4180 + if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
4181 + (sethi2 & 0xFFC00000U) == 0x03000000U &&
4182 + (jmpl & 0xFFFFE000U) == 0x81C06000U)
4183 + {
4184 + unsigned int addr;
4185 +
4186 + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
4187 + addr = regs->u_regs[UREG_G1];
4188 + addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4189 + regs->pc = addr;
4190 + regs->npc = addr+4;
4191 + return 2;
4192 + }
4193 + } while (0);
4194 +
4195 + { /* PaX: patched PLT emulation #2 */
4196 + unsigned int ba;
4197 +
4198 + err = get_user(ba, (unsigned int *)regs->pc);
4199 +
4200 + if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
4201 + unsigned int addr;
4202 +
4203 + addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
4204 + regs->pc = addr;
4205 + regs->npc = addr+4;
4206 + return 2;
4207 + }
4208 + }
4209 +
4210 + do { /* PaX: patched PLT emulation #3 */
4211 + unsigned int sethi, jmpl, nop;
4212 +
4213 + err = get_user(sethi, (unsigned int *)regs->pc);
4214 + err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
4215 + err |= get_user(nop, (unsigned int *)(regs->pc+8));
4216 +
4217 + if (err)
4218 + break;
4219 +
4220 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
4221 + (jmpl & 0xFFFFE000U) == 0x81C06000U &&
4222 + nop == 0x01000000U)
4223 + {
4224 + unsigned int addr;
4225 +
4226 + addr = (sethi & 0x003FFFFFU) << 10;
4227 + regs->u_regs[UREG_G1] = addr;
4228 + addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4229 + regs->pc = addr;
4230 + regs->npc = addr+4;
4231 + return 2;
4232 + }
4233 + } while (0);
4234 +
4235 + do { /* PaX: unpatched PLT emulation step 1 */
4236 + unsigned int sethi, ba, nop;
4237 +
4238 + err = get_user(sethi, (unsigned int *)regs->pc);
4239 + err |= get_user(ba, (unsigned int *)(regs->pc+4));
4240 + err |= get_user(nop, (unsigned int *)(regs->pc+8));
4241 +
4242 + if (err)
4243 + break;
4244 +
4245 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
4246 + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
4247 + nop == 0x01000000U)
4248 + {
4249 + unsigned int addr, save, call;
4250 +
4251 + if ((ba & 0xFFC00000U) == 0x30800000U)
4252 + addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
4253 + else
4254 + addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
4255 +
4256 + err = get_user(save, (unsigned int *)addr);
4257 + err |= get_user(call, (unsigned int *)(addr+4));
4258 + err |= get_user(nop, (unsigned int *)(addr+8));
4259 + if (err)
4260 + break;
4261 +
4262 +#ifdef CONFIG_PAX_DLRESOLVE
4263 + if (save == 0x9DE3BFA8U &&
4264 + (call & 0xC0000000U) == 0x40000000U &&
4265 + nop == 0x01000000U)
4266 + {
4267 + struct vm_area_struct *vma;
4268 + unsigned long call_dl_resolve;
4269 +
4270 + down_read(&current->mm->mmap_sem);
4271 + call_dl_resolve = current->mm->call_dl_resolve;
4272 + up_read(&current->mm->mmap_sem);
4273 + if (likely(call_dl_resolve))
4274 + goto emulate;
4275 +
4276 + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
4277 +
4278 + down_write(&current->mm->mmap_sem);
4279 + if (current->mm->call_dl_resolve) {
4280 + call_dl_resolve = current->mm->call_dl_resolve;
4281 + up_write(&current->mm->mmap_sem);
4282 + if (vma)
4283 + kmem_cache_free(vm_area_cachep, vma);
4284 + goto emulate;
4285 + }
4286 +
4287 + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
4288 + if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
4289 + up_write(&current->mm->mmap_sem);
4290 + if (vma)
4291 + kmem_cache_free(vm_area_cachep, vma);
4292 + return 1;
4293 + }
4294 +
4295 + if (pax_insert_vma(vma, call_dl_resolve)) {
4296 + up_write(&current->mm->mmap_sem);
4297 + kmem_cache_free(vm_area_cachep, vma);
4298 + return 1;
4299 + }
4300 +
4301 + current->mm->call_dl_resolve = call_dl_resolve;
4302 + up_write(&current->mm->mmap_sem);
4303 +
4304 +emulate:
4305 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4306 + regs->pc = call_dl_resolve;
4307 + regs->npc = addr+4;
4308 + return 3;
4309 + }
4310 +#endif
4311 +
4312 + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
4313 + if ((save & 0xFFC00000U) == 0x05000000U &&
4314 + (call & 0xFFFFE000U) == 0x85C0A000U &&
4315 + nop == 0x01000000U)
4316 + {
4317 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4318 + regs->u_regs[UREG_G2] = addr + 4;
4319 + addr = (save & 0x003FFFFFU) << 10;
4320 + addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4321 + regs->pc = addr;
4322 + regs->npc = addr+4;
4323 + return 3;
4324 + }
4325 + }
4326 + } while (0);
4327 +
4328 + do { /* PaX: unpatched PLT emulation step 2 */
4329 + unsigned int save, call, nop;
4330 +
4331 + err = get_user(save, (unsigned int *)(regs->pc-4));
4332 + err |= get_user(call, (unsigned int *)regs->pc);
4333 + err |= get_user(nop, (unsigned int *)(regs->pc+4));
4334 + if (err)
4335 + break;
4336 +
4337 + if (save == 0x9DE3BFA8U &&
4338 + (call & 0xC0000000U) == 0x40000000U &&
4339 + nop == 0x01000000U)
4340 + {
4341 + unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
4342 +
4343 + regs->u_regs[UREG_RETPC] = regs->pc;
4344 + regs->pc = dl_resolve;
4345 + regs->npc = dl_resolve+4;
4346 + return 3;
4347 + }
4348 + } while (0);
4349 +#endif
4350 +
4351 + return 1;
4352 +}
4353 +
4354 +void pax_report_insns(void *pc, void *sp)
4355 +{
4356 + unsigned long i;
4357 +
4358 + printk(KERN_ERR "PAX: bytes at PC: ");
4359 + for (i = 0; i < 8; i++) {
4360 + unsigned int c;
4361 + if (get_user(c, (unsigned int *)pc+i))
4362 + printk(KERN_CONT "???????? ");
4363 + else
4364 + printk(KERN_CONT "%08x ", c);
4365 + }
4366 + printk("\n");
4367 +}
4368 +#endif
4369 +
4370 static noinline void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
4371 int text_fault)
4372 {
4373 @@ -281,6 +546,24 @@ good_area:
4374 if(!(vma->vm_flags & VM_WRITE))
4375 goto bad_area;
4376 } else {
4377 +
4378 +#ifdef CONFIG_PAX_PAGEEXEC
4379 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
4380 + up_read(&mm->mmap_sem);
4381 + switch (pax_handle_fetch_fault(regs)) {
4382 +
4383 +#ifdef CONFIG_PAX_EMUPLT
4384 + case 2:
4385 + case 3:
4386 + return;
4387 +#endif
4388 +
4389 + }
4390 + pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
4391 + do_group_exit(SIGKILL);
4392 + }
4393 +#endif
4394 +
4395 /* Allow reads even for write-only mappings */
4396 if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
4397 goto bad_area;
4398 diff -urNp linux-3.0.8/arch/sparc/mm/fault_64.c linux-3.0.8/arch/sparc/mm/fault_64.c
4399 --- linux-3.0.8/arch/sparc/mm/fault_64.c 2011-07-21 22:17:23.000000000 -0400
4400 +++ linux-3.0.8/arch/sparc/mm/fault_64.c 2011-08-23 21:48:14.000000000 -0400
4401 @@ -21,6 +21,9 @@
4402 #include <linux/kprobes.h>
4403 #include <linux/kdebug.h>
4404 #include <linux/percpu.h>
4405 +#include <linux/slab.h>
4406 +#include <linux/pagemap.h>
4407 +#include <linux/compiler.h>
4408
4409 #include <asm/page.h>
4410 #include <asm/pgtable.h>
4411 @@ -74,7 +77,7 @@ static void __kprobes bad_kernel_pc(stru
4412 printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
4413 regs->tpc);
4414 printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
4415 - printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
4416 + printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
4417 printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
4418 dump_stack();
4419 unhandled_fault(regs->tpc, current, regs);
4420 @@ -272,6 +275,457 @@ static void noinline __kprobes bogus_32b
4421 show_regs(regs);
4422 }
4423
4424 +#ifdef CONFIG_PAX_PAGEEXEC
4425 +#ifdef CONFIG_PAX_DLRESOLVE
4426 +static void pax_emuplt_close(struct vm_area_struct *vma)
4427 +{
4428 + vma->vm_mm->call_dl_resolve = 0UL;
4429 +}
4430 +
4431 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
4432 +{
4433 + unsigned int *kaddr;
4434 +
4435 + vmf->page = alloc_page(GFP_HIGHUSER);
4436 + if (!vmf->page)
4437 + return VM_FAULT_OOM;
4438 +
4439 + kaddr = kmap(vmf->page);
4440 + memset(kaddr, 0, PAGE_SIZE);
4441 + kaddr[0] = 0x9DE3BFA8U; /* save */
4442 + flush_dcache_page(vmf->page);
4443 + kunmap(vmf->page);
4444 + return VM_FAULT_MAJOR;
4445 +}
4446 +
4447 +static const struct vm_operations_struct pax_vm_ops = {
4448 + .close = pax_emuplt_close,
4449 + .fault = pax_emuplt_fault
4450 +};
4451 +
4452 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
4453 +{
4454 + int ret;
4455 +
4456 + INIT_LIST_HEAD(&vma->anon_vma_chain);
4457 + vma->vm_mm = current->mm;
4458 + vma->vm_start = addr;
4459 + vma->vm_end = addr + PAGE_SIZE;
4460 + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
4461 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
4462 + vma->vm_ops = &pax_vm_ops;
4463 +
4464 + ret = insert_vm_struct(current->mm, vma);
4465 + if (ret)
4466 + return ret;
4467 +
4468 + ++current->mm->total_vm;
4469 + return 0;
4470 +}
4471 +#endif
4472 +
4473 +/*
4474 + * PaX: decide what to do with offenders (regs->tpc = fault address)
4475 + *
4476 + * returns 1 when task should be killed
4477 + * 2 when patched PLT trampoline was detected
4478 + * 3 when unpatched PLT trampoline was detected
4479 + */
4480 +static int pax_handle_fetch_fault(struct pt_regs *regs)
4481 +{
4482 +
4483 +#ifdef CONFIG_PAX_EMUPLT
4484 + int err;
4485 +
4486 + do { /* PaX: patched PLT emulation #1 */
4487 + unsigned int sethi1, sethi2, jmpl;
4488 +
4489 + err = get_user(sethi1, (unsigned int *)regs->tpc);
4490 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
4491 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
4492 +
4493 + if (err)
4494 + break;
4495 +
4496 + if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
4497 + (sethi2 & 0xFFC00000U) == 0x03000000U &&
4498 + (jmpl & 0xFFFFE000U) == 0x81C06000U)
4499 + {
4500 + unsigned long addr;
4501 +
4502 + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
4503 + addr = regs->u_regs[UREG_G1];
4504 + addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
4505 +
4506 + if (test_thread_flag(TIF_32BIT))
4507 + addr &= 0xFFFFFFFFUL;
4508 +
4509 + regs->tpc = addr;
4510 + regs->tnpc = addr+4;
4511 + return 2;
4512 + }
4513 + } while (0);
4514 +
4515 + { /* PaX: patched PLT emulation #2 */
4516 + unsigned int ba;
4517 +
4518 + err = get_user(ba, (unsigned int *)regs->tpc);
4519 +
4520 + if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
4521 + unsigned long addr;
4522 +
4523 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
4524 +
4525 + if (test_thread_flag(TIF_32BIT))
4526 + addr &= 0xFFFFFFFFUL;
4527 +
4528 + regs->tpc = addr;
4529 + regs->tnpc = addr+4;
4530 + return 2;
4531 + }
4532 + }
4533 +
4534 + do { /* PaX: patched PLT emulation #3 */
4535 + unsigned int sethi, jmpl, nop;
4536 +
4537 + err = get_user(sethi, (unsigned int *)regs->tpc);
4538 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
4539 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
4540 +
4541 + if (err)
4542 + break;
4543 +
4544 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
4545 + (jmpl & 0xFFFFE000U) == 0x81C06000U &&
4546 + nop == 0x01000000U)
4547 + {
4548 + unsigned long addr;
4549 +
4550 + addr = (sethi & 0x003FFFFFU) << 10;
4551 + regs->u_regs[UREG_G1] = addr;
4552 + addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
4553 +
4554 + if (test_thread_flag(TIF_32BIT))
4555 + addr &= 0xFFFFFFFFUL;
4556 +
4557 + regs->tpc = addr;
4558 + regs->tnpc = addr+4;
4559 + return 2;
4560 + }
4561 + } while (0);
4562 +
4563 + do { /* PaX: patched PLT emulation #4 */
4564 + unsigned int sethi, mov1, call, mov2;
4565 +
4566 + err = get_user(sethi, (unsigned int *)regs->tpc);
4567 + err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
4568 + err |= get_user(call, (unsigned int *)(regs->tpc+8));
4569 + err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
4570 +
4571 + if (err)
4572 + break;
4573 +
4574 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
4575 + mov1 == 0x8210000FU &&
4576 + (call & 0xC0000000U) == 0x40000000U &&
4577 + mov2 == 0x9E100001U)
4578 + {
4579 + unsigned long addr;
4580 +
4581 + regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
4582 + addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
4583 +
4584 + if (test_thread_flag(TIF_32BIT))
4585 + addr &= 0xFFFFFFFFUL;
4586 +
4587 + regs->tpc = addr;
4588 + regs->tnpc = addr+4;
4589 + return 2;
4590 + }
4591 + } while (0);
4592 +
4593 + do { /* PaX: patched PLT emulation #5 */
4594 + unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
4595 +
4596 + err = get_user(sethi, (unsigned int *)regs->tpc);
4597 + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
4598 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
4599 + err |= get_user(or1, (unsigned int *)(regs->tpc+12));
4600 + err |= get_user(or2, (unsigned int *)(regs->tpc+16));
4601 + err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
4602 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
4603 + err |= get_user(nop, (unsigned int *)(regs->tpc+28));
4604 +
4605 + if (err)
4606 + break;
4607 +
4608 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
4609 + (sethi1 & 0xFFC00000U) == 0x03000000U &&
4610 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
4611 + (or1 & 0xFFFFE000U) == 0x82106000U &&
4612 + (or2 & 0xFFFFE000U) == 0x8A116000U &&
4613 + sllx == 0x83287020U &&
4614 + jmpl == 0x81C04005U &&
4615 + nop == 0x01000000U)
4616 + {
4617 + unsigned long addr;
4618 +
4619 + regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
4620 + regs->u_regs[UREG_G1] <<= 32;
4621 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
4622 + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
4623 + regs->tpc = addr;
4624 + regs->tnpc = addr+4;
4625 + return 2;
4626 + }
4627 + } while (0);
4628 +
4629 + do { /* PaX: patched PLT emulation #6 */
4630 + unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
4631 +
4632 + err = get_user(sethi, (unsigned int *)regs->tpc);
4633 + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
4634 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
4635 + err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
4636 + err |= get_user(or, (unsigned int *)(regs->tpc+16));
4637 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
4638 + err |= get_user(nop, (unsigned int *)(regs->tpc+24));
4639 +
4640 + if (err)
4641 + break;
4642 +
4643 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
4644 + (sethi1 & 0xFFC00000U) == 0x03000000U &&
4645 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
4646 + sllx == 0x83287020U &&
4647 + (or & 0xFFFFE000U) == 0x8A116000U &&
4648 + jmpl == 0x81C04005U &&
4649 + nop == 0x01000000U)
4650 + {
4651 + unsigned long addr;
4652 +
4653 + regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
4654 + regs->u_regs[UREG_G1] <<= 32;
4655 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
4656 + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
4657 + regs->tpc = addr;
4658 + regs->tnpc = addr+4;
4659 + return 2;
4660 + }
4661 + } while (0);
4662 +
4663 + do { /* PaX: unpatched PLT emulation step 1 */
4664 + unsigned int sethi, ba, nop;
4665 +
4666 + err = get_user(sethi, (unsigned int *)regs->tpc);
4667 + err |= get_user(ba, (unsigned int *)(regs->tpc+4));
4668 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
4669 +
4670 + if (err)
4671 + break;
4672 +
4673 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
4674 + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
4675 + nop == 0x01000000U)
4676 + {
4677 + unsigned long addr;
4678 + unsigned int save, call;
4679 + unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
4680 +
4681 + if ((ba & 0xFFC00000U) == 0x30800000U)
4682 + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
4683 + else
4684 + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
4685 +
4686 + if (test_thread_flag(TIF_32BIT))
4687 + addr &= 0xFFFFFFFFUL;
4688 +
4689 + err = get_user(save, (unsigned int *)addr);
4690 + err |= get_user(call, (unsigned int *)(addr+4));
4691 + err |= get_user(nop, (unsigned int *)(addr+8));
4692 + if (err)
4693 + break;
4694 +
4695 +#ifdef CONFIG_PAX_DLRESOLVE
4696 + if (save == 0x9DE3BFA8U &&
4697 + (call & 0xC0000000U) == 0x40000000U &&
4698 + nop == 0x01000000U)
4699 + {
4700 + struct vm_area_struct *vma;
4701 + unsigned long call_dl_resolve;
4702 +
4703 + down_read(&current->mm->mmap_sem);
4704 + call_dl_resolve = current->mm->call_dl_resolve;
4705 + up_read(&current->mm->mmap_sem);
4706 + if (likely(call_dl_resolve))
4707 + goto emulate;
4708 +
4709 + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
4710 +
4711 + down_write(&current->mm->mmap_sem);
4712 + if (current->mm->call_dl_resolve) {
4713 + call_dl_resolve = current->mm->call_dl_resolve;
4714 + up_write(&current->mm->mmap_sem);
4715 + if (vma)
4716 + kmem_cache_free(vm_area_cachep, vma);
4717 + goto emulate;
4718 + }
4719 +
4720 + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
4721 + if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
4722 + up_write(&current->mm->mmap_sem);
4723 + if (vma)
4724 + kmem_cache_free(vm_area_cachep, vma);
4725 + return 1;
4726 + }
4727 +
4728 + if (pax_insert_vma(vma, call_dl_resolve)) {
4729 + up_write(&current->mm->mmap_sem);
4730 + kmem_cache_free(vm_area_cachep, vma);
4731 + return 1;
4732 + }
4733 +
4734 + current->mm->call_dl_resolve = call_dl_resolve;
4735 + up_write(&current->mm->mmap_sem);
4736 +
4737 +emulate:
4738 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4739 + regs->tpc = call_dl_resolve;
4740 + regs->tnpc = addr+4;
4741 + return 3;
4742 + }
4743 +#endif
4744 +
4745 + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
4746 + if ((save & 0xFFC00000U) == 0x05000000U &&
4747 + (call & 0xFFFFE000U) == 0x85C0A000U &&
4748 + nop == 0x01000000U)
4749 + {
4750 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4751 + regs->u_regs[UREG_G2] = addr + 4;
4752 + addr = (save & 0x003FFFFFU) << 10;
4753 + addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
4754 +
4755 + if (test_thread_flag(TIF_32BIT))
4756 + addr &= 0xFFFFFFFFUL;
4757 +
4758 + regs->tpc = addr;
4759 + regs->tnpc = addr+4;
4760 + return 3;
4761 + }
4762 +
4763 + /* PaX: 64-bit PLT stub */
4764 + err = get_user(sethi1, (unsigned int *)addr);
4765 + err |= get_user(sethi2, (unsigned int *)(addr+4));
4766 + err |= get_user(or1, (unsigned int *)(addr+8));
4767 + err |= get_user(or2, (unsigned int *)(addr+12));
4768 + err |= get_user(sllx, (unsigned int *)(addr+16));
4769 + err |= get_user(add, (unsigned int *)(addr+20));
4770 + err |= get_user(jmpl, (unsigned int *)(addr+24));
4771 + err |= get_user(nop, (unsigned int *)(addr+28));
4772 + if (err)
4773 + break;
4774 +
4775 + if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
4776 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
4777 + (or1 & 0xFFFFE000U) == 0x88112000U &&
4778 + (or2 & 0xFFFFE000U) == 0x8A116000U &&
4779 + sllx == 0x89293020U &&
4780 + add == 0x8A010005U &&
4781 + jmpl == 0x89C14000U &&
4782 + nop == 0x01000000U)
4783 + {
4784 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4785 + regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
4786 + regs->u_regs[UREG_G4] <<= 32;
4787 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
4788 + regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
4789 + regs->u_regs[UREG_G4] = addr + 24;
4790 + addr = regs->u_regs[UREG_G5];
4791 + regs->tpc = addr;
4792 + regs->tnpc = addr+4;
4793 + return 3;
4794 + }
4795 + }
4796 + } while (0);
4797 +
4798 +#ifdef CONFIG_PAX_DLRESOLVE
4799 + do { /* PaX: unpatched PLT emulation step 2 */
4800 + unsigned int save, call, nop;
4801 +
4802 + err = get_user(save, (unsigned int *)(regs->tpc-4));
4803 + err |= get_user(call, (unsigned int *)regs->tpc);
4804 + err |= get_user(nop, (unsigned int *)(regs->tpc+4));
4805 + if (err)
4806 + break;
4807 +
4808 + if (save == 0x9DE3BFA8U &&
4809 + (call & 0xC0000000U) == 0x40000000U &&
4810 + nop == 0x01000000U)
4811 + {
4812 + unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
4813 +
4814 + if (test_thread_flag(TIF_32BIT))
4815 + dl_resolve &= 0xFFFFFFFFUL;
4816 +
4817 + regs->u_regs[UREG_RETPC] = regs->tpc;
4818 + regs->tpc = dl_resolve;
4819 + regs->tnpc = dl_resolve+4;
4820 + return 3;
4821 + }
4822 + } while (0);
4823 +#endif
4824 +
4825 + do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
4826 + unsigned int sethi, ba, nop;
4827 +
4828 + err = get_user(sethi, (unsigned int *)regs->tpc);
4829 + err |= get_user(ba, (unsigned int *)(regs->tpc+4));
4830 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
4831 +
4832 + if (err)
4833 + break;
4834 +
4835 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
4836 + (ba & 0xFFF00000U) == 0x30600000U &&
4837 + nop == 0x01000000U)
4838 + {
4839 + unsigned long addr;
4840 +
4841 + addr = (sethi & 0x003FFFFFU) << 10;
4842 + regs->u_regs[UREG_G1] = addr;
4843 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
4844 +
4845 + if (test_thread_flag(TIF_32BIT))
4846 + addr &= 0xFFFFFFFFUL;
4847 +
4848 + regs->tpc = addr;
4849 + regs->tnpc = addr+4;
4850 + return 2;
4851 + }
4852 + } while (0);
4853 +
4854 +#endif
4855 +
4856 + return 1;
4857 +}
4858 +
4859 +void pax_report_insns(void *pc, void *sp)
4860 +{
4861 + unsigned long i;
4862 +
4863 + printk(KERN_ERR "PAX: bytes at PC: ");
4864 + for (i = 0; i < 8; i++) {
4865 + unsigned int c;
4866 + if (get_user(c, (unsigned int *)pc+i))
4867 + printk(KERN_CONT "???????? ");
4868 + else
4869 + printk(KERN_CONT "%08x ", c);
4870 + }
4871 + printk("\n");
4872 +}
4873 +#endif
4874 +
4875 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
4876 {
4877 struct mm_struct *mm = current->mm;
4878 @@ -340,6 +794,29 @@ asmlinkage void __kprobes do_sparc64_fau
4879 if (!vma)
4880 goto bad_area;
4881
4882 +#ifdef CONFIG_PAX_PAGEEXEC
4883 + /* PaX: detect ITLB misses on non-exec pages */
4884 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
4885 + !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
4886 + {
4887 + if (address != regs->tpc)
4888 + goto good_area;
4889 +
4890 + up_read(&mm->mmap_sem);
4891 + switch (pax_handle_fetch_fault(regs)) {
4892 +
4893 +#ifdef CONFIG_PAX_EMUPLT
4894 + case 2:
4895 + case 3:
4896 + return;
4897 +#endif
4898 +
4899 + }
4900 + pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
4901 + do_group_exit(SIGKILL);
4902 + }
4903 +#endif
4904 +
4905 /* Pure DTLB misses do not tell us whether the fault causing
4906 * load/store/atomic was a write or not, it only says that there
4907 * was no match. So in such a case we (carefully) read the
4908 diff -urNp linux-3.0.8/arch/sparc/mm/hugetlbpage.c linux-3.0.8/arch/sparc/mm/hugetlbpage.c
4909 --- linux-3.0.8/arch/sparc/mm/hugetlbpage.c 2011-07-21 22:17:23.000000000 -0400
4910 +++ linux-3.0.8/arch/sparc/mm/hugetlbpage.c 2011-08-23 21:47:55.000000000 -0400
4911 @@ -68,7 +68,7 @@ full_search:
4912 }
4913 return -ENOMEM;
4914 }
4915 - if (likely(!vma || addr + len <= vma->vm_start)) {
4916 + if (likely(check_heap_stack_gap(vma, addr, len))) {
4917 /*
4918 * Remember the place where we stopped the search:
4919 */
4920 @@ -107,7 +107,7 @@ hugetlb_get_unmapped_area_topdown(struct
4921 /* make sure it can fit in the remaining address space */
4922 if (likely(addr > len)) {
4923 vma = find_vma(mm, addr-len);
4924 - if (!vma || addr <= vma->vm_start) {
4925 + if (check_heap_stack_gap(vma, addr - len, len)) {
4926 /* remember the address as a hint for next time */
4927 return (mm->free_area_cache = addr-len);
4928 }
4929 @@ -116,16 +116,17 @@ hugetlb_get_unmapped_area_topdown(struct
4930 if (unlikely(mm->mmap_base < len))
4931 goto bottomup;
4932
4933 - addr = (mm->mmap_base-len) & HPAGE_MASK;
4934 + addr = mm->mmap_base - len;
4935
4936 do {
4937 + addr &= HPAGE_MASK;
4938 /*
4939 * Lookup failure means no vma is above this address,
4940 * else if new region fits below vma->vm_start,
4941 * return with success:
4942 */
4943 vma = find_vma(mm, addr);
4944 - if (likely(!vma || addr+len <= vma->vm_start)) {
4945 + if (likely(check_heap_stack_gap(vma, addr, len))) {
4946 /* remember the address as a hint for next time */
4947 return (mm->free_area_cache = addr);
4948 }
4949 @@ -135,8 +136,8 @@ hugetlb_get_unmapped_area_topdown(struct
4950 mm->cached_hole_size = vma->vm_start - addr;
4951
4952 /* try just below the current vma->vm_start */
4953 - addr = (vma->vm_start-len) & HPAGE_MASK;
4954 - } while (likely(len < vma->vm_start));
4955 + addr = skip_heap_stack_gap(vma, len);
4956 + } while (!IS_ERR_VALUE(addr));
4957
4958 bottomup:
4959 /*
4960 @@ -182,8 +183,7 @@ hugetlb_get_unmapped_area(struct file *f
4961 if (addr) {
4962 addr = ALIGN(addr, HPAGE_SIZE);
4963 vma = find_vma(mm, addr);
4964 - if (task_size - len >= addr &&
4965 - (!vma || addr + len <= vma->vm_start))
4966 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
4967 return addr;
4968 }
4969 if (mm->get_unmapped_area == arch_get_unmapped_area)
4970 diff -urNp linux-3.0.8/arch/sparc/mm/init_32.c linux-3.0.8/arch/sparc/mm/init_32.c
4971 --- linux-3.0.8/arch/sparc/mm/init_32.c 2011-07-21 22:17:23.000000000 -0400
4972 +++ linux-3.0.8/arch/sparc/mm/init_32.c 2011-08-23 21:47:55.000000000 -0400
4973 @@ -316,6 +316,9 @@ extern void device_scan(void);
4974 pgprot_t PAGE_SHARED __read_mostly;
4975 EXPORT_SYMBOL(PAGE_SHARED);
4976
4977 +pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
4978 +EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
4979 +
4980 void __init paging_init(void)
4981 {
4982 switch(sparc_cpu_model) {
4983 @@ -344,17 +347,17 @@ void __init paging_init(void)
4984
4985 /* Initialize the protection map with non-constant, MMU dependent values. */
4986 protection_map[0] = PAGE_NONE;
4987 - protection_map[1] = PAGE_READONLY;
4988 - protection_map[2] = PAGE_COPY;
4989 - protection_map[3] = PAGE_COPY;
4990 + protection_map[1] = PAGE_READONLY_NOEXEC;
4991 + protection_map[2] = PAGE_COPY_NOEXEC;
4992 + protection_map[3] = PAGE_COPY_NOEXEC;
4993 protection_map[4] = PAGE_READONLY;
4994 protection_map[5] = PAGE_READONLY;
4995 protection_map[6] = PAGE_COPY;
4996 protection_map[7] = PAGE_COPY;
4997 protection_map[8] = PAGE_NONE;
4998 - protection_map[9] = PAGE_READONLY;
4999 - protection_map[10] = PAGE_SHARED;
5000 - protection_map[11] = PAGE_SHARED;
5001 + protection_map[9] = PAGE_READONLY_NOEXEC;
5002 + protection_map[10] = PAGE_SHARED_NOEXEC;
5003 + protection_map[11] = PAGE_SHARED_NOEXEC;
5004 protection_map[12] = PAGE_READONLY;
5005 protection_map[13] = PAGE_READONLY;
5006 protection_map[14] = PAGE_SHARED;
5007 diff -urNp linux-3.0.8/arch/sparc/mm/Makefile linux-3.0.8/arch/sparc/mm/Makefile
5008 --- linux-3.0.8/arch/sparc/mm/Makefile 2011-07-21 22:17:23.000000000 -0400
5009 +++ linux-3.0.8/arch/sparc/mm/Makefile 2011-08-23 21:47:55.000000000 -0400
5010 @@ -2,7 +2,7 @@
5011 #
5012
5013 asflags-y := -ansi
5014 -ccflags-y := -Werror
5015 +#ccflags-y := -Werror
5016
5017 obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o
5018 obj-y += fault_$(BITS).o
5019 diff -urNp linux-3.0.8/arch/sparc/mm/srmmu.c linux-3.0.8/arch/sparc/mm/srmmu.c
5020 --- linux-3.0.8/arch/sparc/mm/srmmu.c 2011-07-21 22:17:23.000000000 -0400
5021 +++ linux-3.0.8/arch/sparc/mm/srmmu.c 2011-08-23 21:47:55.000000000 -0400
5022 @@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
5023 PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
5024 BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
5025 BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
5026 +
5027 +#ifdef CONFIG_PAX_PAGEEXEC
5028 + PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
5029 + BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
5030 + BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
5031 +#endif
5032 +
5033 BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
5034 page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
5035
5036 diff -urNp linux-3.0.8/arch/um/include/asm/kmap_types.h linux-3.0.8/arch/um/include/asm/kmap_types.h
5037 --- linux-3.0.8/arch/um/include/asm/kmap_types.h 2011-07-21 22:17:23.000000000 -0400
5038 +++ linux-3.0.8/arch/um/include/asm/kmap_types.h 2011-08-23 21:47:55.000000000 -0400
5039 @@ -23,6 +23,7 @@ enum km_type {
5040 KM_IRQ1,
5041 KM_SOFTIRQ0,
5042 KM_SOFTIRQ1,
5043 + KM_CLEARPAGE,
5044 KM_TYPE_NR
5045 };
5046
5047 diff -urNp linux-3.0.8/arch/um/include/asm/page.h linux-3.0.8/arch/um/include/asm/page.h
5048 --- linux-3.0.8/arch/um/include/asm/page.h 2011-07-21 22:17:23.000000000 -0400
5049 +++ linux-3.0.8/arch/um/include/asm/page.h 2011-08-23 21:47:55.000000000 -0400
5050 @@ -14,6 +14,9 @@
5051 #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
5052 #define PAGE_MASK (~(PAGE_SIZE-1))
5053
5054 +#define ktla_ktva(addr) (addr)
5055 +#define ktva_ktla(addr) (addr)
5056 +
5057 #ifndef __ASSEMBLY__
5058
5059 struct page;
5060 diff -urNp linux-3.0.8/arch/um/kernel/process.c linux-3.0.8/arch/um/kernel/process.c
5061 --- linux-3.0.8/arch/um/kernel/process.c 2011-07-21 22:17:23.000000000 -0400
5062 +++ linux-3.0.8/arch/um/kernel/process.c 2011-08-23 21:47:55.000000000 -0400
5063 @@ -404,22 +404,6 @@ int singlestepping(void * t)
5064 return 2;
5065 }
5066
5067 -/*
5068 - * Only x86 and x86_64 have an arch_align_stack().
5069 - * All other arches have "#define arch_align_stack(x) (x)"
5070 - * in their asm/system.h
5071 - * As this is included in UML from asm-um/system-generic.h,
5072 - * we can use it to behave as the subarch does.
5073 - */
5074 -#ifndef arch_align_stack
5075 -unsigned long arch_align_stack(unsigned long sp)
5076 -{
5077 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
5078 - sp -= get_random_int() % 8192;
5079 - return sp & ~0xf;
5080 -}
5081 -#endif
5082 -
5083 unsigned long get_wchan(struct task_struct *p)
5084 {
5085 unsigned long stack_page, sp, ip;
5086 diff -urNp linux-3.0.8/arch/um/Makefile linux-3.0.8/arch/um/Makefile
5087 --- linux-3.0.8/arch/um/Makefile 2011-07-21 22:17:23.000000000 -0400
5088 +++ linux-3.0.8/arch/um/Makefile 2011-10-20 04:46:01.000000000 -0400
5089 @@ -49,6 +49,10 @@ USER_CFLAGS = $(patsubst $(KERNEL_DEFINE
5090 $(patsubst -I%,,$(KBUILD_CFLAGS)))) $(ARCH_INCLUDE) $(MODE_INCLUDE) \
5091 $(filter -I%,$(CFLAGS)) -D_FILE_OFFSET_BITS=64
5092
5093 +ifdef CONSTIFY_PLUGIN
5094 +USER_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
5095 +endif
5096 +
5097 include $(srctree)/$(ARCH_DIR)/Makefile-$(SUBARCH)
5098
5099 #This will adjust *FLAGS accordingly to the platform.
5100 diff -urNp linux-3.0.8/arch/um/sys-i386/shared/sysdep/system.h linux-3.0.8/arch/um/sys-i386/shared/sysdep/system.h
5101 --- linux-3.0.8/arch/um/sys-i386/shared/sysdep/system.h 2011-07-21 22:17:23.000000000 -0400
5102 +++ linux-3.0.8/arch/um/sys-i386/shared/sysdep/system.h 2011-10-20 04:46:01.000000000 -0400
5103 @@ -17,7 +17,7 @@
5104 # define AT_VECTOR_SIZE_ARCH 1
5105 #endif
5106
5107 -extern unsigned long arch_align_stack(unsigned long sp);
5108 +#define arch_align_stack(x) ((x) & ~0xfUL)
5109
5110 void default_idle(void);
5111
5112 diff -urNp linux-3.0.8/arch/um/sys-i386/syscalls.c linux-3.0.8/arch/um/sys-i386/syscalls.c
5113 --- linux-3.0.8/arch/um/sys-i386/syscalls.c 2011-07-21 22:17:23.000000000 -0400
5114 +++ linux-3.0.8/arch/um/sys-i386/syscalls.c 2011-08-23 21:47:55.000000000 -0400
5115 @@ -11,6 +11,21 @@
5116 #include "asm/uaccess.h"
5117 #include "asm/unistd.h"
5118
5119 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
5120 +{
5121 + unsigned long pax_task_size = TASK_SIZE;
5122 +
5123 +#ifdef CONFIG_PAX_SEGMEXEC
5124 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
5125 + pax_task_size = SEGMEXEC_TASK_SIZE;
5126 +#endif
5127 +
5128 + if (len > pax_task_size || addr > pax_task_size - len)
5129 + return -EINVAL;
5130 +
5131 + return 0;
5132 +}
5133 +
5134 /*
5135 * The prototype on i386 is:
5136 *
5137 diff -urNp linux-3.0.8/arch/um/sys-x86_64/shared/sysdep/system.h linux-3.0.8/arch/um/sys-x86_64/shared/sysdep/system.h
5138 --- linux-3.0.8/arch/um/sys-x86_64/shared/sysdep/system.h 2011-07-21 22:17:23.000000000 -0400
5139 +++ linux-3.0.8/arch/um/sys-x86_64/shared/sysdep/system.h 2011-10-20 04:46:01.000000000 -0400
5140 @@ -17,7 +17,7 @@
5141 # define AT_VECTOR_SIZE_ARCH 1
5142 #endif
5143
5144 -extern unsigned long arch_align_stack(unsigned long sp);
5145 +#define arch_align_stack(x) ((x) & ~0xfUL)
5146
5147 void default_idle(void);
5148
5149 diff -urNp linux-3.0.8/arch/x86/boot/bitops.h linux-3.0.8/arch/x86/boot/bitops.h
5150 --- linux-3.0.8/arch/x86/boot/bitops.h 2011-07-21 22:17:23.000000000 -0400
5151 +++ linux-3.0.8/arch/x86/boot/bitops.h 2011-08-23 21:47:55.000000000 -0400
5152 @@ -26,7 +26,7 @@ static inline int variable_test_bit(int
5153 u8 v;
5154 const u32 *p = (const u32 *)addr;
5155
5156 - asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
5157 + asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
5158 return v;
5159 }
5160
5161 @@ -37,7 +37,7 @@ static inline int variable_test_bit(int
5162
5163 static inline void set_bit(int nr, void *addr)
5164 {
5165 - asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
5166 + asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
5167 }
5168
5169 #endif /* BOOT_BITOPS_H */
5170 diff -urNp linux-3.0.8/arch/x86/boot/boot.h linux-3.0.8/arch/x86/boot/boot.h
5171 --- linux-3.0.8/arch/x86/boot/boot.h 2011-07-21 22:17:23.000000000 -0400
5172 +++ linux-3.0.8/arch/x86/boot/boot.h 2011-08-23 21:47:55.000000000 -0400
5173 @@ -85,7 +85,7 @@ static inline void io_delay(void)
5174 static inline u16 ds(void)
5175 {
5176 u16 seg;
5177 - asm("movw %%ds,%0" : "=rm" (seg));
5178 + asm volatile("movw %%ds,%0" : "=rm" (seg));
5179 return seg;
5180 }
5181
5182 @@ -181,7 +181,7 @@ static inline void wrgs32(u32 v, addr_t
5183 static inline int memcmp(const void *s1, const void *s2, size_t len)
5184 {
5185 u8 diff;
5186 - asm("repe; cmpsb; setnz %0"
5187 + asm volatile("repe; cmpsb; setnz %0"
5188 : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
5189 return diff;
5190 }
5191 diff -urNp linux-3.0.8/arch/x86/boot/compressed/head_32.S linux-3.0.8/arch/x86/boot/compressed/head_32.S
5192 --- linux-3.0.8/arch/x86/boot/compressed/head_32.S 2011-07-21 22:17:23.000000000 -0400
5193 +++ linux-3.0.8/arch/x86/boot/compressed/head_32.S 2011-08-23 21:47:55.000000000 -0400
5194 @@ -76,7 +76,7 @@ ENTRY(startup_32)
5195 notl %eax
5196 andl %eax, %ebx
5197 #else
5198 - movl $LOAD_PHYSICAL_ADDR, %ebx
5199 + movl $____LOAD_PHYSICAL_ADDR, %ebx
5200 #endif
5201
5202 /* Target address to relocate to for decompression */
5203 @@ -162,7 +162,7 @@ relocated:
5204 * and where it was actually loaded.
5205 */
5206 movl %ebp, %ebx
5207 - subl $LOAD_PHYSICAL_ADDR, %ebx
5208 + subl $____LOAD_PHYSICAL_ADDR, %ebx
5209 jz 2f /* Nothing to be done if loaded at compiled addr. */
5210 /*
5211 * Process relocations.
5212 @@ -170,8 +170,7 @@ relocated:
5213
5214 1: subl $4, %edi
5215 movl (%edi), %ecx
5216 - testl %ecx, %ecx
5217 - jz 2f
5218 + jecxz 2f
5219 addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
5220 jmp 1b
5221 2:
5222 diff -urNp linux-3.0.8/arch/x86/boot/compressed/head_64.S linux-3.0.8/arch/x86/boot/compressed/head_64.S
5223 --- linux-3.0.8/arch/x86/boot/compressed/head_64.S 2011-07-21 22:17:23.000000000 -0400
5224 +++ linux-3.0.8/arch/x86/boot/compressed/head_64.S 2011-08-23 21:47:55.000000000 -0400
5225 @@ -91,7 +91,7 @@ ENTRY(startup_32)
5226 notl %eax
5227 andl %eax, %ebx
5228 #else
5229 - movl $LOAD_PHYSICAL_ADDR, %ebx
5230 + movl $____LOAD_PHYSICAL_ADDR, %ebx
5231 #endif
5232
5233 /* Target address to relocate to for decompression */
5234 @@ -233,7 +233,7 @@ ENTRY(startup_64)
5235 notq %rax
5236 andq %rax, %rbp
5237 #else
5238 - movq $LOAD_PHYSICAL_ADDR, %rbp
5239 + movq $____LOAD_PHYSICAL_ADDR, %rbp
5240 #endif
5241
5242 /* Target address to relocate to for decompression */
5243 diff -urNp linux-3.0.8/arch/x86/boot/compressed/Makefile linux-3.0.8/arch/x86/boot/compressed/Makefile
5244 --- linux-3.0.8/arch/x86/boot/compressed/Makefile 2011-07-21 22:17:23.000000000 -0400
5245 +++ linux-3.0.8/arch/x86/boot/compressed/Makefile 2011-08-23 21:47:55.000000000 -0400
5246 @@ -14,6 +14,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=smal
5247 KBUILD_CFLAGS += $(cflags-y)
5248 KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
5249 KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
5250 +ifdef CONSTIFY_PLUGIN
5251 +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
5252 +endif
5253
5254 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
5255 GCOV_PROFILE := n
5256 diff -urNp linux-3.0.8/arch/x86/boot/compressed/misc.c linux-3.0.8/arch/x86/boot/compressed/misc.c
5257 --- linux-3.0.8/arch/x86/boot/compressed/misc.c 2011-07-21 22:17:23.000000000 -0400
5258 +++ linux-3.0.8/arch/x86/boot/compressed/misc.c 2011-08-23 21:47:55.000000000 -0400
5259 @@ -310,7 +310,7 @@ static void parse_elf(void *output)
5260 case PT_LOAD:
5261 #ifdef CONFIG_RELOCATABLE
5262 dest = output;
5263 - dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
5264 + dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
5265 #else
5266 dest = (void *)(phdr->p_paddr);
5267 #endif
5268 @@ -363,7 +363,7 @@ asmlinkage void decompress_kernel(void *
5269 error("Destination address too large");
5270 #endif
5271 #ifndef CONFIG_RELOCATABLE
5272 - if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
5273 + if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
5274 error("Wrong destination address");
5275 #endif
5276
5277 diff -urNp linux-3.0.8/arch/x86/boot/compressed/relocs.c linux-3.0.8/arch/x86/boot/compressed/relocs.c
5278 --- linux-3.0.8/arch/x86/boot/compressed/relocs.c 2011-07-21 22:17:23.000000000 -0400
5279 +++ linux-3.0.8/arch/x86/boot/compressed/relocs.c 2011-08-23 21:47:55.000000000 -0400
5280 @@ -13,8 +13,11 @@
5281
5282 static void die(char *fmt, ...);
5283
5284 +#include "../../../../include/generated/autoconf.h"
5285 +
5286 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
5287 static Elf32_Ehdr ehdr;
5288 +static Elf32_Phdr *phdr;
5289 static unsigned long reloc_count, reloc_idx;
5290 static unsigned long *relocs;
5291
5292 @@ -270,9 +273,39 @@ static void read_ehdr(FILE *fp)
5293 }
5294 }
5295
5296 +static void read_phdrs(FILE *fp)
5297 +{
5298 + unsigned int i;
5299 +
5300 + phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
5301 + if (!phdr) {
5302 + die("Unable to allocate %d program headers\n",
5303 + ehdr.e_phnum);
5304 + }
5305 + if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
5306 + die("Seek to %d failed: %s\n",
5307 + ehdr.e_phoff, strerror(errno));
5308 + }
5309 + if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
5310 + die("Cannot read ELF program headers: %s\n",
5311 + strerror(errno));
5312 + }
5313 + for(i = 0; i < ehdr.e_phnum; i++) {
5314 + phdr[i].p_type = elf32_to_cpu(phdr[i].p_type);
5315 + phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset);
5316 + phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr);
5317 + phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr);
5318 + phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz);
5319 + phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz);
5320 + phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags);
5321 + phdr[i].p_align = elf32_to_cpu(phdr[i].p_align);
5322 + }
5323 +
5324 +}
5325 +
5326 static void read_shdrs(FILE *fp)
5327 {
5328 - int i;
5329 + unsigned int i;
5330 Elf32_Shdr shdr;
5331
5332 secs = calloc(ehdr.e_shnum, sizeof(struct section));
5333 @@ -307,7 +340,7 @@ static void read_shdrs(FILE *fp)
5334
5335 static void read_strtabs(FILE *fp)
5336 {
5337 - int i;
5338 + unsigned int i;
5339 for (i = 0; i < ehdr.e_shnum; i++) {
5340 struct section *sec = &secs[i];
5341 if (sec->shdr.sh_type != SHT_STRTAB) {
5342 @@ -332,7 +365,7 @@ static void read_strtabs(FILE *fp)
5343
5344 static void read_symtabs(FILE *fp)
5345 {
5346 - int i,j;
5347 + unsigned int i,j;
5348 for (i = 0; i < ehdr.e_shnum; i++) {
5349 struct section *sec = &secs[i];
5350 if (sec->shdr.sh_type != SHT_SYMTAB) {
5351 @@ -365,7 +398,9 @@ static void read_symtabs(FILE *fp)
5352
5353 static void read_relocs(FILE *fp)
5354 {
5355 - int i,j;
5356 + unsigned int i,j;
5357 + uint32_t base;
5358 +
5359 for (i = 0; i < ehdr.e_shnum; i++) {
5360 struct section *sec = &secs[i];
5361 if (sec->shdr.sh_type != SHT_REL) {
5362 @@ -385,9 +420,18 @@ static void read_relocs(FILE *fp)
5363 die("Cannot read symbol table: %s\n",
5364 strerror(errno));
5365 }
5366 + base = 0;
5367 + for (j = 0; j < ehdr.e_phnum; j++) {
5368 + if (phdr[j].p_type != PT_LOAD )
5369 + continue;
5370 + if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
5371 + continue;
5372 + base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
5373 + break;
5374 + }
5375 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
5376 Elf32_Rel *rel = &sec->reltab[j];
5377 - rel->r_offset = elf32_to_cpu(rel->r_offset);
5378 + rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
5379 rel->r_info = elf32_to_cpu(rel->r_info);
5380 }
5381 }
5382 @@ -396,14 +440,14 @@ static void read_relocs(FILE *fp)
5383
5384 static void print_absolute_symbols(void)
5385 {
5386 - int i;
5387 + unsigned int i;
5388 printf("Absolute symbols\n");
5389 printf(" Num: Value Size Type Bind Visibility Name\n");
5390 for (i = 0; i < ehdr.e_shnum; i++) {
5391 struct section *sec = &secs[i];
5392 char *sym_strtab;
5393 Elf32_Sym *sh_symtab;
5394 - int j;
5395 + unsigned int j;
5396
5397 if (sec->shdr.sh_type != SHT_SYMTAB) {
5398 continue;
5399 @@ -431,14 +475,14 @@ static void print_absolute_symbols(void)
5400
5401 static void print_absolute_relocs(void)
5402 {
5403 - int i, printed = 0;
5404 + unsigned int i, printed = 0;
5405
5406 for (i = 0; i < ehdr.e_shnum; i++) {
5407 struct section *sec = &secs[i];
5408 struct section *sec_applies, *sec_symtab;
5409 char *sym_strtab;
5410 Elf32_Sym *sh_symtab;
5411 - int j;
5412 + unsigned int j;
5413 if (sec->shdr.sh_type != SHT_REL) {
5414 continue;
5415 }
5416 @@ -499,13 +543,13 @@ static void print_absolute_relocs(void)
5417
5418 static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
5419 {
5420 - int i;
5421 + unsigned int i;
5422 /* Walk through the relocations */
5423 for (i = 0; i < ehdr.e_shnum; i++) {
5424 char *sym_strtab;
5425 Elf32_Sym *sh_symtab;
5426 struct section *sec_applies, *sec_symtab;
5427 - int j;
5428 + unsigned int j;
5429 struct section *sec = &secs[i];
5430
5431 if (sec->shdr.sh_type != SHT_REL) {
5432 @@ -530,6 +574,22 @@ static void walk_relocs(void (*visit)(El
5433 !is_rel_reloc(sym_name(sym_strtab, sym))) {
5434 continue;
5435 }
5436 + /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
5437 + if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
5438 + continue;
5439 +
5440 +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
5441 + /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
5442 + if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
5443 + continue;
5444 + if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
5445 + continue;
5446 + if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
5447 + continue;
5448 + if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
5449 + continue;
5450 +#endif
5451 +
5452 switch (r_type) {
5453 case R_386_NONE:
5454 case R_386_PC32:
5455 @@ -571,7 +631,7 @@ static int cmp_relocs(const void *va, co
5456
5457 static void emit_relocs(int as_text)
5458 {
5459 - int i;
5460 + unsigned int i;
5461 /* Count how many relocations I have and allocate space for them. */
5462 reloc_count = 0;
5463 walk_relocs(count_reloc);
5464 @@ -665,6 +725,7 @@ int main(int argc, char **argv)
5465 fname, strerror(errno));
5466 }
5467 read_ehdr(fp);
5468 + read_phdrs(fp);
5469 read_shdrs(fp);
5470 read_strtabs(fp);
5471 read_symtabs(fp);
5472 diff -urNp linux-3.0.8/arch/x86/boot/cpucheck.c linux-3.0.8/arch/x86/boot/cpucheck.c
5473 --- linux-3.0.8/arch/x86/boot/cpucheck.c 2011-07-21 22:17:23.000000000 -0400
5474 +++ linux-3.0.8/arch/x86/boot/cpucheck.c 2011-08-23 21:47:55.000000000 -0400
5475 @@ -74,7 +74,7 @@ static int has_fpu(void)
5476 u16 fcw = -1, fsw = -1;
5477 u32 cr0;
5478
5479 - asm("movl %%cr0,%0" : "=r" (cr0));
5480 + asm volatile("movl %%cr0,%0" : "=r" (cr0));
5481 if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
5482 cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
5483 asm volatile("movl %0,%%cr0" : : "r" (cr0));
5484 @@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
5485 {
5486 u32 f0, f1;
5487
5488 - asm("pushfl ; "
5489 + asm volatile("pushfl ; "
5490 "pushfl ; "
5491 "popl %0 ; "
5492 "movl %0,%1 ; "
5493 @@ -115,7 +115,7 @@ static void get_flags(void)
5494 set_bit(X86_FEATURE_FPU, cpu.flags);
5495
5496 if (has_eflag(X86_EFLAGS_ID)) {
5497 - asm("cpuid"
5498 + asm volatile("cpuid"
5499 : "=a" (max_intel_level),
5500 "=b" (cpu_vendor[0]),
5501 "=d" (cpu_vendor[1]),
5502 @@ -124,7 +124,7 @@ static void get_flags(void)
5503
5504 if (max_intel_level >= 0x00000001 &&
5505 max_intel_level <= 0x0000ffff) {
5506 - asm("cpuid"
5507 + asm volatile("cpuid"
5508 : "=a" (tfms),
5509 "=c" (cpu.flags[4]),
5510 "=d" (cpu.flags[0])
5511 @@ -136,7 +136,7 @@ static void get_flags(void)
5512 cpu.model += ((tfms >> 16) & 0xf) << 4;
5513 }
5514
5515 - asm("cpuid"
5516 + asm volatile("cpuid"
5517 : "=a" (max_amd_level)
5518 : "a" (0x80000000)
5519 : "ebx", "ecx", "edx");
5520 @@ -144,7 +144,7 @@ static void get_flags(void)
5521 if (max_amd_level >= 0x80000001 &&
5522 max_amd_level <= 0x8000ffff) {
5523 u32 eax = 0x80000001;
5524 - asm("cpuid"
5525 + asm volatile("cpuid"
5526 : "+a" (eax),
5527 "=c" (cpu.flags[6]),
5528 "=d" (cpu.flags[1])
5529 @@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r
5530 u32 ecx = MSR_K7_HWCR;
5531 u32 eax, edx;
5532
5533 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
5534 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
5535 eax &= ~(1 << 15);
5536 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
5537 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
5538
5539 get_flags(); /* Make sure it really did something */
5540 err = check_flags();
5541 @@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r
5542 u32 ecx = MSR_VIA_FCR;
5543 u32 eax, edx;
5544
5545 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
5546 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
5547 eax |= (1<<1)|(1<<7);
5548 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
5549 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
5550
5551 set_bit(X86_FEATURE_CX8, cpu.flags);
5552 err = check_flags();
5553 @@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r
5554 u32 eax, edx;
5555 u32 level = 1;
5556
5557 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
5558 - asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
5559 - asm("cpuid"
5560 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
5561 + asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
5562 + asm volatile("cpuid"
5563 : "+a" (level), "=d" (cpu.flags[0])
5564 : : "ecx", "ebx");
5565 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
5566 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
5567
5568 err = check_flags();
5569 }
5570 diff -urNp linux-3.0.8/arch/x86/boot/header.S linux-3.0.8/arch/x86/boot/header.S
5571 --- linux-3.0.8/arch/x86/boot/header.S 2011-07-21 22:17:23.000000000 -0400
5572 +++ linux-3.0.8/arch/x86/boot/header.S 2011-08-23 21:47:55.000000000 -0400
5573 @@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical
5574 # single linked list of
5575 # struct setup_data
5576
5577 -pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
5578 +pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
5579
5580 #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
5581 #define VO_INIT_SIZE (VO__end - VO__text)
5582 diff -urNp linux-3.0.8/arch/x86/boot/Makefile linux-3.0.8/arch/x86/boot/Makefile
5583 --- linux-3.0.8/arch/x86/boot/Makefile 2011-07-21 22:17:23.000000000 -0400
5584 +++ linux-3.0.8/arch/x86/boot/Makefile 2011-08-23 21:47:55.000000000 -0400
5585 @@ -69,6 +69,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os
5586 $(call cc-option, -fno-stack-protector) \
5587 $(call cc-option, -mpreferred-stack-boundary=2)
5588 KBUILD_CFLAGS += $(call cc-option, -m32)
5589 +ifdef CONSTIFY_PLUGIN
5590 +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
5591 +endif
5592 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
5593 GCOV_PROFILE := n
5594
5595 diff -urNp linux-3.0.8/arch/x86/boot/memory.c linux-3.0.8/arch/x86/boot/memory.c
5596 --- linux-3.0.8/arch/x86/boot/memory.c 2011-07-21 22:17:23.000000000 -0400
5597 +++ linux-3.0.8/arch/x86/boot/memory.c 2011-08-23 21:47:55.000000000 -0400
5598 @@ -19,7 +19,7 @@
5599
5600 static int detect_memory_e820(void)
5601 {
5602 - int count = 0;
5603 + unsigned int count = 0;
5604 struct biosregs ireg, oreg;
5605 struct e820entry *desc = boot_params.e820_map;
5606 static struct e820entry buf; /* static so it is zeroed */
5607 diff -urNp linux-3.0.8/arch/x86/boot/video.c linux-3.0.8/arch/x86/boot/video.c
5608 --- linux-3.0.8/arch/x86/boot/video.c 2011-07-21 22:17:23.000000000 -0400
5609 +++ linux-3.0.8/arch/x86/boot/video.c 2011-08-23 21:47:55.000000000 -0400
5610 @@ -96,7 +96,7 @@ static void store_mode_params(void)
5611 static unsigned int get_entry(void)
5612 {
5613 char entry_buf[4];
5614 - int i, len = 0;
5615 + unsigned int i, len = 0;
5616 int key;
5617 unsigned int v;
5618
5619 diff -urNp linux-3.0.8/arch/x86/boot/video-vesa.c linux-3.0.8/arch/x86/boot/video-vesa.c
5620 --- linux-3.0.8/arch/x86/boot/video-vesa.c 2011-07-21 22:17:23.000000000 -0400
5621 +++ linux-3.0.8/arch/x86/boot/video-vesa.c 2011-08-23 21:47:55.000000000 -0400
5622 @@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
5623
5624 boot_params.screen_info.vesapm_seg = oreg.es;
5625 boot_params.screen_info.vesapm_off = oreg.di;
5626 + boot_params.screen_info.vesapm_size = oreg.cx;
5627 }
5628
5629 /*
5630 diff -urNp linux-3.0.8/arch/x86/crypto/aes-x86_64-asm_64.S linux-3.0.8/arch/x86/crypto/aes-x86_64-asm_64.S
5631 --- linux-3.0.8/arch/x86/crypto/aes-x86_64-asm_64.S 2011-07-21 22:17:23.000000000 -0400
5632 +++ linux-3.0.8/arch/x86/crypto/aes-x86_64-asm_64.S 2011-10-06 04:17:55.000000000 -0400
5633 @@ -8,6 +8,8 @@
5634 * including this sentence is retained in full.
5635 */
5636
5637 +#include <asm/alternative-asm.h>
5638 +
5639 .extern crypto_ft_tab
5640 .extern crypto_it_tab
5641 .extern crypto_fl_tab
5642 @@ -71,6 +73,8 @@ FUNC: movq r1,r2; \
5643 je B192; \
5644 leaq 32(r9),r9;
5645
5646 +#define ret pax_force_retaddr; ret
5647 +
5648 #define epilogue(r1,r2,r3,r4,r5,r6,r7,r8,r9) \
5649 movq r1,r2; \
5650 movq r3,r4; \
5651 diff -urNp linux-3.0.8/arch/x86/crypto/salsa20-x86_64-asm_64.S linux-3.0.8/arch/x86/crypto/salsa20-x86_64-asm_64.S
5652 --- linux-3.0.8/arch/x86/crypto/salsa20-x86_64-asm_64.S 2011-07-21 22:17:23.000000000 -0400
5653 +++ linux-3.0.8/arch/x86/crypto/salsa20-x86_64-asm_64.S 2011-10-06 04:17:55.000000000 -0400
5654 @@ -1,3 +1,5 @@
5655 +#include <asm/alternative-asm.h>
5656 +
5657 # enter ECRYPT_encrypt_bytes
5658 .text
5659 .p2align 5
5660 @@ -790,6 +792,7 @@ ECRYPT_encrypt_bytes:
5661 add %r11,%rsp
5662 mov %rdi,%rax
5663 mov %rsi,%rdx
5664 + pax_force_retaddr
5665 ret
5666 # bytesatleast65:
5667 ._bytesatleast65:
5668 @@ -891,6 +894,7 @@ ECRYPT_keysetup:
5669 add %r11,%rsp
5670 mov %rdi,%rax
5671 mov %rsi,%rdx
5672 + pax_force_retaddr
5673 ret
5674 # enter ECRYPT_ivsetup
5675 .text
5676 @@ -917,4 +921,5 @@ ECRYPT_ivsetup:
5677 add %r11,%rsp
5678 mov %rdi,%rax
5679 mov %rsi,%rdx
5680 + pax_force_retaddr
5681 ret
5682 diff -urNp linux-3.0.8/arch/x86/crypto/twofish-x86_64-asm_64.S linux-3.0.8/arch/x86/crypto/twofish-x86_64-asm_64.S
5683 --- linux-3.0.8/arch/x86/crypto/twofish-x86_64-asm_64.S 2011-07-21 22:17:23.000000000 -0400
5684 +++ linux-3.0.8/arch/x86/crypto/twofish-x86_64-asm_64.S 2011-10-06 04:17:55.000000000 -0400
5685 @@ -21,6 +21,7 @@
5686 .text
5687
5688 #include <asm/asm-offsets.h>
5689 +#include <asm/alternative-asm.h>
5690
5691 #define a_offset 0
5692 #define b_offset 4
5693 @@ -269,6 +270,7 @@ twofish_enc_blk:
5694
5695 popq R1
5696 movq $1,%rax
5697 + pax_force_retaddr
5698 ret
5699
5700 twofish_dec_blk:
5701 @@ -321,4 +323,5 @@ twofish_dec_blk:
5702
5703 popq R1
5704 movq $1,%rax
5705 + pax_force_retaddr
5706 ret
5707 diff -urNp linux-3.0.8/arch/x86/ia32/ia32_aout.c linux-3.0.8/arch/x86/ia32/ia32_aout.c
5708 --- linux-3.0.8/arch/x86/ia32/ia32_aout.c 2011-07-21 22:17:23.000000000 -0400
5709 +++ linux-3.0.8/arch/x86/ia32/ia32_aout.c 2011-08-23 21:48:14.000000000 -0400
5710 @@ -162,6 +162,8 @@ static int aout_core_dump(long signr, st
5711 unsigned long dump_start, dump_size;
5712 struct user32 dump;
5713
5714 + memset(&dump, 0, sizeof(dump));
5715 +
5716 fs = get_fs();
5717 set_fs(KERNEL_DS);
5718 has_dumped = 1;
5719 diff -urNp linux-3.0.8/arch/x86/ia32/ia32entry.S linux-3.0.8/arch/x86/ia32/ia32entry.S
5720 --- linux-3.0.8/arch/x86/ia32/ia32entry.S 2011-07-21 22:17:23.000000000 -0400
5721 +++ linux-3.0.8/arch/x86/ia32/ia32entry.S 2011-10-11 10:44:33.000000000 -0400
5722 @@ -13,7 +13,9 @@
5723 #include <asm/thread_info.h>
5724 #include <asm/segment.h>
5725 #include <asm/irqflags.h>
5726 +#include <asm/pgtable.h>
5727 #include <linux/linkage.h>
5728 +#include <asm/alternative-asm.h>
5729
5730 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
5731 #include <linux/elf-em.h>
5732 @@ -95,6 +97,29 @@ ENTRY(native_irq_enable_sysexit)
5733 ENDPROC(native_irq_enable_sysexit)
5734 #endif
5735
5736 + .macro pax_enter_kernel_user
5737 +#ifdef CONFIG_PAX_MEMORY_UDEREF
5738 + call pax_enter_kernel_user
5739 +#endif
5740 + .endm
5741 +
5742 + .macro pax_exit_kernel_user
5743 +#ifdef CONFIG_PAX_MEMORY_UDEREF
5744 + call pax_exit_kernel_user
5745 +#endif
5746 +#ifdef CONFIG_PAX_RANDKSTACK
5747 + pushq %rax
5748 + call pax_randomize_kstack
5749 + popq %rax
5750 +#endif
5751 + .endm
5752 +
5753 + .macro pax_erase_kstack
5754 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
5755 + call pax_erase_kstack
5756 +#endif
5757 + .endm
5758 +
5759 /*
5760 * 32bit SYSENTER instruction entry.
5761 *
5762 @@ -121,7 +146,7 @@ ENTRY(ia32_sysenter_target)
5763 CFI_REGISTER rsp,rbp
5764 SWAPGS_UNSAFE_STACK
5765 movq PER_CPU_VAR(kernel_stack), %rsp
5766 - addq $(KERNEL_STACK_OFFSET),%rsp
5767 + pax_enter_kernel_user
5768 /*
5769 * No need to follow this irqs on/off section: the syscall
5770 * disabled irqs, here we enable it straight after entry:
5771 @@ -134,7 +159,8 @@ ENTRY(ia32_sysenter_target)
5772 CFI_REL_OFFSET rsp,0
5773 pushfq_cfi
5774 /*CFI_REL_OFFSET rflags,0*/
5775 - movl 8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
5776 + GET_THREAD_INFO(%r10)
5777 + movl TI_sysenter_return(%r10), %r10d
5778 CFI_REGISTER rip,r10
5779 pushq_cfi $__USER32_CS
5780 /*CFI_REL_OFFSET cs,0*/
5781 @@ -146,6 +172,12 @@ ENTRY(ia32_sysenter_target)
5782 SAVE_ARGS 0,0,1
5783 /* no need to do an access_ok check here because rbp has been
5784 32bit zero extended */
5785 +
5786 +#ifdef CONFIG_PAX_MEMORY_UDEREF
5787 + mov $PAX_USER_SHADOW_BASE,%r10
5788 + add %r10,%rbp
5789 +#endif
5790 +
5791 1: movl (%rbp),%ebp
5792 .section __ex_table,"a"
5793 .quad 1b,ia32_badarg
5794 @@ -168,6 +200,8 @@ sysenter_dispatch:
5795 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
5796 jnz sysexit_audit
5797 sysexit_from_sys_call:
5798 + pax_exit_kernel_user
5799 + pax_erase_kstack
5800 andl $~TS_COMPAT,TI_status(%r10)
5801 /* clear IF, that popfq doesn't enable interrupts early */
5802 andl $~0x200,EFLAGS-R11(%rsp)
5803 @@ -194,6 +228,9 @@ sysexit_from_sys_call:
5804 movl %eax,%esi /* 2nd arg: syscall number */
5805 movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
5806 call audit_syscall_entry
5807 +
5808 + pax_erase_kstack
5809 +
5810 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
5811 cmpq $(IA32_NR_syscalls-1),%rax
5812 ja ia32_badsys
5813 @@ -246,6 +283,9 @@ sysenter_tracesys:
5814 movq $-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */
5815 movq %rsp,%rdi /* &pt_regs -> arg1 */
5816 call syscall_trace_enter
5817 +
5818 + pax_erase_kstack
5819 +
5820 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
5821 RESTORE_REST
5822 cmpq $(IA32_NR_syscalls-1),%rax
5823 @@ -277,19 +317,24 @@ ENDPROC(ia32_sysenter_target)
5824 ENTRY(ia32_cstar_target)
5825 CFI_STARTPROC32 simple
5826 CFI_SIGNAL_FRAME
5827 - CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
5828 + CFI_DEF_CFA rsp,0
5829 CFI_REGISTER rip,rcx
5830 /*CFI_REGISTER rflags,r11*/
5831 SWAPGS_UNSAFE_STACK
5832 movl %esp,%r8d
5833 CFI_REGISTER rsp,r8
5834 movq PER_CPU_VAR(kernel_stack),%rsp
5835 +
5836 +#ifdef CONFIG_PAX_MEMORY_UDEREF
5837 + pax_enter_kernel_user
5838 +#endif
5839 +
5840 /*
5841 * No need to follow this irqs on/off section: the syscall
5842 * disabled irqs and here we enable it straight after entry:
5843 */
5844 ENABLE_INTERRUPTS(CLBR_NONE)
5845 - SAVE_ARGS 8,1,1
5846 + SAVE_ARGS 8*6,1,1
5847 movl %eax,%eax /* zero extension */
5848 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
5849 movq %rcx,RIP-ARGOFFSET(%rsp)
5850 @@ -305,6 +350,12 @@ ENTRY(ia32_cstar_target)
5851 /* no need to do an access_ok check here because r8 has been
5852 32bit zero extended */
5853 /* hardware stack frame is complete now */
5854 +
5855 +#ifdef CONFIG_PAX_MEMORY_UDEREF
5856 + mov $PAX_USER_SHADOW_BASE,%r10
5857 + add %r10,%r8
5858 +#endif
5859 +
5860 1: movl (%r8),%r9d
5861 .section __ex_table,"a"
5862 .quad 1b,ia32_badarg
5863 @@ -327,6 +378,8 @@ cstar_dispatch:
5864 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
5865 jnz sysretl_audit
5866 sysretl_from_sys_call:
5867 + pax_exit_kernel_user
5868 + pax_erase_kstack
5869 andl $~TS_COMPAT,TI_status(%r10)
5870 RESTORE_ARGS 1,-ARG_SKIP,1,1,1
5871 movl RIP-ARGOFFSET(%rsp),%ecx
5872 @@ -364,6 +417,9 @@ cstar_tracesys:
5873 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
5874 movq %rsp,%rdi /* &pt_regs -> arg1 */
5875 call syscall_trace_enter
5876 +
5877 + pax_erase_kstack
5878 +
5879 LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */
5880 RESTORE_REST
5881 xchgl %ebp,%r9d
5882 @@ -409,6 +465,7 @@ ENTRY(ia32_syscall)
5883 CFI_REL_OFFSET rip,RIP-RIP
5884 PARAVIRT_ADJUST_EXCEPTION_FRAME
5885 SWAPGS
5886 + pax_enter_kernel_user
5887 /*
5888 * No need to follow this irqs on/off section: the syscall
5889 * disabled irqs and here we enable it straight after entry:
5890 @@ -441,6 +498,9 @@ ia32_tracesys:
5891 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
5892 movq %rsp,%rdi /* &pt_regs -> arg1 */
5893 call syscall_trace_enter
5894 +
5895 + pax_erase_kstack
5896 +
5897 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
5898 RESTORE_REST
5899 cmpq $(IA32_NR_syscalls-1),%rax
5900 @@ -455,6 +515,7 @@ ia32_badsys:
5901
5902 quiet_ni_syscall:
5903 movq $-ENOSYS,%rax
5904 + pax_force_retaddr
5905 ret
5906 CFI_ENDPROC
5907
5908 diff -urNp linux-3.0.8/arch/x86/ia32/ia32_signal.c linux-3.0.8/arch/x86/ia32/ia32_signal.c
5909 --- linux-3.0.8/arch/x86/ia32/ia32_signal.c 2011-07-21 22:17:23.000000000 -0400
5910 +++ linux-3.0.8/arch/x86/ia32/ia32_signal.c 2011-10-06 04:17:55.000000000 -0400
5911 @@ -167,7 +167,7 @@ asmlinkage long sys32_sigaltstack(const
5912 }
5913 seg = get_fs();
5914 set_fs(KERNEL_DS);
5915 - ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss, regs->sp);
5916 + ret = do_sigaltstack(uss_ptr ? (const stack_t __force_user *)&uss : NULL, (stack_t __force_user *)&uoss, regs->sp);
5917 set_fs(seg);
5918 if (ret >= 0 && uoss_ptr) {
5919 if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t)))
5920 @@ -374,7 +374,7 @@ static int ia32_setup_sigcontext(struct
5921 */
5922 static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
5923 size_t frame_size,
5924 - void **fpstate)
5925 + void __user **fpstate)
5926 {
5927 unsigned long sp;
5928
5929 @@ -395,7 +395,7 @@ static void __user *get_sigframe(struct
5930
5931 if (used_math()) {
5932 sp = sp - sig_xstate_ia32_size;
5933 - *fpstate = (struct _fpstate_ia32 *) sp;
5934 + *fpstate = (struct _fpstate_ia32 __user *) sp;
5935 if (save_i387_xstate_ia32(*fpstate) < 0)
5936 return (void __user *) -1L;
5937 }
5938 @@ -403,7 +403,7 @@ static void __user *get_sigframe(struct
5939 sp -= frame_size;
5940 /* Align the stack pointer according to the i386 ABI,
5941 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
5942 - sp = ((sp + 4) & -16ul) - 4;
5943 + sp = ((sp - 12) & -16ul) - 4;
5944 return (void __user *) sp;
5945 }
5946
5947 @@ -461,7 +461,7 @@ int ia32_setup_frame(int sig, struct k_s
5948 * These are actually not used anymore, but left because some
5949 * gdb versions depend on them as a marker.
5950 */
5951 - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
5952 + put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
5953 } put_user_catch(err);
5954
5955 if (err)
5956 @@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct
5957 0xb8,
5958 __NR_ia32_rt_sigreturn,
5959 0x80cd,
5960 - 0,
5961 + 0
5962 };
5963
5964 frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
5965 @@ -533,16 +533,18 @@ int ia32_setup_rt_frame(int sig, struct
5966
5967 if (ka->sa.sa_flags & SA_RESTORER)
5968 restorer = ka->sa.sa_restorer;
5969 + else if (current->mm->context.vdso)
5970 + /* Return stub is in 32bit vsyscall page */
5971 + restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
5972 else
5973 - restorer = VDSO32_SYMBOL(current->mm->context.vdso,
5974 - rt_sigreturn);
5975 + restorer = &frame->retcode;
5976 put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
5977
5978 /*
5979 * Not actually used anymore, but left because some gdb
5980 * versions need it.
5981 */
5982 - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
5983 + put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
5984 } put_user_catch(err);
5985
5986 if (err)
5987 diff -urNp linux-3.0.8/arch/x86/ia32/sys_ia32.c linux-3.0.8/arch/x86/ia32/sys_ia32.c
5988 --- linux-3.0.8/arch/x86/ia32/sys_ia32.c 2011-07-21 22:17:23.000000000 -0400
5989 +++ linux-3.0.8/arch/x86/ia32/sys_ia32.c 2011-10-06 04:17:55.000000000 -0400
5990 @@ -69,8 +69,8 @@ asmlinkage long sys32_ftruncate64(unsign
5991 */
5992 static int cp_stat64(struct stat64 __user *ubuf, struct kstat *stat)
5993 {
5994 - typeof(ubuf->st_uid) uid = 0;
5995 - typeof(ubuf->st_gid) gid = 0;
5996 + typeof(((struct stat64 *)0)->st_uid) uid = 0;
5997 + typeof(((struct stat64 *)0)->st_gid) gid = 0;
5998 SET_UID(uid, stat->uid);
5999 SET_GID(gid, stat->gid);
6000 if (!access_ok(VERIFY_WRITE, ubuf, sizeof(struct stat64)) ||
6001 @@ -308,8 +308,8 @@ asmlinkage long sys32_rt_sigprocmask(int
6002 }
6003 set_fs(KERNEL_DS);
6004 ret = sys_rt_sigprocmask(how,
6005 - set ? (sigset_t __user *)&s : NULL,
6006 - oset ? (sigset_t __user *)&s : NULL,
6007 + set ? (sigset_t __force_user *)&s : NULL,
6008 + oset ? (sigset_t __force_user *)&s : NULL,
6009 sigsetsize);
6010 set_fs(old_fs);
6011 if (ret)
6012 @@ -332,7 +332,7 @@ asmlinkage long sys32_alarm(unsigned int
6013 return alarm_setitimer(seconds);
6014 }
6015
6016 -asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int *stat_addr,
6017 +asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int __user *stat_addr,
6018 int options)
6019 {
6020 return compat_sys_wait4(pid, stat_addr, options, NULL);
6021 @@ -353,7 +353,7 @@ asmlinkage long sys32_sched_rr_get_inter
6022 mm_segment_t old_fs = get_fs();
6023
6024 set_fs(KERNEL_DS);
6025 - ret = sys_sched_rr_get_interval(pid, (struct timespec __user *)&t);
6026 + ret = sys_sched_rr_get_interval(pid, (struct timespec __force_user *)&t);
6027 set_fs(old_fs);
6028 if (put_compat_timespec(&t, interval))
6029 return -EFAULT;
6030 @@ -369,7 +369,7 @@ asmlinkage long sys32_rt_sigpending(comp
6031 mm_segment_t old_fs = get_fs();
6032
6033 set_fs(KERNEL_DS);
6034 - ret = sys_rt_sigpending((sigset_t __user *)&s, sigsetsize);
6035 + ret = sys_rt_sigpending((sigset_t __force_user *)&s, sigsetsize);
6036 set_fs(old_fs);
6037 if (!ret) {
6038 switch (_NSIG_WORDS) {
6039 @@ -394,7 +394,7 @@ asmlinkage long sys32_rt_sigqueueinfo(in
6040 if (copy_siginfo_from_user32(&info, uinfo))
6041 return -EFAULT;
6042 set_fs(KERNEL_DS);
6043 - ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __user *)&info);
6044 + ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __force_user *)&info);
6045 set_fs(old_fs);
6046 return ret;
6047 }
6048 @@ -439,7 +439,7 @@ asmlinkage long sys32_sendfile(int out_f
6049 return -EFAULT;
6050
6051 set_fs(KERNEL_DS);
6052 - ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __user *)&of : NULL,
6053 + ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __force_user *)&of : NULL,
6054 count);
6055 set_fs(old_fs);
6056
6057 diff -urNp linux-3.0.8/arch/x86/include/asm/alternative-asm.h linux-3.0.8/arch/x86/include/asm/alternative-asm.h
6058 --- linux-3.0.8/arch/x86/include/asm/alternative-asm.h 2011-07-21 22:17:23.000000000 -0400
6059 +++ linux-3.0.8/arch/x86/include/asm/alternative-asm.h 2011-10-07 19:07:23.000000000 -0400
6060 @@ -15,6 +15,20 @@
6061 .endm
6062 #endif
6063
6064 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN
6065 + .macro pax_force_retaddr rip=0
6066 + btsq $63,\rip(%rsp)
6067 + .endm
6068 + .macro pax_force_fptr ptr
6069 + btsq $63,\ptr
6070 + .endm
6071 +#else
6072 + .macro pax_force_retaddr rip=0
6073 + .endm
6074 + .macro pax_force_fptr ptr
6075 + .endm
6076 +#endif
6077 +
6078 .macro altinstruction_entry orig alt feature orig_len alt_len
6079 .align 8
6080 .quad \orig
6081 diff -urNp linux-3.0.8/arch/x86/include/asm/alternative.h linux-3.0.8/arch/x86/include/asm/alternative.h
6082 --- linux-3.0.8/arch/x86/include/asm/alternative.h 2011-07-21 22:17:23.000000000 -0400
6083 +++ linux-3.0.8/arch/x86/include/asm/alternative.h 2011-08-23 21:47:55.000000000 -0400
6084 @@ -93,7 +93,7 @@ static inline int alternatives_text_rese
6085 ".section .discard,\"aw\",@progbits\n" \
6086 " .byte 0xff + (664f-663f) - (662b-661b)\n" /* rlen <= slen */ \
6087 ".previous\n" \
6088 - ".section .altinstr_replacement, \"ax\"\n" \
6089 + ".section .altinstr_replacement, \"a\"\n" \
6090 "663:\n\t" newinstr "\n664:\n" /* replacement */ \
6091 ".previous"
6092
6093 diff -urNp linux-3.0.8/arch/x86/include/asm/apic.h linux-3.0.8/arch/x86/include/asm/apic.h
6094 --- linux-3.0.8/arch/x86/include/asm/apic.h 2011-07-21 22:17:23.000000000 -0400
6095 +++ linux-3.0.8/arch/x86/include/asm/apic.h 2011-08-23 21:48:14.000000000 -0400
6096 @@ -45,7 +45,7 @@ static inline void generic_apic_probe(vo
6097
6098 #ifdef CONFIG_X86_LOCAL_APIC
6099
6100 -extern unsigned int apic_verbosity;
6101 +extern int apic_verbosity;
6102 extern int local_apic_timer_c2_ok;
6103
6104 extern int disable_apic;
6105 diff -urNp linux-3.0.8/arch/x86/include/asm/apm.h linux-3.0.8/arch/x86/include/asm/apm.h
6106 --- linux-3.0.8/arch/x86/include/asm/apm.h 2011-07-21 22:17:23.000000000 -0400
6107 +++ linux-3.0.8/arch/x86/include/asm/apm.h 2011-08-23 21:47:55.000000000 -0400
6108 @@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
6109 __asm__ __volatile__(APM_DO_ZERO_SEGS
6110 "pushl %%edi\n\t"
6111 "pushl %%ebp\n\t"
6112 - "lcall *%%cs:apm_bios_entry\n\t"
6113 + "lcall *%%ss:apm_bios_entry\n\t"
6114 "setc %%al\n\t"
6115 "popl %%ebp\n\t"
6116 "popl %%edi\n\t"
6117 @@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as
6118 __asm__ __volatile__(APM_DO_ZERO_SEGS
6119 "pushl %%edi\n\t"
6120 "pushl %%ebp\n\t"
6121 - "lcall *%%cs:apm_bios_entry\n\t"
6122 + "lcall *%%ss:apm_bios_entry\n\t"
6123 "setc %%bl\n\t"
6124 "popl %%ebp\n\t"
6125 "popl %%edi\n\t"
6126 diff -urNp linux-3.0.8/arch/x86/include/asm/atomic64_32.h linux-3.0.8/arch/x86/include/asm/atomic64_32.h
6127 --- linux-3.0.8/arch/x86/include/asm/atomic64_32.h 2011-07-21 22:17:23.000000000 -0400
6128 +++ linux-3.0.8/arch/x86/include/asm/atomic64_32.h 2011-08-23 21:47:55.000000000 -0400
6129 @@ -12,6 +12,14 @@ typedef struct {
6130 u64 __aligned(8) counter;
6131 } atomic64_t;
6132
6133 +#ifdef CONFIG_PAX_REFCOUNT
6134 +typedef struct {
6135 + u64 __aligned(8) counter;
6136 +} atomic64_unchecked_t;
6137 +#else
6138 +typedef atomic64_t atomic64_unchecked_t;
6139 +#endif
6140 +
6141 #define ATOMIC64_INIT(val) { (val) }
6142
6143 #ifdef CONFIG_X86_CMPXCHG64
6144 @@ -38,6 +46,21 @@ static inline long long atomic64_cmpxchg
6145 }
6146
6147 /**
6148 + * atomic64_cmpxchg_unchecked - cmpxchg atomic64 variable
6149 + * @p: pointer to type atomic64_unchecked_t
6150 + * @o: expected value
6151 + * @n: new value
6152 + *
6153 + * Atomically sets @v to @n if it was equal to @o and returns
6154 + * the old value.
6155 + */
6156 +
6157 +static inline long long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long long o, long long n)
6158 +{
6159 + return cmpxchg64(&v->counter, o, n);
6160 +}
6161 +
6162 +/**
6163 * atomic64_xchg - xchg atomic64 variable
6164 * @v: pointer to type atomic64_t
6165 * @n: value to assign
6166 @@ -77,6 +100,24 @@ static inline void atomic64_set(atomic64
6167 }
6168
6169 /**
6170 + * atomic64_set_unchecked - set atomic64 variable
6171 + * @v: pointer to type atomic64_unchecked_t
6172 + * @n: value to assign
6173 + *
6174 + * Atomically sets the value of @v to @n.
6175 + */
6176 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
6177 +{
6178 + unsigned high = (unsigned)(i >> 32);
6179 + unsigned low = (unsigned)i;
6180 + asm volatile(ATOMIC64_ALTERNATIVE(set)
6181 + : "+b" (low), "+c" (high)
6182 + : "S" (v)
6183 + : "eax", "edx", "memory"
6184 + );
6185 +}
6186 +
6187 +/**
6188 * atomic64_read - read atomic64 variable
6189 * @v: pointer to type atomic64_t
6190 *
6191 @@ -93,6 +134,22 @@ static inline long long atomic64_read(at
6192 }
6193
6194 /**
6195 + * atomic64_read_unchecked - read atomic64 variable
6196 + * @v: pointer to type atomic64_unchecked_t
6197 + *
6198 + * Atomically reads the value of @v and returns it.
6199 + */
6200 +static inline long long atomic64_read_unchecked(atomic64_unchecked_t *v)
6201 +{
6202 + long long r;
6203 + asm volatile(ATOMIC64_ALTERNATIVE(read_unchecked)
6204 + : "=A" (r), "+c" (v)
6205 + : : "memory"
6206 + );
6207 + return r;
6208 + }
6209 +
6210 +/**
6211 * atomic64_add_return - add and return
6212 * @i: integer value to add
6213 * @v: pointer to type atomic64_t
6214 @@ -108,6 +165,22 @@ static inline long long atomic64_add_ret
6215 return i;
6216 }
6217
6218 +/**
6219 + * atomic64_add_return_unchecked - add and return
6220 + * @i: integer value to add
6221 + * @v: pointer to type atomic64_unchecked_t
6222 + *
6223 + * Atomically adds @i to @v and returns @i + *@v
6224 + */
6225 +static inline long long atomic64_add_return_unchecked(long long i, atomic64_unchecked_t *v)
6226 +{
6227 + asm volatile(ATOMIC64_ALTERNATIVE(add_return_unchecked)
6228 + : "+A" (i), "+c" (v)
6229 + : : "memory"
6230 + );
6231 + return i;
6232 +}
6233 +
6234 /*
6235 * Other variants with different arithmetic operators:
6236 */
6237 @@ -131,6 +204,17 @@ static inline long long atomic64_inc_ret
6238 return a;
6239 }
6240
6241 +static inline long long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
6242 +{
6243 + long long a;
6244 + asm volatile(ATOMIC64_ALTERNATIVE(inc_return_unchecked)
6245 + : "=A" (a)
6246 + : "S" (v)
6247 + : "memory", "ecx"
6248 + );
6249 + return a;
6250 +}
6251 +
6252 static inline long long atomic64_dec_return(atomic64_t *v)
6253 {
6254 long long a;
6255 @@ -159,6 +243,22 @@ static inline long long atomic64_add(lon
6256 }
6257
6258 /**
6259 + * atomic64_add_unchecked - add integer to atomic64 variable
6260 + * @i: integer value to add
6261 + * @v: pointer to type atomic64_unchecked_t
6262 + *
6263 + * Atomically adds @i to @v.
6264 + */
6265 +static inline long long atomic64_add_unchecked(long long i, atomic64_unchecked_t *v)
6266 +{
6267 + asm volatile(ATOMIC64_ALTERNATIVE_(add_unchecked, add_return_unchecked)
6268 + : "+A" (i), "+c" (v)
6269 + : : "memory"
6270 + );
6271 + return i;
6272 +}
6273 +
6274 +/**
6275 * atomic64_sub - subtract the atomic64 variable
6276 * @i: integer value to subtract
6277 * @v: pointer to type atomic64_t
6278 diff -urNp linux-3.0.8/arch/x86/include/asm/atomic64_64.h linux-3.0.8/arch/x86/include/asm/atomic64_64.h
6279 --- linux-3.0.8/arch/x86/include/asm/atomic64_64.h 2011-07-21 22:17:23.000000000 -0400
6280 +++ linux-3.0.8/arch/x86/include/asm/atomic64_64.h 2011-08-23 21:47:55.000000000 -0400
6281 @@ -18,7 +18,19 @@
6282 */
6283 static inline long atomic64_read(const atomic64_t *v)
6284 {
6285 - return (*(volatile long *)&(v)->counter);
6286 + return (*(volatile const long *)&(v)->counter);
6287 +}
6288 +
6289 +/**
6290 + * atomic64_read_unchecked - read atomic64 variable
6291 + * @v: pointer of type atomic64_unchecked_t
6292 + *
6293 + * Atomically reads the value of @v.
6294 + * Doesn't imply a read memory barrier.
6295 + */
6296 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
6297 +{
6298 + return (*(volatile const long *)&(v)->counter);
6299 }
6300
6301 /**
6302 @@ -34,6 +46,18 @@ static inline void atomic64_set(atomic64
6303 }
6304
6305 /**
6306 + * atomic64_set_unchecked - set atomic64 variable
6307 + * @v: pointer to type atomic64_unchecked_t
6308 + * @i: required value
6309 + *
6310 + * Atomically sets the value of @v to @i.
6311 + */
6312 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
6313 +{
6314 + v->counter = i;
6315 +}
6316 +
6317 +/**
6318 * atomic64_add - add integer to atomic64 variable
6319 * @i: integer value to add
6320 * @v: pointer to type atomic64_t
6321 @@ -42,6 +66,28 @@ static inline void atomic64_set(atomic64
6322 */
6323 static inline void atomic64_add(long i, atomic64_t *v)
6324 {
6325 + asm volatile(LOCK_PREFIX "addq %1,%0\n"
6326 +
6327 +#ifdef CONFIG_PAX_REFCOUNT
6328 + "jno 0f\n"
6329 + LOCK_PREFIX "subq %1,%0\n"
6330 + "int $4\n0:\n"
6331 + _ASM_EXTABLE(0b, 0b)
6332 +#endif
6333 +
6334 + : "=m" (v->counter)
6335 + : "er" (i), "m" (v->counter));
6336 +}
6337 +
6338 +/**
6339 + * atomic64_add_unchecked - add integer to atomic64 variable
6340 + * @i: integer value to add
6341 + * @v: pointer to type atomic64_unchecked_t
6342 + *
6343 + * Atomically adds @i to @v.
6344 + */
6345 +static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
6346 +{
6347 asm volatile(LOCK_PREFIX "addq %1,%0"
6348 : "=m" (v->counter)
6349 : "er" (i), "m" (v->counter));
6350 @@ -56,7 +102,29 @@ static inline void atomic64_add(long i,
6351 */
6352 static inline void atomic64_sub(long i, atomic64_t *v)
6353 {
6354 - asm volatile(LOCK_PREFIX "subq %1,%0"
6355 + asm volatile(LOCK_PREFIX "subq %1,%0\n"
6356 +
6357 +#ifdef CONFIG_PAX_REFCOUNT
6358 + "jno 0f\n"
6359 + LOCK_PREFIX "addq %1,%0\n"
6360 + "int $4\n0:\n"
6361 + _ASM_EXTABLE(0b, 0b)
6362 +#endif
6363 +
6364 + : "=m" (v->counter)
6365 + : "er" (i), "m" (v->counter));
6366 +}
6367 +
6368 +/**
6369 + * atomic64_sub_unchecked - subtract the atomic64 variable
6370 + * @i: integer value to subtract
6371 + * @v: pointer to type atomic64_unchecked_t
6372 + *
6373 + * Atomically subtracts @i from @v.
6374 + */
6375 +static inline void atomic64_sub_unchecked(long i, atomic64_unchecked_t *v)
6376 +{
6377 + asm volatile(LOCK_PREFIX "subq %1,%0\n"
6378 : "=m" (v->counter)
6379 : "er" (i), "m" (v->counter));
6380 }
6381 @@ -74,7 +142,16 @@ static inline int atomic64_sub_and_test(
6382 {
6383 unsigned char c;
6384
6385 - asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
6386 + asm volatile(LOCK_PREFIX "subq %2,%0\n"
6387 +
6388 +#ifdef CONFIG_PAX_REFCOUNT
6389 + "jno 0f\n"
6390 + LOCK_PREFIX "addq %2,%0\n"
6391 + "int $4\n0:\n"
6392 + _ASM_EXTABLE(0b, 0b)
6393 +#endif
6394 +
6395 + "sete %1\n"
6396 : "=m" (v->counter), "=qm" (c)
6397 : "er" (i), "m" (v->counter) : "memory");
6398 return c;
6399 @@ -88,6 +165,27 @@ static inline int atomic64_sub_and_test(
6400 */
6401 static inline void atomic64_inc(atomic64_t *v)
6402 {
6403 + asm volatile(LOCK_PREFIX "incq %0\n"
6404 +
6405 +#ifdef CONFIG_PAX_REFCOUNT
6406 + "jno 0f\n"
6407 + LOCK_PREFIX "decq %0\n"
6408 + "int $4\n0:\n"
6409 + _ASM_EXTABLE(0b, 0b)
6410 +#endif
6411 +
6412 + : "=m" (v->counter)
6413 + : "m" (v->counter));
6414 +}
6415 +
6416 +/**
6417 + * atomic64_inc_unchecked - increment atomic64 variable
6418 + * @v: pointer to type atomic64_unchecked_t
6419 + *
6420 + * Atomically increments @v by 1.
6421 + */
6422 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
6423 +{
6424 asm volatile(LOCK_PREFIX "incq %0"
6425 : "=m" (v->counter)
6426 : "m" (v->counter));
6427 @@ -101,7 +199,28 @@ static inline void atomic64_inc(atomic64
6428 */
6429 static inline void atomic64_dec(atomic64_t *v)
6430 {
6431 - asm volatile(LOCK_PREFIX "decq %0"
6432 + asm volatile(LOCK_PREFIX "decq %0\n"
6433 +
6434 +#ifdef CONFIG_PAX_REFCOUNT
6435 + "jno 0f\n"
6436 + LOCK_PREFIX "incq %0\n"
6437 + "int $4\n0:\n"
6438 + _ASM_EXTABLE(0b, 0b)
6439 +#endif
6440 +
6441 + : "=m" (v->counter)
6442 + : "m" (v->counter));
6443 +}
6444 +
6445 +/**
6446 + * atomic64_dec_unchecked - decrement atomic64 variable
6447 + * @v: pointer to type atomic64_t
6448 + *
6449 + * Atomically decrements @v by 1.
6450 + */
6451 +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
6452 +{
6453 + asm volatile(LOCK_PREFIX "decq %0\n"
6454 : "=m" (v->counter)
6455 : "m" (v->counter));
6456 }
6457 @@ -118,7 +237,16 @@ static inline int atomic64_dec_and_test(
6458 {
6459 unsigned char c;
6460
6461 - asm volatile(LOCK_PREFIX "decq %0; sete %1"
6462 + asm volatile(LOCK_PREFIX "decq %0\n"
6463 +
6464 +#ifdef CONFIG_PAX_REFCOUNT
6465 + "jno 0f\n"
6466 + LOCK_PREFIX "incq %0\n"
6467 + "int $4\n0:\n"
6468 + _ASM_EXTABLE(0b, 0b)
6469 +#endif
6470 +
6471 + "sete %1\n"
6472 : "=m" (v->counter), "=qm" (c)
6473 : "m" (v->counter) : "memory");
6474 return c != 0;
6475 @@ -136,7 +264,16 @@ static inline int atomic64_inc_and_test(
6476 {
6477 unsigned char c;
6478
6479 - asm volatile(LOCK_PREFIX "incq %0; sete %1"
6480 + asm volatile(LOCK_PREFIX "incq %0\n"
6481 +
6482 +#ifdef CONFIG_PAX_REFCOUNT
6483 + "jno 0f\n"
6484 + LOCK_PREFIX "decq %0\n"
6485 + "int $4\n0:\n"
6486 + _ASM_EXTABLE(0b, 0b)
6487 +#endif
6488 +
6489 + "sete %1\n"
6490 : "=m" (v->counter), "=qm" (c)
6491 : "m" (v->counter) : "memory");
6492 return c != 0;
6493 @@ -155,7 +292,16 @@ static inline int atomic64_add_negative(
6494 {
6495 unsigned char c;
6496
6497 - asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
6498 + asm volatile(LOCK_PREFIX "addq %2,%0\n"
6499 +
6500 +#ifdef CONFIG_PAX_REFCOUNT
6501 + "jno 0f\n"
6502 + LOCK_PREFIX "subq %2,%0\n"
6503 + "int $4\n0:\n"
6504 + _ASM_EXTABLE(0b, 0b)
6505 +#endif
6506 +
6507 + "sets %1\n"
6508 : "=m" (v->counter), "=qm" (c)
6509 : "er" (i), "m" (v->counter) : "memory");
6510 return c;
6511 @@ -171,7 +317,31 @@ static inline int atomic64_add_negative(
6512 static inline long atomic64_add_return(long i, atomic64_t *v)
6513 {
6514 long __i = i;
6515 - asm volatile(LOCK_PREFIX "xaddq %0, %1;"
6516 + asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
6517 +
6518 +#ifdef CONFIG_PAX_REFCOUNT
6519 + "jno 0f\n"
6520 + "movq %0, %1\n"
6521 + "int $4\n0:\n"
6522 + _ASM_EXTABLE(0b, 0b)
6523 +#endif
6524 +
6525 + : "+r" (i), "+m" (v->counter)
6526 + : : "memory");
6527 + return i + __i;
6528 +}
6529 +
6530 +/**
6531 + * atomic64_add_return_unchecked - add and return
6532 + * @i: integer value to add
6533 + * @v: pointer to type atomic64_unchecked_t
6534 + *
6535 + * Atomically adds @i to @v and returns @i + @v
6536 + */
6537 +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
6538 +{
6539 + long __i = i;
6540 + asm volatile(LOCK_PREFIX "xaddq %0, %1"
6541 : "+r" (i), "+m" (v->counter)
6542 : : "memory");
6543 return i + __i;
6544 @@ -183,6 +353,10 @@ static inline long atomic64_sub_return(l
6545 }
6546
6547 #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
6548 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
6549 +{
6550 + return atomic64_add_return_unchecked(1, v);
6551 +}
6552 #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
6553
6554 static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
6555 @@ -190,6 +364,11 @@ static inline long atomic64_cmpxchg(atom
6556 return cmpxchg(&v->counter, old, new);
6557 }
6558
6559 +static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
6560 +{
6561 + return cmpxchg(&v->counter, old, new);
6562 +}
6563 +
6564 static inline long atomic64_xchg(atomic64_t *v, long new)
6565 {
6566 return xchg(&v->counter, new);
6567 @@ -206,17 +385,30 @@ static inline long atomic64_xchg(atomic6
6568 */
6569 static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
6570 {
6571 - long c, old;
6572 + long c, old, new;
6573 c = atomic64_read(v);
6574 for (;;) {
6575 - if (unlikely(c == (u)))
6576 + if (unlikely(c == u))
6577 break;
6578 - old = atomic64_cmpxchg((v), c, c + (a));
6579 +
6580 + asm volatile("add %2,%0\n"
6581 +
6582 +#ifdef CONFIG_PAX_REFCOUNT
6583 + "jno 0f\n"
6584 + "sub %2,%0\n"
6585 + "int $4\n0:\n"
6586 + _ASM_EXTABLE(0b, 0b)
6587 +#endif
6588 +
6589 + : "=r" (new)
6590 + : "0" (c), "ir" (a));
6591 +
6592 + old = atomic64_cmpxchg(v, c, new);
6593 if (likely(old == c))
6594 break;
6595 c = old;
6596 }
6597 - return c != (u);
6598 + return c != u;
6599 }
6600
6601 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
6602 diff -urNp linux-3.0.8/arch/x86/include/asm/atomic.h linux-3.0.8/arch/x86/include/asm/atomic.h
6603 --- linux-3.0.8/arch/x86/include/asm/atomic.h 2011-07-21 22:17:23.000000000 -0400
6604 +++ linux-3.0.8/arch/x86/include/asm/atomic.h 2011-08-23 21:47:55.000000000 -0400
6605 @@ -22,7 +22,18 @@
6606 */
6607 static inline int atomic_read(const atomic_t *v)
6608 {
6609 - return (*(volatile int *)&(v)->counter);
6610 + return (*(volatile const int *)&(v)->counter);
6611 +}
6612 +
6613 +/**
6614 + * atomic_read_unchecked - read atomic variable
6615 + * @v: pointer of type atomic_unchecked_t
6616 + *
6617 + * Atomically reads the value of @v.
6618 + */
6619 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
6620 +{
6621 + return (*(volatile const int *)&(v)->counter);
6622 }
6623
6624 /**
6625 @@ -38,6 +49,18 @@ static inline void atomic_set(atomic_t *
6626 }
6627
6628 /**
6629 + * atomic_set_unchecked - set atomic variable
6630 + * @v: pointer of type atomic_unchecked_t
6631 + * @i: required value
6632 + *
6633 + * Atomically sets the value of @v to @i.
6634 + */
6635 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
6636 +{
6637 + v->counter = i;
6638 +}
6639 +
6640 +/**
6641 * atomic_add - add integer to atomic variable
6642 * @i: integer value to add
6643 * @v: pointer of type atomic_t
6644 @@ -46,7 +69,29 @@ static inline void atomic_set(atomic_t *
6645 */
6646 static inline void atomic_add(int i, atomic_t *v)
6647 {
6648 - asm volatile(LOCK_PREFIX "addl %1,%0"
6649 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
6650 +
6651 +#ifdef CONFIG_PAX_REFCOUNT
6652 + "jno 0f\n"
6653 + LOCK_PREFIX "subl %1,%0\n"
6654 + "int $4\n0:\n"
6655 + _ASM_EXTABLE(0b, 0b)
6656 +#endif
6657 +
6658 + : "+m" (v->counter)
6659 + : "ir" (i));
6660 +}
6661 +
6662 +/**
6663 + * atomic_add_unchecked - add integer to atomic variable
6664 + * @i: integer value to add
6665 + * @v: pointer of type atomic_unchecked_t
6666 + *
6667 + * Atomically adds @i to @v.
6668 + */
6669 +static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
6670 +{
6671 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
6672 : "+m" (v->counter)
6673 : "ir" (i));
6674 }
6675 @@ -60,7 +105,29 @@ static inline void atomic_add(int i, ato
6676 */
6677 static inline void atomic_sub(int i, atomic_t *v)
6678 {
6679 - asm volatile(LOCK_PREFIX "subl %1,%0"
6680 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
6681 +
6682 +#ifdef CONFIG_PAX_REFCOUNT
6683 + "jno 0f\n"
6684 + LOCK_PREFIX "addl %1,%0\n"
6685 + "int $4\n0:\n"
6686 + _ASM_EXTABLE(0b, 0b)
6687 +#endif
6688 +
6689 + : "+m" (v->counter)
6690 + : "ir" (i));
6691 +}
6692 +
6693 +/**
6694 + * atomic_sub_unchecked - subtract integer from atomic variable
6695 + * @i: integer value to subtract
6696 + * @v: pointer of type atomic_unchecked_t
6697 + *
6698 + * Atomically subtracts @i from @v.
6699 + */
6700 +static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
6701 +{
6702 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
6703 : "+m" (v->counter)
6704 : "ir" (i));
6705 }
6706 @@ -78,7 +145,16 @@ static inline int atomic_sub_and_test(in
6707 {
6708 unsigned char c;
6709
6710 - asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
6711 + asm volatile(LOCK_PREFIX "subl %2,%0\n"
6712 +
6713 +#ifdef CONFIG_PAX_REFCOUNT
6714 + "jno 0f\n"
6715 + LOCK_PREFIX "addl %2,%0\n"
6716 + "int $4\n0:\n"
6717 + _ASM_EXTABLE(0b, 0b)
6718 +#endif
6719 +
6720 + "sete %1\n"
6721 : "+m" (v->counter), "=qm" (c)
6722 : "ir" (i) : "memory");
6723 return c;
6724 @@ -92,7 +168,27 @@ static inline int atomic_sub_and_test(in
6725 */
6726 static inline void atomic_inc(atomic_t *v)
6727 {
6728 - asm volatile(LOCK_PREFIX "incl %0"
6729 + asm volatile(LOCK_PREFIX "incl %0\n"
6730 +
6731 +#ifdef CONFIG_PAX_REFCOUNT
6732 + "jno 0f\n"
6733 + LOCK_PREFIX "decl %0\n"
6734 + "int $4\n0:\n"
6735 + _ASM_EXTABLE(0b, 0b)
6736 +#endif
6737 +
6738 + : "+m" (v->counter));
6739 +}
6740 +
6741 +/**
6742 + * atomic_inc_unchecked - increment atomic variable
6743 + * @v: pointer of type atomic_unchecked_t
6744 + *
6745 + * Atomically increments @v by 1.
6746 + */
6747 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
6748 +{
6749 + asm volatile(LOCK_PREFIX "incl %0\n"
6750 : "+m" (v->counter));
6751 }
6752
6753 @@ -104,7 +200,27 @@ static inline void atomic_inc(atomic_t *
6754 */
6755 static inline void atomic_dec(atomic_t *v)
6756 {
6757 - asm volatile(LOCK_PREFIX "decl %0"
6758 + asm volatile(LOCK_PREFIX "decl %0\n"
6759 +
6760 +#ifdef CONFIG_PAX_REFCOUNT
6761 + "jno 0f\n"
6762 + LOCK_PREFIX "incl %0\n"
6763 + "int $4\n0:\n"
6764 + _ASM_EXTABLE(0b, 0b)
6765 +#endif
6766 +
6767 + : "+m" (v->counter));
6768 +}
6769 +
6770 +/**
6771 + * atomic_dec_unchecked - decrement atomic variable
6772 + * @v: pointer of type atomic_unchecked_t
6773 + *
6774 + * Atomically decrements @v by 1.
6775 + */
6776 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
6777 +{
6778 + asm volatile(LOCK_PREFIX "decl %0\n"
6779 : "+m" (v->counter));
6780 }
6781
6782 @@ -120,7 +236,16 @@ static inline int atomic_dec_and_test(at
6783 {
6784 unsigned char c;
6785
6786 - asm volatile(LOCK_PREFIX "decl %0; sete %1"
6787 + asm volatile(LOCK_PREFIX "decl %0\n"
6788 +
6789 +#ifdef CONFIG_PAX_REFCOUNT
6790 + "jno 0f\n"
6791 + LOCK_PREFIX "incl %0\n"
6792 + "int $4\n0:\n"
6793 + _ASM_EXTABLE(0b, 0b)
6794 +#endif
6795 +
6796 + "sete %1\n"
6797 : "+m" (v->counter), "=qm" (c)
6798 : : "memory");
6799 return c != 0;
6800 @@ -138,7 +263,35 @@ static inline int atomic_inc_and_test(at
6801 {
6802 unsigned char c;
6803
6804 - asm volatile(LOCK_PREFIX "incl %0; sete %1"
6805 + asm volatile(LOCK_PREFIX "incl %0\n"
6806 +
6807 +#ifdef CONFIG_PAX_REFCOUNT
6808 + "jno 0f\n"
6809 + LOCK_PREFIX "decl %0\n"
6810 + "int $4\n0:\n"
6811 + _ASM_EXTABLE(0b, 0b)
6812 +#endif
6813 +
6814 + "sete %1\n"
6815 + : "+m" (v->counter), "=qm" (c)
6816 + : : "memory");
6817 + return c != 0;
6818 +}
6819 +
6820 +/**
6821 + * atomic_inc_and_test_unchecked - increment and test
6822 + * @v: pointer of type atomic_unchecked_t
6823 + *
6824 + * Atomically increments @v by 1
6825 + * and returns true if the result is zero, or false for all
6826 + * other cases.
6827 + */
6828 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
6829 +{
6830 + unsigned char c;
6831 +
6832 + asm volatile(LOCK_PREFIX "incl %0\n"
6833 + "sete %1\n"
6834 : "+m" (v->counter), "=qm" (c)
6835 : : "memory");
6836 return c != 0;
6837 @@ -157,7 +310,16 @@ static inline int atomic_add_negative(in
6838 {
6839 unsigned char c;
6840
6841 - asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
6842 + asm volatile(LOCK_PREFIX "addl %2,%0\n"
6843 +
6844 +#ifdef CONFIG_PAX_REFCOUNT
6845 + "jno 0f\n"
6846 + LOCK_PREFIX "subl %2,%0\n"
6847 + "int $4\n0:\n"
6848 + _ASM_EXTABLE(0b, 0b)
6849 +#endif
6850 +
6851 + "sets %1\n"
6852 : "+m" (v->counter), "=qm" (c)
6853 : "ir" (i) : "memory");
6854 return c;
6855 @@ -180,6 +342,46 @@ static inline int atomic_add_return(int
6856 #endif
6857 /* Modern 486+ processor */
6858 __i = i;
6859 + asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
6860 +
6861 +#ifdef CONFIG_PAX_REFCOUNT
6862 + "jno 0f\n"
6863 + "movl %0, %1\n"
6864 + "int $4\n0:\n"
6865 + _ASM_EXTABLE(0b, 0b)
6866 +#endif
6867 +
6868 + : "+r" (i), "+m" (v->counter)
6869 + : : "memory");
6870 + return i + __i;
6871 +
6872 +#ifdef CONFIG_M386
6873 +no_xadd: /* Legacy 386 processor */
6874 + local_irq_save(flags);
6875 + __i = atomic_read(v);
6876 + atomic_set(v, i + __i);
6877 + local_irq_restore(flags);
6878 + return i + __i;
6879 +#endif
6880 +}
6881 +
6882 +/**
6883 + * atomic_add_return_unchecked - add integer and return
6884 + * @v: pointer of type atomic_unchecked_t
6885 + * @i: integer value to add
6886 + *
6887 + * Atomically adds @i to @v and returns @i + @v
6888 + */
6889 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
6890 +{
6891 + int __i;
6892 +#ifdef CONFIG_M386
6893 + unsigned long flags;
6894 + if (unlikely(boot_cpu_data.x86 <= 3))
6895 + goto no_xadd;
6896 +#endif
6897 + /* Modern 486+ processor */
6898 + __i = i;
6899 asm volatile(LOCK_PREFIX "xaddl %0, %1"
6900 : "+r" (i), "+m" (v->counter)
6901 : : "memory");
6902 @@ -208,6 +410,10 @@ static inline int atomic_sub_return(int
6903 }
6904
6905 #define atomic_inc_return(v) (atomic_add_return(1, v))
6906 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
6907 +{
6908 + return atomic_add_return_unchecked(1, v);
6909 +}
6910 #define atomic_dec_return(v) (atomic_sub_return(1, v))
6911
6912 static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
6913 @@ -215,11 +421,21 @@ static inline int atomic_cmpxchg(atomic_
6914 return cmpxchg(&v->counter, old, new);
6915 }
6916
6917 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
6918 +{
6919 + return cmpxchg(&v->counter, old, new);
6920 +}
6921 +
6922 static inline int atomic_xchg(atomic_t *v, int new)
6923 {
6924 return xchg(&v->counter, new);
6925 }
6926
6927 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
6928 +{
6929 + return xchg(&v->counter, new);
6930 +}
6931 +
6932 /**
6933 * atomic_add_unless - add unless the number is already a given value
6934 * @v: pointer of type atomic_t
6935 @@ -231,21 +447,77 @@ static inline int atomic_xchg(atomic_t *
6936 */
6937 static inline int atomic_add_unless(atomic_t *v, int a, int u)
6938 {
6939 - int c, old;
6940 + int c, old, new;
6941 c = atomic_read(v);
6942 for (;;) {
6943 - if (unlikely(c == (u)))
6944 + if (unlikely(c == u))
6945 break;
6946 - old = atomic_cmpxchg((v), c, c + (a));
6947 +
6948 + asm volatile("addl %2,%0\n"
6949 +
6950 +#ifdef CONFIG_PAX_REFCOUNT
6951 + "jno 0f\n"
6952 + "subl %2,%0\n"
6953 + "int $4\n0:\n"
6954 + _ASM_EXTABLE(0b, 0b)
6955 +#endif
6956 +
6957 + : "=r" (new)
6958 + : "0" (c), "ir" (a));
6959 +
6960 + old = atomic_cmpxchg(v, c, new);
6961 if (likely(old == c))
6962 break;
6963 c = old;
6964 }
6965 - return c != (u);
6966 + return c != u;
6967 }
6968
6969 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
6970
6971 +/**
6972 + * atomic_inc_not_zero_hint - increment if not null
6973 + * @v: pointer of type atomic_t
6974 + * @hint: probable value of the atomic before the increment
6975 + *
6976 + * This version of atomic_inc_not_zero() gives a hint of probable
6977 + * value of the atomic. This helps processor to not read the memory
6978 + * before doing the atomic read/modify/write cycle, lowering
6979 + * number of bus transactions on some arches.
6980 + *
6981 + * Returns: 0 if increment was not done, 1 otherwise.
6982 + */
6983 +#define atomic_inc_not_zero_hint atomic_inc_not_zero_hint
6984 +static inline int atomic_inc_not_zero_hint(atomic_t *v, int hint)
6985 +{
6986 + int val, c = hint, new;
6987 +
6988 + /* sanity test, should be removed by compiler if hint is a constant */
6989 + if (!hint)
6990 + return atomic_inc_not_zero(v);
6991 +
6992 + do {
6993 + asm volatile("incl %0\n"
6994 +
6995 +#ifdef CONFIG_PAX_REFCOUNT
6996 + "jno 0f\n"
6997 + "decl %0\n"
6998 + "int $4\n0:\n"
6999 + _ASM_EXTABLE(0b, 0b)
7000 +#endif
7001 +
7002 + : "=r" (new)
7003 + : "0" (c));
7004 +
7005 + val = atomic_cmpxchg(v, c, new);
7006 + if (val == c)
7007 + return 1;
7008 + c = val;
7009 + } while (c);
7010 +
7011 + return 0;
7012 +}
7013 +
7014 /*
7015 * atomic_dec_if_positive - decrement by 1 if old value positive
7016 * @v: pointer of type atomic_t
7017 diff -urNp linux-3.0.8/arch/x86/include/asm/bitops.h linux-3.0.8/arch/x86/include/asm/bitops.h
7018 --- linux-3.0.8/arch/x86/include/asm/bitops.h 2011-07-21 22:17:23.000000000 -0400
7019 +++ linux-3.0.8/arch/x86/include/asm/bitops.h 2011-08-23 21:47:55.000000000 -0400
7020 @@ -38,7 +38,7 @@
7021 * a mask operation on a byte.
7022 */
7023 #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
7024 -#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
7025 +#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
7026 #define CONST_MASK(nr) (1 << ((nr) & 7))
7027
7028 /**
7029 diff -urNp linux-3.0.8/arch/x86/include/asm/boot.h linux-3.0.8/arch/x86/include/asm/boot.h
7030 --- linux-3.0.8/arch/x86/include/asm/boot.h 2011-07-21 22:17:23.000000000 -0400
7031 +++ linux-3.0.8/arch/x86/include/asm/boot.h 2011-08-23 21:47:55.000000000 -0400
7032 @@ -11,10 +11,15 @@
7033 #include <asm/pgtable_types.h>
7034
7035 /* Physical address where kernel should be loaded. */
7036 -#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
7037 +#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
7038 + (CONFIG_PHYSICAL_ALIGN - 1)) \
7039 & ~(CONFIG_PHYSICAL_ALIGN - 1))
7040
7041 +#ifndef __ASSEMBLY__
7042 +extern unsigned char __LOAD_PHYSICAL_ADDR[];
7043 +#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
7044 +#endif
7045 +
7046 /* Minimum kernel alignment, as a power of two */
7047 #ifdef CONFIG_X86_64
7048 #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
7049 diff -urNp linux-3.0.8/arch/x86/include/asm/cacheflush.h linux-3.0.8/arch/x86/include/asm/cacheflush.h
7050 --- linux-3.0.8/arch/x86/include/asm/cacheflush.h 2011-07-21 22:17:23.000000000 -0400
7051 +++ linux-3.0.8/arch/x86/include/asm/cacheflush.h 2011-08-23 21:47:55.000000000 -0400
7052 @@ -26,7 +26,7 @@ static inline unsigned long get_page_mem
7053 unsigned long pg_flags = pg->flags & _PGMT_MASK;
7054
7055 if (pg_flags == _PGMT_DEFAULT)
7056 - return -1;
7057 + return ~0UL;
7058 else if (pg_flags == _PGMT_WC)
7059 return _PAGE_CACHE_WC;
7060 else if (pg_flags == _PGMT_UC_MINUS)
7061 diff -urNp linux-3.0.8/arch/x86/include/asm/cache.h linux-3.0.8/arch/x86/include/asm/cache.h
7062 --- linux-3.0.8/arch/x86/include/asm/cache.h 2011-07-21 22:17:23.000000000 -0400
7063 +++ linux-3.0.8/arch/x86/include/asm/cache.h 2011-08-23 21:47:55.000000000 -0400
7064 @@ -5,12 +5,13 @@
7065
7066 /* L1 cache line size */
7067 #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
7068 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
7069 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
7070
7071 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
7072 +#define __read_only __attribute__((__section__(".data..read_only")))
7073
7074 #define INTERNODE_CACHE_SHIFT CONFIG_X86_INTERNODE_CACHE_SHIFT
7075 -#define INTERNODE_CACHE_BYTES (1 << INTERNODE_CACHE_SHIFT)
7076 +#define INTERNODE_CACHE_BYTES (_AC(1,UL) << INTERNODE_CACHE_SHIFT)
7077
7078 #ifdef CONFIG_X86_VSMP
7079 #ifdef CONFIG_SMP
7080 diff -urNp linux-3.0.8/arch/x86/include/asm/checksum_32.h linux-3.0.8/arch/x86/include/asm/checksum_32.h
7081 --- linux-3.0.8/arch/x86/include/asm/checksum_32.h 2011-07-21 22:17:23.000000000 -0400
7082 +++ linux-3.0.8/arch/x86/include/asm/checksum_32.h 2011-08-23 21:47:55.000000000 -0400
7083 @@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
7084 int len, __wsum sum,
7085 int *src_err_ptr, int *dst_err_ptr);
7086
7087 +asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
7088 + int len, __wsum sum,
7089 + int *src_err_ptr, int *dst_err_ptr);
7090 +
7091 +asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
7092 + int len, __wsum sum,
7093 + int *src_err_ptr, int *dst_err_ptr);
7094 +
7095 /*
7096 * Note: when you get a NULL pointer exception here this means someone
7097 * passed in an incorrect kernel address to one of these functions.
7098 @@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f
7099 int *err_ptr)
7100 {
7101 might_sleep();
7102 - return csum_partial_copy_generic((__force void *)src, dst,
7103 + return csum_partial_copy_generic_from_user((__force void *)src, dst,
7104 len, sum, err_ptr, NULL);
7105 }
7106
7107 @@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us
7108 {
7109 might_sleep();
7110 if (access_ok(VERIFY_WRITE, dst, len))
7111 - return csum_partial_copy_generic(src, (__force void *)dst,
7112 + return csum_partial_copy_generic_to_user(src, (__force void *)dst,
7113 len, sum, NULL, err_ptr);
7114
7115 if (len)
7116 diff -urNp linux-3.0.8/arch/x86/include/asm/cpufeature.h linux-3.0.8/arch/x86/include/asm/cpufeature.h
7117 --- linux-3.0.8/arch/x86/include/asm/cpufeature.h 2011-07-21 22:17:23.000000000 -0400
7118 +++ linux-3.0.8/arch/x86/include/asm/cpufeature.h 2011-08-23 21:47:55.000000000 -0400
7119 @@ -358,7 +358,7 @@ static __always_inline __pure bool __sta
7120 ".section .discard,\"aw\",@progbits\n"
7121 " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
7122 ".previous\n"
7123 - ".section .altinstr_replacement,\"ax\"\n"
7124 + ".section .altinstr_replacement,\"a\"\n"
7125 "3: movb $1,%0\n"
7126 "4:\n"
7127 ".previous\n"
7128 diff -urNp linux-3.0.8/arch/x86/include/asm/desc_defs.h linux-3.0.8/arch/x86/include/asm/desc_defs.h
7129 --- linux-3.0.8/arch/x86/include/asm/desc_defs.h 2011-07-21 22:17:23.000000000 -0400
7130 +++ linux-3.0.8/arch/x86/include/asm/desc_defs.h 2011-08-23 21:47:55.000000000 -0400
7131 @@ -31,6 +31,12 @@ struct desc_struct {
7132 unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
7133 unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
7134 };
7135 + struct {
7136 + u16 offset_low;
7137 + u16 seg;
7138 + unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
7139 + unsigned offset_high: 16;
7140 + } gate;
7141 };
7142 } __attribute__((packed));
7143
7144 diff -urNp linux-3.0.8/arch/x86/include/asm/desc.h linux-3.0.8/arch/x86/include/asm/desc.h
7145 --- linux-3.0.8/arch/x86/include/asm/desc.h 2011-07-21 22:17:23.000000000 -0400
7146 +++ linux-3.0.8/arch/x86/include/asm/desc.h 2011-08-23 21:47:55.000000000 -0400
7147 @@ -4,6 +4,7 @@
7148 #include <asm/desc_defs.h>
7149 #include <asm/ldt.h>
7150 #include <asm/mmu.h>
7151 +#include <asm/pgtable.h>
7152
7153 #include <linux/smp.h>
7154
7155 @@ -16,6 +17,7 @@ static inline void fill_ldt(struct desc_
7156
7157 desc->type = (info->read_exec_only ^ 1) << 1;
7158 desc->type |= info->contents << 2;
7159 + desc->type |= info->seg_not_present ^ 1;
7160
7161 desc->s = 1;
7162 desc->dpl = 0x3;
7163 @@ -34,17 +36,12 @@ static inline void fill_ldt(struct desc_
7164 }
7165
7166 extern struct desc_ptr idt_descr;
7167 -extern gate_desc idt_table[];
7168 -
7169 -struct gdt_page {
7170 - struct desc_struct gdt[GDT_ENTRIES];
7171 -} __attribute__((aligned(PAGE_SIZE)));
7172 -
7173 -DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
7174 +extern gate_desc idt_table[256];
7175
7176 +extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
7177 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
7178 {
7179 - return per_cpu(gdt_page, cpu).gdt;
7180 + return cpu_gdt_table[cpu];
7181 }
7182
7183 #ifdef CONFIG_X86_64
7184 @@ -69,8 +66,14 @@ static inline void pack_gate(gate_desc *
7185 unsigned long base, unsigned dpl, unsigned flags,
7186 unsigned short seg)
7187 {
7188 - gate->a = (seg << 16) | (base & 0xffff);
7189 - gate->b = (base & 0xffff0000) | (((0x80 | type | (dpl << 5)) & 0xff) << 8);
7190 + gate->gate.offset_low = base;
7191 + gate->gate.seg = seg;
7192 + gate->gate.reserved = 0;
7193 + gate->gate.type = type;
7194 + gate->gate.s = 0;
7195 + gate->gate.dpl = dpl;
7196 + gate->gate.p = 1;
7197 + gate->gate.offset_high = base >> 16;
7198 }
7199
7200 #endif
7201 @@ -115,12 +118,16 @@ static inline void paravirt_free_ldt(str
7202
7203 static inline void native_write_idt_entry(gate_desc *idt, int entry, const gate_desc *gate)
7204 {
7205 + pax_open_kernel();
7206 memcpy(&idt[entry], gate, sizeof(*gate));
7207 + pax_close_kernel();
7208 }
7209
7210 static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry, const void *desc)
7211 {
7212 + pax_open_kernel();
7213 memcpy(&ldt[entry], desc, 8);
7214 + pax_close_kernel();
7215 }
7216
7217 static inline void
7218 @@ -134,7 +141,9 @@ native_write_gdt_entry(struct desc_struc
7219 default: size = sizeof(*gdt); break;
7220 }
7221
7222 + pax_open_kernel();
7223 memcpy(&gdt[entry], desc, size);
7224 + pax_close_kernel();
7225 }
7226
7227 static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
7228 @@ -207,7 +216,9 @@ static inline void native_set_ldt(const
7229
7230 static inline void native_load_tr_desc(void)
7231 {
7232 + pax_open_kernel();
7233 asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
7234 + pax_close_kernel();
7235 }
7236
7237 static inline void native_load_gdt(const struct desc_ptr *dtr)
7238 @@ -244,8 +255,10 @@ static inline void native_load_tls(struc
7239 struct desc_struct *gdt = get_cpu_gdt_table(cpu);
7240 unsigned int i;
7241
7242 + pax_open_kernel();
7243 for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
7244 gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
7245 + pax_close_kernel();
7246 }
7247
7248 #define _LDT_empty(info) \
7249 @@ -307,7 +320,7 @@ static inline void set_desc_limit(struct
7250 desc->limit = (limit >> 16) & 0xf;
7251 }
7252
7253 -static inline void _set_gate(int gate, unsigned type, void *addr,
7254 +static inline void _set_gate(int gate, unsigned type, const void *addr,
7255 unsigned dpl, unsigned ist, unsigned seg)
7256 {
7257 gate_desc s;
7258 @@ -326,7 +339,7 @@ static inline void _set_gate(int gate, u
7259 * Pentium F0 0F bugfix can have resulted in the mapped
7260 * IDT being write-protected.
7261 */
7262 -static inline void set_intr_gate(unsigned int n, void *addr)
7263 +static inline void set_intr_gate(unsigned int n, const void *addr)
7264 {
7265 BUG_ON((unsigned)n > 0xFF);
7266 _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
7267 @@ -356,19 +369,19 @@ static inline void alloc_intr_gate(unsig
7268 /*
7269 * This routine sets up an interrupt gate at directory privilege level 3.
7270 */
7271 -static inline void set_system_intr_gate(unsigned int n, void *addr)
7272 +static inline void set_system_intr_gate(unsigned int n, const void *addr)
7273 {
7274 BUG_ON((unsigned)n > 0xFF);
7275 _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
7276 }
7277
7278 -static inline void set_system_trap_gate(unsigned int n, void *addr)
7279 +static inline void set_system_trap_gate(unsigned int n, const void *addr)
7280 {
7281 BUG_ON((unsigned)n > 0xFF);
7282 _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
7283 }
7284
7285 -static inline void set_trap_gate(unsigned int n, void *addr)
7286 +static inline void set_trap_gate(unsigned int n, const void *addr)
7287 {
7288 BUG_ON((unsigned)n > 0xFF);
7289 _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
7290 @@ -377,19 +390,31 @@ static inline void set_trap_gate(unsigne
7291 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
7292 {
7293 BUG_ON((unsigned)n > 0xFF);
7294 - _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
7295 + _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
7296 }
7297
7298 -static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
7299 +static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
7300 {
7301 BUG_ON((unsigned)n > 0xFF);
7302 _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
7303 }
7304
7305 -static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
7306 +static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
7307 {
7308 BUG_ON((unsigned)n > 0xFF);
7309 _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
7310 }
7311
7312 +#ifdef CONFIG_X86_32
7313 +static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
7314 +{
7315 + struct desc_struct d;
7316 +
7317 + if (likely(limit))
7318 + limit = (limit - 1UL) >> PAGE_SHIFT;
7319 + pack_descriptor(&d, base, limit, 0xFB, 0xC);
7320 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
7321 +}
7322 +#endif
7323 +
7324 #endif /* _ASM_X86_DESC_H */
7325 diff -urNp linux-3.0.8/arch/x86/include/asm/e820.h linux-3.0.8/arch/x86/include/asm/e820.h
7326 --- linux-3.0.8/arch/x86/include/asm/e820.h 2011-07-21 22:17:23.000000000 -0400
7327 +++ linux-3.0.8/arch/x86/include/asm/e820.h 2011-08-23 21:47:55.000000000 -0400
7328 @@ -69,7 +69,7 @@ struct e820map {
7329 #define ISA_START_ADDRESS 0xa0000
7330 #define ISA_END_ADDRESS 0x100000
7331
7332 -#define BIOS_BEGIN 0x000a0000
7333 +#define BIOS_BEGIN 0x000c0000
7334 #define BIOS_END 0x00100000
7335
7336 #define BIOS_ROM_BASE 0xffe00000
7337 diff -urNp linux-3.0.8/arch/x86/include/asm/elf.h linux-3.0.8/arch/x86/include/asm/elf.h
7338 --- linux-3.0.8/arch/x86/include/asm/elf.h 2011-07-21 22:17:23.000000000 -0400
7339 +++ linux-3.0.8/arch/x86/include/asm/elf.h 2011-08-23 21:47:55.000000000 -0400
7340 @@ -237,7 +237,25 @@ extern int force_personality32;
7341 the loader. We need to make sure that it is out of the way of the program
7342 that it will "exec", and that there is sufficient room for the brk. */
7343
7344 +#ifdef CONFIG_PAX_SEGMEXEC
7345 +#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
7346 +#else
7347 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
7348 +#endif
7349 +
7350 +#ifdef CONFIG_PAX_ASLR
7351 +#ifdef CONFIG_X86_32
7352 +#define PAX_ELF_ET_DYN_BASE 0x10000000UL
7353 +
7354 +#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
7355 +#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
7356 +#else
7357 +#define PAX_ELF_ET_DYN_BASE 0x400000UL
7358 +
7359 +#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
7360 +#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
7361 +#endif
7362 +#endif
7363
7364 /* This yields a mask that user programs can use to figure out what
7365 instruction set this CPU supports. This could be done in user space,
7366 @@ -290,9 +308,7 @@ do { \
7367
7368 #define ARCH_DLINFO \
7369 do { \
7370 - if (vdso_enabled) \
7371 - NEW_AUX_ENT(AT_SYSINFO_EHDR, \
7372 - (unsigned long)current->mm->context.vdso); \
7373 + NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso); \
7374 } while (0)
7375
7376 #define AT_SYSINFO 32
7377 @@ -303,7 +319,7 @@ do { \
7378
7379 #endif /* !CONFIG_X86_32 */
7380
7381 -#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
7382 +#define VDSO_CURRENT_BASE (current->mm->context.vdso)
7383
7384 #define VDSO_ENTRY \
7385 ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
7386 @@ -317,7 +333,4 @@ extern int arch_setup_additional_pages(s
7387 extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
7388 #define compat_arch_setup_additional_pages syscall32_setup_pages
7389
7390 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
7391 -#define arch_randomize_brk arch_randomize_brk
7392 -
7393 #endif /* _ASM_X86_ELF_H */
7394 diff -urNp linux-3.0.8/arch/x86/include/asm/emergency-restart.h linux-3.0.8/arch/x86/include/asm/emergency-restart.h
7395 --- linux-3.0.8/arch/x86/include/asm/emergency-restart.h 2011-07-21 22:17:23.000000000 -0400
7396 +++ linux-3.0.8/arch/x86/include/asm/emergency-restart.h 2011-08-23 21:47:55.000000000 -0400
7397 @@ -15,6 +15,6 @@ enum reboot_type {
7398
7399 extern enum reboot_type reboot_type;
7400
7401 -extern void machine_emergency_restart(void);
7402 +extern void machine_emergency_restart(void) __noreturn;
7403
7404 #endif /* _ASM_X86_EMERGENCY_RESTART_H */
7405 diff -urNp linux-3.0.8/arch/x86/include/asm/futex.h linux-3.0.8/arch/x86/include/asm/futex.h
7406 --- linux-3.0.8/arch/x86/include/asm/futex.h 2011-07-21 22:17:23.000000000 -0400
7407 +++ linux-3.0.8/arch/x86/include/asm/futex.h 2011-10-06 04:17:55.000000000 -0400
7408 @@ -12,16 +12,18 @@
7409 #include <asm/system.h>
7410
7411 #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
7412 + typecheck(u32 __user *, uaddr); \
7413 asm volatile("1:\t" insn "\n" \
7414 "2:\t.section .fixup,\"ax\"\n" \
7415 "3:\tmov\t%3, %1\n" \
7416 "\tjmp\t2b\n" \
7417 "\t.previous\n" \
7418 _ASM_EXTABLE(1b, 3b) \
7419 - : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
7420 + : "=r" (oldval), "=r" (ret), "+m" (*(u32 __user *)____m(uaddr))\
7421 : "i" (-EFAULT), "0" (oparg), "1" (0))
7422
7423 #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
7424 + typecheck(u32 __user *, uaddr); \
7425 asm volatile("1:\tmovl %2, %0\n" \
7426 "\tmovl\t%0, %3\n" \
7427 "\t" insn "\n" \
7428 @@ -34,7 +36,7 @@
7429 _ASM_EXTABLE(1b, 4b) \
7430 _ASM_EXTABLE(2b, 4b) \
7431 : "=&a" (oldval), "=&r" (ret), \
7432 - "+m" (*uaddr), "=&r" (tem) \
7433 + "+m" (*(u32 __user *)____m(uaddr)), "=&r" (tem) \
7434 : "r" (oparg), "i" (-EFAULT), "1" (0))
7435
7436 static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
7437 @@ -61,10 +63,10 @@ static inline int futex_atomic_op_inuser
7438
7439 switch (op) {
7440 case FUTEX_OP_SET:
7441 - __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
7442 + __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
7443 break;
7444 case FUTEX_OP_ADD:
7445 - __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
7446 + __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
7447 uaddr, oparg);
7448 break;
7449 case FUTEX_OP_OR:
7450 @@ -123,13 +125,13 @@ static inline int futex_atomic_cmpxchg_i
7451 if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
7452 return -EFAULT;
7453
7454 - asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %4, %2\n"
7455 + asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %4, %2\n"
7456 "2:\t.section .fixup, \"ax\"\n"
7457 "3:\tmov %3, %0\n"
7458 "\tjmp 2b\n"
7459 "\t.previous\n"
7460 _ASM_EXTABLE(1b, 3b)
7461 - : "+r" (ret), "=a" (oldval), "+m" (*uaddr)
7462 + : "+r" (ret), "=a" (oldval), "+m" (*(u32 __user *)____m(uaddr))
7463 : "i" (-EFAULT), "r" (newval), "1" (oldval)
7464 : "memory"
7465 );
7466 diff -urNp linux-3.0.8/arch/x86/include/asm/hw_irq.h linux-3.0.8/arch/x86/include/asm/hw_irq.h
7467 --- linux-3.0.8/arch/x86/include/asm/hw_irq.h 2011-07-21 22:17:23.000000000 -0400
7468 +++ linux-3.0.8/arch/x86/include/asm/hw_irq.h 2011-08-23 21:47:55.000000000 -0400
7469 @@ -137,8 +137,8 @@ extern void setup_ioapic_dest(void);
7470 extern void enable_IO_APIC(void);
7471
7472 /* Statistics */
7473 -extern atomic_t irq_err_count;
7474 -extern atomic_t irq_mis_count;
7475 +extern atomic_unchecked_t irq_err_count;
7476 +extern atomic_unchecked_t irq_mis_count;
7477
7478 /* EISA */
7479 extern void eisa_set_level_irq(unsigned int irq);
7480 diff -urNp linux-3.0.8/arch/x86/include/asm/i387.h linux-3.0.8/arch/x86/include/asm/i387.h
7481 --- linux-3.0.8/arch/x86/include/asm/i387.h 2011-07-21 22:17:23.000000000 -0400
7482 +++ linux-3.0.8/arch/x86/include/asm/i387.h 2011-10-06 04:17:55.000000000 -0400
7483 @@ -92,6 +92,11 @@ static inline int fxrstor_checking(struc
7484 {
7485 int err;
7486
7487 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
7488 + if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
7489 + fx = (struct i387_fxsave_struct __user *)((void *)fx + PAX_USER_SHADOW_BASE);
7490 +#endif
7491 +
7492 /* See comment in fxsave() below. */
7493 #ifdef CONFIG_AS_FXSAVEQ
7494 asm volatile("1: fxrstorq %[fx]\n\t"
7495 @@ -121,6 +126,11 @@ static inline int fxsave_user(struct i38
7496 {
7497 int err;
7498
7499 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
7500 + if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
7501 + fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
7502 +#endif
7503 +
7504 /*
7505 * Clear the bytes not touched by the fxsave and reserved
7506 * for the SW usage.
7507 @@ -213,13 +223,8 @@ static inline void fpu_fxsave(struct fpu
7508 #endif /* CONFIG_X86_64 */
7509
7510 /* We need a safe address that is cheap to find and that is already
7511 - in L1 during context switch. The best choices are unfortunately
7512 - different for UP and SMP */
7513 -#ifdef CONFIG_SMP
7514 -#define safe_address (__per_cpu_offset[0])
7515 -#else
7516 -#define safe_address (kstat_cpu(0).cpustat.user)
7517 -#endif
7518 + in L1 during context switch. */
7519 +#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
7520
7521 /*
7522 * These must be called with preempt disabled
7523 @@ -312,7 +317,7 @@ static inline void kernel_fpu_begin(void
7524 struct thread_info *me = current_thread_info();
7525 preempt_disable();
7526 if (me->status & TS_USEDFPU)
7527 - __save_init_fpu(me->task);
7528 + __save_init_fpu(current);
7529 else
7530 clts();
7531 }
7532 diff -urNp linux-3.0.8/arch/x86/include/asm/io.h linux-3.0.8/arch/x86/include/asm/io.h
7533 --- linux-3.0.8/arch/x86/include/asm/io.h 2011-07-21 22:17:23.000000000 -0400
7534 +++ linux-3.0.8/arch/x86/include/asm/io.h 2011-08-23 21:47:55.000000000 -0400
7535 @@ -196,6 +196,17 @@ extern void set_iounmap_nonlazy(void);
7536
7537 #include <linux/vmalloc.h>
7538
7539 +#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
7540 +static inline int valid_phys_addr_range(unsigned long addr, size_t count)
7541 +{
7542 + return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
7543 +}
7544 +
7545 +static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
7546 +{
7547 + return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
7548 +}
7549 +
7550 /*
7551 * Convert a virtual cached pointer to an uncached pointer
7552 */
7553 diff -urNp linux-3.0.8/arch/x86/include/asm/irqflags.h linux-3.0.8/arch/x86/include/asm/irqflags.h
7554 --- linux-3.0.8/arch/x86/include/asm/irqflags.h 2011-07-21 22:17:23.000000000 -0400
7555 +++ linux-3.0.8/arch/x86/include/asm/irqflags.h 2011-08-23 21:47:55.000000000 -0400
7556 @@ -140,6 +140,11 @@ static inline unsigned long arch_local_i
7557 sti; \
7558 sysexit
7559
7560 +#define GET_CR0_INTO_RDI mov %cr0, %rdi
7561 +#define SET_RDI_INTO_CR0 mov %rdi, %cr0
7562 +#define GET_CR3_INTO_RDI mov %cr3, %rdi
7563 +#define SET_RDI_INTO_CR3 mov %rdi, %cr3
7564 +
7565 #else
7566 #define INTERRUPT_RETURN iret
7567 #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
7568 diff -urNp linux-3.0.8/arch/x86/include/asm/kprobes.h linux-3.0.8/arch/x86/include/asm/kprobes.h
7569 --- linux-3.0.8/arch/x86/include/asm/kprobes.h 2011-07-21 22:17:23.000000000 -0400
7570 +++ linux-3.0.8/arch/x86/include/asm/kprobes.h 2011-08-23 21:47:55.000000000 -0400
7571 @@ -37,13 +37,8 @@ typedef u8 kprobe_opcode_t;
7572 #define RELATIVEJUMP_SIZE 5
7573 #define RELATIVECALL_OPCODE 0xe8
7574 #define RELATIVE_ADDR_SIZE 4
7575 -#define MAX_STACK_SIZE 64
7576 -#define MIN_STACK_SIZE(ADDR) \
7577 - (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
7578 - THREAD_SIZE - (unsigned long)(ADDR))) \
7579 - ? (MAX_STACK_SIZE) \
7580 - : (((unsigned long)current_thread_info()) + \
7581 - THREAD_SIZE - (unsigned long)(ADDR)))
7582 +#define MAX_STACK_SIZE 64UL
7583 +#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
7584
7585 #define flush_insn_slot(p) do { } while (0)
7586
7587 diff -urNp linux-3.0.8/arch/x86/include/asm/kvm_host.h linux-3.0.8/arch/x86/include/asm/kvm_host.h
7588 --- linux-3.0.8/arch/x86/include/asm/kvm_host.h 2011-07-21 22:17:23.000000000 -0400
7589 +++ linux-3.0.8/arch/x86/include/asm/kvm_host.h 2011-08-26 19:49:56.000000000 -0400
7590 @@ -441,7 +441,7 @@ struct kvm_arch {
7591 unsigned int n_used_mmu_pages;
7592 unsigned int n_requested_mmu_pages;
7593 unsigned int n_max_mmu_pages;
7594 - atomic_t invlpg_counter;
7595 + atomic_unchecked_t invlpg_counter;
7596 struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES];
7597 /*
7598 * Hash table of struct kvm_mmu_page.
7599 @@ -619,7 +619,7 @@ struct kvm_x86_ops {
7600 enum x86_intercept_stage stage);
7601
7602 const struct trace_print_flags *exit_reasons_str;
7603 -};
7604 +} __do_const;
7605
7606 struct kvm_arch_async_pf {
7607 u32 token;
7608 diff -urNp linux-3.0.8/arch/x86/include/asm/local.h linux-3.0.8/arch/x86/include/asm/local.h
7609 --- linux-3.0.8/arch/x86/include/asm/local.h 2011-07-21 22:17:23.000000000 -0400
7610 +++ linux-3.0.8/arch/x86/include/asm/local.h 2011-08-23 21:47:55.000000000 -0400
7611 @@ -18,26 +18,58 @@ typedef struct {
7612
7613 static inline void local_inc(local_t *l)
7614 {
7615 - asm volatile(_ASM_INC "%0"
7616 + asm volatile(_ASM_INC "%0\n"
7617 +
7618 +#ifdef CONFIG_PAX_REFCOUNT
7619 + "jno 0f\n"
7620 + _ASM_DEC "%0\n"
7621 + "int $4\n0:\n"
7622 + _ASM_EXTABLE(0b, 0b)
7623 +#endif
7624 +
7625 : "+m" (l->a.counter));
7626 }
7627
7628 static inline void local_dec(local_t *l)
7629 {
7630 - asm volatile(_ASM_DEC "%0"
7631 + asm volatile(_ASM_DEC "%0\n"
7632 +
7633 +#ifdef CONFIG_PAX_REFCOUNT
7634 + "jno 0f\n"
7635 + _ASM_INC "%0\n"
7636 + "int $4\n0:\n"
7637 + _ASM_EXTABLE(0b, 0b)
7638 +#endif
7639 +
7640 : "+m" (l->a.counter));
7641 }
7642
7643 static inline void local_add(long i, local_t *l)
7644 {
7645 - asm volatile(_ASM_ADD "%1,%0"
7646 + asm volatile(_ASM_ADD "%1,%0\n"
7647 +
7648 +#ifdef CONFIG_PAX_REFCOUNT
7649 + "jno 0f\n"
7650 + _ASM_SUB "%1,%0\n"
7651 + "int $4\n0:\n"
7652 + _ASM_EXTABLE(0b, 0b)
7653 +#endif
7654 +
7655 : "+m" (l->a.counter)
7656 : "ir" (i));
7657 }
7658
7659 static inline void local_sub(long i, local_t *l)
7660 {
7661 - asm volatile(_ASM_SUB "%1,%0"
7662 + asm volatile(_ASM_SUB "%1,%0\n"
7663 +
7664 +#ifdef CONFIG_PAX_REFCOUNT
7665 + "jno 0f\n"
7666 + _ASM_ADD "%1,%0\n"
7667 + "int $4\n0:\n"
7668 + _ASM_EXTABLE(0b, 0b)
7669 +#endif
7670 +
7671 : "+m" (l->a.counter)
7672 : "ir" (i));
7673 }
7674 @@ -55,7 +87,16 @@ static inline int local_sub_and_test(lon
7675 {
7676 unsigned char c;
7677
7678 - asm volatile(_ASM_SUB "%2,%0; sete %1"
7679 + asm volatile(_ASM_SUB "%2,%0\n"
7680 +
7681 +#ifdef CONFIG_PAX_REFCOUNT
7682 + "jno 0f\n"
7683 + _ASM_ADD "%2,%0\n"
7684 + "int $4\n0:\n"
7685 + _ASM_EXTABLE(0b, 0b)
7686 +#endif
7687 +
7688 + "sete %1\n"
7689 : "+m" (l->a.counter), "=qm" (c)
7690 : "ir" (i) : "memory");
7691 return c;
7692 @@ -73,7 +114,16 @@ static inline int local_dec_and_test(loc
7693 {
7694 unsigned char c;
7695
7696 - asm volatile(_ASM_DEC "%0; sete %1"
7697 + asm volatile(_ASM_DEC "%0\n"
7698 +
7699 +#ifdef CONFIG_PAX_REFCOUNT
7700 + "jno 0f\n"
7701 + _ASM_INC "%0\n"
7702 + "int $4\n0:\n"
7703 + _ASM_EXTABLE(0b, 0b)
7704 +#endif
7705 +
7706 + "sete %1\n"
7707 : "+m" (l->a.counter), "=qm" (c)
7708 : : "memory");
7709 return c != 0;
7710 @@ -91,7 +141,16 @@ static inline int local_inc_and_test(loc
7711 {
7712 unsigned char c;
7713
7714 - asm volatile(_ASM_INC "%0; sete %1"
7715 + asm volatile(_ASM_INC "%0\n"
7716 +
7717 +#ifdef CONFIG_PAX_REFCOUNT
7718 + "jno 0f\n"
7719 + _ASM_DEC "%0\n"
7720 + "int $4\n0:\n"
7721 + _ASM_EXTABLE(0b, 0b)
7722 +#endif
7723 +
7724 + "sete %1\n"
7725 : "+m" (l->a.counter), "=qm" (c)
7726 : : "memory");
7727 return c != 0;
7728 @@ -110,7 +169,16 @@ static inline int local_add_negative(lon
7729 {
7730 unsigned char c;
7731
7732 - asm volatile(_ASM_ADD "%2,%0; sets %1"
7733 + asm volatile(_ASM_ADD "%2,%0\n"
7734 +
7735 +#ifdef CONFIG_PAX_REFCOUNT
7736 + "jno 0f\n"
7737 + _ASM_SUB "%2,%0\n"
7738 + "int $4\n0:\n"
7739 + _ASM_EXTABLE(0b, 0b)
7740 +#endif
7741 +
7742 + "sets %1\n"
7743 : "+m" (l->a.counter), "=qm" (c)
7744 : "ir" (i) : "memory");
7745 return c;
7746 @@ -133,7 +201,15 @@ static inline long local_add_return(long
7747 #endif
7748 /* Modern 486+ processor */
7749 __i = i;
7750 - asm volatile(_ASM_XADD "%0, %1;"
7751 + asm volatile(_ASM_XADD "%0, %1\n"
7752 +
7753 +#ifdef CONFIG_PAX_REFCOUNT
7754 + "jno 0f\n"
7755 + _ASM_MOV "%0,%1\n"
7756 + "int $4\n0:\n"
7757 + _ASM_EXTABLE(0b, 0b)
7758 +#endif
7759 +
7760 : "+r" (i), "+m" (l->a.counter)
7761 : : "memory");
7762 return i + __i;
7763 diff -urNp linux-3.0.8/arch/x86/include/asm/mman.h linux-3.0.8/arch/x86/include/asm/mman.h
7764 --- linux-3.0.8/arch/x86/include/asm/mman.h 2011-07-21 22:17:23.000000000 -0400
7765 +++ linux-3.0.8/arch/x86/include/asm/mman.h 2011-08-23 21:47:55.000000000 -0400
7766 @@ -5,4 +5,14 @@
7767
7768 #include <asm-generic/mman.h>
7769
7770 +#ifdef __KERNEL__
7771 +#ifndef __ASSEMBLY__
7772 +#ifdef CONFIG_X86_32
7773 +#define arch_mmap_check i386_mmap_check
7774 +int i386_mmap_check(unsigned long addr, unsigned long len,
7775 + unsigned long flags);
7776 +#endif
7777 +#endif
7778 +#endif
7779 +
7780 #endif /* _ASM_X86_MMAN_H */
7781 diff -urNp linux-3.0.8/arch/x86/include/asm/mmu_context.h linux-3.0.8/arch/x86/include/asm/mmu_context.h
7782 --- linux-3.0.8/arch/x86/include/asm/mmu_context.h 2011-07-21 22:17:23.000000000 -0400
7783 +++ linux-3.0.8/arch/x86/include/asm/mmu_context.h 2011-08-23 21:48:14.000000000 -0400
7784 @@ -24,6 +24,18 @@ void destroy_context(struct mm_struct *m
7785
7786 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
7787 {
7788 +
7789 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
7790 + unsigned int i;
7791 + pgd_t *pgd;
7792 +
7793 + pax_open_kernel();
7794 + pgd = get_cpu_pgd(smp_processor_id());
7795 + for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
7796 + set_pgd_batched(pgd+i, native_make_pgd(0));
7797 + pax_close_kernel();
7798 +#endif
7799 +
7800 #ifdef CONFIG_SMP
7801 if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
7802 percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
7803 @@ -34,16 +46,30 @@ static inline void switch_mm(struct mm_s
7804 struct task_struct *tsk)
7805 {
7806 unsigned cpu = smp_processor_id();
7807 +#if defined(CONFIG_X86_32) && defined(CONFIG_SMP) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
7808 + int tlbstate = TLBSTATE_OK;
7809 +#endif
7810
7811 if (likely(prev != next)) {
7812 #ifdef CONFIG_SMP
7813 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
7814 + tlbstate = percpu_read(cpu_tlbstate.state);
7815 +#endif
7816 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
7817 percpu_write(cpu_tlbstate.active_mm, next);
7818 #endif
7819 cpumask_set_cpu(cpu, mm_cpumask(next));
7820
7821 /* Re-load page tables */
7822 +#ifdef CONFIG_PAX_PER_CPU_PGD
7823 + pax_open_kernel();
7824 + __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
7825 + __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
7826 + pax_close_kernel();
7827 + load_cr3(get_cpu_pgd(cpu));
7828 +#else
7829 load_cr3(next->pgd);
7830 +#endif
7831
7832 /* stop flush ipis for the previous mm */
7833 cpumask_clear_cpu(cpu, mm_cpumask(prev));
7834 @@ -53,9 +79,38 @@ static inline void switch_mm(struct mm_s
7835 */
7836 if (unlikely(prev->context.ldt != next->context.ldt))
7837 load_LDT_nolock(&next->context);
7838 - }
7839 +
7840 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
7841 + if (!(__supported_pte_mask & _PAGE_NX)) {
7842 + smp_mb__before_clear_bit();
7843 + cpu_clear(cpu, prev->context.cpu_user_cs_mask);
7844 + smp_mb__after_clear_bit();
7845 + cpu_set(cpu, next->context.cpu_user_cs_mask);
7846 + }
7847 +#endif
7848 +
7849 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
7850 + if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
7851 + prev->context.user_cs_limit != next->context.user_cs_limit))
7852 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
7853 #ifdef CONFIG_SMP
7854 + else if (unlikely(tlbstate != TLBSTATE_OK))
7855 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
7856 +#endif
7857 +#endif
7858 +
7859 + }
7860 else {
7861 +
7862 +#ifdef CONFIG_PAX_PER_CPU_PGD
7863 + pax_open_kernel();
7864 + __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
7865 + __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
7866 + pax_close_kernel();
7867 + load_cr3(get_cpu_pgd(cpu));
7868 +#endif
7869 +
7870 +#ifdef CONFIG_SMP
7871 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
7872 BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
7873
7874 @@ -64,11 +119,28 @@ static inline void switch_mm(struct mm_s
7875 * tlb flush IPI delivery. We must reload CR3
7876 * to make sure to use no freed page tables.
7877 */
7878 +
7879 +#ifndef CONFIG_PAX_PER_CPU_PGD
7880 load_cr3(next->pgd);
7881 +#endif
7882 +
7883 load_LDT_nolock(&next->context);
7884 +
7885 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
7886 + if (!(__supported_pte_mask & _PAGE_NX))
7887 + cpu_set(cpu, next->context.cpu_user_cs_mask);
7888 +#endif
7889 +
7890 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
7891 +#ifdef CONFIG_PAX_PAGEEXEC
7892 + if (!((next->pax_flags & MF_PAX_PAGEEXEC) && (__supported_pte_mask & _PAGE_NX)))
7893 +#endif
7894 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
7895 +#endif
7896 +
7897 }
7898 - }
7899 #endif
7900 + }
7901 }
7902
7903 #define activate_mm(prev, next) \
7904 diff -urNp linux-3.0.8/arch/x86/include/asm/mmu.h linux-3.0.8/arch/x86/include/asm/mmu.h
7905 --- linux-3.0.8/arch/x86/include/asm/mmu.h 2011-07-21 22:17:23.000000000 -0400
7906 +++ linux-3.0.8/arch/x86/include/asm/mmu.h 2011-08-23 21:47:55.000000000 -0400
7907 @@ -9,7 +9,7 @@
7908 * we put the segment information here.
7909 */
7910 typedef struct {
7911 - void *ldt;
7912 + struct desc_struct *ldt;
7913 int size;
7914
7915 #ifdef CONFIG_X86_64
7916 @@ -18,7 +18,19 @@ typedef struct {
7917 #endif
7918
7919 struct mutex lock;
7920 - void *vdso;
7921 + unsigned long vdso;
7922 +
7923 +#ifdef CONFIG_X86_32
7924 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
7925 + unsigned long user_cs_base;
7926 + unsigned long user_cs_limit;
7927 +
7928 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
7929 + cpumask_t cpu_user_cs_mask;
7930 +#endif
7931 +
7932 +#endif
7933 +#endif
7934 } mm_context_t;
7935
7936 #ifdef CONFIG_SMP
7937 diff -urNp linux-3.0.8/arch/x86/include/asm/module.h linux-3.0.8/arch/x86/include/asm/module.h
7938 --- linux-3.0.8/arch/x86/include/asm/module.h 2011-07-21 22:17:23.000000000 -0400
7939 +++ linux-3.0.8/arch/x86/include/asm/module.h 2011-10-07 19:24:31.000000000 -0400
7940 @@ -5,6 +5,7 @@
7941
7942 #ifdef CONFIG_X86_64
7943 /* X86_64 does not define MODULE_PROC_FAMILY */
7944 +#define MODULE_PROC_FAMILY ""
7945 #elif defined CONFIG_M386
7946 #define MODULE_PROC_FAMILY "386 "
7947 #elif defined CONFIG_M486
7948 @@ -59,8 +60,18 @@
7949 #error unknown processor family
7950 #endif
7951
7952 -#ifdef CONFIG_X86_32
7953 -# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY
7954 +#ifdef CONFIG_PAX_KERNEXEC
7955 +#define MODULE_PAX_KERNEXEC "KERNEXEC "
7956 +#else
7957 +#define MODULE_PAX_KERNEXEC ""
7958 #endif
7959
7960 +#ifdef CONFIG_PAX_MEMORY_UDEREF
7961 +#define MODULE_PAX_UDEREF "UDEREF "
7962 +#else
7963 +#define MODULE_PAX_UDEREF ""
7964 +#endif
7965 +
7966 +#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
7967 +
7968 #endif /* _ASM_X86_MODULE_H */
7969 diff -urNp linux-3.0.8/arch/x86/include/asm/page_64_types.h linux-3.0.8/arch/x86/include/asm/page_64_types.h
7970 --- linux-3.0.8/arch/x86/include/asm/page_64_types.h 2011-07-21 22:17:23.000000000 -0400
7971 +++ linux-3.0.8/arch/x86/include/asm/page_64_types.h 2011-08-23 21:47:55.000000000 -0400
7972 @@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
7973
7974 /* duplicated to the one in bootmem.h */
7975 extern unsigned long max_pfn;
7976 -extern unsigned long phys_base;
7977 +extern const unsigned long phys_base;
7978
7979 extern unsigned long __phys_addr(unsigned long);
7980 #define __phys_reloc_hide(x) (x)
7981 diff -urNp linux-3.0.8/arch/x86/include/asm/paravirt.h linux-3.0.8/arch/x86/include/asm/paravirt.h
7982 --- linux-3.0.8/arch/x86/include/asm/paravirt.h 2011-07-21 22:17:23.000000000 -0400
7983 +++ linux-3.0.8/arch/x86/include/asm/paravirt.h 2011-08-23 21:47:55.000000000 -0400
7984 @@ -658,6 +658,18 @@ static inline void set_pgd(pgd_t *pgdp,
7985 val);
7986 }
7987
7988 +static inline void set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
7989 +{
7990 + pgdval_t val = native_pgd_val(pgd);
7991 +
7992 + if (sizeof(pgdval_t) > sizeof(long))
7993 + PVOP_VCALL3(pv_mmu_ops.set_pgd_batched, pgdp,
7994 + val, (u64)val >> 32);
7995 + else
7996 + PVOP_VCALL2(pv_mmu_ops.set_pgd_batched, pgdp,
7997 + val);
7998 +}
7999 +
8000 static inline void pgd_clear(pgd_t *pgdp)
8001 {
8002 set_pgd(pgdp, __pgd(0));
8003 @@ -739,6 +751,21 @@ static inline void __set_fixmap(unsigned
8004 pv_mmu_ops.set_fixmap(idx, phys, flags);
8005 }
8006
8007 +#ifdef CONFIG_PAX_KERNEXEC
8008 +static inline unsigned long pax_open_kernel(void)
8009 +{
8010 + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
8011 +}
8012 +
8013 +static inline unsigned long pax_close_kernel(void)
8014 +{
8015 + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
8016 +}
8017 +#else
8018 +static inline unsigned long pax_open_kernel(void) { return 0; }
8019 +static inline unsigned long pax_close_kernel(void) { return 0; }
8020 +#endif
8021 +
8022 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
8023
8024 static inline int arch_spin_is_locked(struct arch_spinlock *lock)
8025 @@ -955,7 +982,7 @@ extern void default_banner(void);
8026
8027 #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
8028 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
8029 -#define PARA_INDIRECT(addr) *%cs:addr
8030 +#define PARA_INDIRECT(addr) *%ss:addr
8031 #endif
8032
8033 #define INTERRUPT_RETURN \
8034 @@ -1032,6 +1059,21 @@ extern void default_banner(void);
8035 PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
8036 CLBR_NONE, \
8037 jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
8038 +
8039 +#define GET_CR0_INTO_RDI \
8040 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
8041 + mov %rax,%rdi
8042 +
8043 +#define SET_RDI_INTO_CR0 \
8044 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
8045 +
8046 +#define GET_CR3_INTO_RDI \
8047 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
8048 + mov %rax,%rdi
8049 +
8050 +#define SET_RDI_INTO_CR3 \
8051 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
8052 +
8053 #endif /* CONFIG_X86_32 */
8054
8055 #endif /* __ASSEMBLY__ */
8056 diff -urNp linux-3.0.8/arch/x86/include/asm/paravirt_types.h linux-3.0.8/arch/x86/include/asm/paravirt_types.h
8057 --- linux-3.0.8/arch/x86/include/asm/paravirt_types.h 2011-07-21 22:17:23.000000000 -0400
8058 +++ linux-3.0.8/arch/x86/include/asm/paravirt_types.h 2011-08-23 21:47:55.000000000 -0400
8059 @@ -78,19 +78,19 @@ struct pv_init_ops {
8060 */
8061 unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
8062 unsigned long addr, unsigned len);
8063 -};
8064 +} __no_const;
8065
8066
8067 struct pv_lazy_ops {
8068 /* Set deferred update mode, used for batching operations. */
8069 void (*enter)(void);
8070 void (*leave)(void);
8071 -};
8072 +} __no_const;
8073
8074 struct pv_time_ops {
8075 unsigned long long (*sched_clock)(void);
8076 unsigned long (*get_tsc_khz)(void);
8077 -};
8078 +} __no_const;
8079
8080 struct pv_cpu_ops {
8081 /* hooks for various privileged instructions */
8082 @@ -186,7 +186,7 @@ struct pv_cpu_ops {
8083
8084 void (*start_context_switch)(struct task_struct *prev);
8085 void (*end_context_switch)(struct task_struct *next);
8086 -};
8087 +} __no_const;
8088
8089 struct pv_irq_ops {
8090 /*
8091 @@ -217,7 +217,7 @@ struct pv_apic_ops {
8092 unsigned long start_eip,
8093 unsigned long start_esp);
8094 #endif
8095 -};
8096 +} __no_const;
8097
8098 struct pv_mmu_ops {
8099 unsigned long (*read_cr2)(void);
8100 @@ -306,6 +306,7 @@ struct pv_mmu_ops {
8101 struct paravirt_callee_save make_pud;
8102
8103 void (*set_pgd)(pgd_t *pudp, pgd_t pgdval);
8104 + void (*set_pgd_batched)(pgd_t *pudp, pgd_t pgdval);
8105 #endif /* PAGETABLE_LEVELS == 4 */
8106 #endif /* PAGETABLE_LEVELS >= 3 */
8107
8108 @@ -317,6 +318,12 @@ struct pv_mmu_ops {
8109 an mfn. We can tell which is which from the index. */
8110 void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
8111 phys_addr_t phys, pgprot_t flags);
8112 +
8113 +#ifdef CONFIG_PAX_KERNEXEC
8114 + unsigned long (*pax_open_kernel)(void);
8115 + unsigned long (*pax_close_kernel)(void);
8116 +#endif
8117 +
8118 };
8119
8120 struct arch_spinlock;
8121 @@ -327,7 +334,7 @@ struct pv_lock_ops {
8122 void (*spin_lock_flags)(struct arch_spinlock *lock, unsigned long flags);
8123 int (*spin_trylock)(struct arch_spinlock *lock);
8124 void (*spin_unlock)(struct arch_spinlock *lock);
8125 -};
8126 +} __no_const;
8127
8128 /* This contains all the paravirt structures: we get a convenient
8129 * number for each function using the offset which we use to indicate
8130 diff -urNp linux-3.0.8/arch/x86/include/asm/pgalloc.h linux-3.0.8/arch/x86/include/asm/pgalloc.h
8131 --- linux-3.0.8/arch/x86/include/asm/pgalloc.h 2011-07-21 22:17:23.000000000 -0400
8132 +++ linux-3.0.8/arch/x86/include/asm/pgalloc.h 2011-08-23 21:47:55.000000000 -0400
8133 @@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
8134 pmd_t *pmd, pte_t *pte)
8135 {
8136 paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
8137 + set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
8138 +}
8139 +
8140 +static inline void pmd_populate_user(struct mm_struct *mm,
8141 + pmd_t *pmd, pte_t *pte)
8142 +{
8143 + paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
8144 set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
8145 }
8146
8147 diff -urNp linux-3.0.8/arch/x86/include/asm/pgtable-2level.h linux-3.0.8/arch/x86/include/asm/pgtable-2level.h
8148 --- linux-3.0.8/arch/x86/include/asm/pgtable-2level.h 2011-07-21 22:17:23.000000000 -0400
8149 +++ linux-3.0.8/arch/x86/include/asm/pgtable-2level.h 2011-08-23 21:47:55.000000000 -0400
8150 @@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t
8151
8152 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
8153 {
8154 + pax_open_kernel();
8155 *pmdp = pmd;
8156 + pax_close_kernel();
8157 }
8158
8159 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
8160 diff -urNp linux-3.0.8/arch/x86/include/asm/pgtable_32.h linux-3.0.8/arch/x86/include/asm/pgtable_32.h
8161 --- linux-3.0.8/arch/x86/include/asm/pgtable_32.h 2011-07-21 22:17:23.000000000 -0400
8162 +++ linux-3.0.8/arch/x86/include/asm/pgtable_32.h 2011-08-23 21:47:55.000000000 -0400
8163 @@ -25,9 +25,6 @@
8164 struct mm_struct;
8165 struct vm_area_struct;
8166
8167 -extern pgd_t swapper_pg_dir[1024];
8168 -extern pgd_t initial_page_table[1024];
8169 -
8170 static inline void pgtable_cache_init(void) { }
8171 static inline void check_pgt_cache(void) { }
8172 void paging_init(void);
8173 @@ -48,6 +45,12 @@ extern void set_pmd_pfn(unsigned long, u
8174 # include <asm/pgtable-2level.h>
8175 #endif
8176
8177 +extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
8178 +extern pgd_t initial_page_table[PTRS_PER_PGD];
8179 +#ifdef CONFIG_X86_PAE
8180 +extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
8181 +#endif
8182 +
8183 #if defined(CONFIG_HIGHPTE)
8184 #define pte_offset_map(dir, address) \
8185 ((pte_t *)kmap_atomic(pmd_page(*(dir))) + \
8186 @@ -62,7 +65,9 @@ extern void set_pmd_pfn(unsigned long, u
8187 /* Clear a kernel PTE and flush it from the TLB */
8188 #define kpte_clear_flush(ptep, vaddr) \
8189 do { \
8190 + pax_open_kernel(); \
8191 pte_clear(&init_mm, (vaddr), (ptep)); \
8192 + pax_close_kernel(); \
8193 __flush_tlb_one((vaddr)); \
8194 } while (0)
8195
8196 @@ -74,6 +79,9 @@ do { \
8197
8198 #endif /* !__ASSEMBLY__ */
8199
8200 +#define HAVE_ARCH_UNMAPPED_AREA
8201 +#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
8202 +
8203 /*
8204 * kern_addr_valid() is (1) for FLATMEM and (0) for
8205 * SPARSEMEM and DISCONTIGMEM
8206 diff -urNp linux-3.0.8/arch/x86/include/asm/pgtable_32_types.h linux-3.0.8/arch/x86/include/asm/pgtable_32_types.h
8207 --- linux-3.0.8/arch/x86/include/asm/pgtable_32_types.h 2011-07-21 22:17:23.000000000 -0400
8208 +++ linux-3.0.8/arch/x86/include/asm/pgtable_32_types.h 2011-08-23 21:47:55.000000000 -0400
8209 @@ -8,7 +8,7 @@
8210 */
8211 #ifdef CONFIG_X86_PAE
8212 # include <asm/pgtable-3level_types.h>
8213 -# define PMD_SIZE (1UL << PMD_SHIFT)
8214 +# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
8215 # define PMD_MASK (~(PMD_SIZE - 1))
8216 #else
8217 # include <asm/pgtable-2level_types.h>
8218 @@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set
8219 # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
8220 #endif
8221
8222 +#ifdef CONFIG_PAX_KERNEXEC
8223 +#ifndef __ASSEMBLY__
8224 +extern unsigned char MODULES_EXEC_VADDR[];
8225 +extern unsigned char MODULES_EXEC_END[];
8226 +#endif
8227 +#include <asm/boot.h>
8228 +#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
8229 +#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
8230 +#else
8231 +#define ktla_ktva(addr) (addr)
8232 +#define ktva_ktla(addr) (addr)
8233 +#endif
8234 +
8235 #define MODULES_VADDR VMALLOC_START
8236 #define MODULES_END VMALLOC_END
8237 #define MODULES_LEN (MODULES_VADDR - MODULES_END)
8238 diff -urNp linux-3.0.8/arch/x86/include/asm/pgtable-3level.h linux-3.0.8/arch/x86/include/asm/pgtable-3level.h
8239 --- linux-3.0.8/arch/x86/include/asm/pgtable-3level.h 2011-07-21 22:17:23.000000000 -0400
8240 +++ linux-3.0.8/arch/x86/include/asm/pgtable-3level.h 2011-08-23 21:47:55.000000000 -0400
8241 @@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
8242
8243 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
8244 {
8245 + pax_open_kernel();
8246 set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
8247 + pax_close_kernel();
8248 }
8249
8250 static inline void native_set_pud(pud_t *pudp, pud_t pud)
8251 {
8252 + pax_open_kernel();
8253 set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
8254 + pax_close_kernel();
8255 }
8256
8257 /*
8258 diff -urNp linux-3.0.8/arch/x86/include/asm/pgtable_64.h linux-3.0.8/arch/x86/include/asm/pgtable_64.h
8259 --- linux-3.0.8/arch/x86/include/asm/pgtable_64.h 2011-07-21 22:17:23.000000000 -0400
8260 +++ linux-3.0.8/arch/x86/include/asm/pgtable_64.h 2011-08-23 21:47:55.000000000 -0400
8261 @@ -16,10 +16,13 @@
8262
8263 extern pud_t level3_kernel_pgt[512];
8264 extern pud_t level3_ident_pgt[512];
8265 +extern pud_t level3_vmalloc_pgt[512];
8266 +extern pud_t level3_vmemmap_pgt[512];
8267 +extern pud_t level2_vmemmap_pgt[512];
8268 extern pmd_t level2_kernel_pgt[512];
8269 extern pmd_t level2_fixmap_pgt[512];
8270 -extern pmd_t level2_ident_pgt[512];
8271 -extern pgd_t init_level4_pgt[];
8272 +extern pmd_t level2_ident_pgt[512*2];
8273 +extern pgd_t init_level4_pgt[512];
8274
8275 #define swapper_pg_dir init_level4_pgt
8276
8277 @@ -61,7 +64,9 @@ static inline void native_set_pte_atomic
8278
8279 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
8280 {
8281 + pax_open_kernel();
8282 *pmdp = pmd;
8283 + pax_close_kernel();
8284 }
8285
8286 static inline void native_pmd_clear(pmd_t *pmd)
8287 @@ -107,6 +112,13 @@ static inline void native_pud_clear(pud_
8288
8289 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
8290 {
8291 + pax_open_kernel();
8292 + *pgdp = pgd;
8293 + pax_close_kernel();
8294 +}
8295 +
8296 +static inline void native_set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
8297 +{
8298 *pgdp = pgd;
8299 }
8300
8301 diff -urNp linux-3.0.8/arch/x86/include/asm/pgtable_64_types.h linux-3.0.8/arch/x86/include/asm/pgtable_64_types.h
8302 --- linux-3.0.8/arch/x86/include/asm/pgtable_64_types.h 2011-07-21 22:17:23.000000000 -0400
8303 +++ linux-3.0.8/arch/x86/include/asm/pgtable_64_types.h 2011-08-23 21:47:55.000000000 -0400
8304 @@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
8305 #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
8306 #define MODULES_END _AC(0xffffffffff000000, UL)
8307 #define MODULES_LEN (MODULES_END - MODULES_VADDR)
8308 +#define MODULES_EXEC_VADDR MODULES_VADDR
8309 +#define MODULES_EXEC_END MODULES_END
8310 +
8311 +#define ktla_ktva(addr) (addr)
8312 +#define ktva_ktla(addr) (addr)
8313
8314 #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
8315 diff -urNp linux-3.0.8/arch/x86/include/asm/pgtable.h linux-3.0.8/arch/x86/include/asm/pgtable.h
8316 --- linux-3.0.8/arch/x86/include/asm/pgtable.h 2011-07-21 22:17:23.000000000 -0400
8317 +++ linux-3.0.8/arch/x86/include/asm/pgtable.h 2011-08-23 21:47:55.000000000 -0400
8318 @@ -44,6 +44,7 @@ extern struct mm_struct *pgd_page_get_mm
8319
8320 #ifndef __PAGETABLE_PUD_FOLDED
8321 #define set_pgd(pgdp, pgd) native_set_pgd(pgdp, pgd)
8322 +#define set_pgd_batched(pgdp, pgd) native_set_pgd_batched(pgdp, pgd)
8323 #define pgd_clear(pgd) native_pgd_clear(pgd)
8324 #endif
8325
8326 @@ -81,12 +82,51 @@ extern struct mm_struct *pgd_page_get_mm
8327
8328 #define arch_end_context_switch(prev) do {} while(0)
8329
8330 +#define pax_open_kernel() native_pax_open_kernel()
8331 +#define pax_close_kernel() native_pax_close_kernel()
8332 #endif /* CONFIG_PARAVIRT */
8333
8334 +#define __HAVE_ARCH_PAX_OPEN_KERNEL
8335 +#define __HAVE_ARCH_PAX_CLOSE_KERNEL
8336 +
8337 +#ifdef CONFIG_PAX_KERNEXEC
8338 +static inline unsigned long native_pax_open_kernel(void)
8339 +{
8340 + unsigned long cr0;
8341 +
8342 + preempt_disable();
8343 + barrier();
8344 + cr0 = read_cr0() ^ X86_CR0_WP;
8345 + BUG_ON(unlikely(cr0 & X86_CR0_WP));
8346 + write_cr0(cr0);
8347 + return cr0 ^ X86_CR0_WP;
8348 +}
8349 +
8350 +static inline unsigned long native_pax_close_kernel(void)
8351 +{
8352 + unsigned long cr0;
8353 +
8354 + cr0 = read_cr0() ^ X86_CR0_WP;
8355 + BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
8356 + write_cr0(cr0);
8357 + barrier();
8358 + preempt_enable_no_resched();
8359 + return cr0 ^ X86_CR0_WP;
8360 +}
8361 +#else
8362 +static inline unsigned long native_pax_open_kernel(void) { return 0; }
8363 +static inline unsigned long native_pax_close_kernel(void) { return 0; }
8364 +#endif
8365 +
8366 /*
8367 * The following only work if pte_present() is true.
8368 * Undefined behaviour if not..
8369 */
8370 +static inline int pte_user(pte_t pte)
8371 +{
8372 + return pte_val(pte) & _PAGE_USER;
8373 +}
8374 +
8375 static inline int pte_dirty(pte_t pte)
8376 {
8377 return pte_flags(pte) & _PAGE_DIRTY;
8378 @@ -196,9 +236,29 @@ static inline pte_t pte_wrprotect(pte_t
8379 return pte_clear_flags(pte, _PAGE_RW);
8380 }
8381
8382 +static inline pte_t pte_mkread(pte_t pte)
8383 +{
8384 + return __pte(pte_val(pte) | _PAGE_USER);
8385 +}
8386 +
8387 static inline pte_t pte_mkexec(pte_t pte)
8388 {
8389 - return pte_clear_flags(pte, _PAGE_NX);
8390 +#ifdef CONFIG_X86_PAE
8391 + if (__supported_pte_mask & _PAGE_NX)
8392 + return pte_clear_flags(pte, _PAGE_NX);
8393 + else
8394 +#endif
8395 + return pte_set_flags(pte, _PAGE_USER);
8396 +}
8397 +
8398 +static inline pte_t pte_exprotect(pte_t pte)
8399 +{
8400 +#ifdef CONFIG_X86_PAE
8401 + if (__supported_pte_mask & _PAGE_NX)
8402 + return pte_set_flags(pte, _PAGE_NX);
8403 + else
8404 +#endif
8405 + return pte_clear_flags(pte, _PAGE_USER);
8406 }
8407
8408 static inline pte_t pte_mkdirty(pte_t pte)
8409 @@ -390,6 +450,15 @@ pte_t *populate_extra_pte(unsigned long
8410 #endif
8411
8412 #ifndef __ASSEMBLY__
8413 +
8414 +#ifdef CONFIG_PAX_PER_CPU_PGD
8415 +extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
8416 +static inline pgd_t *get_cpu_pgd(unsigned int cpu)
8417 +{
8418 + return cpu_pgd[cpu];
8419 +}
8420 +#endif
8421 +
8422 #include <linux/mm_types.h>
8423
8424 static inline int pte_none(pte_t pte)
8425 @@ -560,7 +629,7 @@ static inline pud_t *pud_offset(pgd_t *p
8426
8427 static inline int pgd_bad(pgd_t pgd)
8428 {
8429 - return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
8430 + return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
8431 }
8432
8433 static inline int pgd_none(pgd_t pgd)
8434 @@ -583,7 +652,12 @@ static inline int pgd_none(pgd_t pgd)
8435 * pgd_offset() returns a (pgd_t *)
8436 * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
8437 */
8438 -#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
8439 +#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
8440 +
8441 +#ifdef CONFIG_PAX_PER_CPU_PGD
8442 +#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
8443 +#endif
8444 +
8445 /*
8446 * a shortcut which implies the use of the kernel's pgd, instead
8447 * of a process's
8448 @@ -594,6 +668,20 @@ static inline int pgd_none(pgd_t pgd)
8449 #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
8450 #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
8451
8452 +#ifdef CONFIG_X86_32
8453 +#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
8454 +#else
8455 +#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
8456 +#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
8457 +
8458 +#ifdef CONFIG_PAX_MEMORY_UDEREF
8459 +#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
8460 +#else
8461 +#define PAX_USER_SHADOW_BASE (_AC(0,UL))
8462 +#endif
8463 +
8464 +#endif
8465 +
8466 #ifndef __ASSEMBLY__
8467
8468 extern int direct_gbpages;
8469 @@ -758,11 +846,23 @@ static inline void pmdp_set_wrprotect(st
8470 * dst and src can be on the same page, but the range must not overlap,
8471 * and must not cross a page boundary.
8472 */
8473 -static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
8474 +static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
8475 {
8476 - memcpy(dst, src, count * sizeof(pgd_t));
8477 + pax_open_kernel();
8478 + while (count--)
8479 + *dst++ = *src++;
8480 + pax_close_kernel();
8481 }
8482
8483 +#ifdef CONFIG_PAX_PER_CPU_PGD
8484 +extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
8485 +#endif
8486 +
8487 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
8488 +extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
8489 +#else
8490 +static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) {}
8491 +#endif
8492
8493 #include <asm-generic/pgtable.h>
8494 #endif /* __ASSEMBLY__ */
8495 diff -urNp linux-3.0.8/arch/x86/include/asm/pgtable_types.h linux-3.0.8/arch/x86/include/asm/pgtable_types.h
8496 --- linux-3.0.8/arch/x86/include/asm/pgtable_types.h 2011-07-21 22:17:23.000000000 -0400
8497 +++ linux-3.0.8/arch/x86/include/asm/pgtable_types.h 2011-08-23 21:47:55.000000000 -0400
8498 @@ -16,13 +16,12 @@
8499 #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
8500 #define _PAGE_BIT_PAT 7 /* on 4KB pages */
8501 #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
8502 -#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
8503 +#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
8504 #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
8505 #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
8506 #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
8507 -#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
8508 -#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
8509 -#define _PAGE_BIT_SPLITTING _PAGE_BIT_UNUSED1 /* only valid on a PSE pmd */
8510 +#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
8511 +#define _PAGE_BIT_SPLITTING _PAGE_BIT_SPECIAL /* only valid on a PSE pmd */
8512 #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
8513
8514 /* If _PAGE_BIT_PRESENT is clear, we use these: */
8515 @@ -40,7 +39,6 @@
8516 #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
8517 #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
8518 #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
8519 -#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
8520 #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
8521 #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
8522 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
8523 @@ -57,8 +55,10 @@
8524
8525 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
8526 #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
8527 -#else
8528 +#elif defined(CONFIG_KMEMCHECK)
8529 #define _PAGE_NX (_AT(pteval_t, 0))
8530 +#else
8531 +#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
8532 #endif
8533
8534 #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
8535 @@ -96,6 +96,9 @@
8536 #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
8537 _PAGE_ACCESSED)
8538
8539 +#define PAGE_READONLY_NOEXEC PAGE_READONLY
8540 +#define PAGE_SHARED_NOEXEC PAGE_SHARED
8541 +
8542 #define __PAGE_KERNEL_EXEC \
8543 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
8544 #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
8545 @@ -106,8 +109,8 @@
8546 #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
8547 #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
8548 #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
8549 -#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
8550 -#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
8551 +#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
8552 +#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
8553 #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
8554 #define __PAGE_KERNEL_LARGE_NOCACHE (__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
8555 #define __PAGE_KERNEL_LARGE_EXEC (__PAGE_KERNEL_EXEC | _PAGE_PSE)
8556 @@ -166,8 +169,8 @@
8557 * bits are combined, this will alow user to access the high address mapped
8558 * VDSO in the presence of CONFIG_COMPAT_VDSO
8559 */
8560 -#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
8561 -#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
8562 +#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
8563 +#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
8564 #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
8565 #endif
8566
8567 @@ -205,7 +208,17 @@ static inline pgdval_t pgd_flags(pgd_t p
8568 {
8569 return native_pgd_val(pgd) & PTE_FLAGS_MASK;
8570 }
8571 +#endif
8572
8573 +#if PAGETABLE_LEVELS == 3
8574 +#include <asm-generic/pgtable-nopud.h>
8575 +#endif
8576 +
8577 +#if PAGETABLE_LEVELS == 2
8578 +#include <asm-generic/pgtable-nopmd.h>
8579 +#endif
8580 +
8581 +#ifndef __ASSEMBLY__
8582 #if PAGETABLE_LEVELS > 3
8583 typedef struct { pudval_t pud; } pud_t;
8584
8585 @@ -219,8 +232,6 @@ static inline pudval_t native_pud_val(pu
8586 return pud.pud;
8587 }
8588 #else
8589 -#include <asm-generic/pgtable-nopud.h>
8590 -
8591 static inline pudval_t native_pud_val(pud_t pud)
8592 {
8593 return native_pgd_val(pud.pgd);
8594 @@ -240,8 +251,6 @@ static inline pmdval_t native_pmd_val(pm
8595 return pmd.pmd;
8596 }
8597 #else
8598 -#include <asm-generic/pgtable-nopmd.h>
8599 -
8600 static inline pmdval_t native_pmd_val(pmd_t pmd)
8601 {
8602 return native_pgd_val(pmd.pud.pgd);
8603 @@ -281,7 +290,6 @@ typedef struct page *pgtable_t;
8604
8605 extern pteval_t __supported_pte_mask;
8606 extern void set_nx(void);
8607 -extern int nx_enabled;
8608
8609 #define pgprot_writecombine pgprot_writecombine
8610 extern pgprot_t pgprot_writecombine(pgprot_t prot);
8611 diff -urNp linux-3.0.8/arch/x86/include/asm/processor.h linux-3.0.8/arch/x86/include/asm/processor.h
8612 --- linux-3.0.8/arch/x86/include/asm/processor.h 2011-07-21 22:17:23.000000000 -0400
8613 +++ linux-3.0.8/arch/x86/include/asm/processor.h 2011-08-23 21:47:55.000000000 -0400
8614 @@ -266,7 +266,7 @@ struct tss_struct {
8615
8616 } ____cacheline_aligned;
8617
8618 -DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
8619 +extern struct tss_struct init_tss[NR_CPUS];
8620
8621 /*
8622 * Save the original ist values for checking stack pointers during debugging
8623 @@ -860,11 +860,18 @@ static inline void spin_lock_prefetch(co
8624 */
8625 #define TASK_SIZE PAGE_OFFSET
8626 #define TASK_SIZE_MAX TASK_SIZE
8627 +
8628 +#ifdef CONFIG_PAX_SEGMEXEC
8629 +#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
8630 +#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
8631 +#else
8632 #define STACK_TOP TASK_SIZE
8633 -#define STACK_TOP_MAX STACK_TOP
8634 +#endif
8635 +
8636 +#define STACK_TOP_MAX TASK_SIZE
8637
8638 #define INIT_THREAD { \
8639 - .sp0 = sizeof(init_stack) + (long)&init_stack, \
8640 + .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
8641 .vm86_info = NULL, \
8642 .sysenter_cs = __KERNEL_CS, \
8643 .io_bitmap_ptr = NULL, \
8644 @@ -878,7 +885,7 @@ static inline void spin_lock_prefetch(co
8645 */
8646 #define INIT_TSS { \
8647 .x86_tss = { \
8648 - .sp0 = sizeof(init_stack) + (long)&init_stack, \
8649 + .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
8650 .ss0 = __KERNEL_DS, \
8651 .ss1 = __KERNEL_CS, \
8652 .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
8653 @@ -889,11 +896,7 @@ static inline void spin_lock_prefetch(co
8654 extern unsigned long thread_saved_pc(struct task_struct *tsk);
8655
8656 #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
8657 -#define KSTK_TOP(info) \
8658 -({ \
8659 - unsigned long *__ptr = (unsigned long *)(info); \
8660 - (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
8661 -})
8662 +#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
8663
8664 /*
8665 * The below -8 is to reserve 8 bytes on top of the ring0 stack.
8666 @@ -908,7 +911,7 @@ extern unsigned long thread_saved_pc(str
8667 #define task_pt_regs(task) \
8668 ({ \
8669 struct pt_regs *__regs__; \
8670 - __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
8671 + __regs__ = (struct pt_regs *)((task)->thread.sp0); \
8672 __regs__ - 1; \
8673 })
8674
8675 @@ -918,13 +921,13 @@ extern unsigned long thread_saved_pc(str
8676 /*
8677 * User space process size. 47bits minus one guard page.
8678 */
8679 -#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
8680 +#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
8681
8682 /* This decides where the kernel will search for a free chunk of vm
8683 * space during mmap's.
8684 */
8685 #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
8686 - 0xc0000000 : 0xFFFFe000)
8687 + 0xc0000000 : 0xFFFFf000)
8688
8689 #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \
8690 IA32_PAGE_OFFSET : TASK_SIZE_MAX)
8691 @@ -935,11 +938,11 @@ extern unsigned long thread_saved_pc(str
8692 #define STACK_TOP_MAX TASK_SIZE_MAX
8693
8694 #define INIT_THREAD { \
8695 - .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
8696 + .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
8697 }
8698
8699 #define INIT_TSS { \
8700 - .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
8701 + .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
8702 }
8703
8704 /*
8705 @@ -961,6 +964,10 @@ extern void start_thread(struct pt_regs
8706 */
8707 #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
8708
8709 +#ifdef CONFIG_PAX_SEGMEXEC
8710 +#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
8711 +#endif
8712 +
8713 #define KSTK_EIP(task) (task_pt_regs(task)->ip)
8714
8715 /* Get/set a process' ability to use the timestamp counter instruction */
8716 diff -urNp linux-3.0.8/arch/x86/include/asm/ptrace.h linux-3.0.8/arch/x86/include/asm/ptrace.h
8717 --- linux-3.0.8/arch/x86/include/asm/ptrace.h 2011-07-21 22:17:23.000000000 -0400
8718 +++ linux-3.0.8/arch/x86/include/asm/ptrace.h 2011-08-23 21:47:55.000000000 -0400
8719 @@ -153,28 +153,29 @@ static inline unsigned long regs_return_
8720 }
8721
8722 /*
8723 - * user_mode_vm(regs) determines whether a register set came from user mode.
8724 + * user_mode(regs) determines whether a register set came from user mode.
8725 * This is true if V8086 mode was enabled OR if the register set was from
8726 * protected mode with RPL-3 CS value. This tricky test checks that with
8727 * one comparison. Many places in the kernel can bypass this full check
8728 - * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
8729 + * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
8730 + * be used.
8731 */
8732 -static inline int user_mode(struct pt_regs *regs)
8733 +static inline int user_mode_novm(struct pt_regs *regs)
8734 {
8735 #ifdef CONFIG_X86_32
8736 return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
8737 #else
8738 - return !!(regs->cs & 3);
8739 + return !!(regs->cs & SEGMENT_RPL_MASK);
8740 #endif
8741 }
8742
8743 -static inline int user_mode_vm(struct pt_regs *regs)
8744 +static inline int user_mode(struct pt_regs *regs)
8745 {
8746 #ifdef CONFIG_X86_32
8747 return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
8748 USER_RPL;
8749 #else
8750 - return user_mode(regs);
8751 + return user_mode_novm(regs);
8752 #endif
8753 }
8754
8755 diff -urNp linux-3.0.8/arch/x86/include/asm/reboot.h linux-3.0.8/arch/x86/include/asm/reboot.h
8756 --- linux-3.0.8/arch/x86/include/asm/reboot.h 2011-07-21 22:17:23.000000000 -0400
8757 +++ linux-3.0.8/arch/x86/include/asm/reboot.h 2011-08-23 21:47:55.000000000 -0400
8758 @@ -6,19 +6,19 @@
8759 struct pt_regs;
8760
8761 struct machine_ops {
8762 - void (*restart)(char *cmd);
8763 - void (*halt)(void);
8764 - void (*power_off)(void);
8765 + void (* __noreturn restart)(char *cmd);
8766 + void (* __noreturn halt)(void);
8767 + void (* __noreturn power_off)(void);
8768 void (*shutdown)(void);
8769 void (*crash_shutdown)(struct pt_regs *);
8770 - void (*emergency_restart)(void);
8771 -};
8772 + void (* __noreturn emergency_restart)(void);
8773 +} __no_const;
8774
8775 extern struct machine_ops machine_ops;
8776
8777 void native_machine_crash_shutdown(struct pt_regs *regs);
8778 void native_machine_shutdown(void);
8779 -void machine_real_restart(unsigned int type);
8780 +void machine_real_restart(unsigned int type) __noreturn;
8781 /* These must match dispatch_table in reboot_32.S */
8782 #define MRR_BIOS 0
8783 #define MRR_APM 1
8784 diff -urNp linux-3.0.8/arch/x86/include/asm/rwsem.h linux-3.0.8/arch/x86/include/asm/rwsem.h
8785 --- linux-3.0.8/arch/x86/include/asm/rwsem.h 2011-07-21 22:17:23.000000000 -0400
8786 +++ linux-3.0.8/arch/x86/include/asm/rwsem.h 2011-08-23 21:47:55.000000000 -0400
8787 @@ -64,6 +64,14 @@ static inline void __down_read(struct rw
8788 {
8789 asm volatile("# beginning down_read\n\t"
8790 LOCK_PREFIX _ASM_INC "(%1)\n\t"
8791 +
8792 +#ifdef CONFIG_PAX_REFCOUNT
8793 + "jno 0f\n"
8794 + LOCK_PREFIX _ASM_DEC "(%1)\n"
8795 + "int $4\n0:\n"
8796 + _ASM_EXTABLE(0b, 0b)
8797 +#endif
8798 +
8799 /* adds 0x00000001 */
8800 " jns 1f\n"
8801 " call call_rwsem_down_read_failed\n"
8802 @@ -85,6 +93,14 @@ static inline int __down_read_trylock(st
8803 "1:\n\t"
8804 " mov %1,%2\n\t"
8805 " add %3,%2\n\t"
8806 +
8807 +#ifdef CONFIG_PAX_REFCOUNT
8808 + "jno 0f\n"
8809 + "sub %3,%2\n"
8810 + "int $4\n0:\n"
8811 + _ASM_EXTABLE(0b, 0b)
8812 +#endif
8813 +
8814 " jle 2f\n\t"
8815 LOCK_PREFIX " cmpxchg %2,%0\n\t"
8816 " jnz 1b\n\t"
8817 @@ -104,6 +120,14 @@ static inline void __down_write_nested(s
8818 long tmp;
8819 asm volatile("# beginning down_write\n\t"
8820 LOCK_PREFIX " xadd %1,(%2)\n\t"
8821 +
8822 +#ifdef CONFIG_PAX_REFCOUNT
8823 + "jno 0f\n"
8824 + "mov %1,(%2)\n"
8825 + "int $4\n0:\n"
8826 + _ASM_EXTABLE(0b, 0b)
8827 +#endif
8828 +
8829 /* adds 0xffff0001, returns the old value */
8830 " test %1,%1\n\t"
8831 /* was the count 0 before? */
8832 @@ -141,6 +165,14 @@ static inline void __up_read(struct rw_s
8833 long tmp;
8834 asm volatile("# beginning __up_read\n\t"
8835 LOCK_PREFIX " xadd %1,(%2)\n\t"
8836 +
8837 +#ifdef CONFIG_PAX_REFCOUNT
8838 + "jno 0f\n"
8839 + "mov %1,(%2)\n"
8840 + "int $4\n0:\n"
8841 + _ASM_EXTABLE(0b, 0b)
8842 +#endif
8843 +
8844 /* subtracts 1, returns the old value */
8845 " jns 1f\n\t"
8846 " call call_rwsem_wake\n" /* expects old value in %edx */
8847 @@ -159,6 +191,14 @@ static inline void __up_write(struct rw_
8848 long tmp;
8849 asm volatile("# beginning __up_write\n\t"
8850 LOCK_PREFIX " xadd %1,(%2)\n\t"
8851 +
8852 +#ifdef CONFIG_PAX_REFCOUNT
8853 + "jno 0f\n"
8854 + "mov %1,(%2)\n"
8855 + "int $4\n0:\n"
8856 + _ASM_EXTABLE(0b, 0b)
8857 +#endif
8858 +
8859 /* subtracts 0xffff0001, returns the old value */
8860 " jns 1f\n\t"
8861 " call call_rwsem_wake\n" /* expects old value in %edx */
8862 @@ -176,6 +216,14 @@ static inline void __downgrade_write(str
8863 {
8864 asm volatile("# beginning __downgrade_write\n\t"
8865 LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
8866 +
8867 +#ifdef CONFIG_PAX_REFCOUNT
8868 + "jno 0f\n"
8869 + LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
8870 + "int $4\n0:\n"
8871 + _ASM_EXTABLE(0b, 0b)
8872 +#endif
8873 +
8874 /*
8875 * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
8876 * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
8877 @@ -194,7 +242,15 @@ static inline void __downgrade_write(str
8878 */
8879 static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem)
8880 {
8881 - asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
8882 + asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
8883 +
8884 +#ifdef CONFIG_PAX_REFCOUNT
8885 + "jno 0f\n"
8886 + LOCK_PREFIX _ASM_SUB "%1,%0\n"
8887 + "int $4\n0:\n"
8888 + _ASM_EXTABLE(0b, 0b)
8889 +#endif
8890 +
8891 : "+m" (sem->count)
8892 : "er" (delta));
8893 }
8894 @@ -206,7 +262,15 @@ static inline long rwsem_atomic_update(l
8895 {
8896 long tmp = delta;
8897
8898 - asm volatile(LOCK_PREFIX "xadd %0,%1"
8899 + asm volatile(LOCK_PREFIX "xadd %0,%1\n"
8900 +
8901 +#ifdef CONFIG_PAX_REFCOUNT
8902 + "jno 0f\n"
8903 + "mov %0,%1\n"
8904 + "int $4\n0:\n"
8905 + _ASM_EXTABLE(0b, 0b)
8906 +#endif
8907 +
8908 : "+r" (tmp), "+m" (sem->count)
8909 : : "memory");
8910
8911 diff -urNp linux-3.0.8/arch/x86/include/asm/segment.h linux-3.0.8/arch/x86/include/asm/segment.h
8912 --- linux-3.0.8/arch/x86/include/asm/segment.h 2011-07-21 22:17:23.000000000 -0400
8913 +++ linux-3.0.8/arch/x86/include/asm/segment.h 2011-09-17 00:53:42.000000000 -0400
8914 @@ -64,10 +64,15 @@
8915 * 26 - ESPFIX small SS
8916 * 27 - per-cpu [ offset to per-cpu data area ]
8917 * 28 - stack_canary-20 [ for stack protector ]
8918 - * 29 - unused
8919 - * 30 - unused
8920 + * 29 - PCI BIOS CS
8921 + * 30 - PCI BIOS DS
8922 * 31 - TSS for double fault handler
8923 */
8924 +#define GDT_ENTRY_KERNEXEC_EFI_CS (1)
8925 +#define GDT_ENTRY_KERNEXEC_EFI_DS (2)
8926 +#define __KERNEXEC_EFI_CS (GDT_ENTRY_KERNEXEC_EFI_CS*8)
8927 +#define __KERNEXEC_EFI_DS (GDT_ENTRY_KERNEXEC_EFI_DS*8)
8928 +
8929 #define GDT_ENTRY_TLS_MIN 6
8930 #define GDT_ENTRY_TLS_MAX (GDT_ENTRY_TLS_MIN + GDT_ENTRY_TLS_ENTRIES - 1)
8931
8932 @@ -79,6 +84,8 @@
8933
8934 #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE+0)
8935
8936 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
8937 +
8938 #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE+1)
8939
8940 #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE+4)
8941 @@ -104,6 +111,12 @@
8942 #define __KERNEL_STACK_CANARY 0
8943 #endif
8944
8945 +#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE+17)
8946 +#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
8947 +
8948 +#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE+18)
8949 +#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
8950 +
8951 #define GDT_ENTRY_DOUBLEFAULT_TSS 31
8952
8953 /*
8954 @@ -141,7 +154,7 @@
8955 */
8956
8957 /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
8958 -#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
8959 +#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
8960
8961
8962 #else
8963 @@ -165,6 +178,8 @@
8964 #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
8965 #define __USER32_DS __USER_DS
8966
8967 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
8968 +
8969 #define GDT_ENTRY_TSS 8 /* needs two entries */
8970 #define GDT_ENTRY_LDT 10 /* needs two entries */
8971 #define GDT_ENTRY_TLS_MIN 12
8972 @@ -185,6 +200,7 @@
8973 #endif
8974
8975 #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS*8)
8976 +#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS*8)
8977 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS*8)
8978 #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS*8+3)
8979 #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS*8+3)
8980 diff -urNp linux-3.0.8/arch/x86/include/asm/smp.h linux-3.0.8/arch/x86/include/asm/smp.h
8981 --- linux-3.0.8/arch/x86/include/asm/smp.h 2011-07-21 22:17:23.000000000 -0400
8982 +++ linux-3.0.8/arch/x86/include/asm/smp.h 2011-08-23 21:47:55.000000000 -0400
8983 @@ -36,7 +36,7 @@ DECLARE_PER_CPU(cpumask_var_t, cpu_core_
8984 /* cpus sharing the last level cache: */
8985 DECLARE_PER_CPU(cpumask_var_t, cpu_llc_shared_map);
8986 DECLARE_PER_CPU(u16, cpu_llc_id);
8987 -DECLARE_PER_CPU(int, cpu_number);
8988 +DECLARE_PER_CPU(unsigned int, cpu_number);
8989
8990 static inline struct cpumask *cpu_sibling_mask(int cpu)
8991 {
8992 @@ -77,7 +77,7 @@ struct smp_ops {
8993
8994 void (*send_call_func_ipi)(const struct cpumask *mask);
8995 void (*send_call_func_single_ipi)(int cpu);
8996 -};
8997 +} __no_const;
8998
8999 /* Globals due to paravirt */
9000 extern void set_cpu_sibling_map(int cpu);
9001 @@ -192,14 +192,8 @@ extern unsigned disabled_cpus __cpuinitd
9002 extern int safe_smp_processor_id(void);
9003
9004 #elif defined(CONFIG_X86_64_SMP)
9005 -#define raw_smp_processor_id() (percpu_read(cpu_number))
9006 -
9007 -#define stack_smp_processor_id() \
9008 -({ \
9009 - struct thread_info *ti; \
9010 - __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
9011 - ti->cpu; \
9012 -})
9013 +#define raw_smp_processor_id() (percpu_read(cpu_number))
9014 +#define stack_smp_processor_id() raw_smp_processor_id()
9015 #define safe_smp_processor_id() smp_processor_id()
9016
9017 #endif
9018 diff -urNp linux-3.0.8/arch/x86/include/asm/spinlock.h linux-3.0.8/arch/x86/include/asm/spinlock.h
9019 --- linux-3.0.8/arch/x86/include/asm/spinlock.h 2011-07-21 22:17:23.000000000 -0400
9020 +++ linux-3.0.8/arch/x86/include/asm/spinlock.h 2011-08-23 21:47:55.000000000 -0400
9021 @@ -249,6 +249,14 @@ static inline int arch_write_can_lock(ar
9022 static inline void arch_read_lock(arch_rwlock_t *rw)
9023 {
9024 asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
9025 +
9026 +#ifdef CONFIG_PAX_REFCOUNT
9027 + "jno 0f\n"
9028 + LOCK_PREFIX " addl $1,(%0)\n"
9029 + "int $4\n0:\n"
9030 + _ASM_EXTABLE(0b, 0b)
9031 +#endif
9032 +
9033 "jns 1f\n"
9034 "call __read_lock_failed\n\t"
9035 "1:\n"
9036 @@ -258,6 +266,14 @@ static inline void arch_read_lock(arch_r
9037 static inline void arch_write_lock(arch_rwlock_t *rw)
9038 {
9039 asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
9040 +
9041 +#ifdef CONFIG_PAX_REFCOUNT
9042 + "jno 0f\n"
9043 + LOCK_PREFIX " addl %1,(%0)\n"
9044 + "int $4\n0:\n"
9045 + _ASM_EXTABLE(0b, 0b)
9046 +#endif
9047 +
9048 "jz 1f\n"
9049 "call __write_lock_failed\n\t"
9050 "1:\n"
9051 @@ -286,12 +302,29 @@ static inline int arch_write_trylock(arc
9052
9053 static inline void arch_read_unlock(arch_rwlock_t *rw)
9054 {
9055 - asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
9056 + asm volatile(LOCK_PREFIX "incl %0\n"
9057 +
9058 +#ifdef CONFIG_PAX_REFCOUNT
9059 + "jno 0f\n"
9060 + LOCK_PREFIX "decl %0\n"
9061 + "int $4\n0:\n"
9062 + _ASM_EXTABLE(0b, 0b)
9063 +#endif
9064 +
9065 + :"+m" (rw->lock) : : "memory");
9066 }
9067
9068 static inline void arch_write_unlock(arch_rwlock_t *rw)
9069 {
9070 - asm volatile(LOCK_PREFIX "addl %1, %0"
9071 + asm volatile(LOCK_PREFIX "addl %1, %0\n"
9072 +
9073 +#ifdef CONFIG_PAX_REFCOUNT
9074 + "jno 0f\n"
9075 + LOCK_PREFIX "subl %1, %0\n"
9076 + "int $4\n0:\n"
9077 + _ASM_EXTABLE(0b, 0b)
9078 +#endif
9079 +
9080 : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
9081 }
9082
9083 diff -urNp linux-3.0.8/arch/x86/include/asm/stackprotector.h linux-3.0.8/arch/x86/include/asm/stackprotector.h
9084 --- linux-3.0.8/arch/x86/include/asm/stackprotector.h 2011-07-21 22:17:23.000000000 -0400
9085 +++ linux-3.0.8/arch/x86/include/asm/stackprotector.h 2011-08-23 21:47:55.000000000 -0400
9086 @@ -48,7 +48,7 @@
9087 * head_32 for boot CPU and setup_per_cpu_areas() for others.
9088 */
9089 #define GDT_STACK_CANARY_INIT \
9090 - [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18),
9091 + [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x17),
9092
9093 /*
9094 * Initialize the stackprotector canary value.
9095 @@ -113,7 +113,7 @@ static inline void setup_stack_canary_se
9096
9097 static inline void load_stack_canary_segment(void)
9098 {
9099 -#ifdef CONFIG_X86_32
9100 +#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
9101 asm volatile ("mov %0, %%gs" : : "r" (0));
9102 #endif
9103 }
9104 diff -urNp linux-3.0.8/arch/x86/include/asm/stacktrace.h linux-3.0.8/arch/x86/include/asm/stacktrace.h
9105 --- linux-3.0.8/arch/x86/include/asm/stacktrace.h 2011-07-21 22:17:23.000000000 -0400
9106 +++ linux-3.0.8/arch/x86/include/asm/stacktrace.h 2011-08-23 21:47:55.000000000 -0400
9107 @@ -11,28 +11,20 @@
9108
9109 extern int kstack_depth_to_print;
9110
9111 -struct thread_info;
9112 +struct task_struct;
9113 struct stacktrace_ops;
9114
9115 -typedef unsigned long (*walk_stack_t)(struct thread_info *tinfo,
9116 - unsigned long *stack,
9117 - unsigned long bp,
9118 - const struct stacktrace_ops *ops,
9119 - void *data,
9120 - unsigned long *end,
9121 - int *graph);
9122 -
9123 -extern unsigned long
9124 -print_context_stack(struct thread_info *tinfo,
9125 - unsigned long *stack, unsigned long bp,
9126 - const struct stacktrace_ops *ops, void *data,
9127 - unsigned long *end, int *graph);
9128 -
9129 -extern unsigned long
9130 -print_context_stack_bp(struct thread_info *tinfo,
9131 - unsigned long *stack, unsigned long bp,
9132 - const struct stacktrace_ops *ops, void *data,
9133 - unsigned long *end, int *graph);
9134 +typedef unsigned long walk_stack_t(struct task_struct *task,
9135 + void *stack_start,
9136 + unsigned long *stack,
9137 + unsigned long bp,
9138 + const struct stacktrace_ops *ops,
9139 + void *data,
9140 + unsigned long *end,
9141 + int *graph);
9142 +
9143 +extern walk_stack_t print_context_stack;
9144 +extern walk_stack_t print_context_stack_bp;
9145
9146 /* Generic stack tracer with callbacks */
9147
9148 @@ -40,7 +32,7 @@ struct stacktrace_ops {
9149 void (*address)(void *data, unsigned long address, int reliable);
9150 /* On negative return stop dumping */
9151 int (*stack)(void *data, char *name);
9152 - walk_stack_t walk_stack;
9153 + walk_stack_t *walk_stack;
9154 };
9155
9156 void dump_trace(struct task_struct *tsk, struct pt_regs *regs,
9157 diff -urNp linux-3.0.8/arch/x86/include/asm/sys_ia32.h linux-3.0.8/arch/x86/include/asm/sys_ia32.h
9158 --- linux-3.0.8/arch/x86/include/asm/sys_ia32.h 2011-07-21 22:17:23.000000000 -0400
9159 +++ linux-3.0.8/arch/x86/include/asm/sys_ia32.h 2011-10-06 04:17:55.000000000 -0400
9160 @@ -40,7 +40,7 @@ asmlinkage long sys32_rt_sigprocmask(int
9161 compat_sigset_t __user *, unsigned int);
9162 asmlinkage long sys32_alarm(unsigned int);
9163
9164 -asmlinkage long sys32_waitpid(compat_pid_t, unsigned int *, int);
9165 +asmlinkage long sys32_waitpid(compat_pid_t, unsigned int __user *, int);
9166 asmlinkage long sys32_sysfs(int, u32, u32);
9167
9168 asmlinkage long sys32_sched_rr_get_interval(compat_pid_t,
9169 diff -urNp linux-3.0.8/arch/x86/include/asm/system.h linux-3.0.8/arch/x86/include/asm/system.h
9170 --- linux-3.0.8/arch/x86/include/asm/system.h 2011-07-21 22:17:23.000000000 -0400
9171 +++ linux-3.0.8/arch/x86/include/asm/system.h 2011-08-23 21:47:55.000000000 -0400
9172 @@ -129,7 +129,7 @@ do { \
9173 "call __switch_to\n\t" \
9174 "movq "__percpu_arg([current_task])",%%rsi\n\t" \
9175 __switch_canary \
9176 - "movq %P[thread_info](%%rsi),%%r8\n\t" \
9177 + "movq "__percpu_arg([thread_info])",%%r8\n\t" \
9178 "movq %%rax,%%rdi\n\t" \
9179 "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
9180 "jnz ret_from_fork\n\t" \
9181 @@ -140,7 +140,7 @@ do { \
9182 [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
9183 [ti_flags] "i" (offsetof(struct thread_info, flags)), \
9184 [_tif_fork] "i" (_TIF_FORK), \
9185 - [thread_info] "i" (offsetof(struct task_struct, stack)), \
9186 + [thread_info] "m" (current_tinfo), \
9187 [current_task] "m" (current_task) \
9188 __switch_canary_iparam \
9189 : "memory", "cc" __EXTRA_CLOBBER)
9190 @@ -200,7 +200,7 @@ static inline unsigned long get_limit(un
9191 {
9192 unsigned long __limit;
9193 asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
9194 - return __limit + 1;
9195 + return __limit;
9196 }
9197
9198 static inline void native_clts(void)
9199 @@ -397,12 +397,12 @@ void enable_hlt(void);
9200
9201 void cpu_idle_wait(void);
9202
9203 -extern unsigned long arch_align_stack(unsigned long sp);
9204 +#define arch_align_stack(x) ((x) & ~0xfUL)
9205 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
9206
9207 void default_idle(void);
9208
9209 -void stop_this_cpu(void *dummy);
9210 +void stop_this_cpu(void *dummy) __noreturn;
9211
9212 /*
9213 * Force strict CPU ordering.
9214 diff -urNp linux-3.0.8/arch/x86/include/asm/thread_info.h linux-3.0.8/arch/x86/include/asm/thread_info.h
9215 --- linux-3.0.8/arch/x86/include/asm/thread_info.h 2011-07-21 22:17:23.000000000 -0400
9216 +++ linux-3.0.8/arch/x86/include/asm/thread_info.h 2011-08-23 21:47:55.000000000 -0400
9217 @@ -10,6 +10,7 @@
9218 #include <linux/compiler.h>
9219 #include <asm/page.h>
9220 #include <asm/types.h>
9221 +#include <asm/percpu.h>
9222
9223 /*
9224 * low level task data that entry.S needs immediate access to
9225 @@ -24,7 +25,6 @@ struct exec_domain;
9226 #include <asm/atomic.h>
9227
9228 struct thread_info {
9229 - struct task_struct *task; /* main task structure */
9230 struct exec_domain *exec_domain; /* execution domain */
9231 __u32 flags; /* low level flags */
9232 __u32 status; /* thread synchronous flags */
9233 @@ -34,18 +34,12 @@ struct thread_info {
9234 mm_segment_t addr_limit;
9235 struct restart_block restart_block;
9236 void __user *sysenter_return;
9237 -#ifdef CONFIG_X86_32
9238 - unsigned long previous_esp; /* ESP of the previous stack in
9239 - case of nested (IRQ) stacks
9240 - */
9241 - __u8 supervisor_stack[0];
9242 -#endif
9243 + unsigned long lowest_stack;
9244 int uaccess_err;
9245 };
9246
9247 -#define INIT_THREAD_INFO(tsk) \
9248 +#define INIT_THREAD_INFO \
9249 { \
9250 - .task = &tsk, \
9251 .exec_domain = &default_exec_domain, \
9252 .flags = 0, \
9253 .cpu = 0, \
9254 @@ -56,7 +50,7 @@ struct thread_info {
9255 }, \
9256 }
9257
9258 -#define init_thread_info (init_thread_union.thread_info)
9259 +#define init_thread_info (init_thread_union.stack)
9260 #define init_stack (init_thread_union.stack)
9261
9262 #else /* !__ASSEMBLY__ */
9263 @@ -170,6 +164,23 @@ struct thread_info {
9264 ret; \
9265 })
9266
9267 +#ifdef __ASSEMBLY__
9268 +/* how to get the thread information struct from ASM */
9269 +#define GET_THREAD_INFO(reg) \
9270 + mov PER_CPU_VAR(current_tinfo), reg
9271 +
9272 +/* use this one if reg already contains %esp */
9273 +#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
9274 +#else
9275 +/* how to get the thread information struct from C */
9276 +DECLARE_PER_CPU(struct thread_info *, current_tinfo);
9277 +
9278 +static __always_inline struct thread_info *current_thread_info(void)
9279 +{
9280 + return percpu_read_stable(current_tinfo);
9281 +}
9282 +#endif
9283 +
9284 #ifdef CONFIG_X86_32
9285
9286 #define STACK_WARN (THREAD_SIZE/8)
9287 @@ -180,35 +191,13 @@ struct thread_info {
9288 */
9289 #ifndef __ASSEMBLY__
9290
9291 -
9292 /* how to get the current stack pointer from C */
9293 register unsigned long current_stack_pointer asm("esp") __used;
9294
9295 -/* how to get the thread information struct from C */
9296 -static inline struct thread_info *current_thread_info(void)
9297 -{
9298 - return (struct thread_info *)
9299 - (current_stack_pointer & ~(THREAD_SIZE - 1));
9300 -}
9301 -
9302 -#else /* !__ASSEMBLY__ */
9303 -
9304 -/* how to get the thread information struct from ASM */
9305 -#define GET_THREAD_INFO(reg) \
9306 - movl $-THREAD_SIZE, reg; \
9307 - andl %esp, reg
9308 -
9309 -/* use this one if reg already contains %esp */
9310 -#define GET_THREAD_INFO_WITH_ESP(reg) \
9311 - andl $-THREAD_SIZE, reg
9312 -
9313 #endif
9314
9315 #else /* X86_32 */
9316
9317 -#include <asm/percpu.h>
9318 -#define KERNEL_STACK_OFFSET (5*8)
9319 -
9320 /*
9321 * macros/functions for gaining access to the thread information structure
9322 * preempt_count needs to be 1 initially, until the scheduler is functional.
9323 @@ -216,21 +205,8 @@ static inline struct thread_info *curren
9324 #ifndef __ASSEMBLY__
9325 DECLARE_PER_CPU(unsigned long, kernel_stack);
9326
9327 -static inline struct thread_info *current_thread_info(void)
9328 -{
9329 - struct thread_info *ti;
9330 - ti = (void *)(percpu_read_stable(kernel_stack) +
9331 - KERNEL_STACK_OFFSET - THREAD_SIZE);
9332 - return ti;
9333 -}
9334 -
9335 -#else /* !__ASSEMBLY__ */
9336 -
9337 -/* how to get the thread information struct from ASM */
9338 -#define GET_THREAD_INFO(reg) \
9339 - movq PER_CPU_VAR(kernel_stack),reg ; \
9340 - subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
9341 -
9342 +/* how to get the current stack pointer from C */
9343 +register unsigned long current_stack_pointer asm("rsp") __used;
9344 #endif
9345
9346 #endif /* !X86_32 */
9347 @@ -266,5 +242,16 @@ extern void arch_task_cache_init(void);
9348 extern void free_thread_info(struct thread_info *ti);
9349 extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
9350 #define arch_task_cache_init arch_task_cache_init
9351 +
9352 +#define __HAVE_THREAD_FUNCTIONS
9353 +#define task_thread_info(task) (&(task)->tinfo)
9354 +#define task_stack_page(task) ((task)->stack)
9355 +#define setup_thread_stack(p, org) do {} while (0)
9356 +#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
9357 +
9358 +#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
9359 +extern struct task_struct *alloc_task_struct_node(int node);
9360 +extern void free_task_struct(struct task_struct *);
9361 +
9362 #endif
9363 #endif /* _ASM_X86_THREAD_INFO_H */
9364 diff -urNp linux-3.0.8/arch/x86/include/asm/uaccess_32.h linux-3.0.8/arch/x86/include/asm/uaccess_32.h
9365 --- linux-3.0.8/arch/x86/include/asm/uaccess_32.h 2011-07-21 22:17:23.000000000 -0400
9366 +++ linux-3.0.8/arch/x86/include/asm/uaccess_32.h 2011-08-23 21:48:14.000000000 -0400
9367 @@ -43,6 +43,11 @@ unsigned long __must_check __copy_from_u
9368 static __always_inline unsigned long __must_check
9369 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
9370 {
9371 + pax_track_stack();
9372 +
9373 + if ((long)n < 0)
9374 + return n;
9375 +
9376 if (__builtin_constant_p(n)) {
9377 unsigned long ret;
9378
9379 @@ -61,6 +66,8 @@ __copy_to_user_inatomic(void __user *to,
9380 return ret;
9381 }
9382 }
9383 + if (!__builtin_constant_p(n))
9384 + check_object_size(from, n, true);
9385 return __copy_to_user_ll(to, from, n);
9386 }
9387
9388 @@ -82,12 +89,16 @@ static __always_inline unsigned long __m
9389 __copy_to_user(void __user *to, const void *from, unsigned long n)
9390 {
9391 might_fault();
9392 +
9393 return __copy_to_user_inatomic(to, from, n);
9394 }
9395
9396 static __always_inline unsigned long
9397 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
9398 {
9399 + if ((long)n < 0)
9400 + return n;
9401 +
9402 /* Avoid zeroing the tail if the copy fails..
9403 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
9404 * but as the zeroing behaviour is only significant when n is not
9405 @@ -137,6 +148,12 @@ static __always_inline unsigned long
9406 __copy_from_user(void *to, const void __user *from, unsigned long n)
9407 {
9408 might_fault();
9409 +
9410 + pax_track_stack();
9411 +
9412 + if ((long)n < 0)
9413 + return n;
9414 +
9415 if (__builtin_constant_p(n)) {
9416 unsigned long ret;
9417
9418 @@ -152,6 +169,8 @@ __copy_from_user(void *to, const void __
9419 return ret;
9420 }
9421 }
9422 + if (!__builtin_constant_p(n))
9423 + check_object_size(to, n, false);
9424 return __copy_from_user_ll(to, from, n);
9425 }
9426
9427 @@ -159,6 +178,10 @@ static __always_inline unsigned long __c
9428 const void __user *from, unsigned long n)
9429 {
9430 might_fault();
9431 +
9432 + if ((long)n < 0)
9433 + return n;
9434 +
9435 if (__builtin_constant_p(n)) {
9436 unsigned long ret;
9437
9438 @@ -181,15 +204,19 @@ static __always_inline unsigned long
9439 __copy_from_user_inatomic_nocache(void *to, const void __user *from,
9440 unsigned long n)
9441 {
9442 - return __copy_from_user_ll_nocache_nozero(to, from, n);
9443 -}
9444 + if ((long)n < 0)
9445 + return n;
9446
9447 -unsigned long __must_check copy_to_user(void __user *to,
9448 - const void *from, unsigned long n);
9449 -unsigned long __must_check _copy_from_user(void *to,
9450 - const void __user *from,
9451 - unsigned long n);
9452 + return __copy_from_user_ll_nocache_nozero(to, from, n);
9453 +}
9454
9455 +extern void copy_to_user_overflow(void)
9456 +#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
9457 + __compiletime_error("copy_to_user() buffer size is not provably correct")
9458 +#else
9459 + __compiletime_warning("copy_to_user() buffer size is not provably correct")
9460 +#endif
9461 +;
9462
9463 extern void copy_from_user_overflow(void)
9464 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
9465 @@ -199,17 +226,61 @@ extern void copy_from_user_overflow(void
9466 #endif
9467 ;
9468
9469 -static inline unsigned long __must_check copy_from_user(void *to,
9470 - const void __user *from,
9471 - unsigned long n)
9472 +/**
9473 + * copy_to_user: - Copy a block of data into user space.
9474 + * @to: Destination address, in user space.
9475 + * @from: Source address, in kernel space.
9476 + * @n: Number of bytes to copy.
9477 + *
9478 + * Context: User context only. This function may sleep.
9479 + *
9480 + * Copy data from kernel space to user space.
9481 + *
9482 + * Returns number of bytes that could not be copied.
9483 + * On success, this will be zero.
9484 + */
9485 +static inline unsigned long __must_check
9486 +copy_to_user(void __user *to, const void *from, unsigned long n)
9487 +{
9488 + int sz = __compiletime_object_size(from);
9489 +
9490 + if (unlikely(sz != -1 && sz < n))
9491 + copy_to_user_overflow();
9492 + else if (access_ok(VERIFY_WRITE, to, n))
9493 + n = __copy_to_user(to, from, n);
9494 + return n;
9495 +}
9496 +
9497 +/**
9498 + * copy_from_user: - Copy a block of data from user space.
9499 + * @to: Destination address, in kernel space.
9500 + * @from: Source address, in user space.
9501 + * @n: Number of bytes to copy.
9502 + *
9503 + * Context: User context only. This function may sleep.
9504 + *
9505 + * Copy data from user space to kernel space.
9506 + *
9507 + * Returns number of bytes that could not be copied.
9508 + * On success, this will be zero.
9509 + *
9510 + * If some data could not be copied, this function will pad the copied
9511 + * data to the requested size using zero bytes.
9512 + */
9513 +static inline unsigned long __must_check
9514 +copy_from_user(void *to, const void __user *from, unsigned long n)
9515 {
9516 int sz = __compiletime_object_size(to);
9517
9518 - if (likely(sz == -1 || sz >= n))
9519 - n = _copy_from_user(to, from, n);
9520 - else
9521 + if (unlikely(sz != -1 && sz < n))
9522 copy_from_user_overflow();
9523 -
9524 + else if (access_ok(VERIFY_READ, from, n))
9525 + n = __copy_from_user(to, from, n);
9526 + else if ((long)n > 0) {
9527 + if (!__builtin_constant_p(n))
9528 + check_object_size(to, n, false);
9529 + memset(to, 0, n);
9530 + }
9531 return n;
9532 }
9533
9534 diff -urNp linux-3.0.8/arch/x86/include/asm/uaccess_64.h linux-3.0.8/arch/x86/include/asm/uaccess_64.h
9535 --- linux-3.0.8/arch/x86/include/asm/uaccess_64.h 2011-07-21 22:17:23.000000000 -0400
9536 +++ linux-3.0.8/arch/x86/include/asm/uaccess_64.h 2011-10-06 04:17:55.000000000 -0400
9537 @@ -10,6 +10,9 @@
9538 #include <asm/alternative.h>
9539 #include <asm/cpufeature.h>
9540 #include <asm/page.h>
9541 +#include <asm/pgtable.h>
9542 +
9543 +#define set_fs(x) (current_thread_info()->addr_limit = (x))
9544
9545 /*
9546 * Copy To/From Userspace
9547 @@ -36,26 +39,26 @@ copy_user_generic(void *to, const void *
9548 return ret;
9549 }
9550
9551 -__must_check unsigned long
9552 -_copy_to_user(void __user *to, const void *from, unsigned len);
9553 -__must_check unsigned long
9554 -_copy_from_user(void *to, const void __user *from, unsigned len);
9555 +static __always_inline __must_check unsigned long
9556 +__copy_to_user(void __user *to, const void *from, unsigned len);
9557 +static __always_inline __must_check unsigned long
9558 +__copy_from_user(void *to, const void __user *from, unsigned len);
9559 __must_check unsigned long
9560 copy_in_user(void __user *to, const void __user *from, unsigned len);
9561
9562 static inline unsigned long __must_check copy_from_user(void *to,
9563 const void __user *from,
9564 - unsigned long n)
9565 + unsigned n)
9566 {
9567 - int sz = __compiletime_object_size(to);
9568 -
9569 might_fault();
9570 - if (likely(sz == -1 || sz >= n))
9571 - n = _copy_from_user(to, from, n);
9572 -#ifdef CONFIG_DEBUG_VM
9573 - else
9574 - WARN(1, "Buffer overflow detected!\n");
9575 -#endif
9576 +
9577 + if (access_ok(VERIFY_READ, from, n))
9578 + n = __copy_from_user(to, from, n);
9579 + else if ((int)n > 0) {
9580 + if (!__builtin_constant_p(n))
9581 + check_object_size(to, n, false);
9582 + memset(to, 0, n);
9583 + }
9584 return n;
9585 }
9586
9587 @@ -64,110 +67,198 @@ int copy_to_user(void __user *dst, const
9588 {
9589 might_fault();
9590
9591 - return _copy_to_user(dst, src, size);
9592 + if (access_ok(VERIFY_WRITE, dst, size))
9593 + size = __copy_to_user(dst, src, size);
9594 + return size;
9595 }
9596
9597 static __always_inline __must_check
9598 -int __copy_from_user(void *dst, const void __user *src, unsigned size)
9599 +unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
9600 {
9601 - int ret = 0;
9602 + int sz = __compiletime_object_size(dst);
9603 + unsigned ret = 0;
9604
9605 might_fault();
9606 - if (!__builtin_constant_p(size))
9607 - return copy_user_generic(dst, (__force void *)src, size);
9608 +
9609 + pax_track_stack();
9610 +
9611 + if ((int)size < 0)
9612 + return size;
9613 +
9614 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9615 + if (!__access_ok(VERIFY_READ, src, size))
9616 + return size;
9617 +#endif
9618 +
9619 + if (unlikely(sz != -1 && sz < size)) {
9620 +#ifdef CONFIG_DEBUG_VM
9621 + WARN(1, "Buffer overflow detected!\n");
9622 +#endif
9623 + return size;
9624 + }
9625 +
9626 + if (!__builtin_constant_p(size)) {
9627 + check_object_size(dst, size, false);
9628 +
9629 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9630 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
9631 + src += PAX_USER_SHADOW_BASE;
9632 +#endif
9633 +
9634 + return copy_user_generic(dst, (__force_kernel const void *)src, size);
9635 + }
9636 switch (size) {
9637 - case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
9638 + case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
9639 ret, "b", "b", "=q", 1);
9640 return ret;
9641 - case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
9642 + case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
9643 ret, "w", "w", "=r", 2);
9644 return ret;
9645 - case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
9646 + case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
9647 ret, "l", "k", "=r", 4);
9648 return ret;
9649 - case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
9650 + case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
9651 ret, "q", "", "=r", 8);
9652 return ret;
9653 case 10:
9654 - __get_user_asm(*(u64 *)dst, (u64 __user *)src,
9655 + __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
9656 ret, "q", "", "=r", 10);
9657 if (unlikely(ret))
9658 return ret;
9659 __get_user_asm(*(u16 *)(8 + (char *)dst),
9660 - (u16 __user *)(8 + (char __user *)src),
9661 + (const u16 __user *)(8 + (const char __user *)src),
9662 ret, "w", "w", "=r", 2);
9663 return ret;
9664 case 16:
9665 - __get_user_asm(*(u64 *)dst, (u64 __user *)src,
9666 + __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
9667 ret, "q", "", "=r", 16);
9668 if (unlikely(ret))
9669 return ret;
9670 __get_user_asm(*(u64 *)(8 + (char *)dst),
9671 - (u64 __user *)(8 + (char __user *)src),
9672 + (const u64 __user *)(8 + (const char __user *)src),
9673 ret, "q", "", "=r", 8);
9674 return ret;
9675 default:
9676 - return copy_user_generic(dst, (__force void *)src, size);
9677 +
9678 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9679 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
9680 + src += PAX_USER_SHADOW_BASE;
9681 +#endif
9682 +
9683 + return copy_user_generic(dst, (__force_kernel const void *)src, size);
9684 }
9685 }
9686
9687 static __always_inline __must_check
9688 -int __copy_to_user(void __user *dst, const void *src, unsigned size)
9689 +unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
9690 {
9691 - int ret = 0;
9692 + int sz = __compiletime_object_size(src);
9693 + unsigned ret = 0;
9694
9695 might_fault();
9696 - if (!__builtin_constant_p(size))
9697 - return copy_user_generic((__force void *)dst, src, size);
9698 +
9699 + pax_track_stack();
9700 +
9701 + if ((int)size < 0)
9702 + return size;
9703 +
9704 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9705 + if (!__access_ok(VERIFY_WRITE, dst, size))
9706 + return size;
9707 +#endif
9708 +
9709 + if (unlikely(sz != -1 && sz < size)) {
9710 +#ifdef CONFIG_DEBUG_VM
9711 + WARN(1, "Buffer overflow detected!\n");
9712 +#endif
9713 + return size;
9714 + }
9715 +
9716 + if (!__builtin_constant_p(size)) {
9717 + check_object_size(src, size, true);
9718 +
9719 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9720 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
9721 + dst += PAX_USER_SHADOW_BASE;
9722 +#endif
9723 +
9724 + return copy_user_generic((__force_kernel void *)dst, src, size);
9725 + }
9726 switch (size) {
9727 - case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
9728 + case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
9729 ret, "b", "b", "iq", 1);
9730 return ret;
9731 - case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
9732 + case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
9733 ret, "w", "w", "ir", 2);
9734 return ret;
9735 - case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
9736 + case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
9737 ret, "l", "k", "ir", 4);
9738 return ret;
9739 - case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
9740 + case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
9741 ret, "q", "", "er", 8);
9742 return ret;
9743 case 10:
9744 - __put_user_asm(*(u64 *)src, (u64 __user *)dst,
9745 + __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
9746 ret, "q", "", "er", 10);
9747 if (unlikely(ret))
9748 return ret;
9749 asm("":::"memory");
9750 - __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
9751 + __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
9752 ret, "w", "w", "ir", 2);
9753 return ret;
9754 case 16:
9755 - __put_user_asm(*(u64 *)src, (u64 __user *)dst,
9756 + __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
9757 ret, "q", "", "er", 16);
9758 if (unlikely(ret))
9759 return ret;
9760 asm("":::"memory");
9761 - __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
9762 + __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
9763 ret, "q", "", "er", 8);
9764 return ret;
9765 default:
9766 - return copy_user_generic((__force void *)dst, src, size);
9767 +
9768 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9769 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
9770 + dst += PAX_USER_SHADOW_BASE;
9771 +#endif
9772 +
9773 + return copy_user_generic((__force_kernel void *)dst, src, size);
9774 }
9775 }
9776
9777 static __always_inline __must_check
9778 -int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
9779 +unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
9780 {
9781 - int ret = 0;
9782 + unsigned ret = 0;
9783
9784 might_fault();
9785 - if (!__builtin_constant_p(size))
9786 - return copy_user_generic((__force void *)dst,
9787 - (__force void *)src, size);
9788 +
9789 + if ((int)size < 0)
9790 + return size;
9791 +
9792 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9793 + if (!__access_ok(VERIFY_READ, src, size))
9794 + return size;
9795 + if (!__access_ok(VERIFY_WRITE, dst, size))
9796 + return size;
9797 +#endif
9798 +
9799 + if (!__builtin_constant_p(size)) {
9800 +
9801 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9802 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
9803 + src += PAX_USER_SHADOW_BASE;
9804 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
9805 + dst += PAX_USER_SHADOW_BASE;
9806 +#endif
9807 +
9808 + return copy_user_generic((__force_kernel void *)dst,
9809 + (__force_kernel const void *)src, size);
9810 + }
9811 switch (size) {
9812 case 1: {
9813 u8 tmp;
9814 - __get_user_asm(tmp, (u8 __user *)src,
9815 + __get_user_asm(tmp, (const u8 __user *)src,
9816 ret, "b", "b", "=q", 1);
9817 if (likely(!ret))
9818 __put_user_asm(tmp, (u8 __user *)dst,
9819 @@ -176,7 +267,7 @@ int __copy_in_user(void __user *dst, con
9820 }
9821 case 2: {
9822 u16 tmp;
9823 - __get_user_asm(tmp, (u16 __user *)src,
9824 + __get_user_asm(tmp, (const u16 __user *)src,
9825 ret, "w", "w", "=r", 2);
9826 if (likely(!ret))
9827 __put_user_asm(tmp, (u16 __user *)dst,
9828 @@ -186,7 +277,7 @@ int __copy_in_user(void __user *dst, con
9829
9830 case 4: {
9831 u32 tmp;
9832 - __get_user_asm(tmp, (u32 __user *)src,
9833 + __get_user_asm(tmp, (const u32 __user *)src,
9834 ret, "l", "k", "=r", 4);
9835 if (likely(!ret))
9836 __put_user_asm(tmp, (u32 __user *)dst,
9837 @@ -195,7 +286,7 @@ int __copy_in_user(void __user *dst, con
9838 }
9839 case 8: {
9840 u64 tmp;
9841 - __get_user_asm(tmp, (u64 __user *)src,
9842 + __get_user_asm(tmp, (const u64 __user *)src,
9843 ret, "q", "", "=r", 8);
9844 if (likely(!ret))
9845 __put_user_asm(tmp, (u64 __user *)dst,
9846 @@ -203,8 +294,16 @@ int __copy_in_user(void __user *dst, con
9847 return ret;
9848 }
9849 default:
9850 - return copy_user_generic((__force void *)dst,
9851 - (__force void *)src, size);
9852 +
9853 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9854 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
9855 + src += PAX_USER_SHADOW_BASE;
9856 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
9857 + dst += PAX_USER_SHADOW_BASE;
9858 +#endif
9859 +
9860 + return copy_user_generic((__force_kernel void *)dst,
9861 + (__force_kernel const void *)src, size);
9862 }
9863 }
9864
9865 @@ -221,33 +320,72 @@ __must_check unsigned long __clear_user(
9866 static __must_check __always_inline int
9867 __copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
9868 {
9869 - return copy_user_generic(dst, (__force const void *)src, size);
9870 + pax_track_stack();
9871 +
9872 + if ((int)size < 0)
9873 + return size;
9874 +
9875 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9876 + if (!__access_ok(VERIFY_READ, src, size))
9877 + return size;
9878 +
9879 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
9880 + src += PAX_USER_SHADOW_BASE;
9881 +#endif
9882 +
9883 + return copy_user_generic(dst, (__force_kernel const void *)src, size);
9884 }
9885
9886 -static __must_check __always_inline int
9887 +static __must_check __always_inline unsigned long
9888 __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
9889 {
9890 - return copy_user_generic((__force void *)dst, src, size);
9891 + if ((int)size < 0)
9892 + return size;
9893 +
9894 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9895 + if (!__access_ok(VERIFY_WRITE, dst, size))
9896 + return size;
9897 +
9898 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
9899 + dst += PAX_USER_SHADOW_BASE;
9900 +#endif
9901 +
9902 + return copy_user_generic((__force_kernel void *)dst, src, size);
9903 }
9904
9905 -extern long __copy_user_nocache(void *dst, const void __user *src,
9906 +extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
9907 unsigned size, int zerorest);
9908
9909 -static inline int
9910 -__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
9911 +static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
9912 {
9913 might_sleep();
9914 +
9915 + if ((int)size < 0)
9916 + return size;
9917 +
9918 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9919 + if (!__access_ok(VERIFY_READ, src, size))
9920 + return size;
9921 +#endif
9922 +
9923 return __copy_user_nocache(dst, src, size, 1);
9924 }
9925
9926 -static inline int
9927 -__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
9928 +static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
9929 unsigned size)
9930 {
9931 + if ((int)size < 0)
9932 + return size;
9933 +
9934 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9935 + if (!__access_ok(VERIFY_READ, src, size))
9936 + return size;
9937 +#endif
9938 +
9939 return __copy_user_nocache(dst, src, size, 0);
9940 }
9941
9942 -unsigned long
9943 -copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
9944 +extern unsigned long
9945 +copy_user_handle_tail(char __user *to, char __user *from, unsigned len, unsigned zerorest);
9946
9947 #endif /* _ASM_X86_UACCESS_64_H */
9948 diff -urNp linux-3.0.8/arch/x86/include/asm/uaccess.h linux-3.0.8/arch/x86/include/asm/uaccess.h
9949 --- linux-3.0.8/arch/x86/include/asm/uaccess.h 2011-07-21 22:17:23.000000000 -0400
9950 +++ linux-3.0.8/arch/x86/include/asm/uaccess.h 2011-10-06 04:17:55.000000000 -0400
9951 @@ -7,12 +7,15 @@
9952 #include <linux/compiler.h>
9953 #include <linux/thread_info.h>
9954 #include <linux/string.h>
9955 +#include <linux/sched.h>
9956 #include <asm/asm.h>
9957 #include <asm/page.h>
9958
9959 #define VERIFY_READ 0
9960 #define VERIFY_WRITE 1
9961
9962 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
9963 +
9964 /*
9965 * The fs value determines whether argument validity checking should be
9966 * performed or not. If get_fs() == USER_DS, checking is performed, with
9967 @@ -28,7 +31,12 @@
9968
9969 #define get_ds() (KERNEL_DS)
9970 #define get_fs() (current_thread_info()->addr_limit)
9971 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
9972 +void __set_fs(mm_segment_t x);
9973 +void set_fs(mm_segment_t x);
9974 +#else
9975 #define set_fs(x) (current_thread_info()->addr_limit = (x))
9976 +#endif
9977
9978 #define segment_eq(a, b) ((a).seg == (b).seg)
9979
9980 @@ -76,7 +84,33 @@
9981 * checks that the pointer is in the user space range - after calling
9982 * this function, memory access functions may still return -EFAULT.
9983 */
9984 -#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
9985 +#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
9986 +#define access_ok(type, addr, size) \
9987 +({ \
9988 + long __size = size; \
9989 + unsigned long __addr = (unsigned long)addr; \
9990 + unsigned long __addr_ao = __addr & PAGE_MASK; \
9991 + unsigned long __end_ao = __addr + __size - 1; \
9992 + bool __ret_ao = __range_not_ok(__addr, __size) == 0; \
9993 + if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
9994 + while(__addr_ao <= __end_ao) { \
9995 + char __c_ao; \
9996 + __addr_ao += PAGE_SIZE; \
9997 + if (__size > PAGE_SIZE) \
9998 + cond_resched(); \
9999 + if (__get_user(__c_ao, (char __user *)__addr)) \
10000 + break; \
10001 + if (type != VERIFY_WRITE) { \
10002 + __addr = __addr_ao; \
10003 + continue; \
10004 + } \
10005 + if (__put_user(__c_ao, (char __user *)__addr)) \
10006 + break; \
10007 + __addr = __addr_ao; \
10008 + } \
10009 + } \
10010 + __ret_ao; \
10011 +})
10012
10013 /*
10014 * The exception table consists of pairs of addresses: the first is the
10015 @@ -182,12 +216,20 @@ extern int __get_user_bad(void);
10016 asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
10017 : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
10018
10019 -
10020 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
10021 +#define __copyuser_seg "gs;"
10022 +#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
10023 +#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
10024 +#else
10025 +#define __copyuser_seg
10026 +#define __COPYUSER_SET_ES
10027 +#define __COPYUSER_RESTORE_ES
10028 +#endif
10029
10030 #ifdef CONFIG_X86_32
10031 #define __put_user_asm_u64(x, addr, err, errret) \
10032 - asm volatile("1: movl %%eax,0(%2)\n" \
10033 - "2: movl %%edx,4(%2)\n" \
10034 + asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \
10035 + "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
10036 "3:\n" \
10037 ".section .fixup,\"ax\"\n" \
10038 "4: movl %3,%0\n" \
10039 @@ -199,8 +241,8 @@ extern int __get_user_bad(void);
10040 : "A" (x), "r" (addr), "i" (errret), "0" (err))
10041
10042 #define __put_user_asm_ex_u64(x, addr) \
10043 - asm volatile("1: movl %%eax,0(%1)\n" \
10044 - "2: movl %%edx,4(%1)\n" \
10045 + asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \
10046 + "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
10047 "3:\n" \
10048 _ASM_EXTABLE(1b, 2b - 1b) \
10049 _ASM_EXTABLE(2b, 3b - 2b) \
10050 @@ -252,7 +294,7 @@ extern void __put_user_8(void);
10051 __typeof__(*(ptr)) __pu_val; \
10052 __chk_user_ptr(ptr); \
10053 might_fault(); \
10054 - __pu_val = x; \
10055 + __pu_val = (x); \
10056 switch (sizeof(*(ptr))) { \
10057 case 1: \
10058 __put_user_x(1, __pu_val, ptr, __ret_pu); \
10059 @@ -373,7 +415,7 @@ do { \
10060 } while (0)
10061
10062 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
10063 - asm volatile("1: mov"itype" %2,%"rtype"1\n" \
10064 + asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
10065 "2:\n" \
10066 ".section .fixup,\"ax\"\n" \
10067 "3: mov %3,%0\n" \
10068 @@ -381,7 +423,7 @@ do { \
10069 " jmp 2b\n" \
10070 ".previous\n" \
10071 _ASM_EXTABLE(1b, 3b) \
10072 - : "=r" (err), ltype(x) \
10073 + : "=r" (err), ltype (x) \
10074 : "m" (__m(addr)), "i" (errret), "0" (err))
10075
10076 #define __get_user_size_ex(x, ptr, size) \
10077 @@ -406,7 +448,7 @@ do { \
10078 } while (0)
10079
10080 #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
10081 - asm volatile("1: mov"itype" %1,%"rtype"0\n" \
10082 + asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
10083 "2:\n" \
10084 _ASM_EXTABLE(1b, 2b - 1b) \
10085 : ltype(x) : "m" (__m(addr)))
10086 @@ -423,13 +465,24 @@ do { \
10087 int __gu_err; \
10088 unsigned long __gu_val; \
10089 __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
10090 - (x) = (__force __typeof__(*(ptr)))__gu_val; \
10091 + (x) = (__typeof__(*(ptr)))__gu_val; \
10092 __gu_err; \
10093 })
10094
10095 /* FIXME: this hack is definitely wrong -AK */
10096 struct __large_struct { unsigned long buf[100]; };
10097 -#define __m(x) (*(struct __large_struct __user *)(x))
10098 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10099 +#define ____m(x) \
10100 +({ \
10101 + unsigned long ____x = (unsigned long)(x); \
10102 + if (____x < PAX_USER_SHADOW_BASE) \
10103 + ____x += PAX_USER_SHADOW_BASE; \
10104 + (void __user *)____x; \
10105 +})
10106 +#else
10107 +#define ____m(x) (x)
10108 +#endif
10109 +#define __m(x) (*(struct __large_struct __user *)____m(x))
10110
10111 /*
10112 * Tell gcc we read from memory instead of writing: this is because
10113 @@ -437,7 +490,7 @@ struct __large_struct { unsigned long bu
10114 * aliasing issues.
10115 */
10116 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
10117 - asm volatile("1: mov"itype" %"rtype"1,%2\n" \
10118 + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
10119 "2:\n" \
10120 ".section .fixup,\"ax\"\n" \
10121 "3: mov %3,%0\n" \
10122 @@ -445,10 +498,10 @@ struct __large_struct { unsigned long bu
10123 ".previous\n" \
10124 _ASM_EXTABLE(1b, 3b) \
10125 : "=r"(err) \
10126 - : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
10127 + : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
10128
10129 #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
10130 - asm volatile("1: mov"itype" %"rtype"0,%1\n" \
10131 + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
10132 "2:\n" \
10133 _ASM_EXTABLE(1b, 2b - 1b) \
10134 : : ltype(x), "m" (__m(addr)))
10135 @@ -487,8 +540,12 @@ struct __large_struct { unsigned long bu
10136 * On error, the variable @x is set to zero.
10137 */
10138
10139 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10140 +#define __get_user(x, ptr) get_user((x), (ptr))
10141 +#else
10142 #define __get_user(x, ptr) \
10143 __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
10144 +#endif
10145
10146 /**
10147 * __put_user: - Write a simple value into user space, with less checking.
10148 @@ -510,8 +567,12 @@ struct __large_struct { unsigned long bu
10149 * Returns zero on success, or -EFAULT on error.
10150 */
10151
10152 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10153 +#define __put_user(x, ptr) put_user((x), (ptr))
10154 +#else
10155 #define __put_user(x, ptr) \
10156 __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
10157 +#endif
10158
10159 #define __get_user_unaligned __get_user
10160 #define __put_user_unaligned __put_user
10161 @@ -529,7 +590,7 @@ struct __large_struct { unsigned long bu
10162 #define get_user_ex(x, ptr) do { \
10163 unsigned long __gue_val; \
10164 __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
10165 - (x) = (__force __typeof__(*(ptr)))__gue_val; \
10166 + (x) = (__typeof__(*(ptr)))__gue_val; \
10167 } while (0)
10168
10169 #ifdef CONFIG_X86_WP_WORKS_OK
10170 diff -urNp linux-3.0.8/arch/x86/include/asm/vdso.h linux-3.0.8/arch/x86/include/asm/vdso.h
10171 --- linux-3.0.8/arch/x86/include/asm/vdso.h 2011-07-21 22:17:23.000000000 -0400
10172 +++ linux-3.0.8/arch/x86/include/asm/vdso.h 2011-10-06 04:17:55.000000000 -0400
10173 @@ -11,7 +11,7 @@ extern const char VDSO32_PRELINK[];
10174 #define VDSO32_SYMBOL(base, name) \
10175 ({ \
10176 extern const char VDSO32_##name[]; \
10177 - (void *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
10178 + (void __user *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
10179 })
10180 #endif
10181
10182 diff -urNp linux-3.0.8/arch/x86/include/asm/x86_init.h linux-3.0.8/arch/x86/include/asm/x86_init.h
10183 --- linux-3.0.8/arch/x86/include/asm/x86_init.h 2011-07-21 22:17:23.000000000 -0400
10184 +++ linux-3.0.8/arch/x86/include/asm/x86_init.h 2011-08-23 21:47:55.000000000 -0400
10185 @@ -28,7 +28,7 @@ struct x86_init_mpparse {
10186 void (*mpc_oem_bus_info)(struct mpc_bus *m, char *name);
10187 void (*find_smp_config)(void);
10188 void (*get_smp_config)(unsigned int early);
10189 -};
10190 +} __no_const;
10191
10192 /**
10193 * struct x86_init_resources - platform specific resource related ops
10194 @@ -42,7 +42,7 @@ struct x86_init_resources {
10195 void (*probe_roms)(void);
10196 void (*reserve_resources)(void);
10197 char *(*memory_setup)(void);
10198 -};
10199 +} __no_const;
10200
10201 /**
10202 * struct x86_init_irqs - platform specific interrupt setup
10203 @@ -55,7 +55,7 @@ struct x86_init_irqs {
10204 void (*pre_vector_init)(void);
10205 void (*intr_init)(void);
10206 void (*trap_init)(void);
10207 -};
10208 +} __no_const;
10209
10210 /**
10211 * struct x86_init_oem - oem platform specific customizing functions
10212 @@ -65,7 +65,7 @@ struct x86_init_irqs {
10213 struct x86_init_oem {
10214 void (*arch_setup)(void);
10215 void (*banner)(void);
10216 -};
10217 +} __no_const;
10218
10219 /**
10220 * struct x86_init_mapping - platform specific initial kernel pagetable setup
10221 @@ -76,7 +76,7 @@ struct x86_init_oem {
10222 */
10223 struct x86_init_mapping {
10224 void (*pagetable_reserve)(u64 start, u64 end);
10225 -};
10226 +} __no_const;
10227
10228 /**
10229 * struct x86_init_paging - platform specific paging functions
10230 @@ -86,7 +86,7 @@ struct x86_init_mapping {
10231 struct x86_init_paging {
10232 void (*pagetable_setup_start)(pgd_t *base);
10233 void (*pagetable_setup_done)(pgd_t *base);
10234 -};
10235 +} __no_const;
10236
10237 /**
10238 * struct x86_init_timers - platform specific timer setup
10239 @@ -101,7 +101,7 @@ struct x86_init_timers {
10240 void (*tsc_pre_init)(void);
10241 void (*timer_init)(void);
10242 void (*wallclock_init)(void);
10243 -};
10244 +} __no_const;
10245
10246 /**
10247 * struct x86_init_iommu - platform specific iommu setup
10248 @@ -109,7 +109,7 @@ struct x86_init_timers {
10249 */
10250 struct x86_init_iommu {
10251 int (*iommu_init)(void);
10252 -};
10253 +} __no_const;
10254
10255 /**
10256 * struct x86_init_pci - platform specific pci init functions
10257 @@ -123,7 +123,7 @@ struct x86_init_pci {
10258 int (*init)(void);
10259 void (*init_irq)(void);
10260 void (*fixup_irqs)(void);
10261 -};
10262 +} __no_const;
10263
10264 /**
10265 * struct x86_init_ops - functions for platform specific setup
10266 @@ -139,7 +139,7 @@ struct x86_init_ops {
10267 struct x86_init_timers timers;
10268 struct x86_init_iommu iommu;
10269 struct x86_init_pci pci;
10270 -};
10271 +} __no_const;
10272
10273 /**
10274 * struct x86_cpuinit_ops - platform specific cpu hotplug setups
10275 @@ -147,7 +147,7 @@ struct x86_init_ops {
10276 */
10277 struct x86_cpuinit_ops {
10278 void (*setup_percpu_clockev)(void);
10279 -};
10280 +} __no_const;
10281
10282 /**
10283 * struct x86_platform_ops - platform specific runtime functions
10284 @@ -166,7 +166,7 @@ struct x86_platform_ops {
10285 bool (*is_untracked_pat_range)(u64 start, u64 end);
10286 void (*nmi_init)(void);
10287 int (*i8042_detect)(void);
10288 -};
10289 +} __no_const;
10290
10291 struct pci_dev;
10292
10293 @@ -174,7 +174,7 @@ struct x86_msi_ops {
10294 int (*setup_msi_irqs)(struct pci_dev *dev, int nvec, int type);
10295 void (*teardown_msi_irq)(unsigned int irq);
10296 void (*teardown_msi_irqs)(struct pci_dev *dev);
10297 -};
10298 +} __no_const;
10299
10300 extern struct x86_init_ops x86_init;
10301 extern struct x86_cpuinit_ops x86_cpuinit;
10302 diff -urNp linux-3.0.8/arch/x86/include/asm/xsave.h linux-3.0.8/arch/x86/include/asm/xsave.h
10303 --- linux-3.0.8/arch/x86/include/asm/xsave.h 2011-07-21 22:17:23.000000000 -0400
10304 +++ linux-3.0.8/arch/x86/include/asm/xsave.h 2011-10-06 04:17:55.000000000 -0400
10305 @@ -65,6 +65,11 @@ static inline int xsave_user(struct xsav
10306 {
10307 int err;
10308
10309 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10310 + if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
10311 + buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
10312 +#endif
10313 +
10314 /*
10315 * Clear the xsave header first, so that reserved fields are
10316 * initialized to zero.
10317 @@ -96,10 +101,15 @@ static inline int xsave_user(struct xsav
10318 static inline int xrestore_user(struct xsave_struct __user *buf, u64 mask)
10319 {
10320 int err;
10321 - struct xsave_struct *xstate = ((__force struct xsave_struct *)buf);
10322 + struct xsave_struct *xstate = ((__force_kernel struct xsave_struct *)buf);
10323 u32 lmask = mask;
10324 u32 hmask = mask >> 32;
10325
10326 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10327 + if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
10328 + xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
10329 +#endif
10330 +
10331 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
10332 "2:\n"
10333 ".section .fixup,\"ax\"\n"
10334 diff -urNp linux-3.0.8/arch/x86/Kconfig linux-3.0.8/arch/x86/Kconfig
10335 --- linux-3.0.8/arch/x86/Kconfig 2011-07-21 22:17:23.000000000 -0400
10336 +++ linux-3.0.8/arch/x86/Kconfig 2011-09-17 00:58:36.000000000 -0400
10337 @@ -229,7 +229,7 @@ config X86_HT
10338
10339 config X86_32_LAZY_GS
10340 def_bool y
10341 - depends on X86_32 && !CC_STACKPROTECTOR
10342 + depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
10343
10344 config ARCH_HWEIGHT_CFLAGS
10345 string
10346 @@ -1018,7 +1018,7 @@ choice
10347
10348 config NOHIGHMEM
10349 bool "off"
10350 - depends on !X86_NUMAQ
10351 + depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
10352 ---help---
10353 Linux can use up to 64 Gigabytes of physical memory on x86 systems.
10354 However, the address space of 32-bit x86 processors is only 4
10355 @@ -1055,7 +1055,7 @@ config NOHIGHMEM
10356
10357 config HIGHMEM4G
10358 bool "4GB"
10359 - depends on !X86_NUMAQ
10360 + depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
10361 ---help---
10362 Select this if you have a 32-bit processor and between 1 and 4
10363 gigabytes of physical RAM.
10364 @@ -1109,7 +1109,7 @@ config PAGE_OFFSET
10365 hex
10366 default 0xB0000000 if VMSPLIT_3G_OPT
10367 default 0x80000000 if VMSPLIT_2G
10368 - default 0x78000000 if VMSPLIT_2G_OPT
10369 + default 0x70000000 if VMSPLIT_2G_OPT
10370 default 0x40000000 if VMSPLIT_1G
10371 default 0xC0000000
10372 depends on X86_32
10373 @@ -1483,6 +1483,7 @@ config SECCOMP
10374
10375 config CC_STACKPROTECTOR
10376 bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
10377 + depends on X86_64 || !PAX_MEMORY_UDEREF
10378 ---help---
10379 This option turns on the -fstack-protector GCC feature. This
10380 feature puts, at the beginning of functions, a canary value on
10381 @@ -1540,6 +1541,7 @@ config KEXEC_JUMP
10382 config PHYSICAL_START
10383 hex "Physical address where the kernel is loaded" if (EXPERT || CRASH_DUMP)
10384 default "0x1000000"
10385 + range 0x400000 0x40000000
10386 ---help---
10387 This gives the physical address where the kernel is loaded.
10388
10389 @@ -1603,6 +1605,7 @@ config X86_NEED_RELOCS
10390 config PHYSICAL_ALIGN
10391 hex "Alignment value to which kernel should be aligned" if X86_32
10392 default "0x1000000"
10393 + range 0x400000 0x1000000 if PAX_KERNEXEC
10394 range 0x2000 0x1000000
10395 ---help---
10396 This value puts the alignment restrictions on physical address
10397 @@ -1634,9 +1637,10 @@ config HOTPLUG_CPU
10398 Say N if you want to disable CPU hotplug.
10399
10400 config COMPAT_VDSO
10401 - def_bool y
10402 + def_bool n
10403 prompt "Compat VDSO support"
10404 depends on X86_32 || IA32_EMULATION
10405 + depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
10406 ---help---
10407 Map the 32-bit VDSO to the predictable old-style address too.
10408
10409 diff -urNp linux-3.0.8/arch/x86/Kconfig.cpu linux-3.0.8/arch/x86/Kconfig.cpu
10410 --- linux-3.0.8/arch/x86/Kconfig.cpu 2011-07-21 22:17:23.000000000 -0400
10411 +++ linux-3.0.8/arch/x86/Kconfig.cpu 2011-08-23 21:47:55.000000000 -0400
10412 @@ -338,7 +338,7 @@ config X86_PPRO_FENCE
10413
10414 config X86_F00F_BUG
10415 def_bool y
10416 - depends on M586MMX || M586TSC || M586 || M486 || M386
10417 + depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
10418
10419 config X86_INVD_BUG
10420 def_bool y
10421 @@ -362,7 +362,7 @@ config X86_POPAD_OK
10422
10423 config X86_ALIGNMENT_16
10424 def_bool y
10425 - depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
10426 + depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
10427
10428 config X86_INTEL_USERCOPY
10429 def_bool y
10430 @@ -408,7 +408,7 @@ config X86_CMPXCHG64
10431 # generates cmov.
10432 config X86_CMOV
10433 def_bool y
10434 - depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
10435 + depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
10436
10437 config X86_MINIMUM_CPU_FAMILY
10438 int
10439 diff -urNp linux-3.0.8/arch/x86/Kconfig.debug linux-3.0.8/arch/x86/Kconfig.debug
10440 --- linux-3.0.8/arch/x86/Kconfig.debug 2011-07-21 22:17:23.000000000 -0400
10441 +++ linux-3.0.8/arch/x86/Kconfig.debug 2011-08-23 21:47:55.000000000 -0400
10442 @@ -81,7 +81,7 @@ config X86_PTDUMP
10443 config DEBUG_RODATA
10444 bool "Write protect kernel read-only data structures"
10445 default y
10446 - depends on DEBUG_KERNEL
10447 + depends on DEBUG_KERNEL && BROKEN
10448 ---help---
10449 Mark the kernel read-only data as write-protected in the pagetables,
10450 in order to catch accidental (and incorrect) writes to such const
10451 @@ -99,7 +99,7 @@ config DEBUG_RODATA_TEST
10452
10453 config DEBUG_SET_MODULE_RONX
10454 bool "Set loadable kernel module data as NX and text as RO"
10455 - depends on MODULES
10456 + depends on MODULES && BROKEN
10457 ---help---
10458 This option helps catch unintended modifications to loadable
10459 kernel module's text and read-only data. It also prevents execution
10460 diff -urNp linux-3.0.8/arch/x86/kernel/acpi/realmode/Makefile linux-3.0.8/arch/x86/kernel/acpi/realmode/Makefile
10461 --- linux-3.0.8/arch/x86/kernel/acpi/realmode/Makefile 2011-07-21 22:17:23.000000000 -0400
10462 +++ linux-3.0.8/arch/x86/kernel/acpi/realmode/Makefile 2011-08-23 21:47:55.000000000 -0400
10463 @@ -41,6 +41,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os
10464 $(call cc-option, -fno-stack-protector) \
10465 $(call cc-option, -mpreferred-stack-boundary=2)
10466 KBUILD_CFLAGS += $(call cc-option, -m32)
10467 +ifdef CONSTIFY_PLUGIN
10468 +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
10469 +endif
10470 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
10471 GCOV_PROFILE := n
10472
10473 diff -urNp linux-3.0.8/arch/x86/kernel/acpi/realmode/wakeup.S linux-3.0.8/arch/x86/kernel/acpi/realmode/wakeup.S
10474 --- linux-3.0.8/arch/x86/kernel/acpi/realmode/wakeup.S 2011-07-21 22:17:23.000000000 -0400
10475 +++ linux-3.0.8/arch/x86/kernel/acpi/realmode/wakeup.S 2011-08-23 21:48:14.000000000 -0400
10476 @@ -108,6 +108,9 @@ wakeup_code:
10477 /* Do any other stuff... */
10478
10479 #ifndef CONFIG_64BIT
10480 + /* Recheck NX bit overrides (64bit path does this in trampoline */
10481 + call verify_cpu
10482 +
10483 /* This could also be done in C code... */
10484 movl pmode_cr3, %eax
10485 movl %eax, %cr3
10486 @@ -131,6 +134,7 @@ wakeup_code:
10487 movl pmode_cr0, %eax
10488 movl %eax, %cr0
10489 jmp pmode_return
10490 +# include "../../verify_cpu.S"
10491 #else
10492 pushw $0
10493 pushw trampoline_segment
10494 diff -urNp linux-3.0.8/arch/x86/kernel/acpi/sleep.c linux-3.0.8/arch/x86/kernel/acpi/sleep.c
10495 --- linux-3.0.8/arch/x86/kernel/acpi/sleep.c 2011-07-21 22:17:23.000000000 -0400
10496 +++ linux-3.0.8/arch/x86/kernel/acpi/sleep.c 2011-08-23 21:47:55.000000000 -0400
10497 @@ -94,8 +94,12 @@ int acpi_suspend_lowlevel(void)
10498 header->trampoline_segment = trampoline_address() >> 4;
10499 #ifdef CONFIG_SMP
10500 stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
10501 +
10502 + pax_open_kernel();
10503 early_gdt_descr.address =
10504 (unsigned long)get_cpu_gdt_table(smp_processor_id());
10505 + pax_close_kernel();
10506 +
10507 initial_gs = per_cpu_offset(smp_processor_id());
10508 #endif
10509 initial_code = (unsigned long)wakeup_long64;
10510 diff -urNp linux-3.0.8/arch/x86/kernel/acpi/wakeup_32.S linux-3.0.8/arch/x86/kernel/acpi/wakeup_32.S
10511 --- linux-3.0.8/arch/x86/kernel/acpi/wakeup_32.S 2011-07-21 22:17:23.000000000 -0400
10512 +++ linux-3.0.8/arch/x86/kernel/acpi/wakeup_32.S 2011-08-23 21:47:55.000000000 -0400
10513 @@ -30,13 +30,11 @@ wakeup_pmode_return:
10514 # and restore the stack ... but you need gdt for this to work
10515 movl saved_context_esp, %esp
10516
10517 - movl %cs:saved_magic, %eax
10518 - cmpl $0x12345678, %eax
10519 + cmpl $0x12345678, saved_magic
10520 jne bogus_magic
10521
10522 # jump to place where we left off
10523 - movl saved_eip, %eax
10524 - jmp *%eax
10525 + jmp *(saved_eip)
10526
10527 bogus_magic:
10528 jmp bogus_magic
10529 diff -urNp linux-3.0.8/arch/x86/kernel/alternative.c linux-3.0.8/arch/x86/kernel/alternative.c
10530 --- linux-3.0.8/arch/x86/kernel/alternative.c 2011-07-21 22:17:23.000000000 -0400
10531 +++ linux-3.0.8/arch/x86/kernel/alternative.c 2011-08-23 21:47:55.000000000 -0400
10532 @@ -313,7 +313,7 @@ static void alternatives_smp_lock(const
10533 if (!*poff || ptr < text || ptr >= text_end)
10534 continue;
10535 /* turn DS segment override prefix into lock prefix */
10536 - if (*ptr == 0x3e)
10537 + if (*ktla_ktva(ptr) == 0x3e)
10538 text_poke(ptr, ((unsigned char []){0xf0}), 1);
10539 };
10540 mutex_unlock(&text_mutex);
10541 @@ -334,7 +334,7 @@ static void alternatives_smp_unlock(cons
10542 if (!*poff || ptr < text || ptr >= text_end)
10543 continue;
10544 /* turn lock prefix into DS segment override prefix */
10545 - if (*ptr == 0xf0)
10546 + if (*ktla_ktva(ptr) == 0xf0)
10547 text_poke(ptr, ((unsigned char []){0x3E}), 1);
10548 };
10549 mutex_unlock(&text_mutex);
10550 @@ -503,7 +503,7 @@ void __init_or_module apply_paravirt(str
10551
10552 BUG_ON(p->len > MAX_PATCH_LEN);
10553 /* prep the buffer with the original instructions */
10554 - memcpy(insnbuf, p->instr, p->len);
10555 + memcpy(insnbuf, ktla_ktva(p->instr), p->len);
10556 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
10557 (unsigned long)p->instr, p->len);
10558
10559 @@ -571,7 +571,7 @@ void __init alternative_instructions(voi
10560 if (smp_alt_once)
10561 free_init_pages("SMP alternatives",
10562 (unsigned long)__smp_locks,
10563 - (unsigned long)__smp_locks_end);
10564 + PAGE_ALIGN((unsigned long)__smp_locks_end));
10565
10566 restart_nmi();
10567 }
10568 @@ -588,13 +588,17 @@ void __init alternative_instructions(voi
10569 * instructions. And on the local CPU you need to be protected again NMI or MCE
10570 * handlers seeing an inconsistent instruction while you patch.
10571 */
10572 -void *__init_or_module text_poke_early(void *addr, const void *opcode,
10573 +void *__kprobes text_poke_early(void *addr, const void *opcode,
10574 size_t len)
10575 {
10576 unsigned long flags;
10577 local_irq_save(flags);
10578 - memcpy(addr, opcode, len);
10579 +
10580 + pax_open_kernel();
10581 + memcpy(ktla_ktva(addr), opcode, len);
10582 sync_core();
10583 + pax_close_kernel();
10584 +
10585 local_irq_restore(flags);
10586 /* Could also do a CLFLUSH here to speed up CPU recovery; but
10587 that causes hangs on some VIA CPUs. */
10588 @@ -616,36 +620,22 @@ void *__init_or_module text_poke_early(v
10589 */
10590 void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
10591 {
10592 - unsigned long flags;
10593 - char *vaddr;
10594 + unsigned char *vaddr = ktla_ktva(addr);
10595 struct page *pages[2];
10596 - int i;
10597 + size_t i;
10598
10599 if (!core_kernel_text((unsigned long)addr)) {
10600 - pages[0] = vmalloc_to_page(addr);
10601 - pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
10602 + pages[0] = vmalloc_to_page(vaddr);
10603 + pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
10604 } else {
10605 - pages[0] = virt_to_page(addr);
10606 + pages[0] = virt_to_page(vaddr);
10607 WARN_ON(!PageReserved(pages[0]));
10608 - pages[1] = virt_to_page(addr + PAGE_SIZE);
10609 + pages[1] = virt_to_page(vaddr + PAGE_SIZE);
10610 }
10611 BUG_ON(!pages[0]);
10612 - local_irq_save(flags);
10613 - set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
10614 - if (pages[1])
10615 - set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
10616 - vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
10617 - memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
10618 - clear_fixmap(FIX_TEXT_POKE0);
10619 - if (pages[1])
10620 - clear_fixmap(FIX_TEXT_POKE1);
10621 - local_flush_tlb();
10622 - sync_core();
10623 - /* Could also do a CLFLUSH here to speed up CPU recovery; but
10624 - that causes hangs on some VIA CPUs. */
10625 + text_poke_early(addr, opcode, len);
10626 for (i = 0; i < len; i++)
10627 - BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
10628 - local_irq_restore(flags);
10629 + BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
10630 return addr;
10631 }
10632
10633 diff -urNp linux-3.0.8/arch/x86/kernel/apic/apic.c linux-3.0.8/arch/x86/kernel/apic/apic.c
10634 --- linux-3.0.8/arch/x86/kernel/apic/apic.c 2011-07-21 22:17:23.000000000 -0400
10635 +++ linux-3.0.8/arch/x86/kernel/apic/apic.c 2011-08-23 21:48:14.000000000 -0400
10636 @@ -173,7 +173,7 @@ int first_system_vector = 0xfe;
10637 /*
10638 * Debug level, exported for io_apic.c
10639 */
10640 -unsigned int apic_verbosity;
10641 +int apic_verbosity;
10642
10643 int pic_mode;
10644
10645 @@ -1834,7 +1834,7 @@ void smp_error_interrupt(struct pt_regs
10646 apic_write(APIC_ESR, 0);
10647 v1 = apic_read(APIC_ESR);
10648 ack_APIC_irq();
10649 - atomic_inc(&irq_err_count);
10650 + atomic_inc_unchecked(&irq_err_count);
10651
10652 apic_printk(APIC_DEBUG, KERN_DEBUG "APIC error on CPU%d: %02x(%02x)",
10653 smp_processor_id(), v0 , v1);
10654 @@ -2190,6 +2190,8 @@ static int __cpuinit apic_cluster_num(vo
10655 u16 *bios_cpu_apicid;
10656 DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
10657
10658 + pax_track_stack();
10659 +
10660 bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
10661 bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
10662
10663 diff -urNp linux-3.0.8/arch/x86/kernel/apic/io_apic.c linux-3.0.8/arch/x86/kernel/apic/io_apic.c
10664 --- linux-3.0.8/arch/x86/kernel/apic/io_apic.c 2011-07-21 22:17:23.000000000 -0400
10665 +++ linux-3.0.8/arch/x86/kernel/apic/io_apic.c 2011-08-23 21:47:55.000000000 -0400
10666 @@ -1028,7 +1028,7 @@ int IO_APIC_get_PCI_irq_vector(int bus,
10667 }
10668 EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
10669
10670 -void lock_vector_lock(void)
10671 +void lock_vector_lock(void) __acquires(vector_lock)
10672 {
10673 /* Used to the online set of cpus does not change
10674 * during assign_irq_vector.
10675 @@ -1036,7 +1036,7 @@ void lock_vector_lock(void)
10676 raw_spin_lock(&vector_lock);
10677 }
10678
10679 -void unlock_vector_lock(void)
10680 +void unlock_vector_lock(void) __releases(vector_lock)
10681 {
10682 raw_spin_unlock(&vector_lock);
10683 }
10684 @@ -2364,7 +2364,7 @@ static void ack_apic_edge(struct irq_dat
10685 ack_APIC_irq();
10686 }
10687
10688 -atomic_t irq_mis_count;
10689 +atomic_unchecked_t irq_mis_count;
10690
10691 /*
10692 * IO-APIC versions below 0x20 don't support EOI register.
10693 @@ -2472,7 +2472,7 @@ static void ack_apic_level(struct irq_da
10694 * at the cpu.
10695 */
10696 if (!(v & (1 << (i & 0x1f)))) {
10697 - atomic_inc(&irq_mis_count);
10698 + atomic_inc_unchecked(&irq_mis_count);
10699
10700 eoi_ioapic_irq(irq, cfg);
10701 }
10702 diff -urNp linux-3.0.8/arch/x86/kernel/apm_32.c linux-3.0.8/arch/x86/kernel/apm_32.c
10703 --- linux-3.0.8/arch/x86/kernel/apm_32.c 2011-07-21 22:17:23.000000000 -0400
10704 +++ linux-3.0.8/arch/x86/kernel/apm_32.c 2011-08-23 21:47:55.000000000 -0400
10705 @@ -413,7 +413,7 @@ static DEFINE_MUTEX(apm_mutex);
10706 * This is for buggy BIOS's that refer to (real mode) segment 0x40
10707 * even though they are called in protected mode.
10708 */
10709 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
10710 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
10711 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
10712
10713 static const char driver_version[] = "1.16ac"; /* no spaces */
10714 @@ -591,7 +591,10 @@ static long __apm_bios_call(void *_call)
10715 BUG_ON(cpu != 0);
10716 gdt = get_cpu_gdt_table(cpu);
10717 save_desc_40 = gdt[0x40 / 8];
10718 +
10719 + pax_open_kernel();
10720 gdt[0x40 / 8] = bad_bios_desc;
10721 + pax_close_kernel();
10722
10723 apm_irq_save(flags);
10724 APM_DO_SAVE_SEGS;
10725 @@ -600,7 +603,11 @@ static long __apm_bios_call(void *_call)
10726 &call->esi);
10727 APM_DO_RESTORE_SEGS;
10728 apm_irq_restore(flags);
10729 +
10730 + pax_open_kernel();
10731 gdt[0x40 / 8] = save_desc_40;
10732 + pax_close_kernel();
10733 +
10734 put_cpu();
10735
10736 return call->eax & 0xff;
10737 @@ -667,7 +674,10 @@ static long __apm_bios_call_simple(void
10738 BUG_ON(cpu != 0);
10739 gdt = get_cpu_gdt_table(cpu);
10740 save_desc_40 = gdt[0x40 / 8];
10741 +
10742 + pax_open_kernel();
10743 gdt[0x40 / 8] = bad_bios_desc;
10744 + pax_close_kernel();
10745
10746 apm_irq_save(flags);
10747 APM_DO_SAVE_SEGS;
10748 @@ -675,7 +685,11 @@ static long __apm_bios_call_simple(void
10749 &call->eax);
10750 APM_DO_RESTORE_SEGS;
10751 apm_irq_restore(flags);
10752 +
10753 + pax_open_kernel();
10754 gdt[0x40 / 8] = save_desc_40;
10755 + pax_close_kernel();
10756 +
10757 put_cpu();
10758 return error;
10759 }
10760 @@ -2349,12 +2363,15 @@ static int __init apm_init(void)
10761 * code to that CPU.
10762 */
10763 gdt = get_cpu_gdt_table(0);
10764 +
10765 + pax_open_kernel();
10766 set_desc_base(&gdt[APM_CS >> 3],
10767 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
10768 set_desc_base(&gdt[APM_CS_16 >> 3],
10769 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
10770 set_desc_base(&gdt[APM_DS >> 3],
10771 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
10772 + pax_close_kernel();
10773
10774 proc_create("apm", 0, NULL, &apm_file_ops);
10775
10776 diff -urNp linux-3.0.8/arch/x86/kernel/asm-offsets_64.c linux-3.0.8/arch/x86/kernel/asm-offsets_64.c
10777 --- linux-3.0.8/arch/x86/kernel/asm-offsets_64.c 2011-07-21 22:17:23.000000000 -0400
10778 +++ linux-3.0.8/arch/x86/kernel/asm-offsets_64.c 2011-08-23 21:47:55.000000000 -0400
10779 @@ -69,6 +69,7 @@ int main(void)
10780 BLANK();
10781 #undef ENTRY
10782
10783 + DEFINE(TSS_size, sizeof(struct tss_struct));
10784 OFFSET(TSS_ist, tss_struct, x86_tss.ist);
10785 BLANK();
10786
10787 diff -urNp linux-3.0.8/arch/x86/kernel/asm-offsets.c linux-3.0.8/arch/x86/kernel/asm-offsets.c
10788 --- linux-3.0.8/arch/x86/kernel/asm-offsets.c 2011-07-21 22:17:23.000000000 -0400
10789 +++ linux-3.0.8/arch/x86/kernel/asm-offsets.c 2011-08-23 21:47:55.000000000 -0400
10790 @@ -33,6 +33,8 @@ void common(void) {
10791 OFFSET(TI_status, thread_info, status);
10792 OFFSET(TI_addr_limit, thread_info, addr_limit);
10793 OFFSET(TI_preempt_count, thread_info, preempt_count);
10794 + OFFSET(TI_lowest_stack, thread_info, lowest_stack);
10795 + DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
10796
10797 BLANK();
10798 OFFSET(crypto_tfm_ctx_offset, crypto_tfm, __crt_ctx);
10799 @@ -53,8 +55,26 @@ void common(void) {
10800 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
10801 OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
10802 OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
10803 +
10804 +#ifdef CONFIG_PAX_KERNEXEC
10805 + OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
10806 +#endif
10807 +
10808 +#ifdef CONFIG_PAX_MEMORY_UDEREF
10809 + OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
10810 + OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
10811 +#ifdef CONFIG_X86_64
10812 + OFFSET(PV_MMU_set_pgd_batched, pv_mmu_ops, set_pgd_batched);
10813 +#endif
10814 #endif
10815
10816 +#endif
10817 +
10818 + BLANK();
10819 + DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
10820 + DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
10821 + DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
10822 +
10823 #ifdef CONFIG_XEN
10824 BLANK();
10825 OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
10826 diff -urNp linux-3.0.8/arch/x86/kernel/cpu/amd.c linux-3.0.8/arch/x86/kernel/cpu/amd.c
10827 --- linux-3.0.8/arch/x86/kernel/cpu/amd.c 2011-07-21 22:17:23.000000000 -0400
10828 +++ linux-3.0.8/arch/x86/kernel/cpu/amd.c 2011-08-23 21:47:55.000000000 -0400
10829 @@ -647,7 +647,7 @@ static unsigned int __cpuinit amd_size_c
10830 unsigned int size)
10831 {
10832 /* AMD errata T13 (order #21922) */
10833 - if ((c->x86 == 6)) {
10834 + if (c->x86 == 6) {
10835 /* Duron Rev A0 */
10836 if (c->x86_model == 3 && c->x86_mask == 0)
10837 size = 64;
10838 diff -urNp linux-3.0.8/arch/x86/kernel/cpu/common.c linux-3.0.8/arch/x86/kernel/cpu/common.c
10839 --- linux-3.0.8/arch/x86/kernel/cpu/common.c 2011-07-21 22:17:23.000000000 -0400
10840 +++ linux-3.0.8/arch/x86/kernel/cpu/common.c 2011-08-23 21:47:55.000000000 -0400
10841 @@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
10842
10843 static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
10844
10845 -DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
10846 -#ifdef CONFIG_X86_64
10847 - /*
10848 - * We need valid kernel segments for data and code in long mode too
10849 - * IRET will check the segment types kkeil 2000/10/28
10850 - * Also sysret mandates a special GDT layout
10851 - *
10852 - * TLS descriptors are currently at a different place compared to i386.
10853 - * Hopefully nobody expects them at a fixed place (Wine?)
10854 - */
10855 - [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
10856 - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
10857 - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
10858 - [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
10859 - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
10860 - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
10861 -#else
10862 - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
10863 - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
10864 - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
10865 - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
10866 - /*
10867 - * Segments used for calling PnP BIOS have byte granularity.
10868 - * They code segments and data segments have fixed 64k limits,
10869 - * the transfer segment sizes are set at run time.
10870 - */
10871 - /* 32-bit code */
10872 - [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
10873 - /* 16-bit code */
10874 - [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
10875 - /* 16-bit data */
10876 - [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
10877 - /* 16-bit data */
10878 - [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
10879 - /* 16-bit data */
10880 - [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
10881 - /*
10882 - * The APM segments have byte granularity and their bases
10883 - * are set at run time. All have 64k limits.
10884 - */
10885 - /* 32-bit code */
10886 - [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
10887 - /* 16-bit code */
10888 - [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
10889 - /* data */
10890 - [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
10891 -
10892 - [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
10893 - [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
10894 - GDT_STACK_CANARY_INIT
10895 -#endif
10896 -} };
10897 -EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
10898 -
10899 static int __init x86_xsave_setup(char *s)
10900 {
10901 setup_clear_cpu_cap(X86_FEATURE_XSAVE);
10902 @@ -371,7 +317,7 @@ void switch_to_new_gdt(int cpu)
10903 {
10904 struct desc_ptr gdt_descr;
10905
10906 - gdt_descr.address = (long)get_cpu_gdt_table(cpu);
10907 + gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
10908 gdt_descr.size = GDT_SIZE - 1;
10909 load_gdt(&gdt_descr);
10910 /* Reload the per-cpu base */
10911 @@ -840,6 +786,10 @@ static void __cpuinit identify_cpu(struc
10912 /* Filter out anything that depends on CPUID levels we don't have */
10913 filter_cpuid_features(c, true);
10914
10915 +#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
10916 + setup_clear_cpu_cap(X86_FEATURE_SEP);
10917 +#endif
10918 +
10919 /* If the model name is still unset, do table lookup. */
10920 if (!c->x86_model_id[0]) {
10921 const char *p;
10922 @@ -1019,6 +969,9 @@ static __init int setup_disablecpuid(cha
10923 }
10924 __setup("clearcpuid=", setup_disablecpuid);
10925
10926 +DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
10927 +EXPORT_PER_CPU_SYMBOL(current_tinfo);
10928 +
10929 #ifdef CONFIG_X86_64
10930 struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
10931
10932 @@ -1034,7 +987,7 @@ DEFINE_PER_CPU(struct task_struct *, cur
10933 EXPORT_PER_CPU_SYMBOL(current_task);
10934
10935 DEFINE_PER_CPU(unsigned long, kernel_stack) =
10936 - (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
10937 + (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
10938 EXPORT_PER_CPU_SYMBOL(kernel_stack);
10939
10940 DEFINE_PER_CPU(char *, irq_stack_ptr) =
10941 @@ -1099,7 +1052,7 @@ struct pt_regs * __cpuinit idle_regs(str
10942 {
10943 memset(regs, 0, sizeof(struct pt_regs));
10944 regs->fs = __KERNEL_PERCPU;
10945 - regs->gs = __KERNEL_STACK_CANARY;
10946 + savesegment(gs, regs->gs);
10947
10948 return regs;
10949 }
10950 @@ -1154,7 +1107,7 @@ void __cpuinit cpu_init(void)
10951 int i;
10952
10953 cpu = stack_smp_processor_id();
10954 - t = &per_cpu(init_tss, cpu);
10955 + t = init_tss + cpu;
10956 oist = &per_cpu(orig_ist, cpu);
10957
10958 #ifdef CONFIG_NUMA
10959 @@ -1180,7 +1133,7 @@ void __cpuinit cpu_init(void)
10960 switch_to_new_gdt(cpu);
10961 loadsegment(fs, 0);
10962
10963 - load_idt((const struct desc_ptr *)&idt_descr);
10964 + load_idt(&idt_descr);
10965
10966 memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
10967 syscall_init();
10968 @@ -1189,7 +1142,6 @@ void __cpuinit cpu_init(void)
10969 wrmsrl(MSR_KERNEL_GS_BASE, 0);
10970 barrier();
10971
10972 - x86_configure_nx();
10973 if (cpu != 0)
10974 enable_x2apic();
10975
10976 @@ -1243,7 +1195,7 @@ void __cpuinit cpu_init(void)
10977 {
10978 int cpu = smp_processor_id();
10979 struct task_struct *curr = current;
10980 - struct tss_struct *t = &per_cpu(init_tss, cpu);
10981 + struct tss_struct *t = init_tss + cpu;
10982 struct thread_struct *thread = &curr->thread;
10983
10984 if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
10985 diff -urNp linux-3.0.8/arch/x86/kernel/cpu/intel.c linux-3.0.8/arch/x86/kernel/cpu/intel.c
10986 --- linux-3.0.8/arch/x86/kernel/cpu/intel.c 2011-10-24 08:05:23.000000000 -0400
10987 +++ linux-3.0.8/arch/x86/kernel/cpu/intel.c 2011-08-29 23:30:14.000000000 -0400
10988 @@ -172,7 +172,7 @@ static void __cpuinit trap_init_f00f_bug
10989 * Update the IDT descriptor and reload the IDT so that
10990 * it uses the read-only mapped virtual address.
10991 */
10992 - idt_descr.address = fix_to_virt(FIX_F00F_IDT);
10993 + idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
10994 load_idt(&idt_descr);
10995 }
10996 #endif
10997 diff -urNp linux-3.0.8/arch/x86/kernel/cpu/Makefile linux-3.0.8/arch/x86/kernel/cpu/Makefile
10998 --- linux-3.0.8/arch/x86/kernel/cpu/Makefile 2011-07-21 22:17:23.000000000 -0400
10999 +++ linux-3.0.8/arch/x86/kernel/cpu/Makefile 2011-08-23 21:47:55.000000000 -0400
11000 @@ -8,10 +8,6 @@ CFLAGS_REMOVE_common.o = -pg
11001 CFLAGS_REMOVE_perf_event.o = -pg
11002 endif
11003
11004 -# Make sure load_percpu_segment has no stackprotector
11005 -nostackp := $(call cc-option, -fno-stack-protector)
11006 -CFLAGS_common.o := $(nostackp)
11007 -
11008 obj-y := intel_cacheinfo.o scattered.o topology.o
11009 obj-y += proc.o capflags.o powerflags.o common.o
11010 obj-y += vmware.o hypervisor.o sched.o mshyperv.o
11011 diff -urNp linux-3.0.8/arch/x86/kernel/cpu/mcheck/mce.c linux-3.0.8/arch/x86/kernel/cpu/mcheck/mce.c
11012 --- linux-3.0.8/arch/x86/kernel/cpu/mcheck/mce.c 2011-07-21 22:17:23.000000000 -0400
11013 +++ linux-3.0.8/arch/x86/kernel/cpu/mcheck/mce.c 2011-08-23 21:47:55.000000000 -0400
11014 @@ -46,6 +46,7 @@
11015 #include <asm/ipi.h>
11016 #include <asm/mce.h>
11017 #include <asm/msr.h>
11018 +#include <asm/local.h>
11019
11020 #include "mce-internal.h"
11021
11022 @@ -208,7 +209,7 @@ static void print_mce(struct mce *m)
11023 !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
11024 m->cs, m->ip);
11025
11026 - if (m->cs == __KERNEL_CS)
11027 + if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
11028 print_symbol("{%s}", m->ip);
11029 pr_cont("\n");
11030 }
11031 @@ -236,10 +237,10 @@ static void print_mce(struct mce *m)
11032
11033 #define PANIC_TIMEOUT 5 /* 5 seconds */
11034
11035 -static atomic_t mce_paniced;
11036 +static atomic_unchecked_t mce_paniced;
11037
11038 static int fake_panic;
11039 -static atomic_t mce_fake_paniced;
11040 +static atomic_unchecked_t mce_fake_paniced;
11041
11042 /* Panic in progress. Enable interrupts and wait for final IPI */
11043 static void wait_for_panic(void)
11044 @@ -263,7 +264,7 @@ static void mce_panic(char *msg, struct
11045 /*
11046 * Make sure only one CPU runs in machine check panic
11047 */
11048 - if (atomic_inc_return(&mce_paniced) > 1)
11049 + if (atomic_inc_return_unchecked(&mce_paniced) > 1)
11050 wait_for_panic();
11051 barrier();
11052
11053 @@ -271,7 +272,7 @@ static void mce_panic(char *msg, struct
11054 console_verbose();
11055 } else {
11056 /* Don't log too much for fake panic */
11057 - if (atomic_inc_return(&mce_fake_paniced) > 1)
11058 + if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
11059 return;
11060 }
11061 /* First print corrected ones that are still unlogged */
11062 @@ -638,7 +639,7 @@ static int mce_timed_out(u64 *t)
11063 * might have been modified by someone else.
11064 */
11065 rmb();
11066 - if (atomic_read(&mce_paniced))
11067 + if (atomic_read_unchecked(&mce_paniced))
11068 wait_for_panic();
11069 if (!monarch_timeout)
11070 goto out;
11071 @@ -1452,14 +1453,14 @@ void __cpuinit mcheck_cpu_init(struct cp
11072 */
11073
11074 static DEFINE_SPINLOCK(mce_state_lock);
11075 -static int open_count; /* #times opened */
11076 +static local_t open_count; /* #times opened */
11077 static int open_exclu; /* already open exclusive? */
11078
11079 static int mce_open(struct inode *inode, struct file *file)
11080 {
11081 spin_lock(&mce_state_lock);
11082
11083 - if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
11084 + if (open_exclu || (local_read(&open_count) && (file->f_flags & O_EXCL))) {
11085 spin_unlock(&mce_state_lock);
11086
11087 return -EBUSY;
11088 @@ -1467,7 +1468,7 @@ static int mce_open(struct inode *inode,
11089
11090 if (file->f_flags & O_EXCL)
11091 open_exclu = 1;
11092 - open_count++;
11093 + local_inc(&open_count);
11094
11095 spin_unlock(&mce_state_lock);
11096
11097 @@ -1478,7 +1479,7 @@ static int mce_release(struct inode *ino
11098 {
11099 spin_lock(&mce_state_lock);
11100
11101 - open_count--;
11102 + local_dec(&open_count);
11103 open_exclu = 0;
11104
11105 spin_unlock(&mce_state_lock);
11106 @@ -2163,7 +2164,7 @@ struct dentry *mce_get_debugfs_dir(void)
11107 static void mce_reset(void)
11108 {
11109 cpu_missing = 0;
11110 - atomic_set(&mce_fake_paniced, 0);
11111 + atomic_set_unchecked(&mce_fake_paniced, 0);
11112 atomic_set(&mce_executing, 0);
11113 atomic_set(&mce_callin, 0);
11114 atomic_set(&global_nwo, 0);
11115 diff -urNp linux-3.0.8/arch/x86/kernel/cpu/mcheck/mce-inject.c linux-3.0.8/arch/x86/kernel/cpu/mcheck/mce-inject.c
11116 --- linux-3.0.8/arch/x86/kernel/cpu/mcheck/mce-inject.c 2011-07-21 22:17:23.000000000 -0400
11117 +++ linux-3.0.8/arch/x86/kernel/cpu/mcheck/mce-inject.c 2011-08-23 21:47:55.000000000 -0400
11118 @@ -215,7 +215,9 @@ static int inject_init(void)
11119 if (!alloc_cpumask_var(&mce_inject_cpumask, GFP_KERNEL))
11120 return -ENOMEM;
11121 printk(KERN_INFO "Machine check injector initialized\n");
11122 - mce_chrdev_ops.write = mce_write;
11123 + pax_open_kernel();
11124 + *(void **)&mce_chrdev_ops.write = mce_write;
11125 + pax_close_kernel();
11126 register_die_notifier(&mce_raise_nb);
11127 return 0;
11128 }
11129 diff -urNp linux-3.0.8/arch/x86/kernel/cpu/mtrr/main.c linux-3.0.8/arch/x86/kernel/cpu/mtrr/main.c
11130 --- linux-3.0.8/arch/x86/kernel/cpu/mtrr/main.c 2011-10-24 08:05:23.000000000 -0400
11131 +++ linux-3.0.8/arch/x86/kernel/cpu/mtrr/main.c 2011-08-29 23:26:21.000000000 -0400
11132 @@ -62,7 +62,7 @@ static DEFINE_MUTEX(mtrr_mutex);
11133 u64 size_or_mask, size_and_mask;
11134 static bool mtrr_aps_delayed_init;
11135
11136 -static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
11137 +static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
11138
11139 const struct mtrr_ops *mtrr_if;
11140
11141 diff -urNp linux-3.0.8/arch/x86/kernel/cpu/mtrr/mtrr.h linux-3.0.8/arch/x86/kernel/cpu/mtrr/mtrr.h
11142 --- linux-3.0.8/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-07-21 22:17:23.000000000 -0400
11143 +++ linux-3.0.8/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-08-26 19:49:56.000000000 -0400
11144 @@ -25,7 +25,7 @@ struct mtrr_ops {
11145 int (*validate_add_page)(unsigned long base, unsigned long size,
11146 unsigned int type);
11147 int (*have_wrcomb)(void);
11148 -};
11149 +} __do_const;
11150
11151 extern int generic_get_free_region(unsigned long base, unsigned long size,
11152 int replace_reg);
11153 diff -urNp linux-3.0.8/arch/x86/kernel/cpu/perf_event.c linux-3.0.8/arch/x86/kernel/cpu/perf_event.c
11154 --- linux-3.0.8/arch/x86/kernel/cpu/perf_event.c 2011-10-24 08:05:30.000000000 -0400
11155 +++ linux-3.0.8/arch/x86/kernel/cpu/perf_event.c 2011-10-16 21:55:27.000000000 -0400
11156 @@ -781,6 +781,8 @@ static int x86_schedule_events(struct cp
11157 int i, j, w, wmax, num = 0;
11158 struct hw_perf_event *hwc;
11159
11160 + pax_track_stack();
11161 +
11162 bitmap_zero(used_mask, X86_PMC_IDX_MAX);
11163
11164 for (i = 0; i < n; i++) {
11165 @@ -1875,7 +1877,7 @@ perf_callchain_user(struct perf_callchai
11166 break;
11167
11168 perf_callchain_store(entry, frame.return_address);
11169 - fp = frame.next_frame;
11170 + fp = (const void __force_user *)frame.next_frame;
11171 }
11172 }
11173
11174 diff -urNp linux-3.0.8/arch/x86/kernel/crash.c linux-3.0.8/arch/x86/kernel/crash.c
11175 --- linux-3.0.8/arch/x86/kernel/crash.c 2011-07-21 22:17:23.000000000 -0400
11176 +++ linux-3.0.8/arch/x86/kernel/crash.c 2011-08-23 21:47:55.000000000 -0400
11177 @@ -42,7 +42,7 @@ static void kdump_nmi_callback(int cpu,
11178 regs = args->regs;
11179
11180 #ifdef CONFIG_X86_32
11181 - if (!user_mode_vm(regs)) {
11182 + if (!user_mode(regs)) {
11183 crash_fixup_ss_esp(&fixed_regs, regs);
11184 regs = &fixed_regs;
11185 }
11186 diff -urNp linux-3.0.8/arch/x86/kernel/doublefault_32.c linux-3.0.8/arch/x86/kernel/doublefault_32.c
11187 --- linux-3.0.8/arch/x86/kernel/doublefault_32.c 2011-07-21 22:17:23.000000000 -0400
11188 +++ linux-3.0.8/arch/x86/kernel/doublefault_32.c 2011-08-23 21:47:55.000000000 -0400
11189 @@ -11,7 +11,7 @@
11190
11191 #define DOUBLEFAULT_STACKSIZE (1024)
11192 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
11193 -#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
11194 +#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
11195
11196 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
11197
11198 @@ -21,7 +21,7 @@ static void doublefault_fn(void)
11199 unsigned long gdt, tss;
11200
11201 store_gdt(&gdt_desc);
11202 - gdt = gdt_desc.address;
11203 + gdt = (unsigned long)gdt_desc.address;
11204
11205 printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
11206
11207 @@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach
11208 /* 0x2 bit is always set */
11209 .flags = X86_EFLAGS_SF | 0x2,
11210 .sp = STACK_START,
11211 - .es = __USER_DS,
11212 + .es = __KERNEL_DS,
11213 .cs = __KERNEL_CS,
11214 .ss = __KERNEL_DS,
11215 - .ds = __USER_DS,
11216 + .ds = __KERNEL_DS,
11217 .fs = __KERNEL_PERCPU,
11218
11219 .__cr3 = __pa_nodebug(swapper_pg_dir),
11220 diff -urNp linux-3.0.8/arch/x86/kernel/dumpstack_32.c linux-3.0.8/arch/x86/kernel/dumpstack_32.c
11221 --- linux-3.0.8/arch/x86/kernel/dumpstack_32.c 2011-07-21 22:17:23.000000000 -0400
11222 +++ linux-3.0.8/arch/x86/kernel/dumpstack_32.c 2011-08-23 21:47:55.000000000 -0400
11223 @@ -38,15 +38,13 @@ void dump_trace(struct task_struct *task
11224 bp = stack_frame(task, regs);
11225
11226 for (;;) {
11227 - struct thread_info *context;
11228 + void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
11229
11230 - context = (struct thread_info *)
11231 - ((unsigned long)stack & (~(THREAD_SIZE - 1)));
11232 - bp = ops->walk_stack(context, stack, bp, ops, data, NULL, &graph);
11233 + bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
11234
11235 - stack = (unsigned long *)context->previous_esp;
11236 - if (!stack)
11237 + if (stack_start == task_stack_page(task))
11238 break;
11239 + stack = *(unsigned long **)stack_start;
11240 if (ops->stack(data, "IRQ") < 0)
11241 break;
11242 touch_nmi_watchdog();
11243 @@ -96,21 +94,22 @@ void show_registers(struct pt_regs *regs
11244 * When in-kernel, we also print out the stack and code at the
11245 * time of the fault..
11246 */
11247 - if (!user_mode_vm(regs)) {
11248 + if (!user_mode(regs)) {
11249 unsigned int code_prologue = code_bytes * 43 / 64;
11250 unsigned int code_len = code_bytes;
11251 unsigned char c;
11252 u8 *ip;
11253 + unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
11254
11255 printk(KERN_EMERG "Stack:\n");
11256 show_stack_log_lvl(NULL, regs, &regs->sp, 0, KERN_EMERG);
11257
11258 printk(KERN_EMERG "Code: ");
11259
11260 - ip = (u8 *)regs->ip - code_prologue;
11261 + ip = (u8 *)regs->ip - code_prologue + cs_base;
11262 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
11263 /* try starting at IP */
11264 - ip = (u8 *)regs->ip;
11265 + ip = (u8 *)regs->ip + cs_base;
11266 code_len = code_len - code_prologue + 1;
11267 }
11268 for (i = 0; i < code_len; i++, ip++) {
11269 @@ -119,7 +118,7 @@ void show_registers(struct pt_regs *regs
11270 printk(" Bad EIP value.");
11271 break;
11272 }
11273 - if (ip == (u8 *)regs->ip)
11274 + if (ip == (u8 *)regs->ip + cs_base)
11275 printk("<%02x> ", c);
11276 else
11277 printk("%02x ", c);
11278 @@ -132,6 +131,7 @@ int is_valid_bugaddr(unsigned long ip)
11279 {
11280 unsigned short ud2;
11281
11282 + ip = ktla_ktva(ip);
11283 if (ip < PAGE_OFFSET)
11284 return 0;
11285 if (probe_kernel_address((unsigned short *)ip, ud2))
11286 diff -urNp linux-3.0.8/arch/x86/kernel/dumpstack_64.c linux-3.0.8/arch/x86/kernel/dumpstack_64.c
11287 --- linux-3.0.8/arch/x86/kernel/dumpstack_64.c 2011-07-21 22:17:23.000000000 -0400
11288 +++ linux-3.0.8/arch/x86/kernel/dumpstack_64.c 2011-08-23 21:47:55.000000000 -0400
11289 @@ -147,9 +147,9 @@ void dump_trace(struct task_struct *task
11290 unsigned long *irq_stack_end =
11291 (unsigned long *)per_cpu(irq_stack_ptr, cpu);
11292 unsigned used = 0;
11293 - struct thread_info *tinfo;
11294 int graph = 0;
11295 unsigned long dummy;
11296 + void *stack_start;
11297
11298 if (!task)
11299 task = current;
11300 @@ -167,10 +167,10 @@ void dump_trace(struct task_struct *task
11301 * current stack address. If the stacks consist of nested
11302 * exceptions
11303 */
11304 - tinfo = task_thread_info(task);
11305 for (;;) {
11306 char *id;
11307 unsigned long *estack_end;
11308 +
11309 estack_end = in_exception_stack(cpu, (unsigned long)stack,
11310 &used, &id);
11311
11312 @@ -178,7 +178,7 @@ void dump_trace(struct task_struct *task
11313 if (ops->stack(data, id) < 0)
11314 break;
11315
11316 - bp = ops->walk_stack(tinfo, stack, bp, ops,
11317 + bp = ops->walk_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
11318 data, estack_end, &graph);
11319 ops->stack(data, "<EOE>");
11320 /*
11321 @@ -197,7 +197,7 @@ void dump_trace(struct task_struct *task
11322 if (in_irq_stack(stack, irq_stack, irq_stack_end)) {
11323 if (ops->stack(data, "IRQ") < 0)
11324 break;
11325 - bp = ops->walk_stack(tinfo, stack, bp,
11326 + bp = ops->walk_stack(task, irq_stack, stack, bp,
11327 ops, data, irq_stack_end, &graph);
11328 /*
11329 * We link to the next stack (which would be
11330 @@ -218,7 +218,8 @@ void dump_trace(struct task_struct *task
11331 /*
11332 * This handles the process stack:
11333 */
11334 - bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph);
11335 + stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
11336 + bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
11337 put_cpu();
11338 }
11339 EXPORT_SYMBOL(dump_trace);
11340 diff -urNp linux-3.0.8/arch/x86/kernel/dumpstack.c linux-3.0.8/arch/x86/kernel/dumpstack.c
11341 --- linux-3.0.8/arch/x86/kernel/dumpstack.c 2011-07-21 22:17:23.000000000 -0400
11342 +++ linux-3.0.8/arch/x86/kernel/dumpstack.c 2011-08-23 21:48:14.000000000 -0400
11343 @@ -2,6 +2,9 @@
11344 * Copyright (C) 1991, 1992 Linus Torvalds
11345 * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
11346 */
11347 +#ifdef CONFIG_GRKERNSEC_HIDESYM
11348 +#define __INCLUDED_BY_HIDESYM 1
11349 +#endif
11350 #include <linux/kallsyms.h>
11351 #include <linux/kprobes.h>
11352 #include <linux/uaccess.h>
11353 @@ -35,9 +38,8 @@ void printk_address(unsigned long addres
11354 static void
11355 print_ftrace_graph_addr(unsigned long addr, void *data,
11356 const struct stacktrace_ops *ops,
11357 - struct thread_info *tinfo, int *graph)
11358 + struct task_struct *task, int *graph)
11359 {
11360 - struct task_struct *task = tinfo->task;
11361 unsigned long ret_addr;
11362 int index = task->curr_ret_stack;
11363
11364 @@ -58,7 +60,7 @@ print_ftrace_graph_addr(unsigned long ad
11365 static inline void
11366 print_ftrace_graph_addr(unsigned long addr, void *data,
11367 const struct stacktrace_ops *ops,
11368 - struct thread_info *tinfo, int *graph)
11369 + struct task_struct *task, int *graph)
11370 { }
11371 #endif
11372
11373 @@ -69,10 +71,8 @@ print_ftrace_graph_addr(unsigned long ad
11374 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
11375 */
11376
11377 -static inline int valid_stack_ptr(struct thread_info *tinfo,
11378 - void *p, unsigned int size, void *end)
11379 +static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
11380 {
11381 - void *t = tinfo;
11382 if (end) {
11383 if (p < end && p >= (end-THREAD_SIZE))
11384 return 1;
11385 @@ -83,14 +83,14 @@ static inline int valid_stack_ptr(struct
11386 }
11387
11388 unsigned long
11389 -print_context_stack(struct thread_info *tinfo,
11390 +print_context_stack(struct task_struct *task, void *stack_start,
11391 unsigned long *stack, unsigned long bp,
11392 const struct stacktrace_ops *ops, void *data,
11393 unsigned long *end, int *graph)
11394 {
11395 struct stack_frame *frame = (struct stack_frame *)bp;
11396
11397 - while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
11398 + while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
11399 unsigned long addr;
11400
11401 addr = *stack;
11402 @@ -102,7 +102,7 @@ print_context_stack(struct thread_info *
11403 } else {
11404 ops->address(data, addr, 0);
11405 }
11406 - print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
11407 + print_ftrace_graph_addr(addr, data, ops, task, graph);
11408 }
11409 stack++;
11410 }
11411 @@ -111,7 +111,7 @@ print_context_stack(struct thread_info *
11412 EXPORT_SYMBOL_GPL(print_context_stack);
11413
11414 unsigned long
11415 -print_context_stack_bp(struct thread_info *tinfo,
11416 +print_context_stack_bp(struct task_struct *task, void *stack_start,
11417 unsigned long *stack, unsigned long bp,
11418 const struct stacktrace_ops *ops, void *data,
11419 unsigned long *end, int *graph)
11420 @@ -119,7 +119,7 @@ print_context_stack_bp(struct thread_inf
11421 struct stack_frame *frame = (struct stack_frame *)bp;
11422 unsigned long *ret_addr = &frame->return_address;
11423
11424 - while (valid_stack_ptr(tinfo, ret_addr, sizeof(*ret_addr), end)) {
11425 + while (valid_stack_ptr(stack_start, ret_addr, sizeof(*ret_addr), end)) {
11426 unsigned long addr = *ret_addr;
11427
11428 if (!__kernel_text_address(addr))
11429 @@ -128,7 +128,7 @@ print_context_stack_bp(struct thread_inf
11430 ops->address(data, addr, 1);
11431 frame = frame->next_frame;
11432 ret_addr = &frame->return_address;
11433 - print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
11434 + print_ftrace_graph_addr(addr, data, ops, task, graph);
11435 }
11436
11437 return (unsigned long)frame;
11438 @@ -186,7 +186,7 @@ void dump_stack(void)
11439
11440 bp = stack_frame(current, NULL);
11441 printk("Pid: %d, comm: %.20s %s %s %.*s\n",
11442 - current->pid, current->comm, print_tainted(),
11443 + task_pid_nr(current), current->comm, print_tainted(),
11444 init_utsname()->release,
11445 (int)strcspn(init_utsname()->version, " "),
11446 init_utsname()->version);
11447 @@ -222,6 +222,8 @@ unsigned __kprobes long oops_begin(void)
11448 }
11449 EXPORT_SYMBOL_GPL(oops_begin);
11450
11451 +extern void gr_handle_kernel_exploit(void);
11452 +
11453 void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
11454 {
11455 if (regs && kexec_should_crash(current))
11456 @@ -243,7 +245,10 @@ void __kprobes oops_end(unsigned long fl
11457 panic("Fatal exception in interrupt");
11458 if (panic_on_oops)
11459 panic("Fatal exception");
11460 - do_exit(signr);
11461 +
11462 + gr_handle_kernel_exploit();
11463 +
11464 + do_group_exit(signr);
11465 }
11466
11467 int __kprobes __die(const char *str, struct pt_regs *regs, long err)
11468 @@ -269,7 +274,7 @@ int __kprobes __die(const char *str, str
11469
11470 show_registers(regs);
11471 #ifdef CONFIG_X86_32
11472 - if (user_mode_vm(regs)) {
11473 + if (user_mode(regs)) {
11474 sp = regs->sp;
11475 ss = regs->ss & 0xffff;
11476 } else {
11477 @@ -297,7 +302,7 @@ void die(const char *str, struct pt_regs
11478 unsigned long flags = oops_begin();
11479 int sig = SIGSEGV;
11480
11481 - if (!user_mode_vm(regs))
11482 + if (!user_mode(regs))
11483 report_bug(regs->ip, regs);
11484
11485 if (__die(str, regs, err))
11486 diff -urNp linux-3.0.8/arch/x86/kernel/early_printk.c linux-3.0.8/arch/x86/kernel/early_printk.c
11487 --- linux-3.0.8/arch/x86/kernel/early_printk.c 2011-07-21 22:17:23.000000000 -0400
11488 +++ linux-3.0.8/arch/x86/kernel/early_printk.c 2011-08-23 21:48:14.000000000 -0400
11489 @@ -7,6 +7,7 @@
11490 #include <linux/pci_regs.h>
11491 #include <linux/pci_ids.h>
11492 #include <linux/errno.h>
11493 +#include <linux/sched.h>
11494 #include <asm/io.h>
11495 #include <asm/processor.h>
11496 #include <asm/fcntl.h>
11497 @@ -179,6 +180,8 @@ asmlinkage void early_printk(const char
11498 int n;
11499 va_list ap;
11500
11501 + pax_track_stack();
11502 +
11503 va_start(ap, fmt);
11504 n = vscnprintf(buf, sizeof(buf), fmt, ap);
11505 early_console->write(early_console, buf, n);
11506 diff -urNp linux-3.0.8/arch/x86/kernel/entry_32.S linux-3.0.8/arch/x86/kernel/entry_32.S
11507 --- linux-3.0.8/arch/x86/kernel/entry_32.S 2011-07-21 22:17:23.000000000 -0400
11508 +++ linux-3.0.8/arch/x86/kernel/entry_32.S 2011-10-20 04:46:01.000000000 -0400
11509 @@ -185,13 +185,146 @@
11510 /*CFI_REL_OFFSET gs, PT_GS*/
11511 .endm
11512 .macro SET_KERNEL_GS reg
11513 +
11514 +#ifdef CONFIG_CC_STACKPROTECTOR
11515 movl $(__KERNEL_STACK_CANARY), \reg
11516 +#elif defined(CONFIG_PAX_MEMORY_UDEREF)
11517 + movl $(__USER_DS), \reg
11518 +#else
11519 + xorl \reg, \reg
11520 +#endif
11521 +
11522 movl \reg, %gs
11523 .endm
11524
11525 #endif /* CONFIG_X86_32_LAZY_GS */
11526
11527 -.macro SAVE_ALL
11528 +.macro pax_enter_kernel
11529 +#ifdef CONFIG_PAX_KERNEXEC
11530 + call pax_enter_kernel
11531 +#endif
11532 +.endm
11533 +
11534 +.macro pax_exit_kernel
11535 +#ifdef CONFIG_PAX_KERNEXEC
11536 + call pax_exit_kernel
11537 +#endif
11538 +.endm
11539 +
11540 +#ifdef CONFIG_PAX_KERNEXEC
11541 +ENTRY(pax_enter_kernel)
11542 +#ifdef CONFIG_PARAVIRT
11543 + pushl %eax
11544 + pushl %ecx
11545 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
11546 + mov %eax, %esi
11547 +#else
11548 + mov %cr0, %esi
11549 +#endif
11550 + bts $16, %esi
11551 + jnc 1f
11552 + mov %cs, %esi
11553 + cmp $__KERNEL_CS, %esi
11554 + jz 3f
11555 + ljmp $__KERNEL_CS, $3f
11556 +1: ljmp $__KERNEXEC_KERNEL_CS, $2f
11557 +2:
11558 +#ifdef CONFIG_PARAVIRT
11559 + mov %esi, %eax
11560 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
11561 +#else
11562 + mov %esi, %cr0
11563 +#endif
11564 +3:
11565 +#ifdef CONFIG_PARAVIRT
11566 + popl %ecx
11567 + popl %eax
11568 +#endif
11569 + ret
11570 +ENDPROC(pax_enter_kernel)
11571 +
11572 +ENTRY(pax_exit_kernel)
11573 +#ifdef CONFIG_PARAVIRT
11574 + pushl %eax
11575 + pushl %ecx
11576 +#endif
11577 + mov %cs, %esi
11578 + cmp $__KERNEXEC_KERNEL_CS, %esi
11579 + jnz 2f
11580 +#ifdef CONFIG_PARAVIRT
11581 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
11582 + mov %eax, %esi
11583 +#else
11584 + mov %cr0, %esi
11585 +#endif
11586 + btr $16, %esi
11587 + ljmp $__KERNEL_CS, $1f
11588 +1:
11589 +#ifdef CONFIG_PARAVIRT
11590 + mov %esi, %eax
11591 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
11592 +#else
11593 + mov %esi, %cr0
11594 +#endif
11595 +2:
11596 +#ifdef CONFIG_PARAVIRT
11597 + popl %ecx
11598 + popl %eax
11599 +#endif
11600 + ret
11601 +ENDPROC(pax_exit_kernel)
11602 +#endif
11603 +
11604 +.macro pax_erase_kstack
11605 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
11606 + call pax_erase_kstack
11607 +#endif
11608 +.endm
11609 +
11610 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
11611 +/*
11612 + * ebp: thread_info
11613 + * ecx, edx: can be clobbered
11614 + */
11615 +ENTRY(pax_erase_kstack)
11616 + pushl %edi
11617 + pushl %eax
11618 +
11619 + mov TI_lowest_stack(%ebp), %edi
11620 + mov $-0xBEEF, %eax
11621 + std
11622 +
11623 +1: mov %edi, %ecx
11624 + and $THREAD_SIZE_asm - 1, %ecx
11625 + shr $2, %ecx
11626 + repne scasl
11627 + jecxz 2f
11628 +
11629 + cmp $2*16, %ecx
11630 + jc 2f
11631 +
11632 + mov $2*16, %ecx
11633 + repe scasl
11634 + jecxz 2f
11635 + jne 1b
11636 +
11637 +2: cld
11638 + mov %esp, %ecx
11639 + sub %edi, %ecx
11640 + shr $2, %ecx
11641 + rep stosl
11642 +
11643 + mov TI_task_thread_sp0(%ebp), %edi
11644 + sub $128, %edi
11645 + mov %edi, TI_lowest_stack(%ebp)
11646 +
11647 + popl %eax
11648 + popl %edi
11649 + ret
11650 +ENDPROC(pax_erase_kstack)
11651 +#endif
11652 +
11653 +.macro __SAVE_ALL _DS
11654 cld
11655 PUSH_GS
11656 pushl_cfi %fs
11657 @@ -214,7 +347,7 @@
11658 CFI_REL_OFFSET ecx, 0
11659 pushl_cfi %ebx
11660 CFI_REL_OFFSET ebx, 0
11661 - movl $(__USER_DS), %edx
11662 + movl $\_DS, %edx
11663 movl %edx, %ds
11664 movl %edx, %es
11665 movl $(__KERNEL_PERCPU), %edx
11666 @@ -222,6 +355,15 @@
11667 SET_KERNEL_GS %edx
11668 .endm
11669
11670 +.macro SAVE_ALL
11671 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
11672 + __SAVE_ALL __KERNEL_DS
11673 + pax_enter_kernel
11674 +#else
11675 + __SAVE_ALL __USER_DS
11676 +#endif
11677 +.endm
11678 +
11679 .macro RESTORE_INT_REGS
11680 popl_cfi %ebx
11681 CFI_RESTORE ebx
11682 @@ -307,7 +449,7 @@ ENTRY(ret_from_fork)
11683 popfl_cfi
11684 jmp syscall_exit
11685 CFI_ENDPROC
11686 -END(ret_from_fork)
11687 +ENDPROC(ret_from_fork)
11688
11689 /*
11690 * Interrupt exit functions should be protected against kprobes
11691 @@ -332,7 +474,15 @@ check_userspace:
11692 movb PT_CS(%esp), %al
11693 andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
11694 cmpl $USER_RPL, %eax
11695 +
11696 +#ifdef CONFIG_PAX_KERNEXEC
11697 + jae resume_userspace
11698 +
11699 + PAX_EXIT_KERNEL
11700 + jmp resume_kernel
11701 +#else
11702 jb resume_kernel # not returning to v8086 or userspace
11703 +#endif
11704
11705 ENTRY(resume_userspace)
11706 LOCKDEP_SYS_EXIT
11707 @@ -344,8 +494,8 @@ ENTRY(resume_userspace)
11708 andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
11709 # int/exception return?
11710 jne work_pending
11711 - jmp restore_all
11712 -END(ret_from_exception)
11713 + jmp restore_all_pax
11714 +ENDPROC(ret_from_exception)
11715
11716 #ifdef CONFIG_PREEMPT
11717 ENTRY(resume_kernel)
11718 @@ -360,7 +510,7 @@ need_resched:
11719 jz restore_all
11720 call preempt_schedule_irq
11721 jmp need_resched
11722 -END(resume_kernel)
11723 +ENDPROC(resume_kernel)
11724 #endif
11725 CFI_ENDPROC
11726 /*
11727 @@ -394,23 +544,34 @@ sysenter_past_esp:
11728 /*CFI_REL_OFFSET cs, 0*/
11729 /*
11730 * Push current_thread_info()->sysenter_return to the stack.
11731 - * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
11732 - * pushed above; +8 corresponds to copy_thread's esp0 setting.
11733 */
11734 - pushl_cfi ((TI_sysenter_return)-THREAD_SIZE+8+4*4)(%esp)
11735 + pushl_cfi $0
11736 CFI_REL_OFFSET eip, 0
11737
11738 pushl_cfi %eax
11739 SAVE_ALL
11740 + GET_THREAD_INFO(%ebp)
11741 + movl TI_sysenter_return(%ebp),%ebp
11742 + movl %ebp,PT_EIP(%esp)
11743 ENABLE_INTERRUPTS(CLBR_NONE)
11744
11745 /*
11746 * Load the potential sixth argument from user stack.
11747 * Careful about security.
11748 */
11749 + movl PT_OLDESP(%esp),%ebp
11750 +
11751 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11752 + mov PT_OLDSS(%esp),%ds
11753 +1: movl %ds:(%ebp),%ebp
11754 + push %ss
11755 + pop %ds
11756 +#else
11757 cmpl $__PAGE_OFFSET-3,%ebp
11758 jae syscall_fault
11759 1: movl (%ebp),%ebp
11760 +#endif
11761 +
11762 movl %ebp,PT_EBP(%esp)
11763 .section __ex_table,"a"
11764 .align 4
11765 @@ -433,12 +594,24 @@ sysenter_do_call:
11766 testl $_TIF_ALLWORK_MASK, %ecx
11767 jne sysexit_audit
11768 sysenter_exit:
11769 +
11770 +#ifdef CONFIG_PAX_RANDKSTACK
11771 + pushl_cfi %eax
11772 + movl %esp, %eax
11773 + call pax_randomize_kstack
11774 + popl_cfi %eax
11775 +#endif
11776 +
11777 + pax_erase_kstack
11778 +
11779 /* if something modifies registers it must also disable sysexit */
11780 movl PT_EIP(%esp), %edx
11781 movl PT_OLDESP(%esp), %ecx
11782 xorl %ebp,%ebp
11783 TRACE_IRQS_ON
11784 1: mov PT_FS(%esp), %fs
11785 +2: mov PT_DS(%esp), %ds
11786 +3: mov PT_ES(%esp), %es
11787 PTGS_TO_GS
11788 ENABLE_INTERRUPTS_SYSEXIT
11789
11790 @@ -455,6 +628,9 @@ sysenter_audit:
11791 movl %eax,%edx /* 2nd arg: syscall number */
11792 movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
11793 call audit_syscall_entry
11794 +
11795 + pax_erase_kstack
11796 +
11797 pushl_cfi %ebx
11798 movl PT_EAX(%esp),%eax /* reload syscall number */
11799 jmp sysenter_do_call
11800 @@ -481,11 +657,17 @@ sysexit_audit:
11801
11802 CFI_ENDPROC
11803 .pushsection .fixup,"ax"
11804 -2: movl $0,PT_FS(%esp)
11805 +4: movl $0,PT_FS(%esp)
11806 + jmp 1b
11807 +5: movl $0,PT_DS(%esp)
11808 + jmp 1b
11809 +6: movl $0,PT_ES(%esp)
11810 jmp 1b
11811 .section __ex_table,"a"
11812 .align 4
11813 - .long 1b,2b
11814 + .long 1b,4b
11815 + .long 2b,5b
11816 + .long 3b,6b
11817 .popsection
11818 PTGS_TO_GS_EX
11819 ENDPROC(ia32_sysenter_target)
11820 @@ -518,6 +700,15 @@ syscall_exit:
11821 testl $_TIF_ALLWORK_MASK, %ecx # current->work
11822 jne syscall_exit_work
11823
11824 +restore_all_pax:
11825 +
11826 +#ifdef CONFIG_PAX_RANDKSTACK
11827 + movl %esp, %eax
11828 + call pax_randomize_kstack
11829 +#endif
11830 +
11831 + pax_erase_kstack
11832 +
11833 restore_all:
11834 TRACE_IRQS_IRET
11835 restore_all_notrace:
11836 @@ -577,14 +768,34 @@ ldt_ss:
11837 * compensating for the offset by changing to the ESPFIX segment with
11838 * a base address that matches for the difference.
11839 */
11840 -#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS * 8)
11841 +#define GDT_ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)(%ebx)
11842 mov %esp, %edx /* load kernel esp */
11843 mov PT_OLDESP(%esp), %eax /* load userspace esp */
11844 mov %dx, %ax /* eax: new kernel esp */
11845 sub %eax, %edx /* offset (low word is 0) */
11846 +#ifdef CONFIG_SMP
11847 + movl PER_CPU_VAR(cpu_number), %ebx
11848 + shll $PAGE_SHIFT_asm, %ebx
11849 + addl $cpu_gdt_table, %ebx
11850 +#else
11851 + movl $cpu_gdt_table, %ebx
11852 +#endif
11853 shr $16, %edx
11854 - mov %dl, GDT_ESPFIX_SS + 4 /* bits 16..23 */
11855 - mov %dh, GDT_ESPFIX_SS + 7 /* bits 24..31 */
11856 +
11857 +#ifdef CONFIG_PAX_KERNEXEC
11858 + mov %cr0, %esi
11859 + btr $16, %esi
11860 + mov %esi, %cr0
11861 +#endif
11862 +
11863 + mov %dl, 4 + GDT_ESPFIX_SS /* bits 16..23 */
11864 + mov %dh, 7 + GDT_ESPFIX_SS /* bits 24..31 */
11865 +
11866 +#ifdef CONFIG_PAX_KERNEXEC
11867 + bts $16, %esi
11868 + mov %esi, %cr0
11869 +#endif
11870 +
11871 pushl_cfi $__ESPFIX_SS
11872 pushl_cfi %eax /* new kernel esp */
11873 /* Disable interrupts, but do not irqtrace this section: we
11874 @@ -613,34 +824,28 @@ work_resched:
11875 movl TI_flags(%ebp), %ecx
11876 andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
11877 # than syscall tracing?
11878 - jz restore_all
11879 + jz restore_all_pax
11880 testb $_TIF_NEED_RESCHED, %cl
11881 jnz work_resched
11882
11883 work_notifysig: # deal with pending signals and
11884 # notify-resume requests
11885 + movl %esp, %eax
11886 #ifdef CONFIG_VM86
11887 testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
11888 - movl %esp, %eax
11889 - jne work_notifysig_v86 # returning to kernel-space or
11890 + jz 1f # returning to kernel-space or
11891 # vm86-space
11892 - xorl %edx, %edx
11893 - call do_notify_resume
11894 - jmp resume_userspace_sig
11895
11896 - ALIGN
11897 -work_notifysig_v86:
11898 pushl_cfi %ecx # save ti_flags for do_notify_resume
11899 call save_v86_state # %eax contains pt_regs pointer
11900 popl_cfi %ecx
11901 movl %eax, %esp
11902 -#else
11903 - movl %esp, %eax
11904 +1:
11905 #endif
11906 xorl %edx, %edx
11907 call do_notify_resume
11908 jmp resume_userspace_sig
11909 -END(work_pending)
11910 +ENDPROC(work_pending)
11911
11912 # perform syscall exit tracing
11913 ALIGN
11914 @@ -648,11 +853,14 @@ syscall_trace_entry:
11915 movl $-ENOSYS,PT_EAX(%esp)
11916 movl %esp, %eax
11917 call syscall_trace_enter
11918 +
11919 + pax_erase_kstack
11920 +
11921 /* What it returned is what we'll actually use. */
11922 cmpl $(nr_syscalls), %eax
11923 jnae syscall_call
11924 jmp syscall_exit
11925 -END(syscall_trace_entry)
11926 +ENDPROC(syscall_trace_entry)
11927
11928 # perform syscall exit tracing
11929 ALIGN
11930 @@ -665,20 +873,24 @@ syscall_exit_work:
11931 movl %esp, %eax
11932 call syscall_trace_leave
11933 jmp resume_userspace
11934 -END(syscall_exit_work)
11935 +ENDPROC(syscall_exit_work)
11936 CFI_ENDPROC
11937
11938 RING0_INT_FRAME # can't unwind into user space anyway
11939 syscall_fault:
11940 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11941 + push %ss
11942 + pop %ds
11943 +#endif
11944 GET_THREAD_INFO(%ebp)
11945 movl $-EFAULT,PT_EAX(%esp)
11946 jmp resume_userspace
11947 -END(syscall_fault)
11948 +ENDPROC(syscall_fault)
11949
11950 syscall_badsys:
11951 movl $-ENOSYS,PT_EAX(%esp)
11952 jmp resume_userspace
11953 -END(syscall_badsys)
11954 +ENDPROC(syscall_badsys)
11955 CFI_ENDPROC
11956 /*
11957 * End of kprobes section
11958 @@ -752,6 +964,36 @@ ptregs_clone:
11959 CFI_ENDPROC
11960 ENDPROC(ptregs_clone)
11961
11962 + ALIGN;
11963 +ENTRY(kernel_execve)
11964 + CFI_STARTPROC
11965 + pushl_cfi %ebp
11966 + sub $PT_OLDSS+4,%esp
11967 + pushl_cfi %edi
11968 + pushl_cfi %ecx
11969 + pushl_cfi %eax
11970 + lea 3*4(%esp),%edi
11971 + mov $PT_OLDSS/4+1,%ecx
11972 + xorl %eax,%eax
11973 + rep stosl
11974 + popl_cfi %eax
11975 + popl_cfi %ecx
11976 + popl_cfi %edi
11977 + movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
11978 + pushl_cfi %esp
11979 + call sys_execve
11980 + add $4,%esp
11981 + CFI_ADJUST_CFA_OFFSET -4
11982 + GET_THREAD_INFO(%ebp)
11983 + test %eax,%eax
11984 + jz syscall_exit
11985 + add $PT_OLDSS+4,%esp
11986 + CFI_ADJUST_CFA_OFFSET -PT_OLDSS-4
11987 + popl_cfi %ebp
11988 + ret
11989 + CFI_ENDPROC
11990 +ENDPROC(kernel_execve)
11991 +
11992 .macro FIXUP_ESPFIX_STACK
11993 /*
11994 * Switch back for ESPFIX stack to the normal zerobased stack
11995 @@ -761,8 +1003,15 @@ ENDPROC(ptregs_clone)
11996 * normal stack and adjusts ESP with the matching offset.
11997 */
11998 /* fixup the stack */
11999 - mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */
12000 - mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */
12001 +#ifdef CONFIG_SMP
12002 + movl PER_CPU_VAR(cpu_number), %ebx
12003 + shll $PAGE_SHIFT_asm, %ebx
12004 + addl $cpu_gdt_table, %ebx
12005 +#else
12006 + movl $cpu_gdt_table, %ebx
12007 +#endif
12008 + mov 4 + GDT_ESPFIX_SS, %al /* bits 16..23 */
12009 + mov 7 + GDT_ESPFIX_SS, %ah /* bits 24..31 */
12010 shl $16, %eax
12011 addl %esp, %eax /* the adjusted stack pointer */
12012 pushl_cfi $__KERNEL_DS
12013 @@ -815,7 +1064,7 @@ vector=vector+1
12014 .endr
12015 2: jmp common_interrupt
12016 .endr
12017 -END(irq_entries_start)
12018 +ENDPROC(irq_entries_start)
12019
12020 .previous
12021 END(interrupt)
12022 @@ -863,7 +1112,7 @@ ENTRY(coprocessor_error)
12023 pushl_cfi $do_coprocessor_error
12024 jmp error_code
12025 CFI_ENDPROC
12026 -END(coprocessor_error)
12027 +ENDPROC(coprocessor_error)
12028
12029 ENTRY(simd_coprocessor_error)
12030 RING0_INT_FRAME
12031 @@ -889,7 +1138,7 @@ ENTRY(simd_coprocessor_error)
12032 #endif
12033 jmp error_code
12034 CFI_ENDPROC
12035 -END(simd_coprocessor_error)
12036 +ENDPROC(simd_coprocessor_error)
12037
12038 ENTRY(device_not_available)
12039 RING0_INT_FRAME
12040 @@ -897,7 +1146,7 @@ ENTRY(device_not_available)
12041 pushl_cfi $do_device_not_available
12042 jmp error_code
12043 CFI_ENDPROC
12044 -END(device_not_available)
12045 +ENDPROC(device_not_available)
12046
12047 #ifdef CONFIG_PARAVIRT
12048 ENTRY(native_iret)
12049 @@ -906,12 +1155,12 @@ ENTRY(native_iret)
12050 .align 4
12051 .long native_iret, iret_exc
12052 .previous
12053 -END(native_iret)
12054 +ENDPROC(native_iret)
12055
12056 ENTRY(native_irq_enable_sysexit)
12057 sti
12058 sysexit
12059 -END(native_irq_enable_sysexit)
12060 +ENDPROC(native_irq_enable_sysexit)
12061 #endif
12062
12063 ENTRY(overflow)
12064 @@ -920,7 +1169,7 @@ ENTRY(overflow)
12065 pushl_cfi $do_overflow
12066 jmp error_code
12067 CFI_ENDPROC
12068 -END(overflow)
12069 +ENDPROC(overflow)
12070
12071 ENTRY(bounds)
12072 RING0_INT_FRAME
12073 @@ -928,7 +1177,7 @@ ENTRY(bounds)
12074 pushl_cfi $do_bounds
12075 jmp error_code
12076 CFI_ENDPROC
12077 -END(bounds)
12078 +ENDPROC(bounds)
12079
12080 ENTRY(invalid_op)
12081 RING0_INT_FRAME
12082 @@ -936,7 +1185,7 @@ ENTRY(invalid_op)
12083 pushl_cfi $do_invalid_op
12084 jmp error_code
12085 CFI_ENDPROC
12086 -END(invalid_op)
12087 +ENDPROC(invalid_op)
12088
12089 ENTRY(coprocessor_segment_overrun)
12090 RING0_INT_FRAME
12091 @@ -944,35 +1193,35 @@ ENTRY(coprocessor_segment_overrun)
12092 pushl_cfi $do_coprocessor_segment_overrun
12093 jmp error_code
12094 CFI_ENDPROC
12095 -END(coprocessor_segment_overrun)
12096 +ENDPROC(coprocessor_segment_overrun)
12097
12098 ENTRY(invalid_TSS)
12099 RING0_EC_FRAME
12100 pushl_cfi $do_invalid_TSS
12101 jmp error_code
12102 CFI_ENDPROC
12103 -END(invalid_TSS)
12104 +ENDPROC(invalid_TSS)
12105
12106 ENTRY(segment_not_present)
12107 RING0_EC_FRAME
12108 pushl_cfi $do_segment_not_present
12109 jmp error_code
12110 CFI_ENDPROC
12111 -END(segment_not_present)
12112 +ENDPROC(segment_not_present)
12113
12114 ENTRY(stack_segment)
12115 RING0_EC_FRAME
12116 pushl_cfi $do_stack_segment
12117 jmp error_code
12118 CFI_ENDPROC
12119 -END(stack_segment)
12120 +ENDPROC(stack_segment)
12121
12122 ENTRY(alignment_check)
12123 RING0_EC_FRAME
12124 pushl_cfi $do_alignment_check
12125 jmp error_code
12126 CFI_ENDPROC
12127 -END(alignment_check)
12128 +ENDPROC(alignment_check)
12129
12130 ENTRY(divide_error)
12131 RING0_INT_FRAME
12132 @@ -980,7 +1229,7 @@ ENTRY(divide_error)
12133 pushl_cfi $do_divide_error
12134 jmp error_code
12135 CFI_ENDPROC
12136 -END(divide_error)
12137 +ENDPROC(divide_error)
12138
12139 #ifdef CONFIG_X86_MCE
12140 ENTRY(machine_check)
12141 @@ -989,7 +1238,7 @@ ENTRY(machine_check)
12142 pushl_cfi machine_check_vector
12143 jmp error_code
12144 CFI_ENDPROC
12145 -END(machine_check)
12146 +ENDPROC(machine_check)
12147 #endif
12148
12149 ENTRY(spurious_interrupt_bug)
12150 @@ -998,7 +1247,7 @@ ENTRY(spurious_interrupt_bug)
12151 pushl_cfi $do_spurious_interrupt_bug
12152 jmp error_code
12153 CFI_ENDPROC
12154 -END(spurious_interrupt_bug)
12155 +ENDPROC(spurious_interrupt_bug)
12156 /*
12157 * End of kprobes section
12158 */
12159 @@ -1113,7 +1362,7 @@ BUILD_INTERRUPT3(xen_hvm_callback_vector
12160
12161 ENTRY(mcount)
12162 ret
12163 -END(mcount)
12164 +ENDPROC(mcount)
12165
12166 ENTRY(ftrace_caller)
12167 cmpl $0, function_trace_stop
12168 @@ -1142,7 +1391,7 @@ ftrace_graph_call:
12169 .globl ftrace_stub
12170 ftrace_stub:
12171 ret
12172 -END(ftrace_caller)
12173 +ENDPROC(ftrace_caller)
12174
12175 #else /* ! CONFIG_DYNAMIC_FTRACE */
12176
12177 @@ -1178,7 +1427,7 @@ trace:
12178 popl %ecx
12179 popl %eax
12180 jmp ftrace_stub
12181 -END(mcount)
12182 +ENDPROC(mcount)
12183 #endif /* CONFIG_DYNAMIC_FTRACE */
12184 #endif /* CONFIG_FUNCTION_TRACER */
12185
12186 @@ -1199,7 +1448,7 @@ ENTRY(ftrace_graph_caller)
12187 popl %ecx
12188 popl %eax
12189 ret
12190 -END(ftrace_graph_caller)
12191 +ENDPROC(ftrace_graph_caller)
12192
12193 .globl return_to_handler
12194 return_to_handler:
12195 @@ -1213,7 +1462,6 @@ return_to_handler:
12196 jmp *%ecx
12197 #endif
12198
12199 -.section .rodata,"a"
12200 #include "syscall_table_32.S"
12201
12202 syscall_table_size=(.-sys_call_table)
12203 @@ -1259,15 +1507,18 @@ error_code:
12204 movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
12205 REG_TO_PTGS %ecx
12206 SET_KERNEL_GS %ecx
12207 - movl $(__USER_DS), %ecx
12208 + movl $(__KERNEL_DS), %ecx
12209 movl %ecx, %ds
12210 movl %ecx, %es
12211 +
12212 + pax_enter_kernel
12213 +
12214 TRACE_IRQS_OFF
12215 movl %esp,%eax # pt_regs pointer
12216 call *%edi
12217 jmp ret_from_exception
12218 CFI_ENDPROC
12219 -END(page_fault)
12220 +ENDPROC(page_fault)
12221
12222 /*
12223 * Debug traps and NMI can happen at the one SYSENTER instruction
12224 @@ -1309,7 +1560,7 @@ debug_stack_correct:
12225 call do_debug
12226 jmp ret_from_exception
12227 CFI_ENDPROC
12228 -END(debug)
12229 +ENDPROC(debug)
12230
12231 /*
12232 * NMI is doubly nasty. It can happen _while_ we're handling
12233 @@ -1346,6 +1597,9 @@ nmi_stack_correct:
12234 xorl %edx,%edx # zero error code
12235 movl %esp,%eax # pt_regs pointer
12236 call do_nmi
12237 +
12238 + pax_exit_kernel
12239 +
12240 jmp restore_all_notrace
12241 CFI_ENDPROC
12242
12243 @@ -1382,12 +1636,15 @@ nmi_espfix_stack:
12244 FIXUP_ESPFIX_STACK # %eax == %esp
12245 xorl %edx,%edx # zero error code
12246 call do_nmi
12247 +
12248 + pax_exit_kernel
12249 +
12250 RESTORE_REGS
12251 lss 12+4(%esp), %esp # back to espfix stack
12252 CFI_ADJUST_CFA_OFFSET -24
12253 jmp irq_return
12254 CFI_ENDPROC
12255 -END(nmi)
12256 +ENDPROC(nmi)
12257
12258 ENTRY(int3)
12259 RING0_INT_FRAME
12260 @@ -1399,14 +1656,14 @@ ENTRY(int3)
12261 call do_int3
12262 jmp ret_from_exception
12263 CFI_ENDPROC
12264 -END(int3)
12265 +ENDPROC(int3)
12266
12267 ENTRY(general_protection)
12268 RING0_EC_FRAME
12269 pushl_cfi $do_general_protection
12270 jmp error_code
12271 CFI_ENDPROC
12272 -END(general_protection)
12273 +ENDPROC(general_protection)
12274
12275 #ifdef CONFIG_KVM_GUEST
12276 ENTRY(async_page_fault)
12277 @@ -1414,7 +1671,7 @@ ENTRY(async_page_fault)
12278 pushl_cfi $do_async_page_fault
12279 jmp error_code
12280 CFI_ENDPROC
12281 -END(async_page_fault)
12282 +ENDPROC(async_page_fault)
12283 #endif
12284
12285 /*
12286 diff -urNp linux-3.0.8/arch/x86/kernel/entry_64.S linux-3.0.8/arch/x86/kernel/entry_64.S
12287 --- linux-3.0.8/arch/x86/kernel/entry_64.S 2011-07-21 22:17:23.000000000 -0400
12288 +++ linux-3.0.8/arch/x86/kernel/entry_64.S 2011-10-20 04:46:01.000000000 -0400
12289 @@ -53,6 +53,8 @@
12290 #include <asm/paravirt.h>
12291 #include <asm/ftrace.h>
12292 #include <asm/percpu.h>
12293 +#include <asm/pgtable.h>
12294 +#include <asm/alternative-asm.h>
12295
12296 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
12297 #include <linux/elf-em.h>
12298 @@ -66,8 +68,9 @@
12299 #ifdef CONFIG_FUNCTION_TRACER
12300 #ifdef CONFIG_DYNAMIC_FTRACE
12301 ENTRY(mcount)
12302 + pax_force_retaddr
12303 retq
12304 -END(mcount)
12305 +ENDPROC(mcount)
12306
12307 ENTRY(ftrace_caller)
12308 cmpl $0, function_trace_stop
12309 @@ -90,8 +93,9 @@ GLOBAL(ftrace_graph_call)
12310 #endif
12311
12312 GLOBAL(ftrace_stub)
12313 + pax_force_retaddr
12314 retq
12315 -END(ftrace_caller)
12316 +ENDPROC(ftrace_caller)
12317
12318 #else /* ! CONFIG_DYNAMIC_FTRACE */
12319 ENTRY(mcount)
12320 @@ -110,6 +114,7 @@ ENTRY(mcount)
12321 #endif
12322
12323 GLOBAL(ftrace_stub)
12324 + pax_force_retaddr
12325 retq
12326
12327 trace:
12328 @@ -119,12 +124,13 @@ trace:
12329 movq 8(%rbp), %rsi
12330 subq $MCOUNT_INSN_SIZE, %rdi
12331
12332 + pax_force_fptr ftrace_trace_function
12333 call *ftrace_trace_function
12334
12335 MCOUNT_RESTORE_FRAME
12336
12337 jmp ftrace_stub
12338 -END(mcount)
12339 +ENDPROC(mcount)
12340 #endif /* CONFIG_DYNAMIC_FTRACE */
12341 #endif /* CONFIG_FUNCTION_TRACER */
12342
12343 @@ -144,8 +150,9 @@ ENTRY(ftrace_graph_caller)
12344
12345 MCOUNT_RESTORE_FRAME
12346
12347 + pax_force_retaddr
12348 retq
12349 -END(ftrace_graph_caller)
12350 +ENDPROC(ftrace_graph_caller)
12351
12352 GLOBAL(return_to_handler)
12353 subq $24, %rsp
12354 @@ -161,6 +168,7 @@ GLOBAL(return_to_handler)
12355 movq 8(%rsp), %rdx
12356 movq (%rsp), %rax
12357 addq $24, %rsp
12358 + pax_force_fptr %rdi
12359 jmp *%rdi
12360 #endif
12361
12362 @@ -176,6 +184,269 @@ ENTRY(native_usergs_sysret64)
12363 ENDPROC(native_usergs_sysret64)
12364 #endif /* CONFIG_PARAVIRT */
12365
12366 + .macro ljmpq sel, off
12367 +#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
12368 + .byte 0x48; ljmp *1234f(%rip)
12369 + .pushsection .rodata
12370 + .align 16
12371 + 1234: .quad \off; .word \sel
12372 + .popsection
12373 +#else
12374 + pushq $\sel
12375 + pushq $\off
12376 + lretq
12377 +#endif
12378 + .endm
12379 +
12380 + .macro pax_enter_kernel
12381 +#ifdef CONFIG_PAX_KERNEXEC
12382 + call pax_enter_kernel
12383 +#endif
12384 + .endm
12385 +
12386 + .macro pax_exit_kernel
12387 +#ifdef CONFIG_PAX_KERNEXEC
12388 + call pax_exit_kernel
12389 +#endif
12390 + .endm
12391 +
12392 +#ifdef CONFIG_PAX_KERNEXEC
12393 +ENTRY(pax_enter_kernel)
12394 + pushq %rdi
12395 +
12396 +#ifdef CONFIG_PARAVIRT
12397 + PV_SAVE_REGS(CLBR_RDI)
12398 +#endif
12399 +
12400 + GET_CR0_INTO_RDI
12401 + bts $16,%rdi
12402 + jnc 1f
12403 + mov %cs,%edi
12404 + cmp $__KERNEL_CS,%edi
12405 + jz 3f
12406 + ljmpq __KERNEL_CS,3f
12407 +1: ljmpq __KERNEXEC_KERNEL_CS,2f
12408 +2: SET_RDI_INTO_CR0
12409 +3:
12410 +
12411 +#ifdef CONFIG_PARAVIRT
12412 + PV_RESTORE_REGS(CLBR_RDI)
12413 +#endif
12414 +
12415 + popq %rdi
12416 + pax_force_retaddr
12417 + retq
12418 +ENDPROC(pax_enter_kernel)
12419 +
12420 +ENTRY(pax_exit_kernel)
12421 + pushq %rdi
12422 +
12423 +#ifdef CONFIG_PARAVIRT
12424 + PV_SAVE_REGS(CLBR_RDI)
12425 +#endif
12426 +
12427 + mov %cs,%rdi
12428 + cmp $__KERNEXEC_KERNEL_CS,%edi
12429 + jnz 2f
12430 + GET_CR0_INTO_RDI
12431 + btr $16,%rdi
12432 + ljmpq __KERNEL_CS,1f
12433 +1: SET_RDI_INTO_CR0
12434 +2:
12435 +
12436 +#ifdef CONFIG_PARAVIRT
12437 + PV_RESTORE_REGS(CLBR_RDI);
12438 +#endif
12439 +
12440 + popq %rdi
12441 + pax_force_retaddr
12442 + retq
12443 +ENDPROC(pax_exit_kernel)
12444 +#endif
12445 +
12446 + .macro pax_enter_kernel_user
12447 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12448 + call pax_enter_kernel_user
12449 +#endif
12450 + .endm
12451 +
12452 + .macro pax_exit_kernel_user
12453 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12454 + call pax_exit_kernel_user
12455 +#endif
12456 +#ifdef CONFIG_PAX_RANDKSTACK
12457 + push %rax
12458 + call pax_randomize_kstack
12459 + pop %rax
12460 +#endif
12461 + .endm
12462 +
12463 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12464 +ENTRY(pax_enter_kernel_user)
12465 + pushq %rdi
12466 + pushq %rbx
12467 +
12468 +#ifdef CONFIG_PARAVIRT
12469 + PV_SAVE_REGS(CLBR_RDI)
12470 +#endif
12471 +
12472 + GET_CR3_INTO_RDI
12473 + mov %rdi,%rbx
12474 + add $__START_KERNEL_map,%rbx
12475 + sub phys_base(%rip),%rbx
12476 +
12477 +#ifdef CONFIG_PARAVIRT
12478 + pushq %rdi
12479 + cmpl $0, pv_info+PARAVIRT_enabled
12480 + jz 1f
12481 + i = 0
12482 + .rept USER_PGD_PTRS
12483 + mov i*8(%rbx),%rsi
12484 + mov $0,%sil
12485 + lea i*8(%rbx),%rdi
12486 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
12487 + i = i + 1
12488 + .endr
12489 + jmp 2f
12490 +1:
12491 +#endif
12492 +
12493 + i = 0
12494 + .rept USER_PGD_PTRS
12495 + movb $0,i*8(%rbx)
12496 + i = i + 1
12497 + .endr
12498 +
12499 +#ifdef CONFIG_PARAVIRT
12500 +2: popq %rdi
12501 +#endif
12502 + SET_RDI_INTO_CR3
12503 +
12504 +#ifdef CONFIG_PAX_KERNEXEC
12505 + GET_CR0_INTO_RDI
12506 + bts $16,%rdi
12507 + SET_RDI_INTO_CR0
12508 +#endif
12509 +
12510 +#ifdef CONFIG_PARAVIRT
12511 + PV_RESTORE_REGS(CLBR_RDI)
12512 +#endif
12513 +
12514 + popq %rbx
12515 + popq %rdi
12516 + pax_force_retaddr
12517 + retq
12518 +ENDPROC(pax_enter_kernel_user)
12519 +
12520 +ENTRY(pax_exit_kernel_user)
12521 + push %rdi
12522 +
12523 +#ifdef CONFIG_PARAVIRT
12524 + pushq %rbx
12525 + PV_SAVE_REGS(CLBR_RDI)
12526 +#endif
12527 +
12528 +#ifdef CONFIG_PAX_KERNEXEC
12529 + GET_CR0_INTO_RDI
12530 + btr $16,%rdi
12531 + SET_RDI_INTO_CR0
12532 +#endif
12533 +
12534 + GET_CR3_INTO_RDI
12535 + add $__START_KERNEL_map,%rdi
12536 + sub phys_base(%rip),%rdi
12537 +
12538 +#ifdef CONFIG_PARAVIRT
12539 + cmpl $0, pv_info+PARAVIRT_enabled
12540 + jz 1f
12541 + mov %rdi,%rbx
12542 + i = 0
12543 + .rept USER_PGD_PTRS
12544 + mov i*8(%rbx),%rsi
12545 + mov $0x67,%sil
12546 + lea i*8(%rbx),%rdi
12547 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
12548 + i = i + 1
12549 + .endr
12550 + jmp 2f
12551 +1:
12552 +#endif
12553 +
12554 + i = 0
12555 + .rept USER_PGD_PTRS
12556 + movb $0x67,i*8(%rdi)
12557 + i = i + 1
12558 + .endr
12559 +
12560 +#ifdef CONFIG_PARAVIRT
12561 +2: PV_RESTORE_REGS(CLBR_RDI)
12562 + popq %rbx
12563 +#endif
12564 +
12565 + popq %rdi
12566 + pax_force_retaddr
12567 + retq
12568 +ENDPROC(pax_exit_kernel_user)
12569 +#endif
12570 +
12571 + .macro pax_erase_kstack
12572 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12573 + call pax_erase_kstack
12574 +#endif
12575 + .endm
12576 +
12577 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12578 +/*
12579 + * r10: thread_info
12580 + * rcx, rdx: can be clobbered
12581 + */
12582 +ENTRY(pax_erase_kstack)
12583 + pushq %rdi
12584 + pushq %rax
12585 + pushq %r10
12586 +
12587 + GET_THREAD_INFO(%r10)
12588 + mov TI_lowest_stack(%r10), %rdi
12589 + mov $-0xBEEF, %rax
12590 + std
12591 +
12592 +1: mov %edi, %ecx
12593 + and $THREAD_SIZE_asm - 1, %ecx
12594 + shr $3, %ecx
12595 + repne scasq
12596 + jecxz 2f
12597 +
12598 + cmp $2*8, %ecx
12599 + jc 2f
12600 +
12601 + mov $2*8, %ecx
12602 + repe scasq
12603 + jecxz 2f
12604 + jne 1b
12605 +
12606 +2: cld
12607 + mov %esp, %ecx
12608 + sub %edi, %ecx
12609 +
12610 + cmp $THREAD_SIZE_asm, %rcx
12611 + jb 3f
12612 + ud2
12613 +3:
12614 +
12615 + shr $3, %ecx
12616 + rep stosq
12617 +
12618 + mov TI_task_thread_sp0(%r10), %rdi
12619 + sub $256, %rdi
12620 + mov %rdi, TI_lowest_stack(%r10)
12621 +
12622 + popq %r10
12623 + popq %rax
12624 + popq %rdi
12625 + pax_force_retaddr
12626 + ret
12627 +ENDPROC(pax_erase_kstack)
12628 +#endif
12629
12630 .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
12631 #ifdef CONFIG_TRACE_IRQFLAGS
12632 @@ -318,7 +589,7 @@ ENTRY(save_args)
12633 leaq -RBP+8(%rsp),%rdi /* arg1 for handler */
12634 movq_cfi rbp, 8 /* push %rbp */
12635 leaq 8(%rsp), %rbp /* mov %rsp, %ebp */
12636 - testl $3, CS(%rdi)
12637 + testb $3, CS(%rdi)
12638 je 1f
12639 SWAPGS
12640 /*
12641 @@ -338,9 +609,10 @@ ENTRY(save_args)
12642 * We entered an interrupt context - irqs are off:
12643 */
12644 2: TRACE_IRQS_OFF
12645 + pax_force_retaddr
12646 ret
12647 CFI_ENDPROC
12648 -END(save_args)
12649 +ENDPROC(save_args)
12650 .popsection
12651
12652 ENTRY(save_rest)
12653 @@ -354,9 +626,10 @@ ENTRY(save_rest)
12654 movq_cfi r15, R15+16
12655 movq %r11, 8(%rsp) /* return address */
12656 FIXUP_TOP_OF_STACK %r11, 16
12657 + pax_force_retaddr
12658 ret
12659 CFI_ENDPROC
12660 -END(save_rest)
12661 +ENDPROC(save_rest)
12662
12663 /* save complete stack frame */
12664 .pushsection .kprobes.text, "ax"
12665 @@ -385,9 +658,10 @@ ENTRY(save_paranoid)
12666 js 1f /* negative -> in kernel */
12667 SWAPGS
12668 xorl %ebx,%ebx
12669 -1: ret
12670 +1: pax_force_retaddr
12671 + ret
12672 CFI_ENDPROC
12673 -END(save_paranoid)
12674 +ENDPROC(save_paranoid)
12675 .popsection
12676
12677 /*
12678 @@ -409,7 +683,7 @@ ENTRY(ret_from_fork)
12679
12680 RESTORE_REST
12681
12682 - testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
12683 + testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
12684 je int_ret_from_sys_call
12685
12686 testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
12687 @@ -419,7 +693,7 @@ ENTRY(ret_from_fork)
12688 jmp ret_from_sys_call # go to the SYSRET fastpath
12689
12690 CFI_ENDPROC
12691 -END(ret_from_fork)
12692 +ENDPROC(ret_from_fork)
12693
12694 /*
12695 * System call entry. Up to 6 arguments in registers are supported.
12696 @@ -455,7 +729,7 @@ END(ret_from_fork)
12697 ENTRY(system_call)
12698 CFI_STARTPROC simple
12699 CFI_SIGNAL_FRAME
12700 - CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
12701 + CFI_DEF_CFA rsp,0
12702 CFI_REGISTER rip,rcx
12703 /*CFI_REGISTER rflags,r11*/
12704 SWAPGS_UNSAFE_STACK
12705 @@ -468,12 +742,13 @@ ENTRY(system_call_after_swapgs)
12706
12707 movq %rsp,PER_CPU_VAR(old_rsp)
12708 movq PER_CPU_VAR(kernel_stack),%rsp
12709 + pax_enter_kernel_user
12710 /*
12711 * No need to follow this irqs off/on section - it's straight
12712 * and short:
12713 */
12714 ENABLE_INTERRUPTS(CLBR_NONE)
12715 - SAVE_ARGS 8,1
12716 + SAVE_ARGS 8*6,1
12717 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
12718 movq %rcx,RIP-ARGOFFSET(%rsp)
12719 CFI_REL_OFFSET rip,RIP-ARGOFFSET
12720 @@ -502,6 +777,8 @@ sysret_check:
12721 andl %edi,%edx
12722 jnz sysret_careful
12723 CFI_REMEMBER_STATE
12724 + pax_exit_kernel_user
12725 + pax_erase_kstack
12726 /*
12727 * sysretq will re-enable interrupts:
12728 */
12729 @@ -560,6 +837,9 @@ auditsys:
12730 movq %rax,%rsi /* 2nd arg: syscall number */
12731 movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
12732 call audit_syscall_entry
12733 +
12734 + pax_erase_kstack
12735 +
12736 LOAD_ARGS 0 /* reload call-clobbered registers */
12737 jmp system_call_fastpath
12738
12739 @@ -590,6 +870,9 @@ tracesys:
12740 FIXUP_TOP_OF_STACK %rdi
12741 movq %rsp,%rdi
12742 call syscall_trace_enter
12743 +
12744 + pax_erase_kstack
12745 +
12746 /*
12747 * Reload arg registers from stack in case ptrace changed them.
12748 * We don't reload %rax because syscall_trace_enter() returned
12749 @@ -611,7 +894,7 @@ tracesys:
12750 GLOBAL(int_ret_from_sys_call)
12751 DISABLE_INTERRUPTS(CLBR_NONE)
12752 TRACE_IRQS_OFF
12753 - testl $3,CS-ARGOFFSET(%rsp)
12754 + testb $3,CS-ARGOFFSET(%rsp)
12755 je retint_restore_args
12756 movl $_TIF_ALLWORK_MASK,%edi
12757 /* edi: mask to check */
12758 @@ -668,7 +951,7 @@ int_restore_rest:
12759 TRACE_IRQS_OFF
12760 jmp int_with_check
12761 CFI_ENDPROC
12762 -END(system_call)
12763 +ENDPROC(system_call)
12764
12765 /*
12766 * Certain special system calls that need to save a complete full stack frame.
12767 @@ -684,7 +967,7 @@ ENTRY(\label)
12768 call \func
12769 jmp ptregscall_common
12770 CFI_ENDPROC
12771 -END(\label)
12772 +ENDPROC(\label)
12773 .endm
12774
12775 PTREGSCALL stub_clone, sys_clone, %r8
12776 @@ -702,9 +985,10 @@ ENTRY(ptregscall_common)
12777 movq_cfi_restore R12+8, r12
12778 movq_cfi_restore RBP+8, rbp
12779 movq_cfi_restore RBX+8, rbx
12780 + pax_force_retaddr
12781 ret $REST_SKIP /* pop extended registers */
12782 CFI_ENDPROC
12783 -END(ptregscall_common)
12784 +ENDPROC(ptregscall_common)
12785
12786 ENTRY(stub_execve)
12787 CFI_STARTPROC
12788 @@ -719,7 +1003,7 @@ ENTRY(stub_execve)
12789 RESTORE_REST
12790 jmp int_ret_from_sys_call
12791 CFI_ENDPROC
12792 -END(stub_execve)
12793 +ENDPROC(stub_execve)
12794
12795 /*
12796 * sigreturn is special because it needs to restore all registers on return.
12797 @@ -737,7 +1021,7 @@ ENTRY(stub_rt_sigreturn)
12798 RESTORE_REST
12799 jmp int_ret_from_sys_call
12800 CFI_ENDPROC
12801 -END(stub_rt_sigreturn)
12802 +ENDPROC(stub_rt_sigreturn)
12803
12804 /*
12805 * Build the entry stubs and pointer table with some assembler magic.
12806 @@ -772,7 +1056,7 @@ vector=vector+1
12807 2: jmp common_interrupt
12808 .endr
12809 CFI_ENDPROC
12810 -END(irq_entries_start)
12811 +ENDPROC(irq_entries_start)
12812
12813 .previous
12814 END(interrupt)
12815 @@ -793,6 +1077,16 @@ END(interrupt)
12816 CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP
12817 call save_args
12818 PARTIAL_FRAME 0
12819 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12820 + testb $3, CS(%rdi)
12821 + jnz 1f
12822 + pax_enter_kernel
12823 + jmp 2f
12824 +1: pax_enter_kernel_user
12825 +2:
12826 +#else
12827 + pax_enter_kernel
12828 +#endif
12829 call \func
12830 .endm
12831
12832 @@ -825,7 +1119,7 @@ ret_from_intr:
12833 CFI_ADJUST_CFA_OFFSET -8
12834 exit_intr:
12835 GET_THREAD_INFO(%rcx)
12836 - testl $3,CS-ARGOFFSET(%rsp)
12837 + testb $3,CS-ARGOFFSET(%rsp)
12838 je retint_kernel
12839
12840 /* Interrupt came from user space */
12841 @@ -847,12 +1141,16 @@ retint_swapgs: /* return to user-space
12842 * The iretq could re-enable interrupts:
12843 */
12844 DISABLE_INTERRUPTS(CLBR_ANY)
12845 + pax_exit_kernel_user
12846 + pax_erase_kstack
12847 TRACE_IRQS_IRETQ
12848 SWAPGS
12849 jmp restore_args
12850
12851 retint_restore_args: /* return to kernel space */
12852 DISABLE_INTERRUPTS(CLBR_ANY)
12853 + pax_exit_kernel
12854 + pax_force_retaddr RIP-ARGOFFSET
12855 /*
12856 * The iretq could re-enable interrupts:
12857 */
12858 @@ -941,7 +1239,7 @@ ENTRY(retint_kernel)
12859 #endif
12860
12861 CFI_ENDPROC
12862 -END(common_interrupt)
12863 +ENDPROC(common_interrupt)
12864 /*
12865 * End of kprobes section
12866 */
12867 @@ -957,7 +1255,7 @@ ENTRY(\sym)
12868 interrupt \do_sym
12869 jmp ret_from_intr
12870 CFI_ENDPROC
12871 -END(\sym)
12872 +ENDPROC(\sym)
12873 .endm
12874
12875 #ifdef CONFIG_SMP
12876 @@ -1027,12 +1325,22 @@ ENTRY(\sym)
12877 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
12878 call error_entry
12879 DEFAULT_FRAME 0
12880 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12881 + testb $3, CS(%rsp)
12882 + jnz 1f
12883 + pax_enter_kernel
12884 + jmp 2f
12885 +1: pax_enter_kernel_user
12886 +2:
12887 +#else
12888 + pax_enter_kernel
12889 +#endif
12890 movq %rsp,%rdi /* pt_regs pointer */
12891 xorl %esi,%esi /* no error code */
12892 call \do_sym
12893 jmp error_exit /* %ebx: no swapgs flag */
12894 CFI_ENDPROC
12895 -END(\sym)
12896 +ENDPROC(\sym)
12897 .endm
12898
12899 .macro paranoidzeroentry sym do_sym
12900 @@ -1044,15 +1352,25 @@ ENTRY(\sym)
12901 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
12902 call save_paranoid
12903 TRACE_IRQS_OFF
12904 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12905 + testb $3, CS(%rsp)
12906 + jnz 1f
12907 + pax_enter_kernel
12908 + jmp 2f
12909 +1: pax_enter_kernel_user
12910 +2:
12911 +#else
12912 + pax_enter_kernel
12913 +#endif
12914 movq %rsp,%rdi /* pt_regs pointer */
12915 xorl %esi,%esi /* no error code */
12916 call \do_sym
12917 jmp paranoid_exit /* %ebx: no swapgs flag */
12918 CFI_ENDPROC
12919 -END(\sym)
12920 +ENDPROC(\sym)
12921 .endm
12922
12923 -#define INIT_TSS_IST(x) PER_CPU_VAR(init_tss) + (TSS_ist + ((x) - 1) * 8)
12924 +#define INIT_TSS_IST(x) (TSS_ist + ((x) - 1) * 8)(%r12)
12925 .macro paranoidzeroentry_ist sym do_sym ist
12926 ENTRY(\sym)
12927 INTR_FRAME
12928 @@ -1062,14 +1380,30 @@ ENTRY(\sym)
12929 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
12930 call save_paranoid
12931 TRACE_IRQS_OFF
12932 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12933 + testb $3, CS(%rsp)
12934 + jnz 1f
12935 + pax_enter_kernel
12936 + jmp 2f
12937 +1: pax_enter_kernel_user
12938 +2:
12939 +#else
12940 + pax_enter_kernel
12941 +#endif
12942 movq %rsp,%rdi /* pt_regs pointer */
12943 xorl %esi,%esi /* no error code */
12944 +#ifdef CONFIG_SMP
12945 + imul $TSS_size, PER_CPU_VAR(cpu_number), %r12d
12946 + lea init_tss(%r12), %r12
12947 +#else
12948 + lea init_tss(%rip), %r12
12949 +#endif
12950 subq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
12951 call \do_sym
12952 addq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
12953 jmp paranoid_exit /* %ebx: no swapgs flag */
12954 CFI_ENDPROC
12955 -END(\sym)
12956 +ENDPROC(\sym)
12957 .endm
12958
12959 .macro errorentry sym do_sym
12960 @@ -1080,13 +1414,23 @@ ENTRY(\sym)
12961 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
12962 call error_entry
12963 DEFAULT_FRAME 0
12964 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12965 + testb $3, CS(%rsp)
12966 + jnz 1f
12967 + pax_enter_kernel
12968 + jmp 2f
12969 +1: pax_enter_kernel_user
12970 +2:
12971 +#else
12972 + pax_enter_kernel
12973 +#endif
12974 movq %rsp,%rdi /* pt_regs pointer */
12975 movq ORIG_RAX(%rsp),%rsi /* get error code */
12976 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
12977 call \do_sym
12978 jmp error_exit /* %ebx: no swapgs flag */
12979 CFI_ENDPROC
12980 -END(\sym)
12981 +ENDPROC(\sym)
12982 .endm
12983
12984 /* error code is on the stack already */
12985 @@ -1099,13 +1443,23 @@ ENTRY(\sym)
12986 call save_paranoid
12987 DEFAULT_FRAME 0
12988 TRACE_IRQS_OFF
12989 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12990 + testb $3, CS(%rsp)
12991 + jnz 1f
12992 + pax_enter_kernel
12993 + jmp 2f
12994 +1: pax_enter_kernel_user
12995 +2:
12996 +#else
12997 + pax_enter_kernel
12998 +#endif
12999 movq %rsp,%rdi /* pt_regs pointer */
13000 movq ORIG_RAX(%rsp),%rsi /* get error code */
13001 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
13002 call \do_sym
13003 jmp paranoid_exit /* %ebx: no swapgs flag */
13004 CFI_ENDPROC
13005 -END(\sym)
13006 +ENDPROC(\sym)
13007 .endm
13008
13009 zeroentry divide_error do_divide_error
13010 @@ -1134,9 +1488,10 @@ gs_change:
13011 2: mfence /* workaround */
13012 SWAPGS
13013 popfq_cfi
13014 + pax_force_retaddr
13015 ret
13016 CFI_ENDPROC
13017 -END(native_load_gs_index)
13018 +ENDPROC(native_load_gs_index)
13019
13020 .section __ex_table,"a"
13021 .align 8
13022 @@ -1158,13 +1513,14 @@ ENTRY(kernel_thread_helper)
13023 * Here we are in the child and the registers are set as they were
13024 * at kernel_thread() invocation in the parent.
13025 */
13026 + pax_force_fptr %rsi
13027 call *%rsi
13028 # exit
13029 mov %eax, %edi
13030 call do_exit
13031 ud2 # padding for call trace
13032 CFI_ENDPROC
13033 -END(kernel_thread_helper)
13034 +ENDPROC(kernel_thread_helper)
13035
13036 /*
13037 * execve(). This function needs to use IRET, not SYSRET, to set up all state properly.
13038 @@ -1193,9 +1549,10 @@ ENTRY(kernel_execve)
13039 je int_ret_from_sys_call
13040 RESTORE_ARGS
13041 UNFAKE_STACK_FRAME
13042 + pax_force_retaddr
13043 ret
13044 CFI_ENDPROC
13045 -END(kernel_execve)
13046 +ENDPROC(kernel_execve)
13047
13048 /* Call softirq on interrupt stack. Interrupts are off. */
13049 ENTRY(call_softirq)
13050 @@ -1213,9 +1570,10 @@ ENTRY(call_softirq)
13051 CFI_DEF_CFA_REGISTER rsp
13052 CFI_ADJUST_CFA_OFFSET -8
13053 decl PER_CPU_VAR(irq_count)
13054 + pax_force_retaddr
13055 ret
13056 CFI_ENDPROC
13057 -END(call_softirq)
13058 +ENDPROC(call_softirq)
13059
13060 #ifdef CONFIG_XEN
13061 zeroentry xen_hypervisor_callback xen_do_hypervisor_callback
13062 @@ -1253,7 +1611,7 @@ ENTRY(xen_do_hypervisor_callback) # do
13063 decl PER_CPU_VAR(irq_count)
13064 jmp error_exit
13065 CFI_ENDPROC
13066 -END(xen_do_hypervisor_callback)
13067 +ENDPROC(xen_do_hypervisor_callback)
13068
13069 /*
13070 * Hypervisor uses this for application faults while it executes.
13071 @@ -1312,7 +1670,7 @@ ENTRY(xen_failsafe_callback)
13072 SAVE_ALL
13073 jmp error_exit
13074 CFI_ENDPROC
13075 -END(xen_failsafe_callback)
13076 +ENDPROC(xen_failsafe_callback)
13077
13078 apicinterrupt XEN_HVM_EVTCHN_CALLBACK \
13079 xen_hvm_callback_vector xen_evtchn_do_upcall
13080 @@ -1361,16 +1719,31 @@ ENTRY(paranoid_exit)
13081 TRACE_IRQS_OFF
13082 testl %ebx,%ebx /* swapgs needed? */
13083 jnz paranoid_restore
13084 - testl $3,CS(%rsp)
13085 + testb $3,CS(%rsp)
13086 jnz paranoid_userspace
13087 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13088 + pax_exit_kernel
13089 + TRACE_IRQS_IRETQ 0
13090 + SWAPGS_UNSAFE_STACK
13091 + RESTORE_ALL 8
13092 + pax_force_retaddr
13093 + jmp irq_return
13094 +#endif
13095 paranoid_swapgs:
13096 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13097 + pax_exit_kernel_user
13098 +#else
13099 + pax_exit_kernel
13100 +#endif
13101 TRACE_IRQS_IRETQ 0
13102 SWAPGS_UNSAFE_STACK
13103 RESTORE_ALL 8
13104 jmp irq_return
13105 paranoid_restore:
13106 + pax_exit_kernel
13107 TRACE_IRQS_IRETQ 0
13108 RESTORE_ALL 8
13109 + pax_force_retaddr
13110 jmp irq_return
13111 paranoid_userspace:
13112 GET_THREAD_INFO(%rcx)
13113 @@ -1399,7 +1772,7 @@ paranoid_schedule:
13114 TRACE_IRQS_OFF
13115 jmp paranoid_userspace
13116 CFI_ENDPROC
13117 -END(paranoid_exit)
13118 +ENDPROC(paranoid_exit)
13119
13120 /*
13121 * Exception entry point. This expects an error code/orig_rax on the stack.
13122 @@ -1426,12 +1799,13 @@ ENTRY(error_entry)
13123 movq_cfi r14, R14+8
13124 movq_cfi r15, R15+8
13125 xorl %ebx,%ebx
13126 - testl $3,CS+8(%rsp)
13127 + testb $3,CS+8(%rsp)
13128 je error_kernelspace
13129 error_swapgs:
13130 SWAPGS
13131 error_sti:
13132 TRACE_IRQS_OFF
13133 + pax_force_retaddr
13134 ret
13135
13136 /*
13137 @@ -1458,7 +1832,7 @@ bstep_iret:
13138 movq %rcx,RIP+8(%rsp)
13139 jmp error_swapgs
13140 CFI_ENDPROC
13141 -END(error_entry)
13142 +ENDPROC(error_entry)
13143
13144
13145 /* ebx: no swapgs flag (1: don't need swapgs, 0: need it) */
13146 @@ -1478,7 +1852,7 @@ ENTRY(error_exit)
13147 jnz retint_careful
13148 jmp retint_swapgs
13149 CFI_ENDPROC
13150 -END(error_exit)
13151 +ENDPROC(error_exit)
13152
13153
13154 /* runs on exception stack */
13155 @@ -1490,6 +1864,16 @@ ENTRY(nmi)
13156 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
13157 call save_paranoid
13158 DEFAULT_FRAME 0
13159 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13160 + testb $3, CS(%rsp)
13161 + jnz 1f
13162 + pax_enter_kernel
13163 + jmp 2f
13164 +1: pax_enter_kernel_user
13165 +2:
13166 +#else
13167 + pax_enter_kernel
13168 +#endif
13169 /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
13170 movq %rsp,%rdi
13171 movq $-1,%rsi
13172 @@ -1500,12 +1884,28 @@ ENTRY(nmi)
13173 DISABLE_INTERRUPTS(CLBR_NONE)
13174 testl %ebx,%ebx /* swapgs needed? */
13175 jnz nmi_restore
13176 - testl $3,CS(%rsp)
13177 + testb $3,CS(%rsp)
13178 jnz nmi_userspace
13179 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13180 + pax_exit_kernel
13181 + SWAPGS_UNSAFE_STACK
13182 + RESTORE_ALL 8
13183 + pax_force_retaddr
13184 + jmp irq_return
13185 +#endif
13186 nmi_swapgs:
13187 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13188 + pax_exit_kernel_user
13189 +#else
13190 + pax_exit_kernel
13191 +#endif
13192 SWAPGS_UNSAFE_STACK
13193 + RESTORE_ALL 8
13194 + jmp irq_return
13195 nmi_restore:
13196 + pax_exit_kernel
13197 RESTORE_ALL 8
13198 + pax_force_retaddr
13199 jmp irq_return
13200 nmi_userspace:
13201 GET_THREAD_INFO(%rcx)
13202 @@ -1534,14 +1934,14 @@ nmi_schedule:
13203 jmp paranoid_exit
13204 CFI_ENDPROC
13205 #endif
13206 -END(nmi)
13207 +ENDPROC(nmi)
13208
13209 ENTRY(ignore_sysret)
13210 CFI_STARTPROC
13211 mov $-ENOSYS,%eax
13212 sysret
13213 CFI_ENDPROC
13214 -END(ignore_sysret)
13215 +ENDPROC(ignore_sysret)
13216
13217 /*
13218 * End of kprobes section
13219 diff -urNp linux-3.0.8/arch/x86/kernel/ftrace.c linux-3.0.8/arch/x86/kernel/ftrace.c
13220 --- linux-3.0.8/arch/x86/kernel/ftrace.c 2011-07-21 22:17:23.000000000 -0400
13221 +++ linux-3.0.8/arch/x86/kernel/ftrace.c 2011-08-23 21:47:55.000000000 -0400
13222 @@ -126,7 +126,7 @@ static void *mod_code_ip; /* holds the
13223 static const void *mod_code_newcode; /* holds the text to write to the IP */
13224
13225 static unsigned nmi_wait_count;
13226 -static atomic_t nmi_update_count = ATOMIC_INIT(0);
13227 +static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
13228
13229 int ftrace_arch_read_dyn_info(char *buf, int size)
13230 {
13231 @@ -134,7 +134,7 @@ int ftrace_arch_read_dyn_info(char *buf,
13232
13233 r = snprintf(buf, size, "%u %u",
13234 nmi_wait_count,
13235 - atomic_read(&nmi_update_count));
13236 + atomic_read_unchecked(&nmi_update_count));
13237 return r;
13238 }
13239
13240 @@ -177,8 +177,10 @@ void ftrace_nmi_enter(void)
13241
13242 if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
13243 smp_rmb();
13244 + pax_open_kernel();
13245 ftrace_mod_code();
13246 - atomic_inc(&nmi_update_count);
13247 + pax_close_kernel();
13248 + atomic_inc_unchecked(&nmi_update_count);
13249 }
13250 /* Must have previous changes seen before executions */
13251 smp_mb();
13252 @@ -271,6 +273,8 @@ ftrace_modify_code(unsigned long ip, uns
13253 {
13254 unsigned char replaced[MCOUNT_INSN_SIZE];
13255
13256 + ip = ktla_ktva(ip);
13257 +
13258 /*
13259 * Note: Due to modules and __init, code can
13260 * disappear and change, we need to protect against faulting
13261 @@ -327,7 +331,7 @@ int ftrace_update_ftrace_func(ftrace_fun
13262 unsigned char old[MCOUNT_INSN_SIZE], *new;
13263 int ret;
13264
13265 - memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
13266 + memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
13267 new = ftrace_call_replace(ip, (unsigned long)func);
13268 ret = ftrace_modify_code(ip, old, new);
13269
13270 @@ -353,6 +357,8 @@ static int ftrace_mod_jmp(unsigned long
13271 {
13272 unsigned char code[MCOUNT_INSN_SIZE];
13273
13274 + ip = ktla_ktva(ip);
13275 +
13276 if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
13277 return -EFAULT;
13278
13279 diff -urNp linux-3.0.8/arch/x86/kernel/head32.c linux-3.0.8/arch/x86/kernel/head32.c
13280 --- linux-3.0.8/arch/x86/kernel/head32.c 2011-07-21 22:17:23.000000000 -0400
13281 +++ linux-3.0.8/arch/x86/kernel/head32.c 2011-08-23 21:47:55.000000000 -0400
13282 @@ -19,6 +19,7 @@
13283 #include <asm/io_apic.h>
13284 #include <asm/bios_ebda.h>
13285 #include <asm/tlbflush.h>
13286 +#include <asm/boot.h>
13287
13288 static void __init i386_default_early_setup(void)
13289 {
13290 @@ -33,7 +34,7 @@ void __init i386_start_kernel(void)
13291 {
13292 memblock_init();
13293
13294 - memblock_x86_reserve_range(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
13295 + memblock_x86_reserve_range(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
13296
13297 #ifdef CONFIG_BLK_DEV_INITRD
13298 /* Reserve INITRD */
13299 diff -urNp linux-3.0.8/arch/x86/kernel/head_32.S linux-3.0.8/arch/x86/kernel/head_32.S
13300 --- linux-3.0.8/arch/x86/kernel/head_32.S 2011-07-21 22:17:23.000000000 -0400
13301 +++ linux-3.0.8/arch/x86/kernel/head_32.S 2011-08-23 21:47:55.000000000 -0400
13302 @@ -25,6 +25,12 @@
13303 /* Physical address */
13304 #define pa(X) ((X) - __PAGE_OFFSET)
13305
13306 +#ifdef CONFIG_PAX_KERNEXEC
13307 +#define ta(X) (X)
13308 +#else
13309 +#define ta(X) ((X) - __PAGE_OFFSET)
13310 +#endif
13311 +
13312 /*
13313 * References to members of the new_cpu_data structure.
13314 */
13315 @@ -54,11 +60,7 @@
13316 * and small than max_low_pfn, otherwise will waste some page table entries
13317 */
13318
13319 -#if PTRS_PER_PMD > 1
13320 -#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
13321 -#else
13322 -#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
13323 -#endif
13324 +#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
13325
13326 /* Number of possible pages in the lowmem region */
13327 LOWMEM_PAGES = (((1<<32) - __PAGE_OFFSET) >> PAGE_SHIFT)
13328 @@ -77,6 +79,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P
13329 RESERVE_BRK(pagetables, INIT_MAP_SIZE)
13330
13331 /*
13332 + * Real beginning of normal "text" segment
13333 + */
13334 +ENTRY(stext)
13335 +ENTRY(_stext)
13336 +
13337 +/*
13338 * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
13339 * %esi points to the real-mode code as a 32-bit pointer.
13340 * CS and DS must be 4 GB flat segments, but we don't depend on
13341 @@ -84,6 +92,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
13342 * can.
13343 */
13344 __HEAD
13345 +
13346 +#ifdef CONFIG_PAX_KERNEXEC
13347 + jmp startup_32
13348 +/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
13349 +.fill PAGE_SIZE-5,1,0xcc
13350 +#endif
13351 +
13352 ENTRY(startup_32)
13353 movl pa(stack_start),%ecx
13354
13355 @@ -105,6 +120,57 @@ ENTRY(startup_32)
13356 2:
13357 leal -__PAGE_OFFSET(%ecx),%esp
13358
13359 +#ifdef CONFIG_SMP
13360 + movl $pa(cpu_gdt_table),%edi
13361 + movl $__per_cpu_load,%eax
13362 + movw %ax,__KERNEL_PERCPU + 2(%edi)
13363 + rorl $16,%eax
13364 + movb %al,__KERNEL_PERCPU + 4(%edi)
13365 + movb %ah,__KERNEL_PERCPU + 7(%edi)
13366 + movl $__per_cpu_end - 1,%eax
13367 + subl $__per_cpu_start,%eax
13368 + movw %ax,__KERNEL_PERCPU + 0(%edi)
13369 +#endif
13370 +
13371 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13372 + movl $NR_CPUS,%ecx
13373 + movl $pa(cpu_gdt_table),%edi
13374 +1:
13375 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
13376 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
13377 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
13378 + addl $PAGE_SIZE_asm,%edi
13379 + loop 1b
13380 +#endif
13381 +
13382 +#ifdef CONFIG_PAX_KERNEXEC
13383 + movl $pa(boot_gdt),%edi
13384 + movl $__LOAD_PHYSICAL_ADDR,%eax
13385 + movw %ax,__BOOT_CS + 2(%edi)
13386 + rorl $16,%eax
13387 + movb %al,__BOOT_CS + 4(%edi)
13388 + movb %ah,__BOOT_CS + 7(%edi)
13389 + rorl $16,%eax
13390 +
13391 + ljmp $(__BOOT_CS),$1f
13392 +1:
13393 +
13394 + movl $NR_CPUS,%ecx
13395 + movl $pa(cpu_gdt_table),%edi
13396 + addl $__PAGE_OFFSET,%eax
13397 +1:
13398 + movw %ax,__KERNEL_CS + 2(%edi)
13399 + movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
13400 + rorl $16,%eax
13401 + movb %al,__KERNEL_CS + 4(%edi)
13402 + movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
13403 + movb %ah,__KERNEL_CS + 7(%edi)
13404 + movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
13405 + rorl $16,%eax
13406 + addl $PAGE_SIZE_asm,%edi
13407 + loop 1b
13408 +#endif
13409 +
13410 /*
13411 * Clear BSS first so that there are no surprises...
13412 */
13413 @@ -195,8 +261,11 @@ ENTRY(startup_32)
13414 movl %eax, pa(max_pfn_mapped)
13415
13416 /* Do early initialization of the fixmap area */
13417 - movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
13418 - movl %eax,pa(initial_pg_pmd+0x1000*KPMDS-8)
13419 +#ifdef CONFIG_COMPAT_VDSO
13420 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_pg_pmd+0x1000*KPMDS-8)
13421 +#else
13422 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_pg_pmd+0x1000*KPMDS-8)
13423 +#endif
13424 #else /* Not PAE */
13425
13426 page_pde_offset = (__PAGE_OFFSET >> 20);
13427 @@ -226,8 +295,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
13428 movl %eax, pa(max_pfn_mapped)
13429
13430 /* Do early initialization of the fixmap area */
13431 - movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
13432 - movl %eax,pa(initial_page_table+0xffc)
13433 +#ifdef CONFIG_COMPAT_VDSO
13434 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_page_table+0xffc)
13435 +#else
13436 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_page_table+0xffc)
13437 +#endif
13438 #endif
13439
13440 #ifdef CONFIG_PARAVIRT
13441 @@ -241,9 +313,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
13442 cmpl $num_subarch_entries, %eax
13443 jae bad_subarch
13444
13445 - movl pa(subarch_entries)(,%eax,4), %eax
13446 - subl $__PAGE_OFFSET, %eax
13447 - jmp *%eax
13448 + jmp *pa(subarch_entries)(,%eax,4)
13449
13450 bad_subarch:
13451 WEAK(lguest_entry)
13452 @@ -255,10 +325,10 @@ WEAK(xen_entry)
13453 __INITDATA
13454
13455 subarch_entries:
13456 - .long default_entry /* normal x86/PC */
13457 - .long lguest_entry /* lguest hypervisor */
13458 - .long xen_entry /* Xen hypervisor */
13459 - .long default_entry /* Moorestown MID */
13460 + .long ta(default_entry) /* normal x86/PC */
13461 + .long ta(lguest_entry) /* lguest hypervisor */
13462 + .long ta(xen_entry) /* Xen hypervisor */
13463 + .long ta(default_entry) /* Moorestown MID */
13464 num_subarch_entries = (. - subarch_entries) / 4
13465 .previous
13466 #else
13467 @@ -312,6 +382,7 @@ default_entry:
13468 orl %edx,%eax
13469 movl %eax,%cr4
13470
13471 +#ifdef CONFIG_X86_PAE
13472 testb $X86_CR4_PAE, %al # check if PAE is enabled
13473 jz 6f
13474
13475 @@ -340,6 +411,9 @@ default_entry:
13476 /* Make changes effective */
13477 wrmsr
13478
13479 + btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
13480 +#endif
13481 +
13482 6:
13483
13484 /*
13485 @@ -443,7 +517,7 @@ is386: movl $2,%ecx # set MP
13486 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
13487 movl %eax,%ss # after changing gdt.
13488
13489 - movl $(__USER_DS),%eax # DS/ES contains default USER segment
13490 +# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
13491 movl %eax,%ds
13492 movl %eax,%es
13493
13494 @@ -457,15 +531,22 @@ is386: movl $2,%ecx # set MP
13495 */
13496 cmpb $0,ready
13497 jne 1f
13498 - movl $gdt_page,%eax
13499 + movl $cpu_gdt_table,%eax
13500 movl $stack_canary,%ecx
13501 +#ifdef CONFIG_SMP
13502 + addl $__per_cpu_load,%ecx
13503 +#endif
13504 movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
13505 shrl $16, %ecx
13506 movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
13507 movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
13508 1:
13509 -#endif
13510 movl $(__KERNEL_STACK_CANARY),%eax
13511 +#elif defined(CONFIG_PAX_MEMORY_UDEREF)
13512 + movl $(__USER_DS),%eax
13513 +#else
13514 + xorl %eax,%eax
13515 +#endif
13516 movl %eax,%gs
13517
13518 xorl %eax,%eax # Clear LDT
13519 @@ -558,22 +639,22 @@ early_page_fault:
13520 jmp early_fault
13521
13522 early_fault:
13523 - cld
13524 #ifdef CONFIG_PRINTK
13525 + cmpl $1,%ss:early_recursion_flag
13526 + je hlt_loop
13527 + incl %ss:early_recursion_flag
13528 + cld
13529 pusha
13530 movl $(__KERNEL_DS),%eax
13531 movl %eax,%ds
13532 movl %eax,%es
13533 - cmpl $2,early_recursion_flag
13534 - je hlt_loop
13535 - incl early_recursion_flag
13536 movl %cr2,%eax
13537 pushl %eax
13538 pushl %edx /* trapno */
13539 pushl $fault_msg
13540 call printk
13541 +; call dump_stack
13542 #endif
13543 - call dump_stack
13544 hlt_loop:
13545 hlt
13546 jmp hlt_loop
13547 @@ -581,8 +662,11 @@ hlt_loop:
13548 /* This is the default interrupt "handler" :-) */
13549 ALIGN
13550 ignore_int:
13551 - cld
13552 #ifdef CONFIG_PRINTK
13553 + cmpl $2,%ss:early_recursion_flag
13554 + je hlt_loop
13555 + incl %ss:early_recursion_flag
13556 + cld
13557 pushl %eax
13558 pushl %ecx
13559 pushl %edx
13560 @@ -591,9 +675,6 @@ ignore_int:
13561 movl $(__KERNEL_DS),%eax
13562 movl %eax,%ds
13563 movl %eax,%es
13564 - cmpl $2,early_recursion_flag
13565 - je hlt_loop
13566 - incl early_recursion_flag
13567 pushl 16(%esp)
13568 pushl 24(%esp)
13569 pushl 32(%esp)
13570 @@ -622,29 +703,43 @@ ENTRY(initial_code)
13571 /*
13572 * BSS section
13573 */
13574 -__PAGE_ALIGNED_BSS
13575 - .align PAGE_SIZE
13576 #ifdef CONFIG_X86_PAE
13577 +.section .initial_pg_pmd,"a",@progbits
13578 initial_pg_pmd:
13579 .fill 1024*KPMDS,4,0
13580 #else
13581 +.section .initial_page_table,"a",@progbits
13582 ENTRY(initial_page_table)
13583 .fill 1024,4,0
13584 #endif
13585 +.section .initial_pg_fixmap,"a",@progbits
13586 initial_pg_fixmap:
13587 .fill 1024,4,0
13588 +.section .empty_zero_page,"a",@progbits
13589 ENTRY(empty_zero_page)
13590 .fill 4096,1,0
13591 +.section .swapper_pg_dir,"a",@progbits
13592 ENTRY(swapper_pg_dir)
13593 +#ifdef CONFIG_X86_PAE
13594 + .fill 4,8,0
13595 +#else
13596 .fill 1024,4,0
13597 +#endif
13598 +
13599 +/*
13600 + * The IDT has to be page-aligned to simplify the Pentium
13601 + * F0 0F bug workaround.. We have a special link segment
13602 + * for this.
13603 + */
13604 +.section .idt,"a",@progbits
13605 +ENTRY(idt_table)
13606 + .fill 256,8,0
13607
13608 /*
13609 * This starts the data section.
13610 */
13611 #ifdef CONFIG_X86_PAE
13612 -__PAGE_ALIGNED_DATA
13613 - /* Page-aligned for the benefit of paravirt? */
13614 - .align PAGE_SIZE
13615 +.section .initial_page_table,"a",@progbits
13616 ENTRY(initial_page_table)
13617 .long pa(initial_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
13618 # if KPMDS == 3
13619 @@ -663,18 +758,27 @@ ENTRY(initial_page_table)
13620 # error "Kernel PMDs should be 1, 2 or 3"
13621 # endif
13622 .align PAGE_SIZE /* needs to be page-sized too */
13623 +
13624 +#ifdef CONFIG_PAX_PER_CPU_PGD
13625 +ENTRY(cpu_pgd)
13626 + .rept NR_CPUS
13627 + .fill 4,8,0
13628 + .endr
13629 +#endif
13630 +
13631 #endif
13632
13633 .data
13634 .balign 4
13635 ENTRY(stack_start)
13636 - .long init_thread_union+THREAD_SIZE
13637 + .long init_thread_union+THREAD_SIZE-8
13638 +
13639 +ready: .byte 0
13640
13641 +.section .rodata,"a",@progbits
13642 early_recursion_flag:
13643 .long 0
13644
13645 -ready: .byte 0
13646 -
13647 int_msg:
13648 .asciz "Unknown interrupt or fault at: %p %p %p\n"
13649
13650 @@ -707,7 +811,7 @@ fault_msg:
13651 .word 0 # 32 bit align gdt_desc.address
13652 boot_gdt_descr:
13653 .word __BOOT_DS+7
13654 - .long boot_gdt - __PAGE_OFFSET
13655 + .long pa(boot_gdt)
13656
13657 .word 0 # 32-bit align idt_desc.address
13658 idt_descr:
13659 @@ -718,7 +822,7 @@ idt_descr:
13660 .word 0 # 32 bit align gdt_desc.address
13661 ENTRY(early_gdt_descr)
13662 .word GDT_ENTRIES*8-1
13663 - .long gdt_page /* Overwritten for secondary CPUs */
13664 + .long cpu_gdt_table /* Overwritten for secondary CPUs */
13665
13666 /*
13667 * The boot_gdt must mirror the equivalent in setup.S and is
13668 @@ -727,5 +831,65 @@ ENTRY(early_gdt_descr)
13669 .align L1_CACHE_BYTES
13670 ENTRY(boot_gdt)
13671 .fill GDT_ENTRY_BOOT_CS,8,0
13672 - .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
13673 - .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
13674 + .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
13675 + .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
13676 +
13677 + .align PAGE_SIZE_asm
13678 +ENTRY(cpu_gdt_table)
13679 + .rept NR_CPUS
13680 + .quad 0x0000000000000000 /* NULL descriptor */
13681 + .quad 0x0000000000000000 /* 0x0b reserved */
13682 + .quad 0x0000000000000000 /* 0x13 reserved */
13683 + .quad 0x0000000000000000 /* 0x1b reserved */
13684 +
13685 +#ifdef CONFIG_PAX_KERNEXEC
13686 + .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
13687 +#else
13688 + .quad 0x0000000000000000 /* 0x20 unused */
13689 +#endif
13690 +
13691 + .quad 0x0000000000000000 /* 0x28 unused */
13692 + .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
13693 + .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
13694 + .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
13695 + .quad 0x0000000000000000 /* 0x4b reserved */
13696 + .quad 0x0000000000000000 /* 0x53 reserved */
13697 + .quad 0x0000000000000000 /* 0x5b reserved */
13698 +
13699 + .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
13700 + .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
13701 + .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
13702 + .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
13703 +
13704 + .quad 0x0000000000000000 /* 0x80 TSS descriptor */
13705 + .quad 0x0000000000000000 /* 0x88 LDT descriptor */
13706 +
13707 + /*
13708 + * Segments used for calling PnP BIOS have byte granularity.
13709 + * The code segments and data segments have fixed 64k limits,
13710 + * the transfer segment sizes are set at run time.
13711 + */
13712 + .quad 0x00409b000000ffff /* 0x90 32-bit code */
13713 + .quad 0x00009b000000ffff /* 0x98 16-bit code */
13714 + .quad 0x000093000000ffff /* 0xa0 16-bit data */
13715 + .quad 0x0000930000000000 /* 0xa8 16-bit data */
13716 + .quad 0x0000930000000000 /* 0xb0 16-bit data */
13717 +
13718 + /*
13719 + * The APM segments have byte granularity and their bases
13720 + * are set at run time. All have 64k limits.
13721 + */
13722 + .quad 0x00409b000000ffff /* 0xb8 APM CS code */
13723 + .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
13724 + .quad 0x004093000000ffff /* 0xc8 APM DS data */
13725 +
13726 + .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
13727 + .quad 0x0040930000000000 /* 0xd8 - PERCPU */
13728 + .quad 0x0040910000000017 /* 0xe0 - STACK_CANARY */
13729 + .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
13730 + .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
13731 + .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
13732 +
13733 + /* Be sure this is zeroed to avoid false validations in Xen */
13734 + .fill PAGE_SIZE_asm - GDT_SIZE,1,0
13735 + .endr
13736 diff -urNp linux-3.0.8/arch/x86/kernel/head_64.S linux-3.0.8/arch/x86/kernel/head_64.S
13737 --- linux-3.0.8/arch/x86/kernel/head_64.S 2011-07-21 22:17:23.000000000 -0400
13738 +++ linux-3.0.8/arch/x86/kernel/head_64.S 2011-08-23 21:47:55.000000000 -0400
13739 @@ -19,6 +19,7 @@
13740 #include <asm/cache.h>
13741 #include <asm/processor-flags.h>
13742 #include <asm/percpu.h>
13743 +#include <asm/cpufeature.h>
13744
13745 #ifdef CONFIG_PARAVIRT
13746 #include <asm/asm-offsets.h>
13747 @@ -38,6 +39,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET
13748 L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
13749 L4_START_KERNEL = pgd_index(__START_KERNEL_map)
13750 L3_START_KERNEL = pud_index(__START_KERNEL_map)
13751 +L4_VMALLOC_START = pgd_index(VMALLOC_START)
13752 +L3_VMALLOC_START = pud_index(VMALLOC_START)
13753 +L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
13754 +L3_VMEMMAP_START = pud_index(VMEMMAP_START)
13755
13756 .text
13757 __HEAD
13758 @@ -85,35 +90,22 @@ startup_64:
13759 */
13760 addq %rbp, init_level4_pgt + 0(%rip)
13761 addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
13762 + addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
13763 + addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
13764 addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
13765
13766 addq %rbp, level3_ident_pgt + 0(%rip)
13767 +#ifndef CONFIG_XEN
13768 + addq %rbp, level3_ident_pgt + 8(%rip)
13769 +#endif
13770
13771 - addq %rbp, level3_kernel_pgt + (510*8)(%rip)
13772 - addq %rbp, level3_kernel_pgt + (511*8)(%rip)
13773 + addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
13774
13775 - addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
13776 + addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
13777 + addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
13778
13779 - /* Add an Identity mapping if I am above 1G */
13780 - leaq _text(%rip), %rdi
13781 - andq $PMD_PAGE_MASK, %rdi
13782 -
13783 - movq %rdi, %rax
13784 - shrq $PUD_SHIFT, %rax
13785 - andq $(PTRS_PER_PUD - 1), %rax
13786 - jz ident_complete
13787 -
13788 - leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
13789 - leaq level3_ident_pgt(%rip), %rbx
13790 - movq %rdx, 0(%rbx, %rax, 8)
13791 -
13792 - movq %rdi, %rax
13793 - shrq $PMD_SHIFT, %rax
13794 - andq $(PTRS_PER_PMD - 1), %rax
13795 - leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
13796 - leaq level2_spare_pgt(%rip), %rbx
13797 - movq %rdx, 0(%rbx, %rax, 8)
13798 -ident_complete:
13799 + addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
13800 + addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
13801
13802 /*
13803 * Fixup the kernel text+data virtual addresses. Note that
13804 @@ -160,8 +152,8 @@ ENTRY(secondary_startup_64)
13805 * after the boot processor executes this code.
13806 */
13807
13808 - /* Enable PAE mode and PGE */
13809 - movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
13810 + /* Enable PAE mode and PSE/PGE */
13811 + movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
13812 movq %rax, %cr4
13813
13814 /* Setup early boot stage 4 level pagetables. */
13815 @@ -183,9 +175,14 @@ ENTRY(secondary_startup_64)
13816 movl $MSR_EFER, %ecx
13817 rdmsr
13818 btsl $_EFER_SCE, %eax /* Enable System Call */
13819 - btl $20,%edi /* No Execute supported? */
13820 + btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
13821 jnc 1f
13822 btsl $_EFER_NX, %eax
13823 + leaq init_level4_pgt(%rip), %rdi
13824 + btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
13825 + btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
13826 + btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
13827 + btsq $_PAGE_BIT_NX, __supported_pte_mask(%rip)
13828 1: wrmsr /* Make changes effective */
13829
13830 /* Setup cr0 */
13831 @@ -269,7 +266,7 @@ ENTRY(secondary_startup_64)
13832 bad_address:
13833 jmp bad_address
13834
13835 - .section ".init.text","ax"
13836 + __INIT
13837 #ifdef CONFIG_EARLY_PRINTK
13838 .globl early_idt_handlers
13839 early_idt_handlers:
13840 @@ -314,18 +311,23 @@ ENTRY(early_idt_handler)
13841 #endif /* EARLY_PRINTK */
13842 1: hlt
13843 jmp 1b
13844 + .previous
13845
13846 #ifdef CONFIG_EARLY_PRINTK
13847 + __INITDATA
13848 early_recursion_flag:
13849 .long 0
13850 + .previous
13851
13852 + .section .rodata,"a",@progbits
13853 early_idt_msg:
13854 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
13855 early_idt_ripmsg:
13856 .asciz "RIP %s\n"
13857 -#endif /* CONFIG_EARLY_PRINTK */
13858 .previous
13859 +#endif /* CONFIG_EARLY_PRINTK */
13860
13861 + .section .rodata,"a",@progbits
13862 #define NEXT_PAGE(name) \
13863 .balign PAGE_SIZE; \
13864 ENTRY(name)
13865 @@ -338,7 +340,6 @@ ENTRY(name)
13866 i = i + 1 ; \
13867 .endr
13868
13869 - .data
13870 /*
13871 * This default setting generates an ident mapping at address 0x100000
13872 * and a mapping for the kernel that precisely maps virtual address
13873 @@ -349,13 +350,36 @@ NEXT_PAGE(init_level4_pgt)
13874 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
13875 .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
13876 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
13877 + .org init_level4_pgt + L4_VMALLOC_START*8, 0
13878 + .quad level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
13879 + .org init_level4_pgt + L4_VMEMMAP_START*8, 0
13880 + .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
13881 .org init_level4_pgt + L4_START_KERNEL*8, 0
13882 /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
13883 .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
13884
13885 +#ifdef CONFIG_PAX_PER_CPU_PGD
13886 +NEXT_PAGE(cpu_pgd)
13887 + .rept NR_CPUS
13888 + .fill 512,8,0
13889 + .endr
13890 +#endif
13891 +
13892 NEXT_PAGE(level3_ident_pgt)
13893 .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
13894 +#ifdef CONFIG_XEN
13895 .fill 511,8,0
13896 +#else
13897 + .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
13898 + .fill 510,8,0
13899 +#endif
13900 +
13901 +NEXT_PAGE(level3_vmalloc_pgt)
13902 + .fill 512,8,0
13903 +
13904 +NEXT_PAGE(level3_vmemmap_pgt)
13905 + .fill L3_VMEMMAP_START,8,0
13906 + .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
13907
13908 NEXT_PAGE(level3_kernel_pgt)
13909 .fill L3_START_KERNEL,8,0
13910 @@ -363,20 +387,23 @@ NEXT_PAGE(level3_kernel_pgt)
13911 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
13912 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
13913
13914 +NEXT_PAGE(level2_vmemmap_pgt)
13915 + .fill 512,8,0
13916 +
13917 NEXT_PAGE(level2_fixmap_pgt)
13918 - .fill 506,8,0
13919 - .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
13920 - /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
13921 - .fill 5,8,0
13922 + .fill 507,8,0
13923 + .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
13924 + /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
13925 + .fill 4,8,0
13926
13927 -NEXT_PAGE(level1_fixmap_pgt)
13928 +NEXT_PAGE(level1_vsyscall_pgt)
13929 .fill 512,8,0
13930
13931 -NEXT_PAGE(level2_ident_pgt)
13932 - /* Since I easily can, map the first 1G.
13933 + /* Since I easily can, map the first 2G.
13934 * Don't set NX because code runs from these pages.
13935 */
13936 - PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
13937 +NEXT_PAGE(level2_ident_pgt)
13938 + PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
13939
13940 NEXT_PAGE(level2_kernel_pgt)
13941 /*
13942 @@ -389,33 +416,55 @@ NEXT_PAGE(level2_kernel_pgt)
13943 * If you want to increase this then increase MODULES_VADDR
13944 * too.)
13945 */
13946 - PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
13947 - KERNEL_IMAGE_SIZE/PMD_SIZE)
13948 -
13949 -NEXT_PAGE(level2_spare_pgt)
13950 - .fill 512, 8, 0
13951 + PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
13952
13953 #undef PMDS
13954 #undef NEXT_PAGE
13955
13956 - .data
13957 + .align PAGE_SIZE
13958 +ENTRY(cpu_gdt_table)
13959 + .rept NR_CPUS
13960 + .quad 0x0000000000000000 /* NULL descriptor */
13961 + .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
13962 + .quad 0x00af9b000000ffff /* __KERNEL_CS */
13963 + .quad 0x00cf93000000ffff /* __KERNEL_DS */
13964 + .quad 0x00cffb000000ffff /* __USER32_CS */
13965 + .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
13966 + .quad 0x00affb000000ffff /* __USER_CS */
13967 +
13968 +#ifdef CONFIG_PAX_KERNEXEC
13969 + .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
13970 +#else
13971 + .quad 0x0 /* unused */
13972 +#endif
13973 +
13974 + .quad 0,0 /* TSS */
13975 + .quad 0,0 /* LDT */
13976 + .quad 0,0,0 /* three TLS descriptors */
13977 + .quad 0x0000f40000000000 /* node/CPU stored in limit */
13978 + /* asm/segment.h:GDT_ENTRIES must match this */
13979 +
13980 + /* zero the remaining page */
13981 + .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
13982 + .endr
13983 +
13984 .align 16
13985 .globl early_gdt_descr
13986 early_gdt_descr:
13987 .word GDT_ENTRIES*8-1
13988 early_gdt_descr_base:
13989 - .quad INIT_PER_CPU_VAR(gdt_page)
13990 + .quad cpu_gdt_table
13991
13992 ENTRY(phys_base)
13993 /* This must match the first entry in level2_kernel_pgt */
13994 .quad 0x0000000000000000
13995
13996 #include "../../x86/xen/xen-head.S"
13997 -
13998 - .section .bss, "aw", @nobits
13999 +
14000 + .section .rodata,"a",@progbits
14001 .align L1_CACHE_BYTES
14002 ENTRY(idt_table)
14003 - .skip IDT_ENTRIES * 16
14004 + .fill 512,8,0
14005
14006 __PAGE_ALIGNED_BSS
14007 .align PAGE_SIZE
14008 diff -urNp linux-3.0.8/arch/x86/kernel/i386_ksyms_32.c linux-3.0.8/arch/x86/kernel/i386_ksyms_32.c
14009 --- linux-3.0.8/arch/x86/kernel/i386_ksyms_32.c 2011-07-21 22:17:23.000000000 -0400
14010 +++ linux-3.0.8/arch/x86/kernel/i386_ksyms_32.c 2011-08-23 21:47:55.000000000 -0400
14011 @@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
14012 EXPORT_SYMBOL(cmpxchg8b_emu);
14013 #endif
14014
14015 +EXPORT_SYMBOL_GPL(cpu_gdt_table);
14016 +
14017 /* Networking helper routines. */
14018 EXPORT_SYMBOL(csum_partial_copy_generic);
14019 +EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
14020 +EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
14021
14022 EXPORT_SYMBOL(__get_user_1);
14023 EXPORT_SYMBOL(__get_user_2);
14024 @@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
14025
14026 EXPORT_SYMBOL(csum_partial);
14027 EXPORT_SYMBOL(empty_zero_page);
14028 +
14029 +#ifdef CONFIG_PAX_KERNEXEC
14030 +EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
14031 +#endif
14032 diff -urNp linux-3.0.8/arch/x86/kernel/i8259.c linux-3.0.8/arch/x86/kernel/i8259.c
14033 --- linux-3.0.8/arch/x86/kernel/i8259.c 2011-07-21 22:17:23.000000000 -0400
14034 +++ linux-3.0.8/arch/x86/kernel/i8259.c 2011-08-23 21:47:55.000000000 -0400
14035 @@ -210,7 +210,7 @@ spurious_8259A_irq:
14036 "spurious 8259A interrupt: IRQ%d.\n", irq);
14037 spurious_irq_mask |= irqmask;
14038 }
14039 - atomic_inc(&irq_err_count);
14040 + atomic_inc_unchecked(&irq_err_count);
14041 /*
14042 * Theoretically we do not have to handle this IRQ,
14043 * but in Linux this does not cause problems and is
14044 diff -urNp linux-3.0.8/arch/x86/kernel/init_task.c linux-3.0.8/arch/x86/kernel/init_task.c
14045 --- linux-3.0.8/arch/x86/kernel/init_task.c 2011-07-21 22:17:23.000000000 -0400
14046 +++ linux-3.0.8/arch/x86/kernel/init_task.c 2011-08-23 21:47:55.000000000 -0400
14047 @@ -20,8 +20,7 @@ static struct sighand_struct init_sighan
14048 * way process stacks are handled. This is done by having a special
14049 * "init_task" linker map entry..
14050 */
14051 -union thread_union init_thread_union __init_task_data =
14052 - { INIT_THREAD_INFO(init_task) };
14053 +union thread_union init_thread_union __init_task_data;
14054
14055 /*
14056 * Initial task structure.
14057 @@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task);
14058 * section. Since TSS's are completely CPU-local, we want them
14059 * on exact cacheline boundaries, to eliminate cacheline ping-pong.
14060 */
14061 -DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
14062 -
14063 +struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
14064 +EXPORT_SYMBOL(init_tss);
14065 diff -urNp linux-3.0.8/arch/x86/kernel/ioport.c linux-3.0.8/arch/x86/kernel/ioport.c
14066 --- linux-3.0.8/arch/x86/kernel/ioport.c 2011-07-21 22:17:23.000000000 -0400
14067 +++ linux-3.0.8/arch/x86/kernel/ioport.c 2011-08-23 21:48:14.000000000 -0400
14068 @@ -6,6 +6,7 @@
14069 #include <linux/sched.h>
14070 #include <linux/kernel.h>
14071 #include <linux/capability.h>
14072 +#include <linux/security.h>
14073 #include <linux/errno.h>
14074 #include <linux/types.h>
14075 #include <linux/ioport.h>
14076 @@ -28,6 +29,12 @@ asmlinkage long sys_ioperm(unsigned long
14077
14078 if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
14079 return -EINVAL;
14080 +#ifdef CONFIG_GRKERNSEC_IO
14081 + if (turn_on && grsec_disable_privio) {
14082 + gr_handle_ioperm();
14083 + return -EPERM;
14084 + }
14085 +#endif
14086 if (turn_on && !capable(CAP_SYS_RAWIO))
14087 return -EPERM;
14088
14089 @@ -54,7 +61,7 @@ asmlinkage long sys_ioperm(unsigned long
14090 * because the ->io_bitmap_max value must match the bitmap
14091 * contents:
14092 */
14093 - tss = &per_cpu(init_tss, get_cpu());
14094 + tss = init_tss + get_cpu();
14095
14096 if (turn_on)
14097 bitmap_clear(t->io_bitmap_ptr, from, num);
14098 @@ -102,6 +109,12 @@ long sys_iopl(unsigned int level, struct
14099 return -EINVAL;
14100 /* Trying to gain more privileges? */
14101 if (level > old) {
14102 +#ifdef CONFIG_GRKERNSEC_IO
14103 + if (grsec_disable_privio) {
14104 + gr_handle_iopl();
14105 + return -EPERM;
14106 + }
14107 +#endif
14108 if (!capable(CAP_SYS_RAWIO))
14109 return -EPERM;
14110 }
14111 diff -urNp linux-3.0.8/arch/x86/kernel/irq_32.c linux-3.0.8/arch/x86/kernel/irq_32.c
14112 --- linux-3.0.8/arch/x86/kernel/irq_32.c 2011-07-21 22:17:23.000000000 -0400
14113 +++ linux-3.0.8/arch/x86/kernel/irq_32.c 2011-08-23 21:47:55.000000000 -0400
14114 @@ -36,7 +36,7 @@ static int check_stack_overflow(void)
14115 __asm__ __volatile__("andl %%esp,%0" :
14116 "=r" (sp) : "0" (THREAD_SIZE - 1));
14117
14118 - return sp < (sizeof(struct thread_info) + STACK_WARN);
14119 + return sp < STACK_WARN;
14120 }
14121
14122 static void print_stack_overflow(void)
14123 @@ -54,8 +54,8 @@ static inline void print_stack_overflow(
14124 * per-CPU IRQ handling contexts (thread information and stack)
14125 */
14126 union irq_ctx {
14127 - struct thread_info tinfo;
14128 - u32 stack[THREAD_SIZE/sizeof(u32)];
14129 + unsigned long previous_esp;
14130 + u32 stack[THREAD_SIZE/sizeof(u32)];
14131 } __attribute__((aligned(THREAD_SIZE)));
14132
14133 static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
14134 @@ -75,10 +75,9 @@ static void call_on_stack(void *func, vo
14135 static inline int
14136 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
14137 {
14138 - union irq_ctx *curctx, *irqctx;
14139 + union irq_ctx *irqctx;
14140 u32 *isp, arg1, arg2;
14141
14142 - curctx = (union irq_ctx *) current_thread_info();
14143 irqctx = __this_cpu_read(hardirq_ctx);
14144
14145 /*
14146 @@ -87,21 +86,16 @@ execute_on_irq_stack(int overflow, struc
14147 * handler) we can't do that and just have to keep using the
14148 * current stack (which is the irq stack already after all)
14149 */
14150 - if (unlikely(curctx == irqctx))
14151 + if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
14152 return 0;
14153
14154 /* build the stack frame on the IRQ stack */
14155 - isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
14156 - irqctx->tinfo.task = curctx->tinfo.task;
14157 - irqctx->tinfo.previous_esp = current_stack_pointer;
14158 + isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
14159 + irqctx->previous_esp = current_stack_pointer;
14160
14161 - /*
14162 - * Copy the softirq bits in preempt_count so that the
14163 - * softirq checks work in the hardirq context.
14164 - */
14165 - irqctx->tinfo.preempt_count =
14166 - (irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
14167 - (curctx->tinfo.preempt_count & SOFTIRQ_MASK);
14168 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14169 + __set_fs(MAKE_MM_SEG(0));
14170 +#endif
14171
14172 if (unlikely(overflow))
14173 call_on_stack(print_stack_overflow, isp);
14174 @@ -113,6 +107,11 @@ execute_on_irq_stack(int overflow, struc
14175 : "0" (irq), "1" (desc), "2" (isp),
14176 "D" (desc->handle_irq)
14177 : "memory", "cc", "ecx");
14178 +
14179 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14180 + __set_fs(current_thread_info()->addr_limit);
14181 +#endif
14182 +
14183 return 1;
14184 }
14185
14186 @@ -121,29 +120,11 @@ execute_on_irq_stack(int overflow, struc
14187 */
14188 void __cpuinit irq_ctx_init(int cpu)
14189 {
14190 - union irq_ctx *irqctx;
14191 -
14192 if (per_cpu(hardirq_ctx, cpu))
14193 return;
14194
14195 - irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
14196 - THREAD_FLAGS,
14197 - THREAD_ORDER));
14198 - memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
14199 - irqctx->tinfo.cpu = cpu;
14200 - irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
14201 - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
14202 -
14203 - per_cpu(hardirq_ctx, cpu) = irqctx;
14204 -
14205 - irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
14206 - THREAD_FLAGS,
14207 - THREAD_ORDER));
14208 - memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
14209 - irqctx->tinfo.cpu = cpu;
14210 - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
14211 -
14212 - per_cpu(softirq_ctx, cpu) = irqctx;
14213 + per_cpu(hardirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
14214 + per_cpu(softirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
14215
14216 printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
14217 cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
14218 @@ -152,7 +133,6 @@ void __cpuinit irq_ctx_init(int cpu)
14219 asmlinkage void do_softirq(void)
14220 {
14221 unsigned long flags;
14222 - struct thread_info *curctx;
14223 union irq_ctx *irqctx;
14224 u32 *isp;
14225
14226 @@ -162,15 +142,22 @@ asmlinkage void do_softirq(void)
14227 local_irq_save(flags);
14228
14229 if (local_softirq_pending()) {
14230 - curctx = current_thread_info();
14231 irqctx = __this_cpu_read(softirq_ctx);
14232 - irqctx->tinfo.task = curctx->task;
14233 - irqctx->tinfo.previous_esp = current_stack_pointer;
14234 + irqctx->previous_esp = current_stack_pointer;
14235
14236 /* build the stack frame on the softirq stack */
14237 - isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
14238 + isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
14239 +
14240 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14241 + __set_fs(MAKE_MM_SEG(0));
14242 +#endif
14243
14244 call_on_stack(__do_softirq, isp);
14245 +
14246 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14247 + __set_fs(current_thread_info()->addr_limit);
14248 +#endif
14249 +
14250 /*
14251 * Shouldn't happen, we returned above if in_interrupt():
14252 */
14253 diff -urNp linux-3.0.8/arch/x86/kernel/irq.c linux-3.0.8/arch/x86/kernel/irq.c
14254 --- linux-3.0.8/arch/x86/kernel/irq.c 2011-07-21 22:17:23.000000000 -0400
14255 +++ linux-3.0.8/arch/x86/kernel/irq.c 2011-08-23 21:47:55.000000000 -0400
14256 @@ -17,7 +17,7 @@
14257 #include <asm/mce.h>
14258 #include <asm/hw_irq.h>
14259
14260 -atomic_t irq_err_count;
14261 +atomic_unchecked_t irq_err_count;
14262
14263 /* Function pointer for generic interrupt vector handling */
14264 void (*x86_platform_ipi_callback)(void) = NULL;
14265 @@ -116,9 +116,9 @@ int arch_show_interrupts(struct seq_file
14266 seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
14267 seq_printf(p, " Machine check polls\n");
14268 #endif
14269 - seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
14270 + seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
14271 #if defined(CONFIG_X86_IO_APIC)
14272 - seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
14273 + seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
14274 #endif
14275 return 0;
14276 }
14277 @@ -158,10 +158,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
14278
14279 u64 arch_irq_stat(void)
14280 {
14281 - u64 sum = atomic_read(&irq_err_count);
14282 + u64 sum = atomic_read_unchecked(&irq_err_count);
14283
14284 #ifdef CONFIG_X86_IO_APIC
14285 - sum += atomic_read(&irq_mis_count);
14286 + sum += atomic_read_unchecked(&irq_mis_count);
14287 #endif
14288 return sum;
14289 }
14290 diff -urNp linux-3.0.8/arch/x86/kernel/kgdb.c linux-3.0.8/arch/x86/kernel/kgdb.c
14291 --- linux-3.0.8/arch/x86/kernel/kgdb.c 2011-07-21 22:17:23.000000000 -0400
14292 +++ linux-3.0.8/arch/x86/kernel/kgdb.c 2011-08-23 21:47:55.000000000 -0400
14293 @@ -124,11 +124,11 @@ char *dbg_get_reg(int regno, void *mem,
14294 #ifdef CONFIG_X86_32
14295 switch (regno) {
14296 case GDB_SS:
14297 - if (!user_mode_vm(regs))
14298 + if (!user_mode(regs))
14299 *(unsigned long *)mem = __KERNEL_DS;
14300 break;
14301 case GDB_SP:
14302 - if (!user_mode_vm(regs))
14303 + if (!user_mode(regs))
14304 *(unsigned long *)mem = kernel_stack_pointer(regs);
14305 break;
14306 case GDB_GS:
14307 @@ -473,12 +473,12 @@ int kgdb_arch_handle_exception(int e_vec
14308 case 'k':
14309 /* clear the trace bit */
14310 linux_regs->flags &= ~X86_EFLAGS_TF;
14311 - atomic_set(&kgdb_cpu_doing_single_step, -1);
14312 + atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
14313
14314 /* set the trace bit if we're stepping */
14315 if (remcomInBuffer[0] == 's') {
14316 linux_regs->flags |= X86_EFLAGS_TF;
14317 - atomic_set(&kgdb_cpu_doing_single_step,
14318 + atomic_set_unchecked(&kgdb_cpu_doing_single_step,
14319 raw_smp_processor_id());
14320 }
14321
14322 @@ -534,7 +534,7 @@ static int __kgdb_notify(struct die_args
14323 return NOTIFY_DONE;
14324
14325 case DIE_DEBUG:
14326 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
14327 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
14328 if (user_mode(regs))
14329 return single_step_cont(regs, args);
14330 break;
14331 diff -urNp linux-3.0.8/arch/x86/kernel/kprobes.c linux-3.0.8/arch/x86/kernel/kprobes.c
14332 --- linux-3.0.8/arch/x86/kernel/kprobes.c 2011-07-21 22:17:23.000000000 -0400
14333 +++ linux-3.0.8/arch/x86/kernel/kprobes.c 2011-10-11 10:44:33.000000000 -0400
14334 @@ -115,8 +115,11 @@ static void __kprobes __synthesize_relat
14335 } __attribute__((packed)) *insn;
14336
14337 insn = (struct __arch_relative_insn *)from;
14338 +
14339 + pax_open_kernel();
14340 insn->raddr = (s32)((long)(to) - ((long)(from) + 5));
14341 insn->op = op;
14342 + pax_close_kernel();
14343 }
14344
14345 /* Insert a jump instruction at address 'from', which jumps to address 'to'.*/
14346 @@ -153,7 +156,7 @@ static int __kprobes can_boost(kprobe_op
14347 kprobe_opcode_t opcode;
14348 kprobe_opcode_t *orig_opcodes = opcodes;
14349
14350 - if (search_exception_tables((unsigned long)opcodes))
14351 + if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
14352 return 0; /* Page fault may occur on this address. */
14353
14354 retry:
14355 @@ -314,7 +317,9 @@ static int __kprobes __copy_instruction(
14356 }
14357 }
14358 insn_get_length(&insn);
14359 + pax_open_kernel();
14360 memcpy(dest, insn.kaddr, insn.length);
14361 + pax_close_kernel();
14362
14363 #ifdef CONFIG_X86_64
14364 if (insn_rip_relative(&insn)) {
14365 @@ -338,7 +343,9 @@ static int __kprobes __copy_instruction(
14366 (u8 *) dest;
14367 BUG_ON((s64) (s32) newdisp != newdisp); /* Sanity check. */
14368 disp = (u8 *) dest + insn_offset_displacement(&insn);
14369 + pax_open_kernel();
14370 *(s32 *) disp = (s32) newdisp;
14371 + pax_close_kernel();
14372 }
14373 #endif
14374 return insn.length;
14375 @@ -352,12 +359,12 @@ static void __kprobes arch_copy_kprobe(s
14376 */
14377 __copy_instruction(p->ainsn.insn, p->addr, 0);
14378
14379 - if (can_boost(p->addr))
14380 + if (can_boost(ktla_ktva(p->addr)))
14381 p->ainsn.boostable = 0;
14382 else
14383 p->ainsn.boostable = -1;
14384
14385 - p->opcode = *p->addr;
14386 + p->opcode = *(ktla_ktva(p->addr));
14387 }
14388
14389 int __kprobes arch_prepare_kprobe(struct kprobe *p)
14390 @@ -474,7 +481,7 @@ static void __kprobes setup_singlestep(s
14391 * nor set current_kprobe, because it doesn't use single
14392 * stepping.
14393 */
14394 - regs->ip = (unsigned long)p->ainsn.insn;
14395 + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
14396 preempt_enable_no_resched();
14397 return;
14398 }
14399 @@ -493,7 +500,7 @@ static void __kprobes setup_singlestep(s
14400 if (p->opcode == BREAKPOINT_INSTRUCTION)
14401 regs->ip = (unsigned long)p->addr;
14402 else
14403 - regs->ip = (unsigned long)p->ainsn.insn;
14404 + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
14405 }
14406
14407 /*
14408 @@ -572,7 +579,7 @@ static int __kprobes kprobe_handler(stru
14409 setup_singlestep(p, regs, kcb, 0);
14410 return 1;
14411 }
14412 - } else if (*addr != BREAKPOINT_INSTRUCTION) {
14413 + } else if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
14414 /*
14415 * The breakpoint instruction was removed right
14416 * after we hit it. Another cpu has removed
14417 @@ -680,6 +687,9 @@ static void __used __kprobes kretprobe_t
14418 " movq %rax, 152(%rsp)\n"
14419 RESTORE_REGS_STRING
14420 " popfq\n"
14421 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN
14422 + " btsq $63,(%rsp)\n"
14423 +#endif
14424 #else
14425 " pushf\n"
14426 SAVE_REGS_STRING
14427 @@ -817,7 +827,7 @@ static void __kprobes resume_execution(s
14428 struct pt_regs *regs, struct kprobe_ctlblk *kcb)
14429 {
14430 unsigned long *tos = stack_addr(regs);
14431 - unsigned long copy_ip = (unsigned long)p->ainsn.insn;
14432 + unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
14433 unsigned long orig_ip = (unsigned long)p->addr;
14434 kprobe_opcode_t *insn = p->ainsn.insn;
14435
14436 @@ -999,7 +1009,7 @@ int __kprobes kprobe_exceptions_notify(s
14437 struct die_args *args = data;
14438 int ret = NOTIFY_DONE;
14439
14440 - if (args->regs && user_mode_vm(args->regs))
14441 + if (args->regs && user_mode(args->regs))
14442 return ret;
14443
14444 switch (val) {
14445 @@ -1381,7 +1391,7 @@ int __kprobes arch_prepare_optimized_kpr
14446 * Verify if the address gap is in 2GB range, because this uses
14447 * a relative jump.
14448 */
14449 - rel = (long)op->optinsn.insn - (long)op->kp.addr + RELATIVEJUMP_SIZE;
14450 + rel = (long)op->optinsn.insn - ktla_ktva((long)op->kp.addr) + RELATIVEJUMP_SIZE;
14451 if (abs(rel) > 0x7fffffff)
14452 return -ERANGE;
14453
14454 @@ -1402,11 +1412,11 @@ int __kprobes arch_prepare_optimized_kpr
14455 synthesize_set_arg1(buf + TMPL_MOVE_IDX, (unsigned long)op);
14456
14457 /* Set probe function call */
14458 - synthesize_relcall(buf + TMPL_CALL_IDX, optimized_callback);
14459 + synthesize_relcall(buf + TMPL_CALL_IDX, ktla_ktva(optimized_callback));
14460
14461 /* Set returning jmp instruction at the tail of out-of-line buffer */
14462 synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size,
14463 - (u8 *)op->kp.addr + op->optinsn.size);
14464 + (u8 *)ktla_ktva(op->kp.addr) + op->optinsn.size);
14465
14466 flush_icache_range((unsigned long) buf,
14467 (unsigned long) buf + TMPL_END_IDX +
14468 @@ -1428,7 +1438,7 @@ static void __kprobes setup_optimize_kpr
14469 ((long)op->kp.addr + RELATIVEJUMP_SIZE));
14470
14471 /* Backup instructions which will be replaced by jump address */
14472 - memcpy(op->optinsn.copied_insn, op->kp.addr + INT3_SIZE,
14473 + memcpy(op->optinsn.copied_insn, ktla_ktva(op->kp.addr) + INT3_SIZE,
14474 RELATIVE_ADDR_SIZE);
14475
14476 insn_buf[0] = RELATIVEJUMP_OPCODE;
14477 diff -urNp linux-3.0.8/arch/x86/kernel/kvm.c linux-3.0.8/arch/x86/kernel/kvm.c
14478 --- linux-3.0.8/arch/x86/kernel/kvm.c 2011-07-21 22:17:23.000000000 -0400
14479 +++ linux-3.0.8/arch/x86/kernel/kvm.c 2011-08-24 18:10:12.000000000 -0400
14480 @@ -426,6 +426,7 @@ static void __init paravirt_ops_setup(vo
14481 pv_mmu_ops.set_pud = kvm_set_pud;
14482 #if PAGETABLE_LEVELS == 4
14483 pv_mmu_ops.set_pgd = kvm_set_pgd;
14484 + pv_mmu_ops.set_pgd_batched = kvm_set_pgd;
14485 #endif
14486 #endif
14487 pv_mmu_ops.flush_tlb_user = kvm_flush_tlb;
14488 diff -urNp linux-3.0.8/arch/x86/kernel/ldt.c linux-3.0.8/arch/x86/kernel/ldt.c
14489 --- linux-3.0.8/arch/x86/kernel/ldt.c 2011-07-21 22:17:23.000000000 -0400
14490 +++ linux-3.0.8/arch/x86/kernel/ldt.c 2011-08-23 21:47:55.000000000 -0400
14491 @@ -67,13 +67,13 @@ static int alloc_ldt(mm_context_t *pc, i
14492 if (reload) {
14493 #ifdef CONFIG_SMP
14494 preempt_disable();
14495 - load_LDT(pc);
14496 + load_LDT_nolock(pc);
14497 if (!cpumask_equal(mm_cpumask(current->mm),
14498 cpumask_of(smp_processor_id())))
14499 smp_call_function(flush_ldt, current->mm, 1);
14500 preempt_enable();
14501 #else
14502 - load_LDT(pc);
14503 + load_LDT_nolock(pc);
14504 #endif
14505 }
14506 if (oldsize) {
14507 @@ -95,7 +95,7 @@ static inline int copy_ldt(mm_context_t
14508 return err;
14509
14510 for (i = 0; i < old->size; i++)
14511 - write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
14512 + write_ldt_entry(new->ldt, i, old->ldt + i);
14513 return 0;
14514 }
14515
14516 @@ -116,6 +116,24 @@ int init_new_context(struct task_struct
14517 retval = copy_ldt(&mm->context, &old_mm->context);
14518 mutex_unlock(&old_mm->context.lock);
14519 }
14520 +
14521 + if (tsk == current) {
14522 + mm->context.vdso = 0;
14523 +
14524 +#ifdef CONFIG_X86_32
14525 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
14526 + mm->context.user_cs_base = 0UL;
14527 + mm->context.user_cs_limit = ~0UL;
14528 +
14529 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
14530 + cpus_clear(mm->context.cpu_user_cs_mask);
14531 +#endif
14532 +
14533 +#endif
14534 +#endif
14535 +
14536 + }
14537 +
14538 return retval;
14539 }
14540
14541 @@ -230,6 +248,13 @@ static int write_ldt(void __user *ptr, u
14542 }
14543 }
14544
14545 +#ifdef CONFIG_PAX_SEGMEXEC
14546 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
14547 + error = -EINVAL;
14548 + goto out_unlock;
14549 + }
14550 +#endif
14551 +
14552 fill_ldt(&ldt, &ldt_info);
14553 if (oldmode)
14554 ldt.avl = 0;
14555 diff -urNp linux-3.0.8/arch/x86/kernel/machine_kexec_32.c linux-3.0.8/arch/x86/kernel/machine_kexec_32.c
14556 --- linux-3.0.8/arch/x86/kernel/machine_kexec_32.c 2011-07-21 22:17:23.000000000 -0400
14557 +++ linux-3.0.8/arch/x86/kernel/machine_kexec_32.c 2011-08-23 21:47:55.000000000 -0400
14558 @@ -27,7 +27,7 @@
14559 #include <asm/cacheflush.h>
14560 #include <asm/debugreg.h>
14561
14562 -static void set_idt(void *newidt, __u16 limit)
14563 +static void set_idt(struct desc_struct *newidt, __u16 limit)
14564 {
14565 struct desc_ptr curidt;
14566
14567 @@ -39,7 +39,7 @@ static void set_idt(void *newidt, __u16
14568 }
14569
14570
14571 -static void set_gdt(void *newgdt, __u16 limit)
14572 +static void set_gdt(struct desc_struct *newgdt, __u16 limit)
14573 {
14574 struct desc_ptr curgdt;
14575
14576 @@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
14577 }
14578
14579 control_page = page_address(image->control_code_page);
14580 - memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
14581 + memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
14582
14583 relocate_kernel_ptr = control_page;
14584 page_list[PA_CONTROL_PAGE] = __pa(control_page);
14585 diff -urNp linux-3.0.8/arch/x86/kernel/microcode_intel.c linux-3.0.8/arch/x86/kernel/microcode_intel.c
14586 --- linux-3.0.8/arch/x86/kernel/microcode_intel.c 2011-07-21 22:17:23.000000000 -0400
14587 +++ linux-3.0.8/arch/x86/kernel/microcode_intel.c 2011-10-06 04:17:55.000000000 -0400
14588 @@ -440,13 +440,13 @@ static enum ucode_state request_microcod
14589
14590 static int get_ucode_user(void *to, const void *from, size_t n)
14591 {
14592 - return copy_from_user(to, from, n);
14593 + return copy_from_user(to, (const void __force_user *)from, n);
14594 }
14595
14596 static enum ucode_state
14597 request_microcode_user(int cpu, const void __user *buf, size_t size)
14598 {
14599 - return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
14600 + return generic_load_microcode(cpu, (__force_kernel void *)buf, size, &get_ucode_user);
14601 }
14602
14603 static void microcode_fini_cpu(int cpu)
14604 diff -urNp linux-3.0.8/arch/x86/kernel/module.c linux-3.0.8/arch/x86/kernel/module.c
14605 --- linux-3.0.8/arch/x86/kernel/module.c 2011-07-21 22:17:23.000000000 -0400
14606 +++ linux-3.0.8/arch/x86/kernel/module.c 2011-08-23 21:47:55.000000000 -0400
14607 @@ -36,21 +36,66 @@
14608 #define DEBUGP(fmt...)
14609 #endif
14610
14611 -void *module_alloc(unsigned long size)
14612 +static inline void *__module_alloc(unsigned long size, pgprot_t prot)
14613 {
14614 if (PAGE_ALIGN(size) > MODULES_LEN)
14615 return NULL;
14616 return __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,
14617 - GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
14618 + GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot,
14619 -1, __builtin_return_address(0));
14620 }
14621
14622 +void *module_alloc(unsigned long size)
14623 +{
14624 +
14625 +#ifdef CONFIG_PAX_KERNEXEC
14626 + return __module_alloc(size, PAGE_KERNEL);
14627 +#else
14628 + return __module_alloc(size, PAGE_KERNEL_EXEC);
14629 +#endif
14630 +
14631 +}
14632 +
14633 /* Free memory returned from module_alloc */
14634 void module_free(struct module *mod, void *module_region)
14635 {
14636 vfree(module_region);
14637 }
14638
14639 +#ifdef CONFIG_PAX_KERNEXEC
14640 +#ifdef CONFIG_X86_32
14641 +void *module_alloc_exec(unsigned long size)
14642 +{
14643 + struct vm_struct *area;
14644 +
14645 + if (size == 0)
14646 + return NULL;
14647 +
14648 + area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
14649 + return area ? area->addr : NULL;
14650 +}
14651 +EXPORT_SYMBOL(module_alloc_exec);
14652 +
14653 +void module_free_exec(struct module *mod, void *module_region)
14654 +{
14655 + vunmap(module_region);
14656 +}
14657 +EXPORT_SYMBOL(module_free_exec);
14658 +#else
14659 +void module_free_exec(struct module *mod, void *module_region)
14660 +{
14661 + module_free(mod, module_region);
14662 +}
14663 +EXPORT_SYMBOL(module_free_exec);
14664 +
14665 +void *module_alloc_exec(unsigned long size)
14666 +{
14667 + return __module_alloc(size, PAGE_KERNEL_RX);
14668 +}
14669 +EXPORT_SYMBOL(module_alloc_exec);
14670 +#endif
14671 +#endif
14672 +
14673 /* We don't need anything special. */
14674 int module_frob_arch_sections(Elf_Ehdr *hdr,
14675 Elf_Shdr *sechdrs,
14676 @@ -70,14 +115,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
14677 unsigned int i;
14678 Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
14679 Elf32_Sym *sym;
14680 - uint32_t *location;
14681 + uint32_t *plocation, location;
14682
14683 DEBUGP("Applying relocate section %u to %u\n", relsec,
14684 sechdrs[relsec].sh_info);
14685 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
14686 /* This is where to make the change */
14687 - location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
14688 - + rel[i].r_offset;
14689 + plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
14690 + location = (uint32_t)plocation;
14691 + if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
14692 + plocation = ktla_ktva((void *)plocation);
14693 /* This is the symbol it is referring to. Note that all
14694 undefined symbols have been resolved. */
14695 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
14696 @@ -86,11 +133,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
14697 switch (ELF32_R_TYPE(rel[i].r_info)) {
14698 case R_386_32:
14699 /* We add the value into the location given */
14700 - *location += sym->st_value;
14701 + pax_open_kernel();
14702 + *plocation += sym->st_value;
14703 + pax_close_kernel();
14704 break;
14705 case R_386_PC32:
14706 /* Add the value, subtract its postition */
14707 - *location += sym->st_value - (uint32_t)location;
14708 + pax_open_kernel();
14709 + *plocation += sym->st_value - location;
14710 + pax_close_kernel();
14711 break;
14712 default:
14713 printk(KERN_ERR "module %s: Unknown relocation: %u\n",
14714 @@ -146,21 +197,30 @@ int apply_relocate_add(Elf64_Shdr *sechd
14715 case R_X86_64_NONE:
14716 break;
14717 case R_X86_64_64:
14718 + pax_open_kernel();
14719 *(u64 *)loc = val;
14720 + pax_close_kernel();
14721 break;
14722 case R_X86_64_32:
14723 + pax_open_kernel();
14724 *(u32 *)loc = val;
14725 + pax_close_kernel();
14726 if (val != *(u32 *)loc)
14727 goto overflow;
14728 break;
14729 case R_X86_64_32S:
14730 + pax_open_kernel();
14731 *(s32 *)loc = val;
14732 + pax_close_kernel();
14733 if ((s64)val != *(s32 *)loc)
14734 goto overflow;
14735 break;
14736 case R_X86_64_PC32:
14737 val -= (u64)loc;
14738 + pax_open_kernel();
14739 *(u32 *)loc = val;
14740 + pax_close_kernel();
14741 +
14742 #if 0
14743 if ((s64)val != *(s32 *)loc)
14744 goto overflow;
14745 diff -urNp linux-3.0.8/arch/x86/kernel/paravirt.c linux-3.0.8/arch/x86/kernel/paravirt.c
14746 --- linux-3.0.8/arch/x86/kernel/paravirt.c 2011-07-21 22:17:23.000000000 -0400
14747 +++ linux-3.0.8/arch/x86/kernel/paravirt.c 2011-08-23 21:48:14.000000000 -0400
14748 @@ -53,6 +53,9 @@ u64 _paravirt_ident_64(u64 x)
14749 {
14750 return x;
14751 }
14752 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
14753 +PV_CALLEE_SAVE_REGS_THUNK(_paravirt_ident_64);
14754 +#endif
14755
14756 void __init default_banner(void)
14757 {
14758 @@ -122,7 +125,7 @@ unsigned paravirt_patch_jmp(void *insnbu
14759 * corresponding structure. */
14760 static void *get_call_destination(u8 type)
14761 {
14762 - struct paravirt_patch_template tmpl = {
14763 + const struct paravirt_patch_template tmpl = {
14764 .pv_init_ops = pv_init_ops,
14765 .pv_time_ops = pv_time_ops,
14766 .pv_cpu_ops = pv_cpu_ops,
14767 @@ -133,6 +136,9 @@ static void *get_call_destination(u8 typ
14768 .pv_lock_ops = pv_lock_ops,
14769 #endif
14770 };
14771 +
14772 + pax_track_stack();
14773 +
14774 return *((void **)&tmpl + type);
14775 }
14776
14777 @@ -145,15 +151,19 @@ unsigned paravirt_patch_default(u8 type,
14778 if (opfunc == NULL)
14779 /* If there's no function, patch it with a ud2a (BUG) */
14780 ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
14781 - else if (opfunc == _paravirt_nop)
14782 + else if (opfunc == (void *)_paravirt_nop)
14783 /* If the operation is a nop, then nop the callsite */
14784 ret = paravirt_patch_nop();
14785
14786 /* identity functions just return their single argument */
14787 - else if (opfunc == _paravirt_ident_32)
14788 + else if (opfunc == (void *)_paravirt_ident_32)
14789 ret = paravirt_patch_ident_32(insnbuf, len);
14790 - else if (opfunc == _paravirt_ident_64)
14791 + else if (opfunc == (void *)_paravirt_ident_64)
14792 ret = paravirt_patch_ident_64(insnbuf, len);
14793 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
14794 + else if (opfunc == (void *)__raw_callee_save__paravirt_ident_64)
14795 + ret = paravirt_patch_ident_64(insnbuf, len);
14796 +#endif
14797
14798 else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
14799 type == PARAVIRT_PATCH(pv_cpu_ops.irq_enable_sysexit) ||
14800 @@ -178,7 +188,7 @@ unsigned paravirt_patch_insns(void *insn
14801 if (insn_len > len || start == NULL)
14802 insn_len = len;
14803 else
14804 - memcpy(insnbuf, start, insn_len);
14805 + memcpy(insnbuf, ktla_ktva(start), insn_len);
14806
14807 return insn_len;
14808 }
14809 @@ -294,22 +304,22 @@ void arch_flush_lazy_mmu_mode(void)
14810 preempt_enable();
14811 }
14812
14813 -struct pv_info pv_info = {
14814 +struct pv_info pv_info __read_only = {
14815 .name = "bare hardware",
14816 .paravirt_enabled = 0,
14817 .kernel_rpl = 0,
14818 .shared_kernel_pmd = 1, /* Only used when CONFIG_X86_PAE is set */
14819 };
14820
14821 -struct pv_init_ops pv_init_ops = {
14822 +struct pv_init_ops pv_init_ops __read_only = {
14823 .patch = native_patch,
14824 };
14825
14826 -struct pv_time_ops pv_time_ops = {
14827 +struct pv_time_ops pv_time_ops __read_only = {
14828 .sched_clock = native_sched_clock,
14829 };
14830
14831 -struct pv_irq_ops pv_irq_ops = {
14832 +struct pv_irq_ops pv_irq_ops __read_only = {
14833 .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
14834 .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
14835 .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
14836 @@ -321,7 +331,7 @@ struct pv_irq_ops pv_irq_ops = {
14837 #endif
14838 };
14839
14840 -struct pv_cpu_ops pv_cpu_ops = {
14841 +struct pv_cpu_ops pv_cpu_ops __read_only = {
14842 .cpuid = native_cpuid,
14843 .get_debugreg = native_get_debugreg,
14844 .set_debugreg = native_set_debugreg,
14845 @@ -382,21 +392,26 @@ struct pv_cpu_ops pv_cpu_ops = {
14846 .end_context_switch = paravirt_nop,
14847 };
14848
14849 -struct pv_apic_ops pv_apic_ops = {
14850 +struct pv_apic_ops pv_apic_ops __read_only = {
14851 #ifdef CONFIG_X86_LOCAL_APIC
14852 .startup_ipi_hook = paravirt_nop,
14853 #endif
14854 };
14855
14856 -#if defined(CONFIG_X86_32) && !defined(CONFIG_X86_PAE)
14857 +#ifdef CONFIG_X86_32
14858 +#ifdef CONFIG_X86_PAE
14859 +/* 64-bit pagetable entries */
14860 +#define PTE_IDENT PV_CALLEE_SAVE(_paravirt_ident_64)
14861 +#else
14862 /* 32-bit pagetable entries */
14863 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_32)
14864 +#endif
14865 #else
14866 /* 64-bit pagetable entries */
14867 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
14868 #endif
14869
14870 -struct pv_mmu_ops pv_mmu_ops = {
14871 +struct pv_mmu_ops pv_mmu_ops __read_only = {
14872
14873 .read_cr2 = native_read_cr2,
14874 .write_cr2 = native_write_cr2,
14875 @@ -446,6 +461,7 @@ struct pv_mmu_ops pv_mmu_ops = {
14876 .make_pud = PTE_IDENT,
14877
14878 .set_pgd = native_set_pgd,
14879 + .set_pgd_batched = native_set_pgd_batched,
14880 #endif
14881 #endif /* PAGETABLE_LEVELS >= 3 */
14882
14883 @@ -465,6 +481,12 @@ struct pv_mmu_ops pv_mmu_ops = {
14884 },
14885
14886 .set_fixmap = native_set_fixmap,
14887 +
14888 +#ifdef CONFIG_PAX_KERNEXEC
14889 + .pax_open_kernel = native_pax_open_kernel,
14890 + .pax_close_kernel = native_pax_close_kernel,
14891 +#endif
14892 +
14893 };
14894
14895 EXPORT_SYMBOL_GPL(pv_time_ops);
14896 diff -urNp linux-3.0.8/arch/x86/kernel/paravirt-spinlocks.c linux-3.0.8/arch/x86/kernel/paravirt-spinlocks.c
14897 --- linux-3.0.8/arch/x86/kernel/paravirt-spinlocks.c 2011-07-21 22:17:23.000000000 -0400
14898 +++ linux-3.0.8/arch/x86/kernel/paravirt-spinlocks.c 2011-08-23 21:47:55.000000000 -0400
14899 @@ -13,7 +13,7 @@ default_spin_lock_flags(arch_spinlock_t
14900 arch_spin_lock(lock);
14901 }
14902
14903 -struct pv_lock_ops pv_lock_ops = {
14904 +struct pv_lock_ops pv_lock_ops __read_only = {
14905 #ifdef CONFIG_SMP
14906 .spin_is_locked = __ticket_spin_is_locked,
14907 .spin_is_contended = __ticket_spin_is_contended,
14908 diff -urNp linux-3.0.8/arch/x86/kernel/pci-iommu_table.c linux-3.0.8/arch/x86/kernel/pci-iommu_table.c
14909 --- linux-3.0.8/arch/x86/kernel/pci-iommu_table.c 2011-07-21 22:17:23.000000000 -0400
14910 +++ linux-3.0.8/arch/x86/kernel/pci-iommu_table.c 2011-08-23 21:48:14.000000000 -0400
14911 @@ -2,7 +2,7 @@
14912 #include <asm/iommu_table.h>
14913 #include <linux/string.h>
14914 #include <linux/kallsyms.h>
14915 -
14916 +#include <linux/sched.h>
14917
14918 #define DEBUG 1
14919
14920 @@ -51,6 +51,8 @@ void __init check_iommu_entries(struct i
14921 {
14922 struct iommu_table_entry *p, *q, *x;
14923
14924 + pax_track_stack();
14925 +
14926 /* Simple cyclic dependency checker. */
14927 for (p = start; p < finish; p++) {
14928 q = find_dependents_of(start, finish, p);
14929 diff -urNp linux-3.0.8/arch/x86/kernel/process_32.c linux-3.0.8/arch/x86/kernel/process_32.c
14930 --- linux-3.0.8/arch/x86/kernel/process_32.c 2011-07-21 22:17:23.000000000 -0400
14931 +++ linux-3.0.8/arch/x86/kernel/process_32.c 2011-08-23 21:47:55.000000000 -0400
14932 @@ -65,6 +65,7 @@ asmlinkage void ret_from_fork(void) __as
14933 unsigned long thread_saved_pc(struct task_struct *tsk)
14934 {
14935 return ((unsigned long *)tsk->thread.sp)[3];
14936 +//XXX return tsk->thread.eip;
14937 }
14938
14939 #ifndef CONFIG_SMP
14940 @@ -126,15 +127,14 @@ void __show_regs(struct pt_regs *regs, i
14941 unsigned long sp;
14942 unsigned short ss, gs;
14943
14944 - if (user_mode_vm(regs)) {
14945 + if (user_mode(regs)) {
14946 sp = regs->sp;
14947 ss = regs->ss & 0xffff;
14948 - gs = get_user_gs(regs);
14949 } else {
14950 sp = kernel_stack_pointer(regs);
14951 savesegment(ss, ss);
14952 - savesegment(gs, gs);
14953 }
14954 + gs = get_user_gs(regs);
14955
14956 show_regs_common();
14957
14958 @@ -196,13 +196,14 @@ int copy_thread(unsigned long clone_flag
14959 struct task_struct *tsk;
14960 int err;
14961
14962 - childregs = task_pt_regs(p);
14963 + childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
14964 *childregs = *regs;
14965 childregs->ax = 0;
14966 childregs->sp = sp;
14967
14968 p->thread.sp = (unsigned long) childregs;
14969 p->thread.sp0 = (unsigned long) (childregs+1);
14970 + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
14971
14972 p->thread.ip = (unsigned long) ret_from_fork;
14973
14974 @@ -292,7 +293,7 @@ __switch_to(struct task_struct *prev_p,
14975 struct thread_struct *prev = &prev_p->thread,
14976 *next = &next_p->thread;
14977 int cpu = smp_processor_id();
14978 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
14979 + struct tss_struct *tss = init_tss + cpu;
14980 bool preload_fpu;
14981
14982 /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
14983 @@ -327,6 +328,10 @@ __switch_to(struct task_struct *prev_p,
14984 */
14985 lazy_save_gs(prev->gs);
14986
14987 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14988 + __set_fs(task_thread_info(next_p)->addr_limit);
14989 +#endif
14990 +
14991 /*
14992 * Load the per-thread Thread-Local Storage descriptor.
14993 */
14994 @@ -362,6 +367,9 @@ __switch_to(struct task_struct *prev_p,
14995 */
14996 arch_end_context_switch(next_p);
14997
14998 + percpu_write(current_task, next_p);
14999 + percpu_write(current_tinfo, &next_p->tinfo);
15000 +
15001 if (preload_fpu)
15002 __math_state_restore();
15003
15004 @@ -371,8 +379,6 @@ __switch_to(struct task_struct *prev_p,
15005 if (prev->gs | next->gs)
15006 lazy_load_gs(next->gs);
15007
15008 - percpu_write(current_task, next_p);
15009 -
15010 return prev_p;
15011 }
15012
15013 @@ -402,4 +408,3 @@ unsigned long get_wchan(struct task_stru
15014 } while (count++ < 16);
15015 return 0;
15016 }
15017 -
15018 diff -urNp linux-3.0.8/arch/x86/kernel/process_64.c linux-3.0.8/arch/x86/kernel/process_64.c
15019 --- linux-3.0.8/arch/x86/kernel/process_64.c 2011-07-21 22:17:23.000000000 -0400
15020 +++ linux-3.0.8/arch/x86/kernel/process_64.c 2011-08-23 21:47:55.000000000 -0400
15021 @@ -87,7 +87,7 @@ static void __exit_idle(void)
15022 void exit_idle(void)
15023 {
15024 /* idle loop has pid 0 */
15025 - if (current->pid)
15026 + if (task_pid_nr(current))
15027 return;
15028 __exit_idle();
15029 }
15030 @@ -260,8 +260,7 @@ int copy_thread(unsigned long clone_flag
15031 struct pt_regs *childregs;
15032 struct task_struct *me = current;
15033
15034 - childregs = ((struct pt_regs *)
15035 - (THREAD_SIZE + task_stack_page(p))) - 1;
15036 + childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
15037 *childregs = *regs;
15038
15039 childregs->ax = 0;
15040 @@ -273,6 +272,7 @@ int copy_thread(unsigned long clone_flag
15041 p->thread.sp = (unsigned long) childregs;
15042 p->thread.sp0 = (unsigned long) (childregs+1);
15043 p->thread.usersp = me->thread.usersp;
15044 + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
15045
15046 set_tsk_thread_flag(p, TIF_FORK);
15047
15048 @@ -375,7 +375,7 @@ __switch_to(struct task_struct *prev_p,
15049 struct thread_struct *prev = &prev_p->thread;
15050 struct thread_struct *next = &next_p->thread;
15051 int cpu = smp_processor_id();
15052 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
15053 + struct tss_struct *tss = init_tss + cpu;
15054 unsigned fsindex, gsindex;
15055 bool preload_fpu;
15056
15057 @@ -471,10 +471,9 @@ __switch_to(struct task_struct *prev_p,
15058 prev->usersp = percpu_read(old_rsp);
15059 percpu_write(old_rsp, next->usersp);
15060 percpu_write(current_task, next_p);
15061 + percpu_write(current_tinfo, &next_p->tinfo);
15062
15063 - percpu_write(kernel_stack,
15064 - (unsigned long)task_stack_page(next_p) +
15065 - THREAD_SIZE - KERNEL_STACK_OFFSET);
15066 + percpu_write(kernel_stack, next->sp0);
15067
15068 /*
15069 * Now maybe reload the debug registers and handle I/O bitmaps
15070 @@ -536,12 +535,11 @@ unsigned long get_wchan(struct task_stru
15071 if (!p || p == current || p->state == TASK_RUNNING)
15072 return 0;
15073 stack = (unsigned long)task_stack_page(p);
15074 - if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
15075 + if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
15076 return 0;
15077 fp = *(u64 *)(p->thread.sp);
15078 do {
15079 - if (fp < (unsigned long)stack ||
15080 - fp >= (unsigned long)stack+THREAD_SIZE)
15081 + if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
15082 return 0;
15083 ip = *(u64 *)(fp+8);
15084 if (!in_sched_functions(ip))
15085 diff -urNp linux-3.0.8/arch/x86/kernel/process.c linux-3.0.8/arch/x86/kernel/process.c
15086 --- linux-3.0.8/arch/x86/kernel/process.c 2011-07-21 22:17:23.000000000 -0400
15087 +++ linux-3.0.8/arch/x86/kernel/process.c 2011-08-30 18:23:52.000000000 -0400
15088 @@ -48,16 +48,33 @@ void free_thread_xstate(struct task_stru
15089
15090 void free_thread_info(struct thread_info *ti)
15091 {
15092 - free_thread_xstate(ti->task);
15093 free_pages((unsigned long)ti, get_order(THREAD_SIZE));
15094 }
15095
15096 +static struct kmem_cache *task_struct_cachep;
15097 +
15098 void arch_task_cache_init(void)
15099 {
15100 - task_xstate_cachep =
15101 - kmem_cache_create("task_xstate", xstate_size,
15102 + /* create a slab on which task_structs can be allocated */
15103 + task_struct_cachep =
15104 + kmem_cache_create("task_struct", sizeof(struct task_struct),
15105 + ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
15106 +
15107 + task_xstate_cachep =
15108 + kmem_cache_create("task_xstate", xstate_size,
15109 __alignof__(union thread_xstate),
15110 - SLAB_PANIC | SLAB_NOTRACK, NULL);
15111 + SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
15112 +}
15113 +
15114 +struct task_struct *alloc_task_struct_node(int node)
15115 +{
15116 + return kmem_cache_alloc_node(task_struct_cachep, GFP_KERNEL, node);
15117 +}
15118 +
15119 +void free_task_struct(struct task_struct *task)
15120 +{
15121 + free_thread_xstate(task);
15122 + kmem_cache_free(task_struct_cachep, task);
15123 }
15124
15125 /*
15126 @@ -70,7 +87,7 @@ void exit_thread(void)
15127 unsigned long *bp = t->io_bitmap_ptr;
15128
15129 if (bp) {
15130 - struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
15131 + struct tss_struct *tss = init_tss + get_cpu();
15132
15133 t->io_bitmap_ptr = NULL;
15134 clear_thread_flag(TIF_IO_BITMAP);
15135 @@ -106,7 +123,7 @@ void show_regs_common(void)
15136
15137 printk(KERN_CONT "\n");
15138 printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s",
15139 - current->pid, current->comm, print_tainted(),
15140 + task_pid_nr(current), current->comm, print_tainted(),
15141 init_utsname()->release,
15142 (int)strcspn(init_utsname()->version, " "),
15143 init_utsname()->version);
15144 @@ -120,6 +137,9 @@ void flush_thread(void)
15145 {
15146 struct task_struct *tsk = current;
15147
15148 +#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
15149 + loadsegment(gs, 0);
15150 +#endif
15151 flush_ptrace_hw_breakpoint(tsk);
15152 memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
15153 /*
15154 @@ -282,10 +302,10 @@ int kernel_thread(int (*fn)(void *), voi
15155 regs.di = (unsigned long) arg;
15156
15157 #ifdef CONFIG_X86_32
15158 - regs.ds = __USER_DS;
15159 - regs.es = __USER_DS;
15160 + regs.ds = __KERNEL_DS;
15161 + regs.es = __KERNEL_DS;
15162 regs.fs = __KERNEL_PERCPU;
15163 - regs.gs = __KERNEL_STACK_CANARY;
15164 + savesegment(gs, regs.gs);
15165 #else
15166 regs.ss = __KERNEL_DS;
15167 #endif
15168 @@ -403,7 +423,7 @@ void default_idle(void)
15169 EXPORT_SYMBOL(default_idle);
15170 #endif
15171
15172 -void stop_this_cpu(void *dummy)
15173 +__noreturn void stop_this_cpu(void *dummy)
15174 {
15175 local_irq_disable();
15176 /*
15177 @@ -668,16 +688,37 @@ static int __init idle_setup(char *str)
15178 }
15179 early_param("idle", idle_setup);
15180
15181 -unsigned long arch_align_stack(unsigned long sp)
15182 +#ifdef CONFIG_PAX_RANDKSTACK
15183 +void pax_randomize_kstack(struct pt_regs *regs)
15184 {
15185 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
15186 - sp -= get_random_int() % 8192;
15187 - return sp & ~0xf;
15188 -}
15189 + struct thread_struct *thread = &current->thread;
15190 + unsigned long time;
15191
15192 -unsigned long arch_randomize_brk(struct mm_struct *mm)
15193 -{
15194 - unsigned long range_end = mm->brk + 0x02000000;
15195 - return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
15196 -}
15197 + if (!randomize_va_space)
15198 + return;
15199 +
15200 + if (v8086_mode(regs))
15201 + return;
15202
15203 + rdtscl(time);
15204 +
15205 + /* P4 seems to return a 0 LSB, ignore it */
15206 +#ifdef CONFIG_MPENTIUM4
15207 + time &= 0x3EUL;
15208 + time <<= 2;
15209 +#elif defined(CONFIG_X86_64)
15210 + time &= 0xFUL;
15211 + time <<= 4;
15212 +#else
15213 + time &= 0x1FUL;
15214 + time <<= 3;
15215 +#endif
15216 +
15217 + thread->sp0 ^= time;
15218 + load_sp0(init_tss + smp_processor_id(), thread);
15219 +
15220 +#ifdef CONFIG_X86_64
15221 + percpu_write(kernel_stack, thread->sp0);
15222 +#endif
15223 +}
15224 +#endif
15225 diff -urNp linux-3.0.8/arch/x86/kernel/ptrace.c linux-3.0.8/arch/x86/kernel/ptrace.c
15226 --- linux-3.0.8/arch/x86/kernel/ptrace.c 2011-07-21 22:17:23.000000000 -0400
15227 +++ linux-3.0.8/arch/x86/kernel/ptrace.c 2011-08-23 21:47:55.000000000 -0400
15228 @@ -821,7 +821,7 @@ long arch_ptrace(struct task_struct *chi
15229 unsigned long addr, unsigned long data)
15230 {
15231 int ret;
15232 - unsigned long __user *datap = (unsigned long __user *)data;
15233 + unsigned long __user *datap = (__force unsigned long __user *)data;
15234
15235 switch (request) {
15236 /* read the word at location addr in the USER area. */
15237 @@ -906,14 +906,14 @@ long arch_ptrace(struct task_struct *chi
15238 if ((int) addr < 0)
15239 return -EIO;
15240 ret = do_get_thread_area(child, addr,
15241 - (struct user_desc __user *)data);
15242 + (__force struct user_desc __user *) data);
15243 break;
15244
15245 case PTRACE_SET_THREAD_AREA:
15246 if ((int) addr < 0)
15247 return -EIO;
15248 ret = do_set_thread_area(child, addr,
15249 - (struct user_desc __user *)data, 0);
15250 + (__force struct user_desc __user *) data, 0);
15251 break;
15252 #endif
15253
15254 @@ -1330,7 +1330,7 @@ static void fill_sigtrap_info(struct tas
15255 memset(info, 0, sizeof(*info));
15256 info->si_signo = SIGTRAP;
15257 info->si_code = si_code;
15258 - info->si_addr = user_mode_vm(regs) ? (void __user *)regs->ip : NULL;
15259 + info->si_addr = user_mode(regs) ? (__force void __user *)regs->ip : NULL;
15260 }
15261
15262 void user_single_step_siginfo(struct task_struct *tsk,
15263 diff -urNp linux-3.0.8/arch/x86/kernel/pvclock.c linux-3.0.8/arch/x86/kernel/pvclock.c
15264 --- linux-3.0.8/arch/x86/kernel/pvclock.c 2011-07-21 22:17:23.000000000 -0400
15265 +++ linux-3.0.8/arch/x86/kernel/pvclock.c 2011-08-23 21:47:55.000000000 -0400
15266 @@ -81,11 +81,11 @@ unsigned long pvclock_tsc_khz(struct pvc
15267 return pv_tsc_khz;
15268 }
15269
15270 -static atomic64_t last_value = ATOMIC64_INIT(0);
15271 +static atomic64_unchecked_t last_value = ATOMIC64_INIT(0);
15272
15273 void pvclock_resume(void)
15274 {
15275 - atomic64_set(&last_value, 0);
15276 + atomic64_set_unchecked(&last_value, 0);
15277 }
15278
15279 cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
15280 @@ -121,11 +121,11 @@ cycle_t pvclock_clocksource_read(struct
15281 * updating at the same time, and one of them could be slightly behind,
15282 * making the assumption that last_value always go forward fail to hold.
15283 */
15284 - last = atomic64_read(&last_value);
15285 + last = atomic64_read_unchecked(&last_value);
15286 do {
15287 if (ret < last)
15288 return last;
15289 - last = atomic64_cmpxchg(&last_value, last, ret);
15290 + last = atomic64_cmpxchg_unchecked(&last_value, last, ret);
15291 } while (unlikely(last != ret));
15292
15293 return ret;
15294 diff -urNp linux-3.0.8/arch/x86/kernel/reboot.c linux-3.0.8/arch/x86/kernel/reboot.c
15295 --- linux-3.0.8/arch/x86/kernel/reboot.c 2011-07-21 22:17:23.000000000 -0400
15296 +++ linux-3.0.8/arch/x86/kernel/reboot.c 2011-08-23 21:47:55.000000000 -0400
15297 @@ -35,7 +35,7 @@ void (*pm_power_off)(void);
15298 EXPORT_SYMBOL(pm_power_off);
15299
15300 static const struct desc_ptr no_idt = {};
15301 -static int reboot_mode;
15302 +static unsigned short reboot_mode;
15303 enum reboot_type reboot_type = BOOT_ACPI;
15304 int reboot_force;
15305
15306 @@ -315,13 +315,17 @@ core_initcall(reboot_init);
15307 extern const unsigned char machine_real_restart_asm[];
15308 extern const u64 machine_real_restart_gdt[3];
15309
15310 -void machine_real_restart(unsigned int type)
15311 +__noreturn void machine_real_restart(unsigned int type)
15312 {
15313 void *restart_va;
15314 unsigned long restart_pa;
15315 - void (*restart_lowmem)(unsigned int);
15316 + void (* __noreturn restart_lowmem)(unsigned int);
15317 u64 *lowmem_gdt;
15318
15319 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
15320 + struct desc_struct *gdt;
15321 +#endif
15322 +
15323 local_irq_disable();
15324
15325 /* Write zero to CMOS register number 0x0f, which the BIOS POST
15326 @@ -347,14 +351,14 @@ void machine_real_restart(unsigned int t
15327 boot)". This seems like a fairly standard thing that gets set by
15328 REBOOT.COM programs, and the previous reset routine did this
15329 too. */
15330 - *((unsigned short *)0x472) = reboot_mode;
15331 + *(unsigned short *)(__va(0x472)) = reboot_mode;
15332
15333 /* Patch the GDT in the low memory trampoline */
15334 lowmem_gdt = TRAMPOLINE_SYM(machine_real_restart_gdt);
15335
15336 restart_va = TRAMPOLINE_SYM(machine_real_restart_asm);
15337 restart_pa = virt_to_phys(restart_va);
15338 - restart_lowmem = (void (*)(unsigned int))restart_pa;
15339 + restart_lowmem = (void *)restart_pa;
15340
15341 /* GDT[0]: GDT self-pointer */
15342 lowmem_gdt[0] =
15343 @@ -365,7 +369,33 @@ void machine_real_restart(unsigned int t
15344 GDT_ENTRY(0x009b, restart_pa, 0xffff);
15345
15346 /* Jump to the identity-mapped low memory code */
15347 +
15348 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
15349 + gdt = get_cpu_gdt_table(smp_processor_id());
15350 + pax_open_kernel();
15351 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15352 + gdt[GDT_ENTRY_KERNEL_DS].type = 3;
15353 + gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
15354 + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
15355 +#endif
15356 +#ifdef CONFIG_PAX_KERNEXEC
15357 + gdt[GDT_ENTRY_KERNEL_CS].base0 = 0;
15358 + gdt[GDT_ENTRY_KERNEL_CS].base1 = 0;
15359 + gdt[GDT_ENTRY_KERNEL_CS].base2 = 0;
15360 + gdt[GDT_ENTRY_KERNEL_CS].limit0 = 0xffff;
15361 + gdt[GDT_ENTRY_KERNEL_CS].limit = 0xf;
15362 + gdt[GDT_ENTRY_KERNEL_CS].g = 1;
15363 +#endif
15364 + pax_close_kernel();
15365 +#endif
15366 +
15367 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
15368 + asm volatile("push %0; push %1; lret\n" : : "i" (__KERNEL_CS), "rm" (restart_lowmem), "a" (type));
15369 + unreachable();
15370 +#else
15371 restart_lowmem(type);
15372 +#endif
15373 +
15374 }
15375 #ifdef CONFIG_APM_MODULE
15376 EXPORT_SYMBOL(machine_real_restart);
15377 @@ -523,7 +553,7 @@ void __attribute__((weak)) mach_reboot_f
15378 * try to force a triple fault and then cycle between hitting the keyboard
15379 * controller and doing that
15380 */
15381 -static void native_machine_emergency_restart(void)
15382 +__noreturn static void native_machine_emergency_restart(void)
15383 {
15384 int i;
15385 int attempt = 0;
15386 @@ -647,13 +677,13 @@ void native_machine_shutdown(void)
15387 #endif
15388 }
15389
15390 -static void __machine_emergency_restart(int emergency)
15391 +static __noreturn void __machine_emergency_restart(int emergency)
15392 {
15393 reboot_emergency = emergency;
15394 machine_ops.emergency_restart();
15395 }
15396
15397 -static void native_machine_restart(char *__unused)
15398 +static __noreturn void native_machine_restart(char *__unused)
15399 {
15400 printk("machine restart\n");
15401
15402 @@ -662,7 +692,7 @@ static void native_machine_restart(char
15403 __machine_emergency_restart(0);
15404 }
15405
15406 -static void native_machine_halt(void)
15407 +static __noreturn void native_machine_halt(void)
15408 {
15409 /* stop other cpus and apics */
15410 machine_shutdown();
15411 @@ -673,7 +703,7 @@ static void native_machine_halt(void)
15412 stop_this_cpu(NULL);
15413 }
15414
15415 -static void native_machine_power_off(void)
15416 +__noreturn static void native_machine_power_off(void)
15417 {
15418 if (pm_power_off) {
15419 if (!reboot_force)
15420 @@ -682,6 +712,7 @@ static void native_machine_power_off(voi
15421 }
15422 /* a fallback in case there is no PM info available */
15423 tboot_shutdown(TB_SHUTDOWN_HALT);
15424 + unreachable();
15425 }
15426
15427 struct machine_ops machine_ops = {
15428 diff -urNp linux-3.0.8/arch/x86/kernel/setup.c linux-3.0.8/arch/x86/kernel/setup.c
15429 --- linux-3.0.8/arch/x86/kernel/setup.c 2011-07-21 22:17:23.000000000 -0400
15430 +++ linux-3.0.8/arch/x86/kernel/setup.c 2011-10-06 04:17:55.000000000 -0400
15431 @@ -447,7 +447,7 @@ static void __init parse_setup_data(void
15432
15433 switch (data->type) {
15434 case SETUP_E820_EXT:
15435 - parse_e820_ext(data);
15436 + parse_e820_ext((struct setup_data __force_kernel *)data);
15437 break;
15438 case SETUP_DTB:
15439 add_dtb(pa_data);
15440 @@ -650,7 +650,7 @@ static void __init trim_bios_range(void)
15441 * area (640->1Mb) as ram even though it is not.
15442 * take them out.
15443 */
15444 - e820_remove_range(BIOS_BEGIN, BIOS_END - BIOS_BEGIN, E820_RAM, 1);
15445 + e820_remove_range(ISA_START_ADDRESS, ISA_END_ADDRESS - ISA_START_ADDRESS, E820_RAM, 1);
15446 sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
15447 }
15448
15449 @@ -773,14 +773,14 @@ void __init setup_arch(char **cmdline_p)
15450
15451 if (!boot_params.hdr.root_flags)
15452 root_mountflags &= ~MS_RDONLY;
15453 - init_mm.start_code = (unsigned long) _text;
15454 - init_mm.end_code = (unsigned long) _etext;
15455 + init_mm.start_code = ktla_ktva((unsigned long) _text);
15456 + init_mm.end_code = ktla_ktva((unsigned long) _etext);
15457 init_mm.end_data = (unsigned long) _edata;
15458 init_mm.brk = _brk_end;
15459
15460 - code_resource.start = virt_to_phys(_text);
15461 - code_resource.end = virt_to_phys(_etext)-1;
15462 - data_resource.start = virt_to_phys(_etext);
15463 + code_resource.start = virt_to_phys(ktla_ktva(_text));
15464 + code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
15465 + data_resource.start = virt_to_phys(_sdata);
15466 data_resource.end = virt_to_phys(_edata)-1;
15467 bss_resource.start = virt_to_phys(&__bss_start);
15468 bss_resource.end = virt_to_phys(&__bss_stop)-1;
15469 diff -urNp linux-3.0.8/arch/x86/kernel/setup_percpu.c linux-3.0.8/arch/x86/kernel/setup_percpu.c
15470 --- linux-3.0.8/arch/x86/kernel/setup_percpu.c 2011-07-21 22:17:23.000000000 -0400
15471 +++ linux-3.0.8/arch/x86/kernel/setup_percpu.c 2011-08-23 21:47:55.000000000 -0400
15472 @@ -21,19 +21,17 @@
15473 #include <asm/cpu.h>
15474 #include <asm/stackprotector.h>
15475
15476 -DEFINE_PER_CPU(int, cpu_number);
15477 +#ifdef CONFIG_SMP
15478 +DEFINE_PER_CPU(unsigned int, cpu_number);
15479 EXPORT_PER_CPU_SYMBOL(cpu_number);
15480 +#endif
15481
15482 -#ifdef CONFIG_X86_64
15483 #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
15484 -#else
15485 -#define BOOT_PERCPU_OFFSET 0
15486 -#endif
15487
15488 DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
15489 EXPORT_PER_CPU_SYMBOL(this_cpu_off);
15490
15491 -unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
15492 +unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
15493 [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
15494 };
15495 EXPORT_SYMBOL(__per_cpu_offset);
15496 @@ -155,10 +153,10 @@ static inline void setup_percpu_segment(
15497 {
15498 #ifdef CONFIG_X86_32
15499 struct desc_struct gdt;
15500 + unsigned long base = per_cpu_offset(cpu);
15501
15502 - pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
15503 - 0x2 | DESCTYPE_S, 0x8);
15504 - gdt.s = 1;
15505 + pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
15506 + 0x83 | DESCTYPE_S, 0xC);
15507 write_gdt_entry(get_cpu_gdt_table(cpu),
15508 GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
15509 #endif
15510 @@ -207,6 +205,11 @@ void __init setup_per_cpu_areas(void)
15511 /* alrighty, percpu areas up and running */
15512 delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
15513 for_each_possible_cpu(cpu) {
15514 +#ifdef CONFIG_CC_STACKPROTECTOR
15515 +#ifdef CONFIG_X86_32
15516 + unsigned long canary = per_cpu(stack_canary.canary, cpu);
15517 +#endif
15518 +#endif
15519 per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
15520 per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
15521 per_cpu(cpu_number, cpu) = cpu;
15522 @@ -247,6 +250,12 @@ void __init setup_per_cpu_areas(void)
15523 */
15524 set_cpu_numa_node(cpu, early_cpu_to_node(cpu));
15525 #endif
15526 +#ifdef CONFIG_CC_STACKPROTECTOR
15527 +#ifdef CONFIG_X86_32
15528 + if (!cpu)
15529 + per_cpu(stack_canary.canary, cpu) = canary;
15530 +#endif
15531 +#endif
15532 /*
15533 * Up to this point, the boot CPU has been using .init.data
15534 * area. Reload any changed state for the boot CPU.
15535 diff -urNp linux-3.0.8/arch/x86/kernel/signal.c linux-3.0.8/arch/x86/kernel/signal.c
15536 --- linux-3.0.8/arch/x86/kernel/signal.c 2011-07-21 22:17:23.000000000 -0400
15537 +++ linux-3.0.8/arch/x86/kernel/signal.c 2011-08-23 21:48:14.000000000 -0400
15538 @@ -198,7 +198,7 @@ static unsigned long align_sigframe(unsi
15539 * Align the stack pointer according to the i386 ABI,
15540 * i.e. so that on function entry ((sp + 4) & 15) == 0.
15541 */
15542 - sp = ((sp + 4) & -16ul) - 4;
15543 + sp = ((sp - 12) & -16ul) - 4;
15544 #else /* !CONFIG_X86_32 */
15545 sp = round_down(sp, 16) - 8;
15546 #endif
15547 @@ -249,11 +249,11 @@ get_sigframe(struct k_sigaction *ka, str
15548 * Return an always-bogus address instead so we will die with SIGSEGV.
15549 */
15550 if (onsigstack && !likely(on_sig_stack(sp)))
15551 - return (void __user *)-1L;
15552 + return (__force void __user *)-1L;
15553
15554 /* save i387 state */
15555 if (used_math() && save_i387_xstate(*fpstate) < 0)
15556 - return (void __user *)-1L;
15557 + return (__force void __user *)-1L;
15558
15559 return (void __user *)sp;
15560 }
15561 @@ -308,9 +308,9 @@ __setup_frame(int sig, struct k_sigactio
15562 }
15563
15564 if (current->mm->context.vdso)
15565 - restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
15566 + restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
15567 else
15568 - restorer = &frame->retcode;
15569 + restorer = (void __user *)&frame->retcode;
15570 if (ka->sa.sa_flags & SA_RESTORER)
15571 restorer = ka->sa.sa_restorer;
15572
15573 @@ -324,7 +324,7 @@ __setup_frame(int sig, struct k_sigactio
15574 * reasons and because gdb uses it as a signature to notice
15575 * signal handler stack frames.
15576 */
15577 - err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
15578 + err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
15579
15580 if (err)
15581 return -EFAULT;
15582 @@ -378,7 +378,10 @@ static int __setup_rt_frame(int sig, str
15583 err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
15584
15585 /* Set up to return from userspace. */
15586 - restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
15587 + if (current->mm->context.vdso)
15588 + restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
15589 + else
15590 + restorer = (void __user *)&frame->retcode;
15591 if (ka->sa.sa_flags & SA_RESTORER)
15592 restorer = ka->sa.sa_restorer;
15593 put_user_ex(restorer, &frame->pretcode);
15594 @@ -390,7 +393,7 @@ static int __setup_rt_frame(int sig, str
15595 * reasons and because gdb uses it as a signature to notice
15596 * signal handler stack frames.
15597 */
15598 - put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
15599 + put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
15600 } put_user_catch(err);
15601
15602 if (err)
15603 @@ -769,6 +772,8 @@ static void do_signal(struct pt_regs *re
15604 int signr;
15605 sigset_t *oldset;
15606
15607 + pax_track_stack();
15608 +
15609 /*
15610 * We want the common case to go fast, which is why we may in certain
15611 * cases get here from kernel mode. Just return without doing anything
15612 @@ -776,7 +781,7 @@ static void do_signal(struct pt_regs *re
15613 * X86_32: vm86 regs switched out by assembly code before reaching
15614 * here, so testing against kernel CS suffices.
15615 */
15616 - if (!user_mode(regs))
15617 + if (!user_mode_novm(regs))
15618 return;
15619
15620 if (current_thread_info()->status & TS_RESTORE_SIGMASK)
15621 diff -urNp linux-3.0.8/arch/x86/kernel/smpboot.c linux-3.0.8/arch/x86/kernel/smpboot.c
15622 --- linux-3.0.8/arch/x86/kernel/smpboot.c 2011-07-21 22:17:23.000000000 -0400
15623 +++ linux-3.0.8/arch/x86/kernel/smpboot.c 2011-08-23 21:47:55.000000000 -0400
15624 @@ -709,17 +709,20 @@ static int __cpuinit do_boot_cpu(int api
15625 set_idle_for_cpu(cpu, c_idle.idle);
15626 do_rest:
15627 per_cpu(current_task, cpu) = c_idle.idle;
15628 + per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
15629 #ifdef CONFIG_X86_32
15630 /* Stack for startup_32 can be just as for start_secondary onwards */
15631 irq_ctx_init(cpu);
15632 #else
15633 clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
15634 initial_gs = per_cpu_offset(cpu);
15635 - per_cpu(kernel_stack, cpu) =
15636 - (unsigned long)task_stack_page(c_idle.idle) -
15637 - KERNEL_STACK_OFFSET + THREAD_SIZE;
15638 + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
15639 #endif
15640 +
15641 + pax_open_kernel();
15642 early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
15643 + pax_close_kernel();
15644 +
15645 initial_code = (unsigned long)start_secondary;
15646 stack_start = c_idle.idle->thread.sp;
15647
15648 @@ -861,6 +864,12 @@ int __cpuinit native_cpu_up(unsigned int
15649
15650 per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
15651
15652 +#ifdef CONFIG_PAX_PER_CPU_PGD
15653 + clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
15654 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
15655 + KERNEL_PGD_PTRS);
15656 +#endif
15657 +
15658 err = do_boot_cpu(apicid, cpu);
15659 if (err) {
15660 pr_debug("do_boot_cpu failed %d\n", err);
15661 diff -urNp linux-3.0.8/arch/x86/kernel/step.c linux-3.0.8/arch/x86/kernel/step.c
15662 --- linux-3.0.8/arch/x86/kernel/step.c 2011-07-21 22:17:23.000000000 -0400
15663 +++ linux-3.0.8/arch/x86/kernel/step.c 2011-08-23 21:47:55.000000000 -0400
15664 @@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
15665 struct desc_struct *desc;
15666 unsigned long base;
15667
15668 - seg &= ~7UL;
15669 + seg >>= 3;
15670
15671 mutex_lock(&child->mm->context.lock);
15672 - if (unlikely((seg >> 3) >= child->mm->context.size))
15673 + if (unlikely(seg >= child->mm->context.size))
15674 addr = -1L; /* bogus selector, access would fault */
15675 else {
15676 desc = child->mm->context.ldt + seg;
15677 @@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struc
15678 addr += base;
15679 }
15680 mutex_unlock(&child->mm->context.lock);
15681 - }
15682 + } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
15683 + addr = ktla_ktva(addr);
15684
15685 return addr;
15686 }
15687 @@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct t
15688 unsigned char opcode[15];
15689 unsigned long addr = convert_ip_to_linear(child, regs);
15690
15691 + if (addr == -EINVAL)
15692 + return 0;
15693 +
15694 copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
15695 for (i = 0; i < copied; i++) {
15696 switch (opcode[i]) {
15697 @@ -74,7 +78,7 @@ static int is_setting_trap_flag(struct t
15698
15699 #ifdef CONFIG_X86_64
15700 case 0x40 ... 0x4f:
15701 - if (regs->cs != __USER_CS)
15702 + if ((regs->cs & 0xffff) != __USER_CS)
15703 /* 32-bit mode: register increment */
15704 return 0;
15705 /* 64-bit mode: REX prefix */
15706 diff -urNp linux-3.0.8/arch/x86/kernel/syscall_table_32.S linux-3.0.8/arch/x86/kernel/syscall_table_32.S
15707 --- linux-3.0.8/arch/x86/kernel/syscall_table_32.S 2011-07-21 22:17:23.000000000 -0400
15708 +++ linux-3.0.8/arch/x86/kernel/syscall_table_32.S 2011-08-23 21:47:55.000000000 -0400
15709 @@ -1,3 +1,4 @@
15710 +.section .rodata,"a",@progbits
15711 ENTRY(sys_call_table)
15712 .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
15713 .long sys_exit
15714 diff -urNp linux-3.0.8/arch/x86/kernel/sys_i386_32.c linux-3.0.8/arch/x86/kernel/sys_i386_32.c
15715 --- linux-3.0.8/arch/x86/kernel/sys_i386_32.c 2011-07-21 22:17:23.000000000 -0400
15716 +++ linux-3.0.8/arch/x86/kernel/sys_i386_32.c 2011-08-23 21:47:55.000000000 -0400
15717 @@ -24,17 +24,224 @@
15718
15719 #include <asm/syscalls.h>
15720
15721 -/*
15722 - * Do a system call from kernel instead of calling sys_execve so we
15723 - * end up with proper pt_regs.
15724 - */
15725 -int kernel_execve(const char *filename,
15726 - const char *const argv[],
15727 - const char *const envp[])
15728 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
15729 {
15730 - long __res;
15731 - asm volatile ("int $0x80"
15732 - : "=a" (__res)
15733 - : "0" (__NR_execve), "b" (filename), "c" (argv), "d" (envp) : "memory");
15734 - return __res;
15735 + unsigned long pax_task_size = TASK_SIZE;
15736 +
15737 +#ifdef CONFIG_PAX_SEGMEXEC
15738 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
15739 + pax_task_size = SEGMEXEC_TASK_SIZE;
15740 +#endif
15741 +
15742 + if (len > pax_task_size || addr > pax_task_size - len)
15743 + return -EINVAL;
15744 +
15745 + return 0;
15746 +}
15747 +
15748 +unsigned long
15749 +arch_get_unmapped_area(struct file *filp, unsigned long addr,
15750 + unsigned long len, unsigned long pgoff, unsigned long flags)
15751 +{
15752 + struct mm_struct *mm = current->mm;
15753 + struct vm_area_struct *vma;
15754 + unsigned long start_addr, pax_task_size = TASK_SIZE;
15755 +
15756 +#ifdef CONFIG_PAX_SEGMEXEC
15757 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
15758 + pax_task_size = SEGMEXEC_TASK_SIZE;
15759 +#endif
15760 +
15761 + pax_task_size -= PAGE_SIZE;
15762 +
15763 + if (len > pax_task_size)
15764 + return -ENOMEM;
15765 +
15766 + if (flags & MAP_FIXED)
15767 + return addr;
15768 +
15769 +#ifdef CONFIG_PAX_RANDMMAP
15770 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
15771 +#endif
15772 +
15773 + if (addr) {
15774 + addr = PAGE_ALIGN(addr);
15775 + if (pax_task_size - len >= addr) {
15776 + vma = find_vma(mm, addr);
15777 + if (check_heap_stack_gap(vma, addr, len))
15778 + return addr;
15779 + }
15780 + }
15781 + if (len > mm->cached_hole_size) {
15782 + start_addr = addr = mm->free_area_cache;
15783 + } else {
15784 + start_addr = addr = mm->mmap_base;
15785 + mm->cached_hole_size = 0;
15786 + }
15787 +
15788 +#ifdef CONFIG_PAX_PAGEEXEC
15789 + if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
15790 + start_addr = 0x00110000UL;
15791 +
15792 +#ifdef CONFIG_PAX_RANDMMAP
15793 + if (mm->pax_flags & MF_PAX_RANDMMAP)
15794 + start_addr += mm->delta_mmap & 0x03FFF000UL;
15795 +#endif
15796 +
15797 + if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
15798 + start_addr = addr = mm->mmap_base;
15799 + else
15800 + addr = start_addr;
15801 + }
15802 +#endif
15803 +
15804 +full_search:
15805 + for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
15806 + /* At this point: (!vma || addr < vma->vm_end). */
15807 + if (pax_task_size - len < addr) {
15808 + /*
15809 + * Start a new search - just in case we missed
15810 + * some holes.
15811 + */
15812 + if (start_addr != mm->mmap_base) {
15813 + start_addr = addr = mm->mmap_base;
15814 + mm->cached_hole_size = 0;
15815 + goto full_search;
15816 + }
15817 + return -ENOMEM;
15818 + }
15819 + if (check_heap_stack_gap(vma, addr, len))
15820 + break;
15821 + if (addr + mm->cached_hole_size < vma->vm_start)
15822 + mm->cached_hole_size = vma->vm_start - addr;
15823 + addr = vma->vm_end;
15824 + if (mm->start_brk <= addr && addr < mm->mmap_base) {
15825 + start_addr = addr = mm->mmap_base;
15826 + mm->cached_hole_size = 0;
15827 + goto full_search;
15828 + }
15829 + }
15830 +
15831 + /*
15832 + * Remember the place where we stopped the search:
15833 + */
15834 + mm->free_area_cache = addr + len;
15835 + return addr;
15836 +}
15837 +
15838 +unsigned long
15839 +arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
15840 + const unsigned long len, const unsigned long pgoff,
15841 + const unsigned long flags)
15842 +{
15843 + struct vm_area_struct *vma;
15844 + struct mm_struct *mm = current->mm;
15845 + unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
15846 +
15847 +#ifdef CONFIG_PAX_SEGMEXEC
15848 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
15849 + pax_task_size = SEGMEXEC_TASK_SIZE;
15850 +#endif
15851 +
15852 + pax_task_size -= PAGE_SIZE;
15853 +
15854 + /* requested length too big for entire address space */
15855 + if (len > pax_task_size)
15856 + return -ENOMEM;
15857 +
15858 + if (flags & MAP_FIXED)
15859 + return addr;
15860 +
15861 +#ifdef CONFIG_PAX_PAGEEXEC
15862 + if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
15863 + goto bottomup;
15864 +#endif
15865 +
15866 +#ifdef CONFIG_PAX_RANDMMAP
15867 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
15868 +#endif
15869 +
15870 + /* requesting a specific address */
15871 + if (addr) {
15872 + addr = PAGE_ALIGN(addr);
15873 + if (pax_task_size - len >= addr) {
15874 + vma = find_vma(mm, addr);
15875 + if (check_heap_stack_gap(vma, addr, len))
15876 + return addr;
15877 + }
15878 + }
15879 +
15880 + /* check if free_area_cache is useful for us */
15881 + if (len <= mm->cached_hole_size) {
15882 + mm->cached_hole_size = 0;
15883 + mm->free_area_cache = mm->mmap_base;
15884 + }
15885 +
15886 + /* either no address requested or can't fit in requested address hole */
15887 + addr = mm->free_area_cache;
15888 +
15889 + /* make sure it can fit in the remaining address space */
15890 + if (addr > len) {
15891 + vma = find_vma(mm, addr-len);
15892 + if (check_heap_stack_gap(vma, addr - len, len))
15893 + /* remember the address as a hint for next time */
15894 + return (mm->free_area_cache = addr-len);
15895 + }
15896 +
15897 + if (mm->mmap_base < len)
15898 + goto bottomup;
15899 +
15900 + addr = mm->mmap_base-len;
15901 +
15902 + do {
15903 + /*
15904 + * Lookup failure means no vma is above this address,
15905 + * else if new region fits below vma->vm_start,
15906 + * return with success:
15907 + */
15908 + vma = find_vma(mm, addr);
15909 + if (check_heap_stack_gap(vma, addr, len))
15910 + /* remember the address as a hint for next time */
15911 + return (mm->free_area_cache = addr);
15912 +
15913 + /* remember the largest hole we saw so far */
15914 + if (addr + mm->cached_hole_size < vma->vm_start)
15915 + mm->cached_hole_size = vma->vm_start - addr;
15916 +
15917 + /* try just below the current vma->vm_start */
15918 + addr = skip_heap_stack_gap(vma, len);
15919 + } while (!IS_ERR_VALUE(addr));
15920 +
15921 +bottomup:
15922 + /*
15923 + * A failed mmap() very likely causes application failure,
15924 + * so fall back to the bottom-up function here. This scenario
15925 + * can happen with large stack limits and large mmap()
15926 + * allocations.
15927 + */
15928 +
15929 +#ifdef CONFIG_PAX_SEGMEXEC
15930 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
15931 + mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
15932 + else
15933 +#endif
15934 +
15935 + mm->mmap_base = TASK_UNMAPPED_BASE;
15936 +
15937 +#ifdef CONFIG_PAX_RANDMMAP
15938 + if (mm->pax_flags & MF_PAX_RANDMMAP)
15939 + mm->mmap_base += mm->delta_mmap;
15940 +#endif
15941 +
15942 + mm->free_area_cache = mm->mmap_base;
15943 + mm->cached_hole_size = ~0UL;
15944 + addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
15945 + /*
15946 + * Restore the topdown base:
15947 + */
15948 + mm->mmap_base = base;
15949 + mm->free_area_cache = base;
15950 + mm->cached_hole_size = ~0UL;
15951 +
15952 + return addr;
15953 }
15954 diff -urNp linux-3.0.8/arch/x86/kernel/sys_x86_64.c linux-3.0.8/arch/x86/kernel/sys_x86_64.c
15955 --- linux-3.0.8/arch/x86/kernel/sys_x86_64.c 2011-07-21 22:17:23.000000000 -0400
15956 +++ linux-3.0.8/arch/x86/kernel/sys_x86_64.c 2011-08-23 21:47:55.000000000 -0400
15957 @@ -32,8 +32,8 @@ out:
15958 return error;
15959 }
15960
15961 -static void find_start_end(unsigned long flags, unsigned long *begin,
15962 - unsigned long *end)
15963 +static void find_start_end(struct mm_struct *mm, unsigned long flags,
15964 + unsigned long *begin, unsigned long *end)
15965 {
15966 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
15967 unsigned long new_begin;
15968 @@ -52,7 +52,7 @@ static void find_start_end(unsigned long
15969 *begin = new_begin;
15970 }
15971 } else {
15972 - *begin = TASK_UNMAPPED_BASE;
15973 + *begin = mm->mmap_base;
15974 *end = TASK_SIZE;
15975 }
15976 }
15977 @@ -69,16 +69,19 @@ arch_get_unmapped_area(struct file *filp
15978 if (flags & MAP_FIXED)
15979 return addr;
15980
15981 - find_start_end(flags, &begin, &end);
15982 + find_start_end(mm, flags, &begin, &end);
15983
15984 if (len > end)
15985 return -ENOMEM;
15986
15987 +#ifdef CONFIG_PAX_RANDMMAP
15988 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
15989 +#endif
15990 +
15991 if (addr) {
15992 addr = PAGE_ALIGN(addr);
15993 vma = find_vma(mm, addr);
15994 - if (end - len >= addr &&
15995 - (!vma || addr + len <= vma->vm_start))
15996 + if (end - len >= addr && check_heap_stack_gap(vma, addr, len))
15997 return addr;
15998 }
15999 if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
16000 @@ -106,7 +109,7 @@ full_search:
16001 }
16002 return -ENOMEM;
16003 }
16004 - if (!vma || addr + len <= vma->vm_start) {
16005 + if (check_heap_stack_gap(vma, addr, len)) {
16006 /*
16007 * Remember the place where we stopped the search:
16008 */
16009 @@ -128,7 +131,7 @@ arch_get_unmapped_area_topdown(struct fi
16010 {
16011 struct vm_area_struct *vma;
16012 struct mm_struct *mm = current->mm;
16013 - unsigned long addr = addr0;
16014 + unsigned long base = mm->mmap_base, addr = addr0;
16015
16016 /* requested length too big for entire address space */
16017 if (len > TASK_SIZE)
16018 @@ -141,13 +144,18 @@ arch_get_unmapped_area_topdown(struct fi
16019 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
16020 goto bottomup;
16021
16022 +#ifdef CONFIG_PAX_RANDMMAP
16023 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
16024 +#endif
16025 +
16026 /* requesting a specific address */
16027 if (addr) {
16028 addr = PAGE_ALIGN(addr);
16029 - vma = find_vma(mm, addr);
16030 - if (TASK_SIZE - len >= addr &&
16031 - (!vma || addr + len <= vma->vm_start))
16032 - return addr;
16033 + if (TASK_SIZE - len >= addr) {
16034 + vma = find_vma(mm, addr);
16035 + if (check_heap_stack_gap(vma, addr, len))
16036 + return addr;
16037 + }
16038 }
16039
16040 /* check if free_area_cache is useful for us */
16041 @@ -162,7 +170,7 @@ arch_get_unmapped_area_topdown(struct fi
16042 /* make sure it can fit in the remaining address space */
16043 if (addr > len) {
16044 vma = find_vma(mm, addr-len);
16045 - if (!vma || addr <= vma->vm_start)
16046 + if (check_heap_stack_gap(vma, addr - len, len))
16047 /* remember the address as a hint for next time */
16048 return mm->free_area_cache = addr-len;
16049 }
16050 @@ -179,7 +187,7 @@ arch_get_unmapped_area_topdown(struct fi
16051 * return with success:
16052 */
16053 vma = find_vma(mm, addr);
16054 - if (!vma || addr+len <= vma->vm_start)
16055 + if (check_heap_stack_gap(vma, addr, len))
16056 /* remember the address as a hint for next time */
16057 return mm->free_area_cache = addr;
16058
16059 @@ -188,8 +196,8 @@ arch_get_unmapped_area_topdown(struct fi
16060 mm->cached_hole_size = vma->vm_start - addr;
16061
16062 /* try just below the current vma->vm_start */
16063 - addr = vma->vm_start-len;
16064 - } while (len < vma->vm_start);
16065 + addr = skip_heap_stack_gap(vma, len);
16066 + } while (!IS_ERR_VALUE(addr));
16067
16068 bottomup:
16069 /*
16070 @@ -198,13 +206,21 @@ bottomup:
16071 * can happen with large stack limits and large mmap()
16072 * allocations.
16073 */
16074 + mm->mmap_base = TASK_UNMAPPED_BASE;
16075 +
16076 +#ifdef CONFIG_PAX_RANDMMAP
16077 + if (mm->pax_flags & MF_PAX_RANDMMAP)
16078 + mm->mmap_base += mm->delta_mmap;
16079 +#endif
16080 +
16081 + mm->free_area_cache = mm->mmap_base;
16082 mm->cached_hole_size = ~0UL;
16083 - mm->free_area_cache = TASK_UNMAPPED_BASE;
16084 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
16085 /*
16086 * Restore the topdown base:
16087 */
16088 - mm->free_area_cache = mm->mmap_base;
16089 + mm->mmap_base = base;
16090 + mm->free_area_cache = base;
16091 mm->cached_hole_size = ~0UL;
16092
16093 return addr;
16094 diff -urNp linux-3.0.8/arch/x86/kernel/tboot.c linux-3.0.8/arch/x86/kernel/tboot.c
16095 --- linux-3.0.8/arch/x86/kernel/tboot.c 2011-07-21 22:17:23.000000000 -0400
16096 +++ linux-3.0.8/arch/x86/kernel/tboot.c 2011-08-23 21:47:55.000000000 -0400
16097 @@ -217,7 +217,7 @@ static int tboot_setup_sleep(void)
16098
16099 void tboot_shutdown(u32 shutdown_type)
16100 {
16101 - void (*shutdown)(void);
16102 + void (* __noreturn shutdown)(void);
16103
16104 if (!tboot_enabled())
16105 return;
16106 @@ -239,7 +239,7 @@ void tboot_shutdown(u32 shutdown_type)
16107
16108 switch_to_tboot_pt();
16109
16110 - shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
16111 + shutdown = (void *)tboot->shutdown_entry;
16112 shutdown();
16113
16114 /* should not reach here */
16115 @@ -296,7 +296,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1
16116 tboot_shutdown(acpi_shutdown_map[sleep_state]);
16117 }
16118
16119 -static atomic_t ap_wfs_count;
16120 +static atomic_unchecked_t ap_wfs_count;
16121
16122 static int tboot_wait_for_aps(int num_aps)
16123 {
16124 @@ -320,9 +320,9 @@ static int __cpuinit tboot_cpu_callback(
16125 {
16126 switch (action) {
16127 case CPU_DYING:
16128 - atomic_inc(&ap_wfs_count);
16129 + atomic_inc_unchecked(&ap_wfs_count);
16130 if (num_online_cpus() == 1)
16131 - if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
16132 + if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
16133 return NOTIFY_BAD;
16134 break;
16135 }
16136 @@ -341,7 +341,7 @@ static __init int tboot_late_init(void)
16137
16138 tboot_create_trampoline();
16139
16140 - atomic_set(&ap_wfs_count, 0);
16141 + atomic_set_unchecked(&ap_wfs_count, 0);
16142 register_hotcpu_notifier(&tboot_cpu_notifier);
16143 return 0;
16144 }
16145 diff -urNp linux-3.0.8/arch/x86/kernel/time.c linux-3.0.8/arch/x86/kernel/time.c
16146 --- linux-3.0.8/arch/x86/kernel/time.c 2011-07-21 22:17:23.000000000 -0400
16147 +++ linux-3.0.8/arch/x86/kernel/time.c 2011-08-23 21:47:55.000000000 -0400
16148 @@ -30,9 +30,9 @@ unsigned long profile_pc(struct pt_regs
16149 {
16150 unsigned long pc = instruction_pointer(regs);
16151
16152 - if (!user_mode_vm(regs) && in_lock_functions(pc)) {
16153 + if (!user_mode(regs) && in_lock_functions(pc)) {
16154 #ifdef CONFIG_FRAME_POINTER
16155 - return *(unsigned long *)(regs->bp + sizeof(long));
16156 + return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
16157 #else
16158 unsigned long *sp =
16159 (unsigned long *)kernel_stack_pointer(regs);
16160 @@ -41,11 +41,17 @@ unsigned long profile_pc(struct pt_regs
16161 * or above a saved flags. Eflags has bits 22-31 zero,
16162 * kernel addresses don't.
16163 */
16164 +
16165 +#ifdef CONFIG_PAX_KERNEXEC
16166 + return ktla_ktva(sp[0]);
16167 +#else
16168 if (sp[0] >> 22)
16169 return sp[0];
16170 if (sp[1] >> 22)
16171 return sp[1];
16172 #endif
16173 +
16174 +#endif
16175 }
16176 return pc;
16177 }
16178 diff -urNp linux-3.0.8/arch/x86/kernel/tls.c linux-3.0.8/arch/x86/kernel/tls.c
16179 --- linux-3.0.8/arch/x86/kernel/tls.c 2011-07-21 22:17:23.000000000 -0400
16180 +++ linux-3.0.8/arch/x86/kernel/tls.c 2011-08-23 21:47:55.000000000 -0400
16181 @@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
16182 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
16183 return -EINVAL;
16184
16185 +#ifdef CONFIG_PAX_SEGMEXEC
16186 + if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
16187 + return -EINVAL;
16188 +#endif
16189 +
16190 set_tls_desc(p, idx, &info, 1);
16191
16192 return 0;
16193 diff -urNp linux-3.0.8/arch/x86/kernel/trampoline_32.S linux-3.0.8/arch/x86/kernel/trampoline_32.S
16194 --- linux-3.0.8/arch/x86/kernel/trampoline_32.S 2011-07-21 22:17:23.000000000 -0400
16195 +++ linux-3.0.8/arch/x86/kernel/trampoline_32.S 2011-08-23 21:47:55.000000000 -0400
16196 @@ -32,6 +32,12 @@
16197 #include <asm/segment.h>
16198 #include <asm/page_types.h>
16199
16200 +#ifdef CONFIG_PAX_KERNEXEC
16201 +#define ta(X) (X)
16202 +#else
16203 +#define ta(X) ((X) - __PAGE_OFFSET)
16204 +#endif
16205 +
16206 #ifdef CONFIG_SMP
16207
16208 .section ".x86_trampoline","a"
16209 @@ -62,7 +68,7 @@ r_base = .
16210 inc %ax # protected mode (PE) bit
16211 lmsw %ax # into protected mode
16212 # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
16213 - ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
16214 + ljmpl $__BOOT_CS, $ta(startup_32_smp)
16215
16216 # These need to be in the same 64K segment as the above;
16217 # hence we don't use the boot_gdt_descr defined in head.S
16218 diff -urNp linux-3.0.8/arch/x86/kernel/trampoline_64.S linux-3.0.8/arch/x86/kernel/trampoline_64.S
16219 --- linux-3.0.8/arch/x86/kernel/trampoline_64.S 2011-07-21 22:17:23.000000000 -0400
16220 +++ linux-3.0.8/arch/x86/kernel/trampoline_64.S 2011-08-23 21:47:55.000000000 -0400
16221 @@ -90,7 +90,7 @@ startup_32:
16222 movl $__KERNEL_DS, %eax # Initialize the %ds segment register
16223 movl %eax, %ds
16224
16225 - movl $X86_CR4_PAE, %eax
16226 + movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
16227 movl %eax, %cr4 # Enable PAE mode
16228
16229 # Setup trampoline 4 level pagetables
16230 @@ -138,7 +138,7 @@ tidt:
16231 # so the kernel can live anywhere
16232 .balign 4
16233 tgdt:
16234 - .short tgdt_end - tgdt # gdt limit
16235 + .short tgdt_end - tgdt - 1 # gdt limit
16236 .long tgdt - r_base
16237 .short 0
16238 .quad 0x00cf9b000000ffff # __KERNEL32_CS
16239 diff -urNp linux-3.0.8/arch/x86/kernel/traps.c linux-3.0.8/arch/x86/kernel/traps.c
16240 --- linux-3.0.8/arch/x86/kernel/traps.c 2011-07-21 22:17:23.000000000 -0400
16241 +++ linux-3.0.8/arch/x86/kernel/traps.c 2011-08-23 21:47:55.000000000 -0400
16242 @@ -70,12 +70,6 @@ asmlinkage int system_call(void);
16243
16244 /* Do we ignore FPU interrupts ? */
16245 char ignore_fpu_irq;
16246 -
16247 -/*
16248 - * The IDT has to be page-aligned to simplify the Pentium
16249 - * F0 0F bug workaround.
16250 - */
16251 -gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
16252 #endif
16253
16254 DECLARE_BITMAP(used_vectors, NR_VECTORS);
16255 @@ -117,13 +111,13 @@ static inline void preempt_conditional_c
16256 }
16257
16258 static void __kprobes
16259 -do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
16260 +do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
16261 long error_code, siginfo_t *info)
16262 {
16263 struct task_struct *tsk = current;
16264
16265 #ifdef CONFIG_X86_32
16266 - if (regs->flags & X86_VM_MASK) {
16267 + if (v8086_mode(regs)) {
16268 /*
16269 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
16270 * On nmi (interrupt 2), do_trap should not be called.
16271 @@ -134,7 +128,7 @@ do_trap(int trapnr, int signr, char *str
16272 }
16273 #endif
16274
16275 - if (!user_mode(regs))
16276 + if (!user_mode_novm(regs))
16277 goto kernel_trap;
16278
16279 #ifdef CONFIG_X86_32
16280 @@ -157,7 +151,7 @@ trap_signal:
16281 printk_ratelimit()) {
16282 printk(KERN_INFO
16283 "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
16284 - tsk->comm, tsk->pid, str,
16285 + tsk->comm, task_pid_nr(tsk), str,
16286 regs->ip, regs->sp, error_code);
16287 print_vma_addr(" in ", regs->ip);
16288 printk("\n");
16289 @@ -174,8 +168,20 @@ kernel_trap:
16290 if (!fixup_exception(regs)) {
16291 tsk->thread.error_code = error_code;
16292 tsk->thread.trap_no = trapnr;
16293 +
16294 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
16295 + if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
16296 + str = "PAX: suspicious stack segment fault";
16297 +#endif
16298 +
16299 die(str, regs, error_code);
16300 }
16301 +
16302 +#ifdef CONFIG_PAX_REFCOUNT
16303 + if (trapnr == 4)
16304 + pax_report_refcount_overflow(regs);
16305 +#endif
16306 +
16307 return;
16308
16309 #ifdef CONFIG_X86_32
16310 @@ -264,14 +270,30 @@ do_general_protection(struct pt_regs *re
16311 conditional_sti(regs);
16312
16313 #ifdef CONFIG_X86_32
16314 - if (regs->flags & X86_VM_MASK)
16315 + if (v8086_mode(regs))
16316 goto gp_in_vm86;
16317 #endif
16318
16319 tsk = current;
16320 - if (!user_mode(regs))
16321 + if (!user_mode_novm(regs))
16322 goto gp_in_kernel;
16323
16324 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
16325 + if (!(__supported_pte_mask & _PAGE_NX) && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
16326 + struct mm_struct *mm = tsk->mm;
16327 + unsigned long limit;
16328 +
16329 + down_write(&mm->mmap_sem);
16330 + limit = mm->context.user_cs_limit;
16331 + if (limit < TASK_SIZE) {
16332 + track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
16333 + up_write(&mm->mmap_sem);
16334 + return;
16335 + }
16336 + up_write(&mm->mmap_sem);
16337 + }
16338 +#endif
16339 +
16340 tsk->thread.error_code = error_code;
16341 tsk->thread.trap_no = 13;
16342
16343 @@ -304,6 +326,13 @@ gp_in_kernel:
16344 if (notify_die(DIE_GPF, "general protection fault", regs,
16345 error_code, 13, SIGSEGV) == NOTIFY_STOP)
16346 return;
16347 +
16348 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
16349 + if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
16350 + die("PAX: suspicious general protection fault", regs, error_code);
16351 + else
16352 +#endif
16353 +
16354 die("general protection fault", regs, error_code);
16355 }
16356
16357 @@ -433,6 +462,17 @@ static notrace __kprobes void default_do
16358 dotraplinkage notrace __kprobes void
16359 do_nmi(struct pt_regs *regs, long error_code)
16360 {
16361 +
16362 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
16363 + if (!user_mode(regs)) {
16364 + unsigned long cs = regs->cs & 0xFFFF;
16365 + unsigned long ip = ktva_ktla(regs->ip);
16366 +
16367 + if ((cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS) && ip <= (unsigned long)_etext)
16368 + regs->ip = ip;
16369 + }
16370 +#endif
16371 +
16372 nmi_enter();
16373
16374 inc_irq_stat(__nmi_count);
16375 @@ -569,7 +609,7 @@ dotraplinkage void __kprobes do_debug(st
16376 /* It's safe to allow irq's after DR6 has been saved */
16377 preempt_conditional_sti(regs);
16378
16379 - if (regs->flags & X86_VM_MASK) {
16380 + if (v8086_mode(regs)) {
16381 handle_vm86_trap((struct kernel_vm86_regs *) regs,
16382 error_code, 1);
16383 preempt_conditional_cli(regs);
16384 @@ -583,7 +623,7 @@ dotraplinkage void __kprobes do_debug(st
16385 * We already checked v86 mode above, so we can check for kernel mode
16386 * by just checking the CPL of CS.
16387 */
16388 - if ((dr6 & DR_STEP) && !user_mode(regs)) {
16389 + if ((dr6 & DR_STEP) && !user_mode_novm(regs)) {
16390 tsk->thread.debugreg6 &= ~DR_STEP;
16391 set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
16392 regs->flags &= ~X86_EFLAGS_TF;
16393 @@ -612,7 +652,7 @@ void math_error(struct pt_regs *regs, in
16394 return;
16395 conditional_sti(regs);
16396
16397 - if (!user_mode_vm(regs))
16398 + if (!user_mode(regs))
16399 {
16400 if (!fixup_exception(regs)) {
16401 task->thread.error_code = error_code;
16402 @@ -723,7 +763,7 @@ asmlinkage void __attribute__((weak)) sm
16403 void __math_state_restore(void)
16404 {
16405 struct thread_info *thread = current_thread_info();
16406 - struct task_struct *tsk = thread->task;
16407 + struct task_struct *tsk = current;
16408
16409 /*
16410 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
16411 @@ -750,8 +790,7 @@ void __math_state_restore(void)
16412 */
16413 asmlinkage void math_state_restore(void)
16414 {
16415 - struct thread_info *thread = current_thread_info();
16416 - struct task_struct *tsk = thread->task;
16417 + struct task_struct *tsk = current;
16418
16419 if (!tsk_used_math(tsk)) {
16420 local_irq_enable();
16421 diff -urNp linux-3.0.8/arch/x86/kernel/verify_cpu.S linux-3.0.8/arch/x86/kernel/verify_cpu.S
16422 --- linux-3.0.8/arch/x86/kernel/verify_cpu.S 2011-07-21 22:17:23.000000000 -0400
16423 +++ linux-3.0.8/arch/x86/kernel/verify_cpu.S 2011-08-23 21:48:14.000000000 -0400
16424 @@ -20,6 +20,7 @@
16425 * arch/x86/boot/compressed/head_64.S: Boot cpu verification
16426 * arch/x86/kernel/trampoline_64.S: secondary processor verification
16427 * arch/x86/kernel/head_32.S: processor startup
16428 + * arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume
16429 *
16430 * verify_cpu, returns the status of longmode and SSE in register %eax.
16431 * 0: Success 1: Failure
16432 diff -urNp linux-3.0.8/arch/x86/kernel/vm86_32.c linux-3.0.8/arch/x86/kernel/vm86_32.c
16433 --- linux-3.0.8/arch/x86/kernel/vm86_32.c 2011-07-21 22:17:23.000000000 -0400
16434 +++ linux-3.0.8/arch/x86/kernel/vm86_32.c 2011-08-23 21:48:14.000000000 -0400
16435 @@ -41,6 +41,7 @@
16436 #include <linux/ptrace.h>
16437 #include <linux/audit.h>
16438 #include <linux/stddef.h>
16439 +#include <linux/grsecurity.h>
16440
16441 #include <asm/uaccess.h>
16442 #include <asm/io.h>
16443 @@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke
16444 do_exit(SIGSEGV);
16445 }
16446
16447 - tss = &per_cpu(init_tss, get_cpu());
16448 + tss = init_tss + get_cpu();
16449 current->thread.sp0 = current->thread.saved_sp0;
16450 current->thread.sysenter_cs = __KERNEL_CS;
16451 load_sp0(tss, &current->thread);
16452 @@ -208,6 +209,13 @@ int sys_vm86old(struct vm86_struct __use
16453 struct task_struct *tsk;
16454 int tmp, ret = -EPERM;
16455
16456 +#ifdef CONFIG_GRKERNSEC_VM86
16457 + if (!capable(CAP_SYS_RAWIO)) {
16458 + gr_handle_vm86();
16459 + goto out;
16460 + }
16461 +#endif
16462 +
16463 tsk = current;
16464 if (tsk->thread.saved_sp0)
16465 goto out;
16466 @@ -238,6 +246,14 @@ int sys_vm86(unsigned long cmd, unsigned
16467 int tmp, ret;
16468 struct vm86plus_struct __user *v86;
16469
16470 +#ifdef CONFIG_GRKERNSEC_VM86
16471 + if (!capable(CAP_SYS_RAWIO)) {
16472 + gr_handle_vm86();
16473 + ret = -EPERM;
16474 + goto out;
16475 + }
16476 +#endif
16477 +
16478 tsk = current;
16479 switch (cmd) {
16480 case VM86_REQUEST_IRQ:
16481 @@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm
16482 tsk->thread.saved_fs = info->regs32->fs;
16483 tsk->thread.saved_gs = get_user_gs(info->regs32);
16484
16485 - tss = &per_cpu(init_tss, get_cpu());
16486 + tss = init_tss + get_cpu();
16487 tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
16488 if (cpu_has_sep)
16489 tsk->thread.sysenter_cs = 0;
16490 @@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_re
16491 goto cannot_handle;
16492 if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
16493 goto cannot_handle;
16494 - intr_ptr = (unsigned long __user *) (i << 2);
16495 + intr_ptr = (__force unsigned long __user *) (i << 2);
16496 if (get_user(segoffs, intr_ptr))
16497 goto cannot_handle;
16498 if ((segoffs >> 16) == BIOSSEG)
16499 diff -urNp linux-3.0.8/arch/x86/kernel/vmlinux.lds.S linux-3.0.8/arch/x86/kernel/vmlinux.lds.S
16500 --- linux-3.0.8/arch/x86/kernel/vmlinux.lds.S 2011-07-21 22:17:23.000000000 -0400
16501 +++ linux-3.0.8/arch/x86/kernel/vmlinux.lds.S 2011-08-23 21:47:55.000000000 -0400
16502 @@ -26,6 +26,13 @@
16503 #include <asm/page_types.h>
16504 #include <asm/cache.h>
16505 #include <asm/boot.h>
16506 +#include <asm/segment.h>
16507 +
16508 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
16509 +#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
16510 +#else
16511 +#define __KERNEL_TEXT_OFFSET 0
16512 +#endif
16513
16514 #undef i386 /* in case the preprocessor is a 32bit one */
16515
16516 @@ -69,31 +76,46 @@ jiffies_64 = jiffies;
16517
16518 PHDRS {
16519 text PT_LOAD FLAGS(5); /* R_E */
16520 +#ifdef CONFIG_X86_32
16521 + module PT_LOAD FLAGS(5); /* R_E */
16522 +#endif
16523 +#ifdef CONFIG_XEN
16524 + rodata PT_LOAD FLAGS(5); /* R_E */
16525 +#else
16526 + rodata PT_LOAD FLAGS(4); /* R__ */
16527 +#endif
16528 data PT_LOAD FLAGS(6); /* RW_ */
16529 #ifdef CONFIG_X86_64
16530 user PT_LOAD FLAGS(5); /* R_E */
16531 +#endif
16532 + init.begin PT_LOAD FLAGS(6); /* RW_ */
16533 #ifdef CONFIG_SMP
16534 percpu PT_LOAD FLAGS(6); /* RW_ */
16535 #endif
16536 + text.init PT_LOAD FLAGS(5); /* R_E */
16537 + text.exit PT_LOAD FLAGS(5); /* R_E */
16538 init PT_LOAD FLAGS(7); /* RWE */
16539 -#endif
16540 note PT_NOTE FLAGS(0); /* ___ */
16541 }
16542
16543 SECTIONS
16544 {
16545 #ifdef CONFIG_X86_32
16546 - . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
16547 - phys_startup_32 = startup_32 - LOAD_OFFSET;
16548 + . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
16549 #else
16550 - . = __START_KERNEL;
16551 - phys_startup_64 = startup_64 - LOAD_OFFSET;
16552 + . = __START_KERNEL;
16553 #endif
16554
16555 /* Text and read-only data */
16556 - .text : AT(ADDR(.text) - LOAD_OFFSET) {
16557 - _text = .;
16558 + .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
16559 /* bootstrapping code */
16560 +#ifdef CONFIG_X86_32
16561 + phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
16562 +#else
16563 + phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
16564 +#endif
16565 + __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
16566 + _text = .;
16567 HEAD_TEXT
16568 #ifdef CONFIG_X86_32
16569 . = ALIGN(PAGE_SIZE);
16570 @@ -109,13 +131,47 @@ SECTIONS
16571 IRQENTRY_TEXT
16572 *(.fixup)
16573 *(.gnu.warning)
16574 - /* End of text section */
16575 - _etext = .;
16576 } :text = 0x9090
16577
16578 - NOTES :text :note
16579 + . += __KERNEL_TEXT_OFFSET;
16580 +
16581 +#ifdef CONFIG_X86_32
16582 + . = ALIGN(PAGE_SIZE);
16583 + .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
16584 +
16585 +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
16586 + MODULES_EXEC_VADDR = .;
16587 + BYTE(0)
16588 + . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
16589 + . = ALIGN(HPAGE_SIZE);
16590 + MODULES_EXEC_END = . - 1;
16591 +#endif
16592 +
16593 + } :module
16594 +#endif
16595 +
16596 + .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
16597 + /* End of text section */
16598 + _etext = . - __KERNEL_TEXT_OFFSET;
16599 + }
16600 +
16601 +#ifdef CONFIG_X86_32
16602 + . = ALIGN(PAGE_SIZE);
16603 + .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
16604 + *(.idt)
16605 + . = ALIGN(PAGE_SIZE);
16606 + *(.empty_zero_page)
16607 + *(.initial_pg_fixmap)
16608 + *(.initial_pg_pmd)
16609 + *(.initial_page_table)
16610 + *(.swapper_pg_dir)
16611 + } :rodata
16612 +#endif
16613 +
16614 + . = ALIGN(PAGE_SIZE);
16615 + NOTES :rodata :note
16616
16617 - EXCEPTION_TABLE(16) :text = 0x9090
16618 + EXCEPTION_TABLE(16) :rodata
16619
16620 #if defined(CONFIG_DEBUG_RODATA)
16621 /* .text should occupy whole number of pages */
16622 @@ -127,16 +183,20 @@ SECTIONS
16623
16624 /* Data */
16625 .data : AT(ADDR(.data) - LOAD_OFFSET) {
16626 +
16627 +#ifdef CONFIG_PAX_KERNEXEC
16628 + . = ALIGN(HPAGE_SIZE);
16629 +#else
16630 + . = ALIGN(PAGE_SIZE);
16631 +#endif
16632 +
16633 /* Start of data section */
16634 _sdata = .;
16635
16636 /* init_task */
16637 INIT_TASK_DATA(THREAD_SIZE)
16638
16639 -#ifdef CONFIG_X86_32
16640 - /* 32 bit has nosave before _edata */
16641 NOSAVE_DATA
16642 -#endif
16643
16644 PAGE_ALIGNED_DATA(PAGE_SIZE)
16645
16646 @@ -208,12 +268,19 @@ SECTIONS
16647 #endif /* CONFIG_X86_64 */
16648
16649 /* Init code and data - will be freed after init */
16650 - . = ALIGN(PAGE_SIZE);
16651 .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
16652 + BYTE(0)
16653 +
16654 +#ifdef CONFIG_PAX_KERNEXEC
16655 + . = ALIGN(HPAGE_SIZE);
16656 +#else
16657 + . = ALIGN(PAGE_SIZE);
16658 +#endif
16659 +
16660 __init_begin = .; /* paired with __init_end */
16661 - }
16662 + } :init.begin
16663
16664 -#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
16665 +#ifdef CONFIG_SMP
16666 /*
16667 * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
16668 * output PHDR, so the next output section - .init.text - should
16669 @@ -222,12 +289,27 @@ SECTIONS
16670 PERCPU_VADDR(INTERNODE_CACHE_BYTES, 0, :percpu)
16671 #endif
16672
16673 - INIT_TEXT_SECTION(PAGE_SIZE)
16674 -#ifdef CONFIG_X86_64
16675 - :init
16676 -#endif
16677 + . = ALIGN(PAGE_SIZE);
16678 + init_begin = .;
16679 + .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
16680 + VMLINUX_SYMBOL(_sinittext) = .;
16681 + INIT_TEXT
16682 + VMLINUX_SYMBOL(_einittext) = .;
16683 + . = ALIGN(PAGE_SIZE);
16684 + } :text.init
16685
16686 - INIT_DATA_SECTION(16)
16687 + /*
16688 + * .exit.text is discard at runtime, not link time, to deal with
16689 + * references from .altinstructions and .eh_frame
16690 + */
16691 + .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
16692 + EXIT_TEXT
16693 + . = ALIGN(16);
16694 + } :text.exit
16695 + . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
16696 +
16697 + . = ALIGN(PAGE_SIZE);
16698 + INIT_DATA_SECTION(16) :init
16699
16700 /*
16701 * Code and data for a variety of lowlevel trampolines, to be
16702 @@ -301,19 +383,12 @@ SECTIONS
16703 }
16704
16705 . = ALIGN(8);
16706 - /*
16707 - * .exit.text is discard at runtime, not link time, to deal with
16708 - * references from .altinstructions and .eh_frame
16709 - */
16710 - .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
16711 - EXIT_TEXT
16712 - }
16713
16714 .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
16715 EXIT_DATA
16716 }
16717
16718 -#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
16719 +#ifndef CONFIG_SMP
16720 PERCPU_SECTION(INTERNODE_CACHE_BYTES)
16721 #endif
16722
16723 @@ -332,16 +407,10 @@ SECTIONS
16724 .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
16725 __smp_locks = .;
16726 *(.smp_locks)
16727 - . = ALIGN(PAGE_SIZE);
16728 __smp_locks_end = .;
16729 + . = ALIGN(PAGE_SIZE);
16730 }
16731
16732 -#ifdef CONFIG_X86_64
16733 - .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
16734 - NOSAVE_DATA
16735 - }
16736 -#endif
16737 -
16738 /* BSS */
16739 . = ALIGN(PAGE_SIZE);
16740 .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
16741 @@ -357,6 +426,7 @@ SECTIONS
16742 __brk_base = .;
16743 . += 64 * 1024; /* 64k alignment slop space */
16744 *(.brk_reservation) /* areas brk users have reserved */
16745 + . = ALIGN(HPAGE_SIZE);
16746 __brk_limit = .;
16747 }
16748
16749 @@ -383,13 +453,12 @@ SECTIONS
16750 * for the boot processor.
16751 */
16752 #define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
16753 -INIT_PER_CPU(gdt_page);
16754 INIT_PER_CPU(irq_stack_union);
16755
16756 /*
16757 * Build-time check on the image size:
16758 */
16759 -. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
16760 +. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
16761 "kernel image bigger than KERNEL_IMAGE_SIZE");
16762
16763 #ifdef CONFIG_SMP
16764 diff -urNp linux-3.0.8/arch/x86/kernel/vsyscall_64.c linux-3.0.8/arch/x86/kernel/vsyscall_64.c
16765 --- linux-3.0.8/arch/x86/kernel/vsyscall_64.c 2011-07-21 22:17:23.000000000 -0400
16766 +++ linux-3.0.8/arch/x86/kernel/vsyscall_64.c 2011-08-23 21:47:55.000000000 -0400
16767 @@ -53,7 +53,7 @@ DEFINE_VVAR(int, vgetcpu_mode);
16768 DEFINE_VVAR(struct vsyscall_gtod_data, vsyscall_gtod_data) =
16769 {
16770 .lock = __SEQLOCK_UNLOCKED(__vsyscall_gtod_data.lock),
16771 - .sysctl_enabled = 1,
16772 + .sysctl_enabled = 0,
16773 };
16774
16775 void update_vsyscall_tz(void)
16776 @@ -231,7 +231,7 @@ static long __vsyscall(3) venosys_1(void
16777 static ctl_table kernel_table2[] = {
16778 { .procname = "vsyscall64",
16779 .data = &vsyscall_gtod_data.sysctl_enabled, .maxlen = sizeof(int),
16780 - .mode = 0644,
16781 + .mode = 0444,
16782 .proc_handler = proc_dointvec },
16783 {}
16784 };
16785 diff -urNp linux-3.0.8/arch/x86/kernel/x8664_ksyms_64.c linux-3.0.8/arch/x86/kernel/x8664_ksyms_64.c
16786 --- linux-3.0.8/arch/x86/kernel/x8664_ksyms_64.c 2011-07-21 22:17:23.000000000 -0400
16787 +++ linux-3.0.8/arch/x86/kernel/x8664_ksyms_64.c 2011-08-23 21:47:55.000000000 -0400
16788 @@ -29,8 +29,6 @@ EXPORT_SYMBOL(__put_user_8);
16789 EXPORT_SYMBOL(copy_user_generic_string);
16790 EXPORT_SYMBOL(copy_user_generic_unrolled);
16791 EXPORT_SYMBOL(__copy_user_nocache);
16792 -EXPORT_SYMBOL(_copy_from_user);
16793 -EXPORT_SYMBOL(_copy_to_user);
16794
16795 EXPORT_SYMBOL(copy_page);
16796 EXPORT_SYMBOL(clear_page);
16797 diff -urNp linux-3.0.8/arch/x86/kernel/xsave.c linux-3.0.8/arch/x86/kernel/xsave.c
16798 --- linux-3.0.8/arch/x86/kernel/xsave.c 2011-07-21 22:17:23.000000000 -0400
16799 +++ linux-3.0.8/arch/x86/kernel/xsave.c 2011-10-06 04:17:55.000000000 -0400
16800 @@ -130,7 +130,7 @@ int check_for_xstate(struct i387_fxsave_
16801 fx_sw_user->xstate_size > fx_sw_user->extended_size)
16802 return -EINVAL;
16803
16804 - err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
16805 + err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
16806 fx_sw_user->extended_size -
16807 FP_XSTATE_MAGIC2_SIZE));
16808 if (err)
16809 @@ -267,7 +267,7 @@ fx_only:
16810 * the other extended state.
16811 */
16812 xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
16813 - return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
16814 + return fxrstor_checking((struct i387_fxsave_struct __force_kernel *)buf);
16815 }
16816
16817 /*
16818 @@ -299,7 +299,7 @@ int restore_i387_xstate(void __user *buf
16819 if (use_xsave())
16820 err = restore_user_xstate(buf);
16821 else
16822 - err = fxrstor_checking((__force struct i387_fxsave_struct *)
16823 + err = fxrstor_checking((struct i387_fxsave_struct __force_kernel *)
16824 buf);
16825 if (unlikely(err)) {
16826 /*
16827 diff -urNp linux-3.0.8/arch/x86/kvm/emulate.c linux-3.0.8/arch/x86/kvm/emulate.c
16828 --- linux-3.0.8/arch/x86/kvm/emulate.c 2011-07-21 22:17:23.000000000 -0400
16829 +++ linux-3.0.8/arch/x86/kvm/emulate.c 2011-08-23 21:47:55.000000000 -0400
16830 @@ -96,7 +96,7 @@
16831 #define Src2ImmByte (2<<29)
16832 #define Src2One (3<<29)
16833 #define Src2Imm (4<<29)
16834 -#define Src2Mask (7<<29)
16835 +#define Src2Mask (7U<<29)
16836
16837 #define X2(x...) x, x
16838 #define X3(x...) X2(x), x
16839 @@ -207,6 +207,7 @@ struct gprefix {
16840
16841 #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix, _dsttype) \
16842 do { \
16843 + unsigned long _tmp; \
16844 __asm__ __volatile__ ( \
16845 _PRE_EFLAGS("0", "4", "2") \
16846 _op _suffix " %"_x"3,%1; " \
16847 @@ -220,8 +221,6 @@ struct gprefix {
16848 /* Raw emulation: instruction has two explicit operands. */
16849 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
16850 do { \
16851 - unsigned long _tmp; \
16852 - \
16853 switch ((_dst).bytes) { \
16854 case 2: \
16855 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w",u16);\
16856 @@ -237,7 +236,6 @@ struct gprefix {
16857
16858 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
16859 do { \
16860 - unsigned long _tmp; \
16861 switch ((_dst).bytes) { \
16862 case 1: \
16863 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b",u8); \
16864 diff -urNp linux-3.0.8/arch/x86/kvm/lapic.c linux-3.0.8/arch/x86/kvm/lapic.c
16865 --- linux-3.0.8/arch/x86/kvm/lapic.c 2011-07-21 22:17:23.000000000 -0400
16866 +++ linux-3.0.8/arch/x86/kvm/lapic.c 2011-08-23 21:47:55.000000000 -0400
16867 @@ -53,7 +53,7 @@
16868 #define APIC_BUS_CYCLE_NS 1
16869
16870 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
16871 -#define apic_debug(fmt, arg...)
16872 +#define apic_debug(fmt, arg...) do {} while (0)
16873
16874 #define APIC_LVT_NUM 6
16875 /* 14 is the version for Xeon and Pentium 8.4.8*/
16876 diff -urNp linux-3.0.8/arch/x86/kvm/mmu.c linux-3.0.8/arch/x86/kvm/mmu.c
16877 --- linux-3.0.8/arch/x86/kvm/mmu.c 2011-07-21 22:17:23.000000000 -0400
16878 +++ linux-3.0.8/arch/x86/kvm/mmu.c 2011-08-23 21:47:55.000000000 -0400
16879 @@ -3238,7 +3238,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *
16880
16881 pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);
16882
16883 - invlpg_counter = atomic_read(&vcpu->kvm->arch.invlpg_counter);
16884 + invlpg_counter = atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter);
16885
16886 /*
16887 * Assume that the pte write on a page table of the same type
16888 @@ -3270,7 +3270,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *
16889 }
16890
16891 spin_lock(&vcpu->kvm->mmu_lock);
16892 - if (atomic_read(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
16893 + if (atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
16894 gentry = 0;
16895 kvm_mmu_free_some_pages(vcpu);
16896 ++vcpu->kvm->stat.mmu_pte_write;
16897 diff -urNp linux-3.0.8/arch/x86/kvm/paging_tmpl.h linux-3.0.8/arch/x86/kvm/paging_tmpl.h
16898 --- linux-3.0.8/arch/x86/kvm/paging_tmpl.h 2011-07-21 22:17:23.000000000 -0400
16899 +++ linux-3.0.8/arch/x86/kvm/paging_tmpl.h 2011-10-06 04:17:55.000000000 -0400
16900 @@ -182,7 +182,7 @@ walk:
16901 break;
16902 }
16903
16904 - ptep_user = (pt_element_t __user *)((void *)host_addr + offset);
16905 + ptep_user = (pt_element_t __force_user *)((void *)host_addr + offset);
16906 if (unlikely(__copy_from_user(&pte, ptep_user, sizeof(pte)))) {
16907 present = false;
16908 break;
16909 @@ -583,6 +583,8 @@ static int FNAME(page_fault)(struct kvm_
16910 unsigned long mmu_seq;
16911 bool map_writable;
16912
16913 + pax_track_stack();
16914 +
16915 pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
16916
16917 r = mmu_topup_memory_caches(vcpu);
16918 @@ -703,7 +705,7 @@ static void FNAME(invlpg)(struct kvm_vcp
16919 if (need_flush)
16920 kvm_flush_remote_tlbs(vcpu->kvm);
16921
16922 - atomic_inc(&vcpu->kvm->arch.invlpg_counter);
16923 + atomic_inc_unchecked(&vcpu->kvm->arch.invlpg_counter);
16924
16925 spin_unlock(&vcpu->kvm->mmu_lock);
16926
16927 diff -urNp linux-3.0.8/arch/x86/kvm/svm.c linux-3.0.8/arch/x86/kvm/svm.c
16928 --- linux-3.0.8/arch/x86/kvm/svm.c 2011-07-21 22:17:23.000000000 -0400
16929 +++ linux-3.0.8/arch/x86/kvm/svm.c 2011-08-23 21:47:55.000000000 -0400
16930 @@ -3377,7 +3377,11 @@ static void reload_tss(struct kvm_vcpu *
16931 int cpu = raw_smp_processor_id();
16932
16933 struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
16934 +
16935 + pax_open_kernel();
16936 sd->tss_desc->type = 9; /* available 32/64-bit TSS */
16937 + pax_close_kernel();
16938 +
16939 load_TR_desc();
16940 }
16941
16942 @@ -3755,6 +3759,10 @@ static void svm_vcpu_run(struct kvm_vcpu
16943 #endif
16944 #endif
16945
16946 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
16947 + __set_fs(current_thread_info()->addr_limit);
16948 +#endif
16949 +
16950 reload_tss(vcpu);
16951
16952 local_irq_disable();
16953 diff -urNp linux-3.0.8/arch/x86/kvm/vmx.c linux-3.0.8/arch/x86/kvm/vmx.c
16954 --- linux-3.0.8/arch/x86/kvm/vmx.c 2011-07-21 22:17:23.000000000 -0400
16955 +++ linux-3.0.8/arch/x86/kvm/vmx.c 2011-08-23 21:47:55.000000000 -0400
16956 @@ -797,7 +797,11 @@ static void reload_tss(void)
16957 struct desc_struct *descs;
16958
16959 descs = (void *)gdt->address;
16960 +
16961 + pax_open_kernel();
16962 descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
16963 + pax_close_kernel();
16964 +
16965 load_TR_desc();
16966 }
16967
16968 @@ -1747,8 +1751,11 @@ static __init int hardware_setup(void)
16969 if (!cpu_has_vmx_flexpriority())
16970 flexpriority_enabled = 0;
16971
16972 - if (!cpu_has_vmx_tpr_shadow())
16973 - kvm_x86_ops->update_cr8_intercept = NULL;
16974 + if (!cpu_has_vmx_tpr_shadow()) {
16975 + pax_open_kernel();
16976 + *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
16977 + pax_close_kernel();
16978 + }
16979
16980 if (enable_ept && !cpu_has_vmx_ept_2m_page())
16981 kvm_disable_largepages();
16982 @@ -2814,7 +2821,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
16983 vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
16984
16985 asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
16986 - vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
16987 + vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
16988 vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
16989 vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
16990 vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host));
16991 @@ -4211,6 +4218,12 @@ static void __noclone vmx_vcpu_run(struc
16992 "jmp .Lkvm_vmx_return \n\t"
16993 ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
16994 ".Lkvm_vmx_return: "
16995 +
16996 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
16997 + "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
16998 + ".Lkvm_vmx_return2: "
16999 +#endif
17000 +
17001 /* Save guest registers, load host registers, keep flags */
17002 "mov %0, %c[wordsize](%%"R"sp) \n\t"
17003 "pop %0 \n\t"
17004 @@ -4259,6 +4272,11 @@ static void __noclone vmx_vcpu_run(struc
17005 #endif
17006 [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
17007 [wordsize]"i"(sizeof(ulong))
17008 +
17009 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17010 + ,[cs]"i"(__KERNEL_CS)
17011 +#endif
17012 +
17013 : "cc", "memory"
17014 , R"ax", R"bx", R"di", R"si"
17015 #ifdef CONFIG_X86_64
17016 @@ -4276,7 +4294,16 @@ static void __noclone vmx_vcpu_run(struc
17017
17018 vmx->idt_vectoring_info = vmcs_read32(IDT_VECTORING_INFO_FIELD);
17019
17020 - asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
17021 + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
17022 +
17023 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17024 + loadsegment(fs, __KERNEL_PERCPU);
17025 +#endif
17026 +
17027 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
17028 + __set_fs(current_thread_info()->addr_limit);
17029 +#endif
17030 +
17031 vmx->launched = 1;
17032
17033 vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
17034 diff -urNp linux-3.0.8/arch/x86/kvm/x86.c linux-3.0.8/arch/x86/kvm/x86.c
17035 --- linux-3.0.8/arch/x86/kvm/x86.c 2011-07-21 22:17:23.000000000 -0400
17036 +++ linux-3.0.8/arch/x86/kvm/x86.c 2011-10-06 04:17:55.000000000 -0400
17037 @@ -1313,8 +1313,8 @@ static int xen_hvm_config(struct kvm_vcp
17038 {
17039 struct kvm *kvm = vcpu->kvm;
17040 int lm = is_long_mode(vcpu);
17041 - u8 *blob_addr = lm ? (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_64
17042 - : (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_32;
17043 + u8 __user *blob_addr = lm ? (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_64
17044 + : (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_32;
17045 u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
17046 : kvm->arch.xen_hvm_config.blob_size_32;
17047 u32 page_num = data & ~PAGE_MASK;
17048 @@ -2057,6 +2057,8 @@ long kvm_arch_dev_ioctl(struct file *fil
17049 if (n < msr_list.nmsrs)
17050 goto out;
17051 r = -EFAULT;
17052 + if (num_msrs_to_save > ARRAY_SIZE(msrs_to_save))
17053 + goto out;
17054 if (copy_to_user(user_msr_list->indices, &msrs_to_save,
17055 num_msrs_to_save * sizeof(u32)))
17056 goto out;
17057 @@ -2229,15 +2231,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(str
17058 struct kvm_cpuid2 *cpuid,
17059 struct kvm_cpuid_entry2 __user *entries)
17060 {
17061 - int r;
17062 + int r, i;
17063
17064 r = -E2BIG;
17065 if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
17066 goto out;
17067 r = -EFAULT;
17068 - if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
17069 - cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
17070 + if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
17071 goto out;
17072 + for (i = 0; i < cpuid->nent; ++i) {
17073 + struct kvm_cpuid_entry2 cpuid_entry;
17074 + if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
17075 + goto out;
17076 + vcpu->arch.cpuid_entries[i] = cpuid_entry;
17077 + }
17078 vcpu->arch.cpuid_nent = cpuid->nent;
17079 kvm_apic_set_version(vcpu);
17080 kvm_x86_ops->cpuid_update(vcpu);
17081 @@ -2252,15 +2259,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(str
17082 struct kvm_cpuid2 *cpuid,
17083 struct kvm_cpuid_entry2 __user *entries)
17084 {
17085 - int r;
17086 + int r, i;
17087
17088 r = -E2BIG;
17089 if (cpuid->nent < vcpu->arch.cpuid_nent)
17090 goto out;
17091 r = -EFAULT;
17092 - if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
17093 - vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
17094 + if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
17095 goto out;
17096 + for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
17097 + struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
17098 + if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
17099 + goto out;
17100 + }
17101 return 0;
17102
17103 out:
17104 @@ -2579,7 +2590,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
17105 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
17106 struct kvm_interrupt *irq)
17107 {
17108 - if (irq->irq < 0 || irq->irq >= 256)
17109 + if (irq->irq >= 256)
17110 return -EINVAL;
17111 if (irqchip_in_kernel(vcpu->kvm))
17112 return -ENXIO;
17113 @@ -4878,7 +4889,7 @@ void kvm_after_handle_nmi(struct kvm_vcp
17114 }
17115 EXPORT_SYMBOL_GPL(kvm_after_handle_nmi);
17116
17117 -int kvm_arch_init(void *opaque)
17118 +int kvm_arch_init(const void *opaque)
17119 {
17120 int r;
17121 struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
17122 diff -urNp linux-3.0.8/arch/x86/lguest/boot.c linux-3.0.8/arch/x86/lguest/boot.c
17123 --- linux-3.0.8/arch/x86/lguest/boot.c 2011-07-21 22:17:23.000000000 -0400
17124 +++ linux-3.0.8/arch/x86/lguest/boot.c 2011-08-23 21:47:55.000000000 -0400
17125 @@ -1176,9 +1176,10 @@ static __init int early_put_chars(u32 vt
17126 * Rebooting also tells the Host we're finished, but the RESTART flag tells the
17127 * Launcher to reboot us.
17128 */
17129 -static void lguest_restart(char *reason)
17130 +static __noreturn void lguest_restart(char *reason)
17131 {
17132 hcall(LHCALL_SHUTDOWN, __pa(reason), LGUEST_SHUTDOWN_RESTART, 0, 0);
17133 + BUG();
17134 }
17135
17136 /*G:050
17137 diff -urNp linux-3.0.8/arch/x86/lib/atomic64_32.c linux-3.0.8/arch/x86/lib/atomic64_32.c
17138 --- linux-3.0.8/arch/x86/lib/atomic64_32.c 2011-07-21 22:17:23.000000000 -0400
17139 +++ linux-3.0.8/arch/x86/lib/atomic64_32.c 2011-08-23 21:47:55.000000000 -0400
17140 @@ -8,18 +8,30 @@
17141
17142 long long atomic64_read_cx8(long long, const atomic64_t *v);
17143 EXPORT_SYMBOL(atomic64_read_cx8);
17144 +long long atomic64_read_unchecked_cx8(long long, const atomic64_unchecked_t *v);
17145 +EXPORT_SYMBOL(atomic64_read_unchecked_cx8);
17146 long long atomic64_set_cx8(long long, const atomic64_t *v);
17147 EXPORT_SYMBOL(atomic64_set_cx8);
17148 +long long atomic64_set_unchecked_cx8(long long, const atomic64_unchecked_t *v);
17149 +EXPORT_SYMBOL(atomic64_set_unchecked_cx8);
17150 long long atomic64_xchg_cx8(long long, unsigned high);
17151 EXPORT_SYMBOL(atomic64_xchg_cx8);
17152 long long atomic64_add_return_cx8(long long a, atomic64_t *v);
17153 EXPORT_SYMBOL(atomic64_add_return_cx8);
17154 +long long atomic64_add_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
17155 +EXPORT_SYMBOL(atomic64_add_return_unchecked_cx8);
17156 long long atomic64_sub_return_cx8(long long a, atomic64_t *v);
17157 EXPORT_SYMBOL(atomic64_sub_return_cx8);
17158 +long long atomic64_sub_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
17159 +EXPORT_SYMBOL(atomic64_sub_return_unchecked_cx8);
17160 long long atomic64_inc_return_cx8(long long a, atomic64_t *v);
17161 EXPORT_SYMBOL(atomic64_inc_return_cx8);
17162 +long long atomic64_inc_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
17163 +EXPORT_SYMBOL(atomic64_inc_return_unchecked_cx8);
17164 long long atomic64_dec_return_cx8(long long a, atomic64_t *v);
17165 EXPORT_SYMBOL(atomic64_dec_return_cx8);
17166 +long long atomic64_dec_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
17167 +EXPORT_SYMBOL(atomic64_dec_return_unchecked_cx8);
17168 long long atomic64_dec_if_positive_cx8(atomic64_t *v);
17169 EXPORT_SYMBOL(atomic64_dec_if_positive_cx8);
17170 int atomic64_inc_not_zero_cx8(atomic64_t *v);
17171 @@ -30,26 +42,46 @@ EXPORT_SYMBOL(atomic64_add_unless_cx8);
17172 #ifndef CONFIG_X86_CMPXCHG64
17173 long long atomic64_read_386(long long, const atomic64_t *v);
17174 EXPORT_SYMBOL(atomic64_read_386);
17175 +long long atomic64_read_unchecked_386(long long, const atomic64_unchecked_t *v);
17176 +EXPORT_SYMBOL(atomic64_read_unchecked_386);
17177 long long atomic64_set_386(long long, const atomic64_t *v);
17178 EXPORT_SYMBOL(atomic64_set_386);
17179 +long long atomic64_set_unchecked_386(long long, const atomic64_unchecked_t *v);
17180 +EXPORT_SYMBOL(atomic64_set_unchecked_386);
17181 long long atomic64_xchg_386(long long, unsigned high);
17182 EXPORT_SYMBOL(atomic64_xchg_386);
17183 long long atomic64_add_return_386(long long a, atomic64_t *v);
17184 EXPORT_SYMBOL(atomic64_add_return_386);
17185 +long long atomic64_add_return_unchecked_386(long long a, atomic64_unchecked_t *v);
17186 +EXPORT_SYMBOL(atomic64_add_return_unchecked_386);
17187 long long atomic64_sub_return_386(long long a, atomic64_t *v);
17188 EXPORT_SYMBOL(atomic64_sub_return_386);
17189 +long long atomic64_sub_return_unchecked_386(long long a, atomic64_unchecked_t *v);
17190 +EXPORT_SYMBOL(atomic64_sub_return_unchecked_386);
17191 long long atomic64_inc_return_386(long long a, atomic64_t *v);
17192 EXPORT_SYMBOL(atomic64_inc_return_386);
17193 +long long atomic64_inc_return_unchecked_386(long long a, atomic64_unchecked_t *v);
17194 +EXPORT_SYMBOL(atomic64_inc_return_unchecked_386);
17195 long long atomic64_dec_return_386(long long a, atomic64_t *v);
17196 EXPORT_SYMBOL(atomic64_dec_return_386);
17197 +long long atomic64_dec_return_unchecked_386(long long a, atomic64_unchecked_t *v);
17198 +EXPORT_SYMBOL(atomic64_dec_return_unchecked_386);
17199 long long atomic64_add_386(long long a, atomic64_t *v);
17200 EXPORT_SYMBOL(atomic64_add_386);
17201 +long long atomic64_add_unchecked_386(long long a, atomic64_unchecked_t *v);
17202 +EXPORT_SYMBOL(atomic64_add_unchecked_386);
17203 long long atomic64_sub_386(long long a, atomic64_t *v);
17204 EXPORT_SYMBOL(atomic64_sub_386);
17205 +long long atomic64_sub_unchecked_386(long long a, atomic64_unchecked_t *v);
17206 +EXPORT_SYMBOL(atomic64_sub_unchecked_386);
17207 long long atomic64_inc_386(long long a, atomic64_t *v);
17208 EXPORT_SYMBOL(atomic64_inc_386);
17209 +long long atomic64_inc_unchecked_386(long long a, atomic64_unchecked_t *v);
17210 +EXPORT_SYMBOL(atomic64_inc_unchecked_386);
17211 long long atomic64_dec_386(long long a, atomic64_t *v);
17212 EXPORT_SYMBOL(atomic64_dec_386);
17213 +long long atomic64_dec_unchecked_386(long long a, atomic64_unchecked_t *v);
17214 +EXPORT_SYMBOL(atomic64_dec_unchecked_386);
17215 long long atomic64_dec_if_positive_386(atomic64_t *v);
17216 EXPORT_SYMBOL(atomic64_dec_if_positive_386);
17217 int atomic64_inc_not_zero_386(atomic64_t *v);
17218 diff -urNp linux-3.0.8/arch/x86/lib/atomic64_386_32.S linux-3.0.8/arch/x86/lib/atomic64_386_32.S
17219 --- linux-3.0.8/arch/x86/lib/atomic64_386_32.S 2011-07-21 22:17:23.000000000 -0400
17220 +++ linux-3.0.8/arch/x86/lib/atomic64_386_32.S 2011-08-23 21:47:55.000000000 -0400
17221 @@ -48,6 +48,10 @@ BEGIN(read)
17222 movl (v), %eax
17223 movl 4(v), %edx
17224 RET_ENDP
17225 +BEGIN(read_unchecked)
17226 + movl (v), %eax
17227 + movl 4(v), %edx
17228 +RET_ENDP
17229 #undef v
17230
17231 #define v %esi
17232 @@ -55,6 +59,10 @@ BEGIN(set)
17233 movl %ebx, (v)
17234 movl %ecx, 4(v)
17235 RET_ENDP
17236 +BEGIN(set_unchecked)
17237 + movl %ebx, (v)
17238 + movl %ecx, 4(v)
17239 +RET_ENDP
17240 #undef v
17241
17242 #define v %esi
17243 @@ -70,6 +78,20 @@ RET_ENDP
17244 BEGIN(add)
17245 addl %eax, (v)
17246 adcl %edx, 4(v)
17247 +
17248 +#ifdef CONFIG_PAX_REFCOUNT
17249 + jno 0f
17250 + subl %eax, (v)
17251 + sbbl %edx, 4(v)
17252 + int $4
17253 +0:
17254 + _ASM_EXTABLE(0b, 0b)
17255 +#endif
17256 +
17257 +RET_ENDP
17258 +BEGIN(add_unchecked)
17259 + addl %eax, (v)
17260 + adcl %edx, 4(v)
17261 RET_ENDP
17262 #undef v
17263
17264 @@ -77,6 +99,24 @@ RET_ENDP
17265 BEGIN(add_return)
17266 addl (v), %eax
17267 adcl 4(v), %edx
17268 +
17269 +#ifdef CONFIG_PAX_REFCOUNT
17270 + into
17271 +1234:
17272 + _ASM_EXTABLE(1234b, 2f)
17273 +#endif
17274 +
17275 + movl %eax, (v)
17276 + movl %edx, 4(v)
17277 +
17278 +#ifdef CONFIG_PAX_REFCOUNT
17279 +2:
17280 +#endif
17281 +
17282 +RET_ENDP
17283 +BEGIN(add_return_unchecked)
17284 + addl (v), %eax
17285 + adcl 4(v), %edx
17286 movl %eax, (v)
17287 movl %edx, 4(v)
17288 RET_ENDP
17289 @@ -86,6 +126,20 @@ RET_ENDP
17290 BEGIN(sub)
17291 subl %eax, (v)
17292 sbbl %edx, 4(v)
17293 +
17294 +#ifdef CONFIG_PAX_REFCOUNT
17295 + jno 0f
17296 + addl %eax, (v)
17297 + adcl %edx, 4(v)
17298 + int $4
17299 +0:
17300 + _ASM_EXTABLE(0b, 0b)
17301 +#endif
17302 +
17303 +RET_ENDP
17304 +BEGIN(sub_unchecked)
17305 + subl %eax, (v)
17306 + sbbl %edx, 4(v)
17307 RET_ENDP
17308 #undef v
17309
17310 @@ -96,6 +150,27 @@ BEGIN(sub_return)
17311 sbbl $0, %edx
17312 addl (v), %eax
17313 adcl 4(v), %edx
17314 +
17315 +#ifdef CONFIG_PAX_REFCOUNT
17316 + into
17317 +1234:
17318 + _ASM_EXTABLE(1234b, 2f)
17319 +#endif
17320 +
17321 + movl %eax, (v)
17322 + movl %edx, 4(v)
17323 +
17324 +#ifdef CONFIG_PAX_REFCOUNT
17325 +2:
17326 +#endif
17327 +
17328 +RET_ENDP
17329 +BEGIN(sub_return_unchecked)
17330 + negl %edx
17331 + negl %eax
17332 + sbbl $0, %edx
17333 + addl (v), %eax
17334 + adcl 4(v), %edx
17335 movl %eax, (v)
17336 movl %edx, 4(v)
17337 RET_ENDP
17338 @@ -105,6 +180,20 @@ RET_ENDP
17339 BEGIN(inc)
17340 addl $1, (v)
17341 adcl $0, 4(v)
17342 +
17343 +#ifdef CONFIG_PAX_REFCOUNT
17344 + jno 0f
17345 + subl $1, (v)
17346 + sbbl $0, 4(v)
17347 + int $4
17348 +0:
17349 + _ASM_EXTABLE(0b, 0b)
17350 +#endif
17351 +
17352 +RET_ENDP
17353 +BEGIN(inc_unchecked)
17354 + addl $1, (v)
17355 + adcl $0, 4(v)
17356 RET_ENDP
17357 #undef v
17358
17359 @@ -114,6 +203,26 @@ BEGIN(inc_return)
17360 movl 4(v), %edx
17361 addl $1, %eax
17362 adcl $0, %edx
17363 +
17364 +#ifdef CONFIG_PAX_REFCOUNT
17365 + into
17366 +1234:
17367 + _ASM_EXTABLE(1234b, 2f)
17368 +#endif
17369 +
17370 + movl %eax, (v)
17371 + movl %edx, 4(v)
17372 +
17373 +#ifdef CONFIG_PAX_REFCOUNT
17374 +2:
17375 +#endif
17376 +
17377 +RET_ENDP
17378 +BEGIN(inc_return_unchecked)
17379 + movl (v), %eax
17380 + movl 4(v), %edx
17381 + addl $1, %eax
17382 + adcl $0, %edx
17383 movl %eax, (v)
17384 movl %edx, 4(v)
17385 RET_ENDP
17386 @@ -123,6 +232,20 @@ RET_ENDP
17387 BEGIN(dec)
17388 subl $1, (v)
17389 sbbl $0, 4(v)
17390 +
17391 +#ifdef CONFIG_PAX_REFCOUNT
17392 + jno 0f
17393 + addl $1, (v)
17394 + adcl $0, 4(v)
17395 + int $4
17396 +0:
17397 + _ASM_EXTABLE(0b, 0b)
17398 +#endif
17399 +
17400 +RET_ENDP
17401 +BEGIN(dec_unchecked)
17402 + subl $1, (v)
17403 + sbbl $0, 4(v)
17404 RET_ENDP
17405 #undef v
17406
17407 @@ -132,6 +255,26 @@ BEGIN(dec_return)
17408 movl 4(v), %edx
17409 subl $1, %eax
17410 sbbl $0, %edx
17411 +
17412 +#ifdef CONFIG_PAX_REFCOUNT
17413 + into
17414 +1234:
17415 + _ASM_EXTABLE(1234b, 2f)
17416 +#endif
17417 +
17418 + movl %eax, (v)
17419 + movl %edx, 4(v)
17420 +
17421 +#ifdef CONFIG_PAX_REFCOUNT
17422 +2:
17423 +#endif
17424 +
17425 +RET_ENDP
17426 +BEGIN(dec_return_unchecked)
17427 + movl (v), %eax
17428 + movl 4(v), %edx
17429 + subl $1, %eax
17430 + sbbl $0, %edx
17431 movl %eax, (v)
17432 movl %edx, 4(v)
17433 RET_ENDP
17434 @@ -143,6 +286,13 @@ BEGIN(add_unless)
17435 adcl %edx, %edi
17436 addl (v), %eax
17437 adcl 4(v), %edx
17438 +
17439 +#ifdef CONFIG_PAX_REFCOUNT
17440 + into
17441 +1234:
17442 + _ASM_EXTABLE(1234b, 2f)
17443 +#endif
17444 +
17445 cmpl %eax, %esi
17446 je 3f
17447 1:
17448 @@ -168,6 +318,13 @@ BEGIN(inc_not_zero)
17449 1:
17450 addl $1, %eax
17451 adcl $0, %edx
17452 +
17453 +#ifdef CONFIG_PAX_REFCOUNT
17454 + into
17455 +1234:
17456 + _ASM_EXTABLE(1234b, 2f)
17457 +#endif
17458 +
17459 movl %eax, (v)
17460 movl %edx, 4(v)
17461 movl $1, %eax
17462 @@ -186,6 +343,13 @@ BEGIN(dec_if_positive)
17463 movl 4(v), %edx
17464 subl $1, %eax
17465 sbbl $0, %edx
17466 +
17467 +#ifdef CONFIG_PAX_REFCOUNT
17468 + into
17469 +1234:
17470 + _ASM_EXTABLE(1234b, 1f)
17471 +#endif
17472 +
17473 js 1f
17474 movl %eax, (v)
17475 movl %edx, 4(v)
17476 diff -urNp linux-3.0.8/arch/x86/lib/atomic64_cx8_32.S linux-3.0.8/arch/x86/lib/atomic64_cx8_32.S
17477 --- linux-3.0.8/arch/x86/lib/atomic64_cx8_32.S 2011-07-21 22:17:23.000000000 -0400
17478 +++ linux-3.0.8/arch/x86/lib/atomic64_cx8_32.S 2011-10-06 04:17:55.000000000 -0400
17479 @@ -35,10 +35,20 @@ ENTRY(atomic64_read_cx8)
17480 CFI_STARTPROC
17481
17482 read64 %ecx
17483 + pax_force_retaddr
17484 ret
17485 CFI_ENDPROC
17486 ENDPROC(atomic64_read_cx8)
17487
17488 +ENTRY(atomic64_read_unchecked_cx8)
17489 + CFI_STARTPROC
17490 +
17491 + read64 %ecx
17492 + pax_force_retaddr
17493 + ret
17494 + CFI_ENDPROC
17495 +ENDPROC(atomic64_read_unchecked_cx8)
17496 +
17497 ENTRY(atomic64_set_cx8)
17498 CFI_STARTPROC
17499
17500 @@ -48,10 +58,25 @@ ENTRY(atomic64_set_cx8)
17501 cmpxchg8b (%esi)
17502 jne 1b
17503
17504 + pax_force_retaddr
17505 ret
17506 CFI_ENDPROC
17507 ENDPROC(atomic64_set_cx8)
17508
17509 +ENTRY(atomic64_set_unchecked_cx8)
17510 + CFI_STARTPROC
17511 +
17512 +1:
17513 +/* we don't need LOCK_PREFIX since aligned 64-bit writes
17514 + * are atomic on 586 and newer */
17515 + cmpxchg8b (%esi)
17516 + jne 1b
17517 +
17518 + pax_force_retaddr
17519 + ret
17520 + CFI_ENDPROC
17521 +ENDPROC(atomic64_set_unchecked_cx8)
17522 +
17523 ENTRY(atomic64_xchg_cx8)
17524 CFI_STARTPROC
17525
17526 @@ -62,12 +87,13 @@ ENTRY(atomic64_xchg_cx8)
17527 cmpxchg8b (%esi)
17528 jne 1b
17529
17530 + pax_force_retaddr
17531 ret
17532 CFI_ENDPROC
17533 ENDPROC(atomic64_xchg_cx8)
17534
17535 -.macro addsub_return func ins insc
17536 -ENTRY(atomic64_\func\()_return_cx8)
17537 +.macro addsub_return func ins insc unchecked=""
17538 +ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
17539 CFI_STARTPROC
17540 SAVE ebp
17541 SAVE ebx
17542 @@ -84,27 +110,44 @@ ENTRY(atomic64_\func\()_return_cx8)
17543 movl %edx, %ecx
17544 \ins\()l %esi, %ebx
17545 \insc\()l %edi, %ecx
17546 +
17547 +.ifb \unchecked
17548 +#ifdef CONFIG_PAX_REFCOUNT
17549 + into
17550 +2:
17551 + _ASM_EXTABLE(2b, 3f)
17552 +#endif
17553 +.endif
17554 +
17555 LOCK_PREFIX
17556 cmpxchg8b (%ebp)
17557 jne 1b
17558 -
17559 -10:
17560 movl %ebx, %eax
17561 movl %ecx, %edx
17562 +
17563 +.ifb \unchecked
17564 +#ifdef CONFIG_PAX_REFCOUNT
17565 +3:
17566 +#endif
17567 +.endif
17568 +
17569 RESTORE edi
17570 RESTORE esi
17571 RESTORE ebx
17572 RESTORE ebp
17573 + pax_force_retaddr
17574 ret
17575 CFI_ENDPROC
17576 -ENDPROC(atomic64_\func\()_return_cx8)
17577 +ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
17578 .endm
17579
17580 addsub_return add add adc
17581 addsub_return sub sub sbb
17582 +addsub_return add add adc _unchecked
17583 +addsub_return sub sub sbb _unchecked
17584
17585 -.macro incdec_return func ins insc
17586 -ENTRY(atomic64_\func\()_return_cx8)
17587 +.macro incdec_return func ins insc unchecked
17588 +ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
17589 CFI_STARTPROC
17590 SAVE ebx
17591
17592 @@ -114,21 +157,39 @@ ENTRY(atomic64_\func\()_return_cx8)
17593 movl %edx, %ecx
17594 \ins\()l $1, %ebx
17595 \insc\()l $0, %ecx
17596 +
17597 +.ifb \unchecked
17598 +#ifdef CONFIG_PAX_REFCOUNT
17599 + into
17600 +2:
17601 + _ASM_EXTABLE(2b, 3f)
17602 +#endif
17603 +.endif
17604 +
17605 LOCK_PREFIX
17606 cmpxchg8b (%esi)
17607 jne 1b
17608
17609 -10:
17610 movl %ebx, %eax
17611 movl %ecx, %edx
17612 +
17613 +.ifb \unchecked
17614 +#ifdef CONFIG_PAX_REFCOUNT
17615 +3:
17616 +#endif
17617 +.endif
17618 +
17619 RESTORE ebx
17620 + pax_force_retaddr
17621 ret
17622 CFI_ENDPROC
17623 -ENDPROC(atomic64_\func\()_return_cx8)
17624 +ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
17625 .endm
17626
17627 incdec_return inc add adc
17628 incdec_return dec sub sbb
17629 +incdec_return inc add adc _unchecked
17630 +incdec_return dec sub sbb _unchecked
17631
17632 ENTRY(atomic64_dec_if_positive_cx8)
17633 CFI_STARTPROC
17634 @@ -140,6 +201,13 @@ ENTRY(atomic64_dec_if_positive_cx8)
17635 movl %edx, %ecx
17636 subl $1, %ebx
17637 sbb $0, %ecx
17638 +
17639 +#ifdef CONFIG_PAX_REFCOUNT
17640 + into
17641 +1234:
17642 + _ASM_EXTABLE(1234b, 2f)
17643 +#endif
17644 +
17645 js 2f
17646 LOCK_PREFIX
17647 cmpxchg8b (%esi)
17648 @@ -149,6 +217,7 @@ ENTRY(atomic64_dec_if_positive_cx8)
17649 movl %ebx, %eax
17650 movl %ecx, %edx
17651 RESTORE ebx
17652 + pax_force_retaddr
17653 ret
17654 CFI_ENDPROC
17655 ENDPROC(atomic64_dec_if_positive_cx8)
17656 @@ -174,6 +243,13 @@ ENTRY(atomic64_add_unless_cx8)
17657 movl %edx, %ecx
17658 addl %esi, %ebx
17659 adcl %edi, %ecx
17660 +
17661 +#ifdef CONFIG_PAX_REFCOUNT
17662 + into
17663 +1234:
17664 + _ASM_EXTABLE(1234b, 3f)
17665 +#endif
17666 +
17667 LOCK_PREFIX
17668 cmpxchg8b (%ebp)
17669 jne 1b
17670 @@ -184,6 +260,7 @@ ENTRY(atomic64_add_unless_cx8)
17671 CFI_ADJUST_CFA_OFFSET -8
17672 RESTORE ebx
17673 RESTORE ebp
17674 + pax_force_retaddr
17675 ret
17676 4:
17677 cmpl %edx, 4(%esp)
17678 @@ -206,6 +283,13 @@ ENTRY(atomic64_inc_not_zero_cx8)
17679 movl %edx, %ecx
17680 addl $1, %ebx
17681 adcl $0, %ecx
17682 +
17683 +#ifdef CONFIG_PAX_REFCOUNT
17684 + into
17685 +1234:
17686 + _ASM_EXTABLE(1234b, 3f)
17687 +#endif
17688 +
17689 LOCK_PREFIX
17690 cmpxchg8b (%esi)
17691 jne 1b
17692 @@ -213,6 +297,7 @@ ENTRY(atomic64_inc_not_zero_cx8)
17693 movl $1, %eax
17694 3:
17695 RESTORE ebx
17696 + pax_force_retaddr
17697 ret
17698 4:
17699 testl %edx, %edx
17700 diff -urNp linux-3.0.8/arch/x86/lib/checksum_32.S linux-3.0.8/arch/x86/lib/checksum_32.S
17701 --- linux-3.0.8/arch/x86/lib/checksum_32.S 2011-07-21 22:17:23.000000000 -0400
17702 +++ linux-3.0.8/arch/x86/lib/checksum_32.S 2011-08-23 21:47:55.000000000 -0400
17703 @@ -28,7 +28,8 @@
17704 #include <linux/linkage.h>
17705 #include <asm/dwarf2.h>
17706 #include <asm/errno.h>
17707 -
17708 +#include <asm/segment.h>
17709 +
17710 /*
17711 * computes a partial checksum, e.g. for TCP/UDP fragments
17712 */
17713 @@ -296,9 +297,24 @@ unsigned int csum_partial_copy_generic (
17714
17715 #define ARGBASE 16
17716 #define FP 12
17717 -
17718 -ENTRY(csum_partial_copy_generic)
17719 +
17720 +ENTRY(csum_partial_copy_generic_to_user)
17721 CFI_STARTPROC
17722 +
17723 +#ifdef CONFIG_PAX_MEMORY_UDEREF
17724 + pushl_cfi %gs
17725 + popl_cfi %es
17726 + jmp csum_partial_copy_generic
17727 +#endif
17728 +
17729 +ENTRY(csum_partial_copy_generic_from_user)
17730 +
17731 +#ifdef CONFIG_PAX_MEMORY_UDEREF
17732 + pushl_cfi %gs
17733 + popl_cfi %ds
17734 +#endif
17735 +
17736 +ENTRY(csum_partial_copy_generic)
17737 subl $4,%esp
17738 CFI_ADJUST_CFA_OFFSET 4
17739 pushl_cfi %edi
17740 @@ -320,7 +336,7 @@ ENTRY(csum_partial_copy_generic)
17741 jmp 4f
17742 SRC(1: movw (%esi), %bx )
17743 addl $2, %esi
17744 -DST( movw %bx, (%edi) )
17745 +DST( movw %bx, %es:(%edi) )
17746 addl $2, %edi
17747 addw %bx, %ax
17748 adcl $0, %eax
17749 @@ -332,30 +348,30 @@ DST( movw %bx, (%edi) )
17750 SRC(1: movl (%esi), %ebx )
17751 SRC( movl 4(%esi), %edx )
17752 adcl %ebx, %eax
17753 -DST( movl %ebx, (%edi) )
17754 +DST( movl %ebx, %es:(%edi) )
17755 adcl %edx, %eax
17756 -DST( movl %edx, 4(%edi) )
17757 +DST( movl %edx, %es:4(%edi) )
17758
17759 SRC( movl 8(%esi), %ebx )
17760 SRC( movl 12(%esi), %edx )
17761 adcl %ebx, %eax
17762 -DST( movl %ebx, 8(%edi) )
17763 +DST( movl %ebx, %es:8(%edi) )
17764 adcl %edx, %eax
17765 -DST( movl %edx, 12(%edi) )
17766 +DST( movl %edx, %es:12(%edi) )
17767
17768 SRC( movl 16(%esi), %ebx )
17769 SRC( movl 20(%esi), %edx )
17770 adcl %ebx, %eax
17771 -DST( movl %ebx, 16(%edi) )
17772 +DST( movl %ebx, %es:16(%edi) )
17773 adcl %edx, %eax
17774 -DST( movl %edx, 20(%edi) )
17775 +DST( movl %edx, %es:20(%edi) )
17776
17777 SRC( movl 24(%esi), %ebx )
17778 SRC( movl 28(%esi), %edx )
17779 adcl %ebx, %eax
17780 -DST( movl %ebx, 24(%edi) )
17781 +DST( movl %ebx, %es:24(%edi) )
17782 adcl %edx, %eax
17783 -DST( movl %edx, 28(%edi) )
17784 +DST( movl %edx, %es:28(%edi) )
17785
17786 lea 32(%esi), %esi
17787 lea 32(%edi), %edi
17788 @@ -369,7 +385,7 @@ DST( movl %edx, 28(%edi) )
17789 shrl $2, %edx # This clears CF
17790 SRC(3: movl (%esi), %ebx )
17791 adcl %ebx, %eax
17792 -DST( movl %ebx, (%edi) )
17793 +DST( movl %ebx, %es:(%edi) )
17794 lea 4(%esi), %esi
17795 lea 4(%edi), %edi
17796 dec %edx
17797 @@ -381,12 +397,12 @@ DST( movl %ebx, (%edi) )
17798 jb 5f
17799 SRC( movw (%esi), %cx )
17800 leal 2(%esi), %esi
17801 -DST( movw %cx, (%edi) )
17802 +DST( movw %cx, %es:(%edi) )
17803 leal 2(%edi), %edi
17804 je 6f
17805 shll $16,%ecx
17806 SRC(5: movb (%esi), %cl )
17807 -DST( movb %cl, (%edi) )
17808 +DST( movb %cl, %es:(%edi) )
17809 6: addl %ecx, %eax
17810 adcl $0, %eax
17811 7:
17812 @@ -397,7 +413,7 @@ DST( movb %cl, (%edi) )
17813
17814 6001:
17815 movl ARGBASE+20(%esp), %ebx # src_err_ptr
17816 - movl $-EFAULT, (%ebx)
17817 + movl $-EFAULT, %ss:(%ebx)
17818
17819 # zero the complete destination - computing the rest
17820 # is too much work
17821 @@ -410,11 +426,15 @@ DST( movb %cl, (%edi) )
17822
17823 6002:
17824 movl ARGBASE+24(%esp), %ebx # dst_err_ptr
17825 - movl $-EFAULT,(%ebx)
17826 + movl $-EFAULT,%ss:(%ebx)
17827 jmp 5000b
17828
17829 .previous
17830
17831 + pushl_cfi %ss
17832 + popl_cfi %ds
17833 + pushl_cfi %ss
17834 + popl_cfi %es
17835 popl_cfi %ebx
17836 CFI_RESTORE ebx
17837 popl_cfi %esi
17838 @@ -424,26 +444,43 @@ DST( movb %cl, (%edi) )
17839 popl_cfi %ecx # equivalent to addl $4,%esp
17840 ret
17841 CFI_ENDPROC
17842 -ENDPROC(csum_partial_copy_generic)
17843 +ENDPROC(csum_partial_copy_generic_to_user)
17844
17845 #else
17846
17847 /* Version for PentiumII/PPro */
17848
17849 #define ROUND1(x) \
17850 + nop; nop; nop; \
17851 SRC(movl x(%esi), %ebx ) ; \
17852 addl %ebx, %eax ; \
17853 - DST(movl %ebx, x(%edi) ) ;
17854 + DST(movl %ebx, %es:x(%edi)) ;
17855
17856 #define ROUND(x) \
17857 + nop; nop; nop; \
17858 SRC(movl x(%esi), %ebx ) ; \
17859 adcl %ebx, %eax ; \
17860 - DST(movl %ebx, x(%edi) ) ;
17861 + DST(movl %ebx, %es:x(%edi)) ;
17862
17863 #define ARGBASE 12
17864 -
17865 -ENTRY(csum_partial_copy_generic)
17866 +
17867 +ENTRY(csum_partial_copy_generic_to_user)
17868 CFI_STARTPROC
17869 +
17870 +#ifdef CONFIG_PAX_MEMORY_UDEREF
17871 + pushl_cfi %gs
17872 + popl_cfi %es
17873 + jmp csum_partial_copy_generic
17874 +#endif
17875 +
17876 +ENTRY(csum_partial_copy_generic_from_user)
17877 +
17878 +#ifdef CONFIG_PAX_MEMORY_UDEREF
17879 + pushl_cfi %gs
17880 + popl_cfi %ds
17881 +#endif
17882 +
17883 +ENTRY(csum_partial_copy_generic)
17884 pushl_cfi %ebx
17885 CFI_REL_OFFSET ebx, 0
17886 pushl_cfi %edi
17887 @@ -464,7 +501,7 @@ ENTRY(csum_partial_copy_generic)
17888 subl %ebx, %edi
17889 lea -1(%esi),%edx
17890 andl $-32,%edx
17891 - lea 3f(%ebx,%ebx), %ebx
17892 + lea 3f(%ebx,%ebx,2), %ebx
17893 testl %esi, %esi
17894 jmp *%ebx
17895 1: addl $64,%esi
17896 @@ -485,19 +522,19 @@ ENTRY(csum_partial_copy_generic)
17897 jb 5f
17898 SRC( movw (%esi), %dx )
17899 leal 2(%esi), %esi
17900 -DST( movw %dx, (%edi) )
17901 +DST( movw %dx, %es:(%edi) )
17902 leal 2(%edi), %edi
17903 je 6f
17904 shll $16,%edx
17905 5:
17906 SRC( movb (%esi), %dl )
17907 -DST( movb %dl, (%edi) )
17908 +DST( movb %dl, %es:(%edi) )
17909 6: addl %edx, %eax
17910 adcl $0, %eax
17911 7:
17912 .section .fixup, "ax"
17913 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
17914 - movl $-EFAULT, (%ebx)
17915 + movl $-EFAULT, %ss:(%ebx)
17916 # zero the complete destination (computing the rest is too much work)
17917 movl ARGBASE+8(%esp),%edi # dst
17918 movl ARGBASE+12(%esp),%ecx # len
17919 @@ -505,10 +542,17 @@ DST( movb %dl, (%edi) )
17920 rep; stosb
17921 jmp 7b
17922 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
17923 - movl $-EFAULT, (%ebx)
17924 + movl $-EFAULT, %ss:(%ebx)
17925 jmp 7b
17926 .previous
17927
17928 +#ifdef CONFIG_PAX_MEMORY_UDEREF
17929 + pushl_cfi %ss
17930 + popl_cfi %ds
17931 + pushl_cfi %ss
17932 + popl_cfi %es
17933 +#endif
17934 +
17935 popl_cfi %esi
17936 CFI_RESTORE esi
17937 popl_cfi %edi
17938 @@ -517,7 +561,7 @@ DST( movb %dl, (%edi) )
17939 CFI_RESTORE ebx
17940 ret
17941 CFI_ENDPROC
17942 -ENDPROC(csum_partial_copy_generic)
17943 +ENDPROC(csum_partial_copy_generic_to_user)
17944
17945 #undef ROUND
17946 #undef ROUND1
17947 diff -urNp linux-3.0.8/arch/x86/lib/clear_page_64.S linux-3.0.8/arch/x86/lib/clear_page_64.S
17948 --- linux-3.0.8/arch/x86/lib/clear_page_64.S 2011-07-21 22:17:23.000000000 -0400
17949 +++ linux-3.0.8/arch/x86/lib/clear_page_64.S 2011-10-06 04:17:55.000000000 -0400
17950 @@ -11,6 +11,7 @@ ENTRY(clear_page_c)
17951 movl $4096/8,%ecx
17952 xorl %eax,%eax
17953 rep stosq
17954 + pax_force_retaddr
17955 ret
17956 CFI_ENDPROC
17957 ENDPROC(clear_page_c)
17958 @@ -20,6 +21,7 @@ ENTRY(clear_page_c_e)
17959 movl $4096,%ecx
17960 xorl %eax,%eax
17961 rep stosb
17962 + pax_force_retaddr
17963 ret
17964 CFI_ENDPROC
17965 ENDPROC(clear_page_c_e)
17966 @@ -43,6 +45,7 @@ ENTRY(clear_page)
17967 leaq 64(%rdi),%rdi
17968 jnz .Lloop
17969 nop
17970 + pax_force_retaddr
17971 ret
17972 CFI_ENDPROC
17973 .Lclear_page_end:
17974 @@ -58,7 +61,7 @@ ENDPROC(clear_page)
17975
17976 #include <asm/cpufeature.h>
17977
17978 - .section .altinstr_replacement,"ax"
17979 + .section .altinstr_replacement,"a"
17980 1: .byte 0xeb /* jmp <disp8> */
17981 .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
17982 2: .byte 0xeb /* jmp <disp8> */
17983 diff -urNp linux-3.0.8/arch/x86/lib/cmpxchg16b_emu.S linux-3.0.8/arch/x86/lib/cmpxchg16b_emu.S
17984 --- linux-3.0.8/arch/x86/lib/cmpxchg16b_emu.S 2011-07-21 22:17:23.000000000 -0400
17985 +++ linux-3.0.8/arch/x86/lib/cmpxchg16b_emu.S 2011-10-07 19:07:28.000000000 -0400
17986 @@ -53,11 +53,13 @@ this_cpu_cmpxchg16b_emu:
17987
17988 popf
17989 mov $1, %al
17990 + pax_force_retaddr
17991 ret
17992
17993 not_same:
17994 popf
17995 xor %al,%al
17996 + pax_force_retaddr
17997 ret
17998
17999 CFI_ENDPROC
18000 diff -urNp linux-3.0.8/arch/x86/lib/copy_page_64.S linux-3.0.8/arch/x86/lib/copy_page_64.S
18001 --- linux-3.0.8/arch/x86/lib/copy_page_64.S 2011-07-21 22:17:23.000000000 -0400
18002 +++ linux-3.0.8/arch/x86/lib/copy_page_64.S 2011-10-06 04:17:55.000000000 -0400
18003 @@ -2,12 +2,14 @@
18004
18005 #include <linux/linkage.h>
18006 #include <asm/dwarf2.h>
18007 +#include <asm/alternative-asm.h>
18008
18009 ALIGN
18010 copy_page_c:
18011 CFI_STARTPROC
18012 movl $4096/8,%ecx
18013 rep movsq
18014 + pax_force_retaddr
18015 ret
18016 CFI_ENDPROC
18017 ENDPROC(copy_page_c)
18018 @@ -94,6 +96,7 @@ ENTRY(copy_page)
18019 CFI_RESTORE r13
18020 addq $3*8,%rsp
18021 CFI_ADJUST_CFA_OFFSET -3*8
18022 + pax_force_retaddr
18023 ret
18024 .Lcopy_page_end:
18025 CFI_ENDPROC
18026 @@ -104,7 +107,7 @@ ENDPROC(copy_page)
18027
18028 #include <asm/cpufeature.h>
18029
18030 - .section .altinstr_replacement,"ax"
18031 + .section .altinstr_replacement,"a"
18032 1: .byte 0xeb /* jmp <disp8> */
18033 .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
18034 2:
18035 diff -urNp linux-3.0.8/arch/x86/lib/copy_user_64.S linux-3.0.8/arch/x86/lib/copy_user_64.S
18036 --- linux-3.0.8/arch/x86/lib/copy_user_64.S 2011-07-21 22:17:23.000000000 -0400
18037 +++ linux-3.0.8/arch/x86/lib/copy_user_64.S 2011-10-06 04:17:55.000000000 -0400
18038 @@ -16,6 +16,7 @@
18039 #include <asm/thread_info.h>
18040 #include <asm/cpufeature.h>
18041 #include <asm/alternative-asm.h>
18042 +#include <asm/pgtable.h>
18043
18044 /*
18045 * By placing feature2 after feature1 in altinstructions section, we logically
18046 @@ -29,7 +30,7 @@
18047 .byte 0xe9 /* 32bit jump */
18048 .long \orig-1f /* by default jump to orig */
18049 1:
18050 - .section .altinstr_replacement,"ax"
18051 + .section .altinstr_replacement,"a"
18052 2: .byte 0xe9 /* near jump with 32bit immediate */
18053 .long \alt1-1b /* offset */ /* or alternatively to alt1 */
18054 3: .byte 0xe9 /* near jump with 32bit immediate */
18055 @@ -71,47 +72,20 @@
18056 #endif
18057 .endm
18058
18059 -/* Standard copy_to_user with segment limit checking */
18060 -ENTRY(_copy_to_user)
18061 - CFI_STARTPROC
18062 - GET_THREAD_INFO(%rax)
18063 - movq %rdi,%rcx
18064 - addq %rdx,%rcx
18065 - jc bad_to_user
18066 - cmpq TI_addr_limit(%rax),%rcx
18067 - ja bad_to_user
18068 - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
18069 - copy_user_generic_unrolled,copy_user_generic_string, \
18070 - copy_user_enhanced_fast_string
18071 - CFI_ENDPROC
18072 -ENDPROC(_copy_to_user)
18073 -
18074 -/* Standard copy_from_user with segment limit checking */
18075 -ENTRY(_copy_from_user)
18076 - CFI_STARTPROC
18077 - GET_THREAD_INFO(%rax)
18078 - movq %rsi,%rcx
18079 - addq %rdx,%rcx
18080 - jc bad_from_user
18081 - cmpq TI_addr_limit(%rax),%rcx
18082 - ja bad_from_user
18083 - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
18084 - copy_user_generic_unrolled,copy_user_generic_string, \
18085 - copy_user_enhanced_fast_string
18086 - CFI_ENDPROC
18087 -ENDPROC(_copy_from_user)
18088 -
18089 .section .fixup,"ax"
18090 /* must zero dest */
18091 ENTRY(bad_from_user)
18092 bad_from_user:
18093 CFI_STARTPROC
18094 + testl %edx,%edx
18095 + js bad_to_user
18096 movl %edx,%ecx
18097 xorl %eax,%eax
18098 rep
18099 stosb
18100 bad_to_user:
18101 movl %edx,%eax
18102 + pax_force_retaddr
18103 ret
18104 CFI_ENDPROC
18105 ENDPROC(bad_from_user)
18106 @@ -179,6 +153,7 @@ ENTRY(copy_user_generic_unrolled)
18107 decl %ecx
18108 jnz 21b
18109 23: xor %eax,%eax
18110 + pax_force_retaddr
18111 ret
18112
18113 .section .fixup,"ax"
18114 @@ -251,6 +226,7 @@ ENTRY(copy_user_generic_string)
18115 3: rep
18116 movsb
18117 4: xorl %eax,%eax
18118 + pax_force_retaddr
18119 ret
18120
18121 .section .fixup,"ax"
18122 @@ -287,6 +263,7 @@ ENTRY(copy_user_enhanced_fast_string)
18123 1: rep
18124 movsb
18125 2: xorl %eax,%eax
18126 + pax_force_retaddr
18127 ret
18128
18129 .section .fixup,"ax"
18130 diff -urNp linux-3.0.8/arch/x86/lib/copy_user_nocache_64.S linux-3.0.8/arch/x86/lib/copy_user_nocache_64.S
18131 --- linux-3.0.8/arch/x86/lib/copy_user_nocache_64.S 2011-07-21 22:17:23.000000000 -0400
18132 +++ linux-3.0.8/arch/x86/lib/copy_user_nocache_64.S 2011-10-06 04:17:55.000000000 -0400
18133 @@ -8,12 +8,14 @@
18134
18135 #include <linux/linkage.h>
18136 #include <asm/dwarf2.h>
18137 +#include <asm/alternative-asm.h>
18138
18139 #define FIX_ALIGNMENT 1
18140
18141 #include <asm/current.h>
18142 #include <asm/asm-offsets.h>
18143 #include <asm/thread_info.h>
18144 +#include <asm/pgtable.h>
18145
18146 .macro ALIGN_DESTINATION
18147 #ifdef FIX_ALIGNMENT
18148 @@ -50,6 +52,15 @@
18149 */
18150 ENTRY(__copy_user_nocache)
18151 CFI_STARTPROC
18152 +
18153 +#ifdef CONFIG_PAX_MEMORY_UDEREF
18154 + mov $PAX_USER_SHADOW_BASE,%rcx
18155 + cmp %rcx,%rsi
18156 + jae 1f
18157 + add %rcx,%rsi
18158 +1:
18159 +#endif
18160 +
18161 cmpl $8,%edx
18162 jb 20f /* less then 8 bytes, go to byte copy loop */
18163 ALIGN_DESTINATION
18164 @@ -98,6 +109,7 @@ ENTRY(__copy_user_nocache)
18165 jnz 21b
18166 23: xorl %eax,%eax
18167 sfence
18168 + pax_force_retaddr
18169 ret
18170
18171 .section .fixup,"ax"
18172 diff -urNp linux-3.0.8/arch/x86/lib/csum-copy_64.S linux-3.0.8/arch/x86/lib/csum-copy_64.S
18173 --- linux-3.0.8/arch/x86/lib/csum-copy_64.S 2011-07-21 22:17:23.000000000 -0400
18174 +++ linux-3.0.8/arch/x86/lib/csum-copy_64.S 2011-10-06 04:17:55.000000000 -0400
18175 @@ -8,6 +8,7 @@
18176 #include <linux/linkage.h>
18177 #include <asm/dwarf2.h>
18178 #include <asm/errno.h>
18179 +#include <asm/alternative-asm.h>
18180
18181 /*
18182 * Checksum copy with exception handling.
18183 @@ -228,6 +229,7 @@ ENTRY(csum_partial_copy_generic)
18184 CFI_RESTORE rbp
18185 addq $7*8, %rsp
18186 CFI_ADJUST_CFA_OFFSET -7*8
18187 + pax_force_retaddr
18188 ret
18189 CFI_RESTORE_STATE
18190
18191 diff -urNp linux-3.0.8/arch/x86/lib/csum-wrappers_64.c linux-3.0.8/arch/x86/lib/csum-wrappers_64.c
18192 --- linux-3.0.8/arch/x86/lib/csum-wrappers_64.c 2011-07-21 22:17:23.000000000 -0400
18193 +++ linux-3.0.8/arch/x86/lib/csum-wrappers_64.c 2011-10-06 04:17:55.000000000 -0400
18194 @@ -52,7 +52,13 @@ csum_partial_copy_from_user(const void _
18195 len -= 2;
18196 }
18197 }
18198 - isum = csum_partial_copy_generic((__force const void *)src,
18199 +
18200 +#ifdef CONFIG_PAX_MEMORY_UDEREF
18201 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
18202 + src += PAX_USER_SHADOW_BASE;
18203 +#endif
18204 +
18205 + isum = csum_partial_copy_generic((const void __force_kernel *)src,
18206 dst, len, isum, errp, NULL);
18207 if (unlikely(*errp))
18208 goto out_err;
18209 @@ -105,7 +111,13 @@ csum_partial_copy_to_user(const void *sr
18210 }
18211
18212 *errp = 0;
18213 - return csum_partial_copy_generic(src, (void __force *)dst,
18214 +
18215 +#ifdef CONFIG_PAX_MEMORY_UDEREF
18216 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
18217 + dst += PAX_USER_SHADOW_BASE;
18218 +#endif
18219 +
18220 + return csum_partial_copy_generic(src, (void __force_kernel *)dst,
18221 len, isum, NULL, errp);
18222 }
18223 EXPORT_SYMBOL(csum_partial_copy_to_user);
18224 diff -urNp linux-3.0.8/arch/x86/lib/getuser.S linux-3.0.8/arch/x86/lib/getuser.S
18225 --- linux-3.0.8/arch/x86/lib/getuser.S 2011-07-21 22:17:23.000000000 -0400
18226 +++ linux-3.0.8/arch/x86/lib/getuser.S 2011-10-07 19:07:23.000000000 -0400
18227 @@ -33,15 +33,38 @@
18228 #include <asm/asm-offsets.h>
18229 #include <asm/thread_info.h>
18230 #include <asm/asm.h>
18231 +#include <asm/segment.h>
18232 +#include <asm/pgtable.h>
18233 +#include <asm/alternative-asm.h>
18234 +
18235 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18236 +#define __copyuser_seg gs;
18237 +#else
18238 +#define __copyuser_seg
18239 +#endif
18240
18241 .text
18242 ENTRY(__get_user_1)
18243 CFI_STARTPROC
18244 +
18245 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
18246 GET_THREAD_INFO(%_ASM_DX)
18247 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
18248 jae bad_get_user
18249 -1: movzb (%_ASM_AX),%edx
18250 +
18251 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
18252 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
18253 + cmp %_ASM_DX,%_ASM_AX
18254 + jae 1234f
18255 + add %_ASM_DX,%_ASM_AX
18256 +1234:
18257 +#endif
18258 +
18259 +#endif
18260 +
18261 +1: __copyuser_seg movzb (%_ASM_AX),%edx
18262 xor %eax,%eax
18263 + pax_force_retaddr
18264 ret
18265 CFI_ENDPROC
18266 ENDPROC(__get_user_1)
18267 @@ -49,12 +72,26 @@ ENDPROC(__get_user_1)
18268 ENTRY(__get_user_2)
18269 CFI_STARTPROC
18270 add $1,%_ASM_AX
18271 +
18272 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
18273 jc bad_get_user
18274 GET_THREAD_INFO(%_ASM_DX)
18275 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
18276 jae bad_get_user
18277 -2: movzwl -1(%_ASM_AX),%edx
18278 +
18279 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
18280 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
18281 + cmp %_ASM_DX,%_ASM_AX
18282 + jae 1234f
18283 + add %_ASM_DX,%_ASM_AX
18284 +1234:
18285 +#endif
18286 +
18287 +#endif
18288 +
18289 +2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
18290 xor %eax,%eax
18291 + pax_force_retaddr
18292 ret
18293 CFI_ENDPROC
18294 ENDPROC(__get_user_2)
18295 @@ -62,12 +99,26 @@ ENDPROC(__get_user_2)
18296 ENTRY(__get_user_4)
18297 CFI_STARTPROC
18298 add $3,%_ASM_AX
18299 +
18300 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
18301 jc bad_get_user
18302 GET_THREAD_INFO(%_ASM_DX)
18303 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
18304 jae bad_get_user
18305 -3: mov -3(%_ASM_AX),%edx
18306 +
18307 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
18308 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
18309 + cmp %_ASM_DX,%_ASM_AX
18310 + jae 1234f
18311 + add %_ASM_DX,%_ASM_AX
18312 +1234:
18313 +#endif
18314 +
18315 +#endif
18316 +
18317 +3: __copyuser_seg mov -3(%_ASM_AX),%edx
18318 xor %eax,%eax
18319 + pax_force_retaddr
18320 ret
18321 CFI_ENDPROC
18322 ENDPROC(__get_user_4)
18323 @@ -80,8 +131,18 @@ ENTRY(__get_user_8)
18324 GET_THREAD_INFO(%_ASM_DX)
18325 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
18326 jae bad_get_user
18327 +
18328 +#ifdef CONFIG_PAX_MEMORY_UDEREF
18329 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
18330 + cmp %_ASM_DX,%_ASM_AX
18331 + jae 1234f
18332 + add %_ASM_DX,%_ASM_AX
18333 +1234:
18334 +#endif
18335 +
18336 4: movq -7(%_ASM_AX),%_ASM_DX
18337 xor %eax,%eax
18338 + pax_force_retaddr
18339 ret
18340 CFI_ENDPROC
18341 ENDPROC(__get_user_8)
18342 @@ -91,6 +152,7 @@ bad_get_user:
18343 CFI_STARTPROC
18344 xor %edx,%edx
18345 mov $(-EFAULT),%_ASM_AX
18346 + pax_force_retaddr
18347 ret
18348 CFI_ENDPROC
18349 END(bad_get_user)
18350 diff -urNp linux-3.0.8/arch/x86/lib/insn.c linux-3.0.8/arch/x86/lib/insn.c
18351 --- linux-3.0.8/arch/x86/lib/insn.c 2011-07-21 22:17:23.000000000 -0400
18352 +++ linux-3.0.8/arch/x86/lib/insn.c 2011-08-23 21:47:55.000000000 -0400
18353 @@ -21,6 +21,11 @@
18354 #include <linux/string.h>
18355 #include <asm/inat.h>
18356 #include <asm/insn.h>
18357 +#ifdef __KERNEL__
18358 +#include <asm/pgtable_types.h>
18359 +#else
18360 +#define ktla_ktva(addr) addr
18361 +#endif
18362
18363 #define get_next(t, insn) \
18364 ({t r; r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); r; })
18365 @@ -40,8 +45,8 @@
18366 void insn_init(struct insn *insn, const void *kaddr, int x86_64)
18367 {
18368 memset(insn, 0, sizeof(*insn));
18369 - insn->kaddr = kaddr;
18370 - insn->next_byte = kaddr;
18371 + insn->kaddr = ktla_ktva(kaddr);
18372 + insn->next_byte = ktla_ktva(kaddr);
18373 insn->x86_64 = x86_64 ? 1 : 0;
18374 insn->opnd_bytes = 4;
18375 if (x86_64)
18376 diff -urNp linux-3.0.8/arch/x86/lib/iomap_copy_64.S linux-3.0.8/arch/x86/lib/iomap_copy_64.S
18377 --- linux-3.0.8/arch/x86/lib/iomap_copy_64.S 2011-07-21 22:17:23.000000000 -0400
18378 +++ linux-3.0.8/arch/x86/lib/iomap_copy_64.S 2011-10-06 04:17:55.000000000 -0400
18379 @@ -17,6 +17,7 @@
18380
18381 #include <linux/linkage.h>
18382 #include <asm/dwarf2.h>
18383 +#include <asm/alternative-asm.h>
18384
18385 /*
18386 * override generic version in lib/iomap_copy.c
18387 @@ -25,6 +26,7 @@ ENTRY(__iowrite32_copy)
18388 CFI_STARTPROC
18389 movl %edx,%ecx
18390 rep movsd
18391 + pax_force_retaddr
18392 ret
18393 CFI_ENDPROC
18394 ENDPROC(__iowrite32_copy)
18395 diff -urNp linux-3.0.8/arch/x86/lib/memcpy_64.S linux-3.0.8/arch/x86/lib/memcpy_64.S
18396 --- linux-3.0.8/arch/x86/lib/memcpy_64.S 2011-07-21 22:17:23.000000000 -0400
18397 +++ linux-3.0.8/arch/x86/lib/memcpy_64.S 2011-10-06 04:17:55.000000000 -0400
18398 @@ -34,6 +34,7 @@
18399 rep movsq
18400 movl %edx, %ecx
18401 rep movsb
18402 + pax_force_retaddr
18403 ret
18404 .Lmemcpy_e:
18405 .previous
18406 @@ -51,6 +52,7 @@
18407
18408 movl %edx, %ecx
18409 rep movsb
18410 + pax_force_retaddr
18411 ret
18412 .Lmemcpy_e_e:
18413 .previous
18414 @@ -141,6 +143,7 @@ ENTRY(memcpy)
18415 movq %r9, 1*8(%rdi)
18416 movq %r10, -2*8(%rdi, %rdx)
18417 movq %r11, -1*8(%rdi, %rdx)
18418 + pax_force_retaddr
18419 retq
18420 .p2align 4
18421 .Lless_16bytes:
18422 @@ -153,6 +156,7 @@ ENTRY(memcpy)
18423 movq -1*8(%rsi, %rdx), %r9
18424 movq %r8, 0*8(%rdi)
18425 movq %r9, -1*8(%rdi, %rdx)
18426 + pax_force_retaddr
18427 retq
18428 .p2align 4
18429 .Lless_8bytes:
18430 @@ -166,6 +170,7 @@ ENTRY(memcpy)
18431 movl -4(%rsi, %rdx), %r8d
18432 movl %ecx, (%rdi)
18433 movl %r8d, -4(%rdi, %rdx)
18434 + pax_force_retaddr
18435 retq
18436 .p2align 4
18437 .Lless_3bytes:
18438 @@ -183,6 +188,7 @@ ENTRY(memcpy)
18439 jnz .Lloop_1
18440
18441 .Lend:
18442 + pax_force_retaddr
18443 retq
18444 CFI_ENDPROC
18445 ENDPROC(memcpy)
18446 diff -urNp linux-3.0.8/arch/x86/lib/memmove_64.S linux-3.0.8/arch/x86/lib/memmove_64.S
18447 --- linux-3.0.8/arch/x86/lib/memmove_64.S 2011-07-21 22:17:23.000000000 -0400
18448 +++ linux-3.0.8/arch/x86/lib/memmove_64.S 2011-10-06 04:17:55.000000000 -0400
18449 @@ -9,6 +9,7 @@
18450 #include <linux/linkage.h>
18451 #include <asm/dwarf2.h>
18452 #include <asm/cpufeature.h>
18453 +#include <asm/alternative-asm.h>
18454
18455 #undef memmove
18456
18457 @@ -201,6 +202,7 @@ ENTRY(memmove)
18458 movb (%rsi), %r11b
18459 movb %r11b, (%rdi)
18460 13:
18461 + pax_force_retaddr
18462 retq
18463 CFI_ENDPROC
18464
18465 @@ -209,6 +211,7 @@ ENTRY(memmove)
18466 /* Forward moving data. */
18467 movq %rdx, %rcx
18468 rep movsb
18469 + pax_force_retaddr
18470 retq
18471 .Lmemmove_end_forward_efs:
18472 .previous
18473 diff -urNp linux-3.0.8/arch/x86/lib/memset_64.S linux-3.0.8/arch/x86/lib/memset_64.S
18474 --- linux-3.0.8/arch/x86/lib/memset_64.S 2011-07-21 22:17:23.000000000 -0400
18475 +++ linux-3.0.8/arch/x86/lib/memset_64.S 2011-10-06 04:17:55.000000000 -0400
18476 @@ -31,6 +31,7 @@
18477 movl %r8d,%ecx
18478 rep stosb
18479 movq %r9,%rax
18480 + pax_force_retaddr
18481 ret
18482 .Lmemset_e:
18483 .previous
18484 @@ -53,6 +54,7 @@
18485 movl %edx,%ecx
18486 rep stosb
18487 movq %r9,%rax
18488 + pax_force_retaddr
18489 ret
18490 .Lmemset_e_e:
18491 .previous
18492 @@ -121,6 +123,7 @@ ENTRY(__memset)
18493
18494 .Lende:
18495 movq %r10,%rax
18496 + pax_force_retaddr
18497 ret
18498
18499 CFI_RESTORE_STATE
18500 diff -urNp linux-3.0.8/arch/x86/lib/mmx_32.c linux-3.0.8/arch/x86/lib/mmx_32.c
18501 --- linux-3.0.8/arch/x86/lib/mmx_32.c 2011-07-21 22:17:23.000000000 -0400
18502 +++ linux-3.0.8/arch/x86/lib/mmx_32.c 2011-08-23 21:47:55.000000000 -0400
18503 @@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
18504 {
18505 void *p;
18506 int i;
18507 + unsigned long cr0;
18508
18509 if (unlikely(in_interrupt()))
18510 return __memcpy(to, from, len);
18511 @@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *
18512 kernel_fpu_begin();
18513
18514 __asm__ __volatile__ (
18515 - "1: prefetch (%0)\n" /* This set is 28 bytes */
18516 - " prefetch 64(%0)\n"
18517 - " prefetch 128(%0)\n"
18518 - " prefetch 192(%0)\n"
18519 - " prefetch 256(%0)\n"
18520 + "1: prefetch (%1)\n" /* This set is 28 bytes */
18521 + " prefetch 64(%1)\n"
18522 + " prefetch 128(%1)\n"
18523 + " prefetch 192(%1)\n"
18524 + " prefetch 256(%1)\n"
18525 "2: \n"
18526 ".section .fixup, \"ax\"\n"
18527 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
18528 + "3: \n"
18529 +
18530 +#ifdef CONFIG_PAX_KERNEXEC
18531 + " movl %%cr0, %0\n"
18532 + " movl %0, %%eax\n"
18533 + " andl $0xFFFEFFFF, %%eax\n"
18534 + " movl %%eax, %%cr0\n"
18535 +#endif
18536 +
18537 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
18538 +
18539 +#ifdef CONFIG_PAX_KERNEXEC
18540 + " movl %0, %%cr0\n"
18541 +#endif
18542 +
18543 " jmp 2b\n"
18544 ".previous\n"
18545 _ASM_EXTABLE(1b, 3b)
18546 - : : "r" (from));
18547 + : "=&r" (cr0) : "r" (from) : "ax");
18548
18549 for ( ; i > 5; i--) {
18550 __asm__ __volatile__ (
18551 - "1: prefetch 320(%0)\n"
18552 - "2: movq (%0), %%mm0\n"
18553 - " movq 8(%0), %%mm1\n"
18554 - " movq 16(%0), %%mm2\n"
18555 - " movq 24(%0), %%mm3\n"
18556 - " movq %%mm0, (%1)\n"
18557 - " movq %%mm1, 8(%1)\n"
18558 - " movq %%mm2, 16(%1)\n"
18559 - " movq %%mm3, 24(%1)\n"
18560 - " movq 32(%0), %%mm0\n"
18561 - " movq 40(%0), %%mm1\n"
18562 - " movq 48(%0), %%mm2\n"
18563 - " movq 56(%0), %%mm3\n"
18564 - " movq %%mm0, 32(%1)\n"
18565 - " movq %%mm1, 40(%1)\n"
18566 - " movq %%mm2, 48(%1)\n"
18567 - " movq %%mm3, 56(%1)\n"
18568 + "1: prefetch 320(%1)\n"
18569 + "2: movq (%1), %%mm0\n"
18570 + " movq 8(%1), %%mm1\n"
18571 + " movq 16(%1), %%mm2\n"
18572 + " movq 24(%1), %%mm3\n"
18573 + " movq %%mm0, (%2)\n"
18574 + " movq %%mm1, 8(%2)\n"
18575 + " movq %%mm2, 16(%2)\n"
18576 + " movq %%mm3, 24(%2)\n"
18577 + " movq 32(%1), %%mm0\n"
18578 + " movq 40(%1), %%mm1\n"
18579 + " movq 48(%1), %%mm2\n"
18580 + " movq 56(%1), %%mm3\n"
18581 + " movq %%mm0, 32(%2)\n"
18582 + " movq %%mm1, 40(%2)\n"
18583 + " movq %%mm2, 48(%2)\n"
18584 + " movq %%mm3, 56(%2)\n"
18585 ".section .fixup, \"ax\"\n"
18586 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
18587 + "3:\n"
18588 +
18589 +#ifdef CONFIG_PAX_KERNEXEC
18590 + " movl %%cr0, %0\n"
18591 + " movl %0, %%eax\n"
18592 + " andl $0xFFFEFFFF, %%eax\n"
18593 + " movl %%eax, %%cr0\n"
18594 +#endif
18595 +
18596 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
18597 +
18598 +#ifdef CONFIG_PAX_KERNEXEC
18599 + " movl %0, %%cr0\n"
18600 +#endif
18601 +
18602 " jmp 2b\n"
18603 ".previous\n"
18604 _ASM_EXTABLE(1b, 3b)
18605 - : : "r" (from), "r" (to) : "memory");
18606 + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
18607
18608 from += 64;
18609 to += 64;
18610 @@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
18611 static void fast_copy_page(void *to, void *from)
18612 {
18613 int i;
18614 + unsigned long cr0;
18615
18616 kernel_fpu_begin();
18617
18618 @@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi
18619 * but that is for later. -AV
18620 */
18621 __asm__ __volatile__(
18622 - "1: prefetch (%0)\n"
18623 - " prefetch 64(%0)\n"
18624 - " prefetch 128(%0)\n"
18625 - " prefetch 192(%0)\n"
18626 - " prefetch 256(%0)\n"
18627 + "1: prefetch (%1)\n"
18628 + " prefetch 64(%1)\n"
18629 + " prefetch 128(%1)\n"
18630 + " prefetch 192(%1)\n"
18631 + " prefetch 256(%1)\n"
18632 "2: \n"
18633 ".section .fixup, \"ax\"\n"
18634 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
18635 + "3: \n"
18636 +
18637 +#ifdef CONFIG_PAX_KERNEXEC
18638 + " movl %%cr0, %0\n"
18639 + " movl %0, %%eax\n"
18640 + " andl $0xFFFEFFFF, %%eax\n"
18641 + " movl %%eax, %%cr0\n"
18642 +#endif
18643 +
18644 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
18645 +
18646 +#ifdef CONFIG_PAX_KERNEXEC
18647 + " movl %0, %%cr0\n"
18648 +#endif
18649 +
18650 " jmp 2b\n"
18651 ".previous\n"
18652 - _ASM_EXTABLE(1b, 3b) : : "r" (from));
18653 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
18654
18655 for (i = 0; i < (4096-320)/64; i++) {
18656 __asm__ __volatile__ (
18657 - "1: prefetch 320(%0)\n"
18658 - "2: movq (%0), %%mm0\n"
18659 - " movntq %%mm0, (%1)\n"
18660 - " movq 8(%0), %%mm1\n"
18661 - " movntq %%mm1, 8(%1)\n"
18662 - " movq 16(%0), %%mm2\n"
18663 - " movntq %%mm2, 16(%1)\n"
18664 - " movq 24(%0), %%mm3\n"
18665 - " movntq %%mm3, 24(%1)\n"
18666 - " movq 32(%0), %%mm4\n"
18667 - " movntq %%mm4, 32(%1)\n"
18668 - " movq 40(%0), %%mm5\n"
18669 - " movntq %%mm5, 40(%1)\n"
18670 - " movq 48(%0), %%mm6\n"
18671 - " movntq %%mm6, 48(%1)\n"
18672 - " movq 56(%0), %%mm7\n"
18673 - " movntq %%mm7, 56(%1)\n"
18674 + "1: prefetch 320(%1)\n"
18675 + "2: movq (%1), %%mm0\n"
18676 + " movntq %%mm0, (%2)\n"
18677 + " movq 8(%1), %%mm1\n"
18678 + " movntq %%mm1, 8(%2)\n"
18679 + " movq 16(%1), %%mm2\n"
18680 + " movntq %%mm2, 16(%2)\n"
18681 + " movq 24(%1), %%mm3\n"
18682 + " movntq %%mm3, 24(%2)\n"
18683 + " movq 32(%1), %%mm4\n"
18684 + " movntq %%mm4, 32(%2)\n"
18685 + " movq 40(%1), %%mm5\n"
18686 + " movntq %%mm5, 40(%2)\n"
18687 + " movq 48(%1), %%mm6\n"
18688 + " movntq %%mm6, 48(%2)\n"
18689 + " movq 56(%1), %%mm7\n"
18690 + " movntq %%mm7, 56(%2)\n"
18691 ".section .fixup, \"ax\"\n"
18692 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
18693 + "3:\n"
18694 +
18695 +#ifdef CONFIG_PAX_KERNEXEC
18696 + " movl %%cr0, %0\n"
18697 + " movl %0, %%eax\n"
18698 + " andl $0xFFFEFFFF, %%eax\n"
18699 + " movl %%eax, %%cr0\n"
18700 +#endif
18701 +
18702 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
18703 +
18704 +#ifdef CONFIG_PAX_KERNEXEC
18705 + " movl %0, %%cr0\n"
18706 +#endif
18707 +
18708 " jmp 2b\n"
18709 ".previous\n"
18710 - _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
18711 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
18712
18713 from += 64;
18714 to += 64;
18715 @@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
18716 static void fast_copy_page(void *to, void *from)
18717 {
18718 int i;
18719 + unsigned long cr0;
18720
18721 kernel_fpu_begin();
18722
18723 __asm__ __volatile__ (
18724 - "1: prefetch (%0)\n"
18725 - " prefetch 64(%0)\n"
18726 - " prefetch 128(%0)\n"
18727 - " prefetch 192(%0)\n"
18728 - " prefetch 256(%0)\n"
18729 + "1: prefetch (%1)\n"
18730 + " prefetch 64(%1)\n"
18731 + " prefetch 128(%1)\n"
18732 + " prefetch 192(%1)\n"
18733 + " prefetch 256(%1)\n"
18734 "2: \n"
18735 ".section .fixup, \"ax\"\n"
18736 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
18737 + "3: \n"
18738 +
18739 +#ifdef CONFIG_PAX_KERNEXEC
18740 + " movl %%cr0, %0\n"
18741 + " movl %0, %%eax\n"
18742 + " andl $0xFFFEFFFF, %%eax\n"
18743 + " movl %%eax, %%cr0\n"
18744 +#endif
18745 +
18746 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
18747 +
18748 +#ifdef CONFIG_PAX_KERNEXEC
18749 + " movl %0, %%cr0\n"
18750 +#endif
18751 +
18752 " jmp 2b\n"
18753 ".previous\n"
18754 - _ASM_EXTABLE(1b, 3b) : : "r" (from));
18755 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
18756
18757 for (i = 0; i < 4096/64; i++) {
18758 __asm__ __volatile__ (
18759 - "1: prefetch 320(%0)\n"
18760 - "2: movq (%0), %%mm0\n"
18761 - " movq 8(%0), %%mm1\n"
18762 - " movq 16(%0), %%mm2\n"
18763 - " movq 24(%0), %%mm3\n"
18764 - " movq %%mm0, (%1)\n"
18765 - " movq %%mm1, 8(%1)\n"
18766 - " movq %%mm2, 16(%1)\n"
18767 - " movq %%mm3, 24(%1)\n"
18768 - " movq 32(%0), %%mm0\n"
18769 - " movq 40(%0), %%mm1\n"
18770 - " movq 48(%0), %%mm2\n"
18771 - " movq 56(%0), %%mm3\n"
18772 - " movq %%mm0, 32(%1)\n"
18773 - " movq %%mm1, 40(%1)\n"
18774 - " movq %%mm2, 48(%1)\n"
18775 - " movq %%mm3, 56(%1)\n"
18776 + "1: prefetch 320(%1)\n"
18777 + "2: movq (%1), %%mm0\n"
18778 + " movq 8(%1), %%mm1\n"
18779 + " movq 16(%1), %%mm2\n"
18780 + " movq 24(%1), %%mm3\n"
18781 + " movq %%mm0, (%2)\n"
18782 + " movq %%mm1, 8(%2)\n"
18783 + " movq %%mm2, 16(%2)\n"
18784 + " movq %%mm3, 24(%2)\n"
18785 + " movq 32(%1), %%mm0\n"
18786 + " movq 40(%1), %%mm1\n"
18787 + " movq 48(%1), %%mm2\n"
18788 + " movq 56(%1), %%mm3\n"
18789 + " movq %%mm0, 32(%2)\n"
18790 + " movq %%mm1, 40(%2)\n"
18791 + " movq %%mm2, 48(%2)\n"
18792 + " movq %%mm3, 56(%2)\n"
18793 ".section .fixup, \"ax\"\n"
18794 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
18795 + "3:\n"
18796 +
18797 +#ifdef CONFIG_PAX_KERNEXEC
18798 + " movl %%cr0, %0\n"
18799 + " movl %0, %%eax\n"
18800 + " andl $0xFFFEFFFF, %%eax\n"
18801 + " movl %%eax, %%cr0\n"
18802 +#endif
18803 +
18804 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
18805 +
18806 +#ifdef CONFIG_PAX_KERNEXEC
18807 + " movl %0, %%cr0\n"
18808 +#endif
18809 +
18810 " jmp 2b\n"
18811 ".previous\n"
18812 _ASM_EXTABLE(1b, 3b)
18813 - : : "r" (from), "r" (to) : "memory");
18814 + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
18815
18816 from += 64;
18817 to += 64;
18818 diff -urNp linux-3.0.8/arch/x86/lib/msr-reg.S linux-3.0.8/arch/x86/lib/msr-reg.S
18819 --- linux-3.0.8/arch/x86/lib/msr-reg.S 2011-07-21 22:17:23.000000000 -0400
18820 +++ linux-3.0.8/arch/x86/lib/msr-reg.S 2011-10-07 19:07:28.000000000 -0400
18821 @@ -3,6 +3,7 @@
18822 #include <asm/dwarf2.h>
18823 #include <asm/asm.h>
18824 #include <asm/msr.h>
18825 +#include <asm/alternative-asm.h>
18826
18827 #ifdef CONFIG_X86_64
18828 /*
18829 @@ -37,6 +38,7 @@ ENTRY(native_\op\()_safe_regs)
18830 movl %edi, 28(%r10)
18831 popq_cfi %rbp
18832 popq_cfi %rbx
18833 + pax_force_retaddr
18834 ret
18835 3:
18836 CFI_RESTORE_STATE
18837 diff -urNp linux-3.0.8/arch/x86/lib/putuser.S linux-3.0.8/arch/x86/lib/putuser.S
18838 --- linux-3.0.8/arch/x86/lib/putuser.S 2011-07-21 22:17:23.000000000 -0400
18839 +++ linux-3.0.8/arch/x86/lib/putuser.S 2011-10-07 19:07:23.000000000 -0400
18840 @@ -15,7 +15,9 @@
18841 #include <asm/thread_info.h>
18842 #include <asm/errno.h>
18843 #include <asm/asm.h>
18844 -
18845 +#include <asm/segment.h>
18846 +#include <asm/pgtable.h>
18847 +#include <asm/alternative-asm.h>
18848
18849 /*
18850 * __put_user_X
18851 @@ -29,52 +31,119 @@
18852 * as they get called from within inline assembly.
18853 */
18854
18855 -#define ENTER CFI_STARTPROC ; \
18856 - GET_THREAD_INFO(%_ASM_BX)
18857 -#define EXIT ret ; \
18858 +#define ENTER CFI_STARTPROC
18859 +#define EXIT pax_force_retaddr; ret ; \
18860 CFI_ENDPROC
18861
18862 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
18863 +#define _DEST %_ASM_CX,%_ASM_BX
18864 +#else
18865 +#define _DEST %_ASM_CX
18866 +#endif
18867 +
18868 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18869 +#define __copyuser_seg gs;
18870 +#else
18871 +#define __copyuser_seg
18872 +#endif
18873 +
18874 .text
18875 ENTRY(__put_user_1)
18876 ENTER
18877 +
18878 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
18879 + GET_THREAD_INFO(%_ASM_BX)
18880 cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
18881 jae bad_put_user
18882 -1: movb %al,(%_ASM_CX)
18883 +
18884 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
18885 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
18886 + cmp %_ASM_BX,%_ASM_CX
18887 + jb 1234f
18888 + xor %ebx,%ebx
18889 +1234:
18890 +#endif
18891 +
18892 +#endif
18893 +
18894 +1: __copyuser_seg movb %al,(_DEST)
18895 xor %eax,%eax
18896 EXIT
18897 ENDPROC(__put_user_1)
18898
18899 ENTRY(__put_user_2)
18900 ENTER
18901 +
18902 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
18903 + GET_THREAD_INFO(%_ASM_BX)
18904 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
18905 sub $1,%_ASM_BX
18906 cmp %_ASM_BX,%_ASM_CX
18907 jae bad_put_user
18908 -2: movw %ax,(%_ASM_CX)
18909 +
18910 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
18911 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
18912 + cmp %_ASM_BX,%_ASM_CX
18913 + jb 1234f
18914 + xor %ebx,%ebx
18915 +1234:
18916 +#endif
18917 +
18918 +#endif
18919 +
18920 +2: __copyuser_seg movw %ax,(_DEST)
18921 xor %eax,%eax
18922 EXIT
18923 ENDPROC(__put_user_2)
18924
18925 ENTRY(__put_user_4)
18926 ENTER
18927 +
18928 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
18929 + GET_THREAD_INFO(%_ASM_BX)
18930 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
18931 sub $3,%_ASM_BX
18932 cmp %_ASM_BX,%_ASM_CX
18933 jae bad_put_user
18934 -3: movl %eax,(%_ASM_CX)
18935 +
18936 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
18937 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
18938 + cmp %_ASM_BX,%_ASM_CX
18939 + jb 1234f
18940 + xor %ebx,%ebx
18941 +1234:
18942 +#endif
18943 +
18944 +#endif
18945 +
18946 +3: __copyuser_seg movl %eax,(_DEST)
18947 xor %eax,%eax
18948 EXIT
18949 ENDPROC(__put_user_4)
18950
18951 ENTRY(__put_user_8)
18952 ENTER
18953 +
18954 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
18955 + GET_THREAD_INFO(%_ASM_BX)
18956 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
18957 sub $7,%_ASM_BX
18958 cmp %_ASM_BX,%_ASM_CX
18959 jae bad_put_user
18960 -4: mov %_ASM_AX,(%_ASM_CX)
18961 +
18962 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
18963 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
18964 + cmp %_ASM_BX,%_ASM_CX
18965 + jb 1234f
18966 + xor %ebx,%ebx
18967 +1234:
18968 +#endif
18969 +
18970 +#endif
18971 +
18972 +4: __copyuser_seg mov %_ASM_AX,(_DEST)
18973 #ifdef CONFIG_X86_32
18974 -5: movl %edx,4(%_ASM_CX)
18975 +5: __copyuser_seg movl %edx,4(_DEST)
18976 #endif
18977 xor %eax,%eax
18978 EXIT
18979 diff -urNp linux-3.0.8/arch/x86/lib/rwlock_64.S linux-3.0.8/arch/x86/lib/rwlock_64.S
18980 --- linux-3.0.8/arch/x86/lib/rwlock_64.S 2011-07-21 22:17:23.000000000 -0400
18981 +++ linux-3.0.8/arch/x86/lib/rwlock_64.S 2011-10-06 04:17:55.000000000 -0400
18982 @@ -17,6 +17,7 @@ ENTRY(__write_lock_failed)
18983 LOCK_PREFIX
18984 subl $RW_LOCK_BIAS,(%rdi)
18985 jnz __write_lock_failed
18986 + pax_force_retaddr
18987 ret
18988 CFI_ENDPROC
18989 END(__write_lock_failed)
18990 @@ -33,6 +34,7 @@ ENTRY(__read_lock_failed)
18991 LOCK_PREFIX
18992 decl (%rdi)
18993 js __read_lock_failed
18994 + pax_force_retaddr
18995 ret
18996 CFI_ENDPROC
18997 END(__read_lock_failed)
18998 diff -urNp linux-3.0.8/arch/x86/lib/rwsem_64.S linux-3.0.8/arch/x86/lib/rwsem_64.S
18999 --- linux-3.0.8/arch/x86/lib/rwsem_64.S 2011-07-21 22:17:23.000000000 -0400
19000 +++ linux-3.0.8/arch/x86/lib/rwsem_64.S 2011-10-07 10:46:47.000000000 -0400
19001 @@ -51,6 +51,7 @@ ENTRY(call_rwsem_down_read_failed)
19002 popq_cfi %rdx
19003 CFI_RESTORE rdx
19004 restore_common_regs
19005 + pax_force_retaddr
19006 ret
19007 CFI_ENDPROC
19008 ENDPROC(call_rwsem_down_read_failed)
19009 @@ -61,6 +62,7 @@ ENTRY(call_rwsem_down_write_failed)
19010 movq %rax,%rdi
19011 call rwsem_down_write_failed
19012 restore_common_regs
19013 + pax_force_retaddr
19014 ret
19015 CFI_ENDPROC
19016 ENDPROC(call_rwsem_down_write_failed)
19017 @@ -73,7 +75,8 @@ ENTRY(call_rwsem_wake)
19018 movq %rax,%rdi
19019 call rwsem_wake
19020 restore_common_regs
19021 -1: ret
19022 +1: pax_force_retaddr
19023 + ret
19024 CFI_ENDPROC
19025 ENDPROC(call_rwsem_wake)
19026
19027 @@ -88,6 +91,7 @@ ENTRY(call_rwsem_downgrade_wake)
19028 popq_cfi %rdx
19029 CFI_RESTORE rdx
19030 restore_common_regs
19031 + pax_force_retaddr
19032 ret
19033 CFI_ENDPROC
19034 ENDPROC(call_rwsem_downgrade_wake)
19035 diff -urNp linux-3.0.8/arch/x86/lib/thunk_64.S linux-3.0.8/arch/x86/lib/thunk_64.S
19036 --- linux-3.0.8/arch/x86/lib/thunk_64.S 2011-07-21 22:17:23.000000000 -0400
19037 +++ linux-3.0.8/arch/x86/lib/thunk_64.S 2011-10-06 04:17:55.000000000 -0400
19038 @@ -10,7 +10,8 @@
19039 #include <asm/dwarf2.h>
19040 #include <asm/calling.h>
19041 #include <asm/rwlock.h>
19042 -
19043 + #include <asm/alternative-asm.h>
19044 +
19045 /* rdi: arg1 ... normal C conventions. rax is saved/restored. */
19046 .macro thunk name,func
19047 .globl \name
19048 @@ -50,5 +51,6 @@
19049 SAVE_ARGS
19050 restore:
19051 RESTORE_ARGS
19052 - ret
19053 + pax_force_retaddr
19054 + ret
19055 CFI_ENDPROC
19056 diff -urNp linux-3.0.8/arch/x86/lib/usercopy_32.c linux-3.0.8/arch/x86/lib/usercopy_32.c
19057 --- linux-3.0.8/arch/x86/lib/usercopy_32.c 2011-07-21 22:17:23.000000000 -0400
19058 +++ linux-3.0.8/arch/x86/lib/usercopy_32.c 2011-08-23 21:47:55.000000000 -0400
19059 @@ -43,7 +43,7 @@ do { \
19060 __asm__ __volatile__( \
19061 " testl %1,%1\n" \
19062 " jz 2f\n" \
19063 - "0: lodsb\n" \
19064 + "0: "__copyuser_seg"lodsb\n" \
19065 " stosb\n" \
19066 " testb %%al,%%al\n" \
19067 " jz 1f\n" \
19068 @@ -128,10 +128,12 @@ do { \
19069 int __d0; \
19070 might_fault(); \
19071 __asm__ __volatile__( \
19072 + __COPYUSER_SET_ES \
19073 "0: rep; stosl\n" \
19074 " movl %2,%0\n" \
19075 "1: rep; stosb\n" \
19076 "2:\n" \
19077 + __COPYUSER_RESTORE_ES \
19078 ".section .fixup,\"ax\"\n" \
19079 "3: lea 0(%2,%0,4),%0\n" \
19080 " jmp 2b\n" \
19081 @@ -200,6 +202,7 @@ long strnlen_user(const char __user *s,
19082 might_fault();
19083
19084 __asm__ __volatile__(
19085 + __COPYUSER_SET_ES
19086 " testl %0, %0\n"
19087 " jz 3f\n"
19088 " andl %0,%%ecx\n"
19089 @@ -208,6 +211,7 @@ long strnlen_user(const char __user *s,
19090 " subl %%ecx,%0\n"
19091 " addl %0,%%eax\n"
19092 "1:\n"
19093 + __COPYUSER_RESTORE_ES
19094 ".section .fixup,\"ax\"\n"
19095 "2: xorl %%eax,%%eax\n"
19096 " jmp 1b\n"
19097 @@ -227,7 +231,7 @@ EXPORT_SYMBOL(strnlen_user);
19098
19099 #ifdef CONFIG_X86_INTEL_USERCOPY
19100 static unsigned long
19101 -__copy_user_intel(void __user *to, const void *from, unsigned long size)
19102 +__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
19103 {
19104 int d0, d1;
19105 __asm__ __volatile__(
19106 @@ -239,36 +243,36 @@ __copy_user_intel(void __user *to, const
19107 " .align 2,0x90\n"
19108 "3: movl 0(%4), %%eax\n"
19109 "4: movl 4(%4), %%edx\n"
19110 - "5: movl %%eax, 0(%3)\n"
19111 - "6: movl %%edx, 4(%3)\n"
19112 + "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
19113 + "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
19114 "7: movl 8(%4), %%eax\n"
19115 "8: movl 12(%4),%%edx\n"
19116 - "9: movl %%eax, 8(%3)\n"
19117 - "10: movl %%edx, 12(%3)\n"
19118 + "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
19119 + "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
19120 "11: movl 16(%4), %%eax\n"
19121 "12: movl 20(%4), %%edx\n"
19122 - "13: movl %%eax, 16(%3)\n"
19123 - "14: movl %%edx, 20(%3)\n"
19124 + "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
19125 + "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
19126 "15: movl 24(%4), %%eax\n"
19127 "16: movl 28(%4), %%edx\n"
19128 - "17: movl %%eax, 24(%3)\n"
19129 - "18: movl %%edx, 28(%3)\n"
19130 + "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
19131 + "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
19132 "19: movl 32(%4), %%eax\n"
19133 "20: movl 36(%4), %%edx\n"
19134 - "21: movl %%eax, 32(%3)\n"
19135 - "22: movl %%edx, 36(%3)\n"
19136 + "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
19137 + "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
19138 "23: movl 40(%4), %%eax\n"
19139 "24: movl 44(%4), %%edx\n"
19140 - "25: movl %%eax, 40(%3)\n"
19141 - "26: movl %%edx, 44(%3)\n"
19142 + "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
19143 + "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
19144 "27: movl 48(%4), %%eax\n"
19145 "28: movl 52(%4), %%edx\n"
19146 - "29: movl %%eax, 48(%3)\n"
19147 - "30: movl %%edx, 52(%3)\n"
19148 + "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
19149 + "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
19150 "31: movl 56(%4), %%eax\n"
19151 "32: movl 60(%4), %%edx\n"
19152 - "33: movl %%eax, 56(%3)\n"
19153 - "34: movl %%edx, 60(%3)\n"
19154 + "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
19155 + "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
19156 " addl $-64, %0\n"
19157 " addl $64, %4\n"
19158 " addl $64, %3\n"
19159 @@ -278,10 +282,119 @@ __copy_user_intel(void __user *to, const
19160 " shrl $2, %0\n"
19161 " andl $3, %%eax\n"
19162 " cld\n"
19163 + __COPYUSER_SET_ES
19164 "99: rep; movsl\n"
19165 "36: movl %%eax, %0\n"
19166 "37: rep; movsb\n"
19167 "100:\n"
19168 + __COPYUSER_RESTORE_ES
19169 + ".section .fixup,\"ax\"\n"
19170 + "101: lea 0(%%eax,%0,4),%0\n"
19171 + " jmp 100b\n"
19172 + ".previous\n"
19173 + ".section __ex_table,\"a\"\n"
19174 + " .align 4\n"
19175 + " .long 1b,100b\n"
19176 + " .long 2b,100b\n"
19177 + " .long 3b,100b\n"
19178 + " .long 4b,100b\n"
19179 + " .long 5b,100b\n"
19180 + " .long 6b,100b\n"
19181 + " .long 7b,100b\n"
19182 + " .long 8b,100b\n"
19183 + " .long 9b,100b\n"
19184 + " .long 10b,100b\n"
19185 + " .long 11b,100b\n"
19186 + " .long 12b,100b\n"
19187 + " .long 13b,100b\n"
19188 + " .long 14b,100b\n"
19189 + " .long 15b,100b\n"
19190 + " .long 16b,100b\n"
19191 + " .long 17b,100b\n"
19192 + " .long 18b,100b\n"
19193 + " .long 19b,100b\n"
19194 + " .long 20b,100b\n"
19195 + " .long 21b,100b\n"
19196 + " .long 22b,100b\n"
19197 + " .long 23b,100b\n"
19198 + " .long 24b,100b\n"
19199 + " .long 25b,100b\n"
19200 + " .long 26b,100b\n"
19201 + " .long 27b,100b\n"
19202 + " .long 28b,100b\n"
19203 + " .long 29b,100b\n"
19204 + " .long 30b,100b\n"
19205 + " .long 31b,100b\n"
19206 + " .long 32b,100b\n"
19207 + " .long 33b,100b\n"
19208 + " .long 34b,100b\n"
19209 + " .long 35b,100b\n"
19210 + " .long 36b,100b\n"
19211 + " .long 37b,100b\n"
19212 + " .long 99b,101b\n"
19213 + ".previous"
19214 + : "=&c"(size), "=&D" (d0), "=&S" (d1)
19215 + : "1"(to), "2"(from), "0"(size)
19216 + : "eax", "edx", "memory");
19217 + return size;
19218 +}
19219 +
19220 +static unsigned long
19221 +__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
19222 +{
19223 + int d0, d1;
19224 + __asm__ __volatile__(
19225 + " .align 2,0x90\n"
19226 + "1: "__copyuser_seg" movl 32(%4), %%eax\n"
19227 + " cmpl $67, %0\n"
19228 + " jbe 3f\n"
19229 + "2: "__copyuser_seg" movl 64(%4), %%eax\n"
19230 + " .align 2,0x90\n"
19231 + "3: "__copyuser_seg" movl 0(%4), %%eax\n"
19232 + "4: "__copyuser_seg" movl 4(%4), %%edx\n"
19233 + "5: movl %%eax, 0(%3)\n"
19234 + "6: movl %%edx, 4(%3)\n"
19235 + "7: "__copyuser_seg" movl 8(%4), %%eax\n"
19236 + "8: "__copyuser_seg" movl 12(%4),%%edx\n"
19237 + "9: movl %%eax, 8(%3)\n"
19238 + "10: movl %%edx, 12(%3)\n"
19239 + "11: "__copyuser_seg" movl 16(%4), %%eax\n"
19240 + "12: "__copyuser_seg" movl 20(%4), %%edx\n"
19241 + "13: movl %%eax, 16(%3)\n"
19242 + "14: movl %%edx, 20(%3)\n"
19243 + "15: "__copyuser_seg" movl 24(%4), %%eax\n"
19244 + "16: "__copyuser_seg" movl 28(%4), %%edx\n"
19245 + "17: movl %%eax, 24(%3)\n"
19246 + "18: movl %%edx, 28(%3)\n"
19247 + "19: "__copyuser_seg" movl 32(%4), %%eax\n"
19248 + "20: "__copyuser_seg" movl 36(%4), %%edx\n"
19249 + "21: movl %%eax, 32(%3)\n"
19250 + "22: movl %%edx, 36(%3)\n"
19251 + "23: "__copyuser_seg" movl 40(%4), %%eax\n"
19252 + "24: "__copyuser_seg" movl 44(%4), %%edx\n"
19253 + "25: movl %%eax, 40(%3)\n"
19254 + "26: movl %%edx, 44(%3)\n"
19255 + "27: "__copyuser_seg" movl 48(%4), %%eax\n"
19256 + "28: "__copyuser_seg" movl 52(%4), %%edx\n"
19257 + "29: movl %%eax, 48(%3)\n"
19258 + "30: movl %%edx, 52(%3)\n"
19259 + "31: "__copyuser_seg" movl 56(%4), %%eax\n"
19260 + "32: "__copyuser_seg" movl 60(%4), %%edx\n"
19261 + "33: movl %%eax, 56(%3)\n"
19262 + "34: movl %%edx, 60(%3)\n"
19263 + " addl $-64, %0\n"
19264 + " addl $64, %4\n"
19265 + " addl $64, %3\n"
19266 + " cmpl $63, %0\n"
19267 + " ja 1b\n"
19268 + "35: movl %0, %%eax\n"
19269 + " shrl $2, %0\n"
19270 + " andl $3, %%eax\n"
19271 + " cld\n"
19272 + "99: rep; "__copyuser_seg" movsl\n"
19273 + "36: movl %%eax, %0\n"
19274 + "37: rep; "__copyuser_seg" movsb\n"
19275 + "100:\n"
19276 ".section .fixup,\"ax\"\n"
19277 "101: lea 0(%%eax,%0,4),%0\n"
19278 " jmp 100b\n"
19279 @@ -339,41 +452,41 @@ __copy_user_zeroing_intel(void *to, cons
19280 int d0, d1;
19281 __asm__ __volatile__(
19282 " .align 2,0x90\n"
19283 - "0: movl 32(%4), %%eax\n"
19284 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
19285 " cmpl $67, %0\n"
19286 " jbe 2f\n"
19287 - "1: movl 64(%4), %%eax\n"
19288 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
19289 " .align 2,0x90\n"
19290 - "2: movl 0(%4), %%eax\n"
19291 - "21: movl 4(%4), %%edx\n"
19292 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
19293 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
19294 " movl %%eax, 0(%3)\n"
19295 " movl %%edx, 4(%3)\n"
19296 - "3: movl 8(%4), %%eax\n"
19297 - "31: movl 12(%4),%%edx\n"
19298 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
19299 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
19300 " movl %%eax, 8(%3)\n"
19301 " movl %%edx, 12(%3)\n"
19302 - "4: movl 16(%4), %%eax\n"
19303 - "41: movl 20(%4), %%edx\n"
19304 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
19305 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
19306 " movl %%eax, 16(%3)\n"
19307 " movl %%edx, 20(%3)\n"
19308 - "10: movl 24(%4), %%eax\n"
19309 - "51: movl 28(%4), %%edx\n"
19310 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
19311 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
19312 " movl %%eax, 24(%3)\n"
19313 " movl %%edx, 28(%3)\n"
19314 - "11: movl 32(%4), %%eax\n"
19315 - "61: movl 36(%4), %%edx\n"
19316 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
19317 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
19318 " movl %%eax, 32(%3)\n"
19319 " movl %%edx, 36(%3)\n"
19320 - "12: movl 40(%4), %%eax\n"
19321 - "71: movl 44(%4), %%edx\n"
19322 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
19323 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
19324 " movl %%eax, 40(%3)\n"
19325 " movl %%edx, 44(%3)\n"
19326 - "13: movl 48(%4), %%eax\n"
19327 - "81: movl 52(%4), %%edx\n"
19328 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
19329 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
19330 " movl %%eax, 48(%3)\n"
19331 " movl %%edx, 52(%3)\n"
19332 - "14: movl 56(%4), %%eax\n"
19333 - "91: movl 60(%4), %%edx\n"
19334 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
19335 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
19336 " movl %%eax, 56(%3)\n"
19337 " movl %%edx, 60(%3)\n"
19338 " addl $-64, %0\n"
19339 @@ -385,9 +498,9 @@ __copy_user_zeroing_intel(void *to, cons
19340 " shrl $2, %0\n"
19341 " andl $3, %%eax\n"
19342 " cld\n"
19343 - "6: rep; movsl\n"
19344 + "6: rep; "__copyuser_seg" movsl\n"
19345 " movl %%eax,%0\n"
19346 - "7: rep; movsb\n"
19347 + "7: rep; "__copyuser_seg" movsb\n"
19348 "8:\n"
19349 ".section .fixup,\"ax\"\n"
19350 "9: lea 0(%%eax,%0,4),%0\n"
19351 @@ -440,41 +553,41 @@ static unsigned long __copy_user_zeroing
19352
19353 __asm__ __volatile__(
19354 " .align 2,0x90\n"
19355 - "0: movl 32(%4), %%eax\n"
19356 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
19357 " cmpl $67, %0\n"
19358 " jbe 2f\n"
19359 - "1: movl 64(%4), %%eax\n"
19360 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
19361 " .align 2,0x90\n"
19362 - "2: movl 0(%4), %%eax\n"
19363 - "21: movl 4(%4), %%edx\n"
19364 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
19365 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
19366 " movnti %%eax, 0(%3)\n"
19367 " movnti %%edx, 4(%3)\n"
19368 - "3: movl 8(%4), %%eax\n"
19369 - "31: movl 12(%4),%%edx\n"
19370 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
19371 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
19372 " movnti %%eax, 8(%3)\n"
19373 " movnti %%edx, 12(%3)\n"
19374 - "4: movl 16(%4), %%eax\n"
19375 - "41: movl 20(%4), %%edx\n"
19376 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
19377 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
19378 " movnti %%eax, 16(%3)\n"
19379 " movnti %%edx, 20(%3)\n"
19380 - "10: movl 24(%4), %%eax\n"
19381 - "51: movl 28(%4), %%edx\n"
19382 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
19383 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
19384 " movnti %%eax, 24(%3)\n"
19385 " movnti %%edx, 28(%3)\n"
19386 - "11: movl 32(%4), %%eax\n"
19387 - "61: movl 36(%4), %%edx\n"
19388 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
19389 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
19390 " movnti %%eax, 32(%3)\n"
19391 " movnti %%edx, 36(%3)\n"
19392 - "12: movl 40(%4), %%eax\n"
19393 - "71: movl 44(%4), %%edx\n"
19394 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
19395 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
19396 " movnti %%eax, 40(%3)\n"
19397 " movnti %%edx, 44(%3)\n"
19398 - "13: movl 48(%4), %%eax\n"
19399 - "81: movl 52(%4), %%edx\n"
19400 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
19401 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
19402 " movnti %%eax, 48(%3)\n"
19403 " movnti %%edx, 52(%3)\n"
19404 - "14: movl 56(%4), %%eax\n"
19405 - "91: movl 60(%4), %%edx\n"
19406 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
19407 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
19408 " movnti %%eax, 56(%3)\n"
19409 " movnti %%edx, 60(%3)\n"
19410 " addl $-64, %0\n"
19411 @@ -487,9 +600,9 @@ static unsigned long __copy_user_zeroing
19412 " shrl $2, %0\n"
19413 " andl $3, %%eax\n"
19414 " cld\n"
19415 - "6: rep; movsl\n"
19416 + "6: rep; "__copyuser_seg" movsl\n"
19417 " movl %%eax,%0\n"
19418 - "7: rep; movsb\n"
19419 + "7: rep; "__copyuser_seg" movsb\n"
19420 "8:\n"
19421 ".section .fixup,\"ax\"\n"
19422 "9: lea 0(%%eax,%0,4),%0\n"
19423 @@ -537,41 +650,41 @@ static unsigned long __copy_user_intel_n
19424
19425 __asm__ __volatile__(
19426 " .align 2,0x90\n"
19427 - "0: movl 32(%4), %%eax\n"
19428 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
19429 " cmpl $67, %0\n"
19430 " jbe 2f\n"
19431 - "1: movl 64(%4), %%eax\n"
19432 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
19433 " .align 2,0x90\n"
19434 - "2: movl 0(%4), %%eax\n"
19435 - "21: movl 4(%4), %%edx\n"
19436 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
19437 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
19438 " movnti %%eax, 0(%3)\n"
19439 " movnti %%edx, 4(%3)\n"
19440 - "3: movl 8(%4), %%eax\n"
19441 - "31: movl 12(%4),%%edx\n"
19442 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
19443 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
19444 " movnti %%eax, 8(%3)\n"
19445 " movnti %%edx, 12(%3)\n"
19446 - "4: movl 16(%4), %%eax\n"
19447 - "41: movl 20(%4), %%edx\n"
19448 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
19449 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
19450 " movnti %%eax, 16(%3)\n"
19451 " movnti %%edx, 20(%3)\n"
19452 - "10: movl 24(%4), %%eax\n"
19453 - "51: movl 28(%4), %%edx\n"
19454 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
19455 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
19456 " movnti %%eax, 24(%3)\n"
19457 " movnti %%edx, 28(%3)\n"
19458 - "11: movl 32(%4), %%eax\n"
19459 - "61: movl 36(%4), %%edx\n"
19460 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
19461 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
19462 " movnti %%eax, 32(%3)\n"
19463 " movnti %%edx, 36(%3)\n"
19464 - "12: movl 40(%4), %%eax\n"
19465 - "71: movl 44(%4), %%edx\n"
19466 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
19467 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
19468 " movnti %%eax, 40(%3)\n"
19469 " movnti %%edx, 44(%3)\n"
19470 - "13: movl 48(%4), %%eax\n"
19471 - "81: movl 52(%4), %%edx\n"
19472 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
19473 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
19474 " movnti %%eax, 48(%3)\n"
19475 " movnti %%edx, 52(%3)\n"
19476 - "14: movl 56(%4), %%eax\n"
19477 - "91: movl 60(%4), %%edx\n"
19478 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
19479 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
19480 " movnti %%eax, 56(%3)\n"
19481 " movnti %%edx, 60(%3)\n"
19482 " addl $-64, %0\n"
19483 @@ -584,9 +697,9 @@ static unsigned long __copy_user_intel_n
19484 " shrl $2, %0\n"
19485 " andl $3, %%eax\n"
19486 " cld\n"
19487 - "6: rep; movsl\n"
19488 + "6: rep; "__copyuser_seg" movsl\n"
19489 " movl %%eax,%0\n"
19490 - "7: rep; movsb\n"
19491 + "7: rep; "__copyuser_seg" movsb\n"
19492 "8:\n"
19493 ".section .fixup,\"ax\"\n"
19494 "9: lea 0(%%eax,%0,4),%0\n"
19495 @@ -629,32 +742,36 @@ static unsigned long __copy_user_intel_n
19496 */
19497 unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
19498 unsigned long size);
19499 -unsigned long __copy_user_intel(void __user *to, const void *from,
19500 +unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
19501 + unsigned long size);
19502 +unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
19503 unsigned long size);
19504 unsigned long __copy_user_zeroing_intel_nocache(void *to,
19505 const void __user *from, unsigned long size);
19506 #endif /* CONFIG_X86_INTEL_USERCOPY */
19507
19508 /* Generic arbitrary sized copy. */
19509 -#define __copy_user(to, from, size) \
19510 +#define __copy_user(to, from, size, prefix, set, restore) \
19511 do { \
19512 int __d0, __d1, __d2; \
19513 __asm__ __volatile__( \
19514 + set \
19515 " cmp $7,%0\n" \
19516 " jbe 1f\n" \
19517 " movl %1,%0\n" \
19518 " negl %0\n" \
19519 " andl $7,%0\n" \
19520 " subl %0,%3\n" \
19521 - "4: rep; movsb\n" \
19522 + "4: rep; "prefix"movsb\n" \
19523 " movl %3,%0\n" \
19524 " shrl $2,%0\n" \
19525 " andl $3,%3\n" \
19526 " .align 2,0x90\n" \
19527 - "0: rep; movsl\n" \
19528 + "0: rep; "prefix"movsl\n" \
19529 " movl %3,%0\n" \
19530 - "1: rep; movsb\n" \
19531 + "1: rep; "prefix"movsb\n" \
19532 "2:\n" \
19533 + restore \
19534 ".section .fixup,\"ax\"\n" \
19535 "5: addl %3,%0\n" \
19536 " jmp 2b\n" \
19537 @@ -682,14 +799,14 @@ do { \
19538 " negl %0\n" \
19539 " andl $7,%0\n" \
19540 " subl %0,%3\n" \
19541 - "4: rep; movsb\n" \
19542 + "4: rep; "__copyuser_seg"movsb\n" \
19543 " movl %3,%0\n" \
19544 " shrl $2,%0\n" \
19545 " andl $3,%3\n" \
19546 " .align 2,0x90\n" \
19547 - "0: rep; movsl\n" \
19548 + "0: rep; "__copyuser_seg"movsl\n" \
19549 " movl %3,%0\n" \
19550 - "1: rep; movsb\n" \
19551 + "1: rep; "__copyuser_seg"movsb\n" \
19552 "2:\n" \
19553 ".section .fixup,\"ax\"\n" \
19554 "5: addl %3,%0\n" \
19555 @@ -775,9 +892,9 @@ survive:
19556 }
19557 #endif
19558 if (movsl_is_ok(to, from, n))
19559 - __copy_user(to, from, n);
19560 + __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
19561 else
19562 - n = __copy_user_intel(to, from, n);
19563 + n = __generic_copy_to_user_intel(to, from, n);
19564 return n;
19565 }
19566 EXPORT_SYMBOL(__copy_to_user_ll);
19567 @@ -797,10 +914,9 @@ unsigned long __copy_from_user_ll_nozero
19568 unsigned long n)
19569 {
19570 if (movsl_is_ok(to, from, n))
19571 - __copy_user(to, from, n);
19572 + __copy_user(to, from, n, __copyuser_seg, "", "");
19573 else
19574 - n = __copy_user_intel((void __user *)to,
19575 - (const void *)from, n);
19576 + n = __generic_copy_from_user_intel(to, from, n);
19577 return n;
19578 }
19579 EXPORT_SYMBOL(__copy_from_user_ll_nozero);
19580 @@ -827,65 +943,50 @@ unsigned long __copy_from_user_ll_nocach
19581 if (n > 64 && cpu_has_xmm2)
19582 n = __copy_user_intel_nocache(to, from, n);
19583 else
19584 - __copy_user(to, from, n);
19585 + __copy_user(to, from, n, __copyuser_seg, "", "");
19586 #else
19587 - __copy_user(to, from, n);
19588 + __copy_user(to, from, n, __copyuser_seg, "", "");
19589 #endif
19590 return n;
19591 }
19592 EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
19593
19594 -/**
19595 - * copy_to_user: - Copy a block of data into user space.
19596 - * @to: Destination address, in user space.
19597 - * @from: Source address, in kernel space.
19598 - * @n: Number of bytes to copy.
19599 - *
19600 - * Context: User context only. This function may sleep.
19601 - *
19602 - * Copy data from kernel space to user space.
19603 - *
19604 - * Returns number of bytes that could not be copied.
19605 - * On success, this will be zero.
19606 - */
19607 -unsigned long
19608 -copy_to_user(void __user *to, const void *from, unsigned long n)
19609 +void copy_from_user_overflow(void)
19610 {
19611 - if (access_ok(VERIFY_WRITE, to, n))
19612 - n = __copy_to_user(to, from, n);
19613 - return n;
19614 + WARN(1, "Buffer overflow detected!\n");
19615 }
19616 -EXPORT_SYMBOL(copy_to_user);
19617 +EXPORT_SYMBOL(copy_from_user_overflow);
19618
19619 -/**
19620 - * copy_from_user: - Copy a block of data from user space.
19621 - * @to: Destination address, in kernel space.
19622 - * @from: Source address, in user space.
19623 - * @n: Number of bytes to copy.
19624 - *
19625 - * Context: User context only. This function may sleep.
19626 - *
19627 - * Copy data from user space to kernel space.
19628 - *
19629 - * Returns number of bytes that could not be copied.
19630 - * On success, this will be zero.
19631 - *
19632 - * If some data could not be copied, this function will pad the copied
19633 - * data to the requested size using zero bytes.
19634 - */
19635 -unsigned long
19636 -_copy_from_user(void *to, const void __user *from, unsigned long n)
19637 +void copy_to_user_overflow(void)
19638 {
19639 - if (access_ok(VERIFY_READ, from, n))
19640 - n = __copy_from_user(to, from, n);
19641 - else
19642 - memset(to, 0, n);
19643 - return n;
19644 + WARN(1, "Buffer overflow detected!\n");
19645 }
19646 -EXPORT_SYMBOL(_copy_from_user);
19647 +EXPORT_SYMBOL(copy_to_user_overflow);
19648
19649 -void copy_from_user_overflow(void)
19650 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19651 +void __set_fs(mm_segment_t x)
19652 {
19653 - WARN(1, "Buffer overflow detected!\n");
19654 + switch (x.seg) {
19655 + case 0:
19656 + loadsegment(gs, 0);
19657 + break;
19658 + case TASK_SIZE_MAX:
19659 + loadsegment(gs, __USER_DS);
19660 + break;
19661 + case -1UL:
19662 + loadsegment(gs, __KERNEL_DS);
19663 + break;
19664 + default:
19665 + BUG();
19666 + }
19667 + return;
19668 }
19669 -EXPORT_SYMBOL(copy_from_user_overflow);
19670 +EXPORT_SYMBOL(__set_fs);
19671 +
19672 +void set_fs(mm_segment_t x)
19673 +{
19674 + current_thread_info()->addr_limit = x;
19675 + __set_fs(x);
19676 +}
19677 +EXPORT_SYMBOL(set_fs);
19678 +#endif
19679 diff -urNp linux-3.0.8/arch/x86/lib/usercopy_64.c linux-3.0.8/arch/x86/lib/usercopy_64.c
19680 --- linux-3.0.8/arch/x86/lib/usercopy_64.c 2011-07-21 22:17:23.000000000 -0400
19681 +++ linux-3.0.8/arch/x86/lib/usercopy_64.c 2011-10-06 04:17:55.000000000 -0400
19682 @@ -42,6 +42,12 @@ long
19683 __strncpy_from_user(char *dst, const char __user *src, long count)
19684 {
19685 long res;
19686 +
19687 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19688 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
19689 + src += PAX_USER_SHADOW_BASE;
19690 +#endif
19691 +
19692 __do_strncpy_from_user(dst, src, count, res);
19693 return res;
19694 }
19695 @@ -65,6 +71,12 @@ unsigned long __clear_user(void __user *
19696 {
19697 long __d0;
19698 might_fault();
19699 +
19700 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19701 + if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
19702 + addr += PAX_USER_SHADOW_BASE;
19703 +#endif
19704 +
19705 /* no memory constraint because it doesn't change any memory gcc knows
19706 about */
19707 asm volatile(
19708 @@ -151,10 +163,18 @@ EXPORT_SYMBOL(strlen_user);
19709
19710 unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
19711 {
19712 - if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
19713 - return copy_user_generic((__force void *)to, (__force void *)from, len);
19714 - }
19715 - return len;
19716 + if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
19717 +
19718 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19719 + if ((unsigned long)to < PAX_USER_SHADOW_BASE)
19720 + to += PAX_USER_SHADOW_BASE;
19721 + if ((unsigned long)from < PAX_USER_SHADOW_BASE)
19722 + from += PAX_USER_SHADOW_BASE;
19723 +#endif
19724 +
19725 + return copy_user_generic((void __force_kernel *)to, (void __force_kernel *)from, len);
19726 + }
19727 + return len;
19728 }
19729 EXPORT_SYMBOL(copy_in_user);
19730
19731 @@ -164,7 +184,7 @@ EXPORT_SYMBOL(copy_in_user);
19732 * it is not necessary to optimize tail handling.
19733 */
19734 unsigned long
19735 -copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
19736 +copy_user_handle_tail(char __user *to, char __user *from, unsigned len, unsigned zerorest)
19737 {
19738 char c;
19739 unsigned zero_len;
19740 diff -urNp linux-3.0.8/arch/x86/Makefile linux-3.0.8/arch/x86/Makefile
19741 --- linux-3.0.8/arch/x86/Makefile 2011-07-21 22:17:23.000000000 -0400
19742 +++ linux-3.0.8/arch/x86/Makefile 2011-08-23 21:48:14.000000000 -0400
19743 @@ -44,6 +44,7 @@ ifeq ($(CONFIG_X86_32),y)
19744 else
19745 BITS := 64
19746 UTS_MACHINE := x86_64
19747 + biarch := $(call cc-option,-m64)
19748 CHECKFLAGS += -D__x86_64__ -m64
19749
19750 KBUILD_AFLAGS += -m64
19751 @@ -195,3 +196,12 @@ define archhelp
19752 echo ' FDARGS="..." arguments for the booted kernel'
19753 echo ' FDINITRD=file initrd for the booted kernel'
19754 endef
19755 +
19756 +define OLD_LD
19757 +
19758 +*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
19759 +*** Please upgrade your binutils to 2.18 or newer
19760 +endef
19761 +
19762 +archprepare:
19763 + $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
19764 diff -urNp linux-3.0.8/arch/x86/mm/extable.c linux-3.0.8/arch/x86/mm/extable.c
19765 --- linux-3.0.8/arch/x86/mm/extable.c 2011-07-21 22:17:23.000000000 -0400
19766 +++ linux-3.0.8/arch/x86/mm/extable.c 2011-08-23 21:47:55.000000000 -0400
19767 @@ -8,7 +8,7 @@ int fixup_exception(struct pt_regs *regs
19768 const struct exception_table_entry *fixup;
19769
19770 #ifdef CONFIG_PNPBIOS
19771 - if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
19772 + if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
19773 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
19774 extern u32 pnp_bios_is_utter_crap;
19775 pnp_bios_is_utter_crap = 1;
19776 diff -urNp linux-3.0.8/arch/x86/mm/fault.c linux-3.0.8/arch/x86/mm/fault.c
19777 --- linux-3.0.8/arch/x86/mm/fault.c 2011-07-21 22:17:23.000000000 -0400
19778 +++ linux-3.0.8/arch/x86/mm/fault.c 2011-10-06 04:17:55.000000000 -0400
19779 @@ -13,10 +13,18 @@
19780 #include <linux/perf_event.h> /* perf_sw_event */
19781 #include <linux/hugetlb.h> /* hstate_index_to_shift */
19782 #include <linux/prefetch.h> /* prefetchw */
19783 +#include <linux/unistd.h>
19784 +#include <linux/compiler.h>
19785
19786 #include <asm/traps.h> /* dotraplinkage, ... */
19787 #include <asm/pgalloc.h> /* pgd_*(), ... */
19788 #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
19789 +#include <asm/vsyscall.h>
19790 +#include <asm/tlbflush.h>
19791 +
19792 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19793 +#include <asm/stacktrace.h>
19794 +#endif
19795
19796 /*
19797 * Page fault error code bits:
19798 @@ -54,7 +62,7 @@ static inline int __kprobes notify_page_
19799 int ret = 0;
19800
19801 /* kprobe_running() needs smp_processor_id() */
19802 - if (kprobes_built_in() && !user_mode_vm(regs)) {
19803 + if (kprobes_built_in() && !user_mode(regs)) {
19804 preempt_disable();
19805 if (kprobe_running() && kprobe_fault_handler(regs, 14))
19806 ret = 1;
19807 @@ -115,7 +123,10 @@ check_prefetch_opcode(struct pt_regs *re
19808 return !instr_lo || (instr_lo>>1) == 1;
19809 case 0x00:
19810 /* Prefetch instruction is 0x0F0D or 0x0F18 */
19811 - if (probe_kernel_address(instr, opcode))
19812 + if (user_mode(regs)) {
19813 + if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
19814 + return 0;
19815 + } else if (probe_kernel_address(instr, opcode))
19816 return 0;
19817
19818 *prefetch = (instr_lo == 0xF) &&
19819 @@ -149,7 +160,10 @@ is_prefetch(struct pt_regs *regs, unsign
19820 while (instr < max_instr) {
19821 unsigned char opcode;
19822
19823 - if (probe_kernel_address(instr, opcode))
19824 + if (user_mode(regs)) {
19825 + if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
19826 + break;
19827 + } else if (probe_kernel_address(instr, opcode))
19828 break;
19829
19830 instr++;
19831 @@ -180,6 +194,30 @@ force_sig_info_fault(int si_signo, int s
19832 force_sig_info(si_signo, &info, tsk);
19833 }
19834
19835 +#ifdef CONFIG_PAX_EMUTRAMP
19836 +static int pax_handle_fetch_fault(struct pt_regs *regs);
19837 +#endif
19838 +
19839 +#ifdef CONFIG_PAX_PAGEEXEC
19840 +static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
19841 +{
19842 + pgd_t *pgd;
19843 + pud_t *pud;
19844 + pmd_t *pmd;
19845 +
19846 + pgd = pgd_offset(mm, address);
19847 + if (!pgd_present(*pgd))
19848 + return NULL;
19849 + pud = pud_offset(pgd, address);
19850 + if (!pud_present(*pud))
19851 + return NULL;
19852 + pmd = pmd_offset(pud, address);
19853 + if (!pmd_present(*pmd))
19854 + return NULL;
19855 + return pmd;
19856 +}
19857 +#endif
19858 +
19859 DEFINE_SPINLOCK(pgd_lock);
19860 LIST_HEAD(pgd_list);
19861
19862 @@ -230,10 +268,22 @@ void vmalloc_sync_all(void)
19863 for (address = VMALLOC_START & PMD_MASK;
19864 address >= TASK_SIZE && address < FIXADDR_TOP;
19865 address += PMD_SIZE) {
19866 +
19867 +#ifdef CONFIG_PAX_PER_CPU_PGD
19868 + unsigned long cpu;
19869 +#else
19870 struct page *page;
19871 +#endif
19872
19873 spin_lock(&pgd_lock);
19874 +
19875 +#ifdef CONFIG_PAX_PER_CPU_PGD
19876 + for (cpu = 0; cpu < NR_CPUS; ++cpu) {
19877 + pgd_t *pgd = get_cpu_pgd(cpu);
19878 + pmd_t *ret;
19879 +#else
19880 list_for_each_entry(page, &pgd_list, lru) {
19881 + pgd_t *pgd = page_address(page);
19882 spinlock_t *pgt_lock;
19883 pmd_t *ret;
19884
19885 @@ -241,8 +291,13 @@ void vmalloc_sync_all(void)
19886 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
19887
19888 spin_lock(pgt_lock);
19889 - ret = vmalloc_sync_one(page_address(page), address);
19890 +#endif
19891 +
19892 + ret = vmalloc_sync_one(pgd, address);
19893 +
19894 +#ifndef CONFIG_PAX_PER_CPU_PGD
19895 spin_unlock(pgt_lock);
19896 +#endif
19897
19898 if (!ret)
19899 break;
19900 @@ -276,6 +331,11 @@ static noinline __kprobes int vmalloc_fa
19901 * an interrupt in the middle of a task switch..
19902 */
19903 pgd_paddr = read_cr3();
19904 +
19905 +#ifdef CONFIG_PAX_PER_CPU_PGD
19906 + BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
19907 +#endif
19908 +
19909 pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
19910 if (!pmd_k)
19911 return -1;
19912 @@ -371,7 +431,14 @@ static noinline __kprobes int vmalloc_fa
19913 * happen within a race in page table update. In the later
19914 * case just flush:
19915 */
19916 +
19917 +#ifdef CONFIG_PAX_PER_CPU_PGD
19918 + BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
19919 + pgd = pgd_offset_cpu(smp_processor_id(), address);
19920 +#else
19921 pgd = pgd_offset(current->active_mm, address);
19922 +#endif
19923 +
19924 pgd_ref = pgd_offset_k(address);
19925 if (pgd_none(*pgd_ref))
19926 return -1;
19927 @@ -533,7 +600,7 @@ static int is_errata93(struct pt_regs *r
19928 static int is_errata100(struct pt_regs *regs, unsigned long address)
19929 {
19930 #ifdef CONFIG_X86_64
19931 - if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
19932 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
19933 return 1;
19934 #endif
19935 return 0;
19936 @@ -560,7 +627,7 @@ static int is_f00f_bug(struct pt_regs *r
19937 }
19938
19939 static const char nx_warning[] = KERN_CRIT
19940 -"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
19941 +"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
19942
19943 static void
19944 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
19945 @@ -569,14 +636,25 @@ show_fault_oops(struct pt_regs *regs, un
19946 if (!oops_may_print())
19947 return;
19948
19949 - if (error_code & PF_INSTR) {
19950 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) {
19951 unsigned int level;
19952
19953 pte_t *pte = lookup_address(address, &level);
19954
19955 if (pte && pte_present(*pte) && !pte_exec(*pte))
19956 - printk(nx_warning, current_uid());
19957 + printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
19958 + }
19959 +
19960 +#ifdef CONFIG_PAX_KERNEXEC
19961 + if (init_mm.start_code <= address && address < init_mm.end_code) {
19962 + if (current->signal->curr_ip)
19963 + printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
19964 + &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
19965 + else
19966 + printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
19967 + current->comm, task_pid_nr(current), current_uid(), current_euid());
19968 }
19969 +#endif
19970
19971 printk(KERN_ALERT "BUG: unable to handle kernel ");
19972 if (address < PAGE_SIZE)
19973 @@ -702,6 +780,66 @@ __bad_area_nosemaphore(struct pt_regs *r
19974 unsigned long address, int si_code)
19975 {
19976 struct task_struct *tsk = current;
19977 +#if defined(CONFIG_X86_64) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
19978 + struct mm_struct *mm = tsk->mm;
19979 +#endif
19980 +
19981 +#ifdef CONFIG_X86_64
19982 + if (mm && (error_code & PF_INSTR) && mm->context.vdso) {
19983 + if (regs->ip == VSYSCALL_ADDR(__NR_vgettimeofday) ||
19984 + regs->ip == VSYSCALL_ADDR(__NR_vtime) ||
19985 + regs->ip == VSYSCALL_ADDR(__NR_vgetcpu)) {
19986 + regs->ip += mm->context.vdso - PAGE_SIZE - VSYSCALL_START;
19987 + return;
19988 + }
19989 + }
19990 +#endif
19991 +
19992 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
19993 + if (mm && (error_code & PF_USER)) {
19994 + unsigned long ip = regs->ip;
19995 +
19996 + if (v8086_mode(regs))
19997 + ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
19998 +
19999 + /*
20000 + * It's possible to have interrupts off here:
20001 + */
20002 + local_irq_enable();
20003 +
20004 +#ifdef CONFIG_PAX_PAGEEXEC
20005 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) &&
20006 + (((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && ip == address))) {
20007 +
20008 +#ifdef CONFIG_PAX_EMUTRAMP
20009 + switch (pax_handle_fetch_fault(regs)) {
20010 + case 2:
20011 + return;
20012 + }
20013 +#endif
20014 +
20015 + pax_report_fault(regs, (void *)ip, (void *)regs->sp);
20016 + do_group_exit(SIGKILL);
20017 + }
20018 +#endif
20019 +
20020 +#ifdef CONFIG_PAX_SEGMEXEC
20021 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address)) {
20022 +
20023 +#ifdef CONFIG_PAX_EMUTRAMP
20024 + switch (pax_handle_fetch_fault(regs)) {
20025 + case 2:
20026 + return;
20027 + }
20028 +#endif
20029 +
20030 + pax_report_fault(regs, (void *)ip, (void *)regs->sp);
20031 + do_group_exit(SIGKILL);
20032 + }
20033 +#endif
20034 +
20035 + }
20036 +#endif
20037
20038 /* User mode accesses just cause a SIGSEGV */
20039 if (error_code & PF_USER) {
20040 @@ -871,6 +1009,99 @@ static int spurious_fault_check(unsigned
20041 return 1;
20042 }
20043
20044 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
20045 +static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
20046 +{
20047 + pte_t *pte;
20048 + pmd_t *pmd;
20049 + spinlock_t *ptl;
20050 + unsigned char pte_mask;
20051 +
20052 + if ((__supported_pte_mask & _PAGE_NX) || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
20053 + !(mm->pax_flags & MF_PAX_PAGEEXEC))
20054 + return 0;
20055 +
20056 + /* PaX: it's our fault, let's handle it if we can */
20057 +
20058 + /* PaX: take a look at read faults before acquiring any locks */
20059 + if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
20060 + /* instruction fetch attempt from a protected page in user mode */
20061 + up_read(&mm->mmap_sem);
20062 +
20063 +#ifdef CONFIG_PAX_EMUTRAMP
20064 + switch (pax_handle_fetch_fault(regs)) {
20065 + case 2:
20066 + return 1;
20067 + }
20068 +#endif
20069 +
20070 + pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
20071 + do_group_exit(SIGKILL);
20072 + }
20073 +
20074 + pmd = pax_get_pmd(mm, address);
20075 + if (unlikely(!pmd))
20076 + return 0;
20077 +
20078 + pte = pte_offset_map_lock(mm, pmd, address, &ptl);
20079 + if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
20080 + pte_unmap_unlock(pte, ptl);
20081 + return 0;
20082 + }
20083 +
20084 + if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
20085 + /* write attempt to a protected page in user mode */
20086 + pte_unmap_unlock(pte, ptl);
20087 + return 0;
20088 + }
20089 +
20090 +#ifdef CONFIG_SMP
20091 + if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
20092 +#else
20093 + if (likely(address > get_limit(regs->cs)))
20094 +#endif
20095 + {
20096 + set_pte(pte, pte_mkread(*pte));
20097 + __flush_tlb_one(address);
20098 + pte_unmap_unlock(pte, ptl);
20099 + up_read(&mm->mmap_sem);
20100 + return 1;
20101 + }
20102 +
20103 + pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
20104 +
20105 + /*
20106 + * PaX: fill DTLB with user rights and retry
20107 + */
20108 + __asm__ __volatile__ (
20109 + "orb %2,(%1)\n"
20110 +#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
20111 +/*
20112 + * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
20113 + * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
20114 + * page fault when examined during a TLB load attempt. this is true not only
20115 + * for PTEs holding a non-present entry but also present entries that will
20116 + * raise a page fault (such as those set up by PaX, or the copy-on-write
20117 + * mechanism). in effect it means that we do *not* need to flush the TLBs
20118 + * for our target pages since their PTEs are simply not in the TLBs at all.
20119 +
20120 + * the best thing in omitting it is that we gain around 15-20% speed in the
20121 + * fast path of the page fault handler and can get rid of tracing since we
20122 + * can no longer flush unintended entries.
20123 + */
20124 + "invlpg (%0)\n"
20125 +#endif
20126 + __copyuser_seg"testb $0,(%0)\n"
20127 + "xorb %3,(%1)\n"
20128 + :
20129 + : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
20130 + : "memory", "cc");
20131 + pte_unmap_unlock(pte, ptl);
20132 + up_read(&mm->mmap_sem);
20133 + return 1;
20134 +}
20135 +#endif
20136 +
20137 /*
20138 * Handle a spurious fault caused by a stale TLB entry.
20139 *
20140 @@ -943,6 +1174,9 @@ int show_unhandled_signals = 1;
20141 static inline int
20142 access_error(unsigned long error_code, struct vm_area_struct *vma)
20143 {
20144 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
20145 + return 1;
20146 +
20147 if (error_code & PF_WRITE) {
20148 /* write, present and write, not present: */
20149 if (unlikely(!(vma->vm_flags & VM_WRITE)))
20150 @@ -976,19 +1210,33 @@ do_page_fault(struct pt_regs *regs, unsi
20151 {
20152 struct vm_area_struct *vma;
20153 struct task_struct *tsk;
20154 - unsigned long address;
20155 struct mm_struct *mm;
20156 int fault;
20157 int write = error_code & PF_WRITE;
20158 unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
20159 (write ? FAULT_FLAG_WRITE : 0);
20160
20161 + /* Get the faulting address: */
20162 + unsigned long address = read_cr2();
20163 +
20164 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20165 + if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
20166 + if (!search_exception_tables(regs->ip)) {
20167 + bad_area_nosemaphore(regs, error_code, address);
20168 + return;
20169 + }
20170 + if (address < PAX_USER_SHADOW_BASE) {
20171 + printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
20172 + printk(KERN_ERR "PAX: faulting IP: %pA\n", (void *)regs->ip);
20173 + show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
20174 + } else
20175 + address -= PAX_USER_SHADOW_BASE;
20176 + }
20177 +#endif
20178 +
20179 tsk = current;
20180 mm = tsk->mm;
20181
20182 - /* Get the faulting address: */
20183 - address = read_cr2();
20184 -
20185 /*
20186 * Detect and handle instructions that would cause a page fault for
20187 * both a tracked kernel page and a userspace page.
20188 @@ -1048,7 +1296,7 @@ do_page_fault(struct pt_regs *regs, unsi
20189 * User-mode registers count as a user access even for any
20190 * potential system fault or CPU buglet:
20191 */
20192 - if (user_mode_vm(regs)) {
20193 + if (user_mode(regs)) {
20194 local_irq_enable();
20195 error_code |= PF_USER;
20196 } else {
20197 @@ -1103,6 +1351,11 @@ retry:
20198 might_sleep();
20199 }
20200
20201 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
20202 + if (pax_handle_pageexec_fault(regs, mm, address, error_code))
20203 + return;
20204 +#endif
20205 +
20206 vma = find_vma(mm, address);
20207 if (unlikely(!vma)) {
20208 bad_area(regs, error_code, address);
20209 @@ -1114,18 +1367,24 @@ retry:
20210 bad_area(regs, error_code, address);
20211 return;
20212 }
20213 - if (error_code & PF_USER) {
20214 - /*
20215 - * Accessing the stack below %sp is always a bug.
20216 - * The large cushion allows instructions like enter
20217 - * and pusha to work. ("enter $65535, $31" pushes
20218 - * 32 pointers and then decrements %sp by 65535.)
20219 - */
20220 - if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
20221 - bad_area(regs, error_code, address);
20222 - return;
20223 - }
20224 + /*
20225 + * Accessing the stack below %sp is always a bug.
20226 + * The large cushion allows instructions like enter
20227 + * and pusha to work. ("enter $65535, $31" pushes
20228 + * 32 pointers and then decrements %sp by 65535.)
20229 + */
20230 + if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
20231 + bad_area(regs, error_code, address);
20232 + return;
20233 }
20234 +
20235 +#ifdef CONFIG_PAX_SEGMEXEC
20236 + if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
20237 + bad_area(regs, error_code, address);
20238 + return;
20239 + }
20240 +#endif
20241 +
20242 if (unlikely(expand_stack(vma, address))) {
20243 bad_area(regs, error_code, address);
20244 return;
20245 @@ -1180,3 +1439,199 @@ good_area:
20246
20247 up_read(&mm->mmap_sem);
20248 }
20249 +
20250 +#ifdef CONFIG_PAX_EMUTRAMP
20251 +static int pax_handle_fetch_fault_32(struct pt_regs *regs)
20252 +{
20253 + int err;
20254 +
20255 + do { /* PaX: gcc trampoline emulation #1 */
20256 + unsigned char mov1, mov2;
20257 + unsigned short jmp;
20258 + unsigned int addr1, addr2;
20259 +
20260 +#ifdef CONFIG_X86_64
20261 + if ((regs->ip + 11) >> 32)
20262 + break;
20263 +#endif
20264 +
20265 + err = get_user(mov1, (unsigned char __user *)regs->ip);
20266 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
20267 + err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
20268 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
20269 + err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
20270 +
20271 + if (err)
20272 + break;
20273 +
20274 + if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
20275 + regs->cx = addr1;
20276 + regs->ax = addr2;
20277 + regs->ip = addr2;
20278 + return 2;
20279 + }
20280 + } while (0);
20281 +
20282 + do { /* PaX: gcc trampoline emulation #2 */
20283 + unsigned char mov, jmp;
20284 + unsigned int addr1, addr2;
20285 +
20286 +#ifdef CONFIG_X86_64
20287 + if ((regs->ip + 9) >> 32)
20288 + break;
20289 +#endif
20290 +
20291 + err = get_user(mov, (unsigned char __user *)regs->ip);
20292 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
20293 + err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
20294 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
20295 +
20296 + if (err)
20297 + break;
20298 +
20299 + if (mov == 0xB9 && jmp == 0xE9) {
20300 + regs->cx = addr1;
20301 + regs->ip = (unsigned int)(regs->ip + addr2 + 10);
20302 + return 2;
20303 + }
20304 + } while (0);
20305 +
20306 + return 1; /* PaX in action */
20307 +}
20308 +
20309 +#ifdef CONFIG_X86_64
20310 +static int pax_handle_fetch_fault_64(struct pt_regs *regs)
20311 +{
20312 + int err;
20313 +
20314 + do { /* PaX: gcc trampoline emulation #1 */
20315 + unsigned short mov1, mov2, jmp1;
20316 + unsigned char jmp2;
20317 + unsigned int addr1;
20318 + unsigned long addr2;
20319 +
20320 + err = get_user(mov1, (unsigned short __user *)regs->ip);
20321 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
20322 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
20323 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
20324 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
20325 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
20326 +
20327 + if (err)
20328 + break;
20329 +
20330 + if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
20331 + regs->r11 = addr1;
20332 + regs->r10 = addr2;
20333 + regs->ip = addr1;
20334 + return 2;
20335 + }
20336 + } while (0);
20337 +
20338 + do { /* PaX: gcc trampoline emulation #2 */
20339 + unsigned short mov1, mov2, jmp1;
20340 + unsigned char jmp2;
20341 + unsigned long addr1, addr2;
20342 +
20343 + err = get_user(mov1, (unsigned short __user *)regs->ip);
20344 + err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
20345 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
20346 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
20347 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
20348 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
20349 +
20350 + if (err)
20351 + break;
20352 +
20353 + if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
20354 + regs->r11 = addr1;
20355 + regs->r10 = addr2;
20356 + regs->ip = addr1;
20357 + return 2;
20358 + }
20359 + } while (0);
20360 +
20361 + return 1; /* PaX in action */
20362 +}
20363 +#endif
20364 +
20365 +/*
20366 + * PaX: decide what to do with offenders (regs->ip = fault address)
20367 + *
20368 + * returns 1 when task should be killed
20369 + * 2 when gcc trampoline was detected
20370 + */
20371 +static int pax_handle_fetch_fault(struct pt_regs *regs)
20372 +{
20373 + if (v8086_mode(regs))
20374 + return 1;
20375 +
20376 + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
20377 + return 1;
20378 +
20379 +#ifdef CONFIG_X86_32
20380 + return pax_handle_fetch_fault_32(regs);
20381 +#else
20382 + if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
20383 + return pax_handle_fetch_fault_32(regs);
20384 + else
20385 + return pax_handle_fetch_fault_64(regs);
20386 +#endif
20387 +}
20388 +#endif
20389 +
20390 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
20391 +void pax_report_insns(void *pc, void *sp)
20392 +{
20393 + long i;
20394 +
20395 + printk(KERN_ERR "PAX: bytes at PC: ");
20396 + for (i = 0; i < 20; i++) {
20397 + unsigned char c;
20398 + if (get_user(c, (unsigned char __force_user *)pc+i))
20399 + printk(KERN_CONT "?? ");
20400 + else
20401 + printk(KERN_CONT "%02x ", c);
20402 + }
20403 + printk("\n");
20404 +
20405 + printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
20406 + for (i = -1; i < 80 / (long)sizeof(long); i++) {
20407 + unsigned long c;
20408 + if (get_user(c, (unsigned long __force_user *)sp+i))
20409 +#ifdef CONFIG_X86_32
20410 + printk(KERN_CONT "???????? ");
20411 +#else
20412 + printk(KERN_CONT "???????????????? ");
20413 +#endif
20414 + else
20415 + printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
20416 + }
20417 + printk("\n");
20418 +}
20419 +#endif
20420 +
20421 +/**
20422 + * probe_kernel_write(): safely attempt to write to a location
20423 + * @dst: address to write to
20424 + * @src: pointer to the data that shall be written
20425 + * @size: size of the data chunk
20426 + *
20427 + * Safely write to address @dst from the buffer at @src. If a kernel fault
20428 + * happens, handle that and return -EFAULT.
20429 + */
20430 +long notrace probe_kernel_write(void *dst, const void *src, size_t size)
20431 +{
20432 + long ret;
20433 + mm_segment_t old_fs = get_fs();
20434 +
20435 + set_fs(KERNEL_DS);
20436 + pagefault_disable();
20437 + pax_open_kernel();
20438 + ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
20439 + pax_close_kernel();
20440 + pagefault_enable();
20441 + set_fs(old_fs);
20442 +
20443 + return ret ? -EFAULT : 0;
20444 +}
20445 diff -urNp linux-3.0.8/arch/x86/mm/gup.c linux-3.0.8/arch/x86/mm/gup.c
20446 --- linux-3.0.8/arch/x86/mm/gup.c 2011-07-21 22:17:23.000000000 -0400
20447 +++ linux-3.0.8/arch/x86/mm/gup.c 2011-08-23 21:47:55.000000000 -0400
20448 @@ -263,7 +263,7 @@ int __get_user_pages_fast(unsigned long
20449 addr = start;
20450 len = (unsigned long) nr_pages << PAGE_SHIFT;
20451 end = start + len;
20452 - if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
20453 + if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
20454 (void __user *)start, len)))
20455 return 0;
20456
20457 diff -urNp linux-3.0.8/arch/x86/mm/highmem_32.c linux-3.0.8/arch/x86/mm/highmem_32.c
20458 --- linux-3.0.8/arch/x86/mm/highmem_32.c 2011-07-21 22:17:23.000000000 -0400
20459 +++ linux-3.0.8/arch/x86/mm/highmem_32.c 2011-08-23 21:47:55.000000000 -0400
20460 @@ -44,7 +44,10 @@ void *kmap_atomic_prot(struct page *page
20461 idx = type + KM_TYPE_NR*smp_processor_id();
20462 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
20463 BUG_ON(!pte_none(*(kmap_pte-idx)));
20464 +
20465 + pax_open_kernel();
20466 set_pte(kmap_pte-idx, mk_pte(page, prot));
20467 + pax_close_kernel();
20468
20469 return (void *)vaddr;
20470 }
20471 diff -urNp linux-3.0.8/arch/x86/mm/hugetlbpage.c linux-3.0.8/arch/x86/mm/hugetlbpage.c
20472 --- linux-3.0.8/arch/x86/mm/hugetlbpage.c 2011-07-21 22:17:23.000000000 -0400
20473 +++ linux-3.0.8/arch/x86/mm/hugetlbpage.c 2011-08-23 21:47:55.000000000 -0400
20474 @@ -266,13 +266,20 @@ static unsigned long hugetlb_get_unmappe
20475 struct hstate *h = hstate_file(file);
20476 struct mm_struct *mm = current->mm;
20477 struct vm_area_struct *vma;
20478 - unsigned long start_addr;
20479 + unsigned long start_addr, pax_task_size = TASK_SIZE;
20480 +
20481 +#ifdef CONFIG_PAX_SEGMEXEC
20482 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
20483 + pax_task_size = SEGMEXEC_TASK_SIZE;
20484 +#endif
20485 +
20486 + pax_task_size -= PAGE_SIZE;
20487
20488 if (len > mm->cached_hole_size) {
20489 - start_addr = mm->free_area_cache;
20490 + start_addr = mm->free_area_cache;
20491 } else {
20492 - start_addr = TASK_UNMAPPED_BASE;
20493 - mm->cached_hole_size = 0;
20494 + start_addr = mm->mmap_base;
20495 + mm->cached_hole_size = 0;
20496 }
20497
20498 full_search:
20499 @@ -280,26 +287,27 @@ full_search:
20500
20501 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
20502 /* At this point: (!vma || addr < vma->vm_end). */
20503 - if (TASK_SIZE - len < addr) {
20504 + if (pax_task_size - len < addr) {
20505 /*
20506 * Start a new search - just in case we missed
20507 * some holes.
20508 */
20509 - if (start_addr != TASK_UNMAPPED_BASE) {
20510 - start_addr = TASK_UNMAPPED_BASE;
20511 + if (start_addr != mm->mmap_base) {
20512 + start_addr = mm->mmap_base;
20513 mm->cached_hole_size = 0;
20514 goto full_search;
20515 }
20516 return -ENOMEM;
20517 }
20518 - if (!vma || addr + len <= vma->vm_start) {
20519 - mm->free_area_cache = addr + len;
20520 - return addr;
20521 - }
20522 + if (check_heap_stack_gap(vma, addr, len))
20523 + break;
20524 if (addr + mm->cached_hole_size < vma->vm_start)
20525 mm->cached_hole_size = vma->vm_start - addr;
20526 addr = ALIGN(vma->vm_end, huge_page_size(h));
20527 }
20528 +
20529 + mm->free_area_cache = addr + len;
20530 + return addr;
20531 }
20532
20533 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
20534 @@ -308,10 +316,9 @@ static unsigned long hugetlb_get_unmappe
20535 {
20536 struct hstate *h = hstate_file(file);
20537 struct mm_struct *mm = current->mm;
20538 - struct vm_area_struct *vma, *prev_vma;
20539 - unsigned long base = mm->mmap_base, addr = addr0;
20540 + struct vm_area_struct *vma;
20541 + unsigned long base = mm->mmap_base, addr;
20542 unsigned long largest_hole = mm->cached_hole_size;
20543 - int first_time = 1;
20544
20545 /* don't allow allocations above current base */
20546 if (mm->free_area_cache > base)
20547 @@ -321,64 +328,63 @@ static unsigned long hugetlb_get_unmappe
20548 largest_hole = 0;
20549 mm->free_area_cache = base;
20550 }
20551 -try_again:
20552 +
20553 /* make sure it can fit in the remaining address space */
20554 if (mm->free_area_cache < len)
20555 goto fail;
20556
20557 /* either no address requested or can't fit in requested address hole */
20558 - addr = (mm->free_area_cache - len) & huge_page_mask(h);
20559 + addr = (mm->free_area_cache - len);
20560 do {
20561 + addr &= huge_page_mask(h);
20562 + vma = find_vma(mm, addr);
20563 /*
20564 * Lookup failure means no vma is above this address,
20565 * i.e. return with success:
20566 - */
20567 - if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
20568 - return addr;
20569 -
20570 - /*
20571 * new region fits between prev_vma->vm_end and
20572 * vma->vm_start, use it:
20573 */
20574 - if (addr + len <= vma->vm_start &&
20575 - (!prev_vma || (addr >= prev_vma->vm_end))) {
20576 + if (check_heap_stack_gap(vma, addr, len)) {
20577 /* remember the address as a hint for next time */
20578 - mm->cached_hole_size = largest_hole;
20579 - return (mm->free_area_cache = addr);
20580 - } else {
20581 - /* pull free_area_cache down to the first hole */
20582 - if (mm->free_area_cache == vma->vm_end) {
20583 - mm->free_area_cache = vma->vm_start;
20584 - mm->cached_hole_size = largest_hole;
20585 - }
20586 + mm->cached_hole_size = largest_hole;
20587 + return (mm->free_area_cache = addr);
20588 + }
20589 + /* pull free_area_cache down to the first hole */
20590 + if (mm->free_area_cache == vma->vm_end) {
20591 + mm->free_area_cache = vma->vm_start;
20592 + mm->cached_hole_size = largest_hole;
20593 }
20594
20595 /* remember the largest hole we saw so far */
20596 if (addr + largest_hole < vma->vm_start)
20597 - largest_hole = vma->vm_start - addr;
20598 + largest_hole = vma->vm_start - addr;
20599
20600 /* try just below the current vma->vm_start */
20601 - addr = (vma->vm_start - len) & huge_page_mask(h);
20602 - } while (len <= vma->vm_start);
20603 + addr = skip_heap_stack_gap(vma, len);
20604 + } while (!IS_ERR_VALUE(addr));
20605
20606 fail:
20607 /*
20608 - * if hint left us with no space for the requested
20609 - * mapping then try again:
20610 - */
20611 - if (first_time) {
20612 - mm->free_area_cache = base;
20613 - largest_hole = 0;
20614 - first_time = 0;
20615 - goto try_again;
20616 - }
20617 - /*
20618 * A failed mmap() very likely causes application failure,
20619 * so fall back to the bottom-up function here. This scenario
20620 * can happen with large stack limits and large mmap()
20621 * allocations.
20622 */
20623 - mm->free_area_cache = TASK_UNMAPPED_BASE;
20624 +
20625 +#ifdef CONFIG_PAX_SEGMEXEC
20626 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
20627 + mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
20628 + else
20629 +#endif
20630 +
20631 + mm->mmap_base = TASK_UNMAPPED_BASE;
20632 +
20633 +#ifdef CONFIG_PAX_RANDMMAP
20634 + if (mm->pax_flags & MF_PAX_RANDMMAP)
20635 + mm->mmap_base += mm->delta_mmap;
20636 +#endif
20637 +
20638 + mm->free_area_cache = mm->mmap_base;
20639 mm->cached_hole_size = ~0UL;
20640 addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
20641 len, pgoff, flags);
20642 @@ -386,6 +392,7 @@ fail:
20643 /*
20644 * Restore the topdown base:
20645 */
20646 + mm->mmap_base = base;
20647 mm->free_area_cache = base;
20648 mm->cached_hole_size = ~0UL;
20649
20650 @@ -399,10 +406,19 @@ hugetlb_get_unmapped_area(struct file *f
20651 struct hstate *h = hstate_file(file);
20652 struct mm_struct *mm = current->mm;
20653 struct vm_area_struct *vma;
20654 + unsigned long pax_task_size = TASK_SIZE;
20655
20656 if (len & ~huge_page_mask(h))
20657 return -EINVAL;
20658 - if (len > TASK_SIZE)
20659 +
20660 +#ifdef CONFIG_PAX_SEGMEXEC
20661 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
20662 + pax_task_size = SEGMEXEC_TASK_SIZE;
20663 +#endif
20664 +
20665 + pax_task_size -= PAGE_SIZE;
20666 +
20667 + if (len > pax_task_size)
20668 return -ENOMEM;
20669
20670 if (flags & MAP_FIXED) {
20671 @@ -414,8 +430,7 @@ hugetlb_get_unmapped_area(struct file *f
20672 if (addr) {
20673 addr = ALIGN(addr, huge_page_size(h));
20674 vma = find_vma(mm, addr);
20675 - if (TASK_SIZE - len >= addr &&
20676 - (!vma || addr + len <= vma->vm_start))
20677 + if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
20678 return addr;
20679 }
20680 if (mm->get_unmapped_area == arch_get_unmapped_area)
20681 diff -urNp linux-3.0.8/arch/x86/mm/init_32.c linux-3.0.8/arch/x86/mm/init_32.c
20682 --- linux-3.0.8/arch/x86/mm/init_32.c 2011-07-21 22:17:23.000000000 -0400
20683 +++ linux-3.0.8/arch/x86/mm/init_32.c 2011-08-23 21:47:55.000000000 -0400
20684 @@ -74,36 +74,6 @@ static __init void *alloc_low_page(void)
20685 }
20686
20687 /*
20688 - * Creates a middle page table and puts a pointer to it in the
20689 - * given global directory entry. This only returns the gd entry
20690 - * in non-PAE compilation mode, since the middle layer is folded.
20691 - */
20692 -static pmd_t * __init one_md_table_init(pgd_t *pgd)
20693 -{
20694 - pud_t *pud;
20695 - pmd_t *pmd_table;
20696 -
20697 -#ifdef CONFIG_X86_PAE
20698 - if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
20699 - if (after_bootmem)
20700 - pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
20701 - else
20702 - pmd_table = (pmd_t *)alloc_low_page();
20703 - paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
20704 - set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
20705 - pud = pud_offset(pgd, 0);
20706 - BUG_ON(pmd_table != pmd_offset(pud, 0));
20707 -
20708 - return pmd_table;
20709 - }
20710 -#endif
20711 - pud = pud_offset(pgd, 0);
20712 - pmd_table = pmd_offset(pud, 0);
20713 -
20714 - return pmd_table;
20715 -}
20716 -
20717 -/*
20718 * Create a page table and place a pointer to it in a middle page
20719 * directory entry:
20720 */
20721 @@ -123,13 +93,28 @@ static pte_t * __init one_page_table_ini
20722 page_table = (pte_t *)alloc_low_page();
20723
20724 paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
20725 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
20726 + set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
20727 +#else
20728 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
20729 +#endif
20730 BUG_ON(page_table != pte_offset_kernel(pmd, 0));
20731 }
20732
20733 return pte_offset_kernel(pmd, 0);
20734 }
20735
20736 +static pmd_t * __init one_md_table_init(pgd_t *pgd)
20737 +{
20738 + pud_t *pud;
20739 + pmd_t *pmd_table;
20740 +
20741 + pud = pud_offset(pgd, 0);
20742 + pmd_table = pmd_offset(pud, 0);
20743 +
20744 + return pmd_table;
20745 +}
20746 +
20747 pmd_t * __init populate_extra_pmd(unsigned long vaddr)
20748 {
20749 int pgd_idx = pgd_index(vaddr);
20750 @@ -203,6 +188,7 @@ page_table_range_init(unsigned long star
20751 int pgd_idx, pmd_idx;
20752 unsigned long vaddr;
20753 pgd_t *pgd;
20754 + pud_t *pud;
20755 pmd_t *pmd;
20756 pte_t *pte = NULL;
20757
20758 @@ -212,8 +198,13 @@ page_table_range_init(unsigned long star
20759 pgd = pgd_base + pgd_idx;
20760
20761 for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
20762 - pmd = one_md_table_init(pgd);
20763 - pmd = pmd + pmd_index(vaddr);
20764 + pud = pud_offset(pgd, vaddr);
20765 + pmd = pmd_offset(pud, vaddr);
20766 +
20767 +#ifdef CONFIG_X86_PAE
20768 + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
20769 +#endif
20770 +
20771 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
20772 pmd++, pmd_idx++) {
20773 pte = page_table_kmap_check(one_page_table_init(pmd),
20774 @@ -225,11 +216,20 @@ page_table_range_init(unsigned long star
20775 }
20776 }
20777
20778 -static inline int is_kernel_text(unsigned long addr)
20779 +static inline int is_kernel_text(unsigned long start, unsigned long end)
20780 {
20781 - if (addr >= (unsigned long)_text && addr <= (unsigned long)__init_end)
20782 - return 1;
20783 - return 0;
20784 + if ((start > ktla_ktva((unsigned long)_etext) ||
20785 + end <= ktla_ktva((unsigned long)_stext)) &&
20786 + (start > ktla_ktva((unsigned long)_einittext) ||
20787 + end <= ktla_ktva((unsigned long)_sinittext)) &&
20788 +
20789 +#ifdef CONFIG_ACPI_SLEEP
20790 + (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
20791 +#endif
20792 +
20793 + (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
20794 + return 0;
20795 + return 1;
20796 }
20797
20798 /*
20799 @@ -246,9 +246,10 @@ kernel_physical_mapping_init(unsigned lo
20800 unsigned long last_map_addr = end;
20801 unsigned long start_pfn, end_pfn;
20802 pgd_t *pgd_base = swapper_pg_dir;
20803 - int pgd_idx, pmd_idx, pte_ofs;
20804 + unsigned int pgd_idx, pmd_idx, pte_ofs;
20805 unsigned long pfn;
20806 pgd_t *pgd;
20807 + pud_t *pud;
20808 pmd_t *pmd;
20809 pte_t *pte;
20810 unsigned pages_2m, pages_4k;
20811 @@ -281,8 +282,13 @@ repeat:
20812 pfn = start_pfn;
20813 pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
20814 pgd = pgd_base + pgd_idx;
20815 - for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
20816 - pmd = one_md_table_init(pgd);
20817 + for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
20818 + pud = pud_offset(pgd, 0);
20819 + pmd = pmd_offset(pud, 0);
20820 +
20821 +#ifdef CONFIG_X86_PAE
20822 + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
20823 +#endif
20824
20825 if (pfn >= end_pfn)
20826 continue;
20827 @@ -294,14 +300,13 @@ repeat:
20828 #endif
20829 for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
20830 pmd++, pmd_idx++) {
20831 - unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
20832 + unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
20833
20834 /*
20835 * Map with big pages if possible, otherwise
20836 * create normal page tables:
20837 */
20838 if (use_pse) {
20839 - unsigned int addr2;
20840 pgprot_t prot = PAGE_KERNEL_LARGE;
20841 /*
20842 * first pass will use the same initial
20843 @@ -311,11 +316,7 @@ repeat:
20844 __pgprot(PTE_IDENT_ATTR |
20845 _PAGE_PSE);
20846
20847 - addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
20848 - PAGE_OFFSET + PAGE_SIZE-1;
20849 -
20850 - if (is_kernel_text(addr) ||
20851 - is_kernel_text(addr2))
20852 + if (is_kernel_text(address, address + PMD_SIZE))
20853 prot = PAGE_KERNEL_LARGE_EXEC;
20854
20855 pages_2m++;
20856 @@ -332,7 +333,7 @@ repeat:
20857 pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
20858 pte += pte_ofs;
20859 for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
20860 - pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
20861 + pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
20862 pgprot_t prot = PAGE_KERNEL;
20863 /*
20864 * first pass will use the same initial
20865 @@ -340,7 +341,7 @@ repeat:
20866 */
20867 pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
20868
20869 - if (is_kernel_text(addr))
20870 + if (is_kernel_text(address, address + PAGE_SIZE))
20871 prot = PAGE_KERNEL_EXEC;
20872
20873 pages_4k++;
20874 @@ -472,7 +473,7 @@ void __init native_pagetable_setup_start
20875
20876 pud = pud_offset(pgd, va);
20877 pmd = pmd_offset(pud, va);
20878 - if (!pmd_present(*pmd))
20879 + if (!pmd_present(*pmd) || pmd_huge(*pmd))
20880 break;
20881
20882 pte = pte_offset_kernel(pmd, va);
20883 @@ -524,12 +525,10 @@ void __init early_ioremap_page_table_ran
20884
20885 static void __init pagetable_init(void)
20886 {
20887 - pgd_t *pgd_base = swapper_pg_dir;
20888 -
20889 - permanent_kmaps_init(pgd_base);
20890 + permanent_kmaps_init(swapper_pg_dir);
20891 }
20892
20893 -pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
20894 +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
20895 EXPORT_SYMBOL_GPL(__supported_pte_mask);
20896
20897 /* user-defined highmem size */
20898 @@ -757,6 +756,12 @@ void __init mem_init(void)
20899
20900 pci_iommu_alloc();
20901
20902 +#ifdef CONFIG_PAX_PER_CPU_PGD
20903 + clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
20904 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
20905 + KERNEL_PGD_PTRS);
20906 +#endif
20907 +
20908 #ifdef CONFIG_FLATMEM
20909 BUG_ON(!mem_map);
20910 #endif
20911 @@ -774,7 +779,7 @@ void __init mem_init(void)
20912 set_highmem_pages_init();
20913
20914 codesize = (unsigned long) &_etext - (unsigned long) &_text;
20915 - datasize = (unsigned long) &_edata - (unsigned long) &_etext;
20916 + datasize = (unsigned long) &_edata - (unsigned long) &_sdata;
20917 initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
20918
20919 printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
20920 @@ -815,10 +820,10 @@ void __init mem_init(void)
20921 ((unsigned long)&__init_end -
20922 (unsigned long)&__init_begin) >> 10,
20923
20924 - (unsigned long)&_etext, (unsigned long)&_edata,
20925 - ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
20926 + (unsigned long)&_sdata, (unsigned long)&_edata,
20927 + ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
20928
20929 - (unsigned long)&_text, (unsigned long)&_etext,
20930 + ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
20931 ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
20932
20933 /*
20934 @@ -896,6 +901,7 @@ void set_kernel_text_rw(void)
20935 if (!kernel_set_to_readonly)
20936 return;
20937
20938 + start = ktla_ktva(start);
20939 pr_debug("Set kernel text: %lx - %lx for read write\n",
20940 start, start+size);
20941
20942 @@ -910,6 +916,7 @@ void set_kernel_text_ro(void)
20943 if (!kernel_set_to_readonly)
20944 return;
20945
20946 + start = ktla_ktva(start);
20947 pr_debug("Set kernel text: %lx - %lx for read only\n",
20948 start, start+size);
20949
20950 @@ -938,6 +945,7 @@ void mark_rodata_ro(void)
20951 unsigned long start = PFN_ALIGN(_text);
20952 unsigned long size = PFN_ALIGN(_etext) - start;
20953
20954 + start = ktla_ktva(start);
20955 set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
20956 printk(KERN_INFO "Write protecting the kernel text: %luk\n",
20957 size >> 10);
20958 diff -urNp linux-3.0.8/arch/x86/mm/init_64.c linux-3.0.8/arch/x86/mm/init_64.c
20959 --- linux-3.0.8/arch/x86/mm/init_64.c 2011-07-21 22:17:23.000000000 -0400
20960 +++ linux-3.0.8/arch/x86/mm/init_64.c 2011-10-06 04:17:55.000000000 -0400
20961 @@ -75,7 +75,7 @@ early_param("gbpages", parse_direct_gbpa
20962 * around without checking the pgd every time.
20963 */
20964
20965 -pteval_t __supported_pte_mask __read_mostly = ~_PAGE_IOMAP;
20966 +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_IOMAP);
20967 EXPORT_SYMBOL_GPL(__supported_pte_mask);
20968
20969 int force_personality32;
20970 @@ -108,12 +108,22 @@ void sync_global_pgds(unsigned long star
20971
20972 for (address = start; address <= end; address += PGDIR_SIZE) {
20973 const pgd_t *pgd_ref = pgd_offset_k(address);
20974 +
20975 +#ifdef CONFIG_PAX_PER_CPU_PGD
20976 + unsigned long cpu;
20977 +#else
20978 struct page *page;
20979 +#endif
20980
20981 if (pgd_none(*pgd_ref))
20982 continue;
20983
20984 spin_lock(&pgd_lock);
20985 +
20986 +#ifdef CONFIG_PAX_PER_CPU_PGD
20987 + for (cpu = 0; cpu < NR_CPUS; ++cpu) {
20988 + pgd_t *pgd = pgd_offset_cpu(cpu, address);
20989 +#else
20990 list_for_each_entry(page, &pgd_list, lru) {
20991 pgd_t *pgd;
20992 spinlock_t *pgt_lock;
20993 @@ -122,6 +132,7 @@ void sync_global_pgds(unsigned long star
20994 /* the pgt_lock only for Xen */
20995 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
20996 spin_lock(pgt_lock);
20997 +#endif
20998
20999 if (pgd_none(*pgd))
21000 set_pgd(pgd, *pgd_ref);
21001 @@ -129,7 +140,10 @@ void sync_global_pgds(unsigned long star
21002 BUG_ON(pgd_page_vaddr(*pgd)
21003 != pgd_page_vaddr(*pgd_ref));
21004
21005 +#ifndef CONFIG_PAX_PER_CPU_PGD
21006 spin_unlock(pgt_lock);
21007 +#endif
21008 +
21009 }
21010 spin_unlock(&pgd_lock);
21011 }
21012 @@ -203,7 +217,9 @@ void set_pte_vaddr_pud(pud_t *pud_page,
21013 pmd = fill_pmd(pud, vaddr);
21014 pte = fill_pte(pmd, vaddr);
21015
21016 + pax_open_kernel();
21017 set_pte(pte, new_pte);
21018 + pax_close_kernel();
21019
21020 /*
21021 * It's enough to flush this one mapping.
21022 @@ -262,14 +278,12 @@ static void __init __init_extra_mapping(
21023 pgd = pgd_offset_k((unsigned long)__va(phys));
21024 if (pgd_none(*pgd)) {
21025 pud = (pud_t *) spp_getpage();
21026 - set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
21027 - _PAGE_USER));
21028 + set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
21029 }
21030 pud = pud_offset(pgd, (unsigned long)__va(phys));
21031 if (pud_none(*pud)) {
21032 pmd = (pmd_t *) spp_getpage();
21033 - set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
21034 - _PAGE_USER));
21035 + set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
21036 }
21037 pmd = pmd_offset(pud, phys);
21038 BUG_ON(!pmd_none(*pmd));
21039 @@ -330,7 +344,7 @@ static __ref void *alloc_low_page(unsign
21040 if (pfn >= pgt_buf_top)
21041 panic("alloc_low_page: ran out of memory");
21042
21043 - adr = early_memremap(pfn * PAGE_SIZE, PAGE_SIZE);
21044 + adr = (void __force_kernel *)early_memremap(pfn * PAGE_SIZE, PAGE_SIZE);
21045 clear_page(adr);
21046 *phys = pfn * PAGE_SIZE;
21047 return adr;
21048 @@ -346,7 +360,7 @@ static __ref void *map_low_page(void *vi
21049
21050 phys = __pa(virt);
21051 left = phys & (PAGE_SIZE - 1);
21052 - adr = early_memremap(phys & PAGE_MASK, PAGE_SIZE);
21053 + adr = (void __force_kernel *)early_memremap(phys & PAGE_MASK, PAGE_SIZE);
21054 adr = (void *)(((unsigned long)adr) | left);
21055
21056 return adr;
21057 @@ -693,6 +707,12 @@ void __init mem_init(void)
21058
21059 pci_iommu_alloc();
21060
21061 +#ifdef CONFIG_PAX_PER_CPU_PGD
21062 + clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
21063 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
21064 + KERNEL_PGD_PTRS);
21065 +#endif
21066 +
21067 /* clear_bss() already clear the empty_zero_page */
21068
21069 reservedpages = 0;
21070 @@ -853,8 +873,8 @@ int kern_addr_valid(unsigned long addr)
21071 static struct vm_area_struct gate_vma = {
21072 .vm_start = VSYSCALL_START,
21073 .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
21074 - .vm_page_prot = PAGE_READONLY_EXEC,
21075 - .vm_flags = VM_READ | VM_EXEC
21076 + .vm_page_prot = PAGE_READONLY,
21077 + .vm_flags = VM_READ
21078 };
21079
21080 struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
21081 @@ -888,7 +908,7 @@ int in_gate_area_no_mm(unsigned long add
21082
21083 const char *arch_vma_name(struct vm_area_struct *vma)
21084 {
21085 - if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
21086 + if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
21087 return "[vdso]";
21088 if (vma == &gate_vma)
21089 return "[vsyscall]";
21090 diff -urNp linux-3.0.8/arch/x86/mm/init.c linux-3.0.8/arch/x86/mm/init.c
21091 --- linux-3.0.8/arch/x86/mm/init.c 2011-10-25 09:10:33.000000000 -0400
21092 +++ linux-3.0.8/arch/x86/mm/init.c 2011-10-25 09:10:41.000000000 -0400
21093 @@ -31,7 +31,7 @@ int direct_gbpages
21094 static void __init find_early_table_space(unsigned long end, int use_pse,
21095 int use_gbpages)
21096 {
21097 - unsigned long puds, pmds, ptes, tables, start = 0, good_end = end;
21098 + unsigned long puds, pmds, ptes, tables, start = 0x100000, good_end = end;
21099 phys_addr_t base;
21100
21101 puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
21102 @@ -312,12 +312,34 @@ unsigned long __init_refok init_memory_m
21103 */
21104 int devmem_is_allowed(unsigned long pagenr)
21105 {
21106 - if (pagenr <= 256)
21107 +#ifdef CONFIG_GRKERNSEC_KMEM
21108 + /* allow BDA */
21109 + if (!pagenr)
21110 + return 1;
21111 + /* allow EBDA */
21112 + if ((0x9f000 >> PAGE_SHIFT) == pagenr)
21113 + return 1;
21114 +#else
21115 + if (!pagenr)
21116 + return 1;
21117 +#ifdef CONFIG_VM86
21118 + if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
21119 + return 1;
21120 +#endif
21121 +#endif
21122 +
21123 + if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
21124 return 1;
21125 +#ifdef CONFIG_GRKERNSEC_KMEM
21126 + /* throw out everything else below 1MB */
21127 + if (pagenr <= 256)
21128 + return 0;
21129 +#endif
21130 if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
21131 return 0;
21132 if (!page_is_ram(pagenr))
21133 return 1;
21134 +
21135 return 0;
21136 }
21137
21138 @@ -372,6 +394,86 @@ void free_init_pages(char *what, unsigne
21139
21140 void free_initmem(void)
21141 {
21142 +
21143 +#ifdef CONFIG_PAX_KERNEXEC
21144 +#ifdef CONFIG_X86_32
21145 + /* PaX: limit KERNEL_CS to actual size */
21146 + unsigned long addr, limit;
21147 + struct desc_struct d;
21148 + int cpu;
21149 +
21150 + limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
21151 + limit = (limit - 1UL) >> PAGE_SHIFT;
21152 +
21153 + memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
21154 + for (cpu = 0; cpu < NR_CPUS; cpu++) {
21155 + pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
21156 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
21157 + }
21158 +
21159 + /* PaX: make KERNEL_CS read-only */
21160 + addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
21161 + if (!paravirt_enabled())
21162 + set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
21163 +/*
21164 + for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
21165 + pgd = pgd_offset_k(addr);
21166 + pud = pud_offset(pgd, addr);
21167 + pmd = pmd_offset(pud, addr);
21168 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
21169 + }
21170 +*/
21171 +#ifdef CONFIG_X86_PAE
21172 + set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
21173 +/*
21174 + for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
21175 + pgd = pgd_offset_k(addr);
21176 + pud = pud_offset(pgd, addr);
21177 + pmd = pmd_offset(pud, addr);
21178 + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
21179 + }
21180 +*/
21181 +#endif
21182 +
21183 +#ifdef CONFIG_MODULES
21184 + set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
21185 +#endif
21186 +
21187 +#else
21188 + pgd_t *pgd;
21189 + pud_t *pud;
21190 + pmd_t *pmd;
21191 + unsigned long addr, end;
21192 +
21193 + /* PaX: make kernel code/rodata read-only, rest non-executable */
21194 + for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
21195 + pgd = pgd_offset_k(addr);
21196 + pud = pud_offset(pgd, addr);
21197 + pmd = pmd_offset(pud, addr);
21198 + if (!pmd_present(*pmd))
21199 + continue;
21200 + if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
21201 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
21202 + else
21203 + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
21204 + }
21205 +
21206 + addr = (unsigned long)__va(__pa(__START_KERNEL_map));
21207 + end = addr + KERNEL_IMAGE_SIZE;
21208 + for (; addr < end; addr += PMD_SIZE) {
21209 + pgd = pgd_offset_k(addr);
21210 + pud = pud_offset(pgd, addr);
21211 + pmd = pmd_offset(pud, addr);
21212 + if (!pmd_present(*pmd))
21213 + continue;
21214 + if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
21215 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
21216 + }
21217 +#endif
21218 +
21219 + flush_tlb_all();
21220 +#endif
21221 +
21222 free_init_pages("unused kernel memory",
21223 (unsigned long)(&__init_begin),
21224 (unsigned long)(&__init_end));
21225 diff -urNp linux-3.0.8/arch/x86/mm/iomap_32.c linux-3.0.8/arch/x86/mm/iomap_32.c
21226 --- linux-3.0.8/arch/x86/mm/iomap_32.c 2011-07-21 22:17:23.000000000 -0400
21227 +++ linux-3.0.8/arch/x86/mm/iomap_32.c 2011-08-23 21:47:55.000000000 -0400
21228 @@ -64,7 +64,11 @@ void *kmap_atomic_prot_pfn(unsigned long
21229 type = kmap_atomic_idx_push();
21230 idx = type + KM_TYPE_NR * smp_processor_id();
21231 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
21232 +
21233 + pax_open_kernel();
21234 set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
21235 + pax_close_kernel();
21236 +
21237 arch_flush_lazy_mmu_mode();
21238
21239 return (void *)vaddr;
21240 diff -urNp linux-3.0.8/arch/x86/mm/ioremap.c linux-3.0.8/arch/x86/mm/ioremap.c
21241 --- linux-3.0.8/arch/x86/mm/ioremap.c 2011-07-21 22:17:23.000000000 -0400
21242 +++ linux-3.0.8/arch/x86/mm/ioremap.c 2011-08-23 21:47:55.000000000 -0400
21243 @@ -97,7 +97,7 @@ static void __iomem *__ioremap_caller(re
21244 for (pfn = phys_addr >> PAGE_SHIFT; pfn <= last_pfn; pfn++) {
21245 int is_ram = page_is_ram(pfn);
21246
21247 - if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
21248 + if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
21249 return NULL;
21250 WARN_ON_ONCE(is_ram);
21251 }
21252 @@ -344,7 +344,7 @@ static int __init early_ioremap_debug_se
21253 early_param("early_ioremap_debug", early_ioremap_debug_setup);
21254
21255 static __initdata int after_paging_init;
21256 -static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
21257 +static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
21258
21259 static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
21260 {
21261 @@ -381,8 +381,7 @@ void __init early_ioremap_init(void)
21262 slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
21263
21264 pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
21265 - memset(bm_pte, 0, sizeof(bm_pte));
21266 - pmd_populate_kernel(&init_mm, pmd, bm_pte);
21267 + pmd_populate_user(&init_mm, pmd, bm_pte);
21268
21269 /*
21270 * The boot-ioremap range spans multiple pmds, for which
21271 diff -urNp linux-3.0.8/arch/x86/mm/kmemcheck/kmemcheck.c linux-3.0.8/arch/x86/mm/kmemcheck/kmemcheck.c
21272 --- linux-3.0.8/arch/x86/mm/kmemcheck/kmemcheck.c 2011-07-21 22:17:23.000000000 -0400
21273 +++ linux-3.0.8/arch/x86/mm/kmemcheck/kmemcheck.c 2011-08-23 21:47:55.000000000 -0400
21274 @@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
21275 * memory (e.g. tracked pages)? For now, we need this to avoid
21276 * invoking kmemcheck for PnP BIOS calls.
21277 */
21278 - if (regs->flags & X86_VM_MASK)
21279 + if (v8086_mode(regs))
21280 return false;
21281 - if (regs->cs != __KERNEL_CS)
21282 + if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
21283 return false;
21284
21285 pte = kmemcheck_pte_lookup(address);
21286 diff -urNp linux-3.0.8/arch/x86/mm/mmap.c linux-3.0.8/arch/x86/mm/mmap.c
21287 --- linux-3.0.8/arch/x86/mm/mmap.c 2011-07-21 22:17:23.000000000 -0400
21288 +++ linux-3.0.8/arch/x86/mm/mmap.c 2011-08-23 21:47:55.000000000 -0400
21289 @@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
21290 * Leave an at least ~128 MB hole with possible stack randomization.
21291 */
21292 #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
21293 -#define MAX_GAP (TASK_SIZE/6*5)
21294 +#define MAX_GAP (pax_task_size/6*5)
21295
21296 /*
21297 * True on X86_32 or when emulating IA32 on X86_64
21298 @@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
21299 return rnd << PAGE_SHIFT;
21300 }
21301
21302 -static unsigned long mmap_base(void)
21303 +static unsigned long mmap_base(struct mm_struct *mm)
21304 {
21305 unsigned long gap = rlimit(RLIMIT_STACK);
21306 + unsigned long pax_task_size = TASK_SIZE;
21307 +
21308 +#ifdef CONFIG_PAX_SEGMEXEC
21309 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
21310 + pax_task_size = SEGMEXEC_TASK_SIZE;
21311 +#endif
21312
21313 if (gap < MIN_GAP)
21314 gap = MIN_GAP;
21315 else if (gap > MAX_GAP)
21316 gap = MAX_GAP;
21317
21318 - return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
21319 + return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
21320 }
21321
21322 /*
21323 * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
21324 * does, but not when emulating X86_32
21325 */
21326 -static unsigned long mmap_legacy_base(void)
21327 +static unsigned long mmap_legacy_base(struct mm_struct *mm)
21328 {
21329 - if (mmap_is_ia32())
21330 + if (mmap_is_ia32()) {
21331 +
21332 +#ifdef CONFIG_PAX_SEGMEXEC
21333 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
21334 + return SEGMEXEC_TASK_UNMAPPED_BASE;
21335 + else
21336 +#endif
21337 +
21338 return TASK_UNMAPPED_BASE;
21339 - else
21340 + } else
21341 return TASK_UNMAPPED_BASE + mmap_rnd();
21342 }
21343
21344 @@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo
21345 void arch_pick_mmap_layout(struct mm_struct *mm)
21346 {
21347 if (mmap_is_legacy()) {
21348 - mm->mmap_base = mmap_legacy_base();
21349 + mm->mmap_base = mmap_legacy_base(mm);
21350 +
21351 +#ifdef CONFIG_PAX_RANDMMAP
21352 + if (mm->pax_flags & MF_PAX_RANDMMAP)
21353 + mm->mmap_base += mm->delta_mmap;
21354 +#endif
21355 +
21356 mm->get_unmapped_area = arch_get_unmapped_area;
21357 mm->unmap_area = arch_unmap_area;
21358 } else {
21359 - mm->mmap_base = mmap_base();
21360 + mm->mmap_base = mmap_base(mm);
21361 +
21362 +#ifdef CONFIG_PAX_RANDMMAP
21363 + if (mm->pax_flags & MF_PAX_RANDMMAP)
21364 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
21365 +#endif
21366 +
21367 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
21368 mm->unmap_area = arch_unmap_area_topdown;
21369 }
21370 diff -urNp linux-3.0.8/arch/x86/mm/mmio-mod.c linux-3.0.8/arch/x86/mm/mmio-mod.c
21371 --- linux-3.0.8/arch/x86/mm/mmio-mod.c 2011-07-21 22:17:23.000000000 -0400
21372 +++ linux-3.0.8/arch/x86/mm/mmio-mod.c 2011-08-23 21:47:55.000000000 -0400
21373 @@ -195,7 +195,7 @@ static void pre(struct kmmio_probe *p, s
21374 break;
21375 default:
21376 {
21377 - unsigned char *ip = (unsigned char *)instptr;
21378 + unsigned char *ip = (unsigned char *)ktla_ktva(instptr);
21379 my_trace->opcode = MMIO_UNKNOWN_OP;
21380 my_trace->width = 0;
21381 my_trace->value = (*ip) << 16 | *(ip + 1) << 8 |
21382 @@ -235,7 +235,7 @@ static void post(struct kmmio_probe *p,
21383 static void ioremap_trace_core(resource_size_t offset, unsigned long size,
21384 void __iomem *addr)
21385 {
21386 - static atomic_t next_id;
21387 + static atomic_unchecked_t next_id;
21388 struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
21389 /* These are page-unaligned. */
21390 struct mmiotrace_map map = {
21391 @@ -259,7 +259,7 @@ static void ioremap_trace_core(resource_
21392 .private = trace
21393 },
21394 .phys = offset,
21395 - .id = atomic_inc_return(&next_id)
21396 + .id = atomic_inc_return_unchecked(&next_id)
21397 };
21398 map.map_id = trace->id;
21399
21400 diff -urNp linux-3.0.8/arch/x86/mm/pageattr.c linux-3.0.8/arch/x86/mm/pageattr.c
21401 --- linux-3.0.8/arch/x86/mm/pageattr.c 2011-07-21 22:17:23.000000000 -0400
21402 +++ linux-3.0.8/arch/x86/mm/pageattr.c 2011-08-23 21:47:55.000000000 -0400
21403 @@ -261,7 +261,7 @@ static inline pgprot_t static_protection
21404 */
21405 #ifdef CONFIG_PCI_BIOS
21406 if (pcibios_enabled && within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
21407 - pgprot_val(forbidden) |= _PAGE_NX;
21408 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
21409 #endif
21410
21411 /*
21412 @@ -269,9 +269,10 @@ static inline pgprot_t static_protection
21413 * Does not cover __inittext since that is gone later on. On
21414 * 64bit we do not enforce !NX on the low mapping
21415 */
21416 - if (within(address, (unsigned long)_text, (unsigned long)_etext))
21417 - pgprot_val(forbidden) |= _PAGE_NX;
21418 + if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
21419 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
21420
21421 +#ifdef CONFIG_DEBUG_RODATA
21422 /*
21423 * The .rodata section needs to be read-only. Using the pfn
21424 * catches all aliases.
21425 @@ -279,6 +280,7 @@ static inline pgprot_t static_protection
21426 if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
21427 __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
21428 pgprot_val(forbidden) |= _PAGE_RW;
21429 +#endif
21430
21431 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
21432 /*
21433 @@ -317,6 +319,13 @@ static inline pgprot_t static_protection
21434 }
21435 #endif
21436
21437 +#ifdef CONFIG_PAX_KERNEXEC
21438 + if (within(pfn, __pa((unsigned long)&_text), __pa((unsigned long)&_sdata))) {
21439 + pgprot_val(forbidden) |= _PAGE_RW;
21440 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
21441 + }
21442 +#endif
21443 +
21444 prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
21445
21446 return prot;
21447 @@ -369,23 +378,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
21448 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
21449 {
21450 /* change init_mm */
21451 + pax_open_kernel();
21452 set_pte_atomic(kpte, pte);
21453 +
21454 #ifdef CONFIG_X86_32
21455 if (!SHARED_KERNEL_PMD) {
21456 +
21457 +#ifdef CONFIG_PAX_PER_CPU_PGD
21458 + unsigned long cpu;
21459 +#else
21460 struct page *page;
21461 +#endif
21462
21463 +#ifdef CONFIG_PAX_PER_CPU_PGD
21464 + for (cpu = 0; cpu < NR_CPUS; ++cpu) {
21465 + pgd_t *pgd = get_cpu_pgd(cpu);
21466 +#else
21467 list_for_each_entry(page, &pgd_list, lru) {
21468 - pgd_t *pgd;
21469 + pgd_t *pgd = (pgd_t *)page_address(page);
21470 +#endif
21471 +
21472 pud_t *pud;
21473 pmd_t *pmd;
21474
21475 - pgd = (pgd_t *)page_address(page) + pgd_index(address);
21476 + pgd += pgd_index(address);
21477 pud = pud_offset(pgd, address);
21478 pmd = pmd_offset(pud, address);
21479 set_pte_atomic((pte_t *)pmd, pte);
21480 }
21481 }
21482 #endif
21483 + pax_close_kernel();
21484 }
21485
21486 static int
21487 diff -urNp linux-3.0.8/arch/x86/mm/pageattr-test.c linux-3.0.8/arch/x86/mm/pageattr-test.c
21488 --- linux-3.0.8/arch/x86/mm/pageattr-test.c 2011-07-21 22:17:23.000000000 -0400
21489 +++ linux-3.0.8/arch/x86/mm/pageattr-test.c 2011-08-23 21:47:55.000000000 -0400
21490 @@ -36,7 +36,7 @@ enum {
21491
21492 static int pte_testbit(pte_t pte)
21493 {
21494 - return pte_flags(pte) & _PAGE_UNUSED1;
21495 + return pte_flags(pte) & _PAGE_CPA_TEST;
21496 }
21497
21498 struct split_state {
21499 diff -urNp linux-3.0.8/arch/x86/mm/pat.c linux-3.0.8/arch/x86/mm/pat.c
21500 --- linux-3.0.8/arch/x86/mm/pat.c 2011-07-21 22:17:23.000000000 -0400
21501 +++ linux-3.0.8/arch/x86/mm/pat.c 2011-08-23 21:47:55.000000000 -0400
21502 @@ -361,7 +361,7 @@ int free_memtype(u64 start, u64 end)
21503
21504 if (!entry) {
21505 printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
21506 - current->comm, current->pid, start, end);
21507 + current->comm, task_pid_nr(current), start, end);
21508 return -EINVAL;
21509 }
21510
21511 @@ -492,8 +492,8 @@ static inline int range_is_allowed(unsig
21512 while (cursor < to) {
21513 if (!devmem_is_allowed(pfn)) {
21514 printk(KERN_INFO
21515 - "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
21516 - current->comm, from, to);
21517 + "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n",
21518 + current->comm, from, to, cursor);
21519 return 0;
21520 }
21521 cursor += PAGE_SIZE;
21522 @@ -557,7 +557,7 @@ int kernel_map_sync_memtype(u64 base, un
21523 printk(KERN_INFO
21524 "%s:%d ioremap_change_attr failed %s "
21525 "for %Lx-%Lx\n",
21526 - current->comm, current->pid,
21527 + current->comm, task_pid_nr(current),
21528 cattr_name(flags),
21529 base, (unsigned long long)(base + size));
21530 return -EINVAL;
21531 @@ -593,7 +593,7 @@ static int reserve_pfn_range(u64 paddr,
21532 if (want_flags != flags) {
21533 printk(KERN_WARNING
21534 "%s:%d map pfn RAM range req %s for %Lx-%Lx, got %s\n",
21535 - current->comm, current->pid,
21536 + current->comm, task_pid_nr(current),
21537 cattr_name(want_flags),
21538 (unsigned long long)paddr,
21539 (unsigned long long)(paddr + size),
21540 @@ -615,7 +615,7 @@ static int reserve_pfn_range(u64 paddr,
21541 free_memtype(paddr, paddr + size);
21542 printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
21543 " for %Lx-%Lx, got %s\n",
21544 - current->comm, current->pid,
21545 + current->comm, task_pid_nr(current),
21546 cattr_name(want_flags),
21547 (unsigned long long)paddr,
21548 (unsigned long long)(paddr + size),
21549 diff -urNp linux-3.0.8/arch/x86/mm/pf_in.c linux-3.0.8/arch/x86/mm/pf_in.c
21550 --- linux-3.0.8/arch/x86/mm/pf_in.c 2011-07-21 22:17:23.000000000 -0400
21551 +++ linux-3.0.8/arch/x86/mm/pf_in.c 2011-08-23 21:47:55.000000000 -0400
21552 @@ -148,7 +148,7 @@ enum reason_type get_ins_type(unsigned l
21553 int i;
21554 enum reason_type rv = OTHERS;
21555
21556 - p = (unsigned char *)ins_addr;
21557 + p = (unsigned char *)ktla_ktva(ins_addr);
21558 p += skip_prefix(p, &prf);
21559 p += get_opcode(p, &opcode);
21560
21561 @@ -168,7 +168,7 @@ static unsigned int get_ins_reg_width(un
21562 struct prefix_bits prf;
21563 int i;
21564
21565 - p = (unsigned char *)ins_addr;
21566 + p = (unsigned char *)ktla_ktva(ins_addr);
21567 p += skip_prefix(p, &prf);
21568 p += get_opcode(p, &opcode);
21569
21570 @@ -191,7 +191,7 @@ unsigned int get_ins_mem_width(unsigned
21571 struct prefix_bits prf;
21572 int i;
21573
21574 - p = (unsigned char *)ins_addr;
21575 + p = (unsigned char *)ktla_ktva(ins_addr);
21576 p += skip_prefix(p, &prf);
21577 p += get_opcode(p, &opcode);
21578
21579 @@ -415,7 +415,7 @@ unsigned long get_ins_reg_val(unsigned l
21580 struct prefix_bits prf;
21581 int i;
21582
21583 - p = (unsigned char *)ins_addr;
21584 + p = (unsigned char *)ktla_ktva(ins_addr);
21585 p += skip_prefix(p, &prf);
21586 p += get_opcode(p, &opcode);
21587 for (i = 0; i < ARRAY_SIZE(reg_rop); i++)
21588 @@ -470,7 +470,7 @@ unsigned long get_ins_imm_val(unsigned l
21589 struct prefix_bits prf;
21590 int i;
21591
21592 - p = (unsigned char *)ins_addr;
21593 + p = (unsigned char *)ktla_ktva(ins_addr);
21594 p += skip_prefix(p, &prf);
21595 p += get_opcode(p, &opcode);
21596 for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
21597 diff -urNp linux-3.0.8/arch/x86/mm/pgtable_32.c linux-3.0.8/arch/x86/mm/pgtable_32.c
21598 --- linux-3.0.8/arch/x86/mm/pgtable_32.c 2011-07-21 22:17:23.000000000 -0400
21599 +++ linux-3.0.8/arch/x86/mm/pgtable_32.c 2011-08-23 21:47:55.000000000 -0400
21600 @@ -48,10 +48,13 @@ void set_pte_vaddr(unsigned long vaddr,
21601 return;
21602 }
21603 pte = pte_offset_kernel(pmd, vaddr);
21604 +
21605 + pax_open_kernel();
21606 if (pte_val(pteval))
21607 set_pte_at(&init_mm, vaddr, pte, pteval);
21608 else
21609 pte_clear(&init_mm, vaddr, pte);
21610 + pax_close_kernel();
21611
21612 /*
21613 * It's enough to flush this one mapping.
21614 diff -urNp linux-3.0.8/arch/x86/mm/pgtable.c linux-3.0.8/arch/x86/mm/pgtable.c
21615 --- linux-3.0.8/arch/x86/mm/pgtable.c 2011-07-21 22:17:23.000000000 -0400
21616 +++ linux-3.0.8/arch/x86/mm/pgtable.c 2011-08-23 21:47:55.000000000 -0400
21617 @@ -84,10 +84,52 @@ static inline void pgd_list_del(pgd_t *p
21618 list_del(&page->lru);
21619 }
21620
21621 -#define UNSHARED_PTRS_PER_PGD \
21622 - (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
21623 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21624 +pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
21625
21626 +void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
21627 +{
21628 + while (count--)
21629 + *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
21630 +}
21631 +#endif
21632 +
21633 +#ifdef CONFIG_PAX_PER_CPU_PGD
21634 +void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
21635 +{
21636 + while (count--)
21637 +
21638 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21639 + *dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
21640 +#else
21641 + *dst++ = *src++;
21642 +#endif
21643
21644 +}
21645 +#endif
21646 +
21647 +#ifdef CONFIG_X86_64
21648 +#define pxd_t pud_t
21649 +#define pyd_t pgd_t
21650 +#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
21651 +#define pxd_free(mm, pud) pud_free((mm), (pud))
21652 +#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
21653 +#define pyd_offset(mm ,address) pgd_offset((mm), (address))
21654 +#define PYD_SIZE PGDIR_SIZE
21655 +#else
21656 +#define pxd_t pmd_t
21657 +#define pyd_t pud_t
21658 +#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
21659 +#define pxd_free(mm, pud) pmd_free((mm), (pud))
21660 +#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
21661 +#define pyd_offset(mm ,address) pud_offset((mm), (address))
21662 +#define PYD_SIZE PUD_SIZE
21663 +#endif
21664 +
21665 +#ifdef CONFIG_PAX_PER_CPU_PGD
21666 +static inline void pgd_ctor(struct mm_struct *mm, pgd_t *pgd) {}
21667 +static inline void pgd_dtor(pgd_t *pgd) {}
21668 +#else
21669 static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
21670 {
21671 BUILD_BUG_ON(sizeof(virt_to_page(pgd)->index) < sizeof(mm));
21672 @@ -128,6 +170,7 @@ static void pgd_dtor(pgd_t *pgd)
21673 pgd_list_del(pgd);
21674 spin_unlock(&pgd_lock);
21675 }
21676 +#endif
21677
21678 /*
21679 * List of all pgd's needed for non-PAE so it can invalidate entries
21680 @@ -140,7 +183,7 @@ static void pgd_dtor(pgd_t *pgd)
21681 * -- wli
21682 */
21683
21684 -#ifdef CONFIG_X86_PAE
21685 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
21686 /*
21687 * In PAE mode, we need to do a cr3 reload (=tlb flush) when
21688 * updating the top-level pagetable entries to guarantee the
21689 @@ -152,7 +195,7 @@ static void pgd_dtor(pgd_t *pgd)
21690 * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
21691 * and initialize the kernel pmds here.
21692 */
21693 -#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
21694 +#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
21695
21696 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
21697 {
21698 @@ -170,36 +213,38 @@ void pud_populate(struct mm_struct *mm,
21699 */
21700 flush_tlb_mm(mm);
21701 }
21702 +#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
21703 +#define PREALLOCATED_PXDS USER_PGD_PTRS
21704 #else /* !CONFIG_X86_PAE */
21705
21706 /* No need to prepopulate any pagetable entries in non-PAE modes. */
21707 -#define PREALLOCATED_PMDS 0
21708 +#define PREALLOCATED_PXDS 0
21709
21710 #endif /* CONFIG_X86_PAE */
21711
21712 -static void free_pmds(pmd_t *pmds[])
21713 +static void free_pxds(pxd_t *pxds[])
21714 {
21715 int i;
21716
21717 - for(i = 0; i < PREALLOCATED_PMDS; i++)
21718 - if (pmds[i])
21719 - free_page((unsigned long)pmds[i]);
21720 + for(i = 0; i < PREALLOCATED_PXDS; i++)
21721 + if (pxds[i])
21722 + free_page((unsigned long)pxds[i]);
21723 }
21724
21725 -static int preallocate_pmds(pmd_t *pmds[])
21726 +static int preallocate_pxds(pxd_t *pxds[])
21727 {
21728 int i;
21729 bool failed = false;
21730
21731 - for(i = 0; i < PREALLOCATED_PMDS; i++) {
21732 - pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
21733 - if (pmd == NULL)
21734 + for(i = 0; i < PREALLOCATED_PXDS; i++) {
21735 + pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
21736 + if (pxd == NULL)
21737 failed = true;
21738 - pmds[i] = pmd;
21739 + pxds[i] = pxd;
21740 }
21741
21742 if (failed) {
21743 - free_pmds(pmds);
21744 + free_pxds(pxds);
21745 return -ENOMEM;
21746 }
21747
21748 @@ -212,51 +257,55 @@ static int preallocate_pmds(pmd_t *pmds[
21749 * preallocate which never got a corresponding vma will need to be
21750 * freed manually.
21751 */
21752 -static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
21753 +static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
21754 {
21755 int i;
21756
21757 - for(i = 0; i < PREALLOCATED_PMDS; i++) {
21758 + for(i = 0; i < PREALLOCATED_PXDS; i++) {
21759 pgd_t pgd = pgdp[i];
21760
21761 if (pgd_val(pgd) != 0) {
21762 - pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
21763 + pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
21764
21765 - pgdp[i] = native_make_pgd(0);
21766 + set_pgd(pgdp + i, native_make_pgd(0));
21767
21768 - paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
21769 - pmd_free(mm, pmd);
21770 + paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
21771 + pxd_free(mm, pxd);
21772 }
21773 }
21774 }
21775
21776 -static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
21777 +static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
21778 {
21779 - pud_t *pud;
21780 + pyd_t *pyd;
21781 unsigned long addr;
21782 int i;
21783
21784 - if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
21785 + if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
21786 return;
21787
21788 - pud = pud_offset(pgd, 0);
21789 +#ifdef CONFIG_X86_64
21790 + pyd = pyd_offset(mm, 0L);
21791 +#else
21792 + pyd = pyd_offset(pgd, 0L);
21793 +#endif
21794
21795 - for (addr = i = 0; i < PREALLOCATED_PMDS;
21796 - i++, pud++, addr += PUD_SIZE) {
21797 - pmd_t *pmd = pmds[i];
21798 + for (addr = i = 0; i < PREALLOCATED_PXDS;
21799 + i++, pyd++, addr += PYD_SIZE) {
21800 + pxd_t *pxd = pxds[i];
21801
21802 if (i >= KERNEL_PGD_BOUNDARY)
21803 - memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
21804 - sizeof(pmd_t) * PTRS_PER_PMD);
21805 + memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
21806 + sizeof(pxd_t) * PTRS_PER_PMD);
21807
21808 - pud_populate(mm, pud, pmd);
21809 + pyd_populate(mm, pyd, pxd);
21810 }
21811 }
21812
21813 pgd_t *pgd_alloc(struct mm_struct *mm)
21814 {
21815 pgd_t *pgd;
21816 - pmd_t *pmds[PREALLOCATED_PMDS];
21817 + pxd_t *pxds[PREALLOCATED_PXDS];
21818
21819 pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
21820
21821 @@ -265,11 +314,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
21822
21823 mm->pgd = pgd;
21824
21825 - if (preallocate_pmds(pmds) != 0)
21826 + if (preallocate_pxds(pxds) != 0)
21827 goto out_free_pgd;
21828
21829 if (paravirt_pgd_alloc(mm) != 0)
21830 - goto out_free_pmds;
21831 + goto out_free_pxds;
21832
21833 /*
21834 * Make sure that pre-populating the pmds is atomic with
21835 @@ -279,14 +328,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
21836 spin_lock(&pgd_lock);
21837
21838 pgd_ctor(mm, pgd);
21839 - pgd_prepopulate_pmd(mm, pgd, pmds);
21840 + pgd_prepopulate_pxd(mm, pgd, pxds);
21841
21842 spin_unlock(&pgd_lock);
21843
21844 return pgd;
21845
21846 -out_free_pmds:
21847 - free_pmds(pmds);
21848 +out_free_pxds:
21849 + free_pxds(pxds);
21850 out_free_pgd:
21851 free_page((unsigned long)pgd);
21852 out:
21853 @@ -295,7 +344,7 @@ out:
21854
21855 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
21856 {
21857 - pgd_mop_up_pmds(mm, pgd);
21858 + pgd_mop_up_pxds(mm, pgd);
21859 pgd_dtor(pgd);
21860 paravirt_pgd_free(mm, pgd);
21861 free_page((unsigned long)pgd);
21862 diff -urNp linux-3.0.8/arch/x86/mm/setup_nx.c linux-3.0.8/arch/x86/mm/setup_nx.c
21863 --- linux-3.0.8/arch/x86/mm/setup_nx.c 2011-07-21 22:17:23.000000000 -0400
21864 +++ linux-3.0.8/arch/x86/mm/setup_nx.c 2011-08-23 21:47:55.000000000 -0400
21865 @@ -5,8 +5,10 @@
21866 #include <asm/pgtable.h>
21867 #include <asm/proto.h>
21868
21869 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
21870 static int disable_nx __cpuinitdata;
21871
21872 +#ifndef CONFIG_PAX_PAGEEXEC
21873 /*
21874 * noexec = on|off
21875 *
21876 @@ -28,12 +30,17 @@ static int __init noexec_setup(char *str
21877 return 0;
21878 }
21879 early_param("noexec", noexec_setup);
21880 +#endif
21881 +
21882 +#endif
21883
21884 void __cpuinit x86_configure_nx(void)
21885 {
21886 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
21887 if (cpu_has_nx && !disable_nx)
21888 __supported_pte_mask |= _PAGE_NX;
21889 else
21890 +#endif
21891 __supported_pte_mask &= ~_PAGE_NX;
21892 }
21893
21894 diff -urNp linux-3.0.8/arch/x86/mm/tlb.c linux-3.0.8/arch/x86/mm/tlb.c
21895 --- linux-3.0.8/arch/x86/mm/tlb.c 2011-07-21 22:17:23.000000000 -0400
21896 +++ linux-3.0.8/arch/x86/mm/tlb.c 2011-08-23 21:47:55.000000000 -0400
21897 @@ -65,7 +65,11 @@ void leave_mm(int cpu)
21898 BUG();
21899 cpumask_clear_cpu(cpu,
21900 mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
21901 +
21902 +#ifndef CONFIG_PAX_PER_CPU_PGD
21903 load_cr3(swapper_pg_dir);
21904 +#endif
21905 +
21906 }
21907 EXPORT_SYMBOL_GPL(leave_mm);
21908
21909 diff -urNp linux-3.0.8/arch/x86/net/bpf_jit_comp.c linux-3.0.8/arch/x86/net/bpf_jit_comp.c
21910 --- linux-3.0.8/arch/x86/net/bpf_jit_comp.c 2011-07-21 22:17:23.000000000 -0400
21911 +++ linux-3.0.8/arch/x86/net/bpf_jit_comp.c 2011-08-23 21:47:55.000000000 -0400
21912 @@ -589,7 +589,9 @@ cond_branch: f_offset = addrs[i + filt
21913 module_free(NULL, image);
21914 return;
21915 }
21916 + pax_open_kernel();
21917 memcpy(image + proglen, temp, ilen);
21918 + pax_close_kernel();
21919 }
21920 proglen += ilen;
21921 addrs[i] = proglen;
21922 @@ -609,7 +611,7 @@ cond_branch: f_offset = addrs[i + filt
21923 break;
21924 }
21925 if (proglen == oldproglen) {
21926 - image = module_alloc(max_t(unsigned int,
21927 + image = module_alloc_exec(max_t(unsigned int,
21928 proglen,
21929 sizeof(struct work_struct)));
21930 if (!image)
21931 diff -urNp linux-3.0.8/arch/x86/net/bpf_jit.S linux-3.0.8/arch/x86/net/bpf_jit.S
21932 --- linux-3.0.8/arch/x86/net/bpf_jit.S 2011-07-21 22:17:23.000000000 -0400
21933 +++ linux-3.0.8/arch/x86/net/bpf_jit.S 2011-10-07 19:07:28.000000000 -0400
21934 @@ -9,6 +9,7 @@
21935 */
21936 #include <linux/linkage.h>
21937 #include <asm/dwarf2.h>
21938 +#include <asm/alternative-asm.h>
21939
21940 /*
21941 * Calling convention :
21942 @@ -35,6 +36,7 @@ sk_load_word:
21943 jle bpf_slow_path_word
21944 mov (SKBDATA,%rsi),%eax
21945 bswap %eax /* ntohl() */
21946 + pax_force_retaddr
21947 ret
21948
21949
21950 @@ -53,6 +55,7 @@ sk_load_half:
21951 jle bpf_slow_path_half
21952 movzwl (SKBDATA,%rsi),%eax
21953 rol $8,%ax # ntohs()
21954 + pax_force_retaddr
21955 ret
21956
21957 sk_load_byte_ind:
21958 @@ -66,6 +69,7 @@ sk_load_byte:
21959 cmp %esi,%r9d /* if (offset >= hlen) goto bpf_slow_path_byte */
21960 jle bpf_slow_path_byte
21961 movzbl (SKBDATA,%rsi),%eax
21962 + pax_force_retaddr
21963 ret
21964
21965 /**
21966 @@ -82,6 +86,7 @@ ENTRY(sk_load_byte_msh)
21967 movzbl (SKBDATA,%rsi),%ebx
21968 and $15,%bl
21969 shl $2,%bl
21970 + pax_force_retaddr
21971 ret
21972 CFI_ENDPROC
21973 ENDPROC(sk_load_byte_msh)
21974 @@ -91,6 +96,7 @@ bpf_error:
21975 xor %eax,%eax
21976 mov -8(%rbp),%rbx
21977 leaveq
21978 + pax_force_retaddr
21979 ret
21980
21981 /* rsi contains offset and can be scratched */
21982 @@ -113,6 +119,7 @@ bpf_slow_path_word:
21983 js bpf_error
21984 mov -12(%rbp),%eax
21985 bswap %eax
21986 + pax_force_retaddr
21987 ret
21988
21989 bpf_slow_path_half:
21990 @@ -121,12 +128,14 @@ bpf_slow_path_half:
21991 mov -12(%rbp),%ax
21992 rol $8,%ax
21993 movzwl %ax,%eax
21994 + pax_force_retaddr
21995 ret
21996
21997 bpf_slow_path_byte:
21998 bpf_slow_path_common(1)
21999 js bpf_error
22000 movzbl -12(%rbp),%eax
22001 + pax_force_retaddr
22002 ret
22003
22004 bpf_slow_path_byte_msh:
22005 @@ -137,4 +146,5 @@ bpf_slow_path_byte_msh:
22006 and $15,%al
22007 shl $2,%al
22008 xchg %eax,%ebx
22009 + pax_force_retaddr
22010 ret
22011 diff -urNp linux-3.0.8/arch/x86/oprofile/backtrace.c linux-3.0.8/arch/x86/oprofile/backtrace.c
22012 --- linux-3.0.8/arch/x86/oprofile/backtrace.c 2011-10-24 08:05:21.000000000 -0400
22013 +++ linux-3.0.8/arch/x86/oprofile/backtrace.c 2011-10-06 04:17:55.000000000 -0400
22014 @@ -83,11 +83,11 @@ dump_user_backtrace_32(struct stack_fram
22015 struct stack_frame_ia32 *fp;
22016 unsigned long bytes;
22017
22018 - bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
22019 + bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead));
22020 if (bytes != sizeof(bufhead))
22021 return NULL;
22022
22023 - fp = (struct stack_frame_ia32 *) compat_ptr(bufhead[0].next_frame);
22024 + fp = (struct stack_frame_ia32 __force_kernel *) compat_ptr(bufhead[0].next_frame);
22025
22026 oprofile_add_trace(bufhead[0].return_address);
22027
22028 @@ -129,7 +129,7 @@ static struct stack_frame *dump_user_bac
22029 struct stack_frame bufhead[2];
22030 unsigned long bytes;
22031
22032 - bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
22033 + bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead));
22034 if (bytes != sizeof(bufhead))
22035 return NULL;
22036
22037 @@ -148,7 +148,7 @@ x86_backtrace(struct pt_regs * const reg
22038 {
22039 struct stack_frame *head = (struct stack_frame *)frame_pointer(regs);
22040
22041 - if (!user_mode_vm(regs)) {
22042 + if (!user_mode(regs)) {
22043 unsigned long stack = kernel_stack_pointer(regs);
22044 if (depth)
22045 dump_trace(NULL, regs, (unsigned long *)stack, 0,
22046 diff -urNp linux-3.0.8/arch/x86/pci/mrst.c linux-3.0.8/arch/x86/pci/mrst.c
22047 --- linux-3.0.8/arch/x86/pci/mrst.c 2011-07-21 22:17:23.000000000 -0400
22048 +++ linux-3.0.8/arch/x86/pci/mrst.c 2011-08-23 21:47:55.000000000 -0400
22049 @@ -234,7 +234,9 @@ int __init pci_mrst_init(void)
22050 printk(KERN_INFO "Moorestown platform detected, using MRST PCI ops\n");
22051 pci_mmcfg_late_init();
22052 pcibios_enable_irq = mrst_pci_irq_enable;
22053 - pci_root_ops = pci_mrst_ops;
22054 + pax_open_kernel();
22055 + memcpy((void *)&pci_root_ops, &pci_mrst_ops, sizeof(pci_mrst_ops));
22056 + pax_close_kernel();
22057 /* Continue with standard init */
22058 return 1;
22059 }
22060 diff -urNp linux-3.0.8/arch/x86/pci/pcbios.c linux-3.0.8/arch/x86/pci/pcbios.c
22061 --- linux-3.0.8/arch/x86/pci/pcbios.c 2011-07-21 22:17:23.000000000 -0400
22062 +++ linux-3.0.8/arch/x86/pci/pcbios.c 2011-08-23 21:47:55.000000000 -0400
22063 @@ -79,50 +79,93 @@ union bios32 {
22064 static struct {
22065 unsigned long address;
22066 unsigned short segment;
22067 -} bios32_indirect = { 0, __KERNEL_CS };
22068 +} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
22069
22070 /*
22071 * Returns the entry point for the given service, NULL on error
22072 */
22073
22074 -static unsigned long bios32_service(unsigned long service)
22075 +static unsigned long __devinit bios32_service(unsigned long service)
22076 {
22077 unsigned char return_code; /* %al */
22078 unsigned long address; /* %ebx */
22079 unsigned long length; /* %ecx */
22080 unsigned long entry; /* %edx */
22081 unsigned long flags;
22082 + struct desc_struct d, *gdt;
22083
22084 local_irq_save(flags);
22085 - __asm__("lcall *(%%edi); cld"
22086 +
22087 + gdt = get_cpu_gdt_table(smp_processor_id());
22088 +
22089 + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
22090 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
22091 + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
22092 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
22093 +
22094 + __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
22095 : "=a" (return_code),
22096 "=b" (address),
22097 "=c" (length),
22098 "=d" (entry)
22099 : "0" (service),
22100 "1" (0),
22101 - "D" (&bios32_indirect));
22102 + "D" (&bios32_indirect),
22103 + "r"(__PCIBIOS_DS)
22104 + : "memory");
22105 +
22106 + pax_open_kernel();
22107 + gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
22108 + gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
22109 + gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
22110 + gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
22111 + pax_close_kernel();
22112 +
22113 local_irq_restore(flags);
22114
22115 switch (return_code) {
22116 - case 0:
22117 - return address + entry;
22118 - case 0x80: /* Not present */
22119 - printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
22120 - return 0;
22121 - default: /* Shouldn't happen */
22122 - printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
22123 - service, return_code);
22124 + case 0: {
22125 + int cpu;
22126 + unsigned char flags;
22127 +
22128 + printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
22129 + if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
22130 + printk(KERN_WARNING "bios32_service: not valid\n");
22131 return 0;
22132 + }
22133 + address = address + PAGE_OFFSET;
22134 + length += 16UL; /* some BIOSs underreport this... */
22135 + flags = 4;
22136 + if (length >= 64*1024*1024) {
22137 + length >>= PAGE_SHIFT;
22138 + flags |= 8;
22139 + }
22140 +
22141 + for (cpu = 0; cpu < NR_CPUS; cpu++) {
22142 + gdt = get_cpu_gdt_table(cpu);
22143 + pack_descriptor(&d, address, length, 0x9b, flags);
22144 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
22145 + pack_descriptor(&d, address, length, 0x93, flags);
22146 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
22147 + }
22148 + return entry;
22149 + }
22150 + case 0x80: /* Not present */
22151 + printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
22152 + return 0;
22153 + default: /* Shouldn't happen */
22154 + printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
22155 + service, return_code);
22156 + return 0;
22157 }
22158 }
22159
22160 static struct {
22161 unsigned long address;
22162 unsigned short segment;
22163 -} pci_indirect = { 0, __KERNEL_CS };
22164 +} pci_indirect __read_only = { 0, __PCIBIOS_CS };
22165
22166 -static int pci_bios_present;
22167 +static int pci_bios_present __read_only;
22168
22169 static int __devinit check_pcibios(void)
22170 {
22171 @@ -131,11 +174,13 @@ static int __devinit check_pcibios(void)
22172 unsigned long flags, pcibios_entry;
22173
22174 if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
22175 - pci_indirect.address = pcibios_entry + PAGE_OFFSET;
22176 + pci_indirect.address = pcibios_entry;
22177
22178 local_irq_save(flags);
22179 - __asm__(
22180 - "lcall *(%%edi); cld\n\t"
22181 + __asm__("movw %w6, %%ds\n\t"
22182 + "lcall *%%ss:(%%edi); cld\n\t"
22183 + "push %%ss\n\t"
22184 + "pop %%ds\n\t"
22185 "jc 1f\n\t"
22186 "xor %%ah, %%ah\n"
22187 "1:"
22188 @@ -144,7 +189,8 @@ static int __devinit check_pcibios(void)
22189 "=b" (ebx),
22190 "=c" (ecx)
22191 : "1" (PCIBIOS_PCI_BIOS_PRESENT),
22192 - "D" (&pci_indirect)
22193 + "D" (&pci_indirect),
22194 + "r" (__PCIBIOS_DS)
22195 : "memory");
22196 local_irq_restore(flags);
22197
22198 @@ -188,7 +234,10 @@ static int pci_bios_read(unsigned int se
22199
22200 switch (len) {
22201 case 1:
22202 - __asm__("lcall *(%%esi); cld\n\t"
22203 + __asm__("movw %w6, %%ds\n\t"
22204 + "lcall *%%ss:(%%esi); cld\n\t"
22205 + "push %%ss\n\t"
22206 + "pop %%ds\n\t"
22207 "jc 1f\n\t"
22208 "xor %%ah, %%ah\n"
22209 "1:"
22210 @@ -197,7 +246,8 @@ static int pci_bios_read(unsigned int se
22211 : "1" (PCIBIOS_READ_CONFIG_BYTE),
22212 "b" (bx),
22213 "D" ((long)reg),
22214 - "S" (&pci_indirect));
22215 + "S" (&pci_indirect),
22216 + "r" (__PCIBIOS_DS));
22217 /*
22218 * Zero-extend the result beyond 8 bits, do not trust the
22219 * BIOS having done it:
22220 @@ -205,7 +255,10 @@ static int pci_bios_read(unsigned int se
22221 *value &= 0xff;
22222 break;
22223 case 2:
22224 - __asm__("lcall *(%%esi); cld\n\t"
22225 + __asm__("movw %w6, %%ds\n\t"
22226 + "lcall *%%ss:(%%esi); cld\n\t"
22227 + "push %%ss\n\t"
22228 + "pop %%ds\n\t"
22229 "jc 1f\n\t"
22230 "xor %%ah, %%ah\n"
22231 "1:"
22232 @@ -214,7 +267,8 @@ static int pci_bios_read(unsigned int se
22233 : "1" (PCIBIOS_READ_CONFIG_WORD),
22234 "b" (bx),
22235 "D" ((long)reg),
22236 - "S" (&pci_indirect));
22237 + "S" (&pci_indirect),
22238 + "r" (__PCIBIOS_DS));
22239 /*
22240 * Zero-extend the result beyond 16 bits, do not trust the
22241 * BIOS having done it:
22242 @@ -222,7 +276,10 @@ static int pci_bios_read(unsigned int se
22243 *value &= 0xffff;
22244 break;
22245 case 4:
22246 - __asm__("lcall *(%%esi); cld\n\t"
22247 + __asm__("movw %w6, %%ds\n\t"
22248 + "lcall *%%ss:(%%esi); cld\n\t"
22249 + "push %%ss\n\t"
22250 + "pop %%ds\n\t"
22251 "jc 1f\n\t"
22252 "xor %%ah, %%ah\n"
22253 "1:"
22254 @@ -231,7 +288,8 @@ static int pci_bios_read(unsigned int se
22255 : "1" (PCIBIOS_READ_CONFIG_DWORD),
22256 "b" (bx),
22257 "D" ((long)reg),
22258 - "S" (&pci_indirect));
22259 + "S" (&pci_indirect),
22260 + "r" (__PCIBIOS_DS));
22261 break;
22262 }
22263
22264 @@ -254,7 +312,10 @@ static int pci_bios_write(unsigned int s
22265
22266 switch (len) {
22267 case 1:
22268 - __asm__("lcall *(%%esi); cld\n\t"
22269 + __asm__("movw %w6, %%ds\n\t"
22270 + "lcall *%%ss:(%%esi); cld\n\t"
22271 + "push %%ss\n\t"
22272 + "pop %%ds\n\t"
22273 "jc 1f\n\t"
22274 "xor %%ah, %%ah\n"
22275 "1:"
22276 @@ -263,10 +324,14 @@ static int pci_bios_write(unsigned int s
22277 "c" (value),
22278 "b" (bx),
22279 "D" ((long)reg),
22280 - "S" (&pci_indirect));
22281 + "S" (&pci_indirect),
22282 + "r" (__PCIBIOS_DS));
22283 break;
22284 case 2:
22285 - __asm__("lcall *(%%esi); cld\n\t"
22286 + __asm__("movw %w6, %%ds\n\t"
22287 + "lcall *%%ss:(%%esi); cld\n\t"
22288 + "push %%ss\n\t"
22289 + "pop %%ds\n\t"
22290 "jc 1f\n\t"
22291 "xor %%ah, %%ah\n"
22292 "1:"
22293 @@ -275,10 +340,14 @@ static int pci_bios_write(unsigned int s
22294 "c" (value),
22295 "b" (bx),
22296 "D" ((long)reg),
22297 - "S" (&pci_indirect));
22298 + "S" (&pci_indirect),
22299 + "r" (__PCIBIOS_DS));
22300 break;
22301 case 4:
22302 - __asm__("lcall *(%%esi); cld\n\t"
22303 + __asm__("movw %w6, %%ds\n\t"
22304 + "lcall *%%ss:(%%esi); cld\n\t"
22305 + "push %%ss\n\t"
22306 + "pop %%ds\n\t"
22307 "jc 1f\n\t"
22308 "xor %%ah, %%ah\n"
22309 "1:"
22310 @@ -287,7 +356,8 @@ static int pci_bios_write(unsigned int s
22311 "c" (value),
22312 "b" (bx),
22313 "D" ((long)reg),
22314 - "S" (&pci_indirect));
22315 + "S" (&pci_indirect),
22316 + "r" (__PCIBIOS_DS));
22317 break;
22318 }
22319
22320 @@ -392,10 +462,13 @@ struct irq_routing_table * pcibios_get_i
22321
22322 DBG("PCI: Fetching IRQ routing table... ");
22323 __asm__("push %%es\n\t"
22324 + "movw %w8, %%ds\n\t"
22325 "push %%ds\n\t"
22326 "pop %%es\n\t"
22327 - "lcall *(%%esi); cld\n\t"
22328 + "lcall *%%ss:(%%esi); cld\n\t"
22329 "pop %%es\n\t"
22330 + "push %%ss\n\t"
22331 + "pop %%ds\n"
22332 "jc 1f\n\t"
22333 "xor %%ah, %%ah\n"
22334 "1:"
22335 @@ -406,7 +479,8 @@ struct irq_routing_table * pcibios_get_i
22336 "1" (0),
22337 "D" ((long) &opt),
22338 "S" (&pci_indirect),
22339 - "m" (opt)
22340 + "m" (opt),
22341 + "r" (__PCIBIOS_DS)
22342 : "memory");
22343 DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
22344 if (ret & 0xff00)
22345 @@ -430,7 +504,10 @@ int pcibios_set_irq_routing(struct pci_d
22346 {
22347 int ret;
22348
22349 - __asm__("lcall *(%%esi); cld\n\t"
22350 + __asm__("movw %w5, %%ds\n\t"
22351 + "lcall *%%ss:(%%esi); cld\n\t"
22352 + "push %%ss\n\t"
22353 + "pop %%ds\n"
22354 "jc 1f\n\t"
22355 "xor %%ah, %%ah\n"
22356 "1:"
22357 @@ -438,7 +515,8 @@ int pcibios_set_irq_routing(struct pci_d
22358 : "0" (PCIBIOS_SET_PCI_HW_INT),
22359 "b" ((dev->bus->number << 8) | dev->devfn),
22360 "c" ((irq << 8) | (pin + 10)),
22361 - "S" (&pci_indirect));
22362 + "S" (&pci_indirect),
22363 + "r" (__PCIBIOS_DS));
22364 return !(ret & 0xff00);
22365 }
22366 EXPORT_SYMBOL(pcibios_set_irq_routing);
22367 diff -urNp linux-3.0.8/arch/x86/platform/efi/efi_32.c linux-3.0.8/arch/x86/platform/efi/efi_32.c
22368 --- linux-3.0.8/arch/x86/platform/efi/efi_32.c 2011-07-21 22:17:23.000000000 -0400
22369 +++ linux-3.0.8/arch/x86/platform/efi/efi_32.c 2011-10-06 04:17:55.000000000 -0400
22370 @@ -38,70 +38,56 @@
22371 */
22372
22373 static unsigned long efi_rt_eflags;
22374 -static pgd_t efi_bak_pg_dir_pointer[2];
22375 +static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
22376
22377 -void efi_call_phys_prelog(void)
22378 +void __init efi_call_phys_prelog(void)
22379 {
22380 - unsigned long cr4;
22381 - unsigned long temp;
22382 struct desc_ptr gdt_descr;
22383
22384 - local_irq_save(efi_rt_eflags);
22385 +#ifdef CONFIG_PAX_KERNEXEC
22386 + struct desc_struct d;
22387 +#endif
22388
22389 - /*
22390 - * If I don't have PAE, I should just duplicate two entries in page
22391 - * directory. If I have PAE, I just need to duplicate one entry in
22392 - * page directory.
22393 - */
22394 - cr4 = read_cr4_safe();
22395 + local_irq_save(efi_rt_eflags);
22396
22397 - if (cr4 & X86_CR4_PAE) {
22398 - efi_bak_pg_dir_pointer[0].pgd =
22399 - swapper_pg_dir[pgd_index(0)].pgd;
22400 - swapper_pg_dir[0].pgd =
22401 - swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
22402 - } else {
22403 - efi_bak_pg_dir_pointer[0].pgd =
22404 - swapper_pg_dir[pgd_index(0)].pgd;
22405 - efi_bak_pg_dir_pointer[1].pgd =
22406 - swapper_pg_dir[pgd_index(0x400000)].pgd;
22407 - swapper_pg_dir[pgd_index(0)].pgd =
22408 - swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
22409 - temp = PAGE_OFFSET + 0x400000;
22410 - swapper_pg_dir[pgd_index(0x400000)].pgd =
22411 - swapper_pg_dir[pgd_index(temp)].pgd;
22412 - }
22413 + clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
22414 + clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22415 + min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
22416
22417 /*
22418 * After the lock is released, the original page table is restored.
22419 */
22420 __flush_tlb_all();
22421
22422 +#ifdef CONFIG_PAX_KERNEXEC
22423 + pack_descriptor(&d, 0, 0xFFFFF, 0x9B, 0xC);
22424 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
22425 + pack_descriptor(&d, 0, 0xFFFFF, 0x93, 0xC);
22426 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
22427 +#endif
22428 +
22429 gdt_descr.address = __pa(get_cpu_gdt_table(0));
22430 gdt_descr.size = GDT_SIZE - 1;
22431 load_gdt(&gdt_descr);
22432 }
22433
22434 -void efi_call_phys_epilog(void)
22435 +void __init efi_call_phys_epilog(void)
22436 {
22437 - unsigned long cr4;
22438 struct desc_ptr gdt_descr;
22439
22440 +#ifdef CONFIG_PAX_KERNEXEC
22441 + struct desc_struct d;
22442 +
22443 + memset(&d, 0, sizeof d);
22444 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
22445 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
22446 +#endif
22447 +
22448 gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
22449 gdt_descr.size = GDT_SIZE - 1;
22450 load_gdt(&gdt_descr);
22451
22452 - cr4 = read_cr4_safe();
22453 -
22454 - if (cr4 & X86_CR4_PAE) {
22455 - swapper_pg_dir[pgd_index(0)].pgd =
22456 - efi_bak_pg_dir_pointer[0].pgd;
22457 - } else {
22458 - swapper_pg_dir[pgd_index(0)].pgd =
22459 - efi_bak_pg_dir_pointer[0].pgd;
22460 - swapper_pg_dir[pgd_index(0x400000)].pgd =
22461 - efi_bak_pg_dir_pointer[1].pgd;
22462 - }
22463 + clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
22464
22465 /*
22466 * After the lock is released, the original page table is restored.
22467 diff -urNp linux-3.0.8/arch/x86/platform/efi/efi_stub_32.S linux-3.0.8/arch/x86/platform/efi/efi_stub_32.S
22468 --- linux-3.0.8/arch/x86/platform/efi/efi_stub_32.S 2011-07-21 22:17:23.000000000 -0400
22469 +++ linux-3.0.8/arch/x86/platform/efi/efi_stub_32.S 2011-09-19 09:16:58.000000000 -0400
22470 @@ -6,7 +6,9 @@
22471 */
22472
22473 #include <linux/linkage.h>
22474 +#include <linux/init.h>
22475 #include <asm/page_types.h>
22476 +#include <asm/segment.h>
22477
22478 /*
22479 * efi_call_phys(void *, ...) is a function with variable parameters.
22480 @@ -20,7 +22,7 @@
22481 * service functions will comply with gcc calling convention, too.
22482 */
22483
22484 -.text
22485 +__INIT
22486 ENTRY(efi_call_phys)
22487 /*
22488 * 0. The function can only be called in Linux kernel. So CS has been
22489 @@ -36,9 +38,11 @@ ENTRY(efi_call_phys)
22490 * The mapping of lower virtual memory has been created in prelog and
22491 * epilog.
22492 */
22493 - movl $1f, %edx
22494 - subl $__PAGE_OFFSET, %edx
22495 - jmp *%edx
22496 + movl $(__KERNEXEC_EFI_DS), %edx
22497 + mov %edx, %ds
22498 + mov %edx, %es
22499 + mov %edx, %ss
22500 + ljmp $(__KERNEXEC_EFI_CS),$1f-__PAGE_OFFSET
22501 1:
22502
22503 /*
22504 @@ -47,14 +51,8 @@ ENTRY(efi_call_phys)
22505 * parameter 2, ..., param n. To make things easy, we save the return
22506 * address of efi_call_phys in a global variable.
22507 */
22508 - popl %edx
22509 - movl %edx, saved_return_addr
22510 - /* get the function pointer into ECX*/
22511 - popl %ecx
22512 - movl %ecx, efi_rt_function_ptr
22513 - movl $2f, %edx
22514 - subl $__PAGE_OFFSET, %edx
22515 - pushl %edx
22516 + popl (saved_return_addr)
22517 + popl (efi_rt_function_ptr)
22518
22519 /*
22520 * 3. Clear PG bit in %CR0.
22521 @@ -73,9 +71,8 @@ ENTRY(efi_call_phys)
22522 /*
22523 * 5. Call the physical function.
22524 */
22525 - jmp *%ecx
22526 + call *(efi_rt_function_ptr-__PAGE_OFFSET)
22527
22528 -2:
22529 /*
22530 * 6. After EFI runtime service returns, control will return to
22531 * following instruction. We'd better readjust stack pointer first.
22532 @@ -88,35 +85,32 @@ ENTRY(efi_call_phys)
22533 movl %cr0, %edx
22534 orl $0x80000000, %edx
22535 movl %edx, %cr0
22536 - jmp 1f
22537 -1:
22538 +
22539 /*
22540 * 8. Now restore the virtual mode from flat mode by
22541 * adding EIP with PAGE_OFFSET.
22542 */
22543 - movl $1f, %edx
22544 - jmp *%edx
22545 + ljmp $(__KERNEL_CS),$1f+__PAGE_OFFSET
22546 1:
22547 + movl $(__KERNEL_DS), %edx
22548 + mov %edx, %ds
22549 + mov %edx, %es
22550 + mov %edx, %ss
22551
22552 /*
22553 * 9. Balance the stack. And because EAX contain the return value,
22554 * we'd better not clobber it.
22555 */
22556 - leal efi_rt_function_ptr, %edx
22557 - movl (%edx), %ecx
22558 - pushl %ecx
22559 + pushl (efi_rt_function_ptr)
22560
22561 /*
22562 - * 10. Push the saved return address onto the stack and return.
22563 + * 10. Return to the saved return address.
22564 */
22565 - leal saved_return_addr, %edx
22566 - movl (%edx), %ecx
22567 - pushl %ecx
22568 - ret
22569 + jmpl *(saved_return_addr)
22570 ENDPROC(efi_call_phys)
22571 .previous
22572
22573 -.data
22574 +__INITDATA
22575 saved_return_addr:
22576 .long 0
22577 efi_rt_function_ptr:
22578 diff -urNp linux-3.0.8/arch/x86/platform/efi/efi_stub_64.S linux-3.0.8/arch/x86/platform/efi/efi_stub_64.S
22579 --- linux-3.0.8/arch/x86/platform/efi/efi_stub_64.S 2011-07-21 22:17:23.000000000 -0400
22580 +++ linux-3.0.8/arch/x86/platform/efi/efi_stub_64.S 2011-10-06 04:17:55.000000000 -0400
22581 @@ -7,6 +7,7 @@
22582 */
22583
22584 #include <linux/linkage.h>
22585 +#include <asm/alternative-asm.h>
22586
22587 #define SAVE_XMM \
22588 mov %rsp, %rax; \
22589 @@ -40,6 +41,7 @@ ENTRY(efi_call0)
22590 call *%rdi
22591 addq $32, %rsp
22592 RESTORE_XMM
22593 + pax_force_retaddr
22594 ret
22595 ENDPROC(efi_call0)
22596
22597 @@ -50,6 +52,7 @@ ENTRY(efi_call1)
22598 call *%rdi
22599 addq $32, %rsp
22600 RESTORE_XMM
22601 + pax_force_retaddr
22602 ret
22603 ENDPROC(efi_call1)
22604
22605 @@ -60,6 +63,7 @@ ENTRY(efi_call2)
22606 call *%rdi
22607 addq $32, %rsp
22608 RESTORE_XMM
22609 + pax_force_retaddr
22610 ret
22611 ENDPROC(efi_call2)
22612
22613 @@ -71,6 +75,7 @@ ENTRY(efi_call3)
22614 call *%rdi
22615 addq $32, %rsp
22616 RESTORE_XMM
22617 + pax_force_retaddr
22618 ret
22619 ENDPROC(efi_call3)
22620
22621 @@ -83,6 +88,7 @@ ENTRY(efi_call4)
22622 call *%rdi
22623 addq $32, %rsp
22624 RESTORE_XMM
22625 + pax_force_retaddr
22626 ret
22627 ENDPROC(efi_call4)
22628
22629 @@ -96,6 +102,7 @@ ENTRY(efi_call5)
22630 call *%rdi
22631 addq $48, %rsp
22632 RESTORE_XMM
22633 + pax_force_retaddr
22634 ret
22635 ENDPROC(efi_call5)
22636
22637 @@ -112,5 +119,6 @@ ENTRY(efi_call6)
22638 call *%rdi
22639 addq $48, %rsp
22640 RESTORE_XMM
22641 + pax_force_retaddr
22642 ret
22643 ENDPROC(efi_call6)
22644 diff -urNp linux-3.0.8/arch/x86/platform/mrst/mrst.c linux-3.0.8/arch/x86/platform/mrst/mrst.c
22645 --- linux-3.0.8/arch/x86/platform/mrst/mrst.c 2011-07-21 22:17:23.000000000 -0400
22646 +++ linux-3.0.8/arch/x86/platform/mrst/mrst.c 2011-08-23 21:47:55.000000000 -0400
22647 @@ -239,14 +239,16 @@ static int mrst_i8042_detect(void)
22648 }
22649
22650 /* Reboot and power off are handled by the SCU on a MID device */
22651 -static void mrst_power_off(void)
22652 +static __noreturn void mrst_power_off(void)
22653 {
22654 intel_scu_ipc_simple_command(0xf1, 1);
22655 + BUG();
22656 }
22657
22658 -static void mrst_reboot(void)
22659 +static __noreturn void mrst_reboot(void)
22660 {
22661 intel_scu_ipc_simple_command(0xf1, 0);
22662 + BUG();
22663 }
22664
22665 /*
22666 diff -urNp linux-3.0.8/arch/x86/platform/uv/tlb_uv.c linux-3.0.8/arch/x86/platform/uv/tlb_uv.c
22667 --- linux-3.0.8/arch/x86/platform/uv/tlb_uv.c 2011-07-21 22:17:23.000000000 -0400
22668 +++ linux-3.0.8/arch/x86/platform/uv/tlb_uv.c 2011-08-23 21:48:14.000000000 -0400
22669 @@ -373,6 +373,8 @@ static void reset_with_ipi(struct bau_ta
22670 cpumask_t mask;
22671 struct reset_args reset_args;
22672
22673 + pax_track_stack();
22674 +
22675 reset_args.sender = sender;
22676 cpus_clear(mask);
22677 /* find a single cpu for each uvhub in this distribution mask */
22678 diff -urNp linux-3.0.8/arch/x86/power/cpu.c linux-3.0.8/arch/x86/power/cpu.c
22679 --- linux-3.0.8/arch/x86/power/cpu.c 2011-07-21 22:17:23.000000000 -0400
22680 +++ linux-3.0.8/arch/x86/power/cpu.c 2011-08-23 21:47:55.000000000 -0400
22681 @@ -130,7 +130,7 @@ static void do_fpu_end(void)
22682 static void fix_processor_context(void)
22683 {
22684 int cpu = smp_processor_id();
22685 - struct tss_struct *t = &per_cpu(init_tss, cpu);
22686 + struct tss_struct *t = init_tss + cpu;
22687
22688 set_tss_desc(cpu, t); /*
22689 * This just modifies memory; should not be
22690 @@ -140,7 +140,9 @@ static void fix_processor_context(void)
22691 */
22692
22693 #ifdef CONFIG_X86_64
22694 + pax_open_kernel();
22695 get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
22696 + pax_close_kernel();
22697
22698 syscall_init(); /* This sets MSR_*STAR and related */
22699 #endif
22700 diff -urNp linux-3.0.8/arch/x86/vdso/Makefile linux-3.0.8/arch/x86/vdso/Makefile
22701 --- linux-3.0.8/arch/x86/vdso/Makefile 2011-07-21 22:17:23.000000000 -0400
22702 +++ linux-3.0.8/arch/x86/vdso/Makefile 2011-08-23 21:47:55.000000000 -0400
22703 @@ -136,7 +136,7 @@ quiet_cmd_vdso = VDSO $@
22704 -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
22705 sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
22706
22707 -VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
22708 +VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
22709 GCOV_PROFILE := n
22710
22711 #
22712 diff -urNp linux-3.0.8/arch/x86/vdso/vdso32-setup.c linux-3.0.8/arch/x86/vdso/vdso32-setup.c
22713 --- linux-3.0.8/arch/x86/vdso/vdso32-setup.c 2011-07-21 22:17:23.000000000 -0400
22714 +++ linux-3.0.8/arch/x86/vdso/vdso32-setup.c 2011-08-23 21:47:55.000000000 -0400
22715 @@ -25,6 +25,7 @@
22716 #include <asm/tlbflush.h>
22717 #include <asm/vdso.h>
22718 #include <asm/proto.h>
22719 +#include <asm/mman.h>
22720
22721 enum {
22722 VDSO_DISABLED = 0,
22723 @@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m
22724 void enable_sep_cpu(void)
22725 {
22726 int cpu = get_cpu();
22727 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
22728 + struct tss_struct *tss = init_tss + cpu;
22729
22730 if (!boot_cpu_has(X86_FEATURE_SEP)) {
22731 put_cpu();
22732 @@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
22733 gate_vma.vm_start = FIXADDR_USER_START;
22734 gate_vma.vm_end = FIXADDR_USER_END;
22735 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
22736 - gate_vma.vm_page_prot = __P101;
22737 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
22738 /*
22739 * Make sure the vDSO gets into every core dump.
22740 * Dumping its contents makes post-mortem fully interpretable later
22741 @@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l
22742 if (compat)
22743 addr = VDSO_HIGH_BASE;
22744 else {
22745 - addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
22746 + addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
22747 if (IS_ERR_VALUE(addr)) {
22748 ret = addr;
22749 goto up_fail;
22750 }
22751 }
22752
22753 - current->mm->context.vdso = (void *)addr;
22754 + current->mm->context.vdso = addr;
22755
22756 if (compat_uses_vma || !compat) {
22757 /*
22758 @@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l
22759 }
22760
22761 current_thread_info()->sysenter_return =
22762 - VDSO32_SYMBOL(addr, SYSENTER_RETURN);
22763 + (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
22764
22765 up_fail:
22766 if (ret)
22767 - current->mm->context.vdso = NULL;
22768 + current->mm->context.vdso = 0;
22769
22770 up_write(&mm->mmap_sem);
22771
22772 @@ -412,8 +413,14 @@ __initcall(ia32_binfmt_init);
22773
22774 const char *arch_vma_name(struct vm_area_struct *vma)
22775 {
22776 - if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
22777 + if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
22778 return "[vdso]";
22779 +
22780 +#ifdef CONFIG_PAX_SEGMEXEC
22781 + if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
22782 + return "[vdso]";
22783 +#endif
22784 +
22785 return NULL;
22786 }
22787
22788 @@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(stru
22789 * Check to see if the corresponding task was created in compat vdso
22790 * mode.
22791 */
22792 - if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
22793 + if (mm && mm->context.vdso == VDSO_HIGH_BASE)
22794 return &gate_vma;
22795 return NULL;
22796 }
22797 diff -urNp linux-3.0.8/arch/x86/vdso/vma.c linux-3.0.8/arch/x86/vdso/vma.c
22798 --- linux-3.0.8/arch/x86/vdso/vma.c 2011-07-21 22:17:23.000000000 -0400
22799 +++ linux-3.0.8/arch/x86/vdso/vma.c 2011-08-23 21:47:55.000000000 -0400
22800 @@ -15,18 +15,19 @@
22801 #include <asm/proto.h>
22802 #include <asm/vdso.h>
22803
22804 -unsigned int __read_mostly vdso_enabled = 1;
22805 -
22806 extern char vdso_start[], vdso_end[];
22807 extern unsigned short vdso_sync_cpuid;
22808 +extern char __vsyscall_0;
22809
22810 static struct page **vdso_pages;
22811 +static struct page *vsyscall_page;
22812 static unsigned vdso_size;
22813
22814 static int __init init_vdso_vars(void)
22815 {
22816 - int npages = (vdso_end - vdso_start + PAGE_SIZE - 1) / PAGE_SIZE;
22817 - int i;
22818 + size_t nbytes = vdso_end - vdso_start;
22819 + size_t npages = (nbytes + PAGE_SIZE - 1) / PAGE_SIZE;
22820 + size_t i;
22821
22822 vdso_size = npages << PAGE_SHIFT;
22823 vdso_pages = kmalloc(sizeof(struct page *) * npages, GFP_KERNEL);
22824 @@ -34,19 +35,19 @@ static int __init init_vdso_vars(void)
22825 goto oom;
22826 for (i = 0; i < npages; i++) {
22827 struct page *p;
22828 - p = alloc_page(GFP_KERNEL);
22829 + p = alloc_page(GFP_KERNEL | __GFP_ZERO);
22830 if (!p)
22831 goto oom;
22832 vdso_pages[i] = p;
22833 - copy_page(page_address(p), vdso_start + i*PAGE_SIZE);
22834 + memcpy(page_address(p), vdso_start + i*PAGE_SIZE, nbytes > PAGE_SIZE ? PAGE_SIZE : nbytes);
22835 + nbytes -= PAGE_SIZE;
22836 }
22837 + vsyscall_page = pfn_to_page((__pa_symbol(&__vsyscall_0)) >> PAGE_SHIFT);
22838
22839 return 0;
22840
22841 oom:
22842 - printk("Cannot allocate vdso\n");
22843 - vdso_enabled = 0;
22844 - return -ENOMEM;
22845 + panic("Cannot allocate vdso\n");
22846 }
22847 subsys_initcall(init_vdso_vars);
22848
22849 @@ -80,37 +81,35 @@ int arch_setup_additional_pages(struct l
22850 unsigned long addr;
22851 int ret;
22852
22853 - if (!vdso_enabled)
22854 - return 0;
22855 -
22856 down_write(&mm->mmap_sem);
22857 - addr = vdso_addr(mm->start_stack, vdso_size);
22858 - addr = get_unmapped_area(NULL, addr, vdso_size, 0, 0);
22859 + addr = vdso_addr(mm->start_stack, vdso_size + PAGE_SIZE);
22860 + addr = get_unmapped_area(NULL, addr, vdso_size + PAGE_SIZE, 0, 0);
22861 if (IS_ERR_VALUE(addr)) {
22862 ret = addr;
22863 goto up_fail;
22864 }
22865
22866 - current->mm->context.vdso = (void *)addr;
22867 + mm->context.vdso = addr + PAGE_SIZE;
22868
22869 - ret = install_special_mapping(mm, addr, vdso_size,
22870 + ret = install_special_mapping(mm, addr, PAGE_SIZE,
22871 VM_READ|VM_EXEC|
22872 - VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC|
22873 + VM_MAYREAD|VM_MAYEXEC|
22874 VM_ALWAYSDUMP,
22875 - vdso_pages);
22876 + &vsyscall_page);
22877 if (ret) {
22878 - current->mm->context.vdso = NULL;
22879 + mm->context.vdso = 0;
22880 goto up_fail;
22881 }
22882
22883 + ret = install_special_mapping(mm, addr + PAGE_SIZE, vdso_size,
22884 + VM_READ|VM_EXEC|
22885 + VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC|
22886 + VM_ALWAYSDUMP,
22887 + vdso_pages);
22888 + if (ret)
22889 + mm->context.vdso = 0;
22890 +
22891 up_fail:
22892 up_write(&mm->mmap_sem);
22893 return ret;
22894 }
22895 -
22896 -static __init int vdso_setup(char *s)
22897 -{
22898 - vdso_enabled = simple_strtoul(s, NULL, 0);
22899 - return 0;
22900 -}
22901 -__setup("vdso=", vdso_setup);
22902 diff -urNp linux-3.0.8/arch/x86/xen/enlighten.c linux-3.0.8/arch/x86/xen/enlighten.c
22903 --- linux-3.0.8/arch/x86/xen/enlighten.c 2011-10-24 08:05:23.000000000 -0400
22904 +++ linux-3.0.8/arch/x86/xen/enlighten.c 2011-08-29 23:26:21.000000000 -0400
22905 @@ -85,8 +85,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
22906
22907 struct shared_info xen_dummy_shared_info;
22908
22909 -void *xen_initial_gdt;
22910 -
22911 RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
22912 __read_mostly int xen_have_vector_callback;
22913 EXPORT_SYMBOL_GPL(xen_have_vector_callback);
22914 @@ -1010,7 +1008,7 @@ static const struct pv_apic_ops xen_apic
22915 #endif
22916 };
22917
22918 -static void xen_reboot(int reason)
22919 +static __noreturn void xen_reboot(int reason)
22920 {
22921 struct sched_shutdown r = { .reason = reason };
22922
22923 @@ -1018,17 +1016,17 @@ static void xen_reboot(int reason)
22924 BUG();
22925 }
22926
22927 -static void xen_restart(char *msg)
22928 +static __noreturn void xen_restart(char *msg)
22929 {
22930 xen_reboot(SHUTDOWN_reboot);
22931 }
22932
22933 -static void xen_emergency_restart(void)
22934 +static __noreturn void xen_emergency_restart(void)
22935 {
22936 xen_reboot(SHUTDOWN_reboot);
22937 }
22938
22939 -static void xen_machine_halt(void)
22940 +static __noreturn void xen_machine_halt(void)
22941 {
22942 xen_reboot(SHUTDOWN_poweroff);
22943 }
22944 @@ -1134,7 +1132,17 @@ asmlinkage void __init xen_start_kernel(
22945 __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
22946
22947 /* Work out if we support NX */
22948 - x86_configure_nx();
22949 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
22950 + if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
22951 + (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
22952 + unsigned l, h;
22953 +
22954 + __supported_pte_mask |= _PAGE_NX;
22955 + rdmsr(MSR_EFER, l, h);
22956 + l |= EFER_NX;
22957 + wrmsr(MSR_EFER, l, h);
22958 + }
22959 +#endif
22960
22961 xen_setup_features();
22962
22963 @@ -1165,13 +1173,6 @@ asmlinkage void __init xen_start_kernel(
22964
22965 machine_ops = xen_machine_ops;
22966
22967 - /*
22968 - * The only reliable way to retain the initial address of the
22969 - * percpu gdt_page is to remember it here, so we can go and
22970 - * mark it RW later, when the initial percpu area is freed.
22971 - */
22972 - xen_initial_gdt = &per_cpu(gdt_page, 0);
22973 -
22974 xen_smp_init();
22975
22976 #ifdef CONFIG_ACPI_NUMA
22977 diff -urNp linux-3.0.8/arch/x86/xen/mmu.c linux-3.0.8/arch/x86/xen/mmu.c
22978 --- linux-3.0.8/arch/x86/xen/mmu.c 2011-10-24 08:05:23.000000000 -0400
22979 +++ linux-3.0.8/arch/x86/xen/mmu.c 2011-08-29 23:26:21.000000000 -0400
22980 @@ -1683,6 +1683,8 @@ pgd_t * __init xen_setup_kernel_pagetabl
22981 convert_pfn_mfn(init_level4_pgt);
22982 convert_pfn_mfn(level3_ident_pgt);
22983 convert_pfn_mfn(level3_kernel_pgt);
22984 + convert_pfn_mfn(level3_vmalloc_pgt);
22985 + convert_pfn_mfn(level3_vmemmap_pgt);
22986
22987 l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
22988 l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
22989 @@ -1701,7 +1703,10 @@ pgd_t * __init xen_setup_kernel_pagetabl
22990 set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
22991 set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
22992 set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
22993 + set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
22994 + set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
22995 set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
22996 + set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
22997 set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
22998 set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
22999
23000 @@ -1913,6 +1918,7 @@ static void __init xen_post_allocator_in
23001 pv_mmu_ops.set_pud = xen_set_pud;
23002 #if PAGETABLE_LEVELS == 4
23003 pv_mmu_ops.set_pgd = xen_set_pgd;
23004 + pv_mmu_ops.set_pgd_batched = xen_set_pgd;
23005 #endif
23006
23007 /* This will work as long as patching hasn't happened yet
23008 @@ -1994,6 +2000,7 @@ static const struct pv_mmu_ops xen_mmu_o
23009 .pud_val = PV_CALLEE_SAVE(xen_pud_val),
23010 .make_pud = PV_CALLEE_SAVE(xen_make_pud),
23011 .set_pgd = xen_set_pgd_hyper,
23012 + .set_pgd_batched = xen_set_pgd_hyper,
23013
23014 .alloc_pud = xen_alloc_pmd_init,
23015 .release_pud = xen_release_pmd_init,
23016 diff -urNp linux-3.0.8/arch/x86/xen/smp.c linux-3.0.8/arch/x86/xen/smp.c
23017 --- linux-3.0.8/arch/x86/xen/smp.c 2011-10-24 08:05:30.000000000 -0400
23018 +++ linux-3.0.8/arch/x86/xen/smp.c 2011-10-16 21:55:27.000000000 -0400
23019 @@ -194,11 +194,6 @@ static void __init xen_smp_prepare_boot_
23020 {
23021 BUG_ON(smp_processor_id() != 0);
23022 native_smp_prepare_boot_cpu();
23023 -
23024 - /* We've switched to the "real" per-cpu gdt, so make sure the
23025 - old memory can be recycled */
23026 - make_lowmem_page_readwrite(xen_initial_gdt);
23027 -
23028 xen_filter_cpu_maps();
23029 xen_setup_vcpu_info_placement();
23030 }
23031 @@ -275,12 +270,12 @@ cpu_initialize_context(unsigned int cpu,
23032 gdt = get_cpu_gdt_table(cpu);
23033
23034 ctxt->flags = VGCF_IN_KERNEL;
23035 - ctxt->user_regs.ds = __USER_DS;
23036 - ctxt->user_regs.es = __USER_DS;
23037 + ctxt->user_regs.ds = __KERNEL_DS;
23038 + ctxt->user_regs.es = __KERNEL_DS;
23039 ctxt->user_regs.ss = __KERNEL_DS;
23040 #ifdef CONFIG_X86_32
23041 ctxt->user_regs.fs = __KERNEL_PERCPU;
23042 - ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
23043 + savesegment(gs, ctxt->user_regs.gs);
23044 #else
23045 ctxt->gs_base_kernel = per_cpu_offset(cpu);
23046 #endif
23047 @@ -331,13 +326,12 @@ static int __cpuinit xen_cpu_up(unsigned
23048 int rc;
23049
23050 per_cpu(current_task, cpu) = idle;
23051 + per_cpu(current_tinfo, cpu) = &idle->tinfo;
23052 #ifdef CONFIG_X86_32
23053 irq_ctx_init(cpu);
23054 #else
23055 clear_tsk_thread_flag(idle, TIF_FORK);
23056 - per_cpu(kernel_stack, cpu) =
23057 - (unsigned long)task_stack_page(idle) -
23058 - KERNEL_STACK_OFFSET + THREAD_SIZE;
23059 + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
23060 #endif
23061 xen_setup_runstate_info(cpu);
23062 xen_setup_timer(cpu);
23063 diff -urNp linux-3.0.8/arch/x86/xen/xen-asm_32.S linux-3.0.8/arch/x86/xen/xen-asm_32.S
23064 --- linux-3.0.8/arch/x86/xen/xen-asm_32.S 2011-10-24 08:05:30.000000000 -0400
23065 +++ linux-3.0.8/arch/x86/xen/xen-asm_32.S 2011-10-16 21:55:27.000000000 -0400
23066 @@ -83,14 +83,14 @@ ENTRY(xen_iret)
23067 ESP_OFFSET=4 # bytes pushed onto stack
23068
23069 /*
23070 - * Store vcpu_info pointer for easy access. Do it this way to
23071 - * avoid having to reload %fs
23072 + * Store vcpu_info pointer for easy access.
23073 */
23074 #ifdef CONFIG_SMP
23075 - GET_THREAD_INFO(%eax)
23076 - movl TI_cpu(%eax), %eax
23077 - movl __per_cpu_offset(,%eax,4), %eax
23078 - mov xen_vcpu(%eax), %eax
23079 + push %fs
23080 + mov $(__KERNEL_PERCPU), %eax
23081 + mov %eax, %fs
23082 + mov PER_CPU_VAR(xen_vcpu), %eax
23083 + pop %fs
23084 #else
23085 movl xen_vcpu, %eax
23086 #endif
23087 diff -urNp linux-3.0.8/arch/x86/xen/xen-head.S linux-3.0.8/arch/x86/xen/xen-head.S
23088 --- linux-3.0.8/arch/x86/xen/xen-head.S 2011-07-21 22:17:23.000000000 -0400
23089 +++ linux-3.0.8/arch/x86/xen/xen-head.S 2011-08-23 21:47:55.000000000 -0400
23090 @@ -19,6 +19,17 @@ ENTRY(startup_xen)
23091 #ifdef CONFIG_X86_32
23092 mov %esi,xen_start_info
23093 mov $init_thread_union+THREAD_SIZE,%esp
23094 +#ifdef CONFIG_SMP
23095 + movl $cpu_gdt_table,%edi
23096 + movl $__per_cpu_load,%eax
23097 + movw %ax,__KERNEL_PERCPU + 2(%edi)
23098 + rorl $16,%eax
23099 + movb %al,__KERNEL_PERCPU + 4(%edi)
23100 + movb %ah,__KERNEL_PERCPU + 7(%edi)
23101 + movl $__per_cpu_end - 1,%eax
23102 + subl $__per_cpu_start,%eax
23103 + movw %ax,__KERNEL_PERCPU + 0(%edi)
23104 +#endif
23105 #else
23106 mov %rsi,xen_start_info
23107 mov $init_thread_union+THREAD_SIZE,%rsp
23108 diff -urNp linux-3.0.8/arch/x86/xen/xen-ops.h linux-3.0.8/arch/x86/xen/xen-ops.h
23109 --- linux-3.0.8/arch/x86/xen/xen-ops.h 2011-10-24 08:05:21.000000000 -0400
23110 +++ linux-3.0.8/arch/x86/xen/xen-ops.h 2011-08-23 21:47:55.000000000 -0400
23111 @@ -10,8 +10,6 @@
23112 extern const char xen_hypervisor_callback[];
23113 extern const char xen_failsafe_callback[];
23114
23115 -extern void *xen_initial_gdt;
23116 -
23117 struct trap_info;
23118 void xen_copy_trap_info(struct trap_info *traps);
23119
23120 diff -urNp linux-3.0.8/block/blk-iopoll.c linux-3.0.8/block/blk-iopoll.c
23121 --- linux-3.0.8/block/blk-iopoll.c 2011-07-21 22:17:23.000000000 -0400
23122 +++ linux-3.0.8/block/blk-iopoll.c 2011-08-23 21:47:55.000000000 -0400
23123 @@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
23124 }
23125 EXPORT_SYMBOL(blk_iopoll_complete);
23126
23127 -static void blk_iopoll_softirq(struct softirq_action *h)
23128 +static void blk_iopoll_softirq(void)
23129 {
23130 struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
23131 int rearm = 0, budget = blk_iopoll_budget;
23132 diff -urNp linux-3.0.8/block/blk-map.c linux-3.0.8/block/blk-map.c
23133 --- linux-3.0.8/block/blk-map.c 2011-07-21 22:17:23.000000000 -0400
23134 +++ linux-3.0.8/block/blk-map.c 2011-08-23 21:47:55.000000000 -0400
23135 @@ -301,7 +301,7 @@ int blk_rq_map_kern(struct request_queue
23136 if (!len || !kbuf)
23137 return -EINVAL;
23138
23139 - do_copy = !blk_rq_aligned(q, addr, len) || object_is_on_stack(kbuf);
23140 + do_copy = !blk_rq_aligned(q, addr, len) || object_starts_on_stack(kbuf);
23141 if (do_copy)
23142 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
23143 else
23144 diff -urNp linux-3.0.8/block/blk-softirq.c linux-3.0.8/block/blk-softirq.c
23145 --- linux-3.0.8/block/blk-softirq.c 2011-07-21 22:17:23.000000000 -0400
23146 +++ linux-3.0.8/block/blk-softirq.c 2011-08-23 21:47:55.000000000 -0400
23147 @@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head,
23148 * Softirq action handler - move entries to local list and loop over them
23149 * while passing them to the queue registered handler.
23150 */
23151 -static void blk_done_softirq(struct softirq_action *h)
23152 +static void blk_done_softirq(void)
23153 {
23154 struct list_head *cpu_list, local_list;
23155
23156 diff -urNp linux-3.0.8/block/bsg.c linux-3.0.8/block/bsg.c
23157 --- linux-3.0.8/block/bsg.c 2011-07-21 22:17:23.000000000 -0400
23158 +++ linux-3.0.8/block/bsg.c 2011-10-06 04:17:55.000000000 -0400
23159 @@ -176,16 +176,24 @@ static int blk_fill_sgv4_hdr_rq(struct r
23160 struct sg_io_v4 *hdr, struct bsg_device *bd,
23161 fmode_t has_write_perm)
23162 {
23163 + unsigned char tmpcmd[sizeof(rq->__cmd)];
23164 + unsigned char *cmdptr;
23165 +
23166 if (hdr->request_len > BLK_MAX_CDB) {
23167 rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
23168 if (!rq->cmd)
23169 return -ENOMEM;
23170 - }
23171 + cmdptr = rq->cmd;
23172 + } else
23173 + cmdptr = tmpcmd;
23174
23175 - if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request,
23176 + if (copy_from_user(cmdptr, (void __user *)(unsigned long)hdr->request,
23177 hdr->request_len))
23178 return -EFAULT;
23179
23180 + if (cmdptr != rq->cmd)
23181 + memcpy(rq->cmd, cmdptr, hdr->request_len);
23182 +
23183 if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
23184 if (blk_verify_command(rq->cmd, has_write_perm))
23185 return -EPERM;
23186 @@ -249,7 +257,7 @@ bsg_map_hdr(struct bsg_device *bd, struc
23187 struct request *rq, *next_rq = NULL;
23188 int ret, rw;
23189 unsigned int dxfer_len;
23190 - void *dxferp = NULL;
23191 + void __user *dxferp = NULL;
23192 struct bsg_class_device *bcd = &q->bsg_dev;
23193
23194 /* if the LLD has been removed then the bsg_unregister_queue will
23195 @@ -291,7 +299,7 @@ bsg_map_hdr(struct bsg_device *bd, struc
23196 rq->next_rq = next_rq;
23197 next_rq->cmd_type = rq->cmd_type;
23198
23199 - dxferp = (void*)(unsigned long)hdr->din_xferp;
23200 + dxferp = (void __user *)(unsigned long)hdr->din_xferp;
23201 ret = blk_rq_map_user(q, next_rq, NULL, dxferp,
23202 hdr->din_xfer_len, GFP_KERNEL);
23203 if (ret)
23204 @@ -300,10 +308,10 @@ bsg_map_hdr(struct bsg_device *bd, struc
23205
23206 if (hdr->dout_xfer_len) {
23207 dxfer_len = hdr->dout_xfer_len;
23208 - dxferp = (void*)(unsigned long)hdr->dout_xferp;
23209 + dxferp = (void __user *)(unsigned long)hdr->dout_xferp;
23210 } else if (hdr->din_xfer_len) {
23211 dxfer_len = hdr->din_xfer_len;
23212 - dxferp = (void*)(unsigned long)hdr->din_xferp;
23213 + dxferp = (void __user *)(unsigned long)hdr->din_xferp;
23214 } else
23215 dxfer_len = 0;
23216
23217 @@ -445,7 +453,7 @@ static int blk_complete_sgv4_hdr_rq(stru
23218 int len = min_t(unsigned int, hdr->max_response_len,
23219 rq->sense_len);
23220
23221 - ret = copy_to_user((void*)(unsigned long)hdr->response,
23222 + ret = copy_to_user((void __user *)(unsigned long)hdr->response,
23223 rq->sense, len);
23224 if (!ret)
23225 hdr->response_len = len;
23226 diff -urNp linux-3.0.8/block/compat_ioctl.c linux-3.0.8/block/compat_ioctl.c
23227 --- linux-3.0.8/block/compat_ioctl.c 2011-07-21 22:17:23.000000000 -0400
23228 +++ linux-3.0.8/block/compat_ioctl.c 2011-10-06 04:17:55.000000000 -0400
23229 @@ -354,7 +354,7 @@ static int compat_fd_ioctl(struct block_
23230 err |= __get_user(f->spec1, &uf->spec1);
23231 err |= __get_user(f->fmt_gap, &uf->fmt_gap);
23232 err |= __get_user(name, &uf->name);
23233 - f->name = compat_ptr(name);
23234 + f->name = (void __force_kernel *)compat_ptr(name);
23235 if (err) {
23236 err = -EFAULT;
23237 goto out;
23238 diff -urNp linux-3.0.8/block/scsi_ioctl.c linux-3.0.8/block/scsi_ioctl.c
23239 --- linux-3.0.8/block/scsi_ioctl.c 2011-07-21 22:17:23.000000000 -0400
23240 +++ linux-3.0.8/block/scsi_ioctl.c 2011-08-23 21:47:55.000000000 -0400
23241 @@ -222,8 +222,20 @@ EXPORT_SYMBOL(blk_verify_command);
23242 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
23243 struct sg_io_hdr *hdr, fmode_t mode)
23244 {
23245 - if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
23246 + unsigned char tmpcmd[sizeof(rq->__cmd)];
23247 + unsigned char *cmdptr;
23248 +
23249 + if (rq->cmd != rq->__cmd)
23250 + cmdptr = rq->cmd;
23251 + else
23252 + cmdptr = tmpcmd;
23253 +
23254 + if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
23255 return -EFAULT;
23256 +
23257 + if (cmdptr != rq->cmd)
23258 + memcpy(rq->cmd, cmdptr, hdr->cmd_len);
23259 +
23260 if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
23261 return -EPERM;
23262
23263 @@ -432,6 +444,8 @@ int sg_scsi_ioctl(struct request_queue *
23264 int err;
23265 unsigned int in_len, out_len, bytes, opcode, cmdlen;
23266 char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
23267 + unsigned char tmpcmd[sizeof(rq->__cmd)];
23268 + unsigned char *cmdptr;
23269
23270 if (!sic)
23271 return -EINVAL;
23272 @@ -465,9 +479,18 @@ int sg_scsi_ioctl(struct request_queue *
23273 */
23274 err = -EFAULT;
23275 rq->cmd_len = cmdlen;
23276 - if (copy_from_user(rq->cmd, sic->data, cmdlen))
23277 +
23278 + if (rq->cmd != rq->__cmd)
23279 + cmdptr = rq->cmd;
23280 + else
23281 + cmdptr = tmpcmd;
23282 +
23283 + if (copy_from_user(cmdptr, sic->data, cmdlen))
23284 goto error;
23285
23286 + if (rq->cmd != cmdptr)
23287 + memcpy(rq->cmd, cmdptr, cmdlen);
23288 +
23289 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
23290 goto error;
23291
23292 diff -urNp linux-3.0.8/crypto/cryptd.c linux-3.0.8/crypto/cryptd.c
23293 --- linux-3.0.8/crypto/cryptd.c 2011-07-21 22:17:23.000000000 -0400
23294 +++ linux-3.0.8/crypto/cryptd.c 2011-08-23 21:47:55.000000000 -0400
23295 @@ -63,7 +63,7 @@ struct cryptd_blkcipher_ctx {
23296
23297 struct cryptd_blkcipher_request_ctx {
23298 crypto_completion_t complete;
23299 -};
23300 +} __no_const;
23301
23302 struct cryptd_hash_ctx {
23303 struct crypto_shash *child;
23304 @@ -80,7 +80,7 @@ struct cryptd_aead_ctx {
23305
23306 struct cryptd_aead_request_ctx {
23307 crypto_completion_t complete;
23308 -};
23309 +} __no_const;
23310
23311 static void cryptd_queue_worker(struct work_struct *work);
23312
23313 diff -urNp linux-3.0.8/crypto/gf128mul.c linux-3.0.8/crypto/gf128mul.c
23314 --- linux-3.0.8/crypto/gf128mul.c 2011-07-21 22:17:23.000000000 -0400
23315 +++ linux-3.0.8/crypto/gf128mul.c 2011-08-23 21:47:55.000000000 -0400
23316 @@ -182,7 +182,7 @@ void gf128mul_lle(be128 *r, const be128
23317 for (i = 0; i < 7; ++i)
23318 gf128mul_x_lle(&p[i + 1], &p[i]);
23319
23320 - memset(r, 0, sizeof(r));
23321 + memset(r, 0, sizeof(*r));
23322 for (i = 0;;) {
23323 u8 ch = ((u8 *)b)[15 - i];
23324
23325 @@ -220,7 +220,7 @@ void gf128mul_bbe(be128 *r, const be128
23326 for (i = 0; i < 7; ++i)
23327 gf128mul_x_bbe(&p[i + 1], &p[i]);
23328
23329 - memset(r, 0, sizeof(r));
23330 + memset(r, 0, sizeof(*r));
23331 for (i = 0;;) {
23332 u8 ch = ((u8 *)b)[i];
23333
23334 diff -urNp linux-3.0.8/crypto/serpent.c linux-3.0.8/crypto/serpent.c
23335 --- linux-3.0.8/crypto/serpent.c 2011-07-21 22:17:23.000000000 -0400
23336 +++ linux-3.0.8/crypto/serpent.c 2011-08-23 21:48:14.000000000 -0400
23337 @@ -224,6 +224,8 @@ static int serpent_setkey(struct crypto_
23338 u32 r0,r1,r2,r3,r4;
23339 int i;
23340
23341 + pax_track_stack();
23342 +
23343 /* Copy key, add padding */
23344
23345 for (i = 0; i < keylen; ++i)
23346 diff -urNp linux-3.0.8/Documentation/dontdiff linux-3.0.8/Documentation/dontdiff
23347 --- linux-3.0.8/Documentation/dontdiff 2011-07-21 22:17:23.000000000 -0400
23348 +++ linux-3.0.8/Documentation/dontdiff 2011-10-20 04:46:01.000000000 -0400
23349 @@ -5,6 +5,7 @@
23350 *.cis
23351 *.cpio
23352 *.csp
23353 +*.dbg
23354 *.dsp
23355 *.dvi
23356 *.elf
23357 @@ -48,9 +49,11 @@
23358 *.tab.h
23359 *.tex
23360 *.ver
23361 +*.vim
23362 *.xml
23363 *.xz
23364 *_MODULES
23365 +*_reg_safe.h
23366 *_vga16.c
23367 *~
23368 \#*#
23369 @@ -70,6 +73,7 @@ Kerntypes
23370 Module.markers
23371 Module.symvers
23372 PENDING
23373 +PERF*
23374 SCCS
23375 System.map*
23376 TAGS
23377 @@ -98,14 +102,18 @@ bzImage*
23378 capability_names.h
23379 capflags.c
23380 classlist.h*
23381 +clut_vga16.c
23382 +common-cmds.h
23383 comp*.log
23384 compile.h*
23385 conf
23386 config
23387 config-*
23388 config_data.h*
23389 +config.c
23390 config.mak
23391 config.mak.autogen
23392 +config.tmp
23393 conmakehash
23394 consolemap_deftbl.c*
23395 cpustr.h
23396 @@ -126,12 +134,14 @@ fore200e_pca_fw.c*
23397 gconf
23398 gconf.glade.h
23399 gen-devlist
23400 +gen-kdb_cmds.c
23401 gen_crc32table
23402 gen_init_cpio
23403 generated
23404 genheaders
23405 genksyms
23406 *_gray256.c
23407 +hash
23408 hpet_example
23409 hugepage-mmap
23410 hugepage-shm
23411 @@ -146,7 +156,7 @@ int32.c
23412 int4.c
23413 int8.c
23414 kallsyms
23415 -kconfig
23416 +kern_constants.h
23417 keywords.c
23418 ksym.c*
23419 ksym.h*
23420 @@ -154,7 +164,6 @@ kxgettext
23421 lkc_defs.h
23422 lex.c
23423 lex.*.c
23424 -linux
23425 logo_*.c
23426 logo_*_clut224.c
23427 logo_*_mono.c
23428 @@ -166,7 +175,6 @@ machtypes.h
23429 map
23430 map_hugetlb
23431 maui_boot.h
23432 -media
23433 mconf
23434 miboot*
23435 mk_elfconfig
23436 @@ -174,6 +182,7 @@ mkboot
23437 mkbugboot
23438 mkcpustr
23439 mkdep
23440 +mkpiggy
23441 mkprep
23442 mkregtable
23443 mktables
23444 @@ -209,6 +218,7 @@ r300_reg_safe.h
23445 r420_reg_safe.h
23446 r600_reg_safe.h
23447 recordmcount
23448 +regdb.c
23449 relocs
23450 rlim_names.h
23451 rn50_reg_safe.h
23452 @@ -219,6 +229,7 @@ setup
23453 setup.bin
23454 setup.elf
23455 sImage
23456 +slabinfo
23457 sm_tbl*
23458 split-include
23459 syscalltab.h
23460 @@ -229,6 +240,7 @@ tftpboot.img
23461 timeconst.h
23462 times.h*
23463 trix_boot.h
23464 +user_constants.h
23465 utsrelease.h*
23466 vdso-syms.lds
23467 vdso.lds
23468 @@ -246,7 +258,9 @@ vmlinux
23469 vmlinux-*
23470 vmlinux.aout
23471 vmlinux.bin.all
23472 +vmlinux.bin.bz2
23473 vmlinux.lds
23474 +vmlinux.relocs
23475 vmlinuz
23476 voffset.h
23477 vsyscall.lds
23478 @@ -254,6 +268,7 @@ vsyscall_32.lds
23479 wanxlfw.inc
23480 uImage
23481 unifdef
23482 +utsrelease.h
23483 wakeup.bin
23484 wakeup.elf
23485 wakeup.lds
23486 diff -urNp linux-3.0.8/Documentation/kernel-parameters.txt linux-3.0.8/Documentation/kernel-parameters.txt
23487 --- linux-3.0.8/Documentation/kernel-parameters.txt 2011-07-21 22:17:23.000000000 -0400
23488 +++ linux-3.0.8/Documentation/kernel-parameters.txt 2011-08-23 21:47:55.000000000 -0400
23489 @@ -1883,6 +1883,13 @@ bytes respectively. Such letter suffixes
23490 the specified number of seconds. This is to be used if
23491 your oopses keep scrolling off the screen.
23492
23493 + pax_nouderef [X86] disables UDEREF. Most likely needed under certain
23494 + virtualization environments that don't cope well with the
23495 + expand down segment used by UDEREF on X86-32 or the frequent
23496 + page table updates on X86-64.
23497 +
23498 + pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
23499 +
23500 pcbit= [HW,ISDN]
23501
23502 pcd. [PARIDE]
23503 diff -urNp linux-3.0.8/drivers/acpi/apei/cper.c linux-3.0.8/drivers/acpi/apei/cper.c
23504 --- linux-3.0.8/drivers/acpi/apei/cper.c 2011-07-21 22:17:23.000000000 -0400
23505 +++ linux-3.0.8/drivers/acpi/apei/cper.c 2011-08-23 21:47:55.000000000 -0400
23506 @@ -38,12 +38,12 @@
23507 */
23508 u64 cper_next_record_id(void)
23509 {
23510 - static atomic64_t seq;
23511 + static atomic64_unchecked_t seq;
23512
23513 - if (!atomic64_read(&seq))
23514 - atomic64_set(&seq, ((u64)get_seconds()) << 32);
23515 + if (!atomic64_read_unchecked(&seq))
23516 + atomic64_set_unchecked(&seq, ((u64)get_seconds()) << 32);
23517
23518 - return atomic64_inc_return(&seq);
23519 + return atomic64_inc_return_unchecked(&seq);
23520 }
23521 EXPORT_SYMBOL_GPL(cper_next_record_id);
23522
23523 diff -urNp linux-3.0.8/drivers/acpi/ec_sys.c linux-3.0.8/drivers/acpi/ec_sys.c
23524 --- linux-3.0.8/drivers/acpi/ec_sys.c 2011-07-21 22:17:23.000000000 -0400
23525 +++ linux-3.0.8/drivers/acpi/ec_sys.c 2011-08-24 19:06:55.000000000 -0400
23526 @@ -11,6 +11,7 @@
23527 #include <linux/kernel.h>
23528 #include <linux/acpi.h>
23529 #include <linux/debugfs.h>
23530 +#include <asm/uaccess.h>
23531 #include "internal.h"
23532
23533 MODULE_AUTHOR("Thomas Renninger <trenn@suse.de>");
23534 @@ -39,7 +40,7 @@ static ssize_t acpi_ec_read_io(struct fi
23535 * struct acpi_ec *ec = ((struct seq_file *)f->private_data)->private;
23536 */
23537 unsigned int size = EC_SPACE_SIZE;
23538 - u8 *data = (u8 *) buf;
23539 + u8 data;
23540 loff_t init_off = *off;
23541 int err = 0;
23542
23543 @@ -52,9 +53,11 @@ static ssize_t acpi_ec_read_io(struct fi
23544 size = count;
23545
23546 while (size) {
23547 - err = ec_read(*off, &data[*off - init_off]);
23548 + err = ec_read(*off, &data);
23549 if (err)
23550 return err;
23551 + if (put_user(data, &buf[*off - init_off]))
23552 + return -EFAULT;
23553 *off += 1;
23554 size--;
23555 }
23556 @@ -70,7 +73,6 @@ static ssize_t acpi_ec_write_io(struct f
23557
23558 unsigned int size = count;
23559 loff_t init_off = *off;
23560 - u8 *data = (u8 *) buf;
23561 int err = 0;
23562
23563 if (*off >= EC_SPACE_SIZE)
23564 @@ -81,7 +83,9 @@ static ssize_t acpi_ec_write_io(struct f
23565 }
23566
23567 while (size) {
23568 - u8 byte_write = data[*off - init_off];
23569 + u8 byte_write;
23570 + if (get_user(byte_write, &buf[*off - init_off]))
23571 + return -EFAULT;
23572 err = ec_write(*off, byte_write);
23573 if (err)
23574 return err;
23575 diff -urNp linux-3.0.8/drivers/acpi/proc.c linux-3.0.8/drivers/acpi/proc.c
23576 --- linux-3.0.8/drivers/acpi/proc.c 2011-07-21 22:17:23.000000000 -0400
23577 +++ linux-3.0.8/drivers/acpi/proc.c 2011-08-23 21:47:55.000000000 -0400
23578 @@ -342,19 +342,13 @@ acpi_system_write_wakeup_device(struct f
23579 size_t count, loff_t * ppos)
23580 {
23581 struct list_head *node, *next;
23582 - char strbuf[5];
23583 - char str[5] = "";
23584 - unsigned int len = count;
23585 -
23586 - if (len > 4)
23587 - len = 4;
23588 - if (len < 0)
23589 - return -EFAULT;
23590 + char strbuf[5] = {0};
23591
23592 - if (copy_from_user(strbuf, buffer, len))
23593 + if (count > 4)
23594 + count = 4;
23595 + if (copy_from_user(strbuf, buffer, count))
23596 return -EFAULT;
23597 - strbuf[len] = '\0';
23598 - sscanf(strbuf, "%s", str);
23599 + strbuf[count] = '\0';
23600
23601 mutex_lock(&acpi_device_lock);
23602 list_for_each_safe(node, next, &acpi_wakeup_device_list) {
23603 @@ -363,7 +357,7 @@ acpi_system_write_wakeup_device(struct f
23604 if (!dev->wakeup.flags.valid)
23605 continue;
23606
23607 - if (!strncmp(dev->pnp.bus_id, str, 4)) {
23608 + if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
23609 if (device_can_wakeup(&dev->dev)) {
23610 bool enable = !device_may_wakeup(&dev->dev);
23611 device_set_wakeup_enable(&dev->dev, enable);
23612 diff -urNp linux-3.0.8/drivers/acpi/processor_driver.c linux-3.0.8/drivers/acpi/processor_driver.c
23613 --- linux-3.0.8/drivers/acpi/processor_driver.c 2011-07-21 22:17:23.000000000 -0400
23614 +++ linux-3.0.8/drivers/acpi/processor_driver.c 2011-08-23 21:47:55.000000000 -0400
23615 @@ -473,7 +473,7 @@ static int __cpuinit acpi_processor_add(
23616 return 0;
23617 #endif
23618
23619 - BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
23620 + BUG_ON(pr->id >= nr_cpu_ids);
23621
23622 /*
23623 * Buggy BIOS check
23624 diff -urNp linux-3.0.8/drivers/ata/libata-core.c linux-3.0.8/drivers/ata/libata-core.c
23625 --- linux-3.0.8/drivers/ata/libata-core.c 2011-07-21 22:17:23.000000000 -0400
23626 +++ linux-3.0.8/drivers/ata/libata-core.c 2011-08-23 21:47:55.000000000 -0400
23627 @@ -4753,7 +4753,7 @@ void ata_qc_free(struct ata_queued_cmd *
23628 struct ata_port *ap;
23629 unsigned int tag;
23630
23631 - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
23632 + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
23633 ap = qc->ap;
23634
23635 qc->flags = 0;
23636 @@ -4769,7 +4769,7 @@ void __ata_qc_complete(struct ata_queued
23637 struct ata_port *ap;
23638 struct ata_link *link;
23639
23640 - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
23641 + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
23642 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
23643 ap = qc->ap;
23644 link = qc->dev->link;
23645 @@ -5774,6 +5774,7 @@ static void ata_finalize_port_ops(struct
23646 return;
23647
23648 spin_lock(&lock);
23649 + pax_open_kernel();
23650
23651 for (cur = ops->inherits; cur; cur = cur->inherits) {
23652 void **inherit = (void **)cur;
23653 @@ -5787,8 +5788,9 @@ static void ata_finalize_port_ops(struct
23654 if (IS_ERR(*pp))
23655 *pp = NULL;
23656
23657 - ops->inherits = NULL;
23658 + *(struct ata_port_operations **)&ops->inherits = NULL;
23659
23660 + pax_close_kernel();
23661 spin_unlock(&lock);
23662 }
23663
23664 diff -urNp linux-3.0.8/drivers/ata/libata-eh.c linux-3.0.8/drivers/ata/libata-eh.c
23665 --- linux-3.0.8/drivers/ata/libata-eh.c 2011-07-21 22:17:23.000000000 -0400
23666 +++ linux-3.0.8/drivers/ata/libata-eh.c 2011-08-23 21:48:14.000000000 -0400
23667 @@ -2518,6 +2518,8 @@ void ata_eh_report(struct ata_port *ap)
23668 {
23669 struct ata_link *link;
23670
23671 + pax_track_stack();
23672 +
23673 ata_for_each_link(link, ap, HOST_FIRST)
23674 ata_eh_link_report(link);
23675 }
23676 diff -urNp linux-3.0.8/drivers/ata/pata_arasan_cf.c linux-3.0.8/drivers/ata/pata_arasan_cf.c
23677 --- linux-3.0.8/drivers/ata/pata_arasan_cf.c 2011-07-21 22:17:23.000000000 -0400
23678 +++ linux-3.0.8/drivers/ata/pata_arasan_cf.c 2011-08-23 21:47:55.000000000 -0400
23679 @@ -862,7 +862,9 @@ static int __devinit arasan_cf_probe(str
23680 /* Handle platform specific quirks */
23681 if (pdata->quirk) {
23682 if (pdata->quirk & CF_BROKEN_PIO) {
23683 - ap->ops->set_piomode = NULL;
23684 + pax_open_kernel();
23685 + *(void **)&ap->ops->set_piomode = NULL;
23686 + pax_close_kernel();
23687 ap->pio_mask = 0;
23688 }
23689 if (pdata->quirk & CF_BROKEN_MWDMA)
23690 diff -urNp linux-3.0.8/drivers/atm/adummy.c linux-3.0.8/drivers/atm/adummy.c
23691 --- linux-3.0.8/drivers/atm/adummy.c 2011-07-21 22:17:23.000000000 -0400
23692 +++ linux-3.0.8/drivers/atm/adummy.c 2011-08-23 21:47:55.000000000 -0400
23693 @@ -114,7 +114,7 @@ adummy_send(struct atm_vcc *vcc, struct
23694 vcc->pop(vcc, skb);
23695 else
23696 dev_kfree_skb_any(skb);
23697 - atomic_inc(&vcc->stats->tx);
23698 + atomic_inc_unchecked(&vcc->stats->tx);
23699
23700 return 0;
23701 }
23702 diff -urNp linux-3.0.8/drivers/atm/ambassador.c linux-3.0.8/drivers/atm/ambassador.c
23703 --- linux-3.0.8/drivers/atm/ambassador.c 2011-07-21 22:17:23.000000000 -0400
23704 +++ linux-3.0.8/drivers/atm/ambassador.c 2011-08-23 21:47:55.000000000 -0400
23705 @@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev,
23706 PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
23707
23708 // VC layer stats
23709 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
23710 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
23711
23712 // free the descriptor
23713 kfree (tx_descr);
23714 @@ -495,7 +495,7 @@ static void rx_complete (amb_dev * dev,
23715 dump_skb ("<<<", vc, skb);
23716
23717 // VC layer stats
23718 - atomic_inc(&atm_vcc->stats->rx);
23719 + atomic_inc_unchecked(&atm_vcc->stats->rx);
23720 __net_timestamp(skb);
23721 // end of our responsibility
23722 atm_vcc->push (atm_vcc, skb);
23723 @@ -510,7 +510,7 @@ static void rx_complete (amb_dev * dev,
23724 } else {
23725 PRINTK (KERN_INFO, "dropped over-size frame");
23726 // should we count this?
23727 - atomic_inc(&atm_vcc->stats->rx_drop);
23728 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
23729 }
23730
23731 } else {
23732 @@ -1342,7 +1342,7 @@ static int amb_send (struct atm_vcc * at
23733 }
23734
23735 if (check_area (skb->data, skb->len)) {
23736 - atomic_inc(&atm_vcc->stats->tx_err);
23737 + atomic_inc_unchecked(&atm_vcc->stats->tx_err);
23738 return -ENOMEM; // ?
23739 }
23740
23741 diff -urNp linux-3.0.8/drivers/atm/atmtcp.c linux-3.0.8/drivers/atm/atmtcp.c
23742 --- linux-3.0.8/drivers/atm/atmtcp.c 2011-07-21 22:17:23.000000000 -0400
23743 +++ linux-3.0.8/drivers/atm/atmtcp.c 2011-08-23 21:47:55.000000000 -0400
23744 @@ -207,7 +207,7 @@ static int atmtcp_v_send(struct atm_vcc
23745 if (vcc->pop) vcc->pop(vcc,skb);
23746 else dev_kfree_skb(skb);
23747 if (dev_data) return 0;
23748 - atomic_inc(&vcc->stats->tx_err);
23749 + atomic_inc_unchecked(&vcc->stats->tx_err);
23750 return -ENOLINK;
23751 }
23752 size = skb->len+sizeof(struct atmtcp_hdr);
23753 @@ -215,7 +215,7 @@ static int atmtcp_v_send(struct atm_vcc
23754 if (!new_skb) {
23755 if (vcc->pop) vcc->pop(vcc,skb);
23756 else dev_kfree_skb(skb);
23757 - atomic_inc(&vcc->stats->tx_err);
23758 + atomic_inc_unchecked(&vcc->stats->tx_err);
23759 return -ENOBUFS;
23760 }
23761 hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
23762 @@ -226,8 +226,8 @@ static int atmtcp_v_send(struct atm_vcc
23763 if (vcc->pop) vcc->pop(vcc,skb);
23764 else dev_kfree_skb(skb);
23765 out_vcc->push(out_vcc,new_skb);
23766 - atomic_inc(&vcc->stats->tx);
23767 - atomic_inc(&out_vcc->stats->rx);
23768 + atomic_inc_unchecked(&vcc->stats->tx);
23769 + atomic_inc_unchecked(&out_vcc->stats->rx);
23770 return 0;
23771 }
23772
23773 @@ -301,7 +301,7 @@ static int atmtcp_c_send(struct atm_vcc
23774 out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
23775 read_unlock(&vcc_sklist_lock);
23776 if (!out_vcc) {
23777 - atomic_inc(&vcc->stats->tx_err);
23778 + atomic_inc_unchecked(&vcc->stats->tx_err);
23779 goto done;
23780 }
23781 skb_pull(skb,sizeof(struct atmtcp_hdr));
23782 @@ -313,8 +313,8 @@ static int atmtcp_c_send(struct atm_vcc
23783 __net_timestamp(new_skb);
23784 skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
23785 out_vcc->push(out_vcc,new_skb);
23786 - atomic_inc(&vcc->stats->tx);
23787 - atomic_inc(&out_vcc->stats->rx);
23788 + atomic_inc_unchecked(&vcc->stats->tx);
23789 + atomic_inc_unchecked(&out_vcc->stats->rx);
23790 done:
23791 if (vcc->pop) vcc->pop(vcc,skb);
23792 else dev_kfree_skb(skb);
23793 diff -urNp linux-3.0.8/drivers/atm/eni.c linux-3.0.8/drivers/atm/eni.c
23794 --- linux-3.0.8/drivers/atm/eni.c 2011-07-21 22:17:23.000000000 -0400
23795 +++ linux-3.0.8/drivers/atm/eni.c 2011-10-11 10:44:33.000000000 -0400
23796 @@ -526,7 +526,7 @@ static int rx_aal0(struct atm_vcc *vcc)
23797 DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
23798 vcc->dev->number);
23799 length = 0;
23800 - atomic_inc(&vcc->stats->rx_err);
23801 + atomic_inc_unchecked(&vcc->stats->rx_err);
23802 }
23803 else {
23804 length = ATM_CELL_SIZE-1; /* no HEC */
23805 @@ -581,7 +581,7 @@ static int rx_aal5(struct atm_vcc *vcc)
23806 size);
23807 }
23808 eff = length = 0;
23809 - atomic_inc(&vcc->stats->rx_err);
23810 + atomic_inc_unchecked(&vcc->stats->rx_err);
23811 }
23812 else {
23813 size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
23814 @@ -598,7 +598,7 @@ static int rx_aal5(struct atm_vcc *vcc)
23815 "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
23816 vcc->dev->number,vcc->vci,length,size << 2,descr);
23817 length = eff = 0;
23818 - atomic_inc(&vcc->stats->rx_err);
23819 + atomic_inc_unchecked(&vcc->stats->rx_err);
23820 }
23821 }
23822 skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
23823 @@ -771,7 +771,7 @@ rx_dequeued++;
23824 vcc->push(vcc,skb);
23825 pushed++;
23826 }
23827 - atomic_inc(&vcc->stats->rx);
23828 + atomic_inc_unchecked(&vcc->stats->rx);
23829 }
23830 wake_up(&eni_dev->rx_wait);
23831 }
23832 @@ -1228,7 +1228,7 @@ static void dequeue_tx(struct atm_dev *d
23833 PCI_DMA_TODEVICE);
23834 if (vcc->pop) vcc->pop(vcc,skb);
23835 else dev_kfree_skb_irq(skb);
23836 - atomic_inc(&vcc->stats->tx);
23837 + atomic_inc_unchecked(&vcc->stats->tx);
23838 wake_up(&eni_dev->tx_wait);
23839 dma_complete++;
23840 }
23841 @@ -1568,7 +1568,7 @@ tx_complete++;
23842 /*--------------------------------- entries ---------------------------------*/
23843
23844
23845 -static const char *media_name[] __devinitdata = {
23846 +static const char *media_name[] __devinitconst = {
23847 "MMF", "SMF", "MMF", "03?", /* 0- 3 */
23848 "UTP", "05?", "06?", "07?", /* 4- 7 */
23849 "TAXI","09?", "10?", "11?", /* 8-11 */
23850 diff -urNp linux-3.0.8/drivers/atm/firestream.c linux-3.0.8/drivers/atm/firestream.c
23851 --- linux-3.0.8/drivers/atm/firestream.c 2011-07-21 22:17:23.000000000 -0400
23852 +++ linux-3.0.8/drivers/atm/firestream.c 2011-08-23 21:47:55.000000000 -0400
23853 @@ -749,7 +749,7 @@ static void process_txdone_queue (struct
23854 }
23855 }
23856
23857 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
23858 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
23859
23860 fs_dprintk (FS_DEBUG_TXMEM, "i");
23861 fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
23862 @@ -816,7 +816,7 @@ static void process_incoming (struct fs_
23863 #endif
23864 skb_put (skb, qe->p1 & 0xffff);
23865 ATM_SKB(skb)->vcc = atm_vcc;
23866 - atomic_inc(&atm_vcc->stats->rx);
23867 + atomic_inc_unchecked(&atm_vcc->stats->rx);
23868 __net_timestamp(skb);
23869 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
23870 atm_vcc->push (atm_vcc, skb);
23871 @@ -837,12 +837,12 @@ static void process_incoming (struct fs_
23872 kfree (pe);
23873 }
23874 if (atm_vcc)
23875 - atomic_inc(&atm_vcc->stats->rx_drop);
23876 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
23877 break;
23878 case 0x1f: /* Reassembly abort: no buffers. */
23879 /* Silently increment error counter. */
23880 if (atm_vcc)
23881 - atomic_inc(&atm_vcc->stats->rx_drop);
23882 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
23883 break;
23884 default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
23885 printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
23886 diff -urNp linux-3.0.8/drivers/atm/fore200e.c linux-3.0.8/drivers/atm/fore200e.c
23887 --- linux-3.0.8/drivers/atm/fore200e.c 2011-07-21 22:17:23.000000000 -0400
23888 +++ linux-3.0.8/drivers/atm/fore200e.c 2011-08-23 21:47:55.000000000 -0400
23889 @@ -933,9 +933,9 @@ fore200e_tx_irq(struct fore200e* fore200
23890 #endif
23891 /* check error condition */
23892 if (*entry->status & STATUS_ERROR)
23893 - atomic_inc(&vcc->stats->tx_err);
23894 + atomic_inc_unchecked(&vcc->stats->tx_err);
23895 else
23896 - atomic_inc(&vcc->stats->tx);
23897 + atomic_inc_unchecked(&vcc->stats->tx);
23898 }
23899 }
23900
23901 @@ -1084,7 +1084,7 @@ fore200e_push_rpd(struct fore200e* fore2
23902 if (skb == NULL) {
23903 DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
23904
23905 - atomic_inc(&vcc->stats->rx_drop);
23906 + atomic_inc_unchecked(&vcc->stats->rx_drop);
23907 return -ENOMEM;
23908 }
23909
23910 @@ -1127,14 +1127,14 @@ fore200e_push_rpd(struct fore200e* fore2
23911
23912 dev_kfree_skb_any(skb);
23913
23914 - atomic_inc(&vcc->stats->rx_drop);
23915 + atomic_inc_unchecked(&vcc->stats->rx_drop);
23916 return -ENOMEM;
23917 }
23918
23919 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
23920
23921 vcc->push(vcc, skb);
23922 - atomic_inc(&vcc->stats->rx);
23923 + atomic_inc_unchecked(&vcc->stats->rx);
23924
23925 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
23926
23927 @@ -1212,7 +1212,7 @@ fore200e_rx_irq(struct fore200e* fore200
23928 DPRINTK(2, "damaged PDU on %d.%d.%d\n",
23929 fore200e->atm_dev->number,
23930 entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
23931 - atomic_inc(&vcc->stats->rx_err);
23932 + atomic_inc_unchecked(&vcc->stats->rx_err);
23933 }
23934 }
23935
23936 @@ -1657,7 +1657,7 @@ fore200e_send(struct atm_vcc *vcc, struc
23937 goto retry_here;
23938 }
23939
23940 - atomic_inc(&vcc->stats->tx_err);
23941 + atomic_inc_unchecked(&vcc->stats->tx_err);
23942
23943 fore200e->tx_sat++;
23944 DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
23945 diff -urNp linux-3.0.8/drivers/atm/he.c linux-3.0.8/drivers/atm/he.c
23946 --- linux-3.0.8/drivers/atm/he.c 2011-07-21 22:17:23.000000000 -0400
23947 +++ linux-3.0.8/drivers/atm/he.c 2011-08-23 21:47:55.000000000 -0400
23948 @@ -1709,7 +1709,7 @@ he_service_rbrq(struct he_dev *he_dev, i
23949
23950 if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
23951 hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
23952 - atomic_inc(&vcc->stats->rx_drop);
23953 + atomic_inc_unchecked(&vcc->stats->rx_drop);
23954 goto return_host_buffers;
23955 }
23956
23957 @@ -1736,7 +1736,7 @@ he_service_rbrq(struct he_dev *he_dev, i
23958 RBRQ_LEN_ERR(he_dev->rbrq_head)
23959 ? "LEN_ERR" : "",
23960 vcc->vpi, vcc->vci);
23961 - atomic_inc(&vcc->stats->rx_err);
23962 + atomic_inc_unchecked(&vcc->stats->rx_err);
23963 goto return_host_buffers;
23964 }
23965
23966 @@ -1788,7 +1788,7 @@ he_service_rbrq(struct he_dev *he_dev, i
23967 vcc->push(vcc, skb);
23968 spin_lock(&he_dev->global_lock);
23969
23970 - atomic_inc(&vcc->stats->rx);
23971 + atomic_inc_unchecked(&vcc->stats->rx);
23972
23973 return_host_buffers:
23974 ++pdus_assembled;
23975 @@ -2114,7 +2114,7 @@ __enqueue_tpd(struct he_dev *he_dev, str
23976 tpd->vcc->pop(tpd->vcc, tpd->skb);
23977 else
23978 dev_kfree_skb_any(tpd->skb);
23979 - atomic_inc(&tpd->vcc->stats->tx_err);
23980 + atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
23981 }
23982 pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
23983 return;
23984 @@ -2526,7 +2526,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
23985 vcc->pop(vcc, skb);
23986 else
23987 dev_kfree_skb_any(skb);
23988 - atomic_inc(&vcc->stats->tx_err);
23989 + atomic_inc_unchecked(&vcc->stats->tx_err);
23990 return -EINVAL;
23991 }
23992
23993 @@ -2537,7 +2537,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
23994 vcc->pop(vcc, skb);
23995 else
23996 dev_kfree_skb_any(skb);
23997 - atomic_inc(&vcc->stats->tx_err);
23998 + atomic_inc_unchecked(&vcc->stats->tx_err);
23999 return -EINVAL;
24000 }
24001 #endif
24002 @@ -2549,7 +2549,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
24003 vcc->pop(vcc, skb);
24004 else
24005 dev_kfree_skb_any(skb);
24006 - atomic_inc(&vcc->stats->tx_err);
24007 + atomic_inc_unchecked(&vcc->stats->tx_err);
24008 spin_unlock_irqrestore(&he_dev->global_lock, flags);
24009 return -ENOMEM;
24010 }
24011 @@ -2591,7 +2591,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
24012 vcc->pop(vcc, skb);
24013 else
24014 dev_kfree_skb_any(skb);
24015 - atomic_inc(&vcc->stats->tx_err);
24016 + atomic_inc_unchecked(&vcc->stats->tx_err);
24017 spin_unlock_irqrestore(&he_dev->global_lock, flags);
24018 return -ENOMEM;
24019 }
24020 @@ -2622,7 +2622,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
24021 __enqueue_tpd(he_dev, tpd, cid);
24022 spin_unlock_irqrestore(&he_dev->global_lock, flags);
24023
24024 - atomic_inc(&vcc->stats->tx);
24025 + atomic_inc_unchecked(&vcc->stats->tx);
24026
24027 return 0;
24028 }
24029 diff -urNp linux-3.0.8/drivers/atm/horizon.c linux-3.0.8/drivers/atm/horizon.c
24030 --- linux-3.0.8/drivers/atm/horizon.c 2011-07-21 22:17:23.000000000 -0400
24031 +++ linux-3.0.8/drivers/atm/horizon.c 2011-08-23 21:47:55.000000000 -0400
24032 @@ -1034,7 +1034,7 @@ static void rx_schedule (hrz_dev * dev,
24033 {
24034 struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
24035 // VC layer stats
24036 - atomic_inc(&vcc->stats->rx);
24037 + atomic_inc_unchecked(&vcc->stats->rx);
24038 __net_timestamp(skb);
24039 // end of our responsibility
24040 vcc->push (vcc, skb);
24041 @@ -1186,7 +1186,7 @@ static void tx_schedule (hrz_dev * const
24042 dev->tx_iovec = NULL;
24043
24044 // VC layer stats
24045 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
24046 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
24047
24048 // free the skb
24049 hrz_kfree_skb (skb);
24050 diff -urNp linux-3.0.8/drivers/atm/idt77252.c linux-3.0.8/drivers/atm/idt77252.c
24051 --- linux-3.0.8/drivers/atm/idt77252.c 2011-07-21 22:17:23.000000000 -0400
24052 +++ linux-3.0.8/drivers/atm/idt77252.c 2011-08-23 21:47:55.000000000 -0400
24053 @@ -811,7 +811,7 @@ drain_scq(struct idt77252_dev *card, str
24054 else
24055 dev_kfree_skb(skb);
24056
24057 - atomic_inc(&vcc->stats->tx);
24058 + atomic_inc_unchecked(&vcc->stats->tx);
24059 }
24060
24061 atomic_dec(&scq->used);
24062 @@ -1074,13 +1074,13 @@ dequeue_rx(struct idt77252_dev *card, st
24063 if ((sb = dev_alloc_skb(64)) == NULL) {
24064 printk("%s: Can't allocate buffers for aal0.\n",
24065 card->name);
24066 - atomic_add(i, &vcc->stats->rx_drop);
24067 + atomic_add_unchecked(i, &vcc->stats->rx_drop);
24068 break;
24069 }
24070 if (!atm_charge(vcc, sb->truesize)) {
24071 RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
24072 card->name);
24073 - atomic_add(i - 1, &vcc->stats->rx_drop);
24074 + atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
24075 dev_kfree_skb(sb);
24076 break;
24077 }
24078 @@ -1097,7 +1097,7 @@ dequeue_rx(struct idt77252_dev *card, st
24079 ATM_SKB(sb)->vcc = vcc;
24080 __net_timestamp(sb);
24081 vcc->push(vcc, sb);
24082 - atomic_inc(&vcc->stats->rx);
24083 + atomic_inc_unchecked(&vcc->stats->rx);
24084
24085 cell += ATM_CELL_PAYLOAD;
24086 }
24087 @@ -1134,13 +1134,13 @@ dequeue_rx(struct idt77252_dev *card, st
24088 "(CDC: %08x)\n",
24089 card->name, len, rpp->len, readl(SAR_REG_CDC));
24090 recycle_rx_pool_skb(card, rpp);
24091 - atomic_inc(&vcc->stats->rx_err);
24092 + atomic_inc_unchecked(&vcc->stats->rx_err);
24093 return;
24094 }
24095 if (stat & SAR_RSQE_CRC) {
24096 RXPRINTK("%s: AAL5 CRC error.\n", card->name);
24097 recycle_rx_pool_skb(card, rpp);
24098 - atomic_inc(&vcc->stats->rx_err);
24099 + atomic_inc_unchecked(&vcc->stats->rx_err);
24100 return;
24101 }
24102 if (skb_queue_len(&rpp->queue) > 1) {
24103 @@ -1151,7 +1151,7 @@ dequeue_rx(struct idt77252_dev *card, st
24104 RXPRINTK("%s: Can't alloc RX skb.\n",
24105 card->name);
24106 recycle_rx_pool_skb(card, rpp);
24107 - atomic_inc(&vcc->stats->rx_err);
24108 + atomic_inc_unchecked(&vcc->stats->rx_err);
24109 return;
24110 }
24111 if (!atm_charge(vcc, skb->truesize)) {
24112 @@ -1170,7 +1170,7 @@ dequeue_rx(struct idt77252_dev *card, st
24113 __net_timestamp(skb);
24114
24115 vcc->push(vcc, skb);
24116 - atomic_inc(&vcc->stats->rx);
24117 + atomic_inc_unchecked(&vcc->stats->rx);
24118
24119 return;
24120 }
24121 @@ -1192,7 +1192,7 @@ dequeue_rx(struct idt77252_dev *card, st
24122 __net_timestamp(skb);
24123
24124 vcc->push(vcc, skb);
24125 - atomic_inc(&vcc->stats->rx);
24126 + atomic_inc_unchecked(&vcc->stats->rx);
24127
24128 if (skb->truesize > SAR_FB_SIZE_3)
24129 add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
24130 @@ -1303,14 +1303,14 @@ idt77252_rx_raw(struct idt77252_dev *car
24131 if (vcc->qos.aal != ATM_AAL0) {
24132 RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
24133 card->name, vpi, vci);
24134 - atomic_inc(&vcc->stats->rx_drop);
24135 + atomic_inc_unchecked(&vcc->stats->rx_drop);
24136 goto drop;
24137 }
24138
24139 if ((sb = dev_alloc_skb(64)) == NULL) {
24140 printk("%s: Can't allocate buffers for AAL0.\n",
24141 card->name);
24142 - atomic_inc(&vcc->stats->rx_err);
24143 + atomic_inc_unchecked(&vcc->stats->rx_err);
24144 goto drop;
24145 }
24146
24147 @@ -1329,7 +1329,7 @@ idt77252_rx_raw(struct idt77252_dev *car
24148 ATM_SKB(sb)->vcc = vcc;
24149 __net_timestamp(sb);
24150 vcc->push(vcc, sb);
24151 - atomic_inc(&vcc->stats->rx);
24152 + atomic_inc_unchecked(&vcc->stats->rx);
24153
24154 drop:
24155 skb_pull(queue, 64);
24156 @@ -1954,13 +1954,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s
24157
24158 if (vc == NULL) {
24159 printk("%s: NULL connection in send().\n", card->name);
24160 - atomic_inc(&vcc->stats->tx_err);
24161 + atomic_inc_unchecked(&vcc->stats->tx_err);
24162 dev_kfree_skb(skb);
24163 return -EINVAL;
24164 }
24165 if (!test_bit(VCF_TX, &vc->flags)) {
24166 printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
24167 - atomic_inc(&vcc->stats->tx_err);
24168 + atomic_inc_unchecked(&vcc->stats->tx_err);
24169 dev_kfree_skb(skb);
24170 return -EINVAL;
24171 }
24172 @@ -1972,14 +1972,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s
24173 break;
24174 default:
24175 printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
24176 - atomic_inc(&vcc->stats->tx_err);
24177 + atomic_inc_unchecked(&vcc->stats->tx_err);
24178 dev_kfree_skb(skb);
24179 return -EINVAL;
24180 }
24181
24182 if (skb_shinfo(skb)->nr_frags != 0) {
24183 printk("%s: No scatter-gather yet.\n", card->name);
24184 - atomic_inc(&vcc->stats->tx_err);
24185 + atomic_inc_unchecked(&vcc->stats->tx_err);
24186 dev_kfree_skb(skb);
24187 return -EINVAL;
24188 }
24189 @@ -1987,7 +1987,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s
24190
24191 err = queue_skb(card, vc, skb, oam);
24192 if (err) {
24193 - atomic_inc(&vcc->stats->tx_err);
24194 + atomic_inc_unchecked(&vcc->stats->tx_err);
24195 dev_kfree_skb(skb);
24196 return err;
24197 }
24198 @@ -2010,7 +2010,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v
24199 skb = dev_alloc_skb(64);
24200 if (!skb) {
24201 printk("%s: Out of memory in send_oam().\n", card->name);
24202 - atomic_inc(&vcc->stats->tx_err);
24203 + atomic_inc_unchecked(&vcc->stats->tx_err);
24204 return -ENOMEM;
24205 }
24206 atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
24207 diff -urNp linux-3.0.8/drivers/atm/iphase.c linux-3.0.8/drivers/atm/iphase.c
24208 --- linux-3.0.8/drivers/atm/iphase.c 2011-07-21 22:17:23.000000000 -0400
24209 +++ linux-3.0.8/drivers/atm/iphase.c 2011-08-23 21:47:55.000000000 -0400
24210 @@ -1120,7 +1120,7 @@ static int rx_pkt(struct atm_dev *dev)
24211 status = (u_short) (buf_desc_ptr->desc_mode);
24212 if (status & (RX_CER | RX_PTE | RX_OFL))
24213 {
24214 - atomic_inc(&vcc->stats->rx_err);
24215 + atomic_inc_unchecked(&vcc->stats->rx_err);
24216 IF_ERR(printk("IA: bad packet, dropping it");)
24217 if (status & RX_CER) {
24218 IF_ERR(printk(" cause: packet CRC error\n");)
24219 @@ -1143,7 +1143,7 @@ static int rx_pkt(struct atm_dev *dev)
24220 len = dma_addr - buf_addr;
24221 if (len > iadev->rx_buf_sz) {
24222 printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
24223 - atomic_inc(&vcc->stats->rx_err);
24224 + atomic_inc_unchecked(&vcc->stats->rx_err);
24225 goto out_free_desc;
24226 }
24227
24228 @@ -1293,7 +1293,7 @@ static void rx_dle_intr(struct atm_dev *
24229 ia_vcc = INPH_IA_VCC(vcc);
24230 if (ia_vcc == NULL)
24231 {
24232 - atomic_inc(&vcc->stats->rx_err);
24233 + atomic_inc_unchecked(&vcc->stats->rx_err);
24234 dev_kfree_skb_any(skb);
24235 atm_return(vcc, atm_guess_pdu2truesize(len));
24236 goto INCR_DLE;
24237 @@ -1305,7 +1305,7 @@ static void rx_dle_intr(struct atm_dev *
24238 if ((length > iadev->rx_buf_sz) || (length >
24239 (skb->len - sizeof(struct cpcs_trailer))))
24240 {
24241 - atomic_inc(&vcc->stats->rx_err);
24242 + atomic_inc_unchecked(&vcc->stats->rx_err);
24243 IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
24244 length, skb->len);)
24245 dev_kfree_skb_any(skb);
24246 @@ -1321,7 +1321,7 @@ static void rx_dle_intr(struct atm_dev *
24247
24248 IF_RX(printk("rx_dle_intr: skb push");)
24249 vcc->push(vcc,skb);
24250 - atomic_inc(&vcc->stats->rx);
24251 + atomic_inc_unchecked(&vcc->stats->rx);
24252 iadev->rx_pkt_cnt++;
24253 }
24254 INCR_DLE:
24255 @@ -2801,15 +2801,15 @@ static int ia_ioctl(struct atm_dev *dev,
24256 {
24257 struct k_sonet_stats *stats;
24258 stats = &PRIV(_ia_dev[board])->sonet_stats;
24259 - printk("section_bip: %d\n", atomic_read(&stats->section_bip));
24260 - printk("line_bip : %d\n", atomic_read(&stats->line_bip));
24261 - printk("path_bip : %d\n", atomic_read(&stats->path_bip));
24262 - printk("line_febe : %d\n", atomic_read(&stats->line_febe));
24263 - printk("path_febe : %d\n", atomic_read(&stats->path_febe));
24264 - printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
24265 - printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
24266 - printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
24267 - printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
24268 + printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
24269 + printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
24270 + printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
24271 + printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
24272 + printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
24273 + printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
24274 + printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
24275 + printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
24276 + printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
24277 }
24278 ia_cmds.status = 0;
24279 break;
24280 @@ -2914,7 +2914,7 @@ static int ia_pkt_tx (struct atm_vcc *vc
24281 if ((desc == 0) || (desc > iadev->num_tx_desc))
24282 {
24283 IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
24284 - atomic_inc(&vcc->stats->tx);
24285 + atomic_inc_unchecked(&vcc->stats->tx);
24286 if (vcc->pop)
24287 vcc->pop(vcc, skb);
24288 else
24289 @@ -3019,14 +3019,14 @@ static int ia_pkt_tx (struct atm_vcc *vc
24290 ATM_DESC(skb) = vcc->vci;
24291 skb_queue_tail(&iadev->tx_dma_q, skb);
24292
24293 - atomic_inc(&vcc->stats->tx);
24294 + atomic_inc_unchecked(&vcc->stats->tx);
24295 iadev->tx_pkt_cnt++;
24296 /* Increment transaction counter */
24297 writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
24298
24299 #if 0
24300 /* add flow control logic */
24301 - if (atomic_read(&vcc->stats->tx) % 20 == 0) {
24302 + if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
24303 if (iavcc->vc_desc_cnt > 10) {
24304 vcc->tx_quota = vcc->tx_quota * 3 / 4;
24305 printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
24306 diff -urNp linux-3.0.8/drivers/atm/lanai.c linux-3.0.8/drivers/atm/lanai.c
24307 --- linux-3.0.8/drivers/atm/lanai.c 2011-07-21 22:17:23.000000000 -0400
24308 +++ linux-3.0.8/drivers/atm/lanai.c 2011-08-23 21:47:55.000000000 -0400
24309 @@ -1303,7 +1303,7 @@ static void lanai_send_one_aal5(struct l
24310 vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
24311 lanai_endtx(lanai, lvcc);
24312 lanai_free_skb(lvcc->tx.atmvcc, skb);
24313 - atomic_inc(&lvcc->tx.atmvcc->stats->tx);
24314 + atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
24315 }
24316
24317 /* Try to fill the buffer - don't call unless there is backlog */
24318 @@ -1426,7 +1426,7 @@ static void vcc_rx_aal5(struct lanai_vcc
24319 ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
24320 __net_timestamp(skb);
24321 lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
24322 - atomic_inc(&lvcc->rx.atmvcc->stats->rx);
24323 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
24324 out:
24325 lvcc->rx.buf.ptr = end;
24326 cardvcc_write(lvcc, endptr, vcc_rxreadptr);
24327 @@ -1668,7 +1668,7 @@ static int handle_service(struct lanai_d
24328 DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
24329 "vcc %d\n", lanai->number, (unsigned int) s, vci);
24330 lanai->stats.service_rxnotaal5++;
24331 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
24332 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
24333 return 0;
24334 }
24335 if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
24336 @@ -1680,7 +1680,7 @@ static int handle_service(struct lanai_d
24337 int bytes;
24338 read_unlock(&vcc_sklist_lock);
24339 DPRINTK("got trashed rx pdu on vci %d\n", vci);
24340 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
24341 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
24342 lvcc->stats.x.aal5.service_trash++;
24343 bytes = (SERVICE_GET_END(s) * 16) -
24344 (((unsigned long) lvcc->rx.buf.ptr) -
24345 @@ -1692,7 +1692,7 @@ static int handle_service(struct lanai_d
24346 }
24347 if (s & SERVICE_STREAM) {
24348 read_unlock(&vcc_sklist_lock);
24349 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
24350 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
24351 lvcc->stats.x.aal5.service_stream++;
24352 printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
24353 "PDU on VCI %d!\n", lanai->number, vci);
24354 @@ -1700,7 +1700,7 @@ static int handle_service(struct lanai_d
24355 return 0;
24356 }
24357 DPRINTK("got rx crc error on vci %d\n", vci);
24358 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
24359 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
24360 lvcc->stats.x.aal5.service_rxcrc++;
24361 lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
24362 cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
24363 diff -urNp linux-3.0.8/drivers/atm/nicstar.c linux-3.0.8/drivers/atm/nicstar.c
24364 --- linux-3.0.8/drivers/atm/nicstar.c 2011-07-21 22:17:23.000000000 -0400
24365 +++ linux-3.0.8/drivers/atm/nicstar.c 2011-08-23 21:47:55.000000000 -0400
24366 @@ -1654,7 +1654,7 @@ static int ns_send(struct atm_vcc *vcc,
24367 if ((vc = (vc_map *) vcc->dev_data) == NULL) {
24368 printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n",
24369 card->index);
24370 - atomic_inc(&vcc->stats->tx_err);
24371 + atomic_inc_unchecked(&vcc->stats->tx_err);
24372 dev_kfree_skb_any(skb);
24373 return -EINVAL;
24374 }
24375 @@ -1662,7 +1662,7 @@ static int ns_send(struct atm_vcc *vcc,
24376 if (!vc->tx) {
24377 printk("nicstar%d: Trying to transmit on a non-tx VC.\n",
24378 card->index);
24379 - atomic_inc(&vcc->stats->tx_err);
24380 + atomic_inc_unchecked(&vcc->stats->tx_err);
24381 dev_kfree_skb_any(skb);
24382 return -EINVAL;
24383 }
24384 @@ -1670,14 +1670,14 @@ static int ns_send(struct atm_vcc *vcc,
24385 if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0) {
24386 printk("nicstar%d: Only AAL0 and AAL5 are supported.\n",
24387 card->index);
24388 - atomic_inc(&vcc->stats->tx_err);
24389 + atomic_inc_unchecked(&vcc->stats->tx_err);
24390 dev_kfree_skb_any(skb);
24391 return -EINVAL;
24392 }
24393
24394 if (skb_shinfo(skb)->nr_frags != 0) {
24395 printk("nicstar%d: No scatter-gather yet.\n", card->index);
24396 - atomic_inc(&vcc->stats->tx_err);
24397 + atomic_inc_unchecked(&vcc->stats->tx_err);
24398 dev_kfree_skb_any(skb);
24399 return -EINVAL;
24400 }
24401 @@ -1725,11 +1725,11 @@ static int ns_send(struct atm_vcc *vcc,
24402 }
24403
24404 if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
24405 - atomic_inc(&vcc->stats->tx_err);
24406 + atomic_inc_unchecked(&vcc->stats->tx_err);
24407 dev_kfree_skb_any(skb);
24408 return -EIO;
24409 }
24410 - atomic_inc(&vcc->stats->tx);
24411 + atomic_inc_unchecked(&vcc->stats->tx);
24412
24413 return 0;
24414 }
24415 @@ -2046,14 +2046,14 @@ static void dequeue_rx(ns_dev * card, ns
24416 printk
24417 ("nicstar%d: Can't allocate buffers for aal0.\n",
24418 card->index);
24419 - atomic_add(i, &vcc->stats->rx_drop);
24420 + atomic_add_unchecked(i, &vcc->stats->rx_drop);
24421 break;
24422 }
24423 if (!atm_charge(vcc, sb->truesize)) {
24424 RXPRINTK
24425 ("nicstar%d: atm_charge() dropped aal0 packets.\n",
24426 card->index);
24427 - atomic_add(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
24428 + atomic_add_unchecked(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
24429 dev_kfree_skb_any(sb);
24430 break;
24431 }
24432 @@ -2068,7 +2068,7 @@ static void dequeue_rx(ns_dev * card, ns
24433 ATM_SKB(sb)->vcc = vcc;
24434 __net_timestamp(sb);
24435 vcc->push(vcc, sb);
24436 - atomic_inc(&vcc->stats->rx);
24437 + atomic_inc_unchecked(&vcc->stats->rx);
24438 cell += ATM_CELL_PAYLOAD;
24439 }
24440
24441 @@ -2085,7 +2085,7 @@ static void dequeue_rx(ns_dev * card, ns
24442 if (iovb == NULL) {
24443 printk("nicstar%d: Out of iovec buffers.\n",
24444 card->index);
24445 - atomic_inc(&vcc->stats->rx_drop);
24446 + atomic_inc_unchecked(&vcc->stats->rx_drop);
24447 recycle_rx_buf(card, skb);
24448 return;
24449 }
24450 @@ -2109,7 +2109,7 @@ static void dequeue_rx(ns_dev * card, ns
24451 small or large buffer itself. */
24452 } else if (NS_PRV_IOVCNT(iovb) >= NS_MAX_IOVECS) {
24453 printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
24454 - atomic_inc(&vcc->stats->rx_err);
24455 + atomic_inc_unchecked(&vcc->stats->rx_err);
24456 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
24457 NS_MAX_IOVECS);
24458 NS_PRV_IOVCNT(iovb) = 0;
24459 @@ -2129,7 +2129,7 @@ static void dequeue_rx(ns_dev * card, ns
24460 ("nicstar%d: Expected a small buffer, and this is not one.\n",
24461 card->index);
24462 which_list(card, skb);
24463 - atomic_inc(&vcc->stats->rx_err);
24464 + atomic_inc_unchecked(&vcc->stats->rx_err);
24465 recycle_rx_buf(card, skb);
24466 vc->rx_iov = NULL;
24467 recycle_iov_buf(card, iovb);
24468 @@ -2142,7 +2142,7 @@ static void dequeue_rx(ns_dev * card, ns
24469 ("nicstar%d: Expected a large buffer, and this is not one.\n",
24470 card->index);
24471 which_list(card, skb);
24472 - atomic_inc(&vcc->stats->rx_err);
24473 + atomic_inc_unchecked(&vcc->stats->rx_err);
24474 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
24475 NS_PRV_IOVCNT(iovb));
24476 vc->rx_iov = NULL;
24477 @@ -2165,7 +2165,7 @@ static void dequeue_rx(ns_dev * card, ns
24478 printk(" - PDU size mismatch.\n");
24479 else
24480 printk(".\n");
24481 - atomic_inc(&vcc->stats->rx_err);
24482 + atomic_inc_unchecked(&vcc->stats->rx_err);
24483 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
24484 NS_PRV_IOVCNT(iovb));
24485 vc->rx_iov = NULL;
24486 @@ -2179,7 +2179,7 @@ static void dequeue_rx(ns_dev * card, ns
24487 /* skb points to a small buffer */
24488 if (!atm_charge(vcc, skb->truesize)) {
24489 push_rxbufs(card, skb);
24490 - atomic_inc(&vcc->stats->rx_drop);
24491 + atomic_inc_unchecked(&vcc->stats->rx_drop);
24492 } else {
24493 skb_put(skb, len);
24494 dequeue_sm_buf(card, skb);
24495 @@ -2189,7 +2189,7 @@ static void dequeue_rx(ns_dev * card, ns
24496 ATM_SKB(skb)->vcc = vcc;
24497 __net_timestamp(skb);
24498 vcc->push(vcc, skb);
24499 - atomic_inc(&vcc->stats->rx);
24500 + atomic_inc_unchecked(&vcc->stats->rx);
24501 }
24502 } else if (NS_PRV_IOVCNT(iovb) == 2) { /* One small plus one large buffer */
24503 struct sk_buff *sb;
24504 @@ -2200,7 +2200,7 @@ static void dequeue_rx(ns_dev * card, ns
24505 if (len <= NS_SMBUFSIZE) {
24506 if (!atm_charge(vcc, sb->truesize)) {
24507 push_rxbufs(card, sb);
24508 - atomic_inc(&vcc->stats->rx_drop);
24509 + atomic_inc_unchecked(&vcc->stats->rx_drop);
24510 } else {
24511 skb_put(sb, len);
24512 dequeue_sm_buf(card, sb);
24513 @@ -2210,7 +2210,7 @@ static void dequeue_rx(ns_dev * card, ns
24514 ATM_SKB(sb)->vcc = vcc;
24515 __net_timestamp(sb);
24516 vcc->push(vcc, sb);
24517 - atomic_inc(&vcc->stats->rx);
24518 + atomic_inc_unchecked(&vcc->stats->rx);
24519 }
24520
24521 push_rxbufs(card, skb);
24522 @@ -2219,7 +2219,7 @@ static void dequeue_rx(ns_dev * card, ns
24523
24524 if (!atm_charge(vcc, skb->truesize)) {
24525 push_rxbufs(card, skb);
24526 - atomic_inc(&vcc->stats->rx_drop);
24527 + atomic_inc_unchecked(&vcc->stats->rx_drop);
24528 } else {
24529 dequeue_lg_buf(card, skb);
24530 #ifdef NS_USE_DESTRUCTORS
24531 @@ -2232,7 +2232,7 @@ static void dequeue_rx(ns_dev * card, ns
24532 ATM_SKB(skb)->vcc = vcc;
24533 __net_timestamp(skb);
24534 vcc->push(vcc, skb);
24535 - atomic_inc(&vcc->stats->rx);
24536 + atomic_inc_unchecked(&vcc->stats->rx);
24537 }
24538
24539 push_rxbufs(card, sb);
24540 @@ -2253,7 +2253,7 @@ static void dequeue_rx(ns_dev * card, ns
24541 printk
24542 ("nicstar%d: Out of huge buffers.\n",
24543 card->index);
24544 - atomic_inc(&vcc->stats->rx_drop);
24545 + atomic_inc_unchecked(&vcc->stats->rx_drop);
24546 recycle_iovec_rx_bufs(card,
24547 (struct iovec *)
24548 iovb->data,
24549 @@ -2304,7 +2304,7 @@ static void dequeue_rx(ns_dev * card, ns
24550 card->hbpool.count++;
24551 } else
24552 dev_kfree_skb_any(hb);
24553 - atomic_inc(&vcc->stats->rx_drop);
24554 + atomic_inc_unchecked(&vcc->stats->rx_drop);
24555 } else {
24556 /* Copy the small buffer to the huge buffer */
24557 sb = (struct sk_buff *)iov->iov_base;
24558 @@ -2341,7 +2341,7 @@ static void dequeue_rx(ns_dev * card, ns
24559 #endif /* NS_USE_DESTRUCTORS */
24560 __net_timestamp(hb);
24561 vcc->push(vcc, hb);
24562 - atomic_inc(&vcc->stats->rx);
24563 + atomic_inc_unchecked(&vcc->stats->rx);
24564 }
24565 }
24566
24567 diff -urNp linux-3.0.8/drivers/atm/solos-pci.c linux-3.0.8/drivers/atm/solos-pci.c
24568 --- linux-3.0.8/drivers/atm/solos-pci.c 2011-07-21 22:17:23.000000000 -0400
24569 +++ linux-3.0.8/drivers/atm/solos-pci.c 2011-08-23 21:48:14.000000000 -0400
24570 @@ -714,7 +714,7 @@ void solos_bh(unsigned long card_arg)
24571 }
24572 atm_charge(vcc, skb->truesize);
24573 vcc->push(vcc, skb);
24574 - atomic_inc(&vcc->stats->rx);
24575 + atomic_inc_unchecked(&vcc->stats->rx);
24576 break;
24577
24578 case PKT_STATUS:
24579 @@ -899,6 +899,8 @@ static int print_buffer(struct sk_buff *
24580 char msg[500];
24581 char item[10];
24582
24583 + pax_track_stack();
24584 +
24585 len = buf->len;
24586 for (i = 0; i < len; i++){
24587 if(i % 8 == 0)
24588 @@ -1008,7 +1010,7 @@ static uint32_t fpga_tx(struct solos_car
24589 vcc = SKB_CB(oldskb)->vcc;
24590
24591 if (vcc) {
24592 - atomic_inc(&vcc->stats->tx);
24593 + atomic_inc_unchecked(&vcc->stats->tx);
24594 solos_pop(vcc, oldskb);
24595 } else
24596 dev_kfree_skb_irq(oldskb);
24597 diff -urNp linux-3.0.8/drivers/atm/suni.c linux-3.0.8/drivers/atm/suni.c
24598 --- linux-3.0.8/drivers/atm/suni.c 2011-07-21 22:17:23.000000000 -0400
24599 +++ linux-3.0.8/drivers/atm/suni.c 2011-08-23 21:47:55.000000000 -0400
24600 @@ -50,8 +50,8 @@ static DEFINE_SPINLOCK(sunis_lock);
24601
24602
24603 #define ADD_LIMITED(s,v) \
24604 - atomic_add((v),&stats->s); \
24605 - if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
24606 + atomic_add_unchecked((v),&stats->s); \
24607 + if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
24608
24609
24610 static void suni_hz(unsigned long from_timer)
24611 diff -urNp linux-3.0.8/drivers/atm/uPD98402.c linux-3.0.8/drivers/atm/uPD98402.c
24612 --- linux-3.0.8/drivers/atm/uPD98402.c 2011-07-21 22:17:23.000000000 -0400
24613 +++ linux-3.0.8/drivers/atm/uPD98402.c 2011-08-23 21:47:55.000000000 -0400
24614 @@ -42,7 +42,7 @@ static int fetch_stats(struct atm_dev *d
24615 struct sonet_stats tmp;
24616 int error = 0;
24617
24618 - atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
24619 + atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
24620 sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
24621 if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
24622 if (zero && !error) {
24623 @@ -161,9 +161,9 @@ static int uPD98402_ioctl(struct atm_dev
24624
24625
24626 #define ADD_LIMITED(s,v) \
24627 - { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
24628 - if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
24629 - atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
24630 + { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
24631 + if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
24632 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
24633
24634
24635 static void stat_event(struct atm_dev *dev)
24636 @@ -194,7 +194,7 @@ static void uPD98402_int(struct atm_dev
24637 if (reason & uPD98402_INT_PFM) stat_event(dev);
24638 if (reason & uPD98402_INT_PCO) {
24639 (void) GET(PCOCR); /* clear interrupt cause */
24640 - atomic_add(GET(HECCT),
24641 + atomic_add_unchecked(GET(HECCT),
24642 &PRIV(dev)->sonet_stats.uncorr_hcs);
24643 }
24644 if ((reason & uPD98402_INT_RFO) &&
24645 @@ -222,9 +222,9 @@ static int uPD98402_start(struct atm_dev
24646 PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
24647 uPD98402_INT_LOS),PIMR); /* enable them */
24648 (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
24649 - atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
24650 - atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
24651 - atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
24652 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
24653 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
24654 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
24655 return 0;
24656 }
24657
24658 diff -urNp linux-3.0.8/drivers/atm/zatm.c linux-3.0.8/drivers/atm/zatm.c
24659 --- linux-3.0.8/drivers/atm/zatm.c 2011-07-21 22:17:23.000000000 -0400
24660 +++ linux-3.0.8/drivers/atm/zatm.c 2011-08-23 21:47:55.000000000 -0400
24661 @@ -459,7 +459,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
24662 }
24663 if (!size) {
24664 dev_kfree_skb_irq(skb);
24665 - if (vcc) atomic_inc(&vcc->stats->rx_err);
24666 + if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
24667 continue;
24668 }
24669 if (!atm_charge(vcc,skb->truesize)) {
24670 @@ -469,7 +469,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
24671 skb->len = size;
24672 ATM_SKB(skb)->vcc = vcc;
24673 vcc->push(vcc,skb);
24674 - atomic_inc(&vcc->stats->rx);
24675 + atomic_inc_unchecked(&vcc->stats->rx);
24676 }
24677 zout(pos & 0xffff,MTA(mbx));
24678 #if 0 /* probably a stupid idea */
24679 @@ -733,7 +733,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD
24680 skb_queue_head(&zatm_vcc->backlog,skb);
24681 break;
24682 }
24683 - atomic_inc(&vcc->stats->tx);
24684 + atomic_inc_unchecked(&vcc->stats->tx);
24685 wake_up(&zatm_vcc->tx_wait);
24686 }
24687
24688 diff -urNp linux-3.0.8/drivers/base/devtmpfs.c linux-3.0.8/drivers/base/devtmpfs.c
24689 --- linux-3.0.8/drivers/base/devtmpfs.c 2011-07-21 22:17:23.000000000 -0400
24690 +++ linux-3.0.8/drivers/base/devtmpfs.c 2011-10-06 04:17:55.000000000 -0400
24691 @@ -357,7 +357,7 @@ int devtmpfs_mount(const char *mntdir)
24692 if (!dev_mnt)
24693 return 0;
24694
24695 - err = sys_mount("devtmpfs", (char *)mntdir, "devtmpfs", MS_SILENT, NULL);
24696 + err = sys_mount((char __force_user *)"devtmpfs", (char __force_user *)mntdir, (char __force_user *)"devtmpfs", MS_SILENT, NULL);
24697 if (err)
24698 printk(KERN_INFO "devtmpfs: error mounting %i\n", err);
24699 else
24700 diff -urNp linux-3.0.8/drivers/base/power/wakeup.c linux-3.0.8/drivers/base/power/wakeup.c
24701 --- linux-3.0.8/drivers/base/power/wakeup.c 2011-07-21 22:17:23.000000000 -0400
24702 +++ linux-3.0.8/drivers/base/power/wakeup.c 2011-08-23 21:47:55.000000000 -0400
24703 @@ -29,14 +29,14 @@ bool events_check_enabled;
24704 * They need to be modified together atomically, so it's better to use one
24705 * atomic variable to hold them both.
24706 */
24707 -static atomic_t combined_event_count = ATOMIC_INIT(0);
24708 +static atomic_unchecked_t combined_event_count = ATOMIC_INIT(0);
24709
24710 #define IN_PROGRESS_BITS (sizeof(int) * 4)
24711 #define MAX_IN_PROGRESS ((1 << IN_PROGRESS_BITS) - 1)
24712
24713 static void split_counters(unsigned int *cnt, unsigned int *inpr)
24714 {
24715 - unsigned int comb = atomic_read(&combined_event_count);
24716 + unsigned int comb = atomic_read_unchecked(&combined_event_count);
24717
24718 *cnt = (comb >> IN_PROGRESS_BITS);
24719 *inpr = comb & MAX_IN_PROGRESS;
24720 @@ -350,7 +350,7 @@ static void wakeup_source_activate(struc
24721 ws->last_time = ktime_get();
24722
24723 /* Increment the counter of events in progress. */
24724 - atomic_inc(&combined_event_count);
24725 + atomic_inc_unchecked(&combined_event_count);
24726 }
24727
24728 /**
24729 @@ -440,7 +440,7 @@ static void wakeup_source_deactivate(str
24730 * Increment the counter of registered wakeup events and decrement the
24731 * couter of wakeup events in progress simultaneously.
24732 */
24733 - atomic_add(MAX_IN_PROGRESS, &combined_event_count);
24734 + atomic_add_unchecked(MAX_IN_PROGRESS, &combined_event_count);
24735 }
24736
24737 /**
24738 diff -urNp linux-3.0.8/drivers/block/cciss.c linux-3.0.8/drivers/block/cciss.c
24739 --- linux-3.0.8/drivers/block/cciss.c 2011-07-21 22:17:23.000000000 -0400
24740 +++ linux-3.0.8/drivers/block/cciss.c 2011-08-23 21:48:14.000000000 -0400
24741 @@ -1179,6 +1179,8 @@ static int cciss_ioctl32_passthru(struct
24742 int err;
24743 u32 cp;
24744
24745 + memset(&arg64, 0, sizeof(arg64));
24746 +
24747 err = 0;
24748 err |=
24749 copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
24750 @@ -2986,7 +2988,7 @@ static void start_io(ctlr_info_t *h)
24751 while (!list_empty(&h->reqQ)) {
24752 c = list_entry(h->reqQ.next, CommandList_struct, list);
24753 /* can't do anything if fifo is full */
24754 - if ((h->access.fifo_full(h))) {
24755 + if ((h->access->fifo_full(h))) {
24756 dev_warn(&h->pdev->dev, "fifo full\n");
24757 break;
24758 }
24759 @@ -2996,7 +2998,7 @@ static void start_io(ctlr_info_t *h)
24760 h->Qdepth--;
24761
24762 /* Tell the controller execute command */
24763 - h->access.submit_command(h, c);
24764 + h->access->submit_command(h, c);
24765
24766 /* Put job onto the completed Q */
24767 addQ(&h->cmpQ, c);
24768 @@ -3422,17 +3424,17 @@ startio:
24769
24770 static inline unsigned long get_next_completion(ctlr_info_t *h)
24771 {
24772 - return h->access.command_completed(h);
24773 + return h->access->command_completed(h);
24774 }
24775
24776 static inline int interrupt_pending(ctlr_info_t *h)
24777 {
24778 - return h->access.intr_pending(h);
24779 + return h->access->intr_pending(h);
24780 }
24781
24782 static inline long interrupt_not_for_us(ctlr_info_t *h)
24783 {
24784 - return ((h->access.intr_pending(h) == 0) ||
24785 + return ((h->access->intr_pending(h) == 0) ||
24786 (h->interrupts_enabled == 0));
24787 }
24788
24789 @@ -3465,7 +3467,7 @@ static inline u32 next_command(ctlr_info
24790 u32 a;
24791
24792 if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
24793 - return h->access.command_completed(h);
24794 + return h->access->command_completed(h);
24795
24796 if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
24797 a = *(h->reply_pool_head); /* Next cmd in ring buffer */
24798 @@ -4020,7 +4022,7 @@ static void __devinit cciss_put_controll
24799 trans_support & CFGTBL_Trans_use_short_tags);
24800
24801 /* Change the access methods to the performant access methods */
24802 - h->access = SA5_performant_access;
24803 + h->access = &SA5_performant_access;
24804 h->transMethod = CFGTBL_Trans_Performant;
24805
24806 return;
24807 @@ -4292,7 +4294,7 @@ static int __devinit cciss_pci_init(ctlr
24808 if (prod_index < 0)
24809 return -ENODEV;
24810 h->product_name = products[prod_index].product_name;
24811 - h->access = *(products[prod_index].access);
24812 + h->access = products[prod_index].access;
24813
24814 if (cciss_board_disabled(h)) {
24815 dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
24816 @@ -5002,7 +5004,7 @@ reinit_after_soft_reset:
24817 }
24818
24819 /* make sure the board interrupts are off */
24820 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
24821 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
24822 rc = cciss_request_irq(h, do_cciss_msix_intr, do_cciss_intx);
24823 if (rc)
24824 goto clean2;
24825 @@ -5054,7 +5056,7 @@ reinit_after_soft_reset:
24826 * fake ones to scoop up any residual completions.
24827 */
24828 spin_lock_irqsave(&h->lock, flags);
24829 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
24830 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
24831 spin_unlock_irqrestore(&h->lock, flags);
24832 free_irq(h->intr[PERF_MODE_INT], h);
24833 rc = cciss_request_irq(h, cciss_msix_discard_completions,
24834 @@ -5074,9 +5076,9 @@ reinit_after_soft_reset:
24835 dev_info(&h->pdev->dev, "Board READY.\n");
24836 dev_info(&h->pdev->dev,
24837 "Waiting for stale completions to drain.\n");
24838 - h->access.set_intr_mask(h, CCISS_INTR_ON);
24839 + h->access->set_intr_mask(h, CCISS_INTR_ON);
24840 msleep(10000);
24841 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
24842 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
24843
24844 rc = controller_reset_failed(h->cfgtable);
24845 if (rc)
24846 @@ -5099,7 +5101,7 @@ reinit_after_soft_reset:
24847 cciss_scsi_setup(h);
24848
24849 /* Turn the interrupts on so we can service requests */
24850 - h->access.set_intr_mask(h, CCISS_INTR_ON);
24851 + h->access->set_intr_mask(h, CCISS_INTR_ON);
24852
24853 /* Get the firmware version */
24854 inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
24855 @@ -5171,7 +5173,7 @@ static void cciss_shutdown(struct pci_de
24856 kfree(flush_buf);
24857 if (return_code != IO_OK)
24858 dev_warn(&h->pdev->dev, "Error flushing cache\n");
24859 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
24860 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
24861 free_irq(h->intr[PERF_MODE_INT], h);
24862 }
24863
24864 diff -urNp linux-3.0.8/drivers/block/cciss.h linux-3.0.8/drivers/block/cciss.h
24865 --- linux-3.0.8/drivers/block/cciss.h 2011-10-24 08:05:21.000000000 -0400
24866 +++ linux-3.0.8/drivers/block/cciss.h 2011-08-23 21:47:55.000000000 -0400
24867 @@ -100,7 +100,7 @@ struct ctlr_info
24868 /* information about each logical volume */
24869 drive_info_struct *drv[CISS_MAX_LUN];
24870
24871 - struct access_method access;
24872 + struct access_method *access;
24873
24874 /* queue and queue Info */
24875 struct list_head reqQ;
24876 diff -urNp linux-3.0.8/drivers/block/cpqarray.c linux-3.0.8/drivers/block/cpqarray.c
24877 --- linux-3.0.8/drivers/block/cpqarray.c 2011-07-21 22:17:23.000000000 -0400
24878 +++ linux-3.0.8/drivers/block/cpqarray.c 2011-08-23 21:48:14.000000000 -0400
24879 @@ -404,7 +404,7 @@ static int __devinit cpqarray_register_c
24880 if (register_blkdev(COMPAQ_SMART2_MAJOR+i, hba[i]->devname)) {
24881 goto Enomem4;
24882 }
24883 - hba[i]->access.set_intr_mask(hba[i], 0);
24884 + hba[i]->access->set_intr_mask(hba[i], 0);
24885 if (request_irq(hba[i]->intr, do_ida_intr,
24886 IRQF_DISABLED|IRQF_SHARED, hba[i]->devname, hba[i]))
24887 {
24888 @@ -459,7 +459,7 @@ static int __devinit cpqarray_register_c
24889 add_timer(&hba[i]->timer);
24890
24891 /* Enable IRQ now that spinlock and rate limit timer are set up */
24892 - hba[i]->access.set_intr_mask(hba[i], FIFO_NOT_EMPTY);
24893 + hba[i]->access->set_intr_mask(hba[i], FIFO_NOT_EMPTY);
24894
24895 for(j=0; j<NWD; j++) {
24896 struct gendisk *disk = ida_gendisk[i][j];
24897 @@ -694,7 +694,7 @@ DBGINFO(
24898 for(i=0; i<NR_PRODUCTS; i++) {
24899 if (board_id == products[i].board_id) {
24900 c->product_name = products[i].product_name;
24901 - c->access = *(products[i].access);
24902 + c->access = products[i].access;
24903 break;
24904 }
24905 }
24906 @@ -792,7 +792,7 @@ static int __devinit cpqarray_eisa_detec
24907 hba[ctlr]->intr = intr;
24908 sprintf(hba[ctlr]->devname, "ida%d", nr_ctlr);
24909 hba[ctlr]->product_name = products[j].product_name;
24910 - hba[ctlr]->access = *(products[j].access);
24911 + hba[ctlr]->access = products[j].access;
24912 hba[ctlr]->ctlr = ctlr;
24913 hba[ctlr]->board_id = board_id;
24914 hba[ctlr]->pci_dev = NULL; /* not PCI */
24915 @@ -911,6 +911,8 @@ static void do_ida_request(struct reques
24916 struct scatterlist tmp_sg[SG_MAX];
24917 int i, dir, seg;
24918
24919 + pax_track_stack();
24920 +
24921 queue_next:
24922 creq = blk_peek_request(q);
24923 if (!creq)
24924 @@ -980,7 +982,7 @@ static void start_io(ctlr_info_t *h)
24925
24926 while((c = h->reqQ) != NULL) {
24927 /* Can't do anything if we're busy */
24928 - if (h->access.fifo_full(h) == 0)
24929 + if (h->access->fifo_full(h) == 0)
24930 return;
24931
24932 /* Get the first entry from the request Q */
24933 @@ -988,7 +990,7 @@ static void start_io(ctlr_info_t *h)
24934 h->Qdepth--;
24935
24936 /* Tell the controller to do our bidding */
24937 - h->access.submit_command(h, c);
24938 + h->access->submit_command(h, c);
24939
24940 /* Get onto the completion Q */
24941 addQ(&h->cmpQ, c);
24942 @@ -1050,7 +1052,7 @@ static irqreturn_t do_ida_intr(int irq,
24943 unsigned long flags;
24944 __u32 a,a1;
24945
24946 - istat = h->access.intr_pending(h);
24947 + istat = h->access->intr_pending(h);
24948 /* Is this interrupt for us? */
24949 if (istat == 0)
24950 return IRQ_NONE;
24951 @@ -1061,7 +1063,7 @@ static irqreturn_t do_ida_intr(int irq,
24952 */
24953 spin_lock_irqsave(IDA_LOCK(h->ctlr), flags);
24954 if (istat & FIFO_NOT_EMPTY) {
24955 - while((a = h->access.command_completed(h))) {
24956 + while((a = h->access->command_completed(h))) {
24957 a1 = a; a &= ~3;
24958 if ((c = h->cmpQ) == NULL)
24959 {
24960 @@ -1449,11 +1451,11 @@ static int sendcmd(
24961 /*
24962 * Disable interrupt
24963 */
24964 - info_p->access.set_intr_mask(info_p, 0);
24965 + info_p->access->set_intr_mask(info_p, 0);
24966 /* Make sure there is room in the command FIFO */
24967 /* Actually it should be completely empty at this time. */
24968 for (i = 200000; i > 0; i--) {
24969 - temp = info_p->access.fifo_full(info_p);
24970 + temp = info_p->access->fifo_full(info_p);
24971 if (temp != 0) {
24972 break;
24973 }
24974 @@ -1466,7 +1468,7 @@ DBG(
24975 /*
24976 * Send the cmd
24977 */
24978 - info_p->access.submit_command(info_p, c);
24979 + info_p->access->submit_command(info_p, c);
24980 complete = pollcomplete(ctlr);
24981
24982 pci_unmap_single(info_p->pci_dev, (dma_addr_t) c->req.sg[0].addr,
24983 @@ -1549,9 +1551,9 @@ static int revalidate_allvol(ctlr_info_t
24984 * we check the new geometry. Then turn interrupts back on when
24985 * we're done.
24986 */
24987 - host->access.set_intr_mask(host, 0);
24988 + host->access->set_intr_mask(host, 0);
24989 getgeometry(ctlr);
24990 - host->access.set_intr_mask(host, FIFO_NOT_EMPTY);
24991 + host->access->set_intr_mask(host, FIFO_NOT_EMPTY);
24992
24993 for(i=0; i<NWD; i++) {
24994 struct gendisk *disk = ida_gendisk[ctlr][i];
24995 @@ -1591,7 +1593,7 @@ static int pollcomplete(int ctlr)
24996 /* Wait (up to 2 seconds) for a command to complete */
24997
24998 for (i = 200000; i > 0; i--) {
24999 - done = hba[ctlr]->access.command_completed(hba[ctlr]);
25000 + done = hba[ctlr]->access->command_completed(hba[ctlr]);
25001 if (done == 0) {
25002 udelay(10); /* a short fixed delay */
25003 } else
25004 diff -urNp linux-3.0.8/drivers/block/cpqarray.h linux-3.0.8/drivers/block/cpqarray.h
25005 --- linux-3.0.8/drivers/block/cpqarray.h 2011-07-21 22:17:23.000000000 -0400
25006 +++ linux-3.0.8/drivers/block/cpqarray.h 2011-08-23 21:47:55.000000000 -0400
25007 @@ -99,7 +99,7 @@ struct ctlr_info {
25008 drv_info_t drv[NWD];
25009 struct proc_dir_entry *proc;
25010
25011 - struct access_method access;
25012 + struct access_method *access;
25013
25014 cmdlist_t *reqQ;
25015 cmdlist_t *cmpQ;
25016 diff -urNp linux-3.0.8/drivers/block/DAC960.c linux-3.0.8/drivers/block/DAC960.c
25017 --- linux-3.0.8/drivers/block/DAC960.c 2011-07-21 22:17:23.000000000 -0400
25018 +++ linux-3.0.8/drivers/block/DAC960.c 2011-08-23 21:48:14.000000000 -0400
25019 @@ -1980,6 +1980,8 @@ static bool DAC960_V1_ReadDeviceConfigur
25020 unsigned long flags;
25021 int Channel, TargetID;
25022
25023 + pax_track_stack();
25024 +
25025 if (!init_dma_loaf(Controller->PCIDevice, &local_dma,
25026 DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
25027 sizeof(DAC960_SCSI_Inquiry_T) +
25028 diff -urNp linux-3.0.8/drivers/block/drbd/drbd_int.h linux-3.0.8/drivers/block/drbd/drbd_int.h
25029 --- linux-3.0.8/drivers/block/drbd/drbd_int.h 2011-07-21 22:17:23.000000000 -0400
25030 +++ linux-3.0.8/drivers/block/drbd/drbd_int.h 2011-10-06 04:17:55.000000000 -0400
25031 @@ -737,7 +737,7 @@ struct drbd_request;
25032 struct drbd_epoch {
25033 struct list_head list;
25034 unsigned int barrier_nr;
25035 - atomic_t epoch_size; /* increased on every request added. */
25036 + atomic_unchecked_t epoch_size; /* increased on every request added. */
25037 atomic_t active; /* increased on every req. added, and dec on every finished. */
25038 unsigned long flags;
25039 };
25040 @@ -1109,7 +1109,7 @@ struct drbd_conf {
25041 void *int_dig_in;
25042 void *int_dig_vv;
25043 wait_queue_head_t seq_wait;
25044 - atomic_t packet_seq;
25045 + atomic_unchecked_t packet_seq;
25046 unsigned int peer_seq;
25047 spinlock_t peer_seq_lock;
25048 unsigned int minor;
25049 @@ -1618,30 +1618,30 @@ static inline int drbd_setsockopt(struct
25050
25051 static inline void drbd_tcp_cork(struct socket *sock)
25052 {
25053 - int __user val = 1;
25054 + int val = 1;
25055 (void) drbd_setsockopt(sock, SOL_TCP, TCP_CORK,
25056 - (char __user *)&val, sizeof(val));
25057 + (char __force_user *)&val, sizeof(val));
25058 }
25059
25060 static inline void drbd_tcp_uncork(struct socket *sock)
25061 {
25062 - int __user val = 0;
25063 + int val = 0;
25064 (void) drbd_setsockopt(sock, SOL_TCP, TCP_CORK,
25065 - (char __user *)&val, sizeof(val));
25066 + (char __force_user *)&val, sizeof(val));
25067 }
25068
25069 static inline void drbd_tcp_nodelay(struct socket *sock)
25070 {
25071 - int __user val = 1;
25072 + int val = 1;
25073 (void) drbd_setsockopt(sock, SOL_TCP, TCP_NODELAY,
25074 - (char __user *)&val, sizeof(val));
25075 + (char __force_user *)&val, sizeof(val));
25076 }
25077
25078 static inline void drbd_tcp_quickack(struct socket *sock)
25079 {
25080 - int __user val = 2;
25081 + int val = 2;
25082 (void) drbd_setsockopt(sock, SOL_TCP, TCP_QUICKACK,
25083 - (char __user *)&val, sizeof(val));
25084 + (char __force_user *)&val, sizeof(val));
25085 }
25086
25087 void drbd_bump_write_ordering(struct drbd_conf *mdev, enum write_ordering_e wo);
25088 diff -urNp linux-3.0.8/drivers/block/drbd/drbd_main.c linux-3.0.8/drivers/block/drbd/drbd_main.c
25089 --- linux-3.0.8/drivers/block/drbd/drbd_main.c 2011-07-21 22:17:23.000000000 -0400
25090 +++ linux-3.0.8/drivers/block/drbd/drbd_main.c 2011-08-23 21:47:55.000000000 -0400
25091 @@ -2397,7 +2397,7 @@ static int _drbd_send_ack(struct drbd_co
25092 p.sector = sector;
25093 p.block_id = block_id;
25094 p.blksize = blksize;
25095 - p.seq_num = cpu_to_be32(atomic_add_return(1, &mdev->packet_seq));
25096 + p.seq_num = cpu_to_be32(atomic_add_return_unchecked(1, &mdev->packet_seq));
25097
25098 if (!mdev->meta.socket || mdev->state.conn < C_CONNECTED)
25099 return false;
25100 @@ -2696,7 +2696,7 @@ int drbd_send_dblock(struct drbd_conf *m
25101 p.sector = cpu_to_be64(req->sector);
25102 p.block_id = (unsigned long)req;
25103 p.seq_num = cpu_to_be32(req->seq_num =
25104 - atomic_add_return(1, &mdev->packet_seq));
25105 + atomic_add_return_unchecked(1, &mdev->packet_seq));
25106
25107 dp_flags = bio_flags_to_wire(mdev, req->master_bio->bi_rw);
25108
25109 @@ -2981,7 +2981,7 @@ void drbd_init_set_defaults(struct drbd_
25110 atomic_set(&mdev->unacked_cnt, 0);
25111 atomic_set(&mdev->local_cnt, 0);
25112 atomic_set(&mdev->net_cnt, 0);
25113 - atomic_set(&mdev->packet_seq, 0);
25114 + atomic_set_unchecked(&mdev->packet_seq, 0);
25115 atomic_set(&mdev->pp_in_use, 0);
25116 atomic_set(&mdev->pp_in_use_by_net, 0);
25117 atomic_set(&mdev->rs_sect_in, 0);
25118 @@ -3063,8 +3063,8 @@ void drbd_mdev_cleanup(struct drbd_conf
25119 mdev->receiver.t_state);
25120
25121 /* no need to lock it, I'm the only thread alive */
25122 - if (atomic_read(&mdev->current_epoch->epoch_size) != 0)
25123 - dev_err(DEV, "epoch_size:%d\n", atomic_read(&mdev->current_epoch->epoch_size));
25124 + if (atomic_read_unchecked(&mdev->current_epoch->epoch_size) != 0)
25125 + dev_err(DEV, "epoch_size:%d\n", atomic_read_unchecked(&mdev->current_epoch->epoch_size));
25126 mdev->al_writ_cnt =
25127 mdev->bm_writ_cnt =
25128 mdev->read_cnt =
25129 diff -urNp linux-3.0.8/drivers/block/drbd/drbd_nl.c linux-3.0.8/drivers/block/drbd/drbd_nl.c
25130 --- linux-3.0.8/drivers/block/drbd/drbd_nl.c 2011-07-21 22:17:23.000000000 -0400
25131 +++ linux-3.0.8/drivers/block/drbd/drbd_nl.c 2011-08-23 21:47:55.000000000 -0400
25132 @@ -2359,7 +2359,7 @@ static void drbd_connector_callback(stru
25133 module_put(THIS_MODULE);
25134 }
25135
25136 -static atomic_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
25137 +static atomic_unchecked_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
25138
25139 static unsigned short *
25140 __tl_add_blob(unsigned short *tl, enum drbd_tags tag, const void *data,
25141 @@ -2430,7 +2430,7 @@ void drbd_bcast_state(struct drbd_conf *
25142 cn_reply->id.idx = CN_IDX_DRBD;
25143 cn_reply->id.val = CN_VAL_DRBD;
25144
25145 - cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
25146 + cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
25147 cn_reply->ack = 0; /* not used here. */
25148 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
25149 (int)((char *)tl - (char *)reply->tag_list);
25150 @@ -2462,7 +2462,7 @@ void drbd_bcast_ev_helper(struct drbd_co
25151 cn_reply->id.idx = CN_IDX_DRBD;
25152 cn_reply->id.val = CN_VAL_DRBD;
25153
25154 - cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
25155 + cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
25156 cn_reply->ack = 0; /* not used here. */
25157 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
25158 (int)((char *)tl - (char *)reply->tag_list);
25159 @@ -2540,7 +2540,7 @@ void drbd_bcast_ee(struct drbd_conf *mde
25160 cn_reply->id.idx = CN_IDX_DRBD;
25161 cn_reply->id.val = CN_VAL_DRBD;
25162
25163 - cn_reply->seq = atomic_add_return(1,&drbd_nl_seq);
25164 + cn_reply->seq = atomic_add_return_unchecked(1,&drbd_nl_seq);
25165 cn_reply->ack = 0; // not used here.
25166 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
25167 (int)((char*)tl - (char*)reply->tag_list);
25168 @@ -2579,7 +2579,7 @@ void drbd_bcast_sync_progress(struct drb
25169 cn_reply->id.idx = CN_IDX_DRBD;
25170 cn_reply->id.val = CN_VAL_DRBD;
25171
25172 - cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
25173 + cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
25174 cn_reply->ack = 0; /* not used here. */
25175 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
25176 (int)((char *)tl - (char *)reply->tag_list);
25177 diff -urNp linux-3.0.8/drivers/block/drbd/drbd_receiver.c linux-3.0.8/drivers/block/drbd/drbd_receiver.c
25178 --- linux-3.0.8/drivers/block/drbd/drbd_receiver.c 2011-07-21 22:17:23.000000000 -0400
25179 +++ linux-3.0.8/drivers/block/drbd/drbd_receiver.c 2011-08-23 21:47:55.000000000 -0400
25180 @@ -894,7 +894,7 @@ retry:
25181 sock->sk->sk_sndtimeo = mdev->net_conf->timeout*HZ/10;
25182 sock->sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
25183
25184 - atomic_set(&mdev->packet_seq, 0);
25185 + atomic_set_unchecked(&mdev->packet_seq, 0);
25186 mdev->peer_seq = 0;
25187
25188 drbd_thread_start(&mdev->asender);
25189 @@ -985,7 +985,7 @@ static enum finish_epoch drbd_may_finish
25190 do {
25191 next_epoch = NULL;
25192
25193 - epoch_size = atomic_read(&epoch->epoch_size);
25194 + epoch_size = atomic_read_unchecked(&epoch->epoch_size);
25195
25196 switch (ev & ~EV_CLEANUP) {
25197 case EV_PUT:
25198 @@ -1020,7 +1020,7 @@ static enum finish_epoch drbd_may_finish
25199 rv = FE_DESTROYED;
25200 } else {
25201 epoch->flags = 0;
25202 - atomic_set(&epoch->epoch_size, 0);
25203 + atomic_set_unchecked(&epoch->epoch_size, 0);
25204 /* atomic_set(&epoch->active, 0); is already zero */
25205 if (rv == FE_STILL_LIVE)
25206 rv = FE_RECYCLED;
25207 @@ -1191,14 +1191,14 @@ static int receive_Barrier(struct drbd_c
25208 drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
25209 drbd_flush(mdev);
25210
25211 - if (atomic_read(&mdev->current_epoch->epoch_size)) {
25212 + if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
25213 epoch = kmalloc(sizeof(struct drbd_epoch), GFP_NOIO);
25214 if (epoch)
25215 break;
25216 }
25217
25218 epoch = mdev->current_epoch;
25219 - wait_event(mdev->ee_wait, atomic_read(&epoch->epoch_size) == 0);
25220 + wait_event(mdev->ee_wait, atomic_read_unchecked(&epoch->epoch_size) == 0);
25221
25222 D_ASSERT(atomic_read(&epoch->active) == 0);
25223 D_ASSERT(epoch->flags == 0);
25224 @@ -1210,11 +1210,11 @@ static int receive_Barrier(struct drbd_c
25225 }
25226
25227 epoch->flags = 0;
25228 - atomic_set(&epoch->epoch_size, 0);
25229 + atomic_set_unchecked(&epoch->epoch_size, 0);
25230 atomic_set(&epoch->active, 0);
25231
25232 spin_lock(&mdev->epoch_lock);
25233 - if (atomic_read(&mdev->current_epoch->epoch_size)) {
25234 + if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
25235 list_add(&epoch->list, &mdev->current_epoch->list);
25236 mdev->current_epoch = epoch;
25237 mdev->epochs++;
25238 @@ -1663,7 +1663,7 @@ static int receive_Data(struct drbd_conf
25239 spin_unlock(&mdev->peer_seq_lock);
25240
25241 drbd_send_ack_dp(mdev, P_NEG_ACK, p, data_size);
25242 - atomic_inc(&mdev->current_epoch->epoch_size);
25243 + atomic_inc_unchecked(&mdev->current_epoch->epoch_size);
25244 return drbd_drain_block(mdev, data_size);
25245 }
25246
25247 @@ -1689,7 +1689,7 @@ static int receive_Data(struct drbd_conf
25248
25249 spin_lock(&mdev->epoch_lock);
25250 e->epoch = mdev->current_epoch;
25251 - atomic_inc(&e->epoch->epoch_size);
25252 + atomic_inc_unchecked(&e->epoch->epoch_size);
25253 atomic_inc(&e->epoch->active);
25254 spin_unlock(&mdev->epoch_lock);
25255
25256 @@ -3885,7 +3885,7 @@ static void drbd_disconnect(struct drbd_
25257 D_ASSERT(list_empty(&mdev->done_ee));
25258
25259 /* ok, no more ee's on the fly, it is safe to reset the epoch_size */
25260 - atomic_set(&mdev->current_epoch->epoch_size, 0);
25261 + atomic_set_unchecked(&mdev->current_epoch->epoch_size, 0);
25262 D_ASSERT(list_empty(&mdev->current_epoch->list));
25263 }
25264
25265 diff -urNp linux-3.0.8/drivers/block/loop.c linux-3.0.8/drivers/block/loop.c
25266 --- linux-3.0.8/drivers/block/loop.c 2011-10-24 08:05:23.000000000 -0400
25267 +++ linux-3.0.8/drivers/block/loop.c 2011-10-06 04:17:55.000000000 -0400
25268 @@ -283,7 +283,7 @@ static int __do_lo_send_write(struct fil
25269 mm_segment_t old_fs = get_fs();
25270
25271 set_fs(get_ds());
25272 - bw = file->f_op->write(file, buf, len, &pos);
25273 + bw = file->f_op->write(file, (const char __force_user *)buf, len, &pos);
25274 set_fs(old_fs);
25275 if (likely(bw == len))
25276 return 0;
25277 diff -urNp linux-3.0.8/drivers/block/nbd.c linux-3.0.8/drivers/block/nbd.c
25278 --- linux-3.0.8/drivers/block/nbd.c 2011-07-21 22:17:23.000000000 -0400
25279 +++ linux-3.0.8/drivers/block/nbd.c 2011-08-23 21:48:14.000000000 -0400
25280 @@ -157,6 +157,8 @@ static int sock_xmit(struct nbd_device *
25281 struct kvec iov;
25282 sigset_t blocked, oldset;
25283
25284 + pax_track_stack();
25285 +
25286 if (unlikely(!sock)) {
25287 printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
25288 lo->disk->disk_name, (send ? "send" : "recv"));
25289 @@ -572,6 +574,8 @@ static void do_nbd_request(struct reques
25290 static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
25291 unsigned int cmd, unsigned long arg)
25292 {
25293 + pax_track_stack();
25294 +
25295 switch (cmd) {
25296 case NBD_DISCONNECT: {
25297 struct request sreq;
25298 diff -urNp linux-3.0.8/drivers/char/agp/frontend.c linux-3.0.8/drivers/char/agp/frontend.c
25299 --- linux-3.0.8/drivers/char/agp/frontend.c 2011-07-21 22:17:23.000000000 -0400
25300 +++ linux-3.0.8/drivers/char/agp/frontend.c 2011-08-23 21:47:55.000000000 -0400
25301 @@ -817,7 +817,7 @@ static int agpioc_reserve_wrap(struct ag
25302 if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
25303 return -EFAULT;
25304
25305 - if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
25306 + if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
25307 return -EFAULT;
25308
25309 client = agp_find_client_by_pid(reserve.pid);
25310 diff -urNp linux-3.0.8/drivers/char/briq_panel.c linux-3.0.8/drivers/char/briq_panel.c
25311 --- linux-3.0.8/drivers/char/briq_panel.c 2011-07-21 22:17:23.000000000 -0400
25312 +++ linux-3.0.8/drivers/char/briq_panel.c 2011-08-23 21:48:14.000000000 -0400
25313 @@ -9,6 +9,7 @@
25314 #include <linux/types.h>
25315 #include <linux/errno.h>
25316 #include <linux/tty.h>
25317 +#include <linux/mutex.h>
25318 #include <linux/timer.h>
25319 #include <linux/kernel.h>
25320 #include <linux/wait.h>
25321 @@ -34,6 +35,7 @@ static int vfd_is_open;
25322 static unsigned char vfd[40];
25323 static int vfd_cursor;
25324 static unsigned char ledpb, led;
25325 +static DEFINE_MUTEX(vfd_mutex);
25326
25327 static void update_vfd(void)
25328 {
25329 @@ -140,12 +142,15 @@ static ssize_t briq_panel_write(struct f
25330 if (!vfd_is_open)
25331 return -EBUSY;
25332
25333 + mutex_lock(&vfd_mutex);
25334 for (;;) {
25335 char c;
25336 if (!indx)
25337 break;
25338 - if (get_user(c, buf))
25339 + if (get_user(c, buf)) {
25340 + mutex_unlock(&vfd_mutex);
25341 return -EFAULT;
25342 + }
25343 if (esc) {
25344 set_led(c);
25345 esc = 0;
25346 @@ -175,6 +180,7 @@ static ssize_t briq_panel_write(struct f
25347 buf++;
25348 }
25349 update_vfd();
25350 + mutex_unlock(&vfd_mutex);
25351
25352 return len;
25353 }
25354 diff -urNp linux-3.0.8/drivers/char/genrtc.c linux-3.0.8/drivers/char/genrtc.c
25355 --- linux-3.0.8/drivers/char/genrtc.c 2011-07-21 22:17:23.000000000 -0400
25356 +++ linux-3.0.8/drivers/char/genrtc.c 2011-08-23 21:48:14.000000000 -0400
25357 @@ -273,6 +273,7 @@ static int gen_rtc_ioctl(struct file *fi
25358 switch (cmd) {
25359
25360 case RTC_PLL_GET:
25361 + memset(&pll, 0, sizeof(pll));
25362 if (get_rtc_pll(&pll))
25363 return -EINVAL;
25364 else
25365 diff -urNp linux-3.0.8/drivers/char/hpet.c linux-3.0.8/drivers/char/hpet.c
25366 --- linux-3.0.8/drivers/char/hpet.c 2011-07-21 22:17:23.000000000 -0400
25367 +++ linux-3.0.8/drivers/char/hpet.c 2011-08-23 21:47:55.000000000 -0400
25368 @@ -572,7 +572,7 @@ static inline unsigned long hpet_time_di
25369 }
25370
25371 static int
25372 -hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
25373 +hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg,
25374 struct hpet_info *info)
25375 {
25376 struct hpet_timer __iomem *timer;
25377 diff -urNp linux-3.0.8/drivers/char/ipmi/ipmi_msghandler.c linux-3.0.8/drivers/char/ipmi/ipmi_msghandler.c
25378 --- linux-3.0.8/drivers/char/ipmi/ipmi_msghandler.c 2011-07-21 22:17:23.000000000 -0400
25379 +++ linux-3.0.8/drivers/char/ipmi/ipmi_msghandler.c 2011-08-23 21:48:14.000000000 -0400
25380 @@ -415,7 +415,7 @@ struct ipmi_smi {
25381 struct proc_dir_entry *proc_dir;
25382 char proc_dir_name[10];
25383
25384 - atomic_t stats[IPMI_NUM_STATS];
25385 + atomic_unchecked_t stats[IPMI_NUM_STATS];
25386
25387 /*
25388 * run_to_completion duplicate of smb_info, smi_info
25389 @@ -448,9 +448,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
25390
25391
25392 #define ipmi_inc_stat(intf, stat) \
25393 - atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
25394 + atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
25395 #define ipmi_get_stat(intf, stat) \
25396 - ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
25397 + ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
25398
25399 static int is_lan_addr(struct ipmi_addr *addr)
25400 {
25401 @@ -2868,7 +2868,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
25402 INIT_LIST_HEAD(&intf->cmd_rcvrs);
25403 init_waitqueue_head(&intf->waitq);
25404 for (i = 0; i < IPMI_NUM_STATS; i++)
25405 - atomic_set(&intf->stats[i], 0);
25406 + atomic_set_unchecked(&intf->stats[i], 0);
25407
25408 intf->proc_dir = NULL;
25409
25410 @@ -4220,6 +4220,8 @@ static void send_panic_events(char *str)
25411 struct ipmi_smi_msg smi_msg;
25412 struct ipmi_recv_msg recv_msg;
25413
25414 + pax_track_stack();
25415 +
25416 si = (struct ipmi_system_interface_addr *) &addr;
25417 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
25418 si->channel = IPMI_BMC_CHANNEL;
25419 diff -urNp linux-3.0.8/drivers/char/ipmi/ipmi_si_intf.c linux-3.0.8/drivers/char/ipmi/ipmi_si_intf.c
25420 --- linux-3.0.8/drivers/char/ipmi/ipmi_si_intf.c 2011-07-21 22:17:23.000000000 -0400
25421 +++ linux-3.0.8/drivers/char/ipmi/ipmi_si_intf.c 2011-08-23 21:47:55.000000000 -0400
25422 @@ -277,7 +277,7 @@ struct smi_info {
25423 unsigned char slave_addr;
25424
25425 /* Counters and things for the proc filesystem. */
25426 - atomic_t stats[SI_NUM_STATS];
25427 + atomic_unchecked_t stats[SI_NUM_STATS];
25428
25429 struct task_struct *thread;
25430
25431 @@ -286,9 +286,9 @@ struct smi_info {
25432 };
25433
25434 #define smi_inc_stat(smi, stat) \
25435 - atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
25436 + atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
25437 #define smi_get_stat(smi, stat) \
25438 - ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
25439 + ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
25440
25441 #define SI_MAX_PARMS 4
25442
25443 @@ -3230,7 +3230,7 @@ static int try_smi_init(struct smi_info
25444 atomic_set(&new_smi->req_events, 0);
25445 new_smi->run_to_completion = 0;
25446 for (i = 0; i < SI_NUM_STATS; i++)
25447 - atomic_set(&new_smi->stats[i], 0);
25448 + atomic_set_unchecked(&new_smi->stats[i], 0);
25449
25450 new_smi->interrupt_disabled = 1;
25451 atomic_set(&new_smi->stop_operation, 0);
25452 diff -urNp linux-3.0.8/drivers/char/Kconfig linux-3.0.8/drivers/char/Kconfig
25453 --- linux-3.0.8/drivers/char/Kconfig 2011-07-21 22:17:23.000000000 -0400
25454 +++ linux-3.0.8/drivers/char/Kconfig 2011-08-23 21:48:14.000000000 -0400
25455 @@ -8,7 +8,8 @@ source "drivers/tty/Kconfig"
25456
25457 config DEVKMEM
25458 bool "/dev/kmem virtual device support"
25459 - default y
25460 + default n
25461 + depends on !GRKERNSEC_KMEM
25462 help
25463 Say Y here if you want to support the /dev/kmem device. The
25464 /dev/kmem device is rarely used, but can be used for certain
25465 @@ -596,6 +597,7 @@ config DEVPORT
25466 bool
25467 depends on !M68K
25468 depends on ISA || PCI
25469 + depends on !GRKERNSEC_KMEM
25470 default y
25471
25472 source "drivers/s390/char/Kconfig"
25473 diff -urNp linux-3.0.8/drivers/char/mbcs.c linux-3.0.8/drivers/char/mbcs.c
25474 --- linux-3.0.8/drivers/char/mbcs.c 2011-07-21 22:17:23.000000000 -0400
25475 +++ linux-3.0.8/drivers/char/mbcs.c 2011-10-11 10:44:33.000000000 -0400
25476 @@ -800,7 +800,7 @@ static int mbcs_remove(struct cx_dev *de
25477 return 0;
25478 }
25479
25480 -static const struct cx_device_id __devinitdata mbcs_id_table[] = {
25481 +static const struct cx_device_id __devinitconst mbcs_id_table[] = {
25482 {
25483 .part_num = MBCS_PART_NUM,
25484 .mfg_num = MBCS_MFG_NUM,
25485 diff -urNp linux-3.0.8/drivers/char/mem.c linux-3.0.8/drivers/char/mem.c
25486 --- linux-3.0.8/drivers/char/mem.c 2011-07-21 22:17:23.000000000 -0400
25487 +++ linux-3.0.8/drivers/char/mem.c 2011-08-23 21:48:14.000000000 -0400
25488 @@ -18,6 +18,7 @@
25489 #include <linux/raw.h>
25490 #include <linux/tty.h>
25491 #include <linux/capability.h>
25492 +#include <linux/security.h>
25493 #include <linux/ptrace.h>
25494 #include <linux/device.h>
25495 #include <linux/highmem.h>
25496 @@ -34,6 +35,10 @@
25497 # include <linux/efi.h>
25498 #endif
25499
25500 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
25501 +extern struct file_operations grsec_fops;
25502 +#endif
25503 +
25504 static inline unsigned long size_inside_page(unsigned long start,
25505 unsigned long size)
25506 {
25507 @@ -65,9 +70,13 @@ static inline int range_is_allowed(unsig
25508
25509 while (cursor < to) {
25510 if (!devmem_is_allowed(pfn)) {
25511 +#ifdef CONFIG_GRKERNSEC_KMEM
25512 + gr_handle_mem_readwrite(from, to);
25513 +#else
25514 printk(KERN_INFO
25515 "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
25516 current->comm, from, to);
25517 +#endif
25518 return 0;
25519 }
25520 cursor += PAGE_SIZE;
25521 @@ -75,6 +84,11 @@ static inline int range_is_allowed(unsig
25522 }
25523 return 1;
25524 }
25525 +#elif defined(CONFIG_GRKERNSEC_KMEM)
25526 +static inline int range_is_allowed(unsigned long pfn, unsigned long size)
25527 +{
25528 + return 0;
25529 +}
25530 #else
25531 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
25532 {
25533 @@ -117,6 +131,7 @@ static ssize_t read_mem(struct file *fil
25534
25535 while (count > 0) {
25536 unsigned long remaining;
25537 + char *temp;
25538
25539 sz = size_inside_page(p, count);
25540
25541 @@ -132,7 +147,23 @@ static ssize_t read_mem(struct file *fil
25542 if (!ptr)
25543 return -EFAULT;
25544
25545 - remaining = copy_to_user(buf, ptr, sz);
25546 +#ifdef CONFIG_PAX_USERCOPY
25547 + temp = kmalloc(sz, GFP_KERNEL);
25548 + if (!temp) {
25549 + unxlate_dev_mem_ptr(p, ptr);
25550 + return -ENOMEM;
25551 + }
25552 + memcpy(temp, ptr, sz);
25553 +#else
25554 + temp = ptr;
25555 +#endif
25556 +
25557 + remaining = copy_to_user(buf, temp, sz);
25558 +
25559 +#ifdef CONFIG_PAX_USERCOPY
25560 + kfree(temp);
25561 +#endif
25562 +
25563 unxlate_dev_mem_ptr(p, ptr);
25564 if (remaining)
25565 return -EFAULT;
25566 @@ -395,9 +426,8 @@ static ssize_t read_kmem(struct file *fi
25567 size_t count, loff_t *ppos)
25568 {
25569 unsigned long p = *ppos;
25570 - ssize_t low_count, read, sz;
25571 + ssize_t low_count, read, sz, err = 0;
25572 char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
25573 - int err = 0;
25574
25575 read = 0;
25576 if (p < (unsigned long) high_memory) {
25577 @@ -419,6 +449,8 @@ static ssize_t read_kmem(struct file *fi
25578 }
25579 #endif
25580 while (low_count > 0) {
25581 + char *temp;
25582 +
25583 sz = size_inside_page(p, low_count);
25584
25585 /*
25586 @@ -428,7 +460,22 @@ static ssize_t read_kmem(struct file *fi
25587 */
25588 kbuf = xlate_dev_kmem_ptr((char *)p);
25589
25590 - if (copy_to_user(buf, kbuf, sz))
25591 +#ifdef CONFIG_PAX_USERCOPY
25592 + temp = kmalloc(sz, GFP_KERNEL);
25593 + if (!temp)
25594 + return -ENOMEM;
25595 + memcpy(temp, kbuf, sz);
25596 +#else
25597 + temp = kbuf;
25598 +#endif
25599 +
25600 + err = copy_to_user(buf, temp, sz);
25601 +
25602 +#ifdef CONFIG_PAX_USERCOPY
25603 + kfree(temp);
25604 +#endif
25605 +
25606 + if (err)
25607 return -EFAULT;
25608 buf += sz;
25609 p += sz;
25610 @@ -866,6 +913,9 @@ static const struct memdev {
25611 #ifdef CONFIG_CRASH_DUMP
25612 [12] = { "oldmem", 0, &oldmem_fops, NULL },
25613 #endif
25614 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
25615 + [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
25616 +#endif
25617 };
25618
25619 static int memory_open(struct inode *inode, struct file *filp)
25620 diff -urNp linux-3.0.8/drivers/char/nvram.c linux-3.0.8/drivers/char/nvram.c
25621 --- linux-3.0.8/drivers/char/nvram.c 2011-07-21 22:17:23.000000000 -0400
25622 +++ linux-3.0.8/drivers/char/nvram.c 2011-08-23 21:47:55.000000000 -0400
25623 @@ -246,7 +246,7 @@ static ssize_t nvram_read(struct file *f
25624
25625 spin_unlock_irq(&rtc_lock);
25626
25627 - if (copy_to_user(buf, contents, tmp - contents))
25628 + if (tmp - contents > sizeof(contents) || copy_to_user(buf, contents, tmp - contents))
25629 return -EFAULT;
25630
25631 *ppos = i;
25632 diff -urNp linux-3.0.8/drivers/char/random.c linux-3.0.8/drivers/char/random.c
25633 --- linux-3.0.8/drivers/char/random.c 2011-10-24 08:05:21.000000000 -0400
25634 +++ linux-3.0.8/drivers/char/random.c 2011-08-23 21:48:14.000000000 -0400
25635 @@ -261,8 +261,13 @@
25636 /*
25637 * Configuration information
25638 */
25639 +#ifdef CONFIG_GRKERNSEC_RANDNET
25640 +#define INPUT_POOL_WORDS 512
25641 +#define OUTPUT_POOL_WORDS 128
25642 +#else
25643 #define INPUT_POOL_WORDS 128
25644 #define OUTPUT_POOL_WORDS 32
25645 +#endif
25646 #define SEC_XFER_SIZE 512
25647 #define EXTRACT_SIZE 10
25648
25649 @@ -300,10 +305,17 @@ static struct poolinfo {
25650 int poolwords;
25651 int tap1, tap2, tap3, tap4, tap5;
25652 } poolinfo_table[] = {
25653 +#ifdef CONFIG_GRKERNSEC_RANDNET
25654 + /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
25655 + { 512, 411, 308, 208, 104, 1 },
25656 + /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
25657 + { 128, 103, 76, 51, 25, 1 },
25658 +#else
25659 /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
25660 { 128, 103, 76, 51, 25, 1 },
25661 /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
25662 { 32, 26, 20, 14, 7, 1 },
25663 +#endif
25664 #if 0
25665 /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
25666 { 2048, 1638, 1231, 819, 411, 1 },
25667 @@ -909,7 +921,7 @@ static ssize_t extract_entropy_user(stru
25668
25669 extract_buf(r, tmp);
25670 i = min_t(int, nbytes, EXTRACT_SIZE);
25671 - if (copy_to_user(buf, tmp, i)) {
25672 + if (i > sizeof(tmp) || copy_to_user(buf, tmp, i)) {
25673 ret = -EFAULT;
25674 break;
25675 }
25676 @@ -1214,7 +1226,7 @@ EXPORT_SYMBOL(generate_random_uuid);
25677 #include <linux/sysctl.h>
25678
25679 static int min_read_thresh = 8, min_write_thresh;
25680 -static int max_read_thresh = INPUT_POOL_WORDS * 32;
25681 +static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
25682 static int max_write_thresh = INPUT_POOL_WORDS * 32;
25683 static char sysctl_bootid[16];
25684
25685 diff -urNp linux-3.0.8/drivers/char/sonypi.c linux-3.0.8/drivers/char/sonypi.c
25686 --- linux-3.0.8/drivers/char/sonypi.c 2011-07-21 22:17:23.000000000 -0400
25687 +++ linux-3.0.8/drivers/char/sonypi.c 2011-08-23 21:47:55.000000000 -0400
25688 @@ -55,6 +55,7 @@
25689 #include <asm/uaccess.h>
25690 #include <asm/io.h>
25691 #include <asm/system.h>
25692 +#include <asm/local.h>
25693
25694 #include <linux/sonypi.h>
25695
25696 @@ -491,7 +492,7 @@ static struct sonypi_device {
25697 spinlock_t fifo_lock;
25698 wait_queue_head_t fifo_proc_list;
25699 struct fasync_struct *fifo_async;
25700 - int open_count;
25701 + local_t open_count;
25702 int model;
25703 struct input_dev *input_jog_dev;
25704 struct input_dev *input_key_dev;
25705 @@ -898,7 +899,7 @@ static int sonypi_misc_fasync(int fd, st
25706 static int sonypi_misc_release(struct inode *inode, struct file *file)
25707 {
25708 mutex_lock(&sonypi_device.lock);
25709 - sonypi_device.open_count--;
25710 + local_dec(&sonypi_device.open_count);
25711 mutex_unlock(&sonypi_device.lock);
25712 return 0;
25713 }
25714 @@ -907,9 +908,9 @@ static int sonypi_misc_open(struct inode
25715 {
25716 mutex_lock(&sonypi_device.lock);
25717 /* Flush input queue on first open */
25718 - if (!sonypi_device.open_count)
25719 + if (!local_read(&sonypi_device.open_count))
25720 kfifo_reset(&sonypi_device.fifo);
25721 - sonypi_device.open_count++;
25722 + local_inc(&sonypi_device.open_count);
25723 mutex_unlock(&sonypi_device.lock);
25724
25725 return 0;
25726 diff -urNp linux-3.0.8/drivers/char/tpm/tpm_bios.c linux-3.0.8/drivers/char/tpm/tpm_bios.c
25727 --- linux-3.0.8/drivers/char/tpm/tpm_bios.c 2011-07-21 22:17:23.000000000 -0400
25728 +++ linux-3.0.8/drivers/char/tpm/tpm_bios.c 2011-10-06 04:17:55.000000000 -0400
25729 @@ -173,7 +173,7 @@ static void *tpm_bios_measurements_start
25730 event = addr;
25731
25732 if ((event->event_type == 0 && event->event_size == 0) ||
25733 - ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
25734 + (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
25735 return NULL;
25736
25737 return addr;
25738 @@ -198,7 +198,7 @@ static void *tpm_bios_measurements_next(
25739 return NULL;
25740
25741 if ((event->event_type == 0 && event->event_size == 0) ||
25742 - ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
25743 + (event->event_size >= limit - v - sizeof(struct tcpa_event)))
25744 return NULL;
25745
25746 (*pos)++;
25747 @@ -291,7 +291,8 @@ static int tpm_binary_bios_measurements_
25748 int i;
25749
25750 for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
25751 - seq_putc(m, data[i]);
25752 + if (!seq_putc(m, data[i]))
25753 + return -EFAULT;
25754
25755 return 0;
25756 }
25757 @@ -410,8 +411,13 @@ static int read_log(struct tpm_bios_log
25758 log->bios_event_log_end = log->bios_event_log + len;
25759
25760 virt = acpi_os_map_memory(start, len);
25761 + if (!virt) {
25762 + kfree(log->bios_event_log);
25763 + log->bios_event_log = NULL;
25764 + return -EFAULT;
25765 + }
25766
25767 - memcpy(log->bios_event_log, virt, len);
25768 + memcpy(log->bios_event_log, (const char __force_kernel *)virt, len);
25769
25770 acpi_os_unmap_memory(virt, len);
25771 return 0;
25772 diff -urNp linux-3.0.8/drivers/char/tpm/tpm.c linux-3.0.8/drivers/char/tpm/tpm.c
25773 --- linux-3.0.8/drivers/char/tpm/tpm.c 2011-10-24 08:05:30.000000000 -0400
25774 +++ linux-3.0.8/drivers/char/tpm/tpm.c 2011-10-16 21:55:27.000000000 -0400
25775 @@ -414,7 +414,7 @@ static ssize_t tpm_transmit(struct tpm_c
25776 chip->vendor.req_complete_val)
25777 goto out_recv;
25778
25779 - if ((status == chip->vendor.req_canceled)) {
25780 + if (status == chip->vendor.req_canceled) {
25781 dev_err(chip->dev, "Operation Canceled\n");
25782 rc = -ECANCELED;
25783 goto out;
25784 @@ -847,6 +847,8 @@ ssize_t tpm_show_pubek(struct device *de
25785
25786 struct tpm_chip *chip = dev_get_drvdata(dev);
25787
25788 + pax_track_stack();
25789 +
25790 tpm_cmd.header.in = tpm_readpubek_header;
25791 err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
25792 "attempting to read the PUBEK");
25793 diff -urNp linux-3.0.8/drivers/char/virtio_console.c linux-3.0.8/drivers/char/virtio_console.c
25794 --- linux-3.0.8/drivers/char/virtio_console.c 2011-07-21 22:17:23.000000000 -0400
25795 +++ linux-3.0.8/drivers/char/virtio_console.c 2011-10-06 04:17:55.000000000 -0400
25796 @@ -555,7 +555,7 @@ static ssize_t fill_readbuf(struct port
25797 if (to_user) {
25798 ssize_t ret;
25799
25800 - ret = copy_to_user(out_buf, buf->buf + buf->offset, out_count);
25801 + ret = copy_to_user((char __force_user *)out_buf, buf->buf + buf->offset, out_count);
25802 if (ret)
25803 return -EFAULT;
25804 } else {
25805 @@ -654,7 +654,7 @@ static ssize_t port_fops_read(struct fil
25806 if (!port_has_data(port) && !port->host_connected)
25807 return 0;
25808
25809 - return fill_readbuf(port, ubuf, count, true);
25810 + return fill_readbuf(port, (char __force_kernel *)ubuf, count, true);
25811 }
25812
25813 static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
25814 diff -urNp linux-3.0.8/drivers/crypto/hifn_795x.c linux-3.0.8/drivers/crypto/hifn_795x.c
25815 --- linux-3.0.8/drivers/crypto/hifn_795x.c 2011-07-21 22:17:23.000000000 -0400
25816 +++ linux-3.0.8/drivers/crypto/hifn_795x.c 2011-08-23 21:48:14.000000000 -0400
25817 @@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device
25818 0xCA, 0x34, 0x2B, 0x2E};
25819 struct scatterlist sg;
25820
25821 + pax_track_stack();
25822 +
25823 memset(src, 0, sizeof(src));
25824 memset(ctx.key, 0, sizeof(ctx.key));
25825
25826 diff -urNp linux-3.0.8/drivers/crypto/padlock-aes.c linux-3.0.8/drivers/crypto/padlock-aes.c
25827 --- linux-3.0.8/drivers/crypto/padlock-aes.c 2011-07-21 22:17:23.000000000 -0400
25828 +++ linux-3.0.8/drivers/crypto/padlock-aes.c 2011-08-23 21:48:14.000000000 -0400
25829 @@ -109,6 +109,8 @@ static int aes_set_key(struct crypto_tfm
25830 struct crypto_aes_ctx gen_aes;
25831 int cpu;
25832
25833 + pax_track_stack();
25834 +
25835 if (key_len % 8) {
25836 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
25837 return -EINVAL;
25838 diff -urNp linux-3.0.8/drivers/dma/ioat/dma_v3.c linux-3.0.8/drivers/dma/ioat/dma_v3.c
25839 --- linux-3.0.8/drivers/dma/ioat/dma_v3.c 2011-07-21 22:17:23.000000000 -0400
25840 +++ linux-3.0.8/drivers/dma/ioat/dma_v3.c 2011-10-11 10:44:33.000000000 -0400
25841 @@ -73,10 +73,10 @@
25842 /* provide a lookup table for setting the source address in the base or
25843 * extended descriptor of an xor or pq descriptor
25844 */
25845 -static const u8 xor_idx_to_desc __read_mostly = 0xd0;
25846 -static const u8 xor_idx_to_field[] __read_mostly = { 1, 4, 5, 6, 7, 0, 1, 2 };
25847 -static const u8 pq_idx_to_desc __read_mostly = 0xf8;
25848 -static const u8 pq_idx_to_field[] __read_mostly = { 1, 4, 5, 0, 1, 2, 4, 5 };
25849 +static const u8 xor_idx_to_desc = 0xd0;
25850 +static const u8 xor_idx_to_field[] = { 1, 4, 5, 6, 7, 0, 1, 2 };
25851 +static const u8 pq_idx_to_desc = 0xf8;
25852 +static const u8 pq_idx_to_field[] = { 1, 4, 5, 0, 1, 2, 4, 5 };
25853
25854 static dma_addr_t xor_get_src(struct ioat_raw_descriptor *descs[2], int idx)
25855 {
25856 diff -urNp linux-3.0.8/drivers/edac/amd64_edac.c linux-3.0.8/drivers/edac/amd64_edac.c
25857 --- linux-3.0.8/drivers/edac/amd64_edac.c 2011-07-21 22:17:23.000000000 -0400
25858 +++ linux-3.0.8/drivers/edac/amd64_edac.c 2011-10-11 10:44:33.000000000 -0400
25859 @@ -2670,7 +2670,7 @@ static void __devexit amd64_remove_one_i
25860 * PCI core identifies what devices are on a system during boot, and then
25861 * inquiry this table to see if this driver is for a given device found.
25862 */
25863 -static const struct pci_device_id amd64_pci_table[] __devinitdata = {
25864 +static const struct pci_device_id amd64_pci_table[] __devinitconst = {
25865 {
25866 .vendor = PCI_VENDOR_ID_AMD,
25867 .device = PCI_DEVICE_ID_AMD_K8_NB_MEMCTL,
25868 diff -urNp linux-3.0.8/drivers/edac/amd76x_edac.c linux-3.0.8/drivers/edac/amd76x_edac.c
25869 --- linux-3.0.8/drivers/edac/amd76x_edac.c 2011-07-21 22:17:23.000000000 -0400
25870 +++ linux-3.0.8/drivers/edac/amd76x_edac.c 2011-10-11 10:44:33.000000000 -0400
25871 @@ -321,7 +321,7 @@ static void __devexit amd76x_remove_one(
25872 edac_mc_free(mci);
25873 }
25874
25875 -static const struct pci_device_id amd76x_pci_tbl[] __devinitdata = {
25876 +static const struct pci_device_id amd76x_pci_tbl[] __devinitconst = {
25877 {
25878 PCI_VEND_DEV(AMD, FE_GATE_700C), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
25879 AMD762},
25880 diff -urNp linux-3.0.8/drivers/edac/e752x_edac.c linux-3.0.8/drivers/edac/e752x_edac.c
25881 --- linux-3.0.8/drivers/edac/e752x_edac.c 2011-07-21 22:17:23.000000000 -0400
25882 +++ linux-3.0.8/drivers/edac/e752x_edac.c 2011-10-11 10:44:33.000000000 -0400
25883 @@ -1380,7 +1380,7 @@ static void __devexit e752x_remove_one(s
25884 edac_mc_free(mci);
25885 }
25886
25887 -static const struct pci_device_id e752x_pci_tbl[] __devinitdata = {
25888 +static const struct pci_device_id e752x_pci_tbl[] __devinitconst = {
25889 {
25890 PCI_VEND_DEV(INTEL, 7520_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
25891 E7520},
25892 diff -urNp linux-3.0.8/drivers/edac/e7xxx_edac.c linux-3.0.8/drivers/edac/e7xxx_edac.c
25893 --- linux-3.0.8/drivers/edac/e7xxx_edac.c 2011-07-21 22:17:23.000000000 -0400
25894 +++ linux-3.0.8/drivers/edac/e7xxx_edac.c 2011-10-11 10:44:33.000000000 -0400
25895 @@ -525,7 +525,7 @@ static void __devexit e7xxx_remove_one(s
25896 edac_mc_free(mci);
25897 }
25898
25899 -static const struct pci_device_id e7xxx_pci_tbl[] __devinitdata = {
25900 +static const struct pci_device_id e7xxx_pci_tbl[] __devinitconst = {
25901 {
25902 PCI_VEND_DEV(INTEL, 7205_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
25903 E7205},
25904 diff -urNp linux-3.0.8/drivers/edac/edac_pci_sysfs.c linux-3.0.8/drivers/edac/edac_pci_sysfs.c
25905 --- linux-3.0.8/drivers/edac/edac_pci_sysfs.c 2011-07-21 22:17:23.000000000 -0400
25906 +++ linux-3.0.8/drivers/edac/edac_pci_sysfs.c 2011-08-23 21:47:55.000000000 -0400
25907 @@ -26,8 +26,8 @@ static int edac_pci_log_pe = 1; /* log
25908 static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
25909 static int edac_pci_poll_msec = 1000; /* one second workq period */
25910
25911 -static atomic_t pci_parity_count = ATOMIC_INIT(0);
25912 -static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
25913 +static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
25914 +static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
25915
25916 static struct kobject *edac_pci_top_main_kobj;
25917 static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
25918 @@ -582,7 +582,7 @@ static void edac_pci_dev_parity_test(str
25919 edac_printk(KERN_CRIT, EDAC_PCI,
25920 "Signaled System Error on %s\n",
25921 pci_name(dev));
25922 - atomic_inc(&pci_nonparity_count);
25923 + atomic_inc_unchecked(&pci_nonparity_count);
25924 }
25925
25926 if (status & (PCI_STATUS_PARITY)) {
25927 @@ -590,7 +590,7 @@ static void edac_pci_dev_parity_test(str
25928 "Master Data Parity Error on %s\n",
25929 pci_name(dev));
25930
25931 - atomic_inc(&pci_parity_count);
25932 + atomic_inc_unchecked(&pci_parity_count);
25933 }
25934
25935 if (status & (PCI_STATUS_DETECTED_PARITY)) {
25936 @@ -598,7 +598,7 @@ static void edac_pci_dev_parity_test(str
25937 "Detected Parity Error on %s\n",
25938 pci_name(dev));
25939
25940 - atomic_inc(&pci_parity_count);
25941 + atomic_inc_unchecked(&pci_parity_count);
25942 }
25943 }
25944
25945 @@ -619,7 +619,7 @@ static void edac_pci_dev_parity_test(str
25946 edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
25947 "Signaled System Error on %s\n",
25948 pci_name(dev));
25949 - atomic_inc(&pci_nonparity_count);
25950 + atomic_inc_unchecked(&pci_nonparity_count);
25951 }
25952
25953 if (status & (PCI_STATUS_PARITY)) {
25954 @@ -627,7 +627,7 @@ static void edac_pci_dev_parity_test(str
25955 "Master Data Parity Error on "
25956 "%s\n", pci_name(dev));
25957
25958 - atomic_inc(&pci_parity_count);
25959 + atomic_inc_unchecked(&pci_parity_count);
25960 }
25961
25962 if (status & (PCI_STATUS_DETECTED_PARITY)) {
25963 @@ -635,7 +635,7 @@ static void edac_pci_dev_parity_test(str
25964 "Detected Parity Error on %s\n",
25965 pci_name(dev));
25966
25967 - atomic_inc(&pci_parity_count);
25968 + atomic_inc_unchecked(&pci_parity_count);
25969 }
25970 }
25971 }
25972 @@ -677,7 +677,7 @@ void edac_pci_do_parity_check(void)
25973 if (!check_pci_errors)
25974 return;
25975
25976 - before_count = atomic_read(&pci_parity_count);
25977 + before_count = atomic_read_unchecked(&pci_parity_count);
25978
25979 /* scan all PCI devices looking for a Parity Error on devices and
25980 * bridges.
25981 @@ -689,7 +689,7 @@ void edac_pci_do_parity_check(void)
25982 /* Only if operator has selected panic on PCI Error */
25983 if (edac_pci_get_panic_on_pe()) {
25984 /* If the count is different 'after' from 'before' */
25985 - if (before_count != atomic_read(&pci_parity_count))
25986 + if (before_count != atomic_read_unchecked(&pci_parity_count))
25987 panic("EDAC: PCI Parity Error");
25988 }
25989 }
25990 diff -urNp linux-3.0.8/drivers/edac/i3000_edac.c linux-3.0.8/drivers/edac/i3000_edac.c
25991 --- linux-3.0.8/drivers/edac/i3000_edac.c 2011-07-21 22:17:23.000000000 -0400
25992 +++ linux-3.0.8/drivers/edac/i3000_edac.c 2011-10-11 10:44:33.000000000 -0400
25993 @@ -470,7 +470,7 @@ static void __devexit i3000_remove_one(s
25994 edac_mc_free(mci);
25995 }
25996
25997 -static const struct pci_device_id i3000_pci_tbl[] __devinitdata = {
25998 +static const struct pci_device_id i3000_pci_tbl[] __devinitconst = {
25999 {
26000 PCI_VEND_DEV(INTEL, 3000_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
26001 I3000},
26002 diff -urNp linux-3.0.8/drivers/edac/i3200_edac.c linux-3.0.8/drivers/edac/i3200_edac.c
26003 --- linux-3.0.8/drivers/edac/i3200_edac.c 2011-07-21 22:17:23.000000000 -0400
26004 +++ linux-3.0.8/drivers/edac/i3200_edac.c 2011-10-11 10:44:33.000000000 -0400
26005 @@ -456,7 +456,7 @@ static void __devexit i3200_remove_one(s
26006 edac_mc_free(mci);
26007 }
26008
26009 -static const struct pci_device_id i3200_pci_tbl[] __devinitdata = {
26010 +static const struct pci_device_id i3200_pci_tbl[] __devinitconst = {
26011 {
26012 PCI_VEND_DEV(INTEL, 3200_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
26013 I3200},
26014 diff -urNp linux-3.0.8/drivers/edac/i5000_edac.c linux-3.0.8/drivers/edac/i5000_edac.c
26015 --- linux-3.0.8/drivers/edac/i5000_edac.c 2011-07-21 22:17:23.000000000 -0400
26016 +++ linux-3.0.8/drivers/edac/i5000_edac.c 2011-10-11 10:44:33.000000000 -0400
26017 @@ -1516,7 +1516,7 @@ static void __devexit i5000_remove_one(s
26018 *
26019 * The "E500P" device is the first device supported.
26020 */
26021 -static const struct pci_device_id i5000_pci_tbl[] __devinitdata = {
26022 +static const struct pci_device_id i5000_pci_tbl[] __devinitconst = {
26023 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_I5000_DEV16),
26024 .driver_data = I5000P},
26025
26026 diff -urNp linux-3.0.8/drivers/edac/i5100_edac.c linux-3.0.8/drivers/edac/i5100_edac.c
26027 --- linux-3.0.8/drivers/edac/i5100_edac.c 2011-07-21 22:17:23.000000000 -0400
26028 +++ linux-3.0.8/drivers/edac/i5100_edac.c 2011-10-11 10:44:33.000000000 -0400
26029 @@ -1051,7 +1051,7 @@ static void __devexit i5100_remove_one(s
26030 edac_mc_free(mci);
26031 }
26032
26033 -static const struct pci_device_id i5100_pci_tbl[] __devinitdata = {
26034 +static const struct pci_device_id i5100_pci_tbl[] __devinitconst = {
26035 /* Device 16, Function 0, Channel 0 Memory Map, Error Flag/Mask, ... */
26036 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5100_16) },
26037 { 0, }
26038 diff -urNp linux-3.0.8/drivers/edac/i5400_edac.c linux-3.0.8/drivers/edac/i5400_edac.c
26039 --- linux-3.0.8/drivers/edac/i5400_edac.c 2011-07-21 22:17:23.000000000 -0400
26040 +++ linux-3.0.8/drivers/edac/i5400_edac.c 2011-10-11 10:44:33.000000000 -0400
26041 @@ -1383,7 +1383,7 @@ static void __devexit i5400_remove_one(s
26042 *
26043 * The "E500P" device is the first device supported.
26044 */
26045 -static const struct pci_device_id i5400_pci_tbl[] __devinitdata = {
26046 +static const struct pci_device_id i5400_pci_tbl[] __devinitconst = {
26047 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5400_ERR)},
26048 {0,} /* 0 terminated list. */
26049 };
26050 diff -urNp linux-3.0.8/drivers/edac/i7300_edac.c linux-3.0.8/drivers/edac/i7300_edac.c
26051 --- linux-3.0.8/drivers/edac/i7300_edac.c 2011-07-21 22:17:23.000000000 -0400
26052 +++ linux-3.0.8/drivers/edac/i7300_edac.c 2011-10-11 10:44:33.000000000 -0400
26053 @@ -1191,7 +1191,7 @@ static void __devexit i7300_remove_one(s
26054 *
26055 * Has only 8086:360c PCI ID
26056 */
26057 -static const struct pci_device_id i7300_pci_tbl[] __devinitdata = {
26058 +static const struct pci_device_id i7300_pci_tbl[] __devinitconst = {
26059 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_I7300_MCH_ERR)},
26060 {0,} /* 0 terminated list. */
26061 };
26062 diff -urNp linux-3.0.8/drivers/edac/i7core_edac.c linux-3.0.8/drivers/edac/i7core_edac.c
26063 --- linux-3.0.8/drivers/edac/i7core_edac.c 2011-10-24 08:05:23.000000000 -0400
26064 +++ linux-3.0.8/drivers/edac/i7core_edac.c 2011-10-11 10:44:33.000000000 -0400
26065 @@ -359,7 +359,7 @@ static const struct pci_id_table pci_dev
26066 /*
26067 * pci_device_id table for which devices we are looking for
26068 */
26069 -static const struct pci_device_id i7core_pci_tbl[] __devinitdata = {
26070 +static const struct pci_device_id i7core_pci_tbl[] __devinitconst = {
26071 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_X58_HUB_MGMT)},
26072 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LYNNFIELD_QPI_LINK0)},
26073 {0,} /* 0 terminated list. */
26074 diff -urNp linux-3.0.8/drivers/edac/i82443bxgx_edac.c linux-3.0.8/drivers/edac/i82443bxgx_edac.c
26075 --- linux-3.0.8/drivers/edac/i82443bxgx_edac.c 2011-07-21 22:17:23.000000000 -0400
26076 +++ linux-3.0.8/drivers/edac/i82443bxgx_edac.c 2011-10-11 10:44:33.000000000 -0400
26077 @@ -380,7 +380,7 @@ static void __devexit i82443bxgx_edacmc_
26078
26079 EXPORT_SYMBOL_GPL(i82443bxgx_edacmc_remove_one);
26080
26081 -static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitdata = {
26082 +static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitconst = {
26083 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_0)},
26084 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_2)},
26085 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0)},
26086 diff -urNp linux-3.0.8/drivers/edac/i82860_edac.c linux-3.0.8/drivers/edac/i82860_edac.c
26087 --- linux-3.0.8/drivers/edac/i82860_edac.c 2011-07-21 22:17:23.000000000 -0400
26088 +++ linux-3.0.8/drivers/edac/i82860_edac.c 2011-10-11 10:44:33.000000000 -0400
26089 @@ -270,7 +270,7 @@ static void __devexit i82860_remove_one(
26090 edac_mc_free(mci);
26091 }
26092
26093 -static const struct pci_device_id i82860_pci_tbl[] __devinitdata = {
26094 +static const struct pci_device_id i82860_pci_tbl[] __devinitconst = {
26095 {
26096 PCI_VEND_DEV(INTEL, 82860_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
26097 I82860},
26098 diff -urNp linux-3.0.8/drivers/edac/i82875p_edac.c linux-3.0.8/drivers/edac/i82875p_edac.c
26099 --- linux-3.0.8/drivers/edac/i82875p_edac.c 2011-07-21 22:17:23.000000000 -0400
26100 +++ linux-3.0.8/drivers/edac/i82875p_edac.c 2011-10-11 10:44:33.000000000 -0400
26101 @@ -511,7 +511,7 @@ static void __devexit i82875p_remove_one
26102 edac_mc_free(mci);
26103 }
26104
26105 -static const struct pci_device_id i82875p_pci_tbl[] __devinitdata = {
26106 +static const struct pci_device_id i82875p_pci_tbl[] __devinitconst = {
26107 {
26108 PCI_VEND_DEV(INTEL, 82875_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
26109 I82875P},
26110 diff -urNp linux-3.0.8/drivers/edac/i82975x_edac.c linux-3.0.8/drivers/edac/i82975x_edac.c
26111 --- linux-3.0.8/drivers/edac/i82975x_edac.c 2011-07-21 22:17:23.000000000 -0400
26112 +++ linux-3.0.8/drivers/edac/i82975x_edac.c 2011-10-11 10:44:33.000000000 -0400
26113 @@ -604,7 +604,7 @@ static void __devexit i82975x_remove_one
26114 edac_mc_free(mci);
26115 }
26116
26117 -static const struct pci_device_id i82975x_pci_tbl[] __devinitdata = {
26118 +static const struct pci_device_id i82975x_pci_tbl[] __devinitconst = {
26119 {
26120 PCI_VEND_DEV(INTEL, 82975_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
26121 I82975X
26122 diff -urNp linux-3.0.8/drivers/edac/mce_amd.h linux-3.0.8/drivers/edac/mce_amd.h
26123 --- linux-3.0.8/drivers/edac/mce_amd.h 2011-07-21 22:17:23.000000000 -0400
26124 +++ linux-3.0.8/drivers/edac/mce_amd.h 2011-08-23 21:47:55.000000000 -0400
26125 @@ -83,7 +83,7 @@ struct amd_decoder_ops {
26126 bool (*dc_mce)(u16, u8);
26127 bool (*ic_mce)(u16, u8);
26128 bool (*nb_mce)(u16, u8);
26129 -};
26130 +} __no_const;
26131
26132 void amd_report_gart_errors(bool);
26133 void amd_register_ecc_decoder(void (*f)(int, struct mce *, u32));
26134 diff -urNp linux-3.0.8/drivers/edac/r82600_edac.c linux-3.0.8/drivers/edac/r82600_edac.c
26135 --- linux-3.0.8/drivers/edac/r82600_edac.c 2011-07-21 22:17:23.000000000 -0400
26136 +++ linux-3.0.8/drivers/edac/r82600_edac.c 2011-10-11 10:44:33.000000000 -0400
26137 @@ -373,7 +373,7 @@ static void __devexit r82600_remove_one(
26138 edac_mc_free(mci);
26139 }
26140
26141 -static const struct pci_device_id r82600_pci_tbl[] __devinitdata = {
26142 +static const struct pci_device_id r82600_pci_tbl[] __devinitconst = {
26143 {
26144 PCI_DEVICE(PCI_VENDOR_ID_RADISYS, R82600_BRIDGE_ID)
26145 },
26146 diff -urNp linux-3.0.8/drivers/edac/x38_edac.c linux-3.0.8/drivers/edac/x38_edac.c
26147 --- linux-3.0.8/drivers/edac/x38_edac.c 2011-07-21 22:17:23.000000000 -0400
26148 +++ linux-3.0.8/drivers/edac/x38_edac.c 2011-10-11 10:44:33.000000000 -0400
26149 @@ -440,7 +440,7 @@ static void __devexit x38_remove_one(str
26150 edac_mc_free(mci);
26151 }
26152
26153 -static const struct pci_device_id x38_pci_tbl[] __devinitdata = {
26154 +static const struct pci_device_id x38_pci_tbl[] __devinitconst = {
26155 {
26156 PCI_VEND_DEV(INTEL, X38_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
26157 X38},
26158 diff -urNp linux-3.0.8/drivers/firewire/core-card.c linux-3.0.8/drivers/firewire/core-card.c
26159 --- linux-3.0.8/drivers/firewire/core-card.c 2011-07-21 22:17:23.000000000 -0400
26160 +++ linux-3.0.8/drivers/firewire/core-card.c 2011-08-23 21:47:55.000000000 -0400
26161 @@ -657,7 +657,7 @@ void fw_card_release(struct kref *kref)
26162
26163 void fw_core_remove_card(struct fw_card *card)
26164 {
26165 - struct fw_card_driver dummy_driver = dummy_driver_template;
26166 + fw_card_driver_no_const dummy_driver = dummy_driver_template;
26167
26168 card->driver->update_phy_reg(card, 4,
26169 PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
26170 diff -urNp linux-3.0.8/drivers/firewire/core-cdev.c linux-3.0.8/drivers/firewire/core-cdev.c
26171 --- linux-3.0.8/drivers/firewire/core-cdev.c 2011-10-24 08:05:21.000000000 -0400
26172 +++ linux-3.0.8/drivers/firewire/core-cdev.c 2011-08-23 21:47:55.000000000 -0400
26173 @@ -1313,8 +1313,7 @@ static int init_iso_resource(struct clie
26174 int ret;
26175
26176 if ((request->channels == 0 && request->bandwidth == 0) ||
26177 - request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
26178 - request->bandwidth < 0)
26179 + request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
26180 return -EINVAL;
26181
26182 r = kmalloc(sizeof(*r), GFP_KERNEL);
26183 diff -urNp linux-3.0.8/drivers/firewire/core.h linux-3.0.8/drivers/firewire/core.h
26184 --- linux-3.0.8/drivers/firewire/core.h 2011-07-21 22:17:23.000000000 -0400
26185 +++ linux-3.0.8/drivers/firewire/core.h 2011-08-23 21:47:55.000000000 -0400
26186 @@ -101,6 +101,7 @@ struct fw_card_driver {
26187
26188 int (*stop_iso)(struct fw_iso_context *ctx);
26189 };
26190 +typedef struct fw_card_driver __no_const fw_card_driver_no_const;
26191
26192 void fw_card_initialize(struct fw_card *card,
26193 const struct fw_card_driver *driver, struct device *device);
26194 diff -urNp linux-3.0.8/drivers/firewire/core-transaction.c linux-3.0.8/drivers/firewire/core-transaction.c
26195 --- linux-3.0.8/drivers/firewire/core-transaction.c 2011-07-21 22:17:23.000000000 -0400
26196 +++ linux-3.0.8/drivers/firewire/core-transaction.c 2011-08-23 21:48:14.000000000 -0400
26197 @@ -37,6 +37,7 @@
26198 #include <linux/timer.h>
26199 #include <linux/types.h>
26200 #include <linux/workqueue.h>
26201 +#include <linux/sched.h>
26202
26203 #include <asm/byteorder.h>
26204
26205 @@ -422,6 +423,8 @@ int fw_run_transaction(struct fw_card *c
26206 struct transaction_callback_data d;
26207 struct fw_transaction t;
26208
26209 + pax_track_stack();
26210 +
26211 init_timer_on_stack(&t.split_timeout_timer);
26212 init_completion(&d.done);
26213 d.payload = payload;
26214 diff -urNp linux-3.0.8/drivers/firmware/dmi_scan.c linux-3.0.8/drivers/firmware/dmi_scan.c
26215 --- linux-3.0.8/drivers/firmware/dmi_scan.c 2011-07-21 22:17:23.000000000 -0400
26216 +++ linux-3.0.8/drivers/firmware/dmi_scan.c 2011-10-06 04:17:55.000000000 -0400
26217 @@ -449,11 +449,6 @@ void __init dmi_scan_machine(void)
26218 }
26219 }
26220 else {
26221 - /*
26222 - * no iounmap() for that ioremap(); it would be a no-op, but
26223 - * it's so early in setup that sucker gets confused into doing
26224 - * what it shouldn't if we actually call it.
26225 - */
26226 p = dmi_ioremap(0xF0000, 0x10000);
26227 if (p == NULL)
26228 goto error;
26229 @@ -725,7 +720,7 @@ int dmi_walk(void (*decode)(const struct
26230 if (buf == NULL)
26231 return -1;
26232
26233 - dmi_table(buf, dmi_len, dmi_num, decode, private_data);
26234 + dmi_table((char __force_kernel *)buf, dmi_len, dmi_num, decode, private_data);
26235
26236 iounmap(buf);
26237 return 0;
26238 diff -urNp linux-3.0.8/drivers/gpio/vr41xx_giu.c linux-3.0.8/drivers/gpio/vr41xx_giu.c
26239 --- linux-3.0.8/drivers/gpio/vr41xx_giu.c 2011-07-21 22:17:23.000000000 -0400
26240 +++ linux-3.0.8/drivers/gpio/vr41xx_giu.c 2011-08-23 21:47:55.000000000 -0400
26241 @@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
26242 printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
26243 maskl, pendl, maskh, pendh);
26244
26245 - atomic_inc(&irq_err_count);
26246 + atomic_inc_unchecked(&irq_err_count);
26247
26248 return -EINVAL;
26249 }
26250 diff -urNp linux-3.0.8/drivers/gpu/drm/drm_crtc.c linux-3.0.8/drivers/gpu/drm/drm_crtc.c
26251 --- linux-3.0.8/drivers/gpu/drm/drm_crtc.c 2011-07-21 22:17:23.000000000 -0400
26252 +++ linux-3.0.8/drivers/gpu/drm/drm_crtc.c 2011-10-06 04:17:55.000000000 -0400
26253 @@ -1372,7 +1372,7 @@ int drm_mode_getconnector(struct drm_dev
26254 */
26255 if ((out_resp->count_modes >= mode_count) && mode_count) {
26256 copied = 0;
26257 - mode_ptr = (struct drm_mode_modeinfo *)(unsigned long)out_resp->modes_ptr;
26258 + mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
26259 list_for_each_entry(mode, &connector->modes, head) {
26260 drm_crtc_convert_to_umode(&u_mode, mode);
26261 if (copy_to_user(mode_ptr + copied,
26262 @@ -1387,8 +1387,8 @@ int drm_mode_getconnector(struct drm_dev
26263
26264 if ((out_resp->count_props >= props_count) && props_count) {
26265 copied = 0;
26266 - prop_ptr = (uint32_t *)(unsigned long)(out_resp->props_ptr);
26267 - prop_values = (uint64_t *)(unsigned long)(out_resp->prop_values_ptr);
26268 + prop_ptr = (uint32_t __user *)(unsigned long)(out_resp->props_ptr);
26269 + prop_values = (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr);
26270 for (i = 0; i < DRM_CONNECTOR_MAX_PROPERTY; i++) {
26271 if (connector->property_ids[i] != 0) {
26272 if (put_user(connector->property_ids[i],
26273 @@ -1410,7 +1410,7 @@ int drm_mode_getconnector(struct drm_dev
26274
26275 if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
26276 copied = 0;
26277 - encoder_ptr = (uint32_t *)(unsigned long)(out_resp->encoders_ptr);
26278 + encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
26279 for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
26280 if (connector->encoder_ids[i] != 0) {
26281 if (put_user(connector->encoder_ids[i],
26282 @@ -1569,7 +1569,7 @@ int drm_mode_setcrtc(struct drm_device *
26283 }
26284
26285 for (i = 0; i < crtc_req->count_connectors; i++) {
26286 - set_connectors_ptr = (uint32_t *)(unsigned long)crtc_req->set_connectors_ptr;
26287 + set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
26288 if (get_user(out_id, &set_connectors_ptr[i])) {
26289 ret = -EFAULT;
26290 goto out;
26291 @@ -1850,7 +1850,7 @@ int drm_mode_dirtyfb_ioctl(struct drm_de
26292 fb = obj_to_fb(obj);
26293
26294 num_clips = r->num_clips;
26295 - clips_ptr = (struct drm_clip_rect *)(unsigned long)r->clips_ptr;
26296 + clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
26297
26298 if (!num_clips != !clips_ptr) {
26299 ret = -EINVAL;
26300 @@ -2270,7 +2270,7 @@ int drm_mode_getproperty_ioctl(struct dr
26301 out_resp->flags = property->flags;
26302
26303 if ((out_resp->count_values >= value_count) && value_count) {
26304 - values_ptr = (uint64_t *)(unsigned long)out_resp->values_ptr;
26305 + values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
26306 for (i = 0; i < value_count; i++) {
26307 if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
26308 ret = -EFAULT;
26309 @@ -2283,7 +2283,7 @@ int drm_mode_getproperty_ioctl(struct dr
26310 if (property->flags & DRM_MODE_PROP_ENUM) {
26311 if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
26312 copied = 0;
26313 - enum_ptr = (struct drm_mode_property_enum *)(unsigned long)out_resp->enum_blob_ptr;
26314 + enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
26315 list_for_each_entry(prop_enum, &property->enum_blob_list, head) {
26316
26317 if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
26318 @@ -2306,7 +2306,7 @@ int drm_mode_getproperty_ioctl(struct dr
26319 if ((out_resp->count_enum_blobs >= blob_count) && blob_count) {
26320 copied = 0;
26321 blob_id_ptr = (uint32_t *)(unsigned long)out_resp->enum_blob_ptr;
26322 - blob_length_ptr = (uint32_t *)(unsigned long)out_resp->values_ptr;
26323 + blob_length_ptr = (uint32_t __user *)(unsigned long)out_resp->values_ptr;
26324
26325 list_for_each_entry(prop_blob, &property->enum_blob_list, head) {
26326 if (put_user(prop_blob->base.id, blob_id_ptr + copied)) {
26327 @@ -2367,7 +2367,7 @@ int drm_mode_getblob_ioctl(struct drm_de
26328 struct drm_mode_get_blob *out_resp = data;
26329 struct drm_property_blob *blob;
26330 int ret = 0;
26331 - void *blob_ptr;
26332 + void __user *blob_ptr;
26333
26334 if (!drm_core_check_feature(dev, DRIVER_MODESET))
26335 return -EINVAL;
26336 @@ -2381,7 +2381,7 @@ int drm_mode_getblob_ioctl(struct drm_de
26337 blob = obj_to_blob(obj);
26338
26339 if (out_resp->length == blob->length) {
26340 - blob_ptr = (void *)(unsigned long)out_resp->data;
26341 + blob_ptr = (void __user *)(unsigned long)out_resp->data;
26342 if (copy_to_user(blob_ptr, blob->data, blob->length)){
26343 ret = -EFAULT;
26344 goto done;
26345 diff -urNp linux-3.0.8/drivers/gpu/drm/drm_crtc_helper.c linux-3.0.8/drivers/gpu/drm/drm_crtc_helper.c
26346 --- linux-3.0.8/drivers/gpu/drm/drm_crtc_helper.c 2011-07-21 22:17:23.000000000 -0400
26347 +++ linux-3.0.8/drivers/gpu/drm/drm_crtc_helper.c 2011-08-23 21:48:14.000000000 -0400
26348 @@ -276,7 +276,7 @@ static bool drm_encoder_crtc_ok(struct d
26349 struct drm_crtc *tmp;
26350 int crtc_mask = 1;
26351
26352 - WARN(!crtc, "checking null crtc?\n");
26353 + BUG_ON(!crtc);
26354
26355 dev = crtc->dev;
26356
26357 @@ -343,6 +343,8 @@ bool drm_crtc_helper_set_mode(struct drm
26358 struct drm_encoder *encoder;
26359 bool ret = true;
26360
26361 + pax_track_stack();
26362 +
26363 crtc->enabled = drm_helper_crtc_in_use(crtc);
26364 if (!crtc->enabled)
26365 return true;
26366 diff -urNp linux-3.0.8/drivers/gpu/drm/drm_drv.c linux-3.0.8/drivers/gpu/drm/drm_drv.c
26367 --- linux-3.0.8/drivers/gpu/drm/drm_drv.c 2011-07-21 22:17:23.000000000 -0400
26368 +++ linux-3.0.8/drivers/gpu/drm/drm_drv.c 2011-10-06 04:17:55.000000000 -0400
26369 @@ -307,7 +307,7 @@ module_exit(drm_core_exit);
26370 /**
26371 * Copy and IOCTL return string to user space
26372 */
26373 -static int drm_copy_field(char *buf, size_t *buf_len, const char *value)
26374 +static int drm_copy_field(char __user *buf, size_t *buf_len, const char *value)
26375 {
26376 int len;
26377
26378 @@ -386,7 +386,7 @@ long drm_ioctl(struct file *filp,
26379
26380 dev = file_priv->minor->dev;
26381 atomic_inc(&dev->ioctl_count);
26382 - atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
26383 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
26384 ++file_priv->ioctl_count;
26385
26386 DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
26387 diff -urNp linux-3.0.8/drivers/gpu/drm/drm_fops.c linux-3.0.8/drivers/gpu/drm/drm_fops.c
26388 --- linux-3.0.8/drivers/gpu/drm/drm_fops.c 2011-07-21 22:17:23.000000000 -0400
26389 +++ linux-3.0.8/drivers/gpu/drm/drm_fops.c 2011-08-23 21:47:55.000000000 -0400
26390 @@ -70,7 +70,7 @@ static int drm_setup(struct drm_device *
26391 }
26392
26393 for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
26394 - atomic_set(&dev->counts[i], 0);
26395 + atomic_set_unchecked(&dev->counts[i], 0);
26396
26397 dev->sigdata.lock = NULL;
26398
26399 @@ -134,8 +134,8 @@ int drm_open(struct inode *inode, struct
26400
26401 retcode = drm_open_helper(inode, filp, dev);
26402 if (!retcode) {
26403 - atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
26404 - if (!dev->open_count++)
26405 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
26406 + if (local_inc_return(&dev->open_count) == 1)
26407 retcode = drm_setup(dev);
26408 }
26409 if (!retcode) {
26410 @@ -472,7 +472,7 @@ int drm_release(struct inode *inode, str
26411
26412 mutex_lock(&drm_global_mutex);
26413
26414 - DRM_DEBUG("open_count = %d\n", dev->open_count);
26415 + DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
26416
26417 if (dev->driver->preclose)
26418 dev->driver->preclose(dev, file_priv);
26419 @@ -484,7 +484,7 @@ int drm_release(struct inode *inode, str
26420 DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
26421 task_pid_nr(current),
26422 (long)old_encode_dev(file_priv->minor->device),
26423 - dev->open_count);
26424 + local_read(&dev->open_count));
26425
26426 /* if the master has gone away we can't do anything with the lock */
26427 if (file_priv->minor->master)
26428 @@ -565,8 +565,8 @@ int drm_release(struct inode *inode, str
26429 * End inline drm_release
26430 */
26431
26432 - atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
26433 - if (!--dev->open_count) {
26434 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
26435 + if (local_dec_and_test(&dev->open_count)) {
26436 if (atomic_read(&dev->ioctl_count)) {
26437 DRM_ERROR("Device busy: %d\n",
26438 atomic_read(&dev->ioctl_count));
26439 diff -urNp linux-3.0.8/drivers/gpu/drm/drm_global.c linux-3.0.8/drivers/gpu/drm/drm_global.c
26440 --- linux-3.0.8/drivers/gpu/drm/drm_global.c 2011-07-21 22:17:23.000000000 -0400
26441 +++ linux-3.0.8/drivers/gpu/drm/drm_global.c 2011-08-23 21:47:55.000000000 -0400
26442 @@ -36,7 +36,7 @@
26443 struct drm_global_item {
26444 struct mutex mutex;
26445 void *object;
26446 - int refcount;
26447 + atomic_t refcount;
26448 };
26449
26450 static struct drm_global_item glob[DRM_GLOBAL_NUM];
26451 @@ -49,7 +49,7 @@ void drm_global_init(void)
26452 struct drm_global_item *item = &glob[i];
26453 mutex_init(&item->mutex);
26454 item->object = NULL;
26455 - item->refcount = 0;
26456 + atomic_set(&item->refcount, 0);
26457 }
26458 }
26459
26460 @@ -59,7 +59,7 @@ void drm_global_release(void)
26461 for (i = 0; i < DRM_GLOBAL_NUM; ++i) {
26462 struct drm_global_item *item = &glob[i];
26463 BUG_ON(item->object != NULL);
26464 - BUG_ON(item->refcount != 0);
26465 + BUG_ON(atomic_read(&item->refcount) != 0);
26466 }
26467 }
26468
26469 @@ -70,7 +70,7 @@ int drm_global_item_ref(struct drm_globa
26470 void *object;
26471
26472 mutex_lock(&item->mutex);
26473 - if (item->refcount == 0) {
26474 + if (atomic_read(&item->refcount) == 0) {
26475 item->object = kzalloc(ref->size, GFP_KERNEL);
26476 if (unlikely(item->object == NULL)) {
26477 ret = -ENOMEM;
26478 @@ -83,7 +83,7 @@ int drm_global_item_ref(struct drm_globa
26479 goto out_err;
26480
26481 }
26482 - ++item->refcount;
26483 + atomic_inc(&item->refcount);
26484 ref->object = item->object;
26485 object = item->object;
26486 mutex_unlock(&item->mutex);
26487 @@ -100,9 +100,9 @@ void drm_global_item_unref(struct drm_gl
26488 struct drm_global_item *item = &glob[ref->global_type];
26489
26490 mutex_lock(&item->mutex);
26491 - BUG_ON(item->refcount == 0);
26492 + BUG_ON(atomic_read(&item->refcount) == 0);
26493 BUG_ON(ref->object != item->object);
26494 - if (--item->refcount == 0) {
26495 + if (atomic_dec_and_test(&item->refcount)) {
26496 ref->release(ref);
26497 item->object = NULL;
26498 }
26499 diff -urNp linux-3.0.8/drivers/gpu/drm/drm_info.c linux-3.0.8/drivers/gpu/drm/drm_info.c
26500 --- linux-3.0.8/drivers/gpu/drm/drm_info.c 2011-07-21 22:17:23.000000000 -0400
26501 +++ linux-3.0.8/drivers/gpu/drm/drm_info.c 2011-08-23 21:48:14.000000000 -0400
26502 @@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void
26503 struct drm_local_map *map;
26504 struct drm_map_list *r_list;
26505
26506 - /* Hardcoded from _DRM_FRAME_BUFFER,
26507 - _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
26508 - _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
26509 - const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
26510 + static const char * const types[] = {
26511 + [_DRM_FRAME_BUFFER] = "FB",
26512 + [_DRM_REGISTERS] = "REG",
26513 + [_DRM_SHM] = "SHM",
26514 + [_DRM_AGP] = "AGP",
26515 + [_DRM_SCATTER_GATHER] = "SG",
26516 + [_DRM_CONSISTENT] = "PCI",
26517 + [_DRM_GEM] = "GEM" };
26518 const char *type;
26519 int i;
26520
26521 @@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void
26522 map = r_list->map;
26523 if (!map)
26524 continue;
26525 - if (map->type < 0 || map->type > 5)
26526 + if (map->type >= ARRAY_SIZE(types))
26527 type = "??";
26528 else
26529 type = types[map->type];
26530 @@ -290,7 +294,11 @@ int drm_vma_info(struct seq_file *m, voi
26531 vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
26532 vma->vm_flags & VM_LOCKED ? 'l' : '-',
26533 vma->vm_flags & VM_IO ? 'i' : '-',
26534 +#ifdef CONFIG_GRKERNSEC_HIDESYM
26535 + 0);
26536 +#else
26537 vma->vm_pgoff);
26538 +#endif
26539
26540 #if defined(__i386__)
26541 pgprot = pgprot_val(vma->vm_page_prot);
26542 diff -urNp linux-3.0.8/drivers/gpu/drm/drm_ioc32.c linux-3.0.8/drivers/gpu/drm/drm_ioc32.c
26543 --- linux-3.0.8/drivers/gpu/drm/drm_ioc32.c 2011-07-21 22:17:23.000000000 -0400
26544 +++ linux-3.0.8/drivers/gpu/drm/drm_ioc32.c 2011-10-06 04:17:55.000000000 -0400
26545 @@ -455,7 +455,7 @@ static int compat_drm_infobufs(struct fi
26546 request = compat_alloc_user_space(nbytes);
26547 if (!access_ok(VERIFY_WRITE, request, nbytes))
26548 return -EFAULT;
26549 - list = (struct drm_buf_desc *) (request + 1);
26550 + list = (struct drm_buf_desc __user *) (request + 1);
26551
26552 if (__put_user(count, &request->count)
26553 || __put_user(list, &request->list))
26554 @@ -516,7 +516,7 @@ static int compat_drm_mapbufs(struct fil
26555 request = compat_alloc_user_space(nbytes);
26556 if (!access_ok(VERIFY_WRITE, request, nbytes))
26557 return -EFAULT;
26558 - list = (struct drm_buf_pub *) (request + 1);
26559 + list = (struct drm_buf_pub __user *) (request + 1);
26560
26561 if (__put_user(count, &request->count)
26562 || __put_user(list, &request->list))
26563 diff -urNp linux-3.0.8/drivers/gpu/drm/drm_ioctl.c linux-3.0.8/drivers/gpu/drm/drm_ioctl.c
26564 --- linux-3.0.8/drivers/gpu/drm/drm_ioctl.c 2011-07-21 22:17:23.000000000 -0400
26565 +++ linux-3.0.8/drivers/gpu/drm/drm_ioctl.c 2011-08-23 21:47:55.000000000 -0400
26566 @@ -256,7 +256,7 @@ int drm_getstats(struct drm_device *dev,
26567 stats->data[i].value =
26568 (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
26569 else
26570 - stats->data[i].value = atomic_read(&dev->counts[i]);
26571 + stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
26572 stats->data[i].type = dev->types[i];
26573 }
26574
26575 diff -urNp linux-3.0.8/drivers/gpu/drm/drm_lock.c linux-3.0.8/drivers/gpu/drm/drm_lock.c
26576 --- linux-3.0.8/drivers/gpu/drm/drm_lock.c 2011-07-21 22:17:23.000000000 -0400
26577 +++ linux-3.0.8/drivers/gpu/drm/drm_lock.c 2011-08-23 21:47:55.000000000 -0400
26578 @@ -89,7 +89,7 @@ int drm_lock(struct drm_device *dev, voi
26579 if (drm_lock_take(&master->lock, lock->context)) {
26580 master->lock.file_priv = file_priv;
26581 master->lock.lock_time = jiffies;
26582 - atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
26583 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
26584 break; /* Got lock */
26585 }
26586
26587 @@ -160,7 +160,7 @@ int drm_unlock(struct drm_device *dev, v
26588 return -EINVAL;
26589 }
26590
26591 - atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
26592 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
26593
26594 if (drm_lock_free(&master->lock, lock->context)) {
26595 /* FIXME: Should really bail out here. */
26596 diff -urNp linux-3.0.8/drivers/gpu/drm/i810/i810_dma.c linux-3.0.8/drivers/gpu/drm/i810/i810_dma.c
26597 --- linux-3.0.8/drivers/gpu/drm/i810/i810_dma.c 2011-07-21 22:17:23.000000000 -0400
26598 +++ linux-3.0.8/drivers/gpu/drm/i810/i810_dma.c 2011-08-23 21:47:55.000000000 -0400
26599 @@ -950,8 +950,8 @@ static int i810_dma_vertex(struct drm_de
26600 dma->buflist[vertex->idx],
26601 vertex->discard, vertex->used);
26602
26603 - atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
26604 - atomic_inc(&dev->counts[_DRM_STAT_DMA]);
26605 + atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
26606 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
26607 sarea_priv->last_enqueue = dev_priv->counter - 1;
26608 sarea_priv->last_dispatch = (int)hw_status[5];
26609
26610 @@ -1111,8 +1111,8 @@ static int i810_dma_mc(struct drm_device
26611 i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
26612 mc->last_render);
26613
26614 - atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
26615 - atomic_inc(&dev->counts[_DRM_STAT_DMA]);
26616 + atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
26617 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
26618 sarea_priv->last_enqueue = dev_priv->counter - 1;
26619 sarea_priv->last_dispatch = (int)hw_status[5];
26620
26621 diff -urNp linux-3.0.8/drivers/gpu/drm/i810/i810_drv.h linux-3.0.8/drivers/gpu/drm/i810/i810_drv.h
26622 --- linux-3.0.8/drivers/gpu/drm/i810/i810_drv.h 2011-07-21 22:17:23.000000000 -0400
26623 +++ linux-3.0.8/drivers/gpu/drm/i810/i810_drv.h 2011-08-23 21:47:55.000000000 -0400
26624 @@ -108,8 +108,8 @@ typedef struct drm_i810_private {
26625 int page_flipping;
26626
26627 wait_queue_head_t irq_queue;
26628 - atomic_t irq_received;
26629 - atomic_t irq_emitted;
26630 + atomic_unchecked_t irq_received;
26631 + atomic_unchecked_t irq_emitted;
26632
26633 int front_offset;
26634 } drm_i810_private_t;
26635 diff -urNp linux-3.0.8/drivers/gpu/drm/i915/i915_debugfs.c linux-3.0.8/drivers/gpu/drm/i915/i915_debugfs.c
26636 --- linux-3.0.8/drivers/gpu/drm/i915/i915_debugfs.c 2011-07-21 22:17:23.000000000 -0400
26637 +++ linux-3.0.8/drivers/gpu/drm/i915/i915_debugfs.c 2011-10-06 04:17:55.000000000 -0400
26638 @@ -497,7 +497,7 @@ static int i915_interrupt_info(struct se
26639 I915_READ(GTIMR));
26640 }
26641 seq_printf(m, "Interrupts received: %d\n",
26642 - atomic_read(&dev_priv->irq_received));
26643 + atomic_read_unchecked(&dev_priv->irq_received));
26644 for (i = 0; i < I915_NUM_RINGS; i++) {
26645 if (IS_GEN6(dev)) {
26646 seq_printf(m, "Graphics Interrupt mask (%s): %08x\n",
26647 @@ -1147,7 +1147,7 @@ static int i915_opregion(struct seq_file
26648 return ret;
26649
26650 if (opregion->header)
26651 - seq_write(m, opregion->header, OPREGION_SIZE);
26652 + seq_write(m, (const void __force_kernel *)opregion->header, OPREGION_SIZE);
26653
26654 mutex_unlock(&dev->struct_mutex);
26655
26656 diff -urNp linux-3.0.8/drivers/gpu/drm/i915/i915_dma.c linux-3.0.8/drivers/gpu/drm/i915/i915_dma.c
26657 --- linux-3.0.8/drivers/gpu/drm/i915/i915_dma.c 2011-10-24 08:05:21.000000000 -0400
26658 +++ linux-3.0.8/drivers/gpu/drm/i915/i915_dma.c 2011-08-23 21:47:55.000000000 -0400
26659 @@ -1169,7 +1169,7 @@ static bool i915_switcheroo_can_switch(s
26660 bool can_switch;
26661
26662 spin_lock(&dev->count_lock);
26663 - can_switch = (dev->open_count == 0);
26664 + can_switch = (local_read(&dev->open_count) == 0);
26665 spin_unlock(&dev->count_lock);
26666 return can_switch;
26667 }
26668 diff -urNp linux-3.0.8/drivers/gpu/drm/i915/i915_drv.h linux-3.0.8/drivers/gpu/drm/i915/i915_drv.h
26669 --- linux-3.0.8/drivers/gpu/drm/i915/i915_drv.h 2011-07-21 22:17:23.000000000 -0400
26670 +++ linux-3.0.8/drivers/gpu/drm/i915/i915_drv.h 2011-08-23 21:47:55.000000000 -0400
26671 @@ -219,7 +219,7 @@ struct drm_i915_display_funcs {
26672 /* render clock increase/decrease */
26673 /* display clock increase/decrease */
26674 /* pll clock increase/decrease */
26675 -};
26676 +} __no_const;
26677
26678 struct intel_device_info {
26679 u8 gen;
26680 @@ -300,7 +300,7 @@ typedef struct drm_i915_private {
26681 int current_page;
26682 int page_flipping;
26683
26684 - atomic_t irq_received;
26685 + atomic_unchecked_t irq_received;
26686
26687 /* protects the irq masks */
26688 spinlock_t irq_lock;
26689 @@ -874,7 +874,7 @@ struct drm_i915_gem_object {
26690 * will be page flipped away on the next vblank. When it
26691 * reaches 0, dev_priv->pending_flip_queue will be woken up.
26692 */
26693 - atomic_t pending_flip;
26694 + atomic_unchecked_t pending_flip;
26695 };
26696
26697 #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
26698 @@ -1247,7 +1247,7 @@ extern int intel_setup_gmbus(struct drm_
26699 extern void intel_teardown_gmbus(struct drm_device *dev);
26700 extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed);
26701 extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit);
26702 -extern inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
26703 +static inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
26704 {
26705 return container_of(adapter, struct intel_gmbus, adapter)->force_bit;
26706 }
26707 diff -urNp linux-3.0.8/drivers/gpu/drm/i915/i915_gem_execbuffer.c linux-3.0.8/drivers/gpu/drm/i915/i915_gem_execbuffer.c
26708 --- linux-3.0.8/drivers/gpu/drm/i915/i915_gem_execbuffer.c 2011-07-21 22:17:23.000000000 -0400
26709 +++ linux-3.0.8/drivers/gpu/drm/i915/i915_gem_execbuffer.c 2011-08-23 21:47:55.000000000 -0400
26710 @@ -188,7 +188,7 @@ i915_gem_object_set_to_gpu_domain(struct
26711 i915_gem_clflush_object(obj);
26712
26713 if (obj->base.pending_write_domain)
26714 - cd->flips |= atomic_read(&obj->pending_flip);
26715 + cd->flips |= atomic_read_unchecked(&obj->pending_flip);
26716
26717 /* The actual obj->write_domain will be updated with
26718 * pending_write_domain after we emit the accumulated flush for all
26719 diff -urNp linux-3.0.8/drivers/gpu/drm/i915/i915_irq.c linux-3.0.8/drivers/gpu/drm/i915/i915_irq.c
26720 --- linux-3.0.8/drivers/gpu/drm/i915/i915_irq.c 2011-10-24 08:05:21.000000000 -0400
26721 +++ linux-3.0.8/drivers/gpu/drm/i915/i915_irq.c 2011-08-23 21:47:55.000000000 -0400
26722 @@ -473,7 +473,7 @@ static irqreturn_t ivybridge_irq_handler
26723 u32 de_iir, gt_iir, de_ier, pch_iir, pm_iir;
26724 struct drm_i915_master_private *master_priv;
26725
26726 - atomic_inc(&dev_priv->irq_received);
26727 + atomic_inc_unchecked(&dev_priv->irq_received);
26728
26729 /* disable master interrupt before clearing iir */
26730 de_ier = I915_READ(DEIER);
26731 @@ -563,7 +563,7 @@ static irqreturn_t ironlake_irq_handler(
26732 struct drm_i915_master_private *master_priv;
26733 u32 bsd_usr_interrupt = GT_BSD_USER_INTERRUPT;
26734
26735 - atomic_inc(&dev_priv->irq_received);
26736 + atomic_inc_unchecked(&dev_priv->irq_received);
26737
26738 if (IS_GEN6(dev))
26739 bsd_usr_interrupt = GT_GEN6_BSD_USER_INTERRUPT;
26740 @@ -1226,7 +1226,7 @@ static irqreturn_t i915_driver_irq_handl
26741 int ret = IRQ_NONE, pipe;
26742 bool blc_event = false;
26743
26744 - atomic_inc(&dev_priv->irq_received);
26745 + atomic_inc_unchecked(&dev_priv->irq_received);
26746
26747 iir = I915_READ(IIR);
26748
26749 @@ -1735,7 +1735,7 @@ static void ironlake_irq_preinstall(stru
26750 {
26751 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
26752
26753 - atomic_set(&dev_priv->irq_received, 0);
26754 + atomic_set_unchecked(&dev_priv->irq_received, 0);
26755
26756 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
26757 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
26758 @@ -1899,7 +1899,7 @@ static void i915_driver_irq_preinstall(s
26759 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
26760 int pipe;
26761
26762 - atomic_set(&dev_priv->irq_received, 0);
26763 + atomic_set_unchecked(&dev_priv->irq_received, 0);
26764
26765 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
26766 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
26767 diff -urNp linux-3.0.8/drivers/gpu/drm/i915/intel_display.c linux-3.0.8/drivers/gpu/drm/i915/intel_display.c
26768 --- linux-3.0.8/drivers/gpu/drm/i915/intel_display.c 2011-10-24 08:05:21.000000000 -0400
26769 +++ linux-3.0.8/drivers/gpu/drm/i915/intel_display.c 2011-08-23 21:47:55.000000000 -0400
26770 @@ -1961,7 +1961,7 @@ intel_pipe_set_base(struct drm_crtc *crt
26771
26772 wait_event(dev_priv->pending_flip_queue,
26773 atomic_read(&dev_priv->mm.wedged) ||
26774 - atomic_read(&obj->pending_flip) == 0);
26775 + atomic_read_unchecked(&obj->pending_flip) == 0);
26776
26777 /* Big Hammer, we also need to ensure that any pending
26778 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
26779 @@ -2548,7 +2548,7 @@ static void intel_crtc_wait_for_pending_
26780 obj = to_intel_framebuffer(crtc->fb)->obj;
26781 dev_priv = crtc->dev->dev_private;
26782 wait_event(dev_priv->pending_flip_queue,
26783 - atomic_read(&obj->pending_flip) == 0);
26784 + atomic_read_unchecked(&obj->pending_flip) == 0);
26785 }
26786
26787 static bool intel_crtc_driving_pch(struct drm_crtc *crtc)
26788 @@ -6225,7 +6225,7 @@ static void do_intel_finish_page_flip(st
26789
26790 atomic_clear_mask(1 << intel_crtc->plane,
26791 &obj->pending_flip.counter);
26792 - if (atomic_read(&obj->pending_flip) == 0)
26793 + if (atomic_read_unchecked(&obj->pending_flip) == 0)
26794 wake_up(&dev_priv->pending_flip_queue);
26795
26796 schedule_work(&work->work);
26797 @@ -6514,7 +6514,7 @@ static int intel_crtc_page_flip(struct d
26798 /* Block clients from rendering to the new back buffer until
26799 * the flip occurs and the object is no longer visible.
26800 */
26801 - atomic_add(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
26802 + atomic_add_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
26803
26804 ret = dev_priv->display.queue_flip(dev, crtc, fb, obj);
26805 if (ret)
26806 @@ -6527,7 +6527,7 @@ static int intel_crtc_page_flip(struct d
26807 return 0;
26808
26809 cleanup_pending:
26810 - atomic_sub(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
26811 + atomic_sub_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
26812 cleanup_objs:
26813 drm_gem_object_unreference(&work->old_fb_obj->base);
26814 drm_gem_object_unreference(&obj->base);
26815 diff -urNp linux-3.0.8/drivers/gpu/drm/mga/mga_drv.h linux-3.0.8/drivers/gpu/drm/mga/mga_drv.h
26816 --- linux-3.0.8/drivers/gpu/drm/mga/mga_drv.h 2011-07-21 22:17:23.000000000 -0400
26817 +++ linux-3.0.8/drivers/gpu/drm/mga/mga_drv.h 2011-08-23 21:47:55.000000000 -0400
26818 @@ -120,9 +120,9 @@ typedef struct drm_mga_private {
26819 u32 clear_cmd;
26820 u32 maccess;
26821
26822 - atomic_t vbl_received; /**< Number of vblanks received. */
26823 + atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
26824 wait_queue_head_t fence_queue;
26825 - atomic_t last_fence_retired;
26826 + atomic_unchecked_t last_fence_retired;
26827 u32 next_fence_to_post;
26828
26829 unsigned int fb_cpp;
26830 diff -urNp linux-3.0.8/drivers/gpu/drm/mga/mga_irq.c linux-3.0.8/drivers/gpu/drm/mga/mga_irq.c
26831 --- linux-3.0.8/drivers/gpu/drm/mga/mga_irq.c 2011-07-21 22:17:23.000000000 -0400
26832 +++ linux-3.0.8/drivers/gpu/drm/mga/mga_irq.c 2011-08-23 21:47:55.000000000 -0400
26833 @@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_de
26834 if (crtc != 0)
26835 return 0;
26836
26837 - return atomic_read(&dev_priv->vbl_received);
26838 + return atomic_read_unchecked(&dev_priv->vbl_received);
26839 }
26840
26841
26842 @@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
26843 /* VBLANK interrupt */
26844 if (status & MGA_VLINEPEN) {
26845 MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
26846 - atomic_inc(&dev_priv->vbl_received);
26847 + atomic_inc_unchecked(&dev_priv->vbl_received);
26848 drm_handle_vblank(dev, 0);
26849 handled = 1;
26850 }
26851 @@ -79,7 +79,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
26852 if ((prim_start & ~0x03) != (prim_end & ~0x03))
26853 MGA_WRITE(MGA_PRIMEND, prim_end);
26854
26855 - atomic_inc(&dev_priv->last_fence_retired);
26856 + atomic_inc_unchecked(&dev_priv->last_fence_retired);
26857 DRM_WAKEUP(&dev_priv->fence_queue);
26858 handled = 1;
26859 }
26860 @@ -130,7 +130,7 @@ int mga_driver_fence_wait(struct drm_dev
26861 * using fences.
26862 */
26863 DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
26864 - (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
26865 + (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
26866 - *sequence) <= (1 << 23)));
26867
26868 *sequence = cur_fence;
26869 diff -urNp linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_bios.c linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_bios.c
26870 --- linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_bios.c 2011-07-21 22:17:23.000000000 -0400
26871 +++ linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_bios.c 2011-08-26 19:49:56.000000000 -0400
26872 @@ -200,7 +200,7 @@ struct methods {
26873 const char desc[8];
26874 void (*loadbios)(struct drm_device *, uint8_t *);
26875 const bool rw;
26876 -};
26877 +} __do_const;
26878
26879 static struct methods shadow_methods[] = {
26880 { "PRAMIN", load_vbios_pramin, true },
26881 @@ -5488,7 +5488,7 @@ parse_bit_displayport_tbl_entry(struct d
26882 struct bit_table {
26883 const char id;
26884 int (* const parse_fn)(struct drm_device *, struct nvbios *, struct bit_entry *);
26885 -};
26886 +} __no_const;
26887
26888 #define BIT_TABLE(id, funcid) ((struct bit_table){ id, parse_bit_##funcid##_tbl_entry })
26889
26890 diff -urNp linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_drv.h linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_drv.h
26891 --- linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-07-21 22:17:23.000000000 -0400
26892 +++ linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-08-23 21:47:55.000000000 -0400
26893 @@ -227,7 +227,7 @@ struct nouveau_channel {
26894 struct list_head pending;
26895 uint32_t sequence;
26896 uint32_t sequence_ack;
26897 - atomic_t last_sequence_irq;
26898 + atomic_unchecked_t last_sequence_irq;
26899 } fence;
26900
26901 /* DMA push buffer */
26902 @@ -304,7 +304,7 @@ struct nouveau_exec_engine {
26903 u32 handle, u16 class);
26904 void (*set_tile_region)(struct drm_device *dev, int i);
26905 void (*tlb_flush)(struct drm_device *, int engine);
26906 -};
26907 +} __no_const;
26908
26909 struct nouveau_instmem_engine {
26910 void *priv;
26911 @@ -325,13 +325,13 @@ struct nouveau_instmem_engine {
26912 struct nouveau_mc_engine {
26913 int (*init)(struct drm_device *dev);
26914 void (*takedown)(struct drm_device *dev);
26915 -};
26916 +} __no_const;
26917
26918 struct nouveau_timer_engine {
26919 int (*init)(struct drm_device *dev);
26920 void (*takedown)(struct drm_device *dev);
26921 uint64_t (*read)(struct drm_device *dev);
26922 -};
26923 +} __no_const;
26924
26925 struct nouveau_fb_engine {
26926 int num_tiles;
26927 @@ -494,7 +494,7 @@ struct nouveau_vram_engine {
26928 void (*put)(struct drm_device *, struct nouveau_mem **);
26929
26930 bool (*flags_valid)(struct drm_device *, u32 tile_flags);
26931 -};
26932 +} __no_const;
26933
26934 struct nouveau_engine {
26935 struct nouveau_instmem_engine instmem;
26936 @@ -640,7 +640,7 @@ struct drm_nouveau_private {
26937 struct drm_global_reference mem_global_ref;
26938 struct ttm_bo_global_ref bo_global_ref;
26939 struct ttm_bo_device bdev;
26940 - atomic_t validate_sequence;
26941 + atomic_unchecked_t validate_sequence;
26942 } ttm;
26943
26944 struct {
26945 diff -urNp linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_fence.c linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_fence.c
26946 --- linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_fence.c 2011-07-21 22:17:23.000000000 -0400
26947 +++ linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_fence.c 2011-08-23 21:47:55.000000000 -0400
26948 @@ -85,7 +85,7 @@ nouveau_fence_update(struct nouveau_chan
26949 if (USE_REFCNT(dev))
26950 sequence = nvchan_rd32(chan, 0x48);
26951 else
26952 - sequence = atomic_read(&chan->fence.last_sequence_irq);
26953 + sequence = atomic_read_unchecked(&chan->fence.last_sequence_irq);
26954
26955 if (chan->fence.sequence_ack == sequence)
26956 goto out;
26957 @@ -544,7 +544,7 @@ nouveau_fence_channel_init(struct nouvea
26958
26959 INIT_LIST_HEAD(&chan->fence.pending);
26960 spin_lock_init(&chan->fence.lock);
26961 - atomic_set(&chan->fence.last_sequence_irq, 0);
26962 + atomic_set_unchecked(&chan->fence.last_sequence_irq, 0);
26963 return 0;
26964 }
26965
26966 diff -urNp linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_gem.c linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_gem.c
26967 --- linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_gem.c 2011-07-21 22:17:23.000000000 -0400
26968 +++ linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_gem.c 2011-08-23 21:47:55.000000000 -0400
26969 @@ -249,7 +249,7 @@ validate_init(struct nouveau_channel *ch
26970 int trycnt = 0;
26971 int ret, i;
26972
26973 - sequence = atomic_add_return(1, &dev_priv->ttm.validate_sequence);
26974 + sequence = atomic_add_return_unchecked(1, &dev_priv->ttm.validate_sequence);
26975 retry:
26976 if (++trycnt > 100000) {
26977 NV_ERROR(dev, "%s failed and gave up.\n", __func__);
26978 diff -urNp linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_state.c linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_state.c
26979 --- linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_state.c 2011-07-21 22:17:23.000000000 -0400
26980 +++ linux-3.0.8/drivers/gpu/drm/nouveau/nouveau_state.c 2011-08-23 21:47:55.000000000 -0400
26981 @@ -488,7 +488,7 @@ static bool nouveau_switcheroo_can_switc
26982 bool can_switch;
26983
26984 spin_lock(&dev->count_lock);
26985 - can_switch = (dev->open_count == 0);
26986 + can_switch = (local_read(&dev->open_count) == 0);
26987 spin_unlock(&dev->count_lock);
26988 return can_switch;
26989 }
26990 diff -urNp linux-3.0.8/drivers/gpu/drm/nouveau/nv04_graph.c linux-3.0.8/drivers/gpu/drm/nouveau/nv04_graph.c
26991 --- linux-3.0.8/drivers/gpu/drm/nouveau/nv04_graph.c 2011-07-21 22:17:23.000000000 -0400
26992 +++ linux-3.0.8/drivers/gpu/drm/nouveau/nv04_graph.c 2011-08-23 21:47:55.000000000 -0400
26993 @@ -560,7 +560,7 @@ static int
26994 nv04_graph_mthd_set_ref(struct nouveau_channel *chan,
26995 u32 class, u32 mthd, u32 data)
26996 {
26997 - atomic_set(&chan->fence.last_sequence_irq, data);
26998 + atomic_set_unchecked(&chan->fence.last_sequence_irq, data);
26999 return 0;
27000 }
27001
27002 diff -urNp linux-3.0.8/drivers/gpu/drm/r128/r128_cce.c linux-3.0.8/drivers/gpu/drm/r128/r128_cce.c
27003 --- linux-3.0.8/drivers/gpu/drm/r128/r128_cce.c 2011-07-21 22:17:23.000000000 -0400
27004 +++ linux-3.0.8/drivers/gpu/drm/r128/r128_cce.c 2011-08-23 21:47:55.000000000 -0400
27005 @@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_d
27006
27007 /* GH: Simple idle check.
27008 */
27009 - atomic_set(&dev_priv->idle_count, 0);
27010 + atomic_set_unchecked(&dev_priv->idle_count, 0);
27011
27012 /* We don't support anything other than bus-mastering ring mode,
27013 * but the ring can be in either AGP or PCI space for the ring
27014 diff -urNp linux-3.0.8/drivers/gpu/drm/r128/r128_drv.h linux-3.0.8/drivers/gpu/drm/r128/r128_drv.h
27015 --- linux-3.0.8/drivers/gpu/drm/r128/r128_drv.h 2011-07-21 22:17:23.000000000 -0400
27016 +++ linux-3.0.8/drivers/gpu/drm/r128/r128_drv.h 2011-08-23 21:47:55.000000000 -0400
27017 @@ -90,14 +90,14 @@ typedef struct drm_r128_private {
27018 int is_pci;
27019 unsigned long cce_buffers_offset;
27020
27021 - atomic_t idle_count;
27022 + atomic_unchecked_t idle_count;
27023
27024 int page_flipping;
27025 int current_page;
27026 u32 crtc_offset;
27027 u32 crtc_offset_cntl;
27028
27029 - atomic_t vbl_received;
27030 + atomic_unchecked_t vbl_received;
27031
27032 u32 color_fmt;
27033 unsigned int front_offset;
27034 diff -urNp linux-3.0.8/drivers/gpu/drm/r128/r128_irq.c linux-3.0.8/drivers/gpu/drm/r128/r128_irq.c
27035 --- linux-3.0.8/drivers/gpu/drm/r128/r128_irq.c 2011-07-21 22:17:23.000000000 -0400
27036 +++ linux-3.0.8/drivers/gpu/drm/r128/r128_irq.c 2011-08-23 21:47:55.000000000 -0400
27037 @@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_d
27038 if (crtc != 0)
27039 return 0;
27040
27041 - return atomic_read(&dev_priv->vbl_received);
27042 + return atomic_read_unchecked(&dev_priv->vbl_received);
27043 }
27044
27045 irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
27046 @@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_
27047 /* VBLANK interrupt */
27048 if (status & R128_CRTC_VBLANK_INT) {
27049 R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
27050 - atomic_inc(&dev_priv->vbl_received);
27051 + atomic_inc_unchecked(&dev_priv->vbl_received);
27052 drm_handle_vblank(dev, 0);
27053 return IRQ_HANDLED;
27054 }
27055 diff -urNp linux-3.0.8/drivers/gpu/drm/r128/r128_state.c linux-3.0.8/drivers/gpu/drm/r128/r128_state.c
27056 --- linux-3.0.8/drivers/gpu/drm/r128/r128_state.c 2011-07-21 22:17:23.000000000 -0400
27057 +++ linux-3.0.8/drivers/gpu/drm/r128/r128_state.c 2011-08-23 21:47:55.000000000 -0400
27058 @@ -321,10 +321,10 @@ static void r128_clear_box(drm_r128_priv
27059
27060 static void r128_cce_performance_boxes(drm_r128_private_t *dev_priv)
27061 {
27062 - if (atomic_read(&dev_priv->idle_count) == 0)
27063 + if (atomic_read_unchecked(&dev_priv->idle_count) == 0)
27064 r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
27065 else
27066 - atomic_set(&dev_priv->idle_count, 0);
27067 + atomic_set_unchecked(&dev_priv->idle_count, 0);
27068 }
27069
27070 #endif
27071 diff -urNp linux-3.0.8/drivers/gpu/drm/radeon/atom.c linux-3.0.8/drivers/gpu/drm/radeon/atom.c
27072 --- linux-3.0.8/drivers/gpu/drm/radeon/atom.c 2011-10-25 09:10:33.000000000 -0400
27073 +++ linux-3.0.8/drivers/gpu/drm/radeon/atom.c 2011-10-25 09:10:41.000000000 -0400
27074 @@ -1254,6 +1254,8 @@ struct atom_context *atom_parse(struct c
27075 char name[512];
27076 int i;
27077
27078 + pax_track_stack();
27079 +
27080 ctx->card = card;
27081 ctx->bios = bios;
27082
27083 diff -urNp linux-3.0.8/drivers/gpu/drm/radeon/mkregtable.c linux-3.0.8/drivers/gpu/drm/radeon/mkregtable.c
27084 --- linux-3.0.8/drivers/gpu/drm/radeon/mkregtable.c 2011-07-21 22:17:23.000000000 -0400
27085 +++ linux-3.0.8/drivers/gpu/drm/radeon/mkregtable.c 2011-08-23 21:47:55.000000000 -0400
27086 @@ -637,14 +637,14 @@ static int parser_auth(struct table *t,
27087 regex_t mask_rex;
27088 regmatch_t match[4];
27089 char buf[1024];
27090 - size_t end;
27091 + long end;
27092 int len;
27093 int done = 0;
27094 int r;
27095 unsigned o;
27096 struct offset *offset;
27097 char last_reg_s[10];
27098 - int last_reg;
27099 + unsigned long last_reg;
27100
27101 if (regcomp
27102 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
27103 diff -urNp linux-3.0.8/drivers/gpu/drm/radeon/radeon_atombios.c linux-3.0.8/drivers/gpu/drm/radeon/radeon_atombios.c
27104 --- linux-3.0.8/drivers/gpu/drm/radeon/radeon_atombios.c 2011-07-21 22:17:23.000000000 -0400
27105 +++ linux-3.0.8/drivers/gpu/drm/radeon/radeon_atombios.c 2011-08-23 21:48:14.000000000 -0400
27106 @@ -545,6 +545,8 @@ bool radeon_get_atom_connector_info_from
27107 struct radeon_gpio_rec gpio;
27108 struct radeon_hpd hpd;
27109
27110 + pax_track_stack();
27111 +
27112 if (!atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset))
27113 return false;
27114
27115 diff -urNp linux-3.0.8/drivers/gpu/drm/radeon/radeon_device.c linux-3.0.8/drivers/gpu/drm/radeon/radeon_device.c
27116 --- linux-3.0.8/drivers/gpu/drm/radeon/radeon_device.c 2011-10-24 08:05:21.000000000 -0400
27117 +++ linux-3.0.8/drivers/gpu/drm/radeon/radeon_device.c 2011-08-23 21:47:55.000000000 -0400
27118 @@ -678,7 +678,7 @@ static bool radeon_switcheroo_can_switch
27119 bool can_switch;
27120
27121 spin_lock(&dev->count_lock);
27122 - can_switch = (dev->open_count == 0);
27123 + can_switch = (local_read(&dev->open_count) == 0);
27124 spin_unlock(&dev->count_lock);
27125 return can_switch;
27126 }
27127 diff -urNp linux-3.0.8/drivers/gpu/drm/radeon/radeon_display.c linux-3.0.8/drivers/gpu/drm/radeon/radeon_display.c
27128 --- linux-3.0.8/drivers/gpu/drm/radeon/radeon_display.c 2011-10-24 08:05:21.000000000 -0400
27129 +++ linux-3.0.8/drivers/gpu/drm/radeon/radeon_display.c 2011-08-23 21:48:14.000000000 -0400
27130 @@ -946,6 +946,8 @@ void radeon_compute_pll_legacy(struct ra
27131 uint32_t post_div;
27132 u32 pll_out_min, pll_out_max;
27133
27134 + pax_track_stack();
27135 +
27136 DRM_DEBUG_KMS("PLL freq %llu %u %u\n", freq, pll->min_ref_div, pll->max_ref_div);
27137 freq = freq * 1000;
27138
27139 diff -urNp linux-3.0.8/drivers/gpu/drm/radeon/radeon_drv.h linux-3.0.8/drivers/gpu/drm/radeon/radeon_drv.h
27140 --- linux-3.0.8/drivers/gpu/drm/radeon/radeon_drv.h 2011-07-21 22:17:23.000000000 -0400
27141 +++ linux-3.0.8/drivers/gpu/drm/radeon/radeon_drv.h 2011-08-23 21:47:55.000000000 -0400
27142 @@ -255,7 +255,7 @@ typedef struct drm_radeon_private {
27143
27144 /* SW interrupt */
27145 wait_queue_head_t swi_queue;
27146 - atomic_t swi_emitted;
27147 + atomic_unchecked_t swi_emitted;
27148 int vblank_crtc;
27149 uint32_t irq_enable_reg;
27150 uint32_t r500_disp_irq_reg;
27151 diff -urNp linux-3.0.8/drivers/gpu/drm/radeon/radeon_fence.c linux-3.0.8/drivers/gpu/drm/radeon/radeon_fence.c
27152 --- linux-3.0.8/drivers/gpu/drm/radeon/radeon_fence.c 2011-07-21 22:17:23.000000000 -0400
27153 +++ linux-3.0.8/drivers/gpu/drm/radeon/radeon_fence.c 2011-08-23 21:47:55.000000000 -0400
27154 @@ -78,7 +78,7 @@ int radeon_fence_emit(struct radeon_devi
27155 write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
27156 return 0;
27157 }
27158 - fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
27159 + fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
27160 if (!rdev->cp.ready)
27161 /* FIXME: cp is not running assume everythings is done right
27162 * away
27163 @@ -373,7 +373,7 @@ int radeon_fence_driver_init(struct rade
27164 return r;
27165 }
27166 radeon_fence_write(rdev, 0);
27167 - atomic_set(&rdev->fence_drv.seq, 0);
27168 + atomic_set_unchecked(&rdev->fence_drv.seq, 0);
27169 INIT_LIST_HEAD(&rdev->fence_drv.created);
27170 INIT_LIST_HEAD(&rdev->fence_drv.emited);
27171 INIT_LIST_HEAD(&rdev->fence_drv.signaled);
27172 diff -urNp linux-3.0.8/drivers/gpu/drm/radeon/radeon.h linux-3.0.8/drivers/gpu/drm/radeon/radeon.h
27173 --- linux-3.0.8/drivers/gpu/drm/radeon/radeon.h 2011-10-24 08:05:30.000000000 -0400
27174 +++ linux-3.0.8/drivers/gpu/drm/radeon/radeon.h 2011-10-16 21:55:27.000000000 -0400
27175 @@ -191,7 +191,7 @@ extern int sumo_get_temp(struct radeon_d
27176 */
27177 struct radeon_fence_driver {
27178 uint32_t scratch_reg;
27179 - atomic_t seq;
27180 + atomic_unchecked_t seq;
27181 uint32_t last_seq;
27182 unsigned long last_jiffies;
27183 unsigned long last_timeout;
27184 @@ -961,7 +961,7 @@ struct radeon_asic {
27185 void (*pre_page_flip)(struct radeon_device *rdev, int crtc);
27186 u32 (*page_flip)(struct radeon_device *rdev, int crtc, u64 crtc_base);
27187 void (*post_page_flip)(struct radeon_device *rdev, int crtc);
27188 -};
27189 +} __no_const;
27190
27191 /*
27192 * Asic structures
27193 diff -urNp linux-3.0.8/drivers/gpu/drm/radeon/radeon_ioc32.c linux-3.0.8/drivers/gpu/drm/radeon/radeon_ioc32.c
27194 --- linux-3.0.8/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-07-21 22:17:23.000000000 -0400
27195 +++ linux-3.0.8/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-08-23 21:47:55.000000000 -0400
27196 @@ -359,7 +359,7 @@ static int compat_radeon_cp_setparam(str
27197 request = compat_alloc_user_space(sizeof(*request));
27198 if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
27199 || __put_user(req32.param, &request->param)
27200 - || __put_user((void __user *)(unsigned long)req32.value,
27201 + || __put_user((unsigned long)req32.value,
27202 &request->value))
27203 return -EFAULT;
27204
27205 diff -urNp linux-3.0.8/drivers/gpu/drm/radeon/radeon_irq.c linux-3.0.8/drivers/gpu/drm/radeon/radeon_irq.c
27206 --- linux-3.0.8/drivers/gpu/drm/radeon/radeon_irq.c 2011-07-21 22:17:23.000000000 -0400
27207 +++ linux-3.0.8/drivers/gpu/drm/radeon/radeon_irq.c 2011-08-23 21:47:55.000000000 -0400
27208 @@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_de
27209 unsigned int ret;
27210 RING_LOCALS;
27211
27212 - atomic_inc(&dev_priv->swi_emitted);
27213 - ret = atomic_read(&dev_priv->swi_emitted);
27214 + atomic_inc_unchecked(&dev_priv->swi_emitted);
27215 + ret = atomic_read_unchecked(&dev_priv->swi_emitted);
27216
27217 BEGIN_RING(4);
27218 OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
27219 @@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct
27220 drm_radeon_private_t *dev_priv =
27221 (drm_radeon_private_t *) dev->dev_private;
27222
27223 - atomic_set(&dev_priv->swi_emitted, 0);
27224 + atomic_set_unchecked(&dev_priv->swi_emitted, 0);
27225 DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
27226
27227 dev->max_vblank_count = 0x001fffff;
27228 diff -urNp linux-3.0.8/drivers/gpu/drm/radeon/radeon_state.c linux-3.0.8/drivers/gpu/drm/radeon/radeon_state.c
27229 --- linux-3.0.8/drivers/gpu/drm/radeon/radeon_state.c 2011-07-21 22:17:23.000000000 -0400
27230 +++ linux-3.0.8/drivers/gpu/drm/radeon/radeon_state.c 2011-08-23 21:47:55.000000000 -0400
27231 @@ -2168,7 +2168,7 @@ static int radeon_cp_clear(struct drm_de
27232 if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS)
27233 sarea_priv->nbox = RADEON_NR_SAREA_CLIPRECTS;
27234
27235 - if (DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
27236 + if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS || DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
27237 sarea_priv->nbox * sizeof(depth_boxes[0])))
27238 return -EFAULT;
27239
27240 @@ -3031,7 +3031,7 @@ static int radeon_cp_getparam(struct drm
27241 {
27242 drm_radeon_private_t *dev_priv = dev->dev_private;
27243 drm_radeon_getparam_t *param = data;
27244 - int value;
27245 + int value = 0;
27246
27247 DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
27248
27249 diff -urNp linux-3.0.8/drivers/gpu/drm/radeon/radeon_ttm.c linux-3.0.8/drivers/gpu/drm/radeon/radeon_ttm.c
27250 --- linux-3.0.8/drivers/gpu/drm/radeon/radeon_ttm.c 2011-10-24 08:05:30.000000000 -0400
27251 +++ linux-3.0.8/drivers/gpu/drm/radeon/radeon_ttm.c 2011-10-16 21:55:27.000000000 -0400
27252 @@ -649,8 +649,10 @@ int radeon_mmap(struct file *filp, struc
27253 }
27254 if (unlikely(ttm_vm_ops == NULL)) {
27255 ttm_vm_ops = vma->vm_ops;
27256 - radeon_ttm_vm_ops = *ttm_vm_ops;
27257 - radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
27258 + pax_open_kernel();
27259 + memcpy((void *)&radeon_ttm_vm_ops, ttm_vm_ops, sizeof(radeon_ttm_vm_ops));
27260 + *(void **)&radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
27261 + pax_close_kernel();
27262 }
27263 vma->vm_ops = &radeon_ttm_vm_ops;
27264 return 0;
27265 diff -urNp linux-3.0.8/drivers/gpu/drm/radeon/rs690.c linux-3.0.8/drivers/gpu/drm/radeon/rs690.c
27266 --- linux-3.0.8/drivers/gpu/drm/radeon/rs690.c 2011-07-21 22:17:23.000000000 -0400
27267 +++ linux-3.0.8/drivers/gpu/drm/radeon/rs690.c 2011-08-23 21:47:55.000000000 -0400
27268 @@ -304,9 +304,11 @@ void rs690_crtc_bandwidth_compute(struct
27269 if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
27270 rdev->pm.sideport_bandwidth.full)
27271 rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
27272 - read_delay_latency.full = dfixed_const(370 * 800 * 1000);
27273 + read_delay_latency.full = dfixed_const(800 * 1000);
27274 read_delay_latency.full = dfixed_div(read_delay_latency,
27275 rdev->pm.igp_sideport_mclk);
27276 + a.full = dfixed_const(370);
27277 + read_delay_latency.full = dfixed_mul(read_delay_latency, a);
27278 } else {
27279 if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
27280 rdev->pm.k8_bandwidth.full)
27281 diff -urNp linux-3.0.8/drivers/gpu/drm/ttm/ttm_page_alloc.c linux-3.0.8/drivers/gpu/drm/ttm/ttm_page_alloc.c
27282 --- linux-3.0.8/drivers/gpu/drm/ttm/ttm_page_alloc.c 2011-07-21 22:17:23.000000000 -0400
27283 +++ linux-3.0.8/drivers/gpu/drm/ttm/ttm_page_alloc.c 2011-08-23 21:47:55.000000000 -0400
27284 @@ -398,9 +398,9 @@ static int ttm_pool_get_num_unused_pages
27285 static int ttm_pool_mm_shrink(struct shrinker *shrink,
27286 struct shrink_control *sc)
27287 {
27288 - static atomic_t start_pool = ATOMIC_INIT(0);
27289 + static atomic_unchecked_t start_pool = ATOMIC_INIT(0);
27290 unsigned i;
27291 - unsigned pool_offset = atomic_add_return(1, &start_pool);
27292 + unsigned pool_offset = atomic_add_return_unchecked(1, &start_pool);
27293 struct ttm_page_pool *pool;
27294 int shrink_pages = sc->nr_to_scan;
27295
27296 diff -urNp linux-3.0.8/drivers/gpu/drm/via/via_drv.h linux-3.0.8/drivers/gpu/drm/via/via_drv.h
27297 --- linux-3.0.8/drivers/gpu/drm/via/via_drv.h 2011-07-21 22:17:23.000000000 -0400
27298 +++ linux-3.0.8/drivers/gpu/drm/via/via_drv.h 2011-08-23 21:47:55.000000000 -0400
27299 @@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
27300 typedef uint32_t maskarray_t[5];
27301
27302 typedef struct drm_via_irq {
27303 - atomic_t irq_received;
27304 + atomic_unchecked_t irq_received;
27305 uint32_t pending_mask;
27306 uint32_t enable_mask;
27307 wait_queue_head_t irq_queue;
27308 @@ -75,7 +75,7 @@ typedef struct drm_via_private {
27309 struct timeval last_vblank;
27310 int last_vblank_valid;
27311 unsigned usec_per_vblank;
27312 - atomic_t vbl_received;
27313 + atomic_unchecked_t vbl_received;
27314 drm_via_state_t hc_state;
27315 char pci_buf[VIA_PCI_BUF_SIZE];
27316 const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
27317 diff -urNp linux-3.0.8/drivers/gpu/drm/via/via_irq.c linux-3.0.8/drivers/gpu/drm/via/via_irq.c
27318 --- linux-3.0.8/drivers/gpu/drm/via/via_irq.c 2011-07-21 22:17:23.000000000 -0400
27319 +++ linux-3.0.8/drivers/gpu/drm/via/via_irq.c 2011-08-23 21:47:55.000000000 -0400
27320 @@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_de
27321 if (crtc != 0)
27322 return 0;
27323
27324 - return atomic_read(&dev_priv->vbl_received);
27325 + return atomic_read_unchecked(&dev_priv->vbl_received);
27326 }
27327
27328 irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
27329 @@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_I
27330
27331 status = VIA_READ(VIA_REG_INTERRUPT);
27332 if (status & VIA_IRQ_VBLANK_PENDING) {
27333 - atomic_inc(&dev_priv->vbl_received);
27334 - if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
27335 + atomic_inc_unchecked(&dev_priv->vbl_received);
27336 + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
27337 do_gettimeofday(&cur_vblank);
27338 if (dev_priv->last_vblank_valid) {
27339 dev_priv->usec_per_vblank =
27340 @@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
27341 dev_priv->last_vblank = cur_vblank;
27342 dev_priv->last_vblank_valid = 1;
27343 }
27344 - if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
27345 + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
27346 DRM_DEBUG("US per vblank is: %u\n",
27347 dev_priv->usec_per_vblank);
27348 }
27349 @@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
27350
27351 for (i = 0; i < dev_priv->num_irqs; ++i) {
27352 if (status & cur_irq->pending_mask) {
27353 - atomic_inc(&cur_irq->irq_received);
27354 + atomic_inc_unchecked(&cur_irq->irq_received);
27355 DRM_WAKEUP(&cur_irq->irq_queue);
27356 handled = 1;
27357 if (dev_priv->irq_map[drm_via_irq_dma0_td] == i)
27358 @@ -243,11 +243,11 @@ via_driver_irq_wait(struct drm_device *d
27359 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
27360 ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
27361 masks[irq][4]));
27362 - cur_irq_sequence = atomic_read(&cur_irq->irq_received);
27363 + cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
27364 } else {
27365 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
27366 (((cur_irq_sequence =
27367 - atomic_read(&cur_irq->irq_received)) -
27368 + atomic_read_unchecked(&cur_irq->irq_received)) -
27369 *sequence) <= (1 << 23)));
27370 }
27371 *sequence = cur_irq_sequence;
27372 @@ -285,7 +285,7 @@ void via_driver_irq_preinstall(struct dr
27373 }
27374
27375 for (i = 0; i < dev_priv->num_irqs; ++i) {
27376 - atomic_set(&cur_irq->irq_received, 0);
27377 + atomic_set_unchecked(&cur_irq->irq_received, 0);
27378 cur_irq->enable_mask = dev_priv->irq_masks[i][0];
27379 cur_irq->pending_mask = dev_priv->irq_masks[i][1];
27380 DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
27381 @@ -367,7 +367,7 @@ int via_wait_irq(struct drm_device *dev,
27382 switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
27383 case VIA_IRQ_RELATIVE:
27384 irqwait->request.sequence +=
27385 - atomic_read(&cur_irq->irq_received);
27386 + atomic_read_unchecked(&cur_irq->irq_received);
27387 irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
27388 case VIA_IRQ_ABSOLUTE:
27389 break;
27390 diff -urNp linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
27391 --- linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h 2011-07-21 22:17:23.000000000 -0400
27392 +++ linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h 2011-08-23 21:47:55.000000000 -0400
27393 @@ -240,7 +240,7 @@ struct vmw_private {
27394 * Fencing and IRQs.
27395 */
27396
27397 - atomic_t fence_seq;
27398 + atomic_unchecked_t fence_seq;
27399 wait_queue_head_t fence_queue;
27400 wait_queue_head_t fifo_queue;
27401 atomic_t fence_queue_waiters;
27402 diff -urNp linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
27403 --- linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c 2011-07-21 22:17:23.000000000 -0400
27404 +++ linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c 2011-10-06 04:17:55.000000000 -0400
27405 @@ -610,7 +610,7 @@ int vmw_execbuf_ioctl(struct drm_device
27406 struct drm_vmw_fence_rep fence_rep;
27407 struct drm_vmw_fence_rep __user *user_fence_rep;
27408 int ret;
27409 - void *user_cmd;
27410 + void __user *user_cmd;
27411 void *cmd;
27412 uint32_t sequence;
27413 struct vmw_sw_context *sw_context = &dev_priv->ctx;
27414 diff -urNp linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
27415 --- linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c 2011-07-21 22:17:23.000000000 -0400
27416 +++ linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c 2011-08-23 21:47:55.000000000 -0400
27417 @@ -151,7 +151,7 @@ int vmw_wait_lag(struct vmw_private *dev
27418 while (!vmw_lag_lt(queue, us)) {
27419 spin_lock(&queue->lock);
27420 if (list_empty(&queue->head))
27421 - sequence = atomic_read(&dev_priv->fence_seq);
27422 + sequence = atomic_read_unchecked(&dev_priv->fence_seq);
27423 else {
27424 fence = list_first_entry(&queue->head,
27425 struct vmw_fence, head);
27426 diff -urNp linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
27427 --- linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-07-21 22:17:23.000000000 -0400
27428 +++ linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-10-06 04:17:55.000000000 -0400
27429 @@ -137,7 +137,7 @@ int vmw_fifo_init(struct vmw_private *de
27430 (unsigned int) min,
27431 (unsigned int) fifo->capabilities);
27432
27433 - atomic_set(&dev_priv->fence_seq, dev_priv->last_read_sequence);
27434 + atomic_set_unchecked(&dev_priv->fence_seq, dev_priv->last_read_sequence);
27435 iowrite32(dev_priv->last_read_sequence, fifo_mem + SVGA_FIFO_FENCE);
27436 vmw_fence_queue_init(&fifo->fence_queue);
27437 return vmw_fifo_send_fence(dev_priv, &dummy);
27438 @@ -356,7 +356,7 @@ void *vmw_fifo_reserve(struct vmw_privat
27439 if (reserveable)
27440 iowrite32(bytes, fifo_mem +
27441 SVGA_FIFO_RESERVED);
27442 - return fifo_mem + (next_cmd >> 2);
27443 + return (__le32 __force_kernel *)fifo_mem + (next_cmd >> 2);
27444 } else {
27445 need_bounce = true;
27446 }
27447 @@ -476,7 +476,7 @@ int vmw_fifo_send_fence(struct vmw_priva
27448
27449 fm = vmw_fifo_reserve(dev_priv, bytes);
27450 if (unlikely(fm == NULL)) {
27451 - *sequence = atomic_read(&dev_priv->fence_seq);
27452 + *sequence = atomic_read_unchecked(&dev_priv->fence_seq);
27453 ret = -ENOMEM;
27454 (void)vmw_fallback_wait(dev_priv, false, true, *sequence,
27455 false, 3*HZ);
27456 @@ -484,7 +484,7 @@ int vmw_fifo_send_fence(struct vmw_priva
27457 }
27458
27459 do {
27460 - *sequence = atomic_add_return(1, &dev_priv->fence_seq);
27461 + *sequence = atomic_add_return_unchecked(1, &dev_priv->fence_seq);
27462 } while (*sequence == 0);
27463
27464 if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
27465 diff -urNp linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
27466 --- linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c 2011-07-21 22:17:23.000000000 -0400
27467 +++ linux-3.0.8/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c 2011-08-23 21:47:55.000000000 -0400
27468 @@ -100,7 +100,7 @@ bool vmw_fence_signaled(struct vmw_priva
27469 * emitted. Then the fence is stale and signaled.
27470 */
27471
27472 - ret = ((atomic_read(&dev_priv->fence_seq) - sequence)
27473 + ret = ((atomic_read_unchecked(&dev_priv->fence_seq) - sequence)
27474 > VMW_FENCE_WRAP);
27475
27476 return ret;
27477 @@ -131,7 +131,7 @@ int vmw_fallback_wait(struct vmw_private
27478
27479 if (fifo_idle)
27480 down_read(&fifo_state->rwsem);
27481 - signal_seq = atomic_read(&dev_priv->fence_seq);
27482 + signal_seq = atomic_read_unchecked(&dev_priv->fence_seq);
27483 ret = 0;
27484
27485 for (;;) {
27486 diff -urNp linux-3.0.8/drivers/hid/hid-core.c linux-3.0.8/drivers/hid/hid-core.c
27487 --- linux-3.0.8/drivers/hid/hid-core.c 2011-07-21 22:17:23.000000000 -0400
27488 +++ linux-3.0.8/drivers/hid/hid-core.c 2011-08-23 21:47:55.000000000 -0400
27489 @@ -1923,7 +1923,7 @@ static bool hid_ignore(struct hid_device
27490
27491 int hid_add_device(struct hid_device *hdev)
27492 {
27493 - static atomic_t id = ATOMIC_INIT(0);
27494 + static atomic_unchecked_t id = ATOMIC_INIT(0);
27495 int ret;
27496
27497 if (WARN_ON(hdev->status & HID_STAT_ADDED))
27498 @@ -1938,7 +1938,7 @@ int hid_add_device(struct hid_device *hd
27499 /* XXX hack, any other cleaner solution after the driver core
27500 * is converted to allow more than 20 bytes as the device name? */
27501 dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
27502 - hdev->vendor, hdev->product, atomic_inc_return(&id));
27503 + hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
27504
27505 hid_debug_register(hdev, dev_name(&hdev->dev));
27506 ret = device_add(&hdev->dev);
27507 diff -urNp linux-3.0.8/drivers/hid/usbhid/hiddev.c linux-3.0.8/drivers/hid/usbhid/hiddev.c
27508 --- linux-3.0.8/drivers/hid/usbhid/hiddev.c 2011-07-21 22:17:23.000000000 -0400
27509 +++ linux-3.0.8/drivers/hid/usbhid/hiddev.c 2011-08-23 21:47:55.000000000 -0400
27510 @@ -624,7 +624,7 @@ static long hiddev_ioctl(struct file *fi
27511 break;
27512
27513 case HIDIOCAPPLICATION:
27514 - if (arg < 0 || arg >= hid->maxapplication)
27515 + if (arg >= hid->maxapplication)
27516 break;
27517
27518 for (i = 0; i < hid->maxcollection; i++)
27519 diff -urNp linux-3.0.8/drivers/hwmon/acpi_power_meter.c linux-3.0.8/drivers/hwmon/acpi_power_meter.c
27520 --- linux-3.0.8/drivers/hwmon/acpi_power_meter.c 2011-07-21 22:17:23.000000000 -0400
27521 +++ linux-3.0.8/drivers/hwmon/acpi_power_meter.c 2011-08-23 21:47:55.000000000 -0400
27522 @@ -316,8 +316,6 @@ static ssize_t set_trip(struct device *d
27523 return res;
27524
27525 temp /= 1000;
27526 - if (temp < 0)
27527 - return -EINVAL;
27528
27529 mutex_lock(&resource->lock);
27530 resource->trip[attr->index - 7] = temp;
27531 diff -urNp linux-3.0.8/drivers/hwmon/sht15.c linux-3.0.8/drivers/hwmon/sht15.c
27532 --- linux-3.0.8/drivers/hwmon/sht15.c 2011-07-21 22:17:23.000000000 -0400
27533 +++ linux-3.0.8/drivers/hwmon/sht15.c 2011-08-23 21:47:55.000000000 -0400
27534 @@ -166,7 +166,7 @@ struct sht15_data {
27535 int supply_uV;
27536 bool supply_uV_valid;
27537 struct work_struct update_supply_work;
27538 - atomic_t interrupt_handled;
27539 + atomic_unchecked_t interrupt_handled;
27540 };
27541
27542 /**
27543 @@ -509,13 +509,13 @@ static int sht15_measurement(struct sht1
27544 return ret;
27545
27546 gpio_direction_input(data->pdata->gpio_data);
27547 - atomic_set(&data->interrupt_handled, 0);
27548 + atomic_set_unchecked(&data->interrupt_handled, 0);
27549
27550 enable_irq(gpio_to_irq(data->pdata->gpio_data));
27551 if (gpio_get_value(data->pdata->gpio_data) == 0) {
27552 disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
27553 /* Only relevant if the interrupt hasn't occurred. */
27554 - if (!atomic_read(&data->interrupt_handled))
27555 + if (!atomic_read_unchecked(&data->interrupt_handled))
27556 schedule_work(&data->read_work);
27557 }
27558 ret = wait_event_timeout(data->wait_queue,
27559 @@ -782,7 +782,7 @@ static irqreturn_t sht15_interrupt_fired
27560
27561 /* First disable the interrupt */
27562 disable_irq_nosync(irq);
27563 - atomic_inc(&data->interrupt_handled);
27564 + atomic_inc_unchecked(&data->interrupt_handled);
27565 /* Then schedule a reading work struct */
27566 if (data->state != SHT15_READING_NOTHING)
27567 schedule_work(&data->read_work);
27568 @@ -804,11 +804,11 @@ static void sht15_bh_read_data(struct wo
27569 * If not, then start the interrupt again - care here as could
27570 * have gone low in meantime so verify it hasn't!
27571 */
27572 - atomic_set(&data->interrupt_handled, 0);
27573 + atomic_set_unchecked(&data->interrupt_handled, 0);
27574 enable_irq(gpio_to_irq(data->pdata->gpio_data));
27575 /* If still not occurred or another handler has been scheduled */
27576 if (gpio_get_value(data->pdata->gpio_data)
27577 - || atomic_read(&data->interrupt_handled))
27578 + || atomic_read_unchecked(&data->interrupt_handled))
27579 return;
27580 }
27581
27582 diff -urNp linux-3.0.8/drivers/hwmon/w83791d.c linux-3.0.8/drivers/hwmon/w83791d.c
27583 --- linux-3.0.8/drivers/hwmon/w83791d.c 2011-07-21 22:17:23.000000000 -0400
27584 +++ linux-3.0.8/drivers/hwmon/w83791d.c 2011-08-23 21:47:55.000000000 -0400
27585 @@ -329,8 +329,8 @@ static int w83791d_detect(struct i2c_cli
27586 struct i2c_board_info *info);
27587 static int w83791d_remove(struct i2c_client *client);
27588
27589 -static int w83791d_read(struct i2c_client *client, u8 register);
27590 -static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
27591 +static int w83791d_read(struct i2c_client *client, u8 reg);
27592 +static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
27593 static struct w83791d_data *w83791d_update_device(struct device *dev);
27594
27595 #ifdef DEBUG
27596 diff -urNp linux-3.0.8/drivers/i2c/busses/i2c-amd756-s4882.c linux-3.0.8/drivers/i2c/busses/i2c-amd756-s4882.c
27597 --- linux-3.0.8/drivers/i2c/busses/i2c-amd756-s4882.c 2011-07-21 22:17:23.000000000 -0400
27598 +++ linux-3.0.8/drivers/i2c/busses/i2c-amd756-s4882.c 2011-08-23 21:47:55.000000000 -0400
27599 @@ -43,7 +43,7 @@
27600 extern struct i2c_adapter amd756_smbus;
27601
27602 static struct i2c_adapter *s4882_adapter;
27603 -static struct i2c_algorithm *s4882_algo;
27604 +static i2c_algorithm_no_const *s4882_algo;
27605
27606 /* Wrapper access functions for multiplexed SMBus */
27607 static DEFINE_MUTEX(amd756_lock);
27608 diff -urNp linux-3.0.8/drivers/i2c/busses/i2c-nforce2-s4985.c linux-3.0.8/drivers/i2c/busses/i2c-nforce2-s4985.c
27609 --- linux-3.0.8/drivers/i2c/busses/i2c-nforce2-s4985.c 2011-07-21 22:17:23.000000000 -0400
27610 +++ linux-3.0.8/drivers/i2c/busses/i2c-nforce2-s4985.c 2011-08-23 21:47:55.000000000 -0400
27611 @@ -41,7 +41,7 @@
27612 extern struct i2c_adapter *nforce2_smbus;
27613
27614 static struct i2c_adapter *s4985_adapter;
27615 -static struct i2c_algorithm *s4985_algo;
27616 +static i2c_algorithm_no_const *s4985_algo;
27617
27618 /* Wrapper access functions for multiplexed SMBus */
27619 static DEFINE_MUTEX(nforce2_lock);
27620 diff -urNp linux-3.0.8/drivers/i2c/i2c-mux.c linux-3.0.8/drivers/i2c/i2c-mux.c
27621 --- linux-3.0.8/drivers/i2c/i2c-mux.c 2011-07-21 22:17:23.000000000 -0400
27622 +++ linux-3.0.8/drivers/i2c/i2c-mux.c 2011-08-23 21:47:55.000000000 -0400
27623 @@ -28,7 +28,7 @@
27624 /* multiplexer per channel data */
27625 struct i2c_mux_priv {
27626 struct i2c_adapter adap;
27627 - struct i2c_algorithm algo;
27628 + i2c_algorithm_no_const algo;
27629
27630 struct i2c_adapter *parent;
27631 void *mux_dev; /* the mux chip/device */
27632 diff -urNp linux-3.0.8/drivers/ide/aec62xx.c linux-3.0.8/drivers/ide/aec62xx.c
27633 --- linux-3.0.8/drivers/ide/aec62xx.c 2011-07-21 22:17:23.000000000 -0400
27634 +++ linux-3.0.8/drivers/ide/aec62xx.c 2011-10-11 10:44:33.000000000 -0400
27635 @@ -181,7 +181,7 @@ static const struct ide_port_ops atp86x_
27636 .cable_detect = atp86x_cable_detect,
27637 };
27638
27639 -static const struct ide_port_info aec62xx_chipsets[] __devinitdata = {
27640 +static const struct ide_port_info aec62xx_chipsets[] __devinitconst = {
27641 { /* 0: AEC6210 */
27642 .name = DRV_NAME,
27643 .init_chipset = init_chipset_aec62xx,
27644 diff -urNp linux-3.0.8/drivers/ide/alim15x3.c linux-3.0.8/drivers/ide/alim15x3.c
27645 --- linux-3.0.8/drivers/ide/alim15x3.c 2011-07-21 22:17:23.000000000 -0400
27646 +++ linux-3.0.8/drivers/ide/alim15x3.c 2011-10-11 10:44:33.000000000 -0400
27647 @@ -512,7 +512,7 @@ static const struct ide_dma_ops ali_dma_
27648 .dma_sff_read_status = ide_dma_sff_read_status,
27649 };
27650
27651 -static const struct ide_port_info ali15x3_chipset __devinitdata = {
27652 +static const struct ide_port_info ali15x3_chipset __devinitconst = {
27653 .name = DRV_NAME,
27654 .init_chipset = init_chipset_ali15x3,
27655 .init_hwif = init_hwif_ali15x3,
27656 diff -urNp linux-3.0.8/drivers/ide/amd74xx.c linux-3.0.8/drivers/ide/amd74xx.c
27657 --- linux-3.0.8/drivers/ide/amd74xx.c 2011-07-21 22:17:23.000000000 -0400
27658 +++ linux-3.0.8/drivers/ide/amd74xx.c 2011-10-11 10:44:33.000000000 -0400
27659 @@ -223,7 +223,7 @@ static const struct ide_port_ops amd_por
27660 .udma_mask = udma, \
27661 }
27662
27663 -static const struct ide_port_info amd74xx_chipsets[] __devinitdata = {
27664 +static const struct ide_port_info amd74xx_chipsets[] __devinitconst = {
27665 /* 0: AMD7401 */ DECLARE_AMD_DEV(0x00, ATA_UDMA2),
27666 /* 1: AMD7409 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA4),
27667 /* 2: AMD7411/7441 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA5),
27668 diff -urNp linux-3.0.8/drivers/ide/atiixp.c linux-3.0.8/drivers/ide/atiixp.c
27669 --- linux-3.0.8/drivers/ide/atiixp.c 2011-07-21 22:17:23.000000000 -0400
27670 +++ linux-3.0.8/drivers/ide/atiixp.c 2011-10-11 10:44:33.000000000 -0400
27671 @@ -139,7 +139,7 @@ static const struct ide_port_ops atiixp_
27672 .cable_detect = atiixp_cable_detect,
27673 };
27674
27675 -static const struct ide_port_info atiixp_pci_info[] __devinitdata = {
27676 +static const struct ide_port_info atiixp_pci_info[] __devinitconst = {
27677 { /* 0: IXP200/300/400/700 */
27678 .name = DRV_NAME,
27679 .enablebits = {{0x48,0x01,0x00}, {0x48,0x08,0x00}},
27680 diff -urNp linux-3.0.8/drivers/ide/cmd64x.c linux-3.0.8/drivers/ide/cmd64x.c
27681 --- linux-3.0.8/drivers/ide/cmd64x.c 2011-07-21 22:17:23.000000000 -0400
27682 +++ linux-3.0.8/drivers/ide/cmd64x.c 2011-10-11 10:44:33.000000000 -0400
27683 @@ -327,7 +327,7 @@ static const struct ide_dma_ops cmd646_r
27684 .dma_sff_read_status = ide_dma_sff_read_status,
27685 };
27686
27687 -static const struct ide_port_info cmd64x_chipsets[] __devinitdata = {
27688 +static const struct ide_port_info cmd64x_chipsets[] __devinitconst = {
27689 { /* 0: CMD643 */
27690 .name = DRV_NAME,
27691 .init_chipset = init_chipset_cmd64x,
27692 diff -urNp linux-3.0.8/drivers/ide/cs5520.c linux-3.0.8/drivers/ide/cs5520.c
27693 --- linux-3.0.8/drivers/ide/cs5520.c 2011-07-21 22:17:23.000000000 -0400
27694 +++ linux-3.0.8/drivers/ide/cs5520.c 2011-10-11 10:44:33.000000000 -0400
27695 @@ -94,7 +94,7 @@ static const struct ide_port_ops cs5520_
27696 .set_dma_mode = cs5520_set_dma_mode,
27697 };
27698
27699 -static const struct ide_port_info cyrix_chipset __devinitdata = {
27700 +static const struct ide_port_info cyrix_chipset __devinitconst = {
27701 .name = DRV_NAME,
27702 .enablebits = { { 0x60, 0x01, 0x01 }, { 0x60, 0x02, 0x02 } },
27703 .port_ops = &cs5520_port_ops,
27704 diff -urNp linux-3.0.8/drivers/ide/cs5530.c linux-3.0.8/drivers/ide/cs5530.c
27705 --- linux-3.0.8/drivers/ide/cs5530.c 2011-07-21 22:17:23.000000000 -0400
27706 +++ linux-3.0.8/drivers/ide/cs5530.c 2011-10-11 10:44:33.000000000 -0400
27707 @@ -245,7 +245,7 @@ static const struct ide_port_ops cs5530_
27708 .udma_filter = cs5530_udma_filter,
27709 };
27710
27711 -static const struct ide_port_info cs5530_chipset __devinitdata = {
27712 +static const struct ide_port_info cs5530_chipset __devinitconst = {
27713 .name = DRV_NAME,
27714 .init_chipset = init_chipset_cs5530,
27715 .init_hwif = init_hwif_cs5530,
27716 diff -urNp linux-3.0.8/drivers/ide/cs5535.c linux-3.0.8/drivers/ide/cs5535.c
27717 --- linux-3.0.8/drivers/ide/cs5535.c 2011-07-21 22:17:23.000000000 -0400
27718 +++ linux-3.0.8/drivers/ide/cs5535.c 2011-10-11 10:44:33.000000000 -0400
27719 @@ -170,7 +170,7 @@ static const struct ide_port_ops cs5535_
27720 .cable_detect = cs5535_cable_detect,
27721 };
27722
27723 -static const struct ide_port_info cs5535_chipset __devinitdata = {
27724 +static const struct ide_port_info cs5535_chipset __devinitconst = {
27725 .name = DRV_NAME,
27726 .port_ops = &cs5535_port_ops,
27727 .host_flags = IDE_HFLAG_SINGLE | IDE_HFLAG_POST_SET_MODE,
27728 diff -urNp linux-3.0.8/drivers/ide/cy82c693.c linux-3.0.8/drivers/ide/cy82c693.c
27729 --- linux-3.0.8/drivers/ide/cy82c693.c 2011-07-21 22:17:23.000000000 -0400
27730 +++ linux-3.0.8/drivers/ide/cy82c693.c 2011-10-11 10:44:33.000000000 -0400
27731 @@ -161,7 +161,7 @@ static const struct ide_port_ops cy82c69
27732 .set_dma_mode = cy82c693_set_dma_mode,
27733 };
27734
27735 -static const struct ide_port_info cy82c693_chipset __devinitdata = {
27736 +static const struct ide_port_info cy82c693_chipset __devinitconst = {
27737 .name = DRV_NAME,
27738 .init_iops = init_iops_cy82c693,
27739 .port_ops = &cy82c693_port_ops,
27740 diff -urNp linux-3.0.8/drivers/ide/hpt366.c linux-3.0.8/drivers/ide/hpt366.c
27741 --- linux-3.0.8/drivers/ide/hpt366.c 2011-07-21 22:17:23.000000000 -0400
27742 +++ linux-3.0.8/drivers/ide/hpt366.c 2011-10-11 10:44:33.000000000 -0400
27743 @@ -443,7 +443,7 @@ static struct hpt_timings hpt37x_timings
27744 }
27745 };
27746
27747 -static const struct hpt_info hpt36x __devinitdata = {
27748 +static const struct hpt_info hpt36x __devinitconst = {
27749 .chip_name = "HPT36x",
27750 .chip_type = HPT36x,
27751 .udma_mask = HPT366_ALLOW_ATA66_3 ? (HPT366_ALLOW_ATA66_4 ? ATA_UDMA4 : ATA_UDMA3) : ATA_UDMA2,
27752 @@ -451,7 +451,7 @@ static const struct hpt_info hpt36x __de
27753 .timings = &hpt36x_timings
27754 };
27755
27756 -static const struct hpt_info hpt370 __devinitdata = {
27757 +static const struct hpt_info hpt370 __devinitconst = {
27758 .chip_name = "HPT370",
27759 .chip_type = HPT370,
27760 .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
27761 @@ -459,7 +459,7 @@ static const struct hpt_info hpt370 __de
27762 .timings = &hpt37x_timings
27763 };
27764
27765 -static const struct hpt_info hpt370a __devinitdata = {
27766 +static const struct hpt_info hpt370a __devinitconst = {
27767 .chip_name = "HPT370A",
27768 .chip_type = HPT370A,
27769 .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
27770 @@ -467,7 +467,7 @@ static const struct hpt_info hpt370a __d
27771 .timings = &hpt37x_timings
27772 };
27773
27774 -static const struct hpt_info hpt374 __devinitdata = {
27775 +static const struct hpt_info hpt374 __devinitconst = {
27776 .chip_name = "HPT374",
27777 .chip_type = HPT374,
27778 .udma_mask = ATA_UDMA5,
27779 @@ -475,7 +475,7 @@ static const struct hpt_info hpt374 __de
27780 .timings = &hpt37x_timings
27781 };
27782
27783 -static const struct hpt_info hpt372 __devinitdata = {
27784 +static const struct hpt_info hpt372 __devinitconst = {
27785 .chip_name = "HPT372",
27786 .chip_type = HPT372,
27787 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
27788 @@ -483,7 +483,7 @@ static const struct hpt_info hpt372 __de
27789 .timings = &hpt37x_timings
27790 };
27791
27792 -static const struct hpt_info hpt372a __devinitdata = {
27793 +static const struct hpt_info hpt372a __devinitconst = {
27794 .chip_name = "HPT372A",
27795 .chip_type = HPT372A,
27796 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
27797 @@ -491,7 +491,7 @@ static const struct hpt_info hpt372a __d
27798 .timings = &hpt37x_timings
27799 };
27800
27801 -static const struct hpt_info hpt302 __devinitdata = {
27802 +static const struct hpt_info hpt302 __devinitconst = {
27803 .chip_name = "HPT302",
27804 .chip_type = HPT302,
27805 .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
27806 @@ -499,7 +499,7 @@ static const struct hpt_info hpt302 __de
27807 .timings = &hpt37x_timings
27808 };
27809
27810 -static const struct hpt_info hpt371 __devinitdata = {
27811 +static const struct hpt_info hpt371 __devinitconst = {
27812 .chip_name = "HPT371",
27813 .chip_type = HPT371,
27814 .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
27815 @@ -507,7 +507,7 @@ static const struct hpt_info hpt371 __de
27816 .timings = &hpt37x_timings
27817 };
27818
27819 -static const struct hpt_info hpt372n __devinitdata = {
27820 +static const struct hpt_info hpt372n __devinitconst = {
27821 .chip_name = "HPT372N",
27822 .chip_type = HPT372N,
27823 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
27824 @@ -515,7 +515,7 @@ static const struct hpt_info hpt372n __d
27825 .timings = &hpt37x_timings
27826 };
27827
27828 -static const struct hpt_info hpt302n __devinitdata = {
27829 +static const struct hpt_info hpt302n __devinitconst = {
27830 .chip_name = "HPT302N",
27831 .chip_type = HPT302N,
27832 .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
27833 @@ -523,7 +523,7 @@ static const struct hpt_info hpt302n __d
27834 .timings = &hpt37x_timings
27835 };
27836
27837 -static const struct hpt_info hpt371n __devinitdata = {
27838 +static const struct hpt_info hpt371n __devinitconst = {
27839 .chip_name = "HPT371N",
27840 .chip_type = HPT371N,
27841 .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
27842 @@ -1361,7 +1361,7 @@ static const struct ide_dma_ops hpt36x_d
27843 .dma_sff_read_status = ide_dma_sff_read_status,
27844 };
27845
27846 -static const struct ide_port_info hpt366_chipsets[] __devinitdata = {
27847 +static const struct ide_port_info hpt366_chipsets[] __devinitconst = {
27848 { /* 0: HPT36x */
27849 .name = DRV_NAME,
27850 .init_chipset = init_chipset_hpt366,
27851 diff -urNp linux-3.0.8/drivers/ide/ide-cd.c linux-3.0.8/drivers/ide/ide-cd.c
27852 --- linux-3.0.8/drivers/ide/ide-cd.c 2011-07-21 22:17:23.000000000 -0400
27853 +++ linux-3.0.8/drivers/ide/ide-cd.c 2011-08-23 21:47:55.000000000 -0400
27854 @@ -769,7 +769,7 @@ static void cdrom_do_block_pc(ide_drive_
27855 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
27856 if ((unsigned long)buf & alignment
27857 || blk_rq_bytes(rq) & q->dma_pad_mask
27858 - || object_is_on_stack(buf))
27859 + || object_starts_on_stack(buf))
27860 drive->dma = 0;
27861 }
27862 }
27863 diff -urNp linux-3.0.8/drivers/ide/ide-floppy.c linux-3.0.8/drivers/ide/ide-floppy.c
27864 --- linux-3.0.8/drivers/ide/ide-floppy.c 2011-07-21 22:17:23.000000000 -0400
27865 +++ linux-3.0.8/drivers/ide/ide-floppy.c 2011-08-23 21:48:14.000000000 -0400
27866 @@ -379,6 +379,8 @@ static int ide_floppy_get_capacity(ide_d
27867 u8 pc_buf[256], header_len, desc_cnt;
27868 int i, rc = 1, blocks, length;
27869
27870 + pax_track_stack();
27871 +
27872 ide_debug_log(IDE_DBG_FUNC, "enter");
27873
27874 drive->bios_cyl = 0;
27875 diff -urNp linux-3.0.8/drivers/ide/ide-pci-generic.c linux-3.0.8/drivers/ide/ide-pci-generic.c
27876 --- linux-3.0.8/drivers/ide/ide-pci-generic.c 2011-07-21 22:17:23.000000000 -0400
27877 +++ linux-3.0.8/drivers/ide/ide-pci-generic.c 2011-10-11 10:44:33.000000000 -0400
27878 @@ -53,7 +53,7 @@ static const struct ide_port_ops netcell
27879 .udma_mask = ATA_UDMA6, \
27880 }
27881
27882 -static const struct ide_port_info generic_chipsets[] __devinitdata = {
27883 +static const struct ide_port_info generic_chipsets[] __devinitconst = {
27884 /* 0: Unknown */
27885 DECLARE_GENERIC_PCI_DEV(0),
27886
27887 diff -urNp linux-3.0.8/drivers/ide/it8172.c linux-3.0.8/drivers/ide/it8172.c
27888 --- linux-3.0.8/drivers/ide/it8172.c 2011-07-21 22:17:23.000000000 -0400
27889 +++ linux-3.0.8/drivers/ide/it8172.c 2011-10-11 10:44:33.000000000 -0400
27890 @@ -115,7 +115,7 @@ static const struct ide_port_ops it8172_
27891 .set_dma_mode = it8172_set_dma_mode,
27892 };
27893
27894 -static const struct ide_port_info it8172_port_info __devinitdata = {
27895 +static const struct ide_port_info it8172_port_info __devinitconst = {
27896 .name = DRV_NAME,
27897 .port_ops = &it8172_port_ops,
27898 .enablebits = { {0x41, 0x80, 0x80}, {0x00, 0x00, 0x00} },
27899 diff -urNp linux-3.0.8/drivers/ide/it8213.c linux-3.0.8/drivers/ide/it8213.c
27900 --- linux-3.0.8/drivers/ide/it8213.c 2011-07-21 22:17:23.000000000 -0400
27901 +++ linux-3.0.8/drivers/ide/it8213.c 2011-10-11 10:44:33.000000000 -0400
27902 @@ -156,7 +156,7 @@ static const struct ide_port_ops it8213_
27903 .cable_detect = it8213_cable_detect,
27904 };
27905
27906 -static const struct ide_port_info it8213_chipset __devinitdata = {
27907 +static const struct ide_port_info it8213_chipset __devinitconst = {
27908 .name = DRV_NAME,
27909 .enablebits = { {0x41, 0x80, 0x80} },
27910 .port_ops = &it8213_port_ops,
27911 diff -urNp linux-3.0.8/drivers/ide/it821x.c linux-3.0.8/drivers/ide/it821x.c
27912 --- linux-3.0.8/drivers/ide/it821x.c 2011-07-21 22:17:23.000000000 -0400
27913 +++ linux-3.0.8/drivers/ide/it821x.c 2011-10-11 10:44:33.000000000 -0400
27914 @@ -630,7 +630,7 @@ static const struct ide_port_ops it821x_
27915 .cable_detect = it821x_cable_detect,
27916 };
27917
27918 -static const struct ide_port_info it821x_chipset __devinitdata = {
27919 +static const struct ide_port_info it821x_chipset __devinitconst = {
27920 .name = DRV_NAME,
27921 .init_chipset = init_chipset_it821x,
27922 .init_hwif = init_hwif_it821x,
27923 diff -urNp linux-3.0.8/drivers/ide/jmicron.c linux-3.0.8/drivers/ide/jmicron.c
27924 --- linux-3.0.8/drivers/ide/jmicron.c 2011-07-21 22:17:23.000000000 -0400
27925 +++ linux-3.0.8/drivers/ide/jmicron.c 2011-10-11 10:44:33.000000000 -0400
27926 @@ -102,7 +102,7 @@ static const struct ide_port_ops jmicron
27927 .cable_detect = jmicron_cable_detect,
27928 };
27929
27930 -static const struct ide_port_info jmicron_chipset __devinitdata = {
27931 +static const struct ide_port_info jmicron_chipset __devinitconst = {
27932 .name = DRV_NAME,
27933 .enablebits = { { 0x40, 0x01, 0x01 }, { 0x40, 0x10, 0x10 } },
27934 .port_ops = &jmicron_port_ops,
27935 diff -urNp linux-3.0.8/drivers/ide/ns87415.c linux-3.0.8/drivers/ide/ns87415.c
27936 --- linux-3.0.8/drivers/ide/ns87415.c 2011-07-21 22:17:23.000000000 -0400
27937 +++ linux-3.0.8/drivers/ide/ns87415.c 2011-10-11 10:44:33.000000000 -0400
27938 @@ -293,7 +293,7 @@ static const struct ide_dma_ops ns87415_
27939 .dma_sff_read_status = superio_dma_sff_read_status,
27940 };
27941
27942 -static const struct ide_port_info ns87415_chipset __devinitdata = {
27943 +static const struct ide_port_info ns87415_chipset __devinitconst = {
27944 .name = DRV_NAME,
27945 .init_hwif = init_hwif_ns87415,
27946 .tp_ops = &ns87415_tp_ops,
27947 diff -urNp linux-3.0.8/drivers/ide/opti621.c linux-3.0.8/drivers/ide/opti621.c
27948 --- linux-3.0.8/drivers/ide/opti621.c 2011-07-21 22:17:23.000000000 -0400
27949 +++ linux-3.0.8/drivers/ide/opti621.c 2011-10-11 10:44:33.000000000 -0400
27950 @@ -131,7 +131,7 @@ static const struct ide_port_ops opti621
27951 .set_pio_mode = opti621_set_pio_mode,
27952 };
27953
27954 -static const struct ide_port_info opti621_chipset __devinitdata = {
27955 +static const struct ide_port_info opti621_chipset __devinitconst = {
27956 .name = DRV_NAME,
27957 .enablebits = { {0x45, 0x80, 0x00}, {0x40, 0x08, 0x00} },
27958 .port_ops = &opti621_port_ops,
27959 diff -urNp linux-3.0.8/drivers/ide/pdc202xx_new.c linux-3.0.8/drivers/ide/pdc202xx_new.c
27960 --- linux-3.0.8/drivers/ide/pdc202xx_new.c 2011-07-21 22:17:23.000000000 -0400
27961 +++ linux-3.0.8/drivers/ide/pdc202xx_new.c 2011-10-11 10:44:33.000000000 -0400
27962 @@ -465,7 +465,7 @@ static const struct ide_port_ops pdcnew_
27963 .udma_mask = udma, \
27964 }
27965
27966 -static const struct ide_port_info pdcnew_chipsets[] __devinitdata = {
27967 +static const struct ide_port_info pdcnew_chipsets[] __devinitconst = {
27968 /* 0: PDC202{68,70} */ DECLARE_PDCNEW_DEV(ATA_UDMA5),
27969 /* 1: PDC202{69,71,75,76,77} */ DECLARE_PDCNEW_DEV(ATA_UDMA6),
27970 };
27971 diff -urNp linux-3.0.8/drivers/ide/pdc202xx_old.c linux-3.0.8/drivers/ide/pdc202xx_old.c
27972 --- linux-3.0.8/drivers/ide/pdc202xx_old.c 2011-07-21 22:17:23.000000000 -0400
27973 +++ linux-3.0.8/drivers/ide/pdc202xx_old.c 2011-10-11 10:44:33.000000000 -0400
27974 @@ -270,7 +270,7 @@ static const struct ide_dma_ops pdc2026x
27975 .max_sectors = sectors, \
27976 }
27977
27978 -static const struct ide_port_info pdc202xx_chipsets[] __devinitdata = {
27979 +static const struct ide_port_info pdc202xx_chipsets[] __devinitconst = {
27980 { /* 0: PDC20246 */
27981 .name = DRV_NAME,
27982 .init_chipset = init_chipset_pdc202xx,
27983 diff -urNp linux-3.0.8/drivers/ide/piix.c linux-3.0.8/drivers/ide/piix.c
27984 --- linux-3.0.8/drivers/ide/piix.c 2011-07-21 22:17:23.000000000 -0400
27985 +++ linux-3.0.8/drivers/ide/piix.c 2011-10-11 10:44:33.000000000 -0400
27986 @@ -344,7 +344,7 @@ static const struct ide_port_ops ich_por
27987 .udma_mask = udma, \
27988 }
27989
27990 -static const struct ide_port_info piix_pci_info[] __devinitdata = {
27991 +static const struct ide_port_info piix_pci_info[] __devinitconst = {
27992 /* 0: MPIIX */
27993 { /*
27994 * MPIIX actually has only a single IDE channel mapped to
27995 diff -urNp linux-3.0.8/drivers/ide/rz1000.c linux-3.0.8/drivers/ide/rz1000.c
27996 --- linux-3.0.8/drivers/ide/rz1000.c 2011-07-21 22:17:23.000000000 -0400
27997 +++ linux-3.0.8/drivers/ide/rz1000.c 2011-10-11 10:44:33.000000000 -0400
27998 @@ -38,7 +38,7 @@ static int __devinit rz1000_disable_read
27999 }
28000 }
28001
28002 -static const struct ide_port_info rz1000_chipset __devinitdata = {
28003 +static const struct ide_port_info rz1000_chipset __devinitconst = {
28004 .name = DRV_NAME,
28005 .host_flags = IDE_HFLAG_NO_DMA,
28006 };
28007 diff -urNp linux-3.0.8/drivers/ide/sc1200.c linux-3.0.8/drivers/ide/sc1200.c
28008 --- linux-3.0.8/drivers/ide/sc1200.c 2011-07-21 22:17:23.000000000 -0400
28009 +++ linux-3.0.8/drivers/ide/sc1200.c 2011-10-11 10:44:33.000000000 -0400
28010 @@ -291,7 +291,7 @@ static const struct ide_dma_ops sc1200_d
28011 .dma_sff_read_status = ide_dma_sff_read_status,
28012 };
28013
28014 -static const struct ide_port_info sc1200_chipset __devinitdata = {
28015 +static const struct ide_port_info sc1200_chipset __devinitconst = {
28016 .name = DRV_NAME,
28017 .port_ops = &sc1200_port_ops,
28018 .dma_ops = &sc1200_dma_ops,
28019 diff -urNp linux-3.0.8/drivers/ide/scc_pata.c linux-3.0.8/drivers/ide/scc_pata.c
28020 --- linux-3.0.8/drivers/ide/scc_pata.c 2011-07-21 22:17:23.000000000 -0400
28021 +++ linux-3.0.8/drivers/ide/scc_pata.c 2011-10-11 10:44:33.000000000 -0400
28022 @@ -811,7 +811,7 @@ static const struct ide_dma_ops scc_dma_
28023 .dma_sff_read_status = scc_dma_sff_read_status,
28024 };
28025
28026 -static const struct ide_port_info scc_chipset __devinitdata = {
28027 +static const struct ide_port_info scc_chipset __devinitconst = {
28028 .name = "sccIDE",
28029 .init_iops = init_iops_scc,
28030 .init_dma = scc_init_dma,
28031 diff -urNp linux-3.0.8/drivers/ide/serverworks.c linux-3.0.8/drivers/ide/serverworks.c
28032 --- linux-3.0.8/drivers/ide/serverworks.c 2011-07-21 22:17:23.000000000 -0400
28033 +++ linux-3.0.8/drivers/ide/serverworks.c 2011-10-11 10:44:33.000000000 -0400
28034 @@ -337,7 +337,7 @@ static const struct ide_port_ops svwks_p
28035 .cable_detect = svwks_cable_detect,
28036 };
28037
28038 -static const struct ide_port_info serverworks_chipsets[] __devinitdata = {
28039 +static const struct ide_port_info serverworks_chipsets[] __devinitconst = {
28040 { /* 0: OSB4 */
28041 .name = DRV_NAME,
28042 .init_chipset = init_chipset_svwks,
28043 diff -urNp linux-3.0.8/drivers/ide/setup-pci.c linux-3.0.8/drivers/ide/setup-pci.c
28044 --- linux-3.0.8/drivers/ide/setup-pci.c 2011-07-21 22:17:23.000000000 -0400
28045 +++ linux-3.0.8/drivers/ide/setup-pci.c 2011-08-23 21:48:14.000000000 -0400
28046 @@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev
28047 int ret, i, n_ports = dev2 ? 4 : 2;
28048 struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
28049
28050 + pax_track_stack();
28051 +
28052 for (i = 0; i < n_ports / 2; i++) {
28053 ret = ide_setup_pci_controller(pdev[i], d, !i);
28054 if (ret < 0)
28055 diff -urNp linux-3.0.8/drivers/ide/siimage.c linux-3.0.8/drivers/ide/siimage.c
28056 --- linux-3.0.8/drivers/ide/siimage.c 2011-07-21 22:17:23.000000000 -0400
28057 +++ linux-3.0.8/drivers/ide/siimage.c 2011-10-11 10:44:33.000000000 -0400
28058 @@ -719,7 +719,7 @@ static const struct ide_dma_ops sil_dma_
28059 .udma_mask = ATA_UDMA6, \
28060 }
28061
28062 -static const struct ide_port_info siimage_chipsets[] __devinitdata = {
28063 +static const struct ide_port_info siimage_chipsets[] __devinitconst = {
28064 /* 0: SiI680 */ DECLARE_SII_DEV(&sil_pata_port_ops),
28065 /* 1: SiI3112 */ DECLARE_SII_DEV(&sil_sata_port_ops)
28066 };
28067 diff -urNp linux-3.0.8/drivers/ide/sis5513.c linux-3.0.8/drivers/ide/sis5513.c
28068 --- linux-3.0.8/drivers/ide/sis5513.c 2011-07-21 22:17:23.000000000 -0400
28069 +++ linux-3.0.8/drivers/ide/sis5513.c 2011-10-11 10:44:33.000000000 -0400
28070 @@ -563,7 +563,7 @@ static const struct ide_port_ops sis_ata
28071 .cable_detect = sis_cable_detect,
28072 };
28073
28074 -static const struct ide_port_info sis5513_chipset __devinitdata = {
28075 +static const struct ide_port_info sis5513_chipset __devinitconst = {
28076 .name = DRV_NAME,
28077 .init_chipset = init_chipset_sis5513,
28078 .enablebits = { {0x4a, 0x02, 0x02}, {0x4a, 0x04, 0x04} },
28079 diff -urNp linux-3.0.8/drivers/ide/sl82c105.c linux-3.0.8/drivers/ide/sl82c105.c
28080 --- linux-3.0.8/drivers/ide/sl82c105.c 2011-07-21 22:17:23.000000000 -0400
28081 +++ linux-3.0.8/drivers/ide/sl82c105.c 2011-10-11 10:44:33.000000000 -0400
28082 @@ -299,7 +299,7 @@ static const struct ide_dma_ops sl82c105
28083 .dma_sff_read_status = ide_dma_sff_read_status,
28084 };
28085
28086 -static const struct ide_port_info sl82c105_chipset __devinitdata = {
28087 +static const struct ide_port_info sl82c105_chipset __devinitconst = {
28088 .name = DRV_NAME,
28089 .init_chipset = init_chipset_sl82c105,
28090 .enablebits = {{0x40,0x01,0x01}, {0x40,0x10,0x10}},
28091 diff -urNp linux-3.0.8/drivers/ide/slc90e66.c linux-3.0.8/drivers/ide/slc90e66.c
28092 --- linux-3.0.8/drivers/ide/slc90e66.c 2011-07-21 22:17:23.000000000 -0400
28093 +++ linux-3.0.8/drivers/ide/slc90e66.c 2011-10-11 10:44:33.000000000 -0400
28094 @@ -132,7 +132,7 @@ static const struct ide_port_ops slc90e6
28095 .cable_detect = slc90e66_cable_detect,
28096 };
28097
28098 -static const struct ide_port_info slc90e66_chipset __devinitdata = {
28099 +static const struct ide_port_info slc90e66_chipset __devinitconst = {
28100 .name = DRV_NAME,
28101 .enablebits = { {0x41, 0x80, 0x80}, {0x43, 0x80, 0x80} },
28102 .port_ops = &slc90e66_port_ops,
28103 diff -urNp linux-3.0.8/drivers/ide/tc86c001.c linux-3.0.8/drivers/ide/tc86c001.c
28104 --- linux-3.0.8/drivers/ide/tc86c001.c 2011-07-21 22:17:23.000000000 -0400
28105 +++ linux-3.0.8/drivers/ide/tc86c001.c 2011-10-11 10:44:33.000000000 -0400
28106 @@ -191,7 +191,7 @@ static const struct ide_dma_ops tc86c001
28107 .dma_sff_read_status = ide_dma_sff_read_status,
28108 };
28109
28110 -static const struct ide_port_info tc86c001_chipset __devinitdata = {
28111 +static const struct ide_port_info tc86c001_chipset __devinitconst = {
28112 .name = DRV_NAME,
28113 .init_hwif = init_hwif_tc86c001,
28114 .port_ops = &tc86c001_port_ops,
28115 diff -urNp linux-3.0.8/drivers/ide/triflex.c linux-3.0.8/drivers/ide/triflex.c
28116 --- linux-3.0.8/drivers/ide/triflex.c 2011-07-21 22:17:23.000000000 -0400
28117 +++ linux-3.0.8/drivers/ide/triflex.c 2011-10-11 10:44:33.000000000 -0400
28118 @@ -92,7 +92,7 @@ static const struct ide_port_ops triflex
28119 .set_dma_mode = triflex_set_mode,
28120 };
28121
28122 -static const struct ide_port_info triflex_device __devinitdata = {
28123 +static const struct ide_port_info triflex_device __devinitconst = {
28124 .name = DRV_NAME,
28125 .enablebits = {{0x80, 0x01, 0x01}, {0x80, 0x02, 0x02}},
28126 .port_ops = &triflex_port_ops,
28127 diff -urNp linux-3.0.8/drivers/ide/trm290.c linux-3.0.8/drivers/ide/trm290.c
28128 --- linux-3.0.8/drivers/ide/trm290.c 2011-07-21 22:17:23.000000000 -0400
28129 +++ linux-3.0.8/drivers/ide/trm290.c 2011-10-11 10:44:33.000000000 -0400
28130 @@ -324,7 +324,7 @@ static struct ide_dma_ops trm290_dma_ops
28131 .dma_check = trm290_dma_check,
28132 };
28133
28134 -static const struct ide_port_info trm290_chipset __devinitdata = {
28135 +static const struct ide_port_info trm290_chipset __devinitconst = {
28136 .name = DRV_NAME,
28137 .init_hwif = init_hwif_trm290,
28138 .tp_ops = &trm290_tp_ops,
28139 diff -urNp linux-3.0.8/drivers/ide/via82cxxx.c linux-3.0.8/drivers/ide/via82cxxx.c
28140 --- linux-3.0.8/drivers/ide/via82cxxx.c 2011-07-21 22:17:23.000000000 -0400
28141 +++ linux-3.0.8/drivers/ide/via82cxxx.c 2011-10-11 10:44:33.000000000 -0400
28142 @@ -403,7 +403,7 @@ static const struct ide_port_ops via_por
28143 .cable_detect = via82cxxx_cable_detect,
28144 };
28145
28146 -static const struct ide_port_info via82cxxx_chipset __devinitdata = {
28147 +static const struct ide_port_info via82cxxx_chipset __devinitconst = {
28148 .name = DRV_NAME,
28149 .init_chipset = init_chipset_via82cxxx,
28150 .enablebits = { { 0x40, 0x02, 0x02 }, { 0x40, 0x01, 0x01 } },
28151 diff -urNp linux-3.0.8/drivers/infiniband/core/cm.c linux-3.0.8/drivers/infiniband/core/cm.c
28152 --- linux-3.0.8/drivers/infiniband/core/cm.c 2011-07-21 22:17:23.000000000 -0400
28153 +++ linux-3.0.8/drivers/infiniband/core/cm.c 2011-08-23 21:47:55.000000000 -0400
28154 @@ -113,7 +113,7 @@ static char const counter_group_names[CM
28155
28156 struct cm_counter_group {
28157 struct kobject obj;
28158 - atomic_long_t counter[CM_ATTR_COUNT];
28159 + atomic_long_unchecked_t counter[CM_ATTR_COUNT];
28160 };
28161
28162 struct cm_counter_attribute {
28163 @@ -1387,7 +1387,7 @@ static void cm_dup_req_handler(struct cm
28164 struct ib_mad_send_buf *msg = NULL;
28165 int ret;
28166
28167 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28168 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28169 counter[CM_REQ_COUNTER]);
28170
28171 /* Quick state check to discard duplicate REQs. */
28172 @@ -1765,7 +1765,7 @@ static void cm_dup_rep_handler(struct cm
28173 if (!cm_id_priv)
28174 return;
28175
28176 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28177 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28178 counter[CM_REP_COUNTER]);
28179 ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
28180 if (ret)
28181 @@ -1932,7 +1932,7 @@ static int cm_rtu_handler(struct cm_work
28182 if (cm_id_priv->id.state != IB_CM_REP_SENT &&
28183 cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
28184 spin_unlock_irq(&cm_id_priv->lock);
28185 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28186 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28187 counter[CM_RTU_COUNTER]);
28188 goto out;
28189 }
28190 @@ -2115,7 +2115,7 @@ static int cm_dreq_handler(struct cm_wor
28191 cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
28192 dreq_msg->local_comm_id);
28193 if (!cm_id_priv) {
28194 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28195 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28196 counter[CM_DREQ_COUNTER]);
28197 cm_issue_drep(work->port, work->mad_recv_wc);
28198 return -EINVAL;
28199 @@ -2140,7 +2140,7 @@ static int cm_dreq_handler(struct cm_wor
28200 case IB_CM_MRA_REP_RCVD:
28201 break;
28202 case IB_CM_TIMEWAIT:
28203 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28204 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28205 counter[CM_DREQ_COUNTER]);
28206 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
28207 goto unlock;
28208 @@ -2154,7 +2154,7 @@ static int cm_dreq_handler(struct cm_wor
28209 cm_free_msg(msg);
28210 goto deref;
28211 case IB_CM_DREQ_RCVD:
28212 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28213 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28214 counter[CM_DREQ_COUNTER]);
28215 goto unlock;
28216 default:
28217 @@ -2521,7 +2521,7 @@ static int cm_mra_handler(struct cm_work
28218 ib_modify_mad(cm_id_priv->av.port->mad_agent,
28219 cm_id_priv->msg, timeout)) {
28220 if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
28221 - atomic_long_inc(&work->port->
28222 + atomic_long_inc_unchecked(&work->port->
28223 counter_group[CM_RECV_DUPLICATES].
28224 counter[CM_MRA_COUNTER]);
28225 goto out;
28226 @@ -2530,7 +2530,7 @@ static int cm_mra_handler(struct cm_work
28227 break;
28228 case IB_CM_MRA_REQ_RCVD:
28229 case IB_CM_MRA_REP_RCVD:
28230 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28231 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28232 counter[CM_MRA_COUNTER]);
28233 /* fall through */
28234 default:
28235 @@ -2692,7 +2692,7 @@ static int cm_lap_handler(struct cm_work
28236 case IB_CM_LAP_IDLE:
28237 break;
28238 case IB_CM_MRA_LAP_SENT:
28239 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28240 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28241 counter[CM_LAP_COUNTER]);
28242 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
28243 goto unlock;
28244 @@ -2708,7 +2708,7 @@ static int cm_lap_handler(struct cm_work
28245 cm_free_msg(msg);
28246 goto deref;
28247 case IB_CM_LAP_RCVD:
28248 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28249 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28250 counter[CM_LAP_COUNTER]);
28251 goto unlock;
28252 default:
28253 @@ -2992,7 +2992,7 @@ static int cm_sidr_req_handler(struct cm
28254 cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
28255 if (cur_cm_id_priv) {
28256 spin_unlock_irq(&cm.lock);
28257 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28258 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28259 counter[CM_SIDR_REQ_COUNTER]);
28260 goto out; /* Duplicate message. */
28261 }
28262 @@ -3204,10 +3204,10 @@ static void cm_send_handler(struct ib_ma
28263 if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
28264 msg->retries = 1;
28265
28266 - atomic_long_add(1 + msg->retries,
28267 + atomic_long_add_unchecked(1 + msg->retries,
28268 &port->counter_group[CM_XMIT].counter[attr_index]);
28269 if (msg->retries)
28270 - atomic_long_add(msg->retries,
28271 + atomic_long_add_unchecked(msg->retries,
28272 &port->counter_group[CM_XMIT_RETRIES].
28273 counter[attr_index]);
28274
28275 @@ -3417,7 +3417,7 @@ static void cm_recv_handler(struct ib_ma
28276 }
28277
28278 attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
28279 - atomic_long_inc(&port->counter_group[CM_RECV].
28280 + atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
28281 counter[attr_id - CM_ATTR_ID_OFFSET]);
28282
28283 work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
28284 @@ -3615,7 +3615,7 @@ static ssize_t cm_show_counter(struct ko
28285 cm_attr = container_of(attr, struct cm_counter_attribute, attr);
28286
28287 return sprintf(buf, "%ld\n",
28288 - atomic_long_read(&group->counter[cm_attr->index]));
28289 + atomic_long_read_unchecked(&group->counter[cm_attr->index]));
28290 }
28291
28292 static const struct sysfs_ops cm_counter_ops = {
28293 diff -urNp linux-3.0.8/drivers/infiniband/core/fmr_pool.c linux-3.0.8/drivers/infiniband/core/fmr_pool.c
28294 --- linux-3.0.8/drivers/infiniband/core/fmr_pool.c 2011-07-21 22:17:23.000000000 -0400
28295 +++ linux-3.0.8/drivers/infiniband/core/fmr_pool.c 2011-08-23 21:47:55.000000000 -0400
28296 @@ -97,8 +97,8 @@ struct ib_fmr_pool {
28297
28298 struct task_struct *thread;
28299
28300 - atomic_t req_ser;
28301 - atomic_t flush_ser;
28302 + atomic_unchecked_t req_ser;
28303 + atomic_unchecked_t flush_ser;
28304
28305 wait_queue_head_t force_wait;
28306 };
28307 @@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *p
28308 struct ib_fmr_pool *pool = pool_ptr;
28309
28310 do {
28311 - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
28312 + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
28313 ib_fmr_batch_release(pool);
28314
28315 - atomic_inc(&pool->flush_ser);
28316 + atomic_inc_unchecked(&pool->flush_ser);
28317 wake_up_interruptible(&pool->force_wait);
28318
28319 if (pool->flush_function)
28320 @@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *p
28321 }
28322
28323 set_current_state(TASK_INTERRUPTIBLE);
28324 - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
28325 + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
28326 !kthread_should_stop())
28327 schedule();
28328 __set_current_state(TASK_RUNNING);
28329 @@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(s
28330 pool->dirty_watermark = params->dirty_watermark;
28331 pool->dirty_len = 0;
28332 spin_lock_init(&pool->pool_lock);
28333 - atomic_set(&pool->req_ser, 0);
28334 - atomic_set(&pool->flush_ser, 0);
28335 + atomic_set_unchecked(&pool->req_ser, 0);
28336 + atomic_set_unchecked(&pool->flush_ser, 0);
28337 init_waitqueue_head(&pool->force_wait);
28338
28339 pool->thread = kthread_run(ib_fmr_cleanup_thread,
28340 @@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool
28341 }
28342 spin_unlock_irq(&pool->pool_lock);
28343
28344 - serial = atomic_inc_return(&pool->req_ser);
28345 + serial = atomic_inc_return_unchecked(&pool->req_ser);
28346 wake_up_process(pool->thread);
28347
28348 if (wait_event_interruptible(pool->force_wait,
28349 - atomic_read(&pool->flush_ser) - serial >= 0))
28350 + atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
28351 return -EINTR;
28352
28353 return 0;
28354 @@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr
28355 } else {
28356 list_add_tail(&fmr->list, &pool->dirty_list);
28357 if (++pool->dirty_len >= pool->dirty_watermark) {
28358 - atomic_inc(&pool->req_ser);
28359 + atomic_inc_unchecked(&pool->req_ser);
28360 wake_up_process(pool->thread);
28361 }
28362 }
28363 diff -urNp linux-3.0.8/drivers/infiniband/hw/cxgb4/mem.c linux-3.0.8/drivers/infiniband/hw/cxgb4/mem.c
28364 --- linux-3.0.8/drivers/infiniband/hw/cxgb4/mem.c 2011-07-21 22:17:23.000000000 -0400
28365 +++ linux-3.0.8/drivers/infiniband/hw/cxgb4/mem.c 2011-08-23 21:47:55.000000000 -0400
28366 @@ -122,7 +122,7 @@ static int write_tpt_entry(struct c4iw_r
28367 int err;
28368 struct fw_ri_tpte tpt;
28369 u32 stag_idx;
28370 - static atomic_t key;
28371 + static atomic_unchecked_t key;
28372
28373 if (c4iw_fatal_error(rdev))
28374 return -EIO;
28375 @@ -135,7 +135,7 @@ static int write_tpt_entry(struct c4iw_r
28376 &rdev->resource.tpt_fifo_lock);
28377 if (!stag_idx)
28378 return -ENOMEM;
28379 - *stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff);
28380 + *stag = (stag_idx << 8) | (atomic_inc_return_unchecked(&key) & 0xff);
28381 }
28382 PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
28383 __func__, stag_state, type, pdid, stag_idx);
28384 diff -urNp linux-3.0.8/drivers/infiniband/hw/ipath/ipath_fs.c linux-3.0.8/drivers/infiniband/hw/ipath/ipath_fs.c
28385 --- linux-3.0.8/drivers/infiniband/hw/ipath/ipath_fs.c 2011-07-21 22:17:23.000000000 -0400
28386 +++ linux-3.0.8/drivers/infiniband/hw/ipath/ipath_fs.c 2011-08-23 21:48:14.000000000 -0400
28387 @@ -113,6 +113,8 @@ static ssize_t atomic_counters_read(stru
28388 struct infinipath_counters counters;
28389 struct ipath_devdata *dd;
28390
28391 + pax_track_stack();
28392 +
28393 dd = file->f_path.dentry->d_inode->i_private;
28394 dd->ipath_f_read_counters(dd, &counters);
28395
28396 diff -urNp linux-3.0.8/drivers/infiniband/hw/ipath/ipath_rc.c linux-3.0.8/drivers/infiniband/hw/ipath/ipath_rc.c
28397 --- linux-3.0.8/drivers/infiniband/hw/ipath/ipath_rc.c 2011-07-21 22:17:23.000000000 -0400
28398 +++ linux-3.0.8/drivers/infiniband/hw/ipath/ipath_rc.c 2011-08-23 21:47:55.000000000 -0400
28399 @@ -1868,7 +1868,7 @@ void ipath_rc_rcv(struct ipath_ibdev *de
28400 struct ib_atomic_eth *ateth;
28401 struct ipath_ack_entry *e;
28402 u64 vaddr;
28403 - atomic64_t *maddr;
28404 + atomic64_unchecked_t *maddr;
28405 u64 sdata;
28406 u32 rkey;
28407 u8 next;
28408 @@ -1903,11 +1903,11 @@ void ipath_rc_rcv(struct ipath_ibdev *de
28409 IB_ACCESS_REMOTE_ATOMIC)))
28410 goto nack_acc_unlck;
28411 /* Perform atomic OP and save result. */
28412 - maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
28413 + maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
28414 sdata = be64_to_cpu(ateth->swap_data);
28415 e = &qp->s_ack_queue[qp->r_head_ack_queue];
28416 e->atomic_data = (opcode == OP(FETCH_ADD)) ?
28417 - (u64) atomic64_add_return(sdata, maddr) - sdata :
28418 + (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
28419 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
28420 be64_to_cpu(ateth->compare_data),
28421 sdata);
28422 diff -urNp linux-3.0.8/drivers/infiniband/hw/ipath/ipath_ruc.c linux-3.0.8/drivers/infiniband/hw/ipath/ipath_ruc.c
28423 --- linux-3.0.8/drivers/infiniband/hw/ipath/ipath_ruc.c 2011-07-21 22:17:23.000000000 -0400
28424 +++ linux-3.0.8/drivers/infiniband/hw/ipath/ipath_ruc.c 2011-08-23 21:47:55.000000000 -0400
28425 @@ -266,7 +266,7 @@ static void ipath_ruc_loopback(struct ip
28426 unsigned long flags;
28427 struct ib_wc wc;
28428 u64 sdata;
28429 - atomic64_t *maddr;
28430 + atomic64_unchecked_t *maddr;
28431 enum ib_wc_status send_status;
28432
28433 /*
28434 @@ -382,11 +382,11 @@ again:
28435 IB_ACCESS_REMOTE_ATOMIC)))
28436 goto acc_err;
28437 /* Perform atomic OP and save result. */
28438 - maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
28439 + maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
28440 sdata = wqe->wr.wr.atomic.compare_add;
28441 *(u64 *) sqp->s_sge.sge.vaddr =
28442 (wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD) ?
28443 - (u64) atomic64_add_return(sdata, maddr) - sdata :
28444 + (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
28445 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
28446 sdata, wqe->wr.wr.atomic.swap);
28447 goto send_comp;
28448 diff -urNp linux-3.0.8/drivers/infiniband/hw/nes/nes.c linux-3.0.8/drivers/infiniband/hw/nes/nes.c
28449 --- linux-3.0.8/drivers/infiniband/hw/nes/nes.c 2011-07-21 22:17:23.000000000 -0400
28450 +++ linux-3.0.8/drivers/infiniband/hw/nes/nes.c 2011-08-23 21:47:55.000000000 -0400
28451 @@ -103,7 +103,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limi
28452 LIST_HEAD(nes_adapter_list);
28453 static LIST_HEAD(nes_dev_list);
28454
28455 -atomic_t qps_destroyed;
28456 +atomic_unchecked_t qps_destroyed;
28457
28458 static unsigned int ee_flsh_adapter;
28459 static unsigned int sysfs_nonidx_addr;
28460 @@ -275,7 +275,7 @@ static void nes_cqp_rem_ref_callback(str
28461 struct nes_qp *nesqp = cqp_request->cqp_callback_pointer;
28462 struct nes_adapter *nesadapter = nesdev->nesadapter;
28463
28464 - atomic_inc(&qps_destroyed);
28465 + atomic_inc_unchecked(&qps_destroyed);
28466
28467 /* Free the control structures */
28468
28469 diff -urNp linux-3.0.8/drivers/infiniband/hw/nes/nes_cm.c linux-3.0.8/drivers/infiniband/hw/nes/nes_cm.c
28470 --- linux-3.0.8/drivers/infiniband/hw/nes/nes_cm.c 2011-07-21 22:17:23.000000000 -0400
28471 +++ linux-3.0.8/drivers/infiniband/hw/nes/nes_cm.c 2011-08-23 21:47:55.000000000 -0400
28472 @@ -68,14 +68,14 @@ u32 cm_packets_dropped;
28473 u32 cm_packets_retrans;
28474 u32 cm_packets_created;
28475 u32 cm_packets_received;
28476 -atomic_t cm_listens_created;
28477 -atomic_t cm_listens_destroyed;
28478 +atomic_unchecked_t cm_listens_created;
28479 +atomic_unchecked_t cm_listens_destroyed;
28480 u32 cm_backlog_drops;
28481 -atomic_t cm_loopbacks;
28482 -atomic_t cm_nodes_created;
28483 -atomic_t cm_nodes_destroyed;
28484 -atomic_t cm_accel_dropped_pkts;
28485 -atomic_t cm_resets_recvd;
28486 +atomic_unchecked_t cm_loopbacks;
28487 +atomic_unchecked_t cm_nodes_created;
28488 +atomic_unchecked_t cm_nodes_destroyed;
28489 +atomic_unchecked_t cm_accel_dropped_pkts;
28490 +atomic_unchecked_t cm_resets_recvd;
28491
28492 static inline int mini_cm_accelerated(struct nes_cm_core *,
28493 struct nes_cm_node *);
28494 @@ -151,13 +151,13 @@ static struct nes_cm_ops nes_cm_api = {
28495
28496 static struct nes_cm_core *g_cm_core;
28497
28498 -atomic_t cm_connects;
28499 -atomic_t cm_accepts;
28500 -atomic_t cm_disconnects;
28501 -atomic_t cm_closes;
28502 -atomic_t cm_connecteds;
28503 -atomic_t cm_connect_reqs;
28504 -atomic_t cm_rejects;
28505 +atomic_unchecked_t cm_connects;
28506 +atomic_unchecked_t cm_accepts;
28507 +atomic_unchecked_t cm_disconnects;
28508 +atomic_unchecked_t cm_closes;
28509 +atomic_unchecked_t cm_connecteds;
28510 +atomic_unchecked_t cm_connect_reqs;
28511 +atomic_unchecked_t cm_rejects;
28512
28513
28514 /**
28515 @@ -1045,7 +1045,7 @@ static int mini_cm_dec_refcnt_listen(str
28516 kfree(listener);
28517 listener = NULL;
28518 ret = 0;
28519 - atomic_inc(&cm_listens_destroyed);
28520 + atomic_inc_unchecked(&cm_listens_destroyed);
28521 } else {
28522 spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
28523 }
28524 @@ -1240,7 +1240,7 @@ static struct nes_cm_node *make_cm_node(
28525 cm_node->rem_mac);
28526
28527 add_hte_node(cm_core, cm_node);
28528 - atomic_inc(&cm_nodes_created);
28529 + atomic_inc_unchecked(&cm_nodes_created);
28530
28531 return cm_node;
28532 }
28533 @@ -1298,7 +1298,7 @@ static int rem_ref_cm_node(struct nes_cm
28534 }
28535
28536 atomic_dec(&cm_core->node_cnt);
28537 - atomic_inc(&cm_nodes_destroyed);
28538 + atomic_inc_unchecked(&cm_nodes_destroyed);
28539 nesqp = cm_node->nesqp;
28540 if (nesqp) {
28541 nesqp->cm_node = NULL;
28542 @@ -1365,7 +1365,7 @@ static int process_options(struct nes_cm
28543
28544 static void drop_packet(struct sk_buff *skb)
28545 {
28546 - atomic_inc(&cm_accel_dropped_pkts);
28547 + atomic_inc_unchecked(&cm_accel_dropped_pkts);
28548 dev_kfree_skb_any(skb);
28549 }
28550
28551 @@ -1428,7 +1428,7 @@ static void handle_rst_pkt(struct nes_cm
28552 {
28553
28554 int reset = 0; /* whether to send reset in case of err.. */
28555 - atomic_inc(&cm_resets_recvd);
28556 + atomic_inc_unchecked(&cm_resets_recvd);
28557 nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
28558 " refcnt=%d\n", cm_node, cm_node->state,
28559 atomic_read(&cm_node->ref_count));
28560 @@ -2057,7 +2057,7 @@ static struct nes_cm_node *mini_cm_conne
28561 rem_ref_cm_node(cm_node->cm_core, cm_node);
28562 return NULL;
28563 }
28564 - atomic_inc(&cm_loopbacks);
28565 + atomic_inc_unchecked(&cm_loopbacks);
28566 loopbackremotenode->loopbackpartner = cm_node;
28567 loopbackremotenode->tcp_cntxt.rcv_wscale =
28568 NES_CM_DEFAULT_RCV_WND_SCALE;
28569 @@ -2332,7 +2332,7 @@ static int mini_cm_recv_pkt(struct nes_c
28570 add_ref_cm_node(cm_node);
28571 } else if (cm_node->state == NES_CM_STATE_TSA) {
28572 rem_ref_cm_node(cm_core, cm_node);
28573 - atomic_inc(&cm_accel_dropped_pkts);
28574 + atomic_inc_unchecked(&cm_accel_dropped_pkts);
28575 dev_kfree_skb_any(skb);
28576 break;
28577 }
28578 @@ -2638,7 +2638,7 @@ static int nes_cm_disconn_true(struct ne
28579
28580 if ((cm_id) && (cm_id->event_handler)) {
28581 if (issue_disconn) {
28582 - atomic_inc(&cm_disconnects);
28583 + atomic_inc_unchecked(&cm_disconnects);
28584 cm_event.event = IW_CM_EVENT_DISCONNECT;
28585 cm_event.status = disconn_status;
28586 cm_event.local_addr = cm_id->local_addr;
28587 @@ -2660,7 +2660,7 @@ static int nes_cm_disconn_true(struct ne
28588 }
28589
28590 if (issue_close) {
28591 - atomic_inc(&cm_closes);
28592 + atomic_inc_unchecked(&cm_closes);
28593 nes_disconnect(nesqp, 1);
28594
28595 cm_id->provider_data = nesqp;
28596 @@ -2791,7 +2791,7 @@ int nes_accept(struct iw_cm_id *cm_id, s
28597
28598 nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
28599 nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
28600 - atomic_inc(&cm_accepts);
28601 + atomic_inc_unchecked(&cm_accepts);
28602
28603 nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
28604 netdev_refcnt_read(nesvnic->netdev));
28605 @@ -3001,7 +3001,7 @@ int nes_reject(struct iw_cm_id *cm_id, c
28606
28607 struct nes_cm_core *cm_core;
28608
28609 - atomic_inc(&cm_rejects);
28610 + atomic_inc_unchecked(&cm_rejects);
28611 cm_node = (struct nes_cm_node *) cm_id->provider_data;
28612 loopback = cm_node->loopbackpartner;
28613 cm_core = cm_node->cm_core;
28614 @@ -3067,7 +3067,7 @@ int nes_connect(struct iw_cm_id *cm_id,
28615 ntohl(cm_id->local_addr.sin_addr.s_addr),
28616 ntohs(cm_id->local_addr.sin_port));
28617
28618 - atomic_inc(&cm_connects);
28619 + atomic_inc_unchecked(&cm_connects);
28620 nesqp->active_conn = 1;
28621
28622 /* cache the cm_id in the qp */
28623 @@ -3173,7 +3173,7 @@ int nes_create_listen(struct iw_cm_id *c
28624 g_cm_core->api->stop_listener(g_cm_core, (void *)cm_node);
28625 return err;
28626 }
28627 - atomic_inc(&cm_listens_created);
28628 + atomic_inc_unchecked(&cm_listens_created);
28629 }
28630
28631 cm_id->add_ref(cm_id);
28632 @@ -3278,7 +3278,7 @@ static void cm_event_connected(struct ne
28633 if (nesqp->destroyed) {
28634 return;
28635 }
28636 - atomic_inc(&cm_connecteds);
28637 + atomic_inc_unchecked(&cm_connecteds);
28638 nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
28639 " local port 0x%04X. jiffies = %lu.\n",
28640 nesqp->hwqp.qp_id,
28641 @@ -3493,7 +3493,7 @@ static void cm_event_reset(struct nes_cm
28642
28643 cm_id->add_ref(cm_id);
28644 ret = cm_id->event_handler(cm_id, &cm_event);
28645 - atomic_inc(&cm_closes);
28646 + atomic_inc_unchecked(&cm_closes);
28647 cm_event.event = IW_CM_EVENT_CLOSE;
28648 cm_event.status = 0;
28649 cm_event.provider_data = cm_id->provider_data;
28650 @@ -3529,7 +3529,7 @@ static void cm_event_mpa_req(struct nes_
28651 return;
28652 cm_id = cm_node->cm_id;
28653
28654 - atomic_inc(&cm_connect_reqs);
28655 + atomic_inc_unchecked(&cm_connect_reqs);
28656 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
28657 cm_node, cm_id, jiffies);
28658
28659 @@ -3567,7 +3567,7 @@ static void cm_event_mpa_reject(struct n
28660 return;
28661 cm_id = cm_node->cm_id;
28662
28663 - atomic_inc(&cm_connect_reqs);
28664 + atomic_inc_unchecked(&cm_connect_reqs);
28665 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
28666 cm_node, cm_id, jiffies);
28667
28668 diff -urNp linux-3.0.8/drivers/infiniband/hw/nes/nes.h linux-3.0.8/drivers/infiniband/hw/nes/nes.h
28669 --- linux-3.0.8/drivers/infiniband/hw/nes/nes.h 2011-07-21 22:17:23.000000000 -0400
28670 +++ linux-3.0.8/drivers/infiniband/hw/nes/nes.h 2011-08-23 21:47:55.000000000 -0400
28671 @@ -175,17 +175,17 @@ extern unsigned int nes_debug_level;
28672 extern unsigned int wqm_quanta;
28673 extern struct list_head nes_adapter_list;
28674
28675 -extern atomic_t cm_connects;
28676 -extern atomic_t cm_accepts;
28677 -extern atomic_t cm_disconnects;
28678 -extern atomic_t cm_closes;
28679 -extern atomic_t cm_connecteds;
28680 -extern atomic_t cm_connect_reqs;
28681 -extern atomic_t cm_rejects;
28682 -extern atomic_t mod_qp_timouts;
28683 -extern atomic_t qps_created;
28684 -extern atomic_t qps_destroyed;
28685 -extern atomic_t sw_qps_destroyed;
28686 +extern atomic_unchecked_t cm_connects;
28687 +extern atomic_unchecked_t cm_accepts;
28688 +extern atomic_unchecked_t cm_disconnects;
28689 +extern atomic_unchecked_t cm_closes;
28690 +extern atomic_unchecked_t cm_connecteds;
28691 +extern atomic_unchecked_t cm_connect_reqs;
28692 +extern atomic_unchecked_t cm_rejects;
28693 +extern atomic_unchecked_t mod_qp_timouts;
28694 +extern atomic_unchecked_t qps_created;
28695 +extern atomic_unchecked_t qps_destroyed;
28696 +extern atomic_unchecked_t sw_qps_destroyed;
28697 extern u32 mh_detected;
28698 extern u32 mh_pauses_sent;
28699 extern u32 cm_packets_sent;
28700 @@ -194,14 +194,14 @@ extern u32 cm_packets_created;
28701 extern u32 cm_packets_received;
28702 extern u32 cm_packets_dropped;
28703 extern u32 cm_packets_retrans;
28704 -extern atomic_t cm_listens_created;
28705 -extern atomic_t cm_listens_destroyed;
28706 +extern atomic_unchecked_t cm_listens_created;
28707 +extern atomic_unchecked_t cm_listens_destroyed;
28708 extern u32 cm_backlog_drops;
28709 -extern atomic_t cm_loopbacks;
28710 -extern atomic_t cm_nodes_created;
28711 -extern atomic_t cm_nodes_destroyed;
28712 -extern atomic_t cm_accel_dropped_pkts;
28713 -extern atomic_t cm_resets_recvd;
28714 +extern atomic_unchecked_t cm_loopbacks;
28715 +extern atomic_unchecked_t cm_nodes_created;
28716 +extern atomic_unchecked_t cm_nodes_destroyed;
28717 +extern atomic_unchecked_t cm_accel_dropped_pkts;
28718 +extern atomic_unchecked_t cm_resets_recvd;
28719
28720 extern u32 int_mod_timer_init;
28721 extern u32 int_mod_cq_depth_256;
28722 diff -urNp linux-3.0.8/drivers/infiniband/hw/nes/nes_nic.c linux-3.0.8/drivers/infiniband/hw/nes/nes_nic.c
28723 --- linux-3.0.8/drivers/infiniband/hw/nes/nes_nic.c 2011-07-21 22:17:23.000000000 -0400
28724 +++ linux-3.0.8/drivers/infiniband/hw/nes/nes_nic.c 2011-08-23 21:47:55.000000000 -0400
28725 @@ -1274,31 +1274,31 @@ static void nes_netdev_get_ethtool_stats
28726 target_stat_values[++index] = mh_detected;
28727 target_stat_values[++index] = mh_pauses_sent;
28728 target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
28729 - target_stat_values[++index] = atomic_read(&cm_connects);
28730 - target_stat_values[++index] = atomic_read(&cm_accepts);
28731 - target_stat_values[++index] = atomic_read(&cm_disconnects);
28732 - target_stat_values[++index] = atomic_read(&cm_connecteds);
28733 - target_stat_values[++index] = atomic_read(&cm_connect_reqs);
28734 - target_stat_values[++index] = atomic_read(&cm_rejects);
28735 - target_stat_values[++index] = atomic_read(&mod_qp_timouts);
28736 - target_stat_values[++index] = atomic_read(&qps_created);
28737 - target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
28738 - target_stat_values[++index] = atomic_read(&qps_destroyed);
28739 - target_stat_values[++index] = atomic_read(&cm_closes);
28740 + target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
28741 + target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
28742 + target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
28743 + target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
28744 + target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
28745 + target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
28746 + target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
28747 + target_stat_values[++index] = atomic_read_unchecked(&qps_created);
28748 + target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
28749 + target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
28750 + target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
28751 target_stat_values[++index] = cm_packets_sent;
28752 target_stat_values[++index] = cm_packets_bounced;
28753 target_stat_values[++index] = cm_packets_created;
28754 target_stat_values[++index] = cm_packets_received;
28755 target_stat_values[++index] = cm_packets_dropped;
28756 target_stat_values[++index] = cm_packets_retrans;
28757 - target_stat_values[++index] = atomic_read(&cm_listens_created);
28758 - target_stat_values[++index] = atomic_read(&cm_listens_destroyed);
28759 + target_stat_values[++index] = atomic_read_unchecked(&cm_listens_created);
28760 + target_stat_values[++index] = atomic_read_unchecked(&cm_listens_destroyed);
28761 target_stat_values[++index] = cm_backlog_drops;
28762 - target_stat_values[++index] = atomic_read(&cm_loopbacks);
28763 - target_stat_values[++index] = atomic_read(&cm_nodes_created);
28764 - target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
28765 - target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
28766 - target_stat_values[++index] = atomic_read(&cm_resets_recvd);
28767 + target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
28768 + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
28769 + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
28770 + target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
28771 + target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
28772 target_stat_values[++index] = nesadapter->free_4kpbl;
28773 target_stat_values[++index] = nesadapter->free_256pbl;
28774 target_stat_values[++index] = int_mod_timer_init;
28775 diff -urNp linux-3.0.8/drivers/infiniband/hw/nes/nes_verbs.c linux-3.0.8/drivers/infiniband/hw/nes/nes_verbs.c
28776 --- linux-3.0.8/drivers/infiniband/hw/nes/nes_verbs.c 2011-07-21 22:17:23.000000000 -0400
28777 +++ linux-3.0.8/drivers/infiniband/hw/nes/nes_verbs.c 2011-08-23 21:47:55.000000000 -0400
28778 @@ -46,9 +46,9 @@
28779
28780 #include <rdma/ib_umem.h>
28781
28782 -atomic_t mod_qp_timouts;
28783 -atomic_t qps_created;
28784 -atomic_t sw_qps_destroyed;
28785 +atomic_unchecked_t mod_qp_timouts;
28786 +atomic_unchecked_t qps_created;
28787 +atomic_unchecked_t sw_qps_destroyed;
28788
28789 static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
28790
28791 @@ -1141,7 +1141,7 @@ static struct ib_qp *nes_create_qp(struc
28792 if (init_attr->create_flags)
28793 return ERR_PTR(-EINVAL);
28794
28795 - atomic_inc(&qps_created);
28796 + atomic_inc_unchecked(&qps_created);
28797 switch (init_attr->qp_type) {
28798 case IB_QPT_RC:
28799 if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
28800 @@ -1470,7 +1470,7 @@ static int nes_destroy_qp(struct ib_qp *
28801 struct iw_cm_event cm_event;
28802 int ret;
28803
28804 - atomic_inc(&sw_qps_destroyed);
28805 + atomic_inc_unchecked(&sw_qps_destroyed);
28806 nesqp->destroyed = 1;
28807
28808 /* Blow away the connection if it exists. */
28809 diff -urNp linux-3.0.8/drivers/infiniband/hw/qib/qib.h linux-3.0.8/drivers/infiniband/hw/qib/qib.h
28810 --- linux-3.0.8/drivers/infiniband/hw/qib/qib.h 2011-07-21 22:17:23.000000000 -0400
28811 +++ linux-3.0.8/drivers/infiniband/hw/qib/qib.h 2011-08-23 21:47:55.000000000 -0400
28812 @@ -51,6 +51,7 @@
28813 #include <linux/completion.h>
28814 #include <linux/kref.h>
28815 #include <linux/sched.h>
28816 +#include <linux/slab.h>
28817
28818 #include "qib_common.h"
28819 #include "qib_verbs.h"
28820 diff -urNp linux-3.0.8/drivers/input/gameport/gameport.c linux-3.0.8/drivers/input/gameport/gameport.c
28821 --- linux-3.0.8/drivers/input/gameport/gameport.c 2011-07-21 22:17:23.000000000 -0400
28822 +++ linux-3.0.8/drivers/input/gameport/gameport.c 2011-08-23 21:47:55.000000000 -0400
28823 @@ -488,14 +488,14 @@ EXPORT_SYMBOL(gameport_set_phys);
28824 */
28825 static void gameport_init_port(struct gameport *gameport)
28826 {
28827 - static atomic_t gameport_no = ATOMIC_INIT(0);
28828 + static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
28829
28830 __module_get(THIS_MODULE);
28831
28832 mutex_init(&gameport->drv_mutex);
28833 device_initialize(&gameport->dev);
28834 dev_set_name(&gameport->dev, "gameport%lu",
28835 - (unsigned long)atomic_inc_return(&gameport_no) - 1);
28836 + (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
28837 gameport->dev.bus = &gameport_bus;
28838 gameport->dev.release = gameport_release_port;
28839 if (gameport->parent)
28840 diff -urNp linux-3.0.8/drivers/input/input.c linux-3.0.8/drivers/input/input.c
28841 --- linux-3.0.8/drivers/input/input.c 2011-07-21 22:17:23.000000000 -0400
28842 +++ linux-3.0.8/drivers/input/input.c 2011-08-23 21:47:55.000000000 -0400
28843 @@ -1814,7 +1814,7 @@ static void input_cleanse_bitmasks(struc
28844 */
28845 int input_register_device(struct input_dev *dev)
28846 {
28847 - static atomic_t input_no = ATOMIC_INIT(0);
28848 + static atomic_unchecked_t input_no = ATOMIC_INIT(0);
28849 struct input_handler *handler;
28850 const char *path;
28851 int error;
28852 @@ -1851,7 +1851,7 @@ int input_register_device(struct input_d
28853 dev->setkeycode = input_default_setkeycode;
28854
28855 dev_set_name(&dev->dev, "input%ld",
28856 - (unsigned long) atomic_inc_return(&input_no) - 1);
28857 + (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
28858
28859 error = device_add(&dev->dev);
28860 if (error)
28861 diff -urNp linux-3.0.8/drivers/input/joystick/sidewinder.c linux-3.0.8/drivers/input/joystick/sidewinder.c
28862 --- linux-3.0.8/drivers/input/joystick/sidewinder.c 2011-07-21 22:17:23.000000000 -0400
28863 +++ linux-3.0.8/drivers/input/joystick/sidewinder.c 2011-08-23 21:48:14.000000000 -0400
28864 @@ -30,6 +30,7 @@
28865 #include <linux/kernel.h>
28866 #include <linux/module.h>
28867 #include <linux/slab.h>
28868 +#include <linux/sched.h>
28869 #include <linux/init.h>
28870 #include <linux/input.h>
28871 #include <linux/gameport.h>
28872 @@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
28873 unsigned char buf[SW_LENGTH];
28874 int i;
28875
28876 + pax_track_stack();
28877 +
28878 i = sw_read_packet(sw->gameport, buf, sw->length, 0);
28879
28880 if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
28881 diff -urNp linux-3.0.8/drivers/input/joystick/xpad.c linux-3.0.8/drivers/input/joystick/xpad.c
28882 --- linux-3.0.8/drivers/input/joystick/xpad.c 2011-07-21 22:17:23.000000000 -0400
28883 +++ linux-3.0.8/drivers/input/joystick/xpad.c 2011-08-23 21:47:55.000000000 -0400
28884 @@ -689,7 +689,7 @@ static void xpad_led_set(struct led_clas
28885
28886 static int xpad_led_probe(struct usb_xpad *xpad)
28887 {
28888 - static atomic_t led_seq = ATOMIC_INIT(0);
28889 + static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
28890 long led_no;
28891 struct xpad_led *led;
28892 struct led_classdev *led_cdev;
28893 @@ -702,7 +702,7 @@ static int xpad_led_probe(struct usb_xpa
28894 if (!led)
28895 return -ENOMEM;
28896
28897 - led_no = (long)atomic_inc_return(&led_seq) - 1;
28898 + led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
28899
28900 snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
28901 led->xpad = xpad;
28902 diff -urNp linux-3.0.8/drivers/input/mousedev.c linux-3.0.8/drivers/input/mousedev.c
28903 --- linux-3.0.8/drivers/input/mousedev.c 2011-07-21 22:17:23.000000000 -0400
28904 +++ linux-3.0.8/drivers/input/mousedev.c 2011-08-23 21:47:55.000000000 -0400
28905 @@ -763,7 +763,7 @@ static ssize_t mousedev_read(struct file
28906
28907 spin_unlock_irq(&client->packet_lock);
28908
28909 - if (copy_to_user(buffer, data, count))
28910 + if (count > sizeof(data) || copy_to_user(buffer, data, count))
28911 return -EFAULT;
28912
28913 return count;
28914 diff -urNp linux-3.0.8/drivers/input/serio/serio.c linux-3.0.8/drivers/input/serio/serio.c
28915 --- linux-3.0.8/drivers/input/serio/serio.c 2011-07-21 22:17:23.000000000 -0400
28916 +++ linux-3.0.8/drivers/input/serio/serio.c 2011-08-23 21:47:55.000000000 -0400
28917 @@ -497,7 +497,7 @@ static void serio_release_port(struct de
28918 */
28919 static void serio_init_port(struct serio *serio)
28920 {
28921 - static atomic_t serio_no = ATOMIC_INIT(0);
28922 + static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
28923
28924 __module_get(THIS_MODULE);
28925
28926 @@ -508,7 +508,7 @@ static void serio_init_port(struct serio
28927 mutex_init(&serio->drv_mutex);
28928 device_initialize(&serio->dev);
28929 dev_set_name(&serio->dev, "serio%ld",
28930 - (long)atomic_inc_return(&serio_no) - 1);
28931 + (long)atomic_inc_return_unchecked(&serio_no) - 1);
28932 serio->dev.bus = &serio_bus;
28933 serio->dev.release = serio_release_port;
28934 serio->dev.groups = serio_device_attr_groups;
28935 diff -urNp linux-3.0.8/drivers/isdn/capi/capi.c linux-3.0.8/drivers/isdn/capi/capi.c
28936 --- linux-3.0.8/drivers/isdn/capi/capi.c 2011-07-21 22:17:23.000000000 -0400
28937 +++ linux-3.0.8/drivers/isdn/capi/capi.c 2011-08-23 21:47:55.000000000 -0400
28938 @@ -83,8 +83,8 @@ struct capiminor {
28939
28940 struct capi20_appl *ap;
28941 u32 ncci;
28942 - atomic_t datahandle;
28943 - atomic_t msgid;
28944 + atomic_unchecked_t datahandle;
28945 + atomic_unchecked_t msgid;
28946
28947 struct tty_port port;
28948 int ttyinstop;
28949 @@ -397,7 +397,7 @@ gen_data_b3_resp_for(struct capiminor *m
28950 capimsg_setu16(s, 2, mp->ap->applid);
28951 capimsg_setu8 (s, 4, CAPI_DATA_B3);
28952 capimsg_setu8 (s, 5, CAPI_RESP);
28953 - capimsg_setu16(s, 6, atomic_inc_return(&mp->msgid));
28954 + capimsg_setu16(s, 6, atomic_inc_return_unchecked(&mp->msgid));
28955 capimsg_setu32(s, 8, mp->ncci);
28956 capimsg_setu16(s, 12, datahandle);
28957 }
28958 @@ -518,14 +518,14 @@ static void handle_minor_send(struct cap
28959 mp->outbytes -= len;
28960 spin_unlock_bh(&mp->outlock);
28961
28962 - datahandle = atomic_inc_return(&mp->datahandle);
28963 + datahandle = atomic_inc_return_unchecked(&mp->datahandle);
28964 skb_push(skb, CAPI_DATA_B3_REQ_LEN);
28965 memset(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
28966 capimsg_setu16(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
28967 capimsg_setu16(skb->data, 2, mp->ap->applid);
28968 capimsg_setu8 (skb->data, 4, CAPI_DATA_B3);
28969 capimsg_setu8 (skb->data, 5, CAPI_REQ);
28970 - capimsg_setu16(skb->data, 6, atomic_inc_return(&mp->msgid));
28971 + capimsg_setu16(skb->data, 6, atomic_inc_return_unchecked(&mp->msgid));
28972 capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */
28973 capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */
28974 capimsg_setu16(skb->data, 16, len); /* Data length */
28975 diff -urNp linux-3.0.8/drivers/isdn/gigaset/common.c linux-3.0.8/drivers/isdn/gigaset/common.c
28976 --- linux-3.0.8/drivers/isdn/gigaset/common.c 2011-07-21 22:17:23.000000000 -0400
28977 +++ linux-3.0.8/drivers/isdn/gigaset/common.c 2011-08-23 21:47:55.000000000 -0400
28978 @@ -723,7 +723,7 @@ struct cardstate *gigaset_initcs(struct
28979 cs->commands_pending = 0;
28980 cs->cur_at_seq = 0;
28981 cs->gotfwver = -1;
28982 - cs->open_count = 0;
28983 + local_set(&cs->open_count, 0);
28984 cs->dev = NULL;
28985 cs->tty = NULL;
28986 cs->tty_dev = NULL;
28987 diff -urNp linux-3.0.8/drivers/isdn/gigaset/gigaset.h linux-3.0.8/drivers/isdn/gigaset/gigaset.h
28988 --- linux-3.0.8/drivers/isdn/gigaset/gigaset.h 2011-07-21 22:17:23.000000000 -0400
28989 +++ linux-3.0.8/drivers/isdn/gigaset/gigaset.h 2011-08-23 21:47:55.000000000 -0400
28990 @@ -35,6 +35,7 @@
28991 #include <linux/tty_driver.h>
28992 #include <linux/list.h>
28993 #include <asm/atomic.h>
28994 +#include <asm/local.h>
28995
28996 #define GIG_VERSION {0, 5, 0, 0}
28997 #define GIG_COMPAT {0, 4, 0, 0}
28998 @@ -433,7 +434,7 @@ struct cardstate {
28999 spinlock_t cmdlock;
29000 unsigned curlen, cmdbytes;
29001
29002 - unsigned open_count;
29003 + local_t open_count;
29004 struct tty_struct *tty;
29005 struct tasklet_struct if_wake_tasklet;
29006 unsigned control_state;
29007 diff -urNp linux-3.0.8/drivers/isdn/gigaset/interface.c linux-3.0.8/drivers/isdn/gigaset/interface.c
29008 --- linux-3.0.8/drivers/isdn/gigaset/interface.c 2011-07-21 22:17:23.000000000 -0400
29009 +++ linux-3.0.8/drivers/isdn/gigaset/interface.c 2011-08-23 21:47:55.000000000 -0400
29010 @@ -162,9 +162,7 @@ static int if_open(struct tty_struct *tt
29011 }
29012 tty->driver_data = cs;
29013
29014 - ++cs->open_count;
29015 -
29016 - if (cs->open_count == 1) {
29017 + if (local_inc_return(&cs->open_count) == 1) {
29018 spin_lock_irqsave(&cs->lock, flags);
29019 cs->tty = tty;
29020 spin_unlock_irqrestore(&cs->lock, flags);
29021 @@ -192,10 +190,10 @@ static void if_close(struct tty_struct *
29022
29023 if (!cs->connected)
29024 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
29025 - else if (!cs->open_count)
29026 + else if (!local_read(&cs->open_count))
29027 dev_warn(cs->dev, "%s: device not opened\n", __func__);
29028 else {
29029 - if (!--cs->open_count) {
29030 + if (!local_dec_return(&cs->open_count)) {
29031 spin_lock_irqsave(&cs->lock, flags);
29032 cs->tty = NULL;
29033 spin_unlock_irqrestore(&cs->lock, flags);
29034 @@ -230,7 +228,7 @@ static int if_ioctl(struct tty_struct *t
29035 if (!cs->connected) {
29036 gig_dbg(DEBUG_IF, "not connected");
29037 retval = -ENODEV;
29038 - } else if (!cs->open_count)
29039 + } else if (!local_read(&cs->open_count))
29040 dev_warn(cs->dev, "%s: device not opened\n", __func__);
29041 else {
29042 retval = 0;
29043 @@ -360,7 +358,7 @@ static int if_write(struct tty_struct *t
29044 retval = -ENODEV;
29045 goto done;
29046 }
29047 - if (!cs->open_count) {
29048 + if (!local_read(&cs->open_count)) {
29049 dev_warn(cs->dev, "%s: device not opened\n", __func__);
29050 retval = -ENODEV;
29051 goto done;
29052 @@ -413,7 +411,7 @@ static int if_write_room(struct tty_stru
29053 if (!cs->connected) {
29054 gig_dbg(DEBUG_IF, "not connected");
29055 retval = -ENODEV;
29056 - } else if (!cs->open_count)
29057 + } else if (!local_read(&cs->open_count))
29058 dev_warn(cs->dev, "%s: device not opened\n", __func__);
29059 else if (cs->mstate != MS_LOCKED) {
29060 dev_warn(cs->dev, "can't write to unlocked device\n");
29061 @@ -443,7 +441,7 @@ static int if_chars_in_buffer(struct tty
29062
29063 if (!cs->connected)
29064 gig_dbg(DEBUG_IF, "not connected");
29065 - else if (!cs->open_count)
29066 + else if (!local_read(&cs->open_count))
29067 dev_warn(cs->dev, "%s: device not opened\n", __func__);
29068 else if (cs->mstate != MS_LOCKED)
29069 dev_warn(cs->dev, "can't write to unlocked device\n");
29070 @@ -471,7 +469,7 @@ static void if_throttle(struct tty_struc
29071
29072 if (!cs->connected)
29073 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
29074 - else if (!cs->open_count)
29075 + else if (!local_read(&cs->open_count))
29076 dev_warn(cs->dev, "%s: device not opened\n", __func__);
29077 else
29078 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
29079 @@ -495,7 +493,7 @@ static void if_unthrottle(struct tty_str
29080
29081 if (!cs->connected)
29082 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
29083 - else if (!cs->open_count)
29084 + else if (!local_read(&cs->open_count))
29085 dev_warn(cs->dev, "%s: device not opened\n", __func__);
29086 else
29087 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
29088 @@ -526,7 +524,7 @@ static void if_set_termios(struct tty_st
29089 goto out;
29090 }
29091
29092 - if (!cs->open_count) {
29093 + if (!local_read(&cs->open_count)) {
29094 dev_warn(cs->dev, "%s: device not opened\n", __func__);
29095 goto out;
29096 }
29097 diff -urNp linux-3.0.8/drivers/isdn/hardware/avm/b1.c linux-3.0.8/drivers/isdn/hardware/avm/b1.c
29098 --- linux-3.0.8/drivers/isdn/hardware/avm/b1.c 2011-07-21 22:17:23.000000000 -0400
29099 +++ linux-3.0.8/drivers/isdn/hardware/avm/b1.c 2011-08-23 21:47:55.000000000 -0400
29100 @@ -176,7 +176,7 @@ int b1_load_t4file(avmcard *card, capilo
29101 }
29102 if (left) {
29103 if (t4file->user) {
29104 - if (copy_from_user(buf, dp, left))
29105 + if (left > sizeof buf || copy_from_user(buf, dp, left))
29106 return -EFAULT;
29107 } else {
29108 memcpy(buf, dp, left);
29109 @@ -224,7 +224,7 @@ int b1_load_config(avmcard *card, capilo
29110 }
29111 if (left) {
29112 if (config->user) {
29113 - if (copy_from_user(buf, dp, left))
29114 + if (left > sizeof buf || copy_from_user(buf, dp, left))
29115 return -EFAULT;
29116 } else {
29117 memcpy(buf, dp, left);
29118 diff -urNp linux-3.0.8/drivers/isdn/hardware/eicon/capidtmf.c linux-3.0.8/drivers/isdn/hardware/eicon/capidtmf.c
29119 --- linux-3.0.8/drivers/isdn/hardware/eicon/capidtmf.c 2011-07-21 22:17:23.000000000 -0400
29120 +++ linux-3.0.8/drivers/isdn/hardware/eicon/capidtmf.c 2011-08-23 21:48:14.000000000 -0400
29121 @@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_sta
29122 byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
29123 short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
29124
29125 + pax_track_stack();
29126
29127 if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
29128 {
29129 diff -urNp linux-3.0.8/drivers/isdn/hardware/eicon/capifunc.c linux-3.0.8/drivers/isdn/hardware/eicon/capifunc.c
29130 --- linux-3.0.8/drivers/isdn/hardware/eicon/capifunc.c 2011-07-21 22:17:23.000000000 -0400
29131 +++ linux-3.0.8/drivers/isdn/hardware/eicon/capifunc.c 2011-08-23 21:48:14.000000000 -0400
29132 @@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
29133 IDI_SYNC_REQ req;
29134 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
29135
29136 + pax_track_stack();
29137 +
29138 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
29139
29140 for (x = 0; x < MAX_DESCRIPTORS; x++) {
29141 diff -urNp linux-3.0.8/drivers/isdn/hardware/eicon/diddfunc.c linux-3.0.8/drivers/isdn/hardware/eicon/diddfunc.c
29142 --- linux-3.0.8/drivers/isdn/hardware/eicon/diddfunc.c 2011-07-21 22:17:23.000000000 -0400
29143 +++ linux-3.0.8/drivers/isdn/hardware/eicon/diddfunc.c 2011-08-23 21:48:14.000000000 -0400
29144 @@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_di
29145 IDI_SYNC_REQ req;
29146 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
29147
29148 + pax_track_stack();
29149 +
29150 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
29151
29152 for (x = 0; x < MAX_DESCRIPTORS; x++) {
29153 diff -urNp linux-3.0.8/drivers/isdn/hardware/eicon/divasfunc.c linux-3.0.8/drivers/isdn/hardware/eicon/divasfunc.c
29154 --- linux-3.0.8/drivers/isdn/hardware/eicon/divasfunc.c 2011-07-21 22:17:23.000000000 -0400
29155 +++ linux-3.0.8/drivers/isdn/hardware/eicon/divasfunc.c 2011-08-23 21:48:14.000000000 -0400
29156 @@ -160,6 +160,8 @@ static int DIVA_INIT_FUNCTION connect_di
29157 IDI_SYNC_REQ req;
29158 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
29159
29160 + pax_track_stack();
29161 +
29162 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
29163
29164 for (x = 0; x < MAX_DESCRIPTORS; x++) {
29165 diff -urNp linux-3.0.8/drivers/isdn/hardware/eicon/divasync.h linux-3.0.8/drivers/isdn/hardware/eicon/divasync.h
29166 --- linux-3.0.8/drivers/isdn/hardware/eicon/divasync.h 2011-07-21 22:17:23.000000000 -0400
29167 +++ linux-3.0.8/drivers/isdn/hardware/eicon/divasync.h 2011-08-23 21:47:55.000000000 -0400
29168 @@ -146,7 +146,7 @@ typedef struct _diva_didd_add_adapter {
29169 } diva_didd_add_adapter_t;
29170 typedef struct _diva_didd_remove_adapter {
29171 IDI_CALL p_request;
29172 -} diva_didd_remove_adapter_t;
29173 +} __no_const diva_didd_remove_adapter_t;
29174 typedef struct _diva_didd_read_adapter_array {
29175 void * buffer;
29176 dword length;
29177 diff -urNp linux-3.0.8/drivers/isdn/hardware/eicon/idifunc.c linux-3.0.8/drivers/isdn/hardware/eicon/idifunc.c
29178 --- linux-3.0.8/drivers/isdn/hardware/eicon/idifunc.c 2011-07-21 22:17:23.000000000 -0400
29179 +++ linux-3.0.8/drivers/isdn/hardware/eicon/idifunc.c 2011-08-23 21:48:14.000000000 -0400
29180 @@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_di
29181 IDI_SYNC_REQ req;
29182 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
29183
29184 + pax_track_stack();
29185 +
29186 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
29187
29188 for (x = 0; x < MAX_DESCRIPTORS; x++) {
29189 diff -urNp linux-3.0.8/drivers/isdn/hardware/eicon/message.c linux-3.0.8/drivers/isdn/hardware/eicon/message.c
29190 --- linux-3.0.8/drivers/isdn/hardware/eicon/message.c 2011-07-21 22:17:23.000000000 -0400
29191 +++ linux-3.0.8/drivers/isdn/hardware/eicon/message.c 2011-08-23 21:48:14.000000000 -0400
29192 @@ -4886,6 +4886,8 @@ static void sig_ind(PLCI *plci)
29193 dword d;
29194 word w;
29195
29196 + pax_track_stack();
29197 +
29198 a = plci->adapter;
29199 Id = ((word)plci->Id<<8)|a->Id;
29200 PUT_WORD(&SS_Ind[4],0x0000);
29201 @@ -7480,6 +7482,8 @@ static word add_b1(PLCI *plci, API_PARSE
29202 word j, n, w;
29203 dword d;
29204
29205 + pax_track_stack();
29206 +
29207
29208 for(i=0;i<8;i++) bp_parms[i].length = 0;
29209 for(i=0;i<2;i++) global_config[i].length = 0;
29210 @@ -7954,6 +7958,8 @@ static word add_b23(PLCI *plci, API_PARS
29211 const byte llc3[] = {4,3,2,2,6,6,0};
29212 const byte header[] = {0,2,3,3,0,0,0};
29213
29214 + pax_track_stack();
29215 +
29216 for(i=0;i<8;i++) bp_parms[i].length = 0;
29217 for(i=0;i<6;i++) b2_config_parms[i].length = 0;
29218 for(i=0;i<5;i++) b3_config_parms[i].length = 0;
29219 @@ -14741,6 +14747,8 @@ static void group_optimization(DIVA_CAPI
29220 word appl_number_group_type[MAX_APPL];
29221 PLCI *auxplci;
29222
29223 + pax_track_stack();
29224 +
29225 set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
29226
29227 if(!a->group_optimization_enabled)
29228 diff -urNp linux-3.0.8/drivers/isdn/hardware/eicon/mntfunc.c linux-3.0.8/drivers/isdn/hardware/eicon/mntfunc.c
29229 --- linux-3.0.8/drivers/isdn/hardware/eicon/mntfunc.c 2011-07-21 22:17:23.000000000 -0400
29230 +++ linux-3.0.8/drivers/isdn/hardware/eicon/mntfunc.c 2011-08-23 21:48:14.000000000 -0400
29231 @@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_di
29232 IDI_SYNC_REQ req;
29233 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
29234
29235 + pax_track_stack();
29236 +
29237 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
29238
29239 for (x = 0; x < MAX_DESCRIPTORS; x++) {
29240 diff -urNp linux-3.0.8/drivers/isdn/hardware/eicon/xdi_adapter.h linux-3.0.8/drivers/isdn/hardware/eicon/xdi_adapter.h
29241 --- linux-3.0.8/drivers/isdn/hardware/eicon/xdi_adapter.h 2011-07-21 22:17:23.000000000 -0400
29242 +++ linux-3.0.8/drivers/isdn/hardware/eicon/xdi_adapter.h 2011-08-23 21:47:55.000000000 -0400
29243 @@ -44,7 +44,7 @@ typedef struct _xdi_mbox_t {
29244 typedef struct _diva_os_idi_adapter_interface {
29245 diva_init_card_proc_t cleanup_adapter_proc;
29246 diva_cmd_card_proc_t cmd_proc;
29247 -} diva_os_idi_adapter_interface_t;
29248 +} __no_const diva_os_idi_adapter_interface_t;
29249
29250 typedef struct _diva_os_xdi_adapter {
29251 struct list_head link;
29252 diff -urNp linux-3.0.8/drivers/isdn/i4l/isdn_common.c linux-3.0.8/drivers/isdn/i4l/isdn_common.c
29253 --- linux-3.0.8/drivers/isdn/i4l/isdn_common.c 2011-07-21 22:17:23.000000000 -0400
29254 +++ linux-3.0.8/drivers/isdn/i4l/isdn_common.c 2011-08-23 21:48:14.000000000 -0400
29255 @@ -1286,6 +1286,8 @@ isdn_ioctl(struct file *file, uint cmd,
29256 } iocpar;
29257 void __user *argp = (void __user *)arg;
29258
29259 + pax_track_stack();
29260 +
29261 #define name iocpar.name
29262 #define bname iocpar.bname
29263 #define iocts iocpar.iocts
29264 diff -urNp linux-3.0.8/drivers/isdn/icn/icn.c linux-3.0.8/drivers/isdn/icn/icn.c
29265 --- linux-3.0.8/drivers/isdn/icn/icn.c 2011-07-21 22:17:23.000000000 -0400
29266 +++ linux-3.0.8/drivers/isdn/icn/icn.c 2011-08-23 21:47:55.000000000 -0400
29267 @@ -1045,7 +1045,7 @@ icn_writecmd(const u_char * buf, int len
29268 if (count > len)
29269 count = len;
29270 if (user) {
29271 - if (copy_from_user(msg, buf, count))
29272 + if (count > sizeof msg || copy_from_user(msg, buf, count))
29273 return -EFAULT;
29274 } else
29275 memcpy(msg, buf, count);
29276 diff -urNp linux-3.0.8/drivers/lguest/core.c linux-3.0.8/drivers/lguest/core.c
29277 --- linux-3.0.8/drivers/lguest/core.c 2011-07-21 22:17:23.000000000 -0400
29278 +++ linux-3.0.8/drivers/lguest/core.c 2011-08-23 21:47:55.000000000 -0400
29279 @@ -92,9 +92,17 @@ static __init int map_switcher(void)
29280 * it's worked so far. The end address needs +1 because __get_vm_area
29281 * allocates an extra guard page, so we need space for that.
29282 */
29283 +
29284 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
29285 + switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
29286 + VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
29287 + + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
29288 +#else
29289 switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
29290 VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
29291 + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
29292 +#endif
29293 +
29294 if (!switcher_vma) {
29295 err = -ENOMEM;
29296 printk("lguest: could not map switcher pages high\n");
29297 @@ -119,7 +127,7 @@ static __init int map_switcher(void)
29298 * Now the Switcher is mapped at the right address, we can't fail!
29299 * Copy in the compiled-in Switcher code (from <arch>_switcher.S).
29300 */
29301 - memcpy(switcher_vma->addr, start_switcher_text,
29302 + memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
29303 end_switcher_text - start_switcher_text);
29304
29305 printk(KERN_INFO "lguest: mapped switcher at %p\n",
29306 diff -urNp linux-3.0.8/drivers/lguest/x86/core.c linux-3.0.8/drivers/lguest/x86/core.c
29307 --- linux-3.0.8/drivers/lguest/x86/core.c 2011-07-21 22:17:23.000000000 -0400
29308 +++ linux-3.0.8/drivers/lguest/x86/core.c 2011-08-23 21:47:55.000000000 -0400
29309 @@ -59,7 +59,7 @@ static struct {
29310 /* Offset from where switcher.S was compiled to where we've copied it */
29311 static unsigned long switcher_offset(void)
29312 {
29313 - return SWITCHER_ADDR - (unsigned long)start_switcher_text;
29314 + return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
29315 }
29316
29317 /* This cpu's struct lguest_pages. */
29318 @@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg
29319 * These copies are pretty cheap, so we do them unconditionally: */
29320 /* Save the current Host top-level page directory.
29321 */
29322 +
29323 +#ifdef CONFIG_PAX_PER_CPU_PGD
29324 + pages->state.host_cr3 = read_cr3();
29325 +#else
29326 pages->state.host_cr3 = __pa(current->mm->pgd);
29327 +#endif
29328 +
29329 /*
29330 * Set up the Guest's page tables to see this CPU's pages (and no
29331 * other CPU's pages).
29332 @@ -547,7 +553,7 @@ void __init lguest_arch_host_init(void)
29333 * compiled-in switcher code and the high-mapped copy we just made.
29334 */
29335 for (i = 0; i < IDT_ENTRIES; i++)
29336 - default_idt_entries[i] += switcher_offset();
29337 + default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
29338
29339 /*
29340 * Set up the Switcher's per-cpu areas.
29341 @@ -630,7 +636,7 @@ void __init lguest_arch_host_init(void)
29342 * it will be undisturbed when we switch. To change %cs and jump we
29343 * need this structure to feed to Intel's "lcall" instruction.
29344 */
29345 - lguest_entry.offset = (long)switch_to_guest + switcher_offset();
29346 + lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
29347 lguest_entry.segment = LGUEST_CS;
29348
29349 /*
29350 diff -urNp linux-3.0.8/drivers/lguest/x86/switcher_32.S linux-3.0.8/drivers/lguest/x86/switcher_32.S
29351 --- linux-3.0.8/drivers/lguest/x86/switcher_32.S 2011-07-21 22:17:23.000000000 -0400
29352 +++ linux-3.0.8/drivers/lguest/x86/switcher_32.S 2011-08-23 21:47:55.000000000 -0400
29353 @@ -87,6 +87,7 @@
29354 #include <asm/page.h>
29355 #include <asm/segment.h>
29356 #include <asm/lguest.h>
29357 +#include <asm/processor-flags.h>
29358
29359 // We mark the start of the code to copy
29360 // It's placed in .text tho it's never run here
29361 @@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
29362 // Changes type when we load it: damn Intel!
29363 // For after we switch over our page tables
29364 // That entry will be read-only: we'd crash.
29365 +
29366 +#ifdef CONFIG_PAX_KERNEXEC
29367 + mov %cr0, %edx
29368 + xor $X86_CR0_WP, %edx
29369 + mov %edx, %cr0
29370 +#endif
29371 +
29372 movl $(GDT_ENTRY_TSS*8), %edx
29373 ltr %dx
29374
29375 @@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
29376 // Let's clear it again for our return.
29377 // The GDT descriptor of the Host
29378 // Points to the table after two "size" bytes
29379 - movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
29380 + movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
29381 // Clear "used" from type field (byte 5, bit 2)
29382 - andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
29383 + andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
29384 +
29385 +#ifdef CONFIG_PAX_KERNEXEC
29386 + mov %cr0, %eax
29387 + xor $X86_CR0_WP, %eax
29388 + mov %eax, %cr0
29389 +#endif
29390
29391 // Once our page table's switched, the Guest is live!
29392 // The Host fades as we run this final step.
29393 @@ -295,13 +309,12 @@ deliver_to_host:
29394 // I consulted gcc, and it gave
29395 // These instructions, which I gladly credit:
29396 leal (%edx,%ebx,8), %eax
29397 - movzwl (%eax),%edx
29398 - movl 4(%eax), %eax
29399 - xorw %ax, %ax
29400 - orl %eax, %edx
29401 + movl 4(%eax), %edx
29402 + movw (%eax), %dx
29403 // Now the address of the handler's in %edx
29404 // We call it now: its "iret" drops us home.
29405 - jmp *%edx
29406 + ljmp $__KERNEL_CS, $1f
29407 +1: jmp *%edx
29408
29409 // Every interrupt can come to us here
29410 // But we must truly tell each apart.
29411 diff -urNp linux-3.0.8/drivers/macintosh/macio_asic.c linux-3.0.8/drivers/macintosh/macio_asic.c
29412 --- linux-3.0.8/drivers/macintosh/macio_asic.c 2011-07-21 22:17:23.000000000 -0400
29413 +++ linux-3.0.8/drivers/macintosh/macio_asic.c 2011-10-11 10:44:33.000000000 -0400
29414 @@ -748,7 +748,7 @@ static void __devexit macio_pci_remove(s
29415 * MacIO is matched against any Apple ID, it's probe() function
29416 * will then decide wether it applies or not
29417 */
29418 -static const struct pci_device_id __devinitdata pci_ids [] = { {
29419 +static const struct pci_device_id __devinitconst pci_ids [] = { {
29420 .vendor = PCI_VENDOR_ID_APPLE,
29421 .device = PCI_ANY_ID,
29422 .subvendor = PCI_ANY_ID,
29423 diff -urNp linux-3.0.8/drivers/md/dm.c linux-3.0.8/drivers/md/dm.c
29424 --- linux-3.0.8/drivers/md/dm.c 2011-10-24 08:05:21.000000000 -0400
29425 +++ linux-3.0.8/drivers/md/dm.c 2011-08-23 21:47:55.000000000 -0400
29426 @@ -164,9 +164,9 @@ struct mapped_device {
29427 /*
29428 * Event handling.
29429 */
29430 - atomic_t event_nr;
29431 + atomic_unchecked_t event_nr;
29432 wait_queue_head_t eventq;
29433 - atomic_t uevent_seq;
29434 + atomic_unchecked_t uevent_seq;
29435 struct list_head uevent_list;
29436 spinlock_t uevent_lock; /* Protect access to uevent_list */
29437
29438 @@ -1842,8 +1842,8 @@ static struct mapped_device *alloc_dev(i
29439 rwlock_init(&md->map_lock);
29440 atomic_set(&md->holders, 1);
29441 atomic_set(&md->open_count, 0);
29442 - atomic_set(&md->event_nr, 0);
29443 - atomic_set(&md->uevent_seq, 0);
29444 + atomic_set_unchecked(&md->event_nr, 0);
29445 + atomic_set_unchecked(&md->uevent_seq, 0);
29446 INIT_LIST_HEAD(&md->uevent_list);
29447 spin_lock_init(&md->uevent_lock);
29448
29449 @@ -1977,7 +1977,7 @@ static void event_callback(void *context
29450
29451 dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
29452
29453 - atomic_inc(&md->event_nr);
29454 + atomic_inc_unchecked(&md->event_nr);
29455 wake_up(&md->eventq);
29456 }
29457
29458 @@ -2553,18 +2553,18 @@ int dm_kobject_uevent(struct mapped_devi
29459
29460 uint32_t dm_next_uevent_seq(struct mapped_device *md)
29461 {
29462 - return atomic_add_return(1, &md->uevent_seq);
29463 + return atomic_add_return_unchecked(1, &md->uevent_seq);
29464 }
29465
29466 uint32_t dm_get_event_nr(struct mapped_device *md)
29467 {
29468 - return atomic_read(&md->event_nr);
29469 + return atomic_read_unchecked(&md->event_nr);
29470 }
29471
29472 int dm_wait_event(struct mapped_device *md, int event_nr)
29473 {
29474 return wait_event_interruptible(md->eventq,
29475 - (event_nr != atomic_read(&md->event_nr)));
29476 + (event_nr != atomic_read_unchecked(&md->event_nr)));
29477 }
29478
29479 void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
29480 diff -urNp linux-3.0.8/drivers/md/dm-ioctl.c linux-3.0.8/drivers/md/dm-ioctl.c
29481 --- linux-3.0.8/drivers/md/dm-ioctl.c 2011-07-21 22:17:23.000000000 -0400
29482 +++ linux-3.0.8/drivers/md/dm-ioctl.c 2011-08-23 21:47:55.000000000 -0400
29483 @@ -1551,7 +1551,7 @@ static int validate_params(uint cmd, str
29484 cmd == DM_LIST_VERSIONS_CMD)
29485 return 0;
29486
29487 - if ((cmd == DM_DEV_CREATE_CMD)) {
29488 + if (cmd == DM_DEV_CREATE_CMD) {
29489 if (!*param->name) {
29490 DMWARN("name not supplied when creating device");
29491 return -EINVAL;
29492 diff -urNp linux-3.0.8/drivers/md/dm-raid1.c linux-3.0.8/drivers/md/dm-raid1.c
29493 --- linux-3.0.8/drivers/md/dm-raid1.c 2011-07-21 22:17:23.000000000 -0400
29494 +++ linux-3.0.8/drivers/md/dm-raid1.c 2011-08-23 21:47:55.000000000 -0400
29495 @@ -40,7 +40,7 @@ enum dm_raid1_error {
29496
29497 struct mirror {
29498 struct mirror_set *ms;
29499 - atomic_t error_count;
29500 + atomic_unchecked_t error_count;
29501 unsigned long error_type;
29502 struct dm_dev *dev;
29503 sector_t offset;
29504 @@ -185,7 +185,7 @@ static struct mirror *get_valid_mirror(s
29505 struct mirror *m;
29506
29507 for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++)
29508 - if (!atomic_read(&m->error_count))
29509 + if (!atomic_read_unchecked(&m->error_count))
29510 return m;
29511
29512 return NULL;
29513 @@ -217,7 +217,7 @@ static void fail_mirror(struct mirror *m
29514 * simple way to tell if a device has encountered
29515 * errors.
29516 */
29517 - atomic_inc(&m->error_count);
29518 + atomic_inc_unchecked(&m->error_count);
29519
29520 if (test_and_set_bit(error_type, &m->error_type))
29521 return;
29522 @@ -408,7 +408,7 @@ static struct mirror *choose_mirror(stru
29523 struct mirror *m = get_default_mirror(ms);
29524
29525 do {
29526 - if (likely(!atomic_read(&m->error_count)))
29527 + if (likely(!atomic_read_unchecked(&m->error_count)))
29528 return m;
29529
29530 if (m-- == ms->mirror)
29531 @@ -422,7 +422,7 @@ static int default_ok(struct mirror *m)
29532 {
29533 struct mirror *default_mirror = get_default_mirror(m->ms);
29534
29535 - return !atomic_read(&default_mirror->error_count);
29536 + return !atomic_read_unchecked(&default_mirror->error_count);
29537 }
29538
29539 static int mirror_available(struct mirror_set *ms, struct bio *bio)
29540 @@ -559,7 +559,7 @@ static void do_reads(struct mirror_set *
29541 */
29542 if (likely(region_in_sync(ms, region, 1)))
29543 m = choose_mirror(ms, bio->bi_sector);
29544 - else if (m && atomic_read(&m->error_count))
29545 + else if (m && atomic_read_unchecked(&m->error_count))
29546 m = NULL;
29547
29548 if (likely(m))
29549 @@ -937,7 +937,7 @@ static int get_mirror(struct mirror_set
29550 }
29551
29552 ms->mirror[mirror].ms = ms;
29553 - atomic_set(&(ms->mirror[mirror].error_count), 0);
29554 + atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
29555 ms->mirror[mirror].error_type = 0;
29556 ms->mirror[mirror].offset = offset;
29557
29558 @@ -1347,7 +1347,7 @@ static void mirror_resume(struct dm_targ
29559 */
29560 static char device_status_char(struct mirror *m)
29561 {
29562 - if (!atomic_read(&(m->error_count)))
29563 + if (!atomic_read_unchecked(&(m->error_count)))
29564 return 'A';
29565
29566 return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' :
29567 diff -urNp linux-3.0.8/drivers/md/dm-stripe.c linux-3.0.8/drivers/md/dm-stripe.c
29568 --- linux-3.0.8/drivers/md/dm-stripe.c 2011-07-21 22:17:23.000000000 -0400
29569 +++ linux-3.0.8/drivers/md/dm-stripe.c 2011-08-23 21:47:55.000000000 -0400
29570 @@ -20,7 +20,7 @@ struct stripe {
29571 struct dm_dev *dev;
29572 sector_t physical_start;
29573
29574 - atomic_t error_count;
29575 + atomic_unchecked_t error_count;
29576 };
29577
29578 struct stripe_c {
29579 @@ -192,7 +192,7 @@ static int stripe_ctr(struct dm_target *
29580 kfree(sc);
29581 return r;
29582 }
29583 - atomic_set(&(sc->stripe[i].error_count), 0);
29584 + atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
29585 }
29586
29587 ti->private = sc;
29588 @@ -314,7 +314,7 @@ static int stripe_status(struct dm_targe
29589 DMEMIT("%d ", sc->stripes);
29590 for (i = 0; i < sc->stripes; i++) {
29591 DMEMIT("%s ", sc->stripe[i].dev->name);
29592 - buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
29593 + buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
29594 'D' : 'A';
29595 }
29596 buffer[i] = '\0';
29597 @@ -361,8 +361,8 @@ static int stripe_end_io(struct dm_targe
29598 */
29599 for (i = 0; i < sc->stripes; i++)
29600 if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
29601 - atomic_inc(&(sc->stripe[i].error_count));
29602 - if (atomic_read(&(sc->stripe[i].error_count)) <
29603 + atomic_inc_unchecked(&(sc->stripe[i].error_count));
29604 + if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
29605 DM_IO_ERROR_THRESHOLD)
29606 schedule_work(&sc->trigger_event);
29607 }
29608 diff -urNp linux-3.0.8/drivers/md/dm-table.c linux-3.0.8/drivers/md/dm-table.c
29609 --- linux-3.0.8/drivers/md/dm-table.c 2011-10-24 08:05:32.000000000 -0400
29610 +++ linux-3.0.8/drivers/md/dm-table.c 2011-10-17 23:17:19.000000000 -0400
29611 @@ -390,7 +390,7 @@ static int device_area_is_invalid(struct
29612 if (!dev_size)
29613 return 0;
29614
29615 - if ((start >= dev_size) || (start + len > dev_size)) {
29616 + if ((start >= dev_size) || (len > dev_size - start)) {
29617 DMWARN("%s: %s too small for target: "
29618 "start=%llu, len=%llu, dev_size=%llu",
29619 dm_device_name(ti->table->md), bdevname(bdev, b),
29620 diff -urNp linux-3.0.8/drivers/md/md.c linux-3.0.8/drivers/md/md.c
29621 --- linux-3.0.8/drivers/md/md.c 2011-10-24 08:05:32.000000000 -0400
29622 +++ linux-3.0.8/drivers/md/md.c 2011-10-17 23:17:19.000000000 -0400
29623 @@ -231,10 +231,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev);
29624 * start build, activate spare
29625 */
29626 static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
29627 -static atomic_t md_event_count;
29628 +static atomic_unchecked_t md_event_count;
29629 void md_new_event(mddev_t *mddev)
29630 {
29631 - atomic_inc(&md_event_count);
29632 + atomic_inc_unchecked(&md_event_count);
29633 wake_up(&md_event_waiters);
29634 }
29635 EXPORT_SYMBOL_GPL(md_new_event);
29636 @@ -244,7 +244,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
29637 */
29638 static void md_new_event_inintr(mddev_t *mddev)
29639 {
29640 - atomic_inc(&md_event_count);
29641 + atomic_inc_unchecked(&md_event_count);
29642 wake_up(&md_event_waiters);
29643 }
29644
29645 @@ -1475,7 +1475,7 @@ static int super_1_load(mdk_rdev_t *rdev
29646
29647 rdev->preferred_minor = 0xffff;
29648 rdev->data_offset = le64_to_cpu(sb->data_offset);
29649 - atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
29650 + atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
29651
29652 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
29653 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
29654 @@ -1653,7 +1653,7 @@ static void super_1_sync(mddev_t *mddev,
29655 else
29656 sb->resync_offset = cpu_to_le64(0);
29657
29658 - sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
29659 + sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
29660
29661 sb->raid_disks = cpu_to_le32(mddev->raid_disks);
29662 sb->size = cpu_to_le64(mddev->dev_sectors);
29663 @@ -2446,7 +2446,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_sho
29664 static ssize_t
29665 errors_show(mdk_rdev_t *rdev, char *page)
29666 {
29667 - return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
29668 + return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
29669 }
29670
29671 static ssize_t
29672 @@ -2455,7 +2455,7 @@ errors_store(mdk_rdev_t *rdev, const cha
29673 char *e;
29674 unsigned long n = simple_strtoul(buf, &e, 10);
29675 if (*buf && (*e == 0 || *e == '\n')) {
29676 - atomic_set(&rdev->corrected_errors, n);
29677 + atomic_set_unchecked(&rdev->corrected_errors, n);
29678 return len;
29679 }
29680 return -EINVAL;
29681 @@ -2811,8 +2811,8 @@ void md_rdev_init(mdk_rdev_t *rdev)
29682 rdev->last_read_error.tv_sec = 0;
29683 rdev->last_read_error.tv_nsec = 0;
29684 atomic_set(&rdev->nr_pending, 0);
29685 - atomic_set(&rdev->read_errors, 0);
29686 - atomic_set(&rdev->corrected_errors, 0);
29687 + atomic_set_unchecked(&rdev->read_errors, 0);
29688 + atomic_set_unchecked(&rdev->corrected_errors, 0);
29689
29690 INIT_LIST_HEAD(&rdev->same_set);
29691 init_waitqueue_head(&rdev->blocked_wait);
29692 @@ -6440,7 +6440,7 @@ static int md_seq_show(struct seq_file *
29693
29694 spin_unlock(&pers_lock);
29695 seq_printf(seq, "\n");
29696 - mi->event = atomic_read(&md_event_count);
29697 + mi->event = atomic_read_unchecked(&md_event_count);
29698 return 0;
29699 }
29700 if (v == (void*)2) {
29701 @@ -6529,7 +6529,7 @@ static int md_seq_show(struct seq_file *
29702 chunk_kb ? "KB" : "B");
29703 if (bitmap->file) {
29704 seq_printf(seq, ", file: ");
29705 - seq_path(seq, &bitmap->file->f_path, " \t\n");
29706 + seq_path(seq, &bitmap->file->f_path, " \t\n\\");
29707 }
29708
29709 seq_printf(seq, "\n");
29710 @@ -6563,7 +6563,7 @@ static int md_seq_open(struct inode *ino
29711 else {
29712 struct seq_file *p = file->private_data;
29713 p->private = mi;
29714 - mi->event = atomic_read(&md_event_count);
29715 + mi->event = atomic_read_unchecked(&md_event_count);
29716 }
29717 return error;
29718 }
29719 @@ -6579,7 +6579,7 @@ static unsigned int mdstat_poll(struct f
29720 /* always allow read */
29721 mask = POLLIN | POLLRDNORM;
29722
29723 - if (mi->event != atomic_read(&md_event_count))
29724 + if (mi->event != atomic_read_unchecked(&md_event_count))
29725 mask |= POLLERR | POLLPRI;
29726 return mask;
29727 }
29728 @@ -6623,7 +6623,7 @@ static int is_mddev_idle(mddev_t *mddev,
29729 struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
29730 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
29731 (int)part_stat_read(&disk->part0, sectors[1]) -
29732 - atomic_read(&disk->sync_io);
29733 + atomic_read_unchecked(&disk->sync_io);
29734 /* sync IO will cause sync_io to increase before the disk_stats
29735 * as sync_io is counted when a request starts, and
29736 * disk_stats is counted when it completes.
29737 diff -urNp linux-3.0.8/drivers/md/md.h linux-3.0.8/drivers/md/md.h
29738 --- linux-3.0.8/drivers/md/md.h 2011-10-24 08:05:32.000000000 -0400
29739 +++ linux-3.0.8/drivers/md/md.h 2011-10-17 23:17:19.000000000 -0400
29740 @@ -97,13 +97,13 @@ struct mdk_rdev_s
29741 * only maintained for arrays that
29742 * support hot removal
29743 */
29744 - atomic_t read_errors; /* number of consecutive read errors that
29745 + atomic_unchecked_t read_errors; /* number of consecutive read errors that
29746 * we have tried to ignore.
29747 */
29748 struct timespec last_read_error; /* monotonic time since our
29749 * last read error
29750 */
29751 - atomic_t corrected_errors; /* number of corrected read errors,
29752 + atomic_unchecked_t corrected_errors; /* number of corrected read errors,
29753 * for reporting to userspace and storing
29754 * in superblock.
29755 */
29756 @@ -344,7 +344,7 @@ static inline void rdev_dec_pending(mdk_
29757
29758 static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
29759 {
29760 - atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
29761 + atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
29762 }
29763
29764 struct mdk_personality
29765 diff -urNp linux-3.0.8/drivers/md/raid10.c linux-3.0.8/drivers/md/raid10.c
29766 --- linux-3.0.8/drivers/md/raid10.c 2011-10-24 08:05:32.000000000 -0400
29767 +++ linux-3.0.8/drivers/md/raid10.c 2011-10-17 23:17:19.000000000 -0400
29768 @@ -1186,7 +1186,7 @@ static void end_sync_read(struct bio *bi
29769 if (test_bit(BIO_UPTODATE, &bio->bi_flags))
29770 set_bit(R10BIO_Uptodate, &r10_bio->state);
29771 else {
29772 - atomic_add(r10_bio->sectors,
29773 + atomic_add_unchecked(r10_bio->sectors,
29774 &conf->mirrors[d].rdev->corrected_errors);
29775 if (!test_bit(MD_RECOVERY_SYNC, &conf->mddev->recovery))
29776 md_error(r10_bio->mddev,
29777 @@ -1394,7 +1394,7 @@ static void check_decay_read_errors(mdde
29778 {
29779 struct timespec cur_time_mon;
29780 unsigned long hours_since_last;
29781 - unsigned int read_errors = atomic_read(&rdev->read_errors);
29782 + unsigned int read_errors = atomic_read_unchecked(&rdev->read_errors);
29783
29784 ktime_get_ts(&cur_time_mon);
29785
29786 @@ -1416,9 +1416,9 @@ static void check_decay_read_errors(mdde
29787 * overflowing the shift of read_errors by hours_since_last.
29788 */
29789 if (hours_since_last >= 8 * sizeof(read_errors))
29790 - atomic_set(&rdev->read_errors, 0);
29791 + atomic_set_unchecked(&rdev->read_errors, 0);
29792 else
29793 - atomic_set(&rdev->read_errors, read_errors >> hours_since_last);
29794 + atomic_set_unchecked(&rdev->read_errors, read_errors >> hours_since_last);
29795 }
29796
29797 /*
29798 @@ -1448,8 +1448,8 @@ static void fix_read_error(conf_t *conf,
29799 return;
29800
29801 check_decay_read_errors(mddev, rdev);
29802 - atomic_inc(&rdev->read_errors);
29803 - if (atomic_read(&rdev->read_errors) > max_read_errors) {
29804 + atomic_inc_unchecked(&rdev->read_errors);
29805 + if (atomic_read_unchecked(&rdev->read_errors) > max_read_errors) {
29806 char b[BDEVNAME_SIZE];
29807 bdevname(rdev->bdev, b);
29808
29809 @@ -1457,7 +1457,7 @@ static void fix_read_error(conf_t *conf,
29810 "md/raid10:%s: %s: Raid device exceeded "
29811 "read_error threshold [cur %d:max %d]\n",
29812 mdname(mddev), b,
29813 - atomic_read(&rdev->read_errors), max_read_errors);
29814 + atomic_read_unchecked(&rdev->read_errors), max_read_errors);
29815 printk(KERN_NOTICE
29816 "md/raid10:%s: %s: Failing raid device\n",
29817 mdname(mddev), b);
29818 @@ -1520,7 +1520,7 @@ static void fix_read_error(conf_t *conf,
29819 test_bit(In_sync, &rdev->flags)) {
29820 atomic_inc(&rdev->nr_pending);
29821 rcu_read_unlock();
29822 - atomic_add(s, &rdev->corrected_errors);
29823 + atomic_add_unchecked(s, &rdev->corrected_errors);
29824 if (sync_page_io(rdev,
29825 r10_bio->devs[sl].addr +
29826 sect,
29827 diff -urNp linux-3.0.8/drivers/md/raid1.c linux-3.0.8/drivers/md/raid1.c
29828 --- linux-3.0.8/drivers/md/raid1.c 2011-10-24 08:05:32.000000000 -0400
29829 +++ linux-3.0.8/drivers/md/raid1.c 2011-10-17 23:17:19.000000000 -0400
29830 @@ -1263,7 +1263,7 @@ static int fix_sync_read_error(r1bio_t *
29831 rdev_dec_pending(rdev, mddev);
29832 md_error(mddev, rdev);
29833 } else
29834 - atomic_add(s, &rdev->corrected_errors);
29835 + atomic_add_unchecked(s, &rdev->corrected_errors);
29836 }
29837 d = start;
29838 while (d != r1_bio->read_disk) {
29839 @@ -1492,7 +1492,7 @@ static void fix_read_error(conf_t *conf,
29840 /* Well, this device is dead */
29841 md_error(mddev, rdev);
29842 else {
29843 - atomic_add(s, &rdev->corrected_errors);
29844 + atomic_add_unchecked(s, &rdev->corrected_errors);
29845 printk(KERN_INFO
29846 "md/raid1:%s: read error corrected "
29847 "(%d sectors at %llu on %s)\n",
29848 diff -urNp linux-3.0.8/drivers/md/raid5.c linux-3.0.8/drivers/md/raid5.c
29849 --- linux-3.0.8/drivers/md/raid5.c 2011-10-24 08:05:32.000000000 -0400
29850 +++ linux-3.0.8/drivers/md/raid5.c 2011-10-17 23:17:19.000000000 -0400
29851 @@ -550,7 +550,7 @@ static void ops_run_io(struct stripe_hea
29852 bi->bi_next = NULL;
29853 if ((rw & WRITE) &&
29854 test_bit(R5_ReWrite, &sh->dev[i].flags))
29855 - atomic_add(STRIPE_SECTORS,
29856 + atomic_add_unchecked(STRIPE_SECTORS,
29857 &rdev->corrected_errors);
29858 generic_make_request(bi);
29859 } else {
29860 @@ -1596,15 +1596,15 @@ static void raid5_end_read_request(struc
29861 clear_bit(R5_ReadError, &sh->dev[i].flags);
29862 clear_bit(R5_ReWrite, &sh->dev[i].flags);
29863 }
29864 - if (atomic_read(&conf->disks[i].rdev->read_errors))
29865 - atomic_set(&conf->disks[i].rdev->read_errors, 0);
29866 + if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
29867 + atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
29868 } else {
29869 const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
29870 int retry = 0;
29871 rdev = conf->disks[i].rdev;
29872
29873 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
29874 - atomic_inc(&rdev->read_errors);
29875 + atomic_inc_unchecked(&rdev->read_errors);
29876 if (conf->mddev->degraded >= conf->max_degraded)
29877 printk_rl(KERN_WARNING
29878 "md/raid:%s: read error not correctable "
29879 @@ -1622,7 +1622,7 @@ static void raid5_end_read_request(struc
29880 (unsigned long long)(sh->sector
29881 + rdev->data_offset),
29882 bdn);
29883 - else if (atomic_read(&rdev->read_errors)
29884 + else if (atomic_read_unchecked(&rdev->read_errors)
29885 > conf->max_nr_stripes)
29886 printk(KERN_WARNING
29887 "md/raid:%s: Too many read errors, failing device %s.\n",
29888 @@ -1945,6 +1945,7 @@ static sector_t compute_blocknr(struct s
29889 sector_t r_sector;
29890 struct stripe_head sh2;
29891
29892 + pax_track_stack();
29893
29894 chunk_offset = sector_div(new_sector, sectors_per_chunk);
29895 stripe = new_sector;
29896 diff -urNp linux-3.0.8/drivers/media/common/saa7146_hlp.c linux-3.0.8/drivers/media/common/saa7146_hlp.c
29897 --- linux-3.0.8/drivers/media/common/saa7146_hlp.c 2011-07-21 22:17:23.000000000 -0400
29898 +++ linux-3.0.8/drivers/media/common/saa7146_hlp.c 2011-08-23 21:48:14.000000000 -0400
29899 @@ -353,6 +353,8 @@ static void calculate_clipping_registers
29900
29901 int x[32], y[32], w[32], h[32];
29902
29903 + pax_track_stack();
29904 +
29905 /* clear out memory */
29906 memset(&line_list[0], 0x00, sizeof(u32)*32);
29907 memset(&pixel_list[0], 0x00, sizeof(u32)*32);
29908 diff -urNp linux-3.0.8/drivers/media/dvb/dvb-core/dvb_ca_en50221.c linux-3.0.8/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
29909 --- linux-3.0.8/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-07-21 22:17:23.000000000 -0400
29910 +++ linux-3.0.8/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-08-23 21:48:14.000000000 -0400
29911 @@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(stru
29912 u8 buf[HOST_LINK_BUF_SIZE];
29913 int i;
29914
29915 + pax_track_stack();
29916 +
29917 dprintk("%s\n", __func__);
29918
29919 /* check if we have space for a link buf in the rx_buffer */
29920 @@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(s
29921 unsigned long timeout;
29922 int written;
29923
29924 + pax_track_stack();
29925 +
29926 dprintk("%s\n", __func__);
29927
29928 /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
29929 diff -urNp linux-3.0.8/drivers/media/dvb/dvb-core/dvb_demux.h linux-3.0.8/drivers/media/dvb/dvb-core/dvb_demux.h
29930 --- linux-3.0.8/drivers/media/dvb/dvb-core/dvb_demux.h 2011-07-21 22:17:23.000000000 -0400
29931 +++ linux-3.0.8/drivers/media/dvb/dvb-core/dvb_demux.h 2011-08-24 18:24:40.000000000 -0400
29932 @@ -68,12 +68,12 @@ struct dvb_demux_feed {
29933 union {
29934 struct dmx_ts_feed ts;
29935 struct dmx_section_feed sec;
29936 - } feed;
29937 + } __no_const feed;
29938
29939 union {
29940 dmx_ts_cb ts;
29941 dmx_section_cb sec;
29942 - } cb;
29943 + } __no_const cb;
29944
29945 struct dvb_demux *demux;
29946 void *priv;
29947 diff -urNp linux-3.0.8/drivers/media/dvb/dvb-core/dvbdev.c linux-3.0.8/drivers/media/dvb/dvb-core/dvbdev.c
29948 --- linux-3.0.8/drivers/media/dvb/dvb-core/dvbdev.c 2011-07-21 22:17:23.000000000 -0400
29949 +++ linux-3.0.8/drivers/media/dvb/dvb-core/dvbdev.c 2011-08-24 18:24:19.000000000 -0400
29950 @@ -192,7 +192,7 @@ int dvb_register_device(struct dvb_adapt
29951 const struct dvb_device *template, void *priv, int type)
29952 {
29953 struct dvb_device *dvbdev;
29954 - struct file_operations *dvbdevfops;
29955 + file_operations_no_const *dvbdevfops;
29956 struct device *clsdev;
29957 int minor;
29958 int id;
29959 diff -urNp linux-3.0.8/drivers/media/dvb/dvb-usb/cxusb.c linux-3.0.8/drivers/media/dvb/dvb-usb/cxusb.c
29960 --- linux-3.0.8/drivers/media/dvb/dvb-usb/cxusb.c 2011-07-21 22:17:23.000000000 -0400
29961 +++ linux-3.0.8/drivers/media/dvb/dvb-usb/cxusb.c 2011-08-24 18:26:33.000000000 -0400
29962 @@ -1059,7 +1059,7 @@ static struct dib0070_config dib7070p_di
29963 struct dib0700_adapter_state {
29964 int (*set_param_save) (struct dvb_frontend *,
29965 struct dvb_frontend_parameters *);
29966 -};
29967 +} __no_const;
29968
29969 static int dib7070_set_param_override(struct dvb_frontend *fe,
29970 struct dvb_frontend_parameters *fep)
29971 diff -urNp linux-3.0.8/drivers/media/dvb/dvb-usb/dib0700_core.c linux-3.0.8/drivers/media/dvb/dvb-usb/dib0700_core.c
29972 --- linux-3.0.8/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-07-21 22:17:23.000000000 -0400
29973 +++ linux-3.0.8/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-08-23 21:48:14.000000000 -0400
29974 @@ -434,6 +434,8 @@ int dib0700_download_firmware(struct usb
29975 if (!buf)
29976 return -ENOMEM;
29977
29978 + pax_track_stack();
29979 +
29980 while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
29981 deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",
29982 hx.addr, hx.len, hx.chk);
29983 diff -urNp linux-3.0.8/drivers/media/dvb/dvb-usb/dibusb.h linux-3.0.8/drivers/media/dvb/dvb-usb/dibusb.h
29984 --- linux-3.0.8/drivers/media/dvb/dvb-usb/dibusb.h 2011-07-21 22:17:23.000000000 -0400
29985 +++ linux-3.0.8/drivers/media/dvb/dvb-usb/dibusb.h 2011-08-24 18:27:27.000000000 -0400
29986 @@ -97,7 +97,7 @@
29987 #define DIBUSB_IOCTL_CMD_DISABLE_STREAM 0x02
29988
29989 struct dibusb_state {
29990 - struct dib_fe_xfer_ops ops;
29991 + dib_fe_xfer_ops_no_const ops;
29992 int mt2060_present;
29993 u8 tuner_addr;
29994 };
29995 diff -urNp linux-3.0.8/drivers/media/dvb/dvb-usb/dw2102.c linux-3.0.8/drivers/media/dvb/dvb-usb/dw2102.c
29996 --- linux-3.0.8/drivers/media/dvb/dvb-usb/dw2102.c 2011-07-21 22:17:23.000000000 -0400
29997 +++ linux-3.0.8/drivers/media/dvb/dvb-usb/dw2102.c 2011-08-24 18:27:45.000000000 -0400
29998 @@ -95,7 +95,7 @@ struct su3000_state {
29999
30000 struct s6x0_state {
30001 int (*old_set_voltage)(struct dvb_frontend *f, fe_sec_voltage_t v);
30002 -};
30003 +} __no_const;
30004
30005 /* debug */
30006 static int dvb_usb_dw2102_debug;
30007 diff -urNp linux-3.0.8/drivers/media/dvb/dvb-usb/lmedm04.c linux-3.0.8/drivers/media/dvb/dvb-usb/lmedm04.c
30008 --- linux-3.0.8/drivers/media/dvb/dvb-usb/lmedm04.c 2011-07-21 22:17:23.000000000 -0400
30009 +++ linux-3.0.8/drivers/media/dvb/dvb-usb/lmedm04.c 2011-08-23 21:48:14.000000000 -0400
30010 @@ -742,6 +742,7 @@ static int lme2510_download_firmware(str
30011 usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
30012 0x06, 0x80, 0x0200, 0x00, data, 0x0109, 1000);
30013
30014 + pax_track_stack();
30015
30016 data[0] = 0x8a;
30017 len_in = 1;
30018 @@ -764,6 +765,8 @@ static void lme_coldreset(struct usb_dev
30019 int ret = 0, len_in;
30020 u8 data[512] = {0};
30021
30022 + pax_track_stack();
30023 +
30024 data[0] = 0x0a;
30025 len_in = 1;
30026 info("FRM Firmware Cold Reset");
30027 diff -urNp linux-3.0.8/drivers/media/dvb/frontends/dib3000.h linux-3.0.8/drivers/media/dvb/frontends/dib3000.h
30028 --- linux-3.0.8/drivers/media/dvb/frontends/dib3000.h 2011-07-21 22:17:23.000000000 -0400
30029 +++ linux-3.0.8/drivers/media/dvb/frontends/dib3000.h 2011-10-07 19:07:39.000000000 -0400
30030 @@ -40,10 +40,11 @@ struct dib_fe_xfer_ops
30031 int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff);
30032 int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl);
30033 };
30034 +typedef struct dib_fe_xfer_ops __no_const dib_fe_xfer_ops_no_const;
30035
30036 #if defined(CONFIG_DVB_DIB3000MB) || (defined(CONFIG_DVB_DIB3000MB_MODULE) && defined(MODULE))
30037 extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
30038 - struct i2c_adapter* i2c, struct dib_fe_xfer_ops *xfer_ops);
30039 + struct i2c_adapter* i2c, dib_fe_xfer_ops_no_const *xfer_ops);
30040 #else
30041 static inline struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
30042 struct i2c_adapter* i2c, struct dib_fe_xfer_ops *xfer_ops)
30043 diff -urNp linux-3.0.8/drivers/media/dvb/frontends/dib3000mb.c linux-3.0.8/drivers/media/dvb/frontends/dib3000mb.c
30044 --- linux-3.0.8/drivers/media/dvb/frontends/dib3000mb.c 2011-07-21 22:17:23.000000000 -0400
30045 +++ linux-3.0.8/drivers/media/dvb/frontends/dib3000mb.c 2011-08-24 18:28:42.000000000 -0400
30046 @@ -756,7 +756,7 @@ static int dib3000mb_tuner_pass_ctrl(str
30047 static struct dvb_frontend_ops dib3000mb_ops;
30048
30049 struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
30050 - struct i2c_adapter* i2c, struct dib_fe_xfer_ops *xfer_ops)
30051 + struct i2c_adapter* i2c, dib_fe_xfer_ops_no_const *xfer_ops)
30052 {
30053 struct dib3000_state* state = NULL;
30054
30055 diff -urNp linux-3.0.8/drivers/media/dvb/frontends/mb86a16.c linux-3.0.8/drivers/media/dvb/frontends/mb86a16.c
30056 --- linux-3.0.8/drivers/media/dvb/frontends/mb86a16.c 2011-07-21 22:17:23.000000000 -0400
30057 +++ linux-3.0.8/drivers/media/dvb/frontends/mb86a16.c 2011-08-23 21:48:14.000000000 -0400
30058 @@ -1060,6 +1060,8 @@ static int mb86a16_set_fe(struct mb86a16
30059 int ret = -1;
30060 int sync;
30061
30062 + pax_track_stack();
30063 +
30064 dprintk(verbose, MB86A16_INFO, 1, "freq=%d Mhz, symbrt=%d Ksps", state->frequency, state->srate);
30065
30066 fcp = 3000;
30067 diff -urNp linux-3.0.8/drivers/media/dvb/frontends/or51211.c linux-3.0.8/drivers/media/dvb/frontends/or51211.c
30068 --- linux-3.0.8/drivers/media/dvb/frontends/or51211.c 2011-07-21 22:17:23.000000000 -0400
30069 +++ linux-3.0.8/drivers/media/dvb/frontends/or51211.c 2011-08-23 21:48:14.000000000 -0400
30070 @@ -113,6 +113,8 @@ static int or51211_load_firmware (struct
30071 u8 tudata[585];
30072 int i;
30073
30074 + pax_track_stack();
30075 +
30076 dprintk("Firmware is %zd bytes\n",fw->size);
30077
30078 /* Get eprom data */
30079 diff -urNp linux-3.0.8/drivers/media/dvb/ngene/ngene-cards.c linux-3.0.8/drivers/media/dvb/ngene/ngene-cards.c
30080 --- linux-3.0.8/drivers/media/dvb/ngene/ngene-cards.c 2011-07-21 22:17:23.000000000 -0400
30081 +++ linux-3.0.8/drivers/media/dvb/ngene/ngene-cards.c 2011-10-11 10:44:33.000000000 -0400
30082 @@ -379,7 +379,7 @@ static struct ngene_info ngene_info_m780
30083
30084 /****************************************************************************/
30085
30086 -static const struct pci_device_id ngene_id_tbl[] __devinitdata = {
30087 +static const struct pci_device_id ngene_id_tbl[] __devinitconst = {
30088 NGENE_ID(0x18c3, 0xabc3, ngene_info_cineS2),
30089 NGENE_ID(0x18c3, 0xabc4, ngene_info_cineS2),
30090 NGENE_ID(0x18c3, 0xdb01, ngene_info_satixS2),
30091 diff -urNp linux-3.0.8/drivers/media/video/cx18/cx18-driver.c linux-3.0.8/drivers/media/video/cx18/cx18-driver.c
30092 --- linux-3.0.8/drivers/media/video/cx18/cx18-driver.c 2011-07-21 22:17:23.000000000 -0400
30093 +++ linux-3.0.8/drivers/media/video/cx18/cx18-driver.c 2011-08-23 21:48:14.000000000 -0400
30094 @@ -327,6 +327,8 @@ void cx18_read_eeprom(struct cx18 *cx, s
30095 struct i2c_client c;
30096 u8 eedata[256];
30097
30098 + pax_track_stack();
30099 +
30100 memset(&c, 0, sizeof(c));
30101 strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
30102 c.adapter = &cx->i2c_adap[0];
30103 diff -urNp linux-3.0.8/drivers/media/video/cx23885/cx23885-input.c linux-3.0.8/drivers/media/video/cx23885/cx23885-input.c
30104 --- linux-3.0.8/drivers/media/video/cx23885/cx23885-input.c 2011-07-21 22:17:23.000000000 -0400
30105 +++ linux-3.0.8/drivers/media/video/cx23885/cx23885-input.c 2011-08-23 21:48:14.000000000 -0400
30106 @@ -53,6 +53,8 @@ static void cx23885_input_process_measur
30107 bool handle = false;
30108 struct ir_raw_event ir_core_event[64];
30109
30110 + pax_track_stack();
30111 +
30112 do {
30113 num = 0;
30114 v4l2_subdev_call(dev->sd_ir, ir, rx_read, (u8 *) ir_core_event,
30115 diff -urNp linux-3.0.8/drivers/media/video/cx88/cx88-alsa.c linux-3.0.8/drivers/media/video/cx88/cx88-alsa.c
30116 --- linux-3.0.8/drivers/media/video/cx88/cx88-alsa.c 2011-07-21 22:17:23.000000000 -0400
30117 +++ linux-3.0.8/drivers/media/video/cx88/cx88-alsa.c 2011-10-11 10:44:33.000000000 -0400
30118 @@ -764,7 +764,7 @@ static struct snd_kcontrol_new snd_cx88_
30119 * Only boards with eeprom and byte 1 at eeprom=1 have it
30120 */
30121
30122 -static const struct pci_device_id const cx88_audio_pci_tbl[] __devinitdata = {
30123 +static const struct pci_device_id const cx88_audio_pci_tbl[] __devinitconst = {
30124 {0x14f1,0x8801,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
30125 {0x14f1,0x8811,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
30126 {0, }
30127 diff -urNp linux-3.0.8/drivers/media/video/pvrusb2/pvrusb2-eeprom.c linux-3.0.8/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
30128 --- linux-3.0.8/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-07-21 22:17:23.000000000 -0400
30129 +++ linux-3.0.8/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-08-23 21:48:14.000000000 -0400
30130 @@ -120,6 +120,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw
30131 u8 *eeprom;
30132 struct tveeprom tvdata;
30133
30134 + pax_track_stack();
30135 +
30136 memset(&tvdata,0,sizeof(tvdata));
30137
30138 eeprom = pvr2_eeprom_fetch(hdw);
30139 diff -urNp linux-3.0.8/drivers/media/video/saa7134/saa6752hs.c linux-3.0.8/drivers/media/video/saa7134/saa6752hs.c
30140 --- linux-3.0.8/drivers/media/video/saa7134/saa6752hs.c 2011-07-21 22:17:23.000000000 -0400
30141 +++ linux-3.0.8/drivers/media/video/saa7134/saa6752hs.c 2011-08-23 21:48:14.000000000 -0400
30142 @@ -682,6 +682,8 @@ static int saa6752hs_init(struct v4l2_su
30143 unsigned char localPAT[256];
30144 unsigned char localPMT[256];
30145
30146 + pax_track_stack();
30147 +
30148 /* Set video format - must be done first as it resets other settings */
30149 set_reg8(client, 0x41, h->video_format);
30150
30151 diff -urNp linux-3.0.8/drivers/media/video/saa7164/saa7164-cmd.c linux-3.0.8/drivers/media/video/saa7164/saa7164-cmd.c
30152 --- linux-3.0.8/drivers/media/video/saa7164/saa7164-cmd.c 2011-07-21 22:17:23.000000000 -0400
30153 +++ linux-3.0.8/drivers/media/video/saa7164/saa7164-cmd.c 2011-08-23 21:48:14.000000000 -0400
30154 @@ -88,6 +88,8 @@ int saa7164_irq_dequeue(struct saa7164_d
30155 u8 tmp[512];
30156 dprintk(DBGLVL_CMD, "%s()\n", __func__);
30157
30158 + pax_track_stack();
30159 +
30160 /* While any outstand message on the bus exists... */
30161 do {
30162
30163 @@ -141,6 +143,8 @@ int saa7164_cmd_dequeue(struct saa7164_d
30164 u8 tmp[512];
30165 dprintk(DBGLVL_CMD, "%s()\n", __func__);
30166
30167 + pax_track_stack();
30168 +
30169 while (loop) {
30170
30171 struct tmComResInfo tRsp = { 0, 0, 0, 0, 0, 0 };
30172 diff -urNp linux-3.0.8/drivers/media/video/timblogiw.c linux-3.0.8/drivers/media/video/timblogiw.c
30173 --- linux-3.0.8/drivers/media/video/timblogiw.c 2011-07-21 22:17:23.000000000 -0400
30174 +++ linux-3.0.8/drivers/media/video/timblogiw.c 2011-08-24 18:29:20.000000000 -0400
30175 @@ -745,7 +745,7 @@ static int timblogiw_mmap(struct file *f
30176
30177 /* Platform device functions */
30178
30179 -static __devinitconst struct v4l2_ioctl_ops timblogiw_ioctl_ops = {
30180 +static __devinitconst v4l2_ioctl_ops_no_const timblogiw_ioctl_ops = {
30181 .vidioc_querycap = timblogiw_querycap,
30182 .vidioc_enum_fmt_vid_cap = timblogiw_enum_fmt,
30183 .vidioc_g_fmt_vid_cap = timblogiw_g_fmt,
30184 diff -urNp linux-3.0.8/drivers/media/video/usbvision/usbvision-core.c linux-3.0.8/drivers/media/video/usbvision/usbvision-core.c
30185 --- linux-3.0.8/drivers/media/video/usbvision/usbvision-core.c 2011-07-21 22:17:23.000000000 -0400
30186 +++ linux-3.0.8/drivers/media/video/usbvision/usbvision-core.c 2011-08-23 21:48:14.000000000 -0400
30187 @@ -707,6 +707,8 @@ static enum parse_state usbvision_parse_
30188 unsigned char rv, gv, bv;
30189 static unsigned char *Y, *U, *V;
30190
30191 + pax_track_stack();
30192 +
30193 frame = usbvision->cur_frame;
30194 image_size = frame->frmwidth * frame->frmheight;
30195 if ((frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
30196 diff -urNp linux-3.0.8/drivers/media/video/videobuf-dma-sg.c linux-3.0.8/drivers/media/video/videobuf-dma-sg.c
30197 --- linux-3.0.8/drivers/media/video/videobuf-dma-sg.c 2011-07-21 22:17:23.000000000 -0400
30198 +++ linux-3.0.8/drivers/media/video/videobuf-dma-sg.c 2011-08-23 21:48:14.000000000 -0400
30199 @@ -606,6 +606,8 @@ void *videobuf_sg_alloc(size_t size)
30200 {
30201 struct videobuf_queue q;
30202
30203 + pax_track_stack();
30204 +
30205 /* Required to make generic handler to call __videobuf_alloc */
30206 q.int_ops = &sg_ops;
30207
30208 diff -urNp linux-3.0.8/drivers/message/fusion/mptbase.c linux-3.0.8/drivers/message/fusion/mptbase.c
30209 --- linux-3.0.8/drivers/message/fusion/mptbase.c 2011-07-21 22:17:23.000000000 -0400
30210 +++ linux-3.0.8/drivers/message/fusion/mptbase.c 2011-08-23 21:48:14.000000000 -0400
30211 @@ -6681,8 +6681,13 @@ static int mpt_iocinfo_proc_show(struct
30212 seq_printf(m, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
30213 seq_printf(m, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
30214
30215 +#ifdef CONFIG_GRKERNSEC_HIDESYM
30216 + seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n", NULL, NULL);
30217 +#else
30218 seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
30219 (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
30220 +#endif
30221 +
30222 /*
30223 * Rounding UP to nearest 4-kB boundary here...
30224 */
30225 diff -urNp linux-3.0.8/drivers/message/fusion/mptsas.c linux-3.0.8/drivers/message/fusion/mptsas.c
30226 --- linux-3.0.8/drivers/message/fusion/mptsas.c 2011-07-21 22:17:23.000000000 -0400
30227 +++ linux-3.0.8/drivers/message/fusion/mptsas.c 2011-08-23 21:47:55.000000000 -0400
30228 @@ -439,6 +439,23 @@ mptsas_is_end_device(struct mptsas_devin
30229 return 0;
30230 }
30231
30232 +static inline void
30233 +mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
30234 +{
30235 + if (phy_info->port_details) {
30236 + phy_info->port_details->rphy = rphy;
30237 + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
30238 + ioc->name, rphy));
30239 + }
30240 +
30241 + if (rphy) {
30242 + dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
30243 + &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
30244 + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
30245 + ioc->name, rphy, rphy->dev.release));
30246 + }
30247 +}
30248 +
30249 /* no mutex */
30250 static void
30251 mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
30252 @@ -477,23 +494,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *p
30253 return NULL;
30254 }
30255
30256 -static inline void
30257 -mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
30258 -{
30259 - if (phy_info->port_details) {
30260 - phy_info->port_details->rphy = rphy;
30261 - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
30262 - ioc->name, rphy));
30263 - }
30264 -
30265 - if (rphy) {
30266 - dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
30267 - &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
30268 - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
30269 - ioc->name, rphy, rphy->dev.release));
30270 - }
30271 -}
30272 -
30273 static inline struct sas_port *
30274 mptsas_get_port(struct mptsas_phyinfo *phy_info)
30275 {
30276 diff -urNp linux-3.0.8/drivers/message/fusion/mptscsih.c linux-3.0.8/drivers/message/fusion/mptscsih.c
30277 --- linux-3.0.8/drivers/message/fusion/mptscsih.c 2011-07-21 22:17:23.000000000 -0400
30278 +++ linux-3.0.8/drivers/message/fusion/mptscsih.c 2011-08-23 21:47:55.000000000 -0400
30279 @@ -1268,15 +1268,16 @@ mptscsih_info(struct Scsi_Host *SChost)
30280
30281 h = shost_priv(SChost);
30282
30283 - if (h) {
30284 - if (h->info_kbuf == NULL)
30285 - if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
30286 - return h->info_kbuf;
30287 - h->info_kbuf[0] = '\0';
30288 + if (!h)
30289 + return NULL;
30290
30291 - mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
30292 - h->info_kbuf[size-1] = '\0';
30293 - }
30294 + if (h->info_kbuf == NULL)
30295 + if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
30296 + return h->info_kbuf;
30297 + h->info_kbuf[0] = '\0';
30298 +
30299 + mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
30300 + h->info_kbuf[size-1] = '\0';
30301
30302 return h->info_kbuf;
30303 }
30304 diff -urNp linux-3.0.8/drivers/message/i2o/i2o_config.c linux-3.0.8/drivers/message/i2o/i2o_config.c
30305 --- linux-3.0.8/drivers/message/i2o/i2o_config.c 2011-07-21 22:17:23.000000000 -0400
30306 +++ linux-3.0.8/drivers/message/i2o/i2o_config.c 2011-08-23 21:48:14.000000000 -0400
30307 @@ -781,6 +781,8 @@ static int i2o_cfg_passthru(unsigned lon
30308 struct i2o_message *msg;
30309 unsigned int iop;
30310
30311 + pax_track_stack();
30312 +
30313 if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
30314 return -EFAULT;
30315
30316 diff -urNp linux-3.0.8/drivers/message/i2o/i2o_proc.c linux-3.0.8/drivers/message/i2o/i2o_proc.c
30317 --- linux-3.0.8/drivers/message/i2o/i2o_proc.c 2011-07-21 22:17:23.000000000 -0400
30318 +++ linux-3.0.8/drivers/message/i2o/i2o_proc.c 2011-08-23 21:47:55.000000000 -0400
30319 @@ -255,13 +255,6 @@ static char *scsi_devices[] = {
30320 "Array Controller Device"
30321 };
30322
30323 -static char *chtostr(u8 * chars, int n)
30324 -{
30325 - char tmp[256];
30326 - tmp[0] = 0;
30327 - return strncat(tmp, (char *)chars, n);
30328 -}
30329 -
30330 static int i2o_report_query_status(struct seq_file *seq, int block_status,
30331 char *group)
30332 {
30333 @@ -838,8 +831,7 @@ static int i2o_seq_show_ddm_table(struct
30334
30335 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
30336 seq_printf(seq, "%-#8x", ddm_table.module_id);
30337 - seq_printf(seq, "%-29s",
30338 - chtostr(ddm_table.module_name_version, 28));
30339 + seq_printf(seq, "%-.28s", ddm_table.module_name_version);
30340 seq_printf(seq, "%9d ", ddm_table.data_size);
30341 seq_printf(seq, "%8d", ddm_table.code_size);
30342
30343 @@ -940,8 +932,8 @@ static int i2o_seq_show_drivers_stored(s
30344
30345 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
30346 seq_printf(seq, "%-#8x", dst->module_id);
30347 - seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
30348 - seq_printf(seq, "%-9s", chtostr(dst->date, 8));
30349 + seq_printf(seq, "%-.28s", dst->module_name_version);
30350 + seq_printf(seq, "%-.8s", dst->date);
30351 seq_printf(seq, "%8d ", dst->module_size);
30352 seq_printf(seq, "%8d ", dst->mpb_size);
30353 seq_printf(seq, "0x%04x", dst->module_flags);
30354 @@ -1272,14 +1264,10 @@ static int i2o_seq_show_dev_identity(str
30355 seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
30356 seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
30357 seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
30358 - seq_printf(seq, "Vendor info : %s\n",
30359 - chtostr((u8 *) (work32 + 2), 16));
30360 - seq_printf(seq, "Product info : %s\n",
30361 - chtostr((u8 *) (work32 + 6), 16));
30362 - seq_printf(seq, "Description : %s\n",
30363 - chtostr((u8 *) (work32 + 10), 16));
30364 - seq_printf(seq, "Product rev. : %s\n",
30365 - chtostr((u8 *) (work32 + 14), 8));
30366 + seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
30367 + seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
30368 + seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
30369 + seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
30370
30371 seq_printf(seq, "Serial number : ");
30372 print_serial_number(seq, (u8 *) (work32 + 16),
30373 @@ -1324,10 +1312,8 @@ static int i2o_seq_show_ddm_identity(str
30374 }
30375
30376 seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
30377 - seq_printf(seq, "Module name : %s\n",
30378 - chtostr(result.module_name, 24));
30379 - seq_printf(seq, "Module revision : %s\n",
30380 - chtostr(result.module_rev, 8));
30381 + seq_printf(seq, "Module name : %.24s\n", result.module_name);
30382 + seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
30383
30384 seq_printf(seq, "Serial number : ");
30385 print_serial_number(seq, result.serial_number, sizeof(result) - 36);
30386 @@ -1358,14 +1344,10 @@ static int i2o_seq_show_uinfo(struct seq
30387 return 0;
30388 }
30389
30390 - seq_printf(seq, "Device name : %s\n",
30391 - chtostr(result.device_name, 64));
30392 - seq_printf(seq, "Service name : %s\n",
30393 - chtostr(result.service_name, 64));
30394 - seq_printf(seq, "Physical name : %s\n",
30395 - chtostr(result.physical_location, 64));
30396 - seq_printf(seq, "Instance number : %s\n",
30397 - chtostr(result.instance_number, 4));
30398 + seq_printf(seq, "Device name : %.64s\n", result.device_name);
30399 + seq_printf(seq, "Service name : %.64s\n", result.service_name);
30400 + seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
30401 + seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
30402
30403 return 0;
30404 }
30405 diff -urNp linux-3.0.8/drivers/message/i2o/iop.c linux-3.0.8/drivers/message/i2o/iop.c
30406 --- linux-3.0.8/drivers/message/i2o/iop.c 2011-07-21 22:17:23.000000000 -0400
30407 +++ linux-3.0.8/drivers/message/i2o/iop.c 2011-08-23 21:47:55.000000000 -0400
30408 @@ -111,10 +111,10 @@ u32 i2o_cntxt_list_add(struct i2o_contro
30409
30410 spin_lock_irqsave(&c->context_list_lock, flags);
30411
30412 - if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
30413 - atomic_inc(&c->context_list_counter);
30414 + if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
30415 + atomic_inc_unchecked(&c->context_list_counter);
30416
30417 - entry->context = atomic_read(&c->context_list_counter);
30418 + entry->context = atomic_read_unchecked(&c->context_list_counter);
30419
30420 list_add(&entry->list, &c->context_list);
30421
30422 @@ -1077,7 +1077,7 @@ struct i2o_controller *i2o_iop_alloc(voi
30423
30424 #if BITS_PER_LONG == 64
30425 spin_lock_init(&c->context_list_lock);
30426 - atomic_set(&c->context_list_counter, 0);
30427 + atomic_set_unchecked(&c->context_list_counter, 0);
30428 INIT_LIST_HEAD(&c->context_list);
30429 #endif
30430
30431 diff -urNp linux-3.0.8/drivers/mfd/ab3100-core.c linux-3.0.8/drivers/mfd/ab3100-core.c
30432 --- linux-3.0.8/drivers/mfd/ab3100-core.c 2011-07-21 22:17:23.000000000 -0400
30433 +++ linux-3.0.8/drivers/mfd/ab3100-core.c 2011-10-11 10:44:33.000000000 -0400
30434 @@ -809,7 +809,7 @@ struct ab_family_id {
30435 char *name;
30436 };
30437
30438 -static const struct ab_family_id ids[] __devinitdata = {
30439 +static const struct ab_family_id ids[] __devinitconst = {
30440 /* AB3100 */
30441 {
30442 .id = 0xc0,
30443 diff -urNp linux-3.0.8/drivers/mfd/abx500-core.c linux-3.0.8/drivers/mfd/abx500-core.c
30444 --- linux-3.0.8/drivers/mfd/abx500-core.c 2011-07-21 22:17:23.000000000 -0400
30445 +++ linux-3.0.8/drivers/mfd/abx500-core.c 2011-08-23 21:47:55.000000000 -0400
30446 @@ -14,7 +14,7 @@ static LIST_HEAD(abx500_list);
30447
30448 struct abx500_device_entry {
30449 struct list_head list;
30450 - struct abx500_ops ops;
30451 + abx500_ops_no_const ops;
30452 struct device *dev;
30453 };
30454
30455 diff -urNp linux-3.0.8/drivers/mfd/janz-cmodio.c linux-3.0.8/drivers/mfd/janz-cmodio.c
30456 --- linux-3.0.8/drivers/mfd/janz-cmodio.c 2011-07-21 22:17:23.000000000 -0400
30457 +++ linux-3.0.8/drivers/mfd/janz-cmodio.c 2011-08-23 21:47:55.000000000 -0400
30458 @@ -13,6 +13,7 @@
30459
30460 #include <linux/kernel.h>
30461 #include <linux/module.h>
30462 +#include <linux/slab.h>
30463 #include <linux/init.h>
30464 #include <linux/pci.h>
30465 #include <linux/interrupt.h>
30466 diff -urNp linux-3.0.8/drivers/mfd/wm8350-i2c.c linux-3.0.8/drivers/mfd/wm8350-i2c.c
30467 --- linux-3.0.8/drivers/mfd/wm8350-i2c.c 2011-07-21 22:17:23.000000000 -0400
30468 +++ linux-3.0.8/drivers/mfd/wm8350-i2c.c 2011-08-23 21:48:14.000000000 -0400
30469 @@ -44,6 +44,8 @@ static int wm8350_i2c_write_device(struc
30470 u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
30471 int ret;
30472
30473 + pax_track_stack();
30474 +
30475 if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
30476 return -EINVAL;
30477
30478 diff -urNp linux-3.0.8/drivers/misc/lis3lv02d/lis3lv02d.c linux-3.0.8/drivers/misc/lis3lv02d/lis3lv02d.c
30479 --- linux-3.0.8/drivers/misc/lis3lv02d/lis3lv02d.c 2011-10-24 08:05:32.000000000 -0400
30480 +++ linux-3.0.8/drivers/misc/lis3lv02d/lis3lv02d.c 2011-10-17 23:17:19.000000000 -0400
30481 @@ -437,7 +437,7 @@ static irqreturn_t lis302dl_interrupt(in
30482 * the lid is closed. This leads to interrupts as soon as a little move
30483 * is done.
30484 */
30485 - atomic_inc(&lis3_dev.count);
30486 + atomic_inc_unchecked(&lis3_dev.count);
30487
30488 wake_up_interruptible(&lis3_dev.misc_wait);
30489 kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
30490 @@ -520,7 +520,7 @@ static int lis3lv02d_misc_open(struct in
30491 if (lis3_dev.pm_dev)
30492 pm_runtime_get_sync(lis3_dev.pm_dev);
30493
30494 - atomic_set(&lis3_dev.count, 0);
30495 + atomic_set_unchecked(&lis3_dev.count, 0);
30496 return 0;
30497 }
30498
30499 @@ -547,7 +547,7 @@ static ssize_t lis3lv02d_misc_read(struc
30500 add_wait_queue(&lis3_dev.misc_wait, &wait);
30501 while (true) {
30502 set_current_state(TASK_INTERRUPTIBLE);
30503 - data = atomic_xchg(&lis3_dev.count, 0);
30504 + data = atomic_xchg_unchecked(&lis3_dev.count, 0);
30505 if (data)
30506 break;
30507
30508 @@ -585,7 +585,7 @@ out:
30509 static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
30510 {
30511 poll_wait(file, &lis3_dev.misc_wait, wait);
30512 - if (atomic_read(&lis3_dev.count))
30513 + if (atomic_read_unchecked(&lis3_dev.count))
30514 return POLLIN | POLLRDNORM;
30515 return 0;
30516 }
30517 diff -urNp linux-3.0.8/drivers/misc/lis3lv02d/lis3lv02d.h linux-3.0.8/drivers/misc/lis3lv02d/lis3lv02d.h
30518 --- linux-3.0.8/drivers/misc/lis3lv02d/lis3lv02d.h 2011-07-21 22:17:23.000000000 -0400
30519 +++ linux-3.0.8/drivers/misc/lis3lv02d/lis3lv02d.h 2011-08-23 21:47:55.000000000 -0400
30520 @@ -265,7 +265,7 @@ struct lis3lv02d {
30521 struct input_polled_dev *idev; /* input device */
30522 struct platform_device *pdev; /* platform device */
30523 struct regulator_bulk_data regulators[2];
30524 - atomic_t count; /* interrupt count after last read */
30525 + atomic_unchecked_t count; /* interrupt count after last read */
30526 union axis_conversion ac; /* hw -> logical axis */
30527 int mapped_btns[3];
30528
30529 diff -urNp linux-3.0.8/drivers/misc/sgi-gru/gruhandles.c linux-3.0.8/drivers/misc/sgi-gru/gruhandles.c
30530 --- linux-3.0.8/drivers/misc/sgi-gru/gruhandles.c 2011-07-21 22:17:23.000000000 -0400
30531 +++ linux-3.0.8/drivers/misc/sgi-gru/gruhandles.c 2011-08-23 21:47:55.000000000 -0400
30532 @@ -44,8 +44,8 @@ static void update_mcs_stats(enum mcs_op
30533 unsigned long nsec;
30534
30535 nsec = CLKS2NSEC(clks);
30536 - atomic_long_inc(&mcs_op_statistics[op].count);
30537 - atomic_long_add(nsec, &mcs_op_statistics[op].total);
30538 + atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
30539 + atomic_long_add_unchecked(nsec, &mcs_op_statistics[op].total);
30540 if (mcs_op_statistics[op].max < nsec)
30541 mcs_op_statistics[op].max = nsec;
30542 }
30543 diff -urNp linux-3.0.8/drivers/misc/sgi-gru/gruprocfs.c linux-3.0.8/drivers/misc/sgi-gru/gruprocfs.c
30544 --- linux-3.0.8/drivers/misc/sgi-gru/gruprocfs.c 2011-07-21 22:17:23.000000000 -0400
30545 +++ linux-3.0.8/drivers/misc/sgi-gru/gruprocfs.c 2011-08-23 21:47:55.000000000 -0400
30546 @@ -32,9 +32,9 @@
30547
30548 #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
30549
30550 -static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
30551 +static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
30552 {
30553 - unsigned long val = atomic_long_read(v);
30554 + unsigned long val = atomic_long_read_unchecked(v);
30555
30556 seq_printf(s, "%16lu %s\n", val, id);
30557 }
30558 @@ -134,8 +134,8 @@ static int mcs_statistics_show(struct se
30559
30560 seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks");
30561 for (op = 0; op < mcsop_last; op++) {
30562 - count = atomic_long_read(&mcs_op_statistics[op].count);
30563 - total = atomic_long_read(&mcs_op_statistics[op].total);
30564 + count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
30565 + total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
30566 max = mcs_op_statistics[op].max;
30567 seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
30568 count ? total / count : 0, max);
30569 diff -urNp linux-3.0.8/drivers/misc/sgi-gru/grutables.h linux-3.0.8/drivers/misc/sgi-gru/grutables.h
30570 --- linux-3.0.8/drivers/misc/sgi-gru/grutables.h 2011-07-21 22:17:23.000000000 -0400
30571 +++ linux-3.0.8/drivers/misc/sgi-gru/grutables.h 2011-08-23 21:47:55.000000000 -0400
30572 @@ -167,82 +167,82 @@ extern unsigned int gru_max_gids;
30573 * GRU statistics.
30574 */
30575 struct gru_stats_s {
30576 - atomic_long_t vdata_alloc;
30577 - atomic_long_t vdata_free;
30578 - atomic_long_t gts_alloc;
30579 - atomic_long_t gts_free;
30580 - atomic_long_t gms_alloc;
30581 - atomic_long_t gms_free;
30582 - atomic_long_t gts_double_allocate;
30583 - atomic_long_t assign_context;
30584 - atomic_long_t assign_context_failed;
30585 - atomic_long_t free_context;
30586 - atomic_long_t load_user_context;
30587 - atomic_long_t load_kernel_context;
30588 - atomic_long_t lock_kernel_context;
30589 - atomic_long_t unlock_kernel_context;
30590 - atomic_long_t steal_user_context;
30591 - atomic_long_t steal_kernel_context;
30592 - atomic_long_t steal_context_failed;
30593 - atomic_long_t nopfn;
30594 - atomic_long_t asid_new;
30595 - atomic_long_t asid_next;
30596 - atomic_long_t asid_wrap;
30597 - atomic_long_t asid_reuse;
30598 - atomic_long_t intr;
30599 - atomic_long_t intr_cbr;
30600 - atomic_long_t intr_tfh;
30601 - atomic_long_t intr_spurious;
30602 - atomic_long_t intr_mm_lock_failed;
30603 - atomic_long_t call_os;
30604 - atomic_long_t call_os_wait_queue;
30605 - atomic_long_t user_flush_tlb;
30606 - atomic_long_t user_unload_context;
30607 - atomic_long_t user_exception;
30608 - atomic_long_t set_context_option;
30609 - atomic_long_t check_context_retarget_intr;
30610 - atomic_long_t check_context_unload;
30611 - atomic_long_t tlb_dropin;
30612 - atomic_long_t tlb_preload_page;
30613 - atomic_long_t tlb_dropin_fail_no_asid;
30614 - atomic_long_t tlb_dropin_fail_upm;
30615 - atomic_long_t tlb_dropin_fail_invalid;
30616 - atomic_long_t tlb_dropin_fail_range_active;
30617 - atomic_long_t tlb_dropin_fail_idle;
30618 - atomic_long_t tlb_dropin_fail_fmm;
30619 - atomic_long_t tlb_dropin_fail_no_exception;
30620 - atomic_long_t tfh_stale_on_fault;
30621 - atomic_long_t mmu_invalidate_range;
30622 - atomic_long_t mmu_invalidate_page;
30623 - atomic_long_t flush_tlb;
30624 - atomic_long_t flush_tlb_gru;
30625 - atomic_long_t flush_tlb_gru_tgh;
30626 - atomic_long_t flush_tlb_gru_zero_asid;
30627 -
30628 - atomic_long_t copy_gpa;
30629 - atomic_long_t read_gpa;
30630 -
30631 - atomic_long_t mesq_receive;
30632 - atomic_long_t mesq_receive_none;
30633 - atomic_long_t mesq_send;
30634 - atomic_long_t mesq_send_failed;
30635 - atomic_long_t mesq_noop;
30636 - atomic_long_t mesq_send_unexpected_error;
30637 - atomic_long_t mesq_send_lb_overflow;
30638 - atomic_long_t mesq_send_qlimit_reached;
30639 - atomic_long_t mesq_send_amo_nacked;
30640 - atomic_long_t mesq_send_put_nacked;
30641 - atomic_long_t mesq_page_overflow;
30642 - atomic_long_t mesq_qf_locked;
30643 - atomic_long_t mesq_qf_noop_not_full;
30644 - atomic_long_t mesq_qf_switch_head_failed;
30645 - atomic_long_t mesq_qf_unexpected_error;
30646 - atomic_long_t mesq_noop_unexpected_error;
30647 - atomic_long_t mesq_noop_lb_overflow;
30648 - atomic_long_t mesq_noop_qlimit_reached;
30649 - atomic_long_t mesq_noop_amo_nacked;
30650 - atomic_long_t mesq_noop_put_nacked;
30651 - atomic_long_t mesq_noop_page_overflow;
30652 + atomic_long_unchecked_t vdata_alloc;
30653 + atomic_long_unchecked_t vdata_free;
30654 + atomic_long_unchecked_t gts_alloc;
30655 + atomic_long_unchecked_t gts_free;
30656 + atomic_long_unchecked_t gms_alloc;
30657 + atomic_long_unchecked_t gms_free;
30658 + atomic_long_unchecked_t gts_double_allocate;
30659 + atomic_long_unchecked_t assign_context;
30660 + atomic_long_unchecked_t assign_context_failed;
30661 + atomic_long_unchecked_t free_context;
30662 + atomic_long_unchecked_t load_user_context;
30663 + atomic_long_unchecked_t load_kernel_context;
30664 + atomic_long_unchecked_t lock_kernel_context;
30665 + atomic_long_unchecked_t unlock_kernel_context;
30666 + atomic_long_unchecked_t steal_user_context;
30667 + atomic_long_unchecked_t steal_kernel_context;
30668 + atomic_long_unchecked_t steal_context_failed;
30669 + atomic_long_unchecked_t nopfn;
30670 + atomic_long_unchecked_t asid_new;
30671 + atomic_long_unchecked_t asid_next;
30672 + atomic_long_unchecked_t asid_wrap;
30673 + atomic_long_unchecked_t asid_reuse;
30674 + atomic_long_unchecked_t intr;
30675 + atomic_long_unchecked_t intr_cbr;
30676 + atomic_long_unchecked_t intr_tfh;
30677 + atomic_long_unchecked_t intr_spurious;
30678 + atomic_long_unchecked_t intr_mm_lock_failed;
30679 + atomic_long_unchecked_t call_os;
30680 + atomic_long_unchecked_t call_os_wait_queue;
30681 + atomic_long_unchecked_t user_flush_tlb;
30682 + atomic_long_unchecked_t user_unload_context;
30683 + atomic_long_unchecked_t user_exception;
30684 + atomic_long_unchecked_t set_context_option;
30685 + atomic_long_unchecked_t check_context_retarget_intr;
30686 + atomic_long_unchecked_t check_context_unload;
30687 + atomic_long_unchecked_t tlb_dropin;
30688 + atomic_long_unchecked_t tlb_preload_page;
30689 + atomic_long_unchecked_t tlb_dropin_fail_no_asid;
30690 + atomic_long_unchecked_t tlb_dropin_fail_upm;
30691 + atomic_long_unchecked_t tlb_dropin_fail_invalid;
30692 + atomic_long_unchecked_t tlb_dropin_fail_range_active;
30693 + atomic_long_unchecked_t tlb_dropin_fail_idle;
30694 + atomic_long_unchecked_t tlb_dropin_fail_fmm;
30695 + atomic_long_unchecked_t tlb_dropin_fail_no_exception;
30696 + atomic_long_unchecked_t tfh_stale_on_fault;
30697 + atomic_long_unchecked_t mmu_invalidate_range;
30698 + atomic_long_unchecked_t mmu_invalidate_page;
30699 + atomic_long_unchecked_t flush_tlb;
30700 + atomic_long_unchecked_t flush_tlb_gru;
30701 + atomic_long_unchecked_t flush_tlb_gru_tgh;
30702 + atomic_long_unchecked_t flush_tlb_gru_zero_asid;
30703 +
30704 + atomic_long_unchecked_t copy_gpa;
30705 + atomic_long_unchecked_t read_gpa;
30706 +
30707 + atomic_long_unchecked_t mesq_receive;
30708 + atomic_long_unchecked_t mesq_receive_none;
30709 + atomic_long_unchecked_t mesq_send;
30710 + atomic_long_unchecked_t mesq_send_failed;
30711 + atomic_long_unchecked_t mesq_noop;
30712 + atomic_long_unchecked_t mesq_send_unexpected_error;
30713 + atomic_long_unchecked_t mesq_send_lb_overflow;
30714 + atomic_long_unchecked_t mesq_send_qlimit_reached;
30715 + atomic_long_unchecked_t mesq_send_amo_nacked;
30716 + atomic_long_unchecked_t mesq_send_put_nacked;
30717 + atomic_long_unchecked_t mesq_page_overflow;
30718 + atomic_long_unchecked_t mesq_qf_locked;
30719 + atomic_long_unchecked_t mesq_qf_noop_not_full;
30720 + atomic_long_unchecked_t mesq_qf_switch_head_failed;
30721 + atomic_long_unchecked_t mesq_qf_unexpected_error;
30722 + atomic_long_unchecked_t mesq_noop_unexpected_error;
30723 + atomic_long_unchecked_t mesq_noop_lb_overflow;
30724 + atomic_long_unchecked_t mesq_noop_qlimit_reached;
30725 + atomic_long_unchecked_t mesq_noop_amo_nacked;
30726 + atomic_long_unchecked_t mesq_noop_put_nacked;
30727 + atomic_long_unchecked_t mesq_noop_page_overflow;
30728
30729 };
30730
30731 @@ -251,8 +251,8 @@ enum mcs_op {cchop_allocate, cchop_start
30732 tghop_invalidate, mcsop_last};
30733
30734 struct mcs_op_statistic {
30735 - atomic_long_t count;
30736 - atomic_long_t total;
30737 + atomic_long_unchecked_t count;
30738 + atomic_long_unchecked_t total;
30739 unsigned long max;
30740 };
30741
30742 @@ -275,7 +275,7 @@ extern struct mcs_op_statistic mcs_op_st
30743
30744 #define STAT(id) do { \
30745 if (gru_options & OPT_STATS) \
30746 - atomic_long_inc(&gru_stats.id); \
30747 + atomic_long_inc_unchecked(&gru_stats.id); \
30748 } while (0)
30749
30750 #ifdef CONFIG_SGI_GRU_DEBUG
30751 diff -urNp linux-3.0.8/drivers/misc/sgi-xp/xpc.h linux-3.0.8/drivers/misc/sgi-xp/xpc.h
30752 --- linux-3.0.8/drivers/misc/sgi-xp/xpc.h 2011-07-21 22:17:23.000000000 -0400
30753 +++ linux-3.0.8/drivers/misc/sgi-xp/xpc.h 2011-10-11 10:44:33.000000000 -0400
30754 @@ -835,6 +835,7 @@ struct xpc_arch_operations {
30755 void (*received_payload) (struct xpc_channel *, void *);
30756 void (*notify_senders_of_disconnect) (struct xpc_channel *);
30757 };
30758 +typedef struct xpc_arch_operations __no_const xpc_arch_operations_no_const;
30759
30760 /* struct xpc_partition act_state values (for XPC HB) */
30761
30762 @@ -876,7 +877,7 @@ extern struct xpc_registration xpc_regis
30763 /* found in xpc_main.c */
30764 extern struct device *xpc_part;
30765 extern struct device *xpc_chan;
30766 -extern struct xpc_arch_operations xpc_arch_ops;
30767 +extern xpc_arch_operations_no_const xpc_arch_ops;
30768 extern int xpc_disengage_timelimit;
30769 extern int xpc_disengage_timedout;
30770 extern int xpc_activate_IRQ_rcvd;
30771 diff -urNp linux-3.0.8/drivers/misc/sgi-xp/xpc_main.c linux-3.0.8/drivers/misc/sgi-xp/xpc_main.c
30772 --- linux-3.0.8/drivers/misc/sgi-xp/xpc_main.c 2011-07-21 22:17:23.000000000 -0400
30773 +++ linux-3.0.8/drivers/misc/sgi-xp/xpc_main.c 2011-10-11 10:44:33.000000000 -0400
30774 @@ -162,7 +162,7 @@ static struct notifier_block xpc_die_not
30775 .notifier_call = xpc_system_die,
30776 };
30777
30778 -struct xpc_arch_operations xpc_arch_ops;
30779 +xpc_arch_operations_no_const xpc_arch_ops;
30780
30781 /*
30782 * Timer function to enforce the timelimit on the partition disengage.
30783 diff -urNp linux-3.0.8/drivers/misc/sgi-xp/xp.h linux-3.0.8/drivers/misc/sgi-xp/xp.h
30784 --- linux-3.0.8/drivers/misc/sgi-xp/xp.h 2011-07-21 22:17:23.000000000 -0400
30785 +++ linux-3.0.8/drivers/misc/sgi-xp/xp.h 2011-08-23 21:47:55.000000000 -0400
30786 @@ -289,7 +289,7 @@ struct xpc_interface {
30787 xpc_notify_func, void *);
30788 void (*received) (short, int, void *);
30789 enum xp_retval (*partid_to_nasids) (short, void *);
30790 -};
30791 +} __no_const;
30792
30793 extern struct xpc_interface xpc_interface;
30794
30795 diff -urNp linux-3.0.8/drivers/mmc/host/sdhci-pci.c linux-3.0.8/drivers/mmc/host/sdhci-pci.c
30796 --- linux-3.0.8/drivers/mmc/host/sdhci-pci.c 2011-07-21 22:17:23.000000000 -0400
30797 +++ linux-3.0.8/drivers/mmc/host/sdhci-pci.c 2011-10-11 10:44:33.000000000 -0400
30798 @@ -524,7 +524,7 @@ static const struct sdhci_pci_fixes sdhc
30799 .probe = via_probe,
30800 };
30801
30802 -static const struct pci_device_id pci_ids[] __devinitdata = {
30803 +static const struct pci_device_id pci_ids[] __devinitconst = {
30804 {
30805 .vendor = PCI_VENDOR_ID_RICOH,
30806 .device = PCI_DEVICE_ID_RICOH_R5C822,
30807 diff -urNp linux-3.0.8/drivers/mtd/chips/cfi_cmdset_0001.c linux-3.0.8/drivers/mtd/chips/cfi_cmdset_0001.c
30808 --- linux-3.0.8/drivers/mtd/chips/cfi_cmdset_0001.c 2011-07-21 22:17:23.000000000 -0400
30809 +++ linux-3.0.8/drivers/mtd/chips/cfi_cmdset_0001.c 2011-08-23 21:48:14.000000000 -0400
30810 @@ -757,6 +757,8 @@ static int chip_ready (struct map_info *
30811 struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
30812 unsigned long timeo = jiffies + HZ;
30813
30814 + pax_track_stack();
30815 +
30816 /* Prevent setting state FL_SYNCING for chip in suspended state. */
30817 if (mode == FL_SYNCING && chip->oldstate != FL_READY)
30818 goto sleep;
30819 @@ -1653,6 +1655,8 @@ static int __xipram do_write_buffer(stru
30820 unsigned long initial_adr;
30821 int initial_len = len;
30822
30823 + pax_track_stack();
30824 +
30825 wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
30826 adr += chip->start;
30827 initial_adr = adr;
30828 @@ -1871,6 +1875,8 @@ static int __xipram do_erase_oneblock(st
30829 int retries = 3;
30830 int ret;
30831
30832 + pax_track_stack();
30833 +
30834 adr += chip->start;
30835
30836 retry:
30837 diff -urNp linux-3.0.8/drivers/mtd/chips/cfi_cmdset_0020.c linux-3.0.8/drivers/mtd/chips/cfi_cmdset_0020.c
30838 --- linux-3.0.8/drivers/mtd/chips/cfi_cmdset_0020.c 2011-07-21 22:17:23.000000000 -0400
30839 +++ linux-3.0.8/drivers/mtd/chips/cfi_cmdset_0020.c 2011-08-23 21:48:14.000000000 -0400
30840 @@ -255,6 +255,8 @@ static inline int do_read_onechip(struct
30841 unsigned long cmd_addr;
30842 struct cfi_private *cfi = map->fldrv_priv;
30843
30844 + pax_track_stack();
30845 +
30846 adr += chip->start;
30847
30848 /* Ensure cmd read/writes are aligned. */
30849 @@ -429,6 +431,8 @@ static inline int do_write_buffer(struct
30850 DECLARE_WAITQUEUE(wait, current);
30851 int wbufsize, z;
30852
30853 + pax_track_stack();
30854 +
30855 /* M58LW064A requires bus alignment for buffer wriets -- saw */
30856 if (adr & (map_bankwidth(map)-1))
30857 return -EINVAL;
30858 @@ -743,6 +747,8 @@ static inline int do_erase_oneblock(stru
30859 DECLARE_WAITQUEUE(wait, current);
30860 int ret = 0;
30861
30862 + pax_track_stack();
30863 +
30864 adr += chip->start;
30865
30866 /* Let's determine this according to the interleave only once */
30867 @@ -1048,6 +1054,8 @@ static inline int do_lock_oneblock(struc
30868 unsigned long timeo = jiffies + HZ;
30869 DECLARE_WAITQUEUE(wait, current);
30870
30871 + pax_track_stack();
30872 +
30873 adr += chip->start;
30874
30875 /* Let's determine this according to the interleave only once */
30876 @@ -1197,6 +1205,8 @@ static inline int do_unlock_oneblock(str
30877 unsigned long timeo = jiffies + HZ;
30878 DECLARE_WAITQUEUE(wait, current);
30879
30880 + pax_track_stack();
30881 +
30882 adr += chip->start;
30883
30884 /* Let's determine this according to the interleave only once */
30885 diff -urNp linux-3.0.8/drivers/mtd/devices/doc2000.c linux-3.0.8/drivers/mtd/devices/doc2000.c
30886 --- linux-3.0.8/drivers/mtd/devices/doc2000.c 2011-07-21 22:17:23.000000000 -0400
30887 +++ linux-3.0.8/drivers/mtd/devices/doc2000.c 2011-08-23 21:47:55.000000000 -0400
30888 @@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
30889
30890 /* The ECC will not be calculated correctly if less than 512 is written */
30891 /* DBB-
30892 - if (len != 0x200 && eccbuf)
30893 + if (len != 0x200)
30894 printk(KERN_WARNING
30895 "ECC needs a full sector write (adr: %lx size %lx)\n",
30896 (long) to, (long) len);
30897 diff -urNp linux-3.0.8/drivers/mtd/devices/doc2001.c linux-3.0.8/drivers/mtd/devices/doc2001.c
30898 --- linux-3.0.8/drivers/mtd/devices/doc2001.c 2011-07-21 22:17:23.000000000 -0400
30899 +++ linux-3.0.8/drivers/mtd/devices/doc2001.c 2011-08-23 21:47:55.000000000 -0400
30900 @@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
30901 struct Nand *mychip = &this->chips[from >> (this->chipshift)];
30902
30903 /* Don't allow read past end of device */
30904 - if (from >= this->totlen)
30905 + if (from >= this->totlen || !len)
30906 return -EINVAL;
30907
30908 /* Don't allow a single read to cross a 512-byte block boundary */
30909 diff -urNp linux-3.0.8/drivers/mtd/ftl.c linux-3.0.8/drivers/mtd/ftl.c
30910 --- linux-3.0.8/drivers/mtd/ftl.c 2011-07-21 22:17:23.000000000 -0400
30911 +++ linux-3.0.8/drivers/mtd/ftl.c 2011-08-23 21:48:14.000000000 -0400
30912 @@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *
30913 loff_t offset;
30914 uint16_t srcunitswap = cpu_to_le16(srcunit);
30915
30916 + pax_track_stack();
30917 +
30918 eun = &part->EUNInfo[srcunit];
30919 xfer = &part->XferInfo[xferunit];
30920 DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
30921 diff -urNp linux-3.0.8/drivers/mtd/inftlcore.c linux-3.0.8/drivers/mtd/inftlcore.c
30922 --- linux-3.0.8/drivers/mtd/inftlcore.c 2011-07-21 22:17:23.000000000 -0400
30923 +++ linux-3.0.8/drivers/mtd/inftlcore.c 2011-08-23 21:48:14.000000000 -0400
30924 @@ -259,6 +259,8 @@ static u16 INFTL_foldchain(struct INFTLr
30925 struct inftl_oob oob;
30926 size_t retlen;
30927
30928 + pax_track_stack();
30929 +
30930 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
30931 "pending=%d)\n", inftl, thisVUC, pendingblock);
30932
30933 diff -urNp linux-3.0.8/drivers/mtd/inftlmount.c linux-3.0.8/drivers/mtd/inftlmount.c
30934 --- linux-3.0.8/drivers/mtd/inftlmount.c 2011-07-21 22:17:23.000000000 -0400
30935 +++ linux-3.0.8/drivers/mtd/inftlmount.c 2011-08-23 21:48:14.000000000 -0400
30936 @@ -53,6 +53,8 @@ static int find_boot_record(struct INFTL
30937 struct INFTLPartition *ip;
30938 size_t retlen;
30939
30940 + pax_track_stack();
30941 +
30942 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
30943
30944 /*
30945 diff -urNp linux-3.0.8/drivers/mtd/lpddr/qinfo_probe.c linux-3.0.8/drivers/mtd/lpddr/qinfo_probe.c
30946 --- linux-3.0.8/drivers/mtd/lpddr/qinfo_probe.c 2011-07-21 22:17:23.000000000 -0400
30947 +++ linux-3.0.8/drivers/mtd/lpddr/qinfo_probe.c 2011-08-23 21:48:14.000000000 -0400
30948 @@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map
30949 {
30950 map_word pfow_val[4];
30951
30952 + pax_track_stack();
30953 +
30954 /* Check identification string */
30955 pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
30956 pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
30957 diff -urNp linux-3.0.8/drivers/mtd/mtdchar.c linux-3.0.8/drivers/mtd/mtdchar.c
30958 --- linux-3.0.8/drivers/mtd/mtdchar.c 2011-07-21 22:17:23.000000000 -0400
30959 +++ linux-3.0.8/drivers/mtd/mtdchar.c 2011-08-23 21:48:14.000000000 -0400
30960 @@ -553,6 +553,8 @@ static int mtd_ioctl(struct file *file,
30961 u_long size;
30962 struct mtd_info_user info;
30963
30964 + pax_track_stack();
30965 +
30966 DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
30967
30968 size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
30969 diff -urNp linux-3.0.8/drivers/mtd/nand/denali.c linux-3.0.8/drivers/mtd/nand/denali.c
30970 --- linux-3.0.8/drivers/mtd/nand/denali.c 2011-07-21 22:17:23.000000000 -0400
30971 +++ linux-3.0.8/drivers/mtd/nand/denali.c 2011-08-23 21:47:55.000000000 -0400
30972 @@ -26,6 +26,7 @@
30973 #include <linux/pci.h>
30974 #include <linux/mtd/mtd.h>
30975 #include <linux/module.h>
30976 +#include <linux/slab.h>
30977
30978 #include "denali.h"
30979
30980 diff -urNp linux-3.0.8/drivers/mtd/nftlcore.c linux-3.0.8/drivers/mtd/nftlcore.c
30981 --- linux-3.0.8/drivers/mtd/nftlcore.c 2011-07-21 22:17:23.000000000 -0400
30982 +++ linux-3.0.8/drivers/mtd/nftlcore.c 2011-08-23 21:48:14.000000000 -0400
30983 @@ -264,6 +264,8 @@ static u16 NFTL_foldchain (struct NFTLre
30984 int inplace = 1;
30985 size_t retlen;
30986
30987 + pax_track_stack();
30988 +
30989 memset(BlockMap, 0xff, sizeof(BlockMap));
30990 memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
30991
30992 diff -urNp linux-3.0.8/drivers/mtd/nftlmount.c linux-3.0.8/drivers/mtd/nftlmount.c
30993 --- linux-3.0.8/drivers/mtd/nftlmount.c 2011-07-21 22:17:23.000000000 -0400
30994 +++ linux-3.0.8/drivers/mtd/nftlmount.c 2011-08-23 21:48:14.000000000 -0400
30995 @@ -24,6 +24,7 @@
30996 #include <asm/errno.h>
30997 #include <linux/delay.h>
30998 #include <linux/slab.h>
30999 +#include <linux/sched.h>
31000 #include <linux/mtd/mtd.h>
31001 #include <linux/mtd/nand.h>
31002 #include <linux/mtd/nftl.h>
31003 @@ -45,6 +46,8 @@ static int find_boot_record(struct NFTLr
31004 struct mtd_info *mtd = nftl->mbd.mtd;
31005 unsigned int i;
31006
31007 + pax_track_stack();
31008 +
31009 /* Assume logical EraseSize == physical erasesize for starting the scan.
31010 We'll sort it out later if we find a MediaHeader which says otherwise */
31011 /* Actually, we won't. The new DiskOnChip driver has already scanned
31012 diff -urNp linux-3.0.8/drivers/mtd/ubi/build.c linux-3.0.8/drivers/mtd/ubi/build.c
31013 --- linux-3.0.8/drivers/mtd/ubi/build.c 2011-07-21 22:17:23.000000000 -0400
31014 +++ linux-3.0.8/drivers/mtd/ubi/build.c 2011-08-23 21:47:55.000000000 -0400
31015 @@ -1287,7 +1287,7 @@ module_exit(ubi_exit);
31016 static int __init bytes_str_to_int(const char *str)
31017 {
31018 char *endp;
31019 - unsigned long result;
31020 + unsigned long result, scale = 1;
31021
31022 result = simple_strtoul(str, &endp, 0);
31023 if (str == endp || result >= INT_MAX) {
31024 @@ -1298,11 +1298,11 @@ static int __init bytes_str_to_int(const
31025
31026 switch (*endp) {
31027 case 'G':
31028 - result *= 1024;
31029 + scale *= 1024;
31030 case 'M':
31031 - result *= 1024;
31032 + scale *= 1024;
31033 case 'K':
31034 - result *= 1024;
31035 + scale *= 1024;
31036 if (endp[1] == 'i' && endp[2] == 'B')
31037 endp += 2;
31038 case '\0':
31039 @@ -1313,7 +1313,13 @@ static int __init bytes_str_to_int(const
31040 return -EINVAL;
31041 }
31042
31043 - return result;
31044 + if ((intoverflow_t)result*scale >= INT_MAX) {
31045 + printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
31046 + str);
31047 + return -EINVAL;
31048 + }
31049 +
31050 + return result*scale;
31051 }
31052
31053 /**
31054 diff -urNp linux-3.0.8/drivers/net/atlx/atl2.c linux-3.0.8/drivers/net/atlx/atl2.c
31055 --- linux-3.0.8/drivers/net/atlx/atl2.c 2011-07-21 22:17:23.000000000 -0400
31056 +++ linux-3.0.8/drivers/net/atlx/atl2.c 2011-10-11 10:44:33.000000000 -0400
31057 @@ -2840,7 +2840,7 @@ static void atl2_force_ps(struct atl2_hw
31058 */
31059
31060 #define ATL2_PARAM(X, desc) \
31061 - static const int __devinitdata X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
31062 + static const int __devinitconst X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
31063 MODULE_PARM(X, "1-" __MODULE_STRING(ATL2_MAX_NIC) "i"); \
31064 MODULE_PARM_DESC(X, desc);
31065 #else
31066 diff -urNp linux-3.0.8/drivers/net/bna/bfa_ioc_ct.c linux-3.0.8/drivers/net/bna/bfa_ioc_ct.c
31067 --- linux-3.0.8/drivers/net/bna/bfa_ioc_ct.c 2011-07-21 22:17:23.000000000 -0400
31068 +++ linux-3.0.8/drivers/net/bna/bfa_ioc_ct.c 2011-08-23 21:47:55.000000000 -0400
31069 @@ -48,7 +48,21 @@ static void bfa_ioc_ct_sync_ack(struct b
31070 static bool bfa_ioc_ct_sync_complete(struct bfa_ioc *ioc);
31071 static enum bfa_status bfa_ioc_ct_pll_init(void __iomem *rb, bool fcmode);
31072
31073 -static struct bfa_ioc_hwif nw_hwif_ct;
31074 +static struct bfa_ioc_hwif nw_hwif_ct = {
31075 + .ioc_pll_init = bfa_ioc_ct_pll_init,
31076 + .ioc_firmware_lock = bfa_ioc_ct_firmware_lock,
31077 + .ioc_firmware_unlock = bfa_ioc_ct_firmware_unlock,
31078 + .ioc_reg_init = bfa_ioc_ct_reg_init,
31079 + .ioc_map_port = bfa_ioc_ct_map_port,
31080 + .ioc_isr_mode_set = bfa_ioc_ct_isr_mode_set,
31081 + .ioc_notify_fail = bfa_ioc_ct_notify_fail,
31082 + .ioc_ownership_reset = bfa_ioc_ct_ownership_reset,
31083 + .ioc_sync_start = bfa_ioc_ct_sync_start,
31084 + .ioc_sync_join = bfa_ioc_ct_sync_join,
31085 + .ioc_sync_leave = bfa_ioc_ct_sync_leave,
31086 + .ioc_sync_ack = bfa_ioc_ct_sync_ack,
31087 + .ioc_sync_complete = bfa_ioc_ct_sync_complete
31088 +};
31089
31090 /**
31091 * Called from bfa_ioc_attach() to map asic specific calls.
31092 @@ -56,20 +70,6 @@ static struct bfa_ioc_hwif nw_hwif_ct;
31093 void
31094 bfa_nw_ioc_set_ct_hwif(struct bfa_ioc *ioc)
31095 {
31096 - nw_hwif_ct.ioc_pll_init = bfa_ioc_ct_pll_init;
31097 - nw_hwif_ct.ioc_firmware_lock = bfa_ioc_ct_firmware_lock;
31098 - nw_hwif_ct.ioc_firmware_unlock = bfa_ioc_ct_firmware_unlock;
31099 - nw_hwif_ct.ioc_reg_init = bfa_ioc_ct_reg_init;
31100 - nw_hwif_ct.ioc_map_port = bfa_ioc_ct_map_port;
31101 - nw_hwif_ct.ioc_isr_mode_set = bfa_ioc_ct_isr_mode_set;
31102 - nw_hwif_ct.ioc_notify_fail = bfa_ioc_ct_notify_fail;
31103 - nw_hwif_ct.ioc_ownership_reset = bfa_ioc_ct_ownership_reset;
31104 - nw_hwif_ct.ioc_sync_start = bfa_ioc_ct_sync_start;
31105 - nw_hwif_ct.ioc_sync_join = bfa_ioc_ct_sync_join;
31106 - nw_hwif_ct.ioc_sync_leave = bfa_ioc_ct_sync_leave;
31107 - nw_hwif_ct.ioc_sync_ack = bfa_ioc_ct_sync_ack;
31108 - nw_hwif_ct.ioc_sync_complete = bfa_ioc_ct_sync_complete;
31109 -
31110 ioc->ioc_hwif = &nw_hwif_ct;
31111 }
31112
31113 diff -urNp linux-3.0.8/drivers/net/bna/bnad.c linux-3.0.8/drivers/net/bna/bnad.c
31114 --- linux-3.0.8/drivers/net/bna/bnad.c 2011-07-21 22:17:23.000000000 -0400
31115 +++ linux-3.0.8/drivers/net/bna/bnad.c 2011-08-23 21:47:55.000000000 -0400
31116 @@ -1681,7 +1681,14 @@ bnad_setup_tx(struct bnad *bnad, uint tx
31117 struct bna_intr_info *intr_info =
31118 &res_info[BNA_TX_RES_INTR_T_TXCMPL].res_u.intr_info;
31119 struct bna_tx_config *tx_config = &bnad->tx_config[tx_id];
31120 - struct bna_tx_event_cbfn tx_cbfn;
31121 + static struct bna_tx_event_cbfn tx_cbfn = {
31122 + /* Initialize the tx event handlers */
31123 + .tcb_setup_cbfn = bnad_cb_tcb_setup,
31124 + .tcb_destroy_cbfn = bnad_cb_tcb_destroy,
31125 + .tx_stall_cbfn = bnad_cb_tx_stall,
31126 + .tx_resume_cbfn = bnad_cb_tx_resume,
31127 + .tx_cleanup_cbfn = bnad_cb_tx_cleanup
31128 + };
31129 struct bna_tx *tx;
31130 unsigned long flags;
31131
31132 @@ -1690,13 +1697,6 @@ bnad_setup_tx(struct bnad *bnad, uint tx
31133 tx_config->txq_depth = bnad->txq_depth;
31134 tx_config->tx_type = BNA_TX_T_REGULAR;
31135
31136 - /* Initialize the tx event handlers */
31137 - tx_cbfn.tcb_setup_cbfn = bnad_cb_tcb_setup;
31138 - tx_cbfn.tcb_destroy_cbfn = bnad_cb_tcb_destroy;
31139 - tx_cbfn.tx_stall_cbfn = bnad_cb_tx_stall;
31140 - tx_cbfn.tx_resume_cbfn = bnad_cb_tx_resume;
31141 - tx_cbfn.tx_cleanup_cbfn = bnad_cb_tx_cleanup;
31142 -
31143 /* Get BNA's resource requirement for one tx object */
31144 spin_lock_irqsave(&bnad->bna_lock, flags);
31145 bna_tx_res_req(bnad->num_txq_per_tx,
31146 @@ -1827,21 +1827,21 @@ bnad_setup_rx(struct bnad *bnad, uint rx
31147 struct bna_intr_info *intr_info =
31148 &res_info[BNA_RX_RES_T_INTR].res_u.intr_info;
31149 struct bna_rx_config *rx_config = &bnad->rx_config[rx_id];
31150 - struct bna_rx_event_cbfn rx_cbfn;
31151 + static struct bna_rx_event_cbfn rx_cbfn = {
31152 + /* Initialize the Rx event handlers */
31153 + .rcb_setup_cbfn = bnad_cb_rcb_setup,
31154 + .rcb_destroy_cbfn = bnad_cb_rcb_destroy,
31155 + .ccb_setup_cbfn = bnad_cb_ccb_setup,
31156 + .ccb_destroy_cbfn = bnad_cb_ccb_destroy,
31157 + .rx_cleanup_cbfn = bnad_cb_rx_cleanup,
31158 + .rx_post_cbfn = bnad_cb_rx_post
31159 + };
31160 struct bna_rx *rx;
31161 unsigned long flags;
31162
31163 /* Initialize the Rx object configuration */
31164 bnad_init_rx_config(bnad, rx_config);
31165
31166 - /* Initialize the Rx event handlers */
31167 - rx_cbfn.rcb_setup_cbfn = bnad_cb_rcb_setup;
31168 - rx_cbfn.rcb_destroy_cbfn = bnad_cb_rcb_destroy;
31169 - rx_cbfn.ccb_setup_cbfn = bnad_cb_ccb_setup;
31170 - rx_cbfn.ccb_destroy_cbfn = bnad_cb_ccb_destroy;
31171 - rx_cbfn.rx_cleanup_cbfn = bnad_cb_rx_cleanup;
31172 - rx_cbfn.rx_post_cbfn = bnad_cb_rx_post;
31173 -
31174 /* Get BNA's resource requirement for one Rx object */
31175 spin_lock_irqsave(&bnad->bna_lock, flags);
31176 bna_rx_res_req(rx_config, res_info);
31177 diff -urNp linux-3.0.8/drivers/net/bnx2.c linux-3.0.8/drivers/net/bnx2.c
31178 --- linux-3.0.8/drivers/net/bnx2.c 2011-10-24 08:05:30.000000000 -0400
31179 +++ linux-3.0.8/drivers/net/bnx2.c 2011-10-16 21:55:27.000000000 -0400
31180 @@ -5831,6 +5831,8 @@ bnx2_test_nvram(struct bnx2 *bp)
31181 int rc = 0;
31182 u32 magic, csum;
31183
31184 + pax_track_stack();
31185 +
31186 if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
31187 goto test_nvram_done;
31188
31189 diff -urNp linux-3.0.8/drivers/net/bnx2x/bnx2x_ethtool.c linux-3.0.8/drivers/net/bnx2x/bnx2x_ethtool.c
31190 --- linux-3.0.8/drivers/net/bnx2x/bnx2x_ethtool.c 2011-07-21 22:17:23.000000000 -0400
31191 +++ linux-3.0.8/drivers/net/bnx2x/bnx2x_ethtool.c 2011-08-23 21:48:14.000000000 -0400
31192 @@ -1705,6 +1705,8 @@ static int bnx2x_test_nvram(struct bnx2x
31193 int i, rc;
31194 u32 magic, crc;
31195
31196 + pax_track_stack();
31197 +
31198 if (BP_NOMCP(bp))
31199 return 0;
31200
31201 diff -urNp linux-3.0.8/drivers/net/can/mscan/mscan.c linux-3.0.8/drivers/net/can/mscan/mscan.c
31202 --- linux-3.0.8/drivers/net/can/mscan/mscan.c 2011-07-21 22:17:23.000000000 -0400
31203 +++ linux-3.0.8/drivers/net/can/mscan/mscan.c 2011-10-17 02:51:46.000000000 -0400
31204 @@ -261,11 +261,13 @@ static netdev_tx_t mscan_start_xmit(stru
31205 void __iomem *data = &regs->tx.dsr1_0;
31206 u16 *payload = (u16 *)frame->data;
31207
31208 - /* It is safe to write into dsr[dlc+1] */
31209 - for (i = 0; i < (frame->can_dlc + 1) / 2; i++) {
31210 + for (i = 0; i < frame->can_dlc / 2; i++) {
31211 out_be16(data, *payload++);
31212 data += 2 + _MSCAN_RESERVED_DSR_SIZE;
31213 }
31214 + /* write remaining byte if necessary */
31215 + if (frame->can_dlc & 1)
31216 + out_8(data, frame->data[frame->can_dlc - 1]);
31217 }
31218
31219 out_8(&regs->tx.dlr, frame->can_dlc);
31220 @@ -330,10 +332,13 @@ static void mscan_get_rx_frame(struct ne
31221 void __iomem *data = &regs->rx.dsr1_0;
31222 u16 *payload = (u16 *)frame->data;
31223
31224 - for (i = 0; i < (frame->can_dlc + 1) / 2; i++) {
31225 + for (i = 0; i < frame->can_dlc / 2; i++) {
31226 *payload++ = in_be16(data);
31227 data += 2 + _MSCAN_RESERVED_DSR_SIZE;
31228 }
31229 + /* read remaining byte if necessary */
31230 + if (frame->can_dlc & 1)
31231 + frame->data[frame->can_dlc - 1] = in_8(data);
31232 }
31233
31234 out_8(&regs->canrflg, MSCAN_RXF);
31235 diff -urNp linux-3.0.8/drivers/net/cxgb3/l2t.h linux-3.0.8/drivers/net/cxgb3/l2t.h
31236 --- linux-3.0.8/drivers/net/cxgb3/l2t.h 2011-10-24 08:05:30.000000000 -0400
31237 +++ linux-3.0.8/drivers/net/cxgb3/l2t.h 2011-10-16 21:55:27.000000000 -0400
31238 @@ -87,7 +87,7 @@ typedef void (*arp_failure_handler_func)
31239 */
31240 struct l2t_skb_cb {
31241 arp_failure_handler_func arp_failure_handler;
31242 -};
31243 +} __no_const;
31244
31245 #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb)
31246
31247 diff -urNp linux-3.0.8/drivers/net/cxgb4/cxgb4_main.c linux-3.0.8/drivers/net/cxgb4/cxgb4_main.c
31248 --- linux-3.0.8/drivers/net/cxgb4/cxgb4_main.c 2011-07-21 22:17:23.000000000 -0400
31249 +++ linux-3.0.8/drivers/net/cxgb4/cxgb4_main.c 2011-08-23 21:48:14.000000000 -0400
31250 @@ -3396,6 +3396,8 @@ static int __devinit enable_msix(struct
31251 unsigned int nchan = adap->params.nports;
31252 struct msix_entry entries[MAX_INGQ + 1];
31253
31254 + pax_track_stack();
31255 +
31256 for (i = 0; i < ARRAY_SIZE(entries); ++i)
31257 entries[i].entry = i;
31258
31259 diff -urNp linux-3.0.8/drivers/net/cxgb4/t4_hw.c linux-3.0.8/drivers/net/cxgb4/t4_hw.c
31260 --- linux-3.0.8/drivers/net/cxgb4/t4_hw.c 2011-07-21 22:17:23.000000000 -0400
31261 +++ linux-3.0.8/drivers/net/cxgb4/t4_hw.c 2011-08-23 21:48:14.000000000 -0400
31262 @@ -362,6 +362,8 @@ static int get_vpd_params(struct adapter
31263 u8 vpd[VPD_LEN], csum;
31264 unsigned int vpdr_len, kw_offset, id_len;
31265
31266 + pax_track_stack();
31267 +
31268 ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(vpd), vpd);
31269 if (ret < 0)
31270 return ret;
31271 diff -urNp linux-3.0.8/drivers/net/e1000e/82571.c linux-3.0.8/drivers/net/e1000e/82571.c
31272 --- linux-3.0.8/drivers/net/e1000e/82571.c 2011-07-21 22:17:23.000000000 -0400
31273 +++ linux-3.0.8/drivers/net/e1000e/82571.c 2011-08-23 21:47:55.000000000 -0400
31274 @@ -239,7 +239,7 @@ static s32 e1000_init_mac_params_82571(s
31275 {
31276 struct e1000_hw *hw = &adapter->hw;
31277 struct e1000_mac_info *mac = &hw->mac;
31278 - struct e1000_mac_operations *func = &mac->ops;
31279 + e1000_mac_operations_no_const *func = &mac->ops;
31280 u32 swsm = 0;
31281 u32 swsm2 = 0;
31282 bool force_clear_smbi = false;
31283 diff -urNp linux-3.0.8/drivers/net/e1000e/es2lan.c linux-3.0.8/drivers/net/e1000e/es2lan.c
31284 --- linux-3.0.8/drivers/net/e1000e/es2lan.c 2011-07-21 22:17:23.000000000 -0400
31285 +++ linux-3.0.8/drivers/net/e1000e/es2lan.c 2011-08-23 21:47:55.000000000 -0400
31286 @@ -205,7 +205,7 @@ static s32 e1000_init_mac_params_80003es
31287 {
31288 struct e1000_hw *hw = &adapter->hw;
31289 struct e1000_mac_info *mac = &hw->mac;
31290 - struct e1000_mac_operations *func = &mac->ops;
31291 + e1000_mac_operations_no_const *func = &mac->ops;
31292
31293 /* Set media type */
31294 switch (adapter->pdev->device) {
31295 diff -urNp linux-3.0.8/drivers/net/e1000e/hw.h linux-3.0.8/drivers/net/e1000e/hw.h
31296 --- linux-3.0.8/drivers/net/e1000e/hw.h 2011-07-21 22:17:23.000000000 -0400
31297 +++ linux-3.0.8/drivers/net/e1000e/hw.h 2011-08-23 21:47:55.000000000 -0400
31298 @@ -776,6 +776,7 @@ struct e1000_mac_operations {
31299 void (*write_vfta)(struct e1000_hw *, u32, u32);
31300 s32 (*read_mac_addr)(struct e1000_hw *);
31301 };
31302 +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
31303
31304 /* Function pointers for the PHY. */
31305 struct e1000_phy_operations {
31306 @@ -799,6 +800,7 @@ struct e1000_phy_operations {
31307 void (*power_up)(struct e1000_hw *);
31308 void (*power_down)(struct e1000_hw *);
31309 };
31310 +typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
31311
31312 /* Function pointers for the NVM. */
31313 struct e1000_nvm_operations {
31314 @@ -810,9 +812,10 @@ struct e1000_nvm_operations {
31315 s32 (*validate)(struct e1000_hw *);
31316 s32 (*write)(struct e1000_hw *, u16, u16, u16 *);
31317 };
31318 +typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
31319
31320 struct e1000_mac_info {
31321 - struct e1000_mac_operations ops;
31322 + e1000_mac_operations_no_const ops;
31323 u8 addr[ETH_ALEN];
31324 u8 perm_addr[ETH_ALEN];
31325
31326 @@ -853,7 +856,7 @@ struct e1000_mac_info {
31327 };
31328
31329 struct e1000_phy_info {
31330 - struct e1000_phy_operations ops;
31331 + e1000_phy_operations_no_const ops;
31332
31333 enum e1000_phy_type type;
31334
31335 @@ -887,7 +890,7 @@ struct e1000_phy_info {
31336 };
31337
31338 struct e1000_nvm_info {
31339 - struct e1000_nvm_operations ops;
31340 + e1000_nvm_operations_no_const ops;
31341
31342 enum e1000_nvm_type type;
31343 enum e1000_nvm_override override;
31344 diff -urNp linux-3.0.8/drivers/net/fealnx.c linux-3.0.8/drivers/net/fealnx.c
31345 --- linux-3.0.8/drivers/net/fealnx.c 2011-07-21 22:17:23.000000000 -0400
31346 +++ linux-3.0.8/drivers/net/fealnx.c 2011-10-11 10:44:33.000000000 -0400
31347 @@ -150,7 +150,7 @@ struct chip_info {
31348 int flags;
31349 };
31350
31351 -static const struct chip_info skel_netdrv_tbl[] __devinitdata = {
31352 +static const struct chip_info skel_netdrv_tbl[] __devinitconst = {
31353 { "100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
31354 { "100/10M Ethernet PCI Adapter", HAS_CHIP_XCVR },
31355 { "1000/100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
31356 diff -urNp linux-3.0.8/drivers/net/hamradio/6pack.c linux-3.0.8/drivers/net/hamradio/6pack.c
31357 --- linux-3.0.8/drivers/net/hamradio/6pack.c 2011-07-21 22:17:23.000000000 -0400
31358 +++ linux-3.0.8/drivers/net/hamradio/6pack.c 2011-08-23 21:48:14.000000000 -0400
31359 @@ -463,6 +463,8 @@ static void sixpack_receive_buf(struct t
31360 unsigned char buf[512];
31361 int count1;
31362
31363 + pax_track_stack();
31364 +
31365 if (!count)
31366 return;
31367
31368 diff -urNp linux-3.0.8/drivers/net/igb/e1000_hw.h linux-3.0.8/drivers/net/igb/e1000_hw.h
31369 --- linux-3.0.8/drivers/net/igb/e1000_hw.h 2011-07-21 22:17:23.000000000 -0400
31370 +++ linux-3.0.8/drivers/net/igb/e1000_hw.h 2011-08-23 21:47:55.000000000 -0400
31371 @@ -314,6 +314,7 @@ struct e1000_mac_operations {
31372 s32 (*read_mac_addr)(struct e1000_hw *);
31373 s32 (*get_speed_and_duplex)(struct e1000_hw *, u16 *, u16 *);
31374 };
31375 +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
31376
31377 struct e1000_phy_operations {
31378 s32 (*acquire)(struct e1000_hw *);
31379 @@ -330,6 +331,7 @@ struct e1000_phy_operations {
31380 s32 (*set_d3_lplu_state)(struct e1000_hw *, bool);
31381 s32 (*write_reg)(struct e1000_hw *, u32, u16);
31382 };
31383 +typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
31384
31385 struct e1000_nvm_operations {
31386 s32 (*acquire)(struct e1000_hw *);
31387 @@ -339,6 +341,7 @@ struct e1000_nvm_operations {
31388 s32 (*update)(struct e1000_hw *);
31389 s32 (*validate)(struct e1000_hw *);
31390 };
31391 +typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
31392
31393 struct e1000_info {
31394 s32 (*get_invariants)(struct e1000_hw *);
31395 @@ -350,7 +353,7 @@ struct e1000_info {
31396 extern const struct e1000_info e1000_82575_info;
31397
31398 struct e1000_mac_info {
31399 - struct e1000_mac_operations ops;
31400 + e1000_mac_operations_no_const ops;
31401
31402 u8 addr[6];
31403 u8 perm_addr[6];
31404 @@ -388,7 +391,7 @@ struct e1000_mac_info {
31405 };
31406
31407 struct e1000_phy_info {
31408 - struct e1000_phy_operations ops;
31409 + e1000_phy_operations_no_const ops;
31410
31411 enum e1000_phy_type type;
31412
31413 @@ -423,7 +426,7 @@ struct e1000_phy_info {
31414 };
31415
31416 struct e1000_nvm_info {
31417 - struct e1000_nvm_operations ops;
31418 + e1000_nvm_operations_no_const ops;
31419 enum e1000_nvm_type type;
31420 enum e1000_nvm_override override;
31421
31422 @@ -468,6 +471,7 @@ struct e1000_mbx_operations {
31423 s32 (*check_for_ack)(struct e1000_hw *, u16);
31424 s32 (*check_for_rst)(struct e1000_hw *, u16);
31425 };
31426 +typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
31427
31428 struct e1000_mbx_stats {
31429 u32 msgs_tx;
31430 @@ -479,7 +483,7 @@ struct e1000_mbx_stats {
31431 };
31432
31433 struct e1000_mbx_info {
31434 - struct e1000_mbx_operations ops;
31435 + e1000_mbx_operations_no_const ops;
31436 struct e1000_mbx_stats stats;
31437 u32 timeout;
31438 u32 usec_delay;
31439 diff -urNp linux-3.0.8/drivers/net/igbvf/vf.h linux-3.0.8/drivers/net/igbvf/vf.h
31440 --- linux-3.0.8/drivers/net/igbvf/vf.h 2011-07-21 22:17:23.000000000 -0400
31441 +++ linux-3.0.8/drivers/net/igbvf/vf.h 2011-08-23 21:47:55.000000000 -0400
31442 @@ -189,9 +189,10 @@ struct e1000_mac_operations {
31443 s32 (*read_mac_addr)(struct e1000_hw *);
31444 s32 (*set_vfta)(struct e1000_hw *, u16, bool);
31445 };
31446 +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
31447
31448 struct e1000_mac_info {
31449 - struct e1000_mac_operations ops;
31450 + e1000_mac_operations_no_const ops;
31451 u8 addr[6];
31452 u8 perm_addr[6];
31453
31454 @@ -213,6 +214,7 @@ struct e1000_mbx_operations {
31455 s32 (*check_for_ack)(struct e1000_hw *);
31456 s32 (*check_for_rst)(struct e1000_hw *);
31457 };
31458 +typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
31459
31460 struct e1000_mbx_stats {
31461 u32 msgs_tx;
31462 @@ -224,7 +226,7 @@ struct e1000_mbx_stats {
31463 };
31464
31465 struct e1000_mbx_info {
31466 - struct e1000_mbx_operations ops;
31467 + e1000_mbx_operations_no_const ops;
31468 struct e1000_mbx_stats stats;
31469 u32 timeout;
31470 u32 usec_delay;
31471 diff -urNp linux-3.0.8/drivers/net/ixgb/ixgb_main.c linux-3.0.8/drivers/net/ixgb/ixgb_main.c
31472 --- linux-3.0.8/drivers/net/ixgb/ixgb_main.c 2011-07-21 22:17:23.000000000 -0400
31473 +++ linux-3.0.8/drivers/net/ixgb/ixgb_main.c 2011-08-23 21:48:14.000000000 -0400
31474 @@ -1070,6 +1070,8 @@ ixgb_set_multi(struct net_device *netdev
31475 u32 rctl;
31476 int i;
31477
31478 + pax_track_stack();
31479 +
31480 /* Check for Promiscuous and All Multicast modes */
31481
31482 rctl = IXGB_READ_REG(hw, RCTL);
31483 diff -urNp linux-3.0.8/drivers/net/ixgb/ixgb_param.c linux-3.0.8/drivers/net/ixgb/ixgb_param.c
31484 --- linux-3.0.8/drivers/net/ixgb/ixgb_param.c 2011-07-21 22:17:23.000000000 -0400
31485 +++ linux-3.0.8/drivers/net/ixgb/ixgb_param.c 2011-08-23 21:48:14.000000000 -0400
31486 @@ -261,6 +261,9 @@ void __devinit
31487 ixgb_check_options(struct ixgb_adapter *adapter)
31488 {
31489 int bd = adapter->bd_number;
31490 +
31491 + pax_track_stack();
31492 +
31493 if (bd >= IXGB_MAX_NIC) {
31494 pr_notice("Warning: no configuration for board #%i\n", bd);
31495 pr_notice("Using defaults for all values\n");
31496 diff -urNp linux-3.0.8/drivers/net/ixgbe/ixgbe_type.h linux-3.0.8/drivers/net/ixgbe/ixgbe_type.h
31497 --- linux-3.0.8/drivers/net/ixgbe/ixgbe_type.h 2011-07-21 22:17:23.000000000 -0400
31498 +++ linux-3.0.8/drivers/net/ixgbe/ixgbe_type.h 2011-08-23 21:47:55.000000000 -0400
31499 @@ -2584,6 +2584,7 @@ struct ixgbe_eeprom_operations {
31500 s32 (*update_checksum)(struct ixgbe_hw *);
31501 u16 (*calc_checksum)(struct ixgbe_hw *);
31502 };
31503 +typedef struct ixgbe_eeprom_operations __no_const ixgbe_eeprom_operations_no_const;
31504
31505 struct ixgbe_mac_operations {
31506 s32 (*init_hw)(struct ixgbe_hw *);
31507 @@ -2639,6 +2640,7 @@ struct ixgbe_mac_operations {
31508 /* Flow Control */
31509 s32 (*fc_enable)(struct ixgbe_hw *, s32);
31510 };
31511 +typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
31512
31513 struct ixgbe_phy_operations {
31514 s32 (*identify)(struct ixgbe_hw *);
31515 @@ -2658,9 +2660,10 @@ struct ixgbe_phy_operations {
31516 s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8);
31517 s32 (*check_overtemp)(struct ixgbe_hw *);
31518 };
31519 +typedef struct ixgbe_phy_operations __no_const ixgbe_phy_operations_no_const;
31520
31521 struct ixgbe_eeprom_info {
31522 - struct ixgbe_eeprom_operations ops;
31523 + ixgbe_eeprom_operations_no_const ops;
31524 enum ixgbe_eeprom_type type;
31525 u32 semaphore_delay;
31526 u16 word_size;
31527 @@ -2670,7 +2673,7 @@ struct ixgbe_eeprom_info {
31528
31529 #define IXGBE_FLAGS_DOUBLE_RESET_REQUIRED 0x01
31530 struct ixgbe_mac_info {
31531 - struct ixgbe_mac_operations ops;
31532 + ixgbe_mac_operations_no_const ops;
31533 enum ixgbe_mac_type type;
31534 u8 addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
31535 u8 perm_addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
31536 @@ -2698,7 +2701,7 @@ struct ixgbe_mac_info {
31537 };
31538
31539 struct ixgbe_phy_info {
31540 - struct ixgbe_phy_operations ops;
31541 + ixgbe_phy_operations_no_const ops;
31542 struct mdio_if_info mdio;
31543 enum ixgbe_phy_type type;
31544 u32 id;
31545 @@ -2726,6 +2729,7 @@ struct ixgbe_mbx_operations {
31546 s32 (*check_for_ack)(struct ixgbe_hw *, u16);
31547 s32 (*check_for_rst)(struct ixgbe_hw *, u16);
31548 };
31549 +typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const;
31550
31551 struct ixgbe_mbx_stats {
31552 u32 msgs_tx;
31553 @@ -2737,7 +2741,7 @@ struct ixgbe_mbx_stats {
31554 };
31555
31556 struct ixgbe_mbx_info {
31557 - struct ixgbe_mbx_operations ops;
31558 + ixgbe_mbx_operations_no_const ops;
31559 struct ixgbe_mbx_stats stats;
31560 u32 timeout;
31561 u32 usec_delay;
31562 diff -urNp linux-3.0.8/drivers/net/ixgbevf/vf.h linux-3.0.8/drivers/net/ixgbevf/vf.h
31563 --- linux-3.0.8/drivers/net/ixgbevf/vf.h 2011-07-21 22:17:23.000000000 -0400
31564 +++ linux-3.0.8/drivers/net/ixgbevf/vf.h 2011-08-23 21:47:55.000000000 -0400
31565 @@ -70,6 +70,7 @@ struct ixgbe_mac_operations {
31566 s32 (*clear_vfta)(struct ixgbe_hw *);
31567 s32 (*set_vfta)(struct ixgbe_hw *, u32, u32, bool);
31568 };
31569 +typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
31570
31571 enum ixgbe_mac_type {
31572 ixgbe_mac_unknown = 0,
31573 @@ -79,7 +80,7 @@ enum ixgbe_mac_type {
31574 };
31575
31576 struct ixgbe_mac_info {
31577 - struct ixgbe_mac_operations ops;
31578 + ixgbe_mac_operations_no_const ops;
31579 u8 addr[6];
31580 u8 perm_addr[6];
31581
31582 @@ -103,6 +104,7 @@ struct ixgbe_mbx_operations {
31583 s32 (*check_for_ack)(struct ixgbe_hw *);
31584 s32 (*check_for_rst)(struct ixgbe_hw *);
31585 };
31586 +typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const;
31587
31588 struct ixgbe_mbx_stats {
31589 u32 msgs_tx;
31590 @@ -114,7 +116,7 @@ struct ixgbe_mbx_stats {
31591 };
31592
31593 struct ixgbe_mbx_info {
31594 - struct ixgbe_mbx_operations ops;
31595 + ixgbe_mbx_operations_no_const ops;
31596 struct ixgbe_mbx_stats stats;
31597 u32 timeout;
31598 u32 udelay;
31599 diff -urNp linux-3.0.8/drivers/net/ksz884x.c linux-3.0.8/drivers/net/ksz884x.c
31600 --- linux-3.0.8/drivers/net/ksz884x.c 2011-07-21 22:17:23.000000000 -0400
31601 +++ linux-3.0.8/drivers/net/ksz884x.c 2011-08-23 21:48:14.000000000 -0400
31602 @@ -6534,6 +6534,8 @@ static void netdev_get_ethtool_stats(str
31603 int rc;
31604 u64 counter[TOTAL_PORT_COUNTER_NUM];
31605
31606 + pax_track_stack();
31607 +
31608 mutex_lock(&hw_priv->lock);
31609 n = SWITCH_PORT_NUM;
31610 for (i = 0, p = port->first_port; i < port->mib_port_cnt; i++, p++) {
31611 diff -urNp linux-3.0.8/drivers/net/mlx4/main.c linux-3.0.8/drivers/net/mlx4/main.c
31612 --- linux-3.0.8/drivers/net/mlx4/main.c 2011-07-21 22:17:23.000000000 -0400
31613 +++ linux-3.0.8/drivers/net/mlx4/main.c 2011-08-23 21:48:14.000000000 -0400
31614 @@ -40,6 +40,7 @@
31615 #include <linux/dma-mapping.h>
31616 #include <linux/slab.h>
31617 #include <linux/io-mapping.h>
31618 +#include <linux/sched.h>
31619
31620 #include <linux/mlx4/device.h>
31621 #include <linux/mlx4/doorbell.h>
31622 @@ -764,6 +765,8 @@ static int mlx4_init_hca(struct mlx4_dev
31623 u64 icm_size;
31624 int err;
31625
31626 + pax_track_stack();
31627 +
31628 err = mlx4_QUERY_FW(dev);
31629 if (err) {
31630 if (err == -EACCES)
31631 diff -urNp linux-3.0.8/drivers/net/niu.c linux-3.0.8/drivers/net/niu.c
31632 --- linux-3.0.8/drivers/net/niu.c 2011-10-24 08:05:21.000000000 -0400
31633 +++ linux-3.0.8/drivers/net/niu.c 2011-08-23 21:48:14.000000000 -0400
31634 @@ -9056,6 +9056,8 @@ static void __devinit niu_try_msix(struc
31635 int i, num_irqs, err;
31636 u8 first_ldg;
31637
31638 + pax_track_stack();
31639 +
31640 first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
31641 for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
31642 ldg_num_map[i] = first_ldg + i;
31643 diff -urNp linux-3.0.8/drivers/net/pcnet32.c linux-3.0.8/drivers/net/pcnet32.c
31644 --- linux-3.0.8/drivers/net/pcnet32.c 2011-07-21 22:17:23.000000000 -0400
31645 +++ linux-3.0.8/drivers/net/pcnet32.c 2011-08-23 21:47:55.000000000 -0400
31646 @@ -82,7 +82,7 @@ static int cards_found;
31647 /*
31648 * VLB I/O addresses
31649 */
31650 -static unsigned int pcnet32_portlist[] __initdata =
31651 +static unsigned int pcnet32_portlist[] __devinitdata =
31652 { 0x300, 0x320, 0x340, 0x360, 0 };
31653
31654 static int pcnet32_debug;
31655 @@ -270,7 +270,7 @@ struct pcnet32_private {
31656 struct sk_buff **rx_skbuff;
31657 dma_addr_t *tx_dma_addr;
31658 dma_addr_t *rx_dma_addr;
31659 - struct pcnet32_access a;
31660 + struct pcnet32_access *a;
31661 spinlock_t lock; /* Guard lock */
31662 unsigned int cur_rx, cur_tx; /* The next free ring entry */
31663 unsigned int rx_ring_size; /* current rx ring size */
31664 @@ -460,9 +460,9 @@ static void pcnet32_netif_start(struct n
31665 u16 val;
31666
31667 netif_wake_queue(dev);
31668 - val = lp->a.read_csr(ioaddr, CSR3);
31669 + val = lp->a->read_csr(ioaddr, CSR3);
31670 val &= 0x00ff;
31671 - lp->a.write_csr(ioaddr, CSR3, val);
31672 + lp->a->write_csr(ioaddr, CSR3, val);
31673 napi_enable(&lp->napi);
31674 }
31675
31676 @@ -730,7 +730,7 @@ static u32 pcnet32_get_link(struct net_d
31677 r = mii_link_ok(&lp->mii_if);
31678 } else if (lp->chip_version >= PCNET32_79C970A) {
31679 ulong ioaddr = dev->base_addr; /* card base I/O address */
31680 - r = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
31681 + r = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
31682 } else { /* can not detect link on really old chips */
31683 r = 1;
31684 }
31685 @@ -792,7 +792,7 @@ static int pcnet32_set_ringparam(struct
31686 pcnet32_netif_stop(dev);
31687
31688 spin_lock_irqsave(&lp->lock, flags);
31689 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
31690 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
31691
31692 size = min(ering->tx_pending, (unsigned int)TX_MAX_RING_SIZE);
31693
31694 @@ -868,7 +868,7 @@ static void pcnet32_ethtool_test(struct
31695 static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
31696 {
31697 struct pcnet32_private *lp = netdev_priv(dev);
31698 - struct pcnet32_access *a = &lp->a; /* access to registers */
31699 + struct pcnet32_access *a = lp->a; /* access to registers */
31700 ulong ioaddr = dev->base_addr; /* card base I/O address */
31701 struct sk_buff *skb; /* sk buff */
31702 int x, i; /* counters */
31703 @@ -888,21 +888,21 @@ static int pcnet32_loopback_test(struct
31704 pcnet32_netif_stop(dev);
31705
31706 spin_lock_irqsave(&lp->lock, flags);
31707 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
31708 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
31709
31710 numbuffs = min(numbuffs, (int)min(lp->rx_ring_size, lp->tx_ring_size));
31711
31712 /* Reset the PCNET32 */
31713 - lp->a.reset(ioaddr);
31714 - lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
31715 + lp->a->reset(ioaddr);
31716 + lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
31717
31718 /* switch pcnet32 to 32bit mode */
31719 - lp->a.write_bcr(ioaddr, 20, 2);
31720 + lp->a->write_bcr(ioaddr, 20, 2);
31721
31722 /* purge & init rings but don't actually restart */
31723 pcnet32_restart(dev, 0x0000);
31724
31725 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
31726 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
31727
31728 /* Initialize Transmit buffers. */
31729 size = data_len + 15;
31730 @@ -947,10 +947,10 @@ static int pcnet32_loopback_test(struct
31731
31732 /* set int loopback in CSR15 */
31733 x = a->read_csr(ioaddr, CSR15) & 0xfffc;
31734 - lp->a.write_csr(ioaddr, CSR15, x | 0x0044);
31735 + lp->a->write_csr(ioaddr, CSR15, x | 0x0044);
31736
31737 teststatus = cpu_to_le16(0x8000);
31738 - lp->a.write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
31739 + lp->a->write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
31740
31741 /* Check status of descriptors */
31742 for (x = 0; x < numbuffs; x++) {
31743 @@ -969,7 +969,7 @@ static int pcnet32_loopback_test(struct
31744 }
31745 }
31746
31747 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
31748 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
31749 wmb();
31750 if (netif_msg_hw(lp) && netif_msg_pktdata(lp)) {
31751 netdev_printk(KERN_DEBUG, dev, "RX loopback packets:\n");
31752 @@ -1015,7 +1015,7 @@ clean_up:
31753 pcnet32_restart(dev, CSR0_NORMAL);
31754 } else {
31755 pcnet32_purge_rx_ring(dev);
31756 - lp->a.write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
31757 + lp->a->write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
31758 }
31759 spin_unlock_irqrestore(&lp->lock, flags);
31760
31761 @@ -1026,7 +1026,7 @@ static int pcnet32_set_phys_id(struct ne
31762 enum ethtool_phys_id_state state)
31763 {
31764 struct pcnet32_private *lp = netdev_priv(dev);
31765 - struct pcnet32_access *a = &lp->a;
31766 + struct pcnet32_access *a = lp->a;
31767 ulong ioaddr = dev->base_addr;
31768 unsigned long flags;
31769 int i;
31770 @@ -1067,7 +1067,7 @@ static int pcnet32_suspend(struct net_de
31771 {
31772 int csr5;
31773 struct pcnet32_private *lp = netdev_priv(dev);
31774 - struct pcnet32_access *a = &lp->a;
31775 + struct pcnet32_access *a = lp->a;
31776 ulong ioaddr = dev->base_addr;
31777 int ticks;
31778
31779 @@ -1324,8 +1324,8 @@ static int pcnet32_poll(struct napi_stru
31780 spin_lock_irqsave(&lp->lock, flags);
31781 if (pcnet32_tx(dev)) {
31782 /* reset the chip to clear the error condition, then restart */
31783 - lp->a.reset(ioaddr);
31784 - lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
31785 + lp->a->reset(ioaddr);
31786 + lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
31787 pcnet32_restart(dev, CSR0_START);
31788 netif_wake_queue(dev);
31789 }
31790 @@ -1337,12 +1337,12 @@ static int pcnet32_poll(struct napi_stru
31791 __napi_complete(napi);
31792
31793 /* clear interrupt masks */
31794 - val = lp->a.read_csr(ioaddr, CSR3);
31795 + val = lp->a->read_csr(ioaddr, CSR3);
31796 val &= 0x00ff;
31797 - lp->a.write_csr(ioaddr, CSR3, val);
31798 + lp->a->write_csr(ioaddr, CSR3, val);
31799
31800 /* Set interrupt enable. */
31801 - lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN);
31802 + lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN);
31803
31804 spin_unlock_irqrestore(&lp->lock, flags);
31805 }
31806 @@ -1365,7 +1365,7 @@ static void pcnet32_get_regs(struct net_
31807 int i, csr0;
31808 u16 *buff = ptr;
31809 struct pcnet32_private *lp = netdev_priv(dev);
31810 - struct pcnet32_access *a = &lp->a;
31811 + struct pcnet32_access *a = lp->a;
31812 ulong ioaddr = dev->base_addr;
31813 unsigned long flags;
31814
31815 @@ -1401,9 +1401,9 @@ static void pcnet32_get_regs(struct net_
31816 for (j = 0; j < PCNET32_MAX_PHYS; j++) {
31817 if (lp->phymask & (1 << j)) {
31818 for (i = 0; i < PCNET32_REGS_PER_PHY; i++) {
31819 - lp->a.write_bcr(ioaddr, 33,
31820 + lp->a->write_bcr(ioaddr, 33,
31821 (j << 5) | i);
31822 - *buff++ = lp->a.read_bcr(ioaddr, 34);
31823 + *buff++ = lp->a->read_bcr(ioaddr, 34);
31824 }
31825 }
31826 }
31827 @@ -1785,7 +1785,7 @@ pcnet32_probe1(unsigned long ioaddr, int
31828 ((cards_found >= MAX_UNITS) || full_duplex[cards_found]))
31829 lp->options |= PCNET32_PORT_FD;
31830
31831 - lp->a = *a;
31832 + lp->a = a;
31833
31834 /* prior to register_netdev, dev->name is not yet correct */
31835 if (pcnet32_alloc_ring(dev, pci_name(lp->pci_dev))) {
31836 @@ -1844,7 +1844,7 @@ pcnet32_probe1(unsigned long ioaddr, int
31837 if (lp->mii) {
31838 /* lp->phycount and lp->phymask are set to 0 by memset above */
31839
31840 - lp->mii_if.phy_id = ((lp->a.read_bcr(ioaddr, 33)) >> 5) & 0x1f;
31841 + lp->mii_if.phy_id = ((lp->a->read_bcr(ioaddr, 33)) >> 5) & 0x1f;
31842 /* scan for PHYs */
31843 for (i = 0; i < PCNET32_MAX_PHYS; i++) {
31844 unsigned short id1, id2;
31845 @@ -1864,7 +1864,7 @@ pcnet32_probe1(unsigned long ioaddr, int
31846 pr_info("Found PHY %04x:%04x at address %d\n",
31847 id1, id2, i);
31848 }
31849 - lp->a.write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
31850 + lp->a->write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
31851 if (lp->phycount > 1)
31852 lp->options |= PCNET32_PORT_MII;
31853 }
31854 @@ -2020,10 +2020,10 @@ static int pcnet32_open(struct net_devic
31855 }
31856
31857 /* Reset the PCNET32 */
31858 - lp->a.reset(ioaddr);
31859 + lp->a->reset(ioaddr);
31860
31861 /* switch pcnet32 to 32bit mode */
31862 - lp->a.write_bcr(ioaddr, 20, 2);
31863 + lp->a->write_bcr(ioaddr, 20, 2);
31864
31865 netif_printk(lp, ifup, KERN_DEBUG, dev,
31866 "%s() irq %d tx/rx rings %#x/%#x init %#x\n",
31867 @@ -2032,14 +2032,14 @@ static int pcnet32_open(struct net_devic
31868 (u32) (lp->init_dma_addr));
31869
31870 /* set/reset autoselect bit */
31871 - val = lp->a.read_bcr(ioaddr, 2) & ~2;
31872 + val = lp->a->read_bcr(ioaddr, 2) & ~2;
31873 if (lp->options & PCNET32_PORT_ASEL)
31874 val |= 2;
31875 - lp->a.write_bcr(ioaddr, 2, val);
31876 + lp->a->write_bcr(ioaddr, 2, val);
31877
31878 /* handle full duplex setting */
31879 if (lp->mii_if.full_duplex) {
31880 - val = lp->a.read_bcr(ioaddr, 9) & ~3;
31881 + val = lp->a->read_bcr(ioaddr, 9) & ~3;
31882 if (lp->options & PCNET32_PORT_FD) {
31883 val |= 1;
31884 if (lp->options == (PCNET32_PORT_FD | PCNET32_PORT_AUI))
31885 @@ -2049,14 +2049,14 @@ static int pcnet32_open(struct net_devic
31886 if (lp->chip_version == 0x2627)
31887 val |= 3;
31888 }
31889 - lp->a.write_bcr(ioaddr, 9, val);
31890 + lp->a->write_bcr(ioaddr, 9, val);
31891 }
31892
31893 /* set/reset GPSI bit in test register */
31894 - val = lp->a.read_csr(ioaddr, 124) & ~0x10;
31895 + val = lp->a->read_csr(ioaddr, 124) & ~0x10;
31896 if ((lp->options & PCNET32_PORT_PORTSEL) == PCNET32_PORT_GPSI)
31897 val |= 0x10;
31898 - lp->a.write_csr(ioaddr, 124, val);
31899 + lp->a->write_csr(ioaddr, 124, val);
31900
31901 /* Allied Telesyn AT 2700/2701 FX are 100Mbit only and do not negotiate */
31902 if (pdev && pdev->subsystem_vendor == PCI_VENDOR_ID_AT &&
31903 @@ -2075,24 +2075,24 @@ static int pcnet32_open(struct net_devic
31904 * duplex, and/or enable auto negotiation, and clear DANAS
31905 */
31906 if (lp->mii && !(lp->options & PCNET32_PORT_ASEL)) {
31907 - lp->a.write_bcr(ioaddr, 32,
31908 - lp->a.read_bcr(ioaddr, 32) | 0x0080);
31909 + lp->a->write_bcr(ioaddr, 32,
31910 + lp->a->read_bcr(ioaddr, 32) | 0x0080);
31911 /* disable Auto Negotiation, set 10Mpbs, HD */
31912 - val = lp->a.read_bcr(ioaddr, 32) & ~0xb8;
31913 + val = lp->a->read_bcr(ioaddr, 32) & ~0xb8;
31914 if (lp->options & PCNET32_PORT_FD)
31915 val |= 0x10;
31916 if (lp->options & PCNET32_PORT_100)
31917 val |= 0x08;
31918 - lp->a.write_bcr(ioaddr, 32, val);
31919 + lp->a->write_bcr(ioaddr, 32, val);
31920 } else {
31921 if (lp->options & PCNET32_PORT_ASEL) {
31922 - lp->a.write_bcr(ioaddr, 32,
31923 - lp->a.read_bcr(ioaddr,
31924 + lp->a->write_bcr(ioaddr, 32,
31925 + lp->a->read_bcr(ioaddr,
31926 32) | 0x0080);
31927 /* enable auto negotiate, setup, disable fd */
31928 - val = lp->a.read_bcr(ioaddr, 32) & ~0x98;
31929 + val = lp->a->read_bcr(ioaddr, 32) & ~0x98;
31930 val |= 0x20;
31931 - lp->a.write_bcr(ioaddr, 32, val);
31932 + lp->a->write_bcr(ioaddr, 32, val);
31933 }
31934 }
31935 } else {
31936 @@ -2105,10 +2105,10 @@ static int pcnet32_open(struct net_devic
31937 * There is really no good other way to handle multiple PHYs
31938 * other than turning off all automatics
31939 */
31940 - val = lp->a.read_bcr(ioaddr, 2);
31941 - lp->a.write_bcr(ioaddr, 2, val & ~2);
31942 - val = lp->a.read_bcr(ioaddr, 32);
31943 - lp->a.write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
31944 + val = lp->a->read_bcr(ioaddr, 2);
31945 + lp->a->write_bcr(ioaddr, 2, val & ~2);
31946 + val = lp->a->read_bcr(ioaddr, 32);
31947 + lp->a->write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
31948
31949 if (!(lp->options & PCNET32_PORT_ASEL)) {
31950 /* setup ecmd */
31951 @@ -2118,7 +2118,7 @@ static int pcnet32_open(struct net_devic
31952 ethtool_cmd_speed_set(&ecmd,
31953 (lp->options & PCNET32_PORT_100) ?
31954 SPEED_100 : SPEED_10);
31955 - bcr9 = lp->a.read_bcr(ioaddr, 9);
31956 + bcr9 = lp->a->read_bcr(ioaddr, 9);
31957
31958 if (lp->options & PCNET32_PORT_FD) {
31959 ecmd.duplex = DUPLEX_FULL;
31960 @@ -2127,7 +2127,7 @@ static int pcnet32_open(struct net_devic
31961 ecmd.duplex = DUPLEX_HALF;
31962 bcr9 |= ~(1 << 0);
31963 }
31964 - lp->a.write_bcr(ioaddr, 9, bcr9);
31965 + lp->a->write_bcr(ioaddr, 9, bcr9);
31966 }
31967
31968 for (i = 0; i < PCNET32_MAX_PHYS; i++) {
31969 @@ -2158,9 +2158,9 @@ static int pcnet32_open(struct net_devic
31970
31971 #ifdef DO_DXSUFLO
31972 if (lp->dxsuflo) { /* Disable transmit stop on underflow */
31973 - val = lp->a.read_csr(ioaddr, CSR3);
31974 + val = lp->a->read_csr(ioaddr, CSR3);
31975 val |= 0x40;
31976 - lp->a.write_csr(ioaddr, CSR3, val);
31977 + lp->a->write_csr(ioaddr, CSR3, val);
31978 }
31979 #endif
31980
31981 @@ -2176,11 +2176,11 @@ static int pcnet32_open(struct net_devic
31982 napi_enable(&lp->napi);
31983
31984 /* Re-initialize the PCNET32, and start it when done. */
31985 - lp->a.write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
31986 - lp->a.write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
31987 + lp->a->write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
31988 + lp->a->write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
31989
31990 - lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
31991 - lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
31992 + lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
31993 + lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
31994
31995 netif_start_queue(dev);
31996
31997 @@ -2192,19 +2192,19 @@ static int pcnet32_open(struct net_devic
31998
31999 i = 0;
32000 while (i++ < 100)
32001 - if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
32002 + if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
32003 break;
32004 /*
32005 * We used to clear the InitDone bit, 0x0100, here but Mark Stockton
32006 * reports that doing so triggers a bug in the '974.
32007 */
32008 - lp->a.write_csr(ioaddr, CSR0, CSR0_NORMAL);
32009 + lp->a->write_csr(ioaddr, CSR0, CSR0_NORMAL);
32010
32011 netif_printk(lp, ifup, KERN_DEBUG, dev,
32012 "pcnet32 open after %d ticks, init block %#x csr0 %4.4x\n",
32013 i,
32014 (u32) (lp->init_dma_addr),
32015 - lp->a.read_csr(ioaddr, CSR0));
32016 + lp->a->read_csr(ioaddr, CSR0));
32017
32018 spin_unlock_irqrestore(&lp->lock, flags);
32019
32020 @@ -2218,7 +2218,7 @@ err_free_ring:
32021 * Switch back to 16bit mode to avoid problems with dumb
32022 * DOS packet driver after a warm reboot
32023 */
32024 - lp->a.write_bcr(ioaddr, 20, 4);
32025 + lp->a->write_bcr(ioaddr, 20, 4);
32026
32027 err_free_irq:
32028 spin_unlock_irqrestore(&lp->lock, flags);
32029 @@ -2323,7 +2323,7 @@ static void pcnet32_restart(struct net_d
32030
32031 /* wait for stop */
32032 for (i = 0; i < 100; i++)
32033 - if (lp->a.read_csr(ioaddr, CSR0) & CSR0_STOP)
32034 + if (lp->a->read_csr(ioaddr, CSR0) & CSR0_STOP)
32035 break;
32036
32037 if (i >= 100)
32038 @@ -2335,13 +2335,13 @@ static void pcnet32_restart(struct net_d
32039 return;
32040
32041 /* ReInit Ring */
32042 - lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
32043 + lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
32044 i = 0;
32045 while (i++ < 1000)
32046 - if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
32047 + if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
32048 break;
32049
32050 - lp->a.write_csr(ioaddr, CSR0, csr0_bits);
32051 + lp->a->write_csr(ioaddr, CSR0, csr0_bits);
32052 }
32053
32054 static void pcnet32_tx_timeout(struct net_device *dev)
32055 @@ -2353,8 +2353,8 @@ static void pcnet32_tx_timeout(struct ne
32056 /* Transmitter timeout, serious problems. */
32057 if (pcnet32_debug & NETIF_MSG_DRV)
32058 pr_err("%s: transmit timed out, status %4.4x, resetting\n",
32059 - dev->name, lp->a.read_csr(ioaddr, CSR0));
32060 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
32061 + dev->name, lp->a->read_csr(ioaddr, CSR0));
32062 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
32063 dev->stats.tx_errors++;
32064 if (netif_msg_tx_err(lp)) {
32065 int i;
32066 @@ -2397,7 +2397,7 @@ static netdev_tx_t pcnet32_start_xmit(st
32067
32068 netif_printk(lp, tx_queued, KERN_DEBUG, dev,
32069 "%s() called, csr0 %4.4x\n",
32070 - __func__, lp->a.read_csr(ioaddr, CSR0));
32071 + __func__, lp->a->read_csr(ioaddr, CSR0));
32072
32073 /* Default status -- will not enable Successful-TxDone
32074 * interrupt when that option is available to us.
32075 @@ -2427,7 +2427,7 @@ static netdev_tx_t pcnet32_start_xmit(st
32076 dev->stats.tx_bytes += skb->len;
32077
32078 /* Trigger an immediate send poll. */
32079 - lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
32080 + lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
32081
32082 if (lp->tx_ring[(entry + 1) & lp->tx_mod_mask].base != 0) {
32083 lp->tx_full = 1;
32084 @@ -2452,16 +2452,16 @@ pcnet32_interrupt(int irq, void *dev_id)
32085
32086 spin_lock(&lp->lock);
32087
32088 - csr0 = lp->a.read_csr(ioaddr, CSR0);
32089 + csr0 = lp->a->read_csr(ioaddr, CSR0);
32090 while ((csr0 & 0x8f00) && --boguscnt >= 0) {
32091 if (csr0 == 0xffff)
32092 break; /* PCMCIA remove happened */
32093 /* Acknowledge all of the current interrupt sources ASAP. */
32094 - lp->a.write_csr(ioaddr, CSR0, csr0 & ~0x004f);
32095 + lp->a->write_csr(ioaddr, CSR0, csr0 & ~0x004f);
32096
32097 netif_printk(lp, intr, KERN_DEBUG, dev,
32098 "interrupt csr0=%#2.2x new csr=%#2.2x\n",
32099 - csr0, lp->a.read_csr(ioaddr, CSR0));
32100 + csr0, lp->a->read_csr(ioaddr, CSR0));
32101
32102 /* Log misc errors. */
32103 if (csr0 & 0x4000)
32104 @@ -2488,19 +2488,19 @@ pcnet32_interrupt(int irq, void *dev_id)
32105 if (napi_schedule_prep(&lp->napi)) {
32106 u16 val;
32107 /* set interrupt masks */
32108 - val = lp->a.read_csr(ioaddr, CSR3);
32109 + val = lp->a->read_csr(ioaddr, CSR3);
32110 val |= 0x5f00;
32111 - lp->a.write_csr(ioaddr, CSR3, val);
32112 + lp->a->write_csr(ioaddr, CSR3, val);
32113
32114 __napi_schedule(&lp->napi);
32115 break;
32116 }
32117 - csr0 = lp->a.read_csr(ioaddr, CSR0);
32118 + csr0 = lp->a->read_csr(ioaddr, CSR0);
32119 }
32120
32121 netif_printk(lp, intr, KERN_DEBUG, dev,
32122 "exiting interrupt, csr0=%#4.4x\n",
32123 - lp->a.read_csr(ioaddr, CSR0));
32124 + lp->a->read_csr(ioaddr, CSR0));
32125
32126 spin_unlock(&lp->lock);
32127
32128 @@ -2520,20 +2520,20 @@ static int pcnet32_close(struct net_devi
32129
32130 spin_lock_irqsave(&lp->lock, flags);
32131
32132 - dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
32133 + dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
32134
32135 netif_printk(lp, ifdown, KERN_DEBUG, dev,
32136 "Shutting down ethercard, status was %2.2x\n",
32137 - lp->a.read_csr(ioaddr, CSR0));
32138 + lp->a->read_csr(ioaddr, CSR0));
32139
32140 /* We stop the PCNET32 here -- it occasionally polls memory if we don't. */
32141 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
32142 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
32143
32144 /*
32145 * Switch back to 16bit mode to avoid problems with dumb
32146 * DOS packet driver after a warm reboot
32147 */
32148 - lp->a.write_bcr(ioaddr, 20, 4);
32149 + lp->a->write_bcr(ioaddr, 20, 4);
32150
32151 spin_unlock_irqrestore(&lp->lock, flags);
32152
32153 @@ -2556,7 +2556,7 @@ static struct net_device_stats *pcnet32_
32154 unsigned long flags;
32155
32156 spin_lock_irqsave(&lp->lock, flags);
32157 - dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
32158 + dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
32159 spin_unlock_irqrestore(&lp->lock, flags);
32160
32161 return &dev->stats;
32162 @@ -2578,10 +2578,10 @@ static void pcnet32_load_multicast(struc
32163 if (dev->flags & IFF_ALLMULTI) {
32164 ib->filter[0] = cpu_to_le32(~0U);
32165 ib->filter[1] = cpu_to_le32(~0U);
32166 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
32167 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
32168 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
32169 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
32170 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
32171 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
32172 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
32173 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
32174 return;
32175 }
32176 /* clear the multicast filter */
32177 @@ -2601,7 +2601,7 @@ static void pcnet32_load_multicast(struc
32178 mcast_table[crc >> 4] |= cpu_to_le16(1 << (crc & 0xf));
32179 }
32180 for (i = 0; i < 4; i++)
32181 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER + i,
32182 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER + i,
32183 le16_to_cpu(mcast_table[i]));
32184 }
32185
32186 @@ -2616,28 +2616,28 @@ static void pcnet32_set_multicast_list(s
32187
32188 spin_lock_irqsave(&lp->lock, flags);
32189 suspended = pcnet32_suspend(dev, &flags, 0);
32190 - csr15 = lp->a.read_csr(ioaddr, CSR15);
32191 + csr15 = lp->a->read_csr(ioaddr, CSR15);
32192 if (dev->flags & IFF_PROMISC) {
32193 /* Log any net taps. */
32194 netif_info(lp, hw, dev, "Promiscuous mode enabled\n");
32195 lp->init_block->mode =
32196 cpu_to_le16(0x8000 | (lp->options & PCNET32_PORT_PORTSEL) <<
32197 7);
32198 - lp->a.write_csr(ioaddr, CSR15, csr15 | 0x8000);
32199 + lp->a->write_csr(ioaddr, CSR15, csr15 | 0x8000);
32200 } else {
32201 lp->init_block->mode =
32202 cpu_to_le16((lp->options & PCNET32_PORT_PORTSEL) << 7);
32203 - lp->a.write_csr(ioaddr, CSR15, csr15 & 0x7fff);
32204 + lp->a->write_csr(ioaddr, CSR15, csr15 & 0x7fff);
32205 pcnet32_load_multicast(dev);
32206 }
32207
32208 if (suspended) {
32209 int csr5;
32210 /* clear SUSPEND (SPND) - CSR5 bit 0 */
32211 - csr5 = lp->a.read_csr(ioaddr, CSR5);
32212 - lp->a.write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
32213 + csr5 = lp->a->read_csr(ioaddr, CSR5);
32214 + lp->a->write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
32215 } else {
32216 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
32217 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
32218 pcnet32_restart(dev, CSR0_NORMAL);
32219 netif_wake_queue(dev);
32220 }
32221 @@ -2655,8 +2655,8 @@ static int mdio_read(struct net_device *
32222 if (!lp->mii)
32223 return 0;
32224
32225 - lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
32226 - val_out = lp->a.read_bcr(ioaddr, 34);
32227 + lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
32228 + val_out = lp->a->read_bcr(ioaddr, 34);
32229
32230 return val_out;
32231 }
32232 @@ -2670,8 +2670,8 @@ static void mdio_write(struct net_device
32233 if (!lp->mii)
32234 return;
32235
32236 - lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
32237 - lp->a.write_bcr(ioaddr, 34, val);
32238 + lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
32239 + lp->a->write_bcr(ioaddr, 34, val);
32240 }
32241
32242 static int pcnet32_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
32243 @@ -2748,7 +2748,7 @@ static void pcnet32_check_media(struct n
32244 curr_link = mii_link_ok(&lp->mii_if);
32245 } else {
32246 ulong ioaddr = dev->base_addr; /* card base I/O address */
32247 - curr_link = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
32248 + curr_link = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
32249 }
32250 if (!curr_link) {
32251 if (prev_link || verbose) {
32252 @@ -2771,13 +2771,13 @@ static void pcnet32_check_media(struct n
32253 (ecmd.duplex == DUPLEX_FULL)
32254 ? "full" : "half");
32255 }
32256 - bcr9 = lp->a.read_bcr(dev->base_addr, 9);
32257 + bcr9 = lp->a->read_bcr(dev->base_addr, 9);
32258 if ((bcr9 & (1 << 0)) != lp->mii_if.full_duplex) {
32259 if (lp->mii_if.full_duplex)
32260 bcr9 |= (1 << 0);
32261 else
32262 bcr9 &= ~(1 << 0);
32263 - lp->a.write_bcr(dev->base_addr, 9, bcr9);
32264 + lp->a->write_bcr(dev->base_addr, 9, bcr9);
32265 }
32266 } else {
32267 netif_info(lp, link, dev, "link up\n");
32268 diff -urNp linux-3.0.8/drivers/net/ppp_generic.c linux-3.0.8/drivers/net/ppp_generic.c
32269 --- linux-3.0.8/drivers/net/ppp_generic.c 2011-07-21 22:17:23.000000000 -0400
32270 +++ linux-3.0.8/drivers/net/ppp_generic.c 2011-08-23 21:47:55.000000000 -0400
32271 @@ -987,7 +987,6 @@ ppp_net_ioctl(struct net_device *dev, st
32272 void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
32273 struct ppp_stats stats;
32274 struct ppp_comp_stats cstats;
32275 - char *vers;
32276
32277 switch (cmd) {
32278 case SIOCGPPPSTATS:
32279 @@ -1009,8 +1008,7 @@ ppp_net_ioctl(struct net_device *dev, st
32280 break;
32281
32282 case SIOCGPPPVER:
32283 - vers = PPP_VERSION;
32284 - if (copy_to_user(addr, vers, strlen(vers) + 1))
32285 + if (copy_to_user(addr, PPP_VERSION, sizeof(PPP_VERSION)))
32286 break;
32287 err = 0;
32288 break;
32289 diff -urNp linux-3.0.8/drivers/net/r8169.c linux-3.0.8/drivers/net/r8169.c
32290 --- linux-3.0.8/drivers/net/r8169.c 2011-10-24 08:05:21.000000000 -0400
32291 +++ linux-3.0.8/drivers/net/r8169.c 2011-08-23 21:47:55.000000000 -0400
32292 @@ -645,12 +645,12 @@ struct rtl8169_private {
32293 struct mdio_ops {
32294 void (*write)(void __iomem *, int, int);
32295 int (*read)(void __iomem *, int);
32296 - } mdio_ops;
32297 + } __no_const mdio_ops;
32298
32299 struct pll_power_ops {
32300 void (*down)(struct rtl8169_private *);
32301 void (*up)(struct rtl8169_private *);
32302 - } pll_power_ops;
32303 + } __no_const pll_power_ops;
32304
32305 int (*set_speed)(struct net_device *, u8 aneg, u16 sp, u8 dpx, u32 adv);
32306 int (*get_settings)(struct net_device *, struct ethtool_cmd *);
32307 diff -urNp linux-3.0.8/drivers/net/sis190.c linux-3.0.8/drivers/net/sis190.c
32308 --- linux-3.0.8/drivers/net/sis190.c 2011-10-24 08:05:21.000000000 -0400
32309 +++ linux-3.0.8/drivers/net/sis190.c 2011-10-11 10:44:33.000000000 -0400
32310 @@ -1623,7 +1623,7 @@ static int __devinit sis190_get_mac_addr
32311 static int __devinit sis190_get_mac_addr_from_apc(struct pci_dev *pdev,
32312 struct net_device *dev)
32313 {
32314 - static const u16 __devinitdata ids[] = { 0x0965, 0x0966, 0x0968 };
32315 + static const u16 __devinitconst ids[] = { 0x0965, 0x0966, 0x0968 };
32316 struct sis190_private *tp = netdev_priv(dev);
32317 struct pci_dev *isa_bridge;
32318 u8 reg, tmp8;
32319 diff -urNp linux-3.0.8/drivers/net/sundance.c linux-3.0.8/drivers/net/sundance.c
32320 --- linux-3.0.8/drivers/net/sundance.c 2011-07-21 22:17:23.000000000 -0400
32321 +++ linux-3.0.8/drivers/net/sundance.c 2011-10-11 10:44:33.000000000 -0400
32322 @@ -218,7 +218,7 @@ enum {
32323 struct pci_id_info {
32324 const char *name;
32325 };
32326 -static const struct pci_id_info pci_id_tbl[] __devinitdata = {
32327 +static const struct pci_id_info pci_id_tbl[] __devinitconst = {
32328 {"D-Link DFE-550TX FAST Ethernet Adapter"},
32329 {"D-Link DFE-550FX 100Mbps Fiber-optics Adapter"},
32330 {"D-Link DFE-580TX 4 port Server Adapter"},
32331 diff -urNp linux-3.0.8/drivers/net/tg3.h linux-3.0.8/drivers/net/tg3.h
32332 --- linux-3.0.8/drivers/net/tg3.h 2011-07-21 22:17:23.000000000 -0400
32333 +++ linux-3.0.8/drivers/net/tg3.h 2011-08-23 21:47:55.000000000 -0400
32334 @@ -134,6 +134,7 @@
32335 #define CHIPREV_ID_5750_A0 0x4000
32336 #define CHIPREV_ID_5750_A1 0x4001
32337 #define CHIPREV_ID_5750_A3 0x4003
32338 +#define CHIPREV_ID_5750_C1 0x4201
32339 #define CHIPREV_ID_5750_C2 0x4202
32340 #define CHIPREV_ID_5752_A0_HW 0x5000
32341 #define CHIPREV_ID_5752_A0 0x6000
32342 diff -urNp linux-3.0.8/drivers/net/tokenring/abyss.c linux-3.0.8/drivers/net/tokenring/abyss.c
32343 --- linux-3.0.8/drivers/net/tokenring/abyss.c 2011-07-21 22:17:23.000000000 -0400
32344 +++ linux-3.0.8/drivers/net/tokenring/abyss.c 2011-08-23 21:47:55.000000000 -0400
32345 @@ -451,10 +451,12 @@ static struct pci_driver abyss_driver =
32346
32347 static int __init abyss_init (void)
32348 {
32349 - abyss_netdev_ops = tms380tr_netdev_ops;
32350 + pax_open_kernel();
32351 + memcpy((void *)&abyss_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
32352
32353 - abyss_netdev_ops.ndo_open = abyss_open;
32354 - abyss_netdev_ops.ndo_stop = abyss_close;
32355 + *(void **)&abyss_netdev_ops.ndo_open = abyss_open;
32356 + *(void **)&abyss_netdev_ops.ndo_stop = abyss_close;
32357 + pax_close_kernel();
32358
32359 return pci_register_driver(&abyss_driver);
32360 }
32361 diff -urNp linux-3.0.8/drivers/net/tokenring/madgemc.c linux-3.0.8/drivers/net/tokenring/madgemc.c
32362 --- linux-3.0.8/drivers/net/tokenring/madgemc.c 2011-07-21 22:17:23.000000000 -0400
32363 +++ linux-3.0.8/drivers/net/tokenring/madgemc.c 2011-08-23 21:47:55.000000000 -0400
32364 @@ -744,9 +744,11 @@ static struct mca_driver madgemc_driver
32365
32366 static int __init madgemc_init (void)
32367 {
32368 - madgemc_netdev_ops = tms380tr_netdev_ops;
32369 - madgemc_netdev_ops.ndo_open = madgemc_open;
32370 - madgemc_netdev_ops.ndo_stop = madgemc_close;
32371 + pax_open_kernel();
32372 + memcpy((void *)&madgemc_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
32373 + *(void **)&madgemc_netdev_ops.ndo_open = madgemc_open;
32374 + *(void **)&madgemc_netdev_ops.ndo_stop = madgemc_close;
32375 + pax_close_kernel();
32376
32377 return mca_register_driver (&madgemc_driver);
32378 }
32379 diff -urNp linux-3.0.8/drivers/net/tokenring/proteon.c linux-3.0.8/drivers/net/tokenring/proteon.c
32380 --- linux-3.0.8/drivers/net/tokenring/proteon.c 2011-07-21 22:17:23.000000000 -0400
32381 +++ linux-3.0.8/drivers/net/tokenring/proteon.c 2011-08-23 21:47:55.000000000 -0400
32382 @@ -353,9 +353,11 @@ static int __init proteon_init(void)
32383 struct platform_device *pdev;
32384 int i, num = 0, err = 0;
32385
32386 - proteon_netdev_ops = tms380tr_netdev_ops;
32387 - proteon_netdev_ops.ndo_open = proteon_open;
32388 - proteon_netdev_ops.ndo_stop = tms380tr_close;
32389 + pax_open_kernel();
32390 + memcpy((void *)&proteon_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
32391 + *(void **)&proteon_netdev_ops.ndo_open = proteon_open;
32392 + *(void **)&proteon_netdev_ops.ndo_stop = tms380tr_close;
32393 + pax_close_kernel();
32394
32395 err = platform_driver_register(&proteon_driver);
32396 if (err)
32397 diff -urNp linux-3.0.8/drivers/net/tokenring/skisa.c linux-3.0.8/drivers/net/tokenring/skisa.c
32398 --- linux-3.0.8/drivers/net/tokenring/skisa.c 2011-07-21 22:17:23.000000000 -0400
32399 +++ linux-3.0.8/drivers/net/tokenring/skisa.c 2011-08-23 21:47:55.000000000 -0400
32400 @@ -363,9 +363,11 @@ static int __init sk_isa_init(void)
32401 struct platform_device *pdev;
32402 int i, num = 0, err = 0;
32403
32404 - sk_isa_netdev_ops = tms380tr_netdev_ops;
32405 - sk_isa_netdev_ops.ndo_open = sk_isa_open;
32406 - sk_isa_netdev_ops.ndo_stop = tms380tr_close;
32407 + pax_open_kernel();
32408 + memcpy((void *)&sk_isa_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
32409 + *(void **)&sk_isa_netdev_ops.ndo_open = sk_isa_open;
32410 + *(void **)&sk_isa_netdev_ops.ndo_stop = tms380tr_close;
32411 + pax_close_kernel();
32412
32413 err = platform_driver_register(&sk_isa_driver);
32414 if (err)
32415 diff -urNp linux-3.0.8/drivers/net/tulip/de2104x.c linux-3.0.8/drivers/net/tulip/de2104x.c
32416 --- linux-3.0.8/drivers/net/tulip/de2104x.c 2011-07-21 22:17:23.000000000 -0400
32417 +++ linux-3.0.8/drivers/net/tulip/de2104x.c 2011-08-23 21:48:14.000000000 -0400
32418 @@ -1794,6 +1794,8 @@ static void __devinit de21041_get_srom_i
32419 struct de_srom_info_leaf *il;
32420 void *bufp;
32421
32422 + pax_track_stack();
32423 +
32424 /* download entire eeprom */
32425 for (i = 0; i < DE_EEPROM_WORDS; i++)
32426 ((__le16 *)ee_data)[i] =
32427 diff -urNp linux-3.0.8/drivers/net/tulip/de4x5.c linux-3.0.8/drivers/net/tulip/de4x5.c
32428 --- linux-3.0.8/drivers/net/tulip/de4x5.c 2011-07-21 22:17:23.000000000 -0400
32429 +++ linux-3.0.8/drivers/net/tulip/de4x5.c 2011-08-23 21:47:55.000000000 -0400
32430 @@ -5401,7 +5401,7 @@ de4x5_ioctl(struct net_device *dev, stru
32431 for (i=0; i<ETH_ALEN; i++) {
32432 tmp.addr[i] = dev->dev_addr[i];
32433 }
32434 - if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
32435 + if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
32436 break;
32437
32438 case DE4X5_SET_HWADDR: /* Set the hardware address */
32439 @@ -5441,7 +5441,7 @@ de4x5_ioctl(struct net_device *dev, stru
32440 spin_lock_irqsave(&lp->lock, flags);
32441 memcpy(&statbuf, &lp->pktStats, ioc->len);
32442 spin_unlock_irqrestore(&lp->lock, flags);
32443 - if (copy_to_user(ioc->data, &statbuf, ioc->len))
32444 + if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
32445 return -EFAULT;
32446 break;
32447 }
32448 diff -urNp linux-3.0.8/drivers/net/tulip/eeprom.c linux-3.0.8/drivers/net/tulip/eeprom.c
32449 --- linux-3.0.8/drivers/net/tulip/eeprom.c 2011-07-21 22:17:23.000000000 -0400
32450 +++ linux-3.0.8/drivers/net/tulip/eeprom.c 2011-10-11 10:44:33.000000000 -0400
32451 @@ -81,7 +81,7 @@ static struct eeprom_fixup eeprom_fixups
32452 {NULL}};
32453
32454
32455 -static const char *block_name[] __devinitdata = {
32456 +static const char *block_name[] __devinitconst = {
32457 "21140 non-MII",
32458 "21140 MII PHY",
32459 "21142 Serial PHY",
32460 diff -urNp linux-3.0.8/drivers/net/tulip/winbond-840.c linux-3.0.8/drivers/net/tulip/winbond-840.c
32461 --- linux-3.0.8/drivers/net/tulip/winbond-840.c 2011-07-21 22:17:23.000000000 -0400
32462 +++ linux-3.0.8/drivers/net/tulip/winbond-840.c 2011-10-11 10:44:33.000000000 -0400
32463 @@ -236,7 +236,7 @@ struct pci_id_info {
32464 int drv_flags; /* Driver use, intended as capability flags. */
32465 };
32466
32467 -static const struct pci_id_info pci_id_tbl[] __devinitdata = {
32468 +static const struct pci_id_info pci_id_tbl[] __devinitconst = {
32469 { /* Sometime a Level-One switch card. */
32470 "Winbond W89c840", CanHaveMII | HasBrokenTx | FDXOnNoMII},
32471 { "Winbond W89c840", CanHaveMII | HasBrokenTx},
32472 diff -urNp linux-3.0.8/drivers/net/usb/hso.c linux-3.0.8/drivers/net/usb/hso.c
32473 --- linux-3.0.8/drivers/net/usb/hso.c 2011-07-21 22:17:23.000000000 -0400
32474 +++ linux-3.0.8/drivers/net/usb/hso.c 2011-08-23 21:47:55.000000000 -0400
32475 @@ -71,7 +71,7 @@
32476 #include <asm/byteorder.h>
32477 #include <linux/serial_core.h>
32478 #include <linux/serial.h>
32479 -
32480 +#include <asm/local.h>
32481
32482 #define MOD_AUTHOR "Option Wireless"
32483 #define MOD_DESCRIPTION "USB High Speed Option driver"
32484 @@ -257,7 +257,7 @@ struct hso_serial {
32485
32486 /* from usb_serial_port */
32487 struct tty_struct *tty;
32488 - int open_count;
32489 + local_t open_count;
32490 spinlock_t serial_lock;
32491
32492 int (*write_data) (struct hso_serial *serial);
32493 @@ -1190,7 +1190,7 @@ static void put_rxbuf_data_and_resubmit_
32494 struct urb *urb;
32495
32496 urb = serial->rx_urb[0];
32497 - if (serial->open_count > 0) {
32498 + if (local_read(&serial->open_count) > 0) {
32499 count = put_rxbuf_data(urb, serial);
32500 if (count == -1)
32501 return;
32502 @@ -1226,7 +1226,7 @@ static void hso_std_serial_read_bulk_cal
32503 DUMP1(urb->transfer_buffer, urb->actual_length);
32504
32505 /* Anyone listening? */
32506 - if (serial->open_count == 0)
32507 + if (local_read(&serial->open_count) == 0)
32508 return;
32509
32510 if (status == 0) {
32511 @@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_st
32512 spin_unlock_irq(&serial->serial_lock);
32513
32514 /* check for port already opened, if not set the termios */
32515 - serial->open_count++;
32516 - if (serial->open_count == 1) {
32517 + if (local_inc_return(&serial->open_count) == 1) {
32518 serial->rx_state = RX_IDLE;
32519 /* Force default termio settings */
32520 _hso_serial_set_termios(tty, NULL);
32521 @@ -1324,7 +1323,7 @@ static int hso_serial_open(struct tty_st
32522 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
32523 if (result) {
32524 hso_stop_serial_device(serial->parent);
32525 - serial->open_count--;
32526 + local_dec(&serial->open_count);
32527 kref_put(&serial->parent->ref, hso_serial_ref_free);
32528 }
32529 } else {
32530 @@ -1361,10 +1360,10 @@ static void hso_serial_close(struct tty_
32531
32532 /* reset the rts and dtr */
32533 /* do the actual close */
32534 - serial->open_count--;
32535 + local_dec(&serial->open_count);
32536
32537 - if (serial->open_count <= 0) {
32538 - serial->open_count = 0;
32539 + if (local_read(&serial->open_count) <= 0) {
32540 + local_set(&serial->open_count, 0);
32541 spin_lock_irq(&serial->serial_lock);
32542 if (serial->tty == tty) {
32543 serial->tty->driver_data = NULL;
32544 @@ -1446,7 +1445,7 @@ static void hso_serial_set_termios(struc
32545
32546 /* the actual setup */
32547 spin_lock_irqsave(&serial->serial_lock, flags);
32548 - if (serial->open_count)
32549 + if (local_read(&serial->open_count))
32550 _hso_serial_set_termios(tty, old);
32551 else
32552 tty->termios = old;
32553 @@ -1905,7 +1904,7 @@ static void intr_callback(struct urb *ur
32554 D1("Pending read interrupt on port %d\n", i);
32555 spin_lock(&serial->serial_lock);
32556 if (serial->rx_state == RX_IDLE &&
32557 - serial->open_count > 0) {
32558 + local_read(&serial->open_count) > 0) {
32559 /* Setup and send a ctrl req read on
32560 * port i */
32561 if (!serial->rx_urb_filled[0]) {
32562 @@ -3098,7 +3097,7 @@ static int hso_resume(struct usb_interfa
32563 /* Start all serial ports */
32564 for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
32565 if (serial_table[i] && (serial_table[i]->interface == iface)) {
32566 - if (dev2ser(serial_table[i])->open_count) {
32567 + if (local_read(&dev2ser(serial_table[i])->open_count)) {
32568 result =
32569 hso_start_serial_device(serial_table[i], GFP_NOIO);
32570 hso_kick_transmit(dev2ser(serial_table[i]));
32571 diff -urNp linux-3.0.8/drivers/net/vmxnet3/vmxnet3_ethtool.c linux-3.0.8/drivers/net/vmxnet3/vmxnet3_ethtool.c
32572 --- linux-3.0.8/drivers/net/vmxnet3/vmxnet3_ethtool.c 2011-07-21 22:17:23.000000000 -0400
32573 +++ linux-3.0.8/drivers/net/vmxnet3/vmxnet3_ethtool.c 2011-08-23 21:47:55.000000000 -0400
32574 @@ -594,8 +594,7 @@ vmxnet3_set_rss_indir(struct net_device
32575 * Return with error code if any of the queue indices
32576 * is out of range
32577 */
32578 - if (p->ring_index[i] < 0 ||
32579 - p->ring_index[i] >= adapter->num_rx_queues)
32580 + if (p->ring_index[i] >= adapter->num_rx_queues)
32581 return -EINVAL;
32582 }
32583
32584 diff -urNp linux-3.0.8/drivers/net/vxge/vxge-config.h linux-3.0.8/drivers/net/vxge/vxge-config.h
32585 --- linux-3.0.8/drivers/net/vxge/vxge-config.h 2011-07-21 22:17:23.000000000 -0400
32586 +++ linux-3.0.8/drivers/net/vxge/vxge-config.h 2011-08-23 21:47:55.000000000 -0400
32587 @@ -512,7 +512,7 @@ struct vxge_hw_uld_cbs {
32588 void (*link_down)(struct __vxge_hw_device *devh);
32589 void (*crit_err)(struct __vxge_hw_device *devh,
32590 enum vxge_hw_event type, u64 ext_data);
32591 -};
32592 +} __no_const;
32593
32594 /*
32595 * struct __vxge_hw_blockpool_entry - Block private data structure
32596 diff -urNp linux-3.0.8/drivers/net/vxge/vxge-main.c linux-3.0.8/drivers/net/vxge/vxge-main.c
32597 --- linux-3.0.8/drivers/net/vxge/vxge-main.c 2011-07-21 22:17:23.000000000 -0400
32598 +++ linux-3.0.8/drivers/net/vxge/vxge-main.c 2011-08-23 21:48:14.000000000 -0400
32599 @@ -98,6 +98,8 @@ static inline void VXGE_COMPLETE_VPATH_T
32600 struct sk_buff *completed[NR_SKB_COMPLETED];
32601 int more;
32602
32603 + pax_track_stack();
32604 +
32605 do {
32606 more = 0;
32607 skb_ptr = completed;
32608 @@ -1920,6 +1922,8 @@ static enum vxge_hw_status vxge_rth_conf
32609 u8 mtable[256] = {0}; /* CPU to vpath mapping */
32610 int index;
32611
32612 + pax_track_stack();
32613 +
32614 /*
32615 * Filling
32616 * - itable with bucket numbers
32617 diff -urNp linux-3.0.8/drivers/net/vxge/vxge-traffic.h linux-3.0.8/drivers/net/vxge/vxge-traffic.h
32618 --- linux-3.0.8/drivers/net/vxge/vxge-traffic.h 2011-07-21 22:17:23.000000000 -0400
32619 +++ linux-3.0.8/drivers/net/vxge/vxge-traffic.h 2011-08-23 21:47:55.000000000 -0400
32620 @@ -2088,7 +2088,7 @@ struct vxge_hw_mempool_cbs {
32621 struct vxge_hw_mempool_dma *dma_object,
32622 u32 index,
32623 u32 is_last);
32624 -};
32625 +} __no_const;
32626
32627 #define VXGE_HW_VIRTUAL_PATH_HANDLE(vpath) \
32628 ((struct __vxge_hw_vpath_handle *)(vpath)->vpath_handles.next)
32629 diff -urNp linux-3.0.8/drivers/net/wan/cycx_x25.c linux-3.0.8/drivers/net/wan/cycx_x25.c
32630 --- linux-3.0.8/drivers/net/wan/cycx_x25.c 2011-07-21 22:17:23.000000000 -0400
32631 +++ linux-3.0.8/drivers/net/wan/cycx_x25.c 2011-08-23 21:48:14.000000000 -0400
32632 @@ -1018,6 +1018,8 @@ static void hex_dump(char *msg, unsigned
32633 unsigned char hex[1024],
32634 * phex = hex;
32635
32636 + pax_track_stack();
32637 +
32638 if (len >= (sizeof(hex) / 2))
32639 len = (sizeof(hex) / 2) - 1;
32640
32641 diff -urNp linux-3.0.8/drivers/net/wan/hdlc_x25.c linux-3.0.8/drivers/net/wan/hdlc_x25.c
32642 --- linux-3.0.8/drivers/net/wan/hdlc_x25.c 2011-07-21 22:17:23.000000000 -0400
32643 +++ linux-3.0.8/drivers/net/wan/hdlc_x25.c 2011-08-23 21:47:55.000000000 -0400
32644 @@ -136,16 +136,16 @@ static netdev_tx_t x25_xmit(struct sk_bu
32645
32646 static int x25_open(struct net_device *dev)
32647 {
32648 - struct lapb_register_struct cb;
32649 + static struct lapb_register_struct cb = {
32650 + .connect_confirmation = x25_connected,
32651 + .connect_indication = x25_connected,
32652 + .disconnect_confirmation = x25_disconnected,
32653 + .disconnect_indication = x25_disconnected,
32654 + .data_indication = x25_data_indication,
32655 + .data_transmit = x25_data_transmit
32656 + };
32657 int result;
32658
32659 - cb.connect_confirmation = x25_connected;
32660 - cb.connect_indication = x25_connected;
32661 - cb.disconnect_confirmation = x25_disconnected;
32662 - cb.disconnect_indication = x25_disconnected;
32663 - cb.data_indication = x25_data_indication;
32664 - cb.data_transmit = x25_data_transmit;
32665 -
32666 result = lapb_register(dev, &cb);
32667 if (result != LAPB_OK)
32668 return result;
32669 diff -urNp linux-3.0.8/drivers/net/wimax/i2400m/usb-fw.c linux-3.0.8/drivers/net/wimax/i2400m/usb-fw.c
32670 --- linux-3.0.8/drivers/net/wimax/i2400m/usb-fw.c 2011-07-21 22:17:23.000000000 -0400
32671 +++ linux-3.0.8/drivers/net/wimax/i2400m/usb-fw.c 2011-08-23 21:48:14.000000000 -0400
32672 @@ -287,6 +287,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(stru
32673 int do_autopm = 1;
32674 DECLARE_COMPLETION_ONSTACK(notif_completion);
32675
32676 + pax_track_stack();
32677 +
32678 d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
32679 i2400m, ack, ack_size);
32680 BUG_ON(_ack == i2400m->bm_ack_buf);
32681 diff -urNp linux-3.0.8/drivers/net/wireless/airo.c linux-3.0.8/drivers/net/wireless/airo.c
32682 --- linux-3.0.8/drivers/net/wireless/airo.c 2011-10-24 08:05:21.000000000 -0400
32683 +++ linux-3.0.8/drivers/net/wireless/airo.c 2011-08-23 21:48:14.000000000 -0400
32684 @@ -3003,6 +3003,8 @@ static void airo_process_scan_results (s
32685 BSSListElement * loop_net;
32686 BSSListElement * tmp_net;
32687
32688 + pax_track_stack();
32689 +
32690 /* Blow away current list of scan results */
32691 list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
32692 list_move_tail (&loop_net->list, &ai->network_free_list);
32693 @@ -3794,6 +3796,8 @@ static u16 setup_card(struct airo_info *
32694 WepKeyRid wkr;
32695 int rc;
32696
32697 + pax_track_stack();
32698 +
32699 memset( &mySsid, 0, sizeof( mySsid ) );
32700 kfree (ai->flash);
32701 ai->flash = NULL;
32702 @@ -4753,6 +4757,8 @@ static int proc_stats_rid_open( struct i
32703 __le32 *vals = stats.vals;
32704 int len;
32705
32706 + pax_track_stack();
32707 +
32708 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
32709 return -ENOMEM;
32710 data = file->private_data;
32711 @@ -5476,6 +5482,8 @@ static int proc_BSSList_open( struct ino
32712 /* If doLoseSync is not 1, we won't do a Lose Sync */
32713 int doLoseSync = -1;
32714
32715 + pax_track_stack();
32716 +
32717 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
32718 return -ENOMEM;
32719 data = file->private_data;
32720 @@ -7181,6 +7189,8 @@ static int airo_get_aplist(struct net_de
32721 int i;
32722 int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
32723
32724 + pax_track_stack();
32725 +
32726 qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
32727 if (!qual)
32728 return -ENOMEM;
32729 @@ -7741,6 +7751,8 @@ static void airo_read_wireless_stats(str
32730 CapabilityRid cap_rid;
32731 __le32 *vals = stats_rid.vals;
32732
32733 + pax_track_stack();
32734 +
32735 /* Get stats out of the card */
32736 clear_bit(JOB_WSTATS, &local->jobs);
32737 if (local->power.event) {
32738 diff -urNp linux-3.0.8/drivers/net/wireless/ath/ath5k/debug.c linux-3.0.8/drivers/net/wireless/ath/ath5k/debug.c
32739 --- linux-3.0.8/drivers/net/wireless/ath/ath5k/debug.c 2011-07-21 22:17:23.000000000 -0400
32740 +++ linux-3.0.8/drivers/net/wireless/ath/ath5k/debug.c 2011-08-23 21:48:14.000000000 -0400
32741 @@ -204,6 +204,8 @@ static ssize_t read_file_beacon(struct f
32742 unsigned int v;
32743 u64 tsf;
32744
32745 + pax_track_stack();
32746 +
32747 v = ath5k_hw_reg_read(sc->ah, AR5K_BEACON);
32748 len += snprintf(buf+len, sizeof(buf)-len,
32749 "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
32750 @@ -323,6 +325,8 @@ static ssize_t read_file_debug(struct fi
32751 unsigned int len = 0;
32752 unsigned int i;
32753
32754 + pax_track_stack();
32755 +
32756 len += snprintf(buf+len, sizeof(buf)-len,
32757 "DEBUG LEVEL: 0x%08x\n\n", sc->debug.level);
32758
32759 @@ -384,6 +388,8 @@ static ssize_t read_file_antenna(struct
32760 unsigned int i;
32761 unsigned int v;
32762
32763 + pax_track_stack();
32764 +
32765 len += snprintf(buf+len, sizeof(buf)-len, "antenna mode\t%d\n",
32766 sc->ah->ah_ant_mode);
32767 len += snprintf(buf+len, sizeof(buf)-len, "default antenna\t%d\n",
32768 @@ -494,6 +500,8 @@ static ssize_t read_file_misc(struct fil
32769 unsigned int len = 0;
32770 u32 filt = ath5k_hw_get_rx_filter(sc->ah);
32771
32772 + pax_track_stack();
32773 +
32774 len += snprintf(buf+len, sizeof(buf)-len, "bssid-mask: %pM\n",
32775 sc->bssidmask);
32776 len += snprintf(buf+len, sizeof(buf)-len, "filter-flags: 0x%x ",
32777 @@ -550,6 +558,8 @@ static ssize_t read_file_frameerrors(str
32778 unsigned int len = 0;
32779 int i;
32780
32781 + pax_track_stack();
32782 +
32783 len += snprintf(buf+len, sizeof(buf)-len,
32784 "RX\n---------------------\n");
32785 len += snprintf(buf+len, sizeof(buf)-len, "CRC\t%u\t(%u%%)\n",
32786 @@ -667,6 +677,8 @@ static ssize_t read_file_ani(struct file
32787 char buf[700];
32788 unsigned int len = 0;
32789
32790 + pax_track_stack();
32791 +
32792 len += snprintf(buf+len, sizeof(buf)-len,
32793 "HW has PHY error counters:\t%s\n",
32794 sc->ah->ah_capabilities.cap_has_phyerr_counters ?
32795 @@ -827,6 +839,8 @@ static ssize_t read_file_queue(struct fi
32796 struct ath5k_buf *bf, *bf0;
32797 int i, n;
32798
32799 + pax_track_stack();
32800 +
32801 len += snprintf(buf+len, sizeof(buf)-len,
32802 "available txbuffers: %d\n", sc->txbuf_len);
32803
32804 diff -urNp linux-3.0.8/drivers/net/wireless/ath/ath9k/ar9003_calib.c linux-3.0.8/drivers/net/wireless/ath/ath9k/ar9003_calib.c
32805 --- linux-3.0.8/drivers/net/wireless/ath/ath9k/ar9003_calib.c 2011-07-21 22:17:23.000000000 -0400
32806 +++ linux-3.0.8/drivers/net/wireless/ath/ath9k/ar9003_calib.c 2011-08-23 21:48:14.000000000 -0400
32807 @@ -757,6 +757,8 @@ static void ar9003_hw_tx_iq_cal_post_pro
32808 int i, im, j;
32809 int nmeasurement;
32810
32811 + pax_track_stack();
32812 +
32813 for (i = 0; i < AR9300_MAX_CHAINS; i++) {
32814 if (ah->txchainmask & (1 << i))
32815 num_chains++;
32816 diff -urNp linux-3.0.8/drivers/net/wireless/ath/ath9k/ar9003_paprd.c linux-3.0.8/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
32817 --- linux-3.0.8/drivers/net/wireless/ath/ath9k/ar9003_paprd.c 2011-07-21 22:17:23.000000000 -0400
32818 +++ linux-3.0.8/drivers/net/wireless/ath/ath9k/ar9003_paprd.c 2011-08-23 21:48:14.000000000 -0400
32819 @@ -356,6 +356,8 @@ static bool create_pa_curve(u32 *data_L,
32820 int theta_low_bin = 0;
32821 int i;
32822
32823 + pax_track_stack();
32824 +
32825 /* disregard any bin that contains <= 16 samples */
32826 thresh_accum_cnt = 16;
32827 scale_factor = 5;
32828 diff -urNp linux-3.0.8/drivers/net/wireless/ath/ath9k/debug.c linux-3.0.8/drivers/net/wireless/ath/ath9k/debug.c
32829 --- linux-3.0.8/drivers/net/wireless/ath/ath9k/debug.c 2011-07-21 22:17:23.000000000 -0400
32830 +++ linux-3.0.8/drivers/net/wireless/ath/ath9k/debug.c 2011-08-23 21:48:14.000000000 -0400
32831 @@ -337,6 +337,8 @@ static ssize_t read_file_interrupt(struc
32832 char buf[512];
32833 unsigned int len = 0;
32834
32835 + pax_track_stack();
32836 +
32837 if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
32838 len += snprintf(buf + len, sizeof(buf) - len,
32839 "%8s: %10u\n", "RXLP", sc->debug.stats.istats.rxlp);
32840 @@ -427,6 +429,8 @@ static ssize_t read_file_wiphy(struct fi
32841 u8 addr[ETH_ALEN];
32842 u32 tmp;
32843
32844 + pax_track_stack();
32845 +
32846 len += snprintf(buf + len, sizeof(buf) - len,
32847 "%s (chan=%d center-freq: %d MHz channel-type: %d (%s))\n",
32848 wiphy_name(sc->hw->wiphy),
32849 diff -urNp linux-3.0.8/drivers/net/wireless/ath/ath9k/htc_drv_debug.c linux-3.0.8/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
32850 --- linux-3.0.8/drivers/net/wireless/ath/ath9k/htc_drv_debug.c 2011-07-21 22:17:23.000000000 -0400
32851 +++ linux-3.0.8/drivers/net/wireless/ath/ath9k/htc_drv_debug.c 2011-08-23 21:48:14.000000000 -0400
32852 @@ -31,6 +31,8 @@ static ssize_t read_file_tgt_int_stats(s
32853 unsigned int len = 0;
32854 int ret = 0;
32855
32856 + pax_track_stack();
32857 +
32858 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
32859
32860 ath9k_htc_ps_wakeup(priv);
32861 @@ -89,6 +91,8 @@ static ssize_t read_file_tgt_tx_stats(st
32862 unsigned int len = 0;
32863 int ret = 0;
32864
32865 + pax_track_stack();
32866 +
32867 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
32868
32869 ath9k_htc_ps_wakeup(priv);
32870 @@ -159,6 +163,8 @@ static ssize_t read_file_tgt_rx_stats(st
32871 unsigned int len = 0;
32872 int ret = 0;
32873
32874 + pax_track_stack();
32875 +
32876 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
32877
32878 ath9k_htc_ps_wakeup(priv);
32879 @@ -203,6 +209,8 @@ static ssize_t read_file_xmit(struct fil
32880 char buf[512];
32881 unsigned int len = 0;
32882
32883 + pax_track_stack();
32884 +
32885 len += snprintf(buf + len, sizeof(buf) - len,
32886 "%20s : %10u\n", "Buffers queued",
32887 priv->debug.tx_stats.buf_queued);
32888 @@ -376,6 +384,8 @@ static ssize_t read_file_slot(struct fil
32889 char buf[512];
32890 unsigned int len = 0;
32891
32892 + pax_track_stack();
32893 +
32894 spin_lock_bh(&priv->tx.tx_lock);
32895
32896 len += snprintf(buf + len, sizeof(buf) - len, "TX slot bitmap : ");
32897 @@ -411,6 +421,8 @@ static ssize_t read_file_queue(struct fi
32898 char buf[512];
32899 unsigned int len = 0;
32900
32901 + pax_track_stack();
32902 +
32903 len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
32904 "Mgmt endpoint", skb_queue_len(&priv->tx.mgmt_ep_queue));
32905
32906 diff -urNp linux-3.0.8/drivers/net/wireless/ath/ath9k/hw.h linux-3.0.8/drivers/net/wireless/ath/ath9k/hw.h
32907 --- linux-3.0.8/drivers/net/wireless/ath/ath9k/hw.h 2011-10-24 08:05:21.000000000 -0400
32908 +++ linux-3.0.8/drivers/net/wireless/ath/ath9k/hw.h 2011-08-23 21:47:55.000000000 -0400
32909 @@ -585,7 +585,7 @@ struct ath_hw_private_ops {
32910
32911 /* ANI */
32912 void (*ani_cache_ini_regs)(struct ath_hw *ah);
32913 -};
32914 +} __no_const;
32915
32916 /**
32917 * struct ath_hw_ops - callbacks used by hardware code and driver code
32918 @@ -637,7 +637,7 @@ struct ath_hw_ops {
32919 void (*antdiv_comb_conf_set)(struct ath_hw *ah,
32920 struct ath_hw_antcomb_conf *antconf);
32921
32922 -};
32923 +} __no_const;
32924
32925 struct ath_nf_limits {
32926 s16 max;
32927 @@ -650,7 +650,7 @@ struct ath_nf_limits {
32928 #define AH_UNPLUGGED 0x2 /* The card has been physically removed. */
32929
32930 struct ath_hw {
32931 - struct ath_ops reg_ops;
32932 + ath_ops_no_const reg_ops;
32933
32934 struct ieee80211_hw *hw;
32935 struct ath_common common;
32936 diff -urNp linux-3.0.8/drivers/net/wireless/ath/ath.h linux-3.0.8/drivers/net/wireless/ath/ath.h
32937 --- linux-3.0.8/drivers/net/wireless/ath/ath.h 2011-07-21 22:17:23.000000000 -0400
32938 +++ linux-3.0.8/drivers/net/wireless/ath/ath.h 2011-08-23 21:47:55.000000000 -0400
32939 @@ -121,6 +121,7 @@ struct ath_ops {
32940 void (*write_flush) (void *);
32941 u32 (*rmw)(void *, u32 reg_offset, u32 set, u32 clr);
32942 };
32943 +typedef struct ath_ops __no_const ath_ops_no_const;
32944
32945 struct ath_common;
32946 struct ath_bus_ops;
32947 diff -urNp linux-3.0.8/drivers/net/wireless/ipw2x00/ipw2100.c linux-3.0.8/drivers/net/wireless/ipw2x00/ipw2100.c
32948 --- linux-3.0.8/drivers/net/wireless/ipw2x00/ipw2100.c 2011-07-21 22:17:23.000000000 -0400
32949 +++ linux-3.0.8/drivers/net/wireless/ipw2x00/ipw2100.c 2011-08-23 21:48:14.000000000 -0400
32950 @@ -2100,6 +2100,8 @@ static int ipw2100_set_essid(struct ipw2
32951 int err;
32952 DECLARE_SSID_BUF(ssid);
32953
32954 + pax_track_stack();
32955 +
32956 IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
32957
32958 if (ssid_len)
32959 @@ -5449,6 +5451,8 @@ static int ipw2100_set_key(struct ipw210
32960 struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
32961 int err;
32962
32963 + pax_track_stack();
32964 +
32965 IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
32966 idx, keylen, len);
32967
32968 diff -urNp linux-3.0.8/drivers/net/wireless/ipw2x00/libipw_rx.c linux-3.0.8/drivers/net/wireless/ipw2x00/libipw_rx.c
32969 --- linux-3.0.8/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-07-21 22:17:23.000000000 -0400
32970 +++ linux-3.0.8/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-08-23 21:48:14.000000000 -0400
32971 @@ -1565,6 +1565,8 @@ static void libipw_process_probe_respons
32972 unsigned long flags;
32973 DECLARE_SSID_BUF(ssid);
32974
32975 + pax_track_stack();
32976 +
32977 LIBIPW_DEBUG_SCAN("'%s' (%pM"
32978 "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
32979 print_ssid(ssid, info_element->data, info_element->len),
32980 diff -urNp linux-3.0.8/drivers/net/wireless/iwlegacy/iwl3945-base.c linux-3.0.8/drivers/net/wireless/iwlegacy/iwl3945-base.c
32981 --- linux-3.0.8/drivers/net/wireless/iwlegacy/iwl3945-base.c 2011-10-24 08:05:30.000000000 -0400
32982 +++ linux-3.0.8/drivers/net/wireless/iwlegacy/iwl3945-base.c 2011-10-16 21:55:27.000000000 -0400
32983 @@ -3962,7 +3962,9 @@ static int iwl3945_pci_probe(struct pci_
32984 */
32985 if (iwl3945_mod_params.disable_hw_scan) {
32986 IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
32987 - iwl3945_hw_ops.hw_scan = NULL;
32988 + pax_open_kernel();
32989 + *(void **)&iwl3945_hw_ops.hw_scan = NULL;
32990 + pax_close_kernel();
32991 }
32992
32993 IWL_DEBUG_INFO(priv, "*** LOAD DRIVER ***\n");
32994 diff -urNp linux-3.0.8/drivers/net/wireless/iwlwifi/iwl-agn-rs.c linux-3.0.8/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
32995 --- linux-3.0.8/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-07-21 22:17:23.000000000 -0400
32996 +++ linux-3.0.8/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-08-23 21:48:14.000000000 -0400
32997 @@ -910,6 +910,8 @@ static void rs_tx_status(void *priv_r, s
32998 struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
32999 struct iwl_rxon_context *ctx = sta_priv->common.ctx;
33000
33001 + pax_track_stack();
33002 +
33003 IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
33004
33005 /* Treat uninitialized rate scaling data same as non-existing. */
33006 @@ -2918,6 +2920,8 @@ static void rs_fill_link_cmd(struct iwl_
33007 container_of(lq_sta, struct iwl_station_priv, lq_sta);
33008 struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
33009
33010 + pax_track_stack();
33011 +
33012 /* Override starting rate (index 0) if needed for debug purposes */
33013 rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
33014
33015 diff -urNp linux-3.0.8/drivers/net/wireless/iwlwifi/iwl-debugfs.c linux-3.0.8/drivers/net/wireless/iwlwifi/iwl-debugfs.c
33016 --- linux-3.0.8/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-07-21 22:17:23.000000000 -0400
33017 +++ linux-3.0.8/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-08-23 21:48:14.000000000 -0400
33018 @@ -548,6 +548,8 @@ static ssize_t iwl_dbgfs_status_read(str
33019 int pos = 0;
33020 const size_t bufsz = sizeof(buf);
33021
33022 + pax_track_stack();
33023 +
33024 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
33025 test_bit(STATUS_HCMD_ACTIVE, &priv->status));
33026 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_INT_ENABLED:\t %d\n",
33027 @@ -680,6 +682,8 @@ static ssize_t iwl_dbgfs_qos_read(struct
33028 char buf[256 * NUM_IWL_RXON_CTX];
33029 const size_t bufsz = sizeof(buf);
33030
33031 + pax_track_stack();
33032 +
33033 for_each_context(priv, ctx) {
33034 pos += scnprintf(buf + pos, bufsz - pos, "context %d:\n",
33035 ctx->ctxid);
33036 diff -urNp linux-3.0.8/drivers/net/wireless/iwlwifi/iwl-debug.h linux-3.0.8/drivers/net/wireless/iwlwifi/iwl-debug.h
33037 --- linux-3.0.8/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-07-21 22:17:23.000000000 -0400
33038 +++ linux-3.0.8/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-08-23 21:47:55.000000000 -0400
33039 @@ -68,8 +68,8 @@ do {
33040 } while (0)
33041
33042 #else
33043 -#define IWL_DEBUG(__priv, level, fmt, args...)
33044 -#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
33045 +#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
33046 +#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
33047 static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
33048 const void *p, u32 len)
33049 {}
33050 diff -urNp linux-3.0.8/drivers/net/wireless/iwmc3200wifi/debugfs.c linux-3.0.8/drivers/net/wireless/iwmc3200wifi/debugfs.c
33051 --- linux-3.0.8/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-07-21 22:17:23.000000000 -0400
33052 +++ linux-3.0.8/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-08-23 21:48:14.000000000 -0400
33053 @@ -327,6 +327,8 @@ static ssize_t iwm_debugfs_fw_err_read(s
33054 int buf_len = 512;
33055 size_t len = 0;
33056
33057 + pax_track_stack();
33058 +
33059 if (*ppos != 0)
33060 return 0;
33061 if (count < sizeof(buf))
33062 diff -urNp linux-3.0.8/drivers/net/wireless/mac80211_hwsim.c linux-3.0.8/drivers/net/wireless/mac80211_hwsim.c
33063 --- linux-3.0.8/drivers/net/wireless/mac80211_hwsim.c 2011-07-21 22:17:23.000000000 -0400
33064 +++ linux-3.0.8/drivers/net/wireless/mac80211_hwsim.c 2011-08-23 21:47:55.000000000 -0400
33065 @@ -1260,9 +1260,11 @@ static int __init init_mac80211_hwsim(vo
33066 return -EINVAL;
33067
33068 if (fake_hw_scan) {
33069 - mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan;
33070 - mac80211_hwsim_ops.sw_scan_start = NULL;
33071 - mac80211_hwsim_ops.sw_scan_complete = NULL;
33072 + pax_open_kernel();
33073 + *(void **)&mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan;
33074 + *(void **)&mac80211_hwsim_ops.sw_scan_start = NULL;
33075 + *(void **)&mac80211_hwsim_ops.sw_scan_complete = NULL;
33076 + pax_close_kernel();
33077 }
33078
33079 spin_lock_init(&hwsim_radio_lock);
33080 diff -urNp linux-3.0.8/drivers/net/wireless/rndis_wlan.c linux-3.0.8/drivers/net/wireless/rndis_wlan.c
33081 --- linux-3.0.8/drivers/net/wireless/rndis_wlan.c 2011-07-21 22:17:23.000000000 -0400
33082 +++ linux-3.0.8/drivers/net/wireless/rndis_wlan.c 2011-08-23 21:47:55.000000000 -0400
33083 @@ -1277,7 +1277,7 @@ static int set_rts_threshold(struct usbn
33084
33085 netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold);
33086
33087 - if (rts_threshold < 0 || rts_threshold > 2347)
33088 + if (rts_threshold > 2347)
33089 rts_threshold = 2347;
33090
33091 tmp = cpu_to_le32(rts_threshold);
33092 diff -urNp linux-3.0.8/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c linux-3.0.8/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
33093 --- linux-3.0.8/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c 2011-07-21 22:17:23.000000000 -0400
33094 +++ linux-3.0.8/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c 2011-08-23 21:48:14.000000000 -0400
33095 @@ -837,6 +837,8 @@ bool _rtl92c_phy_sw_chnl_step_by_step(st
33096 u8 rfpath;
33097 u8 num_total_rfpath = rtlphy->num_total_rfpath;
33098
33099 + pax_track_stack();
33100 +
33101 precommoncmdcnt = 0;
33102 _rtl92c_phy_set_sw_chnl_cmdarray(precommoncmd, precommoncmdcnt++,
33103 MAX_PRECMD_CNT,
33104 diff -urNp linux-3.0.8/drivers/net/wireless/wl1251/wl1251.h linux-3.0.8/drivers/net/wireless/wl1251/wl1251.h
33105 --- linux-3.0.8/drivers/net/wireless/wl1251/wl1251.h 2011-07-21 22:17:23.000000000 -0400
33106 +++ linux-3.0.8/drivers/net/wireless/wl1251/wl1251.h 2011-08-23 21:47:55.000000000 -0400
33107 @@ -266,7 +266,7 @@ struct wl1251_if_operations {
33108 void (*reset)(struct wl1251 *wl);
33109 void (*enable_irq)(struct wl1251 *wl);
33110 void (*disable_irq)(struct wl1251 *wl);
33111 -};
33112 +} __no_const;
33113
33114 struct wl1251 {
33115 struct ieee80211_hw *hw;
33116 diff -urNp linux-3.0.8/drivers/net/wireless/wl12xx/spi.c linux-3.0.8/drivers/net/wireless/wl12xx/spi.c
33117 --- linux-3.0.8/drivers/net/wireless/wl12xx/spi.c 2011-07-21 22:17:23.000000000 -0400
33118 +++ linux-3.0.8/drivers/net/wireless/wl12xx/spi.c 2011-08-23 21:48:14.000000000 -0400
33119 @@ -280,6 +280,8 @@ static void wl1271_spi_raw_write(struct
33120 u32 chunk_len;
33121 int i;
33122
33123 + pax_track_stack();
33124 +
33125 WARN_ON(len > WL1271_AGGR_BUFFER_SIZE);
33126
33127 spi_message_init(&m);
33128 diff -urNp linux-3.0.8/drivers/oprofile/buffer_sync.c linux-3.0.8/drivers/oprofile/buffer_sync.c
33129 --- linux-3.0.8/drivers/oprofile/buffer_sync.c 2011-07-21 22:17:23.000000000 -0400
33130 +++ linux-3.0.8/drivers/oprofile/buffer_sync.c 2011-08-23 21:47:55.000000000 -0400
33131 @@ -343,7 +343,7 @@ static void add_data(struct op_entry *en
33132 if (cookie == NO_COOKIE)
33133 offset = pc;
33134 if (cookie == INVALID_COOKIE) {
33135 - atomic_inc(&oprofile_stats.sample_lost_no_mapping);
33136 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
33137 offset = pc;
33138 }
33139 if (cookie != last_cookie) {
33140 @@ -387,14 +387,14 @@ add_sample(struct mm_struct *mm, struct
33141 /* add userspace sample */
33142
33143 if (!mm) {
33144 - atomic_inc(&oprofile_stats.sample_lost_no_mm);
33145 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
33146 return 0;
33147 }
33148
33149 cookie = lookup_dcookie(mm, s->eip, &offset);
33150
33151 if (cookie == INVALID_COOKIE) {
33152 - atomic_inc(&oprofile_stats.sample_lost_no_mapping);
33153 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
33154 return 0;
33155 }
33156
33157 @@ -563,7 +563,7 @@ void sync_buffer(int cpu)
33158 /* ignore backtraces if failed to add a sample */
33159 if (state == sb_bt_start) {
33160 state = sb_bt_ignore;
33161 - atomic_inc(&oprofile_stats.bt_lost_no_mapping);
33162 + atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
33163 }
33164 }
33165 release_mm(mm);
33166 diff -urNp linux-3.0.8/drivers/oprofile/event_buffer.c linux-3.0.8/drivers/oprofile/event_buffer.c
33167 --- linux-3.0.8/drivers/oprofile/event_buffer.c 2011-07-21 22:17:23.000000000 -0400
33168 +++ linux-3.0.8/drivers/oprofile/event_buffer.c 2011-08-23 21:47:55.000000000 -0400
33169 @@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
33170 }
33171
33172 if (buffer_pos == buffer_size) {
33173 - atomic_inc(&oprofile_stats.event_lost_overflow);
33174 + atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
33175 return;
33176 }
33177
33178 diff -urNp linux-3.0.8/drivers/oprofile/oprof.c linux-3.0.8/drivers/oprofile/oprof.c
33179 --- linux-3.0.8/drivers/oprofile/oprof.c 2011-07-21 22:17:23.000000000 -0400
33180 +++ linux-3.0.8/drivers/oprofile/oprof.c 2011-08-23 21:47:55.000000000 -0400
33181 @@ -110,7 +110,7 @@ static void switch_worker(struct work_st
33182 if (oprofile_ops.switch_events())
33183 return;
33184
33185 - atomic_inc(&oprofile_stats.multiplex_counter);
33186 + atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
33187 start_switch_worker();
33188 }
33189
33190 diff -urNp linux-3.0.8/drivers/oprofile/oprofilefs.c linux-3.0.8/drivers/oprofile/oprofilefs.c
33191 --- linux-3.0.8/drivers/oprofile/oprofilefs.c 2011-07-21 22:17:23.000000000 -0400
33192 +++ linux-3.0.8/drivers/oprofile/oprofilefs.c 2011-08-23 21:47:55.000000000 -0400
33193 @@ -186,7 +186,7 @@ static const struct file_operations atom
33194
33195
33196 int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
33197 - char const *name, atomic_t *val)
33198 + char const *name, atomic_unchecked_t *val)
33199 {
33200 return __oprofilefs_create_file(sb, root, name,
33201 &atomic_ro_fops, 0444, val);
33202 diff -urNp linux-3.0.8/drivers/oprofile/oprofile_stats.c linux-3.0.8/drivers/oprofile/oprofile_stats.c
33203 --- linux-3.0.8/drivers/oprofile/oprofile_stats.c 2011-07-21 22:17:23.000000000 -0400
33204 +++ linux-3.0.8/drivers/oprofile/oprofile_stats.c 2011-08-23 21:47:55.000000000 -0400
33205 @@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
33206 cpu_buf->sample_invalid_eip = 0;
33207 }
33208
33209 - atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
33210 - atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
33211 - atomic_set(&oprofile_stats.event_lost_overflow, 0);
33212 - atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
33213 - atomic_set(&oprofile_stats.multiplex_counter, 0);
33214 + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
33215 + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
33216 + atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
33217 + atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
33218 + atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
33219 }
33220
33221
33222 diff -urNp linux-3.0.8/drivers/oprofile/oprofile_stats.h linux-3.0.8/drivers/oprofile/oprofile_stats.h
33223 --- linux-3.0.8/drivers/oprofile/oprofile_stats.h 2011-07-21 22:17:23.000000000 -0400
33224 +++ linux-3.0.8/drivers/oprofile/oprofile_stats.h 2011-08-23 21:47:55.000000000 -0400
33225 @@ -13,11 +13,11 @@
33226 #include <asm/atomic.h>
33227
33228 struct oprofile_stat_struct {
33229 - atomic_t sample_lost_no_mm;
33230 - atomic_t sample_lost_no_mapping;
33231 - atomic_t bt_lost_no_mapping;
33232 - atomic_t event_lost_overflow;
33233 - atomic_t multiplex_counter;
33234 + atomic_unchecked_t sample_lost_no_mm;
33235 + atomic_unchecked_t sample_lost_no_mapping;
33236 + atomic_unchecked_t bt_lost_no_mapping;
33237 + atomic_unchecked_t event_lost_overflow;
33238 + atomic_unchecked_t multiplex_counter;
33239 };
33240
33241 extern struct oprofile_stat_struct oprofile_stats;
33242 diff -urNp linux-3.0.8/drivers/parport/procfs.c linux-3.0.8/drivers/parport/procfs.c
33243 --- linux-3.0.8/drivers/parport/procfs.c 2011-07-21 22:17:23.000000000 -0400
33244 +++ linux-3.0.8/drivers/parport/procfs.c 2011-08-23 21:47:55.000000000 -0400
33245 @@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
33246
33247 *ppos += len;
33248
33249 - return copy_to_user(result, buffer, len) ? -EFAULT : 0;
33250 + return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
33251 }
33252
33253 #ifdef CONFIG_PARPORT_1284
33254 @@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table
33255
33256 *ppos += len;
33257
33258 - return copy_to_user (result, buffer, len) ? -EFAULT : 0;
33259 + return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
33260 }
33261 #endif /* IEEE1284.3 support. */
33262
33263 diff -urNp linux-3.0.8/drivers/pci/hotplug/cpci_hotplug.h linux-3.0.8/drivers/pci/hotplug/cpci_hotplug.h
33264 --- linux-3.0.8/drivers/pci/hotplug/cpci_hotplug.h 2011-07-21 22:17:23.000000000 -0400
33265 +++ linux-3.0.8/drivers/pci/hotplug/cpci_hotplug.h 2011-08-23 21:47:55.000000000 -0400
33266 @@ -59,7 +59,7 @@ struct cpci_hp_controller_ops {
33267 int (*hardware_test) (struct slot* slot, u32 value);
33268 u8 (*get_power) (struct slot* slot);
33269 int (*set_power) (struct slot* slot, int value);
33270 -};
33271 +} __no_const;
33272
33273 struct cpci_hp_controller {
33274 unsigned int irq;
33275 diff -urNp linux-3.0.8/drivers/pci/hotplug/cpqphp_nvram.c linux-3.0.8/drivers/pci/hotplug/cpqphp_nvram.c
33276 --- linux-3.0.8/drivers/pci/hotplug/cpqphp_nvram.c 2011-07-21 22:17:23.000000000 -0400
33277 +++ linux-3.0.8/drivers/pci/hotplug/cpqphp_nvram.c 2011-08-23 21:47:55.000000000 -0400
33278 @@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
33279
33280 void compaq_nvram_init (void __iomem *rom_start)
33281 {
33282 +
33283 +#ifndef CONFIG_PAX_KERNEXEC
33284 if (rom_start) {
33285 compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
33286 }
33287 +#endif
33288 +
33289 dbg("int15 entry = %p\n", compaq_int15_entry_point);
33290
33291 /* initialize our int15 lock */
33292 diff -urNp linux-3.0.8/drivers/pci/pcie/aspm.c linux-3.0.8/drivers/pci/pcie/aspm.c
33293 --- linux-3.0.8/drivers/pci/pcie/aspm.c 2011-07-21 22:17:23.000000000 -0400
33294 +++ linux-3.0.8/drivers/pci/pcie/aspm.c 2011-08-23 21:47:55.000000000 -0400
33295 @@ -27,9 +27,9 @@
33296 #define MODULE_PARAM_PREFIX "pcie_aspm."
33297
33298 /* Note: those are not register definitions */
33299 -#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
33300 -#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
33301 -#define ASPM_STATE_L1 (4) /* L1 state */
33302 +#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
33303 +#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
33304 +#define ASPM_STATE_L1 (4U) /* L1 state */
33305 #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
33306 #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
33307
33308 diff -urNp linux-3.0.8/drivers/pci/probe.c linux-3.0.8/drivers/pci/probe.c
33309 --- linux-3.0.8/drivers/pci/probe.c 2011-07-21 22:17:23.000000000 -0400
33310 +++ linux-3.0.8/drivers/pci/probe.c 2011-08-23 21:47:55.000000000 -0400
33311 @@ -129,7 +129,7 @@ int __pci_read_base(struct pci_dev *dev,
33312 u32 l, sz, mask;
33313 u16 orig_cmd;
33314
33315 - mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
33316 + mask = type ? (u32)PCI_ROM_ADDRESS_MASK : ~0;
33317
33318 if (!dev->mmio_always_on) {
33319 pci_read_config_word(dev, PCI_COMMAND, &orig_cmd);
33320 diff -urNp linux-3.0.8/drivers/pci/proc.c linux-3.0.8/drivers/pci/proc.c
33321 --- linux-3.0.8/drivers/pci/proc.c 2011-07-21 22:17:23.000000000 -0400
33322 +++ linux-3.0.8/drivers/pci/proc.c 2011-08-23 21:48:14.000000000 -0400
33323 @@ -476,7 +476,16 @@ static const struct file_operations proc
33324 static int __init pci_proc_init(void)
33325 {
33326 struct pci_dev *dev = NULL;
33327 +
33328 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
33329 +#ifdef CONFIG_GRKERNSEC_PROC_USER
33330 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
33331 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
33332 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
33333 +#endif
33334 +#else
33335 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
33336 +#endif
33337 proc_create("devices", 0, proc_bus_pci_dir,
33338 &proc_bus_pci_dev_operations);
33339 proc_initialized = 1;
33340 diff -urNp linux-3.0.8/drivers/pci/xen-pcifront.c linux-3.0.8/drivers/pci/xen-pcifront.c
33341 --- linux-3.0.8/drivers/pci/xen-pcifront.c 2011-07-21 22:17:23.000000000 -0400
33342 +++ linux-3.0.8/drivers/pci/xen-pcifront.c 2011-08-23 21:48:14.000000000 -0400
33343 @@ -187,6 +187,8 @@ static int pcifront_bus_read(struct pci_
33344 struct pcifront_sd *sd = bus->sysdata;
33345 struct pcifront_device *pdev = pcifront_get_pdev(sd);
33346
33347 + pax_track_stack();
33348 +
33349 if (verbose_request)
33350 dev_info(&pdev->xdev->dev,
33351 "read dev=%04x:%02x:%02x.%01x - offset %x size %d\n",
33352 @@ -226,6 +228,8 @@ static int pcifront_bus_write(struct pci
33353 struct pcifront_sd *sd = bus->sysdata;
33354 struct pcifront_device *pdev = pcifront_get_pdev(sd);
33355
33356 + pax_track_stack();
33357 +
33358 if (verbose_request)
33359 dev_info(&pdev->xdev->dev,
33360 "write dev=%04x:%02x:%02x.%01x - "
33361 @@ -258,6 +262,8 @@ static int pci_frontend_enable_msix(stru
33362 struct pcifront_device *pdev = pcifront_get_pdev(sd);
33363 struct msi_desc *entry;
33364
33365 + pax_track_stack();
33366 +
33367 if (nvec > SH_INFO_MAX_VEC) {
33368 dev_err(&dev->dev, "too much vector for pci frontend: %x."
33369 " Increase SH_INFO_MAX_VEC.\n", nvec);
33370 @@ -309,6 +315,8 @@ static void pci_frontend_disable_msix(st
33371 struct pcifront_sd *sd = dev->bus->sysdata;
33372 struct pcifront_device *pdev = pcifront_get_pdev(sd);
33373
33374 + pax_track_stack();
33375 +
33376 err = do_pci_op(pdev, &op);
33377
33378 /* What should do for error ? */
33379 @@ -328,6 +336,8 @@ static int pci_frontend_enable_msi(struc
33380 struct pcifront_sd *sd = dev->bus->sysdata;
33381 struct pcifront_device *pdev = pcifront_get_pdev(sd);
33382
33383 + pax_track_stack();
33384 +
33385 err = do_pci_op(pdev, &op);
33386 if (likely(!err)) {
33387 vector[0] = op.value;
33388 diff -urNp linux-3.0.8/drivers/platform/x86/thinkpad_acpi.c linux-3.0.8/drivers/platform/x86/thinkpad_acpi.c
33389 --- linux-3.0.8/drivers/platform/x86/thinkpad_acpi.c 2011-07-21 22:17:23.000000000 -0400
33390 +++ linux-3.0.8/drivers/platform/x86/thinkpad_acpi.c 2011-08-23 21:47:55.000000000 -0400
33391 @@ -2094,7 +2094,7 @@ static int hotkey_mask_get(void)
33392 return 0;
33393 }
33394
33395 -void static hotkey_mask_warn_incomplete_mask(void)
33396 +static void hotkey_mask_warn_incomplete_mask(void)
33397 {
33398 /* log only what the user can fix... */
33399 const u32 wantedmask = hotkey_driver_mask &
33400 diff -urNp linux-3.0.8/drivers/pnp/pnpbios/bioscalls.c linux-3.0.8/drivers/pnp/pnpbios/bioscalls.c
33401 --- linux-3.0.8/drivers/pnp/pnpbios/bioscalls.c 2011-07-21 22:17:23.000000000 -0400
33402 +++ linux-3.0.8/drivers/pnp/pnpbios/bioscalls.c 2011-08-23 21:47:55.000000000 -0400
33403 @@ -59,7 +59,7 @@ do { \
33404 set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
33405 } while(0)
33406
33407 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
33408 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
33409 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
33410
33411 /*
33412 @@ -96,7 +96,10 @@ static inline u16 call_pnp_bios(u16 func
33413
33414 cpu = get_cpu();
33415 save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
33416 +
33417 + pax_open_kernel();
33418 get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
33419 + pax_close_kernel();
33420
33421 /* On some boxes IRQ's during PnP BIOS calls are deadly. */
33422 spin_lock_irqsave(&pnp_bios_lock, flags);
33423 @@ -134,7 +137,10 @@ static inline u16 call_pnp_bios(u16 func
33424 :"memory");
33425 spin_unlock_irqrestore(&pnp_bios_lock, flags);
33426
33427 + pax_open_kernel();
33428 get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
33429 + pax_close_kernel();
33430 +
33431 put_cpu();
33432
33433 /* If we get here and this is set then the PnP BIOS faulted on us. */
33434 @@ -468,7 +474,7 @@ int pnp_bios_read_escd(char *data, u32 n
33435 return status;
33436 }
33437
33438 -void pnpbios_calls_init(union pnp_bios_install_struct *header)
33439 +void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
33440 {
33441 int i;
33442
33443 @@ -476,6 +482,8 @@ void pnpbios_calls_init(union pnp_bios_i
33444 pnp_bios_callpoint.offset = header->fields.pm16offset;
33445 pnp_bios_callpoint.segment = PNP_CS16;
33446
33447 + pax_open_kernel();
33448 +
33449 for_each_possible_cpu(i) {
33450 struct desc_struct *gdt = get_cpu_gdt_table(i);
33451 if (!gdt)
33452 @@ -487,4 +495,6 @@ void pnpbios_calls_init(union pnp_bios_i
33453 set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
33454 (unsigned long)__va(header->fields.pm16dseg));
33455 }
33456 +
33457 + pax_close_kernel();
33458 }
33459 diff -urNp linux-3.0.8/drivers/pnp/resource.c linux-3.0.8/drivers/pnp/resource.c
33460 --- linux-3.0.8/drivers/pnp/resource.c 2011-07-21 22:17:23.000000000 -0400
33461 +++ linux-3.0.8/drivers/pnp/resource.c 2011-08-23 21:47:55.000000000 -0400
33462 @@ -360,7 +360,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
33463 return 1;
33464
33465 /* check if the resource is valid */
33466 - if (*irq < 0 || *irq > 15)
33467 + if (*irq > 15)
33468 return 0;
33469
33470 /* check if the resource is reserved */
33471 @@ -424,7 +424,7 @@ int pnp_check_dma(struct pnp_dev *dev, s
33472 return 1;
33473
33474 /* check if the resource is valid */
33475 - if (*dma < 0 || *dma == 4 || *dma > 7)
33476 + if (*dma == 4 || *dma > 7)
33477 return 0;
33478
33479 /* check if the resource is reserved */
33480 diff -urNp linux-3.0.8/drivers/power/bq27x00_battery.c linux-3.0.8/drivers/power/bq27x00_battery.c
33481 --- linux-3.0.8/drivers/power/bq27x00_battery.c 2011-07-21 22:17:23.000000000 -0400
33482 +++ linux-3.0.8/drivers/power/bq27x00_battery.c 2011-08-23 21:47:55.000000000 -0400
33483 @@ -67,7 +67,7 @@
33484 struct bq27x00_device_info;
33485 struct bq27x00_access_methods {
33486 int (*read)(struct bq27x00_device_info *di, u8 reg, bool single);
33487 -};
33488 +} __no_const;
33489
33490 enum bq27x00_chip { BQ27000, BQ27500 };
33491
33492 diff -urNp linux-3.0.8/drivers/regulator/max8660.c linux-3.0.8/drivers/regulator/max8660.c
33493 --- linux-3.0.8/drivers/regulator/max8660.c 2011-07-21 22:17:23.000000000 -0400
33494 +++ linux-3.0.8/drivers/regulator/max8660.c 2011-08-23 21:47:55.000000000 -0400
33495 @@ -383,8 +383,10 @@ static int __devinit max8660_probe(struc
33496 max8660->shadow_regs[MAX8660_OVER1] = 5;
33497 } else {
33498 /* Otherwise devices can be toggled via software */
33499 - max8660_dcdc_ops.enable = max8660_dcdc_enable;
33500 - max8660_dcdc_ops.disable = max8660_dcdc_disable;
33501 + pax_open_kernel();
33502 + *(void **)&max8660_dcdc_ops.enable = max8660_dcdc_enable;
33503 + *(void **)&max8660_dcdc_ops.disable = max8660_dcdc_disable;
33504 + pax_close_kernel();
33505 }
33506
33507 /*
33508 diff -urNp linux-3.0.8/drivers/regulator/mc13892-regulator.c linux-3.0.8/drivers/regulator/mc13892-regulator.c
33509 --- linux-3.0.8/drivers/regulator/mc13892-regulator.c 2011-07-21 22:17:23.000000000 -0400
33510 +++ linux-3.0.8/drivers/regulator/mc13892-regulator.c 2011-08-23 21:47:55.000000000 -0400
33511 @@ -564,10 +564,12 @@ static int __devinit mc13892_regulator_p
33512 }
33513 mc13xxx_unlock(mc13892);
33514
33515 - mc13892_regulators[MC13892_VCAM].desc.ops->set_mode
33516 + pax_open_kernel();
33517 + *(void **)&mc13892_regulators[MC13892_VCAM].desc.ops->set_mode
33518 = mc13892_vcam_set_mode;
33519 - mc13892_regulators[MC13892_VCAM].desc.ops->get_mode
33520 + *(void **)&mc13892_regulators[MC13892_VCAM].desc.ops->get_mode
33521 = mc13892_vcam_get_mode;
33522 + pax_close_kernel();
33523 for (i = 0; i < pdata->num_regulators; i++) {
33524 init_data = &pdata->regulators[i];
33525 priv->regulators[i] = regulator_register(
33526 diff -urNp linux-3.0.8/drivers/rtc/rtc-dev.c linux-3.0.8/drivers/rtc/rtc-dev.c
33527 --- linux-3.0.8/drivers/rtc/rtc-dev.c 2011-07-21 22:17:23.000000000 -0400
33528 +++ linux-3.0.8/drivers/rtc/rtc-dev.c 2011-08-23 21:48:14.000000000 -0400
33529 @@ -14,6 +14,7 @@
33530 #include <linux/module.h>
33531 #include <linux/rtc.h>
33532 #include <linux/sched.h>
33533 +#include <linux/grsecurity.h>
33534 #include "rtc-core.h"
33535
33536 static dev_t rtc_devt;
33537 @@ -345,6 +346,8 @@ static long rtc_dev_ioctl(struct file *f
33538 if (copy_from_user(&tm, uarg, sizeof(tm)))
33539 return -EFAULT;
33540
33541 + gr_log_timechange();
33542 +
33543 return rtc_set_time(rtc, &tm);
33544
33545 case RTC_PIE_ON:
33546 diff -urNp linux-3.0.8/drivers/scsi/aacraid/aacraid.h linux-3.0.8/drivers/scsi/aacraid/aacraid.h
33547 --- linux-3.0.8/drivers/scsi/aacraid/aacraid.h 2011-07-21 22:17:23.000000000 -0400
33548 +++ linux-3.0.8/drivers/scsi/aacraid/aacraid.h 2011-08-23 21:47:55.000000000 -0400
33549 @@ -492,7 +492,7 @@ struct adapter_ops
33550 int (*adapter_scsi)(struct fib * fib, struct scsi_cmnd * cmd);
33551 /* Administrative operations */
33552 int (*adapter_comm)(struct aac_dev * dev, int comm);
33553 -};
33554 +} __no_const;
33555
33556 /*
33557 * Define which interrupt handler needs to be installed
33558 diff -urNp linux-3.0.8/drivers/scsi/aacraid/commctrl.c linux-3.0.8/drivers/scsi/aacraid/commctrl.c
33559 --- linux-3.0.8/drivers/scsi/aacraid/commctrl.c 2011-07-21 22:17:23.000000000 -0400
33560 +++ linux-3.0.8/drivers/scsi/aacraid/commctrl.c 2011-08-23 21:48:14.000000000 -0400
33561 @@ -482,6 +482,7 @@ static int aac_send_raw_srb(struct aac_d
33562 u32 actual_fibsize64, actual_fibsize = 0;
33563 int i;
33564
33565 + pax_track_stack();
33566
33567 if (dev->in_reset) {
33568 dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
33569 diff -urNp linux-3.0.8/drivers/scsi/aacraid/linit.c linux-3.0.8/drivers/scsi/aacraid/linit.c
33570 --- linux-3.0.8/drivers/scsi/aacraid/linit.c 2011-07-21 22:17:23.000000000 -0400
33571 +++ linux-3.0.8/drivers/scsi/aacraid/linit.c 2011-10-11 10:44:33.000000000 -0400
33572 @@ -92,7 +92,7 @@ static DECLARE_PCI_DEVICE_TABLE(aac_pci_
33573 #elif defined(__devinitconst)
33574 static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
33575 #else
33576 -static const struct pci_device_id aac_pci_tbl[] __devinitdata = {
33577 +static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
33578 #endif
33579 { 0x1028, 0x0001, 0x1028, 0x0001, 0, 0, 0 }, /* PERC 2/Si (Iguana/PERC2Si) */
33580 { 0x1028, 0x0002, 0x1028, 0x0002, 0, 0, 1 }, /* PERC 3/Di (Opal/PERC3Di) */
33581 diff -urNp linux-3.0.8/drivers/scsi/aic94xx/aic94xx_init.c linux-3.0.8/drivers/scsi/aic94xx/aic94xx_init.c
33582 --- linux-3.0.8/drivers/scsi/aic94xx/aic94xx_init.c 2011-07-21 22:17:23.000000000 -0400
33583 +++ linux-3.0.8/drivers/scsi/aic94xx/aic94xx_init.c 2011-10-11 10:44:33.000000000 -0400
33584 @@ -1012,7 +1012,7 @@ static struct sas_domain_function_templa
33585 .lldd_control_phy = asd_control_phy,
33586 };
33587
33588 -static const struct pci_device_id aic94xx_pci_table[] __devinitdata = {
33589 +static const struct pci_device_id aic94xx_pci_table[] __devinitconst = {
33590 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x410),0, 0, 1},
33591 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x412),0, 0, 1},
33592 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x416),0, 0, 1},
33593 diff -urNp linux-3.0.8/drivers/scsi/bfa/bfad.c linux-3.0.8/drivers/scsi/bfa/bfad.c
33594 --- linux-3.0.8/drivers/scsi/bfa/bfad.c 2011-07-21 22:17:23.000000000 -0400
33595 +++ linux-3.0.8/drivers/scsi/bfa/bfad.c 2011-08-23 21:48:14.000000000 -0400
33596 @@ -1032,6 +1032,8 @@ bfad_start_ops(struct bfad_s *bfad) {
33597 struct bfad_vport_s *vport, *vport_new;
33598 struct bfa_fcs_driver_info_s driver_info;
33599
33600 + pax_track_stack();
33601 +
33602 /* Fill the driver_info info to fcs*/
33603 memset(&driver_info, 0, sizeof(driver_info));
33604 strncpy(driver_info.version, BFAD_DRIVER_VERSION,
33605 diff -urNp linux-3.0.8/drivers/scsi/bfa/bfa_fcs_lport.c linux-3.0.8/drivers/scsi/bfa/bfa_fcs_lport.c
33606 --- linux-3.0.8/drivers/scsi/bfa/bfa_fcs_lport.c 2011-07-21 22:17:23.000000000 -0400
33607 +++ linux-3.0.8/drivers/scsi/bfa/bfa_fcs_lport.c 2011-08-23 21:48:14.000000000 -0400
33608 @@ -1559,6 +1559,8 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
33609 u16 len, count;
33610 u16 templen;
33611
33612 + pax_track_stack();
33613 +
33614 /*
33615 * get hba attributes
33616 */
33617 @@ -1836,6 +1838,8 @@ bfa_fcs_lport_fdmi_build_portattr_block(
33618 u8 count = 0;
33619 u16 templen;
33620
33621 + pax_track_stack();
33622 +
33623 /*
33624 * get port attributes
33625 */
33626 diff -urNp linux-3.0.8/drivers/scsi/bfa/bfa_fcs_rport.c linux-3.0.8/drivers/scsi/bfa/bfa_fcs_rport.c
33627 --- linux-3.0.8/drivers/scsi/bfa/bfa_fcs_rport.c 2011-07-21 22:17:23.000000000 -0400
33628 +++ linux-3.0.8/drivers/scsi/bfa/bfa_fcs_rport.c 2011-08-23 21:48:14.000000000 -0400
33629 @@ -1844,6 +1844,8 @@ bfa_fcs_rport_process_rpsc(struct bfa_fc
33630 struct fc_rpsc_speed_info_s speeds;
33631 struct bfa_port_attr_s pport_attr;
33632
33633 + pax_track_stack();
33634 +
33635 bfa_trc(port->fcs, rx_fchs->s_id);
33636 bfa_trc(port->fcs, rx_fchs->d_id);
33637
33638 diff -urNp linux-3.0.8/drivers/scsi/bfa/bfa.h linux-3.0.8/drivers/scsi/bfa/bfa.h
33639 --- linux-3.0.8/drivers/scsi/bfa/bfa.h 2011-07-21 22:17:23.000000000 -0400
33640 +++ linux-3.0.8/drivers/scsi/bfa/bfa.h 2011-08-23 21:47:55.000000000 -0400
33641 @@ -238,7 +238,7 @@ struct bfa_hwif_s {
33642 u32 *nvecs, u32 *maxvec);
33643 void (*hw_msix_get_rme_range) (struct bfa_s *bfa, u32 *start,
33644 u32 *end);
33645 -};
33646 +} __no_const;
33647 typedef void (*bfa_cb_iocfc_t) (void *cbarg, enum bfa_status status);
33648
33649 struct bfa_iocfc_s {
33650 diff -urNp linux-3.0.8/drivers/scsi/bfa/bfa_ioc.h linux-3.0.8/drivers/scsi/bfa/bfa_ioc.h
33651 --- linux-3.0.8/drivers/scsi/bfa/bfa_ioc.h 2011-07-21 22:17:23.000000000 -0400
33652 +++ linux-3.0.8/drivers/scsi/bfa/bfa_ioc.h 2011-08-23 21:47:55.000000000 -0400
33653 @@ -196,7 +196,7 @@ struct bfa_ioc_cbfn_s {
33654 bfa_ioc_disable_cbfn_t disable_cbfn;
33655 bfa_ioc_hbfail_cbfn_t hbfail_cbfn;
33656 bfa_ioc_reset_cbfn_t reset_cbfn;
33657 -};
33658 +} __no_const;
33659
33660 /*
33661 * Heartbeat failure notification queue element.
33662 @@ -268,7 +268,7 @@ struct bfa_ioc_hwif_s {
33663 void (*ioc_sync_leave) (struct bfa_ioc_s *ioc);
33664 void (*ioc_sync_ack) (struct bfa_ioc_s *ioc);
33665 bfa_boolean_t (*ioc_sync_complete) (struct bfa_ioc_s *ioc);
33666 -};
33667 +} __no_const;
33668
33669 #define bfa_ioc_pcifn(__ioc) ((__ioc)->pcidev.pci_func)
33670 #define bfa_ioc_devid(__ioc) ((__ioc)->pcidev.device_id)
33671 diff -urNp linux-3.0.8/drivers/scsi/BusLogic.c linux-3.0.8/drivers/scsi/BusLogic.c
33672 --- linux-3.0.8/drivers/scsi/BusLogic.c 2011-07-21 22:17:23.000000000 -0400
33673 +++ linux-3.0.8/drivers/scsi/BusLogic.c 2011-08-23 21:48:14.000000000 -0400
33674 @@ -962,6 +962,8 @@ static int __init BusLogic_InitializeFla
33675 static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
33676 *PrototypeHostAdapter)
33677 {
33678 + pax_track_stack();
33679 +
33680 /*
33681 If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
33682 Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
33683 diff -urNp linux-3.0.8/drivers/scsi/dpt_i2o.c linux-3.0.8/drivers/scsi/dpt_i2o.c
33684 --- linux-3.0.8/drivers/scsi/dpt_i2o.c 2011-07-21 22:17:23.000000000 -0400
33685 +++ linux-3.0.8/drivers/scsi/dpt_i2o.c 2011-08-23 21:48:14.000000000 -0400
33686 @@ -1811,6 +1811,8 @@ static int adpt_i2o_passthru(adpt_hba* p
33687 dma_addr_t addr;
33688 ulong flags = 0;
33689
33690 + pax_track_stack();
33691 +
33692 memset(&msg, 0, MAX_MESSAGE_SIZE*4);
33693 // get user msg size in u32s
33694 if(get_user(size, &user_msg[0])){
33695 @@ -2317,6 +2319,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pH
33696 s32 rcode;
33697 dma_addr_t addr;
33698
33699 + pax_track_stack();
33700 +
33701 memset(msg, 0 , sizeof(msg));
33702 len = scsi_bufflen(cmd);
33703 direction = 0x00000000;
33704 diff -urNp linux-3.0.8/drivers/scsi/eata.c linux-3.0.8/drivers/scsi/eata.c
33705 --- linux-3.0.8/drivers/scsi/eata.c 2011-07-21 22:17:23.000000000 -0400
33706 +++ linux-3.0.8/drivers/scsi/eata.c 2011-08-23 21:48:14.000000000 -0400
33707 @@ -1087,6 +1087,8 @@ static int port_detect(unsigned long por
33708 struct hostdata *ha;
33709 char name[16];
33710
33711 + pax_track_stack();
33712 +
33713 sprintf(name, "%s%d", driver_name, j);
33714
33715 if (!request_region(port_base, REGION_SIZE, driver_name)) {
33716 diff -urNp linux-3.0.8/drivers/scsi/fcoe/fcoe_ctlr.c linux-3.0.8/drivers/scsi/fcoe/fcoe_ctlr.c
33717 --- linux-3.0.8/drivers/scsi/fcoe/fcoe_ctlr.c 2011-07-21 22:17:23.000000000 -0400
33718 +++ linux-3.0.8/drivers/scsi/fcoe/fcoe_ctlr.c 2011-08-23 21:48:14.000000000 -0400
33719 @@ -2503,6 +2503,8 @@ static int fcoe_ctlr_vn_recv(struct fcoe
33720 } buf;
33721 int rc;
33722
33723 + pax_track_stack();
33724 +
33725 fiph = (struct fip_header *)skb->data;
33726 sub = fiph->fip_subcode;
33727
33728 diff -urNp linux-3.0.8/drivers/scsi/gdth.c linux-3.0.8/drivers/scsi/gdth.c
33729 --- linux-3.0.8/drivers/scsi/gdth.c 2011-07-21 22:17:23.000000000 -0400
33730 +++ linux-3.0.8/drivers/scsi/gdth.c 2011-08-23 21:48:14.000000000 -0400
33731 @@ -4107,6 +4107,8 @@ static int ioc_lockdrv(void __user *arg)
33732 unsigned long flags;
33733 gdth_ha_str *ha;
33734
33735 + pax_track_stack();
33736 +
33737 if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
33738 return -EFAULT;
33739 ha = gdth_find_ha(ldrv.ionode);
33740 @@ -4139,6 +4141,8 @@ static int ioc_resetdrv(void __user *arg
33741 gdth_ha_str *ha;
33742 int rval;
33743
33744 + pax_track_stack();
33745 +
33746 if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
33747 res.number >= MAX_HDRIVES)
33748 return -EFAULT;
33749 @@ -4174,6 +4178,8 @@ static int ioc_general(void __user *arg,
33750 gdth_ha_str *ha;
33751 int rval;
33752
33753 + pax_track_stack();
33754 +
33755 if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
33756 return -EFAULT;
33757 ha = gdth_find_ha(gen.ionode);
33758 @@ -4642,6 +4648,9 @@ static void gdth_flush(gdth_ha_str *ha)
33759 int i;
33760 gdth_cmd_str gdtcmd;
33761 char cmnd[MAX_COMMAND_SIZE];
33762 +
33763 + pax_track_stack();
33764 +
33765 memset(cmnd, 0xff, MAX_COMMAND_SIZE);
33766
33767 TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
33768 diff -urNp linux-3.0.8/drivers/scsi/gdth_proc.c linux-3.0.8/drivers/scsi/gdth_proc.c
33769 --- linux-3.0.8/drivers/scsi/gdth_proc.c 2011-07-21 22:17:23.000000000 -0400
33770 +++ linux-3.0.8/drivers/scsi/gdth_proc.c 2011-08-23 21:48:14.000000000 -0400
33771 @@ -47,6 +47,9 @@ static int gdth_set_asc_info(struct Scsi
33772 u64 paddr;
33773
33774 char cmnd[MAX_COMMAND_SIZE];
33775 +
33776 + pax_track_stack();
33777 +
33778 memset(cmnd, 0xff, 12);
33779 memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
33780
33781 @@ -175,6 +178,8 @@ static int gdth_get_info(char *buffer,ch
33782 gdth_hget_str *phg;
33783 char cmnd[MAX_COMMAND_SIZE];
33784
33785 + pax_track_stack();
33786 +
33787 gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
33788 estr = kmalloc(sizeof(*estr), GFP_KERNEL);
33789 if (!gdtcmd || !estr)
33790 diff -urNp linux-3.0.8/drivers/scsi/hosts.c linux-3.0.8/drivers/scsi/hosts.c
33791 --- linux-3.0.8/drivers/scsi/hosts.c 2011-07-21 22:17:23.000000000 -0400
33792 +++ linux-3.0.8/drivers/scsi/hosts.c 2011-08-23 21:47:55.000000000 -0400
33793 @@ -42,7 +42,7 @@
33794 #include "scsi_logging.h"
33795
33796
33797 -static atomic_t scsi_host_next_hn; /* host_no for next new host */
33798 +static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
33799
33800
33801 static void scsi_host_cls_release(struct device *dev)
33802 @@ -354,7 +354,7 @@ struct Scsi_Host *scsi_host_alloc(struct
33803 * subtract one because we increment first then return, but we need to
33804 * know what the next host number was before increment
33805 */
33806 - shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
33807 + shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
33808 shost->dma_channel = 0xff;
33809
33810 /* These three are default values which can be overridden */
33811 diff -urNp linux-3.0.8/drivers/scsi/hpsa.c linux-3.0.8/drivers/scsi/hpsa.c
33812 --- linux-3.0.8/drivers/scsi/hpsa.c 2011-10-24 08:05:30.000000000 -0400
33813 +++ linux-3.0.8/drivers/scsi/hpsa.c 2011-10-16 21:55:27.000000000 -0400
33814 @@ -498,7 +498,7 @@ static inline u32 next_command(struct ct
33815 u32 a;
33816
33817 if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
33818 - return h->access.command_completed(h);
33819 + return h->access->command_completed(h);
33820
33821 if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
33822 a = *(h->reply_pool_head); /* Next cmd in ring buffer */
33823 @@ -2955,7 +2955,7 @@ static void start_io(struct ctlr_info *h
33824 while (!list_empty(&h->reqQ)) {
33825 c = list_entry(h->reqQ.next, struct CommandList, list);
33826 /* can't do anything if fifo is full */
33827 - if ((h->access.fifo_full(h))) {
33828 + if ((h->access->fifo_full(h))) {
33829 dev_warn(&h->pdev->dev, "fifo full\n");
33830 break;
33831 }
33832 @@ -2965,7 +2965,7 @@ static void start_io(struct ctlr_info *h
33833 h->Qdepth--;
33834
33835 /* Tell the controller execute command */
33836 - h->access.submit_command(h, c);
33837 + h->access->submit_command(h, c);
33838
33839 /* Put job onto the completed Q */
33840 addQ(&h->cmpQ, c);
33841 @@ -2974,17 +2974,17 @@ static void start_io(struct ctlr_info *h
33842
33843 static inline unsigned long get_next_completion(struct ctlr_info *h)
33844 {
33845 - return h->access.command_completed(h);
33846 + return h->access->command_completed(h);
33847 }
33848
33849 static inline bool interrupt_pending(struct ctlr_info *h)
33850 {
33851 - return h->access.intr_pending(h);
33852 + return h->access->intr_pending(h);
33853 }
33854
33855 static inline long interrupt_not_for_us(struct ctlr_info *h)
33856 {
33857 - return (h->access.intr_pending(h) == 0) ||
33858 + return (h->access->intr_pending(h) == 0) ||
33859 (h->interrupts_enabled == 0);
33860 }
33861
33862 @@ -3874,7 +3874,7 @@ static int __devinit hpsa_pci_init(struc
33863 if (prod_index < 0)
33864 return -ENODEV;
33865 h->product_name = products[prod_index].product_name;
33866 - h->access = *(products[prod_index].access);
33867 + h->access = products[prod_index].access;
33868
33869 if (hpsa_board_disabled(h->pdev)) {
33870 dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
33871 @@ -4151,7 +4151,7 @@ reinit_after_soft_reset:
33872 }
33873
33874 /* make sure the board interrupts are off */
33875 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
33876 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
33877
33878 if (hpsa_request_irq(h, do_hpsa_intr_msi, do_hpsa_intr_intx))
33879 goto clean2;
33880 @@ -4185,7 +4185,7 @@ reinit_after_soft_reset:
33881 * fake ones to scoop up any residual completions.
33882 */
33883 spin_lock_irqsave(&h->lock, flags);
33884 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
33885 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
33886 spin_unlock_irqrestore(&h->lock, flags);
33887 free_irq(h->intr[h->intr_mode], h);
33888 rc = hpsa_request_irq(h, hpsa_msix_discard_completions,
33889 @@ -4204,9 +4204,9 @@ reinit_after_soft_reset:
33890 dev_info(&h->pdev->dev, "Board READY.\n");
33891 dev_info(&h->pdev->dev,
33892 "Waiting for stale completions to drain.\n");
33893 - h->access.set_intr_mask(h, HPSA_INTR_ON);
33894 + h->access->set_intr_mask(h, HPSA_INTR_ON);
33895 msleep(10000);
33896 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
33897 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
33898
33899 rc = controller_reset_failed(h->cfgtable);
33900 if (rc)
33901 @@ -4227,7 +4227,7 @@ reinit_after_soft_reset:
33902 }
33903
33904 /* Turn the interrupts on so we can service requests */
33905 - h->access.set_intr_mask(h, HPSA_INTR_ON);
33906 + h->access->set_intr_mask(h, HPSA_INTR_ON);
33907
33908 hpsa_hba_inquiry(h);
33909 hpsa_register_scsi(h); /* hook ourselves into SCSI subsystem */
33910 @@ -4280,7 +4280,7 @@ static void hpsa_shutdown(struct pci_dev
33911 * To write all data in the battery backed cache to disks
33912 */
33913 hpsa_flush_cache(h);
33914 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
33915 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
33916 free_irq(h->intr[h->intr_mode], h);
33917 #ifdef CONFIG_PCI_MSI
33918 if (h->msix_vector)
33919 @@ -4443,7 +4443,7 @@ static __devinit void hpsa_enter_perform
33920 return;
33921 }
33922 /* Change the access methods to the performant access methods */
33923 - h->access = SA5_performant_access;
33924 + h->access = &SA5_performant_access;
33925 h->transMethod = CFGTBL_Trans_Performant;
33926 }
33927
33928 diff -urNp linux-3.0.8/drivers/scsi/hpsa.h linux-3.0.8/drivers/scsi/hpsa.h
33929 --- linux-3.0.8/drivers/scsi/hpsa.h 2011-10-24 08:05:21.000000000 -0400
33930 +++ linux-3.0.8/drivers/scsi/hpsa.h 2011-08-23 21:47:55.000000000 -0400
33931 @@ -73,7 +73,7 @@ struct ctlr_info {
33932 unsigned int msix_vector;
33933 unsigned int msi_vector;
33934 int intr_mode; /* either PERF_MODE_INT or SIMPLE_MODE_INT */
33935 - struct access_method access;
33936 + struct access_method *access;
33937
33938 /* queue and queue Info */
33939 struct list_head reqQ;
33940 diff -urNp linux-3.0.8/drivers/scsi/ips.h linux-3.0.8/drivers/scsi/ips.h
33941 --- linux-3.0.8/drivers/scsi/ips.h 2011-07-21 22:17:23.000000000 -0400
33942 +++ linux-3.0.8/drivers/scsi/ips.h 2011-08-23 21:47:55.000000000 -0400
33943 @@ -1027,7 +1027,7 @@ typedef struct {
33944 int (*intr)(struct ips_ha *);
33945 void (*enableint)(struct ips_ha *);
33946 uint32_t (*statupd)(struct ips_ha *);
33947 -} ips_hw_func_t;
33948 +} __no_const ips_hw_func_t;
33949
33950 typedef struct ips_ha {
33951 uint8_t ha_id[IPS_MAX_CHANNELS+1];
33952 diff -urNp linux-3.0.8/drivers/scsi/libfc/fc_exch.c linux-3.0.8/drivers/scsi/libfc/fc_exch.c
33953 --- linux-3.0.8/drivers/scsi/libfc/fc_exch.c 2011-07-21 22:17:23.000000000 -0400
33954 +++ linux-3.0.8/drivers/scsi/libfc/fc_exch.c 2011-08-23 21:47:55.000000000 -0400
33955 @@ -105,12 +105,12 @@ struct fc_exch_mgr {
33956 * all together if not used XXX
33957 */
33958 struct {
33959 - atomic_t no_free_exch;
33960 - atomic_t no_free_exch_xid;
33961 - atomic_t xid_not_found;
33962 - atomic_t xid_busy;
33963 - atomic_t seq_not_found;
33964 - atomic_t non_bls_resp;
33965 + atomic_unchecked_t no_free_exch;
33966 + atomic_unchecked_t no_free_exch_xid;
33967 + atomic_unchecked_t xid_not_found;
33968 + atomic_unchecked_t xid_busy;
33969 + atomic_unchecked_t seq_not_found;
33970 + atomic_unchecked_t non_bls_resp;
33971 } stats;
33972 };
33973
33974 @@ -700,7 +700,7 @@ static struct fc_exch *fc_exch_em_alloc(
33975 /* allocate memory for exchange */
33976 ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
33977 if (!ep) {
33978 - atomic_inc(&mp->stats.no_free_exch);
33979 + atomic_inc_unchecked(&mp->stats.no_free_exch);
33980 goto out;
33981 }
33982 memset(ep, 0, sizeof(*ep));
33983 @@ -761,7 +761,7 @@ out:
33984 return ep;
33985 err:
33986 spin_unlock_bh(&pool->lock);
33987 - atomic_inc(&mp->stats.no_free_exch_xid);
33988 + atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
33989 mempool_free(ep, mp->ep_pool);
33990 return NULL;
33991 }
33992 @@ -906,7 +906,7 @@ static enum fc_pf_rjt_reason fc_seq_look
33993 xid = ntohs(fh->fh_ox_id); /* we originated exch */
33994 ep = fc_exch_find(mp, xid);
33995 if (!ep) {
33996 - atomic_inc(&mp->stats.xid_not_found);
33997 + atomic_inc_unchecked(&mp->stats.xid_not_found);
33998 reject = FC_RJT_OX_ID;
33999 goto out;
34000 }
34001 @@ -936,7 +936,7 @@ static enum fc_pf_rjt_reason fc_seq_look
34002 ep = fc_exch_find(mp, xid);
34003 if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
34004 if (ep) {
34005 - atomic_inc(&mp->stats.xid_busy);
34006 + atomic_inc_unchecked(&mp->stats.xid_busy);
34007 reject = FC_RJT_RX_ID;
34008 goto rel;
34009 }
34010 @@ -947,7 +947,7 @@ static enum fc_pf_rjt_reason fc_seq_look
34011 }
34012 xid = ep->xid; /* get our XID */
34013 } else if (!ep) {
34014 - atomic_inc(&mp->stats.xid_not_found);
34015 + atomic_inc_unchecked(&mp->stats.xid_not_found);
34016 reject = FC_RJT_RX_ID; /* XID not found */
34017 goto out;
34018 }
34019 @@ -964,7 +964,7 @@ static enum fc_pf_rjt_reason fc_seq_look
34020 } else {
34021 sp = &ep->seq;
34022 if (sp->id != fh->fh_seq_id) {
34023 - atomic_inc(&mp->stats.seq_not_found);
34024 + atomic_inc_unchecked(&mp->stats.seq_not_found);
34025 reject = FC_RJT_SEQ_ID; /* sequence/exch should exist */
34026 goto rel;
34027 }
34028 @@ -1392,22 +1392,22 @@ static void fc_exch_recv_seq_resp(struct
34029
34030 ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
34031 if (!ep) {
34032 - atomic_inc(&mp->stats.xid_not_found);
34033 + atomic_inc_unchecked(&mp->stats.xid_not_found);
34034 goto out;
34035 }
34036 if (ep->esb_stat & ESB_ST_COMPLETE) {
34037 - atomic_inc(&mp->stats.xid_not_found);
34038 + atomic_inc_unchecked(&mp->stats.xid_not_found);
34039 goto rel;
34040 }
34041 if (ep->rxid == FC_XID_UNKNOWN)
34042 ep->rxid = ntohs(fh->fh_rx_id);
34043 if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
34044 - atomic_inc(&mp->stats.xid_not_found);
34045 + atomic_inc_unchecked(&mp->stats.xid_not_found);
34046 goto rel;
34047 }
34048 if (ep->did != ntoh24(fh->fh_s_id) &&
34049 ep->did != FC_FID_FLOGI) {
34050 - atomic_inc(&mp->stats.xid_not_found);
34051 + atomic_inc_unchecked(&mp->stats.xid_not_found);
34052 goto rel;
34053 }
34054 sof = fr_sof(fp);
34055 @@ -1416,7 +1416,7 @@ static void fc_exch_recv_seq_resp(struct
34056 sp->ssb_stat |= SSB_ST_RESP;
34057 sp->id = fh->fh_seq_id;
34058 } else if (sp->id != fh->fh_seq_id) {
34059 - atomic_inc(&mp->stats.seq_not_found);
34060 + atomic_inc_unchecked(&mp->stats.seq_not_found);
34061 goto rel;
34062 }
34063
34064 @@ -1480,9 +1480,9 @@ static void fc_exch_recv_resp(struct fc_
34065 sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
34066
34067 if (!sp)
34068 - atomic_inc(&mp->stats.xid_not_found);
34069 + atomic_inc_unchecked(&mp->stats.xid_not_found);
34070 else
34071 - atomic_inc(&mp->stats.non_bls_resp);
34072 + atomic_inc_unchecked(&mp->stats.non_bls_resp);
34073
34074 fc_frame_free(fp);
34075 }
34076 diff -urNp linux-3.0.8/drivers/scsi/libsas/sas_ata.c linux-3.0.8/drivers/scsi/libsas/sas_ata.c
34077 --- linux-3.0.8/drivers/scsi/libsas/sas_ata.c 2011-07-21 22:17:23.000000000 -0400
34078 +++ linux-3.0.8/drivers/scsi/libsas/sas_ata.c 2011-08-23 21:47:55.000000000 -0400
34079 @@ -368,7 +368,7 @@ static struct ata_port_operations sas_sa
34080 .postreset = ata_std_postreset,
34081 .error_handler = ata_std_error_handler,
34082 .post_internal_cmd = sas_ata_post_internal,
34083 - .qc_defer = ata_std_qc_defer,
34084 + .qc_defer = ata_std_qc_defer,
34085 .qc_prep = ata_noop_qc_prep,
34086 .qc_issue = sas_ata_qc_issue,
34087 .qc_fill_rtf = sas_ata_qc_fill_rtf,
34088 diff -urNp linux-3.0.8/drivers/scsi/lpfc/lpfc_debugfs.c linux-3.0.8/drivers/scsi/lpfc/lpfc_debugfs.c
34089 --- linux-3.0.8/drivers/scsi/lpfc/lpfc_debugfs.c 2011-07-21 22:17:23.000000000 -0400
34090 +++ linux-3.0.8/drivers/scsi/lpfc/lpfc_debugfs.c 2011-08-23 21:48:14.000000000 -0400
34091 @@ -104,7 +104,7 @@ MODULE_PARM_DESC(lpfc_debugfs_mask_disc_
34092
34093 #include <linux/debugfs.h>
34094
34095 -static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
34096 +static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
34097 static unsigned long lpfc_debugfs_start_time = 0L;
34098
34099 /* iDiag */
34100 @@ -141,7 +141,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_v
34101 lpfc_debugfs_enable = 0;
34102
34103 len = 0;
34104 - index = (atomic_read(&vport->disc_trc_cnt) + 1) &
34105 + index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
34106 (lpfc_debugfs_max_disc_trc - 1);
34107 for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
34108 dtp = vport->disc_trc + i;
34109 @@ -202,7 +202,7 @@ lpfc_debugfs_slow_ring_trc_data(struct l
34110 lpfc_debugfs_enable = 0;
34111
34112 len = 0;
34113 - index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
34114 + index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
34115 (lpfc_debugfs_max_slow_ring_trc - 1);
34116 for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
34117 dtp = phba->slow_ring_trc + i;
34118 @@ -380,6 +380,8 @@ lpfc_debugfs_dumpHBASlim_data(struct lpf
34119 uint32_t *ptr;
34120 char buffer[1024];
34121
34122 + pax_track_stack();
34123 +
34124 off = 0;
34125 spin_lock_irq(&phba->hbalock);
34126
34127 @@ -617,14 +619,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport
34128 !vport || !vport->disc_trc)
34129 return;
34130
34131 - index = atomic_inc_return(&vport->disc_trc_cnt) &
34132 + index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
34133 (lpfc_debugfs_max_disc_trc - 1);
34134 dtp = vport->disc_trc + index;
34135 dtp->fmt = fmt;
34136 dtp->data1 = data1;
34137 dtp->data2 = data2;
34138 dtp->data3 = data3;
34139 - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
34140 + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
34141 dtp->jif = jiffies;
34142 #endif
34143 return;
34144 @@ -655,14 +657,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_h
34145 !phba || !phba->slow_ring_trc)
34146 return;
34147
34148 - index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
34149 + index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
34150 (lpfc_debugfs_max_slow_ring_trc - 1);
34151 dtp = phba->slow_ring_trc + index;
34152 dtp->fmt = fmt;
34153 dtp->data1 = data1;
34154 dtp->data2 = data2;
34155 dtp->data3 = data3;
34156 - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
34157 + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
34158 dtp->jif = jiffies;
34159 #endif
34160 return;
34161 @@ -2606,7 +2608,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
34162 "slow_ring buffer\n");
34163 goto debug_failed;
34164 }
34165 - atomic_set(&phba->slow_ring_trc_cnt, 0);
34166 + atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
34167 memset(phba->slow_ring_trc, 0,
34168 (sizeof(struct lpfc_debugfs_trc) *
34169 lpfc_debugfs_max_slow_ring_trc));
34170 @@ -2652,7 +2654,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
34171 "buffer\n");
34172 goto debug_failed;
34173 }
34174 - atomic_set(&vport->disc_trc_cnt, 0);
34175 + atomic_set_unchecked(&vport->disc_trc_cnt, 0);
34176
34177 snprintf(name, sizeof(name), "discovery_trace");
34178 vport->debug_disc_trc =
34179 diff -urNp linux-3.0.8/drivers/scsi/lpfc/lpfc.h linux-3.0.8/drivers/scsi/lpfc/lpfc.h
34180 --- linux-3.0.8/drivers/scsi/lpfc/lpfc.h 2011-10-24 08:05:30.000000000 -0400
34181 +++ linux-3.0.8/drivers/scsi/lpfc/lpfc.h 2011-10-16 21:55:27.000000000 -0400
34182 @@ -425,7 +425,7 @@ struct lpfc_vport {
34183 struct dentry *debug_nodelist;
34184 struct dentry *vport_debugfs_root;
34185 struct lpfc_debugfs_trc *disc_trc;
34186 - atomic_t disc_trc_cnt;
34187 + atomic_unchecked_t disc_trc_cnt;
34188 #endif
34189 uint8_t stat_data_enabled;
34190 uint8_t stat_data_blocked;
34191 @@ -832,8 +832,8 @@ struct lpfc_hba {
34192 struct timer_list fabric_block_timer;
34193 unsigned long bit_flags;
34194 #define FABRIC_COMANDS_BLOCKED 0
34195 - atomic_t num_rsrc_err;
34196 - atomic_t num_cmd_success;
34197 + atomic_unchecked_t num_rsrc_err;
34198 + atomic_unchecked_t num_cmd_success;
34199 unsigned long last_rsrc_error_time;
34200 unsigned long last_ramp_down_time;
34201 unsigned long last_ramp_up_time;
34202 @@ -847,7 +847,7 @@ struct lpfc_hba {
34203 struct dentry *debug_dumpDif; /* BlockGuard BPL*/
34204 struct dentry *debug_slow_ring_trc;
34205 struct lpfc_debugfs_trc *slow_ring_trc;
34206 - atomic_t slow_ring_trc_cnt;
34207 + atomic_unchecked_t slow_ring_trc_cnt;
34208 /* iDiag debugfs sub-directory */
34209 struct dentry *idiag_root;
34210 struct dentry *idiag_pci_cfg;
34211 diff -urNp linux-3.0.8/drivers/scsi/lpfc/lpfc_init.c linux-3.0.8/drivers/scsi/lpfc/lpfc_init.c
34212 --- linux-3.0.8/drivers/scsi/lpfc/lpfc_init.c 2011-10-24 08:05:30.000000000 -0400
34213 +++ linux-3.0.8/drivers/scsi/lpfc/lpfc_init.c 2011-10-16 21:55:27.000000000 -0400
34214 @@ -9971,8 +9971,10 @@ lpfc_init(void)
34215 printk(LPFC_COPYRIGHT "\n");
34216
34217 if (lpfc_enable_npiv) {
34218 - lpfc_transport_functions.vport_create = lpfc_vport_create;
34219 - lpfc_transport_functions.vport_delete = lpfc_vport_delete;
34220 + pax_open_kernel();
34221 + *(void **)&lpfc_transport_functions.vport_create = lpfc_vport_create;
34222 + *(void **)&lpfc_transport_functions.vport_delete = lpfc_vport_delete;
34223 + pax_close_kernel();
34224 }
34225 lpfc_transport_template =
34226 fc_attach_transport(&lpfc_transport_functions);
34227 diff -urNp linux-3.0.8/drivers/scsi/lpfc/lpfc_scsi.c linux-3.0.8/drivers/scsi/lpfc/lpfc_scsi.c
34228 --- linux-3.0.8/drivers/scsi/lpfc/lpfc_scsi.c 2011-10-24 08:05:30.000000000 -0400
34229 +++ linux-3.0.8/drivers/scsi/lpfc/lpfc_scsi.c 2011-10-16 21:55:27.000000000 -0400
34230 @@ -297,7 +297,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hb
34231 uint32_t evt_posted;
34232
34233 spin_lock_irqsave(&phba->hbalock, flags);
34234 - atomic_inc(&phba->num_rsrc_err);
34235 + atomic_inc_unchecked(&phba->num_rsrc_err);
34236 phba->last_rsrc_error_time = jiffies;
34237
34238 if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
34239 @@ -338,7 +338,7 @@ lpfc_rampup_queue_depth(struct lpfc_vpor
34240 unsigned long flags;
34241 struct lpfc_hba *phba = vport->phba;
34242 uint32_t evt_posted;
34243 - atomic_inc(&phba->num_cmd_success);
34244 + atomic_inc_unchecked(&phba->num_cmd_success);
34245
34246 if (vport->cfg_lun_queue_depth <= queue_depth)
34247 return;
34248 @@ -382,8 +382,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
34249 unsigned long num_rsrc_err, num_cmd_success;
34250 int i;
34251
34252 - num_rsrc_err = atomic_read(&phba->num_rsrc_err);
34253 - num_cmd_success = atomic_read(&phba->num_cmd_success);
34254 + num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
34255 + num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
34256
34257 vports = lpfc_create_vport_work_array(phba);
34258 if (vports != NULL)
34259 @@ -403,8 +403,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
34260 }
34261 }
34262 lpfc_destroy_vport_work_array(phba, vports);
34263 - atomic_set(&phba->num_rsrc_err, 0);
34264 - atomic_set(&phba->num_cmd_success, 0);
34265 + atomic_set_unchecked(&phba->num_rsrc_err, 0);
34266 + atomic_set_unchecked(&phba->num_cmd_success, 0);
34267 }
34268
34269 /**
34270 @@ -438,8 +438,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_h
34271 }
34272 }
34273 lpfc_destroy_vport_work_array(phba, vports);
34274 - atomic_set(&phba->num_rsrc_err, 0);
34275 - atomic_set(&phba->num_cmd_success, 0);
34276 + atomic_set_unchecked(&phba->num_rsrc_err, 0);
34277 + atomic_set_unchecked(&phba->num_cmd_success, 0);
34278 }
34279
34280 /**
34281 diff -urNp linux-3.0.8/drivers/scsi/megaraid/megaraid_mbox.c linux-3.0.8/drivers/scsi/megaraid/megaraid_mbox.c
34282 --- linux-3.0.8/drivers/scsi/megaraid/megaraid_mbox.c 2011-07-21 22:17:23.000000000 -0400
34283 +++ linux-3.0.8/drivers/scsi/megaraid/megaraid_mbox.c 2011-08-23 21:48:14.000000000 -0400
34284 @@ -3503,6 +3503,8 @@ megaraid_cmm_register(adapter_t *adapter
34285 int rval;
34286 int i;
34287
34288 + pax_track_stack();
34289 +
34290 // Allocate memory for the base list of scb for management module.
34291 adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
34292
34293 diff -urNp linux-3.0.8/drivers/scsi/osd/osd_initiator.c linux-3.0.8/drivers/scsi/osd/osd_initiator.c
34294 --- linux-3.0.8/drivers/scsi/osd/osd_initiator.c 2011-07-21 22:17:23.000000000 -0400
34295 +++ linux-3.0.8/drivers/scsi/osd/osd_initiator.c 2011-08-23 21:48:14.000000000 -0400
34296 @@ -97,6 +97,8 @@ static int _osd_get_print_system_info(st
34297 int nelem = ARRAY_SIZE(get_attrs), a = 0;
34298 int ret;
34299
34300 + pax_track_stack();
34301 +
34302 or = osd_start_request(od, GFP_KERNEL);
34303 if (!or)
34304 return -ENOMEM;
34305 diff -urNp linux-3.0.8/drivers/scsi/pmcraid.c linux-3.0.8/drivers/scsi/pmcraid.c
34306 --- linux-3.0.8/drivers/scsi/pmcraid.c 2011-10-24 08:05:21.000000000 -0400
34307 +++ linux-3.0.8/drivers/scsi/pmcraid.c 2011-08-23 21:47:56.000000000 -0400
34308 @@ -201,8 +201,8 @@ static int pmcraid_slave_alloc(struct sc
34309 res->scsi_dev = scsi_dev;
34310 scsi_dev->hostdata = res;
34311 res->change_detected = 0;
34312 - atomic_set(&res->read_failures, 0);
34313 - atomic_set(&res->write_failures, 0);
34314 + atomic_set_unchecked(&res->read_failures, 0);
34315 + atomic_set_unchecked(&res->write_failures, 0);
34316 rc = 0;
34317 }
34318 spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
34319 @@ -2677,9 +2677,9 @@ static int pmcraid_error_handler(struct
34320
34321 /* If this was a SCSI read/write command keep count of errors */
34322 if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
34323 - atomic_inc(&res->read_failures);
34324 + atomic_inc_unchecked(&res->read_failures);
34325 else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
34326 - atomic_inc(&res->write_failures);
34327 + atomic_inc_unchecked(&res->write_failures);
34328
34329 if (!RES_IS_GSCSI(res->cfg_entry) &&
34330 masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
34331 @@ -3535,7 +3535,7 @@ static int pmcraid_queuecommand_lck(
34332 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
34333 * hrrq_id assigned here in queuecommand
34334 */
34335 - ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
34336 + ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
34337 pinstance->num_hrrq;
34338 cmd->cmd_done = pmcraid_io_done;
34339
34340 @@ -3860,7 +3860,7 @@ static long pmcraid_ioctl_passthrough(
34341 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
34342 * hrrq_id assigned here in queuecommand
34343 */
34344 - ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
34345 + ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
34346 pinstance->num_hrrq;
34347
34348 if (request_size) {
34349 @@ -4498,7 +4498,7 @@ static void pmcraid_worker_function(stru
34350
34351 pinstance = container_of(workp, struct pmcraid_instance, worker_q);
34352 /* add resources only after host is added into system */
34353 - if (!atomic_read(&pinstance->expose_resources))
34354 + if (!atomic_read_unchecked(&pinstance->expose_resources))
34355 return;
34356
34357 fw_version = be16_to_cpu(pinstance->inq_data->fw_version);
34358 @@ -5332,8 +5332,8 @@ static int __devinit pmcraid_init_instan
34359 init_waitqueue_head(&pinstance->reset_wait_q);
34360
34361 atomic_set(&pinstance->outstanding_cmds, 0);
34362 - atomic_set(&pinstance->last_message_id, 0);
34363 - atomic_set(&pinstance->expose_resources, 0);
34364 + atomic_set_unchecked(&pinstance->last_message_id, 0);
34365 + atomic_set_unchecked(&pinstance->expose_resources, 0);
34366
34367 INIT_LIST_HEAD(&pinstance->free_res_q);
34368 INIT_LIST_HEAD(&pinstance->used_res_q);
34369 @@ -6048,7 +6048,7 @@ static int __devinit pmcraid_probe(
34370 /* Schedule worker thread to handle CCN and take care of adding and
34371 * removing devices to OS
34372 */
34373 - atomic_set(&pinstance->expose_resources, 1);
34374 + atomic_set_unchecked(&pinstance->expose_resources, 1);
34375 schedule_work(&pinstance->worker_q);
34376 return rc;
34377
34378 diff -urNp linux-3.0.8/drivers/scsi/pmcraid.h linux-3.0.8/drivers/scsi/pmcraid.h
34379 --- linux-3.0.8/drivers/scsi/pmcraid.h 2011-07-21 22:17:23.000000000 -0400
34380 +++ linux-3.0.8/drivers/scsi/pmcraid.h 2011-08-23 21:47:56.000000000 -0400
34381 @@ -749,7 +749,7 @@ struct pmcraid_instance {
34382 struct pmcraid_isr_param hrrq_vector[PMCRAID_NUM_MSIX_VECTORS];
34383
34384 /* Message id as filled in last fired IOARCB, used to identify HRRQ */
34385 - atomic_t last_message_id;
34386 + atomic_unchecked_t last_message_id;
34387
34388 /* configuration table */
34389 struct pmcraid_config_table *cfg_table;
34390 @@ -778,7 +778,7 @@ struct pmcraid_instance {
34391 atomic_t outstanding_cmds;
34392
34393 /* should add/delete resources to mid-layer now ?*/
34394 - atomic_t expose_resources;
34395 + atomic_unchecked_t expose_resources;
34396
34397
34398
34399 @@ -814,8 +814,8 @@ struct pmcraid_resource_entry {
34400 struct pmcraid_config_table_entry_ext cfg_entry_ext;
34401 };
34402 struct scsi_device *scsi_dev; /* Link scsi_device structure */
34403 - atomic_t read_failures; /* count of failed READ commands */
34404 - atomic_t write_failures; /* count of failed WRITE commands */
34405 + atomic_unchecked_t read_failures; /* count of failed READ commands */
34406 + atomic_unchecked_t write_failures; /* count of failed WRITE commands */
34407
34408 /* To indicate add/delete/modify during CCN */
34409 u8 change_detected;
34410 diff -urNp linux-3.0.8/drivers/scsi/qla2xxx/qla_def.h linux-3.0.8/drivers/scsi/qla2xxx/qla_def.h
34411 --- linux-3.0.8/drivers/scsi/qla2xxx/qla_def.h 2011-07-21 22:17:23.000000000 -0400
34412 +++ linux-3.0.8/drivers/scsi/qla2xxx/qla_def.h 2011-08-23 21:47:56.000000000 -0400
34413 @@ -2244,7 +2244,7 @@ struct isp_operations {
34414 int (*get_flash_version) (struct scsi_qla_host *, void *);
34415 int (*start_scsi) (srb_t *);
34416 int (*abort_isp) (struct scsi_qla_host *);
34417 -};
34418 +} __no_const;
34419
34420 /* MSI-X Support *************************************************************/
34421
34422 diff -urNp linux-3.0.8/drivers/scsi/qla4xxx/ql4_def.h linux-3.0.8/drivers/scsi/qla4xxx/ql4_def.h
34423 --- linux-3.0.8/drivers/scsi/qla4xxx/ql4_def.h 2011-07-21 22:17:23.000000000 -0400
34424 +++ linux-3.0.8/drivers/scsi/qla4xxx/ql4_def.h 2011-08-23 21:47:56.000000000 -0400
34425 @@ -256,7 +256,7 @@ struct ddb_entry {
34426 atomic_t retry_relogin_timer; /* Min Time between relogins
34427 * (4000 only) */
34428 atomic_t relogin_timer; /* Max Time to wait for relogin to complete */
34429 - atomic_t relogin_retry_count; /* Num of times relogin has been
34430 + atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
34431 * retried */
34432
34433 uint16_t port;
34434 diff -urNp linux-3.0.8/drivers/scsi/qla4xxx/ql4_init.c linux-3.0.8/drivers/scsi/qla4xxx/ql4_init.c
34435 --- linux-3.0.8/drivers/scsi/qla4xxx/ql4_init.c 2011-07-21 22:17:23.000000000 -0400
34436 +++ linux-3.0.8/drivers/scsi/qla4xxx/ql4_init.c 2011-08-23 21:47:56.000000000 -0400
34437 @@ -680,7 +680,7 @@ static struct ddb_entry * qla4xxx_alloc_
34438 ddb_entry->fw_ddb_index = fw_ddb_index;
34439 atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
34440 atomic_set(&ddb_entry->relogin_timer, 0);
34441 - atomic_set(&ddb_entry->relogin_retry_count, 0);
34442 + atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
34443 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
34444 list_add_tail(&ddb_entry->list, &ha->ddb_list);
34445 ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
34446 @@ -1433,7 +1433,7 @@ int qla4xxx_process_ddb_changed(struct s
34447 if ((ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE) &&
34448 (atomic_read(&ddb_entry->state) != DDB_STATE_ONLINE)) {
34449 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
34450 - atomic_set(&ddb_entry->relogin_retry_count, 0);
34451 + atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
34452 atomic_set(&ddb_entry->relogin_timer, 0);
34453 clear_bit(DF_RELOGIN, &ddb_entry->flags);
34454 iscsi_unblock_session(ddb_entry->sess);
34455 diff -urNp linux-3.0.8/drivers/scsi/qla4xxx/ql4_os.c linux-3.0.8/drivers/scsi/qla4xxx/ql4_os.c
34456 --- linux-3.0.8/drivers/scsi/qla4xxx/ql4_os.c 2011-07-21 22:17:23.000000000 -0400
34457 +++ linux-3.0.8/drivers/scsi/qla4xxx/ql4_os.c 2011-08-23 21:47:56.000000000 -0400
34458 @@ -811,13 +811,13 @@ static void qla4xxx_timer(struct scsi_ql
34459 ddb_entry->fw_ddb_device_state ==
34460 DDB_DS_SESSION_FAILED) {
34461 /* Reset retry relogin timer */
34462 - atomic_inc(&ddb_entry->relogin_retry_count);
34463 + atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
34464 DEBUG2(printk("scsi%ld: ddb [%d] relogin"
34465 " timed out-retrying"
34466 " relogin (%d)\n",
34467 ha->host_no,
34468 ddb_entry->fw_ddb_index,
34469 - atomic_read(&ddb_entry->
34470 + atomic_read_unchecked(&ddb_entry->
34471 relogin_retry_count))
34472 );
34473 start_dpc++;
34474 diff -urNp linux-3.0.8/drivers/scsi/scsi.c linux-3.0.8/drivers/scsi/scsi.c
34475 --- linux-3.0.8/drivers/scsi/scsi.c 2011-07-21 22:17:23.000000000 -0400
34476 +++ linux-3.0.8/drivers/scsi/scsi.c 2011-08-23 21:47:56.000000000 -0400
34477 @@ -655,7 +655,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *
34478 unsigned long timeout;
34479 int rtn = 0;
34480
34481 - atomic_inc(&cmd->device->iorequest_cnt);
34482 + atomic_inc_unchecked(&cmd->device->iorequest_cnt);
34483
34484 /* check if the device is still usable */
34485 if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
34486 diff -urNp linux-3.0.8/drivers/scsi/scsi_debug.c linux-3.0.8/drivers/scsi/scsi_debug.c
34487 --- linux-3.0.8/drivers/scsi/scsi_debug.c 2011-07-21 22:17:23.000000000 -0400
34488 +++ linux-3.0.8/drivers/scsi/scsi_debug.c 2011-08-23 21:48:14.000000000 -0400
34489 @@ -1493,6 +1493,8 @@ static int resp_mode_select(struct scsi_
34490 unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
34491 unsigned char *cmd = (unsigned char *)scp->cmnd;
34492
34493 + pax_track_stack();
34494 +
34495 if ((errsts = check_readiness(scp, 1, devip)))
34496 return errsts;
34497 memset(arr, 0, sizeof(arr));
34498 @@ -1590,6 +1592,8 @@ static int resp_log_sense(struct scsi_cm
34499 unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
34500 unsigned char *cmd = (unsigned char *)scp->cmnd;
34501
34502 + pax_track_stack();
34503 +
34504 if ((errsts = check_readiness(scp, 1, devip)))
34505 return errsts;
34506 memset(arr, 0, sizeof(arr));
34507 diff -urNp linux-3.0.8/drivers/scsi/scsi_lib.c linux-3.0.8/drivers/scsi/scsi_lib.c
34508 --- linux-3.0.8/drivers/scsi/scsi_lib.c 2011-10-24 08:05:21.000000000 -0400
34509 +++ linux-3.0.8/drivers/scsi/scsi_lib.c 2011-08-23 21:47:56.000000000 -0400
34510 @@ -1412,7 +1412,7 @@ static void scsi_kill_request(struct req
34511 shost = sdev->host;
34512 scsi_init_cmd_errh(cmd);
34513 cmd->result = DID_NO_CONNECT << 16;
34514 - atomic_inc(&cmd->device->iorequest_cnt);
34515 + atomic_inc_unchecked(&cmd->device->iorequest_cnt);
34516
34517 /*
34518 * SCSI request completion path will do scsi_device_unbusy(),
34519 @@ -1438,9 +1438,9 @@ static void scsi_softirq_done(struct req
34520
34521 INIT_LIST_HEAD(&cmd->eh_entry);
34522
34523 - atomic_inc(&cmd->device->iodone_cnt);
34524 + atomic_inc_unchecked(&cmd->device->iodone_cnt);
34525 if (cmd->result)
34526 - atomic_inc(&cmd->device->ioerr_cnt);
34527 + atomic_inc_unchecked(&cmd->device->ioerr_cnt);
34528
34529 disposition = scsi_decide_disposition(cmd);
34530 if (disposition != SUCCESS &&
34531 diff -urNp linux-3.0.8/drivers/scsi/scsi_sysfs.c linux-3.0.8/drivers/scsi/scsi_sysfs.c
34532 --- linux-3.0.8/drivers/scsi/scsi_sysfs.c 2011-07-21 22:17:23.000000000 -0400
34533 +++ linux-3.0.8/drivers/scsi/scsi_sysfs.c 2011-08-23 21:47:56.000000000 -0400
34534 @@ -622,7 +622,7 @@ show_iostat_##field(struct device *dev,
34535 char *buf) \
34536 { \
34537 struct scsi_device *sdev = to_scsi_device(dev); \
34538 - unsigned long long count = atomic_read(&sdev->field); \
34539 + unsigned long long count = atomic_read_unchecked(&sdev->field); \
34540 return snprintf(buf, 20, "0x%llx\n", count); \
34541 } \
34542 static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
34543 diff -urNp linux-3.0.8/drivers/scsi/scsi_tgt_lib.c linux-3.0.8/drivers/scsi/scsi_tgt_lib.c
34544 --- linux-3.0.8/drivers/scsi/scsi_tgt_lib.c 2011-07-21 22:17:23.000000000 -0400
34545 +++ linux-3.0.8/drivers/scsi/scsi_tgt_lib.c 2011-10-06 04:17:55.000000000 -0400
34546 @@ -362,7 +362,7 @@ static int scsi_map_user_pages(struct sc
34547 int err;
34548
34549 dprintk("%lx %u\n", uaddr, len);
34550 - err = blk_rq_map_user(q, rq, NULL, (void *)uaddr, len, GFP_KERNEL);
34551 + err = blk_rq_map_user(q, rq, NULL, (void __user *)uaddr, len, GFP_KERNEL);
34552 if (err) {
34553 /*
34554 * TODO: need to fixup sg_tablesize, max_segment_size,
34555 diff -urNp linux-3.0.8/drivers/scsi/scsi_transport_fc.c linux-3.0.8/drivers/scsi/scsi_transport_fc.c
34556 --- linux-3.0.8/drivers/scsi/scsi_transport_fc.c 2011-07-21 22:17:23.000000000 -0400
34557 +++ linux-3.0.8/drivers/scsi/scsi_transport_fc.c 2011-08-23 21:47:56.000000000 -0400
34558 @@ -484,7 +484,7 @@ static DECLARE_TRANSPORT_CLASS(fc_vport_
34559 * Netlink Infrastructure
34560 */
34561
34562 -static atomic_t fc_event_seq;
34563 +static atomic_unchecked_t fc_event_seq;
34564
34565 /**
34566 * fc_get_event_number - Obtain the next sequential FC event number
34567 @@ -497,7 +497,7 @@ static atomic_t fc_event_seq;
34568 u32
34569 fc_get_event_number(void)
34570 {
34571 - return atomic_add_return(1, &fc_event_seq);
34572 + return atomic_add_return_unchecked(1, &fc_event_seq);
34573 }
34574 EXPORT_SYMBOL(fc_get_event_number);
34575
34576 @@ -645,7 +645,7 @@ static __init int fc_transport_init(void
34577 {
34578 int error;
34579
34580 - atomic_set(&fc_event_seq, 0);
34581 + atomic_set_unchecked(&fc_event_seq, 0);
34582
34583 error = transport_class_register(&fc_host_class);
34584 if (error)
34585 @@ -835,7 +835,7 @@ static int fc_str_to_dev_loss(const char
34586 char *cp;
34587
34588 *val = simple_strtoul(buf, &cp, 0);
34589 - if ((*cp && (*cp != '\n')) || (*val < 0))
34590 + if (*cp && (*cp != '\n'))
34591 return -EINVAL;
34592 /*
34593 * Check for overflow; dev_loss_tmo is u32
34594 diff -urNp linux-3.0.8/drivers/scsi/scsi_transport_iscsi.c linux-3.0.8/drivers/scsi/scsi_transport_iscsi.c
34595 --- linux-3.0.8/drivers/scsi/scsi_transport_iscsi.c 2011-07-21 22:17:23.000000000 -0400
34596 +++ linux-3.0.8/drivers/scsi/scsi_transport_iscsi.c 2011-08-23 21:47:56.000000000 -0400
34597 @@ -83,7 +83,7 @@ struct iscsi_internal {
34598 struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
34599 };
34600
34601 -static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
34602 +static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
34603 static struct workqueue_struct *iscsi_eh_timer_workq;
34604
34605 /*
34606 @@ -761,7 +761,7 @@ int iscsi_add_session(struct iscsi_cls_s
34607 int err;
34608
34609 ihost = shost->shost_data;
34610 - session->sid = atomic_add_return(1, &iscsi_session_nr);
34611 + session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
34612
34613 if (id == ISCSI_MAX_TARGET) {
34614 for (id = 0; id < ISCSI_MAX_TARGET; id++) {
34615 @@ -2200,7 +2200,7 @@ static __init int iscsi_transport_init(v
34616 printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
34617 ISCSI_TRANSPORT_VERSION);
34618
34619 - atomic_set(&iscsi_session_nr, 0);
34620 + atomic_set_unchecked(&iscsi_session_nr, 0);
34621
34622 err = class_register(&iscsi_transport_class);
34623 if (err)
34624 diff -urNp linux-3.0.8/drivers/scsi/scsi_transport_srp.c linux-3.0.8/drivers/scsi/scsi_transport_srp.c
34625 --- linux-3.0.8/drivers/scsi/scsi_transport_srp.c 2011-07-21 22:17:23.000000000 -0400
34626 +++ linux-3.0.8/drivers/scsi/scsi_transport_srp.c 2011-08-23 21:47:56.000000000 -0400
34627 @@ -33,7 +33,7 @@
34628 #include "scsi_transport_srp_internal.h"
34629
34630 struct srp_host_attrs {
34631 - atomic_t next_port_id;
34632 + atomic_unchecked_t next_port_id;
34633 };
34634 #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
34635
34636 @@ -62,7 +62,7 @@ static int srp_host_setup(struct transpo
34637 struct Scsi_Host *shost = dev_to_shost(dev);
34638 struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
34639
34640 - atomic_set(&srp_host->next_port_id, 0);
34641 + atomic_set_unchecked(&srp_host->next_port_id, 0);
34642 return 0;
34643 }
34644
34645 @@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct S
34646 memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
34647 rport->roles = ids->roles;
34648
34649 - id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
34650 + id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
34651 dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
34652
34653 transport_setup_device(&rport->dev);
34654 diff -urNp linux-3.0.8/drivers/scsi/sg.c linux-3.0.8/drivers/scsi/sg.c
34655 --- linux-3.0.8/drivers/scsi/sg.c 2011-07-21 22:17:23.000000000 -0400
34656 +++ linux-3.0.8/drivers/scsi/sg.c 2011-10-06 04:17:55.000000000 -0400
34657 @@ -1075,7 +1075,7 @@ sg_ioctl(struct file *filp, unsigned int
34658 sdp->disk->disk_name,
34659 MKDEV(SCSI_GENERIC_MAJOR, sdp->index),
34660 NULL,
34661 - (char *)arg);
34662 + (char __user *)arg);
34663 case BLKTRACESTART:
34664 return blk_trace_startstop(sdp->device->request_queue, 1);
34665 case BLKTRACESTOP:
34666 @@ -2310,7 +2310,7 @@ struct sg_proc_leaf {
34667 const struct file_operations * fops;
34668 };
34669
34670 -static struct sg_proc_leaf sg_proc_leaf_arr[] = {
34671 +static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
34672 {"allow_dio", &adio_fops},
34673 {"debug", &debug_fops},
34674 {"def_reserved_size", &dressz_fops},
34675 @@ -2325,7 +2325,7 @@ sg_proc_init(void)
34676 {
34677 int k, mask;
34678 int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
34679 - struct sg_proc_leaf * leaf;
34680 + const struct sg_proc_leaf * leaf;
34681
34682 sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
34683 if (!sg_proc_sgp)
34684 diff -urNp linux-3.0.8/drivers/scsi/sym53c8xx_2/sym_glue.c linux-3.0.8/drivers/scsi/sym53c8xx_2/sym_glue.c
34685 --- linux-3.0.8/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-07-21 22:17:23.000000000 -0400
34686 +++ linux-3.0.8/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-08-23 21:48:14.000000000 -0400
34687 @@ -1756,6 +1756,8 @@ static int __devinit sym2_probe(struct p
34688 int do_iounmap = 0;
34689 int do_disable_device = 1;
34690
34691 + pax_track_stack();
34692 +
34693 memset(&sym_dev, 0, sizeof(sym_dev));
34694 memset(&nvram, 0, sizeof(nvram));
34695 sym_dev.pdev = pdev;
34696 diff -urNp linux-3.0.8/drivers/scsi/vmw_pvscsi.c linux-3.0.8/drivers/scsi/vmw_pvscsi.c
34697 --- linux-3.0.8/drivers/scsi/vmw_pvscsi.c 2011-07-21 22:17:23.000000000 -0400
34698 +++ linux-3.0.8/drivers/scsi/vmw_pvscsi.c 2011-08-23 21:48:14.000000000 -0400
34699 @@ -447,6 +447,8 @@ static void pvscsi_setup_all_rings(const
34700 dma_addr_t base;
34701 unsigned i;
34702
34703 + pax_track_stack();
34704 +
34705 cmd.ringsStatePPN = adapter->ringStatePA >> PAGE_SHIFT;
34706 cmd.reqRingNumPages = adapter->req_pages;
34707 cmd.cmpRingNumPages = adapter->cmp_pages;
34708 diff -urNp linux-3.0.8/drivers/spi/dw_spi_pci.c linux-3.0.8/drivers/spi/dw_spi_pci.c
34709 --- linux-3.0.8/drivers/spi/dw_spi_pci.c 2011-07-21 22:17:23.000000000 -0400
34710 +++ linux-3.0.8/drivers/spi/dw_spi_pci.c 2011-10-11 10:44:33.000000000 -0400
34711 @@ -148,7 +148,7 @@ static int spi_resume(struct pci_dev *pd
34712 #define spi_resume NULL
34713 #endif
34714
34715 -static const struct pci_device_id pci_ids[] __devinitdata = {
34716 +static const struct pci_device_id pci_ids[] __devinitconst = {
34717 /* Intel MID platform SPI controller 0 */
34718 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x0800) },
34719 {},
34720 diff -urNp linux-3.0.8/drivers/spi/spi.c linux-3.0.8/drivers/spi/spi.c
34721 --- linux-3.0.8/drivers/spi/spi.c 2011-07-21 22:17:23.000000000 -0400
34722 +++ linux-3.0.8/drivers/spi/spi.c 2011-08-23 21:47:56.000000000 -0400
34723 @@ -1023,7 +1023,7 @@ int spi_bus_unlock(struct spi_master *ma
34724 EXPORT_SYMBOL_GPL(spi_bus_unlock);
34725
34726 /* portable code must never pass more than 32 bytes */
34727 -#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
34728 +#define SPI_BUFSIZ max(32UL,SMP_CACHE_BYTES)
34729
34730 static u8 *buf;
34731
34732 diff -urNp linux-3.0.8/drivers/staging/ath6kl/os/linux/ar6000_drv.c linux-3.0.8/drivers/staging/ath6kl/os/linux/ar6000_drv.c
34733 --- linux-3.0.8/drivers/staging/ath6kl/os/linux/ar6000_drv.c 2011-10-24 08:05:21.000000000 -0400
34734 +++ linux-3.0.8/drivers/staging/ath6kl/os/linux/ar6000_drv.c 2011-08-23 21:48:14.000000000 -0400
34735 @@ -362,7 +362,7 @@ static struct ar_cookie s_ar_cookie_mem[
34736 (((ar)->arTargetType == TARGET_TYPE_AR6003) ? AR6003_HOST_INTEREST_ITEM_ADDRESS(item) : 0))
34737
34738
34739 -static struct net_device_ops ar6000_netdev_ops = {
34740 +static net_device_ops_no_const ar6000_netdev_ops = {
34741 .ndo_init = NULL,
34742 .ndo_open = ar6000_open,
34743 .ndo_stop = ar6000_close,
34744 diff -urNp linux-3.0.8/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h linux-3.0.8/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h
34745 --- linux-3.0.8/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h 2011-07-21 22:17:23.000000000 -0400
34746 +++ linux-3.0.8/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h 2011-08-23 21:47:56.000000000 -0400
34747 @@ -30,7 +30,7 @@ typedef bool (*ar6k_pal_recv_pkt_t)(void
34748 typedef struct ar6k_pal_config_s
34749 {
34750 ar6k_pal_recv_pkt_t fpar6k_pal_recv_pkt;
34751 -}ar6k_pal_config_t;
34752 +} __no_const ar6k_pal_config_t;
34753
34754 void register_pal_cb(ar6k_pal_config_t *palConfig_p);
34755 #endif /* _AR6K_PAL_H_ */
34756 diff -urNp linux-3.0.8/drivers/staging/brcm80211/brcmfmac/dhd_linux.c linux-3.0.8/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
34757 --- linux-3.0.8/drivers/staging/brcm80211/brcmfmac/dhd_linux.c 2011-07-21 22:17:23.000000000 -0400
34758 +++ linux-3.0.8/drivers/staging/brcm80211/brcmfmac/dhd_linux.c 2011-08-23 21:47:56.000000000 -0400
34759 @@ -853,14 +853,14 @@ static void dhd_op_if(dhd_if_t *ifp)
34760 free_netdev(ifp->net);
34761 }
34762 /* Allocate etherdev, including space for private structure */
34763 - ifp->net = alloc_etherdev(sizeof(dhd));
34764 + ifp->net = alloc_etherdev(sizeof(*dhd));
34765 if (!ifp->net) {
34766 DHD_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
34767 ret = -ENOMEM;
34768 }
34769 if (ret == 0) {
34770 strcpy(ifp->net->name, ifp->name);
34771 - memcpy(netdev_priv(ifp->net), &dhd, sizeof(dhd));
34772 + memcpy(netdev_priv(ifp->net), dhd, sizeof(*dhd));
34773 err = dhd_net_attach(&dhd->pub, ifp->idx);
34774 if (err != 0) {
34775 DHD_ERROR(("%s: dhd_net_attach failed, "
34776 @@ -1872,7 +1872,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
34777 strcpy(nv_path, nvram_path);
34778
34779 /* Allocate etherdev, including space for private structure */
34780 - net = alloc_etherdev(sizeof(dhd));
34781 + net = alloc_etherdev(sizeof(*dhd));
34782 if (!net) {
34783 DHD_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
34784 goto fail;
34785 @@ -1888,7 +1888,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
34786 /*
34787 * Save the dhd_info into the priv
34788 */
34789 - memcpy(netdev_priv(net), &dhd, sizeof(dhd));
34790 + memcpy(netdev_priv(net), dhd, sizeof(*dhd));
34791
34792 /* Set network interface name if it was provided as module parameter */
34793 if (iface_name[0]) {
34794 @@ -2004,7 +2004,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
34795 /*
34796 * Save the dhd_info into the priv
34797 */
34798 - memcpy(netdev_priv(net), &dhd, sizeof(dhd));
34799 + memcpy(netdev_priv(net), dhd, sizeof(*dhd));
34800
34801 #if defined(CUSTOMER_HW2) && defined(CONFIG_WIFI_CONTROL_FUNC)
34802 g_bus = bus;
34803 diff -urNp linux-3.0.8/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_int.h linux-3.0.8/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_int.h
34804 --- linux-3.0.8/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_int.h 2011-07-21 22:17:23.000000000 -0400
34805 +++ linux-3.0.8/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_int.h 2011-08-23 21:47:56.000000000 -0400
34806 @@ -593,7 +593,7 @@ struct phy_func_ptr {
34807 initfn_t carrsuppr;
34808 rxsigpwrfn_t rxsigpwr;
34809 detachfn_t detach;
34810 -};
34811 +} __no_const;
34812 typedef struct phy_func_ptr phy_func_ptr_t;
34813
34814 struct phy_info {
34815 diff -urNp linux-3.0.8/drivers/staging/brcm80211/include/bcmsdh.h linux-3.0.8/drivers/staging/brcm80211/include/bcmsdh.h
34816 --- linux-3.0.8/drivers/staging/brcm80211/include/bcmsdh.h 2011-07-21 22:17:23.000000000 -0400
34817 +++ linux-3.0.8/drivers/staging/brcm80211/include/bcmsdh.h 2011-08-23 21:47:56.000000000 -0400
34818 @@ -185,7 +185,7 @@ typedef struct {
34819 u16 func, uint bustype, void *regsva, void *param);
34820 /* detach from device */
34821 void (*detach) (void *ch);
34822 -} bcmsdh_driver_t;
34823 +} __no_const bcmsdh_driver_t;
34824
34825 /* platform specific/high level functions */
34826 extern int bcmsdh_register(bcmsdh_driver_t *driver);
34827 diff -urNp linux-3.0.8/drivers/staging/et131x/et1310_tx.c linux-3.0.8/drivers/staging/et131x/et1310_tx.c
34828 --- linux-3.0.8/drivers/staging/et131x/et1310_tx.c 2011-07-21 22:17:23.000000000 -0400
34829 +++ linux-3.0.8/drivers/staging/et131x/et1310_tx.c 2011-08-23 21:47:56.000000000 -0400
34830 @@ -635,11 +635,11 @@ inline void et131x_free_send_packet(stru
34831 struct net_device_stats *stats = &etdev->net_stats;
34832
34833 if (tcb->flags & fMP_DEST_BROAD)
34834 - atomic_inc(&etdev->Stats.brdcstxmt);
34835 + atomic_inc_unchecked(&etdev->Stats.brdcstxmt);
34836 else if (tcb->flags & fMP_DEST_MULTI)
34837 - atomic_inc(&etdev->Stats.multixmt);
34838 + atomic_inc_unchecked(&etdev->Stats.multixmt);
34839 else
34840 - atomic_inc(&etdev->Stats.unixmt);
34841 + atomic_inc_unchecked(&etdev->Stats.unixmt);
34842
34843 if (tcb->skb) {
34844 stats->tx_bytes += tcb->skb->len;
34845 diff -urNp linux-3.0.8/drivers/staging/et131x/et131x_adapter.h linux-3.0.8/drivers/staging/et131x/et131x_adapter.h
34846 --- linux-3.0.8/drivers/staging/et131x/et131x_adapter.h 2011-07-21 22:17:23.000000000 -0400
34847 +++ linux-3.0.8/drivers/staging/et131x/et131x_adapter.h 2011-08-23 21:47:56.000000000 -0400
34848 @@ -110,11 +110,11 @@ typedef struct _ce_stats_t {
34849 * operations
34850 */
34851 u32 unircv; /* # multicast packets received */
34852 - atomic_t unixmt; /* # multicast packets for Tx */
34853 + atomic_unchecked_t unixmt; /* # multicast packets for Tx */
34854 u32 multircv; /* # multicast packets received */
34855 - atomic_t multixmt; /* # multicast packets for Tx */
34856 + atomic_unchecked_t multixmt; /* # multicast packets for Tx */
34857 u32 brdcstrcv; /* # broadcast packets received */
34858 - atomic_t brdcstxmt; /* # broadcast packets for Tx */
34859 + atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */
34860 u32 norcvbuf; /* # Rx packets discarded */
34861 u32 noxmtbuf; /* # Tx packets discarded */
34862
34863 diff -urNp linux-3.0.8/drivers/staging/hv/channel.c linux-3.0.8/drivers/staging/hv/channel.c
34864 --- linux-3.0.8/drivers/staging/hv/channel.c 2011-10-24 08:05:21.000000000 -0400
34865 +++ linux-3.0.8/drivers/staging/hv/channel.c 2011-08-23 21:47:56.000000000 -0400
34866 @@ -433,8 +433,8 @@ int vmbus_establish_gpadl(struct vmbus_c
34867 int ret = 0;
34868 int t;
34869
34870 - next_gpadl_handle = atomic_read(&vmbus_connection.next_gpadl_handle);
34871 - atomic_inc(&vmbus_connection.next_gpadl_handle);
34872 + next_gpadl_handle = atomic_read_unchecked(&vmbus_connection.next_gpadl_handle);
34873 + atomic_inc_unchecked(&vmbus_connection.next_gpadl_handle);
34874
34875 ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount);
34876 if (ret)
34877 diff -urNp linux-3.0.8/drivers/staging/hv/hv.c linux-3.0.8/drivers/staging/hv/hv.c
34878 --- linux-3.0.8/drivers/staging/hv/hv.c 2011-07-21 22:17:23.000000000 -0400
34879 +++ linux-3.0.8/drivers/staging/hv/hv.c 2011-08-23 21:47:56.000000000 -0400
34880 @@ -132,7 +132,7 @@ static u64 do_hypercall(u64 control, voi
34881 u64 output_address = (output) ? virt_to_phys(output) : 0;
34882 u32 output_address_hi = output_address >> 32;
34883 u32 output_address_lo = output_address & 0xFFFFFFFF;
34884 - volatile void *hypercall_page = hv_context.hypercall_page;
34885 + volatile void *hypercall_page = ktva_ktla(hv_context.hypercall_page);
34886
34887 __asm__ __volatile__ ("call *%8" : "=d"(hv_status_hi),
34888 "=a"(hv_status_lo) : "d" (control_hi),
34889 diff -urNp linux-3.0.8/drivers/staging/hv/hv_mouse.c linux-3.0.8/drivers/staging/hv/hv_mouse.c
34890 --- linux-3.0.8/drivers/staging/hv/hv_mouse.c 2011-07-21 22:17:23.000000000 -0400
34891 +++ linux-3.0.8/drivers/staging/hv/hv_mouse.c 2011-08-23 21:47:56.000000000 -0400
34892 @@ -879,8 +879,10 @@ static void reportdesc_callback(struct h
34893 if (hid_dev) {
34894 DPRINT_INFO(INPUTVSC_DRV, "hid_device created");
34895
34896 - hid_dev->ll_driver->open = mousevsc_hid_open;
34897 - hid_dev->ll_driver->close = mousevsc_hid_close;
34898 + pax_open_kernel();
34899 + *(void **)&hid_dev->ll_driver->open = mousevsc_hid_open;
34900 + *(void **)&hid_dev->ll_driver->close = mousevsc_hid_close;
34901 + pax_close_kernel();
34902
34903 hid_dev->bus = BUS_VIRTUAL;
34904 hid_dev->vendor = input_device_ctx->device_info.vendor;
34905 diff -urNp linux-3.0.8/drivers/staging/hv/hyperv_vmbus.h linux-3.0.8/drivers/staging/hv/hyperv_vmbus.h
34906 --- linux-3.0.8/drivers/staging/hv/hyperv_vmbus.h 2011-07-21 22:17:23.000000000 -0400
34907 +++ linux-3.0.8/drivers/staging/hv/hyperv_vmbus.h 2011-08-23 21:47:56.000000000 -0400
34908 @@ -559,7 +559,7 @@ enum vmbus_connect_state {
34909 struct vmbus_connection {
34910 enum vmbus_connect_state conn_state;
34911
34912 - atomic_t next_gpadl_handle;
34913 + atomic_unchecked_t next_gpadl_handle;
34914
34915 /*
34916 * Represents channel interrupts. Each bit position represents a
34917 diff -urNp linux-3.0.8/drivers/staging/hv/rndis_filter.c linux-3.0.8/drivers/staging/hv/rndis_filter.c
34918 --- linux-3.0.8/drivers/staging/hv/rndis_filter.c 2011-10-24 08:05:21.000000000 -0400
34919 +++ linux-3.0.8/drivers/staging/hv/rndis_filter.c 2011-08-23 21:47:56.000000000 -0400
34920 @@ -43,7 +43,7 @@ struct rndis_device {
34921
34922 enum rndis_device_state state;
34923 u32 link_stat;
34924 - atomic_t new_req_id;
34925 + atomic_unchecked_t new_req_id;
34926
34927 spinlock_t request_lock;
34928 struct list_head req_list;
34929 @@ -117,7 +117,7 @@ static struct rndis_request *get_rndis_r
34930 * template
34931 */
34932 set = &rndis_msg->msg.set_req;
34933 - set->req_id = atomic_inc_return(&dev->new_req_id);
34934 + set->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
34935
34936 /* Add to the request list */
34937 spin_lock_irqsave(&dev->request_lock, flags);
34938 @@ -637,7 +637,7 @@ static void rndis_filter_halt_device(str
34939
34940 /* Setup the rndis set */
34941 halt = &request->request_msg.msg.halt_req;
34942 - halt->req_id = atomic_inc_return(&dev->new_req_id);
34943 + halt->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
34944
34945 /* Ignore return since this msg is optional. */
34946 rndis_filter_send_request(dev, request);
34947 diff -urNp linux-3.0.8/drivers/staging/hv/vmbus_drv.c linux-3.0.8/drivers/staging/hv/vmbus_drv.c
34948 --- linux-3.0.8/drivers/staging/hv/vmbus_drv.c 2011-07-21 22:17:23.000000000 -0400
34949 +++ linux-3.0.8/drivers/staging/hv/vmbus_drv.c 2011-08-23 21:47:56.000000000 -0400
34950 @@ -668,11 +668,11 @@ int vmbus_child_device_register(struct h
34951 {
34952 int ret = 0;
34953
34954 - static atomic_t device_num = ATOMIC_INIT(0);
34955 + static atomic_unchecked_t device_num = ATOMIC_INIT(0);
34956
34957 /* Set the device name. Otherwise, device_register() will fail. */
34958 dev_set_name(&child_device_obj->device, "vmbus_0_%d",
34959 - atomic_inc_return(&device_num));
34960 + atomic_inc_return_unchecked(&device_num));
34961
34962 /* The new device belongs to this bus */
34963 child_device_obj->device.bus = &hv_bus; /* device->dev.bus; */
34964 diff -urNp linux-3.0.8/drivers/staging/iio/ring_generic.h linux-3.0.8/drivers/staging/iio/ring_generic.h
34965 --- linux-3.0.8/drivers/staging/iio/ring_generic.h 2011-07-21 22:17:23.000000000 -0400
34966 +++ linux-3.0.8/drivers/staging/iio/ring_generic.h 2011-08-23 21:47:56.000000000 -0400
34967 @@ -62,7 +62,7 @@ struct iio_ring_access_funcs {
34968
34969 int (*is_enabled)(struct iio_ring_buffer *ring);
34970 int (*enable)(struct iio_ring_buffer *ring);
34971 -};
34972 +} __no_const;
34973
34974 struct iio_ring_setup_ops {
34975 int (*preenable)(struct iio_dev *);
34976 diff -urNp linux-3.0.8/drivers/staging/octeon/ethernet.c linux-3.0.8/drivers/staging/octeon/ethernet.c
34977 --- linux-3.0.8/drivers/staging/octeon/ethernet.c 2011-07-21 22:17:23.000000000 -0400
34978 +++ linux-3.0.8/drivers/staging/octeon/ethernet.c 2011-08-23 21:47:56.000000000 -0400
34979 @@ -258,11 +258,11 @@ static struct net_device_stats *cvm_oct_
34980 * since the RX tasklet also increments it.
34981 */
34982 #ifdef CONFIG_64BIT
34983 - atomic64_add(rx_status.dropped_packets,
34984 - (atomic64_t *)&priv->stats.rx_dropped);
34985 + atomic64_add_unchecked(rx_status.dropped_packets,
34986 + (atomic64_unchecked_t *)&priv->stats.rx_dropped);
34987 #else
34988 - atomic_add(rx_status.dropped_packets,
34989 - (atomic_t *)&priv->stats.rx_dropped);
34990 + atomic_add_unchecked(rx_status.dropped_packets,
34991 + (atomic_unchecked_t *)&priv->stats.rx_dropped);
34992 #endif
34993 }
34994
34995 diff -urNp linux-3.0.8/drivers/staging/octeon/ethernet-rx.c linux-3.0.8/drivers/staging/octeon/ethernet-rx.c
34996 --- linux-3.0.8/drivers/staging/octeon/ethernet-rx.c 2011-07-21 22:17:23.000000000 -0400
34997 +++ linux-3.0.8/drivers/staging/octeon/ethernet-rx.c 2011-08-23 21:47:56.000000000 -0400
34998 @@ -417,11 +417,11 @@ static int cvm_oct_napi_poll(struct napi
34999 /* Increment RX stats for virtual ports */
35000 if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
35001 #ifdef CONFIG_64BIT
35002 - atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
35003 - atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
35004 + atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
35005 + atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
35006 #else
35007 - atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
35008 - atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
35009 + atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
35010 + atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
35011 #endif
35012 }
35013 netif_receive_skb(skb);
35014 @@ -433,9 +433,9 @@ static int cvm_oct_napi_poll(struct napi
35015 dev->name);
35016 */
35017 #ifdef CONFIG_64BIT
35018 - atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
35019 + atomic64_unchecked_add(1, (atomic64_unchecked_t *)&priv->stats.rx_dropped);
35020 #else
35021 - atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
35022 + atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_dropped);
35023 #endif
35024 dev_kfree_skb_irq(skb);
35025 }
35026 diff -urNp linux-3.0.8/drivers/staging/pohmelfs/inode.c linux-3.0.8/drivers/staging/pohmelfs/inode.c
35027 --- linux-3.0.8/drivers/staging/pohmelfs/inode.c 2011-07-21 22:17:23.000000000 -0400
35028 +++ linux-3.0.8/drivers/staging/pohmelfs/inode.c 2011-08-23 21:47:56.000000000 -0400
35029 @@ -1856,7 +1856,7 @@ static int pohmelfs_fill_super(struct su
35030 mutex_init(&psb->mcache_lock);
35031 psb->mcache_root = RB_ROOT;
35032 psb->mcache_timeout = msecs_to_jiffies(5000);
35033 - atomic_long_set(&psb->mcache_gen, 0);
35034 + atomic_long_set_unchecked(&psb->mcache_gen, 0);
35035
35036 psb->trans_max_pages = 100;
35037
35038 @@ -1871,7 +1871,7 @@ static int pohmelfs_fill_super(struct su
35039 INIT_LIST_HEAD(&psb->crypto_ready_list);
35040 INIT_LIST_HEAD(&psb->crypto_active_list);
35041
35042 - atomic_set(&psb->trans_gen, 1);
35043 + atomic_set_unchecked(&psb->trans_gen, 1);
35044 atomic_long_set(&psb->total_inodes, 0);
35045
35046 mutex_init(&psb->state_lock);
35047 diff -urNp linux-3.0.8/drivers/staging/pohmelfs/mcache.c linux-3.0.8/drivers/staging/pohmelfs/mcache.c
35048 --- linux-3.0.8/drivers/staging/pohmelfs/mcache.c 2011-07-21 22:17:23.000000000 -0400
35049 +++ linux-3.0.8/drivers/staging/pohmelfs/mcache.c 2011-08-23 21:47:56.000000000 -0400
35050 @@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
35051 m->data = data;
35052 m->start = start;
35053 m->size = size;
35054 - m->gen = atomic_long_inc_return(&psb->mcache_gen);
35055 + m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
35056
35057 mutex_lock(&psb->mcache_lock);
35058 err = pohmelfs_mcache_insert(psb, m);
35059 diff -urNp linux-3.0.8/drivers/staging/pohmelfs/netfs.h linux-3.0.8/drivers/staging/pohmelfs/netfs.h
35060 --- linux-3.0.8/drivers/staging/pohmelfs/netfs.h 2011-07-21 22:17:23.000000000 -0400
35061 +++ linux-3.0.8/drivers/staging/pohmelfs/netfs.h 2011-08-23 21:47:56.000000000 -0400
35062 @@ -571,14 +571,14 @@ struct pohmelfs_config;
35063 struct pohmelfs_sb {
35064 struct rb_root mcache_root;
35065 struct mutex mcache_lock;
35066 - atomic_long_t mcache_gen;
35067 + atomic_long_unchecked_t mcache_gen;
35068 unsigned long mcache_timeout;
35069
35070 unsigned int idx;
35071
35072 unsigned int trans_retries;
35073
35074 - atomic_t trans_gen;
35075 + atomic_unchecked_t trans_gen;
35076
35077 unsigned int crypto_attached_size;
35078 unsigned int crypto_align_size;
35079 diff -urNp linux-3.0.8/drivers/staging/pohmelfs/trans.c linux-3.0.8/drivers/staging/pohmelfs/trans.c
35080 --- linux-3.0.8/drivers/staging/pohmelfs/trans.c 2011-07-21 22:17:23.000000000 -0400
35081 +++ linux-3.0.8/drivers/staging/pohmelfs/trans.c 2011-08-23 21:47:56.000000000 -0400
35082 @@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_tran
35083 int err;
35084 struct netfs_cmd *cmd = t->iovec.iov_base;
35085
35086 - t->gen = atomic_inc_return(&psb->trans_gen);
35087 + t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
35088
35089 cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
35090 t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
35091 diff -urNp linux-3.0.8/drivers/staging/rtl8712/rtl871x_io.h linux-3.0.8/drivers/staging/rtl8712/rtl871x_io.h
35092 --- linux-3.0.8/drivers/staging/rtl8712/rtl871x_io.h 2011-07-21 22:17:23.000000000 -0400
35093 +++ linux-3.0.8/drivers/staging/rtl8712/rtl871x_io.h 2011-08-23 21:47:56.000000000 -0400
35094 @@ -83,7 +83,7 @@ struct _io_ops {
35095 u8 *pmem);
35096 u32 (*_write_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt,
35097 u8 *pmem);
35098 -};
35099 +} __no_const;
35100
35101 struct io_req {
35102 struct list_head list;
35103 diff -urNp linux-3.0.8/drivers/staging/sbe-2t3e3/netdev.c linux-3.0.8/drivers/staging/sbe-2t3e3/netdev.c
35104 --- linux-3.0.8/drivers/staging/sbe-2t3e3/netdev.c 2011-07-21 22:17:23.000000000 -0400
35105 +++ linux-3.0.8/drivers/staging/sbe-2t3e3/netdev.c 2011-08-24 18:21:41.000000000 -0400
35106 @@ -51,7 +51,7 @@ int t3e3_ioctl(struct net_device *dev, s
35107 t3e3_if_config(sc, cmd_2t3e3, (char *)&param, &resp, &rlen);
35108
35109 if (rlen)
35110 - if (copy_to_user(data, &resp, rlen))
35111 + if (rlen > sizeof resp || copy_to_user(data, &resp, rlen))
35112 return -EFAULT;
35113
35114 return 0;
35115 diff -urNp linux-3.0.8/drivers/staging/tty/stallion.c linux-3.0.8/drivers/staging/tty/stallion.c
35116 --- linux-3.0.8/drivers/staging/tty/stallion.c 2011-07-21 22:17:23.000000000 -0400
35117 +++ linux-3.0.8/drivers/staging/tty/stallion.c 2011-08-23 21:48:14.000000000 -0400
35118 @@ -2406,6 +2406,8 @@ static int stl_getportstruct(struct stlp
35119 struct stlport stl_dummyport;
35120 struct stlport *portp;
35121
35122 + pax_track_stack();
35123 +
35124 if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport)))
35125 return -EFAULT;
35126 portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
35127 diff -urNp linux-3.0.8/drivers/staging/usbip/usbip_common.h linux-3.0.8/drivers/staging/usbip/usbip_common.h
35128 --- linux-3.0.8/drivers/staging/usbip/usbip_common.h 2011-07-21 22:17:23.000000000 -0400
35129 +++ linux-3.0.8/drivers/staging/usbip/usbip_common.h 2011-08-23 21:47:56.000000000 -0400
35130 @@ -315,7 +315,7 @@ struct usbip_device {
35131 void (*shutdown)(struct usbip_device *);
35132 void (*reset)(struct usbip_device *);
35133 void (*unusable)(struct usbip_device *);
35134 - } eh_ops;
35135 + } __no_const eh_ops;
35136 };
35137
35138 void usbip_pack_pdu(struct usbip_header *pdu, struct urb *urb, int cmd,
35139 diff -urNp linux-3.0.8/drivers/staging/usbip/vhci.h linux-3.0.8/drivers/staging/usbip/vhci.h
35140 --- linux-3.0.8/drivers/staging/usbip/vhci.h 2011-07-21 22:17:23.000000000 -0400
35141 +++ linux-3.0.8/drivers/staging/usbip/vhci.h 2011-08-23 21:47:56.000000000 -0400
35142 @@ -94,7 +94,7 @@ struct vhci_hcd {
35143 unsigned resuming:1;
35144 unsigned long re_timeout;
35145
35146 - atomic_t seqnum;
35147 + atomic_unchecked_t seqnum;
35148
35149 /*
35150 * NOTE:
35151 diff -urNp linux-3.0.8/drivers/staging/usbip/vhci_hcd.c linux-3.0.8/drivers/staging/usbip/vhci_hcd.c
35152 --- linux-3.0.8/drivers/staging/usbip/vhci_hcd.c 2011-10-24 08:05:21.000000000 -0400
35153 +++ linux-3.0.8/drivers/staging/usbip/vhci_hcd.c 2011-08-23 21:47:56.000000000 -0400
35154 @@ -511,7 +511,7 @@ static void vhci_tx_urb(struct urb *urb)
35155 return;
35156 }
35157
35158 - priv->seqnum = atomic_inc_return(&the_controller->seqnum);
35159 + priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
35160 if (priv->seqnum == 0xffff)
35161 dev_info(&urb->dev->dev, "seqnum max\n");
35162
35163 @@ -765,7 +765,7 @@ static int vhci_urb_dequeue(struct usb_h
35164 return -ENOMEM;
35165 }
35166
35167 - unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
35168 + unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
35169 if (unlink->seqnum == 0xffff)
35170 pr_info("seqnum max\n");
35171
35172 @@ -955,7 +955,7 @@ static int vhci_start(struct usb_hcd *hc
35173 vdev->rhport = rhport;
35174 }
35175
35176 - atomic_set(&vhci->seqnum, 0);
35177 + atomic_set_unchecked(&vhci->seqnum, 0);
35178 spin_lock_init(&vhci->lock);
35179
35180 hcd->power_budget = 0; /* no limit */
35181 diff -urNp linux-3.0.8/drivers/staging/usbip/vhci_rx.c linux-3.0.8/drivers/staging/usbip/vhci_rx.c
35182 --- linux-3.0.8/drivers/staging/usbip/vhci_rx.c 2011-07-21 22:17:23.000000000 -0400
35183 +++ linux-3.0.8/drivers/staging/usbip/vhci_rx.c 2011-08-23 21:47:56.000000000 -0400
35184 @@ -76,7 +76,7 @@ static void vhci_recv_ret_submit(struct
35185 if (!urb) {
35186 pr_err("cannot find a urb of seqnum %u\n", pdu->base.seqnum);
35187 pr_info("max seqnum %d\n",
35188 - atomic_read(&the_controller->seqnum));
35189 + atomic_read_unchecked(&the_controller->seqnum));
35190 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
35191 return;
35192 }
35193 diff -urNp linux-3.0.8/drivers/staging/vt6655/hostap.c linux-3.0.8/drivers/staging/vt6655/hostap.c
35194 --- linux-3.0.8/drivers/staging/vt6655/hostap.c 2011-07-21 22:17:23.000000000 -0400
35195 +++ linux-3.0.8/drivers/staging/vt6655/hostap.c 2011-08-23 21:47:56.000000000 -0400
35196 @@ -79,14 +79,13 @@ static int msglevel
35197 *
35198 */
35199
35200 +static net_device_ops_no_const apdev_netdev_ops;
35201 +
35202 static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
35203 {
35204 PSDevice apdev_priv;
35205 struct net_device *dev = pDevice->dev;
35206 int ret;
35207 - const struct net_device_ops apdev_netdev_ops = {
35208 - .ndo_start_xmit = pDevice->tx_80211,
35209 - };
35210
35211 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Enabling hostapd mode\n", dev->name);
35212
35213 @@ -98,6 +97,8 @@ static int hostap_enable_hostapd(PSDevic
35214 *apdev_priv = *pDevice;
35215 memcpy(pDevice->apdev->dev_addr, dev->dev_addr, ETH_ALEN);
35216
35217 + /* only half broken now */
35218 + apdev_netdev_ops.ndo_start_xmit = pDevice->tx_80211;
35219 pDevice->apdev->netdev_ops = &apdev_netdev_ops;
35220
35221 pDevice->apdev->type = ARPHRD_IEEE80211;
35222 diff -urNp linux-3.0.8/drivers/staging/vt6656/hostap.c linux-3.0.8/drivers/staging/vt6656/hostap.c
35223 --- linux-3.0.8/drivers/staging/vt6656/hostap.c 2011-07-21 22:17:23.000000000 -0400
35224 +++ linux-3.0.8/drivers/staging/vt6656/hostap.c 2011-08-23 21:47:56.000000000 -0400
35225 @@ -80,14 +80,13 @@ static int msglevel
35226 *
35227 */
35228
35229 +static net_device_ops_no_const apdev_netdev_ops;
35230 +
35231 static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
35232 {
35233 PSDevice apdev_priv;
35234 struct net_device *dev = pDevice->dev;
35235 int ret;
35236 - const struct net_device_ops apdev_netdev_ops = {
35237 - .ndo_start_xmit = pDevice->tx_80211,
35238 - };
35239
35240 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Enabling hostapd mode\n", dev->name);
35241
35242 @@ -99,6 +98,8 @@ static int hostap_enable_hostapd(PSDevic
35243 *apdev_priv = *pDevice;
35244 memcpy(pDevice->apdev->dev_addr, dev->dev_addr, ETH_ALEN);
35245
35246 + /* only half broken now */
35247 + apdev_netdev_ops.ndo_start_xmit = pDevice->tx_80211;
35248 pDevice->apdev->netdev_ops = &apdev_netdev_ops;
35249
35250 pDevice->apdev->type = ARPHRD_IEEE80211;
35251 diff -urNp linux-3.0.8/drivers/staging/wlan-ng/hfa384x_usb.c linux-3.0.8/drivers/staging/wlan-ng/hfa384x_usb.c
35252 --- linux-3.0.8/drivers/staging/wlan-ng/hfa384x_usb.c 2011-07-21 22:17:23.000000000 -0400
35253 +++ linux-3.0.8/drivers/staging/wlan-ng/hfa384x_usb.c 2011-08-23 21:47:56.000000000 -0400
35254 @@ -204,7 +204,7 @@ static void unlocked_usbctlx_complete(hf
35255
35256 struct usbctlx_completor {
35257 int (*complete) (struct usbctlx_completor *);
35258 -};
35259 +} __no_const;
35260
35261 static int
35262 hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
35263 diff -urNp linux-3.0.8/drivers/staging/zcache/tmem.c linux-3.0.8/drivers/staging/zcache/tmem.c
35264 --- linux-3.0.8/drivers/staging/zcache/tmem.c 2011-07-21 22:17:23.000000000 -0400
35265 +++ linux-3.0.8/drivers/staging/zcache/tmem.c 2011-08-23 21:47:56.000000000 -0400
35266 @@ -39,7 +39,7 @@
35267 * A tmem host implementation must use this function to register callbacks
35268 * for memory allocation.
35269 */
35270 -static struct tmem_hostops tmem_hostops;
35271 +static tmem_hostops_no_const tmem_hostops;
35272
35273 static void tmem_objnode_tree_init(void);
35274
35275 @@ -53,7 +53,7 @@ void tmem_register_hostops(struct tmem_h
35276 * A tmem host implementation must use this function to register
35277 * callbacks for a page-accessible memory (PAM) implementation
35278 */
35279 -static struct tmem_pamops tmem_pamops;
35280 +static tmem_pamops_no_const tmem_pamops;
35281
35282 void tmem_register_pamops(struct tmem_pamops *m)
35283 {
35284 diff -urNp linux-3.0.8/drivers/staging/zcache/tmem.h linux-3.0.8/drivers/staging/zcache/tmem.h
35285 --- linux-3.0.8/drivers/staging/zcache/tmem.h 2011-07-21 22:17:23.000000000 -0400
35286 +++ linux-3.0.8/drivers/staging/zcache/tmem.h 2011-08-23 21:47:56.000000000 -0400
35287 @@ -171,6 +171,7 @@ struct tmem_pamops {
35288 int (*get_data)(struct page *, void *, struct tmem_pool *);
35289 void (*free)(void *, struct tmem_pool *);
35290 };
35291 +typedef struct tmem_pamops __no_const tmem_pamops_no_const;
35292 extern void tmem_register_pamops(struct tmem_pamops *m);
35293
35294 /* memory allocation methods provided by the host implementation */
35295 @@ -180,6 +181,7 @@ struct tmem_hostops {
35296 struct tmem_objnode *(*objnode_alloc)(struct tmem_pool *);
35297 void (*objnode_free)(struct tmem_objnode *, struct tmem_pool *);
35298 };
35299 +typedef struct tmem_hostops __no_const tmem_hostops_no_const;
35300 extern void tmem_register_hostops(struct tmem_hostops *m);
35301
35302 /* core tmem accessor functions */
35303 diff -urNp linux-3.0.8/drivers/target/target_core_alua.c linux-3.0.8/drivers/target/target_core_alua.c
35304 --- linux-3.0.8/drivers/target/target_core_alua.c 2011-07-21 22:17:23.000000000 -0400
35305 +++ linux-3.0.8/drivers/target/target_core_alua.c 2011-08-23 21:48:14.000000000 -0400
35306 @@ -675,6 +675,8 @@ static int core_alua_update_tpg_primary_
35307 char path[ALUA_METADATA_PATH_LEN];
35308 int len;
35309
35310 + pax_track_stack();
35311 +
35312 memset(path, 0, ALUA_METADATA_PATH_LEN);
35313
35314 len = snprintf(md_buf, tg_pt_gp->tg_pt_gp_md_buf_len,
35315 @@ -938,6 +940,8 @@ static int core_alua_update_tpg_secondar
35316 char path[ALUA_METADATA_PATH_LEN], wwn[ALUA_SECONDARY_METADATA_WWN_LEN];
35317 int len;
35318
35319 + pax_track_stack();
35320 +
35321 memset(path, 0, ALUA_METADATA_PATH_LEN);
35322 memset(wwn, 0, ALUA_SECONDARY_METADATA_WWN_LEN);
35323
35324 diff -urNp linux-3.0.8/drivers/target/target_core_cdb.c linux-3.0.8/drivers/target/target_core_cdb.c
35325 --- linux-3.0.8/drivers/target/target_core_cdb.c 2011-07-21 22:17:23.000000000 -0400
35326 +++ linux-3.0.8/drivers/target/target_core_cdb.c 2011-08-23 21:48:14.000000000 -0400
35327 @@ -838,6 +838,8 @@ target_emulate_modesense(struct se_cmd *
35328 int length = 0;
35329 unsigned char buf[SE_MODE_PAGE_BUF];
35330
35331 + pax_track_stack();
35332 +
35333 memset(buf, 0, SE_MODE_PAGE_BUF);
35334
35335 switch (cdb[2] & 0x3f) {
35336 diff -urNp linux-3.0.8/drivers/target/target_core_configfs.c linux-3.0.8/drivers/target/target_core_configfs.c
35337 --- linux-3.0.8/drivers/target/target_core_configfs.c 2011-07-21 22:17:23.000000000 -0400
35338 +++ linux-3.0.8/drivers/target/target_core_configfs.c 2011-08-23 21:48:14.000000000 -0400
35339 @@ -1276,6 +1276,8 @@ static ssize_t target_core_dev_pr_show_a
35340 ssize_t len = 0;
35341 int reg_count = 0, prf_isid;
35342
35343 + pax_track_stack();
35344 +
35345 if (!(su_dev->se_dev_ptr))
35346 return -ENODEV;
35347
35348 diff -urNp linux-3.0.8/drivers/target/target_core_pr.c linux-3.0.8/drivers/target/target_core_pr.c
35349 --- linux-3.0.8/drivers/target/target_core_pr.c 2011-07-21 22:17:23.000000000 -0400
35350 +++ linux-3.0.8/drivers/target/target_core_pr.c 2011-08-23 21:48:14.000000000 -0400
35351 @@ -918,6 +918,8 @@ static int __core_scsi3_check_aptpl_regi
35352 unsigned char t_port[PR_APTPL_MAX_TPORT_LEN];
35353 u16 tpgt;
35354
35355 + pax_track_stack();
35356 +
35357 memset(i_port, 0, PR_APTPL_MAX_IPORT_LEN);
35358 memset(t_port, 0, PR_APTPL_MAX_TPORT_LEN);
35359 /*
35360 @@ -1861,6 +1863,8 @@ static int __core_scsi3_update_aptpl_buf
35361 ssize_t len = 0;
35362 int reg_count = 0;
35363
35364 + pax_track_stack();
35365 +
35366 memset(buf, 0, pr_aptpl_buf_len);
35367 /*
35368 * Called to clear metadata once APTPL has been deactivated.
35369 @@ -1983,6 +1987,8 @@ static int __core_scsi3_write_aptpl_to_f
35370 char path[512];
35371 int ret;
35372
35373 + pax_track_stack();
35374 +
35375 memset(iov, 0, sizeof(struct iovec));
35376 memset(path, 0, 512);
35377
35378 diff -urNp linux-3.0.8/drivers/target/target_core_tmr.c linux-3.0.8/drivers/target/target_core_tmr.c
35379 --- linux-3.0.8/drivers/target/target_core_tmr.c 2011-07-21 22:17:23.000000000 -0400
35380 +++ linux-3.0.8/drivers/target/target_core_tmr.c 2011-08-23 21:47:56.000000000 -0400
35381 @@ -269,7 +269,7 @@ int core_tmr_lun_reset(
35382 CMD_TFO(cmd)->get_task_tag(cmd), cmd->pr_res_key,
35383 T_TASK(cmd)->t_task_cdbs,
35384 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
35385 - atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
35386 + atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
35387 atomic_read(&T_TASK(cmd)->t_transport_active),
35388 atomic_read(&T_TASK(cmd)->t_transport_stop),
35389 atomic_read(&T_TASK(cmd)->t_transport_sent));
35390 @@ -311,7 +311,7 @@ int core_tmr_lun_reset(
35391 DEBUG_LR("LUN_RESET: got t_transport_active = 1 for"
35392 " task: %p, t_fe_count: %d dev: %p\n", task,
35393 fe_count, dev);
35394 - atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
35395 + atomic_set_unchecked(&T_TASK(cmd)->t_transport_aborted, 1);
35396 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock,
35397 flags);
35398 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
35399 @@ -321,7 +321,7 @@ int core_tmr_lun_reset(
35400 }
35401 DEBUG_LR("LUN_RESET: Got t_transport_active = 0 for task: %p,"
35402 " t_fe_count: %d dev: %p\n", task, fe_count, dev);
35403 - atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
35404 + atomic_set_unchecked(&T_TASK(cmd)->t_transport_aborted, 1);
35405 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
35406 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
35407
35408 diff -urNp linux-3.0.8/drivers/target/target_core_transport.c linux-3.0.8/drivers/target/target_core_transport.c
35409 --- linux-3.0.8/drivers/target/target_core_transport.c 2011-07-21 22:17:23.000000000 -0400
35410 +++ linux-3.0.8/drivers/target/target_core_transport.c 2011-08-23 21:47:56.000000000 -0400
35411 @@ -1681,7 +1681,7 @@ struct se_device *transport_add_device_t
35412
35413 dev->queue_depth = dev_limits->queue_depth;
35414 atomic_set(&dev->depth_left, dev->queue_depth);
35415 - atomic_set(&dev->dev_ordered_id, 0);
35416 + atomic_set_unchecked(&dev->dev_ordered_id, 0);
35417
35418 se_dev_set_default_attribs(dev, dev_limits);
35419
35420 @@ -1882,7 +1882,7 @@ static int transport_check_alloc_task_at
35421 * Used to determine when ORDERED commands should go from
35422 * Dormant to Active status.
35423 */
35424 - cmd->se_ordered_id = atomic_inc_return(&SE_DEV(cmd)->dev_ordered_id);
35425 + cmd->se_ordered_id = atomic_inc_return_unchecked(&SE_DEV(cmd)->dev_ordered_id);
35426 smp_mb__after_atomic_inc();
35427 DEBUG_STA("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
35428 cmd->se_ordered_id, cmd->sam_task_attr,
35429 @@ -2169,7 +2169,7 @@ static void transport_generic_request_fa
35430 " t_transport_active: %d t_transport_stop: %d"
35431 " t_transport_sent: %d\n", T_TASK(cmd)->t_task_cdbs,
35432 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
35433 - atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
35434 + atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
35435 atomic_read(&T_TASK(cmd)->t_task_cdbs_ex_left),
35436 atomic_read(&T_TASK(cmd)->t_transport_active),
35437 atomic_read(&T_TASK(cmd)->t_transport_stop),
35438 @@ -2673,9 +2673,9 @@ check_depth:
35439 spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
35440 atomic_set(&task->task_active, 1);
35441 atomic_set(&task->task_sent, 1);
35442 - atomic_inc(&T_TASK(cmd)->t_task_cdbs_sent);
35443 + atomic_inc_unchecked(&T_TASK(cmd)->t_task_cdbs_sent);
35444
35445 - if (atomic_read(&T_TASK(cmd)->t_task_cdbs_sent) ==
35446 + if (atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent) ==
35447 T_TASK(cmd)->t_task_cdbs)
35448 atomic_set(&cmd->transport_sent, 1);
35449
35450 @@ -5568,7 +5568,7 @@ static void transport_generic_wait_for_t
35451 atomic_set(&T_TASK(cmd)->transport_lun_stop, 0);
35452 }
35453 if (!atomic_read(&T_TASK(cmd)->t_transport_active) ||
35454 - atomic_read(&T_TASK(cmd)->t_transport_aborted))
35455 + atomic_read_unchecked(&T_TASK(cmd)->t_transport_aborted))
35456 goto remove;
35457
35458 atomic_set(&T_TASK(cmd)->t_transport_stop, 1);
35459 @@ -5797,7 +5797,7 @@ int transport_check_aborted_status(struc
35460 {
35461 int ret = 0;
35462
35463 - if (atomic_read(&T_TASK(cmd)->t_transport_aborted) != 0) {
35464 + if (atomic_read_unchecked(&T_TASK(cmd)->t_transport_aborted) != 0) {
35465 if (!(send_status) ||
35466 (cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS))
35467 return 1;
35468 @@ -5825,7 +5825,7 @@ void transport_send_task_abort(struct se
35469 */
35470 if (cmd->data_direction == DMA_TO_DEVICE) {
35471 if (CMD_TFO(cmd)->write_pending_status(cmd) != 0) {
35472 - atomic_inc(&T_TASK(cmd)->t_transport_aborted);
35473 + atomic_inc_unchecked(&T_TASK(cmd)->t_transport_aborted);
35474 smp_mb__after_atomic_inc();
35475 cmd->scsi_status = SAM_STAT_TASK_ABORTED;
35476 transport_new_cmd_failure(cmd);
35477 @@ -5949,7 +5949,7 @@ static void transport_processing_shutdow
35478 CMD_TFO(cmd)->get_task_tag(cmd),
35479 T_TASK(cmd)->t_task_cdbs,
35480 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
35481 - atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
35482 + atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
35483 atomic_read(&T_TASK(cmd)->t_transport_active),
35484 atomic_read(&T_TASK(cmd)->t_transport_stop),
35485 atomic_read(&T_TASK(cmd)->t_transport_sent));
35486 diff -urNp linux-3.0.8/drivers/telephony/ixj.c linux-3.0.8/drivers/telephony/ixj.c
35487 --- linux-3.0.8/drivers/telephony/ixj.c 2011-07-21 22:17:23.000000000 -0400
35488 +++ linux-3.0.8/drivers/telephony/ixj.c 2011-08-23 21:48:14.000000000 -0400
35489 @@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
35490 bool mContinue;
35491 char *pIn, *pOut;
35492
35493 + pax_track_stack();
35494 +
35495 if (!SCI_Prepare(j))
35496 return 0;
35497
35498 diff -urNp linux-3.0.8/drivers/tty/hvc/hvcs.c linux-3.0.8/drivers/tty/hvc/hvcs.c
35499 --- linux-3.0.8/drivers/tty/hvc/hvcs.c 2011-07-21 22:17:23.000000000 -0400
35500 +++ linux-3.0.8/drivers/tty/hvc/hvcs.c 2011-08-23 21:47:56.000000000 -0400
35501 @@ -83,6 +83,7 @@
35502 #include <asm/hvcserver.h>
35503 #include <asm/uaccess.h>
35504 #include <asm/vio.h>
35505 +#include <asm/local.h>
35506
35507 /*
35508 * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
35509 @@ -270,7 +271,7 @@ struct hvcs_struct {
35510 unsigned int index;
35511
35512 struct tty_struct *tty;
35513 - int open_count;
35514 + local_t open_count;
35515
35516 /*
35517 * Used to tell the driver kernel_thread what operations need to take
35518 @@ -422,7 +423,7 @@ static ssize_t hvcs_vterm_state_store(st
35519
35520 spin_lock_irqsave(&hvcsd->lock, flags);
35521
35522 - if (hvcsd->open_count > 0) {
35523 + if (local_read(&hvcsd->open_count) > 0) {
35524 spin_unlock_irqrestore(&hvcsd->lock, flags);
35525 printk(KERN_INFO "HVCS: vterm state unchanged. "
35526 "The hvcs device node is still in use.\n");
35527 @@ -1145,7 +1146,7 @@ static int hvcs_open(struct tty_struct *
35528 if ((retval = hvcs_partner_connect(hvcsd)))
35529 goto error_release;
35530
35531 - hvcsd->open_count = 1;
35532 + local_set(&hvcsd->open_count, 1);
35533 hvcsd->tty = tty;
35534 tty->driver_data = hvcsd;
35535
35536 @@ -1179,7 +1180,7 @@ fast_open:
35537
35538 spin_lock_irqsave(&hvcsd->lock, flags);
35539 kref_get(&hvcsd->kref);
35540 - hvcsd->open_count++;
35541 + local_inc(&hvcsd->open_count);
35542 hvcsd->todo_mask |= HVCS_SCHED_READ;
35543 spin_unlock_irqrestore(&hvcsd->lock, flags);
35544
35545 @@ -1223,7 +1224,7 @@ static void hvcs_close(struct tty_struct
35546 hvcsd = tty->driver_data;
35547
35548 spin_lock_irqsave(&hvcsd->lock, flags);
35549 - if (--hvcsd->open_count == 0) {
35550 + if (local_dec_and_test(&hvcsd->open_count)) {
35551
35552 vio_disable_interrupts(hvcsd->vdev);
35553
35554 @@ -1249,10 +1250,10 @@ static void hvcs_close(struct tty_struct
35555 free_irq(irq, hvcsd);
35556 kref_put(&hvcsd->kref, destroy_hvcs_struct);
35557 return;
35558 - } else if (hvcsd->open_count < 0) {
35559 + } else if (local_read(&hvcsd->open_count) < 0) {
35560 printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
35561 " is missmanaged.\n",
35562 - hvcsd->vdev->unit_address, hvcsd->open_count);
35563 + hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
35564 }
35565
35566 spin_unlock_irqrestore(&hvcsd->lock, flags);
35567 @@ -1268,7 +1269,7 @@ static void hvcs_hangup(struct tty_struc
35568
35569 spin_lock_irqsave(&hvcsd->lock, flags);
35570 /* Preserve this so that we know how many kref refs to put */
35571 - temp_open_count = hvcsd->open_count;
35572 + temp_open_count = local_read(&hvcsd->open_count);
35573
35574 /*
35575 * Don't kref put inside the spinlock because the destruction
35576 @@ -1283,7 +1284,7 @@ static void hvcs_hangup(struct tty_struc
35577 hvcsd->tty->driver_data = NULL;
35578 hvcsd->tty = NULL;
35579
35580 - hvcsd->open_count = 0;
35581 + local_set(&hvcsd->open_count, 0);
35582
35583 /* This will drop any buffered data on the floor which is OK in a hangup
35584 * scenario. */
35585 @@ -1354,7 +1355,7 @@ static int hvcs_write(struct tty_struct
35586 * the middle of a write operation? This is a crummy place to do this
35587 * but we want to keep it all in the spinlock.
35588 */
35589 - if (hvcsd->open_count <= 0) {
35590 + if (local_read(&hvcsd->open_count) <= 0) {
35591 spin_unlock_irqrestore(&hvcsd->lock, flags);
35592 return -ENODEV;
35593 }
35594 @@ -1428,7 +1429,7 @@ static int hvcs_write_room(struct tty_st
35595 {
35596 struct hvcs_struct *hvcsd = tty->driver_data;
35597
35598 - if (!hvcsd || hvcsd->open_count <= 0)
35599 + if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
35600 return 0;
35601
35602 return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
35603 diff -urNp linux-3.0.8/drivers/tty/ipwireless/tty.c linux-3.0.8/drivers/tty/ipwireless/tty.c
35604 --- linux-3.0.8/drivers/tty/ipwireless/tty.c 2011-07-21 22:17:23.000000000 -0400
35605 +++ linux-3.0.8/drivers/tty/ipwireless/tty.c 2011-08-23 21:47:56.000000000 -0400
35606 @@ -29,6 +29,7 @@
35607 #include <linux/tty_driver.h>
35608 #include <linux/tty_flip.h>
35609 #include <linux/uaccess.h>
35610 +#include <asm/local.h>
35611
35612 #include "tty.h"
35613 #include "network.h"
35614 @@ -51,7 +52,7 @@ struct ipw_tty {
35615 int tty_type;
35616 struct ipw_network *network;
35617 struct tty_struct *linux_tty;
35618 - int open_count;
35619 + local_t open_count;
35620 unsigned int control_lines;
35621 struct mutex ipw_tty_mutex;
35622 int tx_bytes_queued;
35623 @@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *l
35624 mutex_unlock(&tty->ipw_tty_mutex);
35625 return -ENODEV;
35626 }
35627 - if (tty->open_count == 0)
35628 + if (local_read(&tty->open_count) == 0)
35629 tty->tx_bytes_queued = 0;
35630
35631 - tty->open_count++;
35632 + local_inc(&tty->open_count);
35633
35634 tty->linux_tty = linux_tty;
35635 linux_tty->driver_data = tty;
35636 @@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *l
35637
35638 static void do_ipw_close(struct ipw_tty *tty)
35639 {
35640 - tty->open_count--;
35641 -
35642 - if (tty->open_count == 0) {
35643 + if (local_dec_return(&tty->open_count) == 0) {
35644 struct tty_struct *linux_tty = tty->linux_tty;
35645
35646 if (linux_tty != NULL) {
35647 @@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct
35648 return;
35649
35650 mutex_lock(&tty->ipw_tty_mutex);
35651 - if (tty->open_count == 0) {
35652 + if (local_read(&tty->open_count) == 0) {
35653 mutex_unlock(&tty->ipw_tty_mutex);
35654 return;
35655 }
35656 @@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_
35657 return;
35658 }
35659
35660 - if (!tty->open_count) {
35661 + if (!local_read(&tty->open_count)) {
35662 mutex_unlock(&tty->ipw_tty_mutex);
35663 return;
35664 }
35665 @@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *
35666 return -ENODEV;
35667
35668 mutex_lock(&tty->ipw_tty_mutex);
35669 - if (!tty->open_count) {
35670 + if (!local_read(&tty->open_count)) {
35671 mutex_unlock(&tty->ipw_tty_mutex);
35672 return -EINVAL;
35673 }
35674 @@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_str
35675 if (!tty)
35676 return -ENODEV;
35677
35678 - if (!tty->open_count)
35679 + if (!local_read(&tty->open_count))
35680 return -EINVAL;
35681
35682 room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
35683 @@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tt
35684 if (!tty)
35685 return 0;
35686
35687 - if (!tty->open_count)
35688 + if (!local_read(&tty->open_count))
35689 return 0;
35690
35691 return tty->tx_bytes_queued;
35692 @@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struc
35693 if (!tty)
35694 return -ENODEV;
35695
35696 - if (!tty->open_count)
35697 + if (!local_read(&tty->open_count))
35698 return -EINVAL;
35699
35700 return get_control_lines(tty);
35701 @@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
35702 if (!tty)
35703 return -ENODEV;
35704
35705 - if (!tty->open_count)
35706 + if (!local_read(&tty->open_count))
35707 return -EINVAL;
35708
35709 return set_control_lines(tty, set, clear);
35710 @@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *
35711 if (!tty)
35712 return -ENODEV;
35713
35714 - if (!tty->open_count)
35715 + if (!local_read(&tty->open_count))
35716 return -EINVAL;
35717
35718 /* FIXME: Exactly how is the tty object locked here .. */
35719 @@ -582,7 +581,7 @@ void ipwireless_tty_free(struct ipw_tty
35720 against a parallel ioctl etc */
35721 mutex_lock(&ttyj->ipw_tty_mutex);
35722 }
35723 - while (ttyj->open_count)
35724 + while (local_read(&ttyj->open_count))
35725 do_ipw_close(ttyj);
35726 ipwireless_disassociate_network_ttys(network,
35727 ttyj->channel_idx);
35728 diff -urNp linux-3.0.8/drivers/tty/n_gsm.c linux-3.0.8/drivers/tty/n_gsm.c
35729 --- linux-3.0.8/drivers/tty/n_gsm.c 2011-10-24 08:05:21.000000000 -0400
35730 +++ linux-3.0.8/drivers/tty/n_gsm.c 2011-08-23 21:47:56.000000000 -0400
35731 @@ -1589,7 +1589,7 @@ static struct gsm_dlci *gsm_dlci_alloc(s
35732 return NULL;
35733 spin_lock_init(&dlci->lock);
35734 dlci->fifo = &dlci->_fifo;
35735 - if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL) < 0) {
35736 + if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL)) {
35737 kfree(dlci);
35738 return NULL;
35739 }
35740 diff -urNp linux-3.0.8/drivers/tty/n_tty.c linux-3.0.8/drivers/tty/n_tty.c
35741 --- linux-3.0.8/drivers/tty/n_tty.c 2011-07-21 22:17:23.000000000 -0400
35742 +++ linux-3.0.8/drivers/tty/n_tty.c 2011-08-23 21:47:56.000000000 -0400
35743 @@ -2123,6 +2123,7 @@ void n_tty_inherit_ops(struct tty_ldisc_
35744 {
35745 *ops = tty_ldisc_N_TTY;
35746 ops->owner = NULL;
35747 - ops->refcount = ops->flags = 0;
35748 + atomic_set(&ops->refcount, 0);
35749 + ops->flags = 0;
35750 }
35751 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
35752 diff -urNp linux-3.0.8/drivers/tty/pty.c linux-3.0.8/drivers/tty/pty.c
35753 --- linux-3.0.8/drivers/tty/pty.c 2011-10-24 08:05:30.000000000 -0400
35754 +++ linux-3.0.8/drivers/tty/pty.c 2011-10-16 21:55:28.000000000 -0400
35755 @@ -767,8 +767,10 @@ static void __init unix98_pty_init(void)
35756 register_sysctl_table(pty_root_table);
35757
35758 /* Now create the /dev/ptmx special device */
35759 + pax_open_kernel();
35760 tty_default_fops(&ptmx_fops);
35761 - ptmx_fops.open = ptmx_open;
35762 + *(void **)&ptmx_fops.open = ptmx_open;
35763 + pax_close_kernel();
35764
35765 cdev_init(&ptmx_cdev, &ptmx_fops);
35766 if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
35767 diff -urNp linux-3.0.8/drivers/tty/rocket.c linux-3.0.8/drivers/tty/rocket.c
35768 --- linux-3.0.8/drivers/tty/rocket.c 2011-07-21 22:17:23.000000000 -0400
35769 +++ linux-3.0.8/drivers/tty/rocket.c 2011-08-23 21:48:14.000000000 -0400
35770 @@ -1277,6 +1277,8 @@ static int get_ports(struct r_port *info
35771 struct rocket_ports tmp;
35772 int board;
35773
35774 + pax_track_stack();
35775 +
35776 if (!retports)
35777 return -EFAULT;
35778 memset(&tmp, 0, sizeof (tmp));
35779 diff -urNp linux-3.0.8/drivers/tty/serial/kgdboc.c linux-3.0.8/drivers/tty/serial/kgdboc.c
35780 --- linux-3.0.8/drivers/tty/serial/kgdboc.c 2011-07-21 22:17:23.000000000 -0400
35781 +++ linux-3.0.8/drivers/tty/serial/kgdboc.c 2011-08-23 21:47:56.000000000 -0400
35782 @@ -23,8 +23,9 @@
35783 #define MAX_CONFIG_LEN 40
35784
35785 static struct kgdb_io kgdboc_io_ops;
35786 +static struct kgdb_io kgdboc_io_ops_console;
35787
35788 -/* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
35789 +/* -1 = init not run yet, 0 = unconfigured, 1/2 = configured. */
35790 static int configured = -1;
35791
35792 static char config[MAX_CONFIG_LEN];
35793 @@ -147,6 +148,8 @@ static void cleanup_kgdboc(void)
35794 kgdboc_unregister_kbd();
35795 if (configured == 1)
35796 kgdb_unregister_io_module(&kgdboc_io_ops);
35797 + else if (configured == 2)
35798 + kgdb_unregister_io_module(&kgdboc_io_ops_console);
35799 }
35800
35801 static int configure_kgdboc(void)
35802 @@ -156,13 +159,13 @@ static int configure_kgdboc(void)
35803 int err;
35804 char *cptr = config;
35805 struct console *cons;
35806 + int is_console = 0;
35807
35808 err = kgdboc_option_setup(config);
35809 if (err || !strlen(config) || isspace(config[0]))
35810 goto noconfig;
35811
35812 err = -ENODEV;
35813 - kgdboc_io_ops.is_console = 0;
35814 kgdb_tty_driver = NULL;
35815
35816 kgdboc_use_kms = 0;
35817 @@ -183,7 +186,7 @@ static int configure_kgdboc(void)
35818 int idx;
35819 if (cons->device && cons->device(cons, &idx) == p &&
35820 idx == tty_line) {
35821 - kgdboc_io_ops.is_console = 1;
35822 + is_console = 1;
35823 break;
35824 }
35825 cons = cons->next;
35826 @@ -193,12 +196,16 @@ static int configure_kgdboc(void)
35827 kgdb_tty_line = tty_line;
35828
35829 do_register:
35830 - err = kgdb_register_io_module(&kgdboc_io_ops);
35831 + if (is_console) {
35832 + err = kgdb_register_io_module(&kgdboc_io_ops_console);
35833 + configured = 2;
35834 + } else {
35835 + err = kgdb_register_io_module(&kgdboc_io_ops);
35836 + configured = 1;
35837 + }
35838 if (err)
35839 goto noconfig;
35840
35841 - configured = 1;
35842 -
35843 return 0;
35844
35845 noconfig:
35846 @@ -212,7 +219,7 @@ noconfig:
35847 static int __init init_kgdboc(void)
35848 {
35849 /* Already configured? */
35850 - if (configured == 1)
35851 + if (configured >= 1)
35852 return 0;
35853
35854 return configure_kgdboc();
35855 @@ -261,7 +268,7 @@ static int param_set_kgdboc_var(const ch
35856 if (config[len - 1] == '\n')
35857 config[len - 1] = '\0';
35858
35859 - if (configured == 1)
35860 + if (configured >= 1)
35861 cleanup_kgdboc();
35862
35863 /* Go and configure with the new params. */
35864 @@ -301,6 +308,15 @@ static struct kgdb_io kgdboc_io_ops = {
35865 .post_exception = kgdboc_post_exp_handler,
35866 };
35867
35868 +static struct kgdb_io kgdboc_io_ops_console = {
35869 + .name = "kgdboc",
35870 + .read_char = kgdboc_get_char,
35871 + .write_char = kgdboc_put_char,
35872 + .pre_exception = kgdboc_pre_exp_handler,
35873 + .post_exception = kgdboc_post_exp_handler,
35874 + .is_console = 1
35875 +};
35876 +
35877 #ifdef CONFIG_KGDB_SERIAL_CONSOLE
35878 /* This is only available if kgdboc is a built in for early debugging */
35879 static int __init kgdboc_early_init(char *opt)
35880 diff -urNp linux-3.0.8/drivers/tty/serial/mfd.c linux-3.0.8/drivers/tty/serial/mfd.c
35881 --- linux-3.0.8/drivers/tty/serial/mfd.c 2011-07-21 22:17:23.000000000 -0400
35882 +++ linux-3.0.8/drivers/tty/serial/mfd.c 2011-10-11 10:44:33.000000000 -0400
35883 @@ -1423,7 +1423,7 @@ static void serial_hsu_remove(struct pci
35884 }
35885
35886 /* First 3 are UART ports, and the 4th is the DMA */
35887 -static const struct pci_device_id pci_ids[] __devinitdata = {
35888 +static const struct pci_device_id pci_ids[] __devinitconst = {
35889 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081B) },
35890 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081C) },
35891 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081D) },
35892 diff -urNp linux-3.0.8/drivers/tty/serial/mrst_max3110.c linux-3.0.8/drivers/tty/serial/mrst_max3110.c
35893 --- linux-3.0.8/drivers/tty/serial/mrst_max3110.c 2011-10-24 08:05:30.000000000 -0400
35894 +++ linux-3.0.8/drivers/tty/serial/mrst_max3110.c 2011-10-16 21:55:28.000000000 -0400
35895 @@ -393,6 +393,8 @@ static void max3110_con_receive(struct u
35896 int loop = 1, num, total = 0;
35897 u8 recv_buf[512], *pbuf;
35898
35899 + pax_track_stack();
35900 +
35901 pbuf = recv_buf;
35902 do {
35903 num = max3110_read_multi(max, pbuf);
35904 diff -urNp linux-3.0.8/drivers/tty/tty_io.c linux-3.0.8/drivers/tty/tty_io.c
35905 --- linux-3.0.8/drivers/tty/tty_io.c 2011-10-24 08:05:30.000000000 -0400
35906 +++ linux-3.0.8/drivers/tty/tty_io.c 2011-10-16 21:55:28.000000000 -0400
35907 @@ -3214,7 +3214,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
35908
35909 void tty_default_fops(struct file_operations *fops)
35910 {
35911 - *fops = tty_fops;
35912 + memcpy((void *)fops, &tty_fops, sizeof(tty_fops));
35913 }
35914
35915 /*
35916 diff -urNp linux-3.0.8/drivers/tty/tty_ldisc.c linux-3.0.8/drivers/tty/tty_ldisc.c
35917 --- linux-3.0.8/drivers/tty/tty_ldisc.c 2011-07-21 22:17:23.000000000 -0400
35918 +++ linux-3.0.8/drivers/tty/tty_ldisc.c 2011-08-23 21:47:56.000000000 -0400
35919 @@ -74,7 +74,7 @@ static void put_ldisc(struct tty_ldisc *
35920 if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
35921 struct tty_ldisc_ops *ldo = ld->ops;
35922
35923 - ldo->refcount--;
35924 + atomic_dec(&ldo->refcount);
35925 module_put(ldo->owner);
35926 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
35927
35928 @@ -109,7 +109,7 @@ int tty_register_ldisc(int disc, struct
35929 spin_lock_irqsave(&tty_ldisc_lock, flags);
35930 tty_ldiscs[disc] = new_ldisc;
35931 new_ldisc->num = disc;
35932 - new_ldisc->refcount = 0;
35933 + atomic_set(&new_ldisc->refcount, 0);
35934 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
35935
35936 return ret;
35937 @@ -137,7 +137,7 @@ int tty_unregister_ldisc(int disc)
35938 return -EINVAL;
35939
35940 spin_lock_irqsave(&tty_ldisc_lock, flags);
35941 - if (tty_ldiscs[disc]->refcount)
35942 + if (atomic_read(&tty_ldiscs[disc]->refcount))
35943 ret = -EBUSY;
35944 else
35945 tty_ldiscs[disc] = NULL;
35946 @@ -158,7 +158,7 @@ static struct tty_ldisc_ops *get_ldops(i
35947 if (ldops) {
35948 ret = ERR_PTR(-EAGAIN);
35949 if (try_module_get(ldops->owner)) {
35950 - ldops->refcount++;
35951 + atomic_inc(&ldops->refcount);
35952 ret = ldops;
35953 }
35954 }
35955 @@ -171,7 +171,7 @@ static void put_ldops(struct tty_ldisc_o
35956 unsigned long flags;
35957
35958 spin_lock_irqsave(&tty_ldisc_lock, flags);
35959 - ldops->refcount--;
35960 + atomic_dec(&ldops->refcount);
35961 module_put(ldops->owner);
35962 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
35963 }
35964 diff -urNp linux-3.0.8/drivers/tty/vt/keyboard.c linux-3.0.8/drivers/tty/vt/keyboard.c
35965 --- linux-3.0.8/drivers/tty/vt/keyboard.c 2011-07-21 22:17:23.000000000 -0400
35966 +++ linux-3.0.8/drivers/tty/vt/keyboard.c 2011-08-23 21:48:14.000000000 -0400
35967 @@ -656,6 +656,16 @@ static void k_spec(struct vc_data *vc, u
35968 kbd->kbdmode == VC_OFF) &&
35969 value != KVAL(K_SAK))
35970 return; /* SAK is allowed even in raw mode */
35971 +
35972 +#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
35973 + {
35974 + void *func = fn_handler[value];
35975 + if (func == fn_show_state || func == fn_show_ptregs ||
35976 + func == fn_show_mem)
35977 + return;
35978 + }
35979 +#endif
35980 +
35981 fn_handler[value](vc);
35982 }
35983
35984 diff -urNp linux-3.0.8/drivers/tty/vt/vt.c linux-3.0.8/drivers/tty/vt/vt.c
35985 --- linux-3.0.8/drivers/tty/vt/vt.c 2011-07-21 22:17:23.000000000 -0400
35986 +++ linux-3.0.8/drivers/tty/vt/vt.c 2011-08-23 21:47:56.000000000 -0400
35987 @@ -259,7 +259,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier
35988
35989 static void notify_write(struct vc_data *vc, unsigned int unicode)
35990 {
35991 - struct vt_notifier_param param = { .vc = vc, unicode = unicode };
35992 + struct vt_notifier_param param = { .vc = vc, .c = unicode };
35993 atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, &param);
35994 }
35995
35996 diff -urNp linux-3.0.8/drivers/tty/vt/vt_ioctl.c linux-3.0.8/drivers/tty/vt/vt_ioctl.c
35997 --- linux-3.0.8/drivers/tty/vt/vt_ioctl.c 2011-07-21 22:17:23.000000000 -0400
35998 +++ linux-3.0.8/drivers/tty/vt/vt_ioctl.c 2011-08-23 21:48:14.000000000 -0400
35999 @@ -207,9 +207,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __
36000 if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
36001 return -EFAULT;
36002
36003 - if (!capable(CAP_SYS_TTY_CONFIG))
36004 - perm = 0;
36005 -
36006 switch (cmd) {
36007 case KDGKBENT:
36008 key_map = key_maps[s];
36009 @@ -221,6 +218,9 @@ do_kdsk_ioctl(int cmd, struct kbentry __
36010 val = (i ? K_HOLE : K_NOSUCHMAP);
36011 return put_user(val, &user_kbe->kb_value);
36012 case KDSKBENT:
36013 + if (!capable(CAP_SYS_TTY_CONFIG))
36014 + perm = 0;
36015 +
36016 if (!perm)
36017 return -EPERM;
36018 if (!i && v == K_NOSUCHMAP) {
36019 @@ -322,9 +322,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
36020 int i, j, k;
36021 int ret;
36022
36023 - if (!capable(CAP_SYS_TTY_CONFIG))
36024 - perm = 0;
36025 -
36026 kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
36027 if (!kbs) {
36028 ret = -ENOMEM;
36029 @@ -358,6 +355,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
36030 kfree(kbs);
36031 return ((p && *p) ? -EOVERFLOW : 0);
36032 case KDSKBSENT:
36033 + if (!capable(CAP_SYS_TTY_CONFIG))
36034 + perm = 0;
36035 +
36036 if (!perm) {
36037 ret = -EPERM;
36038 goto reterr;
36039 diff -urNp linux-3.0.8/drivers/uio/uio.c linux-3.0.8/drivers/uio/uio.c
36040 --- linux-3.0.8/drivers/uio/uio.c 2011-07-21 22:17:23.000000000 -0400
36041 +++ linux-3.0.8/drivers/uio/uio.c 2011-08-23 21:47:56.000000000 -0400
36042 @@ -25,6 +25,7 @@
36043 #include <linux/kobject.h>
36044 #include <linux/cdev.h>
36045 #include <linux/uio_driver.h>
36046 +#include <asm/local.h>
36047
36048 #define UIO_MAX_DEVICES (1U << MINORBITS)
36049
36050 @@ -32,10 +33,10 @@ struct uio_device {
36051 struct module *owner;
36052 struct device *dev;
36053 int minor;
36054 - atomic_t event;
36055 + atomic_unchecked_t event;
36056 struct fasync_struct *async_queue;
36057 wait_queue_head_t wait;
36058 - int vma_count;
36059 + local_t vma_count;
36060 struct uio_info *info;
36061 struct kobject *map_dir;
36062 struct kobject *portio_dir;
36063 @@ -242,7 +243,7 @@ static ssize_t show_event(struct device
36064 struct device_attribute *attr, char *buf)
36065 {
36066 struct uio_device *idev = dev_get_drvdata(dev);
36067 - return sprintf(buf, "%u\n", (unsigned int)atomic_read(&idev->event));
36068 + return sprintf(buf, "%u\n", (unsigned int)atomic_read_unchecked(&idev->event));
36069 }
36070
36071 static struct device_attribute uio_class_attributes[] = {
36072 @@ -408,7 +409,7 @@ void uio_event_notify(struct uio_info *i
36073 {
36074 struct uio_device *idev = info->uio_dev;
36075
36076 - atomic_inc(&idev->event);
36077 + atomic_inc_unchecked(&idev->event);
36078 wake_up_interruptible(&idev->wait);
36079 kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
36080 }
36081 @@ -461,7 +462,7 @@ static int uio_open(struct inode *inode,
36082 }
36083
36084 listener->dev = idev;
36085 - listener->event_count = atomic_read(&idev->event);
36086 + listener->event_count = atomic_read_unchecked(&idev->event);
36087 filep->private_data = listener;
36088
36089 if (idev->info->open) {
36090 @@ -512,7 +513,7 @@ static unsigned int uio_poll(struct file
36091 return -EIO;
36092
36093 poll_wait(filep, &idev->wait, wait);
36094 - if (listener->event_count != atomic_read(&idev->event))
36095 + if (listener->event_count != atomic_read_unchecked(&idev->event))
36096 return POLLIN | POLLRDNORM;
36097 return 0;
36098 }
36099 @@ -537,7 +538,7 @@ static ssize_t uio_read(struct file *fil
36100 do {
36101 set_current_state(TASK_INTERRUPTIBLE);
36102
36103 - event_count = atomic_read(&idev->event);
36104 + event_count = atomic_read_unchecked(&idev->event);
36105 if (event_count != listener->event_count) {
36106 if (copy_to_user(buf, &event_count, count))
36107 retval = -EFAULT;
36108 @@ -606,13 +607,13 @@ static int uio_find_mem_index(struct vm_
36109 static void uio_vma_open(struct vm_area_struct *vma)
36110 {
36111 struct uio_device *idev = vma->vm_private_data;
36112 - idev->vma_count++;
36113 + local_inc(&idev->vma_count);
36114 }
36115
36116 static void uio_vma_close(struct vm_area_struct *vma)
36117 {
36118 struct uio_device *idev = vma->vm_private_data;
36119 - idev->vma_count--;
36120 + local_dec(&idev->vma_count);
36121 }
36122
36123 static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
36124 @@ -823,7 +824,7 @@ int __uio_register_device(struct module
36125 idev->owner = owner;
36126 idev->info = info;
36127 init_waitqueue_head(&idev->wait);
36128 - atomic_set(&idev->event, 0);
36129 + atomic_set_unchecked(&idev->event, 0);
36130
36131 ret = uio_get_minor(idev);
36132 if (ret)
36133 diff -urNp linux-3.0.8/drivers/usb/atm/cxacru.c linux-3.0.8/drivers/usb/atm/cxacru.c
36134 --- linux-3.0.8/drivers/usb/atm/cxacru.c 2011-07-21 22:17:23.000000000 -0400
36135 +++ linux-3.0.8/drivers/usb/atm/cxacru.c 2011-08-23 21:47:56.000000000 -0400
36136 @@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_c
36137 ret = sscanf(buf + pos, "%x=%x%n", &index, &value, &tmp);
36138 if (ret < 2)
36139 return -EINVAL;
36140 - if (index < 0 || index > 0x7f)
36141 + if (index > 0x7f)
36142 return -EINVAL;
36143 pos += tmp;
36144
36145 diff -urNp linux-3.0.8/drivers/usb/atm/usbatm.c linux-3.0.8/drivers/usb/atm/usbatm.c
36146 --- linux-3.0.8/drivers/usb/atm/usbatm.c 2011-07-21 22:17:23.000000000 -0400
36147 +++ linux-3.0.8/drivers/usb/atm/usbatm.c 2011-08-23 21:47:56.000000000 -0400
36148 @@ -332,7 +332,7 @@ static void usbatm_extract_one_cell(stru
36149 if (printk_ratelimit())
36150 atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
36151 __func__, vpi, vci);
36152 - atomic_inc(&vcc->stats->rx_err);
36153 + atomic_inc_unchecked(&vcc->stats->rx_err);
36154 return;
36155 }
36156
36157 @@ -360,7 +360,7 @@ static void usbatm_extract_one_cell(stru
36158 if (length > ATM_MAX_AAL5_PDU) {
36159 atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
36160 __func__, length, vcc);
36161 - atomic_inc(&vcc->stats->rx_err);
36162 + atomic_inc_unchecked(&vcc->stats->rx_err);
36163 goto out;
36164 }
36165
36166 @@ -369,14 +369,14 @@ static void usbatm_extract_one_cell(stru
36167 if (sarb->len < pdu_length) {
36168 atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
36169 __func__, pdu_length, sarb->len, vcc);
36170 - atomic_inc(&vcc->stats->rx_err);
36171 + atomic_inc_unchecked(&vcc->stats->rx_err);
36172 goto out;
36173 }
36174
36175 if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
36176 atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
36177 __func__, vcc);
36178 - atomic_inc(&vcc->stats->rx_err);
36179 + atomic_inc_unchecked(&vcc->stats->rx_err);
36180 goto out;
36181 }
36182
36183 @@ -386,7 +386,7 @@ static void usbatm_extract_one_cell(stru
36184 if (printk_ratelimit())
36185 atm_err(instance, "%s: no memory for skb (length: %u)!\n",
36186 __func__, length);
36187 - atomic_inc(&vcc->stats->rx_drop);
36188 + atomic_inc_unchecked(&vcc->stats->rx_drop);
36189 goto out;
36190 }
36191
36192 @@ -411,7 +411,7 @@ static void usbatm_extract_one_cell(stru
36193
36194 vcc->push(vcc, skb);
36195
36196 - atomic_inc(&vcc->stats->rx);
36197 + atomic_inc_unchecked(&vcc->stats->rx);
36198 out:
36199 skb_trim(sarb, 0);
36200 }
36201 @@ -614,7 +614,7 @@ static void usbatm_tx_process(unsigned l
36202 struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
36203
36204 usbatm_pop(vcc, skb);
36205 - atomic_inc(&vcc->stats->tx);
36206 + atomic_inc_unchecked(&vcc->stats->tx);
36207
36208 skb = skb_dequeue(&instance->sndqueue);
36209 }
36210 @@ -773,11 +773,11 @@ static int usbatm_atm_proc_read(struct a
36211 if (!left--)
36212 return sprintf(page,
36213 "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
36214 - atomic_read(&atm_dev->stats.aal5.tx),
36215 - atomic_read(&atm_dev->stats.aal5.tx_err),
36216 - atomic_read(&atm_dev->stats.aal5.rx),
36217 - atomic_read(&atm_dev->stats.aal5.rx_err),
36218 - atomic_read(&atm_dev->stats.aal5.rx_drop));
36219 + atomic_read_unchecked(&atm_dev->stats.aal5.tx),
36220 + atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
36221 + atomic_read_unchecked(&atm_dev->stats.aal5.rx),
36222 + atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
36223 + atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
36224
36225 if (!left--) {
36226 if (instance->disconnected)
36227 diff -urNp linux-3.0.8/drivers/usb/core/devices.c linux-3.0.8/drivers/usb/core/devices.c
36228 --- linux-3.0.8/drivers/usb/core/devices.c 2011-07-21 22:17:23.000000000 -0400
36229 +++ linux-3.0.8/drivers/usb/core/devices.c 2011-08-23 21:47:56.000000000 -0400
36230 @@ -126,7 +126,7 @@ static const char format_endpt[] =
36231 * time it gets called.
36232 */
36233 static struct device_connect_event {
36234 - atomic_t count;
36235 + atomic_unchecked_t count;
36236 wait_queue_head_t wait;
36237 } device_event = {
36238 .count = ATOMIC_INIT(1),
36239 @@ -164,7 +164,7 @@ static const struct class_info clas_info
36240
36241 void usbfs_conn_disc_event(void)
36242 {
36243 - atomic_add(2, &device_event.count);
36244 + atomic_add_unchecked(2, &device_event.count);
36245 wake_up(&device_event.wait);
36246 }
36247
36248 @@ -648,7 +648,7 @@ static unsigned int usb_device_poll(stru
36249
36250 poll_wait(file, &device_event.wait, wait);
36251
36252 - event_count = atomic_read(&device_event.count);
36253 + event_count = atomic_read_unchecked(&device_event.count);
36254 if (file->f_version != event_count) {
36255 file->f_version = event_count;
36256 return POLLIN | POLLRDNORM;
36257 diff -urNp linux-3.0.8/drivers/usb/core/message.c linux-3.0.8/drivers/usb/core/message.c
36258 --- linux-3.0.8/drivers/usb/core/message.c 2011-07-21 22:17:23.000000000 -0400
36259 +++ linux-3.0.8/drivers/usb/core/message.c 2011-08-23 21:47:56.000000000 -0400
36260 @@ -869,8 +869,8 @@ char *usb_cache_string(struct usb_device
36261 buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
36262 if (buf) {
36263 len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
36264 - if (len > 0) {
36265 - smallbuf = kmalloc(++len, GFP_NOIO);
36266 + if (len++ > 0) {
36267 + smallbuf = kmalloc(len, GFP_NOIO);
36268 if (!smallbuf)
36269 return buf;
36270 memcpy(smallbuf, buf, len);
36271 diff -urNp linux-3.0.8/drivers/usb/early/ehci-dbgp.c linux-3.0.8/drivers/usb/early/ehci-dbgp.c
36272 --- linux-3.0.8/drivers/usb/early/ehci-dbgp.c 2011-07-21 22:17:23.000000000 -0400
36273 +++ linux-3.0.8/drivers/usb/early/ehci-dbgp.c 2011-08-23 21:47:56.000000000 -0400
36274 @@ -97,7 +97,8 @@ static inline u32 dbgp_len_update(u32 x,
36275
36276 #ifdef CONFIG_KGDB
36277 static struct kgdb_io kgdbdbgp_io_ops;
36278 -#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops)
36279 +static struct kgdb_io kgdbdbgp_io_ops_console;
36280 +#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops || dbg_io_ops == &kgdbdbgp_io_ops_console)
36281 #else
36282 #define dbgp_kgdb_mode (0)
36283 #endif
36284 @@ -1035,6 +1036,13 @@ static struct kgdb_io kgdbdbgp_io_ops =
36285 .write_char = kgdbdbgp_write_char,
36286 };
36287
36288 +static struct kgdb_io kgdbdbgp_io_ops_console = {
36289 + .name = "kgdbdbgp",
36290 + .read_char = kgdbdbgp_read_char,
36291 + .write_char = kgdbdbgp_write_char,
36292 + .is_console = 1
36293 +};
36294 +
36295 static int kgdbdbgp_wait_time;
36296
36297 static int __init kgdbdbgp_parse_config(char *str)
36298 @@ -1050,8 +1058,10 @@ static int __init kgdbdbgp_parse_config(
36299 ptr++;
36300 kgdbdbgp_wait_time = simple_strtoul(ptr, &ptr, 10);
36301 }
36302 - kgdb_register_io_module(&kgdbdbgp_io_ops);
36303 - kgdbdbgp_io_ops.is_console = early_dbgp_console.index != -1;
36304 + if (early_dbgp_console.index != -1)
36305 + kgdb_register_io_module(&kgdbdbgp_io_ops_console);
36306 + else
36307 + kgdb_register_io_module(&kgdbdbgp_io_ops);
36308
36309 return 0;
36310 }
36311 diff -urNp linux-3.0.8/drivers/usb/host/xhci-mem.c linux-3.0.8/drivers/usb/host/xhci-mem.c
36312 --- linux-3.0.8/drivers/usb/host/xhci-mem.c 2011-07-21 22:17:23.000000000 -0400
36313 +++ linux-3.0.8/drivers/usb/host/xhci-mem.c 2011-08-23 21:48:14.000000000 -0400
36314 @@ -1685,6 +1685,8 @@ static int xhci_check_trb_in_td_math(str
36315 unsigned int num_tests;
36316 int i, ret;
36317
36318 + pax_track_stack();
36319 +
36320 num_tests = ARRAY_SIZE(simple_test_vector);
36321 for (i = 0; i < num_tests; i++) {
36322 ret = xhci_test_trb_in_td(xhci,
36323 diff -urNp linux-3.0.8/drivers/usb/wusbcore/wa-hc.h linux-3.0.8/drivers/usb/wusbcore/wa-hc.h
36324 --- linux-3.0.8/drivers/usb/wusbcore/wa-hc.h 2011-07-21 22:17:23.000000000 -0400
36325 +++ linux-3.0.8/drivers/usb/wusbcore/wa-hc.h 2011-08-23 21:47:56.000000000 -0400
36326 @@ -192,7 +192,7 @@ struct wahc {
36327 struct list_head xfer_delayed_list;
36328 spinlock_t xfer_list_lock;
36329 struct work_struct xfer_work;
36330 - atomic_t xfer_id_count;
36331 + atomic_unchecked_t xfer_id_count;
36332 };
36333
36334
36335 @@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *
36336 INIT_LIST_HEAD(&wa->xfer_delayed_list);
36337 spin_lock_init(&wa->xfer_list_lock);
36338 INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
36339 - atomic_set(&wa->xfer_id_count, 1);
36340 + atomic_set_unchecked(&wa->xfer_id_count, 1);
36341 }
36342
36343 /**
36344 diff -urNp linux-3.0.8/drivers/usb/wusbcore/wa-xfer.c linux-3.0.8/drivers/usb/wusbcore/wa-xfer.c
36345 --- linux-3.0.8/drivers/usb/wusbcore/wa-xfer.c 2011-07-21 22:17:23.000000000 -0400
36346 +++ linux-3.0.8/drivers/usb/wusbcore/wa-xfer.c 2011-08-23 21:47:56.000000000 -0400
36347 @@ -294,7 +294,7 @@ out:
36348 */
36349 static void wa_xfer_id_init(struct wa_xfer *xfer)
36350 {
36351 - xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
36352 + xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
36353 }
36354
36355 /*
36356 diff -urNp linux-3.0.8/drivers/vhost/vhost.c linux-3.0.8/drivers/vhost/vhost.c
36357 --- linux-3.0.8/drivers/vhost/vhost.c 2011-07-21 22:17:23.000000000 -0400
36358 +++ linux-3.0.8/drivers/vhost/vhost.c 2011-08-23 21:47:56.000000000 -0400
36359 @@ -589,7 +589,7 @@ static int init_used(struct vhost_virtqu
36360 return get_user(vq->last_used_idx, &used->idx);
36361 }
36362
36363 -static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
36364 +static long vhost_set_vring(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
36365 {
36366 struct file *eventfp, *filep = NULL,
36367 *pollstart = NULL, *pollstop = NULL;
36368 diff -urNp linux-3.0.8/drivers/video/aty/aty128fb.c linux-3.0.8/drivers/video/aty/aty128fb.c
36369 --- linux-3.0.8/drivers/video/aty/aty128fb.c 2011-07-21 22:17:23.000000000 -0400
36370 +++ linux-3.0.8/drivers/video/aty/aty128fb.c 2011-10-11 10:44:33.000000000 -0400
36371 @@ -148,7 +148,7 @@ enum {
36372 };
36373
36374 /* Must match above enum */
36375 -static const char *r128_family[] __devinitdata = {
36376 +static const char *r128_family[] __devinitconst = {
36377 "AGP",
36378 "PCI",
36379 "PRO AGP",
36380 diff -urNp linux-3.0.8/drivers/video/fbcmap.c linux-3.0.8/drivers/video/fbcmap.c
36381 --- linux-3.0.8/drivers/video/fbcmap.c 2011-07-21 22:17:23.000000000 -0400
36382 +++ linux-3.0.8/drivers/video/fbcmap.c 2011-08-23 21:47:56.000000000 -0400
36383 @@ -285,8 +285,7 @@ int fb_set_user_cmap(struct fb_cmap_user
36384 rc = -ENODEV;
36385 goto out;
36386 }
36387 - if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
36388 - !info->fbops->fb_setcmap)) {
36389 + if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
36390 rc = -EINVAL;
36391 goto out1;
36392 }
36393 diff -urNp linux-3.0.8/drivers/video/fbmem.c linux-3.0.8/drivers/video/fbmem.c
36394 --- linux-3.0.8/drivers/video/fbmem.c 2011-07-21 22:17:23.000000000 -0400
36395 +++ linux-3.0.8/drivers/video/fbmem.c 2011-08-23 21:48:14.000000000 -0400
36396 @@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_in
36397 image->dx += image->width + 8;
36398 }
36399 } else if (rotate == FB_ROTATE_UD) {
36400 - for (x = 0; x < num && image->dx >= 0; x++) {
36401 + for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
36402 info->fbops->fb_imageblit(info, image);
36403 image->dx -= image->width + 8;
36404 }
36405 @@ -440,7 +440,7 @@ static void fb_do_show_logo(struct fb_in
36406 image->dy += image->height + 8;
36407 }
36408 } else if (rotate == FB_ROTATE_CCW) {
36409 - for (x = 0; x < num && image->dy >= 0; x++) {
36410 + for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
36411 info->fbops->fb_imageblit(info, image);
36412 image->dy -= image->height + 8;
36413 }
36414 @@ -939,6 +939,8 @@ fb_set_var(struct fb_info *info, struct
36415 int flags = info->flags;
36416 int ret = 0;
36417
36418 + pax_track_stack();
36419 +
36420 if (var->activate & FB_ACTIVATE_INV_MODE) {
36421 struct fb_videomode mode1, mode2;
36422
36423 @@ -1064,6 +1066,8 @@ static long do_fb_ioctl(struct fb_info *
36424 void __user *argp = (void __user *)arg;
36425 long ret = 0;
36426
36427 + pax_track_stack();
36428 +
36429 switch (cmd) {
36430 case FBIOGET_VSCREENINFO:
36431 if (!lock_fb_info(info))
36432 @@ -1143,7 +1147,7 @@ static long do_fb_ioctl(struct fb_info *
36433 return -EFAULT;
36434 if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
36435 return -EINVAL;
36436 - if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
36437 + if (con2fb.framebuffer >= FB_MAX)
36438 return -EINVAL;
36439 if (!registered_fb[con2fb.framebuffer])
36440 request_module("fb%d", con2fb.framebuffer);
36441 diff -urNp linux-3.0.8/drivers/video/geode/gx1fb_core.c linux-3.0.8/drivers/video/geode/gx1fb_core.c
36442 --- linux-3.0.8/drivers/video/geode/gx1fb_core.c 2011-07-21 22:17:23.000000000 -0400
36443 +++ linux-3.0.8/drivers/video/geode/gx1fb_core.c 2011-10-11 10:44:33.000000000 -0400
36444 @@ -29,7 +29,7 @@ static int crt_option = 1;
36445 static char panel_option[32] = "";
36446
36447 /* Modes relevant to the GX1 (taken from modedb.c) */
36448 -static const struct fb_videomode __devinitdata gx1_modedb[] = {
36449 +static const struct fb_videomode __devinitconst gx1_modedb[] = {
36450 /* 640x480-60 VESA */
36451 { NULL, 60, 640, 480, 39682, 48, 16, 33, 10, 96, 2,
36452 0, FB_VMODE_NONINTERLACED, FB_MODE_IS_VESA },
36453 diff -urNp linux-3.0.8/drivers/video/gxt4500.c linux-3.0.8/drivers/video/gxt4500.c
36454 --- linux-3.0.8/drivers/video/gxt4500.c 2011-07-21 22:17:23.000000000 -0400
36455 +++ linux-3.0.8/drivers/video/gxt4500.c 2011-10-11 10:44:33.000000000 -0400
36456 @@ -156,7 +156,7 @@ struct gxt4500_par {
36457 static char *mode_option;
36458
36459 /* default mode: 1280x1024 @ 60 Hz, 8 bpp */
36460 -static const struct fb_videomode defaultmode __devinitdata = {
36461 +static const struct fb_videomode defaultmode __devinitconst = {
36462 .refresh = 60,
36463 .xres = 1280,
36464 .yres = 1024,
36465 @@ -581,7 +581,7 @@ static int gxt4500_blank(int blank, stru
36466 return 0;
36467 }
36468
36469 -static const struct fb_fix_screeninfo gxt4500_fix __devinitdata = {
36470 +static const struct fb_fix_screeninfo gxt4500_fix __devinitconst = {
36471 .id = "IBM GXT4500P",
36472 .type = FB_TYPE_PACKED_PIXELS,
36473 .visual = FB_VISUAL_PSEUDOCOLOR,
36474 diff -urNp linux-3.0.8/drivers/video/i810/i810_accel.c linux-3.0.8/drivers/video/i810/i810_accel.c
36475 --- linux-3.0.8/drivers/video/i810/i810_accel.c 2011-07-21 22:17:23.000000000 -0400
36476 +++ linux-3.0.8/drivers/video/i810/i810_accel.c 2011-08-23 21:47:56.000000000 -0400
36477 @@ -73,6 +73,7 @@ static inline int wait_for_space(struct
36478 }
36479 }
36480 printk("ringbuffer lockup!!!\n");
36481 + printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
36482 i810_report_error(mmio);
36483 par->dev_flags |= LOCKUP;
36484 info->pixmap.scan_align = 1;
36485 diff -urNp linux-3.0.8/drivers/video/i810/i810_main.c linux-3.0.8/drivers/video/i810/i810_main.c
36486 --- linux-3.0.8/drivers/video/i810/i810_main.c 2011-07-21 22:17:23.000000000 -0400
36487 +++ linux-3.0.8/drivers/video/i810/i810_main.c 2011-10-11 10:44:33.000000000 -0400
36488 @@ -97,7 +97,7 @@ static int i810fb_blank (int blank_
36489 static void i810fb_release_resource (struct fb_info *info, struct i810fb_par *par);
36490
36491 /* PCI */
36492 -static const char *i810_pci_list[] __devinitdata = {
36493 +static const char *i810_pci_list[] __devinitconst = {
36494 "Intel(R) 810 Framebuffer Device" ,
36495 "Intel(R) 810-DC100 Framebuffer Device" ,
36496 "Intel(R) 810E Framebuffer Device" ,
36497 diff -urNp linux-3.0.8/drivers/video/jz4740_fb.c linux-3.0.8/drivers/video/jz4740_fb.c
36498 --- linux-3.0.8/drivers/video/jz4740_fb.c 2011-07-21 22:17:23.000000000 -0400
36499 +++ linux-3.0.8/drivers/video/jz4740_fb.c 2011-10-11 10:44:33.000000000 -0400
36500 @@ -136,7 +136,7 @@ struct jzfb {
36501 uint32_t pseudo_palette[16];
36502 };
36503
36504 -static const struct fb_fix_screeninfo jzfb_fix __devinitdata = {
36505 +static const struct fb_fix_screeninfo jzfb_fix __devinitconst = {
36506 .id = "JZ4740 FB",
36507 .type = FB_TYPE_PACKED_PIXELS,
36508 .visual = FB_VISUAL_TRUECOLOR,
36509 diff -urNp linux-3.0.8/drivers/video/logo/logo_linux_clut224.ppm linux-3.0.8/drivers/video/logo/logo_linux_clut224.ppm
36510 --- linux-3.0.8/drivers/video/logo/logo_linux_clut224.ppm 2011-07-21 22:17:23.000000000 -0400
36511 +++ linux-3.0.8/drivers/video/logo/logo_linux_clut224.ppm 2011-08-29 23:49:40.000000000 -0400
36512 @@ -1,1604 +1,1123 @@
36513 P3
36514 -# Standard 224-color Linux logo
36515 80 80
36516 255
36517 - 0 0 0 0 0 0 0 0 0 0 0 0
36518 - 0 0 0 0 0 0 0 0 0 0 0 0
36519 - 0 0 0 0 0 0 0 0 0 0 0 0
36520 - 0 0 0 0 0 0 0 0 0 0 0 0
36521 - 0 0 0 0 0 0 0 0 0 0 0 0
36522 - 0 0 0 0 0 0 0 0 0 0 0 0
36523 - 0 0 0 0 0 0 0 0 0 0 0 0
36524 - 0 0 0 0 0 0 0 0 0 0 0 0
36525 - 0 0 0 0 0 0 0 0 0 0 0 0
36526 - 6 6 6 6 6 6 10 10 10 10 10 10
36527 - 10 10 10 6 6 6 6 6 6 6 6 6
36528 - 0 0 0 0 0 0 0 0 0 0 0 0
36529 - 0 0 0 0 0 0 0 0 0 0 0 0
36530 - 0 0 0 0 0 0 0 0 0 0 0 0
36531 - 0 0 0 0 0 0 0 0 0 0 0 0
36532 - 0 0 0 0 0 0 0 0 0 0 0 0
36533 - 0 0 0 0 0 0 0 0 0 0 0 0
36534 - 0 0 0 0 0 0 0 0 0 0 0 0
36535 - 0 0 0 0 0 0 0 0 0 0 0 0
36536 - 0 0 0 0 0 0 0 0 0 0 0 0
36537 - 0 0 0 0 0 0 0 0 0 0 0 0
36538 - 0 0 0 0 0 0 0 0 0 0 0 0
36539 - 0 0 0 0 0 0 0 0 0 0 0 0
36540 - 0 0 0 0 0 0 0 0 0 0 0 0
36541 - 0 0 0 0 0 0 0 0 0 0 0 0
36542 - 0 0 0 0 0 0 0 0 0 0 0 0
36543 - 0 0 0 0 0 0 0 0 0 0 0 0
36544 - 0 0 0 0 0 0 0 0 0 0 0 0
36545 - 0 0 0 6 6 6 10 10 10 14 14 14
36546 - 22 22 22 26 26 26 30 30 30 34 34 34
36547 - 30 30 30 30 30 30 26 26 26 18 18 18
36548 - 14 14 14 10 10 10 6 6 6 0 0 0
36549 - 0 0 0 0 0 0 0 0 0 0 0 0
36550 - 0 0 0 0 0 0 0 0 0 0 0 0
36551 - 0 0 0 0 0 0 0 0 0 0 0 0
36552 - 0 0 0 0 0 0 0 0 0 0 0 0
36553 - 0 0 0 0 0 0 0 0 0 0 0 0
36554 - 0 0 0 0 0 0 0 0 0 0 0 0
36555 - 0 0 0 0 0 0 0 0 0 0 0 0
36556 - 0 0 0 0 0 0 0 0 0 0 0 0
36557 - 0 0 0 0 0 0 0 0 0 0 0 0
36558 - 0 0 0 0 0 1 0 0 1 0 0 0
36559 - 0 0 0 0 0 0 0 0 0 0 0 0
36560 - 0 0 0 0 0 0 0 0 0 0 0 0
36561 - 0 0 0 0 0 0 0 0 0 0 0 0
36562 - 0 0 0 0 0 0 0 0 0 0 0 0
36563 - 0 0 0 0 0 0 0 0 0 0 0 0
36564 - 0 0 0 0 0 0 0 0 0 0 0 0
36565 - 6 6 6 14 14 14 26 26 26 42 42 42
36566 - 54 54 54 66 66 66 78 78 78 78 78 78
36567 - 78 78 78 74 74 74 66 66 66 54 54 54
36568 - 42 42 42 26 26 26 18 18 18 10 10 10
36569 - 6 6 6 0 0 0 0 0 0 0 0 0
36570 - 0 0 0 0 0 0 0 0 0 0 0 0
36571 - 0 0 0 0 0 0 0 0 0 0 0 0
36572 - 0 0 0 0 0 0 0 0 0 0 0 0
36573 - 0 0 0 0 0 0 0 0 0 0 0 0
36574 - 0 0 0 0 0 0 0 0 0 0 0 0
36575 - 0 0 0 0 0 0 0 0 0 0 0 0
36576 - 0 0 0 0 0 0 0 0 0 0 0 0
36577 - 0 0 0 0 0 0 0 0 0 0 0 0
36578 - 0 0 1 0 0 0 0 0 0 0 0 0
36579 - 0 0 0 0 0 0 0 0 0 0 0 0
36580 - 0 0 0 0 0 0 0 0 0 0 0 0
36581 - 0 0 0 0 0 0 0 0 0 0 0 0
36582 - 0 0 0 0 0 0 0 0 0 0 0 0
36583 - 0 0 0 0 0 0 0 0 0 0 0 0
36584 - 0 0 0 0 0 0 0 0 0 10 10 10
36585 - 22 22 22 42 42 42 66 66 66 86 86 86
36586 - 66 66 66 38 38 38 38 38 38 22 22 22
36587 - 26 26 26 34 34 34 54 54 54 66 66 66
36588 - 86 86 86 70 70 70 46 46 46 26 26 26
36589 - 14 14 14 6 6 6 0 0 0 0 0 0
36590 - 0 0 0 0 0 0 0 0 0 0 0 0
36591 - 0 0 0 0 0 0 0 0 0 0 0 0
36592 - 0 0 0 0 0 0 0 0 0 0 0 0
36593 - 0 0 0 0 0 0 0 0 0 0 0 0
36594 - 0 0 0 0 0 0 0 0 0 0 0 0
36595 - 0 0 0 0 0 0 0 0 0 0 0 0
36596 - 0 0 0 0 0 0 0 0 0 0 0 0
36597 - 0 0 0 0 0 0 0 0 0 0 0 0
36598 - 0 0 1 0 0 1 0 0 1 0 0 0
36599 - 0 0 0 0 0 0 0 0 0 0 0 0
36600 - 0 0 0 0 0 0 0 0 0 0 0 0
36601 - 0 0 0 0 0 0 0 0 0 0 0 0
36602 - 0 0 0 0 0 0 0 0 0 0 0 0
36603 - 0 0 0 0 0 0 0 0 0 0 0 0
36604 - 0 0 0 0 0 0 10 10 10 26 26 26
36605 - 50 50 50 82 82 82 58 58 58 6 6 6
36606 - 2 2 6 2 2 6 2 2 6 2 2 6
36607 - 2 2 6 2 2 6 2 2 6 2 2 6
36608 - 6 6 6 54 54 54 86 86 86 66 66 66
36609 - 38 38 38 18 18 18 6 6 6 0 0 0
36610 - 0 0 0 0 0 0 0 0 0 0 0 0
36611 - 0 0 0 0 0 0 0 0 0 0 0 0
36612 - 0 0 0 0 0 0 0 0 0 0 0 0
36613 - 0 0 0 0 0 0 0 0 0 0 0 0
36614 - 0 0 0 0 0 0 0 0 0 0 0 0
36615 - 0 0 0 0 0 0 0 0 0 0 0 0
36616 - 0 0 0 0 0 0 0 0 0 0 0 0
36617 - 0 0 0 0 0 0 0 0 0 0 0 0
36618 - 0 0 0 0 0 0 0 0 0 0 0 0
36619 - 0 0 0 0 0 0 0 0 0 0 0 0
36620 - 0 0 0 0 0 0 0 0 0 0 0 0
36621 - 0 0 0 0 0 0 0 0 0 0 0 0
36622 - 0 0 0 0 0 0 0 0 0 0 0 0
36623 - 0 0 0 0 0 0 0 0 0 0 0 0
36624 - 0 0 0 6 6 6 22 22 22 50 50 50
36625 - 78 78 78 34 34 34 2 2 6 2 2 6
36626 - 2 2 6 2 2 6 2 2 6 2 2 6
36627 - 2 2 6 2 2 6 2 2 6 2 2 6
36628 - 2 2 6 2 2 6 6 6 6 70 70 70
36629 - 78 78 78 46 46 46 22 22 22 6 6 6
36630 - 0 0 0 0 0 0 0 0 0 0 0 0
36631 - 0 0 0 0 0 0 0 0 0 0 0 0
36632 - 0 0 0 0 0 0 0 0 0 0 0 0
36633 - 0 0 0 0 0 0 0 0 0 0 0 0
36634 - 0 0 0 0 0 0 0 0 0 0 0 0
36635 - 0 0 0 0 0 0 0 0 0 0 0 0
36636 - 0 0 0 0 0 0 0 0 0 0 0 0
36637 - 0 0 0 0 0 0 0 0 0 0 0 0
36638 - 0 0 1 0 0 1 0 0 1 0 0 0
36639 - 0 0 0 0 0 0 0 0 0 0 0 0
36640 - 0 0 0 0 0 0 0 0 0 0 0 0
36641 - 0 0 0 0 0 0 0 0 0 0 0 0
36642 - 0 0 0 0 0 0 0 0 0 0 0 0
36643 - 0 0 0 0 0 0 0 0 0 0 0 0
36644 - 6 6 6 18 18 18 42 42 42 82 82 82
36645 - 26 26 26 2 2 6 2 2 6 2 2 6
36646 - 2 2 6 2 2 6 2 2 6 2 2 6
36647 - 2 2 6 2 2 6 2 2 6 14 14 14
36648 - 46 46 46 34 34 34 6 6 6 2 2 6
36649 - 42 42 42 78 78 78 42 42 42 18 18 18
36650 - 6 6 6 0 0 0 0 0 0 0 0 0
36651 - 0 0 0 0 0 0 0 0 0 0 0 0
36652 - 0 0 0 0 0 0 0 0 0 0 0 0
36653 - 0 0 0 0 0 0 0 0 0 0 0 0
36654 - 0 0 0 0 0 0 0 0 0 0 0 0
36655 - 0 0 0 0 0 0 0 0 0 0 0 0
36656 - 0 0 0 0 0 0 0 0 0 0 0 0
36657 - 0 0 0 0 0 0 0 0 0 0 0 0
36658 - 0 0 1 0 0 0 0 0 1 0 0 0
36659 - 0 0 0 0 0 0 0 0 0 0 0 0
36660 - 0 0 0 0 0 0 0 0 0 0 0 0
36661 - 0 0 0 0 0 0 0 0 0 0 0 0
36662 - 0 0 0 0 0 0 0 0 0 0 0 0
36663 - 0 0 0 0 0 0 0 0 0 0 0 0
36664 - 10 10 10 30 30 30 66 66 66 58 58 58
36665 - 2 2 6 2 2 6 2 2 6 2 2 6
36666 - 2 2 6 2 2 6 2 2 6 2 2 6
36667 - 2 2 6 2 2 6 2 2 6 26 26 26
36668 - 86 86 86 101 101 101 46 46 46 10 10 10
36669 - 2 2 6 58 58 58 70 70 70 34 34 34
36670 - 10 10 10 0 0 0 0 0 0 0 0 0
36671 - 0 0 0 0 0 0 0 0 0 0 0 0
36672 - 0 0 0 0 0 0 0 0 0 0 0 0
36673 - 0 0 0 0 0 0 0 0 0 0 0 0
36674 - 0 0 0 0 0 0 0 0 0 0 0 0
36675 - 0 0 0 0 0 0 0 0 0 0 0 0
36676 - 0 0 0 0 0 0 0 0 0 0 0 0
36677 - 0 0 0 0 0 0 0 0 0 0 0 0
36678 - 0 0 1 0 0 1 0 0 1 0 0 0
36679 - 0 0 0 0 0 0 0 0 0 0 0 0
36680 - 0 0 0 0 0 0 0 0 0 0 0 0
36681 - 0 0 0 0 0 0 0 0 0 0 0 0
36682 - 0 0 0 0 0 0 0 0 0 0 0 0
36683 - 0 0 0 0 0 0 0 0 0 0 0 0
36684 - 14 14 14 42 42 42 86 86 86 10 10 10
36685 - 2 2 6 2 2 6 2 2 6 2 2 6
36686 - 2 2 6 2 2 6 2 2 6 2 2 6
36687 - 2 2 6 2 2 6 2 2 6 30 30 30
36688 - 94 94 94 94 94 94 58 58 58 26 26 26
36689 - 2 2 6 6 6 6 78 78 78 54 54 54
36690 - 22 22 22 6 6 6 0 0 0 0 0 0
36691 - 0 0 0 0 0 0 0 0 0 0 0 0
36692 - 0 0 0 0 0 0 0 0 0 0 0 0
36693 - 0 0 0 0 0 0 0 0 0 0 0 0
36694 - 0 0 0 0 0 0 0 0 0 0 0 0
36695 - 0 0 0 0 0 0 0 0 0 0 0 0
36696 - 0 0 0 0 0 0 0 0 0 0 0 0
36697 - 0 0 0 0 0 0 0 0 0 0 0 0
36698 - 0 0 0 0 0 0 0 0 0 0 0 0
36699 - 0 0 0 0 0 0 0 0 0 0 0 0
36700 - 0 0 0 0 0 0 0 0 0 0 0 0
36701 - 0 0 0 0 0 0 0 0 0 0 0 0
36702 - 0 0 0 0 0 0 0 0 0 0 0 0
36703 - 0 0 0 0 0 0 0 0 0 6 6 6
36704 - 22 22 22 62 62 62 62 62 62 2 2 6
36705 - 2 2 6 2 2 6 2 2 6 2 2 6
36706 - 2 2 6 2 2 6 2 2 6 2 2 6
36707 - 2 2 6 2 2 6 2 2 6 26 26 26
36708 - 54 54 54 38 38 38 18 18 18 10 10 10
36709 - 2 2 6 2 2 6 34 34 34 82 82 82
36710 - 38 38 38 14 14 14 0 0 0 0 0 0
36711 - 0 0 0 0 0 0 0 0 0 0 0 0
36712 - 0 0 0 0 0 0 0 0 0 0 0 0
36713 - 0 0 0 0 0 0 0 0 0 0 0 0
36714 - 0 0 0 0 0 0 0 0 0 0 0 0
36715 - 0 0 0 0 0 0 0 0 0 0 0 0
36716 - 0 0 0 0 0 0 0 0 0 0 0 0
36717 - 0 0 0 0 0 0 0 0 0 0 0 0
36718 - 0 0 0 0 0 1 0 0 1 0 0 0
36719 - 0 0 0 0 0 0 0 0 0 0 0 0
36720 - 0 0 0 0 0 0 0 0 0 0 0 0
36721 - 0 0 0 0 0 0 0 0 0 0 0 0
36722 - 0 0 0 0 0 0 0 0 0 0 0 0
36723 - 0 0 0 0 0 0 0 0 0 6 6 6
36724 - 30 30 30 78 78 78 30 30 30 2 2 6
36725 - 2 2 6 2 2 6 2 2 6 2 2 6
36726 - 2 2 6 2 2 6 2 2 6 2 2 6
36727 - 2 2 6 2 2 6 2 2 6 10 10 10
36728 - 10 10 10 2 2 6 2 2 6 2 2 6
36729 - 2 2 6 2 2 6 2 2 6 78 78 78
36730 - 50 50 50 18 18 18 6 6 6 0 0 0
36731 - 0 0 0 0 0 0 0 0 0 0 0 0
36732 - 0 0 0 0 0 0 0 0 0 0 0 0
36733 - 0 0 0 0 0 0 0 0 0 0 0 0
36734 - 0 0 0 0 0 0 0 0 0 0 0 0
36735 - 0 0 0 0 0 0 0 0 0 0 0 0
36736 - 0 0 0 0 0 0 0 0 0 0 0 0
36737 - 0 0 0 0 0 0 0 0 0 0 0 0
36738 - 0 0 1 0 0 0 0 0 0 0 0 0
36739 - 0 0 0 0 0 0 0 0 0 0 0 0
36740 - 0 0 0 0 0 0 0 0 0 0 0 0
36741 - 0 0 0 0 0 0 0 0 0 0 0 0
36742 - 0 0 0 0 0 0 0 0 0 0 0 0
36743 - 0 0 0 0 0 0 0 0 0 10 10 10
36744 - 38 38 38 86 86 86 14 14 14 2 2 6
36745 - 2 2 6 2 2 6 2 2 6 2 2 6
36746 - 2 2 6 2 2 6 2 2 6 2 2 6
36747 - 2 2 6 2 2 6 2 2 6 2 2 6
36748 - 2 2 6 2 2 6 2 2 6 2 2 6
36749 - 2 2 6 2 2 6 2 2 6 54 54 54
36750 - 66 66 66 26 26 26 6 6 6 0 0 0
36751 - 0 0 0 0 0 0 0 0 0 0 0 0
36752 - 0 0 0 0 0 0 0 0 0 0 0 0
36753 - 0 0 0 0 0 0 0 0 0 0 0 0
36754 - 0 0 0 0 0 0 0 0 0 0 0 0
36755 - 0 0 0 0 0 0 0 0 0 0 0 0
36756 - 0 0 0 0 0 0 0 0 0 0 0 0
36757 - 0 0 0 0 0 0 0 0 0 0 0 0
36758 - 0 0 0 0 0 1 0 0 1 0 0 0
36759 - 0 0 0 0 0 0 0 0 0 0 0 0
36760 - 0 0 0 0 0 0 0 0 0 0 0 0
36761 - 0 0 0 0 0 0 0 0 0 0 0 0
36762 - 0 0 0 0 0 0 0 0 0 0 0 0
36763 - 0 0 0 0 0 0 0 0 0 14 14 14
36764 - 42 42 42 82 82 82 2 2 6 2 2 6
36765 - 2 2 6 6 6 6 10 10 10 2 2 6
36766 - 2 2 6 2 2 6 2 2 6 2 2 6
36767 - 2 2 6 2 2 6 2 2 6 6 6 6
36768 - 14 14 14 10 10 10 2 2 6 2 2 6
36769 - 2 2 6 2 2 6 2 2 6 18 18 18
36770 - 82 82 82 34 34 34 10 10 10 0 0 0
36771 - 0 0 0 0 0 0 0 0 0 0 0 0
36772 - 0 0 0 0 0 0 0 0 0 0 0 0
36773 - 0 0 0 0 0 0 0 0 0 0 0 0
36774 - 0 0 0 0 0 0 0 0 0 0 0 0
36775 - 0 0 0 0 0 0 0 0 0 0 0 0
36776 - 0 0 0 0 0 0 0 0 0 0 0 0
36777 - 0 0 0 0 0 0 0 0 0 0 0 0
36778 - 0 0 1 0 0 0 0 0 0 0 0 0
36779 - 0 0 0 0 0 0 0 0 0 0 0 0
36780 - 0 0 0 0 0 0 0 0 0 0 0 0
36781 - 0 0 0 0 0 0 0 0 0 0 0 0
36782 - 0 0 0 0 0 0 0 0 0 0 0 0
36783 - 0 0 0 0 0 0 0 0 0 14 14 14
36784 - 46 46 46 86 86 86 2 2 6 2 2 6
36785 - 6 6 6 6 6 6 22 22 22 34 34 34
36786 - 6 6 6 2 2 6 2 2 6 2 2 6
36787 - 2 2 6 2 2 6 18 18 18 34 34 34
36788 - 10 10 10 50 50 50 22 22 22 2 2 6
36789 - 2 2 6 2 2 6 2 2 6 10 10 10
36790 - 86 86 86 42 42 42 14 14 14 0 0 0
36791 - 0 0 0 0 0 0 0 0 0 0 0 0
36792 - 0 0 0 0 0 0 0 0 0 0 0 0
36793 - 0 0 0 0 0 0 0 0 0 0 0 0
36794 - 0 0 0 0 0 0 0 0 0 0 0 0
36795 - 0 0 0 0 0 0 0 0 0 0 0 0
36796 - 0 0 0 0 0 0 0 0 0 0 0 0
36797 - 0 0 0 0 0 0 0 0 0 0 0 0
36798 - 0 0 1 0 0 1 0 0 1 0 0 0
36799 - 0 0 0 0 0 0 0 0 0 0 0 0
36800 - 0 0 0 0 0 0 0 0 0 0 0 0
36801 - 0 0 0 0 0 0 0 0 0 0 0 0
36802 - 0 0 0 0 0 0 0 0 0 0 0 0
36803 - 0 0 0 0 0 0 0 0 0 14 14 14
36804 - 46 46 46 86 86 86 2 2 6 2 2 6
36805 - 38 38 38 116 116 116 94 94 94 22 22 22
36806 - 22 22 22 2 2 6 2 2 6 2 2 6
36807 - 14 14 14 86 86 86 138 138 138 162 162 162
36808 -154 154 154 38 38 38 26 26 26 6 6 6
36809 - 2 2 6 2 2 6 2 2 6 2 2 6
36810 - 86 86 86 46 46 46 14 14 14 0 0 0
36811 - 0 0 0 0 0 0 0 0 0 0 0 0
36812 - 0 0 0 0 0 0 0 0 0 0 0 0
36813 - 0 0 0 0 0 0 0 0 0 0 0 0
36814 - 0 0 0 0 0 0 0 0 0 0 0 0
36815 - 0 0 0 0 0 0 0 0 0 0 0 0
36816 - 0 0 0 0 0 0 0 0 0 0 0 0
36817 - 0 0 0 0 0 0 0 0 0 0 0 0
36818 - 0 0 0 0 0 0 0 0 0 0 0 0
36819 - 0 0 0 0 0 0 0 0 0 0 0 0
36820 - 0 0 0 0 0 0 0 0 0 0 0 0
36821 - 0 0 0 0 0 0 0 0 0 0 0 0
36822 - 0 0 0 0 0 0 0 0 0 0 0 0
36823 - 0 0 0 0 0 0 0 0 0 14 14 14
36824 - 46 46 46 86 86 86 2 2 6 14 14 14
36825 -134 134 134 198 198 198 195 195 195 116 116 116
36826 - 10 10 10 2 2 6 2 2 6 6 6 6
36827 -101 98 89 187 187 187 210 210 210 218 218 218
36828 -214 214 214 134 134 134 14 14 14 6 6 6
36829 - 2 2 6 2 2 6 2 2 6 2 2 6
36830 - 86 86 86 50 50 50 18 18 18 6 6 6
36831 - 0 0 0 0 0 0 0 0 0 0 0 0
36832 - 0 0 0 0 0 0 0 0 0 0 0 0
36833 - 0 0 0 0 0 0 0 0 0 0 0 0
36834 - 0 0 0 0 0 0 0 0 0 0 0 0
36835 - 0 0 0 0 0 0 0 0 0 0 0 0
36836 - 0 0 0 0 0 0 0 0 0 0 0 0
36837 - 0 0 0 0 0 0 0 0 1 0 0 0
36838 - 0 0 1 0 0 1 0 0 1 0 0 0
36839 - 0 0 0 0 0 0 0 0 0 0 0 0
36840 - 0 0 0 0 0 0 0 0 0 0 0 0
36841 - 0 0 0 0 0 0 0 0 0 0 0 0
36842 - 0 0 0 0 0 0 0 0 0 0 0 0
36843 - 0 0 0 0 0 0 0 0 0 14 14 14
36844 - 46 46 46 86 86 86 2 2 6 54 54 54
36845 -218 218 218 195 195 195 226 226 226 246 246 246
36846 - 58 58 58 2 2 6 2 2 6 30 30 30
36847 -210 210 210 253 253 253 174 174 174 123 123 123
36848 -221 221 221 234 234 234 74 74 74 2 2 6
36849 - 2 2 6 2 2 6 2 2 6 2 2 6
36850 - 70 70 70 58 58 58 22 22 22 6 6 6
36851 - 0 0 0 0 0 0 0 0 0 0 0 0
36852 - 0 0 0 0 0 0 0 0 0 0 0 0
36853 - 0 0 0 0 0 0 0 0 0 0 0 0
36854 - 0 0 0 0 0 0 0 0 0 0 0 0
36855 - 0 0 0 0 0 0 0 0 0 0 0 0
36856 - 0 0 0 0 0 0 0 0 0 0 0 0
36857 - 0 0 0 0 0 0 0 0 0 0 0 0
36858 - 0 0 0 0 0 0 0 0 0 0 0 0
36859 - 0 0 0 0 0 0 0 0 0 0 0 0
36860 - 0 0 0 0 0 0 0 0 0 0 0 0
36861 - 0 0 0 0 0 0 0 0 0 0 0 0
36862 - 0 0 0 0 0 0 0 0 0 0 0 0
36863 - 0 0 0 0 0 0 0 0 0 14 14 14
36864 - 46 46 46 82 82 82 2 2 6 106 106 106
36865 -170 170 170 26 26 26 86 86 86 226 226 226
36866 -123 123 123 10 10 10 14 14 14 46 46 46
36867 -231 231 231 190 190 190 6 6 6 70 70 70
36868 - 90 90 90 238 238 238 158 158 158 2 2 6
36869 - 2 2 6 2 2 6 2 2 6 2 2 6
36870 - 70 70 70 58 58 58 22 22 22 6 6 6
36871 - 0 0 0 0 0 0 0 0 0 0 0 0
36872 - 0 0 0 0 0 0 0 0 0 0 0 0
36873 - 0 0 0 0 0 0 0 0 0 0 0 0
36874 - 0 0 0 0 0 0 0 0 0 0 0 0
36875 - 0 0 0 0 0 0 0 0 0 0 0 0
36876 - 0 0 0 0 0 0 0 0 0 0 0 0
36877 - 0 0 0 0 0 0 0 0 1 0 0 0
36878 - 0 0 1 0 0 1 0 0 1 0 0 0
36879 - 0 0 0 0 0 0 0 0 0 0 0 0
36880 - 0 0 0 0 0 0 0 0 0 0 0 0
36881 - 0 0 0 0 0 0 0 0 0 0 0 0
36882 - 0 0 0 0 0 0 0 0 0 0 0 0
36883 - 0 0 0 0 0 0 0 0 0 14 14 14
36884 - 42 42 42 86 86 86 6 6 6 116 116 116
36885 -106 106 106 6 6 6 70 70 70 149 149 149
36886 -128 128 128 18 18 18 38 38 38 54 54 54
36887 -221 221 221 106 106 106 2 2 6 14 14 14
36888 - 46 46 46 190 190 190 198 198 198 2 2 6
36889 - 2 2 6 2 2 6 2 2 6 2 2 6
36890 - 74 74 74 62 62 62 22 22 22 6 6 6
36891 - 0 0 0 0 0 0 0 0 0 0 0 0
36892 - 0 0 0 0 0 0 0 0 0 0 0 0
36893 - 0 0 0 0 0 0 0 0 0 0 0 0
36894 - 0 0 0 0 0 0 0 0 0 0 0 0
36895 - 0 0 0 0 0 0 0 0 0 0 0 0
36896 - 0 0 0 0 0 0 0 0 0 0 0 0
36897 - 0 0 0 0 0 0 0 0 1 0 0 0
36898 - 0 0 1 0 0 0 0 0 1 0 0 0
36899 - 0 0 0 0 0 0 0 0 0 0 0 0
36900 - 0 0 0 0 0 0 0 0 0 0 0 0
36901 - 0 0 0 0 0 0 0 0 0 0 0 0
36902 - 0 0 0 0 0 0 0 0 0 0 0 0
36903 - 0 0 0 0 0 0 0 0 0 14 14 14
36904 - 42 42 42 94 94 94 14 14 14 101 101 101
36905 -128 128 128 2 2 6 18 18 18 116 116 116
36906 -118 98 46 121 92 8 121 92 8 98 78 10
36907 -162 162 162 106 106 106 2 2 6 2 2 6
36908 - 2 2 6 195 195 195 195 195 195 6 6 6
36909 - 2 2 6 2 2 6 2 2 6 2 2 6
36910 - 74 74 74 62 62 62 22 22 22 6 6 6
36911 - 0 0 0 0 0 0 0 0 0 0 0 0
36912 - 0 0 0 0 0 0 0 0 0 0 0 0
36913 - 0 0 0 0 0 0 0 0 0 0 0 0
36914 - 0 0 0 0 0 0 0 0 0 0 0 0
36915 - 0 0 0 0 0 0 0 0 0 0 0 0
36916 - 0 0 0 0 0 0 0 0 0 0 0 0
36917 - 0 0 0 0 0 0 0 0 1 0 0 1
36918 - 0 0 1 0 0 0 0 0 1 0 0 0
36919 - 0 0 0 0 0 0 0 0 0 0 0 0
36920 - 0 0 0 0 0 0 0 0 0 0 0 0
36921 - 0 0 0 0 0 0 0 0 0 0 0 0
36922 - 0 0 0 0 0 0 0 0 0 0 0 0
36923 - 0 0 0 0 0 0 0 0 0 10 10 10
36924 - 38 38 38 90 90 90 14 14 14 58 58 58
36925 -210 210 210 26 26 26 54 38 6 154 114 10
36926 -226 170 11 236 186 11 225 175 15 184 144 12
36927 -215 174 15 175 146 61 37 26 9 2 2 6
36928 - 70 70 70 246 246 246 138 138 138 2 2 6
36929 - 2 2 6 2 2 6 2 2 6 2 2 6
36930 - 70 70 70 66 66 66 26 26 26 6 6 6
36931 - 0 0 0 0 0 0 0 0 0 0 0 0
36932 - 0 0 0 0 0 0 0 0 0 0 0 0
36933 - 0 0 0 0 0 0 0 0 0 0 0 0
36934 - 0 0 0 0 0 0 0 0 0 0 0 0
36935 - 0 0 0 0 0 0 0 0 0 0 0 0
36936 - 0 0 0 0 0 0 0 0 0 0 0 0
36937 - 0 0 0 0 0 0 0 0 0 0 0 0
36938 - 0 0 0 0 0 0 0 0 0 0 0 0
36939 - 0 0 0 0 0 0 0 0 0 0 0 0
36940 - 0 0 0 0 0 0 0 0 0 0 0 0
36941 - 0 0 0 0 0 0 0 0 0 0 0 0
36942 - 0 0 0 0 0 0 0 0 0 0 0 0
36943 - 0 0 0 0 0 0 0 0 0 10 10 10
36944 - 38 38 38 86 86 86 14 14 14 10 10 10
36945 -195 195 195 188 164 115 192 133 9 225 175 15
36946 -239 182 13 234 190 10 232 195 16 232 200 30
36947 -245 207 45 241 208 19 232 195 16 184 144 12
36948 -218 194 134 211 206 186 42 42 42 2 2 6
36949 - 2 2 6 2 2 6 2 2 6 2 2 6
36950 - 50 50 50 74 74 74 30 30 30 6 6 6
36951 - 0 0 0 0 0 0 0 0 0 0 0 0
36952 - 0 0 0 0 0 0 0 0 0 0 0 0
36953 - 0 0 0 0 0 0 0 0 0 0 0 0
36954 - 0 0 0 0 0 0 0 0 0 0 0 0
36955 - 0 0 0 0 0 0 0 0 0 0 0 0
36956 - 0 0 0 0 0 0 0 0 0 0 0 0
36957 - 0 0 0 0 0 0 0 0 0 0 0 0
36958 - 0 0 0 0 0 0 0 0 0 0 0 0
36959 - 0 0 0 0 0 0 0 0 0 0 0 0
36960 - 0 0 0 0 0 0 0 0 0 0 0 0
36961 - 0 0 0 0 0 0 0 0 0 0 0 0
36962 - 0 0 0 0 0 0 0 0 0 0 0 0
36963 - 0 0 0 0 0 0 0 0 0 10 10 10
36964 - 34 34 34 86 86 86 14 14 14 2 2 6
36965 -121 87 25 192 133 9 219 162 10 239 182 13
36966 -236 186 11 232 195 16 241 208 19 244 214 54
36967 -246 218 60 246 218 38 246 215 20 241 208 19
36968 -241 208 19 226 184 13 121 87 25 2 2 6
36969 - 2 2 6 2 2 6 2 2 6 2 2 6
36970 - 50 50 50 82 82 82 34 34 34 10 10 10
36971 - 0 0 0 0 0 0 0 0 0 0 0 0
36972 - 0 0 0 0 0 0 0 0 0 0 0 0
36973 - 0 0 0 0 0 0 0 0 0 0 0 0
36974 - 0 0 0 0 0 0 0 0 0 0 0 0
36975 - 0 0 0 0 0 0 0 0 0 0 0 0
36976 - 0 0 0 0 0 0 0 0 0 0 0 0
36977 - 0 0 0 0 0 0 0 0 0 0 0 0
36978 - 0 0 0 0 0 0 0 0 0 0 0 0
36979 - 0 0 0 0 0 0 0 0 0 0 0 0
36980 - 0 0 0 0 0 0 0 0 0 0 0 0
36981 - 0 0 0 0 0 0 0 0 0 0 0 0
36982 - 0 0 0 0 0 0 0 0 0 0 0 0
36983 - 0 0 0 0 0 0 0 0 0 10 10 10
36984 - 34 34 34 82 82 82 30 30 30 61 42 6
36985 -180 123 7 206 145 10 230 174 11 239 182 13
36986 -234 190 10 238 202 15 241 208 19 246 218 74
36987 -246 218 38 246 215 20 246 215 20 246 215 20
36988 -226 184 13 215 174 15 184 144 12 6 6 6
36989 - 2 2 6 2 2 6 2 2 6 2 2 6
36990 - 26 26 26 94 94 94 42 42 42 14 14 14
36991 - 0 0 0 0 0 0 0 0 0 0 0 0
36992 - 0 0 0 0 0 0 0 0 0 0 0 0
36993 - 0 0 0 0 0 0 0 0 0 0 0 0
36994 - 0 0 0 0 0 0 0 0 0 0 0 0
36995 - 0 0 0 0 0 0 0 0 0 0 0 0
36996 - 0 0 0 0 0 0 0 0 0 0 0 0
36997 - 0 0 0 0 0 0 0 0 0 0 0 0
36998 - 0 0 0 0 0 0 0 0 0 0 0 0
36999 - 0 0 0 0 0 0 0 0 0 0 0 0
37000 - 0 0 0 0 0 0 0 0 0 0 0 0
37001 - 0 0 0 0 0 0 0 0 0 0 0 0
37002 - 0 0 0 0 0 0 0 0 0 0 0 0
37003 - 0 0 0 0 0 0 0 0 0 10 10 10
37004 - 30 30 30 78 78 78 50 50 50 104 69 6
37005 -192 133 9 216 158 10 236 178 12 236 186 11
37006 -232 195 16 241 208 19 244 214 54 245 215 43
37007 -246 215 20 246 215 20 241 208 19 198 155 10
37008 -200 144 11 216 158 10 156 118 10 2 2 6
37009 - 2 2 6 2 2 6 2 2 6 2 2 6
37010 - 6 6 6 90 90 90 54 54 54 18 18 18
37011 - 6 6 6 0 0 0 0 0 0 0 0 0
37012 - 0 0 0 0 0 0 0 0 0 0 0 0
37013 - 0 0 0 0 0 0 0 0 0 0 0 0
37014 - 0 0 0 0 0 0 0 0 0 0 0 0
37015 - 0 0 0 0 0 0 0 0 0 0 0 0
37016 - 0 0 0 0 0 0 0 0 0 0 0 0
37017 - 0 0 0 0 0 0 0 0 0 0 0 0
37018 - 0 0 0 0 0 0 0 0 0 0 0 0
37019 - 0 0 0 0 0 0 0 0 0 0 0 0
37020 - 0 0 0 0 0 0 0 0 0 0 0 0
37021 - 0 0 0 0 0 0 0 0 0 0 0 0
37022 - 0 0 0 0 0 0 0 0 0 0 0 0
37023 - 0 0 0 0 0 0 0 0 0 10 10 10
37024 - 30 30 30 78 78 78 46 46 46 22 22 22
37025 -137 92 6 210 162 10 239 182 13 238 190 10
37026 -238 202 15 241 208 19 246 215 20 246 215 20
37027 -241 208 19 203 166 17 185 133 11 210 150 10
37028 -216 158 10 210 150 10 102 78 10 2 2 6
37029 - 6 6 6 54 54 54 14 14 14 2 2 6
37030 - 2 2 6 62 62 62 74 74 74 30 30 30
37031 - 10 10 10 0 0 0 0 0 0 0 0 0
37032 - 0 0 0 0 0 0 0 0 0 0 0 0
37033 - 0 0 0 0 0 0 0 0 0 0 0 0
37034 - 0 0 0 0 0 0 0 0 0 0 0 0
37035 - 0 0 0 0 0 0 0 0 0 0 0 0
37036 - 0 0 0 0 0 0 0 0 0 0 0 0
37037 - 0 0 0 0 0 0 0 0 0 0 0 0
37038 - 0 0 0 0 0 0 0 0 0 0 0 0
37039 - 0 0 0 0 0 0 0 0 0 0 0 0
37040 - 0 0 0 0 0 0 0 0 0 0 0 0
37041 - 0 0 0 0 0 0 0 0 0 0 0 0
37042 - 0 0 0 0 0 0 0 0 0 0 0 0
37043 - 0 0 0 0 0 0 0 0 0 10 10 10
37044 - 34 34 34 78 78 78 50 50 50 6 6 6
37045 - 94 70 30 139 102 15 190 146 13 226 184 13
37046 -232 200 30 232 195 16 215 174 15 190 146 13
37047 -168 122 10 192 133 9 210 150 10 213 154 11
37048 -202 150 34 182 157 106 101 98 89 2 2 6
37049 - 2 2 6 78 78 78 116 116 116 58 58 58
37050 - 2 2 6 22 22 22 90 90 90 46 46 46
37051 - 18 18 18 6 6 6 0 0 0 0 0 0
37052 - 0 0 0 0 0 0 0 0 0 0 0 0
37053 - 0 0 0 0 0 0 0 0 0 0 0 0
37054 - 0 0 0 0 0 0 0 0 0 0 0 0
37055 - 0 0 0 0 0 0 0 0 0 0 0 0
37056 - 0 0 0 0 0 0 0 0 0 0 0 0
37057 - 0 0 0 0 0 0 0 0 0 0 0 0
37058 - 0 0 0 0 0 0 0 0 0 0 0 0
37059 - 0 0 0 0 0 0 0 0 0 0 0 0
37060 - 0 0 0 0 0 0 0 0 0 0 0 0
37061 - 0 0 0 0 0 0 0 0 0 0 0 0
37062 - 0 0 0 0 0 0 0 0 0 0 0 0
37063 - 0 0 0 0 0 0 0 0 0 10 10 10
37064 - 38 38 38 86 86 86 50 50 50 6 6 6
37065 -128 128 128 174 154 114 156 107 11 168 122 10
37066 -198 155 10 184 144 12 197 138 11 200 144 11
37067 -206 145 10 206 145 10 197 138 11 188 164 115
37068 -195 195 195 198 198 198 174 174 174 14 14 14
37069 - 2 2 6 22 22 22 116 116 116 116 116 116
37070 - 22 22 22 2 2 6 74 74 74 70 70 70
37071 - 30 30 30 10 10 10 0 0 0 0 0 0
37072 - 0 0 0 0 0 0 0 0 0 0 0 0
37073 - 0 0 0 0 0 0 0 0 0 0 0 0
37074 - 0 0 0 0 0 0 0 0 0 0 0 0
37075 - 0 0 0 0 0 0 0 0 0 0 0 0
37076 - 0 0 0 0 0 0 0 0 0 0 0 0
37077 - 0 0 0 0 0 0 0 0 0 0 0 0
37078 - 0 0 0 0 0 0 0 0 0 0 0 0
37079 - 0 0 0 0 0 0 0 0 0 0 0 0
37080 - 0 0 0 0 0 0 0 0 0 0 0 0
37081 - 0 0 0 0 0 0 0 0 0 0 0 0
37082 - 0 0 0 0 0 0 0 0 0 0 0 0
37083 - 0 0 0 0 0 0 6 6 6 18 18 18
37084 - 50 50 50 101 101 101 26 26 26 10 10 10
37085 -138 138 138 190 190 190 174 154 114 156 107 11
37086 -197 138 11 200 144 11 197 138 11 192 133 9
37087 -180 123 7 190 142 34 190 178 144 187 187 187
37088 -202 202 202 221 221 221 214 214 214 66 66 66
37089 - 2 2 6 2 2 6 50 50 50 62 62 62
37090 - 6 6 6 2 2 6 10 10 10 90 90 90
37091 - 50 50 50 18 18 18 6 6 6 0 0 0
37092 - 0 0 0 0 0 0 0 0 0 0 0 0
37093 - 0 0 0 0 0 0 0 0 0 0 0 0
37094 - 0 0 0 0 0 0 0 0 0 0 0 0
37095 - 0 0 0 0 0 0 0 0 0 0 0 0
37096 - 0 0 0 0 0 0 0 0 0 0 0 0
37097 - 0 0 0 0 0 0 0 0 0 0 0 0
37098 - 0 0 0 0 0 0 0 0 0 0 0 0
37099 - 0 0 0 0 0 0 0 0 0 0 0 0
37100 - 0 0 0 0 0 0 0 0 0 0 0 0
37101 - 0 0 0 0 0 0 0 0 0 0 0 0
37102 - 0 0 0 0 0 0 0 0 0 0 0 0
37103 - 0 0 0 0 0 0 10 10 10 34 34 34
37104 - 74 74 74 74 74 74 2 2 6 6 6 6
37105 -144 144 144 198 198 198 190 190 190 178 166 146
37106 -154 121 60 156 107 11 156 107 11 168 124 44
37107 -174 154 114 187 187 187 190 190 190 210 210 210
37108 -246 246 246 253 253 253 253 253 253 182 182 182
37109 - 6 6 6 2 2 6 2 2 6 2 2 6
37110 - 2 2 6 2 2 6 2 2 6 62 62 62
37111 - 74 74 74 34 34 34 14 14 14 0 0 0
37112 - 0 0 0 0 0 0 0 0 0 0 0 0
37113 - 0 0 0 0 0 0 0 0 0 0 0 0
37114 - 0 0 0 0 0 0 0 0 0 0 0 0
37115 - 0 0 0 0 0 0 0 0 0 0 0 0
37116 - 0 0 0 0 0 0 0 0 0 0 0 0
37117 - 0 0 0 0 0 0 0 0 0 0 0 0
37118 - 0 0 0 0 0 0 0 0 0 0 0 0
37119 - 0 0 0 0 0 0 0 0 0 0 0 0
37120 - 0 0 0 0 0 0 0 0 0 0 0 0
37121 - 0 0 0 0 0 0 0 0 0 0 0 0
37122 - 0 0 0 0 0 0 0 0 0 0 0 0
37123 - 0 0 0 10 10 10 22 22 22 54 54 54
37124 - 94 94 94 18 18 18 2 2 6 46 46 46
37125 -234 234 234 221 221 221 190 190 190 190 190 190
37126 -190 190 190 187 187 187 187 187 187 190 190 190
37127 -190 190 190 195 195 195 214 214 214 242 242 242
37128 -253 253 253 253 253 253 253 253 253 253 253 253
37129 - 82 82 82 2 2 6 2 2 6 2 2 6
37130 - 2 2 6 2 2 6 2 2 6 14 14 14
37131 - 86 86 86 54 54 54 22 22 22 6 6 6
37132 - 0 0 0 0 0 0 0 0 0 0 0 0
37133 - 0 0 0 0 0 0 0 0 0 0 0 0
37134 - 0 0 0 0 0 0 0 0 0 0 0 0
37135 - 0 0 0 0 0 0 0 0 0 0 0 0
37136 - 0 0 0 0 0 0 0 0 0 0 0 0
37137 - 0 0 0 0 0 0 0 0 0 0 0 0
37138 - 0 0 0 0 0 0 0 0 0 0 0 0
37139 - 0 0 0 0 0 0 0 0 0 0 0 0
37140 - 0 0 0 0 0 0 0 0 0 0 0 0
37141 - 0 0 0 0 0 0 0 0 0 0 0 0
37142 - 0 0 0 0 0 0 0 0 0 0 0 0
37143 - 6 6 6 18 18 18 46 46 46 90 90 90
37144 - 46 46 46 18 18 18 6 6 6 182 182 182
37145 -253 253 253 246 246 246 206 206 206 190 190 190
37146 -190 190 190 190 190 190 190 190 190 190 190 190
37147 -206 206 206 231 231 231 250 250 250 253 253 253
37148 -253 253 253 253 253 253 253 253 253 253 253 253
37149 -202 202 202 14 14 14 2 2 6 2 2 6
37150 - 2 2 6 2 2 6 2 2 6 2 2 6
37151 - 42 42 42 86 86 86 42 42 42 18 18 18
37152 - 6 6 6 0 0 0 0 0 0 0 0 0
37153 - 0 0 0 0 0 0 0 0 0 0 0 0
37154 - 0 0 0 0 0 0 0 0 0 0 0 0
37155 - 0 0 0 0 0 0 0 0 0 0 0 0
37156 - 0 0 0 0 0 0 0 0 0 0 0 0
37157 - 0 0 0 0 0 0 0 0 0 0 0 0
37158 - 0 0 0 0 0 0 0 0 0 0 0 0
37159 - 0 0 0 0 0 0 0 0 0 0 0 0
37160 - 0 0 0 0 0 0 0 0 0 0 0 0
37161 - 0 0 0 0 0 0 0 0 0 0 0 0
37162 - 0 0 0 0 0 0 0 0 0 6 6 6
37163 - 14 14 14 38 38 38 74 74 74 66 66 66
37164 - 2 2 6 6 6 6 90 90 90 250 250 250
37165 -253 253 253 253 253 253 238 238 238 198 198 198
37166 -190 190 190 190 190 190 195 195 195 221 221 221
37167 -246 246 246 253 253 253 253 253 253 253 253 253
37168 -253 253 253 253 253 253 253 253 253 253 253 253
37169 -253 253 253 82 82 82 2 2 6 2 2 6
37170 - 2 2 6 2 2 6 2 2 6 2 2 6
37171 - 2 2 6 78 78 78 70 70 70 34 34 34
37172 - 14 14 14 6 6 6 0 0 0 0 0 0
37173 - 0 0 0 0 0 0 0 0 0 0 0 0
37174 - 0 0 0 0 0 0 0 0 0 0 0 0
37175 - 0 0 0 0 0 0 0 0 0 0 0 0
37176 - 0 0 0 0 0 0 0 0 0 0 0 0
37177 - 0 0 0 0 0 0 0 0 0 0 0 0
37178 - 0 0 0 0 0 0 0 0 0 0 0 0
37179 - 0 0 0 0 0 0 0 0 0 0 0 0
37180 - 0 0 0 0 0 0 0 0 0 0 0 0
37181 - 0 0 0 0 0 0 0 0 0 0 0 0
37182 - 0 0 0 0 0 0 0 0 0 14 14 14
37183 - 34 34 34 66 66 66 78 78 78 6 6 6
37184 - 2 2 6 18 18 18 218 218 218 253 253 253
37185 -253 253 253 253 253 253 253 253 253 246 246 246
37186 -226 226 226 231 231 231 246 246 246 253 253 253
37187 -253 253 253 253 253 253 253 253 253 253 253 253
37188 -253 253 253 253 253 253 253 253 253 253 253 253
37189 -253 253 253 178 178 178 2 2 6 2 2 6
37190 - 2 2 6 2 2 6 2 2 6 2 2 6
37191 - 2 2 6 18 18 18 90 90 90 62 62 62
37192 - 30 30 30 10 10 10 0 0 0 0 0 0
37193 - 0 0 0 0 0 0 0 0 0 0 0 0
37194 - 0 0 0 0 0 0 0 0 0 0 0 0
37195 - 0 0 0 0 0 0 0 0 0 0 0 0
37196 - 0 0 0 0 0 0 0 0 0 0 0 0
37197 - 0 0 0 0 0 0 0 0 0 0 0 0
37198 - 0 0 0 0 0 0 0 0 0 0 0 0
37199 - 0 0 0 0 0 0 0 0 0 0 0 0
37200 - 0 0 0 0 0 0 0 0 0 0 0 0
37201 - 0 0 0 0 0 0 0 0 0 0 0 0
37202 - 0 0 0 0 0 0 10 10 10 26 26 26
37203 - 58 58 58 90 90 90 18 18 18 2 2 6
37204 - 2 2 6 110 110 110 253 253 253 253 253 253
37205 -253 253 253 253 253 253 253 253 253 253 253 253
37206 -250 250 250 253 253 253 253 253 253 253 253 253
37207 -253 253 253 253 253 253 253 253 253 253 253 253
37208 -253 253 253 253 253 253 253 253 253 253 253 253
37209 -253 253 253 231 231 231 18 18 18 2 2 6
37210 - 2 2 6 2 2 6 2 2 6 2 2 6
37211 - 2 2 6 2 2 6 18 18 18 94 94 94
37212 - 54 54 54 26 26 26 10 10 10 0 0 0
37213 - 0 0 0 0 0 0 0 0 0 0 0 0
37214 - 0 0 0 0 0 0 0 0 0 0 0 0
37215 - 0 0 0 0 0 0 0 0 0 0 0 0
37216 - 0 0 0 0 0 0 0 0 0 0 0 0
37217 - 0 0 0 0 0 0 0 0 0 0 0 0
37218 - 0 0 0 0 0 0 0 0 0 0 0 0
37219 - 0 0 0 0 0 0 0 0 0 0 0 0
37220 - 0 0 0 0 0 0 0 0 0 0 0 0
37221 - 0 0 0 0 0 0 0 0 0 0 0 0
37222 - 0 0 0 6 6 6 22 22 22 50 50 50
37223 - 90 90 90 26 26 26 2 2 6 2 2 6
37224 - 14 14 14 195 195 195 250 250 250 253 253 253
37225 -253 253 253 253 253 253 253 253 253 253 253 253
37226 -253 253 253 253 253 253 253 253 253 253 253 253
37227 -253 253 253 253 253 253 253 253 253 253 253 253
37228 -253 253 253 253 253 253 253 253 253 253 253 253
37229 -250 250 250 242 242 242 54 54 54 2 2 6
37230 - 2 2 6 2 2 6 2 2 6 2 2 6
37231 - 2 2 6 2 2 6 2 2 6 38 38 38
37232 - 86 86 86 50 50 50 22 22 22 6 6 6
37233 - 0 0 0 0 0 0 0 0 0 0 0 0
37234 - 0 0 0 0 0 0 0 0 0 0 0 0
37235 - 0 0 0 0 0 0 0 0 0 0 0 0
37236 - 0 0 0 0 0 0 0 0 0 0 0 0
37237 - 0 0 0 0 0 0 0 0 0 0 0 0
37238 - 0 0 0 0 0 0 0 0 0 0 0 0
37239 - 0 0 0 0 0 0 0 0 0 0 0 0
37240 - 0 0 0 0 0 0 0 0 0 0 0 0
37241 - 0 0 0 0 0 0 0 0 0 0 0 0
37242 - 6 6 6 14 14 14 38 38 38 82 82 82
37243 - 34 34 34 2 2 6 2 2 6 2 2 6
37244 - 42 42 42 195 195 195 246 246 246 253 253 253
37245 -253 253 253 253 253 253 253 253 253 250 250 250
37246 -242 242 242 242 242 242 250 250 250 253 253 253
37247 -253 253 253 253 253 253 253 253 253 253 253 253
37248 -253 253 253 250 250 250 246 246 246 238 238 238
37249 -226 226 226 231 231 231 101 101 101 6 6 6
37250 - 2 2 6 2 2 6 2 2 6 2 2 6
37251 - 2 2 6 2 2 6 2 2 6 2 2 6
37252 - 38 38 38 82 82 82 42 42 42 14 14 14
37253 - 6 6 6 0 0 0 0 0 0 0 0 0
37254 - 0 0 0 0 0 0 0 0 0 0 0 0
37255 - 0 0 0 0 0 0 0 0 0 0 0 0
37256 - 0 0 0 0 0 0 0 0 0 0 0 0
37257 - 0 0 0 0 0 0 0 0 0 0 0 0
37258 - 0 0 0 0 0 0 0 0 0 0 0 0
37259 - 0 0 0 0 0 0 0 0 0 0 0 0
37260 - 0 0 0 0 0 0 0 0 0 0 0 0
37261 - 0 0 0 0 0 0 0 0 0 0 0 0
37262 - 10 10 10 26 26 26 62 62 62 66 66 66
37263 - 2 2 6 2 2 6 2 2 6 6 6 6
37264 - 70 70 70 170 170 170 206 206 206 234 234 234
37265 -246 246 246 250 250 250 250 250 250 238 238 238
37266 -226 226 226 231 231 231 238 238 238 250 250 250
37267 -250 250 250 250 250 250 246 246 246 231 231 231
37268 -214 214 214 206 206 206 202 202 202 202 202 202
37269 -198 198 198 202 202 202 182 182 182 18 18 18
37270 - 2 2 6 2 2 6 2 2 6 2 2 6
37271 - 2 2 6 2 2 6 2 2 6 2 2 6
37272 - 2 2 6 62 62 62 66 66 66 30 30 30
37273 - 10 10 10 0 0 0 0 0 0 0 0 0
37274 - 0 0 0 0 0 0 0 0 0 0 0 0
37275 - 0 0 0 0 0 0 0 0 0 0 0 0
37276 - 0 0 0 0 0 0 0 0 0 0 0 0
37277 - 0 0 0 0 0 0 0 0 0 0 0 0
37278 - 0 0 0 0 0 0 0 0 0 0 0 0
37279 - 0 0 0 0 0 0 0 0 0 0 0 0
37280 - 0 0 0 0 0 0 0 0 0 0 0 0
37281 - 0 0 0 0 0 0 0 0 0 0 0 0
37282 - 14 14 14 42 42 42 82 82 82 18 18 18
37283 - 2 2 6 2 2 6 2 2 6 10 10 10
37284 - 94 94 94 182 182 182 218 218 218 242 242 242
37285 -250 250 250 253 253 253 253 253 253 250 250 250
37286 -234 234 234 253 253 253 253 253 253 253 253 253
37287 -253 253 253 253 253 253 253 253 253 246 246 246
37288 -238 238 238 226 226 226 210 210 210 202 202 202
37289 -195 195 195 195 195 195 210 210 210 158 158 158
37290 - 6 6 6 14 14 14 50 50 50 14 14 14
37291 - 2 2 6 2 2 6 2 2 6 2 2 6
37292 - 2 2 6 6 6 6 86 86 86 46 46 46
37293 - 18 18 18 6 6 6 0 0 0 0 0 0
37294 - 0 0 0 0 0 0 0 0 0 0 0 0
37295 - 0 0 0 0 0 0 0 0 0 0 0 0
37296 - 0 0 0 0 0 0 0 0 0 0 0 0
37297 - 0 0 0 0 0 0 0 0 0 0 0 0
37298 - 0 0 0 0 0 0 0 0 0 0 0 0
37299 - 0 0 0 0 0 0 0 0 0 0 0 0
37300 - 0 0 0 0 0 0 0 0 0 0 0 0
37301 - 0 0 0 0 0 0 0 0 0 6 6 6
37302 - 22 22 22 54 54 54 70 70 70 2 2 6
37303 - 2 2 6 10 10 10 2 2 6 22 22 22
37304 -166 166 166 231 231 231 250 250 250 253 253 253
37305 -253 253 253 253 253 253 253 253 253 250 250 250
37306 -242 242 242 253 253 253 253 253 253 253 253 253
37307 -253 253 253 253 253 253 253 253 253 253 253 253
37308 -253 253 253 253 253 253 253 253 253 246 246 246
37309 -231 231 231 206 206 206 198 198 198 226 226 226
37310 - 94 94 94 2 2 6 6 6 6 38 38 38
37311 - 30 30 30 2 2 6 2 2 6 2 2 6
37312 - 2 2 6 2 2 6 62 62 62 66 66 66
37313 - 26 26 26 10 10 10 0 0 0 0 0 0
37314 - 0 0 0 0 0 0 0 0 0 0 0 0
37315 - 0 0 0 0 0 0 0 0 0 0 0 0
37316 - 0 0 0 0 0 0 0 0 0 0 0 0
37317 - 0 0 0 0 0 0 0 0 0 0 0 0
37318 - 0 0 0 0 0 0 0 0 0 0 0 0
37319 - 0 0 0 0 0 0 0 0 0 0 0 0
37320 - 0 0 0 0 0 0 0 0 0 0 0 0
37321 - 0 0 0 0 0 0 0 0 0 10 10 10
37322 - 30 30 30 74 74 74 50 50 50 2 2 6
37323 - 26 26 26 26 26 26 2 2 6 106 106 106
37324 -238 238 238 253 253 253 253 253 253 253 253 253
37325 -253 253 253 253 253 253 253 253 253 253 253 253
37326 -253 253 253 253 253 253 253 253 253 253 253 253
37327 -253 253 253 253 253 253 253 253 253 253 253 253
37328 -253 253 253 253 253 253 253 253 253 253 253 253
37329 -253 253 253 246 246 246 218 218 218 202 202 202
37330 -210 210 210 14 14 14 2 2 6 2 2 6
37331 - 30 30 30 22 22 22 2 2 6 2 2 6
37332 - 2 2 6 2 2 6 18 18 18 86 86 86
37333 - 42 42 42 14 14 14 0 0 0 0 0 0
37334 - 0 0 0 0 0 0 0 0 0 0 0 0
37335 - 0 0 0 0 0 0 0 0 0 0 0 0
37336 - 0 0 0 0 0 0 0 0 0 0 0 0
37337 - 0 0 0 0 0 0 0 0 0 0 0 0
37338 - 0 0 0 0 0 0 0 0 0 0 0 0
37339 - 0 0 0 0 0 0 0 0 0 0 0 0
37340 - 0 0 0 0 0 0 0 0 0 0 0 0
37341 - 0 0 0 0 0 0 0 0 0 14 14 14
37342 - 42 42 42 90 90 90 22 22 22 2 2 6
37343 - 42 42 42 2 2 6 18 18 18 218 218 218
37344 -253 253 253 253 253 253 253 253 253 253 253 253
37345 -253 253 253 253 253 253 253 253 253 253 253 253
37346 -253 253 253 253 253 253 253 253 253 253 253 253
37347 -253 253 253 253 253 253 253 253 253 253 253 253
37348 -253 253 253 253 253 253 253 253 253 253 253 253
37349 -253 253 253 253 253 253 250 250 250 221 221 221
37350 -218 218 218 101 101 101 2 2 6 14 14 14
37351 - 18 18 18 38 38 38 10 10 10 2 2 6
37352 - 2 2 6 2 2 6 2 2 6 78 78 78
37353 - 58 58 58 22 22 22 6 6 6 0 0 0
37354 - 0 0 0 0 0 0 0 0 0 0 0 0
37355 - 0 0 0 0 0 0 0 0 0 0 0 0
37356 - 0 0 0 0 0 0 0 0 0 0 0 0
37357 - 0 0 0 0 0 0 0 0 0 0 0 0
37358 - 0 0 0 0 0 0 0 0 0 0 0 0
37359 - 0 0 0 0 0 0 0 0 0 0 0 0
37360 - 0 0 0 0 0 0 0 0 0 0 0 0
37361 - 0 0 0 0 0 0 6 6 6 18 18 18
37362 - 54 54 54 82 82 82 2 2 6 26 26 26
37363 - 22 22 22 2 2 6 123 123 123 253 253 253
37364 -253 253 253 253 253 253 253 253 253 253 253 253
37365 -253 253 253 253 253 253 253 253 253 253 253 253
37366 -253 253 253 253 253 253 253 253 253 253 253 253
37367 -253 253 253 253 253 253 253 253 253 253 253 253
37368 -253 253 253 253 253 253 253 253 253 253 253 253
37369 -253 253 253 253 253 253 253 253 253 250 250 250
37370 -238 238 238 198 198 198 6 6 6 38 38 38
37371 - 58 58 58 26 26 26 38 38 38 2 2 6
37372 - 2 2 6 2 2 6 2 2 6 46 46 46
37373 - 78 78 78 30 30 30 10 10 10 0 0 0
37374 - 0 0 0 0 0 0 0 0 0 0 0 0
37375 - 0 0 0 0 0 0 0 0 0 0 0 0
37376 - 0 0 0 0 0 0 0 0 0 0 0 0
37377 - 0 0 0 0 0 0 0 0 0 0 0 0
37378 - 0 0 0 0 0 0 0 0 0 0 0 0
37379 - 0 0 0 0 0 0 0 0 0 0 0 0
37380 - 0 0 0 0 0 0 0 0 0 0 0 0
37381 - 0 0 0 0 0 0 10 10 10 30 30 30
37382 - 74 74 74 58 58 58 2 2 6 42 42 42
37383 - 2 2 6 22 22 22 231 231 231 253 253 253
37384 -253 253 253 253 253 253 253 253 253 253 253 253
37385 -253 253 253 253 253 253 253 253 253 250 250 250
37386 -253 253 253 253 253 253 253 253 253 253 253 253
37387 -253 253 253 253 253 253 253 253 253 253 253 253
37388 -253 253 253 253 253 253 253 253 253 253 253 253
37389 -253 253 253 253 253 253 253 253 253 253 253 253
37390 -253 253 253 246 246 246 46 46 46 38 38 38
37391 - 42 42 42 14 14 14 38 38 38 14 14 14
37392 - 2 2 6 2 2 6 2 2 6 6 6 6
37393 - 86 86 86 46 46 46 14 14 14 0 0 0
37394 - 0 0 0 0 0 0 0 0 0 0 0 0
37395 - 0 0 0 0 0 0 0 0 0 0 0 0
37396 - 0 0 0 0 0 0 0 0 0 0 0 0
37397 - 0 0 0 0 0 0 0 0 0 0 0 0
37398 - 0 0 0 0 0 0 0 0 0 0 0 0
37399 - 0 0 0 0 0 0 0 0 0 0 0 0
37400 - 0 0 0 0 0 0 0 0 0 0 0 0
37401 - 0 0 0 6 6 6 14 14 14 42 42 42
37402 - 90 90 90 18 18 18 18 18 18 26 26 26
37403 - 2 2 6 116 116 116 253 253 253 253 253 253
37404 -253 253 253 253 253 253 253 253 253 253 253 253
37405 -253 253 253 253 253 253 250 250 250 238 238 238
37406 -253 253 253 253 253 253 253 253 253 253 253 253
37407 -253 253 253 253 253 253 253 253 253 253 253 253
37408 -253 253 253 253 253 253 253 253 253 253 253 253
37409 -253 253 253 253 253 253 253 253 253 253 253 253
37410 -253 253 253 253 253 253 94 94 94 6 6 6
37411 - 2 2 6 2 2 6 10 10 10 34 34 34
37412 - 2 2 6 2 2 6 2 2 6 2 2 6
37413 - 74 74 74 58 58 58 22 22 22 6 6 6
37414 - 0 0 0 0 0 0 0 0 0 0 0 0
37415 - 0 0 0 0 0 0 0 0 0 0 0 0
37416 - 0 0 0 0 0 0 0 0 0 0 0 0
37417 - 0 0 0 0 0 0 0 0 0 0 0 0
37418 - 0 0 0 0 0 0 0 0 0 0 0 0
37419 - 0 0 0 0 0 0 0 0 0 0 0 0
37420 - 0 0 0 0 0 0 0 0 0 0 0 0
37421 - 0 0 0 10 10 10 26 26 26 66 66 66
37422 - 82 82 82 2 2 6 38 38 38 6 6 6
37423 - 14 14 14 210 210 210 253 253 253 253 253 253
37424 -253 253 253 253 253 253 253 253 253 253 253 253
37425 -253 253 253 253 253 253 246 246 246 242 242 242
37426 -253 253 253 253 253 253 253 253 253 253 253 253
37427 -253 253 253 253 253 253 253 253 253 253 253 253
37428 -253 253 253 253 253 253 253 253 253 253 253 253
37429 -253 253 253 253 253 253 253 253 253 253 253 253
37430 -253 253 253 253 253 253 144 144 144 2 2 6
37431 - 2 2 6 2 2 6 2 2 6 46 46 46
37432 - 2 2 6 2 2 6 2 2 6 2 2 6
37433 - 42 42 42 74 74 74 30 30 30 10 10 10
37434 - 0 0 0 0 0 0 0 0 0 0 0 0
37435 - 0 0 0 0 0 0 0 0 0 0 0 0
37436 - 0 0 0 0 0 0 0 0 0 0 0 0
37437 - 0 0 0 0 0 0 0 0 0 0 0 0
37438 - 0 0 0 0 0 0 0 0 0 0 0 0
37439 - 0 0 0 0 0 0 0 0 0 0 0 0
37440 - 0 0 0 0 0 0 0 0 0 0 0 0
37441 - 6 6 6 14 14 14 42 42 42 90 90 90
37442 - 26 26 26 6 6 6 42 42 42 2 2 6
37443 - 74 74 74 250 250 250 253 253 253 253 253 253
37444 -253 253 253 253 253 253 253 253 253 253 253 253
37445 -253 253 253 253 253 253 242 242 242 242 242 242
37446 -253 253 253 253 253 253 253 253 253 253 253 253
37447 -253 253 253 253 253 253 253 253 253 253 253 253
37448 -253 253 253 253 253 253 253 253 253 253 253 253
37449 -253 253 253 253 253 253 253 253 253 253 253 253
37450 -253 253 253 253 253 253 182 182 182 2 2 6
37451 - 2 2 6 2 2 6 2 2 6 46 46 46
37452 - 2 2 6 2 2 6 2 2 6 2 2 6
37453 - 10 10 10 86 86 86 38 38 38 10 10 10
37454 - 0 0 0 0 0 0 0 0 0 0 0 0
37455 - 0 0 0 0 0 0 0 0 0 0 0 0
37456 - 0 0 0 0 0 0 0 0 0 0 0 0
37457 - 0 0 0 0 0 0 0 0 0 0 0 0
37458 - 0 0 0 0 0 0 0 0 0 0 0 0
37459 - 0 0 0 0 0 0 0 0 0 0 0 0
37460 - 0 0 0 0 0 0 0 0 0 0 0 0
37461 - 10 10 10 26 26 26 66 66 66 82 82 82
37462 - 2 2 6 22 22 22 18 18 18 2 2 6
37463 -149 149 149 253 253 253 253 253 253 253 253 253
37464 -253 253 253 253 253 253 253 253 253 253 253 253
37465 -253 253 253 253 253 253 234 234 234 242 242 242
37466 -253 253 253 253 253 253 253 253 253 253 253 253
37467 -253 253 253 253 253 253 253 253 253 253 253 253
37468 -253 253 253 253 253 253 253 253 253 253 253 253
37469 -253 253 253 253 253 253 253 253 253 253 253 253
37470 -253 253 253 253 253 253 206 206 206 2 2 6
37471 - 2 2 6 2 2 6 2 2 6 38 38 38
37472 - 2 2 6 2 2 6 2 2 6 2 2 6
37473 - 6 6 6 86 86 86 46 46 46 14 14 14
37474 - 0 0 0 0 0 0 0 0 0 0 0 0
37475 - 0 0 0 0 0 0 0 0 0 0 0 0
37476 - 0 0 0 0 0 0 0 0 0 0 0 0
37477 - 0 0 0 0 0 0 0 0 0 0 0 0
37478 - 0 0 0 0 0 0 0 0 0 0 0 0
37479 - 0 0 0 0 0 0 0 0 0 0 0 0
37480 - 0 0 0 0 0 0 0 0 0 6 6 6
37481 - 18 18 18 46 46 46 86 86 86 18 18 18
37482 - 2 2 6 34 34 34 10 10 10 6 6 6
37483 -210 210 210 253 253 253 253 253 253 253 253 253
37484 -253 253 253 253 253 253 253 253 253 253 253 253
37485 -253 253 253 253 253 253 234 234 234 242 242 242
37486 -253 253 253 253 253 253 253 253 253 253 253 253
37487 -253 253 253 253 253 253 253 253 253 253 253 253
37488 -253 253 253 253 253 253 253 253 253 253 253 253
37489 -253 253 253 253 253 253 253 253 253 253 253 253
37490 -253 253 253 253 253 253 221 221 221 6 6 6
37491 - 2 2 6 2 2 6 6 6 6 30 30 30
37492 - 2 2 6 2 2 6 2 2 6 2 2 6
37493 - 2 2 6 82 82 82 54 54 54 18 18 18
37494 - 6 6 6 0 0 0 0 0 0 0 0 0
37495 - 0 0 0 0 0 0 0 0 0 0 0 0
37496 - 0 0 0 0 0 0 0 0 0 0 0 0
37497 - 0 0 0 0 0 0 0 0 0 0 0 0
37498 - 0 0 0 0 0 0 0 0 0 0 0 0
37499 - 0 0 0 0 0 0 0 0 0 0 0 0
37500 - 0 0 0 0 0 0 0 0 0 10 10 10
37501 - 26 26 26 66 66 66 62 62 62 2 2 6
37502 - 2 2 6 38 38 38 10 10 10 26 26 26
37503 -238 238 238 253 253 253 253 253 253 253 253 253
37504 -253 253 253 253 253 253 253 253 253 253 253 253
37505 -253 253 253 253 253 253 231 231 231 238 238 238
37506 -253 253 253 253 253 253 253 253 253 253 253 253
37507 -253 253 253 253 253 253 253 253 253 253 253 253
37508 -253 253 253 253 253 253 253 253 253 253 253 253
37509 -253 253 253 253 253 253 253 253 253 253 253 253
37510 -253 253 253 253 253 253 231 231 231 6 6 6
37511 - 2 2 6 2 2 6 10 10 10 30 30 30
37512 - 2 2 6 2 2 6 2 2 6 2 2 6
37513 - 2 2 6 66 66 66 58 58 58 22 22 22
37514 - 6 6 6 0 0 0 0 0 0 0 0 0
37515 - 0 0 0 0 0 0 0 0 0 0 0 0
37516 - 0 0 0 0 0 0 0 0 0 0 0 0
37517 - 0 0 0 0 0 0 0 0 0 0 0 0
37518 - 0 0 0 0 0 0 0 0 0 0 0 0
37519 - 0 0 0 0 0 0 0 0 0 0 0 0
37520 - 0 0 0 0 0 0 0 0 0 10 10 10
37521 - 38 38 38 78 78 78 6 6 6 2 2 6
37522 - 2 2 6 46 46 46 14 14 14 42 42 42
37523 -246 246 246 253 253 253 253 253 253 253 253 253
37524 -253 253 253 253 253 253 253 253 253 253 253 253
37525 -253 253 253 253 253 253 231 231 231 242 242 242
37526 -253 253 253 253 253 253 253 253 253 253 253 253
37527 -253 253 253 253 253 253 253 253 253 253 253 253
37528 -253 253 253 253 253 253 253 253 253 253 253 253
37529 -253 253 253 253 253 253 253 253 253 253 253 253
37530 -253 253 253 253 253 253 234 234 234 10 10 10
37531 - 2 2 6 2 2 6 22 22 22 14 14 14
37532 - 2 2 6 2 2 6 2 2 6 2 2 6
37533 - 2 2 6 66 66 66 62 62 62 22 22 22
37534 - 6 6 6 0 0 0 0 0 0 0 0 0
37535 - 0 0 0 0 0 0 0 0 0 0 0 0
37536 - 0 0 0 0 0 0 0 0 0 0 0 0
37537 - 0 0 0 0 0 0 0 0 0 0 0 0
37538 - 0 0 0 0 0 0 0 0 0 0 0 0
37539 - 0 0 0 0 0 0 0 0 0 0 0 0
37540 - 0 0 0 0 0 0 6 6 6 18 18 18
37541 - 50 50 50 74 74 74 2 2 6 2 2 6
37542 - 14 14 14 70 70 70 34 34 34 62 62 62
37543 -250 250 250 253 253 253 253 253 253 253 253 253
37544 -253 253 253 253 253 253 253 253 253 253 253 253
37545 -253 253 253 253 253 253 231 231 231 246 246 246
37546 -253 253 253 253 253 253 253 253 253 253 253 253
37547 -253 253 253 253 253 253 253 253 253 253 253 253
37548 -253 253 253 253 253 253 253 253 253 253 253 253
37549 -253 253 253 253 253 253 253 253 253 253 253 253
37550 -253 253 253 253 253 253 234 234 234 14 14 14
37551 - 2 2 6 2 2 6 30 30 30 2 2 6
37552 - 2 2 6 2 2 6 2 2 6 2 2 6
37553 - 2 2 6 66 66 66 62 62 62 22 22 22
37554 - 6 6 6 0 0 0 0 0 0 0 0 0
37555 - 0 0 0 0 0 0 0 0 0 0 0 0
37556 - 0 0 0 0 0 0 0 0 0 0 0 0
37557 - 0 0 0 0 0 0 0 0 0 0 0 0
37558 - 0 0 0 0 0 0 0 0 0 0 0 0
37559 - 0 0 0 0 0 0 0 0 0 0 0 0
37560 - 0 0 0 0 0 0 6 6 6 18 18 18
37561 - 54 54 54 62 62 62 2 2 6 2 2 6
37562 - 2 2 6 30 30 30 46 46 46 70 70 70
37563 -250 250 250 253 253 253 253 253 253 253 253 253
37564 -253 253 253 253 253 253 253 253 253 253 253 253
37565 -253 253 253 253 253 253 231 231 231 246 246 246
37566 -253 253 253 253 253 253 253 253 253 253 253 253
37567 -253 253 253 253 253 253 253 253 253 253 253 253
37568 -253 253 253 253 253 253 253 253 253 253 253 253
37569 -253 253 253 253 253 253 253 253 253 253 253 253
37570 -253 253 253 253 253 253 226 226 226 10 10 10
37571 - 2 2 6 6 6 6 30 30 30 2 2 6
37572 - 2 2 6 2 2 6 2 2 6 2 2 6
37573 - 2 2 6 66 66 66 58 58 58 22 22 22
37574 - 6 6 6 0 0 0 0 0 0 0 0 0
37575 - 0 0 0 0 0 0 0 0 0 0 0 0
37576 - 0 0 0 0 0 0 0 0 0 0 0 0
37577 - 0 0 0 0 0 0 0 0 0 0 0 0
37578 - 0 0 0 0 0 0 0 0 0 0 0 0
37579 - 0 0 0 0 0 0 0 0 0 0 0 0
37580 - 0 0 0 0 0 0 6 6 6 22 22 22
37581 - 58 58 58 62 62 62 2 2 6 2 2 6
37582 - 2 2 6 2 2 6 30 30 30 78 78 78
37583 -250 250 250 253 253 253 253 253 253 253 253 253
37584 -253 253 253 253 253 253 253 253 253 253 253 253
37585 -253 253 253 253 253 253 231 231 231 246 246 246
37586 -253 253 253 253 253 253 253 253 253 253 253 253
37587 -253 253 253 253 253 253 253 253 253 253 253 253
37588 -253 253 253 253 253 253 253 253 253 253 253 253
37589 -253 253 253 253 253 253 253 253 253 253 253 253
37590 -253 253 253 253 253 253 206 206 206 2 2 6
37591 - 22 22 22 34 34 34 18 14 6 22 22 22
37592 - 26 26 26 18 18 18 6 6 6 2 2 6
37593 - 2 2 6 82 82 82 54 54 54 18 18 18
37594 - 6 6 6 0 0 0 0 0 0 0 0 0
37595 - 0 0 0 0 0 0 0 0 0 0 0 0
37596 - 0 0 0 0 0 0 0 0 0 0 0 0
37597 - 0 0 0 0 0 0 0 0 0 0 0 0
37598 - 0 0 0 0 0 0 0 0 0 0 0 0
37599 - 0 0 0 0 0 0 0 0 0 0 0 0
37600 - 0 0 0 0 0 0 6 6 6 26 26 26
37601 - 62 62 62 106 106 106 74 54 14 185 133 11
37602 -210 162 10 121 92 8 6 6 6 62 62 62
37603 -238 238 238 253 253 253 253 253 253 253 253 253
37604 -253 253 253 253 253 253 253 253 253 253 253 253
37605 -253 253 253 253 253 253 231 231 231 246 246 246
37606 -253 253 253 253 253 253 253 253 253 253 253 253
37607 -253 253 253 253 253 253 253 253 253 253 253 253
37608 -253 253 253 253 253 253 253 253 253 253 253 253
37609 -253 253 253 253 253 253 253 253 253 253 253 253
37610 -253 253 253 253 253 253 158 158 158 18 18 18
37611 - 14 14 14 2 2 6 2 2 6 2 2 6
37612 - 6 6 6 18 18 18 66 66 66 38 38 38
37613 - 6 6 6 94 94 94 50 50 50 18 18 18
37614 - 6 6 6 0 0 0 0 0 0 0 0 0
37615 - 0 0 0 0 0 0 0 0 0 0 0 0
37616 - 0 0 0 0 0 0 0 0 0 0 0 0
37617 - 0 0 0 0 0 0 0 0 0 0 0 0
37618 - 0 0 0 0 0 0 0 0 0 0 0 0
37619 - 0 0 0 0 0 0 0 0 0 6 6 6
37620 - 10 10 10 10 10 10 18 18 18 38 38 38
37621 - 78 78 78 142 134 106 216 158 10 242 186 14
37622 -246 190 14 246 190 14 156 118 10 10 10 10
37623 - 90 90 90 238 238 238 253 253 253 253 253 253
37624 -253 253 253 253 253 253 253 253 253 253 253 253
37625 -253 253 253 253 253 253 231 231 231 250 250 250
37626 -253 253 253 253 253 253 253 253 253 253 253 253
37627 -253 253 253 253 253 253 253 253 253 253 253 253
37628 -253 253 253 253 253 253 253 253 253 253 253 253
37629 -253 253 253 253 253 253 253 253 253 246 230 190
37630 -238 204 91 238 204 91 181 142 44 37 26 9
37631 - 2 2 6 2 2 6 2 2 6 2 2 6
37632 - 2 2 6 2 2 6 38 38 38 46 46 46
37633 - 26 26 26 106 106 106 54 54 54 18 18 18
37634 - 6 6 6 0 0 0 0 0 0 0 0 0
37635 - 0 0 0 0 0 0 0 0 0 0 0 0
37636 - 0 0 0 0 0 0 0 0 0 0 0 0
37637 - 0 0 0 0 0 0 0 0 0 0 0 0
37638 - 0 0 0 0 0 0 0 0 0 0 0 0
37639 - 0 0 0 6 6 6 14 14 14 22 22 22
37640 - 30 30 30 38 38 38 50 50 50 70 70 70
37641 -106 106 106 190 142 34 226 170 11 242 186 14
37642 -246 190 14 246 190 14 246 190 14 154 114 10
37643 - 6 6 6 74 74 74 226 226 226 253 253 253
37644 -253 253 253 253 253 253 253 253 253 253 253 253
37645 -253 253 253 253 253 253 231 231 231 250 250 250
37646 -253 253 253 253 253 253 253 253 253 253 253 253
37647 -253 253 253 253 253 253 253 253 253 253 253 253
37648 -253 253 253 253 253 253 253 253 253 253 253 253
37649 -253 253 253 253 253 253 253 253 253 228 184 62
37650 -241 196 14 241 208 19 232 195 16 38 30 10
37651 - 2 2 6 2 2 6 2 2 6 2 2 6
37652 - 2 2 6 6 6 6 30 30 30 26 26 26
37653 -203 166 17 154 142 90 66 66 66 26 26 26
37654 - 6 6 6 0 0 0 0 0 0 0 0 0
37655 - 0 0 0 0 0 0 0 0 0 0 0 0
37656 - 0 0 0 0 0 0 0 0 0 0 0 0
37657 - 0 0 0 0 0 0 0 0 0 0 0 0
37658 - 0 0 0 0 0 0 0 0 0 0 0 0
37659 - 6 6 6 18 18 18 38 38 38 58 58 58
37660 - 78 78 78 86 86 86 101 101 101 123 123 123
37661 -175 146 61 210 150 10 234 174 13 246 186 14
37662 -246 190 14 246 190 14 246 190 14 238 190 10
37663 -102 78 10 2 2 6 46 46 46 198 198 198
37664 -253 253 253 253 253 253 253 253 253 253 253 253
37665 -253 253 253 253 253 253 234 234 234 242 242 242
37666 -253 253 253 253 253 253 253 253 253 253 253 253
37667 -253 253 253 253 253 253 253 253 253 253 253 253
37668 -253 253 253 253 253 253 253 253 253 253 253 253
37669 -253 253 253 253 253 253 253 253 253 224 178 62
37670 -242 186 14 241 196 14 210 166 10 22 18 6
37671 - 2 2 6 2 2 6 2 2 6 2 2 6
37672 - 2 2 6 2 2 6 6 6 6 121 92 8
37673 -238 202 15 232 195 16 82 82 82 34 34 34
37674 - 10 10 10 0 0 0 0 0 0 0 0 0
37675 - 0 0 0 0 0 0 0 0 0 0 0 0
37676 - 0 0 0 0 0 0 0 0 0 0 0 0
37677 - 0 0 0 0 0 0 0 0 0 0 0 0
37678 - 0 0 0 0 0 0 0 0 0 0 0 0
37679 - 14 14 14 38 38 38 70 70 70 154 122 46
37680 -190 142 34 200 144 11 197 138 11 197 138 11
37681 -213 154 11 226 170 11 242 186 14 246 190 14
37682 -246 190 14 246 190 14 246 190 14 246 190 14
37683 -225 175 15 46 32 6 2 2 6 22 22 22
37684 -158 158 158 250 250 250 253 253 253 253 253 253
37685 -253 253 253 253 253 253 253 253 253 253 253 253
37686 -253 253 253 253 253 253 253 253 253 253 253 253
37687 -253 253 253 253 253 253 253 253 253 253 253 253
37688 -253 253 253 253 253 253 253 253 253 253 253 253
37689 -253 253 253 250 250 250 242 242 242 224 178 62
37690 -239 182 13 236 186 11 213 154 11 46 32 6
37691 - 2 2 6 2 2 6 2 2 6 2 2 6
37692 - 2 2 6 2 2 6 61 42 6 225 175 15
37693 -238 190 10 236 186 11 112 100 78 42 42 42
37694 - 14 14 14 0 0 0 0 0 0 0 0 0
37695 - 0 0 0 0 0 0 0 0 0 0 0 0
37696 - 0 0 0 0 0 0 0 0 0 0 0 0
37697 - 0 0 0 0 0 0 0 0 0 0 0 0
37698 - 0 0 0 0 0 0 0 0 0 6 6 6
37699 - 22 22 22 54 54 54 154 122 46 213 154 11
37700 -226 170 11 230 174 11 226 170 11 226 170 11
37701 -236 178 12 242 186 14 246 190 14 246 190 14
37702 -246 190 14 246 190 14 246 190 14 246 190 14
37703 -241 196 14 184 144 12 10 10 10 2 2 6
37704 - 6 6 6 116 116 116 242 242 242 253 253 253
37705 -253 253 253 253 253 253 253 253 253 253 253 253
37706 -253 253 253 253 253 253 253 253 253 253 253 253
37707 -253 253 253 253 253 253 253 253 253 253 253 253
37708 -253 253 253 253 253 253 253 253 253 253 253 253
37709 -253 253 253 231 231 231 198 198 198 214 170 54
37710 -236 178 12 236 178 12 210 150 10 137 92 6
37711 - 18 14 6 2 2 6 2 2 6 2 2 6
37712 - 6 6 6 70 47 6 200 144 11 236 178 12
37713 -239 182 13 239 182 13 124 112 88 58 58 58
37714 - 22 22 22 6 6 6 0 0 0 0 0 0
37715 - 0 0 0 0 0 0 0 0 0 0 0 0
37716 - 0 0 0 0 0 0 0 0 0 0 0 0
37717 - 0 0 0 0 0 0 0 0 0 0 0 0
37718 - 0 0 0 0 0 0 0 0 0 10 10 10
37719 - 30 30 30 70 70 70 180 133 36 226 170 11
37720 -239 182 13 242 186 14 242 186 14 246 186 14
37721 -246 190 14 246 190 14 246 190 14 246 190 14
37722 -246 190 14 246 190 14 246 190 14 246 190 14
37723 -246 190 14 232 195 16 98 70 6 2 2 6
37724 - 2 2 6 2 2 6 66 66 66 221 221 221
37725 -253 253 253 253 253 253 253 253 253 253 253 253
37726 -253 253 253 253 253 253 253 253 253 253 253 253
37727 -253 253 253 253 253 253 253 253 253 253 253 253
37728 -253 253 253 253 253 253 253 253 253 253 253 253
37729 -253 253 253 206 206 206 198 198 198 214 166 58
37730 -230 174 11 230 174 11 216 158 10 192 133 9
37731 -163 110 8 116 81 8 102 78 10 116 81 8
37732 -167 114 7 197 138 11 226 170 11 239 182 13
37733 -242 186 14 242 186 14 162 146 94 78 78 78
37734 - 34 34 34 14 14 14 6 6 6 0 0 0
37735 - 0 0 0 0 0 0 0 0 0 0 0 0
37736 - 0 0 0 0 0 0 0 0 0 0 0 0
37737 - 0 0 0 0 0 0 0 0 0 0 0 0
37738 - 0 0 0 0 0 0 0 0 0 6 6 6
37739 - 30 30 30 78 78 78 190 142 34 226 170 11
37740 -239 182 13 246 190 14 246 190 14 246 190 14
37741 -246 190 14 246 190 14 246 190 14 246 190 14
37742 -246 190 14 246 190 14 246 190 14 246 190 14
37743 -246 190 14 241 196 14 203 166 17 22 18 6
37744 - 2 2 6 2 2 6 2 2 6 38 38 38
37745 -218 218 218 253 253 253 253 253 253 253 253 253
37746 -253 253 253 253 253 253 253 253 253 253 253 253
37747 -253 253 253 253 253 253 253 253 253 253 253 253
37748 -253 253 253 253 253 253 253 253 253 253 253 253
37749 -250 250 250 206 206 206 198 198 198 202 162 69
37750 -226 170 11 236 178 12 224 166 10 210 150 10
37751 -200 144 11 197 138 11 192 133 9 197 138 11
37752 -210 150 10 226 170 11 242 186 14 246 190 14
37753 -246 190 14 246 186 14 225 175 15 124 112 88
37754 - 62 62 62 30 30 30 14 14 14 6 6 6
37755 - 0 0 0 0 0 0 0 0 0 0 0 0
37756 - 0 0 0 0 0 0 0 0 0 0 0 0
37757 - 0 0 0 0 0 0 0 0 0 0 0 0
37758 - 0 0 0 0 0 0 0 0 0 10 10 10
37759 - 30 30 30 78 78 78 174 135 50 224 166 10
37760 -239 182 13 246 190 14 246 190 14 246 190 14
37761 -246 190 14 246 190 14 246 190 14 246 190 14
37762 -246 190 14 246 190 14 246 190 14 246 190 14
37763 -246 190 14 246 190 14 241 196 14 139 102 15
37764 - 2 2 6 2 2 6 2 2 6 2 2 6
37765 - 78 78 78 250 250 250 253 253 253 253 253 253
37766 -253 253 253 253 253 253 253 253 253 253 253 253
37767 -253 253 253 253 253 253 253 253 253 253 253 253
37768 -253 253 253 253 253 253 253 253 253 253 253 253
37769 -250 250 250 214 214 214 198 198 198 190 150 46
37770 -219 162 10 236 178 12 234 174 13 224 166 10
37771 -216 158 10 213 154 11 213 154 11 216 158 10
37772 -226 170 11 239 182 13 246 190 14 246 190 14
37773 -246 190 14 246 190 14 242 186 14 206 162 42
37774 -101 101 101 58 58 58 30 30 30 14 14 14
37775 - 6 6 6 0 0 0 0 0 0 0 0 0
37776 - 0 0 0 0 0 0 0 0 0 0 0 0
37777 - 0 0 0 0 0 0 0 0 0 0 0 0
37778 - 0 0 0 0 0 0 0 0 0 10 10 10
37779 - 30 30 30 74 74 74 174 135 50 216 158 10
37780 -236 178 12 246 190 14 246 190 14 246 190 14
37781 -246 190 14 246 190 14 246 190 14 246 190 14
37782 -246 190 14 246 190 14 246 190 14 246 190 14
37783 -246 190 14 246 190 14 241 196 14 226 184 13
37784 - 61 42 6 2 2 6 2 2 6 2 2 6
37785 - 22 22 22 238 238 238 253 253 253 253 253 253
37786 -253 253 253 253 253 253 253 253 253 253 253 253
37787 -253 253 253 253 253 253 253 253 253 253 253 253
37788 -253 253 253 253 253 253 253 253 253 253 253 253
37789 -253 253 253 226 226 226 187 187 187 180 133 36
37790 -216 158 10 236 178 12 239 182 13 236 178 12
37791 -230 174 11 226 170 11 226 170 11 230 174 11
37792 -236 178 12 242 186 14 246 190 14 246 190 14
37793 -246 190 14 246 190 14 246 186 14 239 182 13
37794 -206 162 42 106 106 106 66 66 66 34 34 34
37795 - 14 14 14 6 6 6 0 0 0 0 0 0
37796 - 0 0 0 0 0 0 0 0 0 0 0 0
37797 - 0 0 0 0 0 0 0 0 0 0 0 0
37798 - 0 0 0 0 0 0 0 0 0 6 6 6
37799 - 26 26 26 70 70 70 163 133 67 213 154 11
37800 -236 178 12 246 190 14 246 190 14 246 190 14
37801 -246 190 14 246 190 14 246 190 14 246 190 14
37802 -246 190 14 246 190 14 246 190 14 246 190 14
37803 -246 190 14 246 190 14 246 190 14 241 196 14
37804 -190 146 13 18 14 6 2 2 6 2 2 6
37805 - 46 46 46 246 246 246 253 253 253 253 253 253
37806 -253 253 253 253 253 253 253 253 253 253 253 253
37807 -253 253 253 253 253 253 253 253 253 253 253 253
37808 -253 253 253 253 253 253 253 253 253 253 253 253
37809 -253 253 253 221 221 221 86 86 86 156 107 11
37810 -216 158 10 236 178 12 242 186 14 246 186 14
37811 -242 186 14 239 182 13 239 182 13 242 186 14
37812 -242 186 14 246 186 14 246 190 14 246 190 14
37813 -246 190 14 246 190 14 246 190 14 246 190 14
37814 -242 186 14 225 175 15 142 122 72 66 66 66
37815 - 30 30 30 10 10 10 0 0 0 0 0 0
37816 - 0 0 0 0 0 0 0 0 0 0 0 0
37817 - 0 0 0 0 0 0 0 0 0 0 0 0
37818 - 0 0 0 0 0 0 0 0 0 6 6 6
37819 - 26 26 26 70 70 70 163 133 67 210 150 10
37820 -236 178 12 246 190 14 246 190 14 246 190 14
37821 -246 190 14 246 190 14 246 190 14 246 190 14
37822 -246 190 14 246 190 14 246 190 14 246 190 14
37823 -246 190 14 246 190 14 246 190 14 246 190 14
37824 -232 195 16 121 92 8 34 34 34 106 106 106
37825 -221 221 221 253 253 253 253 253 253 253 253 253
37826 -253 253 253 253 253 253 253 253 253 253 253 253
37827 -253 253 253 253 253 253 253 253 253 253 253 253
37828 -253 253 253 253 253 253 253 253 253 253 253 253
37829 -242 242 242 82 82 82 18 14 6 163 110 8
37830 -216 158 10 236 178 12 242 186 14 246 190 14
37831 -246 190 14 246 190 14 246 190 14 246 190 14
37832 -246 190 14 246 190 14 246 190 14 246 190 14
37833 -246 190 14 246 190 14 246 190 14 246 190 14
37834 -246 190 14 246 190 14 242 186 14 163 133 67
37835 - 46 46 46 18 18 18 6 6 6 0 0 0
37836 - 0 0 0 0 0 0 0 0 0 0 0 0
37837 - 0 0 0 0 0 0 0 0 0 0 0 0
37838 - 0 0 0 0 0 0 0 0 0 10 10 10
37839 - 30 30 30 78 78 78 163 133 67 210 150 10
37840 -236 178 12 246 186 14 246 190 14 246 190 14
37841 -246 190 14 246 190 14 246 190 14 246 190 14
37842 -246 190 14 246 190 14 246 190 14 246 190 14
37843 -246 190 14 246 190 14 246 190 14 246 190 14
37844 -241 196 14 215 174 15 190 178 144 253 253 253
37845 -253 253 253 253 253 253 253 253 253 253 253 253
37846 -253 253 253 253 253 253 253 253 253 253 253 253
37847 -253 253 253 253 253 253 253 253 253 253 253 253
37848 -253 253 253 253 253 253 253 253 253 218 218 218
37849 - 58 58 58 2 2 6 22 18 6 167 114 7
37850 -216 158 10 236 178 12 246 186 14 246 190 14
37851 -246 190 14 246 190 14 246 190 14 246 190 14
37852 -246 190 14 246 190 14 246 190 14 246 190 14
37853 -246 190 14 246 190 14 246 190 14 246 190 14
37854 -246 190 14 246 186 14 242 186 14 190 150 46
37855 - 54 54 54 22 22 22 6 6 6 0 0 0
37856 - 0 0 0 0 0 0 0 0 0 0 0 0
37857 - 0 0 0 0 0 0 0 0 0 0 0 0
37858 - 0 0 0 0 0 0 0 0 0 14 14 14
37859 - 38 38 38 86 86 86 180 133 36 213 154 11
37860 -236 178 12 246 186 14 246 190 14 246 190 14
37861 -246 190 14 246 190 14 246 190 14 246 190 14
37862 -246 190 14 246 190 14 246 190 14 246 190 14
37863 -246 190 14 246 190 14 246 190 14 246 190 14
37864 -246 190 14 232 195 16 190 146 13 214 214 214
37865 -253 253 253 253 253 253 253 253 253 253 253 253
37866 -253 253 253 253 253 253 253 253 253 253 253 253
37867 -253 253 253 253 253 253 253 253 253 253 253 253
37868 -253 253 253 250 250 250 170 170 170 26 26 26
37869 - 2 2 6 2 2 6 37 26 9 163 110 8
37870 -219 162 10 239 182 13 246 186 14 246 190 14
37871 -246 190 14 246 190 14 246 190 14 246 190 14
37872 -246 190 14 246 190 14 246 190 14 246 190 14
37873 -246 190 14 246 190 14 246 190 14 246 190 14
37874 -246 186 14 236 178 12 224 166 10 142 122 72
37875 - 46 46 46 18 18 18 6 6 6 0 0 0
37876 - 0 0 0 0 0 0 0 0 0 0 0 0
37877 - 0 0 0 0 0 0 0 0 0 0 0 0
37878 - 0 0 0 0 0 0 6 6 6 18 18 18
37879 - 50 50 50 109 106 95 192 133 9 224 166 10
37880 -242 186 14 246 190 14 246 190 14 246 190 14
37881 -246 190 14 246 190 14 246 190 14 246 190 14
37882 -246 190 14 246 190 14 246 190 14 246 190 14
37883 -246 190 14 246 190 14 246 190 14 246 190 14
37884 -242 186 14 226 184 13 210 162 10 142 110 46
37885 -226 226 226 253 253 253 253 253 253 253 253 253
37886 -253 253 253 253 253 253 253 253 253 253 253 253
37887 -253 253 253 253 253 253 253 253 253 253 253 253
37888 -198 198 198 66 66 66 2 2 6 2 2 6
37889 - 2 2 6 2 2 6 50 34 6 156 107 11
37890 -219 162 10 239 182 13 246 186 14 246 190 14
37891 -246 190 14 246 190 14 246 190 14 246 190 14
37892 -246 190 14 246 190 14 246 190 14 246 190 14
37893 -246 190 14 246 190 14 246 190 14 242 186 14
37894 -234 174 13 213 154 11 154 122 46 66 66 66
37895 - 30 30 30 10 10 10 0 0 0 0 0 0
37896 - 0 0 0 0 0 0 0 0 0 0 0 0
37897 - 0 0 0 0 0 0 0 0 0 0 0 0
37898 - 0 0 0 0 0 0 6 6 6 22 22 22
37899 - 58 58 58 154 121 60 206 145 10 234 174 13
37900 -242 186 14 246 186 14 246 190 14 246 190 14
37901 -246 190 14 246 190 14 246 190 14 246 190 14
37902 -246 190 14 246 190 14 246 190 14 246 190 14
37903 -246 190 14 246 190 14 246 190 14 246 190 14
37904 -246 186 14 236 178 12 210 162 10 163 110 8
37905 - 61 42 6 138 138 138 218 218 218 250 250 250
37906 -253 253 253 253 253 253 253 253 253 250 250 250
37907 -242 242 242 210 210 210 144 144 144 66 66 66
37908 - 6 6 6 2 2 6 2 2 6 2 2 6
37909 - 2 2 6 2 2 6 61 42 6 163 110 8
37910 -216 158 10 236 178 12 246 190 14 246 190 14
37911 -246 190 14 246 190 14 246 190 14 246 190 14
37912 -246 190 14 246 190 14 246 190 14 246 190 14
37913 -246 190 14 239 182 13 230 174 11 216 158 10
37914 -190 142 34 124 112 88 70 70 70 38 38 38
37915 - 18 18 18 6 6 6 0 0 0 0 0 0
37916 - 0 0 0 0 0 0 0 0 0 0 0 0
37917 - 0 0 0 0 0 0 0 0 0 0 0 0
37918 - 0 0 0 0 0 0 6 6 6 22 22 22
37919 - 62 62 62 168 124 44 206 145 10 224 166 10
37920 -236 178 12 239 182 13 242 186 14 242 186 14
37921 -246 186 14 246 190 14 246 190 14 246 190 14
37922 -246 190 14 246 190 14 246 190 14 246 190 14
37923 -246 190 14 246 190 14 246 190 14 246 190 14
37924 -246 190 14 236 178 12 216 158 10 175 118 6
37925 - 80 54 7 2 2 6 6 6 6 30 30 30
37926 - 54 54 54 62 62 62 50 50 50 38 38 38
37927 - 14 14 14 2 2 6 2 2 6 2 2 6
37928 - 2 2 6 2 2 6 2 2 6 2 2 6
37929 - 2 2 6 6 6 6 80 54 7 167 114 7
37930 -213 154 11 236 178 12 246 190 14 246 190 14
37931 -246 190 14 246 190 14 246 190 14 246 190 14
37932 -246 190 14 242 186 14 239 182 13 239 182 13
37933 -230 174 11 210 150 10 174 135 50 124 112 88
37934 - 82 82 82 54 54 54 34 34 34 18 18 18
37935 - 6 6 6 0 0 0 0 0 0 0 0 0
37936 - 0 0 0 0 0 0 0 0 0 0 0 0
37937 - 0 0 0 0 0 0 0 0 0 0 0 0
37938 - 0 0 0 0 0 0 6 6 6 18 18 18
37939 - 50 50 50 158 118 36 192 133 9 200 144 11
37940 -216 158 10 219 162 10 224 166 10 226 170 11
37941 -230 174 11 236 178 12 239 182 13 239 182 13
37942 -242 186 14 246 186 14 246 190 14 246 190 14
37943 -246 190 14 246 190 14 246 190 14 246 190 14
37944 -246 186 14 230 174 11 210 150 10 163 110 8
37945 -104 69 6 10 10 10 2 2 6 2 2 6
37946 - 2 2 6 2 2 6 2 2 6 2 2 6
37947 - 2 2 6 2 2 6 2 2 6 2 2 6
37948 - 2 2 6 2 2 6 2 2 6 2 2 6
37949 - 2 2 6 6 6 6 91 60 6 167 114 7
37950 -206 145 10 230 174 11 242 186 14 246 190 14
37951 -246 190 14 246 190 14 246 186 14 242 186 14
37952 -239 182 13 230 174 11 224 166 10 213 154 11
37953 -180 133 36 124 112 88 86 86 86 58 58 58
37954 - 38 38 38 22 22 22 10 10 10 6 6 6
37955 - 0 0 0 0 0 0 0 0 0 0 0 0
37956 - 0 0 0 0 0 0 0 0 0 0 0 0
37957 - 0 0 0 0 0 0 0 0 0 0 0 0
37958 - 0 0 0 0 0 0 0 0 0 14 14 14
37959 - 34 34 34 70 70 70 138 110 50 158 118 36
37960 -167 114 7 180 123 7 192 133 9 197 138 11
37961 -200 144 11 206 145 10 213 154 11 219 162 10
37962 -224 166 10 230 174 11 239 182 13 242 186 14
37963 -246 186 14 246 186 14 246 186 14 246 186 14
37964 -239 182 13 216 158 10 185 133 11 152 99 6
37965 -104 69 6 18 14 6 2 2 6 2 2 6
37966 - 2 2 6 2 2 6 2 2 6 2 2 6
37967 - 2 2 6 2 2 6 2 2 6 2 2 6
37968 - 2 2 6 2 2 6 2 2 6 2 2 6
37969 - 2 2 6 6 6 6 80 54 7 152 99 6
37970 -192 133 9 219 162 10 236 178 12 239 182 13
37971 -246 186 14 242 186 14 239 182 13 236 178 12
37972 -224 166 10 206 145 10 192 133 9 154 121 60
37973 - 94 94 94 62 62 62 42 42 42 22 22 22
37974 - 14 14 14 6 6 6 0 0 0 0 0 0
37975 - 0 0 0 0 0 0 0 0 0 0 0 0
37976 - 0 0 0 0 0 0 0 0 0 0 0 0
37977 - 0 0 0 0 0 0 0 0 0 0 0 0
37978 - 0 0 0 0 0 0 0 0 0 6 6 6
37979 - 18 18 18 34 34 34 58 58 58 78 78 78
37980 -101 98 89 124 112 88 142 110 46 156 107 11
37981 -163 110 8 167 114 7 175 118 6 180 123 7
37982 -185 133 11 197 138 11 210 150 10 219 162 10
37983 -226 170 11 236 178 12 236 178 12 234 174 13
37984 -219 162 10 197 138 11 163 110 8 130 83 6
37985 - 91 60 6 10 10 10 2 2 6 2 2 6
37986 - 18 18 18 38 38 38 38 38 38 38 38 38
37987 - 38 38 38 38 38 38 38 38 38 38 38 38
37988 - 38 38 38 38 38 38 26 26 26 2 2 6
37989 - 2 2 6 6 6 6 70 47 6 137 92 6
37990 -175 118 6 200 144 11 219 162 10 230 174 11
37991 -234 174 13 230 174 11 219 162 10 210 150 10
37992 -192 133 9 163 110 8 124 112 88 82 82 82
37993 - 50 50 50 30 30 30 14 14 14 6 6 6
37994 - 0 0 0 0 0 0 0 0 0 0 0 0
37995 - 0 0 0 0 0 0 0 0 0 0 0 0
37996 - 0 0 0 0 0 0 0 0 0 0 0 0
37997 - 0 0 0 0 0 0 0 0 0 0 0 0
37998 - 0 0 0 0 0 0 0 0 0 0 0 0
37999 - 6 6 6 14 14 14 22 22 22 34 34 34
38000 - 42 42 42 58 58 58 74 74 74 86 86 86
38001 -101 98 89 122 102 70 130 98 46 121 87 25
38002 -137 92 6 152 99 6 163 110 8 180 123 7
38003 -185 133 11 197 138 11 206 145 10 200 144 11
38004 -180 123 7 156 107 11 130 83 6 104 69 6
38005 - 50 34 6 54 54 54 110 110 110 101 98 89
38006 - 86 86 86 82 82 82 78 78 78 78 78 78
38007 - 78 78 78 78 78 78 78 78 78 78 78 78
38008 - 78 78 78 82 82 82 86 86 86 94 94 94
38009 -106 106 106 101 101 101 86 66 34 124 80 6
38010 -156 107 11 180 123 7 192 133 9 200 144 11
38011 -206 145 10 200 144 11 192 133 9 175 118 6
38012 -139 102 15 109 106 95 70 70 70 42 42 42
38013 - 22 22 22 10 10 10 0 0 0 0 0 0
38014 - 0 0 0 0 0 0 0 0 0 0 0 0
38015 - 0 0 0 0 0 0 0 0 0 0 0 0
38016 - 0 0 0 0 0 0 0 0 0 0 0 0
38017 - 0 0 0 0 0 0 0 0 0 0 0 0
38018 - 0 0 0 0 0 0 0 0 0 0 0 0
38019 - 0 0 0 0 0 0 6 6 6 10 10 10
38020 - 14 14 14 22 22 22 30 30 30 38 38 38
38021 - 50 50 50 62 62 62 74 74 74 90 90 90
38022 -101 98 89 112 100 78 121 87 25 124 80 6
38023 -137 92 6 152 99 6 152 99 6 152 99 6
38024 -138 86 6 124 80 6 98 70 6 86 66 30
38025 -101 98 89 82 82 82 58 58 58 46 46 46
38026 - 38 38 38 34 34 34 34 34 34 34 34 34
38027 - 34 34 34 34 34 34 34 34 34 34 34 34
38028 - 34 34 34 34 34 34 38 38 38 42 42 42
38029 - 54 54 54 82 82 82 94 86 76 91 60 6
38030 -134 86 6 156 107 11 167 114 7 175 118 6
38031 -175 118 6 167 114 7 152 99 6 121 87 25
38032 -101 98 89 62 62 62 34 34 34 18 18 18
38033 - 6 6 6 0 0 0 0 0 0 0 0 0
38034 - 0 0 0 0 0 0 0 0 0 0 0 0
38035 - 0 0 0 0 0 0 0 0 0 0 0 0
38036 - 0 0 0 0 0 0 0 0 0 0 0 0
38037 - 0 0 0 0 0 0 0 0 0 0 0 0
38038 - 0 0 0 0 0 0 0 0 0 0 0 0
38039 - 0 0 0 0 0 0 0 0 0 0 0 0
38040 - 0 0 0 6 6 6 6 6 6 10 10 10
38041 - 18 18 18 22 22 22 30 30 30 42 42 42
38042 - 50 50 50 66 66 66 86 86 86 101 98 89
38043 -106 86 58 98 70 6 104 69 6 104 69 6
38044 -104 69 6 91 60 6 82 62 34 90 90 90
38045 - 62 62 62 38 38 38 22 22 22 14 14 14
38046 - 10 10 10 10 10 10 10 10 10 10 10 10
38047 - 10 10 10 10 10 10 6 6 6 10 10 10
38048 - 10 10 10 10 10 10 10 10 10 14 14 14
38049 - 22 22 22 42 42 42 70 70 70 89 81 66
38050 - 80 54 7 104 69 6 124 80 6 137 92 6
38051 -134 86 6 116 81 8 100 82 52 86 86 86
38052 - 58 58 58 30 30 30 14 14 14 6 6 6
38053 - 0 0 0 0 0 0 0 0 0 0 0 0
38054 - 0 0 0 0 0 0 0 0 0 0 0 0
38055 - 0 0 0 0 0 0 0 0 0 0 0 0
38056 - 0 0 0 0 0 0 0 0 0 0 0 0
38057 - 0 0 0 0 0 0 0 0 0 0 0 0
38058 - 0 0 0 0 0 0 0 0 0 0 0 0
38059 - 0 0 0 0 0 0 0 0 0 0 0 0
38060 - 0 0 0 0 0 0 0 0 0 0 0 0
38061 - 0 0 0 6 6 6 10 10 10 14 14 14
38062 - 18 18 18 26 26 26 38 38 38 54 54 54
38063 - 70 70 70 86 86 86 94 86 76 89 81 66
38064 - 89 81 66 86 86 86 74 74 74 50 50 50
38065 - 30 30 30 14 14 14 6 6 6 0 0 0
38066 - 0 0 0 0 0 0 0 0 0 0 0 0
38067 - 0 0 0 0 0 0 0 0 0 0 0 0
38068 - 0 0 0 0 0 0 0 0 0 0 0 0
38069 - 6 6 6 18 18 18 34 34 34 58 58 58
38070 - 82 82 82 89 81 66 89 81 66 89 81 66
38071 - 94 86 66 94 86 76 74 74 74 50 50 50
38072 - 26 26 26 14 14 14 6 6 6 0 0 0
38073 - 0 0 0 0 0 0 0 0 0 0 0 0
38074 - 0 0 0 0 0 0 0 0 0 0 0 0
38075 - 0 0 0 0 0 0 0 0 0 0 0 0
38076 - 0 0 0 0 0 0 0 0 0 0 0 0
38077 - 0 0 0 0 0 0 0 0 0 0 0 0
38078 - 0 0 0 0 0 0 0 0 0 0 0 0
38079 - 0 0 0 0 0 0 0 0 0 0 0 0
38080 - 0 0 0 0 0 0 0 0 0 0 0 0
38081 - 0 0 0 0 0 0 0 0 0 0 0 0
38082 - 6 6 6 6 6 6 14 14 14 18 18 18
38083 - 30 30 30 38 38 38 46 46 46 54 54 54
38084 - 50 50 50 42 42 42 30 30 30 18 18 18
38085 - 10 10 10 0 0 0 0 0 0 0 0 0
38086 - 0 0 0 0 0 0 0 0 0 0 0 0
38087 - 0 0 0 0 0 0 0 0 0 0 0 0
38088 - 0 0 0 0 0 0 0 0 0 0 0 0
38089 - 0 0 0 6 6 6 14 14 14 26 26 26
38090 - 38 38 38 50 50 50 58 58 58 58 58 58
38091 - 54 54 54 42 42 42 30 30 30 18 18 18
38092 - 10 10 10 0 0 0 0 0 0 0 0 0
38093 - 0 0 0 0 0 0 0 0 0 0 0 0
38094 - 0 0 0 0 0 0 0 0 0 0 0 0
38095 - 0 0 0 0 0 0 0 0 0 0 0 0
38096 - 0 0 0 0 0 0 0 0 0 0 0 0
38097 - 0 0 0 0 0 0 0 0 0 0 0 0
38098 - 0 0 0 0 0 0 0 0 0 0 0 0
38099 - 0 0 0 0 0 0 0 0 0 0 0 0
38100 - 0 0 0 0 0 0 0 0 0 0 0 0
38101 - 0 0 0 0 0 0 0 0 0 0 0 0
38102 - 0 0 0 0 0 0 0 0 0 6 6 6
38103 - 6 6 6 10 10 10 14 14 14 18 18 18
38104 - 18 18 18 14 14 14 10 10 10 6 6 6
38105 - 0 0 0 0 0 0 0 0 0 0 0 0
38106 - 0 0 0 0 0 0 0 0 0 0 0 0
38107 - 0 0 0 0 0 0 0 0 0 0 0 0
38108 - 0 0 0 0 0 0 0 0 0 0 0 0
38109 - 0 0 0 0 0 0 0 0 0 6 6 6
38110 - 14 14 14 18 18 18 22 22 22 22 22 22
38111 - 18 18 18 14 14 14 10 10 10 6 6 6
38112 - 0 0 0 0 0 0 0 0 0 0 0 0
38113 - 0 0 0 0 0 0 0 0 0 0 0 0
38114 - 0 0 0 0 0 0 0 0 0 0 0 0
38115 - 0 0 0 0 0 0 0 0 0 0 0 0
38116 - 0 0 0 0 0 0 0 0 0 0 0 0
38117 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38118 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38119 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38120 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38121 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38122 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38123 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38124 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38125 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38126 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38127 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38128 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38129 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38130 +4 4 4 4 4 4
38131 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38132 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38133 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38134 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38135 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38136 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38137 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38138 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38139 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38140 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38141 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38142 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38143 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38144 +4 4 4 4 4 4
38145 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38146 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38147 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38148 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38149 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38150 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38151 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38152 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38153 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38154 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38155 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38156 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38157 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38158 +4 4 4 4 4 4
38159 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38160 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38161 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38162 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38163 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38164 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38165 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38166 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38167 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38168 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38169 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38170 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38171 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38172 +4 4 4 4 4 4
38173 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38174 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38175 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38176 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38177 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38178 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38179 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38180 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38181 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38182 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38183 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38184 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38185 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38186 +4 4 4 4 4 4
38187 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38188 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38189 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38190 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38191 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38192 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38193 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38194 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38195 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38196 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38197 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38198 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38199 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38200 +4 4 4 4 4 4
38201 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38202 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38203 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38204 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38205 +4 4 4 4 4 4 4 4 4 3 3 3 0 0 0 0 0 0
38206 +0 0 0 0 0 0 0 0 0 0 0 0 3 3 3 4 4 4
38207 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38208 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38209 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38210 +4 4 4 4 4 4 4 4 4 4 4 4 1 1 1 0 0 0
38211 +0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
38212 +4 4 4 4 4 4 4 4 4 2 1 0 2 1 0 3 2 2
38213 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38214 +4 4 4 4 4 4
38215 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38216 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38217 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38218 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38219 +4 4 4 4 4 4 2 2 2 0 0 0 3 4 3 26 28 28
38220 +37 38 37 37 38 37 14 17 19 2 2 2 0 0 0 2 2 2
38221 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38222 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38223 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38224 +4 4 4 4 4 4 3 3 3 0 0 0 1 1 1 6 6 6
38225 +2 2 2 0 0 0 3 3 3 4 4 4 4 4 4 4 4 4
38226 +4 4 5 3 3 3 1 0 0 0 0 0 1 0 0 0 0 0
38227 +1 1 1 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38228 +4 4 4 4 4 4
38229 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38230 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38231 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38232 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38233 +2 2 2 0 0 0 0 0 0 14 17 19 60 74 84 137 136 137
38234 +153 152 153 137 136 137 125 124 125 60 73 81 6 6 6 3 1 0
38235 +0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
38236 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38237 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38238 +4 4 4 4 4 4 0 0 0 4 4 4 41 54 63 125 124 125
38239 +60 73 81 6 6 6 4 0 0 3 3 3 4 4 4 4 4 4
38240 +4 4 4 0 0 0 6 9 11 41 54 63 41 65 82 22 30 35
38241 +2 2 2 2 1 0 4 4 4 4 4 4 4 4 4 4 4 4
38242 +4 4 4 4 4 4
38243 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38244 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38245 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38246 +4 4 4 4 4 4 5 5 5 5 5 5 2 2 2 0 0 0
38247 +4 0 0 6 6 6 41 54 63 137 136 137 174 174 174 167 166 167
38248 +165 164 165 165 164 165 163 162 163 163 162 163 125 124 125 41 54 63
38249 +1 1 1 0 0 0 0 0 0 3 3 3 5 5 5 4 4 4
38250 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38251 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
38252 +3 3 3 2 0 0 4 0 0 60 73 81 156 155 156 167 166 167
38253 +163 162 163 85 115 134 5 7 8 0 0 0 4 4 4 5 5 5
38254 +0 0 0 2 5 5 55 98 126 90 154 193 90 154 193 72 125 159
38255 +37 51 59 2 0 0 1 1 1 4 5 5 4 4 4 4 4 4
38256 +4 4 4 4 4 4
38257 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38258 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38259 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38260 +4 4 4 5 5 5 4 4 4 1 1 1 0 0 0 3 3 3
38261 +37 38 37 125 124 125 163 162 163 174 174 174 158 157 158 158 157 158
38262 +156 155 156 156 155 156 158 157 158 165 164 165 174 174 174 166 165 166
38263 +125 124 125 16 19 21 1 0 0 0 0 0 0 0 0 4 4 4
38264 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
38265 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 1 1 1
38266 +0 0 0 0 0 0 37 38 37 153 152 153 174 174 174 158 157 158
38267 +174 174 174 163 162 163 37 38 37 4 3 3 4 0 0 1 1 1
38268 +0 0 0 22 40 52 101 161 196 101 161 196 90 154 193 101 161 196
38269 +64 123 161 14 17 19 0 0 0 4 4 4 4 4 4 4 4 4
38270 +4 4 4 4 4 4
38271 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38272 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38273 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
38274 +5 5 5 2 2 2 0 0 0 4 0 0 24 26 27 85 115 134
38275 +156 155 156 174 174 174 167 166 167 156 155 156 154 153 154 157 156 157
38276 +156 155 156 156 155 156 155 154 155 153 152 153 158 157 158 167 166 167
38277 +174 174 174 156 155 156 60 74 84 16 19 21 0 0 0 0 0 0
38278 +1 1 1 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
38279 +4 4 4 5 5 5 6 6 6 3 3 3 0 0 0 4 0 0
38280 +13 16 17 60 73 81 137 136 137 165 164 165 156 155 156 153 152 153
38281 +174 174 174 177 184 187 60 73 81 3 1 0 0 0 0 1 1 2
38282 +22 30 35 64 123 161 136 185 209 90 154 193 90 154 193 90 154 193
38283 +90 154 193 21 29 34 0 0 0 3 2 2 4 4 5 4 4 4
38284 +4 4 4 4 4 4
38285 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38286 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38287 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 3 3 3
38288 +0 0 0 0 0 0 10 13 16 60 74 84 157 156 157 174 174 174
38289 +174 174 174 158 157 158 153 152 153 154 153 154 156 155 156 155 154 155
38290 +156 155 156 155 154 155 154 153 154 157 156 157 154 153 154 153 152 153
38291 +163 162 163 174 174 174 177 184 187 137 136 137 60 73 81 13 16 17
38292 +4 0 0 0 0 0 3 3 3 5 5 5 4 4 4 4 4 4
38293 +5 5 5 4 4 4 1 1 1 0 0 0 3 3 3 41 54 63
38294 +131 129 131 174 174 174 174 174 174 174 174 174 167 166 167 174 174 174
38295 +190 197 201 137 136 137 24 26 27 4 0 0 16 21 25 50 82 103
38296 +90 154 193 136 185 209 90 154 193 101 161 196 101 161 196 101 161 196
38297 +31 91 132 3 6 7 0 0 0 4 4 4 4 4 4 4 4 4
38298 +4 4 4 4 4 4
38299 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38300 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38301 +4 4 4 4 4 4 4 4 4 2 2 2 0 0 0 4 0 0
38302 +4 0 0 43 57 68 137 136 137 177 184 187 174 174 174 163 162 163
38303 +155 154 155 155 154 155 156 155 156 155 154 155 158 157 158 165 164 165
38304 +167 166 167 166 165 166 163 162 163 157 156 157 155 154 155 155 154 155
38305 +153 152 153 156 155 156 167 166 167 174 174 174 174 174 174 131 129 131
38306 +41 54 63 5 5 5 0 0 0 0 0 0 3 3 3 4 4 4
38307 +1 1 1 0 0 0 1 0 0 26 28 28 125 124 125 174 174 174
38308 +177 184 187 174 174 174 174 174 174 156 155 156 131 129 131 137 136 137
38309 +125 124 125 24 26 27 4 0 0 41 65 82 90 154 193 136 185 209
38310 +136 185 209 101 161 196 53 118 160 37 112 160 90 154 193 34 86 122
38311 +7 12 15 0 0 0 4 4 4 4 4 4 4 4 4 4 4 4
38312 +4 4 4 4 4 4
38313 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38314 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38315 +4 4 4 3 3 3 0 0 0 0 0 0 5 5 5 37 38 37
38316 +125 124 125 167 166 167 174 174 174 167 166 167 158 157 158 155 154 155
38317 +156 155 156 156 155 156 156 155 156 163 162 163 167 166 167 155 154 155
38318 +137 136 137 153 152 153 156 155 156 165 164 165 163 162 163 156 155 156
38319 +156 155 156 156 155 156 155 154 155 158 157 158 166 165 166 174 174 174
38320 +167 166 167 125 124 125 37 38 37 1 0 0 0 0 0 0 0 0
38321 +0 0 0 24 26 27 60 74 84 158 157 158 174 174 174 174 174 174
38322 +166 165 166 158 157 158 125 124 125 41 54 63 13 16 17 6 6 6
38323 +6 6 6 37 38 37 80 127 157 136 185 209 101 161 196 101 161 196
38324 +90 154 193 28 67 93 6 10 14 13 20 25 13 20 25 6 10 14
38325 +1 1 2 4 3 3 4 4 4 4 4 4 4 4 4 4 4 4
38326 +4 4 4 4 4 4
38327 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38328 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38329 +1 1 1 1 0 0 4 3 3 37 38 37 60 74 84 153 152 153
38330 +167 166 167 167 166 167 158 157 158 154 153 154 155 154 155 156 155 156
38331 +157 156 157 158 157 158 167 166 167 167 166 167 131 129 131 43 57 68
38332 +26 28 28 37 38 37 60 73 81 131 129 131 165 164 165 166 165 166
38333 +158 157 158 155 154 155 156 155 156 156 155 156 156 155 156 158 157 158
38334 +165 164 165 174 174 174 163 162 163 60 74 84 16 19 21 13 16 17
38335 +60 73 81 131 129 131 174 174 174 174 174 174 167 166 167 165 164 165
38336 +137 136 137 60 73 81 24 26 27 4 0 0 4 0 0 16 19 21
38337 +52 104 138 101 161 196 136 185 209 136 185 209 90 154 193 27 99 146
38338 +13 20 25 4 5 7 2 5 5 4 5 7 1 1 2 0 0 0
38339 +4 4 4 4 4 4 3 3 3 2 2 2 2 2 2 4 4 4
38340 +4 4 4 4 4 4
38341 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38342 +4 4 4 4 4 4 4 4 4 4 4 4 3 3 3 0 0 0
38343 +0 0 0 13 16 17 60 73 81 137 136 137 174 174 174 166 165 166
38344 +158 157 158 156 155 156 157 156 157 156 155 156 155 154 155 158 157 158
38345 +167 166 167 174 174 174 153 152 153 60 73 81 16 19 21 4 0 0
38346 +4 0 0 4 0 0 6 6 6 26 28 28 60 74 84 158 157 158
38347 +174 174 174 166 165 166 157 156 157 155 154 155 156 155 156 156 155 156
38348 +155 154 155 158 157 158 167 166 167 167 166 167 131 129 131 125 124 125
38349 +137 136 137 167 166 167 167 166 167 174 174 174 158 157 158 125 124 125
38350 +16 19 21 4 0 0 4 0 0 10 13 16 49 76 92 107 159 188
38351 +136 185 209 136 185 209 90 154 193 26 108 161 22 40 52 6 10 14
38352 +2 3 3 1 1 2 1 1 2 4 4 5 4 4 5 4 4 5
38353 +4 4 5 2 2 1 0 0 0 0 0 0 0 0 0 2 2 2
38354 +4 4 4 4 4 4
38355 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38356 +4 4 4 5 5 5 3 3 3 0 0 0 1 0 0 4 0 0
38357 +37 51 59 131 129 131 167 166 167 167 166 167 163 162 163 157 156 157
38358 +157 156 157 155 154 155 153 152 153 157 156 157 167 166 167 174 174 174
38359 +153 152 153 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
38360 +4 3 3 4 3 3 4 0 0 6 6 6 4 0 0 37 38 37
38361 +125 124 125 174 174 174 174 174 174 165 164 165 156 155 156 154 153 154
38362 +156 155 156 156 155 156 155 154 155 163 162 163 158 157 158 163 162 163
38363 +174 174 174 174 174 174 174 174 174 125 124 125 37 38 37 0 0 0
38364 +4 0 0 6 9 11 41 54 63 90 154 193 136 185 209 146 190 211
38365 +136 185 209 37 112 160 22 40 52 6 10 14 3 6 7 1 1 2
38366 +1 1 2 3 3 3 1 1 2 3 3 3 4 4 4 4 4 4
38367 +2 2 2 2 0 0 16 19 21 37 38 37 24 26 27 0 0 0
38368 +0 0 0 4 4 4
38369 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
38370 +4 4 4 0 0 0 0 0 0 0 0 0 26 28 28 120 125 127
38371 +158 157 158 174 174 174 165 164 165 157 156 157 155 154 155 156 155 156
38372 +153 152 153 153 152 153 167 166 167 174 174 174 174 174 174 125 124 125
38373 +37 38 37 4 0 0 0 0 0 4 0 0 4 3 3 4 4 4
38374 +4 4 4 4 4 4 5 5 5 4 0 0 4 0 0 4 0 0
38375 +4 3 3 43 57 68 137 136 137 174 174 174 174 174 174 165 164 165
38376 +154 153 154 153 152 153 153 152 153 153 152 153 163 162 163 174 174 174
38377 +174 174 174 153 152 153 60 73 81 6 6 6 4 0 0 4 3 3
38378 +32 43 50 80 127 157 136 185 209 146 190 211 146 190 211 90 154 193
38379 +28 67 93 28 67 93 40 71 93 3 6 7 1 1 2 2 5 5
38380 +50 82 103 79 117 143 26 37 45 0 0 0 3 3 3 1 1 1
38381 +0 0 0 41 54 63 137 136 137 174 174 174 153 152 153 60 73 81
38382 +2 0 0 0 0 0
38383 +4 4 4 4 4 4 4 4 4 4 4 4 6 6 6 2 2 2
38384 +0 0 0 2 0 0 24 26 27 60 74 84 153 152 153 174 174 174
38385 +174 174 174 157 156 157 154 153 154 156 155 156 154 153 154 153 152 153
38386 +165 164 165 174 174 174 177 184 187 137 136 137 43 57 68 6 6 6
38387 +4 0 0 2 0 0 3 3 3 5 5 5 5 5 5 4 4 4
38388 +4 4 4 4 4 4 4 4 4 5 5 5 6 6 6 4 3 3
38389 +4 0 0 4 0 0 24 26 27 60 73 81 153 152 153 174 174 174
38390 +174 174 174 158 157 158 158 157 158 174 174 174 174 174 174 158 157 158
38391 +60 74 84 24 26 27 4 0 0 4 0 0 17 23 27 59 113 148
38392 +136 185 209 191 222 234 146 190 211 136 185 209 31 91 132 7 11 13
38393 +22 40 52 101 161 196 90 154 193 6 9 11 3 4 4 43 95 132
38394 +136 185 209 172 205 220 55 98 126 0 0 0 0 0 0 2 0 0
38395 +26 28 28 153 152 153 177 184 187 167 166 167 177 184 187 165 164 165
38396 +37 38 37 0 0 0
38397 +4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
38398 +13 16 17 60 73 81 137 136 137 174 174 174 174 174 174 165 164 165
38399 +153 152 153 153 152 153 155 154 155 154 153 154 158 157 158 174 174 174
38400 +177 184 187 163 162 163 60 73 81 16 19 21 4 0 0 4 0 0
38401 +4 3 3 4 4 4 5 5 5 5 5 5 4 4 4 5 5 5
38402 +5 5 5 5 5 5 5 5 5 4 4 4 4 4 4 5 5 5
38403 +6 6 6 4 0 0 4 0 0 4 0 0 24 26 27 60 74 84
38404 +166 165 166 174 174 174 177 184 187 165 164 165 125 124 125 24 26 27
38405 +4 0 0 4 0 0 5 5 5 50 82 103 136 185 209 172 205 220
38406 +146 190 211 136 185 209 26 108 161 22 40 52 7 12 15 44 81 103
38407 +71 116 144 28 67 93 37 51 59 41 65 82 100 139 164 101 161 196
38408 +90 154 193 90 154 193 28 67 93 0 0 0 0 0 0 26 28 28
38409 +125 124 125 167 166 167 163 162 163 153 152 153 163 162 163 174 174 174
38410 +85 115 134 4 0 0
38411 +4 4 4 5 5 5 4 4 4 1 0 0 4 0 0 34 47 55
38412 +125 124 125 174 174 174 174 174 174 167 166 167 157 156 157 153 152 153
38413 +155 154 155 155 154 155 158 157 158 166 165 166 167 166 167 154 153 154
38414 +125 124 125 26 28 28 4 0 0 4 0 0 4 0 0 5 5 5
38415 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 1 1 1
38416 +0 0 0 0 0 0 1 1 1 4 4 4 4 4 4 4 4 4
38417 +5 5 5 5 5 5 4 3 3 4 0 0 4 0 0 6 6 6
38418 +37 38 37 131 129 131 137 136 137 37 38 37 0 0 0 4 0 0
38419 +4 5 5 43 61 72 90 154 193 172 205 220 146 190 211 136 185 209
38420 +90 154 193 28 67 93 13 20 25 43 61 72 71 116 144 44 81 103
38421 +2 5 5 7 11 13 59 113 148 101 161 196 90 154 193 28 67 93
38422 +13 20 25 6 10 14 0 0 0 13 16 17 60 73 81 137 136 137
38423 +166 165 166 158 157 158 156 155 156 154 153 154 167 166 167 174 174 174
38424 +60 73 81 4 0 0
38425 +4 4 4 4 4 4 0 0 0 3 3 3 60 74 84 174 174 174
38426 +174 174 174 167 166 167 163 162 163 155 154 155 157 156 157 155 154 155
38427 +156 155 156 163 162 163 167 166 167 158 157 158 125 124 125 37 38 37
38428 +4 3 3 4 0 0 4 0 0 6 6 6 6 6 6 5 5 5
38429 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 2 3 3
38430 +10 13 16 7 11 13 1 0 0 0 0 0 2 2 1 4 4 4
38431 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 4 0 0
38432 +4 0 0 7 11 13 13 16 17 4 0 0 3 3 3 34 47 55
38433 +80 127 157 146 190 211 172 205 220 136 185 209 136 185 209 136 185 209
38434 +28 67 93 22 40 52 55 98 126 55 98 126 21 29 34 7 11 13
38435 +50 82 103 101 161 196 101 161 196 35 83 115 13 20 25 2 2 1
38436 +1 1 2 1 1 2 37 51 59 131 129 131 174 174 174 174 174 174
38437 +167 166 167 163 162 163 163 162 163 167 166 167 174 174 174 125 124 125
38438 +16 19 21 4 0 0
38439 +4 4 4 4 0 0 4 0 0 60 74 84 174 174 174 174 174 174
38440 +158 157 158 155 154 155 155 154 155 156 155 156 155 154 155 158 157 158
38441 +167 166 167 165 164 165 131 129 131 60 73 81 13 16 17 4 0 0
38442 +4 0 0 4 3 3 6 6 6 4 3 3 5 5 5 4 4 4
38443 +4 4 4 3 2 2 0 0 0 0 0 0 7 11 13 45 69 86
38444 +80 127 157 71 116 144 43 61 72 7 11 13 0 0 0 1 1 1
38445 +4 3 3 4 4 4 4 4 4 4 4 4 6 6 6 5 5 5
38446 +3 2 2 4 0 0 1 0 0 21 29 34 59 113 148 136 185 209
38447 +146 190 211 136 185 209 136 185 209 136 185 209 136 185 209 136 185 209
38448 +68 124 159 44 81 103 22 40 52 13 16 17 43 61 72 90 154 193
38449 +136 185 209 59 113 148 21 29 34 3 4 3 1 1 1 0 0 0
38450 +24 26 27 125 124 125 163 162 163 174 174 174 166 165 166 165 164 165
38451 +163 162 163 125 124 125 125 124 125 125 124 125 125 124 125 26 28 28
38452 +4 0 0 4 3 3
38453 +3 3 3 0 0 0 24 26 27 153 152 153 177 184 187 158 157 158
38454 +156 155 156 156 155 156 155 154 155 155 154 155 165 164 165 174 174 174
38455 +155 154 155 60 74 84 26 28 28 4 0 0 4 0 0 3 1 0
38456 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 3 3
38457 +2 0 0 0 0 0 0 0 0 32 43 50 72 125 159 101 161 196
38458 +136 185 209 101 161 196 101 161 196 79 117 143 32 43 50 0 0 0
38459 +0 0 0 2 2 2 4 4 4 4 4 4 3 3 3 1 0 0
38460 +0 0 0 4 5 5 49 76 92 101 161 196 146 190 211 146 190 211
38461 +136 185 209 136 185 209 136 185 209 136 185 209 136 185 209 90 154 193
38462 +28 67 93 13 16 17 37 51 59 80 127 157 136 185 209 90 154 193
38463 +22 40 52 6 9 11 3 4 3 2 2 1 16 19 21 60 73 81
38464 +137 136 137 163 162 163 158 157 158 166 165 166 167 166 167 153 152 153
38465 +60 74 84 37 38 37 6 6 6 13 16 17 4 0 0 1 0 0
38466 +3 2 2 4 4 4
38467 +3 2 2 4 0 0 37 38 37 137 136 137 167 166 167 158 157 158
38468 +157 156 157 154 153 154 157 156 157 167 166 167 174 174 174 125 124 125
38469 +37 38 37 4 0 0 4 0 0 4 0 0 4 3 3 4 4 4
38470 +4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
38471 +0 0 0 16 21 25 55 98 126 90 154 193 136 185 209 101 161 196
38472 +101 161 196 101 161 196 136 185 209 136 185 209 101 161 196 55 98 126
38473 +14 17 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
38474 +22 40 52 90 154 193 146 190 211 146 190 211 136 185 209 136 185 209
38475 +136 185 209 136 185 209 136 185 209 101 161 196 35 83 115 7 11 13
38476 +17 23 27 59 113 148 136 185 209 101 161 196 34 86 122 7 12 15
38477 +2 5 5 3 4 3 6 6 6 60 73 81 131 129 131 163 162 163
38478 +166 165 166 174 174 174 174 174 174 163 162 163 125 124 125 41 54 63
38479 +13 16 17 4 0 0 4 0 0 4 0 0 1 0 0 2 2 2
38480 +4 4 4 4 4 4
38481 +1 1 1 2 1 0 43 57 68 137 136 137 153 152 153 153 152 153
38482 +163 162 163 156 155 156 165 164 165 167 166 167 60 74 84 6 6 6
38483 +4 0 0 4 0 0 5 5 5 4 4 4 4 4 4 4 4 4
38484 +4 5 5 6 6 6 4 3 3 0 0 0 0 0 0 11 15 18
38485 +40 71 93 100 139 164 101 161 196 101 161 196 101 161 196 101 161 196
38486 +101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 136 185 209
38487 +101 161 196 45 69 86 6 6 6 0 0 0 17 23 27 55 98 126
38488 +136 185 209 146 190 211 136 185 209 136 185 209 136 185 209 136 185 209
38489 +136 185 209 136 185 209 90 154 193 22 40 52 7 11 13 50 82 103
38490 +136 185 209 136 185 209 53 118 160 22 40 52 7 11 13 2 5 5
38491 +3 4 3 37 38 37 125 124 125 157 156 157 166 165 166 167 166 167
38492 +174 174 174 174 174 174 137 136 137 60 73 81 4 0 0 4 0 0
38493 +4 0 0 4 0 0 5 5 5 3 3 3 3 3 3 4 4 4
38494 +4 4 4 4 4 4
38495 +4 0 0 4 0 0 41 54 63 137 136 137 125 124 125 131 129 131
38496 +155 154 155 167 166 167 174 174 174 60 74 84 6 6 6 4 0 0
38497 +4 3 3 6 6 6 4 4 4 4 4 4 4 4 4 5 5 5
38498 +4 4 4 1 1 1 0 0 0 3 6 7 41 65 82 72 125 159
38499 +101 161 196 101 161 196 101 161 196 90 154 193 90 154 193 101 161 196
38500 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
38501 +136 185 209 136 185 209 80 127 157 55 98 126 101 161 196 146 190 211
38502 +136 185 209 136 185 209 136 185 209 101 161 196 136 185 209 101 161 196
38503 +136 185 209 101 161 196 35 83 115 22 30 35 101 161 196 172 205 220
38504 +90 154 193 28 67 93 7 11 13 2 5 5 3 4 3 13 16 17
38505 +85 115 134 167 166 167 174 174 174 174 174 174 174 174 174 174 174 174
38506 +167 166 167 60 74 84 13 16 17 4 0 0 4 0 0 4 3 3
38507 +6 6 6 5 5 5 4 4 4 5 5 5 4 4 4 5 5 5
38508 +5 5 5 5 5 5
38509 +1 1 1 4 0 0 41 54 63 137 136 137 137 136 137 125 124 125
38510 +131 129 131 167 166 167 157 156 157 37 38 37 6 6 6 4 0 0
38511 +6 6 6 5 5 5 4 4 4 4 4 4 4 5 5 2 2 1
38512 +0 0 0 0 0 0 26 37 45 58 111 146 101 161 196 101 161 196
38513 +101 161 196 90 154 193 90 154 193 90 154 193 101 161 196 101 161 196
38514 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
38515 +101 161 196 136 185 209 136 185 209 136 185 209 146 190 211 136 185 209
38516 +136 185 209 101 161 196 136 185 209 136 185 209 101 161 196 136 185 209
38517 +101 161 196 136 185 209 136 185 209 136 185 209 136 185 209 16 89 141
38518 +7 11 13 2 5 5 2 5 5 13 16 17 60 73 81 154 154 154
38519 +174 174 174 174 174 174 174 174 174 174 174 174 163 162 163 125 124 125
38520 +24 26 27 4 0 0 4 0 0 4 0 0 5 5 5 5 5 5
38521 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
38522 +5 5 5 4 4 4
38523 +4 0 0 6 6 6 37 38 37 137 136 137 137 136 137 131 129 131
38524 +131 129 131 153 152 153 131 129 131 26 28 28 4 0 0 4 3 3
38525 +6 6 6 4 4 4 4 4 4 4 4 4 0 0 0 0 0 0
38526 +13 20 25 51 88 114 90 154 193 101 161 196 101 161 196 90 154 193
38527 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
38528 +101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 101 161 196
38529 +101 161 196 136 185 209 101 161 196 136 185 209 136 185 209 101 161 196
38530 +136 185 209 101 161 196 136 185 209 101 161 196 101 161 196 101 161 196
38531 +136 185 209 136 185 209 136 185 209 37 112 160 21 29 34 5 7 8
38532 +2 5 5 13 16 17 43 57 68 131 129 131 174 174 174 174 174 174
38533 +174 174 174 167 166 167 157 156 157 125 124 125 37 38 37 4 0 0
38534 +4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
38535 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38536 +4 4 4 4 4 4
38537 +1 1 1 4 0 0 41 54 63 153 152 153 137 136 137 137 136 137
38538 +137 136 137 153 152 153 125 124 125 24 26 27 4 0 0 3 2 2
38539 +4 4 4 4 4 4 4 3 3 4 0 0 3 6 7 43 61 72
38540 +64 123 161 101 161 196 90 154 193 90 154 193 90 154 193 90 154 193
38541 +90 154 193 90 154 193 90 154 193 90 154 193 101 161 196 90 154 193
38542 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
38543 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
38544 +136 185 209 101 161 196 101 161 196 136 185 209 136 185 209 101 161 196
38545 +101 161 196 90 154 193 28 67 93 13 16 17 7 11 13 3 6 7
38546 +37 51 59 125 124 125 163 162 163 174 174 174 167 166 167 166 165 166
38547 +167 166 167 131 129 131 60 73 81 4 0 0 4 0 0 4 0 0
38548 +3 3 3 5 5 5 6 6 6 4 4 4 4 4 4 4 4 4
38549 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38550 +4 4 4 4 4 4
38551 +4 0 0 4 0 0 41 54 63 137 136 137 153 152 153 137 136 137
38552 +153 152 153 157 156 157 125 124 125 24 26 27 0 0 0 2 2 2
38553 +4 4 4 4 4 4 2 0 0 0 0 0 28 67 93 90 154 193
38554 +90 154 193 90 154 193 90 154 193 90 154 193 64 123 161 90 154 193
38555 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
38556 +90 154 193 101 161 196 101 161 196 101 161 196 90 154 193 136 185 209
38557 +101 161 196 101 161 196 136 185 209 101 161 196 136 185 209 101 161 196
38558 +101 161 196 101 161 196 136 185 209 101 161 196 101 161 196 90 154 193
38559 +35 83 115 13 16 17 3 6 7 2 5 5 13 16 17 60 74 84
38560 +154 154 154 166 165 166 165 164 165 158 157 158 163 162 163 157 156 157
38561 +60 74 84 13 16 17 4 0 0 4 0 0 3 2 2 4 4 4
38562 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38563 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38564 +4 4 4 4 4 4
38565 +1 1 1 4 0 0 41 54 63 157 156 157 155 154 155 137 136 137
38566 +153 152 153 158 157 158 137 136 137 26 28 28 2 0 0 2 2 2
38567 +4 4 4 4 4 4 1 0 0 6 10 14 34 86 122 90 154 193
38568 +64 123 161 90 154 193 64 123 161 90 154 193 90 154 193 90 154 193
38569 +64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
38570 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
38571 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
38572 +136 185 209 101 161 196 136 185 209 90 154 193 26 108 161 22 40 52
38573 +13 16 17 5 7 8 2 5 5 2 5 5 37 38 37 165 164 165
38574 +174 174 174 163 162 163 154 154 154 165 164 165 167 166 167 60 73 81
38575 +6 6 6 4 0 0 4 0 0 4 4 4 4 4 4 4 4 4
38576 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38577 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38578 +4 4 4 4 4 4
38579 +4 0 0 6 6 6 41 54 63 156 155 156 158 157 158 153 152 153
38580 +156 155 156 165 164 165 137 136 137 26 28 28 0 0 0 2 2 2
38581 +4 4 5 4 4 4 2 0 0 7 12 15 31 96 139 64 123 161
38582 +90 154 193 64 123 161 90 154 193 90 154 193 64 123 161 90 154 193
38583 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
38584 +90 154 193 90 154 193 90 154 193 101 161 196 101 161 196 101 161 196
38585 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
38586 +101 161 196 136 185 209 26 108 161 22 40 52 7 11 13 5 7 8
38587 +2 5 5 2 5 5 2 5 5 2 2 1 37 38 37 158 157 158
38588 +174 174 174 154 154 154 156 155 156 167 166 167 165 164 165 37 38 37
38589 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38590 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38591 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38592 +4 4 4 4 4 4
38593 +3 1 0 4 0 0 60 73 81 157 156 157 163 162 163 153 152 153
38594 +158 157 158 167 166 167 137 136 137 26 28 28 2 0 0 2 2 2
38595 +4 5 5 4 4 4 4 0 0 7 12 15 24 86 132 26 108 161
38596 +37 112 160 64 123 161 90 154 193 64 123 161 90 154 193 90 154 193
38597 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
38598 +90 154 193 101 161 196 90 154 193 101 161 196 101 161 196 101 161 196
38599 +101 161 196 101 161 196 101 161 196 136 185 209 101 161 196 136 185 209
38600 +90 154 193 35 83 115 13 16 17 13 16 17 7 11 13 3 6 7
38601 +5 7 8 6 6 6 3 4 3 2 2 1 30 32 34 154 154 154
38602 +167 166 167 154 154 154 154 154 154 174 174 174 165 164 165 37 38 37
38603 +6 6 6 4 0 0 6 6 6 4 4 4 4 4 4 4 4 4
38604 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38605 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38606 +4 4 4 4 4 4
38607 +4 0 0 4 0 0 41 54 63 163 162 163 166 165 166 154 154 154
38608 +163 162 163 174 174 174 137 136 137 26 28 28 0 0 0 2 2 2
38609 +4 5 5 4 4 5 1 1 2 6 10 14 28 67 93 18 97 151
38610 +18 97 151 18 97 151 26 108 161 37 112 160 37 112 160 90 154 193
38611 +64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
38612 +90 154 193 101 161 196 101 161 196 90 154 193 101 161 196 101 161 196
38613 +101 161 196 101 161 196 101 161 196 136 185 209 90 154 193 16 89 141
38614 +13 20 25 7 11 13 5 7 8 5 7 8 2 5 5 4 5 5
38615 +3 4 3 4 5 5 3 4 3 0 0 0 37 38 37 158 157 158
38616 +174 174 174 158 157 158 158 157 158 167 166 167 174 174 174 41 54 63
38617 +4 0 0 3 2 2 5 5 5 4 4 4 4 4 4 4 4 4
38618 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38619 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38620 +4 4 4 4 4 4
38621 +1 1 1 4 0 0 60 73 81 165 164 165 174 174 174 158 157 158
38622 +167 166 167 174 174 174 153 152 153 26 28 28 2 0 0 2 2 2
38623 +4 5 5 4 4 4 4 0 0 7 12 15 10 87 144 10 87 144
38624 +18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
38625 +26 108 161 37 112 160 53 118 160 90 154 193 90 154 193 90 154 193
38626 +90 154 193 90 154 193 101 161 196 101 161 196 101 161 196 101 161 196
38627 +101 161 196 136 185 209 90 154 193 26 108 161 22 40 52 13 16 17
38628 +7 11 13 3 6 7 5 7 8 5 7 8 2 5 5 4 5 5
38629 +4 5 5 6 6 6 3 4 3 0 0 0 30 32 34 158 157 158
38630 +174 174 174 156 155 156 155 154 155 165 164 165 154 153 154 37 38 37
38631 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38632 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38633 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38634 +4 4 4 4 4 4
38635 +4 0 0 4 0 0 60 73 81 167 166 167 174 174 174 163 162 163
38636 +174 174 174 174 174 174 153 152 153 26 28 28 0 0 0 3 3 3
38637 +5 5 5 4 4 4 1 1 2 7 12 15 28 67 93 18 97 151
38638 +18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
38639 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
38640 +90 154 193 26 108 161 90 154 193 90 154 193 90 154 193 101 161 196
38641 +101 161 196 26 108 161 22 40 52 13 16 17 7 11 13 2 5 5
38642 +2 5 5 6 6 6 2 5 5 4 5 5 4 5 5 4 5 5
38643 +3 4 3 5 5 5 3 4 3 2 0 0 30 32 34 137 136 137
38644 +153 152 153 137 136 137 131 129 131 137 136 137 131 129 131 37 38 37
38645 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38646 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38647 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38648 +4 4 4 4 4 4
38649 +1 1 1 4 0 0 60 73 81 167 166 167 174 174 174 166 165 166
38650 +174 174 174 177 184 187 153 152 153 30 32 34 1 0 0 3 3 3
38651 +5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
38652 +18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
38653 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
38654 +26 108 161 26 108 161 26 108 161 90 154 193 90 154 193 26 108 161
38655 +35 83 115 13 16 17 7 11 13 5 7 8 3 6 7 5 7 8
38656 +2 5 5 6 6 6 4 5 5 4 5 5 3 4 3 4 5 5
38657 +3 4 3 6 6 6 3 4 3 0 0 0 26 28 28 125 124 125
38658 +131 129 131 125 124 125 125 124 125 131 129 131 131 129 131 37 38 37
38659 +4 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38660 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38661 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38662 +4 4 4 4 4 4
38663 +3 1 0 4 0 0 60 73 81 174 174 174 177 184 187 167 166 167
38664 +174 174 174 177 184 187 153 152 153 30 32 34 0 0 0 3 3 3
38665 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
38666 +18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
38667 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
38668 +26 108 161 90 154 193 26 108 161 26 108 161 24 86 132 13 20 25
38669 +7 11 13 13 20 25 22 40 52 5 7 8 3 4 3 3 4 3
38670 +4 5 5 3 4 3 4 5 5 3 4 3 4 5 5 3 4 3
38671 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
38672 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38673 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38674 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38675 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38676 +4 4 4 4 4 4
38677 +1 1 1 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
38678 +174 174 174 190 197 201 157 156 157 30 32 34 1 0 0 3 3 3
38679 +5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
38680 +18 97 151 19 95 150 19 95 150 18 97 151 18 97 151 26 108 161
38681 +18 97 151 26 108 161 26 108 161 26 108 161 26 108 161 90 154 193
38682 +26 108 161 26 108 161 26 108 161 22 40 52 2 5 5 3 4 3
38683 +28 67 93 37 112 160 34 86 122 2 5 5 3 4 3 3 4 3
38684 +3 4 3 3 4 3 3 4 3 2 2 1 3 4 3 4 4 4
38685 +4 5 5 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
38686 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38687 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38688 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38689 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38690 +4 4 4 4 4 4
38691 +4 0 0 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
38692 +174 174 174 190 197 201 158 157 158 30 32 34 0 0 0 2 2 2
38693 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
38694 +10 87 144 19 95 150 19 95 150 18 97 151 18 97 151 18 97 151
38695 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
38696 +18 97 151 22 40 52 2 5 5 2 2 1 22 40 52 26 108 161
38697 +90 154 193 37 112 160 22 40 52 3 4 3 13 20 25 22 30 35
38698 +3 6 7 1 1 1 2 2 2 6 9 11 5 5 5 4 3 3
38699 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
38700 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38701 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38702 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38703 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38704 +4 4 4 4 4 4
38705 +1 1 1 4 0 0 60 73 81 177 184 187 193 200 203 174 174 174
38706 +177 184 187 193 200 203 163 162 163 30 32 34 4 0 0 2 2 2
38707 +5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
38708 +10 87 144 10 87 144 19 95 150 19 95 150 19 95 150 18 97 151
38709 +26 108 161 26 108 161 26 108 161 90 154 193 26 108 161 28 67 93
38710 +6 10 14 2 5 5 13 20 25 24 86 132 37 112 160 90 154 193
38711 +10 87 144 7 12 15 2 5 5 28 67 93 37 112 160 28 67 93
38712 +2 2 1 7 12 15 35 83 115 28 67 93 3 6 7 1 0 0
38713 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
38714 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38715 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38716 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38717 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38718 +4 4 4 4 4 4
38719 +4 0 0 4 0 0 60 73 81 174 174 174 190 197 201 174 174 174
38720 +177 184 187 193 200 203 163 162 163 30 32 34 0 0 0 2 2 2
38721 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
38722 +10 87 144 16 89 141 19 95 150 10 87 144 26 108 161 26 108 161
38723 +26 108 161 26 108 161 26 108 161 28 67 93 6 10 14 1 1 2
38724 +7 12 15 28 67 93 26 108 161 16 89 141 24 86 132 21 29 34
38725 +3 4 3 21 29 34 37 112 160 37 112 160 27 99 146 21 29 34
38726 +21 29 34 26 108 161 90 154 193 35 83 115 1 1 2 2 0 0
38727 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
38728 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38729 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38730 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38731 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38732 +4 4 4 4 4 4
38733 +3 1 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
38734 +190 197 201 193 200 203 165 164 165 37 38 37 4 0 0 2 2 2
38735 +5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
38736 +10 87 144 10 87 144 16 89 141 18 97 151 18 97 151 10 87 144
38737 +24 86 132 24 86 132 13 20 25 4 5 7 4 5 7 22 40 52
38738 +18 97 151 37 112 160 26 108 161 7 12 15 1 1 1 0 0 0
38739 +28 67 93 37 112 160 26 108 161 28 67 93 22 40 52 28 67 93
38740 +26 108 161 90 154 193 26 108 161 10 87 144 0 0 0 2 0 0
38741 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
38742 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38743 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38744 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38745 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38746 +4 4 4 4 4 4
38747 +4 0 0 6 6 6 60 73 81 174 174 174 193 200 203 174 174 174
38748 +190 197 201 193 200 203 165 164 165 30 32 34 0 0 0 2 2 2
38749 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
38750 +10 87 144 10 87 144 10 87 144 18 97 151 28 67 93 6 10 14
38751 +0 0 0 1 1 2 4 5 7 13 20 25 16 89 141 26 108 161
38752 +26 108 161 26 108 161 24 86 132 6 9 11 2 3 3 22 40 52
38753 +37 112 160 16 89 141 22 40 52 28 67 93 26 108 161 26 108 161
38754 +90 154 193 26 108 161 26 108 161 28 67 93 1 1 1 4 0 0
38755 +4 4 4 5 5 5 3 3 3 4 0 0 26 28 28 124 126 130
38756 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38757 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38758 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38759 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38760 +4 4 4 4 4 4
38761 +4 0 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
38762 +193 200 203 193 200 203 167 166 167 37 38 37 4 0 0 2 2 2
38763 +5 5 5 4 4 4 4 0 0 6 10 14 28 67 93 10 87 144
38764 +10 87 144 10 87 144 18 97 151 10 87 144 13 20 25 4 5 7
38765 +1 1 2 1 1 1 22 40 52 26 108 161 26 108 161 26 108 161
38766 +26 108 161 26 108 161 26 108 161 24 86 132 22 40 52 22 40 52
38767 +22 40 52 22 40 52 10 87 144 26 108 161 26 108 161 26 108 161
38768 +26 108 161 26 108 161 90 154 193 10 87 144 0 0 0 4 0 0
38769 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
38770 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38771 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38772 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38773 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38774 +4 4 4 4 4 4
38775 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
38776 +190 197 201 205 212 215 167 166 167 30 32 34 0 0 0 2 2 2
38777 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
38778 +10 87 144 10 87 144 10 87 144 10 87 144 22 40 52 1 1 2
38779 +2 0 0 1 1 2 24 86 132 26 108 161 26 108 161 26 108 161
38780 +26 108 161 19 95 150 16 89 141 10 87 144 22 40 52 22 40 52
38781 +10 87 144 26 108 161 37 112 160 26 108 161 26 108 161 26 108 161
38782 +26 108 161 26 108 161 26 108 161 28 67 93 2 0 0 3 1 0
38783 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
38784 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38785 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38786 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38787 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38788 +4 4 4 4 4 4
38789 +4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
38790 +193 200 203 193 200 203 174 174 174 37 38 37 4 0 0 2 2 2
38791 +5 5 5 4 4 4 3 2 2 1 1 2 13 20 25 10 87 144
38792 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 13 20 25
38793 +13 20 25 22 40 52 10 87 144 18 97 151 18 97 151 26 108 161
38794 +10 87 144 13 20 25 6 10 14 21 29 34 24 86 132 18 97 151
38795 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
38796 +26 108 161 90 154 193 18 97 151 13 20 25 0 0 0 4 3 3
38797 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
38798 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38799 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38800 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38801 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38802 +4 4 4 4 4 4
38803 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
38804 +190 197 201 220 221 221 167 166 167 30 32 34 1 0 0 2 2 2
38805 +5 5 5 4 4 4 4 4 5 2 5 5 4 5 7 13 20 25
38806 +28 67 93 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
38807 +10 87 144 10 87 144 18 97 151 10 87 144 18 97 151 18 97 151
38808 +28 67 93 2 3 3 0 0 0 28 67 93 26 108 161 26 108 161
38809 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
38810 +26 108 161 10 87 144 13 20 25 1 1 2 3 2 2 4 4 4
38811 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
38812 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38813 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38814 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38815 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38816 +4 4 4 4 4 4
38817 +4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
38818 +193 200 203 193 200 203 174 174 174 26 28 28 4 0 0 4 3 3
38819 +5 5 5 4 4 4 4 4 4 4 4 5 1 1 2 2 5 5
38820 +4 5 7 22 40 52 10 87 144 10 87 144 18 97 151 10 87 144
38821 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 18 97 151
38822 +10 87 144 28 67 93 22 40 52 10 87 144 26 108 161 18 97 151
38823 +18 97 151 18 97 151 26 108 161 26 108 161 26 108 161 26 108 161
38824 +22 40 52 1 1 2 0 0 0 2 3 3 4 4 4 4 4 4
38825 +4 4 4 5 5 5 4 4 4 0 0 0 26 28 28 131 129 131
38826 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38827 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38828 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38829 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38830 +4 4 4 4 4 4
38831 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
38832 +190 197 201 220 221 221 190 197 201 41 54 63 4 0 0 2 2 2
38833 +6 6 6 4 4 4 4 4 4 4 4 5 4 4 5 3 3 3
38834 +1 1 2 1 1 2 6 10 14 22 40 52 10 87 144 18 97 151
38835 +18 97 151 10 87 144 10 87 144 10 87 144 18 97 151 10 87 144
38836 +10 87 144 18 97 151 26 108 161 18 97 151 18 97 151 10 87 144
38837 +26 108 161 26 108 161 26 108 161 10 87 144 28 67 93 6 10 14
38838 +1 1 2 1 1 2 4 3 3 4 4 5 4 4 4 4 4 4
38839 +5 5 5 5 5 5 1 1 1 4 0 0 37 51 59 137 136 137
38840 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38841 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38842 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38843 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38844 +4 4 4 4 4 4
38845 +4 0 0 4 0 0 60 73 81 220 221 221 193 200 203 174 174 174
38846 +193 200 203 193 200 203 220 221 221 137 136 137 13 16 17 4 0 0
38847 +2 2 2 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5
38848 +4 4 5 4 3 3 1 1 2 4 5 7 13 20 25 28 67 93
38849 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
38850 +10 87 144 18 97 151 18 97 151 10 87 144 18 97 151 26 108 161
38851 +26 108 161 18 97 151 28 67 93 6 10 14 0 0 0 0 0 0
38852 +2 3 3 4 5 5 4 4 5 4 4 4 4 4 4 5 5 5
38853 +3 3 3 1 1 1 0 0 0 16 19 21 125 124 125 137 136 137
38854 +131 129 131 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38855 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38856 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38857 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38858 +4 4 4 4 4 4
38859 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
38860 +193 200 203 190 197 201 220 221 221 220 221 221 153 152 153 30 32 34
38861 +0 0 0 0 0 0 2 2 2 4 4 4 4 4 4 4 4 4
38862 +4 4 4 4 5 5 4 5 7 1 1 2 1 1 2 4 5 7
38863 +13 20 25 28 67 93 10 87 144 18 97 151 10 87 144 10 87 144
38864 +10 87 144 10 87 144 10 87 144 18 97 151 26 108 161 18 97 151
38865 +28 67 93 7 12 15 0 0 0 0 0 0 2 2 1 4 4 4
38866 +4 5 5 4 5 5 4 4 4 4 4 4 3 3 3 0 0 0
38867 +0 0 0 0 0 0 37 38 37 125 124 125 158 157 158 131 129 131
38868 +125 124 125 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38869 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38870 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38871 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38872 +4 4 4 4 4 4
38873 +4 3 3 4 0 0 41 54 63 193 200 203 220 221 221 174 174 174
38874 +193 200 203 193 200 203 193 200 203 220 221 221 244 246 246 193 200 203
38875 +120 125 127 5 5 5 1 0 0 0 0 0 1 1 1 4 4 4
38876 +4 4 4 4 4 4 4 5 5 4 5 5 4 4 5 1 1 2
38877 +4 5 7 4 5 7 22 40 52 10 87 144 10 87 144 10 87 144
38878 +10 87 144 10 87 144 18 97 151 10 87 144 10 87 144 13 20 25
38879 +4 5 7 2 3 3 1 1 2 4 4 4 4 5 5 4 4 4
38880 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 1 2
38881 +24 26 27 60 74 84 153 152 153 163 162 163 137 136 137 125 124 125
38882 +125 124 125 125 124 125 125 124 125 137 136 137 125 124 125 26 28 28
38883 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38884 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38885 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38886 +4 4 4 4 4 4
38887 +4 0 0 6 6 6 26 28 28 156 155 156 220 221 221 220 221 221
38888 +174 174 174 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
38889 +220 221 221 167 166 167 60 73 81 7 11 13 0 0 0 0 0 0
38890 +3 3 3 4 4 4 4 4 4 4 4 4 4 4 5 4 4 5
38891 +4 4 5 1 1 2 1 1 2 4 5 7 22 40 52 10 87 144
38892 +10 87 144 10 87 144 10 87 144 22 40 52 4 5 7 1 1 2
38893 +1 1 2 4 4 5 4 4 4 4 4 4 4 4 4 4 4 4
38894 +5 5 5 2 2 2 0 0 0 4 0 0 16 19 21 60 73 81
38895 +137 136 137 167 166 167 158 157 158 137 136 137 131 129 131 131 129 131
38896 +125 124 125 125 124 125 131 129 131 155 154 155 60 74 84 5 7 8
38897 +0 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38898 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38899 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38900 +4 4 4 4 4 4
38901 +5 5 5 4 0 0 4 0 0 60 73 81 193 200 203 220 221 221
38902 +193 200 203 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
38903 +220 221 221 220 221 221 220 221 221 137 136 137 43 57 68 6 6 6
38904 +4 0 0 1 1 1 4 4 4 4 4 4 4 4 4 4 4 4
38905 +4 4 5 4 4 5 3 2 2 1 1 2 2 5 5 13 20 25
38906 +22 40 52 22 40 52 13 20 25 2 3 3 1 1 2 3 3 3
38907 +4 5 7 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38908 +1 1 1 0 0 0 2 3 3 41 54 63 131 129 131 166 165 166
38909 +166 165 166 155 154 155 153 152 153 137 136 137 137 136 137 125 124 125
38910 +125 124 125 137 136 137 137 136 137 125 124 125 37 38 37 4 3 3
38911 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
38912 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38913 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38914 +4 4 4 4 4 4
38915 +4 3 3 6 6 6 6 6 6 13 16 17 60 73 81 167 166 167
38916 +220 221 221 220 221 221 220 221 221 193 200 203 193 200 203 193 200 203
38917 +205 212 215 220 221 221 220 221 221 244 246 246 205 212 215 125 124 125
38918 +24 26 27 0 0 0 0 0 0 2 2 2 5 5 5 5 5 5
38919 +4 4 4 4 4 4 4 4 4 4 4 5 1 1 2 4 5 7
38920 +4 5 7 4 5 7 1 1 2 3 2 2 4 4 5 4 4 4
38921 +4 4 4 4 4 4 5 5 5 4 4 4 0 0 0 0 0 0
38922 +2 0 0 26 28 28 125 124 125 174 174 174 174 174 174 166 165 166
38923 +156 155 156 153 152 153 137 136 137 137 136 137 131 129 131 137 136 137
38924 +137 136 137 137 136 137 60 74 84 30 32 34 4 0 0 4 0 0
38925 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38926 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38927 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38928 +4 4 4 4 4 4
38929 +5 5 5 6 6 6 4 0 0 4 0 0 6 6 6 26 28 28
38930 +125 124 125 174 174 174 220 221 221 220 221 221 220 221 221 193 200 203
38931 +205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
38932 +193 200 203 60 74 84 13 16 17 4 0 0 0 0 0 3 3 3
38933 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 5 3 3 3
38934 +1 1 2 3 3 3 4 4 5 4 4 5 4 4 4 4 4 4
38935 +5 5 5 5 5 5 2 2 2 0 0 0 0 0 0 13 16 17
38936 +60 74 84 174 174 174 193 200 203 174 174 174 167 166 167 163 162 163
38937 +153 152 153 153 152 153 137 136 137 137 136 137 153 152 153 137 136 137
38938 +125 124 125 41 54 63 24 26 27 4 0 0 4 0 0 5 5 5
38939 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38940 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38941 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38942 +4 4 4 4 4 4
38943 +4 3 3 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
38944 +6 6 6 37 38 37 131 129 131 220 221 221 220 221 221 220 221 221
38945 +193 200 203 193 200 203 220 221 221 205 212 215 220 221 221 244 246 246
38946 +244 246 246 244 246 246 174 174 174 41 54 63 0 0 0 0 0 0
38947 +0 0 0 4 4 4 5 5 5 5 5 5 4 4 4 4 4 5
38948 +4 4 5 4 4 5 4 4 4 4 4 4 6 6 6 6 6 6
38949 +3 3 3 0 0 0 2 0 0 13 16 17 60 73 81 156 155 156
38950 +220 221 221 193 200 203 174 174 174 165 164 165 163 162 163 154 153 154
38951 +153 152 153 153 152 153 158 157 158 163 162 163 137 136 137 60 73 81
38952 +13 16 17 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
38953 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38954 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38955 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38956 +4 4 4 4 4 4
38957 +5 5 5 4 3 3 4 3 3 6 6 6 6 6 6 6 6 6
38958 +6 6 6 6 6 6 6 6 6 37 38 37 167 166 167 244 246 246
38959 +244 246 246 220 221 221 205 212 215 205 212 215 220 221 221 193 200 203
38960 +220 221 221 244 246 246 244 246 246 244 246 246 137 136 137 37 38 37
38961 +3 2 2 0 0 0 1 1 1 5 5 5 5 5 5 4 4 4
38962 +4 4 4 4 4 4 4 4 4 5 5 5 4 4 4 1 1 1
38963 +0 0 0 5 5 5 43 57 68 153 152 153 193 200 203 220 221 221
38964 +177 184 187 174 174 174 167 166 167 166 165 166 158 157 158 157 156 157
38965 +158 157 158 166 165 166 156 155 156 85 115 134 13 16 17 4 0 0
38966 +4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
38967 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38968 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38969 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38970 +4 4 4 4 4 4
38971 +5 5 5 4 3 3 6 6 6 6 6 6 4 0 0 6 6 6
38972 +6 6 6 6 6 6 6 6 6 6 6 6 13 16 17 60 73 81
38973 +177 184 187 220 221 221 220 221 221 220 221 221 205 212 215 220 221 221
38974 +220 221 221 205 212 215 220 221 221 244 246 246 244 246 246 205 212 215
38975 +125 124 125 30 32 34 0 0 0 0 0 0 2 2 2 5 5 5
38976 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 0 0
38977 +37 38 37 131 129 131 205 212 215 220 221 221 193 200 203 174 174 174
38978 +174 174 174 174 174 174 167 166 167 165 164 165 166 165 166 167 166 167
38979 +158 157 158 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
38980 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
38981 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38982 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38983 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38984 +4 4 4 4 4 4
38985 +4 4 4 5 5 5 4 3 3 4 3 3 6 6 6 6 6 6
38986 +4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
38987 +26 28 28 125 124 125 205 212 215 220 221 221 220 221 221 220 221 221
38988 +205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
38989 +244 246 246 190 197 201 60 74 84 16 19 21 4 0 0 0 0 0
38990 +0 0 0 0 0 0 0 0 0 0 0 0 16 19 21 120 125 127
38991 +177 184 187 220 221 221 205 212 215 177 184 187 174 174 174 177 184 187
38992 +174 174 174 174 174 174 167 166 167 174 174 174 166 165 166 137 136 137
38993 +60 73 81 13 16 17 4 0 0 4 0 0 4 3 3 6 6 6
38994 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38995 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38996 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38997 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38998 +4 4 4 4 4 4
38999 +5 5 5 4 3 3 5 5 5 4 3 3 6 6 6 4 0 0
39000 +6 6 6 6 6 6 4 0 0 6 6 6 4 0 0 6 6 6
39001 +6 6 6 6 6 6 37 38 37 137 136 137 193 200 203 220 221 221
39002 +220 221 221 205 212 215 220 221 221 205 212 215 205 212 215 220 221 221
39003 +220 221 221 220 221 221 244 246 246 166 165 166 43 57 68 2 2 2
39004 +0 0 0 4 0 0 16 19 21 60 73 81 157 156 157 202 210 214
39005 +220 221 221 193 200 203 177 184 187 177 184 187 177 184 187 174 174 174
39006 +174 174 174 174 174 174 174 174 174 157 156 157 60 74 84 24 26 27
39007 +4 0 0 4 0 0 4 0 0 6 6 6 4 4 4 4 4 4
39008 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39009 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39010 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39011 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39012 +4 4 4 4 4 4
39013 +4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
39014 +6 6 6 4 0 0 6 6 6 6 6 6 6 6 6 4 0 0
39015 +4 0 0 4 0 0 6 6 6 24 26 27 60 73 81 167 166 167
39016 +220 221 221 220 221 221 220 221 221 205 212 215 205 212 215 205 212 215
39017 +205 212 215 220 221 221 220 221 221 220 221 221 205 212 215 137 136 137
39018 +60 74 84 125 124 125 137 136 137 190 197 201 220 221 221 193 200 203
39019 +177 184 187 177 184 187 177 184 187 174 174 174 174 174 174 177 184 187
39020 +190 197 201 174 174 174 125 124 125 37 38 37 6 6 6 4 0 0
39021 +4 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39022 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39023 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39024 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39025 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39026 +4 4 4 4 4 4
39027 +4 4 4 4 4 4 5 5 5 5 5 5 4 3 3 6 6 6
39028 +4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 6 6 6
39029 +6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
39030 +125 124 125 193 200 203 244 246 246 220 221 221 205 212 215 205 212 215
39031 +205 212 215 193 200 203 205 212 215 205 212 215 220 221 221 220 221 221
39032 +193 200 203 193 200 203 205 212 215 193 200 203 193 200 203 177 184 187
39033 +190 197 201 190 197 201 174 174 174 190 197 201 193 200 203 190 197 201
39034 +153 152 153 60 73 81 4 0 0 4 0 0 4 0 0 3 2 2
39035 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39036 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39037 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39038 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39039 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39040 +4 4 4 4 4 4
39041 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
39042 +6 6 6 4 3 3 4 3 3 4 3 3 6 6 6 6 6 6
39043 +4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 4 0 0
39044 +4 0 0 26 28 28 131 129 131 220 221 221 244 246 246 220 221 221
39045 +205 212 215 193 200 203 205 212 215 193 200 203 193 200 203 205 212 215
39046 +220 221 221 193 200 203 193 200 203 193 200 203 190 197 201 174 174 174
39047 +174 174 174 190 197 201 193 200 203 193 200 203 167 166 167 125 124 125
39048 +6 6 6 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
39049 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39050 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39051 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39052 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39053 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39054 +4 4 4 4 4 4
39055 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
39056 +5 5 5 4 3 3 5 5 5 6 6 6 4 3 3 5 5 5
39057 +6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
39058 +4 0 0 4 0 0 6 6 6 41 54 63 158 157 158 220 221 221
39059 +220 221 221 220 221 221 193 200 203 193 200 203 193 200 203 190 197 201
39060 +190 197 201 190 197 201 190 197 201 190 197 201 174 174 174 193 200 203
39061 +193 200 203 220 221 221 174 174 174 125 124 125 37 38 37 4 0 0
39062 +4 0 0 4 3 3 6 6 6 4 4 4 4 4 4 4 4 4
39063 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39064 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39065 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39066 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39067 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39068 +4 4 4 4 4 4
39069 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39070 +4 4 4 5 5 5 4 3 3 4 3 3 4 3 3 5 5 5
39071 +4 3 3 6 6 6 5 5 5 4 3 3 6 6 6 6 6 6
39072 +6 6 6 6 6 6 4 0 0 4 0 0 13 16 17 60 73 81
39073 +174 174 174 220 221 221 220 221 221 205 212 215 190 197 201 174 174 174
39074 +193 200 203 174 174 174 190 197 201 174 174 174 193 200 203 220 221 221
39075 +193 200 203 131 129 131 37 38 37 6 6 6 4 0 0 4 0 0
39076 +6 6 6 6 6 6 4 3 3 5 5 5 4 4 4 4 4 4
39077 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39078 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39079 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39080 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39081 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39082 +4 4 4 4 4 4
39083 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39084 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
39085 +5 5 5 4 3 3 4 3 3 5 5 5 4 3 3 4 3 3
39086 +5 5 5 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
39087 +6 6 6 125 124 125 174 174 174 220 221 221 220 221 221 193 200 203
39088 +193 200 203 193 200 203 193 200 203 193 200 203 220 221 221 158 157 158
39089 +60 73 81 6 6 6 4 0 0 4 0 0 5 5 5 6 6 6
39090 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
39091 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39092 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39093 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39094 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39095 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39096 +4 4 4 4 4 4
39097 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39098 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39099 +4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
39100 +5 5 5 5 5 5 6 6 6 6 6 6 4 0 0 4 0 0
39101 +4 0 0 4 0 0 26 28 28 125 124 125 174 174 174 193 200 203
39102 +193 200 203 174 174 174 193 200 203 167 166 167 125 124 125 6 6 6
39103 +6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 5 5 5
39104 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
39105 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39106 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39107 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39108 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39109 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39110 +4 4 4 4 4 4
39111 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39112 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39113 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
39114 +4 3 3 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
39115 +6 6 6 4 0 0 4 0 0 6 6 6 37 38 37 125 124 125
39116 +153 152 153 131 129 131 125 124 125 37 38 37 6 6 6 6 6 6
39117 +6 6 6 4 0 0 6 6 6 6 6 6 4 3 3 5 5 5
39118 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39119 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39120 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39121 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39122 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39123 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39124 +4 4 4 4 4 4
39125 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39126 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39127 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39128 +4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
39129 +6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
39130 +24 26 27 24 26 27 6 6 6 6 6 6 6 6 6 4 0 0
39131 +6 6 6 6 6 6 4 0 0 6 6 6 5 5 5 4 3 3
39132 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39133 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39134 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39135 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39136 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39137 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39138 +4 4 4 4 4 4
39139 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39140 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39141 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39142 +4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
39143 +4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
39144 +6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
39145 +4 0 0 6 6 6 6 6 6 4 3 3 5 5 5 4 4 4
39146 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39147 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39148 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39149 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39150 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39151 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39152 +4 4 4 4 4 4
39153 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39154 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39155 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39156 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 5 5 5
39157 +5 5 5 5 5 5 4 0 0 6 6 6 4 0 0 6 6 6
39158 +6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 4 0 0
39159 +6 6 6 4 3 3 5 5 5 4 3 3 5 5 5 4 4 4
39160 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39161 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39162 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39163 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39164 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39165 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39166 +4 4 4 4 4 4
39167 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39168 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39169 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39170 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
39171 +4 3 3 6 6 6 4 3 3 6 6 6 6 6 6 6 6 6
39172 +4 0 0 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
39173 +6 6 6 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
39174 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39175 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39176 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39177 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39178 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39179 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39180 +4 4 4 4 4 4
39181 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39182 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39183 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39184 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39185 +4 4 4 5 5 5 4 3 3 5 5 5 4 0 0 6 6 6
39186 +6 6 6 4 0 0 6 6 6 6 6 6 4 0 0 6 6 6
39187 +4 3 3 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
39188 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39189 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39190 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39191 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39192 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39193 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39194 +4 4 4 4 4 4
39195 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39196 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39197 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39198 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39199 +4 4 4 5 5 5 4 3 3 5 5 5 6 6 6 4 3 3
39200 +4 3 3 6 6 6 6 6 6 4 3 3 6 6 6 4 3 3
39201 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39202 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39203 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39204 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39205 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39206 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39207 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39208 +4 4 4 4 4 4
39209 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39210 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39211 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39212 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39213 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 6 6 6
39214 +5 5 5 4 3 3 4 3 3 4 3 3 5 5 5 5 5 5
39215 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39216 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39217 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39218 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39219 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39220 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39221 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39222 +4 4 4 4 4 4
39223 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39224 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39225 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39226 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39227 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
39228 +5 5 5 4 3 3 5 5 5 5 5 5 4 4 4 4 4 4
39229 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39230 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39231 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39232 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39233 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39234 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39235 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39236 +4 4 4 4 4 4
39237 diff -urNp linux-3.0.8/drivers/video/udlfb.c linux-3.0.8/drivers/video/udlfb.c
39238 --- linux-3.0.8/drivers/video/udlfb.c 2011-07-21 22:17:23.000000000 -0400
39239 +++ linux-3.0.8/drivers/video/udlfb.c 2011-08-23 21:47:56.000000000 -0400
39240 @@ -586,11 +586,11 @@ int dlfb_handle_damage(struct dlfb_data
39241 dlfb_urb_completion(urb);
39242
39243 error:
39244 - atomic_add(bytes_sent, &dev->bytes_sent);
39245 - atomic_add(bytes_identical, &dev->bytes_identical);
39246 - atomic_add(width*height*2, &dev->bytes_rendered);
39247 + atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
39248 + atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
39249 + atomic_add_unchecked(width*height*2, &dev->bytes_rendered);
39250 end_cycles = get_cycles();
39251 - atomic_add(((unsigned int) ((end_cycles - start_cycles)
39252 + atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
39253 >> 10)), /* Kcycles */
39254 &dev->cpu_kcycles_used);
39255
39256 @@ -711,11 +711,11 @@ static void dlfb_dpy_deferred_io(struct
39257 dlfb_urb_completion(urb);
39258
39259 error:
39260 - atomic_add(bytes_sent, &dev->bytes_sent);
39261 - atomic_add(bytes_identical, &dev->bytes_identical);
39262 - atomic_add(bytes_rendered, &dev->bytes_rendered);
39263 + atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
39264 + atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
39265 + atomic_add_unchecked(bytes_rendered, &dev->bytes_rendered);
39266 end_cycles = get_cycles();
39267 - atomic_add(((unsigned int) ((end_cycles - start_cycles)
39268 + atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
39269 >> 10)), /* Kcycles */
39270 &dev->cpu_kcycles_used);
39271 }
39272 @@ -1307,7 +1307,7 @@ static ssize_t metrics_bytes_rendered_sh
39273 struct fb_info *fb_info = dev_get_drvdata(fbdev);
39274 struct dlfb_data *dev = fb_info->par;
39275 return snprintf(buf, PAGE_SIZE, "%u\n",
39276 - atomic_read(&dev->bytes_rendered));
39277 + atomic_read_unchecked(&dev->bytes_rendered));
39278 }
39279
39280 static ssize_t metrics_bytes_identical_show(struct device *fbdev,
39281 @@ -1315,7 +1315,7 @@ static ssize_t metrics_bytes_identical_s
39282 struct fb_info *fb_info = dev_get_drvdata(fbdev);
39283 struct dlfb_data *dev = fb_info->par;
39284 return snprintf(buf, PAGE_SIZE, "%u\n",
39285 - atomic_read(&dev->bytes_identical));
39286 + atomic_read_unchecked(&dev->bytes_identical));
39287 }
39288
39289 static ssize_t metrics_bytes_sent_show(struct device *fbdev,
39290 @@ -1323,7 +1323,7 @@ static ssize_t metrics_bytes_sent_show(s
39291 struct fb_info *fb_info = dev_get_drvdata(fbdev);
39292 struct dlfb_data *dev = fb_info->par;
39293 return snprintf(buf, PAGE_SIZE, "%u\n",
39294 - atomic_read(&dev->bytes_sent));
39295 + atomic_read_unchecked(&dev->bytes_sent));
39296 }
39297
39298 static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
39299 @@ -1331,7 +1331,7 @@ static ssize_t metrics_cpu_kcycles_used_
39300 struct fb_info *fb_info = dev_get_drvdata(fbdev);
39301 struct dlfb_data *dev = fb_info->par;
39302 return snprintf(buf, PAGE_SIZE, "%u\n",
39303 - atomic_read(&dev->cpu_kcycles_used));
39304 + atomic_read_unchecked(&dev->cpu_kcycles_used));
39305 }
39306
39307 static ssize_t edid_show(
39308 @@ -1388,10 +1388,10 @@ static ssize_t metrics_reset_store(struc
39309 struct fb_info *fb_info = dev_get_drvdata(fbdev);
39310 struct dlfb_data *dev = fb_info->par;
39311
39312 - atomic_set(&dev->bytes_rendered, 0);
39313 - atomic_set(&dev->bytes_identical, 0);
39314 - atomic_set(&dev->bytes_sent, 0);
39315 - atomic_set(&dev->cpu_kcycles_used, 0);
39316 + atomic_set_unchecked(&dev->bytes_rendered, 0);
39317 + atomic_set_unchecked(&dev->bytes_identical, 0);
39318 + atomic_set_unchecked(&dev->bytes_sent, 0);
39319 + atomic_set_unchecked(&dev->cpu_kcycles_used, 0);
39320
39321 return count;
39322 }
39323 diff -urNp linux-3.0.8/drivers/video/uvesafb.c linux-3.0.8/drivers/video/uvesafb.c
39324 --- linux-3.0.8/drivers/video/uvesafb.c 2011-07-21 22:17:23.000000000 -0400
39325 +++ linux-3.0.8/drivers/video/uvesafb.c 2011-08-23 21:47:56.000000000 -0400
39326 @@ -19,6 +19,7 @@
39327 #include <linux/io.h>
39328 #include <linux/mutex.h>
39329 #include <linux/slab.h>
39330 +#include <linux/moduleloader.h>
39331 #include <video/edid.h>
39332 #include <video/uvesafb.h>
39333 #ifdef CONFIG_X86
39334 @@ -121,7 +122,7 @@ static int uvesafb_helper_start(void)
39335 NULL,
39336 };
39337
39338 - return call_usermodehelper(v86d_path, argv, envp, 1);
39339 + return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
39340 }
39341
39342 /*
39343 @@ -569,10 +570,32 @@ static int __devinit uvesafb_vbe_getpmi(
39344 if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
39345 par->pmi_setpal = par->ypan = 0;
39346 } else {
39347 +
39348 +#ifdef CONFIG_PAX_KERNEXEC
39349 +#ifdef CONFIG_MODULES
39350 + par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
39351 +#endif
39352 + if (!par->pmi_code) {
39353 + par->pmi_setpal = par->ypan = 0;
39354 + return 0;
39355 + }
39356 +#endif
39357 +
39358 par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
39359 + task->t.regs.edi);
39360 +
39361 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
39362 + pax_open_kernel();
39363 + memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
39364 + pax_close_kernel();
39365 +
39366 + par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
39367 + par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
39368 +#else
39369 par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
39370 par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
39371 +#endif
39372 +
39373 printk(KERN_INFO "uvesafb: protected mode interface info at "
39374 "%04x:%04x\n",
39375 (u16)task->t.regs.es, (u16)task->t.regs.edi);
39376 @@ -1821,6 +1844,11 @@ out:
39377 if (par->vbe_modes)
39378 kfree(par->vbe_modes);
39379
39380 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
39381 + if (par->pmi_code)
39382 + module_free_exec(NULL, par->pmi_code);
39383 +#endif
39384 +
39385 framebuffer_release(info);
39386 return err;
39387 }
39388 @@ -1847,6 +1875,12 @@ static int uvesafb_remove(struct platfor
39389 kfree(par->vbe_state_orig);
39390 if (par->vbe_state_saved)
39391 kfree(par->vbe_state_saved);
39392 +
39393 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
39394 + if (par->pmi_code)
39395 + module_free_exec(NULL, par->pmi_code);
39396 +#endif
39397 +
39398 }
39399
39400 framebuffer_release(info);
39401 diff -urNp linux-3.0.8/drivers/video/vesafb.c linux-3.0.8/drivers/video/vesafb.c
39402 --- linux-3.0.8/drivers/video/vesafb.c 2011-07-21 22:17:23.000000000 -0400
39403 +++ linux-3.0.8/drivers/video/vesafb.c 2011-08-23 21:47:56.000000000 -0400
39404 @@ -9,6 +9,7 @@
39405 */
39406
39407 #include <linux/module.h>
39408 +#include <linux/moduleloader.h>
39409 #include <linux/kernel.h>
39410 #include <linux/errno.h>
39411 #include <linux/string.h>
39412 @@ -52,8 +53,8 @@ static int vram_remap __initdata; /*
39413 static int vram_total __initdata; /* Set total amount of memory */
39414 static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
39415 static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
39416 -static void (*pmi_start)(void) __read_mostly;
39417 -static void (*pmi_pal) (void) __read_mostly;
39418 +static void (*pmi_start)(void) __read_only;
39419 +static void (*pmi_pal) (void) __read_only;
39420 static int depth __read_mostly;
39421 static int vga_compat __read_mostly;
39422 /* --------------------------------------------------------------------- */
39423 @@ -233,6 +234,7 @@ static int __init vesafb_probe(struct pl
39424 unsigned int size_vmode;
39425 unsigned int size_remap;
39426 unsigned int size_total;
39427 + void *pmi_code = NULL;
39428
39429 if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
39430 return -ENODEV;
39431 @@ -275,10 +277,6 @@ static int __init vesafb_probe(struct pl
39432 size_remap = size_total;
39433 vesafb_fix.smem_len = size_remap;
39434
39435 -#ifndef __i386__
39436 - screen_info.vesapm_seg = 0;
39437 -#endif
39438 -
39439 if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
39440 printk(KERN_WARNING
39441 "vesafb: cannot reserve video memory at 0x%lx\n",
39442 @@ -307,9 +305,21 @@ static int __init vesafb_probe(struct pl
39443 printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
39444 vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
39445
39446 +#ifdef __i386__
39447 +
39448 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
39449 + pmi_code = module_alloc_exec(screen_info.vesapm_size);
39450 + if (!pmi_code)
39451 +#elif !defined(CONFIG_PAX_KERNEXEC)
39452 + if (0)
39453 +#endif
39454 +
39455 +#endif
39456 + screen_info.vesapm_seg = 0;
39457 +
39458 if (screen_info.vesapm_seg) {
39459 - printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
39460 - screen_info.vesapm_seg,screen_info.vesapm_off);
39461 + printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
39462 + screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
39463 }
39464
39465 if (screen_info.vesapm_seg < 0xc000)
39466 @@ -317,9 +327,25 @@ static int __init vesafb_probe(struct pl
39467
39468 if (ypan || pmi_setpal) {
39469 unsigned short *pmi_base;
39470 +
39471 pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
39472 - pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
39473 - pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
39474 +
39475 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
39476 + pax_open_kernel();
39477 + memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
39478 +#else
39479 + pmi_code = pmi_base;
39480 +#endif
39481 +
39482 + pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
39483 + pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
39484 +
39485 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
39486 + pmi_start = ktva_ktla(pmi_start);
39487 + pmi_pal = ktva_ktla(pmi_pal);
39488 + pax_close_kernel();
39489 +#endif
39490 +
39491 printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
39492 if (pmi_base[3]) {
39493 printk(KERN_INFO "vesafb: pmi: ports = ");
39494 @@ -488,6 +514,11 @@ static int __init vesafb_probe(struct pl
39495 info->node, info->fix.id);
39496 return 0;
39497 err:
39498 +
39499 +#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
39500 + module_free_exec(NULL, pmi_code);
39501 +#endif
39502 +
39503 if (info->screen_base)
39504 iounmap(info->screen_base);
39505 framebuffer_release(info);
39506 diff -urNp linux-3.0.8/drivers/video/via/via_clock.h linux-3.0.8/drivers/video/via/via_clock.h
39507 --- linux-3.0.8/drivers/video/via/via_clock.h 2011-07-21 22:17:23.000000000 -0400
39508 +++ linux-3.0.8/drivers/video/via/via_clock.h 2011-08-23 21:47:56.000000000 -0400
39509 @@ -56,7 +56,7 @@ struct via_clock {
39510
39511 void (*set_engine_pll_state)(u8 state);
39512 void (*set_engine_pll)(struct via_pll_config config);
39513 -};
39514 +} __no_const;
39515
39516
39517 static inline u32 get_pll_internal_frequency(u32 ref_freq,
39518 diff -urNp linux-3.0.8/drivers/virtio/virtio_balloon.c linux-3.0.8/drivers/virtio/virtio_balloon.c
39519 --- linux-3.0.8/drivers/virtio/virtio_balloon.c 2011-07-21 22:17:23.000000000 -0400
39520 +++ linux-3.0.8/drivers/virtio/virtio_balloon.c 2011-08-23 21:48:14.000000000 -0400
39521 @@ -174,6 +174,8 @@ static void update_balloon_stats(struct
39522 struct sysinfo i;
39523 int idx = 0;
39524
39525 + pax_track_stack();
39526 +
39527 all_vm_events(events);
39528 si_meminfo(&i);
39529
39530 diff -urNp linux-3.0.8/fs/9p/vfs_inode.c linux-3.0.8/fs/9p/vfs_inode.c
39531 --- linux-3.0.8/fs/9p/vfs_inode.c 2011-10-24 08:05:30.000000000 -0400
39532 +++ linux-3.0.8/fs/9p/vfs_inode.c 2011-10-16 21:55:28.000000000 -0400
39533 @@ -1264,7 +1264,7 @@ static void *v9fs_vfs_follow_link(struct
39534 void
39535 v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
39536 {
39537 - char *s = nd_get_link(nd);
39538 + const char *s = nd_get_link(nd);
39539
39540 P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
39541 IS_ERR(s) ? "<error>" : s);
39542 diff -urNp linux-3.0.8/fs/aio.c linux-3.0.8/fs/aio.c
39543 --- linux-3.0.8/fs/aio.c 2011-07-21 22:17:23.000000000 -0400
39544 +++ linux-3.0.8/fs/aio.c 2011-08-23 21:48:14.000000000 -0400
39545 @@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx
39546 size += sizeof(struct io_event) * nr_events;
39547 nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
39548
39549 - if (nr_pages < 0)
39550 + if (nr_pages <= 0)
39551 return -EINVAL;
39552
39553 nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
39554 @@ -1088,6 +1088,8 @@ static int read_events(struct kioctx *ct
39555 struct aio_timeout to;
39556 int retry = 0;
39557
39558 + pax_track_stack();
39559 +
39560 /* needed to zero any padding within an entry (there shouldn't be
39561 * any, but C is fun!
39562 */
39563 @@ -1381,22 +1383,27 @@ static ssize_t aio_fsync(struct kiocb *i
39564 static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
39565 {
39566 ssize_t ret;
39567 + struct iovec iovstack;
39568
39569 #ifdef CONFIG_COMPAT
39570 if (compat)
39571 ret = compat_rw_copy_check_uvector(type,
39572 (struct compat_iovec __user *)kiocb->ki_buf,
39573 - kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
39574 + kiocb->ki_nbytes, 1, &iovstack,
39575 &kiocb->ki_iovec);
39576 else
39577 #endif
39578 ret = rw_copy_check_uvector(type,
39579 (struct iovec __user *)kiocb->ki_buf,
39580 - kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
39581 + kiocb->ki_nbytes, 1, &iovstack,
39582 &kiocb->ki_iovec);
39583 if (ret < 0)
39584 goto out;
39585
39586 + if (kiocb->ki_iovec == &iovstack) {
39587 + kiocb->ki_inline_vec = iovstack;
39588 + kiocb->ki_iovec = &kiocb->ki_inline_vec;
39589 + }
39590 kiocb->ki_nr_segs = kiocb->ki_nbytes;
39591 kiocb->ki_cur_seg = 0;
39592 /* ki_nbytes/left now reflect bytes instead of segs */
39593 diff -urNp linux-3.0.8/fs/attr.c linux-3.0.8/fs/attr.c
39594 --- linux-3.0.8/fs/attr.c 2011-07-21 22:17:23.000000000 -0400
39595 +++ linux-3.0.8/fs/attr.c 2011-08-23 21:48:14.000000000 -0400
39596 @@ -98,6 +98,7 @@ int inode_newsize_ok(const struct inode
39597 unsigned long limit;
39598
39599 limit = rlimit(RLIMIT_FSIZE);
39600 + gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
39601 if (limit != RLIM_INFINITY && offset > limit)
39602 goto out_sig;
39603 if (offset > inode->i_sb->s_maxbytes)
39604 diff -urNp linux-3.0.8/fs/autofs4/waitq.c linux-3.0.8/fs/autofs4/waitq.c
39605 --- linux-3.0.8/fs/autofs4/waitq.c 2011-07-21 22:17:23.000000000 -0400
39606 +++ linux-3.0.8/fs/autofs4/waitq.c 2011-10-06 04:17:55.000000000 -0400
39607 @@ -60,7 +60,7 @@ static int autofs4_write(struct file *fi
39608 {
39609 unsigned long sigpipe, flags;
39610 mm_segment_t fs;
39611 - const char *data = (const char *)addr;
39612 + const char __user *data = (const char __force_user *)addr;
39613 ssize_t wr = 0;
39614
39615 /** WARNING: this is not safe for writing more than PIPE_BUF bytes! **/
39616 diff -urNp linux-3.0.8/fs/befs/linuxvfs.c linux-3.0.8/fs/befs/linuxvfs.c
39617 --- linux-3.0.8/fs/befs/linuxvfs.c 2011-10-24 08:05:23.000000000 -0400
39618 +++ linux-3.0.8/fs/befs/linuxvfs.c 2011-08-29 23:26:27.000000000 -0400
39619 @@ -503,7 +503,7 @@ static void befs_put_link(struct dentry
39620 {
39621 befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
39622 if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
39623 - char *link = nd_get_link(nd);
39624 + const char *link = nd_get_link(nd);
39625 if (!IS_ERR(link))
39626 kfree(link);
39627 }
39628 diff -urNp linux-3.0.8/fs/binfmt_aout.c linux-3.0.8/fs/binfmt_aout.c
39629 --- linux-3.0.8/fs/binfmt_aout.c 2011-07-21 22:17:23.000000000 -0400
39630 +++ linux-3.0.8/fs/binfmt_aout.c 2011-08-23 21:48:14.000000000 -0400
39631 @@ -16,6 +16,7 @@
39632 #include <linux/string.h>
39633 #include <linux/fs.h>
39634 #include <linux/file.h>
39635 +#include <linux/security.h>
39636 #include <linux/stat.h>
39637 #include <linux/fcntl.h>
39638 #include <linux/ptrace.h>
39639 @@ -86,6 +87,8 @@ static int aout_core_dump(struct coredum
39640 #endif
39641 # define START_STACK(u) ((void __user *)u.start_stack)
39642
39643 + memset(&dump, 0, sizeof(dump));
39644 +
39645 fs = get_fs();
39646 set_fs(KERNEL_DS);
39647 has_dumped = 1;
39648 @@ -97,10 +100,12 @@ static int aout_core_dump(struct coredum
39649
39650 /* If the size of the dump file exceeds the rlimit, then see what would happen
39651 if we wrote the stack, but not the data area. */
39652 + gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
39653 if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > cprm->limit)
39654 dump.u_dsize = 0;
39655
39656 /* Make sure we have enough room to write the stack and data areas. */
39657 + gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
39658 if ((dump.u_ssize + 1) * PAGE_SIZE > cprm->limit)
39659 dump.u_ssize = 0;
39660
39661 @@ -234,6 +239,8 @@ static int load_aout_binary(struct linux
39662 rlim = rlimit(RLIMIT_DATA);
39663 if (rlim >= RLIM_INFINITY)
39664 rlim = ~0;
39665 +
39666 + gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
39667 if (ex.a_data + ex.a_bss > rlim)
39668 return -ENOMEM;
39669
39670 @@ -262,6 +269,27 @@ static int load_aout_binary(struct linux
39671 install_exec_creds(bprm);
39672 current->flags &= ~PF_FORKNOEXEC;
39673
39674 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
39675 + current->mm->pax_flags = 0UL;
39676 +#endif
39677 +
39678 +#ifdef CONFIG_PAX_PAGEEXEC
39679 + if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
39680 + current->mm->pax_flags |= MF_PAX_PAGEEXEC;
39681 +
39682 +#ifdef CONFIG_PAX_EMUTRAMP
39683 + if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
39684 + current->mm->pax_flags |= MF_PAX_EMUTRAMP;
39685 +#endif
39686 +
39687 +#ifdef CONFIG_PAX_MPROTECT
39688 + if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
39689 + current->mm->pax_flags |= MF_PAX_MPROTECT;
39690 +#endif
39691 +
39692 + }
39693 +#endif
39694 +
39695 if (N_MAGIC(ex) == OMAGIC) {
39696 unsigned long text_addr, map_size;
39697 loff_t pos;
39698 @@ -334,7 +362,7 @@ static int load_aout_binary(struct linux
39699
39700 down_write(&current->mm->mmap_sem);
39701 error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
39702 - PROT_READ | PROT_WRITE | PROT_EXEC,
39703 + PROT_READ | PROT_WRITE,
39704 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
39705 fd_offset + ex.a_text);
39706 up_write(&current->mm->mmap_sem);
39707 diff -urNp linux-3.0.8/fs/binfmt_elf.c linux-3.0.8/fs/binfmt_elf.c
39708 --- linux-3.0.8/fs/binfmt_elf.c 2011-07-21 22:17:23.000000000 -0400
39709 +++ linux-3.0.8/fs/binfmt_elf.c 2011-08-23 21:48:14.000000000 -0400
39710 @@ -51,6 +51,10 @@ static int elf_core_dump(struct coredump
39711 #define elf_core_dump NULL
39712 #endif
39713
39714 +#ifdef CONFIG_PAX_MPROTECT
39715 +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
39716 +#endif
39717 +
39718 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
39719 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
39720 #else
39721 @@ -70,6 +74,11 @@ static struct linux_binfmt elf_format =
39722 .load_binary = load_elf_binary,
39723 .load_shlib = load_elf_library,
39724 .core_dump = elf_core_dump,
39725 +
39726 +#ifdef CONFIG_PAX_MPROTECT
39727 + .handle_mprotect= elf_handle_mprotect,
39728 +#endif
39729 +
39730 .min_coredump = ELF_EXEC_PAGESIZE,
39731 };
39732
39733 @@ -77,6 +86,8 @@ static struct linux_binfmt elf_format =
39734
39735 static int set_brk(unsigned long start, unsigned long end)
39736 {
39737 + unsigned long e = end;
39738 +
39739 start = ELF_PAGEALIGN(start);
39740 end = ELF_PAGEALIGN(end);
39741 if (end > start) {
39742 @@ -87,7 +98,7 @@ static int set_brk(unsigned long start,
39743 if (BAD_ADDR(addr))
39744 return addr;
39745 }
39746 - current->mm->start_brk = current->mm->brk = end;
39747 + current->mm->start_brk = current->mm->brk = e;
39748 return 0;
39749 }
39750
39751 @@ -148,12 +159,15 @@ create_elf_tables(struct linux_binprm *b
39752 elf_addr_t __user *u_rand_bytes;
39753 const char *k_platform = ELF_PLATFORM;
39754 const char *k_base_platform = ELF_BASE_PLATFORM;
39755 - unsigned char k_rand_bytes[16];
39756 + u32 k_rand_bytes[4];
39757 int items;
39758 elf_addr_t *elf_info;
39759 int ei_index = 0;
39760 const struct cred *cred = current_cred();
39761 struct vm_area_struct *vma;
39762 + unsigned long saved_auxv[AT_VECTOR_SIZE];
39763 +
39764 + pax_track_stack();
39765
39766 /*
39767 * In some cases (e.g. Hyper-Threading), we want to avoid L1
39768 @@ -195,8 +209,12 @@ create_elf_tables(struct linux_binprm *b
39769 * Generate 16 random bytes for userspace PRNG seeding.
39770 */
39771 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
39772 - u_rand_bytes = (elf_addr_t __user *)
39773 - STACK_ALLOC(p, sizeof(k_rand_bytes));
39774 + srandom32(k_rand_bytes[0] ^ random32());
39775 + srandom32(k_rand_bytes[1] ^ random32());
39776 + srandom32(k_rand_bytes[2] ^ random32());
39777 + srandom32(k_rand_bytes[3] ^ random32());
39778 + p = STACK_ROUND(p, sizeof(k_rand_bytes));
39779 + u_rand_bytes = (elf_addr_t __user *) p;
39780 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
39781 return -EFAULT;
39782
39783 @@ -308,9 +326,11 @@ create_elf_tables(struct linux_binprm *b
39784 return -EFAULT;
39785 current->mm->env_end = p;
39786
39787 + memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
39788 +
39789 /* Put the elf_info on the stack in the right place. */
39790 sp = (elf_addr_t __user *)envp + 1;
39791 - if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
39792 + if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
39793 return -EFAULT;
39794 return 0;
39795 }
39796 @@ -381,10 +401,10 @@ static unsigned long load_elf_interp(str
39797 {
39798 struct elf_phdr *elf_phdata;
39799 struct elf_phdr *eppnt;
39800 - unsigned long load_addr = 0;
39801 + unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
39802 int load_addr_set = 0;
39803 unsigned long last_bss = 0, elf_bss = 0;
39804 - unsigned long error = ~0UL;
39805 + unsigned long error = -EINVAL;
39806 unsigned long total_size;
39807 int retval, i, size;
39808
39809 @@ -430,6 +450,11 @@ static unsigned long load_elf_interp(str
39810 goto out_close;
39811 }
39812
39813 +#ifdef CONFIG_PAX_SEGMEXEC
39814 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
39815 + pax_task_size = SEGMEXEC_TASK_SIZE;
39816 +#endif
39817 +
39818 eppnt = elf_phdata;
39819 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
39820 if (eppnt->p_type == PT_LOAD) {
39821 @@ -473,8 +498,8 @@ static unsigned long load_elf_interp(str
39822 k = load_addr + eppnt->p_vaddr;
39823 if (BAD_ADDR(k) ||
39824 eppnt->p_filesz > eppnt->p_memsz ||
39825 - eppnt->p_memsz > TASK_SIZE ||
39826 - TASK_SIZE - eppnt->p_memsz < k) {
39827 + eppnt->p_memsz > pax_task_size ||
39828 + pax_task_size - eppnt->p_memsz < k) {
39829 error = -ENOMEM;
39830 goto out_close;
39831 }
39832 @@ -528,6 +553,193 @@ out:
39833 return error;
39834 }
39835
39836 +#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
39837 +static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
39838 +{
39839 + unsigned long pax_flags = 0UL;
39840 +
39841 +#ifdef CONFIG_PAX_PAGEEXEC
39842 + if (elf_phdata->p_flags & PF_PAGEEXEC)
39843 + pax_flags |= MF_PAX_PAGEEXEC;
39844 +#endif
39845 +
39846 +#ifdef CONFIG_PAX_SEGMEXEC
39847 + if (elf_phdata->p_flags & PF_SEGMEXEC)
39848 + pax_flags |= MF_PAX_SEGMEXEC;
39849 +#endif
39850 +
39851 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
39852 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
39853 + if ((__supported_pte_mask & _PAGE_NX))
39854 + pax_flags &= ~MF_PAX_SEGMEXEC;
39855 + else
39856 + pax_flags &= ~MF_PAX_PAGEEXEC;
39857 + }
39858 +#endif
39859 +
39860 +#ifdef CONFIG_PAX_EMUTRAMP
39861 + if (elf_phdata->p_flags & PF_EMUTRAMP)
39862 + pax_flags |= MF_PAX_EMUTRAMP;
39863 +#endif
39864 +
39865 +#ifdef CONFIG_PAX_MPROTECT
39866 + if (elf_phdata->p_flags & PF_MPROTECT)
39867 + pax_flags |= MF_PAX_MPROTECT;
39868 +#endif
39869 +
39870 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
39871 + if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
39872 + pax_flags |= MF_PAX_RANDMMAP;
39873 +#endif
39874 +
39875 + return pax_flags;
39876 +}
39877 +#endif
39878 +
39879 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
39880 +static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
39881 +{
39882 + unsigned long pax_flags = 0UL;
39883 +
39884 +#ifdef CONFIG_PAX_PAGEEXEC
39885 + if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
39886 + pax_flags |= MF_PAX_PAGEEXEC;
39887 +#endif
39888 +
39889 +#ifdef CONFIG_PAX_SEGMEXEC
39890 + if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
39891 + pax_flags |= MF_PAX_SEGMEXEC;
39892 +#endif
39893 +
39894 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
39895 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
39896 + if ((__supported_pte_mask & _PAGE_NX))
39897 + pax_flags &= ~MF_PAX_SEGMEXEC;
39898 + else
39899 + pax_flags &= ~MF_PAX_PAGEEXEC;
39900 + }
39901 +#endif
39902 +
39903 +#ifdef CONFIG_PAX_EMUTRAMP
39904 + if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
39905 + pax_flags |= MF_PAX_EMUTRAMP;
39906 +#endif
39907 +
39908 +#ifdef CONFIG_PAX_MPROTECT
39909 + if (!(elf_phdata->p_flags & PF_NOMPROTECT))
39910 + pax_flags |= MF_PAX_MPROTECT;
39911 +#endif
39912 +
39913 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
39914 + if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
39915 + pax_flags |= MF_PAX_RANDMMAP;
39916 +#endif
39917 +
39918 + return pax_flags;
39919 +}
39920 +#endif
39921 +
39922 +#ifdef CONFIG_PAX_EI_PAX
39923 +static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
39924 +{
39925 + unsigned long pax_flags = 0UL;
39926 +
39927 +#ifdef CONFIG_PAX_PAGEEXEC
39928 + if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
39929 + pax_flags |= MF_PAX_PAGEEXEC;
39930 +#endif
39931 +
39932 +#ifdef CONFIG_PAX_SEGMEXEC
39933 + if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
39934 + pax_flags |= MF_PAX_SEGMEXEC;
39935 +#endif
39936 +
39937 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
39938 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
39939 + if ((__supported_pte_mask & _PAGE_NX))
39940 + pax_flags &= ~MF_PAX_SEGMEXEC;
39941 + else
39942 + pax_flags &= ~MF_PAX_PAGEEXEC;
39943 + }
39944 +#endif
39945 +
39946 +#ifdef CONFIG_PAX_EMUTRAMP
39947 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
39948 + pax_flags |= MF_PAX_EMUTRAMP;
39949 +#endif
39950 +
39951 +#ifdef CONFIG_PAX_MPROTECT
39952 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
39953 + pax_flags |= MF_PAX_MPROTECT;
39954 +#endif
39955 +
39956 +#ifdef CONFIG_PAX_ASLR
39957 + if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
39958 + pax_flags |= MF_PAX_RANDMMAP;
39959 +#endif
39960 +
39961 + return pax_flags;
39962 +}
39963 +#endif
39964 +
39965 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
39966 +static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
39967 +{
39968 + unsigned long pax_flags = 0UL;
39969 +
39970 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
39971 + unsigned long i;
39972 + int found_flags = 0;
39973 +#endif
39974 +
39975 +#ifdef CONFIG_PAX_EI_PAX
39976 + pax_flags = pax_parse_ei_pax(elf_ex);
39977 +#endif
39978 +
39979 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
39980 + for (i = 0UL; i < elf_ex->e_phnum; i++)
39981 + if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
39982 + if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
39983 + ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
39984 + ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
39985 + ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
39986 + ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
39987 + return -EINVAL;
39988 +
39989 +#ifdef CONFIG_PAX_SOFTMODE
39990 + if (pax_softmode)
39991 + pax_flags = pax_parse_softmode(&elf_phdata[i]);
39992 + else
39993 +#endif
39994 +
39995 + pax_flags = pax_parse_hardmode(&elf_phdata[i]);
39996 + found_flags = 1;
39997 + break;
39998 + }
39999 +#endif
40000 +
40001 +#if !defined(CONFIG_PAX_EI_PAX) && defined(CONFIG_PAX_PT_PAX_FLAGS)
40002 + if (found_flags == 0) {
40003 + struct elf_phdr phdr;
40004 + memset(&phdr, 0, sizeof(phdr));
40005 + phdr.p_flags = PF_NOEMUTRAMP;
40006 +#ifdef CONFIG_PAX_SOFTMODE
40007 + if (pax_softmode)
40008 + pax_flags = pax_parse_softmode(&phdr);
40009 + else
40010 +#endif
40011 + pax_flags = pax_parse_hardmode(&phdr);
40012 + }
40013 +#endif
40014 +
40015 + if (0 > pax_check_flags(&pax_flags))
40016 + return -EINVAL;
40017 +
40018 + current->mm->pax_flags = pax_flags;
40019 + return 0;
40020 +}
40021 +#endif
40022 +
40023 /*
40024 * These are the functions used to load ELF style executables and shared
40025 * libraries. There is no binary dependent code anywhere else.
40026 @@ -544,6 +756,11 @@ static unsigned long randomize_stack_top
40027 {
40028 unsigned int random_variable = 0;
40029
40030 +#ifdef CONFIG_PAX_RANDUSTACK
40031 + if (randomize_va_space)
40032 + return stack_top - current->mm->delta_stack;
40033 +#endif
40034 +
40035 if ((current->flags & PF_RANDOMIZE) &&
40036 !(current->personality & ADDR_NO_RANDOMIZE)) {
40037 random_variable = get_random_int() & STACK_RND_MASK;
40038 @@ -562,7 +779,7 @@ static int load_elf_binary(struct linux_
40039 unsigned long load_addr = 0, load_bias = 0;
40040 int load_addr_set = 0;
40041 char * elf_interpreter = NULL;
40042 - unsigned long error;
40043 + unsigned long error = 0;
40044 struct elf_phdr *elf_ppnt, *elf_phdata;
40045 unsigned long elf_bss, elf_brk;
40046 int retval, i;
40047 @@ -572,11 +789,11 @@ static int load_elf_binary(struct linux_
40048 unsigned long start_code, end_code, start_data, end_data;
40049 unsigned long reloc_func_desc __maybe_unused = 0;
40050 int executable_stack = EXSTACK_DEFAULT;
40051 - unsigned long def_flags = 0;
40052 struct {
40053 struct elfhdr elf_ex;
40054 struct elfhdr interp_elf_ex;
40055 } *loc;
40056 + unsigned long pax_task_size = TASK_SIZE;
40057
40058 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
40059 if (!loc) {
40060 @@ -714,11 +931,81 @@ static int load_elf_binary(struct linux_
40061
40062 /* OK, This is the point of no return */
40063 current->flags &= ~PF_FORKNOEXEC;
40064 - current->mm->def_flags = def_flags;
40065 +
40066 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
40067 + current->mm->pax_flags = 0UL;
40068 +#endif
40069 +
40070 +#ifdef CONFIG_PAX_DLRESOLVE
40071 + current->mm->call_dl_resolve = 0UL;
40072 +#endif
40073 +
40074 +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
40075 + current->mm->call_syscall = 0UL;
40076 +#endif
40077 +
40078 +#ifdef CONFIG_PAX_ASLR
40079 + current->mm->delta_mmap = 0UL;
40080 + current->mm->delta_stack = 0UL;
40081 +#endif
40082 +
40083 + current->mm->def_flags = 0;
40084 +
40085 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
40086 + if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
40087 + send_sig(SIGKILL, current, 0);
40088 + goto out_free_dentry;
40089 + }
40090 +#endif
40091 +
40092 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
40093 + pax_set_initial_flags(bprm);
40094 +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
40095 + if (pax_set_initial_flags_func)
40096 + (pax_set_initial_flags_func)(bprm);
40097 +#endif
40098 +
40099 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
40100 + if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !(__supported_pte_mask & _PAGE_NX)) {
40101 + current->mm->context.user_cs_limit = PAGE_SIZE;
40102 + current->mm->def_flags |= VM_PAGEEXEC;
40103 + }
40104 +#endif
40105 +
40106 +#ifdef CONFIG_PAX_SEGMEXEC
40107 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
40108 + current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
40109 + current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
40110 + pax_task_size = SEGMEXEC_TASK_SIZE;
40111 + current->mm->def_flags |= VM_NOHUGEPAGE;
40112 + }
40113 +#endif
40114 +
40115 +#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
40116 + if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
40117 + set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
40118 + put_cpu();
40119 + }
40120 +#endif
40121
40122 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
40123 may depend on the personality. */
40124 SET_PERSONALITY(loc->elf_ex);
40125 +
40126 +#ifdef CONFIG_PAX_ASLR
40127 + if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
40128 + current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
40129 + current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
40130 + }
40131 +#endif
40132 +
40133 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
40134 + if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
40135 + executable_stack = EXSTACK_DISABLE_X;
40136 + current->personality &= ~READ_IMPLIES_EXEC;
40137 + } else
40138 +#endif
40139 +
40140 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
40141 current->personality |= READ_IMPLIES_EXEC;
40142
40143 @@ -800,6 +1087,20 @@ static int load_elf_binary(struct linux_
40144 #else
40145 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
40146 #endif
40147 +
40148 +#ifdef CONFIG_PAX_RANDMMAP
40149 + /* PaX: randomize base address at the default exe base if requested */
40150 + if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
40151 +#ifdef CONFIG_SPARC64
40152 + load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
40153 +#else
40154 + load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
40155 +#endif
40156 + load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
40157 + elf_flags |= MAP_FIXED;
40158 + }
40159 +#endif
40160 +
40161 }
40162
40163 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
40164 @@ -832,9 +1133,9 @@ static int load_elf_binary(struct linux_
40165 * allowed task size. Note that p_filesz must always be
40166 * <= p_memsz so it is only necessary to check p_memsz.
40167 */
40168 - if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
40169 - elf_ppnt->p_memsz > TASK_SIZE ||
40170 - TASK_SIZE - elf_ppnt->p_memsz < k) {
40171 + if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
40172 + elf_ppnt->p_memsz > pax_task_size ||
40173 + pax_task_size - elf_ppnt->p_memsz < k) {
40174 /* set_brk can never work. Avoid overflows. */
40175 send_sig(SIGKILL, current, 0);
40176 retval = -EINVAL;
40177 @@ -862,6 +1163,11 @@ static int load_elf_binary(struct linux_
40178 start_data += load_bias;
40179 end_data += load_bias;
40180
40181 +#ifdef CONFIG_PAX_RANDMMAP
40182 + if (current->mm->pax_flags & MF_PAX_RANDMMAP)
40183 + elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
40184 +#endif
40185 +
40186 /* Calling set_brk effectively mmaps the pages that we need
40187 * for the bss and break sections. We must do this before
40188 * mapping in the interpreter, to make sure it doesn't wind
40189 @@ -873,9 +1179,11 @@ static int load_elf_binary(struct linux_
40190 goto out_free_dentry;
40191 }
40192 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
40193 - send_sig(SIGSEGV, current, 0);
40194 - retval = -EFAULT; /* Nobody gets to see this, but.. */
40195 - goto out_free_dentry;
40196 + /*
40197 + * This bss-zeroing can fail if the ELF
40198 + * file specifies odd protections. So
40199 + * we don't check the return value
40200 + */
40201 }
40202
40203 if (elf_interpreter) {
40204 @@ -1090,7 +1398,7 @@ out:
40205 * Decide what to dump of a segment, part, all or none.
40206 */
40207 static unsigned long vma_dump_size(struct vm_area_struct *vma,
40208 - unsigned long mm_flags)
40209 + unsigned long mm_flags, long signr)
40210 {
40211 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
40212
40213 @@ -1124,7 +1432,7 @@ static unsigned long vma_dump_size(struc
40214 if (vma->vm_file == NULL)
40215 return 0;
40216
40217 - if (FILTER(MAPPED_PRIVATE))
40218 + if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
40219 goto whole;
40220
40221 /*
40222 @@ -1346,9 +1654,9 @@ static void fill_auxv_note(struct memelf
40223 {
40224 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
40225 int i = 0;
40226 - do
40227 + do {
40228 i += 2;
40229 - while (auxv[i - 2] != AT_NULL);
40230 + } while (auxv[i - 2] != AT_NULL);
40231 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
40232 }
40233
40234 @@ -1854,14 +2162,14 @@ static void fill_extnum_info(struct elfh
40235 }
40236
40237 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
40238 - unsigned long mm_flags)
40239 + struct coredump_params *cprm)
40240 {
40241 struct vm_area_struct *vma;
40242 size_t size = 0;
40243
40244 for (vma = first_vma(current, gate_vma); vma != NULL;
40245 vma = next_vma(vma, gate_vma))
40246 - size += vma_dump_size(vma, mm_flags);
40247 + size += vma_dump_size(vma, cprm->mm_flags, cprm->signr);
40248 return size;
40249 }
40250
40251 @@ -1955,7 +2263,7 @@ static int elf_core_dump(struct coredump
40252
40253 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
40254
40255 - offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
40256 + offset += elf_core_vma_data_size(gate_vma, cprm);
40257 offset += elf_core_extra_data_size();
40258 e_shoff = offset;
40259
40260 @@ -1969,10 +2277,12 @@ static int elf_core_dump(struct coredump
40261 offset = dataoff;
40262
40263 size += sizeof(*elf);
40264 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
40265 if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
40266 goto end_coredump;
40267
40268 size += sizeof(*phdr4note);
40269 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
40270 if (size > cprm->limit
40271 || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
40272 goto end_coredump;
40273 @@ -1986,7 +2296,7 @@ static int elf_core_dump(struct coredump
40274 phdr.p_offset = offset;
40275 phdr.p_vaddr = vma->vm_start;
40276 phdr.p_paddr = 0;
40277 - phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
40278 + phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags, cprm->signr);
40279 phdr.p_memsz = vma->vm_end - vma->vm_start;
40280 offset += phdr.p_filesz;
40281 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
40282 @@ -1997,6 +2307,7 @@ static int elf_core_dump(struct coredump
40283 phdr.p_align = ELF_EXEC_PAGESIZE;
40284
40285 size += sizeof(phdr);
40286 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
40287 if (size > cprm->limit
40288 || !dump_write(cprm->file, &phdr, sizeof(phdr)))
40289 goto end_coredump;
40290 @@ -2021,7 +2332,7 @@ static int elf_core_dump(struct coredump
40291 unsigned long addr;
40292 unsigned long end;
40293
40294 - end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
40295 + end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags, cprm->signr);
40296
40297 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
40298 struct page *page;
40299 @@ -2030,6 +2341,7 @@ static int elf_core_dump(struct coredump
40300 page = get_dump_page(addr);
40301 if (page) {
40302 void *kaddr = kmap(page);
40303 + gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
40304 stop = ((size += PAGE_SIZE) > cprm->limit) ||
40305 !dump_write(cprm->file, kaddr,
40306 PAGE_SIZE);
40307 @@ -2047,6 +2359,7 @@ static int elf_core_dump(struct coredump
40308
40309 if (e_phnum == PN_XNUM) {
40310 size += sizeof(*shdr4extnum);
40311 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
40312 if (size > cprm->limit
40313 || !dump_write(cprm->file, shdr4extnum,
40314 sizeof(*shdr4extnum)))
40315 @@ -2067,6 +2380,97 @@ out:
40316
40317 #endif /* CONFIG_ELF_CORE */
40318
40319 +#ifdef CONFIG_PAX_MPROTECT
40320 +/* PaX: non-PIC ELF libraries need relocations on their executable segments
40321 + * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
40322 + * we'll remove VM_MAYWRITE for good on RELRO segments.
40323 + *
40324 + * The checks favour ld-linux.so behaviour which operates on a per ELF segment
40325 + * basis because we want to allow the common case and not the special ones.
40326 + */
40327 +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
40328 +{
40329 + struct elfhdr elf_h;
40330 + struct elf_phdr elf_p;
40331 + unsigned long i;
40332 + unsigned long oldflags;
40333 + bool is_textrel_rw, is_textrel_rx, is_relro;
40334 +
40335 + if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
40336 + return;
40337 +
40338 + oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
40339 + newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
40340 +
40341 +#ifdef CONFIG_PAX_ELFRELOCS
40342 + /* possible TEXTREL */
40343 + is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
40344 + is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
40345 +#else
40346 + is_textrel_rw = false;
40347 + is_textrel_rx = false;
40348 +#endif
40349 +
40350 + /* possible RELRO */
40351 + is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
40352 +
40353 + if (!is_textrel_rw && !is_textrel_rx && !is_relro)
40354 + return;
40355 +
40356 + if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
40357 + memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
40358 +
40359 +#ifdef CONFIG_PAX_ETEXECRELOCS
40360 + ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
40361 +#else
40362 + ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
40363 +#endif
40364 +
40365 + (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
40366 + !elf_check_arch(&elf_h) ||
40367 + elf_h.e_phentsize != sizeof(struct elf_phdr) ||
40368 + elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
40369 + return;
40370 +
40371 + for (i = 0UL; i < elf_h.e_phnum; i++) {
40372 + if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
40373 + return;
40374 + switch (elf_p.p_type) {
40375 + case PT_DYNAMIC:
40376 + if (!is_textrel_rw && !is_textrel_rx)
40377 + continue;
40378 + i = 0UL;
40379 + while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
40380 + elf_dyn dyn;
40381 +
40382 + if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
40383 + return;
40384 + if (dyn.d_tag == DT_NULL)
40385 + return;
40386 + if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
40387 + gr_log_textrel(vma);
40388 + if (is_textrel_rw)
40389 + vma->vm_flags |= VM_MAYWRITE;
40390 + else
40391 + /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
40392 + vma->vm_flags &= ~VM_MAYWRITE;
40393 + return;
40394 + }
40395 + i++;
40396 + }
40397 + return;
40398 +
40399 + case PT_GNU_RELRO:
40400 + if (!is_relro)
40401 + continue;
40402 + if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
40403 + vma->vm_flags &= ~VM_MAYWRITE;
40404 + return;
40405 + }
40406 + }
40407 +}
40408 +#endif
40409 +
40410 static int __init init_elf_binfmt(void)
40411 {
40412 return register_binfmt(&elf_format);
40413 diff -urNp linux-3.0.8/fs/binfmt_flat.c linux-3.0.8/fs/binfmt_flat.c
40414 --- linux-3.0.8/fs/binfmt_flat.c 2011-07-21 22:17:23.000000000 -0400
40415 +++ linux-3.0.8/fs/binfmt_flat.c 2011-08-23 21:47:56.000000000 -0400
40416 @@ -567,7 +567,9 @@ static int load_flat_file(struct linux_b
40417 realdatastart = (unsigned long) -ENOMEM;
40418 printk("Unable to allocate RAM for process data, errno %d\n",
40419 (int)-realdatastart);
40420 + down_write(&current->mm->mmap_sem);
40421 do_munmap(current->mm, textpos, text_len);
40422 + up_write(&current->mm->mmap_sem);
40423 ret = realdatastart;
40424 goto err;
40425 }
40426 @@ -591,8 +593,10 @@ static int load_flat_file(struct linux_b
40427 }
40428 if (IS_ERR_VALUE(result)) {
40429 printk("Unable to read data+bss, errno %d\n", (int)-result);
40430 + down_write(&current->mm->mmap_sem);
40431 do_munmap(current->mm, textpos, text_len);
40432 do_munmap(current->mm, realdatastart, len);
40433 + up_write(&current->mm->mmap_sem);
40434 ret = result;
40435 goto err;
40436 }
40437 @@ -661,8 +665,10 @@ static int load_flat_file(struct linux_b
40438 }
40439 if (IS_ERR_VALUE(result)) {
40440 printk("Unable to read code+data+bss, errno %d\n",(int)-result);
40441 + down_write(&current->mm->mmap_sem);
40442 do_munmap(current->mm, textpos, text_len + data_len + extra +
40443 MAX_SHARED_LIBS * sizeof(unsigned long));
40444 + up_write(&current->mm->mmap_sem);
40445 ret = result;
40446 goto err;
40447 }
40448 diff -urNp linux-3.0.8/fs/bio.c linux-3.0.8/fs/bio.c
40449 --- linux-3.0.8/fs/bio.c 2011-07-21 22:17:23.000000000 -0400
40450 +++ linux-3.0.8/fs/bio.c 2011-10-06 04:17:55.000000000 -0400
40451 @@ -1233,7 +1233,7 @@ static void bio_copy_kern_endio(struct b
40452 const int read = bio_data_dir(bio) == READ;
40453 struct bio_map_data *bmd = bio->bi_private;
40454 int i;
40455 - char *p = bmd->sgvecs[0].iov_base;
40456 + char *p = (char __force_kernel *)bmd->sgvecs[0].iov_base;
40457
40458 __bio_for_each_segment(bvec, bio, i, 0) {
40459 char *addr = page_address(bvec->bv_page);
40460 diff -urNp linux-3.0.8/fs/block_dev.c linux-3.0.8/fs/block_dev.c
40461 --- linux-3.0.8/fs/block_dev.c 2011-10-24 08:05:30.000000000 -0400
40462 +++ linux-3.0.8/fs/block_dev.c 2011-10-16 21:55:28.000000000 -0400
40463 @@ -671,7 +671,7 @@ static bool bd_may_claim(struct block_de
40464 else if (bdev->bd_contains == bdev)
40465 return true; /* is a whole device which isn't held */
40466
40467 - else if (whole->bd_holder == bd_may_claim)
40468 + else if (whole->bd_holder == (void *)bd_may_claim)
40469 return true; /* is a partition of a device that is being partitioned */
40470 else if (whole->bd_holder != NULL)
40471 return false; /* is a partition of a held device */
40472 diff -urNp linux-3.0.8/fs/btrfs/ctree.c linux-3.0.8/fs/btrfs/ctree.c
40473 --- linux-3.0.8/fs/btrfs/ctree.c 2011-07-21 22:17:23.000000000 -0400
40474 +++ linux-3.0.8/fs/btrfs/ctree.c 2011-08-23 21:47:56.000000000 -0400
40475 @@ -454,9 +454,12 @@ static noinline int __btrfs_cow_block(st
40476 free_extent_buffer(buf);
40477 add_root_to_dirty_list(root);
40478 } else {
40479 - if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
40480 - parent_start = parent->start;
40481 - else
40482 + if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
40483 + if (parent)
40484 + parent_start = parent->start;
40485 + else
40486 + parent_start = 0;
40487 + } else
40488 parent_start = 0;
40489
40490 WARN_ON(trans->transid != btrfs_header_generation(parent));
40491 diff -urNp linux-3.0.8/fs/btrfs/inode.c linux-3.0.8/fs/btrfs/inode.c
40492 --- linux-3.0.8/fs/btrfs/inode.c 2011-10-24 08:05:30.000000000 -0400
40493 +++ linux-3.0.8/fs/btrfs/inode.c 2011-10-16 21:55:28.000000000 -0400
40494 @@ -6896,7 +6896,7 @@ fail:
40495 return -ENOMEM;
40496 }
40497
40498 -static int btrfs_getattr(struct vfsmount *mnt,
40499 +int btrfs_getattr(struct vfsmount *mnt,
40500 struct dentry *dentry, struct kstat *stat)
40501 {
40502 struct inode *inode = dentry->d_inode;
40503 @@ -6908,6 +6908,14 @@ static int btrfs_getattr(struct vfsmount
40504 return 0;
40505 }
40506
40507 +EXPORT_SYMBOL(btrfs_getattr);
40508 +
40509 +dev_t get_btrfs_dev_from_inode(struct inode *inode)
40510 +{
40511 + return BTRFS_I(inode)->root->anon_super.s_dev;
40512 +}
40513 +EXPORT_SYMBOL(get_btrfs_dev_from_inode);
40514 +
40515 /*
40516 * If a file is moved, it will inherit the cow and compression flags of the new
40517 * directory.
40518 diff -urNp linux-3.0.8/fs/btrfs/ioctl.c linux-3.0.8/fs/btrfs/ioctl.c
40519 --- linux-3.0.8/fs/btrfs/ioctl.c 2011-07-21 22:17:23.000000000 -0400
40520 +++ linux-3.0.8/fs/btrfs/ioctl.c 2011-10-06 04:17:55.000000000 -0400
40521 @@ -2676,9 +2676,12 @@ long btrfs_ioctl_space_info(struct btrfs
40522 for (i = 0; i < num_types; i++) {
40523 struct btrfs_space_info *tmp;
40524
40525 + /* Don't copy in more than we allocated */
40526 if (!slot_count)
40527 break;
40528
40529 + slot_count--;
40530 +
40531 info = NULL;
40532 rcu_read_lock();
40533 list_for_each_entry_rcu(tmp, &root->fs_info->space_info,
40534 @@ -2700,15 +2703,12 @@ long btrfs_ioctl_space_info(struct btrfs
40535 memcpy(dest, &space, sizeof(space));
40536 dest++;
40537 space_args.total_spaces++;
40538 - slot_count--;
40539 }
40540 - if (!slot_count)
40541 - break;
40542 }
40543 up_read(&info->groups_sem);
40544 }
40545
40546 - user_dest = (struct btrfs_ioctl_space_info *)
40547 + user_dest = (struct btrfs_ioctl_space_info __user *)
40548 (arg + sizeof(struct btrfs_ioctl_space_args));
40549
40550 if (copy_to_user(user_dest, dest_orig, alloc_size))
40551 diff -urNp linux-3.0.8/fs/btrfs/relocation.c linux-3.0.8/fs/btrfs/relocation.c
40552 --- linux-3.0.8/fs/btrfs/relocation.c 2011-07-21 22:17:23.000000000 -0400
40553 +++ linux-3.0.8/fs/btrfs/relocation.c 2011-08-23 21:47:56.000000000 -0400
40554 @@ -1242,7 +1242,7 @@ static int __update_reloc_root(struct bt
40555 }
40556 spin_unlock(&rc->reloc_root_tree.lock);
40557
40558 - BUG_ON((struct btrfs_root *)node->data != root);
40559 + BUG_ON(!node || (struct btrfs_root *)node->data != root);
40560
40561 if (!del) {
40562 spin_lock(&rc->reloc_root_tree.lock);
40563 diff -urNp linux-3.0.8/fs/cachefiles/bind.c linux-3.0.8/fs/cachefiles/bind.c
40564 --- linux-3.0.8/fs/cachefiles/bind.c 2011-07-21 22:17:23.000000000 -0400
40565 +++ linux-3.0.8/fs/cachefiles/bind.c 2011-08-23 21:47:56.000000000 -0400
40566 @@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef
40567 args);
40568
40569 /* start by checking things over */
40570 - ASSERT(cache->fstop_percent >= 0 &&
40571 - cache->fstop_percent < cache->fcull_percent &&
40572 + ASSERT(cache->fstop_percent < cache->fcull_percent &&
40573 cache->fcull_percent < cache->frun_percent &&
40574 cache->frun_percent < 100);
40575
40576 - ASSERT(cache->bstop_percent >= 0 &&
40577 - cache->bstop_percent < cache->bcull_percent &&
40578 + ASSERT(cache->bstop_percent < cache->bcull_percent &&
40579 cache->bcull_percent < cache->brun_percent &&
40580 cache->brun_percent < 100);
40581
40582 diff -urNp linux-3.0.8/fs/cachefiles/daemon.c linux-3.0.8/fs/cachefiles/daemon.c
40583 --- linux-3.0.8/fs/cachefiles/daemon.c 2011-07-21 22:17:23.000000000 -0400
40584 +++ linux-3.0.8/fs/cachefiles/daemon.c 2011-08-23 21:47:56.000000000 -0400
40585 @@ -196,7 +196,7 @@ static ssize_t cachefiles_daemon_read(st
40586 if (n > buflen)
40587 return -EMSGSIZE;
40588
40589 - if (copy_to_user(_buffer, buffer, n) != 0)
40590 + if (n > sizeof(buffer) || copy_to_user(_buffer, buffer, n) != 0)
40591 return -EFAULT;
40592
40593 return n;
40594 @@ -222,7 +222,7 @@ static ssize_t cachefiles_daemon_write(s
40595 if (test_bit(CACHEFILES_DEAD, &cache->flags))
40596 return -EIO;
40597
40598 - if (datalen < 0 || datalen > PAGE_SIZE - 1)
40599 + if (datalen > PAGE_SIZE - 1)
40600 return -EOPNOTSUPP;
40601
40602 /* drag the command string into the kernel so we can parse it */
40603 @@ -386,7 +386,7 @@ static int cachefiles_daemon_fstop(struc
40604 if (args[0] != '%' || args[1] != '\0')
40605 return -EINVAL;
40606
40607 - if (fstop < 0 || fstop >= cache->fcull_percent)
40608 + if (fstop >= cache->fcull_percent)
40609 return cachefiles_daemon_range_error(cache, args);
40610
40611 cache->fstop_percent = fstop;
40612 @@ -458,7 +458,7 @@ static int cachefiles_daemon_bstop(struc
40613 if (args[0] != '%' || args[1] != '\0')
40614 return -EINVAL;
40615
40616 - if (bstop < 0 || bstop >= cache->bcull_percent)
40617 + if (bstop >= cache->bcull_percent)
40618 return cachefiles_daemon_range_error(cache, args);
40619
40620 cache->bstop_percent = bstop;
40621 diff -urNp linux-3.0.8/fs/cachefiles/internal.h linux-3.0.8/fs/cachefiles/internal.h
40622 --- linux-3.0.8/fs/cachefiles/internal.h 2011-07-21 22:17:23.000000000 -0400
40623 +++ linux-3.0.8/fs/cachefiles/internal.h 2011-08-23 21:47:56.000000000 -0400
40624 @@ -57,7 +57,7 @@ struct cachefiles_cache {
40625 wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
40626 struct rb_root active_nodes; /* active nodes (can't be culled) */
40627 rwlock_t active_lock; /* lock for active_nodes */
40628 - atomic_t gravecounter; /* graveyard uniquifier */
40629 + atomic_unchecked_t gravecounter; /* graveyard uniquifier */
40630 unsigned frun_percent; /* when to stop culling (% files) */
40631 unsigned fcull_percent; /* when to start culling (% files) */
40632 unsigned fstop_percent; /* when to stop allocating (% files) */
40633 @@ -169,19 +169,19 @@ extern int cachefiles_check_in_use(struc
40634 * proc.c
40635 */
40636 #ifdef CONFIG_CACHEFILES_HISTOGRAM
40637 -extern atomic_t cachefiles_lookup_histogram[HZ];
40638 -extern atomic_t cachefiles_mkdir_histogram[HZ];
40639 -extern atomic_t cachefiles_create_histogram[HZ];
40640 +extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
40641 +extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
40642 +extern atomic_unchecked_t cachefiles_create_histogram[HZ];
40643
40644 extern int __init cachefiles_proc_init(void);
40645 extern void cachefiles_proc_cleanup(void);
40646 static inline
40647 -void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
40648 +void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
40649 {
40650 unsigned long jif = jiffies - start_jif;
40651 if (jif >= HZ)
40652 jif = HZ - 1;
40653 - atomic_inc(&histogram[jif]);
40654 + atomic_inc_unchecked(&histogram[jif]);
40655 }
40656
40657 #else
40658 diff -urNp linux-3.0.8/fs/cachefiles/namei.c linux-3.0.8/fs/cachefiles/namei.c
40659 --- linux-3.0.8/fs/cachefiles/namei.c 2011-07-21 22:17:23.000000000 -0400
40660 +++ linux-3.0.8/fs/cachefiles/namei.c 2011-08-23 21:47:56.000000000 -0400
40661 @@ -318,7 +318,7 @@ try_again:
40662 /* first step is to make up a grave dentry in the graveyard */
40663 sprintf(nbuffer, "%08x%08x",
40664 (uint32_t) get_seconds(),
40665 - (uint32_t) atomic_inc_return(&cache->gravecounter));
40666 + (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
40667
40668 /* do the multiway lock magic */
40669 trap = lock_rename(cache->graveyard, dir);
40670 diff -urNp linux-3.0.8/fs/cachefiles/proc.c linux-3.0.8/fs/cachefiles/proc.c
40671 --- linux-3.0.8/fs/cachefiles/proc.c 2011-07-21 22:17:23.000000000 -0400
40672 +++ linux-3.0.8/fs/cachefiles/proc.c 2011-08-23 21:47:56.000000000 -0400
40673 @@ -14,9 +14,9 @@
40674 #include <linux/seq_file.h>
40675 #include "internal.h"
40676
40677 -atomic_t cachefiles_lookup_histogram[HZ];
40678 -atomic_t cachefiles_mkdir_histogram[HZ];
40679 -atomic_t cachefiles_create_histogram[HZ];
40680 +atomic_unchecked_t cachefiles_lookup_histogram[HZ];
40681 +atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
40682 +atomic_unchecked_t cachefiles_create_histogram[HZ];
40683
40684 /*
40685 * display the latency histogram
40686 @@ -35,9 +35,9 @@ static int cachefiles_histogram_show(str
40687 return 0;
40688 default:
40689 index = (unsigned long) v - 3;
40690 - x = atomic_read(&cachefiles_lookup_histogram[index]);
40691 - y = atomic_read(&cachefiles_mkdir_histogram[index]);
40692 - z = atomic_read(&cachefiles_create_histogram[index]);
40693 + x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
40694 + y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
40695 + z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
40696 if (x == 0 && y == 0 && z == 0)
40697 return 0;
40698
40699 diff -urNp linux-3.0.8/fs/cachefiles/rdwr.c linux-3.0.8/fs/cachefiles/rdwr.c
40700 --- linux-3.0.8/fs/cachefiles/rdwr.c 2011-07-21 22:17:23.000000000 -0400
40701 +++ linux-3.0.8/fs/cachefiles/rdwr.c 2011-10-06 04:17:55.000000000 -0400
40702 @@ -945,7 +945,7 @@ int cachefiles_write_page(struct fscache
40703 old_fs = get_fs();
40704 set_fs(KERNEL_DS);
40705 ret = file->f_op->write(
40706 - file, (const void __user *) data, len, &pos);
40707 + file, (const void __force_user *) data, len, &pos);
40708 set_fs(old_fs);
40709 kunmap(page);
40710 if (ret != len)
40711 diff -urNp linux-3.0.8/fs/ceph/dir.c linux-3.0.8/fs/ceph/dir.c
40712 --- linux-3.0.8/fs/ceph/dir.c 2011-07-21 22:17:23.000000000 -0400
40713 +++ linux-3.0.8/fs/ceph/dir.c 2011-08-23 21:47:56.000000000 -0400
40714 @@ -226,7 +226,7 @@ static int ceph_readdir(struct file *fil
40715 struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
40716 struct ceph_mds_client *mdsc = fsc->mdsc;
40717 unsigned frag = fpos_frag(filp->f_pos);
40718 - int off = fpos_off(filp->f_pos);
40719 + unsigned int off = fpos_off(filp->f_pos);
40720 int err;
40721 u32 ftype;
40722 struct ceph_mds_reply_info_parsed *rinfo;
40723 diff -urNp linux-3.0.8/fs/cifs/cifs_debug.c linux-3.0.8/fs/cifs/cifs_debug.c
40724 --- linux-3.0.8/fs/cifs/cifs_debug.c 2011-07-21 22:17:23.000000000 -0400
40725 +++ linux-3.0.8/fs/cifs/cifs_debug.c 2011-08-25 17:18:05.000000000 -0400
40726 @@ -265,8 +265,8 @@ static ssize_t cifs_stats_proc_write(str
40727
40728 if (c == '1' || c == 'y' || c == 'Y' || c == '0') {
40729 #ifdef CONFIG_CIFS_STATS2
40730 - atomic_set(&totBufAllocCount, 0);
40731 - atomic_set(&totSmBufAllocCount, 0);
40732 + atomic_set_unchecked(&totBufAllocCount, 0);
40733 + atomic_set_unchecked(&totSmBufAllocCount, 0);
40734 #endif /* CONFIG_CIFS_STATS2 */
40735 spin_lock(&cifs_tcp_ses_lock);
40736 list_for_each(tmp1, &cifs_tcp_ses_list) {
40737 @@ -279,25 +279,25 @@ static ssize_t cifs_stats_proc_write(str
40738 tcon = list_entry(tmp3,
40739 struct cifs_tcon,
40740 tcon_list);
40741 - atomic_set(&tcon->num_smbs_sent, 0);
40742 - atomic_set(&tcon->num_writes, 0);
40743 - atomic_set(&tcon->num_reads, 0);
40744 - atomic_set(&tcon->num_oplock_brks, 0);
40745 - atomic_set(&tcon->num_opens, 0);
40746 - atomic_set(&tcon->num_posixopens, 0);
40747 - atomic_set(&tcon->num_posixmkdirs, 0);
40748 - atomic_set(&tcon->num_closes, 0);
40749 - atomic_set(&tcon->num_deletes, 0);
40750 - atomic_set(&tcon->num_mkdirs, 0);
40751 - atomic_set(&tcon->num_rmdirs, 0);
40752 - atomic_set(&tcon->num_renames, 0);
40753 - atomic_set(&tcon->num_t2renames, 0);
40754 - atomic_set(&tcon->num_ffirst, 0);
40755 - atomic_set(&tcon->num_fnext, 0);
40756 - atomic_set(&tcon->num_fclose, 0);
40757 - atomic_set(&tcon->num_hardlinks, 0);
40758 - atomic_set(&tcon->num_symlinks, 0);
40759 - atomic_set(&tcon->num_locks, 0);
40760 + atomic_set_unchecked(&tcon->num_smbs_sent, 0);
40761 + atomic_set_unchecked(&tcon->num_writes, 0);
40762 + atomic_set_unchecked(&tcon->num_reads, 0);
40763 + atomic_set_unchecked(&tcon->num_oplock_brks, 0);
40764 + atomic_set_unchecked(&tcon->num_opens, 0);
40765 + atomic_set_unchecked(&tcon->num_posixopens, 0);
40766 + atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
40767 + atomic_set_unchecked(&tcon->num_closes, 0);
40768 + atomic_set_unchecked(&tcon->num_deletes, 0);
40769 + atomic_set_unchecked(&tcon->num_mkdirs, 0);
40770 + atomic_set_unchecked(&tcon->num_rmdirs, 0);
40771 + atomic_set_unchecked(&tcon->num_renames, 0);
40772 + atomic_set_unchecked(&tcon->num_t2renames, 0);
40773 + atomic_set_unchecked(&tcon->num_ffirst, 0);
40774 + atomic_set_unchecked(&tcon->num_fnext, 0);
40775 + atomic_set_unchecked(&tcon->num_fclose, 0);
40776 + atomic_set_unchecked(&tcon->num_hardlinks, 0);
40777 + atomic_set_unchecked(&tcon->num_symlinks, 0);
40778 + atomic_set_unchecked(&tcon->num_locks, 0);
40779 }
40780 }
40781 }
40782 @@ -327,8 +327,8 @@ static int cifs_stats_proc_show(struct s
40783 smBufAllocCount.counter, cifs_min_small);
40784 #ifdef CONFIG_CIFS_STATS2
40785 seq_printf(m, "Total Large %d Small %d Allocations\n",
40786 - atomic_read(&totBufAllocCount),
40787 - atomic_read(&totSmBufAllocCount));
40788 + atomic_read_unchecked(&totBufAllocCount),
40789 + atomic_read_unchecked(&totSmBufAllocCount));
40790 #endif /* CONFIG_CIFS_STATS2 */
40791
40792 seq_printf(m, "Operations (MIDs): %d\n", atomic_read(&midCount));
40793 @@ -357,41 +357,41 @@ static int cifs_stats_proc_show(struct s
40794 if (tcon->need_reconnect)
40795 seq_puts(m, "\tDISCONNECTED ");
40796 seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
40797 - atomic_read(&tcon->num_smbs_sent),
40798 - atomic_read(&tcon->num_oplock_brks));
40799 + atomic_read_unchecked(&tcon->num_smbs_sent),
40800 + atomic_read_unchecked(&tcon->num_oplock_brks));
40801 seq_printf(m, "\nReads: %d Bytes: %lld",
40802 - atomic_read(&tcon->num_reads),
40803 + atomic_read_unchecked(&tcon->num_reads),
40804 (long long)(tcon->bytes_read));
40805 seq_printf(m, "\nWrites: %d Bytes: %lld",
40806 - atomic_read(&tcon->num_writes),
40807 + atomic_read_unchecked(&tcon->num_writes),
40808 (long long)(tcon->bytes_written));
40809 seq_printf(m, "\nFlushes: %d",
40810 - atomic_read(&tcon->num_flushes));
40811 + atomic_read_unchecked(&tcon->num_flushes));
40812 seq_printf(m, "\nLocks: %d HardLinks: %d "
40813 "Symlinks: %d",
40814 - atomic_read(&tcon->num_locks),
40815 - atomic_read(&tcon->num_hardlinks),
40816 - atomic_read(&tcon->num_symlinks));
40817 + atomic_read_unchecked(&tcon->num_locks),
40818 + atomic_read_unchecked(&tcon->num_hardlinks),
40819 + atomic_read_unchecked(&tcon->num_symlinks));
40820 seq_printf(m, "\nOpens: %d Closes: %d "
40821 "Deletes: %d",
40822 - atomic_read(&tcon->num_opens),
40823 - atomic_read(&tcon->num_closes),
40824 - atomic_read(&tcon->num_deletes));
40825 + atomic_read_unchecked(&tcon->num_opens),
40826 + atomic_read_unchecked(&tcon->num_closes),
40827 + atomic_read_unchecked(&tcon->num_deletes));
40828 seq_printf(m, "\nPosix Opens: %d "
40829 "Posix Mkdirs: %d",
40830 - atomic_read(&tcon->num_posixopens),
40831 - atomic_read(&tcon->num_posixmkdirs));
40832 + atomic_read_unchecked(&tcon->num_posixopens),
40833 + atomic_read_unchecked(&tcon->num_posixmkdirs));
40834 seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
40835 - atomic_read(&tcon->num_mkdirs),
40836 - atomic_read(&tcon->num_rmdirs));
40837 + atomic_read_unchecked(&tcon->num_mkdirs),
40838 + atomic_read_unchecked(&tcon->num_rmdirs));
40839 seq_printf(m, "\nRenames: %d T2 Renames %d",
40840 - atomic_read(&tcon->num_renames),
40841 - atomic_read(&tcon->num_t2renames));
40842 + atomic_read_unchecked(&tcon->num_renames),
40843 + atomic_read_unchecked(&tcon->num_t2renames));
40844 seq_printf(m, "\nFindFirst: %d FNext %d "
40845 "FClose %d",
40846 - atomic_read(&tcon->num_ffirst),
40847 - atomic_read(&tcon->num_fnext),
40848 - atomic_read(&tcon->num_fclose));
40849 + atomic_read_unchecked(&tcon->num_ffirst),
40850 + atomic_read_unchecked(&tcon->num_fnext),
40851 + atomic_read_unchecked(&tcon->num_fclose));
40852 }
40853 }
40854 }
40855 diff -urNp linux-3.0.8/fs/cifs/cifsfs.c linux-3.0.8/fs/cifs/cifsfs.c
40856 --- linux-3.0.8/fs/cifs/cifsfs.c 2011-10-25 09:10:33.000000000 -0400
40857 +++ linux-3.0.8/fs/cifs/cifsfs.c 2011-10-25 09:10:41.000000000 -0400
40858 @@ -996,7 +996,7 @@ cifs_init_request_bufs(void)
40859 cifs_req_cachep = kmem_cache_create("cifs_request",
40860 CIFSMaxBufSize +
40861 MAX_CIFS_HDR_SIZE, 0,
40862 - SLAB_HWCACHE_ALIGN, NULL);
40863 + SLAB_HWCACHE_ALIGN | SLAB_USERCOPY, NULL);
40864 if (cifs_req_cachep == NULL)
40865 return -ENOMEM;
40866
40867 @@ -1023,7 +1023,7 @@ cifs_init_request_bufs(void)
40868 efficient to alloc 1 per page off the slab compared to 17K (5page)
40869 alloc of large cifs buffers even when page debugging is on */
40870 cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq",
40871 - MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN,
40872 + MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN | SLAB_USERCOPY,
40873 NULL);
40874 if (cifs_sm_req_cachep == NULL) {
40875 mempool_destroy(cifs_req_poolp);
40876 @@ -1108,8 +1108,8 @@ init_cifs(void)
40877 atomic_set(&bufAllocCount, 0);
40878 atomic_set(&smBufAllocCount, 0);
40879 #ifdef CONFIG_CIFS_STATS2
40880 - atomic_set(&totBufAllocCount, 0);
40881 - atomic_set(&totSmBufAllocCount, 0);
40882 + atomic_set_unchecked(&totBufAllocCount, 0);
40883 + atomic_set_unchecked(&totSmBufAllocCount, 0);
40884 #endif /* CONFIG_CIFS_STATS2 */
40885
40886 atomic_set(&midCount, 0);
40887 diff -urNp linux-3.0.8/fs/cifs/cifsglob.h linux-3.0.8/fs/cifs/cifsglob.h
40888 --- linux-3.0.8/fs/cifs/cifsglob.h 2011-07-21 22:17:23.000000000 -0400
40889 +++ linux-3.0.8/fs/cifs/cifsglob.h 2011-08-25 17:18:05.000000000 -0400
40890 @@ -381,28 +381,28 @@ struct cifs_tcon {
40891 __u16 Flags; /* optional support bits */
40892 enum statusEnum tidStatus;
40893 #ifdef CONFIG_CIFS_STATS
40894 - atomic_t num_smbs_sent;
40895 - atomic_t num_writes;
40896 - atomic_t num_reads;
40897 - atomic_t num_flushes;
40898 - atomic_t num_oplock_brks;
40899 - atomic_t num_opens;
40900 - atomic_t num_closes;
40901 - atomic_t num_deletes;
40902 - atomic_t num_mkdirs;
40903 - atomic_t num_posixopens;
40904 - atomic_t num_posixmkdirs;
40905 - atomic_t num_rmdirs;
40906 - atomic_t num_renames;
40907 - atomic_t num_t2renames;
40908 - atomic_t num_ffirst;
40909 - atomic_t num_fnext;
40910 - atomic_t num_fclose;
40911 - atomic_t num_hardlinks;
40912 - atomic_t num_symlinks;
40913 - atomic_t num_locks;
40914 - atomic_t num_acl_get;
40915 - atomic_t num_acl_set;
40916 + atomic_unchecked_t num_smbs_sent;
40917 + atomic_unchecked_t num_writes;
40918 + atomic_unchecked_t num_reads;
40919 + atomic_unchecked_t num_flushes;
40920 + atomic_unchecked_t num_oplock_brks;
40921 + atomic_unchecked_t num_opens;
40922 + atomic_unchecked_t num_closes;
40923 + atomic_unchecked_t num_deletes;
40924 + atomic_unchecked_t num_mkdirs;
40925 + atomic_unchecked_t num_posixopens;
40926 + atomic_unchecked_t num_posixmkdirs;
40927 + atomic_unchecked_t num_rmdirs;
40928 + atomic_unchecked_t num_renames;
40929 + atomic_unchecked_t num_t2renames;
40930 + atomic_unchecked_t num_ffirst;
40931 + atomic_unchecked_t num_fnext;
40932 + atomic_unchecked_t num_fclose;
40933 + atomic_unchecked_t num_hardlinks;
40934 + atomic_unchecked_t num_symlinks;
40935 + atomic_unchecked_t num_locks;
40936 + atomic_unchecked_t num_acl_get;
40937 + atomic_unchecked_t num_acl_set;
40938 #ifdef CONFIG_CIFS_STATS2
40939 unsigned long long time_writes;
40940 unsigned long long time_reads;
40941 @@ -613,7 +613,7 @@ convert_delimiter(char *path, char delim
40942 }
40943
40944 #ifdef CONFIG_CIFS_STATS
40945 -#define cifs_stats_inc atomic_inc
40946 +#define cifs_stats_inc atomic_inc_unchecked
40947
40948 static inline void cifs_stats_bytes_written(struct cifs_tcon *tcon,
40949 unsigned int bytes)
40950 @@ -911,8 +911,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnect
40951 /* Various Debug counters */
40952 GLOBAL_EXTERN atomic_t bufAllocCount; /* current number allocated */
40953 #ifdef CONFIG_CIFS_STATS2
40954 -GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */
40955 -GLOBAL_EXTERN atomic_t totSmBufAllocCount;
40956 +GLOBAL_EXTERN atomic_unchecked_t totBufAllocCount; /* total allocated over all time */
40957 +GLOBAL_EXTERN atomic_unchecked_t totSmBufAllocCount;
40958 #endif
40959 GLOBAL_EXTERN atomic_t smBufAllocCount;
40960 GLOBAL_EXTERN atomic_t midCount;
40961 diff -urNp linux-3.0.8/fs/cifs/link.c linux-3.0.8/fs/cifs/link.c
40962 --- linux-3.0.8/fs/cifs/link.c 2011-07-21 22:17:23.000000000 -0400
40963 +++ linux-3.0.8/fs/cifs/link.c 2011-08-23 21:47:56.000000000 -0400
40964 @@ -587,7 +587,7 @@ symlink_exit:
40965
40966 void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
40967 {
40968 - char *p = nd_get_link(nd);
40969 + const char *p = nd_get_link(nd);
40970 if (!IS_ERR(p))
40971 kfree(p);
40972 }
40973 diff -urNp linux-3.0.8/fs/cifs/misc.c linux-3.0.8/fs/cifs/misc.c
40974 --- linux-3.0.8/fs/cifs/misc.c 2011-07-21 22:17:23.000000000 -0400
40975 +++ linux-3.0.8/fs/cifs/misc.c 2011-08-25 17:18:05.000000000 -0400
40976 @@ -156,7 +156,7 @@ cifs_buf_get(void)
40977 memset(ret_buf, 0, sizeof(struct smb_hdr) + 3);
40978 atomic_inc(&bufAllocCount);
40979 #ifdef CONFIG_CIFS_STATS2
40980 - atomic_inc(&totBufAllocCount);
40981 + atomic_inc_unchecked(&totBufAllocCount);
40982 #endif /* CONFIG_CIFS_STATS2 */
40983 }
40984
40985 @@ -191,7 +191,7 @@ cifs_small_buf_get(void)
40986 /* memset(ret_buf, 0, sizeof(struct smb_hdr) + 27);*/
40987 atomic_inc(&smBufAllocCount);
40988 #ifdef CONFIG_CIFS_STATS2
40989 - atomic_inc(&totSmBufAllocCount);
40990 + atomic_inc_unchecked(&totSmBufAllocCount);
40991 #endif /* CONFIG_CIFS_STATS2 */
40992
40993 }
40994 diff -urNp linux-3.0.8/fs/coda/cache.c linux-3.0.8/fs/coda/cache.c
40995 --- linux-3.0.8/fs/coda/cache.c 2011-07-21 22:17:23.000000000 -0400
40996 +++ linux-3.0.8/fs/coda/cache.c 2011-08-23 21:47:56.000000000 -0400
40997 @@ -24,7 +24,7 @@
40998 #include "coda_linux.h"
40999 #include "coda_cache.h"
41000
41001 -static atomic_t permission_epoch = ATOMIC_INIT(0);
41002 +static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
41003
41004 /* replace or extend an acl cache hit */
41005 void coda_cache_enter(struct inode *inode, int mask)
41006 @@ -32,7 +32,7 @@ void coda_cache_enter(struct inode *inod
41007 struct coda_inode_info *cii = ITOC(inode);
41008
41009 spin_lock(&cii->c_lock);
41010 - cii->c_cached_epoch = atomic_read(&permission_epoch);
41011 + cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
41012 if (cii->c_uid != current_fsuid()) {
41013 cii->c_uid = current_fsuid();
41014 cii->c_cached_perm = mask;
41015 @@ -46,14 +46,14 @@ void coda_cache_clear_inode(struct inode
41016 {
41017 struct coda_inode_info *cii = ITOC(inode);
41018 spin_lock(&cii->c_lock);
41019 - cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
41020 + cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
41021 spin_unlock(&cii->c_lock);
41022 }
41023
41024 /* remove all acl caches */
41025 void coda_cache_clear_all(struct super_block *sb)
41026 {
41027 - atomic_inc(&permission_epoch);
41028 + atomic_inc_unchecked(&permission_epoch);
41029 }
41030
41031
41032 @@ -66,7 +66,7 @@ int coda_cache_check(struct inode *inode
41033 spin_lock(&cii->c_lock);
41034 hit = (mask & cii->c_cached_perm) == mask &&
41035 cii->c_uid == current_fsuid() &&
41036 - cii->c_cached_epoch == atomic_read(&permission_epoch);
41037 + cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
41038 spin_unlock(&cii->c_lock);
41039
41040 return hit;
41041 diff -urNp linux-3.0.8/fs/compat_binfmt_elf.c linux-3.0.8/fs/compat_binfmt_elf.c
41042 --- linux-3.0.8/fs/compat_binfmt_elf.c 2011-07-21 22:17:23.000000000 -0400
41043 +++ linux-3.0.8/fs/compat_binfmt_elf.c 2011-08-23 21:47:56.000000000 -0400
41044 @@ -30,11 +30,13 @@
41045 #undef elf_phdr
41046 #undef elf_shdr
41047 #undef elf_note
41048 +#undef elf_dyn
41049 #undef elf_addr_t
41050 #define elfhdr elf32_hdr
41051 #define elf_phdr elf32_phdr
41052 #define elf_shdr elf32_shdr
41053 #define elf_note elf32_note
41054 +#define elf_dyn Elf32_Dyn
41055 #define elf_addr_t Elf32_Addr
41056
41057 /*
41058 diff -urNp linux-3.0.8/fs/compat.c linux-3.0.8/fs/compat.c
41059 --- linux-3.0.8/fs/compat.c 2011-07-21 22:17:23.000000000 -0400
41060 +++ linux-3.0.8/fs/compat.c 2011-10-06 04:17:55.000000000 -0400
41061 @@ -133,8 +133,8 @@ asmlinkage long compat_sys_utimes(const
41062 static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
41063 {
41064 compat_ino_t ino = stat->ino;
41065 - typeof(ubuf->st_uid) uid = 0;
41066 - typeof(ubuf->st_gid) gid = 0;
41067 + typeof(((struct compat_stat *)0)->st_uid) uid = 0;
41068 + typeof(((struct compat_stat *)0)->st_gid) gid = 0;
41069 int err;
41070
41071 SET_UID(uid, stat->uid);
41072 @@ -508,7 +508,7 @@ compat_sys_io_setup(unsigned nr_reqs, u3
41073
41074 set_fs(KERNEL_DS);
41075 /* The __user pointer cast is valid because of the set_fs() */
41076 - ret = sys_io_setup(nr_reqs, (aio_context_t __user *) &ctx64);
41077 + ret = sys_io_setup(nr_reqs, (aio_context_t __force_user *) &ctx64);
41078 set_fs(oldfs);
41079 /* truncating is ok because it's a user address */
41080 if (!ret)
41081 @@ -566,7 +566,7 @@ ssize_t compat_rw_copy_check_uvector(int
41082 goto out;
41083
41084 ret = -EINVAL;
41085 - if (nr_segs > UIO_MAXIOV || nr_segs < 0)
41086 + if (nr_segs > UIO_MAXIOV)
41087 goto out;
41088 if (nr_segs > fast_segs) {
41089 ret = -ENOMEM;
41090 @@ -848,6 +848,7 @@ struct compat_old_linux_dirent {
41091
41092 struct compat_readdir_callback {
41093 struct compat_old_linux_dirent __user *dirent;
41094 + struct file * file;
41095 int result;
41096 };
41097
41098 @@ -865,6 +866,10 @@ static int compat_fillonedir(void *__buf
41099 buf->result = -EOVERFLOW;
41100 return -EOVERFLOW;
41101 }
41102 +
41103 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
41104 + return 0;
41105 +
41106 buf->result++;
41107 dirent = buf->dirent;
41108 if (!access_ok(VERIFY_WRITE, dirent,
41109 @@ -897,6 +902,7 @@ asmlinkage long compat_sys_old_readdir(u
41110
41111 buf.result = 0;
41112 buf.dirent = dirent;
41113 + buf.file = file;
41114
41115 error = vfs_readdir(file, compat_fillonedir, &buf);
41116 if (buf.result)
41117 @@ -917,6 +923,7 @@ struct compat_linux_dirent {
41118 struct compat_getdents_callback {
41119 struct compat_linux_dirent __user *current_dir;
41120 struct compat_linux_dirent __user *previous;
41121 + struct file * file;
41122 int count;
41123 int error;
41124 };
41125 @@ -938,6 +945,10 @@ static int compat_filldir(void *__buf, c
41126 buf->error = -EOVERFLOW;
41127 return -EOVERFLOW;
41128 }
41129 +
41130 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
41131 + return 0;
41132 +
41133 dirent = buf->previous;
41134 if (dirent) {
41135 if (__put_user(offset, &dirent->d_off))
41136 @@ -985,6 +996,7 @@ asmlinkage long compat_sys_getdents(unsi
41137 buf.previous = NULL;
41138 buf.count = count;
41139 buf.error = 0;
41140 + buf.file = file;
41141
41142 error = vfs_readdir(file, compat_filldir, &buf);
41143 if (error >= 0)
41144 @@ -1006,6 +1018,7 @@ out:
41145 struct compat_getdents_callback64 {
41146 struct linux_dirent64 __user *current_dir;
41147 struct linux_dirent64 __user *previous;
41148 + struct file * file;
41149 int count;
41150 int error;
41151 };
41152 @@ -1022,6 +1035,10 @@ static int compat_filldir64(void * __buf
41153 buf->error = -EINVAL; /* only used if we fail.. */
41154 if (reclen > buf->count)
41155 return -EINVAL;
41156 +
41157 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
41158 + return 0;
41159 +
41160 dirent = buf->previous;
41161
41162 if (dirent) {
41163 @@ -1073,13 +1090,14 @@ asmlinkage long compat_sys_getdents64(un
41164 buf.previous = NULL;
41165 buf.count = count;
41166 buf.error = 0;
41167 + buf.file = file;
41168
41169 error = vfs_readdir(file, compat_filldir64, &buf);
41170 if (error >= 0)
41171 error = buf.error;
41172 lastdirent = buf.previous;
41173 if (lastdirent) {
41174 - typeof(lastdirent->d_off) d_off = file->f_pos;
41175 + typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
41176 if (__put_user_unaligned(d_off, &lastdirent->d_off))
41177 error = -EFAULT;
41178 else
41179 @@ -1446,6 +1464,8 @@ int compat_core_sys_select(int n, compat
41180 struct fdtable *fdt;
41181 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
41182
41183 + pax_track_stack();
41184 +
41185 if (n < 0)
41186 goto out_nofds;
41187
41188 @@ -1904,7 +1924,7 @@ asmlinkage long compat_sys_nfsservctl(in
41189 oldfs = get_fs();
41190 set_fs(KERNEL_DS);
41191 /* The __user pointer casts are valid because of the set_fs() */
41192 - err = sys_nfsservctl(cmd, (void __user *) karg, (void __user *) kres);
41193 + err = sys_nfsservctl(cmd, (void __force_user *) karg, (void __force_user *) kres);
41194 set_fs(oldfs);
41195
41196 if (err)
41197 diff -urNp linux-3.0.8/fs/compat_ioctl.c linux-3.0.8/fs/compat_ioctl.c
41198 --- linux-3.0.8/fs/compat_ioctl.c 2011-07-21 22:17:23.000000000 -0400
41199 +++ linux-3.0.8/fs/compat_ioctl.c 2011-10-06 04:17:55.000000000 -0400
41200 @@ -208,6 +208,8 @@ static int do_video_set_spu_palette(unsi
41201
41202 err = get_user(palp, &up->palette);
41203 err |= get_user(length, &up->length);
41204 + if (err)
41205 + return -EFAULT;
41206
41207 up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
41208 err = put_user(compat_ptr(palp), &up_native->palette);
41209 @@ -619,7 +621,7 @@ static int serial_struct_ioctl(unsigned
41210 return -EFAULT;
41211 if (__get_user(udata, &ss32->iomem_base))
41212 return -EFAULT;
41213 - ss.iomem_base = compat_ptr(udata);
41214 + ss.iomem_base = (unsigned char __force_kernel *)compat_ptr(udata);
41215 if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) ||
41216 __get_user(ss.port_high, &ss32->port_high))
41217 return -EFAULT;
41218 @@ -794,7 +796,7 @@ static int compat_ioctl_preallocate(stru
41219 copy_in_user(&p->l_len, &p32->l_len, sizeof(s64)) ||
41220 copy_in_user(&p->l_sysid, &p32->l_sysid, sizeof(s32)) ||
41221 copy_in_user(&p->l_pid, &p32->l_pid, sizeof(u32)) ||
41222 - copy_in_user(&p->l_pad, &p32->l_pad, 4*sizeof(u32)))
41223 + copy_in_user(p->l_pad, &p32->l_pad, 4*sizeof(u32)))
41224 return -EFAULT;
41225
41226 return ioctl_preallocate(file, p);
41227 @@ -1638,8 +1640,8 @@ asmlinkage long compat_sys_ioctl(unsigne
41228 static int __init init_sys32_ioctl_cmp(const void *p, const void *q)
41229 {
41230 unsigned int a, b;
41231 - a = *(unsigned int *)p;
41232 - b = *(unsigned int *)q;
41233 + a = *(const unsigned int *)p;
41234 + b = *(const unsigned int *)q;
41235 if (a > b)
41236 return 1;
41237 if (a < b)
41238 diff -urNp linux-3.0.8/fs/configfs/dir.c linux-3.0.8/fs/configfs/dir.c
41239 --- linux-3.0.8/fs/configfs/dir.c 2011-07-21 22:17:23.000000000 -0400
41240 +++ linux-3.0.8/fs/configfs/dir.c 2011-08-23 21:47:56.000000000 -0400
41241 @@ -1575,7 +1575,8 @@ static int configfs_readdir(struct file
41242 }
41243 for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
41244 struct configfs_dirent *next;
41245 - const char * name;
41246 + const unsigned char * name;
41247 + char d_name[sizeof(next->s_dentry->d_iname)];
41248 int len;
41249 struct inode *inode = NULL;
41250
41251 @@ -1585,7 +1586,12 @@ static int configfs_readdir(struct file
41252 continue;
41253
41254 name = configfs_get_name(next);
41255 - len = strlen(name);
41256 + if (next->s_dentry && name == next->s_dentry->d_iname) {
41257 + len = next->s_dentry->d_name.len;
41258 + memcpy(d_name, name, len);
41259 + name = d_name;
41260 + } else
41261 + len = strlen(name);
41262
41263 /*
41264 * We'll have a dentry and an inode for
41265 diff -urNp linux-3.0.8/fs/dcache.c linux-3.0.8/fs/dcache.c
41266 --- linux-3.0.8/fs/dcache.c 2011-07-21 22:17:23.000000000 -0400
41267 +++ linux-3.0.8/fs/dcache.c 2011-08-23 21:47:56.000000000 -0400
41268 @@ -3089,7 +3089,7 @@ void __init vfs_caches_init(unsigned lon
41269 mempages -= reserve;
41270
41271 names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
41272 - SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
41273 + SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
41274
41275 dcache_init();
41276 inode_init();
41277 diff -urNp linux-3.0.8/fs/ecryptfs/inode.c linux-3.0.8/fs/ecryptfs/inode.c
41278 --- linux-3.0.8/fs/ecryptfs/inode.c 2011-10-24 08:05:21.000000000 -0400
41279 +++ linux-3.0.8/fs/ecryptfs/inode.c 2011-10-06 04:17:55.000000000 -0400
41280 @@ -704,7 +704,7 @@ static int ecryptfs_readlink_lower(struc
41281 old_fs = get_fs();
41282 set_fs(get_ds());
41283 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
41284 - (char __user *)lower_buf,
41285 + (char __force_user *)lower_buf,
41286 lower_bufsiz);
41287 set_fs(old_fs);
41288 if (rc < 0)
41289 @@ -750,7 +750,7 @@ static void *ecryptfs_follow_link(struct
41290 }
41291 old_fs = get_fs();
41292 set_fs(get_ds());
41293 - rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
41294 + rc = dentry->d_inode->i_op->readlink(dentry, (char __force_user *)buf, len);
41295 set_fs(old_fs);
41296 if (rc < 0) {
41297 kfree(buf);
41298 @@ -765,7 +765,7 @@ out:
41299 static void
41300 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
41301 {
41302 - char *buf = nd_get_link(nd);
41303 + const char *buf = nd_get_link(nd);
41304 if (!IS_ERR(buf)) {
41305 /* Free the char* */
41306 kfree(buf);
41307 diff -urNp linux-3.0.8/fs/ecryptfs/miscdev.c linux-3.0.8/fs/ecryptfs/miscdev.c
41308 --- linux-3.0.8/fs/ecryptfs/miscdev.c 2011-07-21 22:17:23.000000000 -0400
41309 +++ linux-3.0.8/fs/ecryptfs/miscdev.c 2011-08-23 21:47:56.000000000 -0400
41310 @@ -328,7 +328,7 @@ check_list:
41311 goto out_unlock_msg_ctx;
41312 i = 5;
41313 if (msg_ctx->msg) {
41314 - if (copy_to_user(&buf[i], packet_length, packet_length_size))
41315 + if (packet_length_size > sizeof(packet_length) || copy_to_user(&buf[i], packet_length, packet_length_size))
41316 goto out_unlock_msg_ctx;
41317 i += packet_length_size;
41318 if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
41319 diff -urNp linux-3.0.8/fs/ecryptfs/read_write.c linux-3.0.8/fs/ecryptfs/read_write.c
41320 --- linux-3.0.8/fs/ecryptfs/read_write.c 2011-10-24 08:05:21.000000000 -0400
41321 +++ linux-3.0.8/fs/ecryptfs/read_write.c 2011-10-06 04:17:55.000000000 -0400
41322 @@ -48,7 +48,7 @@ int ecryptfs_write_lower(struct inode *e
41323 return -EIO;
41324 fs_save = get_fs();
41325 set_fs(get_ds());
41326 - rc = vfs_write(lower_file, data, size, &offset);
41327 + rc = vfs_write(lower_file, (const char __force_user *)data, size, &offset);
41328 set_fs(fs_save);
41329 mark_inode_dirty_sync(ecryptfs_inode);
41330 return rc;
41331 @@ -235,7 +235,7 @@ int ecryptfs_read_lower(char *data, loff
41332 return -EIO;
41333 fs_save = get_fs();
41334 set_fs(get_ds());
41335 - rc = vfs_read(lower_file, data, size, &offset);
41336 + rc = vfs_read(lower_file, (char __force_user *)data, size, &offset);
41337 set_fs(fs_save);
41338 return rc;
41339 }
41340 diff -urNp linux-3.0.8/fs/exec.c linux-3.0.8/fs/exec.c
41341 --- linux-3.0.8/fs/exec.c 2011-10-24 08:05:32.000000000 -0400
41342 +++ linux-3.0.8/fs/exec.c 2011-10-17 23:17:19.000000000 -0400
41343 @@ -55,12 +55,24 @@
41344 #include <linux/pipe_fs_i.h>
41345 #include <linux/oom.h>
41346 #include <linux/compat.h>
41347 +#include <linux/random.h>
41348 +#include <linux/seq_file.h>
41349 +
41350 +#ifdef CONFIG_PAX_REFCOUNT
41351 +#include <linux/kallsyms.h>
41352 +#include <linux/kdebug.h>
41353 +#endif
41354
41355 #include <asm/uaccess.h>
41356 #include <asm/mmu_context.h>
41357 #include <asm/tlb.h>
41358 #include "internal.h"
41359
41360 +#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
41361 +void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
41362 +EXPORT_SYMBOL(pax_set_initial_flags_func);
41363 +#endif
41364 +
41365 int core_uses_pid;
41366 char core_pattern[CORENAME_MAX_SIZE] = "core";
41367 unsigned int core_pipe_limit;
41368 @@ -70,7 +82,7 @@ struct core_name {
41369 char *corename;
41370 int used, size;
41371 };
41372 -static atomic_t call_count = ATOMIC_INIT(1);
41373 +static atomic_unchecked_t call_count = ATOMIC_INIT(1);
41374
41375 /* The maximal length of core_pattern is also specified in sysctl.c */
41376
41377 @@ -116,7 +128,7 @@ SYSCALL_DEFINE1(uselib, const char __use
41378 char *tmp = getname(library);
41379 int error = PTR_ERR(tmp);
41380 static const struct open_flags uselib_flags = {
41381 - .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
41382 + .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC | FMODE_GREXEC,
41383 .acc_mode = MAY_READ | MAY_EXEC | MAY_OPEN,
41384 .intent = LOOKUP_OPEN
41385 };
41386 @@ -195,18 +207,10 @@ static struct page *get_arg_page(struct
41387 int write)
41388 {
41389 struct page *page;
41390 - int ret;
41391
41392 -#ifdef CONFIG_STACK_GROWSUP
41393 - if (write) {
41394 - ret = expand_downwards(bprm->vma, pos);
41395 - if (ret < 0)
41396 - return NULL;
41397 - }
41398 -#endif
41399 - ret = get_user_pages(current, bprm->mm, pos,
41400 - 1, write, 1, &page, NULL);
41401 - if (ret <= 0)
41402 + if (0 > expand_downwards(bprm->vma, pos))
41403 + return NULL;
41404 + if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
41405 return NULL;
41406
41407 if (write) {
41408 @@ -281,6 +285,11 @@ static int __bprm_mm_init(struct linux_b
41409 vma->vm_end = STACK_TOP_MAX;
41410 vma->vm_start = vma->vm_end - PAGE_SIZE;
41411 vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
41412 +
41413 +#ifdef CONFIG_PAX_SEGMEXEC
41414 + vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
41415 +#endif
41416 +
41417 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
41418 INIT_LIST_HEAD(&vma->anon_vma_chain);
41419
41420 @@ -295,6 +304,12 @@ static int __bprm_mm_init(struct linux_b
41421 mm->stack_vm = mm->total_vm = 1;
41422 up_write(&mm->mmap_sem);
41423 bprm->p = vma->vm_end - sizeof(void *);
41424 +
41425 +#ifdef CONFIG_PAX_RANDUSTACK
41426 + if (randomize_va_space)
41427 + bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
41428 +#endif
41429 +
41430 return 0;
41431 err:
41432 up_write(&mm->mmap_sem);
41433 @@ -403,19 +418,7 @@ err:
41434 return err;
41435 }
41436
41437 -struct user_arg_ptr {
41438 -#ifdef CONFIG_COMPAT
41439 - bool is_compat;
41440 -#endif
41441 - union {
41442 - const char __user *const __user *native;
41443 -#ifdef CONFIG_COMPAT
41444 - compat_uptr_t __user *compat;
41445 -#endif
41446 - } ptr;
41447 -};
41448 -
41449 -static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
41450 +const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
41451 {
41452 const char __user *native;
41453
41454 @@ -424,14 +427,14 @@ static const char __user *get_user_arg_p
41455 compat_uptr_t compat;
41456
41457 if (get_user(compat, argv.ptr.compat + nr))
41458 - return ERR_PTR(-EFAULT);
41459 + return (const char __force_user *)ERR_PTR(-EFAULT);
41460
41461 return compat_ptr(compat);
41462 }
41463 #endif
41464
41465 if (get_user(native, argv.ptr.native + nr))
41466 - return ERR_PTR(-EFAULT);
41467 + return (const char __force_user *)ERR_PTR(-EFAULT);
41468
41469 return native;
41470 }
41471 @@ -450,7 +453,7 @@ static int count(struct user_arg_ptr arg
41472 if (!p)
41473 break;
41474
41475 - if (IS_ERR(p))
41476 + if (IS_ERR((const char __force_kernel *)p))
41477 return -EFAULT;
41478
41479 if (i++ >= max)
41480 @@ -484,7 +487,7 @@ static int copy_strings(int argc, struct
41481
41482 ret = -EFAULT;
41483 str = get_user_arg_ptr(argv, argc);
41484 - if (IS_ERR(str))
41485 + if (IS_ERR((const char __force_kernel *)str))
41486 goto out;
41487
41488 len = strnlen_user(str, MAX_ARG_STRLEN);
41489 @@ -566,7 +569,7 @@ int copy_strings_kernel(int argc, const
41490 int r;
41491 mm_segment_t oldfs = get_fs();
41492 struct user_arg_ptr argv = {
41493 - .ptr.native = (const char __user *const __user *)__argv,
41494 + .ptr.native = (const char __force_user *const __force_user *)__argv,
41495 };
41496
41497 set_fs(KERNEL_DS);
41498 @@ -601,7 +604,8 @@ static int shift_arg_pages(struct vm_are
41499 unsigned long new_end = old_end - shift;
41500 struct mmu_gather tlb;
41501
41502 - BUG_ON(new_start > new_end);
41503 + if (new_start >= new_end || new_start < mmap_min_addr)
41504 + return -ENOMEM;
41505
41506 /*
41507 * ensure there are no vmas between where we want to go
41508 @@ -610,6 +614,10 @@ static int shift_arg_pages(struct vm_are
41509 if (vma != find_vma(mm, new_start))
41510 return -EFAULT;
41511
41512 +#ifdef CONFIG_PAX_SEGMEXEC
41513 + BUG_ON(pax_find_mirror_vma(vma));
41514 +#endif
41515 +
41516 /*
41517 * cover the whole range: [new_start, old_end)
41518 */
41519 @@ -690,10 +698,6 @@ int setup_arg_pages(struct linux_binprm
41520 stack_top = arch_align_stack(stack_top);
41521 stack_top = PAGE_ALIGN(stack_top);
41522
41523 - if (unlikely(stack_top < mmap_min_addr) ||
41524 - unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
41525 - return -ENOMEM;
41526 -
41527 stack_shift = vma->vm_end - stack_top;
41528
41529 bprm->p -= stack_shift;
41530 @@ -705,8 +709,28 @@ int setup_arg_pages(struct linux_binprm
41531 bprm->exec -= stack_shift;
41532
41533 down_write(&mm->mmap_sem);
41534 +
41535 + /* Move stack pages down in memory. */
41536 + if (stack_shift) {
41537 + ret = shift_arg_pages(vma, stack_shift);
41538 + if (ret)
41539 + goto out_unlock;
41540 + }
41541 +
41542 vm_flags = VM_STACK_FLAGS;
41543
41544 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
41545 + if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
41546 + vm_flags &= ~VM_EXEC;
41547 +
41548 +#ifdef CONFIG_PAX_MPROTECT
41549 + if (mm->pax_flags & MF_PAX_MPROTECT)
41550 + vm_flags &= ~VM_MAYEXEC;
41551 +#endif
41552 +
41553 + }
41554 +#endif
41555 +
41556 /*
41557 * Adjust stack execute permissions; explicitly enable for
41558 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
41559 @@ -725,13 +749,6 @@ int setup_arg_pages(struct linux_binprm
41560 goto out_unlock;
41561 BUG_ON(prev != vma);
41562
41563 - /* Move stack pages down in memory. */
41564 - if (stack_shift) {
41565 - ret = shift_arg_pages(vma, stack_shift);
41566 - if (ret)
41567 - goto out_unlock;
41568 - }
41569 -
41570 /* mprotect_fixup is overkill to remove the temporary stack flags */
41571 vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
41572
41573 @@ -771,7 +788,7 @@ struct file *open_exec(const char *name)
41574 struct file *file;
41575 int err;
41576 static const struct open_flags open_exec_flags = {
41577 - .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
41578 + .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC | FMODE_GREXEC,
41579 .acc_mode = MAY_EXEC | MAY_OPEN,
41580 .intent = LOOKUP_OPEN
41581 };
41582 @@ -812,7 +829,7 @@ int kernel_read(struct file *file, loff_
41583 old_fs = get_fs();
41584 set_fs(get_ds());
41585 /* The cast to a user pointer is valid due to the set_fs() */
41586 - result = vfs_read(file, (void __user *)addr, count, &pos);
41587 + result = vfs_read(file, (void __force_user *)addr, count, &pos);
41588 set_fs(old_fs);
41589 return result;
41590 }
41591 @@ -1236,7 +1253,7 @@ int check_unsafe_exec(struct linux_binpr
41592 }
41593 rcu_read_unlock();
41594
41595 - if (p->fs->users > n_fs) {
41596 + if (atomic_read(&p->fs->users) > n_fs) {
41597 bprm->unsafe |= LSM_UNSAFE_SHARE;
41598 } else {
41599 res = -EAGAIN;
41600 @@ -1430,11 +1447,35 @@ static int do_execve_common(const char *
41601 struct user_arg_ptr envp,
41602 struct pt_regs *regs)
41603 {
41604 +#ifdef CONFIG_GRKERNSEC
41605 + struct file *old_exec_file;
41606 + struct acl_subject_label *old_acl;
41607 + struct rlimit old_rlim[RLIM_NLIMITS];
41608 +#endif
41609 struct linux_binprm *bprm;
41610 struct file *file;
41611 struct files_struct *displaced;
41612 bool clear_in_exec;
41613 int retval;
41614 + const struct cred *cred = current_cred();
41615 +
41616 + gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
41617 +
41618 + /*
41619 + * We move the actual failure in case of RLIMIT_NPROC excess from
41620 + * set*uid() to execve() because too many poorly written programs
41621 + * don't check setuid() return code. Here we additionally recheck
41622 + * whether NPROC limit is still exceeded.
41623 + */
41624 + if ((current->flags & PF_NPROC_EXCEEDED) &&
41625 + atomic_read(&cred->user->processes) > rlimit(RLIMIT_NPROC)) {
41626 + retval = -EAGAIN;
41627 + goto out_ret;
41628 + }
41629 +
41630 + /* We're below the limit (still or again), so we don't want to make
41631 + * further execve() calls fail. */
41632 + current->flags &= ~PF_NPROC_EXCEEDED;
41633
41634 retval = unshare_files(&displaced);
41635 if (retval)
41636 @@ -1466,6 +1507,16 @@ static int do_execve_common(const char *
41637 bprm->filename = filename;
41638 bprm->interp = filename;
41639
41640 + if (gr_process_user_ban()) {
41641 + retval = -EPERM;
41642 + goto out_file;
41643 + }
41644 +
41645 + if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
41646 + retval = -EACCES;
41647 + goto out_file;
41648 + }
41649 +
41650 retval = bprm_mm_init(bprm);
41651 if (retval)
41652 goto out_file;
41653 @@ -1495,9 +1546,40 @@ static int do_execve_common(const char *
41654 if (retval < 0)
41655 goto out;
41656
41657 + if (!gr_tpe_allow(file)) {
41658 + retval = -EACCES;
41659 + goto out;
41660 + }
41661 +
41662 + if (gr_check_crash_exec(file)) {
41663 + retval = -EACCES;
41664 + goto out;
41665 + }
41666 +
41667 + gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
41668 +
41669 + gr_handle_exec_args(bprm, argv);
41670 +
41671 +#ifdef CONFIG_GRKERNSEC
41672 + old_acl = current->acl;
41673 + memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
41674 + old_exec_file = current->exec_file;
41675 + get_file(file);
41676 + current->exec_file = file;
41677 +#endif
41678 +
41679 + retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
41680 + bprm->unsafe & LSM_UNSAFE_SHARE);
41681 + if (retval < 0)
41682 + goto out_fail;
41683 +
41684 retval = search_binary_handler(bprm,regs);
41685 if (retval < 0)
41686 - goto out;
41687 + goto out_fail;
41688 +#ifdef CONFIG_GRKERNSEC
41689 + if (old_exec_file)
41690 + fput(old_exec_file);
41691 +#endif
41692
41693 /* execve succeeded */
41694 current->fs->in_exec = 0;
41695 @@ -1508,6 +1590,14 @@ static int do_execve_common(const char *
41696 put_files_struct(displaced);
41697 return retval;
41698
41699 +out_fail:
41700 +#ifdef CONFIG_GRKERNSEC
41701 + current->acl = old_acl;
41702 + memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
41703 + fput(current->exec_file);
41704 + current->exec_file = old_exec_file;
41705 +#endif
41706 +
41707 out:
41708 if (bprm->mm) {
41709 acct_arg_size(bprm, 0);
41710 @@ -1581,7 +1671,7 @@ static int expand_corename(struct core_n
41711 {
41712 char *old_corename = cn->corename;
41713
41714 - cn->size = CORENAME_MAX_SIZE * atomic_inc_return(&call_count);
41715 + cn->size = CORENAME_MAX_SIZE * atomic_inc_return_unchecked(&call_count);
41716 cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
41717
41718 if (!cn->corename) {
41719 @@ -1669,7 +1759,7 @@ static int format_corename(struct core_n
41720 int pid_in_pattern = 0;
41721 int err = 0;
41722
41723 - cn->size = CORENAME_MAX_SIZE * atomic_read(&call_count);
41724 + cn->size = CORENAME_MAX_SIZE * atomic_read_unchecked(&call_count);
41725 cn->corename = kmalloc(cn->size, GFP_KERNEL);
41726 cn->used = 0;
41727
41728 @@ -1760,6 +1850,219 @@ out:
41729 return ispipe;
41730 }
41731
41732 +int pax_check_flags(unsigned long *flags)
41733 +{
41734 + int retval = 0;
41735 +
41736 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
41737 + if (*flags & MF_PAX_SEGMEXEC)
41738 + {
41739 + *flags &= ~MF_PAX_SEGMEXEC;
41740 + retval = -EINVAL;
41741 + }
41742 +#endif
41743 +
41744 + if ((*flags & MF_PAX_PAGEEXEC)
41745 +
41746 +#ifdef CONFIG_PAX_PAGEEXEC
41747 + && (*flags & MF_PAX_SEGMEXEC)
41748 +#endif
41749 +
41750 + )
41751 + {
41752 + *flags &= ~MF_PAX_PAGEEXEC;
41753 + retval = -EINVAL;
41754 + }
41755 +
41756 + if ((*flags & MF_PAX_MPROTECT)
41757 +
41758 +#ifdef CONFIG_PAX_MPROTECT
41759 + && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
41760 +#endif
41761 +
41762 + )
41763 + {
41764 + *flags &= ~MF_PAX_MPROTECT;
41765 + retval = -EINVAL;
41766 + }
41767 +
41768 + if ((*flags & MF_PAX_EMUTRAMP)
41769 +
41770 +#ifdef CONFIG_PAX_EMUTRAMP
41771 + && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
41772 +#endif
41773 +
41774 + )
41775 + {
41776 + *flags &= ~MF_PAX_EMUTRAMP;
41777 + retval = -EINVAL;
41778 + }
41779 +
41780 + return retval;
41781 +}
41782 +
41783 +EXPORT_SYMBOL(pax_check_flags);
41784 +
41785 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
41786 +void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
41787 +{
41788 + struct task_struct *tsk = current;
41789 + struct mm_struct *mm = current->mm;
41790 + char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
41791 + char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
41792 + char *path_exec = NULL;
41793 + char *path_fault = NULL;
41794 + unsigned long start = 0UL, end = 0UL, offset = 0UL;
41795 +
41796 + if (buffer_exec && buffer_fault) {
41797 + struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
41798 +
41799 + down_read(&mm->mmap_sem);
41800 + vma = mm->mmap;
41801 + while (vma && (!vma_exec || !vma_fault)) {
41802 + if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
41803 + vma_exec = vma;
41804 + if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
41805 + vma_fault = vma;
41806 + vma = vma->vm_next;
41807 + }
41808 + if (vma_exec) {
41809 + path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
41810 + if (IS_ERR(path_exec))
41811 + path_exec = "<path too long>";
41812 + else {
41813 + path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
41814 + if (path_exec) {
41815 + *path_exec = 0;
41816 + path_exec = buffer_exec;
41817 + } else
41818 + path_exec = "<path too long>";
41819 + }
41820 + }
41821 + if (vma_fault) {
41822 + start = vma_fault->vm_start;
41823 + end = vma_fault->vm_end;
41824 + offset = vma_fault->vm_pgoff << PAGE_SHIFT;
41825 + if (vma_fault->vm_file) {
41826 + path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
41827 + if (IS_ERR(path_fault))
41828 + path_fault = "<path too long>";
41829 + else {
41830 + path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
41831 + if (path_fault) {
41832 + *path_fault = 0;
41833 + path_fault = buffer_fault;
41834 + } else
41835 + path_fault = "<path too long>";
41836 + }
41837 + } else
41838 + path_fault = "<anonymous mapping>";
41839 + }
41840 + up_read(&mm->mmap_sem);
41841 + }
41842 + if (tsk->signal->curr_ip)
41843 + printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
41844 + else
41845 + printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
41846 + printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
41847 + "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
41848 + task_uid(tsk), task_euid(tsk), pc, sp);
41849 + free_page((unsigned long)buffer_exec);
41850 + free_page((unsigned long)buffer_fault);
41851 + pax_report_insns(pc, sp);
41852 + do_coredump(SIGKILL, SIGKILL, regs);
41853 +}
41854 +#endif
41855 +
41856 +#ifdef CONFIG_PAX_REFCOUNT
41857 +void pax_report_refcount_overflow(struct pt_regs *regs)
41858 +{
41859 + if (current->signal->curr_ip)
41860 + printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
41861 + &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
41862 + else
41863 + printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
41864 + current->comm, task_pid_nr(current), current_uid(), current_euid());
41865 + print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
41866 + show_regs(regs);
41867 + force_sig_info(SIGKILL, SEND_SIG_FORCED, current);
41868 +}
41869 +#endif
41870 +
41871 +#ifdef CONFIG_PAX_USERCOPY
41872 +/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
41873 +int object_is_on_stack(const void *obj, unsigned long len)
41874 +{
41875 + const void * const stack = task_stack_page(current);
41876 + const void * const stackend = stack + THREAD_SIZE;
41877 +
41878 +#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
41879 + const void *frame = NULL;
41880 + const void *oldframe;
41881 +#endif
41882 +
41883 + if (obj + len < obj)
41884 + return -1;
41885 +
41886 + if (obj + len <= stack || stackend <= obj)
41887 + return 0;
41888 +
41889 + if (obj < stack || stackend < obj + len)
41890 + return -1;
41891 +
41892 +#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
41893 + oldframe = __builtin_frame_address(1);
41894 + if (oldframe)
41895 + frame = __builtin_frame_address(2);
41896 + /*
41897 + low ----------------------------------------------> high
41898 + [saved bp][saved ip][args][local vars][saved bp][saved ip]
41899 + ^----------------^
41900 + allow copies only within here
41901 + */
41902 + while (stack <= frame && frame < stackend) {
41903 + /* if obj + len extends past the last frame, this
41904 + check won't pass and the next frame will be 0,
41905 + causing us to bail out and correctly report
41906 + the copy as invalid
41907 + */
41908 + if (obj + len <= frame)
41909 + return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
41910 + oldframe = frame;
41911 + frame = *(const void * const *)frame;
41912 + }
41913 + return -1;
41914 +#else
41915 + return 1;
41916 +#endif
41917 +}
41918 +
41919 +
41920 +NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
41921 +{
41922 + if (current->signal->curr_ip)
41923 + printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
41924 + &current->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
41925 + else
41926 + printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
41927 + to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
41928 + dump_stack();
41929 + gr_handle_kernel_exploit();
41930 + do_group_exit(SIGKILL);
41931 +}
41932 +#endif
41933 +
41934 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
41935 +void pax_track_stack(void)
41936 +{
41937 + unsigned long sp = (unsigned long)&sp;
41938 + if (sp < current_thread_info()->lowest_stack &&
41939 + sp > (unsigned long)task_stack_page(current))
41940 + current_thread_info()->lowest_stack = sp;
41941 +}
41942 +EXPORT_SYMBOL(pax_track_stack);
41943 +#endif
41944 +
41945 static int zap_process(struct task_struct *start, int exit_code)
41946 {
41947 struct task_struct *t;
41948 @@ -1971,17 +2274,17 @@ static void wait_for_dump_helpers(struct
41949 pipe = file->f_path.dentry->d_inode->i_pipe;
41950
41951 pipe_lock(pipe);
41952 - pipe->readers++;
41953 - pipe->writers--;
41954 + atomic_inc(&pipe->readers);
41955 + atomic_dec(&pipe->writers);
41956
41957 - while ((pipe->readers > 1) && (!signal_pending(current))) {
41958 + while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
41959 wake_up_interruptible_sync(&pipe->wait);
41960 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
41961 pipe_wait(pipe);
41962 }
41963
41964 - pipe->readers--;
41965 - pipe->writers++;
41966 + atomic_dec(&pipe->readers);
41967 + atomic_inc(&pipe->writers);
41968 pipe_unlock(pipe);
41969
41970 }
41971 @@ -2042,7 +2345,7 @@ void do_coredump(long signr, int exit_co
41972 int retval = 0;
41973 int flag = 0;
41974 int ispipe;
41975 - static atomic_t core_dump_count = ATOMIC_INIT(0);
41976 + static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
41977 struct coredump_params cprm = {
41978 .signr = signr,
41979 .regs = regs,
41980 @@ -2057,6 +2360,9 @@ void do_coredump(long signr, int exit_co
41981
41982 audit_core_dumps(signr);
41983
41984 + if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
41985 + gr_handle_brute_attach(current, cprm.mm_flags);
41986 +
41987 binfmt = mm->binfmt;
41988 if (!binfmt || !binfmt->core_dump)
41989 goto fail;
41990 @@ -2097,6 +2403,8 @@ void do_coredump(long signr, int exit_co
41991 goto fail_corename;
41992 }
41993
41994 + gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
41995 +
41996 if (ispipe) {
41997 int dump_count;
41998 char **helper_argv;
41999 @@ -2124,7 +2432,7 @@ void do_coredump(long signr, int exit_co
42000 }
42001 cprm.limit = RLIM_INFINITY;
42002
42003 - dump_count = atomic_inc_return(&core_dump_count);
42004 + dump_count = atomic_inc_return_unchecked(&core_dump_count);
42005 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
42006 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
42007 task_tgid_vnr(current), current->comm);
42008 @@ -2194,7 +2502,7 @@ close_fail:
42009 filp_close(cprm.file, NULL);
42010 fail_dropcount:
42011 if (ispipe)
42012 - atomic_dec(&core_dump_count);
42013 + atomic_dec_unchecked(&core_dump_count);
42014 fail_unlock:
42015 kfree(cn.corename);
42016 fail_corename:
42017 @@ -2213,7 +2521,7 @@ fail:
42018 */
42019 int dump_write(struct file *file, const void *addr, int nr)
42020 {
42021 - return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, addr, nr, &file->f_pos) == nr;
42022 + return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, (const char __force_user *)addr, nr, &file->f_pos) == nr;
42023 }
42024 EXPORT_SYMBOL(dump_write);
42025
42026 diff -urNp linux-3.0.8/fs/ext2/balloc.c linux-3.0.8/fs/ext2/balloc.c
42027 --- linux-3.0.8/fs/ext2/balloc.c 2011-07-21 22:17:23.000000000 -0400
42028 +++ linux-3.0.8/fs/ext2/balloc.c 2011-08-23 21:48:14.000000000 -0400
42029 @@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
42030
42031 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
42032 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
42033 - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
42034 + if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
42035 sbi->s_resuid != current_fsuid() &&
42036 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
42037 return 0;
42038 diff -urNp linux-3.0.8/fs/ext3/balloc.c linux-3.0.8/fs/ext3/balloc.c
42039 --- linux-3.0.8/fs/ext3/balloc.c 2011-07-21 22:17:23.000000000 -0400
42040 +++ linux-3.0.8/fs/ext3/balloc.c 2011-08-23 21:48:14.000000000 -0400
42041 @@ -1441,7 +1441,7 @@ static int ext3_has_free_blocks(struct e
42042
42043 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
42044 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
42045 - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
42046 + if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
42047 sbi->s_resuid != current_fsuid() &&
42048 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
42049 return 0;
42050 diff -urNp linux-3.0.8/fs/ext3/ioctl.c linux-3.0.8/fs/ext3/ioctl.c
42051 --- linux-3.0.8/fs/ext3/ioctl.c 2011-07-21 22:17:23.000000000 -0400
42052 +++ linux-3.0.8/fs/ext3/ioctl.c 2011-10-06 04:17:55.000000000 -0400
42053 @@ -285,7 +285,7 @@ group_add_out:
42054 if (!capable(CAP_SYS_ADMIN))
42055 return -EPERM;
42056
42057 - if (copy_from_user(&range, (struct fstrim_range *)arg,
42058 + if (copy_from_user(&range, (struct fstrim_range __user *)arg,
42059 sizeof(range)))
42060 return -EFAULT;
42061
42062 @@ -293,7 +293,7 @@ group_add_out:
42063 if (ret < 0)
42064 return ret;
42065
42066 - if (copy_to_user((struct fstrim_range *)arg, &range,
42067 + if (copy_to_user((struct fstrim_range __user *)arg, &range,
42068 sizeof(range)))
42069 return -EFAULT;
42070
42071 diff -urNp linux-3.0.8/fs/ext4/balloc.c linux-3.0.8/fs/ext4/balloc.c
42072 --- linux-3.0.8/fs/ext4/balloc.c 2011-07-21 22:17:23.000000000 -0400
42073 +++ linux-3.0.8/fs/ext4/balloc.c 2011-08-23 21:48:14.000000000 -0400
42074 @@ -394,8 +394,8 @@ static int ext4_has_free_blocks(struct e
42075 /* Hm, nope. Are (enough) root reserved blocks available? */
42076 if (sbi->s_resuid == current_fsuid() ||
42077 ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
42078 - capable(CAP_SYS_RESOURCE) ||
42079 - (flags & EXT4_MB_USE_ROOT_BLOCKS)) {
42080 + (flags & EXT4_MB_USE_ROOT_BLOCKS) ||
42081 + capable_nolog(CAP_SYS_RESOURCE)) {
42082
42083 if (free_blocks >= (nblocks + dirty_blocks))
42084 return 1;
42085 diff -urNp linux-3.0.8/fs/ext4/ext4.h linux-3.0.8/fs/ext4/ext4.h
42086 --- linux-3.0.8/fs/ext4/ext4.h 2011-10-24 08:05:21.000000000 -0400
42087 +++ linux-3.0.8/fs/ext4/ext4.h 2011-08-23 21:47:56.000000000 -0400
42088 @@ -1177,19 +1177,19 @@ struct ext4_sb_info {
42089 unsigned long s_mb_last_start;
42090
42091 /* stats for buddy allocator */
42092 - atomic_t s_bal_reqs; /* number of reqs with len > 1 */
42093 - atomic_t s_bal_success; /* we found long enough chunks */
42094 - atomic_t s_bal_allocated; /* in blocks */
42095 - atomic_t s_bal_ex_scanned; /* total extents scanned */
42096 - atomic_t s_bal_goals; /* goal hits */
42097 - atomic_t s_bal_breaks; /* too long searches */
42098 - atomic_t s_bal_2orders; /* 2^order hits */
42099 + atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
42100 + atomic_unchecked_t s_bal_success; /* we found long enough chunks */
42101 + atomic_unchecked_t s_bal_allocated; /* in blocks */
42102 + atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
42103 + atomic_unchecked_t s_bal_goals; /* goal hits */
42104 + atomic_unchecked_t s_bal_breaks; /* too long searches */
42105 + atomic_unchecked_t s_bal_2orders; /* 2^order hits */
42106 spinlock_t s_bal_lock;
42107 unsigned long s_mb_buddies_generated;
42108 unsigned long long s_mb_generation_time;
42109 - atomic_t s_mb_lost_chunks;
42110 - atomic_t s_mb_preallocated;
42111 - atomic_t s_mb_discarded;
42112 + atomic_unchecked_t s_mb_lost_chunks;
42113 + atomic_unchecked_t s_mb_preallocated;
42114 + atomic_unchecked_t s_mb_discarded;
42115 atomic_t s_lock_busy;
42116
42117 /* locality groups */
42118 diff -urNp linux-3.0.8/fs/ext4/file.c linux-3.0.8/fs/ext4/file.c
42119 --- linux-3.0.8/fs/ext4/file.c 2011-07-21 22:17:23.000000000 -0400
42120 +++ linux-3.0.8/fs/ext4/file.c 2011-10-17 02:30:30.000000000 -0400
42121 @@ -181,8 +181,8 @@ static int ext4_file_open(struct inode *
42122 path.dentry = mnt->mnt_root;
42123 cp = d_path(&path, buf, sizeof(buf));
42124 if (!IS_ERR(cp)) {
42125 - memcpy(sbi->s_es->s_last_mounted, cp,
42126 - sizeof(sbi->s_es->s_last_mounted));
42127 + strlcpy(sbi->s_es->s_last_mounted, cp,
42128 + sizeof(sbi->s_es->s_last_mounted));
42129 ext4_mark_super_dirty(sb);
42130 }
42131 }
42132 diff -urNp linux-3.0.8/fs/ext4/ioctl.c linux-3.0.8/fs/ext4/ioctl.c
42133 --- linux-3.0.8/fs/ext4/ioctl.c 2011-07-21 22:17:23.000000000 -0400
42134 +++ linux-3.0.8/fs/ext4/ioctl.c 2011-10-06 04:17:55.000000000 -0400
42135 @@ -344,7 +344,7 @@ mext_out:
42136 if (!blk_queue_discard(q))
42137 return -EOPNOTSUPP;
42138
42139 - if (copy_from_user(&range, (struct fstrim_range *)arg,
42140 + if (copy_from_user(&range, (struct fstrim_range __user *)arg,
42141 sizeof(range)))
42142 return -EFAULT;
42143
42144 @@ -354,7 +354,7 @@ mext_out:
42145 if (ret < 0)
42146 return ret;
42147
42148 - if (copy_to_user((struct fstrim_range *)arg, &range,
42149 + if (copy_to_user((struct fstrim_range __user *)arg, &range,
42150 sizeof(range)))
42151 return -EFAULT;
42152
42153 diff -urNp linux-3.0.8/fs/ext4/mballoc.c linux-3.0.8/fs/ext4/mballoc.c
42154 --- linux-3.0.8/fs/ext4/mballoc.c 2011-10-24 08:05:21.000000000 -0400
42155 +++ linux-3.0.8/fs/ext4/mballoc.c 2011-08-23 21:48:14.000000000 -0400
42156 @@ -1793,7 +1793,7 @@ void ext4_mb_simple_scan_group(struct ex
42157 BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
42158
42159 if (EXT4_SB(sb)->s_mb_stats)
42160 - atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
42161 + atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
42162
42163 break;
42164 }
42165 @@ -2087,7 +2087,7 @@ repeat:
42166 ac->ac_status = AC_STATUS_CONTINUE;
42167 ac->ac_flags |= EXT4_MB_HINT_FIRST;
42168 cr = 3;
42169 - atomic_inc(&sbi->s_mb_lost_chunks);
42170 + atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
42171 goto repeat;
42172 }
42173 }
42174 @@ -2130,6 +2130,8 @@ static int ext4_mb_seq_groups_show(struc
42175 ext4_grpblk_t counters[16];
42176 } sg;
42177
42178 + pax_track_stack();
42179 +
42180 group--;
42181 if (group == 0)
42182 seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
42183 @@ -2553,25 +2555,25 @@ int ext4_mb_release(struct super_block *
42184 if (sbi->s_mb_stats) {
42185 printk(KERN_INFO
42186 "EXT4-fs: mballoc: %u blocks %u reqs (%u success)\n",
42187 - atomic_read(&sbi->s_bal_allocated),
42188 - atomic_read(&sbi->s_bal_reqs),
42189 - atomic_read(&sbi->s_bal_success));
42190 + atomic_read_unchecked(&sbi->s_bal_allocated),
42191 + atomic_read_unchecked(&sbi->s_bal_reqs),
42192 + atomic_read_unchecked(&sbi->s_bal_success));
42193 printk(KERN_INFO
42194 "EXT4-fs: mballoc: %u extents scanned, %u goal hits, "
42195 "%u 2^N hits, %u breaks, %u lost\n",
42196 - atomic_read(&sbi->s_bal_ex_scanned),
42197 - atomic_read(&sbi->s_bal_goals),
42198 - atomic_read(&sbi->s_bal_2orders),
42199 - atomic_read(&sbi->s_bal_breaks),
42200 - atomic_read(&sbi->s_mb_lost_chunks));
42201 + atomic_read_unchecked(&sbi->s_bal_ex_scanned),
42202 + atomic_read_unchecked(&sbi->s_bal_goals),
42203 + atomic_read_unchecked(&sbi->s_bal_2orders),
42204 + atomic_read_unchecked(&sbi->s_bal_breaks),
42205 + atomic_read_unchecked(&sbi->s_mb_lost_chunks));
42206 printk(KERN_INFO
42207 "EXT4-fs: mballoc: %lu generated and it took %Lu\n",
42208 sbi->s_mb_buddies_generated++,
42209 sbi->s_mb_generation_time);
42210 printk(KERN_INFO
42211 "EXT4-fs: mballoc: %u preallocated, %u discarded\n",
42212 - atomic_read(&sbi->s_mb_preallocated),
42213 - atomic_read(&sbi->s_mb_discarded));
42214 + atomic_read_unchecked(&sbi->s_mb_preallocated),
42215 + atomic_read_unchecked(&sbi->s_mb_discarded));
42216 }
42217
42218 free_percpu(sbi->s_locality_groups);
42219 @@ -3041,16 +3043,16 @@ static void ext4_mb_collect_stats(struct
42220 struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
42221
42222 if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
42223 - atomic_inc(&sbi->s_bal_reqs);
42224 - atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
42225 + atomic_inc_unchecked(&sbi->s_bal_reqs);
42226 + atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
42227 if (ac->ac_b_ex.fe_len >= ac->ac_o_ex.fe_len)
42228 - atomic_inc(&sbi->s_bal_success);
42229 - atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
42230 + atomic_inc_unchecked(&sbi->s_bal_success);
42231 + atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
42232 if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
42233 ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
42234 - atomic_inc(&sbi->s_bal_goals);
42235 + atomic_inc_unchecked(&sbi->s_bal_goals);
42236 if (ac->ac_found > sbi->s_mb_max_to_scan)
42237 - atomic_inc(&sbi->s_bal_breaks);
42238 + atomic_inc_unchecked(&sbi->s_bal_breaks);
42239 }
42240
42241 if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
42242 @@ -3448,7 +3450,7 @@ ext4_mb_new_inode_pa(struct ext4_allocat
42243 trace_ext4_mb_new_inode_pa(ac, pa);
42244
42245 ext4_mb_use_inode_pa(ac, pa);
42246 - atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
42247 + atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
42248
42249 ei = EXT4_I(ac->ac_inode);
42250 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
42251 @@ -3508,7 +3510,7 @@ ext4_mb_new_group_pa(struct ext4_allocat
42252 trace_ext4_mb_new_group_pa(ac, pa);
42253
42254 ext4_mb_use_group_pa(ac, pa);
42255 - atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
42256 + atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
42257
42258 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
42259 lg = ac->ac_lg;
42260 @@ -3595,7 +3597,7 @@ ext4_mb_release_inode_pa(struct ext4_bud
42261 * from the bitmap and continue.
42262 */
42263 }
42264 - atomic_add(free, &sbi->s_mb_discarded);
42265 + atomic_add_unchecked(free, &sbi->s_mb_discarded);
42266
42267 return err;
42268 }
42269 @@ -3613,7 +3615,7 @@ ext4_mb_release_group_pa(struct ext4_bud
42270 ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
42271 BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
42272 mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
42273 - atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
42274 + atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
42275 trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
42276
42277 return 0;
42278 diff -urNp linux-3.0.8/fs/fcntl.c linux-3.0.8/fs/fcntl.c
42279 --- linux-3.0.8/fs/fcntl.c 2011-07-21 22:17:23.000000000 -0400
42280 +++ linux-3.0.8/fs/fcntl.c 2011-10-06 04:17:55.000000000 -0400
42281 @@ -224,6 +224,11 @@ int __f_setown(struct file *filp, struct
42282 if (err)
42283 return err;
42284
42285 + if (gr_handle_chroot_fowner(pid, type))
42286 + return -ENOENT;
42287 + if (gr_check_protected_task_fowner(pid, type))
42288 + return -EACCES;
42289 +
42290 f_modown(filp, pid, type, force);
42291 return 0;
42292 }
42293 @@ -266,7 +271,7 @@ pid_t f_getown(struct file *filp)
42294
42295 static int f_setown_ex(struct file *filp, unsigned long arg)
42296 {
42297 - struct f_owner_ex * __user owner_p = (void * __user)arg;
42298 + struct f_owner_ex __user *owner_p = (void __user *)arg;
42299 struct f_owner_ex owner;
42300 struct pid *pid;
42301 int type;
42302 @@ -306,7 +311,7 @@ static int f_setown_ex(struct file *filp
42303
42304 static int f_getown_ex(struct file *filp, unsigned long arg)
42305 {
42306 - struct f_owner_ex * __user owner_p = (void * __user)arg;
42307 + struct f_owner_ex __user *owner_p = (void __user *)arg;
42308 struct f_owner_ex owner;
42309 int ret = 0;
42310
42311 @@ -348,6 +353,7 @@ static long do_fcntl(int fd, unsigned in
42312 switch (cmd) {
42313 case F_DUPFD:
42314 case F_DUPFD_CLOEXEC:
42315 + gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
42316 if (arg >= rlimit(RLIMIT_NOFILE))
42317 break;
42318 err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
42319 @@ -835,14 +841,14 @@ static int __init fcntl_init(void)
42320 * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
42321 * is defined as O_NONBLOCK on some platforms and not on others.
42322 */
42323 - BUILD_BUG_ON(19 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
42324 + BUILD_BUG_ON(20 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
42325 O_RDONLY | O_WRONLY | O_RDWR |
42326 O_CREAT | O_EXCL | O_NOCTTY |
42327 O_TRUNC | O_APPEND | /* O_NONBLOCK | */
42328 __O_SYNC | O_DSYNC | FASYNC |
42329 O_DIRECT | O_LARGEFILE | O_DIRECTORY |
42330 O_NOFOLLOW | O_NOATIME | O_CLOEXEC |
42331 - __FMODE_EXEC | O_PATH
42332 + __FMODE_EXEC | O_PATH | FMODE_GREXEC
42333 ));
42334
42335 fasync_cache = kmem_cache_create("fasync_cache",
42336 diff -urNp linux-3.0.8/fs/fifo.c linux-3.0.8/fs/fifo.c
42337 --- linux-3.0.8/fs/fifo.c 2011-07-21 22:17:23.000000000 -0400
42338 +++ linux-3.0.8/fs/fifo.c 2011-08-23 21:47:56.000000000 -0400
42339 @@ -58,10 +58,10 @@ static int fifo_open(struct inode *inode
42340 */
42341 filp->f_op = &read_pipefifo_fops;
42342 pipe->r_counter++;
42343 - if (pipe->readers++ == 0)
42344 + if (atomic_inc_return(&pipe->readers) == 1)
42345 wake_up_partner(inode);
42346
42347 - if (!pipe->writers) {
42348 + if (!atomic_read(&pipe->writers)) {
42349 if ((filp->f_flags & O_NONBLOCK)) {
42350 /* suppress POLLHUP until we have
42351 * seen a writer */
42352 @@ -81,15 +81,15 @@ static int fifo_open(struct inode *inode
42353 * errno=ENXIO when there is no process reading the FIFO.
42354 */
42355 ret = -ENXIO;
42356 - if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
42357 + if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
42358 goto err;
42359
42360 filp->f_op = &write_pipefifo_fops;
42361 pipe->w_counter++;
42362 - if (!pipe->writers++)
42363 + if (atomic_inc_return(&pipe->writers) == 1)
42364 wake_up_partner(inode);
42365
42366 - if (!pipe->readers) {
42367 + if (!atomic_read(&pipe->readers)) {
42368 wait_for_partner(inode, &pipe->r_counter);
42369 if (signal_pending(current))
42370 goto err_wr;
42371 @@ -105,11 +105,11 @@ static int fifo_open(struct inode *inode
42372 */
42373 filp->f_op = &rdwr_pipefifo_fops;
42374
42375 - pipe->readers++;
42376 - pipe->writers++;
42377 + atomic_inc(&pipe->readers);
42378 + atomic_inc(&pipe->writers);
42379 pipe->r_counter++;
42380 pipe->w_counter++;
42381 - if (pipe->readers == 1 || pipe->writers == 1)
42382 + if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
42383 wake_up_partner(inode);
42384 break;
42385
42386 @@ -123,19 +123,19 @@ static int fifo_open(struct inode *inode
42387 return 0;
42388
42389 err_rd:
42390 - if (!--pipe->readers)
42391 + if (atomic_dec_and_test(&pipe->readers))
42392 wake_up_interruptible(&pipe->wait);
42393 ret = -ERESTARTSYS;
42394 goto err;
42395
42396 err_wr:
42397 - if (!--pipe->writers)
42398 + if (atomic_dec_and_test(&pipe->writers))
42399 wake_up_interruptible(&pipe->wait);
42400 ret = -ERESTARTSYS;
42401 goto err;
42402
42403 err:
42404 - if (!pipe->readers && !pipe->writers)
42405 + if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
42406 free_pipe_info(inode);
42407
42408 err_nocleanup:
42409 diff -urNp linux-3.0.8/fs/file.c linux-3.0.8/fs/file.c
42410 --- linux-3.0.8/fs/file.c 2011-07-21 22:17:23.000000000 -0400
42411 +++ linux-3.0.8/fs/file.c 2011-08-23 21:48:14.000000000 -0400
42412 @@ -15,6 +15,7 @@
42413 #include <linux/slab.h>
42414 #include <linux/vmalloc.h>
42415 #include <linux/file.h>
42416 +#include <linux/security.h>
42417 #include <linux/fdtable.h>
42418 #include <linux/bitops.h>
42419 #include <linux/interrupt.h>
42420 @@ -254,6 +255,7 @@ int expand_files(struct files_struct *fi
42421 * N.B. For clone tasks sharing a files structure, this test
42422 * will limit the total number of files that can be opened.
42423 */
42424 + gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
42425 if (nr >= rlimit(RLIMIT_NOFILE))
42426 return -EMFILE;
42427
42428 diff -urNp linux-3.0.8/fs/filesystems.c linux-3.0.8/fs/filesystems.c
42429 --- linux-3.0.8/fs/filesystems.c 2011-07-21 22:17:23.000000000 -0400
42430 +++ linux-3.0.8/fs/filesystems.c 2011-08-23 21:48:14.000000000 -0400
42431 @@ -274,7 +274,12 @@ struct file_system_type *get_fs_type(con
42432 int len = dot ? dot - name : strlen(name);
42433
42434 fs = __get_fs_type(name, len);
42435 +
42436 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
42437 + if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
42438 +#else
42439 if (!fs && (request_module("%.*s", len, name) == 0))
42440 +#endif
42441 fs = __get_fs_type(name, len);
42442
42443 if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
42444 diff -urNp linux-3.0.8/fs/fscache/cookie.c linux-3.0.8/fs/fscache/cookie.c
42445 --- linux-3.0.8/fs/fscache/cookie.c 2011-07-21 22:17:23.000000000 -0400
42446 +++ linux-3.0.8/fs/fscache/cookie.c 2011-08-23 21:47:56.000000000 -0400
42447 @@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire
42448 parent ? (char *) parent->def->name : "<no-parent>",
42449 def->name, netfs_data);
42450
42451 - fscache_stat(&fscache_n_acquires);
42452 + fscache_stat_unchecked(&fscache_n_acquires);
42453
42454 /* if there's no parent cookie, then we don't create one here either */
42455 if (!parent) {
42456 - fscache_stat(&fscache_n_acquires_null);
42457 + fscache_stat_unchecked(&fscache_n_acquires_null);
42458 _leave(" [no parent]");
42459 return NULL;
42460 }
42461 @@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire
42462 /* allocate and initialise a cookie */
42463 cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
42464 if (!cookie) {
42465 - fscache_stat(&fscache_n_acquires_oom);
42466 + fscache_stat_unchecked(&fscache_n_acquires_oom);
42467 _leave(" [ENOMEM]");
42468 return NULL;
42469 }
42470 @@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire
42471
42472 switch (cookie->def->type) {
42473 case FSCACHE_COOKIE_TYPE_INDEX:
42474 - fscache_stat(&fscache_n_cookie_index);
42475 + fscache_stat_unchecked(&fscache_n_cookie_index);
42476 break;
42477 case FSCACHE_COOKIE_TYPE_DATAFILE:
42478 - fscache_stat(&fscache_n_cookie_data);
42479 + fscache_stat_unchecked(&fscache_n_cookie_data);
42480 break;
42481 default:
42482 - fscache_stat(&fscache_n_cookie_special);
42483 + fscache_stat_unchecked(&fscache_n_cookie_special);
42484 break;
42485 }
42486
42487 @@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire
42488 if (fscache_acquire_non_index_cookie(cookie) < 0) {
42489 atomic_dec(&parent->n_children);
42490 __fscache_cookie_put(cookie);
42491 - fscache_stat(&fscache_n_acquires_nobufs);
42492 + fscache_stat_unchecked(&fscache_n_acquires_nobufs);
42493 _leave(" = NULL");
42494 return NULL;
42495 }
42496 }
42497
42498 - fscache_stat(&fscache_n_acquires_ok);
42499 + fscache_stat_unchecked(&fscache_n_acquires_ok);
42500 _leave(" = %p", cookie);
42501 return cookie;
42502 }
42503 @@ -168,7 +168,7 @@ static int fscache_acquire_non_index_coo
42504 cache = fscache_select_cache_for_object(cookie->parent);
42505 if (!cache) {
42506 up_read(&fscache_addremove_sem);
42507 - fscache_stat(&fscache_n_acquires_no_cache);
42508 + fscache_stat_unchecked(&fscache_n_acquires_no_cache);
42509 _leave(" = -ENOMEDIUM [no cache]");
42510 return -ENOMEDIUM;
42511 }
42512 @@ -256,12 +256,12 @@ static int fscache_alloc_object(struct f
42513 object = cache->ops->alloc_object(cache, cookie);
42514 fscache_stat_d(&fscache_n_cop_alloc_object);
42515 if (IS_ERR(object)) {
42516 - fscache_stat(&fscache_n_object_no_alloc);
42517 + fscache_stat_unchecked(&fscache_n_object_no_alloc);
42518 ret = PTR_ERR(object);
42519 goto error;
42520 }
42521
42522 - fscache_stat(&fscache_n_object_alloc);
42523 + fscache_stat_unchecked(&fscache_n_object_alloc);
42524
42525 object->debug_id = atomic_inc_return(&fscache_object_debug_id);
42526
42527 @@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fsca
42528 struct fscache_object *object;
42529 struct hlist_node *_p;
42530
42531 - fscache_stat(&fscache_n_updates);
42532 + fscache_stat_unchecked(&fscache_n_updates);
42533
42534 if (!cookie) {
42535 - fscache_stat(&fscache_n_updates_null);
42536 + fscache_stat_unchecked(&fscache_n_updates_null);
42537 _leave(" [no cookie]");
42538 return;
42539 }
42540 @@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct
42541 struct fscache_object *object;
42542 unsigned long event;
42543
42544 - fscache_stat(&fscache_n_relinquishes);
42545 + fscache_stat_unchecked(&fscache_n_relinquishes);
42546 if (retire)
42547 - fscache_stat(&fscache_n_relinquishes_retire);
42548 + fscache_stat_unchecked(&fscache_n_relinquishes_retire);
42549
42550 if (!cookie) {
42551 - fscache_stat(&fscache_n_relinquishes_null);
42552 + fscache_stat_unchecked(&fscache_n_relinquishes_null);
42553 _leave(" [no cookie]");
42554 return;
42555 }
42556 @@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct
42557
42558 /* wait for the cookie to finish being instantiated (or to fail) */
42559 if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
42560 - fscache_stat(&fscache_n_relinquishes_waitcrt);
42561 + fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
42562 wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
42563 fscache_wait_bit, TASK_UNINTERRUPTIBLE);
42564 }
42565 diff -urNp linux-3.0.8/fs/fscache/internal.h linux-3.0.8/fs/fscache/internal.h
42566 --- linux-3.0.8/fs/fscache/internal.h 2011-07-21 22:17:23.000000000 -0400
42567 +++ linux-3.0.8/fs/fscache/internal.h 2011-08-23 21:47:56.000000000 -0400
42568 @@ -144,94 +144,94 @@ extern void fscache_proc_cleanup(void);
42569 extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
42570 extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
42571
42572 -extern atomic_t fscache_n_op_pend;
42573 -extern atomic_t fscache_n_op_run;
42574 -extern atomic_t fscache_n_op_enqueue;
42575 -extern atomic_t fscache_n_op_deferred_release;
42576 -extern atomic_t fscache_n_op_release;
42577 -extern atomic_t fscache_n_op_gc;
42578 -extern atomic_t fscache_n_op_cancelled;
42579 -extern atomic_t fscache_n_op_rejected;
42580 -
42581 -extern atomic_t fscache_n_attr_changed;
42582 -extern atomic_t fscache_n_attr_changed_ok;
42583 -extern atomic_t fscache_n_attr_changed_nobufs;
42584 -extern atomic_t fscache_n_attr_changed_nomem;
42585 -extern atomic_t fscache_n_attr_changed_calls;
42586 -
42587 -extern atomic_t fscache_n_allocs;
42588 -extern atomic_t fscache_n_allocs_ok;
42589 -extern atomic_t fscache_n_allocs_wait;
42590 -extern atomic_t fscache_n_allocs_nobufs;
42591 -extern atomic_t fscache_n_allocs_intr;
42592 -extern atomic_t fscache_n_allocs_object_dead;
42593 -extern atomic_t fscache_n_alloc_ops;
42594 -extern atomic_t fscache_n_alloc_op_waits;
42595 -
42596 -extern atomic_t fscache_n_retrievals;
42597 -extern atomic_t fscache_n_retrievals_ok;
42598 -extern atomic_t fscache_n_retrievals_wait;
42599 -extern atomic_t fscache_n_retrievals_nodata;
42600 -extern atomic_t fscache_n_retrievals_nobufs;
42601 -extern atomic_t fscache_n_retrievals_intr;
42602 -extern atomic_t fscache_n_retrievals_nomem;
42603 -extern atomic_t fscache_n_retrievals_object_dead;
42604 -extern atomic_t fscache_n_retrieval_ops;
42605 -extern atomic_t fscache_n_retrieval_op_waits;
42606 -
42607 -extern atomic_t fscache_n_stores;
42608 -extern atomic_t fscache_n_stores_ok;
42609 -extern atomic_t fscache_n_stores_again;
42610 -extern atomic_t fscache_n_stores_nobufs;
42611 -extern atomic_t fscache_n_stores_oom;
42612 -extern atomic_t fscache_n_store_ops;
42613 -extern atomic_t fscache_n_store_calls;
42614 -extern atomic_t fscache_n_store_pages;
42615 -extern atomic_t fscache_n_store_radix_deletes;
42616 -extern atomic_t fscache_n_store_pages_over_limit;
42617 -
42618 -extern atomic_t fscache_n_store_vmscan_not_storing;
42619 -extern atomic_t fscache_n_store_vmscan_gone;
42620 -extern atomic_t fscache_n_store_vmscan_busy;
42621 -extern atomic_t fscache_n_store_vmscan_cancelled;
42622 -
42623 -extern atomic_t fscache_n_marks;
42624 -extern atomic_t fscache_n_uncaches;
42625 -
42626 -extern atomic_t fscache_n_acquires;
42627 -extern atomic_t fscache_n_acquires_null;
42628 -extern atomic_t fscache_n_acquires_no_cache;
42629 -extern atomic_t fscache_n_acquires_ok;
42630 -extern atomic_t fscache_n_acquires_nobufs;
42631 -extern atomic_t fscache_n_acquires_oom;
42632 -
42633 -extern atomic_t fscache_n_updates;
42634 -extern atomic_t fscache_n_updates_null;
42635 -extern atomic_t fscache_n_updates_run;
42636 -
42637 -extern atomic_t fscache_n_relinquishes;
42638 -extern atomic_t fscache_n_relinquishes_null;
42639 -extern atomic_t fscache_n_relinquishes_waitcrt;
42640 -extern atomic_t fscache_n_relinquishes_retire;
42641 -
42642 -extern atomic_t fscache_n_cookie_index;
42643 -extern atomic_t fscache_n_cookie_data;
42644 -extern atomic_t fscache_n_cookie_special;
42645 -
42646 -extern atomic_t fscache_n_object_alloc;
42647 -extern atomic_t fscache_n_object_no_alloc;
42648 -extern atomic_t fscache_n_object_lookups;
42649 -extern atomic_t fscache_n_object_lookups_negative;
42650 -extern atomic_t fscache_n_object_lookups_positive;
42651 -extern atomic_t fscache_n_object_lookups_timed_out;
42652 -extern atomic_t fscache_n_object_created;
42653 -extern atomic_t fscache_n_object_avail;
42654 -extern atomic_t fscache_n_object_dead;
42655 -
42656 -extern atomic_t fscache_n_checkaux_none;
42657 -extern atomic_t fscache_n_checkaux_okay;
42658 -extern atomic_t fscache_n_checkaux_update;
42659 -extern atomic_t fscache_n_checkaux_obsolete;
42660 +extern atomic_unchecked_t fscache_n_op_pend;
42661 +extern atomic_unchecked_t fscache_n_op_run;
42662 +extern atomic_unchecked_t fscache_n_op_enqueue;
42663 +extern atomic_unchecked_t fscache_n_op_deferred_release;
42664 +extern atomic_unchecked_t fscache_n_op_release;
42665 +extern atomic_unchecked_t fscache_n_op_gc;
42666 +extern atomic_unchecked_t fscache_n_op_cancelled;
42667 +extern atomic_unchecked_t fscache_n_op_rejected;
42668 +
42669 +extern atomic_unchecked_t fscache_n_attr_changed;
42670 +extern atomic_unchecked_t fscache_n_attr_changed_ok;
42671 +extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
42672 +extern atomic_unchecked_t fscache_n_attr_changed_nomem;
42673 +extern atomic_unchecked_t fscache_n_attr_changed_calls;
42674 +
42675 +extern atomic_unchecked_t fscache_n_allocs;
42676 +extern atomic_unchecked_t fscache_n_allocs_ok;
42677 +extern atomic_unchecked_t fscache_n_allocs_wait;
42678 +extern atomic_unchecked_t fscache_n_allocs_nobufs;
42679 +extern atomic_unchecked_t fscache_n_allocs_intr;
42680 +extern atomic_unchecked_t fscache_n_allocs_object_dead;
42681 +extern atomic_unchecked_t fscache_n_alloc_ops;
42682 +extern atomic_unchecked_t fscache_n_alloc_op_waits;
42683 +
42684 +extern atomic_unchecked_t fscache_n_retrievals;
42685 +extern atomic_unchecked_t fscache_n_retrievals_ok;
42686 +extern atomic_unchecked_t fscache_n_retrievals_wait;
42687 +extern atomic_unchecked_t fscache_n_retrievals_nodata;
42688 +extern atomic_unchecked_t fscache_n_retrievals_nobufs;
42689 +extern atomic_unchecked_t fscache_n_retrievals_intr;
42690 +extern atomic_unchecked_t fscache_n_retrievals_nomem;
42691 +extern atomic_unchecked_t fscache_n_retrievals_object_dead;
42692 +extern atomic_unchecked_t fscache_n_retrieval_ops;
42693 +extern atomic_unchecked_t fscache_n_retrieval_op_waits;
42694 +
42695 +extern atomic_unchecked_t fscache_n_stores;
42696 +extern atomic_unchecked_t fscache_n_stores_ok;
42697 +extern atomic_unchecked_t fscache_n_stores_again;
42698 +extern atomic_unchecked_t fscache_n_stores_nobufs;
42699 +extern atomic_unchecked_t fscache_n_stores_oom;
42700 +extern atomic_unchecked_t fscache_n_store_ops;
42701 +extern atomic_unchecked_t fscache_n_store_calls;
42702 +extern atomic_unchecked_t fscache_n_store_pages;
42703 +extern atomic_unchecked_t fscache_n_store_radix_deletes;
42704 +extern atomic_unchecked_t fscache_n_store_pages_over_limit;
42705 +
42706 +extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
42707 +extern atomic_unchecked_t fscache_n_store_vmscan_gone;
42708 +extern atomic_unchecked_t fscache_n_store_vmscan_busy;
42709 +extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
42710 +
42711 +extern atomic_unchecked_t fscache_n_marks;
42712 +extern atomic_unchecked_t fscache_n_uncaches;
42713 +
42714 +extern atomic_unchecked_t fscache_n_acquires;
42715 +extern atomic_unchecked_t fscache_n_acquires_null;
42716 +extern atomic_unchecked_t fscache_n_acquires_no_cache;
42717 +extern atomic_unchecked_t fscache_n_acquires_ok;
42718 +extern atomic_unchecked_t fscache_n_acquires_nobufs;
42719 +extern atomic_unchecked_t fscache_n_acquires_oom;
42720 +
42721 +extern atomic_unchecked_t fscache_n_updates;
42722 +extern atomic_unchecked_t fscache_n_updates_null;
42723 +extern atomic_unchecked_t fscache_n_updates_run;
42724 +
42725 +extern atomic_unchecked_t fscache_n_relinquishes;
42726 +extern atomic_unchecked_t fscache_n_relinquishes_null;
42727 +extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
42728 +extern atomic_unchecked_t fscache_n_relinquishes_retire;
42729 +
42730 +extern atomic_unchecked_t fscache_n_cookie_index;
42731 +extern atomic_unchecked_t fscache_n_cookie_data;
42732 +extern atomic_unchecked_t fscache_n_cookie_special;
42733 +
42734 +extern atomic_unchecked_t fscache_n_object_alloc;
42735 +extern atomic_unchecked_t fscache_n_object_no_alloc;
42736 +extern atomic_unchecked_t fscache_n_object_lookups;
42737 +extern atomic_unchecked_t fscache_n_object_lookups_negative;
42738 +extern atomic_unchecked_t fscache_n_object_lookups_positive;
42739 +extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
42740 +extern atomic_unchecked_t fscache_n_object_created;
42741 +extern atomic_unchecked_t fscache_n_object_avail;
42742 +extern atomic_unchecked_t fscache_n_object_dead;
42743 +
42744 +extern atomic_unchecked_t fscache_n_checkaux_none;
42745 +extern atomic_unchecked_t fscache_n_checkaux_okay;
42746 +extern atomic_unchecked_t fscache_n_checkaux_update;
42747 +extern atomic_unchecked_t fscache_n_checkaux_obsolete;
42748
42749 extern atomic_t fscache_n_cop_alloc_object;
42750 extern atomic_t fscache_n_cop_lookup_object;
42751 @@ -255,6 +255,11 @@ static inline void fscache_stat(atomic_t
42752 atomic_inc(stat);
42753 }
42754
42755 +static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
42756 +{
42757 + atomic_inc_unchecked(stat);
42758 +}
42759 +
42760 static inline void fscache_stat_d(atomic_t *stat)
42761 {
42762 atomic_dec(stat);
42763 @@ -267,6 +272,7 @@ extern const struct file_operations fsca
42764
42765 #define __fscache_stat(stat) (NULL)
42766 #define fscache_stat(stat) do {} while (0)
42767 +#define fscache_stat_unchecked(stat) do {} while (0)
42768 #define fscache_stat_d(stat) do {} while (0)
42769 #endif
42770
42771 diff -urNp linux-3.0.8/fs/fscache/object.c linux-3.0.8/fs/fscache/object.c
42772 --- linux-3.0.8/fs/fscache/object.c 2011-07-21 22:17:23.000000000 -0400
42773 +++ linux-3.0.8/fs/fscache/object.c 2011-08-23 21:47:56.000000000 -0400
42774 @@ -128,7 +128,7 @@ static void fscache_object_state_machine
42775 /* update the object metadata on disk */
42776 case FSCACHE_OBJECT_UPDATING:
42777 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
42778 - fscache_stat(&fscache_n_updates_run);
42779 + fscache_stat_unchecked(&fscache_n_updates_run);
42780 fscache_stat(&fscache_n_cop_update_object);
42781 object->cache->ops->update_object(object);
42782 fscache_stat_d(&fscache_n_cop_update_object);
42783 @@ -217,7 +217,7 @@ static void fscache_object_state_machine
42784 spin_lock(&object->lock);
42785 object->state = FSCACHE_OBJECT_DEAD;
42786 spin_unlock(&object->lock);
42787 - fscache_stat(&fscache_n_object_dead);
42788 + fscache_stat_unchecked(&fscache_n_object_dead);
42789 goto terminal_transit;
42790
42791 /* handle the parent cache of this object being withdrawn from
42792 @@ -232,7 +232,7 @@ static void fscache_object_state_machine
42793 spin_lock(&object->lock);
42794 object->state = FSCACHE_OBJECT_DEAD;
42795 spin_unlock(&object->lock);
42796 - fscache_stat(&fscache_n_object_dead);
42797 + fscache_stat_unchecked(&fscache_n_object_dead);
42798 goto terminal_transit;
42799
42800 /* complain about the object being woken up once it is
42801 @@ -461,7 +461,7 @@ static void fscache_lookup_object(struct
42802 parent->cookie->def->name, cookie->def->name,
42803 object->cache->tag->name);
42804
42805 - fscache_stat(&fscache_n_object_lookups);
42806 + fscache_stat_unchecked(&fscache_n_object_lookups);
42807 fscache_stat(&fscache_n_cop_lookup_object);
42808 ret = object->cache->ops->lookup_object(object);
42809 fscache_stat_d(&fscache_n_cop_lookup_object);
42810 @@ -472,7 +472,7 @@ static void fscache_lookup_object(struct
42811 if (ret == -ETIMEDOUT) {
42812 /* probably stuck behind another object, so move this one to
42813 * the back of the queue */
42814 - fscache_stat(&fscache_n_object_lookups_timed_out);
42815 + fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
42816 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
42817 }
42818
42819 @@ -495,7 +495,7 @@ void fscache_object_lookup_negative(stru
42820
42821 spin_lock(&object->lock);
42822 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
42823 - fscache_stat(&fscache_n_object_lookups_negative);
42824 + fscache_stat_unchecked(&fscache_n_object_lookups_negative);
42825
42826 /* transit here to allow write requests to begin stacking up
42827 * and read requests to begin returning ENODATA */
42828 @@ -541,7 +541,7 @@ void fscache_obtained_object(struct fsca
42829 * result, in which case there may be data available */
42830 spin_lock(&object->lock);
42831 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
42832 - fscache_stat(&fscache_n_object_lookups_positive);
42833 + fscache_stat_unchecked(&fscache_n_object_lookups_positive);
42834
42835 clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
42836
42837 @@ -555,7 +555,7 @@ void fscache_obtained_object(struct fsca
42838 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
42839 } else {
42840 ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
42841 - fscache_stat(&fscache_n_object_created);
42842 + fscache_stat_unchecked(&fscache_n_object_created);
42843
42844 object->state = FSCACHE_OBJECT_AVAILABLE;
42845 spin_unlock(&object->lock);
42846 @@ -602,7 +602,7 @@ static void fscache_object_available(str
42847 fscache_enqueue_dependents(object);
42848
42849 fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
42850 - fscache_stat(&fscache_n_object_avail);
42851 + fscache_stat_unchecked(&fscache_n_object_avail);
42852
42853 _leave("");
42854 }
42855 @@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(
42856 enum fscache_checkaux result;
42857
42858 if (!object->cookie->def->check_aux) {
42859 - fscache_stat(&fscache_n_checkaux_none);
42860 + fscache_stat_unchecked(&fscache_n_checkaux_none);
42861 return FSCACHE_CHECKAUX_OKAY;
42862 }
42863
42864 @@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(
42865 switch (result) {
42866 /* entry okay as is */
42867 case FSCACHE_CHECKAUX_OKAY:
42868 - fscache_stat(&fscache_n_checkaux_okay);
42869 + fscache_stat_unchecked(&fscache_n_checkaux_okay);
42870 break;
42871
42872 /* entry requires update */
42873 case FSCACHE_CHECKAUX_NEEDS_UPDATE:
42874 - fscache_stat(&fscache_n_checkaux_update);
42875 + fscache_stat_unchecked(&fscache_n_checkaux_update);
42876 break;
42877
42878 /* entry requires deletion */
42879 case FSCACHE_CHECKAUX_OBSOLETE:
42880 - fscache_stat(&fscache_n_checkaux_obsolete);
42881 + fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
42882 break;
42883
42884 default:
42885 diff -urNp linux-3.0.8/fs/fscache/operation.c linux-3.0.8/fs/fscache/operation.c
42886 --- linux-3.0.8/fs/fscache/operation.c 2011-07-21 22:17:23.000000000 -0400
42887 +++ linux-3.0.8/fs/fscache/operation.c 2011-08-23 21:47:56.000000000 -0400
42888 @@ -17,7 +17,7 @@
42889 #include <linux/slab.h>
42890 #include "internal.h"
42891
42892 -atomic_t fscache_op_debug_id;
42893 +atomic_unchecked_t fscache_op_debug_id;
42894 EXPORT_SYMBOL(fscache_op_debug_id);
42895
42896 /**
42897 @@ -38,7 +38,7 @@ void fscache_enqueue_operation(struct fs
42898 ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
42899 ASSERTCMP(atomic_read(&op->usage), >, 0);
42900
42901 - fscache_stat(&fscache_n_op_enqueue);
42902 + fscache_stat_unchecked(&fscache_n_op_enqueue);
42903 switch (op->flags & FSCACHE_OP_TYPE) {
42904 case FSCACHE_OP_ASYNC:
42905 _debug("queue async");
42906 @@ -69,7 +69,7 @@ static void fscache_run_op(struct fscach
42907 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
42908 if (op->processor)
42909 fscache_enqueue_operation(op);
42910 - fscache_stat(&fscache_n_op_run);
42911 + fscache_stat_unchecked(&fscache_n_op_run);
42912 }
42913
42914 /*
42915 @@ -98,11 +98,11 @@ int fscache_submit_exclusive_op(struct f
42916 if (object->n_ops > 1) {
42917 atomic_inc(&op->usage);
42918 list_add_tail(&op->pend_link, &object->pending_ops);
42919 - fscache_stat(&fscache_n_op_pend);
42920 + fscache_stat_unchecked(&fscache_n_op_pend);
42921 } else if (!list_empty(&object->pending_ops)) {
42922 atomic_inc(&op->usage);
42923 list_add_tail(&op->pend_link, &object->pending_ops);
42924 - fscache_stat(&fscache_n_op_pend);
42925 + fscache_stat_unchecked(&fscache_n_op_pend);
42926 fscache_start_operations(object);
42927 } else {
42928 ASSERTCMP(object->n_in_progress, ==, 0);
42929 @@ -118,7 +118,7 @@ int fscache_submit_exclusive_op(struct f
42930 object->n_exclusive++; /* reads and writes must wait */
42931 atomic_inc(&op->usage);
42932 list_add_tail(&op->pend_link, &object->pending_ops);
42933 - fscache_stat(&fscache_n_op_pend);
42934 + fscache_stat_unchecked(&fscache_n_op_pend);
42935 ret = 0;
42936 } else {
42937 /* not allowed to submit ops in any other state */
42938 @@ -203,11 +203,11 @@ int fscache_submit_op(struct fscache_obj
42939 if (object->n_exclusive > 0) {
42940 atomic_inc(&op->usage);
42941 list_add_tail(&op->pend_link, &object->pending_ops);
42942 - fscache_stat(&fscache_n_op_pend);
42943 + fscache_stat_unchecked(&fscache_n_op_pend);
42944 } else if (!list_empty(&object->pending_ops)) {
42945 atomic_inc(&op->usage);
42946 list_add_tail(&op->pend_link, &object->pending_ops);
42947 - fscache_stat(&fscache_n_op_pend);
42948 + fscache_stat_unchecked(&fscache_n_op_pend);
42949 fscache_start_operations(object);
42950 } else {
42951 ASSERTCMP(object->n_exclusive, ==, 0);
42952 @@ -219,12 +219,12 @@ int fscache_submit_op(struct fscache_obj
42953 object->n_ops++;
42954 atomic_inc(&op->usage);
42955 list_add_tail(&op->pend_link, &object->pending_ops);
42956 - fscache_stat(&fscache_n_op_pend);
42957 + fscache_stat_unchecked(&fscache_n_op_pend);
42958 ret = 0;
42959 } else if (object->state == FSCACHE_OBJECT_DYING ||
42960 object->state == FSCACHE_OBJECT_LC_DYING ||
42961 object->state == FSCACHE_OBJECT_WITHDRAWING) {
42962 - fscache_stat(&fscache_n_op_rejected);
42963 + fscache_stat_unchecked(&fscache_n_op_rejected);
42964 ret = -ENOBUFS;
42965 } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
42966 fscache_report_unexpected_submission(object, op, ostate);
42967 @@ -294,7 +294,7 @@ int fscache_cancel_op(struct fscache_ope
42968
42969 ret = -EBUSY;
42970 if (!list_empty(&op->pend_link)) {
42971 - fscache_stat(&fscache_n_op_cancelled);
42972 + fscache_stat_unchecked(&fscache_n_op_cancelled);
42973 list_del_init(&op->pend_link);
42974 object->n_ops--;
42975 if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
42976 @@ -331,7 +331,7 @@ void fscache_put_operation(struct fscach
42977 if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
42978 BUG();
42979
42980 - fscache_stat(&fscache_n_op_release);
42981 + fscache_stat_unchecked(&fscache_n_op_release);
42982
42983 if (op->release) {
42984 op->release(op);
42985 @@ -348,7 +348,7 @@ void fscache_put_operation(struct fscach
42986 * lock, and defer it otherwise */
42987 if (!spin_trylock(&object->lock)) {
42988 _debug("defer put");
42989 - fscache_stat(&fscache_n_op_deferred_release);
42990 + fscache_stat_unchecked(&fscache_n_op_deferred_release);
42991
42992 cache = object->cache;
42993 spin_lock(&cache->op_gc_list_lock);
42994 @@ -410,7 +410,7 @@ void fscache_operation_gc(struct work_st
42995
42996 _debug("GC DEFERRED REL OBJ%x OP%x",
42997 object->debug_id, op->debug_id);
42998 - fscache_stat(&fscache_n_op_gc);
42999 + fscache_stat_unchecked(&fscache_n_op_gc);
43000
43001 ASSERTCMP(atomic_read(&op->usage), ==, 0);
43002
43003 diff -urNp linux-3.0.8/fs/fscache/page.c linux-3.0.8/fs/fscache/page.c
43004 --- linux-3.0.8/fs/fscache/page.c 2011-07-21 22:17:23.000000000 -0400
43005 +++ linux-3.0.8/fs/fscache/page.c 2011-08-23 21:47:56.000000000 -0400
43006 @@ -60,7 +60,7 @@ bool __fscache_maybe_release_page(struct
43007 val = radix_tree_lookup(&cookie->stores, page->index);
43008 if (!val) {
43009 rcu_read_unlock();
43010 - fscache_stat(&fscache_n_store_vmscan_not_storing);
43011 + fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
43012 __fscache_uncache_page(cookie, page);
43013 return true;
43014 }
43015 @@ -90,11 +90,11 @@ bool __fscache_maybe_release_page(struct
43016 spin_unlock(&cookie->stores_lock);
43017
43018 if (xpage) {
43019 - fscache_stat(&fscache_n_store_vmscan_cancelled);
43020 - fscache_stat(&fscache_n_store_radix_deletes);
43021 + fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
43022 + fscache_stat_unchecked(&fscache_n_store_radix_deletes);
43023 ASSERTCMP(xpage, ==, page);
43024 } else {
43025 - fscache_stat(&fscache_n_store_vmscan_gone);
43026 + fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
43027 }
43028
43029 wake_up_bit(&cookie->flags, 0);
43030 @@ -107,7 +107,7 @@ page_busy:
43031 /* we might want to wait here, but that could deadlock the allocator as
43032 * the work threads writing to the cache may all end up sleeping
43033 * on memory allocation */
43034 - fscache_stat(&fscache_n_store_vmscan_busy);
43035 + fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
43036 return false;
43037 }
43038 EXPORT_SYMBOL(__fscache_maybe_release_page);
43039 @@ -131,7 +131,7 @@ static void fscache_end_page_write(struc
43040 FSCACHE_COOKIE_STORING_TAG);
43041 if (!radix_tree_tag_get(&cookie->stores, page->index,
43042 FSCACHE_COOKIE_PENDING_TAG)) {
43043 - fscache_stat(&fscache_n_store_radix_deletes);
43044 + fscache_stat_unchecked(&fscache_n_store_radix_deletes);
43045 xpage = radix_tree_delete(&cookie->stores, page->index);
43046 }
43047 spin_unlock(&cookie->stores_lock);
43048 @@ -152,7 +152,7 @@ static void fscache_attr_changed_op(stru
43049
43050 _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
43051
43052 - fscache_stat(&fscache_n_attr_changed_calls);
43053 + fscache_stat_unchecked(&fscache_n_attr_changed_calls);
43054
43055 if (fscache_object_is_active(object)) {
43056 fscache_stat(&fscache_n_cop_attr_changed);
43057 @@ -177,11 +177,11 @@ int __fscache_attr_changed(struct fscach
43058
43059 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
43060
43061 - fscache_stat(&fscache_n_attr_changed);
43062 + fscache_stat_unchecked(&fscache_n_attr_changed);
43063
43064 op = kzalloc(sizeof(*op), GFP_KERNEL);
43065 if (!op) {
43066 - fscache_stat(&fscache_n_attr_changed_nomem);
43067 + fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
43068 _leave(" = -ENOMEM");
43069 return -ENOMEM;
43070 }
43071 @@ -199,7 +199,7 @@ int __fscache_attr_changed(struct fscach
43072 if (fscache_submit_exclusive_op(object, op) < 0)
43073 goto nobufs;
43074 spin_unlock(&cookie->lock);
43075 - fscache_stat(&fscache_n_attr_changed_ok);
43076 + fscache_stat_unchecked(&fscache_n_attr_changed_ok);
43077 fscache_put_operation(op);
43078 _leave(" = 0");
43079 return 0;
43080 @@ -207,7 +207,7 @@ int __fscache_attr_changed(struct fscach
43081 nobufs:
43082 spin_unlock(&cookie->lock);
43083 kfree(op);
43084 - fscache_stat(&fscache_n_attr_changed_nobufs);
43085 + fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
43086 _leave(" = %d", -ENOBUFS);
43087 return -ENOBUFS;
43088 }
43089 @@ -243,7 +243,7 @@ static struct fscache_retrieval *fscache
43090 /* allocate a retrieval operation and attempt to submit it */
43091 op = kzalloc(sizeof(*op), GFP_NOIO);
43092 if (!op) {
43093 - fscache_stat(&fscache_n_retrievals_nomem);
43094 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
43095 return NULL;
43096 }
43097
43098 @@ -271,13 +271,13 @@ static int fscache_wait_for_deferred_loo
43099 return 0;
43100 }
43101
43102 - fscache_stat(&fscache_n_retrievals_wait);
43103 + fscache_stat_unchecked(&fscache_n_retrievals_wait);
43104
43105 jif = jiffies;
43106 if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
43107 fscache_wait_bit_interruptible,
43108 TASK_INTERRUPTIBLE) != 0) {
43109 - fscache_stat(&fscache_n_retrievals_intr);
43110 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
43111 _leave(" = -ERESTARTSYS");
43112 return -ERESTARTSYS;
43113 }
43114 @@ -295,8 +295,8 @@ static int fscache_wait_for_deferred_loo
43115 */
43116 static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
43117 struct fscache_retrieval *op,
43118 - atomic_t *stat_op_waits,
43119 - atomic_t *stat_object_dead)
43120 + atomic_unchecked_t *stat_op_waits,
43121 + atomic_unchecked_t *stat_object_dead)
43122 {
43123 int ret;
43124
43125 @@ -304,7 +304,7 @@ static int fscache_wait_for_retrieval_ac
43126 goto check_if_dead;
43127
43128 _debug(">>> WT");
43129 - fscache_stat(stat_op_waits);
43130 + fscache_stat_unchecked(stat_op_waits);
43131 if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
43132 fscache_wait_bit_interruptible,
43133 TASK_INTERRUPTIBLE) < 0) {
43134 @@ -321,7 +321,7 @@ static int fscache_wait_for_retrieval_ac
43135
43136 check_if_dead:
43137 if (unlikely(fscache_object_is_dead(object))) {
43138 - fscache_stat(stat_object_dead);
43139 + fscache_stat_unchecked(stat_object_dead);
43140 return -ENOBUFS;
43141 }
43142 return 0;
43143 @@ -348,7 +348,7 @@ int __fscache_read_or_alloc_page(struct
43144
43145 _enter("%p,%p,,,", cookie, page);
43146
43147 - fscache_stat(&fscache_n_retrievals);
43148 + fscache_stat_unchecked(&fscache_n_retrievals);
43149
43150 if (hlist_empty(&cookie->backing_objects))
43151 goto nobufs;
43152 @@ -381,7 +381,7 @@ int __fscache_read_or_alloc_page(struct
43153 goto nobufs_unlock;
43154 spin_unlock(&cookie->lock);
43155
43156 - fscache_stat(&fscache_n_retrieval_ops);
43157 + fscache_stat_unchecked(&fscache_n_retrieval_ops);
43158
43159 /* pin the netfs read context in case we need to do the actual netfs
43160 * read because we've encountered a cache read failure */
43161 @@ -411,15 +411,15 @@ int __fscache_read_or_alloc_page(struct
43162
43163 error:
43164 if (ret == -ENOMEM)
43165 - fscache_stat(&fscache_n_retrievals_nomem);
43166 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
43167 else if (ret == -ERESTARTSYS)
43168 - fscache_stat(&fscache_n_retrievals_intr);
43169 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
43170 else if (ret == -ENODATA)
43171 - fscache_stat(&fscache_n_retrievals_nodata);
43172 + fscache_stat_unchecked(&fscache_n_retrievals_nodata);
43173 else if (ret < 0)
43174 - fscache_stat(&fscache_n_retrievals_nobufs);
43175 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
43176 else
43177 - fscache_stat(&fscache_n_retrievals_ok);
43178 + fscache_stat_unchecked(&fscache_n_retrievals_ok);
43179
43180 fscache_put_retrieval(op);
43181 _leave(" = %d", ret);
43182 @@ -429,7 +429,7 @@ nobufs_unlock:
43183 spin_unlock(&cookie->lock);
43184 kfree(op);
43185 nobufs:
43186 - fscache_stat(&fscache_n_retrievals_nobufs);
43187 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
43188 _leave(" = -ENOBUFS");
43189 return -ENOBUFS;
43190 }
43191 @@ -467,7 +467,7 @@ int __fscache_read_or_alloc_pages(struct
43192
43193 _enter("%p,,%d,,,", cookie, *nr_pages);
43194
43195 - fscache_stat(&fscache_n_retrievals);
43196 + fscache_stat_unchecked(&fscache_n_retrievals);
43197
43198 if (hlist_empty(&cookie->backing_objects))
43199 goto nobufs;
43200 @@ -497,7 +497,7 @@ int __fscache_read_or_alloc_pages(struct
43201 goto nobufs_unlock;
43202 spin_unlock(&cookie->lock);
43203
43204 - fscache_stat(&fscache_n_retrieval_ops);
43205 + fscache_stat_unchecked(&fscache_n_retrieval_ops);
43206
43207 /* pin the netfs read context in case we need to do the actual netfs
43208 * read because we've encountered a cache read failure */
43209 @@ -527,15 +527,15 @@ int __fscache_read_or_alloc_pages(struct
43210
43211 error:
43212 if (ret == -ENOMEM)
43213 - fscache_stat(&fscache_n_retrievals_nomem);
43214 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
43215 else if (ret == -ERESTARTSYS)
43216 - fscache_stat(&fscache_n_retrievals_intr);
43217 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
43218 else if (ret == -ENODATA)
43219 - fscache_stat(&fscache_n_retrievals_nodata);
43220 + fscache_stat_unchecked(&fscache_n_retrievals_nodata);
43221 else if (ret < 0)
43222 - fscache_stat(&fscache_n_retrievals_nobufs);
43223 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
43224 else
43225 - fscache_stat(&fscache_n_retrievals_ok);
43226 + fscache_stat_unchecked(&fscache_n_retrievals_ok);
43227
43228 fscache_put_retrieval(op);
43229 _leave(" = %d", ret);
43230 @@ -545,7 +545,7 @@ nobufs_unlock:
43231 spin_unlock(&cookie->lock);
43232 kfree(op);
43233 nobufs:
43234 - fscache_stat(&fscache_n_retrievals_nobufs);
43235 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
43236 _leave(" = -ENOBUFS");
43237 return -ENOBUFS;
43238 }
43239 @@ -569,7 +569,7 @@ int __fscache_alloc_page(struct fscache_
43240
43241 _enter("%p,%p,,,", cookie, page);
43242
43243 - fscache_stat(&fscache_n_allocs);
43244 + fscache_stat_unchecked(&fscache_n_allocs);
43245
43246 if (hlist_empty(&cookie->backing_objects))
43247 goto nobufs;
43248 @@ -595,7 +595,7 @@ int __fscache_alloc_page(struct fscache_
43249 goto nobufs_unlock;
43250 spin_unlock(&cookie->lock);
43251
43252 - fscache_stat(&fscache_n_alloc_ops);
43253 + fscache_stat_unchecked(&fscache_n_alloc_ops);
43254
43255 ret = fscache_wait_for_retrieval_activation(
43256 object, op,
43257 @@ -611,11 +611,11 @@ int __fscache_alloc_page(struct fscache_
43258
43259 error:
43260 if (ret == -ERESTARTSYS)
43261 - fscache_stat(&fscache_n_allocs_intr);
43262 + fscache_stat_unchecked(&fscache_n_allocs_intr);
43263 else if (ret < 0)
43264 - fscache_stat(&fscache_n_allocs_nobufs);
43265 + fscache_stat_unchecked(&fscache_n_allocs_nobufs);
43266 else
43267 - fscache_stat(&fscache_n_allocs_ok);
43268 + fscache_stat_unchecked(&fscache_n_allocs_ok);
43269
43270 fscache_put_retrieval(op);
43271 _leave(" = %d", ret);
43272 @@ -625,7 +625,7 @@ nobufs_unlock:
43273 spin_unlock(&cookie->lock);
43274 kfree(op);
43275 nobufs:
43276 - fscache_stat(&fscache_n_allocs_nobufs);
43277 + fscache_stat_unchecked(&fscache_n_allocs_nobufs);
43278 _leave(" = -ENOBUFS");
43279 return -ENOBUFS;
43280 }
43281 @@ -666,7 +666,7 @@ static void fscache_write_op(struct fsca
43282
43283 spin_lock(&cookie->stores_lock);
43284
43285 - fscache_stat(&fscache_n_store_calls);
43286 + fscache_stat_unchecked(&fscache_n_store_calls);
43287
43288 /* find a page to store */
43289 page = NULL;
43290 @@ -677,7 +677,7 @@ static void fscache_write_op(struct fsca
43291 page = results[0];
43292 _debug("gang %d [%lx]", n, page->index);
43293 if (page->index > op->store_limit) {
43294 - fscache_stat(&fscache_n_store_pages_over_limit);
43295 + fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
43296 goto superseded;
43297 }
43298
43299 @@ -689,7 +689,7 @@ static void fscache_write_op(struct fsca
43300 spin_unlock(&cookie->stores_lock);
43301 spin_unlock(&object->lock);
43302
43303 - fscache_stat(&fscache_n_store_pages);
43304 + fscache_stat_unchecked(&fscache_n_store_pages);
43305 fscache_stat(&fscache_n_cop_write_page);
43306 ret = object->cache->ops->write_page(op, page);
43307 fscache_stat_d(&fscache_n_cop_write_page);
43308 @@ -757,7 +757,7 @@ int __fscache_write_page(struct fscache_
43309 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
43310 ASSERT(PageFsCache(page));
43311
43312 - fscache_stat(&fscache_n_stores);
43313 + fscache_stat_unchecked(&fscache_n_stores);
43314
43315 op = kzalloc(sizeof(*op), GFP_NOIO);
43316 if (!op)
43317 @@ -808,7 +808,7 @@ int __fscache_write_page(struct fscache_
43318 spin_unlock(&cookie->stores_lock);
43319 spin_unlock(&object->lock);
43320
43321 - op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
43322 + op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
43323 op->store_limit = object->store_limit;
43324
43325 if (fscache_submit_op(object, &op->op) < 0)
43326 @@ -816,8 +816,8 @@ int __fscache_write_page(struct fscache_
43327
43328 spin_unlock(&cookie->lock);
43329 radix_tree_preload_end();
43330 - fscache_stat(&fscache_n_store_ops);
43331 - fscache_stat(&fscache_n_stores_ok);
43332 + fscache_stat_unchecked(&fscache_n_store_ops);
43333 + fscache_stat_unchecked(&fscache_n_stores_ok);
43334
43335 /* the work queue now carries its own ref on the object */
43336 fscache_put_operation(&op->op);
43337 @@ -825,14 +825,14 @@ int __fscache_write_page(struct fscache_
43338 return 0;
43339
43340 already_queued:
43341 - fscache_stat(&fscache_n_stores_again);
43342 + fscache_stat_unchecked(&fscache_n_stores_again);
43343 already_pending:
43344 spin_unlock(&cookie->stores_lock);
43345 spin_unlock(&object->lock);
43346 spin_unlock(&cookie->lock);
43347 radix_tree_preload_end();
43348 kfree(op);
43349 - fscache_stat(&fscache_n_stores_ok);
43350 + fscache_stat_unchecked(&fscache_n_stores_ok);
43351 _leave(" = 0");
43352 return 0;
43353
43354 @@ -851,14 +851,14 @@ nobufs:
43355 spin_unlock(&cookie->lock);
43356 radix_tree_preload_end();
43357 kfree(op);
43358 - fscache_stat(&fscache_n_stores_nobufs);
43359 + fscache_stat_unchecked(&fscache_n_stores_nobufs);
43360 _leave(" = -ENOBUFS");
43361 return -ENOBUFS;
43362
43363 nomem_free:
43364 kfree(op);
43365 nomem:
43366 - fscache_stat(&fscache_n_stores_oom);
43367 + fscache_stat_unchecked(&fscache_n_stores_oom);
43368 _leave(" = -ENOMEM");
43369 return -ENOMEM;
43370 }
43371 @@ -876,7 +876,7 @@ void __fscache_uncache_page(struct fscac
43372 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
43373 ASSERTCMP(page, !=, NULL);
43374
43375 - fscache_stat(&fscache_n_uncaches);
43376 + fscache_stat_unchecked(&fscache_n_uncaches);
43377
43378 /* cache withdrawal may beat us to it */
43379 if (!PageFsCache(page))
43380 @@ -929,7 +929,7 @@ void fscache_mark_pages_cached(struct fs
43381 unsigned long loop;
43382
43383 #ifdef CONFIG_FSCACHE_STATS
43384 - atomic_add(pagevec->nr, &fscache_n_marks);
43385 + atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
43386 #endif
43387
43388 for (loop = 0; loop < pagevec->nr; loop++) {
43389 diff -urNp linux-3.0.8/fs/fscache/stats.c linux-3.0.8/fs/fscache/stats.c
43390 --- linux-3.0.8/fs/fscache/stats.c 2011-07-21 22:17:23.000000000 -0400
43391 +++ linux-3.0.8/fs/fscache/stats.c 2011-08-23 21:47:56.000000000 -0400
43392 @@ -18,95 +18,95 @@
43393 /*
43394 * operation counters
43395 */
43396 -atomic_t fscache_n_op_pend;
43397 -atomic_t fscache_n_op_run;
43398 -atomic_t fscache_n_op_enqueue;
43399 -atomic_t fscache_n_op_requeue;
43400 -atomic_t fscache_n_op_deferred_release;
43401 -atomic_t fscache_n_op_release;
43402 -atomic_t fscache_n_op_gc;
43403 -atomic_t fscache_n_op_cancelled;
43404 -atomic_t fscache_n_op_rejected;
43405 -
43406 -atomic_t fscache_n_attr_changed;
43407 -atomic_t fscache_n_attr_changed_ok;
43408 -atomic_t fscache_n_attr_changed_nobufs;
43409 -atomic_t fscache_n_attr_changed_nomem;
43410 -atomic_t fscache_n_attr_changed_calls;
43411 -
43412 -atomic_t fscache_n_allocs;
43413 -atomic_t fscache_n_allocs_ok;
43414 -atomic_t fscache_n_allocs_wait;
43415 -atomic_t fscache_n_allocs_nobufs;
43416 -atomic_t fscache_n_allocs_intr;
43417 -atomic_t fscache_n_allocs_object_dead;
43418 -atomic_t fscache_n_alloc_ops;
43419 -atomic_t fscache_n_alloc_op_waits;
43420 -
43421 -atomic_t fscache_n_retrievals;
43422 -atomic_t fscache_n_retrievals_ok;
43423 -atomic_t fscache_n_retrievals_wait;
43424 -atomic_t fscache_n_retrievals_nodata;
43425 -atomic_t fscache_n_retrievals_nobufs;
43426 -atomic_t fscache_n_retrievals_intr;
43427 -atomic_t fscache_n_retrievals_nomem;
43428 -atomic_t fscache_n_retrievals_object_dead;
43429 -atomic_t fscache_n_retrieval_ops;
43430 -atomic_t fscache_n_retrieval_op_waits;
43431 -
43432 -atomic_t fscache_n_stores;
43433 -atomic_t fscache_n_stores_ok;
43434 -atomic_t fscache_n_stores_again;
43435 -atomic_t fscache_n_stores_nobufs;
43436 -atomic_t fscache_n_stores_oom;
43437 -atomic_t fscache_n_store_ops;
43438 -atomic_t fscache_n_store_calls;
43439 -atomic_t fscache_n_store_pages;
43440 -atomic_t fscache_n_store_radix_deletes;
43441 -atomic_t fscache_n_store_pages_over_limit;
43442 -
43443 -atomic_t fscache_n_store_vmscan_not_storing;
43444 -atomic_t fscache_n_store_vmscan_gone;
43445 -atomic_t fscache_n_store_vmscan_busy;
43446 -atomic_t fscache_n_store_vmscan_cancelled;
43447 -
43448 -atomic_t fscache_n_marks;
43449 -atomic_t fscache_n_uncaches;
43450 -
43451 -atomic_t fscache_n_acquires;
43452 -atomic_t fscache_n_acquires_null;
43453 -atomic_t fscache_n_acquires_no_cache;
43454 -atomic_t fscache_n_acquires_ok;
43455 -atomic_t fscache_n_acquires_nobufs;
43456 -atomic_t fscache_n_acquires_oom;
43457 -
43458 -atomic_t fscache_n_updates;
43459 -atomic_t fscache_n_updates_null;
43460 -atomic_t fscache_n_updates_run;
43461 -
43462 -atomic_t fscache_n_relinquishes;
43463 -atomic_t fscache_n_relinquishes_null;
43464 -atomic_t fscache_n_relinquishes_waitcrt;
43465 -atomic_t fscache_n_relinquishes_retire;
43466 -
43467 -atomic_t fscache_n_cookie_index;
43468 -atomic_t fscache_n_cookie_data;
43469 -atomic_t fscache_n_cookie_special;
43470 -
43471 -atomic_t fscache_n_object_alloc;
43472 -atomic_t fscache_n_object_no_alloc;
43473 -atomic_t fscache_n_object_lookups;
43474 -atomic_t fscache_n_object_lookups_negative;
43475 -atomic_t fscache_n_object_lookups_positive;
43476 -atomic_t fscache_n_object_lookups_timed_out;
43477 -atomic_t fscache_n_object_created;
43478 -atomic_t fscache_n_object_avail;
43479 -atomic_t fscache_n_object_dead;
43480 -
43481 -atomic_t fscache_n_checkaux_none;
43482 -atomic_t fscache_n_checkaux_okay;
43483 -atomic_t fscache_n_checkaux_update;
43484 -atomic_t fscache_n_checkaux_obsolete;
43485 +atomic_unchecked_t fscache_n_op_pend;
43486 +atomic_unchecked_t fscache_n_op_run;
43487 +atomic_unchecked_t fscache_n_op_enqueue;
43488 +atomic_unchecked_t fscache_n_op_requeue;
43489 +atomic_unchecked_t fscache_n_op_deferred_release;
43490 +atomic_unchecked_t fscache_n_op_release;
43491 +atomic_unchecked_t fscache_n_op_gc;
43492 +atomic_unchecked_t fscache_n_op_cancelled;
43493 +atomic_unchecked_t fscache_n_op_rejected;
43494 +
43495 +atomic_unchecked_t fscache_n_attr_changed;
43496 +atomic_unchecked_t fscache_n_attr_changed_ok;
43497 +atomic_unchecked_t fscache_n_attr_changed_nobufs;
43498 +atomic_unchecked_t fscache_n_attr_changed_nomem;
43499 +atomic_unchecked_t fscache_n_attr_changed_calls;
43500 +
43501 +atomic_unchecked_t fscache_n_allocs;
43502 +atomic_unchecked_t fscache_n_allocs_ok;
43503 +atomic_unchecked_t fscache_n_allocs_wait;
43504 +atomic_unchecked_t fscache_n_allocs_nobufs;
43505 +atomic_unchecked_t fscache_n_allocs_intr;
43506 +atomic_unchecked_t fscache_n_allocs_object_dead;
43507 +atomic_unchecked_t fscache_n_alloc_ops;
43508 +atomic_unchecked_t fscache_n_alloc_op_waits;
43509 +
43510 +atomic_unchecked_t fscache_n_retrievals;
43511 +atomic_unchecked_t fscache_n_retrievals_ok;
43512 +atomic_unchecked_t fscache_n_retrievals_wait;
43513 +atomic_unchecked_t fscache_n_retrievals_nodata;
43514 +atomic_unchecked_t fscache_n_retrievals_nobufs;
43515 +atomic_unchecked_t fscache_n_retrievals_intr;
43516 +atomic_unchecked_t fscache_n_retrievals_nomem;
43517 +atomic_unchecked_t fscache_n_retrievals_object_dead;
43518 +atomic_unchecked_t fscache_n_retrieval_ops;
43519 +atomic_unchecked_t fscache_n_retrieval_op_waits;
43520 +
43521 +atomic_unchecked_t fscache_n_stores;
43522 +atomic_unchecked_t fscache_n_stores_ok;
43523 +atomic_unchecked_t fscache_n_stores_again;
43524 +atomic_unchecked_t fscache_n_stores_nobufs;
43525 +atomic_unchecked_t fscache_n_stores_oom;
43526 +atomic_unchecked_t fscache_n_store_ops;
43527 +atomic_unchecked_t fscache_n_store_calls;
43528 +atomic_unchecked_t fscache_n_store_pages;
43529 +atomic_unchecked_t fscache_n_store_radix_deletes;
43530 +atomic_unchecked_t fscache_n_store_pages_over_limit;
43531 +
43532 +atomic_unchecked_t fscache_n_store_vmscan_not_storing;
43533 +atomic_unchecked_t fscache_n_store_vmscan_gone;
43534 +atomic_unchecked_t fscache_n_store_vmscan_busy;
43535 +atomic_unchecked_t fscache_n_store_vmscan_cancelled;
43536 +
43537 +atomic_unchecked_t fscache_n_marks;
43538 +atomic_unchecked_t fscache_n_uncaches;
43539 +
43540 +atomic_unchecked_t fscache_n_acquires;
43541 +atomic_unchecked_t fscache_n_acquires_null;
43542 +atomic_unchecked_t fscache_n_acquires_no_cache;
43543 +atomic_unchecked_t fscache_n_acquires_ok;
43544 +atomic_unchecked_t fscache_n_acquires_nobufs;
43545 +atomic_unchecked_t fscache_n_acquires_oom;
43546 +
43547 +atomic_unchecked_t fscache_n_updates;
43548 +atomic_unchecked_t fscache_n_updates_null;
43549 +atomic_unchecked_t fscache_n_updates_run;
43550 +
43551 +atomic_unchecked_t fscache_n_relinquishes;
43552 +atomic_unchecked_t fscache_n_relinquishes_null;
43553 +atomic_unchecked_t fscache_n_relinquishes_waitcrt;
43554 +atomic_unchecked_t fscache_n_relinquishes_retire;
43555 +
43556 +atomic_unchecked_t fscache_n_cookie_index;
43557 +atomic_unchecked_t fscache_n_cookie_data;
43558 +atomic_unchecked_t fscache_n_cookie_special;
43559 +
43560 +atomic_unchecked_t fscache_n_object_alloc;
43561 +atomic_unchecked_t fscache_n_object_no_alloc;
43562 +atomic_unchecked_t fscache_n_object_lookups;
43563 +atomic_unchecked_t fscache_n_object_lookups_negative;
43564 +atomic_unchecked_t fscache_n_object_lookups_positive;
43565 +atomic_unchecked_t fscache_n_object_lookups_timed_out;
43566 +atomic_unchecked_t fscache_n_object_created;
43567 +atomic_unchecked_t fscache_n_object_avail;
43568 +atomic_unchecked_t fscache_n_object_dead;
43569 +
43570 +atomic_unchecked_t fscache_n_checkaux_none;
43571 +atomic_unchecked_t fscache_n_checkaux_okay;
43572 +atomic_unchecked_t fscache_n_checkaux_update;
43573 +atomic_unchecked_t fscache_n_checkaux_obsolete;
43574
43575 atomic_t fscache_n_cop_alloc_object;
43576 atomic_t fscache_n_cop_lookup_object;
43577 @@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq
43578 seq_puts(m, "FS-Cache statistics\n");
43579
43580 seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
43581 - atomic_read(&fscache_n_cookie_index),
43582 - atomic_read(&fscache_n_cookie_data),
43583 - atomic_read(&fscache_n_cookie_special));
43584 + atomic_read_unchecked(&fscache_n_cookie_index),
43585 + atomic_read_unchecked(&fscache_n_cookie_data),
43586 + atomic_read_unchecked(&fscache_n_cookie_special));
43587
43588 seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
43589 - atomic_read(&fscache_n_object_alloc),
43590 - atomic_read(&fscache_n_object_no_alloc),
43591 - atomic_read(&fscache_n_object_avail),
43592 - atomic_read(&fscache_n_object_dead));
43593 + atomic_read_unchecked(&fscache_n_object_alloc),
43594 + atomic_read_unchecked(&fscache_n_object_no_alloc),
43595 + atomic_read_unchecked(&fscache_n_object_avail),
43596 + atomic_read_unchecked(&fscache_n_object_dead));
43597 seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
43598 - atomic_read(&fscache_n_checkaux_none),
43599 - atomic_read(&fscache_n_checkaux_okay),
43600 - atomic_read(&fscache_n_checkaux_update),
43601 - atomic_read(&fscache_n_checkaux_obsolete));
43602 + atomic_read_unchecked(&fscache_n_checkaux_none),
43603 + atomic_read_unchecked(&fscache_n_checkaux_okay),
43604 + atomic_read_unchecked(&fscache_n_checkaux_update),
43605 + atomic_read_unchecked(&fscache_n_checkaux_obsolete));
43606
43607 seq_printf(m, "Pages : mrk=%u unc=%u\n",
43608 - atomic_read(&fscache_n_marks),
43609 - atomic_read(&fscache_n_uncaches));
43610 + atomic_read_unchecked(&fscache_n_marks),
43611 + atomic_read_unchecked(&fscache_n_uncaches));
43612
43613 seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
43614 " oom=%u\n",
43615 - atomic_read(&fscache_n_acquires),
43616 - atomic_read(&fscache_n_acquires_null),
43617 - atomic_read(&fscache_n_acquires_no_cache),
43618 - atomic_read(&fscache_n_acquires_ok),
43619 - atomic_read(&fscache_n_acquires_nobufs),
43620 - atomic_read(&fscache_n_acquires_oom));
43621 + atomic_read_unchecked(&fscache_n_acquires),
43622 + atomic_read_unchecked(&fscache_n_acquires_null),
43623 + atomic_read_unchecked(&fscache_n_acquires_no_cache),
43624 + atomic_read_unchecked(&fscache_n_acquires_ok),
43625 + atomic_read_unchecked(&fscache_n_acquires_nobufs),
43626 + atomic_read_unchecked(&fscache_n_acquires_oom));
43627
43628 seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
43629 - atomic_read(&fscache_n_object_lookups),
43630 - atomic_read(&fscache_n_object_lookups_negative),
43631 - atomic_read(&fscache_n_object_lookups_positive),
43632 - atomic_read(&fscache_n_object_created),
43633 - atomic_read(&fscache_n_object_lookups_timed_out));
43634 + atomic_read_unchecked(&fscache_n_object_lookups),
43635 + atomic_read_unchecked(&fscache_n_object_lookups_negative),
43636 + atomic_read_unchecked(&fscache_n_object_lookups_positive),
43637 + atomic_read_unchecked(&fscache_n_object_created),
43638 + atomic_read_unchecked(&fscache_n_object_lookups_timed_out));
43639
43640 seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
43641 - atomic_read(&fscache_n_updates),
43642 - atomic_read(&fscache_n_updates_null),
43643 - atomic_read(&fscache_n_updates_run));
43644 + atomic_read_unchecked(&fscache_n_updates),
43645 + atomic_read_unchecked(&fscache_n_updates_null),
43646 + atomic_read_unchecked(&fscache_n_updates_run));
43647
43648 seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
43649 - atomic_read(&fscache_n_relinquishes),
43650 - atomic_read(&fscache_n_relinquishes_null),
43651 - atomic_read(&fscache_n_relinquishes_waitcrt),
43652 - atomic_read(&fscache_n_relinquishes_retire));
43653 + atomic_read_unchecked(&fscache_n_relinquishes),
43654 + atomic_read_unchecked(&fscache_n_relinquishes_null),
43655 + atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
43656 + atomic_read_unchecked(&fscache_n_relinquishes_retire));
43657
43658 seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
43659 - atomic_read(&fscache_n_attr_changed),
43660 - atomic_read(&fscache_n_attr_changed_ok),
43661 - atomic_read(&fscache_n_attr_changed_nobufs),
43662 - atomic_read(&fscache_n_attr_changed_nomem),
43663 - atomic_read(&fscache_n_attr_changed_calls));
43664 + atomic_read_unchecked(&fscache_n_attr_changed),
43665 + atomic_read_unchecked(&fscache_n_attr_changed_ok),
43666 + atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
43667 + atomic_read_unchecked(&fscache_n_attr_changed_nomem),
43668 + atomic_read_unchecked(&fscache_n_attr_changed_calls));
43669
43670 seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
43671 - atomic_read(&fscache_n_allocs),
43672 - atomic_read(&fscache_n_allocs_ok),
43673 - atomic_read(&fscache_n_allocs_wait),
43674 - atomic_read(&fscache_n_allocs_nobufs),
43675 - atomic_read(&fscache_n_allocs_intr));
43676 + atomic_read_unchecked(&fscache_n_allocs),
43677 + atomic_read_unchecked(&fscache_n_allocs_ok),
43678 + atomic_read_unchecked(&fscache_n_allocs_wait),
43679 + atomic_read_unchecked(&fscache_n_allocs_nobufs),
43680 + atomic_read_unchecked(&fscache_n_allocs_intr));
43681 seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
43682 - atomic_read(&fscache_n_alloc_ops),
43683 - atomic_read(&fscache_n_alloc_op_waits),
43684 - atomic_read(&fscache_n_allocs_object_dead));
43685 + atomic_read_unchecked(&fscache_n_alloc_ops),
43686 + atomic_read_unchecked(&fscache_n_alloc_op_waits),
43687 + atomic_read_unchecked(&fscache_n_allocs_object_dead));
43688
43689 seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
43690 " int=%u oom=%u\n",
43691 - atomic_read(&fscache_n_retrievals),
43692 - atomic_read(&fscache_n_retrievals_ok),
43693 - atomic_read(&fscache_n_retrievals_wait),
43694 - atomic_read(&fscache_n_retrievals_nodata),
43695 - atomic_read(&fscache_n_retrievals_nobufs),
43696 - atomic_read(&fscache_n_retrievals_intr),
43697 - atomic_read(&fscache_n_retrievals_nomem));
43698 + atomic_read_unchecked(&fscache_n_retrievals),
43699 + atomic_read_unchecked(&fscache_n_retrievals_ok),
43700 + atomic_read_unchecked(&fscache_n_retrievals_wait),
43701 + atomic_read_unchecked(&fscache_n_retrievals_nodata),
43702 + atomic_read_unchecked(&fscache_n_retrievals_nobufs),
43703 + atomic_read_unchecked(&fscache_n_retrievals_intr),
43704 + atomic_read_unchecked(&fscache_n_retrievals_nomem));
43705 seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
43706 - atomic_read(&fscache_n_retrieval_ops),
43707 - atomic_read(&fscache_n_retrieval_op_waits),
43708 - atomic_read(&fscache_n_retrievals_object_dead));
43709 + atomic_read_unchecked(&fscache_n_retrieval_ops),
43710 + atomic_read_unchecked(&fscache_n_retrieval_op_waits),
43711 + atomic_read_unchecked(&fscache_n_retrievals_object_dead));
43712
43713 seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
43714 - atomic_read(&fscache_n_stores),
43715 - atomic_read(&fscache_n_stores_ok),
43716 - atomic_read(&fscache_n_stores_again),
43717 - atomic_read(&fscache_n_stores_nobufs),
43718 - atomic_read(&fscache_n_stores_oom));
43719 + atomic_read_unchecked(&fscache_n_stores),
43720 + atomic_read_unchecked(&fscache_n_stores_ok),
43721 + atomic_read_unchecked(&fscache_n_stores_again),
43722 + atomic_read_unchecked(&fscache_n_stores_nobufs),
43723 + atomic_read_unchecked(&fscache_n_stores_oom));
43724 seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
43725 - atomic_read(&fscache_n_store_ops),
43726 - atomic_read(&fscache_n_store_calls),
43727 - atomic_read(&fscache_n_store_pages),
43728 - atomic_read(&fscache_n_store_radix_deletes),
43729 - atomic_read(&fscache_n_store_pages_over_limit));
43730 + atomic_read_unchecked(&fscache_n_store_ops),
43731 + atomic_read_unchecked(&fscache_n_store_calls),
43732 + atomic_read_unchecked(&fscache_n_store_pages),
43733 + atomic_read_unchecked(&fscache_n_store_radix_deletes),
43734 + atomic_read_unchecked(&fscache_n_store_pages_over_limit));
43735
43736 seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
43737 - atomic_read(&fscache_n_store_vmscan_not_storing),
43738 - atomic_read(&fscache_n_store_vmscan_gone),
43739 - atomic_read(&fscache_n_store_vmscan_busy),
43740 - atomic_read(&fscache_n_store_vmscan_cancelled));
43741 + atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
43742 + atomic_read_unchecked(&fscache_n_store_vmscan_gone),
43743 + atomic_read_unchecked(&fscache_n_store_vmscan_busy),
43744 + atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
43745
43746 seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
43747 - atomic_read(&fscache_n_op_pend),
43748 - atomic_read(&fscache_n_op_run),
43749 - atomic_read(&fscache_n_op_enqueue),
43750 - atomic_read(&fscache_n_op_cancelled),
43751 - atomic_read(&fscache_n_op_rejected));
43752 + atomic_read_unchecked(&fscache_n_op_pend),
43753 + atomic_read_unchecked(&fscache_n_op_run),
43754 + atomic_read_unchecked(&fscache_n_op_enqueue),
43755 + atomic_read_unchecked(&fscache_n_op_cancelled),
43756 + atomic_read_unchecked(&fscache_n_op_rejected));
43757 seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
43758 - atomic_read(&fscache_n_op_deferred_release),
43759 - atomic_read(&fscache_n_op_release),
43760 - atomic_read(&fscache_n_op_gc));
43761 + atomic_read_unchecked(&fscache_n_op_deferred_release),
43762 + atomic_read_unchecked(&fscache_n_op_release),
43763 + atomic_read_unchecked(&fscache_n_op_gc));
43764
43765 seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
43766 atomic_read(&fscache_n_cop_alloc_object),
43767 diff -urNp linux-3.0.8/fs/fs_struct.c linux-3.0.8/fs/fs_struct.c
43768 --- linux-3.0.8/fs/fs_struct.c 2011-07-21 22:17:23.000000000 -0400
43769 +++ linux-3.0.8/fs/fs_struct.c 2011-08-23 21:48:14.000000000 -0400
43770 @@ -4,6 +4,7 @@
43771 #include <linux/path.h>
43772 #include <linux/slab.h>
43773 #include <linux/fs_struct.h>
43774 +#include <linux/grsecurity.h>
43775 #include "internal.h"
43776
43777 static inline void path_get_longterm(struct path *path)
43778 @@ -31,6 +32,7 @@ void set_fs_root(struct fs_struct *fs, s
43779 old_root = fs->root;
43780 fs->root = *path;
43781 path_get_longterm(path);
43782 + gr_set_chroot_entries(current, path);
43783 write_seqcount_end(&fs->seq);
43784 spin_unlock(&fs->lock);
43785 if (old_root.dentry)
43786 @@ -74,6 +76,7 @@ void chroot_fs_refs(struct path *old_roo
43787 && fs->root.mnt == old_root->mnt) {
43788 path_get_longterm(new_root);
43789 fs->root = *new_root;
43790 + gr_set_chroot_entries(p, new_root);
43791 count++;
43792 }
43793 if (fs->pwd.dentry == old_root->dentry
43794 @@ -109,7 +112,8 @@ void exit_fs(struct task_struct *tsk)
43795 spin_lock(&fs->lock);
43796 write_seqcount_begin(&fs->seq);
43797 tsk->fs = NULL;
43798 - kill = !--fs->users;
43799 + gr_clear_chroot_entries(tsk);
43800 + kill = !atomic_dec_return(&fs->users);
43801 write_seqcount_end(&fs->seq);
43802 spin_unlock(&fs->lock);
43803 task_unlock(tsk);
43804 @@ -123,7 +127,7 @@ struct fs_struct *copy_fs_struct(struct
43805 struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
43806 /* We don't need to lock fs - think why ;-) */
43807 if (fs) {
43808 - fs->users = 1;
43809 + atomic_set(&fs->users, 1);
43810 fs->in_exec = 0;
43811 spin_lock_init(&fs->lock);
43812 seqcount_init(&fs->seq);
43813 @@ -132,6 +136,9 @@ struct fs_struct *copy_fs_struct(struct
43814 spin_lock(&old->lock);
43815 fs->root = old->root;
43816 path_get_longterm(&fs->root);
43817 + /* instead of calling gr_set_chroot_entries here,
43818 + we call it from every caller of this function
43819 + */
43820 fs->pwd = old->pwd;
43821 path_get_longterm(&fs->pwd);
43822 spin_unlock(&old->lock);
43823 @@ -150,8 +157,9 @@ int unshare_fs_struct(void)
43824
43825 task_lock(current);
43826 spin_lock(&fs->lock);
43827 - kill = !--fs->users;
43828 + kill = !atomic_dec_return(&fs->users);
43829 current->fs = new_fs;
43830 + gr_set_chroot_entries(current, &new_fs->root);
43831 spin_unlock(&fs->lock);
43832 task_unlock(current);
43833
43834 @@ -170,7 +178,7 @@ EXPORT_SYMBOL(current_umask);
43835
43836 /* to be mentioned only in INIT_TASK */
43837 struct fs_struct init_fs = {
43838 - .users = 1,
43839 + .users = ATOMIC_INIT(1),
43840 .lock = __SPIN_LOCK_UNLOCKED(init_fs.lock),
43841 .seq = SEQCNT_ZERO,
43842 .umask = 0022,
43843 @@ -186,12 +194,13 @@ void daemonize_fs_struct(void)
43844 task_lock(current);
43845
43846 spin_lock(&init_fs.lock);
43847 - init_fs.users++;
43848 + atomic_inc(&init_fs.users);
43849 spin_unlock(&init_fs.lock);
43850
43851 spin_lock(&fs->lock);
43852 current->fs = &init_fs;
43853 - kill = !--fs->users;
43854 + gr_set_chroot_entries(current, &current->fs->root);
43855 + kill = !atomic_dec_return(&fs->users);
43856 spin_unlock(&fs->lock);
43857
43858 task_unlock(current);
43859 diff -urNp linux-3.0.8/fs/fuse/cuse.c linux-3.0.8/fs/fuse/cuse.c
43860 --- linux-3.0.8/fs/fuse/cuse.c 2011-07-21 22:17:23.000000000 -0400
43861 +++ linux-3.0.8/fs/fuse/cuse.c 2011-08-23 21:47:56.000000000 -0400
43862 @@ -586,10 +586,12 @@ static int __init cuse_init(void)
43863 INIT_LIST_HEAD(&cuse_conntbl[i]);
43864
43865 /* inherit and extend fuse_dev_operations */
43866 - cuse_channel_fops = fuse_dev_operations;
43867 - cuse_channel_fops.owner = THIS_MODULE;
43868 - cuse_channel_fops.open = cuse_channel_open;
43869 - cuse_channel_fops.release = cuse_channel_release;
43870 + pax_open_kernel();
43871 + memcpy((void *)&cuse_channel_fops, &fuse_dev_operations, sizeof(fuse_dev_operations));
43872 + *(void **)&cuse_channel_fops.owner = THIS_MODULE;
43873 + *(void **)&cuse_channel_fops.open = cuse_channel_open;
43874 + *(void **)&cuse_channel_fops.release = cuse_channel_release;
43875 + pax_close_kernel();
43876
43877 cuse_class = class_create(THIS_MODULE, "cuse");
43878 if (IS_ERR(cuse_class))
43879 diff -urNp linux-3.0.8/fs/fuse/dev.c linux-3.0.8/fs/fuse/dev.c
43880 --- linux-3.0.8/fs/fuse/dev.c 2011-10-25 09:10:33.000000000 -0400
43881 +++ linux-3.0.8/fs/fuse/dev.c 2011-10-25 09:10:41.000000000 -0400
43882 @@ -1242,7 +1242,7 @@ static ssize_t fuse_dev_splice_read(stru
43883 ret = 0;
43884 pipe_lock(pipe);
43885
43886 - if (!pipe->readers) {
43887 + if (!atomic_read(&pipe->readers)) {
43888 send_sig(SIGPIPE, current, 0);
43889 if (!ret)
43890 ret = -EPIPE;
43891 diff -urNp linux-3.0.8/fs/fuse/dir.c linux-3.0.8/fs/fuse/dir.c
43892 --- linux-3.0.8/fs/fuse/dir.c 2011-07-21 22:17:23.000000000 -0400
43893 +++ linux-3.0.8/fs/fuse/dir.c 2011-08-23 21:47:56.000000000 -0400
43894 @@ -1148,7 +1148,7 @@ static char *read_link(struct dentry *de
43895 return link;
43896 }
43897
43898 -static void free_link(char *link)
43899 +static void free_link(const char *link)
43900 {
43901 if (!IS_ERR(link))
43902 free_page((unsigned long) link);
43903 diff -urNp linux-3.0.8/fs/gfs2/inode.c linux-3.0.8/fs/gfs2/inode.c
43904 --- linux-3.0.8/fs/gfs2/inode.c 2011-07-21 22:17:23.000000000 -0400
43905 +++ linux-3.0.8/fs/gfs2/inode.c 2011-08-23 21:47:56.000000000 -0400
43906 @@ -1525,7 +1525,7 @@ out:
43907
43908 static void gfs2_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
43909 {
43910 - char *s = nd_get_link(nd);
43911 + const char *s = nd_get_link(nd);
43912 if (!IS_ERR(s))
43913 kfree(s);
43914 }
43915 diff -urNp linux-3.0.8/fs/hfsplus/catalog.c linux-3.0.8/fs/hfsplus/catalog.c
43916 --- linux-3.0.8/fs/hfsplus/catalog.c 2011-07-21 22:17:23.000000000 -0400
43917 +++ linux-3.0.8/fs/hfsplus/catalog.c 2011-08-23 21:48:14.000000000 -0400
43918 @@ -179,6 +179,8 @@ int hfsplus_find_cat(struct super_block
43919 int err;
43920 u16 type;
43921
43922 + pax_track_stack();
43923 +
43924 hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
43925 err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
43926 if (err)
43927 @@ -210,6 +212,8 @@ int hfsplus_create_cat(u32 cnid, struct
43928 int entry_size;
43929 int err;
43930
43931 + pax_track_stack();
43932 +
43933 dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n",
43934 str->name, cnid, inode->i_nlink);
43935 hfs_find_init(HFSPLUS_SB(sb)->cat_tree, &fd);
43936 @@ -349,6 +353,8 @@ int hfsplus_rename_cat(u32 cnid,
43937 int entry_size, type;
43938 int err = 0;
43939
43940 + pax_track_stack();
43941 +
43942 dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n",
43943 cnid, src_dir->i_ino, src_name->name,
43944 dst_dir->i_ino, dst_name->name);
43945 diff -urNp linux-3.0.8/fs/hfsplus/dir.c linux-3.0.8/fs/hfsplus/dir.c
43946 --- linux-3.0.8/fs/hfsplus/dir.c 2011-07-21 22:17:23.000000000 -0400
43947 +++ linux-3.0.8/fs/hfsplus/dir.c 2011-08-23 21:48:14.000000000 -0400
43948 @@ -129,6 +129,8 @@ static int hfsplus_readdir(struct file *
43949 struct hfsplus_readdir_data *rd;
43950 u16 type;
43951
43952 + pax_track_stack();
43953 +
43954 if (filp->f_pos >= inode->i_size)
43955 return 0;
43956
43957 diff -urNp linux-3.0.8/fs/hfsplus/inode.c linux-3.0.8/fs/hfsplus/inode.c
43958 --- linux-3.0.8/fs/hfsplus/inode.c 2011-07-21 22:17:23.000000000 -0400
43959 +++ linux-3.0.8/fs/hfsplus/inode.c 2011-08-23 21:48:14.000000000 -0400
43960 @@ -489,6 +489,8 @@ int hfsplus_cat_read_inode(struct inode
43961 int res = 0;
43962 u16 type;
43963
43964 + pax_track_stack();
43965 +
43966 type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
43967
43968 HFSPLUS_I(inode)->linkid = 0;
43969 @@ -552,6 +554,8 @@ int hfsplus_cat_write_inode(struct inode
43970 struct hfs_find_data fd;
43971 hfsplus_cat_entry entry;
43972
43973 + pax_track_stack();
43974 +
43975 if (HFSPLUS_IS_RSRC(inode))
43976 main_inode = HFSPLUS_I(inode)->rsrc_inode;
43977
43978 diff -urNp linux-3.0.8/fs/hfsplus/ioctl.c linux-3.0.8/fs/hfsplus/ioctl.c
43979 --- linux-3.0.8/fs/hfsplus/ioctl.c 2011-07-21 22:17:23.000000000 -0400
43980 +++ linux-3.0.8/fs/hfsplus/ioctl.c 2011-08-23 21:48:14.000000000 -0400
43981 @@ -122,6 +122,8 @@ int hfsplus_setxattr(struct dentry *dent
43982 struct hfsplus_cat_file *file;
43983 int res;
43984
43985 + pax_track_stack();
43986 +
43987 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
43988 return -EOPNOTSUPP;
43989
43990 @@ -166,6 +168,8 @@ ssize_t hfsplus_getxattr(struct dentry *
43991 struct hfsplus_cat_file *file;
43992 ssize_t res = 0;
43993
43994 + pax_track_stack();
43995 +
43996 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
43997 return -EOPNOTSUPP;
43998
43999 diff -urNp linux-3.0.8/fs/hfsplus/super.c linux-3.0.8/fs/hfsplus/super.c
44000 --- linux-3.0.8/fs/hfsplus/super.c 2011-10-25 09:10:33.000000000 -0400
44001 +++ linux-3.0.8/fs/hfsplus/super.c 2011-10-25 09:10:41.000000000 -0400
44002 @@ -340,6 +340,8 @@ static int hfsplus_fill_super(struct sup
44003 struct nls_table *nls = NULL;
44004 int err;
44005
44006 + pax_track_stack();
44007 +
44008 err = -EINVAL;
44009 sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
44010 if (!sbi)
44011 diff -urNp linux-3.0.8/fs/hugetlbfs/inode.c linux-3.0.8/fs/hugetlbfs/inode.c
44012 --- linux-3.0.8/fs/hugetlbfs/inode.c 2011-07-21 22:17:23.000000000 -0400
44013 +++ linux-3.0.8/fs/hugetlbfs/inode.c 2011-08-23 21:48:14.000000000 -0400
44014 @@ -914,7 +914,7 @@ static struct file_system_type hugetlbfs
44015 .kill_sb = kill_litter_super,
44016 };
44017
44018 -static struct vfsmount *hugetlbfs_vfsmount;
44019 +struct vfsmount *hugetlbfs_vfsmount;
44020
44021 static int can_do_hugetlb_shm(void)
44022 {
44023 diff -urNp linux-3.0.8/fs/inode.c linux-3.0.8/fs/inode.c
44024 --- linux-3.0.8/fs/inode.c 2011-07-21 22:17:23.000000000 -0400
44025 +++ linux-3.0.8/fs/inode.c 2011-08-23 21:47:56.000000000 -0400
44026 @@ -829,8 +829,8 @@ unsigned int get_next_ino(void)
44027
44028 #ifdef CONFIG_SMP
44029 if (unlikely((res & (LAST_INO_BATCH-1)) == 0)) {
44030 - static atomic_t shared_last_ino;
44031 - int next = atomic_add_return(LAST_INO_BATCH, &shared_last_ino);
44032 + static atomic_unchecked_t shared_last_ino;
44033 + int next = atomic_add_return_unchecked(LAST_INO_BATCH, &shared_last_ino);
44034
44035 res = next - LAST_INO_BATCH;
44036 }
44037 diff -urNp linux-3.0.8/fs/jbd/checkpoint.c linux-3.0.8/fs/jbd/checkpoint.c
44038 --- linux-3.0.8/fs/jbd/checkpoint.c 2011-07-21 22:17:23.000000000 -0400
44039 +++ linux-3.0.8/fs/jbd/checkpoint.c 2011-08-23 21:48:14.000000000 -0400
44040 @@ -350,6 +350,8 @@ int log_do_checkpoint(journal_t *journal
44041 tid_t this_tid;
44042 int result;
44043
44044 + pax_track_stack();
44045 +
44046 jbd_debug(1, "Start checkpoint\n");
44047
44048 /*
44049 diff -urNp linux-3.0.8/fs/jffs2/compr_rtime.c linux-3.0.8/fs/jffs2/compr_rtime.c
44050 --- linux-3.0.8/fs/jffs2/compr_rtime.c 2011-07-21 22:17:23.000000000 -0400
44051 +++ linux-3.0.8/fs/jffs2/compr_rtime.c 2011-08-23 21:48:14.000000000 -0400
44052 @@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned
44053 int outpos = 0;
44054 int pos=0;
44055
44056 + pax_track_stack();
44057 +
44058 memset(positions,0,sizeof(positions));
44059
44060 while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
44061 @@ -78,6 +80,8 @@ static int jffs2_rtime_decompress(unsign
44062 int outpos = 0;
44063 int pos=0;
44064
44065 + pax_track_stack();
44066 +
44067 memset(positions,0,sizeof(positions));
44068
44069 while (outpos<destlen) {
44070 diff -urNp linux-3.0.8/fs/jffs2/compr_rubin.c linux-3.0.8/fs/jffs2/compr_rubin.c
44071 --- linux-3.0.8/fs/jffs2/compr_rubin.c 2011-07-21 22:17:23.000000000 -0400
44072 +++ linux-3.0.8/fs/jffs2/compr_rubin.c 2011-08-23 21:48:14.000000000 -0400
44073 @@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsig
44074 int ret;
44075 uint32_t mysrclen, mydstlen;
44076
44077 + pax_track_stack();
44078 +
44079 mysrclen = *sourcelen;
44080 mydstlen = *dstlen - 8;
44081
44082 diff -urNp linux-3.0.8/fs/jffs2/erase.c linux-3.0.8/fs/jffs2/erase.c
44083 --- linux-3.0.8/fs/jffs2/erase.c 2011-07-21 22:17:23.000000000 -0400
44084 +++ linux-3.0.8/fs/jffs2/erase.c 2011-08-23 21:47:56.000000000 -0400
44085 @@ -439,7 +439,8 @@ static void jffs2_mark_erased_block(stru
44086 struct jffs2_unknown_node marker = {
44087 .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
44088 .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
44089 - .totlen = cpu_to_je32(c->cleanmarker_size)
44090 + .totlen = cpu_to_je32(c->cleanmarker_size),
44091 + .hdr_crc = cpu_to_je32(0)
44092 };
44093
44094 jffs2_prealloc_raw_node_refs(c, jeb, 1);
44095 diff -urNp linux-3.0.8/fs/jffs2/wbuf.c linux-3.0.8/fs/jffs2/wbuf.c
44096 --- linux-3.0.8/fs/jffs2/wbuf.c 2011-07-21 22:17:23.000000000 -0400
44097 +++ linux-3.0.8/fs/jffs2/wbuf.c 2011-08-23 21:47:56.000000000 -0400
44098 @@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
44099 {
44100 .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
44101 .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
44102 - .totlen = constant_cpu_to_je32(8)
44103 + .totlen = constant_cpu_to_je32(8),
44104 + .hdr_crc = constant_cpu_to_je32(0)
44105 };
44106
44107 /*
44108 diff -urNp linux-3.0.8/fs/jffs2/xattr.c linux-3.0.8/fs/jffs2/xattr.c
44109 --- linux-3.0.8/fs/jffs2/xattr.c 2011-07-21 22:17:23.000000000 -0400
44110 +++ linux-3.0.8/fs/jffs2/xattr.c 2011-08-23 21:48:14.000000000 -0400
44111 @@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct
44112
44113 BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
44114
44115 + pax_track_stack();
44116 +
44117 /* Phase.1 : Merge same xref */
44118 for (i=0; i < XREF_TMPHASH_SIZE; i++)
44119 xref_tmphash[i] = NULL;
44120 diff -urNp linux-3.0.8/fs/jfs/super.c linux-3.0.8/fs/jfs/super.c
44121 --- linux-3.0.8/fs/jfs/super.c 2011-07-21 22:17:23.000000000 -0400
44122 +++ linux-3.0.8/fs/jfs/super.c 2011-08-23 21:47:56.000000000 -0400
44123 @@ -803,7 +803,7 @@ static int __init init_jfs_fs(void)
44124
44125 jfs_inode_cachep =
44126 kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
44127 - SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
44128 + SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY,
44129 init_once);
44130 if (jfs_inode_cachep == NULL)
44131 return -ENOMEM;
44132 diff -urNp linux-3.0.8/fs/Kconfig.binfmt linux-3.0.8/fs/Kconfig.binfmt
44133 --- linux-3.0.8/fs/Kconfig.binfmt 2011-07-21 22:17:23.000000000 -0400
44134 +++ linux-3.0.8/fs/Kconfig.binfmt 2011-08-23 21:47:56.000000000 -0400
44135 @@ -86,7 +86,7 @@ config HAVE_AOUT
44136
44137 config BINFMT_AOUT
44138 tristate "Kernel support for a.out and ECOFF binaries"
44139 - depends on HAVE_AOUT
44140 + depends on HAVE_AOUT && BROKEN
44141 ---help---
44142 A.out (Assembler.OUTput) is a set of formats for libraries and
44143 executables used in the earliest versions of UNIX. Linux used
44144 diff -urNp linux-3.0.8/fs/libfs.c linux-3.0.8/fs/libfs.c
44145 --- linux-3.0.8/fs/libfs.c 2011-07-21 22:17:23.000000000 -0400
44146 +++ linux-3.0.8/fs/libfs.c 2011-08-23 21:47:56.000000000 -0400
44147 @@ -163,6 +163,9 @@ int dcache_readdir(struct file * filp, v
44148
44149 for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
44150 struct dentry *next;
44151 + char d_name[sizeof(next->d_iname)];
44152 + const unsigned char *name;
44153 +
44154 next = list_entry(p, struct dentry, d_u.d_child);
44155 spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
44156 if (!simple_positive(next)) {
44157 @@ -172,7 +175,12 @@ int dcache_readdir(struct file * filp, v
44158
44159 spin_unlock(&next->d_lock);
44160 spin_unlock(&dentry->d_lock);
44161 - if (filldir(dirent, next->d_name.name,
44162 + name = next->d_name.name;
44163 + if (name == next->d_iname) {
44164 + memcpy(d_name, name, next->d_name.len);
44165 + name = d_name;
44166 + }
44167 + if (filldir(dirent, name,
44168 next->d_name.len, filp->f_pos,
44169 next->d_inode->i_ino,
44170 dt_type(next->d_inode)) < 0)
44171 diff -urNp linux-3.0.8/fs/lockd/clntproc.c linux-3.0.8/fs/lockd/clntproc.c
44172 --- linux-3.0.8/fs/lockd/clntproc.c 2011-07-21 22:17:23.000000000 -0400
44173 +++ linux-3.0.8/fs/lockd/clntproc.c 2011-08-23 21:48:14.000000000 -0400
44174 @@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt
44175 /*
44176 * Cookie counter for NLM requests
44177 */
44178 -static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
44179 +static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
44180
44181 void nlmclnt_next_cookie(struct nlm_cookie *c)
44182 {
44183 - u32 cookie = atomic_inc_return(&nlm_cookie);
44184 + u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
44185
44186 memcpy(c->data, &cookie, 4);
44187 c->len=4;
44188 @@ -620,6 +620,8 @@ nlmclnt_reclaim(struct nlm_host *host, s
44189 struct nlm_rqst reqst, *req;
44190 int status;
44191
44192 + pax_track_stack();
44193 +
44194 req = &reqst;
44195 memset(req, 0, sizeof(*req));
44196 locks_init_lock(&req->a_args.lock.fl);
44197 diff -urNp linux-3.0.8/fs/locks.c linux-3.0.8/fs/locks.c
44198 --- linux-3.0.8/fs/locks.c 2011-07-21 22:17:23.000000000 -0400
44199 +++ linux-3.0.8/fs/locks.c 2011-08-23 21:47:56.000000000 -0400
44200 @@ -2043,16 +2043,16 @@ void locks_remove_flock(struct file *fil
44201 return;
44202
44203 if (filp->f_op && filp->f_op->flock) {
44204 - struct file_lock fl = {
44205 + struct file_lock flock = {
44206 .fl_pid = current->tgid,
44207 .fl_file = filp,
44208 .fl_flags = FL_FLOCK,
44209 .fl_type = F_UNLCK,
44210 .fl_end = OFFSET_MAX,
44211 };
44212 - filp->f_op->flock(filp, F_SETLKW, &fl);
44213 - if (fl.fl_ops && fl.fl_ops->fl_release_private)
44214 - fl.fl_ops->fl_release_private(&fl);
44215 + filp->f_op->flock(filp, F_SETLKW, &flock);
44216 + if (flock.fl_ops && flock.fl_ops->fl_release_private)
44217 + flock.fl_ops->fl_release_private(&flock);
44218 }
44219
44220 lock_flocks();
44221 diff -urNp linux-3.0.8/fs/logfs/super.c linux-3.0.8/fs/logfs/super.c
44222 --- linux-3.0.8/fs/logfs/super.c 2011-07-21 22:17:23.000000000 -0400
44223 +++ linux-3.0.8/fs/logfs/super.c 2011-08-23 21:48:14.000000000 -0400
44224 @@ -266,6 +266,8 @@ static int logfs_recover_sb(struct super
44225 struct logfs_disk_super _ds1, *ds1 = &_ds1;
44226 int err, valid0, valid1;
44227
44228 + pax_track_stack();
44229 +
44230 /* read first superblock */
44231 err = wbuf_read(sb, super->s_sb_ofs[0], sizeof(*ds0), ds0);
44232 if (err)
44233 diff -urNp linux-3.0.8/fs/namei.c linux-3.0.8/fs/namei.c
44234 --- linux-3.0.8/fs/namei.c 2011-10-24 08:05:30.000000000 -0400
44235 +++ linux-3.0.8/fs/namei.c 2011-10-19 10:09:26.000000000 -0400
44236 @@ -237,21 +237,23 @@ int generic_permission(struct inode *ino
44237 return ret;
44238
44239 /*
44240 - * Read/write DACs are always overridable.
44241 - * Executable DACs are overridable for all directories and
44242 - * for non-directories that have least one exec bit set.
44243 + * Searching includes executable on directories, else just read.
44244 */
44245 - if (!(mask & MAY_EXEC) || execute_ok(inode))
44246 - if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
44247 + mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
44248 + if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE))) {
44249 + if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
44250 return 0;
44251 + }
44252
44253 /*
44254 - * Searching includes executable on directories, else just read.
44255 + * Read/write DACs are always overridable.
44256 + * Executable DACs are overridable for all directories and
44257 + * for non-directories that have least one exec bit set.
44258 */
44259 - mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
44260 - if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
44261 - if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
44262 + if (!(mask & MAY_EXEC) || execute_ok(inode)) {
44263 + if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
44264 return 0;
44265 + }
44266
44267 return -EACCES;
44268 }
44269 @@ -593,9 +595,12 @@ static inline int exec_permission(struct
44270 if (ret == -ECHILD)
44271 return ret;
44272
44273 - if (ns_capable(ns, CAP_DAC_OVERRIDE) ||
44274 - ns_capable(ns, CAP_DAC_READ_SEARCH))
44275 + if (ns_capable_nolog(ns, CAP_DAC_OVERRIDE))
44276 goto ok;
44277 + else {
44278 + if (ns_capable(ns, CAP_DAC_READ_SEARCH) || ns_capable(ns, CAP_DAC_OVERRIDE))
44279 + goto ok;
44280 + }
44281
44282 return ret;
44283 ok:
44284 @@ -703,11 +708,19 @@ follow_link(struct path *link, struct na
44285 return error;
44286 }
44287
44288 + if (gr_handle_follow_link(dentry->d_parent->d_inode,
44289 + dentry->d_inode, dentry, nd->path.mnt)) {
44290 + error = -EACCES;
44291 + *p = ERR_PTR(error); /* no ->put_link(), please */
44292 + path_put(&nd->path);
44293 + return error;
44294 + }
44295 +
44296 nd->last_type = LAST_BIND;
44297 *p = dentry->d_inode->i_op->follow_link(dentry, nd);
44298 error = PTR_ERR(*p);
44299 if (!IS_ERR(*p)) {
44300 - char *s = nd_get_link(nd);
44301 + const char *s = nd_get_link(nd);
44302 error = 0;
44303 if (s)
44304 error = __vfs_follow_link(nd, s);
44305 @@ -1598,6 +1611,12 @@ static int path_lookupat(int dfd, const
44306 if (!err)
44307 err = complete_walk(nd);
44308
44309 + if (!(nd->flags & LOOKUP_PARENT) && !gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
44310 + if (!err)
44311 + path_put(&nd->path);
44312 + err = -ENOENT;
44313 + }
44314 +
44315 if (!err && nd->flags & LOOKUP_DIRECTORY) {
44316 if (!nd->inode->i_op->lookup) {
44317 path_put(&nd->path);
44318 @@ -1625,6 +1644,9 @@ static int do_path_lookup(int dfd, const
44319 retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd);
44320
44321 if (likely(!retval)) {
44322 + if (*name != '/' && nd->path.dentry && nd->inode && !gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
44323 + return -ENOENT;
44324 +
44325 if (unlikely(!audit_dummy_context())) {
44326 if (nd->path.dentry && nd->inode)
44327 audit_inode(name, nd->path.dentry);
44328 @@ -1935,6 +1957,30 @@ int vfs_create(struct inode *dir, struct
44329 return error;
44330 }
44331
44332 +/*
44333 + * Note that while the flag value (low two bits) for sys_open means:
44334 + * 00 - read-only
44335 + * 01 - write-only
44336 + * 10 - read-write
44337 + * 11 - special
44338 + * it is changed into
44339 + * 00 - no permissions needed
44340 + * 01 - read-permission
44341 + * 10 - write-permission
44342 + * 11 - read-write
44343 + * for the internal routines (ie open_namei()/follow_link() etc)
44344 + * This is more logical, and also allows the 00 "no perm needed"
44345 + * to be used for symlinks (where the permissions are checked
44346 + * later).
44347 + *
44348 +*/
44349 +static inline int open_to_namei_flags(int flag)
44350 +{
44351 + if ((flag+1) & O_ACCMODE)
44352 + flag++;
44353 + return flag;
44354 +}
44355 +
44356 static int may_open(struct path *path, int acc_mode, int flag)
44357 {
44358 struct dentry *dentry = path->dentry;
44359 @@ -1987,7 +2033,27 @@ static int may_open(struct path *path, i
44360 /*
44361 * Ensure there are no outstanding leases on the file.
44362 */
44363 - return break_lease(inode, flag);
44364 + error = break_lease(inode, flag);
44365 +
44366 + if (error)
44367 + return error;
44368 +
44369 + if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
44370 + error = -EPERM;
44371 + goto exit;
44372 + }
44373 +
44374 + if (gr_handle_rawio(inode)) {
44375 + error = -EPERM;
44376 + goto exit;
44377 + }
44378 +
44379 + if (!gr_acl_handle_open(dentry, path->mnt, open_to_namei_flags(flag))) {
44380 + error = -EACCES;
44381 + goto exit;
44382 + }
44383 +exit:
44384 + return error;
44385 }
44386
44387 static int handle_truncate(struct file *filp)
44388 @@ -2013,30 +2079,6 @@ static int handle_truncate(struct file *
44389 }
44390
44391 /*
44392 - * Note that while the flag value (low two bits) for sys_open means:
44393 - * 00 - read-only
44394 - * 01 - write-only
44395 - * 10 - read-write
44396 - * 11 - special
44397 - * it is changed into
44398 - * 00 - no permissions needed
44399 - * 01 - read-permission
44400 - * 10 - write-permission
44401 - * 11 - read-write
44402 - * for the internal routines (ie open_namei()/follow_link() etc)
44403 - * This is more logical, and also allows the 00 "no perm needed"
44404 - * to be used for symlinks (where the permissions are checked
44405 - * later).
44406 - *
44407 -*/
44408 -static inline int open_to_namei_flags(int flag)
44409 -{
44410 - if ((flag+1) & O_ACCMODE)
44411 - flag++;
44412 - return flag;
44413 -}
44414 -
44415 -/*
44416 * Handle the last step of open()
44417 */
44418 static struct file *do_last(struct nameidata *nd, struct path *path,
44419 @@ -2045,6 +2087,7 @@ static struct file *do_last(struct namei
44420 struct dentry *dir = nd->path.dentry;
44421 struct dentry *dentry;
44422 int open_flag = op->open_flag;
44423 + int flag = open_to_namei_flags(open_flag);
44424 int will_truncate = open_flag & O_TRUNC;
44425 int want_write = 0;
44426 int acc_mode = op->acc_mode;
44427 @@ -2065,6 +2108,10 @@ static struct file *do_last(struct namei
44428 error = complete_walk(nd);
44429 if (error)
44430 return ERR_PTR(error);
44431 + if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
44432 + error = -ENOENT;
44433 + goto exit;
44434 + }
44435 audit_inode(pathname, nd->path.dentry);
44436 if (open_flag & O_CREAT) {
44437 error = -EISDIR;
44438 @@ -2075,6 +2122,10 @@ static struct file *do_last(struct namei
44439 error = complete_walk(nd);
44440 if (error)
44441 return ERR_PTR(error);
44442 + if (!gr_acl_handle_hidden_file(dir, nd->path.mnt)) {
44443 + error = -ENOENT;
44444 + goto exit;
44445 + }
44446 audit_inode(pathname, dir);
44447 goto ok;
44448 }
44449 @@ -2097,6 +2148,11 @@ static struct file *do_last(struct namei
44450 if (error)
44451 return ERR_PTR(-ECHILD);
44452
44453 + if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
44454 + error = -ENOENT;
44455 + goto exit;
44456 + }
44457 +
44458 error = -ENOTDIR;
44459 if (nd->flags & LOOKUP_DIRECTORY) {
44460 if (!nd->inode->i_op->lookup)
44461 @@ -2132,6 +2188,12 @@ static struct file *do_last(struct namei
44462 /* Negative dentry, just create the file */
44463 if (!dentry->d_inode) {
44464 int mode = op->mode;
44465 +
44466 + if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, path->mnt, flag, mode)) {
44467 + error = -EACCES;
44468 + goto exit_mutex_unlock;
44469 + }
44470 +
44471 if (!IS_POSIXACL(dir->d_inode))
44472 mode &= ~current_umask();
44473 /*
44474 @@ -2155,6 +2217,8 @@ static struct file *do_last(struct namei
44475 error = vfs_create(dir->d_inode, dentry, mode, nd);
44476 if (error)
44477 goto exit_mutex_unlock;
44478 + else
44479 + gr_handle_create(path->dentry, path->mnt);
44480 mutex_unlock(&dir->d_inode->i_mutex);
44481 dput(nd->path.dentry);
44482 nd->path.dentry = dentry;
44483 @@ -2164,6 +2228,19 @@ static struct file *do_last(struct namei
44484 /*
44485 * It already exists.
44486 */
44487 +
44488 + if (!gr_acl_handle_hidden_file(dentry, nd->path.mnt)) {
44489 + error = -ENOENT;
44490 + goto exit_mutex_unlock;
44491 + }
44492 +
44493 + /* only check if O_CREAT is specified, all other checks need to go
44494 + into may_open */
44495 + if (gr_handle_fifo(path->dentry, path->mnt, dir, flag, acc_mode)) {
44496 + error = -EACCES;
44497 + goto exit_mutex_unlock;
44498 + }
44499 +
44500 mutex_unlock(&dir->d_inode->i_mutex);
44501 audit_inode(pathname, path->dentry);
44502
44503 @@ -2373,6 +2450,10 @@ struct dentry *lookup_create(struct name
44504 }
44505 return dentry;
44506 eexist:
44507 + if (!gr_acl_handle_hidden_file(dentry, nd->path.mnt)) {
44508 + dput(dentry);
44509 + return ERR_PTR(-ENOENT);
44510 + }
44511 dput(dentry);
44512 dentry = ERR_PTR(-EEXIST);
44513 fail:
44514 @@ -2450,6 +2531,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
44515 error = may_mknod(mode);
44516 if (error)
44517 goto out_dput;
44518 +
44519 + if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
44520 + error = -EPERM;
44521 + goto out_dput;
44522 + }
44523 +
44524 + if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
44525 + error = -EACCES;
44526 + goto out_dput;
44527 + }
44528 +
44529 error = mnt_want_write(nd.path.mnt);
44530 if (error)
44531 goto out_dput;
44532 @@ -2470,6 +2562,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
44533 }
44534 out_drop_write:
44535 mnt_drop_write(nd.path.mnt);
44536 +
44537 + if (!error)
44538 + gr_handle_create(dentry, nd.path.mnt);
44539 out_dput:
44540 dput(dentry);
44541 out_unlock:
44542 @@ -2522,6 +2617,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
44543 if (IS_ERR(dentry))
44544 goto out_unlock;
44545
44546 + if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
44547 + error = -EACCES;
44548 + goto out_dput;
44549 + }
44550 +
44551 if (!IS_POSIXACL(nd.path.dentry->d_inode))
44552 mode &= ~current_umask();
44553 error = mnt_want_write(nd.path.mnt);
44554 @@ -2533,6 +2633,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
44555 error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
44556 out_drop_write:
44557 mnt_drop_write(nd.path.mnt);
44558 +
44559 + if (!error)
44560 + gr_handle_create(dentry, nd.path.mnt);
44561 +
44562 out_dput:
44563 dput(dentry);
44564 out_unlock:
44565 @@ -2615,6 +2719,8 @@ static long do_rmdir(int dfd, const char
44566 char * name;
44567 struct dentry *dentry;
44568 struct nameidata nd;
44569 + ino_t saved_ino = 0;
44570 + dev_t saved_dev = 0;
44571
44572 error = user_path_parent(dfd, pathname, &nd, &name);
44573 if (error)
44574 @@ -2643,6 +2749,17 @@ static long do_rmdir(int dfd, const char
44575 error = -ENOENT;
44576 goto exit3;
44577 }
44578 +
44579 + if (dentry->d_inode->i_nlink <= 1) {
44580 + saved_ino = dentry->d_inode->i_ino;
44581 + saved_dev = gr_get_dev_from_dentry(dentry);
44582 + }
44583 +
44584 + if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
44585 + error = -EACCES;
44586 + goto exit3;
44587 + }
44588 +
44589 error = mnt_want_write(nd.path.mnt);
44590 if (error)
44591 goto exit3;
44592 @@ -2650,6 +2767,8 @@ static long do_rmdir(int dfd, const char
44593 if (error)
44594 goto exit4;
44595 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
44596 + if (!error && (saved_dev || saved_ino))
44597 + gr_handle_delete(saved_ino, saved_dev);
44598 exit4:
44599 mnt_drop_write(nd.path.mnt);
44600 exit3:
44601 @@ -2712,6 +2831,8 @@ static long do_unlinkat(int dfd, const c
44602 struct dentry *dentry;
44603 struct nameidata nd;
44604 struct inode *inode = NULL;
44605 + ino_t saved_ino = 0;
44606 + dev_t saved_dev = 0;
44607
44608 error = user_path_parent(dfd, pathname, &nd, &name);
44609 if (error)
44610 @@ -2734,6 +2855,16 @@ static long do_unlinkat(int dfd, const c
44611 if (!inode)
44612 goto slashes;
44613 ihold(inode);
44614 +
44615 + if (inode->i_nlink <= 1) {
44616 + saved_ino = inode->i_ino;
44617 + saved_dev = gr_get_dev_from_dentry(dentry);
44618 + }
44619 + if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
44620 + error = -EACCES;
44621 + goto exit2;
44622 + }
44623 +
44624 error = mnt_want_write(nd.path.mnt);
44625 if (error)
44626 goto exit2;
44627 @@ -2741,6 +2872,8 @@ static long do_unlinkat(int dfd, const c
44628 if (error)
44629 goto exit3;
44630 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
44631 + if (!error && (saved_ino || saved_dev))
44632 + gr_handle_delete(saved_ino, saved_dev);
44633 exit3:
44634 mnt_drop_write(nd.path.mnt);
44635 exit2:
44636 @@ -2818,6 +2951,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
44637 if (IS_ERR(dentry))
44638 goto out_unlock;
44639
44640 + if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
44641 + error = -EACCES;
44642 + goto out_dput;
44643 + }
44644 +
44645 error = mnt_want_write(nd.path.mnt);
44646 if (error)
44647 goto out_dput;
44648 @@ -2825,6 +2963,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
44649 if (error)
44650 goto out_drop_write;
44651 error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
44652 + if (!error)
44653 + gr_handle_create(dentry, nd.path.mnt);
44654 out_drop_write:
44655 mnt_drop_write(nd.path.mnt);
44656 out_dput:
44657 @@ -2933,6 +3073,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
44658 error = PTR_ERR(new_dentry);
44659 if (IS_ERR(new_dentry))
44660 goto out_unlock;
44661 +
44662 + if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
44663 + old_path.dentry->d_inode,
44664 + old_path.dentry->d_inode->i_mode, to)) {
44665 + error = -EACCES;
44666 + goto out_dput;
44667 + }
44668 +
44669 + if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
44670 + old_path.dentry, old_path.mnt, to)) {
44671 + error = -EACCES;
44672 + goto out_dput;
44673 + }
44674 +
44675 error = mnt_want_write(nd.path.mnt);
44676 if (error)
44677 goto out_dput;
44678 @@ -2940,6 +3094,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
44679 if (error)
44680 goto out_drop_write;
44681 error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
44682 + if (!error)
44683 + gr_handle_create(new_dentry, nd.path.mnt);
44684 out_drop_write:
44685 mnt_drop_write(nd.path.mnt);
44686 out_dput:
44687 @@ -3117,6 +3273,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
44688 char *to;
44689 int error;
44690
44691 + pax_track_stack();
44692 +
44693 error = user_path_parent(olddfd, oldname, &oldnd, &from);
44694 if (error)
44695 goto exit;
44696 @@ -3173,6 +3331,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
44697 if (new_dentry == trap)
44698 goto exit5;
44699
44700 + error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
44701 + old_dentry, old_dir->d_inode, oldnd.path.mnt,
44702 + to);
44703 + if (error)
44704 + goto exit5;
44705 +
44706 error = mnt_want_write(oldnd.path.mnt);
44707 if (error)
44708 goto exit5;
44709 @@ -3182,6 +3346,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
44710 goto exit6;
44711 error = vfs_rename(old_dir->d_inode, old_dentry,
44712 new_dir->d_inode, new_dentry);
44713 + if (!error)
44714 + gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
44715 + new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
44716 exit6:
44717 mnt_drop_write(oldnd.path.mnt);
44718 exit5:
44719 @@ -3207,6 +3374,8 @@ SYSCALL_DEFINE2(rename, const char __use
44720
44721 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
44722 {
44723 + char tmpbuf[64];
44724 + const char *newlink;
44725 int len;
44726
44727 len = PTR_ERR(link);
44728 @@ -3216,7 +3385,14 @@ int vfs_readlink(struct dentry *dentry,
44729 len = strlen(link);
44730 if (len > (unsigned) buflen)
44731 len = buflen;
44732 - if (copy_to_user(buffer, link, len))
44733 +
44734 + if (len < sizeof(tmpbuf)) {
44735 + memcpy(tmpbuf, link, len);
44736 + newlink = tmpbuf;
44737 + } else
44738 + newlink = link;
44739 +
44740 + if (copy_to_user(buffer, newlink, len))
44741 len = -EFAULT;
44742 out:
44743 return len;
44744 diff -urNp linux-3.0.8/fs/namespace.c linux-3.0.8/fs/namespace.c
44745 --- linux-3.0.8/fs/namespace.c 2011-07-21 22:17:23.000000000 -0400
44746 +++ linux-3.0.8/fs/namespace.c 2011-08-23 21:48:14.000000000 -0400
44747 @@ -1328,6 +1328,9 @@ static int do_umount(struct vfsmount *mn
44748 if (!(sb->s_flags & MS_RDONLY))
44749 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
44750 up_write(&sb->s_umount);
44751 +
44752 + gr_log_remount(mnt->mnt_devname, retval);
44753 +
44754 return retval;
44755 }
44756
44757 @@ -1347,6 +1350,9 @@ static int do_umount(struct vfsmount *mn
44758 br_write_unlock(vfsmount_lock);
44759 up_write(&namespace_sem);
44760 release_mounts(&umount_list);
44761 +
44762 + gr_log_unmount(mnt->mnt_devname, retval);
44763 +
44764 return retval;
44765 }
44766
44767 @@ -2338,6 +2344,16 @@ long do_mount(char *dev_name, char *dir_
44768 MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
44769 MS_STRICTATIME);
44770
44771 + if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
44772 + retval = -EPERM;
44773 + goto dput_out;
44774 + }
44775 +
44776 + if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
44777 + retval = -EPERM;
44778 + goto dput_out;
44779 + }
44780 +
44781 if (flags & MS_REMOUNT)
44782 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
44783 data_page);
44784 @@ -2352,6 +2368,9 @@ long do_mount(char *dev_name, char *dir_
44785 dev_name, data_page);
44786 dput_out:
44787 path_put(&path);
44788 +
44789 + gr_log_mount(dev_name, dir_name, retval);
44790 +
44791 return retval;
44792 }
44793
44794 @@ -2575,6 +2594,11 @@ SYSCALL_DEFINE2(pivot_root, const char _
44795 if (error)
44796 goto out2;
44797
44798 + if (gr_handle_chroot_pivot()) {
44799 + error = -EPERM;
44800 + goto out2;
44801 + }
44802 +
44803 get_fs_root(current->fs, &root);
44804 error = lock_mount(&old);
44805 if (error)
44806 diff -urNp linux-3.0.8/fs/ncpfs/dir.c linux-3.0.8/fs/ncpfs/dir.c
44807 --- linux-3.0.8/fs/ncpfs/dir.c 2011-07-21 22:17:23.000000000 -0400
44808 +++ linux-3.0.8/fs/ncpfs/dir.c 2011-08-23 21:48:14.000000000 -0400
44809 @@ -299,6 +299,8 @@ ncp_lookup_validate(struct dentry *dentr
44810 int res, val = 0, len;
44811 __u8 __name[NCP_MAXPATHLEN + 1];
44812
44813 + pax_track_stack();
44814 +
44815 if (dentry == dentry->d_sb->s_root)
44816 return 1;
44817
44818 @@ -844,6 +846,8 @@ static struct dentry *ncp_lookup(struct
44819 int error, res, len;
44820 __u8 __name[NCP_MAXPATHLEN + 1];
44821
44822 + pax_track_stack();
44823 +
44824 error = -EIO;
44825 if (!ncp_conn_valid(server))
44826 goto finished;
44827 @@ -931,6 +935,8 @@ int ncp_create_new(struct inode *dir, st
44828 PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
44829 dentry->d_parent->d_name.name, dentry->d_name.name, mode);
44830
44831 + pax_track_stack();
44832 +
44833 ncp_age_dentry(server, dentry);
44834 len = sizeof(__name);
44835 error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
44836 @@ -992,6 +998,8 @@ static int ncp_mkdir(struct inode *dir,
44837 int error, len;
44838 __u8 __name[NCP_MAXPATHLEN + 1];
44839
44840 + pax_track_stack();
44841 +
44842 DPRINTK("ncp_mkdir: making %s/%s\n",
44843 dentry->d_parent->d_name.name, dentry->d_name.name);
44844
44845 @@ -1140,6 +1148,8 @@ static int ncp_rename(struct inode *old_
44846 int old_len, new_len;
44847 __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
44848
44849 + pax_track_stack();
44850 +
44851 DPRINTK("ncp_rename: %s/%s to %s/%s\n",
44852 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
44853 new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
44854 diff -urNp linux-3.0.8/fs/ncpfs/inode.c linux-3.0.8/fs/ncpfs/inode.c
44855 --- linux-3.0.8/fs/ncpfs/inode.c 2011-07-21 22:17:23.000000000 -0400
44856 +++ linux-3.0.8/fs/ncpfs/inode.c 2011-08-23 21:48:14.000000000 -0400
44857 @@ -461,6 +461,8 @@ static int ncp_fill_super(struct super_b
44858 #endif
44859 struct ncp_entry_info finfo;
44860
44861 + pax_track_stack();
44862 +
44863 memset(&data, 0, sizeof(data));
44864 server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
44865 if (!server)
44866 diff -urNp linux-3.0.8/fs/nfs/inode.c linux-3.0.8/fs/nfs/inode.c
44867 --- linux-3.0.8/fs/nfs/inode.c 2011-07-21 22:17:23.000000000 -0400
44868 +++ linux-3.0.8/fs/nfs/inode.c 2011-08-23 21:47:56.000000000 -0400
44869 @@ -150,7 +150,7 @@ static void nfs_zap_caches_locked(struct
44870 nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
44871 nfsi->attrtimeo_timestamp = jiffies;
44872
44873 - memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
44874 + memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_I(inode)->cookieverf));
44875 if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
44876 nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
44877 else
44878 @@ -1000,16 +1000,16 @@ static int nfs_size_need_update(const st
44879 return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
44880 }
44881
44882 -static atomic_long_t nfs_attr_generation_counter;
44883 +static atomic_long_unchecked_t nfs_attr_generation_counter;
44884
44885 static unsigned long nfs_read_attr_generation_counter(void)
44886 {
44887 - return atomic_long_read(&nfs_attr_generation_counter);
44888 + return atomic_long_read_unchecked(&nfs_attr_generation_counter);
44889 }
44890
44891 unsigned long nfs_inc_attr_generation_counter(void)
44892 {
44893 - return atomic_long_inc_return(&nfs_attr_generation_counter);
44894 + return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
44895 }
44896
44897 void nfs_fattr_init(struct nfs_fattr *fattr)
44898 diff -urNp linux-3.0.8/fs/nfsd/nfs4state.c linux-3.0.8/fs/nfsd/nfs4state.c
44899 --- linux-3.0.8/fs/nfsd/nfs4state.c 2011-10-24 08:05:21.000000000 -0400
44900 +++ linux-3.0.8/fs/nfsd/nfs4state.c 2011-08-23 21:48:14.000000000 -0400
44901 @@ -3794,6 +3794,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
44902 unsigned int strhashval;
44903 int err;
44904
44905 + pax_track_stack();
44906 +
44907 dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
44908 (long long) lock->lk_offset,
44909 (long long) lock->lk_length);
44910 diff -urNp linux-3.0.8/fs/nfsd/nfs4xdr.c linux-3.0.8/fs/nfsd/nfs4xdr.c
44911 --- linux-3.0.8/fs/nfsd/nfs4xdr.c 2011-07-21 22:17:23.000000000 -0400
44912 +++ linux-3.0.8/fs/nfsd/nfs4xdr.c 2011-08-23 21:48:14.000000000 -0400
44913 @@ -1788,6 +1788,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, s
44914 .dentry = dentry,
44915 };
44916
44917 + pax_track_stack();
44918 +
44919 BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
44920 BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
44921 BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
44922 diff -urNp linux-3.0.8/fs/nfsd/vfs.c linux-3.0.8/fs/nfsd/vfs.c
44923 --- linux-3.0.8/fs/nfsd/vfs.c 2011-07-21 22:17:23.000000000 -0400
44924 +++ linux-3.0.8/fs/nfsd/vfs.c 2011-10-06 04:17:55.000000000 -0400
44925 @@ -896,7 +896,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
44926 } else {
44927 oldfs = get_fs();
44928 set_fs(KERNEL_DS);
44929 - host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
44930 + host_err = vfs_readv(file, (struct iovec __force_user *)vec, vlen, &offset);
44931 set_fs(oldfs);
44932 }
44933
44934 @@ -1000,7 +1000,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
44935
44936 /* Write the data. */
44937 oldfs = get_fs(); set_fs(KERNEL_DS);
44938 - host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
44939 + host_err = vfs_writev(file, (struct iovec __force_user *)vec, vlen, &offset);
44940 set_fs(oldfs);
44941 if (host_err < 0)
44942 goto out_nfserr;
44943 @@ -1535,7 +1535,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
44944 */
44945
44946 oldfs = get_fs(); set_fs(KERNEL_DS);
44947 - host_err = inode->i_op->readlink(dentry, buf, *lenp);
44948 + host_err = inode->i_op->readlink(dentry, (char __force_user *)buf, *lenp);
44949 set_fs(oldfs);
44950
44951 if (host_err < 0)
44952 diff -urNp linux-3.0.8/fs/notify/fanotify/fanotify_user.c linux-3.0.8/fs/notify/fanotify/fanotify_user.c
44953 --- linux-3.0.8/fs/notify/fanotify/fanotify_user.c 2011-07-21 22:17:23.000000000 -0400
44954 +++ linux-3.0.8/fs/notify/fanotify/fanotify_user.c 2011-08-23 21:48:14.000000000 -0400
44955 @@ -276,7 +276,8 @@ static ssize_t copy_event_to_user(struct
44956 goto out_close_fd;
44957
44958 ret = -EFAULT;
44959 - if (copy_to_user(buf, &fanotify_event_metadata,
44960 + if (fanotify_event_metadata.event_len > sizeof fanotify_event_metadata ||
44961 + copy_to_user(buf, &fanotify_event_metadata,
44962 fanotify_event_metadata.event_len))
44963 goto out_kill_access_response;
44964
44965 diff -urNp linux-3.0.8/fs/notify/notification.c linux-3.0.8/fs/notify/notification.c
44966 --- linux-3.0.8/fs/notify/notification.c 2011-07-21 22:17:23.000000000 -0400
44967 +++ linux-3.0.8/fs/notify/notification.c 2011-08-23 21:47:56.000000000 -0400
44968 @@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event
44969 * get set to 0 so it will never get 'freed'
44970 */
44971 static struct fsnotify_event *q_overflow_event;
44972 -static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
44973 +static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
44974
44975 /**
44976 * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
44977 @@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = A
44978 */
44979 u32 fsnotify_get_cookie(void)
44980 {
44981 - return atomic_inc_return(&fsnotify_sync_cookie);
44982 + return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
44983 }
44984 EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
44985
44986 diff -urNp linux-3.0.8/fs/ntfs/dir.c linux-3.0.8/fs/ntfs/dir.c
44987 --- linux-3.0.8/fs/ntfs/dir.c 2011-07-21 22:17:23.000000000 -0400
44988 +++ linux-3.0.8/fs/ntfs/dir.c 2011-08-23 21:47:56.000000000 -0400
44989 @@ -1329,7 +1329,7 @@ find_next_index_buffer:
44990 ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
44991 ~(s64)(ndir->itype.index.block_size - 1)));
44992 /* Bounds checks. */
44993 - if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
44994 + if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
44995 ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
44996 "inode 0x%lx or driver bug.", vdir->i_ino);
44997 goto err_out;
44998 diff -urNp linux-3.0.8/fs/ntfs/file.c linux-3.0.8/fs/ntfs/file.c
44999 --- linux-3.0.8/fs/ntfs/file.c 2011-07-21 22:17:23.000000000 -0400
45000 +++ linux-3.0.8/fs/ntfs/file.c 2011-08-23 21:47:56.000000000 -0400
45001 @@ -2222,6 +2222,6 @@ const struct inode_operations ntfs_file_
45002 #endif /* NTFS_RW */
45003 };
45004
45005 -const struct file_operations ntfs_empty_file_ops = {};
45006 +const struct file_operations ntfs_empty_file_ops __read_only;
45007
45008 -const struct inode_operations ntfs_empty_inode_ops = {};
45009 +const struct inode_operations ntfs_empty_inode_ops __read_only;
45010 diff -urNp linux-3.0.8/fs/ocfs2/localalloc.c linux-3.0.8/fs/ocfs2/localalloc.c
45011 --- linux-3.0.8/fs/ocfs2/localalloc.c 2011-07-21 22:17:23.000000000 -0400
45012 +++ linux-3.0.8/fs/ocfs2/localalloc.c 2011-08-23 21:47:56.000000000 -0400
45013 @@ -1283,7 +1283,7 @@ static int ocfs2_local_alloc_slide_windo
45014 goto bail;
45015 }
45016
45017 - atomic_inc(&osb->alloc_stats.moves);
45018 + atomic_inc_unchecked(&osb->alloc_stats.moves);
45019
45020 bail:
45021 if (handle)
45022 diff -urNp linux-3.0.8/fs/ocfs2/namei.c linux-3.0.8/fs/ocfs2/namei.c
45023 --- linux-3.0.8/fs/ocfs2/namei.c 2011-07-21 22:17:23.000000000 -0400
45024 +++ linux-3.0.8/fs/ocfs2/namei.c 2011-08-23 21:48:14.000000000 -0400
45025 @@ -1063,6 +1063,8 @@ static int ocfs2_rename(struct inode *ol
45026 struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
45027 struct ocfs2_dir_lookup_result target_insert = { NULL, };
45028
45029 + pax_track_stack();
45030 +
45031 /* At some point it might be nice to break this function up a
45032 * bit. */
45033
45034 diff -urNp linux-3.0.8/fs/ocfs2/ocfs2.h linux-3.0.8/fs/ocfs2/ocfs2.h
45035 --- linux-3.0.8/fs/ocfs2/ocfs2.h 2011-07-21 22:17:23.000000000 -0400
45036 +++ linux-3.0.8/fs/ocfs2/ocfs2.h 2011-08-23 21:47:56.000000000 -0400
45037 @@ -235,11 +235,11 @@ enum ocfs2_vol_state
45038
45039 struct ocfs2_alloc_stats
45040 {
45041 - atomic_t moves;
45042 - atomic_t local_data;
45043 - atomic_t bitmap_data;
45044 - atomic_t bg_allocs;
45045 - atomic_t bg_extends;
45046 + atomic_unchecked_t moves;
45047 + atomic_unchecked_t local_data;
45048 + atomic_unchecked_t bitmap_data;
45049 + atomic_unchecked_t bg_allocs;
45050 + atomic_unchecked_t bg_extends;
45051 };
45052
45053 enum ocfs2_local_alloc_state
45054 diff -urNp linux-3.0.8/fs/ocfs2/suballoc.c linux-3.0.8/fs/ocfs2/suballoc.c
45055 --- linux-3.0.8/fs/ocfs2/suballoc.c 2011-07-21 22:17:23.000000000 -0400
45056 +++ linux-3.0.8/fs/ocfs2/suballoc.c 2011-08-23 21:47:56.000000000 -0400
45057 @@ -872,7 +872,7 @@ static int ocfs2_reserve_suballoc_bits(s
45058 mlog_errno(status);
45059 goto bail;
45060 }
45061 - atomic_inc(&osb->alloc_stats.bg_extends);
45062 + atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
45063
45064 /* You should never ask for this much metadata */
45065 BUG_ON(bits_wanted >
45066 @@ -2008,7 +2008,7 @@ int ocfs2_claim_metadata(handle_t *handl
45067 mlog_errno(status);
45068 goto bail;
45069 }
45070 - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
45071 + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
45072
45073 *suballoc_loc = res.sr_bg_blkno;
45074 *suballoc_bit_start = res.sr_bit_offset;
45075 @@ -2172,7 +2172,7 @@ int ocfs2_claim_new_inode_at_loc(handle_
45076 trace_ocfs2_claim_new_inode_at_loc((unsigned long long)di_blkno,
45077 res->sr_bits);
45078
45079 - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
45080 + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
45081
45082 BUG_ON(res->sr_bits != 1);
45083
45084 @@ -2214,7 +2214,7 @@ int ocfs2_claim_new_inode(handle_t *hand
45085 mlog_errno(status);
45086 goto bail;
45087 }
45088 - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
45089 + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
45090
45091 BUG_ON(res.sr_bits != 1);
45092
45093 @@ -2318,7 +2318,7 @@ int __ocfs2_claim_clusters(handle_t *han
45094 cluster_start,
45095 num_clusters);
45096 if (!status)
45097 - atomic_inc(&osb->alloc_stats.local_data);
45098 + atomic_inc_unchecked(&osb->alloc_stats.local_data);
45099 } else {
45100 if (min_clusters > (osb->bitmap_cpg - 1)) {
45101 /* The only paths asking for contiguousness
45102 @@ -2344,7 +2344,7 @@ int __ocfs2_claim_clusters(handle_t *han
45103 ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
45104 res.sr_bg_blkno,
45105 res.sr_bit_offset);
45106 - atomic_inc(&osb->alloc_stats.bitmap_data);
45107 + atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
45108 *num_clusters = res.sr_bits;
45109 }
45110 }
45111 diff -urNp linux-3.0.8/fs/ocfs2/super.c linux-3.0.8/fs/ocfs2/super.c
45112 --- linux-3.0.8/fs/ocfs2/super.c 2011-07-21 22:17:23.000000000 -0400
45113 +++ linux-3.0.8/fs/ocfs2/super.c 2011-08-23 21:47:56.000000000 -0400
45114 @@ -300,11 +300,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
45115 "%10s => GlobalAllocs: %d LocalAllocs: %d "
45116 "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
45117 "Stats",
45118 - atomic_read(&osb->alloc_stats.bitmap_data),
45119 - atomic_read(&osb->alloc_stats.local_data),
45120 - atomic_read(&osb->alloc_stats.bg_allocs),
45121 - atomic_read(&osb->alloc_stats.moves),
45122 - atomic_read(&osb->alloc_stats.bg_extends));
45123 + atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
45124 + atomic_read_unchecked(&osb->alloc_stats.local_data),
45125 + atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
45126 + atomic_read_unchecked(&osb->alloc_stats.moves),
45127 + atomic_read_unchecked(&osb->alloc_stats.bg_extends));
45128
45129 out += snprintf(buf + out, len - out,
45130 "%10s => State: %u Descriptor: %llu Size: %u bits "
45131 @@ -2112,11 +2112,11 @@ static int ocfs2_initialize_super(struct
45132 spin_lock_init(&osb->osb_xattr_lock);
45133 ocfs2_init_steal_slots(osb);
45134
45135 - atomic_set(&osb->alloc_stats.moves, 0);
45136 - atomic_set(&osb->alloc_stats.local_data, 0);
45137 - atomic_set(&osb->alloc_stats.bitmap_data, 0);
45138 - atomic_set(&osb->alloc_stats.bg_allocs, 0);
45139 - atomic_set(&osb->alloc_stats.bg_extends, 0);
45140 + atomic_set_unchecked(&osb->alloc_stats.moves, 0);
45141 + atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
45142 + atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
45143 + atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
45144 + atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
45145
45146 /* Copy the blockcheck stats from the superblock probe */
45147 osb->osb_ecc_stats = *stats;
45148 diff -urNp linux-3.0.8/fs/ocfs2/symlink.c linux-3.0.8/fs/ocfs2/symlink.c
45149 --- linux-3.0.8/fs/ocfs2/symlink.c 2011-07-21 22:17:23.000000000 -0400
45150 +++ linux-3.0.8/fs/ocfs2/symlink.c 2011-08-23 21:47:56.000000000 -0400
45151 @@ -142,7 +142,7 @@ bail:
45152
45153 static void ocfs2_fast_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
45154 {
45155 - char *link = nd_get_link(nd);
45156 + const char *link = nd_get_link(nd);
45157 if (!IS_ERR(link))
45158 kfree(link);
45159 }
45160 diff -urNp linux-3.0.8/fs/open.c linux-3.0.8/fs/open.c
45161 --- linux-3.0.8/fs/open.c 2011-07-21 22:17:23.000000000 -0400
45162 +++ linux-3.0.8/fs/open.c 2011-09-14 09:16:46.000000000 -0400
45163 @@ -112,6 +112,10 @@ static long do_sys_truncate(const char _
45164 error = locks_verify_truncate(inode, NULL, length);
45165 if (!error)
45166 error = security_path_truncate(&path);
45167 +
45168 + if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
45169 + error = -EACCES;
45170 +
45171 if (!error)
45172 error = do_truncate(path.dentry, length, 0, NULL);
45173
45174 @@ -358,6 +362,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
45175 if (__mnt_is_readonly(path.mnt))
45176 res = -EROFS;
45177
45178 + if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
45179 + res = -EACCES;
45180 +
45181 out_path_release:
45182 path_put(&path);
45183 out:
45184 @@ -384,6 +391,8 @@ SYSCALL_DEFINE1(chdir, const char __user
45185 if (error)
45186 goto dput_and_out;
45187
45188 + gr_log_chdir(path.dentry, path.mnt);
45189 +
45190 set_fs_pwd(current->fs, &path);
45191
45192 dput_and_out:
45193 @@ -410,6 +419,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
45194 goto out_putf;
45195
45196 error = inode_permission(inode, MAY_EXEC | MAY_CHDIR);
45197 +
45198 + if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
45199 + error = -EPERM;
45200 +
45201 + if (!error)
45202 + gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
45203 +
45204 if (!error)
45205 set_fs_pwd(current->fs, &file->f_path);
45206 out_putf:
45207 @@ -438,7 +454,13 @@ SYSCALL_DEFINE1(chroot, const char __use
45208 if (error)
45209 goto dput_and_out;
45210
45211 + if (gr_handle_chroot_chroot(path.dentry, path.mnt))
45212 + goto dput_and_out;
45213 +
45214 set_fs_root(current->fs, &path);
45215 +
45216 + gr_handle_chroot_chdir(&path);
45217 +
45218 error = 0;
45219 dput_and_out:
45220 path_put(&path);
45221 @@ -466,12 +488,25 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
45222 err = mnt_want_write_file(file);
45223 if (err)
45224 goto out_putf;
45225 +
45226 mutex_lock(&inode->i_mutex);
45227 +
45228 + if (!gr_acl_handle_fchmod(dentry, file->f_vfsmnt, mode)) {
45229 + err = -EACCES;
45230 + goto out_unlock;
45231 + }
45232 +
45233 err = security_path_chmod(dentry, file->f_vfsmnt, mode);
45234 if (err)
45235 goto out_unlock;
45236 if (mode == (mode_t) -1)
45237 mode = inode->i_mode;
45238 +
45239 + if (gr_handle_chroot_chmod(dentry, file->f_vfsmnt, mode)) {
45240 + err = -EACCES;
45241 + goto out_unlock;
45242 + }
45243 +
45244 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
45245 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
45246 err = notify_change(dentry, &newattrs);
45247 @@ -499,12 +534,25 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
45248 error = mnt_want_write(path.mnt);
45249 if (error)
45250 goto dput_and_out;
45251 +
45252 mutex_lock(&inode->i_mutex);
45253 +
45254 + if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
45255 + error = -EACCES;
45256 + goto out_unlock;
45257 + }
45258 +
45259 error = security_path_chmod(path.dentry, path.mnt, mode);
45260 if (error)
45261 goto out_unlock;
45262 if (mode == (mode_t) -1)
45263 mode = inode->i_mode;
45264 +
45265 + if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
45266 + error = -EACCES;
45267 + goto out_unlock;
45268 + }
45269 +
45270 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
45271 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
45272 error = notify_change(path.dentry, &newattrs);
45273 @@ -528,6 +576,9 @@ static int chown_common(struct path *pat
45274 int error;
45275 struct iattr newattrs;
45276
45277 + if (!gr_acl_handle_chown(path->dentry, path->mnt))
45278 + return -EACCES;
45279 +
45280 newattrs.ia_valid = ATTR_CTIME;
45281 if (user != (uid_t) -1) {
45282 newattrs.ia_valid |= ATTR_UID;
45283 @@ -998,7 +1049,10 @@ long do_sys_open(int dfd, const char __u
45284 if (!IS_ERR(tmp)) {
45285 fd = get_unused_fd_flags(flags);
45286 if (fd >= 0) {
45287 - struct file *f = do_filp_open(dfd, tmp, &op, lookup);
45288 + struct file *f;
45289 + /* don't allow to be set by userland */
45290 + flags &= ~FMODE_GREXEC;
45291 + f = do_filp_open(dfd, tmp, &op, lookup);
45292 if (IS_ERR(f)) {
45293 put_unused_fd(fd);
45294 fd = PTR_ERR(f);
45295 diff -urNp linux-3.0.8/fs/partitions/ldm.c linux-3.0.8/fs/partitions/ldm.c
45296 --- linux-3.0.8/fs/partitions/ldm.c 2011-07-21 22:17:23.000000000 -0400
45297 +++ linux-3.0.8/fs/partitions/ldm.c 2011-08-23 21:48:14.000000000 -0400
45298 @@ -1311,6 +1311,7 @@ static bool ldm_frag_add (const u8 *data
45299 ldm_error ("A VBLK claims to have %d parts.", num);
45300 return false;
45301 }
45302 +
45303 if (rec >= num) {
45304 ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
45305 return false;
45306 @@ -1322,7 +1323,7 @@ static bool ldm_frag_add (const u8 *data
45307 goto found;
45308 }
45309
45310 - f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
45311 + f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
45312 if (!f) {
45313 ldm_crit ("Out of memory.");
45314 return false;
45315 diff -urNp linux-3.0.8/fs/pipe.c linux-3.0.8/fs/pipe.c
45316 --- linux-3.0.8/fs/pipe.c 2011-07-21 22:17:23.000000000 -0400
45317 +++ linux-3.0.8/fs/pipe.c 2011-08-23 21:48:14.000000000 -0400
45318 @@ -420,9 +420,9 @@ redo:
45319 }
45320 if (bufs) /* More to do? */
45321 continue;
45322 - if (!pipe->writers)
45323 + if (!atomic_read(&pipe->writers))
45324 break;
45325 - if (!pipe->waiting_writers) {
45326 + if (!atomic_read(&pipe->waiting_writers)) {
45327 /* syscall merging: Usually we must not sleep
45328 * if O_NONBLOCK is set, or if we got some data.
45329 * But if a writer sleeps in kernel space, then
45330 @@ -481,7 +481,7 @@ pipe_write(struct kiocb *iocb, const str
45331 mutex_lock(&inode->i_mutex);
45332 pipe = inode->i_pipe;
45333
45334 - if (!pipe->readers) {
45335 + if (!atomic_read(&pipe->readers)) {
45336 send_sig(SIGPIPE, current, 0);
45337 ret = -EPIPE;
45338 goto out;
45339 @@ -530,7 +530,7 @@ redo1:
45340 for (;;) {
45341 int bufs;
45342
45343 - if (!pipe->readers) {
45344 + if (!atomic_read(&pipe->readers)) {
45345 send_sig(SIGPIPE, current, 0);
45346 if (!ret)
45347 ret = -EPIPE;
45348 @@ -616,9 +616,9 @@ redo2:
45349 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
45350 do_wakeup = 0;
45351 }
45352 - pipe->waiting_writers++;
45353 + atomic_inc(&pipe->waiting_writers);
45354 pipe_wait(pipe);
45355 - pipe->waiting_writers--;
45356 + atomic_dec(&pipe->waiting_writers);
45357 }
45358 out:
45359 mutex_unlock(&inode->i_mutex);
45360 @@ -685,7 +685,7 @@ pipe_poll(struct file *filp, poll_table
45361 mask = 0;
45362 if (filp->f_mode & FMODE_READ) {
45363 mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
45364 - if (!pipe->writers && filp->f_version != pipe->w_counter)
45365 + if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
45366 mask |= POLLHUP;
45367 }
45368
45369 @@ -695,7 +695,7 @@ pipe_poll(struct file *filp, poll_table
45370 * Most Unices do not set POLLERR for FIFOs but on Linux they
45371 * behave exactly like pipes for poll().
45372 */
45373 - if (!pipe->readers)
45374 + if (!atomic_read(&pipe->readers))
45375 mask |= POLLERR;
45376 }
45377
45378 @@ -709,10 +709,10 @@ pipe_release(struct inode *inode, int de
45379
45380 mutex_lock(&inode->i_mutex);
45381 pipe = inode->i_pipe;
45382 - pipe->readers -= decr;
45383 - pipe->writers -= decw;
45384 + atomic_sub(decr, &pipe->readers);
45385 + atomic_sub(decw, &pipe->writers);
45386
45387 - if (!pipe->readers && !pipe->writers) {
45388 + if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
45389 free_pipe_info(inode);
45390 } else {
45391 wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
45392 @@ -802,7 +802,7 @@ pipe_read_open(struct inode *inode, stru
45393
45394 if (inode->i_pipe) {
45395 ret = 0;
45396 - inode->i_pipe->readers++;
45397 + atomic_inc(&inode->i_pipe->readers);
45398 }
45399
45400 mutex_unlock(&inode->i_mutex);
45401 @@ -819,7 +819,7 @@ pipe_write_open(struct inode *inode, str
45402
45403 if (inode->i_pipe) {
45404 ret = 0;
45405 - inode->i_pipe->writers++;
45406 + atomic_inc(&inode->i_pipe->writers);
45407 }
45408
45409 mutex_unlock(&inode->i_mutex);
45410 @@ -837,9 +837,9 @@ pipe_rdwr_open(struct inode *inode, stru
45411 if (inode->i_pipe) {
45412 ret = 0;
45413 if (filp->f_mode & FMODE_READ)
45414 - inode->i_pipe->readers++;
45415 + atomic_inc(&inode->i_pipe->readers);
45416 if (filp->f_mode & FMODE_WRITE)
45417 - inode->i_pipe->writers++;
45418 + atomic_inc(&inode->i_pipe->writers);
45419 }
45420
45421 mutex_unlock(&inode->i_mutex);
45422 @@ -931,7 +931,7 @@ void free_pipe_info(struct inode *inode)
45423 inode->i_pipe = NULL;
45424 }
45425
45426 -static struct vfsmount *pipe_mnt __read_mostly;
45427 +struct vfsmount *pipe_mnt __read_mostly;
45428
45429 /*
45430 * pipefs_dname() is called from d_path().
45431 @@ -961,7 +961,8 @@ static struct inode * get_pipe_inode(voi
45432 goto fail_iput;
45433 inode->i_pipe = pipe;
45434
45435 - pipe->readers = pipe->writers = 1;
45436 + atomic_set(&pipe->readers, 1);
45437 + atomic_set(&pipe->writers, 1);
45438 inode->i_fop = &rdwr_pipefifo_fops;
45439
45440 /*
45441 diff -urNp linux-3.0.8/fs/proc/array.c linux-3.0.8/fs/proc/array.c
45442 --- linux-3.0.8/fs/proc/array.c 2011-07-21 22:17:23.000000000 -0400
45443 +++ linux-3.0.8/fs/proc/array.c 2011-08-23 21:48:14.000000000 -0400
45444 @@ -60,6 +60,7 @@
45445 #include <linux/tty.h>
45446 #include <linux/string.h>
45447 #include <linux/mman.h>
45448 +#include <linux/grsecurity.h>
45449 #include <linux/proc_fs.h>
45450 #include <linux/ioport.h>
45451 #include <linux/uaccess.h>
45452 @@ -337,6 +338,21 @@ static void task_cpus_allowed(struct seq
45453 seq_putc(m, '\n');
45454 }
45455
45456 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
45457 +static inline void task_pax(struct seq_file *m, struct task_struct *p)
45458 +{
45459 + if (p->mm)
45460 + seq_printf(m, "PaX:\t%c%c%c%c%c\n",
45461 + p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
45462 + p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
45463 + p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
45464 + p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
45465 + p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
45466 + else
45467 + seq_printf(m, "PaX:\t-----\n");
45468 +}
45469 +#endif
45470 +
45471 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
45472 struct pid *pid, struct task_struct *task)
45473 {
45474 @@ -354,9 +370,24 @@ int proc_pid_status(struct seq_file *m,
45475 task_cpus_allowed(m, task);
45476 cpuset_task_status_allowed(m, task);
45477 task_context_switch_counts(m, task);
45478 +
45479 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
45480 + task_pax(m, task);
45481 +#endif
45482 +
45483 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
45484 + task_grsec_rbac(m, task);
45485 +#endif
45486 +
45487 return 0;
45488 }
45489
45490 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
45491 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
45492 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
45493 + _mm->pax_flags & MF_PAX_SEGMEXEC))
45494 +#endif
45495 +
45496 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
45497 struct pid *pid, struct task_struct *task, int whole)
45498 {
45499 @@ -375,9 +406,11 @@ static int do_task_stat(struct seq_file
45500 cputime_t cutime, cstime, utime, stime;
45501 cputime_t cgtime, gtime;
45502 unsigned long rsslim = 0;
45503 - char tcomm[sizeof(task->comm)];
45504 + char tcomm[sizeof(task->comm)] = { 0 };
45505 unsigned long flags;
45506
45507 + pax_track_stack();
45508 +
45509 state = *get_task_state(task);
45510 vsize = eip = esp = 0;
45511 permitted = ptrace_may_access(task, PTRACE_MODE_READ);
45512 @@ -449,6 +482,19 @@ static int do_task_stat(struct seq_file
45513 gtime = task->gtime;
45514 }
45515
45516 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
45517 + if (PAX_RAND_FLAGS(mm)) {
45518 + eip = 0;
45519 + esp = 0;
45520 + wchan = 0;
45521 + }
45522 +#endif
45523 +#ifdef CONFIG_GRKERNSEC_HIDESYM
45524 + wchan = 0;
45525 + eip =0;
45526 + esp =0;
45527 +#endif
45528 +
45529 /* scale priority and nice values from timeslices to -20..20 */
45530 /* to make it look like a "normal" Unix priority/nice value */
45531 priority = task_prio(task);
45532 @@ -489,9 +535,15 @@ static int do_task_stat(struct seq_file
45533 vsize,
45534 mm ? get_mm_rss(mm) : 0,
45535 rsslim,
45536 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
45537 + PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
45538 + PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
45539 + PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
45540 +#else
45541 mm ? (permitted ? mm->start_code : 1) : 0,
45542 mm ? (permitted ? mm->end_code : 1) : 0,
45543 (permitted && mm) ? mm->start_stack : 0,
45544 +#endif
45545 esp,
45546 eip,
45547 /* The signal information here is obsolete.
45548 @@ -544,3 +596,18 @@ int proc_pid_statm(struct seq_file *m, s
45549
45550 return 0;
45551 }
45552 +
45553 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
45554 +int proc_pid_ipaddr(struct task_struct *task, char *buffer)
45555 +{
45556 + u32 curr_ip = 0;
45557 + unsigned long flags;
45558 +
45559 + if (lock_task_sighand(task, &flags)) {
45560 + curr_ip = task->signal->curr_ip;
45561 + unlock_task_sighand(task, &flags);
45562 + }
45563 +
45564 + return sprintf(buffer, "%pI4\n", &curr_ip);
45565 +}
45566 +#endif
45567 diff -urNp linux-3.0.8/fs/proc/base.c linux-3.0.8/fs/proc/base.c
45568 --- linux-3.0.8/fs/proc/base.c 2011-10-24 08:05:21.000000000 -0400
45569 +++ linux-3.0.8/fs/proc/base.c 2011-10-19 03:59:32.000000000 -0400
45570 @@ -107,6 +107,22 @@ struct pid_entry {
45571 union proc_op op;
45572 };
45573
45574 +struct getdents_callback {
45575 + struct linux_dirent __user * current_dir;
45576 + struct linux_dirent __user * previous;
45577 + struct file * file;
45578 + int count;
45579 + int error;
45580 +};
45581 +
45582 +static int gr_fake_filldir(void * __buf, const char *name, int namlen,
45583 + loff_t offset, u64 ino, unsigned int d_type)
45584 +{
45585 + struct getdents_callback * buf = (struct getdents_callback *) __buf;
45586 + buf->error = -EINVAL;
45587 + return 0;
45588 +}
45589 +
45590 #define NOD(NAME, MODE, IOP, FOP, OP) { \
45591 .name = (NAME), \
45592 .len = sizeof(NAME) - 1, \
45593 @@ -209,6 +225,9 @@ static struct mm_struct *__check_mem_per
45594 if (task == current)
45595 return mm;
45596
45597 + if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
45598 + return ERR_PTR(-EPERM);
45599 +
45600 /*
45601 * If current is actively ptrace'ing, and would also be
45602 * permitted to freshly attach with ptrace now, permit it.
45603 @@ -282,6 +301,9 @@ static int proc_pid_cmdline(struct task_
45604 if (!mm->arg_end)
45605 goto out_mm; /* Shh! No looking before we're done */
45606
45607 + if (gr_acl_handle_procpidmem(task))
45608 + goto out_mm;
45609 +
45610 len = mm->arg_end - mm->arg_start;
45611
45612 if (len > PAGE_SIZE)
45613 @@ -309,12 +331,28 @@ out:
45614 return res;
45615 }
45616
45617 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
45618 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
45619 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
45620 + _mm->pax_flags & MF_PAX_SEGMEXEC))
45621 +#endif
45622 +
45623 static int proc_pid_auxv(struct task_struct *task, char *buffer)
45624 {
45625 struct mm_struct *mm = mm_for_maps(task);
45626 int res = PTR_ERR(mm);
45627 if (mm && !IS_ERR(mm)) {
45628 unsigned int nwords = 0;
45629 +
45630 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
45631 + /* allow if we're currently ptracing this task */
45632 + if (PAX_RAND_FLAGS(mm) &&
45633 + (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
45634 + mmput(mm);
45635 + return 0;
45636 + }
45637 +#endif
45638 +
45639 do {
45640 nwords += 2;
45641 } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
45642 @@ -328,7 +366,7 @@ static int proc_pid_auxv(struct task_str
45643 }
45644
45645
45646 -#ifdef CONFIG_KALLSYMS
45647 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
45648 /*
45649 * Provides a wchan file via kallsyms in a proper one-value-per-file format.
45650 * Returns the resolved symbol. If that fails, simply return the address.
45651 @@ -367,7 +405,7 @@ static void unlock_trace(struct task_str
45652 mutex_unlock(&task->signal->cred_guard_mutex);
45653 }
45654
45655 -#ifdef CONFIG_STACKTRACE
45656 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
45657
45658 #define MAX_STACK_TRACE_DEPTH 64
45659
45660 @@ -558,7 +596,7 @@ static int proc_pid_limits(struct task_s
45661 return count;
45662 }
45663
45664 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
45665 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
45666 static int proc_pid_syscall(struct task_struct *task, char *buffer)
45667 {
45668 long nr;
45669 @@ -587,7 +625,7 @@ static int proc_pid_syscall(struct task_
45670 /************************************************************************/
45671
45672 /* permission checks */
45673 -static int proc_fd_access_allowed(struct inode *inode)
45674 +static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
45675 {
45676 struct task_struct *task;
45677 int allowed = 0;
45678 @@ -597,7 +635,10 @@ static int proc_fd_access_allowed(struct
45679 */
45680 task = get_proc_task(inode);
45681 if (task) {
45682 - allowed = ptrace_may_access(task, PTRACE_MODE_READ);
45683 + if (log)
45684 + allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
45685 + else
45686 + allowed = ptrace_may_access(task, PTRACE_MODE_READ);
45687 put_task_struct(task);
45688 }
45689 return allowed;
45690 @@ -978,6 +1019,9 @@ static ssize_t environ_read(struct file
45691 if (!task)
45692 goto out_no_task;
45693
45694 + if (gr_acl_handle_procpidmem(task))
45695 + goto out;
45696 +
45697 ret = -ENOMEM;
45698 page = (char *)__get_free_page(GFP_TEMPORARY);
45699 if (!page)
45700 @@ -1614,7 +1658,7 @@ static void *proc_pid_follow_link(struct
45701 path_put(&nd->path);
45702
45703 /* Are we allowed to snoop on the tasks file descriptors? */
45704 - if (!proc_fd_access_allowed(inode))
45705 + if (!proc_fd_access_allowed(inode,0))
45706 goto out;
45707
45708 error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
45709 @@ -1653,8 +1697,18 @@ static int proc_pid_readlink(struct dent
45710 struct path path;
45711
45712 /* Are we allowed to snoop on the tasks file descriptors? */
45713 - if (!proc_fd_access_allowed(inode))
45714 - goto out;
45715 + /* logging this is needed for learning on chromium to work properly,
45716 + but we don't want to flood the logs from 'ps' which does a readlink
45717 + on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
45718 + CAP_SYS_PTRACE as it's not necessary for its basic functionality
45719 + */
45720 + if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
45721 + if (!proc_fd_access_allowed(inode,0))
45722 + goto out;
45723 + } else {
45724 + if (!proc_fd_access_allowed(inode,1))
45725 + goto out;
45726 + }
45727
45728 error = PROC_I(inode)->op.proc_get_link(inode, &path);
45729 if (error)
45730 @@ -1719,7 +1773,11 @@ struct inode *proc_pid_make_inode(struct
45731 rcu_read_lock();
45732 cred = __task_cred(task);
45733 inode->i_uid = cred->euid;
45734 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
45735 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
45736 +#else
45737 inode->i_gid = cred->egid;
45738 +#endif
45739 rcu_read_unlock();
45740 }
45741 security_task_to_inode(task, inode);
45742 @@ -1737,6 +1795,9 @@ int pid_getattr(struct vfsmount *mnt, st
45743 struct inode *inode = dentry->d_inode;
45744 struct task_struct *task;
45745 const struct cred *cred;
45746 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45747 + const struct cred *tmpcred = current_cred();
45748 +#endif
45749
45750 generic_fillattr(inode, stat);
45751
45752 @@ -1744,13 +1805,41 @@ int pid_getattr(struct vfsmount *mnt, st
45753 stat->uid = 0;
45754 stat->gid = 0;
45755 task = pid_task(proc_pid(inode), PIDTYPE_PID);
45756 +
45757 + if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
45758 + rcu_read_unlock();
45759 + return -ENOENT;
45760 + }
45761 +
45762 if (task) {
45763 + cred = __task_cred(task);
45764 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45765 + if (!tmpcred->uid || (tmpcred->uid == cred->uid)
45766 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
45767 + || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
45768 +#endif
45769 + ) {
45770 +#endif
45771 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
45772 +#ifdef CONFIG_GRKERNSEC_PROC_USER
45773 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
45774 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45775 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
45776 +#endif
45777 task_dumpable(task)) {
45778 - cred = __task_cred(task);
45779 stat->uid = cred->euid;
45780 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
45781 + stat->gid = CONFIG_GRKERNSEC_PROC_GID;
45782 +#else
45783 stat->gid = cred->egid;
45784 +#endif
45785 + }
45786 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45787 + } else {
45788 + rcu_read_unlock();
45789 + return -ENOENT;
45790 }
45791 +#endif
45792 }
45793 rcu_read_unlock();
45794 return 0;
45795 @@ -1787,11 +1876,20 @@ int pid_revalidate(struct dentry *dentry
45796
45797 if (task) {
45798 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
45799 +#ifdef CONFIG_GRKERNSEC_PROC_USER
45800 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
45801 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45802 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
45803 +#endif
45804 task_dumpable(task)) {
45805 rcu_read_lock();
45806 cred = __task_cred(task);
45807 inode->i_uid = cred->euid;
45808 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
45809 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
45810 +#else
45811 inode->i_gid = cred->egid;
45812 +#endif
45813 rcu_read_unlock();
45814 } else {
45815 inode->i_uid = 0;
45816 @@ -1909,7 +2007,8 @@ static int proc_fd_info(struct inode *in
45817 int fd = proc_fd(inode);
45818
45819 if (task) {
45820 - files = get_files_struct(task);
45821 + if (!gr_acl_handle_procpidmem(task))
45822 + files = get_files_struct(task);
45823 put_task_struct(task);
45824 }
45825 if (files) {
45826 @@ -2169,11 +2268,21 @@ static const struct file_operations proc
45827 */
45828 static int proc_fd_permission(struct inode *inode, int mask, unsigned int flags)
45829 {
45830 + struct task_struct *task;
45831 int rv = generic_permission(inode, mask, flags, NULL);
45832 - if (rv == 0)
45833 - return 0;
45834 +
45835 if (task_pid(current) == proc_pid(inode))
45836 rv = 0;
45837 +
45838 + task = get_proc_task(inode);
45839 + if (task == NULL)
45840 + return rv;
45841 +
45842 + if (gr_acl_handle_procpidmem(task))
45843 + rv = -EACCES;
45844 +
45845 + put_task_struct(task);
45846 +
45847 return rv;
45848 }
45849
45850 @@ -2283,6 +2392,9 @@ static struct dentry *proc_pident_lookup
45851 if (!task)
45852 goto out_no_task;
45853
45854 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
45855 + goto out;
45856 +
45857 /*
45858 * Yes, it does not scale. And it should not. Don't add
45859 * new entries into /proc/<tgid>/ without very good reasons.
45860 @@ -2327,6 +2439,9 @@ static int proc_pident_readdir(struct fi
45861 if (!task)
45862 goto out_no_task;
45863
45864 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
45865 + goto out;
45866 +
45867 ret = 0;
45868 i = filp->f_pos;
45869 switch (i) {
45870 @@ -2597,7 +2712,7 @@ static void *proc_self_follow_link(struc
45871 static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
45872 void *cookie)
45873 {
45874 - char *s = nd_get_link(nd);
45875 + const char *s = nd_get_link(nd);
45876 if (!IS_ERR(s))
45877 __putname(s);
45878 }
45879 @@ -2656,6 +2771,7 @@ static struct dentry *proc_base_instanti
45880 if (p->fop)
45881 inode->i_fop = p->fop;
45882 ei->op = p->op;
45883 +
45884 d_add(dentry, inode);
45885 error = NULL;
45886 out:
45887 @@ -2795,7 +2911,7 @@ static const struct pid_entry tgid_base_
45888 REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
45889 #endif
45890 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
45891 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
45892 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
45893 INF("syscall", S_IRUGO, proc_pid_syscall),
45894 #endif
45895 INF("cmdline", S_IRUGO, proc_pid_cmdline),
45896 @@ -2820,10 +2936,10 @@ static const struct pid_entry tgid_base_
45897 #ifdef CONFIG_SECURITY
45898 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
45899 #endif
45900 -#ifdef CONFIG_KALLSYMS
45901 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
45902 INF("wchan", S_IRUGO, proc_pid_wchan),
45903 #endif
45904 -#ifdef CONFIG_STACKTRACE
45905 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
45906 ONE("stack", S_IRUGO, proc_pid_stack),
45907 #endif
45908 #ifdef CONFIG_SCHEDSTATS
45909 @@ -2857,6 +2973,9 @@ static const struct pid_entry tgid_base_
45910 #ifdef CONFIG_HARDWALL
45911 INF("hardwall", S_IRUGO, proc_pid_hardwall),
45912 #endif
45913 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
45914 + INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
45915 +#endif
45916 };
45917
45918 static int proc_tgid_base_readdir(struct file * filp,
45919 @@ -2982,7 +3101,14 @@ static struct dentry *proc_pid_instantia
45920 if (!inode)
45921 goto out;
45922
45923 +#ifdef CONFIG_GRKERNSEC_PROC_USER
45924 + inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
45925 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45926 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
45927 + inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
45928 +#else
45929 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
45930 +#endif
45931 inode->i_op = &proc_tgid_base_inode_operations;
45932 inode->i_fop = &proc_tgid_base_operations;
45933 inode->i_flags|=S_IMMUTABLE;
45934 @@ -3024,7 +3150,14 @@ struct dentry *proc_pid_lookup(struct in
45935 if (!task)
45936 goto out;
45937
45938 + if (!has_group_leader_pid(task))
45939 + goto out_put_task;
45940 +
45941 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
45942 + goto out_put_task;
45943 +
45944 result = proc_pid_instantiate(dir, dentry, task, NULL);
45945 +out_put_task:
45946 put_task_struct(task);
45947 out:
45948 return result;
45949 @@ -3089,6 +3222,11 @@ int proc_pid_readdir(struct file * filp,
45950 {
45951 unsigned int nr;
45952 struct task_struct *reaper;
45953 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45954 + const struct cred *tmpcred = current_cred();
45955 + const struct cred *itercred;
45956 +#endif
45957 + filldir_t __filldir = filldir;
45958 struct tgid_iter iter;
45959 struct pid_namespace *ns;
45960
45961 @@ -3112,8 +3250,27 @@ int proc_pid_readdir(struct file * filp,
45962 for (iter = next_tgid(ns, iter);
45963 iter.task;
45964 iter.tgid += 1, iter = next_tgid(ns, iter)) {
45965 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45966 + rcu_read_lock();
45967 + itercred = __task_cred(iter.task);
45968 +#endif
45969 + if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
45970 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45971 + || (tmpcred->uid && (itercred->uid != tmpcred->uid)
45972 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
45973 + && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
45974 +#endif
45975 + )
45976 +#endif
45977 + )
45978 + __filldir = &gr_fake_filldir;
45979 + else
45980 + __filldir = filldir;
45981 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45982 + rcu_read_unlock();
45983 +#endif
45984 filp->f_pos = iter.tgid + TGID_OFFSET;
45985 - if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
45986 + if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
45987 put_task_struct(iter.task);
45988 goto out;
45989 }
45990 @@ -3141,7 +3298,7 @@ static const struct pid_entry tid_base_s
45991 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
45992 #endif
45993 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
45994 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
45995 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
45996 INF("syscall", S_IRUGO, proc_pid_syscall),
45997 #endif
45998 INF("cmdline", S_IRUGO, proc_pid_cmdline),
45999 @@ -3165,10 +3322,10 @@ static const struct pid_entry tid_base_s
46000 #ifdef CONFIG_SECURITY
46001 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
46002 #endif
46003 -#ifdef CONFIG_KALLSYMS
46004 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
46005 INF("wchan", S_IRUGO, proc_pid_wchan),
46006 #endif
46007 -#ifdef CONFIG_STACKTRACE
46008 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
46009 ONE("stack", S_IRUGO, proc_pid_stack),
46010 #endif
46011 #ifdef CONFIG_SCHEDSTATS
46012 diff -urNp linux-3.0.8/fs/proc/cmdline.c linux-3.0.8/fs/proc/cmdline.c
46013 --- linux-3.0.8/fs/proc/cmdline.c 2011-07-21 22:17:23.000000000 -0400
46014 +++ linux-3.0.8/fs/proc/cmdline.c 2011-08-23 21:48:14.000000000 -0400
46015 @@ -23,7 +23,11 @@ static const struct file_operations cmdl
46016
46017 static int __init proc_cmdline_init(void)
46018 {
46019 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
46020 + proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
46021 +#else
46022 proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
46023 +#endif
46024 return 0;
46025 }
46026 module_init(proc_cmdline_init);
46027 diff -urNp linux-3.0.8/fs/proc/devices.c linux-3.0.8/fs/proc/devices.c
46028 --- linux-3.0.8/fs/proc/devices.c 2011-07-21 22:17:23.000000000 -0400
46029 +++ linux-3.0.8/fs/proc/devices.c 2011-08-23 21:48:14.000000000 -0400
46030 @@ -64,7 +64,11 @@ static const struct file_operations proc
46031
46032 static int __init proc_devices_init(void)
46033 {
46034 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
46035 + proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
46036 +#else
46037 proc_create("devices", 0, NULL, &proc_devinfo_operations);
46038 +#endif
46039 return 0;
46040 }
46041 module_init(proc_devices_init);
46042 diff -urNp linux-3.0.8/fs/proc/inode.c linux-3.0.8/fs/proc/inode.c
46043 --- linux-3.0.8/fs/proc/inode.c 2011-07-21 22:17:23.000000000 -0400
46044 +++ linux-3.0.8/fs/proc/inode.c 2011-10-19 03:59:32.000000000 -0400
46045 @@ -18,12 +18,18 @@
46046 #include <linux/module.h>
46047 #include <linux/sysctl.h>
46048 #include <linux/slab.h>
46049 +#include <linux/grsecurity.h>
46050
46051 #include <asm/system.h>
46052 #include <asm/uaccess.h>
46053
46054 #include "internal.h"
46055
46056 +#ifdef CONFIG_PROC_SYSCTL
46057 +extern const struct inode_operations proc_sys_inode_operations;
46058 +extern const struct inode_operations proc_sys_dir_operations;
46059 +#endif
46060 +
46061 static void proc_evict_inode(struct inode *inode)
46062 {
46063 struct proc_dir_entry *de;
46064 @@ -49,6 +55,13 @@ static void proc_evict_inode(struct inod
46065 ns_ops = PROC_I(inode)->ns_ops;
46066 if (ns_ops && ns_ops->put)
46067 ns_ops->put(PROC_I(inode)->ns);
46068 +
46069 +#ifdef CONFIG_PROC_SYSCTL
46070 + if (inode->i_op == &proc_sys_inode_operations ||
46071 + inode->i_op == &proc_sys_dir_operations)
46072 + gr_handle_delete(inode->i_ino, inode->i_sb->s_dev);
46073 +#endif
46074 +
46075 }
46076
46077 static struct kmem_cache * proc_inode_cachep;
46078 @@ -440,7 +453,11 @@ struct inode *proc_get_inode(struct supe
46079 if (de->mode) {
46080 inode->i_mode = de->mode;
46081 inode->i_uid = de->uid;
46082 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
46083 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
46084 +#else
46085 inode->i_gid = de->gid;
46086 +#endif
46087 }
46088 if (de->size)
46089 inode->i_size = de->size;
46090 diff -urNp linux-3.0.8/fs/proc/internal.h linux-3.0.8/fs/proc/internal.h
46091 --- linux-3.0.8/fs/proc/internal.h 2011-07-21 22:17:23.000000000 -0400
46092 +++ linux-3.0.8/fs/proc/internal.h 2011-08-23 21:48:14.000000000 -0400
46093 @@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
46094 struct pid *pid, struct task_struct *task);
46095 extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
46096 struct pid *pid, struct task_struct *task);
46097 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
46098 +extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
46099 +#endif
46100 extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
46101
46102 extern const struct file_operations proc_maps_operations;
46103 diff -urNp linux-3.0.8/fs/proc/Kconfig linux-3.0.8/fs/proc/Kconfig
46104 --- linux-3.0.8/fs/proc/Kconfig 2011-07-21 22:17:23.000000000 -0400
46105 +++ linux-3.0.8/fs/proc/Kconfig 2011-08-23 21:48:14.000000000 -0400
46106 @@ -30,12 +30,12 @@ config PROC_FS
46107
46108 config PROC_KCORE
46109 bool "/proc/kcore support" if !ARM
46110 - depends on PROC_FS && MMU
46111 + depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
46112
46113 config PROC_VMCORE
46114 bool "/proc/vmcore support"
46115 - depends on PROC_FS && CRASH_DUMP
46116 - default y
46117 + depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
46118 + default n
46119 help
46120 Exports the dump image of crashed kernel in ELF format.
46121
46122 @@ -59,8 +59,8 @@ config PROC_SYSCTL
46123 limited in memory.
46124
46125 config PROC_PAGE_MONITOR
46126 - default y
46127 - depends on PROC_FS && MMU
46128 + default n
46129 + depends on PROC_FS && MMU && !GRKERNSEC
46130 bool "Enable /proc page monitoring" if EXPERT
46131 help
46132 Various /proc files exist to monitor process memory utilization:
46133 diff -urNp linux-3.0.8/fs/proc/kcore.c linux-3.0.8/fs/proc/kcore.c
46134 --- linux-3.0.8/fs/proc/kcore.c 2011-07-21 22:17:23.000000000 -0400
46135 +++ linux-3.0.8/fs/proc/kcore.c 2011-08-23 21:48:14.000000000 -0400
46136 @@ -321,6 +321,8 @@ static void elf_kcore_store_hdr(char *bu
46137 off_t offset = 0;
46138 struct kcore_list *m;
46139
46140 + pax_track_stack();
46141 +
46142 /* setup ELF header */
46143 elf = (struct elfhdr *) bufp;
46144 bufp += sizeof(struct elfhdr);
46145 @@ -478,9 +480,10 @@ read_kcore(struct file *file, char __use
46146 * the addresses in the elf_phdr on our list.
46147 */
46148 start = kc_offset_to_vaddr(*fpos - elf_buflen);
46149 - if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
46150 + tsz = PAGE_SIZE - (start & ~PAGE_MASK);
46151 + if (tsz > buflen)
46152 tsz = buflen;
46153 -
46154 +
46155 while (buflen) {
46156 struct kcore_list *m;
46157
46158 @@ -509,20 +512,23 @@ read_kcore(struct file *file, char __use
46159 kfree(elf_buf);
46160 } else {
46161 if (kern_addr_valid(start)) {
46162 - unsigned long n;
46163 + char *elf_buf;
46164 + mm_segment_t oldfs;
46165
46166 - n = copy_to_user(buffer, (char *)start, tsz);
46167 - /*
46168 - * We cannot distingush between fault on source
46169 - * and fault on destination. When this happens
46170 - * we clear too and hope it will trigger the
46171 - * EFAULT again.
46172 - */
46173 - if (n) {
46174 - if (clear_user(buffer + tsz - n,
46175 - n))
46176 + elf_buf = kmalloc(tsz, GFP_KERNEL);
46177 + if (!elf_buf)
46178 + return -ENOMEM;
46179 + oldfs = get_fs();
46180 + set_fs(KERNEL_DS);
46181 + if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
46182 + set_fs(oldfs);
46183 + if (copy_to_user(buffer, elf_buf, tsz)) {
46184 + kfree(elf_buf);
46185 return -EFAULT;
46186 + }
46187 }
46188 + set_fs(oldfs);
46189 + kfree(elf_buf);
46190 } else {
46191 if (clear_user(buffer, tsz))
46192 return -EFAULT;
46193 @@ -542,6 +548,9 @@ read_kcore(struct file *file, char __use
46194
46195 static int open_kcore(struct inode *inode, struct file *filp)
46196 {
46197 +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
46198 + return -EPERM;
46199 +#endif
46200 if (!capable(CAP_SYS_RAWIO))
46201 return -EPERM;
46202 if (kcore_need_update)
46203 diff -urNp linux-3.0.8/fs/proc/meminfo.c linux-3.0.8/fs/proc/meminfo.c
46204 --- linux-3.0.8/fs/proc/meminfo.c 2011-07-21 22:17:23.000000000 -0400
46205 +++ linux-3.0.8/fs/proc/meminfo.c 2011-08-23 21:48:14.000000000 -0400
46206 @@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_
46207 unsigned long pages[NR_LRU_LISTS];
46208 int lru;
46209
46210 + pax_track_stack();
46211 +
46212 /*
46213 * display in kilobytes.
46214 */
46215 @@ -157,7 +159,7 @@ static int meminfo_proc_show(struct seq_
46216 vmi.used >> 10,
46217 vmi.largest_chunk >> 10
46218 #ifdef CONFIG_MEMORY_FAILURE
46219 - ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
46220 + ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
46221 #endif
46222 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
46223 ,K(global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) *
46224 diff -urNp linux-3.0.8/fs/proc/nommu.c linux-3.0.8/fs/proc/nommu.c
46225 --- linux-3.0.8/fs/proc/nommu.c 2011-07-21 22:17:23.000000000 -0400
46226 +++ linux-3.0.8/fs/proc/nommu.c 2011-08-23 21:47:56.000000000 -0400
46227 @@ -66,7 +66,7 @@ static int nommu_region_show(struct seq_
46228 if (len < 1)
46229 len = 1;
46230 seq_printf(m, "%*c", len, ' ');
46231 - seq_path(m, &file->f_path, "");
46232 + seq_path(m, &file->f_path, "\n\\");
46233 }
46234
46235 seq_putc(m, '\n');
46236 diff -urNp linux-3.0.8/fs/proc/proc_net.c linux-3.0.8/fs/proc/proc_net.c
46237 --- linux-3.0.8/fs/proc/proc_net.c 2011-07-21 22:17:23.000000000 -0400
46238 +++ linux-3.0.8/fs/proc/proc_net.c 2011-08-23 21:48:14.000000000 -0400
46239 @@ -105,6 +105,17 @@ static struct net *get_proc_task_net(str
46240 struct task_struct *task;
46241 struct nsproxy *ns;
46242 struct net *net = NULL;
46243 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
46244 + const struct cred *cred = current_cred();
46245 +#endif
46246 +
46247 +#ifdef CONFIG_GRKERNSEC_PROC_USER
46248 + if (cred->fsuid)
46249 + return net;
46250 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
46251 + if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
46252 + return net;
46253 +#endif
46254
46255 rcu_read_lock();
46256 task = pid_task(proc_pid(dir), PIDTYPE_PID);
46257 diff -urNp linux-3.0.8/fs/proc/proc_sysctl.c linux-3.0.8/fs/proc/proc_sysctl.c
46258 --- linux-3.0.8/fs/proc/proc_sysctl.c 2011-07-21 22:17:23.000000000 -0400
46259 +++ linux-3.0.8/fs/proc/proc_sysctl.c 2011-10-19 03:59:32.000000000 -0400
46260 @@ -8,11 +8,13 @@
46261 #include <linux/namei.h>
46262 #include "internal.h"
46263
46264 +extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
46265 +
46266 static const struct dentry_operations proc_sys_dentry_operations;
46267 static const struct file_operations proc_sys_file_operations;
46268 -static const struct inode_operations proc_sys_inode_operations;
46269 +const struct inode_operations proc_sys_inode_operations;
46270 static const struct file_operations proc_sys_dir_file_operations;
46271 -static const struct inode_operations proc_sys_dir_operations;
46272 +const struct inode_operations proc_sys_dir_operations;
46273
46274 static struct inode *proc_sys_make_inode(struct super_block *sb,
46275 struct ctl_table_header *head, struct ctl_table *table)
46276 @@ -121,8 +123,14 @@ static struct dentry *proc_sys_lookup(st
46277
46278 err = NULL;
46279 d_set_d_op(dentry, &proc_sys_dentry_operations);
46280 +
46281 + gr_handle_proc_create(dentry, inode);
46282 +
46283 d_add(dentry, inode);
46284
46285 + if (gr_handle_sysctl(p, MAY_EXEC))
46286 + err = ERR_PTR(-ENOENT);
46287 +
46288 out:
46289 sysctl_head_finish(head);
46290 return err;
46291 @@ -202,6 +210,9 @@ static int proc_sys_fill_cache(struct fi
46292 return -ENOMEM;
46293 } else {
46294 d_set_d_op(child, &proc_sys_dentry_operations);
46295 +
46296 + gr_handle_proc_create(child, inode);
46297 +
46298 d_add(child, inode);
46299 }
46300 } else {
46301 @@ -230,6 +241,9 @@ static int scan(struct ctl_table_header
46302 if (*pos < file->f_pos)
46303 continue;
46304
46305 + if (gr_handle_sysctl(table, 0))
46306 + continue;
46307 +
46308 res = proc_sys_fill_cache(file, dirent, filldir, head, table);
46309 if (res)
46310 return res;
46311 @@ -355,6 +369,9 @@ static int proc_sys_getattr(struct vfsmo
46312 if (IS_ERR(head))
46313 return PTR_ERR(head);
46314
46315 + if (table && gr_handle_sysctl(table, MAY_EXEC))
46316 + return -ENOENT;
46317 +
46318 generic_fillattr(inode, stat);
46319 if (table)
46320 stat->mode = (stat->mode & S_IFMT) | table->mode;
46321 @@ -374,13 +391,13 @@ static const struct file_operations proc
46322 .llseek = generic_file_llseek,
46323 };
46324
46325 -static const struct inode_operations proc_sys_inode_operations = {
46326 +const struct inode_operations proc_sys_inode_operations = {
46327 .permission = proc_sys_permission,
46328 .setattr = proc_sys_setattr,
46329 .getattr = proc_sys_getattr,
46330 };
46331
46332 -static const struct inode_operations proc_sys_dir_operations = {
46333 +const struct inode_operations proc_sys_dir_operations = {
46334 .lookup = proc_sys_lookup,
46335 .permission = proc_sys_permission,
46336 .setattr = proc_sys_setattr,
46337 diff -urNp linux-3.0.8/fs/proc/root.c linux-3.0.8/fs/proc/root.c
46338 --- linux-3.0.8/fs/proc/root.c 2011-07-21 22:17:23.000000000 -0400
46339 +++ linux-3.0.8/fs/proc/root.c 2011-08-23 21:48:14.000000000 -0400
46340 @@ -123,7 +123,15 @@ void __init proc_root_init(void)
46341 #ifdef CONFIG_PROC_DEVICETREE
46342 proc_device_tree_init();
46343 #endif
46344 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
46345 +#ifdef CONFIG_GRKERNSEC_PROC_USER
46346 + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
46347 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
46348 + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
46349 +#endif
46350 +#else
46351 proc_mkdir("bus", NULL);
46352 +#endif
46353 proc_sys_init();
46354 }
46355
46356 diff -urNp linux-3.0.8/fs/proc/task_mmu.c linux-3.0.8/fs/proc/task_mmu.c
46357 --- linux-3.0.8/fs/proc/task_mmu.c 2011-10-24 08:05:30.000000000 -0400
46358 +++ linux-3.0.8/fs/proc/task_mmu.c 2011-10-16 21:55:28.000000000 -0400
46359 @@ -51,8 +51,13 @@ void task_mem(struct seq_file *m, struct
46360 "VmExe:\t%8lu kB\n"
46361 "VmLib:\t%8lu kB\n"
46362 "VmPTE:\t%8lu kB\n"
46363 - "VmSwap:\t%8lu kB\n",
46364 - hiwater_vm << (PAGE_SHIFT-10),
46365 + "VmSwap:\t%8lu kB\n"
46366 +
46367 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
46368 + "CsBase:\t%8lx\nCsLim:\t%8lx\n"
46369 +#endif
46370 +
46371 + ,hiwater_vm << (PAGE_SHIFT-10),
46372 (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
46373 mm->locked_vm << (PAGE_SHIFT-10),
46374 hiwater_rss << (PAGE_SHIFT-10),
46375 @@ -60,7 +65,13 @@ void task_mem(struct seq_file *m, struct
46376 data << (PAGE_SHIFT-10),
46377 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
46378 (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10,
46379 - swap << (PAGE_SHIFT-10));
46380 + swap << (PAGE_SHIFT-10)
46381 +
46382 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
46383 + , mm->context.user_cs_base, mm->context.user_cs_limit
46384 +#endif
46385 +
46386 + );
46387 }
46388
46389 unsigned long task_vsize(struct mm_struct *mm)
46390 @@ -207,6 +218,12 @@ static int do_maps_open(struct inode *in
46391 return ret;
46392 }
46393
46394 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
46395 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
46396 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
46397 + _mm->pax_flags & MF_PAX_SEGMEXEC))
46398 +#endif
46399 +
46400 static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
46401 {
46402 struct mm_struct *mm = vma->vm_mm;
46403 @@ -225,13 +242,13 @@ static void show_map_vma(struct seq_file
46404 pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
46405 }
46406
46407 - /* We don't show the stack guard page in /proc/maps */
46408 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
46409 + start = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start;
46410 + end = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end;
46411 +#else
46412 start = vma->vm_start;
46413 - if (stack_guard_page_start(vma, start))
46414 - start += PAGE_SIZE;
46415 end = vma->vm_end;
46416 - if (stack_guard_page_end(vma, end))
46417 - end -= PAGE_SIZE;
46418 +#endif
46419
46420 seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
46421 start,
46422 @@ -240,7 +257,11 @@ static void show_map_vma(struct seq_file
46423 flags & VM_WRITE ? 'w' : '-',
46424 flags & VM_EXEC ? 'x' : '-',
46425 flags & VM_MAYSHARE ? 's' : 'p',
46426 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
46427 + PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
46428 +#else
46429 pgoff,
46430 +#endif
46431 MAJOR(dev), MINOR(dev), ino, &len);
46432
46433 /*
46434 @@ -249,7 +270,7 @@ static void show_map_vma(struct seq_file
46435 */
46436 if (file) {
46437 pad_len_spaces(m, len);
46438 - seq_path(m, &file->f_path, "\n");
46439 + seq_path(m, &file->f_path, "\n\\");
46440 } else {
46441 const char *name = arch_vma_name(vma);
46442 if (!name) {
46443 @@ -257,8 +278,9 @@ static void show_map_vma(struct seq_file
46444 if (vma->vm_start <= mm->brk &&
46445 vma->vm_end >= mm->start_brk) {
46446 name = "[heap]";
46447 - } else if (vma->vm_start <= mm->start_stack &&
46448 - vma->vm_end >= mm->start_stack) {
46449 + } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
46450 + (vma->vm_start <= mm->start_stack &&
46451 + vma->vm_end >= mm->start_stack)) {
46452 name = "[stack]";
46453 }
46454 } else {
46455 @@ -433,11 +455,16 @@ static int show_smap(struct seq_file *m,
46456 };
46457
46458 memset(&mss, 0, sizeof mss);
46459 - mss.vma = vma;
46460 - /* mmap_sem is held in m_start */
46461 - if (vma->vm_mm && !is_vm_hugetlb_page(vma))
46462 - walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
46463 -
46464 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
46465 + if (!PAX_RAND_FLAGS(vma->vm_mm)) {
46466 +#endif
46467 + mss.vma = vma;
46468 + /* mmap_sem is held in m_start */
46469 + if (vma->vm_mm && !is_vm_hugetlb_page(vma))
46470 + walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
46471 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
46472 + }
46473 +#endif
46474 show_map_vma(m, vma);
46475
46476 seq_printf(m,
46477 @@ -455,7 +482,11 @@ static int show_smap(struct seq_file *m,
46478 "KernelPageSize: %8lu kB\n"
46479 "MMUPageSize: %8lu kB\n"
46480 "Locked: %8lu kB\n",
46481 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
46482 + PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
46483 +#else
46484 (vma->vm_end - vma->vm_start) >> 10,
46485 +#endif
46486 mss.resident >> 10,
46487 (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
46488 mss.shared_clean >> 10,
46489 @@ -1031,7 +1062,7 @@ static int show_numa_map(struct seq_file
46490
46491 if (file) {
46492 seq_printf(m, " file=");
46493 - seq_path(m, &file->f_path, "\n\t= ");
46494 + seq_path(m, &file->f_path, "\n\t\\= ");
46495 } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
46496 seq_printf(m, " heap");
46497 } else if (vma->vm_start <= mm->start_stack &&
46498 diff -urNp linux-3.0.8/fs/proc/task_nommu.c linux-3.0.8/fs/proc/task_nommu.c
46499 --- linux-3.0.8/fs/proc/task_nommu.c 2011-07-21 22:17:23.000000000 -0400
46500 +++ linux-3.0.8/fs/proc/task_nommu.c 2011-08-23 21:47:56.000000000 -0400
46501 @@ -51,7 +51,7 @@ void task_mem(struct seq_file *m, struct
46502 else
46503 bytes += kobjsize(mm);
46504
46505 - if (current->fs && current->fs->users > 1)
46506 + if (current->fs && atomic_read(&current->fs->users) > 1)
46507 sbytes += kobjsize(current->fs);
46508 else
46509 bytes += kobjsize(current->fs);
46510 @@ -166,7 +166,7 @@ static int nommu_vma_show(struct seq_fil
46511
46512 if (file) {
46513 pad_len_spaces(m, len);
46514 - seq_path(m, &file->f_path, "");
46515 + seq_path(m, &file->f_path, "\n\\");
46516 } else if (mm) {
46517 if (vma->vm_start <= mm->start_stack &&
46518 vma->vm_end >= mm->start_stack) {
46519 diff -urNp linux-3.0.8/fs/quota/netlink.c linux-3.0.8/fs/quota/netlink.c
46520 --- linux-3.0.8/fs/quota/netlink.c 2011-07-21 22:17:23.000000000 -0400
46521 +++ linux-3.0.8/fs/quota/netlink.c 2011-08-23 21:47:56.000000000 -0400
46522 @@ -33,7 +33,7 @@ static struct genl_family quota_genl_fam
46523 void quota_send_warning(short type, unsigned int id, dev_t dev,
46524 const char warntype)
46525 {
46526 - static atomic_t seq;
46527 + static atomic_unchecked_t seq;
46528 struct sk_buff *skb;
46529 void *msg_head;
46530 int ret;
46531 @@ -49,7 +49,7 @@ void quota_send_warning(short type, unsi
46532 "VFS: Not enough memory to send quota warning.\n");
46533 return;
46534 }
46535 - msg_head = genlmsg_put(skb, 0, atomic_add_return(1, &seq),
46536 + msg_head = genlmsg_put(skb, 0, atomic_add_return_unchecked(1, &seq),
46537 &quota_genl_family, 0, QUOTA_NL_C_WARNING);
46538 if (!msg_head) {
46539 printk(KERN_ERR
46540 diff -urNp linux-3.0.8/fs/readdir.c linux-3.0.8/fs/readdir.c
46541 --- linux-3.0.8/fs/readdir.c 2011-07-21 22:17:23.000000000 -0400
46542 +++ linux-3.0.8/fs/readdir.c 2011-10-06 04:17:55.000000000 -0400
46543 @@ -17,6 +17,7 @@
46544 #include <linux/security.h>
46545 #include <linux/syscalls.h>
46546 #include <linux/unistd.h>
46547 +#include <linux/namei.h>
46548
46549 #include <asm/uaccess.h>
46550
46551 @@ -67,6 +68,7 @@ struct old_linux_dirent {
46552
46553 struct readdir_callback {
46554 struct old_linux_dirent __user * dirent;
46555 + struct file * file;
46556 int result;
46557 };
46558
46559 @@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons
46560 buf->result = -EOVERFLOW;
46561 return -EOVERFLOW;
46562 }
46563 +
46564 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
46565 + return 0;
46566 +
46567 buf->result++;
46568 dirent = buf->dirent;
46569 if (!access_ok(VERIFY_WRITE, dirent,
46570 @@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
46571
46572 buf.result = 0;
46573 buf.dirent = dirent;
46574 + buf.file = file;
46575
46576 error = vfs_readdir(file, fillonedir, &buf);
46577 if (buf.result)
46578 @@ -142,6 +149,7 @@ struct linux_dirent {
46579 struct getdents_callback {
46580 struct linux_dirent __user * current_dir;
46581 struct linux_dirent __user * previous;
46582 + struct file * file;
46583 int count;
46584 int error;
46585 };
46586 @@ -163,6 +171,10 @@ static int filldir(void * __buf, const c
46587 buf->error = -EOVERFLOW;
46588 return -EOVERFLOW;
46589 }
46590 +
46591 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
46592 + return 0;
46593 +
46594 dirent = buf->previous;
46595 if (dirent) {
46596 if (__put_user(offset, &dirent->d_off))
46597 @@ -210,6 +222,7 @@ SYSCALL_DEFINE3(getdents, unsigned int,
46598 buf.previous = NULL;
46599 buf.count = count;
46600 buf.error = 0;
46601 + buf.file = file;
46602
46603 error = vfs_readdir(file, filldir, &buf);
46604 if (error >= 0)
46605 @@ -229,6 +242,7 @@ out:
46606 struct getdents_callback64 {
46607 struct linux_dirent64 __user * current_dir;
46608 struct linux_dirent64 __user * previous;
46609 + struct file *file;
46610 int count;
46611 int error;
46612 };
46613 @@ -244,6 +258,10 @@ static int filldir64(void * __buf, const
46614 buf->error = -EINVAL; /* only used if we fail.. */
46615 if (reclen > buf->count)
46616 return -EINVAL;
46617 +
46618 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
46619 + return 0;
46620 +
46621 dirent = buf->previous;
46622 if (dirent) {
46623 if (__put_user(offset, &dirent->d_off))
46624 @@ -291,6 +309,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
46625
46626 buf.current_dir = dirent;
46627 buf.previous = NULL;
46628 + buf.file = file;
46629 buf.count = count;
46630 buf.error = 0;
46631
46632 @@ -299,7 +318,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
46633 error = buf.error;
46634 lastdirent = buf.previous;
46635 if (lastdirent) {
46636 - typeof(lastdirent->d_off) d_off = file->f_pos;
46637 + typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
46638 if (__put_user(d_off, &lastdirent->d_off))
46639 error = -EFAULT;
46640 else
46641 diff -urNp linux-3.0.8/fs/reiserfs/dir.c linux-3.0.8/fs/reiserfs/dir.c
46642 --- linux-3.0.8/fs/reiserfs/dir.c 2011-07-21 22:17:23.000000000 -0400
46643 +++ linux-3.0.8/fs/reiserfs/dir.c 2011-08-23 21:48:14.000000000 -0400
46644 @@ -66,6 +66,8 @@ int reiserfs_readdir_dentry(struct dentr
46645 struct reiserfs_dir_entry de;
46646 int ret = 0;
46647
46648 + pax_track_stack();
46649 +
46650 reiserfs_write_lock(inode->i_sb);
46651
46652 reiserfs_check_lock_depth(inode->i_sb, "readdir");
46653 diff -urNp linux-3.0.8/fs/reiserfs/do_balan.c linux-3.0.8/fs/reiserfs/do_balan.c
46654 --- linux-3.0.8/fs/reiserfs/do_balan.c 2011-07-21 22:17:23.000000000 -0400
46655 +++ linux-3.0.8/fs/reiserfs/do_balan.c 2011-08-23 21:47:56.000000000 -0400
46656 @@ -2051,7 +2051,7 @@ void do_balance(struct tree_balance *tb,
46657 return;
46658 }
46659
46660 - atomic_inc(&(fs_generation(tb->tb_sb)));
46661 + atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
46662 do_balance_starts(tb);
46663
46664 /* balance leaf returns 0 except if combining L R and S into
46665 diff -urNp linux-3.0.8/fs/reiserfs/journal.c linux-3.0.8/fs/reiserfs/journal.c
46666 --- linux-3.0.8/fs/reiserfs/journal.c 2011-07-21 22:17:23.000000000 -0400
46667 +++ linux-3.0.8/fs/reiserfs/journal.c 2011-08-23 21:48:14.000000000 -0400
46668 @@ -2299,6 +2299,8 @@ static struct buffer_head *reiserfs_brea
46669 struct buffer_head *bh;
46670 int i, j;
46671
46672 + pax_track_stack();
46673 +
46674 bh = __getblk(dev, block, bufsize);
46675 if (buffer_uptodate(bh))
46676 return (bh);
46677 diff -urNp linux-3.0.8/fs/reiserfs/namei.c linux-3.0.8/fs/reiserfs/namei.c
46678 --- linux-3.0.8/fs/reiserfs/namei.c 2011-07-21 22:17:23.000000000 -0400
46679 +++ linux-3.0.8/fs/reiserfs/namei.c 2011-08-23 21:48:14.000000000 -0400
46680 @@ -1225,6 +1225,8 @@ static int reiserfs_rename(struct inode
46681 unsigned long savelink = 1;
46682 struct timespec ctime;
46683
46684 + pax_track_stack();
46685 +
46686 /* three balancings: (1) old name removal, (2) new name insertion
46687 and (3) maybe "save" link insertion
46688 stat data updates: (1) old directory,
46689 diff -urNp linux-3.0.8/fs/reiserfs/procfs.c linux-3.0.8/fs/reiserfs/procfs.c
46690 --- linux-3.0.8/fs/reiserfs/procfs.c 2011-07-21 22:17:23.000000000 -0400
46691 +++ linux-3.0.8/fs/reiserfs/procfs.c 2011-08-23 21:48:14.000000000 -0400
46692 @@ -113,7 +113,7 @@ static int show_super(struct seq_file *m
46693 "SMALL_TAILS " : "NO_TAILS ",
46694 replay_only(sb) ? "REPLAY_ONLY " : "",
46695 convert_reiserfs(sb) ? "CONV " : "",
46696 - atomic_read(&r->s_generation_counter),
46697 + atomic_read_unchecked(&r->s_generation_counter),
46698 SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
46699 SF(s_do_balance), SF(s_unneeded_left_neighbor),
46700 SF(s_good_search_by_key_reada), SF(s_bmaps),
46701 @@ -299,6 +299,8 @@ static int show_journal(struct seq_file
46702 struct journal_params *jp = &rs->s_v1.s_journal;
46703 char b[BDEVNAME_SIZE];
46704
46705 + pax_track_stack();
46706 +
46707 seq_printf(m, /* on-disk fields */
46708 "jp_journal_1st_block: \t%i\n"
46709 "jp_journal_dev: \t%s[%x]\n"
46710 diff -urNp linux-3.0.8/fs/reiserfs/stree.c linux-3.0.8/fs/reiserfs/stree.c
46711 --- linux-3.0.8/fs/reiserfs/stree.c 2011-07-21 22:17:23.000000000 -0400
46712 +++ linux-3.0.8/fs/reiserfs/stree.c 2011-08-23 21:48:14.000000000 -0400
46713 @@ -1196,6 +1196,8 @@ int reiserfs_delete_item(struct reiserfs
46714 int iter = 0;
46715 #endif
46716
46717 + pax_track_stack();
46718 +
46719 BUG_ON(!th->t_trans_id);
46720
46721 init_tb_struct(th, &s_del_balance, sb, path,
46722 @@ -1333,6 +1335,8 @@ void reiserfs_delete_solid_item(struct r
46723 int retval;
46724 int quota_cut_bytes = 0;
46725
46726 + pax_track_stack();
46727 +
46728 BUG_ON(!th->t_trans_id);
46729
46730 le_key2cpu_key(&cpu_key, key);
46731 @@ -1562,6 +1566,8 @@ int reiserfs_cut_from_item(struct reiser
46732 int quota_cut_bytes;
46733 loff_t tail_pos = 0;
46734
46735 + pax_track_stack();
46736 +
46737 BUG_ON(!th->t_trans_id);
46738
46739 init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
46740 @@ -1957,6 +1963,8 @@ int reiserfs_paste_into_item(struct reis
46741 int retval;
46742 int fs_gen;
46743
46744 + pax_track_stack();
46745 +
46746 BUG_ON(!th->t_trans_id);
46747
46748 fs_gen = get_generation(inode->i_sb);
46749 @@ -2045,6 +2053,8 @@ int reiserfs_insert_item(struct reiserfs
46750 int fs_gen = 0;
46751 int quota_bytes = 0;
46752
46753 + pax_track_stack();
46754 +
46755 BUG_ON(!th->t_trans_id);
46756
46757 if (inode) { /* Do we count quotas for item? */
46758 diff -urNp linux-3.0.8/fs/reiserfs/super.c linux-3.0.8/fs/reiserfs/super.c
46759 --- linux-3.0.8/fs/reiserfs/super.c 2011-07-21 22:17:23.000000000 -0400
46760 +++ linux-3.0.8/fs/reiserfs/super.c 2011-08-23 21:48:14.000000000 -0400
46761 @@ -927,6 +927,8 @@ static int reiserfs_parse_options(struct
46762 {.option_name = NULL}
46763 };
46764
46765 + pax_track_stack();
46766 +
46767 *blocks = 0;
46768 if (!options || !*options)
46769 /* use default configuration: create tails, journaling on, no
46770 diff -urNp linux-3.0.8/fs/select.c linux-3.0.8/fs/select.c
46771 --- linux-3.0.8/fs/select.c 2011-07-21 22:17:23.000000000 -0400
46772 +++ linux-3.0.8/fs/select.c 2011-08-23 21:48:14.000000000 -0400
46773 @@ -20,6 +20,7 @@
46774 #include <linux/module.h>
46775 #include <linux/slab.h>
46776 #include <linux/poll.h>
46777 +#include <linux/security.h>
46778 #include <linux/personality.h> /* for STICKY_TIMEOUTS */
46779 #include <linux/file.h>
46780 #include <linux/fdtable.h>
46781 @@ -403,6 +404,8 @@ int do_select(int n, fd_set_bits *fds, s
46782 int retval, i, timed_out = 0;
46783 unsigned long slack = 0;
46784
46785 + pax_track_stack();
46786 +
46787 rcu_read_lock();
46788 retval = max_select_fd(n, fds);
46789 rcu_read_unlock();
46790 @@ -528,6 +531,8 @@ int core_sys_select(int n, fd_set __user
46791 /* Allocate small arguments on the stack to save memory and be faster */
46792 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
46793
46794 + pax_track_stack();
46795 +
46796 ret = -EINVAL;
46797 if (n < 0)
46798 goto out_nofds;
46799 @@ -837,6 +842,9 @@ int do_sys_poll(struct pollfd __user *uf
46800 struct poll_list *walk = head;
46801 unsigned long todo = nfds;
46802
46803 + pax_track_stack();
46804 +
46805 + gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
46806 if (nfds > rlimit(RLIMIT_NOFILE))
46807 return -EINVAL;
46808
46809 diff -urNp linux-3.0.8/fs/seq_file.c linux-3.0.8/fs/seq_file.c
46810 --- linux-3.0.8/fs/seq_file.c 2011-07-21 22:17:23.000000000 -0400
46811 +++ linux-3.0.8/fs/seq_file.c 2011-08-23 21:47:56.000000000 -0400
46812 @@ -76,7 +76,8 @@ static int traverse(struct seq_file *m,
46813 return 0;
46814 }
46815 if (!m->buf) {
46816 - m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
46817 + m->size = PAGE_SIZE;
46818 + m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
46819 if (!m->buf)
46820 return -ENOMEM;
46821 }
46822 @@ -116,7 +117,8 @@ static int traverse(struct seq_file *m,
46823 Eoverflow:
46824 m->op->stop(m, p);
46825 kfree(m->buf);
46826 - m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
46827 + m->size <<= 1;
46828 + m->buf = kmalloc(m->size, GFP_KERNEL);
46829 return !m->buf ? -ENOMEM : -EAGAIN;
46830 }
46831
46832 @@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char
46833 m->version = file->f_version;
46834 /* grab buffer if we didn't have one */
46835 if (!m->buf) {
46836 - m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
46837 + m->size = PAGE_SIZE;
46838 + m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
46839 if (!m->buf)
46840 goto Enomem;
46841 }
46842 @@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char
46843 goto Fill;
46844 m->op->stop(m, p);
46845 kfree(m->buf);
46846 - m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
46847 + m->size <<= 1;
46848 + m->buf = kmalloc(m->size, GFP_KERNEL);
46849 if (!m->buf)
46850 goto Enomem;
46851 m->count = 0;
46852 @@ -549,7 +553,7 @@ static void single_stop(struct seq_file
46853 int single_open(struct file *file, int (*show)(struct seq_file *, void *),
46854 void *data)
46855 {
46856 - struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL);
46857 + seq_operations_no_const *op = kmalloc(sizeof(*op), GFP_KERNEL);
46858 int res = -ENOMEM;
46859
46860 if (op) {
46861 diff -urNp linux-3.0.8/fs/splice.c linux-3.0.8/fs/splice.c
46862 --- linux-3.0.8/fs/splice.c 2011-07-21 22:17:23.000000000 -0400
46863 +++ linux-3.0.8/fs/splice.c 2011-10-06 04:17:55.000000000 -0400
46864 @@ -194,7 +194,7 @@ ssize_t splice_to_pipe(struct pipe_inode
46865 pipe_lock(pipe);
46866
46867 for (;;) {
46868 - if (!pipe->readers) {
46869 + if (!atomic_read(&pipe->readers)) {
46870 send_sig(SIGPIPE, current, 0);
46871 if (!ret)
46872 ret = -EPIPE;
46873 @@ -248,9 +248,9 @@ ssize_t splice_to_pipe(struct pipe_inode
46874 do_wakeup = 0;
46875 }
46876
46877 - pipe->waiting_writers++;
46878 + atomic_inc(&pipe->waiting_writers);
46879 pipe_wait(pipe);
46880 - pipe->waiting_writers--;
46881 + atomic_dec(&pipe->waiting_writers);
46882 }
46883
46884 pipe_unlock(pipe);
46885 @@ -320,6 +320,8 @@ __generic_file_splice_read(struct file *
46886 .spd_release = spd_release_page,
46887 };
46888
46889 + pax_track_stack();
46890 +
46891 if (splice_grow_spd(pipe, &spd))
46892 return -ENOMEM;
46893
46894 @@ -560,7 +562,7 @@ static ssize_t kernel_readv(struct file
46895 old_fs = get_fs();
46896 set_fs(get_ds());
46897 /* The cast to a user pointer is valid due to the set_fs() */
46898 - res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
46899 + res = vfs_readv(file, (const struct iovec __force_user *)vec, vlen, &pos);
46900 set_fs(old_fs);
46901
46902 return res;
46903 @@ -575,7 +577,7 @@ static ssize_t kernel_write(struct file
46904 old_fs = get_fs();
46905 set_fs(get_ds());
46906 /* The cast to a user pointer is valid due to the set_fs() */
46907 - res = vfs_write(file, (const char __user *)buf, count, &pos);
46908 + res = vfs_write(file, (const char __force_user *)buf, count, &pos);
46909 set_fs(old_fs);
46910
46911 return res;
46912 @@ -603,6 +605,8 @@ ssize_t default_file_splice_read(struct
46913 .spd_release = spd_release_page,
46914 };
46915
46916 + pax_track_stack();
46917 +
46918 if (splice_grow_spd(pipe, &spd))
46919 return -ENOMEM;
46920
46921 @@ -626,7 +630,7 @@ ssize_t default_file_splice_read(struct
46922 goto err;
46923
46924 this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
46925 - vec[i].iov_base = (void __user *) page_address(page);
46926 + vec[i].iov_base = (void __force_user *) page_address(page);
46927 vec[i].iov_len = this_len;
46928 spd.pages[i] = page;
46929 spd.nr_pages++;
46930 @@ -846,10 +850,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
46931 int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
46932 {
46933 while (!pipe->nrbufs) {
46934 - if (!pipe->writers)
46935 + if (!atomic_read(&pipe->writers))
46936 return 0;
46937
46938 - if (!pipe->waiting_writers && sd->num_spliced)
46939 + if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
46940 return 0;
46941
46942 if (sd->flags & SPLICE_F_NONBLOCK)
46943 @@ -1182,7 +1186,7 @@ ssize_t splice_direct_to_actor(struct fi
46944 * out of the pipe right after the splice_to_pipe(). So set
46945 * PIPE_READERS appropriately.
46946 */
46947 - pipe->readers = 1;
46948 + atomic_set(&pipe->readers, 1);
46949
46950 current->splice_pipe = pipe;
46951 }
46952 @@ -1619,6 +1623,8 @@ static long vmsplice_to_pipe(struct file
46953 };
46954 long ret;
46955
46956 + pax_track_stack();
46957 +
46958 pipe = get_pipe_info(file);
46959 if (!pipe)
46960 return -EBADF;
46961 @@ -1734,9 +1740,9 @@ static int ipipe_prep(struct pipe_inode_
46962 ret = -ERESTARTSYS;
46963 break;
46964 }
46965 - if (!pipe->writers)
46966 + if (!atomic_read(&pipe->writers))
46967 break;
46968 - if (!pipe->waiting_writers) {
46969 + if (!atomic_read(&pipe->waiting_writers)) {
46970 if (flags & SPLICE_F_NONBLOCK) {
46971 ret = -EAGAIN;
46972 break;
46973 @@ -1768,7 +1774,7 @@ static int opipe_prep(struct pipe_inode_
46974 pipe_lock(pipe);
46975
46976 while (pipe->nrbufs >= pipe->buffers) {
46977 - if (!pipe->readers) {
46978 + if (!atomic_read(&pipe->readers)) {
46979 send_sig(SIGPIPE, current, 0);
46980 ret = -EPIPE;
46981 break;
46982 @@ -1781,9 +1787,9 @@ static int opipe_prep(struct pipe_inode_
46983 ret = -ERESTARTSYS;
46984 break;
46985 }
46986 - pipe->waiting_writers++;
46987 + atomic_inc(&pipe->waiting_writers);
46988 pipe_wait(pipe);
46989 - pipe->waiting_writers--;
46990 + atomic_dec(&pipe->waiting_writers);
46991 }
46992
46993 pipe_unlock(pipe);
46994 @@ -1819,14 +1825,14 @@ retry:
46995 pipe_double_lock(ipipe, opipe);
46996
46997 do {
46998 - if (!opipe->readers) {
46999 + if (!atomic_read(&opipe->readers)) {
47000 send_sig(SIGPIPE, current, 0);
47001 if (!ret)
47002 ret = -EPIPE;
47003 break;
47004 }
47005
47006 - if (!ipipe->nrbufs && !ipipe->writers)
47007 + if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
47008 break;
47009
47010 /*
47011 @@ -1923,7 +1929,7 @@ static int link_pipe(struct pipe_inode_i
47012 pipe_double_lock(ipipe, opipe);
47013
47014 do {
47015 - if (!opipe->readers) {
47016 + if (!atomic_read(&opipe->readers)) {
47017 send_sig(SIGPIPE, current, 0);
47018 if (!ret)
47019 ret = -EPIPE;
47020 @@ -1968,7 +1974,7 @@ static int link_pipe(struct pipe_inode_i
47021 * return EAGAIN if we have the potential of some data in the
47022 * future, otherwise just return 0
47023 */
47024 - if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
47025 + if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
47026 ret = -EAGAIN;
47027
47028 pipe_unlock(ipipe);
47029 diff -urNp linux-3.0.8/fs/sysfs/file.c linux-3.0.8/fs/sysfs/file.c
47030 --- linux-3.0.8/fs/sysfs/file.c 2011-07-21 22:17:23.000000000 -0400
47031 +++ linux-3.0.8/fs/sysfs/file.c 2011-08-23 21:47:56.000000000 -0400
47032 @@ -37,7 +37,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent
47033
47034 struct sysfs_open_dirent {
47035 atomic_t refcnt;
47036 - atomic_t event;
47037 + atomic_unchecked_t event;
47038 wait_queue_head_t poll;
47039 struct list_head buffers; /* goes through sysfs_buffer.list */
47040 };
47041 @@ -81,7 +81,7 @@ static int fill_read_buffer(struct dentr
47042 if (!sysfs_get_active(attr_sd))
47043 return -ENODEV;
47044
47045 - buffer->event = atomic_read(&attr_sd->s_attr.open->event);
47046 + buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
47047 count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
47048
47049 sysfs_put_active(attr_sd);
47050 @@ -287,7 +287,7 @@ static int sysfs_get_open_dirent(struct
47051 return -ENOMEM;
47052
47053 atomic_set(&new_od->refcnt, 0);
47054 - atomic_set(&new_od->event, 1);
47055 + atomic_set_unchecked(&new_od->event, 1);
47056 init_waitqueue_head(&new_od->poll);
47057 INIT_LIST_HEAD(&new_od->buffers);
47058 goto retry;
47059 @@ -432,7 +432,7 @@ static unsigned int sysfs_poll(struct fi
47060
47061 sysfs_put_active(attr_sd);
47062
47063 - if (buffer->event != atomic_read(&od->event))
47064 + if (buffer->event != atomic_read_unchecked(&od->event))
47065 goto trigger;
47066
47067 return DEFAULT_POLLMASK;
47068 @@ -451,7 +451,7 @@ void sysfs_notify_dirent(struct sysfs_di
47069
47070 od = sd->s_attr.open;
47071 if (od) {
47072 - atomic_inc(&od->event);
47073 + atomic_inc_unchecked(&od->event);
47074 wake_up_interruptible(&od->poll);
47075 }
47076
47077 diff -urNp linux-3.0.8/fs/sysfs/mount.c linux-3.0.8/fs/sysfs/mount.c
47078 --- linux-3.0.8/fs/sysfs/mount.c 2011-07-21 22:17:23.000000000 -0400
47079 +++ linux-3.0.8/fs/sysfs/mount.c 2011-08-23 21:48:14.000000000 -0400
47080 @@ -36,7 +36,11 @@ struct sysfs_dirent sysfs_root = {
47081 .s_name = "",
47082 .s_count = ATOMIC_INIT(1),
47083 .s_flags = SYSFS_DIR | (KOBJ_NS_TYPE_NONE << SYSFS_NS_TYPE_SHIFT),
47084 +#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
47085 + .s_mode = S_IFDIR | S_IRWXU,
47086 +#else
47087 .s_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
47088 +#endif
47089 .s_ino = 1,
47090 };
47091
47092 diff -urNp linux-3.0.8/fs/sysfs/symlink.c linux-3.0.8/fs/sysfs/symlink.c
47093 --- linux-3.0.8/fs/sysfs/symlink.c 2011-07-21 22:17:23.000000000 -0400
47094 +++ linux-3.0.8/fs/sysfs/symlink.c 2011-08-23 21:47:56.000000000 -0400
47095 @@ -286,7 +286,7 @@ static void *sysfs_follow_link(struct de
47096
47097 static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
47098 {
47099 - char *page = nd_get_link(nd);
47100 + const char *page = nd_get_link(nd);
47101 if (!IS_ERR(page))
47102 free_page((unsigned long)page);
47103 }
47104 diff -urNp linux-3.0.8/fs/udf/inode.c linux-3.0.8/fs/udf/inode.c
47105 --- linux-3.0.8/fs/udf/inode.c 2011-07-21 22:17:23.000000000 -0400
47106 +++ linux-3.0.8/fs/udf/inode.c 2011-08-23 21:48:14.000000000 -0400
47107 @@ -560,6 +560,8 @@ static struct buffer_head *inode_getblk(
47108 int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
47109 int lastblock = 0;
47110
47111 + pax_track_stack();
47112 +
47113 prev_epos.offset = udf_file_entry_alloc_offset(inode);
47114 prev_epos.block = iinfo->i_location;
47115 prev_epos.bh = NULL;
47116 diff -urNp linux-3.0.8/fs/udf/misc.c linux-3.0.8/fs/udf/misc.c
47117 --- linux-3.0.8/fs/udf/misc.c 2011-07-21 22:17:23.000000000 -0400
47118 +++ linux-3.0.8/fs/udf/misc.c 2011-08-23 21:47:56.000000000 -0400
47119 @@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t id
47120
47121 u8 udf_tag_checksum(const struct tag *t)
47122 {
47123 - u8 *data = (u8 *)t;
47124 + const u8 *data = (const u8 *)t;
47125 u8 checksum = 0;
47126 int i;
47127 for (i = 0; i < sizeof(struct tag); ++i)
47128 diff -urNp linux-3.0.8/fs/utimes.c linux-3.0.8/fs/utimes.c
47129 --- linux-3.0.8/fs/utimes.c 2011-07-21 22:17:23.000000000 -0400
47130 +++ linux-3.0.8/fs/utimes.c 2011-08-23 21:48:14.000000000 -0400
47131 @@ -1,6 +1,7 @@
47132 #include <linux/compiler.h>
47133 #include <linux/file.h>
47134 #include <linux/fs.h>
47135 +#include <linux/security.h>
47136 #include <linux/linkage.h>
47137 #include <linux/mount.h>
47138 #include <linux/namei.h>
47139 @@ -101,6 +102,12 @@ static int utimes_common(struct path *pa
47140 goto mnt_drop_write_and_out;
47141 }
47142 }
47143 +
47144 + if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
47145 + error = -EACCES;
47146 + goto mnt_drop_write_and_out;
47147 + }
47148 +
47149 mutex_lock(&inode->i_mutex);
47150 error = notify_change(path->dentry, &newattrs);
47151 mutex_unlock(&inode->i_mutex);
47152 diff -urNp linux-3.0.8/fs/xattr_acl.c linux-3.0.8/fs/xattr_acl.c
47153 --- linux-3.0.8/fs/xattr_acl.c 2011-07-21 22:17:23.000000000 -0400
47154 +++ linux-3.0.8/fs/xattr_acl.c 2011-08-23 21:47:56.000000000 -0400
47155 @@ -17,8 +17,8 @@
47156 struct posix_acl *
47157 posix_acl_from_xattr(const void *value, size_t size)
47158 {
47159 - posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
47160 - posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
47161 + const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
47162 + const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
47163 int count;
47164 struct posix_acl *acl;
47165 struct posix_acl_entry *acl_e;
47166 diff -urNp linux-3.0.8/fs/xattr.c linux-3.0.8/fs/xattr.c
47167 --- linux-3.0.8/fs/xattr.c 2011-07-21 22:17:23.000000000 -0400
47168 +++ linux-3.0.8/fs/xattr.c 2011-08-23 21:48:14.000000000 -0400
47169 @@ -254,7 +254,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
47170 * Extended attribute SET operations
47171 */
47172 static long
47173 -setxattr(struct dentry *d, const char __user *name, const void __user *value,
47174 +setxattr(struct path *path, const char __user *name, const void __user *value,
47175 size_t size, int flags)
47176 {
47177 int error;
47178 @@ -278,7 +278,13 @@ setxattr(struct dentry *d, const char __
47179 return PTR_ERR(kvalue);
47180 }
47181
47182 - error = vfs_setxattr(d, kname, kvalue, size, flags);
47183 + if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
47184 + error = -EACCES;
47185 + goto out;
47186 + }
47187 +
47188 + error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
47189 +out:
47190 kfree(kvalue);
47191 return error;
47192 }
47193 @@ -295,7 +301,7 @@ SYSCALL_DEFINE5(setxattr, const char __u
47194 return error;
47195 error = mnt_want_write(path.mnt);
47196 if (!error) {
47197 - error = setxattr(path.dentry, name, value, size, flags);
47198 + error = setxattr(&path, name, value, size, flags);
47199 mnt_drop_write(path.mnt);
47200 }
47201 path_put(&path);
47202 @@ -314,7 +320,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __
47203 return error;
47204 error = mnt_want_write(path.mnt);
47205 if (!error) {
47206 - error = setxattr(path.dentry, name, value, size, flags);
47207 + error = setxattr(&path, name, value, size, flags);
47208 mnt_drop_write(path.mnt);
47209 }
47210 path_put(&path);
47211 @@ -325,17 +331,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, cons
47212 const void __user *,value, size_t, size, int, flags)
47213 {
47214 struct file *f;
47215 - struct dentry *dentry;
47216 int error = -EBADF;
47217
47218 f = fget(fd);
47219 if (!f)
47220 return error;
47221 - dentry = f->f_path.dentry;
47222 - audit_inode(NULL, dentry);
47223 + audit_inode(NULL, f->f_path.dentry);
47224 error = mnt_want_write_file(f);
47225 if (!error) {
47226 - error = setxattr(dentry, name, value, size, flags);
47227 + error = setxattr(&f->f_path, name, value, size, flags);
47228 mnt_drop_write(f->f_path.mnt);
47229 }
47230 fput(f);
47231 diff -urNp linux-3.0.8/fs/xfs/linux-2.6/xfs_ioctl32.c linux-3.0.8/fs/xfs/linux-2.6/xfs_ioctl32.c
47232 --- linux-3.0.8/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-07-21 22:17:23.000000000 -0400
47233 +++ linux-3.0.8/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-08-23 21:48:14.000000000 -0400
47234 @@ -73,6 +73,7 @@ xfs_compat_ioc_fsgeometry_v1(
47235 xfs_fsop_geom_t fsgeo;
47236 int error;
47237
47238 + memset(&fsgeo, 0, sizeof(fsgeo));
47239 error = xfs_fs_geometry(mp, &fsgeo, 3);
47240 if (error)
47241 return -error;
47242 diff -urNp linux-3.0.8/fs/xfs/linux-2.6/xfs_ioctl.c linux-3.0.8/fs/xfs/linux-2.6/xfs_ioctl.c
47243 --- linux-3.0.8/fs/xfs/linux-2.6/xfs_ioctl.c 2011-07-21 22:17:23.000000000 -0400
47244 +++ linux-3.0.8/fs/xfs/linux-2.6/xfs_ioctl.c 2011-08-23 21:47:56.000000000 -0400
47245 @@ -128,7 +128,7 @@ xfs_find_handle(
47246 }
47247
47248 error = -EFAULT;
47249 - if (copy_to_user(hreq->ohandle, &handle, hsize) ||
47250 + if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
47251 copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
47252 goto out_put;
47253
47254 diff -urNp linux-3.0.8/fs/xfs/linux-2.6/xfs_iops.c linux-3.0.8/fs/xfs/linux-2.6/xfs_iops.c
47255 --- linux-3.0.8/fs/xfs/linux-2.6/xfs_iops.c 2011-07-21 22:17:23.000000000 -0400
47256 +++ linux-3.0.8/fs/xfs/linux-2.6/xfs_iops.c 2011-08-23 21:47:56.000000000 -0400
47257 @@ -437,7 +437,7 @@ xfs_vn_put_link(
47258 struct nameidata *nd,
47259 void *p)
47260 {
47261 - char *s = nd_get_link(nd);
47262 + const char *s = nd_get_link(nd);
47263
47264 if (!IS_ERR(s))
47265 kfree(s);
47266 diff -urNp linux-3.0.8/fs/xfs/xfs_bmap.c linux-3.0.8/fs/xfs/xfs_bmap.c
47267 --- linux-3.0.8/fs/xfs/xfs_bmap.c 2011-07-21 22:17:23.000000000 -0400
47268 +++ linux-3.0.8/fs/xfs/xfs_bmap.c 2011-08-23 21:47:56.000000000 -0400
47269 @@ -253,7 +253,7 @@ xfs_bmap_validate_ret(
47270 int nmap,
47271 int ret_nmap);
47272 #else
47273 -#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
47274 +#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
47275 #endif /* DEBUG */
47276
47277 STATIC int
47278 diff -urNp linux-3.0.8/fs/xfs/xfs_dir2_sf.c linux-3.0.8/fs/xfs/xfs_dir2_sf.c
47279 --- linux-3.0.8/fs/xfs/xfs_dir2_sf.c 2011-07-21 22:17:23.000000000 -0400
47280 +++ linux-3.0.8/fs/xfs/xfs_dir2_sf.c 2011-08-23 21:47:56.000000000 -0400
47281 @@ -780,7 +780,15 @@ xfs_dir2_sf_getdents(
47282 }
47283
47284 ino = xfs_dir2_sf_get_inumber(sfp, xfs_dir2_sf_inumberp(sfep));
47285 - if (filldir(dirent, (char *)sfep->name, sfep->namelen,
47286 + if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
47287 + char name[sfep->namelen];
47288 + memcpy(name, sfep->name, sfep->namelen);
47289 + if (filldir(dirent, name, sfep->namelen,
47290 + off & 0x7fffffff, ino, DT_UNKNOWN)) {
47291 + *offset = off & 0x7fffffff;
47292 + return 0;
47293 + }
47294 + } else if (filldir(dirent, (char *)sfep->name, sfep->namelen,
47295 off & 0x7fffffff, ino, DT_UNKNOWN)) {
47296 *offset = off & 0x7fffffff;
47297 return 0;
47298 diff -urNp linux-3.0.8/grsecurity/gracl_alloc.c linux-3.0.8/grsecurity/gracl_alloc.c
47299 --- linux-3.0.8/grsecurity/gracl_alloc.c 1969-12-31 19:00:00.000000000 -0500
47300 +++ linux-3.0.8/grsecurity/gracl_alloc.c 2011-08-23 21:48:14.000000000 -0400
47301 @@ -0,0 +1,105 @@
47302 +#include <linux/kernel.h>
47303 +#include <linux/mm.h>
47304 +#include <linux/slab.h>
47305 +#include <linux/vmalloc.h>
47306 +#include <linux/gracl.h>
47307 +#include <linux/grsecurity.h>
47308 +
47309 +static unsigned long alloc_stack_next = 1;
47310 +static unsigned long alloc_stack_size = 1;
47311 +static void **alloc_stack;
47312 +
47313 +static __inline__ int
47314 +alloc_pop(void)
47315 +{
47316 + if (alloc_stack_next == 1)
47317 + return 0;
47318 +
47319 + kfree(alloc_stack[alloc_stack_next - 2]);
47320 +
47321 + alloc_stack_next--;
47322 +
47323 + return 1;
47324 +}
47325 +
47326 +static __inline__ int
47327 +alloc_push(void *buf)
47328 +{
47329 + if (alloc_stack_next >= alloc_stack_size)
47330 + return 1;
47331 +
47332 + alloc_stack[alloc_stack_next - 1] = buf;
47333 +
47334 + alloc_stack_next++;
47335 +
47336 + return 0;
47337 +}
47338 +
47339 +void *
47340 +acl_alloc(unsigned long len)
47341 +{
47342 + void *ret = NULL;
47343 +
47344 + if (!len || len > PAGE_SIZE)
47345 + goto out;
47346 +
47347 + ret = kmalloc(len, GFP_KERNEL);
47348 +
47349 + if (ret) {
47350 + if (alloc_push(ret)) {
47351 + kfree(ret);
47352 + ret = NULL;
47353 + }
47354 + }
47355 +
47356 +out:
47357 + return ret;
47358 +}
47359 +
47360 +void *
47361 +acl_alloc_num(unsigned long num, unsigned long len)
47362 +{
47363 + if (!len || (num > (PAGE_SIZE / len)))
47364 + return NULL;
47365 +
47366 + return acl_alloc(num * len);
47367 +}
47368 +
47369 +void
47370 +acl_free_all(void)
47371 +{
47372 + if (gr_acl_is_enabled() || !alloc_stack)
47373 + return;
47374 +
47375 + while (alloc_pop()) ;
47376 +
47377 + if (alloc_stack) {
47378 + if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
47379 + kfree(alloc_stack);
47380 + else
47381 + vfree(alloc_stack);
47382 + }
47383 +
47384 + alloc_stack = NULL;
47385 + alloc_stack_size = 1;
47386 + alloc_stack_next = 1;
47387 +
47388 + return;
47389 +}
47390 +
47391 +int
47392 +acl_alloc_stack_init(unsigned long size)
47393 +{
47394 + if ((size * sizeof (void *)) <= PAGE_SIZE)
47395 + alloc_stack =
47396 + (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
47397 + else
47398 + alloc_stack = (void **) vmalloc(size * sizeof (void *));
47399 +
47400 + alloc_stack_size = size;
47401 +
47402 + if (!alloc_stack)
47403 + return 0;
47404 + else
47405 + return 1;
47406 +}
47407 diff -urNp linux-3.0.8/grsecurity/gracl.c linux-3.0.8/grsecurity/gracl.c
47408 --- linux-3.0.8/grsecurity/gracl.c 1969-12-31 19:00:00.000000000 -0500
47409 +++ linux-3.0.8/grsecurity/gracl.c 2011-10-17 06:42:59.000000000 -0400
47410 @@ -0,0 +1,4154 @@
47411 +#include <linux/kernel.h>
47412 +#include <linux/module.h>
47413 +#include <linux/sched.h>
47414 +#include <linux/mm.h>
47415 +#include <linux/file.h>
47416 +#include <linux/fs.h>
47417 +#include <linux/namei.h>
47418 +#include <linux/mount.h>
47419 +#include <linux/tty.h>
47420 +#include <linux/proc_fs.h>
47421 +#include <linux/lglock.h>
47422 +#include <linux/slab.h>
47423 +#include <linux/vmalloc.h>
47424 +#include <linux/types.h>
47425 +#include <linux/sysctl.h>
47426 +#include <linux/netdevice.h>
47427 +#include <linux/ptrace.h>
47428 +#include <linux/gracl.h>
47429 +#include <linux/gralloc.h>
47430 +#include <linux/grsecurity.h>
47431 +#include <linux/grinternal.h>
47432 +#include <linux/pid_namespace.h>
47433 +#include <linux/fdtable.h>
47434 +#include <linux/percpu.h>
47435 +
47436 +#include <asm/uaccess.h>
47437 +#include <asm/errno.h>
47438 +#include <asm/mman.h>
47439 +
47440 +static struct acl_role_db acl_role_set;
47441 +static struct name_db name_set;
47442 +static struct inodev_db inodev_set;
47443 +
47444 +/* for keeping track of userspace pointers used for subjects, so we
47445 + can share references in the kernel as well
47446 +*/
47447 +
47448 +static struct path real_root;
47449 +
47450 +static struct acl_subj_map_db subj_map_set;
47451 +
47452 +static struct acl_role_label *default_role;
47453 +
47454 +static struct acl_role_label *role_list;
47455 +
47456 +static u16 acl_sp_role_value;
47457 +
47458 +extern char *gr_shared_page[4];
47459 +static DEFINE_MUTEX(gr_dev_mutex);
47460 +DEFINE_RWLOCK(gr_inode_lock);
47461 +
47462 +struct gr_arg *gr_usermode;
47463 +
47464 +static unsigned int gr_status __read_only = GR_STATUS_INIT;
47465 +
47466 +extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
47467 +extern void gr_clear_learn_entries(void);
47468 +
47469 +#ifdef CONFIG_GRKERNSEC_RESLOG
47470 +extern void gr_log_resource(const struct task_struct *task,
47471 + const int res, const unsigned long wanted, const int gt);
47472 +#endif
47473 +
47474 +unsigned char *gr_system_salt;
47475 +unsigned char *gr_system_sum;
47476 +
47477 +static struct sprole_pw **acl_special_roles = NULL;
47478 +static __u16 num_sprole_pws = 0;
47479 +
47480 +static struct acl_role_label *kernel_role = NULL;
47481 +
47482 +static unsigned int gr_auth_attempts = 0;
47483 +static unsigned long gr_auth_expires = 0UL;
47484 +
47485 +#ifdef CONFIG_NET
47486 +extern struct vfsmount *sock_mnt;
47487 +#endif
47488 +
47489 +extern struct vfsmount *pipe_mnt;
47490 +extern struct vfsmount *shm_mnt;
47491 +#ifdef CONFIG_HUGETLBFS
47492 +extern struct vfsmount *hugetlbfs_vfsmount;
47493 +#endif
47494 +
47495 +static struct acl_object_label *fakefs_obj_rw;
47496 +static struct acl_object_label *fakefs_obj_rwx;
47497 +
47498 +extern int gr_init_uidset(void);
47499 +extern void gr_free_uidset(void);
47500 +extern void gr_remove_uid(uid_t uid);
47501 +extern int gr_find_uid(uid_t uid);
47502 +
47503 +DECLARE_BRLOCK(vfsmount_lock);
47504 +
47505 +__inline__ int
47506 +gr_acl_is_enabled(void)
47507 +{
47508 + return (gr_status & GR_READY);
47509 +}
47510 +
47511 +#ifdef CONFIG_BTRFS_FS
47512 +extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
47513 +extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
47514 +#endif
47515 +
47516 +static inline dev_t __get_dev(const struct dentry *dentry)
47517 +{
47518 +#ifdef CONFIG_BTRFS_FS
47519 + if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
47520 + return get_btrfs_dev_from_inode(dentry->d_inode);
47521 + else
47522 +#endif
47523 + return dentry->d_inode->i_sb->s_dev;
47524 +}
47525 +
47526 +dev_t gr_get_dev_from_dentry(struct dentry *dentry)
47527 +{
47528 + return __get_dev(dentry);
47529 +}
47530 +
47531 +static char gr_task_roletype_to_char(struct task_struct *task)
47532 +{
47533 + switch (task->role->roletype &
47534 + (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
47535 + GR_ROLE_SPECIAL)) {
47536 + case GR_ROLE_DEFAULT:
47537 + return 'D';
47538 + case GR_ROLE_USER:
47539 + return 'U';
47540 + case GR_ROLE_GROUP:
47541 + return 'G';
47542 + case GR_ROLE_SPECIAL:
47543 + return 'S';
47544 + }
47545 +
47546 + return 'X';
47547 +}
47548 +
47549 +char gr_roletype_to_char(void)
47550 +{
47551 + return gr_task_roletype_to_char(current);
47552 +}
47553 +
47554 +__inline__ int
47555 +gr_acl_tpe_check(void)
47556 +{
47557 + if (unlikely(!(gr_status & GR_READY)))
47558 + return 0;
47559 + if (current->role->roletype & GR_ROLE_TPE)
47560 + return 1;
47561 + else
47562 + return 0;
47563 +}
47564 +
47565 +int
47566 +gr_handle_rawio(const struct inode *inode)
47567 +{
47568 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
47569 + if (inode && S_ISBLK(inode->i_mode) &&
47570 + grsec_enable_chroot_caps && proc_is_chrooted(current) &&
47571 + !capable(CAP_SYS_RAWIO))
47572 + return 1;
47573 +#endif
47574 + return 0;
47575 +}
47576 +
47577 +static int
47578 +gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
47579 +{
47580 + if (likely(lena != lenb))
47581 + return 0;
47582 +
47583 + return !memcmp(a, b, lena);
47584 +}
47585 +
47586 +static int prepend(char **buffer, int *buflen, const char *str, int namelen)
47587 +{
47588 + *buflen -= namelen;
47589 + if (*buflen < 0)
47590 + return -ENAMETOOLONG;
47591 + *buffer -= namelen;
47592 + memcpy(*buffer, str, namelen);
47593 + return 0;
47594 +}
47595 +
47596 +static int prepend_name(char **buffer, int *buflen, struct qstr *name)
47597 +{
47598 + return prepend(buffer, buflen, name->name, name->len);
47599 +}
47600 +
47601 +static int prepend_path(const struct path *path, struct path *root,
47602 + char **buffer, int *buflen)
47603 +{
47604 + struct dentry *dentry = path->dentry;
47605 + struct vfsmount *vfsmnt = path->mnt;
47606 + bool slash = false;
47607 + int error = 0;
47608 +
47609 + while (dentry != root->dentry || vfsmnt != root->mnt) {
47610 + struct dentry * parent;
47611 +
47612 + if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
47613 + /* Global root? */
47614 + if (vfsmnt->mnt_parent == vfsmnt) {
47615 + goto out;
47616 + }
47617 + dentry = vfsmnt->mnt_mountpoint;
47618 + vfsmnt = vfsmnt->mnt_parent;
47619 + continue;
47620 + }
47621 + parent = dentry->d_parent;
47622 + prefetch(parent);
47623 + spin_lock(&dentry->d_lock);
47624 + error = prepend_name(buffer, buflen, &dentry->d_name);
47625 + spin_unlock(&dentry->d_lock);
47626 + if (!error)
47627 + error = prepend(buffer, buflen, "/", 1);
47628 + if (error)
47629 + break;
47630 +
47631 + slash = true;
47632 + dentry = parent;
47633 + }
47634 +
47635 +out:
47636 + if (!error && !slash)
47637 + error = prepend(buffer, buflen, "/", 1);
47638 +
47639 + return error;
47640 +}
47641 +
47642 +/* this must be called with vfsmount_lock and rename_lock held */
47643 +
47644 +static char *__our_d_path(const struct path *path, struct path *root,
47645 + char *buf, int buflen)
47646 +{
47647 + char *res = buf + buflen;
47648 + int error;
47649 +
47650 + prepend(&res, &buflen, "\0", 1);
47651 + error = prepend_path(path, root, &res, &buflen);
47652 + if (error)
47653 + return ERR_PTR(error);
47654 +
47655 + return res;
47656 +}
47657 +
47658 +static char *
47659 +gen_full_path(struct path *path, struct path *root, char *buf, int buflen)
47660 +{
47661 + char *retval;
47662 +
47663 + retval = __our_d_path(path, root, buf, buflen);
47664 + if (unlikely(IS_ERR(retval)))
47665 + retval = strcpy(buf, "<path too long>");
47666 + else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
47667 + retval[1] = '\0';
47668 +
47669 + return retval;
47670 +}
47671 +
47672 +static char *
47673 +__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
47674 + char *buf, int buflen)
47675 +{
47676 + struct path path;
47677 + char *res;
47678 +
47679 + path.dentry = (struct dentry *)dentry;
47680 + path.mnt = (struct vfsmount *)vfsmnt;
47681 +
47682 + /* we can use real_root.dentry, real_root.mnt, because this is only called
47683 + by the RBAC system */
47684 + res = gen_full_path(&path, &real_root, buf, buflen);
47685 +
47686 + return res;
47687 +}
47688 +
47689 +static char *
47690 +d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
47691 + char *buf, int buflen)
47692 +{
47693 + char *res;
47694 + struct path path;
47695 + struct path root;
47696 + struct task_struct *reaper = &init_task;
47697 +
47698 + path.dentry = (struct dentry *)dentry;
47699 + path.mnt = (struct vfsmount *)vfsmnt;
47700 +
47701 + /* we can't use real_root.dentry, real_root.mnt, because they belong only to the RBAC system */
47702 + get_fs_root(reaper->fs, &root);
47703 +
47704 + write_seqlock(&rename_lock);
47705 + br_read_lock(vfsmount_lock);
47706 + res = gen_full_path(&path, &root, buf, buflen);
47707 + br_read_unlock(vfsmount_lock);
47708 + write_sequnlock(&rename_lock);
47709 +
47710 + path_put(&root);
47711 + return res;
47712 +}
47713 +
47714 +static char *
47715 +gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
47716 +{
47717 + char *ret;
47718 + write_seqlock(&rename_lock);
47719 + br_read_lock(vfsmount_lock);
47720 + ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
47721 + PAGE_SIZE);
47722 + br_read_unlock(vfsmount_lock);
47723 + write_sequnlock(&rename_lock);
47724 + return ret;
47725 +}
47726 +
47727 +static char *
47728 +gr_to_proc_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
47729 +{
47730 + char *ret;
47731 + char *buf;
47732 + int buflen;
47733 +
47734 + write_seqlock(&rename_lock);
47735 + br_read_lock(vfsmount_lock);
47736 + buf = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
47737 + ret = __d_real_path(dentry, mnt, buf, PAGE_SIZE - 6);
47738 + buflen = (int)(ret - buf);
47739 + if (buflen >= 5)
47740 + prepend(&ret, &buflen, "/proc", 5);
47741 + else
47742 + ret = strcpy(buf, "<path too long>");
47743 + br_read_unlock(vfsmount_lock);
47744 + write_sequnlock(&rename_lock);
47745 + return ret;
47746 +}
47747 +
47748 +char *
47749 +gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
47750 +{
47751 + return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
47752 + PAGE_SIZE);
47753 +}
47754 +
47755 +char *
47756 +gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
47757 +{
47758 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
47759 + PAGE_SIZE);
47760 +}
47761 +
47762 +char *
47763 +gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
47764 +{
47765 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
47766 + PAGE_SIZE);
47767 +}
47768 +
47769 +char *
47770 +gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
47771 +{
47772 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
47773 + PAGE_SIZE);
47774 +}
47775 +
47776 +char *
47777 +gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
47778 +{
47779 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
47780 + PAGE_SIZE);
47781 +}
47782 +
47783 +__inline__ __u32
47784 +to_gr_audit(const __u32 reqmode)
47785 +{
47786 + /* masks off auditable permission flags, then shifts them to create
47787 + auditing flags, and adds the special case of append auditing if
47788 + we're requesting write */
47789 + return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
47790 +}
47791 +
47792 +struct acl_subject_label *
47793 +lookup_subject_map(const struct acl_subject_label *userp)
47794 +{
47795 + unsigned int index = shash(userp, subj_map_set.s_size);
47796 + struct subject_map *match;
47797 +
47798 + match = subj_map_set.s_hash[index];
47799 +
47800 + while (match && match->user != userp)
47801 + match = match->next;
47802 +
47803 + if (match != NULL)
47804 + return match->kernel;
47805 + else
47806 + return NULL;
47807 +}
47808 +
47809 +static void
47810 +insert_subj_map_entry(struct subject_map *subjmap)
47811 +{
47812 + unsigned int index = shash(subjmap->user, subj_map_set.s_size);
47813 + struct subject_map **curr;
47814 +
47815 + subjmap->prev = NULL;
47816 +
47817 + curr = &subj_map_set.s_hash[index];
47818 + if (*curr != NULL)
47819 + (*curr)->prev = subjmap;
47820 +
47821 + subjmap->next = *curr;
47822 + *curr = subjmap;
47823 +
47824 + return;
47825 +}
47826 +
47827 +static struct acl_role_label *
47828 +lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
47829 + const gid_t gid)
47830 +{
47831 + unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
47832 + struct acl_role_label *match;
47833 + struct role_allowed_ip *ipp;
47834 + unsigned int x;
47835 + u32 curr_ip = task->signal->curr_ip;
47836 +
47837 + task->signal->saved_ip = curr_ip;
47838 +
47839 + match = acl_role_set.r_hash[index];
47840 +
47841 + while (match) {
47842 + if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
47843 + for (x = 0; x < match->domain_child_num; x++) {
47844 + if (match->domain_children[x] == uid)
47845 + goto found;
47846 + }
47847 + } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
47848 + break;
47849 + match = match->next;
47850 + }
47851 +found:
47852 + if (match == NULL) {
47853 + try_group:
47854 + index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
47855 + match = acl_role_set.r_hash[index];
47856 +
47857 + while (match) {
47858 + if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
47859 + for (x = 0; x < match->domain_child_num; x++) {
47860 + if (match->domain_children[x] == gid)
47861 + goto found2;
47862 + }
47863 + } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
47864 + break;
47865 + match = match->next;
47866 + }
47867 +found2:
47868 + if (match == NULL)
47869 + match = default_role;
47870 + if (match->allowed_ips == NULL)
47871 + return match;
47872 + else {
47873 + for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
47874 + if (likely
47875 + ((ntohl(curr_ip) & ipp->netmask) ==
47876 + (ntohl(ipp->addr) & ipp->netmask)))
47877 + return match;
47878 + }
47879 + match = default_role;
47880 + }
47881 + } else if (match->allowed_ips == NULL) {
47882 + return match;
47883 + } else {
47884 + for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
47885 + if (likely
47886 + ((ntohl(curr_ip) & ipp->netmask) ==
47887 + (ntohl(ipp->addr) & ipp->netmask)))
47888 + return match;
47889 + }
47890 + goto try_group;
47891 + }
47892 +
47893 + return match;
47894 +}
47895 +
47896 +struct acl_subject_label *
47897 +lookup_acl_subj_label(const ino_t ino, const dev_t dev,
47898 + const struct acl_role_label *role)
47899 +{
47900 + unsigned int index = fhash(ino, dev, role->subj_hash_size);
47901 + struct acl_subject_label *match;
47902 +
47903 + match = role->subj_hash[index];
47904 +
47905 + while (match && (match->inode != ino || match->device != dev ||
47906 + (match->mode & GR_DELETED))) {
47907 + match = match->next;
47908 + }
47909 +
47910 + if (match && !(match->mode & GR_DELETED))
47911 + return match;
47912 + else
47913 + return NULL;
47914 +}
47915 +
47916 +struct acl_subject_label *
47917 +lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
47918 + const struct acl_role_label *role)
47919 +{
47920 + unsigned int index = fhash(ino, dev, role->subj_hash_size);
47921 + struct acl_subject_label *match;
47922 +
47923 + match = role->subj_hash[index];
47924 +
47925 + while (match && (match->inode != ino || match->device != dev ||
47926 + !(match->mode & GR_DELETED))) {
47927 + match = match->next;
47928 + }
47929 +
47930 + if (match && (match->mode & GR_DELETED))
47931 + return match;
47932 + else
47933 + return NULL;
47934 +}
47935 +
47936 +static struct acl_object_label *
47937 +lookup_acl_obj_label(const ino_t ino, const dev_t dev,
47938 + const struct acl_subject_label *subj)
47939 +{
47940 + unsigned int index = fhash(ino, dev, subj->obj_hash_size);
47941 + struct acl_object_label *match;
47942 +
47943 + match = subj->obj_hash[index];
47944 +
47945 + while (match && (match->inode != ino || match->device != dev ||
47946 + (match->mode & GR_DELETED))) {
47947 + match = match->next;
47948 + }
47949 +
47950 + if (match && !(match->mode & GR_DELETED))
47951 + return match;
47952 + else
47953 + return NULL;
47954 +}
47955 +
47956 +static struct acl_object_label *
47957 +lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
47958 + const struct acl_subject_label *subj)
47959 +{
47960 + unsigned int index = fhash(ino, dev, subj->obj_hash_size);
47961 + struct acl_object_label *match;
47962 +
47963 + match = subj->obj_hash[index];
47964 +
47965 + while (match && (match->inode != ino || match->device != dev ||
47966 + !(match->mode & GR_DELETED))) {
47967 + match = match->next;
47968 + }
47969 +
47970 + if (match && (match->mode & GR_DELETED))
47971 + return match;
47972 +
47973 + match = subj->obj_hash[index];
47974 +
47975 + while (match && (match->inode != ino || match->device != dev ||
47976 + (match->mode & GR_DELETED))) {
47977 + match = match->next;
47978 + }
47979 +
47980 + if (match && !(match->mode & GR_DELETED))
47981 + return match;
47982 + else
47983 + return NULL;
47984 +}
47985 +
47986 +static struct name_entry *
47987 +lookup_name_entry(const char *name)
47988 +{
47989 + unsigned int len = strlen(name);
47990 + unsigned int key = full_name_hash(name, len);
47991 + unsigned int index = key % name_set.n_size;
47992 + struct name_entry *match;
47993 +
47994 + match = name_set.n_hash[index];
47995 +
47996 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
47997 + match = match->next;
47998 +
47999 + return match;
48000 +}
48001 +
48002 +static struct name_entry *
48003 +lookup_name_entry_create(const char *name)
48004 +{
48005 + unsigned int len = strlen(name);
48006 + unsigned int key = full_name_hash(name, len);
48007 + unsigned int index = key % name_set.n_size;
48008 + struct name_entry *match;
48009 +
48010 + match = name_set.n_hash[index];
48011 +
48012 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
48013 + !match->deleted))
48014 + match = match->next;
48015 +
48016 + if (match && match->deleted)
48017 + return match;
48018 +
48019 + match = name_set.n_hash[index];
48020 +
48021 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
48022 + match->deleted))
48023 + match = match->next;
48024 +
48025 + if (match && !match->deleted)
48026 + return match;
48027 + else
48028 + return NULL;
48029 +}
48030 +
48031 +static struct inodev_entry *
48032 +lookup_inodev_entry(const ino_t ino, const dev_t dev)
48033 +{
48034 + unsigned int index = fhash(ino, dev, inodev_set.i_size);
48035 + struct inodev_entry *match;
48036 +
48037 + match = inodev_set.i_hash[index];
48038 +
48039 + while (match && (match->nentry->inode != ino || match->nentry->device != dev))
48040 + match = match->next;
48041 +
48042 + return match;
48043 +}
48044 +
48045 +static void
48046 +insert_inodev_entry(struct inodev_entry *entry)
48047 +{
48048 + unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
48049 + inodev_set.i_size);
48050 + struct inodev_entry **curr;
48051 +
48052 + entry->prev = NULL;
48053 +
48054 + curr = &inodev_set.i_hash[index];
48055 + if (*curr != NULL)
48056 + (*curr)->prev = entry;
48057 +
48058 + entry->next = *curr;
48059 + *curr = entry;
48060 +
48061 + return;
48062 +}
48063 +
48064 +static void
48065 +__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
48066 +{
48067 + unsigned int index =
48068 + rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
48069 + struct acl_role_label **curr;
48070 + struct acl_role_label *tmp;
48071 +
48072 + curr = &acl_role_set.r_hash[index];
48073 +
48074 + /* if role was already inserted due to domains and already has
48075 + a role in the same bucket as it attached, then we need to
48076 + combine these two buckets
48077 + */
48078 + if (role->next) {
48079 + tmp = role->next;
48080 + while (tmp->next)
48081 + tmp = tmp->next;
48082 + tmp->next = *curr;
48083 + } else
48084 + role->next = *curr;
48085 + *curr = role;
48086 +
48087 + return;
48088 +}
48089 +
48090 +static void
48091 +insert_acl_role_label(struct acl_role_label *role)
48092 +{
48093 + int i;
48094 +
48095 + if (role_list == NULL) {
48096 + role_list = role;
48097 + role->prev = NULL;
48098 + } else {
48099 + role->prev = role_list;
48100 + role_list = role;
48101 + }
48102 +
48103 + /* used for hash chains */
48104 + role->next = NULL;
48105 +
48106 + if (role->roletype & GR_ROLE_DOMAIN) {
48107 + for (i = 0; i < role->domain_child_num; i++)
48108 + __insert_acl_role_label(role, role->domain_children[i]);
48109 + } else
48110 + __insert_acl_role_label(role, role->uidgid);
48111 +}
48112 +
48113 +static int
48114 +insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
48115 +{
48116 + struct name_entry **curr, *nentry;
48117 + struct inodev_entry *ientry;
48118 + unsigned int len = strlen(name);
48119 + unsigned int key = full_name_hash(name, len);
48120 + unsigned int index = key % name_set.n_size;
48121 +
48122 + curr = &name_set.n_hash[index];
48123 +
48124 + while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
48125 + curr = &((*curr)->next);
48126 +
48127 + if (*curr != NULL)
48128 + return 1;
48129 +
48130 + nentry = acl_alloc(sizeof (struct name_entry));
48131 + if (nentry == NULL)
48132 + return 0;
48133 + ientry = acl_alloc(sizeof (struct inodev_entry));
48134 + if (ientry == NULL)
48135 + return 0;
48136 + ientry->nentry = nentry;
48137 +
48138 + nentry->key = key;
48139 + nentry->name = name;
48140 + nentry->inode = inode;
48141 + nentry->device = device;
48142 + nentry->len = len;
48143 + nentry->deleted = deleted;
48144 +
48145 + nentry->prev = NULL;
48146 + curr = &name_set.n_hash[index];
48147 + if (*curr != NULL)
48148 + (*curr)->prev = nentry;
48149 + nentry->next = *curr;
48150 + *curr = nentry;
48151 +
48152 + /* insert us into the table searchable by inode/dev */
48153 + insert_inodev_entry(ientry);
48154 +
48155 + return 1;
48156 +}
48157 +
48158 +static void
48159 +insert_acl_obj_label(struct acl_object_label *obj,
48160 + struct acl_subject_label *subj)
48161 +{
48162 + unsigned int index =
48163 + fhash(obj->inode, obj->device, subj->obj_hash_size);
48164 + struct acl_object_label **curr;
48165 +
48166 +
48167 + obj->prev = NULL;
48168 +
48169 + curr = &subj->obj_hash[index];
48170 + if (*curr != NULL)
48171 + (*curr)->prev = obj;
48172 +
48173 + obj->next = *curr;
48174 + *curr = obj;
48175 +
48176 + return;
48177 +}
48178 +
48179 +static void
48180 +insert_acl_subj_label(struct acl_subject_label *obj,
48181 + struct acl_role_label *role)
48182 +{
48183 + unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
48184 + struct acl_subject_label **curr;
48185 +
48186 + obj->prev = NULL;
48187 +
48188 + curr = &role->subj_hash[index];
48189 + if (*curr != NULL)
48190 + (*curr)->prev = obj;
48191 +
48192 + obj->next = *curr;
48193 + *curr = obj;
48194 +
48195 + return;
48196 +}
48197 +
48198 +/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
48199 +
48200 +static void *
48201 +create_table(__u32 * len, int elementsize)
48202 +{
48203 + unsigned int table_sizes[] = {
48204 + 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
48205 + 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
48206 + 4194301, 8388593, 16777213, 33554393, 67108859
48207 + };
48208 + void *newtable = NULL;
48209 + unsigned int pwr = 0;
48210 +
48211 + while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
48212 + table_sizes[pwr] <= *len)
48213 + pwr++;
48214 +
48215 + if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
48216 + return newtable;
48217 +
48218 + if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
48219 + newtable =
48220 + kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
48221 + else
48222 + newtable = vmalloc(table_sizes[pwr] * elementsize);
48223 +
48224 + *len = table_sizes[pwr];
48225 +
48226 + return newtable;
48227 +}
48228 +
48229 +static int
48230 +init_variables(const struct gr_arg *arg)
48231 +{
48232 + struct task_struct *reaper = &init_task;
48233 + unsigned int stacksize;
48234 +
48235 + subj_map_set.s_size = arg->role_db.num_subjects;
48236 + acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
48237 + name_set.n_size = arg->role_db.num_objects;
48238 + inodev_set.i_size = arg->role_db.num_objects;
48239 +
48240 + if (!subj_map_set.s_size || !acl_role_set.r_size ||
48241 + !name_set.n_size || !inodev_set.i_size)
48242 + return 1;
48243 +
48244 + if (!gr_init_uidset())
48245 + return 1;
48246 +
48247 + /* set up the stack that holds allocation info */
48248 +
48249 + stacksize = arg->role_db.num_pointers + 5;
48250 +
48251 + if (!acl_alloc_stack_init(stacksize))
48252 + return 1;
48253 +
48254 + /* grab reference for the real root dentry and vfsmount */
48255 + get_fs_root(reaper->fs, &real_root);
48256 +
48257 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
48258 + printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root.dentry), real_root.dentry->d_inode->i_ino);
48259 +#endif
48260 +
48261 + fakefs_obj_rw = acl_alloc(sizeof(struct acl_object_label));
48262 + if (fakefs_obj_rw == NULL)
48263 + return 1;
48264 + fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE;
48265 +
48266 + fakefs_obj_rwx = acl_alloc(sizeof(struct acl_object_label));
48267 + if (fakefs_obj_rwx == NULL)
48268 + return 1;
48269 + fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
48270 +
48271 + subj_map_set.s_hash =
48272 + (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
48273 + acl_role_set.r_hash =
48274 + (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
48275 + name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
48276 + inodev_set.i_hash =
48277 + (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
48278 +
48279 + if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
48280 + !name_set.n_hash || !inodev_set.i_hash)
48281 + return 1;
48282 +
48283 + memset(subj_map_set.s_hash, 0,
48284 + sizeof(struct subject_map *) * subj_map_set.s_size);
48285 + memset(acl_role_set.r_hash, 0,
48286 + sizeof (struct acl_role_label *) * acl_role_set.r_size);
48287 + memset(name_set.n_hash, 0,
48288 + sizeof (struct name_entry *) * name_set.n_size);
48289 + memset(inodev_set.i_hash, 0,
48290 + sizeof (struct inodev_entry *) * inodev_set.i_size);
48291 +
48292 + return 0;
48293 +}
48294 +
48295 +/* free information not needed after startup
48296 + currently contains user->kernel pointer mappings for subjects
48297 +*/
48298 +
48299 +static void
48300 +free_init_variables(void)
48301 +{
48302 + __u32 i;
48303 +
48304 + if (subj_map_set.s_hash) {
48305 + for (i = 0; i < subj_map_set.s_size; i++) {
48306 + if (subj_map_set.s_hash[i]) {
48307 + kfree(subj_map_set.s_hash[i]);
48308 + subj_map_set.s_hash[i] = NULL;
48309 + }
48310 + }
48311 +
48312 + if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
48313 + PAGE_SIZE)
48314 + kfree(subj_map_set.s_hash);
48315 + else
48316 + vfree(subj_map_set.s_hash);
48317 + }
48318 +
48319 + return;
48320 +}
48321 +
48322 +static void
48323 +free_variables(void)
48324 +{
48325 + struct acl_subject_label *s;
48326 + struct acl_role_label *r;
48327 + struct task_struct *task, *task2;
48328 + unsigned int x;
48329 +
48330 + gr_clear_learn_entries();
48331 +
48332 + read_lock(&tasklist_lock);
48333 + do_each_thread(task2, task) {
48334 + task->acl_sp_role = 0;
48335 + task->acl_role_id = 0;
48336 + task->acl = NULL;
48337 + task->role = NULL;
48338 + } while_each_thread(task2, task);
48339 + read_unlock(&tasklist_lock);
48340 +
48341 + /* release the reference to the real root dentry and vfsmount */
48342 + path_put(&real_root);
48343 +
48344 + /* free all object hash tables */
48345 +
48346 + FOR_EACH_ROLE_START(r)
48347 + if (r->subj_hash == NULL)
48348 + goto next_role;
48349 + FOR_EACH_SUBJECT_START(r, s, x)
48350 + if (s->obj_hash == NULL)
48351 + break;
48352 + if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
48353 + kfree(s->obj_hash);
48354 + else
48355 + vfree(s->obj_hash);
48356 + FOR_EACH_SUBJECT_END(s, x)
48357 + FOR_EACH_NESTED_SUBJECT_START(r, s)
48358 + if (s->obj_hash == NULL)
48359 + break;
48360 + if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
48361 + kfree(s->obj_hash);
48362 + else
48363 + vfree(s->obj_hash);
48364 + FOR_EACH_NESTED_SUBJECT_END(s)
48365 + if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
48366 + kfree(r->subj_hash);
48367 + else
48368 + vfree(r->subj_hash);
48369 + r->subj_hash = NULL;
48370 +next_role:
48371 + FOR_EACH_ROLE_END(r)
48372 +
48373 + acl_free_all();
48374 +
48375 + if (acl_role_set.r_hash) {
48376 + if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
48377 + PAGE_SIZE)
48378 + kfree(acl_role_set.r_hash);
48379 + else
48380 + vfree(acl_role_set.r_hash);
48381 + }
48382 + if (name_set.n_hash) {
48383 + if ((name_set.n_size * sizeof (struct name_entry *)) <=
48384 + PAGE_SIZE)
48385 + kfree(name_set.n_hash);
48386 + else
48387 + vfree(name_set.n_hash);
48388 + }
48389 +
48390 + if (inodev_set.i_hash) {
48391 + if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
48392 + PAGE_SIZE)
48393 + kfree(inodev_set.i_hash);
48394 + else
48395 + vfree(inodev_set.i_hash);
48396 + }
48397 +
48398 + gr_free_uidset();
48399 +
48400 + memset(&name_set, 0, sizeof (struct name_db));
48401 + memset(&inodev_set, 0, sizeof (struct inodev_db));
48402 + memset(&acl_role_set, 0, sizeof (struct acl_role_db));
48403 + memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
48404 +
48405 + default_role = NULL;
48406 + role_list = NULL;
48407 +
48408 + return;
48409 +}
48410 +
48411 +static __u32
48412 +count_user_objs(struct acl_object_label *userp)
48413 +{
48414 + struct acl_object_label o_tmp;
48415 + __u32 num = 0;
48416 +
48417 + while (userp) {
48418 + if (copy_from_user(&o_tmp, userp,
48419 + sizeof (struct acl_object_label)))
48420 + break;
48421 +
48422 + userp = o_tmp.prev;
48423 + num++;
48424 + }
48425 +
48426 + return num;
48427 +}
48428 +
48429 +static struct acl_subject_label *
48430 +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
48431 +
48432 +static int
48433 +copy_user_glob(struct acl_object_label *obj)
48434 +{
48435 + struct acl_object_label *g_tmp, **guser;
48436 + unsigned int len;
48437 + char *tmp;
48438 +
48439 + if (obj->globbed == NULL)
48440 + return 0;
48441 +
48442 + guser = &obj->globbed;
48443 + while (*guser) {
48444 + g_tmp = (struct acl_object_label *)
48445 + acl_alloc(sizeof (struct acl_object_label));
48446 + if (g_tmp == NULL)
48447 + return -ENOMEM;
48448 +
48449 + if (copy_from_user(g_tmp, *guser,
48450 + sizeof (struct acl_object_label)))
48451 + return -EFAULT;
48452 +
48453 + len = strnlen_user(g_tmp->filename, PATH_MAX);
48454 +
48455 + if (!len || len >= PATH_MAX)
48456 + return -EINVAL;
48457 +
48458 + if ((tmp = (char *) acl_alloc(len)) == NULL)
48459 + return -ENOMEM;
48460 +
48461 + if (copy_from_user(tmp, g_tmp->filename, len))
48462 + return -EFAULT;
48463 + tmp[len-1] = '\0';
48464 + g_tmp->filename = tmp;
48465 +
48466 + *guser = g_tmp;
48467 + guser = &(g_tmp->next);
48468 + }
48469 +
48470 + return 0;
48471 +}
48472 +
48473 +static int
48474 +copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
48475 + struct acl_role_label *role)
48476 +{
48477 + struct acl_object_label *o_tmp;
48478 + unsigned int len;
48479 + int ret;
48480 + char *tmp;
48481 +
48482 + while (userp) {
48483 + if ((o_tmp = (struct acl_object_label *)
48484 + acl_alloc(sizeof (struct acl_object_label))) == NULL)
48485 + return -ENOMEM;
48486 +
48487 + if (copy_from_user(o_tmp, userp,
48488 + sizeof (struct acl_object_label)))
48489 + return -EFAULT;
48490 +
48491 + userp = o_tmp->prev;
48492 +
48493 + len = strnlen_user(o_tmp->filename, PATH_MAX);
48494 +
48495 + if (!len || len >= PATH_MAX)
48496 + return -EINVAL;
48497 +
48498 + if ((tmp = (char *) acl_alloc(len)) == NULL)
48499 + return -ENOMEM;
48500 +
48501 + if (copy_from_user(tmp, o_tmp->filename, len))
48502 + return -EFAULT;
48503 + tmp[len-1] = '\0';
48504 + o_tmp->filename = tmp;
48505 +
48506 + insert_acl_obj_label(o_tmp, subj);
48507 + if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
48508 + o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
48509 + return -ENOMEM;
48510 +
48511 + ret = copy_user_glob(o_tmp);
48512 + if (ret)
48513 + return ret;
48514 +
48515 + if (o_tmp->nested) {
48516 + o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
48517 + if (IS_ERR(o_tmp->nested))
48518 + return PTR_ERR(o_tmp->nested);
48519 +
48520 + /* insert into nested subject list */
48521 + o_tmp->nested->next = role->hash->first;
48522 + role->hash->first = o_tmp->nested;
48523 + }
48524 + }
48525 +
48526 + return 0;
48527 +}
48528 +
48529 +static __u32
48530 +count_user_subjs(struct acl_subject_label *userp)
48531 +{
48532 + struct acl_subject_label s_tmp;
48533 + __u32 num = 0;
48534 +
48535 + while (userp) {
48536 + if (copy_from_user(&s_tmp, userp,
48537 + sizeof (struct acl_subject_label)))
48538 + break;
48539 +
48540 + userp = s_tmp.prev;
48541 + /* do not count nested subjects against this count, since
48542 + they are not included in the hash table, but are
48543 + attached to objects. We have already counted
48544 + the subjects in userspace for the allocation
48545 + stack
48546 + */
48547 + if (!(s_tmp.mode & GR_NESTED))
48548 + num++;
48549 + }
48550 +
48551 + return num;
48552 +}
48553 +
48554 +static int
48555 +copy_user_allowedips(struct acl_role_label *rolep)
48556 +{
48557 + struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
48558 +
48559 + ruserip = rolep->allowed_ips;
48560 +
48561 + while (ruserip) {
48562 + rlast = rtmp;
48563 +
48564 + if ((rtmp = (struct role_allowed_ip *)
48565 + acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
48566 + return -ENOMEM;
48567 +
48568 + if (copy_from_user(rtmp, ruserip,
48569 + sizeof (struct role_allowed_ip)))
48570 + return -EFAULT;
48571 +
48572 + ruserip = rtmp->prev;
48573 +
48574 + if (!rlast) {
48575 + rtmp->prev = NULL;
48576 + rolep->allowed_ips = rtmp;
48577 + } else {
48578 + rlast->next = rtmp;
48579 + rtmp->prev = rlast;
48580 + }
48581 +
48582 + if (!ruserip)
48583 + rtmp->next = NULL;
48584 + }
48585 +
48586 + return 0;
48587 +}
48588 +
48589 +static int
48590 +copy_user_transitions(struct acl_role_label *rolep)
48591 +{
48592 + struct role_transition *rusertp, *rtmp = NULL, *rlast;
48593 +
48594 + unsigned int len;
48595 + char *tmp;
48596 +
48597 + rusertp = rolep->transitions;
48598 +
48599 + while (rusertp) {
48600 + rlast = rtmp;
48601 +
48602 + if ((rtmp = (struct role_transition *)
48603 + acl_alloc(sizeof (struct role_transition))) == NULL)
48604 + return -ENOMEM;
48605 +
48606 + if (copy_from_user(rtmp, rusertp,
48607 + sizeof (struct role_transition)))
48608 + return -EFAULT;
48609 +
48610 + rusertp = rtmp->prev;
48611 +
48612 + len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
48613 +
48614 + if (!len || len >= GR_SPROLE_LEN)
48615 + return -EINVAL;
48616 +
48617 + if ((tmp = (char *) acl_alloc(len)) == NULL)
48618 + return -ENOMEM;
48619 +
48620 + if (copy_from_user(tmp, rtmp->rolename, len))
48621 + return -EFAULT;
48622 + tmp[len-1] = '\0';
48623 + rtmp->rolename = tmp;
48624 +
48625 + if (!rlast) {
48626 + rtmp->prev = NULL;
48627 + rolep->transitions = rtmp;
48628 + } else {
48629 + rlast->next = rtmp;
48630 + rtmp->prev = rlast;
48631 + }
48632 +
48633 + if (!rusertp)
48634 + rtmp->next = NULL;
48635 + }
48636 +
48637 + return 0;
48638 +}
48639 +
48640 +static struct acl_subject_label *
48641 +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
48642 +{
48643 + struct acl_subject_label *s_tmp = NULL, *s_tmp2;
48644 + unsigned int len;
48645 + char *tmp;
48646 + __u32 num_objs;
48647 + struct acl_ip_label **i_tmp, *i_utmp2;
48648 + struct gr_hash_struct ghash;
48649 + struct subject_map *subjmap;
48650 + unsigned int i_num;
48651 + int err;
48652 +
48653 + s_tmp = lookup_subject_map(userp);
48654 +
48655 + /* we've already copied this subject into the kernel, just return
48656 + the reference to it, and don't copy it over again
48657 + */
48658 + if (s_tmp)
48659 + return(s_tmp);
48660 +
48661 + if ((s_tmp = (struct acl_subject_label *)
48662 + acl_alloc(sizeof (struct acl_subject_label))) == NULL)
48663 + return ERR_PTR(-ENOMEM);
48664 +
48665 + subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
48666 + if (subjmap == NULL)
48667 + return ERR_PTR(-ENOMEM);
48668 +
48669 + subjmap->user = userp;
48670 + subjmap->kernel = s_tmp;
48671 + insert_subj_map_entry(subjmap);
48672 +
48673 + if (copy_from_user(s_tmp, userp,
48674 + sizeof (struct acl_subject_label)))
48675 + return ERR_PTR(-EFAULT);
48676 +
48677 + len = strnlen_user(s_tmp->filename, PATH_MAX);
48678 +
48679 + if (!len || len >= PATH_MAX)
48680 + return ERR_PTR(-EINVAL);
48681 +
48682 + if ((tmp = (char *) acl_alloc(len)) == NULL)
48683 + return ERR_PTR(-ENOMEM);
48684 +
48685 + if (copy_from_user(tmp, s_tmp->filename, len))
48686 + return ERR_PTR(-EFAULT);
48687 + tmp[len-1] = '\0';
48688 + s_tmp->filename = tmp;
48689 +
48690 + if (!strcmp(s_tmp->filename, "/"))
48691 + role->root_label = s_tmp;
48692 +
48693 + if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
48694 + return ERR_PTR(-EFAULT);
48695 +
48696 + /* copy user and group transition tables */
48697 +
48698 + if (s_tmp->user_trans_num) {
48699 + uid_t *uidlist;
48700 +
48701 + uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
48702 + if (uidlist == NULL)
48703 + return ERR_PTR(-ENOMEM);
48704 + if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
48705 + return ERR_PTR(-EFAULT);
48706 +
48707 + s_tmp->user_transitions = uidlist;
48708 + }
48709 +
48710 + if (s_tmp->group_trans_num) {
48711 + gid_t *gidlist;
48712 +
48713 + gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
48714 + if (gidlist == NULL)
48715 + return ERR_PTR(-ENOMEM);
48716 + if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
48717 + return ERR_PTR(-EFAULT);
48718 +
48719 + s_tmp->group_transitions = gidlist;
48720 + }
48721 +
48722 + /* set up object hash table */
48723 + num_objs = count_user_objs(ghash.first);
48724 +
48725 + s_tmp->obj_hash_size = num_objs;
48726 + s_tmp->obj_hash =
48727 + (struct acl_object_label **)
48728 + create_table(&(s_tmp->obj_hash_size), sizeof(void *));
48729 +
48730 + if (!s_tmp->obj_hash)
48731 + return ERR_PTR(-ENOMEM);
48732 +
48733 + memset(s_tmp->obj_hash, 0,
48734 + s_tmp->obj_hash_size *
48735 + sizeof (struct acl_object_label *));
48736 +
48737 + /* add in objects */
48738 + err = copy_user_objs(ghash.first, s_tmp, role);
48739 +
48740 + if (err)
48741 + return ERR_PTR(err);
48742 +
48743 + /* set pointer for parent subject */
48744 + if (s_tmp->parent_subject) {
48745 + s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
48746 +
48747 + if (IS_ERR(s_tmp2))
48748 + return s_tmp2;
48749 +
48750 + s_tmp->parent_subject = s_tmp2;
48751 + }
48752 +
48753 + /* add in ip acls */
48754 +
48755 + if (!s_tmp->ip_num) {
48756 + s_tmp->ips = NULL;
48757 + goto insert;
48758 + }
48759 +
48760 + i_tmp =
48761 + (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
48762 + sizeof (struct acl_ip_label *));
48763 +
48764 + if (!i_tmp)
48765 + return ERR_PTR(-ENOMEM);
48766 +
48767 + for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
48768 + *(i_tmp + i_num) =
48769 + (struct acl_ip_label *)
48770 + acl_alloc(sizeof (struct acl_ip_label));
48771 + if (!*(i_tmp + i_num))
48772 + return ERR_PTR(-ENOMEM);
48773 +
48774 + if (copy_from_user
48775 + (&i_utmp2, s_tmp->ips + i_num,
48776 + sizeof (struct acl_ip_label *)))
48777 + return ERR_PTR(-EFAULT);
48778 +
48779 + if (copy_from_user
48780 + (*(i_tmp + i_num), i_utmp2,
48781 + sizeof (struct acl_ip_label)))
48782 + return ERR_PTR(-EFAULT);
48783 +
48784 + if ((*(i_tmp + i_num))->iface == NULL)
48785 + continue;
48786 +
48787 + len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
48788 + if (!len || len >= IFNAMSIZ)
48789 + return ERR_PTR(-EINVAL);
48790 + tmp = acl_alloc(len);
48791 + if (tmp == NULL)
48792 + return ERR_PTR(-ENOMEM);
48793 + if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
48794 + return ERR_PTR(-EFAULT);
48795 + (*(i_tmp + i_num))->iface = tmp;
48796 + }
48797 +
48798 + s_tmp->ips = i_tmp;
48799 +
48800 +insert:
48801 + if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
48802 + s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
48803 + return ERR_PTR(-ENOMEM);
48804 +
48805 + return s_tmp;
48806 +}
48807 +
48808 +static int
48809 +copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
48810 +{
48811 + struct acl_subject_label s_pre;
48812 + struct acl_subject_label * ret;
48813 + int err;
48814 +
48815 + while (userp) {
48816 + if (copy_from_user(&s_pre, userp,
48817 + sizeof (struct acl_subject_label)))
48818 + return -EFAULT;
48819 +
48820 + /* do not add nested subjects here, add
48821 + while parsing objects
48822 + */
48823 +
48824 + if (s_pre.mode & GR_NESTED) {
48825 + userp = s_pre.prev;
48826 + continue;
48827 + }
48828 +
48829 + ret = do_copy_user_subj(userp, role);
48830 +
48831 + err = PTR_ERR(ret);
48832 + if (IS_ERR(ret))
48833 + return err;
48834 +
48835 + insert_acl_subj_label(ret, role);
48836 +
48837 + userp = s_pre.prev;
48838 + }
48839 +
48840 + return 0;
48841 +}
48842 +
48843 +static int
48844 +copy_user_acl(struct gr_arg *arg)
48845 +{
48846 + struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
48847 + struct sprole_pw *sptmp;
48848 + struct gr_hash_struct *ghash;
48849 + uid_t *domainlist;
48850 + unsigned int r_num;
48851 + unsigned int len;
48852 + char *tmp;
48853 + int err = 0;
48854 + __u16 i;
48855 + __u32 num_subjs;
48856 +
48857 + /* we need a default and kernel role */
48858 + if (arg->role_db.num_roles < 2)
48859 + return -EINVAL;
48860 +
48861 + /* copy special role authentication info from userspace */
48862 +
48863 + num_sprole_pws = arg->num_sprole_pws;
48864 + acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
48865 +
48866 + if (!acl_special_roles) {
48867 + err = -ENOMEM;
48868 + goto cleanup;
48869 + }
48870 +
48871 + for (i = 0; i < num_sprole_pws; i++) {
48872 + sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
48873 + if (!sptmp) {
48874 + err = -ENOMEM;
48875 + goto cleanup;
48876 + }
48877 + if (copy_from_user(sptmp, arg->sprole_pws + i,
48878 + sizeof (struct sprole_pw))) {
48879 + err = -EFAULT;
48880 + goto cleanup;
48881 + }
48882 +
48883 + len =
48884 + strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
48885 +
48886 + if (!len || len >= GR_SPROLE_LEN) {
48887 + err = -EINVAL;
48888 + goto cleanup;
48889 + }
48890 +
48891 + if ((tmp = (char *) acl_alloc(len)) == NULL) {
48892 + err = -ENOMEM;
48893 + goto cleanup;
48894 + }
48895 +
48896 + if (copy_from_user(tmp, sptmp->rolename, len)) {
48897 + err = -EFAULT;
48898 + goto cleanup;
48899 + }
48900 + tmp[len-1] = '\0';
48901 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
48902 + printk(KERN_ALERT "Copying special role %s\n", tmp);
48903 +#endif
48904 + sptmp->rolename = tmp;
48905 + acl_special_roles[i] = sptmp;
48906 + }
48907 +
48908 + r_utmp = (struct acl_role_label **) arg->role_db.r_table;
48909 +
48910 + for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
48911 + r_tmp = acl_alloc(sizeof (struct acl_role_label));
48912 +
48913 + if (!r_tmp) {
48914 + err = -ENOMEM;
48915 + goto cleanup;
48916 + }
48917 +
48918 + if (copy_from_user(&r_utmp2, r_utmp + r_num,
48919 + sizeof (struct acl_role_label *))) {
48920 + err = -EFAULT;
48921 + goto cleanup;
48922 + }
48923 +
48924 + if (copy_from_user(r_tmp, r_utmp2,
48925 + sizeof (struct acl_role_label))) {
48926 + err = -EFAULT;
48927 + goto cleanup;
48928 + }
48929 +
48930 + len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
48931 +
48932 + if (!len || len >= PATH_MAX) {
48933 + err = -EINVAL;
48934 + goto cleanup;
48935 + }
48936 +
48937 + if ((tmp = (char *) acl_alloc(len)) == NULL) {
48938 + err = -ENOMEM;
48939 + goto cleanup;
48940 + }
48941 + if (copy_from_user(tmp, r_tmp->rolename, len)) {
48942 + err = -EFAULT;
48943 + goto cleanup;
48944 + }
48945 + tmp[len-1] = '\0';
48946 + r_tmp->rolename = tmp;
48947 +
48948 + if (!strcmp(r_tmp->rolename, "default")
48949 + && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
48950 + default_role = r_tmp;
48951 + } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
48952 + kernel_role = r_tmp;
48953 + }
48954 +
48955 + if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
48956 + err = -ENOMEM;
48957 + goto cleanup;
48958 + }
48959 + if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
48960 + err = -EFAULT;
48961 + goto cleanup;
48962 + }
48963 +
48964 + r_tmp->hash = ghash;
48965 +
48966 + num_subjs = count_user_subjs(r_tmp->hash->first);
48967 +
48968 + r_tmp->subj_hash_size = num_subjs;
48969 + r_tmp->subj_hash =
48970 + (struct acl_subject_label **)
48971 + create_table(&(r_tmp->subj_hash_size), sizeof(void *));
48972 +
48973 + if (!r_tmp->subj_hash) {
48974 + err = -ENOMEM;
48975 + goto cleanup;
48976 + }
48977 +
48978 + err = copy_user_allowedips(r_tmp);
48979 + if (err)
48980 + goto cleanup;
48981 +
48982 + /* copy domain info */
48983 + if (r_tmp->domain_children != NULL) {
48984 + domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
48985 + if (domainlist == NULL) {
48986 + err = -ENOMEM;
48987 + goto cleanup;
48988 + }
48989 + if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
48990 + err = -EFAULT;
48991 + goto cleanup;
48992 + }
48993 + r_tmp->domain_children = domainlist;
48994 + }
48995 +
48996 + err = copy_user_transitions(r_tmp);
48997 + if (err)
48998 + goto cleanup;
48999 +
49000 + memset(r_tmp->subj_hash, 0,
49001 + r_tmp->subj_hash_size *
49002 + sizeof (struct acl_subject_label *));
49003 +
49004 + err = copy_user_subjs(r_tmp->hash->first, r_tmp);
49005 +
49006 + if (err)
49007 + goto cleanup;
49008 +
49009 + /* set nested subject list to null */
49010 + r_tmp->hash->first = NULL;
49011 +
49012 + insert_acl_role_label(r_tmp);
49013 + }
49014 +
49015 + goto return_err;
49016 + cleanup:
49017 + free_variables();
49018 + return_err:
49019 + return err;
49020 +
49021 +}
49022 +
49023 +static int
49024 +gracl_init(struct gr_arg *args)
49025 +{
49026 + int error = 0;
49027 +
49028 + memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
49029 + memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
49030 +
49031 + if (init_variables(args)) {
49032 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
49033 + error = -ENOMEM;
49034 + free_variables();
49035 + goto out;
49036 + }
49037 +
49038 + error = copy_user_acl(args);
49039 + free_init_variables();
49040 + if (error) {
49041 + free_variables();
49042 + goto out;
49043 + }
49044 +
49045 + if ((error = gr_set_acls(0))) {
49046 + free_variables();
49047 + goto out;
49048 + }
49049 +
49050 + pax_open_kernel();
49051 + gr_status |= GR_READY;
49052 + pax_close_kernel();
49053 +
49054 + out:
49055 + return error;
49056 +}
49057 +
49058 +/* derived from glibc fnmatch() 0: match, 1: no match*/
49059 +
49060 +static int
49061 +glob_match(const char *p, const char *n)
49062 +{
49063 + char c;
49064 +
49065 + while ((c = *p++) != '\0') {
49066 + switch (c) {
49067 + case '?':
49068 + if (*n == '\0')
49069 + return 1;
49070 + else if (*n == '/')
49071 + return 1;
49072 + break;
49073 + case '\\':
49074 + if (*n != c)
49075 + return 1;
49076 + break;
49077 + case '*':
49078 + for (c = *p++; c == '?' || c == '*'; c = *p++) {
49079 + if (*n == '/')
49080 + return 1;
49081 + else if (c == '?') {
49082 + if (*n == '\0')
49083 + return 1;
49084 + else
49085 + ++n;
49086 + }
49087 + }
49088 + if (c == '\0') {
49089 + return 0;
49090 + } else {
49091 + const char *endp;
49092 +
49093 + if ((endp = strchr(n, '/')) == NULL)
49094 + endp = n + strlen(n);
49095 +
49096 + if (c == '[') {
49097 + for (--p; n < endp; ++n)
49098 + if (!glob_match(p, n))
49099 + return 0;
49100 + } else if (c == '/') {
49101 + while (*n != '\0' && *n != '/')
49102 + ++n;
49103 + if (*n == '/' && !glob_match(p, n + 1))
49104 + return 0;
49105 + } else {
49106 + for (--p; n < endp; ++n)
49107 + if (*n == c && !glob_match(p, n))
49108 + return 0;
49109 + }
49110 +
49111 + return 1;
49112 + }
49113 + case '[':
49114 + {
49115 + int not;
49116 + char cold;
49117 +
49118 + if (*n == '\0' || *n == '/')
49119 + return 1;
49120 +
49121 + not = (*p == '!' || *p == '^');
49122 + if (not)
49123 + ++p;
49124 +
49125 + c = *p++;
49126 + for (;;) {
49127 + unsigned char fn = (unsigned char)*n;
49128 +
49129 + if (c == '\0')
49130 + return 1;
49131 + else {
49132 + if (c == fn)
49133 + goto matched;
49134 + cold = c;
49135 + c = *p++;
49136 +
49137 + if (c == '-' && *p != ']') {
49138 + unsigned char cend = *p++;
49139 +
49140 + if (cend == '\0')
49141 + return 1;
49142 +
49143 + if (cold <= fn && fn <= cend)
49144 + goto matched;
49145 +
49146 + c = *p++;
49147 + }
49148 + }
49149 +
49150 + if (c == ']')
49151 + break;
49152 + }
49153 + if (!not)
49154 + return 1;
49155 + break;
49156 + matched:
49157 + while (c != ']') {
49158 + if (c == '\0')
49159 + return 1;
49160 +
49161 + c = *p++;
49162 + }
49163 + if (not)
49164 + return 1;
49165 + }
49166 + break;
49167 + default:
49168 + if (c != *n)
49169 + return 1;
49170 + }
49171 +
49172 + ++n;
49173 + }
49174 +
49175 + if (*n == '\0')
49176 + return 0;
49177 +
49178 + if (*n == '/')
49179 + return 0;
49180 +
49181 + return 1;
49182 +}
49183 +
49184 +static struct acl_object_label *
49185 +chk_glob_label(struct acl_object_label *globbed,
49186 + struct dentry *dentry, struct vfsmount *mnt, char **path)
49187 +{
49188 + struct acl_object_label *tmp;
49189 +
49190 + if (*path == NULL)
49191 + *path = gr_to_filename_nolock(dentry, mnt);
49192 +
49193 + tmp = globbed;
49194 +
49195 + while (tmp) {
49196 + if (!glob_match(tmp->filename, *path))
49197 + return tmp;
49198 + tmp = tmp->next;
49199 + }
49200 +
49201 + return NULL;
49202 +}
49203 +
49204 +static struct acl_object_label *
49205 +__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
49206 + const ino_t curr_ino, const dev_t curr_dev,
49207 + const struct acl_subject_label *subj, char **path, const int checkglob)
49208 +{
49209 + struct acl_subject_label *tmpsubj;
49210 + struct acl_object_label *retval;
49211 + struct acl_object_label *retval2;
49212 +
49213 + tmpsubj = (struct acl_subject_label *) subj;
49214 + read_lock(&gr_inode_lock);
49215 + do {
49216 + retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
49217 + if (retval) {
49218 + if (checkglob && retval->globbed) {
49219 + retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
49220 + (struct vfsmount *)orig_mnt, path);
49221 + if (retval2)
49222 + retval = retval2;
49223 + }
49224 + break;
49225 + }
49226 + } while ((tmpsubj = tmpsubj->parent_subject));
49227 + read_unlock(&gr_inode_lock);
49228 +
49229 + return retval;
49230 +}
49231 +
49232 +static __inline__ struct acl_object_label *
49233 +full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
49234 + struct dentry *curr_dentry,
49235 + const struct acl_subject_label *subj, char **path, const int checkglob)
49236 +{
49237 + int newglob = checkglob;
49238 + ino_t inode;
49239 + dev_t device;
49240 +
49241 + /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
49242 + as we don't want a / * rule to match instead of the / object
49243 + don't do this for create lookups that call this function though, since they're looking up
49244 + on the parent and thus need globbing checks on all paths
49245 + */
49246 + if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
49247 + newglob = GR_NO_GLOB;
49248 +
49249 + spin_lock(&curr_dentry->d_lock);
49250 + inode = curr_dentry->d_inode->i_ino;
49251 + device = __get_dev(curr_dentry);
49252 + spin_unlock(&curr_dentry->d_lock);
49253 +
49254 + return __full_lookup(orig_dentry, orig_mnt, inode, device, subj, path, newglob);
49255 +}
49256 +
49257 +static struct acl_object_label *
49258 +__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
49259 + const struct acl_subject_label *subj, char *path, const int checkglob)
49260 +{
49261 + struct dentry *dentry = (struct dentry *) l_dentry;
49262 + struct vfsmount *mnt = (struct vfsmount *) l_mnt;
49263 + struct acl_object_label *retval;
49264 + struct dentry *parent;
49265 +
49266 + write_seqlock(&rename_lock);
49267 + br_read_lock(vfsmount_lock);
49268 +
49269 + if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
49270 +#ifdef CONFIG_NET
49271 + mnt == sock_mnt ||
49272 +#endif
49273 +#ifdef CONFIG_HUGETLBFS
49274 + (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
49275 +#endif
49276 + /* ignore Eric Biederman */
49277 + IS_PRIVATE(l_dentry->d_inode))) {
49278 + retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw;
49279 + goto out;
49280 + }
49281 +
49282 + for (;;) {
49283 + if (dentry == real_root.dentry && mnt == real_root.mnt)
49284 + break;
49285 +
49286 + if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
49287 + if (mnt->mnt_parent == mnt)
49288 + break;
49289 +
49290 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
49291 + if (retval != NULL)
49292 + goto out;
49293 +
49294 + dentry = mnt->mnt_mountpoint;
49295 + mnt = mnt->mnt_parent;
49296 + continue;
49297 + }
49298 +
49299 + parent = dentry->d_parent;
49300 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
49301 + if (retval != NULL)
49302 + goto out;
49303 +
49304 + dentry = parent;
49305 + }
49306 +
49307 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
49308 +
49309 + /* real_root is pinned so we don't have to hold a reference */
49310 + if (retval == NULL)
49311 + retval = full_lookup(l_dentry, l_mnt, real_root.dentry, subj, &path, checkglob);
49312 +out:
49313 + br_read_unlock(vfsmount_lock);
49314 + write_sequnlock(&rename_lock);
49315 +
49316 + BUG_ON(retval == NULL);
49317 +
49318 + return retval;
49319 +}
49320 +
49321 +static __inline__ struct acl_object_label *
49322 +chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
49323 + const struct acl_subject_label *subj)
49324 +{
49325 + char *path = NULL;
49326 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
49327 +}
49328 +
49329 +static __inline__ struct acl_object_label *
49330 +chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
49331 + const struct acl_subject_label *subj)
49332 +{
49333 + char *path = NULL;
49334 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
49335 +}
49336 +
49337 +static __inline__ struct acl_object_label *
49338 +chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
49339 + const struct acl_subject_label *subj, char *path)
49340 +{
49341 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
49342 +}
49343 +
49344 +static struct acl_subject_label *
49345 +chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
49346 + const struct acl_role_label *role)
49347 +{
49348 + struct dentry *dentry = (struct dentry *) l_dentry;
49349 + struct vfsmount *mnt = (struct vfsmount *) l_mnt;
49350 + struct acl_subject_label *retval;
49351 + struct dentry *parent;
49352 +
49353 + write_seqlock(&rename_lock);
49354 + br_read_lock(vfsmount_lock);
49355 +
49356 + for (;;) {
49357 + if (dentry == real_root.dentry && mnt == real_root.mnt)
49358 + break;
49359 + if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
49360 + if (mnt->mnt_parent == mnt)
49361 + break;
49362 +
49363 + spin_lock(&dentry->d_lock);
49364 + read_lock(&gr_inode_lock);
49365 + retval =
49366 + lookup_acl_subj_label(dentry->d_inode->i_ino,
49367 + __get_dev(dentry), role);
49368 + read_unlock(&gr_inode_lock);
49369 + spin_unlock(&dentry->d_lock);
49370 + if (retval != NULL)
49371 + goto out;
49372 +
49373 + dentry = mnt->mnt_mountpoint;
49374 + mnt = mnt->mnt_parent;
49375 + continue;
49376 + }
49377 +
49378 + spin_lock(&dentry->d_lock);
49379 + read_lock(&gr_inode_lock);
49380 + retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
49381 + __get_dev(dentry), role);
49382 + read_unlock(&gr_inode_lock);
49383 + parent = dentry->d_parent;
49384 + spin_unlock(&dentry->d_lock);
49385 +
49386 + if (retval != NULL)
49387 + goto out;
49388 +
49389 + dentry = parent;
49390 + }
49391 +
49392 + spin_lock(&dentry->d_lock);
49393 + read_lock(&gr_inode_lock);
49394 + retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
49395 + __get_dev(dentry), role);
49396 + read_unlock(&gr_inode_lock);
49397 + spin_unlock(&dentry->d_lock);
49398 +
49399 + if (unlikely(retval == NULL)) {
49400 + /* real_root is pinned, we don't need to hold a reference */
49401 + read_lock(&gr_inode_lock);
49402 + retval = lookup_acl_subj_label(real_root.dentry->d_inode->i_ino,
49403 + __get_dev(real_root.dentry), role);
49404 + read_unlock(&gr_inode_lock);
49405 + }
49406 +out:
49407 + br_read_unlock(vfsmount_lock);
49408 + write_sequnlock(&rename_lock);
49409 +
49410 + BUG_ON(retval == NULL);
49411 +
49412 + return retval;
49413 +}
49414 +
49415 +static void
49416 +gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
49417 +{
49418 + struct task_struct *task = current;
49419 + const struct cred *cred = current_cred();
49420 +
49421 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
49422 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
49423 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
49424 + 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
49425 +
49426 + return;
49427 +}
49428 +
49429 +static void
49430 +gr_log_learn_sysctl(const char *path, const __u32 mode)
49431 +{
49432 + struct task_struct *task = current;
49433 + const struct cred *cred = current_cred();
49434 +
49435 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
49436 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
49437 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
49438 + 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
49439 +
49440 + return;
49441 +}
49442 +
49443 +static void
49444 +gr_log_learn_id_change(const char type, const unsigned int real,
49445 + const unsigned int effective, const unsigned int fs)
49446 +{
49447 + struct task_struct *task = current;
49448 + const struct cred *cred = current_cred();
49449 +
49450 + security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
49451 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
49452 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
49453 + type, real, effective, fs, &task->signal->saved_ip);
49454 +
49455 + return;
49456 +}
49457 +
49458 +__u32
49459 +gr_search_file(const struct dentry * dentry, const __u32 mode,
49460 + const struct vfsmount * mnt)
49461 +{
49462 + __u32 retval = mode;
49463 + struct acl_subject_label *curracl;
49464 + struct acl_object_label *currobj;
49465 +
49466 + if (unlikely(!(gr_status & GR_READY)))
49467 + return (mode & ~GR_AUDITS);
49468 +
49469 + curracl = current->acl;
49470 +
49471 + currobj = chk_obj_label(dentry, mnt, curracl);
49472 + retval = currobj->mode & mode;
49473 +
49474 + /* if we're opening a specified transfer file for writing
49475 + (e.g. /dev/initctl), then transfer our role to init
49476 + */
49477 + if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
49478 + current->role->roletype & GR_ROLE_PERSIST)) {
49479 + struct task_struct *task = init_pid_ns.child_reaper;
49480 +
49481 + if (task->role != current->role) {
49482 + task->acl_sp_role = 0;
49483 + task->acl_role_id = current->acl_role_id;
49484 + task->role = current->role;
49485 + rcu_read_lock();
49486 + read_lock(&grsec_exec_file_lock);
49487 + gr_apply_subject_to_task(task);
49488 + read_unlock(&grsec_exec_file_lock);
49489 + rcu_read_unlock();
49490 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
49491 + }
49492 + }
49493 +
49494 + if (unlikely
49495 + ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
49496 + && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
49497 + __u32 new_mode = mode;
49498 +
49499 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
49500 +
49501 + retval = new_mode;
49502 +
49503 + if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
49504 + new_mode |= GR_INHERIT;
49505 +
49506 + if (!(mode & GR_NOLEARN))
49507 + gr_log_learn(dentry, mnt, new_mode);
49508 + }
49509 +
49510 + return retval;
49511 +}
49512 +
49513 +struct acl_object_label *gr_get_create_object(const struct dentry *new_dentry,
49514 + const struct dentry *parent,
49515 + const struct vfsmount *mnt)
49516 +{
49517 + struct name_entry *match;
49518 + struct acl_object_label *matchpo;
49519 + struct acl_subject_label *curracl;
49520 + char *path;
49521 +
49522 + if (unlikely(!(gr_status & GR_READY)))
49523 + return NULL;
49524 +
49525 + preempt_disable();
49526 + path = gr_to_filename_rbac(new_dentry, mnt);
49527 + match = lookup_name_entry_create(path);
49528 +
49529 + curracl = current->acl;
49530 +
49531 + if (match) {
49532 + read_lock(&gr_inode_lock);
49533 + matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
49534 + read_unlock(&gr_inode_lock);
49535 +
49536 + if (matchpo) {
49537 + preempt_enable();
49538 + return matchpo;
49539 + }
49540 + }
49541 +
49542 + // lookup parent
49543 +
49544 + matchpo = chk_obj_create_label(parent, mnt, curracl, path);
49545 +
49546 + preempt_enable();
49547 + return matchpo;
49548 +}
49549 +
49550 +__u32
49551 +gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
49552 + const struct vfsmount * mnt, const __u32 mode)
49553 +{
49554 + struct acl_object_label *matchpo;
49555 + __u32 retval;
49556 +
49557 + if (unlikely(!(gr_status & GR_READY)))
49558 + return (mode & ~GR_AUDITS);
49559 +
49560 + matchpo = gr_get_create_object(new_dentry, parent, mnt);
49561 +
49562 + retval = matchpo->mode & mode;
49563 +
49564 + if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
49565 + && (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))) {
49566 + __u32 new_mode = mode;
49567 +
49568 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
49569 +
49570 + gr_log_learn(new_dentry, mnt, new_mode);
49571 + return new_mode;
49572 + }
49573 +
49574 + return retval;
49575 +}
49576 +
49577 +__u32
49578 +gr_check_link(const struct dentry * new_dentry,
49579 + const struct dentry * parent_dentry,
49580 + const struct vfsmount * parent_mnt,
49581 + const struct dentry * old_dentry, const struct vfsmount * old_mnt)
49582 +{
49583 + struct acl_object_label *obj;
49584 + __u32 oldmode, newmode;
49585 + __u32 needmode;
49586 + __u32 checkmodes = GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC | GR_SETID | GR_READ |
49587 + GR_DELETE | GR_INHERIT;
49588 +
49589 + if (unlikely(!(gr_status & GR_READY)))
49590 + return (GR_CREATE | GR_LINK);
49591 +
49592 + obj = chk_obj_label(old_dentry, old_mnt, current->acl);
49593 + oldmode = obj->mode;
49594 +
49595 + obj = gr_get_create_object(new_dentry, parent_dentry, parent_mnt);
49596 + newmode = obj->mode;
49597 +
49598 + needmode = newmode & checkmodes;
49599 +
49600 + // old name for hardlink must have at least the permissions of the new name
49601 + if ((oldmode & needmode) != needmode)
49602 + goto bad;
49603 +
49604 + // if old name had restrictions/auditing, make sure the new name does as well
49605 + needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
49606 +
49607 + // don't allow hardlinking of suid/sgid files without permission
49608 + if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
49609 + needmode |= GR_SETID;
49610 +
49611 + if ((newmode & needmode) != needmode)
49612 + goto bad;
49613 +
49614 + // enforce minimum permissions
49615 + if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
49616 + return newmode;
49617 +bad:
49618 + needmode = oldmode;
49619 + if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
49620 + needmode |= GR_SETID;
49621 +
49622 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
49623 + gr_log_learn(old_dentry, old_mnt, needmode | GR_CREATE | GR_LINK);
49624 + return (GR_CREATE | GR_LINK);
49625 + } else if (newmode & GR_SUPPRESS)
49626 + return GR_SUPPRESS;
49627 + else
49628 + return 0;
49629 +}
49630 +
49631 +int
49632 +gr_check_hidden_task(const struct task_struct *task)
49633 +{
49634 + if (unlikely(!(gr_status & GR_READY)))
49635 + return 0;
49636 +
49637 + if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
49638 + return 1;
49639 +
49640 + return 0;
49641 +}
49642 +
49643 +int
49644 +gr_check_protected_task(const struct task_struct *task)
49645 +{
49646 + if (unlikely(!(gr_status & GR_READY) || !task))
49647 + return 0;
49648 +
49649 + if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
49650 + task->acl != current->acl)
49651 + return 1;
49652 +
49653 + return 0;
49654 +}
49655 +
49656 +int
49657 +gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
49658 +{
49659 + struct task_struct *p;
49660 + int ret = 0;
49661 +
49662 + if (unlikely(!(gr_status & GR_READY) || !pid))
49663 + return ret;
49664 +
49665 + read_lock(&tasklist_lock);
49666 + do_each_pid_task(pid, type, p) {
49667 + if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
49668 + p->acl != current->acl) {
49669 + ret = 1;
49670 + goto out;
49671 + }
49672 + } while_each_pid_task(pid, type, p);
49673 +out:
49674 + read_unlock(&tasklist_lock);
49675 +
49676 + return ret;
49677 +}
49678 +
49679 +void
49680 +gr_copy_label(struct task_struct *tsk)
49681 +{
49682 + tsk->signal->used_accept = 0;
49683 + tsk->acl_sp_role = 0;
49684 + tsk->acl_role_id = current->acl_role_id;
49685 + tsk->acl = current->acl;
49686 + tsk->role = current->role;
49687 + tsk->signal->curr_ip = current->signal->curr_ip;
49688 + tsk->signal->saved_ip = current->signal->saved_ip;
49689 + if (current->exec_file)
49690 + get_file(current->exec_file);
49691 + tsk->exec_file = current->exec_file;
49692 + tsk->is_writable = current->is_writable;
49693 + if (unlikely(current->signal->used_accept)) {
49694 + current->signal->curr_ip = 0;
49695 + current->signal->saved_ip = 0;
49696 + }
49697 +
49698 + return;
49699 +}
49700 +
49701 +static void
49702 +gr_set_proc_res(struct task_struct *task)
49703 +{
49704 + struct acl_subject_label *proc;
49705 + unsigned short i;
49706 +
49707 + proc = task->acl;
49708 +
49709 + if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
49710 + return;
49711 +
49712 + for (i = 0; i < RLIM_NLIMITS; i++) {
49713 + if (!(proc->resmask & (1 << i)))
49714 + continue;
49715 +
49716 + task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
49717 + task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
49718 + }
49719 +
49720 + return;
49721 +}
49722 +
49723 +extern int __gr_process_user_ban(struct user_struct *user);
49724 +
49725 +int
49726 +gr_check_user_change(int real, int effective, int fs)
49727 +{
49728 + unsigned int i;
49729 + __u16 num;
49730 + uid_t *uidlist;
49731 + int curuid;
49732 + int realok = 0;
49733 + int effectiveok = 0;
49734 + int fsok = 0;
49735 +
49736 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
49737 + struct user_struct *user;
49738 +
49739 + if (real == -1)
49740 + goto skipit;
49741 +
49742 + user = find_user(real);
49743 + if (user == NULL)
49744 + goto skipit;
49745 +
49746 + if (__gr_process_user_ban(user)) {
49747 + /* for find_user */
49748 + free_uid(user);
49749 + return 1;
49750 + }
49751 +
49752 + /* for find_user */
49753 + free_uid(user);
49754 +
49755 +skipit:
49756 +#endif
49757 +
49758 + if (unlikely(!(gr_status & GR_READY)))
49759 + return 0;
49760 +
49761 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
49762 + gr_log_learn_id_change('u', real, effective, fs);
49763 +
49764 + num = current->acl->user_trans_num;
49765 + uidlist = current->acl->user_transitions;
49766 +
49767 + if (uidlist == NULL)
49768 + return 0;
49769 +
49770 + if (real == -1)
49771 + realok = 1;
49772 + if (effective == -1)
49773 + effectiveok = 1;
49774 + if (fs == -1)
49775 + fsok = 1;
49776 +
49777 + if (current->acl->user_trans_type & GR_ID_ALLOW) {
49778 + for (i = 0; i < num; i++) {
49779 + curuid = (int)uidlist[i];
49780 + if (real == curuid)
49781 + realok = 1;
49782 + if (effective == curuid)
49783 + effectiveok = 1;
49784 + if (fs == curuid)
49785 + fsok = 1;
49786 + }
49787 + } else if (current->acl->user_trans_type & GR_ID_DENY) {
49788 + for (i = 0; i < num; i++) {
49789 + curuid = (int)uidlist[i];
49790 + if (real == curuid)
49791 + break;
49792 + if (effective == curuid)
49793 + break;
49794 + if (fs == curuid)
49795 + break;
49796 + }
49797 + /* not in deny list */
49798 + if (i == num) {
49799 + realok = 1;
49800 + effectiveok = 1;
49801 + fsok = 1;
49802 + }
49803 + }
49804 +
49805 + if (realok && effectiveok && fsok)
49806 + return 0;
49807 + else {
49808 + gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
49809 + return 1;
49810 + }
49811 +}
49812 +
49813 +int
49814 +gr_check_group_change(int real, int effective, int fs)
49815 +{
49816 + unsigned int i;
49817 + __u16 num;
49818 + gid_t *gidlist;
49819 + int curgid;
49820 + int realok = 0;
49821 + int effectiveok = 0;
49822 + int fsok = 0;
49823 +
49824 + if (unlikely(!(gr_status & GR_READY)))
49825 + return 0;
49826 +
49827 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
49828 + gr_log_learn_id_change('g', real, effective, fs);
49829 +
49830 + num = current->acl->group_trans_num;
49831 + gidlist = current->acl->group_transitions;
49832 +
49833 + if (gidlist == NULL)
49834 + return 0;
49835 +
49836 + if (real == -1)
49837 + realok = 1;
49838 + if (effective == -1)
49839 + effectiveok = 1;
49840 + if (fs == -1)
49841 + fsok = 1;
49842 +
49843 + if (current->acl->group_trans_type & GR_ID_ALLOW) {
49844 + for (i = 0; i < num; i++) {
49845 + curgid = (int)gidlist[i];
49846 + if (real == curgid)
49847 + realok = 1;
49848 + if (effective == curgid)
49849 + effectiveok = 1;
49850 + if (fs == curgid)
49851 + fsok = 1;
49852 + }
49853 + } else if (current->acl->group_trans_type & GR_ID_DENY) {
49854 + for (i = 0; i < num; i++) {
49855 + curgid = (int)gidlist[i];
49856 + if (real == curgid)
49857 + break;
49858 + if (effective == curgid)
49859 + break;
49860 + if (fs == curgid)
49861 + break;
49862 + }
49863 + /* not in deny list */
49864 + if (i == num) {
49865 + realok = 1;
49866 + effectiveok = 1;
49867 + fsok = 1;
49868 + }
49869 + }
49870 +
49871 + if (realok && effectiveok && fsok)
49872 + return 0;
49873 + else {
49874 + gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
49875 + return 1;
49876 + }
49877 +}
49878 +
49879 +void
49880 +gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
49881 +{
49882 + struct acl_role_label *role = task->role;
49883 + struct acl_subject_label *subj = NULL;
49884 + struct acl_object_label *obj;
49885 + struct file *filp;
49886 +
49887 + if (unlikely(!(gr_status & GR_READY)))
49888 + return;
49889 +
49890 + filp = task->exec_file;
49891 +
49892 + /* kernel process, we'll give them the kernel role */
49893 + if (unlikely(!filp)) {
49894 + task->role = kernel_role;
49895 + task->acl = kernel_role->root_label;
49896 + return;
49897 + } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
49898 + role = lookup_acl_role_label(task, uid, gid);
49899 +
49900 + /* perform subject lookup in possibly new role
49901 + we can use this result below in the case where role == task->role
49902 + */
49903 + subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
49904 +
49905 + /* if we changed uid/gid, but result in the same role
49906 + and are using inheritance, don't lose the inherited subject
49907 + if current subject is other than what normal lookup
49908 + would result in, we arrived via inheritance, don't
49909 + lose subject
49910 + */
49911 + if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
49912 + (subj == task->acl)))
49913 + task->acl = subj;
49914 +
49915 + task->role = role;
49916 +
49917 + task->is_writable = 0;
49918 +
49919 + /* ignore additional mmap checks for processes that are writable
49920 + by the default ACL */
49921 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
49922 + if (unlikely(obj->mode & GR_WRITE))
49923 + task->is_writable = 1;
49924 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
49925 + if (unlikely(obj->mode & GR_WRITE))
49926 + task->is_writable = 1;
49927 +
49928 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
49929 + printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
49930 +#endif
49931 +
49932 + gr_set_proc_res(task);
49933 +
49934 + return;
49935 +}
49936 +
49937 +int
49938 +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
49939 + const int unsafe_share)
49940 +{
49941 + struct task_struct *task = current;
49942 + struct acl_subject_label *newacl;
49943 + struct acl_object_label *obj;
49944 + __u32 retmode;
49945 +
49946 + if (unlikely(!(gr_status & GR_READY)))
49947 + return 0;
49948 +
49949 + newacl = chk_subj_label(dentry, mnt, task->role);
49950 +
49951 + task_lock(task);
49952 + if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
49953 + !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
49954 + !(task->role->roletype & GR_ROLE_GOD) &&
49955 + !gr_search_file(dentry, GR_PTRACERD, mnt) &&
49956 + !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
49957 + task_unlock(task);
49958 + if (unsafe_share)
49959 + gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
49960 + else
49961 + gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
49962 + return -EACCES;
49963 + }
49964 + task_unlock(task);
49965 +
49966 + obj = chk_obj_label(dentry, mnt, task->acl);
49967 + retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
49968 +
49969 + if (!(task->acl->mode & GR_INHERITLEARN) &&
49970 + ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
49971 + if (obj->nested)
49972 + task->acl = obj->nested;
49973 + else
49974 + task->acl = newacl;
49975 + } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
49976 + gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
49977 +
49978 + task->is_writable = 0;
49979 +
49980 + /* ignore additional mmap checks for processes that are writable
49981 + by the default ACL */
49982 + obj = chk_obj_label(dentry, mnt, default_role->root_label);
49983 + if (unlikely(obj->mode & GR_WRITE))
49984 + task->is_writable = 1;
49985 + obj = chk_obj_label(dentry, mnt, task->role->root_label);
49986 + if (unlikely(obj->mode & GR_WRITE))
49987 + task->is_writable = 1;
49988 +
49989 + gr_set_proc_res(task);
49990 +
49991 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
49992 + printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
49993 +#endif
49994 + return 0;
49995 +}
49996 +
49997 +/* always called with valid inodev ptr */
49998 +static void
49999 +do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
50000 +{
50001 + struct acl_object_label *matchpo;
50002 + struct acl_subject_label *matchps;
50003 + struct acl_subject_label *subj;
50004 + struct acl_role_label *role;
50005 + unsigned int x;
50006 +
50007 + FOR_EACH_ROLE_START(role)
50008 + FOR_EACH_SUBJECT_START(role, subj, x)
50009 + if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
50010 + matchpo->mode |= GR_DELETED;
50011 + FOR_EACH_SUBJECT_END(subj,x)
50012 + FOR_EACH_NESTED_SUBJECT_START(role, subj)
50013 + if (subj->inode == ino && subj->device == dev)
50014 + subj->mode |= GR_DELETED;
50015 + FOR_EACH_NESTED_SUBJECT_END(subj)
50016 + if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
50017 + matchps->mode |= GR_DELETED;
50018 + FOR_EACH_ROLE_END(role)
50019 +
50020 + inodev->nentry->deleted = 1;
50021 +
50022 + return;
50023 +}
50024 +
50025 +void
50026 +gr_handle_delete(const ino_t ino, const dev_t dev)
50027 +{
50028 + struct inodev_entry *inodev;
50029 +
50030 + if (unlikely(!(gr_status & GR_READY)))
50031 + return;
50032 +
50033 + write_lock(&gr_inode_lock);
50034 + inodev = lookup_inodev_entry(ino, dev);
50035 + if (inodev != NULL)
50036 + do_handle_delete(inodev, ino, dev);
50037 + write_unlock(&gr_inode_lock);
50038 +
50039 + return;
50040 +}
50041 +
50042 +static void
50043 +update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
50044 + const ino_t newinode, const dev_t newdevice,
50045 + struct acl_subject_label *subj)
50046 +{
50047 + unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
50048 + struct acl_object_label *match;
50049 +
50050 + match = subj->obj_hash[index];
50051 +
50052 + while (match && (match->inode != oldinode ||
50053 + match->device != olddevice ||
50054 + !(match->mode & GR_DELETED)))
50055 + match = match->next;
50056 +
50057 + if (match && (match->inode == oldinode)
50058 + && (match->device == olddevice)
50059 + && (match->mode & GR_DELETED)) {
50060 + if (match->prev == NULL) {
50061 + subj->obj_hash[index] = match->next;
50062 + if (match->next != NULL)
50063 + match->next->prev = NULL;
50064 + } else {
50065 + match->prev->next = match->next;
50066 + if (match->next != NULL)
50067 + match->next->prev = match->prev;
50068 + }
50069 + match->prev = NULL;
50070 + match->next = NULL;
50071 + match->inode = newinode;
50072 + match->device = newdevice;
50073 + match->mode &= ~GR_DELETED;
50074 +
50075 + insert_acl_obj_label(match, subj);
50076 + }
50077 +
50078 + return;
50079 +}
50080 +
50081 +static void
50082 +update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
50083 + const ino_t newinode, const dev_t newdevice,
50084 + struct acl_role_label *role)
50085 +{
50086 + unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
50087 + struct acl_subject_label *match;
50088 +
50089 + match = role->subj_hash[index];
50090 +
50091 + while (match && (match->inode != oldinode ||
50092 + match->device != olddevice ||
50093 + !(match->mode & GR_DELETED)))
50094 + match = match->next;
50095 +
50096 + if (match && (match->inode == oldinode)
50097 + && (match->device == olddevice)
50098 + && (match->mode & GR_DELETED)) {
50099 + if (match->prev == NULL) {
50100 + role->subj_hash[index] = match->next;
50101 + if (match->next != NULL)
50102 + match->next->prev = NULL;
50103 + } else {
50104 + match->prev->next = match->next;
50105 + if (match->next != NULL)
50106 + match->next->prev = match->prev;
50107 + }
50108 + match->prev = NULL;
50109 + match->next = NULL;
50110 + match->inode = newinode;
50111 + match->device = newdevice;
50112 + match->mode &= ~GR_DELETED;
50113 +
50114 + insert_acl_subj_label(match, role);
50115 + }
50116 +
50117 + return;
50118 +}
50119 +
50120 +static void
50121 +update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
50122 + const ino_t newinode, const dev_t newdevice)
50123 +{
50124 + unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
50125 + struct inodev_entry *match;
50126 +
50127 + match = inodev_set.i_hash[index];
50128 +
50129 + while (match && (match->nentry->inode != oldinode ||
50130 + match->nentry->device != olddevice || !match->nentry->deleted))
50131 + match = match->next;
50132 +
50133 + if (match && (match->nentry->inode == oldinode)
50134 + && (match->nentry->device == olddevice) &&
50135 + match->nentry->deleted) {
50136 + if (match->prev == NULL) {
50137 + inodev_set.i_hash[index] = match->next;
50138 + if (match->next != NULL)
50139 + match->next->prev = NULL;
50140 + } else {
50141 + match->prev->next = match->next;
50142 + if (match->next != NULL)
50143 + match->next->prev = match->prev;
50144 + }
50145 + match->prev = NULL;
50146 + match->next = NULL;
50147 + match->nentry->inode = newinode;
50148 + match->nentry->device = newdevice;
50149 + match->nentry->deleted = 0;
50150 +
50151 + insert_inodev_entry(match);
50152 + }
50153 +
50154 + return;
50155 +}
50156 +
50157 +static void
50158 +__do_handle_create(const struct name_entry *matchn, ino_t ino, dev_t dev)
50159 +{
50160 + struct acl_subject_label *subj;
50161 + struct acl_role_label *role;
50162 + unsigned int x;
50163 +
50164 + FOR_EACH_ROLE_START(role)
50165 + update_acl_subj_label(matchn->inode, matchn->device, ino, dev, role);
50166 +
50167 + FOR_EACH_NESTED_SUBJECT_START(role, subj)
50168 + if ((subj->inode == ino) && (subj->device == dev)) {
50169 + subj->inode = ino;
50170 + subj->device = dev;
50171 + }
50172 + FOR_EACH_NESTED_SUBJECT_END(subj)
50173 + FOR_EACH_SUBJECT_START(role, subj, x)
50174 + update_acl_obj_label(matchn->inode, matchn->device,
50175 + ino, dev, subj);
50176 + FOR_EACH_SUBJECT_END(subj,x)
50177 + FOR_EACH_ROLE_END(role)
50178 +
50179 + update_inodev_entry(matchn->inode, matchn->device, ino, dev);
50180 +
50181 + return;
50182 +}
50183 +
50184 +static void
50185 +do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
50186 + const struct vfsmount *mnt)
50187 +{
50188 + ino_t ino = dentry->d_inode->i_ino;
50189 + dev_t dev = __get_dev(dentry);
50190 +
50191 + __do_handle_create(matchn, ino, dev);
50192 +
50193 + return;
50194 +}
50195 +
50196 +void
50197 +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
50198 +{
50199 + struct name_entry *matchn;
50200 +
50201 + if (unlikely(!(gr_status & GR_READY)))
50202 + return;
50203 +
50204 + preempt_disable();
50205 + matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
50206 +
50207 + if (unlikely((unsigned long)matchn)) {
50208 + write_lock(&gr_inode_lock);
50209 + do_handle_create(matchn, dentry, mnt);
50210 + write_unlock(&gr_inode_lock);
50211 + }
50212 + preempt_enable();
50213 +
50214 + return;
50215 +}
50216 +
50217 +void
50218 +gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
50219 +{
50220 + struct name_entry *matchn;
50221 +
50222 + if (unlikely(!(gr_status & GR_READY)))
50223 + return;
50224 +
50225 + preempt_disable();
50226 + matchn = lookup_name_entry(gr_to_proc_filename_rbac(dentry, init_pid_ns.proc_mnt));
50227 +
50228 + if (unlikely((unsigned long)matchn)) {
50229 + write_lock(&gr_inode_lock);
50230 + __do_handle_create(matchn, inode->i_ino, inode->i_sb->s_dev);
50231 + write_unlock(&gr_inode_lock);
50232 + }
50233 + preempt_enable();
50234 +
50235 + return;
50236 +}
50237 +
50238 +void
50239 +gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
50240 + struct dentry *old_dentry,
50241 + struct dentry *new_dentry,
50242 + struct vfsmount *mnt, const __u8 replace)
50243 +{
50244 + struct name_entry *matchn;
50245 + struct inodev_entry *inodev;
50246 + ino_t old_ino = old_dentry->d_inode->i_ino;
50247 + dev_t old_dev = __get_dev(old_dentry);
50248 +
50249 + /* vfs_rename swaps the name and parent link for old_dentry and
50250 + new_dentry
50251 + at this point, old_dentry has the new name, parent link, and inode
50252 + for the renamed file
50253 + if a file is being replaced by a rename, new_dentry has the inode
50254 + and name for the replaced file
50255 + */
50256 +
50257 + if (unlikely(!(gr_status & GR_READY)))
50258 + return;
50259 +
50260 + preempt_disable();
50261 + matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
50262 +
50263 + /* we wouldn't have to check d_inode if it weren't for
50264 + NFS silly-renaming
50265 + */
50266 +
50267 + write_lock(&gr_inode_lock);
50268 + if (unlikely(replace && new_dentry->d_inode)) {
50269 + ino_t new_ino = new_dentry->d_inode->i_ino;
50270 + dev_t new_dev = __get_dev(new_dentry);
50271 +
50272 + inodev = lookup_inodev_entry(new_ino, new_dev);
50273 + if (inodev != NULL && (new_dentry->d_inode->i_nlink <= 1))
50274 + do_handle_delete(inodev, new_ino, new_dev);
50275 + }
50276 +
50277 + inodev = lookup_inodev_entry(old_ino, old_dev);
50278 + if (inodev != NULL && (old_dentry->d_inode->i_nlink <= 1))
50279 + do_handle_delete(inodev, old_ino, old_dev);
50280 +
50281 + if (unlikely((unsigned long)matchn))
50282 + do_handle_create(matchn, old_dentry, mnt);
50283 +
50284 + write_unlock(&gr_inode_lock);
50285 + preempt_enable();
50286 +
50287 + return;
50288 +}
50289 +
50290 +static int
50291 +lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
50292 + unsigned char **sum)
50293 +{
50294 + struct acl_role_label *r;
50295 + struct role_allowed_ip *ipp;
50296 + struct role_transition *trans;
50297 + unsigned int i;
50298 + int found = 0;
50299 + u32 curr_ip = current->signal->curr_ip;
50300 +
50301 + current->signal->saved_ip = curr_ip;
50302 +
50303 + /* check transition table */
50304 +
50305 + for (trans = current->role->transitions; trans; trans = trans->next) {
50306 + if (!strcmp(rolename, trans->rolename)) {
50307 + found = 1;
50308 + break;
50309 + }
50310 + }
50311 +
50312 + if (!found)
50313 + return 0;
50314 +
50315 + /* handle special roles that do not require authentication
50316 + and check ip */
50317 +
50318 + FOR_EACH_ROLE_START(r)
50319 + if (!strcmp(rolename, r->rolename) &&
50320 + (r->roletype & GR_ROLE_SPECIAL)) {
50321 + found = 0;
50322 + if (r->allowed_ips != NULL) {
50323 + for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
50324 + if ((ntohl(curr_ip) & ipp->netmask) ==
50325 + (ntohl(ipp->addr) & ipp->netmask))
50326 + found = 1;
50327 + }
50328 + } else
50329 + found = 2;
50330 + if (!found)
50331 + return 0;
50332 +
50333 + if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
50334 + ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
50335 + *salt = NULL;
50336 + *sum = NULL;
50337 + return 1;
50338 + }
50339 + }
50340 + FOR_EACH_ROLE_END(r)
50341 +
50342 + for (i = 0; i < num_sprole_pws; i++) {
50343 + if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
50344 + *salt = acl_special_roles[i]->salt;
50345 + *sum = acl_special_roles[i]->sum;
50346 + return 1;
50347 + }
50348 + }
50349 +
50350 + return 0;
50351 +}
50352 +
50353 +static void
50354 +assign_special_role(char *rolename)
50355 +{
50356 + struct acl_object_label *obj;
50357 + struct acl_role_label *r;
50358 + struct acl_role_label *assigned = NULL;
50359 + struct task_struct *tsk;
50360 + struct file *filp;
50361 +
50362 + FOR_EACH_ROLE_START(r)
50363 + if (!strcmp(rolename, r->rolename) &&
50364 + (r->roletype & GR_ROLE_SPECIAL)) {
50365 + assigned = r;
50366 + break;
50367 + }
50368 + FOR_EACH_ROLE_END(r)
50369 +
50370 + if (!assigned)
50371 + return;
50372 +
50373 + read_lock(&tasklist_lock);
50374 + read_lock(&grsec_exec_file_lock);
50375 +
50376 + tsk = current->real_parent;
50377 + if (tsk == NULL)
50378 + goto out_unlock;
50379 +
50380 + filp = tsk->exec_file;
50381 + if (filp == NULL)
50382 + goto out_unlock;
50383 +
50384 + tsk->is_writable = 0;
50385 +
50386 + tsk->acl_sp_role = 1;
50387 + tsk->acl_role_id = ++acl_sp_role_value;
50388 + tsk->role = assigned;
50389 + tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
50390 +
50391 + /* ignore additional mmap checks for processes that are writable
50392 + by the default ACL */
50393 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
50394 + if (unlikely(obj->mode & GR_WRITE))
50395 + tsk->is_writable = 1;
50396 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
50397 + if (unlikely(obj->mode & GR_WRITE))
50398 + tsk->is_writable = 1;
50399 +
50400 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
50401 + printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
50402 +#endif
50403 +
50404 +out_unlock:
50405 + read_unlock(&grsec_exec_file_lock);
50406 + read_unlock(&tasklist_lock);
50407 + return;
50408 +}
50409 +
50410 +int gr_check_secure_terminal(struct task_struct *task)
50411 +{
50412 + struct task_struct *p, *p2, *p3;
50413 + struct files_struct *files;
50414 + struct fdtable *fdt;
50415 + struct file *our_file = NULL, *file;
50416 + int i;
50417 +
50418 + if (task->signal->tty == NULL)
50419 + return 1;
50420 +
50421 + files = get_files_struct(task);
50422 + if (files != NULL) {
50423 + rcu_read_lock();
50424 + fdt = files_fdtable(files);
50425 + for (i=0; i < fdt->max_fds; i++) {
50426 + file = fcheck_files(files, i);
50427 + if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
50428 + get_file(file);
50429 + our_file = file;
50430 + }
50431 + }
50432 + rcu_read_unlock();
50433 + put_files_struct(files);
50434 + }
50435 +
50436 + if (our_file == NULL)
50437 + return 1;
50438 +
50439 + read_lock(&tasklist_lock);
50440 + do_each_thread(p2, p) {
50441 + files = get_files_struct(p);
50442 + if (files == NULL ||
50443 + (p->signal && p->signal->tty == task->signal->tty)) {
50444 + if (files != NULL)
50445 + put_files_struct(files);
50446 + continue;
50447 + }
50448 + rcu_read_lock();
50449 + fdt = files_fdtable(files);
50450 + for (i=0; i < fdt->max_fds; i++) {
50451 + file = fcheck_files(files, i);
50452 + if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
50453 + file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
50454 + p3 = task;
50455 + while (p3->pid > 0) {
50456 + if (p3 == p)
50457 + break;
50458 + p3 = p3->real_parent;
50459 + }
50460 + if (p3 == p)
50461 + break;
50462 + gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
50463 + gr_handle_alertkill(p);
50464 + rcu_read_unlock();
50465 + put_files_struct(files);
50466 + read_unlock(&tasklist_lock);
50467 + fput(our_file);
50468 + return 0;
50469 + }
50470 + }
50471 + rcu_read_unlock();
50472 + put_files_struct(files);
50473 + } while_each_thread(p2, p);
50474 + read_unlock(&tasklist_lock);
50475 +
50476 + fput(our_file);
50477 + return 1;
50478 +}
50479 +
50480 +ssize_t
50481 +write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
50482 +{
50483 + struct gr_arg_wrapper uwrap;
50484 + unsigned char *sprole_salt = NULL;
50485 + unsigned char *sprole_sum = NULL;
50486 + int error = sizeof (struct gr_arg_wrapper);
50487 + int error2 = 0;
50488 +
50489 + mutex_lock(&gr_dev_mutex);
50490 +
50491 + if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
50492 + error = -EPERM;
50493 + goto out;
50494 + }
50495 +
50496 + if (count != sizeof (struct gr_arg_wrapper)) {
50497 + gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
50498 + error = -EINVAL;
50499 + goto out;
50500 + }
50501 +
50502 +
50503 + if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
50504 + gr_auth_expires = 0;
50505 + gr_auth_attempts = 0;
50506 + }
50507 +
50508 + if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
50509 + error = -EFAULT;
50510 + goto out;
50511 + }
50512 +
50513 + if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
50514 + error = -EINVAL;
50515 + goto out;
50516 + }
50517 +
50518 + if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
50519 + error = -EFAULT;
50520 + goto out;
50521 + }
50522 +
50523 + if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
50524 + gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
50525 + time_after(gr_auth_expires, get_seconds())) {
50526 + error = -EBUSY;
50527 + goto out;
50528 + }
50529 +
50530 + /* if non-root trying to do anything other than use a special role,
50531 + do not attempt authentication, do not count towards authentication
50532 + locking
50533 + */
50534 +
50535 + if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
50536 + gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
50537 + current_uid()) {
50538 + error = -EPERM;
50539 + goto out;
50540 + }
50541 +
50542 + /* ensure pw and special role name are null terminated */
50543 +
50544 + gr_usermode->pw[GR_PW_LEN - 1] = '\0';
50545 + gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
50546 +
50547 + /* Okay.
50548 + * We have our enough of the argument structure..(we have yet
50549 + * to copy_from_user the tables themselves) . Copy the tables
50550 + * only if we need them, i.e. for loading operations. */
50551 +
50552 + switch (gr_usermode->mode) {
50553 + case GR_STATUS:
50554 + if (gr_status & GR_READY) {
50555 + error = 1;
50556 + if (!gr_check_secure_terminal(current))
50557 + error = 3;
50558 + } else
50559 + error = 2;
50560 + goto out;
50561 + case GR_SHUTDOWN:
50562 + if ((gr_status & GR_READY)
50563 + && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
50564 + pax_open_kernel();
50565 + gr_status &= ~GR_READY;
50566 + pax_close_kernel();
50567 +
50568 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
50569 + free_variables();
50570 + memset(gr_usermode, 0, sizeof (struct gr_arg));
50571 + memset(gr_system_salt, 0, GR_SALT_LEN);
50572 + memset(gr_system_sum, 0, GR_SHA_LEN);
50573 + } else if (gr_status & GR_READY) {
50574 + gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
50575 + error = -EPERM;
50576 + } else {
50577 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
50578 + error = -EAGAIN;
50579 + }
50580 + break;
50581 + case GR_ENABLE:
50582 + if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
50583 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
50584 + else {
50585 + if (gr_status & GR_READY)
50586 + error = -EAGAIN;
50587 + else
50588 + error = error2;
50589 + gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
50590 + }
50591 + break;
50592 + case GR_RELOAD:
50593 + if (!(gr_status & GR_READY)) {
50594 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
50595 + error = -EAGAIN;
50596 + } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
50597 + preempt_disable();
50598 +
50599 + pax_open_kernel();
50600 + gr_status &= ~GR_READY;
50601 + pax_close_kernel();
50602 +
50603 + free_variables();
50604 + if (!(error2 = gracl_init(gr_usermode))) {
50605 + preempt_enable();
50606 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
50607 + } else {
50608 + preempt_enable();
50609 + error = error2;
50610 + gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
50611 + }
50612 + } else {
50613 + gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
50614 + error = -EPERM;
50615 + }
50616 + break;
50617 + case GR_SEGVMOD:
50618 + if (unlikely(!(gr_status & GR_READY))) {
50619 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
50620 + error = -EAGAIN;
50621 + break;
50622 + }
50623 +
50624 + if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
50625 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
50626 + if (gr_usermode->segv_device && gr_usermode->segv_inode) {
50627 + struct acl_subject_label *segvacl;
50628 + segvacl =
50629 + lookup_acl_subj_label(gr_usermode->segv_inode,
50630 + gr_usermode->segv_device,
50631 + current->role);
50632 + if (segvacl) {
50633 + segvacl->crashes = 0;
50634 + segvacl->expires = 0;
50635 + }
50636 + } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
50637 + gr_remove_uid(gr_usermode->segv_uid);
50638 + }
50639 + } else {
50640 + gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
50641 + error = -EPERM;
50642 + }
50643 + break;
50644 + case GR_SPROLE:
50645 + case GR_SPROLEPAM:
50646 + if (unlikely(!(gr_status & GR_READY))) {
50647 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
50648 + error = -EAGAIN;
50649 + break;
50650 + }
50651 +
50652 + if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
50653 + current->role->expires = 0;
50654 + current->role->auth_attempts = 0;
50655 + }
50656 +
50657 + if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
50658 + time_after(current->role->expires, get_seconds())) {
50659 + error = -EBUSY;
50660 + goto out;
50661 + }
50662 +
50663 + if (lookup_special_role_auth
50664 + (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
50665 + && ((!sprole_salt && !sprole_sum)
50666 + || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
50667 + char *p = "";
50668 + assign_special_role(gr_usermode->sp_role);
50669 + read_lock(&tasklist_lock);
50670 + if (current->real_parent)
50671 + p = current->real_parent->role->rolename;
50672 + read_unlock(&tasklist_lock);
50673 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
50674 + p, acl_sp_role_value);
50675 + } else {
50676 + gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
50677 + error = -EPERM;
50678 + if(!(current->role->auth_attempts++))
50679 + current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
50680 +
50681 + goto out;
50682 + }
50683 + break;
50684 + case GR_UNSPROLE:
50685 + if (unlikely(!(gr_status & GR_READY))) {
50686 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
50687 + error = -EAGAIN;
50688 + break;
50689 + }
50690 +
50691 + if (current->role->roletype & GR_ROLE_SPECIAL) {
50692 + char *p = "";
50693 + int i = 0;
50694 +
50695 + read_lock(&tasklist_lock);
50696 + if (current->real_parent) {
50697 + p = current->real_parent->role->rolename;
50698 + i = current->real_parent->acl_role_id;
50699 + }
50700 + read_unlock(&tasklist_lock);
50701 +
50702 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
50703 + gr_set_acls(1);
50704 + } else {
50705 + error = -EPERM;
50706 + goto out;
50707 + }
50708 + break;
50709 + default:
50710 + gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
50711 + error = -EINVAL;
50712 + break;
50713 + }
50714 +
50715 + if (error != -EPERM)
50716 + goto out;
50717 +
50718 + if(!(gr_auth_attempts++))
50719 + gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
50720 +
50721 + out:
50722 + mutex_unlock(&gr_dev_mutex);
50723 + return error;
50724 +}
50725 +
50726 +/* must be called with
50727 + rcu_read_lock();
50728 + read_lock(&tasklist_lock);
50729 + read_lock(&grsec_exec_file_lock);
50730 +*/
50731 +int gr_apply_subject_to_task(struct task_struct *task)
50732 +{
50733 + struct acl_object_label *obj;
50734 + char *tmpname;
50735 + struct acl_subject_label *tmpsubj;
50736 + struct file *filp;
50737 + struct name_entry *nmatch;
50738 +
50739 + filp = task->exec_file;
50740 + if (filp == NULL)
50741 + return 0;
50742 +
50743 + /* the following is to apply the correct subject
50744 + on binaries running when the RBAC system
50745 + is enabled, when the binaries have been
50746 + replaced or deleted since their execution
50747 + -----
50748 + when the RBAC system starts, the inode/dev
50749 + from exec_file will be one the RBAC system
50750 + is unaware of. It only knows the inode/dev
50751 + of the present file on disk, or the absence
50752 + of it.
50753 + */
50754 + preempt_disable();
50755 + tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
50756 +
50757 + nmatch = lookup_name_entry(tmpname);
50758 + preempt_enable();
50759 + tmpsubj = NULL;
50760 + if (nmatch) {
50761 + if (nmatch->deleted)
50762 + tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
50763 + else
50764 + tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
50765 + if (tmpsubj != NULL)
50766 + task->acl = tmpsubj;
50767 + }
50768 + if (tmpsubj == NULL)
50769 + task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
50770 + task->role);
50771 + if (task->acl) {
50772 + task->is_writable = 0;
50773 + /* ignore additional mmap checks for processes that are writable
50774 + by the default ACL */
50775 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
50776 + if (unlikely(obj->mode & GR_WRITE))
50777 + task->is_writable = 1;
50778 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
50779 + if (unlikely(obj->mode & GR_WRITE))
50780 + task->is_writable = 1;
50781 +
50782 + gr_set_proc_res(task);
50783 +
50784 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
50785 + printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
50786 +#endif
50787 + } else {
50788 + return 1;
50789 + }
50790 +
50791 + return 0;
50792 +}
50793 +
50794 +int
50795 +gr_set_acls(const int type)
50796 +{
50797 + struct task_struct *task, *task2;
50798 + struct acl_role_label *role = current->role;
50799 + __u16 acl_role_id = current->acl_role_id;
50800 + const struct cred *cred;
50801 + int ret;
50802 +
50803 + rcu_read_lock();
50804 + read_lock(&tasklist_lock);
50805 + read_lock(&grsec_exec_file_lock);
50806 + do_each_thread(task2, task) {
50807 + /* check to see if we're called from the exit handler,
50808 + if so, only replace ACLs that have inherited the admin
50809 + ACL */
50810 +
50811 + if (type && (task->role != role ||
50812 + task->acl_role_id != acl_role_id))
50813 + continue;
50814 +
50815 + task->acl_role_id = 0;
50816 + task->acl_sp_role = 0;
50817 +
50818 + if (task->exec_file) {
50819 + cred = __task_cred(task);
50820 + task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
50821 + ret = gr_apply_subject_to_task(task);
50822 + if (ret) {
50823 + read_unlock(&grsec_exec_file_lock);
50824 + read_unlock(&tasklist_lock);
50825 + rcu_read_unlock();
50826 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
50827 + return ret;
50828 + }
50829 + } else {
50830 + // it's a kernel process
50831 + task->role = kernel_role;
50832 + task->acl = kernel_role->root_label;
50833 +#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
50834 + task->acl->mode &= ~GR_PROCFIND;
50835 +#endif
50836 + }
50837 + } while_each_thread(task2, task);
50838 + read_unlock(&grsec_exec_file_lock);
50839 + read_unlock(&tasklist_lock);
50840 + rcu_read_unlock();
50841 +
50842 + return 0;
50843 +}
50844 +
50845 +void
50846 +gr_learn_resource(const struct task_struct *task,
50847 + const int res, const unsigned long wanted, const int gt)
50848 +{
50849 + struct acl_subject_label *acl;
50850 + const struct cred *cred;
50851 +
50852 + if (unlikely((gr_status & GR_READY) &&
50853 + task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
50854 + goto skip_reslog;
50855 +
50856 +#ifdef CONFIG_GRKERNSEC_RESLOG
50857 + gr_log_resource(task, res, wanted, gt);
50858 +#endif
50859 + skip_reslog:
50860 +
50861 + if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
50862 + return;
50863 +
50864 + acl = task->acl;
50865 +
50866 + if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
50867 + !(acl->resmask & (1 << (unsigned short) res))))
50868 + return;
50869 +
50870 + if (wanted >= acl->res[res].rlim_cur) {
50871 + unsigned long res_add;
50872 +
50873 + res_add = wanted;
50874 + switch (res) {
50875 + case RLIMIT_CPU:
50876 + res_add += GR_RLIM_CPU_BUMP;
50877 + break;
50878 + case RLIMIT_FSIZE:
50879 + res_add += GR_RLIM_FSIZE_BUMP;
50880 + break;
50881 + case RLIMIT_DATA:
50882 + res_add += GR_RLIM_DATA_BUMP;
50883 + break;
50884 + case RLIMIT_STACK:
50885 + res_add += GR_RLIM_STACK_BUMP;
50886 + break;
50887 + case RLIMIT_CORE:
50888 + res_add += GR_RLIM_CORE_BUMP;
50889 + break;
50890 + case RLIMIT_RSS:
50891 + res_add += GR_RLIM_RSS_BUMP;
50892 + break;
50893 + case RLIMIT_NPROC:
50894 + res_add += GR_RLIM_NPROC_BUMP;
50895 + break;
50896 + case RLIMIT_NOFILE:
50897 + res_add += GR_RLIM_NOFILE_BUMP;
50898 + break;
50899 + case RLIMIT_MEMLOCK:
50900 + res_add += GR_RLIM_MEMLOCK_BUMP;
50901 + break;
50902 + case RLIMIT_AS:
50903 + res_add += GR_RLIM_AS_BUMP;
50904 + break;
50905 + case RLIMIT_LOCKS:
50906 + res_add += GR_RLIM_LOCKS_BUMP;
50907 + break;
50908 + case RLIMIT_SIGPENDING:
50909 + res_add += GR_RLIM_SIGPENDING_BUMP;
50910 + break;
50911 + case RLIMIT_MSGQUEUE:
50912 + res_add += GR_RLIM_MSGQUEUE_BUMP;
50913 + break;
50914 + case RLIMIT_NICE:
50915 + res_add += GR_RLIM_NICE_BUMP;
50916 + break;
50917 + case RLIMIT_RTPRIO:
50918 + res_add += GR_RLIM_RTPRIO_BUMP;
50919 + break;
50920 + case RLIMIT_RTTIME:
50921 + res_add += GR_RLIM_RTTIME_BUMP;
50922 + break;
50923 + }
50924 +
50925 + acl->res[res].rlim_cur = res_add;
50926 +
50927 + if (wanted > acl->res[res].rlim_max)
50928 + acl->res[res].rlim_max = res_add;
50929 +
50930 + /* only log the subject filename, since resource logging is supported for
50931 + single-subject learning only */
50932 + rcu_read_lock();
50933 + cred = __task_cred(task);
50934 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
50935 + task->role->roletype, cred->uid, cred->gid, acl->filename,
50936 + acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
50937 + "", (unsigned long) res, &task->signal->saved_ip);
50938 + rcu_read_unlock();
50939 + }
50940 +
50941 + return;
50942 +}
50943 +
50944 +#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
50945 +void
50946 +pax_set_initial_flags(struct linux_binprm *bprm)
50947 +{
50948 + struct task_struct *task = current;
50949 + struct acl_subject_label *proc;
50950 + unsigned long flags;
50951 +
50952 + if (unlikely(!(gr_status & GR_READY)))
50953 + return;
50954 +
50955 + flags = pax_get_flags(task);
50956 +
50957 + proc = task->acl;
50958 +
50959 + if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
50960 + flags &= ~MF_PAX_PAGEEXEC;
50961 + if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
50962 + flags &= ~MF_PAX_SEGMEXEC;
50963 + if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
50964 + flags &= ~MF_PAX_RANDMMAP;
50965 + if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
50966 + flags &= ~MF_PAX_EMUTRAMP;
50967 + if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
50968 + flags &= ~MF_PAX_MPROTECT;
50969 +
50970 + if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
50971 + flags |= MF_PAX_PAGEEXEC;
50972 + if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
50973 + flags |= MF_PAX_SEGMEXEC;
50974 + if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
50975 + flags |= MF_PAX_RANDMMAP;
50976 + if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
50977 + flags |= MF_PAX_EMUTRAMP;
50978 + if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
50979 + flags |= MF_PAX_MPROTECT;
50980 +
50981 + pax_set_flags(task, flags);
50982 +
50983 + return;
50984 +}
50985 +#endif
50986 +
50987 +#ifdef CONFIG_SYSCTL
50988 +/* Eric Biederman likes breaking userland ABI and every inode-based security
50989 + system to save 35kb of memory */
50990 +
50991 +/* we modify the passed in filename, but adjust it back before returning */
50992 +static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
50993 +{
50994 + struct name_entry *nmatch;
50995 + char *p, *lastp = NULL;
50996 + struct acl_object_label *obj = NULL, *tmp;
50997 + struct acl_subject_label *tmpsubj;
50998 + char c = '\0';
50999 +
51000 + read_lock(&gr_inode_lock);
51001 +
51002 + p = name + len - 1;
51003 + do {
51004 + nmatch = lookup_name_entry(name);
51005 + if (lastp != NULL)
51006 + *lastp = c;
51007 +
51008 + if (nmatch == NULL)
51009 + goto next_component;
51010 + tmpsubj = current->acl;
51011 + do {
51012 + obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
51013 + if (obj != NULL) {
51014 + tmp = obj->globbed;
51015 + while (tmp) {
51016 + if (!glob_match(tmp->filename, name)) {
51017 + obj = tmp;
51018 + goto found_obj;
51019 + }
51020 + tmp = tmp->next;
51021 + }
51022 + goto found_obj;
51023 + }
51024 + } while ((tmpsubj = tmpsubj->parent_subject));
51025 +next_component:
51026 + /* end case */
51027 + if (p == name)
51028 + break;
51029 +
51030 + while (*p != '/')
51031 + p--;
51032 + if (p == name)
51033 + lastp = p + 1;
51034 + else {
51035 + lastp = p;
51036 + p--;
51037 + }
51038 + c = *lastp;
51039 + *lastp = '\0';
51040 + } while (1);
51041 +found_obj:
51042 + read_unlock(&gr_inode_lock);
51043 + /* obj returned will always be non-null */
51044 + return obj;
51045 +}
51046 +
51047 +/* returns 0 when allowing, non-zero on error
51048 + op of 0 is used for readdir, so we don't log the names of hidden files
51049 +*/
51050 +__u32
51051 +gr_handle_sysctl(const struct ctl_table *table, const int op)
51052 +{
51053 + struct ctl_table *tmp;
51054 + const char *proc_sys = "/proc/sys";
51055 + char *path;
51056 + struct acl_object_label *obj;
51057 + unsigned short len = 0, pos = 0, depth = 0, i;
51058 + __u32 err = 0;
51059 + __u32 mode = 0;
51060 +
51061 + if (unlikely(!(gr_status & GR_READY)))
51062 + return 0;
51063 +
51064 + /* for now, ignore operations on non-sysctl entries if it's not a
51065 + readdir*/
51066 + if (table->child != NULL && op != 0)
51067 + return 0;
51068 +
51069 + mode |= GR_FIND;
51070 + /* it's only a read if it's an entry, read on dirs is for readdir */
51071 + if (op & MAY_READ)
51072 + mode |= GR_READ;
51073 + if (op & MAY_WRITE)
51074 + mode |= GR_WRITE;
51075 +
51076 + preempt_disable();
51077 +
51078 + path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
51079 +
51080 + /* it's only a read/write if it's an actual entry, not a dir
51081 + (which are opened for readdir)
51082 + */
51083 +
51084 + /* convert the requested sysctl entry into a pathname */
51085 +
51086 + for (tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
51087 + len += strlen(tmp->procname);
51088 + len++;
51089 + depth++;
51090 + }
51091 +
51092 + if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
51093 + /* deny */
51094 + goto out;
51095 + }
51096 +
51097 + memset(path, 0, PAGE_SIZE);
51098 +
51099 + memcpy(path, proc_sys, strlen(proc_sys));
51100 +
51101 + pos += strlen(proc_sys);
51102 +
51103 + for (; depth > 0; depth--) {
51104 + path[pos] = '/';
51105 + pos++;
51106 + for (i = 1, tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
51107 + if (depth == i) {
51108 + memcpy(path + pos, tmp->procname,
51109 + strlen(tmp->procname));
51110 + pos += strlen(tmp->procname);
51111 + }
51112 + i++;
51113 + }
51114 + }
51115 +
51116 + obj = gr_lookup_by_name(path, pos);
51117 + err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
51118 +
51119 + if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
51120 + ((err & mode) != mode))) {
51121 + __u32 new_mode = mode;
51122 +
51123 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
51124 +
51125 + err = 0;
51126 + gr_log_learn_sysctl(path, new_mode);
51127 + } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
51128 + gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
51129 + err = -ENOENT;
51130 + } else if (!(err & GR_FIND)) {
51131 + err = -ENOENT;
51132 + } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
51133 + gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
51134 + path, (mode & GR_READ) ? " reading" : "",
51135 + (mode & GR_WRITE) ? " writing" : "");
51136 + err = -EACCES;
51137 + } else if ((err & mode) != mode) {
51138 + err = -EACCES;
51139 + } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
51140 + gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
51141 + path, (mode & GR_READ) ? " reading" : "",
51142 + (mode & GR_WRITE) ? " writing" : "");
51143 + err = 0;
51144 + } else
51145 + err = 0;
51146 +
51147 + out:
51148 + preempt_enable();
51149 +
51150 + return err;
51151 +}
51152 +#endif
51153 +
51154 +int
51155 +gr_handle_proc_ptrace(struct task_struct *task)
51156 +{
51157 + struct file *filp;
51158 + struct task_struct *tmp = task;
51159 + struct task_struct *curtemp = current;
51160 + __u32 retmode;
51161 +
51162 +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
51163 + if (unlikely(!(gr_status & GR_READY)))
51164 + return 0;
51165 +#endif
51166 +
51167 + read_lock(&tasklist_lock);
51168 + read_lock(&grsec_exec_file_lock);
51169 + filp = task->exec_file;
51170 +
51171 + while (tmp->pid > 0) {
51172 + if (tmp == curtemp)
51173 + break;
51174 + tmp = tmp->real_parent;
51175 + }
51176 +
51177 + if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
51178 + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
51179 + read_unlock(&grsec_exec_file_lock);
51180 + read_unlock(&tasklist_lock);
51181 + return 1;
51182 + }
51183 +
51184 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
51185 + if (!(gr_status & GR_READY)) {
51186 + read_unlock(&grsec_exec_file_lock);
51187 + read_unlock(&tasklist_lock);
51188 + return 0;
51189 + }
51190 +#endif
51191 +
51192 + retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
51193 + read_unlock(&grsec_exec_file_lock);
51194 + read_unlock(&tasklist_lock);
51195 +
51196 + if (retmode & GR_NOPTRACE)
51197 + return 1;
51198 +
51199 + if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
51200 + && (current->acl != task->acl || (current->acl != current->role->root_label
51201 + && current->pid != task->pid)))
51202 + return 1;
51203 +
51204 + return 0;
51205 +}
51206 +
51207 +void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
51208 +{
51209 + if (unlikely(!(gr_status & GR_READY)))
51210 + return;
51211 +
51212 + if (!(current->role->roletype & GR_ROLE_GOD))
51213 + return;
51214 +
51215 + seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
51216 + p->role->rolename, gr_task_roletype_to_char(p),
51217 + p->acl->filename);
51218 +}
51219 +
51220 +int
51221 +gr_handle_ptrace(struct task_struct *task, const long request)
51222 +{
51223 + struct task_struct *tmp = task;
51224 + struct task_struct *curtemp = current;
51225 + __u32 retmode;
51226 +
51227 +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
51228 + if (unlikely(!(gr_status & GR_READY)))
51229 + return 0;
51230 +#endif
51231 +
51232 + read_lock(&tasklist_lock);
51233 + while (tmp->pid > 0) {
51234 + if (tmp == curtemp)
51235 + break;
51236 + tmp = tmp->real_parent;
51237 + }
51238 +
51239 + if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
51240 + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
51241 + read_unlock(&tasklist_lock);
51242 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
51243 + return 1;
51244 + }
51245 + read_unlock(&tasklist_lock);
51246 +
51247 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
51248 + if (!(gr_status & GR_READY))
51249 + return 0;
51250 +#endif
51251 +
51252 + read_lock(&grsec_exec_file_lock);
51253 + if (unlikely(!task->exec_file)) {
51254 + read_unlock(&grsec_exec_file_lock);
51255 + return 0;
51256 + }
51257 +
51258 + retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
51259 + read_unlock(&grsec_exec_file_lock);
51260 +
51261 + if (retmode & GR_NOPTRACE) {
51262 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
51263 + return 1;
51264 + }
51265 +
51266 + if (retmode & GR_PTRACERD) {
51267 + switch (request) {
51268 + case PTRACE_POKETEXT:
51269 + case PTRACE_POKEDATA:
51270 + case PTRACE_POKEUSR:
51271 +#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
51272 + case PTRACE_SETREGS:
51273 + case PTRACE_SETFPREGS:
51274 +#endif
51275 +#ifdef CONFIG_X86
51276 + case PTRACE_SETFPXREGS:
51277 +#endif
51278 +#ifdef CONFIG_ALTIVEC
51279 + case PTRACE_SETVRREGS:
51280 +#endif
51281 + return 1;
51282 + default:
51283 + return 0;
51284 + }
51285 + } else if (!(current->acl->mode & GR_POVERRIDE) &&
51286 + !(current->role->roletype & GR_ROLE_GOD) &&
51287 + (current->acl != task->acl)) {
51288 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
51289 + return 1;
51290 + }
51291 +
51292 + return 0;
51293 +}
51294 +
51295 +static int is_writable_mmap(const struct file *filp)
51296 +{
51297 + struct task_struct *task = current;
51298 + struct acl_object_label *obj, *obj2;
51299 +
51300 + if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
51301 + !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
51302 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
51303 + obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
51304 + task->role->root_label);
51305 + if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
51306 + gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
51307 + return 1;
51308 + }
51309 + }
51310 + return 0;
51311 +}
51312 +
51313 +int
51314 +gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
51315 +{
51316 + __u32 mode;
51317 +
51318 + if (unlikely(!file || !(prot & PROT_EXEC)))
51319 + return 1;
51320 +
51321 + if (is_writable_mmap(file))
51322 + return 0;
51323 +
51324 + mode =
51325 + gr_search_file(file->f_path.dentry,
51326 + GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
51327 + file->f_path.mnt);
51328 +
51329 + if (!gr_tpe_allow(file))
51330 + return 0;
51331 +
51332 + if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
51333 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
51334 + return 0;
51335 + } else if (unlikely(!(mode & GR_EXEC))) {
51336 + return 0;
51337 + } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
51338 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
51339 + return 1;
51340 + }
51341 +
51342 + return 1;
51343 +}
51344 +
51345 +int
51346 +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
51347 +{
51348 + __u32 mode;
51349 +
51350 + if (unlikely(!file || !(prot & PROT_EXEC)))
51351 + return 1;
51352 +
51353 + if (is_writable_mmap(file))
51354 + return 0;
51355 +
51356 + mode =
51357 + gr_search_file(file->f_path.dentry,
51358 + GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
51359 + file->f_path.mnt);
51360 +
51361 + if (!gr_tpe_allow(file))
51362 + return 0;
51363 +
51364 + if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
51365 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
51366 + return 0;
51367 + } else if (unlikely(!(mode & GR_EXEC))) {
51368 + return 0;
51369 + } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
51370 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
51371 + return 1;
51372 + }
51373 +
51374 + return 1;
51375 +}
51376 +
51377 +void
51378 +gr_acl_handle_psacct(struct task_struct *task, const long code)
51379 +{
51380 + unsigned long runtime;
51381 + unsigned long cputime;
51382 + unsigned int wday, cday;
51383 + __u8 whr, chr;
51384 + __u8 wmin, cmin;
51385 + __u8 wsec, csec;
51386 + struct timespec timeval;
51387 +
51388 + if (unlikely(!(gr_status & GR_READY) || !task->acl ||
51389 + !(task->acl->mode & GR_PROCACCT)))
51390 + return;
51391 +
51392 + do_posix_clock_monotonic_gettime(&timeval);
51393 + runtime = timeval.tv_sec - task->start_time.tv_sec;
51394 + wday = runtime / (3600 * 24);
51395 + runtime -= wday * (3600 * 24);
51396 + whr = runtime / 3600;
51397 + runtime -= whr * 3600;
51398 + wmin = runtime / 60;
51399 + runtime -= wmin * 60;
51400 + wsec = runtime;
51401 +
51402 + cputime = (task->utime + task->stime) / HZ;
51403 + cday = cputime / (3600 * 24);
51404 + cputime -= cday * (3600 * 24);
51405 + chr = cputime / 3600;
51406 + cputime -= chr * 3600;
51407 + cmin = cputime / 60;
51408 + cputime -= cmin * 60;
51409 + csec = cputime;
51410 +
51411 + gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
51412 +
51413 + return;
51414 +}
51415 +
51416 +void gr_set_kernel_label(struct task_struct *task)
51417 +{
51418 + if (gr_status & GR_READY) {
51419 + task->role = kernel_role;
51420 + task->acl = kernel_role->root_label;
51421 + }
51422 + return;
51423 +}
51424 +
51425 +#ifdef CONFIG_TASKSTATS
51426 +int gr_is_taskstats_denied(int pid)
51427 +{
51428 + struct task_struct *task;
51429 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
51430 + const struct cred *cred;
51431 +#endif
51432 + int ret = 0;
51433 +
51434 + /* restrict taskstats viewing to un-chrooted root users
51435 + who have the 'view' subject flag if the RBAC system is enabled
51436 + */
51437 +
51438 + rcu_read_lock();
51439 + read_lock(&tasklist_lock);
51440 + task = find_task_by_vpid(pid);
51441 + if (task) {
51442 +#ifdef CONFIG_GRKERNSEC_CHROOT
51443 + if (proc_is_chrooted(task))
51444 + ret = -EACCES;
51445 +#endif
51446 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
51447 + cred = __task_cred(task);
51448 +#ifdef CONFIG_GRKERNSEC_PROC_USER
51449 + if (cred->uid != 0)
51450 + ret = -EACCES;
51451 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
51452 + if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
51453 + ret = -EACCES;
51454 +#endif
51455 +#endif
51456 + if (gr_status & GR_READY) {
51457 + if (!(task->acl->mode & GR_VIEW))
51458 + ret = -EACCES;
51459 + }
51460 + } else
51461 + ret = -ENOENT;
51462 +
51463 + read_unlock(&tasklist_lock);
51464 + rcu_read_unlock();
51465 +
51466 + return ret;
51467 +}
51468 +#endif
51469 +
51470 +/* AUXV entries are filled via a descendant of search_binary_handler
51471 + after we've already applied the subject for the target
51472 +*/
51473 +int gr_acl_enable_at_secure(void)
51474 +{
51475 + if (unlikely(!(gr_status & GR_READY)))
51476 + return 0;
51477 +
51478 + if (current->acl->mode & GR_ATSECURE)
51479 + return 1;
51480 +
51481 + return 0;
51482 +}
51483 +
51484 +int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
51485 +{
51486 + struct task_struct *task = current;
51487 + struct dentry *dentry = file->f_path.dentry;
51488 + struct vfsmount *mnt = file->f_path.mnt;
51489 + struct acl_object_label *obj, *tmp;
51490 + struct acl_subject_label *subj;
51491 + unsigned int bufsize;
51492 + int is_not_root;
51493 + char *path;
51494 + dev_t dev = __get_dev(dentry);
51495 +
51496 + if (unlikely(!(gr_status & GR_READY)))
51497 + return 1;
51498 +
51499 + if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
51500 + return 1;
51501 +
51502 + /* ignore Eric Biederman */
51503 + if (IS_PRIVATE(dentry->d_inode))
51504 + return 1;
51505 +
51506 + subj = task->acl;
51507 + do {
51508 + obj = lookup_acl_obj_label(ino, dev, subj);
51509 + if (obj != NULL)
51510 + return (obj->mode & GR_FIND) ? 1 : 0;
51511 + } while ((subj = subj->parent_subject));
51512 +
51513 + /* this is purely an optimization since we're looking for an object
51514 + for the directory we're doing a readdir on
51515 + if it's possible for any globbed object to match the entry we're
51516 + filling into the directory, then the object we find here will be
51517 + an anchor point with attached globbed objects
51518 + */
51519 + obj = chk_obj_label_noglob(dentry, mnt, task->acl);
51520 + if (obj->globbed == NULL)
51521 + return (obj->mode & GR_FIND) ? 1 : 0;
51522 +
51523 + is_not_root = ((obj->filename[0] == '/') &&
51524 + (obj->filename[1] == '\0')) ? 0 : 1;
51525 + bufsize = PAGE_SIZE - namelen - is_not_root;
51526 +
51527 + /* check bufsize > PAGE_SIZE || bufsize == 0 */
51528 + if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
51529 + return 1;
51530 +
51531 + preempt_disable();
51532 + path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
51533 + bufsize);
51534 +
51535 + bufsize = strlen(path);
51536 +
51537 + /* if base is "/", don't append an additional slash */
51538 + if (is_not_root)
51539 + *(path + bufsize) = '/';
51540 + memcpy(path + bufsize + is_not_root, name, namelen);
51541 + *(path + bufsize + namelen + is_not_root) = '\0';
51542 +
51543 + tmp = obj->globbed;
51544 + while (tmp) {
51545 + if (!glob_match(tmp->filename, path)) {
51546 + preempt_enable();
51547 + return (tmp->mode & GR_FIND) ? 1 : 0;
51548 + }
51549 + tmp = tmp->next;
51550 + }
51551 + preempt_enable();
51552 + return (obj->mode & GR_FIND) ? 1 : 0;
51553 +}
51554 +
51555 +#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
51556 +EXPORT_SYMBOL(gr_acl_is_enabled);
51557 +#endif
51558 +EXPORT_SYMBOL(gr_learn_resource);
51559 +EXPORT_SYMBOL(gr_set_kernel_label);
51560 +#ifdef CONFIG_SECURITY
51561 +EXPORT_SYMBOL(gr_check_user_change);
51562 +EXPORT_SYMBOL(gr_check_group_change);
51563 +#endif
51564 +
51565 diff -urNp linux-3.0.8/grsecurity/gracl_cap.c linux-3.0.8/grsecurity/gracl_cap.c
51566 --- linux-3.0.8/grsecurity/gracl_cap.c 1969-12-31 19:00:00.000000000 -0500
51567 +++ linux-3.0.8/grsecurity/gracl_cap.c 2011-09-14 09:21:24.000000000 -0400
51568 @@ -0,0 +1,101 @@
51569 +#include <linux/kernel.h>
51570 +#include <linux/module.h>
51571 +#include <linux/sched.h>
51572 +#include <linux/gracl.h>
51573 +#include <linux/grsecurity.h>
51574 +#include <linux/grinternal.h>
51575 +
51576 +extern const char *captab_log[];
51577 +extern int captab_log_entries;
51578 +
51579 +int
51580 +gr_acl_is_capable(const int cap)
51581 +{
51582 + struct task_struct *task = current;
51583 + const struct cred *cred = current_cred();
51584 + struct acl_subject_label *curracl;
51585 + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
51586 + kernel_cap_t cap_audit = __cap_empty_set;
51587 +
51588 + if (!gr_acl_is_enabled())
51589 + return 1;
51590 +
51591 + curracl = task->acl;
51592 +
51593 + cap_drop = curracl->cap_lower;
51594 + cap_mask = curracl->cap_mask;
51595 + cap_audit = curracl->cap_invert_audit;
51596 +
51597 + while ((curracl = curracl->parent_subject)) {
51598 + /* if the cap isn't specified in the current computed mask but is specified in the
51599 + current level subject, and is lowered in the current level subject, then add
51600 + it to the set of dropped capabilities
51601 + otherwise, add the current level subject's mask to the current computed mask
51602 + */
51603 + if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
51604 + cap_raise(cap_mask, cap);
51605 + if (cap_raised(curracl->cap_lower, cap))
51606 + cap_raise(cap_drop, cap);
51607 + if (cap_raised(curracl->cap_invert_audit, cap))
51608 + cap_raise(cap_audit, cap);
51609 + }
51610 + }
51611 +
51612 + if (!cap_raised(cap_drop, cap)) {
51613 + if (cap_raised(cap_audit, cap))
51614 + gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
51615 + return 1;
51616 + }
51617 +
51618 + curracl = task->acl;
51619 +
51620 + if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
51621 + && cap_raised(cred->cap_effective, cap)) {
51622 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
51623 + task->role->roletype, cred->uid,
51624 + cred->gid, task->exec_file ?
51625 + gr_to_filename(task->exec_file->f_path.dentry,
51626 + task->exec_file->f_path.mnt) : curracl->filename,
51627 + curracl->filename, 0UL,
51628 + 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
51629 + return 1;
51630 + }
51631 +
51632 + if ((cap >= 0) && (cap < captab_log_entries) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
51633 + gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
51634 + return 0;
51635 +}
51636 +
51637 +int
51638 +gr_acl_is_capable_nolog(const int cap)
51639 +{
51640 + struct acl_subject_label *curracl;
51641 + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
51642 +
51643 + if (!gr_acl_is_enabled())
51644 + return 1;
51645 +
51646 + curracl = current->acl;
51647 +
51648 + cap_drop = curracl->cap_lower;
51649 + cap_mask = curracl->cap_mask;
51650 +
51651 + while ((curracl = curracl->parent_subject)) {
51652 + /* if the cap isn't specified in the current computed mask but is specified in the
51653 + current level subject, and is lowered in the current level subject, then add
51654 + it to the set of dropped capabilities
51655 + otherwise, add the current level subject's mask to the current computed mask
51656 + */
51657 + if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
51658 + cap_raise(cap_mask, cap);
51659 + if (cap_raised(curracl->cap_lower, cap))
51660 + cap_raise(cap_drop, cap);
51661 + }
51662 + }
51663 +
51664 + if (!cap_raised(cap_drop, cap))
51665 + return 1;
51666 +
51667 + return 0;
51668 +}
51669 +
51670 diff -urNp linux-3.0.8/grsecurity/gracl_fs.c linux-3.0.8/grsecurity/gracl_fs.c
51671 --- linux-3.0.8/grsecurity/gracl_fs.c 1969-12-31 19:00:00.000000000 -0500
51672 +++ linux-3.0.8/grsecurity/gracl_fs.c 2011-10-17 01:22:26.000000000 -0400
51673 @@ -0,0 +1,431 @@
51674 +#include <linux/kernel.h>
51675 +#include <linux/sched.h>
51676 +#include <linux/types.h>
51677 +#include <linux/fs.h>
51678 +#include <linux/file.h>
51679 +#include <linux/stat.h>
51680 +#include <linux/grsecurity.h>
51681 +#include <linux/grinternal.h>
51682 +#include <linux/gracl.h>
51683 +
51684 +__u32
51685 +gr_acl_handle_hidden_file(const struct dentry * dentry,
51686 + const struct vfsmount * mnt)
51687 +{
51688 + __u32 mode;
51689 +
51690 + if (unlikely(!dentry->d_inode))
51691 + return GR_FIND;
51692 +
51693 + mode =
51694 + gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
51695 +
51696 + if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
51697 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
51698 + return mode;
51699 + } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
51700 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
51701 + return 0;
51702 + } else if (unlikely(!(mode & GR_FIND)))
51703 + return 0;
51704 +
51705 + return GR_FIND;
51706 +}
51707 +
51708 +__u32
51709 +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
51710 + const int fmode)
51711 +{
51712 + __u32 reqmode = GR_FIND;
51713 + __u32 mode;
51714 +
51715 + if (unlikely(!dentry->d_inode))
51716 + return reqmode;
51717 +
51718 + if (unlikely(fmode & O_APPEND))
51719 + reqmode |= GR_APPEND;
51720 + else if (unlikely(fmode & FMODE_WRITE))
51721 + reqmode |= GR_WRITE;
51722 + if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
51723 + reqmode |= GR_READ;
51724 + if ((fmode & FMODE_GREXEC) && (fmode & __FMODE_EXEC))
51725 + reqmode &= ~GR_READ;
51726 + mode =
51727 + gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
51728 + mnt);
51729 +
51730 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
51731 + gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
51732 + reqmode & GR_READ ? " reading" : "",
51733 + reqmode & GR_WRITE ? " writing" : reqmode &
51734 + GR_APPEND ? " appending" : "");
51735 + return reqmode;
51736 + } else
51737 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
51738 + {
51739 + gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
51740 + reqmode & GR_READ ? " reading" : "",
51741 + reqmode & GR_WRITE ? " writing" : reqmode &
51742 + GR_APPEND ? " appending" : "");
51743 + return 0;
51744 + } else if (unlikely((mode & reqmode) != reqmode))
51745 + return 0;
51746 +
51747 + return reqmode;
51748 +}
51749 +
51750 +__u32
51751 +gr_acl_handle_creat(const struct dentry * dentry,
51752 + const struct dentry * p_dentry,
51753 + const struct vfsmount * p_mnt, const int fmode,
51754 + const int imode)
51755 +{
51756 + __u32 reqmode = GR_WRITE | GR_CREATE;
51757 + __u32 mode;
51758 +
51759 + if (unlikely(fmode & O_APPEND))
51760 + reqmode |= GR_APPEND;
51761 + if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
51762 + reqmode |= GR_READ;
51763 + if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
51764 + reqmode |= GR_SETID;
51765 +
51766 + mode =
51767 + gr_check_create(dentry, p_dentry, p_mnt,
51768 + reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
51769 +
51770 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
51771 + gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
51772 + reqmode & GR_READ ? " reading" : "",
51773 + reqmode & GR_WRITE ? " writing" : reqmode &
51774 + GR_APPEND ? " appending" : "");
51775 + return reqmode;
51776 + } else
51777 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
51778 + {
51779 + gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
51780 + reqmode & GR_READ ? " reading" : "",
51781 + reqmode & GR_WRITE ? " writing" : reqmode &
51782 + GR_APPEND ? " appending" : "");
51783 + return 0;
51784 + } else if (unlikely((mode & reqmode) != reqmode))
51785 + return 0;
51786 +
51787 + return reqmode;
51788 +}
51789 +
51790 +__u32
51791 +gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
51792 + const int fmode)
51793 +{
51794 + __u32 mode, reqmode = GR_FIND;
51795 +
51796 + if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
51797 + reqmode |= GR_EXEC;
51798 + if (fmode & S_IWOTH)
51799 + reqmode |= GR_WRITE;
51800 + if (fmode & S_IROTH)
51801 + reqmode |= GR_READ;
51802 +
51803 + mode =
51804 + gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
51805 + mnt);
51806 +
51807 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
51808 + gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
51809 + reqmode & GR_READ ? " reading" : "",
51810 + reqmode & GR_WRITE ? " writing" : "",
51811 + reqmode & GR_EXEC ? " executing" : "");
51812 + return reqmode;
51813 + } else
51814 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
51815 + {
51816 + gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
51817 + reqmode & GR_READ ? " reading" : "",
51818 + reqmode & GR_WRITE ? " writing" : "",
51819 + reqmode & GR_EXEC ? " executing" : "");
51820 + return 0;
51821 + } else if (unlikely((mode & reqmode) != reqmode))
51822 + return 0;
51823 +
51824 + return reqmode;
51825 +}
51826 +
51827 +static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
51828 +{
51829 + __u32 mode;
51830 +
51831 + mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
51832 +
51833 + if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
51834 + gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
51835 + return mode;
51836 + } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
51837 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
51838 + return 0;
51839 + } else if (unlikely((mode & (reqmode)) != (reqmode)))
51840 + return 0;
51841 +
51842 + return (reqmode);
51843 +}
51844 +
51845 +__u32
51846 +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
51847 +{
51848 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
51849 +}
51850 +
51851 +__u32
51852 +gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
51853 +{
51854 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
51855 +}
51856 +
51857 +__u32
51858 +gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
51859 +{
51860 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
51861 +}
51862 +
51863 +__u32
51864 +gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
51865 +{
51866 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
51867 +}
51868 +
51869 +__u32
51870 +gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
51871 + mode_t mode)
51872 +{
51873 + if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
51874 + return 1;
51875 +
51876 + if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
51877 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
51878 + GR_FCHMOD_ACL_MSG);
51879 + } else {
51880 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
51881 + }
51882 +}
51883 +
51884 +__u32
51885 +gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
51886 + mode_t mode)
51887 +{
51888 + if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
51889 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
51890 + GR_CHMOD_ACL_MSG);
51891 + } else {
51892 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
51893 + }
51894 +}
51895 +
51896 +__u32
51897 +gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
51898 +{
51899 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
51900 +}
51901 +
51902 +__u32
51903 +gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
51904 +{
51905 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
51906 +}
51907 +
51908 +__u32
51909 +gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
51910 +{
51911 + return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
51912 +}
51913 +
51914 +__u32
51915 +gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
51916 +{
51917 + return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
51918 + GR_UNIXCONNECT_ACL_MSG);
51919 +}
51920 +
51921 +/* hardlinks require at minimum create and link permission,
51922 + any additional privilege required is based on the
51923 + privilege of the file being linked to
51924 +*/
51925 +__u32
51926 +gr_acl_handle_link(const struct dentry * new_dentry,
51927 + const struct dentry * parent_dentry,
51928 + const struct vfsmount * parent_mnt,
51929 + const struct dentry * old_dentry,
51930 + const struct vfsmount * old_mnt, const char *to)
51931 +{
51932 + __u32 mode;
51933 + __u32 needmode = GR_CREATE | GR_LINK;
51934 + __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
51935 +
51936 + mode =
51937 + gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
51938 + old_mnt);
51939 +
51940 + if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
51941 + gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
51942 + return mode;
51943 + } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
51944 + gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
51945 + return 0;
51946 + } else if (unlikely((mode & needmode) != needmode))
51947 + return 0;
51948 +
51949 + return 1;
51950 +}
51951 +
51952 +__u32
51953 +gr_acl_handle_symlink(const struct dentry * new_dentry,
51954 + const struct dentry * parent_dentry,
51955 + const struct vfsmount * parent_mnt, const char *from)
51956 +{
51957 + __u32 needmode = GR_WRITE | GR_CREATE;
51958 + __u32 mode;
51959 +
51960 + mode =
51961 + gr_check_create(new_dentry, parent_dentry, parent_mnt,
51962 + GR_CREATE | GR_AUDIT_CREATE |
51963 + GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
51964 +
51965 + if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
51966 + gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
51967 + return mode;
51968 + } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
51969 + gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
51970 + return 0;
51971 + } else if (unlikely((mode & needmode) != needmode))
51972 + return 0;
51973 +
51974 + return (GR_WRITE | GR_CREATE);
51975 +}
51976 +
51977 +static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
51978 +{
51979 + __u32 mode;
51980 +
51981 + mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
51982 +
51983 + if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
51984 + gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
51985 + return mode;
51986 + } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
51987 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
51988 + return 0;
51989 + } else if (unlikely((mode & (reqmode)) != (reqmode)))
51990 + return 0;
51991 +
51992 + return (reqmode);
51993 +}
51994 +
51995 +__u32
51996 +gr_acl_handle_mknod(const struct dentry * new_dentry,
51997 + const struct dentry * parent_dentry,
51998 + const struct vfsmount * parent_mnt,
51999 + const int mode)
52000 +{
52001 + __u32 reqmode = GR_WRITE | GR_CREATE;
52002 + if (unlikely(mode & (S_ISUID | S_ISGID)))
52003 + reqmode |= GR_SETID;
52004 +
52005 + return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
52006 + reqmode, GR_MKNOD_ACL_MSG);
52007 +}
52008 +
52009 +__u32
52010 +gr_acl_handle_mkdir(const struct dentry *new_dentry,
52011 + const struct dentry *parent_dentry,
52012 + const struct vfsmount *parent_mnt)
52013 +{
52014 + return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
52015 + GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
52016 +}
52017 +
52018 +#define RENAME_CHECK_SUCCESS(old, new) \
52019 + (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
52020 + ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
52021 +
52022 +int
52023 +gr_acl_handle_rename(struct dentry *new_dentry,
52024 + struct dentry *parent_dentry,
52025 + const struct vfsmount *parent_mnt,
52026 + struct dentry *old_dentry,
52027 + struct inode *old_parent_inode,
52028 + struct vfsmount *old_mnt, const char *newname)
52029 +{
52030 + __u32 comp1, comp2;
52031 + int error = 0;
52032 +
52033 + if (unlikely(!gr_acl_is_enabled()))
52034 + return 0;
52035 +
52036 + if (!new_dentry->d_inode) {
52037 + comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
52038 + GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
52039 + GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
52040 + comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
52041 + GR_DELETE | GR_AUDIT_DELETE |
52042 + GR_AUDIT_READ | GR_AUDIT_WRITE |
52043 + GR_SUPPRESS, old_mnt);
52044 + } else {
52045 + comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
52046 + GR_CREATE | GR_DELETE |
52047 + GR_AUDIT_CREATE | GR_AUDIT_DELETE |
52048 + GR_AUDIT_READ | GR_AUDIT_WRITE |
52049 + GR_SUPPRESS, parent_mnt);
52050 + comp2 =
52051 + gr_search_file(old_dentry,
52052 + GR_READ | GR_WRITE | GR_AUDIT_READ |
52053 + GR_DELETE | GR_AUDIT_DELETE |
52054 + GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
52055 + }
52056 +
52057 + if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
52058 + ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
52059 + gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
52060 + else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
52061 + && !(comp2 & GR_SUPPRESS)) {
52062 + gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
52063 + error = -EACCES;
52064 + } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
52065 + error = -EACCES;
52066 +
52067 + return error;
52068 +}
52069 +
52070 +void
52071 +gr_acl_handle_exit(void)
52072 +{
52073 + u16 id;
52074 + char *rolename;
52075 + struct file *exec_file;
52076 +
52077 + if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
52078 + !(current->role->roletype & GR_ROLE_PERSIST))) {
52079 + id = current->acl_role_id;
52080 + rolename = current->role->rolename;
52081 + gr_set_acls(1);
52082 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
52083 + }
52084 +
52085 + write_lock(&grsec_exec_file_lock);
52086 + exec_file = current->exec_file;
52087 + current->exec_file = NULL;
52088 + write_unlock(&grsec_exec_file_lock);
52089 +
52090 + if (exec_file)
52091 + fput(exec_file);
52092 +}
52093 +
52094 +int
52095 +gr_acl_handle_procpidmem(const struct task_struct *task)
52096 +{
52097 + if (unlikely(!gr_acl_is_enabled()))
52098 + return 0;
52099 +
52100 + if (task != current && task->acl->mode & GR_PROTPROCFD)
52101 + return -EACCES;
52102 +
52103 + return 0;
52104 +}
52105 diff -urNp linux-3.0.8/grsecurity/gracl_ip.c linux-3.0.8/grsecurity/gracl_ip.c
52106 --- linux-3.0.8/grsecurity/gracl_ip.c 1969-12-31 19:00:00.000000000 -0500
52107 +++ linux-3.0.8/grsecurity/gracl_ip.c 2011-08-23 21:48:14.000000000 -0400
52108 @@ -0,0 +1,381 @@
52109 +#include <linux/kernel.h>
52110 +#include <asm/uaccess.h>
52111 +#include <asm/errno.h>
52112 +#include <net/sock.h>
52113 +#include <linux/file.h>
52114 +#include <linux/fs.h>
52115 +#include <linux/net.h>
52116 +#include <linux/in.h>
52117 +#include <linux/skbuff.h>
52118 +#include <linux/ip.h>
52119 +#include <linux/udp.h>
52120 +#include <linux/types.h>
52121 +#include <linux/sched.h>
52122 +#include <linux/netdevice.h>
52123 +#include <linux/inetdevice.h>
52124 +#include <linux/gracl.h>
52125 +#include <linux/grsecurity.h>
52126 +#include <linux/grinternal.h>
52127 +
52128 +#define GR_BIND 0x01
52129 +#define GR_CONNECT 0x02
52130 +#define GR_INVERT 0x04
52131 +#define GR_BINDOVERRIDE 0x08
52132 +#define GR_CONNECTOVERRIDE 0x10
52133 +#define GR_SOCK_FAMILY 0x20
52134 +
52135 +static const char * gr_protocols[IPPROTO_MAX] = {
52136 + "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
52137 + "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
52138 + "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
52139 + "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
52140 + "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
52141 + "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
52142 + "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
52143 + "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
52144 + "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
52145 + "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
52146 + "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
52147 + "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
52148 + "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
52149 + "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
52150 + "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
52151 + "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
52152 + "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
52153 + "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
52154 + "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
52155 + "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
52156 + "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
52157 + "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
52158 + "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
52159 + "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
52160 + "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
52161 + "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
52162 + "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
52163 + "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
52164 + "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
52165 + "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
52166 + "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
52167 + "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
52168 + };
52169 +
52170 +static const char * gr_socktypes[SOCK_MAX] = {
52171 + "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
52172 + "unknown:7", "unknown:8", "unknown:9", "packet"
52173 + };
52174 +
52175 +static const char * gr_sockfamilies[AF_MAX+1] = {
52176 + "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
52177 + "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
52178 + "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
52179 + "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154", "ciaf"
52180 + };
52181 +
52182 +const char *
52183 +gr_proto_to_name(unsigned char proto)
52184 +{
52185 + return gr_protocols[proto];
52186 +}
52187 +
52188 +const char *
52189 +gr_socktype_to_name(unsigned char type)
52190 +{
52191 + return gr_socktypes[type];
52192 +}
52193 +
52194 +const char *
52195 +gr_sockfamily_to_name(unsigned char family)
52196 +{
52197 + return gr_sockfamilies[family];
52198 +}
52199 +
52200 +int
52201 +gr_search_socket(const int domain, const int type, const int protocol)
52202 +{
52203 + struct acl_subject_label *curr;
52204 + const struct cred *cred = current_cred();
52205 +
52206 + if (unlikely(!gr_acl_is_enabled()))
52207 + goto exit;
52208 +
52209 + if ((domain < 0) || (type < 0) || (protocol < 0) ||
52210 + (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
52211 + goto exit; // let the kernel handle it
52212 +
52213 + curr = current->acl;
52214 +
52215 + if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
52216 + /* the family is allowed, if this is PF_INET allow it only if
52217 + the extra sock type/protocol checks pass */
52218 + if (domain == PF_INET)
52219 + goto inet_check;
52220 + goto exit;
52221 + } else {
52222 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
52223 + __u32 fakeip = 0;
52224 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
52225 + current->role->roletype, cred->uid,
52226 + cred->gid, current->exec_file ?
52227 + gr_to_filename(current->exec_file->f_path.dentry,
52228 + current->exec_file->f_path.mnt) :
52229 + curr->filename, curr->filename,
52230 + &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
52231 + &current->signal->saved_ip);
52232 + goto exit;
52233 + }
52234 + goto exit_fail;
52235 + }
52236 +
52237 +inet_check:
52238 + /* the rest of this checking is for IPv4 only */
52239 + if (!curr->ips)
52240 + goto exit;
52241 +
52242 + if ((curr->ip_type & (1 << type)) &&
52243 + (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
52244 + goto exit;
52245 +
52246 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
52247 + /* we don't place acls on raw sockets , and sometimes
52248 + dgram/ip sockets are opened for ioctl and not
52249 + bind/connect, so we'll fake a bind learn log */
52250 + if (type == SOCK_RAW || type == SOCK_PACKET) {
52251 + __u32 fakeip = 0;
52252 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
52253 + current->role->roletype, cred->uid,
52254 + cred->gid, current->exec_file ?
52255 + gr_to_filename(current->exec_file->f_path.dentry,
52256 + current->exec_file->f_path.mnt) :
52257 + curr->filename, curr->filename,
52258 + &fakeip, 0, type,
52259 + protocol, GR_CONNECT, &current->signal->saved_ip);
52260 + } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
52261 + __u32 fakeip = 0;
52262 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
52263 + current->role->roletype, cred->uid,
52264 + cred->gid, current->exec_file ?
52265 + gr_to_filename(current->exec_file->f_path.dentry,
52266 + current->exec_file->f_path.mnt) :
52267 + curr->filename, curr->filename,
52268 + &fakeip, 0, type,
52269 + protocol, GR_BIND, &current->signal->saved_ip);
52270 + }
52271 + /* we'll log when they use connect or bind */
52272 + goto exit;
52273 + }
52274 +
52275 +exit_fail:
52276 + if (domain == PF_INET)
52277 + gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
52278 + gr_socktype_to_name(type), gr_proto_to_name(protocol));
52279 + else
52280 + gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
52281 + gr_socktype_to_name(type), protocol);
52282 +
52283 + return 0;
52284 +exit:
52285 + return 1;
52286 +}
52287 +
52288 +int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
52289 +{
52290 + if ((ip->mode & mode) &&
52291 + (ip_port >= ip->low) &&
52292 + (ip_port <= ip->high) &&
52293 + ((ntohl(ip_addr) & our_netmask) ==
52294 + (ntohl(our_addr) & our_netmask))
52295 + && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
52296 + && (ip->type & (1 << type))) {
52297 + if (ip->mode & GR_INVERT)
52298 + return 2; // specifically denied
52299 + else
52300 + return 1; // allowed
52301 + }
52302 +
52303 + return 0; // not specifically allowed, may continue parsing
52304 +}
52305 +
52306 +static int
52307 +gr_search_connectbind(const int full_mode, struct sock *sk,
52308 + struct sockaddr_in *addr, const int type)
52309 +{
52310 + char iface[IFNAMSIZ] = {0};
52311 + struct acl_subject_label *curr;
52312 + struct acl_ip_label *ip;
52313 + struct inet_sock *isk;
52314 + struct net_device *dev;
52315 + struct in_device *idev;
52316 + unsigned long i;
52317 + int ret;
52318 + int mode = full_mode & (GR_BIND | GR_CONNECT);
52319 + __u32 ip_addr = 0;
52320 + __u32 our_addr;
52321 + __u32 our_netmask;
52322 + char *p;
52323 + __u16 ip_port = 0;
52324 + const struct cred *cred = current_cred();
52325 +
52326 + if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
52327 + return 0;
52328 +
52329 + curr = current->acl;
52330 + isk = inet_sk(sk);
52331 +
52332 + /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
52333 + if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
52334 + addr->sin_addr.s_addr = curr->inaddr_any_override;
52335 + if ((full_mode & GR_CONNECT) && isk->inet_saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
52336 + struct sockaddr_in saddr;
52337 + int err;
52338 +
52339 + saddr.sin_family = AF_INET;
52340 + saddr.sin_addr.s_addr = curr->inaddr_any_override;
52341 + saddr.sin_port = isk->inet_sport;
52342 +
52343 + err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
52344 + if (err)
52345 + return err;
52346 +
52347 + err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
52348 + if (err)
52349 + return err;
52350 + }
52351 +
52352 + if (!curr->ips)
52353 + return 0;
52354 +
52355 + ip_addr = addr->sin_addr.s_addr;
52356 + ip_port = ntohs(addr->sin_port);
52357 +
52358 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
52359 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
52360 + current->role->roletype, cred->uid,
52361 + cred->gid, current->exec_file ?
52362 + gr_to_filename(current->exec_file->f_path.dentry,
52363 + current->exec_file->f_path.mnt) :
52364 + curr->filename, curr->filename,
52365 + &ip_addr, ip_port, type,
52366 + sk->sk_protocol, mode, &current->signal->saved_ip);
52367 + return 0;
52368 + }
52369 +
52370 + for (i = 0; i < curr->ip_num; i++) {
52371 + ip = *(curr->ips + i);
52372 + if (ip->iface != NULL) {
52373 + strncpy(iface, ip->iface, IFNAMSIZ - 1);
52374 + p = strchr(iface, ':');
52375 + if (p != NULL)
52376 + *p = '\0';
52377 + dev = dev_get_by_name(sock_net(sk), iface);
52378 + if (dev == NULL)
52379 + continue;
52380 + idev = in_dev_get(dev);
52381 + if (idev == NULL) {
52382 + dev_put(dev);
52383 + continue;
52384 + }
52385 + rcu_read_lock();
52386 + for_ifa(idev) {
52387 + if (!strcmp(ip->iface, ifa->ifa_label)) {
52388 + our_addr = ifa->ifa_address;
52389 + our_netmask = 0xffffffff;
52390 + ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
52391 + if (ret == 1) {
52392 + rcu_read_unlock();
52393 + in_dev_put(idev);
52394 + dev_put(dev);
52395 + return 0;
52396 + } else if (ret == 2) {
52397 + rcu_read_unlock();
52398 + in_dev_put(idev);
52399 + dev_put(dev);
52400 + goto denied;
52401 + }
52402 + }
52403 + } endfor_ifa(idev);
52404 + rcu_read_unlock();
52405 + in_dev_put(idev);
52406 + dev_put(dev);
52407 + } else {
52408 + our_addr = ip->addr;
52409 + our_netmask = ip->netmask;
52410 + ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
52411 + if (ret == 1)
52412 + return 0;
52413 + else if (ret == 2)
52414 + goto denied;
52415 + }
52416 + }
52417 +
52418 +denied:
52419 + if (mode == GR_BIND)
52420 + gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
52421 + else if (mode == GR_CONNECT)
52422 + gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
52423 +
52424 + return -EACCES;
52425 +}
52426 +
52427 +int
52428 +gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
52429 +{
52430 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
52431 +}
52432 +
52433 +int
52434 +gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
52435 +{
52436 + return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
52437 +}
52438 +
52439 +int gr_search_listen(struct socket *sock)
52440 +{
52441 + struct sock *sk = sock->sk;
52442 + struct sockaddr_in addr;
52443 +
52444 + addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
52445 + addr.sin_port = inet_sk(sk)->inet_sport;
52446 +
52447 + return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
52448 +}
52449 +
52450 +int gr_search_accept(struct socket *sock)
52451 +{
52452 + struct sock *sk = sock->sk;
52453 + struct sockaddr_in addr;
52454 +
52455 + addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
52456 + addr.sin_port = inet_sk(sk)->inet_sport;
52457 +
52458 + return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
52459 +}
52460 +
52461 +int
52462 +gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
52463 +{
52464 + if (addr)
52465 + return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
52466 + else {
52467 + struct sockaddr_in sin;
52468 + const struct inet_sock *inet = inet_sk(sk);
52469 +
52470 + sin.sin_addr.s_addr = inet->inet_daddr;
52471 + sin.sin_port = inet->inet_dport;
52472 +
52473 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
52474 + }
52475 +}
52476 +
52477 +int
52478 +gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
52479 +{
52480 + struct sockaddr_in sin;
52481 +
52482 + if (unlikely(skb->len < sizeof (struct udphdr)))
52483 + return 0; // skip this packet
52484 +
52485 + sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
52486 + sin.sin_port = udp_hdr(skb)->source;
52487 +
52488 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
52489 +}
52490 diff -urNp linux-3.0.8/grsecurity/gracl_learn.c linux-3.0.8/grsecurity/gracl_learn.c
52491 --- linux-3.0.8/grsecurity/gracl_learn.c 1969-12-31 19:00:00.000000000 -0500
52492 +++ linux-3.0.8/grsecurity/gracl_learn.c 2011-08-23 21:48:14.000000000 -0400
52493 @@ -0,0 +1,207 @@
52494 +#include <linux/kernel.h>
52495 +#include <linux/mm.h>
52496 +#include <linux/sched.h>
52497 +#include <linux/poll.h>
52498 +#include <linux/string.h>
52499 +#include <linux/file.h>
52500 +#include <linux/types.h>
52501 +#include <linux/vmalloc.h>
52502 +#include <linux/grinternal.h>
52503 +
52504 +extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
52505 + size_t count, loff_t *ppos);
52506 +extern int gr_acl_is_enabled(void);
52507 +
52508 +static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
52509 +static int gr_learn_attached;
52510 +
52511 +/* use a 512k buffer */
52512 +#define LEARN_BUFFER_SIZE (512 * 1024)
52513 +
52514 +static DEFINE_SPINLOCK(gr_learn_lock);
52515 +static DEFINE_MUTEX(gr_learn_user_mutex);
52516 +
52517 +/* we need to maintain two buffers, so that the kernel context of grlearn
52518 + uses a semaphore around the userspace copying, and the other kernel contexts
52519 + use a spinlock when copying into the buffer, since they cannot sleep
52520 +*/
52521 +static char *learn_buffer;
52522 +static char *learn_buffer_user;
52523 +static int learn_buffer_len;
52524 +static int learn_buffer_user_len;
52525 +
52526 +static ssize_t
52527 +read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
52528 +{
52529 + DECLARE_WAITQUEUE(wait, current);
52530 + ssize_t retval = 0;
52531 +
52532 + add_wait_queue(&learn_wait, &wait);
52533 + set_current_state(TASK_INTERRUPTIBLE);
52534 + do {
52535 + mutex_lock(&gr_learn_user_mutex);
52536 + spin_lock(&gr_learn_lock);
52537 + if (learn_buffer_len)
52538 + break;
52539 + spin_unlock(&gr_learn_lock);
52540 + mutex_unlock(&gr_learn_user_mutex);
52541 + if (file->f_flags & O_NONBLOCK) {
52542 + retval = -EAGAIN;
52543 + goto out;
52544 + }
52545 + if (signal_pending(current)) {
52546 + retval = -ERESTARTSYS;
52547 + goto out;
52548 + }
52549 +
52550 + schedule();
52551 + } while (1);
52552 +
52553 + memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
52554 + learn_buffer_user_len = learn_buffer_len;
52555 + retval = learn_buffer_len;
52556 + learn_buffer_len = 0;
52557 +
52558 + spin_unlock(&gr_learn_lock);
52559 +
52560 + if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
52561 + retval = -EFAULT;
52562 +
52563 + mutex_unlock(&gr_learn_user_mutex);
52564 +out:
52565 + set_current_state(TASK_RUNNING);
52566 + remove_wait_queue(&learn_wait, &wait);
52567 + return retval;
52568 +}
52569 +
52570 +static unsigned int
52571 +poll_learn(struct file * file, poll_table * wait)
52572 +{
52573 + poll_wait(file, &learn_wait, wait);
52574 +
52575 + if (learn_buffer_len)
52576 + return (POLLIN | POLLRDNORM);
52577 +
52578 + return 0;
52579 +}
52580 +
52581 +void
52582 +gr_clear_learn_entries(void)
52583 +{
52584 + char *tmp;
52585 +
52586 + mutex_lock(&gr_learn_user_mutex);
52587 + spin_lock(&gr_learn_lock);
52588 + tmp = learn_buffer;
52589 + learn_buffer = NULL;
52590 + spin_unlock(&gr_learn_lock);
52591 + if (tmp)
52592 + vfree(tmp);
52593 + if (learn_buffer_user != NULL) {
52594 + vfree(learn_buffer_user);
52595 + learn_buffer_user = NULL;
52596 + }
52597 + learn_buffer_len = 0;
52598 + mutex_unlock(&gr_learn_user_mutex);
52599 +
52600 + return;
52601 +}
52602 +
52603 +void
52604 +gr_add_learn_entry(const char *fmt, ...)
52605 +{
52606 + va_list args;
52607 + unsigned int len;
52608 +
52609 + if (!gr_learn_attached)
52610 + return;
52611 +
52612 + spin_lock(&gr_learn_lock);
52613 +
52614 + /* leave a gap at the end so we know when it's "full" but don't have to
52615 + compute the exact length of the string we're trying to append
52616 + */
52617 + if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
52618 + spin_unlock(&gr_learn_lock);
52619 + wake_up_interruptible(&learn_wait);
52620 + return;
52621 + }
52622 + if (learn_buffer == NULL) {
52623 + spin_unlock(&gr_learn_lock);
52624 + return;
52625 + }
52626 +
52627 + va_start(args, fmt);
52628 + len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
52629 + va_end(args);
52630 +
52631 + learn_buffer_len += len + 1;
52632 +
52633 + spin_unlock(&gr_learn_lock);
52634 + wake_up_interruptible(&learn_wait);
52635 +
52636 + return;
52637 +}
52638 +
52639 +static int
52640 +open_learn(struct inode *inode, struct file *file)
52641 +{
52642 + if (file->f_mode & FMODE_READ && gr_learn_attached)
52643 + return -EBUSY;
52644 + if (file->f_mode & FMODE_READ) {
52645 + int retval = 0;
52646 + mutex_lock(&gr_learn_user_mutex);
52647 + if (learn_buffer == NULL)
52648 + learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
52649 + if (learn_buffer_user == NULL)
52650 + learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
52651 + if (learn_buffer == NULL) {
52652 + retval = -ENOMEM;
52653 + goto out_error;
52654 + }
52655 + if (learn_buffer_user == NULL) {
52656 + retval = -ENOMEM;
52657 + goto out_error;
52658 + }
52659 + learn_buffer_len = 0;
52660 + learn_buffer_user_len = 0;
52661 + gr_learn_attached = 1;
52662 +out_error:
52663 + mutex_unlock(&gr_learn_user_mutex);
52664 + return retval;
52665 + }
52666 + return 0;
52667 +}
52668 +
52669 +static int
52670 +close_learn(struct inode *inode, struct file *file)
52671 +{
52672 + if (file->f_mode & FMODE_READ) {
52673 + char *tmp = NULL;
52674 + mutex_lock(&gr_learn_user_mutex);
52675 + spin_lock(&gr_learn_lock);
52676 + tmp = learn_buffer;
52677 + learn_buffer = NULL;
52678 + spin_unlock(&gr_learn_lock);
52679 + if (tmp)
52680 + vfree(tmp);
52681 + if (learn_buffer_user != NULL) {
52682 + vfree(learn_buffer_user);
52683 + learn_buffer_user = NULL;
52684 + }
52685 + learn_buffer_len = 0;
52686 + learn_buffer_user_len = 0;
52687 + gr_learn_attached = 0;
52688 + mutex_unlock(&gr_learn_user_mutex);
52689 + }
52690 +
52691 + return 0;
52692 +}
52693 +
52694 +const struct file_operations grsec_fops = {
52695 + .read = read_learn,
52696 + .write = write_grsec_handler,
52697 + .open = open_learn,
52698 + .release = close_learn,
52699 + .poll = poll_learn,
52700 +};
52701 diff -urNp linux-3.0.8/grsecurity/gracl_res.c linux-3.0.8/grsecurity/gracl_res.c
52702 --- linux-3.0.8/grsecurity/gracl_res.c 1969-12-31 19:00:00.000000000 -0500
52703 +++ linux-3.0.8/grsecurity/gracl_res.c 2011-08-23 21:48:14.000000000 -0400
52704 @@ -0,0 +1,68 @@
52705 +#include <linux/kernel.h>
52706 +#include <linux/sched.h>
52707 +#include <linux/gracl.h>
52708 +#include <linux/grinternal.h>
52709 +
52710 +static const char *restab_log[] = {
52711 + [RLIMIT_CPU] = "RLIMIT_CPU",
52712 + [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
52713 + [RLIMIT_DATA] = "RLIMIT_DATA",
52714 + [RLIMIT_STACK] = "RLIMIT_STACK",
52715 + [RLIMIT_CORE] = "RLIMIT_CORE",
52716 + [RLIMIT_RSS] = "RLIMIT_RSS",
52717 + [RLIMIT_NPROC] = "RLIMIT_NPROC",
52718 + [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
52719 + [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
52720 + [RLIMIT_AS] = "RLIMIT_AS",
52721 + [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
52722 + [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
52723 + [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
52724 + [RLIMIT_NICE] = "RLIMIT_NICE",
52725 + [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
52726 + [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
52727 + [GR_CRASH_RES] = "RLIMIT_CRASH"
52728 +};
52729 +
52730 +void
52731 +gr_log_resource(const struct task_struct *task,
52732 + const int res, const unsigned long wanted, const int gt)
52733 +{
52734 + const struct cred *cred;
52735 + unsigned long rlim;
52736 +
52737 + if (!gr_acl_is_enabled() && !grsec_resource_logging)
52738 + return;
52739 +
52740 + // not yet supported resource
52741 + if (unlikely(!restab_log[res]))
52742 + return;
52743 +
52744 + if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
52745 + rlim = task_rlimit_max(task, res);
52746 + else
52747 + rlim = task_rlimit(task, res);
52748 +
52749 + if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
52750 + return;
52751 +
52752 + rcu_read_lock();
52753 + cred = __task_cred(task);
52754 +
52755 + if (res == RLIMIT_NPROC &&
52756 + (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
52757 + cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
52758 + goto out_rcu_unlock;
52759 + else if (res == RLIMIT_MEMLOCK &&
52760 + cap_raised(cred->cap_effective, CAP_IPC_LOCK))
52761 + goto out_rcu_unlock;
52762 + else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
52763 + goto out_rcu_unlock;
52764 + rcu_read_unlock();
52765 +
52766 + gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
52767 +
52768 + return;
52769 +out_rcu_unlock:
52770 + rcu_read_unlock();
52771 + return;
52772 +}
52773 diff -urNp linux-3.0.8/grsecurity/gracl_segv.c linux-3.0.8/grsecurity/gracl_segv.c
52774 --- linux-3.0.8/grsecurity/gracl_segv.c 1969-12-31 19:00:00.000000000 -0500
52775 +++ linux-3.0.8/grsecurity/gracl_segv.c 2011-08-23 21:48:14.000000000 -0400
52776 @@ -0,0 +1,299 @@
52777 +#include <linux/kernel.h>
52778 +#include <linux/mm.h>
52779 +#include <asm/uaccess.h>
52780 +#include <asm/errno.h>
52781 +#include <asm/mman.h>
52782 +#include <net/sock.h>
52783 +#include <linux/file.h>
52784 +#include <linux/fs.h>
52785 +#include <linux/net.h>
52786 +#include <linux/in.h>
52787 +#include <linux/slab.h>
52788 +#include <linux/types.h>
52789 +#include <linux/sched.h>
52790 +#include <linux/timer.h>
52791 +#include <linux/gracl.h>
52792 +#include <linux/grsecurity.h>
52793 +#include <linux/grinternal.h>
52794 +
52795 +static struct crash_uid *uid_set;
52796 +static unsigned short uid_used;
52797 +static DEFINE_SPINLOCK(gr_uid_lock);
52798 +extern rwlock_t gr_inode_lock;
52799 +extern struct acl_subject_label *
52800 + lookup_acl_subj_label(const ino_t inode, const dev_t dev,
52801 + struct acl_role_label *role);
52802 +
52803 +#ifdef CONFIG_BTRFS_FS
52804 +extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
52805 +extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
52806 +#endif
52807 +
52808 +static inline dev_t __get_dev(const struct dentry *dentry)
52809 +{
52810 +#ifdef CONFIG_BTRFS_FS
52811 + if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
52812 + return get_btrfs_dev_from_inode(dentry->d_inode);
52813 + else
52814 +#endif
52815 + return dentry->d_inode->i_sb->s_dev;
52816 +}
52817 +
52818 +int
52819 +gr_init_uidset(void)
52820 +{
52821 + uid_set =
52822 + kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
52823 + uid_used = 0;
52824 +
52825 + return uid_set ? 1 : 0;
52826 +}
52827 +
52828 +void
52829 +gr_free_uidset(void)
52830 +{
52831 + if (uid_set)
52832 + kfree(uid_set);
52833 +
52834 + return;
52835 +}
52836 +
52837 +int
52838 +gr_find_uid(const uid_t uid)
52839 +{
52840 + struct crash_uid *tmp = uid_set;
52841 + uid_t buid;
52842 + int low = 0, high = uid_used - 1, mid;
52843 +
52844 + while (high >= low) {
52845 + mid = (low + high) >> 1;
52846 + buid = tmp[mid].uid;
52847 + if (buid == uid)
52848 + return mid;
52849 + if (buid > uid)
52850 + high = mid - 1;
52851 + if (buid < uid)
52852 + low = mid + 1;
52853 + }
52854 +
52855 + return -1;
52856 +}
52857 +
52858 +static __inline__ void
52859 +gr_insertsort(void)
52860 +{
52861 + unsigned short i, j;
52862 + struct crash_uid index;
52863 +
52864 + for (i = 1; i < uid_used; i++) {
52865 + index = uid_set[i];
52866 + j = i;
52867 + while ((j > 0) && uid_set[j - 1].uid > index.uid) {
52868 + uid_set[j] = uid_set[j - 1];
52869 + j--;
52870 + }
52871 + uid_set[j] = index;
52872 + }
52873 +
52874 + return;
52875 +}
52876 +
52877 +static __inline__ void
52878 +gr_insert_uid(const uid_t uid, const unsigned long expires)
52879 +{
52880 + int loc;
52881 +
52882 + if (uid_used == GR_UIDTABLE_MAX)
52883 + return;
52884 +
52885 + loc = gr_find_uid(uid);
52886 +
52887 + if (loc >= 0) {
52888 + uid_set[loc].expires = expires;
52889 + return;
52890 + }
52891 +
52892 + uid_set[uid_used].uid = uid;
52893 + uid_set[uid_used].expires = expires;
52894 + uid_used++;
52895 +
52896 + gr_insertsort();
52897 +
52898 + return;
52899 +}
52900 +
52901 +void
52902 +gr_remove_uid(const unsigned short loc)
52903 +{
52904 + unsigned short i;
52905 +
52906 + for (i = loc + 1; i < uid_used; i++)
52907 + uid_set[i - 1] = uid_set[i];
52908 +
52909 + uid_used--;
52910 +
52911 + return;
52912 +}
52913 +
52914 +int
52915 +gr_check_crash_uid(const uid_t uid)
52916 +{
52917 + int loc;
52918 + int ret = 0;
52919 +
52920 + if (unlikely(!gr_acl_is_enabled()))
52921 + return 0;
52922 +
52923 + spin_lock(&gr_uid_lock);
52924 + loc = gr_find_uid(uid);
52925 +
52926 + if (loc < 0)
52927 + goto out_unlock;
52928 +
52929 + if (time_before_eq(uid_set[loc].expires, get_seconds()))
52930 + gr_remove_uid(loc);
52931 + else
52932 + ret = 1;
52933 +
52934 +out_unlock:
52935 + spin_unlock(&gr_uid_lock);
52936 + return ret;
52937 +}
52938 +
52939 +static __inline__ int
52940 +proc_is_setxid(const struct cred *cred)
52941 +{
52942 + if (cred->uid != cred->euid || cred->uid != cred->suid ||
52943 + cred->uid != cred->fsuid)
52944 + return 1;
52945 + if (cred->gid != cred->egid || cred->gid != cred->sgid ||
52946 + cred->gid != cred->fsgid)
52947 + return 1;
52948 +
52949 + return 0;
52950 +}
52951 +
52952 +extern int gr_fake_force_sig(int sig, struct task_struct *t);
52953 +
52954 +void
52955 +gr_handle_crash(struct task_struct *task, const int sig)
52956 +{
52957 + struct acl_subject_label *curr;
52958 + struct acl_subject_label *curr2;
52959 + struct task_struct *tsk, *tsk2;
52960 + const struct cred *cred;
52961 + const struct cred *cred2;
52962 +
52963 + if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
52964 + return;
52965 +
52966 + if (unlikely(!gr_acl_is_enabled()))
52967 + return;
52968 +
52969 + curr = task->acl;
52970 +
52971 + if (!(curr->resmask & (1 << GR_CRASH_RES)))
52972 + return;
52973 +
52974 + if (time_before_eq(curr->expires, get_seconds())) {
52975 + curr->expires = 0;
52976 + curr->crashes = 0;
52977 + }
52978 +
52979 + curr->crashes++;
52980 +
52981 + if (!curr->expires)
52982 + curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
52983 +
52984 + if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
52985 + time_after(curr->expires, get_seconds())) {
52986 + rcu_read_lock();
52987 + cred = __task_cred(task);
52988 + if (cred->uid && proc_is_setxid(cred)) {
52989 + gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
52990 + spin_lock(&gr_uid_lock);
52991 + gr_insert_uid(cred->uid, curr->expires);
52992 + spin_unlock(&gr_uid_lock);
52993 + curr->expires = 0;
52994 + curr->crashes = 0;
52995 + read_lock(&tasklist_lock);
52996 + do_each_thread(tsk2, tsk) {
52997 + cred2 = __task_cred(tsk);
52998 + if (tsk != task && cred2->uid == cred->uid)
52999 + gr_fake_force_sig(SIGKILL, tsk);
53000 + } while_each_thread(tsk2, tsk);
53001 + read_unlock(&tasklist_lock);
53002 + } else {
53003 + gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
53004 + read_lock(&tasklist_lock);
53005 + do_each_thread(tsk2, tsk) {
53006 + if (likely(tsk != task)) {
53007 + curr2 = tsk->acl;
53008 +
53009 + if (curr2->device == curr->device &&
53010 + curr2->inode == curr->inode)
53011 + gr_fake_force_sig(SIGKILL, tsk);
53012 + }
53013 + } while_each_thread(tsk2, tsk);
53014 + read_unlock(&tasklist_lock);
53015 + }
53016 + rcu_read_unlock();
53017 + }
53018 +
53019 + return;
53020 +}
53021 +
53022 +int
53023 +gr_check_crash_exec(const struct file *filp)
53024 +{
53025 + struct acl_subject_label *curr;
53026 +
53027 + if (unlikely(!gr_acl_is_enabled()))
53028 + return 0;
53029 +
53030 + read_lock(&gr_inode_lock);
53031 + curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
53032 + __get_dev(filp->f_path.dentry),
53033 + current->role);
53034 + read_unlock(&gr_inode_lock);
53035 +
53036 + if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
53037 + (!curr->crashes && !curr->expires))
53038 + return 0;
53039 +
53040 + if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
53041 + time_after(curr->expires, get_seconds()))
53042 + return 1;
53043 + else if (time_before_eq(curr->expires, get_seconds())) {
53044 + curr->crashes = 0;
53045 + curr->expires = 0;
53046 + }
53047 +
53048 + return 0;
53049 +}
53050 +
53051 +void
53052 +gr_handle_alertkill(struct task_struct *task)
53053 +{
53054 + struct acl_subject_label *curracl;
53055 + __u32 curr_ip;
53056 + struct task_struct *p, *p2;
53057 +
53058 + if (unlikely(!gr_acl_is_enabled()))
53059 + return;
53060 +
53061 + curracl = task->acl;
53062 + curr_ip = task->signal->curr_ip;
53063 +
53064 + if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
53065 + read_lock(&tasklist_lock);
53066 + do_each_thread(p2, p) {
53067 + if (p->signal->curr_ip == curr_ip)
53068 + gr_fake_force_sig(SIGKILL, p);
53069 + } while_each_thread(p2, p);
53070 + read_unlock(&tasklist_lock);
53071 + } else if (curracl->mode & GR_KILLPROC)
53072 + gr_fake_force_sig(SIGKILL, task);
53073 +
53074 + return;
53075 +}
53076 diff -urNp linux-3.0.8/grsecurity/gracl_shm.c linux-3.0.8/grsecurity/gracl_shm.c
53077 --- linux-3.0.8/grsecurity/gracl_shm.c 1969-12-31 19:00:00.000000000 -0500
53078 +++ linux-3.0.8/grsecurity/gracl_shm.c 2011-08-23 21:48:14.000000000 -0400
53079 @@ -0,0 +1,40 @@
53080 +#include <linux/kernel.h>
53081 +#include <linux/mm.h>
53082 +#include <linux/sched.h>
53083 +#include <linux/file.h>
53084 +#include <linux/ipc.h>
53085 +#include <linux/gracl.h>
53086 +#include <linux/grsecurity.h>
53087 +#include <linux/grinternal.h>
53088 +
53089 +int
53090 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
53091 + const time_t shm_createtime, const uid_t cuid, const int shmid)
53092 +{
53093 + struct task_struct *task;
53094 +
53095 + if (!gr_acl_is_enabled())
53096 + return 1;
53097 +
53098 + rcu_read_lock();
53099 + read_lock(&tasklist_lock);
53100 +
53101 + task = find_task_by_vpid(shm_cprid);
53102 +
53103 + if (unlikely(!task))
53104 + task = find_task_by_vpid(shm_lapid);
53105 +
53106 + if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
53107 + (task->pid == shm_lapid)) &&
53108 + (task->acl->mode & GR_PROTSHM) &&
53109 + (task->acl != current->acl))) {
53110 + read_unlock(&tasklist_lock);
53111 + rcu_read_unlock();
53112 + gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
53113 + return 0;
53114 + }
53115 + read_unlock(&tasklist_lock);
53116 + rcu_read_unlock();
53117 +
53118 + return 1;
53119 +}
53120 diff -urNp linux-3.0.8/grsecurity/grsec_chdir.c linux-3.0.8/grsecurity/grsec_chdir.c
53121 --- linux-3.0.8/grsecurity/grsec_chdir.c 1969-12-31 19:00:00.000000000 -0500
53122 +++ linux-3.0.8/grsecurity/grsec_chdir.c 2011-08-23 21:48:14.000000000 -0400
53123 @@ -0,0 +1,19 @@
53124 +#include <linux/kernel.h>
53125 +#include <linux/sched.h>
53126 +#include <linux/fs.h>
53127 +#include <linux/file.h>
53128 +#include <linux/grsecurity.h>
53129 +#include <linux/grinternal.h>
53130 +
53131 +void
53132 +gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
53133 +{
53134 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
53135 + if ((grsec_enable_chdir && grsec_enable_group &&
53136 + in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
53137 + !grsec_enable_group)) {
53138 + gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
53139 + }
53140 +#endif
53141 + return;
53142 +}
53143 diff -urNp linux-3.0.8/grsecurity/grsec_chroot.c linux-3.0.8/grsecurity/grsec_chroot.c
53144 --- linux-3.0.8/grsecurity/grsec_chroot.c 1969-12-31 19:00:00.000000000 -0500
53145 +++ linux-3.0.8/grsecurity/grsec_chroot.c 2011-09-15 06:47:48.000000000 -0400
53146 @@ -0,0 +1,351 @@
53147 +#include <linux/kernel.h>
53148 +#include <linux/module.h>
53149 +#include <linux/sched.h>
53150 +#include <linux/file.h>
53151 +#include <linux/fs.h>
53152 +#include <linux/mount.h>
53153 +#include <linux/types.h>
53154 +#include <linux/pid_namespace.h>
53155 +#include <linux/grsecurity.h>
53156 +#include <linux/grinternal.h>
53157 +
53158 +void gr_set_chroot_entries(struct task_struct *task, struct path *path)
53159 +{
53160 +#ifdef CONFIG_GRKERNSEC
53161 + if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
53162 + path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
53163 + task->gr_is_chrooted = 1;
53164 + else
53165 + task->gr_is_chrooted = 0;
53166 +
53167 + task->gr_chroot_dentry = path->dentry;
53168 +#endif
53169 + return;
53170 +}
53171 +
53172 +void gr_clear_chroot_entries(struct task_struct *task)
53173 +{
53174 +#ifdef CONFIG_GRKERNSEC
53175 + task->gr_is_chrooted = 0;
53176 + task->gr_chroot_dentry = NULL;
53177 +#endif
53178 + return;
53179 +}
53180 +
53181 +int
53182 +gr_handle_chroot_unix(const pid_t pid)
53183 +{
53184 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
53185 + struct task_struct *p;
53186 +
53187 + if (unlikely(!grsec_enable_chroot_unix))
53188 + return 1;
53189 +
53190 + if (likely(!proc_is_chrooted(current)))
53191 + return 1;
53192 +
53193 + rcu_read_lock();
53194 + read_lock(&tasklist_lock);
53195 + p = find_task_by_vpid_unrestricted(pid);
53196 + if (unlikely(p && !have_same_root(current, p))) {
53197 + read_unlock(&tasklist_lock);
53198 + rcu_read_unlock();
53199 + gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
53200 + return 0;
53201 + }
53202 + read_unlock(&tasklist_lock);
53203 + rcu_read_unlock();
53204 +#endif
53205 + return 1;
53206 +}
53207 +
53208 +int
53209 +gr_handle_chroot_nice(void)
53210 +{
53211 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
53212 + if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
53213 + gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
53214 + return -EPERM;
53215 + }
53216 +#endif
53217 + return 0;
53218 +}
53219 +
53220 +int
53221 +gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
53222 +{
53223 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
53224 + if (grsec_enable_chroot_nice && (niceval < task_nice(p))
53225 + && proc_is_chrooted(current)) {
53226 + gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
53227 + return -EACCES;
53228 + }
53229 +#endif
53230 + return 0;
53231 +}
53232 +
53233 +int
53234 +gr_handle_chroot_rawio(const struct inode *inode)
53235 +{
53236 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
53237 + if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
53238 + inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
53239 + return 1;
53240 +#endif
53241 + return 0;
53242 +}
53243 +
53244 +int
53245 +gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
53246 +{
53247 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
53248 + struct task_struct *p;
53249 + int ret = 0;
53250 + if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
53251 + return ret;
53252 +
53253 + read_lock(&tasklist_lock);
53254 + do_each_pid_task(pid, type, p) {
53255 + if (!have_same_root(current, p)) {
53256 + ret = 1;
53257 + goto out;
53258 + }
53259 + } while_each_pid_task(pid, type, p);
53260 +out:
53261 + read_unlock(&tasklist_lock);
53262 + return ret;
53263 +#endif
53264 + return 0;
53265 +}
53266 +
53267 +int
53268 +gr_pid_is_chrooted(struct task_struct *p)
53269 +{
53270 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
53271 + if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
53272 + return 0;
53273 +
53274 + if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
53275 + !have_same_root(current, p)) {
53276 + return 1;
53277 + }
53278 +#endif
53279 + return 0;
53280 +}
53281 +
53282 +EXPORT_SYMBOL(gr_pid_is_chrooted);
53283 +
53284 +#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
53285 +int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
53286 +{
53287 + struct path path, currentroot;
53288 + int ret = 0;
53289 +
53290 + path.dentry = (struct dentry *)u_dentry;
53291 + path.mnt = (struct vfsmount *)u_mnt;
53292 + get_fs_root(current->fs, &currentroot);
53293 + if (path_is_under(&path, &currentroot))
53294 + ret = 1;
53295 + path_put(&currentroot);
53296 +
53297 + return ret;
53298 +}
53299 +#endif
53300 +
53301 +int
53302 +gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
53303 +{
53304 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
53305 + if (!grsec_enable_chroot_fchdir)
53306 + return 1;
53307 +
53308 + if (!proc_is_chrooted(current))
53309 + return 1;
53310 + else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
53311 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
53312 + return 0;
53313 + }
53314 +#endif
53315 + return 1;
53316 +}
53317 +
53318 +int
53319 +gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
53320 + const time_t shm_createtime)
53321 +{
53322 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
53323 + struct task_struct *p;
53324 + time_t starttime;
53325 +
53326 + if (unlikely(!grsec_enable_chroot_shmat))
53327 + return 1;
53328 +
53329 + if (likely(!proc_is_chrooted(current)))
53330 + return 1;
53331 +
53332 + rcu_read_lock();
53333 + read_lock(&tasklist_lock);
53334 +
53335 + if ((p = find_task_by_vpid_unrestricted(shm_cprid))) {
53336 + starttime = p->start_time.tv_sec;
53337 + if (time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime)) {
53338 + if (have_same_root(current, p)) {
53339 + goto allow;
53340 + } else {
53341 + read_unlock(&tasklist_lock);
53342 + rcu_read_unlock();
53343 + gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
53344 + return 0;
53345 + }
53346 + }
53347 + /* creator exited, pid reuse, fall through to next check */
53348 + }
53349 + if ((p = find_task_by_vpid_unrestricted(shm_lapid))) {
53350 + if (unlikely(!have_same_root(current, p))) {
53351 + read_unlock(&tasklist_lock);
53352 + rcu_read_unlock();
53353 + gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
53354 + return 0;
53355 + }
53356 + }
53357 +
53358 +allow:
53359 + read_unlock(&tasklist_lock);
53360 + rcu_read_unlock();
53361 +#endif
53362 + return 1;
53363 +}
53364 +
53365 +void
53366 +gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
53367 +{
53368 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
53369 + if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
53370 + gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
53371 +#endif
53372 + return;
53373 +}
53374 +
53375 +int
53376 +gr_handle_chroot_mknod(const struct dentry *dentry,
53377 + const struct vfsmount *mnt, const int mode)
53378 +{
53379 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
53380 + if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
53381 + proc_is_chrooted(current)) {
53382 + gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
53383 + return -EPERM;
53384 + }
53385 +#endif
53386 + return 0;
53387 +}
53388 +
53389 +int
53390 +gr_handle_chroot_mount(const struct dentry *dentry,
53391 + const struct vfsmount *mnt, const char *dev_name)
53392 +{
53393 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
53394 + if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
53395 + gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none", dentry, mnt);
53396 + return -EPERM;
53397 + }
53398 +#endif
53399 + return 0;
53400 +}
53401 +
53402 +int
53403 +gr_handle_chroot_pivot(void)
53404 +{
53405 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
53406 + if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
53407 + gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
53408 + return -EPERM;
53409 + }
53410 +#endif
53411 + return 0;
53412 +}
53413 +
53414 +int
53415 +gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
53416 +{
53417 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
53418 + if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
53419 + !gr_is_outside_chroot(dentry, mnt)) {
53420 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
53421 + return -EPERM;
53422 + }
53423 +#endif
53424 + return 0;
53425 +}
53426 +
53427 +extern const char *captab_log[];
53428 +extern int captab_log_entries;
53429 +
53430 +int
53431 +gr_chroot_is_capable(const int cap)
53432 +{
53433 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
53434 + if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
53435 + kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
53436 + if (cap_raised(chroot_caps, cap)) {
53437 + const struct cred *creds = current_cred();
53438 + if (cap_raised(creds->cap_effective, cap) && cap < captab_log_entries) {
53439 + gr_log_cap(GR_DONT_AUDIT, GR_CAP_CHROOT_MSG, current, captab_log[cap]);
53440 + }
53441 + return 0;
53442 + }
53443 + }
53444 +#endif
53445 + return 1;
53446 +}
53447 +
53448 +int
53449 +gr_chroot_is_capable_nolog(const int cap)
53450 +{
53451 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
53452 + if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
53453 + kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
53454 + if (cap_raised(chroot_caps, cap)) {
53455 + return 0;
53456 + }
53457 + }
53458 +#endif
53459 + return 1;
53460 +}
53461 +
53462 +int
53463 +gr_handle_chroot_sysctl(const int op)
53464 +{
53465 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
53466 + if (grsec_enable_chroot_sysctl && (op & MAY_WRITE) &&
53467 + proc_is_chrooted(current))
53468 + return -EACCES;
53469 +#endif
53470 + return 0;
53471 +}
53472 +
53473 +void
53474 +gr_handle_chroot_chdir(struct path *path)
53475 +{
53476 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
53477 + if (grsec_enable_chroot_chdir)
53478 + set_fs_pwd(current->fs, path);
53479 +#endif
53480 + return;
53481 +}
53482 +
53483 +int
53484 +gr_handle_chroot_chmod(const struct dentry *dentry,
53485 + const struct vfsmount *mnt, const int mode)
53486 +{
53487 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
53488 + /* allow chmod +s on directories, but not files */
53489 + if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
53490 + ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
53491 + proc_is_chrooted(current)) {
53492 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
53493 + return -EPERM;
53494 + }
53495 +#endif
53496 + return 0;
53497 +}
53498 diff -urNp linux-3.0.8/grsecurity/grsec_disabled.c linux-3.0.8/grsecurity/grsec_disabled.c
53499 --- linux-3.0.8/grsecurity/grsec_disabled.c 1969-12-31 19:00:00.000000000 -0500
53500 +++ linux-3.0.8/grsecurity/grsec_disabled.c 2011-10-25 09:17:34.000000000 -0400
53501 @@ -0,0 +1,439 @@
53502 +#include <linux/kernel.h>
53503 +#include <linux/module.h>
53504 +#include <linux/sched.h>
53505 +#include <linux/file.h>
53506 +#include <linux/fs.h>
53507 +#include <linux/kdev_t.h>
53508 +#include <linux/net.h>
53509 +#include <linux/in.h>
53510 +#include <linux/ip.h>
53511 +#include <linux/skbuff.h>
53512 +#include <linux/sysctl.h>
53513 +
53514 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
53515 +void
53516 +pax_set_initial_flags(struct linux_binprm *bprm)
53517 +{
53518 + return;
53519 +}
53520 +#endif
53521 +
53522 +#ifdef CONFIG_SYSCTL
53523 +__u32
53524 +gr_handle_sysctl(const struct ctl_table * table, const int op)
53525 +{
53526 + return 0;
53527 +}
53528 +#endif
53529 +
53530 +#ifdef CONFIG_TASKSTATS
53531 +int gr_is_taskstats_denied(int pid)
53532 +{
53533 + return 0;
53534 +}
53535 +#endif
53536 +
53537 +int
53538 +gr_acl_is_enabled(void)
53539 +{
53540 + return 0;
53541 +}
53542 +
53543 +void
53544 +gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
53545 +{
53546 + return;
53547 +}
53548 +
53549 +int
53550 +gr_handle_rawio(const struct inode *inode)
53551 +{
53552 + return 0;
53553 +}
53554 +
53555 +void
53556 +gr_acl_handle_psacct(struct task_struct *task, const long code)
53557 +{
53558 + return;
53559 +}
53560 +
53561 +int
53562 +gr_handle_ptrace(struct task_struct *task, const long request)
53563 +{
53564 + return 0;
53565 +}
53566 +
53567 +int
53568 +gr_handle_proc_ptrace(struct task_struct *task)
53569 +{
53570 + return 0;
53571 +}
53572 +
53573 +void
53574 +gr_learn_resource(const struct task_struct *task,
53575 + const int res, const unsigned long wanted, const int gt)
53576 +{
53577 + return;
53578 +}
53579 +
53580 +int
53581 +gr_set_acls(const int type)
53582 +{
53583 + return 0;
53584 +}
53585 +
53586 +int
53587 +gr_check_hidden_task(const struct task_struct *tsk)
53588 +{
53589 + return 0;
53590 +}
53591 +
53592 +int
53593 +gr_check_protected_task(const struct task_struct *task)
53594 +{
53595 + return 0;
53596 +}
53597 +
53598 +int
53599 +gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
53600 +{
53601 + return 0;
53602 +}
53603 +
53604 +void
53605 +gr_copy_label(struct task_struct *tsk)
53606 +{
53607 + return;
53608 +}
53609 +
53610 +void
53611 +gr_set_pax_flags(struct task_struct *task)
53612 +{
53613 + return;
53614 +}
53615 +
53616 +int
53617 +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
53618 + const int unsafe_share)
53619 +{
53620 + return 0;
53621 +}
53622 +
53623 +void
53624 +gr_handle_delete(const ino_t ino, const dev_t dev)
53625 +{
53626 + return;
53627 +}
53628 +
53629 +void
53630 +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
53631 +{
53632 + return;
53633 +}
53634 +
53635 +void
53636 +gr_handle_crash(struct task_struct *task, const int sig)
53637 +{
53638 + return;
53639 +}
53640 +
53641 +int
53642 +gr_check_crash_exec(const struct file *filp)
53643 +{
53644 + return 0;
53645 +}
53646 +
53647 +int
53648 +gr_check_crash_uid(const uid_t uid)
53649 +{
53650 + return 0;
53651 +}
53652 +
53653 +void
53654 +gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
53655 + struct dentry *old_dentry,
53656 + struct dentry *new_dentry,
53657 + struct vfsmount *mnt, const __u8 replace)
53658 +{
53659 + return;
53660 +}
53661 +
53662 +int
53663 +gr_search_socket(const int family, const int type, const int protocol)
53664 +{
53665 + return 1;
53666 +}
53667 +
53668 +int
53669 +gr_search_connectbind(const int mode, const struct socket *sock,
53670 + const struct sockaddr_in *addr)
53671 +{
53672 + return 0;
53673 +}
53674 +
53675 +void
53676 +gr_handle_alertkill(struct task_struct *task)
53677 +{
53678 + return;
53679 +}
53680 +
53681 +__u32
53682 +gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
53683 +{
53684 + return 1;
53685 +}
53686 +
53687 +__u32
53688 +gr_acl_handle_hidden_file(const struct dentry * dentry,
53689 + const struct vfsmount * mnt)
53690 +{
53691 + return 1;
53692 +}
53693 +
53694 +__u32
53695 +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
53696 + const int fmode)
53697 +{
53698 + return 1;
53699 +}
53700 +
53701 +__u32
53702 +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
53703 +{
53704 + return 1;
53705 +}
53706 +
53707 +__u32
53708 +gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
53709 +{
53710 + return 1;
53711 +}
53712 +
53713 +int
53714 +gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
53715 + unsigned int *vm_flags)
53716 +{
53717 + return 1;
53718 +}
53719 +
53720 +__u32
53721 +gr_acl_handle_truncate(const struct dentry * dentry,
53722 + const struct vfsmount * mnt)
53723 +{
53724 + return 1;
53725 +}
53726 +
53727 +__u32
53728 +gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
53729 +{
53730 + return 1;
53731 +}
53732 +
53733 +__u32
53734 +gr_acl_handle_access(const struct dentry * dentry,
53735 + const struct vfsmount * mnt, const int fmode)
53736 +{
53737 + return 1;
53738 +}
53739 +
53740 +__u32
53741 +gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
53742 + mode_t mode)
53743 +{
53744 + return 1;
53745 +}
53746 +
53747 +__u32
53748 +gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
53749 + mode_t mode)
53750 +{
53751 + return 1;
53752 +}
53753 +
53754 +__u32
53755 +gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
53756 +{
53757 + return 1;
53758 +}
53759 +
53760 +__u32
53761 +gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
53762 +{
53763 + return 1;
53764 +}
53765 +
53766 +void
53767 +grsecurity_init(void)
53768 +{
53769 + return;
53770 +}
53771 +
53772 +__u32
53773 +gr_acl_handle_mknod(const struct dentry * new_dentry,
53774 + const struct dentry * parent_dentry,
53775 + const struct vfsmount * parent_mnt,
53776 + const int mode)
53777 +{
53778 + return 1;
53779 +}
53780 +
53781 +__u32
53782 +gr_acl_handle_mkdir(const struct dentry * new_dentry,
53783 + const struct dentry * parent_dentry,
53784 + const struct vfsmount * parent_mnt)
53785 +{
53786 + return 1;
53787 +}
53788 +
53789 +__u32
53790 +gr_acl_handle_symlink(const struct dentry * new_dentry,
53791 + const struct dentry * parent_dentry,
53792 + const struct vfsmount * parent_mnt, const char *from)
53793 +{
53794 + return 1;
53795 +}
53796 +
53797 +__u32
53798 +gr_acl_handle_link(const struct dentry * new_dentry,
53799 + const struct dentry * parent_dentry,
53800 + const struct vfsmount * parent_mnt,
53801 + const struct dentry * old_dentry,
53802 + const struct vfsmount * old_mnt, const char *to)
53803 +{
53804 + return 1;
53805 +}
53806 +
53807 +int
53808 +gr_acl_handle_rename(const struct dentry *new_dentry,
53809 + const struct dentry *parent_dentry,
53810 + const struct vfsmount *parent_mnt,
53811 + const struct dentry *old_dentry,
53812 + const struct inode *old_parent_inode,
53813 + const struct vfsmount *old_mnt, const char *newname)
53814 +{
53815 + return 0;
53816 +}
53817 +
53818 +int
53819 +gr_acl_handle_filldir(const struct file *file, const char *name,
53820 + const int namelen, const ino_t ino)
53821 +{
53822 + return 1;
53823 +}
53824 +
53825 +int
53826 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
53827 + const time_t shm_createtime, const uid_t cuid, const int shmid)
53828 +{
53829 + return 1;
53830 +}
53831 +
53832 +int
53833 +gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
53834 +{
53835 + return 0;
53836 +}
53837 +
53838 +int
53839 +gr_search_accept(const struct socket *sock)
53840 +{
53841 + return 0;
53842 +}
53843 +
53844 +int
53845 +gr_search_listen(const struct socket *sock)
53846 +{
53847 + return 0;
53848 +}
53849 +
53850 +int
53851 +gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
53852 +{
53853 + return 0;
53854 +}
53855 +
53856 +__u32
53857 +gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
53858 +{
53859 + return 1;
53860 +}
53861 +
53862 +__u32
53863 +gr_acl_handle_creat(const struct dentry * dentry,
53864 + const struct dentry * p_dentry,
53865 + const struct vfsmount * p_mnt, const int fmode,
53866 + const int imode)
53867 +{
53868 + return 1;
53869 +}
53870 +
53871 +void
53872 +gr_acl_handle_exit(void)
53873 +{
53874 + return;
53875 +}
53876 +
53877 +int
53878 +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
53879 +{
53880 + return 1;
53881 +}
53882 +
53883 +void
53884 +gr_set_role_label(const uid_t uid, const gid_t gid)
53885 +{
53886 + return;
53887 +}
53888 +
53889 +int
53890 +gr_acl_handle_procpidmem(const struct task_struct *task)
53891 +{
53892 + return 0;
53893 +}
53894 +
53895 +int
53896 +gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
53897 +{
53898 + return 0;
53899 +}
53900 +
53901 +int
53902 +gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
53903 +{
53904 + return 0;
53905 +}
53906 +
53907 +void
53908 +gr_set_kernel_label(struct task_struct *task)
53909 +{
53910 + return;
53911 +}
53912 +
53913 +int
53914 +gr_check_user_change(int real, int effective, int fs)
53915 +{
53916 + return 0;
53917 +}
53918 +
53919 +int
53920 +gr_check_group_change(int real, int effective, int fs)
53921 +{
53922 + return 0;
53923 +}
53924 +
53925 +int gr_acl_enable_at_secure(void)
53926 +{
53927 + return 0;
53928 +}
53929 +
53930 +dev_t gr_get_dev_from_dentry(struct dentry *dentry)
53931 +{
53932 + return dentry->d_inode->i_sb->s_dev;
53933 +}
53934 +
53935 +EXPORT_SYMBOL(gr_learn_resource);
53936 +EXPORT_SYMBOL(gr_set_kernel_label);
53937 +#ifdef CONFIG_SECURITY
53938 +EXPORT_SYMBOL(gr_check_user_change);
53939 +EXPORT_SYMBOL(gr_check_group_change);
53940 +#endif
53941 diff -urNp linux-3.0.8/grsecurity/grsec_exec.c linux-3.0.8/grsecurity/grsec_exec.c
53942 --- linux-3.0.8/grsecurity/grsec_exec.c 1969-12-31 19:00:00.000000000 -0500
53943 +++ linux-3.0.8/grsecurity/grsec_exec.c 2011-10-20 00:50:54.000000000 -0400
53944 @@ -0,0 +1,146 @@
53945 +#include <linux/kernel.h>
53946 +#include <linux/sched.h>
53947 +#include <linux/file.h>
53948 +#include <linux/binfmts.h>
53949 +#include <linux/fs.h>
53950 +#include <linux/types.h>
53951 +#include <linux/grdefs.h>
53952 +#include <linux/grsecurity.h>
53953 +#include <linux/grinternal.h>
53954 +#include <linux/capability.h>
53955 +#include <linux/module.h>
53956 +
53957 +#include <asm/uaccess.h>
53958 +
53959 +#ifdef CONFIG_GRKERNSEC_EXECLOG
53960 +static char gr_exec_arg_buf[132];
53961 +static DEFINE_MUTEX(gr_exec_arg_mutex);
53962 +#endif
53963 +
53964 +extern const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr);
53965 +
53966 +void
53967 +gr_handle_exec_args(struct linux_binprm *bprm, struct user_arg_ptr argv)
53968 +{
53969 +#ifdef CONFIG_GRKERNSEC_EXECLOG
53970 + char *grarg = gr_exec_arg_buf;
53971 + unsigned int i, x, execlen = 0;
53972 + char c;
53973 +
53974 + if (!((grsec_enable_execlog && grsec_enable_group &&
53975 + in_group_p(grsec_audit_gid))
53976 + || (grsec_enable_execlog && !grsec_enable_group)))
53977 + return;
53978 +
53979 + mutex_lock(&gr_exec_arg_mutex);
53980 + memset(grarg, 0, sizeof(gr_exec_arg_buf));
53981 +
53982 + for (i = 0; i < bprm->argc && execlen < 128; i++) {
53983 + const char __user *p;
53984 + unsigned int len;
53985 +
53986 + p = get_user_arg_ptr(argv, i);
53987 + if (IS_ERR(p))
53988 + goto log;
53989 +
53990 + len = strnlen_user(p, 128 - execlen);
53991 + if (len > 128 - execlen)
53992 + len = 128 - execlen;
53993 + else if (len > 0)
53994 + len--;
53995 + if (copy_from_user(grarg + execlen, p, len))
53996 + goto log;
53997 +
53998 + /* rewrite unprintable characters */
53999 + for (x = 0; x < len; x++) {
54000 + c = *(grarg + execlen + x);
54001 + if (c < 32 || c > 126)
54002 + *(grarg + execlen + x) = ' ';
54003 + }
54004 +
54005 + execlen += len;
54006 + *(grarg + execlen) = ' ';
54007 + *(grarg + execlen + 1) = '\0';
54008 + execlen++;
54009 + }
54010 +
54011 + log:
54012 + gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
54013 + bprm->file->f_path.mnt, grarg);
54014 + mutex_unlock(&gr_exec_arg_mutex);
54015 +#endif
54016 + return;
54017 +}
54018 +
54019 +#ifdef CONFIG_GRKERNSEC
54020 +extern int gr_acl_is_capable(const int cap);
54021 +extern int gr_acl_is_capable_nolog(const int cap);
54022 +extern int gr_chroot_is_capable(const int cap);
54023 +extern int gr_chroot_is_capable_nolog(const int cap);
54024 +#endif
54025 +
54026 +const char *captab_log[] = {
54027 + "CAP_CHOWN",
54028 + "CAP_DAC_OVERRIDE",
54029 + "CAP_DAC_READ_SEARCH",
54030 + "CAP_FOWNER",
54031 + "CAP_FSETID",
54032 + "CAP_KILL",
54033 + "CAP_SETGID",
54034 + "CAP_SETUID",
54035 + "CAP_SETPCAP",
54036 + "CAP_LINUX_IMMUTABLE",
54037 + "CAP_NET_BIND_SERVICE",
54038 + "CAP_NET_BROADCAST",
54039 + "CAP_NET_ADMIN",
54040 + "CAP_NET_RAW",
54041 + "CAP_IPC_LOCK",
54042 + "CAP_IPC_OWNER",
54043 + "CAP_SYS_MODULE",
54044 + "CAP_SYS_RAWIO",
54045 + "CAP_SYS_CHROOT",
54046 + "CAP_SYS_PTRACE",
54047 + "CAP_SYS_PACCT",
54048 + "CAP_SYS_ADMIN",
54049 + "CAP_SYS_BOOT",
54050 + "CAP_SYS_NICE",
54051 + "CAP_SYS_RESOURCE",
54052 + "CAP_SYS_TIME",
54053 + "CAP_SYS_TTY_CONFIG",
54054 + "CAP_MKNOD",
54055 + "CAP_LEASE",
54056 + "CAP_AUDIT_WRITE",
54057 + "CAP_AUDIT_CONTROL",
54058 + "CAP_SETFCAP",
54059 + "CAP_MAC_OVERRIDE",
54060 + "CAP_MAC_ADMIN",
54061 + "CAP_SYSLOG",
54062 + "CAP_WAKE_ALARM"
54063 +};
54064 +
54065 +int captab_log_entries = sizeof(captab_log)/sizeof(captab_log[0]);
54066 +
54067 +int gr_is_capable(const int cap)
54068 +{
54069 +#ifdef CONFIG_GRKERNSEC
54070 + if (gr_acl_is_capable(cap) && gr_chroot_is_capable(cap))
54071 + return 1;
54072 + return 0;
54073 +#else
54074 + return 1;
54075 +#endif
54076 +}
54077 +
54078 +int gr_is_capable_nolog(const int cap)
54079 +{
54080 +#ifdef CONFIG_GRKERNSEC
54081 + if (gr_acl_is_capable_nolog(cap) && gr_chroot_is_capable_nolog(cap))
54082 + return 1;
54083 + return 0;
54084 +#else
54085 + return 1;
54086 +#endif
54087 +}
54088 +
54089 +EXPORT_SYMBOL(gr_is_capable);
54090 +EXPORT_SYMBOL(gr_is_capable_nolog);
54091 diff -urNp linux-3.0.8/grsecurity/grsec_fifo.c linux-3.0.8/grsecurity/grsec_fifo.c
54092 --- linux-3.0.8/grsecurity/grsec_fifo.c 1969-12-31 19:00:00.000000000 -0500
54093 +++ linux-3.0.8/grsecurity/grsec_fifo.c 2011-08-23 21:48:14.000000000 -0400
54094 @@ -0,0 +1,24 @@
54095 +#include <linux/kernel.h>
54096 +#include <linux/sched.h>
54097 +#include <linux/fs.h>
54098 +#include <linux/file.h>
54099 +#include <linux/grinternal.h>
54100 +
54101 +int
54102 +gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
54103 + const struct dentry *dir, const int flag, const int acc_mode)
54104 +{
54105 +#ifdef CONFIG_GRKERNSEC_FIFO
54106 + const struct cred *cred = current_cred();
54107 +
54108 + if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
54109 + !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
54110 + (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
54111 + (cred->fsuid != dentry->d_inode->i_uid)) {
54112 + if (!inode_permission(dentry->d_inode, acc_mode))
54113 + gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
54114 + return -EACCES;
54115 + }
54116 +#endif
54117 + return 0;
54118 +}
54119 diff -urNp linux-3.0.8/grsecurity/grsec_fork.c linux-3.0.8/grsecurity/grsec_fork.c
54120 --- linux-3.0.8/grsecurity/grsec_fork.c 1969-12-31 19:00:00.000000000 -0500
54121 +++ linux-3.0.8/grsecurity/grsec_fork.c 2011-08-23 21:48:14.000000000 -0400
54122 @@ -0,0 +1,23 @@
54123 +#include <linux/kernel.h>
54124 +#include <linux/sched.h>
54125 +#include <linux/grsecurity.h>
54126 +#include <linux/grinternal.h>
54127 +#include <linux/errno.h>
54128 +
54129 +void
54130 +gr_log_forkfail(const int retval)
54131 +{
54132 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
54133 + if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
54134 + switch (retval) {
54135 + case -EAGAIN:
54136 + gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
54137 + break;
54138 + case -ENOMEM:
54139 + gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
54140 + break;
54141 + }
54142 + }
54143 +#endif
54144 + return;
54145 +}
54146 diff -urNp linux-3.0.8/grsecurity/grsec_init.c linux-3.0.8/grsecurity/grsec_init.c
54147 --- linux-3.0.8/grsecurity/grsec_init.c 1969-12-31 19:00:00.000000000 -0500
54148 +++ linux-3.0.8/grsecurity/grsec_init.c 2011-08-25 17:25:12.000000000 -0400
54149 @@ -0,0 +1,269 @@
54150 +#include <linux/kernel.h>
54151 +#include <linux/sched.h>
54152 +#include <linux/mm.h>
54153 +#include <linux/gracl.h>
54154 +#include <linux/slab.h>
54155 +#include <linux/vmalloc.h>
54156 +#include <linux/percpu.h>
54157 +#include <linux/module.h>
54158 +
54159 +int grsec_enable_brute;
54160 +int grsec_enable_link;
54161 +int grsec_enable_dmesg;
54162 +int grsec_enable_harden_ptrace;
54163 +int grsec_enable_fifo;
54164 +int grsec_enable_execlog;
54165 +int grsec_enable_signal;
54166 +int grsec_enable_forkfail;
54167 +int grsec_enable_audit_ptrace;
54168 +int grsec_enable_time;
54169 +int grsec_enable_audit_textrel;
54170 +int grsec_enable_group;
54171 +int grsec_audit_gid;
54172 +int grsec_enable_chdir;
54173 +int grsec_enable_mount;
54174 +int grsec_enable_rofs;
54175 +int grsec_enable_chroot_findtask;
54176 +int grsec_enable_chroot_mount;
54177 +int grsec_enable_chroot_shmat;
54178 +int grsec_enable_chroot_fchdir;
54179 +int grsec_enable_chroot_double;
54180 +int grsec_enable_chroot_pivot;
54181 +int grsec_enable_chroot_chdir;
54182 +int grsec_enable_chroot_chmod;
54183 +int grsec_enable_chroot_mknod;
54184 +int grsec_enable_chroot_nice;
54185 +int grsec_enable_chroot_execlog;
54186 +int grsec_enable_chroot_caps;
54187 +int grsec_enable_chroot_sysctl;
54188 +int grsec_enable_chroot_unix;
54189 +int grsec_enable_tpe;
54190 +int grsec_tpe_gid;
54191 +int grsec_enable_blackhole;
54192 +#ifdef CONFIG_IPV6_MODULE
54193 +EXPORT_SYMBOL(grsec_enable_blackhole);
54194 +#endif
54195 +int grsec_lastack_retries;
54196 +int grsec_enable_tpe_all;
54197 +int grsec_enable_tpe_invert;
54198 +int grsec_enable_socket_all;
54199 +int grsec_socket_all_gid;
54200 +int grsec_enable_socket_client;
54201 +int grsec_socket_client_gid;
54202 +int grsec_enable_socket_server;
54203 +int grsec_socket_server_gid;
54204 +int grsec_resource_logging;
54205 +int grsec_disable_privio;
54206 +int grsec_enable_log_rwxmaps;
54207 +int grsec_lock;
54208 +
54209 +DEFINE_SPINLOCK(grsec_alert_lock);
54210 +unsigned long grsec_alert_wtime = 0;
54211 +unsigned long grsec_alert_fyet = 0;
54212 +
54213 +DEFINE_SPINLOCK(grsec_audit_lock);
54214 +
54215 +DEFINE_RWLOCK(grsec_exec_file_lock);
54216 +
54217 +char *gr_shared_page[4];
54218 +
54219 +char *gr_alert_log_fmt;
54220 +char *gr_audit_log_fmt;
54221 +char *gr_alert_log_buf;
54222 +char *gr_audit_log_buf;
54223 +
54224 +extern struct gr_arg *gr_usermode;
54225 +extern unsigned char *gr_system_salt;
54226 +extern unsigned char *gr_system_sum;
54227 +
54228 +void __init
54229 +grsecurity_init(void)
54230 +{
54231 + int j;
54232 + /* create the per-cpu shared pages */
54233 +
54234 +#ifdef CONFIG_X86
54235 + memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
54236 +#endif
54237 +
54238 + for (j = 0; j < 4; j++) {
54239 + gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
54240 + if (gr_shared_page[j] == NULL) {
54241 + panic("Unable to allocate grsecurity shared page");
54242 + return;
54243 + }
54244 + }
54245 +
54246 + /* allocate log buffers */
54247 + gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
54248 + if (!gr_alert_log_fmt) {
54249 + panic("Unable to allocate grsecurity alert log format buffer");
54250 + return;
54251 + }
54252 + gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
54253 + if (!gr_audit_log_fmt) {
54254 + panic("Unable to allocate grsecurity audit log format buffer");
54255 + return;
54256 + }
54257 + gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
54258 + if (!gr_alert_log_buf) {
54259 + panic("Unable to allocate grsecurity alert log buffer");
54260 + return;
54261 + }
54262 + gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
54263 + if (!gr_audit_log_buf) {
54264 + panic("Unable to allocate grsecurity audit log buffer");
54265 + return;
54266 + }
54267 +
54268 + /* allocate memory for authentication structure */
54269 + gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
54270 + gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
54271 + gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
54272 +
54273 + if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
54274 + panic("Unable to allocate grsecurity authentication structure");
54275 + return;
54276 + }
54277 +
54278 +
54279 +#ifdef CONFIG_GRKERNSEC_IO
54280 +#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
54281 + grsec_disable_privio = 1;
54282 +#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
54283 + grsec_disable_privio = 1;
54284 +#else
54285 + grsec_disable_privio = 0;
54286 +#endif
54287 +#endif
54288 +
54289 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
54290 + /* for backward compatibility, tpe_invert always defaults to on if
54291 + enabled in the kernel
54292 + */
54293 + grsec_enable_tpe_invert = 1;
54294 +#endif
54295 +
54296 +#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
54297 +#ifndef CONFIG_GRKERNSEC_SYSCTL
54298 + grsec_lock = 1;
54299 +#endif
54300 +
54301 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
54302 + grsec_enable_audit_textrel = 1;
54303 +#endif
54304 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
54305 + grsec_enable_log_rwxmaps = 1;
54306 +#endif
54307 +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
54308 + grsec_enable_group = 1;
54309 + grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
54310 +#endif
54311 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
54312 + grsec_enable_chdir = 1;
54313 +#endif
54314 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
54315 + grsec_enable_harden_ptrace = 1;
54316 +#endif
54317 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
54318 + grsec_enable_mount = 1;
54319 +#endif
54320 +#ifdef CONFIG_GRKERNSEC_LINK
54321 + grsec_enable_link = 1;
54322 +#endif
54323 +#ifdef CONFIG_GRKERNSEC_BRUTE
54324 + grsec_enable_brute = 1;
54325 +#endif
54326 +#ifdef CONFIG_GRKERNSEC_DMESG
54327 + grsec_enable_dmesg = 1;
54328 +#endif
54329 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
54330 + grsec_enable_blackhole = 1;
54331 + grsec_lastack_retries = 4;
54332 +#endif
54333 +#ifdef CONFIG_GRKERNSEC_FIFO
54334 + grsec_enable_fifo = 1;
54335 +#endif
54336 +#ifdef CONFIG_GRKERNSEC_EXECLOG
54337 + grsec_enable_execlog = 1;
54338 +#endif
54339 +#ifdef CONFIG_GRKERNSEC_SIGNAL
54340 + grsec_enable_signal = 1;
54341 +#endif
54342 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
54343 + grsec_enable_forkfail = 1;
54344 +#endif
54345 +#ifdef CONFIG_GRKERNSEC_TIME
54346 + grsec_enable_time = 1;
54347 +#endif
54348 +#ifdef CONFIG_GRKERNSEC_RESLOG
54349 + grsec_resource_logging = 1;
54350 +#endif
54351 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
54352 + grsec_enable_chroot_findtask = 1;
54353 +#endif
54354 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
54355 + grsec_enable_chroot_unix = 1;
54356 +#endif
54357 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
54358 + grsec_enable_chroot_mount = 1;
54359 +#endif
54360 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
54361 + grsec_enable_chroot_fchdir = 1;
54362 +#endif
54363 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
54364 + grsec_enable_chroot_shmat = 1;
54365 +#endif
54366 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
54367 + grsec_enable_audit_ptrace = 1;
54368 +#endif
54369 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
54370 + grsec_enable_chroot_double = 1;
54371 +#endif
54372 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
54373 + grsec_enable_chroot_pivot = 1;
54374 +#endif
54375 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
54376 + grsec_enable_chroot_chdir = 1;
54377 +#endif
54378 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
54379 + grsec_enable_chroot_chmod = 1;
54380 +#endif
54381 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
54382 + grsec_enable_chroot_mknod = 1;
54383 +#endif
54384 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
54385 + grsec_enable_chroot_nice = 1;
54386 +#endif
54387 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
54388 + grsec_enable_chroot_execlog = 1;
54389 +#endif
54390 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
54391 + grsec_enable_chroot_caps = 1;
54392 +#endif
54393 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
54394 + grsec_enable_chroot_sysctl = 1;
54395 +#endif
54396 +#ifdef CONFIG_GRKERNSEC_TPE
54397 + grsec_enable_tpe = 1;
54398 + grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
54399 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
54400 + grsec_enable_tpe_all = 1;
54401 +#endif
54402 +#endif
54403 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
54404 + grsec_enable_socket_all = 1;
54405 + grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
54406 +#endif
54407 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
54408 + grsec_enable_socket_client = 1;
54409 + grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
54410 +#endif
54411 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
54412 + grsec_enable_socket_server = 1;
54413 + grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
54414 +#endif
54415 +#endif
54416 +
54417 + return;
54418 +}
54419 diff -urNp linux-3.0.8/grsecurity/grsec_link.c linux-3.0.8/grsecurity/grsec_link.c
54420 --- linux-3.0.8/grsecurity/grsec_link.c 1969-12-31 19:00:00.000000000 -0500
54421 +++ linux-3.0.8/grsecurity/grsec_link.c 2011-08-23 21:48:14.000000000 -0400
54422 @@ -0,0 +1,43 @@
54423 +#include <linux/kernel.h>
54424 +#include <linux/sched.h>
54425 +#include <linux/fs.h>
54426 +#include <linux/file.h>
54427 +#include <linux/grinternal.h>
54428 +
54429 +int
54430 +gr_handle_follow_link(const struct inode *parent,
54431 + const struct inode *inode,
54432 + const struct dentry *dentry, const struct vfsmount *mnt)
54433 +{
54434 +#ifdef CONFIG_GRKERNSEC_LINK
54435 + const struct cred *cred = current_cred();
54436 +
54437 + if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
54438 + (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
54439 + (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
54440 + gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
54441 + return -EACCES;
54442 + }
54443 +#endif
54444 + return 0;
54445 +}
54446 +
54447 +int
54448 +gr_handle_hardlink(const struct dentry *dentry,
54449 + const struct vfsmount *mnt,
54450 + struct inode *inode, const int mode, const char *to)
54451 +{
54452 +#ifdef CONFIG_GRKERNSEC_LINK
54453 + const struct cred *cred = current_cred();
54454 +
54455 + if (grsec_enable_link && cred->fsuid != inode->i_uid &&
54456 + (!S_ISREG(mode) || (mode & S_ISUID) ||
54457 + ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
54458 + (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
54459 + !capable(CAP_FOWNER) && cred->uid) {
54460 + gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
54461 + return -EPERM;
54462 + }
54463 +#endif
54464 + return 0;
54465 +}
54466 diff -urNp linux-3.0.8/grsecurity/grsec_log.c linux-3.0.8/grsecurity/grsec_log.c
54467 --- linux-3.0.8/grsecurity/grsec_log.c 1969-12-31 19:00:00.000000000 -0500
54468 +++ linux-3.0.8/grsecurity/grsec_log.c 2011-09-26 10:46:21.000000000 -0400
54469 @@ -0,0 +1,315 @@
54470 +#include <linux/kernel.h>
54471 +#include <linux/sched.h>
54472 +#include <linux/file.h>
54473 +#include <linux/tty.h>
54474 +#include <linux/fs.h>
54475 +#include <linux/grinternal.h>
54476 +
54477 +#ifdef CONFIG_TREE_PREEMPT_RCU
54478 +#define DISABLE_PREEMPT() preempt_disable()
54479 +#define ENABLE_PREEMPT() preempt_enable()
54480 +#else
54481 +#define DISABLE_PREEMPT()
54482 +#define ENABLE_PREEMPT()
54483 +#endif
54484 +
54485 +#define BEGIN_LOCKS(x) \
54486 + DISABLE_PREEMPT(); \
54487 + rcu_read_lock(); \
54488 + read_lock(&tasklist_lock); \
54489 + read_lock(&grsec_exec_file_lock); \
54490 + if (x != GR_DO_AUDIT) \
54491 + spin_lock(&grsec_alert_lock); \
54492 + else \
54493 + spin_lock(&grsec_audit_lock)
54494 +
54495 +#define END_LOCKS(x) \
54496 + if (x != GR_DO_AUDIT) \
54497 + spin_unlock(&grsec_alert_lock); \
54498 + else \
54499 + spin_unlock(&grsec_audit_lock); \
54500 + read_unlock(&grsec_exec_file_lock); \
54501 + read_unlock(&tasklist_lock); \
54502 + rcu_read_unlock(); \
54503 + ENABLE_PREEMPT(); \
54504 + if (x == GR_DONT_AUDIT) \
54505 + gr_handle_alertkill(current)
54506 +
54507 +enum {
54508 + FLOODING,
54509 + NO_FLOODING
54510 +};
54511 +
54512 +extern char *gr_alert_log_fmt;
54513 +extern char *gr_audit_log_fmt;
54514 +extern char *gr_alert_log_buf;
54515 +extern char *gr_audit_log_buf;
54516 +
54517 +static int gr_log_start(int audit)
54518 +{
54519 + char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
54520 + char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
54521 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
54522 +#if (CONFIG_GRKERNSEC_FLOODTIME > 0 && CONFIG_GRKERNSEC_FLOODBURST > 0)
54523 + unsigned long curr_secs = get_seconds();
54524 +
54525 + if (audit == GR_DO_AUDIT)
54526 + goto set_fmt;
54527 +
54528 + if (!grsec_alert_wtime || time_after(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)) {
54529 + grsec_alert_wtime = curr_secs;
54530 + grsec_alert_fyet = 0;
54531 + } else if (time_before_eq(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)
54532 + && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
54533 + grsec_alert_fyet++;
54534 + } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
54535 + grsec_alert_wtime = curr_secs;
54536 + grsec_alert_fyet++;
54537 + printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
54538 + return FLOODING;
54539 + }
54540 + else return FLOODING;
54541 +
54542 +set_fmt:
54543 +#endif
54544 + memset(buf, 0, PAGE_SIZE);
54545 + if (current->signal->curr_ip && gr_acl_is_enabled()) {
54546 + sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
54547 + snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
54548 + } else if (current->signal->curr_ip) {
54549 + sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
54550 + snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
54551 + } else if (gr_acl_is_enabled()) {
54552 + sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
54553 + snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
54554 + } else {
54555 + sprintf(fmt, "%s%s", loglevel, "grsec: ");
54556 + strcpy(buf, fmt);
54557 + }
54558 +
54559 + return NO_FLOODING;
54560 +}
54561 +
54562 +static void gr_log_middle(int audit, const char *msg, va_list ap)
54563 + __attribute__ ((format (printf, 2, 0)));
54564 +
54565 +static void gr_log_middle(int audit, const char *msg, va_list ap)
54566 +{
54567 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
54568 + unsigned int len = strlen(buf);
54569 +
54570 + vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
54571 +
54572 + return;
54573 +}
54574 +
54575 +static void gr_log_middle_varargs(int audit, const char *msg, ...)
54576 + __attribute__ ((format (printf, 2, 3)));
54577 +
54578 +static void gr_log_middle_varargs(int audit, const char *msg, ...)
54579 +{
54580 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
54581 + unsigned int len = strlen(buf);
54582 + va_list ap;
54583 +
54584 + va_start(ap, msg);
54585 + vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
54586 + va_end(ap);
54587 +
54588 + return;
54589 +}
54590 +
54591 +static void gr_log_end(int audit)
54592 +{
54593 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
54594 + unsigned int len = strlen(buf);
54595 +
54596 + snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
54597 + printk("%s\n", buf);
54598 +
54599 + return;
54600 +}
54601 +
54602 +void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
54603 +{
54604 + int logtype;
54605 + char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
54606 + char *str1 = NULL, *str2 = NULL, *str3 = NULL;
54607 + void *voidptr = NULL;
54608 + int num1 = 0, num2 = 0;
54609 + unsigned long ulong1 = 0, ulong2 = 0;
54610 + struct dentry *dentry = NULL;
54611 + struct vfsmount *mnt = NULL;
54612 + struct file *file = NULL;
54613 + struct task_struct *task = NULL;
54614 + const struct cred *cred, *pcred;
54615 + va_list ap;
54616 +
54617 + BEGIN_LOCKS(audit);
54618 + logtype = gr_log_start(audit);
54619 + if (logtype == FLOODING) {
54620 + END_LOCKS(audit);
54621 + return;
54622 + }
54623 + va_start(ap, argtypes);
54624 + switch (argtypes) {
54625 + case GR_TTYSNIFF:
54626 + task = va_arg(ap, struct task_struct *);
54627 + gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
54628 + break;
54629 + case GR_SYSCTL_HIDDEN:
54630 + str1 = va_arg(ap, char *);
54631 + gr_log_middle_varargs(audit, msg, result, str1);
54632 + break;
54633 + case GR_RBAC:
54634 + dentry = va_arg(ap, struct dentry *);
54635 + mnt = va_arg(ap, struct vfsmount *);
54636 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
54637 + break;
54638 + case GR_RBAC_STR:
54639 + dentry = va_arg(ap, struct dentry *);
54640 + mnt = va_arg(ap, struct vfsmount *);
54641 + str1 = va_arg(ap, char *);
54642 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
54643 + break;
54644 + case GR_STR_RBAC:
54645 + str1 = va_arg(ap, char *);
54646 + dentry = va_arg(ap, struct dentry *);
54647 + mnt = va_arg(ap, struct vfsmount *);
54648 + gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
54649 + break;
54650 + case GR_RBAC_MODE2:
54651 + dentry = va_arg(ap, struct dentry *);
54652 + mnt = va_arg(ap, struct vfsmount *);
54653 + str1 = va_arg(ap, char *);
54654 + str2 = va_arg(ap, char *);
54655 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
54656 + break;
54657 + case GR_RBAC_MODE3:
54658 + dentry = va_arg(ap, struct dentry *);
54659 + mnt = va_arg(ap, struct vfsmount *);
54660 + str1 = va_arg(ap, char *);
54661 + str2 = va_arg(ap, char *);
54662 + str3 = va_arg(ap, char *);
54663 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
54664 + break;
54665 + case GR_FILENAME:
54666 + dentry = va_arg(ap, struct dentry *);
54667 + mnt = va_arg(ap, struct vfsmount *);
54668 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
54669 + break;
54670 + case GR_STR_FILENAME:
54671 + str1 = va_arg(ap, char *);
54672 + dentry = va_arg(ap, struct dentry *);
54673 + mnt = va_arg(ap, struct vfsmount *);
54674 + gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
54675 + break;
54676 + case GR_FILENAME_STR:
54677 + dentry = va_arg(ap, struct dentry *);
54678 + mnt = va_arg(ap, struct vfsmount *);
54679 + str1 = va_arg(ap, char *);
54680 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
54681 + break;
54682 + case GR_FILENAME_TWO_INT:
54683 + dentry = va_arg(ap, struct dentry *);
54684 + mnt = va_arg(ap, struct vfsmount *);
54685 + num1 = va_arg(ap, int);
54686 + num2 = va_arg(ap, int);
54687 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
54688 + break;
54689 + case GR_FILENAME_TWO_INT_STR:
54690 + dentry = va_arg(ap, struct dentry *);
54691 + mnt = va_arg(ap, struct vfsmount *);
54692 + num1 = va_arg(ap, int);
54693 + num2 = va_arg(ap, int);
54694 + str1 = va_arg(ap, char *);
54695 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
54696 + break;
54697 + case GR_TEXTREL:
54698 + file = va_arg(ap, struct file *);
54699 + ulong1 = va_arg(ap, unsigned long);
54700 + ulong2 = va_arg(ap, unsigned long);
54701 + gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
54702 + break;
54703 + case GR_PTRACE:
54704 + task = va_arg(ap, struct task_struct *);
54705 + gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
54706 + break;
54707 + case GR_RESOURCE:
54708 + task = va_arg(ap, struct task_struct *);
54709 + cred = __task_cred(task);
54710 + pcred = __task_cred(task->real_parent);
54711 + ulong1 = va_arg(ap, unsigned long);
54712 + str1 = va_arg(ap, char *);
54713 + ulong2 = va_arg(ap, unsigned long);
54714 + gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
54715 + break;
54716 + case GR_CAP:
54717 + task = va_arg(ap, struct task_struct *);
54718 + cred = __task_cred(task);
54719 + pcred = __task_cred(task->real_parent);
54720 + str1 = va_arg(ap, char *);
54721 + gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
54722 + break;
54723 + case GR_SIG:
54724 + str1 = va_arg(ap, char *);
54725 + voidptr = va_arg(ap, void *);
54726 + gr_log_middle_varargs(audit, msg, str1, voidptr);
54727 + break;
54728 + case GR_SIG2:
54729 + task = va_arg(ap, struct task_struct *);
54730 + cred = __task_cred(task);
54731 + pcred = __task_cred(task->real_parent);
54732 + num1 = va_arg(ap, int);
54733 + gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
54734 + break;
54735 + case GR_CRASH1:
54736 + task = va_arg(ap, struct task_struct *);
54737 + cred = __task_cred(task);
54738 + pcred = __task_cred(task->real_parent);
54739 + ulong1 = va_arg(ap, unsigned long);
54740 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
54741 + break;
54742 + case GR_CRASH2:
54743 + task = va_arg(ap, struct task_struct *);
54744 + cred = __task_cred(task);
54745 + pcred = __task_cred(task->real_parent);
54746 + ulong1 = va_arg(ap, unsigned long);
54747 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
54748 + break;
54749 + case GR_RWXMAP:
54750 + file = va_arg(ap, struct file *);
54751 + gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
54752 + break;
54753 + case GR_PSACCT:
54754 + {
54755 + unsigned int wday, cday;
54756 + __u8 whr, chr;
54757 + __u8 wmin, cmin;
54758 + __u8 wsec, csec;
54759 + char cur_tty[64] = { 0 };
54760 + char parent_tty[64] = { 0 };
54761 +
54762 + task = va_arg(ap, struct task_struct *);
54763 + wday = va_arg(ap, unsigned int);
54764 + cday = va_arg(ap, unsigned int);
54765 + whr = va_arg(ap, int);
54766 + chr = va_arg(ap, int);
54767 + wmin = va_arg(ap, int);
54768 + cmin = va_arg(ap, int);
54769 + wsec = va_arg(ap, int);
54770 + csec = va_arg(ap, int);
54771 + ulong1 = va_arg(ap, unsigned long);
54772 + cred = __task_cred(task);
54773 + pcred = __task_cred(task->real_parent);
54774 +
54775 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
54776 + }
54777 + break;
54778 + default:
54779 + gr_log_middle(audit, msg, ap);
54780 + }
54781 + va_end(ap);
54782 + gr_log_end(audit);
54783 + END_LOCKS(audit);
54784 +}
54785 diff -urNp linux-3.0.8/grsecurity/grsec_mem.c linux-3.0.8/grsecurity/grsec_mem.c
54786 --- linux-3.0.8/grsecurity/grsec_mem.c 1969-12-31 19:00:00.000000000 -0500
54787 +++ linux-3.0.8/grsecurity/grsec_mem.c 2011-08-23 21:48:14.000000000 -0400
54788 @@ -0,0 +1,33 @@
54789 +#include <linux/kernel.h>
54790 +#include <linux/sched.h>
54791 +#include <linux/mm.h>
54792 +#include <linux/mman.h>
54793 +#include <linux/grinternal.h>
54794 +
54795 +void
54796 +gr_handle_ioperm(void)
54797 +{
54798 + gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
54799 + return;
54800 +}
54801 +
54802 +void
54803 +gr_handle_iopl(void)
54804 +{
54805 + gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
54806 + return;
54807 +}
54808 +
54809 +void
54810 +gr_handle_mem_readwrite(u64 from, u64 to)
54811 +{
54812 + gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
54813 + return;
54814 +}
54815 +
54816 +void
54817 +gr_handle_vm86(void)
54818 +{
54819 + gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
54820 + return;
54821 +}
54822 diff -urNp linux-3.0.8/grsecurity/grsec_mount.c linux-3.0.8/grsecurity/grsec_mount.c
54823 --- linux-3.0.8/grsecurity/grsec_mount.c 1969-12-31 19:00:00.000000000 -0500
54824 +++ linux-3.0.8/grsecurity/grsec_mount.c 2011-08-23 21:48:14.000000000 -0400
54825 @@ -0,0 +1,62 @@
54826 +#include <linux/kernel.h>
54827 +#include <linux/sched.h>
54828 +#include <linux/mount.h>
54829 +#include <linux/grsecurity.h>
54830 +#include <linux/grinternal.h>
54831 +
54832 +void
54833 +gr_log_remount(const char *devname, const int retval)
54834 +{
54835 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
54836 + if (grsec_enable_mount && (retval >= 0))
54837 + gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
54838 +#endif
54839 + return;
54840 +}
54841 +
54842 +void
54843 +gr_log_unmount(const char *devname, const int retval)
54844 +{
54845 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
54846 + if (grsec_enable_mount && (retval >= 0))
54847 + gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
54848 +#endif
54849 + return;
54850 +}
54851 +
54852 +void
54853 +gr_log_mount(const char *from, const char *to, const int retval)
54854 +{
54855 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
54856 + if (grsec_enable_mount && (retval >= 0))
54857 + gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to);
54858 +#endif
54859 + return;
54860 +}
54861 +
54862 +int
54863 +gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
54864 +{
54865 +#ifdef CONFIG_GRKERNSEC_ROFS
54866 + if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
54867 + gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
54868 + return -EPERM;
54869 + } else
54870 + return 0;
54871 +#endif
54872 + return 0;
54873 +}
54874 +
54875 +int
54876 +gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
54877 +{
54878 +#ifdef CONFIG_GRKERNSEC_ROFS
54879 + if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
54880 + dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
54881 + gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
54882 + return -EPERM;
54883 + } else
54884 + return 0;
54885 +#endif
54886 + return 0;
54887 +}
54888 diff -urNp linux-3.0.8/grsecurity/grsec_pax.c linux-3.0.8/grsecurity/grsec_pax.c
54889 --- linux-3.0.8/grsecurity/grsec_pax.c 1969-12-31 19:00:00.000000000 -0500
54890 +++ linux-3.0.8/grsecurity/grsec_pax.c 2011-08-23 21:48:14.000000000 -0400
54891 @@ -0,0 +1,36 @@
54892 +#include <linux/kernel.h>
54893 +#include <linux/sched.h>
54894 +#include <linux/mm.h>
54895 +#include <linux/file.h>
54896 +#include <linux/grinternal.h>
54897 +#include <linux/grsecurity.h>
54898 +
54899 +void
54900 +gr_log_textrel(struct vm_area_struct * vma)
54901 +{
54902 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
54903 + if (grsec_enable_audit_textrel)
54904 + gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
54905 +#endif
54906 + return;
54907 +}
54908 +
54909 +void
54910 +gr_log_rwxmmap(struct file *file)
54911 +{
54912 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
54913 + if (grsec_enable_log_rwxmaps)
54914 + gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
54915 +#endif
54916 + return;
54917 +}
54918 +
54919 +void
54920 +gr_log_rwxmprotect(struct file *file)
54921 +{
54922 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
54923 + if (grsec_enable_log_rwxmaps)
54924 + gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
54925 +#endif
54926 + return;
54927 +}
54928 diff -urNp linux-3.0.8/grsecurity/grsec_ptrace.c linux-3.0.8/grsecurity/grsec_ptrace.c
54929 --- linux-3.0.8/grsecurity/grsec_ptrace.c 1969-12-31 19:00:00.000000000 -0500
54930 +++ linux-3.0.8/grsecurity/grsec_ptrace.c 2011-08-23 21:48:14.000000000 -0400
54931 @@ -0,0 +1,14 @@
54932 +#include <linux/kernel.h>
54933 +#include <linux/sched.h>
54934 +#include <linux/grinternal.h>
54935 +#include <linux/grsecurity.h>
54936 +
54937 +void
54938 +gr_audit_ptrace(struct task_struct *task)
54939 +{
54940 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
54941 + if (grsec_enable_audit_ptrace)
54942 + gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
54943 +#endif
54944 + return;
54945 +}
54946 diff -urNp linux-3.0.8/grsecurity/grsec_sig.c linux-3.0.8/grsecurity/grsec_sig.c
54947 --- linux-3.0.8/grsecurity/grsec_sig.c 1969-12-31 19:00:00.000000000 -0500
54948 +++ linux-3.0.8/grsecurity/grsec_sig.c 2011-08-23 21:48:14.000000000 -0400
54949 @@ -0,0 +1,206 @@
54950 +#include <linux/kernel.h>
54951 +#include <linux/sched.h>
54952 +#include <linux/delay.h>
54953 +#include <linux/grsecurity.h>
54954 +#include <linux/grinternal.h>
54955 +#include <linux/hardirq.h>
54956 +
54957 +char *signames[] = {
54958 + [SIGSEGV] = "Segmentation fault",
54959 + [SIGILL] = "Illegal instruction",
54960 + [SIGABRT] = "Abort",
54961 + [SIGBUS] = "Invalid alignment/Bus error"
54962 +};
54963 +
54964 +void
54965 +gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
54966 +{
54967 +#ifdef CONFIG_GRKERNSEC_SIGNAL
54968 + if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
54969 + (sig == SIGABRT) || (sig == SIGBUS))) {
54970 + if (t->pid == current->pid) {
54971 + gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
54972 + } else {
54973 + gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
54974 + }
54975 + }
54976 +#endif
54977 + return;
54978 +}
54979 +
54980 +int
54981 +gr_handle_signal(const struct task_struct *p, const int sig)
54982 +{
54983 +#ifdef CONFIG_GRKERNSEC
54984 + if (current->pid > 1 && gr_check_protected_task(p)) {
54985 + gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
54986 + return -EPERM;
54987 + } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
54988 + return -EPERM;
54989 + }
54990 +#endif
54991 + return 0;
54992 +}
54993 +
54994 +#ifdef CONFIG_GRKERNSEC
54995 +extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
54996 +
54997 +int gr_fake_force_sig(int sig, struct task_struct *t)
54998 +{
54999 + unsigned long int flags;
55000 + int ret, blocked, ignored;
55001 + struct k_sigaction *action;
55002 +
55003 + spin_lock_irqsave(&t->sighand->siglock, flags);
55004 + action = &t->sighand->action[sig-1];
55005 + ignored = action->sa.sa_handler == SIG_IGN;
55006 + blocked = sigismember(&t->blocked, sig);
55007 + if (blocked || ignored) {
55008 + action->sa.sa_handler = SIG_DFL;
55009 + if (blocked) {
55010 + sigdelset(&t->blocked, sig);
55011 + recalc_sigpending_and_wake(t);
55012 + }
55013 + }
55014 + if (action->sa.sa_handler == SIG_DFL)
55015 + t->signal->flags &= ~SIGNAL_UNKILLABLE;
55016 + ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
55017 +
55018 + spin_unlock_irqrestore(&t->sighand->siglock, flags);
55019 +
55020 + return ret;
55021 +}
55022 +#endif
55023 +
55024 +#ifdef CONFIG_GRKERNSEC_BRUTE
55025 +#define GR_USER_BAN_TIME (15 * 60)
55026 +
55027 +static int __get_dumpable(unsigned long mm_flags)
55028 +{
55029 + int ret;
55030 +
55031 + ret = mm_flags & MMF_DUMPABLE_MASK;
55032 + return (ret >= 2) ? 2 : ret;
55033 +}
55034 +#endif
55035 +
55036 +void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
55037 +{
55038 +#ifdef CONFIG_GRKERNSEC_BRUTE
55039 + uid_t uid = 0;
55040 +
55041 + if (!grsec_enable_brute)
55042 + return;
55043 +
55044 + rcu_read_lock();
55045 + read_lock(&tasklist_lock);
55046 + read_lock(&grsec_exec_file_lock);
55047 + if (p->real_parent && p->real_parent->exec_file == p->exec_file)
55048 + p->real_parent->brute = 1;
55049 + else {
55050 + const struct cred *cred = __task_cred(p), *cred2;
55051 + struct task_struct *tsk, *tsk2;
55052 +
55053 + if (!__get_dumpable(mm_flags) && cred->uid) {
55054 + struct user_struct *user;
55055 +
55056 + uid = cred->uid;
55057 +
55058 + /* this is put upon execution past expiration */
55059 + user = find_user(uid);
55060 + if (user == NULL)
55061 + goto unlock;
55062 + user->banned = 1;
55063 + user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
55064 + if (user->ban_expires == ~0UL)
55065 + user->ban_expires--;
55066 +
55067 + do_each_thread(tsk2, tsk) {
55068 + cred2 = __task_cred(tsk);
55069 + if (tsk != p && cred2->uid == uid)
55070 + gr_fake_force_sig(SIGKILL, tsk);
55071 + } while_each_thread(tsk2, tsk);
55072 + }
55073 + }
55074 +unlock:
55075 + read_unlock(&grsec_exec_file_lock);
55076 + read_unlock(&tasklist_lock);
55077 + rcu_read_unlock();
55078 +
55079 + if (uid)
55080 + printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
55081 +
55082 +#endif
55083 + return;
55084 +}
55085 +
55086 +void gr_handle_brute_check(void)
55087 +{
55088 +#ifdef CONFIG_GRKERNSEC_BRUTE
55089 + if (current->brute)
55090 + msleep(30 * 1000);
55091 +#endif
55092 + return;
55093 +}
55094 +
55095 +void gr_handle_kernel_exploit(void)
55096 +{
55097 +#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
55098 + const struct cred *cred;
55099 + struct task_struct *tsk, *tsk2;
55100 + struct user_struct *user;
55101 + uid_t uid;
55102 +
55103 + if (in_irq() || in_serving_softirq() || in_nmi())
55104 + panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
55105 +
55106 + uid = current_uid();
55107 +
55108 + if (uid == 0)
55109 + panic("grsec: halting the system due to suspicious kernel crash caused by root");
55110 + else {
55111 + /* kill all the processes of this user, hold a reference
55112 + to their creds struct, and prevent them from creating
55113 + another process until system reset
55114 + */
55115 + printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
55116 + /* we intentionally leak this ref */
55117 + user = get_uid(current->cred->user);
55118 + if (user) {
55119 + user->banned = 1;
55120 + user->ban_expires = ~0UL;
55121 + }
55122 +
55123 + read_lock(&tasklist_lock);
55124 + do_each_thread(tsk2, tsk) {
55125 + cred = __task_cred(tsk);
55126 + if (cred->uid == uid)
55127 + gr_fake_force_sig(SIGKILL, tsk);
55128 + } while_each_thread(tsk2, tsk);
55129 + read_unlock(&tasklist_lock);
55130 + }
55131 +#endif
55132 +}
55133 +
55134 +int __gr_process_user_ban(struct user_struct *user)
55135 +{
55136 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
55137 + if (unlikely(user->banned)) {
55138 + if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
55139 + user->banned = 0;
55140 + user->ban_expires = 0;
55141 + free_uid(user);
55142 + } else
55143 + return -EPERM;
55144 + }
55145 +#endif
55146 + return 0;
55147 +}
55148 +
55149 +int gr_process_user_ban(void)
55150 +{
55151 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
55152 + return __gr_process_user_ban(current->cred->user);
55153 +#endif
55154 + return 0;
55155 +}
55156 diff -urNp linux-3.0.8/grsecurity/grsec_sock.c linux-3.0.8/grsecurity/grsec_sock.c
55157 --- linux-3.0.8/grsecurity/grsec_sock.c 1969-12-31 19:00:00.000000000 -0500
55158 +++ linux-3.0.8/grsecurity/grsec_sock.c 2011-08-23 21:48:14.000000000 -0400
55159 @@ -0,0 +1,244 @@
55160 +#include <linux/kernel.h>
55161 +#include <linux/module.h>
55162 +#include <linux/sched.h>
55163 +#include <linux/file.h>
55164 +#include <linux/net.h>
55165 +#include <linux/in.h>
55166 +#include <linux/ip.h>
55167 +#include <net/sock.h>
55168 +#include <net/inet_sock.h>
55169 +#include <linux/grsecurity.h>
55170 +#include <linux/grinternal.h>
55171 +#include <linux/gracl.h>
55172 +
55173 +extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
55174 +extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
55175 +
55176 +EXPORT_SYMBOL(gr_search_udp_recvmsg);
55177 +EXPORT_SYMBOL(gr_search_udp_sendmsg);
55178 +
55179 +#ifdef CONFIG_UNIX_MODULE
55180 +EXPORT_SYMBOL(gr_acl_handle_unix);
55181 +EXPORT_SYMBOL(gr_acl_handle_mknod);
55182 +EXPORT_SYMBOL(gr_handle_chroot_unix);
55183 +EXPORT_SYMBOL(gr_handle_create);
55184 +#endif
55185 +
55186 +#ifdef CONFIG_GRKERNSEC
55187 +#define gr_conn_table_size 32749
55188 +struct conn_table_entry {
55189 + struct conn_table_entry *next;
55190 + struct signal_struct *sig;
55191 +};
55192 +
55193 +struct conn_table_entry *gr_conn_table[gr_conn_table_size];
55194 +DEFINE_SPINLOCK(gr_conn_table_lock);
55195 +
55196 +extern const char * gr_socktype_to_name(unsigned char type);
55197 +extern const char * gr_proto_to_name(unsigned char proto);
55198 +extern const char * gr_sockfamily_to_name(unsigned char family);
55199 +
55200 +static __inline__ int
55201 +conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
55202 +{
55203 + return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
55204 +}
55205 +
55206 +static __inline__ int
55207 +conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
55208 + __u16 sport, __u16 dport)
55209 +{
55210 + if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
55211 + sig->gr_sport == sport && sig->gr_dport == dport))
55212 + return 1;
55213 + else
55214 + return 0;
55215 +}
55216 +
55217 +static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
55218 +{
55219 + struct conn_table_entry **match;
55220 + unsigned int index;
55221 +
55222 + index = conn_hash(sig->gr_saddr, sig->gr_daddr,
55223 + sig->gr_sport, sig->gr_dport,
55224 + gr_conn_table_size);
55225 +
55226 + newent->sig = sig;
55227 +
55228 + match = &gr_conn_table[index];
55229 + newent->next = *match;
55230 + *match = newent;
55231 +
55232 + return;
55233 +}
55234 +
55235 +static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
55236 +{
55237 + struct conn_table_entry *match, *last = NULL;
55238 + unsigned int index;
55239 +
55240 + index = conn_hash(sig->gr_saddr, sig->gr_daddr,
55241 + sig->gr_sport, sig->gr_dport,
55242 + gr_conn_table_size);
55243 +
55244 + match = gr_conn_table[index];
55245 + while (match && !conn_match(match->sig,
55246 + sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
55247 + sig->gr_dport)) {
55248 + last = match;
55249 + match = match->next;
55250 + }
55251 +
55252 + if (match) {
55253 + if (last)
55254 + last->next = match->next;
55255 + else
55256 + gr_conn_table[index] = NULL;
55257 + kfree(match);
55258 + }
55259 +
55260 + return;
55261 +}
55262 +
55263 +static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
55264 + __u16 sport, __u16 dport)
55265 +{
55266 + struct conn_table_entry *match;
55267 + unsigned int index;
55268 +
55269 + index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
55270 +
55271 + match = gr_conn_table[index];
55272 + while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
55273 + match = match->next;
55274 +
55275 + if (match)
55276 + return match->sig;
55277 + else
55278 + return NULL;
55279 +}
55280 +
55281 +#endif
55282 +
55283 +void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
55284 +{
55285 +#ifdef CONFIG_GRKERNSEC
55286 + struct signal_struct *sig = task->signal;
55287 + struct conn_table_entry *newent;
55288 +
55289 + newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
55290 + if (newent == NULL)
55291 + return;
55292 + /* no bh lock needed since we are called with bh disabled */
55293 + spin_lock(&gr_conn_table_lock);
55294 + gr_del_task_from_ip_table_nolock(sig);
55295 + sig->gr_saddr = inet->inet_rcv_saddr;
55296 + sig->gr_daddr = inet->inet_daddr;
55297 + sig->gr_sport = inet->inet_sport;
55298 + sig->gr_dport = inet->inet_dport;
55299 + gr_add_to_task_ip_table_nolock(sig, newent);
55300 + spin_unlock(&gr_conn_table_lock);
55301 +#endif
55302 + return;
55303 +}
55304 +
55305 +void gr_del_task_from_ip_table(struct task_struct *task)
55306 +{
55307 +#ifdef CONFIG_GRKERNSEC
55308 + spin_lock_bh(&gr_conn_table_lock);
55309 + gr_del_task_from_ip_table_nolock(task->signal);
55310 + spin_unlock_bh(&gr_conn_table_lock);
55311 +#endif
55312 + return;
55313 +}
55314 +
55315 +void
55316 +gr_attach_curr_ip(const struct sock *sk)
55317 +{
55318 +#ifdef CONFIG_GRKERNSEC
55319 + struct signal_struct *p, *set;
55320 + const struct inet_sock *inet = inet_sk(sk);
55321 +
55322 + if (unlikely(sk->sk_protocol != IPPROTO_TCP))
55323 + return;
55324 +
55325 + set = current->signal;
55326 +
55327 + spin_lock_bh(&gr_conn_table_lock);
55328 + p = gr_lookup_task_ip_table(inet->inet_daddr, inet->inet_rcv_saddr,
55329 + inet->inet_dport, inet->inet_sport);
55330 + if (unlikely(p != NULL)) {
55331 + set->curr_ip = p->curr_ip;
55332 + set->used_accept = 1;
55333 + gr_del_task_from_ip_table_nolock(p);
55334 + spin_unlock_bh(&gr_conn_table_lock);
55335 + return;
55336 + }
55337 + spin_unlock_bh(&gr_conn_table_lock);
55338 +
55339 + set->curr_ip = inet->inet_daddr;
55340 + set->used_accept = 1;
55341 +#endif
55342 + return;
55343 +}
55344 +
55345 +int
55346 +gr_handle_sock_all(const int family, const int type, const int protocol)
55347 +{
55348 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
55349 + if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
55350 + (family != AF_UNIX)) {
55351 + if (family == AF_INET)
55352 + gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
55353 + else
55354 + gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
55355 + return -EACCES;
55356 + }
55357 +#endif
55358 + return 0;
55359 +}
55360 +
55361 +int
55362 +gr_handle_sock_server(const struct sockaddr *sck)
55363 +{
55364 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
55365 + if (grsec_enable_socket_server &&
55366 + in_group_p(grsec_socket_server_gid) &&
55367 + sck && (sck->sa_family != AF_UNIX) &&
55368 + (sck->sa_family != AF_LOCAL)) {
55369 + gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
55370 + return -EACCES;
55371 + }
55372 +#endif
55373 + return 0;
55374 +}
55375 +
55376 +int
55377 +gr_handle_sock_server_other(const struct sock *sck)
55378 +{
55379 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
55380 + if (grsec_enable_socket_server &&
55381 + in_group_p(grsec_socket_server_gid) &&
55382 + sck && (sck->sk_family != AF_UNIX) &&
55383 + (sck->sk_family != AF_LOCAL)) {
55384 + gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
55385 + return -EACCES;
55386 + }
55387 +#endif
55388 + return 0;
55389 +}
55390 +
55391 +int
55392 +gr_handle_sock_client(const struct sockaddr *sck)
55393 +{
55394 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
55395 + if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
55396 + sck && (sck->sa_family != AF_UNIX) &&
55397 + (sck->sa_family != AF_LOCAL)) {
55398 + gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
55399 + return -EACCES;
55400 + }
55401 +#endif
55402 + return 0;
55403 +}
55404 diff -urNp linux-3.0.8/grsecurity/grsec_sysctl.c linux-3.0.8/grsecurity/grsec_sysctl.c
55405 --- linux-3.0.8/grsecurity/grsec_sysctl.c 1969-12-31 19:00:00.000000000 -0500
55406 +++ linux-3.0.8/grsecurity/grsec_sysctl.c 2011-08-25 17:26:15.000000000 -0400
55407 @@ -0,0 +1,433 @@
55408 +#include <linux/kernel.h>
55409 +#include <linux/sched.h>
55410 +#include <linux/sysctl.h>
55411 +#include <linux/grsecurity.h>
55412 +#include <linux/grinternal.h>
55413 +
55414 +int
55415 +gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
55416 +{
55417 +#ifdef CONFIG_GRKERNSEC_SYSCTL
55418 + if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
55419 + gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
55420 + return -EACCES;
55421 + }
55422 +#endif
55423 + return 0;
55424 +}
55425 +
55426 +#ifdef CONFIG_GRKERNSEC_ROFS
55427 +static int __maybe_unused one = 1;
55428 +#endif
55429 +
55430 +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
55431 +struct ctl_table grsecurity_table[] = {
55432 +#ifdef CONFIG_GRKERNSEC_SYSCTL
55433 +#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
55434 +#ifdef CONFIG_GRKERNSEC_IO
55435 + {
55436 + .procname = "disable_priv_io",
55437 + .data = &grsec_disable_privio,
55438 + .maxlen = sizeof(int),
55439 + .mode = 0600,
55440 + .proc_handler = &proc_dointvec,
55441 + },
55442 +#endif
55443 +#endif
55444 +#ifdef CONFIG_GRKERNSEC_LINK
55445 + {
55446 + .procname = "linking_restrictions",
55447 + .data = &grsec_enable_link,
55448 + .maxlen = sizeof(int),
55449 + .mode = 0600,
55450 + .proc_handler = &proc_dointvec,
55451 + },
55452 +#endif
55453 +#ifdef CONFIG_GRKERNSEC_BRUTE
55454 + {
55455 + .procname = "deter_bruteforce",
55456 + .data = &grsec_enable_brute,
55457 + .maxlen = sizeof(int),
55458 + .mode = 0600,
55459 + .proc_handler = &proc_dointvec,
55460 + },
55461 +#endif
55462 +#ifdef CONFIG_GRKERNSEC_FIFO
55463 + {
55464 + .procname = "fifo_restrictions",
55465 + .data = &grsec_enable_fifo,
55466 + .maxlen = sizeof(int),
55467 + .mode = 0600,
55468 + .proc_handler = &proc_dointvec,
55469 + },
55470 +#endif
55471 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
55472 + {
55473 + .procname = "ip_blackhole",
55474 + .data = &grsec_enable_blackhole,
55475 + .maxlen = sizeof(int),
55476 + .mode = 0600,
55477 + .proc_handler = &proc_dointvec,
55478 + },
55479 + {
55480 + .procname = "lastack_retries",
55481 + .data = &grsec_lastack_retries,
55482 + .maxlen = sizeof(int),
55483 + .mode = 0600,
55484 + .proc_handler = &proc_dointvec,
55485 + },
55486 +#endif
55487 +#ifdef CONFIG_GRKERNSEC_EXECLOG
55488 + {
55489 + .procname = "exec_logging",
55490 + .data = &grsec_enable_execlog,
55491 + .maxlen = sizeof(int),
55492 + .mode = 0600,
55493 + .proc_handler = &proc_dointvec,
55494 + },
55495 +#endif
55496 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
55497 + {
55498 + .procname = "rwxmap_logging",
55499 + .data = &grsec_enable_log_rwxmaps,
55500 + .maxlen = sizeof(int),
55501 + .mode = 0600,
55502 + .proc_handler = &proc_dointvec,
55503 + },
55504 +#endif
55505 +#ifdef CONFIG_GRKERNSEC_SIGNAL
55506 + {
55507 + .procname = "signal_logging",
55508 + .data = &grsec_enable_signal,
55509 + .maxlen = sizeof(int),
55510 + .mode = 0600,
55511 + .proc_handler = &proc_dointvec,
55512 + },
55513 +#endif
55514 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
55515 + {
55516 + .procname = "forkfail_logging",
55517 + .data = &grsec_enable_forkfail,
55518 + .maxlen = sizeof(int),
55519 + .mode = 0600,
55520 + .proc_handler = &proc_dointvec,
55521 + },
55522 +#endif
55523 +#ifdef CONFIG_GRKERNSEC_TIME
55524 + {
55525 + .procname = "timechange_logging",
55526 + .data = &grsec_enable_time,
55527 + .maxlen = sizeof(int),
55528 + .mode = 0600,
55529 + .proc_handler = &proc_dointvec,
55530 + },
55531 +#endif
55532 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
55533 + {
55534 + .procname = "chroot_deny_shmat",
55535 + .data = &grsec_enable_chroot_shmat,
55536 + .maxlen = sizeof(int),
55537 + .mode = 0600,
55538 + .proc_handler = &proc_dointvec,
55539 + },
55540 +#endif
55541 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
55542 + {
55543 + .procname = "chroot_deny_unix",
55544 + .data = &grsec_enable_chroot_unix,
55545 + .maxlen = sizeof(int),
55546 + .mode = 0600,
55547 + .proc_handler = &proc_dointvec,
55548 + },
55549 +#endif
55550 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
55551 + {
55552 + .procname = "chroot_deny_mount",
55553 + .data = &grsec_enable_chroot_mount,
55554 + .maxlen = sizeof(int),
55555 + .mode = 0600,
55556 + .proc_handler = &proc_dointvec,
55557 + },
55558 +#endif
55559 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
55560 + {
55561 + .procname = "chroot_deny_fchdir",
55562 + .data = &grsec_enable_chroot_fchdir,
55563 + .maxlen = sizeof(int),
55564 + .mode = 0600,
55565 + .proc_handler = &proc_dointvec,
55566 + },
55567 +#endif
55568 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
55569 + {
55570 + .procname = "chroot_deny_chroot",
55571 + .data = &grsec_enable_chroot_double,
55572 + .maxlen = sizeof(int),
55573 + .mode = 0600,
55574 + .proc_handler = &proc_dointvec,
55575 + },
55576 +#endif
55577 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
55578 + {
55579 + .procname = "chroot_deny_pivot",
55580 + .data = &grsec_enable_chroot_pivot,
55581 + .maxlen = sizeof(int),
55582 + .mode = 0600,
55583 + .proc_handler = &proc_dointvec,
55584 + },
55585 +#endif
55586 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
55587 + {
55588 + .procname = "chroot_enforce_chdir",
55589 + .data = &grsec_enable_chroot_chdir,
55590 + .maxlen = sizeof(int),
55591 + .mode = 0600,
55592 + .proc_handler = &proc_dointvec,
55593 + },
55594 +#endif
55595 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
55596 + {
55597 + .procname = "chroot_deny_chmod",
55598 + .data = &grsec_enable_chroot_chmod,
55599 + .maxlen = sizeof(int),
55600 + .mode = 0600,
55601 + .proc_handler = &proc_dointvec,
55602 + },
55603 +#endif
55604 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
55605 + {
55606 + .procname = "chroot_deny_mknod",
55607 + .data = &grsec_enable_chroot_mknod,
55608 + .maxlen = sizeof(int),
55609 + .mode = 0600,
55610 + .proc_handler = &proc_dointvec,
55611 + },
55612 +#endif
55613 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
55614 + {
55615 + .procname = "chroot_restrict_nice",
55616 + .data = &grsec_enable_chroot_nice,
55617 + .maxlen = sizeof(int),
55618 + .mode = 0600,
55619 + .proc_handler = &proc_dointvec,
55620 + },
55621 +#endif
55622 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
55623 + {
55624 + .procname = "chroot_execlog",
55625 + .data = &grsec_enable_chroot_execlog,
55626 + .maxlen = sizeof(int),
55627 + .mode = 0600,
55628 + .proc_handler = &proc_dointvec,
55629 + },
55630 +#endif
55631 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
55632 + {
55633 + .procname = "chroot_caps",
55634 + .data = &grsec_enable_chroot_caps,
55635 + .maxlen = sizeof(int),
55636 + .mode = 0600,
55637 + .proc_handler = &proc_dointvec,
55638 + },
55639 +#endif
55640 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
55641 + {
55642 + .procname = "chroot_deny_sysctl",
55643 + .data = &grsec_enable_chroot_sysctl,
55644 + .maxlen = sizeof(int),
55645 + .mode = 0600,
55646 + .proc_handler = &proc_dointvec,
55647 + },
55648 +#endif
55649 +#ifdef CONFIG_GRKERNSEC_TPE
55650 + {
55651 + .procname = "tpe",
55652 + .data = &grsec_enable_tpe,
55653 + .maxlen = sizeof(int),
55654 + .mode = 0600,
55655 + .proc_handler = &proc_dointvec,
55656 + },
55657 + {
55658 + .procname = "tpe_gid",
55659 + .data = &grsec_tpe_gid,
55660 + .maxlen = sizeof(int),
55661 + .mode = 0600,
55662 + .proc_handler = &proc_dointvec,
55663 + },
55664 +#endif
55665 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
55666 + {
55667 + .procname = "tpe_invert",
55668 + .data = &grsec_enable_tpe_invert,
55669 + .maxlen = sizeof(int),
55670 + .mode = 0600,
55671 + .proc_handler = &proc_dointvec,
55672 + },
55673 +#endif
55674 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
55675 + {
55676 + .procname = "tpe_restrict_all",
55677 + .data = &grsec_enable_tpe_all,
55678 + .maxlen = sizeof(int),
55679 + .mode = 0600,
55680 + .proc_handler = &proc_dointvec,
55681 + },
55682 +#endif
55683 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
55684 + {
55685 + .procname = "socket_all",
55686 + .data = &grsec_enable_socket_all,
55687 + .maxlen = sizeof(int),
55688 + .mode = 0600,
55689 + .proc_handler = &proc_dointvec,
55690 + },
55691 + {
55692 + .procname = "socket_all_gid",
55693 + .data = &grsec_socket_all_gid,
55694 + .maxlen = sizeof(int),
55695 + .mode = 0600,
55696 + .proc_handler = &proc_dointvec,
55697 + },
55698 +#endif
55699 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
55700 + {
55701 + .procname = "socket_client",
55702 + .data = &grsec_enable_socket_client,
55703 + .maxlen = sizeof(int),
55704 + .mode = 0600,
55705 + .proc_handler = &proc_dointvec,
55706 + },
55707 + {
55708 + .procname = "socket_client_gid",
55709 + .data = &grsec_socket_client_gid,
55710 + .maxlen = sizeof(int),
55711 + .mode = 0600,
55712 + .proc_handler = &proc_dointvec,
55713 + },
55714 +#endif
55715 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
55716 + {
55717 + .procname = "socket_server",
55718 + .data = &grsec_enable_socket_server,
55719 + .maxlen = sizeof(int),
55720 + .mode = 0600,
55721 + .proc_handler = &proc_dointvec,
55722 + },
55723 + {
55724 + .procname = "socket_server_gid",
55725 + .data = &grsec_socket_server_gid,
55726 + .maxlen = sizeof(int),
55727 + .mode = 0600,
55728 + .proc_handler = &proc_dointvec,
55729 + },
55730 +#endif
55731 +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
55732 + {
55733 + .procname = "audit_group",
55734 + .data = &grsec_enable_group,
55735 + .maxlen = sizeof(int),
55736 + .mode = 0600,
55737 + .proc_handler = &proc_dointvec,
55738 + },
55739 + {
55740 + .procname = "audit_gid",
55741 + .data = &grsec_audit_gid,
55742 + .maxlen = sizeof(int),
55743 + .mode = 0600,
55744 + .proc_handler = &proc_dointvec,
55745 + },
55746 +#endif
55747 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
55748 + {
55749 + .procname = "audit_chdir",
55750 + .data = &grsec_enable_chdir,
55751 + .maxlen = sizeof(int),
55752 + .mode = 0600,
55753 + .proc_handler = &proc_dointvec,
55754 + },
55755 +#endif
55756 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
55757 + {
55758 + .procname = "audit_mount",
55759 + .data = &grsec_enable_mount,
55760 + .maxlen = sizeof(int),
55761 + .mode = 0600,
55762 + .proc_handler = &proc_dointvec,
55763 + },
55764 +#endif
55765 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
55766 + {
55767 + .procname = "audit_textrel",
55768 + .data = &grsec_enable_audit_textrel,
55769 + .maxlen = sizeof(int),
55770 + .mode = 0600,
55771 + .proc_handler = &proc_dointvec,
55772 + },
55773 +#endif
55774 +#ifdef CONFIG_GRKERNSEC_DMESG
55775 + {
55776 + .procname = "dmesg",
55777 + .data = &grsec_enable_dmesg,
55778 + .maxlen = sizeof(int),
55779 + .mode = 0600,
55780 + .proc_handler = &proc_dointvec,
55781 + },
55782 +#endif
55783 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
55784 + {
55785 + .procname = "chroot_findtask",
55786 + .data = &grsec_enable_chroot_findtask,
55787 + .maxlen = sizeof(int),
55788 + .mode = 0600,
55789 + .proc_handler = &proc_dointvec,
55790 + },
55791 +#endif
55792 +#ifdef CONFIG_GRKERNSEC_RESLOG
55793 + {
55794 + .procname = "resource_logging",
55795 + .data = &grsec_resource_logging,
55796 + .maxlen = sizeof(int),
55797 + .mode = 0600,
55798 + .proc_handler = &proc_dointvec,
55799 + },
55800 +#endif
55801 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
55802 + {
55803 + .procname = "audit_ptrace",
55804 + .data = &grsec_enable_audit_ptrace,
55805 + .maxlen = sizeof(int),
55806 + .mode = 0600,
55807 + .proc_handler = &proc_dointvec,
55808 + },
55809 +#endif
55810 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
55811 + {
55812 + .procname = "harden_ptrace",
55813 + .data = &grsec_enable_harden_ptrace,
55814 + .maxlen = sizeof(int),
55815 + .mode = 0600,
55816 + .proc_handler = &proc_dointvec,
55817 + },
55818 +#endif
55819 + {
55820 + .procname = "grsec_lock",
55821 + .data = &grsec_lock,
55822 + .maxlen = sizeof(int),
55823 + .mode = 0600,
55824 + .proc_handler = &proc_dointvec,
55825 + },
55826 +#endif
55827 +#ifdef CONFIG_GRKERNSEC_ROFS
55828 + {
55829 + .procname = "romount_protect",
55830 + .data = &grsec_enable_rofs,
55831 + .maxlen = sizeof(int),
55832 + .mode = 0600,
55833 + .proc_handler = &proc_dointvec_minmax,
55834 + .extra1 = &one,
55835 + .extra2 = &one,
55836 + },
55837 +#endif
55838 + { }
55839 +};
55840 +#endif
55841 diff -urNp linux-3.0.8/grsecurity/grsec_time.c linux-3.0.8/grsecurity/grsec_time.c
55842 --- linux-3.0.8/grsecurity/grsec_time.c 1969-12-31 19:00:00.000000000 -0500
55843 +++ linux-3.0.8/grsecurity/grsec_time.c 2011-08-23 21:48:14.000000000 -0400
55844 @@ -0,0 +1,16 @@
55845 +#include <linux/kernel.h>
55846 +#include <linux/sched.h>
55847 +#include <linux/grinternal.h>
55848 +#include <linux/module.h>
55849 +
55850 +void
55851 +gr_log_timechange(void)
55852 +{
55853 +#ifdef CONFIG_GRKERNSEC_TIME
55854 + if (grsec_enable_time)
55855 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
55856 +#endif
55857 + return;
55858 +}
55859 +
55860 +EXPORT_SYMBOL(gr_log_timechange);
55861 diff -urNp linux-3.0.8/grsecurity/grsec_tpe.c linux-3.0.8/grsecurity/grsec_tpe.c
55862 --- linux-3.0.8/grsecurity/grsec_tpe.c 1969-12-31 19:00:00.000000000 -0500
55863 +++ linux-3.0.8/grsecurity/grsec_tpe.c 2011-08-23 21:48:14.000000000 -0400
55864 @@ -0,0 +1,39 @@
55865 +#include <linux/kernel.h>
55866 +#include <linux/sched.h>
55867 +#include <linux/file.h>
55868 +#include <linux/fs.h>
55869 +#include <linux/grinternal.h>
55870 +
55871 +extern int gr_acl_tpe_check(void);
55872 +
55873 +int
55874 +gr_tpe_allow(const struct file *file)
55875 +{
55876 +#ifdef CONFIG_GRKERNSEC
55877 + struct inode *inode = file->f_path.dentry->d_parent->d_inode;
55878 + const struct cred *cred = current_cred();
55879 +
55880 + if (cred->uid && ((grsec_enable_tpe &&
55881 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
55882 + ((grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid)) ||
55883 + (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid)))
55884 +#else
55885 + in_group_p(grsec_tpe_gid)
55886 +#endif
55887 + ) || gr_acl_tpe_check()) &&
55888 + (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
55889 + (inode->i_mode & S_IWOTH))))) {
55890 + gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
55891 + return 0;
55892 + }
55893 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
55894 + if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
55895 + ((inode->i_uid && (inode->i_uid != cred->uid)) ||
55896 + (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
55897 + gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
55898 + return 0;
55899 + }
55900 +#endif
55901 +#endif
55902 + return 1;
55903 +}
55904 diff -urNp linux-3.0.8/grsecurity/grsum.c linux-3.0.8/grsecurity/grsum.c
55905 --- linux-3.0.8/grsecurity/grsum.c 1969-12-31 19:00:00.000000000 -0500
55906 +++ linux-3.0.8/grsecurity/grsum.c 2011-08-23 21:48:14.000000000 -0400
55907 @@ -0,0 +1,61 @@
55908 +#include <linux/err.h>
55909 +#include <linux/kernel.h>
55910 +#include <linux/sched.h>
55911 +#include <linux/mm.h>
55912 +#include <linux/scatterlist.h>
55913 +#include <linux/crypto.h>
55914 +#include <linux/gracl.h>
55915 +
55916 +
55917 +#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
55918 +#error "crypto and sha256 must be built into the kernel"
55919 +#endif
55920 +
55921 +int
55922 +chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
55923 +{
55924 + char *p;
55925 + struct crypto_hash *tfm;
55926 + struct hash_desc desc;
55927 + struct scatterlist sg;
55928 + unsigned char temp_sum[GR_SHA_LEN];
55929 + volatile int retval = 0;
55930 + volatile int dummy = 0;
55931 + unsigned int i;
55932 +
55933 + sg_init_table(&sg, 1);
55934 +
55935 + tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
55936 + if (IS_ERR(tfm)) {
55937 + /* should never happen, since sha256 should be built in */
55938 + return 1;
55939 + }
55940 +
55941 + desc.tfm = tfm;
55942 + desc.flags = 0;
55943 +
55944 + crypto_hash_init(&desc);
55945 +
55946 + p = salt;
55947 + sg_set_buf(&sg, p, GR_SALT_LEN);
55948 + crypto_hash_update(&desc, &sg, sg.length);
55949 +
55950 + p = entry->pw;
55951 + sg_set_buf(&sg, p, strlen(p));
55952 +
55953 + crypto_hash_update(&desc, &sg, sg.length);
55954 +
55955 + crypto_hash_final(&desc, temp_sum);
55956 +
55957 + memset(entry->pw, 0, GR_PW_LEN);
55958 +
55959 + for (i = 0; i < GR_SHA_LEN; i++)
55960 + if (sum[i] != temp_sum[i])
55961 + retval = 1;
55962 + else
55963 + dummy = 1; // waste a cycle
55964 +
55965 + crypto_free_hash(tfm);
55966 +
55967 + return retval;
55968 +}
55969 diff -urNp linux-3.0.8/grsecurity/Kconfig linux-3.0.8/grsecurity/Kconfig
55970 --- linux-3.0.8/grsecurity/Kconfig 1969-12-31 19:00:00.000000000 -0500
55971 +++ linux-3.0.8/grsecurity/Kconfig 2011-09-15 00:00:57.000000000 -0400
55972 @@ -0,0 +1,1038 @@
55973 +#
55974 +# grecurity configuration
55975 +#
55976 +
55977 +menu "Grsecurity"
55978 +
55979 +config GRKERNSEC
55980 + bool "Grsecurity"
55981 + select CRYPTO
55982 + select CRYPTO_SHA256
55983 + help
55984 + If you say Y here, you will be able to configure many features
55985 + that will enhance the security of your system. It is highly
55986 + recommended that you say Y here and read through the help
55987 + for each option so that you fully understand the features and
55988 + can evaluate their usefulness for your machine.
55989 +
55990 +choice
55991 + prompt "Security Level"
55992 + depends on GRKERNSEC
55993 + default GRKERNSEC_CUSTOM
55994 +
55995 +config GRKERNSEC_LOW
55996 + bool "Low"
55997 + select GRKERNSEC_LINK
55998 + select GRKERNSEC_FIFO
55999 + select GRKERNSEC_RANDNET
56000 + select GRKERNSEC_DMESG
56001 + select GRKERNSEC_CHROOT
56002 + select GRKERNSEC_CHROOT_CHDIR
56003 +
56004 + help
56005 + If you choose this option, several of the grsecurity options will
56006 + be enabled that will give you greater protection against a number
56007 + of attacks, while assuring that none of your software will have any
56008 + conflicts with the additional security measures. If you run a lot
56009 + of unusual software, or you are having problems with the higher
56010 + security levels, you should say Y here. With this option, the
56011 + following features are enabled:
56012 +
56013 + - Linking restrictions
56014 + - FIFO restrictions
56015 + - Restricted dmesg
56016 + - Enforced chdir("/") on chroot
56017 + - Runtime module disabling
56018 +
56019 +config GRKERNSEC_MEDIUM
56020 + bool "Medium"
56021 + select PAX
56022 + select PAX_EI_PAX
56023 + select PAX_PT_PAX_FLAGS
56024 + select PAX_HAVE_ACL_FLAGS
56025 + select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
56026 + select GRKERNSEC_CHROOT
56027 + select GRKERNSEC_CHROOT_SYSCTL
56028 + select GRKERNSEC_LINK
56029 + select GRKERNSEC_FIFO
56030 + select GRKERNSEC_DMESG
56031 + select GRKERNSEC_RANDNET
56032 + select GRKERNSEC_FORKFAIL
56033 + select GRKERNSEC_TIME
56034 + select GRKERNSEC_SIGNAL
56035 + select GRKERNSEC_CHROOT
56036 + select GRKERNSEC_CHROOT_UNIX
56037 + select GRKERNSEC_CHROOT_MOUNT
56038 + select GRKERNSEC_CHROOT_PIVOT
56039 + select GRKERNSEC_CHROOT_DOUBLE
56040 + select GRKERNSEC_CHROOT_CHDIR
56041 + select GRKERNSEC_CHROOT_MKNOD
56042 + select GRKERNSEC_PROC
56043 + select GRKERNSEC_PROC_USERGROUP
56044 + select PAX_RANDUSTACK
56045 + select PAX_ASLR
56046 + select PAX_RANDMMAP
56047 + select PAX_REFCOUNT if (X86 || SPARC64)
56048 + select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB))
56049 +
56050 + help
56051 + If you say Y here, several features in addition to those included
56052 + in the low additional security level will be enabled. These
56053 + features provide even more security to your system, though in rare
56054 + cases they may be incompatible with very old or poorly written
56055 + software. If you enable this option, make sure that your auth
56056 + service (identd) is running as gid 1001. With this option,
56057 + the following features (in addition to those provided in the
56058 + low additional security level) will be enabled:
56059 +
56060 + - Failed fork logging
56061 + - Time change logging
56062 + - Signal logging
56063 + - Deny mounts in chroot
56064 + - Deny double chrooting
56065 + - Deny sysctl writes in chroot
56066 + - Deny mknod in chroot
56067 + - Deny access to abstract AF_UNIX sockets out of chroot
56068 + - Deny pivot_root in chroot
56069 + - Denied writes of /dev/kmem, /dev/mem, and /dev/port
56070 + - /proc restrictions with special GID set to 10 (usually wheel)
56071 + - Address Space Layout Randomization (ASLR)
56072 + - Prevent exploitation of most refcount overflows
56073 + - Bounds checking of copying between the kernel and userland
56074 +
56075 +config GRKERNSEC_HIGH
56076 + bool "High"
56077 + select GRKERNSEC_LINK
56078 + select GRKERNSEC_FIFO
56079 + select GRKERNSEC_DMESG
56080 + select GRKERNSEC_FORKFAIL
56081 + select GRKERNSEC_TIME
56082 + select GRKERNSEC_SIGNAL
56083 + select GRKERNSEC_CHROOT
56084 + select GRKERNSEC_CHROOT_SHMAT
56085 + select GRKERNSEC_CHROOT_UNIX
56086 + select GRKERNSEC_CHROOT_MOUNT
56087 + select GRKERNSEC_CHROOT_FCHDIR
56088 + select GRKERNSEC_CHROOT_PIVOT
56089 + select GRKERNSEC_CHROOT_DOUBLE
56090 + select GRKERNSEC_CHROOT_CHDIR
56091 + select GRKERNSEC_CHROOT_MKNOD
56092 + select GRKERNSEC_CHROOT_CAPS
56093 + select GRKERNSEC_CHROOT_SYSCTL
56094 + select GRKERNSEC_CHROOT_FINDTASK
56095 + select GRKERNSEC_SYSFS_RESTRICT
56096 + select GRKERNSEC_PROC
56097 + select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
56098 + select GRKERNSEC_HIDESYM
56099 + select GRKERNSEC_BRUTE
56100 + select GRKERNSEC_PROC_USERGROUP
56101 + select GRKERNSEC_KMEM
56102 + select GRKERNSEC_RESLOG
56103 + select GRKERNSEC_RANDNET
56104 + select GRKERNSEC_PROC_ADD
56105 + select GRKERNSEC_CHROOT_CHMOD
56106 + select GRKERNSEC_CHROOT_NICE
56107 + select GRKERNSEC_AUDIT_MOUNT
56108 + select GRKERNSEC_MODHARDEN if (MODULES)
56109 + select GRKERNSEC_HARDEN_PTRACE
56110 + select GRKERNSEC_VM86 if (X86_32)
56111 + select GRKERNSEC_KERN_LOCKOUT if (X86 || ARM || PPC || SPARC)
56112 + select PAX
56113 + select PAX_RANDUSTACK
56114 + select PAX_ASLR
56115 + select PAX_RANDMMAP
56116 + select PAX_NOEXEC
56117 + select PAX_MPROTECT
56118 + select PAX_EI_PAX
56119 + select PAX_PT_PAX_FLAGS
56120 + select PAX_HAVE_ACL_FLAGS
56121 + select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
56122 + select PAX_MEMORY_UDEREF if (X86 && !XEN)
56123 + select PAX_RANDKSTACK if (X86_TSC && X86)
56124 + select PAX_SEGMEXEC if (X86_32)
56125 + select PAX_PAGEEXEC
56126 + select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
56127 + select PAX_EMUTRAMP if (PARISC)
56128 + select PAX_EMUSIGRT if (PARISC)
56129 + select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
56130 + select PAX_ELFRELOCS if (PAX_ETEXECRELOCS || (IA64 || PPC || X86))
56131 + select PAX_REFCOUNT if (X86 || SPARC64)
56132 + select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB))
56133 + help
56134 + If you say Y here, many of the features of grsecurity will be
56135 + enabled, which will protect you against many kinds of attacks
56136 + against your system. The heightened security comes at a cost
56137 + of an increased chance of incompatibilities with rare software
56138 + on your machine. Since this security level enables PaX, you should
56139 + view <http://pax.grsecurity.net> and read about the PaX
56140 + project. While you are there, download chpax and run it on
56141 + binaries that cause problems with PaX. Also remember that
56142 + since the /proc restrictions are enabled, you must run your
56143 + identd as gid 1001. This security level enables the following
56144 + features in addition to those listed in the low and medium
56145 + security levels:
56146 +
56147 + - Additional /proc restrictions
56148 + - Chmod restrictions in chroot
56149 + - No signals, ptrace, or viewing of processes outside of chroot
56150 + - Capability restrictions in chroot
56151 + - Deny fchdir out of chroot
56152 + - Priority restrictions in chroot
56153 + - Segmentation-based implementation of PaX
56154 + - Mprotect restrictions
56155 + - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
56156 + - Kernel stack randomization
56157 + - Mount/unmount/remount logging
56158 + - Kernel symbol hiding
56159 + - Prevention of memory exhaustion-based exploits
56160 + - Hardening of module auto-loading
56161 + - Ptrace restrictions
56162 + - Restricted vm86 mode
56163 + - Restricted sysfs/debugfs
56164 + - Active kernel exploit response
56165 +
56166 +config GRKERNSEC_CUSTOM
56167 + bool "Custom"
56168 + help
56169 + If you say Y here, you will be able to configure every grsecurity
56170 + option, which allows you to enable many more features that aren't
56171 + covered in the basic security levels. These additional features
56172 + include TPE, socket restrictions, and the sysctl system for
56173 + grsecurity. It is advised that you read through the help for
56174 + each option to determine its usefulness in your situation.
56175 +
56176 +endchoice
56177 +
56178 +menu "Address Space Protection"
56179 +depends on GRKERNSEC
56180 +
56181 +config GRKERNSEC_KMEM
56182 + bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
56183 + select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
56184 + help
56185 + If you say Y here, /dev/kmem and /dev/mem won't be allowed to
56186 + be written to via mmap or otherwise to modify the running kernel.
56187 + /dev/port will also not be allowed to be opened. If you have module
56188 + support disabled, enabling this will close up four ways that are
56189 + currently used to insert malicious code into the running kernel.
56190 + Even with all these features enabled, we still highly recommend that
56191 + you use the RBAC system, as it is still possible for an attacker to
56192 + modify the running kernel through privileged I/O granted by ioperm/iopl.
56193 + If you are not using XFree86, you may be able to stop this additional
56194 + case by enabling the 'Disable privileged I/O' option. Though nothing
56195 + legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
56196 + but only to video memory, which is the only writing we allow in this
56197 + case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
56198 + not be allowed to mprotect it with PROT_WRITE later.
56199 + It is highly recommended that you say Y here if you meet all the
56200 + conditions above.
56201 +
56202 +config GRKERNSEC_VM86
56203 + bool "Restrict VM86 mode"
56204 + depends on X86_32
56205 +
56206 + help
56207 + If you say Y here, only processes with CAP_SYS_RAWIO will be able to
56208 + make use of a special execution mode on 32bit x86 processors called
56209 + Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
56210 + video cards and will still work with this option enabled. The purpose
56211 + of the option is to prevent exploitation of emulation errors in
56212 + virtualization of vm86 mode like the one discovered in VMWare in 2009.
56213 + Nearly all users should be able to enable this option.
56214 +
56215 +config GRKERNSEC_IO
56216 + bool "Disable privileged I/O"
56217 + depends on X86
56218 + select RTC_CLASS
56219 + select RTC_INTF_DEV
56220 + select RTC_DRV_CMOS
56221 +
56222 + help
56223 + If you say Y here, all ioperm and iopl calls will return an error.
56224 + Ioperm and iopl can be used to modify the running kernel.
56225 + Unfortunately, some programs need this access to operate properly,
56226 + the most notable of which are XFree86 and hwclock. hwclock can be
56227 + remedied by having RTC support in the kernel, so real-time
56228 + clock support is enabled if this option is enabled, to ensure
56229 + that hwclock operates correctly. XFree86 still will not
56230 + operate correctly with this option enabled, so DO NOT CHOOSE Y
56231 + IF YOU USE XFree86. If you use XFree86 and you still want to
56232 + protect your kernel against modification, use the RBAC system.
56233 +
56234 +config GRKERNSEC_PROC_MEMMAP
56235 + bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
56236 + default y if (PAX_NOEXEC || PAX_ASLR)
56237 + depends on PAX_NOEXEC || PAX_ASLR
56238 + help
56239 + If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
56240 + give no information about the addresses of its mappings if
56241 + PaX features that rely on random addresses are enabled on the task.
56242 + If you use PaX it is greatly recommended that you say Y here as it
56243 + closes up a hole that makes the full ASLR useless for suid
56244 + binaries.
56245 +
56246 +config GRKERNSEC_BRUTE
56247 + bool "Deter exploit bruteforcing"
56248 + help
56249 + If you say Y here, attempts to bruteforce exploits against forking
56250 + daemons such as apache or sshd, as well as against suid/sgid binaries
56251 + will be deterred. When a child of a forking daemon is killed by PaX
56252 + or crashes due to an illegal instruction or other suspicious signal,
56253 + the parent process will be delayed 30 seconds upon every subsequent
56254 + fork until the administrator is able to assess the situation and
56255 + restart the daemon.
56256 + In the suid/sgid case, the attempt is logged, the user has all their
56257 + processes terminated, and they are prevented from executing any further
56258 + processes for 15 minutes.
56259 + It is recommended that you also enable signal logging in the auditing
56260 + section so that logs are generated when a process triggers a suspicious
56261 + signal.
56262 + If the sysctl option is enabled, a sysctl option with name
56263 + "deter_bruteforce" is created.
56264 +
56265 +
56266 +config GRKERNSEC_MODHARDEN
56267 + bool "Harden module auto-loading"
56268 + depends on MODULES
56269 + help
56270 + If you say Y here, module auto-loading in response to use of some
56271 + feature implemented by an unloaded module will be restricted to
56272 + root users. Enabling this option helps defend against attacks
56273 + by unprivileged users who abuse the auto-loading behavior to
56274 + cause a vulnerable module to load that is then exploited.
56275 +
56276 + If this option prevents a legitimate use of auto-loading for a
56277 + non-root user, the administrator can execute modprobe manually
56278 + with the exact name of the module mentioned in the alert log.
56279 + Alternatively, the administrator can add the module to the list
56280 + of modules loaded at boot by modifying init scripts.
56281 +
56282 + Modification of init scripts will most likely be needed on
56283 + Ubuntu servers with encrypted home directory support enabled,
56284 + as the first non-root user logging in will cause the ecb(aes),
56285 + ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
56286 +
56287 +config GRKERNSEC_HIDESYM
56288 + bool "Hide kernel symbols"
56289 + help
56290 + If you say Y here, getting information on loaded modules, and
56291 + displaying all kernel symbols through a syscall will be restricted
56292 + to users with CAP_SYS_MODULE. For software compatibility reasons,
56293 + /proc/kallsyms will be restricted to the root user. The RBAC
56294 + system can hide that entry even from root.
56295 +
56296 + This option also prevents leaking of kernel addresses through
56297 + several /proc entries.
56298 +
56299 + Note that this option is only effective provided the following
56300 + conditions are met:
56301 + 1) The kernel using grsecurity is not precompiled by some distribution
56302 + 2) You have also enabled GRKERNSEC_DMESG
56303 + 3) You are using the RBAC system and hiding other files such as your
56304 + kernel image and System.map. Alternatively, enabling this option
56305 + causes the permissions on /boot, /lib/modules, and the kernel
56306 + source directory to change at compile time to prevent
56307 + reading by non-root users.
56308 + If the above conditions are met, this option will aid in providing a
56309 + useful protection against local kernel exploitation of overflows
56310 + and arbitrary read/write vulnerabilities.
56311 +
56312 +config GRKERNSEC_KERN_LOCKOUT
56313 + bool "Active kernel exploit response"
56314 + depends on X86 || ARM || PPC || SPARC
56315 + help
56316 + If you say Y here, when a PaX alert is triggered due to suspicious
56317 + activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
56318 + or an OOPs occurs due to bad memory accesses, instead of just
56319 + terminating the offending process (and potentially allowing
56320 + a subsequent exploit from the same user), we will take one of two
56321 + actions:
56322 + If the user was root, we will panic the system
56323 + If the user was non-root, we will log the attempt, terminate
56324 + all processes owned by the user, then prevent them from creating
56325 + any new processes until the system is restarted
56326 + This deters repeated kernel exploitation/bruteforcing attempts
56327 + and is useful for later forensics.
56328 +
56329 +endmenu
56330 +menu "Role Based Access Control Options"
56331 +depends on GRKERNSEC
56332 +
56333 +config GRKERNSEC_RBAC_DEBUG
56334 + bool
56335 +
56336 +config GRKERNSEC_NO_RBAC
56337 + bool "Disable RBAC system"
56338 + help
56339 + If you say Y here, the /dev/grsec device will be removed from the kernel,
56340 + preventing the RBAC system from being enabled. You should only say Y
56341 + here if you have no intention of using the RBAC system, so as to prevent
56342 + an attacker with root access from misusing the RBAC system to hide files
56343 + and processes when loadable module support and /dev/[k]mem have been
56344 + locked down.
56345 +
56346 +config GRKERNSEC_ACL_HIDEKERN
56347 + bool "Hide kernel processes"
56348 + help
56349 + If you say Y here, all kernel threads will be hidden to all
56350 + processes but those whose subject has the "view hidden processes"
56351 + flag.
56352 +
56353 +config GRKERNSEC_ACL_MAXTRIES
56354 + int "Maximum tries before password lockout"
56355 + default 3
56356 + help
56357 + This option enforces the maximum number of times a user can attempt
56358 + to authorize themselves with the grsecurity RBAC system before being
56359 + denied the ability to attempt authorization again for a specified time.
56360 + The lower the number, the harder it will be to brute-force a password.
56361 +
56362 +config GRKERNSEC_ACL_TIMEOUT
56363 + int "Time to wait after max password tries, in seconds"
56364 + default 30
56365 + help
56366 + This option specifies the time the user must wait after attempting to
56367 + authorize to the RBAC system with the maximum number of invalid
56368 + passwords. The higher the number, the harder it will be to brute-force
56369 + a password.
56370 +
56371 +endmenu
56372 +menu "Filesystem Protections"
56373 +depends on GRKERNSEC
56374 +
56375 +config GRKERNSEC_PROC
56376 + bool "Proc restrictions"
56377 + help
56378 + If you say Y here, the permissions of the /proc filesystem
56379 + will be altered to enhance system security and privacy. You MUST
56380 + choose either a user only restriction or a user and group restriction.
56381 + Depending upon the option you choose, you can either restrict users to
56382 + see only the processes they themselves run, or choose a group that can
56383 + view all processes and files normally restricted to root if you choose
56384 + the "restrict to user only" option. NOTE: If you're running identd as
56385 + a non-root user, you will have to run it as the group you specify here.
56386 +
56387 +config GRKERNSEC_PROC_USER
56388 + bool "Restrict /proc to user only"
56389 + depends on GRKERNSEC_PROC
56390 + help
56391 + If you say Y here, non-root users will only be able to view their own
56392 + processes, and restricts them from viewing network-related information,
56393 + and viewing kernel symbol and module information.
56394 +
56395 +config GRKERNSEC_PROC_USERGROUP
56396 + bool "Allow special group"
56397 + depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
56398 + help
56399 + If you say Y here, you will be able to select a group that will be
56400 + able to view all processes and network-related information. If you've
56401 + enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
56402 + remain hidden. This option is useful if you want to run identd as
56403 + a non-root user.
56404 +
56405 +config GRKERNSEC_PROC_GID
56406 + int "GID for special group"
56407 + depends on GRKERNSEC_PROC_USERGROUP
56408 + default 1001
56409 +
56410 +config GRKERNSEC_PROC_ADD
56411 + bool "Additional restrictions"
56412 + depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
56413 + help
56414 + If you say Y here, additional restrictions will be placed on
56415 + /proc that keep normal users from viewing device information and
56416 + slabinfo information that could be useful for exploits.
56417 +
56418 +config GRKERNSEC_LINK
56419 + bool "Linking restrictions"
56420 + help
56421 + If you say Y here, /tmp race exploits will be prevented, since users
56422 + will no longer be able to follow symlinks owned by other users in
56423 + world-writable +t directories (e.g. /tmp), unless the owner of the
56424 + symlink is the owner of the directory. users will also not be
56425 + able to hardlink to files they do not own. If the sysctl option is
56426 + enabled, a sysctl option with name "linking_restrictions" is created.
56427 +
56428 +config GRKERNSEC_FIFO
56429 + bool "FIFO restrictions"
56430 + help
56431 + If you say Y here, users will not be able to write to FIFOs they don't
56432 + own in world-writable +t directories (e.g. /tmp), unless the owner of
56433 + the FIFO is the same owner of the directory it's held in. If the sysctl
56434 + option is enabled, a sysctl option with name "fifo_restrictions" is
56435 + created.
56436 +
56437 +config GRKERNSEC_SYSFS_RESTRICT
56438 + bool "Sysfs/debugfs restriction"
56439 + depends on SYSFS
56440 + help
56441 + If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
56442 + any filesystem normally mounted under it (e.g. debugfs) will only
56443 + be accessible by root. These filesystems generally provide access
56444 + to hardware and debug information that isn't appropriate for unprivileged
56445 + users of the system. Sysfs and debugfs have also become a large source
56446 + of new vulnerabilities, ranging from infoleaks to local compromise.
56447 + There has been very little oversight with an eye toward security involved
56448 + in adding new exporters of information to these filesystems, so their
56449 + use is discouraged.
56450 + This option is equivalent to a chmod 0700 of the mount paths.
56451 +
56452 +config GRKERNSEC_ROFS
56453 + bool "Runtime read-only mount protection"
56454 + help
56455 + If you say Y here, a sysctl option with name "romount_protect" will
56456 + be created. By setting this option to 1 at runtime, filesystems
56457 + will be protected in the following ways:
56458 + * No new writable mounts will be allowed
56459 + * Existing read-only mounts won't be able to be remounted read/write
56460 + * Write operations will be denied on all block devices
56461 + This option acts independently of grsec_lock: once it is set to 1,
56462 + it cannot be turned off. Therefore, please be mindful of the resulting
56463 + behavior if this option is enabled in an init script on a read-only
56464 + filesystem. This feature is mainly intended for secure embedded systems.
56465 +
56466 +config GRKERNSEC_CHROOT
56467 + bool "Chroot jail restrictions"
56468 + help
56469 + If you say Y here, you will be able to choose several options that will
56470 + make breaking out of a chrooted jail much more difficult. If you
56471 + encounter no software incompatibilities with the following options, it
56472 + is recommended that you enable each one.
56473 +
56474 +config GRKERNSEC_CHROOT_MOUNT
56475 + bool "Deny mounts"
56476 + depends on GRKERNSEC_CHROOT
56477 + help
56478 + If you say Y here, processes inside a chroot will not be able to
56479 + mount or remount filesystems. If the sysctl option is enabled, a
56480 + sysctl option with name "chroot_deny_mount" is created.
56481 +
56482 +config GRKERNSEC_CHROOT_DOUBLE
56483 + bool "Deny double-chroots"
56484 + depends on GRKERNSEC_CHROOT
56485 + help
56486 + If you say Y here, processes inside a chroot will not be able to chroot
56487 + again outside the chroot. This is a widely used method of breaking
56488 + out of a chroot jail and should not be allowed. If the sysctl
56489 + option is enabled, a sysctl option with name
56490 + "chroot_deny_chroot" is created.
56491 +
56492 +config GRKERNSEC_CHROOT_PIVOT
56493 + bool "Deny pivot_root in chroot"
56494 + depends on GRKERNSEC_CHROOT
56495 + help
56496 + If you say Y here, processes inside a chroot will not be able to use
56497 + a function called pivot_root() that was introduced in Linux 2.3.41. It
56498 + works similar to chroot in that it changes the root filesystem. This
56499 + function could be misused in a chrooted process to attempt to break out
56500 + of the chroot, and therefore should not be allowed. If the sysctl
56501 + option is enabled, a sysctl option with name "chroot_deny_pivot" is
56502 + created.
56503 +
56504 +config GRKERNSEC_CHROOT_CHDIR
56505 + bool "Enforce chdir(\"/\") on all chroots"
56506 + depends on GRKERNSEC_CHROOT
56507 + help
56508 + If you say Y here, the current working directory of all newly-chrooted
56509 + applications will be set to the the root directory of the chroot.
56510 + The man page on chroot(2) states:
56511 + Note that this call does not change the current working
56512 + directory, so that `.' can be outside the tree rooted at
56513 + `/'. In particular, the super-user can escape from a
56514 + `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
56515 +
56516 + It is recommended that you say Y here, since it's not known to break
56517 + any software. If the sysctl option is enabled, a sysctl option with
56518 + name "chroot_enforce_chdir" is created.
56519 +
56520 +config GRKERNSEC_CHROOT_CHMOD
56521 + bool "Deny (f)chmod +s"
56522 + depends on GRKERNSEC_CHROOT
56523 + help
56524 + If you say Y here, processes inside a chroot will not be able to chmod
56525 + or fchmod files to make them have suid or sgid bits. This protects
56526 + against another published method of breaking a chroot. If the sysctl
56527 + option is enabled, a sysctl option with name "chroot_deny_chmod" is
56528 + created.
56529 +
56530 +config GRKERNSEC_CHROOT_FCHDIR
56531 + bool "Deny fchdir out of chroot"
56532 + depends on GRKERNSEC_CHROOT
56533 + help
56534 + If you say Y here, a well-known method of breaking chroots by fchdir'ing
56535 + to a file descriptor of the chrooting process that points to a directory
56536 + outside the filesystem will be stopped. If the sysctl option
56537 + is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
56538 +
56539 +config GRKERNSEC_CHROOT_MKNOD
56540 + bool "Deny mknod"
56541 + depends on GRKERNSEC_CHROOT
56542 + help
56543 + If you say Y here, processes inside a chroot will not be allowed to
56544 + mknod. The problem with using mknod inside a chroot is that it
56545 + would allow an attacker to create a device entry that is the same
56546 + as one on the physical root of your system, which could range from
56547 + anything from the console device to a device for your harddrive (which
56548 + they could then use to wipe the drive or steal data). It is recommended
56549 + that you say Y here, unless you run into software incompatibilities.
56550 + If the sysctl option is enabled, a sysctl option with name
56551 + "chroot_deny_mknod" is created.
56552 +
56553 +config GRKERNSEC_CHROOT_SHMAT
56554 + bool "Deny shmat() out of chroot"
56555 + depends on GRKERNSEC_CHROOT
56556 + help
56557 + If you say Y here, processes inside a chroot will not be able to attach
56558 + to shared memory segments that were created outside of the chroot jail.
56559 + It is recommended that you say Y here. If the sysctl option is enabled,
56560 + a sysctl option with name "chroot_deny_shmat" is created.
56561 +
56562 +config GRKERNSEC_CHROOT_UNIX
56563 + bool "Deny access to abstract AF_UNIX sockets out of chroot"
56564 + depends on GRKERNSEC_CHROOT
56565 + help
56566 + If you say Y here, processes inside a chroot will not be able to
56567 + connect to abstract (meaning not belonging to a filesystem) Unix
56568 + domain sockets that were bound outside of a chroot. It is recommended
56569 + that you say Y here. If the sysctl option is enabled, a sysctl option
56570 + with name "chroot_deny_unix" is created.
56571 +
56572 +config GRKERNSEC_CHROOT_FINDTASK
56573 + bool "Protect outside processes"
56574 + depends on GRKERNSEC_CHROOT
56575 + help
56576 + If you say Y here, processes inside a chroot will not be able to
56577 + kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
56578 + getsid, or view any process outside of the chroot. If the sysctl
56579 + option is enabled, a sysctl option with name "chroot_findtask" is
56580 + created.
56581 +
56582 +config GRKERNSEC_CHROOT_NICE
56583 + bool "Restrict priority changes"
56584 + depends on GRKERNSEC_CHROOT
56585 + help
56586 + If you say Y here, processes inside a chroot will not be able to raise
56587 + the priority of processes in the chroot, or alter the priority of
56588 + processes outside the chroot. This provides more security than simply
56589 + removing CAP_SYS_NICE from the process' capability set. If the
56590 + sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
56591 + is created.
56592 +
56593 +config GRKERNSEC_CHROOT_SYSCTL
56594 + bool "Deny sysctl writes"
56595 + depends on GRKERNSEC_CHROOT
56596 + help
56597 + If you say Y here, an attacker in a chroot will not be able to
56598 + write to sysctl entries, either by sysctl(2) or through a /proc
56599 + interface. It is strongly recommended that you say Y here. If the
56600 + sysctl option is enabled, a sysctl option with name
56601 + "chroot_deny_sysctl" is created.
56602 +
56603 +config GRKERNSEC_CHROOT_CAPS
56604 + bool "Capability restrictions"
56605 + depends on GRKERNSEC_CHROOT
56606 + help
56607 + If you say Y here, the capabilities on all processes within a
56608 + chroot jail will be lowered to stop module insertion, raw i/o,
56609 + system and net admin tasks, rebooting the system, modifying immutable
56610 + files, modifying IPC owned by another, and changing the system time.
56611 + This is left an option because it can break some apps. Disable this
56612 + if your chrooted apps are having problems performing those kinds of
56613 + tasks. If the sysctl option is enabled, a sysctl option with
56614 + name "chroot_caps" is created.
56615 +
56616 +endmenu
56617 +menu "Kernel Auditing"
56618 +depends on GRKERNSEC
56619 +
56620 +config GRKERNSEC_AUDIT_GROUP
56621 + bool "Single group for auditing"
56622 + help
56623 + If you say Y here, the exec, chdir, and (un)mount logging features
56624 + will only operate on a group you specify. This option is recommended
56625 + if you only want to watch certain users instead of having a large
56626 + amount of logs from the entire system. If the sysctl option is enabled,
56627 + a sysctl option with name "audit_group" is created.
56628 +
56629 +config GRKERNSEC_AUDIT_GID
56630 + int "GID for auditing"
56631 + depends on GRKERNSEC_AUDIT_GROUP
56632 + default 1007
56633 +
56634 +config GRKERNSEC_EXECLOG
56635 + bool "Exec logging"
56636 + help
56637 + If you say Y here, all execve() calls will be logged (since the
56638 + other exec*() calls are frontends to execve(), all execution
56639 + will be logged). Useful for shell-servers that like to keep track
56640 + of their users. If the sysctl option is enabled, a sysctl option with
56641 + name "exec_logging" is created.
56642 + WARNING: This option when enabled will produce a LOT of logs, especially
56643 + on an active system.
56644 +
56645 +config GRKERNSEC_RESLOG
56646 + bool "Resource logging"
56647 + help
56648 + If you say Y here, all attempts to overstep resource limits will
56649 + be logged with the resource name, the requested size, and the current
56650 + limit. It is highly recommended that you say Y here. If the sysctl
56651 + option is enabled, a sysctl option with name "resource_logging" is
56652 + created. If the RBAC system is enabled, the sysctl value is ignored.
56653 +
56654 +config GRKERNSEC_CHROOT_EXECLOG
56655 + bool "Log execs within chroot"
56656 + help
56657 + If you say Y here, all executions inside a chroot jail will be logged
56658 + to syslog. This can cause a large amount of logs if certain
56659 + applications (eg. djb's daemontools) are installed on the system, and
56660 + is therefore left as an option. If the sysctl option is enabled, a
56661 + sysctl option with name "chroot_execlog" is created.
56662 +
56663 +config GRKERNSEC_AUDIT_PTRACE
56664 + bool "Ptrace logging"
56665 + help
56666 + If you say Y here, all attempts to attach to a process via ptrace
56667 + will be logged. If the sysctl option is enabled, a sysctl option
56668 + with name "audit_ptrace" is created.
56669 +
56670 +config GRKERNSEC_AUDIT_CHDIR
56671 + bool "Chdir logging"
56672 + help
56673 + If you say Y here, all chdir() calls will be logged. If the sysctl
56674 + option is enabled, a sysctl option with name "audit_chdir" is created.
56675 +
56676 +config GRKERNSEC_AUDIT_MOUNT
56677 + bool "(Un)Mount logging"
56678 + help
56679 + If you say Y here, all mounts and unmounts will be logged. If the
56680 + sysctl option is enabled, a sysctl option with name "audit_mount" is
56681 + created.
56682 +
56683 +config GRKERNSEC_SIGNAL
56684 + bool "Signal logging"
56685 + help
56686 + If you say Y here, certain important signals will be logged, such as
56687 + SIGSEGV, which will as a result inform you of when a error in a program
56688 + occurred, which in some cases could mean a possible exploit attempt.
56689 + If the sysctl option is enabled, a sysctl option with name
56690 + "signal_logging" is created.
56691 +
56692 +config GRKERNSEC_FORKFAIL
56693 + bool "Fork failure logging"
56694 + help
56695 + If you say Y here, all failed fork() attempts will be logged.
56696 + This could suggest a fork bomb, or someone attempting to overstep
56697 + their process limit. If the sysctl option is enabled, a sysctl option
56698 + with name "forkfail_logging" is created.
56699 +
56700 +config GRKERNSEC_TIME
56701 + bool "Time change logging"
56702 + help
56703 + If you say Y here, any changes of the system clock will be logged.
56704 + If the sysctl option is enabled, a sysctl option with name
56705 + "timechange_logging" is created.
56706 +
56707 +config GRKERNSEC_PROC_IPADDR
56708 + bool "/proc/<pid>/ipaddr support"
56709 + help
56710 + If you say Y here, a new entry will be added to each /proc/<pid>
56711 + directory that contains the IP address of the person using the task.
56712 + The IP is carried across local TCP and AF_UNIX stream sockets.
56713 + This information can be useful for IDS/IPSes to perform remote response
56714 + to a local attack. The entry is readable by only the owner of the
56715 + process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
56716 + the RBAC system), and thus does not create privacy concerns.
56717 +
56718 +config GRKERNSEC_RWXMAP_LOG
56719 + bool 'Denied RWX mmap/mprotect logging'
56720 + depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
56721 + help
56722 + If you say Y here, calls to mmap() and mprotect() with explicit
56723 + usage of PROT_WRITE and PROT_EXEC together will be logged when
56724 + denied by the PAX_MPROTECT feature. If the sysctl option is
56725 + enabled, a sysctl option with name "rwxmap_logging" is created.
56726 +
56727 +config GRKERNSEC_AUDIT_TEXTREL
56728 + bool 'ELF text relocations logging (READ HELP)'
56729 + depends on PAX_MPROTECT
56730 + help
56731 + If you say Y here, text relocations will be logged with the filename
56732 + of the offending library or binary. The purpose of the feature is
56733 + to help Linux distribution developers get rid of libraries and
56734 + binaries that need text relocations which hinder the future progress
56735 + of PaX. Only Linux distribution developers should say Y here, and
56736 + never on a production machine, as this option creates an information
56737 + leak that could aid an attacker in defeating the randomization of
56738 + a single memory region. If the sysctl option is enabled, a sysctl
56739 + option with name "audit_textrel" is created.
56740 +
56741 +endmenu
56742 +
56743 +menu "Executable Protections"
56744 +depends on GRKERNSEC
56745 +
56746 +config GRKERNSEC_DMESG
56747 + bool "Dmesg(8) restriction"
56748 + help
56749 + If you say Y here, non-root users will not be able to use dmesg(8)
56750 + to view up to the last 4kb of messages in the kernel's log buffer.
56751 + The kernel's log buffer often contains kernel addresses and other
56752 + identifying information useful to an attacker in fingerprinting a
56753 + system for a targeted exploit.
56754 + If the sysctl option is enabled, a sysctl option with name "dmesg" is
56755 + created.
56756 +
56757 +config GRKERNSEC_HARDEN_PTRACE
56758 + bool "Deter ptrace-based process snooping"
56759 + help
56760 + If you say Y here, TTY sniffers and other malicious monitoring
56761 + programs implemented through ptrace will be defeated. If you
56762 + have been using the RBAC system, this option has already been
56763 + enabled for several years for all users, with the ability to make
56764 + fine-grained exceptions.
56765 +
56766 + This option only affects the ability of non-root users to ptrace
56767 + processes that are not a descendent of the ptracing process.
56768 + This means that strace ./binary and gdb ./binary will still work,
56769 + but attaching to arbitrary processes will not. If the sysctl
56770 + option is enabled, a sysctl option with name "harden_ptrace" is
56771 + created.
56772 +
56773 +config GRKERNSEC_TPE
56774 + bool "Trusted Path Execution (TPE)"
56775 + help
56776 + If you say Y here, you will be able to choose a gid to add to the
56777 + supplementary groups of users you want to mark as "untrusted."
56778 + These users will not be able to execute any files that are not in
56779 + root-owned directories writable only by root. If the sysctl option
56780 + is enabled, a sysctl option with name "tpe" is created.
56781 +
56782 +config GRKERNSEC_TPE_ALL
56783 + bool "Partially restrict all non-root users"
56784 + depends on GRKERNSEC_TPE
56785 + help
56786 + If you say Y here, all non-root users will be covered under
56787 + a weaker TPE restriction. This is separate from, and in addition to,
56788 + the main TPE options that you have selected elsewhere. Thus, if a
56789 + "trusted" GID is chosen, this restriction applies to even that GID.
56790 + Under this restriction, all non-root users will only be allowed to
56791 + execute files in directories they own that are not group or
56792 + world-writable, or in directories owned by root and writable only by
56793 + root. If the sysctl option is enabled, a sysctl option with name
56794 + "tpe_restrict_all" is created.
56795 +
56796 +config GRKERNSEC_TPE_INVERT
56797 + bool "Invert GID option"
56798 + depends on GRKERNSEC_TPE
56799 + help
56800 + If you say Y here, the group you specify in the TPE configuration will
56801 + decide what group TPE restrictions will be *disabled* for. This
56802 + option is useful if you want TPE restrictions to be applied to most
56803 + users on the system. If the sysctl option is enabled, a sysctl option
56804 + with name "tpe_invert" is created. Unlike other sysctl options, this
56805 + entry will default to on for backward-compatibility.
56806 +
56807 +config GRKERNSEC_TPE_GID
56808 + int "GID for untrusted users"
56809 + depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
56810 + default 1005
56811 + help
56812 + Setting this GID determines what group TPE restrictions will be
56813 + *enabled* for. If the sysctl option is enabled, a sysctl option
56814 + with name "tpe_gid" is created.
56815 +
56816 +config GRKERNSEC_TPE_GID
56817 + int "GID for trusted users"
56818 + depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
56819 + default 1005
56820 + help
56821 + Setting this GID determines what group TPE restrictions will be
56822 + *disabled* for. If the sysctl option is enabled, a sysctl option
56823 + with name "tpe_gid" is created.
56824 +
56825 +endmenu
56826 +menu "Network Protections"
56827 +depends on GRKERNSEC
56828 +
56829 +config GRKERNSEC_RANDNET
56830 + bool "Larger entropy pools"
56831 + help
56832 + If you say Y here, the entropy pools used for many features of Linux
56833 + and grsecurity will be doubled in size. Since several grsecurity
56834 + features use additional randomness, it is recommended that you say Y
56835 + here. Saying Y here has a similar effect as modifying
56836 + /proc/sys/kernel/random/poolsize.
56837 +
56838 +config GRKERNSEC_BLACKHOLE
56839 + bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
56840 + depends on NET
56841 + help
56842 + If you say Y here, neither TCP resets nor ICMP
56843 + destination-unreachable packets will be sent in response to packets
56844 + sent to ports for which no associated listening process exists.
56845 + This feature supports both IPV4 and IPV6 and exempts the
56846 + loopback interface from blackholing. Enabling this feature
56847 + makes a host more resilient to DoS attacks and reduces network
56848 + visibility against scanners.
56849 +
56850 + The blackhole feature as-implemented is equivalent to the FreeBSD
56851 + blackhole feature, as it prevents RST responses to all packets, not
56852 + just SYNs. Under most application behavior this causes no
56853 + problems, but applications (like haproxy) may not close certain
56854 + connections in a way that cleanly terminates them on the remote
56855 + end, leaving the remote host in LAST_ACK state. Because of this
56856 + side-effect and to prevent intentional LAST_ACK DoSes, this
56857 + feature also adds automatic mitigation against such attacks.
56858 + The mitigation drastically reduces the amount of time a socket
56859 + can spend in LAST_ACK state. If you're using haproxy and not
56860 + all servers it connects to have this option enabled, consider
56861 + disabling this feature on the haproxy host.
56862 +
56863 + If the sysctl option is enabled, two sysctl options with names
56864 + "ip_blackhole" and "lastack_retries" will be created.
56865 + While "ip_blackhole" takes the standard zero/non-zero on/off
56866 + toggle, "lastack_retries" uses the same kinds of values as
56867 + "tcp_retries1" and "tcp_retries2". The default value of 4
56868 + prevents a socket from lasting more than 45 seconds in LAST_ACK
56869 + state.
56870 +
56871 +config GRKERNSEC_SOCKET
56872 + bool "Socket restrictions"
56873 + depends on NET
56874 + help
56875 + If you say Y here, you will be able to choose from several options.
56876 + If you assign a GID on your system and add it to the supplementary
56877 + groups of users you want to restrict socket access to, this patch
56878 + will perform up to three things, based on the option(s) you choose.
56879 +
56880 +config GRKERNSEC_SOCKET_ALL
56881 + bool "Deny any sockets to group"
56882 + depends on GRKERNSEC_SOCKET
56883 + help
56884 + If you say Y here, you will be able to choose a GID of whose users will
56885 + be unable to connect to other hosts from your machine or run server
56886 + applications from your machine. If the sysctl option is enabled, a
56887 + sysctl option with name "socket_all" is created.
56888 +
56889 +config GRKERNSEC_SOCKET_ALL_GID
56890 + int "GID to deny all sockets for"
56891 + depends on GRKERNSEC_SOCKET_ALL
56892 + default 1004
56893 + help
56894 + Here you can choose the GID to disable socket access for. Remember to
56895 + add the users you want socket access disabled for to the GID
56896 + specified here. If the sysctl option is enabled, a sysctl option
56897 + with name "socket_all_gid" is created.
56898 +
56899 +config GRKERNSEC_SOCKET_CLIENT
56900 + bool "Deny client sockets to group"
56901 + depends on GRKERNSEC_SOCKET
56902 + help
56903 + If you say Y here, you will be able to choose a GID of whose users will
56904 + be unable to connect to other hosts from your machine, but will be
56905 + able to run servers. If this option is enabled, all users in the group
56906 + you specify will have to use passive mode when initiating ftp transfers
56907 + from the shell on your machine. If the sysctl option is enabled, a
56908 + sysctl option with name "socket_client" is created.
56909 +
56910 +config GRKERNSEC_SOCKET_CLIENT_GID
56911 + int "GID to deny client sockets for"
56912 + depends on GRKERNSEC_SOCKET_CLIENT
56913 + default 1003
56914 + help
56915 + Here you can choose the GID to disable client socket access for.
56916 + Remember to add the users you want client socket access disabled for to
56917 + the GID specified here. If the sysctl option is enabled, a sysctl
56918 + option with name "socket_client_gid" is created.
56919 +
56920 +config GRKERNSEC_SOCKET_SERVER
56921 + bool "Deny server sockets to group"
56922 + depends on GRKERNSEC_SOCKET
56923 + help
56924 + If you say Y here, you will be able to choose a GID of whose users will
56925 + be unable to run server applications from your machine. If the sysctl
56926 + option is enabled, a sysctl option with name "socket_server" is created.
56927 +
56928 +config GRKERNSEC_SOCKET_SERVER_GID
56929 + int "GID to deny server sockets for"
56930 + depends on GRKERNSEC_SOCKET_SERVER
56931 + default 1002
56932 + help
56933 + Here you can choose the GID to disable server socket access for.
56934 + Remember to add the users you want server socket access disabled for to
56935 + the GID specified here. If the sysctl option is enabled, a sysctl
56936 + option with name "socket_server_gid" is created.
56937 +
56938 +endmenu
56939 +menu "Sysctl support"
56940 +depends on GRKERNSEC && SYSCTL
56941 +
56942 +config GRKERNSEC_SYSCTL
56943 + bool "Sysctl support"
56944 + help
56945 + If you say Y here, you will be able to change the options that
56946 + grsecurity runs with at bootup, without having to recompile your
56947 + kernel. You can echo values to files in /proc/sys/kernel/grsecurity
56948 + to enable (1) or disable (0) various features. All the sysctl entries
56949 + are mutable until the "grsec_lock" entry is set to a non-zero value.
56950 + All features enabled in the kernel configuration are disabled at boot
56951 + if you do not say Y to the "Turn on features by default" option.
56952 + All options should be set at startup, and the grsec_lock entry should
56953 + be set to a non-zero value after all the options are set.
56954 + *THIS IS EXTREMELY IMPORTANT*
56955 +
56956 +config GRKERNSEC_SYSCTL_DISTRO
56957 + bool "Extra sysctl support for distro makers (READ HELP)"
56958 + depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
56959 + help
56960 + If you say Y here, additional sysctl options will be created
56961 + for features that affect processes running as root. Therefore,
56962 + it is critical when using this option that the grsec_lock entry be
56963 + enabled after boot. Only distros with prebuilt kernel packages
56964 + with this option enabled that can ensure grsec_lock is enabled
56965 + after boot should use this option.
56966 + *Failure to set grsec_lock after boot makes all grsec features
56967 + this option covers useless*
56968 +
56969 + Currently this option creates the following sysctl entries:
56970 + "Disable Privileged I/O": "disable_priv_io"
56971 +
56972 +config GRKERNSEC_SYSCTL_ON
56973 + bool "Turn on features by default"
56974 + depends on GRKERNSEC_SYSCTL
56975 + help
56976 + If you say Y here, instead of having all features enabled in the
56977 + kernel configuration disabled at boot time, the features will be
56978 + enabled at boot time. It is recommended you say Y here unless
56979 + there is some reason you would want all sysctl-tunable features to
56980 + be disabled by default. As mentioned elsewhere, it is important
56981 + to enable the grsec_lock entry once you have finished modifying
56982 + the sysctl entries.
56983 +
56984 +endmenu
56985 +menu "Logging Options"
56986 +depends on GRKERNSEC
56987 +
56988 +config GRKERNSEC_FLOODTIME
56989 + int "Seconds in between log messages (minimum)"
56990 + default 10
56991 + help
56992 + This option allows you to enforce the number of seconds between
56993 + grsecurity log messages. The default should be suitable for most
56994 + people, however, if you choose to change it, choose a value small enough
56995 + to allow informative logs to be produced, but large enough to
56996 + prevent flooding.
56997 +
56998 +config GRKERNSEC_FLOODBURST
56999 + int "Number of messages in a burst (maximum)"
57000 + default 6
57001 + help
57002 + This option allows you to choose the maximum number of messages allowed
57003 + within the flood time interval you chose in a separate option. The
57004 + default should be suitable for most people, however if you find that
57005 + many of your logs are being interpreted as flooding, you may want to
57006 + raise this value.
57007 +
57008 +endmenu
57009 +
57010 +endmenu
57011 diff -urNp linux-3.0.8/grsecurity/Makefile linux-3.0.8/grsecurity/Makefile
57012 --- linux-3.0.8/grsecurity/Makefile 1969-12-31 19:00:00.000000000 -0500
57013 +++ linux-3.0.8/grsecurity/Makefile 2011-10-17 06:45:43.000000000 -0400
57014 @@ -0,0 +1,36 @@
57015 +# grsecurity's ACL system was originally written in 2001 by Michael Dalton
57016 +# during 2001-2009 it has been completely redesigned by Brad Spengler
57017 +# into an RBAC system
57018 +#
57019 +# All code in this directory and various hooks inserted throughout the kernel
57020 +# are copyright Brad Spengler - Open Source Security, Inc., and released
57021 +# under the GPL v2 or higher
57022 +
57023 +obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
57024 + grsec_mount.o grsec_sig.o grsec_sysctl.o \
57025 + grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
57026 +
57027 +obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
57028 + gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
57029 + gracl_learn.o grsec_log.o
57030 +obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
57031 +
57032 +ifdef CONFIG_NET
57033 +obj-y += grsec_sock.o
57034 +obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
57035 +endif
57036 +
57037 +ifndef CONFIG_GRKERNSEC
57038 +obj-y += grsec_disabled.o
57039 +endif
57040 +
57041 +ifdef CONFIG_GRKERNSEC_HIDESYM
57042 +extra-y := grsec_hidesym.o
57043 +$(obj)/grsec_hidesym.o:
57044 + @-chmod -f 500 /boot
57045 + @-chmod -f 500 /lib/modules
57046 + @-chmod -f 500 /lib64/modules
57047 + @-chmod -f 500 /lib32/modules
57048 + @-chmod -f 700 .
57049 + @echo ' grsec: protected kernel image paths'
57050 +endif
57051 diff -urNp linux-3.0.8/include/acpi/acpi_bus.h linux-3.0.8/include/acpi/acpi_bus.h
57052 --- linux-3.0.8/include/acpi/acpi_bus.h 2011-07-21 22:17:23.000000000 -0400
57053 +++ linux-3.0.8/include/acpi/acpi_bus.h 2011-08-23 21:47:56.000000000 -0400
57054 @@ -107,7 +107,7 @@ struct acpi_device_ops {
57055 acpi_op_bind bind;
57056 acpi_op_unbind unbind;
57057 acpi_op_notify notify;
57058 -};
57059 +} __no_const;
57060
57061 #define ACPI_DRIVER_ALL_NOTIFY_EVENTS 0x1 /* system AND device events */
57062
57063 diff -urNp linux-3.0.8/include/asm-generic/atomic-long.h linux-3.0.8/include/asm-generic/atomic-long.h
57064 --- linux-3.0.8/include/asm-generic/atomic-long.h 2011-07-21 22:17:23.000000000 -0400
57065 +++ linux-3.0.8/include/asm-generic/atomic-long.h 2011-08-23 21:47:56.000000000 -0400
57066 @@ -22,6 +22,12 @@
57067
57068 typedef atomic64_t atomic_long_t;
57069
57070 +#ifdef CONFIG_PAX_REFCOUNT
57071 +typedef atomic64_unchecked_t atomic_long_unchecked_t;
57072 +#else
57073 +typedef atomic64_t atomic_long_unchecked_t;
57074 +#endif
57075 +
57076 #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
57077
57078 static inline long atomic_long_read(atomic_long_t *l)
57079 @@ -31,6 +37,15 @@ static inline long atomic_long_read(atom
57080 return (long)atomic64_read(v);
57081 }
57082
57083 +#ifdef CONFIG_PAX_REFCOUNT
57084 +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
57085 +{
57086 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
57087 +
57088 + return (long)atomic64_read_unchecked(v);
57089 +}
57090 +#endif
57091 +
57092 static inline void atomic_long_set(atomic_long_t *l, long i)
57093 {
57094 atomic64_t *v = (atomic64_t *)l;
57095 @@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi
57096 atomic64_set(v, i);
57097 }
57098
57099 +#ifdef CONFIG_PAX_REFCOUNT
57100 +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
57101 +{
57102 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
57103 +
57104 + atomic64_set_unchecked(v, i);
57105 +}
57106 +#endif
57107 +
57108 static inline void atomic_long_inc(atomic_long_t *l)
57109 {
57110 atomic64_t *v = (atomic64_t *)l;
57111 @@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi
57112 atomic64_inc(v);
57113 }
57114
57115 +#ifdef CONFIG_PAX_REFCOUNT
57116 +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
57117 +{
57118 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
57119 +
57120 + atomic64_inc_unchecked(v);
57121 +}
57122 +#endif
57123 +
57124 static inline void atomic_long_dec(atomic_long_t *l)
57125 {
57126 atomic64_t *v = (atomic64_t *)l;
57127 @@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomi
57128 atomic64_dec(v);
57129 }
57130
57131 +#ifdef CONFIG_PAX_REFCOUNT
57132 +static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
57133 +{
57134 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
57135 +
57136 + atomic64_dec_unchecked(v);
57137 +}
57138 +#endif
57139 +
57140 static inline void atomic_long_add(long i, atomic_long_t *l)
57141 {
57142 atomic64_t *v = (atomic64_t *)l;
57143 @@ -59,6 +101,15 @@ static inline void atomic_long_add(long
57144 atomic64_add(i, v);
57145 }
57146
57147 +#ifdef CONFIG_PAX_REFCOUNT
57148 +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
57149 +{
57150 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
57151 +
57152 + atomic64_add_unchecked(i, v);
57153 +}
57154 +#endif
57155 +
57156 static inline void atomic_long_sub(long i, atomic_long_t *l)
57157 {
57158 atomic64_t *v = (atomic64_t *)l;
57159 @@ -66,6 +117,15 @@ static inline void atomic_long_sub(long
57160 atomic64_sub(i, v);
57161 }
57162
57163 +#ifdef CONFIG_PAX_REFCOUNT
57164 +static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
57165 +{
57166 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
57167 +
57168 + atomic64_sub_unchecked(i, v);
57169 +}
57170 +#endif
57171 +
57172 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
57173 {
57174 atomic64_t *v = (atomic64_t *)l;
57175 @@ -115,6 +175,15 @@ static inline long atomic_long_inc_retur
57176 return (long)atomic64_inc_return(v);
57177 }
57178
57179 +#ifdef CONFIG_PAX_REFCOUNT
57180 +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
57181 +{
57182 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
57183 +
57184 + return (long)atomic64_inc_return_unchecked(v);
57185 +}
57186 +#endif
57187 +
57188 static inline long atomic_long_dec_return(atomic_long_t *l)
57189 {
57190 atomic64_t *v = (atomic64_t *)l;
57191 @@ -140,6 +209,12 @@ static inline long atomic_long_add_unles
57192
57193 typedef atomic_t atomic_long_t;
57194
57195 +#ifdef CONFIG_PAX_REFCOUNT
57196 +typedef atomic_unchecked_t atomic_long_unchecked_t;
57197 +#else
57198 +typedef atomic_t atomic_long_unchecked_t;
57199 +#endif
57200 +
57201 #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
57202 static inline long atomic_long_read(atomic_long_t *l)
57203 {
57204 @@ -148,6 +223,15 @@ static inline long atomic_long_read(atom
57205 return (long)atomic_read(v);
57206 }
57207
57208 +#ifdef CONFIG_PAX_REFCOUNT
57209 +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
57210 +{
57211 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
57212 +
57213 + return (long)atomic_read_unchecked(v);
57214 +}
57215 +#endif
57216 +
57217 static inline void atomic_long_set(atomic_long_t *l, long i)
57218 {
57219 atomic_t *v = (atomic_t *)l;
57220 @@ -155,6 +239,15 @@ static inline void atomic_long_set(atomi
57221 atomic_set(v, i);
57222 }
57223
57224 +#ifdef CONFIG_PAX_REFCOUNT
57225 +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
57226 +{
57227 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
57228 +
57229 + atomic_set_unchecked(v, i);
57230 +}
57231 +#endif
57232 +
57233 static inline void atomic_long_inc(atomic_long_t *l)
57234 {
57235 atomic_t *v = (atomic_t *)l;
57236 @@ -162,6 +255,15 @@ static inline void atomic_long_inc(atomi
57237 atomic_inc(v);
57238 }
57239
57240 +#ifdef CONFIG_PAX_REFCOUNT
57241 +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
57242 +{
57243 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
57244 +
57245 + atomic_inc_unchecked(v);
57246 +}
57247 +#endif
57248 +
57249 static inline void atomic_long_dec(atomic_long_t *l)
57250 {
57251 atomic_t *v = (atomic_t *)l;
57252 @@ -169,6 +271,15 @@ static inline void atomic_long_dec(atomi
57253 atomic_dec(v);
57254 }
57255
57256 +#ifdef CONFIG_PAX_REFCOUNT
57257 +static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
57258 +{
57259 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
57260 +
57261 + atomic_dec_unchecked(v);
57262 +}
57263 +#endif
57264 +
57265 static inline void atomic_long_add(long i, atomic_long_t *l)
57266 {
57267 atomic_t *v = (atomic_t *)l;
57268 @@ -176,6 +287,15 @@ static inline void atomic_long_add(long
57269 atomic_add(i, v);
57270 }
57271
57272 +#ifdef CONFIG_PAX_REFCOUNT
57273 +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
57274 +{
57275 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
57276 +
57277 + atomic_add_unchecked(i, v);
57278 +}
57279 +#endif
57280 +
57281 static inline void atomic_long_sub(long i, atomic_long_t *l)
57282 {
57283 atomic_t *v = (atomic_t *)l;
57284 @@ -183,6 +303,15 @@ static inline void atomic_long_sub(long
57285 atomic_sub(i, v);
57286 }
57287
57288 +#ifdef CONFIG_PAX_REFCOUNT
57289 +static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
57290 +{
57291 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
57292 +
57293 + atomic_sub_unchecked(i, v);
57294 +}
57295 +#endif
57296 +
57297 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
57298 {
57299 atomic_t *v = (atomic_t *)l;
57300 @@ -232,6 +361,15 @@ static inline long atomic_long_inc_retur
57301 return (long)atomic_inc_return(v);
57302 }
57303
57304 +#ifdef CONFIG_PAX_REFCOUNT
57305 +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
57306 +{
57307 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
57308 +
57309 + return (long)atomic_inc_return_unchecked(v);
57310 +}
57311 +#endif
57312 +
57313 static inline long atomic_long_dec_return(atomic_long_t *l)
57314 {
57315 atomic_t *v = (atomic_t *)l;
57316 @@ -255,4 +393,49 @@ static inline long atomic_long_add_unles
57317
57318 #endif /* BITS_PER_LONG == 64 */
57319
57320 +#ifdef CONFIG_PAX_REFCOUNT
57321 +static inline void pax_refcount_needs_these_functions(void)
57322 +{
57323 + atomic_read_unchecked((atomic_unchecked_t *)NULL);
57324 + atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
57325 + atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
57326 + atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
57327 + atomic_inc_unchecked((atomic_unchecked_t *)NULL);
57328 + (void)atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
57329 + atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
57330 + atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
57331 + atomic_dec_unchecked((atomic_unchecked_t *)NULL);
57332 + atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
57333 + (void)atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
57334 +
57335 + atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
57336 + atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
57337 + atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
57338 + atomic_long_sub_unchecked(0, (atomic_long_unchecked_t *)NULL);
57339 + atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
57340 + atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
57341 + atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
57342 +}
57343 +#else
57344 +#define atomic_read_unchecked(v) atomic_read(v)
57345 +#define atomic_set_unchecked(v, i) atomic_set((v), (i))
57346 +#define atomic_add_unchecked(i, v) atomic_add((i), (v))
57347 +#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
57348 +#define atomic_inc_unchecked(v) atomic_inc(v)
57349 +#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
57350 +#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
57351 +#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
57352 +#define atomic_dec_unchecked(v) atomic_dec(v)
57353 +#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
57354 +#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
57355 +
57356 +#define atomic_long_read_unchecked(v) atomic_long_read(v)
57357 +#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
57358 +#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
57359 +#define atomic_long_sub_unchecked(i, v) atomic_long_sub((i), (v))
57360 +#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
57361 +#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
57362 +#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
57363 +#endif
57364 +
57365 #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
57366 diff -urNp linux-3.0.8/include/asm-generic/cache.h linux-3.0.8/include/asm-generic/cache.h
57367 --- linux-3.0.8/include/asm-generic/cache.h 2011-07-21 22:17:23.000000000 -0400
57368 +++ linux-3.0.8/include/asm-generic/cache.h 2011-08-23 21:47:56.000000000 -0400
57369 @@ -6,7 +6,7 @@
57370 * cache lines need to provide their own cache.h.
57371 */
57372
57373 -#define L1_CACHE_SHIFT 5
57374 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
57375 +#define L1_CACHE_SHIFT 5UL
57376 +#define L1_CACHE_BYTES (1UL << L1_CACHE_SHIFT)
57377
57378 #endif /* __ASM_GENERIC_CACHE_H */
57379 diff -urNp linux-3.0.8/include/asm-generic/int-l64.h linux-3.0.8/include/asm-generic/int-l64.h
57380 --- linux-3.0.8/include/asm-generic/int-l64.h 2011-07-21 22:17:23.000000000 -0400
57381 +++ linux-3.0.8/include/asm-generic/int-l64.h 2011-08-23 21:47:56.000000000 -0400
57382 @@ -46,6 +46,8 @@ typedef unsigned int u32;
57383 typedef signed long s64;
57384 typedef unsigned long u64;
57385
57386 +typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
57387 +
57388 #define S8_C(x) x
57389 #define U8_C(x) x ## U
57390 #define S16_C(x) x
57391 diff -urNp linux-3.0.8/include/asm-generic/int-ll64.h linux-3.0.8/include/asm-generic/int-ll64.h
57392 --- linux-3.0.8/include/asm-generic/int-ll64.h 2011-07-21 22:17:23.000000000 -0400
57393 +++ linux-3.0.8/include/asm-generic/int-ll64.h 2011-08-23 21:47:56.000000000 -0400
57394 @@ -51,6 +51,8 @@ typedef unsigned int u32;
57395 typedef signed long long s64;
57396 typedef unsigned long long u64;
57397
57398 +typedef unsigned long long intoverflow_t;
57399 +
57400 #define S8_C(x) x
57401 #define U8_C(x) x ## U
57402 #define S16_C(x) x
57403 diff -urNp linux-3.0.8/include/asm-generic/kmap_types.h linux-3.0.8/include/asm-generic/kmap_types.h
57404 --- linux-3.0.8/include/asm-generic/kmap_types.h 2011-07-21 22:17:23.000000000 -0400
57405 +++ linux-3.0.8/include/asm-generic/kmap_types.h 2011-08-23 21:47:56.000000000 -0400
57406 @@ -29,10 +29,11 @@ KMAP_D(16) KM_IRQ_PTE,
57407 KMAP_D(17) KM_NMI,
57408 KMAP_D(18) KM_NMI_PTE,
57409 KMAP_D(19) KM_KDB,
57410 +KMAP_D(20) KM_CLEARPAGE,
57411 /*
57412 * Remember to update debug_kmap_atomic() when adding new kmap types!
57413 */
57414 -KMAP_D(20) KM_TYPE_NR
57415 +KMAP_D(21) KM_TYPE_NR
57416 };
57417
57418 #undef KMAP_D
57419 diff -urNp linux-3.0.8/include/asm-generic/pgtable.h linux-3.0.8/include/asm-generic/pgtable.h
57420 --- linux-3.0.8/include/asm-generic/pgtable.h 2011-07-21 22:17:23.000000000 -0400
57421 +++ linux-3.0.8/include/asm-generic/pgtable.h 2011-08-23 21:47:56.000000000 -0400
57422 @@ -443,6 +443,14 @@ static inline int pmd_write(pmd_t pmd)
57423 #endif /* __HAVE_ARCH_PMD_WRITE */
57424 #endif
57425
57426 +#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
57427 +static inline unsigned long pax_open_kernel(void) { return 0; }
57428 +#endif
57429 +
57430 +#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
57431 +static inline unsigned long pax_close_kernel(void) { return 0; }
57432 +#endif
57433 +
57434 #endif /* !__ASSEMBLY__ */
57435
57436 #endif /* _ASM_GENERIC_PGTABLE_H */
57437 diff -urNp linux-3.0.8/include/asm-generic/pgtable-nopmd.h linux-3.0.8/include/asm-generic/pgtable-nopmd.h
57438 --- linux-3.0.8/include/asm-generic/pgtable-nopmd.h 2011-07-21 22:17:23.000000000 -0400
57439 +++ linux-3.0.8/include/asm-generic/pgtable-nopmd.h 2011-08-23 21:47:56.000000000 -0400
57440 @@ -1,14 +1,19 @@
57441 #ifndef _PGTABLE_NOPMD_H
57442 #define _PGTABLE_NOPMD_H
57443
57444 -#ifndef __ASSEMBLY__
57445 -
57446 #include <asm-generic/pgtable-nopud.h>
57447
57448 -struct mm_struct;
57449 -
57450 #define __PAGETABLE_PMD_FOLDED
57451
57452 +#define PMD_SHIFT PUD_SHIFT
57453 +#define PTRS_PER_PMD 1
57454 +#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
57455 +#define PMD_MASK (~(PMD_SIZE-1))
57456 +
57457 +#ifndef __ASSEMBLY__
57458 +
57459 +struct mm_struct;
57460 +
57461 /*
57462 * Having the pmd type consist of a pud gets the size right, and allows
57463 * us to conceptually access the pud entry that this pmd is folded into
57464 @@ -16,11 +21,6 @@ struct mm_struct;
57465 */
57466 typedef struct { pud_t pud; } pmd_t;
57467
57468 -#define PMD_SHIFT PUD_SHIFT
57469 -#define PTRS_PER_PMD 1
57470 -#define PMD_SIZE (1UL << PMD_SHIFT)
57471 -#define PMD_MASK (~(PMD_SIZE-1))
57472 -
57473 /*
57474 * The "pud_xxx()" functions here are trivial for a folded two-level
57475 * setup: the pmd is never bad, and a pmd always exists (as it's folded
57476 diff -urNp linux-3.0.8/include/asm-generic/pgtable-nopud.h linux-3.0.8/include/asm-generic/pgtable-nopud.h
57477 --- linux-3.0.8/include/asm-generic/pgtable-nopud.h 2011-07-21 22:17:23.000000000 -0400
57478 +++ linux-3.0.8/include/asm-generic/pgtable-nopud.h 2011-08-23 21:47:56.000000000 -0400
57479 @@ -1,10 +1,15 @@
57480 #ifndef _PGTABLE_NOPUD_H
57481 #define _PGTABLE_NOPUD_H
57482
57483 -#ifndef __ASSEMBLY__
57484 -
57485 #define __PAGETABLE_PUD_FOLDED
57486
57487 +#define PUD_SHIFT PGDIR_SHIFT
57488 +#define PTRS_PER_PUD 1
57489 +#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
57490 +#define PUD_MASK (~(PUD_SIZE-1))
57491 +
57492 +#ifndef __ASSEMBLY__
57493 +
57494 /*
57495 * Having the pud type consist of a pgd gets the size right, and allows
57496 * us to conceptually access the pgd entry that this pud is folded into
57497 @@ -12,11 +17,6 @@
57498 */
57499 typedef struct { pgd_t pgd; } pud_t;
57500
57501 -#define PUD_SHIFT PGDIR_SHIFT
57502 -#define PTRS_PER_PUD 1
57503 -#define PUD_SIZE (1UL << PUD_SHIFT)
57504 -#define PUD_MASK (~(PUD_SIZE-1))
57505 -
57506 /*
57507 * The "pgd_xxx()" functions here are trivial for a folded two-level
57508 * setup: the pud is never bad, and a pud always exists (as it's folded
57509 diff -urNp linux-3.0.8/include/asm-generic/vmlinux.lds.h linux-3.0.8/include/asm-generic/vmlinux.lds.h
57510 --- linux-3.0.8/include/asm-generic/vmlinux.lds.h 2011-07-21 22:17:23.000000000 -0400
57511 +++ linux-3.0.8/include/asm-generic/vmlinux.lds.h 2011-08-23 21:47:56.000000000 -0400
57512 @@ -217,6 +217,7 @@
57513 .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
57514 VMLINUX_SYMBOL(__start_rodata) = .; \
57515 *(.rodata) *(.rodata.*) \
57516 + *(.data..read_only) \
57517 *(__vermagic) /* Kernel version magic */ \
57518 . = ALIGN(8); \
57519 VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .; \
57520 @@ -723,17 +724,18 @@
57521 * section in the linker script will go there too. @phdr should have
57522 * a leading colon.
57523 *
57524 - * Note that this macros defines __per_cpu_load as an absolute symbol.
57525 + * Note that this macros defines per_cpu_load as an absolute symbol.
57526 * If there is no need to put the percpu section at a predetermined
57527 * address, use PERCPU_SECTION.
57528 */
57529 #define PERCPU_VADDR(cacheline, vaddr, phdr) \
57530 - VMLINUX_SYMBOL(__per_cpu_load) = .; \
57531 - .data..percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
57532 + per_cpu_load = .; \
57533 + .data..percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
57534 - LOAD_OFFSET) { \
57535 + VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
57536 PERCPU_INPUT(cacheline) \
57537 } phdr \
57538 - . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data..percpu);
57539 + . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data..percpu);
57540
57541 /**
57542 * PERCPU_SECTION - define output section for percpu area, simple version
57543 diff -urNp linux-3.0.8/include/drm/drm_crtc_helper.h linux-3.0.8/include/drm/drm_crtc_helper.h
57544 --- linux-3.0.8/include/drm/drm_crtc_helper.h 2011-07-21 22:17:23.000000000 -0400
57545 +++ linux-3.0.8/include/drm/drm_crtc_helper.h 2011-08-23 21:47:56.000000000 -0400
57546 @@ -74,7 +74,7 @@ struct drm_crtc_helper_funcs {
57547
57548 /* disable crtc when not in use - more explicit than dpms off */
57549 void (*disable)(struct drm_crtc *crtc);
57550 -};
57551 +} __no_const;
57552
57553 struct drm_encoder_helper_funcs {
57554 void (*dpms)(struct drm_encoder *encoder, int mode);
57555 @@ -95,7 +95,7 @@ struct drm_encoder_helper_funcs {
57556 struct drm_connector *connector);
57557 /* disable encoder when not in use - more explicit than dpms off */
57558 void (*disable)(struct drm_encoder *encoder);
57559 -};
57560 +} __no_const;
57561
57562 struct drm_connector_helper_funcs {
57563 int (*get_modes)(struct drm_connector *connector);
57564 diff -urNp linux-3.0.8/include/drm/drmP.h linux-3.0.8/include/drm/drmP.h
57565 --- linux-3.0.8/include/drm/drmP.h 2011-07-21 22:17:23.000000000 -0400
57566 +++ linux-3.0.8/include/drm/drmP.h 2011-08-23 21:47:56.000000000 -0400
57567 @@ -73,6 +73,7 @@
57568 #include <linux/workqueue.h>
57569 #include <linux/poll.h>
57570 #include <asm/pgalloc.h>
57571 +#include <asm/local.h>
57572 #include "drm.h"
57573
57574 #include <linux/idr.h>
57575 @@ -1033,7 +1034,7 @@ struct drm_device {
57576
57577 /** \name Usage Counters */
57578 /*@{ */
57579 - int open_count; /**< Outstanding files open */
57580 + local_t open_count; /**< Outstanding files open */
57581 atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
57582 atomic_t vma_count; /**< Outstanding vma areas open */
57583 int buf_use; /**< Buffers in use -- cannot alloc */
57584 @@ -1044,7 +1045,7 @@ struct drm_device {
57585 /*@{ */
57586 unsigned long counters;
57587 enum drm_stat_type types[15];
57588 - atomic_t counts[15];
57589 + atomic_unchecked_t counts[15];
57590 /*@} */
57591
57592 struct list_head filelist;
57593 diff -urNp linux-3.0.8/include/drm/ttm/ttm_memory.h linux-3.0.8/include/drm/ttm/ttm_memory.h
57594 --- linux-3.0.8/include/drm/ttm/ttm_memory.h 2011-07-21 22:17:23.000000000 -0400
57595 +++ linux-3.0.8/include/drm/ttm/ttm_memory.h 2011-08-23 21:47:56.000000000 -0400
57596 @@ -47,7 +47,7 @@
57597
57598 struct ttm_mem_shrink {
57599 int (*do_shrink) (struct ttm_mem_shrink *);
57600 -};
57601 +} __no_const;
57602
57603 /**
57604 * struct ttm_mem_global - Global memory accounting structure.
57605 diff -urNp linux-3.0.8/include/linux/a.out.h linux-3.0.8/include/linux/a.out.h
57606 --- linux-3.0.8/include/linux/a.out.h 2011-07-21 22:17:23.000000000 -0400
57607 +++ linux-3.0.8/include/linux/a.out.h 2011-08-23 21:47:56.000000000 -0400
57608 @@ -39,6 +39,14 @@ enum machine_type {
57609 M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
57610 };
57611
57612 +/* Constants for the N_FLAGS field */
57613 +#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
57614 +#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
57615 +#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
57616 +#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
57617 +/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
57618 +#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
57619 +
57620 #if !defined (N_MAGIC)
57621 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
57622 #endif
57623 diff -urNp linux-3.0.8/include/linux/atmdev.h linux-3.0.8/include/linux/atmdev.h
57624 --- linux-3.0.8/include/linux/atmdev.h 2011-07-21 22:17:23.000000000 -0400
57625 +++ linux-3.0.8/include/linux/atmdev.h 2011-08-23 21:47:56.000000000 -0400
57626 @@ -237,7 +237,7 @@ struct compat_atm_iobuf {
57627 #endif
57628
57629 struct k_atm_aal_stats {
57630 -#define __HANDLE_ITEM(i) atomic_t i
57631 +#define __HANDLE_ITEM(i) atomic_unchecked_t i
57632 __AAL_STAT_ITEMS
57633 #undef __HANDLE_ITEM
57634 };
57635 diff -urNp linux-3.0.8/include/linux/binfmts.h linux-3.0.8/include/linux/binfmts.h
57636 --- linux-3.0.8/include/linux/binfmts.h 2011-07-21 22:17:23.000000000 -0400
57637 +++ linux-3.0.8/include/linux/binfmts.h 2011-08-23 21:47:56.000000000 -0400
57638 @@ -88,6 +88,7 @@ struct linux_binfmt {
57639 int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
57640 int (*load_shlib)(struct file *);
57641 int (*core_dump)(struct coredump_params *cprm);
57642 + void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
57643 unsigned long min_coredump; /* minimal dump size */
57644 };
57645
57646 diff -urNp linux-3.0.8/include/linux/blkdev.h linux-3.0.8/include/linux/blkdev.h
57647 --- linux-3.0.8/include/linux/blkdev.h 2011-07-21 22:17:23.000000000 -0400
57648 +++ linux-3.0.8/include/linux/blkdev.h 2011-08-26 19:49:56.000000000 -0400
57649 @@ -1308,7 +1308,7 @@ struct block_device_operations {
57650 /* this callback is with swap_lock and sometimes page table lock held */
57651 void (*swap_slot_free_notify) (struct block_device *, unsigned long);
57652 struct module *owner;
57653 -};
57654 +} __do_const;
57655
57656 extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
57657 unsigned long);
57658 diff -urNp linux-3.0.8/include/linux/blktrace_api.h linux-3.0.8/include/linux/blktrace_api.h
57659 --- linux-3.0.8/include/linux/blktrace_api.h 2011-07-21 22:17:23.000000000 -0400
57660 +++ linux-3.0.8/include/linux/blktrace_api.h 2011-08-23 21:47:56.000000000 -0400
57661 @@ -161,7 +161,7 @@ struct blk_trace {
57662 struct dentry *dir;
57663 struct dentry *dropped_file;
57664 struct dentry *msg_file;
57665 - atomic_t dropped;
57666 + atomic_unchecked_t dropped;
57667 };
57668
57669 extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
57670 diff -urNp linux-3.0.8/include/linux/byteorder/little_endian.h linux-3.0.8/include/linux/byteorder/little_endian.h
57671 --- linux-3.0.8/include/linux/byteorder/little_endian.h 2011-07-21 22:17:23.000000000 -0400
57672 +++ linux-3.0.8/include/linux/byteorder/little_endian.h 2011-08-23 21:47:56.000000000 -0400
57673 @@ -42,51 +42,51 @@
57674
57675 static inline __le64 __cpu_to_le64p(const __u64 *p)
57676 {
57677 - return (__force __le64)*p;
57678 + return (__force const __le64)*p;
57679 }
57680 static inline __u64 __le64_to_cpup(const __le64 *p)
57681 {
57682 - return (__force __u64)*p;
57683 + return (__force const __u64)*p;
57684 }
57685 static inline __le32 __cpu_to_le32p(const __u32 *p)
57686 {
57687 - return (__force __le32)*p;
57688 + return (__force const __le32)*p;
57689 }
57690 static inline __u32 __le32_to_cpup(const __le32 *p)
57691 {
57692 - return (__force __u32)*p;
57693 + return (__force const __u32)*p;
57694 }
57695 static inline __le16 __cpu_to_le16p(const __u16 *p)
57696 {
57697 - return (__force __le16)*p;
57698 + return (__force const __le16)*p;
57699 }
57700 static inline __u16 __le16_to_cpup(const __le16 *p)
57701 {
57702 - return (__force __u16)*p;
57703 + return (__force const __u16)*p;
57704 }
57705 static inline __be64 __cpu_to_be64p(const __u64 *p)
57706 {
57707 - return (__force __be64)__swab64p(p);
57708 + return (__force const __be64)__swab64p(p);
57709 }
57710 static inline __u64 __be64_to_cpup(const __be64 *p)
57711 {
57712 - return __swab64p((__u64 *)p);
57713 + return __swab64p((const __u64 *)p);
57714 }
57715 static inline __be32 __cpu_to_be32p(const __u32 *p)
57716 {
57717 - return (__force __be32)__swab32p(p);
57718 + return (__force const __be32)__swab32p(p);
57719 }
57720 static inline __u32 __be32_to_cpup(const __be32 *p)
57721 {
57722 - return __swab32p((__u32 *)p);
57723 + return __swab32p((const __u32 *)p);
57724 }
57725 static inline __be16 __cpu_to_be16p(const __u16 *p)
57726 {
57727 - return (__force __be16)__swab16p(p);
57728 + return (__force const __be16)__swab16p(p);
57729 }
57730 static inline __u16 __be16_to_cpup(const __be16 *p)
57731 {
57732 - return __swab16p((__u16 *)p);
57733 + return __swab16p((const __u16 *)p);
57734 }
57735 #define __cpu_to_le64s(x) do { (void)(x); } while (0)
57736 #define __le64_to_cpus(x) do { (void)(x); } while (0)
57737 diff -urNp linux-3.0.8/include/linux/cache.h linux-3.0.8/include/linux/cache.h
57738 --- linux-3.0.8/include/linux/cache.h 2011-07-21 22:17:23.000000000 -0400
57739 +++ linux-3.0.8/include/linux/cache.h 2011-08-23 21:47:56.000000000 -0400
57740 @@ -16,6 +16,10 @@
57741 #define __read_mostly
57742 #endif
57743
57744 +#ifndef __read_only
57745 +#define __read_only __read_mostly
57746 +#endif
57747 +
57748 #ifndef ____cacheline_aligned
57749 #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
57750 #endif
57751 diff -urNp linux-3.0.8/include/linux/capability.h linux-3.0.8/include/linux/capability.h
57752 --- linux-3.0.8/include/linux/capability.h 2011-07-21 22:17:23.000000000 -0400
57753 +++ linux-3.0.8/include/linux/capability.h 2011-08-23 21:48:14.000000000 -0400
57754 @@ -547,6 +547,9 @@ extern bool capable(int cap);
57755 extern bool ns_capable(struct user_namespace *ns, int cap);
57756 extern bool task_ns_capable(struct task_struct *t, int cap);
57757 extern bool nsown_capable(int cap);
57758 +extern bool task_ns_capable_nolog(struct task_struct *t, int cap);
57759 +extern bool ns_capable_nolog(struct user_namespace *ns, int cap);
57760 +extern bool capable_nolog(int cap);
57761
57762 /* audit system wants to get cap info from files as well */
57763 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
57764 diff -urNp linux-3.0.8/include/linux/cleancache.h linux-3.0.8/include/linux/cleancache.h
57765 --- linux-3.0.8/include/linux/cleancache.h 2011-07-21 22:17:23.000000000 -0400
57766 +++ linux-3.0.8/include/linux/cleancache.h 2011-08-23 21:47:56.000000000 -0400
57767 @@ -31,7 +31,7 @@ struct cleancache_ops {
57768 void (*flush_page)(int, struct cleancache_filekey, pgoff_t);
57769 void (*flush_inode)(int, struct cleancache_filekey);
57770 void (*flush_fs)(int);
57771 -};
57772 +} __no_const;
57773
57774 extern struct cleancache_ops
57775 cleancache_register_ops(struct cleancache_ops *ops);
57776 diff -urNp linux-3.0.8/include/linux/compiler-gcc4.h linux-3.0.8/include/linux/compiler-gcc4.h
57777 --- linux-3.0.8/include/linux/compiler-gcc4.h 2011-07-21 22:17:23.000000000 -0400
57778 +++ linux-3.0.8/include/linux/compiler-gcc4.h 2011-08-26 19:49:56.000000000 -0400
57779 @@ -31,6 +31,12 @@
57780
57781
57782 #if __GNUC_MINOR__ >= 5
57783 +
57784 +#ifdef CONSTIFY_PLUGIN
57785 +#define __no_const __attribute__((no_const))
57786 +#define __do_const __attribute__((do_const))
57787 +#endif
57788 +
57789 /*
57790 * Mark a position in code as unreachable. This can be used to
57791 * suppress control flow warnings after asm blocks that transfer
57792 @@ -46,6 +52,11 @@
57793 #define __noclone __attribute__((__noclone__))
57794
57795 #endif
57796 +
57797 +#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
57798 +#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
57799 +#define __bos0(ptr) __bos((ptr), 0)
57800 +#define __bos1(ptr) __bos((ptr), 1)
57801 #endif
57802
57803 #if __GNUC_MINOR__ > 0
57804 diff -urNp linux-3.0.8/include/linux/compiler.h linux-3.0.8/include/linux/compiler.h
57805 --- linux-3.0.8/include/linux/compiler.h 2011-07-21 22:17:23.000000000 -0400
57806 +++ linux-3.0.8/include/linux/compiler.h 2011-10-06 04:17:55.000000000 -0400
57807 @@ -5,31 +5,62 @@
57808
57809 #ifdef __CHECKER__
57810 # define __user __attribute__((noderef, address_space(1)))
57811 +# define __force_user __force __user
57812 # define __kernel __attribute__((address_space(0)))
57813 +# define __force_kernel __force __kernel
57814 # define __safe __attribute__((safe))
57815 # define __force __attribute__((force))
57816 # define __nocast __attribute__((nocast))
57817 # define __iomem __attribute__((noderef, address_space(2)))
57818 +# define __force_iomem __force __iomem
57819 # define __acquires(x) __attribute__((context(x,0,1)))
57820 # define __releases(x) __attribute__((context(x,1,0)))
57821 # define __acquire(x) __context__(x,1)
57822 # define __release(x) __context__(x,-1)
57823 # define __cond_lock(x,c) ((c) ? ({ __acquire(x); 1; }) : 0)
57824 # define __percpu __attribute__((noderef, address_space(3)))
57825 +# define __force_percpu __force __percpu
57826 #ifdef CONFIG_SPARSE_RCU_POINTER
57827 # define __rcu __attribute__((noderef, address_space(4)))
57828 +# define __force_rcu __force __rcu
57829 #else
57830 # define __rcu
57831 +# define __force_rcu
57832 #endif
57833 extern void __chk_user_ptr(const volatile void __user *);
57834 extern void __chk_io_ptr(const volatile void __iomem *);
57835 +#elif defined(CHECKER_PLUGIN)
57836 +//# define __user
57837 +//# define __force_user
57838 +//# define __kernel
57839 +//# define __force_kernel
57840 +# define __safe
57841 +# define __force
57842 +# define __nocast
57843 +# define __iomem
57844 +# define __force_iomem
57845 +# define __chk_user_ptr(x) (void)0
57846 +# define __chk_io_ptr(x) (void)0
57847 +# define __builtin_warning(x, y...) (1)
57848 +# define __acquires(x)
57849 +# define __releases(x)
57850 +# define __acquire(x) (void)0
57851 +# define __release(x) (void)0
57852 +# define __cond_lock(x,c) (c)
57853 +# define __percpu
57854 +# define __force_percpu
57855 +# define __rcu
57856 +# define __force_rcu
57857 #else
57858 # define __user
57859 +# define __force_user
57860 # define __kernel
57861 +# define __force_kernel
57862 # define __safe
57863 # define __force
57864 # define __nocast
57865 # define __iomem
57866 +# define __force_iomem
57867 # define __chk_user_ptr(x) (void)0
57868 # define __chk_io_ptr(x) (void)0
57869 # define __builtin_warning(x, y...) (1)
57870 @@ -39,7 +70,9 @@ extern void __chk_io_ptr(const volatile
57871 # define __release(x) (void)0
57872 # define __cond_lock(x,c) (c)
57873 # define __percpu
57874 +# define __force_percpu
57875 # define __rcu
57876 +# define __force_rcu
57877 #endif
57878
57879 #ifdef __KERNEL__
57880 @@ -264,6 +297,14 @@ void ftrace_likely_update(struct ftrace_
57881 # define __attribute_const__ /* unimplemented */
57882 #endif
57883
57884 +#ifndef __no_const
57885 +# define __no_const
57886 +#endif
57887 +
57888 +#ifndef __do_const
57889 +# define __do_const
57890 +#endif
57891 +
57892 /*
57893 * Tell gcc if a function is cold. The compiler will assume any path
57894 * directly leading to the call is unlikely.
57895 @@ -273,6 +314,22 @@ void ftrace_likely_update(struct ftrace_
57896 #define __cold
57897 #endif
57898
57899 +#ifndef __alloc_size
57900 +#define __alloc_size(...)
57901 +#endif
57902 +
57903 +#ifndef __bos
57904 +#define __bos(ptr, arg)
57905 +#endif
57906 +
57907 +#ifndef __bos0
57908 +#define __bos0(ptr)
57909 +#endif
57910 +
57911 +#ifndef __bos1
57912 +#define __bos1(ptr)
57913 +#endif
57914 +
57915 /* Simple shorthand for a section definition */
57916 #ifndef __section
57917 # define __section(S) __attribute__ ((__section__(#S)))
57918 @@ -306,6 +363,7 @@ void ftrace_likely_update(struct ftrace_
57919 * use is to mediate communication between process-level code and irq/NMI
57920 * handlers, all running on the same CPU.
57921 */
57922 -#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
57923 +#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
57924 +#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
57925
57926 #endif /* __LINUX_COMPILER_H */
57927 diff -urNp linux-3.0.8/include/linux/cpuset.h linux-3.0.8/include/linux/cpuset.h
57928 --- linux-3.0.8/include/linux/cpuset.h 2011-07-21 22:17:23.000000000 -0400
57929 +++ linux-3.0.8/include/linux/cpuset.h 2011-08-23 21:47:56.000000000 -0400
57930 @@ -118,7 +118,7 @@ static inline void put_mems_allowed(void
57931 * nodemask.
57932 */
57933 smp_mb();
57934 - --ACCESS_ONCE(current->mems_allowed_change_disable);
57935 + --ACCESS_ONCE_RW(current->mems_allowed_change_disable);
57936 }
57937
57938 static inline void set_mems_allowed(nodemask_t nodemask)
57939 diff -urNp linux-3.0.8/include/linux/crypto.h linux-3.0.8/include/linux/crypto.h
57940 --- linux-3.0.8/include/linux/crypto.h 2011-07-21 22:17:23.000000000 -0400
57941 +++ linux-3.0.8/include/linux/crypto.h 2011-08-23 21:47:56.000000000 -0400
57942 @@ -361,7 +361,7 @@ struct cipher_tfm {
57943 const u8 *key, unsigned int keylen);
57944 void (*cit_encrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
57945 void (*cit_decrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
57946 -};
57947 +} __no_const;
57948
57949 struct hash_tfm {
57950 int (*init)(struct hash_desc *desc);
57951 @@ -382,13 +382,13 @@ struct compress_tfm {
57952 int (*cot_decompress)(struct crypto_tfm *tfm,
57953 const u8 *src, unsigned int slen,
57954 u8 *dst, unsigned int *dlen);
57955 -};
57956 +} __no_const;
57957
57958 struct rng_tfm {
57959 int (*rng_gen_random)(struct crypto_rng *tfm, u8 *rdata,
57960 unsigned int dlen);
57961 int (*rng_reset)(struct crypto_rng *tfm, u8 *seed, unsigned int slen);
57962 -};
57963 +} __no_const;
57964
57965 #define crt_ablkcipher crt_u.ablkcipher
57966 #define crt_aead crt_u.aead
57967 diff -urNp linux-3.0.8/include/linux/decompress/mm.h linux-3.0.8/include/linux/decompress/mm.h
57968 --- linux-3.0.8/include/linux/decompress/mm.h 2011-07-21 22:17:23.000000000 -0400
57969 +++ linux-3.0.8/include/linux/decompress/mm.h 2011-08-23 21:47:56.000000000 -0400
57970 @@ -77,7 +77,7 @@ static void free(void *where)
57971 * warnings when not needed (indeed large_malloc / large_free are not
57972 * needed by inflate */
57973
57974 -#define malloc(a) kmalloc(a, GFP_KERNEL)
57975 +#define malloc(a) kmalloc((a), GFP_KERNEL)
57976 #define free(a) kfree(a)
57977
57978 #define large_malloc(a) vmalloc(a)
57979 diff -urNp linux-3.0.8/include/linux/dma-mapping.h linux-3.0.8/include/linux/dma-mapping.h
57980 --- linux-3.0.8/include/linux/dma-mapping.h 2011-07-21 22:17:23.000000000 -0400
57981 +++ linux-3.0.8/include/linux/dma-mapping.h 2011-08-26 19:49:56.000000000 -0400
57982 @@ -50,7 +50,7 @@ struct dma_map_ops {
57983 int (*dma_supported)(struct device *dev, u64 mask);
57984 int (*set_dma_mask)(struct device *dev, u64 mask);
57985 int is_phys;
57986 -};
57987 +} __do_const;
57988
57989 #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
57990
57991 diff -urNp linux-3.0.8/include/linux/efi.h linux-3.0.8/include/linux/efi.h
57992 --- linux-3.0.8/include/linux/efi.h 2011-07-21 22:17:23.000000000 -0400
57993 +++ linux-3.0.8/include/linux/efi.h 2011-08-23 21:47:56.000000000 -0400
57994 @@ -410,7 +410,7 @@ struct efivar_operations {
57995 efi_get_variable_t *get_variable;
57996 efi_get_next_variable_t *get_next_variable;
57997 efi_set_variable_t *set_variable;
57998 -};
57999 +} __no_const;
58000
58001 struct efivars {
58002 /*
58003 diff -urNp linux-3.0.8/include/linux/elf.h linux-3.0.8/include/linux/elf.h
58004 --- linux-3.0.8/include/linux/elf.h 2011-07-21 22:17:23.000000000 -0400
58005 +++ linux-3.0.8/include/linux/elf.h 2011-08-23 21:47:56.000000000 -0400
58006 @@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
58007 #define PT_GNU_EH_FRAME 0x6474e550
58008
58009 #define PT_GNU_STACK (PT_LOOS + 0x474e551)
58010 +#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
58011 +
58012 +#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
58013 +
58014 +/* Constants for the e_flags field */
58015 +#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
58016 +#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
58017 +#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
58018 +#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
58019 +/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
58020 +#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
58021
58022 /*
58023 * Extended Numbering
58024 @@ -106,6 +117,8 @@ typedef __s64 Elf64_Sxword;
58025 #define DT_DEBUG 21
58026 #define DT_TEXTREL 22
58027 #define DT_JMPREL 23
58028 +#define DT_FLAGS 30
58029 + #define DF_TEXTREL 0x00000004
58030 #define DT_ENCODING 32
58031 #define OLD_DT_LOOS 0x60000000
58032 #define DT_LOOS 0x6000000d
58033 @@ -252,6 +265,19 @@ typedef struct elf64_hdr {
58034 #define PF_W 0x2
58035 #define PF_X 0x1
58036
58037 +#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
58038 +#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
58039 +#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
58040 +#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
58041 +#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
58042 +#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
58043 +/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
58044 +/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
58045 +#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
58046 +#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
58047 +#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
58048 +#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
58049 +
58050 typedef struct elf32_phdr{
58051 Elf32_Word p_type;
58052 Elf32_Off p_offset;
58053 @@ -344,6 +370,8 @@ typedef struct elf64_shdr {
58054 #define EI_OSABI 7
58055 #define EI_PAD 8
58056
58057 +#define EI_PAX 14
58058 +
58059 #define ELFMAG0 0x7f /* EI_MAG */
58060 #define ELFMAG1 'E'
58061 #define ELFMAG2 'L'
58062 @@ -422,6 +450,7 @@ extern Elf32_Dyn _DYNAMIC [];
58063 #define elf_note elf32_note
58064 #define elf_addr_t Elf32_Off
58065 #define Elf_Half Elf32_Half
58066 +#define elf_dyn Elf32_Dyn
58067
58068 #else
58069
58070 @@ -432,6 +461,7 @@ extern Elf64_Dyn _DYNAMIC [];
58071 #define elf_note elf64_note
58072 #define elf_addr_t Elf64_Off
58073 #define Elf_Half Elf64_Half
58074 +#define elf_dyn Elf64_Dyn
58075
58076 #endif
58077
58078 diff -urNp linux-3.0.8/include/linux/firewire.h linux-3.0.8/include/linux/firewire.h
58079 --- linux-3.0.8/include/linux/firewire.h 2011-07-21 22:17:23.000000000 -0400
58080 +++ linux-3.0.8/include/linux/firewire.h 2011-08-23 21:47:56.000000000 -0400
58081 @@ -428,7 +428,7 @@ struct fw_iso_context {
58082 union {
58083 fw_iso_callback_t sc;
58084 fw_iso_mc_callback_t mc;
58085 - } callback;
58086 + } __no_const callback;
58087 void *callback_data;
58088 };
58089
58090 diff -urNp linux-3.0.8/include/linux/fscache-cache.h linux-3.0.8/include/linux/fscache-cache.h
58091 --- linux-3.0.8/include/linux/fscache-cache.h 2011-07-21 22:17:23.000000000 -0400
58092 +++ linux-3.0.8/include/linux/fscache-cache.h 2011-08-23 21:47:56.000000000 -0400
58093 @@ -102,7 +102,7 @@ struct fscache_operation {
58094 fscache_operation_release_t release;
58095 };
58096
58097 -extern atomic_t fscache_op_debug_id;
58098 +extern atomic_unchecked_t fscache_op_debug_id;
58099 extern void fscache_op_work_func(struct work_struct *work);
58100
58101 extern void fscache_enqueue_operation(struct fscache_operation *);
58102 @@ -122,7 +122,7 @@ static inline void fscache_operation_ini
58103 {
58104 INIT_WORK(&op->work, fscache_op_work_func);
58105 atomic_set(&op->usage, 1);
58106 - op->debug_id = atomic_inc_return(&fscache_op_debug_id);
58107 + op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
58108 op->processor = processor;
58109 op->release = release;
58110 INIT_LIST_HEAD(&op->pend_link);
58111 diff -urNp linux-3.0.8/include/linux/fs.h linux-3.0.8/include/linux/fs.h
58112 --- linux-3.0.8/include/linux/fs.h 2011-07-21 22:17:23.000000000 -0400
58113 +++ linux-3.0.8/include/linux/fs.h 2011-08-26 19:49:56.000000000 -0400
58114 @@ -109,6 +109,11 @@ struct inodes_stat_t {
58115 /* File was opened by fanotify and shouldn't generate fanotify events */
58116 #define FMODE_NONOTIFY ((__force fmode_t)0x1000000)
58117
58118 +/* Hack for grsec so as not to require read permission simply to execute
58119 + * a binary
58120 + */
58121 +#define FMODE_GREXEC ((__force fmode_t)0x2000000)
58122 +
58123 /*
58124 * The below are the various read and write types that we support. Some of
58125 * them include behavioral modifiers that send information down to the
58126 @@ -1571,7 +1576,8 @@ struct file_operations {
58127 int (*setlease)(struct file *, long, struct file_lock **);
58128 long (*fallocate)(struct file *file, int mode, loff_t offset,
58129 loff_t len);
58130 -};
58131 +} __do_const;
58132 +typedef struct file_operations __no_const file_operations_no_const;
58133
58134 #define IPERM_FLAG_RCU 0x0001
58135
58136 diff -urNp linux-3.0.8/include/linux/fsnotify.h linux-3.0.8/include/linux/fsnotify.h
58137 --- linux-3.0.8/include/linux/fsnotify.h 2011-07-21 22:17:23.000000000 -0400
58138 +++ linux-3.0.8/include/linux/fsnotify.h 2011-08-24 18:10:29.000000000 -0400
58139 @@ -314,7 +314,7 @@ static inline void fsnotify_change(struc
58140 */
58141 static inline const unsigned char *fsnotify_oldname_init(const unsigned char *name)
58142 {
58143 - return kstrdup(name, GFP_KERNEL);
58144 + return (const unsigned char *)kstrdup((const char *)name, GFP_KERNEL);
58145 }
58146
58147 /*
58148 diff -urNp linux-3.0.8/include/linux/fs_struct.h linux-3.0.8/include/linux/fs_struct.h
58149 --- linux-3.0.8/include/linux/fs_struct.h 2011-07-21 22:17:23.000000000 -0400
58150 +++ linux-3.0.8/include/linux/fs_struct.h 2011-08-23 21:47:56.000000000 -0400
58151 @@ -6,7 +6,7 @@
58152 #include <linux/seqlock.h>
58153
58154 struct fs_struct {
58155 - int users;
58156 + atomic_t users;
58157 spinlock_t lock;
58158 seqcount_t seq;
58159 int umask;
58160 diff -urNp linux-3.0.8/include/linux/ftrace_event.h linux-3.0.8/include/linux/ftrace_event.h
58161 --- linux-3.0.8/include/linux/ftrace_event.h 2011-07-21 22:17:23.000000000 -0400
58162 +++ linux-3.0.8/include/linux/ftrace_event.h 2011-08-23 21:47:56.000000000 -0400
58163 @@ -96,7 +96,7 @@ struct trace_event_functions {
58164 trace_print_func raw;
58165 trace_print_func hex;
58166 trace_print_func binary;
58167 -};
58168 +} __no_const;
58169
58170 struct trace_event {
58171 struct hlist_node node;
58172 @@ -247,7 +247,7 @@ extern int trace_define_field(struct ftr
58173 extern int trace_add_event_call(struct ftrace_event_call *call);
58174 extern void trace_remove_event_call(struct ftrace_event_call *call);
58175
58176 -#define is_signed_type(type) (((type)(-1)) < 0)
58177 +#define is_signed_type(type) (((type)(-1)) < (type)1)
58178
58179 int trace_set_clr_event(const char *system, const char *event, int set);
58180
58181 diff -urNp linux-3.0.8/include/linux/genhd.h linux-3.0.8/include/linux/genhd.h
58182 --- linux-3.0.8/include/linux/genhd.h 2011-07-21 22:17:23.000000000 -0400
58183 +++ linux-3.0.8/include/linux/genhd.h 2011-08-23 21:47:56.000000000 -0400
58184 @@ -184,7 +184,7 @@ struct gendisk {
58185 struct kobject *slave_dir;
58186
58187 struct timer_rand_state *random;
58188 - atomic_t sync_io; /* RAID */
58189 + atomic_unchecked_t sync_io; /* RAID */
58190 struct disk_events *ev;
58191 #ifdef CONFIG_BLK_DEV_INTEGRITY
58192 struct blk_integrity *integrity;
58193 diff -urNp linux-3.0.8/include/linux/gracl.h linux-3.0.8/include/linux/gracl.h
58194 --- linux-3.0.8/include/linux/gracl.h 1969-12-31 19:00:00.000000000 -0500
58195 +++ linux-3.0.8/include/linux/gracl.h 2011-08-23 21:48:14.000000000 -0400
58196 @@ -0,0 +1,317 @@
58197 +#ifndef GR_ACL_H
58198 +#define GR_ACL_H
58199 +
58200 +#include <linux/grdefs.h>
58201 +#include <linux/resource.h>
58202 +#include <linux/capability.h>
58203 +#include <linux/dcache.h>
58204 +#include <asm/resource.h>
58205 +
58206 +/* Major status information */
58207 +
58208 +#define GR_VERSION "grsecurity 2.2.2"
58209 +#define GRSECURITY_VERSION 0x2202
58210 +
58211 +enum {
58212 + GR_SHUTDOWN = 0,
58213 + GR_ENABLE = 1,
58214 + GR_SPROLE = 2,
58215 + GR_RELOAD = 3,
58216 + GR_SEGVMOD = 4,
58217 + GR_STATUS = 5,
58218 + GR_UNSPROLE = 6,
58219 + GR_PASSSET = 7,
58220 + GR_SPROLEPAM = 8,
58221 +};
58222 +
58223 +/* Password setup definitions
58224 + * kernel/grhash.c */
58225 +enum {
58226 + GR_PW_LEN = 128,
58227 + GR_SALT_LEN = 16,
58228 + GR_SHA_LEN = 32,
58229 +};
58230 +
58231 +enum {
58232 + GR_SPROLE_LEN = 64,
58233 +};
58234 +
58235 +enum {
58236 + GR_NO_GLOB = 0,
58237 + GR_REG_GLOB,
58238 + GR_CREATE_GLOB
58239 +};
58240 +
58241 +#define GR_NLIMITS 32
58242 +
58243 +/* Begin Data Structures */
58244 +
58245 +struct sprole_pw {
58246 + unsigned char *rolename;
58247 + unsigned char salt[GR_SALT_LEN];
58248 + unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
58249 +};
58250 +
58251 +struct name_entry {
58252 + __u32 key;
58253 + ino_t inode;
58254 + dev_t device;
58255 + char *name;
58256 + __u16 len;
58257 + __u8 deleted;
58258 + struct name_entry *prev;
58259 + struct name_entry *next;
58260 +};
58261 +
58262 +struct inodev_entry {
58263 + struct name_entry *nentry;
58264 + struct inodev_entry *prev;
58265 + struct inodev_entry *next;
58266 +};
58267 +
58268 +struct acl_role_db {
58269 + struct acl_role_label **r_hash;
58270 + __u32 r_size;
58271 +};
58272 +
58273 +struct inodev_db {
58274 + struct inodev_entry **i_hash;
58275 + __u32 i_size;
58276 +};
58277 +
58278 +struct name_db {
58279 + struct name_entry **n_hash;
58280 + __u32 n_size;
58281 +};
58282 +
58283 +struct crash_uid {
58284 + uid_t uid;
58285 + unsigned long expires;
58286 +};
58287 +
58288 +struct gr_hash_struct {
58289 + void **table;
58290 + void **nametable;
58291 + void *first;
58292 + __u32 table_size;
58293 + __u32 used_size;
58294 + int type;
58295 +};
58296 +
58297 +/* Userspace Grsecurity ACL data structures */
58298 +
58299 +struct acl_subject_label {
58300 + char *filename;
58301 + ino_t inode;
58302 + dev_t device;
58303 + __u32 mode;
58304 + kernel_cap_t cap_mask;
58305 + kernel_cap_t cap_lower;
58306 + kernel_cap_t cap_invert_audit;
58307 +
58308 + struct rlimit res[GR_NLIMITS];
58309 + __u32 resmask;
58310 +
58311 + __u8 user_trans_type;
58312 + __u8 group_trans_type;
58313 + uid_t *user_transitions;
58314 + gid_t *group_transitions;
58315 + __u16 user_trans_num;
58316 + __u16 group_trans_num;
58317 +
58318 + __u32 sock_families[2];
58319 + __u32 ip_proto[8];
58320 + __u32 ip_type;
58321 + struct acl_ip_label **ips;
58322 + __u32 ip_num;
58323 + __u32 inaddr_any_override;
58324 +
58325 + __u32 crashes;
58326 + unsigned long expires;
58327 +
58328 + struct acl_subject_label *parent_subject;
58329 + struct gr_hash_struct *hash;
58330 + struct acl_subject_label *prev;
58331 + struct acl_subject_label *next;
58332 +
58333 + struct acl_object_label **obj_hash;
58334 + __u32 obj_hash_size;
58335 + __u16 pax_flags;
58336 +};
58337 +
58338 +struct role_allowed_ip {
58339 + __u32 addr;
58340 + __u32 netmask;
58341 +
58342 + struct role_allowed_ip *prev;
58343 + struct role_allowed_ip *next;
58344 +};
58345 +
58346 +struct role_transition {
58347 + char *rolename;
58348 +
58349 + struct role_transition *prev;
58350 + struct role_transition *next;
58351 +};
58352 +
58353 +struct acl_role_label {
58354 + char *rolename;
58355 + uid_t uidgid;
58356 + __u16 roletype;
58357 +
58358 + __u16 auth_attempts;
58359 + unsigned long expires;
58360 +
58361 + struct acl_subject_label *root_label;
58362 + struct gr_hash_struct *hash;
58363 +
58364 + struct acl_role_label *prev;
58365 + struct acl_role_label *next;
58366 +
58367 + struct role_transition *transitions;
58368 + struct role_allowed_ip *allowed_ips;
58369 + uid_t *domain_children;
58370 + __u16 domain_child_num;
58371 +
58372 + struct acl_subject_label **subj_hash;
58373 + __u32 subj_hash_size;
58374 +};
58375 +
58376 +struct user_acl_role_db {
58377 + struct acl_role_label **r_table;
58378 + __u32 num_pointers; /* Number of allocations to track */
58379 + __u32 num_roles; /* Number of roles */
58380 + __u32 num_domain_children; /* Number of domain children */
58381 + __u32 num_subjects; /* Number of subjects */
58382 + __u32 num_objects; /* Number of objects */
58383 +};
58384 +
58385 +struct acl_object_label {
58386 + char *filename;
58387 + ino_t inode;
58388 + dev_t device;
58389 + __u32 mode;
58390 +
58391 + struct acl_subject_label *nested;
58392 + struct acl_object_label *globbed;
58393 +
58394 + /* next two structures not used */
58395 +
58396 + struct acl_object_label *prev;
58397 + struct acl_object_label *next;
58398 +};
58399 +
58400 +struct acl_ip_label {
58401 + char *iface;
58402 + __u32 addr;
58403 + __u32 netmask;
58404 + __u16 low, high;
58405 + __u8 mode;
58406 + __u32 type;
58407 + __u32 proto[8];
58408 +
58409 + /* next two structures not used */
58410 +
58411 + struct acl_ip_label *prev;
58412 + struct acl_ip_label *next;
58413 +};
58414 +
58415 +struct gr_arg {
58416 + struct user_acl_role_db role_db;
58417 + unsigned char pw[GR_PW_LEN];
58418 + unsigned char salt[GR_SALT_LEN];
58419 + unsigned char sum[GR_SHA_LEN];
58420 + unsigned char sp_role[GR_SPROLE_LEN];
58421 + struct sprole_pw *sprole_pws;
58422 + dev_t segv_device;
58423 + ino_t segv_inode;
58424 + uid_t segv_uid;
58425 + __u16 num_sprole_pws;
58426 + __u16 mode;
58427 +};
58428 +
58429 +struct gr_arg_wrapper {
58430 + struct gr_arg *arg;
58431 + __u32 version;
58432 + __u32 size;
58433 +};
58434 +
58435 +struct subject_map {
58436 + struct acl_subject_label *user;
58437 + struct acl_subject_label *kernel;
58438 + struct subject_map *prev;
58439 + struct subject_map *next;
58440 +};
58441 +
58442 +struct acl_subj_map_db {
58443 + struct subject_map **s_hash;
58444 + __u32 s_size;
58445 +};
58446 +
58447 +/* End Data Structures Section */
58448 +
58449 +/* Hash functions generated by empirical testing by Brad Spengler
58450 + Makes good use of the low bits of the inode. Generally 0-1 times
58451 + in loop for successful match. 0-3 for unsuccessful match.
58452 + Shift/add algorithm with modulus of table size and an XOR*/
58453 +
58454 +static __inline__ unsigned int
58455 +rhash(const uid_t uid, const __u16 type, const unsigned int sz)
58456 +{
58457 + return ((((uid + type) << (16 + type)) ^ uid) % sz);
58458 +}
58459 +
58460 + static __inline__ unsigned int
58461 +shash(const struct acl_subject_label *userp, const unsigned int sz)
58462 +{
58463 + return ((const unsigned long)userp % sz);
58464 +}
58465 +
58466 +static __inline__ unsigned int
58467 +fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
58468 +{
58469 + return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
58470 +}
58471 +
58472 +static __inline__ unsigned int
58473 +nhash(const char *name, const __u16 len, const unsigned int sz)
58474 +{
58475 + return full_name_hash((const unsigned char *)name, len) % sz;
58476 +}
58477 +
58478 +#define FOR_EACH_ROLE_START(role) \
58479 + role = role_list; \
58480 + while (role) {
58481 +
58482 +#define FOR_EACH_ROLE_END(role) \
58483 + role = role->prev; \
58484 + }
58485 +
58486 +#define FOR_EACH_SUBJECT_START(role,subj,iter) \
58487 + subj = NULL; \
58488 + iter = 0; \
58489 + while (iter < role->subj_hash_size) { \
58490 + if (subj == NULL) \
58491 + subj = role->subj_hash[iter]; \
58492 + if (subj == NULL) { \
58493 + iter++; \
58494 + continue; \
58495 + }
58496 +
58497 +#define FOR_EACH_SUBJECT_END(subj,iter) \
58498 + subj = subj->next; \
58499 + if (subj == NULL) \
58500 + iter++; \
58501 + }
58502 +
58503 +
58504 +#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
58505 + subj = role->hash->first; \
58506 + while (subj != NULL) {
58507 +
58508 +#define FOR_EACH_NESTED_SUBJECT_END(subj) \
58509 + subj = subj->next; \
58510 + }
58511 +
58512 +#endif
58513 +
58514 diff -urNp linux-3.0.8/include/linux/gralloc.h linux-3.0.8/include/linux/gralloc.h
58515 --- linux-3.0.8/include/linux/gralloc.h 1969-12-31 19:00:00.000000000 -0500
58516 +++ linux-3.0.8/include/linux/gralloc.h 2011-08-23 21:48:14.000000000 -0400
58517 @@ -0,0 +1,9 @@
58518 +#ifndef __GRALLOC_H
58519 +#define __GRALLOC_H
58520 +
58521 +void acl_free_all(void);
58522 +int acl_alloc_stack_init(unsigned long size);
58523 +void *acl_alloc(unsigned long len);
58524 +void *acl_alloc_num(unsigned long num, unsigned long len);
58525 +
58526 +#endif
58527 diff -urNp linux-3.0.8/include/linux/grdefs.h linux-3.0.8/include/linux/grdefs.h
58528 --- linux-3.0.8/include/linux/grdefs.h 1969-12-31 19:00:00.000000000 -0500
58529 +++ linux-3.0.8/include/linux/grdefs.h 2011-08-23 21:48:14.000000000 -0400
58530 @@ -0,0 +1,140 @@
58531 +#ifndef GRDEFS_H
58532 +#define GRDEFS_H
58533 +
58534 +/* Begin grsecurity status declarations */
58535 +
58536 +enum {
58537 + GR_READY = 0x01,
58538 + GR_STATUS_INIT = 0x00 // disabled state
58539 +};
58540 +
58541 +/* Begin ACL declarations */
58542 +
58543 +/* Role flags */
58544 +
58545 +enum {
58546 + GR_ROLE_USER = 0x0001,
58547 + GR_ROLE_GROUP = 0x0002,
58548 + GR_ROLE_DEFAULT = 0x0004,
58549 + GR_ROLE_SPECIAL = 0x0008,
58550 + GR_ROLE_AUTH = 0x0010,
58551 + GR_ROLE_NOPW = 0x0020,
58552 + GR_ROLE_GOD = 0x0040,
58553 + GR_ROLE_LEARN = 0x0080,
58554 + GR_ROLE_TPE = 0x0100,
58555 + GR_ROLE_DOMAIN = 0x0200,
58556 + GR_ROLE_PAM = 0x0400,
58557 + GR_ROLE_PERSIST = 0x0800
58558 +};
58559 +
58560 +/* ACL Subject and Object mode flags */
58561 +enum {
58562 + GR_DELETED = 0x80000000
58563 +};
58564 +
58565 +/* ACL Object-only mode flags */
58566 +enum {
58567 + GR_READ = 0x00000001,
58568 + GR_APPEND = 0x00000002,
58569 + GR_WRITE = 0x00000004,
58570 + GR_EXEC = 0x00000008,
58571 + GR_FIND = 0x00000010,
58572 + GR_INHERIT = 0x00000020,
58573 + GR_SETID = 0x00000040,
58574 + GR_CREATE = 0x00000080,
58575 + GR_DELETE = 0x00000100,
58576 + GR_LINK = 0x00000200,
58577 + GR_AUDIT_READ = 0x00000400,
58578 + GR_AUDIT_APPEND = 0x00000800,
58579 + GR_AUDIT_WRITE = 0x00001000,
58580 + GR_AUDIT_EXEC = 0x00002000,
58581 + GR_AUDIT_FIND = 0x00004000,
58582 + GR_AUDIT_INHERIT= 0x00008000,
58583 + GR_AUDIT_SETID = 0x00010000,
58584 + GR_AUDIT_CREATE = 0x00020000,
58585 + GR_AUDIT_DELETE = 0x00040000,
58586 + GR_AUDIT_LINK = 0x00080000,
58587 + GR_PTRACERD = 0x00100000,
58588 + GR_NOPTRACE = 0x00200000,
58589 + GR_SUPPRESS = 0x00400000,
58590 + GR_NOLEARN = 0x00800000,
58591 + GR_INIT_TRANSFER= 0x01000000
58592 +};
58593 +
58594 +#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
58595 + GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
58596 + GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
58597 +
58598 +/* ACL subject-only mode flags */
58599 +enum {
58600 + GR_KILL = 0x00000001,
58601 + GR_VIEW = 0x00000002,
58602 + GR_PROTECTED = 0x00000004,
58603 + GR_LEARN = 0x00000008,
58604 + GR_OVERRIDE = 0x00000010,
58605 + /* just a placeholder, this mode is only used in userspace */
58606 + GR_DUMMY = 0x00000020,
58607 + GR_PROTSHM = 0x00000040,
58608 + GR_KILLPROC = 0x00000080,
58609 + GR_KILLIPPROC = 0x00000100,
58610 + /* just a placeholder, this mode is only used in userspace */
58611 + GR_NOTROJAN = 0x00000200,
58612 + GR_PROTPROCFD = 0x00000400,
58613 + GR_PROCACCT = 0x00000800,
58614 + GR_RELAXPTRACE = 0x00001000,
58615 + GR_NESTED = 0x00002000,
58616 + GR_INHERITLEARN = 0x00004000,
58617 + GR_PROCFIND = 0x00008000,
58618 + GR_POVERRIDE = 0x00010000,
58619 + GR_KERNELAUTH = 0x00020000,
58620 + GR_ATSECURE = 0x00040000,
58621 + GR_SHMEXEC = 0x00080000
58622 +};
58623 +
58624 +enum {
58625 + GR_PAX_ENABLE_SEGMEXEC = 0x0001,
58626 + GR_PAX_ENABLE_PAGEEXEC = 0x0002,
58627 + GR_PAX_ENABLE_MPROTECT = 0x0004,
58628 + GR_PAX_ENABLE_RANDMMAP = 0x0008,
58629 + GR_PAX_ENABLE_EMUTRAMP = 0x0010,
58630 + GR_PAX_DISABLE_SEGMEXEC = 0x0100,
58631 + GR_PAX_DISABLE_PAGEEXEC = 0x0200,
58632 + GR_PAX_DISABLE_MPROTECT = 0x0400,
58633 + GR_PAX_DISABLE_RANDMMAP = 0x0800,
58634 + GR_PAX_DISABLE_EMUTRAMP = 0x1000,
58635 +};
58636 +
58637 +enum {
58638 + GR_ID_USER = 0x01,
58639 + GR_ID_GROUP = 0x02,
58640 +};
58641 +
58642 +enum {
58643 + GR_ID_ALLOW = 0x01,
58644 + GR_ID_DENY = 0x02,
58645 +};
58646 +
58647 +#define GR_CRASH_RES 31
58648 +#define GR_UIDTABLE_MAX 500
58649 +
58650 +/* begin resource learning section */
58651 +enum {
58652 + GR_RLIM_CPU_BUMP = 60,
58653 + GR_RLIM_FSIZE_BUMP = 50000,
58654 + GR_RLIM_DATA_BUMP = 10000,
58655 + GR_RLIM_STACK_BUMP = 1000,
58656 + GR_RLIM_CORE_BUMP = 10000,
58657 + GR_RLIM_RSS_BUMP = 500000,
58658 + GR_RLIM_NPROC_BUMP = 1,
58659 + GR_RLIM_NOFILE_BUMP = 5,
58660 + GR_RLIM_MEMLOCK_BUMP = 50000,
58661 + GR_RLIM_AS_BUMP = 500000,
58662 + GR_RLIM_LOCKS_BUMP = 2,
58663 + GR_RLIM_SIGPENDING_BUMP = 5,
58664 + GR_RLIM_MSGQUEUE_BUMP = 10000,
58665 + GR_RLIM_NICE_BUMP = 1,
58666 + GR_RLIM_RTPRIO_BUMP = 1,
58667 + GR_RLIM_RTTIME_BUMP = 1000000
58668 +};
58669 +
58670 +#endif
58671 diff -urNp linux-3.0.8/include/linux/grinternal.h linux-3.0.8/include/linux/grinternal.h
58672 --- linux-3.0.8/include/linux/grinternal.h 1969-12-31 19:00:00.000000000 -0500
58673 +++ linux-3.0.8/include/linux/grinternal.h 2011-10-20 00:47:28.000000000 -0400
58674 @@ -0,0 +1,220 @@
58675 +#ifndef __GRINTERNAL_H
58676 +#define __GRINTERNAL_H
58677 +
58678 +#ifdef CONFIG_GRKERNSEC
58679 +
58680 +#include <linux/fs.h>
58681 +#include <linux/mnt_namespace.h>
58682 +#include <linux/nsproxy.h>
58683 +#include <linux/gracl.h>
58684 +#include <linux/grdefs.h>
58685 +#include <linux/grmsg.h>
58686 +
58687 +void gr_add_learn_entry(const char *fmt, ...)
58688 + __attribute__ ((format (printf, 1, 2)));
58689 +__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
58690 + const struct vfsmount *mnt);
58691 +__u32 gr_check_create(const struct dentry *new_dentry,
58692 + const struct dentry *parent,
58693 + const struct vfsmount *mnt, const __u32 mode);
58694 +int gr_check_protected_task(const struct task_struct *task);
58695 +__u32 to_gr_audit(const __u32 reqmode);
58696 +int gr_set_acls(const int type);
58697 +int gr_apply_subject_to_task(struct task_struct *task);
58698 +int gr_acl_is_enabled(void);
58699 +char gr_roletype_to_char(void);
58700 +
58701 +void gr_handle_alertkill(struct task_struct *task);
58702 +char *gr_to_filename(const struct dentry *dentry,
58703 + const struct vfsmount *mnt);
58704 +char *gr_to_filename1(const struct dentry *dentry,
58705 + const struct vfsmount *mnt);
58706 +char *gr_to_filename2(const struct dentry *dentry,
58707 + const struct vfsmount *mnt);
58708 +char *gr_to_filename3(const struct dentry *dentry,
58709 + const struct vfsmount *mnt);
58710 +
58711 +extern int grsec_enable_harden_ptrace;
58712 +extern int grsec_enable_link;
58713 +extern int grsec_enable_fifo;
58714 +extern int grsec_enable_execve;
58715 +extern int grsec_enable_shm;
58716 +extern int grsec_enable_execlog;
58717 +extern int grsec_enable_signal;
58718 +extern int grsec_enable_audit_ptrace;
58719 +extern int grsec_enable_forkfail;
58720 +extern int grsec_enable_time;
58721 +extern int grsec_enable_rofs;
58722 +extern int grsec_enable_chroot_shmat;
58723 +extern int grsec_enable_chroot_mount;
58724 +extern int grsec_enable_chroot_double;
58725 +extern int grsec_enable_chroot_pivot;
58726 +extern int grsec_enable_chroot_chdir;
58727 +extern int grsec_enable_chroot_chmod;
58728 +extern int grsec_enable_chroot_mknod;
58729 +extern int grsec_enable_chroot_fchdir;
58730 +extern int grsec_enable_chroot_nice;
58731 +extern int grsec_enable_chroot_execlog;
58732 +extern int grsec_enable_chroot_caps;
58733 +extern int grsec_enable_chroot_sysctl;
58734 +extern int grsec_enable_chroot_unix;
58735 +extern int grsec_enable_tpe;
58736 +extern int grsec_tpe_gid;
58737 +extern int grsec_enable_tpe_all;
58738 +extern int grsec_enable_tpe_invert;
58739 +extern int grsec_enable_socket_all;
58740 +extern int grsec_socket_all_gid;
58741 +extern int grsec_enable_socket_client;
58742 +extern int grsec_socket_client_gid;
58743 +extern int grsec_enable_socket_server;
58744 +extern int grsec_socket_server_gid;
58745 +extern int grsec_audit_gid;
58746 +extern int grsec_enable_group;
58747 +extern int grsec_enable_audit_textrel;
58748 +extern int grsec_enable_log_rwxmaps;
58749 +extern int grsec_enable_mount;
58750 +extern int grsec_enable_chdir;
58751 +extern int grsec_resource_logging;
58752 +extern int grsec_enable_blackhole;
58753 +extern int grsec_lastack_retries;
58754 +extern int grsec_enable_brute;
58755 +extern int grsec_lock;
58756 +
58757 +extern spinlock_t grsec_alert_lock;
58758 +extern unsigned long grsec_alert_wtime;
58759 +extern unsigned long grsec_alert_fyet;
58760 +
58761 +extern spinlock_t grsec_audit_lock;
58762 +
58763 +extern rwlock_t grsec_exec_file_lock;
58764 +
58765 +#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
58766 + gr_to_filename2((tsk)->exec_file->f_path.dentry, \
58767 + (tsk)->exec_file->f_vfsmnt) : "/")
58768 +
58769 +#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
58770 + gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
58771 + (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
58772 +
58773 +#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
58774 + gr_to_filename((tsk)->exec_file->f_path.dentry, \
58775 + (tsk)->exec_file->f_vfsmnt) : "/")
58776 +
58777 +#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
58778 + gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
58779 + (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
58780 +
58781 +#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
58782 +
58783 +#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
58784 +
58785 +#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
58786 + (task)->pid, (cred)->uid, \
58787 + (cred)->euid, (cred)->gid, (cred)->egid, \
58788 + gr_parent_task_fullpath(task), \
58789 + (task)->real_parent->comm, (task)->real_parent->pid, \
58790 + (pcred)->uid, (pcred)->euid, \
58791 + (pcred)->gid, (pcred)->egid
58792 +
58793 +#define GR_CHROOT_CAPS {{ \
58794 + CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
58795 + CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
58796 + CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
58797 + CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
58798 + CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
58799 + CAP_TO_MASK(CAP_IPC_OWNER) | CAP_TO_MASK(CAP_SETFCAP), \
58800 + CAP_TO_MASK(CAP_SYSLOG) | CAP_TO_MASK(CAP_MAC_ADMIN) }}
58801 +
58802 +#define security_learn(normal_msg,args...) \
58803 +({ \
58804 + read_lock(&grsec_exec_file_lock); \
58805 + gr_add_learn_entry(normal_msg "\n", ## args); \
58806 + read_unlock(&grsec_exec_file_lock); \
58807 +})
58808 +
58809 +enum {
58810 + GR_DO_AUDIT,
58811 + GR_DONT_AUDIT,
58812 + /* used for non-audit messages that we shouldn't kill the task on */
58813 + GR_DONT_AUDIT_GOOD
58814 +};
58815 +
58816 +enum {
58817 + GR_TTYSNIFF,
58818 + GR_RBAC,
58819 + GR_RBAC_STR,
58820 + GR_STR_RBAC,
58821 + GR_RBAC_MODE2,
58822 + GR_RBAC_MODE3,
58823 + GR_FILENAME,
58824 + GR_SYSCTL_HIDDEN,
58825 + GR_NOARGS,
58826 + GR_ONE_INT,
58827 + GR_ONE_INT_TWO_STR,
58828 + GR_ONE_STR,
58829 + GR_STR_INT,
58830 + GR_TWO_STR_INT,
58831 + GR_TWO_INT,
58832 + GR_TWO_U64,
58833 + GR_THREE_INT,
58834 + GR_FIVE_INT_TWO_STR,
58835 + GR_TWO_STR,
58836 + GR_THREE_STR,
58837 + GR_FOUR_STR,
58838 + GR_STR_FILENAME,
58839 + GR_FILENAME_STR,
58840 + GR_FILENAME_TWO_INT,
58841 + GR_FILENAME_TWO_INT_STR,
58842 + GR_TEXTREL,
58843 + GR_PTRACE,
58844 + GR_RESOURCE,
58845 + GR_CAP,
58846 + GR_SIG,
58847 + GR_SIG2,
58848 + GR_CRASH1,
58849 + GR_CRASH2,
58850 + GR_PSACCT,
58851 + GR_RWXMAP
58852 +};
58853 +
58854 +#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
58855 +#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
58856 +#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
58857 +#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
58858 +#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
58859 +#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
58860 +#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
58861 +#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
58862 +#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
58863 +#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
58864 +#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
58865 +#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
58866 +#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
58867 +#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
58868 +#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
58869 +#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
58870 +#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
58871 +#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
58872 +#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
58873 +#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
58874 +#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
58875 +#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
58876 +#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
58877 +#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
58878 +#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
58879 +#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
58880 +#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
58881 +#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
58882 +#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
58883 +#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
58884 +#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
58885 +#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
58886 +#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
58887 +#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
58888 +#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
58889 +
58890 +void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
58891 +
58892 +#endif
58893 +
58894 +#endif
58895 diff -urNp linux-3.0.8/include/linux/grmsg.h linux-3.0.8/include/linux/grmsg.h
58896 --- linux-3.0.8/include/linux/grmsg.h 1969-12-31 19:00:00.000000000 -0500
58897 +++ linux-3.0.8/include/linux/grmsg.h 2011-09-14 09:16:54.000000000 -0400
58898 @@ -0,0 +1,108 @@
58899 +#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
58900 +#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
58901 +#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
58902 +#define GR_STOPMOD_MSG "denied modification of module state by "
58903 +#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
58904 +#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
58905 +#define GR_IOPERM_MSG "denied use of ioperm() by "
58906 +#define GR_IOPL_MSG "denied use of iopl() by "
58907 +#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
58908 +#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
58909 +#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
58910 +#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
58911 +#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
58912 +#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
58913 +#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
58914 +#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
58915 +#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
58916 +#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
58917 +#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
58918 +#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
58919 +#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
58920 +#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
58921 +#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
58922 +#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
58923 +#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
58924 +#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
58925 +#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
58926 +#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
58927 +#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
58928 +#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
58929 +#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
58930 +#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
58931 +#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
58932 +#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
58933 +#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
58934 +#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
58935 +#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
58936 +#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
58937 +#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
58938 +#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
58939 +#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
58940 +#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
58941 +#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
58942 +#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
58943 +#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
58944 +#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
58945 +#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
58946 +#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
58947 +#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
58948 +#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
58949 +#define GR_INITF_ACL_MSG "init_variables() failed %s by "
58950 +#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
58951 +#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
58952 +#define GR_SHUTS_ACL_MSG "shutdown auth success for "
58953 +#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
58954 +#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
58955 +#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
58956 +#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
58957 +#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
58958 +#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
58959 +#define GR_ENABLEF_ACL_MSG "unable to load %s for "
58960 +#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
58961 +#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
58962 +#define GR_RELOADF_ACL_MSG "failed reload of %s for "
58963 +#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
58964 +#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
58965 +#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
58966 +#define GR_SPROLEF_ACL_MSG "special role %s failure for "
58967 +#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
58968 +#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
58969 +#define GR_INVMODE_ACL_MSG "invalid mode %d by "
58970 +#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
58971 +#define GR_FAILFORK_MSG "failed fork with errno %s by "
58972 +#define GR_NICE_CHROOT_MSG "denied priority change by "
58973 +#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
58974 +#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
58975 +#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
58976 +#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
58977 +#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
58978 +#define GR_TIME_MSG "time set by "
58979 +#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
58980 +#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
58981 +#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
58982 +#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
58983 +#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
58984 +#define GR_BIND_MSG "denied bind() by "
58985 +#define GR_CONNECT_MSG "denied connect() by "
58986 +#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
58987 +#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
58988 +#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
58989 +#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
58990 +#define GR_CAP_ACL_MSG "use of %s denied for "
58991 +#define GR_CAP_CHROOT_MSG "use of %s in chroot denied for "
58992 +#define GR_CAP_ACL_MSG2 "use of %s permitted for "
58993 +#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
58994 +#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
58995 +#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
58996 +#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
58997 +#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
58998 +#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
58999 +#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
59000 +#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
59001 +#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
59002 +#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
59003 +#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
59004 +#define GR_VM86_MSG "denied use of vm86 by "
59005 +#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
59006 +#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
59007 diff -urNp linux-3.0.8/include/linux/grsecurity.h linux-3.0.8/include/linux/grsecurity.h
59008 --- linux-3.0.8/include/linux/grsecurity.h 1969-12-31 19:00:00.000000000 -0500
59009 +++ linux-3.0.8/include/linux/grsecurity.h 2011-10-17 06:35:30.000000000 -0400
59010 @@ -0,0 +1,228 @@
59011 +#ifndef GR_SECURITY_H
59012 +#define GR_SECURITY_H
59013 +#include <linux/fs.h>
59014 +#include <linux/fs_struct.h>
59015 +#include <linux/binfmts.h>
59016 +#include <linux/gracl.h>
59017 +
59018 +/* notify of brain-dead configs */
59019 +#if defined(CONFIG_GRKERNSEC_PROC_USER) && defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
59020 +#error "CONFIG_GRKERNSEC_PROC_USER and CONFIG_GRKERNSEC_PROC_USERGROUP cannot both be enabled."
59021 +#endif
59022 +#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
59023 +#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
59024 +#endif
59025 +#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
59026 +#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
59027 +#endif
59028 +#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
59029 +#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
59030 +#endif
59031 +#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
59032 +#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
59033 +#endif
59034 +#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
59035 +#error "CONFIG_PAX enabled, but no PaX options are enabled."
59036 +#endif
59037 +
59038 +#include <linux/compat.h>
59039 +
59040 +struct user_arg_ptr {
59041 +#ifdef CONFIG_COMPAT
59042 + bool is_compat;
59043 +#endif
59044 + union {
59045 + const char __user *const __user *native;
59046 +#ifdef CONFIG_COMPAT
59047 + compat_uptr_t __user *compat;
59048 +#endif
59049 + } ptr;
59050 +};
59051 +
59052 +void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
59053 +void gr_handle_brute_check(void);
59054 +void gr_handle_kernel_exploit(void);
59055 +int gr_process_user_ban(void);
59056 +
59057 +char gr_roletype_to_char(void);
59058 +
59059 +int gr_acl_enable_at_secure(void);
59060 +
59061 +int gr_check_user_change(int real, int effective, int fs);
59062 +int gr_check_group_change(int real, int effective, int fs);
59063 +
59064 +void gr_del_task_from_ip_table(struct task_struct *p);
59065 +
59066 +int gr_pid_is_chrooted(struct task_struct *p);
59067 +int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
59068 +int gr_handle_chroot_nice(void);
59069 +int gr_handle_chroot_sysctl(const int op);
59070 +int gr_handle_chroot_setpriority(struct task_struct *p,
59071 + const int niceval);
59072 +int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
59073 +int gr_handle_chroot_chroot(const struct dentry *dentry,
59074 + const struct vfsmount *mnt);
59075 +void gr_handle_chroot_chdir(struct path *path);
59076 +int gr_handle_chroot_chmod(const struct dentry *dentry,
59077 + const struct vfsmount *mnt, const int mode);
59078 +int gr_handle_chroot_mknod(const struct dentry *dentry,
59079 + const struct vfsmount *mnt, const int mode);
59080 +int gr_handle_chroot_mount(const struct dentry *dentry,
59081 + const struct vfsmount *mnt,
59082 + const char *dev_name);
59083 +int gr_handle_chroot_pivot(void);
59084 +int gr_handle_chroot_unix(const pid_t pid);
59085 +
59086 +int gr_handle_rawio(const struct inode *inode);
59087 +
59088 +void gr_handle_ioperm(void);
59089 +void gr_handle_iopl(void);
59090 +
59091 +int gr_tpe_allow(const struct file *file);
59092 +
59093 +void gr_set_chroot_entries(struct task_struct *task, struct path *path);
59094 +void gr_clear_chroot_entries(struct task_struct *task);
59095 +
59096 +void gr_log_forkfail(const int retval);
59097 +void gr_log_timechange(void);
59098 +void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
59099 +void gr_log_chdir(const struct dentry *dentry,
59100 + const struct vfsmount *mnt);
59101 +void gr_log_chroot_exec(const struct dentry *dentry,
59102 + const struct vfsmount *mnt);
59103 +void gr_handle_exec_args(struct linux_binprm *bprm, struct user_arg_ptr argv);
59104 +void gr_log_remount(const char *devname, const int retval);
59105 +void gr_log_unmount(const char *devname, const int retval);
59106 +void gr_log_mount(const char *from, const char *to, const int retval);
59107 +void gr_log_textrel(struct vm_area_struct *vma);
59108 +void gr_log_rwxmmap(struct file *file);
59109 +void gr_log_rwxmprotect(struct file *file);
59110 +
59111 +int gr_handle_follow_link(const struct inode *parent,
59112 + const struct inode *inode,
59113 + const struct dentry *dentry,
59114 + const struct vfsmount *mnt);
59115 +int gr_handle_fifo(const struct dentry *dentry,
59116 + const struct vfsmount *mnt,
59117 + const struct dentry *dir, const int flag,
59118 + const int acc_mode);
59119 +int gr_handle_hardlink(const struct dentry *dentry,
59120 + const struct vfsmount *mnt,
59121 + struct inode *inode,
59122 + const int mode, const char *to);
59123 +
59124 +int gr_is_capable(const int cap);
59125 +int gr_is_capable_nolog(const int cap);
59126 +void gr_learn_resource(const struct task_struct *task, const int limit,
59127 + const unsigned long wanted, const int gt);
59128 +void gr_copy_label(struct task_struct *tsk);
59129 +void gr_handle_crash(struct task_struct *task, const int sig);
59130 +int gr_handle_signal(const struct task_struct *p, const int sig);
59131 +int gr_check_crash_uid(const uid_t uid);
59132 +int gr_check_protected_task(const struct task_struct *task);
59133 +int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
59134 +int gr_acl_handle_mmap(const struct file *file,
59135 + const unsigned long prot);
59136 +int gr_acl_handle_mprotect(const struct file *file,
59137 + const unsigned long prot);
59138 +int gr_check_hidden_task(const struct task_struct *tsk);
59139 +__u32 gr_acl_handle_truncate(const struct dentry *dentry,
59140 + const struct vfsmount *mnt);
59141 +__u32 gr_acl_handle_utime(const struct dentry *dentry,
59142 + const struct vfsmount *mnt);
59143 +__u32 gr_acl_handle_access(const struct dentry *dentry,
59144 + const struct vfsmount *mnt, const int fmode);
59145 +__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
59146 + const struct vfsmount *mnt, mode_t mode);
59147 +__u32 gr_acl_handle_chmod(const struct dentry *dentry,
59148 + const struct vfsmount *mnt, mode_t mode);
59149 +__u32 gr_acl_handle_chown(const struct dentry *dentry,
59150 + const struct vfsmount *mnt);
59151 +__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
59152 + const struct vfsmount *mnt);
59153 +int gr_handle_ptrace(struct task_struct *task, const long request);
59154 +int gr_handle_proc_ptrace(struct task_struct *task);
59155 +__u32 gr_acl_handle_execve(const struct dentry *dentry,
59156 + const struct vfsmount *mnt);
59157 +int gr_check_crash_exec(const struct file *filp);
59158 +int gr_acl_is_enabled(void);
59159 +void gr_set_kernel_label(struct task_struct *task);
59160 +void gr_set_role_label(struct task_struct *task, const uid_t uid,
59161 + const gid_t gid);
59162 +int gr_set_proc_label(const struct dentry *dentry,
59163 + const struct vfsmount *mnt,
59164 + const int unsafe_share);
59165 +__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
59166 + const struct vfsmount *mnt);
59167 +__u32 gr_acl_handle_open(const struct dentry *dentry,
59168 + const struct vfsmount *mnt, const int fmode);
59169 +__u32 gr_acl_handle_creat(const struct dentry *dentry,
59170 + const struct dentry *p_dentry,
59171 + const struct vfsmount *p_mnt, const int fmode,
59172 + const int imode);
59173 +void gr_handle_create(const struct dentry *dentry,
59174 + const struct vfsmount *mnt);
59175 +void gr_handle_proc_create(const struct dentry *dentry,
59176 + const struct inode *inode);
59177 +__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
59178 + const struct dentry *parent_dentry,
59179 + const struct vfsmount *parent_mnt,
59180 + const int mode);
59181 +__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
59182 + const struct dentry *parent_dentry,
59183 + const struct vfsmount *parent_mnt);
59184 +__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
59185 + const struct vfsmount *mnt);
59186 +void gr_handle_delete(const ino_t ino, const dev_t dev);
59187 +__u32 gr_acl_handle_unlink(const struct dentry *dentry,
59188 + const struct vfsmount *mnt);
59189 +__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
59190 + const struct dentry *parent_dentry,
59191 + const struct vfsmount *parent_mnt,
59192 + const char *from);
59193 +__u32 gr_acl_handle_link(const struct dentry *new_dentry,
59194 + const struct dentry *parent_dentry,
59195 + const struct vfsmount *parent_mnt,
59196 + const struct dentry *old_dentry,
59197 + const struct vfsmount *old_mnt, const char *to);
59198 +int gr_acl_handle_rename(struct dentry *new_dentry,
59199 + struct dentry *parent_dentry,
59200 + const struct vfsmount *parent_mnt,
59201 + struct dentry *old_dentry,
59202 + struct inode *old_parent_inode,
59203 + struct vfsmount *old_mnt, const char *newname);
59204 +void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
59205 + struct dentry *old_dentry,
59206 + struct dentry *new_dentry,
59207 + struct vfsmount *mnt, const __u8 replace);
59208 +__u32 gr_check_link(const struct dentry *new_dentry,
59209 + const struct dentry *parent_dentry,
59210 + const struct vfsmount *parent_mnt,
59211 + const struct dentry *old_dentry,
59212 + const struct vfsmount *old_mnt);
59213 +int gr_acl_handle_filldir(const struct file *file, const char *name,
59214 + const unsigned int namelen, const ino_t ino);
59215 +
59216 +__u32 gr_acl_handle_unix(const struct dentry *dentry,
59217 + const struct vfsmount *mnt);
59218 +void gr_acl_handle_exit(void);
59219 +void gr_acl_handle_psacct(struct task_struct *task, const long code);
59220 +int gr_acl_handle_procpidmem(const struct task_struct *task);
59221 +int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
59222 +int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
59223 +void gr_audit_ptrace(struct task_struct *task);
59224 +dev_t gr_get_dev_from_dentry(struct dentry *dentry);
59225 +
59226 +#ifdef CONFIG_GRKERNSEC
59227 +void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
59228 +void gr_handle_vm86(void);
59229 +void gr_handle_mem_readwrite(u64 from, u64 to);
59230 +
59231 +extern int grsec_enable_dmesg;
59232 +extern int grsec_disable_privio;
59233 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
59234 +extern int grsec_enable_chroot_findtask;
59235 +#endif
59236 +#endif
59237 +
59238 +#endif
59239 diff -urNp linux-3.0.8/include/linux/grsock.h linux-3.0.8/include/linux/grsock.h
59240 --- linux-3.0.8/include/linux/grsock.h 1969-12-31 19:00:00.000000000 -0500
59241 +++ linux-3.0.8/include/linux/grsock.h 2011-08-23 21:48:14.000000000 -0400
59242 @@ -0,0 +1,19 @@
59243 +#ifndef __GRSOCK_H
59244 +#define __GRSOCK_H
59245 +
59246 +extern void gr_attach_curr_ip(const struct sock *sk);
59247 +extern int gr_handle_sock_all(const int family, const int type,
59248 + const int protocol);
59249 +extern int gr_handle_sock_server(const struct sockaddr *sck);
59250 +extern int gr_handle_sock_server_other(const struct sock *sck);
59251 +extern int gr_handle_sock_client(const struct sockaddr *sck);
59252 +extern int gr_search_connect(struct socket * sock,
59253 + struct sockaddr_in * addr);
59254 +extern int gr_search_bind(struct socket * sock,
59255 + struct sockaddr_in * addr);
59256 +extern int gr_search_listen(struct socket * sock);
59257 +extern int gr_search_accept(struct socket * sock);
59258 +extern int gr_search_socket(const int domain, const int type,
59259 + const int protocol);
59260 +
59261 +#endif
59262 diff -urNp linux-3.0.8/include/linux/hid.h linux-3.0.8/include/linux/hid.h
59263 --- linux-3.0.8/include/linux/hid.h 2011-07-21 22:17:23.000000000 -0400
59264 +++ linux-3.0.8/include/linux/hid.h 2011-08-23 21:47:56.000000000 -0400
59265 @@ -675,7 +675,7 @@ struct hid_ll_driver {
59266 unsigned int code, int value);
59267
59268 int (*parse)(struct hid_device *hdev);
59269 -};
59270 +} __no_const;
59271
59272 #define PM_HINT_FULLON 1<<5
59273 #define PM_HINT_NORMAL 1<<1
59274 diff -urNp linux-3.0.8/include/linux/highmem.h linux-3.0.8/include/linux/highmem.h
59275 --- linux-3.0.8/include/linux/highmem.h 2011-07-21 22:17:23.000000000 -0400
59276 +++ linux-3.0.8/include/linux/highmem.h 2011-08-23 21:47:56.000000000 -0400
59277 @@ -185,6 +185,18 @@ static inline void clear_highpage(struct
59278 kunmap_atomic(kaddr, KM_USER0);
59279 }
59280
59281 +static inline void sanitize_highpage(struct page *page)
59282 +{
59283 + void *kaddr;
59284 + unsigned long flags;
59285 +
59286 + local_irq_save(flags);
59287 + kaddr = kmap_atomic(page, KM_CLEARPAGE);
59288 + clear_page(kaddr);
59289 + kunmap_atomic(kaddr, KM_CLEARPAGE);
59290 + local_irq_restore(flags);
59291 +}
59292 +
59293 static inline void zero_user_segments(struct page *page,
59294 unsigned start1, unsigned end1,
59295 unsigned start2, unsigned end2)
59296 diff -urNp linux-3.0.8/include/linux/i2c.h linux-3.0.8/include/linux/i2c.h
59297 --- linux-3.0.8/include/linux/i2c.h 2011-07-21 22:17:23.000000000 -0400
59298 +++ linux-3.0.8/include/linux/i2c.h 2011-08-23 21:47:56.000000000 -0400
59299 @@ -346,6 +346,7 @@ struct i2c_algorithm {
59300 /* To determine what the adapter supports */
59301 u32 (*functionality) (struct i2c_adapter *);
59302 };
59303 +typedef struct i2c_algorithm __no_const i2c_algorithm_no_const;
59304
59305 /*
59306 * i2c_adapter is the structure used to identify a physical i2c bus along
59307 diff -urNp linux-3.0.8/include/linux/i2o.h linux-3.0.8/include/linux/i2o.h
59308 --- linux-3.0.8/include/linux/i2o.h 2011-07-21 22:17:23.000000000 -0400
59309 +++ linux-3.0.8/include/linux/i2o.h 2011-08-23 21:47:56.000000000 -0400
59310 @@ -564,7 +564,7 @@ struct i2o_controller {
59311 struct i2o_device *exec; /* Executive */
59312 #if BITS_PER_LONG == 64
59313 spinlock_t context_list_lock; /* lock for context_list */
59314 - atomic_t context_list_counter; /* needed for unique contexts */
59315 + atomic_unchecked_t context_list_counter; /* needed for unique contexts */
59316 struct list_head context_list; /* list of context id's
59317 and pointers */
59318 #endif
59319 diff -urNp linux-3.0.8/include/linux/init.h linux-3.0.8/include/linux/init.h
59320 --- linux-3.0.8/include/linux/init.h 2011-07-21 22:17:23.000000000 -0400
59321 +++ linux-3.0.8/include/linux/init.h 2011-08-23 21:47:56.000000000 -0400
59322 @@ -293,13 +293,13 @@ void __init parse_early_options(char *cm
59323
59324 /* Each module must use one module_init(). */
59325 #define module_init(initfn) \
59326 - static inline initcall_t __inittest(void) \
59327 + static inline __used initcall_t __inittest(void) \
59328 { return initfn; } \
59329 int init_module(void) __attribute__((alias(#initfn)));
59330
59331 /* This is only required if you want to be unloadable. */
59332 #define module_exit(exitfn) \
59333 - static inline exitcall_t __exittest(void) \
59334 + static inline __used exitcall_t __exittest(void) \
59335 { return exitfn; } \
59336 void cleanup_module(void) __attribute__((alias(#exitfn)));
59337
59338 diff -urNp linux-3.0.8/include/linux/init_task.h linux-3.0.8/include/linux/init_task.h
59339 --- linux-3.0.8/include/linux/init_task.h 2011-07-21 22:17:23.000000000 -0400
59340 +++ linux-3.0.8/include/linux/init_task.h 2011-08-23 21:47:56.000000000 -0400
59341 @@ -126,6 +126,12 @@ extern struct cred init_cred;
59342 # define INIT_PERF_EVENTS(tsk)
59343 #endif
59344
59345 +#ifdef CONFIG_X86
59346 +#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
59347 +#else
59348 +#define INIT_TASK_THREAD_INFO
59349 +#endif
59350 +
59351 /*
59352 * INIT_TASK is used to set up the first task table, touch at
59353 * your own risk!. Base=0, limit=0x1fffff (=2MB)
59354 @@ -164,6 +170,7 @@ extern struct cred init_cred;
59355 RCU_INIT_POINTER(.cred, &init_cred), \
59356 .comm = "swapper", \
59357 .thread = INIT_THREAD, \
59358 + INIT_TASK_THREAD_INFO \
59359 .fs = &init_fs, \
59360 .files = &init_files, \
59361 .signal = &init_signals, \
59362 diff -urNp linux-3.0.8/include/linux/intel-iommu.h linux-3.0.8/include/linux/intel-iommu.h
59363 --- linux-3.0.8/include/linux/intel-iommu.h 2011-07-21 22:17:23.000000000 -0400
59364 +++ linux-3.0.8/include/linux/intel-iommu.h 2011-08-23 21:47:56.000000000 -0400
59365 @@ -296,7 +296,7 @@ struct iommu_flush {
59366 u8 fm, u64 type);
59367 void (*flush_iotlb)(struct intel_iommu *iommu, u16 did, u64 addr,
59368 unsigned int size_order, u64 type);
59369 -};
59370 +} __no_const;
59371
59372 enum {
59373 SR_DMAR_FECTL_REG,
59374 diff -urNp linux-3.0.8/include/linux/interrupt.h linux-3.0.8/include/linux/interrupt.h
59375 --- linux-3.0.8/include/linux/interrupt.h 2011-07-21 22:17:23.000000000 -0400
59376 +++ linux-3.0.8/include/linux/interrupt.h 2011-08-23 21:47:56.000000000 -0400
59377 @@ -422,7 +422,7 @@ enum
59378 /* map softirq index to softirq name. update 'softirq_to_name' in
59379 * kernel/softirq.c when adding a new softirq.
59380 */
59381 -extern char *softirq_to_name[NR_SOFTIRQS];
59382 +extern const char * const softirq_to_name[NR_SOFTIRQS];
59383
59384 /* softirq mask and active fields moved to irq_cpustat_t in
59385 * asm/hardirq.h to get better cache usage. KAO
59386 @@ -430,12 +430,12 @@ extern char *softirq_to_name[NR_SOFTIRQS
59387
59388 struct softirq_action
59389 {
59390 - void (*action)(struct softirq_action *);
59391 + void (*action)(void);
59392 };
59393
59394 asmlinkage void do_softirq(void);
59395 asmlinkage void __do_softirq(void);
59396 -extern void open_softirq(int nr, void (*action)(struct softirq_action *));
59397 +extern void open_softirq(int nr, void (*action)(void));
59398 extern void softirq_init(void);
59399 static inline void __raise_softirq_irqoff(unsigned int nr)
59400 {
59401 diff -urNp linux-3.0.8/include/linux/kallsyms.h linux-3.0.8/include/linux/kallsyms.h
59402 --- linux-3.0.8/include/linux/kallsyms.h 2011-07-21 22:17:23.000000000 -0400
59403 +++ linux-3.0.8/include/linux/kallsyms.h 2011-08-23 21:48:14.000000000 -0400
59404 @@ -15,7 +15,8 @@
59405
59406 struct module;
59407
59408 -#ifdef CONFIG_KALLSYMS
59409 +#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
59410 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
59411 /* Lookup the address for a symbol. Returns 0 if not found. */
59412 unsigned long kallsyms_lookup_name(const char *name);
59413
59414 @@ -99,6 +100,16 @@ static inline int lookup_symbol_attrs(un
59415 /* Stupid that this does nothing, but I didn't create this mess. */
59416 #define __print_symbol(fmt, addr)
59417 #endif /*CONFIG_KALLSYMS*/
59418 +#else /* when included by kallsyms.c, vsnprintf.c, or
59419 + arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
59420 +extern void __print_symbol(const char *fmt, unsigned long address);
59421 +extern int sprint_backtrace(char *buffer, unsigned long address);
59422 +extern int sprint_symbol(char *buffer, unsigned long address);
59423 +const char *kallsyms_lookup(unsigned long addr,
59424 + unsigned long *symbolsize,
59425 + unsigned long *offset,
59426 + char **modname, char *namebuf);
59427 +#endif
59428
59429 /* This macro allows us to keep printk typechecking */
59430 static void __check_printsym_format(const char *fmt, ...)
59431 diff -urNp linux-3.0.8/include/linux/kgdb.h linux-3.0.8/include/linux/kgdb.h
59432 --- linux-3.0.8/include/linux/kgdb.h 2011-07-21 22:17:23.000000000 -0400
59433 +++ linux-3.0.8/include/linux/kgdb.h 2011-08-26 19:49:56.000000000 -0400
59434 @@ -53,7 +53,7 @@ extern int kgdb_connected;
59435 extern int kgdb_io_module_registered;
59436
59437 extern atomic_t kgdb_setting_breakpoint;
59438 -extern atomic_t kgdb_cpu_doing_single_step;
59439 +extern atomic_unchecked_t kgdb_cpu_doing_single_step;
59440
59441 extern struct task_struct *kgdb_usethread;
59442 extern struct task_struct *kgdb_contthread;
59443 @@ -251,7 +251,7 @@ struct kgdb_arch {
59444 void (*disable_hw_break)(struct pt_regs *regs);
59445 void (*remove_all_hw_break)(void);
59446 void (*correct_hw_break)(void);
59447 -};
59448 +} __do_const;
59449
59450 /**
59451 * struct kgdb_io - Describe the interface for an I/O driver to talk with KGDB.
59452 @@ -276,7 +276,7 @@ struct kgdb_io {
59453 void (*pre_exception) (void);
59454 void (*post_exception) (void);
59455 int is_console;
59456 -};
59457 +} __do_const;
59458
59459 extern struct kgdb_arch arch_kgdb_ops;
59460
59461 diff -urNp linux-3.0.8/include/linux/kmod.h linux-3.0.8/include/linux/kmod.h
59462 --- linux-3.0.8/include/linux/kmod.h 2011-07-21 22:17:23.000000000 -0400
59463 +++ linux-3.0.8/include/linux/kmod.h 2011-08-23 21:48:14.000000000 -0400
59464 @@ -34,6 +34,8 @@ extern char modprobe_path[]; /* for sysc
59465 * usually useless though. */
59466 extern int __request_module(bool wait, const char *name, ...) \
59467 __attribute__((format(printf, 2, 3)));
59468 +extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
59469 + __attribute__((format(printf, 3, 4)));
59470 #define request_module(mod...) __request_module(true, mod)
59471 #define request_module_nowait(mod...) __request_module(false, mod)
59472 #define try_then_request_module(x, mod...) \
59473 diff -urNp linux-3.0.8/include/linux/kvm_host.h linux-3.0.8/include/linux/kvm_host.h
59474 --- linux-3.0.8/include/linux/kvm_host.h 2011-07-21 22:17:23.000000000 -0400
59475 +++ linux-3.0.8/include/linux/kvm_host.h 2011-08-23 21:47:56.000000000 -0400
59476 @@ -307,7 +307,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
59477 void vcpu_load(struct kvm_vcpu *vcpu);
59478 void vcpu_put(struct kvm_vcpu *vcpu);
59479
59480 -int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
59481 +int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
59482 struct module *module);
59483 void kvm_exit(void);
59484
59485 @@ -446,7 +446,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
59486 struct kvm_guest_debug *dbg);
59487 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
59488
59489 -int kvm_arch_init(void *opaque);
59490 +int kvm_arch_init(const void *opaque);
59491 void kvm_arch_exit(void);
59492
59493 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
59494 diff -urNp linux-3.0.8/include/linux/libata.h linux-3.0.8/include/linux/libata.h
59495 --- linux-3.0.8/include/linux/libata.h 2011-07-21 22:17:23.000000000 -0400
59496 +++ linux-3.0.8/include/linux/libata.h 2011-08-26 19:49:56.000000000 -0400
59497 @@ -899,7 +899,7 @@ struct ata_port_operations {
59498 * fields must be pointers.
59499 */
59500 const struct ata_port_operations *inherits;
59501 -};
59502 +} __do_const;
59503
59504 struct ata_port_info {
59505 unsigned long flags;
59506 diff -urNp linux-3.0.8/include/linux/mca.h linux-3.0.8/include/linux/mca.h
59507 --- linux-3.0.8/include/linux/mca.h 2011-07-21 22:17:23.000000000 -0400
59508 +++ linux-3.0.8/include/linux/mca.h 2011-08-23 21:47:56.000000000 -0400
59509 @@ -80,7 +80,7 @@ struct mca_bus_accessor_functions {
59510 int region);
59511 void * (*mca_transform_memory)(struct mca_device *,
59512 void *memory);
59513 -};
59514 +} __no_const;
59515
59516 struct mca_bus {
59517 u64 default_dma_mask;
59518 diff -urNp linux-3.0.8/include/linux/memory.h linux-3.0.8/include/linux/memory.h
59519 --- linux-3.0.8/include/linux/memory.h 2011-07-21 22:17:23.000000000 -0400
59520 +++ linux-3.0.8/include/linux/memory.h 2011-08-23 21:47:56.000000000 -0400
59521 @@ -144,7 +144,7 @@ struct memory_accessor {
59522 size_t count);
59523 ssize_t (*write)(struct memory_accessor *, const char *buf,
59524 off_t offset, size_t count);
59525 -};
59526 +} __no_const;
59527
59528 /*
59529 * Kernel text modification mutex, used for code patching. Users of this lock
59530 diff -urNp linux-3.0.8/include/linux/mfd/abx500.h linux-3.0.8/include/linux/mfd/abx500.h
59531 --- linux-3.0.8/include/linux/mfd/abx500.h 2011-07-21 22:17:23.000000000 -0400
59532 +++ linux-3.0.8/include/linux/mfd/abx500.h 2011-08-23 21:47:56.000000000 -0400
59533 @@ -234,6 +234,7 @@ struct abx500_ops {
59534 int (*event_registers_startup_state_get) (struct device *, u8 *);
59535 int (*startup_irq_enabled) (struct device *, unsigned int);
59536 };
59537 +typedef struct abx500_ops __no_const abx500_ops_no_const;
59538
59539 int abx500_register_ops(struct device *core_dev, struct abx500_ops *ops);
59540 void abx500_remove_ops(struct device *dev);
59541 diff -urNp linux-3.0.8/include/linux/mm.h linux-3.0.8/include/linux/mm.h
59542 --- linux-3.0.8/include/linux/mm.h 2011-10-24 08:05:21.000000000 -0400
59543 +++ linux-3.0.8/include/linux/mm.h 2011-08-23 21:47:56.000000000 -0400
59544 @@ -113,7 +113,14 @@ extern unsigned int kobjsize(const void
59545
59546 #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
59547 #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
59548 +
59549 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
59550 +#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
59551 +#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
59552 +#else
59553 #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
59554 +#endif
59555 +
59556 #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
59557 #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
59558
59559 @@ -1009,34 +1016,6 @@ int set_page_dirty(struct page *page);
59560 int set_page_dirty_lock(struct page *page);
59561 int clear_page_dirty_for_io(struct page *page);
59562
59563 -/* Is the vma a continuation of the stack vma above it? */
59564 -static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
59565 -{
59566 - return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
59567 -}
59568 -
59569 -static inline int stack_guard_page_start(struct vm_area_struct *vma,
59570 - unsigned long addr)
59571 -{
59572 - return (vma->vm_flags & VM_GROWSDOWN) &&
59573 - (vma->vm_start == addr) &&
59574 - !vma_growsdown(vma->vm_prev, addr);
59575 -}
59576 -
59577 -/* Is the vma a continuation of the stack vma below it? */
59578 -static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
59579 -{
59580 - return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
59581 -}
59582 -
59583 -static inline int stack_guard_page_end(struct vm_area_struct *vma,
59584 - unsigned long addr)
59585 -{
59586 - return (vma->vm_flags & VM_GROWSUP) &&
59587 - (vma->vm_end == addr) &&
59588 - !vma_growsup(vma->vm_next, addr);
59589 -}
59590 -
59591 extern unsigned long move_page_tables(struct vm_area_struct *vma,
59592 unsigned long old_addr, struct vm_area_struct *new_vma,
59593 unsigned long new_addr, unsigned long len);
59594 @@ -1169,6 +1148,15 @@ struct shrinker {
59595 extern void register_shrinker(struct shrinker *);
59596 extern void unregister_shrinker(struct shrinker *);
59597
59598 +#ifdef CONFIG_MMU
59599 +pgprot_t vm_get_page_prot(vm_flags_t vm_flags);
59600 +#else
59601 +static inline pgprot_t vm_get_page_prot(vm_flags_t vm_flags)
59602 +{
59603 + return __pgprot(0);
59604 +}
59605 +#endif
59606 +
59607 int vma_wants_writenotify(struct vm_area_struct *vma);
59608
59609 extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
59610 @@ -1452,6 +1440,7 @@ out:
59611 }
59612
59613 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
59614 +extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
59615
59616 extern unsigned long do_brk(unsigned long, unsigned long);
59617
59618 @@ -1510,6 +1499,10 @@ extern struct vm_area_struct * find_vma(
59619 extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
59620 struct vm_area_struct **pprev);
59621
59622 +extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
59623 +extern __must_check long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
59624 +extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
59625 +
59626 /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
59627 NULL if none. Assume start_addr < end_addr. */
59628 static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
59629 @@ -1526,15 +1519,6 @@ static inline unsigned long vma_pages(st
59630 return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
59631 }
59632
59633 -#ifdef CONFIG_MMU
59634 -pgprot_t vm_get_page_prot(unsigned long vm_flags);
59635 -#else
59636 -static inline pgprot_t vm_get_page_prot(unsigned long vm_flags)
59637 -{
59638 - return __pgprot(0);
59639 -}
59640 -#endif
59641 -
59642 struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
59643 int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
59644 unsigned long pfn, unsigned long size, pgprot_t);
59645 @@ -1647,7 +1631,7 @@ extern int unpoison_memory(unsigned long
59646 extern int sysctl_memory_failure_early_kill;
59647 extern int sysctl_memory_failure_recovery;
59648 extern void shake_page(struct page *p, int access);
59649 -extern atomic_long_t mce_bad_pages;
59650 +extern atomic_long_unchecked_t mce_bad_pages;
59651 extern int soft_offline_page(struct page *page, int flags);
59652
59653 extern void dump_page(struct page *page);
59654 @@ -1661,5 +1645,11 @@ extern void copy_user_huge_page(struct p
59655 unsigned int pages_per_huge_page);
59656 #endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLBFS */
59657
59658 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
59659 +extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
59660 +#else
59661 +static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
59662 +#endif
59663 +
59664 #endif /* __KERNEL__ */
59665 #endif /* _LINUX_MM_H */
59666 diff -urNp linux-3.0.8/include/linux/mm_types.h linux-3.0.8/include/linux/mm_types.h
59667 --- linux-3.0.8/include/linux/mm_types.h 2011-07-21 22:17:23.000000000 -0400
59668 +++ linux-3.0.8/include/linux/mm_types.h 2011-08-23 21:47:56.000000000 -0400
59669 @@ -184,6 +184,8 @@ struct vm_area_struct {
59670 #ifdef CONFIG_NUMA
59671 struct mempolicy *vm_policy; /* NUMA policy for the VMA */
59672 #endif
59673 +
59674 + struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
59675 };
59676
59677 struct core_thread {
59678 @@ -316,6 +318,24 @@ struct mm_struct {
59679 #ifdef CONFIG_CPUMASK_OFFSTACK
59680 struct cpumask cpumask_allocation;
59681 #endif
59682 +
59683 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
59684 + unsigned long pax_flags;
59685 +#endif
59686 +
59687 +#ifdef CONFIG_PAX_DLRESOLVE
59688 + unsigned long call_dl_resolve;
59689 +#endif
59690 +
59691 +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
59692 + unsigned long call_syscall;
59693 +#endif
59694 +
59695 +#ifdef CONFIG_PAX_ASLR
59696 + unsigned long delta_mmap; /* randomized offset */
59697 + unsigned long delta_stack; /* randomized offset */
59698 +#endif
59699 +
59700 };
59701
59702 static inline void mm_init_cpumask(struct mm_struct *mm)
59703 diff -urNp linux-3.0.8/include/linux/mmu_notifier.h linux-3.0.8/include/linux/mmu_notifier.h
59704 --- linux-3.0.8/include/linux/mmu_notifier.h 2011-07-21 22:17:23.000000000 -0400
59705 +++ linux-3.0.8/include/linux/mmu_notifier.h 2011-08-23 21:47:56.000000000 -0400
59706 @@ -255,12 +255,12 @@ static inline void mmu_notifier_mm_destr
59707 */
59708 #define ptep_clear_flush_notify(__vma, __address, __ptep) \
59709 ({ \
59710 - pte_t __pte; \
59711 + pte_t ___pte; \
59712 struct vm_area_struct *___vma = __vma; \
59713 unsigned long ___address = __address; \
59714 - __pte = ptep_clear_flush(___vma, ___address, __ptep); \
59715 + ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
59716 mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
59717 - __pte; \
59718 + ___pte; \
59719 })
59720
59721 #define pmdp_clear_flush_notify(__vma, __address, __pmdp) \
59722 diff -urNp linux-3.0.8/include/linux/mmzone.h linux-3.0.8/include/linux/mmzone.h
59723 --- linux-3.0.8/include/linux/mmzone.h 2011-07-21 22:17:23.000000000 -0400
59724 +++ linux-3.0.8/include/linux/mmzone.h 2011-08-23 21:47:56.000000000 -0400
59725 @@ -350,7 +350,7 @@ struct zone {
59726 unsigned long flags; /* zone flags, see below */
59727
59728 /* Zone statistics */
59729 - atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
59730 + atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
59731
59732 /*
59733 * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on
59734 diff -urNp linux-3.0.8/include/linux/mod_devicetable.h linux-3.0.8/include/linux/mod_devicetable.h
59735 --- linux-3.0.8/include/linux/mod_devicetable.h 2011-07-21 22:17:23.000000000 -0400
59736 +++ linux-3.0.8/include/linux/mod_devicetable.h 2011-08-23 21:47:56.000000000 -0400
59737 @@ -12,7 +12,7 @@
59738 typedef unsigned long kernel_ulong_t;
59739 #endif
59740
59741 -#define PCI_ANY_ID (~0)
59742 +#define PCI_ANY_ID ((__u16)~0)
59743
59744 struct pci_device_id {
59745 __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
59746 @@ -131,7 +131,7 @@ struct usb_device_id {
59747 #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
59748 #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
59749
59750 -#define HID_ANY_ID (~0)
59751 +#define HID_ANY_ID (~0U)
59752
59753 struct hid_device_id {
59754 __u16 bus;
59755 diff -urNp linux-3.0.8/include/linux/module.h linux-3.0.8/include/linux/module.h
59756 --- linux-3.0.8/include/linux/module.h 2011-07-21 22:17:23.000000000 -0400
59757 +++ linux-3.0.8/include/linux/module.h 2011-08-23 21:47:56.000000000 -0400
59758 @@ -16,6 +16,7 @@
59759 #include <linux/kobject.h>
59760 #include <linux/moduleparam.h>
59761 #include <linux/tracepoint.h>
59762 +#include <linux/fs.h>
59763
59764 #include <linux/percpu.h>
59765 #include <asm/module.h>
59766 @@ -325,19 +326,16 @@ struct module
59767 int (*init)(void);
59768
59769 /* If this is non-NULL, vfree after init() returns */
59770 - void *module_init;
59771 + void *module_init_rx, *module_init_rw;
59772
59773 /* Here is the actual code + data, vfree'd on unload. */
59774 - void *module_core;
59775 + void *module_core_rx, *module_core_rw;
59776
59777 /* Here are the sizes of the init and core sections */
59778 - unsigned int init_size, core_size;
59779 + unsigned int init_size_rw, core_size_rw;
59780
59781 /* The size of the executable code in each section. */
59782 - unsigned int init_text_size, core_text_size;
59783 -
59784 - /* Size of RO sections of the module (text+rodata) */
59785 - unsigned int init_ro_size, core_ro_size;
59786 + unsigned int init_size_rx, core_size_rx;
59787
59788 /* Arch-specific module values */
59789 struct mod_arch_specific arch;
59790 @@ -393,6 +391,10 @@ struct module
59791 #ifdef CONFIG_EVENT_TRACING
59792 struct ftrace_event_call **trace_events;
59793 unsigned int num_trace_events;
59794 + struct file_operations trace_id;
59795 + struct file_operations trace_enable;
59796 + struct file_operations trace_format;
59797 + struct file_operations trace_filter;
59798 #endif
59799 #ifdef CONFIG_FTRACE_MCOUNT_RECORD
59800 unsigned int num_ftrace_callsites;
59801 @@ -443,16 +445,46 @@ bool is_module_address(unsigned long add
59802 bool is_module_percpu_address(unsigned long addr);
59803 bool is_module_text_address(unsigned long addr);
59804
59805 +static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
59806 +{
59807 +
59808 +#ifdef CONFIG_PAX_KERNEXEC
59809 + if (ktla_ktva(addr) >= (unsigned long)start &&
59810 + ktla_ktva(addr) < (unsigned long)start + size)
59811 + return 1;
59812 +#endif
59813 +
59814 + return ((void *)addr >= start && (void *)addr < start + size);
59815 +}
59816 +
59817 +static inline int within_module_core_rx(unsigned long addr, struct module *mod)
59818 +{
59819 + return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
59820 +}
59821 +
59822 +static inline int within_module_core_rw(unsigned long addr, struct module *mod)
59823 +{
59824 + return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
59825 +}
59826 +
59827 +static inline int within_module_init_rx(unsigned long addr, struct module *mod)
59828 +{
59829 + return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
59830 +}
59831 +
59832 +static inline int within_module_init_rw(unsigned long addr, struct module *mod)
59833 +{
59834 + return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
59835 +}
59836 +
59837 static inline int within_module_core(unsigned long addr, struct module *mod)
59838 {
59839 - return (unsigned long)mod->module_core <= addr &&
59840 - addr < (unsigned long)mod->module_core + mod->core_size;
59841 + return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
59842 }
59843
59844 static inline int within_module_init(unsigned long addr, struct module *mod)
59845 {
59846 - return (unsigned long)mod->module_init <= addr &&
59847 - addr < (unsigned long)mod->module_init + mod->init_size;
59848 + return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
59849 }
59850
59851 /* Search for module by name: must hold module_mutex. */
59852 diff -urNp linux-3.0.8/include/linux/moduleloader.h linux-3.0.8/include/linux/moduleloader.h
59853 --- linux-3.0.8/include/linux/moduleloader.h 2011-07-21 22:17:23.000000000 -0400
59854 +++ linux-3.0.8/include/linux/moduleloader.h 2011-08-23 21:47:56.000000000 -0400
59855 @@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
59856 sections. Returns NULL on failure. */
59857 void *module_alloc(unsigned long size);
59858
59859 +#ifdef CONFIG_PAX_KERNEXEC
59860 +void *module_alloc_exec(unsigned long size);
59861 +#else
59862 +#define module_alloc_exec(x) module_alloc(x)
59863 +#endif
59864 +
59865 /* Free memory returned from module_alloc. */
59866 void module_free(struct module *mod, void *module_region);
59867
59868 +#ifdef CONFIG_PAX_KERNEXEC
59869 +void module_free_exec(struct module *mod, void *module_region);
59870 +#else
59871 +#define module_free_exec(x, y) module_free((x), (y))
59872 +#endif
59873 +
59874 /* Apply the given relocation to the (simplified) ELF. Return -error
59875 or 0. */
59876 int apply_relocate(Elf_Shdr *sechdrs,
59877 diff -urNp linux-3.0.8/include/linux/moduleparam.h linux-3.0.8/include/linux/moduleparam.h
59878 --- linux-3.0.8/include/linux/moduleparam.h 2011-07-21 22:17:23.000000000 -0400
59879 +++ linux-3.0.8/include/linux/moduleparam.h 2011-08-23 21:47:56.000000000 -0400
59880 @@ -255,7 +255,7 @@ static inline void __kernel_param_unlock
59881 * @len is usually just sizeof(string).
59882 */
59883 #define module_param_string(name, string, len, perm) \
59884 - static const struct kparam_string __param_string_##name \
59885 + static const struct kparam_string __param_string_##name __used \
59886 = { len, string }; \
59887 __module_param_call(MODULE_PARAM_PREFIX, name, \
59888 &param_ops_string, \
59889 @@ -370,7 +370,7 @@ extern int param_get_invbool(char *buffe
59890 * module_param_named() for why this might be necessary.
59891 */
59892 #define module_param_array_named(name, array, type, nump, perm) \
59893 - static const struct kparam_array __param_arr_##name \
59894 + static const struct kparam_array __param_arr_##name __used \
59895 = { .max = ARRAY_SIZE(array), .num = nump, \
59896 .ops = &param_ops_##type, \
59897 .elemsize = sizeof(array[0]), .elem = array }; \
59898 diff -urNp linux-3.0.8/include/linux/namei.h linux-3.0.8/include/linux/namei.h
59899 --- linux-3.0.8/include/linux/namei.h 2011-07-21 22:17:23.000000000 -0400
59900 +++ linux-3.0.8/include/linux/namei.h 2011-08-23 21:47:56.000000000 -0400
59901 @@ -24,7 +24,7 @@ struct nameidata {
59902 unsigned seq;
59903 int last_type;
59904 unsigned depth;
59905 - char *saved_names[MAX_NESTED_LINKS + 1];
59906 + const char *saved_names[MAX_NESTED_LINKS + 1];
59907
59908 /* Intent data */
59909 union {
59910 @@ -91,12 +91,12 @@ extern int follow_up(struct path *);
59911 extern struct dentry *lock_rename(struct dentry *, struct dentry *);
59912 extern void unlock_rename(struct dentry *, struct dentry *);
59913
59914 -static inline void nd_set_link(struct nameidata *nd, char *path)
59915 +static inline void nd_set_link(struct nameidata *nd, const char *path)
59916 {
59917 nd->saved_names[nd->depth] = path;
59918 }
59919
59920 -static inline char *nd_get_link(struct nameidata *nd)
59921 +static inline const char *nd_get_link(const struct nameidata *nd)
59922 {
59923 return nd->saved_names[nd->depth];
59924 }
59925 diff -urNp linux-3.0.8/include/linux/netdevice.h linux-3.0.8/include/linux/netdevice.h
59926 --- linux-3.0.8/include/linux/netdevice.h 2011-10-24 08:05:21.000000000 -0400
59927 +++ linux-3.0.8/include/linux/netdevice.h 2011-08-23 21:47:56.000000000 -0400
59928 @@ -979,6 +979,7 @@ struct net_device_ops {
59929 int (*ndo_set_features)(struct net_device *dev,
59930 u32 features);
59931 };
59932 +typedef struct net_device_ops __no_const net_device_ops_no_const;
59933
59934 /*
59935 * The DEVICE structure.
59936 diff -urNp linux-3.0.8/include/linux/netfilter/xt_gradm.h linux-3.0.8/include/linux/netfilter/xt_gradm.h
59937 --- linux-3.0.8/include/linux/netfilter/xt_gradm.h 1969-12-31 19:00:00.000000000 -0500
59938 +++ linux-3.0.8/include/linux/netfilter/xt_gradm.h 2011-08-23 21:48:14.000000000 -0400
59939 @@ -0,0 +1,9 @@
59940 +#ifndef _LINUX_NETFILTER_XT_GRADM_H
59941 +#define _LINUX_NETFILTER_XT_GRADM_H 1
59942 +
59943 +struct xt_gradm_mtinfo {
59944 + __u16 flags;
59945 + __u16 invflags;
59946 +};
59947 +
59948 +#endif
59949 diff -urNp linux-3.0.8/include/linux/of_pdt.h linux-3.0.8/include/linux/of_pdt.h
59950 --- linux-3.0.8/include/linux/of_pdt.h 2011-07-21 22:17:23.000000000 -0400
59951 +++ linux-3.0.8/include/linux/of_pdt.h 2011-08-30 06:20:11.000000000 -0400
59952 @@ -32,7 +32,7 @@ struct of_pdt_ops {
59953
59954 /* return 0 on success; fill in 'len' with number of bytes in path */
59955 int (*pkg2path)(phandle node, char *buf, const int buflen, int *len);
59956 -};
59957 +} __no_const;
59958
59959 extern void *prom_early_alloc(unsigned long size);
59960
59961 diff -urNp linux-3.0.8/include/linux/oprofile.h linux-3.0.8/include/linux/oprofile.h
59962 --- linux-3.0.8/include/linux/oprofile.h 2011-07-21 22:17:23.000000000 -0400
59963 +++ linux-3.0.8/include/linux/oprofile.h 2011-08-23 21:47:56.000000000 -0400
59964 @@ -139,9 +139,9 @@ int oprofilefs_create_ulong(struct super
59965 int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
59966 char const * name, ulong * val);
59967
59968 -/** Create a file for read-only access to an atomic_t. */
59969 +/** Create a file for read-only access to an atomic_unchecked_t. */
59970 int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
59971 - char const * name, atomic_t * val);
59972 + char const * name, atomic_unchecked_t * val);
59973
59974 /** create a directory */
59975 struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
59976 diff -urNp linux-3.0.8/include/linux/padata.h linux-3.0.8/include/linux/padata.h
59977 --- linux-3.0.8/include/linux/padata.h 2011-07-21 22:17:23.000000000 -0400
59978 +++ linux-3.0.8/include/linux/padata.h 2011-08-23 21:47:56.000000000 -0400
59979 @@ -129,7 +129,7 @@ struct parallel_data {
59980 struct padata_instance *pinst;
59981 struct padata_parallel_queue __percpu *pqueue;
59982 struct padata_serial_queue __percpu *squeue;
59983 - atomic_t seq_nr;
59984 + atomic_unchecked_t seq_nr;
59985 atomic_t reorder_objects;
59986 atomic_t refcnt;
59987 unsigned int max_seq_nr;
59988 diff -urNp linux-3.0.8/include/linux/perf_event.h linux-3.0.8/include/linux/perf_event.h
59989 --- linux-3.0.8/include/linux/perf_event.h 2011-07-21 22:17:23.000000000 -0400
59990 +++ linux-3.0.8/include/linux/perf_event.h 2011-08-23 21:47:56.000000000 -0400
59991 @@ -761,8 +761,8 @@ struct perf_event {
59992
59993 enum perf_event_active_state state;
59994 unsigned int attach_state;
59995 - local64_t count;
59996 - atomic64_t child_count;
59997 + local64_t count; /* PaX: fix it one day */
59998 + atomic64_unchecked_t child_count;
59999
60000 /*
60001 * These are the total time in nanoseconds that the event
60002 @@ -813,8 +813,8 @@ struct perf_event {
60003 * These accumulate total time (in nanoseconds) that children
60004 * events have been enabled and running, respectively.
60005 */
60006 - atomic64_t child_total_time_enabled;
60007 - atomic64_t child_total_time_running;
60008 + atomic64_unchecked_t child_total_time_enabled;
60009 + atomic64_unchecked_t child_total_time_running;
60010
60011 /*
60012 * Protect attach/detach and child_list:
60013 diff -urNp linux-3.0.8/include/linux/pipe_fs_i.h linux-3.0.8/include/linux/pipe_fs_i.h
60014 --- linux-3.0.8/include/linux/pipe_fs_i.h 2011-07-21 22:17:23.000000000 -0400
60015 +++ linux-3.0.8/include/linux/pipe_fs_i.h 2011-08-23 21:47:56.000000000 -0400
60016 @@ -46,9 +46,9 @@ struct pipe_buffer {
60017 struct pipe_inode_info {
60018 wait_queue_head_t wait;
60019 unsigned int nrbufs, curbuf, buffers;
60020 - unsigned int readers;
60021 - unsigned int writers;
60022 - unsigned int waiting_writers;
60023 + atomic_t readers;
60024 + atomic_t writers;
60025 + atomic_t waiting_writers;
60026 unsigned int r_counter;
60027 unsigned int w_counter;
60028 struct page *tmp_page;
60029 diff -urNp linux-3.0.8/include/linux/pm_runtime.h linux-3.0.8/include/linux/pm_runtime.h
60030 --- linux-3.0.8/include/linux/pm_runtime.h 2011-07-21 22:17:23.000000000 -0400
60031 +++ linux-3.0.8/include/linux/pm_runtime.h 2011-08-23 21:47:56.000000000 -0400
60032 @@ -94,7 +94,7 @@ static inline bool pm_runtime_callbacks_
60033
60034 static inline void pm_runtime_mark_last_busy(struct device *dev)
60035 {
60036 - ACCESS_ONCE(dev->power.last_busy) = jiffies;
60037 + ACCESS_ONCE_RW(dev->power.last_busy) = jiffies;
60038 }
60039
60040 #else /* !CONFIG_PM_RUNTIME */
60041 diff -urNp linux-3.0.8/include/linux/poison.h linux-3.0.8/include/linux/poison.h
60042 --- linux-3.0.8/include/linux/poison.h 2011-07-21 22:17:23.000000000 -0400
60043 +++ linux-3.0.8/include/linux/poison.h 2011-08-23 21:47:56.000000000 -0400
60044 @@ -19,8 +19,8 @@
60045 * under normal circumstances, used to verify that nobody uses
60046 * non-initialized list entries.
60047 */
60048 -#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
60049 -#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
60050 +#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
60051 +#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
60052
60053 /********** include/linux/timer.h **********/
60054 /*
60055 diff -urNp linux-3.0.8/include/linux/preempt.h linux-3.0.8/include/linux/preempt.h
60056 --- linux-3.0.8/include/linux/preempt.h 2011-07-21 22:17:23.000000000 -0400
60057 +++ linux-3.0.8/include/linux/preempt.h 2011-08-23 21:47:56.000000000 -0400
60058 @@ -115,7 +115,7 @@ struct preempt_ops {
60059 void (*sched_in)(struct preempt_notifier *notifier, int cpu);
60060 void (*sched_out)(struct preempt_notifier *notifier,
60061 struct task_struct *next);
60062 -};
60063 +} __no_const;
60064
60065 /**
60066 * preempt_notifier - key for installing preemption notifiers
60067 diff -urNp linux-3.0.8/include/linux/proc_fs.h linux-3.0.8/include/linux/proc_fs.h
60068 --- linux-3.0.8/include/linux/proc_fs.h 2011-07-21 22:17:23.000000000 -0400
60069 +++ linux-3.0.8/include/linux/proc_fs.h 2011-08-23 21:48:14.000000000 -0400
60070 @@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
60071 return proc_create_data(name, mode, parent, proc_fops, NULL);
60072 }
60073
60074 +static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
60075 + struct proc_dir_entry *parent, const struct file_operations *proc_fops)
60076 +{
60077 +#ifdef CONFIG_GRKERNSEC_PROC_USER
60078 + return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
60079 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
60080 + return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
60081 +#else
60082 + return proc_create_data(name, mode, parent, proc_fops, NULL);
60083 +#endif
60084 +}
60085 +
60086 +
60087 static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
60088 mode_t mode, struct proc_dir_entry *base,
60089 read_proc_t *read_proc, void * data)
60090 @@ -258,7 +271,7 @@ union proc_op {
60091 int (*proc_show)(struct seq_file *m,
60092 struct pid_namespace *ns, struct pid *pid,
60093 struct task_struct *task);
60094 -};
60095 +} __no_const;
60096
60097 struct ctl_table_header;
60098 struct ctl_table;
60099 diff -urNp linux-3.0.8/include/linux/ptrace.h linux-3.0.8/include/linux/ptrace.h
60100 --- linux-3.0.8/include/linux/ptrace.h 2011-07-21 22:17:23.000000000 -0400
60101 +++ linux-3.0.8/include/linux/ptrace.h 2011-08-23 21:48:14.000000000 -0400
60102 @@ -115,10 +115,10 @@ extern void __ptrace_unlink(struct task_
60103 extern void exit_ptrace(struct task_struct *tracer);
60104 #define PTRACE_MODE_READ 1
60105 #define PTRACE_MODE_ATTACH 2
60106 -/* Returns 0 on success, -errno on denial. */
60107 -extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
60108 /* Returns true on success, false on denial. */
60109 extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
60110 +/* Returns true on success, false on denial. */
60111 +extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
60112
60113 static inline int ptrace_reparented(struct task_struct *child)
60114 {
60115 diff -urNp linux-3.0.8/include/linux/random.h linux-3.0.8/include/linux/random.h
60116 --- linux-3.0.8/include/linux/random.h 2011-10-24 08:05:21.000000000 -0400
60117 +++ linux-3.0.8/include/linux/random.h 2011-08-23 21:47:56.000000000 -0400
60118 @@ -69,12 +69,17 @@ void srandom32(u32 seed);
60119
60120 u32 prandom32(struct rnd_state *);
60121
60122 +static inline unsigned long pax_get_random_long(void)
60123 +{
60124 + return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
60125 +}
60126 +
60127 /*
60128 * Handle minimum values for seeds
60129 */
60130 static inline u32 __seed(u32 x, u32 m)
60131 {
60132 - return (x < m) ? x + m : x;
60133 + return (x <= m) ? x + m + 1 : x;
60134 }
60135
60136 /**
60137 diff -urNp linux-3.0.8/include/linux/reboot.h linux-3.0.8/include/linux/reboot.h
60138 --- linux-3.0.8/include/linux/reboot.h 2011-07-21 22:17:23.000000000 -0400
60139 +++ linux-3.0.8/include/linux/reboot.h 2011-08-23 21:47:56.000000000 -0400
60140 @@ -47,9 +47,9 @@ extern int unregister_reboot_notifier(st
60141 * Architecture-specific implementations of sys_reboot commands.
60142 */
60143
60144 -extern void machine_restart(char *cmd);
60145 -extern void machine_halt(void);
60146 -extern void machine_power_off(void);
60147 +extern void machine_restart(char *cmd) __noreturn;
60148 +extern void machine_halt(void) __noreturn;
60149 +extern void machine_power_off(void) __noreturn;
60150
60151 extern void machine_shutdown(void);
60152 struct pt_regs;
60153 @@ -60,9 +60,9 @@ extern void machine_crash_shutdown(struc
60154 */
60155
60156 extern void kernel_restart_prepare(char *cmd);
60157 -extern void kernel_restart(char *cmd);
60158 -extern void kernel_halt(void);
60159 -extern void kernel_power_off(void);
60160 +extern void kernel_restart(char *cmd) __noreturn;
60161 +extern void kernel_halt(void) __noreturn;
60162 +extern void kernel_power_off(void) __noreturn;
60163
60164 extern int C_A_D; /* for sysctl */
60165 void ctrl_alt_del(void);
60166 @@ -76,7 +76,7 @@ extern int orderly_poweroff(bool force);
60167 * Emergency restart, callable from an interrupt handler.
60168 */
60169
60170 -extern void emergency_restart(void);
60171 +extern void emergency_restart(void) __noreturn;
60172 #include <asm/emergency-restart.h>
60173
60174 #endif
60175 diff -urNp linux-3.0.8/include/linux/reiserfs_fs.h linux-3.0.8/include/linux/reiserfs_fs.h
60176 --- linux-3.0.8/include/linux/reiserfs_fs.h 2011-07-21 22:17:23.000000000 -0400
60177 +++ linux-3.0.8/include/linux/reiserfs_fs.h 2011-08-23 21:47:56.000000000 -0400
60178 @@ -1406,7 +1406,7 @@ static inline loff_t max_reiserfs_offset
60179 #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
60180
60181 #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
60182 -#define get_generation(s) atomic_read (&fs_generation(s))
60183 +#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
60184 #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
60185 #define __fs_changed(gen,s) (gen != get_generation (s))
60186 #define fs_changed(gen,s) \
60187 diff -urNp linux-3.0.8/include/linux/reiserfs_fs_sb.h linux-3.0.8/include/linux/reiserfs_fs_sb.h
60188 --- linux-3.0.8/include/linux/reiserfs_fs_sb.h 2011-07-21 22:17:23.000000000 -0400
60189 +++ linux-3.0.8/include/linux/reiserfs_fs_sb.h 2011-08-23 21:47:56.000000000 -0400
60190 @@ -386,7 +386,7 @@ struct reiserfs_sb_info {
60191 /* Comment? -Hans */
60192 wait_queue_head_t s_wait;
60193 /* To be obsoleted soon by per buffer seals.. -Hans */
60194 - atomic_t s_generation_counter; // increased by one every time the
60195 + atomic_unchecked_t s_generation_counter; // increased by one every time the
60196 // tree gets re-balanced
60197 unsigned long s_properties; /* File system properties. Currently holds
60198 on-disk FS format */
60199 diff -urNp linux-3.0.8/include/linux/relay.h linux-3.0.8/include/linux/relay.h
60200 --- linux-3.0.8/include/linux/relay.h 2011-07-21 22:17:23.000000000 -0400
60201 +++ linux-3.0.8/include/linux/relay.h 2011-08-23 21:47:56.000000000 -0400
60202 @@ -159,7 +159,7 @@ struct rchan_callbacks
60203 * The callback should return 0 if successful, negative if not.
60204 */
60205 int (*remove_buf_file)(struct dentry *dentry);
60206 -};
60207 +} __no_const;
60208
60209 /*
60210 * CONFIG_RELAY kernel API, kernel/relay.c
60211 diff -urNp linux-3.0.8/include/linux/rfkill.h linux-3.0.8/include/linux/rfkill.h
60212 --- linux-3.0.8/include/linux/rfkill.h 2011-07-21 22:17:23.000000000 -0400
60213 +++ linux-3.0.8/include/linux/rfkill.h 2011-08-23 21:47:56.000000000 -0400
60214 @@ -147,6 +147,7 @@ struct rfkill_ops {
60215 void (*query)(struct rfkill *rfkill, void *data);
60216 int (*set_block)(void *data, bool blocked);
60217 };
60218 +typedef struct rfkill_ops __no_const rfkill_ops_no_const;
60219
60220 #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
60221 /**
60222 diff -urNp linux-3.0.8/include/linux/rmap.h linux-3.0.8/include/linux/rmap.h
60223 --- linux-3.0.8/include/linux/rmap.h 2011-07-21 22:17:23.000000000 -0400
60224 +++ linux-3.0.8/include/linux/rmap.h 2011-08-23 21:47:56.000000000 -0400
60225 @@ -119,8 +119,8 @@ static inline void anon_vma_unlock(struc
60226 void anon_vma_init(void); /* create anon_vma_cachep */
60227 int anon_vma_prepare(struct vm_area_struct *);
60228 void unlink_anon_vmas(struct vm_area_struct *);
60229 -int anon_vma_clone(struct vm_area_struct *, struct vm_area_struct *);
60230 -int anon_vma_fork(struct vm_area_struct *, struct vm_area_struct *);
60231 +int anon_vma_clone(struct vm_area_struct *, const struct vm_area_struct *);
60232 +int anon_vma_fork(struct vm_area_struct *, const struct vm_area_struct *);
60233 void __anon_vma_link(struct vm_area_struct *);
60234
60235 static inline void anon_vma_merge(struct vm_area_struct *vma,
60236 diff -urNp linux-3.0.8/include/linux/sched.h linux-3.0.8/include/linux/sched.h
60237 --- linux-3.0.8/include/linux/sched.h 2011-10-24 08:05:32.000000000 -0400
60238 +++ linux-3.0.8/include/linux/sched.h 2011-10-17 23:17:19.000000000 -0400
60239 @@ -100,6 +100,7 @@ struct bio_list;
60240 struct fs_struct;
60241 struct perf_event_context;
60242 struct blk_plug;
60243 +struct linux_binprm;
60244
60245 /*
60246 * List of flags we want to share for kernel threads,
60247 @@ -380,10 +381,13 @@ struct user_namespace;
60248 #define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
60249
60250 extern int sysctl_max_map_count;
60251 +extern unsigned long sysctl_heap_stack_gap;
60252
60253 #include <linux/aio.h>
60254
60255 #ifdef CONFIG_MMU
60256 +extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len);
60257 +extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len);
60258 extern void arch_pick_mmap_layout(struct mm_struct *mm);
60259 extern unsigned long
60260 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
60261 @@ -629,6 +633,17 @@ struct signal_struct {
60262 #ifdef CONFIG_TASKSTATS
60263 struct taskstats *stats;
60264 #endif
60265 +
60266 +#ifdef CONFIG_GRKERNSEC
60267 + u32 curr_ip;
60268 + u32 saved_ip;
60269 + u32 gr_saddr;
60270 + u32 gr_daddr;
60271 + u16 gr_sport;
60272 + u16 gr_dport;
60273 + u8 used_accept:1;
60274 +#endif
60275 +
60276 #ifdef CONFIG_AUDIT
60277 unsigned audit_tty;
60278 struct tty_audit_buf *tty_audit_buf;
60279 @@ -710,6 +725,11 @@ struct user_struct {
60280 struct key *session_keyring; /* UID's default session keyring */
60281 #endif
60282
60283 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
60284 + unsigned int banned;
60285 + unsigned long ban_expires;
60286 +#endif
60287 +
60288 /* Hash table maintenance information */
60289 struct hlist_node uidhash_node;
60290 uid_t uid;
60291 @@ -1340,8 +1360,8 @@ struct task_struct {
60292 struct list_head thread_group;
60293
60294 struct completion *vfork_done; /* for vfork() */
60295 - int __user *set_child_tid; /* CLONE_CHILD_SETTID */
60296 - int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
60297 + pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
60298 + pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
60299
60300 cputime_t utime, stime, utimescaled, stimescaled;
60301 cputime_t gtime;
60302 @@ -1357,13 +1377,6 @@ struct task_struct {
60303 struct task_cputime cputime_expires;
60304 struct list_head cpu_timers[3];
60305
60306 -/* process credentials */
60307 - const struct cred __rcu *real_cred; /* objective and real subjective task
60308 - * credentials (COW) */
60309 - const struct cred __rcu *cred; /* effective (overridable) subjective task
60310 - * credentials (COW) */
60311 - struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
60312 -
60313 char comm[TASK_COMM_LEN]; /* executable name excluding path
60314 - access with [gs]et_task_comm (which lock
60315 it with task_lock())
60316 @@ -1380,8 +1393,16 @@ struct task_struct {
60317 #endif
60318 /* CPU-specific state of this task */
60319 struct thread_struct thread;
60320 +/* thread_info moved to task_struct */
60321 +#ifdef CONFIG_X86
60322 + struct thread_info tinfo;
60323 +#endif
60324 /* filesystem information */
60325 struct fs_struct *fs;
60326 +
60327 + const struct cred __rcu *cred; /* effective (overridable) subjective task
60328 + * credentials (COW) */
60329 +
60330 /* open file information */
60331 struct files_struct *files;
60332 /* namespaces */
60333 @@ -1428,6 +1449,11 @@ struct task_struct {
60334 struct rt_mutex_waiter *pi_blocked_on;
60335 #endif
60336
60337 +/* process credentials */
60338 + const struct cred __rcu *real_cred; /* objective and real subjective task
60339 + * credentials (COW) */
60340 + struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
60341 +
60342 #ifdef CONFIG_DEBUG_MUTEXES
60343 /* mutex deadlock detection */
60344 struct mutex_waiter *blocked_on;
60345 @@ -1538,6 +1564,21 @@ struct task_struct {
60346 unsigned long default_timer_slack_ns;
60347
60348 struct list_head *scm_work_list;
60349 +
60350 +#ifdef CONFIG_GRKERNSEC
60351 + /* grsecurity */
60352 + struct dentry *gr_chroot_dentry;
60353 + struct acl_subject_label *acl;
60354 + struct acl_role_label *role;
60355 + struct file *exec_file;
60356 + u16 acl_role_id;
60357 + /* is this the task that authenticated to the special role */
60358 + u8 acl_sp_role;
60359 + u8 is_writable;
60360 + u8 brute;
60361 + u8 gr_is_chrooted;
60362 +#endif
60363 +
60364 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
60365 /* Index of current stored address in ret_stack */
60366 int curr_ret_stack;
60367 @@ -1572,6 +1613,57 @@ struct task_struct {
60368 #endif
60369 };
60370
60371 +#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
60372 +#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
60373 +#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
60374 +#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
60375 +/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
60376 +#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
60377 +
60378 +#ifdef CONFIG_PAX_SOFTMODE
60379 +extern int pax_softmode;
60380 +#endif
60381 +
60382 +extern int pax_check_flags(unsigned long *);
60383 +
60384 +/* if tsk != current then task_lock must be held on it */
60385 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
60386 +static inline unsigned long pax_get_flags(struct task_struct *tsk)
60387 +{
60388 + if (likely(tsk->mm))
60389 + return tsk->mm->pax_flags;
60390 + else
60391 + return 0UL;
60392 +}
60393 +
60394 +/* if tsk != current then task_lock must be held on it */
60395 +static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
60396 +{
60397 + if (likely(tsk->mm)) {
60398 + tsk->mm->pax_flags = flags;
60399 + return 0;
60400 + }
60401 + return -EINVAL;
60402 +}
60403 +#endif
60404 +
60405 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
60406 +extern void pax_set_initial_flags(struct linux_binprm *bprm);
60407 +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
60408 +extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
60409 +#endif
60410 +
60411 +extern void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
60412 +extern void pax_report_insns(void *pc, void *sp);
60413 +extern void pax_report_refcount_overflow(struct pt_regs *regs);
60414 +extern NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type) ATTRIB_NORET;
60415 +
60416 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
60417 +extern void pax_track_stack(void);
60418 +#else
60419 +static inline void pax_track_stack(void) {}
60420 +#endif
60421 +
60422 /* Future-safe accessor for struct task_struct's cpus_allowed. */
60423 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
60424
60425 @@ -1768,6 +1860,7 @@ extern void thread_group_times(struct ta
60426 #define PF_DUMPCORE 0x00000200 /* dumped core */
60427 #define PF_SIGNALED 0x00000400 /* killed by a signal */
60428 #define PF_MEMALLOC 0x00000800 /* Allocating memory */
60429 +#define PF_NPROC_EXCEEDED 0x00001000 /* set_user noticed that RLIMIT_NPROC was exceeded */
60430 #define PF_USED_MATH 0x00002000 /* if unset the fpu must be initialized before use */
60431 #define PF_FREEZING 0x00004000 /* freeze in progress. do not account to load */
60432 #define PF_NOFREEZE 0x00008000 /* this thread should not be frozen */
60433 @@ -2055,7 +2148,9 @@ void yield(void);
60434 extern struct exec_domain default_exec_domain;
60435
60436 union thread_union {
60437 +#ifndef CONFIG_X86
60438 struct thread_info thread_info;
60439 +#endif
60440 unsigned long stack[THREAD_SIZE/sizeof(long)];
60441 };
60442
60443 @@ -2088,6 +2183,7 @@ extern struct pid_namespace init_pid_ns;
60444 */
60445
60446 extern struct task_struct *find_task_by_vpid(pid_t nr);
60447 +extern struct task_struct *find_task_by_vpid_unrestricted(pid_t nr);
60448 extern struct task_struct *find_task_by_pid_ns(pid_t nr,
60449 struct pid_namespace *ns);
60450
60451 @@ -2224,7 +2320,7 @@ extern void __cleanup_sighand(struct sig
60452 extern void exit_itimers(struct signal_struct *);
60453 extern void flush_itimer_signals(void);
60454
60455 -extern NORET_TYPE void do_group_exit(int);
60456 +extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
60457
60458 extern void daemonize(const char *, ...);
60459 extern int allow_signal(int);
60460 @@ -2392,13 +2488,17 @@ static inline unsigned long *end_of_stac
60461
60462 #endif
60463
60464 -static inline int object_is_on_stack(void *obj)
60465 +static inline int object_starts_on_stack(void *obj)
60466 {
60467 - void *stack = task_stack_page(current);
60468 + const void *stack = task_stack_page(current);
60469
60470 return (obj >= stack) && (obj < (stack + THREAD_SIZE));
60471 }
60472
60473 +#ifdef CONFIG_PAX_USERCOPY
60474 +extern int object_is_on_stack(const void *obj, unsigned long len);
60475 +#endif
60476 +
60477 extern void thread_info_cache_init(void);
60478
60479 #ifdef CONFIG_DEBUG_STACK_USAGE
60480 diff -urNp linux-3.0.8/include/linux/screen_info.h linux-3.0.8/include/linux/screen_info.h
60481 --- linux-3.0.8/include/linux/screen_info.h 2011-07-21 22:17:23.000000000 -0400
60482 +++ linux-3.0.8/include/linux/screen_info.h 2011-08-23 21:47:56.000000000 -0400
60483 @@ -43,7 +43,8 @@ struct screen_info {
60484 __u16 pages; /* 0x32 */
60485 __u16 vesa_attributes; /* 0x34 */
60486 __u32 capabilities; /* 0x36 */
60487 - __u8 _reserved[6]; /* 0x3a */
60488 + __u16 vesapm_size; /* 0x3a */
60489 + __u8 _reserved[4]; /* 0x3c */
60490 } __attribute__((packed));
60491
60492 #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
60493 diff -urNp linux-3.0.8/include/linux/security.h linux-3.0.8/include/linux/security.h
60494 --- linux-3.0.8/include/linux/security.h 2011-07-21 22:17:23.000000000 -0400
60495 +++ linux-3.0.8/include/linux/security.h 2011-08-23 21:48:14.000000000 -0400
60496 @@ -36,6 +36,7 @@
60497 #include <linux/key.h>
60498 #include <linux/xfrm.h>
60499 #include <linux/slab.h>
60500 +#include <linux/grsecurity.h>
60501 #include <net/flow.h>
60502
60503 /* Maximum number of letters for an LSM name string */
60504 diff -urNp linux-3.0.8/include/linux/seq_file.h linux-3.0.8/include/linux/seq_file.h
60505 --- linux-3.0.8/include/linux/seq_file.h 2011-07-21 22:17:23.000000000 -0400
60506 +++ linux-3.0.8/include/linux/seq_file.h 2011-08-23 21:47:56.000000000 -0400
60507 @@ -32,6 +32,7 @@ struct seq_operations {
60508 void * (*next) (struct seq_file *m, void *v, loff_t *pos);
60509 int (*show) (struct seq_file *m, void *v);
60510 };
60511 +typedef struct seq_operations __no_const seq_operations_no_const;
60512
60513 #define SEQ_SKIP 1
60514
60515 diff -urNp linux-3.0.8/include/linux/shmem_fs.h linux-3.0.8/include/linux/shmem_fs.h
60516 --- linux-3.0.8/include/linux/shmem_fs.h 2011-07-21 22:17:23.000000000 -0400
60517 +++ linux-3.0.8/include/linux/shmem_fs.h 2011-08-23 21:47:56.000000000 -0400
60518 @@ -10,7 +10,7 @@
60519
60520 #define SHMEM_NR_DIRECT 16
60521
60522 -#define SHMEM_SYMLINK_INLINE_LEN (SHMEM_NR_DIRECT * sizeof(swp_entry_t))
60523 +#define SHMEM_SYMLINK_INLINE_LEN 64
60524
60525 struct shmem_inode_info {
60526 spinlock_t lock;
60527 diff -urNp linux-3.0.8/include/linux/shm.h linux-3.0.8/include/linux/shm.h
60528 --- linux-3.0.8/include/linux/shm.h 2011-07-21 22:17:23.000000000 -0400
60529 +++ linux-3.0.8/include/linux/shm.h 2011-08-23 21:48:14.000000000 -0400
60530 @@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
60531 pid_t shm_cprid;
60532 pid_t shm_lprid;
60533 struct user_struct *mlock_user;
60534 +#ifdef CONFIG_GRKERNSEC
60535 + time_t shm_createtime;
60536 + pid_t shm_lapid;
60537 +#endif
60538 };
60539
60540 /* shm_mode upper byte flags */
60541 diff -urNp linux-3.0.8/include/linux/skbuff.h linux-3.0.8/include/linux/skbuff.h
60542 --- linux-3.0.8/include/linux/skbuff.h 2011-07-21 22:17:23.000000000 -0400
60543 +++ linux-3.0.8/include/linux/skbuff.h 2011-08-23 21:47:56.000000000 -0400
60544 @@ -592,7 +592,7 @@ static inline struct skb_shared_hwtstamp
60545 */
60546 static inline int skb_queue_empty(const struct sk_buff_head *list)
60547 {
60548 - return list->next == (struct sk_buff *)list;
60549 + return list->next == (const struct sk_buff *)list;
60550 }
60551
60552 /**
60553 @@ -605,7 +605,7 @@ static inline int skb_queue_empty(const
60554 static inline bool skb_queue_is_last(const struct sk_buff_head *list,
60555 const struct sk_buff *skb)
60556 {
60557 - return skb->next == (struct sk_buff *)list;
60558 + return skb->next == (const struct sk_buff *)list;
60559 }
60560
60561 /**
60562 @@ -618,7 +618,7 @@ static inline bool skb_queue_is_last(con
60563 static inline bool skb_queue_is_first(const struct sk_buff_head *list,
60564 const struct sk_buff *skb)
60565 {
60566 - return skb->prev == (struct sk_buff *)list;
60567 + return skb->prev == (const struct sk_buff *)list;
60568 }
60569
60570 /**
60571 @@ -1440,7 +1440,7 @@ static inline int pskb_network_may_pull(
60572 * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
60573 */
60574 #ifndef NET_SKB_PAD
60575 -#define NET_SKB_PAD max(32, L1_CACHE_BYTES)
60576 +#define NET_SKB_PAD max(_AC(32,UL), L1_CACHE_BYTES)
60577 #endif
60578
60579 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
60580 diff -urNp linux-3.0.8/include/linux/slab_def.h linux-3.0.8/include/linux/slab_def.h
60581 --- linux-3.0.8/include/linux/slab_def.h 2011-07-21 22:17:23.000000000 -0400
60582 +++ linux-3.0.8/include/linux/slab_def.h 2011-08-23 21:47:56.000000000 -0400
60583 @@ -96,10 +96,10 @@ struct kmem_cache {
60584 unsigned long node_allocs;
60585 unsigned long node_frees;
60586 unsigned long node_overflow;
60587 - atomic_t allochit;
60588 - atomic_t allocmiss;
60589 - atomic_t freehit;
60590 - atomic_t freemiss;
60591 + atomic_unchecked_t allochit;
60592 + atomic_unchecked_t allocmiss;
60593 + atomic_unchecked_t freehit;
60594 + atomic_unchecked_t freemiss;
60595
60596 /*
60597 * If debugging is enabled, then the allocator can add additional
60598 diff -urNp linux-3.0.8/include/linux/slab.h linux-3.0.8/include/linux/slab.h
60599 --- linux-3.0.8/include/linux/slab.h 2011-07-21 22:17:23.000000000 -0400
60600 +++ linux-3.0.8/include/linux/slab.h 2011-08-23 21:47:56.000000000 -0400
60601 @@ -11,12 +11,20 @@
60602
60603 #include <linux/gfp.h>
60604 #include <linux/types.h>
60605 +#include <linux/err.h>
60606
60607 /*
60608 * Flags to pass to kmem_cache_create().
60609 * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
60610 */
60611 #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
60612 +
60613 +#ifdef CONFIG_PAX_USERCOPY
60614 +#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
60615 +#else
60616 +#define SLAB_USERCOPY 0x00000000UL
60617 +#endif
60618 +
60619 #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
60620 #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
60621 #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
60622 @@ -87,10 +95,13 @@
60623 * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
60624 * Both make kfree a no-op.
60625 */
60626 -#define ZERO_SIZE_PTR ((void *)16)
60627 +#define ZERO_SIZE_PTR \
60628 +({ \
60629 + BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
60630 + (void *)(-MAX_ERRNO-1L); \
60631 +})
60632
60633 -#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
60634 - (unsigned long)ZERO_SIZE_PTR)
60635 +#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
60636
60637 /*
60638 * struct kmem_cache related prototypes
60639 @@ -141,6 +152,7 @@ void * __must_check krealloc(const void
60640 void kfree(const void *);
60641 void kzfree(const void *);
60642 size_t ksize(const void *);
60643 +void check_object_size(const void *ptr, unsigned long n, bool to);
60644
60645 /*
60646 * Allocator specific definitions. These are mainly used to establish optimized
60647 @@ -333,4 +345,59 @@ static inline void *kzalloc_node(size_t
60648
60649 void __init kmem_cache_init_late(void);
60650
60651 +#define kmalloc(x, y) \
60652 +({ \
60653 + void *___retval; \
60654 + intoverflow_t ___x = (intoverflow_t)x; \
60655 + if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n")) \
60656 + ___retval = NULL; \
60657 + else \
60658 + ___retval = kmalloc((size_t)___x, (y)); \
60659 + ___retval; \
60660 +})
60661 +
60662 +#define kmalloc_node(x, y, z) \
60663 +({ \
60664 + void *___retval; \
60665 + intoverflow_t ___x = (intoverflow_t)x; \
60666 + if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
60667 + ___retval = NULL; \
60668 + else \
60669 + ___retval = kmalloc_node((size_t)___x, (y), (z));\
60670 + ___retval; \
60671 +})
60672 +
60673 +#define kzalloc(x, y) \
60674 +({ \
60675 + void *___retval; \
60676 + intoverflow_t ___x = (intoverflow_t)x; \
60677 + if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n")) \
60678 + ___retval = NULL; \
60679 + else \
60680 + ___retval = kzalloc((size_t)___x, (y)); \
60681 + ___retval; \
60682 +})
60683 +
60684 +#define __krealloc(x, y, z) \
60685 +({ \
60686 + void *___retval; \
60687 + intoverflow_t ___y = (intoverflow_t)y; \
60688 + if (WARN(___y > ULONG_MAX, "__krealloc size overflow\n"))\
60689 + ___retval = NULL; \
60690 + else \
60691 + ___retval = __krealloc((x), (size_t)___y, (z)); \
60692 + ___retval; \
60693 +})
60694 +
60695 +#define krealloc(x, y, z) \
60696 +({ \
60697 + void *___retval; \
60698 + intoverflow_t ___y = (intoverflow_t)y; \
60699 + if (WARN(___y > ULONG_MAX, "krealloc size overflow\n")) \
60700 + ___retval = NULL; \
60701 + else \
60702 + ___retval = krealloc((x), (size_t)___y, (z)); \
60703 + ___retval; \
60704 +})
60705 +
60706 #endif /* _LINUX_SLAB_H */
60707 diff -urNp linux-3.0.8/include/linux/slub_def.h linux-3.0.8/include/linux/slub_def.h
60708 --- linux-3.0.8/include/linux/slub_def.h 2011-07-21 22:17:23.000000000 -0400
60709 +++ linux-3.0.8/include/linux/slub_def.h 2011-08-23 21:47:56.000000000 -0400
60710 @@ -82,7 +82,7 @@ struct kmem_cache {
60711 struct kmem_cache_order_objects max;
60712 struct kmem_cache_order_objects min;
60713 gfp_t allocflags; /* gfp flags to use on each alloc */
60714 - int refcount; /* Refcount for slab cache destroy */
60715 + atomic_t refcount; /* Refcount for slab cache destroy */
60716 void (*ctor)(void *);
60717 int inuse; /* Offset to metadata */
60718 int align; /* Alignment */
60719 @@ -218,7 +218,7 @@ static __always_inline struct kmem_cache
60720 }
60721
60722 void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
60723 -void *__kmalloc(size_t size, gfp_t flags);
60724 +void *__kmalloc(size_t size, gfp_t flags) __alloc_size(1);
60725
60726 static __always_inline void *
60727 kmalloc_order(size_t size, gfp_t flags, unsigned int order)
60728 diff -urNp linux-3.0.8/include/linux/sonet.h linux-3.0.8/include/linux/sonet.h
60729 --- linux-3.0.8/include/linux/sonet.h 2011-07-21 22:17:23.000000000 -0400
60730 +++ linux-3.0.8/include/linux/sonet.h 2011-08-23 21:47:56.000000000 -0400
60731 @@ -61,7 +61,7 @@ struct sonet_stats {
60732 #include <asm/atomic.h>
60733
60734 struct k_sonet_stats {
60735 -#define __HANDLE_ITEM(i) atomic_t i
60736 +#define __HANDLE_ITEM(i) atomic_unchecked_t i
60737 __SONET_ITEMS
60738 #undef __HANDLE_ITEM
60739 };
60740 diff -urNp linux-3.0.8/include/linux/sunrpc/clnt.h linux-3.0.8/include/linux/sunrpc/clnt.h
60741 --- linux-3.0.8/include/linux/sunrpc/clnt.h 2011-07-21 22:17:23.000000000 -0400
60742 +++ linux-3.0.8/include/linux/sunrpc/clnt.h 2011-08-23 21:47:56.000000000 -0400
60743 @@ -169,9 +169,9 @@ static inline unsigned short rpc_get_por
60744 {
60745 switch (sap->sa_family) {
60746 case AF_INET:
60747 - return ntohs(((struct sockaddr_in *)sap)->sin_port);
60748 + return ntohs(((const struct sockaddr_in *)sap)->sin_port);
60749 case AF_INET6:
60750 - return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
60751 + return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
60752 }
60753 return 0;
60754 }
60755 @@ -204,7 +204,7 @@ static inline bool __rpc_cmp_addr4(const
60756 static inline bool __rpc_copy_addr4(struct sockaddr *dst,
60757 const struct sockaddr *src)
60758 {
60759 - const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
60760 + const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
60761 struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
60762
60763 dsin->sin_family = ssin->sin_family;
60764 @@ -301,7 +301,7 @@ static inline u32 rpc_get_scope_id(const
60765 if (sa->sa_family != AF_INET6)
60766 return 0;
60767
60768 - return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
60769 + return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
60770 }
60771
60772 #endif /* __KERNEL__ */
60773 diff -urNp linux-3.0.8/include/linux/sunrpc/svc_rdma.h linux-3.0.8/include/linux/sunrpc/svc_rdma.h
60774 --- linux-3.0.8/include/linux/sunrpc/svc_rdma.h 2011-07-21 22:17:23.000000000 -0400
60775 +++ linux-3.0.8/include/linux/sunrpc/svc_rdma.h 2011-08-23 21:47:56.000000000 -0400
60776 @@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
60777 extern unsigned int svcrdma_max_requests;
60778 extern unsigned int svcrdma_max_req_size;
60779
60780 -extern atomic_t rdma_stat_recv;
60781 -extern atomic_t rdma_stat_read;
60782 -extern atomic_t rdma_stat_write;
60783 -extern atomic_t rdma_stat_sq_starve;
60784 -extern atomic_t rdma_stat_rq_starve;
60785 -extern atomic_t rdma_stat_rq_poll;
60786 -extern atomic_t rdma_stat_rq_prod;
60787 -extern atomic_t rdma_stat_sq_poll;
60788 -extern atomic_t rdma_stat_sq_prod;
60789 +extern atomic_unchecked_t rdma_stat_recv;
60790 +extern atomic_unchecked_t rdma_stat_read;
60791 +extern atomic_unchecked_t rdma_stat_write;
60792 +extern atomic_unchecked_t rdma_stat_sq_starve;
60793 +extern atomic_unchecked_t rdma_stat_rq_starve;
60794 +extern atomic_unchecked_t rdma_stat_rq_poll;
60795 +extern atomic_unchecked_t rdma_stat_rq_prod;
60796 +extern atomic_unchecked_t rdma_stat_sq_poll;
60797 +extern atomic_unchecked_t rdma_stat_sq_prod;
60798
60799 #define RPCRDMA_VERSION 1
60800
60801 diff -urNp linux-3.0.8/include/linux/sysctl.h linux-3.0.8/include/linux/sysctl.h
60802 --- linux-3.0.8/include/linux/sysctl.h 2011-07-21 22:17:23.000000000 -0400
60803 +++ linux-3.0.8/include/linux/sysctl.h 2011-08-23 21:48:14.000000000 -0400
60804 @@ -155,7 +155,11 @@ enum
60805 KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
60806 };
60807
60808 -
60809 +#ifdef CONFIG_PAX_SOFTMODE
60810 +enum {
60811 + PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
60812 +};
60813 +#endif
60814
60815 /* CTL_VM names: */
60816 enum
60817 @@ -967,6 +971,8 @@ typedef int proc_handler (struct ctl_tab
60818
60819 extern int proc_dostring(struct ctl_table *, int,
60820 void __user *, size_t *, loff_t *);
60821 +extern int proc_dostring_modpriv(struct ctl_table *, int,
60822 + void __user *, size_t *, loff_t *);
60823 extern int proc_dointvec(struct ctl_table *, int,
60824 void __user *, size_t *, loff_t *);
60825 extern int proc_dointvec_minmax(struct ctl_table *, int,
60826 diff -urNp linux-3.0.8/include/linux/tty_ldisc.h linux-3.0.8/include/linux/tty_ldisc.h
60827 --- linux-3.0.8/include/linux/tty_ldisc.h 2011-07-21 22:17:23.000000000 -0400
60828 +++ linux-3.0.8/include/linux/tty_ldisc.h 2011-08-23 21:47:56.000000000 -0400
60829 @@ -148,7 +148,7 @@ struct tty_ldisc_ops {
60830
60831 struct module *owner;
60832
60833 - int refcount;
60834 + atomic_t refcount;
60835 };
60836
60837 struct tty_ldisc {
60838 diff -urNp linux-3.0.8/include/linux/types.h linux-3.0.8/include/linux/types.h
60839 --- linux-3.0.8/include/linux/types.h 2011-07-21 22:17:23.000000000 -0400
60840 +++ linux-3.0.8/include/linux/types.h 2011-08-23 21:47:56.000000000 -0400
60841 @@ -213,10 +213,26 @@ typedef struct {
60842 int counter;
60843 } atomic_t;
60844
60845 +#ifdef CONFIG_PAX_REFCOUNT
60846 +typedef struct {
60847 + int counter;
60848 +} atomic_unchecked_t;
60849 +#else
60850 +typedef atomic_t atomic_unchecked_t;
60851 +#endif
60852 +
60853 #ifdef CONFIG_64BIT
60854 typedef struct {
60855 long counter;
60856 } atomic64_t;
60857 +
60858 +#ifdef CONFIG_PAX_REFCOUNT
60859 +typedef struct {
60860 + long counter;
60861 +} atomic64_unchecked_t;
60862 +#else
60863 +typedef atomic64_t atomic64_unchecked_t;
60864 +#endif
60865 #endif
60866
60867 struct list_head {
60868 diff -urNp linux-3.0.8/include/linux/uaccess.h linux-3.0.8/include/linux/uaccess.h
60869 --- linux-3.0.8/include/linux/uaccess.h 2011-07-21 22:17:23.000000000 -0400
60870 +++ linux-3.0.8/include/linux/uaccess.h 2011-10-06 04:17:55.000000000 -0400
60871 @@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
60872 long ret; \
60873 mm_segment_t old_fs = get_fs(); \
60874 \
60875 - set_fs(KERNEL_DS); \
60876 pagefault_disable(); \
60877 - ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
60878 - pagefault_enable(); \
60879 + set_fs(KERNEL_DS); \
60880 + ret = __copy_from_user_inatomic(&(retval), (typeof(retval) __force_user *)(addr), sizeof(retval)); \
60881 set_fs(old_fs); \
60882 + pagefault_enable(); \
60883 ret; \
60884 })
60885
60886 diff -urNp linux-3.0.8/include/linux/unaligned/access_ok.h linux-3.0.8/include/linux/unaligned/access_ok.h
60887 --- linux-3.0.8/include/linux/unaligned/access_ok.h 2011-07-21 22:17:23.000000000 -0400
60888 +++ linux-3.0.8/include/linux/unaligned/access_ok.h 2011-08-23 21:47:56.000000000 -0400
60889 @@ -6,32 +6,32 @@
60890
60891 static inline u16 get_unaligned_le16(const void *p)
60892 {
60893 - return le16_to_cpup((__le16 *)p);
60894 + return le16_to_cpup((const __le16 *)p);
60895 }
60896
60897 static inline u32 get_unaligned_le32(const void *p)
60898 {
60899 - return le32_to_cpup((__le32 *)p);
60900 + return le32_to_cpup((const __le32 *)p);
60901 }
60902
60903 static inline u64 get_unaligned_le64(const void *p)
60904 {
60905 - return le64_to_cpup((__le64 *)p);
60906 + return le64_to_cpup((const __le64 *)p);
60907 }
60908
60909 static inline u16 get_unaligned_be16(const void *p)
60910 {
60911 - return be16_to_cpup((__be16 *)p);
60912 + return be16_to_cpup((const __be16 *)p);
60913 }
60914
60915 static inline u32 get_unaligned_be32(const void *p)
60916 {
60917 - return be32_to_cpup((__be32 *)p);
60918 + return be32_to_cpup((const __be32 *)p);
60919 }
60920
60921 static inline u64 get_unaligned_be64(const void *p)
60922 {
60923 - return be64_to_cpup((__be64 *)p);
60924 + return be64_to_cpup((const __be64 *)p);
60925 }
60926
60927 static inline void put_unaligned_le16(u16 val, void *p)
60928 diff -urNp linux-3.0.8/include/linux/vermagic.h linux-3.0.8/include/linux/vermagic.h
60929 --- linux-3.0.8/include/linux/vermagic.h 2011-07-21 22:17:23.000000000 -0400
60930 +++ linux-3.0.8/include/linux/vermagic.h 2011-10-07 19:25:35.000000000 -0400
60931 @@ -26,9 +26,28 @@
60932 #define MODULE_ARCH_VERMAGIC ""
60933 #endif
60934
60935 +#ifdef CONFIG_PAX_REFCOUNT
60936 +#define MODULE_PAX_REFCOUNT "REFCOUNT "
60937 +#else
60938 +#define MODULE_PAX_REFCOUNT ""
60939 +#endif
60940 +
60941 +#ifdef CONSTIFY_PLUGIN
60942 +#define MODULE_CONSTIFY_PLUGIN "CONSTIFY_PLUGIN "
60943 +#else
60944 +#define MODULE_CONSTIFY_PLUGIN ""
60945 +#endif
60946 +
60947 +#ifdef CONFIG_GRKERNSEC
60948 +#define MODULE_GRSEC "GRSEC "
60949 +#else
60950 +#define MODULE_GRSEC ""
60951 +#endif
60952 +
60953 #define VERMAGIC_STRING \
60954 UTS_RELEASE " " \
60955 MODULE_VERMAGIC_SMP MODULE_VERMAGIC_PREEMPT \
60956 MODULE_VERMAGIC_MODULE_UNLOAD MODULE_VERMAGIC_MODVERSIONS \
60957 - MODULE_ARCH_VERMAGIC
60958 + MODULE_ARCH_VERMAGIC \
60959 + MODULE_PAX_REFCOUNT MODULE_CONSTIFY_PLUGIN MODULE_GRSEC
60960
60961 diff -urNp linux-3.0.8/include/linux/vmalloc.h linux-3.0.8/include/linux/vmalloc.h
60962 --- linux-3.0.8/include/linux/vmalloc.h 2011-07-21 22:17:23.000000000 -0400
60963 +++ linux-3.0.8/include/linux/vmalloc.h 2011-08-23 21:47:56.000000000 -0400
60964 @@ -13,6 +13,11 @@ struct vm_area_struct; /* vma defining
60965 #define VM_MAP 0x00000004 /* vmap()ed pages */
60966 #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
60967 #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
60968 +
60969 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
60970 +#define VM_KERNEXEC 0x00000020 /* allocate from executable kernel memory range */
60971 +#endif
60972 +
60973 /* bits [20..32] reserved for arch specific ioremap internals */
60974
60975 /*
60976 @@ -155,4 +160,103 @@ pcpu_free_vm_areas(struct vm_struct **vm
60977 # endif
60978 #endif
60979
60980 +#define vmalloc(x) \
60981 +({ \
60982 + void *___retval; \
60983 + intoverflow_t ___x = (intoverflow_t)x; \
60984 + if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n")) \
60985 + ___retval = NULL; \
60986 + else \
60987 + ___retval = vmalloc((unsigned long)___x); \
60988 + ___retval; \
60989 +})
60990 +
60991 +#define vzalloc(x) \
60992 +({ \
60993 + void *___retval; \
60994 + intoverflow_t ___x = (intoverflow_t)x; \
60995 + if (WARN(___x > ULONG_MAX, "vzalloc size overflow\n")) \
60996 + ___retval = NULL; \
60997 + else \
60998 + ___retval = vzalloc((unsigned long)___x); \
60999 + ___retval; \
61000 +})
61001 +
61002 +#define __vmalloc(x, y, z) \
61003 +({ \
61004 + void *___retval; \
61005 + intoverflow_t ___x = (intoverflow_t)x; \
61006 + if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
61007 + ___retval = NULL; \
61008 + else \
61009 + ___retval = __vmalloc((unsigned long)___x, (y), (z));\
61010 + ___retval; \
61011 +})
61012 +
61013 +#define vmalloc_user(x) \
61014 +({ \
61015 + void *___retval; \
61016 + intoverflow_t ___x = (intoverflow_t)x; \
61017 + if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
61018 + ___retval = NULL; \
61019 + else \
61020 + ___retval = vmalloc_user((unsigned long)___x); \
61021 + ___retval; \
61022 +})
61023 +
61024 +#define vmalloc_exec(x) \
61025 +({ \
61026 + void *___retval; \
61027 + intoverflow_t ___x = (intoverflow_t)x; \
61028 + if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
61029 + ___retval = NULL; \
61030 + else \
61031 + ___retval = vmalloc_exec((unsigned long)___x); \
61032 + ___retval; \
61033 +})
61034 +
61035 +#define vmalloc_node(x, y) \
61036 +({ \
61037 + void *___retval; \
61038 + intoverflow_t ___x = (intoverflow_t)x; \
61039 + if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
61040 + ___retval = NULL; \
61041 + else \
61042 + ___retval = vmalloc_node((unsigned long)___x, (y));\
61043 + ___retval; \
61044 +})
61045 +
61046 +#define vzalloc_node(x, y) \
61047 +({ \
61048 + void *___retval; \
61049 + intoverflow_t ___x = (intoverflow_t)x; \
61050 + if (WARN(___x > ULONG_MAX, "vzalloc_node size overflow\n"))\
61051 + ___retval = NULL; \
61052 + else \
61053 + ___retval = vzalloc_node((unsigned long)___x, (y));\
61054 + ___retval; \
61055 +})
61056 +
61057 +#define vmalloc_32(x) \
61058 +({ \
61059 + void *___retval; \
61060 + intoverflow_t ___x = (intoverflow_t)x; \
61061 + if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
61062 + ___retval = NULL; \
61063 + else \
61064 + ___retval = vmalloc_32((unsigned long)___x); \
61065 + ___retval; \
61066 +})
61067 +
61068 +#define vmalloc_32_user(x) \
61069 +({ \
61070 +void *___retval; \
61071 + intoverflow_t ___x = (intoverflow_t)x; \
61072 + if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
61073 + ___retval = NULL; \
61074 + else \
61075 + ___retval = vmalloc_32_user((unsigned long)___x);\
61076 + ___retval; \
61077 +})
61078 +
61079 #endif /* _LINUX_VMALLOC_H */
61080 diff -urNp linux-3.0.8/include/linux/vmstat.h linux-3.0.8/include/linux/vmstat.h
61081 --- linux-3.0.8/include/linux/vmstat.h 2011-07-21 22:17:23.000000000 -0400
61082 +++ linux-3.0.8/include/linux/vmstat.h 2011-08-23 21:47:56.000000000 -0400
61083 @@ -87,18 +87,18 @@ static inline void vm_events_fold_cpu(in
61084 /*
61085 * Zone based page accounting with per cpu differentials.
61086 */
61087 -extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
61088 +extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
61089
61090 static inline void zone_page_state_add(long x, struct zone *zone,
61091 enum zone_stat_item item)
61092 {
61093 - atomic_long_add(x, &zone->vm_stat[item]);
61094 - atomic_long_add(x, &vm_stat[item]);
61095 + atomic_long_add_unchecked(x, &zone->vm_stat[item]);
61096 + atomic_long_add_unchecked(x, &vm_stat[item]);
61097 }
61098
61099 static inline unsigned long global_page_state(enum zone_stat_item item)
61100 {
61101 - long x = atomic_long_read(&vm_stat[item]);
61102 + long x = atomic_long_read_unchecked(&vm_stat[item]);
61103 #ifdef CONFIG_SMP
61104 if (x < 0)
61105 x = 0;
61106 @@ -109,7 +109,7 @@ static inline unsigned long global_page_
61107 static inline unsigned long zone_page_state(struct zone *zone,
61108 enum zone_stat_item item)
61109 {
61110 - long x = atomic_long_read(&zone->vm_stat[item]);
61111 + long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
61112 #ifdef CONFIG_SMP
61113 if (x < 0)
61114 x = 0;
61115 @@ -126,7 +126,7 @@ static inline unsigned long zone_page_st
61116 static inline unsigned long zone_page_state_snapshot(struct zone *zone,
61117 enum zone_stat_item item)
61118 {
61119 - long x = atomic_long_read(&zone->vm_stat[item]);
61120 + long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
61121
61122 #ifdef CONFIG_SMP
61123 int cpu;
61124 @@ -221,8 +221,8 @@ static inline void __mod_zone_page_state
61125
61126 static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
61127 {
61128 - atomic_long_inc(&zone->vm_stat[item]);
61129 - atomic_long_inc(&vm_stat[item]);
61130 + atomic_long_inc_unchecked(&zone->vm_stat[item]);
61131 + atomic_long_inc_unchecked(&vm_stat[item]);
61132 }
61133
61134 static inline void __inc_zone_page_state(struct page *page,
61135 @@ -233,8 +233,8 @@ static inline void __inc_zone_page_state
61136
61137 static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
61138 {
61139 - atomic_long_dec(&zone->vm_stat[item]);
61140 - atomic_long_dec(&vm_stat[item]);
61141 + atomic_long_dec_unchecked(&zone->vm_stat[item]);
61142 + atomic_long_dec_unchecked(&vm_stat[item]);
61143 }
61144
61145 static inline void __dec_zone_page_state(struct page *page,
61146 diff -urNp linux-3.0.8/include/media/saa7146_vv.h linux-3.0.8/include/media/saa7146_vv.h
61147 --- linux-3.0.8/include/media/saa7146_vv.h 2011-07-21 22:17:23.000000000 -0400
61148 +++ linux-3.0.8/include/media/saa7146_vv.h 2011-10-07 19:07:40.000000000 -0400
61149 @@ -163,7 +163,7 @@ struct saa7146_ext_vv
61150 int (*std_callback)(struct saa7146_dev*, struct saa7146_standard *);
61151
61152 /* the extension can override this */
61153 - struct v4l2_ioctl_ops ops;
61154 + v4l2_ioctl_ops_no_const ops;
61155 /* pointer to the saa7146 core ops */
61156 const struct v4l2_ioctl_ops *core_ops;
61157
61158 diff -urNp linux-3.0.8/include/media/v4l2-dev.h linux-3.0.8/include/media/v4l2-dev.h
61159 --- linux-3.0.8/include/media/v4l2-dev.h 2011-07-21 22:17:23.000000000 -0400
61160 +++ linux-3.0.8/include/media/v4l2-dev.h 2011-10-07 19:07:40.000000000 -0400
61161 @@ -56,7 +56,7 @@ int v4l2_prio_check(struct v4l2_prio_sta
61162
61163
61164 struct v4l2_file_operations {
61165 - struct module *owner;
61166 + struct module * const owner;
61167 ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
61168 ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
61169 unsigned int (*poll) (struct file *, struct poll_table_struct *);
61170 @@ -68,6 +68,7 @@ struct v4l2_file_operations {
61171 int (*open) (struct file *);
61172 int (*release) (struct file *);
61173 };
61174 +typedef struct v4l2_file_operations __no_const v4l2_file_operations_no_const;
61175
61176 /*
61177 * Newer version of video_device, handled by videodev2.c
61178 diff -urNp linux-3.0.8/include/media/v4l2-ioctl.h linux-3.0.8/include/media/v4l2-ioctl.h
61179 --- linux-3.0.8/include/media/v4l2-ioctl.h 2011-07-21 22:17:23.000000000 -0400
61180 +++ linux-3.0.8/include/media/v4l2-ioctl.h 2011-08-24 18:25:45.000000000 -0400
61181 @@ -272,6 +272,7 @@ struct v4l2_ioctl_ops {
61182 long (*vidioc_default) (struct file *file, void *fh,
61183 bool valid_prio, int cmd, void *arg);
61184 };
61185 +typedef struct v4l2_ioctl_ops __no_const v4l2_ioctl_ops_no_const;
61186
61187
61188 /* v4l debugging and diagnostics */
61189 diff -urNp linux-3.0.8/include/net/caif/cfctrl.h linux-3.0.8/include/net/caif/cfctrl.h
61190 --- linux-3.0.8/include/net/caif/cfctrl.h 2011-07-21 22:17:23.000000000 -0400
61191 +++ linux-3.0.8/include/net/caif/cfctrl.h 2011-08-23 21:47:56.000000000 -0400
61192 @@ -52,7 +52,7 @@ struct cfctrl_rsp {
61193 void (*radioset_rsp)(void);
61194 void (*reject_rsp)(struct cflayer *layer, u8 linkid,
61195 struct cflayer *client_layer);
61196 -};
61197 +} __no_const;
61198
61199 /* Link Setup Parameters for CAIF-Links. */
61200 struct cfctrl_link_param {
61201 @@ -101,8 +101,8 @@ struct cfctrl_request_info {
61202 struct cfctrl {
61203 struct cfsrvl serv;
61204 struct cfctrl_rsp res;
61205 - atomic_t req_seq_no;
61206 - atomic_t rsp_seq_no;
61207 + atomic_unchecked_t req_seq_no;
61208 + atomic_unchecked_t rsp_seq_no;
61209 struct list_head list;
61210 /* Protects from simultaneous access to first_req list */
61211 spinlock_t info_list_lock;
61212 diff -urNp linux-3.0.8/include/net/flow.h linux-3.0.8/include/net/flow.h
61213 --- linux-3.0.8/include/net/flow.h 2011-07-21 22:17:23.000000000 -0400
61214 +++ linux-3.0.8/include/net/flow.h 2011-08-23 21:47:56.000000000 -0400
61215 @@ -188,6 +188,6 @@ extern struct flow_cache_object *flow_ca
61216 u8 dir, flow_resolve_t resolver, void *ctx);
61217
61218 extern void flow_cache_flush(void);
61219 -extern atomic_t flow_cache_genid;
61220 +extern atomic_unchecked_t flow_cache_genid;
61221
61222 #endif
61223 diff -urNp linux-3.0.8/include/net/inetpeer.h linux-3.0.8/include/net/inetpeer.h
61224 --- linux-3.0.8/include/net/inetpeer.h 2011-07-21 22:17:23.000000000 -0400
61225 +++ linux-3.0.8/include/net/inetpeer.h 2011-08-23 21:47:56.000000000 -0400
61226 @@ -43,8 +43,8 @@ struct inet_peer {
61227 */
61228 union {
61229 struct {
61230 - atomic_t rid; /* Frag reception counter */
61231 - atomic_t ip_id_count; /* IP ID for the next packet */
61232 + atomic_unchecked_t rid; /* Frag reception counter */
61233 + atomic_unchecked_t ip_id_count; /* IP ID for the next packet */
61234 __u32 tcp_ts;
61235 __u32 tcp_ts_stamp;
61236 u32 metrics[RTAX_MAX];
61237 @@ -108,7 +108,7 @@ static inline __u16 inet_getid(struct in
61238 {
61239 more++;
61240 inet_peer_refcheck(p);
61241 - return atomic_add_return(more, &p->ip_id_count) - more;
61242 + return atomic_add_return_unchecked(more, &p->ip_id_count) - more;
61243 }
61244
61245 #endif /* _NET_INETPEER_H */
61246 diff -urNp linux-3.0.8/include/net/ip_fib.h linux-3.0.8/include/net/ip_fib.h
61247 --- linux-3.0.8/include/net/ip_fib.h 2011-07-21 22:17:23.000000000 -0400
61248 +++ linux-3.0.8/include/net/ip_fib.h 2011-08-23 21:47:56.000000000 -0400
61249 @@ -146,7 +146,7 @@ extern __be32 fib_info_update_nh_saddr(s
61250
61251 #define FIB_RES_SADDR(net, res) \
61252 ((FIB_RES_NH(res).nh_saddr_genid == \
61253 - atomic_read(&(net)->ipv4.dev_addr_genid)) ? \
61254 + atomic_read_unchecked(&(net)->ipv4.dev_addr_genid)) ? \
61255 FIB_RES_NH(res).nh_saddr : \
61256 fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
61257 #define FIB_RES_GW(res) (FIB_RES_NH(res).nh_gw)
61258 diff -urNp linux-3.0.8/include/net/ip_vs.h linux-3.0.8/include/net/ip_vs.h
61259 --- linux-3.0.8/include/net/ip_vs.h 2011-07-21 22:17:23.000000000 -0400
61260 +++ linux-3.0.8/include/net/ip_vs.h 2011-08-23 21:47:56.000000000 -0400
61261 @@ -509,7 +509,7 @@ struct ip_vs_conn {
61262 struct ip_vs_conn *control; /* Master control connection */
61263 atomic_t n_control; /* Number of controlled ones */
61264 struct ip_vs_dest *dest; /* real server */
61265 - atomic_t in_pkts; /* incoming packet counter */
61266 + atomic_unchecked_t in_pkts; /* incoming packet counter */
61267
61268 /* packet transmitter for different forwarding methods. If it
61269 mangles the packet, it must return NF_DROP or better NF_STOLEN,
61270 @@ -647,7 +647,7 @@ struct ip_vs_dest {
61271 __be16 port; /* port number of the server */
61272 union nf_inet_addr addr; /* IP address of the server */
61273 volatile unsigned flags; /* dest status flags */
61274 - atomic_t conn_flags; /* flags to copy to conn */
61275 + atomic_unchecked_t conn_flags; /* flags to copy to conn */
61276 atomic_t weight; /* server weight */
61277
61278 atomic_t refcnt; /* reference counter */
61279 diff -urNp linux-3.0.8/include/net/irda/ircomm_core.h linux-3.0.8/include/net/irda/ircomm_core.h
61280 --- linux-3.0.8/include/net/irda/ircomm_core.h 2011-07-21 22:17:23.000000000 -0400
61281 +++ linux-3.0.8/include/net/irda/ircomm_core.h 2011-08-23 21:47:56.000000000 -0400
61282 @@ -51,7 +51,7 @@ typedef struct {
61283 int (*connect_response)(struct ircomm_cb *, struct sk_buff *);
61284 int (*disconnect_request)(struct ircomm_cb *, struct sk_buff *,
61285 struct ircomm_info *);
61286 -} call_t;
61287 +} __no_const call_t;
61288
61289 struct ircomm_cb {
61290 irda_queue_t queue;
61291 diff -urNp linux-3.0.8/include/net/irda/ircomm_tty.h linux-3.0.8/include/net/irda/ircomm_tty.h
61292 --- linux-3.0.8/include/net/irda/ircomm_tty.h 2011-07-21 22:17:23.000000000 -0400
61293 +++ linux-3.0.8/include/net/irda/ircomm_tty.h 2011-08-23 21:47:56.000000000 -0400
61294 @@ -35,6 +35,7 @@
61295 #include <linux/termios.h>
61296 #include <linux/timer.h>
61297 #include <linux/tty.h> /* struct tty_struct */
61298 +#include <asm/local.h>
61299
61300 #include <net/irda/irias_object.h>
61301 #include <net/irda/ircomm_core.h>
61302 @@ -105,8 +106,8 @@ struct ircomm_tty_cb {
61303 unsigned short close_delay;
61304 unsigned short closing_wait; /* time to wait before closing */
61305
61306 - int open_count;
61307 - int blocked_open; /* # of blocked opens */
61308 + local_t open_count;
61309 + local_t blocked_open; /* # of blocked opens */
61310
61311 /* Protect concurent access to :
61312 * o self->open_count
61313 diff -urNp linux-3.0.8/include/net/iucv/af_iucv.h linux-3.0.8/include/net/iucv/af_iucv.h
61314 --- linux-3.0.8/include/net/iucv/af_iucv.h 2011-07-21 22:17:23.000000000 -0400
61315 +++ linux-3.0.8/include/net/iucv/af_iucv.h 2011-08-23 21:47:56.000000000 -0400
61316 @@ -87,7 +87,7 @@ struct iucv_sock {
61317 struct iucv_sock_list {
61318 struct hlist_head head;
61319 rwlock_t lock;
61320 - atomic_t autobind_name;
61321 + atomic_unchecked_t autobind_name;
61322 };
61323
61324 unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
61325 diff -urNp linux-3.0.8/include/net/lapb.h linux-3.0.8/include/net/lapb.h
61326 --- linux-3.0.8/include/net/lapb.h 2011-07-21 22:17:23.000000000 -0400
61327 +++ linux-3.0.8/include/net/lapb.h 2011-08-23 21:47:56.000000000 -0400
61328 @@ -95,7 +95,7 @@ struct lapb_cb {
61329 struct sk_buff_head write_queue;
61330 struct sk_buff_head ack_queue;
61331 unsigned char window;
61332 - struct lapb_register_struct callbacks;
61333 + struct lapb_register_struct *callbacks;
61334
61335 /* FRMR control information */
61336 struct lapb_frame frmr_data;
61337 diff -urNp linux-3.0.8/include/net/neighbour.h linux-3.0.8/include/net/neighbour.h
61338 --- linux-3.0.8/include/net/neighbour.h 2011-07-21 22:17:23.000000000 -0400
61339 +++ linux-3.0.8/include/net/neighbour.h 2011-08-31 18:39:25.000000000 -0400
61340 @@ -124,7 +124,7 @@ struct neigh_ops {
61341 int (*connected_output)(struct sk_buff*);
61342 int (*hh_output)(struct sk_buff*);
61343 int (*queue_xmit)(struct sk_buff*);
61344 -};
61345 +} __do_const;
61346
61347 struct pneigh_entry {
61348 struct pneigh_entry *next;
61349 diff -urNp linux-3.0.8/include/net/netlink.h linux-3.0.8/include/net/netlink.h
61350 --- linux-3.0.8/include/net/netlink.h 2011-07-21 22:17:23.000000000 -0400
61351 +++ linux-3.0.8/include/net/netlink.h 2011-08-23 21:47:56.000000000 -0400
61352 @@ -562,7 +562,7 @@ static inline void *nlmsg_get_pos(struct
61353 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
61354 {
61355 if (mark)
61356 - skb_trim(skb, (unsigned char *) mark - skb->data);
61357 + skb_trim(skb, (const unsigned char *) mark - skb->data);
61358 }
61359
61360 /**
61361 diff -urNp linux-3.0.8/include/net/netns/ipv4.h linux-3.0.8/include/net/netns/ipv4.h
61362 --- linux-3.0.8/include/net/netns/ipv4.h 2011-07-21 22:17:23.000000000 -0400
61363 +++ linux-3.0.8/include/net/netns/ipv4.h 2011-08-23 21:47:56.000000000 -0400
61364 @@ -56,8 +56,8 @@ struct netns_ipv4 {
61365
61366 unsigned int sysctl_ping_group_range[2];
61367
61368 - atomic_t rt_genid;
61369 - atomic_t dev_addr_genid;
61370 + atomic_unchecked_t rt_genid;
61371 + atomic_unchecked_t dev_addr_genid;
61372
61373 #ifdef CONFIG_IP_MROUTE
61374 #ifndef CONFIG_IP_MROUTE_MULTIPLE_TABLES
61375 diff -urNp linux-3.0.8/include/net/sctp/sctp.h linux-3.0.8/include/net/sctp/sctp.h
61376 --- linux-3.0.8/include/net/sctp/sctp.h 2011-07-21 22:17:23.000000000 -0400
61377 +++ linux-3.0.8/include/net/sctp/sctp.h 2011-08-23 21:47:56.000000000 -0400
61378 @@ -315,9 +315,9 @@ do { \
61379
61380 #else /* SCTP_DEBUG */
61381
61382 -#define SCTP_DEBUG_PRINTK(whatever...)
61383 -#define SCTP_DEBUG_PRINTK_CONT(fmt, args...)
61384 -#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
61385 +#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
61386 +#define SCTP_DEBUG_PRINTK_CONT(fmt, args...) do {} while (0)
61387 +#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
61388 #define SCTP_ENABLE_DEBUG
61389 #define SCTP_DISABLE_DEBUG
61390 #define SCTP_ASSERT(expr, str, func)
61391 diff -urNp linux-3.0.8/include/net/sock.h linux-3.0.8/include/net/sock.h
61392 --- linux-3.0.8/include/net/sock.h 2011-07-21 22:17:23.000000000 -0400
61393 +++ linux-3.0.8/include/net/sock.h 2011-08-23 21:47:56.000000000 -0400
61394 @@ -277,7 +277,7 @@ struct sock {
61395 #ifdef CONFIG_RPS
61396 __u32 sk_rxhash;
61397 #endif
61398 - atomic_t sk_drops;
61399 + atomic_unchecked_t sk_drops;
61400 int sk_rcvbuf;
61401
61402 struct sk_filter __rcu *sk_filter;
61403 @@ -1390,7 +1390,7 @@ static inline void sk_nocaps_add(struct
61404 }
61405
61406 static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb,
61407 - char __user *from, char *to,
61408 + char __user *from, unsigned char *to,
61409 int copy, int offset)
61410 {
61411 if (skb->ip_summed == CHECKSUM_NONE) {
61412 diff -urNp linux-3.0.8/include/net/tcp.h linux-3.0.8/include/net/tcp.h
61413 --- linux-3.0.8/include/net/tcp.h 2011-07-21 22:17:23.000000000 -0400
61414 +++ linux-3.0.8/include/net/tcp.h 2011-08-23 21:47:56.000000000 -0400
61415 @@ -1374,8 +1374,8 @@ enum tcp_seq_states {
61416 struct tcp_seq_afinfo {
61417 char *name;
61418 sa_family_t family;
61419 - struct file_operations seq_fops;
61420 - struct seq_operations seq_ops;
61421 + file_operations_no_const seq_fops;
61422 + seq_operations_no_const seq_ops;
61423 };
61424
61425 struct tcp_iter_state {
61426 diff -urNp linux-3.0.8/include/net/udp.h linux-3.0.8/include/net/udp.h
61427 --- linux-3.0.8/include/net/udp.h 2011-07-21 22:17:23.000000000 -0400
61428 +++ linux-3.0.8/include/net/udp.h 2011-08-23 21:47:56.000000000 -0400
61429 @@ -234,8 +234,8 @@ struct udp_seq_afinfo {
61430 char *name;
61431 sa_family_t family;
61432 struct udp_table *udp_table;
61433 - struct file_operations seq_fops;
61434 - struct seq_operations seq_ops;
61435 + file_operations_no_const seq_fops;
61436 + seq_operations_no_const seq_ops;
61437 };
61438
61439 struct udp_iter_state {
61440 diff -urNp linux-3.0.8/include/net/xfrm.h linux-3.0.8/include/net/xfrm.h
61441 --- linux-3.0.8/include/net/xfrm.h 2011-07-21 22:17:23.000000000 -0400
61442 +++ linux-3.0.8/include/net/xfrm.h 2011-08-23 21:47:56.000000000 -0400
61443 @@ -505,7 +505,7 @@ struct xfrm_policy {
61444 struct timer_list timer;
61445
61446 struct flow_cache_object flo;
61447 - atomic_t genid;
61448 + atomic_unchecked_t genid;
61449 u32 priority;
61450 u32 index;
61451 struct xfrm_mark mark;
61452 diff -urNp linux-3.0.8/include/rdma/iw_cm.h linux-3.0.8/include/rdma/iw_cm.h
61453 --- linux-3.0.8/include/rdma/iw_cm.h 2011-07-21 22:17:23.000000000 -0400
61454 +++ linux-3.0.8/include/rdma/iw_cm.h 2011-08-23 21:47:56.000000000 -0400
61455 @@ -120,7 +120,7 @@ struct iw_cm_verbs {
61456 int backlog);
61457
61458 int (*destroy_listen)(struct iw_cm_id *cm_id);
61459 -};
61460 +} __no_const;
61461
61462 /**
61463 * iw_create_cm_id - Create an IW CM identifier.
61464 diff -urNp linux-3.0.8/include/scsi/libfc.h linux-3.0.8/include/scsi/libfc.h
61465 --- linux-3.0.8/include/scsi/libfc.h 2011-07-21 22:17:23.000000000 -0400
61466 +++ linux-3.0.8/include/scsi/libfc.h 2011-08-23 21:47:56.000000000 -0400
61467 @@ -750,6 +750,7 @@ struct libfc_function_template {
61468 */
61469 void (*disc_stop_final) (struct fc_lport *);
61470 };
61471 +typedef struct libfc_function_template __no_const libfc_function_template_no_const;
61472
61473 /**
61474 * struct fc_disc - Discovery context
61475 @@ -853,7 +854,7 @@ struct fc_lport {
61476 struct fc_vport *vport;
61477
61478 /* Operational Information */
61479 - struct libfc_function_template tt;
61480 + libfc_function_template_no_const tt;
61481 u8 link_up;
61482 u8 qfull;
61483 enum fc_lport_state state;
61484 diff -urNp linux-3.0.8/include/scsi/scsi_device.h linux-3.0.8/include/scsi/scsi_device.h
61485 --- linux-3.0.8/include/scsi/scsi_device.h 2011-07-21 22:17:23.000000000 -0400
61486 +++ linux-3.0.8/include/scsi/scsi_device.h 2011-08-23 21:47:56.000000000 -0400
61487 @@ -161,9 +161,9 @@ struct scsi_device {
61488 unsigned int max_device_blocked; /* what device_blocked counts down from */
61489 #define SCSI_DEFAULT_DEVICE_BLOCKED 3
61490
61491 - atomic_t iorequest_cnt;
61492 - atomic_t iodone_cnt;
61493 - atomic_t ioerr_cnt;
61494 + atomic_unchecked_t iorequest_cnt;
61495 + atomic_unchecked_t iodone_cnt;
61496 + atomic_unchecked_t ioerr_cnt;
61497
61498 struct device sdev_gendev,
61499 sdev_dev;
61500 diff -urNp linux-3.0.8/include/scsi/scsi_transport_fc.h linux-3.0.8/include/scsi/scsi_transport_fc.h
61501 --- linux-3.0.8/include/scsi/scsi_transport_fc.h 2011-07-21 22:17:23.000000000 -0400
61502 +++ linux-3.0.8/include/scsi/scsi_transport_fc.h 2011-08-26 19:49:56.000000000 -0400
61503 @@ -711,7 +711,7 @@ struct fc_function_template {
61504 unsigned long show_host_system_hostname:1;
61505
61506 unsigned long disable_target_scan:1;
61507 -};
61508 +} __do_const;
61509
61510
61511 /**
61512 diff -urNp linux-3.0.8/include/sound/ak4xxx-adda.h linux-3.0.8/include/sound/ak4xxx-adda.h
61513 --- linux-3.0.8/include/sound/ak4xxx-adda.h 2011-07-21 22:17:23.000000000 -0400
61514 +++ linux-3.0.8/include/sound/ak4xxx-adda.h 2011-08-23 21:47:56.000000000 -0400
61515 @@ -35,7 +35,7 @@ struct snd_ak4xxx_ops {
61516 void (*write)(struct snd_akm4xxx *ak, int chip, unsigned char reg,
61517 unsigned char val);
61518 void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
61519 -};
61520 +} __no_const;
61521
61522 #define AK4XXX_IMAGE_SIZE (AK4XXX_MAX_CHIPS * 16) /* 64 bytes */
61523
61524 diff -urNp linux-3.0.8/include/sound/hwdep.h linux-3.0.8/include/sound/hwdep.h
61525 --- linux-3.0.8/include/sound/hwdep.h 2011-07-21 22:17:23.000000000 -0400
61526 +++ linux-3.0.8/include/sound/hwdep.h 2011-08-23 21:47:56.000000000 -0400
61527 @@ -49,7 +49,7 @@ struct snd_hwdep_ops {
61528 struct snd_hwdep_dsp_status *status);
61529 int (*dsp_load)(struct snd_hwdep *hw,
61530 struct snd_hwdep_dsp_image *image);
61531 -};
61532 +} __no_const;
61533
61534 struct snd_hwdep {
61535 struct snd_card *card;
61536 diff -urNp linux-3.0.8/include/sound/info.h linux-3.0.8/include/sound/info.h
61537 --- linux-3.0.8/include/sound/info.h 2011-07-21 22:17:23.000000000 -0400
61538 +++ linux-3.0.8/include/sound/info.h 2011-08-23 21:47:56.000000000 -0400
61539 @@ -44,7 +44,7 @@ struct snd_info_entry_text {
61540 struct snd_info_buffer *buffer);
61541 void (*write)(struct snd_info_entry *entry,
61542 struct snd_info_buffer *buffer);
61543 -};
61544 +} __no_const;
61545
61546 struct snd_info_entry_ops {
61547 int (*open)(struct snd_info_entry *entry,
61548 diff -urNp linux-3.0.8/include/sound/pcm.h linux-3.0.8/include/sound/pcm.h
61549 --- linux-3.0.8/include/sound/pcm.h 2011-07-21 22:17:23.000000000 -0400
61550 +++ linux-3.0.8/include/sound/pcm.h 2011-08-23 21:47:56.000000000 -0400
61551 @@ -81,6 +81,7 @@ struct snd_pcm_ops {
61552 int (*mmap)(struct snd_pcm_substream *substream, struct vm_area_struct *vma);
61553 int (*ack)(struct snd_pcm_substream *substream);
61554 };
61555 +typedef struct snd_pcm_ops __no_const snd_pcm_ops_no_const;
61556
61557 /*
61558 *
61559 diff -urNp linux-3.0.8/include/sound/sb16_csp.h linux-3.0.8/include/sound/sb16_csp.h
61560 --- linux-3.0.8/include/sound/sb16_csp.h 2011-07-21 22:17:23.000000000 -0400
61561 +++ linux-3.0.8/include/sound/sb16_csp.h 2011-08-23 21:47:56.000000000 -0400
61562 @@ -146,7 +146,7 @@ struct snd_sb_csp_ops {
61563 int (*csp_start) (struct snd_sb_csp * p, int sample_width, int channels);
61564 int (*csp_stop) (struct snd_sb_csp * p);
61565 int (*csp_qsound_transfer) (struct snd_sb_csp * p);
61566 -};
61567 +} __no_const;
61568
61569 /*
61570 * CSP private data
61571 diff -urNp linux-3.0.8/include/sound/soc.h linux-3.0.8/include/sound/soc.h
61572 --- linux-3.0.8/include/sound/soc.h 2011-07-21 22:17:23.000000000 -0400
61573 +++ linux-3.0.8/include/sound/soc.h 2011-08-26 19:49:56.000000000 -0400
61574 @@ -636,7 +636,7 @@ struct snd_soc_platform_driver {
61575
61576 /* platform stream ops */
61577 struct snd_pcm_ops *ops;
61578 -};
61579 +} __do_const;
61580
61581 struct snd_soc_platform {
61582 const char *name;
61583 diff -urNp linux-3.0.8/include/sound/ymfpci.h linux-3.0.8/include/sound/ymfpci.h
61584 --- linux-3.0.8/include/sound/ymfpci.h 2011-07-21 22:17:23.000000000 -0400
61585 +++ linux-3.0.8/include/sound/ymfpci.h 2011-08-23 21:47:56.000000000 -0400
61586 @@ -358,7 +358,7 @@ struct snd_ymfpci {
61587 spinlock_t reg_lock;
61588 spinlock_t voice_lock;
61589 wait_queue_head_t interrupt_sleep;
61590 - atomic_t interrupt_sleep_count;
61591 + atomic_unchecked_t interrupt_sleep_count;
61592 struct snd_info_entry *proc_entry;
61593 const struct firmware *dsp_microcode;
61594 const struct firmware *controller_microcode;
61595 diff -urNp linux-3.0.8/include/target/target_core_base.h linux-3.0.8/include/target/target_core_base.h
61596 --- linux-3.0.8/include/target/target_core_base.h 2011-07-21 22:17:23.000000000 -0400
61597 +++ linux-3.0.8/include/target/target_core_base.h 2011-08-23 21:47:56.000000000 -0400
61598 @@ -364,7 +364,7 @@ struct t10_reservation_ops {
61599 int (*t10_seq_non_holder)(struct se_cmd *, unsigned char *, u32);
61600 int (*t10_pr_register)(struct se_cmd *);
61601 int (*t10_pr_clear)(struct se_cmd *);
61602 -};
61603 +} __no_const;
61604
61605 struct t10_reservation_template {
61606 /* Reservation effects all target ports */
61607 @@ -432,8 +432,8 @@ struct se_transport_task {
61608 atomic_t t_task_cdbs_left;
61609 atomic_t t_task_cdbs_ex_left;
61610 atomic_t t_task_cdbs_timeout_left;
61611 - atomic_t t_task_cdbs_sent;
61612 - atomic_t t_transport_aborted;
61613 + atomic_unchecked_t t_task_cdbs_sent;
61614 + atomic_unchecked_t t_transport_aborted;
61615 atomic_t t_transport_active;
61616 atomic_t t_transport_complete;
61617 atomic_t t_transport_queue_active;
61618 @@ -774,7 +774,7 @@ struct se_device {
61619 atomic_t active_cmds;
61620 atomic_t simple_cmds;
61621 atomic_t depth_left;
61622 - atomic_t dev_ordered_id;
61623 + atomic_unchecked_t dev_ordered_id;
61624 atomic_t dev_tur_active;
61625 atomic_t execute_tasks;
61626 atomic_t dev_status_thr_count;
61627 diff -urNp linux-3.0.8/include/trace/events/irq.h linux-3.0.8/include/trace/events/irq.h
61628 --- linux-3.0.8/include/trace/events/irq.h 2011-07-21 22:17:23.000000000 -0400
61629 +++ linux-3.0.8/include/trace/events/irq.h 2011-08-23 21:47:56.000000000 -0400
61630 @@ -36,7 +36,7 @@ struct softirq_action;
61631 */
61632 TRACE_EVENT(irq_handler_entry,
61633
61634 - TP_PROTO(int irq, struct irqaction *action),
61635 + TP_PROTO(int irq, const struct irqaction *action),
61636
61637 TP_ARGS(irq, action),
61638
61639 @@ -66,7 +66,7 @@ TRACE_EVENT(irq_handler_entry,
61640 */
61641 TRACE_EVENT(irq_handler_exit,
61642
61643 - TP_PROTO(int irq, struct irqaction *action, int ret),
61644 + TP_PROTO(int irq, const struct irqaction *action, int ret),
61645
61646 TP_ARGS(irq, action, ret),
61647
61648 diff -urNp linux-3.0.8/include/video/udlfb.h linux-3.0.8/include/video/udlfb.h
61649 --- linux-3.0.8/include/video/udlfb.h 2011-07-21 22:17:23.000000000 -0400
61650 +++ linux-3.0.8/include/video/udlfb.h 2011-08-23 21:47:56.000000000 -0400
61651 @@ -51,10 +51,10 @@ struct dlfb_data {
61652 int base8;
61653 u32 pseudo_palette[256];
61654 /* blit-only rendering path metrics, exposed through sysfs */
61655 - atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
61656 - atomic_t bytes_identical; /* saved effort with backbuffer comparison */
61657 - atomic_t bytes_sent; /* to usb, after compression including overhead */
61658 - atomic_t cpu_kcycles_used; /* transpired during pixel processing */
61659 + atomic_unchecked_t bytes_rendered; /* raw pixel-bytes driver asked to render */
61660 + atomic_unchecked_t bytes_identical; /* saved effort with backbuffer comparison */
61661 + atomic_unchecked_t bytes_sent; /* to usb, after compression including overhead */
61662 + atomic_unchecked_t cpu_kcycles_used; /* transpired during pixel processing */
61663 };
61664
61665 #define NR_USB_REQUEST_I2C_SUB_IO 0x02
61666 diff -urNp linux-3.0.8/include/video/uvesafb.h linux-3.0.8/include/video/uvesafb.h
61667 --- linux-3.0.8/include/video/uvesafb.h 2011-07-21 22:17:23.000000000 -0400
61668 +++ linux-3.0.8/include/video/uvesafb.h 2011-08-23 21:47:56.000000000 -0400
61669 @@ -177,6 +177,7 @@ struct uvesafb_par {
61670 u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
61671 u8 pmi_setpal; /* PMI for palette changes */
61672 u16 *pmi_base; /* protected mode interface location */
61673 + u8 *pmi_code; /* protected mode code location */
61674 void *pmi_start;
61675 void *pmi_pal;
61676 u8 *vbe_state_orig; /*
61677 diff -urNp linux-3.0.8/init/do_mounts.c linux-3.0.8/init/do_mounts.c
61678 --- linux-3.0.8/init/do_mounts.c 2011-07-21 22:17:23.000000000 -0400
61679 +++ linux-3.0.8/init/do_mounts.c 2011-10-06 04:17:55.000000000 -0400
61680 @@ -287,11 +287,11 @@ static void __init get_fs_names(char *pa
61681
61682 static int __init do_mount_root(char *name, char *fs, int flags, void *data)
61683 {
61684 - int err = sys_mount(name, "/root", fs, flags, data);
61685 + int err = sys_mount((char __force_user *)name, (char __force_user *)"/root", (char __force_user *)fs, flags, (void __force_user *)data);
61686 if (err)
61687 return err;
61688
61689 - sys_chdir((const char __user __force *)"/root");
61690 + sys_chdir((const char __force_user*)"/root");
61691 ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
61692 printk(KERN_INFO
61693 "VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
61694 @@ -383,18 +383,18 @@ void __init change_floppy(char *fmt, ...
61695 va_start(args, fmt);
61696 vsprintf(buf, fmt, args);
61697 va_end(args);
61698 - fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
61699 + fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
61700 if (fd >= 0) {
61701 sys_ioctl(fd, FDEJECT, 0);
61702 sys_close(fd);
61703 }
61704 printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
61705 - fd = sys_open("/dev/console", O_RDWR, 0);
61706 + fd = sys_open((__force const char __user *)"/dev/console", O_RDWR, 0);
61707 if (fd >= 0) {
61708 sys_ioctl(fd, TCGETS, (long)&termios);
61709 termios.c_lflag &= ~ICANON;
61710 sys_ioctl(fd, TCSETSF, (long)&termios);
61711 - sys_read(fd, &c, 1);
61712 + sys_read(fd, (char __user *)&c, 1);
61713 termios.c_lflag |= ICANON;
61714 sys_ioctl(fd, TCSETSF, (long)&termios);
61715 sys_close(fd);
61716 @@ -488,6 +488,6 @@ void __init prepare_namespace(void)
61717 mount_root();
61718 out:
61719 devtmpfs_mount("dev");
61720 - sys_mount(".", "/", NULL, MS_MOVE, NULL);
61721 - sys_chroot((const char __user __force *)".");
61722 + sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
61723 + sys_chroot((const char __force_user *)".");
61724 }
61725 diff -urNp linux-3.0.8/init/do_mounts.h linux-3.0.8/init/do_mounts.h
61726 --- linux-3.0.8/init/do_mounts.h 2011-07-21 22:17:23.000000000 -0400
61727 +++ linux-3.0.8/init/do_mounts.h 2011-10-06 04:17:55.000000000 -0400
61728 @@ -15,15 +15,15 @@ extern int root_mountflags;
61729
61730 static inline int create_dev(char *name, dev_t dev)
61731 {
61732 - sys_unlink(name);
61733 - return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
61734 + sys_unlink((char __force_user *)name);
61735 + return sys_mknod((char __force_user *)name, S_IFBLK|0600, new_encode_dev(dev));
61736 }
61737
61738 #if BITS_PER_LONG == 32
61739 static inline u32 bstat(char *name)
61740 {
61741 struct stat64 stat;
61742 - if (sys_stat64(name, &stat) != 0)
61743 + if (sys_stat64((char __force_user *)name, (struct stat64 __force_user *)&stat) != 0)
61744 return 0;
61745 if (!S_ISBLK(stat.st_mode))
61746 return 0;
61747 @@ -35,7 +35,7 @@ static inline u32 bstat(char *name)
61748 static inline u32 bstat(char *name)
61749 {
61750 struct stat stat;
61751 - if (sys_newstat(name, &stat) != 0)
61752 + if (sys_newstat((const char __force_user *)name, (struct stat __force_user *)&stat) != 0)
61753 return 0;
61754 if (!S_ISBLK(stat.st_mode))
61755 return 0;
61756 diff -urNp linux-3.0.8/init/do_mounts_initrd.c linux-3.0.8/init/do_mounts_initrd.c
61757 --- linux-3.0.8/init/do_mounts_initrd.c 2011-07-21 22:17:23.000000000 -0400
61758 +++ linux-3.0.8/init/do_mounts_initrd.c 2011-10-06 04:17:55.000000000 -0400
61759 @@ -44,13 +44,13 @@ static void __init handle_initrd(void)
61760 create_dev("/dev/root.old", Root_RAM0);
61761 /* mount initrd on rootfs' /root */
61762 mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
61763 - sys_mkdir("/old", 0700);
61764 - root_fd = sys_open("/", 0, 0);
61765 - old_fd = sys_open("/old", 0, 0);
61766 + sys_mkdir((const char __force_user *)"/old", 0700);
61767 + root_fd = sys_open((const char __force_user *)"/", 0, 0);
61768 + old_fd = sys_open((const char __force_user *)"/old", 0, 0);
61769 /* move initrd over / and chdir/chroot in initrd root */
61770 - sys_chdir("/root");
61771 - sys_mount(".", "/", NULL, MS_MOVE, NULL);
61772 - sys_chroot(".");
61773 + sys_chdir((const char __force_user *)"/root");
61774 + sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
61775 + sys_chroot((const char __force_user *)".");
61776
61777 /*
61778 * In case that a resume from disk is carried out by linuxrc or one of
61779 @@ -67,15 +67,15 @@ static void __init handle_initrd(void)
61780
61781 /* move initrd to rootfs' /old */
61782 sys_fchdir(old_fd);
61783 - sys_mount("/", ".", NULL, MS_MOVE, NULL);
61784 + sys_mount((char __force_user *)"/", (char __force_user *)".", NULL, MS_MOVE, NULL);
61785 /* switch root and cwd back to / of rootfs */
61786 sys_fchdir(root_fd);
61787 - sys_chroot(".");
61788 + sys_chroot((const char __force_user *)".");
61789 sys_close(old_fd);
61790 sys_close(root_fd);
61791
61792 if (new_decode_dev(real_root_dev) == Root_RAM0) {
61793 - sys_chdir("/old");
61794 + sys_chdir((const char __force_user *)"/old");
61795 return;
61796 }
61797
61798 @@ -83,17 +83,17 @@ static void __init handle_initrd(void)
61799 mount_root();
61800
61801 printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
61802 - error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
61803 + error = sys_mount((char __force_user *)"/old", (char __force_user *)"/root/initrd", NULL, MS_MOVE, NULL);
61804 if (!error)
61805 printk("okay\n");
61806 else {
61807 - int fd = sys_open("/dev/root.old", O_RDWR, 0);
61808 + int fd = sys_open((const char __force_user *)"/dev/root.old", O_RDWR, 0);
61809 if (error == -ENOENT)
61810 printk("/initrd does not exist. Ignored.\n");
61811 else
61812 printk("failed\n");
61813 printk(KERN_NOTICE "Unmounting old root\n");
61814 - sys_umount("/old", MNT_DETACH);
61815 + sys_umount((char __force_user *)"/old", MNT_DETACH);
61816 printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
61817 if (fd < 0) {
61818 error = fd;
61819 @@ -116,11 +116,11 @@ int __init initrd_load(void)
61820 * mounted in the normal path.
61821 */
61822 if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
61823 - sys_unlink("/initrd.image");
61824 + sys_unlink((const char __force_user *)"/initrd.image");
61825 handle_initrd();
61826 return 1;
61827 }
61828 }
61829 - sys_unlink("/initrd.image");
61830 + sys_unlink((const char __force_user *)"/initrd.image");
61831 return 0;
61832 }
61833 diff -urNp linux-3.0.8/init/do_mounts_md.c linux-3.0.8/init/do_mounts_md.c
61834 --- linux-3.0.8/init/do_mounts_md.c 2011-07-21 22:17:23.000000000 -0400
61835 +++ linux-3.0.8/init/do_mounts_md.c 2011-10-06 04:17:55.000000000 -0400
61836 @@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
61837 partitioned ? "_d" : "", minor,
61838 md_setup_args[ent].device_names);
61839
61840 - fd = sys_open(name, 0, 0);
61841 + fd = sys_open((char __force_user *)name, 0, 0);
61842 if (fd < 0) {
61843 printk(KERN_ERR "md: open failed - cannot start "
61844 "array %s\n", name);
61845 @@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
61846 * array without it
61847 */
61848 sys_close(fd);
61849 - fd = sys_open(name, 0, 0);
61850 + fd = sys_open((char __force_user *)name, 0, 0);
61851 sys_ioctl(fd, BLKRRPART, 0);
61852 }
61853 sys_close(fd);
61854 @@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
61855
61856 wait_for_device_probe();
61857
61858 - fd = sys_open((const char __user __force *) "/dev/md0", 0, 0);
61859 + fd = sys_open((const char __force_user *) "/dev/md0", 0, 0);
61860 if (fd >= 0) {
61861 sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
61862 sys_close(fd);
61863 diff -urNp linux-3.0.8/init/initramfs.c linux-3.0.8/init/initramfs.c
61864 --- linux-3.0.8/init/initramfs.c 2011-07-21 22:17:23.000000000 -0400
61865 +++ linux-3.0.8/init/initramfs.c 2011-10-06 04:17:55.000000000 -0400
61866 @@ -74,7 +74,7 @@ static void __init free_hash(void)
61867 }
61868 }
61869
61870 -static long __init do_utime(char __user *filename, time_t mtime)
61871 +static long __init do_utime(__force char __user *filename, time_t mtime)
61872 {
61873 struct timespec t[2];
61874
61875 @@ -109,7 +109,7 @@ static void __init dir_utime(void)
61876 struct dir_entry *de, *tmp;
61877 list_for_each_entry_safe(de, tmp, &dir_list, list) {
61878 list_del(&de->list);
61879 - do_utime(de->name, de->mtime);
61880 + do_utime((char __force_user *)de->name, de->mtime);
61881 kfree(de->name);
61882 kfree(de);
61883 }
61884 @@ -271,7 +271,7 @@ static int __init maybe_link(void)
61885 if (nlink >= 2) {
61886 char *old = find_link(major, minor, ino, mode, collected);
61887 if (old)
61888 - return (sys_link(old, collected) < 0) ? -1 : 1;
61889 + return (sys_link((char __force_user *)old, (char __force_user *)collected) < 0) ? -1 : 1;
61890 }
61891 return 0;
61892 }
61893 @@ -280,11 +280,11 @@ static void __init clean_path(char *path
61894 {
61895 struct stat st;
61896
61897 - if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
61898 + if (!sys_newlstat((char __force_user *)path, (struct stat __force_user *)&st) && (st.st_mode^mode) & S_IFMT) {
61899 if (S_ISDIR(st.st_mode))
61900 - sys_rmdir(path);
61901 + sys_rmdir((char __force_user *)path);
61902 else
61903 - sys_unlink(path);
61904 + sys_unlink((char __force_user *)path);
61905 }
61906 }
61907
61908 @@ -305,7 +305,7 @@ static int __init do_name(void)
61909 int openflags = O_WRONLY|O_CREAT;
61910 if (ml != 1)
61911 openflags |= O_TRUNC;
61912 - wfd = sys_open(collected, openflags, mode);
61913 + wfd = sys_open((char __force_user *)collected, openflags, mode);
61914
61915 if (wfd >= 0) {
61916 sys_fchown(wfd, uid, gid);
61917 @@ -317,17 +317,17 @@ static int __init do_name(void)
61918 }
61919 }
61920 } else if (S_ISDIR(mode)) {
61921 - sys_mkdir(collected, mode);
61922 - sys_chown(collected, uid, gid);
61923 - sys_chmod(collected, mode);
61924 + sys_mkdir((char __force_user *)collected, mode);
61925 + sys_chown((char __force_user *)collected, uid, gid);
61926 + sys_chmod((char __force_user *)collected, mode);
61927 dir_add(collected, mtime);
61928 } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
61929 S_ISFIFO(mode) || S_ISSOCK(mode)) {
61930 if (maybe_link() == 0) {
61931 - sys_mknod(collected, mode, rdev);
61932 - sys_chown(collected, uid, gid);
61933 - sys_chmod(collected, mode);
61934 - do_utime(collected, mtime);
61935 + sys_mknod((char __force_user *)collected, mode, rdev);
61936 + sys_chown((char __force_user *)collected, uid, gid);
61937 + sys_chmod((char __force_user *)collected, mode);
61938 + do_utime((char __force_user *)collected, mtime);
61939 }
61940 }
61941 return 0;
61942 @@ -336,15 +336,15 @@ static int __init do_name(void)
61943 static int __init do_copy(void)
61944 {
61945 if (count >= body_len) {
61946 - sys_write(wfd, victim, body_len);
61947 + sys_write(wfd, (char __force_user *)victim, body_len);
61948 sys_close(wfd);
61949 - do_utime(vcollected, mtime);
61950 + do_utime((char __force_user *)vcollected, mtime);
61951 kfree(vcollected);
61952 eat(body_len);
61953 state = SkipIt;
61954 return 0;
61955 } else {
61956 - sys_write(wfd, victim, count);
61957 + sys_write(wfd, (char __force_user *)victim, count);
61958 body_len -= count;
61959 eat(count);
61960 return 1;
61961 @@ -355,9 +355,9 @@ static int __init do_symlink(void)
61962 {
61963 collected[N_ALIGN(name_len) + body_len] = '\0';
61964 clean_path(collected, 0);
61965 - sys_symlink(collected + N_ALIGN(name_len), collected);
61966 - sys_lchown(collected, uid, gid);
61967 - do_utime(collected, mtime);
61968 + sys_symlink((char __force_user *)collected + N_ALIGN(name_len), (char __force_user *)collected);
61969 + sys_lchown((char __force_user *)collected, uid, gid);
61970 + do_utime((char __force_user *)collected, mtime);
61971 state = SkipIt;
61972 next_state = Reset;
61973 return 0;
61974 diff -urNp linux-3.0.8/init/Kconfig linux-3.0.8/init/Kconfig
61975 --- linux-3.0.8/init/Kconfig 2011-07-21 22:17:23.000000000 -0400
61976 +++ linux-3.0.8/init/Kconfig 2011-08-23 21:47:56.000000000 -0400
61977 @@ -1195,7 +1195,7 @@ config SLUB_DEBUG
61978
61979 config COMPAT_BRK
61980 bool "Disable heap randomization"
61981 - default y
61982 + default n
61983 help
61984 Randomizing heap placement makes heap exploits harder, but it
61985 also breaks ancient binaries (including anything libc5 based).
61986 diff -urNp linux-3.0.8/init/main.c linux-3.0.8/init/main.c
61987 --- linux-3.0.8/init/main.c 2011-07-21 22:17:23.000000000 -0400
61988 +++ linux-3.0.8/init/main.c 2011-10-06 04:17:55.000000000 -0400
61989 @@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void)
61990 extern void tc_init(void);
61991 #endif
61992
61993 +extern void grsecurity_init(void);
61994 +
61995 /*
61996 * Debug helper: via this flag we know that we are in 'early bootup code'
61997 * where only the boot processor is running with IRQ disabled. This means
61998 @@ -149,6 +151,49 @@ static int __init set_reset_devices(char
61999
62000 __setup("reset_devices", set_reset_devices);
62001
62002 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
62003 +extern char pax_enter_kernel_user[];
62004 +extern char pax_exit_kernel_user[];
62005 +extern pgdval_t clone_pgd_mask;
62006 +#endif
62007 +
62008 +#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
62009 +static int __init setup_pax_nouderef(char *str)
62010 +{
62011 +#ifdef CONFIG_X86_32
62012 + unsigned int cpu;
62013 + struct desc_struct *gdt;
62014 +
62015 + for (cpu = 0; cpu < NR_CPUS; cpu++) {
62016 + gdt = get_cpu_gdt_table(cpu);
62017 + gdt[GDT_ENTRY_KERNEL_DS].type = 3;
62018 + gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
62019 + gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
62020 + gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
62021 + }
62022 + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
62023 +#else
62024 + memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
62025 + memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
62026 + clone_pgd_mask = ~(pgdval_t)0UL;
62027 +#endif
62028 +
62029 + return 0;
62030 +}
62031 +early_param("pax_nouderef", setup_pax_nouderef);
62032 +#endif
62033 +
62034 +#ifdef CONFIG_PAX_SOFTMODE
62035 +int pax_softmode;
62036 +
62037 +static int __init setup_pax_softmode(char *str)
62038 +{
62039 + get_option(&str, &pax_softmode);
62040 + return 1;
62041 +}
62042 +__setup("pax_softmode=", setup_pax_softmode);
62043 +#endif
62044 +
62045 static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
62046 const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
62047 static const char *panic_later, *panic_param;
62048 @@ -667,6 +712,7 @@ int __init_or_module do_one_initcall(ini
62049 {
62050 int count = preempt_count();
62051 int ret;
62052 + const char *msg1 = "", *msg2 = "";
62053
62054 if (initcall_debug)
62055 ret = do_one_initcall_debug(fn);
62056 @@ -679,15 +725,15 @@ int __init_or_module do_one_initcall(ini
62057 sprintf(msgbuf, "error code %d ", ret);
62058
62059 if (preempt_count() != count) {
62060 - strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
62061 + msg1 = " preemption imbalance";
62062 preempt_count() = count;
62063 }
62064 if (irqs_disabled()) {
62065 - strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
62066 + msg2 = " disabled interrupts";
62067 local_irq_enable();
62068 }
62069 - if (msgbuf[0]) {
62070 - printk("initcall %pF returned with %s\n", fn, msgbuf);
62071 + if (msgbuf[0] || *msg1 || *msg2) {
62072 + printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
62073 }
62074
62075 return ret;
62076 @@ -805,7 +851,7 @@ static int __init kernel_init(void * unu
62077 do_basic_setup();
62078
62079 /* Open the /dev/console on the rootfs, this should never fail */
62080 - if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0)
62081 + if (sys_open((const char __force_user *) "/dev/console", O_RDWR, 0) < 0)
62082 printk(KERN_WARNING "Warning: unable to open an initial console.\n");
62083
62084 (void) sys_dup(0);
62085 @@ -818,11 +864,13 @@ static int __init kernel_init(void * unu
62086 if (!ramdisk_execute_command)
62087 ramdisk_execute_command = "/init";
62088
62089 - if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
62090 + if (sys_access((const char __force_user *) ramdisk_execute_command, 0) != 0) {
62091 ramdisk_execute_command = NULL;
62092 prepare_namespace();
62093 }
62094
62095 + grsecurity_init();
62096 +
62097 /*
62098 * Ok, we have completed the initial bootup, and
62099 * we're essentially up and running. Get rid of the
62100 diff -urNp linux-3.0.8/ipc/mqueue.c linux-3.0.8/ipc/mqueue.c
62101 --- linux-3.0.8/ipc/mqueue.c 2011-10-24 08:05:30.000000000 -0400
62102 +++ linux-3.0.8/ipc/mqueue.c 2011-10-16 21:59:31.000000000 -0400
62103 @@ -156,6 +156,7 @@ static struct inode *mqueue_get_inode(st
62104 mq_bytes = (mq_msg_tblsz +
62105 (info->attr.mq_maxmsg * info->attr.mq_msgsize));
62106
62107 + gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
62108 spin_lock(&mq_lock);
62109 if (u->mq_bytes + mq_bytes < u->mq_bytes ||
62110 u->mq_bytes + mq_bytes > task_rlimit(p, RLIMIT_MSGQUEUE)) {
62111 diff -urNp linux-3.0.8/ipc/msg.c linux-3.0.8/ipc/msg.c
62112 --- linux-3.0.8/ipc/msg.c 2011-07-21 22:17:23.000000000 -0400
62113 +++ linux-3.0.8/ipc/msg.c 2011-08-23 21:47:56.000000000 -0400
62114 @@ -309,18 +309,19 @@ static inline int msg_security(struct ke
62115 return security_msg_queue_associate(msq, msgflg);
62116 }
62117
62118 +static struct ipc_ops msg_ops = {
62119 + .getnew = newque,
62120 + .associate = msg_security,
62121 + .more_checks = NULL
62122 +};
62123 +
62124 SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
62125 {
62126 struct ipc_namespace *ns;
62127 - struct ipc_ops msg_ops;
62128 struct ipc_params msg_params;
62129
62130 ns = current->nsproxy->ipc_ns;
62131
62132 - msg_ops.getnew = newque;
62133 - msg_ops.associate = msg_security;
62134 - msg_ops.more_checks = NULL;
62135 -
62136 msg_params.key = key;
62137 msg_params.flg = msgflg;
62138
62139 diff -urNp linux-3.0.8/ipc/sem.c linux-3.0.8/ipc/sem.c
62140 --- linux-3.0.8/ipc/sem.c 2011-10-24 08:05:21.000000000 -0400
62141 +++ linux-3.0.8/ipc/sem.c 2011-08-23 21:48:14.000000000 -0400
62142 @@ -318,10 +318,15 @@ static inline int sem_more_checks(struct
62143 return 0;
62144 }
62145
62146 +static struct ipc_ops sem_ops = {
62147 + .getnew = newary,
62148 + .associate = sem_security,
62149 + .more_checks = sem_more_checks
62150 +};
62151 +
62152 SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
62153 {
62154 struct ipc_namespace *ns;
62155 - struct ipc_ops sem_ops;
62156 struct ipc_params sem_params;
62157
62158 ns = current->nsproxy->ipc_ns;
62159 @@ -329,10 +334,6 @@ SYSCALL_DEFINE3(semget, key_t, key, int,
62160 if (nsems < 0 || nsems > ns->sc_semmsl)
62161 return -EINVAL;
62162
62163 - sem_ops.getnew = newary;
62164 - sem_ops.associate = sem_security;
62165 - sem_ops.more_checks = sem_more_checks;
62166 -
62167 sem_params.key = key;
62168 sem_params.flg = semflg;
62169 sem_params.u.nsems = nsems;
62170 @@ -854,6 +855,8 @@ static int semctl_main(struct ipc_namesp
62171 int nsems;
62172 struct list_head tasks;
62173
62174 + pax_track_stack();
62175 +
62176 sma = sem_lock_check(ns, semid);
62177 if (IS_ERR(sma))
62178 return PTR_ERR(sma);
62179 @@ -1301,6 +1304,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid,
62180 struct ipc_namespace *ns;
62181 struct list_head tasks;
62182
62183 + pax_track_stack();
62184 +
62185 ns = current->nsproxy->ipc_ns;
62186
62187 if (nsops < 1 || semid < 0)
62188 diff -urNp linux-3.0.8/ipc/shm.c linux-3.0.8/ipc/shm.c
62189 --- linux-3.0.8/ipc/shm.c 2011-07-21 22:17:23.000000000 -0400
62190 +++ linux-3.0.8/ipc/shm.c 2011-08-23 21:48:14.000000000 -0400
62191 @@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_name
62192 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
62193 #endif
62194
62195 +#ifdef CONFIG_GRKERNSEC
62196 +extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
62197 + const time_t shm_createtime, const uid_t cuid,
62198 + const int shmid);
62199 +extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
62200 + const time_t shm_createtime);
62201 +#endif
62202 +
62203 void shm_init_ns(struct ipc_namespace *ns)
62204 {
62205 ns->shm_ctlmax = SHMMAX;
62206 @@ -401,6 +409,14 @@ static int newseg(struct ipc_namespace *
62207 shp->shm_lprid = 0;
62208 shp->shm_atim = shp->shm_dtim = 0;
62209 shp->shm_ctim = get_seconds();
62210 +#ifdef CONFIG_GRKERNSEC
62211 + {
62212 + struct timespec timeval;
62213 + do_posix_clock_monotonic_gettime(&timeval);
62214 +
62215 + shp->shm_createtime = timeval.tv_sec;
62216 + }
62217 +#endif
62218 shp->shm_segsz = size;
62219 shp->shm_nattch = 0;
62220 shp->shm_file = file;
62221 @@ -451,18 +467,19 @@ static inline int shm_more_checks(struct
62222 return 0;
62223 }
62224
62225 +static struct ipc_ops shm_ops = {
62226 + .getnew = newseg,
62227 + .associate = shm_security,
62228 + .more_checks = shm_more_checks
62229 +};
62230 +
62231 SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
62232 {
62233 struct ipc_namespace *ns;
62234 - struct ipc_ops shm_ops;
62235 struct ipc_params shm_params;
62236
62237 ns = current->nsproxy->ipc_ns;
62238
62239 - shm_ops.getnew = newseg;
62240 - shm_ops.associate = shm_security;
62241 - shm_ops.more_checks = shm_more_checks;
62242 -
62243 shm_params.key = key;
62244 shm_params.flg = shmflg;
62245 shm_params.u.size = size;
62246 @@ -762,8 +779,6 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int,
62247 case SHM_LOCK:
62248 case SHM_UNLOCK:
62249 {
62250 - struct file *uninitialized_var(shm_file);
62251 -
62252 lru_add_drain_all(); /* drain pagevecs to lru lists */
62253
62254 shp = shm_lock_check(ns, shmid);
62255 @@ -896,9 +911,21 @@ long do_shmat(int shmid, char __user *sh
62256 if (err)
62257 goto out_unlock;
62258
62259 +#ifdef CONFIG_GRKERNSEC
62260 + if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
62261 + shp->shm_perm.cuid, shmid) ||
62262 + !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
62263 + err = -EACCES;
62264 + goto out_unlock;
62265 + }
62266 +#endif
62267 +
62268 path = shp->shm_file->f_path;
62269 path_get(&path);
62270 shp->shm_nattch++;
62271 +#ifdef CONFIG_GRKERNSEC
62272 + shp->shm_lapid = current->pid;
62273 +#endif
62274 size = i_size_read(path.dentry->d_inode);
62275 shm_unlock(shp);
62276
62277 diff -urNp linux-3.0.8/kernel/acct.c linux-3.0.8/kernel/acct.c
62278 --- linux-3.0.8/kernel/acct.c 2011-07-21 22:17:23.000000000 -0400
62279 +++ linux-3.0.8/kernel/acct.c 2011-10-06 04:17:55.000000000 -0400
62280 @@ -570,7 +570,7 @@ static void do_acct_process(struct bsd_a
62281 */
62282 flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
62283 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
62284 - file->f_op->write(file, (char *)&ac,
62285 + file->f_op->write(file, (char __force_user *)&ac,
62286 sizeof(acct_t), &file->f_pos);
62287 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
62288 set_fs(fs);
62289 diff -urNp linux-3.0.8/kernel/audit.c linux-3.0.8/kernel/audit.c
62290 --- linux-3.0.8/kernel/audit.c 2011-07-21 22:17:23.000000000 -0400
62291 +++ linux-3.0.8/kernel/audit.c 2011-08-23 21:47:56.000000000 -0400
62292 @@ -112,7 +112,7 @@ u32 audit_sig_sid = 0;
62293 3) suppressed due to audit_rate_limit
62294 4) suppressed due to audit_backlog_limit
62295 */
62296 -static atomic_t audit_lost = ATOMIC_INIT(0);
62297 +static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
62298
62299 /* The netlink socket. */
62300 static struct sock *audit_sock;
62301 @@ -234,7 +234,7 @@ void audit_log_lost(const char *message)
62302 unsigned long now;
62303 int print;
62304
62305 - atomic_inc(&audit_lost);
62306 + atomic_inc_unchecked(&audit_lost);
62307
62308 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
62309
62310 @@ -253,7 +253,7 @@ void audit_log_lost(const char *message)
62311 printk(KERN_WARNING
62312 "audit: audit_lost=%d audit_rate_limit=%d "
62313 "audit_backlog_limit=%d\n",
62314 - atomic_read(&audit_lost),
62315 + atomic_read_unchecked(&audit_lost),
62316 audit_rate_limit,
62317 audit_backlog_limit);
62318 audit_panic(message);
62319 @@ -686,7 +686,7 @@ static int audit_receive_msg(struct sk_b
62320 status_set.pid = audit_pid;
62321 status_set.rate_limit = audit_rate_limit;
62322 status_set.backlog_limit = audit_backlog_limit;
62323 - status_set.lost = atomic_read(&audit_lost);
62324 + status_set.lost = atomic_read_unchecked(&audit_lost);
62325 status_set.backlog = skb_queue_len(&audit_skb_queue);
62326 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
62327 &status_set, sizeof(status_set));
62328 diff -urNp linux-3.0.8/kernel/auditsc.c linux-3.0.8/kernel/auditsc.c
62329 --- linux-3.0.8/kernel/auditsc.c 2011-07-21 22:17:23.000000000 -0400
62330 +++ linux-3.0.8/kernel/auditsc.c 2011-08-23 21:47:56.000000000 -0400
62331 @@ -2118,7 +2118,7 @@ int auditsc_get_stamp(struct audit_conte
62332 }
62333
62334 /* global counter which is incremented every time something logs in */
62335 -static atomic_t session_id = ATOMIC_INIT(0);
62336 +static atomic_unchecked_t session_id = ATOMIC_INIT(0);
62337
62338 /**
62339 * audit_set_loginuid - set a task's audit_context loginuid
62340 @@ -2131,7 +2131,7 @@ static atomic_t session_id = ATOMIC_INIT
62341 */
62342 int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
62343 {
62344 - unsigned int sessionid = atomic_inc_return(&session_id);
62345 + unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
62346 struct audit_context *context = task->audit_context;
62347
62348 if (context && context->in_syscall) {
62349 diff -urNp linux-3.0.8/kernel/capability.c linux-3.0.8/kernel/capability.c
62350 --- linux-3.0.8/kernel/capability.c 2011-07-21 22:17:23.000000000 -0400
62351 +++ linux-3.0.8/kernel/capability.c 2011-08-23 21:48:14.000000000 -0400
62352 @@ -202,6 +202,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_
62353 * before modification is attempted and the application
62354 * fails.
62355 */
62356 + if (tocopy > ARRAY_SIZE(kdata))
62357 + return -EFAULT;
62358 +
62359 if (copy_to_user(dataptr, kdata, tocopy
62360 * sizeof(struct __user_cap_data_struct))) {
62361 return -EFAULT;
62362 @@ -374,7 +377,7 @@ bool ns_capable(struct user_namespace *n
62363 BUG();
62364 }
62365
62366 - if (security_capable(ns, current_cred(), cap) == 0) {
62367 + if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable(cap)) {
62368 current->flags |= PF_SUPERPRIV;
62369 return true;
62370 }
62371 @@ -382,6 +385,27 @@ bool ns_capable(struct user_namespace *n
62372 }
62373 EXPORT_SYMBOL(ns_capable);
62374
62375 +bool ns_capable_nolog(struct user_namespace *ns, int cap)
62376 +{
62377 + if (unlikely(!cap_valid(cap))) {
62378 + printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
62379 + BUG();
62380 + }
62381 +
62382 + if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable_nolog(cap)) {
62383 + current->flags |= PF_SUPERPRIV;
62384 + return true;
62385 + }
62386 + return false;
62387 +}
62388 +EXPORT_SYMBOL(ns_capable_nolog);
62389 +
62390 +bool capable_nolog(int cap)
62391 +{
62392 + return ns_capable_nolog(&init_user_ns, cap);
62393 +}
62394 +EXPORT_SYMBOL(capable_nolog);
62395 +
62396 /**
62397 * task_ns_capable - Determine whether current task has a superior
62398 * capability targeted at a specific task's user namespace.
62399 @@ -396,6 +420,12 @@ bool task_ns_capable(struct task_struct
62400 }
62401 EXPORT_SYMBOL(task_ns_capable);
62402
62403 +bool task_ns_capable_nolog(struct task_struct *t, int cap)
62404 +{
62405 + return ns_capable_nolog(task_cred_xxx(t, user)->user_ns, cap);
62406 +}
62407 +EXPORT_SYMBOL(task_ns_capable_nolog);
62408 +
62409 /**
62410 * nsown_capable - Check superior capability to one's own user_ns
62411 * @cap: The capability in question
62412 diff -urNp linux-3.0.8/kernel/cgroup.c linux-3.0.8/kernel/cgroup.c
62413 --- linux-3.0.8/kernel/cgroup.c 2011-07-21 22:17:23.000000000 -0400
62414 +++ linux-3.0.8/kernel/cgroup.c 2011-08-23 21:48:14.000000000 -0400
62415 @@ -593,6 +593,8 @@ static struct css_set *find_css_set(
62416 struct hlist_head *hhead;
62417 struct cg_cgroup_link *link;
62418
62419 + pax_track_stack();
62420 +
62421 /* First see if we already have a cgroup group that matches
62422 * the desired set */
62423 read_lock(&css_set_lock);
62424 diff -urNp linux-3.0.8/kernel/compat.c linux-3.0.8/kernel/compat.c
62425 --- linux-3.0.8/kernel/compat.c 2011-07-21 22:17:23.000000000 -0400
62426 +++ linux-3.0.8/kernel/compat.c 2011-10-06 04:17:55.000000000 -0400
62427 @@ -13,6 +13,7 @@
62428
62429 #include <linux/linkage.h>
62430 #include <linux/compat.h>
62431 +#include <linux/module.h>
62432 #include <linux/errno.h>
62433 #include <linux/time.h>
62434 #include <linux/signal.h>
62435 @@ -166,7 +167,7 @@ static long compat_nanosleep_restart(str
62436 mm_segment_t oldfs;
62437 long ret;
62438
62439 - restart->nanosleep.rmtp = (struct timespec __user *) &rmt;
62440 + restart->nanosleep.rmtp = (struct timespec __force_user *) &rmt;
62441 oldfs = get_fs();
62442 set_fs(KERNEL_DS);
62443 ret = hrtimer_nanosleep_restart(restart);
62444 @@ -198,7 +199,7 @@ asmlinkage long compat_sys_nanosleep(str
62445 oldfs = get_fs();
62446 set_fs(KERNEL_DS);
62447 ret = hrtimer_nanosleep(&tu,
62448 - rmtp ? (struct timespec __user *)&rmt : NULL,
62449 + rmtp ? (struct timespec __force_user *)&rmt : NULL,
62450 HRTIMER_MODE_REL, CLOCK_MONOTONIC);
62451 set_fs(oldfs);
62452
62453 @@ -307,7 +308,7 @@ asmlinkage long compat_sys_sigpending(co
62454 mm_segment_t old_fs = get_fs();
62455
62456 set_fs(KERNEL_DS);
62457 - ret = sys_sigpending((old_sigset_t __user *) &s);
62458 + ret = sys_sigpending((old_sigset_t __force_user *) &s);
62459 set_fs(old_fs);
62460 if (ret == 0)
62461 ret = put_user(s, set);
62462 @@ -330,8 +331,8 @@ asmlinkage long compat_sys_sigprocmask(i
62463 old_fs = get_fs();
62464 set_fs(KERNEL_DS);
62465 ret = sys_sigprocmask(how,
62466 - set ? (old_sigset_t __user *) &s : NULL,
62467 - oset ? (old_sigset_t __user *) &s : NULL);
62468 + set ? (old_sigset_t __force_user *) &s : NULL,
62469 + oset ? (old_sigset_t __force_user *) &s : NULL);
62470 set_fs(old_fs);
62471 if (ret == 0)
62472 if (oset)
62473 @@ -368,7 +369,7 @@ asmlinkage long compat_sys_old_getrlimit
62474 mm_segment_t old_fs = get_fs();
62475
62476 set_fs(KERNEL_DS);
62477 - ret = sys_old_getrlimit(resource, &r);
62478 + ret = sys_old_getrlimit(resource, (struct rlimit __force_user *)&r);
62479 set_fs(old_fs);
62480
62481 if (!ret) {
62482 @@ -440,7 +441,7 @@ asmlinkage long compat_sys_getrusage(int
62483 mm_segment_t old_fs = get_fs();
62484
62485 set_fs(KERNEL_DS);
62486 - ret = sys_getrusage(who, (struct rusage __user *) &r);
62487 + ret = sys_getrusage(who, (struct rusage __force_user *) &r);
62488 set_fs(old_fs);
62489
62490 if (ret)
62491 @@ -467,8 +468,8 @@ compat_sys_wait4(compat_pid_t pid, compa
62492 set_fs (KERNEL_DS);
62493 ret = sys_wait4(pid,
62494 (stat_addr ?
62495 - (unsigned int __user *) &status : NULL),
62496 - options, (struct rusage __user *) &r);
62497 + (unsigned int __force_user *) &status : NULL),
62498 + options, (struct rusage __force_user *) &r);
62499 set_fs (old_fs);
62500
62501 if (ret > 0) {
62502 @@ -493,8 +494,8 @@ asmlinkage long compat_sys_waitid(int wh
62503 memset(&info, 0, sizeof(info));
62504
62505 set_fs(KERNEL_DS);
62506 - ret = sys_waitid(which, pid, (siginfo_t __user *)&info, options,
62507 - uru ? (struct rusage __user *)&ru : NULL);
62508 + ret = sys_waitid(which, pid, (siginfo_t __force_user *)&info, options,
62509 + uru ? (struct rusage __force_user *)&ru : NULL);
62510 set_fs(old_fs);
62511
62512 if ((ret < 0) || (info.si_signo == 0))
62513 @@ -624,8 +625,8 @@ long compat_sys_timer_settime(timer_t ti
62514 oldfs = get_fs();
62515 set_fs(KERNEL_DS);
62516 err = sys_timer_settime(timer_id, flags,
62517 - (struct itimerspec __user *) &newts,
62518 - (struct itimerspec __user *) &oldts);
62519 + (struct itimerspec __force_user *) &newts,
62520 + (struct itimerspec __force_user *) &oldts);
62521 set_fs(oldfs);
62522 if (!err && old && put_compat_itimerspec(old, &oldts))
62523 return -EFAULT;
62524 @@ -642,7 +643,7 @@ long compat_sys_timer_gettime(timer_t ti
62525 oldfs = get_fs();
62526 set_fs(KERNEL_DS);
62527 err = sys_timer_gettime(timer_id,
62528 - (struct itimerspec __user *) &ts);
62529 + (struct itimerspec __force_user *) &ts);
62530 set_fs(oldfs);
62531 if (!err && put_compat_itimerspec(setting, &ts))
62532 return -EFAULT;
62533 @@ -661,7 +662,7 @@ long compat_sys_clock_settime(clockid_t
62534 oldfs = get_fs();
62535 set_fs(KERNEL_DS);
62536 err = sys_clock_settime(which_clock,
62537 - (struct timespec __user *) &ts);
62538 + (struct timespec __force_user *) &ts);
62539 set_fs(oldfs);
62540 return err;
62541 }
62542 @@ -676,7 +677,7 @@ long compat_sys_clock_gettime(clockid_t
62543 oldfs = get_fs();
62544 set_fs(KERNEL_DS);
62545 err = sys_clock_gettime(which_clock,
62546 - (struct timespec __user *) &ts);
62547 + (struct timespec __force_user *) &ts);
62548 set_fs(oldfs);
62549 if (!err && put_compat_timespec(&ts, tp))
62550 return -EFAULT;
62551 @@ -696,7 +697,7 @@ long compat_sys_clock_adjtime(clockid_t
62552
62553 oldfs = get_fs();
62554 set_fs(KERNEL_DS);
62555 - ret = sys_clock_adjtime(which_clock, (struct timex __user *) &txc);
62556 + ret = sys_clock_adjtime(which_clock, (struct timex __force_user *) &txc);
62557 set_fs(oldfs);
62558
62559 err = compat_put_timex(utp, &txc);
62560 @@ -716,7 +717,7 @@ long compat_sys_clock_getres(clockid_t w
62561 oldfs = get_fs();
62562 set_fs(KERNEL_DS);
62563 err = sys_clock_getres(which_clock,
62564 - (struct timespec __user *) &ts);
62565 + (struct timespec __force_user *) &ts);
62566 set_fs(oldfs);
62567 if (!err && tp && put_compat_timespec(&ts, tp))
62568 return -EFAULT;
62569 @@ -728,9 +729,9 @@ static long compat_clock_nanosleep_resta
62570 long err;
62571 mm_segment_t oldfs;
62572 struct timespec tu;
62573 - struct compat_timespec *rmtp = restart->nanosleep.compat_rmtp;
62574 + struct compat_timespec __user *rmtp = restart->nanosleep.compat_rmtp;
62575
62576 - restart->nanosleep.rmtp = (struct timespec __user *) &tu;
62577 + restart->nanosleep.rmtp = (struct timespec __force_user *) &tu;
62578 oldfs = get_fs();
62579 set_fs(KERNEL_DS);
62580 err = clock_nanosleep_restart(restart);
62581 @@ -762,8 +763,8 @@ long compat_sys_clock_nanosleep(clockid_
62582 oldfs = get_fs();
62583 set_fs(KERNEL_DS);
62584 err = sys_clock_nanosleep(which_clock, flags,
62585 - (struct timespec __user *) &in,
62586 - (struct timespec __user *) &out);
62587 + (struct timespec __force_user *) &in,
62588 + (struct timespec __force_user *) &out);
62589 set_fs(oldfs);
62590
62591 if ((err == -ERESTART_RESTARTBLOCK) && rmtp &&
62592 diff -urNp linux-3.0.8/kernel/configs.c linux-3.0.8/kernel/configs.c
62593 --- linux-3.0.8/kernel/configs.c 2011-07-21 22:17:23.000000000 -0400
62594 +++ linux-3.0.8/kernel/configs.c 2011-08-23 21:48:14.000000000 -0400
62595 @@ -74,8 +74,19 @@ static int __init ikconfig_init(void)
62596 struct proc_dir_entry *entry;
62597
62598 /* create the current config file */
62599 +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
62600 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
62601 + entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
62602 + &ikconfig_file_ops);
62603 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
62604 + entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
62605 + &ikconfig_file_ops);
62606 +#endif
62607 +#else
62608 entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
62609 &ikconfig_file_ops);
62610 +#endif
62611 +
62612 if (!entry)
62613 return -ENOMEM;
62614
62615 diff -urNp linux-3.0.8/kernel/cred.c linux-3.0.8/kernel/cred.c
62616 --- linux-3.0.8/kernel/cred.c 2011-07-21 22:17:23.000000000 -0400
62617 +++ linux-3.0.8/kernel/cred.c 2011-08-25 17:23:03.000000000 -0400
62618 @@ -158,6 +158,8 @@ static void put_cred_rcu(struct rcu_head
62619 */
62620 void __put_cred(struct cred *cred)
62621 {
62622 + pax_track_stack();
62623 +
62624 kdebug("__put_cred(%p{%d,%d})", cred,
62625 atomic_read(&cred->usage),
62626 read_cred_subscribers(cred));
62627 @@ -182,6 +184,8 @@ void exit_creds(struct task_struct *tsk)
62628 {
62629 struct cred *cred;
62630
62631 + pax_track_stack();
62632 +
62633 kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
62634 atomic_read(&tsk->cred->usage),
62635 read_cred_subscribers(tsk->cred));
62636 @@ -220,6 +224,8 @@ const struct cred *get_task_cred(struct
62637 {
62638 const struct cred *cred;
62639
62640 + pax_track_stack();
62641 +
62642 rcu_read_lock();
62643
62644 do {
62645 @@ -239,6 +245,8 @@ struct cred *cred_alloc_blank(void)
62646 {
62647 struct cred *new;
62648
62649 + pax_track_stack();
62650 +
62651 new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
62652 if (!new)
62653 return NULL;
62654 @@ -287,6 +295,8 @@ struct cred *prepare_creds(void)
62655 const struct cred *old;
62656 struct cred *new;
62657
62658 + pax_track_stack();
62659 +
62660 validate_process_creds();
62661
62662 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
62663 @@ -333,6 +343,8 @@ struct cred *prepare_exec_creds(void)
62664 struct thread_group_cred *tgcred = NULL;
62665 struct cred *new;
62666
62667 + pax_track_stack();
62668 +
62669 #ifdef CONFIG_KEYS
62670 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
62671 if (!tgcred)
62672 @@ -385,6 +397,8 @@ int copy_creds(struct task_struct *p, un
62673 struct cred *new;
62674 int ret;
62675
62676 + pax_track_stack();
62677 +
62678 if (
62679 #ifdef CONFIG_KEYS
62680 !p->cred->thread_keyring &&
62681 @@ -475,6 +489,8 @@ int commit_creds(struct cred *new)
62682 struct task_struct *task = current;
62683 const struct cred *old = task->real_cred;
62684
62685 + pax_track_stack();
62686 +
62687 kdebug("commit_creds(%p{%d,%d})", new,
62688 atomic_read(&new->usage),
62689 read_cred_subscribers(new));
62690 @@ -489,6 +505,8 @@ int commit_creds(struct cred *new)
62691
62692 get_cred(new); /* we will require a ref for the subj creds too */
62693
62694 + gr_set_role_label(task, new->uid, new->gid);
62695 +
62696 /* dumpability changes */
62697 if (old->euid != new->euid ||
62698 old->egid != new->egid ||
62699 @@ -508,10 +526,8 @@ int commit_creds(struct cred *new)
62700 key_fsgid_changed(task);
62701
62702 /* do it
62703 - * - What if a process setreuid()'s and this brings the
62704 - * new uid over his NPROC rlimit? We can check this now
62705 - * cheaply with the new uid cache, so if it matters
62706 - * we should be checking for it. -DaveM
62707 + * RLIMIT_NPROC limits on user->processes have already been checked
62708 + * in set_user().
62709 */
62710 alter_cred_subscribers(new, 2);
62711 if (new->user != old->user)
62712 @@ -551,6 +567,8 @@ EXPORT_SYMBOL(commit_creds);
62713 */
62714 void abort_creds(struct cred *new)
62715 {
62716 + pax_track_stack();
62717 +
62718 kdebug("abort_creds(%p{%d,%d})", new,
62719 atomic_read(&new->usage),
62720 read_cred_subscribers(new));
62721 @@ -574,6 +592,8 @@ const struct cred *override_creds(const
62722 {
62723 const struct cred *old = current->cred;
62724
62725 + pax_track_stack();
62726 +
62727 kdebug("override_creds(%p{%d,%d})", new,
62728 atomic_read(&new->usage),
62729 read_cred_subscribers(new));
62730 @@ -603,6 +623,8 @@ void revert_creds(const struct cred *old
62731 {
62732 const struct cred *override = current->cred;
62733
62734 + pax_track_stack();
62735 +
62736 kdebug("revert_creds(%p{%d,%d})", old,
62737 atomic_read(&old->usage),
62738 read_cred_subscribers(old));
62739 @@ -649,6 +671,8 @@ struct cred *prepare_kernel_cred(struct
62740 const struct cred *old;
62741 struct cred *new;
62742
62743 + pax_track_stack();
62744 +
62745 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
62746 if (!new)
62747 return NULL;
62748 @@ -703,6 +727,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
62749 */
62750 int set_security_override(struct cred *new, u32 secid)
62751 {
62752 + pax_track_stack();
62753 +
62754 return security_kernel_act_as(new, secid);
62755 }
62756 EXPORT_SYMBOL(set_security_override);
62757 @@ -722,6 +748,8 @@ int set_security_override_from_ctx(struc
62758 u32 secid;
62759 int ret;
62760
62761 + pax_track_stack();
62762 +
62763 ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
62764 if (ret < 0)
62765 return ret;
62766 diff -urNp linux-3.0.8/kernel/debug/debug_core.c linux-3.0.8/kernel/debug/debug_core.c
62767 --- linux-3.0.8/kernel/debug/debug_core.c 2011-07-21 22:17:23.000000000 -0400
62768 +++ linux-3.0.8/kernel/debug/debug_core.c 2011-08-23 21:47:56.000000000 -0400
62769 @@ -119,7 +119,7 @@ static DEFINE_RAW_SPINLOCK(dbg_slave_loc
62770 */
62771 static atomic_t masters_in_kgdb;
62772 static atomic_t slaves_in_kgdb;
62773 -static atomic_t kgdb_break_tasklet_var;
62774 +static atomic_unchecked_t kgdb_break_tasklet_var;
62775 atomic_t kgdb_setting_breakpoint;
62776
62777 struct task_struct *kgdb_usethread;
62778 @@ -129,7 +129,7 @@ int kgdb_single_step;
62779 static pid_t kgdb_sstep_pid;
62780
62781 /* to keep track of the CPU which is doing the single stepping*/
62782 -atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
62783 +atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
62784
62785 /*
62786 * If you are debugging a problem where roundup (the collection of
62787 @@ -542,7 +542,7 @@ return_normal:
62788 * kernel will only try for the value of sstep_tries before
62789 * giving up and continuing on.
62790 */
62791 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
62792 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
62793 (kgdb_info[cpu].task &&
62794 kgdb_info[cpu].task->pid != kgdb_sstep_pid) && --sstep_tries) {
62795 atomic_set(&kgdb_active, -1);
62796 @@ -636,8 +636,8 @@ cpu_master_loop:
62797 }
62798
62799 kgdb_restore:
62800 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
62801 - int sstep_cpu = atomic_read(&kgdb_cpu_doing_single_step);
62802 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
62803 + int sstep_cpu = atomic_read_unchecked(&kgdb_cpu_doing_single_step);
62804 if (kgdb_info[sstep_cpu].task)
62805 kgdb_sstep_pid = kgdb_info[sstep_cpu].task->pid;
62806 else
62807 @@ -834,18 +834,18 @@ static void kgdb_unregister_callbacks(vo
62808 static void kgdb_tasklet_bpt(unsigned long ing)
62809 {
62810 kgdb_breakpoint();
62811 - atomic_set(&kgdb_break_tasklet_var, 0);
62812 + atomic_set_unchecked(&kgdb_break_tasklet_var, 0);
62813 }
62814
62815 static DECLARE_TASKLET(kgdb_tasklet_breakpoint, kgdb_tasklet_bpt, 0);
62816
62817 void kgdb_schedule_breakpoint(void)
62818 {
62819 - if (atomic_read(&kgdb_break_tasklet_var) ||
62820 + if (atomic_read_unchecked(&kgdb_break_tasklet_var) ||
62821 atomic_read(&kgdb_active) != -1 ||
62822 atomic_read(&kgdb_setting_breakpoint))
62823 return;
62824 - atomic_inc(&kgdb_break_tasklet_var);
62825 + atomic_inc_unchecked(&kgdb_break_tasklet_var);
62826 tasklet_schedule(&kgdb_tasklet_breakpoint);
62827 }
62828 EXPORT_SYMBOL_GPL(kgdb_schedule_breakpoint);
62829 diff -urNp linux-3.0.8/kernel/debug/kdb/kdb_main.c linux-3.0.8/kernel/debug/kdb/kdb_main.c
62830 --- linux-3.0.8/kernel/debug/kdb/kdb_main.c 2011-07-21 22:17:23.000000000 -0400
62831 +++ linux-3.0.8/kernel/debug/kdb/kdb_main.c 2011-08-23 21:47:56.000000000 -0400
62832 @@ -1980,7 +1980,7 @@ static int kdb_lsmod(int argc, const cha
62833 list_for_each_entry(mod, kdb_modules, list) {
62834
62835 kdb_printf("%-20s%8u 0x%p ", mod->name,
62836 - mod->core_size, (void *)mod);
62837 + mod->core_size_rx + mod->core_size_rw, (void *)mod);
62838 #ifdef CONFIG_MODULE_UNLOAD
62839 kdb_printf("%4d ", module_refcount(mod));
62840 #endif
62841 @@ -1990,7 +1990,7 @@ static int kdb_lsmod(int argc, const cha
62842 kdb_printf(" (Loading)");
62843 else
62844 kdb_printf(" (Live)");
62845 - kdb_printf(" 0x%p", mod->module_core);
62846 + kdb_printf(" 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
62847
62848 #ifdef CONFIG_MODULE_UNLOAD
62849 {
62850 diff -urNp linux-3.0.8/kernel/events/core.c linux-3.0.8/kernel/events/core.c
62851 --- linux-3.0.8/kernel/events/core.c 2011-10-24 08:05:21.000000000 -0400
62852 +++ linux-3.0.8/kernel/events/core.c 2011-09-14 09:08:05.000000000 -0400
62853 @@ -170,7 +170,7 @@ int perf_proc_update_handler(struct ctl_
62854 return 0;
62855 }
62856
62857 -static atomic64_t perf_event_id;
62858 +static atomic64_unchecked_t perf_event_id;
62859
62860 static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
62861 enum event_type_t event_type);
62862 @@ -2488,7 +2488,7 @@ static void __perf_event_read(void *info
62863
62864 static inline u64 perf_event_count(struct perf_event *event)
62865 {
62866 - return local64_read(&event->count) + atomic64_read(&event->child_count);
62867 + return local64_read(&event->count) + atomic64_read_unchecked(&event->child_count);
62868 }
62869
62870 static u64 perf_event_read(struct perf_event *event)
62871 @@ -3023,9 +3023,9 @@ u64 perf_event_read_value(struct perf_ev
62872 mutex_lock(&event->child_mutex);
62873 total += perf_event_read(event);
62874 *enabled += event->total_time_enabled +
62875 - atomic64_read(&event->child_total_time_enabled);
62876 + atomic64_read_unchecked(&event->child_total_time_enabled);
62877 *running += event->total_time_running +
62878 - atomic64_read(&event->child_total_time_running);
62879 + atomic64_read_unchecked(&event->child_total_time_running);
62880
62881 list_for_each_entry(child, &event->child_list, child_list) {
62882 total += perf_event_read(child);
62883 @@ -3388,10 +3388,10 @@ void perf_event_update_userpage(struct p
62884 userpg->offset -= local64_read(&event->hw.prev_count);
62885
62886 userpg->time_enabled = event->total_time_enabled +
62887 - atomic64_read(&event->child_total_time_enabled);
62888 + atomic64_read_unchecked(&event->child_total_time_enabled);
62889
62890 userpg->time_running = event->total_time_running +
62891 - atomic64_read(&event->child_total_time_running);
62892 + atomic64_read_unchecked(&event->child_total_time_running);
62893
62894 barrier();
62895 ++userpg->lock;
62896 @@ -4188,11 +4188,11 @@ static void perf_output_read_one(struct
62897 values[n++] = perf_event_count(event);
62898 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
62899 values[n++] = enabled +
62900 - atomic64_read(&event->child_total_time_enabled);
62901 + atomic64_read_unchecked(&event->child_total_time_enabled);
62902 }
62903 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
62904 values[n++] = running +
62905 - atomic64_read(&event->child_total_time_running);
62906 + atomic64_read_unchecked(&event->child_total_time_running);
62907 }
62908 if (read_format & PERF_FORMAT_ID)
62909 values[n++] = primary_event_id(event);
62910 @@ -4833,12 +4833,12 @@ static void perf_event_mmap_event(struct
62911 * need to add enough zero bytes after the string to handle
62912 * the 64bit alignment we do later.
62913 */
62914 - buf = kzalloc(PATH_MAX + sizeof(u64), GFP_KERNEL);
62915 + buf = kzalloc(PATH_MAX, GFP_KERNEL);
62916 if (!buf) {
62917 name = strncpy(tmp, "//enomem", sizeof(tmp));
62918 goto got_name;
62919 }
62920 - name = d_path(&file->f_path, buf, PATH_MAX);
62921 + name = d_path(&file->f_path, buf, PATH_MAX - sizeof(u64));
62922 if (IS_ERR(name)) {
62923 name = strncpy(tmp, "//toolong", sizeof(tmp));
62924 goto got_name;
62925 @@ -6190,7 +6190,7 @@ perf_event_alloc(struct perf_event_attr
62926 event->parent = parent_event;
62927
62928 event->ns = get_pid_ns(current->nsproxy->pid_ns);
62929 - event->id = atomic64_inc_return(&perf_event_id);
62930 + event->id = atomic64_inc_return_unchecked(&perf_event_id);
62931
62932 event->state = PERF_EVENT_STATE_INACTIVE;
62933
62934 @@ -6713,10 +6713,10 @@ static void sync_child_event(struct perf
62935 /*
62936 * Add back the child's count to the parent's count:
62937 */
62938 - atomic64_add(child_val, &parent_event->child_count);
62939 - atomic64_add(child_event->total_time_enabled,
62940 + atomic64_add_unchecked(child_val, &parent_event->child_count);
62941 + atomic64_add_unchecked(child_event->total_time_enabled,
62942 &parent_event->child_total_time_enabled);
62943 - atomic64_add(child_event->total_time_running,
62944 + atomic64_add_unchecked(child_event->total_time_running,
62945 &parent_event->child_total_time_running);
62946
62947 /*
62948 diff -urNp linux-3.0.8/kernel/exit.c linux-3.0.8/kernel/exit.c
62949 --- linux-3.0.8/kernel/exit.c 2011-07-21 22:17:23.000000000 -0400
62950 +++ linux-3.0.8/kernel/exit.c 2011-08-23 21:48:14.000000000 -0400
62951 @@ -57,6 +57,10 @@
62952 #include <asm/pgtable.h>
62953 #include <asm/mmu_context.h>
62954
62955 +#ifdef CONFIG_GRKERNSEC
62956 +extern rwlock_t grsec_exec_file_lock;
62957 +#endif
62958 +
62959 static void exit_mm(struct task_struct * tsk);
62960
62961 static void __unhash_process(struct task_struct *p, bool group_dead)
62962 @@ -169,6 +173,10 @@ void release_task(struct task_struct * p
62963 struct task_struct *leader;
62964 int zap_leader;
62965 repeat:
62966 +#ifdef CONFIG_NET
62967 + gr_del_task_from_ip_table(p);
62968 +#endif
62969 +
62970 tracehook_prepare_release_task(p);
62971 /* don't need to get the RCU readlock here - the process is dead and
62972 * can't be modifying its own credentials. But shut RCU-lockdep up */
62973 @@ -338,11 +346,22 @@ static void reparent_to_kthreadd(void)
62974 {
62975 write_lock_irq(&tasklist_lock);
62976
62977 +#ifdef CONFIG_GRKERNSEC
62978 + write_lock(&grsec_exec_file_lock);
62979 + if (current->exec_file) {
62980 + fput(current->exec_file);
62981 + current->exec_file = NULL;
62982 + }
62983 + write_unlock(&grsec_exec_file_lock);
62984 +#endif
62985 +
62986 ptrace_unlink(current);
62987 /* Reparent to init */
62988 current->real_parent = current->parent = kthreadd_task;
62989 list_move_tail(&current->sibling, &current->real_parent->children);
62990
62991 + gr_set_kernel_label(current);
62992 +
62993 /* Set the exit signal to SIGCHLD so we signal init on exit */
62994 current->exit_signal = SIGCHLD;
62995
62996 @@ -394,7 +413,7 @@ int allow_signal(int sig)
62997 * know it'll be handled, so that they don't get converted to
62998 * SIGKILL or just silently dropped.
62999 */
63000 - current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
63001 + current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
63002 recalc_sigpending();
63003 spin_unlock_irq(&current->sighand->siglock);
63004 return 0;
63005 @@ -430,6 +449,17 @@ void daemonize(const char *name, ...)
63006 vsnprintf(current->comm, sizeof(current->comm), name, args);
63007 va_end(args);
63008
63009 +#ifdef CONFIG_GRKERNSEC
63010 + write_lock(&grsec_exec_file_lock);
63011 + if (current->exec_file) {
63012 + fput(current->exec_file);
63013 + current->exec_file = NULL;
63014 + }
63015 + write_unlock(&grsec_exec_file_lock);
63016 +#endif
63017 +
63018 + gr_set_kernel_label(current);
63019 +
63020 /*
63021 * If we were started as result of loading a module, close all of the
63022 * user space pages. We don't need them, and if we didn't close them
63023 @@ -904,15 +934,8 @@ NORET_TYPE void do_exit(long code)
63024 struct task_struct *tsk = current;
63025 int group_dead;
63026
63027 - profile_task_exit(tsk);
63028 -
63029 - WARN_ON(atomic_read(&tsk->fs_excl));
63030 - WARN_ON(blk_needs_flush_plug(tsk));
63031 -
63032 if (unlikely(in_interrupt()))
63033 panic("Aiee, killing interrupt handler!");
63034 - if (unlikely(!tsk->pid))
63035 - panic("Attempted to kill the idle task!");
63036
63037 /*
63038 * If do_exit is called because this processes oopsed, it's possible
63039 @@ -923,6 +946,14 @@ NORET_TYPE void do_exit(long code)
63040 */
63041 set_fs(USER_DS);
63042
63043 + profile_task_exit(tsk);
63044 +
63045 + WARN_ON(atomic_read(&tsk->fs_excl));
63046 + WARN_ON(blk_needs_flush_plug(tsk));
63047 +
63048 + if (unlikely(!tsk->pid))
63049 + panic("Attempted to kill the idle task!");
63050 +
63051 tracehook_report_exit(&code);
63052
63053 validate_creds_for_do_exit(tsk);
63054 @@ -983,6 +1014,9 @@ NORET_TYPE void do_exit(long code)
63055 tsk->exit_code = code;
63056 taskstats_exit(tsk, group_dead);
63057
63058 + gr_acl_handle_psacct(tsk, code);
63059 + gr_acl_handle_exit();
63060 +
63061 exit_mm(tsk);
63062
63063 if (group_dead)
63064 diff -urNp linux-3.0.8/kernel/fork.c linux-3.0.8/kernel/fork.c
63065 --- linux-3.0.8/kernel/fork.c 2011-07-21 22:17:23.000000000 -0400
63066 +++ linux-3.0.8/kernel/fork.c 2011-08-25 17:23:36.000000000 -0400
63067 @@ -286,7 +286,7 @@ static struct task_struct *dup_task_stru
63068 *stackend = STACK_END_MAGIC; /* for overflow detection */
63069
63070 #ifdef CONFIG_CC_STACKPROTECTOR
63071 - tsk->stack_canary = get_random_int();
63072 + tsk->stack_canary = pax_get_random_long();
63073 #endif
63074
63075 /* One for us, one for whoever does the "release_task()" (usually parent) */
63076 @@ -308,13 +308,77 @@ out:
63077 }
63078
63079 #ifdef CONFIG_MMU
63080 +static struct vm_area_struct *dup_vma(struct mm_struct *mm, struct vm_area_struct *mpnt)
63081 +{
63082 + struct vm_area_struct *tmp;
63083 + unsigned long charge;
63084 + struct mempolicy *pol;
63085 + struct file *file;
63086 +
63087 + charge = 0;
63088 + if (mpnt->vm_flags & VM_ACCOUNT) {
63089 + unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
63090 + if (security_vm_enough_memory(len))
63091 + goto fail_nomem;
63092 + charge = len;
63093 + }
63094 + tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
63095 + if (!tmp)
63096 + goto fail_nomem;
63097 + *tmp = *mpnt;
63098 + tmp->vm_mm = mm;
63099 + INIT_LIST_HEAD(&tmp->anon_vma_chain);
63100 + pol = mpol_dup(vma_policy(mpnt));
63101 + if (IS_ERR(pol))
63102 + goto fail_nomem_policy;
63103 + vma_set_policy(tmp, pol);
63104 + if (anon_vma_fork(tmp, mpnt))
63105 + goto fail_nomem_anon_vma_fork;
63106 + tmp->vm_flags &= ~VM_LOCKED;
63107 + tmp->vm_next = tmp->vm_prev = NULL;
63108 + tmp->vm_mirror = NULL;
63109 + file = tmp->vm_file;
63110 + if (file) {
63111 + struct inode *inode = file->f_path.dentry->d_inode;
63112 + struct address_space *mapping = file->f_mapping;
63113 +
63114 + get_file(file);
63115 + if (tmp->vm_flags & VM_DENYWRITE)
63116 + atomic_dec(&inode->i_writecount);
63117 + mutex_lock(&mapping->i_mmap_mutex);
63118 + if (tmp->vm_flags & VM_SHARED)
63119 + mapping->i_mmap_writable++;
63120 + flush_dcache_mmap_lock(mapping);
63121 + /* insert tmp into the share list, just after mpnt */
63122 + vma_prio_tree_add(tmp, mpnt);
63123 + flush_dcache_mmap_unlock(mapping);
63124 + mutex_unlock(&mapping->i_mmap_mutex);
63125 + }
63126 +
63127 + /*
63128 + * Clear hugetlb-related page reserves for children. This only
63129 + * affects MAP_PRIVATE mappings. Faults generated by the child
63130 + * are not guaranteed to succeed, even if read-only
63131 + */
63132 + if (is_vm_hugetlb_page(tmp))
63133 + reset_vma_resv_huge_pages(tmp);
63134 +
63135 + return tmp;
63136 +
63137 +fail_nomem_anon_vma_fork:
63138 + mpol_put(pol);
63139 +fail_nomem_policy:
63140 + kmem_cache_free(vm_area_cachep, tmp);
63141 +fail_nomem:
63142 + vm_unacct_memory(charge);
63143 + return NULL;
63144 +}
63145 +
63146 static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
63147 {
63148 struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
63149 struct rb_node **rb_link, *rb_parent;
63150 int retval;
63151 - unsigned long charge;
63152 - struct mempolicy *pol;
63153
63154 down_write(&oldmm->mmap_sem);
63155 flush_cache_dup_mm(oldmm);
63156 @@ -326,8 +390,8 @@ static int dup_mmap(struct mm_struct *mm
63157 mm->locked_vm = 0;
63158 mm->mmap = NULL;
63159 mm->mmap_cache = NULL;
63160 - mm->free_area_cache = oldmm->mmap_base;
63161 - mm->cached_hole_size = ~0UL;
63162 + mm->free_area_cache = oldmm->free_area_cache;
63163 + mm->cached_hole_size = oldmm->cached_hole_size;
63164 mm->map_count = 0;
63165 cpumask_clear(mm_cpumask(mm));
63166 mm->mm_rb = RB_ROOT;
63167 @@ -343,8 +407,6 @@ static int dup_mmap(struct mm_struct *mm
63168
63169 prev = NULL;
63170 for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
63171 - struct file *file;
63172 -
63173 if (mpnt->vm_flags & VM_DONTCOPY) {
63174 long pages = vma_pages(mpnt);
63175 mm->total_vm -= pages;
63176 @@ -352,55 +414,13 @@ static int dup_mmap(struct mm_struct *mm
63177 -pages);
63178 continue;
63179 }
63180 - charge = 0;
63181 - if (mpnt->vm_flags & VM_ACCOUNT) {
63182 - unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
63183 - if (security_vm_enough_memory(len))
63184 - goto fail_nomem;
63185 - charge = len;
63186 - }
63187 - tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
63188 - if (!tmp)
63189 - goto fail_nomem;
63190 - *tmp = *mpnt;
63191 - INIT_LIST_HEAD(&tmp->anon_vma_chain);
63192 - pol = mpol_dup(vma_policy(mpnt));
63193 - retval = PTR_ERR(pol);
63194 - if (IS_ERR(pol))
63195 - goto fail_nomem_policy;
63196 - vma_set_policy(tmp, pol);
63197 - tmp->vm_mm = mm;
63198 - if (anon_vma_fork(tmp, mpnt))
63199 - goto fail_nomem_anon_vma_fork;
63200 - tmp->vm_flags &= ~VM_LOCKED;
63201 - tmp->vm_next = tmp->vm_prev = NULL;
63202 - file = tmp->vm_file;
63203 - if (file) {
63204 - struct inode *inode = file->f_path.dentry->d_inode;
63205 - struct address_space *mapping = file->f_mapping;
63206 -
63207 - get_file(file);
63208 - if (tmp->vm_flags & VM_DENYWRITE)
63209 - atomic_dec(&inode->i_writecount);
63210 - mutex_lock(&mapping->i_mmap_mutex);
63211 - if (tmp->vm_flags & VM_SHARED)
63212 - mapping->i_mmap_writable++;
63213 - flush_dcache_mmap_lock(mapping);
63214 - /* insert tmp into the share list, just after mpnt */
63215 - vma_prio_tree_add(tmp, mpnt);
63216 - flush_dcache_mmap_unlock(mapping);
63217 - mutex_unlock(&mapping->i_mmap_mutex);
63218 + tmp = dup_vma(mm, mpnt);
63219 + if (!tmp) {
63220 + retval = -ENOMEM;
63221 + goto out;
63222 }
63223
63224 /*
63225 - * Clear hugetlb-related page reserves for children. This only
63226 - * affects MAP_PRIVATE mappings. Faults generated by the child
63227 - * are not guaranteed to succeed, even if read-only
63228 - */
63229 - if (is_vm_hugetlb_page(tmp))
63230 - reset_vma_resv_huge_pages(tmp);
63231 -
63232 - /*
63233 * Link in the new vma and copy the page table entries.
63234 */
63235 *pprev = tmp;
63236 @@ -421,6 +441,31 @@ static int dup_mmap(struct mm_struct *mm
63237 if (retval)
63238 goto out;
63239 }
63240 +
63241 +#ifdef CONFIG_PAX_SEGMEXEC
63242 + if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
63243 + struct vm_area_struct *mpnt_m;
63244 +
63245 + for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
63246 + BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
63247 +
63248 + if (!mpnt->vm_mirror)
63249 + continue;
63250 +
63251 + if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
63252 + BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
63253 + mpnt->vm_mirror = mpnt_m;
63254 + } else {
63255 + BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
63256 + mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
63257 + mpnt_m->vm_mirror->vm_mirror = mpnt_m;
63258 + mpnt->vm_mirror->vm_mirror = mpnt;
63259 + }
63260 + }
63261 + BUG_ON(mpnt_m);
63262 + }
63263 +#endif
63264 +
63265 /* a new mm has just been created */
63266 arch_dup_mmap(oldmm, mm);
63267 retval = 0;
63268 @@ -429,14 +474,6 @@ out:
63269 flush_tlb_mm(oldmm);
63270 up_write(&oldmm->mmap_sem);
63271 return retval;
63272 -fail_nomem_anon_vma_fork:
63273 - mpol_put(pol);
63274 -fail_nomem_policy:
63275 - kmem_cache_free(vm_area_cachep, tmp);
63276 -fail_nomem:
63277 - retval = -ENOMEM;
63278 - vm_unacct_memory(charge);
63279 - goto out;
63280 }
63281
63282 static inline int mm_alloc_pgd(struct mm_struct * mm)
63283 @@ -836,13 +873,14 @@ static int copy_fs(unsigned long clone_f
63284 spin_unlock(&fs->lock);
63285 return -EAGAIN;
63286 }
63287 - fs->users++;
63288 + atomic_inc(&fs->users);
63289 spin_unlock(&fs->lock);
63290 return 0;
63291 }
63292 tsk->fs = copy_fs_struct(fs);
63293 if (!tsk->fs)
63294 return -ENOMEM;
63295 + gr_set_chroot_entries(tsk, &tsk->fs->root);
63296 return 0;
63297 }
63298
63299 @@ -1104,12 +1142,16 @@ static struct task_struct *copy_process(
63300 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
63301 #endif
63302 retval = -EAGAIN;
63303 +
63304 + gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
63305 +
63306 if (atomic_read(&p->real_cred->user->processes) >=
63307 task_rlimit(p, RLIMIT_NPROC)) {
63308 - if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
63309 - p->real_cred->user != INIT_USER)
63310 + if (p->real_cred->user != INIT_USER &&
63311 + !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE))
63312 goto bad_fork_free;
63313 }
63314 + current->flags &= ~PF_NPROC_EXCEEDED;
63315
63316 retval = copy_creds(p, clone_flags);
63317 if (retval < 0)
63318 @@ -1250,6 +1292,8 @@ static struct task_struct *copy_process(
63319 if (clone_flags & CLONE_THREAD)
63320 p->tgid = current->tgid;
63321
63322 + gr_copy_label(p);
63323 +
63324 p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
63325 /*
63326 * Clear TID on mm_release()?
63327 @@ -1414,6 +1458,8 @@ bad_fork_cleanup_count:
63328 bad_fork_free:
63329 free_task(p);
63330 fork_out:
63331 + gr_log_forkfail(retval);
63332 +
63333 return ERR_PTR(retval);
63334 }
63335
63336 @@ -1502,6 +1548,8 @@ long do_fork(unsigned long clone_flags,
63337 if (clone_flags & CLONE_PARENT_SETTID)
63338 put_user(nr, parent_tidptr);
63339
63340 + gr_handle_brute_check();
63341 +
63342 if (clone_flags & CLONE_VFORK) {
63343 p->vfork_done = &vfork;
63344 init_completion(&vfork);
63345 @@ -1610,7 +1658,7 @@ static int unshare_fs(unsigned long unsh
63346 return 0;
63347
63348 /* don't need lock here; in the worst case we'll do useless copy */
63349 - if (fs->users == 1)
63350 + if (atomic_read(&fs->users) == 1)
63351 return 0;
63352
63353 *new_fsp = copy_fs_struct(fs);
63354 @@ -1697,7 +1745,8 @@ SYSCALL_DEFINE1(unshare, unsigned long,
63355 fs = current->fs;
63356 spin_lock(&fs->lock);
63357 current->fs = new_fs;
63358 - if (--fs->users)
63359 + gr_set_chroot_entries(current, &current->fs->root);
63360 + if (atomic_dec_return(&fs->users))
63361 new_fs = NULL;
63362 else
63363 new_fs = fs;
63364 diff -urNp linux-3.0.8/kernel/futex.c linux-3.0.8/kernel/futex.c
63365 --- linux-3.0.8/kernel/futex.c 2011-10-24 08:05:21.000000000 -0400
63366 +++ linux-3.0.8/kernel/futex.c 2011-08-23 21:48:14.000000000 -0400
63367 @@ -54,6 +54,7 @@
63368 #include <linux/mount.h>
63369 #include <linux/pagemap.h>
63370 #include <linux/syscalls.h>
63371 +#include <linux/ptrace.h>
63372 #include <linux/signal.h>
63373 #include <linux/module.h>
63374 #include <linux/magic.h>
63375 @@ -238,6 +239,11 @@ get_futex_key(u32 __user *uaddr, int fsh
63376 struct page *page, *page_head;
63377 int err, ro = 0;
63378
63379 +#ifdef CONFIG_PAX_SEGMEXEC
63380 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
63381 + return -EFAULT;
63382 +#endif
63383 +
63384 /*
63385 * The futex address must be "naturally" aligned.
63386 */
63387 @@ -1863,6 +1869,8 @@ static int futex_wait(u32 __user *uaddr,
63388 struct futex_q q = futex_q_init;
63389 int ret;
63390
63391 + pax_track_stack();
63392 +
63393 if (!bitset)
63394 return -EINVAL;
63395 q.bitset = bitset;
63396 @@ -2259,6 +2267,8 @@ static int futex_wait_requeue_pi(u32 __u
63397 struct futex_q q = futex_q_init;
63398 int res, ret;
63399
63400 + pax_track_stack();
63401 +
63402 if (!bitset)
63403 return -EINVAL;
63404
63405 @@ -2431,7 +2441,9 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
63406 {
63407 struct robust_list_head __user *head;
63408 unsigned long ret;
63409 +#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
63410 const struct cred *cred = current_cred(), *pcred;
63411 +#endif
63412
63413 if (!futex_cmpxchg_enabled)
63414 return -ENOSYS;
63415 @@ -2447,6 +2459,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
63416 if (!p)
63417 goto err_unlock;
63418 ret = -EPERM;
63419 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
63420 + if (!ptrace_may_access(p, PTRACE_MODE_READ))
63421 + goto err_unlock;
63422 +#else
63423 pcred = __task_cred(p);
63424 /* If victim is in different user_ns, then uids are not
63425 comparable, so we must have CAP_SYS_PTRACE */
63426 @@ -2461,6 +2477,7 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
63427 !ns_capable(pcred->user->user_ns, CAP_SYS_PTRACE))
63428 goto err_unlock;
63429 ok:
63430 +#endif
63431 head = p->robust_list;
63432 rcu_read_unlock();
63433 }
63434 @@ -2712,6 +2729,7 @@ static int __init futex_init(void)
63435 {
63436 u32 curval;
63437 int i;
63438 + mm_segment_t oldfs;
63439
63440 /*
63441 * This will fail and we want it. Some arch implementations do
63442 @@ -2723,8 +2741,11 @@ static int __init futex_init(void)
63443 * implementation, the non-functional ones will return
63444 * -ENOSYS.
63445 */
63446 + oldfs = get_fs();
63447 + set_fs(USER_DS);
63448 if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT)
63449 futex_cmpxchg_enabled = 1;
63450 + set_fs(oldfs);
63451
63452 for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
63453 plist_head_init(&futex_queues[i].chain, &futex_queues[i].lock);
63454 diff -urNp linux-3.0.8/kernel/futex_compat.c linux-3.0.8/kernel/futex_compat.c
63455 --- linux-3.0.8/kernel/futex_compat.c 2011-07-21 22:17:23.000000000 -0400
63456 +++ linux-3.0.8/kernel/futex_compat.c 2011-08-23 21:48:14.000000000 -0400
63457 @@ -10,6 +10,7 @@
63458 #include <linux/compat.h>
63459 #include <linux/nsproxy.h>
63460 #include <linux/futex.h>
63461 +#include <linux/ptrace.h>
63462
63463 #include <asm/uaccess.h>
63464
63465 @@ -136,7 +137,10 @@ compat_sys_get_robust_list(int pid, comp
63466 {
63467 struct compat_robust_list_head __user *head;
63468 unsigned long ret;
63469 - const struct cred *cred = current_cred(), *pcred;
63470 +#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
63471 + const struct cred *cred = current_cred();
63472 + const struct cred *pcred;
63473 +#endif
63474
63475 if (!futex_cmpxchg_enabled)
63476 return -ENOSYS;
63477 @@ -152,6 +156,10 @@ compat_sys_get_robust_list(int pid, comp
63478 if (!p)
63479 goto err_unlock;
63480 ret = -EPERM;
63481 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
63482 + if (!ptrace_may_access(p, PTRACE_MODE_READ))
63483 + goto err_unlock;
63484 +#else
63485 pcred = __task_cred(p);
63486 /* If victim is in different user_ns, then uids are not
63487 comparable, so we must have CAP_SYS_PTRACE */
63488 @@ -166,6 +174,7 @@ compat_sys_get_robust_list(int pid, comp
63489 !ns_capable(pcred->user->user_ns, CAP_SYS_PTRACE))
63490 goto err_unlock;
63491 ok:
63492 +#endif
63493 head = p->compat_robust_list;
63494 rcu_read_unlock();
63495 }
63496 diff -urNp linux-3.0.8/kernel/gcov/base.c linux-3.0.8/kernel/gcov/base.c
63497 --- linux-3.0.8/kernel/gcov/base.c 2011-07-21 22:17:23.000000000 -0400
63498 +++ linux-3.0.8/kernel/gcov/base.c 2011-08-23 21:47:56.000000000 -0400
63499 @@ -102,11 +102,6 @@ void gcov_enable_events(void)
63500 }
63501
63502 #ifdef CONFIG_MODULES
63503 -static inline int within(void *addr, void *start, unsigned long size)
63504 -{
63505 - return ((addr >= start) && (addr < start + size));
63506 -}
63507 -
63508 /* Update list and generate events when modules are unloaded. */
63509 static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
63510 void *data)
63511 @@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n
63512 prev = NULL;
63513 /* Remove entries located in module from linked list. */
63514 for (info = gcov_info_head; info; info = info->next) {
63515 - if (within(info, mod->module_core, mod->core_size)) {
63516 + if (within_module_core_rw((unsigned long)info, mod)) {
63517 if (prev)
63518 prev->next = info->next;
63519 else
63520 diff -urNp linux-3.0.8/kernel/hrtimer.c linux-3.0.8/kernel/hrtimer.c
63521 --- linux-3.0.8/kernel/hrtimer.c 2011-07-21 22:17:23.000000000 -0400
63522 +++ linux-3.0.8/kernel/hrtimer.c 2011-08-23 21:47:56.000000000 -0400
63523 @@ -1391,7 +1391,7 @@ void hrtimer_peek_ahead_timers(void)
63524 local_irq_restore(flags);
63525 }
63526
63527 -static void run_hrtimer_softirq(struct softirq_action *h)
63528 +static void run_hrtimer_softirq(void)
63529 {
63530 hrtimer_peek_ahead_timers();
63531 }
63532 diff -urNp linux-3.0.8/kernel/jump_label.c linux-3.0.8/kernel/jump_label.c
63533 --- linux-3.0.8/kernel/jump_label.c 2011-07-21 22:17:23.000000000 -0400
63534 +++ linux-3.0.8/kernel/jump_label.c 2011-08-23 21:47:56.000000000 -0400
63535 @@ -55,7 +55,9 @@ jump_label_sort_entries(struct jump_entr
63536
63537 size = (((unsigned long)stop - (unsigned long)start)
63538 / sizeof(struct jump_entry));
63539 + pax_open_kernel();
63540 sort(start, size, sizeof(struct jump_entry), jump_label_cmp, NULL);
63541 + pax_close_kernel();
63542 }
63543
63544 static void jump_label_update(struct jump_label_key *key, int enable);
63545 @@ -297,10 +299,12 @@ static void jump_label_invalidate_module
63546 struct jump_entry *iter_stop = iter_start + mod->num_jump_entries;
63547 struct jump_entry *iter;
63548
63549 + pax_open_kernel();
63550 for (iter = iter_start; iter < iter_stop; iter++) {
63551 if (within_module_init(iter->code, mod))
63552 iter->code = 0;
63553 }
63554 + pax_close_kernel();
63555 }
63556
63557 static int
63558 diff -urNp linux-3.0.8/kernel/kallsyms.c linux-3.0.8/kernel/kallsyms.c
63559 --- linux-3.0.8/kernel/kallsyms.c 2011-07-21 22:17:23.000000000 -0400
63560 +++ linux-3.0.8/kernel/kallsyms.c 2011-08-23 21:48:14.000000000 -0400
63561 @@ -11,6 +11,9 @@
63562 * Changed the compression method from stem compression to "table lookup"
63563 * compression (see scripts/kallsyms.c for a more complete description)
63564 */
63565 +#ifdef CONFIG_GRKERNSEC_HIDESYM
63566 +#define __INCLUDED_BY_HIDESYM 1
63567 +#endif
63568 #include <linux/kallsyms.h>
63569 #include <linux/module.h>
63570 #include <linux/init.h>
63571 @@ -53,12 +56,33 @@ extern const unsigned long kallsyms_mark
63572
63573 static inline int is_kernel_inittext(unsigned long addr)
63574 {
63575 + if (system_state != SYSTEM_BOOTING)
63576 + return 0;
63577 +
63578 if (addr >= (unsigned long)_sinittext
63579 && addr <= (unsigned long)_einittext)
63580 return 1;
63581 return 0;
63582 }
63583
63584 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
63585 +#ifdef CONFIG_MODULES
63586 +static inline int is_module_text(unsigned long addr)
63587 +{
63588 + if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
63589 + return 1;
63590 +
63591 + addr = ktla_ktva(addr);
63592 + return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
63593 +}
63594 +#else
63595 +static inline int is_module_text(unsigned long addr)
63596 +{
63597 + return 0;
63598 +}
63599 +#endif
63600 +#endif
63601 +
63602 static inline int is_kernel_text(unsigned long addr)
63603 {
63604 if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
63605 @@ -69,13 +93,28 @@ static inline int is_kernel_text(unsigne
63606
63607 static inline int is_kernel(unsigned long addr)
63608 {
63609 +
63610 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
63611 + if (is_kernel_text(addr) || is_kernel_inittext(addr))
63612 + return 1;
63613 +
63614 + if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
63615 +#else
63616 if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
63617 +#endif
63618 +
63619 return 1;
63620 return in_gate_area_no_mm(addr);
63621 }
63622
63623 static int is_ksym_addr(unsigned long addr)
63624 {
63625 +
63626 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
63627 + if (is_module_text(addr))
63628 + return 0;
63629 +#endif
63630 +
63631 if (all_var)
63632 return is_kernel(addr);
63633
63634 @@ -454,7 +493,6 @@ static unsigned long get_ksymbol_core(st
63635
63636 static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
63637 {
63638 - iter->name[0] = '\0';
63639 iter->nameoff = get_symbol_offset(new_pos);
63640 iter->pos = new_pos;
63641 }
63642 @@ -502,6 +540,11 @@ static int s_show(struct seq_file *m, vo
63643 {
63644 struct kallsym_iter *iter = m->private;
63645
63646 +#ifdef CONFIG_GRKERNSEC_HIDESYM
63647 + if (current_uid())
63648 + return 0;
63649 +#endif
63650 +
63651 /* Some debugging symbols have no name. Ignore them. */
63652 if (!iter->name[0])
63653 return 0;
63654 @@ -540,7 +583,7 @@ static int kallsyms_open(struct inode *i
63655 struct kallsym_iter *iter;
63656 int ret;
63657
63658 - iter = kmalloc(sizeof(*iter), GFP_KERNEL);
63659 + iter = kzalloc(sizeof(*iter), GFP_KERNEL);
63660 if (!iter)
63661 return -ENOMEM;
63662 reset_iter(iter, 0);
63663 diff -urNp linux-3.0.8/kernel/kexec.c linux-3.0.8/kernel/kexec.c
63664 --- linux-3.0.8/kernel/kexec.c 2011-07-21 22:17:23.000000000 -0400
63665 +++ linux-3.0.8/kernel/kexec.c 2011-10-06 04:17:55.000000000 -0400
63666 @@ -1033,7 +1033,8 @@ asmlinkage long compat_sys_kexec_load(un
63667 unsigned long flags)
63668 {
63669 struct compat_kexec_segment in;
63670 - struct kexec_segment out, __user *ksegments;
63671 + struct kexec_segment out;
63672 + struct kexec_segment __user *ksegments;
63673 unsigned long i, result;
63674
63675 /* Don't allow clients that don't understand the native
63676 diff -urNp linux-3.0.8/kernel/kmod.c linux-3.0.8/kernel/kmod.c
63677 --- linux-3.0.8/kernel/kmod.c 2011-07-21 22:17:23.000000000 -0400
63678 +++ linux-3.0.8/kernel/kmod.c 2011-10-06 04:17:55.000000000 -0400
63679 @@ -73,13 +73,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sb
63680 * If module auto-loading support is disabled then this function
63681 * becomes a no-operation.
63682 */
63683 -int __request_module(bool wait, const char *fmt, ...)
63684 +static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
63685 {
63686 - va_list args;
63687 char module_name[MODULE_NAME_LEN];
63688 unsigned int max_modprobes;
63689 int ret;
63690 - char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
63691 + char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
63692 static char *envp[] = { "HOME=/",
63693 "TERM=linux",
63694 "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
63695 @@ -88,9 +87,7 @@ int __request_module(bool wait, const ch
63696 #define MAX_KMOD_CONCURRENT 50 /* Completely arbitrary value - KAO */
63697 static int kmod_loop_msg;
63698
63699 - va_start(args, fmt);
63700 - ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
63701 - va_end(args);
63702 + ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
63703 if (ret >= MODULE_NAME_LEN)
63704 return -ENAMETOOLONG;
63705
63706 @@ -98,6 +95,20 @@ int __request_module(bool wait, const ch
63707 if (ret)
63708 return ret;
63709
63710 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
63711 + if (!current_uid()) {
63712 + /* hack to workaround consolekit/udisks stupidity */
63713 + read_lock(&tasklist_lock);
63714 + if (!strcmp(current->comm, "mount") &&
63715 + current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
63716 + read_unlock(&tasklist_lock);
63717 + printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
63718 + return -EPERM;
63719 + }
63720 + read_unlock(&tasklist_lock);
63721 + }
63722 +#endif
63723 +
63724 /* If modprobe needs a service that is in a module, we get a recursive
63725 * loop. Limit the number of running kmod threads to max_threads/2 or
63726 * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
63727 @@ -131,6 +142,47 @@ int __request_module(bool wait, const ch
63728 atomic_dec(&kmod_concurrent);
63729 return ret;
63730 }
63731 +
63732 +int ___request_module(bool wait, char *module_param, const char *fmt, ...)
63733 +{
63734 + va_list args;
63735 + int ret;
63736 +
63737 + va_start(args, fmt);
63738 + ret = ____request_module(wait, module_param, fmt, args);
63739 + va_end(args);
63740 +
63741 + return ret;
63742 +}
63743 +
63744 +int __request_module(bool wait, const char *fmt, ...)
63745 +{
63746 + va_list args;
63747 + int ret;
63748 +
63749 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
63750 + if (current_uid()) {
63751 + char module_param[MODULE_NAME_LEN];
63752 +
63753 + memset(module_param, 0, sizeof(module_param));
63754 +
63755 + snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
63756 +
63757 + va_start(args, fmt);
63758 + ret = ____request_module(wait, module_param, fmt, args);
63759 + va_end(args);
63760 +
63761 + return ret;
63762 + }
63763 +#endif
63764 +
63765 + va_start(args, fmt);
63766 + ret = ____request_module(wait, NULL, fmt, args);
63767 + va_end(args);
63768 +
63769 + return ret;
63770 +}
63771 +
63772 EXPORT_SYMBOL(__request_module);
63773 #endif /* CONFIG_MODULES */
63774
63775 @@ -220,7 +272,7 @@ static int wait_for_helper(void *data)
63776 *
63777 * Thus the __user pointer cast is valid here.
63778 */
63779 - sys_wait4(pid, (int __user *)&ret, 0, NULL);
63780 + sys_wait4(pid, (int __force_user *)&ret, 0, NULL);
63781
63782 /*
63783 * If ret is 0, either ____call_usermodehelper failed and the
63784 diff -urNp linux-3.0.8/kernel/kprobes.c linux-3.0.8/kernel/kprobes.c
63785 --- linux-3.0.8/kernel/kprobes.c 2011-07-21 22:17:23.000000000 -0400
63786 +++ linux-3.0.8/kernel/kprobes.c 2011-08-23 21:47:56.000000000 -0400
63787 @@ -185,7 +185,7 @@ static kprobe_opcode_t __kprobes *__get_
63788 * kernel image and loaded module images reside. This is required
63789 * so x86_64 can correctly handle the %rip-relative fixups.
63790 */
63791 - kip->insns = module_alloc(PAGE_SIZE);
63792 + kip->insns = module_alloc_exec(PAGE_SIZE);
63793 if (!kip->insns) {
63794 kfree(kip);
63795 return NULL;
63796 @@ -225,7 +225,7 @@ static int __kprobes collect_one_slot(st
63797 */
63798 if (!list_is_singular(&kip->list)) {
63799 list_del(&kip->list);
63800 - module_free(NULL, kip->insns);
63801 + module_free_exec(NULL, kip->insns);
63802 kfree(kip);
63803 }
63804 return 1;
63805 @@ -1936,7 +1936,7 @@ static int __init init_kprobes(void)
63806 {
63807 int i, err = 0;
63808 unsigned long offset = 0, size = 0;
63809 - char *modname, namebuf[128];
63810 + char *modname, namebuf[KSYM_NAME_LEN];
63811 const char *symbol_name;
63812 void *addr;
63813 struct kprobe_blackpoint *kb;
63814 @@ -2062,7 +2062,7 @@ static int __kprobes show_kprobe_addr(st
63815 const char *sym = NULL;
63816 unsigned int i = *(loff_t *) v;
63817 unsigned long offset = 0;
63818 - char *modname, namebuf[128];
63819 + char *modname, namebuf[KSYM_NAME_LEN];
63820
63821 head = &kprobe_table[i];
63822 preempt_disable();
63823 diff -urNp linux-3.0.8/kernel/lockdep.c linux-3.0.8/kernel/lockdep.c
63824 --- linux-3.0.8/kernel/lockdep.c 2011-07-21 22:17:23.000000000 -0400
63825 +++ linux-3.0.8/kernel/lockdep.c 2011-08-23 21:47:56.000000000 -0400
63826 @@ -583,6 +583,10 @@ static int static_obj(void *obj)
63827 end = (unsigned long) &_end,
63828 addr = (unsigned long) obj;
63829
63830 +#ifdef CONFIG_PAX_KERNEXEC
63831 + start = ktla_ktva(start);
63832 +#endif
63833 +
63834 /*
63835 * static variable?
63836 */
63837 @@ -718,6 +722,7 @@ register_lock_class(struct lockdep_map *
63838 if (!static_obj(lock->key)) {
63839 debug_locks_off();
63840 printk("INFO: trying to register non-static key.\n");
63841 + printk("lock:%pS key:%pS.\n", lock, lock->key);
63842 printk("the code is fine but needs lockdep annotation.\n");
63843 printk("turning off the locking correctness validator.\n");
63844 dump_stack();
63845 @@ -2936,7 +2941,7 @@ static int __lock_acquire(struct lockdep
63846 if (!class)
63847 return 0;
63848 }
63849 - atomic_inc((atomic_t *)&class->ops);
63850 + atomic_inc_unchecked((atomic_unchecked_t *)&class->ops);
63851 if (very_verbose(class)) {
63852 printk("\nacquire class [%p] %s", class->key, class->name);
63853 if (class->name_version > 1)
63854 diff -urNp linux-3.0.8/kernel/lockdep_proc.c linux-3.0.8/kernel/lockdep_proc.c
63855 --- linux-3.0.8/kernel/lockdep_proc.c 2011-07-21 22:17:23.000000000 -0400
63856 +++ linux-3.0.8/kernel/lockdep_proc.c 2011-08-23 21:47:56.000000000 -0400
63857 @@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v
63858
63859 static void print_name(struct seq_file *m, struct lock_class *class)
63860 {
63861 - char str[128];
63862 + char str[KSYM_NAME_LEN];
63863 const char *name = class->name;
63864
63865 if (!name) {
63866 diff -urNp linux-3.0.8/kernel/module.c linux-3.0.8/kernel/module.c
63867 --- linux-3.0.8/kernel/module.c 2011-07-21 22:17:23.000000000 -0400
63868 +++ linux-3.0.8/kernel/module.c 2011-08-23 21:48:14.000000000 -0400
63869 @@ -58,6 +58,7 @@
63870 #include <linux/jump_label.h>
63871 #include <linux/pfn.h>
63872 #include <linux/bsearch.h>
63873 +#include <linux/grsecurity.h>
63874
63875 #define CREATE_TRACE_POINTS
63876 #include <trace/events/module.h>
63877 @@ -119,7 +120,8 @@ static BLOCKING_NOTIFIER_HEAD(module_not
63878
63879 /* Bounds of module allocation, for speeding __module_address.
63880 * Protected by module_mutex. */
63881 -static unsigned long module_addr_min = -1UL, module_addr_max = 0;
63882 +static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
63883 +static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
63884
63885 int register_module_notifier(struct notifier_block * nb)
63886 {
63887 @@ -284,7 +286,7 @@ bool each_symbol_section(bool (*fn)(cons
63888 return true;
63889
63890 list_for_each_entry_rcu(mod, &modules, list) {
63891 - struct symsearch arr[] = {
63892 + struct symsearch modarr[] = {
63893 { mod->syms, mod->syms + mod->num_syms, mod->crcs,
63894 NOT_GPL_ONLY, false },
63895 { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
63896 @@ -306,7 +308,7 @@ bool each_symbol_section(bool (*fn)(cons
63897 #endif
63898 };
63899
63900 - if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
63901 + if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
63902 return true;
63903 }
63904 return false;
63905 @@ -438,7 +440,7 @@ static inline void __percpu *mod_percpu(
63906 static int percpu_modalloc(struct module *mod,
63907 unsigned long size, unsigned long align)
63908 {
63909 - if (align > PAGE_SIZE) {
63910 + if (align-1 >= PAGE_SIZE) {
63911 printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
63912 mod->name, align, PAGE_SIZE);
63913 align = PAGE_SIZE;
63914 @@ -1166,7 +1168,7 @@ resolve_symbol_wait(struct module *mod,
63915 */
63916 #ifdef CONFIG_SYSFS
63917
63918 -#ifdef CONFIG_KALLSYMS
63919 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
63920 static inline bool sect_empty(const Elf_Shdr *sect)
63921 {
63922 return !(sect->sh_flags & SHF_ALLOC) || sect->sh_size == 0;
63923 @@ -1632,21 +1634,21 @@ static void set_section_ro_nx(void *base
63924
63925 static void unset_module_core_ro_nx(struct module *mod)
63926 {
63927 - set_page_attributes(mod->module_core + mod->core_text_size,
63928 - mod->module_core + mod->core_size,
63929 + set_page_attributes(mod->module_core_rw,
63930 + mod->module_core_rw + mod->core_size_rw,
63931 set_memory_x);
63932 - set_page_attributes(mod->module_core,
63933 - mod->module_core + mod->core_ro_size,
63934 + set_page_attributes(mod->module_core_rx,
63935 + mod->module_core_rx + mod->core_size_rx,
63936 set_memory_rw);
63937 }
63938
63939 static void unset_module_init_ro_nx(struct module *mod)
63940 {
63941 - set_page_attributes(mod->module_init + mod->init_text_size,
63942 - mod->module_init + mod->init_size,
63943 + set_page_attributes(mod->module_init_rw,
63944 + mod->module_init_rw + mod->init_size_rw,
63945 set_memory_x);
63946 - set_page_attributes(mod->module_init,
63947 - mod->module_init + mod->init_ro_size,
63948 + set_page_attributes(mod->module_init_rx,
63949 + mod->module_init_rx + mod->init_size_rx,
63950 set_memory_rw);
63951 }
63952
63953 @@ -1657,14 +1659,14 @@ void set_all_modules_text_rw(void)
63954
63955 mutex_lock(&module_mutex);
63956 list_for_each_entry_rcu(mod, &modules, list) {
63957 - if ((mod->module_core) && (mod->core_text_size)) {
63958 - set_page_attributes(mod->module_core,
63959 - mod->module_core + mod->core_text_size,
63960 + if ((mod->module_core_rx) && (mod->core_size_rx)) {
63961 + set_page_attributes(mod->module_core_rx,
63962 + mod->module_core_rx + mod->core_size_rx,
63963 set_memory_rw);
63964 }
63965 - if ((mod->module_init) && (mod->init_text_size)) {
63966 - set_page_attributes(mod->module_init,
63967 - mod->module_init + mod->init_text_size,
63968 + if ((mod->module_init_rx) && (mod->init_size_rx)) {
63969 + set_page_attributes(mod->module_init_rx,
63970 + mod->module_init_rx + mod->init_size_rx,
63971 set_memory_rw);
63972 }
63973 }
63974 @@ -1678,14 +1680,14 @@ void set_all_modules_text_ro(void)
63975
63976 mutex_lock(&module_mutex);
63977 list_for_each_entry_rcu(mod, &modules, list) {
63978 - if ((mod->module_core) && (mod->core_text_size)) {
63979 - set_page_attributes(mod->module_core,
63980 - mod->module_core + mod->core_text_size,
63981 + if ((mod->module_core_rx) && (mod->core_size_rx)) {
63982 + set_page_attributes(mod->module_core_rx,
63983 + mod->module_core_rx + mod->core_size_rx,
63984 set_memory_ro);
63985 }
63986 - if ((mod->module_init) && (mod->init_text_size)) {
63987 - set_page_attributes(mod->module_init,
63988 - mod->module_init + mod->init_text_size,
63989 + if ((mod->module_init_rx) && (mod->init_size_rx)) {
63990 + set_page_attributes(mod->module_init_rx,
63991 + mod->module_init_rx + mod->init_size_rx,
63992 set_memory_ro);
63993 }
63994 }
63995 @@ -1722,16 +1724,19 @@ static void free_module(struct module *m
63996
63997 /* This may be NULL, but that's OK */
63998 unset_module_init_ro_nx(mod);
63999 - module_free(mod, mod->module_init);
64000 + module_free(mod, mod->module_init_rw);
64001 + module_free_exec(mod, mod->module_init_rx);
64002 kfree(mod->args);
64003 percpu_modfree(mod);
64004
64005 /* Free lock-classes: */
64006 - lockdep_free_key_range(mod->module_core, mod->core_size);
64007 + lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
64008 + lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
64009
64010 /* Finally, free the core (containing the module structure) */
64011 unset_module_core_ro_nx(mod);
64012 - module_free(mod, mod->module_core);
64013 + module_free_exec(mod, mod->module_core_rx);
64014 + module_free(mod, mod->module_core_rw);
64015
64016 #ifdef CONFIG_MPU
64017 update_protections(current->mm);
64018 @@ -1800,10 +1805,31 @@ static int simplify_symbols(struct modul
64019 unsigned int i;
64020 int ret = 0;
64021 const struct kernel_symbol *ksym;
64022 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
64023 + int is_fs_load = 0;
64024 + int register_filesystem_found = 0;
64025 + char *p;
64026 +
64027 + p = strstr(mod->args, "grsec_modharden_fs");
64028 + if (p) {
64029 + char *endptr = p + strlen("grsec_modharden_fs");
64030 + /* copy \0 as well */
64031 + memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
64032 + is_fs_load = 1;
64033 + }
64034 +#endif
64035
64036 for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
64037 const char *name = info->strtab + sym[i].st_name;
64038
64039 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
64040 + /* it's a real shame this will never get ripped and copied
64041 + upstream! ;(
64042 + */
64043 + if (is_fs_load && !strcmp(name, "register_filesystem"))
64044 + register_filesystem_found = 1;
64045 +#endif
64046 +
64047 switch (sym[i].st_shndx) {
64048 case SHN_COMMON:
64049 /* We compiled with -fno-common. These are not
64050 @@ -1824,7 +1850,9 @@ static int simplify_symbols(struct modul
64051 ksym = resolve_symbol_wait(mod, info, name);
64052 /* Ok if resolved. */
64053 if (ksym && !IS_ERR(ksym)) {
64054 + pax_open_kernel();
64055 sym[i].st_value = ksym->value;
64056 + pax_close_kernel();
64057 break;
64058 }
64059
64060 @@ -1843,11 +1871,20 @@ static int simplify_symbols(struct modul
64061 secbase = (unsigned long)mod_percpu(mod);
64062 else
64063 secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
64064 + pax_open_kernel();
64065 sym[i].st_value += secbase;
64066 + pax_close_kernel();
64067 break;
64068 }
64069 }
64070
64071 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
64072 + if (is_fs_load && !register_filesystem_found) {
64073 + printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
64074 + ret = -EPERM;
64075 + }
64076 +#endif
64077 +
64078 return ret;
64079 }
64080
64081 @@ -1931,22 +1968,12 @@ static void layout_sections(struct modul
64082 || s->sh_entsize != ~0UL
64083 || strstarts(sname, ".init"))
64084 continue;
64085 - s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
64086 + if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
64087 + s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
64088 + else
64089 + s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
64090 DEBUGP("\t%s\n", name);
64091 }
64092 - switch (m) {
64093 - case 0: /* executable */
64094 - mod->core_size = debug_align(mod->core_size);
64095 - mod->core_text_size = mod->core_size;
64096 - break;
64097 - case 1: /* RO: text and ro-data */
64098 - mod->core_size = debug_align(mod->core_size);
64099 - mod->core_ro_size = mod->core_size;
64100 - break;
64101 - case 3: /* whole core */
64102 - mod->core_size = debug_align(mod->core_size);
64103 - break;
64104 - }
64105 }
64106
64107 DEBUGP("Init section allocation order:\n");
64108 @@ -1960,23 +1987,13 @@ static void layout_sections(struct modul
64109 || s->sh_entsize != ~0UL
64110 || !strstarts(sname, ".init"))
64111 continue;
64112 - s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
64113 - | INIT_OFFSET_MASK);
64114 + if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
64115 + s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
64116 + else
64117 + s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
64118 + s->sh_entsize |= INIT_OFFSET_MASK;
64119 DEBUGP("\t%s\n", sname);
64120 }
64121 - switch (m) {
64122 - case 0: /* executable */
64123 - mod->init_size = debug_align(mod->init_size);
64124 - mod->init_text_size = mod->init_size;
64125 - break;
64126 - case 1: /* RO: text and ro-data */
64127 - mod->init_size = debug_align(mod->init_size);
64128 - mod->init_ro_size = mod->init_size;
64129 - break;
64130 - case 3: /* whole init */
64131 - mod->init_size = debug_align(mod->init_size);
64132 - break;
64133 - }
64134 }
64135 }
64136
64137 @@ -2141,7 +2158,7 @@ static void layout_symtab(struct module
64138
64139 /* Put symbol section at end of init part of module. */
64140 symsect->sh_flags |= SHF_ALLOC;
64141 - symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
64142 + symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
64143 info->index.sym) | INIT_OFFSET_MASK;
64144 DEBUGP("\t%s\n", info->secstrings + symsect->sh_name);
64145
64146 @@ -2158,19 +2175,19 @@ static void layout_symtab(struct module
64147 }
64148
64149 /* Append room for core symbols at end of core part. */
64150 - info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
64151 - mod->core_size = info->symoffs + ndst * sizeof(Elf_Sym);
64152 + info->symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
64153 + mod->core_size_rx = info->symoffs + ndst * sizeof(Elf_Sym);
64154
64155 /* Put string table section at end of init part of module. */
64156 strsect->sh_flags |= SHF_ALLOC;
64157 - strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
64158 + strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
64159 info->index.str) | INIT_OFFSET_MASK;
64160 DEBUGP("\t%s\n", info->secstrings + strsect->sh_name);
64161
64162 /* Append room for core symbols' strings at end of core part. */
64163 - info->stroffs = mod->core_size;
64164 + info->stroffs = mod->core_size_rx;
64165 __set_bit(0, info->strmap);
64166 - mod->core_size += bitmap_weight(info->strmap, strsect->sh_size);
64167 + mod->core_size_rx += bitmap_weight(info->strmap, strsect->sh_size);
64168 }
64169
64170 static void add_kallsyms(struct module *mod, const struct load_info *info)
64171 @@ -2186,11 +2203,13 @@ static void add_kallsyms(struct module *
64172 /* Make sure we get permanent strtab: don't use info->strtab. */
64173 mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
64174
64175 + pax_open_kernel();
64176 +
64177 /* Set types up while we still have access to sections. */
64178 for (i = 0; i < mod->num_symtab; i++)
64179 mod->symtab[i].st_info = elf_type(&mod->symtab[i], info);
64180
64181 - mod->core_symtab = dst = mod->module_core + info->symoffs;
64182 + mod->core_symtab = dst = mod->module_core_rx + info->symoffs;
64183 src = mod->symtab;
64184 *dst = *src;
64185 for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
64186 @@ -2203,10 +2222,12 @@ static void add_kallsyms(struct module *
64187 }
64188 mod->core_num_syms = ndst;
64189
64190 - mod->core_strtab = s = mod->module_core + info->stroffs;
64191 + mod->core_strtab = s = mod->module_core_rx + info->stroffs;
64192 for (*s = 0, i = 1; i < info->sechdrs[info->index.str].sh_size; ++i)
64193 if (test_bit(i, info->strmap))
64194 *++s = mod->strtab[i];
64195 +
64196 + pax_close_kernel();
64197 }
64198 #else
64199 static inline void layout_symtab(struct module *mod, struct load_info *info)
64200 @@ -2235,17 +2256,33 @@ static void dynamic_debug_remove(struct
64201 ddebug_remove_module(debug->modname);
64202 }
64203
64204 -static void *module_alloc_update_bounds(unsigned long size)
64205 +static void *module_alloc_update_bounds_rw(unsigned long size)
64206 {
64207 void *ret = module_alloc(size);
64208
64209 if (ret) {
64210 mutex_lock(&module_mutex);
64211 /* Update module bounds. */
64212 - if ((unsigned long)ret < module_addr_min)
64213 - module_addr_min = (unsigned long)ret;
64214 - if ((unsigned long)ret + size > module_addr_max)
64215 - module_addr_max = (unsigned long)ret + size;
64216 + if ((unsigned long)ret < module_addr_min_rw)
64217 + module_addr_min_rw = (unsigned long)ret;
64218 + if ((unsigned long)ret + size > module_addr_max_rw)
64219 + module_addr_max_rw = (unsigned long)ret + size;
64220 + mutex_unlock(&module_mutex);
64221 + }
64222 + return ret;
64223 +}
64224 +
64225 +static void *module_alloc_update_bounds_rx(unsigned long size)
64226 +{
64227 + void *ret = module_alloc_exec(size);
64228 +
64229 + if (ret) {
64230 + mutex_lock(&module_mutex);
64231 + /* Update module bounds. */
64232 + if ((unsigned long)ret < module_addr_min_rx)
64233 + module_addr_min_rx = (unsigned long)ret;
64234 + if ((unsigned long)ret + size > module_addr_max_rx)
64235 + module_addr_max_rx = (unsigned long)ret + size;
64236 mutex_unlock(&module_mutex);
64237 }
64238 return ret;
64239 @@ -2538,7 +2575,7 @@ static int move_module(struct module *mo
64240 void *ptr;
64241
64242 /* Do the allocs. */
64243 - ptr = module_alloc_update_bounds(mod->core_size);
64244 + ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
64245 /*
64246 * The pointer to this block is stored in the module structure
64247 * which is inside the block. Just mark it as not being a
64248 @@ -2548,23 +2585,50 @@ static int move_module(struct module *mo
64249 if (!ptr)
64250 return -ENOMEM;
64251
64252 - memset(ptr, 0, mod->core_size);
64253 - mod->module_core = ptr;
64254 + memset(ptr, 0, mod->core_size_rw);
64255 + mod->module_core_rw = ptr;
64256
64257 - ptr = module_alloc_update_bounds(mod->init_size);
64258 + ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
64259 /*
64260 * The pointer to this block is stored in the module structure
64261 * which is inside the block. This block doesn't need to be
64262 * scanned as it contains data and code that will be freed
64263 * after the module is initialized.
64264 */
64265 - kmemleak_ignore(ptr);
64266 - if (!ptr && mod->init_size) {
64267 - module_free(mod, mod->module_core);
64268 + kmemleak_not_leak(ptr);
64269 + if (!ptr && mod->init_size_rw) {
64270 + module_free(mod, mod->module_core_rw);
64271 return -ENOMEM;
64272 }
64273 - memset(ptr, 0, mod->init_size);
64274 - mod->module_init = ptr;
64275 + memset(ptr, 0, mod->init_size_rw);
64276 + mod->module_init_rw = ptr;
64277 +
64278 + ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
64279 + kmemleak_not_leak(ptr);
64280 + if (!ptr) {
64281 + module_free(mod, mod->module_init_rw);
64282 + module_free(mod, mod->module_core_rw);
64283 + return -ENOMEM;
64284 + }
64285 +
64286 + pax_open_kernel();
64287 + memset(ptr, 0, mod->core_size_rx);
64288 + pax_close_kernel();
64289 + mod->module_core_rx = ptr;
64290 +
64291 + ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
64292 + kmemleak_not_leak(ptr);
64293 + if (!ptr && mod->init_size_rx) {
64294 + module_free_exec(mod, mod->module_core_rx);
64295 + module_free(mod, mod->module_init_rw);
64296 + module_free(mod, mod->module_core_rw);
64297 + return -ENOMEM;
64298 + }
64299 +
64300 + pax_open_kernel();
64301 + memset(ptr, 0, mod->init_size_rx);
64302 + pax_close_kernel();
64303 + mod->module_init_rx = ptr;
64304
64305 /* Transfer each section which specifies SHF_ALLOC */
64306 DEBUGP("final section addresses:\n");
64307 @@ -2575,16 +2639,45 @@ static int move_module(struct module *mo
64308 if (!(shdr->sh_flags & SHF_ALLOC))
64309 continue;
64310
64311 - if (shdr->sh_entsize & INIT_OFFSET_MASK)
64312 - dest = mod->module_init
64313 - + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
64314 - else
64315 - dest = mod->module_core + shdr->sh_entsize;
64316 + if (shdr->sh_entsize & INIT_OFFSET_MASK) {
64317 + if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
64318 + dest = mod->module_init_rw
64319 + + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
64320 + else
64321 + dest = mod->module_init_rx
64322 + + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
64323 + } else {
64324 + if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
64325 + dest = mod->module_core_rw + shdr->sh_entsize;
64326 + else
64327 + dest = mod->module_core_rx + shdr->sh_entsize;
64328 + }
64329 +
64330 + if (shdr->sh_type != SHT_NOBITS) {
64331 +
64332 +#ifdef CONFIG_PAX_KERNEXEC
64333 +#ifdef CONFIG_X86_64
64334 + if ((shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_EXECINSTR))
64335 + set_memory_x((unsigned long)dest, (shdr->sh_size + PAGE_SIZE) >> PAGE_SHIFT);
64336 +#endif
64337 + if (!(shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_ALLOC)) {
64338 + pax_open_kernel();
64339 + memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
64340 + pax_close_kernel();
64341 + } else
64342 +#endif
64343
64344 - if (shdr->sh_type != SHT_NOBITS)
64345 memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
64346 + }
64347 /* Update sh_addr to point to copy in image. */
64348 - shdr->sh_addr = (unsigned long)dest;
64349 +
64350 +#ifdef CONFIG_PAX_KERNEXEC
64351 + if (shdr->sh_flags & SHF_EXECINSTR)
64352 + shdr->sh_addr = ktva_ktla((unsigned long)dest);
64353 + else
64354 +#endif
64355 +
64356 + shdr->sh_addr = (unsigned long)dest;
64357 DEBUGP("\t0x%lx %s\n",
64358 shdr->sh_addr, info->secstrings + shdr->sh_name);
64359 }
64360 @@ -2635,12 +2728,12 @@ static void flush_module_icache(const st
64361 * Do it before processing of module parameters, so the module
64362 * can provide parameter accessor functions of its own.
64363 */
64364 - if (mod->module_init)
64365 - flush_icache_range((unsigned long)mod->module_init,
64366 - (unsigned long)mod->module_init
64367 - + mod->init_size);
64368 - flush_icache_range((unsigned long)mod->module_core,
64369 - (unsigned long)mod->module_core + mod->core_size);
64370 + if (mod->module_init_rx)
64371 + flush_icache_range((unsigned long)mod->module_init_rx,
64372 + (unsigned long)mod->module_init_rx
64373 + + mod->init_size_rx);
64374 + flush_icache_range((unsigned long)mod->module_core_rx,
64375 + (unsigned long)mod->module_core_rx + mod->core_size_rx);
64376
64377 set_fs(old_fs);
64378 }
64379 @@ -2712,8 +2805,10 @@ static void module_deallocate(struct mod
64380 {
64381 kfree(info->strmap);
64382 percpu_modfree(mod);
64383 - module_free(mod, mod->module_init);
64384 - module_free(mod, mod->module_core);
64385 + module_free_exec(mod, mod->module_init_rx);
64386 + module_free_exec(mod, mod->module_core_rx);
64387 + module_free(mod, mod->module_init_rw);
64388 + module_free(mod, mod->module_core_rw);
64389 }
64390
64391 static int post_relocation(struct module *mod, const struct load_info *info)
64392 @@ -2770,9 +2865,38 @@ static struct module *load_module(void _
64393 if (err)
64394 goto free_unload;
64395
64396 + /* Now copy in args */
64397 + mod->args = strndup_user(uargs, ~0UL >> 1);
64398 + if (IS_ERR(mod->args)) {
64399 + err = PTR_ERR(mod->args);
64400 + goto free_unload;
64401 + }
64402 +
64403 /* Set up MODINFO_ATTR fields */
64404 setup_modinfo(mod, &info);
64405
64406 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
64407 + {
64408 + char *p, *p2;
64409 +
64410 + if (strstr(mod->args, "grsec_modharden_netdev")) {
64411 + printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
64412 + err = -EPERM;
64413 + goto free_modinfo;
64414 + } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
64415 + p += strlen("grsec_modharden_normal");
64416 + p2 = strstr(p, "_");
64417 + if (p2) {
64418 + *p2 = '\0';
64419 + printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
64420 + *p2 = '_';
64421 + }
64422 + err = -EPERM;
64423 + goto free_modinfo;
64424 + }
64425 + }
64426 +#endif
64427 +
64428 /* Fix up syms, so that st_value is a pointer to location. */
64429 err = simplify_symbols(mod, &info);
64430 if (err < 0)
64431 @@ -2788,13 +2912,6 @@ static struct module *load_module(void _
64432
64433 flush_module_icache(mod);
64434
64435 - /* Now copy in args */
64436 - mod->args = strndup_user(uargs, ~0UL >> 1);
64437 - if (IS_ERR(mod->args)) {
64438 - err = PTR_ERR(mod->args);
64439 - goto free_arch_cleanup;
64440 - }
64441 -
64442 /* Mark state as coming so strong_try_module_get() ignores us. */
64443 mod->state = MODULE_STATE_COMING;
64444
64445 @@ -2854,11 +2971,10 @@ static struct module *load_module(void _
64446 unlock:
64447 mutex_unlock(&module_mutex);
64448 synchronize_sched();
64449 - kfree(mod->args);
64450 - free_arch_cleanup:
64451 module_arch_cleanup(mod);
64452 free_modinfo:
64453 free_modinfo(mod);
64454 + kfree(mod->args);
64455 free_unload:
64456 module_unload_free(mod);
64457 free_module:
64458 @@ -2899,16 +3015,16 @@ SYSCALL_DEFINE3(init_module, void __user
64459 MODULE_STATE_COMING, mod);
64460
64461 /* Set RO and NX regions for core */
64462 - set_section_ro_nx(mod->module_core,
64463 - mod->core_text_size,
64464 - mod->core_ro_size,
64465 - mod->core_size);
64466 + set_section_ro_nx(mod->module_core_rx,
64467 + mod->core_size_rx,
64468 + mod->core_size_rx,
64469 + mod->core_size_rx);
64470
64471 /* Set RO and NX regions for init */
64472 - set_section_ro_nx(mod->module_init,
64473 - mod->init_text_size,
64474 - mod->init_ro_size,
64475 - mod->init_size);
64476 + set_section_ro_nx(mod->module_init_rx,
64477 + mod->init_size_rx,
64478 + mod->init_size_rx,
64479 + mod->init_size_rx);
64480
64481 do_mod_ctors(mod);
64482 /* Start the module */
64483 @@ -2954,11 +3070,12 @@ SYSCALL_DEFINE3(init_module, void __user
64484 mod->strtab = mod->core_strtab;
64485 #endif
64486 unset_module_init_ro_nx(mod);
64487 - module_free(mod, mod->module_init);
64488 - mod->module_init = NULL;
64489 - mod->init_size = 0;
64490 - mod->init_ro_size = 0;
64491 - mod->init_text_size = 0;
64492 + module_free(mod, mod->module_init_rw);
64493 + module_free_exec(mod, mod->module_init_rx);
64494 + mod->module_init_rw = NULL;
64495 + mod->module_init_rx = NULL;
64496 + mod->init_size_rw = 0;
64497 + mod->init_size_rx = 0;
64498 mutex_unlock(&module_mutex);
64499
64500 return 0;
64501 @@ -2989,10 +3106,16 @@ static const char *get_ksymbol(struct mo
64502 unsigned long nextval;
64503
64504 /* At worse, next value is at end of module */
64505 - if (within_module_init(addr, mod))
64506 - nextval = (unsigned long)mod->module_init+mod->init_text_size;
64507 + if (within_module_init_rx(addr, mod))
64508 + nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
64509 + else if (within_module_init_rw(addr, mod))
64510 + nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
64511 + else if (within_module_core_rx(addr, mod))
64512 + nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
64513 + else if (within_module_core_rw(addr, mod))
64514 + nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
64515 else
64516 - nextval = (unsigned long)mod->module_core+mod->core_text_size;
64517 + return NULL;
64518
64519 /* Scan for closest preceding symbol, and next symbol. (ELF
64520 starts real symbols at 1). */
64521 @@ -3238,7 +3361,7 @@ static int m_show(struct seq_file *m, vo
64522 char buf[8];
64523
64524 seq_printf(m, "%s %u",
64525 - mod->name, mod->init_size + mod->core_size);
64526 + mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
64527 print_unload_info(m, mod);
64528
64529 /* Informative for users. */
64530 @@ -3247,7 +3370,7 @@ static int m_show(struct seq_file *m, vo
64531 mod->state == MODULE_STATE_COMING ? "Loading":
64532 "Live");
64533 /* Used by oprofile and other similar tools. */
64534 - seq_printf(m, " 0x%pK", mod->module_core);
64535 + seq_printf(m, " 0x%pK 0x%pK", mod->module_core_rx, mod->module_core_rw);
64536
64537 /* Taints info */
64538 if (mod->taints)
64539 @@ -3283,7 +3406,17 @@ static const struct file_operations proc
64540
64541 static int __init proc_modules_init(void)
64542 {
64543 +#ifndef CONFIG_GRKERNSEC_HIDESYM
64544 +#ifdef CONFIG_GRKERNSEC_PROC_USER
64545 + proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
64546 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
64547 + proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
64548 +#else
64549 proc_create("modules", 0, NULL, &proc_modules_operations);
64550 +#endif
64551 +#else
64552 + proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
64553 +#endif
64554 return 0;
64555 }
64556 module_init(proc_modules_init);
64557 @@ -3342,12 +3475,12 @@ struct module *__module_address(unsigned
64558 {
64559 struct module *mod;
64560
64561 - if (addr < module_addr_min || addr > module_addr_max)
64562 + if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
64563 + (addr < module_addr_min_rw || addr > module_addr_max_rw))
64564 return NULL;
64565
64566 list_for_each_entry_rcu(mod, &modules, list)
64567 - if (within_module_core(addr, mod)
64568 - || within_module_init(addr, mod))
64569 + if (within_module_init(addr, mod) || within_module_core(addr, mod))
64570 return mod;
64571 return NULL;
64572 }
64573 @@ -3381,11 +3514,20 @@ bool is_module_text_address(unsigned lon
64574 */
64575 struct module *__module_text_address(unsigned long addr)
64576 {
64577 - struct module *mod = __module_address(addr);
64578 + struct module *mod;
64579 +
64580 +#ifdef CONFIG_X86_32
64581 + addr = ktla_ktva(addr);
64582 +#endif
64583 +
64584 + if (addr < module_addr_min_rx || addr > module_addr_max_rx)
64585 + return NULL;
64586 +
64587 + mod = __module_address(addr);
64588 +
64589 if (mod) {
64590 /* Make sure it's within the text section. */
64591 - if (!within(addr, mod->module_init, mod->init_text_size)
64592 - && !within(addr, mod->module_core, mod->core_text_size))
64593 + if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
64594 mod = NULL;
64595 }
64596 return mod;
64597 diff -urNp linux-3.0.8/kernel/mutex.c linux-3.0.8/kernel/mutex.c
64598 --- linux-3.0.8/kernel/mutex.c 2011-07-21 22:17:23.000000000 -0400
64599 +++ linux-3.0.8/kernel/mutex.c 2011-08-23 21:47:56.000000000 -0400
64600 @@ -198,7 +198,7 @@ __mutex_lock_common(struct mutex *lock,
64601 spin_lock_mutex(&lock->wait_lock, flags);
64602
64603 debug_mutex_lock_common(lock, &waiter);
64604 - debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
64605 + debug_mutex_add_waiter(lock, &waiter, task);
64606
64607 /* add waiting tasks to the end of the waitqueue (FIFO): */
64608 list_add_tail(&waiter.list, &lock->wait_list);
64609 @@ -227,8 +227,7 @@ __mutex_lock_common(struct mutex *lock,
64610 * TASK_UNINTERRUPTIBLE case.)
64611 */
64612 if (unlikely(signal_pending_state(state, task))) {
64613 - mutex_remove_waiter(lock, &waiter,
64614 - task_thread_info(task));
64615 + mutex_remove_waiter(lock, &waiter, task);
64616 mutex_release(&lock->dep_map, 1, ip);
64617 spin_unlock_mutex(&lock->wait_lock, flags);
64618
64619 @@ -249,7 +248,7 @@ __mutex_lock_common(struct mutex *lock,
64620 done:
64621 lock_acquired(&lock->dep_map, ip);
64622 /* got the lock - rejoice! */
64623 - mutex_remove_waiter(lock, &waiter, current_thread_info());
64624 + mutex_remove_waiter(lock, &waiter, task);
64625 mutex_set_owner(lock);
64626
64627 /* set it to 0 if there are no waiters left: */
64628 diff -urNp linux-3.0.8/kernel/mutex-debug.c linux-3.0.8/kernel/mutex-debug.c
64629 --- linux-3.0.8/kernel/mutex-debug.c 2011-07-21 22:17:23.000000000 -0400
64630 +++ linux-3.0.8/kernel/mutex-debug.c 2011-08-23 21:47:56.000000000 -0400
64631 @@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mute
64632 }
64633
64634 void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
64635 - struct thread_info *ti)
64636 + struct task_struct *task)
64637 {
64638 SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
64639
64640 /* Mark the current thread as blocked on the lock: */
64641 - ti->task->blocked_on = waiter;
64642 + task->blocked_on = waiter;
64643 }
64644
64645 void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
64646 - struct thread_info *ti)
64647 + struct task_struct *task)
64648 {
64649 DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
64650 - DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
64651 - DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
64652 - ti->task->blocked_on = NULL;
64653 + DEBUG_LOCKS_WARN_ON(waiter->task != task);
64654 + DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
64655 + task->blocked_on = NULL;
64656
64657 list_del_init(&waiter->list);
64658 waiter->task = NULL;
64659 diff -urNp linux-3.0.8/kernel/mutex-debug.h linux-3.0.8/kernel/mutex-debug.h
64660 --- linux-3.0.8/kernel/mutex-debug.h 2011-07-21 22:17:23.000000000 -0400
64661 +++ linux-3.0.8/kernel/mutex-debug.h 2011-08-23 21:47:56.000000000 -0400
64662 @@ -20,9 +20,9 @@ extern void debug_mutex_wake_waiter(stru
64663 extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
64664 extern void debug_mutex_add_waiter(struct mutex *lock,
64665 struct mutex_waiter *waiter,
64666 - struct thread_info *ti);
64667 + struct task_struct *task);
64668 extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
64669 - struct thread_info *ti);
64670 + struct task_struct *task);
64671 extern void debug_mutex_unlock(struct mutex *lock);
64672 extern void debug_mutex_init(struct mutex *lock, const char *name,
64673 struct lock_class_key *key);
64674 diff -urNp linux-3.0.8/kernel/padata.c linux-3.0.8/kernel/padata.c
64675 --- linux-3.0.8/kernel/padata.c 2011-07-21 22:17:23.000000000 -0400
64676 +++ linux-3.0.8/kernel/padata.c 2011-08-23 21:47:56.000000000 -0400
64677 @@ -132,10 +132,10 @@ int padata_do_parallel(struct padata_ins
64678 padata->pd = pd;
64679 padata->cb_cpu = cb_cpu;
64680
64681 - if (unlikely(atomic_read(&pd->seq_nr) == pd->max_seq_nr))
64682 - atomic_set(&pd->seq_nr, -1);
64683 + if (unlikely(atomic_read_unchecked(&pd->seq_nr) == pd->max_seq_nr))
64684 + atomic_set_unchecked(&pd->seq_nr, -1);
64685
64686 - padata->seq_nr = atomic_inc_return(&pd->seq_nr);
64687 + padata->seq_nr = atomic_inc_return_unchecked(&pd->seq_nr);
64688
64689 target_cpu = padata_cpu_hash(padata);
64690 queue = per_cpu_ptr(pd->pqueue, target_cpu);
64691 @@ -444,7 +444,7 @@ static struct parallel_data *padata_allo
64692 padata_init_pqueues(pd);
64693 padata_init_squeues(pd);
64694 setup_timer(&pd->timer, padata_reorder_timer, (unsigned long)pd);
64695 - atomic_set(&pd->seq_nr, -1);
64696 + atomic_set_unchecked(&pd->seq_nr, -1);
64697 atomic_set(&pd->reorder_objects, 0);
64698 atomic_set(&pd->refcnt, 0);
64699 pd->pinst = pinst;
64700 diff -urNp linux-3.0.8/kernel/panic.c linux-3.0.8/kernel/panic.c
64701 --- linux-3.0.8/kernel/panic.c 2011-07-21 22:17:23.000000000 -0400
64702 +++ linux-3.0.8/kernel/panic.c 2011-08-23 21:48:14.000000000 -0400
64703 @@ -369,7 +369,7 @@ static void warn_slowpath_common(const c
64704 const char *board;
64705
64706 printk(KERN_WARNING "------------[ cut here ]------------\n");
64707 - printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
64708 + printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
64709 board = dmi_get_system_info(DMI_PRODUCT_NAME);
64710 if (board)
64711 printk(KERN_WARNING "Hardware name: %s\n", board);
64712 @@ -424,7 +424,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
64713 */
64714 void __stack_chk_fail(void)
64715 {
64716 - panic("stack-protector: Kernel stack is corrupted in: %p\n",
64717 + dump_stack();
64718 + panic("stack-protector: Kernel stack is corrupted in: %pA\n",
64719 __builtin_return_address(0));
64720 }
64721 EXPORT_SYMBOL(__stack_chk_fail);
64722 diff -urNp linux-3.0.8/kernel/pid.c linux-3.0.8/kernel/pid.c
64723 --- linux-3.0.8/kernel/pid.c 2011-07-21 22:17:23.000000000 -0400
64724 +++ linux-3.0.8/kernel/pid.c 2011-08-23 21:48:14.000000000 -0400
64725 @@ -33,6 +33,7 @@
64726 #include <linux/rculist.h>
64727 #include <linux/bootmem.h>
64728 #include <linux/hash.h>
64729 +#include <linux/security.h>
64730 #include <linux/pid_namespace.h>
64731 #include <linux/init_task.h>
64732 #include <linux/syscalls.h>
64733 @@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT
64734
64735 int pid_max = PID_MAX_DEFAULT;
64736
64737 -#define RESERVED_PIDS 300
64738 +#define RESERVED_PIDS 500
64739
64740 int pid_max_min = RESERVED_PIDS + 1;
64741 int pid_max_max = PID_MAX_LIMIT;
64742 @@ -419,8 +420,15 @@ EXPORT_SYMBOL(pid_task);
64743 */
64744 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
64745 {
64746 + struct task_struct *task;
64747 +
64748 rcu_lockdep_assert(rcu_read_lock_held());
64749 - return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
64750 + task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
64751 +
64752 + if (gr_pid_is_chrooted(task))
64753 + return NULL;
64754 +
64755 + return task;
64756 }
64757
64758 struct task_struct *find_task_by_vpid(pid_t vnr)
64759 @@ -428,6 +436,12 @@ struct task_struct *find_task_by_vpid(pi
64760 return find_task_by_pid_ns(vnr, current->nsproxy->pid_ns);
64761 }
64762
64763 +struct task_struct *find_task_by_vpid_unrestricted(pid_t vnr)
64764 +{
64765 + rcu_lockdep_assert(rcu_read_lock_held());
64766 + return pid_task(find_pid_ns(vnr, current->nsproxy->pid_ns), PIDTYPE_PID);
64767 +}
64768 +
64769 struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
64770 {
64771 struct pid *pid;
64772 diff -urNp linux-3.0.8/kernel/posix-cpu-timers.c linux-3.0.8/kernel/posix-cpu-timers.c
64773 --- linux-3.0.8/kernel/posix-cpu-timers.c 2011-10-25 09:10:33.000000000 -0400
64774 +++ linux-3.0.8/kernel/posix-cpu-timers.c 2011-10-25 09:10:41.000000000 -0400
64775 @@ -6,6 +6,7 @@
64776 #include <linux/posix-timers.h>
64777 #include <linux/errno.h>
64778 #include <linux/math64.h>
64779 +#include <linux/security.h>
64780 #include <asm/uaccess.h>
64781 #include <linux/kernel_stat.h>
64782 #include <trace/events/timer.h>
64783 @@ -1606,14 +1607,14 @@ struct k_clock clock_posix_cpu = {
64784
64785 static __init int init_posix_cpu_timers(void)
64786 {
64787 - struct k_clock process = {
64788 + static struct k_clock process = {
64789 .clock_getres = process_cpu_clock_getres,
64790 .clock_get = process_cpu_clock_get,
64791 .timer_create = process_cpu_timer_create,
64792 .nsleep = process_cpu_nsleep,
64793 .nsleep_restart = process_cpu_nsleep_restart,
64794 };
64795 - struct k_clock thread = {
64796 + static struct k_clock thread = {
64797 .clock_getres = thread_cpu_clock_getres,
64798 .clock_get = thread_cpu_clock_get,
64799 .timer_create = thread_cpu_timer_create,
64800 diff -urNp linux-3.0.8/kernel/posix-timers.c linux-3.0.8/kernel/posix-timers.c
64801 --- linux-3.0.8/kernel/posix-timers.c 2011-07-21 22:17:23.000000000 -0400
64802 +++ linux-3.0.8/kernel/posix-timers.c 2011-08-23 21:48:14.000000000 -0400
64803 @@ -43,6 +43,7 @@
64804 #include <linux/idr.h>
64805 #include <linux/posix-clock.h>
64806 #include <linux/posix-timers.h>
64807 +#include <linux/grsecurity.h>
64808 #include <linux/syscalls.h>
64809 #include <linux/wait.h>
64810 #include <linux/workqueue.h>
64811 @@ -129,7 +130,7 @@ static DEFINE_SPINLOCK(idr_lock);
64812 * which we beg off on and pass to do_sys_settimeofday().
64813 */
64814
64815 -static struct k_clock posix_clocks[MAX_CLOCKS];
64816 +static struct k_clock *posix_clocks[MAX_CLOCKS];
64817
64818 /*
64819 * These ones are defined below.
64820 @@ -227,7 +228,7 @@ static int posix_get_boottime(const cloc
64821 */
64822 static __init int init_posix_timers(void)
64823 {
64824 - struct k_clock clock_realtime = {
64825 + static struct k_clock clock_realtime = {
64826 .clock_getres = hrtimer_get_res,
64827 .clock_get = posix_clock_realtime_get,
64828 .clock_set = posix_clock_realtime_set,
64829 @@ -239,7 +240,7 @@ static __init int init_posix_timers(void
64830 .timer_get = common_timer_get,
64831 .timer_del = common_timer_del,
64832 };
64833 - struct k_clock clock_monotonic = {
64834 + static struct k_clock clock_monotonic = {
64835 .clock_getres = hrtimer_get_res,
64836 .clock_get = posix_ktime_get_ts,
64837 .nsleep = common_nsleep,
64838 @@ -249,19 +250,19 @@ static __init int init_posix_timers(void
64839 .timer_get = common_timer_get,
64840 .timer_del = common_timer_del,
64841 };
64842 - struct k_clock clock_monotonic_raw = {
64843 + static struct k_clock clock_monotonic_raw = {
64844 .clock_getres = hrtimer_get_res,
64845 .clock_get = posix_get_monotonic_raw,
64846 };
64847 - struct k_clock clock_realtime_coarse = {
64848 + static struct k_clock clock_realtime_coarse = {
64849 .clock_getres = posix_get_coarse_res,
64850 .clock_get = posix_get_realtime_coarse,
64851 };
64852 - struct k_clock clock_monotonic_coarse = {
64853 + static struct k_clock clock_monotonic_coarse = {
64854 .clock_getres = posix_get_coarse_res,
64855 .clock_get = posix_get_monotonic_coarse,
64856 };
64857 - struct k_clock clock_boottime = {
64858 + static struct k_clock clock_boottime = {
64859 .clock_getres = hrtimer_get_res,
64860 .clock_get = posix_get_boottime,
64861 .nsleep = common_nsleep,
64862 @@ -272,6 +273,8 @@ static __init int init_posix_timers(void
64863 .timer_del = common_timer_del,
64864 };
64865
64866 + pax_track_stack();
64867 +
64868 posix_timers_register_clock(CLOCK_REALTIME, &clock_realtime);
64869 posix_timers_register_clock(CLOCK_MONOTONIC, &clock_monotonic);
64870 posix_timers_register_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
64871 @@ -473,7 +476,7 @@ void posix_timers_register_clock(const c
64872 return;
64873 }
64874
64875 - posix_clocks[clock_id] = *new_clock;
64876 + posix_clocks[clock_id] = new_clock;
64877 }
64878 EXPORT_SYMBOL_GPL(posix_timers_register_clock);
64879
64880 @@ -519,9 +522,9 @@ static struct k_clock *clockid_to_kclock
64881 return (id & CLOCKFD_MASK) == CLOCKFD ?
64882 &clock_posix_dynamic : &clock_posix_cpu;
64883
64884 - if (id >= MAX_CLOCKS || !posix_clocks[id].clock_getres)
64885 + if (id >= MAX_CLOCKS || !posix_clocks[id] || !posix_clocks[id]->clock_getres)
64886 return NULL;
64887 - return &posix_clocks[id];
64888 + return posix_clocks[id];
64889 }
64890
64891 static int common_timer_create(struct k_itimer *new_timer)
64892 @@ -959,6 +962,13 @@ SYSCALL_DEFINE2(clock_settime, const clo
64893 if (copy_from_user(&new_tp, tp, sizeof (*tp)))
64894 return -EFAULT;
64895
64896 + /* only the CLOCK_REALTIME clock can be set, all other clocks
64897 + have their clock_set fptr set to a nosettime dummy function
64898 + CLOCK_REALTIME has a NULL clock_set fptr which causes it to
64899 + call common_clock_set, which calls do_sys_settimeofday, which
64900 + we hook
64901 + */
64902 +
64903 return kc->clock_set(which_clock, &new_tp);
64904 }
64905
64906 diff -urNp linux-3.0.8/kernel/power/poweroff.c linux-3.0.8/kernel/power/poweroff.c
64907 --- linux-3.0.8/kernel/power/poweroff.c 2011-07-21 22:17:23.000000000 -0400
64908 +++ linux-3.0.8/kernel/power/poweroff.c 2011-08-23 21:47:56.000000000 -0400
64909 @@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_powerof
64910 .enable_mask = SYSRQ_ENABLE_BOOT,
64911 };
64912
64913 -static int pm_sysrq_init(void)
64914 +static int __init pm_sysrq_init(void)
64915 {
64916 register_sysrq_key('o', &sysrq_poweroff_op);
64917 return 0;
64918 diff -urNp linux-3.0.8/kernel/power/process.c linux-3.0.8/kernel/power/process.c
64919 --- linux-3.0.8/kernel/power/process.c 2011-07-21 22:17:23.000000000 -0400
64920 +++ linux-3.0.8/kernel/power/process.c 2011-08-23 21:47:56.000000000 -0400
64921 @@ -41,6 +41,7 @@ static int try_to_freeze_tasks(bool sig_
64922 u64 elapsed_csecs64;
64923 unsigned int elapsed_csecs;
64924 bool wakeup = false;
64925 + bool timedout = false;
64926
64927 do_gettimeofday(&start);
64928
64929 @@ -51,6 +52,8 @@ static int try_to_freeze_tasks(bool sig_
64930
64931 while (true) {
64932 todo = 0;
64933 + if (time_after(jiffies, end_time))
64934 + timedout = true;
64935 read_lock(&tasklist_lock);
64936 do_each_thread(g, p) {
64937 if (frozen(p) || !freezable(p))
64938 @@ -71,9 +74,13 @@ static int try_to_freeze_tasks(bool sig_
64939 * try_to_stop() after schedule() in ptrace/signal
64940 * stop sees TIF_FREEZE.
64941 */
64942 - if (!task_is_stopped_or_traced(p) &&
64943 - !freezer_should_skip(p))
64944 + if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
64945 todo++;
64946 + if (timedout) {
64947 + printk(KERN_ERR "Task refusing to freeze:\n");
64948 + sched_show_task(p);
64949 + }
64950 + }
64951 } while_each_thread(g, p);
64952 read_unlock(&tasklist_lock);
64953
64954 @@ -82,7 +89,7 @@ static int try_to_freeze_tasks(bool sig_
64955 todo += wq_busy;
64956 }
64957
64958 - if (!todo || time_after(jiffies, end_time))
64959 + if (!todo || timedout)
64960 break;
64961
64962 if (pm_wakeup_pending()) {
64963 diff -urNp linux-3.0.8/kernel/printk.c linux-3.0.8/kernel/printk.c
64964 --- linux-3.0.8/kernel/printk.c 2011-10-24 08:05:30.000000000 -0400
64965 +++ linux-3.0.8/kernel/printk.c 2011-10-16 21:55:28.000000000 -0400
64966 @@ -313,12 +313,17 @@ static int check_syslog_permissions(int
64967 if (from_file && type != SYSLOG_ACTION_OPEN)
64968 return 0;
64969
64970 +#ifdef CONFIG_GRKERNSEC_DMESG
64971 + if (grsec_enable_dmesg && !capable(CAP_SYSLOG) && !capable_nolog(CAP_SYS_ADMIN))
64972 + return -EPERM;
64973 +#endif
64974 +
64975 if (syslog_action_restricted(type)) {
64976 if (capable(CAP_SYSLOG))
64977 return 0;
64978 /* For historical reasons, accept CAP_SYS_ADMIN too, with a warning */
64979 if (capable(CAP_SYS_ADMIN)) {
64980 - WARN_ONCE(1, "Attempt to access syslog with CAP_SYS_ADMIN "
64981 + printk_once(KERN_WARNING "Attempt to access syslog with CAP_SYS_ADMIN "
64982 "but no CAP_SYSLOG (deprecated).\n");
64983 return 0;
64984 }
64985 diff -urNp linux-3.0.8/kernel/profile.c linux-3.0.8/kernel/profile.c
64986 --- linux-3.0.8/kernel/profile.c 2011-07-21 22:17:23.000000000 -0400
64987 +++ linux-3.0.8/kernel/profile.c 2011-08-23 21:47:56.000000000 -0400
64988 @@ -39,7 +39,7 @@ struct profile_hit {
64989 /* Oprofile timer tick hook */
64990 static int (*timer_hook)(struct pt_regs *) __read_mostly;
64991
64992 -static atomic_t *prof_buffer;
64993 +static atomic_unchecked_t *prof_buffer;
64994 static unsigned long prof_len, prof_shift;
64995
64996 int prof_on __read_mostly;
64997 @@ -281,7 +281,7 @@ static void profile_flip_buffers(void)
64998 hits[i].pc = 0;
64999 continue;
65000 }
65001 - atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
65002 + atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
65003 hits[i].hits = hits[i].pc = 0;
65004 }
65005 }
65006 @@ -342,9 +342,9 @@ static void do_profile_hits(int type, vo
65007 * Add the current hit(s) and flush the write-queue out
65008 * to the global buffer:
65009 */
65010 - atomic_add(nr_hits, &prof_buffer[pc]);
65011 + atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
65012 for (i = 0; i < NR_PROFILE_HIT; ++i) {
65013 - atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
65014 + atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
65015 hits[i].pc = hits[i].hits = 0;
65016 }
65017 out:
65018 @@ -419,7 +419,7 @@ static void do_profile_hits(int type, vo
65019 {
65020 unsigned long pc;
65021 pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
65022 - atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
65023 + atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
65024 }
65025 #endif /* !CONFIG_SMP */
65026
65027 @@ -517,7 +517,7 @@ read_profile(struct file *file, char __u
65028 return -EFAULT;
65029 buf++; p++; count--; read++;
65030 }
65031 - pnt = (char *)prof_buffer + p - sizeof(atomic_t);
65032 + pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
65033 if (copy_to_user(buf, (void *)pnt, count))
65034 return -EFAULT;
65035 read += count;
65036 @@ -548,7 +548,7 @@ static ssize_t write_profile(struct file
65037 }
65038 #endif
65039 profile_discard_flip_buffers();
65040 - memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
65041 + memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
65042 return count;
65043 }
65044
65045 diff -urNp linux-3.0.8/kernel/ptrace.c linux-3.0.8/kernel/ptrace.c
65046 --- linux-3.0.8/kernel/ptrace.c 2011-07-21 22:17:23.000000000 -0400
65047 +++ linux-3.0.8/kernel/ptrace.c 2011-08-23 21:48:14.000000000 -0400
65048 @@ -132,7 +132,8 @@ int ptrace_check_attach(struct task_stru
65049 return ret;
65050 }
65051
65052 -int __ptrace_may_access(struct task_struct *task, unsigned int mode)
65053 +static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
65054 + unsigned int log)
65055 {
65056 const struct cred *cred = current_cred(), *tcred;
65057
65058 @@ -158,7 +159,8 @@ int __ptrace_may_access(struct task_stru
65059 cred->gid == tcred->sgid &&
65060 cred->gid == tcred->gid))
65061 goto ok;
65062 - if (ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE))
65063 + if ((!log && ns_capable_nolog(tcred->user->user_ns, CAP_SYS_PTRACE)) ||
65064 + (log && ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE)))
65065 goto ok;
65066 rcu_read_unlock();
65067 return -EPERM;
65068 @@ -167,7 +169,9 @@ ok:
65069 smp_rmb();
65070 if (task->mm)
65071 dumpable = get_dumpable(task->mm);
65072 - if (!dumpable && !task_ns_capable(task, CAP_SYS_PTRACE))
65073 + if (!dumpable &&
65074 + ((!log && !task_ns_capable_nolog(task, CAP_SYS_PTRACE)) ||
65075 + (log && !task_ns_capable(task, CAP_SYS_PTRACE))))
65076 return -EPERM;
65077
65078 return security_ptrace_access_check(task, mode);
65079 @@ -177,7 +181,16 @@ bool ptrace_may_access(struct task_struc
65080 {
65081 int err;
65082 task_lock(task);
65083 - err = __ptrace_may_access(task, mode);
65084 + err = __ptrace_may_access(task, mode, 0);
65085 + task_unlock(task);
65086 + return !err;
65087 +}
65088 +
65089 +bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
65090 +{
65091 + int err;
65092 + task_lock(task);
65093 + err = __ptrace_may_access(task, mode, 1);
65094 task_unlock(task);
65095 return !err;
65096 }
65097 @@ -205,7 +218,7 @@ static int ptrace_attach(struct task_str
65098 goto out;
65099
65100 task_lock(task);
65101 - retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
65102 + retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
65103 task_unlock(task);
65104 if (retval)
65105 goto unlock_creds;
65106 @@ -218,7 +231,7 @@ static int ptrace_attach(struct task_str
65107 goto unlock_tasklist;
65108
65109 task->ptrace = PT_PTRACED;
65110 - if (task_ns_capable(task, CAP_SYS_PTRACE))
65111 + if (task_ns_capable_nolog(task, CAP_SYS_PTRACE))
65112 task->ptrace |= PT_PTRACE_CAP;
65113
65114 __ptrace_link(task, current);
65115 @@ -406,6 +419,8 @@ int ptrace_readdata(struct task_struct *
65116 {
65117 int copied = 0;
65118
65119 + pax_track_stack();
65120 +
65121 while (len > 0) {
65122 char buf[128];
65123 int this_len, retval;
65124 @@ -417,7 +432,7 @@ int ptrace_readdata(struct task_struct *
65125 break;
65126 return -EIO;
65127 }
65128 - if (copy_to_user(dst, buf, retval))
65129 + if (retval > sizeof(buf) || copy_to_user(dst, buf, retval))
65130 return -EFAULT;
65131 copied += retval;
65132 src += retval;
65133 @@ -431,6 +446,8 @@ int ptrace_writedata(struct task_struct
65134 {
65135 int copied = 0;
65136
65137 + pax_track_stack();
65138 +
65139 while (len > 0) {
65140 char buf[128];
65141 int this_len, retval;
65142 @@ -613,9 +630,11 @@ int ptrace_request(struct task_struct *c
65143 {
65144 int ret = -EIO;
65145 siginfo_t siginfo;
65146 - void __user *datavp = (void __user *) data;
65147 + void __user *datavp = (__force void __user *) data;
65148 unsigned long __user *datalp = datavp;
65149
65150 + pax_track_stack();
65151 +
65152 switch (request) {
65153 case PTRACE_PEEKTEXT:
65154 case PTRACE_PEEKDATA:
65155 @@ -761,14 +780,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
65156 goto out;
65157 }
65158
65159 + if (gr_handle_ptrace(child, request)) {
65160 + ret = -EPERM;
65161 + goto out_put_task_struct;
65162 + }
65163 +
65164 if (request == PTRACE_ATTACH) {
65165 ret = ptrace_attach(child);
65166 /*
65167 * Some architectures need to do book-keeping after
65168 * a ptrace attach.
65169 */
65170 - if (!ret)
65171 + if (!ret) {
65172 arch_ptrace_attach(child);
65173 + gr_audit_ptrace(child);
65174 + }
65175 goto out_put_task_struct;
65176 }
65177
65178 @@ -793,7 +819,7 @@ int generic_ptrace_peekdata(struct task_
65179 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
65180 if (copied != sizeof(tmp))
65181 return -EIO;
65182 - return put_user(tmp, (unsigned long __user *)data);
65183 + return put_user(tmp, (__force unsigned long __user *)data);
65184 }
65185
65186 int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
65187 @@ -816,6 +842,8 @@ int compat_ptrace_request(struct task_st
65188 siginfo_t siginfo;
65189 int ret;
65190
65191 + pax_track_stack();
65192 +
65193 switch (request) {
65194 case PTRACE_PEEKTEXT:
65195 case PTRACE_PEEKDATA:
65196 @@ -903,14 +931,21 @@ asmlinkage long compat_sys_ptrace(compat
65197 goto out;
65198 }
65199
65200 + if (gr_handle_ptrace(child, request)) {
65201 + ret = -EPERM;
65202 + goto out_put_task_struct;
65203 + }
65204 +
65205 if (request == PTRACE_ATTACH) {
65206 ret = ptrace_attach(child);
65207 /*
65208 * Some architectures need to do book-keeping after
65209 * a ptrace attach.
65210 */
65211 - if (!ret)
65212 + if (!ret) {
65213 arch_ptrace_attach(child);
65214 + gr_audit_ptrace(child);
65215 + }
65216 goto out_put_task_struct;
65217 }
65218
65219 diff -urNp linux-3.0.8/kernel/rcutorture.c linux-3.0.8/kernel/rcutorture.c
65220 --- linux-3.0.8/kernel/rcutorture.c 2011-07-21 22:17:23.000000000 -0400
65221 +++ linux-3.0.8/kernel/rcutorture.c 2011-08-23 21:47:56.000000000 -0400
65222 @@ -138,12 +138,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_
65223 { 0 };
65224 static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
65225 { 0 };
65226 -static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
65227 -static atomic_t n_rcu_torture_alloc;
65228 -static atomic_t n_rcu_torture_alloc_fail;
65229 -static atomic_t n_rcu_torture_free;
65230 -static atomic_t n_rcu_torture_mberror;
65231 -static atomic_t n_rcu_torture_error;
65232 +static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
65233 +static atomic_unchecked_t n_rcu_torture_alloc;
65234 +static atomic_unchecked_t n_rcu_torture_alloc_fail;
65235 +static atomic_unchecked_t n_rcu_torture_free;
65236 +static atomic_unchecked_t n_rcu_torture_mberror;
65237 +static atomic_unchecked_t n_rcu_torture_error;
65238 static long n_rcu_torture_boost_ktrerror;
65239 static long n_rcu_torture_boost_rterror;
65240 static long n_rcu_torture_boost_failure;
65241 @@ -223,11 +223,11 @@ rcu_torture_alloc(void)
65242
65243 spin_lock_bh(&rcu_torture_lock);
65244 if (list_empty(&rcu_torture_freelist)) {
65245 - atomic_inc(&n_rcu_torture_alloc_fail);
65246 + atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
65247 spin_unlock_bh(&rcu_torture_lock);
65248 return NULL;
65249 }
65250 - atomic_inc(&n_rcu_torture_alloc);
65251 + atomic_inc_unchecked(&n_rcu_torture_alloc);
65252 p = rcu_torture_freelist.next;
65253 list_del_init(p);
65254 spin_unlock_bh(&rcu_torture_lock);
65255 @@ -240,7 +240,7 @@ rcu_torture_alloc(void)
65256 static void
65257 rcu_torture_free(struct rcu_torture *p)
65258 {
65259 - atomic_inc(&n_rcu_torture_free);
65260 + atomic_inc_unchecked(&n_rcu_torture_free);
65261 spin_lock_bh(&rcu_torture_lock);
65262 list_add_tail(&p->rtort_free, &rcu_torture_freelist);
65263 spin_unlock_bh(&rcu_torture_lock);
65264 @@ -360,7 +360,7 @@ rcu_torture_cb(struct rcu_head *p)
65265 i = rp->rtort_pipe_count;
65266 if (i > RCU_TORTURE_PIPE_LEN)
65267 i = RCU_TORTURE_PIPE_LEN;
65268 - atomic_inc(&rcu_torture_wcount[i]);
65269 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
65270 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
65271 rp->rtort_mbtest = 0;
65272 rcu_torture_free(rp);
65273 @@ -407,7 +407,7 @@ static void rcu_sync_torture_deferred_fr
65274 i = rp->rtort_pipe_count;
65275 if (i > RCU_TORTURE_PIPE_LEN)
65276 i = RCU_TORTURE_PIPE_LEN;
65277 - atomic_inc(&rcu_torture_wcount[i]);
65278 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
65279 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
65280 rp->rtort_mbtest = 0;
65281 list_del(&rp->rtort_free);
65282 @@ -882,7 +882,7 @@ rcu_torture_writer(void *arg)
65283 i = old_rp->rtort_pipe_count;
65284 if (i > RCU_TORTURE_PIPE_LEN)
65285 i = RCU_TORTURE_PIPE_LEN;
65286 - atomic_inc(&rcu_torture_wcount[i]);
65287 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
65288 old_rp->rtort_pipe_count++;
65289 cur_ops->deferred_free(old_rp);
65290 }
65291 @@ -951,7 +951,7 @@ static void rcu_torture_timer(unsigned l
65292 return;
65293 }
65294 if (p->rtort_mbtest == 0)
65295 - atomic_inc(&n_rcu_torture_mberror);
65296 + atomic_inc_unchecked(&n_rcu_torture_mberror);
65297 spin_lock(&rand_lock);
65298 cur_ops->read_delay(&rand);
65299 n_rcu_torture_timers++;
65300 @@ -1013,7 +1013,7 @@ rcu_torture_reader(void *arg)
65301 continue;
65302 }
65303 if (p->rtort_mbtest == 0)
65304 - atomic_inc(&n_rcu_torture_mberror);
65305 + atomic_inc_unchecked(&n_rcu_torture_mberror);
65306 cur_ops->read_delay(&rand);
65307 preempt_disable();
65308 pipe_count = p->rtort_pipe_count;
65309 @@ -1072,16 +1072,16 @@ rcu_torture_printk(char *page)
65310 rcu_torture_current,
65311 rcu_torture_current_version,
65312 list_empty(&rcu_torture_freelist),
65313 - atomic_read(&n_rcu_torture_alloc),
65314 - atomic_read(&n_rcu_torture_alloc_fail),
65315 - atomic_read(&n_rcu_torture_free),
65316 - atomic_read(&n_rcu_torture_mberror),
65317 + atomic_read_unchecked(&n_rcu_torture_alloc),
65318 + atomic_read_unchecked(&n_rcu_torture_alloc_fail),
65319 + atomic_read_unchecked(&n_rcu_torture_free),
65320 + atomic_read_unchecked(&n_rcu_torture_mberror),
65321 n_rcu_torture_boost_ktrerror,
65322 n_rcu_torture_boost_rterror,
65323 n_rcu_torture_boost_failure,
65324 n_rcu_torture_boosts,
65325 n_rcu_torture_timers);
65326 - if (atomic_read(&n_rcu_torture_mberror) != 0 ||
65327 + if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0 ||
65328 n_rcu_torture_boost_ktrerror != 0 ||
65329 n_rcu_torture_boost_rterror != 0 ||
65330 n_rcu_torture_boost_failure != 0)
65331 @@ -1089,7 +1089,7 @@ rcu_torture_printk(char *page)
65332 cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
65333 if (i > 1) {
65334 cnt += sprintf(&page[cnt], "!!! ");
65335 - atomic_inc(&n_rcu_torture_error);
65336 + atomic_inc_unchecked(&n_rcu_torture_error);
65337 WARN_ON_ONCE(1);
65338 }
65339 cnt += sprintf(&page[cnt], "Reader Pipe: ");
65340 @@ -1103,7 +1103,7 @@ rcu_torture_printk(char *page)
65341 cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
65342 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
65343 cnt += sprintf(&page[cnt], " %d",
65344 - atomic_read(&rcu_torture_wcount[i]));
65345 + atomic_read_unchecked(&rcu_torture_wcount[i]));
65346 }
65347 cnt += sprintf(&page[cnt], "\n");
65348 if (cur_ops->stats)
65349 @@ -1412,7 +1412,7 @@ rcu_torture_cleanup(void)
65350
65351 if (cur_ops->cleanup)
65352 cur_ops->cleanup();
65353 - if (atomic_read(&n_rcu_torture_error))
65354 + if (atomic_read_unchecked(&n_rcu_torture_error))
65355 rcu_torture_print_module_parms(cur_ops, "End of test: FAILURE");
65356 else
65357 rcu_torture_print_module_parms(cur_ops, "End of test: SUCCESS");
65358 @@ -1476,17 +1476,17 @@ rcu_torture_init(void)
65359
65360 rcu_torture_current = NULL;
65361 rcu_torture_current_version = 0;
65362 - atomic_set(&n_rcu_torture_alloc, 0);
65363 - atomic_set(&n_rcu_torture_alloc_fail, 0);
65364 - atomic_set(&n_rcu_torture_free, 0);
65365 - atomic_set(&n_rcu_torture_mberror, 0);
65366 - atomic_set(&n_rcu_torture_error, 0);
65367 + atomic_set_unchecked(&n_rcu_torture_alloc, 0);
65368 + atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
65369 + atomic_set_unchecked(&n_rcu_torture_free, 0);
65370 + atomic_set_unchecked(&n_rcu_torture_mberror, 0);
65371 + atomic_set_unchecked(&n_rcu_torture_error, 0);
65372 n_rcu_torture_boost_ktrerror = 0;
65373 n_rcu_torture_boost_rterror = 0;
65374 n_rcu_torture_boost_failure = 0;
65375 n_rcu_torture_boosts = 0;
65376 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
65377 - atomic_set(&rcu_torture_wcount[i], 0);
65378 + atomic_set_unchecked(&rcu_torture_wcount[i], 0);
65379 for_each_possible_cpu(cpu) {
65380 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
65381 per_cpu(rcu_torture_count, cpu)[i] = 0;
65382 diff -urNp linux-3.0.8/kernel/rcutree.c linux-3.0.8/kernel/rcutree.c
65383 --- linux-3.0.8/kernel/rcutree.c 2011-07-21 22:17:23.000000000 -0400
65384 +++ linux-3.0.8/kernel/rcutree.c 2011-09-14 09:08:05.000000000 -0400
65385 @@ -356,9 +356,9 @@ void rcu_enter_nohz(void)
65386 }
65387 /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */
65388 smp_mb__before_atomic_inc(); /* See above. */
65389 - atomic_inc(&rdtp->dynticks);
65390 + atomic_inc_unchecked(&rdtp->dynticks);
65391 smp_mb__after_atomic_inc(); /* Force ordering with next sojourn. */
65392 - WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1);
65393 + WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks) & 0x1);
65394 local_irq_restore(flags);
65395
65396 /* If the interrupt queued a callback, get out of dyntick mode. */
65397 @@ -387,10 +387,10 @@ void rcu_exit_nohz(void)
65398 return;
65399 }
65400 smp_mb__before_atomic_inc(); /* Force ordering w/previous sojourn. */
65401 - atomic_inc(&rdtp->dynticks);
65402 + atomic_inc_unchecked(&rdtp->dynticks);
65403 /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */
65404 smp_mb__after_atomic_inc(); /* See above. */
65405 - WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
65406 + WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks) & 0x1));
65407 local_irq_restore(flags);
65408 }
65409
65410 @@ -406,14 +406,14 @@ void rcu_nmi_enter(void)
65411 struct rcu_dynticks *rdtp = &__get_cpu_var(rcu_dynticks);
65412
65413 if (rdtp->dynticks_nmi_nesting == 0 &&
65414 - (atomic_read(&rdtp->dynticks) & 0x1))
65415 + (atomic_read_unchecked(&rdtp->dynticks) & 0x1))
65416 return;
65417 rdtp->dynticks_nmi_nesting++;
65418 smp_mb__before_atomic_inc(); /* Force delay from prior write. */
65419 - atomic_inc(&rdtp->dynticks);
65420 + atomic_inc_unchecked(&rdtp->dynticks);
65421 /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */
65422 smp_mb__after_atomic_inc(); /* See above. */
65423 - WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
65424 + WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks) & 0x1));
65425 }
65426
65427 /**
65428 @@ -432,9 +432,9 @@ void rcu_nmi_exit(void)
65429 return;
65430 /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */
65431 smp_mb__before_atomic_inc(); /* See above. */
65432 - atomic_inc(&rdtp->dynticks);
65433 + atomic_inc_unchecked(&rdtp->dynticks);
65434 smp_mb__after_atomic_inc(); /* Force delay to next write. */
65435 - WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1);
65436 + WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks) & 0x1);
65437 }
65438
65439 /**
65440 @@ -469,7 +469,7 @@ void rcu_irq_exit(void)
65441 */
65442 static int dyntick_save_progress_counter(struct rcu_data *rdp)
65443 {
65444 - rdp->dynticks_snap = atomic_add_return(0, &rdp->dynticks->dynticks);
65445 + rdp->dynticks_snap = atomic_add_return_unchecked(0, &rdp->dynticks->dynticks);
65446 return 0;
65447 }
65448
65449 @@ -484,7 +484,7 @@ static int rcu_implicit_dynticks_qs(stru
65450 unsigned long curr;
65451 unsigned long snap;
65452
65453 - curr = (unsigned long)atomic_add_return(0, &rdp->dynticks->dynticks);
65454 + curr = (unsigned long)atomic_add_return_unchecked(0, &rdp->dynticks->dynticks);
65455 snap = (unsigned long)rdp->dynticks_snap;
65456
65457 /*
65458 @@ -1470,7 +1470,7 @@ __rcu_process_callbacks(struct rcu_state
65459 /*
65460 * Do softirq processing for the current CPU.
65461 */
65462 -static void rcu_process_callbacks(struct softirq_action *unused)
65463 +static void rcu_process_callbacks(void)
65464 {
65465 __rcu_process_callbacks(&rcu_sched_state,
65466 &__get_cpu_var(rcu_sched_data));
65467 diff -urNp linux-3.0.8/kernel/rcutree.h linux-3.0.8/kernel/rcutree.h
65468 --- linux-3.0.8/kernel/rcutree.h 2011-07-21 22:17:23.000000000 -0400
65469 +++ linux-3.0.8/kernel/rcutree.h 2011-09-14 09:08:05.000000000 -0400
65470 @@ -86,7 +86,7 @@
65471 struct rcu_dynticks {
65472 int dynticks_nesting; /* Track irq/process nesting level. */
65473 int dynticks_nmi_nesting; /* Track NMI nesting level. */
65474 - atomic_t dynticks; /* Even value for dynticks-idle, else odd. */
65475 + atomic_unchecked_t dynticks; /* Even value for dynticks-idle, else odd. */
65476 };
65477
65478 /* RCU's kthread states for tracing. */
65479 diff -urNp linux-3.0.8/kernel/rcutree_plugin.h linux-3.0.8/kernel/rcutree_plugin.h
65480 --- linux-3.0.8/kernel/rcutree_plugin.h 2011-07-21 22:17:23.000000000 -0400
65481 +++ linux-3.0.8/kernel/rcutree_plugin.h 2011-08-23 21:47:56.000000000 -0400
65482 @@ -822,7 +822,7 @@ void synchronize_rcu_expedited(void)
65483
65484 /* Clean up and exit. */
65485 smp_mb(); /* ensure expedited GP seen before counter increment. */
65486 - ACCESS_ONCE(sync_rcu_preempt_exp_count)++;
65487 + ACCESS_ONCE_RW(sync_rcu_preempt_exp_count)++;
65488 unlock_mb_ret:
65489 mutex_unlock(&sync_rcu_preempt_exp_mutex);
65490 mb_ret:
65491 @@ -1774,8 +1774,8 @@ EXPORT_SYMBOL_GPL(synchronize_sched_expe
65492
65493 #else /* #ifndef CONFIG_SMP */
65494
65495 -static atomic_t sync_sched_expedited_started = ATOMIC_INIT(0);
65496 -static atomic_t sync_sched_expedited_done = ATOMIC_INIT(0);
65497 +static atomic_unchecked_t sync_sched_expedited_started = ATOMIC_INIT(0);
65498 +static atomic_unchecked_t sync_sched_expedited_done = ATOMIC_INIT(0);
65499
65500 static int synchronize_sched_expedited_cpu_stop(void *data)
65501 {
65502 @@ -1830,7 +1830,7 @@ void synchronize_sched_expedited(void)
65503 int firstsnap, s, snap, trycount = 0;
65504
65505 /* Note that atomic_inc_return() implies full memory barrier. */
65506 - firstsnap = snap = atomic_inc_return(&sync_sched_expedited_started);
65507 + firstsnap = snap = atomic_inc_return_unchecked(&sync_sched_expedited_started);
65508 get_online_cpus();
65509
65510 /*
65511 @@ -1851,7 +1851,7 @@ void synchronize_sched_expedited(void)
65512 }
65513
65514 /* Check to see if someone else did our work for us. */
65515 - s = atomic_read(&sync_sched_expedited_done);
65516 + s = atomic_read_unchecked(&sync_sched_expedited_done);
65517 if (UINT_CMP_GE((unsigned)s, (unsigned)firstsnap)) {
65518 smp_mb(); /* ensure test happens before caller kfree */
65519 return;
65520 @@ -1866,7 +1866,7 @@ void synchronize_sched_expedited(void)
65521 * grace period works for us.
65522 */
65523 get_online_cpus();
65524 - snap = atomic_read(&sync_sched_expedited_started) - 1;
65525 + snap = atomic_read_unchecked(&sync_sched_expedited_started) - 1;
65526 smp_mb(); /* ensure read is before try_stop_cpus(). */
65527 }
65528
65529 @@ -1877,12 +1877,12 @@ void synchronize_sched_expedited(void)
65530 * than we did beat us to the punch.
65531 */
65532 do {
65533 - s = atomic_read(&sync_sched_expedited_done);
65534 + s = atomic_read_unchecked(&sync_sched_expedited_done);
65535 if (UINT_CMP_GE((unsigned)s, (unsigned)snap)) {
65536 smp_mb(); /* ensure test happens before caller kfree */
65537 break;
65538 }
65539 - } while (atomic_cmpxchg(&sync_sched_expedited_done, s, snap) != s);
65540 + } while (atomic_cmpxchg_unchecked(&sync_sched_expedited_done, s, snap) != s);
65541
65542 put_online_cpus();
65543 }
65544 diff -urNp linux-3.0.8/kernel/relay.c linux-3.0.8/kernel/relay.c
65545 --- linux-3.0.8/kernel/relay.c 2011-07-21 22:17:23.000000000 -0400
65546 +++ linux-3.0.8/kernel/relay.c 2011-08-23 21:48:14.000000000 -0400
65547 @@ -1236,6 +1236,8 @@ static ssize_t subbuf_splice_actor(struc
65548 };
65549 ssize_t ret;
65550
65551 + pax_track_stack();
65552 +
65553 if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
65554 return 0;
65555 if (splice_grow_spd(pipe, &spd))
65556 diff -urNp linux-3.0.8/kernel/resource.c linux-3.0.8/kernel/resource.c
65557 --- linux-3.0.8/kernel/resource.c 2011-07-21 22:17:23.000000000 -0400
65558 +++ linux-3.0.8/kernel/resource.c 2011-08-23 21:48:14.000000000 -0400
65559 @@ -141,8 +141,18 @@ static const struct file_operations proc
65560
65561 static int __init ioresources_init(void)
65562 {
65563 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
65564 +#ifdef CONFIG_GRKERNSEC_PROC_USER
65565 + proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
65566 + proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
65567 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
65568 + proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
65569 + proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
65570 +#endif
65571 +#else
65572 proc_create("ioports", 0, NULL, &proc_ioports_operations);
65573 proc_create("iomem", 0, NULL, &proc_iomem_operations);
65574 +#endif
65575 return 0;
65576 }
65577 __initcall(ioresources_init);
65578 diff -urNp linux-3.0.8/kernel/rtmutex-tester.c linux-3.0.8/kernel/rtmutex-tester.c
65579 --- linux-3.0.8/kernel/rtmutex-tester.c 2011-07-21 22:17:23.000000000 -0400
65580 +++ linux-3.0.8/kernel/rtmutex-tester.c 2011-08-23 21:47:56.000000000 -0400
65581 @@ -20,7 +20,7 @@
65582 #define MAX_RT_TEST_MUTEXES 8
65583
65584 static spinlock_t rttest_lock;
65585 -static atomic_t rttest_event;
65586 +static atomic_unchecked_t rttest_event;
65587
65588 struct test_thread_data {
65589 int opcode;
65590 @@ -61,7 +61,7 @@ static int handle_op(struct test_thread_
65591
65592 case RTTEST_LOCKCONT:
65593 td->mutexes[td->opdata] = 1;
65594 - td->event = atomic_add_return(1, &rttest_event);
65595 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65596 return 0;
65597
65598 case RTTEST_RESET:
65599 @@ -74,7 +74,7 @@ static int handle_op(struct test_thread_
65600 return 0;
65601
65602 case RTTEST_RESETEVENT:
65603 - atomic_set(&rttest_event, 0);
65604 + atomic_set_unchecked(&rttest_event, 0);
65605 return 0;
65606
65607 default:
65608 @@ -91,9 +91,9 @@ static int handle_op(struct test_thread_
65609 return ret;
65610
65611 td->mutexes[id] = 1;
65612 - td->event = atomic_add_return(1, &rttest_event);
65613 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65614 rt_mutex_lock(&mutexes[id]);
65615 - td->event = atomic_add_return(1, &rttest_event);
65616 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65617 td->mutexes[id] = 4;
65618 return 0;
65619
65620 @@ -104,9 +104,9 @@ static int handle_op(struct test_thread_
65621 return ret;
65622
65623 td->mutexes[id] = 1;
65624 - td->event = atomic_add_return(1, &rttest_event);
65625 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65626 ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
65627 - td->event = atomic_add_return(1, &rttest_event);
65628 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65629 td->mutexes[id] = ret ? 0 : 4;
65630 return ret ? -EINTR : 0;
65631
65632 @@ -115,9 +115,9 @@ static int handle_op(struct test_thread_
65633 if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
65634 return ret;
65635
65636 - td->event = atomic_add_return(1, &rttest_event);
65637 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65638 rt_mutex_unlock(&mutexes[id]);
65639 - td->event = atomic_add_return(1, &rttest_event);
65640 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65641 td->mutexes[id] = 0;
65642 return 0;
65643
65644 @@ -164,7 +164,7 @@ void schedule_rt_mutex_test(struct rt_mu
65645 break;
65646
65647 td->mutexes[dat] = 2;
65648 - td->event = atomic_add_return(1, &rttest_event);
65649 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65650 break;
65651
65652 default:
65653 @@ -184,7 +184,7 @@ void schedule_rt_mutex_test(struct rt_mu
65654 return;
65655
65656 td->mutexes[dat] = 3;
65657 - td->event = atomic_add_return(1, &rttest_event);
65658 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65659 break;
65660
65661 case RTTEST_LOCKNOWAIT:
65662 @@ -196,7 +196,7 @@ void schedule_rt_mutex_test(struct rt_mu
65663 return;
65664
65665 td->mutexes[dat] = 1;
65666 - td->event = atomic_add_return(1, &rttest_event);
65667 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65668 return;
65669
65670 default:
65671 diff -urNp linux-3.0.8/kernel/sched_autogroup.c linux-3.0.8/kernel/sched_autogroup.c
65672 --- linux-3.0.8/kernel/sched_autogroup.c 2011-07-21 22:17:23.000000000 -0400
65673 +++ linux-3.0.8/kernel/sched_autogroup.c 2011-08-23 21:47:56.000000000 -0400
65674 @@ -7,7 +7,7 @@
65675
65676 unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1;
65677 static struct autogroup autogroup_default;
65678 -static atomic_t autogroup_seq_nr;
65679 +static atomic_unchecked_t autogroup_seq_nr;
65680
65681 static void __init autogroup_init(struct task_struct *init_task)
65682 {
65683 @@ -78,7 +78,7 @@ static inline struct autogroup *autogrou
65684
65685 kref_init(&ag->kref);
65686 init_rwsem(&ag->lock);
65687 - ag->id = atomic_inc_return(&autogroup_seq_nr);
65688 + ag->id = atomic_inc_return_unchecked(&autogroup_seq_nr);
65689 ag->tg = tg;
65690 #ifdef CONFIG_RT_GROUP_SCHED
65691 /*
65692 diff -urNp linux-3.0.8/kernel/sched.c linux-3.0.8/kernel/sched.c
65693 --- linux-3.0.8/kernel/sched.c 2011-10-24 08:05:32.000000000 -0400
65694 +++ linux-3.0.8/kernel/sched.c 2011-10-17 23:17:19.000000000 -0400
65695 @@ -4227,6 +4227,8 @@ static void __sched __schedule(void)
65696 struct rq *rq;
65697 int cpu;
65698
65699 + pax_track_stack();
65700 +
65701 need_resched:
65702 preempt_disable();
65703 cpu = smp_processor_id();
65704 @@ -4920,6 +4922,8 @@ int can_nice(const struct task_struct *p
65705 /* convert nice value [19,-20] to rlimit style value [1,40] */
65706 int nice_rlim = 20 - nice;
65707
65708 + gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
65709 +
65710 return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
65711 capable(CAP_SYS_NICE));
65712 }
65713 @@ -4953,7 +4957,8 @@ SYSCALL_DEFINE1(nice, int, increment)
65714 if (nice > 19)
65715 nice = 19;
65716
65717 - if (increment < 0 && !can_nice(current, nice))
65718 + if (increment < 0 && (!can_nice(current, nice) ||
65719 + gr_handle_chroot_nice()))
65720 return -EPERM;
65721
65722 retval = security_task_setnice(current, nice);
65723 @@ -5097,6 +5102,7 @@ recheck:
65724 unsigned long rlim_rtprio =
65725 task_rlimit(p, RLIMIT_RTPRIO);
65726
65727 + gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
65728 /* can't set/change the rt policy */
65729 if (policy != p->policy && !rlim_rtprio)
65730 return -EPERM;
65731 diff -urNp linux-3.0.8/kernel/sched_fair.c linux-3.0.8/kernel/sched_fair.c
65732 --- linux-3.0.8/kernel/sched_fair.c 2011-07-21 22:17:23.000000000 -0400
65733 +++ linux-3.0.8/kernel/sched_fair.c 2011-08-23 21:47:56.000000000 -0400
65734 @@ -4050,7 +4050,7 @@ static void nohz_idle_balance(int this_c
65735 * run_rebalance_domains is triggered when needed from the scheduler tick.
65736 * Also triggered for nohz idle balancing (with nohz_balancing_kick set).
65737 */
65738 -static void run_rebalance_domains(struct softirq_action *h)
65739 +static void run_rebalance_domains(void)
65740 {
65741 int this_cpu = smp_processor_id();
65742 struct rq *this_rq = cpu_rq(this_cpu);
65743 diff -urNp linux-3.0.8/kernel/signal.c linux-3.0.8/kernel/signal.c
65744 --- linux-3.0.8/kernel/signal.c 2011-07-21 22:17:23.000000000 -0400
65745 +++ linux-3.0.8/kernel/signal.c 2011-08-23 21:48:14.000000000 -0400
65746 @@ -45,12 +45,12 @@ static struct kmem_cache *sigqueue_cache
65747
65748 int print_fatal_signals __read_mostly;
65749
65750 -static void __user *sig_handler(struct task_struct *t, int sig)
65751 +static __sighandler_t sig_handler(struct task_struct *t, int sig)
65752 {
65753 return t->sighand->action[sig - 1].sa.sa_handler;
65754 }
65755
65756 -static int sig_handler_ignored(void __user *handler, int sig)
65757 +static int sig_handler_ignored(__sighandler_t handler, int sig)
65758 {
65759 /* Is it explicitly or implicitly ignored? */
65760 return handler == SIG_IGN ||
65761 @@ -60,7 +60,7 @@ static int sig_handler_ignored(void __us
65762 static int sig_task_ignored(struct task_struct *t, int sig,
65763 int from_ancestor_ns)
65764 {
65765 - void __user *handler;
65766 + __sighandler_t handler;
65767
65768 handler = sig_handler(t, sig);
65769
65770 @@ -320,6 +320,9 @@ __sigqueue_alloc(int sig, struct task_st
65771 atomic_inc(&user->sigpending);
65772 rcu_read_unlock();
65773
65774 + if (!override_rlimit)
65775 + gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
65776 +
65777 if (override_rlimit ||
65778 atomic_read(&user->sigpending) <=
65779 task_rlimit(t, RLIMIT_SIGPENDING)) {
65780 @@ -444,7 +447,7 @@ flush_signal_handlers(struct task_struct
65781
65782 int unhandled_signal(struct task_struct *tsk, int sig)
65783 {
65784 - void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
65785 + __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
65786 if (is_global_init(tsk))
65787 return 1;
65788 if (handler != SIG_IGN && handler != SIG_DFL)
65789 @@ -770,6 +773,13 @@ static int check_kill_permission(int sig
65790 }
65791 }
65792
65793 + /* allow glibc communication via tgkill to other threads in our
65794 + thread group */
65795 + if ((info == SEND_SIG_NOINFO || info->si_code != SI_TKILL ||
65796 + sig != (SIGRTMIN+1) || task_tgid_vnr(t) != info->si_pid)
65797 + && gr_handle_signal(t, sig))
65798 + return -EPERM;
65799 +
65800 return security_task_kill(t, info, sig, 0);
65801 }
65802
65803 @@ -1092,7 +1102,7 @@ __group_send_sig_info(int sig, struct si
65804 return send_signal(sig, info, p, 1);
65805 }
65806
65807 -static int
65808 +int
65809 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
65810 {
65811 return send_signal(sig, info, t, 0);
65812 @@ -1129,6 +1139,7 @@ force_sig_info(int sig, struct siginfo *
65813 unsigned long int flags;
65814 int ret, blocked, ignored;
65815 struct k_sigaction *action;
65816 + int is_unhandled = 0;
65817
65818 spin_lock_irqsave(&t->sighand->siglock, flags);
65819 action = &t->sighand->action[sig-1];
65820 @@ -1143,9 +1154,18 @@ force_sig_info(int sig, struct siginfo *
65821 }
65822 if (action->sa.sa_handler == SIG_DFL)
65823 t->signal->flags &= ~SIGNAL_UNKILLABLE;
65824 + if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
65825 + is_unhandled = 1;
65826 ret = specific_send_sig_info(sig, info, t);
65827 spin_unlock_irqrestore(&t->sighand->siglock, flags);
65828
65829 + /* only deal with unhandled signals, java etc trigger SIGSEGV during
65830 + normal operation */
65831 + if (is_unhandled) {
65832 + gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
65833 + gr_handle_crash(t, sig);
65834 + }
65835 +
65836 return ret;
65837 }
65838
65839 @@ -1212,8 +1232,11 @@ int group_send_sig_info(int sig, struct
65840 ret = check_kill_permission(sig, info, p);
65841 rcu_read_unlock();
65842
65843 - if (!ret && sig)
65844 + if (!ret && sig) {
65845 ret = do_send_sig_info(sig, info, p, true);
65846 + if (!ret)
65847 + gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
65848 + }
65849
65850 return ret;
65851 }
65852 @@ -1839,6 +1862,8 @@ void ptrace_notify(int exit_code)
65853 {
65854 siginfo_t info;
65855
65856 + pax_track_stack();
65857 +
65858 BUG_ON((exit_code & (0x7f | ~0xffff)) != SIGTRAP);
65859
65860 memset(&info, 0, sizeof info);
65861 @@ -2639,7 +2664,15 @@ do_send_specific(pid_t tgid, pid_t pid,
65862 int error = -ESRCH;
65863
65864 rcu_read_lock();
65865 - p = find_task_by_vpid(pid);
65866 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
65867 + /* allow glibc communication via tgkill to other threads in our
65868 + thread group */
65869 + if (grsec_enable_chroot_findtask && info->si_code == SI_TKILL &&
65870 + sig == (SIGRTMIN+1) && tgid == info->si_pid)
65871 + p = find_task_by_vpid_unrestricted(pid);
65872 + else
65873 +#endif
65874 + p = find_task_by_vpid(pid);
65875 if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
65876 error = check_kill_permission(sig, info, p);
65877 /*
65878 diff -urNp linux-3.0.8/kernel/smp.c linux-3.0.8/kernel/smp.c
65879 --- linux-3.0.8/kernel/smp.c 2011-07-21 22:17:23.000000000 -0400
65880 +++ linux-3.0.8/kernel/smp.c 2011-08-23 21:47:56.000000000 -0400
65881 @@ -580,22 +580,22 @@ int smp_call_function(smp_call_func_t fu
65882 }
65883 EXPORT_SYMBOL(smp_call_function);
65884
65885 -void ipi_call_lock(void)
65886 +void ipi_call_lock(void) __acquires(call_function.lock)
65887 {
65888 raw_spin_lock(&call_function.lock);
65889 }
65890
65891 -void ipi_call_unlock(void)
65892 +void ipi_call_unlock(void) __releases(call_function.lock)
65893 {
65894 raw_spin_unlock(&call_function.lock);
65895 }
65896
65897 -void ipi_call_lock_irq(void)
65898 +void ipi_call_lock_irq(void) __acquires(call_function.lock)
65899 {
65900 raw_spin_lock_irq(&call_function.lock);
65901 }
65902
65903 -void ipi_call_unlock_irq(void)
65904 +void ipi_call_unlock_irq(void) __releases(call_function.lock)
65905 {
65906 raw_spin_unlock_irq(&call_function.lock);
65907 }
65908 diff -urNp linux-3.0.8/kernel/softirq.c linux-3.0.8/kernel/softirq.c
65909 --- linux-3.0.8/kernel/softirq.c 2011-07-21 22:17:23.000000000 -0400
65910 +++ linux-3.0.8/kernel/softirq.c 2011-08-23 21:47:56.000000000 -0400
65911 @@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
65912
65913 DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
65914
65915 -char *softirq_to_name[NR_SOFTIRQS] = {
65916 +const char * const softirq_to_name[NR_SOFTIRQS] = {
65917 "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
65918 "TASKLET", "SCHED", "HRTIMER", "RCU"
65919 };
65920 @@ -235,7 +235,7 @@ restart:
65921 kstat_incr_softirqs_this_cpu(vec_nr);
65922
65923 trace_softirq_entry(vec_nr);
65924 - h->action(h);
65925 + h->action();
65926 trace_softirq_exit(vec_nr);
65927 if (unlikely(prev_count != preempt_count())) {
65928 printk(KERN_ERR "huh, entered softirq %u %s %p"
65929 @@ -385,9 +385,11 @@ void raise_softirq(unsigned int nr)
65930 local_irq_restore(flags);
65931 }
65932
65933 -void open_softirq(int nr, void (*action)(struct softirq_action *))
65934 +void open_softirq(int nr, void (*action)(void))
65935 {
65936 - softirq_vec[nr].action = action;
65937 + pax_open_kernel();
65938 + *(void **)&softirq_vec[nr].action = action;
65939 + pax_close_kernel();
65940 }
65941
65942 /*
65943 @@ -441,7 +443,7 @@ void __tasklet_hi_schedule_first(struct
65944
65945 EXPORT_SYMBOL(__tasklet_hi_schedule_first);
65946
65947 -static void tasklet_action(struct softirq_action *a)
65948 +static void tasklet_action(void)
65949 {
65950 struct tasklet_struct *list;
65951
65952 @@ -476,7 +478,7 @@ static void tasklet_action(struct softir
65953 }
65954 }
65955
65956 -static void tasklet_hi_action(struct softirq_action *a)
65957 +static void tasklet_hi_action(void)
65958 {
65959 struct tasklet_struct *list;
65960
65961 diff -urNp linux-3.0.8/kernel/sys.c linux-3.0.8/kernel/sys.c
65962 --- linux-3.0.8/kernel/sys.c 2011-10-25 09:10:33.000000000 -0400
65963 +++ linux-3.0.8/kernel/sys.c 2011-10-25 09:10:41.000000000 -0400
65964 @@ -158,6 +158,12 @@ static int set_one_prio(struct task_stru
65965 error = -EACCES;
65966 goto out;
65967 }
65968 +
65969 + if (gr_handle_chroot_setpriority(p, niceval)) {
65970 + error = -EACCES;
65971 + goto out;
65972 + }
65973 +
65974 no_nice = security_task_setnice(p, niceval);
65975 if (no_nice) {
65976 error = no_nice;
65977 @@ -541,6 +547,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
65978 goto error;
65979 }
65980
65981 + if (gr_check_group_change(new->gid, new->egid, -1))
65982 + goto error;
65983 +
65984 if (rgid != (gid_t) -1 ||
65985 (egid != (gid_t) -1 && egid != old->gid))
65986 new->sgid = new->egid;
65987 @@ -570,6 +579,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
65988 old = current_cred();
65989
65990 retval = -EPERM;
65991 +
65992 + if (gr_check_group_change(gid, gid, gid))
65993 + goto error;
65994 +
65995 if (nsown_capable(CAP_SETGID))
65996 new->gid = new->egid = new->sgid = new->fsgid = gid;
65997 else if (gid == old->gid || gid == old->sgid)
65998 @@ -595,11 +608,18 @@ static int set_user(struct cred *new)
65999 if (!new_user)
66000 return -EAGAIN;
66001
66002 + /*
66003 + * We don't fail in case of NPROC limit excess here because too many
66004 + * poorly written programs don't check set*uid() return code, assuming
66005 + * it never fails if called by root. We may still enforce NPROC limit
66006 + * for programs doing set*uid()+execve() by harmlessly deferring the
66007 + * failure to the execve() stage.
66008 + */
66009 if (atomic_read(&new_user->processes) >= rlimit(RLIMIT_NPROC) &&
66010 - new_user != INIT_USER) {
66011 - free_uid(new_user);
66012 - return -EAGAIN;
66013 - }
66014 + new_user != INIT_USER)
66015 + current->flags |= PF_NPROC_EXCEEDED;
66016 + else
66017 + current->flags &= ~PF_NPROC_EXCEEDED;
66018
66019 free_uid(new->user);
66020 new->user = new_user;
66021 @@ -650,6 +670,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
66022 goto error;
66023 }
66024
66025 + if (gr_check_user_change(new->uid, new->euid, -1))
66026 + goto error;
66027 +
66028 if (new->uid != old->uid) {
66029 retval = set_user(new);
66030 if (retval < 0)
66031 @@ -694,6 +717,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
66032 old = current_cred();
66033
66034 retval = -EPERM;
66035 +
66036 + if (gr_check_crash_uid(uid))
66037 + goto error;
66038 + if (gr_check_user_change(uid, uid, uid))
66039 + goto error;
66040 +
66041 if (nsown_capable(CAP_SETUID)) {
66042 new->suid = new->uid = uid;
66043 if (uid != old->uid) {
66044 @@ -748,6 +777,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid,
66045 goto error;
66046 }
66047
66048 + if (gr_check_user_change(ruid, euid, -1))
66049 + goto error;
66050 +
66051 if (ruid != (uid_t) -1) {
66052 new->uid = ruid;
66053 if (ruid != old->uid) {
66054 @@ -812,6 +844,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid,
66055 goto error;
66056 }
66057
66058 + if (gr_check_group_change(rgid, egid, -1))
66059 + goto error;
66060 +
66061 if (rgid != (gid_t) -1)
66062 new->gid = rgid;
66063 if (egid != (gid_t) -1)
66064 @@ -858,6 +893,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
66065 old = current_cred();
66066 old_fsuid = old->fsuid;
66067
66068 + if (gr_check_user_change(-1, -1, uid))
66069 + goto error;
66070 +
66071 if (uid == old->uid || uid == old->euid ||
66072 uid == old->suid || uid == old->fsuid ||
66073 nsown_capable(CAP_SETUID)) {
66074 @@ -868,6 +906,7 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
66075 }
66076 }
66077
66078 +error:
66079 abort_creds(new);
66080 return old_fsuid;
66081
66082 @@ -894,12 +933,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
66083 if (gid == old->gid || gid == old->egid ||
66084 gid == old->sgid || gid == old->fsgid ||
66085 nsown_capable(CAP_SETGID)) {
66086 + if (gr_check_group_change(-1, -1, gid))
66087 + goto error;
66088 +
66089 if (gid != old_fsgid) {
66090 new->fsgid = gid;
66091 goto change_okay;
66092 }
66093 }
66094
66095 +error:
66096 abort_creds(new);
66097 return old_fsgid;
66098
66099 @@ -1205,19 +1248,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_
66100 return -EFAULT;
66101
66102 down_read(&uts_sem);
66103 - error = __copy_to_user(&name->sysname, &utsname()->sysname,
66104 + error = __copy_to_user(name->sysname, &utsname()->sysname,
66105 __OLD_UTS_LEN);
66106 error |= __put_user(0, name->sysname + __OLD_UTS_LEN);
66107 - error |= __copy_to_user(&name->nodename, &utsname()->nodename,
66108 + error |= __copy_to_user(name->nodename, &utsname()->nodename,
66109 __OLD_UTS_LEN);
66110 error |= __put_user(0, name->nodename + __OLD_UTS_LEN);
66111 - error |= __copy_to_user(&name->release, &utsname()->release,
66112 + error |= __copy_to_user(name->release, &utsname()->release,
66113 __OLD_UTS_LEN);
66114 error |= __put_user(0, name->release + __OLD_UTS_LEN);
66115 - error |= __copy_to_user(&name->version, &utsname()->version,
66116 + error |= __copy_to_user(name->version, &utsname()->version,
66117 __OLD_UTS_LEN);
66118 error |= __put_user(0, name->version + __OLD_UTS_LEN);
66119 - error |= __copy_to_user(&name->machine, &utsname()->machine,
66120 + error |= __copy_to_user(name->machine, &utsname()->machine,
66121 __OLD_UTS_LEN);
66122 error |= __put_user(0, name->machine + __OLD_UTS_LEN);
66123 up_read(&uts_sem);
66124 @@ -1680,7 +1723,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
66125 error = get_dumpable(me->mm);
66126 break;
66127 case PR_SET_DUMPABLE:
66128 - if (arg2 < 0 || arg2 > 1) {
66129 + if (arg2 > 1) {
66130 error = -EINVAL;
66131 break;
66132 }
66133 diff -urNp linux-3.0.8/kernel/sysctl_binary.c linux-3.0.8/kernel/sysctl_binary.c
66134 --- linux-3.0.8/kernel/sysctl_binary.c 2011-07-21 22:17:23.000000000 -0400
66135 +++ linux-3.0.8/kernel/sysctl_binary.c 2011-10-06 04:17:55.000000000 -0400
66136 @@ -989,7 +989,7 @@ static ssize_t bin_intvec(struct file *f
66137 int i;
66138
66139 set_fs(KERNEL_DS);
66140 - result = vfs_read(file, buffer, BUFSZ - 1, &pos);
66141 + result = vfs_read(file, (char __force_user *)buffer, BUFSZ - 1, &pos);
66142 set_fs(old_fs);
66143 if (result < 0)
66144 goto out_kfree;
66145 @@ -1034,7 +1034,7 @@ static ssize_t bin_intvec(struct file *f
66146 }
66147
66148 set_fs(KERNEL_DS);
66149 - result = vfs_write(file, buffer, str - buffer, &pos);
66150 + result = vfs_write(file, (const char __force_user *)buffer, str - buffer, &pos);
66151 set_fs(old_fs);
66152 if (result < 0)
66153 goto out_kfree;
66154 @@ -1067,7 +1067,7 @@ static ssize_t bin_ulongvec(struct file
66155 int i;
66156
66157 set_fs(KERNEL_DS);
66158 - result = vfs_read(file, buffer, BUFSZ - 1, &pos);
66159 + result = vfs_read(file, (char __force_user *)buffer, BUFSZ - 1, &pos);
66160 set_fs(old_fs);
66161 if (result < 0)
66162 goto out_kfree;
66163 @@ -1112,7 +1112,7 @@ static ssize_t bin_ulongvec(struct file
66164 }
66165
66166 set_fs(KERNEL_DS);
66167 - result = vfs_write(file, buffer, str - buffer, &pos);
66168 + result = vfs_write(file, (const char __force_user *)buffer, str - buffer, &pos);
66169 set_fs(old_fs);
66170 if (result < 0)
66171 goto out_kfree;
66172 @@ -1138,7 +1138,7 @@ static ssize_t bin_uuid(struct file *fil
66173 int i;
66174
66175 set_fs(KERNEL_DS);
66176 - result = vfs_read(file, buf, sizeof(buf) - 1, &pos);
66177 + result = vfs_read(file, (char __force_user *)buf, sizeof(buf) - 1, &pos);
66178 set_fs(old_fs);
66179 if (result < 0)
66180 goto out;
66181 @@ -1185,7 +1185,7 @@ static ssize_t bin_dn_node_address(struc
66182 __le16 dnaddr;
66183
66184 set_fs(KERNEL_DS);
66185 - result = vfs_read(file, buf, sizeof(buf) - 1, &pos);
66186 + result = vfs_read(file, (char __force_user *)buf, sizeof(buf) - 1, &pos);
66187 set_fs(old_fs);
66188 if (result < 0)
66189 goto out;
66190 @@ -1233,7 +1233,7 @@ static ssize_t bin_dn_node_address(struc
66191 le16_to_cpu(dnaddr) & 0x3ff);
66192
66193 set_fs(KERNEL_DS);
66194 - result = vfs_write(file, buf, len, &pos);
66195 + result = vfs_write(file, (const char __force_user *)buf, len, &pos);
66196 set_fs(old_fs);
66197 if (result < 0)
66198 goto out;
66199 diff -urNp linux-3.0.8/kernel/sysctl.c linux-3.0.8/kernel/sysctl.c
66200 --- linux-3.0.8/kernel/sysctl.c 2011-07-21 22:17:23.000000000 -0400
66201 +++ linux-3.0.8/kernel/sysctl.c 2011-08-23 21:48:14.000000000 -0400
66202 @@ -85,6 +85,13 @@
66203
66204
66205 #if defined(CONFIG_SYSCTL)
66206 +#include <linux/grsecurity.h>
66207 +#include <linux/grinternal.h>
66208 +
66209 +extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
66210 +extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
66211 + const int op);
66212 +extern int gr_handle_chroot_sysctl(const int op);
66213
66214 /* External variables not in a header file. */
66215 extern int sysctl_overcommit_memory;
66216 @@ -197,6 +204,7 @@ static int sysrq_sysctl_handler(ctl_tabl
66217 }
66218
66219 #endif
66220 +extern struct ctl_table grsecurity_table[];
66221
66222 static struct ctl_table root_table[];
66223 static struct ctl_table_root sysctl_table_root;
66224 @@ -226,6 +234,20 @@ extern struct ctl_table epoll_table[];
66225 int sysctl_legacy_va_layout;
66226 #endif
66227
66228 +#ifdef CONFIG_PAX_SOFTMODE
66229 +static ctl_table pax_table[] = {
66230 + {
66231 + .procname = "softmode",
66232 + .data = &pax_softmode,
66233 + .maxlen = sizeof(unsigned int),
66234 + .mode = 0600,
66235 + .proc_handler = &proc_dointvec,
66236 + },
66237 +
66238 + { }
66239 +};
66240 +#endif
66241 +
66242 /* The default sysctl tables: */
66243
66244 static struct ctl_table root_table[] = {
66245 @@ -272,6 +294,22 @@ static int max_extfrag_threshold = 1000;
66246 #endif
66247
66248 static struct ctl_table kern_table[] = {
66249 +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
66250 + {
66251 + .procname = "grsecurity",
66252 + .mode = 0500,
66253 + .child = grsecurity_table,
66254 + },
66255 +#endif
66256 +
66257 +#ifdef CONFIG_PAX_SOFTMODE
66258 + {
66259 + .procname = "pax",
66260 + .mode = 0500,
66261 + .child = pax_table,
66262 + },
66263 +#endif
66264 +
66265 {
66266 .procname = "sched_child_runs_first",
66267 .data = &sysctl_sched_child_runs_first,
66268 @@ -546,7 +584,7 @@ static struct ctl_table kern_table[] = {
66269 .data = &modprobe_path,
66270 .maxlen = KMOD_PATH_LEN,
66271 .mode = 0644,
66272 - .proc_handler = proc_dostring,
66273 + .proc_handler = proc_dostring_modpriv,
66274 },
66275 {
66276 .procname = "modules_disabled",
66277 @@ -713,16 +751,20 @@ static struct ctl_table kern_table[] = {
66278 .extra1 = &zero,
66279 .extra2 = &one,
66280 },
66281 +#endif
66282 {
66283 .procname = "kptr_restrict",
66284 .data = &kptr_restrict,
66285 .maxlen = sizeof(int),
66286 .mode = 0644,
66287 .proc_handler = proc_dmesg_restrict,
66288 +#ifdef CONFIG_GRKERNSEC_HIDESYM
66289 + .extra1 = &two,
66290 +#else
66291 .extra1 = &zero,
66292 +#endif
66293 .extra2 = &two,
66294 },
66295 -#endif
66296 {
66297 .procname = "ngroups_max",
66298 .data = &ngroups_max,
66299 @@ -1205,6 +1247,13 @@ static struct ctl_table vm_table[] = {
66300 .proc_handler = proc_dointvec_minmax,
66301 .extra1 = &zero,
66302 },
66303 + {
66304 + .procname = "heap_stack_gap",
66305 + .data = &sysctl_heap_stack_gap,
66306 + .maxlen = sizeof(sysctl_heap_stack_gap),
66307 + .mode = 0644,
66308 + .proc_handler = proc_doulongvec_minmax,
66309 + },
66310 #else
66311 {
66312 .procname = "nr_trim_pages",
66313 @@ -1714,6 +1763,17 @@ static int test_perm(int mode, int op)
66314 int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
66315 {
66316 int mode;
66317 + int error;
66318 +
66319 + if (table->parent != NULL && table->parent->procname != NULL &&
66320 + table->procname != NULL &&
66321 + gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
66322 + return -EACCES;
66323 + if (gr_handle_chroot_sysctl(op))
66324 + return -EACCES;
66325 + error = gr_handle_sysctl(table, op);
66326 + if (error)
66327 + return error;
66328
66329 if (root->permissions)
66330 mode = root->permissions(root, current->nsproxy, table);
66331 @@ -2118,6 +2178,16 @@ int proc_dostring(struct ctl_table *tabl
66332 buffer, lenp, ppos);
66333 }
66334
66335 +int proc_dostring_modpriv(struct ctl_table *table, int write,
66336 + void __user *buffer, size_t *lenp, loff_t *ppos)
66337 +{
66338 + if (write && !capable(CAP_SYS_MODULE))
66339 + return -EPERM;
66340 +
66341 + return _proc_do_string(table->data, table->maxlen, write,
66342 + buffer, lenp, ppos);
66343 +}
66344 +
66345 static size_t proc_skip_spaces(char **buf)
66346 {
66347 size_t ret;
66348 @@ -2223,6 +2293,8 @@ static int proc_put_long(void __user **b
66349 len = strlen(tmp);
66350 if (len > *size)
66351 len = *size;
66352 + if (len > sizeof(tmp))
66353 + len = sizeof(tmp);
66354 if (copy_to_user(*buf, tmp, len))
66355 return -EFAULT;
66356 *size -= len;
66357 @@ -2539,8 +2611,11 @@ static int __do_proc_doulongvec_minmax(v
66358 *i = val;
66359 } else {
66360 val = convdiv * (*i) / convmul;
66361 - if (!first)
66362 + if (!first) {
66363 err = proc_put_char(&buffer, &left, '\t');
66364 + if (err)
66365 + break;
66366 + }
66367 err = proc_put_long(&buffer, &left, val, false);
66368 if (err)
66369 break;
66370 @@ -2935,6 +3010,12 @@ int proc_dostring(struct ctl_table *tabl
66371 return -ENOSYS;
66372 }
66373
66374 +int proc_dostring_modpriv(struct ctl_table *table, int write,
66375 + void __user *buffer, size_t *lenp, loff_t *ppos)
66376 +{
66377 + return -ENOSYS;
66378 +}
66379 +
66380 int proc_dointvec(struct ctl_table *table, int write,
66381 void __user *buffer, size_t *lenp, loff_t *ppos)
66382 {
66383 @@ -2991,6 +3072,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
66384 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
66385 EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
66386 EXPORT_SYMBOL(proc_dostring);
66387 +EXPORT_SYMBOL(proc_dostring_modpriv);
66388 EXPORT_SYMBOL(proc_doulongvec_minmax);
66389 EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
66390 EXPORT_SYMBOL(register_sysctl_table);
66391 diff -urNp linux-3.0.8/kernel/sysctl_check.c linux-3.0.8/kernel/sysctl_check.c
66392 --- linux-3.0.8/kernel/sysctl_check.c 2011-07-21 22:17:23.000000000 -0400
66393 +++ linux-3.0.8/kernel/sysctl_check.c 2011-08-23 21:48:14.000000000 -0400
66394 @@ -129,6 +129,7 @@ int sysctl_check_table(struct nsproxy *n
66395 set_fail(&fail, table, "Directory with extra2");
66396 } else {
66397 if ((table->proc_handler == proc_dostring) ||
66398 + (table->proc_handler == proc_dostring_modpriv) ||
66399 (table->proc_handler == proc_dointvec) ||
66400 (table->proc_handler == proc_dointvec_minmax) ||
66401 (table->proc_handler == proc_dointvec_jiffies) ||
66402 diff -urNp linux-3.0.8/kernel/taskstats.c linux-3.0.8/kernel/taskstats.c
66403 --- linux-3.0.8/kernel/taskstats.c 2011-07-21 22:17:23.000000000 -0400
66404 +++ linux-3.0.8/kernel/taskstats.c 2011-08-23 21:48:14.000000000 -0400
66405 @@ -27,9 +27,12 @@
66406 #include <linux/cgroup.h>
66407 #include <linux/fs.h>
66408 #include <linux/file.h>
66409 +#include <linux/grsecurity.h>
66410 #include <net/genetlink.h>
66411 #include <asm/atomic.h>
66412
66413 +extern int gr_is_taskstats_denied(int pid);
66414 +
66415 /*
66416 * Maximum length of a cpumask that can be specified in
66417 * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
66418 @@ -558,6 +561,9 @@ err:
66419
66420 static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
66421 {
66422 + if (gr_is_taskstats_denied(current->pid))
66423 + return -EACCES;
66424 +
66425 if (info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK])
66426 return cmd_attr_register_cpumask(info);
66427 else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK])
66428 diff -urNp linux-3.0.8/kernel/time/alarmtimer.c linux-3.0.8/kernel/time/alarmtimer.c
66429 --- linux-3.0.8/kernel/time/alarmtimer.c 2011-10-24 08:05:30.000000000 -0400
66430 +++ linux-3.0.8/kernel/time/alarmtimer.c 2011-10-16 21:55:28.000000000 -0400
66431 @@ -693,7 +693,7 @@ static int __init alarmtimer_init(void)
66432 {
66433 int error = 0;
66434 int i;
66435 - struct k_clock alarm_clock = {
66436 + static struct k_clock alarm_clock = {
66437 .clock_getres = alarm_clock_getres,
66438 .clock_get = alarm_clock_get,
66439 .timer_create = alarm_timer_create,
66440 diff -urNp linux-3.0.8/kernel/time/tick-broadcast.c linux-3.0.8/kernel/time/tick-broadcast.c
66441 --- linux-3.0.8/kernel/time/tick-broadcast.c 2011-07-21 22:17:23.000000000 -0400
66442 +++ linux-3.0.8/kernel/time/tick-broadcast.c 2011-08-23 21:47:56.000000000 -0400
66443 @@ -115,7 +115,7 @@ int tick_device_uses_broadcast(struct cl
66444 * then clear the broadcast bit.
66445 */
66446 if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
66447 - int cpu = smp_processor_id();
66448 + cpu = smp_processor_id();
66449
66450 cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
66451 tick_broadcast_clear_oneshot(cpu);
66452 diff -urNp linux-3.0.8/kernel/time/timekeeping.c linux-3.0.8/kernel/time/timekeeping.c
66453 --- linux-3.0.8/kernel/time/timekeeping.c 2011-07-21 22:17:23.000000000 -0400
66454 +++ linux-3.0.8/kernel/time/timekeeping.c 2011-08-23 21:48:14.000000000 -0400
66455 @@ -14,6 +14,7 @@
66456 #include <linux/init.h>
66457 #include <linux/mm.h>
66458 #include <linux/sched.h>
66459 +#include <linux/grsecurity.h>
66460 #include <linux/syscore_ops.h>
66461 #include <linux/clocksource.h>
66462 #include <linux/jiffies.h>
66463 @@ -361,6 +362,8 @@ int do_settimeofday(const struct timespe
66464 if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
66465 return -EINVAL;
66466
66467 + gr_log_timechange();
66468 +
66469 write_seqlock_irqsave(&xtime_lock, flags);
66470
66471 timekeeping_forward_now();
66472 diff -urNp linux-3.0.8/kernel/time/timer_list.c linux-3.0.8/kernel/time/timer_list.c
66473 --- linux-3.0.8/kernel/time/timer_list.c 2011-07-21 22:17:23.000000000 -0400
66474 +++ linux-3.0.8/kernel/time/timer_list.c 2011-08-23 21:48:14.000000000 -0400
66475 @@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base,
66476
66477 static void print_name_offset(struct seq_file *m, void *sym)
66478 {
66479 +#ifdef CONFIG_GRKERNSEC_HIDESYM
66480 + SEQ_printf(m, "<%p>", NULL);
66481 +#else
66482 char symname[KSYM_NAME_LEN];
66483
66484 if (lookup_symbol_name((unsigned long)sym, symname) < 0)
66485 SEQ_printf(m, "<%pK>", sym);
66486 else
66487 SEQ_printf(m, "%s", symname);
66488 +#endif
66489 }
66490
66491 static void
66492 @@ -112,7 +116,11 @@ next_one:
66493 static void
66494 print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
66495 {
66496 +#ifdef CONFIG_GRKERNSEC_HIDESYM
66497 + SEQ_printf(m, " .base: %p\n", NULL);
66498 +#else
66499 SEQ_printf(m, " .base: %pK\n", base);
66500 +#endif
66501 SEQ_printf(m, " .index: %d\n",
66502 base->index);
66503 SEQ_printf(m, " .resolution: %Lu nsecs\n",
66504 @@ -293,7 +301,11 @@ static int __init init_timer_list_procfs
66505 {
66506 struct proc_dir_entry *pe;
66507
66508 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
66509 + pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
66510 +#else
66511 pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
66512 +#endif
66513 if (!pe)
66514 return -ENOMEM;
66515 return 0;
66516 diff -urNp linux-3.0.8/kernel/time/timer_stats.c linux-3.0.8/kernel/time/timer_stats.c
66517 --- linux-3.0.8/kernel/time/timer_stats.c 2011-07-21 22:17:23.000000000 -0400
66518 +++ linux-3.0.8/kernel/time/timer_stats.c 2011-08-23 21:48:14.000000000 -0400
66519 @@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
66520 static unsigned long nr_entries;
66521 static struct entry entries[MAX_ENTRIES];
66522
66523 -static atomic_t overflow_count;
66524 +static atomic_unchecked_t overflow_count;
66525
66526 /*
66527 * The entries are in a hash-table, for fast lookup:
66528 @@ -140,7 +140,7 @@ static void reset_entries(void)
66529 nr_entries = 0;
66530 memset(entries, 0, sizeof(entries));
66531 memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
66532 - atomic_set(&overflow_count, 0);
66533 + atomic_set_unchecked(&overflow_count, 0);
66534 }
66535
66536 static struct entry *alloc_entry(void)
66537 @@ -261,7 +261,7 @@ void timer_stats_update_stats(void *time
66538 if (likely(entry))
66539 entry->count++;
66540 else
66541 - atomic_inc(&overflow_count);
66542 + atomic_inc_unchecked(&overflow_count);
66543
66544 out_unlock:
66545 raw_spin_unlock_irqrestore(lock, flags);
66546 @@ -269,12 +269,16 @@ void timer_stats_update_stats(void *time
66547
66548 static void print_name_offset(struct seq_file *m, unsigned long addr)
66549 {
66550 +#ifdef CONFIG_GRKERNSEC_HIDESYM
66551 + seq_printf(m, "<%p>", NULL);
66552 +#else
66553 char symname[KSYM_NAME_LEN];
66554
66555 if (lookup_symbol_name(addr, symname) < 0)
66556 seq_printf(m, "<%p>", (void *)addr);
66557 else
66558 seq_printf(m, "%s", symname);
66559 +#endif
66560 }
66561
66562 static int tstats_show(struct seq_file *m, void *v)
66563 @@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *
66564
66565 seq_puts(m, "Timer Stats Version: v0.2\n");
66566 seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
66567 - if (atomic_read(&overflow_count))
66568 + if (atomic_read_unchecked(&overflow_count))
66569 seq_printf(m, "Overflow: %d entries\n",
66570 - atomic_read(&overflow_count));
66571 + atomic_read_unchecked(&overflow_count));
66572
66573 for (i = 0; i < nr_entries; i++) {
66574 entry = entries + i;
66575 @@ -417,7 +421,11 @@ static int __init init_tstats_procfs(voi
66576 {
66577 struct proc_dir_entry *pe;
66578
66579 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
66580 + pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
66581 +#else
66582 pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
66583 +#endif
66584 if (!pe)
66585 return -ENOMEM;
66586 return 0;
66587 diff -urNp linux-3.0.8/kernel/time.c linux-3.0.8/kernel/time.c
66588 --- linux-3.0.8/kernel/time.c 2011-07-21 22:17:23.000000000 -0400
66589 +++ linux-3.0.8/kernel/time.c 2011-08-23 21:48:14.000000000 -0400
66590 @@ -163,6 +163,11 @@ int do_sys_settimeofday(const struct tim
66591 return error;
66592
66593 if (tz) {
66594 + /* we log in do_settimeofday called below, so don't log twice
66595 + */
66596 + if (!tv)
66597 + gr_log_timechange();
66598 +
66599 /* SMP safe, global irq locking makes it work. */
66600 sys_tz = *tz;
66601 update_vsyscall_tz();
66602 diff -urNp linux-3.0.8/kernel/timer.c linux-3.0.8/kernel/timer.c
66603 --- linux-3.0.8/kernel/timer.c 2011-07-21 22:17:23.000000000 -0400
66604 +++ linux-3.0.8/kernel/timer.c 2011-08-23 21:47:56.000000000 -0400
66605 @@ -1304,7 +1304,7 @@ void update_process_times(int user_tick)
66606 /*
66607 * This function runs timers and the timer-tq in bottom half context.
66608 */
66609 -static void run_timer_softirq(struct softirq_action *h)
66610 +static void run_timer_softirq(void)
66611 {
66612 struct tvec_base *base = __this_cpu_read(tvec_bases);
66613
66614 diff -urNp linux-3.0.8/kernel/trace/blktrace.c linux-3.0.8/kernel/trace/blktrace.c
66615 --- linux-3.0.8/kernel/trace/blktrace.c 2011-07-21 22:17:23.000000000 -0400
66616 +++ linux-3.0.8/kernel/trace/blktrace.c 2011-08-23 21:47:56.000000000 -0400
66617 @@ -321,7 +321,7 @@ static ssize_t blk_dropped_read(struct f
66618 struct blk_trace *bt = filp->private_data;
66619 char buf[16];
66620
66621 - snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
66622 + snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
66623
66624 return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
66625 }
66626 @@ -386,7 +386,7 @@ static int blk_subbuf_start_callback(str
66627 return 1;
66628
66629 bt = buf->chan->private_data;
66630 - atomic_inc(&bt->dropped);
66631 + atomic_inc_unchecked(&bt->dropped);
66632 return 0;
66633 }
66634
66635 @@ -487,7 +487,7 @@ int do_blk_trace_setup(struct request_qu
66636
66637 bt->dir = dir;
66638 bt->dev = dev;
66639 - atomic_set(&bt->dropped, 0);
66640 + atomic_set_unchecked(&bt->dropped, 0);
66641
66642 ret = -EIO;
66643 bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
66644 diff -urNp linux-3.0.8/kernel/trace/ftrace.c linux-3.0.8/kernel/trace/ftrace.c
66645 --- linux-3.0.8/kernel/trace/ftrace.c 2011-10-24 08:05:32.000000000 -0400
66646 +++ linux-3.0.8/kernel/trace/ftrace.c 2011-10-17 23:17:19.000000000 -0400
66647 @@ -1566,12 +1566,17 @@ ftrace_code_disable(struct module *mod,
66648 if (unlikely(ftrace_disabled))
66649 return 0;
66650
66651 + ret = ftrace_arch_code_modify_prepare();
66652 + FTRACE_WARN_ON(ret);
66653 + if (ret)
66654 + return 0;
66655 +
66656 ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
66657 + FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
66658 if (ret) {
66659 ftrace_bug(ret, ip);
66660 - return 0;
66661 }
66662 - return 1;
66663 + return ret ? 0 : 1;
66664 }
66665
66666 /*
66667 @@ -2570,7 +2575,7 @@ static void ftrace_free_entry_rcu(struct
66668
66669 int
66670 register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
66671 - void *data)
66672 + void *data)
66673 {
66674 struct ftrace_func_probe *entry;
66675 struct ftrace_page *pg;
66676 diff -urNp linux-3.0.8/kernel/trace/trace.c linux-3.0.8/kernel/trace/trace.c
66677 --- linux-3.0.8/kernel/trace/trace.c 2011-07-21 22:17:23.000000000 -0400
66678 +++ linux-3.0.8/kernel/trace/trace.c 2011-08-23 21:48:14.000000000 -0400
66679 @@ -3339,6 +3339,8 @@ static ssize_t tracing_splice_read_pipe(
66680 size_t rem;
66681 unsigned int i;
66682
66683 + pax_track_stack();
66684 +
66685 if (splice_grow_spd(pipe, &spd))
66686 return -ENOMEM;
66687
66688 @@ -3822,6 +3824,8 @@ tracing_buffers_splice_read(struct file
66689 int entries, size, i;
66690 size_t ret;
66691
66692 + pax_track_stack();
66693 +
66694 if (splice_grow_spd(pipe, &spd))
66695 return -ENOMEM;
66696
66697 @@ -3990,10 +3994,9 @@ static const struct file_operations trac
66698 };
66699 #endif
66700
66701 -static struct dentry *d_tracer;
66702 -
66703 struct dentry *tracing_init_dentry(void)
66704 {
66705 + static struct dentry *d_tracer;
66706 static int once;
66707
66708 if (d_tracer)
66709 @@ -4013,10 +4016,9 @@ struct dentry *tracing_init_dentry(void)
66710 return d_tracer;
66711 }
66712
66713 -static struct dentry *d_percpu;
66714 -
66715 struct dentry *tracing_dentry_percpu(void)
66716 {
66717 + static struct dentry *d_percpu;
66718 static int once;
66719 struct dentry *d_tracer;
66720
66721 diff -urNp linux-3.0.8/kernel/trace/trace_events.c linux-3.0.8/kernel/trace/trace_events.c
66722 --- linux-3.0.8/kernel/trace/trace_events.c 2011-10-24 08:05:21.000000000 -0400
66723 +++ linux-3.0.8/kernel/trace/trace_events.c 2011-08-23 21:47:56.000000000 -0400
66724 @@ -1318,10 +1318,6 @@ static LIST_HEAD(ftrace_module_file_list
66725 struct ftrace_module_file_ops {
66726 struct list_head list;
66727 struct module *mod;
66728 - struct file_operations id;
66729 - struct file_operations enable;
66730 - struct file_operations format;
66731 - struct file_operations filter;
66732 };
66733
66734 static struct ftrace_module_file_ops *
66735 @@ -1342,17 +1338,12 @@ trace_create_file_ops(struct module *mod
66736
66737 file_ops->mod = mod;
66738
66739 - file_ops->id = ftrace_event_id_fops;
66740 - file_ops->id.owner = mod;
66741 -
66742 - file_ops->enable = ftrace_enable_fops;
66743 - file_ops->enable.owner = mod;
66744 -
66745 - file_ops->filter = ftrace_event_filter_fops;
66746 - file_ops->filter.owner = mod;
66747 -
66748 - file_ops->format = ftrace_event_format_fops;
66749 - file_ops->format.owner = mod;
66750 + pax_open_kernel();
66751 + *(void **)&mod->trace_id.owner = mod;
66752 + *(void **)&mod->trace_enable.owner = mod;
66753 + *(void **)&mod->trace_filter.owner = mod;
66754 + *(void **)&mod->trace_format.owner = mod;
66755 + pax_close_kernel();
66756
66757 list_add(&file_ops->list, &ftrace_module_file_list);
66758
66759 @@ -1376,8 +1367,8 @@ static void trace_module_add_events(stru
66760
66761 for_each_event(call, start, end) {
66762 __trace_add_event_call(*call, mod,
66763 - &file_ops->id, &file_ops->enable,
66764 - &file_ops->filter, &file_ops->format);
66765 + &mod->trace_id, &mod->trace_enable,
66766 + &mod->trace_filter, &mod->trace_format);
66767 }
66768 }
66769
66770 diff -urNp linux-3.0.8/kernel/trace/trace_kprobe.c linux-3.0.8/kernel/trace/trace_kprobe.c
66771 --- linux-3.0.8/kernel/trace/trace_kprobe.c 2011-07-21 22:17:23.000000000 -0400
66772 +++ linux-3.0.8/kernel/trace/trace_kprobe.c 2011-10-06 04:17:55.000000000 -0400
66773 @@ -217,7 +217,7 @@ static __kprobes void FETCH_FUNC_NAME(me
66774 long ret;
66775 int maxlen = get_rloc_len(*(u32 *)dest);
66776 u8 *dst = get_rloc_data(dest);
66777 - u8 *src = addr;
66778 + const u8 __user *src = (const u8 __force_user *)addr;
66779 mm_segment_t old_fs = get_fs();
66780 if (!maxlen)
66781 return;
66782 @@ -229,7 +229,7 @@ static __kprobes void FETCH_FUNC_NAME(me
66783 pagefault_disable();
66784 do
66785 ret = __copy_from_user_inatomic(dst++, src++, 1);
66786 - while (dst[-1] && ret == 0 && src - (u8 *)addr < maxlen);
66787 + while (dst[-1] && ret == 0 && src - (const u8 __force_user *)addr < maxlen);
66788 dst[-1] = '\0';
66789 pagefault_enable();
66790 set_fs(old_fs);
66791 @@ -238,7 +238,7 @@ static __kprobes void FETCH_FUNC_NAME(me
66792 ((u8 *)get_rloc_data(dest))[0] = '\0';
66793 *(u32 *)dest = make_data_rloc(0, get_rloc_offs(*(u32 *)dest));
66794 } else
66795 - *(u32 *)dest = make_data_rloc(src - (u8 *)addr,
66796 + *(u32 *)dest = make_data_rloc(src - (const u8 __force_user *)addr,
66797 get_rloc_offs(*(u32 *)dest));
66798 }
66799 /* Return the length of string -- including null terminal byte */
66800 @@ -252,7 +252,7 @@ static __kprobes void FETCH_FUNC_NAME(me
66801 set_fs(KERNEL_DS);
66802 pagefault_disable();
66803 do {
66804 - ret = __copy_from_user_inatomic(&c, (u8 *)addr + len, 1);
66805 + ret = __copy_from_user_inatomic(&c, (const u8 __force_user *)addr + len, 1);
66806 len++;
66807 } while (c && ret == 0 && len < MAX_STRING_SIZE);
66808 pagefault_enable();
66809 diff -urNp linux-3.0.8/kernel/trace/trace_mmiotrace.c linux-3.0.8/kernel/trace/trace_mmiotrace.c
66810 --- linux-3.0.8/kernel/trace/trace_mmiotrace.c 2011-07-21 22:17:23.000000000 -0400
66811 +++ linux-3.0.8/kernel/trace/trace_mmiotrace.c 2011-08-23 21:47:56.000000000 -0400
66812 @@ -24,7 +24,7 @@ struct header_iter {
66813 static struct trace_array *mmio_trace_array;
66814 static bool overrun_detected;
66815 static unsigned long prev_overruns;
66816 -static atomic_t dropped_count;
66817 +static atomic_unchecked_t dropped_count;
66818
66819 static void mmio_reset_data(struct trace_array *tr)
66820 {
66821 @@ -127,7 +127,7 @@ static void mmio_close(struct trace_iter
66822
66823 static unsigned long count_overruns(struct trace_iterator *iter)
66824 {
66825 - unsigned long cnt = atomic_xchg(&dropped_count, 0);
66826 + unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
66827 unsigned long over = ring_buffer_overruns(iter->tr->buffer);
66828
66829 if (over > prev_overruns)
66830 @@ -317,7 +317,7 @@ static void __trace_mmiotrace_rw(struct
66831 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
66832 sizeof(*entry), 0, pc);
66833 if (!event) {
66834 - atomic_inc(&dropped_count);
66835 + atomic_inc_unchecked(&dropped_count);
66836 return;
66837 }
66838 entry = ring_buffer_event_data(event);
66839 @@ -347,7 +347,7 @@ static void __trace_mmiotrace_map(struct
66840 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
66841 sizeof(*entry), 0, pc);
66842 if (!event) {
66843 - atomic_inc(&dropped_count);
66844 + atomic_inc_unchecked(&dropped_count);
66845 return;
66846 }
66847 entry = ring_buffer_event_data(event);
66848 diff -urNp linux-3.0.8/kernel/trace/trace_output.c linux-3.0.8/kernel/trace/trace_output.c
66849 --- linux-3.0.8/kernel/trace/trace_output.c 2011-07-21 22:17:23.000000000 -0400
66850 +++ linux-3.0.8/kernel/trace/trace_output.c 2011-08-23 21:47:56.000000000 -0400
66851 @@ -278,7 +278,7 @@ int trace_seq_path(struct trace_seq *s,
66852
66853 p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
66854 if (!IS_ERR(p)) {
66855 - p = mangle_path(s->buffer + s->len, p, "\n");
66856 + p = mangle_path(s->buffer + s->len, p, "\n\\");
66857 if (p) {
66858 s->len = p - s->buffer;
66859 return 1;
66860 diff -urNp linux-3.0.8/kernel/trace/trace_stack.c linux-3.0.8/kernel/trace/trace_stack.c
66861 --- linux-3.0.8/kernel/trace/trace_stack.c 2011-07-21 22:17:23.000000000 -0400
66862 +++ linux-3.0.8/kernel/trace/trace_stack.c 2011-08-23 21:47:56.000000000 -0400
66863 @@ -50,7 +50,7 @@ static inline void check_stack(void)
66864 return;
66865
66866 /* we do not handle interrupt stacks yet */
66867 - if (!object_is_on_stack(&this_size))
66868 + if (!object_starts_on_stack(&this_size))
66869 return;
66870
66871 local_irq_save(flags);
66872 diff -urNp linux-3.0.8/kernel/trace/trace_workqueue.c linux-3.0.8/kernel/trace/trace_workqueue.c
66873 --- linux-3.0.8/kernel/trace/trace_workqueue.c 2011-07-21 22:17:23.000000000 -0400
66874 +++ linux-3.0.8/kernel/trace/trace_workqueue.c 2011-08-23 21:47:56.000000000 -0400
66875 @@ -22,7 +22,7 @@ struct cpu_workqueue_stats {
66876 int cpu;
66877 pid_t pid;
66878 /* Can be inserted from interrupt or user context, need to be atomic */
66879 - atomic_t inserted;
66880 + atomic_unchecked_t inserted;
66881 /*
66882 * Don't need to be atomic, works are serialized in a single workqueue thread
66883 * on a single CPU.
66884 @@ -60,7 +60,7 @@ probe_workqueue_insertion(void *ignore,
66885 spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
66886 list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
66887 if (node->pid == wq_thread->pid) {
66888 - atomic_inc(&node->inserted);
66889 + atomic_inc_unchecked(&node->inserted);
66890 goto found;
66891 }
66892 }
66893 @@ -210,7 +210,7 @@ static int workqueue_stat_show(struct se
66894 tsk = get_pid_task(pid, PIDTYPE_PID);
66895 if (tsk) {
66896 seq_printf(s, "%3d %6d %6u %s\n", cws->cpu,
66897 - atomic_read(&cws->inserted), cws->executed,
66898 + atomic_read_unchecked(&cws->inserted), cws->executed,
66899 tsk->comm);
66900 put_task_struct(tsk);
66901 }
66902 diff -urNp linux-3.0.8/lib/bitmap.c linux-3.0.8/lib/bitmap.c
66903 --- linux-3.0.8/lib/bitmap.c 2011-07-21 22:17:23.000000000 -0400
66904 +++ linux-3.0.8/lib/bitmap.c 2011-10-06 04:17:55.000000000 -0400
66905 @@ -421,7 +421,7 @@ int __bitmap_parse(const char *buf, unsi
66906 {
66907 int c, old_c, totaldigits, ndigits, nchunks, nbits;
66908 u32 chunk;
66909 - const char __user *ubuf = buf;
66910 + const char __user *ubuf = (const char __force_user *)buf;
66911
66912 bitmap_zero(maskp, nmaskbits);
66913
66914 @@ -506,7 +506,7 @@ int bitmap_parse_user(const char __user
66915 {
66916 if (!access_ok(VERIFY_READ, ubuf, ulen))
66917 return -EFAULT;
66918 - return __bitmap_parse((const char *)ubuf, ulen, 1, maskp, nmaskbits);
66919 + return __bitmap_parse((const char __force_kernel *)ubuf, ulen, 1, maskp, nmaskbits);
66920 }
66921 EXPORT_SYMBOL(bitmap_parse_user);
66922
66923 @@ -596,7 +596,7 @@ static int __bitmap_parselist(const char
66924 {
66925 unsigned a, b;
66926 int c, old_c, totaldigits;
66927 - const char __user *ubuf = buf;
66928 + const char __user *ubuf = (const char __force_user *)buf;
66929 int exp_digit, in_range;
66930
66931 totaldigits = c = 0;
66932 @@ -696,7 +696,7 @@ int bitmap_parselist_user(const char __u
66933 {
66934 if (!access_ok(VERIFY_READ, ubuf, ulen))
66935 return -EFAULT;
66936 - return __bitmap_parselist((const char *)ubuf,
66937 + return __bitmap_parselist((const char __force_kernel *)ubuf,
66938 ulen, 1, maskp, nmaskbits);
66939 }
66940 EXPORT_SYMBOL(bitmap_parselist_user);
66941 diff -urNp linux-3.0.8/lib/bug.c linux-3.0.8/lib/bug.c
66942 --- linux-3.0.8/lib/bug.c 2011-07-21 22:17:23.000000000 -0400
66943 +++ linux-3.0.8/lib/bug.c 2011-08-23 21:47:56.000000000 -0400
66944 @@ -133,6 +133,8 @@ enum bug_trap_type report_bug(unsigned l
66945 return BUG_TRAP_TYPE_NONE;
66946
66947 bug = find_bug(bugaddr);
66948 + if (!bug)
66949 + return BUG_TRAP_TYPE_NONE;
66950
66951 file = NULL;
66952 line = 0;
66953 diff -urNp linux-3.0.8/lib/debugobjects.c linux-3.0.8/lib/debugobjects.c
66954 --- linux-3.0.8/lib/debugobjects.c 2011-07-21 22:17:23.000000000 -0400
66955 +++ linux-3.0.8/lib/debugobjects.c 2011-08-23 21:47:56.000000000 -0400
66956 @@ -284,7 +284,7 @@ static void debug_object_is_on_stack(voi
66957 if (limit > 4)
66958 return;
66959
66960 - is_on_stack = object_is_on_stack(addr);
66961 + is_on_stack = object_starts_on_stack(addr);
66962 if (is_on_stack == onstack)
66963 return;
66964
66965 diff -urNp linux-3.0.8/lib/devres.c linux-3.0.8/lib/devres.c
66966 --- linux-3.0.8/lib/devres.c 2011-07-21 22:17:23.000000000 -0400
66967 +++ linux-3.0.8/lib/devres.c 2011-10-06 04:17:55.000000000 -0400
66968 @@ -81,7 +81,7 @@ void devm_iounmap(struct device *dev, vo
66969 {
66970 iounmap(addr);
66971 WARN_ON(devres_destroy(dev, devm_ioremap_release, devm_ioremap_match,
66972 - (void *)addr));
66973 + (void __force *)addr));
66974 }
66975 EXPORT_SYMBOL(devm_iounmap);
66976
66977 @@ -141,7 +141,7 @@ void devm_ioport_unmap(struct device *de
66978 {
66979 ioport_unmap(addr);
66980 WARN_ON(devres_destroy(dev, devm_ioport_map_release,
66981 - devm_ioport_map_match, (void *)addr));
66982 + devm_ioport_map_match, (void __force *)addr));
66983 }
66984 EXPORT_SYMBOL(devm_ioport_unmap);
66985
66986 diff -urNp linux-3.0.8/lib/dma-debug.c linux-3.0.8/lib/dma-debug.c
66987 --- linux-3.0.8/lib/dma-debug.c 2011-07-21 22:17:23.000000000 -0400
66988 +++ linux-3.0.8/lib/dma-debug.c 2011-08-23 21:47:56.000000000 -0400
66989 @@ -870,7 +870,7 @@ out:
66990
66991 static void check_for_stack(struct device *dev, void *addr)
66992 {
66993 - if (object_is_on_stack(addr))
66994 + if (object_starts_on_stack(addr))
66995 err_printk(dev, NULL, "DMA-API: device driver maps memory from"
66996 "stack [addr=%p]\n", addr);
66997 }
66998 diff -urNp linux-3.0.8/lib/extable.c linux-3.0.8/lib/extable.c
66999 --- linux-3.0.8/lib/extable.c 2011-07-21 22:17:23.000000000 -0400
67000 +++ linux-3.0.8/lib/extable.c 2011-08-23 21:47:56.000000000 -0400
67001 @@ -13,6 +13,7 @@
67002 #include <linux/init.h>
67003 #include <linux/sort.h>
67004 #include <asm/uaccess.h>
67005 +#include <asm/pgtable.h>
67006
67007 #ifndef ARCH_HAS_SORT_EXTABLE
67008 /*
67009 @@ -36,8 +37,10 @@ static int cmp_ex(const void *a, const v
67010 void sort_extable(struct exception_table_entry *start,
67011 struct exception_table_entry *finish)
67012 {
67013 + pax_open_kernel();
67014 sort(start, finish - start, sizeof(struct exception_table_entry),
67015 cmp_ex, NULL);
67016 + pax_close_kernel();
67017 }
67018
67019 #ifdef CONFIG_MODULES
67020 diff -urNp linux-3.0.8/lib/inflate.c linux-3.0.8/lib/inflate.c
67021 --- linux-3.0.8/lib/inflate.c 2011-07-21 22:17:23.000000000 -0400
67022 +++ linux-3.0.8/lib/inflate.c 2011-08-23 21:47:56.000000000 -0400
67023 @@ -269,7 +269,7 @@ static void free(void *where)
67024 malloc_ptr = free_mem_ptr;
67025 }
67026 #else
67027 -#define malloc(a) kmalloc(a, GFP_KERNEL)
67028 +#define malloc(a) kmalloc((a), GFP_KERNEL)
67029 #define free(a) kfree(a)
67030 #endif
67031
67032 diff -urNp linux-3.0.8/lib/Kconfig.debug linux-3.0.8/lib/Kconfig.debug
67033 --- linux-3.0.8/lib/Kconfig.debug 2011-07-21 22:17:23.000000000 -0400
67034 +++ linux-3.0.8/lib/Kconfig.debug 2011-08-23 21:48:14.000000000 -0400
67035 @@ -1088,6 +1088,7 @@ config LATENCYTOP
67036 depends on DEBUG_KERNEL
67037 depends on STACKTRACE_SUPPORT
67038 depends on PROC_FS
67039 + depends on !GRKERNSEC_HIDESYM
67040 select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE
67041 select KALLSYMS
67042 select KALLSYMS_ALL
67043 diff -urNp linux-3.0.8/lib/kref.c linux-3.0.8/lib/kref.c
67044 --- linux-3.0.8/lib/kref.c 2011-07-21 22:17:23.000000000 -0400
67045 +++ linux-3.0.8/lib/kref.c 2011-08-23 21:47:56.000000000 -0400
67046 @@ -52,7 +52,7 @@ void kref_get(struct kref *kref)
67047 */
67048 int kref_put(struct kref *kref, void (*release)(struct kref *kref))
67049 {
67050 - WARN_ON(release == NULL);
67051 + BUG_ON(release == NULL);
67052 WARN_ON(release == (void (*)(struct kref *))kfree);
67053
67054 if (atomic_dec_and_test(&kref->refcount)) {
67055 diff -urNp linux-3.0.8/lib/radix-tree.c linux-3.0.8/lib/radix-tree.c
67056 --- linux-3.0.8/lib/radix-tree.c 2011-07-21 22:17:23.000000000 -0400
67057 +++ linux-3.0.8/lib/radix-tree.c 2011-08-23 21:47:56.000000000 -0400
67058 @@ -80,7 +80,7 @@ struct radix_tree_preload {
67059 int nr;
67060 struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
67061 };
67062 -static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
67063 +static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
67064
67065 static inline void *ptr_to_indirect(void *ptr)
67066 {
67067 diff -urNp linux-3.0.8/lib/vsprintf.c linux-3.0.8/lib/vsprintf.c
67068 --- linux-3.0.8/lib/vsprintf.c 2011-07-21 22:17:23.000000000 -0400
67069 +++ linux-3.0.8/lib/vsprintf.c 2011-08-23 21:48:14.000000000 -0400
67070 @@ -16,6 +16,9 @@
67071 * - scnprintf and vscnprintf
67072 */
67073
67074 +#ifdef CONFIG_GRKERNSEC_HIDESYM
67075 +#define __INCLUDED_BY_HIDESYM 1
67076 +#endif
67077 #include <stdarg.h>
67078 #include <linux/module.h>
67079 #include <linux/types.h>
67080 @@ -435,7 +438,7 @@ char *symbol_string(char *buf, char *end
67081 char sym[KSYM_SYMBOL_LEN];
67082 if (ext == 'B')
67083 sprint_backtrace(sym, value);
67084 - else if (ext != 'f' && ext != 's')
67085 + else if (ext != 'f' && ext != 's' && ext != 'a')
67086 sprint_symbol(sym, value);
67087 else
67088 kallsyms_lookup(value, NULL, NULL, NULL, sym);
67089 @@ -799,7 +802,11 @@ char *uuid_string(char *buf, char *end,
67090 return string(buf, end, uuid, spec);
67091 }
67092
67093 +#ifdef CONFIG_GRKERNSEC_HIDESYM
67094 +int kptr_restrict __read_mostly = 2;
67095 +#else
67096 int kptr_restrict __read_mostly;
67097 +#endif
67098
67099 /*
67100 * Show a '%p' thing. A kernel extension is that the '%p' is followed
67101 @@ -813,6 +820,8 @@ int kptr_restrict __read_mostly;
67102 * - 'S' For symbolic direct pointers with offset
67103 * - 's' For symbolic direct pointers without offset
67104 * - 'B' For backtraced symbolic direct pointers with offset
67105 + * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
67106 + * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
67107 * - 'R' For decoded struct resource, e.g., [mem 0x0-0x1f 64bit pref]
67108 * - 'r' For raw struct resource, e.g., [mem 0x0-0x1f flags 0x201]
67109 * - 'M' For a 6-byte MAC address, it prints the address in the
67110 @@ -857,12 +866,12 @@ char *pointer(const char *fmt, char *buf
67111 {
67112 if (!ptr && *fmt != 'K') {
67113 /*
67114 - * Print (null) with the same width as a pointer so it makes
67115 + * Print (nil) with the same width as a pointer so it makes
67116 * tabular output look nice.
67117 */
67118 if (spec.field_width == -1)
67119 spec.field_width = 2 * sizeof(void *);
67120 - return string(buf, end, "(null)", spec);
67121 + return string(buf, end, "(nil)", spec);
67122 }
67123
67124 switch (*fmt) {
67125 @@ -872,6 +881,13 @@ char *pointer(const char *fmt, char *buf
67126 /* Fallthrough */
67127 case 'S':
67128 case 's':
67129 +#ifdef CONFIG_GRKERNSEC_HIDESYM
67130 + break;
67131 +#else
67132 + return symbol_string(buf, end, ptr, spec, *fmt);
67133 +#endif
67134 + case 'A':
67135 + case 'a':
67136 case 'B':
67137 return symbol_string(buf, end, ptr, spec, *fmt);
67138 case 'R':
67139 @@ -1631,11 +1647,11 @@ int bstr_printf(char *buf, size_t size,
67140 typeof(type) value; \
67141 if (sizeof(type) == 8) { \
67142 args = PTR_ALIGN(args, sizeof(u32)); \
67143 - *(u32 *)&value = *(u32 *)args; \
67144 - *((u32 *)&value + 1) = *(u32 *)(args + 4); \
67145 + *(u32 *)&value = *(const u32 *)args; \
67146 + *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
67147 } else { \
67148 args = PTR_ALIGN(args, sizeof(type)); \
67149 - value = *(typeof(type) *)args; \
67150 + value = *(const typeof(type) *)args; \
67151 } \
67152 args += sizeof(type); \
67153 value; \
67154 @@ -1698,7 +1714,7 @@ int bstr_printf(char *buf, size_t size,
67155 case FORMAT_TYPE_STR: {
67156 const char *str_arg = args;
67157 args += strlen(str_arg) + 1;
67158 - str = string(str, end, (char *)str_arg, spec);
67159 + str = string(str, end, str_arg, spec);
67160 break;
67161 }
67162
67163 diff -urNp linux-3.0.8/localversion-grsec linux-3.0.8/localversion-grsec
67164 --- linux-3.0.8/localversion-grsec 1969-12-31 19:00:00.000000000 -0500
67165 +++ linux-3.0.8/localversion-grsec 2011-08-23 21:48:14.000000000 -0400
67166 @@ -0,0 +1 @@
67167 +-grsec
67168 diff -urNp linux-3.0.8/Makefile linux-3.0.8/Makefile
67169 --- linux-3.0.8/Makefile 2011-10-25 09:10:33.000000000 -0400
67170 +++ linux-3.0.8/Makefile 2011-10-25 09:10:41.000000000 -0400
67171 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
67172
67173 HOSTCC = gcc
67174 HOSTCXX = g++
67175 -HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
67176 -HOSTCXXFLAGS = -O2
67177 +HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
67178 +HOSTCFLAGS += $(call cc-option, -Wno-empty-body)
67179 +HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
67180
67181 # Decide whether to build built-in, modular, or both.
67182 # Normally, just do built-in.
67183 @@ -365,10 +366,12 @@ LINUXINCLUDE := -I$(srctree)/arch/$(h
67184 KBUILD_CPPFLAGS := -D__KERNEL__
67185
67186 KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
67187 + -W -Wno-unused-parameter -Wno-missing-field-initializers \
67188 -fno-strict-aliasing -fno-common \
67189 -Werror-implicit-function-declaration \
67190 -Wno-format-security \
67191 -fno-delete-null-pointer-checks
67192 +KBUILD_CFLAGS += $(call cc-option, -Wno-empty-body)
67193 KBUILD_AFLAGS_KERNEL :=
67194 KBUILD_CFLAGS_KERNEL :=
67195 KBUILD_AFLAGS := -D__ASSEMBLY__
67196 @@ -407,8 +410,8 @@ export RCS_TAR_IGNORE := --exclude SCCS
67197 # Rules shared between *config targets and build targets
67198
67199 # Basic helpers built in scripts/
67200 -PHONY += scripts_basic
67201 -scripts_basic:
67202 +PHONY += scripts_basic gcc-plugins
67203 +scripts_basic: gcc-plugins
67204 $(Q)$(MAKE) $(build)=scripts/basic
67205 $(Q)rm -f .tmp_quiet_recordmcount
67206
67207 @@ -564,6 +567,36 @@ else
67208 KBUILD_CFLAGS += -O2
67209 endif
67210
67211 +ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCC)" "$(CC)"), y)
67212 +CONSTIFY_PLUGIN := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN
67213 +ifdef CONFIG_PAX_MEMORY_STACKLEAK
67214 +STACKLEAK_PLUGIN := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -fplugin-arg-stackleak_plugin-track-lowest-sp=100
67215 +endif
67216 +ifdef CONFIG_KALLOCSTAT_PLUGIN
67217 +KALLOCSTAT_PLUGIN := -fplugin=$(objtree)/tools/gcc/kallocstat_plugin.so
67218 +endif
67219 +ifdef CONFIG_PAX_KERNEXEC_PLUGIN
67220 +KERNEXEC_PLUGIN := -fplugin=$(objtree)/tools/gcc/kernexec_plugin.so
67221 +endif
67222 +ifdef CONFIG_CHECKER_PLUGIN
67223 +ifeq ($(call cc-ifversion, -ge, 0406, y), y)
67224 +CHECKER_PLUGIN := -fplugin=$(objtree)/tools/gcc/checker_plugin.so -DCHECKER_PLUGIN
67225 +endif
67226 +endif
67227 +GCC_PLUGINS := $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) $(KALLOCSTAT_PLUGIN) $(KERNEXEC_PLUGIN) $(CHECKER_PLUGIN)
67228 +export CONSTIFY_PLUGIN STACKLEAK_PLUGIN KERNEXEC_PLUGIN CHECKER_PLUGIN
67229 +gcc-plugins:
67230 + $(Q)$(MAKE) $(build)=tools/gcc
67231 +else
67232 +gcc-plugins:
67233 +ifeq ($(call cc-ifversion, -ge, 0405, y), y)
67234 + $(error Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev.))
67235 +else
67236 + $(Q)echo "warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least"
67237 +endif
67238 + $(Q)echo "PAX_MEMORY_STACKLEAK and constification will be less secure"
67239 +endif
67240 +
67241 include $(srctree)/arch/$(SRCARCH)/Makefile
67242
67243 ifneq ($(CONFIG_FRAME_WARN),0)
67244 @@ -708,7 +741,7 @@ export mod_strip_cmd
67245
67246
67247 ifeq ($(KBUILD_EXTMOD),)
67248 -core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
67249 +core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
67250
67251 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
67252 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
67253 @@ -932,6 +965,7 @@ vmlinux.o: $(modpost-init) $(vmlinux-mai
67254
67255 # The actual objects are generated when descending,
67256 # make sure no implicit rule kicks in
67257 +$(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): KBUILD_CFLAGS += $(GCC_PLUGINS)
67258 $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
67259
67260 # Handle descending into subdirectories listed in $(vmlinux-dirs)
67261 @@ -941,7 +975,7 @@ $(sort $(vmlinux-init) $(vmlinux-main))
67262 # Error messages still appears in the original language
67263
67264 PHONY += $(vmlinux-dirs)
67265 -$(vmlinux-dirs): prepare scripts
67266 +$(vmlinux-dirs): gcc-plugins prepare scripts
67267 $(Q)$(MAKE) $(build)=$@
67268
67269 # Store (new) KERNELRELASE string in include/config/kernel.release
67270 @@ -986,6 +1020,7 @@ prepare0: archprepare FORCE
67271 $(Q)$(MAKE) $(build)=. missing-syscalls
67272
67273 # All the preparing..
67274 +prepare: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS),$(KBUILD_CFLAGS))
67275 prepare: prepare0
67276
67277 # Generate some files
67278 @@ -1087,6 +1122,7 @@ all: modules
67279 # using awk while concatenating to the final file.
67280
67281 PHONY += modules
67282 +modules: KBUILD_CFLAGS += $(GCC_PLUGINS)
67283 modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
67284 $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
67285 @$(kecho) ' Building modules, stage 2.';
67286 @@ -1102,7 +1138,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modu
67287
67288 # Target to prepare building external modules
67289 PHONY += modules_prepare
67290 -modules_prepare: prepare scripts
67291 +modules_prepare: gcc-plugins prepare scripts
67292
67293 # Target to install modules
67294 PHONY += modules_install
67295 @@ -1198,7 +1234,7 @@ distclean: mrproper
67296 @find $(srctree) $(RCS_FIND_IGNORE) \
67297 \( -name '*.orig' -o -name '*.rej' -o -name '*~' \
67298 -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
67299 - -o -name '.*.rej' -o -size 0 \
67300 + -o -name '.*.rej' -o -name '*.so' -o -size 0 \
67301 -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
67302 -type f -print | xargs rm -f
67303
67304 @@ -1359,6 +1395,7 @@ PHONY += $(module-dirs) modules
67305 $(module-dirs): crmodverdir $(objtree)/Module.symvers
67306 $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
67307
67308 +modules: KBUILD_CFLAGS += $(GCC_PLUGINS)
67309 modules: $(module-dirs)
67310 @$(kecho) ' Building modules, stage 2.';
67311 $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
67312 @@ -1485,17 +1522,19 @@ else
67313 target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
67314 endif
67315
67316 -%.s: %.c prepare scripts FORCE
67317 +%.s: KBUILD_CFLAGS += $(GCC_PLUGINS)
67318 +%.s: %.c gcc-plugins prepare scripts FORCE
67319 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
67320 %.i: %.c prepare scripts FORCE
67321 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
67322 -%.o: %.c prepare scripts FORCE
67323 +%.o: KBUILD_CFLAGS += $(GCC_PLUGINS)
67324 +%.o: %.c gcc-plugins prepare scripts FORCE
67325 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
67326 %.lst: %.c prepare scripts FORCE
67327 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
67328 -%.s: %.S prepare scripts FORCE
67329 +%.s: %.S gcc-plugins prepare scripts FORCE
67330 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
67331 -%.o: %.S prepare scripts FORCE
67332 +%.o: %.S gcc-plugins prepare scripts FORCE
67333 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
67334 %.symtypes: %.c prepare scripts FORCE
67335 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
67336 @@ -1505,11 +1544,13 @@ endif
67337 $(cmd_crmodverdir)
67338 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
67339 $(build)=$(build-dir)
67340 -%/: prepare scripts FORCE
67341 +%/: KBUILD_CFLAGS += $(GCC_PLUGINS)
67342 +%/: gcc-plugins prepare scripts FORCE
67343 $(cmd_crmodverdir)
67344 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
67345 $(build)=$(build-dir)
67346 -%.ko: prepare scripts FORCE
67347 +%.ko: KBUILD_CFLAGS += $(GCC_PLUGINS)
67348 +%.ko: gcc-plugins prepare scripts FORCE
67349 $(cmd_crmodverdir)
67350 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
67351 $(build)=$(build-dir) $(@:.ko=.o)
67352 diff -urNp linux-3.0.8/mm/filemap.c linux-3.0.8/mm/filemap.c
67353 --- linux-3.0.8/mm/filemap.c 2011-07-21 22:17:23.000000000 -0400
67354 +++ linux-3.0.8/mm/filemap.c 2011-08-23 21:48:14.000000000 -0400
67355 @@ -1763,7 +1763,7 @@ int generic_file_mmap(struct file * file
67356 struct address_space *mapping = file->f_mapping;
67357
67358 if (!mapping->a_ops->readpage)
67359 - return -ENOEXEC;
67360 + return -ENODEV;
67361 file_accessed(file);
67362 vma->vm_ops = &generic_file_vm_ops;
67363 vma->vm_flags |= VM_CAN_NONLINEAR;
67364 @@ -2169,6 +2169,7 @@ inline int generic_write_checks(struct f
67365 *pos = i_size_read(inode);
67366
67367 if (limit != RLIM_INFINITY) {
67368 + gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
67369 if (*pos >= limit) {
67370 send_sig(SIGXFSZ, current, 0);
67371 return -EFBIG;
67372 diff -urNp linux-3.0.8/mm/fremap.c linux-3.0.8/mm/fremap.c
67373 --- linux-3.0.8/mm/fremap.c 2011-07-21 22:17:23.000000000 -0400
67374 +++ linux-3.0.8/mm/fremap.c 2011-08-23 21:47:56.000000000 -0400
67375 @@ -156,6 +156,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
67376 retry:
67377 vma = find_vma(mm, start);
67378
67379 +#ifdef CONFIG_PAX_SEGMEXEC
67380 + if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
67381 + goto out;
67382 +#endif
67383 +
67384 /*
67385 * Make sure the vma is shared, that it supports prefaulting,
67386 * and that the remapped range is valid and fully within
67387 diff -urNp linux-3.0.8/mm/highmem.c linux-3.0.8/mm/highmem.c
67388 --- linux-3.0.8/mm/highmem.c 2011-07-21 22:17:23.000000000 -0400
67389 +++ linux-3.0.8/mm/highmem.c 2011-08-23 21:47:56.000000000 -0400
67390 @@ -125,9 +125,10 @@ static void flush_all_zero_pkmaps(void)
67391 * So no dangers, even with speculative execution.
67392 */
67393 page = pte_page(pkmap_page_table[i]);
67394 + pax_open_kernel();
67395 pte_clear(&init_mm, (unsigned long)page_address(page),
67396 &pkmap_page_table[i]);
67397 -
67398 + pax_close_kernel();
67399 set_page_address(page, NULL);
67400 need_flush = 1;
67401 }
67402 @@ -186,9 +187,11 @@ start:
67403 }
67404 }
67405 vaddr = PKMAP_ADDR(last_pkmap_nr);
67406 +
67407 + pax_open_kernel();
67408 set_pte_at(&init_mm, vaddr,
67409 &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
67410 -
67411 + pax_close_kernel();
67412 pkmap_count[last_pkmap_nr] = 1;
67413 set_page_address(page, (void *)vaddr);
67414
67415 diff -urNp linux-3.0.8/mm/huge_memory.c linux-3.0.8/mm/huge_memory.c
67416 --- linux-3.0.8/mm/huge_memory.c 2011-07-21 22:17:23.000000000 -0400
67417 +++ linux-3.0.8/mm/huge_memory.c 2011-08-23 21:47:56.000000000 -0400
67418 @@ -702,7 +702,7 @@ out:
67419 * run pte_offset_map on the pmd, if an huge pmd could
67420 * materialize from under us from a different thread.
67421 */
67422 - if (unlikely(__pte_alloc(mm, vma, pmd, address)))
67423 + if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
67424 return VM_FAULT_OOM;
67425 /* if an huge pmd materialized from under us just retry later */
67426 if (unlikely(pmd_trans_huge(*pmd)))
67427 diff -urNp linux-3.0.8/mm/hugetlb.c linux-3.0.8/mm/hugetlb.c
67428 --- linux-3.0.8/mm/hugetlb.c 2011-07-21 22:17:23.000000000 -0400
67429 +++ linux-3.0.8/mm/hugetlb.c 2011-08-23 21:47:56.000000000 -0400
67430 @@ -2339,6 +2339,27 @@ static int unmap_ref_private(struct mm_s
67431 return 1;
67432 }
67433
67434 +#ifdef CONFIG_PAX_SEGMEXEC
67435 +static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
67436 +{
67437 + struct mm_struct *mm = vma->vm_mm;
67438 + struct vm_area_struct *vma_m;
67439 + unsigned long address_m;
67440 + pte_t *ptep_m;
67441 +
67442 + vma_m = pax_find_mirror_vma(vma);
67443 + if (!vma_m)
67444 + return;
67445 +
67446 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
67447 + address_m = address + SEGMEXEC_TASK_SIZE;
67448 + ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
67449 + get_page(page_m);
67450 + hugepage_add_anon_rmap(page_m, vma_m, address_m);
67451 + set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
67452 +}
67453 +#endif
67454 +
67455 /*
67456 * Hugetlb_cow() should be called with page lock of the original hugepage held.
67457 */
67458 @@ -2440,6 +2461,11 @@ retry_avoidcopy:
67459 make_huge_pte(vma, new_page, 1));
67460 page_remove_rmap(old_page);
67461 hugepage_add_new_anon_rmap(new_page, vma, address);
67462 +
67463 +#ifdef CONFIG_PAX_SEGMEXEC
67464 + pax_mirror_huge_pte(vma, address, new_page);
67465 +#endif
67466 +
67467 /* Make the old page be freed below */
67468 new_page = old_page;
67469 mmu_notifier_invalidate_range_end(mm,
67470 @@ -2591,6 +2617,10 @@ retry:
67471 && (vma->vm_flags & VM_SHARED)));
67472 set_huge_pte_at(mm, address, ptep, new_pte);
67473
67474 +#ifdef CONFIG_PAX_SEGMEXEC
67475 + pax_mirror_huge_pte(vma, address, page);
67476 +#endif
67477 +
67478 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
67479 /* Optimization, do the COW without a second fault */
67480 ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
67481 @@ -2620,6 +2650,10 @@ int hugetlb_fault(struct mm_struct *mm,
67482 static DEFINE_MUTEX(hugetlb_instantiation_mutex);
67483 struct hstate *h = hstate_vma(vma);
67484
67485 +#ifdef CONFIG_PAX_SEGMEXEC
67486 + struct vm_area_struct *vma_m;
67487 +#endif
67488 +
67489 ptep = huge_pte_offset(mm, address);
67490 if (ptep) {
67491 entry = huge_ptep_get(ptep);
67492 @@ -2631,6 +2665,26 @@ int hugetlb_fault(struct mm_struct *mm,
67493 VM_FAULT_SET_HINDEX(h - hstates);
67494 }
67495
67496 +#ifdef CONFIG_PAX_SEGMEXEC
67497 + vma_m = pax_find_mirror_vma(vma);
67498 + if (vma_m) {
67499 + unsigned long address_m;
67500 +
67501 + if (vma->vm_start > vma_m->vm_start) {
67502 + address_m = address;
67503 + address -= SEGMEXEC_TASK_SIZE;
67504 + vma = vma_m;
67505 + h = hstate_vma(vma);
67506 + } else
67507 + address_m = address + SEGMEXEC_TASK_SIZE;
67508 +
67509 + if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
67510 + return VM_FAULT_OOM;
67511 + address_m &= HPAGE_MASK;
67512 + unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
67513 + }
67514 +#endif
67515 +
67516 ptep = huge_pte_alloc(mm, address, huge_page_size(h));
67517 if (!ptep)
67518 return VM_FAULT_OOM;
67519 diff -urNp linux-3.0.8/mm/internal.h linux-3.0.8/mm/internal.h
67520 --- linux-3.0.8/mm/internal.h 2011-07-21 22:17:23.000000000 -0400
67521 +++ linux-3.0.8/mm/internal.h 2011-08-23 21:47:56.000000000 -0400
67522 @@ -49,6 +49,7 @@ extern void putback_lru_page(struct page
67523 * in mm/page_alloc.c
67524 */
67525 extern void __free_pages_bootmem(struct page *page, unsigned int order);
67526 +extern void free_compound_page(struct page *page);
67527 extern void prep_compound_page(struct page *page, unsigned long order);
67528 #ifdef CONFIG_MEMORY_FAILURE
67529 extern bool is_free_buddy_page(struct page *page);
67530 diff -urNp linux-3.0.8/mm/Kconfig linux-3.0.8/mm/Kconfig
67531 --- linux-3.0.8/mm/Kconfig 2011-07-21 22:17:23.000000000 -0400
67532 +++ linux-3.0.8/mm/Kconfig 2011-08-23 21:48:14.000000000 -0400
67533 @@ -240,7 +240,7 @@ config KSM
67534 config DEFAULT_MMAP_MIN_ADDR
67535 int "Low address space to protect from user allocation"
67536 depends on MMU
67537 - default 4096
67538 + default 65536
67539 help
67540 This is the portion of low virtual memory which should be protected
67541 from userspace allocation. Keeping a user from writing to low pages
67542 diff -urNp linux-3.0.8/mm/kmemleak.c linux-3.0.8/mm/kmemleak.c
67543 --- linux-3.0.8/mm/kmemleak.c 2011-07-21 22:17:23.000000000 -0400
67544 +++ linux-3.0.8/mm/kmemleak.c 2011-08-23 21:48:14.000000000 -0400
67545 @@ -357,7 +357,7 @@ static void print_unreferenced(struct se
67546
67547 for (i = 0; i < object->trace_len; i++) {
67548 void *ptr = (void *)object->trace[i];
67549 - seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
67550 + seq_printf(seq, " [<%p>] %pA\n", ptr, ptr);
67551 }
67552 }
67553
67554 diff -urNp linux-3.0.8/mm/maccess.c linux-3.0.8/mm/maccess.c
67555 --- linux-3.0.8/mm/maccess.c 2011-07-21 22:17:23.000000000 -0400
67556 +++ linux-3.0.8/mm/maccess.c 2011-10-06 04:17:55.000000000 -0400
67557 @@ -26,7 +26,7 @@ long __probe_kernel_read(void *dst, cons
67558 set_fs(KERNEL_DS);
67559 pagefault_disable();
67560 ret = __copy_from_user_inatomic(dst,
67561 - (__force const void __user *)src, size);
67562 + (const void __force_user *)src, size);
67563 pagefault_enable();
67564 set_fs(old_fs);
67565
67566 @@ -53,7 +53,7 @@ long __probe_kernel_write(void *dst, con
67567
67568 set_fs(KERNEL_DS);
67569 pagefault_disable();
67570 - ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
67571 + ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
67572 pagefault_enable();
67573 set_fs(old_fs);
67574
67575 diff -urNp linux-3.0.8/mm/madvise.c linux-3.0.8/mm/madvise.c
67576 --- linux-3.0.8/mm/madvise.c 2011-07-21 22:17:23.000000000 -0400
67577 +++ linux-3.0.8/mm/madvise.c 2011-08-23 21:47:56.000000000 -0400
67578 @@ -45,6 +45,10 @@ static long madvise_behavior(struct vm_a
67579 pgoff_t pgoff;
67580 unsigned long new_flags = vma->vm_flags;
67581
67582 +#ifdef CONFIG_PAX_SEGMEXEC
67583 + struct vm_area_struct *vma_m;
67584 +#endif
67585 +
67586 switch (behavior) {
67587 case MADV_NORMAL:
67588 new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
67589 @@ -110,6 +114,13 @@ success:
67590 /*
67591 * vm_flags is protected by the mmap_sem held in write mode.
67592 */
67593 +
67594 +#ifdef CONFIG_PAX_SEGMEXEC
67595 + vma_m = pax_find_mirror_vma(vma);
67596 + if (vma_m)
67597 + vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
67598 +#endif
67599 +
67600 vma->vm_flags = new_flags;
67601
67602 out:
67603 @@ -168,6 +179,11 @@ static long madvise_dontneed(struct vm_a
67604 struct vm_area_struct ** prev,
67605 unsigned long start, unsigned long end)
67606 {
67607 +
67608 +#ifdef CONFIG_PAX_SEGMEXEC
67609 + struct vm_area_struct *vma_m;
67610 +#endif
67611 +
67612 *prev = vma;
67613 if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
67614 return -EINVAL;
67615 @@ -180,6 +196,21 @@ static long madvise_dontneed(struct vm_a
67616 zap_page_range(vma, start, end - start, &details);
67617 } else
67618 zap_page_range(vma, start, end - start, NULL);
67619 +
67620 +#ifdef CONFIG_PAX_SEGMEXEC
67621 + vma_m = pax_find_mirror_vma(vma);
67622 + if (vma_m) {
67623 + if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
67624 + struct zap_details details = {
67625 + .nonlinear_vma = vma_m,
67626 + .last_index = ULONG_MAX,
67627 + };
67628 + zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
67629 + } else
67630 + zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
67631 + }
67632 +#endif
67633 +
67634 return 0;
67635 }
67636
67637 @@ -376,6 +407,16 @@ SYSCALL_DEFINE3(madvise, unsigned long,
67638 if (end < start)
67639 goto out;
67640
67641 +#ifdef CONFIG_PAX_SEGMEXEC
67642 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
67643 + if (end > SEGMEXEC_TASK_SIZE)
67644 + goto out;
67645 + } else
67646 +#endif
67647 +
67648 + if (end > TASK_SIZE)
67649 + goto out;
67650 +
67651 error = 0;
67652 if (end == start)
67653 goto out;
67654 diff -urNp linux-3.0.8/mm/memory.c linux-3.0.8/mm/memory.c
67655 --- linux-3.0.8/mm/memory.c 2011-10-24 08:05:21.000000000 -0400
67656 +++ linux-3.0.8/mm/memory.c 2011-08-23 21:47:56.000000000 -0400
67657 @@ -457,8 +457,12 @@ static inline void free_pmd_range(struct
67658 return;
67659
67660 pmd = pmd_offset(pud, start);
67661 +
67662 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
67663 pud_clear(pud);
67664 pmd_free_tlb(tlb, pmd, start);
67665 +#endif
67666 +
67667 }
67668
67669 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
67670 @@ -489,9 +493,12 @@ static inline void free_pud_range(struct
67671 if (end - 1 > ceiling - 1)
67672 return;
67673
67674 +#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
67675 pud = pud_offset(pgd, start);
67676 pgd_clear(pgd);
67677 pud_free_tlb(tlb, pud, start);
67678 +#endif
67679 +
67680 }
67681
67682 /*
67683 @@ -1577,12 +1584,6 @@ no_page_table:
67684 return page;
67685 }
67686
67687 -static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
67688 -{
67689 - return stack_guard_page_start(vma, addr) ||
67690 - stack_guard_page_end(vma, addr+PAGE_SIZE);
67691 -}
67692 -
67693 /**
67694 * __get_user_pages() - pin user pages in memory
67695 * @tsk: task_struct of target task
67696 @@ -1655,10 +1656,10 @@ int __get_user_pages(struct task_struct
67697 (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
67698 i = 0;
67699
67700 - do {
67701 + while (nr_pages) {
67702 struct vm_area_struct *vma;
67703
67704 - vma = find_extend_vma(mm, start);
67705 + vma = find_vma(mm, start);
67706 if (!vma && in_gate_area(mm, start)) {
67707 unsigned long pg = start & PAGE_MASK;
67708 pgd_t *pgd;
67709 @@ -1706,7 +1707,7 @@ int __get_user_pages(struct task_struct
67710 goto next_page;
67711 }
67712
67713 - if (!vma ||
67714 + if (!vma || start < vma->vm_start ||
67715 (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
67716 !(vm_flags & vma->vm_flags))
67717 return i ? : -EFAULT;
67718 @@ -1733,11 +1734,6 @@ int __get_user_pages(struct task_struct
67719 int ret;
67720 unsigned int fault_flags = 0;
67721
67722 - /* For mlock, just skip the stack guard page. */
67723 - if (foll_flags & FOLL_MLOCK) {
67724 - if (stack_guard_page(vma, start))
67725 - goto next_page;
67726 - }
67727 if (foll_flags & FOLL_WRITE)
67728 fault_flags |= FAULT_FLAG_WRITE;
67729 if (nonblocking)
67730 @@ -1811,7 +1807,7 @@ next_page:
67731 start += PAGE_SIZE;
67732 nr_pages--;
67733 } while (nr_pages && start < vma->vm_end);
67734 - } while (nr_pages);
67735 + }
67736 return i;
67737 }
67738 EXPORT_SYMBOL(__get_user_pages);
67739 @@ -2018,6 +2014,10 @@ static int insert_page(struct vm_area_st
67740 page_add_file_rmap(page);
67741 set_pte_at(mm, addr, pte, mk_pte(page, prot));
67742
67743 +#ifdef CONFIG_PAX_SEGMEXEC
67744 + pax_mirror_file_pte(vma, addr, page, ptl);
67745 +#endif
67746 +
67747 retval = 0;
67748 pte_unmap_unlock(pte, ptl);
67749 return retval;
67750 @@ -2052,10 +2052,22 @@ out:
67751 int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
67752 struct page *page)
67753 {
67754 +
67755 +#ifdef CONFIG_PAX_SEGMEXEC
67756 + struct vm_area_struct *vma_m;
67757 +#endif
67758 +
67759 if (addr < vma->vm_start || addr >= vma->vm_end)
67760 return -EFAULT;
67761 if (!page_count(page))
67762 return -EINVAL;
67763 +
67764 +#ifdef CONFIG_PAX_SEGMEXEC
67765 + vma_m = pax_find_mirror_vma(vma);
67766 + if (vma_m)
67767 + vma_m->vm_flags |= VM_INSERTPAGE;
67768 +#endif
67769 +
67770 vma->vm_flags |= VM_INSERTPAGE;
67771 return insert_page(vma, addr, page, vma->vm_page_prot);
67772 }
67773 @@ -2141,6 +2153,7 @@ int vm_insert_mixed(struct vm_area_struc
67774 unsigned long pfn)
67775 {
67776 BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
67777 + BUG_ON(vma->vm_mirror);
67778
67779 if (addr < vma->vm_start || addr >= vma->vm_end)
67780 return -EFAULT;
67781 @@ -2456,6 +2469,186 @@ static inline void cow_user_page(struct
67782 copy_user_highpage(dst, src, va, vma);
67783 }
67784
67785 +#ifdef CONFIG_PAX_SEGMEXEC
67786 +static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
67787 +{
67788 + struct mm_struct *mm = vma->vm_mm;
67789 + spinlock_t *ptl;
67790 + pte_t *pte, entry;
67791 +
67792 + pte = pte_offset_map_lock(mm, pmd, address, &ptl);
67793 + entry = *pte;
67794 + if (!pte_present(entry)) {
67795 + if (!pte_none(entry)) {
67796 + BUG_ON(pte_file(entry));
67797 + free_swap_and_cache(pte_to_swp_entry(entry));
67798 + pte_clear_not_present_full(mm, address, pte, 0);
67799 + }
67800 + } else {
67801 + struct page *page;
67802 +
67803 + flush_cache_page(vma, address, pte_pfn(entry));
67804 + entry = ptep_clear_flush(vma, address, pte);
67805 + BUG_ON(pte_dirty(entry));
67806 + page = vm_normal_page(vma, address, entry);
67807 + if (page) {
67808 + update_hiwater_rss(mm);
67809 + if (PageAnon(page))
67810 + dec_mm_counter_fast(mm, MM_ANONPAGES);
67811 + else
67812 + dec_mm_counter_fast(mm, MM_FILEPAGES);
67813 + page_remove_rmap(page);
67814 + page_cache_release(page);
67815 + }
67816 + }
67817 + pte_unmap_unlock(pte, ptl);
67818 +}
67819 +
67820 +/* PaX: if vma is mirrored, synchronize the mirror's PTE
67821 + *
67822 + * the ptl of the lower mapped page is held on entry and is not released on exit
67823 + * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
67824 + */
67825 +static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
67826 +{
67827 + struct mm_struct *mm = vma->vm_mm;
67828 + unsigned long address_m;
67829 + spinlock_t *ptl_m;
67830 + struct vm_area_struct *vma_m;
67831 + pmd_t *pmd_m;
67832 + pte_t *pte_m, entry_m;
67833 +
67834 + BUG_ON(!page_m || !PageAnon(page_m));
67835 +
67836 + vma_m = pax_find_mirror_vma(vma);
67837 + if (!vma_m)
67838 + return;
67839 +
67840 + BUG_ON(!PageLocked(page_m));
67841 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
67842 + address_m = address + SEGMEXEC_TASK_SIZE;
67843 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
67844 + pte_m = pte_offset_map(pmd_m, address_m);
67845 + ptl_m = pte_lockptr(mm, pmd_m);
67846 + if (ptl != ptl_m) {
67847 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
67848 + if (!pte_none(*pte_m))
67849 + goto out;
67850 + }
67851 +
67852 + entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
67853 + page_cache_get(page_m);
67854 + page_add_anon_rmap(page_m, vma_m, address_m);
67855 + inc_mm_counter_fast(mm, MM_ANONPAGES);
67856 + set_pte_at(mm, address_m, pte_m, entry_m);
67857 + update_mmu_cache(vma_m, address_m, entry_m);
67858 +out:
67859 + if (ptl != ptl_m)
67860 + spin_unlock(ptl_m);
67861 + pte_unmap(pte_m);
67862 + unlock_page(page_m);
67863 +}
67864 +
67865 +void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
67866 +{
67867 + struct mm_struct *mm = vma->vm_mm;
67868 + unsigned long address_m;
67869 + spinlock_t *ptl_m;
67870 + struct vm_area_struct *vma_m;
67871 + pmd_t *pmd_m;
67872 + pte_t *pte_m, entry_m;
67873 +
67874 + BUG_ON(!page_m || PageAnon(page_m));
67875 +
67876 + vma_m = pax_find_mirror_vma(vma);
67877 + if (!vma_m)
67878 + return;
67879 +
67880 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
67881 + address_m = address + SEGMEXEC_TASK_SIZE;
67882 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
67883 + pte_m = pte_offset_map(pmd_m, address_m);
67884 + ptl_m = pte_lockptr(mm, pmd_m);
67885 + if (ptl != ptl_m) {
67886 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
67887 + if (!pte_none(*pte_m))
67888 + goto out;
67889 + }
67890 +
67891 + entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
67892 + page_cache_get(page_m);
67893 + page_add_file_rmap(page_m);
67894 + inc_mm_counter_fast(mm, MM_FILEPAGES);
67895 + set_pte_at(mm, address_m, pte_m, entry_m);
67896 + update_mmu_cache(vma_m, address_m, entry_m);
67897 +out:
67898 + if (ptl != ptl_m)
67899 + spin_unlock(ptl_m);
67900 + pte_unmap(pte_m);
67901 +}
67902 +
67903 +static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
67904 +{
67905 + struct mm_struct *mm = vma->vm_mm;
67906 + unsigned long address_m;
67907 + spinlock_t *ptl_m;
67908 + struct vm_area_struct *vma_m;
67909 + pmd_t *pmd_m;
67910 + pte_t *pte_m, entry_m;
67911 +
67912 + vma_m = pax_find_mirror_vma(vma);
67913 + if (!vma_m)
67914 + return;
67915 +
67916 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
67917 + address_m = address + SEGMEXEC_TASK_SIZE;
67918 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
67919 + pte_m = pte_offset_map(pmd_m, address_m);
67920 + ptl_m = pte_lockptr(mm, pmd_m);
67921 + if (ptl != ptl_m) {
67922 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
67923 + if (!pte_none(*pte_m))
67924 + goto out;
67925 + }
67926 +
67927 + entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
67928 + set_pte_at(mm, address_m, pte_m, entry_m);
67929 +out:
67930 + if (ptl != ptl_m)
67931 + spin_unlock(ptl_m);
67932 + pte_unmap(pte_m);
67933 +}
67934 +
67935 +static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
67936 +{
67937 + struct page *page_m;
67938 + pte_t entry;
67939 +
67940 + if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
67941 + goto out;
67942 +
67943 + entry = *pte;
67944 + page_m = vm_normal_page(vma, address, entry);
67945 + if (!page_m)
67946 + pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
67947 + else if (PageAnon(page_m)) {
67948 + if (pax_find_mirror_vma(vma)) {
67949 + pte_unmap_unlock(pte, ptl);
67950 + lock_page(page_m);
67951 + pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
67952 + if (pte_same(entry, *pte))
67953 + pax_mirror_anon_pte(vma, address, page_m, ptl);
67954 + else
67955 + unlock_page(page_m);
67956 + }
67957 + } else
67958 + pax_mirror_file_pte(vma, address, page_m, ptl);
67959 +
67960 +out:
67961 + pte_unmap_unlock(pte, ptl);
67962 +}
67963 +#endif
67964 +
67965 /*
67966 * This routine handles present pages, when users try to write
67967 * to a shared page. It is done by copying the page to a new address
67968 @@ -2667,6 +2860,12 @@ gotten:
67969 */
67970 page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
67971 if (likely(pte_same(*page_table, orig_pte))) {
67972 +
67973 +#ifdef CONFIG_PAX_SEGMEXEC
67974 + if (pax_find_mirror_vma(vma))
67975 + BUG_ON(!trylock_page(new_page));
67976 +#endif
67977 +
67978 if (old_page) {
67979 if (!PageAnon(old_page)) {
67980 dec_mm_counter_fast(mm, MM_FILEPAGES);
67981 @@ -2718,6 +2917,10 @@ gotten:
67982 page_remove_rmap(old_page);
67983 }
67984
67985 +#ifdef CONFIG_PAX_SEGMEXEC
67986 + pax_mirror_anon_pte(vma, address, new_page, ptl);
67987 +#endif
67988 +
67989 /* Free the old page.. */
67990 new_page = old_page;
67991 ret |= VM_FAULT_WRITE;
67992 @@ -2997,6 +3200,11 @@ static int do_swap_page(struct mm_struct
67993 swap_free(entry);
67994 if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
67995 try_to_free_swap(page);
67996 +
67997 +#ifdef CONFIG_PAX_SEGMEXEC
67998 + if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
67999 +#endif
68000 +
68001 unlock_page(page);
68002 if (swapcache) {
68003 /*
68004 @@ -3020,6 +3228,11 @@ static int do_swap_page(struct mm_struct
68005
68006 /* No need to invalidate - it was non-present before */
68007 update_mmu_cache(vma, address, page_table);
68008 +
68009 +#ifdef CONFIG_PAX_SEGMEXEC
68010 + pax_mirror_anon_pte(vma, address, page, ptl);
68011 +#endif
68012 +
68013 unlock:
68014 pte_unmap_unlock(page_table, ptl);
68015 out:
68016 @@ -3039,40 +3252,6 @@ out_release:
68017 }
68018
68019 /*
68020 - * This is like a special single-page "expand_{down|up}wards()",
68021 - * except we must first make sure that 'address{-|+}PAGE_SIZE'
68022 - * doesn't hit another vma.
68023 - */
68024 -static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
68025 -{
68026 - address &= PAGE_MASK;
68027 - if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
68028 - struct vm_area_struct *prev = vma->vm_prev;
68029 -
68030 - /*
68031 - * Is there a mapping abutting this one below?
68032 - *
68033 - * That's only ok if it's the same stack mapping
68034 - * that has gotten split..
68035 - */
68036 - if (prev && prev->vm_end == address)
68037 - return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
68038 -
68039 - expand_downwards(vma, address - PAGE_SIZE);
68040 - }
68041 - if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
68042 - struct vm_area_struct *next = vma->vm_next;
68043 -
68044 - /* As VM_GROWSDOWN but s/below/above/ */
68045 - if (next && next->vm_start == address + PAGE_SIZE)
68046 - return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
68047 -
68048 - expand_upwards(vma, address + PAGE_SIZE);
68049 - }
68050 - return 0;
68051 -}
68052 -
68053 -/*
68054 * We enter with non-exclusive mmap_sem (to exclude vma changes,
68055 * but allow concurrent faults), and pte mapped but not yet locked.
68056 * We return with mmap_sem still held, but pte unmapped and unlocked.
68057 @@ -3081,27 +3260,23 @@ static int do_anonymous_page(struct mm_s
68058 unsigned long address, pte_t *page_table, pmd_t *pmd,
68059 unsigned int flags)
68060 {
68061 - struct page *page;
68062 + struct page *page = NULL;
68063 spinlock_t *ptl;
68064 pte_t entry;
68065
68066 - pte_unmap(page_table);
68067 -
68068 - /* Check if we need to add a guard page to the stack */
68069 - if (check_stack_guard_page(vma, address) < 0)
68070 - return VM_FAULT_SIGBUS;
68071 -
68072 - /* Use the zero-page for reads */
68073 if (!(flags & FAULT_FLAG_WRITE)) {
68074 entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
68075 vma->vm_page_prot));
68076 - page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
68077 + ptl = pte_lockptr(mm, pmd);
68078 + spin_lock(ptl);
68079 if (!pte_none(*page_table))
68080 goto unlock;
68081 goto setpte;
68082 }
68083
68084 /* Allocate our own private page. */
68085 + pte_unmap(page_table);
68086 +
68087 if (unlikely(anon_vma_prepare(vma)))
68088 goto oom;
68089 page = alloc_zeroed_user_highpage_movable(vma, address);
68090 @@ -3120,6 +3295,11 @@ static int do_anonymous_page(struct mm_s
68091 if (!pte_none(*page_table))
68092 goto release;
68093
68094 +#ifdef CONFIG_PAX_SEGMEXEC
68095 + if (pax_find_mirror_vma(vma))
68096 + BUG_ON(!trylock_page(page));
68097 +#endif
68098 +
68099 inc_mm_counter_fast(mm, MM_ANONPAGES);
68100 page_add_new_anon_rmap(page, vma, address);
68101 setpte:
68102 @@ -3127,6 +3307,12 @@ setpte:
68103
68104 /* No need to invalidate - it was non-present before */
68105 update_mmu_cache(vma, address, page_table);
68106 +
68107 +#ifdef CONFIG_PAX_SEGMEXEC
68108 + if (page)
68109 + pax_mirror_anon_pte(vma, address, page, ptl);
68110 +#endif
68111 +
68112 unlock:
68113 pte_unmap_unlock(page_table, ptl);
68114 return 0;
68115 @@ -3264,6 +3450,12 @@ static int __do_fault(struct mm_struct *
68116 */
68117 /* Only go through if we didn't race with anybody else... */
68118 if (likely(pte_same(*page_table, orig_pte))) {
68119 +
68120 +#ifdef CONFIG_PAX_SEGMEXEC
68121 + if (anon && pax_find_mirror_vma(vma))
68122 + BUG_ON(!trylock_page(page));
68123 +#endif
68124 +
68125 flush_icache_page(vma, page);
68126 entry = mk_pte(page, vma->vm_page_prot);
68127 if (flags & FAULT_FLAG_WRITE)
68128 @@ -3283,6 +3475,14 @@ static int __do_fault(struct mm_struct *
68129
68130 /* no need to invalidate: a not-present page won't be cached */
68131 update_mmu_cache(vma, address, page_table);
68132 +
68133 +#ifdef CONFIG_PAX_SEGMEXEC
68134 + if (anon)
68135 + pax_mirror_anon_pte(vma, address, page, ptl);
68136 + else
68137 + pax_mirror_file_pte(vma, address, page, ptl);
68138 +#endif
68139 +
68140 } else {
68141 if (charged)
68142 mem_cgroup_uncharge_page(page);
68143 @@ -3430,6 +3630,12 @@ int handle_pte_fault(struct mm_struct *m
68144 if (flags & FAULT_FLAG_WRITE)
68145 flush_tlb_fix_spurious_fault(vma, address);
68146 }
68147 +
68148 +#ifdef CONFIG_PAX_SEGMEXEC
68149 + pax_mirror_pte(vma, address, pte, pmd, ptl);
68150 + return 0;
68151 +#endif
68152 +
68153 unlock:
68154 pte_unmap_unlock(pte, ptl);
68155 return 0;
68156 @@ -3446,6 +3652,10 @@ int handle_mm_fault(struct mm_struct *mm
68157 pmd_t *pmd;
68158 pte_t *pte;
68159
68160 +#ifdef CONFIG_PAX_SEGMEXEC
68161 + struct vm_area_struct *vma_m;
68162 +#endif
68163 +
68164 __set_current_state(TASK_RUNNING);
68165
68166 count_vm_event(PGFAULT);
68167 @@ -3457,6 +3667,34 @@ int handle_mm_fault(struct mm_struct *mm
68168 if (unlikely(is_vm_hugetlb_page(vma)))
68169 return hugetlb_fault(mm, vma, address, flags);
68170
68171 +#ifdef CONFIG_PAX_SEGMEXEC
68172 + vma_m = pax_find_mirror_vma(vma);
68173 + if (vma_m) {
68174 + unsigned long address_m;
68175 + pgd_t *pgd_m;
68176 + pud_t *pud_m;
68177 + pmd_t *pmd_m;
68178 +
68179 + if (vma->vm_start > vma_m->vm_start) {
68180 + address_m = address;
68181 + address -= SEGMEXEC_TASK_SIZE;
68182 + vma = vma_m;
68183 + } else
68184 + address_m = address + SEGMEXEC_TASK_SIZE;
68185 +
68186 + pgd_m = pgd_offset(mm, address_m);
68187 + pud_m = pud_alloc(mm, pgd_m, address_m);
68188 + if (!pud_m)
68189 + return VM_FAULT_OOM;
68190 + pmd_m = pmd_alloc(mm, pud_m, address_m);
68191 + if (!pmd_m)
68192 + return VM_FAULT_OOM;
68193 + if (!pmd_present(*pmd_m) && __pte_alloc(mm, vma_m, pmd_m, address_m))
68194 + return VM_FAULT_OOM;
68195 + pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
68196 + }
68197 +#endif
68198 +
68199 pgd = pgd_offset(mm, address);
68200 pud = pud_alloc(mm, pgd, address);
68201 if (!pud)
68202 @@ -3486,7 +3724,7 @@ int handle_mm_fault(struct mm_struct *mm
68203 * run pte_offset_map on the pmd, if an huge pmd could
68204 * materialize from under us from a different thread.
68205 */
68206 - if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
68207 + if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
68208 return VM_FAULT_OOM;
68209 /* if an huge pmd materialized from under us just retry later */
68210 if (unlikely(pmd_trans_huge(*pmd)))
68211 @@ -3590,7 +3828,7 @@ static int __init gate_vma_init(void)
68212 gate_vma.vm_start = FIXADDR_USER_START;
68213 gate_vma.vm_end = FIXADDR_USER_END;
68214 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
68215 - gate_vma.vm_page_prot = __P101;
68216 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
68217 /*
68218 * Make sure the vDSO gets into every core dump.
68219 * Dumping its contents makes post-mortem fully interpretable later
68220 diff -urNp linux-3.0.8/mm/memory-failure.c linux-3.0.8/mm/memory-failure.c
68221 --- linux-3.0.8/mm/memory-failure.c 2011-07-21 22:17:23.000000000 -0400
68222 +++ linux-3.0.8/mm/memory-failure.c 2011-10-06 04:17:55.000000000 -0400
68223 @@ -59,7 +59,7 @@ int sysctl_memory_failure_early_kill __r
68224
68225 int sysctl_memory_failure_recovery __read_mostly = 1;
68226
68227 -atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
68228 +atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
68229
68230 #if defined(CONFIG_HWPOISON_INJECT) || defined(CONFIG_HWPOISON_INJECT_MODULE)
68231
68232 @@ -200,7 +200,7 @@ static int kill_proc_ao(struct task_stru
68233 si.si_signo = SIGBUS;
68234 si.si_errno = 0;
68235 si.si_code = BUS_MCEERR_AO;
68236 - si.si_addr = (void *)addr;
68237 + si.si_addr = (void __user *)addr;
68238 #ifdef __ARCH_SI_TRAPNO
68239 si.si_trapno = trapno;
68240 #endif
68241 @@ -1008,7 +1008,7 @@ int __memory_failure(unsigned long pfn,
68242 }
68243
68244 nr_pages = 1 << compound_trans_order(hpage);
68245 - atomic_long_add(nr_pages, &mce_bad_pages);
68246 + atomic_long_add_unchecked(nr_pages, &mce_bad_pages);
68247
68248 /*
68249 * We need/can do nothing about count=0 pages.
68250 @@ -1038,7 +1038,7 @@ int __memory_failure(unsigned long pfn,
68251 if (!PageHWPoison(hpage)
68252 || (hwpoison_filter(p) && TestClearPageHWPoison(p))
68253 || (p != hpage && TestSetPageHWPoison(hpage))) {
68254 - atomic_long_sub(nr_pages, &mce_bad_pages);
68255 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
68256 return 0;
68257 }
68258 set_page_hwpoison_huge_page(hpage);
68259 @@ -1096,7 +1096,7 @@ int __memory_failure(unsigned long pfn,
68260 }
68261 if (hwpoison_filter(p)) {
68262 if (TestClearPageHWPoison(p))
68263 - atomic_long_sub(nr_pages, &mce_bad_pages);
68264 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
68265 unlock_page(hpage);
68266 put_page(hpage);
68267 return 0;
68268 @@ -1222,7 +1222,7 @@ int unpoison_memory(unsigned long pfn)
68269 return 0;
68270 }
68271 if (TestClearPageHWPoison(p))
68272 - atomic_long_sub(nr_pages, &mce_bad_pages);
68273 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
68274 pr_info("MCE: Software-unpoisoned free page %#lx\n", pfn);
68275 return 0;
68276 }
68277 @@ -1236,7 +1236,7 @@ int unpoison_memory(unsigned long pfn)
68278 */
68279 if (TestClearPageHWPoison(page)) {
68280 pr_info("MCE: Software-unpoisoned page %#lx\n", pfn);
68281 - atomic_long_sub(nr_pages, &mce_bad_pages);
68282 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
68283 freeit = 1;
68284 if (PageHuge(page))
68285 clear_page_hwpoison_huge_page(page);
68286 @@ -1349,7 +1349,7 @@ static int soft_offline_huge_page(struct
68287 }
68288 done:
68289 if (!PageHWPoison(hpage))
68290 - atomic_long_add(1 << compound_trans_order(hpage), &mce_bad_pages);
68291 + atomic_long_add_unchecked(1 << compound_trans_order(hpage), &mce_bad_pages);
68292 set_page_hwpoison_huge_page(hpage);
68293 dequeue_hwpoisoned_huge_page(hpage);
68294 /* keep elevated page count for bad page */
68295 @@ -1480,7 +1480,7 @@ int soft_offline_page(struct page *page,
68296 return ret;
68297
68298 done:
68299 - atomic_long_add(1, &mce_bad_pages);
68300 + atomic_long_add_unchecked(1, &mce_bad_pages);
68301 SetPageHWPoison(page);
68302 /* keep elevated page count for bad page */
68303 return ret;
68304 diff -urNp linux-3.0.8/mm/mempolicy.c linux-3.0.8/mm/mempolicy.c
68305 --- linux-3.0.8/mm/mempolicy.c 2011-07-21 22:17:23.000000000 -0400
68306 +++ linux-3.0.8/mm/mempolicy.c 2011-08-23 21:48:14.000000000 -0400
68307 @@ -639,6 +639,10 @@ static int mbind_range(struct mm_struct
68308 unsigned long vmstart;
68309 unsigned long vmend;
68310
68311 +#ifdef CONFIG_PAX_SEGMEXEC
68312 + struct vm_area_struct *vma_m;
68313 +#endif
68314 +
68315 vma = find_vma_prev(mm, start, &prev);
68316 if (!vma || vma->vm_start > start)
68317 return -EFAULT;
68318 @@ -669,6 +673,16 @@ static int mbind_range(struct mm_struct
68319 err = policy_vma(vma, new_pol);
68320 if (err)
68321 goto out;
68322 +
68323 +#ifdef CONFIG_PAX_SEGMEXEC
68324 + vma_m = pax_find_mirror_vma(vma);
68325 + if (vma_m) {
68326 + err = policy_vma(vma_m, new_pol);
68327 + if (err)
68328 + goto out;
68329 + }
68330 +#endif
68331 +
68332 }
68333
68334 out:
68335 @@ -1102,6 +1116,17 @@ static long do_mbind(unsigned long start
68336
68337 if (end < start)
68338 return -EINVAL;
68339 +
68340 +#ifdef CONFIG_PAX_SEGMEXEC
68341 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
68342 + if (end > SEGMEXEC_TASK_SIZE)
68343 + return -EINVAL;
68344 + } else
68345 +#endif
68346 +
68347 + if (end > TASK_SIZE)
68348 + return -EINVAL;
68349 +
68350 if (end == start)
68351 return 0;
68352
68353 @@ -1320,6 +1345,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
68354 if (!mm)
68355 goto out;
68356
68357 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
68358 + if (mm != current->mm &&
68359 + (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
68360 + err = -EPERM;
68361 + goto out;
68362 + }
68363 +#endif
68364 +
68365 /*
68366 * Check if this process has the right to modify the specified
68367 * process. The right exists if the process has administrative
68368 @@ -1329,8 +1362,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
68369 rcu_read_lock();
68370 tcred = __task_cred(task);
68371 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
68372 - cred->uid != tcred->suid && cred->uid != tcred->uid &&
68373 - !capable(CAP_SYS_NICE)) {
68374 + cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
68375 rcu_read_unlock();
68376 err = -EPERM;
68377 goto out;
68378 diff -urNp linux-3.0.8/mm/migrate.c linux-3.0.8/mm/migrate.c
68379 --- linux-3.0.8/mm/migrate.c 2011-10-25 09:10:33.000000000 -0400
68380 +++ linux-3.0.8/mm/migrate.c 2011-10-25 09:10:41.000000000 -0400
68381 @@ -1124,6 +1124,8 @@ static int do_pages_move(struct mm_struc
68382 unsigned long chunk_start;
68383 int err;
68384
68385 + pax_track_stack();
68386 +
68387 task_nodes = cpuset_mems_allowed(task);
68388
68389 err = -ENOMEM;
68390 @@ -1308,6 +1310,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
68391 if (!mm)
68392 return -EINVAL;
68393
68394 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
68395 + if (mm != current->mm &&
68396 + (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
68397 + err = -EPERM;
68398 + goto out;
68399 + }
68400 +#endif
68401 +
68402 /*
68403 * Check if this process has the right to modify the specified
68404 * process. The right exists if the process has administrative
68405 @@ -1317,8 +1327,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
68406 rcu_read_lock();
68407 tcred = __task_cred(task);
68408 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
68409 - cred->uid != tcred->suid && cred->uid != tcred->uid &&
68410 - !capable(CAP_SYS_NICE)) {
68411 + cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
68412 rcu_read_unlock();
68413 err = -EPERM;
68414 goto out;
68415 diff -urNp linux-3.0.8/mm/mlock.c linux-3.0.8/mm/mlock.c
68416 --- linux-3.0.8/mm/mlock.c 2011-07-21 22:17:23.000000000 -0400
68417 +++ linux-3.0.8/mm/mlock.c 2011-08-23 21:48:14.000000000 -0400
68418 @@ -13,6 +13,7 @@
68419 #include <linux/pagemap.h>
68420 #include <linux/mempolicy.h>
68421 #include <linux/syscalls.h>
68422 +#include <linux/security.h>
68423 #include <linux/sched.h>
68424 #include <linux/module.h>
68425 #include <linux/rmap.h>
68426 @@ -377,6 +378,9 @@ static int do_mlock(unsigned long start,
68427 return -EINVAL;
68428 if (end == start)
68429 return 0;
68430 + if (end > TASK_SIZE)
68431 + return -EINVAL;
68432 +
68433 vma = find_vma_prev(current->mm, start, &prev);
68434 if (!vma || vma->vm_start > start)
68435 return -ENOMEM;
68436 @@ -387,6 +391,11 @@ static int do_mlock(unsigned long start,
68437 for (nstart = start ; ; ) {
68438 vm_flags_t newflags;
68439
68440 +#ifdef CONFIG_PAX_SEGMEXEC
68441 + if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
68442 + break;
68443 +#endif
68444 +
68445 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
68446
68447 newflags = vma->vm_flags | VM_LOCKED;
68448 @@ -492,6 +501,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
68449 lock_limit >>= PAGE_SHIFT;
68450
68451 /* check against resource limits */
68452 + gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
68453 if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
68454 error = do_mlock(start, len, 1);
68455 up_write(&current->mm->mmap_sem);
68456 @@ -515,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long,
68457 static int do_mlockall(int flags)
68458 {
68459 struct vm_area_struct * vma, * prev = NULL;
68460 - unsigned int def_flags = 0;
68461
68462 if (flags & MCL_FUTURE)
68463 - def_flags = VM_LOCKED;
68464 - current->mm->def_flags = def_flags;
68465 + current->mm->def_flags |= VM_LOCKED;
68466 + else
68467 + current->mm->def_flags &= ~VM_LOCKED;
68468 if (flags == MCL_FUTURE)
68469 goto out;
68470
68471 for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
68472 vm_flags_t newflags;
68473
68474 +#ifdef CONFIG_PAX_SEGMEXEC
68475 + if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
68476 + break;
68477 +#endif
68478 +
68479 + BUG_ON(vma->vm_end > TASK_SIZE);
68480 newflags = vma->vm_flags | VM_LOCKED;
68481 if (!(flags & MCL_CURRENT))
68482 newflags &= ~VM_LOCKED;
68483 @@ -557,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
68484 lock_limit >>= PAGE_SHIFT;
68485
68486 ret = -ENOMEM;
68487 + gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
68488 if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
68489 capable(CAP_IPC_LOCK))
68490 ret = do_mlockall(flags);
68491 diff -urNp linux-3.0.8/mm/mmap.c linux-3.0.8/mm/mmap.c
68492 --- linux-3.0.8/mm/mmap.c 2011-07-21 22:17:23.000000000 -0400
68493 +++ linux-3.0.8/mm/mmap.c 2011-08-23 21:48:14.000000000 -0400
68494 @@ -46,6 +46,16 @@
68495 #define arch_rebalance_pgtables(addr, len) (addr)
68496 #endif
68497
68498 +static inline void verify_mm_writelocked(struct mm_struct *mm)
68499 +{
68500 +#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
68501 + if (unlikely(down_read_trylock(&mm->mmap_sem))) {
68502 + up_read(&mm->mmap_sem);
68503 + BUG();
68504 + }
68505 +#endif
68506 +}
68507 +
68508 static void unmap_region(struct mm_struct *mm,
68509 struct vm_area_struct *vma, struct vm_area_struct *prev,
68510 unsigned long start, unsigned long end);
68511 @@ -71,22 +81,32 @@ static void unmap_region(struct mm_struc
68512 * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
68513 *
68514 */
68515 -pgprot_t protection_map[16] = {
68516 +pgprot_t protection_map[16] __read_only = {
68517 __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
68518 __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
68519 };
68520
68521 -pgprot_t vm_get_page_prot(unsigned long vm_flags)
68522 +pgprot_t vm_get_page_prot(vm_flags_t vm_flags)
68523 {
68524 - return __pgprot(pgprot_val(protection_map[vm_flags &
68525 + pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
68526 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
68527 pgprot_val(arch_vm_get_page_prot(vm_flags)));
68528 +
68529 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
68530 + if (!(__supported_pte_mask & _PAGE_NX) &&
68531 + (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
68532 + (vm_flags & (VM_READ | VM_WRITE)))
68533 + prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
68534 +#endif
68535 +
68536 + return prot;
68537 }
68538 EXPORT_SYMBOL(vm_get_page_prot);
68539
68540 int sysctl_overcommit_memory __read_mostly = OVERCOMMIT_GUESS; /* heuristic overcommit */
68541 int sysctl_overcommit_ratio __read_mostly = 50; /* default is 50% */
68542 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
68543 +unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
68544 /*
68545 * Make sure vm_committed_as in one cacheline and not cacheline shared with
68546 * other variables. It can be updated by several CPUs frequently.
68547 @@ -236,6 +256,7 @@ static struct vm_area_struct *remove_vma
68548 struct vm_area_struct *next = vma->vm_next;
68549
68550 might_sleep();
68551 + BUG_ON(vma->vm_mirror);
68552 if (vma->vm_ops && vma->vm_ops->close)
68553 vma->vm_ops->close(vma);
68554 if (vma->vm_file) {
68555 @@ -280,6 +301,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
68556 * not page aligned -Ram Gupta
68557 */
68558 rlim = rlimit(RLIMIT_DATA);
68559 + gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
68560 if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
68561 (mm->end_data - mm->start_data) > rlim)
68562 goto out;
68563 @@ -697,6 +719,12 @@ static int
68564 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
68565 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
68566 {
68567 +
68568 +#ifdef CONFIG_PAX_SEGMEXEC
68569 + if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
68570 + return 0;
68571 +#endif
68572 +
68573 if (is_mergeable_vma(vma, file, vm_flags) &&
68574 is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
68575 if (vma->vm_pgoff == vm_pgoff)
68576 @@ -716,6 +744,12 @@ static int
68577 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
68578 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
68579 {
68580 +
68581 +#ifdef CONFIG_PAX_SEGMEXEC
68582 + if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
68583 + return 0;
68584 +#endif
68585 +
68586 if (is_mergeable_vma(vma, file, vm_flags) &&
68587 is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
68588 pgoff_t vm_pglen;
68589 @@ -758,13 +792,20 @@ can_vma_merge_after(struct vm_area_struc
68590 struct vm_area_struct *vma_merge(struct mm_struct *mm,
68591 struct vm_area_struct *prev, unsigned long addr,
68592 unsigned long end, unsigned long vm_flags,
68593 - struct anon_vma *anon_vma, struct file *file,
68594 + struct anon_vma *anon_vma, struct file *file,
68595 pgoff_t pgoff, struct mempolicy *policy)
68596 {
68597 pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
68598 struct vm_area_struct *area, *next;
68599 int err;
68600
68601 +#ifdef CONFIG_PAX_SEGMEXEC
68602 + unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
68603 + struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
68604 +
68605 + BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
68606 +#endif
68607 +
68608 /*
68609 * We later require that vma->vm_flags == vm_flags,
68610 * so this tests vma->vm_flags & VM_SPECIAL, too.
68611 @@ -780,6 +821,15 @@ struct vm_area_struct *vma_merge(struct
68612 if (next && next->vm_end == end) /* cases 6, 7, 8 */
68613 next = next->vm_next;
68614
68615 +#ifdef CONFIG_PAX_SEGMEXEC
68616 + if (prev)
68617 + prev_m = pax_find_mirror_vma(prev);
68618 + if (area)
68619 + area_m = pax_find_mirror_vma(area);
68620 + if (next)
68621 + next_m = pax_find_mirror_vma(next);
68622 +#endif
68623 +
68624 /*
68625 * Can it merge with the predecessor?
68626 */
68627 @@ -799,9 +849,24 @@ struct vm_area_struct *vma_merge(struct
68628 /* cases 1, 6 */
68629 err = vma_adjust(prev, prev->vm_start,
68630 next->vm_end, prev->vm_pgoff, NULL);
68631 - } else /* cases 2, 5, 7 */
68632 +
68633 +#ifdef CONFIG_PAX_SEGMEXEC
68634 + if (!err && prev_m)
68635 + err = vma_adjust(prev_m, prev_m->vm_start,
68636 + next_m->vm_end, prev_m->vm_pgoff, NULL);
68637 +#endif
68638 +
68639 + } else { /* cases 2, 5, 7 */
68640 err = vma_adjust(prev, prev->vm_start,
68641 end, prev->vm_pgoff, NULL);
68642 +
68643 +#ifdef CONFIG_PAX_SEGMEXEC
68644 + if (!err && prev_m)
68645 + err = vma_adjust(prev_m, prev_m->vm_start,
68646 + end_m, prev_m->vm_pgoff, NULL);
68647 +#endif
68648 +
68649 + }
68650 if (err)
68651 return NULL;
68652 khugepaged_enter_vma_merge(prev);
68653 @@ -815,12 +880,27 @@ struct vm_area_struct *vma_merge(struct
68654 mpol_equal(policy, vma_policy(next)) &&
68655 can_vma_merge_before(next, vm_flags,
68656 anon_vma, file, pgoff+pglen)) {
68657 - if (prev && addr < prev->vm_end) /* case 4 */
68658 + if (prev && addr < prev->vm_end) { /* case 4 */
68659 err = vma_adjust(prev, prev->vm_start,
68660 addr, prev->vm_pgoff, NULL);
68661 - else /* cases 3, 8 */
68662 +
68663 +#ifdef CONFIG_PAX_SEGMEXEC
68664 + if (!err && prev_m)
68665 + err = vma_adjust(prev_m, prev_m->vm_start,
68666 + addr_m, prev_m->vm_pgoff, NULL);
68667 +#endif
68668 +
68669 + } else { /* cases 3, 8 */
68670 err = vma_adjust(area, addr, next->vm_end,
68671 next->vm_pgoff - pglen, NULL);
68672 +
68673 +#ifdef CONFIG_PAX_SEGMEXEC
68674 + if (!err && area_m)
68675 + err = vma_adjust(area_m, addr_m, next_m->vm_end,
68676 + next_m->vm_pgoff - pglen, NULL);
68677 +#endif
68678 +
68679 + }
68680 if (err)
68681 return NULL;
68682 khugepaged_enter_vma_merge(area);
68683 @@ -929,14 +1009,11 @@ none:
68684 void vm_stat_account(struct mm_struct *mm, unsigned long flags,
68685 struct file *file, long pages)
68686 {
68687 - const unsigned long stack_flags
68688 - = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
68689 -
68690 if (file) {
68691 mm->shared_vm += pages;
68692 if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
68693 mm->exec_vm += pages;
68694 - } else if (flags & stack_flags)
68695 + } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
68696 mm->stack_vm += pages;
68697 if (flags & (VM_RESERVED|VM_IO))
68698 mm->reserved_vm += pages;
68699 @@ -963,7 +1040,7 @@ unsigned long do_mmap_pgoff(struct file
68700 * (the exception is when the underlying filesystem is noexec
68701 * mounted, in which case we dont add PROT_EXEC.)
68702 */
68703 - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
68704 + if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
68705 if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
68706 prot |= PROT_EXEC;
68707
68708 @@ -989,7 +1066,7 @@ unsigned long do_mmap_pgoff(struct file
68709 /* Obtain the address to map to. we verify (or select) it and ensure
68710 * that it represents a valid section of the address space.
68711 */
68712 - addr = get_unmapped_area(file, addr, len, pgoff, flags);
68713 + addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
68714 if (addr & ~PAGE_MASK)
68715 return addr;
68716
68717 @@ -1000,6 +1077,36 @@ unsigned long do_mmap_pgoff(struct file
68718 vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
68719 mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
68720
68721 +#ifdef CONFIG_PAX_MPROTECT
68722 + if (mm->pax_flags & MF_PAX_MPROTECT) {
68723 +#ifndef CONFIG_PAX_MPROTECT_COMPAT
68724 + if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
68725 + gr_log_rwxmmap(file);
68726 +
68727 +#ifdef CONFIG_PAX_EMUPLT
68728 + vm_flags &= ~VM_EXEC;
68729 +#else
68730 + return -EPERM;
68731 +#endif
68732 +
68733 + }
68734 +
68735 + if (!(vm_flags & VM_EXEC))
68736 + vm_flags &= ~VM_MAYEXEC;
68737 +#else
68738 + if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
68739 + vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
68740 +#endif
68741 + else
68742 + vm_flags &= ~VM_MAYWRITE;
68743 + }
68744 +#endif
68745 +
68746 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
68747 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
68748 + vm_flags &= ~VM_PAGEEXEC;
68749 +#endif
68750 +
68751 if (flags & MAP_LOCKED)
68752 if (!can_do_mlock())
68753 return -EPERM;
68754 @@ -1011,6 +1118,7 @@ unsigned long do_mmap_pgoff(struct file
68755 locked += mm->locked_vm;
68756 lock_limit = rlimit(RLIMIT_MEMLOCK);
68757 lock_limit >>= PAGE_SHIFT;
68758 + gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
68759 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
68760 return -EAGAIN;
68761 }
68762 @@ -1081,6 +1189,9 @@ unsigned long do_mmap_pgoff(struct file
68763 if (error)
68764 return error;
68765
68766 + if (!gr_acl_handle_mmap(file, prot))
68767 + return -EACCES;
68768 +
68769 return mmap_region(file, addr, len, flags, vm_flags, pgoff);
68770 }
68771 EXPORT_SYMBOL(do_mmap_pgoff);
68772 @@ -1161,7 +1272,7 @@ int vma_wants_writenotify(struct vm_area
68773 vm_flags_t vm_flags = vma->vm_flags;
68774
68775 /* If it was private or non-writable, the write bit is already clear */
68776 - if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
68777 + if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
68778 return 0;
68779
68780 /* The backer wishes to know when pages are first written to? */
68781 @@ -1210,14 +1321,24 @@ unsigned long mmap_region(struct file *f
68782 unsigned long charged = 0;
68783 struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
68784
68785 +#ifdef CONFIG_PAX_SEGMEXEC
68786 + struct vm_area_struct *vma_m = NULL;
68787 +#endif
68788 +
68789 + /*
68790 + * mm->mmap_sem is required to protect against another thread
68791 + * changing the mappings in case we sleep.
68792 + */
68793 + verify_mm_writelocked(mm);
68794 +
68795 /* Clear old maps */
68796 error = -ENOMEM;
68797 -munmap_back:
68798 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
68799 if (vma && vma->vm_start < addr + len) {
68800 if (do_munmap(mm, addr, len))
68801 return -ENOMEM;
68802 - goto munmap_back;
68803 + vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
68804 + BUG_ON(vma && vma->vm_start < addr + len);
68805 }
68806
68807 /* Check against address space limit. */
68808 @@ -1266,6 +1387,16 @@ munmap_back:
68809 goto unacct_error;
68810 }
68811
68812 +#ifdef CONFIG_PAX_SEGMEXEC
68813 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
68814 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
68815 + if (!vma_m) {
68816 + error = -ENOMEM;
68817 + goto free_vma;
68818 + }
68819 + }
68820 +#endif
68821 +
68822 vma->vm_mm = mm;
68823 vma->vm_start = addr;
68824 vma->vm_end = addr + len;
68825 @@ -1289,6 +1420,19 @@ munmap_back:
68826 error = file->f_op->mmap(file, vma);
68827 if (error)
68828 goto unmap_and_free_vma;
68829 +
68830 +#ifdef CONFIG_PAX_SEGMEXEC
68831 + if (vma_m && (vm_flags & VM_EXECUTABLE))
68832 + added_exe_file_vma(mm);
68833 +#endif
68834 +
68835 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
68836 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
68837 + vma->vm_flags |= VM_PAGEEXEC;
68838 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
68839 + }
68840 +#endif
68841 +
68842 if (vm_flags & VM_EXECUTABLE)
68843 added_exe_file_vma(mm);
68844
68845 @@ -1324,6 +1468,11 @@ munmap_back:
68846 vma_link(mm, vma, prev, rb_link, rb_parent);
68847 file = vma->vm_file;
68848
68849 +#ifdef CONFIG_PAX_SEGMEXEC
68850 + if (vma_m)
68851 + BUG_ON(pax_mirror_vma(vma_m, vma));
68852 +#endif
68853 +
68854 /* Once vma denies write, undo our temporary denial count */
68855 if (correct_wcount)
68856 atomic_inc(&inode->i_writecount);
68857 @@ -1332,6 +1481,7 @@ out:
68858
68859 mm->total_vm += len >> PAGE_SHIFT;
68860 vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
68861 + track_exec_limit(mm, addr, addr + len, vm_flags);
68862 if (vm_flags & VM_LOCKED) {
68863 if (!mlock_vma_pages_range(vma, addr, addr + len))
68864 mm->locked_vm += (len >> PAGE_SHIFT);
68865 @@ -1349,6 +1499,12 @@ unmap_and_free_vma:
68866 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
68867 charged = 0;
68868 free_vma:
68869 +
68870 +#ifdef CONFIG_PAX_SEGMEXEC
68871 + if (vma_m)
68872 + kmem_cache_free(vm_area_cachep, vma_m);
68873 +#endif
68874 +
68875 kmem_cache_free(vm_area_cachep, vma);
68876 unacct_error:
68877 if (charged)
68878 @@ -1356,6 +1512,44 @@ unacct_error:
68879 return error;
68880 }
68881
68882 +bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len)
68883 +{
68884 + if (!vma) {
68885 +#ifdef CONFIG_STACK_GROWSUP
68886 + if (addr > sysctl_heap_stack_gap)
68887 + vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
68888 + else
68889 + vma = find_vma(current->mm, 0);
68890 + if (vma && (vma->vm_flags & VM_GROWSUP))
68891 + return false;
68892 +#endif
68893 + return true;
68894 + }
68895 +
68896 + if (addr + len > vma->vm_start)
68897 + return false;
68898 +
68899 + if (vma->vm_flags & VM_GROWSDOWN)
68900 + return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
68901 +#ifdef CONFIG_STACK_GROWSUP
68902 + else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
68903 + return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
68904 +#endif
68905 +
68906 + return true;
68907 +}
68908 +
68909 +unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len)
68910 +{
68911 + if (vma->vm_start < len)
68912 + return -ENOMEM;
68913 + if (!(vma->vm_flags & VM_GROWSDOWN))
68914 + return vma->vm_start - len;
68915 + if (sysctl_heap_stack_gap <= vma->vm_start - len)
68916 + return vma->vm_start - len - sysctl_heap_stack_gap;
68917 + return -ENOMEM;
68918 +}
68919 +
68920 /* Get an address range which is currently unmapped.
68921 * For shmat() with addr=0.
68922 *
68923 @@ -1382,18 +1576,23 @@ arch_get_unmapped_area(struct file *filp
68924 if (flags & MAP_FIXED)
68925 return addr;
68926
68927 +#ifdef CONFIG_PAX_RANDMMAP
68928 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
68929 +#endif
68930 +
68931 if (addr) {
68932 addr = PAGE_ALIGN(addr);
68933 - vma = find_vma(mm, addr);
68934 - if (TASK_SIZE - len >= addr &&
68935 - (!vma || addr + len <= vma->vm_start))
68936 - return addr;
68937 + if (TASK_SIZE - len >= addr) {
68938 + vma = find_vma(mm, addr);
68939 + if (check_heap_stack_gap(vma, addr, len))
68940 + return addr;
68941 + }
68942 }
68943 if (len > mm->cached_hole_size) {
68944 - start_addr = addr = mm->free_area_cache;
68945 + start_addr = addr = mm->free_area_cache;
68946 } else {
68947 - start_addr = addr = TASK_UNMAPPED_BASE;
68948 - mm->cached_hole_size = 0;
68949 + start_addr = addr = mm->mmap_base;
68950 + mm->cached_hole_size = 0;
68951 }
68952
68953 full_search:
68954 @@ -1404,34 +1603,40 @@ full_search:
68955 * Start a new search - just in case we missed
68956 * some holes.
68957 */
68958 - if (start_addr != TASK_UNMAPPED_BASE) {
68959 - addr = TASK_UNMAPPED_BASE;
68960 - start_addr = addr;
68961 + if (start_addr != mm->mmap_base) {
68962 + start_addr = addr = mm->mmap_base;
68963 mm->cached_hole_size = 0;
68964 goto full_search;
68965 }
68966 return -ENOMEM;
68967 }
68968 - if (!vma || addr + len <= vma->vm_start) {
68969 - /*
68970 - * Remember the place where we stopped the search:
68971 - */
68972 - mm->free_area_cache = addr + len;
68973 - return addr;
68974 - }
68975 + if (check_heap_stack_gap(vma, addr, len))
68976 + break;
68977 if (addr + mm->cached_hole_size < vma->vm_start)
68978 mm->cached_hole_size = vma->vm_start - addr;
68979 addr = vma->vm_end;
68980 }
68981 +
68982 + /*
68983 + * Remember the place where we stopped the search:
68984 + */
68985 + mm->free_area_cache = addr + len;
68986 + return addr;
68987 }
68988 #endif
68989
68990 void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
68991 {
68992 +
68993 +#ifdef CONFIG_PAX_SEGMEXEC
68994 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
68995 + return;
68996 +#endif
68997 +
68998 /*
68999 * Is this a new hole at the lowest possible address?
69000 */
69001 - if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
69002 + if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
69003 mm->free_area_cache = addr;
69004 mm->cached_hole_size = ~0UL;
69005 }
69006 @@ -1449,7 +1654,7 @@ arch_get_unmapped_area_topdown(struct fi
69007 {
69008 struct vm_area_struct *vma;
69009 struct mm_struct *mm = current->mm;
69010 - unsigned long addr = addr0;
69011 + unsigned long base = mm->mmap_base, addr = addr0;
69012
69013 /* requested length too big for entire address space */
69014 if (len > TASK_SIZE)
69015 @@ -1458,13 +1663,18 @@ arch_get_unmapped_area_topdown(struct fi
69016 if (flags & MAP_FIXED)
69017 return addr;
69018
69019 +#ifdef CONFIG_PAX_RANDMMAP
69020 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
69021 +#endif
69022 +
69023 /* requesting a specific address */
69024 if (addr) {
69025 addr = PAGE_ALIGN(addr);
69026 - vma = find_vma(mm, addr);
69027 - if (TASK_SIZE - len >= addr &&
69028 - (!vma || addr + len <= vma->vm_start))
69029 - return addr;
69030 + if (TASK_SIZE - len >= addr) {
69031 + vma = find_vma(mm, addr);
69032 + if (check_heap_stack_gap(vma, addr, len))
69033 + return addr;
69034 + }
69035 }
69036
69037 /* check if free_area_cache is useful for us */
69038 @@ -1479,7 +1689,7 @@ arch_get_unmapped_area_topdown(struct fi
69039 /* make sure it can fit in the remaining address space */
69040 if (addr > len) {
69041 vma = find_vma(mm, addr-len);
69042 - if (!vma || addr <= vma->vm_start)
69043 + if (check_heap_stack_gap(vma, addr - len, len))
69044 /* remember the address as a hint for next time */
69045 return (mm->free_area_cache = addr-len);
69046 }
69047 @@ -1496,7 +1706,7 @@ arch_get_unmapped_area_topdown(struct fi
69048 * return with success:
69049 */
69050 vma = find_vma(mm, addr);
69051 - if (!vma || addr+len <= vma->vm_start)
69052 + if (check_heap_stack_gap(vma, addr, len))
69053 /* remember the address as a hint for next time */
69054 return (mm->free_area_cache = addr);
69055
69056 @@ -1505,8 +1715,8 @@ arch_get_unmapped_area_topdown(struct fi
69057 mm->cached_hole_size = vma->vm_start - addr;
69058
69059 /* try just below the current vma->vm_start */
69060 - addr = vma->vm_start-len;
69061 - } while (len < vma->vm_start);
69062 + addr = skip_heap_stack_gap(vma, len);
69063 + } while (!IS_ERR_VALUE(addr));
69064
69065 bottomup:
69066 /*
69067 @@ -1515,13 +1725,21 @@ bottomup:
69068 * can happen with large stack limits and large mmap()
69069 * allocations.
69070 */
69071 + mm->mmap_base = TASK_UNMAPPED_BASE;
69072 +
69073 +#ifdef CONFIG_PAX_RANDMMAP
69074 + if (mm->pax_flags & MF_PAX_RANDMMAP)
69075 + mm->mmap_base += mm->delta_mmap;
69076 +#endif
69077 +
69078 + mm->free_area_cache = mm->mmap_base;
69079 mm->cached_hole_size = ~0UL;
69080 - mm->free_area_cache = TASK_UNMAPPED_BASE;
69081 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
69082 /*
69083 * Restore the topdown base:
69084 */
69085 - mm->free_area_cache = mm->mmap_base;
69086 + mm->mmap_base = base;
69087 + mm->free_area_cache = base;
69088 mm->cached_hole_size = ~0UL;
69089
69090 return addr;
69091 @@ -1530,6 +1748,12 @@ bottomup:
69092
69093 void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
69094 {
69095 +
69096 +#ifdef CONFIG_PAX_SEGMEXEC
69097 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
69098 + return;
69099 +#endif
69100 +
69101 /*
69102 * Is this a new hole at the highest possible address?
69103 */
69104 @@ -1537,8 +1761,10 @@ void arch_unmap_area_topdown(struct mm_s
69105 mm->free_area_cache = addr;
69106
69107 /* dont allow allocations above current base */
69108 - if (mm->free_area_cache > mm->mmap_base)
69109 + if (mm->free_area_cache > mm->mmap_base) {
69110 mm->free_area_cache = mm->mmap_base;
69111 + mm->cached_hole_size = ~0UL;
69112 + }
69113 }
69114
69115 unsigned long
69116 @@ -1646,6 +1872,28 @@ out:
69117 return prev ? prev->vm_next : vma;
69118 }
69119
69120 +#ifdef CONFIG_PAX_SEGMEXEC
69121 +struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
69122 +{
69123 + struct vm_area_struct *vma_m;
69124 +
69125 + BUG_ON(!vma || vma->vm_start >= vma->vm_end);
69126 + if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
69127 + BUG_ON(vma->vm_mirror);
69128 + return NULL;
69129 + }
69130 + BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
69131 + vma_m = vma->vm_mirror;
69132 + BUG_ON(!vma_m || vma_m->vm_mirror != vma);
69133 + BUG_ON(vma->vm_file != vma_m->vm_file);
69134 + BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
69135 + BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff);
69136 + BUG_ON(vma->anon_vma != vma_m->anon_vma && vma->anon_vma->root != vma_m->anon_vma->root);
69137 + BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
69138 + return vma_m;
69139 +}
69140 +#endif
69141 +
69142 /*
69143 * Verify that the stack growth is acceptable and
69144 * update accounting. This is shared with both the
69145 @@ -1662,6 +1910,7 @@ static int acct_stack_growth(struct vm_a
69146 return -ENOMEM;
69147
69148 /* Stack limit test */
69149 + gr_learn_resource(current, RLIMIT_STACK, size, 1);
69150 if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
69151 return -ENOMEM;
69152
69153 @@ -1672,6 +1921,7 @@ static int acct_stack_growth(struct vm_a
69154 locked = mm->locked_vm + grow;
69155 limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
69156 limit >>= PAGE_SHIFT;
69157 + gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
69158 if (locked > limit && !capable(CAP_IPC_LOCK))
69159 return -ENOMEM;
69160 }
69161 @@ -1702,37 +1952,48 @@ static int acct_stack_growth(struct vm_a
69162 * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
69163 * vma is the last one with address > vma->vm_end. Have to extend vma.
69164 */
69165 +#ifndef CONFIG_IA64
69166 +static
69167 +#endif
69168 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
69169 {
69170 int error;
69171 + bool locknext;
69172
69173 if (!(vma->vm_flags & VM_GROWSUP))
69174 return -EFAULT;
69175
69176 + /* Also guard against wrapping around to address 0. */
69177 + if (address < PAGE_ALIGN(address+1))
69178 + address = PAGE_ALIGN(address+1);
69179 + else
69180 + return -ENOMEM;
69181 +
69182 /*
69183 * We must make sure the anon_vma is allocated
69184 * so that the anon_vma locking is not a noop.
69185 */
69186 if (unlikely(anon_vma_prepare(vma)))
69187 return -ENOMEM;
69188 + locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
69189 + if (locknext && anon_vma_prepare(vma->vm_next))
69190 + return -ENOMEM;
69191 vma_lock_anon_vma(vma);
69192 + if (locknext)
69193 + vma_lock_anon_vma(vma->vm_next);
69194
69195 /*
69196 * vma->vm_start/vm_end cannot change under us because the caller
69197 * is required to hold the mmap_sem in read mode. We need the
69198 - * anon_vma lock to serialize against concurrent expand_stacks.
69199 - * Also guard against wrapping around to address 0.
69200 + * anon_vma locks to serialize against concurrent expand_stacks
69201 + * and expand_upwards.
69202 */
69203 - if (address < PAGE_ALIGN(address+4))
69204 - address = PAGE_ALIGN(address+4);
69205 - else {
69206 - vma_unlock_anon_vma(vma);
69207 - return -ENOMEM;
69208 - }
69209 error = 0;
69210
69211 /* Somebody else might have raced and expanded it already */
69212 - if (address > vma->vm_end) {
69213 + if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
69214 + error = -ENOMEM;
69215 + else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
69216 unsigned long size, grow;
69217
69218 size = address - vma->vm_start;
69219 @@ -1747,6 +2008,8 @@ int expand_upwards(struct vm_area_struct
69220 }
69221 }
69222 }
69223 + if (locknext)
69224 + vma_unlock_anon_vma(vma->vm_next);
69225 vma_unlock_anon_vma(vma);
69226 khugepaged_enter_vma_merge(vma);
69227 return error;
69228 @@ -1760,6 +2023,8 @@ int expand_downwards(struct vm_area_stru
69229 unsigned long address)
69230 {
69231 int error;
69232 + bool lockprev = false;
69233 + struct vm_area_struct *prev;
69234
69235 /*
69236 * We must make sure the anon_vma is allocated
69237 @@ -1773,6 +2038,15 @@ int expand_downwards(struct vm_area_stru
69238 if (error)
69239 return error;
69240
69241 + prev = vma->vm_prev;
69242 +#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
69243 + lockprev = prev && (prev->vm_flags & VM_GROWSUP);
69244 +#endif
69245 + if (lockprev && anon_vma_prepare(prev))
69246 + return -ENOMEM;
69247 + if (lockprev)
69248 + vma_lock_anon_vma(prev);
69249 +
69250 vma_lock_anon_vma(vma);
69251
69252 /*
69253 @@ -1782,9 +2056,17 @@ int expand_downwards(struct vm_area_stru
69254 */
69255
69256 /* Somebody else might have raced and expanded it already */
69257 - if (address < vma->vm_start) {
69258 + if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
69259 + error = -ENOMEM;
69260 + else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
69261 unsigned long size, grow;
69262
69263 +#ifdef CONFIG_PAX_SEGMEXEC
69264 + struct vm_area_struct *vma_m;
69265 +
69266 + vma_m = pax_find_mirror_vma(vma);
69267 +#endif
69268 +
69269 size = vma->vm_end - address;
69270 grow = (vma->vm_start - address) >> PAGE_SHIFT;
69271
69272 @@ -1794,11 +2076,22 @@ int expand_downwards(struct vm_area_stru
69273 if (!error) {
69274 vma->vm_start = address;
69275 vma->vm_pgoff -= grow;
69276 + track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
69277 +
69278 +#ifdef CONFIG_PAX_SEGMEXEC
69279 + if (vma_m) {
69280 + vma_m->vm_start -= grow << PAGE_SHIFT;
69281 + vma_m->vm_pgoff -= grow;
69282 + }
69283 +#endif
69284 +
69285 perf_event_mmap(vma);
69286 }
69287 }
69288 }
69289 vma_unlock_anon_vma(vma);
69290 + if (lockprev)
69291 + vma_unlock_anon_vma(prev);
69292 khugepaged_enter_vma_merge(vma);
69293 return error;
69294 }
69295 @@ -1868,6 +2161,13 @@ static void remove_vma_list(struct mm_st
69296 do {
69297 long nrpages = vma_pages(vma);
69298
69299 +#ifdef CONFIG_PAX_SEGMEXEC
69300 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
69301 + vma = remove_vma(vma);
69302 + continue;
69303 + }
69304 +#endif
69305 +
69306 mm->total_vm -= nrpages;
69307 vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
69308 vma = remove_vma(vma);
69309 @@ -1913,6 +2213,16 @@ detach_vmas_to_be_unmapped(struct mm_str
69310 insertion_point = (prev ? &prev->vm_next : &mm->mmap);
69311 vma->vm_prev = NULL;
69312 do {
69313 +
69314 +#ifdef CONFIG_PAX_SEGMEXEC
69315 + if (vma->vm_mirror) {
69316 + BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
69317 + vma->vm_mirror->vm_mirror = NULL;
69318 + vma->vm_mirror->vm_flags &= ~VM_EXEC;
69319 + vma->vm_mirror = NULL;
69320 + }
69321 +#endif
69322 +
69323 rb_erase(&vma->vm_rb, &mm->mm_rb);
69324 mm->map_count--;
69325 tail_vma = vma;
69326 @@ -1941,14 +2251,33 @@ static int __split_vma(struct mm_struct
69327 struct vm_area_struct *new;
69328 int err = -ENOMEM;
69329
69330 +#ifdef CONFIG_PAX_SEGMEXEC
69331 + struct vm_area_struct *vma_m, *new_m = NULL;
69332 + unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
69333 +#endif
69334 +
69335 if (is_vm_hugetlb_page(vma) && (addr &
69336 ~(huge_page_mask(hstate_vma(vma)))))
69337 return -EINVAL;
69338
69339 +#ifdef CONFIG_PAX_SEGMEXEC
69340 + vma_m = pax_find_mirror_vma(vma);
69341 +#endif
69342 +
69343 new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
69344 if (!new)
69345 goto out_err;
69346
69347 +#ifdef CONFIG_PAX_SEGMEXEC
69348 + if (vma_m) {
69349 + new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
69350 + if (!new_m) {
69351 + kmem_cache_free(vm_area_cachep, new);
69352 + goto out_err;
69353 + }
69354 + }
69355 +#endif
69356 +
69357 /* most fields are the same, copy all, and then fixup */
69358 *new = *vma;
69359
69360 @@ -1961,6 +2290,22 @@ static int __split_vma(struct mm_struct
69361 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
69362 }
69363
69364 +#ifdef CONFIG_PAX_SEGMEXEC
69365 + if (vma_m) {
69366 + *new_m = *vma_m;
69367 + INIT_LIST_HEAD(&new_m->anon_vma_chain);
69368 + new_m->vm_mirror = new;
69369 + new->vm_mirror = new_m;
69370 +
69371 + if (new_below)
69372 + new_m->vm_end = addr_m;
69373 + else {
69374 + new_m->vm_start = addr_m;
69375 + new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
69376 + }
69377 + }
69378 +#endif
69379 +
69380 pol = mpol_dup(vma_policy(vma));
69381 if (IS_ERR(pol)) {
69382 err = PTR_ERR(pol);
69383 @@ -1986,6 +2331,42 @@ static int __split_vma(struct mm_struct
69384 else
69385 err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
69386
69387 +#ifdef CONFIG_PAX_SEGMEXEC
69388 + if (!err && vma_m) {
69389 + if (anon_vma_clone(new_m, vma_m))
69390 + goto out_free_mpol;
69391 +
69392 + mpol_get(pol);
69393 + vma_set_policy(new_m, pol);
69394 +
69395 + if (new_m->vm_file) {
69396 + get_file(new_m->vm_file);
69397 + if (vma_m->vm_flags & VM_EXECUTABLE)
69398 + added_exe_file_vma(mm);
69399 + }
69400 +
69401 + if (new_m->vm_ops && new_m->vm_ops->open)
69402 + new_m->vm_ops->open(new_m);
69403 +
69404 + if (new_below)
69405 + err = vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
69406 + ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
69407 + else
69408 + err = vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
69409 +
69410 + if (err) {
69411 + if (new_m->vm_ops && new_m->vm_ops->close)
69412 + new_m->vm_ops->close(new_m);
69413 + if (new_m->vm_file) {
69414 + if (vma_m->vm_flags & VM_EXECUTABLE)
69415 + removed_exe_file_vma(mm);
69416 + fput(new_m->vm_file);
69417 + }
69418 + mpol_put(pol);
69419 + }
69420 + }
69421 +#endif
69422 +
69423 /* Success. */
69424 if (!err)
69425 return 0;
69426 @@ -1998,10 +2379,18 @@ static int __split_vma(struct mm_struct
69427 removed_exe_file_vma(mm);
69428 fput(new->vm_file);
69429 }
69430 - unlink_anon_vmas(new);
69431 out_free_mpol:
69432 mpol_put(pol);
69433 out_free_vma:
69434 +
69435 +#ifdef CONFIG_PAX_SEGMEXEC
69436 + if (new_m) {
69437 + unlink_anon_vmas(new_m);
69438 + kmem_cache_free(vm_area_cachep, new_m);
69439 + }
69440 +#endif
69441 +
69442 + unlink_anon_vmas(new);
69443 kmem_cache_free(vm_area_cachep, new);
69444 out_err:
69445 return err;
69446 @@ -2014,6 +2403,15 @@ static int __split_vma(struct mm_struct
69447 int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
69448 unsigned long addr, int new_below)
69449 {
69450 +
69451 +#ifdef CONFIG_PAX_SEGMEXEC
69452 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
69453 + BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
69454 + if (mm->map_count >= sysctl_max_map_count-1)
69455 + return -ENOMEM;
69456 + } else
69457 +#endif
69458 +
69459 if (mm->map_count >= sysctl_max_map_count)
69460 return -ENOMEM;
69461
69462 @@ -2025,11 +2423,30 @@ int split_vma(struct mm_struct *mm, stru
69463 * work. This now handles partial unmappings.
69464 * Jeremy Fitzhardinge <jeremy@goop.org>
69465 */
69466 +#ifdef CONFIG_PAX_SEGMEXEC
69467 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
69468 {
69469 + int ret = __do_munmap(mm, start, len);
69470 + if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
69471 + return ret;
69472 +
69473 + return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
69474 +}
69475 +
69476 +int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
69477 +#else
69478 +int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
69479 +#endif
69480 +{
69481 unsigned long end;
69482 struct vm_area_struct *vma, *prev, *last;
69483
69484 + /*
69485 + * mm->mmap_sem is required to protect against another thread
69486 + * changing the mappings in case we sleep.
69487 + */
69488 + verify_mm_writelocked(mm);
69489 +
69490 if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
69491 return -EINVAL;
69492
69493 @@ -2104,6 +2521,8 @@ int do_munmap(struct mm_struct *mm, unsi
69494 /* Fix up all other VM information */
69495 remove_vma_list(mm, vma);
69496
69497 + track_exec_limit(mm, start, end, 0UL);
69498 +
69499 return 0;
69500 }
69501
69502 @@ -2116,22 +2535,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
69503
69504 profile_munmap(addr);
69505
69506 +#ifdef CONFIG_PAX_SEGMEXEC
69507 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
69508 + (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
69509 + return -EINVAL;
69510 +#endif
69511 +
69512 down_write(&mm->mmap_sem);
69513 ret = do_munmap(mm, addr, len);
69514 up_write(&mm->mmap_sem);
69515 return ret;
69516 }
69517
69518 -static inline void verify_mm_writelocked(struct mm_struct *mm)
69519 -{
69520 -#ifdef CONFIG_DEBUG_VM
69521 - if (unlikely(down_read_trylock(&mm->mmap_sem))) {
69522 - WARN_ON(1);
69523 - up_read(&mm->mmap_sem);
69524 - }
69525 -#endif
69526 -}
69527 -
69528 /*
69529 * this is really a simplified "do_mmap". it only handles
69530 * anonymous maps. eventually we may be able to do some
69531 @@ -2145,6 +2560,7 @@ unsigned long do_brk(unsigned long addr,
69532 struct rb_node ** rb_link, * rb_parent;
69533 pgoff_t pgoff = addr >> PAGE_SHIFT;
69534 int error;
69535 + unsigned long charged;
69536
69537 len = PAGE_ALIGN(len);
69538 if (!len)
69539 @@ -2156,16 +2572,30 @@ unsigned long do_brk(unsigned long addr,
69540
69541 flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
69542
69543 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
69544 + if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
69545 + flags &= ~VM_EXEC;
69546 +
69547 +#ifdef CONFIG_PAX_MPROTECT
69548 + if (mm->pax_flags & MF_PAX_MPROTECT)
69549 + flags &= ~VM_MAYEXEC;
69550 +#endif
69551 +
69552 + }
69553 +#endif
69554 +
69555 error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
69556 if (error & ~PAGE_MASK)
69557 return error;
69558
69559 + charged = len >> PAGE_SHIFT;
69560 +
69561 /*
69562 * mlock MCL_FUTURE?
69563 */
69564 if (mm->def_flags & VM_LOCKED) {
69565 unsigned long locked, lock_limit;
69566 - locked = len >> PAGE_SHIFT;
69567 + locked = charged;
69568 locked += mm->locked_vm;
69569 lock_limit = rlimit(RLIMIT_MEMLOCK);
69570 lock_limit >>= PAGE_SHIFT;
69571 @@ -2182,22 +2612,22 @@ unsigned long do_brk(unsigned long addr,
69572 /*
69573 * Clear old maps. this also does some error checking for us
69574 */
69575 - munmap_back:
69576 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
69577 if (vma && vma->vm_start < addr + len) {
69578 if (do_munmap(mm, addr, len))
69579 return -ENOMEM;
69580 - goto munmap_back;
69581 + vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
69582 + BUG_ON(vma && vma->vm_start < addr + len);
69583 }
69584
69585 /* Check against address space limits *after* clearing old maps... */
69586 - if (!may_expand_vm(mm, len >> PAGE_SHIFT))
69587 + if (!may_expand_vm(mm, charged))
69588 return -ENOMEM;
69589
69590 if (mm->map_count > sysctl_max_map_count)
69591 return -ENOMEM;
69592
69593 - if (security_vm_enough_memory(len >> PAGE_SHIFT))
69594 + if (security_vm_enough_memory(charged))
69595 return -ENOMEM;
69596
69597 /* Can we just expand an old private anonymous mapping? */
69598 @@ -2211,7 +2641,7 @@ unsigned long do_brk(unsigned long addr,
69599 */
69600 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
69601 if (!vma) {
69602 - vm_unacct_memory(len >> PAGE_SHIFT);
69603 + vm_unacct_memory(charged);
69604 return -ENOMEM;
69605 }
69606
69607 @@ -2225,11 +2655,12 @@ unsigned long do_brk(unsigned long addr,
69608 vma_link(mm, vma, prev, rb_link, rb_parent);
69609 out:
69610 perf_event_mmap(vma);
69611 - mm->total_vm += len >> PAGE_SHIFT;
69612 + mm->total_vm += charged;
69613 if (flags & VM_LOCKED) {
69614 if (!mlock_vma_pages_range(vma, addr, addr + len))
69615 - mm->locked_vm += (len >> PAGE_SHIFT);
69616 + mm->locked_vm += charged;
69617 }
69618 + track_exec_limit(mm, addr, addr + len, flags);
69619 return addr;
69620 }
69621
69622 @@ -2276,8 +2707,10 @@ void exit_mmap(struct mm_struct *mm)
69623 * Walk the list again, actually closing and freeing it,
69624 * with preemption enabled, without holding any MM locks.
69625 */
69626 - while (vma)
69627 + while (vma) {
69628 + vma->vm_mirror = NULL;
69629 vma = remove_vma(vma);
69630 + }
69631
69632 BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
69633 }
69634 @@ -2291,6 +2724,13 @@ int insert_vm_struct(struct mm_struct *
69635 struct vm_area_struct * __vma, * prev;
69636 struct rb_node ** rb_link, * rb_parent;
69637
69638 +#ifdef CONFIG_PAX_SEGMEXEC
69639 + struct vm_area_struct *vma_m = NULL;
69640 +#endif
69641 +
69642 + if (security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1))
69643 + return -EPERM;
69644 +
69645 /*
69646 * The vm_pgoff of a purely anonymous vma should be irrelevant
69647 * until its first write fault, when page's anon_vma and index
69648 @@ -2313,7 +2753,22 @@ int insert_vm_struct(struct mm_struct *
69649 if ((vma->vm_flags & VM_ACCOUNT) &&
69650 security_vm_enough_memory_mm(mm, vma_pages(vma)))
69651 return -ENOMEM;
69652 +
69653 +#ifdef CONFIG_PAX_SEGMEXEC
69654 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
69655 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
69656 + if (!vma_m)
69657 + return -ENOMEM;
69658 + }
69659 +#endif
69660 +
69661 vma_link(mm, vma, prev, rb_link, rb_parent);
69662 +
69663 +#ifdef CONFIG_PAX_SEGMEXEC
69664 + if (vma_m)
69665 + BUG_ON(pax_mirror_vma(vma_m, vma));
69666 +#endif
69667 +
69668 return 0;
69669 }
69670
69671 @@ -2331,6 +2786,8 @@ struct vm_area_struct *copy_vma(struct v
69672 struct rb_node **rb_link, *rb_parent;
69673 struct mempolicy *pol;
69674
69675 + BUG_ON(vma->vm_mirror);
69676 +
69677 /*
69678 * If anonymous vma has not yet been faulted, update new pgoff
69679 * to match new location, to increase its chance of merging.
69680 @@ -2381,6 +2838,39 @@ struct vm_area_struct *copy_vma(struct v
69681 return NULL;
69682 }
69683
69684 +#ifdef CONFIG_PAX_SEGMEXEC
69685 +long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
69686 +{
69687 + struct vm_area_struct *prev_m;
69688 + struct rb_node **rb_link_m, *rb_parent_m;
69689 + struct mempolicy *pol_m;
69690 +
69691 + BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
69692 + BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
69693 + BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
69694 + *vma_m = *vma;
69695 + INIT_LIST_HEAD(&vma_m->anon_vma_chain);
69696 + if (anon_vma_clone(vma_m, vma))
69697 + return -ENOMEM;
69698 + pol_m = vma_policy(vma_m);
69699 + mpol_get(pol_m);
69700 + vma_set_policy(vma_m, pol_m);
69701 + vma_m->vm_start += SEGMEXEC_TASK_SIZE;
69702 + vma_m->vm_end += SEGMEXEC_TASK_SIZE;
69703 + vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
69704 + vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
69705 + if (vma_m->vm_file)
69706 + get_file(vma_m->vm_file);
69707 + if (vma_m->vm_ops && vma_m->vm_ops->open)
69708 + vma_m->vm_ops->open(vma_m);
69709 + find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
69710 + vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
69711 + vma_m->vm_mirror = vma;
69712 + vma->vm_mirror = vma_m;
69713 + return 0;
69714 +}
69715 +#endif
69716 +
69717 /*
69718 * Return true if the calling process may expand its vm space by the passed
69719 * number of pages
69720 @@ -2391,7 +2881,7 @@ int may_expand_vm(struct mm_struct *mm,
69721 unsigned long lim;
69722
69723 lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
69724 -
69725 + gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
69726 if (cur + npages > lim)
69727 return 0;
69728 return 1;
69729 @@ -2462,6 +2952,22 @@ int install_special_mapping(struct mm_st
69730 vma->vm_start = addr;
69731 vma->vm_end = addr + len;
69732
69733 +#ifdef CONFIG_PAX_MPROTECT
69734 + if (mm->pax_flags & MF_PAX_MPROTECT) {
69735 +#ifndef CONFIG_PAX_MPROTECT_COMPAT
69736 + if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
69737 + return -EPERM;
69738 + if (!(vm_flags & VM_EXEC))
69739 + vm_flags &= ~VM_MAYEXEC;
69740 +#else
69741 + if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
69742 + vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
69743 +#endif
69744 + else
69745 + vm_flags &= ~VM_MAYWRITE;
69746 + }
69747 +#endif
69748 +
69749 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
69750 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
69751
69752 diff -urNp linux-3.0.8/mm/mprotect.c linux-3.0.8/mm/mprotect.c
69753 --- linux-3.0.8/mm/mprotect.c 2011-07-21 22:17:23.000000000 -0400
69754 +++ linux-3.0.8/mm/mprotect.c 2011-08-23 21:48:14.000000000 -0400
69755 @@ -23,10 +23,16 @@
69756 #include <linux/mmu_notifier.h>
69757 #include <linux/migrate.h>
69758 #include <linux/perf_event.h>
69759 +
69760 +#ifdef CONFIG_PAX_MPROTECT
69761 +#include <linux/elf.h>
69762 +#endif
69763 +
69764 #include <asm/uaccess.h>
69765 #include <asm/pgtable.h>
69766 #include <asm/cacheflush.h>
69767 #include <asm/tlbflush.h>
69768 +#include <asm/mmu_context.h>
69769
69770 #ifndef pgprot_modify
69771 static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
69772 @@ -141,6 +147,48 @@ static void change_protection(struct vm_
69773 flush_tlb_range(vma, start, end);
69774 }
69775
69776 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
69777 +/* called while holding the mmap semaphor for writing except stack expansion */
69778 +void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
69779 +{
69780 + unsigned long oldlimit, newlimit = 0UL;
69781 +
69782 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || (__supported_pte_mask & _PAGE_NX))
69783 + return;
69784 +
69785 + spin_lock(&mm->page_table_lock);
69786 + oldlimit = mm->context.user_cs_limit;
69787 + if ((prot & VM_EXEC) && oldlimit < end)
69788 + /* USER_CS limit moved up */
69789 + newlimit = end;
69790 + else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
69791 + /* USER_CS limit moved down */
69792 + newlimit = start;
69793 +
69794 + if (newlimit) {
69795 + mm->context.user_cs_limit = newlimit;
69796 +
69797 +#ifdef CONFIG_SMP
69798 + wmb();
69799 + cpus_clear(mm->context.cpu_user_cs_mask);
69800 + cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
69801 +#endif
69802 +
69803 + set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
69804 + }
69805 + spin_unlock(&mm->page_table_lock);
69806 + if (newlimit == end) {
69807 + struct vm_area_struct *vma = find_vma(mm, oldlimit);
69808 +
69809 + for (; vma && vma->vm_start < end; vma = vma->vm_next)
69810 + if (is_vm_hugetlb_page(vma))
69811 + hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
69812 + else
69813 + change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
69814 + }
69815 +}
69816 +#endif
69817 +
69818 int
69819 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
69820 unsigned long start, unsigned long end, unsigned long newflags)
69821 @@ -153,11 +201,29 @@ mprotect_fixup(struct vm_area_struct *vm
69822 int error;
69823 int dirty_accountable = 0;
69824
69825 +#ifdef CONFIG_PAX_SEGMEXEC
69826 + struct vm_area_struct *vma_m = NULL;
69827 + unsigned long start_m, end_m;
69828 +
69829 + start_m = start + SEGMEXEC_TASK_SIZE;
69830 + end_m = end + SEGMEXEC_TASK_SIZE;
69831 +#endif
69832 +
69833 if (newflags == oldflags) {
69834 *pprev = vma;
69835 return 0;
69836 }
69837
69838 + if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
69839 + struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
69840 +
69841 + if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
69842 + return -ENOMEM;
69843 +
69844 + if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
69845 + return -ENOMEM;
69846 + }
69847 +
69848 /*
69849 * If we make a private mapping writable we increase our commit;
69850 * but (without finer accounting) cannot reduce our commit if we
69851 @@ -174,6 +240,42 @@ mprotect_fixup(struct vm_area_struct *vm
69852 }
69853 }
69854
69855 +#ifdef CONFIG_PAX_SEGMEXEC
69856 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
69857 + if (start != vma->vm_start) {
69858 + error = split_vma(mm, vma, start, 1);
69859 + if (error)
69860 + goto fail;
69861 + BUG_ON(!*pprev || (*pprev)->vm_next == vma);
69862 + *pprev = (*pprev)->vm_next;
69863 + }
69864 +
69865 + if (end != vma->vm_end) {
69866 + error = split_vma(mm, vma, end, 0);
69867 + if (error)
69868 + goto fail;
69869 + }
69870 +
69871 + if (pax_find_mirror_vma(vma)) {
69872 + error = __do_munmap(mm, start_m, end_m - start_m);
69873 + if (error)
69874 + goto fail;
69875 + } else {
69876 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
69877 + if (!vma_m) {
69878 + error = -ENOMEM;
69879 + goto fail;
69880 + }
69881 + vma->vm_flags = newflags;
69882 + error = pax_mirror_vma(vma_m, vma);
69883 + if (error) {
69884 + vma->vm_flags = oldflags;
69885 + goto fail;
69886 + }
69887 + }
69888 + }
69889 +#endif
69890 +
69891 /*
69892 * First try to merge with previous and/or next vma.
69893 */
69894 @@ -204,9 +306,21 @@ success:
69895 * vm_flags and vm_page_prot are protected by the mmap_sem
69896 * held in write mode.
69897 */
69898 +
69899 +#ifdef CONFIG_PAX_SEGMEXEC
69900 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
69901 + pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
69902 +#endif
69903 +
69904 vma->vm_flags = newflags;
69905 +
69906 +#ifdef CONFIG_PAX_MPROTECT
69907 + if (mm->binfmt && mm->binfmt->handle_mprotect)
69908 + mm->binfmt->handle_mprotect(vma, newflags);
69909 +#endif
69910 +
69911 vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
69912 - vm_get_page_prot(newflags));
69913 + vm_get_page_prot(vma->vm_flags));
69914
69915 if (vma_wants_writenotify(vma)) {
69916 vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
69917 @@ -248,6 +362,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
69918 end = start + len;
69919 if (end <= start)
69920 return -ENOMEM;
69921 +
69922 +#ifdef CONFIG_PAX_SEGMEXEC
69923 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
69924 + if (end > SEGMEXEC_TASK_SIZE)
69925 + return -EINVAL;
69926 + } else
69927 +#endif
69928 +
69929 + if (end > TASK_SIZE)
69930 + return -EINVAL;
69931 +
69932 if (!arch_validate_prot(prot))
69933 return -EINVAL;
69934
69935 @@ -255,7 +380,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
69936 /*
69937 * Does the application expect PROT_READ to imply PROT_EXEC:
69938 */
69939 - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
69940 + if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
69941 prot |= PROT_EXEC;
69942
69943 vm_flags = calc_vm_prot_bits(prot);
69944 @@ -287,6 +412,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
69945 if (start > vma->vm_start)
69946 prev = vma;
69947
69948 +#ifdef CONFIG_PAX_MPROTECT
69949 + if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
69950 + current->mm->binfmt->handle_mprotect(vma, vm_flags);
69951 +#endif
69952 +
69953 for (nstart = start ; ; ) {
69954 unsigned long newflags;
69955
69956 @@ -296,6 +426,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
69957
69958 /* newflags >> 4 shift VM_MAY% in place of VM_% */
69959 if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
69960 + if (prot & (PROT_WRITE | PROT_EXEC))
69961 + gr_log_rwxmprotect(vma->vm_file);
69962 +
69963 + error = -EACCES;
69964 + goto out;
69965 + }
69966 +
69967 + if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
69968 error = -EACCES;
69969 goto out;
69970 }
69971 @@ -310,6 +448,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
69972 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
69973 if (error)
69974 goto out;
69975 +
69976 + track_exec_limit(current->mm, nstart, tmp, vm_flags);
69977 +
69978 nstart = tmp;
69979
69980 if (nstart < prev->vm_end)
69981 diff -urNp linux-3.0.8/mm/mremap.c linux-3.0.8/mm/mremap.c
69982 --- linux-3.0.8/mm/mremap.c 2011-07-21 22:17:23.000000000 -0400
69983 +++ linux-3.0.8/mm/mremap.c 2011-08-23 21:47:56.000000000 -0400
69984 @@ -113,6 +113,12 @@ static void move_ptes(struct vm_area_str
69985 continue;
69986 pte = ptep_clear_flush(vma, old_addr, old_pte);
69987 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
69988 +
69989 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
69990 + if (!(__supported_pte_mask & _PAGE_NX) && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
69991 + pte = pte_exprotect(pte);
69992 +#endif
69993 +
69994 set_pte_at(mm, new_addr, new_pte, pte);
69995 }
69996
69997 @@ -272,6 +278,11 @@ static struct vm_area_struct *vma_to_res
69998 if (is_vm_hugetlb_page(vma))
69999 goto Einval;
70000
70001 +#ifdef CONFIG_PAX_SEGMEXEC
70002 + if (pax_find_mirror_vma(vma))
70003 + goto Einval;
70004 +#endif
70005 +
70006 /* We can't remap across vm area boundaries */
70007 if (old_len > vma->vm_end - addr)
70008 goto Efault;
70009 @@ -328,20 +339,25 @@ static unsigned long mremap_to(unsigned
70010 unsigned long ret = -EINVAL;
70011 unsigned long charged = 0;
70012 unsigned long map_flags;
70013 + unsigned long pax_task_size = TASK_SIZE;
70014
70015 if (new_addr & ~PAGE_MASK)
70016 goto out;
70017
70018 - if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
70019 +#ifdef CONFIG_PAX_SEGMEXEC
70020 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
70021 + pax_task_size = SEGMEXEC_TASK_SIZE;
70022 +#endif
70023 +
70024 + pax_task_size -= PAGE_SIZE;
70025 +
70026 + if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
70027 goto out;
70028
70029 /* Check if the location we're moving into overlaps the
70030 * old location at all, and fail if it does.
70031 */
70032 - if ((new_addr <= addr) && (new_addr+new_len) > addr)
70033 - goto out;
70034 -
70035 - if ((addr <= new_addr) && (addr+old_len) > new_addr)
70036 + if (addr + old_len > new_addr && new_addr + new_len > addr)
70037 goto out;
70038
70039 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
70040 @@ -413,6 +429,7 @@ unsigned long do_mremap(unsigned long ad
70041 struct vm_area_struct *vma;
70042 unsigned long ret = -EINVAL;
70043 unsigned long charged = 0;
70044 + unsigned long pax_task_size = TASK_SIZE;
70045
70046 if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
70047 goto out;
70048 @@ -431,6 +448,17 @@ unsigned long do_mremap(unsigned long ad
70049 if (!new_len)
70050 goto out;
70051
70052 +#ifdef CONFIG_PAX_SEGMEXEC
70053 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
70054 + pax_task_size = SEGMEXEC_TASK_SIZE;
70055 +#endif
70056 +
70057 + pax_task_size -= PAGE_SIZE;
70058 +
70059 + if (new_len > pax_task_size || addr > pax_task_size-new_len ||
70060 + old_len > pax_task_size || addr > pax_task_size-old_len)
70061 + goto out;
70062 +
70063 if (flags & MREMAP_FIXED) {
70064 if (flags & MREMAP_MAYMOVE)
70065 ret = mremap_to(addr, old_len, new_addr, new_len);
70066 @@ -480,6 +508,7 @@ unsigned long do_mremap(unsigned long ad
70067 addr + new_len);
70068 }
70069 ret = addr;
70070 + track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
70071 goto out;
70072 }
70073 }
70074 @@ -506,7 +535,13 @@ unsigned long do_mremap(unsigned long ad
70075 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
70076 if (ret)
70077 goto out;
70078 +
70079 + map_flags = vma->vm_flags;
70080 ret = move_vma(vma, addr, old_len, new_len, new_addr);
70081 + if (!(ret & ~PAGE_MASK)) {
70082 + track_exec_limit(current->mm, addr, addr + old_len, 0UL);
70083 + track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
70084 + }
70085 }
70086 out:
70087 if (ret & ~PAGE_MASK)
70088 diff -urNp linux-3.0.8/mm/nobootmem.c linux-3.0.8/mm/nobootmem.c
70089 --- linux-3.0.8/mm/nobootmem.c 2011-07-21 22:17:23.000000000 -0400
70090 +++ linux-3.0.8/mm/nobootmem.c 2011-08-23 21:47:56.000000000 -0400
70091 @@ -110,19 +110,30 @@ static void __init __free_pages_memory(u
70092 unsigned long __init free_all_memory_core_early(int nodeid)
70093 {
70094 int i;
70095 - u64 start, end;
70096 + u64 start, end, startrange, endrange;
70097 unsigned long count = 0;
70098 - struct range *range = NULL;
70099 + struct range *range = NULL, rangerange = { 0, 0 };
70100 int nr_range;
70101
70102 nr_range = get_free_all_memory_range(&range, nodeid);
70103 + startrange = __pa(range) >> PAGE_SHIFT;
70104 + endrange = (__pa(range + nr_range) - 1) >> PAGE_SHIFT;
70105
70106 for (i = 0; i < nr_range; i++) {
70107 start = range[i].start;
70108 end = range[i].end;
70109 + if (start <= endrange && startrange < end) {
70110 + BUG_ON(rangerange.start | rangerange.end);
70111 + rangerange = range[i];
70112 + continue;
70113 + }
70114 count += end - start;
70115 __free_pages_memory(start, end);
70116 }
70117 + start = rangerange.start;
70118 + end = rangerange.end;
70119 + count += end - start;
70120 + __free_pages_memory(start, end);
70121
70122 return count;
70123 }
70124 diff -urNp linux-3.0.8/mm/nommu.c linux-3.0.8/mm/nommu.c
70125 --- linux-3.0.8/mm/nommu.c 2011-07-21 22:17:23.000000000 -0400
70126 +++ linux-3.0.8/mm/nommu.c 2011-08-23 21:47:56.000000000 -0400
70127 @@ -63,7 +63,6 @@ int sysctl_overcommit_memory = OVERCOMMI
70128 int sysctl_overcommit_ratio = 50; /* default is 50% */
70129 int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
70130 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
70131 -int heap_stack_gap = 0;
70132
70133 atomic_long_t mmap_pages_allocated;
70134
70135 @@ -826,15 +825,6 @@ struct vm_area_struct *find_vma(struct m
70136 EXPORT_SYMBOL(find_vma);
70137
70138 /*
70139 - * find a VMA
70140 - * - we don't extend stack VMAs under NOMMU conditions
70141 - */
70142 -struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
70143 -{
70144 - return find_vma(mm, addr);
70145 -}
70146 -
70147 -/*
70148 * expand a stack to a given address
70149 * - not supported under NOMMU conditions
70150 */
70151 @@ -1554,6 +1544,7 @@ int split_vma(struct mm_struct *mm, stru
70152
70153 /* most fields are the same, copy all, and then fixup */
70154 *new = *vma;
70155 + INIT_LIST_HEAD(&new->anon_vma_chain);
70156 *region = *vma->vm_region;
70157 new->vm_region = region;
70158
70159 diff -urNp linux-3.0.8/mm/page_alloc.c linux-3.0.8/mm/page_alloc.c
70160 --- linux-3.0.8/mm/page_alloc.c 2011-10-24 08:05:30.000000000 -0400
70161 +++ linux-3.0.8/mm/page_alloc.c 2011-10-25 09:15:11.000000000 -0400
70162 @@ -340,7 +340,7 @@ out:
70163 * This usage means that zero-order pages may not be compound.
70164 */
70165
70166 -static void free_compound_page(struct page *page)
70167 +void free_compound_page(struct page *page)
70168 {
70169 __free_pages_ok(page, compound_order(page));
70170 }
70171 @@ -653,6 +653,10 @@ static bool free_pages_prepare(struct pa
70172 int i;
70173 int bad = 0;
70174
70175 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
70176 + unsigned long index = 1UL << order;
70177 +#endif
70178 +
70179 trace_mm_page_free_direct(page, order);
70180 kmemcheck_free_shadow(page, order);
70181
70182 @@ -668,6 +672,12 @@ static bool free_pages_prepare(struct pa
70183 debug_check_no_obj_freed(page_address(page),
70184 PAGE_SIZE << order);
70185 }
70186 +
70187 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
70188 + for (; index; --index)
70189 + sanitize_highpage(page + index - 1);
70190 +#endif
70191 +
70192 arch_free_page(page, order);
70193 kernel_map_pages(page, 1 << order, 0);
70194
70195 @@ -783,8 +793,10 @@ static int prep_new_page(struct page *pa
70196 arch_alloc_page(page, order);
70197 kernel_map_pages(page, 1 << order, 1);
70198
70199 +#ifndef CONFIG_PAX_MEMORY_SANITIZE
70200 if (gfp_flags & __GFP_ZERO)
70201 prep_zero_page(page, order, gfp_flags);
70202 +#endif
70203
70204 if (order && (gfp_flags & __GFP_COMP))
70205 prep_compound_page(page, order);
70206 @@ -2557,6 +2569,8 @@ void show_free_areas(unsigned int filter
70207 int cpu;
70208 struct zone *zone;
70209
70210 + pax_track_stack();
70211 +
70212 for_each_populated_zone(zone) {
70213 if (skip_free_areas_node(filter, zone_to_nid(zone)))
70214 continue;
70215 @@ -3368,7 +3382,13 @@ static int pageblock_is_reserved(unsigne
70216 unsigned long pfn;
70217
70218 for (pfn = start_pfn; pfn < end_pfn; pfn++) {
70219 +#ifdef CONFIG_X86_32
70220 + /* boot failures in VMware 8 on 32bit vanilla since
70221 + this change */
70222 + if (!pfn_valid(pfn) || PageReserved(pfn_to_page(pfn)))
70223 +#else
70224 if (!pfn_valid_within(pfn) || PageReserved(pfn_to_page(pfn)))
70225 +#endif
70226 return 1;
70227 }
70228 return 0;
70229 diff -urNp linux-3.0.8/mm/percpu.c linux-3.0.8/mm/percpu.c
70230 --- linux-3.0.8/mm/percpu.c 2011-07-21 22:17:23.000000000 -0400
70231 +++ linux-3.0.8/mm/percpu.c 2011-08-23 21:47:56.000000000 -0400
70232 @@ -121,7 +121,7 @@ static unsigned int pcpu_first_unit_cpu
70233 static unsigned int pcpu_last_unit_cpu __read_mostly;
70234
70235 /* the address of the first chunk which starts with the kernel static area */
70236 -void *pcpu_base_addr __read_mostly;
70237 +void *pcpu_base_addr __read_only;
70238 EXPORT_SYMBOL_GPL(pcpu_base_addr);
70239
70240 static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
70241 diff -urNp linux-3.0.8/mm/rmap.c linux-3.0.8/mm/rmap.c
70242 --- linux-3.0.8/mm/rmap.c 2011-07-21 22:17:23.000000000 -0400
70243 +++ linux-3.0.8/mm/rmap.c 2011-08-23 21:47:56.000000000 -0400
70244 @@ -153,6 +153,10 @@ int anon_vma_prepare(struct vm_area_stru
70245 struct anon_vma *anon_vma = vma->anon_vma;
70246 struct anon_vma_chain *avc;
70247
70248 +#ifdef CONFIG_PAX_SEGMEXEC
70249 + struct anon_vma_chain *avc_m = NULL;
70250 +#endif
70251 +
70252 might_sleep();
70253 if (unlikely(!anon_vma)) {
70254 struct mm_struct *mm = vma->vm_mm;
70255 @@ -162,6 +166,12 @@ int anon_vma_prepare(struct vm_area_stru
70256 if (!avc)
70257 goto out_enomem;
70258
70259 +#ifdef CONFIG_PAX_SEGMEXEC
70260 + avc_m = anon_vma_chain_alloc(GFP_KERNEL);
70261 + if (!avc_m)
70262 + goto out_enomem_free_avc;
70263 +#endif
70264 +
70265 anon_vma = find_mergeable_anon_vma(vma);
70266 allocated = NULL;
70267 if (!anon_vma) {
70268 @@ -175,6 +185,21 @@ int anon_vma_prepare(struct vm_area_stru
70269 /* page_table_lock to protect against threads */
70270 spin_lock(&mm->page_table_lock);
70271 if (likely(!vma->anon_vma)) {
70272 +
70273 +#ifdef CONFIG_PAX_SEGMEXEC
70274 + struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
70275 +
70276 + if (vma_m) {
70277 + BUG_ON(vma_m->anon_vma);
70278 + vma_m->anon_vma = anon_vma;
70279 + avc_m->anon_vma = anon_vma;
70280 + avc_m->vma = vma;
70281 + list_add(&avc_m->same_vma, &vma_m->anon_vma_chain);
70282 + list_add(&avc_m->same_anon_vma, &anon_vma->head);
70283 + avc_m = NULL;
70284 + }
70285 +#endif
70286 +
70287 vma->anon_vma = anon_vma;
70288 avc->anon_vma = anon_vma;
70289 avc->vma = vma;
70290 @@ -188,12 +213,24 @@ int anon_vma_prepare(struct vm_area_stru
70291
70292 if (unlikely(allocated))
70293 put_anon_vma(allocated);
70294 +
70295 +#ifdef CONFIG_PAX_SEGMEXEC
70296 + if (unlikely(avc_m))
70297 + anon_vma_chain_free(avc_m);
70298 +#endif
70299 +
70300 if (unlikely(avc))
70301 anon_vma_chain_free(avc);
70302 }
70303 return 0;
70304
70305 out_enomem_free_avc:
70306 +
70307 +#ifdef CONFIG_PAX_SEGMEXEC
70308 + if (avc_m)
70309 + anon_vma_chain_free(avc_m);
70310 +#endif
70311 +
70312 anon_vma_chain_free(avc);
70313 out_enomem:
70314 return -ENOMEM;
70315 @@ -244,7 +281,7 @@ static void anon_vma_chain_link(struct v
70316 * Attach the anon_vmas from src to dst.
70317 * Returns 0 on success, -ENOMEM on failure.
70318 */
70319 -int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
70320 +int anon_vma_clone(struct vm_area_struct *dst, const struct vm_area_struct *src)
70321 {
70322 struct anon_vma_chain *avc, *pavc;
70323 struct anon_vma *root = NULL;
70324 @@ -277,7 +314,7 @@ int anon_vma_clone(struct vm_area_struct
70325 * the corresponding VMA in the parent process is attached to.
70326 * Returns 0 on success, non-zero on failure.
70327 */
70328 -int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
70329 +int anon_vma_fork(struct vm_area_struct *vma, const struct vm_area_struct *pvma)
70330 {
70331 struct anon_vma_chain *avc;
70332 struct anon_vma *anon_vma;
70333 diff -urNp linux-3.0.8/mm/shmem.c linux-3.0.8/mm/shmem.c
70334 --- linux-3.0.8/mm/shmem.c 2011-07-21 22:17:23.000000000 -0400
70335 +++ linux-3.0.8/mm/shmem.c 2011-08-23 21:48:14.000000000 -0400
70336 @@ -31,7 +31,7 @@
70337 #include <linux/percpu_counter.h>
70338 #include <linux/swap.h>
70339
70340 -static struct vfsmount *shm_mnt;
70341 +struct vfsmount *shm_mnt;
70342
70343 #ifdef CONFIG_SHMEM
70344 /*
70345 @@ -1101,6 +1101,8 @@ static int shmem_writepage(struct page *
70346 goto unlock;
70347 }
70348 entry = shmem_swp_entry(info, index, NULL);
70349 + if (!entry)
70350 + goto unlock;
70351 if (entry->val) {
70352 /*
70353 * The more uptodate page coming down from a stacked
70354 @@ -1172,6 +1174,8 @@ static struct page *shmem_swapin(swp_ent
70355 struct vm_area_struct pvma;
70356 struct page *page;
70357
70358 + pax_track_stack();
70359 +
70360 spol = mpol_cond_copy(&mpol,
70361 mpol_shared_policy_lookup(&info->policy, idx));
70362
70363 @@ -2568,8 +2572,7 @@ int shmem_fill_super(struct super_block
70364 int err = -ENOMEM;
70365
70366 /* Round up to L1_CACHE_BYTES to resist false sharing */
70367 - sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
70368 - L1_CACHE_BYTES), GFP_KERNEL);
70369 + sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
70370 if (!sbinfo)
70371 return -ENOMEM;
70372
70373 diff -urNp linux-3.0.8/mm/slab.c linux-3.0.8/mm/slab.c
70374 --- linux-3.0.8/mm/slab.c 2011-07-21 22:17:23.000000000 -0400
70375 +++ linux-3.0.8/mm/slab.c 2011-08-23 21:48:14.000000000 -0400
70376 @@ -151,7 +151,7 @@
70377
70378 /* Legal flag mask for kmem_cache_create(). */
70379 #if DEBUG
70380 -# define CREATE_MASK (SLAB_RED_ZONE | \
70381 +# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
70382 SLAB_POISON | SLAB_HWCACHE_ALIGN | \
70383 SLAB_CACHE_DMA | \
70384 SLAB_STORE_USER | \
70385 @@ -159,7 +159,7 @@
70386 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
70387 SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
70388 #else
70389 -# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
70390 +# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
70391 SLAB_CACHE_DMA | \
70392 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
70393 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
70394 @@ -288,7 +288,7 @@ struct kmem_list3 {
70395 * Need this for bootstrapping a per node allocator.
70396 */
70397 #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
70398 -static struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
70399 +static struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
70400 #define CACHE_CACHE 0
70401 #define SIZE_AC MAX_NUMNODES
70402 #define SIZE_L3 (2 * MAX_NUMNODES)
70403 @@ -389,10 +389,10 @@ static void kmem_list3_init(struct kmem_
70404 if ((x)->max_freeable < i) \
70405 (x)->max_freeable = i; \
70406 } while (0)
70407 -#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
70408 -#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
70409 -#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
70410 -#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
70411 +#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
70412 +#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
70413 +#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
70414 +#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
70415 #else
70416 #define STATS_INC_ACTIVE(x) do { } while (0)
70417 #define STATS_DEC_ACTIVE(x) do { } while (0)
70418 @@ -538,7 +538,7 @@ static inline void *index_to_obj(struct
70419 * reciprocal_divide(offset, cache->reciprocal_buffer_size)
70420 */
70421 static inline unsigned int obj_to_index(const struct kmem_cache *cache,
70422 - const struct slab *slab, void *obj)
70423 + const struct slab *slab, const void *obj)
70424 {
70425 u32 offset = (obj - slab->s_mem);
70426 return reciprocal_divide(offset, cache->reciprocal_buffer_size);
70427 @@ -564,7 +564,7 @@ struct cache_names {
70428 static struct cache_names __initdata cache_names[] = {
70429 #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
70430 #include <linux/kmalloc_sizes.h>
70431 - {NULL,}
70432 + {NULL}
70433 #undef CACHE
70434 };
70435
70436 @@ -1530,7 +1530,7 @@ void __init kmem_cache_init(void)
70437 sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
70438 sizes[INDEX_AC].cs_size,
70439 ARCH_KMALLOC_MINALIGN,
70440 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
70441 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
70442 NULL);
70443
70444 if (INDEX_AC != INDEX_L3) {
70445 @@ -1538,7 +1538,7 @@ void __init kmem_cache_init(void)
70446 kmem_cache_create(names[INDEX_L3].name,
70447 sizes[INDEX_L3].cs_size,
70448 ARCH_KMALLOC_MINALIGN,
70449 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
70450 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
70451 NULL);
70452 }
70453
70454 @@ -1556,7 +1556,7 @@ void __init kmem_cache_init(void)
70455 sizes->cs_cachep = kmem_cache_create(names->name,
70456 sizes->cs_size,
70457 ARCH_KMALLOC_MINALIGN,
70458 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
70459 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
70460 NULL);
70461 }
70462 #ifdef CONFIG_ZONE_DMA
70463 @@ -4272,10 +4272,10 @@ static int s_show(struct seq_file *m, vo
70464 }
70465 /* cpu stats */
70466 {
70467 - unsigned long allochit = atomic_read(&cachep->allochit);
70468 - unsigned long allocmiss = atomic_read(&cachep->allocmiss);
70469 - unsigned long freehit = atomic_read(&cachep->freehit);
70470 - unsigned long freemiss = atomic_read(&cachep->freemiss);
70471 + unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
70472 + unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
70473 + unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
70474 + unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
70475
70476 seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
70477 allochit, allocmiss, freehit, freemiss);
70478 @@ -4532,15 +4532,66 @@ static const struct file_operations proc
70479
70480 static int __init slab_proc_init(void)
70481 {
70482 - proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
70483 + mode_t gr_mode = S_IRUGO;
70484 +
70485 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
70486 + gr_mode = S_IRUSR;
70487 +#endif
70488 +
70489 + proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
70490 #ifdef CONFIG_DEBUG_SLAB_LEAK
70491 - proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
70492 + proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
70493 #endif
70494 return 0;
70495 }
70496 module_init(slab_proc_init);
70497 #endif
70498
70499 +void check_object_size(const void *ptr, unsigned long n, bool to)
70500 +{
70501 +
70502 +#ifdef CONFIG_PAX_USERCOPY
70503 + struct page *page;
70504 + struct kmem_cache *cachep = NULL;
70505 + struct slab *slabp;
70506 + unsigned int objnr;
70507 + unsigned long offset;
70508 +
70509 + if (!n)
70510 + return;
70511 +
70512 + if (ZERO_OR_NULL_PTR(ptr))
70513 + goto report;
70514 +
70515 + if (!virt_addr_valid(ptr))
70516 + return;
70517 +
70518 + page = virt_to_head_page(ptr);
70519 +
70520 + if (!PageSlab(page)) {
70521 + if (object_is_on_stack(ptr, n) == -1)
70522 + goto report;
70523 + return;
70524 + }
70525 +
70526 + cachep = page_get_cache(page);
70527 + if (!(cachep->flags & SLAB_USERCOPY))
70528 + goto report;
70529 +
70530 + slabp = page_get_slab(page);
70531 + objnr = obj_to_index(cachep, slabp, ptr);
70532 + BUG_ON(objnr >= cachep->num);
70533 + offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
70534 + if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
70535 + return;
70536 +
70537 +report:
70538 + pax_report_usercopy(ptr, n, to, cachep ? cachep->name : NULL);
70539 +#endif
70540 +
70541 +}
70542 +EXPORT_SYMBOL(check_object_size);
70543 +
70544 /**
70545 * ksize - get the actual amount of memory allocated for a given object
70546 * @objp: Pointer to the object
70547 diff -urNp linux-3.0.8/mm/slob.c linux-3.0.8/mm/slob.c
70548 --- linux-3.0.8/mm/slob.c 2011-07-21 22:17:23.000000000 -0400
70549 +++ linux-3.0.8/mm/slob.c 2011-08-23 21:47:56.000000000 -0400
70550 @@ -29,7 +29,7 @@
70551 * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
70552 * alloc_pages() directly, allocating compound pages so the page order
70553 * does not have to be separately tracked, and also stores the exact
70554 - * allocation size in page->private so that it can be used to accurately
70555 + * allocation size in slob_page->size so that it can be used to accurately
70556 * provide ksize(). These objects are detected in kfree() because slob_page()
70557 * is false for them.
70558 *
70559 @@ -58,6 +58,7 @@
70560 */
70561
70562 #include <linux/kernel.h>
70563 +#include <linux/sched.h>
70564 #include <linux/slab.h>
70565 #include <linux/mm.h>
70566 #include <linux/swap.h> /* struct reclaim_state */
70567 @@ -102,7 +103,8 @@ struct slob_page {
70568 unsigned long flags; /* mandatory */
70569 atomic_t _count; /* mandatory */
70570 slobidx_t units; /* free units left in page */
70571 - unsigned long pad[2];
70572 + unsigned long pad[1];
70573 + unsigned long size; /* size when >=PAGE_SIZE */
70574 slob_t *free; /* first free slob_t in page */
70575 struct list_head list; /* linked list of free pages */
70576 };
70577 @@ -135,7 +137,7 @@ static LIST_HEAD(free_slob_large);
70578 */
70579 static inline int is_slob_page(struct slob_page *sp)
70580 {
70581 - return PageSlab((struct page *)sp);
70582 + return PageSlab((struct page *)sp) && !sp->size;
70583 }
70584
70585 static inline void set_slob_page(struct slob_page *sp)
70586 @@ -150,7 +152,7 @@ static inline void clear_slob_page(struc
70587
70588 static inline struct slob_page *slob_page(const void *addr)
70589 {
70590 - return (struct slob_page *)virt_to_page(addr);
70591 + return (struct slob_page *)virt_to_head_page(addr);
70592 }
70593
70594 /*
70595 @@ -210,7 +212,7 @@ static void set_slob(slob_t *s, slobidx_
70596 /*
70597 * Return the size of a slob block.
70598 */
70599 -static slobidx_t slob_units(slob_t *s)
70600 +static slobidx_t slob_units(const slob_t *s)
70601 {
70602 if (s->units > 0)
70603 return s->units;
70604 @@ -220,7 +222,7 @@ static slobidx_t slob_units(slob_t *s)
70605 /*
70606 * Return the next free slob block pointer after this one.
70607 */
70608 -static slob_t *slob_next(slob_t *s)
70609 +static slob_t *slob_next(const slob_t *s)
70610 {
70611 slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
70612 slobidx_t next;
70613 @@ -235,7 +237,7 @@ static slob_t *slob_next(slob_t *s)
70614 /*
70615 * Returns true if s is the last free block in its page.
70616 */
70617 -static int slob_last(slob_t *s)
70618 +static int slob_last(const slob_t *s)
70619 {
70620 return !((unsigned long)slob_next(s) & ~PAGE_MASK);
70621 }
70622 @@ -254,6 +256,7 @@ static void *slob_new_pages(gfp_t gfp, i
70623 if (!page)
70624 return NULL;
70625
70626 + set_slob_page(page);
70627 return page_address(page);
70628 }
70629
70630 @@ -370,11 +373,11 @@ static void *slob_alloc(size_t size, gfp
70631 if (!b)
70632 return NULL;
70633 sp = slob_page(b);
70634 - set_slob_page(sp);
70635
70636 spin_lock_irqsave(&slob_lock, flags);
70637 sp->units = SLOB_UNITS(PAGE_SIZE);
70638 sp->free = b;
70639 + sp->size = 0;
70640 INIT_LIST_HEAD(&sp->list);
70641 set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
70642 set_slob_page_free(sp, slob_list);
70643 @@ -476,10 +479,9 @@ out:
70644 * End of slob allocator proper. Begin kmem_cache_alloc and kmalloc frontend.
70645 */
70646
70647 -void *__kmalloc_node(size_t size, gfp_t gfp, int node)
70648 +static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
70649 {
70650 - unsigned int *m;
70651 - int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
70652 + slob_t *m;
70653 void *ret;
70654
70655 lockdep_trace_alloc(gfp);
70656 @@ -492,7 +494,10 @@ void *__kmalloc_node(size_t size, gfp_t
70657
70658 if (!m)
70659 return NULL;
70660 - *m = size;
70661 + BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
70662 + BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
70663 + m[0].units = size;
70664 + m[1].units = align;
70665 ret = (void *)m + align;
70666
70667 trace_kmalloc_node(_RET_IP_, ret,
70668 @@ -504,16 +509,25 @@ void *__kmalloc_node(size_t size, gfp_t
70669 gfp |= __GFP_COMP;
70670 ret = slob_new_pages(gfp, order, node);
70671 if (ret) {
70672 - struct page *page;
70673 - page = virt_to_page(ret);
70674 - page->private = size;
70675 + struct slob_page *sp;
70676 + sp = slob_page(ret);
70677 + sp->size = size;
70678 }
70679
70680 trace_kmalloc_node(_RET_IP_, ret,
70681 size, PAGE_SIZE << order, gfp, node);
70682 }
70683
70684 - kmemleak_alloc(ret, size, 1, gfp);
70685 + return ret;
70686 +}
70687 +
70688 +void *__kmalloc_node(size_t size, gfp_t gfp, int node)
70689 +{
70690 + int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
70691 + void *ret = __kmalloc_node_align(size, gfp, node, align);
70692 +
70693 + if (!ZERO_OR_NULL_PTR(ret))
70694 + kmemleak_alloc(ret, size, 1, gfp);
70695 return ret;
70696 }
70697 EXPORT_SYMBOL(__kmalloc_node);
70698 @@ -531,13 +545,88 @@ void kfree(const void *block)
70699 sp = slob_page(block);
70700 if (is_slob_page(sp)) {
70701 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
70702 - unsigned int *m = (unsigned int *)(block - align);
70703 - slob_free(m, *m + align);
70704 - } else
70705 + slob_t *m = (slob_t *)(block - align);
70706 + slob_free(m, m[0].units + align);
70707 + } else {
70708 + clear_slob_page(sp);
70709 + free_slob_page(sp);
70710 + sp->size = 0;
70711 put_page(&sp->page);
70712 + }
70713 }
70714 EXPORT_SYMBOL(kfree);
70715
70716 +void check_object_size(const void *ptr, unsigned long n, bool to)
70717 +{
70718 +
70719 +#ifdef CONFIG_PAX_USERCOPY
70720 + struct slob_page *sp;
70721 + const slob_t *free;
70722 + const void *base;
70723 + unsigned long flags;
70724 +
70725 + if (!n)
70726 + return;
70727 +
70728 + if (ZERO_OR_NULL_PTR(ptr))
70729 + goto report;
70730 +
70731 + if (!virt_addr_valid(ptr))
70732 + return;
70733 +
70734 + sp = slob_page(ptr);
70735 + if (!PageSlab((struct page*)sp)) {
70736 + if (object_is_on_stack(ptr, n) == -1)
70737 + goto report;
70738 + return;
70739 + }
70740 +
70741 + if (sp->size) {
70742 + base = page_address(&sp->page);
70743 + if (base <= ptr && n <= sp->size - (ptr - base))
70744 + return;
70745 + goto report;
70746 + }
70747 +
70748 + /* some tricky double walking to find the chunk */
70749 + spin_lock_irqsave(&slob_lock, flags);
70750 + base = (void *)((unsigned long)ptr & PAGE_MASK);
70751 + free = sp->free;
70752 +
70753 + while (!slob_last(free) && (void *)free <= ptr) {
70754 + base = free + slob_units(free);
70755 + free = slob_next(free);
70756 + }
70757 +
70758 + while (base < (void *)free) {
70759 + slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
70760 + int size = SLOB_UNIT * SLOB_UNITS(m + align);
70761 + int offset;
70762 +
70763 + if (ptr < base + align)
70764 + break;
70765 +
70766 + offset = ptr - base - align;
70767 + if (offset >= m) {
70768 + base += size;
70769 + continue;
70770 + }
70771 +
70772 + if (n > m - offset)
70773 + break;
70774 +
70775 + spin_unlock_irqrestore(&slob_lock, flags);
70776 + return;
70777 + }
70778 +
70779 + spin_unlock_irqrestore(&slob_lock, flags);
70780 +report:
70781 + pax_report_usercopy(ptr, n, to, NULL);
70782 +#endif
70783 +
70784 +}
70785 +EXPORT_SYMBOL(check_object_size);
70786 +
70787 /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
70788 size_t ksize(const void *block)
70789 {
70790 @@ -550,10 +639,10 @@ size_t ksize(const void *block)
70791 sp = slob_page(block);
70792 if (is_slob_page(sp)) {
70793 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
70794 - unsigned int *m = (unsigned int *)(block - align);
70795 - return SLOB_UNITS(*m) * SLOB_UNIT;
70796 + slob_t *m = (slob_t *)(block - align);
70797 + return SLOB_UNITS(m[0].units) * SLOB_UNIT;
70798 } else
70799 - return sp->page.private;
70800 + return sp->size;
70801 }
70802 EXPORT_SYMBOL(ksize);
70803
70804 @@ -569,8 +658,13 @@ struct kmem_cache *kmem_cache_create(con
70805 {
70806 struct kmem_cache *c;
70807
70808 +#ifdef CONFIG_PAX_USERCOPY
70809 + c = __kmalloc_node_align(sizeof(struct kmem_cache),
70810 + GFP_KERNEL, -1, ARCH_KMALLOC_MINALIGN);
70811 +#else
70812 c = slob_alloc(sizeof(struct kmem_cache),
70813 GFP_KERNEL, ARCH_KMALLOC_MINALIGN, -1);
70814 +#endif
70815
70816 if (c) {
70817 c->name = name;
70818 @@ -608,17 +702,25 @@ void *kmem_cache_alloc_node(struct kmem_
70819 {
70820 void *b;
70821
70822 +#ifdef CONFIG_PAX_USERCOPY
70823 + b = __kmalloc_node_align(c->size, flags, node, c->align);
70824 +#else
70825 if (c->size < PAGE_SIZE) {
70826 b = slob_alloc(c->size, flags, c->align, node);
70827 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
70828 SLOB_UNITS(c->size) * SLOB_UNIT,
70829 flags, node);
70830 } else {
70831 + struct slob_page *sp;
70832 +
70833 b = slob_new_pages(flags, get_order(c->size), node);
70834 + sp = slob_page(b);
70835 + sp->size = c->size;
70836 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
70837 PAGE_SIZE << get_order(c->size),
70838 flags, node);
70839 }
70840 +#endif
70841
70842 if (c->ctor)
70843 c->ctor(b);
70844 @@ -630,10 +732,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
70845
70846 static void __kmem_cache_free(void *b, int size)
70847 {
70848 - if (size < PAGE_SIZE)
70849 + struct slob_page *sp = slob_page(b);
70850 +
70851 + if (is_slob_page(sp))
70852 slob_free(b, size);
70853 - else
70854 + else {
70855 + clear_slob_page(sp);
70856 + free_slob_page(sp);
70857 + sp->size = 0;
70858 slob_free_pages(b, get_order(size));
70859 + }
70860 }
70861
70862 static void kmem_rcu_free(struct rcu_head *head)
70863 @@ -646,17 +754,31 @@ static void kmem_rcu_free(struct rcu_hea
70864
70865 void kmem_cache_free(struct kmem_cache *c, void *b)
70866 {
70867 + int size = c->size;
70868 +
70869 +#ifdef CONFIG_PAX_USERCOPY
70870 + if (size + c->align < PAGE_SIZE) {
70871 + size += c->align;
70872 + b -= c->align;
70873 + }
70874 +#endif
70875 +
70876 kmemleak_free_recursive(b, c->flags);
70877 if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
70878 struct slob_rcu *slob_rcu;
70879 - slob_rcu = b + (c->size - sizeof(struct slob_rcu));
70880 - slob_rcu->size = c->size;
70881 + slob_rcu = b + (size - sizeof(struct slob_rcu));
70882 + slob_rcu->size = size;
70883 call_rcu(&slob_rcu->head, kmem_rcu_free);
70884 } else {
70885 - __kmem_cache_free(b, c->size);
70886 + __kmem_cache_free(b, size);
70887 }
70888
70889 +#ifdef CONFIG_PAX_USERCOPY
70890 + trace_kfree(_RET_IP_, b);
70891 +#else
70892 trace_kmem_cache_free(_RET_IP_, b);
70893 +#endif
70894 +
70895 }
70896 EXPORT_SYMBOL(kmem_cache_free);
70897
70898 diff -urNp linux-3.0.8/mm/slub.c linux-3.0.8/mm/slub.c
70899 --- linux-3.0.8/mm/slub.c 2011-07-21 22:17:23.000000000 -0400
70900 +++ linux-3.0.8/mm/slub.c 2011-09-25 22:15:40.000000000 -0400
70901 @@ -200,7 +200,7 @@ struct track {
70902
70903 enum track_item { TRACK_ALLOC, TRACK_FREE };
70904
70905 -#ifdef CONFIG_SYSFS
70906 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
70907 static int sysfs_slab_add(struct kmem_cache *);
70908 static int sysfs_slab_alias(struct kmem_cache *, const char *);
70909 static void sysfs_slab_remove(struct kmem_cache *);
70910 @@ -442,7 +442,7 @@ static void print_track(const char *s, s
70911 if (!t->addr)
70912 return;
70913
70914 - printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
70915 + printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
70916 s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
70917 }
70918
70919 @@ -2137,6 +2137,8 @@ void kmem_cache_free(struct kmem_cache *
70920
70921 page = virt_to_head_page(x);
70922
70923 + BUG_ON(!PageSlab(page));
70924 +
70925 slab_free(s, page, x, _RET_IP_);
70926
70927 trace_kmem_cache_free(_RET_IP_, x);
70928 @@ -2170,7 +2172,7 @@ static int slub_min_objects;
70929 * Merge control. If this is set then no merging of slab caches will occur.
70930 * (Could be removed. This was introduced to pacify the merge skeptics.)
70931 */
70932 -static int slub_nomerge;
70933 +static int slub_nomerge = 1;
70934
70935 /*
70936 * Calculate the order of allocation given an slab object size.
70937 @@ -2594,7 +2596,7 @@ static int kmem_cache_open(struct kmem_c
70938 * list to avoid pounding the page allocator excessively.
70939 */
70940 set_min_partial(s, ilog2(s->size));
70941 - s->refcount = 1;
70942 + atomic_set(&s->refcount, 1);
70943 #ifdef CONFIG_NUMA
70944 s->remote_node_defrag_ratio = 1000;
70945 #endif
70946 @@ -2699,8 +2701,7 @@ static inline int kmem_cache_close(struc
70947 void kmem_cache_destroy(struct kmem_cache *s)
70948 {
70949 down_write(&slub_lock);
70950 - s->refcount--;
70951 - if (!s->refcount) {
70952 + if (atomic_dec_and_test(&s->refcount)) {
70953 list_del(&s->list);
70954 if (kmem_cache_close(s)) {
70955 printk(KERN_ERR "SLUB %s: %s called for cache that "
70956 @@ -2910,6 +2911,46 @@ void *__kmalloc_node(size_t size, gfp_t
70957 EXPORT_SYMBOL(__kmalloc_node);
70958 #endif
70959
70960 +void check_object_size(const void *ptr, unsigned long n, bool to)
70961 +{
70962 +
70963 +#ifdef CONFIG_PAX_USERCOPY
70964 + struct page *page;
70965 + struct kmem_cache *s = NULL;
70966 + unsigned long offset;
70967 +
70968 + if (!n)
70969 + return;
70970 +
70971 + if (ZERO_OR_NULL_PTR(ptr))
70972 + goto report;
70973 +
70974 + if (!virt_addr_valid(ptr))
70975 + return;
70976 +
70977 + page = virt_to_head_page(ptr);
70978 +
70979 + if (!PageSlab(page)) {
70980 + if (object_is_on_stack(ptr, n) == -1)
70981 + goto report;
70982 + return;
70983 + }
70984 +
70985 + s = page->slab;
70986 + if (!(s->flags & SLAB_USERCOPY))
70987 + goto report;
70988 +
70989 + offset = (ptr - page_address(page)) % s->size;
70990 + if (offset <= s->objsize && n <= s->objsize - offset)
70991 + return;
70992 +
70993 +report:
70994 + pax_report_usercopy(ptr, n, to, s ? s->name : NULL);
70995 +#endif
70996 +
70997 +}
70998 +EXPORT_SYMBOL(check_object_size);
70999 +
71000 size_t ksize(const void *object)
71001 {
71002 struct page *page;
71003 @@ -3154,7 +3195,7 @@ static void __init kmem_cache_bootstrap_
71004 int node;
71005
71006 list_add(&s->list, &slab_caches);
71007 - s->refcount = -1;
71008 + atomic_set(&s->refcount, -1);
71009
71010 for_each_node_state(node, N_NORMAL_MEMORY) {
71011 struct kmem_cache_node *n = get_node(s, node);
71012 @@ -3271,17 +3312,17 @@ void __init kmem_cache_init(void)
71013
71014 /* Caches that are not of the two-to-the-power-of size */
71015 if (KMALLOC_MIN_SIZE <= 32) {
71016 - kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, 0);
71017 + kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, SLAB_USERCOPY);
71018 caches++;
71019 }
71020
71021 if (KMALLOC_MIN_SIZE <= 64) {
71022 - kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, 0);
71023 + kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, SLAB_USERCOPY);
71024 caches++;
71025 }
71026
71027 for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
71028 - kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, 0);
71029 + kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, SLAB_USERCOPY);
71030 caches++;
71031 }
71032
71033 @@ -3349,7 +3390,7 @@ static int slab_unmergeable(struct kmem_
71034 /*
71035 * We may have set a slab to be unmergeable during bootstrap.
71036 */
71037 - if (s->refcount < 0)
71038 + if (atomic_read(&s->refcount) < 0)
71039 return 1;
71040
71041 return 0;
71042 @@ -3408,7 +3449,7 @@ struct kmem_cache *kmem_cache_create(con
71043 down_write(&slub_lock);
71044 s = find_mergeable(size, align, flags, name, ctor);
71045 if (s) {
71046 - s->refcount++;
71047 + atomic_inc(&s->refcount);
71048 /*
71049 * Adjust the object sizes so that we clear
71050 * the complete object on kzalloc.
71051 @@ -3417,7 +3458,7 @@ struct kmem_cache *kmem_cache_create(con
71052 s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
71053
71054 if (sysfs_slab_alias(s, name)) {
71055 - s->refcount--;
71056 + atomic_dec(&s->refcount);
71057 goto err;
71058 }
71059 up_write(&slub_lock);
71060 @@ -3545,7 +3586,7 @@ void *__kmalloc_node_track_caller(size_t
71061 }
71062 #endif
71063
71064 -#ifdef CONFIG_SYSFS
71065 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
71066 static int count_inuse(struct page *page)
71067 {
71068 return page->inuse;
71069 @@ -3935,12 +3976,12 @@ static void resiliency_test(void)
71070 validate_slab_cache(kmalloc_caches[9]);
71071 }
71072 #else
71073 -#ifdef CONFIG_SYSFS
71074 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
71075 static void resiliency_test(void) {};
71076 #endif
71077 #endif
71078
71079 -#ifdef CONFIG_SYSFS
71080 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
71081 enum slab_stat_type {
71082 SL_ALL, /* All slabs */
71083 SL_PARTIAL, /* Only partially allocated slabs */
71084 @@ -4150,7 +4191,7 @@ SLAB_ATTR_RO(ctor);
71085
71086 static ssize_t aliases_show(struct kmem_cache *s, char *buf)
71087 {
71088 - return sprintf(buf, "%d\n", s->refcount - 1);
71089 + return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
71090 }
71091 SLAB_ATTR_RO(aliases);
71092
71093 @@ -4662,6 +4703,7 @@ static char *create_unique_id(struct kme
71094 return name;
71095 }
71096
71097 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
71098 static int sysfs_slab_add(struct kmem_cache *s)
71099 {
71100 int err;
71101 @@ -4724,6 +4766,7 @@ static void sysfs_slab_remove(struct kme
71102 kobject_del(&s->kobj);
71103 kobject_put(&s->kobj);
71104 }
71105 +#endif
71106
71107 /*
71108 * Need to buffer aliases during bootup until sysfs becomes
71109 @@ -4737,6 +4780,7 @@ struct saved_alias {
71110
71111 static struct saved_alias *alias_list;
71112
71113 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
71114 static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
71115 {
71116 struct saved_alias *al;
71117 @@ -4759,6 +4803,7 @@ static int sysfs_slab_alias(struct kmem_
71118 alias_list = al;
71119 return 0;
71120 }
71121 +#endif
71122
71123 static int __init slab_sysfs_init(void)
71124 {
71125 @@ -4894,7 +4939,13 @@ static const struct file_operations proc
71126
71127 static int __init slab_proc_init(void)
71128 {
71129 - proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
71130 + mode_t gr_mode = S_IRUGO;
71131 +
71132 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
71133 + gr_mode = S_IRUSR;
71134 +#endif
71135 +
71136 + proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
71137 return 0;
71138 }
71139 module_init(slab_proc_init);
71140 diff -urNp linux-3.0.8/mm/swap.c linux-3.0.8/mm/swap.c
71141 --- linux-3.0.8/mm/swap.c 2011-07-21 22:17:23.000000000 -0400
71142 +++ linux-3.0.8/mm/swap.c 2011-08-23 21:47:56.000000000 -0400
71143 @@ -31,6 +31,7 @@
71144 #include <linux/backing-dev.h>
71145 #include <linux/memcontrol.h>
71146 #include <linux/gfp.h>
71147 +#include <linux/hugetlb.h>
71148
71149 #include "internal.h"
71150
71151 @@ -71,6 +72,8 @@ static void __put_compound_page(struct p
71152
71153 __page_cache_release(page);
71154 dtor = get_compound_page_dtor(page);
71155 + if (!PageHuge(page))
71156 + BUG_ON(dtor != free_compound_page);
71157 (*dtor)(page);
71158 }
71159
71160 diff -urNp linux-3.0.8/mm/swapfile.c linux-3.0.8/mm/swapfile.c
71161 --- linux-3.0.8/mm/swapfile.c 2011-07-21 22:17:23.000000000 -0400
71162 +++ linux-3.0.8/mm/swapfile.c 2011-08-23 21:47:56.000000000 -0400
71163 @@ -62,7 +62,7 @@ static DEFINE_MUTEX(swapon_mutex);
71164
71165 static DECLARE_WAIT_QUEUE_HEAD(proc_poll_wait);
71166 /* Activity counter to indicate that a swapon or swapoff has occurred */
71167 -static atomic_t proc_poll_event = ATOMIC_INIT(0);
71168 +static atomic_unchecked_t proc_poll_event = ATOMIC_INIT(0);
71169
71170 static inline unsigned char swap_count(unsigned char ent)
71171 {
71172 @@ -1671,7 +1671,7 @@ SYSCALL_DEFINE1(swapoff, const char __us
71173 }
71174 filp_close(swap_file, NULL);
71175 err = 0;
71176 - atomic_inc(&proc_poll_event);
71177 + atomic_inc_unchecked(&proc_poll_event);
71178 wake_up_interruptible(&proc_poll_wait);
71179
71180 out_dput:
71181 @@ -1692,8 +1692,8 @@ static unsigned swaps_poll(struct file *
71182
71183 poll_wait(file, &proc_poll_wait, wait);
71184
71185 - if (s->event != atomic_read(&proc_poll_event)) {
71186 - s->event = atomic_read(&proc_poll_event);
71187 + if (s->event != atomic_read_unchecked(&proc_poll_event)) {
71188 + s->event = atomic_read_unchecked(&proc_poll_event);
71189 return POLLIN | POLLRDNORM | POLLERR | POLLPRI;
71190 }
71191
71192 @@ -1799,7 +1799,7 @@ static int swaps_open(struct inode *inod
71193 }
71194
71195 s->seq.private = s;
71196 - s->event = atomic_read(&proc_poll_event);
71197 + s->event = atomic_read_unchecked(&proc_poll_event);
71198 return ret;
71199 }
71200
71201 @@ -2133,7 +2133,7 @@ SYSCALL_DEFINE2(swapon, const char __use
71202 (p->flags & SWP_DISCARDABLE) ? "D" : "");
71203
71204 mutex_unlock(&swapon_mutex);
71205 - atomic_inc(&proc_poll_event);
71206 + atomic_inc_unchecked(&proc_poll_event);
71207 wake_up_interruptible(&proc_poll_wait);
71208
71209 if (S_ISREG(inode->i_mode))
71210 diff -urNp linux-3.0.8/mm/util.c linux-3.0.8/mm/util.c
71211 --- linux-3.0.8/mm/util.c 2011-07-21 22:17:23.000000000 -0400
71212 +++ linux-3.0.8/mm/util.c 2011-08-23 21:47:56.000000000 -0400
71213 @@ -114,6 +114,7 @@ EXPORT_SYMBOL(memdup_user);
71214 * allocated buffer. Use this if you don't want to free the buffer immediately
71215 * like, for example, with RCU.
71216 */
71217 +#undef __krealloc
71218 void *__krealloc(const void *p, size_t new_size, gfp_t flags)
71219 {
71220 void *ret;
71221 @@ -147,6 +148,7 @@ EXPORT_SYMBOL(__krealloc);
71222 * behaves exactly like kmalloc(). If @size is 0 and @p is not a
71223 * %NULL pointer, the object pointed to is freed.
71224 */
71225 +#undef krealloc
71226 void *krealloc(const void *p, size_t new_size, gfp_t flags)
71227 {
71228 void *ret;
71229 @@ -243,6 +245,12 @@ void __vma_link_list(struct mm_struct *m
71230 void arch_pick_mmap_layout(struct mm_struct *mm)
71231 {
71232 mm->mmap_base = TASK_UNMAPPED_BASE;
71233 +
71234 +#ifdef CONFIG_PAX_RANDMMAP
71235 + if (mm->pax_flags & MF_PAX_RANDMMAP)
71236 + mm->mmap_base += mm->delta_mmap;
71237 +#endif
71238 +
71239 mm->get_unmapped_area = arch_get_unmapped_area;
71240 mm->unmap_area = arch_unmap_area;
71241 }
71242 diff -urNp linux-3.0.8/mm/vmalloc.c linux-3.0.8/mm/vmalloc.c
71243 --- linux-3.0.8/mm/vmalloc.c 2011-10-24 08:05:30.000000000 -0400
71244 +++ linux-3.0.8/mm/vmalloc.c 2011-10-16 21:55:28.000000000 -0400
71245 @@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd,
71246
71247 pte = pte_offset_kernel(pmd, addr);
71248 do {
71249 - pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
71250 - WARN_ON(!pte_none(ptent) && !pte_present(ptent));
71251 +
71252 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
71253 + if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
71254 + BUG_ON(!pte_exec(*pte));
71255 + set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
71256 + continue;
71257 + }
71258 +#endif
71259 +
71260 + {
71261 + pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
71262 + WARN_ON(!pte_none(ptent) && !pte_present(ptent));
71263 + }
71264 } while (pte++, addr += PAGE_SIZE, addr != end);
71265 }
71266
71267 @@ -91,6 +102,7 @@ static int vmap_pte_range(pmd_t *pmd, un
71268 unsigned long end, pgprot_t prot, struct page **pages, int *nr)
71269 {
71270 pte_t *pte;
71271 + int ret = -ENOMEM;
71272
71273 /*
71274 * nr is a running index into the array which helps higher level
71275 @@ -100,17 +112,30 @@ static int vmap_pte_range(pmd_t *pmd, un
71276 pte = pte_alloc_kernel(pmd, addr);
71277 if (!pte)
71278 return -ENOMEM;
71279 +
71280 + pax_open_kernel();
71281 do {
71282 struct page *page = pages[*nr];
71283
71284 - if (WARN_ON(!pte_none(*pte)))
71285 - return -EBUSY;
71286 - if (WARN_ON(!page))
71287 - return -ENOMEM;
71288 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
71289 + if (pgprot_val(prot) & _PAGE_NX)
71290 +#endif
71291 +
71292 + if (WARN_ON(!pte_none(*pte))) {
71293 + ret = -EBUSY;
71294 + goto out;
71295 + }
71296 + if (WARN_ON(!page)) {
71297 + ret = -ENOMEM;
71298 + goto out;
71299 + }
71300 set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
71301 (*nr)++;
71302 } while (pte++, addr += PAGE_SIZE, addr != end);
71303 - return 0;
71304 + ret = 0;
71305 +out:
71306 + pax_close_kernel();
71307 + return ret;
71308 }
71309
71310 static int vmap_pmd_range(pud_t *pud, unsigned long addr,
71311 @@ -191,11 +216,20 @@ int is_vmalloc_or_module_addr(const void
71312 * and fall back on vmalloc() if that fails. Others
71313 * just put it in the vmalloc space.
71314 */
71315 -#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
71316 +#ifdef CONFIG_MODULES
71317 +#ifdef MODULES_VADDR
71318 unsigned long addr = (unsigned long)x;
71319 if (addr >= MODULES_VADDR && addr < MODULES_END)
71320 return 1;
71321 #endif
71322 +
71323 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
71324 + if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
71325 + return 1;
71326 +#endif
71327 +
71328 +#endif
71329 +
71330 return is_vmalloc_addr(x);
71331 }
71332
71333 @@ -216,8 +250,14 @@ struct page *vmalloc_to_page(const void
71334
71335 if (!pgd_none(*pgd)) {
71336 pud_t *pud = pud_offset(pgd, addr);
71337 +#ifdef CONFIG_X86
71338 + if (!pud_large(*pud))
71339 +#endif
71340 if (!pud_none(*pud)) {
71341 pmd_t *pmd = pmd_offset(pud, addr);
71342 +#ifdef CONFIG_X86
71343 + if (!pmd_large(*pmd))
71344 +#endif
71345 if (!pmd_none(*pmd)) {
71346 pte_t *ptep, pte;
71347
71348 @@ -1297,6 +1337,16 @@ static struct vm_struct *__get_vm_area_n
71349 struct vm_struct *area;
71350
71351 BUG_ON(in_interrupt());
71352 +
71353 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
71354 + if (flags & VM_KERNEXEC) {
71355 + if (start != VMALLOC_START || end != VMALLOC_END)
71356 + return NULL;
71357 + start = (unsigned long)MODULES_EXEC_VADDR;
71358 + end = (unsigned long)MODULES_EXEC_END;
71359 + }
71360 +#endif
71361 +
71362 if (flags & VM_IOREMAP) {
71363 int bit = fls(size);
71364
71365 @@ -1515,6 +1565,11 @@ void *vmap(struct page **pages, unsigned
71366 if (count > totalram_pages)
71367 return NULL;
71368
71369 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
71370 + if (!(pgprot_val(prot) & _PAGE_NX))
71371 + flags |= VM_KERNEXEC;
71372 +#endif
71373 +
71374 area = get_vm_area_caller((count << PAGE_SHIFT), flags,
71375 __builtin_return_address(0));
71376 if (!area)
71377 @@ -1616,6 +1671,13 @@ void *__vmalloc_node_range(unsigned long
71378 if (!size || (size >> PAGE_SHIFT) > totalram_pages)
71379 return NULL;
71380
71381 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
71382 + if (!(pgprot_val(prot) & _PAGE_NX))
71383 + area = __get_vm_area_node(size, align, VM_ALLOC | VM_KERNEXEC, VMALLOC_START, VMALLOC_END,
71384 + node, gfp_mask, caller);
71385 + else
71386 +#endif
71387 +
71388 area = __get_vm_area_node(size, align, VM_ALLOC, start, end, node,
71389 gfp_mask, caller);
71390
71391 @@ -1655,6 +1717,7 @@ static void *__vmalloc_node(unsigned lon
71392 gfp_mask, prot, node, caller);
71393 }
71394
71395 +#undef __vmalloc
71396 void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
71397 {
71398 return __vmalloc_node(size, 1, gfp_mask, prot, -1,
71399 @@ -1678,6 +1741,7 @@ static inline void *__vmalloc_node_flags
71400 * For tight control over page level allocator and protection flags
71401 * use __vmalloc() instead.
71402 */
71403 +#undef vmalloc
71404 void *vmalloc(unsigned long size)
71405 {
71406 return __vmalloc_node_flags(size, -1, GFP_KERNEL | __GFP_HIGHMEM);
71407 @@ -1694,6 +1758,7 @@ EXPORT_SYMBOL(vmalloc);
71408 * For tight control over page level allocator and protection flags
71409 * use __vmalloc() instead.
71410 */
71411 +#undef vzalloc
71412 void *vzalloc(unsigned long size)
71413 {
71414 return __vmalloc_node_flags(size, -1,
71415 @@ -1708,6 +1773,7 @@ EXPORT_SYMBOL(vzalloc);
71416 * The resulting memory area is zeroed so it can be mapped to userspace
71417 * without leaking data.
71418 */
71419 +#undef vmalloc_user
71420 void *vmalloc_user(unsigned long size)
71421 {
71422 struct vm_struct *area;
71423 @@ -1735,6 +1801,7 @@ EXPORT_SYMBOL(vmalloc_user);
71424 * For tight control over page level allocator and protection flags
71425 * use __vmalloc() instead.
71426 */
71427 +#undef vmalloc_node
71428 void *vmalloc_node(unsigned long size, int node)
71429 {
71430 return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
71431 @@ -1754,6 +1821,7 @@ EXPORT_SYMBOL(vmalloc_node);
71432 * For tight control over page level allocator and protection flags
71433 * use __vmalloc_node() instead.
71434 */
71435 +#undef vzalloc_node
71436 void *vzalloc_node(unsigned long size, int node)
71437 {
71438 return __vmalloc_node_flags(size, node,
71439 @@ -1776,10 +1844,10 @@ EXPORT_SYMBOL(vzalloc_node);
71440 * For tight control over page level allocator and protection flags
71441 * use __vmalloc() instead.
71442 */
71443 -
71444 +#undef vmalloc_exec
71445 void *vmalloc_exec(unsigned long size)
71446 {
71447 - return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
71448 + return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
71449 -1, __builtin_return_address(0));
71450 }
71451
71452 @@ -1798,6 +1866,7 @@ void *vmalloc_exec(unsigned long size)
71453 * Allocate enough 32bit PA addressable pages to cover @size from the
71454 * page level allocator and map them into contiguous kernel virtual space.
71455 */
71456 +#undef vmalloc_32
71457 void *vmalloc_32(unsigned long size)
71458 {
71459 return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
71460 @@ -1812,6 +1881,7 @@ EXPORT_SYMBOL(vmalloc_32);
71461 * The resulting memory area is 32bit addressable and zeroed so it can be
71462 * mapped to userspace without leaking data.
71463 */
71464 +#undef vmalloc_32_user
71465 void *vmalloc_32_user(unsigned long size)
71466 {
71467 struct vm_struct *area;
71468 @@ -2074,6 +2144,8 @@ int remap_vmalloc_range(struct vm_area_s
71469 unsigned long uaddr = vma->vm_start;
71470 unsigned long usize = vma->vm_end - vma->vm_start;
71471
71472 + BUG_ON(vma->vm_mirror);
71473 +
71474 if ((PAGE_SIZE-1) & (unsigned long)addr)
71475 return -EINVAL;
71476
71477 diff -urNp linux-3.0.8/mm/vmstat.c linux-3.0.8/mm/vmstat.c
71478 --- linux-3.0.8/mm/vmstat.c 2011-07-21 22:17:23.000000000 -0400
71479 +++ linux-3.0.8/mm/vmstat.c 2011-08-23 21:48:14.000000000 -0400
71480 @@ -78,7 +78,7 @@ void vm_events_fold_cpu(int cpu)
71481 *
71482 * vm_stat contains the global counters
71483 */
71484 -atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
71485 +atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
71486 EXPORT_SYMBOL(vm_stat);
71487
71488 #ifdef CONFIG_SMP
71489 @@ -454,7 +454,7 @@ void refresh_cpu_vm_stats(int cpu)
71490 v = p->vm_stat_diff[i];
71491 p->vm_stat_diff[i] = 0;
71492 local_irq_restore(flags);
71493 - atomic_long_add(v, &zone->vm_stat[i]);
71494 + atomic_long_add_unchecked(v, &zone->vm_stat[i]);
71495 global_diff[i] += v;
71496 #ifdef CONFIG_NUMA
71497 /* 3 seconds idle till flush */
71498 @@ -492,7 +492,7 @@ void refresh_cpu_vm_stats(int cpu)
71499
71500 for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
71501 if (global_diff[i])
71502 - atomic_long_add(global_diff[i], &vm_stat[i]);
71503 + atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
71504 }
71505
71506 #endif
71507 @@ -1207,10 +1207,20 @@ static int __init setup_vmstat(void)
71508 start_cpu_timer(cpu);
71509 #endif
71510 #ifdef CONFIG_PROC_FS
71511 - proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
71512 - proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
71513 - proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
71514 - proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
71515 + {
71516 + mode_t gr_mode = S_IRUGO;
71517 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
71518 + gr_mode = S_IRUSR;
71519 +#endif
71520 + proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
71521 + proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
71522 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
71523 + proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
71524 +#else
71525 + proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
71526 +#endif
71527 + proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
71528 + }
71529 #endif
71530 return 0;
71531 }
71532 diff -urNp linux-3.0.8/net/8021q/vlan.c linux-3.0.8/net/8021q/vlan.c
71533 --- linux-3.0.8/net/8021q/vlan.c 2011-07-21 22:17:23.000000000 -0400
71534 +++ linux-3.0.8/net/8021q/vlan.c 2011-08-23 21:47:56.000000000 -0400
71535 @@ -591,8 +591,7 @@ static int vlan_ioctl_handler(struct net
71536 err = -EPERM;
71537 if (!capable(CAP_NET_ADMIN))
71538 break;
71539 - if ((args.u.name_type >= 0) &&
71540 - (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
71541 + if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
71542 struct vlan_net *vn;
71543
71544 vn = net_generic(net, vlan_net_id);
71545 diff -urNp linux-3.0.8/net/9p/trans_fd.c linux-3.0.8/net/9p/trans_fd.c
71546 --- linux-3.0.8/net/9p/trans_fd.c 2011-07-21 22:17:23.000000000 -0400
71547 +++ linux-3.0.8/net/9p/trans_fd.c 2011-10-06 04:17:55.000000000 -0400
71548 @@ -423,7 +423,7 @@ static int p9_fd_write(struct p9_client
71549 oldfs = get_fs();
71550 set_fs(get_ds());
71551 /* The cast to a user pointer is valid due to the set_fs() */
71552 - ret = vfs_write(ts->wr, (__force void __user *)v, len, &ts->wr->f_pos);
71553 + ret = vfs_write(ts->wr, (void __force_user *)v, len, &ts->wr->f_pos);
71554 set_fs(oldfs);
71555
71556 if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN)
71557 diff -urNp linux-3.0.8/net/9p/trans_virtio.c linux-3.0.8/net/9p/trans_virtio.c
71558 --- linux-3.0.8/net/9p/trans_virtio.c 2011-10-24 08:05:30.000000000 -0400
71559 +++ linux-3.0.8/net/9p/trans_virtio.c 2011-10-16 21:55:28.000000000 -0400
71560 @@ -327,7 +327,7 @@ req_retry_pinned:
71561 } else {
71562 char *pbuf;
71563 if (req->tc->pubuf)
71564 - pbuf = (__force char *) req->tc->pubuf;
71565 + pbuf = (char __force_kernel *) req->tc->pubuf;
71566 else
71567 pbuf = req->tc->pkbuf;
71568 outp = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, pbuf,
71569 @@ -357,7 +357,7 @@ req_retry_pinned:
71570 } else {
71571 char *pbuf;
71572 if (req->tc->pubuf)
71573 - pbuf = (__force char *) req->tc->pubuf;
71574 + pbuf = (char __force_kernel *) req->tc->pubuf;
71575 else
71576 pbuf = req->tc->pkbuf;
71577
71578 diff -urNp linux-3.0.8/net/atm/atm_misc.c linux-3.0.8/net/atm/atm_misc.c
71579 --- linux-3.0.8/net/atm/atm_misc.c 2011-07-21 22:17:23.000000000 -0400
71580 +++ linux-3.0.8/net/atm/atm_misc.c 2011-08-23 21:47:56.000000000 -0400
71581 @@ -17,7 +17,7 @@ int atm_charge(struct atm_vcc *vcc, int
71582 if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
71583 return 1;
71584 atm_return(vcc, truesize);
71585 - atomic_inc(&vcc->stats->rx_drop);
71586 + atomic_inc_unchecked(&vcc->stats->rx_drop);
71587 return 0;
71588 }
71589 EXPORT_SYMBOL(atm_charge);
71590 @@ -39,7 +39,7 @@ struct sk_buff *atm_alloc_charge(struct
71591 }
71592 }
71593 atm_return(vcc, guess);
71594 - atomic_inc(&vcc->stats->rx_drop);
71595 + atomic_inc_unchecked(&vcc->stats->rx_drop);
71596 return NULL;
71597 }
71598 EXPORT_SYMBOL(atm_alloc_charge);
71599 @@ -86,7 +86,7 @@ EXPORT_SYMBOL(atm_pcr_goal);
71600
71601 void sonet_copy_stats(struct k_sonet_stats *from, struct sonet_stats *to)
71602 {
71603 -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
71604 +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
71605 __SONET_ITEMS
71606 #undef __HANDLE_ITEM
71607 }
71608 @@ -94,7 +94,7 @@ EXPORT_SYMBOL(sonet_copy_stats);
71609
71610 void sonet_subtract_stats(struct k_sonet_stats *from, struct sonet_stats *to)
71611 {
71612 -#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
71613 +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
71614 __SONET_ITEMS
71615 #undef __HANDLE_ITEM
71616 }
71617 diff -urNp linux-3.0.8/net/atm/lec.h linux-3.0.8/net/atm/lec.h
71618 --- linux-3.0.8/net/atm/lec.h 2011-07-21 22:17:23.000000000 -0400
71619 +++ linux-3.0.8/net/atm/lec.h 2011-08-23 21:47:56.000000000 -0400
71620 @@ -48,7 +48,7 @@ struct lane2_ops {
71621 const u8 *tlvs, u32 sizeoftlvs);
71622 void (*associate_indicator) (struct net_device *dev, const u8 *mac_addr,
71623 const u8 *tlvs, u32 sizeoftlvs);
71624 -};
71625 +} __no_const;
71626
71627 /*
71628 * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
71629 diff -urNp linux-3.0.8/net/atm/mpc.h linux-3.0.8/net/atm/mpc.h
71630 --- linux-3.0.8/net/atm/mpc.h 2011-07-21 22:17:23.000000000 -0400
71631 +++ linux-3.0.8/net/atm/mpc.h 2011-08-23 21:47:56.000000000 -0400
71632 @@ -33,7 +33,7 @@ struct mpoa_client {
71633 struct mpc_parameters parameters; /* parameters for this client */
71634
71635 const struct net_device_ops *old_ops;
71636 - struct net_device_ops new_ops;
71637 + net_device_ops_no_const new_ops;
71638 };
71639
71640
71641 diff -urNp linux-3.0.8/net/atm/mpoa_caches.c linux-3.0.8/net/atm/mpoa_caches.c
71642 --- linux-3.0.8/net/atm/mpoa_caches.c 2011-07-21 22:17:23.000000000 -0400
71643 +++ linux-3.0.8/net/atm/mpoa_caches.c 2011-08-23 21:48:14.000000000 -0400
71644 @@ -255,6 +255,8 @@ static void check_resolving_entries(stru
71645 struct timeval now;
71646 struct k_message msg;
71647
71648 + pax_track_stack();
71649 +
71650 do_gettimeofday(&now);
71651
71652 read_lock_bh(&client->ingress_lock);
71653 diff -urNp linux-3.0.8/net/atm/proc.c linux-3.0.8/net/atm/proc.c
71654 --- linux-3.0.8/net/atm/proc.c 2011-07-21 22:17:23.000000000 -0400
71655 +++ linux-3.0.8/net/atm/proc.c 2011-08-23 21:47:56.000000000 -0400
71656 @@ -45,9 +45,9 @@ static void add_stats(struct seq_file *s
71657 const struct k_atm_aal_stats *stats)
71658 {
71659 seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
71660 - atomic_read(&stats->tx), atomic_read(&stats->tx_err),
71661 - atomic_read(&stats->rx), atomic_read(&stats->rx_err),
71662 - atomic_read(&stats->rx_drop));
71663 + atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
71664 + atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
71665 + atomic_read_unchecked(&stats->rx_drop));
71666 }
71667
71668 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
71669 diff -urNp linux-3.0.8/net/atm/resources.c linux-3.0.8/net/atm/resources.c
71670 --- linux-3.0.8/net/atm/resources.c 2011-07-21 22:17:23.000000000 -0400
71671 +++ linux-3.0.8/net/atm/resources.c 2011-08-23 21:47:56.000000000 -0400
71672 @@ -160,7 +160,7 @@ EXPORT_SYMBOL(atm_dev_deregister);
71673 static void copy_aal_stats(struct k_atm_aal_stats *from,
71674 struct atm_aal_stats *to)
71675 {
71676 -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
71677 +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
71678 __AAL_STAT_ITEMS
71679 #undef __HANDLE_ITEM
71680 }
71681 @@ -168,7 +168,7 @@ static void copy_aal_stats(struct k_atm_
71682 static void subtract_aal_stats(struct k_atm_aal_stats *from,
71683 struct atm_aal_stats *to)
71684 {
71685 -#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
71686 +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
71687 __AAL_STAT_ITEMS
71688 #undef __HANDLE_ITEM
71689 }
71690 diff -urNp linux-3.0.8/net/batman-adv/hard-interface.c linux-3.0.8/net/batman-adv/hard-interface.c
71691 --- linux-3.0.8/net/batman-adv/hard-interface.c 2011-07-21 22:17:23.000000000 -0400
71692 +++ linux-3.0.8/net/batman-adv/hard-interface.c 2011-08-23 21:47:56.000000000 -0400
71693 @@ -351,8 +351,8 @@ int hardif_enable_interface(struct hard_
71694 hard_iface->batman_adv_ptype.dev = hard_iface->net_dev;
71695 dev_add_pack(&hard_iface->batman_adv_ptype);
71696
71697 - atomic_set(&hard_iface->seqno, 1);
71698 - atomic_set(&hard_iface->frag_seqno, 1);
71699 + atomic_set_unchecked(&hard_iface->seqno, 1);
71700 + atomic_set_unchecked(&hard_iface->frag_seqno, 1);
71701 bat_info(hard_iface->soft_iface, "Adding interface: %s\n",
71702 hard_iface->net_dev->name);
71703
71704 diff -urNp linux-3.0.8/net/batman-adv/routing.c linux-3.0.8/net/batman-adv/routing.c
71705 --- linux-3.0.8/net/batman-adv/routing.c 2011-07-21 22:17:23.000000000 -0400
71706 +++ linux-3.0.8/net/batman-adv/routing.c 2011-08-23 21:47:56.000000000 -0400
71707 @@ -627,7 +627,7 @@ void receive_bat_packet(struct ethhdr *e
71708 return;
71709
71710 /* could be changed by schedule_own_packet() */
71711 - if_incoming_seqno = atomic_read(&if_incoming->seqno);
71712 + if_incoming_seqno = atomic_read_unchecked(&if_incoming->seqno);
71713
71714 has_directlink_flag = (batman_packet->flags & DIRECTLINK ? 1 : 0);
71715
71716 diff -urNp linux-3.0.8/net/batman-adv/send.c linux-3.0.8/net/batman-adv/send.c
71717 --- linux-3.0.8/net/batman-adv/send.c 2011-07-21 22:17:23.000000000 -0400
71718 +++ linux-3.0.8/net/batman-adv/send.c 2011-08-23 21:47:56.000000000 -0400
71719 @@ -279,7 +279,7 @@ void schedule_own_packet(struct hard_ifa
71720
71721 /* change sequence number to network order */
71722 batman_packet->seqno =
71723 - htonl((uint32_t)atomic_read(&hard_iface->seqno));
71724 + htonl((uint32_t)atomic_read_unchecked(&hard_iface->seqno));
71725
71726 if (vis_server == VIS_TYPE_SERVER_SYNC)
71727 batman_packet->flags |= VIS_SERVER;
71728 @@ -293,7 +293,7 @@ void schedule_own_packet(struct hard_ifa
71729 else
71730 batman_packet->gw_flags = 0;
71731
71732 - atomic_inc(&hard_iface->seqno);
71733 + atomic_inc_unchecked(&hard_iface->seqno);
71734
71735 slide_own_bcast_window(hard_iface);
71736 send_time = own_send_time(bat_priv);
71737 diff -urNp linux-3.0.8/net/batman-adv/soft-interface.c linux-3.0.8/net/batman-adv/soft-interface.c
71738 --- linux-3.0.8/net/batman-adv/soft-interface.c 2011-07-21 22:17:23.000000000 -0400
71739 +++ linux-3.0.8/net/batman-adv/soft-interface.c 2011-08-23 21:47:56.000000000 -0400
71740 @@ -628,7 +628,7 @@ int interface_tx(struct sk_buff *skb, st
71741
71742 /* set broadcast sequence number */
71743 bcast_packet->seqno =
71744 - htonl(atomic_inc_return(&bat_priv->bcast_seqno));
71745 + htonl(atomic_inc_return_unchecked(&bat_priv->bcast_seqno));
71746
71747 add_bcast_packet_to_list(bat_priv, skb);
71748
71749 @@ -830,7 +830,7 @@ struct net_device *softif_create(char *n
71750 atomic_set(&bat_priv->batman_queue_left, BATMAN_QUEUE_LEN);
71751
71752 atomic_set(&bat_priv->mesh_state, MESH_INACTIVE);
71753 - atomic_set(&bat_priv->bcast_seqno, 1);
71754 + atomic_set_unchecked(&bat_priv->bcast_seqno, 1);
71755 atomic_set(&bat_priv->tt_local_changed, 0);
71756
71757 bat_priv->primary_if = NULL;
71758 diff -urNp linux-3.0.8/net/batman-adv/types.h linux-3.0.8/net/batman-adv/types.h
71759 --- linux-3.0.8/net/batman-adv/types.h 2011-07-21 22:17:23.000000000 -0400
71760 +++ linux-3.0.8/net/batman-adv/types.h 2011-08-23 21:47:56.000000000 -0400
71761 @@ -38,8 +38,8 @@ struct hard_iface {
71762 int16_t if_num;
71763 char if_status;
71764 struct net_device *net_dev;
71765 - atomic_t seqno;
71766 - atomic_t frag_seqno;
71767 + atomic_unchecked_t seqno;
71768 + atomic_unchecked_t frag_seqno;
71769 unsigned char *packet_buff;
71770 int packet_len;
71771 struct kobject *hardif_obj;
71772 @@ -142,7 +142,7 @@ struct bat_priv {
71773 atomic_t orig_interval; /* uint */
71774 atomic_t hop_penalty; /* uint */
71775 atomic_t log_level; /* uint */
71776 - atomic_t bcast_seqno;
71777 + atomic_unchecked_t bcast_seqno;
71778 atomic_t bcast_queue_left;
71779 atomic_t batman_queue_left;
71780 char num_ifaces;
71781 diff -urNp linux-3.0.8/net/batman-adv/unicast.c linux-3.0.8/net/batman-adv/unicast.c
71782 --- linux-3.0.8/net/batman-adv/unicast.c 2011-07-21 22:17:23.000000000 -0400
71783 +++ linux-3.0.8/net/batman-adv/unicast.c 2011-08-23 21:47:56.000000000 -0400
71784 @@ -265,7 +265,7 @@ int frag_send_skb(struct sk_buff *skb, s
71785 frag1->flags = UNI_FRAG_HEAD | large_tail;
71786 frag2->flags = large_tail;
71787
71788 - seqno = atomic_add_return(2, &hard_iface->frag_seqno);
71789 + seqno = atomic_add_return_unchecked(2, &hard_iface->frag_seqno);
71790 frag1->seqno = htons(seqno - 1);
71791 frag2->seqno = htons(seqno);
71792
71793 diff -urNp linux-3.0.8/net/bridge/br_multicast.c linux-3.0.8/net/bridge/br_multicast.c
71794 --- linux-3.0.8/net/bridge/br_multicast.c 2011-10-24 08:05:30.000000000 -0400
71795 +++ linux-3.0.8/net/bridge/br_multicast.c 2011-10-16 21:55:28.000000000 -0400
71796 @@ -1485,7 +1485,7 @@ static int br_multicast_ipv6_rcv(struct
71797 nexthdr = ip6h->nexthdr;
71798 offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr);
71799
71800 - if (offset < 0 || nexthdr != IPPROTO_ICMPV6)
71801 + if (nexthdr != IPPROTO_ICMPV6)
71802 return 0;
71803
71804 /* Okay, we found ICMPv6 header */
71805 diff -urNp linux-3.0.8/net/bridge/netfilter/ebtables.c linux-3.0.8/net/bridge/netfilter/ebtables.c
71806 --- linux-3.0.8/net/bridge/netfilter/ebtables.c 2011-07-21 22:17:23.000000000 -0400
71807 +++ linux-3.0.8/net/bridge/netfilter/ebtables.c 2011-08-23 21:48:14.000000000 -0400
71808 @@ -1512,7 +1512,7 @@ static int do_ebt_get_ctl(struct sock *s
71809 tmp.valid_hooks = t->table->valid_hooks;
71810 }
71811 mutex_unlock(&ebt_mutex);
71812 - if (copy_to_user(user, &tmp, *len) != 0){
71813 + if (*len > sizeof(tmp) || copy_to_user(user, &tmp, *len) != 0){
71814 BUGPRINT("c2u Didn't work\n");
71815 ret = -EFAULT;
71816 break;
71817 @@ -1780,6 +1780,8 @@ static int compat_copy_everything_to_use
71818 int ret;
71819 void __user *pos;
71820
71821 + pax_track_stack();
71822 +
71823 memset(&tinfo, 0, sizeof(tinfo));
71824
71825 if (cmd == EBT_SO_GET_ENTRIES) {
71826 diff -urNp linux-3.0.8/net/caif/caif_socket.c linux-3.0.8/net/caif/caif_socket.c
71827 --- linux-3.0.8/net/caif/caif_socket.c 2011-07-21 22:17:23.000000000 -0400
71828 +++ linux-3.0.8/net/caif/caif_socket.c 2011-08-23 21:47:56.000000000 -0400
71829 @@ -48,19 +48,20 @@ static struct dentry *debugfsdir;
71830 #ifdef CONFIG_DEBUG_FS
71831 struct debug_fs_counter {
71832 atomic_t caif_nr_socks;
71833 - atomic_t caif_sock_create;
71834 - atomic_t num_connect_req;
71835 - atomic_t num_connect_resp;
71836 - atomic_t num_connect_fail_resp;
71837 - atomic_t num_disconnect;
71838 - atomic_t num_remote_shutdown_ind;
71839 - atomic_t num_tx_flow_off_ind;
71840 - atomic_t num_tx_flow_on_ind;
71841 - atomic_t num_rx_flow_off;
71842 - atomic_t num_rx_flow_on;
71843 + atomic_unchecked_t caif_sock_create;
71844 + atomic_unchecked_t num_connect_req;
71845 + atomic_unchecked_t num_connect_resp;
71846 + atomic_unchecked_t num_connect_fail_resp;
71847 + atomic_unchecked_t num_disconnect;
71848 + atomic_unchecked_t num_remote_shutdown_ind;
71849 + atomic_unchecked_t num_tx_flow_off_ind;
71850 + atomic_unchecked_t num_tx_flow_on_ind;
71851 + atomic_unchecked_t num_rx_flow_off;
71852 + atomic_unchecked_t num_rx_flow_on;
71853 };
71854 static struct debug_fs_counter cnt;
71855 #define dbfs_atomic_inc(v) atomic_inc_return(v)
71856 +#define dbfs_atomic_inc_unchecked(v) atomic_inc_return_unchecked(v)
71857 #define dbfs_atomic_dec(v) atomic_dec_return(v)
71858 #else
71859 #define dbfs_atomic_inc(v) 0
71860 @@ -161,7 +162,7 @@ static int caif_queue_rcv_skb(struct soc
71861 atomic_read(&cf_sk->sk.sk_rmem_alloc),
71862 sk_rcvbuf_lowwater(cf_sk));
71863 set_rx_flow_off(cf_sk);
71864 - dbfs_atomic_inc(&cnt.num_rx_flow_off);
71865 + dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
71866 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
71867 }
71868
71869 @@ -172,7 +173,7 @@ static int caif_queue_rcv_skb(struct soc
71870 set_rx_flow_off(cf_sk);
71871 if (net_ratelimit())
71872 pr_debug("sending flow OFF due to rmem_schedule\n");
71873 - dbfs_atomic_inc(&cnt.num_rx_flow_off);
71874 + dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
71875 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
71876 }
71877 skb->dev = NULL;
71878 @@ -233,14 +234,14 @@ static void caif_ctrl_cb(struct cflayer
71879 switch (flow) {
71880 case CAIF_CTRLCMD_FLOW_ON_IND:
71881 /* OK from modem to start sending again */
71882 - dbfs_atomic_inc(&cnt.num_tx_flow_on_ind);
71883 + dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_on_ind);
71884 set_tx_flow_on(cf_sk);
71885 cf_sk->sk.sk_state_change(&cf_sk->sk);
71886 break;
71887
71888 case CAIF_CTRLCMD_FLOW_OFF_IND:
71889 /* Modem asks us to shut up */
71890 - dbfs_atomic_inc(&cnt.num_tx_flow_off_ind);
71891 + dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_off_ind);
71892 set_tx_flow_off(cf_sk);
71893 cf_sk->sk.sk_state_change(&cf_sk->sk);
71894 break;
71895 @@ -249,7 +250,7 @@ static void caif_ctrl_cb(struct cflayer
71896 /* We're now connected */
71897 caif_client_register_refcnt(&cf_sk->layer,
71898 cfsk_hold, cfsk_put);
71899 - dbfs_atomic_inc(&cnt.num_connect_resp);
71900 + dbfs_atomic_inc_unchecked(&cnt.num_connect_resp);
71901 cf_sk->sk.sk_state = CAIF_CONNECTED;
71902 set_tx_flow_on(cf_sk);
71903 cf_sk->sk.sk_state_change(&cf_sk->sk);
71904 @@ -263,7 +264,7 @@ static void caif_ctrl_cb(struct cflayer
71905
71906 case CAIF_CTRLCMD_INIT_FAIL_RSP:
71907 /* Connect request failed */
71908 - dbfs_atomic_inc(&cnt.num_connect_fail_resp);
71909 + dbfs_atomic_inc_unchecked(&cnt.num_connect_fail_resp);
71910 cf_sk->sk.sk_err = ECONNREFUSED;
71911 cf_sk->sk.sk_state = CAIF_DISCONNECTED;
71912 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
71913 @@ -277,7 +278,7 @@ static void caif_ctrl_cb(struct cflayer
71914
71915 case CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND:
71916 /* Modem has closed this connection, or device is down. */
71917 - dbfs_atomic_inc(&cnt.num_remote_shutdown_ind);
71918 + dbfs_atomic_inc_unchecked(&cnt.num_remote_shutdown_ind);
71919 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
71920 cf_sk->sk.sk_err = ECONNRESET;
71921 set_rx_flow_on(cf_sk);
71922 @@ -297,7 +298,7 @@ static void caif_check_flow_release(stru
71923 return;
71924
71925 if (atomic_read(&sk->sk_rmem_alloc) <= sk_rcvbuf_lowwater(cf_sk)) {
71926 - dbfs_atomic_inc(&cnt.num_rx_flow_on);
71927 + dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_on);
71928 set_rx_flow_on(cf_sk);
71929 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_ON_REQ);
71930 }
71931 @@ -854,7 +855,7 @@ static int caif_connect(struct socket *s
71932 /*ifindex = id of the interface.*/
71933 cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if;
71934
71935 - dbfs_atomic_inc(&cnt.num_connect_req);
71936 + dbfs_atomic_inc_unchecked(&cnt.num_connect_req);
71937 cf_sk->layer.receive = caif_sktrecv_cb;
71938
71939 err = caif_connect_client(sock_net(sk), &cf_sk->conn_req,
71940 @@ -943,7 +944,7 @@ static int caif_release(struct socket *s
71941 spin_unlock_bh(&sk->sk_receive_queue.lock);
71942 sock->sk = NULL;
71943
71944 - dbfs_atomic_inc(&cnt.num_disconnect);
71945 + dbfs_atomic_inc_unchecked(&cnt.num_disconnect);
71946
71947 WARN_ON(IS_ERR(cf_sk->debugfs_socket_dir));
71948 if (cf_sk->debugfs_socket_dir != NULL)
71949 @@ -1122,7 +1123,7 @@ static int caif_create(struct net *net,
71950 cf_sk->conn_req.protocol = protocol;
71951 /* Increase the number of sockets created. */
71952 dbfs_atomic_inc(&cnt.caif_nr_socks);
71953 - num = dbfs_atomic_inc(&cnt.caif_sock_create);
71954 + num = dbfs_atomic_inc_unchecked(&cnt.caif_sock_create);
71955 #ifdef CONFIG_DEBUG_FS
71956 if (!IS_ERR(debugfsdir)) {
71957
71958 diff -urNp linux-3.0.8/net/caif/cfctrl.c linux-3.0.8/net/caif/cfctrl.c
71959 --- linux-3.0.8/net/caif/cfctrl.c 2011-07-21 22:17:23.000000000 -0400
71960 +++ linux-3.0.8/net/caif/cfctrl.c 2011-08-23 21:48:14.000000000 -0400
71961 @@ -9,6 +9,7 @@
71962 #include <linux/stddef.h>
71963 #include <linux/spinlock.h>
71964 #include <linux/slab.h>
71965 +#include <linux/sched.h>
71966 #include <net/caif/caif_layer.h>
71967 #include <net/caif/cfpkt.h>
71968 #include <net/caif/cfctrl.h>
71969 @@ -45,8 +46,8 @@ struct cflayer *cfctrl_create(void)
71970 dev_info.id = 0xff;
71971 memset(this, 0, sizeof(*this));
71972 cfsrvl_init(&this->serv, 0, &dev_info, false);
71973 - atomic_set(&this->req_seq_no, 1);
71974 - atomic_set(&this->rsp_seq_no, 1);
71975 + atomic_set_unchecked(&this->req_seq_no, 1);
71976 + atomic_set_unchecked(&this->rsp_seq_no, 1);
71977 this->serv.layer.receive = cfctrl_recv;
71978 sprintf(this->serv.layer.name, "ctrl");
71979 this->serv.layer.ctrlcmd = cfctrl_ctrlcmd;
71980 @@ -132,8 +133,8 @@ static void cfctrl_insert_req(struct cfc
71981 struct cfctrl_request_info *req)
71982 {
71983 spin_lock_bh(&ctrl->info_list_lock);
71984 - atomic_inc(&ctrl->req_seq_no);
71985 - req->sequence_no = atomic_read(&ctrl->req_seq_no);
71986 + atomic_inc_unchecked(&ctrl->req_seq_no);
71987 + req->sequence_no = atomic_read_unchecked(&ctrl->req_seq_no);
71988 list_add_tail(&req->list, &ctrl->list);
71989 spin_unlock_bh(&ctrl->info_list_lock);
71990 }
71991 @@ -151,7 +152,7 @@ static struct cfctrl_request_info *cfctr
71992 if (p != first)
71993 pr_warn("Requests are not received in order\n");
71994
71995 - atomic_set(&ctrl->rsp_seq_no,
71996 + atomic_set_unchecked(&ctrl->rsp_seq_no,
71997 p->sequence_no);
71998 list_del(&p->list);
71999 goto out;
72000 @@ -364,6 +365,7 @@ static int cfctrl_recv(struct cflayer *l
72001 struct cfctrl *cfctrl = container_obj(layer);
72002 struct cfctrl_request_info rsp, *req;
72003
72004 + pax_track_stack();
72005
72006 cfpkt_extr_head(pkt, &cmdrsp, 1);
72007 cmd = cmdrsp & CFCTRL_CMD_MASK;
72008 diff -urNp linux-3.0.8/net/compat.c linux-3.0.8/net/compat.c
72009 --- linux-3.0.8/net/compat.c 2011-07-21 22:17:23.000000000 -0400
72010 +++ linux-3.0.8/net/compat.c 2011-10-06 04:17:55.000000000 -0400
72011 @@ -70,9 +70,9 @@ int get_compat_msghdr(struct msghdr *kms
72012 __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
72013 __get_user(kmsg->msg_flags, &umsg->msg_flags))
72014 return -EFAULT;
72015 - kmsg->msg_name = compat_ptr(tmp1);
72016 - kmsg->msg_iov = compat_ptr(tmp2);
72017 - kmsg->msg_control = compat_ptr(tmp3);
72018 + kmsg->msg_name = (void __force_kernel *)compat_ptr(tmp1);
72019 + kmsg->msg_iov = (void __force_kernel *)compat_ptr(tmp2);
72020 + kmsg->msg_control = (void __force_kernel *)compat_ptr(tmp3);
72021 return 0;
72022 }
72023
72024 @@ -84,7 +84,7 @@ int verify_compat_iovec(struct msghdr *k
72025
72026 if (kern_msg->msg_namelen) {
72027 if (mode == VERIFY_READ) {
72028 - int err = move_addr_to_kernel(kern_msg->msg_name,
72029 + int err = move_addr_to_kernel((void __force_user *)kern_msg->msg_name,
72030 kern_msg->msg_namelen,
72031 kern_address);
72032 if (err < 0)
72033 @@ -95,7 +95,7 @@ int verify_compat_iovec(struct msghdr *k
72034 kern_msg->msg_name = NULL;
72035
72036 tot_len = iov_from_user_compat_to_kern(kern_iov,
72037 - (struct compat_iovec __user *)kern_msg->msg_iov,
72038 + (struct compat_iovec __force_user *)kern_msg->msg_iov,
72039 kern_msg->msg_iovlen);
72040 if (tot_len >= 0)
72041 kern_msg->msg_iov = kern_iov;
72042 @@ -115,20 +115,20 @@ int verify_compat_iovec(struct msghdr *k
72043
72044 #define CMSG_COMPAT_FIRSTHDR(msg) \
72045 (((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ? \
72046 - (struct compat_cmsghdr __user *)((msg)->msg_control) : \
72047 + (struct compat_cmsghdr __force_user *)((msg)->msg_control) : \
72048 (struct compat_cmsghdr __user *)NULL)
72049
72050 #define CMSG_COMPAT_OK(ucmlen, ucmsg, mhdr) \
72051 ((ucmlen) >= sizeof(struct compat_cmsghdr) && \
72052 (ucmlen) <= (unsigned long) \
72053 ((mhdr)->msg_controllen - \
72054 - ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
72055 + ((char __force_kernel *)(ucmsg) - (char *)(mhdr)->msg_control)))
72056
72057 static inline struct compat_cmsghdr __user *cmsg_compat_nxthdr(struct msghdr *msg,
72058 struct compat_cmsghdr __user *cmsg, int cmsg_len)
72059 {
72060 char __user *ptr = (char __user *)cmsg + CMSG_COMPAT_ALIGN(cmsg_len);
72061 - if ((unsigned long)(ptr + 1 - (char __user *)msg->msg_control) >
72062 + if ((unsigned long)(ptr + 1 - (char __force_user *)msg->msg_control) >
72063 msg->msg_controllen)
72064 return NULL;
72065 return (struct compat_cmsghdr __user *)ptr;
72066 @@ -220,7 +220,7 @@ int put_cmsg_compat(struct msghdr *kmsg,
72067 {
72068 struct compat_timeval ctv;
72069 struct compat_timespec cts[3];
72070 - struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
72071 + struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
72072 struct compat_cmsghdr cmhdr;
72073 int cmlen;
72074
72075 @@ -272,7 +272,7 @@ int put_cmsg_compat(struct msghdr *kmsg,
72076
72077 void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
72078 {
72079 - struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
72080 + struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
72081 int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
72082 int fdnum = scm->fp->count;
72083 struct file **fp = scm->fp->fp;
72084 @@ -369,7 +369,7 @@ static int do_set_sock_timeout(struct so
72085 return -EFAULT;
72086 old_fs = get_fs();
72087 set_fs(KERNEL_DS);
72088 - err = sock_setsockopt(sock, level, optname, (char *)&ktime, sizeof(ktime));
72089 + err = sock_setsockopt(sock, level, optname, (char __force_user *)&ktime, sizeof(ktime));
72090 set_fs(old_fs);
72091
72092 return err;
72093 @@ -430,7 +430,7 @@ static int do_get_sock_timeout(struct so
72094 len = sizeof(ktime);
72095 old_fs = get_fs();
72096 set_fs(KERNEL_DS);
72097 - err = sock_getsockopt(sock, level, optname, (char *) &ktime, &len);
72098 + err = sock_getsockopt(sock, level, optname, (char __force_user *) &ktime, (int __force_user *)&len);
72099 set_fs(old_fs);
72100
72101 if (!err) {
72102 @@ -565,7 +565,7 @@ int compat_mc_setsockopt(struct sock *so
72103 case MCAST_JOIN_GROUP:
72104 case MCAST_LEAVE_GROUP:
72105 {
72106 - struct compat_group_req __user *gr32 = (void *)optval;
72107 + struct compat_group_req __user *gr32 = (void __user *)optval;
72108 struct group_req __user *kgr =
72109 compat_alloc_user_space(sizeof(struct group_req));
72110 u32 interface;
72111 @@ -586,7 +586,7 @@ int compat_mc_setsockopt(struct sock *so
72112 case MCAST_BLOCK_SOURCE:
72113 case MCAST_UNBLOCK_SOURCE:
72114 {
72115 - struct compat_group_source_req __user *gsr32 = (void *)optval;
72116 + struct compat_group_source_req __user *gsr32 = (void __user *)optval;
72117 struct group_source_req __user *kgsr = compat_alloc_user_space(
72118 sizeof(struct group_source_req));
72119 u32 interface;
72120 @@ -607,7 +607,7 @@ int compat_mc_setsockopt(struct sock *so
72121 }
72122 case MCAST_MSFILTER:
72123 {
72124 - struct compat_group_filter __user *gf32 = (void *)optval;
72125 + struct compat_group_filter __user *gf32 = (void __user *)optval;
72126 struct group_filter __user *kgf;
72127 u32 interface, fmode, numsrc;
72128
72129 @@ -645,7 +645,7 @@ int compat_mc_getsockopt(struct sock *so
72130 char __user *optval, int __user *optlen,
72131 int (*getsockopt)(struct sock *, int, int, char __user *, int __user *))
72132 {
72133 - struct compat_group_filter __user *gf32 = (void *)optval;
72134 + struct compat_group_filter __user *gf32 = (void __user *)optval;
72135 struct group_filter __user *kgf;
72136 int __user *koptlen;
72137 u32 interface, fmode, numsrc;
72138 diff -urNp linux-3.0.8/net/core/datagram.c linux-3.0.8/net/core/datagram.c
72139 --- linux-3.0.8/net/core/datagram.c 2011-07-21 22:17:23.000000000 -0400
72140 +++ linux-3.0.8/net/core/datagram.c 2011-08-23 21:47:56.000000000 -0400
72141 @@ -285,7 +285,7 @@ int skb_kill_datagram(struct sock *sk, s
72142 }
72143
72144 kfree_skb(skb);
72145 - atomic_inc(&sk->sk_drops);
72146 + atomic_inc_unchecked(&sk->sk_drops);
72147 sk_mem_reclaim_partial(sk);
72148
72149 return err;
72150 diff -urNp linux-3.0.8/net/core/dev.c linux-3.0.8/net/core/dev.c
72151 --- linux-3.0.8/net/core/dev.c 2011-07-21 22:17:23.000000000 -0400
72152 +++ linux-3.0.8/net/core/dev.c 2011-08-23 21:48:14.000000000 -0400
72153 @@ -1125,10 +1125,14 @@ void dev_load(struct net *net, const cha
72154 if (no_module && capable(CAP_NET_ADMIN))
72155 no_module = request_module("netdev-%s", name);
72156 if (no_module && capable(CAP_SYS_MODULE)) {
72157 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
72158 + ___request_module(true, "grsec_modharden_netdev", "%s", name);
72159 +#else
72160 if (!request_module("%s", name))
72161 pr_err("Loading kernel module for a network device "
72162 "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s "
72163 "instead\n", name);
72164 +#endif
72165 }
72166 }
72167 EXPORT_SYMBOL(dev_load);
72168 @@ -1959,7 +1963,7 @@ static int illegal_highdma(struct net_de
72169
72170 struct dev_gso_cb {
72171 void (*destructor)(struct sk_buff *skb);
72172 -};
72173 +} __no_const;
72174
72175 #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
72176
72177 @@ -2912,7 +2916,7 @@ int netif_rx_ni(struct sk_buff *skb)
72178 }
72179 EXPORT_SYMBOL(netif_rx_ni);
72180
72181 -static void net_tx_action(struct softirq_action *h)
72182 +static void net_tx_action(void)
72183 {
72184 struct softnet_data *sd = &__get_cpu_var(softnet_data);
72185
72186 @@ -3761,7 +3765,7 @@ void netif_napi_del(struct napi_struct *
72187 }
72188 EXPORT_SYMBOL(netif_napi_del);
72189
72190 -static void net_rx_action(struct softirq_action *h)
72191 +static void net_rx_action(void)
72192 {
72193 struct softnet_data *sd = &__get_cpu_var(softnet_data);
72194 unsigned long time_limit = jiffies + 2;
72195 diff -urNp linux-3.0.8/net/core/flow.c linux-3.0.8/net/core/flow.c
72196 --- linux-3.0.8/net/core/flow.c 2011-07-21 22:17:23.000000000 -0400
72197 +++ linux-3.0.8/net/core/flow.c 2011-08-23 21:47:56.000000000 -0400
72198 @@ -60,7 +60,7 @@ struct flow_cache {
72199 struct timer_list rnd_timer;
72200 };
72201
72202 -atomic_t flow_cache_genid = ATOMIC_INIT(0);
72203 +atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
72204 EXPORT_SYMBOL(flow_cache_genid);
72205 static struct flow_cache flow_cache_global;
72206 static struct kmem_cache *flow_cachep __read_mostly;
72207 @@ -85,7 +85,7 @@ static void flow_cache_new_hashrnd(unsig
72208
72209 static int flow_entry_valid(struct flow_cache_entry *fle)
72210 {
72211 - if (atomic_read(&flow_cache_genid) != fle->genid)
72212 + if (atomic_read_unchecked(&flow_cache_genid) != fle->genid)
72213 return 0;
72214 if (fle->object && !fle->object->ops->check(fle->object))
72215 return 0;
72216 @@ -253,7 +253,7 @@ flow_cache_lookup(struct net *net, const
72217 hlist_add_head(&fle->u.hlist, &fcp->hash_table[hash]);
72218 fcp->hash_count++;
72219 }
72220 - } else if (likely(fle->genid == atomic_read(&flow_cache_genid))) {
72221 + } else if (likely(fle->genid == atomic_read_unchecked(&flow_cache_genid))) {
72222 flo = fle->object;
72223 if (!flo)
72224 goto ret_object;
72225 @@ -274,7 +274,7 @@ nocache:
72226 }
72227 flo = resolver(net, key, family, dir, flo, ctx);
72228 if (fle) {
72229 - fle->genid = atomic_read(&flow_cache_genid);
72230 + fle->genid = atomic_read_unchecked(&flow_cache_genid);
72231 if (!IS_ERR(flo))
72232 fle->object = flo;
72233 else
72234 diff -urNp linux-3.0.8/net/core/iovec.c linux-3.0.8/net/core/iovec.c
72235 --- linux-3.0.8/net/core/iovec.c 2011-07-21 22:17:23.000000000 -0400
72236 +++ linux-3.0.8/net/core/iovec.c 2011-10-06 04:17:55.000000000 -0400
72237 @@ -42,7 +42,7 @@ int verify_iovec(struct msghdr *m, struc
72238 if (m->msg_namelen) {
72239 if (mode == VERIFY_READ) {
72240 void __user *namep;
72241 - namep = (void __user __force *) m->msg_name;
72242 + namep = (void __force_user *) m->msg_name;
72243 err = move_addr_to_kernel(namep, m->msg_namelen,
72244 address);
72245 if (err < 0)
72246 @@ -54,7 +54,7 @@ int verify_iovec(struct msghdr *m, struc
72247 }
72248
72249 size = m->msg_iovlen * sizeof(struct iovec);
72250 - if (copy_from_user(iov, (void __user __force *) m->msg_iov, size))
72251 + if (copy_from_user(iov, (void __force_user *) m->msg_iov, size))
72252 return -EFAULT;
72253
72254 m->msg_iov = iov;
72255 diff -urNp linux-3.0.8/net/core/rtnetlink.c linux-3.0.8/net/core/rtnetlink.c
72256 --- linux-3.0.8/net/core/rtnetlink.c 2011-07-21 22:17:23.000000000 -0400
72257 +++ linux-3.0.8/net/core/rtnetlink.c 2011-08-23 21:47:56.000000000 -0400
72258 @@ -56,7 +56,7 @@
72259 struct rtnl_link {
72260 rtnl_doit_func doit;
72261 rtnl_dumpit_func dumpit;
72262 -};
72263 +} __no_const;
72264
72265 static DEFINE_MUTEX(rtnl_mutex);
72266
72267 diff -urNp linux-3.0.8/net/core/scm.c linux-3.0.8/net/core/scm.c
72268 --- linux-3.0.8/net/core/scm.c 2011-10-24 08:05:30.000000000 -0400
72269 +++ linux-3.0.8/net/core/scm.c 2011-10-16 21:55:28.000000000 -0400
72270 @@ -218,7 +218,7 @@ EXPORT_SYMBOL(__scm_send);
72271 int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
72272 {
72273 struct cmsghdr __user *cm
72274 - = (__force struct cmsghdr __user *)msg->msg_control;
72275 + = (struct cmsghdr __force_user *)msg->msg_control;
72276 struct cmsghdr cmhdr;
72277 int cmlen = CMSG_LEN(len);
72278 int err;
72279 @@ -241,7 +241,7 @@ int put_cmsg(struct msghdr * msg, int le
72280 err = -EFAULT;
72281 if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
72282 goto out;
72283 - if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
72284 + if (copy_to_user((void __force_user *)CMSG_DATA((void __force_kernel *)cm), data, cmlen - sizeof(struct cmsghdr)))
72285 goto out;
72286 cmlen = CMSG_SPACE(len);
72287 if (msg->msg_controllen < cmlen)
72288 @@ -257,7 +257,7 @@ EXPORT_SYMBOL(put_cmsg);
72289 void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
72290 {
72291 struct cmsghdr __user *cm
72292 - = (__force struct cmsghdr __user*)msg->msg_control;
72293 + = (struct cmsghdr __force_user *)msg->msg_control;
72294
72295 int fdmax = 0;
72296 int fdnum = scm->fp->count;
72297 @@ -277,7 +277,7 @@ void scm_detach_fds(struct msghdr *msg,
72298 if (fdnum < fdmax)
72299 fdmax = fdnum;
72300
72301 - for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
72302 + for (i=0, cmfptr=(int __force_user *)CMSG_DATA((void __force_kernel *)cm); i<fdmax;
72303 i++, cmfptr++)
72304 {
72305 int new_fd;
72306 diff -urNp linux-3.0.8/net/core/skbuff.c linux-3.0.8/net/core/skbuff.c
72307 --- linux-3.0.8/net/core/skbuff.c 2011-07-21 22:17:23.000000000 -0400
72308 +++ linux-3.0.8/net/core/skbuff.c 2011-08-23 21:48:14.000000000 -0400
72309 @@ -1543,6 +1543,8 @@ int skb_splice_bits(struct sk_buff *skb,
72310 struct sock *sk = skb->sk;
72311 int ret = 0;
72312
72313 + pax_track_stack();
72314 +
72315 if (splice_grow_spd(pipe, &spd))
72316 return -ENOMEM;
72317
72318 diff -urNp linux-3.0.8/net/core/sock.c linux-3.0.8/net/core/sock.c
72319 --- linux-3.0.8/net/core/sock.c 2011-07-21 22:17:23.000000000 -0400
72320 +++ linux-3.0.8/net/core/sock.c 2011-08-23 21:48:14.000000000 -0400
72321 @@ -291,7 +291,7 @@ int sock_queue_rcv_skb(struct sock *sk,
72322 */
72323 if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
72324 (unsigned)sk->sk_rcvbuf) {
72325 - atomic_inc(&sk->sk_drops);
72326 + atomic_inc_unchecked(&sk->sk_drops);
72327 return -ENOMEM;
72328 }
72329
72330 @@ -300,7 +300,7 @@ int sock_queue_rcv_skb(struct sock *sk,
72331 return err;
72332
72333 if (!sk_rmem_schedule(sk, skb->truesize)) {
72334 - atomic_inc(&sk->sk_drops);
72335 + atomic_inc_unchecked(&sk->sk_drops);
72336 return -ENOBUFS;
72337 }
72338
72339 @@ -320,7 +320,7 @@ int sock_queue_rcv_skb(struct sock *sk,
72340 skb_dst_force(skb);
72341
72342 spin_lock_irqsave(&list->lock, flags);
72343 - skb->dropcount = atomic_read(&sk->sk_drops);
72344 + skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
72345 __skb_queue_tail(list, skb);
72346 spin_unlock_irqrestore(&list->lock, flags);
72347
72348 @@ -340,7 +340,7 @@ int sk_receive_skb(struct sock *sk, stru
72349 skb->dev = NULL;
72350
72351 if (sk_rcvqueues_full(sk, skb)) {
72352 - atomic_inc(&sk->sk_drops);
72353 + atomic_inc_unchecked(&sk->sk_drops);
72354 goto discard_and_relse;
72355 }
72356 if (nested)
72357 @@ -358,7 +358,7 @@ int sk_receive_skb(struct sock *sk, stru
72358 mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
72359 } else if (sk_add_backlog(sk, skb)) {
72360 bh_unlock_sock(sk);
72361 - atomic_inc(&sk->sk_drops);
72362 + atomic_inc_unchecked(&sk->sk_drops);
72363 goto discard_and_relse;
72364 }
72365
72366 @@ -921,7 +921,7 @@ int sock_getsockopt(struct socket *sock,
72367 if (len > sizeof(peercred))
72368 len = sizeof(peercred);
72369 cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred);
72370 - if (copy_to_user(optval, &peercred, len))
72371 + if (len > sizeof(peercred) || copy_to_user(optval, &peercred, len))
72372 return -EFAULT;
72373 goto lenout;
72374 }
72375 @@ -934,7 +934,7 @@ int sock_getsockopt(struct socket *sock,
72376 return -ENOTCONN;
72377 if (lv < len)
72378 return -EINVAL;
72379 - if (copy_to_user(optval, address, len))
72380 + if (len > sizeof(address) || copy_to_user(optval, address, len))
72381 return -EFAULT;
72382 goto lenout;
72383 }
72384 @@ -967,7 +967,7 @@ int sock_getsockopt(struct socket *sock,
72385
72386 if (len > lv)
72387 len = lv;
72388 - if (copy_to_user(optval, &v, len))
72389 + if (len > sizeof(v) || copy_to_user(optval, &v, len))
72390 return -EFAULT;
72391 lenout:
72392 if (put_user(len, optlen))
72393 @@ -2023,7 +2023,7 @@ void sock_init_data(struct socket *sock,
72394 */
72395 smp_wmb();
72396 atomic_set(&sk->sk_refcnt, 1);
72397 - atomic_set(&sk->sk_drops, 0);
72398 + atomic_set_unchecked(&sk->sk_drops, 0);
72399 }
72400 EXPORT_SYMBOL(sock_init_data);
72401
72402 diff -urNp linux-3.0.8/net/decnet/sysctl_net_decnet.c linux-3.0.8/net/decnet/sysctl_net_decnet.c
72403 --- linux-3.0.8/net/decnet/sysctl_net_decnet.c 2011-07-21 22:17:23.000000000 -0400
72404 +++ linux-3.0.8/net/decnet/sysctl_net_decnet.c 2011-08-23 21:47:56.000000000 -0400
72405 @@ -173,7 +173,7 @@ static int dn_node_address_handler(ctl_t
72406
72407 if (len > *lenp) len = *lenp;
72408
72409 - if (copy_to_user(buffer, addr, len))
72410 + if (len > sizeof addr || copy_to_user(buffer, addr, len))
72411 return -EFAULT;
72412
72413 *lenp = len;
72414 @@ -236,7 +236,7 @@ static int dn_def_dev_handler(ctl_table
72415
72416 if (len > *lenp) len = *lenp;
72417
72418 - if (copy_to_user(buffer, devname, len))
72419 + if (len > sizeof devname || copy_to_user(buffer, devname, len))
72420 return -EFAULT;
72421
72422 *lenp = len;
72423 diff -urNp linux-3.0.8/net/econet/Kconfig linux-3.0.8/net/econet/Kconfig
72424 --- linux-3.0.8/net/econet/Kconfig 2011-07-21 22:17:23.000000000 -0400
72425 +++ linux-3.0.8/net/econet/Kconfig 2011-08-23 21:48:14.000000000 -0400
72426 @@ -4,7 +4,7 @@
72427
72428 config ECONET
72429 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
72430 - depends on EXPERIMENTAL && INET
72431 + depends on EXPERIMENTAL && INET && BROKEN
72432 ---help---
72433 Econet is a fairly old and slow networking protocol mainly used by
72434 Acorn computers to access file and print servers. It uses native
72435 diff -urNp linux-3.0.8/net/ipv4/fib_frontend.c linux-3.0.8/net/ipv4/fib_frontend.c
72436 --- linux-3.0.8/net/ipv4/fib_frontend.c 2011-07-21 22:17:23.000000000 -0400
72437 +++ linux-3.0.8/net/ipv4/fib_frontend.c 2011-08-23 21:47:56.000000000 -0400
72438 @@ -970,12 +970,12 @@ static int fib_inetaddr_event(struct not
72439 #ifdef CONFIG_IP_ROUTE_MULTIPATH
72440 fib_sync_up(dev);
72441 #endif
72442 - atomic_inc(&net->ipv4.dev_addr_genid);
72443 + atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
72444 rt_cache_flush(dev_net(dev), -1);
72445 break;
72446 case NETDEV_DOWN:
72447 fib_del_ifaddr(ifa, NULL);
72448 - atomic_inc(&net->ipv4.dev_addr_genid);
72449 + atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
72450 if (ifa->ifa_dev->ifa_list == NULL) {
72451 /* Last address was deleted from this interface.
72452 * Disable IP.
72453 @@ -1011,7 +1011,7 @@ static int fib_netdev_event(struct notif
72454 #ifdef CONFIG_IP_ROUTE_MULTIPATH
72455 fib_sync_up(dev);
72456 #endif
72457 - atomic_inc(&net->ipv4.dev_addr_genid);
72458 + atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
72459 rt_cache_flush(dev_net(dev), -1);
72460 break;
72461 case NETDEV_DOWN:
72462 diff -urNp linux-3.0.8/net/ipv4/fib_semantics.c linux-3.0.8/net/ipv4/fib_semantics.c
72463 --- linux-3.0.8/net/ipv4/fib_semantics.c 2011-07-21 22:17:23.000000000 -0400
72464 +++ linux-3.0.8/net/ipv4/fib_semantics.c 2011-08-23 21:47:56.000000000 -0400
72465 @@ -691,7 +691,7 @@ __be32 fib_info_update_nh_saddr(struct n
72466 nh->nh_saddr = inet_select_addr(nh->nh_dev,
72467 nh->nh_gw,
72468 nh->nh_parent->fib_scope);
72469 - nh->nh_saddr_genid = atomic_read(&net->ipv4.dev_addr_genid);
72470 + nh->nh_saddr_genid = atomic_read_unchecked(&net->ipv4.dev_addr_genid);
72471
72472 return nh->nh_saddr;
72473 }
72474 diff -urNp linux-3.0.8/net/ipv4/inet_diag.c linux-3.0.8/net/ipv4/inet_diag.c
72475 --- linux-3.0.8/net/ipv4/inet_diag.c 2011-07-21 22:17:23.000000000 -0400
72476 +++ linux-3.0.8/net/ipv4/inet_diag.c 2011-08-23 21:48:14.000000000 -0400
72477 @@ -114,8 +114,14 @@ static int inet_csk_diag_fill(struct soc
72478 r->idiag_retrans = 0;
72479
72480 r->id.idiag_if = sk->sk_bound_dev_if;
72481 +
72482 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72483 + r->id.idiag_cookie[0] = 0;
72484 + r->id.idiag_cookie[1] = 0;
72485 +#else
72486 r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
72487 r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
72488 +#endif
72489
72490 r->id.idiag_sport = inet->inet_sport;
72491 r->id.idiag_dport = inet->inet_dport;
72492 @@ -201,8 +207,15 @@ static int inet_twsk_diag_fill(struct in
72493 r->idiag_family = tw->tw_family;
72494 r->idiag_retrans = 0;
72495 r->id.idiag_if = tw->tw_bound_dev_if;
72496 +
72497 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72498 + r->id.idiag_cookie[0] = 0;
72499 + r->id.idiag_cookie[1] = 0;
72500 +#else
72501 r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
72502 r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
72503 +#endif
72504 +
72505 r->id.idiag_sport = tw->tw_sport;
72506 r->id.idiag_dport = tw->tw_dport;
72507 r->id.idiag_src[0] = tw->tw_rcv_saddr;
72508 @@ -285,12 +298,14 @@ static int inet_diag_get_exact(struct sk
72509 if (sk == NULL)
72510 goto unlock;
72511
72512 +#ifndef CONFIG_GRKERNSEC_HIDESYM
72513 err = -ESTALE;
72514 if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
72515 req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
72516 ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
72517 (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
72518 goto out;
72519 +#endif
72520
72521 err = -ENOMEM;
72522 rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
72523 @@ -580,8 +595,14 @@ static int inet_diag_fill_req(struct sk_
72524 r->idiag_retrans = req->retrans;
72525
72526 r->id.idiag_if = sk->sk_bound_dev_if;
72527 +
72528 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72529 + r->id.idiag_cookie[0] = 0;
72530 + r->id.idiag_cookie[1] = 0;
72531 +#else
72532 r->id.idiag_cookie[0] = (u32)(unsigned long)req;
72533 r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
72534 +#endif
72535
72536 tmo = req->expires - jiffies;
72537 if (tmo < 0)
72538 diff -urNp linux-3.0.8/net/ipv4/inet_hashtables.c linux-3.0.8/net/ipv4/inet_hashtables.c
72539 --- linux-3.0.8/net/ipv4/inet_hashtables.c 2011-10-24 08:05:21.000000000 -0400
72540 +++ linux-3.0.8/net/ipv4/inet_hashtables.c 2011-08-23 21:55:24.000000000 -0400
72541 @@ -18,12 +18,15 @@
72542 #include <linux/sched.h>
72543 #include <linux/slab.h>
72544 #include <linux/wait.h>
72545 +#include <linux/security.h>
72546
72547 #include <net/inet_connection_sock.h>
72548 #include <net/inet_hashtables.h>
72549 #include <net/secure_seq.h>
72550 #include <net/ip.h>
72551
72552 +extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
72553 +
72554 /*
72555 * Allocate and initialize a new local port bind bucket.
72556 * The bindhash mutex for snum's hash chain must be held here.
72557 @@ -530,6 +533,8 @@ ok:
72558 twrefcnt += inet_twsk_bind_unhash(tw, hinfo);
72559 spin_unlock(&head->lock);
72560
72561 + gr_update_task_in_ip_table(current, inet_sk(sk));
72562 +
72563 if (tw) {
72564 inet_twsk_deschedule(tw, death_row);
72565 while (twrefcnt) {
72566 diff -urNp linux-3.0.8/net/ipv4/inetpeer.c linux-3.0.8/net/ipv4/inetpeer.c
72567 --- linux-3.0.8/net/ipv4/inetpeer.c 2011-10-24 08:05:21.000000000 -0400
72568 +++ linux-3.0.8/net/ipv4/inetpeer.c 2011-08-23 21:48:14.000000000 -0400
72569 @@ -481,6 +481,8 @@ struct inet_peer *inet_getpeer(struct in
72570 unsigned int sequence;
72571 int invalidated, newrefcnt = 0;
72572
72573 + pax_track_stack();
72574 +
72575 /* Look up for the address quickly, lockless.
72576 * Because of a concurrent writer, we might not find an existing entry.
72577 */
72578 @@ -517,8 +519,8 @@ found: /* The existing node has been fo
72579 if (p) {
72580 p->daddr = *daddr;
72581 atomic_set(&p->refcnt, 1);
72582 - atomic_set(&p->rid, 0);
72583 - atomic_set(&p->ip_id_count, secure_ip_id(daddr->addr.a4));
72584 + atomic_set_unchecked(&p->rid, 0);
72585 + atomic_set_unchecked(&p->ip_id_count, secure_ip_id(daddr->addr.a4));
72586 p->tcp_ts_stamp = 0;
72587 p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
72588 p->rate_tokens = 0;
72589 diff -urNp linux-3.0.8/net/ipv4/ipconfig.c linux-3.0.8/net/ipv4/ipconfig.c
72590 --- linux-3.0.8/net/ipv4/ipconfig.c 2011-07-21 22:17:23.000000000 -0400
72591 +++ linux-3.0.8/net/ipv4/ipconfig.c 2011-10-06 04:17:55.000000000 -0400
72592 @@ -313,7 +313,7 @@ static int __init ic_devinet_ioctl(unsig
72593
72594 mm_segment_t oldfs = get_fs();
72595 set_fs(get_ds());
72596 - res = devinet_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
72597 + res = devinet_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
72598 set_fs(oldfs);
72599 return res;
72600 }
72601 @@ -324,7 +324,7 @@ static int __init ic_dev_ioctl(unsigned
72602
72603 mm_segment_t oldfs = get_fs();
72604 set_fs(get_ds());
72605 - res = dev_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
72606 + res = dev_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
72607 set_fs(oldfs);
72608 return res;
72609 }
72610 @@ -335,7 +335,7 @@ static int __init ic_route_ioctl(unsigne
72611
72612 mm_segment_t oldfs = get_fs();
72613 set_fs(get_ds());
72614 - res = ip_rt_ioctl(&init_net, cmd, (void __user *) arg);
72615 + res = ip_rt_ioctl(&init_net, cmd, (void __force_user *) arg);
72616 set_fs(oldfs);
72617 return res;
72618 }
72619 diff -urNp linux-3.0.8/net/ipv4/ip_fragment.c linux-3.0.8/net/ipv4/ip_fragment.c
72620 --- linux-3.0.8/net/ipv4/ip_fragment.c 2011-07-21 22:17:23.000000000 -0400
72621 +++ linux-3.0.8/net/ipv4/ip_fragment.c 2011-08-23 21:47:56.000000000 -0400
72622 @@ -315,7 +315,7 @@ static inline int ip_frag_too_far(struct
72623 return 0;
72624
72625 start = qp->rid;
72626 - end = atomic_inc_return(&peer->rid);
72627 + end = atomic_inc_return_unchecked(&peer->rid);
72628 qp->rid = end;
72629
72630 rc = qp->q.fragments && (end - start) > max;
72631 diff -urNp linux-3.0.8/net/ipv4/ip_sockglue.c linux-3.0.8/net/ipv4/ip_sockglue.c
72632 --- linux-3.0.8/net/ipv4/ip_sockglue.c 2011-07-21 22:17:23.000000000 -0400
72633 +++ linux-3.0.8/net/ipv4/ip_sockglue.c 2011-10-06 04:17:55.000000000 -0400
72634 @@ -1073,6 +1073,8 @@ static int do_ip_getsockopt(struct sock
72635 int val;
72636 int len;
72637
72638 + pax_track_stack();
72639 +
72640 if (level != SOL_IP)
72641 return -EOPNOTSUPP;
72642
72643 @@ -1110,7 +1112,8 @@ static int do_ip_getsockopt(struct sock
72644 len = min_t(unsigned int, len, opt->optlen);
72645 if (put_user(len, optlen))
72646 return -EFAULT;
72647 - if (copy_to_user(optval, opt->__data, len))
72648 + if ((len > (sizeof(optbuf) - sizeof(struct ip_options))) ||
72649 + copy_to_user(optval, opt->__data, len))
72650 return -EFAULT;
72651 return 0;
72652 }
72653 @@ -1238,7 +1241,7 @@ static int do_ip_getsockopt(struct sock
72654 if (sk->sk_type != SOCK_STREAM)
72655 return -ENOPROTOOPT;
72656
72657 - msg.msg_control = optval;
72658 + msg.msg_control = (void __force_kernel *)optval;
72659 msg.msg_controllen = len;
72660 msg.msg_flags = 0;
72661
72662 diff -urNp linux-3.0.8/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-3.0.8/net/ipv4/netfilter/nf_nat_snmp_basic.c
72663 --- linux-3.0.8/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-07-21 22:17:23.000000000 -0400
72664 +++ linux-3.0.8/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-08-23 21:47:56.000000000 -0400
72665 @@ -399,7 +399,7 @@ static unsigned char asn1_octets_decode(
72666
72667 *len = 0;
72668
72669 - *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
72670 + *octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
72671 if (*octets == NULL) {
72672 if (net_ratelimit())
72673 pr_notice("OOM in bsalg (%d)\n", __LINE__);
72674 diff -urNp linux-3.0.8/net/ipv4/ping.c linux-3.0.8/net/ipv4/ping.c
72675 --- linux-3.0.8/net/ipv4/ping.c 2011-07-21 22:17:23.000000000 -0400
72676 +++ linux-3.0.8/net/ipv4/ping.c 2011-08-23 21:47:56.000000000 -0400
72677 @@ -837,7 +837,7 @@ static void ping_format_sock(struct sock
72678 sk_rmem_alloc_get(sp),
72679 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
72680 atomic_read(&sp->sk_refcnt), sp,
72681 - atomic_read(&sp->sk_drops), len);
72682 + atomic_read_unchecked(&sp->sk_drops), len);
72683 }
72684
72685 static int ping_seq_show(struct seq_file *seq, void *v)
72686 diff -urNp linux-3.0.8/net/ipv4/raw.c linux-3.0.8/net/ipv4/raw.c
72687 --- linux-3.0.8/net/ipv4/raw.c 2011-07-21 22:17:23.000000000 -0400
72688 +++ linux-3.0.8/net/ipv4/raw.c 2011-08-23 21:48:14.000000000 -0400
72689 @@ -302,7 +302,7 @@ static int raw_rcv_skb(struct sock * sk,
72690 int raw_rcv(struct sock *sk, struct sk_buff *skb)
72691 {
72692 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
72693 - atomic_inc(&sk->sk_drops);
72694 + atomic_inc_unchecked(&sk->sk_drops);
72695 kfree_skb(skb);
72696 return NET_RX_DROP;
72697 }
72698 @@ -736,16 +736,20 @@ static int raw_init(struct sock *sk)
72699
72700 static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
72701 {
72702 + struct icmp_filter filter;
72703 +
72704 if (optlen > sizeof(struct icmp_filter))
72705 optlen = sizeof(struct icmp_filter);
72706 - if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
72707 + if (copy_from_user(&filter, optval, optlen))
72708 return -EFAULT;
72709 + raw_sk(sk)->filter = filter;
72710 return 0;
72711 }
72712
72713 static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
72714 {
72715 int len, ret = -EFAULT;
72716 + struct icmp_filter filter;
72717
72718 if (get_user(len, optlen))
72719 goto out;
72720 @@ -755,8 +759,9 @@ static int raw_geticmpfilter(struct sock
72721 if (len > sizeof(struct icmp_filter))
72722 len = sizeof(struct icmp_filter);
72723 ret = -EFAULT;
72724 - if (put_user(len, optlen) ||
72725 - copy_to_user(optval, &raw_sk(sk)->filter, len))
72726 + filter = raw_sk(sk)->filter;
72727 + if (put_user(len, optlen) || len > sizeof filter ||
72728 + copy_to_user(optval, &filter, len))
72729 goto out;
72730 ret = 0;
72731 out: return ret;
72732 @@ -984,7 +989,13 @@ static void raw_sock_seq_show(struct seq
72733 sk_wmem_alloc_get(sp),
72734 sk_rmem_alloc_get(sp),
72735 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
72736 - atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
72737 + atomic_read(&sp->sk_refcnt),
72738 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72739 + NULL,
72740 +#else
72741 + sp,
72742 +#endif
72743 + atomic_read_unchecked(&sp->sk_drops));
72744 }
72745
72746 static int raw_seq_show(struct seq_file *seq, void *v)
72747 diff -urNp linux-3.0.8/net/ipv4/route.c linux-3.0.8/net/ipv4/route.c
72748 --- linux-3.0.8/net/ipv4/route.c 2011-10-24 08:05:30.000000000 -0400
72749 +++ linux-3.0.8/net/ipv4/route.c 2011-10-16 21:55:28.000000000 -0400
72750 @@ -304,7 +304,7 @@ static inline unsigned int rt_hash(__be3
72751
72752 static inline int rt_genid(struct net *net)
72753 {
72754 - return atomic_read(&net->ipv4.rt_genid);
72755 + return atomic_read_unchecked(&net->ipv4.rt_genid);
72756 }
72757
72758 #ifdef CONFIG_PROC_FS
72759 @@ -832,7 +832,7 @@ static void rt_cache_invalidate(struct n
72760 unsigned char shuffle;
72761
72762 get_random_bytes(&shuffle, sizeof(shuffle));
72763 - atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
72764 + atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
72765 }
72766
72767 /*
72768 @@ -2832,7 +2832,7 @@ static int rt_fill_info(struct net *net,
72769 error = rt->dst.error;
72770 if (peer) {
72771 inet_peer_refcheck(rt->peer);
72772 - id = atomic_read(&peer->ip_id_count) & 0xffff;
72773 + id = atomic_read_unchecked(&peer->ip_id_count) & 0xffff;
72774 if (peer->tcp_ts_stamp) {
72775 ts = peer->tcp_ts;
72776 tsage = get_seconds() - peer->tcp_ts_stamp;
72777 diff -urNp linux-3.0.8/net/ipv4/tcp.c linux-3.0.8/net/ipv4/tcp.c
72778 --- linux-3.0.8/net/ipv4/tcp.c 2011-07-21 22:17:23.000000000 -0400
72779 +++ linux-3.0.8/net/ipv4/tcp.c 2011-08-23 21:48:14.000000000 -0400
72780 @@ -2122,6 +2122,8 @@ static int do_tcp_setsockopt(struct sock
72781 int val;
72782 int err = 0;
72783
72784 + pax_track_stack();
72785 +
72786 /* These are data/string values, all the others are ints */
72787 switch (optname) {
72788 case TCP_CONGESTION: {
72789 @@ -2501,6 +2503,8 @@ static int do_tcp_getsockopt(struct sock
72790 struct tcp_sock *tp = tcp_sk(sk);
72791 int val, len;
72792
72793 + pax_track_stack();
72794 +
72795 if (get_user(len, optlen))
72796 return -EFAULT;
72797
72798 diff -urNp linux-3.0.8/net/ipv4/tcp_ipv4.c linux-3.0.8/net/ipv4/tcp_ipv4.c
72799 --- linux-3.0.8/net/ipv4/tcp_ipv4.c 2011-10-24 08:05:21.000000000 -0400
72800 +++ linux-3.0.8/net/ipv4/tcp_ipv4.c 2011-08-23 21:48:14.000000000 -0400
72801 @@ -87,6 +87,9 @@ int sysctl_tcp_tw_reuse __read_mostly;
72802 int sysctl_tcp_low_latency __read_mostly;
72803 EXPORT_SYMBOL(sysctl_tcp_low_latency);
72804
72805 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72806 +extern int grsec_enable_blackhole;
72807 +#endif
72808
72809 #ifdef CONFIG_TCP_MD5SIG
72810 static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
72811 @@ -1607,6 +1610,9 @@ int tcp_v4_do_rcv(struct sock *sk, struc
72812 return 0;
72813
72814 reset:
72815 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72816 + if (!grsec_enable_blackhole)
72817 +#endif
72818 tcp_v4_send_reset(rsk, skb);
72819 discard:
72820 kfree_skb(skb);
72821 @@ -1669,12 +1675,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
72822 TCP_SKB_CB(skb)->sacked = 0;
72823
72824 sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
72825 - if (!sk)
72826 + if (!sk) {
72827 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72828 + ret = 1;
72829 +#endif
72830 goto no_tcp_socket;
72831 -
72832 + }
72833 process:
72834 - if (sk->sk_state == TCP_TIME_WAIT)
72835 + if (sk->sk_state == TCP_TIME_WAIT) {
72836 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72837 + ret = 2;
72838 +#endif
72839 goto do_time_wait;
72840 + }
72841
72842 if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
72843 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
72844 @@ -1724,6 +1737,10 @@ no_tcp_socket:
72845 bad_packet:
72846 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
72847 } else {
72848 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72849 + if (!grsec_enable_blackhole || (ret == 1 &&
72850 + (skb->dev->flags & IFF_LOOPBACK)))
72851 +#endif
72852 tcp_v4_send_reset(NULL, skb);
72853 }
72854
72855 @@ -2388,7 +2405,11 @@ static void get_openreq4(struct sock *sk
72856 0, /* non standard timer */
72857 0, /* open_requests have no inode */
72858 atomic_read(&sk->sk_refcnt),
72859 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72860 + NULL,
72861 +#else
72862 req,
72863 +#endif
72864 len);
72865 }
72866
72867 @@ -2438,7 +2459,12 @@ static void get_tcp4_sock(struct sock *s
72868 sock_i_uid(sk),
72869 icsk->icsk_probes_out,
72870 sock_i_ino(sk),
72871 - atomic_read(&sk->sk_refcnt), sk,
72872 + atomic_read(&sk->sk_refcnt),
72873 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72874 + NULL,
72875 +#else
72876 + sk,
72877 +#endif
72878 jiffies_to_clock_t(icsk->icsk_rto),
72879 jiffies_to_clock_t(icsk->icsk_ack.ato),
72880 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
72881 @@ -2466,7 +2492,13 @@ static void get_timewait4_sock(struct in
72882 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK%n",
72883 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
72884 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
72885 - atomic_read(&tw->tw_refcnt), tw, len);
72886 + atomic_read(&tw->tw_refcnt),
72887 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72888 + NULL,
72889 +#else
72890 + tw,
72891 +#endif
72892 + len);
72893 }
72894
72895 #define TMPSZ 150
72896 diff -urNp linux-3.0.8/net/ipv4/tcp_minisocks.c linux-3.0.8/net/ipv4/tcp_minisocks.c
72897 --- linux-3.0.8/net/ipv4/tcp_minisocks.c 2011-07-21 22:17:23.000000000 -0400
72898 +++ linux-3.0.8/net/ipv4/tcp_minisocks.c 2011-08-23 21:48:14.000000000 -0400
72899 @@ -27,6 +27,10 @@
72900 #include <net/inet_common.h>
72901 #include <net/xfrm.h>
72902
72903 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72904 +extern int grsec_enable_blackhole;
72905 +#endif
72906 +
72907 int sysctl_tcp_syncookies __read_mostly = 1;
72908 EXPORT_SYMBOL(sysctl_tcp_syncookies);
72909
72910 @@ -745,6 +749,10 @@ listen_overflow:
72911
72912 embryonic_reset:
72913 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
72914 +
72915 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72916 + if (!grsec_enable_blackhole)
72917 +#endif
72918 if (!(flg & TCP_FLAG_RST))
72919 req->rsk_ops->send_reset(sk, skb);
72920
72921 diff -urNp linux-3.0.8/net/ipv4/tcp_output.c linux-3.0.8/net/ipv4/tcp_output.c
72922 --- linux-3.0.8/net/ipv4/tcp_output.c 2011-07-21 22:17:23.000000000 -0400
72923 +++ linux-3.0.8/net/ipv4/tcp_output.c 2011-08-23 21:48:14.000000000 -0400
72924 @@ -2421,6 +2421,8 @@ struct sk_buff *tcp_make_synack(struct s
72925 int mss;
72926 int s_data_desired = 0;
72927
72928 + pax_track_stack();
72929 +
72930 if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired)
72931 s_data_desired = cvp->s_data_desired;
72932 skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15 + s_data_desired, 1, GFP_ATOMIC);
72933 diff -urNp linux-3.0.8/net/ipv4/tcp_probe.c linux-3.0.8/net/ipv4/tcp_probe.c
72934 --- linux-3.0.8/net/ipv4/tcp_probe.c 2011-07-21 22:17:23.000000000 -0400
72935 +++ linux-3.0.8/net/ipv4/tcp_probe.c 2011-08-23 21:47:56.000000000 -0400
72936 @@ -202,7 +202,7 @@ static ssize_t tcpprobe_read(struct file
72937 if (cnt + width >= len)
72938 break;
72939
72940 - if (copy_to_user(buf + cnt, tbuf, width))
72941 + if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
72942 return -EFAULT;
72943 cnt += width;
72944 }
72945 diff -urNp linux-3.0.8/net/ipv4/tcp_timer.c linux-3.0.8/net/ipv4/tcp_timer.c
72946 --- linux-3.0.8/net/ipv4/tcp_timer.c 2011-07-21 22:17:23.000000000 -0400
72947 +++ linux-3.0.8/net/ipv4/tcp_timer.c 2011-08-23 21:48:14.000000000 -0400
72948 @@ -22,6 +22,10 @@
72949 #include <linux/gfp.h>
72950 #include <net/tcp.h>
72951
72952 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72953 +extern int grsec_lastack_retries;
72954 +#endif
72955 +
72956 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
72957 int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
72958 int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
72959 @@ -199,6 +203,13 @@ static int tcp_write_timeout(struct sock
72960 }
72961 }
72962
72963 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72964 + if ((sk->sk_state == TCP_LAST_ACK) &&
72965 + (grsec_lastack_retries > 0) &&
72966 + (grsec_lastack_retries < retry_until))
72967 + retry_until = grsec_lastack_retries;
72968 +#endif
72969 +
72970 if (retransmits_timed_out(sk, retry_until,
72971 syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
72972 /* Has it gone just too far? */
72973 diff -urNp linux-3.0.8/net/ipv4/udp.c linux-3.0.8/net/ipv4/udp.c
72974 --- linux-3.0.8/net/ipv4/udp.c 2011-07-21 22:17:23.000000000 -0400
72975 +++ linux-3.0.8/net/ipv4/udp.c 2011-08-23 21:48:14.000000000 -0400
72976 @@ -86,6 +86,7 @@
72977 #include <linux/types.h>
72978 #include <linux/fcntl.h>
72979 #include <linux/module.h>
72980 +#include <linux/security.h>
72981 #include <linux/socket.h>
72982 #include <linux/sockios.h>
72983 #include <linux/igmp.h>
72984 @@ -107,6 +108,10 @@
72985 #include <net/xfrm.h>
72986 #include "udp_impl.h"
72987
72988 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72989 +extern int grsec_enable_blackhole;
72990 +#endif
72991 +
72992 struct udp_table udp_table __read_mostly;
72993 EXPORT_SYMBOL(udp_table);
72994
72995 @@ -564,6 +569,9 @@ found:
72996 return s;
72997 }
72998
72999 +extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
73000 +extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
73001 +
73002 /*
73003 * This routine is called by the ICMP module when it gets some
73004 * sort of error condition. If err < 0 then the socket should
73005 @@ -855,9 +863,18 @@ int udp_sendmsg(struct kiocb *iocb, stru
73006 dport = usin->sin_port;
73007 if (dport == 0)
73008 return -EINVAL;
73009 +
73010 + err = gr_search_udp_sendmsg(sk, usin);
73011 + if (err)
73012 + return err;
73013 } else {
73014 if (sk->sk_state != TCP_ESTABLISHED)
73015 return -EDESTADDRREQ;
73016 +
73017 + err = gr_search_udp_sendmsg(sk, NULL);
73018 + if (err)
73019 + return err;
73020 +
73021 daddr = inet->inet_daddr;
73022 dport = inet->inet_dport;
73023 /* Open fast path for connected socket.
73024 @@ -1098,7 +1115,7 @@ static unsigned int first_packet_length(
73025 udp_lib_checksum_complete(skb)) {
73026 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
73027 IS_UDPLITE(sk));
73028 - atomic_inc(&sk->sk_drops);
73029 + atomic_inc_unchecked(&sk->sk_drops);
73030 __skb_unlink(skb, rcvq);
73031 __skb_queue_tail(&list_kill, skb);
73032 }
73033 @@ -1184,6 +1201,10 @@ try_again:
73034 if (!skb)
73035 goto out;
73036
73037 + err = gr_search_udp_recvmsg(sk, skb);
73038 + if (err)
73039 + goto out_free;
73040 +
73041 ulen = skb->len - sizeof(struct udphdr);
73042 if (len > ulen)
73043 len = ulen;
73044 @@ -1483,7 +1504,7 @@ int udp_queue_rcv_skb(struct sock *sk, s
73045
73046 drop:
73047 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
73048 - atomic_inc(&sk->sk_drops);
73049 + atomic_inc_unchecked(&sk->sk_drops);
73050 kfree_skb(skb);
73051 return -1;
73052 }
73053 @@ -1502,7 +1523,7 @@ static void flush_stack(struct sock **st
73054 skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
73055
73056 if (!skb1) {
73057 - atomic_inc(&sk->sk_drops);
73058 + atomic_inc_unchecked(&sk->sk_drops);
73059 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
73060 IS_UDPLITE(sk));
73061 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
73062 @@ -1671,6 +1692,9 @@ int __udp4_lib_rcv(struct sk_buff *skb,
73063 goto csum_error;
73064
73065 UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
73066 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
73067 + if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
73068 +#endif
73069 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
73070
73071 /*
73072 @@ -2098,8 +2122,13 @@ static void udp4_format_sock(struct sock
73073 sk_wmem_alloc_get(sp),
73074 sk_rmem_alloc_get(sp),
73075 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
73076 - atomic_read(&sp->sk_refcnt), sp,
73077 - atomic_read(&sp->sk_drops), len);
73078 + atomic_read(&sp->sk_refcnt),
73079 +#ifdef CONFIG_GRKERNSEC_HIDESYM
73080 + NULL,
73081 +#else
73082 + sp,
73083 +#endif
73084 + atomic_read_unchecked(&sp->sk_drops), len);
73085 }
73086
73087 int udp4_seq_show(struct seq_file *seq, void *v)
73088 diff -urNp linux-3.0.8/net/ipv6/addrconf.c linux-3.0.8/net/ipv6/addrconf.c
73089 --- linux-3.0.8/net/ipv6/addrconf.c 2011-07-21 22:17:23.000000000 -0400
73090 +++ linux-3.0.8/net/ipv6/addrconf.c 2011-10-06 04:17:55.000000000 -0400
73091 @@ -2072,7 +2072,7 @@ int addrconf_set_dstaddr(struct net *net
73092 p.iph.ihl = 5;
73093 p.iph.protocol = IPPROTO_IPV6;
73094 p.iph.ttl = 64;
73095 - ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
73096 + ifr.ifr_ifru.ifru_data = (void __force_user *)&p;
73097
73098 if (ops->ndo_do_ioctl) {
73099 mm_segment_t oldfs = get_fs();
73100 diff -urNp linux-3.0.8/net/ipv6/inet6_connection_sock.c linux-3.0.8/net/ipv6/inet6_connection_sock.c
73101 --- linux-3.0.8/net/ipv6/inet6_connection_sock.c 2011-07-21 22:17:23.000000000 -0400
73102 +++ linux-3.0.8/net/ipv6/inet6_connection_sock.c 2011-08-23 21:47:56.000000000 -0400
73103 @@ -178,7 +178,7 @@ void __inet6_csk_dst_store(struct sock *
73104 #ifdef CONFIG_XFRM
73105 {
73106 struct rt6_info *rt = (struct rt6_info *)dst;
73107 - rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
73108 + rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
73109 }
73110 #endif
73111 }
73112 @@ -193,7 +193,7 @@ struct dst_entry *__inet6_csk_dst_check(
73113 #ifdef CONFIG_XFRM
73114 if (dst) {
73115 struct rt6_info *rt = (struct rt6_info *)dst;
73116 - if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
73117 + if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
73118 __sk_dst_reset(sk);
73119 dst = NULL;
73120 }
73121 diff -urNp linux-3.0.8/net/ipv6/ipv6_sockglue.c linux-3.0.8/net/ipv6/ipv6_sockglue.c
73122 --- linux-3.0.8/net/ipv6/ipv6_sockglue.c 2011-10-24 08:05:30.000000000 -0400
73123 +++ linux-3.0.8/net/ipv6/ipv6_sockglue.c 2011-10-16 21:55:28.000000000 -0400
73124 @@ -129,6 +129,8 @@ static int do_ipv6_setsockopt(struct soc
73125 int val, valbool;
73126 int retv = -ENOPROTOOPT;
73127
73128 + pax_track_stack();
73129 +
73130 if (optval == NULL)
73131 val=0;
73132 else {
73133 @@ -919,6 +921,8 @@ static int do_ipv6_getsockopt(struct soc
73134 int len;
73135 int val;
73136
73137 + pax_track_stack();
73138 +
73139 if (ip6_mroute_opt(optname))
73140 return ip6_mroute_getsockopt(sk, optname, optval, optlen);
73141
73142 @@ -960,7 +964,7 @@ static int do_ipv6_getsockopt(struct soc
73143 if (sk->sk_type != SOCK_STREAM)
73144 return -ENOPROTOOPT;
73145
73146 - msg.msg_control = optval;
73147 + msg.msg_control = (void __force_kernel *)optval;
73148 msg.msg_controllen = len;
73149 msg.msg_flags = flags;
73150
73151 diff -urNp linux-3.0.8/net/ipv6/raw.c linux-3.0.8/net/ipv6/raw.c
73152 --- linux-3.0.8/net/ipv6/raw.c 2011-07-21 22:17:23.000000000 -0400
73153 +++ linux-3.0.8/net/ipv6/raw.c 2011-08-23 21:48:14.000000000 -0400
73154 @@ -376,7 +376,7 @@ static inline int rawv6_rcv_skb(struct s
73155 {
73156 if ((raw6_sk(sk)->checksum || rcu_dereference_raw(sk->sk_filter)) &&
73157 skb_checksum_complete(skb)) {
73158 - atomic_inc(&sk->sk_drops);
73159 + atomic_inc_unchecked(&sk->sk_drops);
73160 kfree_skb(skb);
73161 return NET_RX_DROP;
73162 }
73163 @@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk
73164 struct raw6_sock *rp = raw6_sk(sk);
73165
73166 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
73167 - atomic_inc(&sk->sk_drops);
73168 + atomic_inc_unchecked(&sk->sk_drops);
73169 kfree_skb(skb);
73170 return NET_RX_DROP;
73171 }
73172 @@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk
73173
73174 if (inet->hdrincl) {
73175 if (skb_checksum_complete(skb)) {
73176 - atomic_inc(&sk->sk_drops);
73177 + atomic_inc_unchecked(&sk->sk_drops);
73178 kfree_skb(skb);
73179 return NET_RX_DROP;
73180 }
73181 @@ -601,7 +601,7 @@ out:
73182 return err;
73183 }
73184
73185 -static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
73186 +static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
73187 struct flowi6 *fl6, struct dst_entry **dstp,
73188 unsigned int flags)
73189 {
73190 @@ -742,6 +742,8 @@ static int rawv6_sendmsg(struct kiocb *i
73191 u16 proto;
73192 int err;
73193
73194 + pax_track_stack();
73195 +
73196 /* Rough check on arithmetic overflow,
73197 better check is made in ip6_append_data().
73198 */
73199 @@ -909,12 +911,15 @@ do_confirm:
73200 static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
73201 char __user *optval, int optlen)
73202 {
73203 + struct icmp6_filter filter;
73204 +
73205 switch (optname) {
73206 case ICMPV6_FILTER:
73207 if (optlen > sizeof(struct icmp6_filter))
73208 optlen = sizeof(struct icmp6_filter);
73209 - if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
73210 + if (copy_from_user(&filter, optval, optlen))
73211 return -EFAULT;
73212 + raw6_sk(sk)->filter = filter;
73213 return 0;
73214 default:
73215 return -ENOPROTOOPT;
73216 @@ -927,6 +932,7 @@ static int rawv6_geticmpfilter(struct so
73217 char __user *optval, int __user *optlen)
73218 {
73219 int len;
73220 + struct icmp6_filter filter;
73221
73222 switch (optname) {
73223 case ICMPV6_FILTER:
73224 @@ -938,7 +944,8 @@ static int rawv6_geticmpfilter(struct so
73225 len = sizeof(struct icmp6_filter);
73226 if (put_user(len, optlen))
73227 return -EFAULT;
73228 - if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
73229 + filter = raw6_sk(sk)->filter;
73230 + if (len > sizeof filter || copy_to_user(optval, &filter, len))
73231 return -EFAULT;
73232 return 0;
73233 default:
73234 @@ -1252,7 +1259,13 @@ static void raw6_sock_seq_show(struct se
73235 0, 0L, 0,
73236 sock_i_uid(sp), 0,
73237 sock_i_ino(sp),
73238 - atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
73239 + atomic_read(&sp->sk_refcnt),
73240 +#ifdef CONFIG_GRKERNSEC_HIDESYM
73241 + NULL,
73242 +#else
73243 + sp,
73244 +#endif
73245 + atomic_read_unchecked(&sp->sk_drops));
73246 }
73247
73248 static int raw6_seq_show(struct seq_file *seq, void *v)
73249 diff -urNp linux-3.0.8/net/ipv6/tcp_ipv6.c linux-3.0.8/net/ipv6/tcp_ipv6.c
73250 --- linux-3.0.8/net/ipv6/tcp_ipv6.c 2011-10-24 08:05:21.000000000 -0400
73251 +++ linux-3.0.8/net/ipv6/tcp_ipv6.c 2011-08-23 21:48:14.000000000 -0400
73252 @@ -93,6 +93,10 @@ static struct tcp_md5sig_key *tcp_v6_md5
73253 }
73254 #endif
73255
73256 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
73257 +extern int grsec_enable_blackhole;
73258 +#endif
73259 +
73260 static void tcp_v6_hash(struct sock *sk)
73261 {
73262 if (sk->sk_state != TCP_CLOSE) {
73263 @@ -1662,6 +1666,9 @@ static int tcp_v6_do_rcv(struct sock *sk
73264 return 0;
73265
73266 reset:
73267 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
73268 + if (!grsec_enable_blackhole)
73269 +#endif
73270 tcp_v6_send_reset(sk, skb);
73271 discard:
73272 if (opt_skb)
73273 @@ -1741,12 +1748,20 @@ static int tcp_v6_rcv(struct sk_buff *sk
73274 TCP_SKB_CB(skb)->sacked = 0;
73275
73276 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
73277 - if (!sk)
73278 + if (!sk) {
73279 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
73280 + ret = 1;
73281 +#endif
73282 goto no_tcp_socket;
73283 + }
73284
73285 process:
73286 - if (sk->sk_state == TCP_TIME_WAIT)
73287 + if (sk->sk_state == TCP_TIME_WAIT) {
73288 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
73289 + ret = 2;
73290 +#endif
73291 goto do_time_wait;
73292 + }
73293
73294 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
73295 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
73296 @@ -1794,6 +1809,10 @@ no_tcp_socket:
73297 bad_packet:
73298 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
73299 } else {
73300 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
73301 + if (!grsec_enable_blackhole || (ret == 1 &&
73302 + (skb->dev->flags & IFF_LOOPBACK)))
73303 +#endif
73304 tcp_v6_send_reset(NULL, skb);
73305 }
73306
73307 @@ -2054,7 +2073,13 @@ static void get_openreq6(struct seq_file
73308 uid,
73309 0, /* non standard timer */
73310 0, /* open_requests have no inode */
73311 - 0, req);
73312 + 0,
73313 +#ifdef CONFIG_GRKERNSEC_HIDESYM
73314 + NULL
73315 +#else
73316 + req
73317 +#endif
73318 + );
73319 }
73320
73321 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
73322 @@ -2104,7 +2129,12 @@ static void get_tcp6_sock(struct seq_fil
73323 sock_i_uid(sp),
73324 icsk->icsk_probes_out,
73325 sock_i_ino(sp),
73326 - atomic_read(&sp->sk_refcnt), sp,
73327 + atomic_read(&sp->sk_refcnt),
73328 +#ifdef CONFIG_GRKERNSEC_HIDESYM
73329 + NULL,
73330 +#else
73331 + sp,
73332 +#endif
73333 jiffies_to_clock_t(icsk->icsk_rto),
73334 jiffies_to_clock_t(icsk->icsk_ack.ato),
73335 (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
73336 @@ -2139,7 +2169,13 @@ static void get_timewait6_sock(struct se
73337 dest->s6_addr32[2], dest->s6_addr32[3], destp,
73338 tw->tw_substate, 0, 0,
73339 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
73340 - atomic_read(&tw->tw_refcnt), tw);
73341 + atomic_read(&tw->tw_refcnt),
73342 +#ifdef CONFIG_GRKERNSEC_HIDESYM
73343 + NULL
73344 +#else
73345 + tw
73346 +#endif
73347 + );
73348 }
73349
73350 static int tcp6_seq_show(struct seq_file *seq, void *v)
73351 diff -urNp linux-3.0.8/net/ipv6/udp.c linux-3.0.8/net/ipv6/udp.c
73352 --- linux-3.0.8/net/ipv6/udp.c 2011-10-24 08:05:32.000000000 -0400
73353 +++ linux-3.0.8/net/ipv6/udp.c 2011-10-17 23:17:19.000000000 -0400
73354 @@ -50,6 +50,10 @@
73355 #include <linux/seq_file.h>
73356 #include "udp_impl.h"
73357
73358 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
73359 +extern int grsec_enable_blackhole;
73360 +#endif
73361 +
73362 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
73363 {
73364 const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
73365 @@ -548,7 +552,7 @@ int udpv6_queue_rcv_skb(struct sock * sk
73366
73367 return 0;
73368 drop:
73369 - atomic_inc(&sk->sk_drops);
73370 + atomic_inc_unchecked(&sk->sk_drops);
73371 drop_no_sk_drops_inc:
73372 UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
73373 kfree_skb(skb);
73374 @@ -624,7 +628,7 @@ static void flush_stack(struct sock **st
73375 continue;
73376 }
73377 drop:
73378 - atomic_inc(&sk->sk_drops);
73379 + atomic_inc_unchecked(&sk->sk_drops);
73380 UDP6_INC_STATS_BH(sock_net(sk),
73381 UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
73382 UDP6_INC_STATS_BH(sock_net(sk),
73383 @@ -779,6 +783,9 @@ int __udp6_lib_rcv(struct sk_buff *skb,
73384 UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
73385 proto == IPPROTO_UDPLITE);
73386
73387 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
73388 + if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
73389 +#endif
73390 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
73391
73392 kfree_skb(skb);
73393 @@ -795,7 +802,7 @@ int __udp6_lib_rcv(struct sk_buff *skb,
73394 if (!sock_owned_by_user(sk))
73395 udpv6_queue_rcv_skb(sk, skb);
73396 else if (sk_add_backlog(sk, skb)) {
73397 - atomic_inc(&sk->sk_drops);
73398 + atomic_inc_unchecked(&sk->sk_drops);
73399 bh_unlock_sock(sk);
73400 sock_put(sk);
73401 goto discard;
73402 @@ -1408,8 +1415,13 @@ static void udp6_sock_seq_show(struct se
73403 0, 0L, 0,
73404 sock_i_uid(sp), 0,
73405 sock_i_ino(sp),
73406 - atomic_read(&sp->sk_refcnt), sp,
73407 - atomic_read(&sp->sk_drops));
73408 + atomic_read(&sp->sk_refcnt),
73409 +#ifdef CONFIG_GRKERNSEC_HIDESYM
73410 + NULL,
73411 +#else
73412 + sp,
73413 +#endif
73414 + atomic_read_unchecked(&sp->sk_drops));
73415 }
73416
73417 int udp6_seq_show(struct seq_file *seq, void *v)
73418 diff -urNp linux-3.0.8/net/irda/ircomm/ircomm_tty.c linux-3.0.8/net/irda/ircomm/ircomm_tty.c
73419 --- linux-3.0.8/net/irda/ircomm/ircomm_tty.c 2011-07-21 22:17:23.000000000 -0400
73420 +++ linux-3.0.8/net/irda/ircomm/ircomm_tty.c 2011-08-23 21:47:56.000000000 -0400
73421 @@ -282,16 +282,16 @@ static int ircomm_tty_block_til_ready(st
73422 add_wait_queue(&self->open_wait, &wait);
73423
73424 IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
73425 - __FILE__,__LINE__, tty->driver->name, self->open_count );
73426 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
73427
73428 /* As far as I can see, we protect open_count - Jean II */
73429 spin_lock_irqsave(&self->spinlock, flags);
73430 if (!tty_hung_up_p(filp)) {
73431 extra_count = 1;
73432 - self->open_count--;
73433 + local_dec(&self->open_count);
73434 }
73435 spin_unlock_irqrestore(&self->spinlock, flags);
73436 - self->blocked_open++;
73437 + local_inc(&self->blocked_open);
73438
73439 while (1) {
73440 if (tty->termios->c_cflag & CBAUD) {
73441 @@ -331,7 +331,7 @@ static int ircomm_tty_block_til_ready(st
73442 }
73443
73444 IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
73445 - __FILE__,__LINE__, tty->driver->name, self->open_count );
73446 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
73447
73448 schedule();
73449 }
73450 @@ -342,13 +342,13 @@ static int ircomm_tty_block_til_ready(st
73451 if (extra_count) {
73452 /* ++ is not atomic, so this should be protected - Jean II */
73453 spin_lock_irqsave(&self->spinlock, flags);
73454 - self->open_count++;
73455 + local_inc(&self->open_count);
73456 spin_unlock_irqrestore(&self->spinlock, flags);
73457 }
73458 - self->blocked_open--;
73459 + local_dec(&self->blocked_open);
73460
73461 IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
73462 - __FILE__,__LINE__, tty->driver->name, self->open_count);
73463 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
73464
73465 if (!retval)
73466 self->flags |= ASYNC_NORMAL_ACTIVE;
73467 @@ -417,14 +417,14 @@ static int ircomm_tty_open(struct tty_st
73468 }
73469 /* ++ is not atomic, so this should be protected - Jean II */
73470 spin_lock_irqsave(&self->spinlock, flags);
73471 - self->open_count++;
73472 + local_inc(&self->open_count);
73473
73474 tty->driver_data = self;
73475 self->tty = tty;
73476 spin_unlock_irqrestore(&self->spinlock, flags);
73477
73478 IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
73479 - self->line, self->open_count);
73480 + self->line, local_read(&self->open_count));
73481
73482 /* Not really used by us, but lets do it anyway */
73483 self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
73484 @@ -510,7 +510,7 @@ static void ircomm_tty_close(struct tty_
73485 return;
73486 }
73487
73488 - if ((tty->count == 1) && (self->open_count != 1)) {
73489 + if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
73490 /*
73491 * Uh, oh. tty->count is 1, which means that the tty
73492 * structure will be freed. state->count should always
73493 @@ -520,16 +520,16 @@ static void ircomm_tty_close(struct tty_
73494 */
73495 IRDA_DEBUG(0, "%s(), bad serial port count; "
73496 "tty->count is 1, state->count is %d\n", __func__ ,
73497 - self->open_count);
73498 - self->open_count = 1;
73499 + local_read(&self->open_count));
73500 + local_set(&self->open_count, 1);
73501 }
73502
73503 - if (--self->open_count < 0) {
73504 + if (local_dec_return(&self->open_count) < 0) {
73505 IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
73506 - __func__, self->line, self->open_count);
73507 - self->open_count = 0;
73508 + __func__, self->line, local_read(&self->open_count));
73509 + local_set(&self->open_count, 0);
73510 }
73511 - if (self->open_count) {
73512 + if (local_read(&self->open_count)) {
73513 spin_unlock_irqrestore(&self->spinlock, flags);
73514
73515 IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
73516 @@ -561,7 +561,7 @@ static void ircomm_tty_close(struct tty_
73517 tty->closing = 0;
73518 self->tty = NULL;
73519
73520 - if (self->blocked_open) {
73521 + if (local_read(&self->blocked_open)) {
73522 if (self->close_delay)
73523 schedule_timeout_interruptible(self->close_delay);
73524 wake_up_interruptible(&self->open_wait);
73525 @@ -1013,7 +1013,7 @@ static void ircomm_tty_hangup(struct tty
73526 spin_lock_irqsave(&self->spinlock, flags);
73527 self->flags &= ~ASYNC_NORMAL_ACTIVE;
73528 self->tty = NULL;
73529 - self->open_count = 0;
73530 + local_set(&self->open_count, 0);
73531 spin_unlock_irqrestore(&self->spinlock, flags);
73532
73533 wake_up_interruptible(&self->open_wait);
73534 @@ -1360,7 +1360,7 @@ static void ircomm_tty_line_info(struct
73535 seq_putc(m, '\n');
73536
73537 seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
73538 - seq_printf(m, "Open count: %d\n", self->open_count);
73539 + seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
73540 seq_printf(m, "Max data size: %d\n", self->max_data_size);
73541 seq_printf(m, "Max header size: %d\n", self->max_header_size);
73542
73543 diff -urNp linux-3.0.8/net/iucv/af_iucv.c linux-3.0.8/net/iucv/af_iucv.c
73544 --- linux-3.0.8/net/iucv/af_iucv.c 2011-07-21 22:17:23.000000000 -0400
73545 +++ linux-3.0.8/net/iucv/af_iucv.c 2011-08-23 21:47:56.000000000 -0400
73546 @@ -648,10 +648,10 @@ static int iucv_sock_autobind(struct soc
73547
73548 write_lock_bh(&iucv_sk_list.lock);
73549
73550 - sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
73551 + sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
73552 while (__iucv_get_sock_by_name(name)) {
73553 sprintf(name, "%08x",
73554 - atomic_inc_return(&iucv_sk_list.autobind_name));
73555 + atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
73556 }
73557
73558 write_unlock_bh(&iucv_sk_list.lock);
73559 diff -urNp linux-3.0.8/net/key/af_key.c linux-3.0.8/net/key/af_key.c
73560 --- linux-3.0.8/net/key/af_key.c 2011-07-21 22:17:23.000000000 -0400
73561 +++ linux-3.0.8/net/key/af_key.c 2011-08-23 21:48:14.000000000 -0400
73562 @@ -2481,6 +2481,8 @@ static int pfkey_migrate(struct sock *sk
73563 struct xfrm_migrate m[XFRM_MAX_DEPTH];
73564 struct xfrm_kmaddress k;
73565
73566 + pax_track_stack();
73567 +
73568 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
73569 ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
73570 !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
73571 @@ -3016,10 +3018,10 @@ static int pfkey_send_policy_notify(stru
73572 static u32 get_acqseq(void)
73573 {
73574 u32 res;
73575 - static atomic_t acqseq;
73576 + static atomic_unchecked_t acqseq;
73577
73578 do {
73579 - res = atomic_inc_return(&acqseq);
73580 + res = atomic_inc_return_unchecked(&acqseq);
73581 } while (!res);
73582 return res;
73583 }
73584 diff -urNp linux-3.0.8/net/lapb/lapb_iface.c linux-3.0.8/net/lapb/lapb_iface.c
73585 --- linux-3.0.8/net/lapb/lapb_iface.c 2011-07-21 22:17:23.000000000 -0400
73586 +++ linux-3.0.8/net/lapb/lapb_iface.c 2011-08-23 21:47:56.000000000 -0400
73587 @@ -158,7 +158,7 @@ int lapb_register(struct net_device *dev
73588 goto out;
73589
73590 lapb->dev = dev;
73591 - lapb->callbacks = *callbacks;
73592 + lapb->callbacks = callbacks;
73593
73594 __lapb_insert_cb(lapb);
73595
73596 @@ -380,32 +380,32 @@ int lapb_data_received(struct net_device
73597
73598 void lapb_connect_confirmation(struct lapb_cb *lapb, int reason)
73599 {
73600 - if (lapb->callbacks.connect_confirmation)
73601 - lapb->callbacks.connect_confirmation(lapb->dev, reason);
73602 + if (lapb->callbacks->connect_confirmation)
73603 + lapb->callbacks->connect_confirmation(lapb->dev, reason);
73604 }
73605
73606 void lapb_connect_indication(struct lapb_cb *lapb, int reason)
73607 {
73608 - if (lapb->callbacks.connect_indication)
73609 - lapb->callbacks.connect_indication(lapb->dev, reason);
73610 + if (lapb->callbacks->connect_indication)
73611 + lapb->callbacks->connect_indication(lapb->dev, reason);
73612 }
73613
73614 void lapb_disconnect_confirmation(struct lapb_cb *lapb, int reason)
73615 {
73616 - if (lapb->callbacks.disconnect_confirmation)
73617 - lapb->callbacks.disconnect_confirmation(lapb->dev, reason);
73618 + if (lapb->callbacks->disconnect_confirmation)
73619 + lapb->callbacks->disconnect_confirmation(lapb->dev, reason);
73620 }
73621
73622 void lapb_disconnect_indication(struct lapb_cb *lapb, int reason)
73623 {
73624 - if (lapb->callbacks.disconnect_indication)
73625 - lapb->callbacks.disconnect_indication(lapb->dev, reason);
73626 + if (lapb->callbacks->disconnect_indication)
73627 + lapb->callbacks->disconnect_indication(lapb->dev, reason);
73628 }
73629
73630 int lapb_data_indication(struct lapb_cb *lapb, struct sk_buff *skb)
73631 {
73632 - if (lapb->callbacks.data_indication)
73633 - return lapb->callbacks.data_indication(lapb->dev, skb);
73634 + if (lapb->callbacks->data_indication)
73635 + return lapb->callbacks->data_indication(lapb->dev, skb);
73636
73637 kfree_skb(skb);
73638 return NET_RX_SUCCESS; /* For now; must be != NET_RX_DROP */
73639 @@ -415,8 +415,8 @@ int lapb_data_transmit(struct lapb_cb *l
73640 {
73641 int used = 0;
73642
73643 - if (lapb->callbacks.data_transmit) {
73644 - lapb->callbacks.data_transmit(lapb->dev, skb);
73645 + if (lapb->callbacks->data_transmit) {
73646 + lapb->callbacks->data_transmit(lapb->dev, skb);
73647 used = 1;
73648 }
73649
73650 diff -urNp linux-3.0.8/net/mac80211/debugfs_sta.c linux-3.0.8/net/mac80211/debugfs_sta.c
73651 --- linux-3.0.8/net/mac80211/debugfs_sta.c 2011-07-21 22:17:23.000000000 -0400
73652 +++ linux-3.0.8/net/mac80211/debugfs_sta.c 2011-08-23 21:48:14.000000000 -0400
73653 @@ -140,6 +140,8 @@ static ssize_t sta_agg_status_read(struc
73654 struct tid_ampdu_rx *tid_rx;
73655 struct tid_ampdu_tx *tid_tx;
73656
73657 + pax_track_stack();
73658 +
73659 rcu_read_lock();
73660
73661 p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n",
73662 @@ -240,6 +242,8 @@ static ssize_t sta_ht_capa_read(struct f
73663 struct sta_info *sta = file->private_data;
73664 struct ieee80211_sta_ht_cap *htc = &sta->sta.ht_cap;
73665
73666 + pax_track_stack();
73667 +
73668 p += scnprintf(p, sizeof(buf) + buf - p, "ht %ssupported\n",
73669 htc->ht_supported ? "" : "not ");
73670 if (htc->ht_supported) {
73671 diff -urNp linux-3.0.8/net/mac80211/ieee80211_i.h linux-3.0.8/net/mac80211/ieee80211_i.h
73672 --- linux-3.0.8/net/mac80211/ieee80211_i.h 2011-07-21 22:17:23.000000000 -0400
73673 +++ linux-3.0.8/net/mac80211/ieee80211_i.h 2011-08-23 21:47:56.000000000 -0400
73674 @@ -27,6 +27,7 @@
73675 #include <net/ieee80211_radiotap.h>
73676 #include <net/cfg80211.h>
73677 #include <net/mac80211.h>
73678 +#include <asm/local.h>
73679 #include "key.h"
73680 #include "sta_info.h"
73681
73682 @@ -721,7 +722,7 @@ struct ieee80211_local {
73683 /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
73684 spinlock_t queue_stop_reason_lock;
73685
73686 - int open_count;
73687 + local_t open_count;
73688 int monitors, cooked_mntrs;
73689 /* number of interfaces with corresponding FIF_ flags */
73690 int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
73691 diff -urNp linux-3.0.8/net/mac80211/iface.c linux-3.0.8/net/mac80211/iface.c
73692 --- linux-3.0.8/net/mac80211/iface.c 2011-10-24 08:05:21.000000000 -0400
73693 +++ linux-3.0.8/net/mac80211/iface.c 2011-08-23 21:47:56.000000000 -0400
73694 @@ -211,7 +211,7 @@ static int ieee80211_do_open(struct net_
73695 break;
73696 }
73697
73698 - if (local->open_count == 0) {
73699 + if (local_read(&local->open_count) == 0) {
73700 res = drv_start(local);
73701 if (res)
73702 goto err_del_bss;
73703 @@ -235,7 +235,7 @@ static int ieee80211_do_open(struct net_
73704 memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
73705
73706 if (!is_valid_ether_addr(dev->dev_addr)) {
73707 - if (!local->open_count)
73708 + if (!local_read(&local->open_count))
73709 drv_stop(local);
73710 return -EADDRNOTAVAIL;
73711 }
73712 @@ -327,7 +327,7 @@ static int ieee80211_do_open(struct net_
73713 mutex_unlock(&local->mtx);
73714
73715 if (coming_up)
73716 - local->open_count++;
73717 + local_inc(&local->open_count);
73718
73719 if (hw_reconf_flags) {
73720 ieee80211_hw_config(local, hw_reconf_flags);
73721 @@ -347,7 +347,7 @@ static int ieee80211_do_open(struct net_
73722 err_del_interface:
73723 drv_remove_interface(local, &sdata->vif);
73724 err_stop:
73725 - if (!local->open_count)
73726 + if (!local_read(&local->open_count))
73727 drv_stop(local);
73728 err_del_bss:
73729 sdata->bss = NULL;
73730 @@ -475,7 +475,7 @@ static void ieee80211_do_stop(struct iee
73731 }
73732
73733 if (going_down)
73734 - local->open_count--;
73735 + local_dec(&local->open_count);
73736
73737 switch (sdata->vif.type) {
73738 case NL80211_IFTYPE_AP_VLAN:
73739 @@ -534,7 +534,7 @@ static void ieee80211_do_stop(struct iee
73740
73741 ieee80211_recalc_ps(local, -1);
73742
73743 - if (local->open_count == 0) {
73744 + if (local_read(&local->open_count) == 0) {
73745 if (local->ops->napi_poll)
73746 napi_disable(&local->napi);
73747 ieee80211_clear_tx_pending(local);
73748 diff -urNp linux-3.0.8/net/mac80211/main.c linux-3.0.8/net/mac80211/main.c
73749 --- linux-3.0.8/net/mac80211/main.c 2011-07-21 22:17:23.000000000 -0400
73750 +++ linux-3.0.8/net/mac80211/main.c 2011-08-23 21:47:56.000000000 -0400
73751 @@ -209,7 +209,7 @@ int ieee80211_hw_config(struct ieee80211
73752 local->hw.conf.power_level = power;
73753 }
73754
73755 - if (changed && local->open_count) {
73756 + if (changed && local_read(&local->open_count)) {
73757 ret = drv_config(local, changed);
73758 /*
73759 * Goal:
73760 diff -urNp linux-3.0.8/net/mac80211/mlme.c linux-3.0.8/net/mac80211/mlme.c
73761 --- linux-3.0.8/net/mac80211/mlme.c 2011-10-24 08:05:21.000000000 -0400
73762 +++ linux-3.0.8/net/mac80211/mlme.c 2011-08-23 21:48:14.000000000 -0400
73763 @@ -1444,6 +1444,8 @@ static bool ieee80211_assoc_success(stru
73764 bool have_higher_than_11mbit = false;
73765 u16 ap_ht_cap_flags;
73766
73767 + pax_track_stack();
73768 +
73769 /* AssocResp and ReassocResp have identical structure */
73770
73771 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
73772 diff -urNp linux-3.0.8/net/mac80211/pm.c linux-3.0.8/net/mac80211/pm.c
73773 --- linux-3.0.8/net/mac80211/pm.c 2011-07-21 22:17:23.000000000 -0400
73774 +++ linux-3.0.8/net/mac80211/pm.c 2011-08-23 21:47:56.000000000 -0400
73775 @@ -47,7 +47,7 @@ int __ieee80211_suspend(struct ieee80211
73776 cancel_work_sync(&local->dynamic_ps_enable_work);
73777 del_timer_sync(&local->dynamic_ps_timer);
73778
73779 - local->wowlan = wowlan && local->open_count;
73780 + local->wowlan = wowlan && local_read(&local->open_count);
73781 if (local->wowlan) {
73782 int err = drv_suspend(local, wowlan);
73783 if (err) {
73784 @@ -111,7 +111,7 @@ int __ieee80211_suspend(struct ieee80211
73785 }
73786
73787 /* stop hardware - this must stop RX */
73788 - if (local->open_count)
73789 + if (local_read(&local->open_count))
73790 ieee80211_stop_device(local);
73791
73792 suspend:
73793 diff -urNp linux-3.0.8/net/mac80211/rate.c linux-3.0.8/net/mac80211/rate.c
73794 --- linux-3.0.8/net/mac80211/rate.c 2011-07-21 22:17:23.000000000 -0400
73795 +++ linux-3.0.8/net/mac80211/rate.c 2011-08-23 21:47:56.000000000 -0400
73796 @@ -371,7 +371,7 @@ int ieee80211_init_rate_ctrl_alg(struct
73797
73798 ASSERT_RTNL();
73799
73800 - if (local->open_count)
73801 + if (local_read(&local->open_count))
73802 return -EBUSY;
73803
73804 if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
73805 diff -urNp linux-3.0.8/net/mac80211/rc80211_pid_debugfs.c linux-3.0.8/net/mac80211/rc80211_pid_debugfs.c
73806 --- linux-3.0.8/net/mac80211/rc80211_pid_debugfs.c 2011-07-21 22:17:23.000000000 -0400
73807 +++ linux-3.0.8/net/mac80211/rc80211_pid_debugfs.c 2011-08-23 21:47:56.000000000 -0400
73808 @@ -192,7 +192,7 @@ static ssize_t rate_control_pid_events_r
73809
73810 spin_unlock_irqrestore(&events->lock, status);
73811
73812 - if (copy_to_user(buf, pb, p))
73813 + if (p > sizeof(pb) || copy_to_user(buf, pb, p))
73814 return -EFAULT;
73815
73816 return p;
73817 diff -urNp linux-3.0.8/net/mac80211/util.c linux-3.0.8/net/mac80211/util.c
73818 --- linux-3.0.8/net/mac80211/util.c 2011-07-21 22:17:23.000000000 -0400
73819 +++ linux-3.0.8/net/mac80211/util.c 2011-08-23 21:47:56.000000000 -0400
73820 @@ -1147,7 +1147,7 @@ int ieee80211_reconfig(struct ieee80211_
73821 #endif
73822
73823 /* restart hardware */
73824 - if (local->open_count) {
73825 + if (local_read(&local->open_count)) {
73826 /*
73827 * Upon resume hardware can sometimes be goofy due to
73828 * various platform / driver / bus issues, so restarting
73829 diff -urNp linux-3.0.8/net/netfilter/ipvs/ip_vs_conn.c linux-3.0.8/net/netfilter/ipvs/ip_vs_conn.c
73830 --- linux-3.0.8/net/netfilter/ipvs/ip_vs_conn.c 2011-07-21 22:17:23.000000000 -0400
73831 +++ linux-3.0.8/net/netfilter/ipvs/ip_vs_conn.c 2011-08-23 21:47:56.000000000 -0400
73832 @@ -556,7 +556,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s
73833 /* Increase the refcnt counter of the dest */
73834 atomic_inc(&dest->refcnt);
73835
73836 - conn_flags = atomic_read(&dest->conn_flags);
73837 + conn_flags = atomic_read_unchecked(&dest->conn_flags);
73838 if (cp->protocol != IPPROTO_UDP)
73839 conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
73840 /* Bind with the destination and its corresponding transmitter */
73841 @@ -869,7 +869,7 @@ ip_vs_conn_new(const struct ip_vs_conn_p
73842 atomic_set(&cp->refcnt, 1);
73843
73844 atomic_set(&cp->n_control, 0);
73845 - atomic_set(&cp->in_pkts, 0);
73846 + atomic_set_unchecked(&cp->in_pkts, 0);
73847
73848 atomic_inc(&ipvs->conn_count);
73849 if (flags & IP_VS_CONN_F_NO_CPORT)
73850 @@ -1149,7 +1149,7 @@ static inline int todrop_entry(struct ip
73851
73852 /* Don't drop the entry if its number of incoming packets is not
73853 located in [0, 8] */
73854 - i = atomic_read(&cp->in_pkts);
73855 + i = atomic_read_unchecked(&cp->in_pkts);
73856 if (i > 8 || i < 0) return 0;
73857
73858 if (!todrop_rate[i]) return 0;
73859 diff -urNp linux-3.0.8/net/netfilter/ipvs/ip_vs_core.c linux-3.0.8/net/netfilter/ipvs/ip_vs_core.c
73860 --- linux-3.0.8/net/netfilter/ipvs/ip_vs_core.c 2011-07-21 22:17:23.000000000 -0400
73861 +++ linux-3.0.8/net/netfilter/ipvs/ip_vs_core.c 2011-08-23 21:47:56.000000000 -0400
73862 @@ -563,7 +563,7 @@ int ip_vs_leave(struct ip_vs_service *sv
73863 ret = cp->packet_xmit(skb, cp, pd->pp);
73864 /* do not touch skb anymore */
73865
73866 - atomic_inc(&cp->in_pkts);
73867 + atomic_inc_unchecked(&cp->in_pkts);
73868 ip_vs_conn_put(cp);
73869 return ret;
73870 }
73871 @@ -1613,7 +1613,7 @@ ip_vs_in(unsigned int hooknum, struct sk
73872 if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
73873 pkts = sysctl_sync_threshold(ipvs);
73874 else
73875 - pkts = atomic_add_return(1, &cp->in_pkts);
73876 + pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
73877
73878 if ((ipvs->sync_state & IP_VS_STATE_MASTER) &&
73879 cp->protocol == IPPROTO_SCTP) {
73880 diff -urNp linux-3.0.8/net/netfilter/ipvs/ip_vs_ctl.c linux-3.0.8/net/netfilter/ipvs/ip_vs_ctl.c
73881 --- linux-3.0.8/net/netfilter/ipvs/ip_vs_ctl.c 2011-10-24 08:05:21.000000000 -0400
73882 +++ linux-3.0.8/net/netfilter/ipvs/ip_vs_ctl.c 2011-08-23 21:48:14.000000000 -0400
73883 @@ -782,7 +782,7 @@ __ip_vs_update_dest(struct ip_vs_service
73884 ip_vs_rs_hash(ipvs, dest);
73885 write_unlock_bh(&ipvs->rs_lock);
73886 }
73887 - atomic_set(&dest->conn_flags, conn_flags);
73888 + atomic_set_unchecked(&dest->conn_flags, conn_flags);
73889
73890 /* bind the service */
73891 if (!dest->svc) {
73892 @@ -2027,7 +2027,7 @@ static int ip_vs_info_seq_show(struct se
73893 " %-7s %-6d %-10d %-10d\n",
73894 &dest->addr.in6,
73895 ntohs(dest->port),
73896 - ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
73897 + ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
73898 atomic_read(&dest->weight),
73899 atomic_read(&dest->activeconns),
73900 atomic_read(&dest->inactconns));
73901 @@ -2038,7 +2038,7 @@ static int ip_vs_info_seq_show(struct se
73902 "%-7s %-6d %-10d %-10d\n",
73903 ntohl(dest->addr.ip),
73904 ntohs(dest->port),
73905 - ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
73906 + ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
73907 atomic_read(&dest->weight),
73908 atomic_read(&dest->activeconns),
73909 atomic_read(&dest->inactconns));
73910 @@ -2284,6 +2284,8 @@ do_ip_vs_set_ctl(struct sock *sk, int cm
73911 struct ip_vs_dest_user *udest_compat;
73912 struct ip_vs_dest_user_kern udest;
73913
73914 + pax_track_stack();
73915 +
73916 if (!capable(CAP_NET_ADMIN))
73917 return -EPERM;
73918
73919 @@ -2498,7 +2500,7 @@ __ip_vs_get_dest_entries(struct net *net
73920
73921 entry.addr = dest->addr.ip;
73922 entry.port = dest->port;
73923 - entry.conn_flags = atomic_read(&dest->conn_flags);
73924 + entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
73925 entry.weight = atomic_read(&dest->weight);
73926 entry.u_threshold = dest->u_threshold;
73927 entry.l_threshold = dest->l_threshold;
73928 @@ -3026,7 +3028,7 @@ static int ip_vs_genl_fill_dest(struct s
73929 NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
73930
73931 NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
73932 - atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
73933 + atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
73934 NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
73935 NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
73936 NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
73937 diff -urNp linux-3.0.8/net/netfilter/ipvs/ip_vs_sync.c linux-3.0.8/net/netfilter/ipvs/ip_vs_sync.c
73938 --- linux-3.0.8/net/netfilter/ipvs/ip_vs_sync.c 2011-07-21 22:17:23.000000000 -0400
73939 +++ linux-3.0.8/net/netfilter/ipvs/ip_vs_sync.c 2011-08-23 21:47:56.000000000 -0400
73940 @@ -648,7 +648,7 @@ control:
73941 * i.e only increment in_pkts for Templates.
73942 */
73943 if (cp->flags & IP_VS_CONN_F_TEMPLATE) {
73944 - int pkts = atomic_add_return(1, &cp->in_pkts);
73945 + int pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
73946
73947 if (pkts % sysctl_sync_period(ipvs) != 1)
73948 return;
73949 @@ -794,7 +794,7 @@ static void ip_vs_proc_conn(struct net *
73950
73951 if (opt)
73952 memcpy(&cp->in_seq, opt, sizeof(*opt));
73953 - atomic_set(&cp->in_pkts, sysctl_sync_threshold(ipvs));
73954 + atomic_set_unchecked(&cp->in_pkts, sysctl_sync_threshold(ipvs));
73955 cp->state = state;
73956 cp->old_state = cp->state;
73957 /*
73958 diff -urNp linux-3.0.8/net/netfilter/ipvs/ip_vs_xmit.c linux-3.0.8/net/netfilter/ipvs/ip_vs_xmit.c
73959 --- linux-3.0.8/net/netfilter/ipvs/ip_vs_xmit.c 2011-07-21 22:17:23.000000000 -0400
73960 +++ linux-3.0.8/net/netfilter/ipvs/ip_vs_xmit.c 2011-08-23 21:47:56.000000000 -0400
73961 @@ -1151,7 +1151,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, str
73962 else
73963 rc = NF_ACCEPT;
73964 /* do not touch skb anymore */
73965 - atomic_inc(&cp->in_pkts);
73966 + atomic_inc_unchecked(&cp->in_pkts);
73967 goto out;
73968 }
73969
73970 @@ -1272,7 +1272,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb,
73971 else
73972 rc = NF_ACCEPT;
73973 /* do not touch skb anymore */
73974 - atomic_inc(&cp->in_pkts);
73975 + atomic_inc_unchecked(&cp->in_pkts);
73976 goto out;
73977 }
73978
73979 diff -urNp linux-3.0.8/net/netfilter/Kconfig linux-3.0.8/net/netfilter/Kconfig
73980 --- linux-3.0.8/net/netfilter/Kconfig 2011-07-21 22:17:23.000000000 -0400
73981 +++ linux-3.0.8/net/netfilter/Kconfig 2011-08-23 21:48:14.000000000 -0400
73982 @@ -781,6 +781,16 @@ config NETFILTER_XT_MATCH_ESP
73983
73984 To compile it as a module, choose M here. If unsure, say N.
73985
73986 +config NETFILTER_XT_MATCH_GRADM
73987 + tristate '"gradm" match support'
73988 + depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
73989 + depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
73990 + ---help---
73991 + The gradm match allows to match on grsecurity RBAC being enabled.
73992 + It is useful when iptables rules are applied early on bootup to
73993 + prevent connections to the machine (except from a trusted host)
73994 + while the RBAC system is disabled.
73995 +
73996 config NETFILTER_XT_MATCH_HASHLIMIT
73997 tristate '"hashlimit" match support'
73998 depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
73999 diff -urNp linux-3.0.8/net/netfilter/Makefile linux-3.0.8/net/netfilter/Makefile
74000 --- linux-3.0.8/net/netfilter/Makefile 2011-07-21 22:17:23.000000000 -0400
74001 +++ linux-3.0.8/net/netfilter/Makefile 2011-08-23 21:48:14.000000000 -0400
74002 @@ -81,6 +81,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) +=
74003 obj-$(CONFIG_NETFILTER_XT_MATCH_DEVGROUP) += xt_devgroup.o
74004 obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
74005 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
74006 +obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
74007 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
74008 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
74009 obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
74010 diff -urNp linux-3.0.8/net/netfilter/nfnetlink_log.c linux-3.0.8/net/netfilter/nfnetlink_log.c
74011 --- linux-3.0.8/net/netfilter/nfnetlink_log.c 2011-07-21 22:17:23.000000000 -0400
74012 +++ linux-3.0.8/net/netfilter/nfnetlink_log.c 2011-08-23 21:47:56.000000000 -0400
74013 @@ -70,7 +70,7 @@ struct nfulnl_instance {
74014 };
74015
74016 static DEFINE_SPINLOCK(instances_lock);
74017 -static atomic_t global_seq;
74018 +static atomic_unchecked_t global_seq;
74019
74020 #define INSTANCE_BUCKETS 16
74021 static struct hlist_head instance_table[INSTANCE_BUCKETS];
74022 @@ -505,7 +505,7 @@ __build_packet_message(struct nfulnl_ins
74023 /* global sequence number */
74024 if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
74025 NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
74026 - htonl(atomic_inc_return(&global_seq)));
74027 + htonl(atomic_inc_return_unchecked(&global_seq)));
74028
74029 if (data_len) {
74030 struct nlattr *nla;
74031 diff -urNp linux-3.0.8/net/netfilter/nfnetlink_queue.c linux-3.0.8/net/netfilter/nfnetlink_queue.c
74032 --- linux-3.0.8/net/netfilter/nfnetlink_queue.c 2011-07-21 22:17:23.000000000 -0400
74033 +++ linux-3.0.8/net/netfilter/nfnetlink_queue.c 2011-08-23 21:47:56.000000000 -0400
74034 @@ -58,7 +58,7 @@ struct nfqnl_instance {
74035 */
74036 spinlock_t lock;
74037 unsigned int queue_total;
74038 - atomic_t id_sequence; /* 'sequence' of pkt ids */
74039 + atomic_unchecked_t id_sequence; /* 'sequence' of pkt ids */
74040 struct list_head queue_list; /* packets in queue */
74041 };
74042
74043 @@ -272,7 +272,7 @@ nfqnl_build_packet_message(struct nfqnl_
74044 nfmsg->version = NFNETLINK_V0;
74045 nfmsg->res_id = htons(queue->queue_num);
74046
74047 - entry->id = atomic_inc_return(&queue->id_sequence);
74048 + entry->id = atomic_inc_return_unchecked(&queue->id_sequence);
74049 pmsg.packet_id = htonl(entry->id);
74050 pmsg.hw_protocol = entskb->protocol;
74051 pmsg.hook = entry->hook;
74052 @@ -870,7 +870,7 @@ static int seq_show(struct seq_file *s,
74053 inst->peer_pid, inst->queue_total,
74054 inst->copy_mode, inst->copy_range,
74055 inst->queue_dropped, inst->queue_user_dropped,
74056 - atomic_read(&inst->id_sequence), 1);
74057 + atomic_read_unchecked(&inst->id_sequence), 1);
74058 }
74059
74060 static const struct seq_operations nfqnl_seq_ops = {
74061 diff -urNp linux-3.0.8/net/netfilter/xt_gradm.c linux-3.0.8/net/netfilter/xt_gradm.c
74062 --- linux-3.0.8/net/netfilter/xt_gradm.c 1969-12-31 19:00:00.000000000 -0500
74063 +++ linux-3.0.8/net/netfilter/xt_gradm.c 2011-08-23 21:48:14.000000000 -0400
74064 @@ -0,0 +1,51 @@
74065 +/*
74066 + * gradm match for netfilter
74067 + * Copyright © Zbigniew Krzystolik, 2010
74068 + *
74069 + * This program is free software; you can redistribute it and/or modify
74070 + * it under the terms of the GNU General Public License; either version
74071 + * 2 or 3 as published by the Free Software Foundation.
74072 + */
74073 +#include <linux/module.h>
74074 +#include <linux/moduleparam.h>
74075 +#include <linux/skbuff.h>
74076 +#include <linux/netfilter/x_tables.h>
74077 +#include <linux/grsecurity.h>
74078 +#include <linux/netfilter/xt_gradm.h>
74079 +
74080 +static bool
74081 +gradm_mt(const struct sk_buff *skb, struct xt_action_param *par)
74082 +{
74083 + const struct xt_gradm_mtinfo *info = par->matchinfo;
74084 + bool retval = false;
74085 + if (gr_acl_is_enabled())
74086 + retval = true;
74087 + return retval ^ info->invflags;
74088 +}
74089 +
74090 +static struct xt_match gradm_mt_reg __read_mostly = {
74091 + .name = "gradm",
74092 + .revision = 0,
74093 + .family = NFPROTO_UNSPEC,
74094 + .match = gradm_mt,
74095 + .matchsize = XT_ALIGN(sizeof(struct xt_gradm_mtinfo)),
74096 + .me = THIS_MODULE,
74097 +};
74098 +
74099 +static int __init gradm_mt_init(void)
74100 +{
74101 + return xt_register_match(&gradm_mt_reg);
74102 +}
74103 +
74104 +static void __exit gradm_mt_exit(void)
74105 +{
74106 + xt_unregister_match(&gradm_mt_reg);
74107 +}
74108 +
74109 +module_init(gradm_mt_init);
74110 +module_exit(gradm_mt_exit);
74111 +MODULE_AUTHOR("Zbigniew Krzystolik <zbyniu@destrukcja.pl>");
74112 +MODULE_DESCRIPTION("Xtables: Grsecurity RBAC match");
74113 +MODULE_LICENSE("GPL");
74114 +MODULE_ALIAS("ipt_gradm");
74115 +MODULE_ALIAS("ip6t_gradm");
74116 diff -urNp linux-3.0.8/net/netfilter/xt_statistic.c linux-3.0.8/net/netfilter/xt_statistic.c
74117 --- linux-3.0.8/net/netfilter/xt_statistic.c 2011-07-21 22:17:23.000000000 -0400
74118 +++ linux-3.0.8/net/netfilter/xt_statistic.c 2011-08-23 21:47:56.000000000 -0400
74119 @@ -18,7 +18,7 @@
74120 #include <linux/netfilter/x_tables.h>
74121
74122 struct xt_statistic_priv {
74123 - atomic_t count;
74124 + atomic_unchecked_t count;
74125 } ____cacheline_aligned_in_smp;
74126
74127 MODULE_LICENSE("GPL");
74128 @@ -41,9 +41,9 @@ statistic_mt(const struct sk_buff *skb,
74129 break;
74130 case XT_STATISTIC_MODE_NTH:
74131 do {
74132 - oval = atomic_read(&info->master->count);
74133 + oval = atomic_read_unchecked(&info->master->count);
74134 nval = (oval == info->u.nth.every) ? 0 : oval + 1;
74135 - } while (atomic_cmpxchg(&info->master->count, oval, nval) != oval);
74136 + } while (atomic_cmpxchg_unchecked(&info->master->count, oval, nval) != oval);
74137 if (nval == 0)
74138 ret = !ret;
74139 break;
74140 @@ -63,7 +63,7 @@ static int statistic_mt_check(const stru
74141 info->master = kzalloc(sizeof(*info->master), GFP_KERNEL);
74142 if (info->master == NULL)
74143 return -ENOMEM;
74144 - atomic_set(&info->master->count, info->u.nth.count);
74145 + atomic_set_unchecked(&info->master->count, info->u.nth.count);
74146
74147 return 0;
74148 }
74149 diff -urNp linux-3.0.8/net/netlink/af_netlink.c linux-3.0.8/net/netlink/af_netlink.c
74150 --- linux-3.0.8/net/netlink/af_netlink.c 2011-07-21 22:17:23.000000000 -0400
74151 +++ linux-3.0.8/net/netlink/af_netlink.c 2011-08-23 21:47:56.000000000 -0400
74152 @@ -742,7 +742,7 @@ static void netlink_overrun(struct sock
74153 sk->sk_error_report(sk);
74154 }
74155 }
74156 - atomic_inc(&sk->sk_drops);
74157 + atomic_inc_unchecked(&sk->sk_drops);
74158 }
74159
74160 static struct sock *netlink_getsockbypid(struct sock *ssk, u32 pid)
74161 @@ -1994,7 +1994,7 @@ static int netlink_seq_show(struct seq_f
74162 sk_wmem_alloc_get(s),
74163 nlk->cb,
74164 atomic_read(&s->sk_refcnt),
74165 - atomic_read(&s->sk_drops),
74166 + atomic_read_unchecked(&s->sk_drops),
74167 sock_i_ino(s)
74168 );
74169
74170 diff -urNp linux-3.0.8/net/netrom/af_netrom.c linux-3.0.8/net/netrom/af_netrom.c
74171 --- linux-3.0.8/net/netrom/af_netrom.c 2011-07-21 22:17:23.000000000 -0400
74172 +++ linux-3.0.8/net/netrom/af_netrom.c 2011-08-23 21:48:14.000000000 -0400
74173 @@ -839,6 +839,7 @@ static int nr_getname(struct socket *soc
74174 struct sock *sk = sock->sk;
74175 struct nr_sock *nr = nr_sk(sk);
74176
74177 + memset(sax, 0, sizeof(*sax));
74178 lock_sock(sk);
74179 if (peer != 0) {
74180 if (sk->sk_state != TCP_ESTABLISHED) {
74181 @@ -853,7 +854,6 @@ static int nr_getname(struct socket *soc
74182 *uaddr_len = sizeof(struct full_sockaddr_ax25);
74183 } else {
74184 sax->fsa_ax25.sax25_family = AF_NETROM;
74185 - sax->fsa_ax25.sax25_ndigis = 0;
74186 sax->fsa_ax25.sax25_call = nr->source_addr;
74187 *uaddr_len = sizeof(struct sockaddr_ax25);
74188 }
74189 diff -urNp linux-3.0.8/net/packet/af_packet.c linux-3.0.8/net/packet/af_packet.c
74190 --- linux-3.0.8/net/packet/af_packet.c 2011-07-21 22:17:23.000000000 -0400
74191 +++ linux-3.0.8/net/packet/af_packet.c 2011-08-23 21:47:56.000000000 -0400
74192 @@ -647,14 +647,14 @@ static int packet_rcv(struct sk_buff *sk
74193
74194 spin_lock(&sk->sk_receive_queue.lock);
74195 po->stats.tp_packets++;
74196 - skb->dropcount = atomic_read(&sk->sk_drops);
74197 + skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
74198 __skb_queue_tail(&sk->sk_receive_queue, skb);
74199 spin_unlock(&sk->sk_receive_queue.lock);
74200 sk->sk_data_ready(sk, skb->len);
74201 return 0;
74202
74203 drop_n_acct:
74204 - po->stats.tp_drops = atomic_inc_return(&sk->sk_drops);
74205 + po->stats.tp_drops = atomic_inc_return_unchecked(&sk->sk_drops);
74206
74207 drop_n_restore:
74208 if (skb_head != skb->data && skb_shared(skb)) {
74209 @@ -2168,7 +2168,7 @@ static int packet_getsockopt(struct sock
74210 case PACKET_HDRLEN:
74211 if (len > sizeof(int))
74212 len = sizeof(int);
74213 - if (copy_from_user(&val, optval, len))
74214 + if (len > sizeof(val) || copy_from_user(&val, optval, len))
74215 return -EFAULT;
74216 switch (val) {
74217 case TPACKET_V1:
74218 @@ -2206,7 +2206,7 @@ static int packet_getsockopt(struct sock
74219
74220 if (put_user(len, optlen))
74221 return -EFAULT;
74222 - if (copy_to_user(optval, data, len))
74223 + if (len > sizeof(st) || copy_to_user(optval, data, len))
74224 return -EFAULT;
74225 return 0;
74226 }
74227 diff -urNp linux-3.0.8/net/phonet/af_phonet.c linux-3.0.8/net/phonet/af_phonet.c
74228 --- linux-3.0.8/net/phonet/af_phonet.c 2011-07-21 22:17:23.000000000 -0400
74229 +++ linux-3.0.8/net/phonet/af_phonet.c 2011-08-23 21:48:14.000000000 -0400
74230 @@ -41,7 +41,7 @@ static struct phonet_protocol *phonet_pr
74231 {
74232 struct phonet_protocol *pp;
74233
74234 - if (protocol >= PHONET_NPROTO)
74235 + if (protocol < 0 || protocol >= PHONET_NPROTO)
74236 return NULL;
74237
74238 rcu_read_lock();
74239 @@ -469,7 +469,7 @@ int __init_or_module phonet_proto_regist
74240 {
74241 int err = 0;
74242
74243 - if (protocol >= PHONET_NPROTO)
74244 + if (protocol < 0 || protocol >= PHONET_NPROTO)
74245 return -EINVAL;
74246
74247 err = proto_register(pp->prot, 1);
74248 diff -urNp linux-3.0.8/net/phonet/pep.c linux-3.0.8/net/phonet/pep.c
74249 --- linux-3.0.8/net/phonet/pep.c 2011-07-21 22:17:23.000000000 -0400
74250 +++ linux-3.0.8/net/phonet/pep.c 2011-08-23 21:47:56.000000000 -0400
74251 @@ -387,7 +387,7 @@ static int pipe_do_rcv(struct sock *sk,
74252
74253 case PNS_PEP_CTRL_REQ:
74254 if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) {
74255 - atomic_inc(&sk->sk_drops);
74256 + atomic_inc_unchecked(&sk->sk_drops);
74257 break;
74258 }
74259 __skb_pull(skb, 4);
74260 @@ -408,7 +408,7 @@ static int pipe_do_rcv(struct sock *sk,
74261 }
74262
74263 if (pn->rx_credits == 0) {
74264 - atomic_inc(&sk->sk_drops);
74265 + atomic_inc_unchecked(&sk->sk_drops);
74266 err = -ENOBUFS;
74267 break;
74268 }
74269 @@ -556,7 +556,7 @@ static int pipe_handler_do_rcv(struct so
74270 }
74271
74272 if (pn->rx_credits == 0) {
74273 - atomic_inc(&sk->sk_drops);
74274 + atomic_inc_unchecked(&sk->sk_drops);
74275 err = NET_RX_DROP;
74276 break;
74277 }
74278 diff -urNp linux-3.0.8/net/phonet/socket.c linux-3.0.8/net/phonet/socket.c
74279 --- linux-3.0.8/net/phonet/socket.c 2011-07-21 22:17:23.000000000 -0400
74280 +++ linux-3.0.8/net/phonet/socket.c 2011-08-23 21:48:14.000000000 -0400
74281 @@ -612,8 +612,13 @@ static int pn_sock_seq_show(struct seq_f
74282 pn->resource, sk->sk_state,
74283 sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
74284 sock_i_uid(sk), sock_i_ino(sk),
74285 - atomic_read(&sk->sk_refcnt), sk,
74286 - atomic_read(&sk->sk_drops), &len);
74287 + atomic_read(&sk->sk_refcnt),
74288 +#ifdef CONFIG_GRKERNSEC_HIDESYM
74289 + NULL,
74290 +#else
74291 + sk,
74292 +#endif
74293 + atomic_read_unchecked(&sk->sk_drops), &len);
74294 }
74295 seq_printf(seq, "%*s\n", 127 - len, "");
74296 return 0;
74297 diff -urNp linux-3.0.8/net/rds/cong.c linux-3.0.8/net/rds/cong.c
74298 --- linux-3.0.8/net/rds/cong.c 2011-07-21 22:17:23.000000000 -0400
74299 +++ linux-3.0.8/net/rds/cong.c 2011-08-23 21:47:56.000000000 -0400
74300 @@ -77,7 +77,7 @@
74301 * finds that the saved generation number is smaller than the global generation
74302 * number, it wakes up the process.
74303 */
74304 -static atomic_t rds_cong_generation = ATOMIC_INIT(0);
74305 +static atomic_unchecked_t rds_cong_generation = ATOMIC_INIT(0);
74306
74307 /*
74308 * Congestion monitoring
74309 @@ -232,7 +232,7 @@ void rds_cong_map_updated(struct rds_con
74310 rdsdebug("waking map %p for %pI4\n",
74311 map, &map->m_addr);
74312 rds_stats_inc(s_cong_update_received);
74313 - atomic_inc(&rds_cong_generation);
74314 + atomic_inc_unchecked(&rds_cong_generation);
74315 if (waitqueue_active(&map->m_waitq))
74316 wake_up(&map->m_waitq);
74317 if (waitqueue_active(&rds_poll_waitq))
74318 @@ -258,7 +258,7 @@ EXPORT_SYMBOL_GPL(rds_cong_map_updated);
74319
74320 int rds_cong_updated_since(unsigned long *recent)
74321 {
74322 - unsigned long gen = atomic_read(&rds_cong_generation);
74323 + unsigned long gen = atomic_read_unchecked(&rds_cong_generation);
74324
74325 if (likely(*recent == gen))
74326 return 0;
74327 diff -urNp linux-3.0.8/net/rds/ib_cm.c linux-3.0.8/net/rds/ib_cm.c
74328 --- linux-3.0.8/net/rds/ib_cm.c 2011-07-21 22:17:23.000000000 -0400
74329 +++ linux-3.0.8/net/rds/ib_cm.c 2011-08-23 21:47:56.000000000 -0400
74330 @@ -720,7 +720,7 @@ void rds_ib_conn_shutdown(struct rds_con
74331 /* Clear the ACK state */
74332 clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
74333 #ifdef KERNEL_HAS_ATOMIC64
74334 - atomic64_set(&ic->i_ack_next, 0);
74335 + atomic64_set_unchecked(&ic->i_ack_next, 0);
74336 #else
74337 ic->i_ack_next = 0;
74338 #endif
74339 diff -urNp linux-3.0.8/net/rds/ib.h linux-3.0.8/net/rds/ib.h
74340 --- linux-3.0.8/net/rds/ib.h 2011-07-21 22:17:23.000000000 -0400
74341 +++ linux-3.0.8/net/rds/ib.h 2011-08-23 21:47:56.000000000 -0400
74342 @@ -127,7 +127,7 @@ struct rds_ib_connection {
74343 /* sending acks */
74344 unsigned long i_ack_flags;
74345 #ifdef KERNEL_HAS_ATOMIC64
74346 - atomic64_t i_ack_next; /* next ACK to send */
74347 + atomic64_unchecked_t i_ack_next; /* next ACK to send */
74348 #else
74349 spinlock_t i_ack_lock; /* protect i_ack_next */
74350 u64 i_ack_next; /* next ACK to send */
74351 diff -urNp linux-3.0.8/net/rds/ib_recv.c linux-3.0.8/net/rds/ib_recv.c
74352 --- linux-3.0.8/net/rds/ib_recv.c 2011-07-21 22:17:23.000000000 -0400
74353 +++ linux-3.0.8/net/rds/ib_recv.c 2011-08-23 21:47:56.000000000 -0400
74354 @@ -592,7 +592,7 @@ static u64 rds_ib_get_ack(struct rds_ib_
74355 static void rds_ib_set_ack(struct rds_ib_connection *ic, u64 seq,
74356 int ack_required)
74357 {
74358 - atomic64_set(&ic->i_ack_next, seq);
74359 + atomic64_set_unchecked(&ic->i_ack_next, seq);
74360 if (ack_required) {
74361 smp_mb__before_clear_bit();
74362 set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
74363 @@ -604,7 +604,7 @@ static u64 rds_ib_get_ack(struct rds_ib_
74364 clear_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
74365 smp_mb__after_clear_bit();
74366
74367 - return atomic64_read(&ic->i_ack_next);
74368 + return atomic64_read_unchecked(&ic->i_ack_next);
74369 }
74370 #endif
74371
74372 diff -urNp linux-3.0.8/net/rds/iw_cm.c linux-3.0.8/net/rds/iw_cm.c
74373 --- linux-3.0.8/net/rds/iw_cm.c 2011-07-21 22:17:23.000000000 -0400
74374 +++ linux-3.0.8/net/rds/iw_cm.c 2011-08-23 21:47:56.000000000 -0400
74375 @@ -664,7 +664,7 @@ void rds_iw_conn_shutdown(struct rds_con
74376 /* Clear the ACK state */
74377 clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
74378 #ifdef KERNEL_HAS_ATOMIC64
74379 - atomic64_set(&ic->i_ack_next, 0);
74380 + atomic64_set_unchecked(&ic->i_ack_next, 0);
74381 #else
74382 ic->i_ack_next = 0;
74383 #endif
74384 diff -urNp linux-3.0.8/net/rds/iw.h linux-3.0.8/net/rds/iw.h
74385 --- linux-3.0.8/net/rds/iw.h 2011-07-21 22:17:23.000000000 -0400
74386 +++ linux-3.0.8/net/rds/iw.h 2011-08-23 21:47:56.000000000 -0400
74387 @@ -133,7 +133,7 @@ struct rds_iw_connection {
74388 /* sending acks */
74389 unsigned long i_ack_flags;
74390 #ifdef KERNEL_HAS_ATOMIC64
74391 - atomic64_t i_ack_next; /* next ACK to send */
74392 + atomic64_unchecked_t i_ack_next; /* next ACK to send */
74393 #else
74394 spinlock_t i_ack_lock; /* protect i_ack_next */
74395 u64 i_ack_next; /* next ACK to send */
74396 diff -urNp linux-3.0.8/net/rds/iw_rdma.c linux-3.0.8/net/rds/iw_rdma.c
74397 --- linux-3.0.8/net/rds/iw_rdma.c 2011-07-21 22:17:23.000000000 -0400
74398 +++ linux-3.0.8/net/rds/iw_rdma.c 2011-08-23 21:48:14.000000000 -0400
74399 @@ -182,6 +182,8 @@ int rds_iw_update_cm_id(struct rds_iw_de
74400 struct rdma_cm_id *pcm_id;
74401 int rc;
74402
74403 + pax_track_stack();
74404 +
74405 src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
74406 dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
74407
74408 diff -urNp linux-3.0.8/net/rds/iw_recv.c linux-3.0.8/net/rds/iw_recv.c
74409 --- linux-3.0.8/net/rds/iw_recv.c 2011-07-21 22:17:23.000000000 -0400
74410 +++ linux-3.0.8/net/rds/iw_recv.c 2011-08-23 21:47:56.000000000 -0400
74411 @@ -427,7 +427,7 @@ static u64 rds_iw_get_ack(struct rds_iw_
74412 static void rds_iw_set_ack(struct rds_iw_connection *ic, u64 seq,
74413 int ack_required)
74414 {
74415 - atomic64_set(&ic->i_ack_next, seq);
74416 + atomic64_set_unchecked(&ic->i_ack_next, seq);
74417 if (ack_required) {
74418 smp_mb__before_clear_bit();
74419 set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
74420 @@ -439,7 +439,7 @@ static u64 rds_iw_get_ack(struct rds_iw_
74421 clear_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
74422 smp_mb__after_clear_bit();
74423
74424 - return atomic64_read(&ic->i_ack_next);
74425 + return atomic64_read_unchecked(&ic->i_ack_next);
74426 }
74427 #endif
74428
74429 diff -urNp linux-3.0.8/net/rds/tcp.c linux-3.0.8/net/rds/tcp.c
74430 --- linux-3.0.8/net/rds/tcp.c 2011-07-21 22:17:23.000000000 -0400
74431 +++ linux-3.0.8/net/rds/tcp.c 2011-10-06 04:17:55.000000000 -0400
74432 @@ -58,7 +58,7 @@ void rds_tcp_nonagle(struct socket *sock
74433 int val = 1;
74434
74435 set_fs(KERNEL_DS);
74436 - sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __user *)&val,
74437 + sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __force_user *)&val,
74438 sizeof(val));
74439 set_fs(oldfs);
74440 }
74441 diff -urNp linux-3.0.8/net/rds/tcp_send.c linux-3.0.8/net/rds/tcp_send.c
74442 --- linux-3.0.8/net/rds/tcp_send.c 2011-07-21 22:17:23.000000000 -0400
74443 +++ linux-3.0.8/net/rds/tcp_send.c 2011-10-06 04:17:55.000000000 -0400
74444 @@ -43,7 +43,7 @@ static void rds_tcp_cork(struct socket *
74445
74446 oldfs = get_fs();
74447 set_fs(KERNEL_DS);
74448 - sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __user *)&val,
74449 + sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __force_user *)&val,
74450 sizeof(val));
74451 set_fs(oldfs);
74452 }
74453 diff -urNp linux-3.0.8/net/rxrpc/af_rxrpc.c linux-3.0.8/net/rxrpc/af_rxrpc.c
74454 --- linux-3.0.8/net/rxrpc/af_rxrpc.c 2011-07-21 22:17:23.000000000 -0400
74455 +++ linux-3.0.8/net/rxrpc/af_rxrpc.c 2011-08-23 21:47:56.000000000 -0400
74456 @@ -39,7 +39,7 @@ static const struct proto_ops rxrpc_rpc_
74457 __be32 rxrpc_epoch;
74458
74459 /* current debugging ID */
74460 -atomic_t rxrpc_debug_id;
74461 +atomic_unchecked_t rxrpc_debug_id;
74462
74463 /* count of skbs currently in use */
74464 atomic_t rxrpc_n_skbs;
74465 diff -urNp linux-3.0.8/net/rxrpc/ar-ack.c linux-3.0.8/net/rxrpc/ar-ack.c
74466 --- linux-3.0.8/net/rxrpc/ar-ack.c 2011-07-21 22:17:23.000000000 -0400
74467 +++ linux-3.0.8/net/rxrpc/ar-ack.c 2011-08-23 21:48:14.000000000 -0400
74468 @@ -175,7 +175,7 @@ static void rxrpc_resend(struct rxrpc_ca
74469
74470 _enter("{%d,%d,%d,%d},",
74471 call->acks_hard, call->acks_unacked,
74472 - atomic_read(&call->sequence),
74473 + atomic_read_unchecked(&call->sequence),
74474 CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
74475
74476 stop = 0;
74477 @@ -199,7 +199,7 @@ static void rxrpc_resend(struct rxrpc_ca
74478
74479 /* each Tx packet has a new serial number */
74480 sp->hdr.serial =
74481 - htonl(atomic_inc_return(&call->conn->serial));
74482 + htonl(atomic_inc_return_unchecked(&call->conn->serial));
74483
74484 hdr = (struct rxrpc_header *) txb->head;
74485 hdr->serial = sp->hdr.serial;
74486 @@ -403,7 +403,7 @@ static void rxrpc_rotate_tx_window(struc
74487 */
74488 static void rxrpc_clear_tx_window(struct rxrpc_call *call)
74489 {
74490 - rxrpc_rotate_tx_window(call, atomic_read(&call->sequence));
74491 + rxrpc_rotate_tx_window(call, atomic_read_unchecked(&call->sequence));
74492 }
74493
74494 /*
74495 @@ -629,7 +629,7 @@ process_further:
74496
74497 latest = ntohl(sp->hdr.serial);
74498 hard = ntohl(ack.firstPacket);
74499 - tx = atomic_read(&call->sequence);
74500 + tx = atomic_read_unchecked(&call->sequence);
74501
74502 _proto("Rx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
74503 latest,
74504 @@ -842,6 +842,8 @@ void rxrpc_process_call(struct work_stru
74505 u32 abort_code = RX_PROTOCOL_ERROR;
74506 u8 *acks = NULL;
74507
74508 + pax_track_stack();
74509 +
74510 //printk("\n--------------------\n");
74511 _enter("{%d,%s,%lx} [%lu]",
74512 call->debug_id, rxrpc_call_states[call->state], call->events,
74513 @@ -1161,7 +1163,7 @@ void rxrpc_process_call(struct work_stru
74514 goto maybe_reschedule;
74515
74516 send_ACK_with_skew:
74517 - ack.maxSkew = htons(atomic_read(&call->conn->hi_serial) -
74518 + ack.maxSkew = htons(atomic_read_unchecked(&call->conn->hi_serial) -
74519 ntohl(ack.serial));
74520 send_ACK:
74521 mtu = call->conn->trans->peer->if_mtu;
74522 @@ -1173,7 +1175,7 @@ send_ACK:
74523 ackinfo.rxMTU = htonl(5692);
74524 ackinfo.jumbo_max = htonl(4);
74525
74526 - hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
74527 + hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
74528 _proto("Tx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
74529 ntohl(hdr.serial),
74530 ntohs(ack.maxSkew),
74531 @@ -1191,7 +1193,7 @@ send_ACK:
74532 send_message:
74533 _debug("send message");
74534
74535 - hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
74536 + hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
74537 _proto("Tx %s %%%u", rxrpc_pkts[hdr.type], ntohl(hdr.serial));
74538 send_message_2:
74539
74540 diff -urNp linux-3.0.8/net/rxrpc/ar-call.c linux-3.0.8/net/rxrpc/ar-call.c
74541 --- linux-3.0.8/net/rxrpc/ar-call.c 2011-07-21 22:17:23.000000000 -0400
74542 +++ linux-3.0.8/net/rxrpc/ar-call.c 2011-08-23 21:47:56.000000000 -0400
74543 @@ -83,7 +83,7 @@ static struct rxrpc_call *rxrpc_alloc_ca
74544 spin_lock_init(&call->lock);
74545 rwlock_init(&call->state_lock);
74546 atomic_set(&call->usage, 1);
74547 - call->debug_id = atomic_inc_return(&rxrpc_debug_id);
74548 + call->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
74549 call->state = RXRPC_CALL_CLIENT_SEND_REQUEST;
74550
74551 memset(&call->sock_node, 0xed, sizeof(call->sock_node));
74552 diff -urNp linux-3.0.8/net/rxrpc/ar-connection.c linux-3.0.8/net/rxrpc/ar-connection.c
74553 --- linux-3.0.8/net/rxrpc/ar-connection.c 2011-07-21 22:17:23.000000000 -0400
74554 +++ linux-3.0.8/net/rxrpc/ar-connection.c 2011-08-23 21:47:56.000000000 -0400
74555 @@ -206,7 +206,7 @@ static struct rxrpc_connection *rxrpc_al
74556 rwlock_init(&conn->lock);
74557 spin_lock_init(&conn->state_lock);
74558 atomic_set(&conn->usage, 1);
74559 - conn->debug_id = atomic_inc_return(&rxrpc_debug_id);
74560 + conn->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
74561 conn->avail_calls = RXRPC_MAXCALLS;
74562 conn->size_align = 4;
74563 conn->header_size = sizeof(struct rxrpc_header);
74564 diff -urNp linux-3.0.8/net/rxrpc/ar-connevent.c linux-3.0.8/net/rxrpc/ar-connevent.c
74565 --- linux-3.0.8/net/rxrpc/ar-connevent.c 2011-07-21 22:17:23.000000000 -0400
74566 +++ linux-3.0.8/net/rxrpc/ar-connevent.c 2011-08-23 21:47:56.000000000 -0400
74567 @@ -109,7 +109,7 @@ static int rxrpc_abort_connection(struct
74568
74569 len = iov[0].iov_len + iov[1].iov_len;
74570
74571 - hdr.serial = htonl(atomic_inc_return(&conn->serial));
74572 + hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
74573 _proto("Tx CONN ABORT %%%u { %d }", ntohl(hdr.serial), abort_code);
74574
74575 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
74576 diff -urNp linux-3.0.8/net/rxrpc/ar-input.c linux-3.0.8/net/rxrpc/ar-input.c
74577 --- linux-3.0.8/net/rxrpc/ar-input.c 2011-07-21 22:17:23.000000000 -0400
74578 +++ linux-3.0.8/net/rxrpc/ar-input.c 2011-08-23 21:47:56.000000000 -0400
74579 @@ -340,9 +340,9 @@ void rxrpc_fast_process_packet(struct rx
74580 /* track the latest serial number on this connection for ACK packet
74581 * information */
74582 serial = ntohl(sp->hdr.serial);
74583 - hi_serial = atomic_read(&call->conn->hi_serial);
74584 + hi_serial = atomic_read_unchecked(&call->conn->hi_serial);
74585 while (serial > hi_serial)
74586 - hi_serial = atomic_cmpxchg(&call->conn->hi_serial, hi_serial,
74587 + hi_serial = atomic_cmpxchg_unchecked(&call->conn->hi_serial, hi_serial,
74588 serial);
74589
74590 /* request ACK generation for any ACK or DATA packet that requests
74591 diff -urNp linux-3.0.8/net/rxrpc/ar-internal.h linux-3.0.8/net/rxrpc/ar-internal.h
74592 --- linux-3.0.8/net/rxrpc/ar-internal.h 2011-07-21 22:17:23.000000000 -0400
74593 +++ linux-3.0.8/net/rxrpc/ar-internal.h 2011-08-23 21:47:56.000000000 -0400
74594 @@ -272,8 +272,8 @@ struct rxrpc_connection {
74595 int error; /* error code for local abort */
74596 int debug_id; /* debug ID for printks */
74597 unsigned call_counter; /* call ID counter */
74598 - atomic_t serial; /* packet serial number counter */
74599 - atomic_t hi_serial; /* highest serial number received */
74600 + atomic_unchecked_t serial; /* packet serial number counter */
74601 + atomic_unchecked_t hi_serial; /* highest serial number received */
74602 u8 avail_calls; /* number of calls available */
74603 u8 size_align; /* data size alignment (for security) */
74604 u8 header_size; /* rxrpc + security header size */
74605 @@ -346,7 +346,7 @@ struct rxrpc_call {
74606 spinlock_t lock;
74607 rwlock_t state_lock; /* lock for state transition */
74608 atomic_t usage;
74609 - atomic_t sequence; /* Tx data packet sequence counter */
74610 + atomic_unchecked_t sequence; /* Tx data packet sequence counter */
74611 u32 abort_code; /* local/remote abort code */
74612 enum { /* current state of call */
74613 RXRPC_CALL_CLIENT_SEND_REQUEST, /* - client sending request phase */
74614 @@ -420,7 +420,7 @@ static inline void rxrpc_abort_call(stru
74615 */
74616 extern atomic_t rxrpc_n_skbs;
74617 extern __be32 rxrpc_epoch;
74618 -extern atomic_t rxrpc_debug_id;
74619 +extern atomic_unchecked_t rxrpc_debug_id;
74620 extern struct workqueue_struct *rxrpc_workqueue;
74621
74622 /*
74623 diff -urNp linux-3.0.8/net/rxrpc/ar-local.c linux-3.0.8/net/rxrpc/ar-local.c
74624 --- linux-3.0.8/net/rxrpc/ar-local.c 2011-07-21 22:17:23.000000000 -0400
74625 +++ linux-3.0.8/net/rxrpc/ar-local.c 2011-08-23 21:47:56.000000000 -0400
74626 @@ -45,7 +45,7 @@ struct rxrpc_local *rxrpc_alloc_local(st
74627 spin_lock_init(&local->lock);
74628 rwlock_init(&local->services_lock);
74629 atomic_set(&local->usage, 1);
74630 - local->debug_id = atomic_inc_return(&rxrpc_debug_id);
74631 + local->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
74632 memcpy(&local->srx, srx, sizeof(*srx));
74633 }
74634
74635 diff -urNp linux-3.0.8/net/rxrpc/ar-output.c linux-3.0.8/net/rxrpc/ar-output.c
74636 --- linux-3.0.8/net/rxrpc/ar-output.c 2011-07-21 22:17:23.000000000 -0400
74637 +++ linux-3.0.8/net/rxrpc/ar-output.c 2011-08-23 21:47:56.000000000 -0400
74638 @@ -681,9 +681,9 @@ static int rxrpc_send_data(struct kiocb
74639 sp->hdr.cid = call->cid;
74640 sp->hdr.callNumber = call->call_id;
74641 sp->hdr.seq =
74642 - htonl(atomic_inc_return(&call->sequence));
74643 + htonl(atomic_inc_return_unchecked(&call->sequence));
74644 sp->hdr.serial =
74645 - htonl(atomic_inc_return(&conn->serial));
74646 + htonl(atomic_inc_return_unchecked(&conn->serial));
74647 sp->hdr.type = RXRPC_PACKET_TYPE_DATA;
74648 sp->hdr.userStatus = 0;
74649 sp->hdr.securityIndex = conn->security_ix;
74650 diff -urNp linux-3.0.8/net/rxrpc/ar-peer.c linux-3.0.8/net/rxrpc/ar-peer.c
74651 --- linux-3.0.8/net/rxrpc/ar-peer.c 2011-07-21 22:17:23.000000000 -0400
74652 +++ linux-3.0.8/net/rxrpc/ar-peer.c 2011-08-23 21:47:56.000000000 -0400
74653 @@ -72,7 +72,7 @@ static struct rxrpc_peer *rxrpc_alloc_pe
74654 INIT_LIST_HEAD(&peer->error_targets);
74655 spin_lock_init(&peer->lock);
74656 atomic_set(&peer->usage, 1);
74657 - peer->debug_id = atomic_inc_return(&rxrpc_debug_id);
74658 + peer->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
74659 memcpy(&peer->srx, srx, sizeof(*srx));
74660
74661 rxrpc_assess_MTU_size(peer);
74662 diff -urNp linux-3.0.8/net/rxrpc/ar-proc.c linux-3.0.8/net/rxrpc/ar-proc.c
74663 --- linux-3.0.8/net/rxrpc/ar-proc.c 2011-07-21 22:17:23.000000000 -0400
74664 +++ linux-3.0.8/net/rxrpc/ar-proc.c 2011-08-23 21:47:56.000000000 -0400
74665 @@ -164,8 +164,8 @@ static int rxrpc_connection_seq_show(str
74666 atomic_read(&conn->usage),
74667 rxrpc_conn_states[conn->state],
74668 key_serial(conn->key),
74669 - atomic_read(&conn->serial),
74670 - atomic_read(&conn->hi_serial));
74671 + atomic_read_unchecked(&conn->serial),
74672 + atomic_read_unchecked(&conn->hi_serial));
74673
74674 return 0;
74675 }
74676 diff -urNp linux-3.0.8/net/rxrpc/ar-transport.c linux-3.0.8/net/rxrpc/ar-transport.c
74677 --- linux-3.0.8/net/rxrpc/ar-transport.c 2011-07-21 22:17:23.000000000 -0400
74678 +++ linux-3.0.8/net/rxrpc/ar-transport.c 2011-08-23 21:47:56.000000000 -0400
74679 @@ -47,7 +47,7 @@ static struct rxrpc_transport *rxrpc_all
74680 spin_lock_init(&trans->client_lock);
74681 rwlock_init(&trans->conn_lock);
74682 atomic_set(&trans->usage, 1);
74683 - trans->debug_id = atomic_inc_return(&rxrpc_debug_id);
74684 + trans->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
74685
74686 if (peer->srx.transport.family == AF_INET) {
74687 switch (peer->srx.transport_type) {
74688 diff -urNp linux-3.0.8/net/rxrpc/rxkad.c linux-3.0.8/net/rxrpc/rxkad.c
74689 --- linux-3.0.8/net/rxrpc/rxkad.c 2011-07-21 22:17:23.000000000 -0400
74690 +++ linux-3.0.8/net/rxrpc/rxkad.c 2011-08-23 21:48:14.000000000 -0400
74691 @@ -211,6 +211,8 @@ static int rxkad_secure_packet_encrypt(c
74692 u16 check;
74693 int nsg;
74694
74695 + pax_track_stack();
74696 +
74697 sp = rxrpc_skb(skb);
74698
74699 _enter("");
74700 @@ -338,6 +340,8 @@ static int rxkad_verify_packet_auth(cons
74701 u16 check;
74702 int nsg;
74703
74704 + pax_track_stack();
74705 +
74706 _enter("");
74707
74708 sp = rxrpc_skb(skb);
74709 @@ -610,7 +614,7 @@ static int rxkad_issue_challenge(struct
74710
74711 len = iov[0].iov_len + iov[1].iov_len;
74712
74713 - hdr.serial = htonl(atomic_inc_return(&conn->serial));
74714 + hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
74715 _proto("Tx CHALLENGE %%%u", ntohl(hdr.serial));
74716
74717 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
74718 @@ -660,7 +664,7 @@ static int rxkad_send_response(struct rx
74719
74720 len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len;
74721
74722 - hdr->serial = htonl(atomic_inc_return(&conn->serial));
74723 + hdr->serial = htonl(atomic_inc_return_unchecked(&conn->serial));
74724 _proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
74725
74726 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
74727 diff -urNp linux-3.0.8/net/sctp/proc.c linux-3.0.8/net/sctp/proc.c
74728 --- linux-3.0.8/net/sctp/proc.c 2011-07-21 22:17:23.000000000 -0400
74729 +++ linux-3.0.8/net/sctp/proc.c 2011-08-23 21:48:14.000000000 -0400
74730 @@ -318,7 +318,8 @@ static int sctp_assocs_seq_show(struct s
74731 seq_printf(seq,
74732 "%8pK %8pK %-3d %-3d %-2d %-4d "
74733 "%4d %8d %8d %7d %5lu %-5d %5d ",
74734 - assoc, sk, sctp_sk(sk)->type, sk->sk_state,
74735 + assoc, sk,
74736 + sctp_sk(sk)->type, sk->sk_state,
74737 assoc->state, hash,
74738 assoc->assoc_id,
74739 assoc->sndbuf_used,
74740 diff -urNp linux-3.0.8/net/sctp/socket.c linux-3.0.8/net/sctp/socket.c
74741 --- linux-3.0.8/net/sctp/socket.c 2011-07-21 22:17:23.000000000 -0400
74742 +++ linux-3.0.8/net/sctp/socket.c 2011-08-23 21:47:56.000000000 -0400
74743 @@ -4452,7 +4452,7 @@ static int sctp_getsockopt_peer_addrs(st
74744 addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
74745 if (space_left < addrlen)
74746 return -ENOMEM;
74747 - if (copy_to_user(to, &temp, addrlen))
74748 + if (addrlen > sizeof(temp) || copy_to_user(to, &temp, addrlen))
74749 return -EFAULT;
74750 to += addrlen;
74751 cnt++;
74752 diff -urNp linux-3.0.8/net/socket.c linux-3.0.8/net/socket.c
74753 --- linux-3.0.8/net/socket.c 2011-10-24 08:05:30.000000000 -0400
74754 +++ linux-3.0.8/net/socket.c 2011-10-16 21:55:28.000000000 -0400
74755 @@ -88,6 +88,7 @@
74756 #include <linux/nsproxy.h>
74757 #include <linux/magic.h>
74758 #include <linux/slab.h>
74759 +#include <linux/in.h>
74760
74761 #include <asm/uaccess.h>
74762 #include <asm/unistd.h>
74763 @@ -105,6 +106,8 @@
74764 #include <linux/sockios.h>
74765 #include <linux/atalk.h>
74766
74767 +#include <linux/grsock.h>
74768 +
74769 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
74770 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
74771 unsigned long nr_segs, loff_t pos);
74772 @@ -321,7 +324,7 @@ static struct dentry *sockfs_mount(struc
74773 &sockfs_dentry_operations, SOCKFS_MAGIC);
74774 }
74775
74776 -static struct vfsmount *sock_mnt __read_mostly;
74777 +struct vfsmount *sock_mnt __read_mostly;
74778
74779 static struct file_system_type sock_fs_type = {
74780 .name = "sockfs",
74781 @@ -1187,6 +1190,8 @@ int __sock_create(struct net *net, int f
74782 return -EAFNOSUPPORT;
74783 if (type < 0 || type >= SOCK_MAX)
74784 return -EINVAL;
74785 + if (protocol < 0)
74786 + return -EINVAL;
74787
74788 /* Compatibility.
74789
74790 @@ -1319,6 +1324,16 @@ SYSCALL_DEFINE3(socket, int, family, int
74791 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
74792 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
74793
74794 + if(!gr_search_socket(family, type, protocol)) {
74795 + retval = -EACCES;
74796 + goto out;
74797 + }
74798 +
74799 + if (gr_handle_sock_all(family, type, protocol)) {
74800 + retval = -EACCES;
74801 + goto out;
74802 + }
74803 +
74804 retval = sock_create(family, type, protocol, &sock);
74805 if (retval < 0)
74806 goto out;
74807 @@ -1431,6 +1446,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
74808 if (sock) {
74809 err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
74810 if (err >= 0) {
74811 + if (gr_handle_sock_server((struct sockaddr *)&address)) {
74812 + err = -EACCES;
74813 + goto error;
74814 + }
74815 + err = gr_search_bind(sock, (struct sockaddr_in *)&address);
74816 + if (err)
74817 + goto error;
74818 +
74819 err = security_socket_bind(sock,
74820 (struct sockaddr *)&address,
74821 addrlen);
74822 @@ -1439,6 +1462,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
74823 (struct sockaddr *)
74824 &address, addrlen);
74825 }
74826 +error:
74827 fput_light(sock->file, fput_needed);
74828 }
74829 return err;
74830 @@ -1462,10 +1486,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
74831 if ((unsigned)backlog > somaxconn)
74832 backlog = somaxconn;
74833
74834 + if (gr_handle_sock_server_other(sock->sk)) {
74835 + err = -EPERM;
74836 + goto error;
74837 + }
74838 +
74839 + err = gr_search_listen(sock);
74840 + if (err)
74841 + goto error;
74842 +
74843 err = security_socket_listen(sock, backlog);
74844 if (!err)
74845 err = sock->ops->listen(sock, backlog);
74846
74847 +error:
74848 fput_light(sock->file, fput_needed);
74849 }
74850 return err;
74851 @@ -1509,6 +1543,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
74852 newsock->type = sock->type;
74853 newsock->ops = sock->ops;
74854
74855 + if (gr_handle_sock_server_other(sock->sk)) {
74856 + err = -EPERM;
74857 + sock_release(newsock);
74858 + goto out_put;
74859 + }
74860 +
74861 + err = gr_search_accept(sock);
74862 + if (err) {
74863 + sock_release(newsock);
74864 + goto out_put;
74865 + }
74866 +
74867 /*
74868 * We don't need try_module_get here, as the listening socket (sock)
74869 * has the protocol module (sock->ops->owner) held.
74870 @@ -1547,6 +1593,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
74871 fd_install(newfd, newfile);
74872 err = newfd;
74873
74874 + gr_attach_curr_ip(newsock->sk);
74875 +
74876 out_put:
74877 fput_light(sock->file, fput_needed);
74878 out:
74879 @@ -1579,6 +1627,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct
74880 int, addrlen)
74881 {
74882 struct socket *sock;
74883 + struct sockaddr *sck;
74884 struct sockaddr_storage address;
74885 int err, fput_needed;
74886
74887 @@ -1589,6 +1638,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct
74888 if (err < 0)
74889 goto out_put;
74890
74891 + sck = (struct sockaddr *)&address;
74892 +
74893 + if (gr_handle_sock_client(sck)) {
74894 + err = -EACCES;
74895 + goto out_put;
74896 + }
74897 +
74898 + err = gr_search_connect(sock, (struct sockaddr_in *)sck);
74899 + if (err)
74900 + goto out_put;
74901 +
74902 err =
74903 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
74904 if (err)
74905 @@ -1890,6 +1950,8 @@ static int __sys_sendmsg(struct socket *
74906 unsigned char *ctl_buf = ctl;
74907 int err, ctl_len, iov_size, total_len;
74908
74909 + pax_track_stack();
74910 +
74911 err = -EFAULT;
74912 if (MSG_CMSG_COMPAT & flags) {
74913 if (get_compat_msghdr(msg_sys, msg_compat))
74914 @@ -1950,7 +2012,7 @@ static int __sys_sendmsg(struct socket *
74915 * checking falls down on this.
74916 */
74917 if (copy_from_user(ctl_buf,
74918 - (void __user __force *)msg_sys->msg_control,
74919 + (void __force_user *)msg_sys->msg_control,
74920 ctl_len))
74921 goto out_freectl;
74922 msg_sys->msg_control = ctl_buf;
74923 @@ -2120,7 +2182,7 @@ static int __sys_recvmsg(struct socket *
74924 * kernel msghdr to use the kernel address space)
74925 */
74926
74927 - uaddr = (__force void __user *)msg_sys->msg_name;
74928 + uaddr = (void __force_user *)msg_sys->msg_name;
74929 uaddr_len = COMPAT_NAMELEN(msg);
74930 if (MSG_CMSG_COMPAT & flags) {
74931 err = verify_compat_iovec(msg_sys, iov,
74932 @@ -2748,7 +2810,7 @@ static int ethtool_ioctl(struct net *net
74933 }
74934
74935 ifr = compat_alloc_user_space(buf_size);
74936 - rxnfc = (void *)ifr + ALIGN(sizeof(struct ifreq), 8);
74937 + rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
74938
74939 if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
74940 return -EFAULT;
74941 @@ -2772,12 +2834,12 @@ static int ethtool_ioctl(struct net *net
74942 offsetof(struct ethtool_rxnfc, fs.ring_cookie));
74943
74944 if (copy_in_user(rxnfc, compat_rxnfc,
74945 - (void *)(&rxnfc->fs.m_ext + 1) -
74946 - (void *)rxnfc) ||
74947 + (void __user *)(&rxnfc->fs.m_ext + 1) -
74948 + (void __user *)rxnfc) ||
74949 copy_in_user(&rxnfc->fs.ring_cookie,
74950 &compat_rxnfc->fs.ring_cookie,
74951 - (void *)(&rxnfc->fs.location + 1) -
74952 - (void *)&rxnfc->fs.ring_cookie) ||
74953 + (void __user *)(&rxnfc->fs.location + 1) -
74954 + (void __user *)&rxnfc->fs.ring_cookie) ||
74955 copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
74956 sizeof(rxnfc->rule_cnt)))
74957 return -EFAULT;
74958 @@ -2789,12 +2851,12 @@ static int ethtool_ioctl(struct net *net
74959
74960 if (convert_out) {
74961 if (copy_in_user(compat_rxnfc, rxnfc,
74962 - (const void *)(&rxnfc->fs.m_ext + 1) -
74963 - (const void *)rxnfc) ||
74964 + (const void __user *)(&rxnfc->fs.m_ext + 1) -
74965 + (const void __user *)rxnfc) ||
74966 copy_in_user(&compat_rxnfc->fs.ring_cookie,
74967 &rxnfc->fs.ring_cookie,
74968 - (const void *)(&rxnfc->fs.location + 1) -
74969 - (const void *)&rxnfc->fs.ring_cookie) ||
74970 + (const void __user *)(&rxnfc->fs.location + 1) -
74971 + (const void __user *)&rxnfc->fs.ring_cookie) ||
74972 copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
74973 sizeof(rxnfc->rule_cnt)))
74974 return -EFAULT;
74975 @@ -2864,7 +2926,7 @@ static int bond_ioctl(struct net *net, u
74976 old_fs = get_fs();
74977 set_fs(KERNEL_DS);
74978 err = dev_ioctl(net, cmd,
74979 - (struct ifreq __user __force *) &kifr);
74980 + (struct ifreq __force_user *) &kifr);
74981 set_fs(old_fs);
74982
74983 return err;
74984 @@ -2973,7 +3035,7 @@ static int compat_sioc_ifmap(struct net
74985
74986 old_fs = get_fs();
74987 set_fs(KERNEL_DS);
74988 - err = dev_ioctl(net, cmd, (void __user __force *)&ifr);
74989 + err = dev_ioctl(net, cmd, (void __force_user *)&ifr);
74990 set_fs(old_fs);
74991
74992 if (cmd == SIOCGIFMAP && !err) {
74993 @@ -3078,7 +3140,7 @@ static int routing_ioctl(struct net *net
74994 ret |= __get_user(rtdev, &(ur4->rt_dev));
74995 if (rtdev) {
74996 ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
74997 - r4.rt_dev = (char __user __force *)devname;
74998 + r4.rt_dev = (char __force_user *)devname;
74999 devname[15] = 0;
75000 } else
75001 r4.rt_dev = NULL;
75002 @@ -3318,8 +3380,8 @@ int kernel_getsockopt(struct socket *soc
75003 int __user *uoptlen;
75004 int err;
75005
75006 - uoptval = (char __user __force *) optval;
75007 - uoptlen = (int __user __force *) optlen;
75008 + uoptval = (char __force_user *) optval;
75009 + uoptlen = (int __force_user *) optlen;
75010
75011 set_fs(KERNEL_DS);
75012 if (level == SOL_SOCKET)
75013 @@ -3339,7 +3401,7 @@ int kernel_setsockopt(struct socket *soc
75014 char __user *uoptval;
75015 int err;
75016
75017 - uoptval = (char __user __force *) optval;
75018 + uoptval = (char __force_user *) optval;
75019
75020 set_fs(KERNEL_DS);
75021 if (level == SOL_SOCKET)
75022 diff -urNp linux-3.0.8/net/sunrpc/sched.c linux-3.0.8/net/sunrpc/sched.c
75023 --- linux-3.0.8/net/sunrpc/sched.c 2011-07-21 22:17:23.000000000 -0400
75024 +++ linux-3.0.8/net/sunrpc/sched.c 2011-08-23 21:47:56.000000000 -0400
75025 @@ -234,9 +234,9 @@ static int rpc_wait_bit_killable(void *w
75026 #ifdef RPC_DEBUG
75027 static void rpc_task_set_debuginfo(struct rpc_task *task)
75028 {
75029 - static atomic_t rpc_pid;
75030 + static atomic_unchecked_t rpc_pid;
75031
75032 - task->tk_pid = atomic_inc_return(&rpc_pid);
75033 + task->tk_pid = atomic_inc_return_unchecked(&rpc_pid);
75034 }
75035 #else
75036 static inline void rpc_task_set_debuginfo(struct rpc_task *task)
75037 diff -urNp linux-3.0.8/net/sunrpc/svcsock.c linux-3.0.8/net/sunrpc/svcsock.c
75038 --- linux-3.0.8/net/sunrpc/svcsock.c 2011-07-21 22:17:23.000000000 -0400
75039 +++ linux-3.0.8/net/sunrpc/svcsock.c 2011-10-06 04:17:55.000000000 -0400
75040 @@ -392,7 +392,7 @@ static int svc_partial_recvfrom(struct s
75041 int buflen, unsigned int base)
75042 {
75043 size_t save_iovlen;
75044 - void __user *save_iovbase;
75045 + void *save_iovbase;
75046 unsigned int i;
75047 int ret;
75048
75049 diff -urNp linux-3.0.8/net/sunrpc/xprtrdma/svc_rdma.c linux-3.0.8/net/sunrpc/xprtrdma/svc_rdma.c
75050 --- linux-3.0.8/net/sunrpc/xprtrdma/svc_rdma.c 2011-07-21 22:17:23.000000000 -0400
75051 +++ linux-3.0.8/net/sunrpc/xprtrdma/svc_rdma.c 2011-08-23 21:47:56.000000000 -0400
75052 @@ -61,15 +61,15 @@ unsigned int svcrdma_max_req_size = RPCR
75053 static unsigned int min_max_inline = 4096;
75054 static unsigned int max_max_inline = 65536;
75055
75056 -atomic_t rdma_stat_recv;
75057 -atomic_t rdma_stat_read;
75058 -atomic_t rdma_stat_write;
75059 -atomic_t rdma_stat_sq_starve;
75060 -atomic_t rdma_stat_rq_starve;
75061 -atomic_t rdma_stat_rq_poll;
75062 -atomic_t rdma_stat_rq_prod;
75063 -atomic_t rdma_stat_sq_poll;
75064 -atomic_t rdma_stat_sq_prod;
75065 +atomic_unchecked_t rdma_stat_recv;
75066 +atomic_unchecked_t rdma_stat_read;
75067 +atomic_unchecked_t rdma_stat_write;
75068 +atomic_unchecked_t rdma_stat_sq_starve;
75069 +atomic_unchecked_t rdma_stat_rq_starve;
75070 +atomic_unchecked_t rdma_stat_rq_poll;
75071 +atomic_unchecked_t rdma_stat_rq_prod;
75072 +atomic_unchecked_t rdma_stat_sq_poll;
75073 +atomic_unchecked_t rdma_stat_sq_prod;
75074
75075 /* Temporary NFS request map and context caches */
75076 struct kmem_cache *svc_rdma_map_cachep;
75077 @@ -109,7 +109,7 @@ static int read_reset_stat(ctl_table *ta
75078 len -= *ppos;
75079 if (len > *lenp)
75080 len = *lenp;
75081 - if (len && copy_to_user(buffer, str_buf, len))
75082 + if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
75083 return -EFAULT;
75084 *lenp = len;
75085 *ppos += len;
75086 @@ -150,63 +150,63 @@ static ctl_table svcrdma_parm_table[] =
75087 {
75088 .procname = "rdma_stat_read",
75089 .data = &rdma_stat_read,
75090 - .maxlen = sizeof(atomic_t),
75091 + .maxlen = sizeof(atomic_unchecked_t),
75092 .mode = 0644,
75093 .proc_handler = read_reset_stat,
75094 },
75095 {
75096 .procname = "rdma_stat_recv",
75097 .data = &rdma_stat_recv,
75098 - .maxlen = sizeof(atomic_t),
75099 + .maxlen = sizeof(atomic_unchecked_t),
75100 .mode = 0644,
75101 .proc_handler = read_reset_stat,
75102 },
75103 {
75104 .procname = "rdma_stat_write",
75105 .data = &rdma_stat_write,
75106 - .maxlen = sizeof(atomic_t),
75107 + .maxlen = sizeof(atomic_unchecked_t),
75108 .mode = 0644,
75109 .proc_handler = read_reset_stat,
75110 },
75111 {
75112 .procname = "rdma_stat_sq_starve",
75113 .data = &rdma_stat_sq_starve,
75114 - .maxlen = sizeof(atomic_t),
75115 + .maxlen = sizeof(atomic_unchecked_t),
75116 .mode = 0644,
75117 .proc_handler = read_reset_stat,
75118 },
75119 {
75120 .procname = "rdma_stat_rq_starve",
75121 .data = &rdma_stat_rq_starve,
75122 - .maxlen = sizeof(atomic_t),
75123 + .maxlen = sizeof(atomic_unchecked_t),
75124 .mode = 0644,
75125 .proc_handler = read_reset_stat,
75126 },
75127 {
75128 .procname = "rdma_stat_rq_poll",
75129 .data = &rdma_stat_rq_poll,
75130 - .maxlen = sizeof(atomic_t),
75131 + .maxlen = sizeof(atomic_unchecked_t),
75132 .mode = 0644,
75133 .proc_handler = read_reset_stat,
75134 },
75135 {
75136 .procname = "rdma_stat_rq_prod",
75137 .data = &rdma_stat_rq_prod,
75138 - .maxlen = sizeof(atomic_t),
75139 + .maxlen = sizeof(atomic_unchecked_t),
75140 .mode = 0644,
75141 .proc_handler = read_reset_stat,
75142 },
75143 {
75144 .procname = "rdma_stat_sq_poll",
75145 .data = &rdma_stat_sq_poll,
75146 - .maxlen = sizeof(atomic_t),
75147 + .maxlen = sizeof(atomic_unchecked_t),
75148 .mode = 0644,
75149 .proc_handler = read_reset_stat,
75150 },
75151 {
75152 .procname = "rdma_stat_sq_prod",
75153 .data = &rdma_stat_sq_prod,
75154 - .maxlen = sizeof(atomic_t),
75155 + .maxlen = sizeof(atomic_unchecked_t),
75156 .mode = 0644,
75157 .proc_handler = read_reset_stat,
75158 },
75159 diff -urNp linux-3.0.8/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c linux-3.0.8/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
75160 --- linux-3.0.8/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 2011-07-21 22:17:23.000000000 -0400
75161 +++ linux-3.0.8/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 2011-08-23 21:47:56.000000000 -0400
75162 @@ -499,7 +499,7 @@ next_sge:
75163 svc_rdma_put_context(ctxt, 0);
75164 goto out;
75165 }
75166 - atomic_inc(&rdma_stat_read);
75167 + atomic_inc_unchecked(&rdma_stat_read);
75168
75169 if (read_wr.num_sge < chl_map->ch[ch_no].count) {
75170 chl_map->ch[ch_no].count -= read_wr.num_sge;
75171 @@ -609,7 +609,7 @@ int svc_rdma_recvfrom(struct svc_rqst *r
75172 dto_q);
75173 list_del_init(&ctxt->dto_q);
75174 } else {
75175 - atomic_inc(&rdma_stat_rq_starve);
75176 + atomic_inc_unchecked(&rdma_stat_rq_starve);
75177 clear_bit(XPT_DATA, &xprt->xpt_flags);
75178 ctxt = NULL;
75179 }
75180 @@ -629,7 +629,7 @@ int svc_rdma_recvfrom(struct svc_rqst *r
75181 dprintk("svcrdma: processing ctxt=%p on xprt=%p, rqstp=%p, status=%d\n",
75182 ctxt, rdma_xprt, rqstp, ctxt->wc_status);
75183 BUG_ON(ctxt->wc_status != IB_WC_SUCCESS);
75184 - atomic_inc(&rdma_stat_recv);
75185 + atomic_inc_unchecked(&rdma_stat_recv);
75186
75187 /* Build up the XDR from the receive buffers. */
75188 rdma_build_arg_xdr(rqstp, ctxt, ctxt->byte_len);
75189 diff -urNp linux-3.0.8/net/sunrpc/xprtrdma/svc_rdma_sendto.c linux-3.0.8/net/sunrpc/xprtrdma/svc_rdma_sendto.c
75190 --- linux-3.0.8/net/sunrpc/xprtrdma/svc_rdma_sendto.c 2011-07-21 22:17:23.000000000 -0400
75191 +++ linux-3.0.8/net/sunrpc/xprtrdma/svc_rdma_sendto.c 2011-08-23 21:47:56.000000000 -0400
75192 @@ -362,7 +362,7 @@ static int send_write(struct svcxprt_rdm
75193 write_wr.wr.rdma.remote_addr = to;
75194
75195 /* Post It */
75196 - atomic_inc(&rdma_stat_write);
75197 + atomic_inc_unchecked(&rdma_stat_write);
75198 if (svc_rdma_send(xprt, &write_wr))
75199 goto err;
75200 return 0;
75201 diff -urNp linux-3.0.8/net/sunrpc/xprtrdma/svc_rdma_transport.c linux-3.0.8/net/sunrpc/xprtrdma/svc_rdma_transport.c
75202 --- linux-3.0.8/net/sunrpc/xprtrdma/svc_rdma_transport.c 2011-07-21 22:17:23.000000000 -0400
75203 +++ linux-3.0.8/net/sunrpc/xprtrdma/svc_rdma_transport.c 2011-08-23 21:47:56.000000000 -0400
75204 @@ -298,7 +298,7 @@ static void rq_cq_reap(struct svcxprt_rd
75205 return;
75206
75207 ib_req_notify_cq(xprt->sc_rq_cq, IB_CQ_NEXT_COMP);
75208 - atomic_inc(&rdma_stat_rq_poll);
75209 + atomic_inc_unchecked(&rdma_stat_rq_poll);
75210
75211 while ((ret = ib_poll_cq(xprt->sc_rq_cq, 1, &wc)) > 0) {
75212 ctxt = (struct svc_rdma_op_ctxt *)(unsigned long)wc.wr_id;
75213 @@ -320,7 +320,7 @@ static void rq_cq_reap(struct svcxprt_rd
75214 }
75215
75216 if (ctxt)
75217 - atomic_inc(&rdma_stat_rq_prod);
75218 + atomic_inc_unchecked(&rdma_stat_rq_prod);
75219
75220 set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
75221 /*
75222 @@ -392,7 +392,7 @@ static void sq_cq_reap(struct svcxprt_rd
75223 return;
75224
75225 ib_req_notify_cq(xprt->sc_sq_cq, IB_CQ_NEXT_COMP);
75226 - atomic_inc(&rdma_stat_sq_poll);
75227 + atomic_inc_unchecked(&rdma_stat_sq_poll);
75228 while ((ret = ib_poll_cq(cq, 1, &wc)) > 0) {
75229 if (wc.status != IB_WC_SUCCESS)
75230 /* Close the transport */
75231 @@ -410,7 +410,7 @@ static void sq_cq_reap(struct svcxprt_rd
75232 }
75233
75234 if (ctxt)
75235 - atomic_inc(&rdma_stat_sq_prod);
75236 + atomic_inc_unchecked(&rdma_stat_sq_prod);
75237 }
75238
75239 static void sq_comp_handler(struct ib_cq *cq, void *cq_context)
75240 @@ -1272,7 +1272,7 @@ int svc_rdma_send(struct svcxprt_rdma *x
75241 spin_lock_bh(&xprt->sc_lock);
75242 if (xprt->sc_sq_depth < atomic_read(&xprt->sc_sq_count) + wr_count) {
75243 spin_unlock_bh(&xprt->sc_lock);
75244 - atomic_inc(&rdma_stat_sq_starve);
75245 + atomic_inc_unchecked(&rdma_stat_sq_starve);
75246
75247 /* See if we can opportunistically reap SQ WR to make room */
75248 sq_cq_reap(xprt);
75249 diff -urNp linux-3.0.8/net/sysctl_net.c linux-3.0.8/net/sysctl_net.c
75250 --- linux-3.0.8/net/sysctl_net.c 2011-07-21 22:17:23.000000000 -0400
75251 +++ linux-3.0.8/net/sysctl_net.c 2011-08-23 21:48:14.000000000 -0400
75252 @@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ct
75253 struct ctl_table *table)
75254 {
75255 /* Allow network administrator to have same access as root. */
75256 - if (capable(CAP_NET_ADMIN)) {
75257 + if (capable_nolog(CAP_NET_ADMIN)) {
75258 int mode = (table->mode >> 6) & 7;
75259 return (mode << 6) | (mode << 3) | mode;
75260 }
75261 diff -urNp linux-3.0.8/net/tipc/link.c linux-3.0.8/net/tipc/link.c
75262 --- linux-3.0.8/net/tipc/link.c 2011-07-21 22:17:23.000000000 -0400
75263 +++ linux-3.0.8/net/tipc/link.c 2011-10-06 04:17:55.000000000 -0400
75264 @@ -1170,7 +1170,7 @@ static int link_send_sections_long(struc
75265 struct tipc_msg fragm_hdr;
75266 struct sk_buff *buf, *buf_chain, *prev;
75267 u32 fragm_crs, fragm_rest, hsz, sect_rest;
75268 - const unchar *sect_crs;
75269 + const unchar __user *sect_crs;
75270 int curr_sect;
75271 u32 fragm_no;
75272
75273 @@ -1214,7 +1214,7 @@ again:
75274
75275 if (!sect_rest) {
75276 sect_rest = msg_sect[++curr_sect].iov_len;
75277 - sect_crs = (const unchar *)msg_sect[curr_sect].iov_base;
75278 + sect_crs = (const unchar __user *)msg_sect[curr_sect].iov_base;
75279 }
75280
75281 if (sect_rest < fragm_rest)
75282 @@ -1233,7 +1233,7 @@ error:
75283 }
75284 } else
75285 skb_copy_to_linear_data_offset(buf, fragm_crs,
75286 - sect_crs, sz);
75287 + (const void __force_kernel *)sect_crs, sz);
75288 sect_crs += sz;
75289 sect_rest -= sz;
75290 fragm_crs += sz;
75291 diff -urNp linux-3.0.8/net/tipc/msg.c linux-3.0.8/net/tipc/msg.c
75292 --- linux-3.0.8/net/tipc/msg.c 2011-07-21 22:17:23.000000000 -0400
75293 +++ linux-3.0.8/net/tipc/msg.c 2011-10-06 04:17:55.000000000 -0400
75294 @@ -101,7 +101,7 @@ int tipc_msg_build(struct tipc_msg *hdr,
75295 msg_sect[cnt].iov_len);
75296 else
75297 skb_copy_to_linear_data_offset(*buf, pos,
75298 - msg_sect[cnt].iov_base,
75299 + (const void __force_kernel *)msg_sect[cnt].iov_base,
75300 msg_sect[cnt].iov_len);
75301 pos += msg_sect[cnt].iov_len;
75302 }
75303 diff -urNp linux-3.0.8/net/tipc/subscr.c linux-3.0.8/net/tipc/subscr.c
75304 --- linux-3.0.8/net/tipc/subscr.c 2011-07-21 22:17:23.000000000 -0400
75305 +++ linux-3.0.8/net/tipc/subscr.c 2011-10-06 04:17:55.000000000 -0400
75306 @@ -101,7 +101,7 @@ static void subscr_send_event(struct sub
75307 {
75308 struct iovec msg_sect;
75309
75310 - msg_sect.iov_base = (void *)&sub->evt;
75311 + msg_sect.iov_base = (void __force_user *)&sub->evt;
75312 msg_sect.iov_len = sizeof(struct tipc_event);
75313
75314 sub->evt.event = htohl(event, sub->swap);
75315 diff -urNp linux-3.0.8/net/unix/af_unix.c linux-3.0.8/net/unix/af_unix.c
75316 --- linux-3.0.8/net/unix/af_unix.c 2011-07-21 22:17:23.000000000 -0400
75317 +++ linux-3.0.8/net/unix/af_unix.c 2011-08-23 21:48:14.000000000 -0400
75318 @@ -767,6 +767,12 @@ static struct sock *unix_find_other(stru
75319 err = -ECONNREFUSED;
75320 if (!S_ISSOCK(inode->i_mode))
75321 goto put_fail;
75322 +
75323 + if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
75324 + err = -EACCES;
75325 + goto put_fail;
75326 + }
75327 +
75328 u = unix_find_socket_byinode(inode);
75329 if (!u)
75330 goto put_fail;
75331 @@ -787,6 +793,13 @@ static struct sock *unix_find_other(stru
75332 if (u) {
75333 struct dentry *dentry;
75334 dentry = unix_sk(u)->dentry;
75335 +
75336 + if (!gr_handle_chroot_unix(pid_vnr(u->sk_peer_pid))) {
75337 + err = -EPERM;
75338 + sock_put(u);
75339 + goto fail;
75340 + }
75341 +
75342 if (dentry)
75343 touch_atime(unix_sk(u)->mnt, dentry);
75344 } else
75345 @@ -872,11 +885,18 @@ static int unix_bind(struct socket *sock
75346 err = security_path_mknod(&nd.path, dentry, mode, 0);
75347 if (err)
75348 goto out_mknod_drop_write;
75349 + if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
75350 + err = -EACCES;
75351 + goto out_mknod_drop_write;
75352 + }
75353 err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
75354 out_mknod_drop_write:
75355 mnt_drop_write(nd.path.mnt);
75356 if (err)
75357 goto out_mknod_dput;
75358 +
75359 + gr_handle_create(dentry, nd.path.mnt);
75360 +
75361 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
75362 dput(nd.path.dentry);
75363 nd.path.dentry = dentry;
75364 diff -urNp linux-3.0.8/net/wireless/core.h linux-3.0.8/net/wireless/core.h
75365 --- linux-3.0.8/net/wireless/core.h 2011-07-21 22:17:23.000000000 -0400
75366 +++ linux-3.0.8/net/wireless/core.h 2011-08-23 21:47:56.000000000 -0400
75367 @@ -27,7 +27,7 @@ struct cfg80211_registered_device {
75368 struct mutex mtx;
75369
75370 /* rfkill support */
75371 - struct rfkill_ops rfkill_ops;
75372 + rfkill_ops_no_const rfkill_ops;
75373 struct rfkill *rfkill;
75374 struct work_struct rfkill_sync;
75375
75376 diff -urNp linux-3.0.8/net/wireless/wext-core.c linux-3.0.8/net/wireless/wext-core.c
75377 --- linux-3.0.8/net/wireless/wext-core.c 2011-07-21 22:17:23.000000000 -0400
75378 +++ linux-3.0.8/net/wireless/wext-core.c 2011-08-23 21:47:56.000000000 -0400
75379 @@ -746,8 +746,7 @@ static int ioctl_standard_iw_point(struc
75380 */
75381
75382 /* Support for very large requests */
75383 - if ((descr->flags & IW_DESCR_FLAG_NOMAX) &&
75384 - (user_length > descr->max_tokens)) {
75385 + if (user_length > descr->max_tokens) {
75386 /* Allow userspace to GET more than max so
75387 * we can support any size GET requests.
75388 * There is still a limit : -ENOMEM.
75389 @@ -784,22 +783,6 @@ static int ioctl_standard_iw_point(struc
75390 }
75391 }
75392
75393 - if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) {
75394 - /*
75395 - * If this is a GET, but not NOMAX, it means that the extra
75396 - * data is not bounded by userspace, but by max_tokens. Thus
75397 - * set the length to max_tokens. This matches the extra data
75398 - * allocation.
75399 - * The driver should fill it with the number of tokens it
75400 - * provided, and it may check iwp->length rather than having
75401 - * knowledge of max_tokens. If the driver doesn't change the
75402 - * iwp->length, this ioctl just copies back max_token tokens
75403 - * filled with zeroes. Hopefully the driver isn't claiming
75404 - * them to be valid data.
75405 - */
75406 - iwp->length = descr->max_tokens;
75407 - }
75408 -
75409 err = handler(dev, info, (union iwreq_data *) iwp, extra);
75410
75411 iwp->length += essid_compat;
75412 diff -urNp linux-3.0.8/net/xfrm/xfrm_policy.c linux-3.0.8/net/xfrm/xfrm_policy.c
75413 --- linux-3.0.8/net/xfrm/xfrm_policy.c 2011-07-21 22:17:23.000000000 -0400
75414 +++ linux-3.0.8/net/xfrm/xfrm_policy.c 2011-08-23 21:47:56.000000000 -0400
75415 @@ -299,7 +299,7 @@ static void xfrm_policy_kill(struct xfrm
75416 {
75417 policy->walk.dead = 1;
75418
75419 - atomic_inc(&policy->genid);
75420 + atomic_inc_unchecked(&policy->genid);
75421
75422 if (del_timer(&policy->timer))
75423 xfrm_pol_put(policy);
75424 @@ -583,7 +583,7 @@ int xfrm_policy_insert(int dir, struct x
75425 hlist_add_head(&policy->bydst, chain);
75426 xfrm_pol_hold(policy);
75427 net->xfrm.policy_count[dir]++;
75428 - atomic_inc(&flow_cache_genid);
75429 + atomic_inc_unchecked(&flow_cache_genid);
75430 if (delpol)
75431 __xfrm_policy_unlink(delpol, dir);
75432 policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
75433 @@ -1528,7 +1528,7 @@ free_dst:
75434 goto out;
75435 }
75436
75437 -static int inline
75438 +static inline int
75439 xfrm_dst_alloc_copy(void **target, const void *src, int size)
75440 {
75441 if (!*target) {
75442 @@ -1540,7 +1540,7 @@ xfrm_dst_alloc_copy(void **target, const
75443 return 0;
75444 }
75445
75446 -static int inline
75447 +static inline int
75448 xfrm_dst_update_parent(struct dst_entry *dst, const struct xfrm_selector *sel)
75449 {
75450 #ifdef CONFIG_XFRM_SUB_POLICY
75451 @@ -1552,7 +1552,7 @@ xfrm_dst_update_parent(struct dst_entry
75452 #endif
75453 }
75454
75455 -static int inline
75456 +static inline int
75457 xfrm_dst_update_origin(struct dst_entry *dst, const struct flowi *fl)
75458 {
75459 #ifdef CONFIG_XFRM_SUB_POLICY
75460 @@ -1646,7 +1646,7 @@ xfrm_resolve_and_create_bundle(struct xf
75461
75462 xdst->num_pols = num_pols;
75463 memcpy(xdst->pols, pols, sizeof(struct xfrm_policy*) * num_pols);
75464 - xdst->policy_genid = atomic_read(&pols[0]->genid);
75465 + xdst->policy_genid = atomic_read_unchecked(&pols[0]->genid);
75466
75467 return xdst;
75468 }
75469 @@ -2333,7 +2333,7 @@ static int xfrm_bundle_ok(struct xfrm_ds
75470 if (xdst->xfrm_genid != dst->xfrm->genid)
75471 return 0;
75472 if (xdst->num_pols > 0 &&
75473 - xdst->policy_genid != atomic_read(&xdst->pols[0]->genid))
75474 + xdst->policy_genid != atomic_read_unchecked(&xdst->pols[0]->genid))
75475 return 0;
75476
75477 mtu = dst_mtu(dst->child);
75478 @@ -2861,7 +2861,7 @@ static int xfrm_policy_migrate(struct xf
75479 sizeof(pol->xfrm_vec[i].saddr));
75480 pol->xfrm_vec[i].encap_family = mp->new_family;
75481 /* flush bundles */
75482 - atomic_inc(&pol->genid);
75483 + atomic_inc_unchecked(&pol->genid);
75484 }
75485 }
75486
75487 diff -urNp linux-3.0.8/net/xfrm/xfrm_user.c linux-3.0.8/net/xfrm/xfrm_user.c
75488 --- linux-3.0.8/net/xfrm/xfrm_user.c 2011-07-21 22:17:23.000000000 -0400
75489 +++ linux-3.0.8/net/xfrm/xfrm_user.c 2011-08-23 21:48:14.000000000 -0400
75490 @@ -1394,6 +1394,8 @@ static int copy_to_user_tmpl(struct xfrm
75491 struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
75492 int i;
75493
75494 + pax_track_stack();
75495 +
75496 if (xp->xfrm_nr == 0)
75497 return 0;
75498
75499 @@ -2062,6 +2064,8 @@ static int xfrm_do_migrate(struct sk_buf
75500 int err;
75501 int n = 0;
75502
75503 + pax_track_stack();
75504 +
75505 if (attrs[XFRMA_MIGRATE] == NULL)
75506 return -EINVAL;
75507
75508 diff -urNp linux-3.0.8/scripts/basic/fixdep.c linux-3.0.8/scripts/basic/fixdep.c
75509 --- linux-3.0.8/scripts/basic/fixdep.c 2011-07-21 22:17:23.000000000 -0400
75510 +++ linux-3.0.8/scripts/basic/fixdep.c 2011-10-06 04:17:55.000000000 -0400
75511 @@ -161,7 +161,7 @@ static unsigned int strhash(const char *
75512 /*
75513 * Lookup a value in the configuration string.
75514 */
75515 -static int is_defined_config(const char *name, int len, unsigned int hash)
75516 +static int is_defined_config(const char *name, unsigned int len, unsigned int hash)
75517 {
75518 struct item *aux;
75519
75520 @@ -211,10 +211,10 @@ static void clear_config(void)
75521 /*
75522 * Record the use of a CONFIG_* word.
75523 */
75524 -static void use_config(const char *m, int slen)
75525 +static void use_config(const char *m, unsigned int slen)
75526 {
75527 unsigned int hash = strhash(m, slen);
75528 - int c, i;
75529 + unsigned int c, i;
75530
75531 if (is_defined_config(m, slen, hash))
75532 return;
75533 @@ -235,9 +235,9 @@ static void use_config(const char *m, in
75534
75535 static void parse_config_file(const char *map, size_t len)
75536 {
75537 - const int *end = (const int *) (map + len);
75538 + const unsigned int *end = (const unsigned int *) (map + len);
75539 /* start at +1, so that p can never be < map */
75540 - const int *m = (const int *) map + 1;
75541 + const unsigned int *m = (const unsigned int *) map + 1;
75542 const char *p, *q;
75543
75544 for (; m < end; m++) {
75545 @@ -405,7 +405,7 @@ static void print_deps(void)
75546 static void traps(void)
75547 {
75548 static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
75549 - int *p = (int *)test;
75550 + unsigned int *p = (unsigned int *)test;
75551
75552 if (*p != INT_CONF) {
75553 fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
75554 diff -urNp linux-3.0.8/scripts/gcc-plugin.sh linux-3.0.8/scripts/gcc-plugin.sh
75555 --- linux-3.0.8/scripts/gcc-plugin.sh 1969-12-31 19:00:00.000000000 -0500
75556 +++ linux-3.0.8/scripts/gcc-plugin.sh 2011-09-14 09:08:05.000000000 -0400
75557 @@ -0,0 +1,2 @@
75558 +#!/bin/sh
75559 +echo "#include \"gcc-plugin.h\"\n#include \"rtl.h\"" | $1 -x c -shared - -o /dev/null -I`$2 -print-file-name=plugin`/include >/dev/null 2>&1 && echo "y"
75560 diff -urNp linux-3.0.8/scripts/Makefile.build linux-3.0.8/scripts/Makefile.build
75561 --- linux-3.0.8/scripts/Makefile.build 2011-07-21 22:17:23.000000000 -0400
75562 +++ linux-3.0.8/scripts/Makefile.build 2011-08-23 21:47:56.000000000 -0400
75563 @@ -109,7 +109,7 @@ endif
75564 endif
75565
75566 # Do not include host rules unless needed
75567 -ifneq ($(hostprogs-y)$(hostprogs-m),)
75568 +ifneq ($(hostprogs-y)$(hostprogs-m)$(hostlibs-y)$(hostlibs-m),)
75569 include scripts/Makefile.host
75570 endif
75571
75572 diff -urNp linux-3.0.8/scripts/Makefile.clean linux-3.0.8/scripts/Makefile.clean
75573 --- linux-3.0.8/scripts/Makefile.clean 2011-07-21 22:17:23.000000000 -0400
75574 +++ linux-3.0.8/scripts/Makefile.clean 2011-08-23 21:47:56.000000000 -0400
75575 @@ -43,7 +43,8 @@ subdir-ymn := $(addprefix $(obj)/,$(subd
75576 __clean-files := $(extra-y) $(always) \
75577 $(targets) $(clean-files) \
75578 $(host-progs) \
75579 - $(hostprogs-y) $(hostprogs-m) $(hostprogs-)
75580 + $(hostprogs-y) $(hostprogs-m) $(hostprogs-) \
75581 + $(hostlibs-y) $(hostlibs-m) $(hostlibs-)
75582
75583 __clean-files := $(filter-out $(no-clean-files), $(__clean-files))
75584
75585 diff -urNp linux-3.0.8/scripts/Makefile.host linux-3.0.8/scripts/Makefile.host
75586 --- linux-3.0.8/scripts/Makefile.host 2011-07-21 22:17:23.000000000 -0400
75587 +++ linux-3.0.8/scripts/Makefile.host 2011-08-23 21:47:56.000000000 -0400
75588 @@ -31,6 +31,7 @@
75589 # Note: Shared libraries consisting of C++ files are not supported
75590
75591 __hostprogs := $(sort $(hostprogs-y) $(hostprogs-m))
75592 +__hostlibs := $(sort $(hostlibs-y) $(hostlibs-m))
75593
75594 # C code
75595 # Executables compiled from a single .c file
75596 @@ -54,6 +55,7 @@ host-cxxobjs := $(sort $(foreach m,$(hos
75597 # Shared libaries (only .c supported)
75598 # Shared libraries (.so) - all .so files referenced in "xxx-objs"
75599 host-cshlib := $(sort $(filter %.so, $(host-cobjs)))
75600 +host-cshlib += $(sort $(filter %.so, $(__hostlibs)))
75601 # Remove .so files from "xxx-objs"
75602 host-cobjs := $(filter-out %.so,$(host-cobjs))
75603
75604 diff -urNp linux-3.0.8/scripts/mod/file2alias.c linux-3.0.8/scripts/mod/file2alias.c
75605 --- linux-3.0.8/scripts/mod/file2alias.c 2011-07-21 22:17:23.000000000 -0400
75606 +++ linux-3.0.8/scripts/mod/file2alias.c 2011-10-06 04:17:55.000000000 -0400
75607 @@ -72,7 +72,7 @@ static void device_id_check(const char *
75608 unsigned long size, unsigned long id_size,
75609 void *symval)
75610 {
75611 - int i;
75612 + unsigned int i;
75613
75614 if (size % id_size || size < id_size) {
75615 if (cross_build != 0)
75616 @@ -102,7 +102,7 @@ static void device_id_check(const char *
75617 /* USB is special because the bcdDevice can be matched against a numeric range */
75618 /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
75619 static void do_usb_entry(struct usb_device_id *id,
75620 - unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
75621 + unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
75622 unsigned char range_lo, unsigned char range_hi,
75623 unsigned char max, struct module *mod)
75624 {
75625 @@ -203,7 +203,7 @@ static void do_usb_entry_multi(struct us
75626 {
75627 unsigned int devlo, devhi;
75628 unsigned char chi, clo, max;
75629 - int ndigits;
75630 + unsigned int ndigits;
75631
75632 id->match_flags = TO_NATIVE(id->match_flags);
75633 id->idVendor = TO_NATIVE(id->idVendor);
75634 @@ -437,7 +437,7 @@ static void do_pnp_device_entry(void *sy
75635 for (i = 0; i < count; i++) {
75636 const char *id = (char *)devs[i].id;
75637 char acpi_id[sizeof(devs[0].id)];
75638 - int j;
75639 + unsigned int j;
75640
75641 buf_printf(&mod->dev_table_buf,
75642 "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
75643 @@ -467,7 +467,7 @@ static void do_pnp_card_entries(void *sy
75644
75645 for (j = 0; j < PNP_MAX_DEVICES; j++) {
75646 const char *id = (char *)card->devs[j].id;
75647 - int i2, j2;
75648 + unsigned int i2, j2;
75649 int dup = 0;
75650
75651 if (!id[0])
75652 @@ -493,7 +493,7 @@ static void do_pnp_card_entries(void *sy
75653 /* add an individual alias for every device entry */
75654 if (!dup) {
75655 char acpi_id[sizeof(card->devs[0].id)];
75656 - int k;
75657 + unsigned int k;
75658
75659 buf_printf(&mod->dev_table_buf,
75660 "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
75661 @@ -786,7 +786,7 @@ static void dmi_ascii_filter(char *d, co
75662 static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
75663 char *alias)
75664 {
75665 - int i, j;
75666 + unsigned int i, j;
75667
75668 sprintf(alias, "dmi*");
75669
75670 diff -urNp linux-3.0.8/scripts/mod/modpost.c linux-3.0.8/scripts/mod/modpost.c
75671 --- linux-3.0.8/scripts/mod/modpost.c 2011-07-21 22:17:23.000000000 -0400
75672 +++ linux-3.0.8/scripts/mod/modpost.c 2011-08-23 21:47:56.000000000 -0400
75673 @@ -892,6 +892,7 @@ enum mismatch {
75674 ANY_INIT_TO_ANY_EXIT,
75675 ANY_EXIT_TO_ANY_INIT,
75676 EXPORT_TO_INIT_EXIT,
75677 + DATA_TO_TEXT
75678 };
75679
75680 struct sectioncheck {
75681 @@ -1000,6 +1001,12 @@ const struct sectioncheck sectioncheck[]
75682 .tosec = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
75683 .mismatch = EXPORT_TO_INIT_EXIT,
75684 .symbol_white_list = { DEFAULT_SYMBOL_WHITE_LIST, NULL },
75685 +},
75686 +/* Do not reference code from writable data */
75687 +{
75688 + .fromsec = { DATA_SECTIONS, NULL },
75689 + .tosec = { TEXT_SECTIONS, NULL },
75690 + .mismatch = DATA_TO_TEXT
75691 }
75692 };
75693
75694 @@ -1122,10 +1129,10 @@ static Elf_Sym *find_elf_symbol(struct e
75695 continue;
75696 if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
75697 continue;
75698 - if (sym->st_value == addr)
75699 - return sym;
75700 /* Find a symbol nearby - addr are maybe negative */
75701 d = sym->st_value - addr;
75702 + if (d == 0)
75703 + return sym;
75704 if (d < 0)
75705 d = addr - sym->st_value;
75706 if (d < distance) {
75707 @@ -1404,6 +1411,14 @@ static void report_sec_mismatch(const ch
75708 tosym, prl_to, prl_to, tosym);
75709 free(prl_to);
75710 break;
75711 + case DATA_TO_TEXT:
75712 +/*
75713 + fprintf(stderr,
75714 + "The variable %s references\n"
75715 + "the %s %s%s%s\n",
75716 + fromsym, to, sec2annotation(tosec), tosym, to_p);
75717 +*/
75718 + break;
75719 }
75720 fprintf(stderr, "\n");
75721 }
75722 @@ -1629,7 +1644,7 @@ static void section_rel(const char *modn
75723 static void check_sec_ref(struct module *mod, const char *modname,
75724 struct elf_info *elf)
75725 {
75726 - int i;
75727 + unsigned int i;
75728 Elf_Shdr *sechdrs = elf->sechdrs;
75729
75730 /* Walk through all sections */
75731 @@ -1727,7 +1742,7 @@ void __attribute__((format(printf, 2, 3)
75732 va_end(ap);
75733 }
75734
75735 -void buf_write(struct buffer *buf, const char *s, int len)
75736 +void buf_write(struct buffer *buf, const char *s, unsigned int len)
75737 {
75738 if (buf->size - buf->pos < len) {
75739 buf->size += len + SZ;
75740 @@ -1939,7 +1954,7 @@ static void write_if_changed(struct buff
75741 if (fstat(fileno(file), &st) < 0)
75742 goto close_write;
75743
75744 - if (st.st_size != b->pos)
75745 + if (st.st_size != (off_t)b->pos)
75746 goto close_write;
75747
75748 tmp = NOFAIL(malloc(b->pos));
75749 diff -urNp linux-3.0.8/scripts/mod/modpost.h linux-3.0.8/scripts/mod/modpost.h
75750 --- linux-3.0.8/scripts/mod/modpost.h 2011-07-21 22:17:23.000000000 -0400
75751 +++ linux-3.0.8/scripts/mod/modpost.h 2011-08-23 21:47:56.000000000 -0400
75752 @@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *e
75753
75754 struct buffer {
75755 char *p;
75756 - int pos;
75757 - int size;
75758 + unsigned int pos;
75759 + unsigned int size;
75760 };
75761
75762 void __attribute__((format(printf, 2, 3)))
75763 buf_printf(struct buffer *buf, const char *fmt, ...);
75764
75765 void
75766 -buf_write(struct buffer *buf, const char *s, int len);
75767 +buf_write(struct buffer *buf, const char *s, unsigned int len);
75768
75769 struct module {
75770 struct module *next;
75771 diff -urNp linux-3.0.8/scripts/mod/sumversion.c linux-3.0.8/scripts/mod/sumversion.c
75772 --- linux-3.0.8/scripts/mod/sumversion.c 2011-07-21 22:17:23.000000000 -0400
75773 +++ linux-3.0.8/scripts/mod/sumversion.c 2011-08-23 21:47:56.000000000 -0400
75774 @@ -470,7 +470,7 @@ static void write_version(const char *fi
75775 goto out;
75776 }
75777
75778 - if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
75779 + if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
75780 warn("writing sum in %s failed: %s\n",
75781 filename, strerror(errno));
75782 goto out;
75783 diff -urNp linux-3.0.8/scripts/pnmtologo.c linux-3.0.8/scripts/pnmtologo.c
75784 --- linux-3.0.8/scripts/pnmtologo.c 2011-07-21 22:17:23.000000000 -0400
75785 +++ linux-3.0.8/scripts/pnmtologo.c 2011-08-23 21:47:56.000000000 -0400
75786 @@ -237,14 +237,14 @@ static void write_header(void)
75787 fprintf(out, " * Linux logo %s\n", logoname);
75788 fputs(" */\n\n", out);
75789 fputs("#include <linux/linux_logo.h>\n\n", out);
75790 - fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
75791 + fprintf(out, "static unsigned char %s_data[] = {\n",
75792 logoname);
75793 }
75794
75795 static void write_footer(void)
75796 {
75797 fputs("\n};\n\n", out);
75798 - fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
75799 + fprintf(out, "const struct linux_logo %s = {\n", logoname);
75800 fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
75801 fprintf(out, "\t.width\t\t= %d,\n", logo_width);
75802 fprintf(out, "\t.height\t\t= %d,\n", logo_height);
75803 @@ -374,7 +374,7 @@ static void write_logo_clut224(void)
75804 fputs("\n};\n\n", out);
75805
75806 /* write logo clut */
75807 - fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
75808 + fprintf(out, "static unsigned char %s_clut[] = {\n",
75809 logoname);
75810 write_hex_cnt = 0;
75811 for (i = 0; i < logo_clutsize; i++) {
75812 diff -urNp linux-3.0.8/security/apparmor/lsm.c linux-3.0.8/security/apparmor/lsm.c
75813 --- linux-3.0.8/security/apparmor/lsm.c 2011-10-24 08:05:21.000000000 -0400
75814 +++ linux-3.0.8/security/apparmor/lsm.c 2011-08-23 21:48:14.000000000 -0400
75815 @@ -621,7 +621,7 @@ static int apparmor_task_setrlimit(struc
75816 return error;
75817 }
75818
75819 -static struct security_operations apparmor_ops = {
75820 +static struct security_operations apparmor_ops __read_only = {
75821 .name = "apparmor",
75822
75823 .ptrace_access_check = apparmor_ptrace_access_check,
75824 diff -urNp linux-3.0.8/security/commoncap.c linux-3.0.8/security/commoncap.c
75825 --- linux-3.0.8/security/commoncap.c 2011-07-21 22:17:23.000000000 -0400
75826 +++ linux-3.0.8/security/commoncap.c 2011-08-23 21:48:14.000000000 -0400
75827 @@ -28,6 +28,7 @@
75828 #include <linux/prctl.h>
75829 #include <linux/securebits.h>
75830 #include <linux/user_namespace.h>
75831 +#include <net/sock.h>
75832
75833 /*
75834 * If a non-root user executes a setuid-root binary in
75835 @@ -58,7 +59,7 @@ int cap_netlink_send(struct sock *sk, st
75836
75837 int cap_netlink_recv(struct sk_buff *skb, int cap)
75838 {
75839 - if (!cap_raised(current_cap(), cap))
75840 + if (!cap_raised(current_cap(), cap) || !gr_is_capable(cap))
75841 return -EPERM;
75842 return 0;
75843 }
75844 @@ -575,6 +576,9 @@ int cap_bprm_secureexec(struct linux_bin
75845 {
75846 const struct cred *cred = current_cred();
75847
75848 + if (gr_acl_enable_at_secure())
75849 + return 1;
75850 +
75851 if (cred->uid != 0) {
75852 if (bprm->cap_effective)
75853 return 1;
75854 diff -urNp linux-3.0.8/security/integrity/ima/ima_api.c linux-3.0.8/security/integrity/ima/ima_api.c
75855 --- linux-3.0.8/security/integrity/ima/ima_api.c 2011-07-21 22:17:23.000000000 -0400
75856 +++ linux-3.0.8/security/integrity/ima/ima_api.c 2011-08-23 21:47:56.000000000 -0400
75857 @@ -75,7 +75,7 @@ void ima_add_violation(struct inode *ino
75858 int result;
75859
75860 /* can overflow, only indicator */
75861 - atomic_long_inc(&ima_htable.violations);
75862 + atomic_long_inc_unchecked(&ima_htable.violations);
75863
75864 entry = kmalloc(sizeof(*entry), GFP_KERNEL);
75865 if (!entry) {
75866 diff -urNp linux-3.0.8/security/integrity/ima/ima_fs.c linux-3.0.8/security/integrity/ima/ima_fs.c
75867 --- linux-3.0.8/security/integrity/ima/ima_fs.c 2011-07-21 22:17:23.000000000 -0400
75868 +++ linux-3.0.8/security/integrity/ima/ima_fs.c 2011-08-23 21:47:56.000000000 -0400
75869 @@ -28,12 +28,12 @@
75870 static int valid_policy = 1;
75871 #define TMPBUFLEN 12
75872 static ssize_t ima_show_htable_value(char __user *buf, size_t count,
75873 - loff_t *ppos, atomic_long_t *val)
75874 + loff_t *ppos, atomic_long_unchecked_t *val)
75875 {
75876 char tmpbuf[TMPBUFLEN];
75877 ssize_t len;
75878
75879 - len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
75880 + len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
75881 return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
75882 }
75883
75884 diff -urNp linux-3.0.8/security/integrity/ima/ima.h linux-3.0.8/security/integrity/ima/ima.h
75885 --- linux-3.0.8/security/integrity/ima/ima.h 2011-07-21 22:17:23.000000000 -0400
75886 +++ linux-3.0.8/security/integrity/ima/ima.h 2011-08-23 21:47:56.000000000 -0400
75887 @@ -85,8 +85,8 @@ void ima_add_violation(struct inode *ino
75888 extern spinlock_t ima_queue_lock;
75889
75890 struct ima_h_table {
75891 - atomic_long_t len; /* number of stored measurements in the list */
75892 - atomic_long_t violations;
75893 + atomic_long_unchecked_t len; /* number of stored measurements in the list */
75894 + atomic_long_unchecked_t violations;
75895 struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
75896 };
75897 extern struct ima_h_table ima_htable;
75898 diff -urNp linux-3.0.8/security/integrity/ima/ima_queue.c linux-3.0.8/security/integrity/ima/ima_queue.c
75899 --- linux-3.0.8/security/integrity/ima/ima_queue.c 2011-07-21 22:17:23.000000000 -0400
75900 +++ linux-3.0.8/security/integrity/ima/ima_queue.c 2011-08-23 21:47:56.000000000 -0400
75901 @@ -79,7 +79,7 @@ static int ima_add_digest_entry(struct i
75902 INIT_LIST_HEAD(&qe->later);
75903 list_add_tail_rcu(&qe->later, &ima_measurements);
75904
75905 - atomic_long_inc(&ima_htable.len);
75906 + atomic_long_inc_unchecked(&ima_htable.len);
75907 key = ima_hash_key(entry->digest);
75908 hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
75909 return 0;
75910 diff -urNp linux-3.0.8/security/Kconfig linux-3.0.8/security/Kconfig
75911 --- linux-3.0.8/security/Kconfig 2011-07-21 22:17:23.000000000 -0400
75912 +++ linux-3.0.8/security/Kconfig 2011-10-06 04:19:25.000000000 -0400
75913 @@ -4,6 +4,558 @@
75914
75915 menu "Security options"
75916
75917 +source grsecurity/Kconfig
75918 +
75919 +menu "PaX"
75920 +
75921 + config ARCH_TRACK_EXEC_LIMIT
75922 + bool
75923 +
75924 + config PAX_KERNEXEC_PLUGIN
75925 + bool
75926 +
75927 + config PAX_PER_CPU_PGD
75928 + bool
75929 +
75930 + config TASK_SIZE_MAX_SHIFT
75931 + int
75932 + depends on X86_64
75933 + default 47 if !PAX_PER_CPU_PGD
75934 + default 42 if PAX_PER_CPU_PGD
75935 +
75936 + config PAX_ENABLE_PAE
75937 + bool
75938 + default y if (X86_32 && (MPENTIUM4 || MK8 || MPSC || MCORE2 || MATOM))
75939 +
75940 +config PAX
75941 + bool "Enable various PaX features"
75942 + depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS || PARISC || PPC || SPARC || X86)
75943 + help
75944 + This allows you to enable various PaX features. PaX adds
75945 + intrusion prevention mechanisms to the kernel that reduce
75946 + the risks posed by exploitable memory corruption bugs.
75947 +
75948 +menu "PaX Control"
75949 + depends on PAX
75950 +
75951 +config PAX_SOFTMODE
75952 + bool 'Support soft mode'
75953 + select PAX_PT_PAX_FLAGS
75954 + help
75955 + Enabling this option will allow you to run PaX in soft mode, that
75956 + is, PaX features will not be enforced by default, only on executables
75957 + marked explicitly. You must also enable PT_PAX_FLAGS support as it
75958 + is the only way to mark executables for soft mode use.
75959 +
75960 + Soft mode can be activated by using the "pax_softmode=1" kernel command
75961 + line option on boot. Furthermore you can control various PaX features
75962 + at runtime via the entries in /proc/sys/kernel/pax.
75963 +
75964 +config PAX_EI_PAX
75965 + bool 'Use legacy ELF header marking'
75966 + help
75967 + Enabling this option will allow you to control PaX features on
75968 + a per executable basis via the 'chpax' utility available at
75969 + http://pax.grsecurity.net/. The control flags will be read from
75970 + an otherwise reserved part of the ELF header. This marking has
75971 + numerous drawbacks (no support for soft-mode, toolchain does not
75972 + know about the non-standard use of the ELF header) therefore it
75973 + has been deprecated in favour of PT_PAX_FLAGS support.
75974 +
75975 + Note that if you enable PT_PAX_FLAGS marking support as well,
75976 + the PT_PAX_FLAG marks will override the legacy EI_PAX marks.
75977 +
75978 +config PAX_PT_PAX_FLAGS
75979 + bool 'Use ELF program header marking'
75980 + help
75981 + Enabling this option will allow you to control PaX features on
75982 + a per executable basis via the 'paxctl' utility available at
75983 + http://pax.grsecurity.net/. The control flags will be read from
75984 + a PaX specific ELF program header (PT_PAX_FLAGS). This marking
75985 + has the benefits of supporting both soft mode and being fully
75986 + integrated into the toolchain (the binutils patch is available
75987 + from http://pax.grsecurity.net).
75988 +
75989 + If your toolchain does not support PT_PAX_FLAGS markings,
75990 + you can create one in most cases with 'paxctl -C'.
75991 +
75992 + Note that if you enable the legacy EI_PAX marking support as well,
75993 + the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
75994 +
75995 +choice
75996 + prompt 'MAC system integration'
75997 + default PAX_HAVE_ACL_FLAGS
75998 + help
75999 + Mandatory Access Control systems have the option of controlling
76000 + PaX flags on a per executable basis, choose the method supported
76001 + by your particular system.
76002 +
76003 + - "none": if your MAC system does not interact with PaX,
76004 + - "direct": if your MAC system defines pax_set_initial_flags() itself,
76005 + - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
76006 +
76007 + NOTE: this option is for developers/integrators only.
76008 +
76009 + config PAX_NO_ACL_FLAGS
76010 + bool 'none'
76011 +
76012 + config PAX_HAVE_ACL_FLAGS
76013 + bool 'direct'
76014 +
76015 + config PAX_HOOK_ACL_FLAGS
76016 + bool 'hook'
76017 +endchoice
76018 +
76019 +endmenu
76020 +
76021 +menu "Non-executable pages"
76022 + depends on PAX
76023 +
76024 +config PAX_NOEXEC
76025 + bool "Enforce non-executable pages"
76026 + depends on (PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS) && (ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86)
76027 + help
76028 + By design some architectures do not allow for protecting memory
76029 + pages against execution or even if they do, Linux does not make
76030 + use of this feature. In practice this means that if a page is
76031 + readable (such as the stack or heap) it is also executable.
76032 +
76033 + There is a well known exploit technique that makes use of this
76034 + fact and a common programming mistake where an attacker can
76035 + introduce code of his choice somewhere in the attacked program's
76036 + memory (typically the stack or the heap) and then execute it.
76037 +
76038 + If the attacked program was running with different (typically
76039 + higher) privileges than that of the attacker, then he can elevate
76040 + his own privilege level (e.g. get a root shell, write to files for
76041 + which he does not have write access to, etc).
76042 +
76043 + Enabling this option will let you choose from various features
76044 + that prevent the injection and execution of 'foreign' code in
76045 + a program.
76046 +
76047 + This will also break programs that rely on the old behaviour and
76048 + expect that dynamically allocated memory via the malloc() family
76049 + of functions is executable (which it is not). Notable examples
76050 + are the XFree86 4.x server, the java runtime and wine.
76051 +
76052 +config PAX_PAGEEXEC
76053 + bool "Paging based non-executable pages"
76054 + depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MATOM || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
76055 + select S390_SWITCH_AMODE if S390
76056 + select S390_EXEC_PROTECT if S390
76057 + select ARCH_TRACK_EXEC_LIMIT if X86_32
76058 + help
76059 + This implementation is based on the paging feature of the CPU.
76060 + On i386 without hardware non-executable bit support there is a
76061 + variable but usually low performance impact, however on Intel's
76062 + P4 core based CPUs it is very high so you should not enable this
76063 + for kernels meant to be used on such CPUs.
76064 +
76065 + On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
76066 + with hardware non-executable bit support there is no performance
76067 + impact, on ppc the impact is negligible.
76068 +
76069 + Note that several architectures require various emulations due to
76070 + badly designed userland ABIs, this will cause a performance impact
76071 + but will disappear as soon as userland is fixed. For example, ppc
76072 + userland MUST have been built with secure-plt by a recent toolchain.
76073 +
76074 +config PAX_SEGMEXEC
76075 + bool "Segmentation based non-executable pages"
76076 + depends on PAX_NOEXEC && X86_32
76077 + help
76078 + This implementation is based on the segmentation feature of the
76079 + CPU and has a very small performance impact, however applications
76080 + will be limited to a 1.5 GB address space instead of the normal
76081 + 3 GB.
76082 +
76083 +config PAX_EMUTRAMP
76084 + bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
76085 + default y if PARISC
76086 + help
76087 + There are some programs and libraries that for one reason or
76088 + another attempt to execute special small code snippets from
76089 + non-executable memory pages. Most notable examples are the
76090 + signal handler return code generated by the kernel itself and
76091 + the GCC trampolines.
76092 +
76093 + If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
76094 + such programs will no longer work under your kernel.
76095 +
76096 + As a remedy you can say Y here and use the 'chpax' or 'paxctl'
76097 + utilities to enable trampoline emulation for the affected programs
76098 + yet still have the protection provided by the non-executable pages.
76099 +
76100 + On parisc you MUST enable this option and EMUSIGRT as well, otherwise
76101 + your system will not even boot.
76102 +
76103 + Alternatively you can say N here and use the 'chpax' or 'paxctl'
76104 + utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
76105 + for the affected files.
76106 +
76107 + NOTE: enabling this feature *may* open up a loophole in the
76108 + protection provided by non-executable pages that an attacker
76109 + could abuse. Therefore the best solution is to not have any
76110 + files on your system that would require this option. This can
76111 + be achieved by not using libc5 (which relies on the kernel
76112 + signal handler return code) and not using or rewriting programs
76113 + that make use of the nested function implementation of GCC.
76114 + Skilled users can just fix GCC itself so that it implements
76115 + nested function calls in a way that does not interfere with PaX.
76116 +
76117 +config PAX_EMUSIGRT
76118 + bool "Automatically emulate sigreturn trampolines"
76119 + depends on PAX_EMUTRAMP && PARISC
76120 + default y
76121 + help
76122 + Enabling this option will have the kernel automatically detect
76123 + and emulate signal return trampolines executing on the stack
76124 + that would otherwise lead to task termination.
76125 +
76126 + This solution is intended as a temporary one for users with
76127 + legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
76128 + Modula-3 runtime, etc) or executables linked to such, basically
76129 + everything that does not specify its own SA_RESTORER function in
76130 + normal executable memory like glibc 2.1+ does.
76131 +
76132 + On parisc you MUST enable this option, otherwise your system will
76133 + not even boot.
76134 +
76135 + NOTE: this feature cannot be disabled on a per executable basis
76136 + and since it *does* open up a loophole in the protection provided
76137 + by non-executable pages, the best solution is to not have any
76138 + files on your system that would require this option.
76139 +
76140 +config PAX_MPROTECT
76141 + bool "Restrict mprotect()"
76142 + depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
76143 + help
76144 + Enabling this option will prevent programs from
76145 + - changing the executable status of memory pages that were
76146 + not originally created as executable,
76147 + - making read-only executable pages writable again,
76148 + - creating executable pages from anonymous memory,
76149 + - making read-only-after-relocations (RELRO) data pages writable again.
76150 +
76151 + You should say Y here to complete the protection provided by
76152 + the enforcement of non-executable pages.
76153 +
76154 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control
76155 + this feature on a per file basis.
76156 +
76157 +config PAX_MPROTECT_COMPAT
76158 + bool "Use legacy/compat protection demoting (read help)"
76159 + depends on PAX_MPROTECT
76160 + default n
76161 + help
76162 + The current implementation of PAX_MPROTECT denies RWX allocations/mprotects
76163 + by sending the proper error code to the application. For some broken
76164 + userland, this can cause problems with Python or other applications. The
76165 + current implementation however allows for applications like clamav to
76166 + detect if JIT compilation/execution is allowed and to fall back gracefully
76167 + to an interpreter-based mode if it does not. While we encourage everyone
76168 + to use the current implementation as-is and push upstream to fix broken
76169 + userland (note that the RWX logging option can assist with this), in some
76170 + environments this may not be possible. Having to disable MPROTECT
76171 + completely on certain binaries reduces the security benefit of PaX,
76172 + so this option is provided for those environments to revert to the old
76173 + behavior.
76174 +
76175 +config PAX_ELFRELOCS
76176 + bool "Allow ELF text relocations (read help)"
76177 + depends on PAX_MPROTECT
76178 + default n
76179 + help
76180 + Non-executable pages and mprotect() restrictions are effective
76181 + in preventing the introduction of new executable code into an
76182 + attacked task's address space. There remain only two venues
76183 + for this kind of attack: if the attacker can execute already
76184 + existing code in the attacked task then he can either have it
76185 + create and mmap() a file containing his code or have it mmap()
76186 + an already existing ELF library that does not have position
76187 + independent code in it and use mprotect() on it to make it
76188 + writable and copy his code there. While protecting against
76189 + the former approach is beyond PaX, the latter can be prevented
76190 + by having only PIC ELF libraries on one's system (which do not
76191 + need to relocate their code). If you are sure this is your case,
76192 + as is the case with all modern Linux distributions, then leave
76193 + this option disabled. You should say 'n' here.
76194 +
76195 +config PAX_ETEXECRELOCS
76196 + bool "Allow ELF ET_EXEC text relocations"
76197 + depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
76198 + select PAX_ELFRELOCS
76199 + default y
76200 + help
76201 + On some architectures there are incorrectly created applications
76202 + that require text relocations and would not work without enabling
76203 + this option. If you are an alpha, ia64 or parisc user, you should
76204 + enable this option and disable it once you have made sure that
76205 + none of your applications need it.
76206 +
76207 +config PAX_EMUPLT
76208 + bool "Automatically emulate ELF PLT"
76209 + depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
76210 + default y
76211 + help
76212 + Enabling this option will have the kernel automatically detect
76213 + and emulate the Procedure Linkage Table entries in ELF files.
76214 + On some architectures such entries are in writable memory, and
76215 + become non-executable leading to task termination. Therefore
76216 + it is mandatory that you enable this option on alpha, parisc,
76217 + sparc and sparc64, otherwise your system would not even boot.
76218 +
76219 + NOTE: this feature *does* open up a loophole in the protection
76220 + provided by the non-executable pages, therefore the proper
76221 + solution is to modify the toolchain to produce a PLT that does
76222 + not need to be writable.
76223 +
76224 +config PAX_DLRESOLVE
76225 + bool 'Emulate old glibc resolver stub'
76226 + depends on PAX_EMUPLT && SPARC
76227 + default n
76228 + help
76229 + This option is needed if userland has an old glibc (before 2.4)
76230 + that puts a 'save' instruction into the runtime generated resolver
76231 + stub that needs special emulation.
76232 +
76233 +config PAX_KERNEXEC
76234 + bool "Enforce non-executable kernel pages"
76235 + depends on (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN
76236 + select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
76237 + select PAX_KERNEXEC_PLUGIN if X86_64
76238 + help
76239 + This is the kernel land equivalent of PAGEEXEC and MPROTECT,
76240 + that is, enabling this option will make it harder to inject
76241 + and execute 'foreign' code in kernel memory itself.
76242 +
76243 + Note that on x86_64 kernels there is a known regression when
76244 + this feature and KVM/VMX are both enabled in the host kernel.
76245 +
76246 +config PAX_KERNEXEC_MODULE_TEXT
76247 + int "Minimum amount of memory reserved for module code"
76248 + default "4"
76249 + depends on PAX_KERNEXEC && X86_32 && MODULES
76250 + help
76251 + Due to implementation details the kernel must reserve a fixed
76252 + amount of memory for module code at compile time that cannot be
76253 + changed at runtime. Here you can specify the minimum amount
76254 + in MB that will be reserved. Due to the same implementation
76255 + details this size will always be rounded up to the next 2/4 MB
76256 + boundary (depends on PAE) so the actually available memory for
76257 + module code will usually be more than this minimum.
76258 +
76259 + The default 4 MB should be enough for most users but if you have
76260 + an excessive number of modules (e.g., most distribution configs
76261 + compile many drivers as modules) or use huge modules such as
76262 + nvidia's kernel driver, you will need to adjust this amount.
76263 + A good rule of thumb is to look at your currently loaded kernel
76264 + modules and add up their sizes.
76265 +
76266 +endmenu
76267 +
76268 +menu "Address Space Layout Randomization"
76269 + depends on PAX
76270 +
76271 +config PAX_ASLR
76272 + bool "Address Space Layout Randomization"
76273 + depends on PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS
76274 + help
76275 + Many if not most exploit techniques rely on the knowledge of
76276 + certain addresses in the attacked program. The following options
76277 + will allow the kernel to apply a certain amount of randomization
76278 + to specific parts of the program thereby forcing an attacker to
76279 + guess them in most cases. Any failed guess will most likely crash
76280 + the attacked program which allows the kernel to detect such attempts
76281 + and react on them. PaX itself provides no reaction mechanisms,
76282 + instead it is strongly encouraged that you make use of Nergal's
76283 + segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
76284 + (http://www.grsecurity.net/) built-in crash detection features or
76285 + develop one yourself.
76286 +
76287 + By saying Y here you can choose to randomize the following areas:
76288 + - top of the task's kernel stack
76289 + - top of the task's userland stack
76290 + - base address for mmap() requests that do not specify one
76291 + (this includes all libraries)
76292 + - base address of the main executable
76293 +
76294 + It is strongly recommended to say Y here as address space layout
76295 + randomization has negligible impact on performance yet it provides
76296 + a very effective protection.
76297 +
76298 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control
76299 + this feature on a per file basis.
76300 +
76301 +config PAX_RANDKSTACK
76302 + bool "Randomize kernel stack base"
76303 + depends on X86_TSC && X86
76304 + help
76305 + By saying Y here the kernel will randomize every task's kernel
76306 + stack on every system call. This will not only force an attacker
76307 + to guess it but also prevent him from making use of possible
76308 + leaked information about it.
76309 +
76310 + Since the kernel stack is a rather scarce resource, randomization
76311 + may cause unexpected stack overflows, therefore you should very
76312 + carefully test your system. Note that once enabled in the kernel
76313 + configuration, this feature cannot be disabled on a per file basis.
76314 +
76315 +config PAX_RANDUSTACK
76316 + bool "Randomize user stack base"
76317 + depends on PAX_ASLR
76318 + help
76319 + By saying Y here the kernel will randomize every task's userland
76320 + stack. The randomization is done in two steps where the second
76321 + one may apply a big amount of shift to the top of the stack and
76322 + cause problems for programs that want to use lots of memory (more
76323 + than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
76324 + For this reason the second step can be controlled by 'chpax' or
76325 + 'paxctl' on a per file basis.
76326 +
76327 +config PAX_RANDMMAP
76328 + bool "Randomize mmap() base"
76329 + depends on PAX_ASLR
76330 + help
76331 + By saying Y here the kernel will use a randomized base address for
76332 + mmap() requests that do not specify one themselves. As a result
76333 + all dynamically loaded libraries will appear at random addresses
76334 + and therefore be harder to exploit by a technique where an attacker
76335 + attempts to execute library code for his purposes (e.g. spawn a
76336 + shell from an exploited program that is running at an elevated
76337 + privilege level).
76338 +
76339 + Furthermore, if a program is relinked as a dynamic ELF file, its
76340 + base address will be randomized as well, completing the full
76341 + randomization of the address space layout. Attacking such programs
76342 + becomes a guess game. You can find an example of doing this at
76343 + http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
76344 + http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
76345 +
76346 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
76347 + feature on a per file basis.
76348 +
76349 +endmenu
76350 +
76351 +menu "Miscellaneous hardening features"
76352 +
76353 +config PAX_MEMORY_SANITIZE
76354 + bool "Sanitize all freed memory"
76355 + help
76356 + By saying Y here the kernel will erase memory pages as soon as they
76357 + are freed. This in turn reduces the lifetime of data stored in the
76358 + pages, making it less likely that sensitive information such as
76359 + passwords, cryptographic secrets, etc stay in memory for too long.
76360 +
76361 + This is especially useful for programs whose runtime is short, long
76362 + lived processes and the kernel itself benefit from this as long as
76363 + they operate on whole memory pages and ensure timely freeing of pages
76364 + that may hold sensitive information.
76365 +
76366 + The tradeoff is performance impact, on a single CPU system kernel
76367 + compilation sees a 3% slowdown, other systems and workloads may vary
76368 + and you are advised to test this feature on your expected workload
76369 + before deploying it.
76370 +
76371 + Note that this feature does not protect data stored in live pages,
76372 + e.g., process memory swapped to disk may stay there for a long time.
76373 +
76374 +config PAX_MEMORY_STACKLEAK
76375 + bool "Sanitize kernel stack"
76376 + depends on X86
76377 + help
76378 + By saying Y here the kernel will erase the kernel stack before it
76379 + returns from a system call. This in turn reduces the information
76380 + that a kernel stack leak bug can reveal.
76381 +
76382 + Note that such a bug can still leak information that was put on
76383 + the stack by the current system call (the one eventually triggering
76384 + the bug) but traces of earlier system calls on the kernel stack
76385 + cannot leak anymore.
76386 +
76387 + The tradeoff is performance impact: on a single CPU system kernel
76388 + compilation sees a 1% slowdown, other systems and workloads may vary
76389 + and you are advised to test this feature on your expected workload
76390 + before deploying it.
76391 +
76392 + Note: full support for this feature requires gcc with plugin support
76393 + so make sure your compiler is at least gcc 4.5.0 (cross compilation
76394 + is not supported). Using older gcc versions means that functions
76395 + with large enough stack frames may leave uninitialized memory behind
76396 + that may be exposed to a later syscall leaking the stack.
76397 +
76398 +config PAX_MEMORY_UDEREF
76399 + bool "Prevent invalid userland pointer dereference"
76400 + depends on X86 && !UML_X86 && !XEN
76401 + select PAX_PER_CPU_PGD if X86_64
76402 + help
76403 + By saying Y here the kernel will be prevented from dereferencing
76404 + userland pointers in contexts where the kernel expects only kernel
76405 + pointers. This is both a useful runtime debugging feature and a
76406 + security measure that prevents exploiting a class of kernel bugs.
76407 +
76408 + The tradeoff is that some virtualization solutions may experience
76409 + a huge slowdown and therefore you should not enable this feature
76410 + for kernels meant to run in such environments. Whether a given VM
76411 + solution is affected or not is best determined by simply trying it
76412 + out, the performance impact will be obvious right on boot as this
76413 + mechanism engages from very early on. A good rule of thumb is that
76414 + VMs running on CPUs without hardware virtualization support (i.e.,
76415 + the majority of IA-32 CPUs) will likely experience the slowdown.
76416 +
76417 +config PAX_REFCOUNT
76418 + bool "Prevent various kernel object reference counter overflows"
76419 + depends on GRKERNSEC && (X86 || SPARC64)
76420 + help
76421 + By saying Y here the kernel will detect and prevent overflowing
76422 + various (but not all) kinds of object reference counters. Such
76423 + overflows can normally occur due to bugs only and are often, if
76424 + not always, exploitable.
76425 +
76426 + The tradeoff is that data structures protected by an overflowed
76427 + refcount will never be freed and therefore will leak memory. Note
76428 + that this leak also happens even without this protection but in
76429 + that case the overflow can eventually trigger the freeing of the
76430 + data structure while it is still being used elsewhere, resulting
76431 + in the exploitable situation that this feature prevents.
76432 +
76433 + Since this has a negligible performance impact, you should enable
76434 + this feature.
76435 +
76436 +config PAX_USERCOPY
76437 + bool "Harden heap object copies between kernel and userland"
76438 + depends on X86 || PPC || SPARC || ARM
76439 + depends on GRKERNSEC && (SLAB || SLUB || SLOB)
76440 + help
76441 + By saying Y here the kernel will enforce the size of heap objects
76442 + when they are copied in either direction between the kernel and
76443 + userland, even if only a part of the heap object is copied.
76444 +
76445 + Specifically, this checking prevents information leaking from the
76446 + kernel heap during kernel to userland copies (if the kernel heap
76447 + object is otherwise fully initialized) and prevents kernel heap
76448 + overflows during userland to kernel copies.
76449 +
76450 + Note that the current implementation provides the strictest bounds
76451 + checks for the SLUB allocator.
76452 +
76453 + Enabling this option also enables per-slab cache protection against
76454 + data in a given cache being copied into/out of via userland
76455 + accessors. Though the whitelist of regions will be reduced over
76456 + time, it notably protects important data structures like task structs.
76457 +
76458 + If frame pointers are enabled on x86, this option will also restrict
76459 + copies into and out of the kernel stack to local variables within a
76460 + single frame.
76461 +
76462 + Since this has a negligible performance impact, you should enable
76463 + this feature.
76464 +
76465 +endmenu
76466 +
76467 +endmenu
76468 +
76469 config KEYS
76470 bool "Enable access key retention support"
76471 help
76472 @@ -167,7 +719,7 @@ config INTEL_TXT
76473 config LSM_MMAP_MIN_ADDR
76474 int "Low address space for LSM to protect from user allocation"
76475 depends on SECURITY && SECURITY_SELINUX
76476 - default 32768 if ARM
76477 + default 32768 if ALPHA || ARM || PARISC || SPARC32
76478 default 65536
76479 help
76480 This is the portion of low virtual memory which should be protected
76481 diff -urNp linux-3.0.8/security/keys/compat.c linux-3.0.8/security/keys/compat.c
76482 --- linux-3.0.8/security/keys/compat.c 2011-07-21 22:17:23.000000000 -0400
76483 +++ linux-3.0.8/security/keys/compat.c 2011-10-06 04:17:55.000000000 -0400
76484 @@ -44,7 +44,7 @@ long compat_keyctl_instantiate_key_iov(
76485 if (ret == 0)
76486 goto no_payload_free;
76487
76488 - ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
76489 + ret = keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, ioc, ret, ringid);
76490
76491 if (iov != iovstack)
76492 kfree(iov);
76493 diff -urNp linux-3.0.8/security/keys/keyctl.c linux-3.0.8/security/keys/keyctl.c
76494 --- linux-3.0.8/security/keys/keyctl.c 2011-07-21 22:17:23.000000000 -0400
76495 +++ linux-3.0.8/security/keys/keyctl.c 2011-10-06 04:17:55.000000000 -0400
76496 @@ -921,7 +921,7 @@ static int keyctl_change_reqkey_auth(str
76497 /*
76498 * Copy the iovec data from userspace
76499 */
76500 -static long copy_from_user_iovec(void *buffer, const struct iovec *iov,
76501 +static long copy_from_user_iovec(void *buffer, const struct iovec __user *iov,
76502 unsigned ioc)
76503 {
76504 for (; ioc > 0; ioc--) {
76505 @@ -943,7 +943,7 @@ static long copy_from_user_iovec(void *b
76506 * If successful, 0 will be returned.
76507 */
76508 long keyctl_instantiate_key_common(key_serial_t id,
76509 - const struct iovec *payload_iov,
76510 + const struct iovec __user *payload_iov,
76511 unsigned ioc,
76512 size_t plen,
76513 key_serial_t ringid)
76514 @@ -1038,7 +1038,7 @@ long keyctl_instantiate_key(key_serial_t
76515 [0].iov_len = plen
76516 };
76517
76518 - return keyctl_instantiate_key_common(id, iov, 1, plen, ringid);
76519 + return keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, 1, plen, ringid);
76520 }
76521
76522 return keyctl_instantiate_key_common(id, NULL, 0, 0, ringid);
76523 @@ -1071,7 +1071,7 @@ long keyctl_instantiate_key_iov(key_seri
76524 if (ret == 0)
76525 goto no_payload_free;
76526
76527 - ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
76528 + ret = keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, ioc, ret, ringid);
76529
76530 if (iov != iovstack)
76531 kfree(iov);
76532 diff -urNp linux-3.0.8/security/keys/keyring.c linux-3.0.8/security/keys/keyring.c
76533 --- linux-3.0.8/security/keys/keyring.c 2011-07-21 22:17:23.000000000 -0400
76534 +++ linux-3.0.8/security/keys/keyring.c 2011-08-23 21:47:56.000000000 -0400
76535 @@ -215,15 +215,15 @@ static long keyring_read(const struct ke
76536 ret = -EFAULT;
76537
76538 for (loop = 0; loop < klist->nkeys; loop++) {
76539 + key_serial_t serial;
76540 key = klist->keys[loop];
76541 + serial = key->serial;
76542
76543 tmp = sizeof(key_serial_t);
76544 if (tmp > buflen)
76545 tmp = buflen;
76546
76547 - if (copy_to_user(buffer,
76548 - &key->serial,
76549 - tmp) != 0)
76550 + if (copy_to_user(buffer, &serial, tmp))
76551 goto error;
76552
76553 buflen -= tmp;
76554 diff -urNp linux-3.0.8/security/min_addr.c linux-3.0.8/security/min_addr.c
76555 --- linux-3.0.8/security/min_addr.c 2011-07-21 22:17:23.000000000 -0400
76556 +++ linux-3.0.8/security/min_addr.c 2011-08-23 21:48:14.000000000 -0400
76557 @@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG
76558 */
76559 static void update_mmap_min_addr(void)
76560 {
76561 +#ifndef SPARC
76562 #ifdef CONFIG_LSM_MMAP_MIN_ADDR
76563 if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
76564 mmap_min_addr = dac_mmap_min_addr;
76565 @@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
76566 #else
76567 mmap_min_addr = dac_mmap_min_addr;
76568 #endif
76569 +#endif
76570 }
76571
76572 /*
76573 diff -urNp linux-3.0.8/security/security.c linux-3.0.8/security/security.c
76574 --- linux-3.0.8/security/security.c 2011-07-21 22:17:23.000000000 -0400
76575 +++ linux-3.0.8/security/security.c 2011-08-23 21:48:14.000000000 -0400
76576 @@ -25,8 +25,8 @@ static __initdata char chosen_lsm[SECURI
76577 /* things that live in capability.c */
76578 extern void __init security_fixup_ops(struct security_operations *ops);
76579
76580 -static struct security_operations *security_ops;
76581 -static struct security_operations default_security_ops = {
76582 +static struct security_operations *security_ops __read_only;
76583 +static struct security_operations default_security_ops __read_only = {
76584 .name = "default",
76585 };
76586
76587 @@ -67,7 +67,9 @@ int __init security_init(void)
76588
76589 void reset_security_ops(void)
76590 {
76591 + pax_open_kernel();
76592 security_ops = &default_security_ops;
76593 + pax_close_kernel();
76594 }
76595
76596 /* Save user chosen LSM */
76597 diff -urNp linux-3.0.8/security/selinux/hooks.c linux-3.0.8/security/selinux/hooks.c
76598 --- linux-3.0.8/security/selinux/hooks.c 2011-07-21 22:17:23.000000000 -0400
76599 +++ linux-3.0.8/security/selinux/hooks.c 2011-08-23 21:48:14.000000000 -0400
76600 @@ -93,7 +93,6 @@
76601 #define NUM_SEL_MNT_OPTS 5
76602
76603 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
76604 -extern struct security_operations *security_ops;
76605
76606 /* SECMARK reference count */
76607 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
76608 @@ -5454,7 +5453,7 @@ static int selinux_key_getsecurity(struc
76609
76610 #endif
76611
76612 -static struct security_operations selinux_ops = {
76613 +static struct security_operations selinux_ops __read_only = {
76614 .name = "selinux",
76615
76616 .ptrace_access_check = selinux_ptrace_access_check,
76617 diff -urNp linux-3.0.8/security/selinux/include/xfrm.h linux-3.0.8/security/selinux/include/xfrm.h
76618 --- linux-3.0.8/security/selinux/include/xfrm.h 2011-07-21 22:17:23.000000000 -0400
76619 +++ linux-3.0.8/security/selinux/include/xfrm.h 2011-08-23 21:47:56.000000000 -0400
76620 @@ -48,7 +48,7 @@ int selinux_xfrm_decode_session(struct s
76621
76622 static inline void selinux_xfrm_notify_policyload(void)
76623 {
76624 - atomic_inc(&flow_cache_genid);
76625 + atomic_inc_unchecked(&flow_cache_genid);
76626 }
76627 #else
76628 static inline int selinux_xfrm_enabled(void)
76629 diff -urNp linux-3.0.8/security/selinux/ss/services.c linux-3.0.8/security/selinux/ss/services.c
76630 --- linux-3.0.8/security/selinux/ss/services.c 2011-07-21 22:17:23.000000000 -0400
76631 +++ linux-3.0.8/security/selinux/ss/services.c 2011-08-23 21:48:14.000000000 -0400
76632 @@ -1814,6 +1814,8 @@ int security_load_policy(void *data, siz
76633 int rc = 0;
76634 struct policy_file file = { data, len }, *fp = &file;
76635
76636 + pax_track_stack();
76637 +
76638 if (!ss_initialized) {
76639 avtab_cache_init();
76640 rc = policydb_read(&policydb, fp);
76641 diff -urNp linux-3.0.8/security/smack/smack_lsm.c linux-3.0.8/security/smack/smack_lsm.c
76642 --- linux-3.0.8/security/smack/smack_lsm.c 2011-07-21 22:17:23.000000000 -0400
76643 +++ linux-3.0.8/security/smack/smack_lsm.c 2011-08-23 21:47:56.000000000 -0400
76644 @@ -3392,7 +3392,7 @@ static int smack_inode_getsecctx(struct
76645 return 0;
76646 }
76647
76648 -struct security_operations smack_ops = {
76649 +struct security_operations smack_ops __read_only = {
76650 .name = "smack",
76651
76652 .ptrace_access_check = smack_ptrace_access_check,
76653 diff -urNp linux-3.0.8/security/tomoyo/tomoyo.c linux-3.0.8/security/tomoyo/tomoyo.c
76654 --- linux-3.0.8/security/tomoyo/tomoyo.c 2011-07-21 22:17:23.000000000 -0400
76655 +++ linux-3.0.8/security/tomoyo/tomoyo.c 2011-08-23 21:47:56.000000000 -0400
76656 @@ -240,7 +240,7 @@ static int tomoyo_sb_pivotroot(struct pa
76657 * tomoyo_security_ops is a "struct security_operations" which is used for
76658 * registering TOMOYO.
76659 */
76660 -static struct security_operations tomoyo_security_ops = {
76661 +static struct security_operations tomoyo_security_ops __read_only = {
76662 .name = "tomoyo",
76663 .cred_alloc_blank = tomoyo_cred_alloc_blank,
76664 .cred_prepare = tomoyo_cred_prepare,
76665 diff -urNp linux-3.0.8/sound/aoa/codecs/onyx.c linux-3.0.8/sound/aoa/codecs/onyx.c
76666 --- linux-3.0.8/sound/aoa/codecs/onyx.c 2011-07-21 22:17:23.000000000 -0400
76667 +++ linux-3.0.8/sound/aoa/codecs/onyx.c 2011-08-23 21:47:56.000000000 -0400
76668 @@ -54,7 +54,7 @@ struct onyx {
76669 spdif_locked:1,
76670 analog_locked:1,
76671 original_mute:2;
76672 - int open_count;
76673 + local_t open_count;
76674 struct codec_info *codec_info;
76675
76676 /* mutex serializes concurrent access to the device
76677 @@ -753,7 +753,7 @@ static int onyx_open(struct codec_info_i
76678 struct onyx *onyx = cii->codec_data;
76679
76680 mutex_lock(&onyx->mutex);
76681 - onyx->open_count++;
76682 + local_inc(&onyx->open_count);
76683 mutex_unlock(&onyx->mutex);
76684
76685 return 0;
76686 @@ -765,8 +765,7 @@ static int onyx_close(struct codec_info_
76687 struct onyx *onyx = cii->codec_data;
76688
76689 mutex_lock(&onyx->mutex);
76690 - onyx->open_count--;
76691 - if (!onyx->open_count)
76692 + if (local_dec_and_test(&onyx->open_count))
76693 onyx->spdif_locked = onyx->analog_locked = 0;
76694 mutex_unlock(&onyx->mutex);
76695
76696 diff -urNp linux-3.0.8/sound/aoa/codecs/onyx.h linux-3.0.8/sound/aoa/codecs/onyx.h
76697 --- linux-3.0.8/sound/aoa/codecs/onyx.h 2011-07-21 22:17:23.000000000 -0400
76698 +++ linux-3.0.8/sound/aoa/codecs/onyx.h 2011-08-23 21:47:56.000000000 -0400
76699 @@ -11,6 +11,7 @@
76700 #include <linux/i2c.h>
76701 #include <asm/pmac_low_i2c.h>
76702 #include <asm/prom.h>
76703 +#include <asm/local.h>
76704
76705 /* PCM3052 register definitions */
76706
76707 diff -urNp linux-3.0.8/sound/core/oss/pcm_oss.c linux-3.0.8/sound/core/oss/pcm_oss.c
76708 --- linux-3.0.8/sound/core/oss/pcm_oss.c 2011-07-21 22:17:23.000000000 -0400
76709 +++ linux-3.0.8/sound/core/oss/pcm_oss.c 2011-10-06 04:17:55.000000000 -0400
76710 @@ -1189,10 +1189,10 @@ snd_pcm_sframes_t snd_pcm_oss_write3(str
76711 if (in_kernel) {
76712 mm_segment_t fs;
76713 fs = snd_enter_user();
76714 - ret = snd_pcm_lib_write(substream, (void __force __user *)ptr, frames);
76715 + ret = snd_pcm_lib_write(substream, (void __force_user *)ptr, frames);
76716 snd_leave_user(fs);
76717 } else {
76718 - ret = snd_pcm_lib_write(substream, (void __force __user *)ptr, frames);
76719 + ret = snd_pcm_lib_write(substream, (void __force_user *)ptr, frames);
76720 }
76721 if (ret != -EPIPE && ret != -ESTRPIPE)
76722 break;
76723 @@ -1234,10 +1234,10 @@ snd_pcm_sframes_t snd_pcm_oss_read3(stru
76724 if (in_kernel) {
76725 mm_segment_t fs;
76726 fs = snd_enter_user();
76727 - ret = snd_pcm_lib_read(substream, (void __force __user *)ptr, frames);
76728 + ret = snd_pcm_lib_read(substream, (void __force_user *)ptr, frames);
76729 snd_leave_user(fs);
76730 } else {
76731 - ret = snd_pcm_lib_read(substream, (void __force __user *)ptr, frames);
76732 + ret = snd_pcm_lib_read(substream, (void __force_user *)ptr, frames);
76733 }
76734 if (ret == -EPIPE) {
76735 if (runtime->status->state == SNDRV_PCM_STATE_DRAINING) {
76736 @@ -1337,7 +1337,7 @@ static ssize_t snd_pcm_oss_write2(struct
76737 struct snd_pcm_plugin_channel *channels;
76738 size_t oss_frame_bytes = (runtime->oss.plugin_first->src_width * runtime->oss.plugin_first->src_format.channels) / 8;
76739 if (!in_kernel) {
76740 - if (copy_from_user(runtime->oss.buffer, (const char __force __user *)buf, bytes))
76741 + if (copy_from_user(runtime->oss.buffer, (const char __force_user *)buf, bytes))
76742 return -EFAULT;
76743 buf = runtime->oss.buffer;
76744 }
76745 @@ -1407,7 +1407,7 @@ static ssize_t snd_pcm_oss_write1(struct
76746 }
76747 } else {
76748 tmp = snd_pcm_oss_write2(substream,
76749 - (const char __force *)buf,
76750 + (const char __force_kernel *)buf,
76751 runtime->oss.period_bytes, 0);
76752 if (tmp <= 0)
76753 goto err;
76754 @@ -1433,7 +1433,7 @@ static ssize_t snd_pcm_oss_read2(struct
76755 struct snd_pcm_runtime *runtime = substream->runtime;
76756 snd_pcm_sframes_t frames, frames1;
76757 #ifdef CONFIG_SND_PCM_OSS_PLUGINS
76758 - char __user *final_dst = (char __force __user *)buf;
76759 + char __user *final_dst = (char __force_user *)buf;
76760 if (runtime->oss.plugin_first) {
76761 struct snd_pcm_plugin_channel *channels;
76762 size_t oss_frame_bytes = (runtime->oss.plugin_last->dst_width * runtime->oss.plugin_last->dst_format.channels) / 8;
76763 @@ -1495,7 +1495,7 @@ static ssize_t snd_pcm_oss_read1(struct
76764 xfer += tmp;
76765 runtime->oss.buffer_used -= tmp;
76766 } else {
76767 - tmp = snd_pcm_oss_read2(substream, (char __force *)buf,
76768 + tmp = snd_pcm_oss_read2(substream, (char __force_kernel *)buf,
76769 runtime->oss.period_bytes, 0);
76770 if (tmp <= 0)
76771 goto err;
76772 @@ -1663,7 +1663,7 @@ static int snd_pcm_oss_sync(struct snd_p
76773 size1);
76774 size1 /= runtime->channels; /* frames */
76775 fs = snd_enter_user();
76776 - snd_pcm_lib_write(substream, (void __force __user *)runtime->oss.buffer, size1);
76777 + snd_pcm_lib_write(substream, (void __force_user *)runtime->oss.buffer, size1);
76778 snd_leave_user(fs);
76779 }
76780 } else if (runtime->access == SNDRV_PCM_ACCESS_RW_NONINTERLEAVED) {
76781 diff -urNp linux-3.0.8/sound/core/pcm_compat.c linux-3.0.8/sound/core/pcm_compat.c
76782 --- linux-3.0.8/sound/core/pcm_compat.c 2011-10-24 08:05:21.000000000 -0400
76783 +++ linux-3.0.8/sound/core/pcm_compat.c 2011-10-06 04:17:55.000000000 -0400
76784 @@ -31,7 +31,7 @@ static int snd_pcm_ioctl_delay_compat(st
76785 int err;
76786
76787 fs = snd_enter_user();
76788 - err = snd_pcm_delay(substream, &delay);
76789 + err = snd_pcm_delay(substream, (snd_pcm_sframes_t __force_user *)&delay);
76790 snd_leave_user(fs);
76791 if (err < 0)
76792 return err;
76793 diff -urNp linux-3.0.8/sound/core/pcm_native.c linux-3.0.8/sound/core/pcm_native.c
76794 --- linux-3.0.8/sound/core/pcm_native.c 2011-07-21 22:17:23.000000000 -0400
76795 +++ linux-3.0.8/sound/core/pcm_native.c 2011-10-06 04:17:55.000000000 -0400
76796 @@ -2770,11 +2770,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_
76797 switch (substream->stream) {
76798 case SNDRV_PCM_STREAM_PLAYBACK:
76799 result = snd_pcm_playback_ioctl1(NULL, substream, cmd,
76800 - (void __user *)arg);
76801 + (void __force_user *)arg);
76802 break;
76803 case SNDRV_PCM_STREAM_CAPTURE:
76804 result = snd_pcm_capture_ioctl1(NULL, substream, cmd,
76805 - (void __user *)arg);
76806 + (void __force_user *)arg);
76807 break;
76808 default:
76809 result = -EINVAL;
76810 diff -urNp linux-3.0.8/sound/core/seq/seq_device.c linux-3.0.8/sound/core/seq/seq_device.c
76811 --- linux-3.0.8/sound/core/seq/seq_device.c 2011-07-21 22:17:23.000000000 -0400
76812 +++ linux-3.0.8/sound/core/seq/seq_device.c 2011-08-23 21:47:56.000000000 -0400
76813 @@ -63,7 +63,7 @@ struct ops_list {
76814 int argsize; /* argument size */
76815
76816 /* operators */
76817 - struct snd_seq_dev_ops ops;
76818 + struct snd_seq_dev_ops *ops;
76819
76820 /* registred devices */
76821 struct list_head dev_list; /* list of devices */
76822 @@ -332,7 +332,7 @@ int snd_seq_device_register_driver(char
76823
76824 mutex_lock(&ops->reg_mutex);
76825 /* copy driver operators */
76826 - ops->ops = *entry;
76827 + ops->ops = entry;
76828 ops->driver |= DRIVER_LOADED;
76829 ops->argsize = argsize;
76830
76831 @@ -462,7 +462,7 @@ static int init_device(struct snd_seq_de
76832 dev->name, ops->id, ops->argsize, dev->argsize);
76833 return -EINVAL;
76834 }
76835 - if (ops->ops.init_device(dev) >= 0) {
76836 + if (ops->ops->init_device(dev) >= 0) {
76837 dev->status = SNDRV_SEQ_DEVICE_REGISTERED;
76838 ops->num_init_devices++;
76839 } else {
76840 @@ -489,7 +489,7 @@ static int free_device(struct snd_seq_de
76841 dev->name, ops->id, ops->argsize, dev->argsize);
76842 return -EINVAL;
76843 }
76844 - if ((result = ops->ops.free_device(dev)) >= 0 || result == -ENXIO) {
76845 + if ((result = ops->ops->free_device(dev)) >= 0 || result == -ENXIO) {
76846 dev->status = SNDRV_SEQ_DEVICE_FREE;
76847 dev->driver_data = NULL;
76848 ops->num_init_devices--;
76849 diff -urNp linux-3.0.8/sound/drivers/mts64.c linux-3.0.8/sound/drivers/mts64.c
76850 --- linux-3.0.8/sound/drivers/mts64.c 2011-07-21 22:17:23.000000000 -0400
76851 +++ linux-3.0.8/sound/drivers/mts64.c 2011-08-23 21:47:56.000000000 -0400
76852 @@ -28,6 +28,7 @@
76853 #include <sound/initval.h>
76854 #include <sound/rawmidi.h>
76855 #include <sound/control.h>
76856 +#include <asm/local.h>
76857
76858 #define CARD_NAME "Miditerminal 4140"
76859 #define DRIVER_NAME "MTS64"
76860 @@ -66,7 +67,7 @@ struct mts64 {
76861 struct pardevice *pardev;
76862 int pardev_claimed;
76863
76864 - int open_count;
76865 + local_t open_count;
76866 int current_midi_output_port;
76867 int current_midi_input_port;
76868 u8 mode[MTS64_NUM_INPUT_PORTS];
76869 @@ -696,7 +697,7 @@ static int snd_mts64_rawmidi_open(struct
76870 {
76871 struct mts64 *mts = substream->rmidi->private_data;
76872
76873 - if (mts->open_count == 0) {
76874 + if (local_read(&mts->open_count) == 0) {
76875 /* We don't need a spinlock here, because this is just called
76876 if the device has not been opened before.
76877 So there aren't any IRQs from the device */
76878 @@ -704,7 +705,7 @@ static int snd_mts64_rawmidi_open(struct
76879
76880 msleep(50);
76881 }
76882 - ++(mts->open_count);
76883 + local_inc(&mts->open_count);
76884
76885 return 0;
76886 }
76887 @@ -714,8 +715,7 @@ static int snd_mts64_rawmidi_close(struc
76888 struct mts64 *mts = substream->rmidi->private_data;
76889 unsigned long flags;
76890
76891 - --(mts->open_count);
76892 - if (mts->open_count == 0) {
76893 + if (local_dec_return(&mts->open_count) == 0) {
76894 /* We need the spinlock_irqsave here because we can still
76895 have IRQs at this point */
76896 spin_lock_irqsave(&mts->lock, flags);
76897 @@ -724,8 +724,8 @@ static int snd_mts64_rawmidi_close(struc
76898
76899 msleep(500);
76900
76901 - } else if (mts->open_count < 0)
76902 - mts->open_count = 0;
76903 + } else if (local_read(&mts->open_count) < 0)
76904 + local_set(&mts->open_count, 0);
76905
76906 return 0;
76907 }
76908 diff -urNp linux-3.0.8/sound/drivers/opl4/opl4_lib.c linux-3.0.8/sound/drivers/opl4/opl4_lib.c
76909 --- linux-3.0.8/sound/drivers/opl4/opl4_lib.c 2011-07-21 22:17:23.000000000 -0400
76910 +++ linux-3.0.8/sound/drivers/opl4/opl4_lib.c 2011-08-23 21:47:56.000000000 -0400
76911 @@ -28,7 +28,7 @@ MODULE_AUTHOR("Clemens Ladisch <clemens@
76912 MODULE_DESCRIPTION("OPL4 driver");
76913 MODULE_LICENSE("GPL");
76914
76915 -static void inline snd_opl4_wait(struct snd_opl4 *opl4)
76916 +static inline void snd_opl4_wait(struct snd_opl4 *opl4)
76917 {
76918 int timeout = 10;
76919 while ((inb(opl4->fm_port) & OPL4_STATUS_BUSY) && --timeout > 0)
76920 diff -urNp linux-3.0.8/sound/drivers/portman2x4.c linux-3.0.8/sound/drivers/portman2x4.c
76921 --- linux-3.0.8/sound/drivers/portman2x4.c 2011-07-21 22:17:23.000000000 -0400
76922 +++ linux-3.0.8/sound/drivers/portman2x4.c 2011-08-23 21:47:56.000000000 -0400
76923 @@ -47,6 +47,7 @@
76924 #include <sound/initval.h>
76925 #include <sound/rawmidi.h>
76926 #include <sound/control.h>
76927 +#include <asm/local.h>
76928
76929 #define CARD_NAME "Portman 2x4"
76930 #define DRIVER_NAME "portman"
76931 @@ -84,7 +85,7 @@ struct portman {
76932 struct pardevice *pardev;
76933 int pardev_claimed;
76934
76935 - int open_count;
76936 + local_t open_count;
76937 int mode[PORTMAN_NUM_INPUT_PORTS];
76938 struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
76939 };
76940 diff -urNp linux-3.0.8/sound/firewire/amdtp.c linux-3.0.8/sound/firewire/amdtp.c
76941 --- linux-3.0.8/sound/firewire/amdtp.c 2011-07-21 22:17:23.000000000 -0400
76942 +++ linux-3.0.8/sound/firewire/amdtp.c 2011-08-23 21:47:56.000000000 -0400
76943 @@ -371,7 +371,7 @@ static void queue_out_packet(struct amdt
76944 ptr = s->pcm_buffer_pointer + data_blocks;
76945 if (ptr >= pcm->runtime->buffer_size)
76946 ptr -= pcm->runtime->buffer_size;
76947 - ACCESS_ONCE(s->pcm_buffer_pointer) = ptr;
76948 + ACCESS_ONCE_RW(s->pcm_buffer_pointer) = ptr;
76949
76950 s->pcm_period_pointer += data_blocks;
76951 if (s->pcm_period_pointer >= pcm->runtime->period_size) {
76952 @@ -511,7 +511,7 @@ EXPORT_SYMBOL(amdtp_out_stream_start);
76953 */
76954 void amdtp_out_stream_update(struct amdtp_out_stream *s)
76955 {
76956 - ACCESS_ONCE(s->source_node_id_field) =
76957 + ACCESS_ONCE_RW(s->source_node_id_field) =
76958 (fw_parent_device(s->unit)->card->node_id & 0x3f) << 24;
76959 }
76960 EXPORT_SYMBOL(amdtp_out_stream_update);
76961 diff -urNp linux-3.0.8/sound/firewire/amdtp.h linux-3.0.8/sound/firewire/amdtp.h
76962 --- linux-3.0.8/sound/firewire/amdtp.h 2011-07-21 22:17:23.000000000 -0400
76963 +++ linux-3.0.8/sound/firewire/amdtp.h 2011-08-23 21:47:56.000000000 -0400
76964 @@ -146,7 +146,7 @@ static inline void amdtp_out_stream_pcm_
76965 static inline void amdtp_out_stream_pcm_trigger(struct amdtp_out_stream *s,
76966 struct snd_pcm_substream *pcm)
76967 {
76968 - ACCESS_ONCE(s->pcm) = pcm;
76969 + ACCESS_ONCE_RW(s->pcm) = pcm;
76970 }
76971
76972 /**
76973 diff -urNp linux-3.0.8/sound/firewire/isight.c linux-3.0.8/sound/firewire/isight.c
76974 --- linux-3.0.8/sound/firewire/isight.c 2011-07-21 22:17:23.000000000 -0400
76975 +++ linux-3.0.8/sound/firewire/isight.c 2011-08-23 21:47:56.000000000 -0400
76976 @@ -97,7 +97,7 @@ static void isight_update_pointers(struc
76977 ptr += count;
76978 if (ptr >= runtime->buffer_size)
76979 ptr -= runtime->buffer_size;
76980 - ACCESS_ONCE(isight->buffer_pointer) = ptr;
76981 + ACCESS_ONCE_RW(isight->buffer_pointer) = ptr;
76982
76983 isight->period_counter += count;
76984 if (isight->period_counter >= runtime->period_size) {
76985 @@ -308,7 +308,7 @@ static int isight_hw_params(struct snd_p
76986 if (err < 0)
76987 return err;
76988
76989 - ACCESS_ONCE(isight->pcm_active) = true;
76990 + ACCESS_ONCE_RW(isight->pcm_active) = true;
76991
76992 return 0;
76993 }
76994 @@ -341,7 +341,7 @@ static int isight_hw_free(struct snd_pcm
76995 {
76996 struct isight *isight = substream->private_data;
76997
76998 - ACCESS_ONCE(isight->pcm_active) = false;
76999 + ACCESS_ONCE_RW(isight->pcm_active) = false;
77000
77001 mutex_lock(&isight->mutex);
77002 isight_stop_streaming(isight);
77003 @@ -434,10 +434,10 @@ static int isight_trigger(struct snd_pcm
77004
77005 switch (cmd) {
77006 case SNDRV_PCM_TRIGGER_START:
77007 - ACCESS_ONCE(isight->pcm_running) = true;
77008 + ACCESS_ONCE_RW(isight->pcm_running) = true;
77009 break;
77010 case SNDRV_PCM_TRIGGER_STOP:
77011 - ACCESS_ONCE(isight->pcm_running) = false;
77012 + ACCESS_ONCE_RW(isight->pcm_running) = false;
77013 break;
77014 default:
77015 return -EINVAL;
77016 diff -urNp linux-3.0.8/sound/isa/cmi8330.c linux-3.0.8/sound/isa/cmi8330.c
77017 --- linux-3.0.8/sound/isa/cmi8330.c 2011-07-21 22:17:23.000000000 -0400
77018 +++ linux-3.0.8/sound/isa/cmi8330.c 2011-08-23 21:47:56.000000000 -0400
77019 @@ -172,7 +172,7 @@ struct snd_cmi8330 {
77020
77021 struct snd_pcm *pcm;
77022 struct snd_cmi8330_stream {
77023 - struct snd_pcm_ops ops;
77024 + snd_pcm_ops_no_const ops;
77025 snd_pcm_open_callback_t open;
77026 void *private_data; /* sb or wss */
77027 } streams[2];
77028 diff -urNp linux-3.0.8/sound/oss/sb_audio.c linux-3.0.8/sound/oss/sb_audio.c
77029 --- linux-3.0.8/sound/oss/sb_audio.c 2011-07-21 22:17:23.000000000 -0400
77030 +++ linux-3.0.8/sound/oss/sb_audio.c 2011-08-23 21:47:56.000000000 -0400
77031 @@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
77032 buf16 = (signed short *)(localbuf + localoffs);
77033 while (c)
77034 {
77035 - locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
77036 + locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
77037 if (copy_from_user(lbuf8,
77038 userbuf+useroffs + p,
77039 locallen))
77040 diff -urNp linux-3.0.8/sound/oss/swarm_cs4297a.c linux-3.0.8/sound/oss/swarm_cs4297a.c
77041 --- linux-3.0.8/sound/oss/swarm_cs4297a.c 2011-07-21 22:17:23.000000000 -0400
77042 +++ linux-3.0.8/sound/oss/swarm_cs4297a.c 2011-08-23 21:47:56.000000000 -0400
77043 @@ -2606,7 +2606,6 @@ static int __init cs4297a_init(void)
77044 {
77045 struct cs4297a_state *s;
77046 u32 pwr, id;
77047 - mm_segment_t fs;
77048 int rval;
77049 #ifndef CONFIG_BCM_CS4297A_CSWARM
77050 u64 cfg;
77051 @@ -2696,22 +2695,23 @@ static int __init cs4297a_init(void)
77052 if (!rval) {
77053 char *sb1250_duart_present;
77054
77055 +#if 0
77056 + mm_segment_t fs;
77057 fs = get_fs();
77058 set_fs(KERNEL_DS);
77059 -#if 0
77060 val = SOUND_MASK_LINE;
77061 mixer_ioctl(s, SOUND_MIXER_WRITE_RECSRC, (unsigned long) &val);
77062 for (i = 0; i < ARRAY_SIZE(initvol); i++) {
77063 val = initvol[i].vol;
77064 mixer_ioctl(s, initvol[i].mixch, (unsigned long) &val);
77065 }
77066 + set_fs(fs);
77067 // cs4297a_write_ac97(s, 0x18, 0x0808);
77068 #else
77069 // cs4297a_write_ac97(s, 0x5e, 0x180);
77070 cs4297a_write_ac97(s, 0x02, 0x0808);
77071 cs4297a_write_ac97(s, 0x18, 0x0808);
77072 #endif
77073 - set_fs(fs);
77074
77075 list_add(&s->list, &cs4297a_devs);
77076
77077 diff -urNp linux-3.0.8/sound/pci/hda/hda_codec.h linux-3.0.8/sound/pci/hda/hda_codec.h
77078 --- linux-3.0.8/sound/pci/hda/hda_codec.h 2011-07-21 22:17:23.000000000 -0400
77079 +++ linux-3.0.8/sound/pci/hda/hda_codec.h 2011-08-23 21:47:56.000000000 -0400
77080 @@ -615,7 +615,7 @@ struct hda_bus_ops {
77081 /* notify power-up/down from codec to controller */
77082 void (*pm_notify)(struct hda_bus *bus);
77083 #endif
77084 -};
77085 +} __no_const;
77086
77087 /* template to pass to the bus constructor */
77088 struct hda_bus_template {
77089 @@ -713,6 +713,7 @@ struct hda_codec_ops {
77090 #endif
77091 void (*reboot_notify)(struct hda_codec *codec);
77092 };
77093 +typedef struct hda_codec_ops __no_const hda_codec_ops_no_const;
77094
77095 /* record for amp information cache */
77096 struct hda_cache_head {
77097 @@ -743,7 +744,7 @@ struct hda_pcm_ops {
77098 struct snd_pcm_substream *substream);
77099 int (*cleanup)(struct hda_pcm_stream *info, struct hda_codec *codec,
77100 struct snd_pcm_substream *substream);
77101 -};
77102 +} __no_const;
77103
77104 /* PCM information for each substream */
77105 struct hda_pcm_stream {
77106 @@ -801,7 +802,7 @@ struct hda_codec {
77107 const char *modelname; /* model name for preset */
77108
77109 /* set by patch */
77110 - struct hda_codec_ops patch_ops;
77111 + hda_codec_ops_no_const patch_ops;
77112
77113 /* PCM to create, set by patch_ops.build_pcms callback */
77114 unsigned int num_pcms;
77115 diff -urNp linux-3.0.8/sound/pci/ice1712/ice1712.h linux-3.0.8/sound/pci/ice1712/ice1712.h
77116 --- linux-3.0.8/sound/pci/ice1712/ice1712.h 2011-07-21 22:17:23.000000000 -0400
77117 +++ linux-3.0.8/sound/pci/ice1712/ice1712.h 2011-08-23 21:47:56.000000000 -0400
77118 @@ -269,7 +269,7 @@ struct snd_ak4xxx_private {
77119 unsigned int mask_flags; /* total mask bits */
77120 struct snd_akm4xxx_ops {
77121 void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
77122 - } ops;
77123 + } __no_const ops;
77124 };
77125
77126 struct snd_ice1712_spdif {
77127 @@ -285,7 +285,7 @@ struct snd_ice1712_spdif {
77128 int (*default_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
77129 void (*stream_get)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
77130 int (*stream_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
77131 - } ops;
77132 + } __no_const ops;
77133 };
77134
77135
77136 diff -urNp linux-3.0.8/sound/pci/ymfpci/ymfpci_main.c linux-3.0.8/sound/pci/ymfpci/ymfpci_main.c
77137 --- linux-3.0.8/sound/pci/ymfpci/ymfpci_main.c 2011-07-21 22:17:23.000000000 -0400
77138 +++ linux-3.0.8/sound/pci/ymfpci/ymfpci_main.c 2011-08-23 21:47:56.000000000 -0400
77139 @@ -202,8 +202,8 @@ static void snd_ymfpci_hw_stop(struct sn
77140 if ((snd_ymfpci_readl(chip, YDSXGR_STATUS) & 2) == 0)
77141 break;
77142 }
77143 - if (atomic_read(&chip->interrupt_sleep_count)) {
77144 - atomic_set(&chip->interrupt_sleep_count, 0);
77145 + if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
77146 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
77147 wake_up(&chip->interrupt_sleep);
77148 }
77149 __end:
77150 @@ -787,7 +787,7 @@ static void snd_ymfpci_irq_wait(struct s
77151 continue;
77152 init_waitqueue_entry(&wait, current);
77153 add_wait_queue(&chip->interrupt_sleep, &wait);
77154 - atomic_inc(&chip->interrupt_sleep_count);
77155 + atomic_inc_unchecked(&chip->interrupt_sleep_count);
77156 schedule_timeout_uninterruptible(msecs_to_jiffies(50));
77157 remove_wait_queue(&chip->interrupt_sleep, &wait);
77158 }
77159 @@ -825,8 +825,8 @@ static irqreturn_t snd_ymfpci_interrupt(
77160 snd_ymfpci_writel(chip, YDSXGR_MODE, mode);
77161 spin_unlock(&chip->reg_lock);
77162
77163 - if (atomic_read(&chip->interrupt_sleep_count)) {
77164 - atomic_set(&chip->interrupt_sleep_count, 0);
77165 + if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
77166 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
77167 wake_up(&chip->interrupt_sleep);
77168 }
77169 }
77170 @@ -2363,7 +2363,7 @@ int __devinit snd_ymfpci_create(struct s
77171 spin_lock_init(&chip->reg_lock);
77172 spin_lock_init(&chip->voice_lock);
77173 init_waitqueue_head(&chip->interrupt_sleep);
77174 - atomic_set(&chip->interrupt_sleep_count, 0);
77175 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
77176 chip->card = card;
77177 chip->pci = pci;
77178 chip->irq = -1;
77179 diff -urNp linux-3.0.8/sound/soc/soc-core.c linux-3.0.8/sound/soc/soc-core.c
77180 --- linux-3.0.8/sound/soc/soc-core.c 2011-10-24 08:05:21.000000000 -0400
77181 +++ linux-3.0.8/sound/soc/soc-core.c 2011-08-23 21:47:56.000000000 -0400
77182 @@ -1021,7 +1021,7 @@ static snd_pcm_uframes_t soc_pcm_pointer
77183 }
77184
77185 /* ASoC PCM operations */
77186 -static struct snd_pcm_ops soc_pcm_ops = {
77187 +static snd_pcm_ops_no_const soc_pcm_ops = {
77188 .open = soc_pcm_open,
77189 .close = soc_codec_close,
77190 .hw_params = soc_pcm_hw_params,
77191 @@ -2128,6 +2128,7 @@ static int soc_new_pcm(struct snd_soc_pc
77192 rtd->pcm = pcm;
77193 pcm->private_data = rtd;
77194 if (platform->driver->ops) {
77195 + /* this whole logic is broken... */
77196 soc_pcm_ops.mmap = platform->driver->ops->mmap;
77197 soc_pcm_ops.pointer = platform->driver->ops->pointer;
77198 soc_pcm_ops.ioctl = platform->driver->ops->ioctl;
77199 diff -urNp linux-3.0.8/sound/usb/card.h linux-3.0.8/sound/usb/card.h
77200 --- linux-3.0.8/sound/usb/card.h 2011-07-21 22:17:23.000000000 -0400
77201 +++ linux-3.0.8/sound/usb/card.h 2011-08-23 21:47:56.000000000 -0400
77202 @@ -44,6 +44,7 @@ struct snd_urb_ops {
77203 int (*prepare_sync)(struct snd_usb_substream *subs, struct snd_pcm_runtime *runtime, struct urb *u);
77204 int (*retire_sync)(struct snd_usb_substream *subs, struct snd_pcm_runtime *runtime, struct urb *u);
77205 };
77206 +typedef struct snd_urb_ops __no_const snd_urb_ops_no_const;
77207
77208 struct snd_usb_substream {
77209 struct snd_usb_stream *stream;
77210 @@ -93,7 +94,7 @@ struct snd_usb_substream {
77211 struct snd_pcm_hw_constraint_list rate_list; /* limited rates */
77212 spinlock_t lock;
77213
77214 - struct snd_urb_ops ops; /* callbacks (must be filled at init) */
77215 + snd_urb_ops_no_const ops; /* callbacks (must be filled at init) */
77216 };
77217
77218 struct snd_usb_stream {
77219 diff -urNp linux-3.0.8/tools/gcc/checker_plugin.c linux-3.0.8/tools/gcc/checker_plugin.c
77220 --- linux-3.0.8/tools/gcc/checker_plugin.c 1969-12-31 19:00:00.000000000 -0500
77221 +++ linux-3.0.8/tools/gcc/checker_plugin.c 2011-10-06 04:17:55.000000000 -0400
77222 @@ -0,0 +1,169 @@
77223 +/*
77224 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
77225 + * Licensed under the GPL v2
77226 + *
77227 + * Note: the choice of the license means that the compilation process is
77228 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
77229 + * but for the kernel it doesn't matter since it doesn't link against
77230 + * any of the gcc libraries
77231 + *
77232 + * gcc plugin to implement various sparse (source code checker) features
77233 + *
77234 + * TODO:
77235 + * - define separate __iomem, __percpu and __rcu address spaces (lots of code to patch)
77236 + *
77237 + * BUGS:
77238 + * - none known
77239 + */
77240 +#include "gcc-plugin.h"
77241 +#include "config.h"
77242 +#include "system.h"
77243 +#include "coretypes.h"
77244 +#include "tree.h"
77245 +#include "tree-pass.h"
77246 +#include "intl.h"
77247 +#include "plugin-version.h"
77248 +#include "tm.h"
77249 +#include "toplev.h"
77250 +#include "basic-block.h"
77251 +#include "gimple.h"
77252 +//#include "expr.h" where are you...
77253 +#include "diagnostic.h"
77254 +#include "rtl.h"
77255 +#include "emit-rtl.h"
77256 +#include "function.h"
77257 +#include "tree-flow.h"
77258 +#include "target.h"
77259 +
77260 +extern void c_register_addr_space (const char *str, addr_space_t as);
77261 +extern enum machine_mode default_addr_space_pointer_mode (addr_space_t);
77262 +extern enum machine_mode default_addr_space_address_mode (addr_space_t);
77263 +extern bool default_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as);
77264 +extern bool default_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as);
77265 +extern rtx default_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as);
77266 +
77267 +extern void print_gimple_stmt(FILE *, gimple, int, int);
77268 +extern rtx emit_move_insn(rtx x, rtx y);
77269 +
77270 +int plugin_is_GPL_compatible;
77271 +
77272 +static struct plugin_info checker_plugin_info = {
77273 + .version = "201110031940",
77274 +};
77275 +
77276 +#define ADDR_SPACE_KERNEL 0
77277 +#define ADDR_SPACE_FORCE_KERNEL 1
77278 +#define ADDR_SPACE_USER 2
77279 +#define ADDR_SPACE_FORCE_USER 3
77280 +#define ADDR_SPACE_IOMEM 0
77281 +#define ADDR_SPACE_FORCE_IOMEM 0
77282 +#define ADDR_SPACE_PERCPU 0
77283 +#define ADDR_SPACE_FORCE_PERCPU 0
77284 +#define ADDR_SPACE_RCU 0
77285 +#define ADDR_SPACE_FORCE_RCU 0
77286 +
77287 +static enum machine_mode checker_addr_space_pointer_mode(addr_space_t addrspace)
77288 +{
77289 + return default_addr_space_pointer_mode(ADDR_SPACE_GENERIC);
77290 +}
77291 +
77292 +static enum machine_mode checker_addr_space_address_mode(addr_space_t addrspace)
77293 +{
77294 + return default_addr_space_address_mode(ADDR_SPACE_GENERIC);
77295 +}
77296 +
77297 +static bool checker_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as)
77298 +{
77299 + return default_addr_space_valid_pointer_mode(mode, as);
77300 +}
77301 +
77302 +static bool checker_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as)
77303 +{
77304 + return default_addr_space_legitimate_address_p(mode, mem, strict, ADDR_SPACE_GENERIC);
77305 +}
77306 +
77307 +static rtx checker_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as)
77308 +{
77309 + return default_addr_space_legitimize_address(x, oldx, mode, as);
77310 +}
77311 +
77312 +static bool checker_addr_space_subset_p(addr_space_t subset, addr_space_t superset)
77313 +{
77314 + if (subset == ADDR_SPACE_FORCE_KERNEL && superset == ADDR_SPACE_KERNEL)
77315 + return true;
77316 +
77317 + if (subset == ADDR_SPACE_FORCE_USER && superset == ADDR_SPACE_USER)
77318 + return true;
77319 +
77320 + if (subset == ADDR_SPACE_FORCE_IOMEM && superset == ADDR_SPACE_IOMEM)
77321 + return true;
77322 +
77323 + if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_USER)
77324 + return true;
77325 +
77326 + if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_IOMEM)
77327 + return true;
77328 +
77329 + if (subset == ADDR_SPACE_USER && superset == ADDR_SPACE_FORCE_KERNEL)
77330 + return true;
77331 +
77332 + if (subset == ADDR_SPACE_IOMEM && superset == ADDR_SPACE_FORCE_KERNEL)
77333 + return true;
77334 +
77335 + return subset == superset;
77336 +}
77337 +
77338 +static rtx checker_addr_space_convert(rtx op, tree from_type, tree to_type)
77339 +{
77340 +// addr_space_t from_as = TYPE_ADDR_SPACE(TREE_TYPE(from_type));
77341 +// addr_space_t to_as = TYPE_ADDR_SPACE(TREE_TYPE(to_type));
77342 +
77343 + return op;
77344 +}
77345 +
77346 +static void register_checker_address_spaces(void *event_data, void *data)
77347 +{
77348 + c_register_addr_space("__kernel", ADDR_SPACE_KERNEL);
77349 + c_register_addr_space("__force_kernel", ADDR_SPACE_FORCE_KERNEL);
77350 + c_register_addr_space("__user", ADDR_SPACE_USER);
77351 + c_register_addr_space("__force_user", ADDR_SPACE_FORCE_USER);
77352 +// c_register_addr_space("__iomem", ADDR_SPACE_IOMEM);
77353 +// c_register_addr_space("__force_iomem", ADDR_SPACE_FORCE_IOMEM);
77354 +// c_register_addr_space("__percpu", ADDR_SPACE_PERCPU);
77355 +// c_register_addr_space("__force_percpu", ADDR_SPACE_FORCE_PERCPU);
77356 +// c_register_addr_space("__rcu", ADDR_SPACE_RCU);
77357 +// c_register_addr_space("__force_rcu", ADDR_SPACE_FORCE_RCU);
77358 +
77359 + targetm.addr_space.pointer_mode = checker_addr_space_pointer_mode;
77360 + targetm.addr_space.address_mode = checker_addr_space_address_mode;
77361 + targetm.addr_space.valid_pointer_mode = checker_addr_space_valid_pointer_mode;
77362 + targetm.addr_space.legitimate_address_p = checker_addr_space_legitimate_address_p;
77363 +// targetm.addr_space.legitimize_address = checker_addr_space_legitimize_address;
77364 + targetm.addr_space.subset_p = checker_addr_space_subset_p;
77365 + targetm.addr_space.convert = checker_addr_space_convert;
77366 +}
77367 +
77368 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
77369 +{
77370 + const char * const plugin_name = plugin_info->base_name;
77371 + const int argc = plugin_info->argc;
77372 + const struct plugin_argument * const argv = plugin_info->argv;
77373 + int i;
77374 +
77375 + if (!plugin_default_version_check(version, &gcc_version)) {
77376 + error(G_("incompatible gcc/plugin versions"));
77377 + return 1;
77378 + }
77379 +
77380 + register_callback(plugin_name, PLUGIN_INFO, NULL, &checker_plugin_info);
77381 +
77382 + for (i = 0; i < argc; ++i)
77383 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
77384 +
77385 + if (TARGET_64BIT == 0)
77386 + return 0;
77387 +
77388 + register_callback (plugin_name, PLUGIN_PRAGMAS, register_checker_address_spaces, NULL);
77389 +
77390 + return 0;
77391 +}
77392 diff -urNp linux-3.0.8/tools/gcc/constify_plugin.c linux-3.0.8/tools/gcc/constify_plugin.c
77393 --- linux-3.0.8/tools/gcc/constify_plugin.c 1969-12-31 19:00:00.000000000 -0500
77394 +++ linux-3.0.8/tools/gcc/constify_plugin.c 2011-08-30 18:23:52.000000000 -0400
77395 @@ -0,0 +1,293 @@
77396 +/*
77397 + * Copyright 2011 by Emese Revfy <re.emese@gmail.com>
77398 + * Copyright 2011 by PaX Team <pageexec@freemail.hu>
77399 + * Licensed under the GPL v2, or (at your option) v3
77400 + *
77401 + * This gcc plugin constifies all structures which contain only function pointers or are explicitly marked for constification.
77402 + *
77403 + * Homepage:
77404 + * http://www.grsecurity.net/~ephox/const_plugin/
77405 + *
77406 + * Usage:
77407 + * $ gcc -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -o constify_plugin.so constify_plugin.c
77408 + * $ gcc -fplugin=constify_plugin.so test.c -O2
77409 + */
77410 +
77411 +#include "gcc-plugin.h"
77412 +#include "config.h"
77413 +#include "system.h"
77414 +#include "coretypes.h"
77415 +#include "tree.h"
77416 +#include "tree-pass.h"
77417 +#include "intl.h"
77418 +#include "plugin-version.h"
77419 +#include "tm.h"
77420 +#include "toplev.h"
77421 +#include "function.h"
77422 +#include "tree-flow.h"
77423 +#include "plugin.h"
77424 +#include "diagnostic.h"
77425 +//#include "c-tree.h"
77426 +
77427 +#define C_TYPE_FIELDS_READONLY(TYPE) TREE_LANG_FLAG_1(TYPE)
77428 +
77429 +int plugin_is_GPL_compatible;
77430 +
77431 +static struct plugin_info const_plugin_info = {
77432 + .version = "20110826",
77433 + .help = "no-constify\tturn off constification\n",
77434 +};
77435 +
77436 +static void constify_type(tree type);
77437 +static bool walk_struct(tree node);
77438 +
77439 +static tree deconstify_type(tree old_type)
77440 +{
77441 + tree new_type, field;
77442 +
77443 + new_type = build_qualified_type(old_type, TYPE_QUALS(old_type) & ~TYPE_QUAL_CONST);
77444 + TYPE_FIELDS(new_type) = copy_list(TYPE_FIELDS(new_type));
77445 + for (field = TYPE_FIELDS(new_type); field; field = TREE_CHAIN(field))
77446 + DECL_FIELD_CONTEXT(field) = new_type;
77447 + TYPE_READONLY(new_type) = 0;
77448 + C_TYPE_FIELDS_READONLY(new_type) = 0;
77449 + return new_type;
77450 +}
77451 +
77452 +static tree handle_no_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
77453 +{
77454 + tree type;
77455 +
77456 + *no_add_attrs = true;
77457 + if (TREE_CODE(*node) == FUNCTION_DECL) {
77458 + error("%qE attribute does not apply to functions", name);
77459 + return NULL_TREE;
77460 + }
77461 +
77462 + if (TREE_CODE(*node) == VAR_DECL) {
77463 + error("%qE attribute does not apply to variables", name);
77464 + return NULL_TREE;
77465 + }
77466 +
77467 + if (TYPE_P(*node)) {
77468 + if (TREE_CODE(*node) == RECORD_TYPE || TREE_CODE(*node) == UNION_TYPE)
77469 + *no_add_attrs = false;
77470 + else
77471 + error("%qE attribute applies to struct and union types only", name);
77472 + return NULL_TREE;
77473 + }
77474 +
77475 + type = TREE_TYPE(*node);
77476 +
77477 + if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE) {
77478 + error("%qE attribute applies to struct and union types only", name);
77479 + return NULL_TREE;
77480 + }
77481 +
77482 + if (lookup_attribute(IDENTIFIER_POINTER(name), TYPE_ATTRIBUTES(type))) {
77483 + error("%qE attribute is already applied to the type", name);
77484 + return NULL_TREE;
77485 + }
77486 +
77487 + if (TREE_CODE(*node) == TYPE_DECL && !TYPE_READONLY(type)) {
77488 + error("%qE attribute used on type that is not constified", name);
77489 + return NULL_TREE;
77490 + }
77491 +
77492 + if (TREE_CODE(*node) == TYPE_DECL) {
77493 + TREE_TYPE(*node) = deconstify_type(type);
77494 + TREE_READONLY(*node) = 0;
77495 + return NULL_TREE;
77496 + }
77497 +
77498 + return NULL_TREE;
77499 +}
77500 +
77501 +static tree handle_do_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
77502 +{
77503 + *no_add_attrs = true;
77504 + if (!TYPE_P(*node)) {
77505 + error("%qE attribute applies to types only", name);
77506 + return NULL_TREE;
77507 + }
77508 +
77509 + if (TREE_CODE(*node) != RECORD_TYPE && TREE_CODE(*node) != UNION_TYPE) {
77510 + error("%qE attribute applies to struct and union types only", name);
77511 + return NULL_TREE;
77512 + }
77513 +
77514 + *no_add_attrs = false;
77515 + constify_type(*node);
77516 + return NULL_TREE;
77517 +}
77518 +
77519 +static struct attribute_spec no_const_attr = {
77520 + .name = "no_const",
77521 + .min_length = 0,
77522 + .max_length = 0,
77523 + .decl_required = false,
77524 + .type_required = false,
77525 + .function_type_required = false,
77526 + .handler = handle_no_const_attribute
77527 +};
77528 +
77529 +static struct attribute_spec do_const_attr = {
77530 + .name = "do_const",
77531 + .min_length = 0,
77532 + .max_length = 0,
77533 + .decl_required = false,
77534 + .type_required = false,
77535 + .function_type_required = false,
77536 + .handler = handle_do_const_attribute
77537 +};
77538 +
77539 +static void register_attributes(void *event_data, void *data)
77540 +{
77541 + register_attribute(&no_const_attr);
77542 + register_attribute(&do_const_attr);
77543 +}
77544 +
77545 +static void constify_type(tree type)
77546 +{
77547 + TYPE_READONLY(type) = 1;
77548 + C_TYPE_FIELDS_READONLY(type) = 1;
77549 +}
77550 +
77551 +static bool is_fptr(tree field)
77552 +{
77553 + tree ptr = TREE_TYPE(field);
77554 +
77555 + if (TREE_CODE(ptr) != POINTER_TYPE)
77556 + return false;
77557 +
77558 + return TREE_CODE(TREE_TYPE(ptr)) == FUNCTION_TYPE;
77559 +}
77560 +
77561 +static bool walk_struct(tree node)
77562 +{
77563 + tree field;
77564 +
77565 + if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node)))
77566 + return false;
77567 +
77568 + if (TYPE_FIELDS(node) == NULL_TREE)
77569 + return false;
77570 +
77571 + for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
77572 + tree type = TREE_TYPE(field);
77573 + enum tree_code code = TREE_CODE(type);
77574 + if (code == RECORD_TYPE || code == UNION_TYPE) {
77575 + if (!(walk_struct(type)))
77576 + return false;
77577 + } else if (!is_fptr(field) && !TREE_READONLY(field))
77578 + return false;
77579 + }
77580 + return true;
77581 +}
77582 +
77583 +static void finish_type(void *event_data, void *data)
77584 +{
77585 + tree type = (tree)event_data;
77586 +
77587 + if (type == NULL_TREE)
77588 + return;
77589 +
77590 + if (TYPE_READONLY(type))
77591 + return;
77592 +
77593 + if (walk_struct(type))
77594 + constify_type(type);
77595 +}
77596 +
77597 +static unsigned int check_local_variables(void);
77598 +
77599 +struct gimple_opt_pass pass_local_variable = {
77600 + {
77601 + .type = GIMPLE_PASS,
77602 + .name = "check_local_variables",
77603 + .gate = NULL,
77604 + .execute = check_local_variables,
77605 + .sub = NULL,
77606 + .next = NULL,
77607 + .static_pass_number = 0,
77608 + .tv_id = TV_NONE,
77609 + .properties_required = 0,
77610 + .properties_provided = 0,
77611 + .properties_destroyed = 0,
77612 + .todo_flags_start = 0,
77613 + .todo_flags_finish = 0
77614 + }
77615 +};
77616 +
77617 +static unsigned int check_local_variables(void)
77618 +{
77619 + tree var;
77620 + referenced_var_iterator rvi;
77621 +
77622 +#if __GNUC__ == 4 && __GNUC_MINOR__ == 5
77623 + FOR_EACH_REFERENCED_VAR(var, rvi) {
77624 +#else
77625 + FOR_EACH_REFERENCED_VAR(cfun, var, rvi) {
77626 +#endif
77627 + tree type = TREE_TYPE(var);
77628 +
77629 + if (!DECL_P(var) || TREE_STATIC(var) || DECL_EXTERNAL(var))
77630 + continue;
77631 +
77632 + if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
77633 + continue;
77634 +
77635 + if (!TYPE_READONLY(type))
77636 + continue;
77637 +
77638 +// if (lookup_attribute("no_const", DECL_ATTRIBUTES(var)))
77639 +// continue;
77640 +
77641 +// if (lookup_attribute("no_const", TYPE_ATTRIBUTES(type)))
77642 +// continue;
77643 +
77644 + if (walk_struct(type)) {
77645 + error("constified variable %qE cannot be local", var);
77646 + return 1;
77647 + }
77648 + }
77649 + return 0;
77650 +}
77651 +
77652 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
77653 +{
77654 + const char * const plugin_name = plugin_info->base_name;
77655 + const int argc = plugin_info->argc;
77656 + const struct plugin_argument * const argv = plugin_info->argv;
77657 + int i;
77658 + bool constify = true;
77659 +
77660 + struct register_pass_info local_variable_pass_info = {
77661 + .pass = &pass_local_variable.pass,
77662 + .reference_pass_name = "*referenced_vars",
77663 + .ref_pass_instance_number = 0,
77664 + .pos_op = PASS_POS_INSERT_AFTER
77665 + };
77666 +
77667 + if (!plugin_default_version_check(version, &gcc_version)) {
77668 + error(G_("incompatible gcc/plugin versions"));
77669 + return 1;
77670 + }
77671 +
77672 + for (i = 0; i < argc; ++i) {
77673 + if (!(strcmp(argv[i].key, "no-constify"))) {
77674 + constify = false;
77675 + continue;
77676 + }
77677 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
77678 + }
77679 +
77680 + register_callback(plugin_name, PLUGIN_INFO, NULL, &const_plugin_info);
77681 + if (constify) {
77682 + register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
77683 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &local_variable_pass_info);
77684 + }
77685 + register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
77686 +
77687 + return 0;
77688 +}
77689 diff -urNp linux-3.0.8/tools/gcc/kallocstat_plugin.c linux-3.0.8/tools/gcc/kallocstat_plugin.c
77690 --- linux-3.0.8/tools/gcc/kallocstat_plugin.c 1969-12-31 19:00:00.000000000 -0500
77691 +++ linux-3.0.8/tools/gcc/kallocstat_plugin.c 2011-10-06 04:17:55.000000000 -0400
77692 @@ -0,0 +1,165 @@
77693 +/*
77694 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
77695 + * Licensed under the GPL v2
77696 + *
77697 + * Note: the choice of the license means that the compilation process is
77698 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
77699 + * but for the kernel it doesn't matter since it doesn't link against
77700 + * any of the gcc libraries
77701 + *
77702 + * gcc plugin to find the distribution of k*alloc sizes
77703 + *
77704 + * TODO:
77705 + *
77706 + * BUGS:
77707 + * - none known
77708 + */
77709 +#include "gcc-plugin.h"
77710 +#include "config.h"
77711 +#include "system.h"
77712 +#include "coretypes.h"
77713 +#include "tree.h"
77714 +#include "tree-pass.h"
77715 +#include "intl.h"
77716 +#include "plugin-version.h"
77717 +#include "tm.h"
77718 +#include "toplev.h"
77719 +#include "basic-block.h"
77720 +#include "gimple.h"
77721 +//#include "expr.h" where are you...
77722 +#include "diagnostic.h"
77723 +#include "rtl.h"
77724 +#include "emit-rtl.h"
77725 +#include "function.h"
77726 +
77727 +extern void print_gimple_stmt(FILE *, gimple, int, int);
77728 +
77729 +int plugin_is_GPL_compatible;
77730 +
77731 +static const char * const kalloc_functions[] = {
77732 + "__kmalloc",
77733 + "kmalloc",
77734 + "kmalloc_large",
77735 + "kmalloc_node",
77736 + "kmalloc_order",
77737 + "kmalloc_order_trace",
77738 + "kmalloc_slab",
77739 + "kzalloc",
77740 + "kzalloc_node",
77741 +};
77742 +
77743 +static struct plugin_info kallocstat_plugin_info = {
77744 + .version = "201109121100",
77745 +};
77746 +
77747 +static unsigned int execute_kallocstat(void);
77748 +
77749 +static struct gimple_opt_pass kallocstat_pass = {
77750 + .pass = {
77751 + .type = GIMPLE_PASS,
77752 + .name = "kallocstat",
77753 + .gate = NULL,
77754 + .execute = execute_kallocstat,
77755 + .sub = NULL,
77756 + .next = NULL,
77757 + .static_pass_number = 0,
77758 + .tv_id = TV_NONE,
77759 + .properties_required = 0,
77760 + .properties_provided = 0,
77761 + .properties_destroyed = 0,
77762 + .todo_flags_start = 0,
77763 + .todo_flags_finish = 0
77764 + }
77765 +};
77766 +
77767 +static bool is_kalloc(const char *fnname)
77768 +{
77769 + size_t i;
77770 +
77771 + for (i = 0; i < ARRAY_SIZE(kalloc_functions); i++)
77772 + if (!strcmp(fnname, kalloc_functions[i]))
77773 + return true;
77774 + return false;
77775 +}
77776 +
77777 +static unsigned int execute_kallocstat(void)
77778 +{
77779 + basic_block bb;
77780 +
77781 + // 1. loop through BBs and GIMPLE statements
77782 + FOR_EACH_BB(bb) {
77783 + gimple_stmt_iterator gsi;
77784 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
77785 + // gimple match:
77786 + tree fndecl, size;
77787 + gimple call_stmt;
77788 + const char *fnname;
77789 +
77790 + // is it a call
77791 + call_stmt = gsi_stmt(gsi);
77792 + if (!is_gimple_call(call_stmt))
77793 + continue;
77794 + fndecl = gimple_call_fndecl(call_stmt);
77795 + if (fndecl == NULL_TREE)
77796 + continue;
77797 + if (TREE_CODE(fndecl) != FUNCTION_DECL)
77798 + continue;
77799 +
77800 + // is it a call to k*alloc
77801 + fnname = IDENTIFIER_POINTER(DECL_NAME(fndecl));
77802 + if (!is_kalloc(fnname))
77803 + continue;
77804 +
77805 + // is the size arg the result of a simple const assignment
77806 + size = gimple_call_arg(call_stmt, 0);
77807 + while (true) {
77808 + gimple def_stmt;
77809 + expanded_location xloc;
77810 + size_t size_val;
77811 +
77812 + if (TREE_CODE(size) != SSA_NAME)
77813 + break;
77814 + def_stmt = SSA_NAME_DEF_STMT(size);
77815 + if (!def_stmt || !is_gimple_assign(def_stmt))
77816 + break;
77817 + if (gimple_num_ops(def_stmt) != 2)
77818 + break;
77819 + size = gimple_assign_rhs1(def_stmt);
77820 + if (!TREE_CONSTANT(size))
77821 + continue;
77822 + xloc = expand_location(gimple_location(def_stmt));
77823 + if (!xloc.file)
77824 + xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl));
77825 + size_val = TREE_INT_CST_LOW(size);
77826 + fprintf(stderr, "kallocsize: %8zu %8zx %s %s:%u\n", size_val, size_val, fnname, xloc.file, xloc.line);
77827 + break;
77828 + }
77829 +//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
77830 +//debug_tree(gimple_call_fn(call_stmt));
77831 +//print_node(stderr, "pax", fndecl, 4);
77832 + }
77833 + }
77834 +
77835 + return 0;
77836 +}
77837 +
77838 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
77839 +{
77840 + const char * const plugin_name = plugin_info->base_name;
77841 + struct register_pass_info kallocstat_pass_info = {
77842 + .pass = &kallocstat_pass.pass,
77843 + .reference_pass_name = "ssa",
77844 + .ref_pass_instance_number = 0,
77845 + .pos_op = PASS_POS_INSERT_AFTER
77846 + };
77847 +
77848 + if (!plugin_default_version_check(version, &gcc_version)) {
77849 + error(G_("incompatible gcc/plugin versions"));
77850 + return 1;
77851 + }
77852 +
77853 + register_callback(plugin_name, PLUGIN_INFO, NULL, &kallocstat_plugin_info);
77854 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kallocstat_pass_info);
77855 +
77856 + return 0;
77857 +}
77858 diff -urNp linux-3.0.8/tools/gcc/kernexec_plugin.c linux-3.0.8/tools/gcc/kernexec_plugin.c
77859 --- linux-3.0.8/tools/gcc/kernexec_plugin.c 1969-12-31 19:00:00.000000000 -0500
77860 +++ linux-3.0.8/tools/gcc/kernexec_plugin.c 2011-10-06 04:17:55.000000000 -0400
77861 @@ -0,0 +1,273 @@
77862 +/*
77863 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
77864 + * Licensed under the GPL v2
77865 + *
77866 + * Note: the choice of the license means that the compilation process is
77867 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
77868 + * but for the kernel it doesn't matter since it doesn't link against
77869 + * any of the gcc libraries
77870 + *
77871 + * gcc plugin to make KERNEXEC/amd64 almost as good as it is on i386
77872 + *
77873 + * TODO:
77874 + *
77875 + * BUGS:
77876 + * - none known
77877 + */
77878 +#include "gcc-plugin.h"
77879 +#include "config.h"
77880 +#include "system.h"
77881 +#include "coretypes.h"
77882 +#include "tree.h"
77883 +#include "tree-pass.h"
77884 +#include "intl.h"
77885 +#include "plugin-version.h"
77886 +#include "tm.h"
77887 +#include "toplev.h"
77888 +#include "basic-block.h"
77889 +#include "gimple.h"
77890 +//#include "expr.h" where are you...
77891 +#include "diagnostic.h"
77892 +#include "rtl.h"
77893 +#include "emit-rtl.h"
77894 +#include "function.h"
77895 +#include "tree-flow.h"
77896 +
77897 +extern void print_gimple_stmt(FILE *, gimple, int, int);
77898 +extern rtx emit_move_insn(rtx x, rtx y);
77899 +
77900 +int plugin_is_GPL_compatible;
77901 +
77902 +static struct plugin_info kernexec_plugin_info = {
77903 + .version = "201110032145",
77904 +};
77905 +
77906 +static unsigned int execute_kernexec_fptr(void);
77907 +static unsigned int execute_kernexec_retaddr(void);
77908 +static bool kernexec_cmodel_check(void);
77909 +
77910 +static struct gimple_opt_pass kernexec_fptr_pass = {
77911 + .pass = {
77912 + .type = GIMPLE_PASS,
77913 + .name = "kernexec_fptr",
77914 + .gate = kernexec_cmodel_check,
77915 + .execute = execute_kernexec_fptr,
77916 + .sub = NULL,
77917 + .next = NULL,
77918 + .static_pass_number = 0,
77919 + .tv_id = TV_NONE,
77920 + .properties_required = 0,
77921 + .properties_provided = 0,
77922 + .properties_destroyed = 0,
77923 + .todo_flags_start = 0,
77924 + .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi
77925 + }
77926 +};
77927 +
77928 +static struct rtl_opt_pass kernexec_retaddr_pass = {
77929 + .pass = {
77930 + .type = RTL_PASS,
77931 + .name = "kernexec_retaddr",
77932 + .gate = kernexec_cmodel_check,
77933 + .execute = execute_kernexec_retaddr,
77934 + .sub = NULL,
77935 + .next = NULL,
77936 + .static_pass_number = 0,
77937 + .tv_id = TV_NONE,
77938 + .properties_required = 0,
77939 + .properties_provided = 0,
77940 + .properties_destroyed = 0,
77941 + .todo_flags_start = 0,
77942 + .todo_flags_finish = TODO_dump_func | TODO_ggc_collect
77943 + }
77944 +};
77945 +
77946 +static bool kernexec_cmodel_check(void)
77947 +{
77948 + tree section;
77949 +
77950 + if (ix86_cmodel != CM_KERNEL)
77951 + return false;
77952 +
77953 + section = lookup_attribute("__section__", DECL_ATTRIBUTES(current_function_decl));
77954 + if (!section || !TREE_VALUE(section))
77955 + return true;
77956 +
77957 + section = TREE_VALUE(TREE_VALUE(section));
77958 + if (strncmp(TREE_STRING_POINTER(section), ".vsyscall_", 10))
77959 + return true;
77960 +
77961 + return false;
77962 +}
77963 +
77964 +/*
77965 + * add special KERNEXEC instrumentation: force MSB of fptr to 1, which will produce
77966 + * a non-canonical address from a userland ptr and will just trigger a GPF on dereference
77967 + */
77968 +static void kernexec_instrument_fptr(gimple_stmt_iterator gsi)
77969 +{
77970 + gimple assign_intptr, assign_new_fptr, call_stmt;
77971 + tree intptr, old_fptr, new_fptr, kernexec_mask;
77972 +
77973 + call_stmt = gsi_stmt(gsi);
77974 + old_fptr = gimple_call_fn(call_stmt);
77975 +
77976 + // create temporary unsigned long variable used for bitops and cast fptr to it
77977 + intptr = create_tmp_var(long_unsigned_type_node, NULL);
77978 + add_referenced_var(intptr);
77979 + mark_sym_for_renaming(intptr);
77980 + assign_intptr = gimple_build_assign(intptr, fold_convert(long_unsigned_type_node, old_fptr));
77981 + update_stmt(assign_intptr);
77982 + gsi_insert_before(&gsi, assign_intptr, GSI_SAME_STMT);
77983 +
77984 + // apply logical or to temporary unsigned long and bitmask
77985 + kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0x8000000000000000LL);
77986 +// kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0xffffffff80000000LL);
77987 + assign_intptr = gimple_build_assign(intptr, fold_build2(BIT_IOR_EXPR, long_long_unsigned_type_node, intptr, kernexec_mask));
77988 + update_stmt(assign_intptr);
77989 + gsi_insert_before(&gsi, assign_intptr, GSI_SAME_STMT);
77990 +
77991 + // cast temporary unsigned long back to a temporary fptr variable
77992 + new_fptr = create_tmp_var(TREE_TYPE(old_fptr), NULL);
77993 + add_referenced_var(new_fptr);
77994 + mark_sym_for_renaming(new_fptr);
77995 + assign_new_fptr = gimple_build_assign(new_fptr, fold_convert(TREE_TYPE(old_fptr), intptr));
77996 + update_stmt(assign_new_fptr);
77997 + gsi_insert_before(&gsi, assign_new_fptr, GSI_SAME_STMT);
77998 +
77999 + // replace call stmt fn with the new fptr
78000 + gimple_call_set_fn(call_stmt, new_fptr);
78001 + update_stmt(call_stmt);
78002 +}
78003 +
78004 +/*
78005 + * find all C level function pointer dereferences and forcibly set the highest bit of the pointer
78006 + */
78007 +static unsigned int execute_kernexec_fptr(void)
78008 +{
78009 + basic_block bb;
78010 + gimple_stmt_iterator gsi;
78011 +
78012 + // 1. loop through BBs and GIMPLE statements
78013 + FOR_EACH_BB(bb) {
78014 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
78015 + // gimple match: h_1 = get_fptr (); D.2709_3 = h_1 (x_2(D));
78016 + tree fn;
78017 + gimple call_stmt;
78018 +
78019 + // is it a call ...
78020 + call_stmt = gsi_stmt(gsi);
78021 + if (!is_gimple_call(call_stmt))
78022 + continue;
78023 + fn = gimple_call_fn(call_stmt);
78024 + if (TREE_CODE(fn) == ADDR_EXPR)
78025 + continue;
78026 + if (TREE_CODE(fn) != SSA_NAME)
78027 + gcc_unreachable();
78028 +
78029 + // ... through a function pointer
78030 + fn = SSA_NAME_VAR(fn);
78031 + if (TREE_CODE(fn) != VAR_DECL && TREE_CODE(fn) != PARM_DECL)
78032 + continue;
78033 + fn = TREE_TYPE(fn);
78034 + if (TREE_CODE(fn) != POINTER_TYPE)
78035 + continue;
78036 + fn = TREE_TYPE(fn);
78037 + if (TREE_CODE(fn) != FUNCTION_TYPE)
78038 + continue;
78039 +
78040 + kernexec_instrument_fptr(gsi);
78041 +
78042 +//debug_tree(gimple_call_fn(call_stmt));
78043 +//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
78044 + }
78045 + }
78046 +
78047 + return 0;
78048 +}
78049 +
78050 +// add special KERNEXEC instrumentation: btsq $63,(%rsp) just before retn
78051 +static void kernexec_instrument_retaddr(rtx insn)
78052 +{
78053 + rtx btsq;
78054 + rtvec argvec, constraintvec, labelvec;
78055 + int line;
78056 +
78057 + // create asm volatile("btsq $63,(%%rsp)":::)
78058 + argvec = rtvec_alloc(0);
78059 + constraintvec = rtvec_alloc(0);
78060 + labelvec = rtvec_alloc(0);
78061 + line = expand_location(RTL_LOCATION(insn)).line;
78062 + btsq = gen_rtx_ASM_OPERANDS(VOIDmode, "btsq $63,(%%rsp)", empty_string, 0, argvec, constraintvec, labelvec, line);
78063 + MEM_VOLATILE_P(btsq) = 1;
78064 + RTX_FRAME_RELATED_P(btsq) = 1;
78065 + emit_insn_before(btsq, insn);
78066 +}
78067 +
78068 +/*
78069 + * find all asm level function returns and forcibly set the highest bit of the return address
78070 + */
78071 +static unsigned int execute_kernexec_retaddr(void)
78072 +{
78073 + rtx insn;
78074 +
78075 + // 1. find function returns
78076 + for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
78077 + // rtl match: (jump_insn 41 40 42 2 (return) fptr.c:42 634 {return_internal} (nil))
78078 + // (jump_insn 12 9 11 2 (parallel [ (return) (unspec [ (0) ] UNSPEC_REP) ]) fptr.c:46 635 {return_internal_long} (nil))
78079 + rtx body;
78080 +
78081 + // is it a retn
78082 + if (!JUMP_P(insn))
78083 + continue;
78084 + body = PATTERN(insn);
78085 + if (GET_CODE(body) == PARALLEL)
78086 + body = XVECEXP(body, 0, 0);
78087 + if (GET_CODE(body) != RETURN)
78088 + continue;
78089 + kernexec_instrument_retaddr(insn);
78090 + }
78091 +
78092 +// print_simple_rtl(stderr, get_insns());
78093 +// print_rtl(stderr, get_insns());
78094 +
78095 + return 0;
78096 +}
78097 +
78098 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
78099 +{
78100 + const char * const plugin_name = plugin_info->base_name;
78101 + const int argc = plugin_info->argc;
78102 + const struct plugin_argument * const argv = plugin_info->argv;
78103 + int i;
78104 + struct register_pass_info kernexec_fptr_pass_info = {
78105 + .pass = &kernexec_fptr_pass.pass,
78106 + .reference_pass_name = "ssa",
78107 + .ref_pass_instance_number = 0,
78108 + .pos_op = PASS_POS_INSERT_AFTER
78109 + };
78110 + struct register_pass_info kernexec_retaddr_pass_info = {
78111 + .pass = &kernexec_retaddr_pass.pass,
78112 + .reference_pass_name = "pro_and_epilogue",
78113 + .ref_pass_instance_number = 0,
78114 + .pos_op = PASS_POS_INSERT_AFTER
78115 + };
78116 +
78117 + if (!plugin_default_version_check(version, &gcc_version)) {
78118 + error(G_("incompatible gcc/plugin versions"));
78119 + return 1;
78120 + }
78121 +
78122 + register_callback(plugin_name, PLUGIN_INFO, NULL, &kernexec_plugin_info);
78123 +
78124 + for (i = 0; i < argc; ++i)
78125 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
78126 +
78127 + if (TARGET_64BIT == 0)
78128 + return 0;
78129 +
78130 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_fptr_pass_info);
78131 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_retaddr_pass_info);
78132 +
78133 + return 0;
78134 +}
78135 diff -urNp linux-3.0.8/tools/gcc/Makefile linux-3.0.8/tools/gcc/Makefile
78136 --- linux-3.0.8/tools/gcc/Makefile 1969-12-31 19:00:00.000000000 -0500
78137 +++ linux-3.0.8/tools/gcc/Makefile 2011-10-06 04:17:55.000000000 -0400
78138 @@ -0,0 +1,21 @@
78139 +#CC := gcc
78140 +#PLUGIN_SOURCE_FILES := pax_plugin.c
78141 +#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES))
78142 +GCCPLUGINS_DIR := $(shell $(HOSTCC) -print-file-name=plugin)
78143 +#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W
78144 +
78145 +HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include
78146 +
78147 +hostlibs-y := constify_plugin.so
78148 +hostlibs-$(CONFIG_PAX_MEMORY_STACKLEAK) += stackleak_plugin.so
78149 +hostlibs-$(CONFIG_KALLOCSTAT_PLUGIN) += kallocstat_plugin.so
78150 +hostlibs-$(CONFIG_PAX_KERNEXEC_PLUGIN) += kernexec_plugin.so
78151 +hostlibs-$(CONFIG_CHECKER_PLUGIN) += checker_plugin.so
78152 +
78153 +always := $(hostlibs-y)
78154 +
78155 +stackleak_plugin-objs := stackleak_plugin.o
78156 +constify_plugin-objs := constify_plugin.o
78157 +kallocstat_plugin-objs := kallocstat_plugin.o
78158 +kernexec_plugin-objs := kernexec_plugin.o
78159 +checker_plugin-objs := checker_plugin.o
78160 diff -urNp linux-3.0.8/tools/gcc/stackleak_plugin.c linux-3.0.8/tools/gcc/stackleak_plugin.c
78161 --- linux-3.0.8/tools/gcc/stackleak_plugin.c 1969-12-31 19:00:00.000000000 -0500
78162 +++ linux-3.0.8/tools/gcc/stackleak_plugin.c 2011-09-17 00:53:44.000000000 -0400
78163 @@ -0,0 +1,251 @@
78164 +/*
78165 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
78166 + * Licensed under the GPL v2
78167 + *
78168 + * Note: the choice of the license means that the compilation process is
78169 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
78170 + * but for the kernel it doesn't matter since it doesn't link against
78171 + * any of the gcc libraries
78172 + *
78173 + * gcc plugin to help implement various PaX features
78174 + *
78175 + * - track lowest stack pointer
78176 + *
78177 + * TODO:
78178 + * - initialize all local variables
78179 + *
78180 + * BUGS:
78181 + * - none known
78182 + */
78183 +#include "gcc-plugin.h"
78184 +#include "config.h"
78185 +#include "system.h"
78186 +#include "coretypes.h"
78187 +#include "tree.h"
78188 +#include "tree-pass.h"
78189 +#include "intl.h"
78190 +#include "plugin-version.h"
78191 +#include "tm.h"
78192 +#include "toplev.h"
78193 +#include "basic-block.h"
78194 +#include "gimple.h"
78195 +//#include "expr.h" where are you...
78196 +#include "diagnostic.h"
78197 +#include "rtl.h"
78198 +#include "emit-rtl.h"
78199 +#include "function.h"
78200 +
78201 +int plugin_is_GPL_compatible;
78202 +
78203 +static int track_frame_size = -1;
78204 +static const char track_function[] = "pax_track_stack";
78205 +static bool init_locals;
78206 +
78207 +static struct plugin_info stackleak_plugin_info = {
78208 + .version = "201109112100",
78209 + .help = "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n"
78210 +// "initialize-locals\t\tforcibly initialize all stack frames\n"
78211 +};
78212 +
78213 +static bool gate_stackleak_track_stack(void);
78214 +static unsigned int execute_stackleak_tree_instrument(void);
78215 +static unsigned int execute_stackleak_final(void);
78216 +
78217 +static struct gimple_opt_pass stackleak_tree_instrument_pass = {
78218 + .pass = {
78219 + .type = GIMPLE_PASS,
78220 + .name = "stackleak_tree_instrument",
78221 + .gate = gate_stackleak_track_stack,
78222 + .execute = execute_stackleak_tree_instrument,
78223 + .sub = NULL,
78224 + .next = NULL,
78225 + .static_pass_number = 0,
78226 + .tv_id = TV_NONE,
78227 + .properties_required = PROP_gimple_leh | PROP_cfg,
78228 + .properties_provided = 0,
78229 + .properties_destroyed = 0,
78230 + .todo_flags_start = 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts,
78231 + .todo_flags_finish = TODO_verify_stmts | TODO_dump_func
78232 + }
78233 +};
78234 +
78235 +static struct rtl_opt_pass stackleak_final_rtl_opt_pass = {
78236 + .pass = {
78237 + .type = RTL_PASS,
78238 + .name = "stackleak_final",
78239 + .gate = gate_stackleak_track_stack,
78240 + .execute = execute_stackleak_final,
78241 + .sub = NULL,
78242 + .next = NULL,
78243 + .static_pass_number = 0,
78244 + .tv_id = TV_NONE,
78245 + .properties_required = 0,
78246 + .properties_provided = 0,
78247 + .properties_destroyed = 0,
78248 + .todo_flags_start = 0,
78249 + .todo_flags_finish = TODO_dump_func
78250 + }
78251 +};
78252 +
78253 +static bool gate_stackleak_track_stack(void)
78254 +{
78255 + return track_frame_size >= 0;
78256 +}
78257 +
78258 +static void stackleak_add_instrumentation(gimple_stmt_iterator *gsi, bool before)
78259 +{
78260 + gimple call;
78261 + tree fndecl, type;
78262 +
78263 + // insert call to void pax_track_stack(void)
78264 + type = build_function_type_list(void_type_node, NULL_TREE);
78265 + fndecl = build_fn_decl(track_function, type);
78266 + DECL_ASSEMBLER_NAME(fndecl); // for LTO
78267 + call = gimple_build_call(fndecl, 0);
78268 + if (before)
78269 + gsi_insert_before(gsi, call, GSI_CONTINUE_LINKING);
78270 + else
78271 + gsi_insert_after(gsi, call, GSI_CONTINUE_LINKING);
78272 +}
78273 +
78274 +static unsigned int execute_stackleak_tree_instrument(void)
78275 +{
78276 + basic_block bb, entry_bb;
78277 + gimple_stmt_iterator gsi;
78278 + bool prologue_instrumented = false;
78279 +
78280 + entry_bb = ENTRY_BLOCK_PTR_FOR_FUNCTION(cfun)->next_bb;
78281 +
78282 + // 1. loop through BBs and GIMPLE statements
78283 + FOR_EACH_BB(bb) {
78284 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
78285 + // gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes <tree_list 0xb7576450>
78286 + tree fndecl;
78287 + gimple stmt = gsi_stmt(gsi);
78288 +
78289 + if (!is_gimple_call(stmt))
78290 + continue;
78291 + fndecl = gimple_call_fndecl(stmt);
78292 + if (!fndecl)
78293 + continue;
78294 + if (TREE_CODE(fndecl) != FUNCTION_DECL)
78295 + continue;
78296 + if (!DECL_BUILT_IN(fndecl))
78297 + continue;
78298 + if (DECL_BUILT_IN_CLASS(fndecl) != BUILT_IN_NORMAL)
78299 + continue;
78300 + if (DECL_FUNCTION_CODE(fndecl) != BUILT_IN_ALLOCA)
78301 + continue;
78302 +
78303 + // 2. insert track call after each __builtin_alloca call
78304 + stackleak_add_instrumentation(&gsi, false);
78305 + if (bb == entry_bb)
78306 + prologue_instrumented = true;
78307 +// print_node(stderr, "pax", fndecl, 4);
78308 + }
78309 + }
78310 +
78311 + // 3. insert track call at the beginning
78312 + if (!prologue_instrumented) {
78313 + gsi = gsi_start_bb(entry_bb);
78314 + stackleak_add_instrumentation(&gsi, true);
78315 + }
78316 +
78317 + return 0;
78318 +}
78319 +
78320 +static unsigned int execute_stackleak_final(void)
78321 +{
78322 + rtx insn;
78323 +
78324 + if (cfun->calls_alloca)
78325 + return 0;
78326 +
78327 + // keep calls only if function frame is big enough
78328 + if (get_frame_size() >= track_frame_size)
78329 + return 0;
78330 +
78331 + // 1. find pax_track_stack calls
78332 + for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
78333 + // rtl match: (call_insn 8 7 9 3 (call (mem (symbol_ref ("pax_track_stack") [flags 0x41] <function_decl 0xb7470e80 pax_track_stack>) [0 S1 A8]) (4)) -1 (nil) (nil))
78334 + rtx body;
78335 +
78336 + if (!CALL_P(insn))
78337 + continue;
78338 + body = PATTERN(insn);
78339 + if (GET_CODE(body) != CALL)
78340 + continue;
78341 + body = XEXP(body, 0);
78342 + if (GET_CODE(body) != MEM)
78343 + continue;
78344 + body = XEXP(body, 0);
78345 + if (GET_CODE(body) != SYMBOL_REF)
78346 + continue;
78347 + if (strcmp(XSTR(body, 0), track_function))
78348 + continue;
78349 +// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
78350 + // 2. delete call
78351 + delete_insn_and_edges(insn);
78352 + }
78353 +
78354 +// print_simple_rtl(stderr, get_insns());
78355 +// print_rtl(stderr, get_insns());
78356 +// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
78357 +
78358 + return 0;
78359 +}
78360 +
78361 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
78362 +{
78363 + const char * const plugin_name = plugin_info->base_name;
78364 + const int argc = plugin_info->argc;
78365 + const struct plugin_argument * const argv = plugin_info->argv;
78366 + int i;
78367 + struct register_pass_info stackleak_tree_instrument_pass_info = {
78368 + .pass = &stackleak_tree_instrument_pass.pass,
78369 +// .reference_pass_name = "tree_profile",
78370 + .reference_pass_name = "optimized",
78371 + .ref_pass_instance_number = 0,
78372 + .pos_op = PASS_POS_INSERT_AFTER
78373 + };
78374 + struct register_pass_info stackleak_final_pass_info = {
78375 + .pass = &stackleak_final_rtl_opt_pass.pass,
78376 + .reference_pass_name = "final",
78377 + .ref_pass_instance_number = 0,
78378 + .pos_op = PASS_POS_INSERT_BEFORE
78379 + };
78380 +
78381 + if (!plugin_default_version_check(version, &gcc_version)) {
78382 + error(G_("incompatible gcc/plugin versions"));
78383 + return 1;
78384 + }
78385 +
78386 + register_callback(plugin_name, PLUGIN_INFO, NULL, &stackleak_plugin_info);
78387 +
78388 + for (i = 0; i < argc; ++i) {
78389 + if (!strcmp(argv[i].key, "track-lowest-sp")) {
78390 + if (!argv[i].value) {
78391 + error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
78392 + continue;
78393 + }
78394 + track_frame_size = atoi(argv[i].value);
78395 + if (argv[i].value[0] < '0' || argv[i].value[0] > '9' || track_frame_size < 0)
78396 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
78397 + continue;
78398 + }
78399 + if (!strcmp(argv[i].key, "initialize-locals")) {
78400 + if (argv[i].value) {
78401 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
78402 + continue;
78403 + }
78404 + init_locals = true;
78405 + continue;
78406 + }
78407 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
78408 + }
78409 +
78410 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_tree_instrument_pass_info);
78411 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_final_pass_info);
78412 +
78413 + return 0;
78414 +}
78415 diff -urNp linux-3.0.8/tools/perf/util/include/asm/alternative-asm.h linux-3.0.8/tools/perf/util/include/asm/alternative-asm.h
78416 --- linux-3.0.8/tools/perf/util/include/asm/alternative-asm.h 2011-07-21 22:17:23.000000000 -0400
78417 +++ linux-3.0.8/tools/perf/util/include/asm/alternative-asm.h 2011-10-20 04:46:01.000000000 -0400
78418 @@ -5,4 +5,7 @@
78419
78420 #define altinstruction_entry #
78421
78422 + .macro pax_force_retaddr rip=0
78423 + .endm
78424 +
78425 #endif
78426 diff -urNp linux-3.0.8/usr/gen_init_cpio.c linux-3.0.8/usr/gen_init_cpio.c
78427 --- linux-3.0.8/usr/gen_init_cpio.c 2011-07-21 22:17:23.000000000 -0400
78428 +++ linux-3.0.8/usr/gen_init_cpio.c 2011-08-23 21:47:56.000000000 -0400
78429 @@ -303,7 +303,7 @@ static int cpio_mkfile(const char *name,
78430 int retval;
78431 int rc = -1;
78432 int namesize;
78433 - int i;
78434 + unsigned int i;
78435
78436 mode |= S_IFREG;
78437
78438 @@ -392,9 +392,10 @@ static char *cpio_replace_env(char *new_
78439 *env_var = *expanded = '\0';
78440 strncat(env_var, start + 2, end - start - 2);
78441 strncat(expanded, new_location, start - new_location);
78442 - strncat(expanded, getenv(env_var), PATH_MAX);
78443 - strncat(expanded, end + 1, PATH_MAX);
78444 + strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
78445 + strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
78446 strncpy(new_location, expanded, PATH_MAX);
78447 + new_location[PATH_MAX] = 0;
78448 } else
78449 break;
78450 }
78451 diff -urNp linux-3.0.8/virt/kvm/kvm_main.c linux-3.0.8/virt/kvm/kvm_main.c
78452 --- linux-3.0.8/virt/kvm/kvm_main.c 2011-07-21 22:17:23.000000000 -0400
78453 +++ linux-3.0.8/virt/kvm/kvm_main.c 2011-08-23 21:47:56.000000000 -0400
78454 @@ -73,7 +73,7 @@ LIST_HEAD(vm_list);
78455
78456 static cpumask_var_t cpus_hardware_enabled;
78457 static int kvm_usage_count = 0;
78458 -static atomic_t hardware_enable_failed;
78459 +static atomic_unchecked_t hardware_enable_failed;
78460
78461 struct kmem_cache *kvm_vcpu_cache;
78462 EXPORT_SYMBOL_GPL(kvm_vcpu_cache);
78463 @@ -2176,7 +2176,7 @@ static void hardware_enable_nolock(void
78464
78465 if (r) {
78466 cpumask_clear_cpu(cpu, cpus_hardware_enabled);
78467 - atomic_inc(&hardware_enable_failed);
78468 + atomic_inc_unchecked(&hardware_enable_failed);
78469 printk(KERN_INFO "kvm: enabling virtualization on "
78470 "CPU%d failed\n", cpu);
78471 }
78472 @@ -2230,10 +2230,10 @@ static int hardware_enable_all(void)
78473
78474 kvm_usage_count++;
78475 if (kvm_usage_count == 1) {
78476 - atomic_set(&hardware_enable_failed, 0);
78477 + atomic_set_unchecked(&hardware_enable_failed, 0);
78478 on_each_cpu(hardware_enable_nolock, NULL, 1);
78479
78480 - if (atomic_read(&hardware_enable_failed)) {
78481 + if (atomic_read_unchecked(&hardware_enable_failed)) {
78482 hardware_disable_all_nolock();
78483 r = -EBUSY;
78484 }
78485 @@ -2498,7 +2498,7 @@ static void kvm_sched_out(struct preempt
78486 kvm_arch_vcpu_put(vcpu);
78487 }
78488
78489 -int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
78490 +int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
78491 struct module *module)
78492 {
78493 int r;
78494 @@ -2561,7 +2561,7 @@ int kvm_init(void *opaque, unsigned vcpu
78495 if (!vcpu_align)
78496 vcpu_align = __alignof__(struct kvm_vcpu);
78497 kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align,
78498 - 0, NULL);
78499 + SLAB_USERCOPY, NULL);
78500 if (!kvm_vcpu_cache) {
78501 r = -ENOMEM;
78502 goto out_free_3;
78503 @@ -2571,9 +2571,11 @@ int kvm_init(void *opaque, unsigned vcpu
78504 if (r)
78505 goto out_free;
78506
78507 - kvm_chardev_ops.owner = module;
78508 - kvm_vm_fops.owner = module;
78509 - kvm_vcpu_fops.owner = module;
78510 + pax_open_kernel();
78511 + *(void **)&kvm_chardev_ops.owner = module;
78512 + *(void **)&kvm_vm_fops.owner = module;
78513 + *(void **)&kvm_vcpu_fops.owner = module;
78514 + pax_close_kernel();
78515
78516 r = misc_register(&kvm_dev);
78517 if (r) {
Unofficial grsecurity patch archive (https://github.com/slashbeast/grsecurity-scrape)