]> git.ipfire.org Git - thirdparty/grsecurity-scrape.git/blob - test/grsecurity-2.2.2-3.0.9-201111161802.patch
projects / thirdparty / grsecurity-scrape.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Auto commit, 1 new patch{es}.
[thirdparty/grsecurity-scrape.git] / test / grsecurity-2.2.2-3.0.9-201111161802.patch
1 diff -urNp linux-3.0.9/arch/alpha/include/asm/elf.h linux-3.0.9/arch/alpha/include/asm/elf.h
2 --- linux-3.0.9/arch/alpha/include/asm/elf.h 2011-11-11 13:12:24.000000000 -0500
3 +++ linux-3.0.9/arch/alpha/include/asm/elf.h 2011-11-15 20:02:59.000000000 -0500
4 @@ -90,6 +90,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
5
6 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
7
8 +#ifdef CONFIG_PAX_ASLR
9 +#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
10 +
11 +#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
12 +#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
13 +#endif
14 +
15 /* $0 is set by ld.so to a pointer to a function which might be
16 registered using atexit. This provides a mean for the dynamic
17 linker to call DT_FINI functions for shared libraries that have
18 diff -urNp linux-3.0.9/arch/alpha/include/asm/pgtable.h linux-3.0.9/arch/alpha/include/asm/pgtable.h
19 --- linux-3.0.9/arch/alpha/include/asm/pgtable.h 2011-11-11 13:12:24.000000000 -0500
20 +++ linux-3.0.9/arch/alpha/include/asm/pgtable.h 2011-11-15 20:02:59.000000000 -0500
21 @@ -101,6 +101,17 @@ struct vm_area_struct;
22 #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
23 #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
24 #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
25 +
26 +#ifdef CONFIG_PAX_PAGEEXEC
27 +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
28 +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
29 +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
30 +#else
31 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
32 +# define PAGE_COPY_NOEXEC PAGE_COPY
33 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
34 +#endif
35 +
36 #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
37
38 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
39 diff -urNp linux-3.0.9/arch/alpha/kernel/module.c linux-3.0.9/arch/alpha/kernel/module.c
40 --- linux-3.0.9/arch/alpha/kernel/module.c 2011-11-11 13:12:24.000000000 -0500
41 +++ linux-3.0.9/arch/alpha/kernel/module.c 2011-11-15 20:02:59.000000000 -0500
42 @@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs,
43
44 /* The small sections were sorted to the end of the segment.
45 The following should definitely cover them. */
46 - gp = (u64)me->module_core + me->core_size - 0x8000;
47 + gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
48 got = sechdrs[me->arch.gotsecindex].sh_addr;
49
50 for (i = 0; i < n; i++) {
51 diff -urNp linux-3.0.9/arch/alpha/kernel/osf_sys.c linux-3.0.9/arch/alpha/kernel/osf_sys.c
52 --- linux-3.0.9/arch/alpha/kernel/osf_sys.c 2011-11-11 13:12:24.000000000 -0500
53 +++ linux-3.0.9/arch/alpha/kernel/osf_sys.c 2011-11-15 20:02:59.000000000 -0500
54 @@ -1145,7 +1145,7 @@ arch_get_unmapped_area_1(unsigned long a
55 /* At this point: (!vma || addr < vma->vm_end). */
56 if (limit - len < addr)
57 return -ENOMEM;
58 - if (!vma || addr + len <= vma->vm_start)
59 + if (check_heap_stack_gap(vma, addr, len))
60 return addr;
61 addr = vma->vm_end;
62 vma = vma->vm_next;
63 @@ -1181,6 +1181,10 @@ arch_get_unmapped_area(struct file *filp
64 merely specific addresses, but regions of memory -- perhaps
65 this feature should be incorporated into all ports? */
66
67 +#ifdef CONFIG_PAX_RANDMMAP
68 + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
69 +#endif
70 +
71 if (addr) {
72 addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
73 if (addr != (unsigned long) -ENOMEM)
74 @@ -1188,8 +1192,8 @@ arch_get_unmapped_area(struct file *filp
75 }
76
77 /* Next, try allocating at TASK_UNMAPPED_BASE. */
78 - addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
79 - len, limit);
80 + addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
81 +
82 if (addr != (unsigned long) -ENOMEM)
83 return addr;
84
85 diff -urNp linux-3.0.9/arch/alpha/mm/fault.c linux-3.0.9/arch/alpha/mm/fault.c
86 --- linux-3.0.9/arch/alpha/mm/fault.c 2011-11-11 13:12:24.000000000 -0500
87 +++ linux-3.0.9/arch/alpha/mm/fault.c 2011-11-15 20:02:59.000000000 -0500
88 @@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
89 __reload_thread(pcb);
90 }
91
92 +#ifdef CONFIG_PAX_PAGEEXEC
93 +/*
94 + * PaX: decide what to do with offenders (regs->pc = fault address)
95 + *
96 + * returns 1 when task should be killed
97 + * 2 when patched PLT trampoline was detected
98 + * 3 when unpatched PLT trampoline was detected
99 + */
100 +static int pax_handle_fetch_fault(struct pt_regs *regs)
101 +{
102 +
103 +#ifdef CONFIG_PAX_EMUPLT
104 + int err;
105 +
106 + do { /* PaX: patched PLT emulation #1 */
107 + unsigned int ldah, ldq, jmp;
108 +
109 + err = get_user(ldah, (unsigned int *)regs->pc);
110 + err |= get_user(ldq, (unsigned int *)(regs->pc+4));
111 + err |= get_user(jmp, (unsigned int *)(regs->pc+8));
112 +
113 + if (err)
114 + break;
115 +
116 + if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
117 + (ldq & 0xFFFF0000U) == 0xA77B0000U &&
118 + jmp == 0x6BFB0000U)
119 + {
120 + unsigned long r27, addr;
121 + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
122 + unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
123 +
124 + addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
125 + err = get_user(r27, (unsigned long *)addr);
126 + if (err)
127 + break;
128 +
129 + regs->r27 = r27;
130 + regs->pc = r27;
131 + return 2;
132 + }
133 + } while (0);
134 +
135 + do { /* PaX: patched PLT emulation #2 */
136 + unsigned int ldah, lda, br;
137 +
138 + err = get_user(ldah, (unsigned int *)regs->pc);
139 + err |= get_user(lda, (unsigned int *)(regs->pc+4));
140 + err |= get_user(br, (unsigned int *)(regs->pc+8));
141 +
142 + if (err)
143 + break;
144 +
145 + if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
146 + (lda & 0xFFFF0000U) == 0xA77B0000U &&
147 + (br & 0xFFE00000U) == 0xC3E00000U)
148 + {
149 + unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
150 + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
151 + unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
152 +
153 + regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
154 + regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
155 + return 2;
156 + }
157 + } while (0);
158 +
159 + do { /* PaX: unpatched PLT emulation */
160 + unsigned int br;
161 +
162 + err = get_user(br, (unsigned int *)regs->pc);
163 +
164 + if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
165 + unsigned int br2, ldq, nop, jmp;
166 + unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
167 +
168 + addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
169 + err = get_user(br2, (unsigned int *)addr);
170 + err |= get_user(ldq, (unsigned int *)(addr+4));
171 + err |= get_user(nop, (unsigned int *)(addr+8));
172 + err |= get_user(jmp, (unsigned int *)(addr+12));
173 + err |= get_user(resolver, (unsigned long *)(addr+16));
174 +
175 + if (err)
176 + break;
177 +
178 + if (br2 == 0xC3600000U &&
179 + ldq == 0xA77B000CU &&
180 + nop == 0x47FF041FU &&
181 + jmp == 0x6B7B0000U)
182 + {
183 + regs->r28 = regs->pc+4;
184 + regs->r27 = addr+16;
185 + regs->pc = resolver;
186 + return 3;
187 + }
188 + }
189 + } while (0);
190 +#endif
191 +
192 + return 1;
193 +}
194 +
195 +void pax_report_insns(void *pc, void *sp)
196 +{
197 + unsigned long i;
198 +
199 + printk(KERN_ERR "PAX: bytes at PC: ");
200 + for (i = 0; i < 5; i++) {
201 + unsigned int c;
202 + if (get_user(c, (unsigned int *)pc+i))
203 + printk(KERN_CONT "???????? ");
204 + else
205 + printk(KERN_CONT "%08x ", c);
206 + }
207 + printk("\n");
208 +}
209 +#endif
210
211 /*
212 * This routine handles page faults. It determines the address,
213 @@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns
214 good_area:
215 si_code = SEGV_ACCERR;
216 if (cause < 0) {
217 - if (!(vma->vm_flags & VM_EXEC))
218 + if (!(vma->vm_flags & VM_EXEC)) {
219 +
220 +#ifdef CONFIG_PAX_PAGEEXEC
221 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
222 + goto bad_area;
223 +
224 + up_read(&mm->mmap_sem);
225 + switch (pax_handle_fetch_fault(regs)) {
226 +
227 +#ifdef CONFIG_PAX_EMUPLT
228 + case 2:
229 + case 3:
230 + return;
231 +#endif
232 +
233 + }
234 + pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
235 + do_group_exit(SIGKILL);
236 +#else
237 goto bad_area;
238 +#endif
239 +
240 + }
241 } else if (!cause) {
242 /* Allow reads even for write-only mappings */
243 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
244 diff -urNp linux-3.0.9/arch/arm/include/asm/elf.h linux-3.0.9/arch/arm/include/asm/elf.h
245 --- linux-3.0.9/arch/arm/include/asm/elf.h 2011-11-11 13:12:24.000000000 -0500
246 +++ linux-3.0.9/arch/arm/include/asm/elf.h 2011-11-15 20:02:59.000000000 -0500
247 @@ -116,7 +116,14 @@ int dump_task_regs(struct task_struct *t
248 the loader. We need to make sure that it is out of the way of the program
249 that it will "exec", and that there is sufficient room for the brk. */
250
251 -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
252 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
253 +
254 +#ifdef CONFIG_PAX_ASLR
255 +#define PAX_ELF_ET_DYN_BASE 0x00008000UL
256 +
257 +#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
258 +#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
259 +#endif
260
261 /* When the program starts, a1 contains a pointer to a function to be
262 registered with atexit, as per the SVR4 ABI. A value of 0 means we
263 @@ -126,10 +133,6 @@ int dump_task_regs(struct task_struct *t
264 extern void elf_set_personality(const struct elf32_hdr *);
265 #define SET_PERSONALITY(ex) elf_set_personality(&(ex))
266
267 -struct mm_struct;
268 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
269 -#define arch_randomize_brk arch_randomize_brk
270 -
271 extern int vectors_user_mapping(void);
272 #define arch_setup_additional_pages(bprm, uses_interp) vectors_user_mapping()
273 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES
274 diff -urNp linux-3.0.9/arch/arm/include/asm/kmap_types.h linux-3.0.9/arch/arm/include/asm/kmap_types.h
275 --- linux-3.0.9/arch/arm/include/asm/kmap_types.h 2011-11-11 13:12:24.000000000 -0500
276 +++ linux-3.0.9/arch/arm/include/asm/kmap_types.h 2011-11-15 20:02:59.000000000 -0500
277 @@ -21,6 +21,7 @@ enum km_type {
278 KM_L1_CACHE,
279 KM_L2_CACHE,
280 KM_KDB,
281 + KM_CLEARPAGE,
282 KM_TYPE_NR
283 };
284
285 diff -urNp linux-3.0.9/arch/arm/include/asm/uaccess.h linux-3.0.9/arch/arm/include/asm/uaccess.h
286 --- linux-3.0.9/arch/arm/include/asm/uaccess.h 2011-11-11 13:12:24.000000000 -0500
287 +++ linux-3.0.9/arch/arm/include/asm/uaccess.h 2011-11-15 20:02:59.000000000 -0500
288 @@ -22,6 +22,8 @@
289 #define VERIFY_READ 0
290 #define VERIFY_WRITE 1
291
292 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
293 +
294 /*
295 * The exception table consists of pairs of addresses: the first is the
296 * address of an instruction that is allowed to fault, and the second is
297 @@ -387,8 +389,23 @@ do { \
298
299
300 #ifdef CONFIG_MMU
301 -extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
302 -extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
303 +extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n);
304 +extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n);
305 +
306 +static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
307 +{
308 + if (!__builtin_constant_p(n))
309 + check_object_size(to, n, false);
310 + return ___copy_from_user(to, from, n);
311 +}
312 +
313 +static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
314 +{
315 + if (!__builtin_constant_p(n))
316 + check_object_size(from, n, true);
317 + return ___copy_to_user(to, from, n);
318 +}
319 +
320 extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
321 extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
322 extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
323 @@ -403,6 +420,9 @@ extern unsigned long __must_check __strn
324
325 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
326 {
327 + if ((long)n < 0)
328 + return n;
329 +
330 if (access_ok(VERIFY_READ, from, n))
331 n = __copy_from_user(to, from, n);
332 else /* security hole - plug it */
333 @@ -412,6 +432,9 @@ static inline unsigned long __must_check
334
335 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
336 {
337 + if ((long)n < 0)
338 + return n;
339 +
340 if (access_ok(VERIFY_WRITE, to, n))
341 n = __copy_to_user(to, from, n);
342 return n;
343 diff -urNp linux-3.0.9/arch/arm/kernel/armksyms.c linux-3.0.9/arch/arm/kernel/armksyms.c
344 --- linux-3.0.9/arch/arm/kernel/armksyms.c 2011-11-11 13:12:24.000000000 -0500
345 +++ linux-3.0.9/arch/arm/kernel/armksyms.c 2011-11-15 20:02:59.000000000 -0500
346 @@ -98,8 +98,8 @@ EXPORT_SYMBOL(__strncpy_from_user);
347 #ifdef CONFIG_MMU
348 EXPORT_SYMBOL(copy_page);
349
350 -EXPORT_SYMBOL(__copy_from_user);
351 -EXPORT_SYMBOL(__copy_to_user);
352 +EXPORT_SYMBOL(___copy_from_user);
353 +EXPORT_SYMBOL(___copy_to_user);
354 EXPORT_SYMBOL(__clear_user);
355
356 EXPORT_SYMBOL(__get_user_1);
357 diff -urNp linux-3.0.9/arch/arm/kernel/process.c linux-3.0.9/arch/arm/kernel/process.c
358 --- linux-3.0.9/arch/arm/kernel/process.c 2011-11-11 13:12:24.000000000 -0500
359 +++ linux-3.0.9/arch/arm/kernel/process.c 2011-11-15 20:02:59.000000000 -0500
360 @@ -28,7 +28,6 @@
361 #include <linux/tick.h>
362 #include <linux/utsname.h>
363 #include <linux/uaccess.h>
364 -#include <linux/random.h>
365 #include <linux/hw_breakpoint.h>
366
367 #include <asm/cacheflush.h>
368 @@ -479,12 +478,6 @@ unsigned long get_wchan(struct task_stru
369 return 0;
370 }
371
372 -unsigned long arch_randomize_brk(struct mm_struct *mm)
373 -{
374 - unsigned long range_end = mm->brk + 0x02000000;
375 - return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
376 -}
377 -
378 #ifdef CONFIG_MMU
379 /*
380 * The vectors page is always readable from user space for the
381 diff -urNp linux-3.0.9/arch/arm/kernel/traps.c linux-3.0.9/arch/arm/kernel/traps.c
382 --- linux-3.0.9/arch/arm/kernel/traps.c 2011-11-11 13:12:24.000000000 -0500
383 +++ linux-3.0.9/arch/arm/kernel/traps.c 2011-11-15 20:02:59.000000000 -0500
384 @@ -257,6 +257,8 @@ static int __die(const char *str, int er
385
386 static DEFINE_SPINLOCK(die_lock);
387
388 +extern void gr_handle_kernel_exploit(void);
389 +
390 /*
391 * This function is protected against re-entrancy.
392 */
393 @@ -284,6 +286,9 @@ void die(const char *str, struct pt_regs
394 panic("Fatal exception in interrupt");
395 if (panic_on_oops)
396 panic("Fatal exception");
397 +
398 + gr_handle_kernel_exploit();
399 +
400 if (ret != NOTIFY_STOP)
401 do_exit(SIGSEGV);
402 }
403 diff -urNp linux-3.0.9/arch/arm/lib/copy_from_user.S linux-3.0.9/arch/arm/lib/copy_from_user.S
404 --- linux-3.0.9/arch/arm/lib/copy_from_user.S 2011-11-11 13:12:24.000000000 -0500
405 +++ linux-3.0.9/arch/arm/lib/copy_from_user.S 2011-11-15 20:02:59.000000000 -0500
406 @@ -16,7 +16,7 @@
407 /*
408 * Prototype:
409 *
410 - * size_t __copy_from_user(void *to, const void *from, size_t n)
411 + * size_t ___copy_from_user(void *to, const void *from, size_t n)
412 *
413 * Purpose:
414 *
415 @@ -84,11 +84,11 @@
416
417 .text
418
419 -ENTRY(__copy_from_user)
420 +ENTRY(___copy_from_user)
421
422 #include "copy_template.S"
423
424 -ENDPROC(__copy_from_user)
425 +ENDPROC(___copy_from_user)
426
427 .pushsection .fixup,"ax"
428 .align 0
429 diff -urNp linux-3.0.9/arch/arm/lib/copy_to_user.S linux-3.0.9/arch/arm/lib/copy_to_user.S
430 --- linux-3.0.9/arch/arm/lib/copy_to_user.S 2011-11-11 13:12:24.000000000 -0500
431 +++ linux-3.0.9/arch/arm/lib/copy_to_user.S 2011-11-15 20:02:59.000000000 -0500
432 @@ -16,7 +16,7 @@
433 /*
434 * Prototype:
435 *
436 - * size_t __copy_to_user(void *to, const void *from, size_t n)
437 + * size_t ___copy_to_user(void *to, const void *from, size_t n)
438 *
439 * Purpose:
440 *
441 @@ -88,11 +88,11 @@
442 .text
443
444 ENTRY(__copy_to_user_std)
445 -WEAK(__copy_to_user)
446 +WEAK(___copy_to_user)
447
448 #include "copy_template.S"
449
450 -ENDPROC(__copy_to_user)
451 +ENDPROC(___copy_to_user)
452 ENDPROC(__copy_to_user_std)
453
454 .pushsection .fixup,"ax"
455 diff -urNp linux-3.0.9/arch/arm/lib/uaccess.S linux-3.0.9/arch/arm/lib/uaccess.S
456 --- linux-3.0.9/arch/arm/lib/uaccess.S 2011-11-11 13:12:24.000000000 -0500
457 +++ linux-3.0.9/arch/arm/lib/uaccess.S 2011-11-15 20:02:59.000000000 -0500
458 @@ -20,7 +20,7 @@
459
460 #define PAGE_SHIFT 12
461
462 -/* Prototype: int __copy_to_user(void *to, const char *from, size_t n)
463 +/* Prototype: int ___copy_to_user(void *to, const char *from, size_t n)
464 * Purpose : copy a block to user memory from kernel memory
465 * Params : to - user memory
466 * : from - kernel memory
467 @@ -40,7 +40,7 @@ USER( T(strgtb) r3, [r0], #1) @ May f
468 sub r2, r2, ip
469 b .Lc2u_dest_aligned
470
471 -ENTRY(__copy_to_user)
472 +ENTRY(___copy_to_user)
473 stmfd sp!, {r2, r4 - r7, lr}
474 cmp r2, #4
475 blt .Lc2u_not_enough
476 @@ -278,14 +278,14 @@ USER( T(strgeb) r3, [r0], #1) @ May f
477 ldrgtb r3, [r1], #0
478 USER( T(strgtb) r3, [r0], #1) @ May fault
479 b .Lc2u_finished
480 -ENDPROC(__copy_to_user)
481 +ENDPROC(___copy_to_user)
482
483 .pushsection .fixup,"ax"
484 .align 0
485 9001: ldmfd sp!, {r0, r4 - r7, pc}
486 .popsection
487
488 -/* Prototype: unsigned long __copy_from_user(void *to,const void *from,unsigned long n);
489 +/* Prototype: unsigned long ___copy_from_user(void *to,const void *from,unsigned long n);
490 * Purpose : copy a block from user memory to kernel memory
491 * Params : to - kernel memory
492 * : from - user memory
493 @@ -304,7 +304,7 @@ USER( T(ldrgtb) r3, [r1], #1) @ May f
494 sub r2, r2, ip
495 b .Lcfu_dest_aligned
496
497 -ENTRY(__copy_from_user)
498 +ENTRY(___copy_from_user)
499 stmfd sp!, {r0, r2, r4 - r7, lr}
500 cmp r2, #4
501 blt .Lcfu_not_enough
502 @@ -544,7 +544,7 @@ USER( T(ldrgeb) r3, [r1], #1) @ May f
503 USER( T(ldrgtb) r3, [r1], #1) @ May fault
504 strgtb r3, [r0], #1
505 b .Lcfu_finished
506 -ENDPROC(__copy_from_user)
507 +ENDPROC(___copy_from_user)
508
509 .pushsection .fixup,"ax"
510 .align 0
511 diff -urNp linux-3.0.9/arch/arm/lib/uaccess_with_memcpy.c linux-3.0.9/arch/arm/lib/uaccess_with_memcpy.c
512 --- linux-3.0.9/arch/arm/lib/uaccess_with_memcpy.c 2011-11-11 13:12:24.000000000 -0500
513 +++ linux-3.0.9/arch/arm/lib/uaccess_with_memcpy.c 2011-11-15 20:02:59.000000000 -0500
514 @@ -103,7 +103,7 @@ out:
515 }
516
517 unsigned long
518 -__copy_to_user(void __user *to, const void *from, unsigned long n)
519 +___copy_to_user(void __user *to, const void *from, unsigned long n)
520 {
521 /*
522 * This test is stubbed out of the main function above to keep
523 diff -urNp linux-3.0.9/arch/arm/mach-ux500/mbox-db5500.c linux-3.0.9/arch/arm/mach-ux500/mbox-db5500.c
524 --- linux-3.0.9/arch/arm/mach-ux500/mbox-db5500.c 2011-11-11 13:12:24.000000000 -0500
525 +++ linux-3.0.9/arch/arm/mach-ux500/mbox-db5500.c 2011-11-15 20:02:59.000000000 -0500
526 @@ -168,7 +168,7 @@ static ssize_t mbox_read_fifo(struct dev
527 return sprintf(buf, "0x%X\n", mbox_value);
528 }
529
530 -static DEVICE_ATTR(fifo, S_IWUGO | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
531 +static DEVICE_ATTR(fifo, S_IWUSR | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
532
533 static int mbox_show(struct seq_file *s, void *data)
534 {
535 diff -urNp linux-3.0.9/arch/arm/mm/fault.c linux-3.0.9/arch/arm/mm/fault.c
536 --- linux-3.0.9/arch/arm/mm/fault.c 2011-11-11 13:12:24.000000000 -0500
537 +++ linux-3.0.9/arch/arm/mm/fault.c 2011-11-15 20:02:59.000000000 -0500
538 @@ -182,6 +182,13 @@ __do_user_fault(struct task_struct *tsk,
539 }
540 #endif
541
542 +#ifdef CONFIG_PAX_PAGEEXEC
543 + if (fsr & FSR_LNX_PF) {
544 + pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
545 + do_group_exit(SIGKILL);
546 + }
547 +#endif
548 +
549 tsk->thread.address = addr;
550 tsk->thread.error_code = fsr;
551 tsk->thread.trap_no = 14;
552 @@ -379,6 +386,33 @@ do_page_fault(unsigned long addr, unsign
553 }
554 #endif /* CONFIG_MMU */
555
556 +#ifdef CONFIG_PAX_PAGEEXEC
557 +void pax_report_insns(void *pc, void *sp)
558 +{
559 + long i;
560 +
561 + printk(KERN_ERR "PAX: bytes at PC: ");
562 + for (i = 0; i < 20; i++) {
563 + unsigned char c;
564 + if (get_user(c, (__force unsigned char __user *)pc+i))
565 + printk(KERN_CONT "?? ");
566 + else
567 + printk(KERN_CONT "%02x ", c);
568 + }
569 + printk("\n");
570 +
571 + printk(KERN_ERR "PAX: bytes at SP-4: ");
572 + for (i = -1; i < 20; i++) {
573 + unsigned long c;
574 + if (get_user(c, (__force unsigned long __user *)sp+i))
575 + printk(KERN_CONT "???????? ");
576 + else
577 + printk(KERN_CONT "%08lx ", c);
578 + }
579 + printk("\n");
580 +}
581 +#endif
582 +
583 /*
584 * First Level Translation Fault Handler
585 *
586 diff -urNp linux-3.0.9/arch/arm/mm/mmap.c linux-3.0.9/arch/arm/mm/mmap.c
587 --- linux-3.0.9/arch/arm/mm/mmap.c 2011-11-11 13:12:24.000000000 -0500
588 +++ linux-3.0.9/arch/arm/mm/mmap.c 2011-11-15 20:02:59.000000000 -0500
589 @@ -65,6 +65,10 @@ arch_get_unmapped_area(struct file *filp
590 if (len > TASK_SIZE)
591 return -ENOMEM;
592
593 +#ifdef CONFIG_PAX_RANDMMAP
594 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
595 +#endif
596 +
597 if (addr) {
598 if (do_align)
599 addr = COLOUR_ALIGN(addr, pgoff);
600 @@ -72,15 +76,14 @@ arch_get_unmapped_area(struct file *filp
601 addr = PAGE_ALIGN(addr);
602
603 vma = find_vma(mm, addr);
604 - if (TASK_SIZE - len >= addr &&
605 - (!vma || addr + len <= vma->vm_start))
606 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
607 return addr;
608 }
609 if (len > mm->cached_hole_size) {
610 - start_addr = addr = mm->free_area_cache;
611 + start_addr = addr = mm->free_area_cache;
612 } else {
613 - start_addr = addr = TASK_UNMAPPED_BASE;
614 - mm->cached_hole_size = 0;
615 + start_addr = addr = mm->mmap_base;
616 + mm->cached_hole_size = 0;
617 }
618 /* 8 bits of randomness in 20 address space bits */
619 if ((current->flags & PF_RANDOMIZE) &&
620 @@ -100,14 +103,14 @@ full_search:
621 * Start a new search - just in case we missed
622 * some holes.
623 */
624 - if (start_addr != TASK_UNMAPPED_BASE) {
625 - start_addr = addr = TASK_UNMAPPED_BASE;
626 + if (start_addr != mm->mmap_base) {
627 + start_addr = addr = mm->mmap_base;
628 mm->cached_hole_size = 0;
629 goto full_search;
630 }
631 return -ENOMEM;
632 }
633 - if (!vma || addr + len <= vma->vm_start) {
634 + if (check_heap_stack_gap(vma, addr, len)) {
635 /*
636 * Remember the place where we stopped the search:
637 */
638 diff -urNp linux-3.0.9/arch/avr32/include/asm/elf.h linux-3.0.9/arch/avr32/include/asm/elf.h
639 --- linux-3.0.9/arch/avr32/include/asm/elf.h 2011-11-11 13:12:24.000000000 -0500
640 +++ linux-3.0.9/arch/avr32/include/asm/elf.h 2011-11-15 20:02:59.000000000 -0500
641 @@ -84,8 +84,14 @@ typedef struct user_fpu_struct elf_fpreg
642 the loader. We need to make sure that it is out of the way of the program
643 that it will "exec", and that there is sufficient room for the brk. */
644
645 -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
646 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
647
648 +#ifdef CONFIG_PAX_ASLR
649 +#define PAX_ELF_ET_DYN_BASE 0x00001000UL
650 +
651 +#define PAX_DELTA_MMAP_LEN 15
652 +#define PAX_DELTA_STACK_LEN 15
653 +#endif
654
655 /* This yields a mask that user programs can use to figure out what
656 instruction set this CPU supports. This could be done in user space,
657 diff -urNp linux-3.0.9/arch/avr32/include/asm/kmap_types.h linux-3.0.9/arch/avr32/include/asm/kmap_types.h
658 --- linux-3.0.9/arch/avr32/include/asm/kmap_types.h 2011-11-11 13:12:24.000000000 -0500
659 +++ linux-3.0.9/arch/avr32/include/asm/kmap_types.h 2011-11-15 20:02:59.000000000 -0500
660 @@ -22,7 +22,8 @@ D(10) KM_IRQ0,
661 D(11) KM_IRQ1,
662 D(12) KM_SOFTIRQ0,
663 D(13) KM_SOFTIRQ1,
664 -D(14) KM_TYPE_NR
665 +D(14) KM_CLEARPAGE,
666 +D(15) KM_TYPE_NR
667 };
668
669 #undef D
670 diff -urNp linux-3.0.9/arch/avr32/mm/fault.c linux-3.0.9/arch/avr32/mm/fault.c
671 --- linux-3.0.9/arch/avr32/mm/fault.c 2011-11-11 13:12:24.000000000 -0500
672 +++ linux-3.0.9/arch/avr32/mm/fault.c 2011-11-15 20:02:59.000000000 -0500
673 @@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
674
675 int exception_trace = 1;
676
677 +#ifdef CONFIG_PAX_PAGEEXEC
678 +void pax_report_insns(void *pc, void *sp)
679 +{
680 + unsigned long i;
681 +
682 + printk(KERN_ERR "PAX: bytes at PC: ");
683 + for (i = 0; i < 20; i++) {
684 + unsigned char c;
685 + if (get_user(c, (unsigned char *)pc+i))
686 + printk(KERN_CONT "???????? ");
687 + else
688 + printk(KERN_CONT "%02x ", c);
689 + }
690 + printk("\n");
691 +}
692 +#endif
693 +
694 /*
695 * This routine handles page faults. It determines the address and the
696 * problem, and then passes it off to one of the appropriate routines.
697 @@ -156,6 +173,16 @@ bad_area:
698 up_read(&mm->mmap_sem);
699
700 if (user_mode(regs)) {
701 +
702 +#ifdef CONFIG_PAX_PAGEEXEC
703 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
704 + if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
705 + pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
706 + do_group_exit(SIGKILL);
707 + }
708 + }
709 +#endif
710 +
711 if (exception_trace && printk_ratelimit())
712 printk("%s%s[%d]: segfault at %08lx pc %08lx "
713 "sp %08lx ecr %lu\n",
714 diff -urNp linux-3.0.9/arch/frv/include/asm/kmap_types.h linux-3.0.9/arch/frv/include/asm/kmap_types.h
715 --- linux-3.0.9/arch/frv/include/asm/kmap_types.h 2011-11-11 13:12:24.000000000 -0500
716 +++ linux-3.0.9/arch/frv/include/asm/kmap_types.h 2011-11-15 20:02:59.000000000 -0500
717 @@ -23,6 +23,7 @@ enum km_type {
718 KM_IRQ1,
719 KM_SOFTIRQ0,
720 KM_SOFTIRQ1,
721 + KM_CLEARPAGE,
722 KM_TYPE_NR
723 };
724
725 diff -urNp linux-3.0.9/arch/frv/mm/elf-fdpic.c linux-3.0.9/arch/frv/mm/elf-fdpic.c
726 --- linux-3.0.9/arch/frv/mm/elf-fdpic.c 2011-11-11 13:12:24.000000000 -0500
727 +++ linux-3.0.9/arch/frv/mm/elf-fdpic.c 2011-11-15 20:02:59.000000000 -0500
728 @@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(str
729 if (addr) {
730 addr = PAGE_ALIGN(addr);
731 vma = find_vma(current->mm, addr);
732 - if (TASK_SIZE - len >= addr &&
733 - (!vma || addr + len <= vma->vm_start))
734 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
735 goto success;
736 }
737
738 @@ -89,7 +88,7 @@ unsigned long arch_get_unmapped_area(str
739 for (; vma; vma = vma->vm_next) {
740 if (addr > limit)
741 break;
742 - if (addr + len <= vma->vm_start)
743 + if (check_heap_stack_gap(vma, addr, len))
744 goto success;
745 addr = vma->vm_end;
746 }
747 @@ -104,7 +103,7 @@ unsigned long arch_get_unmapped_area(str
748 for (; vma; vma = vma->vm_next) {
749 if (addr > limit)
750 break;
751 - if (addr + len <= vma->vm_start)
752 + if (check_heap_stack_gap(vma, addr, len))
753 goto success;
754 addr = vma->vm_end;
755 }
756 diff -urNp linux-3.0.9/arch/ia64/include/asm/elf.h linux-3.0.9/arch/ia64/include/asm/elf.h
757 --- linux-3.0.9/arch/ia64/include/asm/elf.h 2011-11-11 13:12:24.000000000 -0500
758 +++ linux-3.0.9/arch/ia64/include/asm/elf.h 2011-11-15 20:02:59.000000000 -0500
759 @@ -42,6 +42,13 @@
760 */
761 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
762
763 +#ifdef CONFIG_PAX_ASLR
764 +#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
765 +
766 +#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
767 +#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
768 +#endif
769 +
770 #define PT_IA_64_UNWIND 0x70000001
771
772 /* IA-64 relocations: */
773 diff -urNp linux-3.0.9/arch/ia64/include/asm/pgtable.h linux-3.0.9/arch/ia64/include/asm/pgtable.h
774 --- linux-3.0.9/arch/ia64/include/asm/pgtable.h 2011-11-11 13:12:24.000000000 -0500
775 +++ linux-3.0.9/arch/ia64/include/asm/pgtable.h 2011-11-15 20:02:59.000000000 -0500
776 @@ -12,7 +12,7 @@
777 * David Mosberger-Tang <davidm@hpl.hp.com>
778 */
779
780 -
781 +#include <linux/const.h>
782 #include <asm/mman.h>
783 #include <asm/page.h>
784 #include <asm/processor.h>
785 @@ -143,6 +143,17 @@
786 #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
787 #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
788 #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
789 +
790 +#ifdef CONFIG_PAX_PAGEEXEC
791 +# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
792 +# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
793 +# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
794 +#else
795 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
796 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
797 +# define PAGE_COPY_NOEXEC PAGE_COPY
798 +#endif
799 +
800 #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
801 #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
802 #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
803 diff -urNp linux-3.0.9/arch/ia64/include/asm/spinlock.h linux-3.0.9/arch/ia64/include/asm/spinlock.h
804 --- linux-3.0.9/arch/ia64/include/asm/spinlock.h 2011-11-11 13:12:24.000000000 -0500
805 +++ linux-3.0.9/arch/ia64/include/asm/spinlock.h 2011-11-15 20:02:59.000000000 -0500
806 @@ -72,7 +72,7 @@ static __always_inline void __ticket_spi
807 unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
808
809 asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
810 - ACCESS_ONCE(*p) = (tmp + 2) & ~1;
811 + ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
812 }
813
814 static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
815 diff -urNp linux-3.0.9/arch/ia64/include/asm/uaccess.h linux-3.0.9/arch/ia64/include/asm/uaccess.h
816 --- linux-3.0.9/arch/ia64/include/asm/uaccess.h 2011-11-11 13:12:24.000000000 -0500
817 +++ linux-3.0.9/arch/ia64/include/asm/uaccess.h 2011-11-15 20:02:59.000000000 -0500
818 @@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
819 const void *__cu_from = (from); \
820 long __cu_len = (n); \
821 \
822 - if (__access_ok(__cu_to, __cu_len, get_fs())) \
823 + if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) \
824 __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
825 __cu_len; \
826 })
827 @@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _
828 long __cu_len = (n); \
829 \
830 __chk_user_ptr(__cu_from); \
831 - if (__access_ok(__cu_from, __cu_len, get_fs())) \
832 + if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) \
833 __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
834 __cu_len; \
835 })
836 diff -urNp linux-3.0.9/arch/ia64/kernel/module.c linux-3.0.9/arch/ia64/kernel/module.c
837 --- linux-3.0.9/arch/ia64/kernel/module.c 2011-11-11 13:12:24.000000000 -0500
838 +++ linux-3.0.9/arch/ia64/kernel/module.c 2011-11-15 20:02:59.000000000 -0500
839 @@ -315,8 +315,7 @@ module_alloc (unsigned long size)
840 void
841 module_free (struct module *mod, void *module_region)
842 {
843 - if (mod && mod->arch.init_unw_table &&
844 - module_region == mod->module_init) {
845 + if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
846 unw_remove_unwind_table(mod->arch.init_unw_table);
847 mod->arch.init_unw_table = NULL;
848 }
849 @@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
850 }
851
852 static inline int
853 +in_init_rx (const struct module *mod, uint64_t addr)
854 +{
855 + return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
856 +}
857 +
858 +static inline int
859 +in_init_rw (const struct module *mod, uint64_t addr)
860 +{
861 + return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
862 +}
863 +
864 +static inline int
865 in_init (const struct module *mod, uint64_t addr)
866 {
867 - return addr - (uint64_t) mod->module_init < mod->init_size;
868 + return in_init_rx(mod, addr) || in_init_rw(mod, addr);
869 +}
870 +
871 +static inline int
872 +in_core_rx (const struct module *mod, uint64_t addr)
873 +{
874 + return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
875 +}
876 +
877 +static inline int
878 +in_core_rw (const struct module *mod, uint64_t addr)
879 +{
880 + return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
881 }
882
883 static inline int
884 in_core (const struct module *mod, uint64_t addr)
885 {
886 - return addr - (uint64_t) mod->module_core < mod->core_size;
887 + return in_core_rx(mod, addr) || in_core_rw(mod, addr);
888 }
889
890 static inline int
891 @@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_
892 break;
893
894 case RV_BDREL:
895 - val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
896 + if (in_init_rx(mod, val))
897 + val -= (uint64_t) mod->module_init_rx;
898 + else if (in_init_rw(mod, val))
899 + val -= (uint64_t) mod->module_init_rw;
900 + else if (in_core_rx(mod, val))
901 + val -= (uint64_t) mod->module_core_rx;
902 + else if (in_core_rw(mod, val))
903 + val -= (uint64_t) mod->module_core_rw;
904 break;
905
906 case RV_LTV:
907 @@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
908 * addresses have been selected...
909 */
910 uint64_t gp;
911 - if (mod->core_size > MAX_LTOFF)
912 + if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
913 /*
914 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
915 * at the end of the module.
916 */
917 - gp = mod->core_size - MAX_LTOFF / 2;
918 + gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
919 else
920 - gp = mod->core_size / 2;
921 - gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
922 + gp = (mod->core_size_rx + mod->core_size_rw) / 2;
923 + gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
924 mod->arch.gp = gp;
925 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
926 }
927 diff -urNp linux-3.0.9/arch/ia64/kernel/sys_ia64.c linux-3.0.9/arch/ia64/kernel/sys_ia64.c
928 --- linux-3.0.9/arch/ia64/kernel/sys_ia64.c 2011-11-11 13:12:24.000000000 -0500
929 +++ linux-3.0.9/arch/ia64/kernel/sys_ia64.c 2011-11-15 20:02:59.000000000 -0500
930 @@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
931 if (REGION_NUMBER(addr) == RGN_HPAGE)
932 addr = 0;
933 #endif
934 +
935 +#ifdef CONFIG_PAX_RANDMMAP
936 + if (mm->pax_flags & MF_PAX_RANDMMAP)
937 + addr = mm->free_area_cache;
938 + else
939 +#endif
940 +
941 if (!addr)
942 addr = mm->free_area_cache;
943
944 @@ -61,14 +68,14 @@ arch_get_unmapped_area (struct file *fil
945 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
946 /* At this point: (!vma || addr < vma->vm_end). */
947 if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
948 - if (start_addr != TASK_UNMAPPED_BASE) {
949 + if (start_addr != mm->mmap_base) {
950 /* Start a new search --- just in case we missed some holes. */
951 - addr = TASK_UNMAPPED_BASE;
952 + addr = mm->mmap_base;
953 goto full_search;
954 }
955 return -ENOMEM;
956 }
957 - if (!vma || addr + len <= vma->vm_start) {
958 + if (check_heap_stack_gap(vma, addr, len)) {
959 /* Remember the address where we stopped this search: */
960 mm->free_area_cache = addr + len;
961 return addr;
962 diff -urNp linux-3.0.9/arch/ia64/kernel/vmlinux.lds.S linux-3.0.9/arch/ia64/kernel/vmlinux.lds.S
963 --- linux-3.0.9/arch/ia64/kernel/vmlinux.lds.S 2011-11-11 13:12:24.000000000 -0500
964 +++ linux-3.0.9/arch/ia64/kernel/vmlinux.lds.S 2011-11-15 20:02:59.000000000 -0500
965 @@ -199,7 +199,7 @@ SECTIONS {
966 /* Per-cpu data: */
967 . = ALIGN(PERCPU_PAGE_SIZE);
968 PERCPU_VADDR(SMP_CACHE_BYTES, PERCPU_ADDR, :percpu)
969 - __phys_per_cpu_start = __per_cpu_load;
970 + __phys_per_cpu_start = per_cpu_load;
971 /*
972 * ensure percpu data fits
973 * into percpu page size
974 diff -urNp linux-3.0.9/arch/ia64/mm/fault.c linux-3.0.9/arch/ia64/mm/fault.c
975 --- linux-3.0.9/arch/ia64/mm/fault.c 2011-11-11 13:12:24.000000000 -0500
976 +++ linux-3.0.9/arch/ia64/mm/fault.c 2011-11-15 20:02:59.000000000 -0500
977 @@ -73,6 +73,23 @@ mapped_kernel_page_is_present (unsigned
978 return pte_present(pte);
979 }
980
981 +#ifdef CONFIG_PAX_PAGEEXEC
982 +void pax_report_insns(void *pc, void *sp)
983 +{
984 + unsigned long i;
985 +
986 + printk(KERN_ERR "PAX: bytes at PC: ");
987 + for (i = 0; i < 8; i++) {
988 + unsigned int c;
989 + if (get_user(c, (unsigned int *)pc+i))
990 + printk(KERN_CONT "???????? ");
991 + else
992 + printk(KERN_CONT "%08x ", c);
993 + }
994 + printk("\n");
995 +}
996 +#endif
997 +
998 void __kprobes
999 ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
1000 {
1001 @@ -146,9 +163,23 @@ ia64_do_page_fault (unsigned long addres
1002 mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
1003 | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
1004
1005 - if ((vma->vm_flags & mask) != mask)
1006 + if ((vma->vm_flags & mask) != mask) {
1007 +
1008 +#ifdef CONFIG_PAX_PAGEEXEC
1009 + if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
1010 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
1011 + goto bad_area;
1012 +
1013 + up_read(&mm->mmap_sem);
1014 + pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
1015 + do_group_exit(SIGKILL);
1016 + }
1017 +#endif
1018 +
1019 goto bad_area;
1020
1021 + }
1022 +
1023 /*
1024 * If for any reason at all we couldn't handle the fault, make
1025 * sure we exit gracefully rather than endlessly redo the
1026 diff -urNp linux-3.0.9/arch/ia64/mm/hugetlbpage.c linux-3.0.9/arch/ia64/mm/hugetlbpage.c
1027 --- linux-3.0.9/arch/ia64/mm/hugetlbpage.c 2011-11-11 13:12:24.000000000 -0500
1028 +++ linux-3.0.9/arch/ia64/mm/hugetlbpage.c 2011-11-15 20:02:59.000000000 -0500
1029 @@ -171,7 +171,7 @@ unsigned long hugetlb_get_unmapped_area(
1030 /* At this point: (!vmm || addr < vmm->vm_end). */
1031 if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
1032 return -ENOMEM;
1033 - if (!vmm || (addr + len) <= vmm->vm_start)
1034 + if (check_heap_stack_gap(vmm, addr, len))
1035 return addr;
1036 addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
1037 }
1038 diff -urNp linux-3.0.9/arch/ia64/mm/init.c linux-3.0.9/arch/ia64/mm/init.c
1039 --- linux-3.0.9/arch/ia64/mm/init.c 2011-11-11 13:12:24.000000000 -0500
1040 +++ linux-3.0.9/arch/ia64/mm/init.c 2011-11-15 20:02:59.000000000 -0500
1041 @@ -120,6 +120,19 @@ ia64_init_addr_space (void)
1042 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
1043 vma->vm_end = vma->vm_start + PAGE_SIZE;
1044 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
1045 +
1046 +#ifdef CONFIG_PAX_PAGEEXEC
1047 + if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
1048 + vma->vm_flags &= ~VM_EXEC;
1049 +
1050 +#ifdef CONFIG_PAX_MPROTECT
1051 + if (current->mm->pax_flags & MF_PAX_MPROTECT)
1052 + vma->vm_flags &= ~VM_MAYEXEC;
1053 +#endif
1054 +
1055 + }
1056 +#endif
1057 +
1058 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
1059 down_write(&current->mm->mmap_sem);
1060 if (insert_vm_struct(current->mm, vma)) {
1061 diff -urNp linux-3.0.9/arch/m32r/lib/usercopy.c linux-3.0.9/arch/m32r/lib/usercopy.c
1062 --- linux-3.0.9/arch/m32r/lib/usercopy.c 2011-11-11 13:12:24.000000000 -0500
1063 +++ linux-3.0.9/arch/m32r/lib/usercopy.c 2011-11-15 20:02:59.000000000 -0500
1064 @@ -14,6 +14,9 @@
1065 unsigned long
1066 __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1067 {
1068 + if ((long)n < 0)
1069 + return n;
1070 +
1071 prefetch(from);
1072 if (access_ok(VERIFY_WRITE, to, n))
1073 __copy_user(to,from,n);
1074 @@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to,
1075 unsigned long
1076 __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
1077 {
1078 + if ((long)n < 0)
1079 + return n;
1080 +
1081 prefetchw(to);
1082 if (access_ok(VERIFY_READ, from, n))
1083 __copy_user_zeroing(to,from,n);
1084 diff -urNp linux-3.0.9/arch/mips/include/asm/elf.h linux-3.0.9/arch/mips/include/asm/elf.h
1085 --- linux-3.0.9/arch/mips/include/asm/elf.h 2011-11-11 13:12:24.000000000 -0500
1086 +++ linux-3.0.9/arch/mips/include/asm/elf.h 2011-11-15 20:02:59.000000000 -0500
1087 @@ -372,13 +372,16 @@ extern const char *__elf_platform;
1088 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1089 #endif
1090
1091 +#ifdef CONFIG_PAX_ASLR
1092 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
1093 +
1094 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1095 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1096 +#endif
1097 +
1098 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
1099 struct linux_binprm;
1100 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
1101 int uses_interp);
1102
1103 -struct mm_struct;
1104 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
1105 -#define arch_randomize_brk arch_randomize_brk
1106 -
1107 #endif /* _ASM_ELF_H */
1108 diff -urNp linux-3.0.9/arch/mips/include/asm/page.h linux-3.0.9/arch/mips/include/asm/page.h
1109 --- linux-3.0.9/arch/mips/include/asm/page.h 2011-11-11 13:12:24.000000000 -0500
1110 +++ linux-3.0.9/arch/mips/include/asm/page.h 2011-11-15 20:02:59.000000000 -0500
1111 @@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
1112 #ifdef CONFIG_CPU_MIPS32
1113 typedef struct { unsigned long pte_low, pte_high; } pte_t;
1114 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
1115 - #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
1116 + #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
1117 #else
1118 typedef struct { unsigned long long pte; } pte_t;
1119 #define pte_val(x) ((x).pte)
1120 diff -urNp linux-3.0.9/arch/mips/include/asm/system.h linux-3.0.9/arch/mips/include/asm/system.h
1121 --- linux-3.0.9/arch/mips/include/asm/system.h 2011-11-11 13:12:24.000000000 -0500
1122 +++ linux-3.0.9/arch/mips/include/asm/system.h 2011-11-15 20:02:59.000000000 -0500
1123 @@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
1124 */
1125 #define __ARCH_WANT_UNLOCKED_CTXSW
1126
1127 -extern unsigned long arch_align_stack(unsigned long sp);
1128 +#define arch_align_stack(x) ((x) & ~0xfUL)
1129
1130 #endif /* _ASM_SYSTEM_H */
1131 diff -urNp linux-3.0.9/arch/mips/kernel/binfmt_elfn32.c linux-3.0.9/arch/mips/kernel/binfmt_elfn32.c
1132 --- linux-3.0.9/arch/mips/kernel/binfmt_elfn32.c 2011-11-11 13:12:24.000000000 -0500
1133 +++ linux-3.0.9/arch/mips/kernel/binfmt_elfn32.c 2011-11-15 20:02:59.000000000 -0500
1134 @@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
1135 #undef ELF_ET_DYN_BASE
1136 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
1137
1138 +#ifdef CONFIG_PAX_ASLR
1139 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
1140 +
1141 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1142 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1143 +#endif
1144 +
1145 #include <asm/processor.h>
1146 #include <linux/module.h>
1147 #include <linux/elfcore.h>
1148 diff -urNp linux-3.0.9/arch/mips/kernel/binfmt_elfo32.c linux-3.0.9/arch/mips/kernel/binfmt_elfo32.c
1149 --- linux-3.0.9/arch/mips/kernel/binfmt_elfo32.c 2011-11-11 13:12:24.000000000 -0500
1150 +++ linux-3.0.9/arch/mips/kernel/binfmt_elfo32.c 2011-11-15 20:02:59.000000000 -0500
1151 @@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
1152 #undef ELF_ET_DYN_BASE
1153 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
1154
1155 +#ifdef CONFIG_PAX_ASLR
1156 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
1157 +
1158 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1159 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1160 +#endif
1161 +
1162 #include <asm/processor.h>
1163
1164 /*
1165 diff -urNp linux-3.0.9/arch/mips/kernel/process.c linux-3.0.9/arch/mips/kernel/process.c
1166 --- linux-3.0.9/arch/mips/kernel/process.c 2011-11-11 13:12:24.000000000 -0500
1167 +++ linux-3.0.9/arch/mips/kernel/process.c 2011-11-15 20:02:59.000000000 -0500
1168 @@ -473,15 +473,3 @@ unsigned long get_wchan(struct task_stru
1169 out:
1170 return pc;
1171 }
1172 -
1173 -/*
1174 - * Don't forget that the stack pointer must be aligned on a 8 bytes
1175 - * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
1176 - */
1177 -unsigned long arch_align_stack(unsigned long sp)
1178 -{
1179 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
1180 - sp -= get_random_int() & ~PAGE_MASK;
1181 -
1182 - return sp & ALMASK;
1183 -}
1184 diff -urNp linux-3.0.9/arch/mips/mm/fault.c linux-3.0.9/arch/mips/mm/fault.c
1185 --- linux-3.0.9/arch/mips/mm/fault.c 2011-11-11 13:12:24.000000000 -0500
1186 +++ linux-3.0.9/arch/mips/mm/fault.c 2011-11-15 20:02:59.000000000 -0500
1187 @@ -28,6 +28,23 @@
1188 #include <asm/highmem.h> /* For VMALLOC_END */
1189 #include <linux/kdebug.h>
1190
1191 +#ifdef CONFIG_PAX_PAGEEXEC
1192 +void pax_report_insns(void *pc, void *sp)
1193 +{
1194 + unsigned long i;
1195 +
1196 + printk(KERN_ERR "PAX: bytes at PC: ");
1197 + for (i = 0; i < 5; i++) {
1198 + unsigned int c;
1199 + if (get_user(c, (unsigned int *)pc+i))
1200 + printk(KERN_CONT "???????? ");
1201 + else
1202 + printk(KERN_CONT "%08x ", c);
1203 + }
1204 + printk("\n");
1205 +}
1206 +#endif
1207 +
1208 /*
1209 * This routine handles page faults. It determines the address,
1210 * and the problem, and then passes it off to one of the appropriate
1211 diff -urNp linux-3.0.9/arch/mips/mm/mmap.c linux-3.0.9/arch/mips/mm/mmap.c
1212 --- linux-3.0.9/arch/mips/mm/mmap.c 2011-11-11 13:12:24.000000000 -0500
1213 +++ linux-3.0.9/arch/mips/mm/mmap.c 2011-11-15 20:02:59.000000000 -0500
1214 @@ -48,14 +48,18 @@ unsigned long arch_get_unmapped_area(str
1215 do_color_align = 0;
1216 if (filp || (flags & MAP_SHARED))
1217 do_color_align = 1;
1218 +
1219 +#ifdef CONFIG_PAX_RANDMMAP
1220 + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
1221 +#endif
1222 +
1223 if (addr) {
1224 if (do_color_align)
1225 addr = COLOUR_ALIGN(addr, pgoff);
1226 else
1227 addr = PAGE_ALIGN(addr);
1228 vmm = find_vma(current->mm, addr);
1229 - if (TASK_SIZE - len >= addr &&
1230 - (!vmm || addr + len <= vmm->vm_start))
1231 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vmm, addr, len))
1232 return addr;
1233 }
1234 addr = current->mm->mmap_base;
1235 @@ -68,7 +72,7 @@ unsigned long arch_get_unmapped_area(str
1236 /* At this point: (!vmm || addr < vmm->vm_end). */
1237 if (TASK_SIZE - len < addr)
1238 return -ENOMEM;
1239 - if (!vmm || addr + len <= vmm->vm_start)
1240 + if (check_heap_stack_gap(vmm, addr, len))
1241 return addr;
1242 addr = vmm->vm_end;
1243 if (do_color_align)
1244 @@ -93,30 +97,3 @@ void arch_pick_mmap_layout(struct mm_str
1245 mm->get_unmapped_area = arch_get_unmapped_area;
1246 mm->unmap_area = arch_unmap_area;
1247 }
1248 -
1249 -static inline unsigned long brk_rnd(void)
1250 -{
1251 - unsigned long rnd = get_random_int();
1252 -
1253 - rnd = rnd << PAGE_SHIFT;
1254 - /* 8MB for 32bit, 256MB for 64bit */
1255 - if (TASK_IS_32BIT_ADDR)
1256 - rnd = rnd & 0x7ffffful;
1257 - else
1258 - rnd = rnd & 0xffffffful;
1259 -
1260 - return rnd;
1261 -}
1262 -
1263 -unsigned long arch_randomize_brk(struct mm_struct *mm)
1264 -{
1265 - unsigned long base = mm->brk;
1266 - unsigned long ret;
1267 -
1268 - ret = PAGE_ALIGN(base + brk_rnd());
1269 -
1270 - if (ret < mm->brk)
1271 - return mm->brk;
1272 -
1273 - return ret;
1274 -}
1275 diff -urNp linux-3.0.9/arch/parisc/include/asm/elf.h linux-3.0.9/arch/parisc/include/asm/elf.h
1276 --- linux-3.0.9/arch/parisc/include/asm/elf.h 2011-11-11 13:12:24.000000000 -0500
1277 +++ linux-3.0.9/arch/parisc/include/asm/elf.h 2011-11-15 20:02:59.000000000 -0500
1278 @@ -342,6 +342,13 @@ struct pt_regs; /* forward declaration..
1279
1280 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
1281
1282 +#ifdef CONFIG_PAX_ASLR
1283 +#define PAX_ELF_ET_DYN_BASE 0x10000UL
1284 +
1285 +#define PAX_DELTA_MMAP_LEN 16
1286 +#define PAX_DELTA_STACK_LEN 16
1287 +#endif
1288 +
1289 /* This yields a mask that user programs can use to figure out what
1290 instruction set this CPU supports. This could be done in user space,
1291 but it's not easy, and we've already done it here. */
1292 diff -urNp linux-3.0.9/arch/parisc/include/asm/pgtable.h linux-3.0.9/arch/parisc/include/asm/pgtable.h
1293 --- linux-3.0.9/arch/parisc/include/asm/pgtable.h 2011-11-11 13:12:24.000000000 -0500
1294 +++ linux-3.0.9/arch/parisc/include/asm/pgtable.h 2011-11-15 20:02:59.000000000 -0500
1295 @@ -210,6 +210,17 @@ struct vm_area_struct;
1296 #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
1297 #define PAGE_COPY PAGE_EXECREAD
1298 #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
1299 +
1300 +#ifdef CONFIG_PAX_PAGEEXEC
1301 +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
1302 +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1303 +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1304 +#else
1305 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
1306 +# define PAGE_COPY_NOEXEC PAGE_COPY
1307 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
1308 +#endif
1309 +
1310 #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
1311 #define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL_EXEC)
1312 #define PAGE_KERNEL_RWX __pgprot(_PAGE_KERNEL_RWX)
1313 diff -urNp linux-3.0.9/arch/parisc/kernel/module.c linux-3.0.9/arch/parisc/kernel/module.c
1314 --- linux-3.0.9/arch/parisc/kernel/module.c 2011-11-11 13:12:24.000000000 -0500
1315 +++ linux-3.0.9/arch/parisc/kernel/module.c 2011-11-15 20:02:59.000000000 -0500
1316 @@ -98,16 +98,38 @@
1317
1318 /* three functions to determine where in the module core
1319 * or init pieces the location is */
1320 +static inline int in_init_rx(struct module *me, void *loc)
1321 +{
1322 + return (loc >= me->module_init_rx &&
1323 + loc < (me->module_init_rx + me->init_size_rx));
1324 +}
1325 +
1326 +static inline int in_init_rw(struct module *me, void *loc)
1327 +{
1328 + return (loc >= me->module_init_rw &&
1329 + loc < (me->module_init_rw + me->init_size_rw));
1330 +}
1331 +
1332 static inline int in_init(struct module *me, void *loc)
1333 {
1334 - return (loc >= me->module_init &&
1335 - loc <= (me->module_init + me->init_size));
1336 + return in_init_rx(me, loc) || in_init_rw(me, loc);
1337 +}
1338 +
1339 +static inline int in_core_rx(struct module *me, void *loc)
1340 +{
1341 + return (loc >= me->module_core_rx &&
1342 + loc < (me->module_core_rx + me->core_size_rx));
1343 +}
1344 +
1345 +static inline int in_core_rw(struct module *me, void *loc)
1346 +{
1347 + return (loc >= me->module_core_rw &&
1348 + loc < (me->module_core_rw + me->core_size_rw));
1349 }
1350
1351 static inline int in_core(struct module *me, void *loc)
1352 {
1353 - return (loc >= me->module_core &&
1354 - loc <= (me->module_core + me->core_size));
1355 + return in_core_rx(me, loc) || in_core_rw(me, loc);
1356 }
1357
1358 static inline int in_local(struct module *me, void *loc)
1359 @@ -373,13 +395,13 @@ int module_frob_arch_sections(CONST Elf_
1360 }
1361
1362 /* align things a bit */
1363 - me->core_size = ALIGN(me->core_size, 16);
1364 - me->arch.got_offset = me->core_size;
1365 - me->core_size += gots * sizeof(struct got_entry);
1366 -
1367 - me->core_size = ALIGN(me->core_size, 16);
1368 - me->arch.fdesc_offset = me->core_size;
1369 - me->core_size += fdescs * sizeof(Elf_Fdesc);
1370 + me->core_size_rw = ALIGN(me->core_size_rw, 16);
1371 + me->arch.got_offset = me->core_size_rw;
1372 + me->core_size_rw += gots * sizeof(struct got_entry);
1373 +
1374 + me->core_size_rw = ALIGN(me->core_size_rw, 16);
1375 + me->arch.fdesc_offset = me->core_size_rw;
1376 + me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
1377
1378 me->arch.got_max = gots;
1379 me->arch.fdesc_max = fdescs;
1380 @@ -397,7 +419,7 @@ static Elf64_Word get_got(struct module
1381
1382 BUG_ON(value == 0);
1383
1384 - got = me->module_core + me->arch.got_offset;
1385 + got = me->module_core_rw + me->arch.got_offset;
1386 for (i = 0; got[i].addr; i++)
1387 if (got[i].addr == value)
1388 goto out;
1389 @@ -415,7 +437,7 @@ static Elf64_Word get_got(struct module
1390 #ifdef CONFIG_64BIT
1391 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
1392 {
1393 - Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
1394 + Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
1395
1396 if (!value) {
1397 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
1398 @@ -433,7 +455,7 @@ static Elf_Addr get_fdesc(struct module
1399
1400 /* Create new one */
1401 fdesc->addr = value;
1402 - fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1403 + fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1404 return (Elf_Addr)fdesc;
1405 }
1406 #endif /* CONFIG_64BIT */
1407 @@ -857,7 +879,7 @@ register_unwind_table(struct module *me,
1408
1409 table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
1410 end = table + sechdrs[me->arch.unwind_section].sh_size;
1411 - gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1412 + gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1413
1414 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
1415 me->arch.unwind_section, table, end, gp);
1416 diff -urNp linux-3.0.9/arch/parisc/kernel/sys_parisc.c linux-3.0.9/arch/parisc/kernel/sys_parisc.c
1417 --- linux-3.0.9/arch/parisc/kernel/sys_parisc.c 2011-11-11 13:12:24.000000000 -0500
1418 +++ linux-3.0.9/arch/parisc/kernel/sys_parisc.c 2011-11-15 20:02:59.000000000 -0500
1419 @@ -43,7 +43,7 @@ static unsigned long get_unshared_area(u
1420 /* At this point: (!vma || addr < vma->vm_end). */
1421 if (TASK_SIZE - len < addr)
1422 return -ENOMEM;
1423 - if (!vma || addr + len <= vma->vm_start)
1424 + if (check_heap_stack_gap(vma, addr, len))
1425 return addr;
1426 addr = vma->vm_end;
1427 }
1428 @@ -79,7 +79,7 @@ static unsigned long get_shared_area(str
1429 /* At this point: (!vma || addr < vma->vm_end). */
1430 if (TASK_SIZE - len < addr)
1431 return -ENOMEM;
1432 - if (!vma || addr + len <= vma->vm_start)
1433 + if (check_heap_stack_gap(vma, addr, len))
1434 return addr;
1435 addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
1436 if (addr < vma->vm_end) /* handle wraparound */
1437 @@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str
1438 if (flags & MAP_FIXED)
1439 return addr;
1440 if (!addr)
1441 - addr = TASK_UNMAPPED_BASE;
1442 + addr = current->mm->mmap_base;
1443
1444 if (filp) {
1445 addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
1446 diff -urNp linux-3.0.9/arch/parisc/kernel/traps.c linux-3.0.9/arch/parisc/kernel/traps.c
1447 --- linux-3.0.9/arch/parisc/kernel/traps.c 2011-11-11 13:12:24.000000000 -0500
1448 +++ linux-3.0.9/arch/parisc/kernel/traps.c 2011-11-15 20:02:59.000000000 -0500
1449 @@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
1450
1451 down_read(&current->mm->mmap_sem);
1452 vma = find_vma(current->mm,regs->iaoq[0]);
1453 - if (vma && (regs->iaoq[0] >= vma->vm_start)
1454 - && (vma->vm_flags & VM_EXEC)) {
1455 -
1456 + if (vma && (regs->iaoq[0] >= vma->vm_start)) {
1457 fault_address = regs->iaoq[0];
1458 fault_space = regs->iasq[0];
1459
1460 diff -urNp linux-3.0.9/arch/parisc/mm/fault.c linux-3.0.9/arch/parisc/mm/fault.c
1461 --- linux-3.0.9/arch/parisc/mm/fault.c 2011-11-11 13:12:24.000000000 -0500
1462 +++ linux-3.0.9/arch/parisc/mm/fault.c 2011-11-15 20:02:59.000000000 -0500
1463 @@ -15,6 +15,7 @@
1464 #include <linux/sched.h>
1465 #include <linux/interrupt.h>
1466 #include <linux/module.h>
1467 +#include <linux/unistd.h>
1468
1469 #include <asm/uaccess.h>
1470 #include <asm/traps.h>
1471 @@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex
1472 static unsigned long
1473 parisc_acctyp(unsigned long code, unsigned int inst)
1474 {
1475 - if (code == 6 || code == 16)
1476 + if (code == 6 || code == 7 || code == 16)
1477 return VM_EXEC;
1478
1479 switch (inst & 0xf0000000) {
1480 @@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign
1481 }
1482 #endif
1483
1484 +#ifdef CONFIG_PAX_PAGEEXEC
1485 +/*
1486 + * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
1487 + *
1488 + * returns 1 when task should be killed
1489 + * 2 when rt_sigreturn trampoline was detected
1490 + * 3 when unpatched PLT trampoline was detected
1491 + */
1492 +static int pax_handle_fetch_fault(struct pt_regs *regs)
1493 +{
1494 +
1495 +#ifdef CONFIG_PAX_EMUPLT
1496 + int err;
1497 +
1498 + do { /* PaX: unpatched PLT emulation */
1499 + unsigned int bl, depwi;
1500 +
1501 + err = get_user(bl, (unsigned int *)instruction_pointer(regs));
1502 + err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
1503 +
1504 + if (err)
1505 + break;
1506 +
1507 + if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
1508 + unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
1509 +
1510 + err = get_user(ldw, (unsigned int *)addr);
1511 + err |= get_user(bv, (unsigned int *)(addr+4));
1512 + err |= get_user(ldw2, (unsigned int *)(addr+8));
1513 +
1514 + if (err)
1515 + break;
1516 +
1517 + if (ldw == 0x0E801096U &&
1518 + bv == 0xEAC0C000U &&
1519 + ldw2 == 0x0E881095U)
1520 + {
1521 + unsigned int resolver, map;
1522 +
1523 + err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
1524 + err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
1525 + if (err)
1526 + break;
1527 +
1528 + regs->gr[20] = instruction_pointer(regs)+8;
1529 + regs->gr[21] = map;
1530 + regs->gr[22] = resolver;
1531 + regs->iaoq[0] = resolver | 3UL;
1532 + regs->iaoq[1] = regs->iaoq[0] + 4;
1533 + return 3;
1534 + }
1535 + }
1536 + } while (0);
1537 +#endif
1538 +
1539 +#ifdef CONFIG_PAX_EMUTRAMP
1540 +
1541 +#ifndef CONFIG_PAX_EMUSIGRT
1542 + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
1543 + return 1;
1544 +#endif
1545 +
1546 + do { /* PaX: rt_sigreturn emulation */
1547 + unsigned int ldi1, ldi2, bel, nop;
1548 +
1549 + err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
1550 + err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
1551 + err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
1552 + err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
1553 +
1554 + if (err)
1555 + break;
1556 +
1557 + if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
1558 + ldi2 == 0x3414015AU &&
1559 + bel == 0xE4008200U &&
1560 + nop == 0x08000240U)
1561 + {
1562 + regs->gr[25] = (ldi1 & 2) >> 1;
1563 + regs->gr[20] = __NR_rt_sigreturn;
1564 + regs->gr[31] = regs->iaoq[1] + 16;
1565 + regs->sr[0] = regs->iasq[1];
1566 + regs->iaoq[0] = 0x100UL;
1567 + regs->iaoq[1] = regs->iaoq[0] + 4;
1568 + regs->iasq[0] = regs->sr[2];
1569 + regs->iasq[1] = regs->sr[2];
1570 + return 2;
1571 + }
1572 + } while (0);
1573 +#endif
1574 +
1575 + return 1;
1576 +}
1577 +
1578 +void pax_report_insns(void *pc, void *sp)
1579 +{
1580 + unsigned long i;
1581 +
1582 + printk(KERN_ERR "PAX: bytes at PC: ");
1583 + for (i = 0; i < 5; i++) {
1584 + unsigned int c;
1585 + if (get_user(c, (unsigned int *)pc+i))
1586 + printk(KERN_CONT "???????? ");
1587 + else
1588 + printk(KERN_CONT "%08x ", c);
1589 + }
1590 + printk("\n");
1591 +}
1592 +#endif
1593 +
1594 int fixup_exception(struct pt_regs *regs)
1595 {
1596 const struct exception_table_entry *fix;
1597 @@ -192,8 +303,33 @@ good_area:
1598
1599 acc_type = parisc_acctyp(code,regs->iir);
1600
1601 - if ((vma->vm_flags & acc_type) != acc_type)
1602 + if ((vma->vm_flags & acc_type) != acc_type) {
1603 +
1604 +#ifdef CONFIG_PAX_PAGEEXEC
1605 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
1606 + (address & ~3UL) == instruction_pointer(regs))
1607 + {
1608 + up_read(&mm->mmap_sem);
1609 + switch (pax_handle_fetch_fault(regs)) {
1610 +
1611 +#ifdef CONFIG_PAX_EMUPLT
1612 + case 3:
1613 + return;
1614 +#endif
1615 +
1616 +#ifdef CONFIG_PAX_EMUTRAMP
1617 + case 2:
1618 + return;
1619 +#endif
1620 +
1621 + }
1622 + pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
1623 + do_group_exit(SIGKILL);
1624 + }
1625 +#endif
1626 +
1627 goto bad_area;
1628 + }
1629
1630 /*
1631 * If for any reason at all we couldn't handle the fault, make
1632 diff -urNp linux-3.0.9/arch/powerpc/include/asm/elf.h linux-3.0.9/arch/powerpc/include/asm/elf.h
1633 --- linux-3.0.9/arch/powerpc/include/asm/elf.h 2011-11-11 13:12:24.000000000 -0500
1634 +++ linux-3.0.9/arch/powerpc/include/asm/elf.h 2011-11-15 20:02:59.000000000 -0500
1635 @@ -178,8 +178,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
1636 the loader. We need to make sure that it is out of the way of the program
1637 that it will "exec", and that there is sufficient room for the brk. */
1638
1639 -extern unsigned long randomize_et_dyn(unsigned long base);
1640 -#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
1641 +#define ELF_ET_DYN_BASE (0x20000000)
1642 +
1643 +#ifdef CONFIG_PAX_ASLR
1644 +#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
1645 +
1646 +#ifdef __powerpc64__
1647 +#define PAX_DELTA_MMAP_LEN (is_32bit_task() ? 16 : 28)
1648 +#define PAX_DELTA_STACK_LEN (is_32bit_task() ? 16 : 28)
1649 +#else
1650 +#define PAX_DELTA_MMAP_LEN 15
1651 +#define PAX_DELTA_STACK_LEN 15
1652 +#endif
1653 +#endif
1654
1655 /*
1656 * Our registers are always unsigned longs, whether we're a 32 bit
1657 @@ -274,9 +285,6 @@ extern int arch_setup_additional_pages(s
1658 (0x7ff >> (PAGE_SHIFT - 12)) : \
1659 (0x3ffff >> (PAGE_SHIFT - 12)))
1660
1661 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
1662 -#define arch_randomize_brk arch_randomize_brk
1663 -
1664 #endif /* __KERNEL__ */
1665
1666 /*
1667 diff -urNp linux-3.0.9/arch/powerpc/include/asm/kmap_types.h linux-3.0.9/arch/powerpc/include/asm/kmap_types.h
1668 --- linux-3.0.9/arch/powerpc/include/asm/kmap_types.h 2011-11-11 13:12:24.000000000 -0500
1669 +++ linux-3.0.9/arch/powerpc/include/asm/kmap_types.h 2011-11-15 20:02:59.000000000 -0500
1670 @@ -27,6 +27,7 @@ enum km_type {
1671 KM_PPC_SYNC_PAGE,
1672 KM_PPC_SYNC_ICACHE,
1673 KM_KDB,
1674 + KM_CLEARPAGE,
1675 KM_TYPE_NR
1676 };
1677
1678 diff -urNp linux-3.0.9/arch/powerpc/include/asm/mman.h linux-3.0.9/arch/powerpc/include/asm/mman.h
1679 --- linux-3.0.9/arch/powerpc/include/asm/mman.h 2011-11-11 13:12:24.000000000 -0500
1680 +++ linux-3.0.9/arch/powerpc/include/asm/mman.h 2011-11-15 20:02:59.000000000 -0500
1681 @@ -44,7 +44,7 @@ static inline unsigned long arch_calc_vm
1682 }
1683 #define arch_calc_vm_prot_bits(prot) arch_calc_vm_prot_bits(prot)
1684
1685 -static inline pgprot_t arch_vm_get_page_prot(unsigned long vm_flags)
1686 +static inline pgprot_t arch_vm_get_page_prot(vm_flags_t vm_flags)
1687 {
1688 return (vm_flags & VM_SAO) ? __pgprot(_PAGE_SAO) : __pgprot(0);
1689 }
1690 diff -urNp linux-3.0.9/arch/powerpc/include/asm/page_64.h linux-3.0.9/arch/powerpc/include/asm/page_64.h
1691 --- linux-3.0.9/arch/powerpc/include/asm/page_64.h 2011-11-11 13:12:24.000000000 -0500
1692 +++ linux-3.0.9/arch/powerpc/include/asm/page_64.h 2011-11-15 20:02:59.000000000 -0500
1693 @@ -155,15 +155,18 @@ do { \
1694 * stack by default, so in the absence of a PT_GNU_STACK program header
1695 * we turn execute permission off.
1696 */
1697 -#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
1698 - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
1699 +#define VM_STACK_DEFAULT_FLAGS32 \
1700 + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
1701 + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
1702
1703 #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
1704 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
1705
1706 +#ifndef CONFIG_PAX_PAGEEXEC
1707 #define VM_STACK_DEFAULT_FLAGS \
1708 (is_32bit_task() ? \
1709 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
1710 +#endif
1711
1712 #include <asm-generic/getorder.h>
1713
1714 diff -urNp linux-3.0.9/arch/powerpc/include/asm/page.h linux-3.0.9/arch/powerpc/include/asm/page.h
1715 --- linux-3.0.9/arch/powerpc/include/asm/page.h 2011-11-11 13:12:24.000000000 -0500
1716 +++ linux-3.0.9/arch/powerpc/include/asm/page.h 2011-11-15 20:02:59.000000000 -0500
1717 @@ -129,8 +129,9 @@ extern phys_addr_t kernstart_addr;
1718 * and needs to be executable. This means the whole heap ends
1719 * up being executable.
1720 */
1721 -#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
1722 - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
1723 +#define VM_DATA_DEFAULT_FLAGS32 \
1724 + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
1725 + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
1726
1727 #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
1728 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
1729 @@ -158,6 +159,9 @@ extern phys_addr_t kernstart_addr;
1730 #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
1731 #endif
1732
1733 +#define ktla_ktva(addr) (addr)
1734 +#define ktva_ktla(addr) (addr)
1735 +
1736 #ifndef __ASSEMBLY__
1737
1738 #undef STRICT_MM_TYPECHECKS
1739 diff -urNp linux-3.0.9/arch/powerpc/include/asm/pgtable.h linux-3.0.9/arch/powerpc/include/asm/pgtable.h
1740 --- linux-3.0.9/arch/powerpc/include/asm/pgtable.h 2011-11-11 13:12:24.000000000 -0500
1741 +++ linux-3.0.9/arch/powerpc/include/asm/pgtable.h 2011-11-15 20:02:59.000000000 -0500
1742 @@ -2,6 +2,7 @@
1743 #define _ASM_POWERPC_PGTABLE_H
1744 #ifdef __KERNEL__
1745
1746 +#include <linux/const.h>
1747 #ifndef __ASSEMBLY__
1748 #include <asm/processor.h> /* For TASK_SIZE */
1749 #include <asm/mmu.h>
1750 diff -urNp linux-3.0.9/arch/powerpc/include/asm/pte-hash32.h linux-3.0.9/arch/powerpc/include/asm/pte-hash32.h
1751 --- linux-3.0.9/arch/powerpc/include/asm/pte-hash32.h 2011-11-11 13:12:24.000000000 -0500
1752 +++ linux-3.0.9/arch/powerpc/include/asm/pte-hash32.h 2011-11-15 20:02:59.000000000 -0500
1753 @@ -21,6 +21,7 @@
1754 #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
1755 #define _PAGE_USER 0x004 /* usermode access allowed */
1756 #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
1757 +#define _PAGE_EXEC _PAGE_GUARDED
1758 #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
1759 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
1760 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
1761 diff -urNp linux-3.0.9/arch/powerpc/include/asm/reg.h linux-3.0.9/arch/powerpc/include/asm/reg.h
1762 --- linux-3.0.9/arch/powerpc/include/asm/reg.h 2011-11-11 13:12:24.000000000 -0500
1763 +++ linux-3.0.9/arch/powerpc/include/asm/reg.h 2011-11-15 20:02:59.000000000 -0500
1764 @@ -209,6 +209,7 @@
1765 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
1766 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
1767 #define DSISR_NOHPTE 0x40000000 /* no translation found */
1768 +#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
1769 #define DSISR_PROTFAULT 0x08000000 /* protection fault */
1770 #define DSISR_ISSTORE 0x02000000 /* access was a store */
1771 #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
1772 diff -urNp linux-3.0.9/arch/powerpc/include/asm/system.h linux-3.0.9/arch/powerpc/include/asm/system.h
1773 --- linux-3.0.9/arch/powerpc/include/asm/system.h 2011-11-11 13:12:24.000000000 -0500
1774 +++ linux-3.0.9/arch/powerpc/include/asm/system.h 2011-11-15 20:02:59.000000000 -0500
1775 @@ -531,7 +531,7 @@ __cmpxchg_local(volatile void *ptr, unsi
1776 #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
1777 #endif
1778
1779 -extern unsigned long arch_align_stack(unsigned long sp);
1780 +#define arch_align_stack(x) ((x) & ~0xfUL)
1781
1782 /* Used in very early kernel initialization. */
1783 extern unsigned long reloc_offset(void);
1784 diff -urNp linux-3.0.9/arch/powerpc/include/asm/uaccess.h linux-3.0.9/arch/powerpc/include/asm/uaccess.h
1785 --- linux-3.0.9/arch/powerpc/include/asm/uaccess.h 2011-11-11 13:12:24.000000000 -0500
1786 +++ linux-3.0.9/arch/powerpc/include/asm/uaccess.h 2011-11-15 20:02:59.000000000 -0500
1787 @@ -13,6 +13,8 @@
1788 #define VERIFY_READ 0
1789 #define VERIFY_WRITE 1
1790
1791 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
1792 +
1793 /*
1794 * The fs value determines whether argument validity checking should be
1795 * performed or not. If get_fs() == USER_DS, checking is performed, with
1796 @@ -327,52 +329,6 @@ do { \
1797 extern unsigned long __copy_tofrom_user(void __user *to,
1798 const void __user *from, unsigned long size);
1799
1800 -#ifndef __powerpc64__
1801 -
1802 -static inline unsigned long copy_from_user(void *to,
1803 - const void __user *from, unsigned long n)
1804 -{
1805 - unsigned long over;
1806 -
1807 - if (access_ok(VERIFY_READ, from, n))
1808 - return __copy_tofrom_user((__force void __user *)to, from, n);
1809 - if ((unsigned long)from < TASK_SIZE) {
1810 - over = (unsigned long)from + n - TASK_SIZE;
1811 - return __copy_tofrom_user((__force void __user *)to, from,
1812 - n - over) + over;
1813 - }
1814 - return n;
1815 -}
1816 -
1817 -static inline unsigned long copy_to_user(void __user *to,
1818 - const void *from, unsigned long n)
1819 -{
1820 - unsigned long over;
1821 -
1822 - if (access_ok(VERIFY_WRITE, to, n))
1823 - return __copy_tofrom_user(to, (__force void __user *)from, n);
1824 - if ((unsigned long)to < TASK_SIZE) {
1825 - over = (unsigned long)to + n - TASK_SIZE;
1826 - return __copy_tofrom_user(to, (__force void __user *)from,
1827 - n - over) + over;
1828 - }
1829 - return n;
1830 -}
1831 -
1832 -#else /* __powerpc64__ */
1833 -
1834 -#define __copy_in_user(to, from, size) \
1835 - __copy_tofrom_user((to), (from), (size))
1836 -
1837 -extern unsigned long copy_from_user(void *to, const void __user *from,
1838 - unsigned long n);
1839 -extern unsigned long copy_to_user(void __user *to, const void *from,
1840 - unsigned long n);
1841 -extern unsigned long copy_in_user(void __user *to, const void __user *from,
1842 - unsigned long n);
1843 -
1844 -#endif /* __powerpc64__ */
1845 -
1846 static inline unsigned long __copy_from_user_inatomic(void *to,
1847 const void __user *from, unsigned long n)
1848 {
1849 @@ -396,6 +352,10 @@ static inline unsigned long __copy_from_
1850 if (ret == 0)
1851 return 0;
1852 }
1853 +
1854 + if (!__builtin_constant_p(n))
1855 + check_object_size(to, n, false);
1856 +
1857 return __copy_tofrom_user((__force void __user *)to, from, n);
1858 }
1859
1860 @@ -422,6 +382,10 @@ static inline unsigned long __copy_to_us
1861 if (ret == 0)
1862 return 0;
1863 }
1864 +
1865 + if (!__builtin_constant_p(n))
1866 + check_object_size(from, n, true);
1867 +
1868 return __copy_tofrom_user(to, (__force const void __user *)from, n);
1869 }
1870
1871 @@ -439,6 +403,92 @@ static inline unsigned long __copy_to_us
1872 return __copy_to_user_inatomic(to, from, size);
1873 }
1874
1875 +#ifndef __powerpc64__
1876 +
1877 +static inline unsigned long __must_check copy_from_user(void *to,
1878 + const void __user *from, unsigned long n)
1879 +{
1880 + unsigned long over;
1881 +
1882 + if ((long)n < 0)
1883 + return n;
1884 +
1885 + if (access_ok(VERIFY_READ, from, n)) {
1886 + if (!__builtin_constant_p(n))
1887 + check_object_size(to, n, false);
1888 + return __copy_tofrom_user((__force void __user *)to, from, n);
1889 + }
1890 + if ((unsigned long)from < TASK_SIZE) {
1891 + over = (unsigned long)from + n - TASK_SIZE;
1892 + if (!__builtin_constant_p(n - over))
1893 + check_object_size(to, n - over, false);
1894 + return __copy_tofrom_user((__force void __user *)to, from,
1895 + n - over) + over;
1896 + }
1897 + return n;
1898 +}
1899 +
1900 +static inline unsigned long __must_check copy_to_user(void __user *to,
1901 + const void *from, unsigned long n)
1902 +{
1903 + unsigned long over;
1904 +
1905 + if ((long)n < 0)
1906 + return n;
1907 +
1908 + if (access_ok(VERIFY_WRITE, to, n)) {
1909 + if (!__builtin_constant_p(n))
1910 + check_object_size(from, n, true);
1911 + return __copy_tofrom_user(to, (__force void __user *)from, n);
1912 + }
1913 + if ((unsigned long)to < TASK_SIZE) {
1914 + over = (unsigned long)to + n - TASK_SIZE;
1915 + if (!__builtin_constant_p(n))
1916 + check_object_size(from, n - over, true);
1917 + return __copy_tofrom_user(to, (__force void __user *)from,
1918 + n - over) + over;
1919 + }
1920 + return n;
1921 +}
1922 +
1923 +#else /* __powerpc64__ */
1924 +
1925 +#define __copy_in_user(to, from, size) \
1926 + __copy_tofrom_user((to), (from), (size))
1927 +
1928 +static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
1929 +{
1930 + if ((long)n < 0 || n > INT_MAX)
1931 + return n;
1932 +
1933 + if (!__builtin_constant_p(n))
1934 + check_object_size(to, n, false);
1935 +
1936 + if (likely(access_ok(VERIFY_READ, from, n)))
1937 + n = __copy_from_user(to, from, n);
1938 + else
1939 + memset(to, 0, n);
1940 + return n;
1941 +}
1942 +
1943 +static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
1944 +{
1945 + if ((long)n < 0 || n > INT_MAX)
1946 + return n;
1947 +
1948 + if (likely(access_ok(VERIFY_WRITE, to, n))) {
1949 + if (!__builtin_constant_p(n))
1950 + check_object_size(from, n, true);
1951 + n = __copy_to_user(to, from, n);
1952 + }
1953 + return n;
1954 +}
1955 +
1956 +extern unsigned long copy_in_user(void __user *to, const void __user *from,
1957 + unsigned long n);
1958 +
1959 +#endif /* __powerpc64__ */
1960 +
1961 extern unsigned long __clear_user(void __user *addr, unsigned long size);
1962
1963 static inline unsigned long clear_user(void __user *addr, unsigned long size)
1964 diff -urNp linux-3.0.9/arch/powerpc/kernel/exceptions-64e.S linux-3.0.9/arch/powerpc/kernel/exceptions-64e.S
1965 --- linux-3.0.9/arch/powerpc/kernel/exceptions-64e.S 2011-11-11 13:12:24.000000000 -0500
1966 +++ linux-3.0.9/arch/powerpc/kernel/exceptions-64e.S 2011-11-15 20:02:59.000000000 -0500
1967 @@ -567,6 +567,7 @@ storage_fault_common:
1968 std r14,_DAR(r1)
1969 std r15,_DSISR(r1)
1970 addi r3,r1,STACK_FRAME_OVERHEAD
1971 + bl .save_nvgprs
1972 mr r4,r14
1973 mr r5,r15
1974 ld r14,PACA_EXGEN+EX_R14(r13)
1975 @@ -576,8 +577,7 @@ storage_fault_common:
1976 cmpdi r3,0
1977 bne- 1f
1978 b .ret_from_except_lite
1979 -1: bl .save_nvgprs
1980 - mr r5,r3
1981 +1: mr r5,r3
1982 addi r3,r1,STACK_FRAME_OVERHEAD
1983 ld r4,_DAR(r1)
1984 bl .bad_page_fault
1985 diff -urNp linux-3.0.9/arch/powerpc/kernel/exceptions-64s.S linux-3.0.9/arch/powerpc/kernel/exceptions-64s.S
1986 --- linux-3.0.9/arch/powerpc/kernel/exceptions-64s.S 2011-11-11 13:12:24.000000000 -0500
1987 +++ linux-3.0.9/arch/powerpc/kernel/exceptions-64s.S 2011-11-15 20:02:59.000000000 -0500
1988 @@ -956,10 +956,10 @@ handle_page_fault:
1989 11: ld r4,_DAR(r1)
1990 ld r5,_DSISR(r1)
1991 addi r3,r1,STACK_FRAME_OVERHEAD
1992 + bl .save_nvgprs
1993 bl .do_page_fault
1994 cmpdi r3,0
1995 beq+ 13f
1996 - bl .save_nvgprs
1997 mr r5,r3
1998 addi r3,r1,STACK_FRAME_OVERHEAD
1999 lwz r4,_DAR(r1)
2000 diff -urNp linux-3.0.9/arch/powerpc/kernel/module_32.c linux-3.0.9/arch/powerpc/kernel/module_32.c
2001 --- linux-3.0.9/arch/powerpc/kernel/module_32.c 2011-11-11 13:12:24.000000000 -0500
2002 +++ linux-3.0.9/arch/powerpc/kernel/module_32.c 2011-11-15 20:02:59.000000000 -0500
2003 @@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
2004 me->arch.core_plt_section = i;
2005 }
2006 if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
2007 - printk("Module doesn't contain .plt or .init.plt sections.\n");
2008 + printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
2009 return -ENOEXEC;
2010 }
2011
2012 @@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati
2013
2014 DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
2015 /* Init, or core PLT? */
2016 - if (location >= mod->module_core
2017 - && location < mod->module_core + mod->core_size)
2018 + if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
2019 + (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
2020 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
2021 - else
2022 + else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
2023 + (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
2024 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
2025 + else {
2026 + printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
2027 + return ~0UL;
2028 + }
2029
2030 /* Find this entry, or if that fails, the next avail. entry */
2031 while (entry->jump[0]) {
2032 diff -urNp linux-3.0.9/arch/powerpc/kernel/module.c linux-3.0.9/arch/powerpc/kernel/module.c
2033 --- linux-3.0.9/arch/powerpc/kernel/module.c 2011-11-11 13:12:24.000000000 -0500
2034 +++ linux-3.0.9/arch/powerpc/kernel/module.c 2011-11-15 20:02:59.000000000 -0500
2035 @@ -31,11 +31,24 @@
2036
2037 LIST_HEAD(module_bug_list);
2038
2039 +#ifdef CONFIG_PAX_KERNEXEC
2040 void *module_alloc(unsigned long size)
2041 {
2042 if (size == 0)
2043 return NULL;
2044
2045 + return vmalloc(size);
2046 +}
2047 +
2048 +void *module_alloc_exec(unsigned long size)
2049 +#else
2050 +void *module_alloc(unsigned long size)
2051 +#endif
2052 +
2053 +{
2054 + if (size == 0)
2055 + return NULL;
2056 +
2057 return vmalloc_exec(size);
2058 }
2059
2060 @@ -45,6 +58,13 @@ void module_free(struct module *mod, voi
2061 vfree(module_region);
2062 }
2063
2064 +#ifdef CONFIG_PAX_KERNEXEC
2065 +void module_free_exec(struct module *mod, void *module_region)
2066 +{
2067 + module_free(mod, module_region);
2068 +}
2069 +#endif
2070 +
2071 static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
2072 const Elf_Shdr *sechdrs,
2073 const char *name)
2074 diff -urNp linux-3.0.9/arch/powerpc/kernel/process.c linux-3.0.9/arch/powerpc/kernel/process.c
2075 --- linux-3.0.9/arch/powerpc/kernel/process.c 2011-11-11 13:12:24.000000000 -0500
2076 +++ linux-3.0.9/arch/powerpc/kernel/process.c 2011-11-15 20:02:59.000000000 -0500
2077 @@ -676,8 +676,8 @@ void show_regs(struct pt_regs * regs)
2078 * Lookup NIP late so we have the best change of getting the
2079 * above info out without failing
2080 */
2081 - printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
2082 - printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
2083 + printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
2084 + printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
2085 #endif
2086 show_stack(current, (unsigned long *) regs->gpr[1]);
2087 if (!user_mode(regs))
2088 @@ -1183,10 +1183,10 @@ void show_stack(struct task_struct *tsk,
2089 newsp = stack[0];
2090 ip = stack[STACK_FRAME_LR_SAVE];
2091 if (!firstframe || ip != lr) {
2092 - printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
2093 + printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
2094 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
2095 if ((ip == rth || ip == mrth) && curr_frame >= 0) {
2096 - printk(" (%pS)",
2097 + printk(" (%pA)",
2098 (void *)current->ret_stack[curr_frame].ret);
2099 curr_frame--;
2100 }
2101 @@ -1206,7 +1206,7 @@ void show_stack(struct task_struct *tsk,
2102 struct pt_regs *regs = (struct pt_regs *)
2103 (sp + STACK_FRAME_OVERHEAD);
2104 lr = regs->link;
2105 - printk("--- Exception: %lx at %pS\n LR = %pS\n",
2106 + printk("--- Exception: %lx at %pA\n LR = %pA\n",
2107 regs->trap, (void *)regs->nip, (void *)lr);
2108 firstframe = 1;
2109 }
2110 @@ -1281,58 +1281,3 @@ void thread_info_cache_init(void)
2111 }
2112
2113 #endif /* THREAD_SHIFT < PAGE_SHIFT */
2114 -
2115 -unsigned long arch_align_stack(unsigned long sp)
2116 -{
2117 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
2118 - sp -= get_random_int() & ~PAGE_MASK;
2119 - return sp & ~0xf;
2120 -}
2121 -
2122 -static inline unsigned long brk_rnd(void)
2123 -{
2124 - unsigned long rnd = 0;
2125 -
2126 - /* 8MB for 32bit, 1GB for 64bit */
2127 - if (is_32bit_task())
2128 - rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
2129 - else
2130 - rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
2131 -
2132 - return rnd << PAGE_SHIFT;
2133 -}
2134 -
2135 -unsigned long arch_randomize_brk(struct mm_struct *mm)
2136 -{
2137 - unsigned long base = mm->brk;
2138 - unsigned long ret;
2139 -
2140 -#ifdef CONFIG_PPC_STD_MMU_64
2141 - /*
2142 - * If we are using 1TB segments and we are allowed to randomise
2143 - * the heap, we can put it above 1TB so it is backed by a 1TB
2144 - * segment. Otherwise the heap will be in the bottom 1TB
2145 - * which always uses 256MB segments and this may result in a
2146 - * performance penalty.
2147 - */
2148 - if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
2149 - base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
2150 -#endif
2151 -
2152 - ret = PAGE_ALIGN(base + brk_rnd());
2153 -
2154 - if (ret < mm->brk)
2155 - return mm->brk;
2156 -
2157 - return ret;
2158 -}
2159 -
2160 -unsigned long randomize_et_dyn(unsigned long base)
2161 -{
2162 - unsigned long ret = PAGE_ALIGN(base + brk_rnd());
2163 -
2164 - if (ret < base)
2165 - return base;
2166 -
2167 - return ret;
2168 -}
2169 diff -urNp linux-3.0.9/arch/powerpc/kernel/signal_32.c linux-3.0.9/arch/powerpc/kernel/signal_32.c
2170 --- linux-3.0.9/arch/powerpc/kernel/signal_32.c 2011-11-11 13:12:24.000000000 -0500
2171 +++ linux-3.0.9/arch/powerpc/kernel/signal_32.c 2011-11-15 20:02:59.000000000 -0500
2172 @@ -859,7 +859,7 @@ int handle_rt_signal32(unsigned long sig
2173 /* Save user registers on the stack */
2174 frame = &rt_sf->uc.uc_mcontext;
2175 addr = frame;
2176 - if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
2177 + if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2178 if (save_user_regs(regs, frame, 0, 1))
2179 goto badframe;
2180 regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
2181 diff -urNp linux-3.0.9/arch/powerpc/kernel/signal_64.c linux-3.0.9/arch/powerpc/kernel/signal_64.c
2182 --- linux-3.0.9/arch/powerpc/kernel/signal_64.c 2011-11-11 13:12:24.000000000 -0500
2183 +++ linux-3.0.9/arch/powerpc/kernel/signal_64.c 2011-11-15 20:02:59.000000000 -0500
2184 @@ -430,7 +430,7 @@ int handle_rt_signal64(int signr, struct
2185 current->thread.fpscr.val = 0;
2186
2187 /* Set up to return from userspace. */
2188 - if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
2189 + if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2190 regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
2191 } else {
2192 err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
2193 diff -urNp linux-3.0.9/arch/powerpc/kernel/traps.c linux-3.0.9/arch/powerpc/kernel/traps.c
2194 --- linux-3.0.9/arch/powerpc/kernel/traps.c 2011-11-11 13:12:24.000000000 -0500
2195 +++ linux-3.0.9/arch/powerpc/kernel/traps.c 2011-11-15 20:02:59.000000000 -0500
2196 @@ -98,6 +98,8 @@ static void pmac_backlight_unblank(void)
2197 static inline void pmac_backlight_unblank(void) { }
2198 #endif
2199
2200 +extern void gr_handle_kernel_exploit(void);
2201 +
2202 int die(const char *str, struct pt_regs *regs, long err)
2203 {
2204 static struct {
2205 @@ -171,6 +173,8 @@ int die(const char *str, struct pt_regs
2206 if (panic_on_oops)
2207 panic("Fatal exception");
2208
2209 + gr_handle_kernel_exploit();
2210 +
2211 oops_exit();
2212 do_exit(err);
2213
2214 diff -urNp linux-3.0.9/arch/powerpc/kernel/vdso.c linux-3.0.9/arch/powerpc/kernel/vdso.c
2215 --- linux-3.0.9/arch/powerpc/kernel/vdso.c 2011-11-11 13:12:24.000000000 -0500
2216 +++ linux-3.0.9/arch/powerpc/kernel/vdso.c 2011-11-15 20:02:59.000000000 -0500
2217 @@ -36,6 +36,7 @@
2218 #include <asm/firmware.h>
2219 #include <asm/vdso.h>
2220 #include <asm/vdso_datapage.h>
2221 +#include <asm/mman.h>
2222
2223 #include "setup.h"
2224
2225 @@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l
2226 vdso_base = VDSO32_MBASE;
2227 #endif
2228
2229 - current->mm->context.vdso_base = 0;
2230 + current->mm->context.vdso_base = ~0UL;
2231
2232 /* vDSO has a problem and was disabled, just don't "enable" it for the
2233 * process
2234 @@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l
2235 vdso_base = get_unmapped_area(NULL, vdso_base,
2236 (vdso_pages << PAGE_SHIFT) +
2237 ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
2238 - 0, 0);
2239 + 0, MAP_PRIVATE | MAP_EXECUTABLE);
2240 if (IS_ERR_VALUE(vdso_base)) {
2241 rc = vdso_base;
2242 goto fail_mmapsem;
2243 diff -urNp linux-3.0.9/arch/powerpc/lib/usercopy_64.c linux-3.0.9/arch/powerpc/lib/usercopy_64.c
2244 --- linux-3.0.9/arch/powerpc/lib/usercopy_64.c 2011-11-11 13:12:24.000000000 -0500
2245 +++ linux-3.0.9/arch/powerpc/lib/usercopy_64.c 2011-11-15 20:02:59.000000000 -0500
2246 @@ -9,22 +9,6 @@
2247 #include <linux/module.h>
2248 #include <asm/uaccess.h>
2249
2250 -unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
2251 -{
2252 - if (likely(access_ok(VERIFY_READ, from, n)))
2253 - n = __copy_from_user(to, from, n);
2254 - else
2255 - memset(to, 0, n);
2256 - return n;
2257 -}
2258 -
2259 -unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
2260 -{
2261 - if (likely(access_ok(VERIFY_WRITE, to, n)))
2262 - n = __copy_to_user(to, from, n);
2263 - return n;
2264 -}
2265 -
2266 unsigned long copy_in_user(void __user *to, const void __user *from,
2267 unsigned long n)
2268 {
2269 @@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *
2270 return n;
2271 }
2272
2273 -EXPORT_SYMBOL(copy_from_user);
2274 -EXPORT_SYMBOL(copy_to_user);
2275 EXPORT_SYMBOL(copy_in_user);
2276
2277 diff -urNp linux-3.0.9/arch/powerpc/mm/fault.c linux-3.0.9/arch/powerpc/mm/fault.c
2278 --- linux-3.0.9/arch/powerpc/mm/fault.c 2011-11-11 13:12:24.000000000 -0500
2279 +++ linux-3.0.9/arch/powerpc/mm/fault.c 2011-11-15 20:02:59.000000000 -0500
2280 @@ -32,6 +32,10 @@
2281 #include <linux/perf_event.h>
2282 #include <linux/magic.h>
2283 #include <linux/ratelimit.h>
2284 +#include <linux/slab.h>
2285 +#include <linux/pagemap.h>
2286 +#include <linux/compiler.h>
2287 +#include <linux/unistd.h>
2288
2289 #include <asm/firmware.h>
2290 #include <asm/page.h>
2291 @@ -43,6 +47,7 @@
2292 #include <asm/tlbflush.h>
2293 #include <asm/siginfo.h>
2294 #include <mm/mmu_decl.h>
2295 +#include <asm/ptrace.h>
2296
2297 #ifdef CONFIG_KPROBES
2298 static inline int notify_page_fault(struct pt_regs *regs)
2299 @@ -66,6 +71,33 @@ static inline int notify_page_fault(stru
2300 }
2301 #endif
2302
2303 +#ifdef CONFIG_PAX_PAGEEXEC
2304 +/*
2305 + * PaX: decide what to do with offenders (regs->nip = fault address)
2306 + *
2307 + * returns 1 when task should be killed
2308 + */
2309 +static int pax_handle_fetch_fault(struct pt_regs *regs)
2310 +{
2311 + return 1;
2312 +}
2313 +
2314 +void pax_report_insns(void *pc, void *sp)
2315 +{
2316 + unsigned long i;
2317 +
2318 + printk(KERN_ERR "PAX: bytes at PC: ");
2319 + for (i = 0; i < 5; i++) {
2320 + unsigned int c;
2321 + if (get_user(c, (unsigned int __user *)pc+i))
2322 + printk(KERN_CONT "???????? ");
2323 + else
2324 + printk(KERN_CONT "%08x ", c);
2325 + }
2326 + printk("\n");
2327 +}
2328 +#endif
2329 +
2330 /*
2331 * Check whether the instruction at regs->nip is a store using
2332 * an update addressing form which will update r1.
2333 @@ -136,7 +168,7 @@ int __kprobes do_page_fault(struct pt_re
2334 * indicate errors in DSISR but can validly be set in SRR1.
2335 */
2336 if (trap == 0x400)
2337 - error_code &= 0x48200000;
2338 + error_code &= 0x58200000;
2339 else
2340 is_write = error_code & DSISR_ISSTORE;
2341 #else
2342 @@ -259,7 +291,7 @@ good_area:
2343 * "undefined". Of those that can be set, this is the only
2344 * one which seems bad.
2345 */
2346 - if (error_code & 0x10000000)
2347 + if (error_code & DSISR_GUARDED)
2348 /* Guarded storage error. */
2349 goto bad_area;
2350 #endif /* CONFIG_8xx */
2351 @@ -274,7 +306,7 @@ good_area:
2352 * processors use the same I/D cache coherency mechanism
2353 * as embedded.
2354 */
2355 - if (error_code & DSISR_PROTFAULT)
2356 + if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
2357 goto bad_area;
2358 #endif /* CONFIG_PPC_STD_MMU */
2359
2360 @@ -343,6 +375,23 @@ bad_area:
2361 bad_area_nosemaphore:
2362 /* User mode accesses cause a SIGSEGV */
2363 if (user_mode(regs)) {
2364 +
2365 +#ifdef CONFIG_PAX_PAGEEXEC
2366 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
2367 +#ifdef CONFIG_PPC_STD_MMU
2368 + if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
2369 +#else
2370 + if (is_exec && regs->nip == address) {
2371 +#endif
2372 + switch (pax_handle_fetch_fault(regs)) {
2373 + }
2374 +
2375 + pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
2376 + do_group_exit(SIGKILL);
2377 + }
2378 + }
2379 +#endif
2380 +
2381 _exception(SIGSEGV, regs, code, address);
2382 return 0;
2383 }
2384 diff -urNp linux-3.0.9/arch/powerpc/mm/mmap_64.c linux-3.0.9/arch/powerpc/mm/mmap_64.c
2385 --- linux-3.0.9/arch/powerpc/mm/mmap_64.c 2011-11-11 13:12:24.000000000 -0500
2386 +++ linux-3.0.9/arch/powerpc/mm/mmap_64.c 2011-11-15 20:02:59.000000000 -0500
2387 @@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
2388 */
2389 if (mmap_is_legacy()) {
2390 mm->mmap_base = TASK_UNMAPPED_BASE;
2391 +
2392 +#ifdef CONFIG_PAX_RANDMMAP
2393 + if (mm->pax_flags & MF_PAX_RANDMMAP)
2394 + mm->mmap_base += mm->delta_mmap;
2395 +#endif
2396 +
2397 mm->get_unmapped_area = arch_get_unmapped_area;
2398 mm->unmap_area = arch_unmap_area;
2399 } else {
2400 mm->mmap_base = mmap_base();
2401 +
2402 +#ifdef CONFIG_PAX_RANDMMAP
2403 + if (mm->pax_flags & MF_PAX_RANDMMAP)
2404 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
2405 +#endif
2406 +
2407 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
2408 mm->unmap_area = arch_unmap_area_topdown;
2409 }
2410 diff -urNp linux-3.0.9/arch/powerpc/mm/slice.c linux-3.0.9/arch/powerpc/mm/slice.c
2411 --- linux-3.0.9/arch/powerpc/mm/slice.c 2011-11-11 13:12:24.000000000 -0500
2412 +++ linux-3.0.9/arch/powerpc/mm/slice.c 2011-11-15 20:02:59.000000000 -0500
2413 @@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_
2414 if ((mm->task_size - len) < addr)
2415 return 0;
2416 vma = find_vma(mm, addr);
2417 - return (!vma || (addr + len) <= vma->vm_start);
2418 + return check_heap_stack_gap(vma, addr, len);
2419 }
2420
2421 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
2422 @@ -256,7 +256,7 @@ full_search:
2423 addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT);
2424 continue;
2425 }
2426 - if (!vma || addr + len <= vma->vm_start) {
2427 + if (check_heap_stack_gap(vma, addr, len)) {
2428 /*
2429 * Remember the place where we stopped the search:
2430 */
2431 @@ -313,10 +313,14 @@ static unsigned long slice_find_area_top
2432 }
2433 }
2434
2435 - addr = mm->mmap_base;
2436 - while (addr > len) {
2437 + if (mm->mmap_base < len)
2438 + addr = -ENOMEM;
2439 + else
2440 + addr = mm->mmap_base - len;
2441 +
2442 + while (!IS_ERR_VALUE(addr)) {
2443 /* Go down by chunk size */
2444 - addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
2445 + addr = _ALIGN_DOWN(addr, 1ul << pshift);
2446
2447 /* Check for hit with different page size */
2448 mask = slice_range_to_mask(addr, len);
2449 @@ -336,7 +340,7 @@ static unsigned long slice_find_area_top
2450 * return with success:
2451 */
2452 vma = find_vma(mm, addr);
2453 - if (!vma || (addr + len) <= vma->vm_start) {
2454 + if (check_heap_stack_gap(vma, addr, len)) {
2455 /* remember the address as a hint for next time */
2456 if (use_cache)
2457 mm->free_area_cache = addr;
2458 @@ -348,7 +352,7 @@ static unsigned long slice_find_area_top
2459 mm->cached_hole_size = vma->vm_start - addr;
2460
2461 /* try just below the current vma->vm_start */
2462 - addr = vma->vm_start;
2463 + addr = skip_heap_stack_gap(vma, len);
2464 }
2465
2466 /*
2467 @@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(un
2468 if (fixed && addr > (mm->task_size - len))
2469 return -EINVAL;
2470
2471 +#ifdef CONFIG_PAX_RANDMMAP
2472 + if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
2473 + addr = 0;
2474 +#endif
2475 +
2476 /* If hint, make sure it matches our alignment restrictions */
2477 if (!fixed && addr) {
2478 addr = _ALIGN_UP(addr, 1ul << pshift);
2479 diff -urNp linux-3.0.9/arch/s390/include/asm/elf.h linux-3.0.9/arch/s390/include/asm/elf.h
2480 --- linux-3.0.9/arch/s390/include/asm/elf.h 2011-11-11 13:12:24.000000000 -0500
2481 +++ linux-3.0.9/arch/s390/include/asm/elf.h 2011-11-15 20:02:59.000000000 -0500
2482 @@ -162,8 +162,14 @@ extern unsigned int vdso_enabled;
2483 the loader. We need to make sure that it is out of the way of the program
2484 that it will "exec", and that there is sufficient room for the brk. */
2485
2486 -extern unsigned long randomize_et_dyn(unsigned long base);
2487 -#define ELF_ET_DYN_BASE (randomize_et_dyn(STACK_TOP / 3 * 2))
2488 +#define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
2489 +
2490 +#ifdef CONFIG_PAX_ASLR
2491 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
2492 +
2493 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
2494 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
2495 +#endif
2496
2497 /* This yields a mask that user programs can use to figure out what
2498 instruction set this CPU supports. */
2499 @@ -210,7 +216,4 @@ struct linux_binprm;
2500 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
2501 int arch_setup_additional_pages(struct linux_binprm *, int);
2502
2503 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2504 -#define arch_randomize_brk arch_randomize_brk
2505 -
2506 #endif
2507 diff -urNp linux-3.0.9/arch/s390/include/asm/system.h linux-3.0.9/arch/s390/include/asm/system.h
2508 --- linux-3.0.9/arch/s390/include/asm/system.h 2011-11-11 13:12:24.000000000 -0500
2509 +++ linux-3.0.9/arch/s390/include/asm/system.h 2011-11-15 20:02:59.000000000 -0500
2510 @@ -255,7 +255,7 @@ extern void (*_machine_restart)(char *co
2511 extern void (*_machine_halt)(void);
2512 extern void (*_machine_power_off)(void);
2513
2514 -extern unsigned long arch_align_stack(unsigned long sp);
2515 +#define arch_align_stack(x) ((x) & ~0xfUL)
2516
2517 static inline int tprot(unsigned long addr)
2518 {
2519 diff -urNp linux-3.0.9/arch/s390/include/asm/uaccess.h linux-3.0.9/arch/s390/include/asm/uaccess.h
2520 --- linux-3.0.9/arch/s390/include/asm/uaccess.h 2011-11-11 13:12:24.000000000 -0500
2521 +++ linux-3.0.9/arch/s390/include/asm/uaccess.h 2011-11-15 20:02:59.000000000 -0500
2522 @@ -235,6 +235,10 @@ static inline unsigned long __must_check
2523 copy_to_user(void __user *to, const void *from, unsigned long n)
2524 {
2525 might_fault();
2526 +
2527 + if ((long)n < 0)
2528 + return n;
2529 +
2530 if (access_ok(VERIFY_WRITE, to, n))
2531 n = __copy_to_user(to, from, n);
2532 return n;
2533 @@ -260,6 +264,9 @@ copy_to_user(void __user *to, const void
2534 static inline unsigned long __must_check
2535 __copy_from_user(void *to, const void __user *from, unsigned long n)
2536 {
2537 + if ((long)n < 0)
2538 + return n;
2539 +
2540 if (__builtin_constant_p(n) && (n <= 256))
2541 return uaccess.copy_from_user_small(n, from, to);
2542 else
2543 @@ -294,6 +301,10 @@ copy_from_user(void *to, const void __us
2544 unsigned int sz = __compiletime_object_size(to);
2545
2546 might_fault();
2547 +
2548 + if ((long)n < 0)
2549 + return n;
2550 +
2551 if (unlikely(sz != -1 && sz < n)) {
2552 copy_from_user_overflow();
2553 return n;
2554 diff -urNp linux-3.0.9/arch/s390/kernel/module.c linux-3.0.9/arch/s390/kernel/module.c
2555 --- linux-3.0.9/arch/s390/kernel/module.c 2011-11-11 13:12:24.000000000 -0500
2556 +++ linux-3.0.9/arch/s390/kernel/module.c 2011-11-15 20:02:59.000000000 -0500
2557 @@ -168,11 +168,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
2558
2559 /* Increase core size by size of got & plt and set start
2560 offsets for got and plt. */
2561 - me->core_size = ALIGN(me->core_size, 4);
2562 - me->arch.got_offset = me->core_size;
2563 - me->core_size += me->arch.got_size;
2564 - me->arch.plt_offset = me->core_size;
2565 - me->core_size += me->arch.plt_size;
2566 + me->core_size_rw = ALIGN(me->core_size_rw, 4);
2567 + me->arch.got_offset = me->core_size_rw;
2568 + me->core_size_rw += me->arch.got_size;
2569 + me->arch.plt_offset = me->core_size_rx;
2570 + me->core_size_rx += me->arch.plt_size;
2571 return 0;
2572 }
2573
2574 @@ -258,7 +258,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
2575 if (info->got_initialized == 0) {
2576 Elf_Addr *gotent;
2577
2578 - gotent = me->module_core + me->arch.got_offset +
2579 + gotent = me->module_core_rw + me->arch.got_offset +
2580 info->got_offset;
2581 *gotent = val;
2582 info->got_initialized = 1;
2583 @@ -282,7 +282,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
2584 else if (r_type == R_390_GOTENT ||
2585 r_type == R_390_GOTPLTENT)
2586 *(unsigned int *) loc =
2587 - (val + (Elf_Addr) me->module_core - loc) >> 1;
2588 + (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
2589 else if (r_type == R_390_GOT64 ||
2590 r_type == R_390_GOTPLT64)
2591 *(unsigned long *) loc = val;
2592 @@ -296,7 +296,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
2593 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
2594 if (info->plt_initialized == 0) {
2595 unsigned int *ip;
2596 - ip = me->module_core + me->arch.plt_offset +
2597 + ip = me->module_core_rx + me->arch.plt_offset +
2598 info->plt_offset;
2599 #ifndef CONFIG_64BIT
2600 ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
2601 @@ -321,7 +321,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
2602 val - loc + 0xffffUL < 0x1ffffeUL) ||
2603 (r_type == R_390_PLT32DBL &&
2604 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
2605 - val = (Elf_Addr) me->module_core +
2606 + val = (Elf_Addr) me->module_core_rx +
2607 me->arch.plt_offset +
2608 info->plt_offset;
2609 val += rela->r_addend - loc;
2610 @@ -343,7 +343,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
2611 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
2612 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
2613 val = val + rela->r_addend -
2614 - ((Elf_Addr) me->module_core + me->arch.got_offset);
2615 + ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
2616 if (r_type == R_390_GOTOFF16)
2617 *(unsigned short *) loc = val;
2618 else if (r_type == R_390_GOTOFF32)
2619 @@ -353,7 +353,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
2620 break;
2621 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
2622 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
2623 - val = (Elf_Addr) me->module_core + me->arch.got_offset +
2624 + val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
2625 rela->r_addend - loc;
2626 if (r_type == R_390_GOTPC)
2627 *(unsigned int *) loc = val;
2628 diff -urNp linux-3.0.9/arch/s390/kernel/process.c linux-3.0.9/arch/s390/kernel/process.c
2629 --- linux-3.0.9/arch/s390/kernel/process.c 2011-11-11 13:12:24.000000000 -0500
2630 +++ linux-3.0.9/arch/s390/kernel/process.c 2011-11-15 20:02:59.000000000 -0500
2631 @@ -319,39 +319,3 @@ unsigned long get_wchan(struct task_stru
2632 }
2633 return 0;
2634 }
2635 -
2636 -unsigned long arch_align_stack(unsigned long sp)
2637 -{
2638 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
2639 - sp -= get_random_int() & ~PAGE_MASK;
2640 - return sp & ~0xf;
2641 -}
2642 -
2643 -static inline unsigned long brk_rnd(void)
2644 -{
2645 - /* 8MB for 32bit, 1GB for 64bit */
2646 - if (is_32bit_task())
2647 - return (get_random_int() & 0x7ffUL) << PAGE_SHIFT;
2648 - else
2649 - return (get_random_int() & 0x3ffffUL) << PAGE_SHIFT;
2650 -}
2651 -
2652 -unsigned long arch_randomize_brk(struct mm_struct *mm)
2653 -{
2654 - unsigned long ret = PAGE_ALIGN(mm->brk + brk_rnd());
2655 -
2656 - if (ret < mm->brk)
2657 - return mm->brk;
2658 - return ret;
2659 -}
2660 -
2661 -unsigned long randomize_et_dyn(unsigned long base)
2662 -{
2663 - unsigned long ret = PAGE_ALIGN(base + brk_rnd());
2664 -
2665 - if (!(current->flags & PF_RANDOMIZE))
2666 - return base;
2667 - if (ret < base)
2668 - return base;
2669 - return ret;
2670 -}
2671 diff -urNp linux-3.0.9/arch/s390/kernel/setup.c linux-3.0.9/arch/s390/kernel/setup.c
2672 --- linux-3.0.9/arch/s390/kernel/setup.c 2011-11-11 13:12:24.000000000 -0500
2673 +++ linux-3.0.9/arch/s390/kernel/setup.c 2011-11-15 20:02:59.000000000 -0500
2674 @@ -271,7 +271,7 @@ static int __init early_parse_mem(char *
2675 }
2676 early_param("mem", early_parse_mem);
2677
2678 -unsigned int user_mode = HOME_SPACE_MODE;
2679 +unsigned int user_mode = SECONDARY_SPACE_MODE;
2680 EXPORT_SYMBOL_GPL(user_mode);
2681
2682 static int set_amode_and_uaccess(unsigned long user_amode,
2683 diff -urNp linux-3.0.9/arch/s390/mm/mmap.c linux-3.0.9/arch/s390/mm/mmap.c
2684 --- linux-3.0.9/arch/s390/mm/mmap.c 2011-11-11 13:12:24.000000000 -0500
2685 +++ linux-3.0.9/arch/s390/mm/mmap.c 2011-11-15 20:02:59.000000000 -0500
2686 @@ -91,10 +91,22 @@ void arch_pick_mmap_layout(struct mm_str
2687 */
2688 if (mmap_is_legacy()) {
2689 mm->mmap_base = TASK_UNMAPPED_BASE;
2690 +
2691 +#ifdef CONFIG_PAX_RANDMMAP
2692 + if (mm->pax_flags & MF_PAX_RANDMMAP)
2693 + mm->mmap_base += mm->delta_mmap;
2694 +#endif
2695 +
2696 mm->get_unmapped_area = arch_get_unmapped_area;
2697 mm->unmap_area = arch_unmap_area;
2698 } else {
2699 mm->mmap_base = mmap_base();
2700 +
2701 +#ifdef CONFIG_PAX_RANDMMAP
2702 + if (mm->pax_flags & MF_PAX_RANDMMAP)
2703 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
2704 +#endif
2705 +
2706 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
2707 mm->unmap_area = arch_unmap_area_topdown;
2708 }
2709 @@ -166,10 +178,22 @@ void arch_pick_mmap_layout(struct mm_str
2710 */
2711 if (mmap_is_legacy()) {
2712 mm->mmap_base = TASK_UNMAPPED_BASE;
2713 +
2714 +#ifdef CONFIG_PAX_RANDMMAP
2715 + if (mm->pax_flags & MF_PAX_RANDMMAP)
2716 + mm->mmap_base += mm->delta_mmap;
2717 +#endif
2718 +
2719 mm->get_unmapped_area = s390_get_unmapped_area;
2720 mm->unmap_area = arch_unmap_area;
2721 } else {
2722 mm->mmap_base = mmap_base();
2723 +
2724 +#ifdef CONFIG_PAX_RANDMMAP
2725 + if (mm->pax_flags & MF_PAX_RANDMMAP)
2726 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
2727 +#endif
2728 +
2729 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
2730 mm->unmap_area = arch_unmap_area_topdown;
2731 }
2732 diff -urNp linux-3.0.9/arch/score/include/asm/system.h linux-3.0.9/arch/score/include/asm/system.h
2733 --- linux-3.0.9/arch/score/include/asm/system.h 2011-11-11 13:12:24.000000000 -0500
2734 +++ linux-3.0.9/arch/score/include/asm/system.h 2011-11-15 20:02:59.000000000 -0500
2735 @@ -17,7 +17,7 @@ do { \
2736 #define finish_arch_switch(prev) do {} while (0)
2737
2738 typedef void (*vi_handler_t)(void);
2739 -extern unsigned long arch_align_stack(unsigned long sp);
2740 +#define arch_align_stack(x) (x)
2741
2742 #define mb() barrier()
2743 #define rmb() barrier()
2744 diff -urNp linux-3.0.9/arch/score/kernel/process.c linux-3.0.9/arch/score/kernel/process.c
2745 --- linux-3.0.9/arch/score/kernel/process.c 2011-11-11 13:12:24.000000000 -0500
2746 +++ linux-3.0.9/arch/score/kernel/process.c 2011-11-15 20:02:59.000000000 -0500
2747 @@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_stru
2748
2749 return task_pt_regs(task)->cp0_epc;
2750 }
2751 -
2752 -unsigned long arch_align_stack(unsigned long sp)
2753 -{
2754 - return sp;
2755 -}
2756 diff -urNp linux-3.0.9/arch/sh/mm/mmap.c linux-3.0.9/arch/sh/mm/mmap.c
2757 --- linux-3.0.9/arch/sh/mm/mmap.c 2011-11-11 13:12:24.000000000 -0500
2758 +++ linux-3.0.9/arch/sh/mm/mmap.c 2011-11-15 20:02:59.000000000 -0500
2759 @@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(str
2760 addr = PAGE_ALIGN(addr);
2761
2762 vma = find_vma(mm, addr);
2763 - if (TASK_SIZE - len >= addr &&
2764 - (!vma || addr + len <= vma->vm_start))
2765 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
2766 return addr;
2767 }
2768
2769 @@ -106,7 +105,7 @@ full_search:
2770 }
2771 return -ENOMEM;
2772 }
2773 - if (likely(!vma || addr + len <= vma->vm_start)) {
2774 + if (likely(check_heap_stack_gap(vma, addr, len))) {
2775 /*
2776 * Remember the place where we stopped the search:
2777 */
2778 @@ -157,8 +156,7 @@ arch_get_unmapped_area_topdown(struct fi
2779 addr = PAGE_ALIGN(addr);
2780
2781 vma = find_vma(mm, addr);
2782 - if (TASK_SIZE - len >= addr &&
2783 - (!vma || addr + len <= vma->vm_start))
2784 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
2785 return addr;
2786 }
2787
2788 @@ -179,7 +177,7 @@ arch_get_unmapped_area_topdown(struct fi
2789 /* make sure it can fit in the remaining address space */
2790 if (likely(addr > len)) {
2791 vma = find_vma(mm, addr-len);
2792 - if (!vma || addr <= vma->vm_start) {
2793 + if (check_heap_stack_gap(vma, addr - len, len)) {
2794 /* remember the address as a hint for next time */
2795 return (mm->free_area_cache = addr-len);
2796 }
2797 @@ -188,18 +186,18 @@ arch_get_unmapped_area_topdown(struct fi
2798 if (unlikely(mm->mmap_base < len))
2799 goto bottomup;
2800
2801 - addr = mm->mmap_base-len;
2802 - if (do_colour_align)
2803 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
2804 + addr = mm->mmap_base - len;
2805
2806 do {
2807 + if (do_colour_align)
2808 + addr = COLOUR_ALIGN_DOWN(addr, pgoff);
2809 /*
2810 * Lookup failure means no vma is above this address,
2811 * else if new region fits below vma->vm_start,
2812 * return with success:
2813 */
2814 vma = find_vma(mm, addr);
2815 - if (likely(!vma || addr+len <= vma->vm_start)) {
2816 + if (likely(check_heap_stack_gap(vma, addr, len))) {
2817 /* remember the address as a hint for next time */
2818 return (mm->free_area_cache = addr);
2819 }
2820 @@ -209,10 +207,8 @@ arch_get_unmapped_area_topdown(struct fi
2821 mm->cached_hole_size = vma->vm_start - addr;
2822
2823 /* try just below the current vma->vm_start */
2824 - addr = vma->vm_start-len;
2825 - if (do_colour_align)
2826 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
2827 - } while (likely(len < vma->vm_start));
2828 + addr = skip_heap_stack_gap(vma, len);
2829 + } while (!IS_ERR_VALUE(addr));
2830
2831 bottomup:
2832 /*
2833 diff -urNp linux-3.0.9/arch/sparc/include/asm/atomic_64.h linux-3.0.9/arch/sparc/include/asm/atomic_64.h
2834 --- linux-3.0.9/arch/sparc/include/asm/atomic_64.h 2011-11-11 13:12:24.000000000 -0500
2835 +++ linux-3.0.9/arch/sparc/include/asm/atomic_64.h 2011-11-15 20:02:59.000000000 -0500
2836 @@ -14,18 +14,40 @@
2837 #define ATOMIC64_INIT(i) { (i) }
2838
2839 #define atomic_read(v) (*(volatile int *)&(v)->counter)
2840 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
2841 +{
2842 + return v->counter;
2843 +}
2844 #define atomic64_read(v) (*(volatile long *)&(v)->counter)
2845 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
2846 +{
2847 + return v->counter;
2848 +}
2849
2850 #define atomic_set(v, i) (((v)->counter) = i)
2851 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
2852 +{
2853 + v->counter = i;
2854 +}
2855 #define atomic64_set(v, i) (((v)->counter) = i)
2856 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
2857 +{
2858 + v->counter = i;
2859 +}
2860
2861 extern void atomic_add(int, atomic_t *);
2862 +extern void atomic_add_unchecked(int, atomic_unchecked_t *);
2863 extern void atomic64_add(long, atomic64_t *);
2864 +extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
2865 extern void atomic_sub(int, atomic_t *);
2866 +extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
2867 extern void atomic64_sub(long, atomic64_t *);
2868 +extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
2869
2870 extern int atomic_add_ret(int, atomic_t *);
2871 +extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
2872 extern long atomic64_add_ret(long, atomic64_t *);
2873 +extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
2874 extern int atomic_sub_ret(int, atomic_t *);
2875 extern long atomic64_sub_ret(long, atomic64_t *);
2876
2877 @@ -33,13 +55,29 @@ extern long atomic64_sub_ret(long, atomi
2878 #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
2879
2880 #define atomic_inc_return(v) atomic_add_ret(1, v)
2881 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
2882 +{
2883 + return atomic_add_ret_unchecked(1, v);
2884 +}
2885 #define atomic64_inc_return(v) atomic64_add_ret(1, v)
2886 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
2887 +{
2888 + return atomic64_add_ret_unchecked(1, v);
2889 +}
2890
2891 #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
2892 #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
2893
2894 #define atomic_add_return(i, v) atomic_add_ret(i, v)
2895 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
2896 +{
2897 + return atomic_add_ret_unchecked(i, v);
2898 +}
2899 #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
2900 +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
2901 +{
2902 + return atomic64_add_ret_unchecked(i, v);
2903 +}
2904
2905 /*
2906 * atomic_inc_and_test - increment and test
2907 @@ -50,6 +88,10 @@ extern long atomic64_sub_ret(long, atomi
2908 * other cases.
2909 */
2910 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
2911 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
2912 +{
2913 + return atomic_inc_return_unchecked(v) == 0;
2914 +}
2915 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
2916
2917 #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
2918 @@ -59,30 +101,65 @@ extern long atomic64_sub_ret(long, atomi
2919 #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
2920
2921 #define atomic_inc(v) atomic_add(1, v)
2922 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
2923 +{
2924 + atomic_add_unchecked(1, v);
2925 +}
2926 #define atomic64_inc(v) atomic64_add(1, v)
2927 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
2928 +{
2929 + atomic64_add_unchecked(1, v);
2930 +}
2931
2932 #define atomic_dec(v) atomic_sub(1, v)
2933 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
2934 +{
2935 + atomic_sub_unchecked(1, v);
2936 +}
2937 #define atomic64_dec(v) atomic64_sub(1, v)
2938 +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
2939 +{
2940 + atomic64_sub_unchecked(1, v);
2941 +}
2942
2943 #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
2944 #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
2945
2946 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
2947 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
2948 +{
2949 + return cmpxchg(&v->counter, old, new);
2950 +}
2951 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
2952 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
2953 +{
2954 + return xchg(&v->counter, new);
2955 +}
2956
2957 static inline int atomic_add_unless(atomic_t *v, int a, int u)
2958 {
2959 - int c, old;
2960 + int c, old, new;
2961 c = atomic_read(v);
2962 for (;;) {
2963 - if (unlikely(c == (u)))
2964 + if (unlikely(c == u))
2965 break;
2966 - old = atomic_cmpxchg((v), c, c + (a));
2967 +
2968 + asm volatile("addcc %2, %0, %0\n"
2969 +
2970 +#ifdef CONFIG_PAX_REFCOUNT
2971 + "tvs %%icc, 6\n"
2972 +#endif
2973 +
2974 + : "=r" (new)
2975 + : "0" (c), "ir" (a)
2976 + : "cc");
2977 +
2978 + old = atomic_cmpxchg(v, c, new);
2979 if (likely(old == c))
2980 break;
2981 c = old;
2982 }
2983 - return c != (u);
2984 + return c != u;
2985 }
2986
2987 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
2988 @@ -90,20 +167,35 @@ static inline int atomic_add_unless(atom
2989 #define atomic64_cmpxchg(v, o, n) \
2990 ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
2991 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
2992 +static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
2993 +{
2994 + return xchg(&v->counter, new);
2995 +}
2996
2997 static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
2998 {
2999 - long c, old;
3000 + long c, old, new;
3001 c = atomic64_read(v);
3002 for (;;) {
3003 - if (unlikely(c == (u)))
3004 + if (unlikely(c == u))
3005 break;
3006 - old = atomic64_cmpxchg((v), c, c + (a));
3007 +
3008 + asm volatile("addcc %2, %0, %0\n"
3009 +
3010 +#ifdef CONFIG_PAX_REFCOUNT
3011 + "tvs %%xcc, 6\n"
3012 +#endif
3013 +
3014 + : "=r" (new)
3015 + : "0" (c), "ir" (a)
3016 + : "cc");
3017 +
3018 + old = atomic64_cmpxchg(v, c, new);
3019 if (likely(old == c))
3020 break;
3021 c = old;
3022 }
3023 - return c != (u);
3024 + return c != u;
3025 }
3026
3027 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
3028 diff -urNp linux-3.0.9/arch/sparc/include/asm/cache.h linux-3.0.9/arch/sparc/include/asm/cache.h
3029 --- linux-3.0.9/arch/sparc/include/asm/cache.h 2011-11-11 13:12:24.000000000 -0500
3030 +++ linux-3.0.9/arch/sparc/include/asm/cache.h 2011-11-15 20:02:59.000000000 -0500
3031 @@ -10,7 +10,7 @@
3032 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
3033
3034 #define L1_CACHE_SHIFT 5
3035 -#define L1_CACHE_BYTES 32
3036 +#define L1_CACHE_BYTES 32UL
3037
3038 #ifdef CONFIG_SPARC32
3039 #define SMP_CACHE_BYTES_SHIFT 5
3040 diff -urNp linux-3.0.9/arch/sparc/include/asm/elf_32.h linux-3.0.9/arch/sparc/include/asm/elf_32.h
3041 --- linux-3.0.9/arch/sparc/include/asm/elf_32.h 2011-11-11 13:12:24.000000000 -0500
3042 +++ linux-3.0.9/arch/sparc/include/asm/elf_32.h 2011-11-15 20:02:59.000000000 -0500
3043 @@ -114,6 +114,13 @@ typedef struct {
3044
3045 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
3046
3047 +#ifdef CONFIG_PAX_ASLR
3048 +#define PAX_ELF_ET_DYN_BASE 0x10000UL
3049 +
3050 +#define PAX_DELTA_MMAP_LEN 16
3051 +#define PAX_DELTA_STACK_LEN 16
3052 +#endif
3053 +
3054 /* This yields a mask that user programs can use to figure out what
3055 instruction set this cpu supports. This can NOT be done in userspace
3056 on Sparc. */
3057 diff -urNp linux-3.0.9/arch/sparc/include/asm/elf_64.h linux-3.0.9/arch/sparc/include/asm/elf_64.h
3058 --- linux-3.0.9/arch/sparc/include/asm/elf_64.h 2011-11-11 13:12:24.000000000 -0500
3059 +++ linux-3.0.9/arch/sparc/include/asm/elf_64.h 2011-11-15 20:02:59.000000000 -0500
3060 @@ -180,6 +180,13 @@ typedef struct {
3061 #define ELF_ET_DYN_BASE 0x0000010000000000UL
3062 #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
3063
3064 +#ifdef CONFIG_PAX_ASLR
3065 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
3066 +
3067 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
3068 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
3069 +#endif
3070 +
3071 extern unsigned long sparc64_elf_hwcap;
3072 #define ELF_HWCAP sparc64_elf_hwcap
3073
3074 diff -urNp linux-3.0.9/arch/sparc/include/asm/pgtable_32.h linux-3.0.9/arch/sparc/include/asm/pgtable_32.h
3075 --- linux-3.0.9/arch/sparc/include/asm/pgtable_32.h 2011-11-11 13:12:24.000000000 -0500
3076 +++ linux-3.0.9/arch/sparc/include/asm/pgtable_32.h 2011-11-15 20:02:59.000000000 -0500
3077 @@ -45,6 +45,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
3078 BTFIXUPDEF_INT(page_none)
3079 BTFIXUPDEF_INT(page_copy)
3080 BTFIXUPDEF_INT(page_readonly)
3081 +
3082 +#ifdef CONFIG_PAX_PAGEEXEC
3083 +BTFIXUPDEF_INT(page_shared_noexec)
3084 +BTFIXUPDEF_INT(page_copy_noexec)
3085 +BTFIXUPDEF_INT(page_readonly_noexec)
3086 +#endif
3087 +
3088 BTFIXUPDEF_INT(page_kernel)
3089
3090 #define PMD_SHIFT SUN4C_PMD_SHIFT
3091 @@ -66,6 +73,16 @@ extern pgprot_t PAGE_SHARED;
3092 #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy))
3093 #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly))
3094
3095 +#ifdef CONFIG_PAX_PAGEEXEC
3096 +extern pgprot_t PAGE_SHARED_NOEXEC;
3097 +# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec))
3098 +# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec))
3099 +#else
3100 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
3101 +# define PAGE_COPY_NOEXEC PAGE_COPY
3102 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
3103 +#endif
3104 +
3105 extern unsigned long page_kernel;
3106
3107 #ifdef MODULE
3108 diff -urNp linux-3.0.9/arch/sparc/include/asm/pgtsrmmu.h linux-3.0.9/arch/sparc/include/asm/pgtsrmmu.h
3109 --- linux-3.0.9/arch/sparc/include/asm/pgtsrmmu.h 2011-11-11 13:12:24.000000000 -0500
3110 +++ linux-3.0.9/arch/sparc/include/asm/pgtsrmmu.h 2011-11-15 20:02:59.000000000 -0500
3111 @@ -115,6 +115,13 @@
3112 SRMMU_EXEC | SRMMU_REF)
3113 #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
3114 SRMMU_EXEC | SRMMU_REF)
3115 +
3116 +#ifdef CONFIG_PAX_PAGEEXEC
3117 +#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
3118 +#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
3119 +#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
3120 +#endif
3121 +
3122 #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
3123 SRMMU_DIRTY | SRMMU_REF)
3124
3125 diff -urNp linux-3.0.9/arch/sparc/include/asm/spinlock_64.h linux-3.0.9/arch/sparc/include/asm/spinlock_64.h
3126 --- linux-3.0.9/arch/sparc/include/asm/spinlock_64.h 2011-11-11 13:12:24.000000000 -0500
3127 +++ linux-3.0.9/arch/sparc/include/asm/spinlock_64.h 2011-11-15 20:02:59.000000000 -0500
3128 @@ -92,14 +92,19 @@ static inline void arch_spin_lock_flags(
3129
3130 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
3131
3132 -static void inline arch_read_lock(arch_rwlock_t *lock)
3133 +static inline void arch_read_lock(arch_rwlock_t *lock)
3134 {
3135 unsigned long tmp1, tmp2;
3136
3137 __asm__ __volatile__ (
3138 "1: ldsw [%2], %0\n"
3139 " brlz,pn %0, 2f\n"
3140 -"4: add %0, 1, %1\n"
3141 +"4: addcc %0, 1, %1\n"
3142 +
3143 +#ifdef CONFIG_PAX_REFCOUNT
3144 +" tvs %%icc, 6\n"
3145 +#endif
3146 +
3147 " cas [%2], %0, %1\n"
3148 " cmp %0, %1\n"
3149 " bne,pn %%icc, 1b\n"
3150 @@ -112,10 +117,10 @@ static void inline arch_read_lock(arch_r
3151 " .previous"
3152 : "=&r" (tmp1), "=&r" (tmp2)
3153 : "r" (lock)
3154 - : "memory");
3155 + : "memory", "cc");
3156 }
3157
3158 -static int inline arch_read_trylock(arch_rwlock_t *lock)
3159 +static inline int arch_read_trylock(arch_rwlock_t *lock)
3160 {
3161 int tmp1, tmp2;
3162
3163 @@ -123,7 +128,12 @@ static int inline arch_read_trylock(arch
3164 "1: ldsw [%2], %0\n"
3165 " brlz,a,pn %0, 2f\n"
3166 " mov 0, %0\n"
3167 -" add %0, 1, %1\n"
3168 +" addcc %0, 1, %1\n"
3169 +
3170 +#ifdef CONFIG_PAX_REFCOUNT
3171 +" tvs %%icc, 6\n"
3172 +#endif
3173 +
3174 " cas [%2], %0, %1\n"
3175 " cmp %0, %1\n"
3176 " bne,pn %%icc, 1b\n"
3177 @@ -136,13 +146,18 @@ static int inline arch_read_trylock(arch
3178 return tmp1;
3179 }
3180
3181 -static void inline arch_read_unlock(arch_rwlock_t *lock)
3182 +static inline void arch_read_unlock(arch_rwlock_t *lock)
3183 {
3184 unsigned long tmp1, tmp2;
3185
3186 __asm__ __volatile__(
3187 "1: lduw [%2], %0\n"
3188 -" sub %0, 1, %1\n"
3189 +" subcc %0, 1, %1\n"
3190 +
3191 +#ifdef CONFIG_PAX_REFCOUNT
3192 +" tvs %%icc, 6\n"
3193 +#endif
3194 +
3195 " cas [%2], %0, %1\n"
3196 " cmp %0, %1\n"
3197 " bne,pn %%xcc, 1b\n"
3198 @@ -152,7 +167,7 @@ static void inline arch_read_unlock(arch
3199 : "memory");
3200 }
3201
3202 -static void inline arch_write_lock(arch_rwlock_t *lock)
3203 +static inline void arch_write_lock(arch_rwlock_t *lock)
3204 {
3205 unsigned long mask, tmp1, tmp2;
3206
3207 @@ -177,7 +192,7 @@ static void inline arch_write_lock(arch_
3208 : "memory");
3209 }
3210
3211 -static void inline arch_write_unlock(arch_rwlock_t *lock)
3212 +static inline void arch_write_unlock(arch_rwlock_t *lock)
3213 {
3214 __asm__ __volatile__(
3215 " stw %%g0, [%0]"
3216 @@ -186,7 +201,7 @@ static void inline arch_write_unlock(arc
3217 : "memory");
3218 }
3219
3220 -static int inline arch_write_trylock(arch_rwlock_t *lock)
3221 +static inline int arch_write_trylock(arch_rwlock_t *lock)
3222 {
3223 unsigned long mask, tmp1, tmp2, result;
3224
3225 diff -urNp linux-3.0.9/arch/sparc/include/asm/thread_info_32.h linux-3.0.9/arch/sparc/include/asm/thread_info_32.h
3226 --- linux-3.0.9/arch/sparc/include/asm/thread_info_32.h 2011-11-11 13:12:24.000000000 -0500
3227 +++ linux-3.0.9/arch/sparc/include/asm/thread_info_32.h 2011-11-15 20:02:59.000000000 -0500
3228 @@ -50,6 +50,8 @@ struct thread_info {
3229 unsigned long w_saved;
3230
3231 struct restart_block restart_block;
3232 +
3233 + unsigned long lowest_stack;
3234 };
3235
3236 /*
3237 diff -urNp linux-3.0.9/arch/sparc/include/asm/thread_info_64.h linux-3.0.9/arch/sparc/include/asm/thread_info_64.h
3238 --- linux-3.0.9/arch/sparc/include/asm/thread_info_64.h 2011-11-11 13:12:24.000000000 -0500
3239 +++ linux-3.0.9/arch/sparc/include/asm/thread_info_64.h 2011-11-15 20:02:59.000000000 -0500
3240 @@ -63,6 +63,8 @@ struct thread_info {
3241 struct pt_regs *kern_una_regs;
3242 unsigned int kern_una_insn;
3243
3244 + unsigned long lowest_stack;
3245 +
3246 unsigned long fpregs[0] __attribute__ ((aligned(64)));
3247 };
3248
3249 diff -urNp linux-3.0.9/arch/sparc/include/asm/uaccess_32.h linux-3.0.9/arch/sparc/include/asm/uaccess_32.h
3250 --- linux-3.0.9/arch/sparc/include/asm/uaccess_32.h 2011-11-11 13:12:24.000000000 -0500
3251 +++ linux-3.0.9/arch/sparc/include/asm/uaccess_32.h 2011-11-15 20:02:59.000000000 -0500
3252 @@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
3253
3254 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
3255 {
3256 - if (n && __access_ok((unsigned long) to, n))
3257 + if ((long)n < 0)
3258 + return n;
3259 +
3260 + if (n && __access_ok((unsigned long) to, n)) {
3261 + if (!__builtin_constant_p(n))
3262 + check_object_size(from, n, true);
3263 return __copy_user(to, (__force void __user *) from, n);
3264 - else
3265 + } else
3266 return n;
3267 }
3268
3269 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
3270 {
3271 + if ((long)n < 0)
3272 + return n;
3273 +
3274 + if (!__builtin_constant_p(n))
3275 + check_object_size(from, n, true);
3276 +
3277 return __copy_user(to, (__force void __user *) from, n);
3278 }
3279
3280 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
3281 {
3282 - if (n && __access_ok((unsigned long) from, n))
3283 + if ((long)n < 0)
3284 + return n;
3285 +
3286 + if (n && __access_ok((unsigned long) from, n)) {
3287 + if (!__builtin_constant_p(n))
3288 + check_object_size(to, n, false);
3289 return __copy_user((__force void __user *) to, from, n);
3290 - else
3291 + } else
3292 return n;
3293 }
3294
3295 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
3296 {
3297 + if ((long)n < 0)
3298 + return n;
3299 +
3300 return __copy_user((__force void __user *) to, from, n);
3301 }
3302
3303 diff -urNp linux-3.0.9/arch/sparc/include/asm/uaccess_64.h linux-3.0.9/arch/sparc/include/asm/uaccess_64.h
3304 --- linux-3.0.9/arch/sparc/include/asm/uaccess_64.h 2011-11-11 13:12:24.000000000 -0500
3305 +++ linux-3.0.9/arch/sparc/include/asm/uaccess_64.h 2011-11-15 20:02:59.000000000 -0500
3306 @@ -10,6 +10,7 @@
3307 #include <linux/compiler.h>
3308 #include <linux/string.h>
3309 #include <linux/thread_info.h>
3310 +#include <linux/kernel.h>
3311 #include <asm/asi.h>
3312 #include <asm/system.h>
3313 #include <asm/spitfire.h>
3314 @@ -213,8 +214,15 @@ extern unsigned long copy_from_user_fixu
3315 static inline unsigned long __must_check
3316 copy_from_user(void *to, const void __user *from, unsigned long size)
3317 {
3318 - unsigned long ret = ___copy_from_user(to, from, size);
3319 + unsigned long ret;
3320
3321 + if ((long)size < 0 || size > INT_MAX)
3322 + return size;
3323 +
3324 + if (!__builtin_constant_p(size))
3325 + check_object_size(to, size, false);
3326 +
3327 + ret = ___copy_from_user(to, from, size);
3328 if (unlikely(ret))
3329 ret = copy_from_user_fixup(to, from, size);
3330
3331 @@ -230,8 +238,15 @@ extern unsigned long copy_to_user_fixup(
3332 static inline unsigned long __must_check
3333 copy_to_user(void __user *to, const void *from, unsigned long size)
3334 {
3335 - unsigned long ret = ___copy_to_user(to, from, size);
3336 + unsigned long ret;
3337 +
3338 + if ((long)size < 0 || size > INT_MAX)
3339 + return size;
3340 +
3341 + if (!__builtin_constant_p(size))
3342 + check_object_size(from, size, true);
3343
3344 + ret = ___copy_to_user(to, from, size);
3345 if (unlikely(ret))
3346 ret = copy_to_user_fixup(to, from, size);
3347 return ret;
3348 diff -urNp linux-3.0.9/arch/sparc/include/asm/uaccess.h linux-3.0.9/arch/sparc/include/asm/uaccess.h
3349 --- linux-3.0.9/arch/sparc/include/asm/uaccess.h 2011-11-11 13:12:24.000000000 -0500
3350 +++ linux-3.0.9/arch/sparc/include/asm/uaccess.h 2011-11-15 20:02:59.000000000 -0500
3351 @@ -1,5 +1,13 @@
3352 #ifndef ___ASM_SPARC_UACCESS_H
3353 #define ___ASM_SPARC_UACCESS_H
3354 +
3355 +#ifdef __KERNEL__
3356 +#ifndef __ASSEMBLY__
3357 +#include <linux/types.h>
3358 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
3359 +#endif
3360 +#endif
3361 +
3362 #if defined(__sparc__) && defined(__arch64__)
3363 #include <asm/uaccess_64.h>
3364 #else
3365 diff -urNp linux-3.0.9/arch/sparc/kernel/Makefile linux-3.0.9/arch/sparc/kernel/Makefile
3366 --- linux-3.0.9/arch/sparc/kernel/Makefile 2011-11-11 13:12:24.000000000 -0500
3367 +++ linux-3.0.9/arch/sparc/kernel/Makefile 2011-11-15 20:02:59.000000000 -0500
3368 @@ -3,7 +3,7 @@
3369 #
3370
3371 asflags-y := -ansi
3372 -ccflags-y := -Werror
3373 +#ccflags-y := -Werror
3374
3375 extra-y := head_$(BITS).o
3376 extra-y += init_task.o
3377 diff -urNp linux-3.0.9/arch/sparc/kernel/process_32.c linux-3.0.9/arch/sparc/kernel/process_32.c
3378 --- linux-3.0.9/arch/sparc/kernel/process_32.c 2011-11-11 13:12:24.000000000 -0500
3379 +++ linux-3.0.9/arch/sparc/kernel/process_32.c 2011-11-15 20:02:59.000000000 -0500
3380 @@ -204,7 +204,7 @@ void __show_backtrace(unsigned long fp)
3381 rw->ins[4], rw->ins[5],
3382 rw->ins[6],
3383 rw->ins[7]);
3384 - printk("%pS\n", (void *) rw->ins[7]);
3385 + printk("%pA\n", (void *) rw->ins[7]);
3386 rw = (struct reg_window32 *) rw->ins[6];
3387 }
3388 spin_unlock_irqrestore(&sparc_backtrace_lock, flags);
3389 @@ -271,14 +271,14 @@ void show_regs(struct pt_regs *r)
3390
3391 printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
3392 r->psr, r->pc, r->npc, r->y, print_tainted());
3393 - printk("PC: <%pS>\n", (void *) r->pc);
3394 + printk("PC: <%pA>\n", (void *) r->pc);
3395 printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
3396 r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
3397 r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
3398 printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
3399 r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
3400 r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
3401 - printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
3402 + printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
3403
3404 printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
3405 rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
3406 @@ -313,7 +313,7 @@ void show_stack(struct task_struct *tsk,
3407 rw = (struct reg_window32 *) fp;
3408 pc = rw->ins[7];
3409 printk("[%08lx : ", pc);
3410 - printk("%pS ] ", (void *) pc);
3411 + printk("%pA ] ", (void *) pc);
3412 fp = rw->ins[6];
3413 } while (++count < 16);
3414 printk("\n");
3415 diff -urNp linux-3.0.9/arch/sparc/kernel/process_64.c linux-3.0.9/arch/sparc/kernel/process_64.c
3416 --- linux-3.0.9/arch/sparc/kernel/process_64.c 2011-11-11 13:12:24.000000000 -0500
3417 +++ linux-3.0.9/arch/sparc/kernel/process_64.c 2011-11-15 20:02:59.000000000 -0500
3418 @@ -180,14 +180,14 @@ static void show_regwindow(struct pt_reg
3419 printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
3420 rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
3421 if (regs->tstate & TSTATE_PRIV)
3422 - printk("I7: <%pS>\n", (void *) rwk->ins[7]);
3423 + printk("I7: <%pA>\n", (void *) rwk->ins[7]);
3424 }
3425
3426 void show_regs(struct pt_regs *regs)
3427 {
3428 printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
3429 regs->tpc, regs->tnpc, regs->y, print_tainted());
3430 - printk("TPC: <%pS>\n", (void *) regs->tpc);
3431 + printk("TPC: <%pA>\n", (void *) regs->tpc);
3432 printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
3433 regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
3434 regs->u_regs[3]);
3435 @@ -200,7 +200,7 @@ void show_regs(struct pt_regs *regs)
3436 printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
3437 regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
3438 regs->u_regs[15]);
3439 - printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
3440 + printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
3441 show_regwindow(regs);
3442 show_stack(current, (unsigned long *) regs->u_regs[UREG_FP]);
3443 }
3444 @@ -285,7 +285,7 @@ void arch_trigger_all_cpu_backtrace(void
3445 ((tp && tp->task) ? tp->task->pid : -1));
3446
3447 if (gp->tstate & TSTATE_PRIV) {
3448 - printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
3449 + printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
3450 (void *) gp->tpc,
3451 (void *) gp->o7,
3452 (void *) gp->i7,
3453 diff -urNp linux-3.0.9/arch/sparc/kernel/sys_sparc_32.c linux-3.0.9/arch/sparc/kernel/sys_sparc_32.c
3454 --- linux-3.0.9/arch/sparc/kernel/sys_sparc_32.c 2011-11-11 13:12:24.000000000 -0500
3455 +++ linux-3.0.9/arch/sparc/kernel/sys_sparc_32.c 2011-11-15 20:02:59.000000000 -0500
3456 @@ -56,7 +56,7 @@ unsigned long arch_get_unmapped_area(str
3457 if (ARCH_SUN4C && len > 0x20000000)
3458 return -ENOMEM;
3459 if (!addr)
3460 - addr = TASK_UNMAPPED_BASE;
3461 + addr = current->mm->mmap_base;
3462
3463 if (flags & MAP_SHARED)
3464 addr = COLOUR_ALIGN(addr);
3465 @@ -71,7 +71,7 @@ unsigned long arch_get_unmapped_area(str
3466 }
3467 if (TASK_SIZE - PAGE_SIZE - len < addr)
3468 return -ENOMEM;
3469 - if (!vmm || addr + len <= vmm->vm_start)
3470 + if (check_heap_stack_gap(vmm, addr, len))
3471 return addr;
3472 addr = vmm->vm_end;
3473 if (flags & MAP_SHARED)
3474 diff -urNp linux-3.0.9/arch/sparc/kernel/sys_sparc_64.c linux-3.0.9/arch/sparc/kernel/sys_sparc_64.c
3475 --- linux-3.0.9/arch/sparc/kernel/sys_sparc_64.c 2011-11-11 13:12:24.000000000 -0500
3476 +++ linux-3.0.9/arch/sparc/kernel/sys_sparc_64.c 2011-11-15 20:02:59.000000000 -0500
3477 @@ -124,7 +124,7 @@ unsigned long arch_get_unmapped_area(str
3478 /* We do not accept a shared mapping if it would violate
3479 * cache aliasing constraints.
3480 */
3481 - if ((flags & MAP_SHARED) &&
3482 + if ((filp || (flags & MAP_SHARED)) &&
3483 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
3484 return -EINVAL;
3485 return addr;
3486 @@ -139,6 +139,10 @@ unsigned long arch_get_unmapped_area(str
3487 if (filp || (flags & MAP_SHARED))
3488 do_color_align = 1;
3489
3490 +#ifdef CONFIG_PAX_RANDMMAP
3491 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
3492 +#endif
3493 +
3494 if (addr) {
3495 if (do_color_align)
3496 addr = COLOUR_ALIGN(addr, pgoff);
3497 @@ -146,15 +150,14 @@ unsigned long arch_get_unmapped_area(str
3498 addr = PAGE_ALIGN(addr);
3499
3500 vma = find_vma(mm, addr);
3501 - if (task_size - len >= addr &&
3502 - (!vma || addr + len <= vma->vm_start))
3503 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
3504 return addr;
3505 }
3506
3507 if (len > mm->cached_hole_size) {
3508 - start_addr = addr = mm->free_area_cache;
3509 + start_addr = addr = mm->free_area_cache;
3510 } else {
3511 - start_addr = addr = TASK_UNMAPPED_BASE;
3512 + start_addr = addr = mm->mmap_base;
3513 mm->cached_hole_size = 0;
3514 }
3515
3516 @@ -174,14 +177,14 @@ full_search:
3517 vma = find_vma(mm, VA_EXCLUDE_END);
3518 }
3519 if (unlikely(task_size < addr)) {
3520 - if (start_addr != TASK_UNMAPPED_BASE) {
3521 - start_addr = addr = TASK_UNMAPPED_BASE;
3522 + if (start_addr != mm->mmap_base) {
3523 + start_addr = addr = mm->mmap_base;
3524 mm->cached_hole_size = 0;
3525 goto full_search;
3526 }
3527 return -ENOMEM;
3528 }
3529 - if (likely(!vma || addr + len <= vma->vm_start)) {
3530 + if (likely(check_heap_stack_gap(vma, addr, len))) {
3531 /*
3532 * Remember the place where we stopped the search:
3533 */
3534 @@ -215,7 +218,7 @@ arch_get_unmapped_area_topdown(struct fi
3535 /* We do not accept a shared mapping if it would violate
3536 * cache aliasing constraints.
3537 */
3538 - if ((flags & MAP_SHARED) &&
3539 + if ((filp || (flags & MAP_SHARED)) &&
3540 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
3541 return -EINVAL;
3542 return addr;
3543 @@ -236,8 +239,7 @@ arch_get_unmapped_area_topdown(struct fi
3544 addr = PAGE_ALIGN(addr);
3545
3546 vma = find_vma(mm, addr);
3547 - if (task_size - len >= addr &&
3548 - (!vma || addr + len <= vma->vm_start))
3549 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
3550 return addr;
3551 }
3552
3553 @@ -258,7 +260,7 @@ arch_get_unmapped_area_topdown(struct fi
3554 /* make sure it can fit in the remaining address space */
3555 if (likely(addr > len)) {
3556 vma = find_vma(mm, addr-len);
3557 - if (!vma || addr <= vma->vm_start) {
3558 + if (check_heap_stack_gap(vma, addr - len, len)) {
3559 /* remember the address as a hint for next time */
3560 return (mm->free_area_cache = addr-len);
3561 }
3562 @@ -267,18 +269,18 @@ arch_get_unmapped_area_topdown(struct fi
3563 if (unlikely(mm->mmap_base < len))
3564 goto bottomup;
3565
3566 - addr = mm->mmap_base-len;
3567 - if (do_color_align)
3568 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3569 + addr = mm->mmap_base - len;
3570
3571 do {
3572 + if (do_color_align)
3573 + addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3574 /*
3575 * Lookup failure means no vma is above this address,
3576 * else if new region fits below vma->vm_start,
3577 * return with success:
3578 */
3579 vma = find_vma(mm, addr);
3580 - if (likely(!vma || addr+len <= vma->vm_start)) {
3581 + if (likely(check_heap_stack_gap(vma, addr, len))) {
3582 /* remember the address as a hint for next time */
3583 return (mm->free_area_cache = addr);
3584 }
3585 @@ -288,10 +290,8 @@ arch_get_unmapped_area_topdown(struct fi
3586 mm->cached_hole_size = vma->vm_start - addr;
3587
3588 /* try just below the current vma->vm_start */
3589 - addr = vma->vm_start-len;
3590 - if (do_color_align)
3591 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
3592 - } while (likely(len < vma->vm_start));
3593 + addr = skip_heap_stack_gap(vma, len);
3594 + } while (!IS_ERR_VALUE(addr));
3595
3596 bottomup:
3597 /*
3598 @@ -390,6 +390,12 @@ void arch_pick_mmap_layout(struct mm_str
3599 gap == RLIM_INFINITY ||
3600 sysctl_legacy_va_layout) {
3601 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
3602 +
3603 +#ifdef CONFIG_PAX_RANDMMAP
3604 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3605 + mm->mmap_base += mm->delta_mmap;
3606 +#endif
3607 +
3608 mm->get_unmapped_area = arch_get_unmapped_area;
3609 mm->unmap_area = arch_unmap_area;
3610 } else {
3611 @@ -402,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_str
3612 gap = (task_size / 6 * 5);
3613
3614 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
3615 +
3616 +#ifdef CONFIG_PAX_RANDMMAP
3617 + if (mm->pax_flags & MF_PAX_RANDMMAP)
3618 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3619 +#endif
3620 +
3621 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
3622 mm->unmap_area = arch_unmap_area_topdown;
3623 }
3624 diff -urNp linux-3.0.9/arch/sparc/kernel/traps_32.c linux-3.0.9/arch/sparc/kernel/traps_32.c
3625 --- linux-3.0.9/arch/sparc/kernel/traps_32.c 2011-11-11 13:12:24.000000000 -0500
3626 +++ linux-3.0.9/arch/sparc/kernel/traps_32.c 2011-11-15 20:02:59.000000000 -0500
3627 @@ -44,6 +44,8 @@ static void instruction_dump(unsigned lo
3628 #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
3629 #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
3630
3631 +extern void gr_handle_kernel_exploit(void);
3632 +
3633 void die_if_kernel(char *str, struct pt_regs *regs)
3634 {
3635 static int die_counter;
3636 @@ -76,15 +78,17 @@ void die_if_kernel(char *str, struct pt_
3637 count++ < 30 &&
3638 (((unsigned long) rw) >= PAGE_OFFSET) &&
3639 !(((unsigned long) rw) & 0x7)) {
3640 - printk("Caller[%08lx]: %pS\n", rw->ins[7],
3641 + printk("Caller[%08lx]: %pA\n", rw->ins[7],
3642 (void *) rw->ins[7]);
3643 rw = (struct reg_window32 *)rw->ins[6];
3644 }
3645 }
3646 printk("Instruction DUMP:");
3647 instruction_dump ((unsigned long *) regs->pc);
3648 - if(regs->psr & PSR_PS)
3649 + if(regs->psr & PSR_PS) {
3650 + gr_handle_kernel_exploit();
3651 do_exit(SIGKILL);
3652 + }
3653 do_exit(SIGSEGV);
3654 }
3655
3656 diff -urNp linux-3.0.9/arch/sparc/kernel/traps_64.c linux-3.0.9/arch/sparc/kernel/traps_64.c
3657 --- linux-3.0.9/arch/sparc/kernel/traps_64.c 2011-11-11 13:12:24.000000000 -0500
3658 +++ linux-3.0.9/arch/sparc/kernel/traps_64.c 2011-11-15 20:02:59.000000000 -0500
3659 @@ -75,7 +75,7 @@ static void dump_tl1_traplog(struct tl1_
3660 i + 1,
3661 p->trapstack[i].tstate, p->trapstack[i].tpc,
3662 p->trapstack[i].tnpc, p->trapstack[i].tt);
3663 - printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
3664 + printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
3665 }
3666 }
3667
3668 @@ -95,6 +95,12 @@ void bad_trap(struct pt_regs *regs, long
3669
3670 lvl -= 0x100;
3671 if (regs->tstate & TSTATE_PRIV) {
3672 +
3673 +#ifdef CONFIG_PAX_REFCOUNT
3674 + if (lvl == 6)
3675 + pax_report_refcount_overflow(regs);
3676 +#endif
3677 +
3678 sprintf(buffer, "Kernel bad sw trap %lx", lvl);
3679 die_if_kernel(buffer, regs);
3680 }
3681 @@ -113,11 +119,16 @@ void bad_trap(struct pt_regs *regs, long
3682 void bad_trap_tl1(struct pt_regs *regs, long lvl)
3683 {
3684 char buffer[32];
3685 -
3686 +
3687 if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
3688 0, lvl, SIGTRAP) == NOTIFY_STOP)
3689 return;
3690
3691 +#ifdef CONFIG_PAX_REFCOUNT
3692 + if (lvl == 6)
3693 + pax_report_refcount_overflow(regs);
3694 +#endif
3695 +
3696 dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
3697
3698 sprintf (buffer, "Bad trap %lx at tl>0", lvl);
3699 @@ -1141,7 +1152,7 @@ static void cheetah_log_errors(struct pt
3700 regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
3701 printk("%s" "ERROR(%d): ",
3702 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
3703 - printk("TPC<%pS>\n", (void *) regs->tpc);
3704 + printk("TPC<%pA>\n", (void *) regs->tpc);
3705 printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
3706 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
3707 (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
3708 @@ -1748,7 +1759,7 @@ void cheetah_plus_parity_error(int type,
3709 smp_processor_id(),
3710 (type & 0x1) ? 'I' : 'D',
3711 regs->tpc);
3712 - printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
3713 + printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
3714 panic("Irrecoverable Cheetah+ parity error.");
3715 }
3716
3717 @@ -1756,7 +1767,7 @@ void cheetah_plus_parity_error(int type,
3718 smp_processor_id(),
3719 (type & 0x1) ? 'I' : 'D',
3720 regs->tpc);
3721 - printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
3722 + printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
3723 }
3724
3725 struct sun4v_error_entry {
3726 @@ -1963,9 +1974,9 @@ void sun4v_itlb_error_report(struct pt_r
3727
3728 printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
3729 regs->tpc, tl);
3730 - printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
3731 + printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
3732 printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
3733 - printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
3734 + printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
3735 (void *) regs->u_regs[UREG_I7]);
3736 printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
3737 "pte[%lx] error[%lx]\n",
3738 @@ -1987,9 +1998,9 @@ void sun4v_dtlb_error_report(struct pt_r
3739
3740 printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
3741 regs->tpc, tl);
3742 - printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
3743 + printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
3744 printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
3745 - printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
3746 + printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
3747 (void *) regs->u_regs[UREG_I7]);
3748 printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
3749 "pte[%lx] error[%lx]\n",
3750 @@ -2195,13 +2206,13 @@ void show_stack(struct task_struct *tsk,
3751 fp = (unsigned long)sf->fp + STACK_BIAS;
3752 }
3753
3754 - printk(" [%016lx] %pS\n", pc, (void *) pc);
3755 + printk(" [%016lx] %pA\n", pc, (void *) pc);
3756 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
3757 if ((pc + 8UL) == (unsigned long) &return_to_handler) {
3758 int index = tsk->curr_ret_stack;
3759 if (tsk->ret_stack && index >= graph) {
3760 pc = tsk->ret_stack[index - graph].ret;
3761 - printk(" [%016lx] %pS\n", pc, (void *) pc);
3762 + printk(" [%016lx] %pA\n", pc, (void *) pc);
3763 graph++;
3764 }
3765 }
3766 @@ -2226,6 +2237,8 @@ static inline struct reg_window *kernel_
3767 return (struct reg_window *) (fp + STACK_BIAS);
3768 }
3769
3770 +extern void gr_handle_kernel_exploit(void);
3771 +
3772 void die_if_kernel(char *str, struct pt_regs *regs)
3773 {
3774 static int die_counter;
3775 @@ -2254,7 +2267,7 @@ void die_if_kernel(char *str, struct pt_
3776 while (rw &&
3777 count++ < 30 &&
3778 kstack_valid(tp, (unsigned long) rw)) {
3779 - printk("Caller[%016lx]: %pS\n", rw->ins[7],
3780 + printk("Caller[%016lx]: %pA\n", rw->ins[7],
3781 (void *) rw->ins[7]);
3782
3783 rw = kernel_stack_up(rw);
3784 @@ -2267,8 +2280,10 @@ void die_if_kernel(char *str, struct pt_
3785 }
3786 user_instruction_dump ((unsigned int __user *) regs->tpc);
3787 }
3788 - if (regs->tstate & TSTATE_PRIV)
3789 + if (regs->tstate & TSTATE_PRIV) {
3790 + gr_handle_kernel_exploit();
3791 do_exit(SIGKILL);
3792 + }
3793 do_exit(SIGSEGV);
3794 }
3795 EXPORT_SYMBOL(die_if_kernel);
3796 diff -urNp linux-3.0.9/arch/sparc/kernel/unaligned_64.c linux-3.0.9/arch/sparc/kernel/unaligned_64.c
3797 --- linux-3.0.9/arch/sparc/kernel/unaligned_64.c 2011-11-11 13:12:24.000000000 -0500
3798 +++ linux-3.0.9/arch/sparc/kernel/unaligned_64.c 2011-11-15 20:02:59.000000000 -0500
3799 @@ -279,7 +279,7 @@ static void log_unaligned(struct pt_regs
3800 static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
3801
3802 if (__ratelimit(&ratelimit)) {
3803 - printk("Kernel unaligned access at TPC[%lx] %pS\n",
3804 + printk("Kernel unaligned access at TPC[%lx] %pA\n",
3805 regs->tpc, (void *) regs->tpc);
3806 }
3807 }
3808 diff -urNp linux-3.0.9/arch/sparc/lib/atomic_64.S linux-3.0.9/arch/sparc/lib/atomic_64.S
3809 --- linux-3.0.9/arch/sparc/lib/atomic_64.S 2011-11-11 13:12:24.000000000 -0500
3810 +++ linux-3.0.9/arch/sparc/lib/atomic_64.S 2011-11-15 20:02:59.000000000 -0500
3811 @@ -18,7 +18,12 @@
3812 atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
3813 BACKOFF_SETUP(%o2)
3814 1: lduw [%o1], %g1
3815 - add %g1, %o0, %g7
3816 + addcc %g1, %o0, %g7
3817 +
3818 +#ifdef CONFIG_PAX_REFCOUNT
3819 + tvs %icc, 6
3820 +#endif
3821 +
3822 cas [%o1], %g1, %g7
3823 cmp %g1, %g7
3824 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
3825 @@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at
3826 2: BACKOFF_SPIN(%o2, %o3, 1b)
3827 .size atomic_add, .-atomic_add
3828
3829 + .globl atomic_add_unchecked
3830 + .type atomic_add_unchecked,#function
3831 +atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
3832 + BACKOFF_SETUP(%o2)
3833 +1: lduw [%o1], %g1
3834 + add %g1, %o0, %g7
3835 + cas [%o1], %g1, %g7
3836 + cmp %g1, %g7
3837 + bne,pn %icc, 2f
3838 + nop
3839 + retl
3840 + nop
3841 +2: BACKOFF_SPIN(%o2, %o3, 1b)
3842 + .size atomic_add_unchecked, .-atomic_add_unchecked
3843 +
3844 .globl atomic_sub
3845 .type atomic_sub,#function
3846 atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
3847 BACKOFF_SETUP(%o2)
3848 1: lduw [%o1], %g1
3849 - sub %g1, %o0, %g7
3850 + subcc %g1, %o0, %g7
3851 +
3852 +#ifdef CONFIG_PAX_REFCOUNT
3853 + tvs %icc, 6
3854 +#endif
3855 +
3856 cas [%o1], %g1, %g7
3857 cmp %g1, %g7
3858 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
3859 @@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at
3860 2: BACKOFF_SPIN(%o2, %o3, 1b)
3861 .size atomic_sub, .-atomic_sub
3862
3863 + .globl atomic_sub_unchecked
3864 + .type atomic_sub_unchecked,#function
3865 +atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
3866 + BACKOFF_SETUP(%o2)
3867 +1: lduw [%o1], %g1
3868 + sub %g1, %o0, %g7
3869 + cas [%o1], %g1, %g7
3870 + cmp %g1, %g7
3871 + bne,pn %icc, 2f
3872 + nop
3873 + retl
3874 + nop
3875 +2: BACKOFF_SPIN(%o2, %o3, 1b)
3876 + .size atomic_sub_unchecked, .-atomic_sub_unchecked
3877 +
3878 .globl atomic_add_ret
3879 .type atomic_add_ret,#function
3880 atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
3881 BACKOFF_SETUP(%o2)
3882 1: lduw [%o1], %g1
3883 - add %g1, %o0, %g7
3884 + addcc %g1, %o0, %g7
3885 +
3886 +#ifdef CONFIG_PAX_REFCOUNT
3887 + tvs %icc, 6
3888 +#endif
3889 +
3890 cas [%o1], %g1, %g7
3891 cmp %g1, %g7
3892 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
3893 @@ -58,12 +103,33 @@ atomic_add_ret: /* %o0 = increment, %o1
3894 2: BACKOFF_SPIN(%o2, %o3, 1b)
3895 .size atomic_add_ret, .-atomic_add_ret
3896
3897 + .globl atomic_add_ret_unchecked
3898 + .type atomic_add_ret_unchecked,#function
3899 +atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
3900 + BACKOFF_SETUP(%o2)
3901 +1: lduw [%o1], %g1
3902 + addcc %g1, %o0, %g7
3903 + cas [%o1], %g1, %g7
3904 + cmp %g1, %g7
3905 + bne,pn %icc, 2f
3906 + add %g7, %o0, %g7
3907 + sra %g7, 0, %o0
3908 + retl
3909 + nop
3910 +2: BACKOFF_SPIN(%o2, %o3, 1b)
3911 + .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked
3912 +
3913 .globl atomic_sub_ret
3914 .type atomic_sub_ret,#function
3915 atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
3916 BACKOFF_SETUP(%o2)
3917 1: lduw [%o1], %g1
3918 - sub %g1, %o0, %g7
3919 + subcc %g1, %o0, %g7
3920 +
3921 +#ifdef CONFIG_PAX_REFCOUNT
3922 + tvs %icc, 6
3923 +#endif
3924 +
3925 cas [%o1], %g1, %g7
3926 cmp %g1, %g7
3927 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
3928 @@ -78,7 +144,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1
3929 atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
3930 BACKOFF_SETUP(%o2)
3931 1: ldx [%o1], %g1
3932 - add %g1, %o0, %g7
3933 + addcc %g1, %o0, %g7
3934 +
3935 +#ifdef CONFIG_PAX_REFCOUNT
3936 + tvs %xcc, 6
3937 +#endif
3938 +
3939 casx [%o1], %g1, %g7
3940 cmp %g1, %g7
3941 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
3942 @@ -88,12 +159,32 @@ atomic64_add: /* %o0 = increment, %o1 =
3943 2: BACKOFF_SPIN(%o2, %o3, 1b)
3944 .size atomic64_add, .-atomic64_add
3945
3946 + .globl atomic64_add_unchecked
3947 + .type atomic64_add_unchecked,#function
3948 +atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
3949 + BACKOFF_SETUP(%o2)
3950 +1: ldx [%o1], %g1
3951 + addcc %g1, %o0, %g7
3952 + casx [%o1], %g1, %g7
3953 + cmp %g1, %g7
3954 + bne,pn %xcc, 2f
3955 + nop
3956 + retl
3957 + nop
3958 +2: BACKOFF_SPIN(%o2, %o3, 1b)
3959 + .size atomic64_add_unchecked, .-atomic64_add_unchecked
3960 +
3961 .globl atomic64_sub
3962 .type atomic64_sub,#function
3963 atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
3964 BACKOFF_SETUP(%o2)
3965 1: ldx [%o1], %g1
3966 - sub %g1, %o0, %g7
3967 + subcc %g1, %o0, %g7
3968 +
3969 +#ifdef CONFIG_PAX_REFCOUNT
3970 + tvs %xcc, 6
3971 +#endif
3972 +
3973 casx [%o1], %g1, %g7
3974 cmp %g1, %g7
3975 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
3976 @@ -103,12 +194,32 @@ atomic64_sub: /* %o0 = decrement, %o1 =
3977 2: BACKOFF_SPIN(%o2, %o3, 1b)
3978 .size atomic64_sub, .-atomic64_sub
3979
3980 + .globl atomic64_sub_unchecked
3981 + .type atomic64_sub_unchecked,#function
3982 +atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
3983 + BACKOFF_SETUP(%o2)
3984 +1: ldx [%o1], %g1
3985 + subcc %g1, %o0, %g7
3986 + casx [%o1], %g1, %g7
3987 + cmp %g1, %g7
3988 + bne,pn %xcc, 2f
3989 + nop
3990 + retl
3991 + nop
3992 +2: BACKOFF_SPIN(%o2, %o3, 1b)
3993 + .size atomic64_sub_unchecked, .-atomic64_sub_unchecked
3994 +
3995 .globl atomic64_add_ret
3996 .type atomic64_add_ret,#function
3997 atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
3998 BACKOFF_SETUP(%o2)
3999 1: ldx [%o1], %g1
4000 - add %g1, %o0, %g7
4001 + addcc %g1, %o0, %g7
4002 +
4003 +#ifdef CONFIG_PAX_REFCOUNT
4004 + tvs %xcc, 6
4005 +#endif
4006 +
4007 casx [%o1], %g1, %g7
4008 cmp %g1, %g7
4009 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4010 @@ -118,12 +229,33 @@ atomic64_add_ret: /* %o0 = increment, %o
4011 2: BACKOFF_SPIN(%o2, %o3, 1b)
4012 .size atomic64_add_ret, .-atomic64_add_ret
4013
4014 + .globl atomic64_add_ret_unchecked
4015 + .type atomic64_add_ret_unchecked,#function
4016 +atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
4017 + BACKOFF_SETUP(%o2)
4018 +1: ldx [%o1], %g1
4019 + addcc %g1, %o0, %g7
4020 + casx [%o1], %g1, %g7
4021 + cmp %g1, %g7
4022 + bne,pn %xcc, 2f
4023 + add %g7, %o0, %g7
4024 + mov %g7, %o0
4025 + retl
4026 + nop
4027 +2: BACKOFF_SPIN(%o2, %o3, 1b)
4028 + .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
4029 +
4030 .globl atomic64_sub_ret
4031 .type atomic64_sub_ret,#function
4032 atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
4033 BACKOFF_SETUP(%o2)
4034 1: ldx [%o1], %g1
4035 - sub %g1, %o0, %g7
4036 + subcc %g1, %o0, %g7
4037 +
4038 +#ifdef CONFIG_PAX_REFCOUNT
4039 + tvs %xcc, 6
4040 +#endif
4041 +
4042 casx [%o1], %g1, %g7
4043 cmp %g1, %g7
4044 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
4045 diff -urNp linux-3.0.9/arch/sparc/lib/ksyms.c linux-3.0.9/arch/sparc/lib/ksyms.c
4046 --- linux-3.0.9/arch/sparc/lib/ksyms.c 2011-11-11 13:12:24.000000000 -0500
4047 +++ linux-3.0.9/arch/sparc/lib/ksyms.c 2011-11-15 20:02:59.000000000 -0500
4048 @@ -142,12 +142,18 @@ EXPORT_SYMBOL(__downgrade_write);
4049
4050 /* Atomic counter implementation. */
4051 EXPORT_SYMBOL(atomic_add);
4052 +EXPORT_SYMBOL(atomic_add_unchecked);
4053 EXPORT_SYMBOL(atomic_add_ret);
4054 +EXPORT_SYMBOL(atomic_add_ret_unchecked);
4055 EXPORT_SYMBOL(atomic_sub);
4056 +EXPORT_SYMBOL(atomic_sub_unchecked);
4057 EXPORT_SYMBOL(atomic_sub_ret);
4058 EXPORT_SYMBOL(atomic64_add);
4059 +EXPORT_SYMBOL(atomic64_add_unchecked);
4060 EXPORT_SYMBOL(atomic64_add_ret);
4061 +EXPORT_SYMBOL(atomic64_add_ret_unchecked);
4062 EXPORT_SYMBOL(atomic64_sub);
4063 +EXPORT_SYMBOL(atomic64_sub_unchecked);
4064 EXPORT_SYMBOL(atomic64_sub_ret);
4065
4066 /* Atomic bit operations. */
4067 diff -urNp linux-3.0.9/arch/sparc/lib/Makefile linux-3.0.9/arch/sparc/lib/Makefile
4068 --- linux-3.0.9/arch/sparc/lib/Makefile 2011-11-11 13:12:24.000000000 -0500
4069 +++ linux-3.0.9/arch/sparc/lib/Makefile 2011-11-15 20:02:59.000000000 -0500
4070 @@ -2,7 +2,7 @@
4071 #
4072
4073 asflags-y := -ansi -DST_DIV0=0x02
4074 -ccflags-y := -Werror
4075 +#ccflags-y := -Werror
4076
4077 lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
4078 lib-$(CONFIG_SPARC32) += memcpy.o memset.o
4079 diff -urNp linux-3.0.9/arch/sparc/Makefile linux-3.0.9/arch/sparc/Makefile
4080 --- linux-3.0.9/arch/sparc/Makefile 2011-11-11 13:12:24.000000000 -0500
4081 +++ linux-3.0.9/arch/sparc/Makefile 2011-11-15 20:02:59.000000000 -0500
4082 @@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc
4083 # Export what is needed by arch/sparc/boot/Makefile
4084 export VMLINUX_INIT VMLINUX_MAIN
4085 VMLINUX_INIT := $(head-y) $(init-y)
4086 -VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
4087 +VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
4088 VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
4089 VMLINUX_MAIN += $(drivers-y) $(net-y)
4090
4091 diff -urNp linux-3.0.9/arch/sparc/mm/fault_32.c linux-3.0.9/arch/sparc/mm/fault_32.c
4092 --- linux-3.0.9/arch/sparc/mm/fault_32.c 2011-11-11 13:12:24.000000000 -0500
4093 +++ linux-3.0.9/arch/sparc/mm/fault_32.c 2011-11-15 20:02:59.000000000 -0500
4094 @@ -22,6 +22,9 @@
4095 #include <linux/interrupt.h>
4096 #include <linux/module.h>
4097 #include <linux/kdebug.h>
4098 +#include <linux/slab.h>
4099 +#include <linux/pagemap.h>
4100 +#include <linux/compiler.h>
4101
4102 #include <asm/system.h>
4103 #include <asm/page.h>
4104 @@ -209,6 +212,268 @@ static unsigned long compute_si_addr(str
4105 return safe_compute_effective_address(regs, insn);
4106 }
4107
4108 +#ifdef CONFIG_PAX_PAGEEXEC
4109 +#ifdef CONFIG_PAX_DLRESOLVE
4110 +static void pax_emuplt_close(struct vm_area_struct *vma)
4111 +{
4112 + vma->vm_mm->call_dl_resolve = 0UL;
4113 +}
4114 +
4115 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
4116 +{
4117 + unsigned int *kaddr;
4118 +
4119 + vmf->page = alloc_page(GFP_HIGHUSER);
4120 + if (!vmf->page)
4121 + return VM_FAULT_OOM;
4122 +
4123 + kaddr = kmap(vmf->page);
4124 + memset(kaddr, 0, PAGE_SIZE);
4125 + kaddr[0] = 0x9DE3BFA8U; /* save */
4126 + flush_dcache_page(vmf->page);
4127 + kunmap(vmf->page);
4128 + return VM_FAULT_MAJOR;
4129 +}
4130 +
4131 +static const struct vm_operations_struct pax_vm_ops = {
4132 + .close = pax_emuplt_close,
4133 + .fault = pax_emuplt_fault
4134 +};
4135 +
4136 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
4137 +{
4138 + int ret;
4139 +
4140 + INIT_LIST_HEAD(&vma->anon_vma_chain);
4141 + vma->vm_mm = current->mm;
4142 + vma->vm_start = addr;
4143 + vma->vm_end = addr + PAGE_SIZE;
4144 + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
4145 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
4146 + vma->vm_ops = &pax_vm_ops;
4147 +
4148 + ret = insert_vm_struct(current->mm, vma);
4149 + if (ret)
4150 + return ret;
4151 +
4152 + ++current->mm->total_vm;
4153 + return 0;
4154 +}
4155 +#endif
4156 +
4157 +/*
4158 + * PaX: decide what to do with offenders (regs->pc = fault address)
4159 + *
4160 + * returns 1 when task should be killed
4161 + * 2 when patched PLT trampoline was detected
4162 + * 3 when unpatched PLT trampoline was detected
4163 + */
4164 +static int pax_handle_fetch_fault(struct pt_regs *regs)
4165 +{
4166 +
4167 +#ifdef CONFIG_PAX_EMUPLT
4168 + int err;
4169 +
4170 + do { /* PaX: patched PLT emulation #1 */
4171 + unsigned int sethi1, sethi2, jmpl;
4172 +
4173 + err = get_user(sethi1, (unsigned int *)regs->pc);
4174 + err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
4175 + err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
4176 +
4177 + if (err)
4178 + break;
4179 +
4180 + if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
4181 + (sethi2 & 0xFFC00000U) == 0x03000000U &&
4182 + (jmpl & 0xFFFFE000U) == 0x81C06000U)
4183 + {
4184 + unsigned int addr;
4185 +
4186 + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
4187 + addr = regs->u_regs[UREG_G1];
4188 + addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4189 + regs->pc = addr;
4190 + regs->npc = addr+4;
4191 + return 2;
4192 + }
4193 + } while (0);
4194 +
4195 + { /* PaX: patched PLT emulation #2 */
4196 + unsigned int ba;
4197 +
4198 + err = get_user(ba, (unsigned int *)regs->pc);
4199 +
4200 + if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
4201 + unsigned int addr;
4202 +
4203 + addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
4204 + regs->pc = addr;
4205 + regs->npc = addr+4;
4206 + return 2;
4207 + }
4208 + }
4209 +
4210 + do { /* PaX: patched PLT emulation #3 */
4211 + unsigned int sethi, jmpl, nop;
4212 +
4213 + err = get_user(sethi, (unsigned int *)regs->pc);
4214 + err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
4215 + err |= get_user(nop, (unsigned int *)(regs->pc+8));
4216 +
4217 + if (err)
4218 + break;
4219 +
4220 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
4221 + (jmpl & 0xFFFFE000U) == 0x81C06000U &&
4222 + nop == 0x01000000U)
4223 + {
4224 + unsigned int addr;
4225 +
4226 + addr = (sethi & 0x003FFFFFU) << 10;
4227 + regs->u_regs[UREG_G1] = addr;
4228 + addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4229 + regs->pc = addr;
4230 + regs->npc = addr+4;
4231 + return 2;
4232 + }
4233 + } while (0);
4234 +
4235 + do { /* PaX: unpatched PLT emulation step 1 */
4236 + unsigned int sethi, ba, nop;
4237 +
4238 + err = get_user(sethi, (unsigned int *)regs->pc);
4239 + err |= get_user(ba, (unsigned int *)(regs->pc+4));
4240 + err |= get_user(nop, (unsigned int *)(regs->pc+8));
4241 +
4242 + if (err)
4243 + break;
4244 +
4245 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
4246 + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
4247 + nop == 0x01000000U)
4248 + {
4249 + unsigned int addr, save, call;
4250 +
4251 + if ((ba & 0xFFC00000U) == 0x30800000U)
4252 + addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
4253 + else
4254 + addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
4255 +
4256 + err = get_user(save, (unsigned int *)addr);
4257 + err |= get_user(call, (unsigned int *)(addr+4));
4258 + err |= get_user(nop, (unsigned int *)(addr+8));
4259 + if (err)
4260 + break;
4261 +
4262 +#ifdef CONFIG_PAX_DLRESOLVE
4263 + if (save == 0x9DE3BFA8U &&
4264 + (call & 0xC0000000U) == 0x40000000U &&
4265 + nop == 0x01000000U)
4266 + {
4267 + struct vm_area_struct *vma;
4268 + unsigned long call_dl_resolve;
4269 +
4270 + down_read(&current->mm->mmap_sem);
4271 + call_dl_resolve = current->mm->call_dl_resolve;
4272 + up_read(&current->mm->mmap_sem);
4273 + if (likely(call_dl_resolve))
4274 + goto emulate;
4275 +
4276 + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
4277 +
4278 + down_write(&current->mm->mmap_sem);
4279 + if (current->mm->call_dl_resolve) {
4280 + call_dl_resolve = current->mm->call_dl_resolve;
4281 + up_write(&current->mm->mmap_sem);
4282 + if (vma)
4283 + kmem_cache_free(vm_area_cachep, vma);
4284 + goto emulate;
4285 + }
4286 +
4287 + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
4288 + if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
4289 + up_write(&current->mm->mmap_sem);
4290 + if (vma)
4291 + kmem_cache_free(vm_area_cachep, vma);
4292 + return 1;
4293 + }
4294 +
4295 + if (pax_insert_vma(vma, call_dl_resolve)) {
4296 + up_write(&current->mm->mmap_sem);
4297 + kmem_cache_free(vm_area_cachep, vma);
4298 + return 1;
4299 + }
4300 +
4301 + current->mm->call_dl_resolve = call_dl_resolve;
4302 + up_write(&current->mm->mmap_sem);
4303 +
4304 +emulate:
4305 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4306 + regs->pc = call_dl_resolve;
4307 + regs->npc = addr+4;
4308 + return 3;
4309 + }
4310 +#endif
4311 +
4312 + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
4313 + if ((save & 0xFFC00000U) == 0x05000000U &&
4314 + (call & 0xFFFFE000U) == 0x85C0A000U &&
4315 + nop == 0x01000000U)
4316 + {
4317 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4318 + regs->u_regs[UREG_G2] = addr + 4;
4319 + addr = (save & 0x003FFFFFU) << 10;
4320 + addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4321 + regs->pc = addr;
4322 + regs->npc = addr+4;
4323 + return 3;
4324 + }
4325 + }
4326 + } while (0);
4327 +
4328 + do { /* PaX: unpatched PLT emulation step 2 */
4329 + unsigned int save, call, nop;
4330 +
4331 + err = get_user(save, (unsigned int *)(regs->pc-4));
4332 + err |= get_user(call, (unsigned int *)regs->pc);
4333 + err |= get_user(nop, (unsigned int *)(regs->pc+4));
4334 + if (err)
4335 + break;
4336 +
4337 + if (save == 0x9DE3BFA8U &&
4338 + (call & 0xC0000000U) == 0x40000000U &&
4339 + nop == 0x01000000U)
4340 + {
4341 + unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
4342 +
4343 + regs->u_regs[UREG_RETPC] = regs->pc;
4344 + regs->pc = dl_resolve;
4345 + regs->npc = dl_resolve+4;
4346 + return 3;
4347 + }
4348 + } while (0);
4349 +#endif
4350 +
4351 + return 1;
4352 +}
4353 +
4354 +void pax_report_insns(void *pc, void *sp)
4355 +{
4356 + unsigned long i;
4357 +
4358 + printk(KERN_ERR "PAX: bytes at PC: ");
4359 + for (i = 0; i < 8; i++) {
4360 + unsigned int c;
4361 + if (get_user(c, (unsigned int *)pc+i))
4362 + printk(KERN_CONT "???????? ");
4363 + else
4364 + printk(KERN_CONT "%08x ", c);
4365 + }
4366 + printk("\n");
4367 +}
4368 +#endif
4369 +
4370 static noinline void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
4371 int text_fault)
4372 {
4373 @@ -281,6 +546,24 @@ good_area:
4374 if(!(vma->vm_flags & VM_WRITE))
4375 goto bad_area;
4376 } else {
4377 +
4378 +#ifdef CONFIG_PAX_PAGEEXEC
4379 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
4380 + up_read(&mm->mmap_sem);
4381 + switch (pax_handle_fetch_fault(regs)) {
4382 +
4383 +#ifdef CONFIG_PAX_EMUPLT
4384 + case 2:
4385 + case 3:
4386 + return;
4387 +#endif
4388 +
4389 + }
4390 + pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
4391 + do_group_exit(SIGKILL);
4392 + }
4393 +#endif
4394 +
4395 /* Allow reads even for write-only mappings */
4396 if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
4397 goto bad_area;
4398 diff -urNp linux-3.0.9/arch/sparc/mm/fault_64.c linux-3.0.9/arch/sparc/mm/fault_64.c
4399 --- linux-3.0.9/arch/sparc/mm/fault_64.c 2011-11-11 13:12:24.000000000 -0500
4400 +++ linux-3.0.9/arch/sparc/mm/fault_64.c 2011-11-15 20:02:59.000000000 -0500
4401 @@ -21,6 +21,9 @@
4402 #include <linux/kprobes.h>
4403 #include <linux/kdebug.h>
4404 #include <linux/percpu.h>
4405 +#include <linux/slab.h>
4406 +#include <linux/pagemap.h>
4407 +#include <linux/compiler.h>
4408
4409 #include <asm/page.h>
4410 #include <asm/pgtable.h>
4411 @@ -74,7 +77,7 @@ static void __kprobes bad_kernel_pc(stru
4412 printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
4413 regs->tpc);
4414 printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
4415 - printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
4416 + printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
4417 printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
4418 dump_stack();
4419 unhandled_fault(regs->tpc, current, regs);
4420 @@ -272,6 +275,457 @@ static void noinline __kprobes bogus_32b
4421 show_regs(regs);
4422 }
4423
4424 +#ifdef CONFIG_PAX_PAGEEXEC
4425 +#ifdef CONFIG_PAX_DLRESOLVE
4426 +static void pax_emuplt_close(struct vm_area_struct *vma)
4427 +{
4428 + vma->vm_mm->call_dl_resolve = 0UL;
4429 +}
4430 +
4431 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
4432 +{
4433 + unsigned int *kaddr;
4434 +
4435 + vmf->page = alloc_page(GFP_HIGHUSER);
4436 + if (!vmf->page)
4437 + return VM_FAULT_OOM;
4438 +
4439 + kaddr = kmap(vmf->page);
4440 + memset(kaddr, 0, PAGE_SIZE);
4441 + kaddr[0] = 0x9DE3BFA8U; /* save */
4442 + flush_dcache_page(vmf->page);
4443 + kunmap(vmf->page);
4444 + return VM_FAULT_MAJOR;
4445 +}
4446 +
4447 +static const struct vm_operations_struct pax_vm_ops = {
4448 + .close = pax_emuplt_close,
4449 + .fault = pax_emuplt_fault
4450 +};
4451 +
4452 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
4453 +{
4454 + int ret;
4455 +
4456 + INIT_LIST_HEAD(&vma->anon_vma_chain);
4457 + vma->vm_mm = current->mm;
4458 + vma->vm_start = addr;
4459 + vma->vm_end = addr + PAGE_SIZE;
4460 + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
4461 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
4462 + vma->vm_ops = &pax_vm_ops;
4463 +
4464 + ret = insert_vm_struct(current->mm, vma);
4465 + if (ret)
4466 + return ret;
4467 +
4468 + ++current->mm->total_vm;
4469 + return 0;
4470 +}
4471 +#endif
4472 +
4473 +/*
4474 + * PaX: decide what to do with offenders (regs->tpc = fault address)
4475 + *
4476 + * returns 1 when task should be killed
4477 + * 2 when patched PLT trampoline was detected
4478 + * 3 when unpatched PLT trampoline was detected
4479 + */
4480 +static int pax_handle_fetch_fault(struct pt_regs *regs)
4481 +{
4482 +
4483 +#ifdef CONFIG_PAX_EMUPLT
4484 + int err;
4485 +
4486 + do { /* PaX: patched PLT emulation #1 */
4487 + unsigned int sethi1, sethi2, jmpl;
4488 +
4489 + err = get_user(sethi1, (unsigned int *)regs->tpc);
4490 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
4491 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
4492 +
4493 + if (err)
4494 + break;
4495 +
4496 + if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
4497 + (sethi2 & 0xFFC00000U) == 0x03000000U &&
4498 + (jmpl & 0xFFFFE000U) == 0x81C06000U)
4499 + {
4500 + unsigned long addr;
4501 +
4502 + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
4503 + addr = regs->u_regs[UREG_G1];
4504 + addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
4505 +
4506 + if (test_thread_flag(TIF_32BIT))
4507 + addr &= 0xFFFFFFFFUL;
4508 +
4509 + regs->tpc = addr;
4510 + regs->tnpc = addr+4;
4511 + return 2;
4512 + }
4513 + } while (0);
4514 +
4515 + { /* PaX: patched PLT emulation #2 */
4516 + unsigned int ba;
4517 +
4518 + err = get_user(ba, (unsigned int *)regs->tpc);
4519 +
4520 + if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
4521 + unsigned long addr;
4522 +
4523 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
4524 +
4525 + if (test_thread_flag(TIF_32BIT))
4526 + addr &= 0xFFFFFFFFUL;
4527 +
4528 + regs->tpc = addr;
4529 + regs->tnpc = addr+4;
4530 + return 2;
4531 + }
4532 + }
4533 +
4534 + do { /* PaX: patched PLT emulation #3 */
4535 + unsigned int sethi, jmpl, nop;
4536 +
4537 + err = get_user(sethi, (unsigned int *)regs->tpc);
4538 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
4539 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
4540 +
4541 + if (err)
4542 + break;
4543 +
4544 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
4545 + (jmpl & 0xFFFFE000U) == 0x81C06000U &&
4546 + nop == 0x01000000U)
4547 + {
4548 + unsigned long addr;
4549 +
4550 + addr = (sethi & 0x003FFFFFU) << 10;
4551 + regs->u_regs[UREG_G1] = addr;
4552 + addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
4553 +
4554 + if (test_thread_flag(TIF_32BIT))
4555 + addr &= 0xFFFFFFFFUL;
4556 +
4557 + regs->tpc = addr;
4558 + regs->tnpc = addr+4;
4559 + return 2;
4560 + }
4561 + } while (0);
4562 +
4563 + do { /* PaX: patched PLT emulation #4 */
4564 + unsigned int sethi, mov1, call, mov2;
4565 +
4566 + err = get_user(sethi, (unsigned int *)regs->tpc);
4567 + err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
4568 + err |= get_user(call, (unsigned int *)(regs->tpc+8));
4569 + err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
4570 +
4571 + if (err)
4572 + break;
4573 +
4574 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
4575 + mov1 == 0x8210000FU &&
4576 + (call & 0xC0000000U) == 0x40000000U &&
4577 + mov2 == 0x9E100001U)
4578 + {
4579 + unsigned long addr;
4580 +
4581 + regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
4582 + addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
4583 +
4584 + if (test_thread_flag(TIF_32BIT))
4585 + addr &= 0xFFFFFFFFUL;
4586 +
4587 + regs->tpc = addr;
4588 + regs->tnpc = addr+4;
4589 + return 2;
4590 + }
4591 + } while (0);
4592 +
4593 + do { /* PaX: patched PLT emulation #5 */
4594 + unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
4595 +
4596 + err = get_user(sethi, (unsigned int *)regs->tpc);
4597 + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
4598 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
4599 + err |= get_user(or1, (unsigned int *)(regs->tpc+12));
4600 + err |= get_user(or2, (unsigned int *)(regs->tpc+16));
4601 + err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
4602 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
4603 + err |= get_user(nop, (unsigned int *)(regs->tpc+28));
4604 +
4605 + if (err)
4606 + break;
4607 +
4608 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
4609 + (sethi1 & 0xFFC00000U) == 0x03000000U &&
4610 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
4611 + (or1 & 0xFFFFE000U) == 0x82106000U &&
4612 + (or2 & 0xFFFFE000U) == 0x8A116000U &&
4613 + sllx == 0x83287020U &&
4614 + jmpl == 0x81C04005U &&
4615 + nop == 0x01000000U)
4616 + {
4617 + unsigned long addr;
4618 +
4619 + regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
4620 + regs->u_regs[UREG_G1] <<= 32;
4621 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
4622 + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
4623 + regs->tpc = addr;
4624 + regs->tnpc = addr+4;
4625 + return 2;
4626 + }
4627 + } while (0);
4628 +
4629 + do { /* PaX: patched PLT emulation #6 */
4630 + unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
4631 +
4632 + err = get_user(sethi, (unsigned int *)regs->tpc);
4633 + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
4634 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
4635 + err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
4636 + err |= get_user(or, (unsigned int *)(regs->tpc+16));
4637 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
4638 + err |= get_user(nop, (unsigned int *)(regs->tpc+24));
4639 +
4640 + if (err)
4641 + break;
4642 +
4643 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
4644 + (sethi1 & 0xFFC00000U) == 0x03000000U &&
4645 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
4646 + sllx == 0x83287020U &&
4647 + (or & 0xFFFFE000U) == 0x8A116000U &&
4648 + jmpl == 0x81C04005U &&
4649 + nop == 0x01000000U)
4650 + {
4651 + unsigned long addr;
4652 +
4653 + regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
4654 + regs->u_regs[UREG_G1] <<= 32;
4655 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
4656 + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
4657 + regs->tpc = addr;
4658 + regs->tnpc = addr+4;
4659 + return 2;
4660 + }
4661 + } while (0);
4662 +
4663 + do { /* PaX: unpatched PLT emulation step 1 */
4664 + unsigned int sethi, ba, nop;
4665 +
4666 + err = get_user(sethi, (unsigned int *)regs->tpc);
4667 + err |= get_user(ba, (unsigned int *)(regs->tpc+4));
4668 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
4669 +
4670 + if (err)
4671 + break;
4672 +
4673 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
4674 + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
4675 + nop == 0x01000000U)
4676 + {
4677 + unsigned long addr;
4678 + unsigned int save, call;
4679 + unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
4680 +
4681 + if ((ba & 0xFFC00000U) == 0x30800000U)
4682 + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
4683 + else
4684 + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
4685 +
4686 + if (test_thread_flag(TIF_32BIT))
4687 + addr &= 0xFFFFFFFFUL;
4688 +
4689 + err = get_user(save, (unsigned int *)addr);
4690 + err |= get_user(call, (unsigned int *)(addr+4));
4691 + err |= get_user(nop, (unsigned int *)(addr+8));
4692 + if (err)
4693 + break;
4694 +
4695 +#ifdef CONFIG_PAX_DLRESOLVE
4696 + if (save == 0x9DE3BFA8U &&
4697 + (call & 0xC0000000U) == 0x40000000U &&
4698 + nop == 0x01000000U)
4699 + {
4700 + struct vm_area_struct *vma;
4701 + unsigned long call_dl_resolve;
4702 +
4703 + down_read(&current->mm->mmap_sem);
4704 + call_dl_resolve = current->mm->call_dl_resolve;
4705 + up_read(&current->mm->mmap_sem);
4706 + if (likely(call_dl_resolve))
4707 + goto emulate;
4708 +
4709 + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
4710 +
4711 + down_write(&current->mm->mmap_sem);
4712 + if (current->mm->call_dl_resolve) {
4713 + call_dl_resolve = current->mm->call_dl_resolve;
4714 + up_write(&current->mm->mmap_sem);
4715 + if (vma)
4716 + kmem_cache_free(vm_area_cachep, vma);
4717 + goto emulate;
4718 + }
4719 +
4720 + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
4721 + if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
4722 + up_write(&current->mm->mmap_sem);
4723 + if (vma)
4724 + kmem_cache_free(vm_area_cachep, vma);
4725 + return 1;
4726 + }
4727 +
4728 + if (pax_insert_vma(vma, call_dl_resolve)) {
4729 + up_write(&current->mm->mmap_sem);
4730 + kmem_cache_free(vm_area_cachep, vma);
4731 + return 1;
4732 + }
4733 +
4734 + current->mm->call_dl_resolve = call_dl_resolve;
4735 + up_write(&current->mm->mmap_sem);
4736 +
4737 +emulate:
4738 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4739 + regs->tpc = call_dl_resolve;
4740 + regs->tnpc = addr+4;
4741 + return 3;
4742 + }
4743 +#endif
4744 +
4745 + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
4746 + if ((save & 0xFFC00000U) == 0x05000000U &&
4747 + (call & 0xFFFFE000U) == 0x85C0A000U &&
4748 + nop == 0x01000000U)
4749 + {
4750 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4751 + regs->u_regs[UREG_G2] = addr + 4;
4752 + addr = (save & 0x003FFFFFU) << 10;
4753 + addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
4754 +
4755 + if (test_thread_flag(TIF_32BIT))
4756 + addr &= 0xFFFFFFFFUL;
4757 +
4758 + regs->tpc = addr;
4759 + regs->tnpc = addr+4;
4760 + return 3;
4761 + }
4762 +
4763 + /* PaX: 64-bit PLT stub */
4764 + err = get_user(sethi1, (unsigned int *)addr);
4765 + err |= get_user(sethi2, (unsigned int *)(addr+4));
4766 + err |= get_user(or1, (unsigned int *)(addr+8));
4767 + err |= get_user(or2, (unsigned int *)(addr+12));
4768 + err |= get_user(sllx, (unsigned int *)(addr+16));
4769 + err |= get_user(add, (unsigned int *)(addr+20));
4770 + err |= get_user(jmpl, (unsigned int *)(addr+24));
4771 + err |= get_user(nop, (unsigned int *)(addr+28));
4772 + if (err)
4773 + break;
4774 +
4775 + if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
4776 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
4777 + (or1 & 0xFFFFE000U) == 0x88112000U &&
4778 + (or2 & 0xFFFFE000U) == 0x8A116000U &&
4779 + sllx == 0x89293020U &&
4780 + add == 0x8A010005U &&
4781 + jmpl == 0x89C14000U &&
4782 + nop == 0x01000000U)
4783 + {
4784 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4785 + regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
4786 + regs->u_regs[UREG_G4] <<= 32;
4787 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
4788 + regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
4789 + regs->u_regs[UREG_G4] = addr + 24;
4790 + addr = regs->u_regs[UREG_G5];
4791 + regs->tpc = addr;
4792 + regs->tnpc = addr+4;
4793 + return 3;
4794 + }
4795 + }
4796 + } while (0);
4797 +
4798 +#ifdef CONFIG_PAX_DLRESOLVE
4799 + do { /* PaX: unpatched PLT emulation step 2 */
4800 + unsigned int save, call, nop;
4801 +
4802 + err = get_user(save, (unsigned int *)(regs->tpc-4));
4803 + err |= get_user(call, (unsigned int *)regs->tpc);
4804 + err |= get_user(nop, (unsigned int *)(regs->tpc+4));
4805 + if (err)
4806 + break;
4807 +
4808 + if (save == 0x9DE3BFA8U &&
4809 + (call & 0xC0000000U) == 0x40000000U &&
4810 + nop == 0x01000000U)
4811 + {
4812 + unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
4813 +
4814 + if (test_thread_flag(TIF_32BIT))
4815 + dl_resolve &= 0xFFFFFFFFUL;
4816 +
4817 + regs->u_regs[UREG_RETPC] = regs->tpc;
4818 + regs->tpc = dl_resolve;
4819 + regs->tnpc = dl_resolve+4;
4820 + return 3;
4821 + }
4822 + } while (0);
4823 +#endif
4824 +
4825 + do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
4826 + unsigned int sethi, ba, nop;
4827 +
4828 + err = get_user(sethi, (unsigned int *)regs->tpc);
4829 + err |= get_user(ba, (unsigned int *)(regs->tpc+4));
4830 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
4831 +
4832 + if (err)
4833 + break;
4834 +
4835 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
4836 + (ba & 0xFFF00000U) == 0x30600000U &&
4837 + nop == 0x01000000U)
4838 + {
4839 + unsigned long addr;
4840 +
4841 + addr = (sethi & 0x003FFFFFU) << 10;
4842 + regs->u_regs[UREG_G1] = addr;
4843 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
4844 +
4845 + if (test_thread_flag(TIF_32BIT))
4846 + addr &= 0xFFFFFFFFUL;
4847 +
4848 + regs->tpc = addr;
4849 + regs->tnpc = addr+4;
4850 + return 2;
4851 + }
4852 + } while (0);
4853 +
4854 +#endif
4855 +
4856 + return 1;
4857 +}
4858 +
4859 +void pax_report_insns(void *pc, void *sp)
4860 +{
4861 + unsigned long i;
4862 +
4863 + printk(KERN_ERR "PAX: bytes at PC: ");
4864 + for (i = 0; i < 8; i++) {
4865 + unsigned int c;
4866 + if (get_user(c, (unsigned int *)pc+i))
4867 + printk(KERN_CONT "???????? ");
4868 + else
4869 + printk(KERN_CONT "%08x ", c);
4870 + }
4871 + printk("\n");
4872 +}
4873 +#endif
4874 +
4875 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
4876 {
4877 struct mm_struct *mm = current->mm;
4878 @@ -340,6 +794,29 @@ asmlinkage void __kprobes do_sparc64_fau
4879 if (!vma)
4880 goto bad_area;
4881
4882 +#ifdef CONFIG_PAX_PAGEEXEC
4883 + /* PaX: detect ITLB misses on non-exec pages */
4884 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
4885 + !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
4886 + {
4887 + if (address != regs->tpc)
4888 + goto good_area;
4889 +
4890 + up_read(&mm->mmap_sem);
4891 + switch (pax_handle_fetch_fault(regs)) {
4892 +
4893 +#ifdef CONFIG_PAX_EMUPLT
4894 + case 2:
4895 + case 3:
4896 + return;
4897 +#endif
4898 +
4899 + }
4900 + pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
4901 + do_group_exit(SIGKILL);
4902 + }
4903 +#endif
4904 +
4905 /* Pure DTLB misses do not tell us whether the fault causing
4906 * load/store/atomic was a write or not, it only says that there
4907 * was no match. So in such a case we (carefully) read the
4908 diff -urNp linux-3.0.9/arch/sparc/mm/hugetlbpage.c linux-3.0.9/arch/sparc/mm/hugetlbpage.c
4909 --- linux-3.0.9/arch/sparc/mm/hugetlbpage.c 2011-11-11 13:12:24.000000000 -0500
4910 +++ linux-3.0.9/arch/sparc/mm/hugetlbpage.c 2011-11-15 20:02:59.000000000 -0500
4911 @@ -68,7 +68,7 @@ full_search:
4912 }
4913 return -ENOMEM;
4914 }
4915 - if (likely(!vma || addr + len <= vma->vm_start)) {
4916 + if (likely(check_heap_stack_gap(vma, addr, len))) {
4917 /*
4918 * Remember the place where we stopped the search:
4919 */
4920 @@ -107,7 +107,7 @@ hugetlb_get_unmapped_area_topdown(struct
4921 /* make sure it can fit in the remaining address space */
4922 if (likely(addr > len)) {
4923 vma = find_vma(mm, addr-len);
4924 - if (!vma || addr <= vma->vm_start) {
4925 + if (check_heap_stack_gap(vma, addr - len, len)) {
4926 /* remember the address as a hint for next time */
4927 return (mm->free_area_cache = addr-len);
4928 }
4929 @@ -116,16 +116,17 @@ hugetlb_get_unmapped_area_topdown(struct
4930 if (unlikely(mm->mmap_base < len))
4931 goto bottomup;
4932
4933 - addr = (mm->mmap_base-len) & HPAGE_MASK;
4934 + addr = mm->mmap_base - len;
4935
4936 do {
4937 + addr &= HPAGE_MASK;
4938 /*
4939 * Lookup failure means no vma is above this address,
4940 * else if new region fits below vma->vm_start,
4941 * return with success:
4942 */
4943 vma = find_vma(mm, addr);
4944 - if (likely(!vma || addr+len <= vma->vm_start)) {
4945 + if (likely(check_heap_stack_gap(vma, addr, len))) {
4946 /* remember the address as a hint for next time */
4947 return (mm->free_area_cache = addr);
4948 }
4949 @@ -135,8 +136,8 @@ hugetlb_get_unmapped_area_topdown(struct
4950 mm->cached_hole_size = vma->vm_start - addr;
4951
4952 /* try just below the current vma->vm_start */
4953 - addr = (vma->vm_start-len) & HPAGE_MASK;
4954 - } while (likely(len < vma->vm_start));
4955 + addr = skip_heap_stack_gap(vma, len);
4956 + } while (!IS_ERR_VALUE(addr));
4957
4958 bottomup:
4959 /*
4960 @@ -182,8 +183,7 @@ hugetlb_get_unmapped_area(struct file *f
4961 if (addr) {
4962 addr = ALIGN(addr, HPAGE_SIZE);
4963 vma = find_vma(mm, addr);
4964 - if (task_size - len >= addr &&
4965 - (!vma || addr + len <= vma->vm_start))
4966 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
4967 return addr;
4968 }
4969 if (mm->get_unmapped_area == arch_get_unmapped_area)
4970 diff -urNp linux-3.0.9/arch/sparc/mm/init_32.c linux-3.0.9/arch/sparc/mm/init_32.c
4971 --- linux-3.0.9/arch/sparc/mm/init_32.c 2011-11-11 13:12:24.000000000 -0500
4972 +++ linux-3.0.9/arch/sparc/mm/init_32.c 2011-11-15 20:02:59.000000000 -0500
4973 @@ -316,6 +316,9 @@ extern void device_scan(void);
4974 pgprot_t PAGE_SHARED __read_mostly;
4975 EXPORT_SYMBOL(PAGE_SHARED);
4976
4977 +pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
4978 +EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
4979 +
4980 void __init paging_init(void)
4981 {
4982 switch(sparc_cpu_model) {
4983 @@ -344,17 +347,17 @@ void __init paging_init(void)
4984
4985 /* Initialize the protection map with non-constant, MMU dependent values. */
4986 protection_map[0] = PAGE_NONE;
4987 - protection_map[1] = PAGE_READONLY;
4988 - protection_map[2] = PAGE_COPY;
4989 - protection_map[3] = PAGE_COPY;
4990 + protection_map[1] = PAGE_READONLY_NOEXEC;
4991 + protection_map[2] = PAGE_COPY_NOEXEC;
4992 + protection_map[3] = PAGE_COPY_NOEXEC;
4993 protection_map[4] = PAGE_READONLY;
4994 protection_map[5] = PAGE_READONLY;
4995 protection_map[6] = PAGE_COPY;
4996 protection_map[7] = PAGE_COPY;
4997 protection_map[8] = PAGE_NONE;
4998 - protection_map[9] = PAGE_READONLY;
4999 - protection_map[10] = PAGE_SHARED;
5000 - protection_map[11] = PAGE_SHARED;
5001 + protection_map[9] = PAGE_READONLY_NOEXEC;
5002 + protection_map[10] = PAGE_SHARED_NOEXEC;
5003 + protection_map[11] = PAGE_SHARED_NOEXEC;
5004 protection_map[12] = PAGE_READONLY;
5005 protection_map[13] = PAGE_READONLY;
5006 protection_map[14] = PAGE_SHARED;
5007 diff -urNp linux-3.0.9/arch/sparc/mm/Makefile linux-3.0.9/arch/sparc/mm/Makefile
5008 --- linux-3.0.9/arch/sparc/mm/Makefile 2011-11-11 13:12:24.000000000 -0500
5009 +++ linux-3.0.9/arch/sparc/mm/Makefile 2011-11-15 20:02:59.000000000 -0500
5010 @@ -2,7 +2,7 @@
5011 #
5012
5013 asflags-y := -ansi
5014 -ccflags-y := -Werror
5015 +#ccflags-y := -Werror
5016
5017 obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o
5018 obj-y += fault_$(BITS).o
5019 diff -urNp linux-3.0.9/arch/sparc/mm/srmmu.c linux-3.0.9/arch/sparc/mm/srmmu.c
5020 --- linux-3.0.9/arch/sparc/mm/srmmu.c 2011-11-11 13:12:24.000000000 -0500
5021 +++ linux-3.0.9/arch/sparc/mm/srmmu.c 2011-11-15 20:02:59.000000000 -0500
5022 @@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
5023 PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
5024 BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
5025 BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
5026 +
5027 +#ifdef CONFIG_PAX_PAGEEXEC
5028 + PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
5029 + BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
5030 + BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
5031 +#endif
5032 +
5033 BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
5034 page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
5035
5036 diff -urNp linux-3.0.9/arch/um/include/asm/kmap_types.h linux-3.0.9/arch/um/include/asm/kmap_types.h
5037 --- linux-3.0.9/arch/um/include/asm/kmap_types.h 2011-11-11 13:12:24.000000000 -0500
5038 +++ linux-3.0.9/arch/um/include/asm/kmap_types.h 2011-11-15 20:02:59.000000000 -0500
5039 @@ -23,6 +23,7 @@ enum km_type {
5040 KM_IRQ1,
5041 KM_SOFTIRQ0,
5042 KM_SOFTIRQ1,
5043 + KM_CLEARPAGE,
5044 KM_TYPE_NR
5045 };
5046
5047 diff -urNp linux-3.0.9/arch/um/include/asm/page.h linux-3.0.9/arch/um/include/asm/page.h
5048 --- linux-3.0.9/arch/um/include/asm/page.h 2011-11-11 13:12:24.000000000 -0500
5049 +++ linux-3.0.9/arch/um/include/asm/page.h 2011-11-15 20:02:59.000000000 -0500
5050 @@ -14,6 +14,9 @@
5051 #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
5052 #define PAGE_MASK (~(PAGE_SIZE-1))
5053
5054 +#define ktla_ktva(addr) (addr)
5055 +#define ktva_ktla(addr) (addr)
5056 +
5057 #ifndef __ASSEMBLY__
5058
5059 struct page;
5060 diff -urNp linux-3.0.9/arch/um/kernel/process.c linux-3.0.9/arch/um/kernel/process.c
5061 --- linux-3.0.9/arch/um/kernel/process.c 2011-11-11 13:12:24.000000000 -0500
5062 +++ linux-3.0.9/arch/um/kernel/process.c 2011-11-15 20:02:59.000000000 -0500
5063 @@ -404,22 +404,6 @@ int singlestepping(void * t)
5064 return 2;
5065 }
5066
5067 -/*
5068 - * Only x86 and x86_64 have an arch_align_stack().
5069 - * All other arches have "#define arch_align_stack(x) (x)"
5070 - * in their asm/system.h
5071 - * As this is included in UML from asm-um/system-generic.h,
5072 - * we can use it to behave as the subarch does.
5073 - */
5074 -#ifndef arch_align_stack
5075 -unsigned long arch_align_stack(unsigned long sp)
5076 -{
5077 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
5078 - sp -= get_random_int() % 8192;
5079 - return sp & ~0xf;
5080 -}
5081 -#endif
5082 -
5083 unsigned long get_wchan(struct task_struct *p)
5084 {
5085 unsigned long stack_page, sp, ip;
5086 diff -urNp linux-3.0.9/arch/um/Makefile linux-3.0.9/arch/um/Makefile
5087 --- linux-3.0.9/arch/um/Makefile 2011-11-11 13:12:24.000000000 -0500
5088 +++ linux-3.0.9/arch/um/Makefile 2011-11-15 20:02:59.000000000 -0500
5089 @@ -49,6 +49,10 @@ USER_CFLAGS = $(patsubst $(KERNEL_DEFINE
5090 $(patsubst -I%,,$(KBUILD_CFLAGS)))) $(ARCH_INCLUDE) $(MODE_INCLUDE) \
5091 $(filter -I%,$(CFLAGS)) -D_FILE_OFFSET_BITS=64
5092
5093 +ifdef CONSTIFY_PLUGIN
5094 +USER_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
5095 +endif
5096 +
5097 include $(srctree)/$(ARCH_DIR)/Makefile-$(SUBARCH)
5098
5099 #This will adjust *FLAGS accordingly to the platform.
5100 diff -urNp linux-3.0.9/arch/um/sys-i386/shared/sysdep/system.h linux-3.0.9/arch/um/sys-i386/shared/sysdep/system.h
5101 --- linux-3.0.9/arch/um/sys-i386/shared/sysdep/system.h 2011-11-11 13:12:24.000000000 -0500
5102 +++ linux-3.0.9/arch/um/sys-i386/shared/sysdep/system.h 2011-11-15 20:02:59.000000000 -0500
5103 @@ -17,7 +17,7 @@
5104 # define AT_VECTOR_SIZE_ARCH 1
5105 #endif
5106
5107 -extern unsigned long arch_align_stack(unsigned long sp);
5108 +#define arch_align_stack(x) ((x) & ~0xfUL)
5109
5110 void default_idle(void);
5111
5112 diff -urNp linux-3.0.9/arch/um/sys-i386/syscalls.c linux-3.0.9/arch/um/sys-i386/syscalls.c
5113 --- linux-3.0.9/arch/um/sys-i386/syscalls.c 2011-11-11 13:12:24.000000000 -0500
5114 +++ linux-3.0.9/arch/um/sys-i386/syscalls.c 2011-11-15 20:02:59.000000000 -0500
5115 @@ -11,6 +11,21 @@
5116 #include "asm/uaccess.h"
5117 #include "asm/unistd.h"
5118
5119 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
5120 +{
5121 + unsigned long pax_task_size = TASK_SIZE;
5122 +
5123 +#ifdef CONFIG_PAX_SEGMEXEC
5124 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
5125 + pax_task_size = SEGMEXEC_TASK_SIZE;
5126 +#endif
5127 +
5128 + if (len > pax_task_size || addr > pax_task_size - len)
5129 + return -EINVAL;
5130 +
5131 + return 0;
5132 +}
5133 +
5134 /*
5135 * The prototype on i386 is:
5136 *
5137 diff -urNp linux-3.0.9/arch/um/sys-x86_64/shared/sysdep/system.h linux-3.0.9/arch/um/sys-x86_64/shared/sysdep/system.h
5138 --- linux-3.0.9/arch/um/sys-x86_64/shared/sysdep/system.h 2011-11-11 13:12:24.000000000 -0500
5139 +++ linux-3.0.9/arch/um/sys-x86_64/shared/sysdep/system.h 2011-11-15 20:02:59.000000000 -0500
5140 @@ -17,7 +17,7 @@
5141 # define AT_VECTOR_SIZE_ARCH 1
5142 #endif
5143
5144 -extern unsigned long arch_align_stack(unsigned long sp);
5145 +#define arch_align_stack(x) ((x) & ~0xfUL)
5146
5147 void default_idle(void);
5148
5149 diff -urNp linux-3.0.9/arch/x86/boot/bitops.h linux-3.0.9/arch/x86/boot/bitops.h
5150 --- linux-3.0.9/arch/x86/boot/bitops.h 2011-11-11 13:12:24.000000000 -0500
5151 +++ linux-3.0.9/arch/x86/boot/bitops.h 2011-11-15 20:02:59.000000000 -0500
5152 @@ -26,7 +26,7 @@ static inline int variable_test_bit(int
5153 u8 v;
5154 const u32 *p = (const u32 *)addr;
5155
5156 - asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
5157 + asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
5158 return v;
5159 }
5160
5161 @@ -37,7 +37,7 @@ static inline int variable_test_bit(int
5162
5163 static inline void set_bit(int nr, void *addr)
5164 {
5165 - asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
5166 + asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
5167 }
5168
5169 #endif /* BOOT_BITOPS_H */
5170 diff -urNp linux-3.0.9/arch/x86/boot/boot.h linux-3.0.9/arch/x86/boot/boot.h
5171 --- linux-3.0.9/arch/x86/boot/boot.h 2011-11-11 13:12:24.000000000 -0500
5172 +++ linux-3.0.9/arch/x86/boot/boot.h 2011-11-15 20:02:59.000000000 -0500
5173 @@ -85,7 +85,7 @@ static inline void io_delay(void)
5174 static inline u16 ds(void)
5175 {
5176 u16 seg;
5177 - asm("movw %%ds,%0" : "=rm" (seg));
5178 + asm volatile("movw %%ds,%0" : "=rm" (seg));
5179 return seg;
5180 }
5181
5182 @@ -181,7 +181,7 @@ static inline void wrgs32(u32 v, addr_t
5183 static inline int memcmp(const void *s1, const void *s2, size_t len)
5184 {
5185 u8 diff;
5186 - asm("repe; cmpsb; setnz %0"
5187 + asm volatile("repe; cmpsb; setnz %0"
5188 : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
5189 return diff;
5190 }
5191 diff -urNp linux-3.0.9/arch/x86/boot/compressed/head_32.S linux-3.0.9/arch/x86/boot/compressed/head_32.S
5192 --- linux-3.0.9/arch/x86/boot/compressed/head_32.S 2011-11-11 13:12:24.000000000 -0500
5193 +++ linux-3.0.9/arch/x86/boot/compressed/head_32.S 2011-11-15 20:02:59.000000000 -0500
5194 @@ -76,7 +76,7 @@ ENTRY(startup_32)
5195 notl %eax
5196 andl %eax, %ebx
5197 #else
5198 - movl $LOAD_PHYSICAL_ADDR, %ebx
5199 + movl $____LOAD_PHYSICAL_ADDR, %ebx
5200 #endif
5201
5202 /* Target address to relocate to for decompression */
5203 @@ -162,7 +162,7 @@ relocated:
5204 * and where it was actually loaded.
5205 */
5206 movl %ebp, %ebx
5207 - subl $LOAD_PHYSICAL_ADDR, %ebx
5208 + subl $____LOAD_PHYSICAL_ADDR, %ebx
5209 jz 2f /* Nothing to be done if loaded at compiled addr. */
5210 /*
5211 * Process relocations.
5212 @@ -170,8 +170,7 @@ relocated:
5213
5214 1: subl $4, %edi
5215 movl (%edi), %ecx
5216 - testl %ecx, %ecx
5217 - jz 2f
5218 + jecxz 2f
5219 addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
5220 jmp 1b
5221 2:
5222 diff -urNp linux-3.0.9/arch/x86/boot/compressed/head_64.S linux-3.0.9/arch/x86/boot/compressed/head_64.S
5223 --- linux-3.0.9/arch/x86/boot/compressed/head_64.S 2011-11-11 13:12:24.000000000 -0500
5224 +++ linux-3.0.9/arch/x86/boot/compressed/head_64.S 2011-11-15 20:02:59.000000000 -0500
5225 @@ -91,7 +91,7 @@ ENTRY(startup_32)
5226 notl %eax
5227 andl %eax, %ebx
5228 #else
5229 - movl $LOAD_PHYSICAL_ADDR, %ebx
5230 + movl $____LOAD_PHYSICAL_ADDR, %ebx
5231 #endif
5232
5233 /* Target address to relocate to for decompression */
5234 @@ -233,7 +233,7 @@ ENTRY(startup_64)
5235 notq %rax
5236 andq %rax, %rbp
5237 #else
5238 - movq $LOAD_PHYSICAL_ADDR, %rbp
5239 + movq $____LOAD_PHYSICAL_ADDR, %rbp
5240 #endif
5241
5242 /* Target address to relocate to for decompression */
5243 diff -urNp linux-3.0.9/arch/x86/boot/compressed/Makefile linux-3.0.9/arch/x86/boot/compressed/Makefile
5244 --- linux-3.0.9/arch/x86/boot/compressed/Makefile 2011-11-11 13:12:24.000000000 -0500
5245 +++ linux-3.0.9/arch/x86/boot/compressed/Makefile 2011-11-15 20:02:59.000000000 -0500
5246 @@ -14,6 +14,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=smal
5247 KBUILD_CFLAGS += $(cflags-y)
5248 KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
5249 KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
5250 +ifdef CONSTIFY_PLUGIN
5251 +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
5252 +endif
5253
5254 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
5255 GCOV_PROFILE := n
5256 diff -urNp linux-3.0.9/arch/x86/boot/compressed/misc.c linux-3.0.9/arch/x86/boot/compressed/misc.c
5257 --- linux-3.0.9/arch/x86/boot/compressed/misc.c 2011-11-11 13:12:24.000000000 -0500
5258 +++ linux-3.0.9/arch/x86/boot/compressed/misc.c 2011-11-15 20:02:59.000000000 -0500
5259 @@ -310,7 +310,7 @@ static void parse_elf(void *output)
5260 case PT_LOAD:
5261 #ifdef CONFIG_RELOCATABLE
5262 dest = output;
5263 - dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
5264 + dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
5265 #else
5266 dest = (void *)(phdr->p_paddr);
5267 #endif
5268 @@ -363,7 +363,7 @@ asmlinkage void decompress_kernel(void *
5269 error("Destination address too large");
5270 #endif
5271 #ifndef CONFIG_RELOCATABLE
5272 - if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
5273 + if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
5274 error("Wrong destination address");
5275 #endif
5276
5277 diff -urNp linux-3.0.9/arch/x86/boot/compressed/relocs.c linux-3.0.9/arch/x86/boot/compressed/relocs.c
5278 --- linux-3.0.9/arch/x86/boot/compressed/relocs.c 2011-11-11 13:12:24.000000000 -0500
5279 +++ linux-3.0.9/arch/x86/boot/compressed/relocs.c 2011-11-15 20:02:59.000000000 -0500
5280 @@ -13,8 +13,11 @@
5281
5282 static void die(char *fmt, ...);
5283
5284 +#include "../../../../include/generated/autoconf.h"
5285 +
5286 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
5287 static Elf32_Ehdr ehdr;
5288 +static Elf32_Phdr *phdr;
5289 static unsigned long reloc_count, reloc_idx;
5290 static unsigned long *relocs;
5291
5292 @@ -270,9 +273,39 @@ static void read_ehdr(FILE *fp)
5293 }
5294 }
5295
5296 +static void read_phdrs(FILE *fp)
5297 +{
5298 + unsigned int i;
5299 +
5300 + phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
5301 + if (!phdr) {
5302 + die("Unable to allocate %d program headers\n",
5303 + ehdr.e_phnum);
5304 + }
5305 + if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
5306 + die("Seek to %d failed: %s\n",
5307 + ehdr.e_phoff, strerror(errno));
5308 + }
5309 + if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
5310 + die("Cannot read ELF program headers: %s\n",
5311 + strerror(errno));
5312 + }
5313 + for(i = 0; i < ehdr.e_phnum; i++) {
5314 + phdr[i].p_type = elf32_to_cpu(phdr[i].p_type);
5315 + phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset);
5316 + phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr);
5317 + phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr);
5318 + phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz);
5319 + phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz);
5320 + phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags);
5321 + phdr[i].p_align = elf32_to_cpu(phdr[i].p_align);
5322 + }
5323 +
5324 +}
5325 +
5326 static void read_shdrs(FILE *fp)
5327 {
5328 - int i;
5329 + unsigned int i;
5330 Elf32_Shdr shdr;
5331
5332 secs = calloc(ehdr.e_shnum, sizeof(struct section));
5333 @@ -307,7 +340,7 @@ static void read_shdrs(FILE *fp)
5334
5335 static void read_strtabs(FILE *fp)
5336 {
5337 - int i;
5338 + unsigned int i;
5339 for (i = 0; i < ehdr.e_shnum; i++) {
5340 struct section *sec = &secs[i];
5341 if (sec->shdr.sh_type != SHT_STRTAB) {
5342 @@ -332,7 +365,7 @@ static void read_strtabs(FILE *fp)
5343
5344 static void read_symtabs(FILE *fp)
5345 {
5346 - int i,j;
5347 + unsigned int i,j;
5348 for (i = 0; i < ehdr.e_shnum; i++) {
5349 struct section *sec = &secs[i];
5350 if (sec->shdr.sh_type != SHT_SYMTAB) {
5351 @@ -365,7 +398,9 @@ static void read_symtabs(FILE *fp)
5352
5353 static void read_relocs(FILE *fp)
5354 {
5355 - int i,j;
5356 + unsigned int i,j;
5357 + uint32_t base;
5358 +
5359 for (i = 0; i < ehdr.e_shnum; i++) {
5360 struct section *sec = &secs[i];
5361 if (sec->shdr.sh_type != SHT_REL) {
5362 @@ -385,9 +420,18 @@ static void read_relocs(FILE *fp)
5363 die("Cannot read symbol table: %s\n",
5364 strerror(errno));
5365 }
5366 + base = 0;
5367 + for (j = 0; j < ehdr.e_phnum; j++) {
5368 + if (phdr[j].p_type != PT_LOAD )
5369 + continue;
5370 + if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
5371 + continue;
5372 + base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
5373 + break;
5374 + }
5375 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
5376 Elf32_Rel *rel = &sec->reltab[j];
5377 - rel->r_offset = elf32_to_cpu(rel->r_offset);
5378 + rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
5379 rel->r_info = elf32_to_cpu(rel->r_info);
5380 }
5381 }
5382 @@ -396,14 +440,14 @@ static void read_relocs(FILE *fp)
5383
5384 static void print_absolute_symbols(void)
5385 {
5386 - int i;
5387 + unsigned int i;
5388 printf("Absolute symbols\n");
5389 printf(" Num: Value Size Type Bind Visibility Name\n");
5390 for (i = 0; i < ehdr.e_shnum; i++) {
5391 struct section *sec = &secs[i];
5392 char *sym_strtab;
5393 Elf32_Sym *sh_symtab;
5394 - int j;
5395 + unsigned int j;
5396
5397 if (sec->shdr.sh_type != SHT_SYMTAB) {
5398 continue;
5399 @@ -431,14 +475,14 @@ static void print_absolute_symbols(void)
5400
5401 static void print_absolute_relocs(void)
5402 {
5403 - int i, printed = 0;
5404 + unsigned int i, printed = 0;
5405
5406 for (i = 0; i < ehdr.e_shnum; i++) {
5407 struct section *sec = &secs[i];
5408 struct section *sec_applies, *sec_symtab;
5409 char *sym_strtab;
5410 Elf32_Sym *sh_symtab;
5411 - int j;
5412 + unsigned int j;
5413 if (sec->shdr.sh_type != SHT_REL) {
5414 continue;
5415 }
5416 @@ -499,13 +543,13 @@ static void print_absolute_relocs(void)
5417
5418 static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
5419 {
5420 - int i;
5421 + unsigned int i;
5422 /* Walk through the relocations */
5423 for (i = 0; i < ehdr.e_shnum; i++) {
5424 char *sym_strtab;
5425 Elf32_Sym *sh_symtab;
5426 struct section *sec_applies, *sec_symtab;
5427 - int j;
5428 + unsigned int j;
5429 struct section *sec = &secs[i];
5430
5431 if (sec->shdr.sh_type != SHT_REL) {
5432 @@ -530,6 +574,22 @@ static void walk_relocs(void (*visit)(El
5433 !is_rel_reloc(sym_name(sym_strtab, sym))) {
5434 continue;
5435 }
5436 + /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
5437 + if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
5438 + continue;
5439 +
5440 +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
5441 + /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
5442 + if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
5443 + continue;
5444 + if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
5445 + continue;
5446 + if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
5447 + continue;
5448 + if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
5449 + continue;
5450 +#endif
5451 +
5452 switch (r_type) {
5453 case R_386_NONE:
5454 case R_386_PC32:
5455 @@ -571,7 +631,7 @@ static int cmp_relocs(const void *va, co
5456
5457 static void emit_relocs(int as_text)
5458 {
5459 - int i;
5460 + unsigned int i;
5461 /* Count how many relocations I have and allocate space for them. */
5462 reloc_count = 0;
5463 walk_relocs(count_reloc);
5464 @@ -665,6 +725,7 @@ int main(int argc, char **argv)
5465 fname, strerror(errno));
5466 }
5467 read_ehdr(fp);
5468 + read_phdrs(fp);
5469 read_shdrs(fp);
5470 read_strtabs(fp);
5471 read_symtabs(fp);
5472 diff -urNp linux-3.0.9/arch/x86/boot/cpucheck.c linux-3.0.9/arch/x86/boot/cpucheck.c
5473 --- linux-3.0.9/arch/x86/boot/cpucheck.c 2011-11-11 13:12:24.000000000 -0500
5474 +++ linux-3.0.9/arch/x86/boot/cpucheck.c 2011-11-15 20:02:59.000000000 -0500
5475 @@ -74,7 +74,7 @@ static int has_fpu(void)
5476 u16 fcw = -1, fsw = -1;
5477 u32 cr0;
5478
5479 - asm("movl %%cr0,%0" : "=r" (cr0));
5480 + asm volatile("movl %%cr0,%0" : "=r" (cr0));
5481 if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
5482 cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
5483 asm volatile("movl %0,%%cr0" : : "r" (cr0));
5484 @@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
5485 {
5486 u32 f0, f1;
5487
5488 - asm("pushfl ; "
5489 + asm volatile("pushfl ; "
5490 "pushfl ; "
5491 "popl %0 ; "
5492 "movl %0,%1 ; "
5493 @@ -115,7 +115,7 @@ static void get_flags(void)
5494 set_bit(X86_FEATURE_FPU, cpu.flags);
5495
5496 if (has_eflag(X86_EFLAGS_ID)) {
5497 - asm("cpuid"
5498 + asm volatile("cpuid"
5499 : "=a" (max_intel_level),
5500 "=b" (cpu_vendor[0]),
5501 "=d" (cpu_vendor[1]),
5502 @@ -124,7 +124,7 @@ static void get_flags(void)
5503
5504 if (max_intel_level >= 0x00000001 &&
5505 max_intel_level <= 0x0000ffff) {
5506 - asm("cpuid"
5507 + asm volatile("cpuid"
5508 : "=a" (tfms),
5509 "=c" (cpu.flags[4]),
5510 "=d" (cpu.flags[0])
5511 @@ -136,7 +136,7 @@ static void get_flags(void)
5512 cpu.model += ((tfms >> 16) & 0xf) << 4;
5513 }
5514
5515 - asm("cpuid"
5516 + asm volatile("cpuid"
5517 : "=a" (max_amd_level)
5518 : "a" (0x80000000)
5519 : "ebx", "ecx", "edx");
5520 @@ -144,7 +144,7 @@ static void get_flags(void)
5521 if (max_amd_level >= 0x80000001 &&
5522 max_amd_level <= 0x8000ffff) {
5523 u32 eax = 0x80000001;
5524 - asm("cpuid"
5525 + asm volatile("cpuid"
5526 : "+a" (eax),
5527 "=c" (cpu.flags[6]),
5528 "=d" (cpu.flags[1])
5529 @@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r
5530 u32 ecx = MSR_K7_HWCR;
5531 u32 eax, edx;
5532
5533 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
5534 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
5535 eax &= ~(1 << 15);
5536 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
5537 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
5538
5539 get_flags(); /* Make sure it really did something */
5540 err = check_flags();
5541 @@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r
5542 u32 ecx = MSR_VIA_FCR;
5543 u32 eax, edx;
5544
5545 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
5546 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
5547 eax |= (1<<1)|(1<<7);
5548 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
5549 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
5550
5551 set_bit(X86_FEATURE_CX8, cpu.flags);
5552 err = check_flags();
5553 @@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r
5554 u32 eax, edx;
5555 u32 level = 1;
5556
5557 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
5558 - asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
5559 - asm("cpuid"
5560 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
5561 + asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
5562 + asm volatile("cpuid"
5563 : "+a" (level), "=d" (cpu.flags[0])
5564 : : "ecx", "ebx");
5565 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
5566 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
5567
5568 err = check_flags();
5569 }
5570 diff -urNp linux-3.0.9/arch/x86/boot/header.S linux-3.0.9/arch/x86/boot/header.S
5571 --- linux-3.0.9/arch/x86/boot/header.S 2011-11-11 13:12:24.000000000 -0500
5572 +++ linux-3.0.9/arch/x86/boot/header.S 2011-11-15 20:02:59.000000000 -0500
5573 @@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical
5574 # single linked list of
5575 # struct setup_data
5576
5577 -pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
5578 +pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
5579
5580 #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
5581 #define VO_INIT_SIZE (VO__end - VO__text)
5582 diff -urNp linux-3.0.9/arch/x86/boot/Makefile linux-3.0.9/arch/x86/boot/Makefile
5583 --- linux-3.0.9/arch/x86/boot/Makefile 2011-11-11 13:12:24.000000000 -0500
5584 +++ linux-3.0.9/arch/x86/boot/Makefile 2011-11-15 20:02:59.000000000 -0500
5585 @@ -69,6 +69,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os
5586 $(call cc-option, -fno-stack-protector) \
5587 $(call cc-option, -mpreferred-stack-boundary=2)
5588 KBUILD_CFLAGS += $(call cc-option, -m32)
5589 +ifdef CONSTIFY_PLUGIN
5590 +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
5591 +endif
5592 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
5593 GCOV_PROFILE := n
5594
5595 diff -urNp linux-3.0.9/arch/x86/boot/memory.c linux-3.0.9/arch/x86/boot/memory.c
5596 --- linux-3.0.9/arch/x86/boot/memory.c 2011-11-11 13:12:24.000000000 -0500
5597 +++ linux-3.0.9/arch/x86/boot/memory.c 2011-11-15 20:02:59.000000000 -0500
5598 @@ -19,7 +19,7 @@
5599
5600 static int detect_memory_e820(void)
5601 {
5602 - int count = 0;
5603 + unsigned int count = 0;
5604 struct biosregs ireg, oreg;
5605 struct e820entry *desc = boot_params.e820_map;
5606 static struct e820entry buf; /* static so it is zeroed */
5607 diff -urNp linux-3.0.9/arch/x86/boot/video.c linux-3.0.9/arch/x86/boot/video.c
5608 --- linux-3.0.9/arch/x86/boot/video.c 2011-11-11 13:12:24.000000000 -0500
5609 +++ linux-3.0.9/arch/x86/boot/video.c 2011-11-15 20:02:59.000000000 -0500
5610 @@ -96,7 +96,7 @@ static void store_mode_params(void)
5611 static unsigned int get_entry(void)
5612 {
5613 char entry_buf[4];
5614 - int i, len = 0;
5615 + unsigned int i, len = 0;
5616 int key;
5617 unsigned int v;
5618
5619 diff -urNp linux-3.0.9/arch/x86/boot/video-vesa.c linux-3.0.9/arch/x86/boot/video-vesa.c
5620 --- linux-3.0.9/arch/x86/boot/video-vesa.c 2011-11-11 13:12:24.000000000 -0500
5621 +++ linux-3.0.9/arch/x86/boot/video-vesa.c 2011-11-15 20:02:59.000000000 -0500
5622 @@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
5623
5624 boot_params.screen_info.vesapm_seg = oreg.es;
5625 boot_params.screen_info.vesapm_off = oreg.di;
5626 + boot_params.screen_info.vesapm_size = oreg.cx;
5627 }
5628
5629 /*
5630 diff -urNp linux-3.0.9/arch/x86/crypto/aes-x86_64-asm_64.S linux-3.0.9/arch/x86/crypto/aes-x86_64-asm_64.S
5631 --- linux-3.0.9/arch/x86/crypto/aes-x86_64-asm_64.S 2011-11-11 13:12:24.000000000 -0500
5632 +++ linux-3.0.9/arch/x86/crypto/aes-x86_64-asm_64.S 2011-11-15 20:02:59.000000000 -0500
5633 @@ -8,6 +8,8 @@
5634 * including this sentence is retained in full.
5635 */
5636
5637 +#include <asm/alternative-asm.h>
5638 +
5639 .extern crypto_ft_tab
5640 .extern crypto_it_tab
5641 .extern crypto_fl_tab
5642 @@ -71,6 +73,8 @@ FUNC: movq r1,r2; \
5643 je B192; \
5644 leaq 32(r9),r9;
5645
5646 +#define ret pax_force_retaddr; ret
5647 +
5648 #define epilogue(r1,r2,r3,r4,r5,r6,r7,r8,r9) \
5649 movq r1,r2; \
5650 movq r3,r4; \
5651 diff -urNp linux-3.0.9/arch/x86/crypto/salsa20-x86_64-asm_64.S linux-3.0.9/arch/x86/crypto/salsa20-x86_64-asm_64.S
5652 --- linux-3.0.9/arch/x86/crypto/salsa20-x86_64-asm_64.S 2011-11-11 13:12:24.000000000 -0500
5653 +++ linux-3.0.9/arch/x86/crypto/salsa20-x86_64-asm_64.S 2011-11-15 20:02:59.000000000 -0500
5654 @@ -1,3 +1,5 @@
5655 +#include <asm/alternative-asm.h>
5656 +
5657 # enter ECRYPT_encrypt_bytes
5658 .text
5659 .p2align 5
5660 @@ -790,6 +792,7 @@ ECRYPT_encrypt_bytes:
5661 add %r11,%rsp
5662 mov %rdi,%rax
5663 mov %rsi,%rdx
5664 + pax_force_retaddr
5665 ret
5666 # bytesatleast65:
5667 ._bytesatleast65:
5668 @@ -891,6 +894,7 @@ ECRYPT_keysetup:
5669 add %r11,%rsp
5670 mov %rdi,%rax
5671 mov %rsi,%rdx
5672 + pax_force_retaddr
5673 ret
5674 # enter ECRYPT_ivsetup
5675 .text
5676 @@ -917,4 +921,5 @@ ECRYPT_ivsetup:
5677 add %r11,%rsp
5678 mov %rdi,%rax
5679 mov %rsi,%rdx
5680 + pax_force_retaddr
5681 ret
5682 diff -urNp linux-3.0.9/arch/x86/crypto/twofish-x86_64-asm_64.S linux-3.0.9/arch/x86/crypto/twofish-x86_64-asm_64.S
5683 --- linux-3.0.9/arch/x86/crypto/twofish-x86_64-asm_64.S 2011-11-11 13:12:24.000000000 -0500
5684 +++ linux-3.0.9/arch/x86/crypto/twofish-x86_64-asm_64.S 2011-11-15 20:02:59.000000000 -0500
5685 @@ -21,6 +21,7 @@
5686 .text
5687
5688 #include <asm/asm-offsets.h>
5689 +#include <asm/alternative-asm.h>
5690
5691 #define a_offset 0
5692 #define b_offset 4
5693 @@ -269,6 +270,7 @@ twofish_enc_blk:
5694
5695 popq R1
5696 movq $1,%rax
5697 + pax_force_retaddr
5698 ret
5699
5700 twofish_dec_blk:
5701 @@ -321,4 +323,5 @@ twofish_dec_blk:
5702
5703 popq R1
5704 movq $1,%rax
5705 + pax_force_retaddr
5706 ret
5707 diff -urNp linux-3.0.9/arch/x86/ia32/ia32_aout.c linux-3.0.9/arch/x86/ia32/ia32_aout.c
5708 --- linux-3.0.9/arch/x86/ia32/ia32_aout.c 2011-11-11 13:12:24.000000000 -0500
5709 +++ linux-3.0.9/arch/x86/ia32/ia32_aout.c 2011-11-15 20:02:59.000000000 -0500
5710 @@ -162,6 +162,8 @@ static int aout_core_dump(long signr, st
5711 unsigned long dump_start, dump_size;
5712 struct user32 dump;
5713
5714 + memset(&dump, 0, sizeof(dump));
5715 +
5716 fs = get_fs();
5717 set_fs(KERNEL_DS);
5718 has_dumped = 1;
5719 diff -urNp linux-3.0.9/arch/x86/ia32/ia32entry.S linux-3.0.9/arch/x86/ia32/ia32entry.S
5720 --- linux-3.0.9/arch/x86/ia32/ia32entry.S 2011-11-11 13:12:24.000000000 -0500
5721 +++ linux-3.0.9/arch/x86/ia32/ia32entry.S 2011-11-15 20:02:59.000000000 -0500
5722 @@ -13,7 +13,9 @@
5723 #include <asm/thread_info.h>
5724 #include <asm/segment.h>
5725 #include <asm/irqflags.h>
5726 +#include <asm/pgtable.h>
5727 #include <linux/linkage.h>
5728 +#include <asm/alternative-asm.h>
5729
5730 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
5731 #include <linux/elf-em.h>
5732 @@ -95,6 +97,29 @@ ENTRY(native_irq_enable_sysexit)
5733 ENDPROC(native_irq_enable_sysexit)
5734 #endif
5735
5736 + .macro pax_enter_kernel_user
5737 +#ifdef CONFIG_PAX_MEMORY_UDEREF
5738 + call pax_enter_kernel_user
5739 +#endif
5740 + .endm
5741 +
5742 + .macro pax_exit_kernel_user
5743 +#ifdef CONFIG_PAX_MEMORY_UDEREF
5744 + call pax_exit_kernel_user
5745 +#endif
5746 +#ifdef CONFIG_PAX_RANDKSTACK
5747 + pushq %rax
5748 + call pax_randomize_kstack
5749 + popq %rax
5750 +#endif
5751 + .endm
5752 +
5753 + .macro pax_erase_kstack
5754 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
5755 + call pax_erase_kstack
5756 +#endif
5757 + .endm
5758 +
5759 /*
5760 * 32bit SYSENTER instruction entry.
5761 *
5762 @@ -121,7 +146,7 @@ ENTRY(ia32_sysenter_target)
5763 CFI_REGISTER rsp,rbp
5764 SWAPGS_UNSAFE_STACK
5765 movq PER_CPU_VAR(kernel_stack), %rsp
5766 - addq $(KERNEL_STACK_OFFSET),%rsp
5767 + pax_enter_kernel_user
5768 /*
5769 * No need to follow this irqs on/off section: the syscall
5770 * disabled irqs, here we enable it straight after entry:
5771 @@ -134,7 +159,8 @@ ENTRY(ia32_sysenter_target)
5772 CFI_REL_OFFSET rsp,0
5773 pushfq_cfi
5774 /*CFI_REL_OFFSET rflags,0*/
5775 - movl 8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
5776 + GET_THREAD_INFO(%r10)
5777 + movl TI_sysenter_return(%r10), %r10d
5778 CFI_REGISTER rip,r10
5779 pushq_cfi $__USER32_CS
5780 /*CFI_REL_OFFSET cs,0*/
5781 @@ -146,6 +172,12 @@ ENTRY(ia32_sysenter_target)
5782 SAVE_ARGS 0,0,1
5783 /* no need to do an access_ok check here because rbp has been
5784 32bit zero extended */
5785 +
5786 +#ifdef CONFIG_PAX_MEMORY_UDEREF
5787 + mov $PAX_USER_SHADOW_BASE,%r10
5788 + add %r10,%rbp
5789 +#endif
5790 +
5791 1: movl (%rbp),%ebp
5792 .section __ex_table,"a"
5793 .quad 1b,ia32_badarg
5794 @@ -168,6 +200,8 @@ sysenter_dispatch:
5795 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
5796 jnz sysexit_audit
5797 sysexit_from_sys_call:
5798 + pax_exit_kernel_user
5799 + pax_erase_kstack
5800 andl $~TS_COMPAT,TI_status(%r10)
5801 /* clear IF, that popfq doesn't enable interrupts early */
5802 andl $~0x200,EFLAGS-R11(%rsp)
5803 @@ -194,6 +228,9 @@ sysexit_from_sys_call:
5804 movl %eax,%esi /* 2nd arg: syscall number */
5805 movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
5806 call audit_syscall_entry
5807 +
5808 + pax_erase_kstack
5809 +
5810 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
5811 cmpq $(IA32_NR_syscalls-1),%rax
5812 ja ia32_badsys
5813 @@ -246,6 +283,9 @@ sysenter_tracesys:
5814 movq $-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */
5815 movq %rsp,%rdi /* &pt_regs -> arg1 */
5816 call syscall_trace_enter
5817 +
5818 + pax_erase_kstack
5819 +
5820 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
5821 RESTORE_REST
5822 cmpq $(IA32_NR_syscalls-1),%rax
5823 @@ -277,19 +317,24 @@ ENDPROC(ia32_sysenter_target)
5824 ENTRY(ia32_cstar_target)
5825 CFI_STARTPROC32 simple
5826 CFI_SIGNAL_FRAME
5827 - CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
5828 + CFI_DEF_CFA rsp,0
5829 CFI_REGISTER rip,rcx
5830 /*CFI_REGISTER rflags,r11*/
5831 SWAPGS_UNSAFE_STACK
5832 movl %esp,%r8d
5833 CFI_REGISTER rsp,r8
5834 movq PER_CPU_VAR(kernel_stack),%rsp
5835 +
5836 +#ifdef CONFIG_PAX_MEMORY_UDEREF
5837 + pax_enter_kernel_user
5838 +#endif
5839 +
5840 /*
5841 * No need to follow this irqs on/off section: the syscall
5842 * disabled irqs and here we enable it straight after entry:
5843 */
5844 ENABLE_INTERRUPTS(CLBR_NONE)
5845 - SAVE_ARGS 8,1,1
5846 + SAVE_ARGS 8*6,1,1
5847 movl %eax,%eax /* zero extension */
5848 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
5849 movq %rcx,RIP-ARGOFFSET(%rsp)
5850 @@ -305,6 +350,12 @@ ENTRY(ia32_cstar_target)
5851 /* no need to do an access_ok check here because r8 has been
5852 32bit zero extended */
5853 /* hardware stack frame is complete now */
5854 +
5855 +#ifdef CONFIG_PAX_MEMORY_UDEREF
5856 + mov $PAX_USER_SHADOW_BASE,%r10
5857 + add %r10,%r8
5858 +#endif
5859 +
5860 1: movl (%r8),%r9d
5861 .section __ex_table,"a"
5862 .quad 1b,ia32_badarg
5863 @@ -327,6 +378,8 @@ cstar_dispatch:
5864 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
5865 jnz sysretl_audit
5866 sysretl_from_sys_call:
5867 + pax_exit_kernel_user
5868 + pax_erase_kstack
5869 andl $~TS_COMPAT,TI_status(%r10)
5870 RESTORE_ARGS 1,-ARG_SKIP,1,1,1
5871 movl RIP-ARGOFFSET(%rsp),%ecx
5872 @@ -364,6 +417,9 @@ cstar_tracesys:
5873 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
5874 movq %rsp,%rdi /* &pt_regs -> arg1 */
5875 call syscall_trace_enter
5876 +
5877 + pax_erase_kstack
5878 +
5879 LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */
5880 RESTORE_REST
5881 xchgl %ebp,%r9d
5882 @@ -409,6 +465,7 @@ ENTRY(ia32_syscall)
5883 CFI_REL_OFFSET rip,RIP-RIP
5884 PARAVIRT_ADJUST_EXCEPTION_FRAME
5885 SWAPGS
5886 + pax_enter_kernel_user
5887 /*
5888 * No need to follow this irqs on/off section: the syscall
5889 * disabled irqs and here we enable it straight after entry:
5890 @@ -441,6 +498,9 @@ ia32_tracesys:
5891 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
5892 movq %rsp,%rdi /* &pt_regs -> arg1 */
5893 call syscall_trace_enter
5894 +
5895 + pax_erase_kstack
5896 +
5897 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
5898 RESTORE_REST
5899 cmpq $(IA32_NR_syscalls-1),%rax
5900 @@ -455,6 +515,7 @@ ia32_badsys:
5901
5902 quiet_ni_syscall:
5903 movq $-ENOSYS,%rax
5904 + pax_force_retaddr
5905 ret
5906 CFI_ENDPROC
5907
5908 diff -urNp linux-3.0.9/arch/x86/ia32/ia32_signal.c linux-3.0.9/arch/x86/ia32/ia32_signal.c
5909 --- linux-3.0.9/arch/x86/ia32/ia32_signal.c 2011-11-11 13:12:24.000000000 -0500
5910 +++ linux-3.0.9/arch/x86/ia32/ia32_signal.c 2011-11-15 20:02:59.000000000 -0500
5911 @@ -167,7 +167,7 @@ asmlinkage long sys32_sigaltstack(const
5912 }
5913 seg = get_fs();
5914 set_fs(KERNEL_DS);
5915 - ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss, regs->sp);
5916 + ret = do_sigaltstack(uss_ptr ? (const stack_t __force_user *)&uss : NULL, (stack_t __force_user *)&uoss, regs->sp);
5917 set_fs(seg);
5918 if (ret >= 0 && uoss_ptr) {
5919 if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t)))
5920 @@ -374,7 +374,7 @@ static int ia32_setup_sigcontext(struct
5921 */
5922 static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
5923 size_t frame_size,
5924 - void **fpstate)
5925 + void __user **fpstate)
5926 {
5927 unsigned long sp;
5928
5929 @@ -395,7 +395,7 @@ static void __user *get_sigframe(struct
5930
5931 if (used_math()) {
5932 sp = sp - sig_xstate_ia32_size;
5933 - *fpstate = (struct _fpstate_ia32 *) sp;
5934 + *fpstate = (struct _fpstate_ia32 __user *) sp;
5935 if (save_i387_xstate_ia32(*fpstate) < 0)
5936 return (void __user *) -1L;
5937 }
5938 @@ -403,7 +403,7 @@ static void __user *get_sigframe(struct
5939 sp -= frame_size;
5940 /* Align the stack pointer according to the i386 ABI,
5941 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
5942 - sp = ((sp + 4) & -16ul) - 4;
5943 + sp = ((sp - 12) & -16ul) - 4;
5944 return (void __user *) sp;
5945 }
5946
5947 @@ -461,7 +461,7 @@ int ia32_setup_frame(int sig, struct k_s
5948 * These are actually not used anymore, but left because some
5949 * gdb versions depend on them as a marker.
5950 */
5951 - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
5952 + put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
5953 } put_user_catch(err);
5954
5955 if (err)
5956 @@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct
5957 0xb8,
5958 __NR_ia32_rt_sigreturn,
5959 0x80cd,
5960 - 0,
5961 + 0
5962 };
5963
5964 frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
5965 @@ -533,16 +533,18 @@ int ia32_setup_rt_frame(int sig, struct
5966
5967 if (ka->sa.sa_flags & SA_RESTORER)
5968 restorer = ka->sa.sa_restorer;
5969 + else if (current->mm->context.vdso)
5970 + /* Return stub is in 32bit vsyscall page */
5971 + restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
5972 else
5973 - restorer = VDSO32_SYMBOL(current->mm->context.vdso,
5974 - rt_sigreturn);
5975 + restorer = &frame->retcode;
5976 put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
5977
5978 /*
5979 * Not actually used anymore, but left because some gdb
5980 * versions need it.
5981 */
5982 - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
5983 + put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
5984 } put_user_catch(err);
5985
5986 if (err)
5987 diff -urNp linux-3.0.9/arch/x86/ia32/sys_ia32.c linux-3.0.9/arch/x86/ia32/sys_ia32.c
5988 --- linux-3.0.9/arch/x86/ia32/sys_ia32.c 2011-11-11 13:12:24.000000000 -0500
5989 +++ linux-3.0.9/arch/x86/ia32/sys_ia32.c 2011-11-15 20:02:59.000000000 -0500
5990 @@ -69,8 +69,8 @@ asmlinkage long sys32_ftruncate64(unsign
5991 */
5992 static int cp_stat64(struct stat64 __user *ubuf, struct kstat *stat)
5993 {
5994 - typeof(ubuf->st_uid) uid = 0;
5995 - typeof(ubuf->st_gid) gid = 0;
5996 + typeof(((struct stat64 *)0)->st_uid) uid = 0;
5997 + typeof(((struct stat64 *)0)->st_gid) gid = 0;
5998 SET_UID(uid, stat->uid);
5999 SET_GID(gid, stat->gid);
6000 if (!access_ok(VERIFY_WRITE, ubuf, sizeof(struct stat64)) ||
6001 @@ -308,8 +308,8 @@ asmlinkage long sys32_rt_sigprocmask(int
6002 }
6003 set_fs(KERNEL_DS);
6004 ret = sys_rt_sigprocmask(how,
6005 - set ? (sigset_t __user *)&s : NULL,
6006 - oset ? (sigset_t __user *)&s : NULL,
6007 + set ? (sigset_t __force_user *)&s : NULL,
6008 + oset ? (sigset_t __force_user *)&s : NULL,
6009 sigsetsize);
6010 set_fs(old_fs);
6011 if (ret)
6012 @@ -332,7 +332,7 @@ asmlinkage long sys32_alarm(unsigned int
6013 return alarm_setitimer(seconds);
6014 }
6015
6016 -asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int *stat_addr,
6017 +asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int __user *stat_addr,
6018 int options)
6019 {
6020 return compat_sys_wait4(pid, stat_addr, options, NULL);
6021 @@ -353,7 +353,7 @@ asmlinkage long sys32_sched_rr_get_inter
6022 mm_segment_t old_fs = get_fs();
6023
6024 set_fs(KERNEL_DS);
6025 - ret = sys_sched_rr_get_interval(pid, (struct timespec __user *)&t);
6026 + ret = sys_sched_rr_get_interval(pid, (struct timespec __force_user *)&t);
6027 set_fs(old_fs);
6028 if (put_compat_timespec(&t, interval))
6029 return -EFAULT;
6030 @@ -369,7 +369,7 @@ asmlinkage long sys32_rt_sigpending(comp
6031 mm_segment_t old_fs = get_fs();
6032
6033 set_fs(KERNEL_DS);
6034 - ret = sys_rt_sigpending((sigset_t __user *)&s, sigsetsize);
6035 + ret = sys_rt_sigpending((sigset_t __force_user *)&s, sigsetsize);
6036 set_fs(old_fs);
6037 if (!ret) {
6038 switch (_NSIG_WORDS) {
6039 @@ -394,7 +394,7 @@ asmlinkage long sys32_rt_sigqueueinfo(in
6040 if (copy_siginfo_from_user32(&info, uinfo))
6041 return -EFAULT;
6042 set_fs(KERNEL_DS);
6043 - ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __user *)&info);
6044 + ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __force_user *)&info);
6045 set_fs(old_fs);
6046 return ret;
6047 }
6048 @@ -439,7 +439,7 @@ asmlinkage long sys32_sendfile(int out_f
6049 return -EFAULT;
6050
6051 set_fs(KERNEL_DS);
6052 - ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __user *)&of : NULL,
6053 + ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __force_user *)&of : NULL,
6054 count);
6055 set_fs(old_fs);
6056
6057 diff -urNp linux-3.0.9/arch/x86/include/asm/alternative-asm.h linux-3.0.9/arch/x86/include/asm/alternative-asm.h
6058 --- linux-3.0.9/arch/x86/include/asm/alternative-asm.h 2011-11-11 13:12:24.000000000 -0500
6059 +++ linux-3.0.9/arch/x86/include/asm/alternative-asm.h 2011-11-15 20:02:59.000000000 -0500
6060 @@ -15,6 +15,20 @@
6061 .endm
6062 #endif
6063
6064 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN
6065 + .macro pax_force_retaddr rip=0
6066 + btsq $63,\rip(%rsp)
6067 + .endm
6068 + .macro pax_force_fptr ptr
6069 + btsq $63,\ptr
6070 + .endm
6071 +#else
6072 + .macro pax_force_retaddr rip=0
6073 + .endm
6074 + .macro pax_force_fptr ptr
6075 + .endm
6076 +#endif
6077 +
6078 .macro altinstruction_entry orig alt feature orig_len alt_len
6079 .align 8
6080 .quad \orig
6081 diff -urNp linux-3.0.9/arch/x86/include/asm/alternative.h linux-3.0.9/arch/x86/include/asm/alternative.h
6082 --- linux-3.0.9/arch/x86/include/asm/alternative.h 2011-11-11 13:12:24.000000000 -0500
6083 +++ linux-3.0.9/arch/x86/include/asm/alternative.h 2011-11-15 20:02:59.000000000 -0500
6084 @@ -93,7 +93,7 @@ static inline int alternatives_text_rese
6085 ".section .discard,\"aw\",@progbits\n" \
6086 " .byte 0xff + (664f-663f) - (662b-661b)\n" /* rlen <= slen */ \
6087 ".previous\n" \
6088 - ".section .altinstr_replacement, \"ax\"\n" \
6089 + ".section .altinstr_replacement, \"a\"\n" \
6090 "663:\n\t" newinstr "\n664:\n" /* replacement */ \
6091 ".previous"
6092
6093 diff -urNp linux-3.0.9/arch/x86/include/asm/apic.h linux-3.0.9/arch/x86/include/asm/apic.h
6094 --- linux-3.0.9/arch/x86/include/asm/apic.h 2011-11-11 13:12:24.000000000 -0500
6095 +++ linux-3.0.9/arch/x86/include/asm/apic.h 2011-11-15 20:02:59.000000000 -0500
6096 @@ -45,7 +45,7 @@ static inline void generic_apic_probe(vo
6097
6098 #ifdef CONFIG_X86_LOCAL_APIC
6099
6100 -extern unsigned int apic_verbosity;
6101 +extern int apic_verbosity;
6102 extern int local_apic_timer_c2_ok;
6103
6104 extern int disable_apic;
6105 diff -urNp linux-3.0.9/arch/x86/include/asm/apm.h linux-3.0.9/arch/x86/include/asm/apm.h
6106 --- linux-3.0.9/arch/x86/include/asm/apm.h 2011-11-11 13:12:24.000000000 -0500
6107 +++ linux-3.0.9/arch/x86/include/asm/apm.h 2011-11-15 20:02:59.000000000 -0500
6108 @@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
6109 __asm__ __volatile__(APM_DO_ZERO_SEGS
6110 "pushl %%edi\n\t"
6111 "pushl %%ebp\n\t"
6112 - "lcall *%%cs:apm_bios_entry\n\t"
6113 + "lcall *%%ss:apm_bios_entry\n\t"
6114 "setc %%al\n\t"
6115 "popl %%ebp\n\t"
6116 "popl %%edi\n\t"
6117 @@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as
6118 __asm__ __volatile__(APM_DO_ZERO_SEGS
6119 "pushl %%edi\n\t"
6120 "pushl %%ebp\n\t"
6121 - "lcall *%%cs:apm_bios_entry\n\t"
6122 + "lcall *%%ss:apm_bios_entry\n\t"
6123 "setc %%bl\n\t"
6124 "popl %%ebp\n\t"
6125 "popl %%edi\n\t"
6126 diff -urNp linux-3.0.9/arch/x86/include/asm/atomic64_32.h linux-3.0.9/arch/x86/include/asm/atomic64_32.h
6127 --- linux-3.0.9/arch/x86/include/asm/atomic64_32.h 2011-11-11 13:12:24.000000000 -0500
6128 +++ linux-3.0.9/arch/x86/include/asm/atomic64_32.h 2011-11-15 20:02:59.000000000 -0500
6129 @@ -12,6 +12,14 @@ typedef struct {
6130 u64 __aligned(8) counter;
6131 } atomic64_t;
6132
6133 +#ifdef CONFIG_PAX_REFCOUNT
6134 +typedef struct {
6135 + u64 __aligned(8) counter;
6136 +} atomic64_unchecked_t;
6137 +#else
6138 +typedef atomic64_t atomic64_unchecked_t;
6139 +#endif
6140 +
6141 #define ATOMIC64_INIT(val) { (val) }
6142
6143 #ifdef CONFIG_X86_CMPXCHG64
6144 @@ -38,6 +46,21 @@ static inline long long atomic64_cmpxchg
6145 }
6146
6147 /**
6148 + * atomic64_cmpxchg_unchecked - cmpxchg atomic64 variable
6149 + * @p: pointer to type atomic64_unchecked_t
6150 + * @o: expected value
6151 + * @n: new value
6152 + *
6153 + * Atomically sets @v to @n if it was equal to @o and returns
6154 + * the old value.
6155 + */
6156 +
6157 +static inline long long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long long o, long long n)
6158 +{
6159 + return cmpxchg64(&v->counter, o, n);
6160 +}
6161 +
6162 +/**
6163 * atomic64_xchg - xchg atomic64 variable
6164 * @v: pointer to type atomic64_t
6165 * @n: value to assign
6166 @@ -77,6 +100,24 @@ static inline void atomic64_set(atomic64
6167 }
6168
6169 /**
6170 + * atomic64_set_unchecked - set atomic64 variable
6171 + * @v: pointer to type atomic64_unchecked_t
6172 + * @n: value to assign
6173 + *
6174 + * Atomically sets the value of @v to @n.
6175 + */
6176 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
6177 +{
6178 + unsigned high = (unsigned)(i >> 32);
6179 + unsigned low = (unsigned)i;
6180 + asm volatile(ATOMIC64_ALTERNATIVE(set)
6181 + : "+b" (low), "+c" (high)
6182 + : "S" (v)
6183 + : "eax", "edx", "memory"
6184 + );
6185 +}
6186 +
6187 +/**
6188 * atomic64_read - read atomic64 variable
6189 * @v: pointer to type atomic64_t
6190 *
6191 @@ -93,6 +134,22 @@ static inline long long atomic64_read(at
6192 }
6193
6194 /**
6195 + * atomic64_read_unchecked - read atomic64 variable
6196 + * @v: pointer to type atomic64_unchecked_t
6197 + *
6198 + * Atomically reads the value of @v and returns it.
6199 + */
6200 +static inline long long atomic64_read_unchecked(atomic64_unchecked_t *v)
6201 +{
6202 + long long r;
6203 + asm volatile(ATOMIC64_ALTERNATIVE(read_unchecked)
6204 + : "=A" (r), "+c" (v)
6205 + : : "memory"
6206 + );
6207 + return r;
6208 + }
6209 +
6210 +/**
6211 * atomic64_add_return - add and return
6212 * @i: integer value to add
6213 * @v: pointer to type atomic64_t
6214 @@ -108,6 +165,22 @@ static inline long long atomic64_add_ret
6215 return i;
6216 }
6217
6218 +/**
6219 + * atomic64_add_return_unchecked - add and return
6220 + * @i: integer value to add
6221 + * @v: pointer to type atomic64_unchecked_t
6222 + *
6223 + * Atomically adds @i to @v and returns @i + *@v
6224 + */
6225 +static inline long long atomic64_add_return_unchecked(long long i, atomic64_unchecked_t *v)
6226 +{
6227 + asm volatile(ATOMIC64_ALTERNATIVE(add_return_unchecked)
6228 + : "+A" (i), "+c" (v)
6229 + : : "memory"
6230 + );
6231 + return i;
6232 +}
6233 +
6234 /*
6235 * Other variants with different arithmetic operators:
6236 */
6237 @@ -131,6 +204,17 @@ static inline long long atomic64_inc_ret
6238 return a;
6239 }
6240
6241 +static inline long long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
6242 +{
6243 + long long a;
6244 + asm volatile(ATOMIC64_ALTERNATIVE(inc_return_unchecked)
6245 + : "=A" (a)
6246 + : "S" (v)
6247 + : "memory", "ecx"
6248 + );
6249 + return a;
6250 +}
6251 +
6252 static inline long long atomic64_dec_return(atomic64_t *v)
6253 {
6254 long long a;
6255 @@ -159,6 +243,22 @@ static inline long long atomic64_add(lon
6256 }
6257
6258 /**
6259 + * atomic64_add_unchecked - add integer to atomic64 variable
6260 + * @i: integer value to add
6261 + * @v: pointer to type atomic64_unchecked_t
6262 + *
6263 + * Atomically adds @i to @v.
6264 + */
6265 +static inline long long atomic64_add_unchecked(long long i, atomic64_unchecked_t *v)
6266 +{
6267 + asm volatile(ATOMIC64_ALTERNATIVE_(add_unchecked, add_return_unchecked)
6268 + : "+A" (i), "+c" (v)
6269 + : : "memory"
6270 + );
6271 + return i;
6272 +}
6273 +
6274 +/**
6275 * atomic64_sub - subtract the atomic64 variable
6276 * @i: integer value to subtract
6277 * @v: pointer to type atomic64_t
6278 diff -urNp linux-3.0.9/arch/x86/include/asm/atomic64_64.h linux-3.0.9/arch/x86/include/asm/atomic64_64.h
6279 --- linux-3.0.9/arch/x86/include/asm/atomic64_64.h 2011-11-11 13:12:24.000000000 -0500
6280 +++ linux-3.0.9/arch/x86/include/asm/atomic64_64.h 2011-11-15 20:02:59.000000000 -0500
6281 @@ -18,7 +18,19 @@
6282 */
6283 static inline long atomic64_read(const atomic64_t *v)
6284 {
6285 - return (*(volatile long *)&(v)->counter);
6286 + return (*(volatile const long *)&(v)->counter);
6287 +}
6288 +
6289 +/**
6290 + * atomic64_read_unchecked - read atomic64 variable
6291 + * @v: pointer of type atomic64_unchecked_t
6292 + *
6293 + * Atomically reads the value of @v.
6294 + * Doesn't imply a read memory barrier.
6295 + */
6296 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
6297 +{
6298 + return (*(volatile const long *)&(v)->counter);
6299 }
6300
6301 /**
6302 @@ -34,6 +46,18 @@ static inline void atomic64_set(atomic64
6303 }
6304
6305 /**
6306 + * atomic64_set_unchecked - set atomic64 variable
6307 + * @v: pointer to type atomic64_unchecked_t
6308 + * @i: required value
6309 + *
6310 + * Atomically sets the value of @v to @i.
6311 + */
6312 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
6313 +{
6314 + v->counter = i;
6315 +}
6316 +
6317 +/**
6318 * atomic64_add - add integer to atomic64 variable
6319 * @i: integer value to add
6320 * @v: pointer to type atomic64_t
6321 @@ -42,6 +66,28 @@ static inline void atomic64_set(atomic64
6322 */
6323 static inline void atomic64_add(long i, atomic64_t *v)
6324 {
6325 + asm volatile(LOCK_PREFIX "addq %1,%0\n"
6326 +
6327 +#ifdef CONFIG_PAX_REFCOUNT
6328 + "jno 0f\n"
6329 + LOCK_PREFIX "subq %1,%0\n"
6330 + "int $4\n0:\n"
6331 + _ASM_EXTABLE(0b, 0b)
6332 +#endif
6333 +
6334 + : "=m" (v->counter)
6335 + : "er" (i), "m" (v->counter));
6336 +}
6337 +
6338 +/**
6339 + * atomic64_add_unchecked - add integer to atomic64 variable
6340 + * @i: integer value to add
6341 + * @v: pointer to type atomic64_unchecked_t
6342 + *
6343 + * Atomically adds @i to @v.
6344 + */
6345 +static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
6346 +{
6347 asm volatile(LOCK_PREFIX "addq %1,%0"
6348 : "=m" (v->counter)
6349 : "er" (i), "m" (v->counter));
6350 @@ -56,7 +102,29 @@ static inline void atomic64_add(long i,
6351 */
6352 static inline void atomic64_sub(long i, atomic64_t *v)
6353 {
6354 - asm volatile(LOCK_PREFIX "subq %1,%0"
6355 + asm volatile(LOCK_PREFIX "subq %1,%0\n"
6356 +
6357 +#ifdef CONFIG_PAX_REFCOUNT
6358 + "jno 0f\n"
6359 + LOCK_PREFIX "addq %1,%0\n"
6360 + "int $4\n0:\n"
6361 + _ASM_EXTABLE(0b, 0b)
6362 +#endif
6363 +
6364 + : "=m" (v->counter)
6365 + : "er" (i), "m" (v->counter));
6366 +}
6367 +
6368 +/**
6369 + * atomic64_sub_unchecked - subtract the atomic64 variable
6370 + * @i: integer value to subtract
6371 + * @v: pointer to type atomic64_unchecked_t
6372 + *
6373 + * Atomically subtracts @i from @v.
6374 + */
6375 +static inline void atomic64_sub_unchecked(long i, atomic64_unchecked_t *v)
6376 +{
6377 + asm volatile(LOCK_PREFIX "subq %1,%0\n"
6378 : "=m" (v->counter)
6379 : "er" (i), "m" (v->counter));
6380 }
6381 @@ -74,7 +142,16 @@ static inline int atomic64_sub_and_test(
6382 {
6383 unsigned char c;
6384
6385 - asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
6386 + asm volatile(LOCK_PREFIX "subq %2,%0\n"
6387 +
6388 +#ifdef CONFIG_PAX_REFCOUNT
6389 + "jno 0f\n"
6390 + LOCK_PREFIX "addq %2,%0\n"
6391 + "int $4\n0:\n"
6392 + _ASM_EXTABLE(0b, 0b)
6393 +#endif
6394 +
6395 + "sete %1\n"
6396 : "=m" (v->counter), "=qm" (c)
6397 : "er" (i), "m" (v->counter) : "memory");
6398 return c;
6399 @@ -88,6 +165,27 @@ static inline int atomic64_sub_and_test(
6400 */
6401 static inline void atomic64_inc(atomic64_t *v)
6402 {
6403 + asm volatile(LOCK_PREFIX "incq %0\n"
6404 +
6405 +#ifdef CONFIG_PAX_REFCOUNT
6406 + "jno 0f\n"
6407 + LOCK_PREFIX "decq %0\n"
6408 + "int $4\n0:\n"
6409 + _ASM_EXTABLE(0b, 0b)
6410 +#endif
6411 +
6412 + : "=m" (v->counter)
6413 + : "m" (v->counter));
6414 +}
6415 +
6416 +/**
6417 + * atomic64_inc_unchecked - increment atomic64 variable
6418 + * @v: pointer to type atomic64_unchecked_t
6419 + *
6420 + * Atomically increments @v by 1.
6421 + */
6422 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
6423 +{
6424 asm volatile(LOCK_PREFIX "incq %0"
6425 : "=m" (v->counter)
6426 : "m" (v->counter));
6427 @@ -101,7 +199,28 @@ static inline void atomic64_inc(atomic64
6428 */
6429 static inline void atomic64_dec(atomic64_t *v)
6430 {
6431 - asm volatile(LOCK_PREFIX "decq %0"
6432 + asm volatile(LOCK_PREFIX "decq %0\n"
6433 +
6434 +#ifdef CONFIG_PAX_REFCOUNT
6435 + "jno 0f\n"
6436 + LOCK_PREFIX "incq %0\n"
6437 + "int $4\n0:\n"
6438 + _ASM_EXTABLE(0b, 0b)
6439 +#endif
6440 +
6441 + : "=m" (v->counter)
6442 + : "m" (v->counter));
6443 +}
6444 +
6445 +/**
6446 + * atomic64_dec_unchecked - decrement atomic64 variable
6447 + * @v: pointer to type atomic64_t
6448 + *
6449 + * Atomically decrements @v by 1.
6450 + */
6451 +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
6452 +{
6453 + asm volatile(LOCK_PREFIX "decq %0\n"
6454 : "=m" (v->counter)
6455 : "m" (v->counter));
6456 }
6457 @@ -118,7 +237,16 @@ static inline int atomic64_dec_and_test(
6458 {
6459 unsigned char c;
6460
6461 - asm volatile(LOCK_PREFIX "decq %0; sete %1"
6462 + asm volatile(LOCK_PREFIX "decq %0\n"
6463 +
6464 +#ifdef CONFIG_PAX_REFCOUNT
6465 + "jno 0f\n"
6466 + LOCK_PREFIX "incq %0\n"
6467 + "int $4\n0:\n"
6468 + _ASM_EXTABLE(0b, 0b)
6469 +#endif
6470 +
6471 + "sete %1\n"
6472 : "=m" (v->counter), "=qm" (c)
6473 : "m" (v->counter) : "memory");
6474 return c != 0;
6475 @@ -136,7 +264,16 @@ static inline int atomic64_inc_and_test(
6476 {
6477 unsigned char c;
6478
6479 - asm volatile(LOCK_PREFIX "incq %0; sete %1"
6480 + asm volatile(LOCK_PREFIX "incq %0\n"
6481 +
6482 +#ifdef CONFIG_PAX_REFCOUNT
6483 + "jno 0f\n"
6484 + LOCK_PREFIX "decq %0\n"
6485 + "int $4\n0:\n"
6486 + _ASM_EXTABLE(0b, 0b)
6487 +#endif
6488 +
6489 + "sete %1\n"
6490 : "=m" (v->counter), "=qm" (c)
6491 : "m" (v->counter) : "memory");
6492 return c != 0;
6493 @@ -155,7 +292,16 @@ static inline int atomic64_add_negative(
6494 {
6495 unsigned char c;
6496
6497 - asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
6498 + asm volatile(LOCK_PREFIX "addq %2,%0\n"
6499 +
6500 +#ifdef CONFIG_PAX_REFCOUNT
6501 + "jno 0f\n"
6502 + LOCK_PREFIX "subq %2,%0\n"
6503 + "int $4\n0:\n"
6504 + _ASM_EXTABLE(0b, 0b)
6505 +#endif
6506 +
6507 + "sets %1\n"
6508 : "=m" (v->counter), "=qm" (c)
6509 : "er" (i), "m" (v->counter) : "memory");
6510 return c;
6511 @@ -171,7 +317,31 @@ static inline int atomic64_add_negative(
6512 static inline long atomic64_add_return(long i, atomic64_t *v)
6513 {
6514 long __i = i;
6515 - asm volatile(LOCK_PREFIX "xaddq %0, %1;"
6516 + asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
6517 +
6518 +#ifdef CONFIG_PAX_REFCOUNT
6519 + "jno 0f\n"
6520 + "movq %0, %1\n"
6521 + "int $4\n0:\n"
6522 + _ASM_EXTABLE(0b, 0b)
6523 +#endif
6524 +
6525 + : "+r" (i), "+m" (v->counter)
6526 + : : "memory");
6527 + return i + __i;
6528 +}
6529 +
6530 +/**
6531 + * atomic64_add_return_unchecked - add and return
6532 + * @i: integer value to add
6533 + * @v: pointer to type atomic64_unchecked_t
6534 + *
6535 + * Atomically adds @i to @v and returns @i + @v
6536 + */
6537 +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
6538 +{
6539 + long __i = i;
6540 + asm volatile(LOCK_PREFIX "xaddq %0, %1"
6541 : "+r" (i), "+m" (v->counter)
6542 : : "memory");
6543 return i + __i;
6544 @@ -183,6 +353,10 @@ static inline long atomic64_sub_return(l
6545 }
6546
6547 #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
6548 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
6549 +{
6550 + return atomic64_add_return_unchecked(1, v);
6551 +}
6552 #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
6553
6554 static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
6555 @@ -190,6 +364,11 @@ static inline long atomic64_cmpxchg(atom
6556 return cmpxchg(&v->counter, old, new);
6557 }
6558
6559 +static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
6560 +{
6561 + return cmpxchg(&v->counter, old, new);
6562 +}
6563 +
6564 static inline long atomic64_xchg(atomic64_t *v, long new)
6565 {
6566 return xchg(&v->counter, new);
6567 @@ -206,17 +385,30 @@ static inline long atomic64_xchg(atomic6
6568 */
6569 static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
6570 {
6571 - long c, old;
6572 + long c, old, new;
6573 c = atomic64_read(v);
6574 for (;;) {
6575 - if (unlikely(c == (u)))
6576 + if (unlikely(c == u))
6577 break;
6578 - old = atomic64_cmpxchg((v), c, c + (a));
6579 +
6580 + asm volatile("add %2,%0\n"
6581 +
6582 +#ifdef CONFIG_PAX_REFCOUNT
6583 + "jno 0f\n"
6584 + "sub %2,%0\n"
6585 + "int $4\n0:\n"
6586 + _ASM_EXTABLE(0b, 0b)
6587 +#endif
6588 +
6589 + : "=r" (new)
6590 + : "0" (c), "ir" (a));
6591 +
6592 + old = atomic64_cmpxchg(v, c, new);
6593 if (likely(old == c))
6594 break;
6595 c = old;
6596 }
6597 - return c != (u);
6598 + return c != u;
6599 }
6600
6601 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
6602 diff -urNp linux-3.0.9/arch/x86/include/asm/atomic.h linux-3.0.9/arch/x86/include/asm/atomic.h
6603 --- linux-3.0.9/arch/x86/include/asm/atomic.h 2011-11-11 13:12:24.000000000 -0500
6604 +++ linux-3.0.9/arch/x86/include/asm/atomic.h 2011-11-15 20:02:59.000000000 -0500
6605 @@ -22,7 +22,18 @@
6606 */
6607 static inline int atomic_read(const atomic_t *v)
6608 {
6609 - return (*(volatile int *)&(v)->counter);
6610 + return (*(volatile const int *)&(v)->counter);
6611 +}
6612 +
6613 +/**
6614 + * atomic_read_unchecked - read atomic variable
6615 + * @v: pointer of type atomic_unchecked_t
6616 + *
6617 + * Atomically reads the value of @v.
6618 + */
6619 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
6620 +{
6621 + return (*(volatile const int *)&(v)->counter);
6622 }
6623
6624 /**
6625 @@ -38,6 +49,18 @@ static inline void atomic_set(atomic_t *
6626 }
6627
6628 /**
6629 + * atomic_set_unchecked - set atomic variable
6630 + * @v: pointer of type atomic_unchecked_t
6631 + * @i: required value
6632 + *
6633 + * Atomically sets the value of @v to @i.
6634 + */
6635 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
6636 +{
6637 + v->counter = i;
6638 +}
6639 +
6640 +/**
6641 * atomic_add - add integer to atomic variable
6642 * @i: integer value to add
6643 * @v: pointer of type atomic_t
6644 @@ -46,7 +69,29 @@ static inline void atomic_set(atomic_t *
6645 */
6646 static inline void atomic_add(int i, atomic_t *v)
6647 {
6648 - asm volatile(LOCK_PREFIX "addl %1,%0"
6649 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
6650 +
6651 +#ifdef CONFIG_PAX_REFCOUNT
6652 + "jno 0f\n"
6653 + LOCK_PREFIX "subl %1,%0\n"
6654 + "int $4\n0:\n"
6655 + _ASM_EXTABLE(0b, 0b)
6656 +#endif
6657 +
6658 + : "+m" (v->counter)
6659 + : "ir" (i));
6660 +}
6661 +
6662 +/**
6663 + * atomic_add_unchecked - add integer to atomic variable
6664 + * @i: integer value to add
6665 + * @v: pointer of type atomic_unchecked_t
6666 + *
6667 + * Atomically adds @i to @v.
6668 + */
6669 +static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
6670 +{
6671 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
6672 : "+m" (v->counter)
6673 : "ir" (i));
6674 }
6675 @@ -60,7 +105,29 @@ static inline void atomic_add(int i, ato
6676 */
6677 static inline void atomic_sub(int i, atomic_t *v)
6678 {
6679 - asm volatile(LOCK_PREFIX "subl %1,%0"
6680 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
6681 +
6682 +#ifdef CONFIG_PAX_REFCOUNT
6683 + "jno 0f\n"
6684 + LOCK_PREFIX "addl %1,%0\n"
6685 + "int $4\n0:\n"
6686 + _ASM_EXTABLE(0b, 0b)
6687 +#endif
6688 +
6689 + : "+m" (v->counter)
6690 + : "ir" (i));
6691 +}
6692 +
6693 +/**
6694 + * atomic_sub_unchecked - subtract integer from atomic variable
6695 + * @i: integer value to subtract
6696 + * @v: pointer of type atomic_unchecked_t
6697 + *
6698 + * Atomically subtracts @i from @v.
6699 + */
6700 +static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
6701 +{
6702 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
6703 : "+m" (v->counter)
6704 : "ir" (i));
6705 }
6706 @@ -78,7 +145,16 @@ static inline int atomic_sub_and_test(in
6707 {
6708 unsigned char c;
6709
6710 - asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
6711 + asm volatile(LOCK_PREFIX "subl %2,%0\n"
6712 +
6713 +#ifdef CONFIG_PAX_REFCOUNT
6714 + "jno 0f\n"
6715 + LOCK_PREFIX "addl %2,%0\n"
6716 + "int $4\n0:\n"
6717 + _ASM_EXTABLE(0b, 0b)
6718 +#endif
6719 +
6720 + "sete %1\n"
6721 : "+m" (v->counter), "=qm" (c)
6722 : "ir" (i) : "memory");
6723 return c;
6724 @@ -92,7 +168,27 @@ static inline int atomic_sub_and_test(in
6725 */
6726 static inline void atomic_inc(atomic_t *v)
6727 {
6728 - asm volatile(LOCK_PREFIX "incl %0"
6729 + asm volatile(LOCK_PREFIX "incl %0\n"
6730 +
6731 +#ifdef CONFIG_PAX_REFCOUNT
6732 + "jno 0f\n"
6733 + LOCK_PREFIX "decl %0\n"
6734 + "int $4\n0:\n"
6735 + _ASM_EXTABLE(0b, 0b)
6736 +#endif
6737 +
6738 + : "+m" (v->counter));
6739 +}
6740 +
6741 +/**
6742 + * atomic_inc_unchecked - increment atomic variable
6743 + * @v: pointer of type atomic_unchecked_t
6744 + *
6745 + * Atomically increments @v by 1.
6746 + */
6747 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
6748 +{
6749 + asm volatile(LOCK_PREFIX "incl %0\n"
6750 : "+m" (v->counter));
6751 }
6752
6753 @@ -104,7 +200,27 @@ static inline void atomic_inc(atomic_t *
6754 */
6755 static inline void atomic_dec(atomic_t *v)
6756 {
6757 - asm volatile(LOCK_PREFIX "decl %0"
6758 + asm volatile(LOCK_PREFIX "decl %0\n"
6759 +
6760 +#ifdef CONFIG_PAX_REFCOUNT
6761 + "jno 0f\n"
6762 + LOCK_PREFIX "incl %0\n"
6763 + "int $4\n0:\n"
6764 + _ASM_EXTABLE(0b, 0b)
6765 +#endif
6766 +
6767 + : "+m" (v->counter));
6768 +}
6769 +
6770 +/**
6771 + * atomic_dec_unchecked - decrement atomic variable
6772 + * @v: pointer of type atomic_unchecked_t
6773 + *
6774 + * Atomically decrements @v by 1.
6775 + */
6776 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
6777 +{
6778 + asm volatile(LOCK_PREFIX "decl %0\n"
6779 : "+m" (v->counter));
6780 }
6781
6782 @@ -120,7 +236,16 @@ static inline int atomic_dec_and_test(at
6783 {
6784 unsigned char c;
6785
6786 - asm volatile(LOCK_PREFIX "decl %0; sete %1"
6787 + asm volatile(LOCK_PREFIX "decl %0\n"
6788 +
6789 +#ifdef CONFIG_PAX_REFCOUNT
6790 + "jno 0f\n"
6791 + LOCK_PREFIX "incl %0\n"
6792 + "int $4\n0:\n"
6793 + _ASM_EXTABLE(0b, 0b)
6794 +#endif
6795 +
6796 + "sete %1\n"
6797 : "+m" (v->counter), "=qm" (c)
6798 : : "memory");
6799 return c != 0;
6800 @@ -138,7 +263,35 @@ static inline int atomic_inc_and_test(at
6801 {
6802 unsigned char c;
6803
6804 - asm volatile(LOCK_PREFIX "incl %0; sete %1"
6805 + asm volatile(LOCK_PREFIX "incl %0\n"
6806 +
6807 +#ifdef CONFIG_PAX_REFCOUNT
6808 + "jno 0f\n"
6809 + LOCK_PREFIX "decl %0\n"
6810 + "int $4\n0:\n"
6811 + _ASM_EXTABLE(0b, 0b)
6812 +#endif
6813 +
6814 + "sete %1\n"
6815 + : "+m" (v->counter), "=qm" (c)
6816 + : : "memory");
6817 + return c != 0;
6818 +}
6819 +
6820 +/**
6821 + * atomic_inc_and_test_unchecked - increment and test
6822 + * @v: pointer of type atomic_unchecked_t
6823 + *
6824 + * Atomically increments @v by 1
6825 + * and returns true if the result is zero, or false for all
6826 + * other cases.
6827 + */
6828 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
6829 +{
6830 + unsigned char c;
6831 +
6832 + asm volatile(LOCK_PREFIX "incl %0\n"
6833 + "sete %1\n"
6834 : "+m" (v->counter), "=qm" (c)
6835 : : "memory");
6836 return c != 0;
6837 @@ -157,7 +310,16 @@ static inline int atomic_add_negative(in
6838 {
6839 unsigned char c;
6840
6841 - asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
6842 + asm volatile(LOCK_PREFIX "addl %2,%0\n"
6843 +
6844 +#ifdef CONFIG_PAX_REFCOUNT
6845 + "jno 0f\n"
6846 + LOCK_PREFIX "subl %2,%0\n"
6847 + "int $4\n0:\n"
6848 + _ASM_EXTABLE(0b, 0b)
6849 +#endif
6850 +
6851 + "sets %1\n"
6852 : "+m" (v->counter), "=qm" (c)
6853 : "ir" (i) : "memory");
6854 return c;
6855 @@ -180,6 +342,46 @@ static inline int atomic_add_return(int
6856 #endif
6857 /* Modern 486+ processor */
6858 __i = i;
6859 + asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
6860 +
6861 +#ifdef CONFIG_PAX_REFCOUNT
6862 + "jno 0f\n"
6863 + "movl %0, %1\n"
6864 + "int $4\n0:\n"
6865 + _ASM_EXTABLE(0b, 0b)
6866 +#endif
6867 +
6868 + : "+r" (i), "+m" (v->counter)
6869 + : : "memory");
6870 + return i + __i;
6871 +
6872 +#ifdef CONFIG_M386
6873 +no_xadd: /* Legacy 386 processor */
6874 + local_irq_save(flags);
6875 + __i = atomic_read(v);
6876 + atomic_set(v, i + __i);
6877 + local_irq_restore(flags);
6878 + return i + __i;
6879 +#endif
6880 +}
6881 +
6882 +/**
6883 + * atomic_add_return_unchecked - add integer and return
6884 + * @v: pointer of type atomic_unchecked_t
6885 + * @i: integer value to add
6886 + *
6887 + * Atomically adds @i to @v and returns @i + @v
6888 + */
6889 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
6890 +{
6891 + int __i;
6892 +#ifdef CONFIG_M386
6893 + unsigned long flags;
6894 + if (unlikely(boot_cpu_data.x86 <= 3))
6895 + goto no_xadd;
6896 +#endif
6897 + /* Modern 486+ processor */
6898 + __i = i;
6899 asm volatile(LOCK_PREFIX "xaddl %0, %1"
6900 : "+r" (i), "+m" (v->counter)
6901 : : "memory");
6902 @@ -208,6 +410,10 @@ static inline int atomic_sub_return(int
6903 }
6904
6905 #define atomic_inc_return(v) (atomic_add_return(1, v))
6906 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
6907 +{
6908 + return atomic_add_return_unchecked(1, v);
6909 +}
6910 #define atomic_dec_return(v) (atomic_sub_return(1, v))
6911
6912 static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
6913 @@ -215,11 +421,21 @@ static inline int atomic_cmpxchg(atomic_
6914 return cmpxchg(&v->counter, old, new);
6915 }
6916
6917 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
6918 +{
6919 + return cmpxchg(&v->counter, old, new);
6920 +}
6921 +
6922 static inline int atomic_xchg(atomic_t *v, int new)
6923 {
6924 return xchg(&v->counter, new);
6925 }
6926
6927 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
6928 +{
6929 + return xchg(&v->counter, new);
6930 +}
6931 +
6932 /**
6933 * atomic_add_unless - add unless the number is already a given value
6934 * @v: pointer of type atomic_t
6935 @@ -231,21 +447,77 @@ static inline int atomic_xchg(atomic_t *
6936 */
6937 static inline int atomic_add_unless(atomic_t *v, int a, int u)
6938 {
6939 - int c, old;
6940 + int c, old, new;
6941 c = atomic_read(v);
6942 for (;;) {
6943 - if (unlikely(c == (u)))
6944 + if (unlikely(c == u))
6945 break;
6946 - old = atomic_cmpxchg((v), c, c + (a));
6947 +
6948 + asm volatile("addl %2,%0\n"
6949 +
6950 +#ifdef CONFIG_PAX_REFCOUNT
6951 + "jno 0f\n"
6952 + "subl %2,%0\n"
6953 + "int $4\n0:\n"
6954 + _ASM_EXTABLE(0b, 0b)
6955 +#endif
6956 +
6957 + : "=r" (new)
6958 + : "0" (c), "ir" (a));
6959 +
6960 + old = atomic_cmpxchg(v, c, new);
6961 if (likely(old == c))
6962 break;
6963 c = old;
6964 }
6965 - return c != (u);
6966 + return c != u;
6967 }
6968
6969 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
6970
6971 +/**
6972 + * atomic_inc_not_zero_hint - increment if not null
6973 + * @v: pointer of type atomic_t
6974 + * @hint: probable value of the atomic before the increment
6975 + *
6976 + * This version of atomic_inc_not_zero() gives a hint of probable
6977 + * value of the atomic. This helps processor to not read the memory
6978 + * before doing the atomic read/modify/write cycle, lowering
6979 + * number of bus transactions on some arches.
6980 + *
6981 + * Returns: 0 if increment was not done, 1 otherwise.
6982 + */
6983 +#define atomic_inc_not_zero_hint atomic_inc_not_zero_hint
6984 +static inline int atomic_inc_not_zero_hint(atomic_t *v, int hint)
6985 +{
6986 + int val, c = hint, new;
6987 +
6988 + /* sanity test, should be removed by compiler if hint is a constant */
6989 + if (!hint)
6990 + return atomic_inc_not_zero(v);
6991 +
6992 + do {
6993 + asm volatile("incl %0\n"
6994 +
6995 +#ifdef CONFIG_PAX_REFCOUNT
6996 + "jno 0f\n"
6997 + "decl %0\n"
6998 + "int $4\n0:\n"
6999 + _ASM_EXTABLE(0b, 0b)
7000 +#endif
7001 +
7002 + : "=r" (new)
7003 + : "0" (c));
7004 +
7005 + val = atomic_cmpxchg(v, c, new);
7006 + if (val == c)
7007 + return 1;
7008 + c = val;
7009 + } while (c);
7010 +
7011 + return 0;
7012 +}
7013 +
7014 /*
7015 * atomic_dec_if_positive - decrement by 1 if old value positive
7016 * @v: pointer of type atomic_t
7017 diff -urNp linux-3.0.9/arch/x86/include/asm/bitops.h linux-3.0.9/arch/x86/include/asm/bitops.h
7018 --- linux-3.0.9/arch/x86/include/asm/bitops.h 2011-11-11 13:12:24.000000000 -0500
7019 +++ linux-3.0.9/arch/x86/include/asm/bitops.h 2011-11-15 20:02:59.000000000 -0500
7020 @@ -38,7 +38,7 @@
7021 * a mask operation on a byte.
7022 */
7023 #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
7024 -#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
7025 +#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
7026 #define CONST_MASK(nr) (1 << ((nr) & 7))
7027
7028 /**
7029 diff -urNp linux-3.0.9/arch/x86/include/asm/boot.h linux-3.0.9/arch/x86/include/asm/boot.h
7030 --- linux-3.0.9/arch/x86/include/asm/boot.h 2011-11-11 13:12:24.000000000 -0500
7031 +++ linux-3.0.9/arch/x86/include/asm/boot.h 2011-11-15 20:02:59.000000000 -0500
7032 @@ -11,10 +11,15 @@
7033 #include <asm/pgtable_types.h>
7034
7035 /* Physical address where kernel should be loaded. */
7036 -#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
7037 +#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
7038 + (CONFIG_PHYSICAL_ALIGN - 1)) \
7039 & ~(CONFIG_PHYSICAL_ALIGN - 1))
7040
7041 +#ifndef __ASSEMBLY__
7042 +extern unsigned char __LOAD_PHYSICAL_ADDR[];
7043 +#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
7044 +#endif
7045 +
7046 /* Minimum kernel alignment, as a power of two */
7047 #ifdef CONFIG_X86_64
7048 #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
7049 diff -urNp linux-3.0.9/arch/x86/include/asm/cacheflush.h linux-3.0.9/arch/x86/include/asm/cacheflush.h
7050 --- linux-3.0.9/arch/x86/include/asm/cacheflush.h 2011-11-11 13:12:24.000000000 -0500
7051 +++ linux-3.0.9/arch/x86/include/asm/cacheflush.h 2011-11-15 20:02:59.000000000 -0500
7052 @@ -26,7 +26,7 @@ static inline unsigned long get_page_mem
7053 unsigned long pg_flags = pg->flags & _PGMT_MASK;
7054
7055 if (pg_flags == _PGMT_DEFAULT)
7056 - return -1;
7057 + return ~0UL;
7058 else if (pg_flags == _PGMT_WC)
7059 return _PAGE_CACHE_WC;
7060 else if (pg_flags == _PGMT_UC_MINUS)
7061 diff -urNp linux-3.0.9/arch/x86/include/asm/cache.h linux-3.0.9/arch/x86/include/asm/cache.h
7062 --- linux-3.0.9/arch/x86/include/asm/cache.h 2011-11-11 13:12:24.000000000 -0500
7063 +++ linux-3.0.9/arch/x86/include/asm/cache.h 2011-11-15 20:02:59.000000000 -0500
7064 @@ -5,12 +5,13 @@
7065
7066 /* L1 cache line size */
7067 #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
7068 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
7069 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
7070
7071 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
7072 +#define __read_only __attribute__((__section__(".data..read_only")))
7073
7074 #define INTERNODE_CACHE_SHIFT CONFIG_X86_INTERNODE_CACHE_SHIFT
7075 -#define INTERNODE_CACHE_BYTES (1 << INTERNODE_CACHE_SHIFT)
7076 +#define INTERNODE_CACHE_BYTES (_AC(1,UL) << INTERNODE_CACHE_SHIFT)
7077
7078 #ifdef CONFIG_X86_VSMP
7079 #ifdef CONFIG_SMP
7080 diff -urNp linux-3.0.9/arch/x86/include/asm/checksum_32.h linux-3.0.9/arch/x86/include/asm/checksum_32.h
7081 --- linux-3.0.9/arch/x86/include/asm/checksum_32.h 2011-11-11 13:12:24.000000000 -0500
7082 +++ linux-3.0.9/arch/x86/include/asm/checksum_32.h 2011-11-15 20:02:59.000000000 -0500
7083 @@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
7084 int len, __wsum sum,
7085 int *src_err_ptr, int *dst_err_ptr);
7086
7087 +asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
7088 + int len, __wsum sum,
7089 + int *src_err_ptr, int *dst_err_ptr);
7090 +
7091 +asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
7092 + int len, __wsum sum,
7093 + int *src_err_ptr, int *dst_err_ptr);
7094 +
7095 /*
7096 * Note: when you get a NULL pointer exception here this means someone
7097 * passed in an incorrect kernel address to one of these functions.
7098 @@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f
7099 int *err_ptr)
7100 {
7101 might_sleep();
7102 - return csum_partial_copy_generic((__force void *)src, dst,
7103 + return csum_partial_copy_generic_from_user((__force void *)src, dst,
7104 len, sum, err_ptr, NULL);
7105 }
7106
7107 @@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us
7108 {
7109 might_sleep();
7110 if (access_ok(VERIFY_WRITE, dst, len))
7111 - return csum_partial_copy_generic(src, (__force void *)dst,
7112 + return csum_partial_copy_generic_to_user(src, (__force void *)dst,
7113 len, sum, NULL, err_ptr);
7114
7115 if (len)
7116 diff -urNp linux-3.0.9/arch/x86/include/asm/cpufeature.h linux-3.0.9/arch/x86/include/asm/cpufeature.h
7117 --- linux-3.0.9/arch/x86/include/asm/cpufeature.h 2011-11-11 13:12:24.000000000 -0500
7118 +++ linux-3.0.9/arch/x86/include/asm/cpufeature.h 2011-11-15 20:02:59.000000000 -0500
7119 @@ -358,7 +358,7 @@ static __always_inline __pure bool __sta
7120 ".section .discard,\"aw\",@progbits\n"
7121 " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
7122 ".previous\n"
7123 - ".section .altinstr_replacement,\"ax\"\n"
7124 + ".section .altinstr_replacement,\"a\"\n"
7125 "3: movb $1,%0\n"
7126 "4:\n"
7127 ".previous\n"
7128 diff -urNp linux-3.0.9/arch/x86/include/asm/desc_defs.h linux-3.0.9/arch/x86/include/asm/desc_defs.h
7129 --- linux-3.0.9/arch/x86/include/asm/desc_defs.h 2011-11-11 13:12:24.000000000 -0500
7130 +++ linux-3.0.9/arch/x86/include/asm/desc_defs.h 2011-11-15 20:02:59.000000000 -0500
7131 @@ -31,6 +31,12 @@ struct desc_struct {
7132 unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
7133 unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
7134 };
7135 + struct {
7136 + u16 offset_low;
7137 + u16 seg;
7138 + unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
7139 + unsigned offset_high: 16;
7140 + } gate;
7141 };
7142 } __attribute__((packed));
7143
7144 diff -urNp linux-3.0.9/arch/x86/include/asm/desc.h linux-3.0.9/arch/x86/include/asm/desc.h
7145 --- linux-3.0.9/arch/x86/include/asm/desc.h 2011-11-11 13:12:24.000000000 -0500
7146 +++ linux-3.0.9/arch/x86/include/asm/desc.h 2011-11-15 20:02:59.000000000 -0500
7147 @@ -4,6 +4,7 @@
7148 #include <asm/desc_defs.h>
7149 #include <asm/ldt.h>
7150 #include <asm/mmu.h>
7151 +#include <asm/pgtable.h>
7152
7153 #include <linux/smp.h>
7154
7155 @@ -16,6 +17,7 @@ static inline void fill_ldt(struct desc_
7156
7157 desc->type = (info->read_exec_only ^ 1) << 1;
7158 desc->type |= info->contents << 2;
7159 + desc->type |= info->seg_not_present ^ 1;
7160
7161 desc->s = 1;
7162 desc->dpl = 0x3;
7163 @@ -34,17 +36,12 @@ static inline void fill_ldt(struct desc_
7164 }
7165
7166 extern struct desc_ptr idt_descr;
7167 -extern gate_desc idt_table[];
7168 -
7169 -struct gdt_page {
7170 - struct desc_struct gdt[GDT_ENTRIES];
7171 -} __attribute__((aligned(PAGE_SIZE)));
7172 -
7173 -DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
7174 +extern gate_desc idt_table[256];
7175
7176 +extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
7177 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
7178 {
7179 - return per_cpu(gdt_page, cpu).gdt;
7180 + return cpu_gdt_table[cpu];
7181 }
7182
7183 #ifdef CONFIG_X86_64
7184 @@ -69,8 +66,14 @@ static inline void pack_gate(gate_desc *
7185 unsigned long base, unsigned dpl, unsigned flags,
7186 unsigned short seg)
7187 {
7188 - gate->a = (seg << 16) | (base & 0xffff);
7189 - gate->b = (base & 0xffff0000) | (((0x80 | type | (dpl << 5)) & 0xff) << 8);
7190 + gate->gate.offset_low = base;
7191 + gate->gate.seg = seg;
7192 + gate->gate.reserved = 0;
7193 + gate->gate.type = type;
7194 + gate->gate.s = 0;
7195 + gate->gate.dpl = dpl;
7196 + gate->gate.p = 1;
7197 + gate->gate.offset_high = base >> 16;
7198 }
7199
7200 #endif
7201 @@ -115,12 +118,16 @@ static inline void paravirt_free_ldt(str
7202
7203 static inline void native_write_idt_entry(gate_desc *idt, int entry, const gate_desc *gate)
7204 {
7205 + pax_open_kernel();
7206 memcpy(&idt[entry], gate, sizeof(*gate));
7207 + pax_close_kernel();
7208 }
7209
7210 static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry, const void *desc)
7211 {
7212 + pax_open_kernel();
7213 memcpy(&ldt[entry], desc, 8);
7214 + pax_close_kernel();
7215 }
7216
7217 static inline void
7218 @@ -134,7 +141,9 @@ native_write_gdt_entry(struct desc_struc
7219 default: size = sizeof(*gdt); break;
7220 }
7221
7222 + pax_open_kernel();
7223 memcpy(&gdt[entry], desc, size);
7224 + pax_close_kernel();
7225 }
7226
7227 static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
7228 @@ -207,7 +216,9 @@ static inline void native_set_ldt(const
7229
7230 static inline void native_load_tr_desc(void)
7231 {
7232 + pax_open_kernel();
7233 asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
7234 + pax_close_kernel();
7235 }
7236
7237 static inline void native_load_gdt(const struct desc_ptr *dtr)
7238 @@ -244,8 +255,10 @@ static inline void native_load_tls(struc
7239 struct desc_struct *gdt = get_cpu_gdt_table(cpu);
7240 unsigned int i;
7241
7242 + pax_open_kernel();
7243 for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
7244 gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
7245 + pax_close_kernel();
7246 }
7247
7248 #define _LDT_empty(info) \
7249 @@ -307,7 +320,7 @@ static inline void set_desc_limit(struct
7250 desc->limit = (limit >> 16) & 0xf;
7251 }
7252
7253 -static inline void _set_gate(int gate, unsigned type, void *addr,
7254 +static inline void _set_gate(int gate, unsigned type, const void *addr,
7255 unsigned dpl, unsigned ist, unsigned seg)
7256 {
7257 gate_desc s;
7258 @@ -326,7 +339,7 @@ static inline void _set_gate(int gate, u
7259 * Pentium F0 0F bugfix can have resulted in the mapped
7260 * IDT being write-protected.
7261 */
7262 -static inline void set_intr_gate(unsigned int n, void *addr)
7263 +static inline void set_intr_gate(unsigned int n, const void *addr)
7264 {
7265 BUG_ON((unsigned)n > 0xFF);
7266 _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
7267 @@ -356,19 +369,19 @@ static inline void alloc_intr_gate(unsig
7268 /*
7269 * This routine sets up an interrupt gate at directory privilege level 3.
7270 */
7271 -static inline void set_system_intr_gate(unsigned int n, void *addr)
7272 +static inline void set_system_intr_gate(unsigned int n, const void *addr)
7273 {
7274 BUG_ON((unsigned)n > 0xFF);
7275 _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
7276 }
7277
7278 -static inline void set_system_trap_gate(unsigned int n, void *addr)
7279 +static inline void set_system_trap_gate(unsigned int n, const void *addr)
7280 {
7281 BUG_ON((unsigned)n > 0xFF);
7282 _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
7283 }
7284
7285 -static inline void set_trap_gate(unsigned int n, void *addr)
7286 +static inline void set_trap_gate(unsigned int n, const void *addr)
7287 {
7288 BUG_ON((unsigned)n > 0xFF);
7289 _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
7290 @@ -377,19 +390,31 @@ static inline void set_trap_gate(unsigne
7291 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
7292 {
7293 BUG_ON((unsigned)n > 0xFF);
7294 - _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
7295 + _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
7296 }
7297
7298 -static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
7299 +static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
7300 {
7301 BUG_ON((unsigned)n > 0xFF);
7302 _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
7303 }
7304
7305 -static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
7306 +static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
7307 {
7308 BUG_ON((unsigned)n > 0xFF);
7309 _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
7310 }
7311
7312 +#ifdef CONFIG_X86_32
7313 +static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
7314 +{
7315 + struct desc_struct d;
7316 +
7317 + if (likely(limit))
7318 + limit = (limit - 1UL) >> PAGE_SHIFT;
7319 + pack_descriptor(&d, base, limit, 0xFB, 0xC);
7320 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
7321 +}
7322 +#endif
7323 +
7324 #endif /* _ASM_X86_DESC_H */
7325 diff -urNp linux-3.0.9/arch/x86/include/asm/e820.h linux-3.0.9/arch/x86/include/asm/e820.h
7326 --- linux-3.0.9/arch/x86/include/asm/e820.h 2011-11-11 13:12:24.000000000 -0500
7327 +++ linux-3.0.9/arch/x86/include/asm/e820.h 2011-11-15 20:02:59.000000000 -0500
7328 @@ -69,7 +69,7 @@ struct e820map {
7329 #define ISA_START_ADDRESS 0xa0000
7330 #define ISA_END_ADDRESS 0x100000
7331
7332 -#define BIOS_BEGIN 0x000a0000
7333 +#define BIOS_BEGIN 0x000c0000
7334 #define BIOS_END 0x00100000
7335
7336 #define BIOS_ROM_BASE 0xffe00000
7337 diff -urNp linux-3.0.9/arch/x86/include/asm/elf.h linux-3.0.9/arch/x86/include/asm/elf.h
7338 --- linux-3.0.9/arch/x86/include/asm/elf.h 2011-11-11 13:12:24.000000000 -0500
7339 +++ linux-3.0.9/arch/x86/include/asm/elf.h 2011-11-15 20:02:59.000000000 -0500
7340 @@ -237,7 +237,25 @@ extern int force_personality32;
7341 the loader. We need to make sure that it is out of the way of the program
7342 that it will "exec", and that there is sufficient room for the brk. */
7343
7344 +#ifdef CONFIG_PAX_SEGMEXEC
7345 +#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
7346 +#else
7347 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
7348 +#endif
7349 +
7350 +#ifdef CONFIG_PAX_ASLR
7351 +#ifdef CONFIG_X86_32
7352 +#define PAX_ELF_ET_DYN_BASE 0x10000000UL
7353 +
7354 +#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
7355 +#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
7356 +#else
7357 +#define PAX_ELF_ET_DYN_BASE 0x400000UL
7358 +
7359 +#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
7360 +#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
7361 +#endif
7362 +#endif
7363
7364 /* This yields a mask that user programs can use to figure out what
7365 instruction set this CPU supports. This could be done in user space,
7366 @@ -290,9 +308,7 @@ do { \
7367
7368 #define ARCH_DLINFO \
7369 do { \
7370 - if (vdso_enabled) \
7371 - NEW_AUX_ENT(AT_SYSINFO_EHDR, \
7372 - (unsigned long)current->mm->context.vdso); \
7373 + NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso); \
7374 } while (0)
7375
7376 #define AT_SYSINFO 32
7377 @@ -303,7 +319,7 @@ do { \
7378
7379 #endif /* !CONFIG_X86_32 */
7380
7381 -#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
7382 +#define VDSO_CURRENT_BASE (current->mm->context.vdso)
7383
7384 #define VDSO_ENTRY \
7385 ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
7386 @@ -317,7 +333,4 @@ extern int arch_setup_additional_pages(s
7387 extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
7388 #define compat_arch_setup_additional_pages syscall32_setup_pages
7389
7390 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
7391 -#define arch_randomize_brk arch_randomize_brk
7392 -
7393 #endif /* _ASM_X86_ELF_H */
7394 diff -urNp linux-3.0.9/arch/x86/include/asm/emergency-restart.h linux-3.0.9/arch/x86/include/asm/emergency-restart.h
7395 --- linux-3.0.9/arch/x86/include/asm/emergency-restart.h 2011-11-11 13:12:24.000000000 -0500
7396 +++ linux-3.0.9/arch/x86/include/asm/emergency-restart.h 2011-11-15 20:02:59.000000000 -0500
7397 @@ -15,6 +15,6 @@ enum reboot_type {
7398
7399 extern enum reboot_type reboot_type;
7400
7401 -extern void machine_emergency_restart(void);
7402 +extern void machine_emergency_restart(void) __noreturn;
7403
7404 #endif /* _ASM_X86_EMERGENCY_RESTART_H */
7405 diff -urNp linux-3.0.9/arch/x86/include/asm/futex.h linux-3.0.9/arch/x86/include/asm/futex.h
7406 --- linux-3.0.9/arch/x86/include/asm/futex.h 2011-11-11 13:12:24.000000000 -0500
7407 +++ linux-3.0.9/arch/x86/include/asm/futex.h 2011-11-15 20:02:59.000000000 -0500
7408 @@ -12,16 +12,18 @@
7409 #include <asm/system.h>
7410
7411 #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
7412 + typecheck(u32 __user *, uaddr); \
7413 asm volatile("1:\t" insn "\n" \
7414 "2:\t.section .fixup,\"ax\"\n" \
7415 "3:\tmov\t%3, %1\n" \
7416 "\tjmp\t2b\n" \
7417 "\t.previous\n" \
7418 _ASM_EXTABLE(1b, 3b) \
7419 - : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
7420 + : "=r" (oldval), "=r" (ret), "+m" (*(u32 __user *)____m(uaddr))\
7421 : "i" (-EFAULT), "0" (oparg), "1" (0))
7422
7423 #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
7424 + typecheck(u32 __user *, uaddr); \
7425 asm volatile("1:\tmovl %2, %0\n" \
7426 "\tmovl\t%0, %3\n" \
7427 "\t" insn "\n" \
7428 @@ -34,7 +36,7 @@
7429 _ASM_EXTABLE(1b, 4b) \
7430 _ASM_EXTABLE(2b, 4b) \
7431 : "=&a" (oldval), "=&r" (ret), \
7432 - "+m" (*uaddr), "=&r" (tem) \
7433 + "+m" (*(u32 __user *)____m(uaddr)), "=&r" (tem) \
7434 : "r" (oparg), "i" (-EFAULT), "1" (0))
7435
7436 static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
7437 @@ -61,10 +63,10 @@ static inline int futex_atomic_op_inuser
7438
7439 switch (op) {
7440 case FUTEX_OP_SET:
7441 - __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
7442 + __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
7443 break;
7444 case FUTEX_OP_ADD:
7445 - __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
7446 + __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
7447 uaddr, oparg);
7448 break;
7449 case FUTEX_OP_OR:
7450 @@ -123,13 +125,13 @@ static inline int futex_atomic_cmpxchg_i
7451 if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
7452 return -EFAULT;
7453
7454 - asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %4, %2\n"
7455 + asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %4, %2\n"
7456 "2:\t.section .fixup, \"ax\"\n"
7457 "3:\tmov %3, %0\n"
7458 "\tjmp 2b\n"
7459 "\t.previous\n"
7460 _ASM_EXTABLE(1b, 3b)
7461 - : "+r" (ret), "=a" (oldval), "+m" (*uaddr)
7462 + : "+r" (ret), "=a" (oldval), "+m" (*(u32 __user *)____m(uaddr))
7463 : "i" (-EFAULT), "r" (newval), "1" (oldval)
7464 : "memory"
7465 );
7466 diff -urNp linux-3.0.9/arch/x86/include/asm/hw_irq.h linux-3.0.9/arch/x86/include/asm/hw_irq.h
7467 --- linux-3.0.9/arch/x86/include/asm/hw_irq.h 2011-11-11 13:12:24.000000000 -0500
7468 +++ linux-3.0.9/arch/x86/include/asm/hw_irq.h 2011-11-15 20:02:59.000000000 -0500
7469 @@ -137,8 +137,8 @@ extern void setup_ioapic_dest(void);
7470 extern void enable_IO_APIC(void);
7471
7472 /* Statistics */
7473 -extern atomic_t irq_err_count;
7474 -extern atomic_t irq_mis_count;
7475 +extern atomic_unchecked_t irq_err_count;
7476 +extern atomic_unchecked_t irq_mis_count;
7477
7478 /* EISA */
7479 extern void eisa_set_level_irq(unsigned int irq);
7480 diff -urNp linux-3.0.9/arch/x86/include/asm/i387.h linux-3.0.9/arch/x86/include/asm/i387.h
7481 --- linux-3.0.9/arch/x86/include/asm/i387.h 2011-11-11 13:12:24.000000000 -0500
7482 +++ linux-3.0.9/arch/x86/include/asm/i387.h 2011-11-15 20:02:59.000000000 -0500
7483 @@ -92,6 +92,11 @@ static inline int fxrstor_checking(struc
7484 {
7485 int err;
7486
7487 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
7488 + if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
7489 + fx = (struct i387_fxsave_struct __user *)((void *)fx + PAX_USER_SHADOW_BASE);
7490 +#endif
7491 +
7492 /* See comment in fxsave() below. */
7493 #ifdef CONFIG_AS_FXSAVEQ
7494 asm volatile("1: fxrstorq %[fx]\n\t"
7495 @@ -121,6 +126,11 @@ static inline int fxsave_user(struct i38
7496 {
7497 int err;
7498
7499 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
7500 + if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
7501 + fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
7502 +#endif
7503 +
7504 /*
7505 * Clear the bytes not touched by the fxsave and reserved
7506 * for the SW usage.
7507 @@ -213,13 +223,8 @@ static inline void fpu_fxsave(struct fpu
7508 #endif /* CONFIG_X86_64 */
7509
7510 /* We need a safe address that is cheap to find and that is already
7511 - in L1 during context switch. The best choices are unfortunately
7512 - different for UP and SMP */
7513 -#ifdef CONFIG_SMP
7514 -#define safe_address (__per_cpu_offset[0])
7515 -#else
7516 -#define safe_address (kstat_cpu(0).cpustat.user)
7517 -#endif
7518 + in L1 during context switch. */
7519 +#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
7520
7521 /*
7522 * These must be called with preempt disabled
7523 @@ -312,7 +317,7 @@ static inline void kernel_fpu_begin(void
7524 struct thread_info *me = current_thread_info();
7525 preempt_disable();
7526 if (me->status & TS_USEDFPU)
7527 - __save_init_fpu(me->task);
7528 + __save_init_fpu(current);
7529 else
7530 clts();
7531 }
7532 diff -urNp linux-3.0.9/arch/x86/include/asm/io.h linux-3.0.9/arch/x86/include/asm/io.h
7533 --- linux-3.0.9/arch/x86/include/asm/io.h 2011-11-11 13:12:24.000000000 -0500
7534 +++ linux-3.0.9/arch/x86/include/asm/io.h 2011-11-15 20:02:59.000000000 -0500
7535 @@ -196,6 +196,17 @@ extern void set_iounmap_nonlazy(void);
7536
7537 #include <linux/vmalloc.h>
7538
7539 +#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
7540 +static inline int valid_phys_addr_range(unsigned long addr, size_t count)
7541 +{
7542 + return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
7543 +}
7544 +
7545 +static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
7546 +{
7547 + return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
7548 +}
7549 +
7550 /*
7551 * Convert a virtual cached pointer to an uncached pointer
7552 */
7553 diff -urNp linux-3.0.9/arch/x86/include/asm/irqflags.h linux-3.0.9/arch/x86/include/asm/irqflags.h
7554 --- linux-3.0.9/arch/x86/include/asm/irqflags.h 2011-11-11 13:12:24.000000000 -0500
7555 +++ linux-3.0.9/arch/x86/include/asm/irqflags.h 2011-11-15 20:02:59.000000000 -0500
7556 @@ -140,6 +140,11 @@ static inline unsigned long arch_local_i
7557 sti; \
7558 sysexit
7559
7560 +#define GET_CR0_INTO_RDI mov %cr0, %rdi
7561 +#define SET_RDI_INTO_CR0 mov %rdi, %cr0
7562 +#define GET_CR3_INTO_RDI mov %cr3, %rdi
7563 +#define SET_RDI_INTO_CR3 mov %rdi, %cr3
7564 +
7565 #else
7566 #define INTERRUPT_RETURN iret
7567 #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
7568 diff -urNp linux-3.0.9/arch/x86/include/asm/kprobes.h linux-3.0.9/arch/x86/include/asm/kprobes.h
7569 --- linux-3.0.9/arch/x86/include/asm/kprobes.h 2011-11-11 13:12:24.000000000 -0500
7570 +++ linux-3.0.9/arch/x86/include/asm/kprobes.h 2011-11-15 20:02:59.000000000 -0500
7571 @@ -37,13 +37,8 @@ typedef u8 kprobe_opcode_t;
7572 #define RELATIVEJUMP_SIZE 5
7573 #define RELATIVECALL_OPCODE 0xe8
7574 #define RELATIVE_ADDR_SIZE 4
7575 -#define MAX_STACK_SIZE 64
7576 -#define MIN_STACK_SIZE(ADDR) \
7577 - (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
7578 - THREAD_SIZE - (unsigned long)(ADDR))) \
7579 - ? (MAX_STACK_SIZE) \
7580 - : (((unsigned long)current_thread_info()) + \
7581 - THREAD_SIZE - (unsigned long)(ADDR)))
7582 +#define MAX_STACK_SIZE 64UL
7583 +#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
7584
7585 #define flush_insn_slot(p) do { } while (0)
7586
7587 diff -urNp linux-3.0.9/arch/x86/include/asm/kvm_host.h linux-3.0.9/arch/x86/include/asm/kvm_host.h
7588 --- linux-3.0.9/arch/x86/include/asm/kvm_host.h 2011-11-11 13:12:24.000000000 -0500
7589 +++ linux-3.0.9/arch/x86/include/asm/kvm_host.h 2011-11-15 20:02:59.000000000 -0500
7590 @@ -441,7 +441,7 @@ struct kvm_arch {
7591 unsigned int n_used_mmu_pages;
7592 unsigned int n_requested_mmu_pages;
7593 unsigned int n_max_mmu_pages;
7594 - atomic_t invlpg_counter;
7595 + atomic_unchecked_t invlpg_counter;
7596 struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES];
7597 /*
7598 * Hash table of struct kvm_mmu_page.
7599 @@ -619,7 +619,7 @@ struct kvm_x86_ops {
7600 enum x86_intercept_stage stage);
7601
7602 const struct trace_print_flags *exit_reasons_str;
7603 -};
7604 +} __do_const;
7605
7606 struct kvm_arch_async_pf {
7607 u32 token;
7608 diff -urNp linux-3.0.9/arch/x86/include/asm/local.h linux-3.0.9/arch/x86/include/asm/local.h
7609 --- linux-3.0.9/arch/x86/include/asm/local.h 2011-11-11 13:12:24.000000000 -0500
7610 +++ linux-3.0.9/arch/x86/include/asm/local.h 2011-11-15 20:02:59.000000000 -0500
7611 @@ -18,26 +18,58 @@ typedef struct {
7612
7613 static inline void local_inc(local_t *l)
7614 {
7615 - asm volatile(_ASM_INC "%0"
7616 + asm volatile(_ASM_INC "%0\n"
7617 +
7618 +#ifdef CONFIG_PAX_REFCOUNT
7619 + "jno 0f\n"
7620 + _ASM_DEC "%0\n"
7621 + "int $4\n0:\n"
7622 + _ASM_EXTABLE(0b, 0b)
7623 +#endif
7624 +
7625 : "+m" (l->a.counter));
7626 }
7627
7628 static inline void local_dec(local_t *l)
7629 {
7630 - asm volatile(_ASM_DEC "%0"
7631 + asm volatile(_ASM_DEC "%0\n"
7632 +
7633 +#ifdef CONFIG_PAX_REFCOUNT
7634 + "jno 0f\n"
7635 + _ASM_INC "%0\n"
7636 + "int $4\n0:\n"
7637 + _ASM_EXTABLE(0b, 0b)
7638 +#endif
7639 +
7640 : "+m" (l->a.counter));
7641 }
7642
7643 static inline void local_add(long i, local_t *l)
7644 {
7645 - asm volatile(_ASM_ADD "%1,%0"
7646 + asm volatile(_ASM_ADD "%1,%0\n"
7647 +
7648 +#ifdef CONFIG_PAX_REFCOUNT
7649 + "jno 0f\n"
7650 + _ASM_SUB "%1,%0\n"
7651 + "int $4\n0:\n"
7652 + _ASM_EXTABLE(0b, 0b)
7653 +#endif
7654 +
7655 : "+m" (l->a.counter)
7656 : "ir" (i));
7657 }
7658
7659 static inline void local_sub(long i, local_t *l)
7660 {
7661 - asm volatile(_ASM_SUB "%1,%0"
7662 + asm volatile(_ASM_SUB "%1,%0\n"
7663 +
7664 +#ifdef CONFIG_PAX_REFCOUNT
7665 + "jno 0f\n"
7666 + _ASM_ADD "%1,%0\n"
7667 + "int $4\n0:\n"
7668 + _ASM_EXTABLE(0b, 0b)
7669 +#endif
7670 +
7671 : "+m" (l->a.counter)
7672 : "ir" (i));
7673 }
7674 @@ -55,7 +87,16 @@ static inline int local_sub_and_test(lon
7675 {
7676 unsigned char c;
7677
7678 - asm volatile(_ASM_SUB "%2,%0; sete %1"
7679 + asm volatile(_ASM_SUB "%2,%0\n"
7680 +
7681 +#ifdef CONFIG_PAX_REFCOUNT
7682 + "jno 0f\n"
7683 + _ASM_ADD "%2,%0\n"
7684 + "int $4\n0:\n"
7685 + _ASM_EXTABLE(0b, 0b)
7686 +#endif
7687 +
7688 + "sete %1\n"
7689 : "+m" (l->a.counter), "=qm" (c)
7690 : "ir" (i) : "memory");
7691 return c;
7692 @@ -73,7 +114,16 @@ static inline int local_dec_and_test(loc
7693 {
7694 unsigned char c;
7695
7696 - asm volatile(_ASM_DEC "%0; sete %1"
7697 + asm volatile(_ASM_DEC "%0\n"
7698 +
7699 +#ifdef CONFIG_PAX_REFCOUNT
7700 + "jno 0f\n"
7701 + _ASM_INC "%0\n"
7702 + "int $4\n0:\n"
7703 + _ASM_EXTABLE(0b, 0b)
7704 +#endif
7705 +
7706 + "sete %1\n"
7707 : "+m" (l->a.counter), "=qm" (c)
7708 : : "memory");
7709 return c != 0;
7710 @@ -91,7 +141,16 @@ static inline int local_inc_and_test(loc
7711 {
7712 unsigned char c;
7713
7714 - asm volatile(_ASM_INC "%0; sete %1"
7715 + asm volatile(_ASM_INC "%0\n"
7716 +
7717 +#ifdef CONFIG_PAX_REFCOUNT
7718 + "jno 0f\n"
7719 + _ASM_DEC "%0\n"
7720 + "int $4\n0:\n"
7721 + _ASM_EXTABLE(0b, 0b)
7722 +#endif
7723 +
7724 + "sete %1\n"
7725 : "+m" (l->a.counter), "=qm" (c)
7726 : : "memory");
7727 return c != 0;
7728 @@ -110,7 +169,16 @@ static inline int local_add_negative(lon
7729 {
7730 unsigned char c;
7731
7732 - asm volatile(_ASM_ADD "%2,%0; sets %1"
7733 + asm volatile(_ASM_ADD "%2,%0\n"
7734 +
7735 +#ifdef CONFIG_PAX_REFCOUNT
7736 + "jno 0f\n"
7737 + _ASM_SUB "%2,%0\n"
7738 + "int $4\n0:\n"
7739 + _ASM_EXTABLE(0b, 0b)
7740 +#endif
7741 +
7742 + "sets %1\n"
7743 : "+m" (l->a.counter), "=qm" (c)
7744 : "ir" (i) : "memory");
7745 return c;
7746 @@ -133,7 +201,15 @@ static inline long local_add_return(long
7747 #endif
7748 /* Modern 486+ processor */
7749 __i = i;
7750 - asm volatile(_ASM_XADD "%0, %1;"
7751 + asm volatile(_ASM_XADD "%0, %1\n"
7752 +
7753 +#ifdef CONFIG_PAX_REFCOUNT
7754 + "jno 0f\n"
7755 + _ASM_MOV "%0,%1\n"
7756 + "int $4\n0:\n"
7757 + _ASM_EXTABLE(0b, 0b)
7758 +#endif
7759 +
7760 : "+r" (i), "+m" (l->a.counter)
7761 : : "memory");
7762 return i + __i;
7763 diff -urNp linux-3.0.9/arch/x86/include/asm/mman.h linux-3.0.9/arch/x86/include/asm/mman.h
7764 --- linux-3.0.9/arch/x86/include/asm/mman.h 2011-11-11 13:12:24.000000000 -0500
7765 +++ linux-3.0.9/arch/x86/include/asm/mman.h 2011-11-15 20:02:59.000000000 -0500
7766 @@ -5,4 +5,14 @@
7767
7768 #include <asm-generic/mman.h>
7769
7770 +#ifdef __KERNEL__
7771 +#ifndef __ASSEMBLY__
7772 +#ifdef CONFIG_X86_32
7773 +#define arch_mmap_check i386_mmap_check
7774 +int i386_mmap_check(unsigned long addr, unsigned long len,
7775 + unsigned long flags);
7776 +#endif
7777 +#endif
7778 +#endif
7779 +
7780 #endif /* _ASM_X86_MMAN_H */
7781 diff -urNp linux-3.0.9/arch/x86/include/asm/mmu_context.h linux-3.0.9/arch/x86/include/asm/mmu_context.h
7782 --- linux-3.0.9/arch/x86/include/asm/mmu_context.h 2011-11-11 13:12:24.000000000 -0500
7783 +++ linux-3.0.9/arch/x86/include/asm/mmu_context.h 2011-11-15 20:02:59.000000000 -0500
7784 @@ -24,6 +24,18 @@ void destroy_context(struct mm_struct *m
7785
7786 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
7787 {
7788 +
7789 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
7790 + unsigned int i;
7791 + pgd_t *pgd;
7792 +
7793 + pax_open_kernel();
7794 + pgd = get_cpu_pgd(smp_processor_id());
7795 + for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
7796 + set_pgd_batched(pgd+i, native_make_pgd(0));
7797 + pax_close_kernel();
7798 +#endif
7799 +
7800 #ifdef CONFIG_SMP
7801 if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
7802 percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
7803 @@ -34,16 +46,30 @@ static inline void switch_mm(struct mm_s
7804 struct task_struct *tsk)
7805 {
7806 unsigned cpu = smp_processor_id();
7807 +#if defined(CONFIG_X86_32) && defined(CONFIG_SMP) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
7808 + int tlbstate = TLBSTATE_OK;
7809 +#endif
7810
7811 if (likely(prev != next)) {
7812 #ifdef CONFIG_SMP
7813 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
7814 + tlbstate = percpu_read(cpu_tlbstate.state);
7815 +#endif
7816 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
7817 percpu_write(cpu_tlbstate.active_mm, next);
7818 #endif
7819 cpumask_set_cpu(cpu, mm_cpumask(next));
7820
7821 /* Re-load page tables */
7822 +#ifdef CONFIG_PAX_PER_CPU_PGD
7823 + pax_open_kernel();
7824 + __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
7825 + __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
7826 + pax_close_kernel();
7827 + load_cr3(get_cpu_pgd(cpu));
7828 +#else
7829 load_cr3(next->pgd);
7830 +#endif
7831
7832 /* stop flush ipis for the previous mm */
7833 cpumask_clear_cpu(cpu, mm_cpumask(prev));
7834 @@ -53,9 +79,38 @@ static inline void switch_mm(struct mm_s
7835 */
7836 if (unlikely(prev->context.ldt != next->context.ldt))
7837 load_LDT_nolock(&next->context);
7838 - }
7839 +
7840 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
7841 + if (!(__supported_pte_mask & _PAGE_NX)) {
7842 + smp_mb__before_clear_bit();
7843 + cpu_clear(cpu, prev->context.cpu_user_cs_mask);
7844 + smp_mb__after_clear_bit();
7845 + cpu_set(cpu, next->context.cpu_user_cs_mask);
7846 + }
7847 +#endif
7848 +
7849 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
7850 + if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
7851 + prev->context.user_cs_limit != next->context.user_cs_limit))
7852 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
7853 #ifdef CONFIG_SMP
7854 + else if (unlikely(tlbstate != TLBSTATE_OK))
7855 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
7856 +#endif
7857 +#endif
7858 +
7859 + }
7860 else {
7861 +
7862 +#ifdef CONFIG_PAX_PER_CPU_PGD
7863 + pax_open_kernel();
7864 + __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
7865 + __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
7866 + pax_close_kernel();
7867 + load_cr3(get_cpu_pgd(cpu));
7868 +#endif
7869 +
7870 +#ifdef CONFIG_SMP
7871 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
7872 BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
7873
7874 @@ -64,11 +119,28 @@ static inline void switch_mm(struct mm_s
7875 * tlb flush IPI delivery. We must reload CR3
7876 * to make sure to use no freed page tables.
7877 */
7878 +
7879 +#ifndef CONFIG_PAX_PER_CPU_PGD
7880 load_cr3(next->pgd);
7881 +#endif
7882 +
7883 load_LDT_nolock(&next->context);
7884 +
7885 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
7886 + if (!(__supported_pte_mask & _PAGE_NX))
7887 + cpu_set(cpu, next->context.cpu_user_cs_mask);
7888 +#endif
7889 +
7890 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
7891 +#ifdef CONFIG_PAX_PAGEEXEC
7892 + if (!((next->pax_flags & MF_PAX_PAGEEXEC) && (__supported_pte_mask & _PAGE_NX)))
7893 +#endif
7894 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
7895 +#endif
7896 +
7897 }
7898 - }
7899 #endif
7900 + }
7901 }
7902
7903 #define activate_mm(prev, next) \
7904 diff -urNp linux-3.0.9/arch/x86/include/asm/mmu.h linux-3.0.9/arch/x86/include/asm/mmu.h
7905 --- linux-3.0.9/arch/x86/include/asm/mmu.h 2011-11-11 13:12:24.000000000 -0500
7906 +++ linux-3.0.9/arch/x86/include/asm/mmu.h 2011-11-15 20:02:59.000000000 -0500
7907 @@ -9,7 +9,7 @@
7908 * we put the segment information here.
7909 */
7910 typedef struct {
7911 - void *ldt;
7912 + struct desc_struct *ldt;
7913 int size;
7914
7915 #ifdef CONFIG_X86_64
7916 @@ -18,7 +18,19 @@ typedef struct {
7917 #endif
7918
7919 struct mutex lock;
7920 - void *vdso;
7921 + unsigned long vdso;
7922 +
7923 +#ifdef CONFIG_X86_32
7924 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
7925 + unsigned long user_cs_base;
7926 + unsigned long user_cs_limit;
7927 +
7928 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
7929 + cpumask_t cpu_user_cs_mask;
7930 +#endif
7931 +
7932 +#endif
7933 +#endif
7934 } mm_context_t;
7935
7936 #ifdef CONFIG_SMP
7937 diff -urNp linux-3.0.9/arch/x86/include/asm/module.h linux-3.0.9/arch/x86/include/asm/module.h
7938 --- linux-3.0.9/arch/x86/include/asm/module.h 2011-11-11 13:12:24.000000000 -0500
7939 +++ linux-3.0.9/arch/x86/include/asm/module.h 2011-11-15 20:02:59.000000000 -0500
7940 @@ -5,6 +5,7 @@
7941
7942 #ifdef CONFIG_X86_64
7943 /* X86_64 does not define MODULE_PROC_FAMILY */
7944 +#define MODULE_PROC_FAMILY ""
7945 #elif defined CONFIG_M386
7946 #define MODULE_PROC_FAMILY "386 "
7947 #elif defined CONFIG_M486
7948 @@ -59,8 +60,18 @@
7949 #error unknown processor family
7950 #endif
7951
7952 -#ifdef CONFIG_X86_32
7953 -# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY
7954 +#ifdef CONFIG_PAX_KERNEXEC
7955 +#define MODULE_PAX_KERNEXEC "KERNEXEC "
7956 +#else
7957 +#define MODULE_PAX_KERNEXEC ""
7958 #endif
7959
7960 +#ifdef CONFIG_PAX_MEMORY_UDEREF
7961 +#define MODULE_PAX_UDEREF "UDEREF "
7962 +#else
7963 +#define MODULE_PAX_UDEREF ""
7964 +#endif
7965 +
7966 +#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
7967 +
7968 #endif /* _ASM_X86_MODULE_H */
7969 diff -urNp linux-3.0.9/arch/x86/include/asm/page_64_types.h linux-3.0.9/arch/x86/include/asm/page_64_types.h
7970 --- linux-3.0.9/arch/x86/include/asm/page_64_types.h 2011-11-11 13:12:24.000000000 -0500
7971 +++ linux-3.0.9/arch/x86/include/asm/page_64_types.h 2011-11-15 20:02:59.000000000 -0500
7972 @@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
7973
7974 /* duplicated to the one in bootmem.h */
7975 extern unsigned long max_pfn;
7976 -extern unsigned long phys_base;
7977 +extern const unsigned long phys_base;
7978
7979 extern unsigned long __phys_addr(unsigned long);
7980 #define __phys_reloc_hide(x) (x)
7981 diff -urNp linux-3.0.9/arch/x86/include/asm/paravirt.h linux-3.0.9/arch/x86/include/asm/paravirt.h
7982 --- linux-3.0.9/arch/x86/include/asm/paravirt.h 2011-11-11 13:12:24.000000000 -0500
7983 +++ linux-3.0.9/arch/x86/include/asm/paravirt.h 2011-11-15 20:02:59.000000000 -0500
7984 @@ -658,6 +658,18 @@ static inline void set_pgd(pgd_t *pgdp,
7985 val);
7986 }
7987
7988 +static inline void set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
7989 +{
7990 + pgdval_t val = native_pgd_val(pgd);
7991 +
7992 + if (sizeof(pgdval_t) > sizeof(long))
7993 + PVOP_VCALL3(pv_mmu_ops.set_pgd_batched, pgdp,
7994 + val, (u64)val >> 32);
7995 + else
7996 + PVOP_VCALL2(pv_mmu_ops.set_pgd_batched, pgdp,
7997 + val);
7998 +}
7999 +
8000 static inline void pgd_clear(pgd_t *pgdp)
8001 {
8002 set_pgd(pgdp, __pgd(0));
8003 @@ -739,6 +751,21 @@ static inline void __set_fixmap(unsigned
8004 pv_mmu_ops.set_fixmap(idx, phys, flags);
8005 }
8006
8007 +#ifdef CONFIG_PAX_KERNEXEC
8008 +static inline unsigned long pax_open_kernel(void)
8009 +{
8010 + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
8011 +}
8012 +
8013 +static inline unsigned long pax_close_kernel(void)
8014 +{
8015 + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
8016 +}
8017 +#else
8018 +static inline unsigned long pax_open_kernel(void) { return 0; }
8019 +static inline unsigned long pax_close_kernel(void) { return 0; }
8020 +#endif
8021 +
8022 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
8023
8024 static inline int arch_spin_is_locked(struct arch_spinlock *lock)
8025 @@ -955,7 +982,7 @@ extern void default_banner(void);
8026
8027 #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
8028 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
8029 -#define PARA_INDIRECT(addr) *%cs:addr
8030 +#define PARA_INDIRECT(addr) *%ss:addr
8031 #endif
8032
8033 #define INTERRUPT_RETURN \
8034 @@ -1032,6 +1059,21 @@ extern void default_banner(void);
8035 PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
8036 CLBR_NONE, \
8037 jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
8038 +
8039 +#define GET_CR0_INTO_RDI \
8040 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
8041 + mov %rax,%rdi
8042 +
8043 +#define SET_RDI_INTO_CR0 \
8044 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
8045 +
8046 +#define GET_CR3_INTO_RDI \
8047 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
8048 + mov %rax,%rdi
8049 +
8050 +#define SET_RDI_INTO_CR3 \
8051 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
8052 +
8053 #endif /* CONFIG_X86_32 */
8054
8055 #endif /* __ASSEMBLY__ */
8056 diff -urNp linux-3.0.9/arch/x86/include/asm/paravirt_types.h linux-3.0.9/arch/x86/include/asm/paravirt_types.h
8057 --- linux-3.0.9/arch/x86/include/asm/paravirt_types.h 2011-11-11 13:12:24.000000000 -0500
8058 +++ linux-3.0.9/arch/x86/include/asm/paravirt_types.h 2011-11-15 20:02:59.000000000 -0500
8059 @@ -78,19 +78,19 @@ struct pv_init_ops {
8060 */
8061 unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
8062 unsigned long addr, unsigned len);
8063 -};
8064 +} __no_const;
8065
8066
8067 struct pv_lazy_ops {
8068 /* Set deferred update mode, used for batching operations. */
8069 void (*enter)(void);
8070 void (*leave)(void);
8071 -};
8072 +} __no_const;
8073
8074 struct pv_time_ops {
8075 unsigned long long (*sched_clock)(void);
8076 unsigned long (*get_tsc_khz)(void);
8077 -};
8078 +} __no_const;
8079
8080 struct pv_cpu_ops {
8081 /* hooks for various privileged instructions */
8082 @@ -186,7 +186,7 @@ struct pv_cpu_ops {
8083
8084 void (*start_context_switch)(struct task_struct *prev);
8085 void (*end_context_switch)(struct task_struct *next);
8086 -};
8087 +} __no_const;
8088
8089 struct pv_irq_ops {
8090 /*
8091 @@ -217,7 +217,7 @@ struct pv_apic_ops {
8092 unsigned long start_eip,
8093 unsigned long start_esp);
8094 #endif
8095 -};
8096 +} __no_const;
8097
8098 struct pv_mmu_ops {
8099 unsigned long (*read_cr2)(void);
8100 @@ -306,6 +306,7 @@ struct pv_mmu_ops {
8101 struct paravirt_callee_save make_pud;
8102
8103 void (*set_pgd)(pgd_t *pudp, pgd_t pgdval);
8104 + void (*set_pgd_batched)(pgd_t *pudp, pgd_t pgdval);
8105 #endif /* PAGETABLE_LEVELS == 4 */
8106 #endif /* PAGETABLE_LEVELS >= 3 */
8107
8108 @@ -317,6 +318,12 @@ struct pv_mmu_ops {
8109 an mfn. We can tell which is which from the index. */
8110 void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
8111 phys_addr_t phys, pgprot_t flags);
8112 +
8113 +#ifdef CONFIG_PAX_KERNEXEC
8114 + unsigned long (*pax_open_kernel)(void);
8115 + unsigned long (*pax_close_kernel)(void);
8116 +#endif
8117 +
8118 };
8119
8120 struct arch_spinlock;
8121 @@ -327,7 +334,7 @@ struct pv_lock_ops {
8122 void (*spin_lock_flags)(struct arch_spinlock *lock, unsigned long flags);
8123 int (*spin_trylock)(struct arch_spinlock *lock);
8124 void (*spin_unlock)(struct arch_spinlock *lock);
8125 -};
8126 +} __no_const;
8127
8128 /* This contains all the paravirt structures: we get a convenient
8129 * number for each function using the offset which we use to indicate
8130 diff -urNp linux-3.0.9/arch/x86/include/asm/pgalloc.h linux-3.0.9/arch/x86/include/asm/pgalloc.h
8131 --- linux-3.0.9/arch/x86/include/asm/pgalloc.h 2011-11-11 13:12:24.000000000 -0500
8132 +++ linux-3.0.9/arch/x86/include/asm/pgalloc.h 2011-11-15 20:02:59.000000000 -0500
8133 @@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
8134 pmd_t *pmd, pte_t *pte)
8135 {
8136 paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
8137 + set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
8138 +}
8139 +
8140 +static inline void pmd_populate_user(struct mm_struct *mm,
8141 + pmd_t *pmd, pte_t *pte)
8142 +{
8143 + paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
8144 set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
8145 }
8146
8147 diff -urNp linux-3.0.9/arch/x86/include/asm/pgtable-2level.h linux-3.0.9/arch/x86/include/asm/pgtable-2level.h
8148 --- linux-3.0.9/arch/x86/include/asm/pgtable-2level.h 2011-11-11 13:12:24.000000000 -0500
8149 +++ linux-3.0.9/arch/x86/include/asm/pgtable-2level.h 2011-11-15 20:02:59.000000000 -0500
8150 @@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t
8151
8152 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
8153 {
8154 + pax_open_kernel();
8155 *pmdp = pmd;
8156 + pax_close_kernel();
8157 }
8158
8159 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
8160 diff -urNp linux-3.0.9/arch/x86/include/asm/pgtable_32.h linux-3.0.9/arch/x86/include/asm/pgtable_32.h
8161 --- linux-3.0.9/arch/x86/include/asm/pgtable_32.h 2011-11-11 13:12:24.000000000 -0500
8162 +++ linux-3.0.9/arch/x86/include/asm/pgtable_32.h 2011-11-15 20:02:59.000000000 -0500
8163 @@ -25,9 +25,6 @@
8164 struct mm_struct;
8165 struct vm_area_struct;
8166
8167 -extern pgd_t swapper_pg_dir[1024];
8168 -extern pgd_t initial_page_table[1024];
8169 -
8170 static inline void pgtable_cache_init(void) { }
8171 static inline void check_pgt_cache(void) { }
8172 void paging_init(void);
8173 @@ -48,6 +45,12 @@ extern void set_pmd_pfn(unsigned long, u
8174 # include <asm/pgtable-2level.h>
8175 #endif
8176
8177 +extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
8178 +extern pgd_t initial_page_table[PTRS_PER_PGD];
8179 +#ifdef CONFIG_X86_PAE
8180 +extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
8181 +#endif
8182 +
8183 #if defined(CONFIG_HIGHPTE)
8184 #define pte_offset_map(dir, address) \
8185 ((pte_t *)kmap_atomic(pmd_page(*(dir))) + \
8186 @@ -62,7 +65,9 @@ extern void set_pmd_pfn(unsigned long, u
8187 /* Clear a kernel PTE and flush it from the TLB */
8188 #define kpte_clear_flush(ptep, vaddr) \
8189 do { \
8190 + pax_open_kernel(); \
8191 pte_clear(&init_mm, (vaddr), (ptep)); \
8192 + pax_close_kernel(); \
8193 __flush_tlb_one((vaddr)); \
8194 } while (0)
8195
8196 @@ -74,6 +79,9 @@ do { \
8197
8198 #endif /* !__ASSEMBLY__ */
8199
8200 +#define HAVE_ARCH_UNMAPPED_AREA
8201 +#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
8202 +
8203 /*
8204 * kern_addr_valid() is (1) for FLATMEM and (0) for
8205 * SPARSEMEM and DISCONTIGMEM
8206 diff -urNp linux-3.0.9/arch/x86/include/asm/pgtable_32_types.h linux-3.0.9/arch/x86/include/asm/pgtable_32_types.h
8207 --- linux-3.0.9/arch/x86/include/asm/pgtable_32_types.h 2011-11-11 13:12:24.000000000 -0500
8208 +++ linux-3.0.9/arch/x86/include/asm/pgtable_32_types.h 2011-11-15 20:02:59.000000000 -0500
8209 @@ -8,7 +8,7 @@
8210 */
8211 #ifdef CONFIG_X86_PAE
8212 # include <asm/pgtable-3level_types.h>
8213 -# define PMD_SIZE (1UL << PMD_SHIFT)
8214 +# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
8215 # define PMD_MASK (~(PMD_SIZE - 1))
8216 #else
8217 # include <asm/pgtable-2level_types.h>
8218 @@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set
8219 # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
8220 #endif
8221
8222 +#ifdef CONFIG_PAX_KERNEXEC
8223 +#ifndef __ASSEMBLY__
8224 +extern unsigned char MODULES_EXEC_VADDR[];
8225 +extern unsigned char MODULES_EXEC_END[];
8226 +#endif
8227 +#include <asm/boot.h>
8228 +#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
8229 +#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
8230 +#else
8231 +#define ktla_ktva(addr) (addr)
8232 +#define ktva_ktla(addr) (addr)
8233 +#endif
8234 +
8235 #define MODULES_VADDR VMALLOC_START
8236 #define MODULES_END VMALLOC_END
8237 #define MODULES_LEN (MODULES_VADDR - MODULES_END)
8238 diff -urNp linux-3.0.9/arch/x86/include/asm/pgtable-3level.h linux-3.0.9/arch/x86/include/asm/pgtable-3level.h
8239 --- linux-3.0.9/arch/x86/include/asm/pgtable-3level.h 2011-11-11 13:12:24.000000000 -0500
8240 +++ linux-3.0.9/arch/x86/include/asm/pgtable-3level.h 2011-11-15 20:02:59.000000000 -0500
8241 @@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
8242
8243 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
8244 {
8245 + pax_open_kernel();
8246 set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
8247 + pax_close_kernel();
8248 }
8249
8250 static inline void native_set_pud(pud_t *pudp, pud_t pud)
8251 {
8252 + pax_open_kernel();
8253 set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
8254 + pax_close_kernel();
8255 }
8256
8257 /*
8258 diff -urNp linux-3.0.9/arch/x86/include/asm/pgtable_64.h linux-3.0.9/arch/x86/include/asm/pgtable_64.h
8259 --- linux-3.0.9/arch/x86/include/asm/pgtable_64.h 2011-11-11 13:12:24.000000000 -0500
8260 +++ linux-3.0.9/arch/x86/include/asm/pgtable_64.h 2011-11-15 20:02:59.000000000 -0500
8261 @@ -16,10 +16,13 @@
8262
8263 extern pud_t level3_kernel_pgt[512];
8264 extern pud_t level3_ident_pgt[512];
8265 +extern pud_t level3_vmalloc_pgt[512];
8266 +extern pud_t level3_vmemmap_pgt[512];
8267 +extern pud_t level2_vmemmap_pgt[512];
8268 extern pmd_t level2_kernel_pgt[512];
8269 extern pmd_t level2_fixmap_pgt[512];
8270 -extern pmd_t level2_ident_pgt[512];
8271 -extern pgd_t init_level4_pgt[];
8272 +extern pmd_t level2_ident_pgt[512*2];
8273 +extern pgd_t init_level4_pgt[512];
8274
8275 #define swapper_pg_dir init_level4_pgt
8276
8277 @@ -61,7 +64,9 @@ static inline void native_set_pte_atomic
8278
8279 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
8280 {
8281 + pax_open_kernel();
8282 *pmdp = pmd;
8283 + pax_close_kernel();
8284 }
8285
8286 static inline void native_pmd_clear(pmd_t *pmd)
8287 @@ -107,6 +112,13 @@ static inline void native_pud_clear(pud_
8288
8289 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
8290 {
8291 + pax_open_kernel();
8292 + *pgdp = pgd;
8293 + pax_close_kernel();
8294 +}
8295 +
8296 +static inline void native_set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
8297 +{
8298 *pgdp = pgd;
8299 }
8300
8301 diff -urNp linux-3.0.9/arch/x86/include/asm/pgtable_64_types.h linux-3.0.9/arch/x86/include/asm/pgtable_64_types.h
8302 --- linux-3.0.9/arch/x86/include/asm/pgtable_64_types.h 2011-11-11 13:12:24.000000000 -0500
8303 +++ linux-3.0.9/arch/x86/include/asm/pgtable_64_types.h 2011-11-15 20:02:59.000000000 -0500
8304 @@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
8305 #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
8306 #define MODULES_END _AC(0xffffffffff000000, UL)
8307 #define MODULES_LEN (MODULES_END - MODULES_VADDR)
8308 +#define MODULES_EXEC_VADDR MODULES_VADDR
8309 +#define MODULES_EXEC_END MODULES_END
8310 +
8311 +#define ktla_ktva(addr) (addr)
8312 +#define ktva_ktla(addr) (addr)
8313
8314 #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
8315 diff -urNp linux-3.0.9/arch/x86/include/asm/pgtable.h linux-3.0.9/arch/x86/include/asm/pgtable.h
8316 --- linux-3.0.9/arch/x86/include/asm/pgtable.h 2011-11-11 13:12:24.000000000 -0500
8317 +++ linux-3.0.9/arch/x86/include/asm/pgtable.h 2011-11-15 20:02:59.000000000 -0500
8318 @@ -44,6 +44,7 @@ extern struct mm_struct *pgd_page_get_mm
8319
8320 #ifndef __PAGETABLE_PUD_FOLDED
8321 #define set_pgd(pgdp, pgd) native_set_pgd(pgdp, pgd)
8322 +#define set_pgd_batched(pgdp, pgd) native_set_pgd_batched(pgdp, pgd)
8323 #define pgd_clear(pgd) native_pgd_clear(pgd)
8324 #endif
8325
8326 @@ -81,12 +82,51 @@ extern struct mm_struct *pgd_page_get_mm
8327
8328 #define arch_end_context_switch(prev) do {} while(0)
8329
8330 +#define pax_open_kernel() native_pax_open_kernel()
8331 +#define pax_close_kernel() native_pax_close_kernel()
8332 #endif /* CONFIG_PARAVIRT */
8333
8334 +#define __HAVE_ARCH_PAX_OPEN_KERNEL
8335 +#define __HAVE_ARCH_PAX_CLOSE_KERNEL
8336 +
8337 +#ifdef CONFIG_PAX_KERNEXEC
8338 +static inline unsigned long native_pax_open_kernel(void)
8339 +{
8340 + unsigned long cr0;
8341 +
8342 + preempt_disable();
8343 + barrier();
8344 + cr0 = read_cr0() ^ X86_CR0_WP;
8345 + BUG_ON(unlikely(cr0 & X86_CR0_WP));
8346 + write_cr0(cr0);
8347 + return cr0 ^ X86_CR0_WP;
8348 +}
8349 +
8350 +static inline unsigned long native_pax_close_kernel(void)
8351 +{
8352 + unsigned long cr0;
8353 +
8354 + cr0 = read_cr0() ^ X86_CR0_WP;
8355 + BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
8356 + write_cr0(cr0);
8357 + barrier();
8358 + preempt_enable_no_resched();
8359 + return cr0 ^ X86_CR0_WP;
8360 +}
8361 +#else
8362 +static inline unsigned long native_pax_open_kernel(void) { return 0; }
8363 +static inline unsigned long native_pax_close_kernel(void) { return 0; }
8364 +#endif
8365 +
8366 /*
8367 * The following only work if pte_present() is true.
8368 * Undefined behaviour if not..
8369 */
8370 +static inline int pte_user(pte_t pte)
8371 +{
8372 + return pte_val(pte) & _PAGE_USER;
8373 +}
8374 +
8375 static inline int pte_dirty(pte_t pte)
8376 {
8377 return pte_flags(pte) & _PAGE_DIRTY;
8378 @@ -196,9 +236,29 @@ static inline pte_t pte_wrprotect(pte_t
8379 return pte_clear_flags(pte, _PAGE_RW);
8380 }
8381
8382 +static inline pte_t pte_mkread(pte_t pte)
8383 +{
8384 + return __pte(pte_val(pte) | _PAGE_USER);
8385 +}
8386 +
8387 static inline pte_t pte_mkexec(pte_t pte)
8388 {
8389 - return pte_clear_flags(pte, _PAGE_NX);
8390 +#ifdef CONFIG_X86_PAE
8391 + if (__supported_pte_mask & _PAGE_NX)
8392 + return pte_clear_flags(pte, _PAGE_NX);
8393 + else
8394 +#endif
8395 + return pte_set_flags(pte, _PAGE_USER);
8396 +}
8397 +
8398 +static inline pte_t pte_exprotect(pte_t pte)
8399 +{
8400 +#ifdef CONFIG_X86_PAE
8401 + if (__supported_pte_mask & _PAGE_NX)
8402 + return pte_set_flags(pte, _PAGE_NX);
8403 + else
8404 +#endif
8405 + return pte_clear_flags(pte, _PAGE_USER);
8406 }
8407
8408 static inline pte_t pte_mkdirty(pte_t pte)
8409 @@ -390,6 +450,15 @@ pte_t *populate_extra_pte(unsigned long
8410 #endif
8411
8412 #ifndef __ASSEMBLY__
8413 +
8414 +#ifdef CONFIG_PAX_PER_CPU_PGD
8415 +extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
8416 +static inline pgd_t *get_cpu_pgd(unsigned int cpu)
8417 +{
8418 + return cpu_pgd[cpu];
8419 +}
8420 +#endif
8421 +
8422 #include <linux/mm_types.h>
8423
8424 static inline int pte_none(pte_t pte)
8425 @@ -560,7 +629,7 @@ static inline pud_t *pud_offset(pgd_t *p
8426
8427 static inline int pgd_bad(pgd_t pgd)
8428 {
8429 - return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
8430 + return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
8431 }
8432
8433 static inline int pgd_none(pgd_t pgd)
8434 @@ -583,7 +652,12 @@ static inline int pgd_none(pgd_t pgd)
8435 * pgd_offset() returns a (pgd_t *)
8436 * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
8437 */
8438 -#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
8439 +#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
8440 +
8441 +#ifdef CONFIG_PAX_PER_CPU_PGD
8442 +#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
8443 +#endif
8444 +
8445 /*
8446 * a shortcut which implies the use of the kernel's pgd, instead
8447 * of a process's
8448 @@ -594,6 +668,20 @@ static inline int pgd_none(pgd_t pgd)
8449 #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
8450 #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
8451
8452 +#ifdef CONFIG_X86_32
8453 +#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
8454 +#else
8455 +#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
8456 +#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
8457 +
8458 +#ifdef CONFIG_PAX_MEMORY_UDEREF
8459 +#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
8460 +#else
8461 +#define PAX_USER_SHADOW_BASE (_AC(0,UL))
8462 +#endif
8463 +
8464 +#endif
8465 +
8466 #ifndef __ASSEMBLY__
8467
8468 extern int direct_gbpages;
8469 @@ -758,11 +846,23 @@ static inline void pmdp_set_wrprotect(st
8470 * dst and src can be on the same page, but the range must not overlap,
8471 * and must not cross a page boundary.
8472 */
8473 -static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
8474 +static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
8475 {
8476 - memcpy(dst, src, count * sizeof(pgd_t));
8477 + pax_open_kernel();
8478 + while (count--)
8479 + *dst++ = *src++;
8480 + pax_close_kernel();
8481 }
8482
8483 +#ifdef CONFIG_PAX_PER_CPU_PGD
8484 +extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
8485 +#endif
8486 +
8487 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
8488 +extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
8489 +#else
8490 +static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) {}
8491 +#endif
8492
8493 #include <asm-generic/pgtable.h>
8494 #endif /* __ASSEMBLY__ */
8495 diff -urNp linux-3.0.9/arch/x86/include/asm/pgtable_types.h linux-3.0.9/arch/x86/include/asm/pgtable_types.h
8496 --- linux-3.0.9/arch/x86/include/asm/pgtable_types.h 2011-11-11 13:12:24.000000000 -0500
8497 +++ linux-3.0.9/arch/x86/include/asm/pgtable_types.h 2011-11-15 20:02:59.000000000 -0500
8498 @@ -16,13 +16,12 @@
8499 #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
8500 #define _PAGE_BIT_PAT 7 /* on 4KB pages */
8501 #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
8502 -#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
8503 +#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
8504 #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
8505 #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
8506 #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
8507 -#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
8508 -#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
8509 -#define _PAGE_BIT_SPLITTING _PAGE_BIT_UNUSED1 /* only valid on a PSE pmd */
8510 +#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
8511 +#define _PAGE_BIT_SPLITTING _PAGE_BIT_SPECIAL /* only valid on a PSE pmd */
8512 #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
8513
8514 /* If _PAGE_BIT_PRESENT is clear, we use these: */
8515 @@ -40,7 +39,6 @@
8516 #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
8517 #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
8518 #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
8519 -#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
8520 #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
8521 #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
8522 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
8523 @@ -57,8 +55,10 @@
8524
8525 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
8526 #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
8527 -#else
8528 +#elif defined(CONFIG_KMEMCHECK)
8529 #define _PAGE_NX (_AT(pteval_t, 0))
8530 +#else
8531 +#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
8532 #endif
8533
8534 #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
8535 @@ -96,6 +96,9 @@
8536 #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
8537 _PAGE_ACCESSED)
8538
8539 +#define PAGE_READONLY_NOEXEC PAGE_READONLY
8540 +#define PAGE_SHARED_NOEXEC PAGE_SHARED
8541 +
8542 #define __PAGE_KERNEL_EXEC \
8543 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
8544 #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
8545 @@ -106,8 +109,8 @@
8546 #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
8547 #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
8548 #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
8549 -#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
8550 -#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
8551 +#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
8552 +#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
8553 #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
8554 #define __PAGE_KERNEL_LARGE_NOCACHE (__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
8555 #define __PAGE_KERNEL_LARGE_EXEC (__PAGE_KERNEL_EXEC | _PAGE_PSE)
8556 @@ -166,8 +169,8 @@
8557 * bits are combined, this will alow user to access the high address mapped
8558 * VDSO in the presence of CONFIG_COMPAT_VDSO
8559 */
8560 -#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
8561 -#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
8562 +#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
8563 +#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
8564 #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
8565 #endif
8566
8567 @@ -205,7 +208,17 @@ static inline pgdval_t pgd_flags(pgd_t p
8568 {
8569 return native_pgd_val(pgd) & PTE_FLAGS_MASK;
8570 }
8571 +#endif
8572
8573 +#if PAGETABLE_LEVELS == 3
8574 +#include <asm-generic/pgtable-nopud.h>
8575 +#endif
8576 +
8577 +#if PAGETABLE_LEVELS == 2
8578 +#include <asm-generic/pgtable-nopmd.h>
8579 +#endif
8580 +
8581 +#ifndef __ASSEMBLY__
8582 #if PAGETABLE_LEVELS > 3
8583 typedef struct { pudval_t pud; } pud_t;
8584
8585 @@ -219,8 +232,6 @@ static inline pudval_t native_pud_val(pu
8586 return pud.pud;
8587 }
8588 #else
8589 -#include <asm-generic/pgtable-nopud.h>
8590 -
8591 static inline pudval_t native_pud_val(pud_t pud)
8592 {
8593 return native_pgd_val(pud.pgd);
8594 @@ -240,8 +251,6 @@ static inline pmdval_t native_pmd_val(pm
8595 return pmd.pmd;
8596 }
8597 #else
8598 -#include <asm-generic/pgtable-nopmd.h>
8599 -
8600 static inline pmdval_t native_pmd_val(pmd_t pmd)
8601 {
8602 return native_pgd_val(pmd.pud.pgd);
8603 @@ -281,7 +290,6 @@ typedef struct page *pgtable_t;
8604
8605 extern pteval_t __supported_pte_mask;
8606 extern void set_nx(void);
8607 -extern int nx_enabled;
8608
8609 #define pgprot_writecombine pgprot_writecombine
8610 extern pgprot_t pgprot_writecombine(pgprot_t prot);
8611 diff -urNp linux-3.0.9/arch/x86/include/asm/processor.h linux-3.0.9/arch/x86/include/asm/processor.h
8612 --- linux-3.0.9/arch/x86/include/asm/processor.h 2011-11-11 13:12:24.000000000 -0500
8613 +++ linux-3.0.9/arch/x86/include/asm/processor.h 2011-11-15 20:02:59.000000000 -0500
8614 @@ -266,7 +266,7 @@ struct tss_struct {
8615
8616 } ____cacheline_aligned;
8617
8618 -DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
8619 +extern struct tss_struct init_tss[NR_CPUS];
8620
8621 /*
8622 * Save the original ist values for checking stack pointers during debugging
8623 @@ -860,11 +860,18 @@ static inline void spin_lock_prefetch(co
8624 */
8625 #define TASK_SIZE PAGE_OFFSET
8626 #define TASK_SIZE_MAX TASK_SIZE
8627 +
8628 +#ifdef CONFIG_PAX_SEGMEXEC
8629 +#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
8630 +#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
8631 +#else
8632 #define STACK_TOP TASK_SIZE
8633 -#define STACK_TOP_MAX STACK_TOP
8634 +#endif
8635 +
8636 +#define STACK_TOP_MAX TASK_SIZE
8637
8638 #define INIT_THREAD { \
8639 - .sp0 = sizeof(init_stack) + (long)&init_stack, \
8640 + .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
8641 .vm86_info = NULL, \
8642 .sysenter_cs = __KERNEL_CS, \
8643 .io_bitmap_ptr = NULL, \
8644 @@ -878,7 +885,7 @@ static inline void spin_lock_prefetch(co
8645 */
8646 #define INIT_TSS { \
8647 .x86_tss = { \
8648 - .sp0 = sizeof(init_stack) + (long)&init_stack, \
8649 + .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
8650 .ss0 = __KERNEL_DS, \
8651 .ss1 = __KERNEL_CS, \
8652 .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
8653 @@ -889,11 +896,7 @@ static inline void spin_lock_prefetch(co
8654 extern unsigned long thread_saved_pc(struct task_struct *tsk);
8655
8656 #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
8657 -#define KSTK_TOP(info) \
8658 -({ \
8659 - unsigned long *__ptr = (unsigned long *)(info); \
8660 - (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
8661 -})
8662 +#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
8663
8664 /*
8665 * The below -8 is to reserve 8 bytes on top of the ring0 stack.
8666 @@ -908,7 +911,7 @@ extern unsigned long thread_saved_pc(str
8667 #define task_pt_regs(task) \
8668 ({ \
8669 struct pt_regs *__regs__; \
8670 - __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
8671 + __regs__ = (struct pt_regs *)((task)->thread.sp0); \
8672 __regs__ - 1; \
8673 })
8674
8675 @@ -918,13 +921,13 @@ extern unsigned long thread_saved_pc(str
8676 /*
8677 * User space process size. 47bits minus one guard page.
8678 */
8679 -#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
8680 +#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
8681
8682 /* This decides where the kernel will search for a free chunk of vm
8683 * space during mmap's.
8684 */
8685 #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
8686 - 0xc0000000 : 0xFFFFe000)
8687 + 0xc0000000 : 0xFFFFf000)
8688
8689 #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \
8690 IA32_PAGE_OFFSET : TASK_SIZE_MAX)
8691 @@ -935,11 +938,11 @@ extern unsigned long thread_saved_pc(str
8692 #define STACK_TOP_MAX TASK_SIZE_MAX
8693
8694 #define INIT_THREAD { \
8695 - .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
8696 + .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
8697 }
8698
8699 #define INIT_TSS { \
8700 - .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
8701 + .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
8702 }
8703
8704 /*
8705 @@ -961,6 +964,10 @@ extern void start_thread(struct pt_regs
8706 */
8707 #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
8708
8709 +#ifdef CONFIG_PAX_SEGMEXEC
8710 +#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
8711 +#endif
8712 +
8713 #define KSTK_EIP(task) (task_pt_regs(task)->ip)
8714
8715 /* Get/set a process' ability to use the timestamp counter instruction */
8716 diff -urNp linux-3.0.9/arch/x86/include/asm/ptrace.h linux-3.0.9/arch/x86/include/asm/ptrace.h
8717 --- linux-3.0.9/arch/x86/include/asm/ptrace.h 2011-11-11 13:12:24.000000000 -0500
8718 +++ linux-3.0.9/arch/x86/include/asm/ptrace.h 2011-11-15 20:02:59.000000000 -0500
8719 @@ -153,28 +153,29 @@ static inline unsigned long regs_return_
8720 }
8721
8722 /*
8723 - * user_mode_vm(regs) determines whether a register set came from user mode.
8724 + * user_mode(regs) determines whether a register set came from user mode.
8725 * This is true if V8086 mode was enabled OR if the register set was from
8726 * protected mode with RPL-3 CS value. This tricky test checks that with
8727 * one comparison. Many places in the kernel can bypass this full check
8728 - * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
8729 + * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
8730 + * be used.
8731 */
8732 -static inline int user_mode(struct pt_regs *regs)
8733 +static inline int user_mode_novm(struct pt_regs *regs)
8734 {
8735 #ifdef CONFIG_X86_32
8736 return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
8737 #else
8738 - return !!(regs->cs & 3);
8739 + return !!(regs->cs & SEGMENT_RPL_MASK);
8740 #endif
8741 }
8742
8743 -static inline int user_mode_vm(struct pt_regs *regs)
8744 +static inline int user_mode(struct pt_regs *regs)
8745 {
8746 #ifdef CONFIG_X86_32
8747 return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
8748 USER_RPL;
8749 #else
8750 - return user_mode(regs);
8751 + return user_mode_novm(regs);
8752 #endif
8753 }
8754
8755 diff -urNp linux-3.0.9/arch/x86/include/asm/reboot.h linux-3.0.9/arch/x86/include/asm/reboot.h
8756 --- linux-3.0.9/arch/x86/include/asm/reboot.h 2011-11-11 13:12:24.000000000 -0500
8757 +++ linux-3.0.9/arch/x86/include/asm/reboot.h 2011-11-15 20:02:59.000000000 -0500
8758 @@ -6,19 +6,19 @@
8759 struct pt_regs;
8760
8761 struct machine_ops {
8762 - void (*restart)(char *cmd);
8763 - void (*halt)(void);
8764 - void (*power_off)(void);
8765 + void (* __noreturn restart)(char *cmd);
8766 + void (* __noreturn halt)(void);
8767 + void (* __noreturn power_off)(void);
8768 void (*shutdown)(void);
8769 void (*crash_shutdown)(struct pt_regs *);
8770 - void (*emergency_restart)(void);
8771 -};
8772 + void (* __noreturn emergency_restart)(void);
8773 +} __no_const;
8774
8775 extern struct machine_ops machine_ops;
8776
8777 void native_machine_crash_shutdown(struct pt_regs *regs);
8778 void native_machine_shutdown(void);
8779 -void machine_real_restart(unsigned int type);
8780 +void machine_real_restart(unsigned int type) __noreturn;
8781 /* These must match dispatch_table in reboot_32.S */
8782 #define MRR_BIOS 0
8783 #define MRR_APM 1
8784 diff -urNp linux-3.0.9/arch/x86/include/asm/rwsem.h linux-3.0.9/arch/x86/include/asm/rwsem.h
8785 --- linux-3.0.9/arch/x86/include/asm/rwsem.h 2011-11-11 13:12:24.000000000 -0500
8786 +++ linux-3.0.9/arch/x86/include/asm/rwsem.h 2011-11-15 20:02:59.000000000 -0500
8787 @@ -64,6 +64,14 @@ static inline void __down_read(struct rw
8788 {
8789 asm volatile("# beginning down_read\n\t"
8790 LOCK_PREFIX _ASM_INC "(%1)\n\t"
8791 +
8792 +#ifdef CONFIG_PAX_REFCOUNT
8793 + "jno 0f\n"
8794 + LOCK_PREFIX _ASM_DEC "(%1)\n"
8795 + "int $4\n0:\n"
8796 + _ASM_EXTABLE(0b, 0b)
8797 +#endif
8798 +
8799 /* adds 0x00000001 */
8800 " jns 1f\n"
8801 " call call_rwsem_down_read_failed\n"
8802 @@ -85,6 +93,14 @@ static inline int __down_read_trylock(st
8803 "1:\n\t"
8804 " mov %1,%2\n\t"
8805 " add %3,%2\n\t"
8806 +
8807 +#ifdef CONFIG_PAX_REFCOUNT
8808 + "jno 0f\n"
8809 + "sub %3,%2\n"
8810 + "int $4\n0:\n"
8811 + _ASM_EXTABLE(0b, 0b)
8812 +#endif
8813 +
8814 " jle 2f\n\t"
8815 LOCK_PREFIX " cmpxchg %2,%0\n\t"
8816 " jnz 1b\n\t"
8817 @@ -104,6 +120,14 @@ static inline void __down_write_nested(s
8818 long tmp;
8819 asm volatile("# beginning down_write\n\t"
8820 LOCK_PREFIX " xadd %1,(%2)\n\t"
8821 +
8822 +#ifdef CONFIG_PAX_REFCOUNT
8823 + "jno 0f\n"
8824 + "mov %1,(%2)\n"
8825 + "int $4\n0:\n"
8826 + _ASM_EXTABLE(0b, 0b)
8827 +#endif
8828 +
8829 /* adds 0xffff0001, returns the old value */
8830 " test %1,%1\n\t"
8831 /* was the count 0 before? */
8832 @@ -141,6 +165,14 @@ static inline void __up_read(struct rw_s
8833 long tmp;
8834 asm volatile("# beginning __up_read\n\t"
8835 LOCK_PREFIX " xadd %1,(%2)\n\t"
8836 +
8837 +#ifdef CONFIG_PAX_REFCOUNT
8838 + "jno 0f\n"
8839 + "mov %1,(%2)\n"
8840 + "int $4\n0:\n"
8841 + _ASM_EXTABLE(0b, 0b)
8842 +#endif
8843 +
8844 /* subtracts 1, returns the old value */
8845 " jns 1f\n\t"
8846 " call call_rwsem_wake\n" /* expects old value in %edx */
8847 @@ -159,6 +191,14 @@ static inline void __up_write(struct rw_
8848 long tmp;
8849 asm volatile("# beginning __up_write\n\t"
8850 LOCK_PREFIX " xadd %1,(%2)\n\t"
8851 +
8852 +#ifdef CONFIG_PAX_REFCOUNT
8853 + "jno 0f\n"
8854 + "mov %1,(%2)\n"
8855 + "int $4\n0:\n"
8856 + _ASM_EXTABLE(0b, 0b)
8857 +#endif
8858 +
8859 /* subtracts 0xffff0001, returns the old value */
8860 " jns 1f\n\t"
8861 " call call_rwsem_wake\n" /* expects old value in %edx */
8862 @@ -176,6 +216,14 @@ static inline void __downgrade_write(str
8863 {
8864 asm volatile("# beginning __downgrade_write\n\t"
8865 LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
8866 +
8867 +#ifdef CONFIG_PAX_REFCOUNT
8868 + "jno 0f\n"
8869 + LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
8870 + "int $4\n0:\n"
8871 + _ASM_EXTABLE(0b, 0b)
8872 +#endif
8873 +
8874 /*
8875 * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
8876 * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
8877 @@ -194,7 +242,15 @@ static inline void __downgrade_write(str
8878 */
8879 static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem)
8880 {
8881 - asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
8882 + asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
8883 +
8884 +#ifdef CONFIG_PAX_REFCOUNT
8885 + "jno 0f\n"
8886 + LOCK_PREFIX _ASM_SUB "%1,%0\n"
8887 + "int $4\n0:\n"
8888 + _ASM_EXTABLE(0b, 0b)
8889 +#endif
8890 +
8891 : "+m" (sem->count)
8892 : "er" (delta));
8893 }
8894 @@ -206,7 +262,15 @@ static inline long rwsem_atomic_update(l
8895 {
8896 long tmp = delta;
8897
8898 - asm volatile(LOCK_PREFIX "xadd %0,%1"
8899 + asm volatile(LOCK_PREFIX "xadd %0,%1\n"
8900 +
8901 +#ifdef CONFIG_PAX_REFCOUNT
8902 + "jno 0f\n"
8903 + "mov %0,%1\n"
8904 + "int $4\n0:\n"
8905 + _ASM_EXTABLE(0b, 0b)
8906 +#endif
8907 +
8908 : "+r" (tmp), "+m" (sem->count)
8909 : : "memory");
8910
8911 diff -urNp linux-3.0.9/arch/x86/include/asm/segment.h linux-3.0.9/arch/x86/include/asm/segment.h
8912 --- linux-3.0.9/arch/x86/include/asm/segment.h 2011-11-11 13:12:24.000000000 -0500
8913 +++ linux-3.0.9/arch/x86/include/asm/segment.h 2011-11-15 20:02:59.000000000 -0500
8914 @@ -64,10 +64,15 @@
8915 * 26 - ESPFIX small SS
8916 * 27 - per-cpu [ offset to per-cpu data area ]
8917 * 28 - stack_canary-20 [ for stack protector ]
8918 - * 29 - unused
8919 - * 30 - unused
8920 + * 29 - PCI BIOS CS
8921 + * 30 - PCI BIOS DS
8922 * 31 - TSS for double fault handler
8923 */
8924 +#define GDT_ENTRY_KERNEXEC_EFI_CS (1)
8925 +#define GDT_ENTRY_KERNEXEC_EFI_DS (2)
8926 +#define __KERNEXEC_EFI_CS (GDT_ENTRY_KERNEXEC_EFI_CS*8)
8927 +#define __KERNEXEC_EFI_DS (GDT_ENTRY_KERNEXEC_EFI_DS*8)
8928 +
8929 #define GDT_ENTRY_TLS_MIN 6
8930 #define GDT_ENTRY_TLS_MAX (GDT_ENTRY_TLS_MIN + GDT_ENTRY_TLS_ENTRIES - 1)
8931
8932 @@ -79,6 +84,8 @@
8933
8934 #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE+0)
8935
8936 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
8937 +
8938 #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE+1)
8939
8940 #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE+4)
8941 @@ -104,6 +111,12 @@
8942 #define __KERNEL_STACK_CANARY 0
8943 #endif
8944
8945 +#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE+17)
8946 +#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
8947 +
8948 +#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE+18)
8949 +#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
8950 +
8951 #define GDT_ENTRY_DOUBLEFAULT_TSS 31
8952
8953 /*
8954 @@ -141,7 +154,7 @@
8955 */
8956
8957 /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
8958 -#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
8959 +#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
8960
8961
8962 #else
8963 @@ -165,6 +178,8 @@
8964 #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
8965 #define __USER32_DS __USER_DS
8966
8967 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
8968 +
8969 #define GDT_ENTRY_TSS 8 /* needs two entries */
8970 #define GDT_ENTRY_LDT 10 /* needs two entries */
8971 #define GDT_ENTRY_TLS_MIN 12
8972 @@ -185,6 +200,7 @@
8973 #endif
8974
8975 #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS*8)
8976 +#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS*8)
8977 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS*8)
8978 #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS*8+3)
8979 #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS*8+3)
8980 diff -urNp linux-3.0.9/arch/x86/include/asm/smp.h linux-3.0.9/arch/x86/include/asm/smp.h
8981 --- linux-3.0.9/arch/x86/include/asm/smp.h 2011-11-11 13:12:24.000000000 -0500
8982 +++ linux-3.0.9/arch/x86/include/asm/smp.h 2011-11-15 20:02:59.000000000 -0500
8983 @@ -36,7 +36,7 @@ DECLARE_PER_CPU(cpumask_var_t, cpu_core_
8984 /* cpus sharing the last level cache: */
8985 DECLARE_PER_CPU(cpumask_var_t, cpu_llc_shared_map);
8986 DECLARE_PER_CPU(u16, cpu_llc_id);
8987 -DECLARE_PER_CPU(int, cpu_number);
8988 +DECLARE_PER_CPU(unsigned int, cpu_number);
8989
8990 static inline struct cpumask *cpu_sibling_mask(int cpu)
8991 {
8992 @@ -77,7 +77,7 @@ struct smp_ops {
8993
8994 void (*send_call_func_ipi)(const struct cpumask *mask);
8995 void (*send_call_func_single_ipi)(int cpu);
8996 -};
8997 +} __no_const;
8998
8999 /* Globals due to paravirt */
9000 extern void set_cpu_sibling_map(int cpu);
9001 @@ -192,14 +192,8 @@ extern unsigned disabled_cpus __cpuinitd
9002 extern int safe_smp_processor_id(void);
9003
9004 #elif defined(CONFIG_X86_64_SMP)
9005 -#define raw_smp_processor_id() (percpu_read(cpu_number))
9006 -
9007 -#define stack_smp_processor_id() \
9008 -({ \
9009 - struct thread_info *ti; \
9010 - __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
9011 - ti->cpu; \
9012 -})
9013 +#define raw_smp_processor_id() (percpu_read(cpu_number))
9014 +#define stack_smp_processor_id() raw_smp_processor_id()
9015 #define safe_smp_processor_id() smp_processor_id()
9016
9017 #endif
9018 diff -urNp linux-3.0.9/arch/x86/include/asm/spinlock.h linux-3.0.9/arch/x86/include/asm/spinlock.h
9019 --- linux-3.0.9/arch/x86/include/asm/spinlock.h 2011-11-11 13:12:24.000000000 -0500
9020 +++ linux-3.0.9/arch/x86/include/asm/spinlock.h 2011-11-15 20:02:59.000000000 -0500
9021 @@ -249,6 +249,14 @@ static inline int arch_write_can_lock(ar
9022 static inline void arch_read_lock(arch_rwlock_t *rw)
9023 {
9024 asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
9025 +
9026 +#ifdef CONFIG_PAX_REFCOUNT
9027 + "jno 0f\n"
9028 + LOCK_PREFIX " addl $1,(%0)\n"
9029 + "int $4\n0:\n"
9030 + _ASM_EXTABLE(0b, 0b)
9031 +#endif
9032 +
9033 "jns 1f\n"
9034 "call __read_lock_failed\n\t"
9035 "1:\n"
9036 @@ -258,6 +266,14 @@ static inline void arch_read_lock(arch_r
9037 static inline void arch_write_lock(arch_rwlock_t *rw)
9038 {
9039 asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
9040 +
9041 +#ifdef CONFIG_PAX_REFCOUNT
9042 + "jno 0f\n"
9043 + LOCK_PREFIX " addl %1,(%0)\n"
9044 + "int $4\n0:\n"
9045 + _ASM_EXTABLE(0b, 0b)
9046 +#endif
9047 +
9048 "jz 1f\n"
9049 "call __write_lock_failed\n\t"
9050 "1:\n"
9051 @@ -286,12 +302,29 @@ static inline int arch_write_trylock(arc
9052
9053 static inline void arch_read_unlock(arch_rwlock_t *rw)
9054 {
9055 - asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
9056 + asm volatile(LOCK_PREFIX "incl %0\n"
9057 +
9058 +#ifdef CONFIG_PAX_REFCOUNT
9059 + "jno 0f\n"
9060 + LOCK_PREFIX "decl %0\n"
9061 + "int $4\n0:\n"
9062 + _ASM_EXTABLE(0b, 0b)
9063 +#endif
9064 +
9065 + :"+m" (rw->lock) : : "memory");
9066 }
9067
9068 static inline void arch_write_unlock(arch_rwlock_t *rw)
9069 {
9070 - asm volatile(LOCK_PREFIX "addl %1, %0"
9071 + asm volatile(LOCK_PREFIX "addl %1, %0\n"
9072 +
9073 +#ifdef CONFIG_PAX_REFCOUNT
9074 + "jno 0f\n"
9075 + LOCK_PREFIX "subl %1, %0\n"
9076 + "int $4\n0:\n"
9077 + _ASM_EXTABLE(0b, 0b)
9078 +#endif
9079 +
9080 : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
9081 }
9082
9083 diff -urNp linux-3.0.9/arch/x86/include/asm/stackprotector.h linux-3.0.9/arch/x86/include/asm/stackprotector.h
9084 --- linux-3.0.9/arch/x86/include/asm/stackprotector.h 2011-11-11 13:12:24.000000000 -0500
9085 +++ linux-3.0.9/arch/x86/include/asm/stackprotector.h 2011-11-15 20:02:59.000000000 -0500
9086 @@ -48,7 +48,7 @@
9087 * head_32 for boot CPU and setup_per_cpu_areas() for others.
9088 */
9089 #define GDT_STACK_CANARY_INIT \
9090 - [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18),
9091 + [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x17),
9092
9093 /*
9094 * Initialize the stackprotector canary value.
9095 @@ -113,7 +113,7 @@ static inline void setup_stack_canary_se
9096
9097 static inline void load_stack_canary_segment(void)
9098 {
9099 -#ifdef CONFIG_X86_32
9100 +#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
9101 asm volatile ("mov %0, %%gs" : : "r" (0));
9102 #endif
9103 }
9104 diff -urNp linux-3.0.9/arch/x86/include/asm/stacktrace.h linux-3.0.9/arch/x86/include/asm/stacktrace.h
9105 --- linux-3.0.9/arch/x86/include/asm/stacktrace.h 2011-11-11 13:12:24.000000000 -0500
9106 +++ linux-3.0.9/arch/x86/include/asm/stacktrace.h 2011-11-15 20:02:59.000000000 -0500
9107 @@ -11,28 +11,20 @@
9108
9109 extern int kstack_depth_to_print;
9110
9111 -struct thread_info;
9112 +struct task_struct;
9113 struct stacktrace_ops;
9114
9115 -typedef unsigned long (*walk_stack_t)(struct thread_info *tinfo,
9116 - unsigned long *stack,
9117 - unsigned long bp,
9118 - const struct stacktrace_ops *ops,
9119 - void *data,
9120 - unsigned long *end,
9121 - int *graph);
9122 -
9123 -extern unsigned long
9124 -print_context_stack(struct thread_info *tinfo,
9125 - unsigned long *stack, unsigned long bp,
9126 - const struct stacktrace_ops *ops, void *data,
9127 - unsigned long *end, int *graph);
9128 -
9129 -extern unsigned long
9130 -print_context_stack_bp(struct thread_info *tinfo,
9131 - unsigned long *stack, unsigned long bp,
9132 - const struct stacktrace_ops *ops, void *data,
9133 - unsigned long *end, int *graph);
9134 +typedef unsigned long walk_stack_t(struct task_struct *task,
9135 + void *stack_start,
9136 + unsigned long *stack,
9137 + unsigned long bp,
9138 + const struct stacktrace_ops *ops,
9139 + void *data,
9140 + unsigned long *end,
9141 + int *graph);
9142 +
9143 +extern walk_stack_t print_context_stack;
9144 +extern walk_stack_t print_context_stack_bp;
9145
9146 /* Generic stack tracer with callbacks */
9147
9148 @@ -40,7 +32,7 @@ struct stacktrace_ops {
9149 void (*address)(void *data, unsigned long address, int reliable);
9150 /* On negative return stop dumping */
9151 int (*stack)(void *data, char *name);
9152 - walk_stack_t walk_stack;
9153 + walk_stack_t *walk_stack;
9154 };
9155
9156 void dump_trace(struct task_struct *tsk, struct pt_regs *regs,
9157 diff -urNp linux-3.0.9/arch/x86/include/asm/sys_ia32.h linux-3.0.9/arch/x86/include/asm/sys_ia32.h
9158 --- linux-3.0.9/arch/x86/include/asm/sys_ia32.h 2011-11-11 13:12:24.000000000 -0500
9159 +++ linux-3.0.9/arch/x86/include/asm/sys_ia32.h 2011-11-15 20:02:59.000000000 -0500
9160 @@ -40,7 +40,7 @@ asmlinkage long sys32_rt_sigprocmask(int
9161 compat_sigset_t __user *, unsigned int);
9162 asmlinkage long sys32_alarm(unsigned int);
9163
9164 -asmlinkage long sys32_waitpid(compat_pid_t, unsigned int *, int);
9165 +asmlinkage long sys32_waitpid(compat_pid_t, unsigned int __user *, int);
9166 asmlinkage long sys32_sysfs(int, u32, u32);
9167
9168 asmlinkage long sys32_sched_rr_get_interval(compat_pid_t,
9169 diff -urNp linux-3.0.9/arch/x86/include/asm/system.h linux-3.0.9/arch/x86/include/asm/system.h
9170 --- linux-3.0.9/arch/x86/include/asm/system.h 2011-11-11 13:12:24.000000000 -0500
9171 +++ linux-3.0.9/arch/x86/include/asm/system.h 2011-11-15 20:02:59.000000000 -0500
9172 @@ -129,7 +129,7 @@ do { \
9173 "call __switch_to\n\t" \
9174 "movq "__percpu_arg([current_task])",%%rsi\n\t" \
9175 __switch_canary \
9176 - "movq %P[thread_info](%%rsi),%%r8\n\t" \
9177 + "movq "__percpu_arg([thread_info])",%%r8\n\t" \
9178 "movq %%rax,%%rdi\n\t" \
9179 "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
9180 "jnz ret_from_fork\n\t" \
9181 @@ -140,7 +140,7 @@ do { \
9182 [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
9183 [ti_flags] "i" (offsetof(struct thread_info, flags)), \
9184 [_tif_fork] "i" (_TIF_FORK), \
9185 - [thread_info] "i" (offsetof(struct task_struct, stack)), \
9186 + [thread_info] "m" (current_tinfo), \
9187 [current_task] "m" (current_task) \
9188 __switch_canary_iparam \
9189 : "memory", "cc" __EXTRA_CLOBBER)
9190 @@ -200,7 +200,7 @@ static inline unsigned long get_limit(un
9191 {
9192 unsigned long __limit;
9193 asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
9194 - return __limit + 1;
9195 + return __limit;
9196 }
9197
9198 static inline void native_clts(void)
9199 @@ -397,12 +397,12 @@ void enable_hlt(void);
9200
9201 void cpu_idle_wait(void);
9202
9203 -extern unsigned long arch_align_stack(unsigned long sp);
9204 +#define arch_align_stack(x) ((x) & ~0xfUL)
9205 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
9206
9207 void default_idle(void);
9208
9209 -void stop_this_cpu(void *dummy);
9210 +void stop_this_cpu(void *dummy) __noreturn;
9211
9212 /*
9213 * Force strict CPU ordering.
9214 diff -urNp linux-3.0.9/arch/x86/include/asm/thread_info.h linux-3.0.9/arch/x86/include/asm/thread_info.h
9215 --- linux-3.0.9/arch/x86/include/asm/thread_info.h 2011-11-11 13:12:24.000000000 -0500
9216 +++ linux-3.0.9/arch/x86/include/asm/thread_info.h 2011-11-15 20:02:59.000000000 -0500
9217 @@ -10,6 +10,7 @@
9218 #include <linux/compiler.h>
9219 #include <asm/page.h>
9220 #include <asm/types.h>
9221 +#include <asm/percpu.h>
9222
9223 /*
9224 * low level task data that entry.S needs immediate access to
9225 @@ -24,7 +25,6 @@ struct exec_domain;
9226 #include <asm/atomic.h>
9227
9228 struct thread_info {
9229 - struct task_struct *task; /* main task structure */
9230 struct exec_domain *exec_domain; /* execution domain */
9231 __u32 flags; /* low level flags */
9232 __u32 status; /* thread synchronous flags */
9233 @@ -34,18 +34,12 @@ struct thread_info {
9234 mm_segment_t addr_limit;
9235 struct restart_block restart_block;
9236 void __user *sysenter_return;
9237 -#ifdef CONFIG_X86_32
9238 - unsigned long previous_esp; /* ESP of the previous stack in
9239 - case of nested (IRQ) stacks
9240 - */
9241 - __u8 supervisor_stack[0];
9242 -#endif
9243 + unsigned long lowest_stack;
9244 int uaccess_err;
9245 };
9246
9247 -#define INIT_THREAD_INFO(tsk) \
9248 +#define INIT_THREAD_INFO \
9249 { \
9250 - .task = &tsk, \
9251 .exec_domain = &default_exec_domain, \
9252 .flags = 0, \
9253 .cpu = 0, \
9254 @@ -56,7 +50,7 @@ struct thread_info {
9255 }, \
9256 }
9257
9258 -#define init_thread_info (init_thread_union.thread_info)
9259 +#define init_thread_info (init_thread_union.stack)
9260 #define init_stack (init_thread_union.stack)
9261
9262 #else /* !__ASSEMBLY__ */
9263 @@ -170,6 +164,23 @@ struct thread_info {
9264 ret; \
9265 })
9266
9267 +#ifdef __ASSEMBLY__
9268 +/* how to get the thread information struct from ASM */
9269 +#define GET_THREAD_INFO(reg) \
9270 + mov PER_CPU_VAR(current_tinfo), reg
9271 +
9272 +/* use this one if reg already contains %esp */
9273 +#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
9274 +#else
9275 +/* how to get the thread information struct from C */
9276 +DECLARE_PER_CPU(struct thread_info *, current_tinfo);
9277 +
9278 +static __always_inline struct thread_info *current_thread_info(void)
9279 +{
9280 + return percpu_read_stable(current_tinfo);
9281 +}
9282 +#endif
9283 +
9284 #ifdef CONFIG_X86_32
9285
9286 #define STACK_WARN (THREAD_SIZE/8)
9287 @@ -180,35 +191,13 @@ struct thread_info {
9288 */
9289 #ifndef __ASSEMBLY__
9290
9291 -
9292 /* how to get the current stack pointer from C */
9293 register unsigned long current_stack_pointer asm("esp") __used;
9294
9295 -/* how to get the thread information struct from C */
9296 -static inline struct thread_info *current_thread_info(void)
9297 -{
9298 - return (struct thread_info *)
9299 - (current_stack_pointer & ~(THREAD_SIZE - 1));
9300 -}
9301 -
9302 -#else /* !__ASSEMBLY__ */
9303 -
9304 -/* how to get the thread information struct from ASM */
9305 -#define GET_THREAD_INFO(reg) \
9306 - movl $-THREAD_SIZE, reg; \
9307 - andl %esp, reg
9308 -
9309 -/* use this one if reg already contains %esp */
9310 -#define GET_THREAD_INFO_WITH_ESP(reg) \
9311 - andl $-THREAD_SIZE, reg
9312 -
9313 #endif
9314
9315 #else /* X86_32 */
9316
9317 -#include <asm/percpu.h>
9318 -#define KERNEL_STACK_OFFSET (5*8)
9319 -
9320 /*
9321 * macros/functions for gaining access to the thread information structure
9322 * preempt_count needs to be 1 initially, until the scheduler is functional.
9323 @@ -216,21 +205,8 @@ static inline struct thread_info *curren
9324 #ifndef __ASSEMBLY__
9325 DECLARE_PER_CPU(unsigned long, kernel_stack);
9326
9327 -static inline struct thread_info *current_thread_info(void)
9328 -{
9329 - struct thread_info *ti;
9330 - ti = (void *)(percpu_read_stable(kernel_stack) +
9331 - KERNEL_STACK_OFFSET - THREAD_SIZE);
9332 - return ti;
9333 -}
9334 -
9335 -#else /* !__ASSEMBLY__ */
9336 -
9337 -/* how to get the thread information struct from ASM */
9338 -#define GET_THREAD_INFO(reg) \
9339 - movq PER_CPU_VAR(kernel_stack),reg ; \
9340 - subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
9341 -
9342 +/* how to get the current stack pointer from C */
9343 +register unsigned long current_stack_pointer asm("rsp") __used;
9344 #endif
9345
9346 #endif /* !X86_32 */
9347 @@ -266,5 +242,16 @@ extern void arch_task_cache_init(void);
9348 extern void free_thread_info(struct thread_info *ti);
9349 extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
9350 #define arch_task_cache_init arch_task_cache_init
9351 +
9352 +#define __HAVE_THREAD_FUNCTIONS
9353 +#define task_thread_info(task) (&(task)->tinfo)
9354 +#define task_stack_page(task) ((task)->stack)
9355 +#define setup_thread_stack(p, org) do {} while (0)
9356 +#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
9357 +
9358 +#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
9359 +extern struct task_struct *alloc_task_struct_node(int node);
9360 +extern void free_task_struct(struct task_struct *);
9361 +
9362 #endif
9363 #endif /* _ASM_X86_THREAD_INFO_H */
9364 diff -urNp linux-3.0.9/arch/x86/include/asm/uaccess_32.h linux-3.0.9/arch/x86/include/asm/uaccess_32.h
9365 --- linux-3.0.9/arch/x86/include/asm/uaccess_32.h 2011-11-11 13:12:24.000000000 -0500
9366 +++ linux-3.0.9/arch/x86/include/asm/uaccess_32.h 2011-11-15 20:02:59.000000000 -0500
9367 @@ -43,6 +43,11 @@ unsigned long __must_check __copy_from_u
9368 static __always_inline unsigned long __must_check
9369 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
9370 {
9371 + pax_track_stack();
9372 +
9373 + if ((long)n < 0)
9374 + return n;
9375 +
9376 if (__builtin_constant_p(n)) {
9377 unsigned long ret;
9378
9379 @@ -61,6 +66,8 @@ __copy_to_user_inatomic(void __user *to,
9380 return ret;
9381 }
9382 }
9383 + if (!__builtin_constant_p(n))
9384 + check_object_size(from, n, true);
9385 return __copy_to_user_ll(to, from, n);
9386 }
9387
9388 @@ -82,12 +89,16 @@ static __always_inline unsigned long __m
9389 __copy_to_user(void __user *to, const void *from, unsigned long n)
9390 {
9391 might_fault();
9392 +
9393 return __copy_to_user_inatomic(to, from, n);
9394 }
9395
9396 static __always_inline unsigned long
9397 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
9398 {
9399 + if ((long)n < 0)
9400 + return n;
9401 +
9402 /* Avoid zeroing the tail if the copy fails..
9403 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
9404 * but as the zeroing behaviour is only significant when n is not
9405 @@ -137,6 +148,12 @@ static __always_inline unsigned long
9406 __copy_from_user(void *to, const void __user *from, unsigned long n)
9407 {
9408 might_fault();
9409 +
9410 + pax_track_stack();
9411 +
9412 + if ((long)n < 0)
9413 + return n;
9414 +
9415 if (__builtin_constant_p(n)) {
9416 unsigned long ret;
9417
9418 @@ -152,6 +169,8 @@ __copy_from_user(void *to, const void __
9419 return ret;
9420 }
9421 }
9422 + if (!__builtin_constant_p(n))
9423 + check_object_size(to, n, false);
9424 return __copy_from_user_ll(to, from, n);
9425 }
9426
9427 @@ -159,6 +178,10 @@ static __always_inline unsigned long __c
9428 const void __user *from, unsigned long n)
9429 {
9430 might_fault();
9431 +
9432 + if ((long)n < 0)
9433 + return n;
9434 +
9435 if (__builtin_constant_p(n)) {
9436 unsigned long ret;
9437
9438 @@ -181,15 +204,19 @@ static __always_inline unsigned long
9439 __copy_from_user_inatomic_nocache(void *to, const void __user *from,
9440 unsigned long n)
9441 {
9442 - return __copy_from_user_ll_nocache_nozero(to, from, n);
9443 -}
9444 + if ((long)n < 0)
9445 + return n;
9446
9447 -unsigned long __must_check copy_to_user(void __user *to,
9448 - const void *from, unsigned long n);
9449 -unsigned long __must_check _copy_from_user(void *to,
9450 - const void __user *from,
9451 - unsigned long n);
9452 + return __copy_from_user_ll_nocache_nozero(to, from, n);
9453 +}
9454
9455 +extern void copy_to_user_overflow(void)
9456 +#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
9457 + __compiletime_error("copy_to_user() buffer size is not provably correct")
9458 +#else
9459 + __compiletime_warning("copy_to_user() buffer size is not provably correct")
9460 +#endif
9461 +;
9462
9463 extern void copy_from_user_overflow(void)
9464 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
9465 @@ -199,17 +226,61 @@ extern void copy_from_user_overflow(void
9466 #endif
9467 ;
9468
9469 -static inline unsigned long __must_check copy_from_user(void *to,
9470 - const void __user *from,
9471 - unsigned long n)
9472 +/**
9473 + * copy_to_user: - Copy a block of data into user space.
9474 + * @to: Destination address, in user space.
9475 + * @from: Source address, in kernel space.
9476 + * @n: Number of bytes to copy.
9477 + *
9478 + * Context: User context only. This function may sleep.
9479 + *
9480 + * Copy data from kernel space to user space.
9481 + *
9482 + * Returns number of bytes that could not be copied.
9483 + * On success, this will be zero.
9484 + */
9485 +static inline unsigned long __must_check
9486 +copy_to_user(void __user *to, const void *from, unsigned long n)
9487 +{
9488 + int sz = __compiletime_object_size(from);
9489 +
9490 + if (unlikely(sz != -1 && sz < n))
9491 + copy_to_user_overflow();
9492 + else if (access_ok(VERIFY_WRITE, to, n))
9493 + n = __copy_to_user(to, from, n);
9494 + return n;
9495 +}
9496 +
9497 +/**
9498 + * copy_from_user: - Copy a block of data from user space.
9499 + * @to: Destination address, in kernel space.
9500 + * @from: Source address, in user space.
9501 + * @n: Number of bytes to copy.
9502 + *
9503 + * Context: User context only. This function may sleep.
9504 + *
9505 + * Copy data from user space to kernel space.
9506 + *
9507 + * Returns number of bytes that could not be copied.
9508 + * On success, this will be zero.
9509 + *
9510 + * If some data could not be copied, this function will pad the copied
9511 + * data to the requested size using zero bytes.
9512 + */
9513 +static inline unsigned long __must_check
9514 +copy_from_user(void *to, const void __user *from, unsigned long n)
9515 {
9516 int sz = __compiletime_object_size(to);
9517
9518 - if (likely(sz == -1 || sz >= n))
9519 - n = _copy_from_user(to, from, n);
9520 - else
9521 + if (unlikely(sz != -1 && sz < n))
9522 copy_from_user_overflow();
9523 -
9524 + else if (access_ok(VERIFY_READ, from, n))
9525 + n = __copy_from_user(to, from, n);
9526 + else if ((long)n > 0) {
9527 + if (!__builtin_constant_p(n))
9528 + check_object_size(to, n, false);
9529 + memset(to, 0, n);
9530 + }
9531 return n;
9532 }
9533
9534 diff -urNp linux-3.0.9/arch/x86/include/asm/uaccess_64.h linux-3.0.9/arch/x86/include/asm/uaccess_64.h
9535 --- linux-3.0.9/arch/x86/include/asm/uaccess_64.h 2011-11-11 13:12:24.000000000 -0500
9536 +++ linux-3.0.9/arch/x86/include/asm/uaccess_64.h 2011-11-15 20:02:59.000000000 -0500
9537 @@ -10,6 +10,9 @@
9538 #include <asm/alternative.h>
9539 #include <asm/cpufeature.h>
9540 #include <asm/page.h>
9541 +#include <asm/pgtable.h>
9542 +
9543 +#define set_fs(x) (current_thread_info()->addr_limit = (x))
9544
9545 /*
9546 * Copy To/From Userspace
9547 @@ -36,26 +39,26 @@ copy_user_generic(void *to, const void *
9548 return ret;
9549 }
9550
9551 -__must_check unsigned long
9552 -_copy_to_user(void __user *to, const void *from, unsigned len);
9553 -__must_check unsigned long
9554 -_copy_from_user(void *to, const void __user *from, unsigned len);
9555 +static __always_inline __must_check unsigned long
9556 +__copy_to_user(void __user *to, const void *from, unsigned len);
9557 +static __always_inline __must_check unsigned long
9558 +__copy_from_user(void *to, const void __user *from, unsigned len);
9559 __must_check unsigned long
9560 copy_in_user(void __user *to, const void __user *from, unsigned len);
9561
9562 static inline unsigned long __must_check copy_from_user(void *to,
9563 const void __user *from,
9564 - unsigned long n)
9565 + unsigned n)
9566 {
9567 - int sz = __compiletime_object_size(to);
9568 -
9569 might_fault();
9570 - if (likely(sz == -1 || sz >= n))
9571 - n = _copy_from_user(to, from, n);
9572 -#ifdef CONFIG_DEBUG_VM
9573 - else
9574 - WARN(1, "Buffer overflow detected!\n");
9575 -#endif
9576 +
9577 + if (access_ok(VERIFY_READ, from, n))
9578 + n = __copy_from_user(to, from, n);
9579 + else if ((int)n > 0) {
9580 + if (!__builtin_constant_p(n))
9581 + check_object_size(to, n, false);
9582 + memset(to, 0, n);
9583 + }
9584 return n;
9585 }
9586
9587 @@ -64,110 +67,198 @@ int copy_to_user(void __user *dst, const
9588 {
9589 might_fault();
9590
9591 - return _copy_to_user(dst, src, size);
9592 + if (access_ok(VERIFY_WRITE, dst, size))
9593 + size = __copy_to_user(dst, src, size);
9594 + return size;
9595 }
9596
9597 static __always_inline __must_check
9598 -int __copy_from_user(void *dst, const void __user *src, unsigned size)
9599 +unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
9600 {
9601 - int ret = 0;
9602 + int sz = __compiletime_object_size(dst);
9603 + unsigned ret = 0;
9604
9605 might_fault();
9606 - if (!__builtin_constant_p(size))
9607 - return copy_user_generic(dst, (__force void *)src, size);
9608 +
9609 + pax_track_stack();
9610 +
9611 + if ((int)size < 0)
9612 + return size;
9613 +
9614 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9615 + if (!__access_ok(VERIFY_READ, src, size))
9616 + return size;
9617 +#endif
9618 +
9619 + if (unlikely(sz != -1 && sz < size)) {
9620 +#ifdef CONFIG_DEBUG_VM
9621 + WARN(1, "Buffer overflow detected!\n");
9622 +#endif
9623 + return size;
9624 + }
9625 +
9626 + if (!__builtin_constant_p(size)) {
9627 + check_object_size(dst, size, false);
9628 +
9629 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9630 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
9631 + src += PAX_USER_SHADOW_BASE;
9632 +#endif
9633 +
9634 + return copy_user_generic(dst, (__force_kernel const void *)src, size);
9635 + }
9636 switch (size) {
9637 - case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
9638 + case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
9639 ret, "b", "b", "=q", 1);
9640 return ret;
9641 - case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
9642 + case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
9643 ret, "w", "w", "=r", 2);
9644 return ret;
9645 - case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
9646 + case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
9647 ret, "l", "k", "=r", 4);
9648 return ret;
9649 - case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
9650 + case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
9651 ret, "q", "", "=r", 8);
9652 return ret;
9653 case 10:
9654 - __get_user_asm(*(u64 *)dst, (u64 __user *)src,
9655 + __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
9656 ret, "q", "", "=r", 10);
9657 if (unlikely(ret))
9658 return ret;
9659 __get_user_asm(*(u16 *)(8 + (char *)dst),
9660 - (u16 __user *)(8 + (char __user *)src),
9661 + (const u16 __user *)(8 + (const char __user *)src),
9662 ret, "w", "w", "=r", 2);
9663 return ret;
9664 case 16:
9665 - __get_user_asm(*(u64 *)dst, (u64 __user *)src,
9666 + __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
9667 ret, "q", "", "=r", 16);
9668 if (unlikely(ret))
9669 return ret;
9670 __get_user_asm(*(u64 *)(8 + (char *)dst),
9671 - (u64 __user *)(8 + (char __user *)src),
9672 + (const u64 __user *)(8 + (const char __user *)src),
9673 ret, "q", "", "=r", 8);
9674 return ret;
9675 default:
9676 - return copy_user_generic(dst, (__force void *)src, size);
9677 +
9678 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9679 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
9680 + src += PAX_USER_SHADOW_BASE;
9681 +#endif
9682 +
9683 + return copy_user_generic(dst, (__force_kernel const void *)src, size);
9684 }
9685 }
9686
9687 static __always_inline __must_check
9688 -int __copy_to_user(void __user *dst, const void *src, unsigned size)
9689 +unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
9690 {
9691 - int ret = 0;
9692 + int sz = __compiletime_object_size(src);
9693 + unsigned ret = 0;
9694
9695 might_fault();
9696 - if (!__builtin_constant_p(size))
9697 - return copy_user_generic((__force void *)dst, src, size);
9698 +
9699 + pax_track_stack();
9700 +
9701 + if ((int)size < 0)
9702 + return size;
9703 +
9704 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9705 + if (!__access_ok(VERIFY_WRITE, dst, size))
9706 + return size;
9707 +#endif
9708 +
9709 + if (unlikely(sz != -1 && sz < size)) {
9710 +#ifdef CONFIG_DEBUG_VM
9711 + WARN(1, "Buffer overflow detected!\n");
9712 +#endif
9713 + return size;
9714 + }
9715 +
9716 + if (!__builtin_constant_p(size)) {
9717 + check_object_size(src, size, true);
9718 +
9719 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9720 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
9721 + dst += PAX_USER_SHADOW_BASE;
9722 +#endif
9723 +
9724 + return copy_user_generic((__force_kernel void *)dst, src, size);
9725 + }
9726 switch (size) {
9727 - case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
9728 + case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
9729 ret, "b", "b", "iq", 1);
9730 return ret;
9731 - case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
9732 + case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
9733 ret, "w", "w", "ir", 2);
9734 return ret;
9735 - case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
9736 + case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
9737 ret, "l", "k", "ir", 4);
9738 return ret;
9739 - case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
9740 + case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
9741 ret, "q", "", "er", 8);
9742 return ret;
9743 case 10:
9744 - __put_user_asm(*(u64 *)src, (u64 __user *)dst,
9745 + __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
9746 ret, "q", "", "er", 10);
9747 if (unlikely(ret))
9748 return ret;
9749 asm("":::"memory");
9750 - __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
9751 + __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
9752 ret, "w", "w", "ir", 2);
9753 return ret;
9754 case 16:
9755 - __put_user_asm(*(u64 *)src, (u64 __user *)dst,
9756 + __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
9757 ret, "q", "", "er", 16);
9758 if (unlikely(ret))
9759 return ret;
9760 asm("":::"memory");
9761 - __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
9762 + __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
9763 ret, "q", "", "er", 8);
9764 return ret;
9765 default:
9766 - return copy_user_generic((__force void *)dst, src, size);
9767 +
9768 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9769 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
9770 + dst += PAX_USER_SHADOW_BASE;
9771 +#endif
9772 +
9773 + return copy_user_generic((__force_kernel void *)dst, src, size);
9774 }
9775 }
9776
9777 static __always_inline __must_check
9778 -int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
9779 +unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
9780 {
9781 - int ret = 0;
9782 + unsigned ret = 0;
9783
9784 might_fault();
9785 - if (!__builtin_constant_p(size))
9786 - return copy_user_generic((__force void *)dst,
9787 - (__force void *)src, size);
9788 +
9789 + if ((int)size < 0)
9790 + return size;
9791 +
9792 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9793 + if (!__access_ok(VERIFY_READ, src, size))
9794 + return size;
9795 + if (!__access_ok(VERIFY_WRITE, dst, size))
9796 + return size;
9797 +#endif
9798 +
9799 + if (!__builtin_constant_p(size)) {
9800 +
9801 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9802 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
9803 + src += PAX_USER_SHADOW_BASE;
9804 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
9805 + dst += PAX_USER_SHADOW_BASE;
9806 +#endif
9807 +
9808 + return copy_user_generic((__force_kernel void *)dst,
9809 + (__force_kernel const void *)src, size);
9810 + }
9811 switch (size) {
9812 case 1: {
9813 u8 tmp;
9814 - __get_user_asm(tmp, (u8 __user *)src,
9815 + __get_user_asm(tmp, (const u8 __user *)src,
9816 ret, "b", "b", "=q", 1);
9817 if (likely(!ret))
9818 __put_user_asm(tmp, (u8 __user *)dst,
9819 @@ -176,7 +267,7 @@ int __copy_in_user(void __user *dst, con
9820 }
9821 case 2: {
9822 u16 tmp;
9823 - __get_user_asm(tmp, (u16 __user *)src,
9824 + __get_user_asm(tmp, (const u16 __user *)src,
9825 ret, "w", "w", "=r", 2);
9826 if (likely(!ret))
9827 __put_user_asm(tmp, (u16 __user *)dst,
9828 @@ -186,7 +277,7 @@ int __copy_in_user(void __user *dst, con
9829
9830 case 4: {
9831 u32 tmp;
9832 - __get_user_asm(tmp, (u32 __user *)src,
9833 + __get_user_asm(tmp, (const u32 __user *)src,
9834 ret, "l", "k", "=r", 4);
9835 if (likely(!ret))
9836 __put_user_asm(tmp, (u32 __user *)dst,
9837 @@ -195,7 +286,7 @@ int __copy_in_user(void __user *dst, con
9838 }
9839 case 8: {
9840 u64 tmp;
9841 - __get_user_asm(tmp, (u64 __user *)src,
9842 + __get_user_asm(tmp, (const u64 __user *)src,
9843 ret, "q", "", "=r", 8);
9844 if (likely(!ret))
9845 __put_user_asm(tmp, (u64 __user *)dst,
9846 @@ -203,8 +294,16 @@ int __copy_in_user(void __user *dst, con
9847 return ret;
9848 }
9849 default:
9850 - return copy_user_generic((__force void *)dst,
9851 - (__force void *)src, size);
9852 +
9853 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9854 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
9855 + src += PAX_USER_SHADOW_BASE;
9856 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
9857 + dst += PAX_USER_SHADOW_BASE;
9858 +#endif
9859 +
9860 + return copy_user_generic((__force_kernel void *)dst,
9861 + (__force_kernel const void *)src, size);
9862 }
9863 }
9864
9865 @@ -221,33 +320,72 @@ __must_check unsigned long __clear_user(
9866 static __must_check __always_inline int
9867 __copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
9868 {
9869 - return copy_user_generic(dst, (__force const void *)src, size);
9870 + pax_track_stack();
9871 +
9872 + if ((int)size < 0)
9873 + return size;
9874 +
9875 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9876 + if (!__access_ok(VERIFY_READ, src, size))
9877 + return size;
9878 +
9879 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
9880 + src += PAX_USER_SHADOW_BASE;
9881 +#endif
9882 +
9883 + return copy_user_generic(dst, (__force_kernel const void *)src, size);
9884 }
9885
9886 -static __must_check __always_inline int
9887 +static __must_check __always_inline unsigned long
9888 __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
9889 {
9890 - return copy_user_generic((__force void *)dst, src, size);
9891 + if ((int)size < 0)
9892 + return size;
9893 +
9894 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9895 + if (!__access_ok(VERIFY_WRITE, dst, size))
9896 + return size;
9897 +
9898 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
9899 + dst += PAX_USER_SHADOW_BASE;
9900 +#endif
9901 +
9902 + return copy_user_generic((__force_kernel void *)dst, src, size);
9903 }
9904
9905 -extern long __copy_user_nocache(void *dst, const void __user *src,
9906 +extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
9907 unsigned size, int zerorest);
9908
9909 -static inline int
9910 -__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
9911 +static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
9912 {
9913 might_sleep();
9914 +
9915 + if ((int)size < 0)
9916 + return size;
9917 +
9918 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9919 + if (!__access_ok(VERIFY_READ, src, size))
9920 + return size;
9921 +#endif
9922 +
9923 return __copy_user_nocache(dst, src, size, 1);
9924 }
9925
9926 -static inline int
9927 -__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
9928 +static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
9929 unsigned size)
9930 {
9931 + if ((int)size < 0)
9932 + return size;
9933 +
9934 +#ifdef CONFIG_PAX_MEMORY_UDEREF
9935 + if (!__access_ok(VERIFY_READ, src, size))
9936 + return size;
9937 +#endif
9938 +
9939 return __copy_user_nocache(dst, src, size, 0);
9940 }
9941
9942 -unsigned long
9943 -copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
9944 +extern unsigned long
9945 +copy_user_handle_tail(char __user *to, char __user *from, unsigned len, unsigned zerorest);
9946
9947 #endif /* _ASM_X86_UACCESS_64_H */
9948 diff -urNp linux-3.0.9/arch/x86/include/asm/uaccess.h linux-3.0.9/arch/x86/include/asm/uaccess.h
9949 --- linux-3.0.9/arch/x86/include/asm/uaccess.h 2011-11-11 13:12:24.000000000 -0500
9950 +++ linux-3.0.9/arch/x86/include/asm/uaccess.h 2011-11-15 20:02:59.000000000 -0500
9951 @@ -7,12 +7,15 @@
9952 #include <linux/compiler.h>
9953 #include <linux/thread_info.h>
9954 #include <linux/string.h>
9955 +#include <linux/sched.h>
9956 #include <asm/asm.h>
9957 #include <asm/page.h>
9958
9959 #define VERIFY_READ 0
9960 #define VERIFY_WRITE 1
9961
9962 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
9963 +
9964 /*
9965 * The fs value determines whether argument validity checking should be
9966 * performed or not. If get_fs() == USER_DS, checking is performed, with
9967 @@ -28,7 +31,12 @@
9968
9969 #define get_ds() (KERNEL_DS)
9970 #define get_fs() (current_thread_info()->addr_limit)
9971 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
9972 +void __set_fs(mm_segment_t x);
9973 +void set_fs(mm_segment_t x);
9974 +#else
9975 #define set_fs(x) (current_thread_info()->addr_limit = (x))
9976 +#endif
9977
9978 #define segment_eq(a, b) ((a).seg == (b).seg)
9979
9980 @@ -76,7 +84,33 @@
9981 * checks that the pointer is in the user space range - after calling
9982 * this function, memory access functions may still return -EFAULT.
9983 */
9984 -#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
9985 +#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
9986 +#define access_ok(type, addr, size) \
9987 +({ \
9988 + long __size = size; \
9989 + unsigned long __addr = (unsigned long)addr; \
9990 + unsigned long __addr_ao = __addr & PAGE_MASK; \
9991 + unsigned long __end_ao = __addr + __size - 1; \
9992 + bool __ret_ao = __range_not_ok(__addr, __size) == 0; \
9993 + if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
9994 + while(__addr_ao <= __end_ao) { \
9995 + char __c_ao; \
9996 + __addr_ao += PAGE_SIZE; \
9997 + if (__size > PAGE_SIZE) \
9998 + cond_resched(); \
9999 + if (__get_user(__c_ao, (char __user *)__addr)) \
10000 + break; \
10001 + if (type != VERIFY_WRITE) { \
10002 + __addr = __addr_ao; \
10003 + continue; \
10004 + } \
10005 + if (__put_user(__c_ao, (char __user *)__addr)) \
10006 + break; \
10007 + __addr = __addr_ao; \
10008 + } \
10009 + } \
10010 + __ret_ao; \
10011 +})
10012
10013 /*
10014 * The exception table consists of pairs of addresses: the first is the
10015 @@ -182,12 +216,20 @@ extern int __get_user_bad(void);
10016 asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
10017 : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
10018
10019 -
10020 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
10021 +#define __copyuser_seg "gs;"
10022 +#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
10023 +#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
10024 +#else
10025 +#define __copyuser_seg
10026 +#define __COPYUSER_SET_ES
10027 +#define __COPYUSER_RESTORE_ES
10028 +#endif
10029
10030 #ifdef CONFIG_X86_32
10031 #define __put_user_asm_u64(x, addr, err, errret) \
10032 - asm volatile("1: movl %%eax,0(%2)\n" \
10033 - "2: movl %%edx,4(%2)\n" \
10034 + asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \
10035 + "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
10036 "3:\n" \
10037 ".section .fixup,\"ax\"\n" \
10038 "4: movl %3,%0\n" \
10039 @@ -199,8 +241,8 @@ extern int __get_user_bad(void);
10040 : "A" (x), "r" (addr), "i" (errret), "0" (err))
10041
10042 #define __put_user_asm_ex_u64(x, addr) \
10043 - asm volatile("1: movl %%eax,0(%1)\n" \
10044 - "2: movl %%edx,4(%1)\n" \
10045 + asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \
10046 + "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
10047 "3:\n" \
10048 _ASM_EXTABLE(1b, 2b - 1b) \
10049 _ASM_EXTABLE(2b, 3b - 2b) \
10050 @@ -252,7 +294,7 @@ extern void __put_user_8(void);
10051 __typeof__(*(ptr)) __pu_val; \
10052 __chk_user_ptr(ptr); \
10053 might_fault(); \
10054 - __pu_val = x; \
10055 + __pu_val = (x); \
10056 switch (sizeof(*(ptr))) { \
10057 case 1: \
10058 __put_user_x(1, __pu_val, ptr, __ret_pu); \
10059 @@ -373,7 +415,7 @@ do { \
10060 } while (0)
10061
10062 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
10063 - asm volatile("1: mov"itype" %2,%"rtype"1\n" \
10064 + asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
10065 "2:\n" \
10066 ".section .fixup,\"ax\"\n" \
10067 "3: mov %3,%0\n" \
10068 @@ -381,7 +423,7 @@ do { \
10069 " jmp 2b\n" \
10070 ".previous\n" \
10071 _ASM_EXTABLE(1b, 3b) \
10072 - : "=r" (err), ltype(x) \
10073 + : "=r" (err), ltype (x) \
10074 : "m" (__m(addr)), "i" (errret), "0" (err))
10075
10076 #define __get_user_size_ex(x, ptr, size) \
10077 @@ -406,7 +448,7 @@ do { \
10078 } while (0)
10079
10080 #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
10081 - asm volatile("1: mov"itype" %1,%"rtype"0\n" \
10082 + asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
10083 "2:\n" \
10084 _ASM_EXTABLE(1b, 2b - 1b) \
10085 : ltype(x) : "m" (__m(addr)))
10086 @@ -423,13 +465,24 @@ do { \
10087 int __gu_err; \
10088 unsigned long __gu_val; \
10089 __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
10090 - (x) = (__force __typeof__(*(ptr)))__gu_val; \
10091 + (x) = (__typeof__(*(ptr)))__gu_val; \
10092 __gu_err; \
10093 })
10094
10095 /* FIXME: this hack is definitely wrong -AK */
10096 struct __large_struct { unsigned long buf[100]; };
10097 -#define __m(x) (*(struct __large_struct __user *)(x))
10098 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10099 +#define ____m(x) \
10100 +({ \
10101 + unsigned long ____x = (unsigned long)(x); \
10102 + if (____x < PAX_USER_SHADOW_BASE) \
10103 + ____x += PAX_USER_SHADOW_BASE; \
10104 + (void __user *)____x; \
10105 +})
10106 +#else
10107 +#define ____m(x) (x)
10108 +#endif
10109 +#define __m(x) (*(struct __large_struct __user *)____m(x))
10110
10111 /*
10112 * Tell gcc we read from memory instead of writing: this is because
10113 @@ -437,7 +490,7 @@ struct __large_struct { unsigned long bu
10114 * aliasing issues.
10115 */
10116 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
10117 - asm volatile("1: mov"itype" %"rtype"1,%2\n" \
10118 + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
10119 "2:\n" \
10120 ".section .fixup,\"ax\"\n" \
10121 "3: mov %3,%0\n" \
10122 @@ -445,10 +498,10 @@ struct __large_struct { unsigned long bu
10123 ".previous\n" \
10124 _ASM_EXTABLE(1b, 3b) \
10125 : "=r"(err) \
10126 - : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
10127 + : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
10128
10129 #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
10130 - asm volatile("1: mov"itype" %"rtype"0,%1\n" \
10131 + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
10132 "2:\n" \
10133 _ASM_EXTABLE(1b, 2b - 1b) \
10134 : : ltype(x), "m" (__m(addr)))
10135 @@ -487,8 +540,12 @@ struct __large_struct { unsigned long bu
10136 * On error, the variable @x is set to zero.
10137 */
10138
10139 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10140 +#define __get_user(x, ptr) get_user((x), (ptr))
10141 +#else
10142 #define __get_user(x, ptr) \
10143 __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
10144 +#endif
10145
10146 /**
10147 * __put_user: - Write a simple value into user space, with less checking.
10148 @@ -510,8 +567,12 @@ struct __large_struct { unsigned long bu
10149 * Returns zero on success, or -EFAULT on error.
10150 */
10151
10152 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10153 +#define __put_user(x, ptr) put_user((x), (ptr))
10154 +#else
10155 #define __put_user(x, ptr) \
10156 __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
10157 +#endif
10158
10159 #define __get_user_unaligned __get_user
10160 #define __put_user_unaligned __put_user
10161 @@ -529,7 +590,7 @@ struct __large_struct { unsigned long bu
10162 #define get_user_ex(x, ptr) do { \
10163 unsigned long __gue_val; \
10164 __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
10165 - (x) = (__force __typeof__(*(ptr)))__gue_val; \
10166 + (x) = (__typeof__(*(ptr)))__gue_val; \
10167 } while (0)
10168
10169 #ifdef CONFIG_X86_WP_WORKS_OK
10170 diff -urNp linux-3.0.9/arch/x86/include/asm/vdso.h linux-3.0.9/arch/x86/include/asm/vdso.h
10171 --- linux-3.0.9/arch/x86/include/asm/vdso.h 2011-11-11 13:12:24.000000000 -0500
10172 +++ linux-3.0.9/arch/x86/include/asm/vdso.h 2011-11-15 20:02:59.000000000 -0500
10173 @@ -11,7 +11,7 @@ extern const char VDSO32_PRELINK[];
10174 #define VDSO32_SYMBOL(base, name) \
10175 ({ \
10176 extern const char VDSO32_##name[]; \
10177 - (void *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
10178 + (void __user *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
10179 })
10180 #endif
10181
10182 diff -urNp linux-3.0.9/arch/x86/include/asm/x86_init.h linux-3.0.9/arch/x86/include/asm/x86_init.h
10183 --- linux-3.0.9/arch/x86/include/asm/x86_init.h 2011-11-11 13:12:24.000000000 -0500
10184 +++ linux-3.0.9/arch/x86/include/asm/x86_init.h 2011-11-15 20:02:59.000000000 -0500
10185 @@ -28,7 +28,7 @@ struct x86_init_mpparse {
10186 void (*mpc_oem_bus_info)(struct mpc_bus *m, char *name);
10187 void (*find_smp_config)(void);
10188 void (*get_smp_config)(unsigned int early);
10189 -};
10190 +} __no_const;
10191
10192 /**
10193 * struct x86_init_resources - platform specific resource related ops
10194 @@ -42,7 +42,7 @@ struct x86_init_resources {
10195 void (*probe_roms)(void);
10196 void (*reserve_resources)(void);
10197 char *(*memory_setup)(void);
10198 -};
10199 +} __no_const;
10200
10201 /**
10202 * struct x86_init_irqs - platform specific interrupt setup
10203 @@ -55,7 +55,7 @@ struct x86_init_irqs {
10204 void (*pre_vector_init)(void);
10205 void (*intr_init)(void);
10206 void (*trap_init)(void);
10207 -};
10208 +} __no_const;
10209
10210 /**
10211 * struct x86_init_oem - oem platform specific customizing functions
10212 @@ -65,7 +65,7 @@ struct x86_init_irqs {
10213 struct x86_init_oem {
10214 void (*arch_setup)(void);
10215 void (*banner)(void);
10216 -};
10217 +} __no_const;
10218
10219 /**
10220 * struct x86_init_mapping - platform specific initial kernel pagetable setup
10221 @@ -76,7 +76,7 @@ struct x86_init_oem {
10222 */
10223 struct x86_init_mapping {
10224 void (*pagetable_reserve)(u64 start, u64 end);
10225 -};
10226 +} __no_const;
10227
10228 /**
10229 * struct x86_init_paging - platform specific paging functions
10230 @@ -86,7 +86,7 @@ struct x86_init_mapping {
10231 struct x86_init_paging {
10232 void (*pagetable_setup_start)(pgd_t *base);
10233 void (*pagetable_setup_done)(pgd_t *base);
10234 -};
10235 +} __no_const;
10236
10237 /**
10238 * struct x86_init_timers - platform specific timer setup
10239 @@ -101,7 +101,7 @@ struct x86_init_timers {
10240 void (*tsc_pre_init)(void);
10241 void (*timer_init)(void);
10242 void (*wallclock_init)(void);
10243 -};
10244 +} __no_const;
10245
10246 /**
10247 * struct x86_init_iommu - platform specific iommu setup
10248 @@ -109,7 +109,7 @@ struct x86_init_timers {
10249 */
10250 struct x86_init_iommu {
10251 int (*iommu_init)(void);
10252 -};
10253 +} __no_const;
10254
10255 /**
10256 * struct x86_init_pci - platform specific pci init functions
10257 @@ -123,7 +123,7 @@ struct x86_init_pci {
10258 int (*init)(void);
10259 void (*init_irq)(void);
10260 void (*fixup_irqs)(void);
10261 -};
10262 +} __no_const;
10263
10264 /**
10265 * struct x86_init_ops - functions for platform specific setup
10266 @@ -139,7 +139,7 @@ struct x86_init_ops {
10267 struct x86_init_timers timers;
10268 struct x86_init_iommu iommu;
10269 struct x86_init_pci pci;
10270 -};
10271 +} __no_const;
10272
10273 /**
10274 * struct x86_cpuinit_ops - platform specific cpu hotplug setups
10275 @@ -147,7 +147,7 @@ struct x86_init_ops {
10276 */
10277 struct x86_cpuinit_ops {
10278 void (*setup_percpu_clockev)(void);
10279 -};
10280 +} __no_const;
10281
10282 /**
10283 * struct x86_platform_ops - platform specific runtime functions
10284 @@ -166,7 +166,7 @@ struct x86_platform_ops {
10285 bool (*is_untracked_pat_range)(u64 start, u64 end);
10286 void (*nmi_init)(void);
10287 int (*i8042_detect)(void);
10288 -};
10289 +} __no_const;
10290
10291 struct pci_dev;
10292
10293 @@ -174,7 +174,7 @@ struct x86_msi_ops {
10294 int (*setup_msi_irqs)(struct pci_dev *dev, int nvec, int type);
10295 void (*teardown_msi_irq)(unsigned int irq);
10296 void (*teardown_msi_irqs)(struct pci_dev *dev);
10297 -};
10298 +} __no_const;
10299
10300 extern struct x86_init_ops x86_init;
10301 extern struct x86_cpuinit_ops x86_cpuinit;
10302 diff -urNp linux-3.0.9/arch/x86/include/asm/xsave.h linux-3.0.9/arch/x86/include/asm/xsave.h
10303 --- linux-3.0.9/arch/x86/include/asm/xsave.h 2011-11-11 13:12:24.000000000 -0500
10304 +++ linux-3.0.9/arch/x86/include/asm/xsave.h 2011-11-15 20:02:59.000000000 -0500
10305 @@ -65,6 +65,11 @@ static inline int xsave_user(struct xsav
10306 {
10307 int err;
10308
10309 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10310 + if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
10311 + buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
10312 +#endif
10313 +
10314 /*
10315 * Clear the xsave header first, so that reserved fields are
10316 * initialized to zero.
10317 @@ -96,10 +101,15 @@ static inline int xsave_user(struct xsav
10318 static inline int xrestore_user(struct xsave_struct __user *buf, u64 mask)
10319 {
10320 int err;
10321 - struct xsave_struct *xstate = ((__force struct xsave_struct *)buf);
10322 + struct xsave_struct *xstate = ((__force_kernel struct xsave_struct *)buf);
10323 u32 lmask = mask;
10324 u32 hmask = mask >> 32;
10325
10326 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10327 + if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
10328 + xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
10329 +#endif
10330 +
10331 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
10332 "2:\n"
10333 ".section .fixup,\"ax\"\n"
10334 diff -urNp linux-3.0.9/arch/x86/Kconfig linux-3.0.9/arch/x86/Kconfig
10335 --- linux-3.0.9/arch/x86/Kconfig 2011-11-11 13:12:24.000000000 -0500
10336 +++ linux-3.0.9/arch/x86/Kconfig 2011-11-15 20:02:59.000000000 -0500
10337 @@ -229,7 +229,7 @@ config X86_HT
10338
10339 config X86_32_LAZY_GS
10340 def_bool y
10341 - depends on X86_32 && !CC_STACKPROTECTOR
10342 + depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
10343
10344 config ARCH_HWEIGHT_CFLAGS
10345 string
10346 @@ -1018,7 +1018,7 @@ choice
10347
10348 config NOHIGHMEM
10349 bool "off"
10350 - depends on !X86_NUMAQ
10351 + depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
10352 ---help---
10353 Linux can use up to 64 Gigabytes of physical memory on x86 systems.
10354 However, the address space of 32-bit x86 processors is only 4
10355 @@ -1055,7 +1055,7 @@ config NOHIGHMEM
10356
10357 config HIGHMEM4G
10358 bool "4GB"
10359 - depends on !X86_NUMAQ
10360 + depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
10361 ---help---
10362 Select this if you have a 32-bit processor and between 1 and 4
10363 gigabytes of physical RAM.
10364 @@ -1109,7 +1109,7 @@ config PAGE_OFFSET
10365 hex
10366 default 0xB0000000 if VMSPLIT_3G_OPT
10367 default 0x80000000 if VMSPLIT_2G
10368 - default 0x78000000 if VMSPLIT_2G_OPT
10369 + default 0x70000000 if VMSPLIT_2G_OPT
10370 default 0x40000000 if VMSPLIT_1G
10371 default 0xC0000000
10372 depends on X86_32
10373 @@ -1483,6 +1483,7 @@ config SECCOMP
10374
10375 config CC_STACKPROTECTOR
10376 bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
10377 + depends on X86_64 || !PAX_MEMORY_UDEREF
10378 ---help---
10379 This option turns on the -fstack-protector GCC feature. This
10380 feature puts, at the beginning of functions, a canary value on
10381 @@ -1540,6 +1541,7 @@ config KEXEC_JUMP
10382 config PHYSICAL_START
10383 hex "Physical address where the kernel is loaded" if (EXPERT || CRASH_DUMP)
10384 default "0x1000000"
10385 + range 0x400000 0x40000000
10386 ---help---
10387 This gives the physical address where the kernel is loaded.
10388
10389 @@ -1603,6 +1605,7 @@ config X86_NEED_RELOCS
10390 config PHYSICAL_ALIGN
10391 hex "Alignment value to which kernel should be aligned" if X86_32
10392 default "0x1000000"
10393 + range 0x400000 0x1000000 if PAX_KERNEXEC
10394 range 0x2000 0x1000000
10395 ---help---
10396 This value puts the alignment restrictions on physical address
10397 @@ -1634,9 +1637,10 @@ config HOTPLUG_CPU
10398 Say N if you want to disable CPU hotplug.
10399
10400 config COMPAT_VDSO
10401 - def_bool y
10402 + def_bool n
10403 prompt "Compat VDSO support"
10404 depends on X86_32 || IA32_EMULATION
10405 + depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
10406 ---help---
10407 Map the 32-bit VDSO to the predictable old-style address too.
10408
10409 diff -urNp linux-3.0.9/arch/x86/Kconfig.cpu linux-3.0.9/arch/x86/Kconfig.cpu
10410 --- linux-3.0.9/arch/x86/Kconfig.cpu 2011-11-11 13:12:24.000000000 -0500
10411 +++ linux-3.0.9/arch/x86/Kconfig.cpu 2011-11-15 20:02:59.000000000 -0500
10412 @@ -338,7 +338,7 @@ config X86_PPRO_FENCE
10413
10414 config X86_F00F_BUG
10415 def_bool y
10416 - depends on M586MMX || M586TSC || M586 || M486 || M386
10417 + depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
10418
10419 config X86_INVD_BUG
10420 def_bool y
10421 @@ -362,7 +362,7 @@ config X86_POPAD_OK
10422
10423 config X86_ALIGNMENT_16
10424 def_bool y
10425 - depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
10426 + depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
10427
10428 config X86_INTEL_USERCOPY
10429 def_bool y
10430 @@ -408,7 +408,7 @@ config X86_CMPXCHG64
10431 # generates cmov.
10432 config X86_CMOV
10433 def_bool y
10434 - depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
10435 + depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
10436
10437 config X86_MINIMUM_CPU_FAMILY
10438 int
10439 diff -urNp linux-3.0.9/arch/x86/Kconfig.debug linux-3.0.9/arch/x86/Kconfig.debug
10440 --- linux-3.0.9/arch/x86/Kconfig.debug 2011-11-11 13:12:24.000000000 -0500
10441 +++ linux-3.0.9/arch/x86/Kconfig.debug 2011-11-15 20:02:59.000000000 -0500
10442 @@ -81,7 +81,7 @@ config X86_PTDUMP
10443 config DEBUG_RODATA
10444 bool "Write protect kernel read-only data structures"
10445 default y
10446 - depends on DEBUG_KERNEL
10447 + depends on DEBUG_KERNEL && BROKEN
10448 ---help---
10449 Mark the kernel read-only data as write-protected in the pagetables,
10450 in order to catch accidental (and incorrect) writes to such const
10451 @@ -99,7 +99,7 @@ config DEBUG_RODATA_TEST
10452
10453 config DEBUG_SET_MODULE_RONX
10454 bool "Set loadable kernel module data as NX and text as RO"
10455 - depends on MODULES
10456 + depends on MODULES && BROKEN
10457 ---help---
10458 This option helps catch unintended modifications to loadable
10459 kernel module's text and read-only data. It also prevents execution
10460 diff -urNp linux-3.0.9/arch/x86/kernel/acpi/realmode/Makefile linux-3.0.9/arch/x86/kernel/acpi/realmode/Makefile
10461 --- linux-3.0.9/arch/x86/kernel/acpi/realmode/Makefile 2011-11-11 13:12:24.000000000 -0500
10462 +++ linux-3.0.9/arch/x86/kernel/acpi/realmode/Makefile 2011-11-15 20:02:59.000000000 -0500
10463 @@ -41,6 +41,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os
10464 $(call cc-option, -fno-stack-protector) \
10465 $(call cc-option, -mpreferred-stack-boundary=2)
10466 KBUILD_CFLAGS += $(call cc-option, -m32)
10467 +ifdef CONSTIFY_PLUGIN
10468 +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
10469 +endif
10470 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
10471 GCOV_PROFILE := n
10472
10473 diff -urNp linux-3.0.9/arch/x86/kernel/acpi/realmode/wakeup.S linux-3.0.9/arch/x86/kernel/acpi/realmode/wakeup.S
10474 --- linux-3.0.9/arch/x86/kernel/acpi/realmode/wakeup.S 2011-11-11 13:12:24.000000000 -0500
10475 +++ linux-3.0.9/arch/x86/kernel/acpi/realmode/wakeup.S 2011-11-15 20:02:59.000000000 -0500
10476 @@ -108,6 +108,9 @@ wakeup_code:
10477 /* Do any other stuff... */
10478
10479 #ifndef CONFIG_64BIT
10480 + /* Recheck NX bit overrides (64bit path does this in trampoline */
10481 + call verify_cpu
10482 +
10483 /* This could also be done in C code... */
10484 movl pmode_cr3, %eax
10485 movl %eax, %cr3
10486 @@ -131,6 +134,7 @@ wakeup_code:
10487 movl pmode_cr0, %eax
10488 movl %eax, %cr0
10489 jmp pmode_return
10490 +# include "../../verify_cpu.S"
10491 #else
10492 pushw $0
10493 pushw trampoline_segment
10494 diff -urNp linux-3.0.9/arch/x86/kernel/acpi/sleep.c linux-3.0.9/arch/x86/kernel/acpi/sleep.c
10495 --- linux-3.0.9/arch/x86/kernel/acpi/sleep.c 2011-11-11 13:12:24.000000000 -0500
10496 +++ linux-3.0.9/arch/x86/kernel/acpi/sleep.c 2011-11-15 20:02:59.000000000 -0500
10497 @@ -94,8 +94,12 @@ int acpi_suspend_lowlevel(void)
10498 header->trampoline_segment = trampoline_address() >> 4;
10499 #ifdef CONFIG_SMP
10500 stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
10501 +
10502 + pax_open_kernel();
10503 early_gdt_descr.address =
10504 (unsigned long)get_cpu_gdt_table(smp_processor_id());
10505 + pax_close_kernel();
10506 +
10507 initial_gs = per_cpu_offset(smp_processor_id());
10508 #endif
10509 initial_code = (unsigned long)wakeup_long64;
10510 diff -urNp linux-3.0.9/arch/x86/kernel/acpi/wakeup_32.S linux-3.0.9/arch/x86/kernel/acpi/wakeup_32.S
10511 --- linux-3.0.9/arch/x86/kernel/acpi/wakeup_32.S 2011-11-11 13:12:24.000000000 -0500
10512 +++ linux-3.0.9/arch/x86/kernel/acpi/wakeup_32.S 2011-11-15 20:02:59.000000000 -0500
10513 @@ -30,13 +30,11 @@ wakeup_pmode_return:
10514 # and restore the stack ... but you need gdt for this to work
10515 movl saved_context_esp, %esp
10516
10517 - movl %cs:saved_magic, %eax
10518 - cmpl $0x12345678, %eax
10519 + cmpl $0x12345678, saved_magic
10520 jne bogus_magic
10521
10522 # jump to place where we left off
10523 - movl saved_eip, %eax
10524 - jmp *%eax
10525 + jmp *(saved_eip)
10526
10527 bogus_magic:
10528 jmp bogus_magic
10529 diff -urNp linux-3.0.9/arch/x86/kernel/alternative.c linux-3.0.9/arch/x86/kernel/alternative.c
10530 --- linux-3.0.9/arch/x86/kernel/alternative.c 2011-11-11 13:12:24.000000000 -0500
10531 +++ linux-3.0.9/arch/x86/kernel/alternative.c 2011-11-15 20:02:59.000000000 -0500
10532 @@ -313,7 +313,7 @@ static void alternatives_smp_lock(const
10533 if (!*poff || ptr < text || ptr >= text_end)
10534 continue;
10535 /* turn DS segment override prefix into lock prefix */
10536 - if (*ptr == 0x3e)
10537 + if (*ktla_ktva(ptr) == 0x3e)
10538 text_poke(ptr, ((unsigned char []){0xf0}), 1);
10539 };
10540 mutex_unlock(&text_mutex);
10541 @@ -334,7 +334,7 @@ static void alternatives_smp_unlock(cons
10542 if (!*poff || ptr < text || ptr >= text_end)
10543 continue;
10544 /* turn lock prefix into DS segment override prefix */
10545 - if (*ptr == 0xf0)
10546 + if (*ktla_ktva(ptr) == 0xf0)
10547 text_poke(ptr, ((unsigned char []){0x3E}), 1);
10548 };
10549 mutex_unlock(&text_mutex);
10550 @@ -503,7 +503,7 @@ void __init_or_module apply_paravirt(str
10551
10552 BUG_ON(p->len > MAX_PATCH_LEN);
10553 /* prep the buffer with the original instructions */
10554 - memcpy(insnbuf, p->instr, p->len);
10555 + memcpy(insnbuf, ktla_ktva(p->instr), p->len);
10556 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
10557 (unsigned long)p->instr, p->len);
10558
10559 @@ -571,7 +571,7 @@ void __init alternative_instructions(voi
10560 if (smp_alt_once)
10561 free_init_pages("SMP alternatives",
10562 (unsigned long)__smp_locks,
10563 - (unsigned long)__smp_locks_end);
10564 + PAGE_ALIGN((unsigned long)__smp_locks_end));
10565
10566 restart_nmi();
10567 }
10568 @@ -588,13 +588,17 @@ void __init alternative_instructions(voi
10569 * instructions. And on the local CPU you need to be protected again NMI or MCE
10570 * handlers seeing an inconsistent instruction while you patch.
10571 */
10572 -void *__init_or_module text_poke_early(void *addr, const void *opcode,
10573 +void *__kprobes text_poke_early(void *addr, const void *opcode,
10574 size_t len)
10575 {
10576 unsigned long flags;
10577 local_irq_save(flags);
10578 - memcpy(addr, opcode, len);
10579 +
10580 + pax_open_kernel();
10581 + memcpy(ktla_ktva(addr), opcode, len);
10582 sync_core();
10583 + pax_close_kernel();
10584 +
10585 local_irq_restore(flags);
10586 /* Could also do a CLFLUSH here to speed up CPU recovery; but
10587 that causes hangs on some VIA CPUs. */
10588 @@ -616,36 +620,22 @@ void *__init_or_module text_poke_early(v
10589 */
10590 void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
10591 {
10592 - unsigned long flags;
10593 - char *vaddr;
10594 + unsigned char *vaddr = ktla_ktva(addr);
10595 struct page *pages[2];
10596 - int i;
10597 + size_t i;
10598
10599 if (!core_kernel_text((unsigned long)addr)) {
10600 - pages[0] = vmalloc_to_page(addr);
10601 - pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
10602 + pages[0] = vmalloc_to_page(vaddr);
10603 + pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
10604 } else {
10605 - pages[0] = virt_to_page(addr);
10606 + pages[0] = virt_to_page(vaddr);
10607 WARN_ON(!PageReserved(pages[0]));
10608 - pages[1] = virt_to_page(addr + PAGE_SIZE);
10609 + pages[1] = virt_to_page(vaddr + PAGE_SIZE);
10610 }
10611 BUG_ON(!pages[0]);
10612 - local_irq_save(flags);
10613 - set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
10614 - if (pages[1])
10615 - set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
10616 - vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
10617 - memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
10618 - clear_fixmap(FIX_TEXT_POKE0);
10619 - if (pages[1])
10620 - clear_fixmap(FIX_TEXT_POKE1);
10621 - local_flush_tlb();
10622 - sync_core();
10623 - /* Could also do a CLFLUSH here to speed up CPU recovery; but
10624 - that causes hangs on some VIA CPUs. */
10625 + text_poke_early(addr, opcode, len);
10626 for (i = 0; i < len; i++)
10627 - BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
10628 - local_irq_restore(flags);
10629 + BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
10630 return addr;
10631 }
10632
10633 diff -urNp linux-3.0.9/arch/x86/kernel/apic/apic.c linux-3.0.9/arch/x86/kernel/apic/apic.c
10634 --- linux-3.0.9/arch/x86/kernel/apic/apic.c 2011-11-11 13:12:24.000000000 -0500
10635 +++ linux-3.0.9/arch/x86/kernel/apic/apic.c 2011-11-15 20:02:59.000000000 -0500
10636 @@ -173,7 +173,7 @@ int first_system_vector = 0xfe;
10637 /*
10638 * Debug level, exported for io_apic.c
10639 */
10640 -unsigned int apic_verbosity;
10641 +int apic_verbosity;
10642
10643 int pic_mode;
10644
10645 @@ -1834,7 +1834,7 @@ void smp_error_interrupt(struct pt_regs
10646 apic_write(APIC_ESR, 0);
10647 v1 = apic_read(APIC_ESR);
10648 ack_APIC_irq();
10649 - atomic_inc(&irq_err_count);
10650 + atomic_inc_unchecked(&irq_err_count);
10651
10652 apic_printk(APIC_DEBUG, KERN_DEBUG "APIC error on CPU%d: %02x(%02x)",
10653 smp_processor_id(), v0 , v1);
10654 @@ -2190,6 +2190,8 @@ static int __cpuinit apic_cluster_num(vo
10655 u16 *bios_cpu_apicid;
10656 DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
10657
10658 + pax_track_stack();
10659 +
10660 bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
10661 bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
10662
10663 diff -urNp linux-3.0.9/arch/x86/kernel/apic/io_apic.c linux-3.0.9/arch/x86/kernel/apic/io_apic.c
10664 --- linux-3.0.9/arch/x86/kernel/apic/io_apic.c 2011-11-11 13:12:24.000000000 -0500
10665 +++ linux-3.0.9/arch/x86/kernel/apic/io_apic.c 2011-11-15 20:02:59.000000000 -0500
10666 @@ -1028,7 +1028,7 @@ int IO_APIC_get_PCI_irq_vector(int bus,
10667 }
10668 EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
10669
10670 -void lock_vector_lock(void)
10671 +void lock_vector_lock(void) __acquires(vector_lock)
10672 {
10673 /* Used to the online set of cpus does not change
10674 * during assign_irq_vector.
10675 @@ -1036,7 +1036,7 @@ void lock_vector_lock(void)
10676 raw_spin_lock(&vector_lock);
10677 }
10678
10679 -void unlock_vector_lock(void)
10680 +void unlock_vector_lock(void) __releases(vector_lock)
10681 {
10682 raw_spin_unlock(&vector_lock);
10683 }
10684 @@ -2364,7 +2364,7 @@ static void ack_apic_edge(struct irq_dat
10685 ack_APIC_irq();
10686 }
10687
10688 -atomic_t irq_mis_count;
10689 +atomic_unchecked_t irq_mis_count;
10690
10691 /*
10692 * IO-APIC versions below 0x20 don't support EOI register.
10693 @@ -2472,7 +2472,7 @@ static void ack_apic_level(struct irq_da
10694 * at the cpu.
10695 */
10696 if (!(v & (1 << (i & 0x1f)))) {
10697 - atomic_inc(&irq_mis_count);
10698 + atomic_inc_unchecked(&irq_mis_count);
10699
10700 eoi_ioapic_irq(irq, cfg);
10701 }
10702 diff -urNp linux-3.0.9/arch/x86/kernel/apm_32.c linux-3.0.9/arch/x86/kernel/apm_32.c
10703 --- linux-3.0.9/arch/x86/kernel/apm_32.c 2011-11-11 13:12:24.000000000 -0500
10704 +++ linux-3.0.9/arch/x86/kernel/apm_32.c 2011-11-15 20:02:59.000000000 -0500
10705 @@ -413,7 +413,7 @@ static DEFINE_MUTEX(apm_mutex);
10706 * This is for buggy BIOS's that refer to (real mode) segment 0x40
10707 * even though they are called in protected mode.
10708 */
10709 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
10710 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
10711 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
10712
10713 static const char driver_version[] = "1.16ac"; /* no spaces */
10714 @@ -591,7 +591,10 @@ static long __apm_bios_call(void *_call)
10715 BUG_ON(cpu != 0);
10716 gdt = get_cpu_gdt_table(cpu);
10717 save_desc_40 = gdt[0x40 / 8];
10718 +
10719 + pax_open_kernel();
10720 gdt[0x40 / 8] = bad_bios_desc;
10721 + pax_close_kernel();
10722
10723 apm_irq_save(flags);
10724 APM_DO_SAVE_SEGS;
10725 @@ -600,7 +603,11 @@ static long __apm_bios_call(void *_call)
10726 &call->esi);
10727 APM_DO_RESTORE_SEGS;
10728 apm_irq_restore(flags);
10729 +
10730 + pax_open_kernel();
10731 gdt[0x40 / 8] = save_desc_40;
10732 + pax_close_kernel();
10733 +
10734 put_cpu();
10735
10736 return call->eax & 0xff;
10737 @@ -667,7 +674,10 @@ static long __apm_bios_call_simple(void
10738 BUG_ON(cpu != 0);
10739 gdt = get_cpu_gdt_table(cpu);
10740 save_desc_40 = gdt[0x40 / 8];
10741 +
10742 + pax_open_kernel();
10743 gdt[0x40 / 8] = bad_bios_desc;
10744 + pax_close_kernel();
10745
10746 apm_irq_save(flags);
10747 APM_DO_SAVE_SEGS;
10748 @@ -675,7 +685,11 @@ static long __apm_bios_call_simple(void
10749 &call->eax);
10750 APM_DO_RESTORE_SEGS;
10751 apm_irq_restore(flags);
10752 +
10753 + pax_open_kernel();
10754 gdt[0x40 / 8] = save_desc_40;
10755 + pax_close_kernel();
10756 +
10757 put_cpu();
10758 return error;
10759 }
10760 @@ -2349,12 +2363,15 @@ static int __init apm_init(void)
10761 * code to that CPU.
10762 */
10763 gdt = get_cpu_gdt_table(0);
10764 +
10765 + pax_open_kernel();
10766 set_desc_base(&gdt[APM_CS >> 3],
10767 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
10768 set_desc_base(&gdt[APM_CS_16 >> 3],
10769 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
10770 set_desc_base(&gdt[APM_DS >> 3],
10771 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
10772 + pax_close_kernel();
10773
10774 proc_create("apm", 0, NULL, &apm_file_ops);
10775
10776 diff -urNp linux-3.0.9/arch/x86/kernel/asm-offsets_64.c linux-3.0.9/arch/x86/kernel/asm-offsets_64.c
10777 --- linux-3.0.9/arch/x86/kernel/asm-offsets_64.c 2011-11-11 13:12:24.000000000 -0500
10778 +++ linux-3.0.9/arch/x86/kernel/asm-offsets_64.c 2011-11-15 20:02:59.000000000 -0500
10779 @@ -69,6 +69,7 @@ int main(void)
10780 BLANK();
10781 #undef ENTRY
10782
10783 + DEFINE(TSS_size, sizeof(struct tss_struct));
10784 OFFSET(TSS_ist, tss_struct, x86_tss.ist);
10785 BLANK();
10786
10787 diff -urNp linux-3.0.9/arch/x86/kernel/asm-offsets.c linux-3.0.9/arch/x86/kernel/asm-offsets.c
10788 --- linux-3.0.9/arch/x86/kernel/asm-offsets.c 2011-11-11 13:12:24.000000000 -0500
10789 +++ linux-3.0.9/arch/x86/kernel/asm-offsets.c 2011-11-15 20:02:59.000000000 -0500
10790 @@ -33,6 +33,8 @@ void common(void) {
10791 OFFSET(TI_status, thread_info, status);
10792 OFFSET(TI_addr_limit, thread_info, addr_limit);
10793 OFFSET(TI_preempt_count, thread_info, preempt_count);
10794 + OFFSET(TI_lowest_stack, thread_info, lowest_stack);
10795 + DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
10796
10797 BLANK();
10798 OFFSET(crypto_tfm_ctx_offset, crypto_tfm, __crt_ctx);
10799 @@ -53,8 +55,26 @@ void common(void) {
10800 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
10801 OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
10802 OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
10803 +
10804 +#ifdef CONFIG_PAX_KERNEXEC
10805 + OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
10806 +#endif
10807 +
10808 +#ifdef CONFIG_PAX_MEMORY_UDEREF
10809 + OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
10810 + OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
10811 +#ifdef CONFIG_X86_64
10812 + OFFSET(PV_MMU_set_pgd_batched, pv_mmu_ops, set_pgd_batched);
10813 +#endif
10814 #endif
10815
10816 +#endif
10817 +
10818 + BLANK();
10819 + DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
10820 + DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
10821 + DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
10822 +
10823 #ifdef CONFIG_XEN
10824 BLANK();
10825 OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
10826 diff -urNp linux-3.0.9/arch/x86/kernel/cpu/amd.c linux-3.0.9/arch/x86/kernel/cpu/amd.c
10827 --- linux-3.0.9/arch/x86/kernel/cpu/amd.c 2011-11-11 13:12:24.000000000 -0500
10828 +++ linux-3.0.9/arch/x86/kernel/cpu/amd.c 2011-11-15 20:02:59.000000000 -0500
10829 @@ -647,7 +647,7 @@ static unsigned int __cpuinit amd_size_c
10830 unsigned int size)
10831 {
10832 /* AMD errata T13 (order #21922) */
10833 - if ((c->x86 == 6)) {
10834 + if (c->x86 == 6) {
10835 /* Duron Rev A0 */
10836 if (c->x86_model == 3 && c->x86_mask == 0)
10837 size = 64;
10838 diff -urNp linux-3.0.9/arch/x86/kernel/cpu/common.c linux-3.0.9/arch/x86/kernel/cpu/common.c
10839 --- linux-3.0.9/arch/x86/kernel/cpu/common.c 2011-11-11 13:12:24.000000000 -0500
10840 +++ linux-3.0.9/arch/x86/kernel/cpu/common.c 2011-11-15 20:02:59.000000000 -0500
10841 @@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
10842
10843 static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
10844
10845 -DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
10846 -#ifdef CONFIG_X86_64
10847 - /*
10848 - * We need valid kernel segments for data and code in long mode too
10849 - * IRET will check the segment types kkeil 2000/10/28
10850 - * Also sysret mandates a special GDT layout
10851 - *
10852 - * TLS descriptors are currently at a different place compared to i386.
10853 - * Hopefully nobody expects them at a fixed place (Wine?)
10854 - */
10855 - [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
10856 - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
10857 - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
10858 - [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
10859 - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
10860 - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
10861 -#else
10862 - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
10863 - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
10864 - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
10865 - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
10866 - /*
10867 - * Segments used for calling PnP BIOS have byte granularity.
10868 - * They code segments and data segments have fixed 64k limits,
10869 - * the transfer segment sizes are set at run time.
10870 - */
10871 - /* 32-bit code */
10872 - [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
10873 - /* 16-bit code */
10874 - [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
10875 - /* 16-bit data */
10876 - [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
10877 - /* 16-bit data */
10878 - [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
10879 - /* 16-bit data */
10880 - [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
10881 - /*
10882 - * The APM segments have byte granularity and their bases
10883 - * are set at run time. All have 64k limits.
10884 - */
10885 - /* 32-bit code */
10886 - [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
10887 - /* 16-bit code */
10888 - [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
10889 - /* data */
10890 - [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
10891 -
10892 - [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
10893 - [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
10894 - GDT_STACK_CANARY_INIT
10895 -#endif
10896 -} };
10897 -EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
10898 -
10899 static int __init x86_xsave_setup(char *s)
10900 {
10901 setup_clear_cpu_cap(X86_FEATURE_XSAVE);
10902 @@ -371,7 +317,7 @@ void switch_to_new_gdt(int cpu)
10903 {
10904 struct desc_ptr gdt_descr;
10905
10906 - gdt_descr.address = (long)get_cpu_gdt_table(cpu);
10907 + gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
10908 gdt_descr.size = GDT_SIZE - 1;
10909 load_gdt(&gdt_descr);
10910 /* Reload the per-cpu base */
10911 @@ -840,6 +786,10 @@ static void __cpuinit identify_cpu(struc
10912 /* Filter out anything that depends on CPUID levels we don't have */
10913 filter_cpuid_features(c, true);
10914
10915 +#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
10916 + setup_clear_cpu_cap(X86_FEATURE_SEP);
10917 +#endif
10918 +
10919 /* If the model name is still unset, do table lookup. */
10920 if (!c->x86_model_id[0]) {
10921 const char *p;
10922 @@ -1019,6 +969,9 @@ static __init int setup_disablecpuid(cha
10923 }
10924 __setup("clearcpuid=", setup_disablecpuid);
10925
10926 +DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
10927 +EXPORT_PER_CPU_SYMBOL(current_tinfo);
10928 +
10929 #ifdef CONFIG_X86_64
10930 struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
10931
10932 @@ -1034,7 +987,7 @@ DEFINE_PER_CPU(struct task_struct *, cur
10933 EXPORT_PER_CPU_SYMBOL(current_task);
10934
10935 DEFINE_PER_CPU(unsigned long, kernel_stack) =
10936 - (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
10937 + (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
10938 EXPORT_PER_CPU_SYMBOL(kernel_stack);
10939
10940 DEFINE_PER_CPU(char *, irq_stack_ptr) =
10941 @@ -1099,7 +1052,7 @@ struct pt_regs * __cpuinit idle_regs(str
10942 {
10943 memset(regs, 0, sizeof(struct pt_regs));
10944 regs->fs = __KERNEL_PERCPU;
10945 - regs->gs = __KERNEL_STACK_CANARY;
10946 + savesegment(gs, regs->gs);
10947
10948 return regs;
10949 }
10950 @@ -1154,7 +1107,7 @@ void __cpuinit cpu_init(void)
10951 int i;
10952
10953 cpu = stack_smp_processor_id();
10954 - t = &per_cpu(init_tss, cpu);
10955 + t = init_tss + cpu;
10956 oist = &per_cpu(orig_ist, cpu);
10957
10958 #ifdef CONFIG_NUMA
10959 @@ -1180,7 +1133,7 @@ void __cpuinit cpu_init(void)
10960 switch_to_new_gdt(cpu);
10961 loadsegment(fs, 0);
10962
10963 - load_idt((const struct desc_ptr *)&idt_descr);
10964 + load_idt(&idt_descr);
10965
10966 memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
10967 syscall_init();
10968 @@ -1189,7 +1142,6 @@ void __cpuinit cpu_init(void)
10969 wrmsrl(MSR_KERNEL_GS_BASE, 0);
10970 barrier();
10971
10972 - x86_configure_nx();
10973 if (cpu != 0)
10974 enable_x2apic();
10975
10976 @@ -1243,7 +1195,7 @@ void __cpuinit cpu_init(void)
10977 {
10978 int cpu = smp_processor_id();
10979 struct task_struct *curr = current;
10980 - struct tss_struct *t = &per_cpu(init_tss, cpu);
10981 + struct tss_struct *t = init_tss + cpu;
10982 struct thread_struct *thread = &curr->thread;
10983
10984 if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
10985 diff -urNp linux-3.0.9/arch/x86/kernel/cpu/intel.c linux-3.0.9/arch/x86/kernel/cpu/intel.c
10986 --- linux-3.0.9/arch/x86/kernel/cpu/intel.c 2011-11-11 13:12:24.000000000 -0500
10987 +++ linux-3.0.9/arch/x86/kernel/cpu/intel.c 2011-11-15 20:02:59.000000000 -0500
10988 @@ -172,7 +172,7 @@ static void __cpuinit trap_init_f00f_bug
10989 * Update the IDT descriptor and reload the IDT so that
10990 * it uses the read-only mapped virtual address.
10991 */
10992 - idt_descr.address = fix_to_virt(FIX_F00F_IDT);
10993 + idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
10994 load_idt(&idt_descr);
10995 }
10996 #endif
10997 diff -urNp linux-3.0.9/arch/x86/kernel/cpu/Makefile linux-3.0.9/arch/x86/kernel/cpu/Makefile
10998 --- linux-3.0.9/arch/x86/kernel/cpu/Makefile 2011-11-11 13:12:24.000000000 -0500
10999 +++ linux-3.0.9/arch/x86/kernel/cpu/Makefile 2011-11-15 20:02:59.000000000 -0500
11000 @@ -8,10 +8,6 @@ CFLAGS_REMOVE_common.o = -pg
11001 CFLAGS_REMOVE_perf_event.o = -pg
11002 endif
11003
11004 -# Make sure load_percpu_segment has no stackprotector
11005 -nostackp := $(call cc-option, -fno-stack-protector)
11006 -CFLAGS_common.o := $(nostackp)
11007 -
11008 obj-y := intel_cacheinfo.o scattered.o topology.o
11009 obj-y += proc.o capflags.o powerflags.o common.o
11010 obj-y += vmware.o hypervisor.o sched.o mshyperv.o
11011 diff -urNp linux-3.0.9/arch/x86/kernel/cpu/mcheck/mce.c linux-3.0.9/arch/x86/kernel/cpu/mcheck/mce.c
11012 --- linux-3.0.9/arch/x86/kernel/cpu/mcheck/mce.c 2011-11-11 13:12:24.000000000 -0500
11013 +++ linux-3.0.9/arch/x86/kernel/cpu/mcheck/mce.c 2011-11-15 20:02:59.000000000 -0500
11014 @@ -46,6 +46,7 @@
11015 #include <asm/ipi.h>
11016 #include <asm/mce.h>
11017 #include <asm/msr.h>
11018 +#include <asm/local.h>
11019
11020 #include "mce-internal.h"
11021
11022 @@ -208,7 +209,7 @@ static void print_mce(struct mce *m)
11023 !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
11024 m->cs, m->ip);
11025
11026 - if (m->cs == __KERNEL_CS)
11027 + if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
11028 print_symbol("{%s}", m->ip);
11029 pr_cont("\n");
11030 }
11031 @@ -236,10 +237,10 @@ static void print_mce(struct mce *m)
11032
11033 #define PANIC_TIMEOUT 5 /* 5 seconds */
11034
11035 -static atomic_t mce_paniced;
11036 +static atomic_unchecked_t mce_paniced;
11037
11038 static int fake_panic;
11039 -static atomic_t mce_fake_paniced;
11040 +static atomic_unchecked_t mce_fake_paniced;
11041
11042 /* Panic in progress. Enable interrupts and wait for final IPI */
11043 static void wait_for_panic(void)
11044 @@ -263,7 +264,7 @@ static void mce_panic(char *msg, struct
11045 /*
11046 * Make sure only one CPU runs in machine check panic
11047 */
11048 - if (atomic_inc_return(&mce_paniced) > 1)
11049 + if (atomic_inc_return_unchecked(&mce_paniced) > 1)
11050 wait_for_panic();
11051 barrier();
11052
11053 @@ -271,7 +272,7 @@ static void mce_panic(char *msg, struct
11054 console_verbose();
11055 } else {
11056 /* Don't log too much for fake panic */
11057 - if (atomic_inc_return(&mce_fake_paniced) > 1)
11058 + if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
11059 return;
11060 }
11061 /* First print corrected ones that are still unlogged */
11062 @@ -638,7 +639,7 @@ static int mce_timed_out(u64 *t)
11063 * might have been modified by someone else.
11064 */
11065 rmb();
11066 - if (atomic_read(&mce_paniced))
11067 + if (atomic_read_unchecked(&mce_paniced))
11068 wait_for_panic();
11069 if (!monarch_timeout)
11070 goto out;
11071 @@ -1452,14 +1453,14 @@ void __cpuinit mcheck_cpu_init(struct cp
11072 */
11073
11074 static DEFINE_SPINLOCK(mce_state_lock);
11075 -static int open_count; /* #times opened */
11076 +static local_t open_count; /* #times opened */
11077 static int open_exclu; /* already open exclusive? */
11078
11079 static int mce_open(struct inode *inode, struct file *file)
11080 {
11081 spin_lock(&mce_state_lock);
11082
11083 - if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
11084 + if (open_exclu || (local_read(&open_count) && (file->f_flags & O_EXCL))) {
11085 spin_unlock(&mce_state_lock);
11086
11087 return -EBUSY;
11088 @@ -1467,7 +1468,7 @@ static int mce_open(struct inode *inode,
11089
11090 if (file->f_flags & O_EXCL)
11091 open_exclu = 1;
11092 - open_count++;
11093 + local_inc(&open_count);
11094
11095 spin_unlock(&mce_state_lock);
11096
11097 @@ -1478,7 +1479,7 @@ static int mce_release(struct inode *ino
11098 {
11099 spin_lock(&mce_state_lock);
11100
11101 - open_count--;
11102 + local_dec(&open_count);
11103 open_exclu = 0;
11104
11105 spin_unlock(&mce_state_lock);
11106 @@ -2163,7 +2164,7 @@ struct dentry *mce_get_debugfs_dir(void)
11107 static void mce_reset(void)
11108 {
11109 cpu_missing = 0;
11110 - atomic_set(&mce_fake_paniced, 0);
11111 + atomic_set_unchecked(&mce_fake_paniced, 0);
11112 atomic_set(&mce_executing, 0);
11113 atomic_set(&mce_callin, 0);
11114 atomic_set(&global_nwo, 0);
11115 diff -urNp linux-3.0.9/arch/x86/kernel/cpu/mcheck/mce-inject.c linux-3.0.9/arch/x86/kernel/cpu/mcheck/mce-inject.c
11116 --- linux-3.0.9/arch/x86/kernel/cpu/mcheck/mce-inject.c 2011-11-11 13:12:24.000000000 -0500
11117 +++ linux-3.0.9/arch/x86/kernel/cpu/mcheck/mce-inject.c 2011-11-15 20:02:59.000000000 -0500
11118 @@ -215,7 +215,9 @@ static int inject_init(void)
11119 if (!alloc_cpumask_var(&mce_inject_cpumask, GFP_KERNEL))
11120 return -ENOMEM;
11121 printk(KERN_INFO "Machine check injector initialized\n");
11122 - mce_chrdev_ops.write = mce_write;
11123 + pax_open_kernel();
11124 + *(void **)&mce_chrdev_ops.write = mce_write;
11125 + pax_close_kernel();
11126 register_die_notifier(&mce_raise_nb);
11127 return 0;
11128 }
11129 diff -urNp linux-3.0.9/arch/x86/kernel/cpu/mtrr/main.c linux-3.0.9/arch/x86/kernel/cpu/mtrr/main.c
11130 --- linux-3.0.9/arch/x86/kernel/cpu/mtrr/main.c 2011-11-11 13:12:24.000000000 -0500
11131 +++ linux-3.0.9/arch/x86/kernel/cpu/mtrr/main.c 2011-11-15 20:02:59.000000000 -0500
11132 @@ -62,7 +62,7 @@ static DEFINE_MUTEX(mtrr_mutex);
11133 u64 size_or_mask, size_and_mask;
11134 static bool mtrr_aps_delayed_init;
11135
11136 -static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
11137 +static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
11138
11139 const struct mtrr_ops *mtrr_if;
11140
11141 diff -urNp linux-3.0.9/arch/x86/kernel/cpu/mtrr/mtrr.h linux-3.0.9/arch/x86/kernel/cpu/mtrr/mtrr.h
11142 --- linux-3.0.9/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-11-11 13:12:24.000000000 -0500
11143 +++ linux-3.0.9/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-11-15 20:02:59.000000000 -0500
11144 @@ -25,7 +25,7 @@ struct mtrr_ops {
11145 int (*validate_add_page)(unsigned long base, unsigned long size,
11146 unsigned int type);
11147 int (*have_wrcomb)(void);
11148 -};
11149 +} __do_const;
11150
11151 extern int generic_get_free_region(unsigned long base, unsigned long size,
11152 int replace_reg);
11153 diff -urNp linux-3.0.9/arch/x86/kernel/cpu/perf_event.c linux-3.0.9/arch/x86/kernel/cpu/perf_event.c
11154 --- linux-3.0.9/arch/x86/kernel/cpu/perf_event.c 2011-11-11 13:12:24.000000000 -0500
11155 +++ linux-3.0.9/arch/x86/kernel/cpu/perf_event.c 2011-11-15 20:02:59.000000000 -0500
11156 @@ -781,6 +781,8 @@ static int x86_schedule_events(struct cp
11157 int i, j, w, wmax, num = 0;
11158 struct hw_perf_event *hwc;
11159
11160 + pax_track_stack();
11161 +
11162 bitmap_zero(used_mask, X86_PMC_IDX_MAX);
11163
11164 for (i = 0; i < n; i++) {
11165 @@ -1875,7 +1877,7 @@ perf_callchain_user(struct perf_callchai
11166 break;
11167
11168 perf_callchain_store(entry, frame.return_address);
11169 - fp = frame.next_frame;
11170 + fp = (const void __force_user *)frame.next_frame;
11171 }
11172 }
11173
11174 diff -urNp linux-3.0.9/arch/x86/kernel/crash.c linux-3.0.9/arch/x86/kernel/crash.c
11175 --- linux-3.0.9/arch/x86/kernel/crash.c 2011-11-11 13:12:24.000000000 -0500
11176 +++ linux-3.0.9/arch/x86/kernel/crash.c 2011-11-15 20:02:59.000000000 -0500
11177 @@ -42,7 +42,7 @@ static void kdump_nmi_callback(int cpu,
11178 regs = args->regs;
11179
11180 #ifdef CONFIG_X86_32
11181 - if (!user_mode_vm(regs)) {
11182 + if (!user_mode(regs)) {
11183 crash_fixup_ss_esp(&fixed_regs, regs);
11184 regs = &fixed_regs;
11185 }
11186 diff -urNp linux-3.0.9/arch/x86/kernel/doublefault_32.c linux-3.0.9/arch/x86/kernel/doublefault_32.c
11187 --- linux-3.0.9/arch/x86/kernel/doublefault_32.c 2011-11-11 13:12:24.000000000 -0500
11188 +++ linux-3.0.9/arch/x86/kernel/doublefault_32.c 2011-11-15 20:02:59.000000000 -0500
11189 @@ -11,7 +11,7 @@
11190
11191 #define DOUBLEFAULT_STACKSIZE (1024)
11192 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
11193 -#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
11194 +#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
11195
11196 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
11197
11198 @@ -21,7 +21,7 @@ static void doublefault_fn(void)
11199 unsigned long gdt, tss;
11200
11201 store_gdt(&gdt_desc);
11202 - gdt = gdt_desc.address;
11203 + gdt = (unsigned long)gdt_desc.address;
11204
11205 printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
11206
11207 @@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach
11208 /* 0x2 bit is always set */
11209 .flags = X86_EFLAGS_SF | 0x2,
11210 .sp = STACK_START,
11211 - .es = __USER_DS,
11212 + .es = __KERNEL_DS,
11213 .cs = __KERNEL_CS,
11214 .ss = __KERNEL_DS,
11215 - .ds = __USER_DS,
11216 + .ds = __KERNEL_DS,
11217 .fs = __KERNEL_PERCPU,
11218
11219 .__cr3 = __pa_nodebug(swapper_pg_dir),
11220 diff -urNp linux-3.0.9/arch/x86/kernel/dumpstack_32.c linux-3.0.9/arch/x86/kernel/dumpstack_32.c
11221 --- linux-3.0.9/arch/x86/kernel/dumpstack_32.c 2011-11-11 13:12:24.000000000 -0500
11222 +++ linux-3.0.9/arch/x86/kernel/dumpstack_32.c 2011-11-15 20:02:59.000000000 -0500
11223 @@ -38,15 +38,13 @@ void dump_trace(struct task_struct *task
11224 bp = stack_frame(task, regs);
11225
11226 for (;;) {
11227 - struct thread_info *context;
11228 + void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
11229
11230 - context = (struct thread_info *)
11231 - ((unsigned long)stack & (~(THREAD_SIZE - 1)));
11232 - bp = ops->walk_stack(context, stack, bp, ops, data, NULL, &graph);
11233 + bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
11234
11235 - stack = (unsigned long *)context->previous_esp;
11236 - if (!stack)
11237 + if (stack_start == task_stack_page(task))
11238 break;
11239 + stack = *(unsigned long **)stack_start;
11240 if (ops->stack(data, "IRQ") < 0)
11241 break;
11242 touch_nmi_watchdog();
11243 @@ -96,21 +94,22 @@ void show_registers(struct pt_regs *regs
11244 * When in-kernel, we also print out the stack and code at the
11245 * time of the fault..
11246 */
11247 - if (!user_mode_vm(regs)) {
11248 + if (!user_mode(regs)) {
11249 unsigned int code_prologue = code_bytes * 43 / 64;
11250 unsigned int code_len = code_bytes;
11251 unsigned char c;
11252 u8 *ip;
11253 + unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
11254
11255 printk(KERN_EMERG "Stack:\n");
11256 show_stack_log_lvl(NULL, regs, &regs->sp, 0, KERN_EMERG);
11257
11258 printk(KERN_EMERG "Code: ");
11259
11260 - ip = (u8 *)regs->ip - code_prologue;
11261 + ip = (u8 *)regs->ip - code_prologue + cs_base;
11262 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
11263 /* try starting at IP */
11264 - ip = (u8 *)regs->ip;
11265 + ip = (u8 *)regs->ip + cs_base;
11266 code_len = code_len - code_prologue + 1;
11267 }
11268 for (i = 0; i < code_len; i++, ip++) {
11269 @@ -119,7 +118,7 @@ void show_registers(struct pt_regs *regs
11270 printk(" Bad EIP value.");
11271 break;
11272 }
11273 - if (ip == (u8 *)regs->ip)
11274 + if (ip == (u8 *)regs->ip + cs_base)
11275 printk("<%02x> ", c);
11276 else
11277 printk("%02x ", c);
11278 @@ -132,6 +131,7 @@ int is_valid_bugaddr(unsigned long ip)
11279 {
11280 unsigned short ud2;
11281
11282 + ip = ktla_ktva(ip);
11283 if (ip < PAGE_OFFSET)
11284 return 0;
11285 if (probe_kernel_address((unsigned short *)ip, ud2))
11286 diff -urNp linux-3.0.9/arch/x86/kernel/dumpstack_64.c linux-3.0.9/arch/x86/kernel/dumpstack_64.c
11287 --- linux-3.0.9/arch/x86/kernel/dumpstack_64.c 2011-11-11 13:12:24.000000000 -0500
11288 +++ linux-3.0.9/arch/x86/kernel/dumpstack_64.c 2011-11-15 20:02:59.000000000 -0500
11289 @@ -147,9 +147,9 @@ void dump_trace(struct task_struct *task
11290 unsigned long *irq_stack_end =
11291 (unsigned long *)per_cpu(irq_stack_ptr, cpu);
11292 unsigned used = 0;
11293 - struct thread_info *tinfo;
11294 int graph = 0;
11295 unsigned long dummy;
11296 + void *stack_start;
11297
11298 if (!task)
11299 task = current;
11300 @@ -167,10 +167,10 @@ void dump_trace(struct task_struct *task
11301 * current stack address. If the stacks consist of nested
11302 * exceptions
11303 */
11304 - tinfo = task_thread_info(task);
11305 for (;;) {
11306 char *id;
11307 unsigned long *estack_end;
11308 +
11309 estack_end = in_exception_stack(cpu, (unsigned long)stack,
11310 &used, &id);
11311
11312 @@ -178,7 +178,7 @@ void dump_trace(struct task_struct *task
11313 if (ops->stack(data, id) < 0)
11314 break;
11315
11316 - bp = ops->walk_stack(tinfo, stack, bp, ops,
11317 + bp = ops->walk_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
11318 data, estack_end, &graph);
11319 ops->stack(data, "<EOE>");
11320 /*
11321 @@ -197,7 +197,7 @@ void dump_trace(struct task_struct *task
11322 if (in_irq_stack(stack, irq_stack, irq_stack_end)) {
11323 if (ops->stack(data, "IRQ") < 0)
11324 break;
11325 - bp = ops->walk_stack(tinfo, stack, bp,
11326 + bp = ops->walk_stack(task, irq_stack, stack, bp,
11327 ops, data, irq_stack_end, &graph);
11328 /*
11329 * We link to the next stack (which would be
11330 @@ -218,7 +218,8 @@ void dump_trace(struct task_struct *task
11331 /*
11332 * This handles the process stack:
11333 */
11334 - bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph);
11335 + stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
11336 + bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
11337 put_cpu();
11338 }
11339 EXPORT_SYMBOL(dump_trace);
11340 diff -urNp linux-3.0.9/arch/x86/kernel/dumpstack.c linux-3.0.9/arch/x86/kernel/dumpstack.c
11341 --- linux-3.0.9/arch/x86/kernel/dumpstack.c 2011-11-11 13:12:24.000000000 -0500
11342 +++ linux-3.0.9/arch/x86/kernel/dumpstack.c 2011-11-15 20:02:59.000000000 -0500
11343 @@ -2,6 +2,9 @@
11344 * Copyright (C) 1991, 1992 Linus Torvalds
11345 * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
11346 */
11347 +#ifdef CONFIG_GRKERNSEC_HIDESYM
11348 +#define __INCLUDED_BY_HIDESYM 1
11349 +#endif
11350 #include <linux/kallsyms.h>
11351 #include <linux/kprobes.h>
11352 #include <linux/uaccess.h>
11353 @@ -35,9 +38,8 @@ void printk_address(unsigned long addres
11354 static void
11355 print_ftrace_graph_addr(unsigned long addr, void *data,
11356 const struct stacktrace_ops *ops,
11357 - struct thread_info *tinfo, int *graph)
11358 + struct task_struct *task, int *graph)
11359 {
11360 - struct task_struct *task = tinfo->task;
11361 unsigned long ret_addr;
11362 int index = task->curr_ret_stack;
11363
11364 @@ -58,7 +60,7 @@ print_ftrace_graph_addr(unsigned long ad
11365 static inline void
11366 print_ftrace_graph_addr(unsigned long addr, void *data,
11367 const struct stacktrace_ops *ops,
11368 - struct thread_info *tinfo, int *graph)
11369 + struct task_struct *task, int *graph)
11370 { }
11371 #endif
11372
11373 @@ -69,10 +71,8 @@ print_ftrace_graph_addr(unsigned long ad
11374 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
11375 */
11376
11377 -static inline int valid_stack_ptr(struct thread_info *tinfo,
11378 - void *p, unsigned int size, void *end)
11379 +static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
11380 {
11381 - void *t = tinfo;
11382 if (end) {
11383 if (p < end && p >= (end-THREAD_SIZE))
11384 return 1;
11385 @@ -83,14 +83,14 @@ static inline int valid_stack_ptr(struct
11386 }
11387
11388 unsigned long
11389 -print_context_stack(struct thread_info *tinfo,
11390 +print_context_stack(struct task_struct *task, void *stack_start,
11391 unsigned long *stack, unsigned long bp,
11392 const struct stacktrace_ops *ops, void *data,
11393 unsigned long *end, int *graph)
11394 {
11395 struct stack_frame *frame = (struct stack_frame *)bp;
11396
11397 - while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
11398 + while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
11399 unsigned long addr;
11400
11401 addr = *stack;
11402 @@ -102,7 +102,7 @@ print_context_stack(struct thread_info *
11403 } else {
11404 ops->address(data, addr, 0);
11405 }
11406 - print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
11407 + print_ftrace_graph_addr(addr, data, ops, task, graph);
11408 }
11409 stack++;
11410 }
11411 @@ -111,7 +111,7 @@ print_context_stack(struct thread_info *
11412 EXPORT_SYMBOL_GPL(print_context_stack);
11413
11414 unsigned long
11415 -print_context_stack_bp(struct thread_info *tinfo,
11416 +print_context_stack_bp(struct task_struct *task, void *stack_start,
11417 unsigned long *stack, unsigned long bp,
11418 const struct stacktrace_ops *ops, void *data,
11419 unsigned long *end, int *graph)
11420 @@ -119,7 +119,7 @@ print_context_stack_bp(struct thread_inf
11421 struct stack_frame *frame = (struct stack_frame *)bp;
11422 unsigned long *ret_addr = &frame->return_address;
11423
11424 - while (valid_stack_ptr(tinfo, ret_addr, sizeof(*ret_addr), end)) {
11425 + while (valid_stack_ptr(stack_start, ret_addr, sizeof(*ret_addr), end)) {
11426 unsigned long addr = *ret_addr;
11427
11428 if (!__kernel_text_address(addr))
11429 @@ -128,7 +128,7 @@ print_context_stack_bp(struct thread_inf
11430 ops->address(data, addr, 1);
11431 frame = frame->next_frame;
11432 ret_addr = &frame->return_address;
11433 - print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
11434 + print_ftrace_graph_addr(addr, data, ops, task, graph);
11435 }
11436
11437 return (unsigned long)frame;
11438 @@ -186,7 +186,7 @@ void dump_stack(void)
11439
11440 bp = stack_frame(current, NULL);
11441 printk("Pid: %d, comm: %.20s %s %s %.*s\n",
11442 - current->pid, current->comm, print_tainted(),
11443 + task_pid_nr(current), current->comm, print_tainted(),
11444 init_utsname()->release,
11445 (int)strcspn(init_utsname()->version, " "),
11446 init_utsname()->version);
11447 @@ -222,6 +222,8 @@ unsigned __kprobes long oops_begin(void)
11448 }
11449 EXPORT_SYMBOL_GPL(oops_begin);
11450
11451 +extern void gr_handle_kernel_exploit(void);
11452 +
11453 void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
11454 {
11455 if (regs && kexec_should_crash(current))
11456 @@ -243,7 +245,10 @@ void __kprobes oops_end(unsigned long fl
11457 panic("Fatal exception in interrupt");
11458 if (panic_on_oops)
11459 panic("Fatal exception");
11460 - do_exit(signr);
11461 +
11462 + gr_handle_kernel_exploit();
11463 +
11464 + do_group_exit(signr);
11465 }
11466
11467 int __kprobes __die(const char *str, struct pt_regs *regs, long err)
11468 @@ -269,7 +274,7 @@ int __kprobes __die(const char *str, str
11469
11470 show_registers(regs);
11471 #ifdef CONFIG_X86_32
11472 - if (user_mode_vm(regs)) {
11473 + if (user_mode(regs)) {
11474 sp = regs->sp;
11475 ss = regs->ss & 0xffff;
11476 } else {
11477 @@ -297,7 +302,7 @@ void die(const char *str, struct pt_regs
11478 unsigned long flags = oops_begin();
11479 int sig = SIGSEGV;
11480
11481 - if (!user_mode_vm(regs))
11482 + if (!user_mode(regs))
11483 report_bug(regs->ip, regs);
11484
11485 if (__die(str, regs, err))
11486 diff -urNp linux-3.0.9/arch/x86/kernel/early_printk.c linux-3.0.9/arch/x86/kernel/early_printk.c
11487 --- linux-3.0.9/arch/x86/kernel/early_printk.c 2011-11-11 13:12:24.000000000 -0500
11488 +++ linux-3.0.9/arch/x86/kernel/early_printk.c 2011-11-15 20:02:59.000000000 -0500
11489 @@ -7,6 +7,7 @@
11490 #include <linux/pci_regs.h>
11491 #include <linux/pci_ids.h>
11492 #include <linux/errno.h>
11493 +#include <linux/sched.h>
11494 #include <asm/io.h>
11495 #include <asm/processor.h>
11496 #include <asm/fcntl.h>
11497 @@ -179,6 +180,8 @@ asmlinkage void early_printk(const char
11498 int n;
11499 va_list ap;
11500
11501 + pax_track_stack();
11502 +
11503 va_start(ap, fmt);
11504 n = vscnprintf(buf, sizeof(buf), fmt, ap);
11505 early_console->write(early_console, buf, n);
11506 diff -urNp linux-3.0.9/arch/x86/kernel/entry_32.S linux-3.0.9/arch/x86/kernel/entry_32.S
11507 --- linux-3.0.9/arch/x86/kernel/entry_32.S 2011-11-11 13:12:24.000000000 -0500
11508 +++ linux-3.0.9/arch/x86/kernel/entry_32.S 2011-11-15 20:02:59.000000000 -0500
11509 @@ -185,13 +185,146 @@
11510 /*CFI_REL_OFFSET gs, PT_GS*/
11511 .endm
11512 .macro SET_KERNEL_GS reg
11513 +
11514 +#ifdef CONFIG_CC_STACKPROTECTOR
11515 movl $(__KERNEL_STACK_CANARY), \reg
11516 +#elif defined(CONFIG_PAX_MEMORY_UDEREF)
11517 + movl $(__USER_DS), \reg
11518 +#else
11519 + xorl \reg, \reg
11520 +#endif
11521 +
11522 movl \reg, %gs
11523 .endm
11524
11525 #endif /* CONFIG_X86_32_LAZY_GS */
11526
11527 -.macro SAVE_ALL
11528 +.macro pax_enter_kernel
11529 +#ifdef CONFIG_PAX_KERNEXEC
11530 + call pax_enter_kernel
11531 +#endif
11532 +.endm
11533 +
11534 +.macro pax_exit_kernel
11535 +#ifdef CONFIG_PAX_KERNEXEC
11536 + call pax_exit_kernel
11537 +#endif
11538 +.endm
11539 +
11540 +#ifdef CONFIG_PAX_KERNEXEC
11541 +ENTRY(pax_enter_kernel)
11542 +#ifdef CONFIG_PARAVIRT
11543 + pushl %eax
11544 + pushl %ecx
11545 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
11546 + mov %eax, %esi
11547 +#else
11548 + mov %cr0, %esi
11549 +#endif
11550 + bts $16, %esi
11551 + jnc 1f
11552 + mov %cs, %esi
11553 + cmp $__KERNEL_CS, %esi
11554 + jz 3f
11555 + ljmp $__KERNEL_CS, $3f
11556 +1: ljmp $__KERNEXEC_KERNEL_CS, $2f
11557 +2:
11558 +#ifdef CONFIG_PARAVIRT
11559 + mov %esi, %eax
11560 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
11561 +#else
11562 + mov %esi, %cr0
11563 +#endif
11564 +3:
11565 +#ifdef CONFIG_PARAVIRT
11566 + popl %ecx
11567 + popl %eax
11568 +#endif
11569 + ret
11570 +ENDPROC(pax_enter_kernel)
11571 +
11572 +ENTRY(pax_exit_kernel)
11573 +#ifdef CONFIG_PARAVIRT
11574 + pushl %eax
11575 + pushl %ecx
11576 +#endif
11577 + mov %cs, %esi
11578 + cmp $__KERNEXEC_KERNEL_CS, %esi
11579 + jnz 2f
11580 +#ifdef CONFIG_PARAVIRT
11581 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
11582 + mov %eax, %esi
11583 +#else
11584 + mov %cr0, %esi
11585 +#endif
11586 + btr $16, %esi
11587 + ljmp $__KERNEL_CS, $1f
11588 +1:
11589 +#ifdef CONFIG_PARAVIRT
11590 + mov %esi, %eax
11591 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
11592 +#else
11593 + mov %esi, %cr0
11594 +#endif
11595 +2:
11596 +#ifdef CONFIG_PARAVIRT
11597 + popl %ecx
11598 + popl %eax
11599 +#endif
11600 + ret
11601 +ENDPROC(pax_exit_kernel)
11602 +#endif
11603 +
11604 +.macro pax_erase_kstack
11605 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
11606 + call pax_erase_kstack
11607 +#endif
11608 +.endm
11609 +
11610 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
11611 +/*
11612 + * ebp: thread_info
11613 + * ecx, edx: can be clobbered
11614 + */
11615 +ENTRY(pax_erase_kstack)
11616 + pushl %edi
11617 + pushl %eax
11618 +
11619 + mov TI_lowest_stack(%ebp), %edi
11620 + mov $-0xBEEF, %eax
11621 + std
11622 +
11623 +1: mov %edi, %ecx
11624 + and $THREAD_SIZE_asm - 1, %ecx
11625 + shr $2, %ecx
11626 + repne scasl
11627 + jecxz 2f
11628 +
11629 + cmp $2*16, %ecx
11630 + jc 2f
11631 +
11632 + mov $2*16, %ecx
11633 + repe scasl
11634 + jecxz 2f
11635 + jne 1b
11636 +
11637 +2: cld
11638 + mov %esp, %ecx
11639 + sub %edi, %ecx
11640 + shr $2, %ecx
11641 + rep stosl
11642 +
11643 + mov TI_task_thread_sp0(%ebp), %edi
11644 + sub $128, %edi
11645 + mov %edi, TI_lowest_stack(%ebp)
11646 +
11647 + popl %eax
11648 + popl %edi
11649 + ret
11650 +ENDPROC(pax_erase_kstack)
11651 +#endif
11652 +
11653 +.macro __SAVE_ALL _DS
11654 cld
11655 PUSH_GS
11656 pushl_cfi %fs
11657 @@ -214,7 +347,7 @@
11658 CFI_REL_OFFSET ecx, 0
11659 pushl_cfi %ebx
11660 CFI_REL_OFFSET ebx, 0
11661 - movl $(__USER_DS), %edx
11662 + movl $\_DS, %edx
11663 movl %edx, %ds
11664 movl %edx, %es
11665 movl $(__KERNEL_PERCPU), %edx
11666 @@ -222,6 +355,15 @@
11667 SET_KERNEL_GS %edx
11668 .endm
11669
11670 +.macro SAVE_ALL
11671 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
11672 + __SAVE_ALL __KERNEL_DS
11673 + pax_enter_kernel
11674 +#else
11675 + __SAVE_ALL __USER_DS
11676 +#endif
11677 +.endm
11678 +
11679 .macro RESTORE_INT_REGS
11680 popl_cfi %ebx
11681 CFI_RESTORE ebx
11682 @@ -307,7 +449,7 @@ ENTRY(ret_from_fork)
11683 popfl_cfi
11684 jmp syscall_exit
11685 CFI_ENDPROC
11686 -END(ret_from_fork)
11687 +ENDPROC(ret_from_fork)
11688
11689 /*
11690 * Interrupt exit functions should be protected against kprobes
11691 @@ -332,7 +474,15 @@ check_userspace:
11692 movb PT_CS(%esp), %al
11693 andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
11694 cmpl $USER_RPL, %eax
11695 +
11696 +#ifdef CONFIG_PAX_KERNEXEC
11697 + jae resume_userspace
11698 +
11699 + PAX_EXIT_KERNEL
11700 + jmp resume_kernel
11701 +#else
11702 jb resume_kernel # not returning to v8086 or userspace
11703 +#endif
11704
11705 ENTRY(resume_userspace)
11706 LOCKDEP_SYS_EXIT
11707 @@ -344,8 +494,8 @@ ENTRY(resume_userspace)
11708 andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
11709 # int/exception return?
11710 jne work_pending
11711 - jmp restore_all
11712 -END(ret_from_exception)
11713 + jmp restore_all_pax
11714 +ENDPROC(ret_from_exception)
11715
11716 #ifdef CONFIG_PREEMPT
11717 ENTRY(resume_kernel)
11718 @@ -360,7 +510,7 @@ need_resched:
11719 jz restore_all
11720 call preempt_schedule_irq
11721 jmp need_resched
11722 -END(resume_kernel)
11723 +ENDPROC(resume_kernel)
11724 #endif
11725 CFI_ENDPROC
11726 /*
11727 @@ -394,23 +544,34 @@ sysenter_past_esp:
11728 /*CFI_REL_OFFSET cs, 0*/
11729 /*
11730 * Push current_thread_info()->sysenter_return to the stack.
11731 - * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
11732 - * pushed above; +8 corresponds to copy_thread's esp0 setting.
11733 */
11734 - pushl_cfi ((TI_sysenter_return)-THREAD_SIZE+8+4*4)(%esp)
11735 + pushl_cfi $0
11736 CFI_REL_OFFSET eip, 0
11737
11738 pushl_cfi %eax
11739 SAVE_ALL
11740 + GET_THREAD_INFO(%ebp)
11741 + movl TI_sysenter_return(%ebp),%ebp
11742 + movl %ebp,PT_EIP(%esp)
11743 ENABLE_INTERRUPTS(CLBR_NONE)
11744
11745 /*
11746 * Load the potential sixth argument from user stack.
11747 * Careful about security.
11748 */
11749 + movl PT_OLDESP(%esp),%ebp
11750 +
11751 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11752 + mov PT_OLDSS(%esp),%ds
11753 +1: movl %ds:(%ebp),%ebp
11754 + push %ss
11755 + pop %ds
11756 +#else
11757 cmpl $__PAGE_OFFSET-3,%ebp
11758 jae syscall_fault
11759 1: movl (%ebp),%ebp
11760 +#endif
11761 +
11762 movl %ebp,PT_EBP(%esp)
11763 .section __ex_table,"a"
11764 .align 4
11765 @@ -433,12 +594,24 @@ sysenter_do_call:
11766 testl $_TIF_ALLWORK_MASK, %ecx
11767 jne sysexit_audit
11768 sysenter_exit:
11769 +
11770 +#ifdef CONFIG_PAX_RANDKSTACK
11771 + pushl_cfi %eax
11772 + movl %esp, %eax
11773 + call pax_randomize_kstack
11774 + popl_cfi %eax
11775 +#endif
11776 +
11777 + pax_erase_kstack
11778 +
11779 /* if something modifies registers it must also disable sysexit */
11780 movl PT_EIP(%esp), %edx
11781 movl PT_OLDESP(%esp), %ecx
11782 xorl %ebp,%ebp
11783 TRACE_IRQS_ON
11784 1: mov PT_FS(%esp), %fs
11785 +2: mov PT_DS(%esp), %ds
11786 +3: mov PT_ES(%esp), %es
11787 PTGS_TO_GS
11788 ENABLE_INTERRUPTS_SYSEXIT
11789
11790 @@ -455,6 +628,9 @@ sysenter_audit:
11791 movl %eax,%edx /* 2nd arg: syscall number */
11792 movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
11793 call audit_syscall_entry
11794 +
11795 + pax_erase_kstack
11796 +
11797 pushl_cfi %ebx
11798 movl PT_EAX(%esp),%eax /* reload syscall number */
11799 jmp sysenter_do_call
11800 @@ -481,11 +657,17 @@ sysexit_audit:
11801
11802 CFI_ENDPROC
11803 .pushsection .fixup,"ax"
11804 -2: movl $0,PT_FS(%esp)
11805 +4: movl $0,PT_FS(%esp)
11806 + jmp 1b
11807 +5: movl $0,PT_DS(%esp)
11808 + jmp 1b
11809 +6: movl $0,PT_ES(%esp)
11810 jmp 1b
11811 .section __ex_table,"a"
11812 .align 4
11813 - .long 1b,2b
11814 + .long 1b,4b
11815 + .long 2b,5b
11816 + .long 3b,6b
11817 .popsection
11818 PTGS_TO_GS_EX
11819 ENDPROC(ia32_sysenter_target)
11820 @@ -518,6 +700,15 @@ syscall_exit:
11821 testl $_TIF_ALLWORK_MASK, %ecx # current->work
11822 jne syscall_exit_work
11823
11824 +restore_all_pax:
11825 +
11826 +#ifdef CONFIG_PAX_RANDKSTACK
11827 + movl %esp, %eax
11828 + call pax_randomize_kstack
11829 +#endif
11830 +
11831 + pax_erase_kstack
11832 +
11833 restore_all:
11834 TRACE_IRQS_IRET
11835 restore_all_notrace:
11836 @@ -577,14 +768,34 @@ ldt_ss:
11837 * compensating for the offset by changing to the ESPFIX segment with
11838 * a base address that matches for the difference.
11839 */
11840 -#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS * 8)
11841 +#define GDT_ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)(%ebx)
11842 mov %esp, %edx /* load kernel esp */
11843 mov PT_OLDESP(%esp), %eax /* load userspace esp */
11844 mov %dx, %ax /* eax: new kernel esp */
11845 sub %eax, %edx /* offset (low word is 0) */
11846 +#ifdef CONFIG_SMP
11847 + movl PER_CPU_VAR(cpu_number), %ebx
11848 + shll $PAGE_SHIFT_asm, %ebx
11849 + addl $cpu_gdt_table, %ebx
11850 +#else
11851 + movl $cpu_gdt_table, %ebx
11852 +#endif
11853 shr $16, %edx
11854 - mov %dl, GDT_ESPFIX_SS + 4 /* bits 16..23 */
11855 - mov %dh, GDT_ESPFIX_SS + 7 /* bits 24..31 */
11856 +
11857 +#ifdef CONFIG_PAX_KERNEXEC
11858 + mov %cr0, %esi
11859 + btr $16, %esi
11860 + mov %esi, %cr0
11861 +#endif
11862 +
11863 + mov %dl, 4 + GDT_ESPFIX_SS /* bits 16..23 */
11864 + mov %dh, 7 + GDT_ESPFIX_SS /* bits 24..31 */
11865 +
11866 +#ifdef CONFIG_PAX_KERNEXEC
11867 + bts $16, %esi
11868 + mov %esi, %cr0
11869 +#endif
11870 +
11871 pushl_cfi $__ESPFIX_SS
11872 pushl_cfi %eax /* new kernel esp */
11873 /* Disable interrupts, but do not irqtrace this section: we
11874 @@ -613,34 +824,28 @@ work_resched:
11875 movl TI_flags(%ebp), %ecx
11876 andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
11877 # than syscall tracing?
11878 - jz restore_all
11879 + jz restore_all_pax
11880 testb $_TIF_NEED_RESCHED, %cl
11881 jnz work_resched
11882
11883 work_notifysig: # deal with pending signals and
11884 # notify-resume requests
11885 + movl %esp, %eax
11886 #ifdef CONFIG_VM86
11887 testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
11888 - movl %esp, %eax
11889 - jne work_notifysig_v86 # returning to kernel-space or
11890 + jz 1f # returning to kernel-space or
11891 # vm86-space
11892 - xorl %edx, %edx
11893 - call do_notify_resume
11894 - jmp resume_userspace_sig
11895
11896 - ALIGN
11897 -work_notifysig_v86:
11898 pushl_cfi %ecx # save ti_flags for do_notify_resume
11899 call save_v86_state # %eax contains pt_regs pointer
11900 popl_cfi %ecx
11901 movl %eax, %esp
11902 -#else
11903 - movl %esp, %eax
11904 +1:
11905 #endif
11906 xorl %edx, %edx
11907 call do_notify_resume
11908 jmp resume_userspace_sig
11909 -END(work_pending)
11910 +ENDPROC(work_pending)
11911
11912 # perform syscall exit tracing
11913 ALIGN
11914 @@ -648,11 +853,14 @@ syscall_trace_entry:
11915 movl $-ENOSYS,PT_EAX(%esp)
11916 movl %esp, %eax
11917 call syscall_trace_enter
11918 +
11919 + pax_erase_kstack
11920 +
11921 /* What it returned is what we'll actually use. */
11922 cmpl $(nr_syscalls), %eax
11923 jnae syscall_call
11924 jmp syscall_exit
11925 -END(syscall_trace_entry)
11926 +ENDPROC(syscall_trace_entry)
11927
11928 # perform syscall exit tracing
11929 ALIGN
11930 @@ -665,20 +873,24 @@ syscall_exit_work:
11931 movl %esp, %eax
11932 call syscall_trace_leave
11933 jmp resume_userspace
11934 -END(syscall_exit_work)
11935 +ENDPROC(syscall_exit_work)
11936 CFI_ENDPROC
11937
11938 RING0_INT_FRAME # can't unwind into user space anyway
11939 syscall_fault:
11940 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11941 + push %ss
11942 + pop %ds
11943 +#endif
11944 GET_THREAD_INFO(%ebp)
11945 movl $-EFAULT,PT_EAX(%esp)
11946 jmp resume_userspace
11947 -END(syscall_fault)
11948 +ENDPROC(syscall_fault)
11949
11950 syscall_badsys:
11951 movl $-ENOSYS,PT_EAX(%esp)
11952 jmp resume_userspace
11953 -END(syscall_badsys)
11954 +ENDPROC(syscall_badsys)
11955 CFI_ENDPROC
11956 /*
11957 * End of kprobes section
11958 @@ -752,6 +964,36 @@ ptregs_clone:
11959 CFI_ENDPROC
11960 ENDPROC(ptregs_clone)
11961
11962 + ALIGN;
11963 +ENTRY(kernel_execve)
11964 + CFI_STARTPROC
11965 + pushl_cfi %ebp
11966 + sub $PT_OLDSS+4,%esp
11967 + pushl_cfi %edi
11968 + pushl_cfi %ecx
11969 + pushl_cfi %eax
11970 + lea 3*4(%esp),%edi
11971 + mov $PT_OLDSS/4+1,%ecx
11972 + xorl %eax,%eax
11973 + rep stosl
11974 + popl_cfi %eax
11975 + popl_cfi %ecx
11976 + popl_cfi %edi
11977 + movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
11978 + pushl_cfi %esp
11979 + call sys_execve
11980 + add $4,%esp
11981 + CFI_ADJUST_CFA_OFFSET -4
11982 + GET_THREAD_INFO(%ebp)
11983 + test %eax,%eax
11984 + jz syscall_exit
11985 + add $PT_OLDSS+4,%esp
11986 + CFI_ADJUST_CFA_OFFSET -PT_OLDSS-4
11987 + popl_cfi %ebp
11988 + ret
11989 + CFI_ENDPROC
11990 +ENDPROC(kernel_execve)
11991 +
11992 .macro FIXUP_ESPFIX_STACK
11993 /*
11994 * Switch back for ESPFIX stack to the normal zerobased stack
11995 @@ -761,8 +1003,15 @@ ENDPROC(ptregs_clone)
11996 * normal stack and adjusts ESP with the matching offset.
11997 */
11998 /* fixup the stack */
11999 - mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */
12000 - mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */
12001 +#ifdef CONFIG_SMP
12002 + movl PER_CPU_VAR(cpu_number), %ebx
12003 + shll $PAGE_SHIFT_asm, %ebx
12004 + addl $cpu_gdt_table, %ebx
12005 +#else
12006 + movl $cpu_gdt_table, %ebx
12007 +#endif
12008 + mov 4 + GDT_ESPFIX_SS, %al /* bits 16..23 */
12009 + mov 7 + GDT_ESPFIX_SS, %ah /* bits 24..31 */
12010 shl $16, %eax
12011 addl %esp, %eax /* the adjusted stack pointer */
12012 pushl_cfi $__KERNEL_DS
12013 @@ -815,7 +1064,7 @@ vector=vector+1
12014 .endr
12015 2: jmp common_interrupt
12016 .endr
12017 -END(irq_entries_start)
12018 +ENDPROC(irq_entries_start)
12019
12020 .previous
12021 END(interrupt)
12022 @@ -863,7 +1112,7 @@ ENTRY(coprocessor_error)
12023 pushl_cfi $do_coprocessor_error
12024 jmp error_code
12025 CFI_ENDPROC
12026 -END(coprocessor_error)
12027 +ENDPROC(coprocessor_error)
12028
12029 ENTRY(simd_coprocessor_error)
12030 RING0_INT_FRAME
12031 @@ -889,7 +1138,7 @@ ENTRY(simd_coprocessor_error)
12032 #endif
12033 jmp error_code
12034 CFI_ENDPROC
12035 -END(simd_coprocessor_error)
12036 +ENDPROC(simd_coprocessor_error)
12037
12038 ENTRY(device_not_available)
12039 RING0_INT_FRAME
12040 @@ -897,7 +1146,7 @@ ENTRY(device_not_available)
12041 pushl_cfi $do_device_not_available
12042 jmp error_code
12043 CFI_ENDPROC
12044 -END(device_not_available)
12045 +ENDPROC(device_not_available)
12046
12047 #ifdef CONFIG_PARAVIRT
12048 ENTRY(native_iret)
12049 @@ -906,12 +1155,12 @@ ENTRY(native_iret)
12050 .align 4
12051 .long native_iret, iret_exc
12052 .previous
12053 -END(native_iret)
12054 +ENDPROC(native_iret)
12055
12056 ENTRY(native_irq_enable_sysexit)
12057 sti
12058 sysexit
12059 -END(native_irq_enable_sysexit)
12060 +ENDPROC(native_irq_enable_sysexit)
12061 #endif
12062
12063 ENTRY(overflow)
12064 @@ -920,7 +1169,7 @@ ENTRY(overflow)
12065 pushl_cfi $do_overflow
12066 jmp error_code
12067 CFI_ENDPROC
12068 -END(overflow)
12069 +ENDPROC(overflow)
12070
12071 ENTRY(bounds)
12072 RING0_INT_FRAME
12073 @@ -928,7 +1177,7 @@ ENTRY(bounds)
12074 pushl_cfi $do_bounds
12075 jmp error_code
12076 CFI_ENDPROC
12077 -END(bounds)
12078 +ENDPROC(bounds)
12079
12080 ENTRY(invalid_op)
12081 RING0_INT_FRAME
12082 @@ -936,7 +1185,7 @@ ENTRY(invalid_op)
12083 pushl_cfi $do_invalid_op
12084 jmp error_code
12085 CFI_ENDPROC
12086 -END(invalid_op)
12087 +ENDPROC(invalid_op)
12088
12089 ENTRY(coprocessor_segment_overrun)
12090 RING0_INT_FRAME
12091 @@ -944,35 +1193,35 @@ ENTRY(coprocessor_segment_overrun)
12092 pushl_cfi $do_coprocessor_segment_overrun
12093 jmp error_code
12094 CFI_ENDPROC
12095 -END(coprocessor_segment_overrun)
12096 +ENDPROC(coprocessor_segment_overrun)
12097
12098 ENTRY(invalid_TSS)
12099 RING0_EC_FRAME
12100 pushl_cfi $do_invalid_TSS
12101 jmp error_code
12102 CFI_ENDPROC
12103 -END(invalid_TSS)
12104 +ENDPROC(invalid_TSS)
12105
12106 ENTRY(segment_not_present)
12107 RING0_EC_FRAME
12108 pushl_cfi $do_segment_not_present
12109 jmp error_code
12110 CFI_ENDPROC
12111 -END(segment_not_present)
12112 +ENDPROC(segment_not_present)
12113
12114 ENTRY(stack_segment)
12115 RING0_EC_FRAME
12116 pushl_cfi $do_stack_segment
12117 jmp error_code
12118 CFI_ENDPROC
12119 -END(stack_segment)
12120 +ENDPROC(stack_segment)
12121
12122 ENTRY(alignment_check)
12123 RING0_EC_FRAME
12124 pushl_cfi $do_alignment_check
12125 jmp error_code
12126 CFI_ENDPROC
12127 -END(alignment_check)
12128 +ENDPROC(alignment_check)
12129
12130 ENTRY(divide_error)
12131 RING0_INT_FRAME
12132 @@ -980,7 +1229,7 @@ ENTRY(divide_error)
12133 pushl_cfi $do_divide_error
12134 jmp error_code
12135 CFI_ENDPROC
12136 -END(divide_error)
12137 +ENDPROC(divide_error)
12138
12139 #ifdef CONFIG_X86_MCE
12140 ENTRY(machine_check)
12141 @@ -989,7 +1238,7 @@ ENTRY(machine_check)
12142 pushl_cfi machine_check_vector
12143 jmp error_code
12144 CFI_ENDPROC
12145 -END(machine_check)
12146 +ENDPROC(machine_check)
12147 #endif
12148
12149 ENTRY(spurious_interrupt_bug)
12150 @@ -998,7 +1247,7 @@ ENTRY(spurious_interrupt_bug)
12151 pushl_cfi $do_spurious_interrupt_bug
12152 jmp error_code
12153 CFI_ENDPROC
12154 -END(spurious_interrupt_bug)
12155 +ENDPROC(spurious_interrupt_bug)
12156 /*
12157 * End of kprobes section
12158 */
12159 @@ -1113,7 +1362,7 @@ BUILD_INTERRUPT3(xen_hvm_callback_vector
12160
12161 ENTRY(mcount)
12162 ret
12163 -END(mcount)
12164 +ENDPROC(mcount)
12165
12166 ENTRY(ftrace_caller)
12167 cmpl $0, function_trace_stop
12168 @@ -1142,7 +1391,7 @@ ftrace_graph_call:
12169 .globl ftrace_stub
12170 ftrace_stub:
12171 ret
12172 -END(ftrace_caller)
12173 +ENDPROC(ftrace_caller)
12174
12175 #else /* ! CONFIG_DYNAMIC_FTRACE */
12176
12177 @@ -1178,7 +1427,7 @@ trace:
12178 popl %ecx
12179 popl %eax
12180 jmp ftrace_stub
12181 -END(mcount)
12182 +ENDPROC(mcount)
12183 #endif /* CONFIG_DYNAMIC_FTRACE */
12184 #endif /* CONFIG_FUNCTION_TRACER */
12185
12186 @@ -1199,7 +1448,7 @@ ENTRY(ftrace_graph_caller)
12187 popl %ecx
12188 popl %eax
12189 ret
12190 -END(ftrace_graph_caller)
12191 +ENDPROC(ftrace_graph_caller)
12192
12193 .globl return_to_handler
12194 return_to_handler:
12195 @@ -1213,7 +1462,6 @@ return_to_handler:
12196 jmp *%ecx
12197 #endif
12198
12199 -.section .rodata,"a"
12200 #include "syscall_table_32.S"
12201
12202 syscall_table_size=(.-sys_call_table)
12203 @@ -1259,15 +1507,18 @@ error_code:
12204 movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
12205 REG_TO_PTGS %ecx
12206 SET_KERNEL_GS %ecx
12207 - movl $(__USER_DS), %ecx
12208 + movl $(__KERNEL_DS), %ecx
12209 movl %ecx, %ds
12210 movl %ecx, %es
12211 +
12212 + pax_enter_kernel
12213 +
12214 TRACE_IRQS_OFF
12215 movl %esp,%eax # pt_regs pointer
12216 call *%edi
12217 jmp ret_from_exception
12218 CFI_ENDPROC
12219 -END(page_fault)
12220 +ENDPROC(page_fault)
12221
12222 /*
12223 * Debug traps and NMI can happen at the one SYSENTER instruction
12224 @@ -1309,7 +1560,7 @@ debug_stack_correct:
12225 call do_debug
12226 jmp ret_from_exception
12227 CFI_ENDPROC
12228 -END(debug)
12229 +ENDPROC(debug)
12230
12231 /*
12232 * NMI is doubly nasty. It can happen _while_ we're handling
12233 @@ -1346,6 +1597,9 @@ nmi_stack_correct:
12234 xorl %edx,%edx # zero error code
12235 movl %esp,%eax # pt_regs pointer
12236 call do_nmi
12237 +
12238 + pax_exit_kernel
12239 +
12240 jmp restore_all_notrace
12241 CFI_ENDPROC
12242
12243 @@ -1382,12 +1636,15 @@ nmi_espfix_stack:
12244 FIXUP_ESPFIX_STACK # %eax == %esp
12245 xorl %edx,%edx # zero error code
12246 call do_nmi
12247 +
12248 + pax_exit_kernel
12249 +
12250 RESTORE_REGS
12251 lss 12+4(%esp), %esp # back to espfix stack
12252 CFI_ADJUST_CFA_OFFSET -24
12253 jmp irq_return
12254 CFI_ENDPROC
12255 -END(nmi)
12256 +ENDPROC(nmi)
12257
12258 ENTRY(int3)
12259 RING0_INT_FRAME
12260 @@ -1399,14 +1656,14 @@ ENTRY(int3)
12261 call do_int3
12262 jmp ret_from_exception
12263 CFI_ENDPROC
12264 -END(int3)
12265 +ENDPROC(int3)
12266
12267 ENTRY(general_protection)
12268 RING0_EC_FRAME
12269 pushl_cfi $do_general_protection
12270 jmp error_code
12271 CFI_ENDPROC
12272 -END(general_protection)
12273 +ENDPROC(general_protection)
12274
12275 #ifdef CONFIG_KVM_GUEST
12276 ENTRY(async_page_fault)
12277 @@ -1414,7 +1671,7 @@ ENTRY(async_page_fault)
12278 pushl_cfi $do_async_page_fault
12279 jmp error_code
12280 CFI_ENDPROC
12281 -END(async_page_fault)
12282 +ENDPROC(async_page_fault)
12283 #endif
12284
12285 /*
12286 diff -urNp linux-3.0.9/arch/x86/kernel/entry_64.S linux-3.0.9/arch/x86/kernel/entry_64.S
12287 --- linux-3.0.9/arch/x86/kernel/entry_64.S 2011-11-11 13:12:24.000000000 -0500
12288 +++ linux-3.0.9/arch/x86/kernel/entry_64.S 2011-11-15 20:02:59.000000000 -0500
12289 @@ -53,6 +53,8 @@
12290 #include <asm/paravirt.h>
12291 #include <asm/ftrace.h>
12292 #include <asm/percpu.h>
12293 +#include <asm/pgtable.h>
12294 +#include <asm/alternative-asm.h>
12295
12296 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
12297 #include <linux/elf-em.h>
12298 @@ -66,8 +68,9 @@
12299 #ifdef CONFIG_FUNCTION_TRACER
12300 #ifdef CONFIG_DYNAMIC_FTRACE
12301 ENTRY(mcount)
12302 + pax_force_retaddr
12303 retq
12304 -END(mcount)
12305 +ENDPROC(mcount)
12306
12307 ENTRY(ftrace_caller)
12308 cmpl $0, function_trace_stop
12309 @@ -90,8 +93,9 @@ GLOBAL(ftrace_graph_call)
12310 #endif
12311
12312 GLOBAL(ftrace_stub)
12313 + pax_force_retaddr
12314 retq
12315 -END(ftrace_caller)
12316 +ENDPROC(ftrace_caller)
12317
12318 #else /* ! CONFIG_DYNAMIC_FTRACE */
12319 ENTRY(mcount)
12320 @@ -110,6 +114,7 @@ ENTRY(mcount)
12321 #endif
12322
12323 GLOBAL(ftrace_stub)
12324 + pax_force_retaddr
12325 retq
12326
12327 trace:
12328 @@ -119,12 +124,13 @@ trace:
12329 movq 8(%rbp), %rsi
12330 subq $MCOUNT_INSN_SIZE, %rdi
12331
12332 + pax_force_fptr ftrace_trace_function
12333 call *ftrace_trace_function
12334
12335 MCOUNT_RESTORE_FRAME
12336
12337 jmp ftrace_stub
12338 -END(mcount)
12339 +ENDPROC(mcount)
12340 #endif /* CONFIG_DYNAMIC_FTRACE */
12341 #endif /* CONFIG_FUNCTION_TRACER */
12342
12343 @@ -144,8 +150,9 @@ ENTRY(ftrace_graph_caller)
12344
12345 MCOUNT_RESTORE_FRAME
12346
12347 + pax_force_retaddr
12348 retq
12349 -END(ftrace_graph_caller)
12350 +ENDPROC(ftrace_graph_caller)
12351
12352 GLOBAL(return_to_handler)
12353 subq $24, %rsp
12354 @@ -161,6 +168,7 @@ GLOBAL(return_to_handler)
12355 movq 8(%rsp), %rdx
12356 movq (%rsp), %rax
12357 addq $24, %rsp
12358 + pax_force_fptr %rdi
12359 jmp *%rdi
12360 #endif
12361
12362 @@ -176,6 +184,269 @@ ENTRY(native_usergs_sysret64)
12363 ENDPROC(native_usergs_sysret64)
12364 #endif /* CONFIG_PARAVIRT */
12365
12366 + .macro ljmpq sel, off
12367 +#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
12368 + .byte 0x48; ljmp *1234f(%rip)
12369 + .pushsection .rodata
12370 + .align 16
12371 + 1234: .quad \off; .word \sel
12372 + .popsection
12373 +#else
12374 + pushq $\sel
12375 + pushq $\off
12376 + lretq
12377 +#endif
12378 + .endm
12379 +
12380 + .macro pax_enter_kernel
12381 +#ifdef CONFIG_PAX_KERNEXEC
12382 + call pax_enter_kernel
12383 +#endif
12384 + .endm
12385 +
12386 + .macro pax_exit_kernel
12387 +#ifdef CONFIG_PAX_KERNEXEC
12388 + call pax_exit_kernel
12389 +#endif
12390 + .endm
12391 +
12392 +#ifdef CONFIG_PAX_KERNEXEC
12393 +ENTRY(pax_enter_kernel)
12394 + pushq %rdi
12395 +
12396 +#ifdef CONFIG_PARAVIRT
12397 + PV_SAVE_REGS(CLBR_RDI)
12398 +#endif
12399 +
12400 + GET_CR0_INTO_RDI
12401 + bts $16,%rdi
12402 + jnc 1f
12403 + mov %cs,%edi
12404 + cmp $__KERNEL_CS,%edi
12405 + jz 3f
12406 + ljmpq __KERNEL_CS,3f
12407 +1: ljmpq __KERNEXEC_KERNEL_CS,2f
12408 +2: SET_RDI_INTO_CR0
12409 +3:
12410 +
12411 +#ifdef CONFIG_PARAVIRT
12412 + PV_RESTORE_REGS(CLBR_RDI)
12413 +#endif
12414 +
12415 + popq %rdi
12416 + pax_force_retaddr
12417 + retq
12418 +ENDPROC(pax_enter_kernel)
12419 +
12420 +ENTRY(pax_exit_kernel)
12421 + pushq %rdi
12422 +
12423 +#ifdef CONFIG_PARAVIRT
12424 + PV_SAVE_REGS(CLBR_RDI)
12425 +#endif
12426 +
12427 + mov %cs,%rdi
12428 + cmp $__KERNEXEC_KERNEL_CS,%edi
12429 + jnz 2f
12430 + GET_CR0_INTO_RDI
12431 + btr $16,%rdi
12432 + ljmpq __KERNEL_CS,1f
12433 +1: SET_RDI_INTO_CR0
12434 +2:
12435 +
12436 +#ifdef CONFIG_PARAVIRT
12437 + PV_RESTORE_REGS(CLBR_RDI);
12438 +#endif
12439 +
12440 + popq %rdi
12441 + pax_force_retaddr
12442 + retq
12443 +ENDPROC(pax_exit_kernel)
12444 +#endif
12445 +
12446 + .macro pax_enter_kernel_user
12447 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12448 + call pax_enter_kernel_user
12449 +#endif
12450 + .endm
12451 +
12452 + .macro pax_exit_kernel_user
12453 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12454 + call pax_exit_kernel_user
12455 +#endif
12456 +#ifdef CONFIG_PAX_RANDKSTACK
12457 + push %rax
12458 + call pax_randomize_kstack
12459 + pop %rax
12460 +#endif
12461 + .endm
12462 +
12463 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12464 +ENTRY(pax_enter_kernel_user)
12465 + pushq %rdi
12466 + pushq %rbx
12467 +
12468 +#ifdef CONFIG_PARAVIRT
12469 + PV_SAVE_REGS(CLBR_RDI)
12470 +#endif
12471 +
12472 + GET_CR3_INTO_RDI
12473 + mov %rdi,%rbx
12474 + add $__START_KERNEL_map,%rbx
12475 + sub phys_base(%rip),%rbx
12476 +
12477 +#ifdef CONFIG_PARAVIRT
12478 + pushq %rdi
12479 + cmpl $0, pv_info+PARAVIRT_enabled
12480 + jz 1f
12481 + i = 0
12482 + .rept USER_PGD_PTRS
12483 + mov i*8(%rbx),%rsi
12484 + mov $0,%sil
12485 + lea i*8(%rbx),%rdi
12486 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
12487 + i = i + 1
12488 + .endr
12489 + jmp 2f
12490 +1:
12491 +#endif
12492 +
12493 + i = 0
12494 + .rept USER_PGD_PTRS
12495 + movb $0,i*8(%rbx)
12496 + i = i + 1
12497 + .endr
12498 +
12499 +#ifdef CONFIG_PARAVIRT
12500 +2: popq %rdi
12501 +#endif
12502 + SET_RDI_INTO_CR3
12503 +
12504 +#ifdef CONFIG_PAX_KERNEXEC
12505 + GET_CR0_INTO_RDI
12506 + bts $16,%rdi
12507 + SET_RDI_INTO_CR0
12508 +#endif
12509 +
12510 +#ifdef CONFIG_PARAVIRT
12511 + PV_RESTORE_REGS(CLBR_RDI)
12512 +#endif
12513 +
12514 + popq %rbx
12515 + popq %rdi
12516 + pax_force_retaddr
12517 + retq
12518 +ENDPROC(pax_enter_kernel_user)
12519 +
12520 +ENTRY(pax_exit_kernel_user)
12521 + push %rdi
12522 +
12523 +#ifdef CONFIG_PARAVIRT
12524 + pushq %rbx
12525 + PV_SAVE_REGS(CLBR_RDI)
12526 +#endif
12527 +
12528 +#ifdef CONFIG_PAX_KERNEXEC
12529 + GET_CR0_INTO_RDI
12530 + btr $16,%rdi
12531 + SET_RDI_INTO_CR0
12532 +#endif
12533 +
12534 + GET_CR3_INTO_RDI
12535 + add $__START_KERNEL_map,%rdi
12536 + sub phys_base(%rip),%rdi
12537 +
12538 +#ifdef CONFIG_PARAVIRT
12539 + cmpl $0, pv_info+PARAVIRT_enabled
12540 + jz 1f
12541 + mov %rdi,%rbx
12542 + i = 0
12543 + .rept USER_PGD_PTRS
12544 + mov i*8(%rbx),%rsi
12545 + mov $0x67,%sil
12546 + lea i*8(%rbx),%rdi
12547 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
12548 + i = i + 1
12549 + .endr
12550 + jmp 2f
12551 +1:
12552 +#endif
12553 +
12554 + i = 0
12555 + .rept USER_PGD_PTRS
12556 + movb $0x67,i*8(%rdi)
12557 + i = i + 1
12558 + .endr
12559 +
12560 +#ifdef CONFIG_PARAVIRT
12561 +2: PV_RESTORE_REGS(CLBR_RDI)
12562 + popq %rbx
12563 +#endif
12564 +
12565 + popq %rdi
12566 + pax_force_retaddr
12567 + retq
12568 +ENDPROC(pax_exit_kernel_user)
12569 +#endif
12570 +
12571 + .macro pax_erase_kstack
12572 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12573 + call pax_erase_kstack
12574 +#endif
12575 + .endm
12576 +
12577 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
12578 +/*
12579 + * r10: thread_info
12580 + * rcx, rdx: can be clobbered
12581 + */
12582 +ENTRY(pax_erase_kstack)
12583 + pushq %rdi
12584 + pushq %rax
12585 + pushq %r10
12586 +
12587 + GET_THREAD_INFO(%r10)
12588 + mov TI_lowest_stack(%r10), %rdi
12589 + mov $-0xBEEF, %rax
12590 + std
12591 +
12592 +1: mov %edi, %ecx
12593 + and $THREAD_SIZE_asm - 1, %ecx
12594 + shr $3, %ecx
12595 + repne scasq
12596 + jecxz 2f
12597 +
12598 + cmp $2*8, %ecx
12599 + jc 2f
12600 +
12601 + mov $2*8, %ecx
12602 + repe scasq
12603 + jecxz 2f
12604 + jne 1b
12605 +
12606 +2: cld
12607 + mov %esp, %ecx
12608 + sub %edi, %ecx
12609 +
12610 + cmp $THREAD_SIZE_asm, %rcx
12611 + jb 3f
12612 + ud2
12613 +3:
12614 +
12615 + shr $3, %ecx
12616 + rep stosq
12617 +
12618 + mov TI_task_thread_sp0(%r10), %rdi
12619 + sub $256, %rdi
12620 + mov %rdi, TI_lowest_stack(%r10)
12621 +
12622 + popq %r10
12623 + popq %rax
12624 + popq %rdi
12625 + pax_force_retaddr
12626 + ret
12627 +ENDPROC(pax_erase_kstack)
12628 +#endif
12629
12630 .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
12631 #ifdef CONFIG_TRACE_IRQFLAGS
12632 @@ -318,7 +589,7 @@ ENTRY(save_args)
12633 leaq -RBP+8(%rsp),%rdi /* arg1 for handler */
12634 movq_cfi rbp, 8 /* push %rbp */
12635 leaq 8(%rsp), %rbp /* mov %rsp, %ebp */
12636 - testl $3, CS(%rdi)
12637 + testb $3, CS(%rdi)
12638 je 1f
12639 SWAPGS
12640 /*
12641 @@ -338,9 +609,10 @@ ENTRY(save_args)
12642 * We entered an interrupt context - irqs are off:
12643 */
12644 2: TRACE_IRQS_OFF
12645 + pax_force_retaddr
12646 ret
12647 CFI_ENDPROC
12648 -END(save_args)
12649 +ENDPROC(save_args)
12650 .popsection
12651
12652 ENTRY(save_rest)
12653 @@ -354,9 +626,10 @@ ENTRY(save_rest)
12654 movq_cfi r15, R15+16
12655 movq %r11, 8(%rsp) /* return address */
12656 FIXUP_TOP_OF_STACK %r11, 16
12657 + pax_force_retaddr
12658 ret
12659 CFI_ENDPROC
12660 -END(save_rest)
12661 +ENDPROC(save_rest)
12662
12663 /* save complete stack frame */
12664 .pushsection .kprobes.text, "ax"
12665 @@ -385,9 +658,10 @@ ENTRY(save_paranoid)
12666 js 1f /* negative -> in kernel */
12667 SWAPGS
12668 xorl %ebx,%ebx
12669 -1: ret
12670 +1: pax_force_retaddr
12671 + ret
12672 CFI_ENDPROC
12673 -END(save_paranoid)
12674 +ENDPROC(save_paranoid)
12675 .popsection
12676
12677 /*
12678 @@ -409,7 +683,7 @@ ENTRY(ret_from_fork)
12679
12680 RESTORE_REST
12681
12682 - testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
12683 + testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
12684 je int_ret_from_sys_call
12685
12686 testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
12687 @@ -419,7 +693,7 @@ ENTRY(ret_from_fork)
12688 jmp ret_from_sys_call # go to the SYSRET fastpath
12689
12690 CFI_ENDPROC
12691 -END(ret_from_fork)
12692 +ENDPROC(ret_from_fork)
12693
12694 /*
12695 * System call entry. Up to 6 arguments in registers are supported.
12696 @@ -455,7 +729,7 @@ END(ret_from_fork)
12697 ENTRY(system_call)
12698 CFI_STARTPROC simple
12699 CFI_SIGNAL_FRAME
12700 - CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
12701 + CFI_DEF_CFA rsp,0
12702 CFI_REGISTER rip,rcx
12703 /*CFI_REGISTER rflags,r11*/
12704 SWAPGS_UNSAFE_STACK
12705 @@ -468,12 +742,13 @@ ENTRY(system_call_after_swapgs)
12706
12707 movq %rsp,PER_CPU_VAR(old_rsp)
12708 movq PER_CPU_VAR(kernel_stack),%rsp
12709 + pax_enter_kernel_user
12710 /*
12711 * No need to follow this irqs off/on section - it's straight
12712 * and short:
12713 */
12714 ENABLE_INTERRUPTS(CLBR_NONE)
12715 - SAVE_ARGS 8,1
12716 + SAVE_ARGS 8*6,1
12717 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
12718 movq %rcx,RIP-ARGOFFSET(%rsp)
12719 CFI_REL_OFFSET rip,RIP-ARGOFFSET
12720 @@ -502,6 +777,8 @@ sysret_check:
12721 andl %edi,%edx
12722 jnz sysret_careful
12723 CFI_REMEMBER_STATE
12724 + pax_exit_kernel_user
12725 + pax_erase_kstack
12726 /*
12727 * sysretq will re-enable interrupts:
12728 */
12729 @@ -560,6 +837,9 @@ auditsys:
12730 movq %rax,%rsi /* 2nd arg: syscall number */
12731 movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
12732 call audit_syscall_entry
12733 +
12734 + pax_erase_kstack
12735 +
12736 LOAD_ARGS 0 /* reload call-clobbered registers */
12737 jmp system_call_fastpath
12738
12739 @@ -590,6 +870,9 @@ tracesys:
12740 FIXUP_TOP_OF_STACK %rdi
12741 movq %rsp,%rdi
12742 call syscall_trace_enter
12743 +
12744 + pax_erase_kstack
12745 +
12746 /*
12747 * Reload arg registers from stack in case ptrace changed them.
12748 * We don't reload %rax because syscall_trace_enter() returned
12749 @@ -611,7 +894,7 @@ tracesys:
12750 GLOBAL(int_ret_from_sys_call)
12751 DISABLE_INTERRUPTS(CLBR_NONE)
12752 TRACE_IRQS_OFF
12753 - testl $3,CS-ARGOFFSET(%rsp)
12754 + testb $3,CS-ARGOFFSET(%rsp)
12755 je retint_restore_args
12756 movl $_TIF_ALLWORK_MASK,%edi
12757 /* edi: mask to check */
12758 @@ -668,7 +951,7 @@ int_restore_rest:
12759 TRACE_IRQS_OFF
12760 jmp int_with_check
12761 CFI_ENDPROC
12762 -END(system_call)
12763 +ENDPROC(system_call)
12764
12765 /*
12766 * Certain special system calls that need to save a complete full stack frame.
12767 @@ -684,7 +967,7 @@ ENTRY(\label)
12768 call \func
12769 jmp ptregscall_common
12770 CFI_ENDPROC
12771 -END(\label)
12772 +ENDPROC(\label)
12773 .endm
12774
12775 PTREGSCALL stub_clone, sys_clone, %r8
12776 @@ -702,9 +985,10 @@ ENTRY(ptregscall_common)
12777 movq_cfi_restore R12+8, r12
12778 movq_cfi_restore RBP+8, rbp
12779 movq_cfi_restore RBX+8, rbx
12780 + pax_force_retaddr
12781 ret $REST_SKIP /* pop extended registers */
12782 CFI_ENDPROC
12783 -END(ptregscall_common)
12784 +ENDPROC(ptregscall_common)
12785
12786 ENTRY(stub_execve)
12787 CFI_STARTPROC
12788 @@ -719,7 +1003,7 @@ ENTRY(stub_execve)
12789 RESTORE_REST
12790 jmp int_ret_from_sys_call
12791 CFI_ENDPROC
12792 -END(stub_execve)
12793 +ENDPROC(stub_execve)
12794
12795 /*
12796 * sigreturn is special because it needs to restore all registers on return.
12797 @@ -737,7 +1021,7 @@ ENTRY(stub_rt_sigreturn)
12798 RESTORE_REST
12799 jmp int_ret_from_sys_call
12800 CFI_ENDPROC
12801 -END(stub_rt_sigreturn)
12802 +ENDPROC(stub_rt_sigreturn)
12803
12804 /*
12805 * Build the entry stubs and pointer table with some assembler magic.
12806 @@ -772,7 +1056,7 @@ vector=vector+1
12807 2: jmp common_interrupt
12808 .endr
12809 CFI_ENDPROC
12810 -END(irq_entries_start)
12811 +ENDPROC(irq_entries_start)
12812
12813 .previous
12814 END(interrupt)
12815 @@ -793,6 +1077,16 @@ END(interrupt)
12816 CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP
12817 call save_args
12818 PARTIAL_FRAME 0
12819 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12820 + testb $3, CS(%rdi)
12821 + jnz 1f
12822 + pax_enter_kernel
12823 + jmp 2f
12824 +1: pax_enter_kernel_user
12825 +2:
12826 +#else
12827 + pax_enter_kernel
12828 +#endif
12829 call \func
12830 .endm
12831
12832 @@ -825,7 +1119,7 @@ ret_from_intr:
12833 CFI_ADJUST_CFA_OFFSET -8
12834 exit_intr:
12835 GET_THREAD_INFO(%rcx)
12836 - testl $3,CS-ARGOFFSET(%rsp)
12837 + testb $3,CS-ARGOFFSET(%rsp)
12838 je retint_kernel
12839
12840 /* Interrupt came from user space */
12841 @@ -847,12 +1141,16 @@ retint_swapgs: /* return to user-space
12842 * The iretq could re-enable interrupts:
12843 */
12844 DISABLE_INTERRUPTS(CLBR_ANY)
12845 + pax_exit_kernel_user
12846 + pax_erase_kstack
12847 TRACE_IRQS_IRETQ
12848 SWAPGS
12849 jmp restore_args
12850
12851 retint_restore_args: /* return to kernel space */
12852 DISABLE_INTERRUPTS(CLBR_ANY)
12853 + pax_exit_kernel
12854 + pax_force_retaddr RIP-ARGOFFSET
12855 /*
12856 * The iretq could re-enable interrupts:
12857 */
12858 @@ -941,7 +1239,7 @@ ENTRY(retint_kernel)
12859 #endif
12860
12861 CFI_ENDPROC
12862 -END(common_interrupt)
12863 +ENDPROC(common_interrupt)
12864 /*
12865 * End of kprobes section
12866 */
12867 @@ -957,7 +1255,7 @@ ENTRY(\sym)
12868 interrupt \do_sym
12869 jmp ret_from_intr
12870 CFI_ENDPROC
12871 -END(\sym)
12872 +ENDPROC(\sym)
12873 .endm
12874
12875 #ifdef CONFIG_SMP
12876 @@ -1027,12 +1325,22 @@ ENTRY(\sym)
12877 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
12878 call error_entry
12879 DEFAULT_FRAME 0
12880 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12881 + testb $3, CS(%rsp)
12882 + jnz 1f
12883 + pax_enter_kernel
12884 + jmp 2f
12885 +1: pax_enter_kernel_user
12886 +2:
12887 +#else
12888 + pax_enter_kernel
12889 +#endif
12890 movq %rsp,%rdi /* pt_regs pointer */
12891 xorl %esi,%esi /* no error code */
12892 call \do_sym
12893 jmp error_exit /* %ebx: no swapgs flag */
12894 CFI_ENDPROC
12895 -END(\sym)
12896 +ENDPROC(\sym)
12897 .endm
12898
12899 .macro paranoidzeroentry sym do_sym
12900 @@ -1044,15 +1352,25 @@ ENTRY(\sym)
12901 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
12902 call save_paranoid
12903 TRACE_IRQS_OFF
12904 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12905 + testb $3, CS(%rsp)
12906 + jnz 1f
12907 + pax_enter_kernel
12908 + jmp 2f
12909 +1: pax_enter_kernel_user
12910 +2:
12911 +#else
12912 + pax_enter_kernel
12913 +#endif
12914 movq %rsp,%rdi /* pt_regs pointer */
12915 xorl %esi,%esi /* no error code */
12916 call \do_sym
12917 jmp paranoid_exit /* %ebx: no swapgs flag */
12918 CFI_ENDPROC
12919 -END(\sym)
12920 +ENDPROC(\sym)
12921 .endm
12922
12923 -#define INIT_TSS_IST(x) PER_CPU_VAR(init_tss) + (TSS_ist + ((x) - 1) * 8)
12924 +#define INIT_TSS_IST(x) (TSS_ist + ((x) - 1) * 8)(%r12)
12925 .macro paranoidzeroentry_ist sym do_sym ist
12926 ENTRY(\sym)
12927 INTR_FRAME
12928 @@ -1062,14 +1380,30 @@ ENTRY(\sym)
12929 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
12930 call save_paranoid
12931 TRACE_IRQS_OFF
12932 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12933 + testb $3, CS(%rsp)
12934 + jnz 1f
12935 + pax_enter_kernel
12936 + jmp 2f
12937 +1: pax_enter_kernel_user
12938 +2:
12939 +#else
12940 + pax_enter_kernel
12941 +#endif
12942 movq %rsp,%rdi /* pt_regs pointer */
12943 xorl %esi,%esi /* no error code */
12944 +#ifdef CONFIG_SMP
12945 + imul $TSS_size, PER_CPU_VAR(cpu_number), %r12d
12946 + lea init_tss(%r12), %r12
12947 +#else
12948 + lea init_tss(%rip), %r12
12949 +#endif
12950 subq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
12951 call \do_sym
12952 addq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
12953 jmp paranoid_exit /* %ebx: no swapgs flag */
12954 CFI_ENDPROC
12955 -END(\sym)
12956 +ENDPROC(\sym)
12957 .endm
12958
12959 .macro errorentry sym do_sym
12960 @@ -1080,13 +1414,23 @@ ENTRY(\sym)
12961 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
12962 call error_entry
12963 DEFAULT_FRAME 0
12964 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12965 + testb $3, CS(%rsp)
12966 + jnz 1f
12967 + pax_enter_kernel
12968 + jmp 2f
12969 +1: pax_enter_kernel_user
12970 +2:
12971 +#else
12972 + pax_enter_kernel
12973 +#endif
12974 movq %rsp,%rdi /* pt_regs pointer */
12975 movq ORIG_RAX(%rsp),%rsi /* get error code */
12976 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
12977 call \do_sym
12978 jmp error_exit /* %ebx: no swapgs flag */
12979 CFI_ENDPROC
12980 -END(\sym)
12981 +ENDPROC(\sym)
12982 .endm
12983
12984 /* error code is on the stack already */
12985 @@ -1099,13 +1443,23 @@ ENTRY(\sym)
12986 call save_paranoid
12987 DEFAULT_FRAME 0
12988 TRACE_IRQS_OFF
12989 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12990 + testb $3, CS(%rsp)
12991 + jnz 1f
12992 + pax_enter_kernel
12993 + jmp 2f
12994 +1: pax_enter_kernel_user
12995 +2:
12996 +#else
12997 + pax_enter_kernel
12998 +#endif
12999 movq %rsp,%rdi /* pt_regs pointer */
13000 movq ORIG_RAX(%rsp),%rsi /* get error code */
13001 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
13002 call \do_sym
13003 jmp paranoid_exit /* %ebx: no swapgs flag */
13004 CFI_ENDPROC
13005 -END(\sym)
13006 +ENDPROC(\sym)
13007 .endm
13008
13009 zeroentry divide_error do_divide_error
13010 @@ -1134,9 +1488,10 @@ gs_change:
13011 2: mfence /* workaround */
13012 SWAPGS
13013 popfq_cfi
13014 + pax_force_retaddr
13015 ret
13016 CFI_ENDPROC
13017 -END(native_load_gs_index)
13018 +ENDPROC(native_load_gs_index)
13019
13020 .section __ex_table,"a"
13021 .align 8
13022 @@ -1158,13 +1513,14 @@ ENTRY(kernel_thread_helper)
13023 * Here we are in the child and the registers are set as they were
13024 * at kernel_thread() invocation in the parent.
13025 */
13026 + pax_force_fptr %rsi
13027 call *%rsi
13028 # exit
13029 mov %eax, %edi
13030 call do_exit
13031 ud2 # padding for call trace
13032 CFI_ENDPROC
13033 -END(kernel_thread_helper)
13034 +ENDPROC(kernel_thread_helper)
13035
13036 /*
13037 * execve(). This function needs to use IRET, not SYSRET, to set up all state properly.
13038 @@ -1193,9 +1549,10 @@ ENTRY(kernel_execve)
13039 je int_ret_from_sys_call
13040 RESTORE_ARGS
13041 UNFAKE_STACK_FRAME
13042 + pax_force_retaddr
13043 ret
13044 CFI_ENDPROC
13045 -END(kernel_execve)
13046 +ENDPROC(kernel_execve)
13047
13048 /* Call softirq on interrupt stack. Interrupts are off. */
13049 ENTRY(call_softirq)
13050 @@ -1213,9 +1570,10 @@ ENTRY(call_softirq)
13051 CFI_DEF_CFA_REGISTER rsp
13052 CFI_ADJUST_CFA_OFFSET -8
13053 decl PER_CPU_VAR(irq_count)
13054 + pax_force_retaddr
13055 ret
13056 CFI_ENDPROC
13057 -END(call_softirq)
13058 +ENDPROC(call_softirq)
13059
13060 #ifdef CONFIG_XEN
13061 zeroentry xen_hypervisor_callback xen_do_hypervisor_callback
13062 @@ -1253,7 +1611,7 @@ ENTRY(xen_do_hypervisor_callback) # do
13063 decl PER_CPU_VAR(irq_count)
13064 jmp error_exit
13065 CFI_ENDPROC
13066 -END(xen_do_hypervisor_callback)
13067 +ENDPROC(xen_do_hypervisor_callback)
13068
13069 /*
13070 * Hypervisor uses this for application faults while it executes.
13071 @@ -1312,7 +1670,7 @@ ENTRY(xen_failsafe_callback)
13072 SAVE_ALL
13073 jmp error_exit
13074 CFI_ENDPROC
13075 -END(xen_failsafe_callback)
13076 +ENDPROC(xen_failsafe_callback)
13077
13078 apicinterrupt XEN_HVM_EVTCHN_CALLBACK \
13079 xen_hvm_callback_vector xen_evtchn_do_upcall
13080 @@ -1361,16 +1719,31 @@ ENTRY(paranoid_exit)
13081 TRACE_IRQS_OFF
13082 testl %ebx,%ebx /* swapgs needed? */
13083 jnz paranoid_restore
13084 - testl $3,CS(%rsp)
13085 + testb $3,CS(%rsp)
13086 jnz paranoid_userspace
13087 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13088 + pax_exit_kernel
13089 + TRACE_IRQS_IRETQ 0
13090 + SWAPGS_UNSAFE_STACK
13091 + RESTORE_ALL 8
13092 + pax_force_retaddr
13093 + jmp irq_return
13094 +#endif
13095 paranoid_swapgs:
13096 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13097 + pax_exit_kernel_user
13098 +#else
13099 + pax_exit_kernel
13100 +#endif
13101 TRACE_IRQS_IRETQ 0
13102 SWAPGS_UNSAFE_STACK
13103 RESTORE_ALL 8
13104 jmp irq_return
13105 paranoid_restore:
13106 + pax_exit_kernel
13107 TRACE_IRQS_IRETQ 0
13108 RESTORE_ALL 8
13109 + pax_force_retaddr
13110 jmp irq_return
13111 paranoid_userspace:
13112 GET_THREAD_INFO(%rcx)
13113 @@ -1399,7 +1772,7 @@ paranoid_schedule:
13114 TRACE_IRQS_OFF
13115 jmp paranoid_userspace
13116 CFI_ENDPROC
13117 -END(paranoid_exit)
13118 +ENDPROC(paranoid_exit)
13119
13120 /*
13121 * Exception entry point. This expects an error code/orig_rax on the stack.
13122 @@ -1426,12 +1799,13 @@ ENTRY(error_entry)
13123 movq_cfi r14, R14+8
13124 movq_cfi r15, R15+8
13125 xorl %ebx,%ebx
13126 - testl $3,CS+8(%rsp)
13127 + testb $3,CS+8(%rsp)
13128 je error_kernelspace
13129 error_swapgs:
13130 SWAPGS
13131 error_sti:
13132 TRACE_IRQS_OFF
13133 + pax_force_retaddr
13134 ret
13135
13136 /*
13137 @@ -1458,7 +1832,7 @@ bstep_iret:
13138 movq %rcx,RIP+8(%rsp)
13139 jmp error_swapgs
13140 CFI_ENDPROC
13141 -END(error_entry)
13142 +ENDPROC(error_entry)
13143
13144
13145 /* ebx: no swapgs flag (1: don't need swapgs, 0: need it) */
13146 @@ -1478,7 +1852,7 @@ ENTRY(error_exit)
13147 jnz retint_careful
13148 jmp retint_swapgs
13149 CFI_ENDPROC
13150 -END(error_exit)
13151 +ENDPROC(error_exit)
13152
13153
13154 /* runs on exception stack */
13155 @@ -1490,6 +1864,16 @@ ENTRY(nmi)
13156 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
13157 call save_paranoid
13158 DEFAULT_FRAME 0
13159 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13160 + testb $3, CS(%rsp)
13161 + jnz 1f
13162 + pax_enter_kernel
13163 + jmp 2f
13164 +1: pax_enter_kernel_user
13165 +2:
13166 +#else
13167 + pax_enter_kernel
13168 +#endif
13169 /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
13170 movq %rsp,%rdi
13171 movq $-1,%rsi
13172 @@ -1500,12 +1884,28 @@ ENTRY(nmi)
13173 DISABLE_INTERRUPTS(CLBR_NONE)
13174 testl %ebx,%ebx /* swapgs needed? */
13175 jnz nmi_restore
13176 - testl $3,CS(%rsp)
13177 + testb $3,CS(%rsp)
13178 jnz nmi_userspace
13179 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13180 + pax_exit_kernel
13181 + SWAPGS_UNSAFE_STACK
13182 + RESTORE_ALL 8
13183 + pax_force_retaddr
13184 + jmp irq_return
13185 +#endif
13186 nmi_swapgs:
13187 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13188 + pax_exit_kernel_user
13189 +#else
13190 + pax_exit_kernel
13191 +#endif
13192 SWAPGS_UNSAFE_STACK
13193 + RESTORE_ALL 8
13194 + jmp irq_return
13195 nmi_restore:
13196 + pax_exit_kernel
13197 RESTORE_ALL 8
13198 + pax_force_retaddr
13199 jmp irq_return
13200 nmi_userspace:
13201 GET_THREAD_INFO(%rcx)
13202 @@ -1534,14 +1934,14 @@ nmi_schedule:
13203 jmp paranoid_exit
13204 CFI_ENDPROC
13205 #endif
13206 -END(nmi)
13207 +ENDPROC(nmi)
13208
13209 ENTRY(ignore_sysret)
13210 CFI_STARTPROC
13211 mov $-ENOSYS,%eax
13212 sysret
13213 CFI_ENDPROC
13214 -END(ignore_sysret)
13215 +ENDPROC(ignore_sysret)
13216
13217 /*
13218 * End of kprobes section
13219 diff -urNp linux-3.0.9/arch/x86/kernel/ftrace.c linux-3.0.9/arch/x86/kernel/ftrace.c
13220 --- linux-3.0.9/arch/x86/kernel/ftrace.c 2011-11-11 13:12:24.000000000 -0500
13221 +++ linux-3.0.9/arch/x86/kernel/ftrace.c 2011-11-15 20:02:59.000000000 -0500
13222 @@ -126,7 +126,7 @@ static void *mod_code_ip; /* holds the
13223 static const void *mod_code_newcode; /* holds the text to write to the IP */
13224
13225 static unsigned nmi_wait_count;
13226 -static atomic_t nmi_update_count = ATOMIC_INIT(0);
13227 +static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
13228
13229 int ftrace_arch_read_dyn_info(char *buf, int size)
13230 {
13231 @@ -134,7 +134,7 @@ int ftrace_arch_read_dyn_info(char *buf,
13232
13233 r = snprintf(buf, size, "%u %u",
13234 nmi_wait_count,
13235 - atomic_read(&nmi_update_count));
13236 + atomic_read_unchecked(&nmi_update_count));
13237 return r;
13238 }
13239
13240 @@ -177,8 +177,10 @@ void ftrace_nmi_enter(void)
13241
13242 if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
13243 smp_rmb();
13244 + pax_open_kernel();
13245 ftrace_mod_code();
13246 - atomic_inc(&nmi_update_count);
13247 + pax_close_kernel();
13248 + atomic_inc_unchecked(&nmi_update_count);
13249 }
13250 /* Must have previous changes seen before executions */
13251 smp_mb();
13252 @@ -271,6 +273,8 @@ ftrace_modify_code(unsigned long ip, uns
13253 {
13254 unsigned char replaced[MCOUNT_INSN_SIZE];
13255
13256 + ip = ktla_ktva(ip);
13257 +
13258 /*
13259 * Note: Due to modules and __init, code can
13260 * disappear and change, we need to protect against faulting
13261 @@ -327,7 +331,7 @@ int ftrace_update_ftrace_func(ftrace_fun
13262 unsigned char old[MCOUNT_INSN_SIZE], *new;
13263 int ret;
13264
13265 - memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
13266 + memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
13267 new = ftrace_call_replace(ip, (unsigned long)func);
13268 ret = ftrace_modify_code(ip, old, new);
13269
13270 @@ -353,6 +357,8 @@ static int ftrace_mod_jmp(unsigned long
13271 {
13272 unsigned char code[MCOUNT_INSN_SIZE];
13273
13274 + ip = ktla_ktva(ip);
13275 +
13276 if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
13277 return -EFAULT;
13278
13279 diff -urNp linux-3.0.9/arch/x86/kernel/head32.c linux-3.0.9/arch/x86/kernel/head32.c
13280 --- linux-3.0.9/arch/x86/kernel/head32.c 2011-11-11 13:12:24.000000000 -0500
13281 +++ linux-3.0.9/arch/x86/kernel/head32.c 2011-11-15 20:02:59.000000000 -0500
13282 @@ -19,6 +19,7 @@
13283 #include <asm/io_apic.h>
13284 #include <asm/bios_ebda.h>
13285 #include <asm/tlbflush.h>
13286 +#include <asm/boot.h>
13287
13288 static void __init i386_default_early_setup(void)
13289 {
13290 @@ -33,7 +34,7 @@ void __init i386_start_kernel(void)
13291 {
13292 memblock_init();
13293
13294 - memblock_x86_reserve_range(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
13295 + memblock_x86_reserve_range(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
13296
13297 #ifdef CONFIG_BLK_DEV_INITRD
13298 /* Reserve INITRD */
13299 diff -urNp linux-3.0.9/arch/x86/kernel/head_32.S linux-3.0.9/arch/x86/kernel/head_32.S
13300 --- linux-3.0.9/arch/x86/kernel/head_32.S 2011-11-11 13:12:24.000000000 -0500
13301 +++ linux-3.0.9/arch/x86/kernel/head_32.S 2011-11-15 20:02:59.000000000 -0500
13302 @@ -25,6 +25,12 @@
13303 /* Physical address */
13304 #define pa(X) ((X) - __PAGE_OFFSET)
13305
13306 +#ifdef CONFIG_PAX_KERNEXEC
13307 +#define ta(X) (X)
13308 +#else
13309 +#define ta(X) ((X) - __PAGE_OFFSET)
13310 +#endif
13311 +
13312 /*
13313 * References to members of the new_cpu_data structure.
13314 */
13315 @@ -54,11 +60,7 @@
13316 * and small than max_low_pfn, otherwise will waste some page table entries
13317 */
13318
13319 -#if PTRS_PER_PMD > 1
13320 -#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
13321 -#else
13322 -#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
13323 -#endif
13324 +#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
13325
13326 /* Number of possible pages in the lowmem region */
13327 LOWMEM_PAGES = (((1<<32) - __PAGE_OFFSET) >> PAGE_SHIFT)
13328 @@ -77,6 +79,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P
13329 RESERVE_BRK(pagetables, INIT_MAP_SIZE)
13330
13331 /*
13332 + * Real beginning of normal "text" segment
13333 + */
13334 +ENTRY(stext)
13335 +ENTRY(_stext)
13336 +
13337 +/*
13338 * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
13339 * %esi points to the real-mode code as a 32-bit pointer.
13340 * CS and DS must be 4 GB flat segments, but we don't depend on
13341 @@ -84,6 +92,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
13342 * can.
13343 */
13344 __HEAD
13345 +
13346 +#ifdef CONFIG_PAX_KERNEXEC
13347 + jmp startup_32
13348 +/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
13349 +.fill PAGE_SIZE-5,1,0xcc
13350 +#endif
13351 +
13352 ENTRY(startup_32)
13353 movl pa(stack_start),%ecx
13354
13355 @@ -105,6 +120,57 @@ ENTRY(startup_32)
13356 2:
13357 leal -__PAGE_OFFSET(%ecx),%esp
13358
13359 +#ifdef CONFIG_SMP
13360 + movl $pa(cpu_gdt_table),%edi
13361 + movl $__per_cpu_load,%eax
13362 + movw %ax,__KERNEL_PERCPU + 2(%edi)
13363 + rorl $16,%eax
13364 + movb %al,__KERNEL_PERCPU + 4(%edi)
13365 + movb %ah,__KERNEL_PERCPU + 7(%edi)
13366 + movl $__per_cpu_end - 1,%eax
13367 + subl $__per_cpu_start,%eax
13368 + movw %ax,__KERNEL_PERCPU + 0(%edi)
13369 +#endif
13370 +
13371 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13372 + movl $NR_CPUS,%ecx
13373 + movl $pa(cpu_gdt_table),%edi
13374 +1:
13375 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
13376 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
13377 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
13378 + addl $PAGE_SIZE_asm,%edi
13379 + loop 1b
13380 +#endif
13381 +
13382 +#ifdef CONFIG_PAX_KERNEXEC
13383 + movl $pa(boot_gdt),%edi
13384 + movl $__LOAD_PHYSICAL_ADDR,%eax
13385 + movw %ax,__BOOT_CS + 2(%edi)
13386 + rorl $16,%eax
13387 + movb %al,__BOOT_CS + 4(%edi)
13388 + movb %ah,__BOOT_CS + 7(%edi)
13389 + rorl $16,%eax
13390 +
13391 + ljmp $(__BOOT_CS),$1f
13392 +1:
13393 +
13394 + movl $NR_CPUS,%ecx
13395 + movl $pa(cpu_gdt_table),%edi
13396 + addl $__PAGE_OFFSET,%eax
13397 +1:
13398 + movw %ax,__KERNEL_CS + 2(%edi)
13399 + movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
13400 + rorl $16,%eax
13401 + movb %al,__KERNEL_CS + 4(%edi)
13402 + movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
13403 + movb %ah,__KERNEL_CS + 7(%edi)
13404 + movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
13405 + rorl $16,%eax
13406 + addl $PAGE_SIZE_asm,%edi
13407 + loop 1b
13408 +#endif
13409 +
13410 /*
13411 * Clear BSS first so that there are no surprises...
13412 */
13413 @@ -195,8 +261,11 @@ ENTRY(startup_32)
13414 movl %eax, pa(max_pfn_mapped)
13415
13416 /* Do early initialization of the fixmap area */
13417 - movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
13418 - movl %eax,pa(initial_pg_pmd+0x1000*KPMDS-8)
13419 +#ifdef CONFIG_COMPAT_VDSO
13420 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_pg_pmd+0x1000*KPMDS-8)
13421 +#else
13422 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_pg_pmd+0x1000*KPMDS-8)
13423 +#endif
13424 #else /* Not PAE */
13425
13426 page_pde_offset = (__PAGE_OFFSET >> 20);
13427 @@ -226,8 +295,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
13428 movl %eax, pa(max_pfn_mapped)
13429
13430 /* Do early initialization of the fixmap area */
13431 - movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
13432 - movl %eax,pa(initial_page_table+0xffc)
13433 +#ifdef CONFIG_COMPAT_VDSO
13434 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_page_table+0xffc)
13435 +#else
13436 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_page_table+0xffc)
13437 +#endif
13438 #endif
13439
13440 #ifdef CONFIG_PARAVIRT
13441 @@ -241,9 +313,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
13442 cmpl $num_subarch_entries, %eax
13443 jae bad_subarch
13444
13445 - movl pa(subarch_entries)(,%eax,4), %eax
13446 - subl $__PAGE_OFFSET, %eax
13447 - jmp *%eax
13448 + jmp *pa(subarch_entries)(,%eax,4)
13449
13450 bad_subarch:
13451 WEAK(lguest_entry)
13452 @@ -255,10 +325,10 @@ WEAK(xen_entry)
13453 __INITDATA
13454
13455 subarch_entries:
13456 - .long default_entry /* normal x86/PC */
13457 - .long lguest_entry /* lguest hypervisor */
13458 - .long xen_entry /* Xen hypervisor */
13459 - .long default_entry /* Moorestown MID */
13460 + .long ta(default_entry) /* normal x86/PC */
13461 + .long ta(lguest_entry) /* lguest hypervisor */
13462 + .long ta(xen_entry) /* Xen hypervisor */
13463 + .long ta(default_entry) /* Moorestown MID */
13464 num_subarch_entries = (. - subarch_entries) / 4
13465 .previous
13466 #else
13467 @@ -312,6 +382,7 @@ default_entry:
13468 orl %edx,%eax
13469 movl %eax,%cr4
13470
13471 +#ifdef CONFIG_X86_PAE
13472 testb $X86_CR4_PAE, %al # check if PAE is enabled
13473 jz 6f
13474
13475 @@ -340,6 +411,9 @@ default_entry:
13476 /* Make changes effective */
13477 wrmsr
13478
13479 + btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
13480 +#endif
13481 +
13482 6:
13483
13484 /*
13485 @@ -443,7 +517,7 @@ is386: movl $2,%ecx # set MP
13486 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
13487 movl %eax,%ss # after changing gdt.
13488
13489 - movl $(__USER_DS),%eax # DS/ES contains default USER segment
13490 +# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
13491 movl %eax,%ds
13492 movl %eax,%es
13493
13494 @@ -457,15 +531,22 @@ is386: movl $2,%ecx # set MP
13495 */
13496 cmpb $0,ready
13497 jne 1f
13498 - movl $gdt_page,%eax
13499 + movl $cpu_gdt_table,%eax
13500 movl $stack_canary,%ecx
13501 +#ifdef CONFIG_SMP
13502 + addl $__per_cpu_load,%ecx
13503 +#endif
13504 movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
13505 shrl $16, %ecx
13506 movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
13507 movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
13508 1:
13509 -#endif
13510 movl $(__KERNEL_STACK_CANARY),%eax
13511 +#elif defined(CONFIG_PAX_MEMORY_UDEREF)
13512 + movl $(__USER_DS),%eax
13513 +#else
13514 + xorl %eax,%eax
13515 +#endif
13516 movl %eax,%gs
13517
13518 xorl %eax,%eax # Clear LDT
13519 @@ -558,22 +639,22 @@ early_page_fault:
13520 jmp early_fault
13521
13522 early_fault:
13523 - cld
13524 #ifdef CONFIG_PRINTK
13525 + cmpl $1,%ss:early_recursion_flag
13526 + je hlt_loop
13527 + incl %ss:early_recursion_flag
13528 + cld
13529 pusha
13530 movl $(__KERNEL_DS),%eax
13531 movl %eax,%ds
13532 movl %eax,%es
13533 - cmpl $2,early_recursion_flag
13534 - je hlt_loop
13535 - incl early_recursion_flag
13536 movl %cr2,%eax
13537 pushl %eax
13538 pushl %edx /* trapno */
13539 pushl $fault_msg
13540 call printk
13541 +; call dump_stack
13542 #endif
13543 - call dump_stack
13544 hlt_loop:
13545 hlt
13546 jmp hlt_loop
13547 @@ -581,8 +662,11 @@ hlt_loop:
13548 /* This is the default interrupt "handler" :-) */
13549 ALIGN
13550 ignore_int:
13551 - cld
13552 #ifdef CONFIG_PRINTK
13553 + cmpl $2,%ss:early_recursion_flag
13554 + je hlt_loop
13555 + incl %ss:early_recursion_flag
13556 + cld
13557 pushl %eax
13558 pushl %ecx
13559 pushl %edx
13560 @@ -591,9 +675,6 @@ ignore_int:
13561 movl $(__KERNEL_DS),%eax
13562 movl %eax,%ds
13563 movl %eax,%es
13564 - cmpl $2,early_recursion_flag
13565 - je hlt_loop
13566 - incl early_recursion_flag
13567 pushl 16(%esp)
13568 pushl 24(%esp)
13569 pushl 32(%esp)
13570 @@ -622,29 +703,43 @@ ENTRY(initial_code)
13571 /*
13572 * BSS section
13573 */
13574 -__PAGE_ALIGNED_BSS
13575 - .align PAGE_SIZE
13576 #ifdef CONFIG_X86_PAE
13577 +.section .initial_pg_pmd,"a",@progbits
13578 initial_pg_pmd:
13579 .fill 1024*KPMDS,4,0
13580 #else
13581 +.section .initial_page_table,"a",@progbits
13582 ENTRY(initial_page_table)
13583 .fill 1024,4,0
13584 #endif
13585 +.section .initial_pg_fixmap,"a",@progbits
13586 initial_pg_fixmap:
13587 .fill 1024,4,0
13588 +.section .empty_zero_page,"a",@progbits
13589 ENTRY(empty_zero_page)
13590 .fill 4096,1,0
13591 +.section .swapper_pg_dir,"a",@progbits
13592 ENTRY(swapper_pg_dir)
13593 +#ifdef CONFIG_X86_PAE
13594 + .fill 4,8,0
13595 +#else
13596 .fill 1024,4,0
13597 +#endif
13598 +
13599 +/*
13600 + * The IDT has to be page-aligned to simplify the Pentium
13601 + * F0 0F bug workaround.. We have a special link segment
13602 + * for this.
13603 + */
13604 +.section .idt,"a",@progbits
13605 +ENTRY(idt_table)
13606 + .fill 256,8,0
13607
13608 /*
13609 * This starts the data section.
13610 */
13611 #ifdef CONFIG_X86_PAE
13612 -__PAGE_ALIGNED_DATA
13613 - /* Page-aligned for the benefit of paravirt? */
13614 - .align PAGE_SIZE
13615 +.section .initial_page_table,"a",@progbits
13616 ENTRY(initial_page_table)
13617 .long pa(initial_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
13618 # if KPMDS == 3
13619 @@ -663,18 +758,27 @@ ENTRY(initial_page_table)
13620 # error "Kernel PMDs should be 1, 2 or 3"
13621 # endif
13622 .align PAGE_SIZE /* needs to be page-sized too */
13623 +
13624 +#ifdef CONFIG_PAX_PER_CPU_PGD
13625 +ENTRY(cpu_pgd)
13626 + .rept NR_CPUS
13627 + .fill 4,8,0
13628 + .endr
13629 +#endif
13630 +
13631 #endif
13632
13633 .data
13634 .balign 4
13635 ENTRY(stack_start)
13636 - .long init_thread_union+THREAD_SIZE
13637 + .long init_thread_union+THREAD_SIZE-8
13638 +
13639 +ready: .byte 0
13640
13641 +.section .rodata,"a",@progbits
13642 early_recursion_flag:
13643 .long 0
13644
13645 -ready: .byte 0
13646 -
13647 int_msg:
13648 .asciz "Unknown interrupt or fault at: %p %p %p\n"
13649
13650 @@ -707,7 +811,7 @@ fault_msg:
13651 .word 0 # 32 bit align gdt_desc.address
13652 boot_gdt_descr:
13653 .word __BOOT_DS+7
13654 - .long boot_gdt - __PAGE_OFFSET
13655 + .long pa(boot_gdt)
13656
13657 .word 0 # 32-bit align idt_desc.address
13658 idt_descr:
13659 @@ -718,7 +822,7 @@ idt_descr:
13660 .word 0 # 32 bit align gdt_desc.address
13661 ENTRY(early_gdt_descr)
13662 .word GDT_ENTRIES*8-1
13663 - .long gdt_page /* Overwritten for secondary CPUs */
13664 + .long cpu_gdt_table /* Overwritten for secondary CPUs */
13665
13666 /*
13667 * The boot_gdt must mirror the equivalent in setup.S and is
13668 @@ -727,5 +831,65 @@ ENTRY(early_gdt_descr)
13669 .align L1_CACHE_BYTES
13670 ENTRY(boot_gdt)
13671 .fill GDT_ENTRY_BOOT_CS,8,0
13672 - .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
13673 - .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
13674 + .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
13675 + .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
13676 +
13677 + .align PAGE_SIZE_asm
13678 +ENTRY(cpu_gdt_table)
13679 + .rept NR_CPUS
13680 + .quad 0x0000000000000000 /* NULL descriptor */
13681 + .quad 0x0000000000000000 /* 0x0b reserved */
13682 + .quad 0x0000000000000000 /* 0x13 reserved */
13683 + .quad 0x0000000000000000 /* 0x1b reserved */
13684 +
13685 +#ifdef CONFIG_PAX_KERNEXEC
13686 + .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
13687 +#else
13688 + .quad 0x0000000000000000 /* 0x20 unused */
13689 +#endif
13690 +
13691 + .quad 0x0000000000000000 /* 0x28 unused */
13692 + .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
13693 + .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
13694 + .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
13695 + .quad 0x0000000000000000 /* 0x4b reserved */
13696 + .quad 0x0000000000000000 /* 0x53 reserved */
13697 + .quad 0x0000000000000000 /* 0x5b reserved */
13698 +
13699 + .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
13700 + .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
13701 + .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
13702 + .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
13703 +
13704 + .quad 0x0000000000000000 /* 0x80 TSS descriptor */
13705 + .quad 0x0000000000000000 /* 0x88 LDT descriptor */
13706 +
13707 + /*
13708 + * Segments used for calling PnP BIOS have byte granularity.
13709 + * The code segments and data segments have fixed 64k limits,
13710 + * the transfer segment sizes are set at run time.
13711 + */
13712 + .quad 0x00409b000000ffff /* 0x90 32-bit code */
13713 + .quad 0x00009b000000ffff /* 0x98 16-bit code */
13714 + .quad 0x000093000000ffff /* 0xa0 16-bit data */
13715 + .quad 0x0000930000000000 /* 0xa8 16-bit data */
13716 + .quad 0x0000930000000000 /* 0xb0 16-bit data */
13717 +
13718 + /*
13719 + * The APM segments have byte granularity and their bases
13720 + * are set at run time. All have 64k limits.
13721 + */
13722 + .quad 0x00409b000000ffff /* 0xb8 APM CS code */
13723 + .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
13724 + .quad 0x004093000000ffff /* 0xc8 APM DS data */
13725 +
13726 + .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
13727 + .quad 0x0040930000000000 /* 0xd8 - PERCPU */
13728 + .quad 0x0040910000000017 /* 0xe0 - STACK_CANARY */
13729 + .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
13730 + .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
13731 + .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
13732 +
13733 + /* Be sure this is zeroed to avoid false validations in Xen */
13734 + .fill PAGE_SIZE_asm - GDT_SIZE,1,0
13735 + .endr
13736 diff -urNp linux-3.0.9/arch/x86/kernel/head_64.S linux-3.0.9/arch/x86/kernel/head_64.S
13737 --- linux-3.0.9/arch/x86/kernel/head_64.S 2011-11-11 13:12:24.000000000 -0500
13738 +++ linux-3.0.9/arch/x86/kernel/head_64.S 2011-11-15 20:02:59.000000000 -0500
13739 @@ -19,6 +19,7 @@
13740 #include <asm/cache.h>
13741 #include <asm/processor-flags.h>
13742 #include <asm/percpu.h>
13743 +#include <asm/cpufeature.h>
13744
13745 #ifdef CONFIG_PARAVIRT
13746 #include <asm/asm-offsets.h>
13747 @@ -38,6 +39,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET
13748 L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
13749 L4_START_KERNEL = pgd_index(__START_KERNEL_map)
13750 L3_START_KERNEL = pud_index(__START_KERNEL_map)
13751 +L4_VMALLOC_START = pgd_index(VMALLOC_START)
13752 +L3_VMALLOC_START = pud_index(VMALLOC_START)
13753 +L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
13754 +L3_VMEMMAP_START = pud_index(VMEMMAP_START)
13755
13756 .text
13757 __HEAD
13758 @@ -85,35 +90,22 @@ startup_64:
13759 */
13760 addq %rbp, init_level4_pgt + 0(%rip)
13761 addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
13762 + addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
13763 + addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
13764 addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
13765
13766 addq %rbp, level3_ident_pgt + 0(%rip)
13767 +#ifndef CONFIG_XEN
13768 + addq %rbp, level3_ident_pgt + 8(%rip)
13769 +#endif
13770
13771 - addq %rbp, level3_kernel_pgt + (510*8)(%rip)
13772 - addq %rbp, level3_kernel_pgt + (511*8)(%rip)
13773 + addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
13774
13775 - addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
13776 + addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
13777 + addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
13778
13779 - /* Add an Identity mapping if I am above 1G */
13780 - leaq _text(%rip), %rdi
13781 - andq $PMD_PAGE_MASK, %rdi
13782 -
13783 - movq %rdi, %rax
13784 - shrq $PUD_SHIFT, %rax
13785 - andq $(PTRS_PER_PUD - 1), %rax
13786 - jz ident_complete
13787 -
13788 - leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
13789 - leaq level3_ident_pgt(%rip), %rbx
13790 - movq %rdx, 0(%rbx, %rax, 8)
13791 -
13792 - movq %rdi, %rax
13793 - shrq $PMD_SHIFT, %rax
13794 - andq $(PTRS_PER_PMD - 1), %rax
13795 - leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
13796 - leaq level2_spare_pgt(%rip), %rbx
13797 - movq %rdx, 0(%rbx, %rax, 8)
13798 -ident_complete:
13799 + addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
13800 + addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
13801
13802 /*
13803 * Fixup the kernel text+data virtual addresses. Note that
13804 @@ -160,8 +152,8 @@ ENTRY(secondary_startup_64)
13805 * after the boot processor executes this code.
13806 */
13807
13808 - /* Enable PAE mode and PGE */
13809 - movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
13810 + /* Enable PAE mode and PSE/PGE */
13811 + movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
13812 movq %rax, %cr4
13813
13814 /* Setup early boot stage 4 level pagetables. */
13815 @@ -183,9 +175,14 @@ ENTRY(secondary_startup_64)
13816 movl $MSR_EFER, %ecx
13817 rdmsr
13818 btsl $_EFER_SCE, %eax /* Enable System Call */
13819 - btl $20,%edi /* No Execute supported? */
13820 + btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
13821 jnc 1f
13822 btsl $_EFER_NX, %eax
13823 + leaq init_level4_pgt(%rip), %rdi
13824 + btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
13825 + btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
13826 + btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
13827 + btsq $_PAGE_BIT_NX, __supported_pte_mask(%rip)
13828 1: wrmsr /* Make changes effective */
13829
13830 /* Setup cr0 */
13831 @@ -269,7 +266,7 @@ ENTRY(secondary_startup_64)
13832 bad_address:
13833 jmp bad_address
13834
13835 - .section ".init.text","ax"
13836 + __INIT
13837 #ifdef CONFIG_EARLY_PRINTK
13838 .globl early_idt_handlers
13839 early_idt_handlers:
13840 @@ -314,18 +311,23 @@ ENTRY(early_idt_handler)
13841 #endif /* EARLY_PRINTK */
13842 1: hlt
13843 jmp 1b
13844 + .previous
13845
13846 #ifdef CONFIG_EARLY_PRINTK
13847 + __INITDATA
13848 early_recursion_flag:
13849 .long 0
13850 + .previous
13851
13852 + .section .rodata,"a",@progbits
13853 early_idt_msg:
13854 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
13855 early_idt_ripmsg:
13856 .asciz "RIP %s\n"
13857 -#endif /* CONFIG_EARLY_PRINTK */
13858 .previous
13859 +#endif /* CONFIG_EARLY_PRINTK */
13860
13861 + .section .rodata,"a",@progbits
13862 #define NEXT_PAGE(name) \
13863 .balign PAGE_SIZE; \
13864 ENTRY(name)
13865 @@ -338,7 +340,6 @@ ENTRY(name)
13866 i = i + 1 ; \
13867 .endr
13868
13869 - .data
13870 /*
13871 * This default setting generates an ident mapping at address 0x100000
13872 * and a mapping for the kernel that precisely maps virtual address
13873 @@ -349,13 +350,36 @@ NEXT_PAGE(init_level4_pgt)
13874 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
13875 .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
13876 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
13877 + .org init_level4_pgt + L4_VMALLOC_START*8, 0
13878 + .quad level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
13879 + .org init_level4_pgt + L4_VMEMMAP_START*8, 0
13880 + .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
13881 .org init_level4_pgt + L4_START_KERNEL*8, 0
13882 /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
13883 .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
13884
13885 +#ifdef CONFIG_PAX_PER_CPU_PGD
13886 +NEXT_PAGE(cpu_pgd)
13887 + .rept NR_CPUS
13888 + .fill 512,8,0
13889 + .endr
13890 +#endif
13891 +
13892 NEXT_PAGE(level3_ident_pgt)
13893 .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
13894 +#ifdef CONFIG_XEN
13895 .fill 511,8,0
13896 +#else
13897 + .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
13898 + .fill 510,8,0
13899 +#endif
13900 +
13901 +NEXT_PAGE(level3_vmalloc_pgt)
13902 + .fill 512,8,0
13903 +
13904 +NEXT_PAGE(level3_vmemmap_pgt)
13905 + .fill L3_VMEMMAP_START,8,0
13906 + .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
13907
13908 NEXT_PAGE(level3_kernel_pgt)
13909 .fill L3_START_KERNEL,8,0
13910 @@ -363,20 +387,23 @@ NEXT_PAGE(level3_kernel_pgt)
13911 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
13912 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
13913
13914 +NEXT_PAGE(level2_vmemmap_pgt)
13915 + .fill 512,8,0
13916 +
13917 NEXT_PAGE(level2_fixmap_pgt)
13918 - .fill 506,8,0
13919 - .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
13920 - /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
13921 - .fill 5,8,0
13922 + .fill 507,8,0
13923 + .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
13924 + /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
13925 + .fill 4,8,0
13926
13927 -NEXT_PAGE(level1_fixmap_pgt)
13928 +NEXT_PAGE(level1_vsyscall_pgt)
13929 .fill 512,8,0
13930
13931 -NEXT_PAGE(level2_ident_pgt)
13932 - /* Since I easily can, map the first 1G.
13933 + /* Since I easily can, map the first 2G.
13934 * Don't set NX because code runs from these pages.
13935 */
13936 - PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
13937 +NEXT_PAGE(level2_ident_pgt)
13938 + PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
13939
13940 NEXT_PAGE(level2_kernel_pgt)
13941 /*
13942 @@ -389,33 +416,55 @@ NEXT_PAGE(level2_kernel_pgt)
13943 * If you want to increase this then increase MODULES_VADDR
13944 * too.)
13945 */
13946 - PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
13947 - KERNEL_IMAGE_SIZE/PMD_SIZE)
13948 -
13949 -NEXT_PAGE(level2_spare_pgt)
13950 - .fill 512, 8, 0
13951 + PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
13952
13953 #undef PMDS
13954 #undef NEXT_PAGE
13955
13956 - .data
13957 + .align PAGE_SIZE
13958 +ENTRY(cpu_gdt_table)
13959 + .rept NR_CPUS
13960 + .quad 0x0000000000000000 /* NULL descriptor */
13961 + .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
13962 + .quad 0x00af9b000000ffff /* __KERNEL_CS */
13963 + .quad 0x00cf93000000ffff /* __KERNEL_DS */
13964 + .quad 0x00cffb000000ffff /* __USER32_CS */
13965 + .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
13966 + .quad 0x00affb000000ffff /* __USER_CS */
13967 +
13968 +#ifdef CONFIG_PAX_KERNEXEC
13969 + .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
13970 +#else
13971 + .quad 0x0 /* unused */
13972 +#endif
13973 +
13974 + .quad 0,0 /* TSS */
13975 + .quad 0,0 /* LDT */
13976 + .quad 0,0,0 /* three TLS descriptors */
13977 + .quad 0x0000f40000000000 /* node/CPU stored in limit */
13978 + /* asm/segment.h:GDT_ENTRIES must match this */
13979 +
13980 + /* zero the remaining page */
13981 + .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
13982 + .endr
13983 +
13984 .align 16
13985 .globl early_gdt_descr
13986 early_gdt_descr:
13987 .word GDT_ENTRIES*8-1
13988 early_gdt_descr_base:
13989 - .quad INIT_PER_CPU_VAR(gdt_page)
13990 + .quad cpu_gdt_table
13991
13992 ENTRY(phys_base)
13993 /* This must match the first entry in level2_kernel_pgt */
13994 .quad 0x0000000000000000
13995
13996 #include "../../x86/xen/xen-head.S"
13997 -
13998 - .section .bss, "aw", @nobits
13999 +
14000 + .section .rodata,"a",@progbits
14001 .align L1_CACHE_BYTES
14002 ENTRY(idt_table)
14003 - .skip IDT_ENTRIES * 16
14004 + .fill 512,8,0
14005
14006 __PAGE_ALIGNED_BSS
14007 .align PAGE_SIZE
14008 diff -urNp linux-3.0.9/arch/x86/kernel/i386_ksyms_32.c linux-3.0.9/arch/x86/kernel/i386_ksyms_32.c
14009 --- linux-3.0.9/arch/x86/kernel/i386_ksyms_32.c 2011-11-11 13:12:24.000000000 -0500
14010 +++ linux-3.0.9/arch/x86/kernel/i386_ksyms_32.c 2011-11-15 20:02:59.000000000 -0500
14011 @@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
14012 EXPORT_SYMBOL(cmpxchg8b_emu);
14013 #endif
14014
14015 +EXPORT_SYMBOL_GPL(cpu_gdt_table);
14016 +
14017 /* Networking helper routines. */
14018 EXPORT_SYMBOL(csum_partial_copy_generic);
14019 +EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
14020 +EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
14021
14022 EXPORT_SYMBOL(__get_user_1);
14023 EXPORT_SYMBOL(__get_user_2);
14024 @@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
14025
14026 EXPORT_SYMBOL(csum_partial);
14027 EXPORT_SYMBOL(empty_zero_page);
14028 +
14029 +#ifdef CONFIG_PAX_KERNEXEC
14030 +EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
14031 +#endif
14032 diff -urNp linux-3.0.9/arch/x86/kernel/i8259.c linux-3.0.9/arch/x86/kernel/i8259.c
14033 --- linux-3.0.9/arch/x86/kernel/i8259.c 2011-11-11 13:12:24.000000000 -0500
14034 +++ linux-3.0.9/arch/x86/kernel/i8259.c 2011-11-15 20:02:59.000000000 -0500
14035 @@ -210,7 +210,7 @@ spurious_8259A_irq:
14036 "spurious 8259A interrupt: IRQ%d.\n", irq);
14037 spurious_irq_mask |= irqmask;
14038 }
14039 - atomic_inc(&irq_err_count);
14040 + atomic_inc_unchecked(&irq_err_count);
14041 /*
14042 * Theoretically we do not have to handle this IRQ,
14043 * but in Linux this does not cause problems and is
14044 diff -urNp linux-3.0.9/arch/x86/kernel/init_task.c linux-3.0.9/arch/x86/kernel/init_task.c
14045 --- linux-3.0.9/arch/x86/kernel/init_task.c 2011-11-11 13:12:24.000000000 -0500
14046 +++ linux-3.0.9/arch/x86/kernel/init_task.c 2011-11-15 20:02:59.000000000 -0500
14047 @@ -20,8 +20,7 @@ static struct sighand_struct init_sighan
14048 * way process stacks are handled. This is done by having a special
14049 * "init_task" linker map entry..
14050 */
14051 -union thread_union init_thread_union __init_task_data =
14052 - { INIT_THREAD_INFO(init_task) };
14053 +union thread_union init_thread_union __init_task_data;
14054
14055 /*
14056 * Initial task structure.
14057 @@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task);
14058 * section. Since TSS's are completely CPU-local, we want them
14059 * on exact cacheline boundaries, to eliminate cacheline ping-pong.
14060 */
14061 -DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
14062 -
14063 +struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
14064 +EXPORT_SYMBOL(init_tss);
14065 diff -urNp linux-3.0.9/arch/x86/kernel/ioport.c linux-3.0.9/arch/x86/kernel/ioport.c
14066 --- linux-3.0.9/arch/x86/kernel/ioport.c 2011-11-11 13:12:24.000000000 -0500
14067 +++ linux-3.0.9/arch/x86/kernel/ioport.c 2011-11-15 20:02:59.000000000 -0500
14068 @@ -6,6 +6,7 @@
14069 #include <linux/sched.h>
14070 #include <linux/kernel.h>
14071 #include <linux/capability.h>
14072 +#include <linux/security.h>
14073 #include <linux/errno.h>
14074 #include <linux/types.h>
14075 #include <linux/ioport.h>
14076 @@ -28,6 +29,12 @@ asmlinkage long sys_ioperm(unsigned long
14077
14078 if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
14079 return -EINVAL;
14080 +#ifdef CONFIG_GRKERNSEC_IO
14081 + if (turn_on && grsec_disable_privio) {
14082 + gr_handle_ioperm();
14083 + return -EPERM;
14084 + }
14085 +#endif
14086 if (turn_on && !capable(CAP_SYS_RAWIO))
14087 return -EPERM;
14088
14089 @@ -54,7 +61,7 @@ asmlinkage long sys_ioperm(unsigned long
14090 * because the ->io_bitmap_max value must match the bitmap
14091 * contents:
14092 */
14093 - tss = &per_cpu(init_tss, get_cpu());
14094 + tss = init_tss + get_cpu();
14095
14096 if (turn_on)
14097 bitmap_clear(t->io_bitmap_ptr, from, num);
14098 @@ -102,6 +109,12 @@ long sys_iopl(unsigned int level, struct
14099 return -EINVAL;
14100 /* Trying to gain more privileges? */
14101 if (level > old) {
14102 +#ifdef CONFIG_GRKERNSEC_IO
14103 + if (grsec_disable_privio) {
14104 + gr_handle_iopl();
14105 + return -EPERM;
14106 + }
14107 +#endif
14108 if (!capable(CAP_SYS_RAWIO))
14109 return -EPERM;
14110 }
14111 diff -urNp linux-3.0.9/arch/x86/kernel/irq_32.c linux-3.0.9/arch/x86/kernel/irq_32.c
14112 --- linux-3.0.9/arch/x86/kernel/irq_32.c 2011-11-11 13:12:24.000000000 -0500
14113 +++ linux-3.0.9/arch/x86/kernel/irq_32.c 2011-11-15 20:02:59.000000000 -0500
14114 @@ -36,7 +36,7 @@ static int check_stack_overflow(void)
14115 __asm__ __volatile__("andl %%esp,%0" :
14116 "=r" (sp) : "0" (THREAD_SIZE - 1));
14117
14118 - return sp < (sizeof(struct thread_info) + STACK_WARN);
14119 + return sp < STACK_WARN;
14120 }
14121
14122 static void print_stack_overflow(void)
14123 @@ -54,8 +54,8 @@ static inline void print_stack_overflow(
14124 * per-CPU IRQ handling contexts (thread information and stack)
14125 */
14126 union irq_ctx {
14127 - struct thread_info tinfo;
14128 - u32 stack[THREAD_SIZE/sizeof(u32)];
14129 + unsigned long previous_esp;
14130 + u32 stack[THREAD_SIZE/sizeof(u32)];
14131 } __attribute__((aligned(THREAD_SIZE)));
14132
14133 static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
14134 @@ -75,10 +75,9 @@ static void call_on_stack(void *func, vo
14135 static inline int
14136 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
14137 {
14138 - union irq_ctx *curctx, *irqctx;
14139 + union irq_ctx *irqctx;
14140 u32 *isp, arg1, arg2;
14141
14142 - curctx = (union irq_ctx *) current_thread_info();
14143 irqctx = __this_cpu_read(hardirq_ctx);
14144
14145 /*
14146 @@ -87,21 +86,16 @@ execute_on_irq_stack(int overflow, struc
14147 * handler) we can't do that and just have to keep using the
14148 * current stack (which is the irq stack already after all)
14149 */
14150 - if (unlikely(curctx == irqctx))
14151 + if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
14152 return 0;
14153
14154 /* build the stack frame on the IRQ stack */
14155 - isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
14156 - irqctx->tinfo.task = curctx->tinfo.task;
14157 - irqctx->tinfo.previous_esp = current_stack_pointer;
14158 + isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
14159 + irqctx->previous_esp = current_stack_pointer;
14160
14161 - /*
14162 - * Copy the softirq bits in preempt_count so that the
14163 - * softirq checks work in the hardirq context.
14164 - */
14165 - irqctx->tinfo.preempt_count =
14166 - (irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
14167 - (curctx->tinfo.preempt_count & SOFTIRQ_MASK);
14168 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14169 + __set_fs(MAKE_MM_SEG(0));
14170 +#endif
14171
14172 if (unlikely(overflow))
14173 call_on_stack(print_stack_overflow, isp);
14174 @@ -113,6 +107,11 @@ execute_on_irq_stack(int overflow, struc
14175 : "0" (irq), "1" (desc), "2" (isp),
14176 "D" (desc->handle_irq)
14177 : "memory", "cc", "ecx");
14178 +
14179 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14180 + __set_fs(current_thread_info()->addr_limit);
14181 +#endif
14182 +
14183 return 1;
14184 }
14185
14186 @@ -121,29 +120,11 @@ execute_on_irq_stack(int overflow, struc
14187 */
14188 void __cpuinit irq_ctx_init(int cpu)
14189 {
14190 - union irq_ctx *irqctx;
14191 -
14192 if (per_cpu(hardirq_ctx, cpu))
14193 return;
14194
14195 - irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
14196 - THREAD_FLAGS,
14197 - THREAD_ORDER));
14198 - memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
14199 - irqctx->tinfo.cpu = cpu;
14200 - irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
14201 - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
14202 -
14203 - per_cpu(hardirq_ctx, cpu) = irqctx;
14204 -
14205 - irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
14206 - THREAD_FLAGS,
14207 - THREAD_ORDER));
14208 - memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
14209 - irqctx->tinfo.cpu = cpu;
14210 - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
14211 -
14212 - per_cpu(softirq_ctx, cpu) = irqctx;
14213 + per_cpu(hardirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
14214 + per_cpu(softirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
14215
14216 printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
14217 cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
14218 @@ -152,7 +133,6 @@ void __cpuinit irq_ctx_init(int cpu)
14219 asmlinkage void do_softirq(void)
14220 {
14221 unsigned long flags;
14222 - struct thread_info *curctx;
14223 union irq_ctx *irqctx;
14224 u32 *isp;
14225
14226 @@ -162,15 +142,22 @@ asmlinkage void do_softirq(void)
14227 local_irq_save(flags);
14228
14229 if (local_softirq_pending()) {
14230 - curctx = current_thread_info();
14231 irqctx = __this_cpu_read(softirq_ctx);
14232 - irqctx->tinfo.task = curctx->task;
14233 - irqctx->tinfo.previous_esp = current_stack_pointer;
14234 + irqctx->previous_esp = current_stack_pointer;
14235
14236 /* build the stack frame on the softirq stack */
14237 - isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
14238 + isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
14239 +
14240 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14241 + __set_fs(MAKE_MM_SEG(0));
14242 +#endif
14243
14244 call_on_stack(__do_softirq, isp);
14245 +
14246 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14247 + __set_fs(current_thread_info()->addr_limit);
14248 +#endif
14249 +
14250 /*
14251 * Shouldn't happen, we returned above if in_interrupt():
14252 */
14253 diff -urNp linux-3.0.9/arch/x86/kernel/irq.c linux-3.0.9/arch/x86/kernel/irq.c
14254 --- linux-3.0.9/arch/x86/kernel/irq.c 2011-11-11 13:12:24.000000000 -0500
14255 +++ linux-3.0.9/arch/x86/kernel/irq.c 2011-11-15 20:02:59.000000000 -0500
14256 @@ -17,7 +17,7 @@
14257 #include <asm/mce.h>
14258 #include <asm/hw_irq.h>
14259
14260 -atomic_t irq_err_count;
14261 +atomic_unchecked_t irq_err_count;
14262
14263 /* Function pointer for generic interrupt vector handling */
14264 void (*x86_platform_ipi_callback)(void) = NULL;
14265 @@ -116,9 +116,9 @@ int arch_show_interrupts(struct seq_file
14266 seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
14267 seq_printf(p, " Machine check polls\n");
14268 #endif
14269 - seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
14270 + seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
14271 #if defined(CONFIG_X86_IO_APIC)
14272 - seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
14273 + seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
14274 #endif
14275 return 0;
14276 }
14277 @@ -158,10 +158,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
14278
14279 u64 arch_irq_stat(void)
14280 {
14281 - u64 sum = atomic_read(&irq_err_count);
14282 + u64 sum = atomic_read_unchecked(&irq_err_count);
14283
14284 #ifdef CONFIG_X86_IO_APIC
14285 - sum += atomic_read(&irq_mis_count);
14286 + sum += atomic_read_unchecked(&irq_mis_count);
14287 #endif
14288 return sum;
14289 }
14290 diff -urNp linux-3.0.9/arch/x86/kernel/kgdb.c linux-3.0.9/arch/x86/kernel/kgdb.c
14291 --- linux-3.0.9/arch/x86/kernel/kgdb.c 2011-11-11 13:12:24.000000000 -0500
14292 +++ linux-3.0.9/arch/x86/kernel/kgdb.c 2011-11-15 20:02:59.000000000 -0500
14293 @@ -124,11 +124,11 @@ char *dbg_get_reg(int regno, void *mem,
14294 #ifdef CONFIG_X86_32
14295 switch (regno) {
14296 case GDB_SS:
14297 - if (!user_mode_vm(regs))
14298 + if (!user_mode(regs))
14299 *(unsigned long *)mem = __KERNEL_DS;
14300 break;
14301 case GDB_SP:
14302 - if (!user_mode_vm(regs))
14303 + if (!user_mode(regs))
14304 *(unsigned long *)mem = kernel_stack_pointer(regs);
14305 break;
14306 case GDB_GS:
14307 @@ -473,12 +473,12 @@ int kgdb_arch_handle_exception(int e_vec
14308 case 'k':
14309 /* clear the trace bit */
14310 linux_regs->flags &= ~X86_EFLAGS_TF;
14311 - atomic_set(&kgdb_cpu_doing_single_step, -1);
14312 + atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
14313
14314 /* set the trace bit if we're stepping */
14315 if (remcomInBuffer[0] == 's') {
14316 linux_regs->flags |= X86_EFLAGS_TF;
14317 - atomic_set(&kgdb_cpu_doing_single_step,
14318 + atomic_set_unchecked(&kgdb_cpu_doing_single_step,
14319 raw_smp_processor_id());
14320 }
14321
14322 @@ -534,7 +534,7 @@ static int __kgdb_notify(struct die_args
14323 return NOTIFY_DONE;
14324
14325 case DIE_DEBUG:
14326 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
14327 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
14328 if (user_mode(regs))
14329 return single_step_cont(regs, args);
14330 break;
14331 diff -urNp linux-3.0.9/arch/x86/kernel/kprobes.c linux-3.0.9/arch/x86/kernel/kprobes.c
14332 --- linux-3.0.9/arch/x86/kernel/kprobes.c 2011-11-11 13:12:24.000000000 -0500
14333 +++ linux-3.0.9/arch/x86/kernel/kprobes.c 2011-11-15 20:02:59.000000000 -0500
14334 @@ -117,8 +117,11 @@ static void __kprobes __synthesize_relat
14335 } __attribute__((packed)) *insn;
14336
14337 insn = (struct __arch_relative_insn *)from;
14338 +
14339 + pax_open_kernel();
14340 insn->raddr = (s32)((long)(to) - ((long)(from) + 5));
14341 insn->op = op;
14342 + pax_close_kernel();
14343 }
14344
14345 /* Insert a jump instruction at address 'from', which jumps to address 'to'.*/
14346 @@ -155,7 +158,7 @@ static int __kprobes can_boost(kprobe_op
14347 kprobe_opcode_t opcode;
14348 kprobe_opcode_t *orig_opcodes = opcodes;
14349
14350 - if (search_exception_tables((unsigned long)opcodes))
14351 + if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
14352 return 0; /* Page fault may occur on this address. */
14353
14354 retry:
14355 @@ -316,7 +319,9 @@ static int __kprobes __copy_instruction(
14356 }
14357 }
14358 insn_get_length(&insn);
14359 + pax_open_kernel();
14360 memcpy(dest, insn.kaddr, insn.length);
14361 + pax_close_kernel();
14362
14363 #ifdef CONFIG_X86_64
14364 if (insn_rip_relative(&insn)) {
14365 @@ -340,7 +345,9 @@ static int __kprobes __copy_instruction(
14366 (u8 *) dest;
14367 BUG_ON((s64) (s32) newdisp != newdisp); /* Sanity check. */
14368 disp = (u8 *) dest + insn_offset_displacement(&insn);
14369 + pax_open_kernel();
14370 *(s32 *) disp = (s32) newdisp;
14371 + pax_close_kernel();
14372 }
14373 #endif
14374 return insn.length;
14375 @@ -354,12 +361,12 @@ static void __kprobes arch_copy_kprobe(s
14376 */
14377 __copy_instruction(p->ainsn.insn, p->addr, 0);
14378
14379 - if (can_boost(p->addr))
14380 + if (can_boost(ktla_ktva(p->addr)))
14381 p->ainsn.boostable = 0;
14382 else
14383 p->ainsn.boostable = -1;
14384
14385 - p->opcode = *p->addr;
14386 + p->opcode = *(ktla_ktva(p->addr));
14387 }
14388
14389 int __kprobes arch_prepare_kprobe(struct kprobe *p)
14390 @@ -476,7 +483,7 @@ static void __kprobes setup_singlestep(s
14391 * nor set current_kprobe, because it doesn't use single
14392 * stepping.
14393 */
14394 - regs->ip = (unsigned long)p->ainsn.insn;
14395 + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
14396 preempt_enable_no_resched();
14397 return;
14398 }
14399 @@ -495,7 +502,7 @@ static void __kprobes setup_singlestep(s
14400 if (p->opcode == BREAKPOINT_INSTRUCTION)
14401 regs->ip = (unsigned long)p->addr;
14402 else
14403 - regs->ip = (unsigned long)p->ainsn.insn;
14404 + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
14405 }
14406
14407 /*
14408 @@ -574,7 +581,7 @@ static int __kprobes kprobe_handler(stru
14409 setup_singlestep(p, regs, kcb, 0);
14410 return 1;
14411 }
14412 - } else if (*addr != BREAKPOINT_INSTRUCTION) {
14413 + } else if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
14414 /*
14415 * The breakpoint instruction was removed right
14416 * after we hit it. Another cpu has removed
14417 @@ -682,6 +689,9 @@ static void __used __kprobes kretprobe_t
14418 " movq %rax, 152(%rsp)\n"
14419 RESTORE_REGS_STRING
14420 " popfq\n"
14421 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN
14422 + " btsq $63,(%rsp)\n"
14423 +#endif
14424 #else
14425 " pushf\n"
14426 SAVE_REGS_STRING
14427 @@ -819,7 +829,7 @@ static void __kprobes resume_execution(s
14428 struct pt_regs *regs, struct kprobe_ctlblk *kcb)
14429 {
14430 unsigned long *tos = stack_addr(regs);
14431 - unsigned long copy_ip = (unsigned long)p->ainsn.insn;
14432 + unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
14433 unsigned long orig_ip = (unsigned long)p->addr;
14434 kprobe_opcode_t *insn = p->ainsn.insn;
14435
14436 @@ -1001,7 +1011,7 @@ int __kprobes kprobe_exceptions_notify(s
14437 struct die_args *args = data;
14438 int ret = NOTIFY_DONE;
14439
14440 - if (args->regs && user_mode_vm(args->regs))
14441 + if (args->regs && user_mode(args->regs))
14442 return ret;
14443
14444 switch (val) {
14445 @@ -1383,7 +1393,7 @@ int __kprobes arch_prepare_optimized_kpr
14446 * Verify if the address gap is in 2GB range, because this uses
14447 * a relative jump.
14448 */
14449 - rel = (long)op->optinsn.insn - (long)op->kp.addr + RELATIVEJUMP_SIZE;
14450 + rel = (long)op->optinsn.insn - ktla_ktva((long)op->kp.addr) + RELATIVEJUMP_SIZE;
14451 if (abs(rel) > 0x7fffffff)
14452 return -ERANGE;
14453
14454 @@ -1404,11 +1414,11 @@ int __kprobes arch_prepare_optimized_kpr
14455 synthesize_set_arg1(buf + TMPL_MOVE_IDX, (unsigned long)op);
14456
14457 /* Set probe function call */
14458 - synthesize_relcall(buf + TMPL_CALL_IDX, optimized_callback);
14459 + synthesize_relcall(buf + TMPL_CALL_IDX, ktla_ktva(optimized_callback));
14460
14461 /* Set returning jmp instruction at the tail of out-of-line buffer */
14462 synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size,
14463 - (u8 *)op->kp.addr + op->optinsn.size);
14464 + (u8 *)ktla_ktva(op->kp.addr) + op->optinsn.size);
14465
14466 flush_icache_range((unsigned long) buf,
14467 (unsigned long) buf + TMPL_END_IDX +
14468 @@ -1430,7 +1440,7 @@ static void __kprobes setup_optimize_kpr
14469 ((long)op->kp.addr + RELATIVEJUMP_SIZE));
14470
14471 /* Backup instructions which will be replaced by jump address */
14472 - memcpy(op->optinsn.copied_insn, op->kp.addr + INT3_SIZE,
14473 + memcpy(op->optinsn.copied_insn, ktla_ktva(op->kp.addr) + INT3_SIZE,
14474 RELATIVE_ADDR_SIZE);
14475
14476 insn_buf[0] = RELATIVEJUMP_OPCODE;
14477 diff -urNp linux-3.0.9/arch/x86/kernel/kvm.c linux-3.0.9/arch/x86/kernel/kvm.c
14478 --- linux-3.0.9/arch/x86/kernel/kvm.c 2011-11-11 13:12:24.000000000 -0500
14479 +++ linux-3.0.9/arch/x86/kernel/kvm.c 2011-11-15 20:02:59.000000000 -0500
14480 @@ -426,6 +426,7 @@ static void __init paravirt_ops_setup(vo
14481 pv_mmu_ops.set_pud = kvm_set_pud;
14482 #if PAGETABLE_LEVELS == 4
14483 pv_mmu_ops.set_pgd = kvm_set_pgd;
14484 + pv_mmu_ops.set_pgd_batched = kvm_set_pgd;
14485 #endif
14486 #endif
14487 pv_mmu_ops.flush_tlb_user = kvm_flush_tlb;
14488 diff -urNp linux-3.0.9/arch/x86/kernel/ldt.c linux-3.0.9/arch/x86/kernel/ldt.c
14489 --- linux-3.0.9/arch/x86/kernel/ldt.c 2011-11-11 13:12:24.000000000 -0500
14490 +++ linux-3.0.9/arch/x86/kernel/ldt.c 2011-11-15 20:02:59.000000000 -0500
14491 @@ -67,13 +67,13 @@ static int alloc_ldt(mm_context_t *pc, i
14492 if (reload) {
14493 #ifdef CONFIG_SMP
14494 preempt_disable();
14495 - load_LDT(pc);
14496 + load_LDT_nolock(pc);
14497 if (!cpumask_equal(mm_cpumask(current->mm),
14498 cpumask_of(smp_processor_id())))
14499 smp_call_function(flush_ldt, current->mm, 1);
14500 preempt_enable();
14501 #else
14502 - load_LDT(pc);
14503 + load_LDT_nolock(pc);
14504 #endif
14505 }
14506 if (oldsize) {
14507 @@ -95,7 +95,7 @@ static inline int copy_ldt(mm_context_t
14508 return err;
14509
14510 for (i = 0; i < old->size; i++)
14511 - write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
14512 + write_ldt_entry(new->ldt, i, old->ldt + i);
14513 return 0;
14514 }
14515
14516 @@ -116,6 +116,24 @@ int init_new_context(struct task_struct
14517 retval = copy_ldt(&mm->context, &old_mm->context);
14518 mutex_unlock(&old_mm->context.lock);
14519 }
14520 +
14521 + if (tsk == current) {
14522 + mm->context.vdso = 0;
14523 +
14524 +#ifdef CONFIG_X86_32
14525 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
14526 + mm->context.user_cs_base = 0UL;
14527 + mm->context.user_cs_limit = ~0UL;
14528 +
14529 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
14530 + cpus_clear(mm->context.cpu_user_cs_mask);
14531 +#endif
14532 +
14533 +#endif
14534 +#endif
14535 +
14536 + }
14537 +
14538 return retval;
14539 }
14540
14541 @@ -230,6 +248,13 @@ static int write_ldt(void __user *ptr, u
14542 }
14543 }
14544
14545 +#ifdef CONFIG_PAX_SEGMEXEC
14546 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
14547 + error = -EINVAL;
14548 + goto out_unlock;
14549 + }
14550 +#endif
14551 +
14552 fill_ldt(&ldt, &ldt_info);
14553 if (oldmode)
14554 ldt.avl = 0;
14555 diff -urNp linux-3.0.9/arch/x86/kernel/machine_kexec_32.c linux-3.0.9/arch/x86/kernel/machine_kexec_32.c
14556 --- linux-3.0.9/arch/x86/kernel/machine_kexec_32.c 2011-11-11 13:12:24.000000000 -0500
14557 +++ linux-3.0.9/arch/x86/kernel/machine_kexec_32.c 2011-11-15 20:02:59.000000000 -0500
14558 @@ -27,7 +27,7 @@
14559 #include <asm/cacheflush.h>
14560 #include <asm/debugreg.h>
14561
14562 -static void set_idt(void *newidt, __u16 limit)
14563 +static void set_idt(struct desc_struct *newidt, __u16 limit)
14564 {
14565 struct desc_ptr curidt;
14566
14567 @@ -39,7 +39,7 @@ static void set_idt(void *newidt, __u16
14568 }
14569
14570
14571 -static void set_gdt(void *newgdt, __u16 limit)
14572 +static void set_gdt(struct desc_struct *newgdt, __u16 limit)
14573 {
14574 struct desc_ptr curgdt;
14575
14576 @@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
14577 }
14578
14579 control_page = page_address(image->control_code_page);
14580 - memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
14581 + memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
14582
14583 relocate_kernel_ptr = control_page;
14584 page_list[PA_CONTROL_PAGE] = __pa(control_page);
14585 diff -urNp linux-3.0.9/arch/x86/kernel/microcode_intel.c linux-3.0.9/arch/x86/kernel/microcode_intel.c
14586 --- linux-3.0.9/arch/x86/kernel/microcode_intel.c 2011-11-11 13:12:24.000000000 -0500
14587 +++ linux-3.0.9/arch/x86/kernel/microcode_intel.c 2011-11-15 20:02:59.000000000 -0500
14588 @@ -440,13 +440,13 @@ static enum ucode_state request_microcod
14589
14590 static int get_ucode_user(void *to, const void *from, size_t n)
14591 {
14592 - return copy_from_user(to, from, n);
14593 + return copy_from_user(to, (const void __force_user *)from, n);
14594 }
14595
14596 static enum ucode_state
14597 request_microcode_user(int cpu, const void __user *buf, size_t size)
14598 {
14599 - return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
14600 + return generic_load_microcode(cpu, (__force_kernel void *)buf, size, &get_ucode_user);
14601 }
14602
14603 static void microcode_fini_cpu(int cpu)
14604 diff -urNp linux-3.0.9/arch/x86/kernel/module.c linux-3.0.9/arch/x86/kernel/module.c
14605 --- linux-3.0.9/arch/x86/kernel/module.c 2011-11-11 13:12:24.000000000 -0500
14606 +++ linux-3.0.9/arch/x86/kernel/module.c 2011-11-15 20:02:59.000000000 -0500
14607 @@ -36,21 +36,66 @@
14608 #define DEBUGP(fmt...)
14609 #endif
14610
14611 -void *module_alloc(unsigned long size)
14612 +static inline void *__module_alloc(unsigned long size, pgprot_t prot)
14613 {
14614 if (PAGE_ALIGN(size) > MODULES_LEN)
14615 return NULL;
14616 return __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,
14617 - GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
14618 + GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot,
14619 -1, __builtin_return_address(0));
14620 }
14621
14622 +void *module_alloc(unsigned long size)
14623 +{
14624 +
14625 +#ifdef CONFIG_PAX_KERNEXEC
14626 + return __module_alloc(size, PAGE_KERNEL);
14627 +#else
14628 + return __module_alloc(size, PAGE_KERNEL_EXEC);
14629 +#endif
14630 +
14631 +}
14632 +
14633 /* Free memory returned from module_alloc */
14634 void module_free(struct module *mod, void *module_region)
14635 {
14636 vfree(module_region);
14637 }
14638
14639 +#ifdef CONFIG_PAX_KERNEXEC
14640 +#ifdef CONFIG_X86_32
14641 +void *module_alloc_exec(unsigned long size)
14642 +{
14643 + struct vm_struct *area;
14644 +
14645 + if (size == 0)
14646 + return NULL;
14647 +
14648 + area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
14649 + return area ? area->addr : NULL;
14650 +}
14651 +EXPORT_SYMBOL(module_alloc_exec);
14652 +
14653 +void module_free_exec(struct module *mod, void *module_region)
14654 +{
14655 + vunmap(module_region);
14656 +}
14657 +EXPORT_SYMBOL(module_free_exec);
14658 +#else
14659 +void module_free_exec(struct module *mod, void *module_region)
14660 +{
14661 + module_free(mod, module_region);
14662 +}
14663 +EXPORT_SYMBOL(module_free_exec);
14664 +
14665 +void *module_alloc_exec(unsigned long size)
14666 +{
14667 + return __module_alloc(size, PAGE_KERNEL_RX);
14668 +}
14669 +EXPORT_SYMBOL(module_alloc_exec);
14670 +#endif
14671 +#endif
14672 +
14673 /* We don't need anything special. */
14674 int module_frob_arch_sections(Elf_Ehdr *hdr,
14675 Elf_Shdr *sechdrs,
14676 @@ -70,14 +115,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
14677 unsigned int i;
14678 Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
14679 Elf32_Sym *sym;
14680 - uint32_t *location;
14681 + uint32_t *plocation, location;
14682
14683 DEBUGP("Applying relocate section %u to %u\n", relsec,
14684 sechdrs[relsec].sh_info);
14685 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
14686 /* This is where to make the change */
14687 - location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
14688 - + rel[i].r_offset;
14689 + plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
14690 + location = (uint32_t)plocation;
14691 + if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
14692 + plocation = ktla_ktva((void *)plocation);
14693 /* This is the symbol it is referring to. Note that all
14694 undefined symbols have been resolved. */
14695 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
14696 @@ -86,11 +133,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
14697 switch (ELF32_R_TYPE(rel[i].r_info)) {
14698 case R_386_32:
14699 /* We add the value into the location given */
14700 - *location += sym->st_value;
14701 + pax_open_kernel();
14702 + *plocation += sym->st_value;
14703 + pax_close_kernel();
14704 break;
14705 case R_386_PC32:
14706 /* Add the value, subtract its postition */
14707 - *location += sym->st_value - (uint32_t)location;
14708 + pax_open_kernel();
14709 + *plocation += sym->st_value - location;
14710 + pax_close_kernel();
14711 break;
14712 default:
14713 printk(KERN_ERR "module %s: Unknown relocation: %u\n",
14714 @@ -146,21 +197,30 @@ int apply_relocate_add(Elf64_Shdr *sechd
14715 case R_X86_64_NONE:
14716 break;
14717 case R_X86_64_64:
14718 + pax_open_kernel();
14719 *(u64 *)loc = val;
14720 + pax_close_kernel();
14721 break;
14722 case R_X86_64_32:
14723 + pax_open_kernel();
14724 *(u32 *)loc = val;
14725 + pax_close_kernel();
14726 if (val != *(u32 *)loc)
14727 goto overflow;
14728 break;
14729 case R_X86_64_32S:
14730 + pax_open_kernel();
14731 *(s32 *)loc = val;
14732 + pax_close_kernel();
14733 if ((s64)val != *(s32 *)loc)
14734 goto overflow;
14735 break;
14736 case R_X86_64_PC32:
14737 val -= (u64)loc;
14738 + pax_open_kernel();
14739 *(u32 *)loc = val;
14740 + pax_close_kernel();
14741 +
14742 #if 0
14743 if ((s64)val != *(s32 *)loc)
14744 goto overflow;
14745 diff -urNp linux-3.0.9/arch/x86/kernel/paravirt.c linux-3.0.9/arch/x86/kernel/paravirt.c
14746 --- linux-3.0.9/arch/x86/kernel/paravirt.c 2011-11-11 13:12:24.000000000 -0500
14747 +++ linux-3.0.9/arch/x86/kernel/paravirt.c 2011-11-15 20:02:59.000000000 -0500
14748 @@ -53,6 +53,9 @@ u64 _paravirt_ident_64(u64 x)
14749 {
14750 return x;
14751 }
14752 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
14753 +PV_CALLEE_SAVE_REGS_THUNK(_paravirt_ident_64);
14754 +#endif
14755
14756 void __init default_banner(void)
14757 {
14758 @@ -122,7 +125,7 @@ unsigned paravirt_patch_jmp(void *insnbu
14759 * corresponding structure. */
14760 static void *get_call_destination(u8 type)
14761 {
14762 - struct paravirt_patch_template tmpl = {
14763 + const struct paravirt_patch_template tmpl = {
14764 .pv_init_ops = pv_init_ops,
14765 .pv_time_ops = pv_time_ops,
14766 .pv_cpu_ops = pv_cpu_ops,
14767 @@ -133,6 +136,9 @@ static void *get_call_destination(u8 typ
14768 .pv_lock_ops = pv_lock_ops,
14769 #endif
14770 };
14771 +
14772 + pax_track_stack();
14773 +
14774 return *((void **)&tmpl + type);
14775 }
14776
14777 @@ -145,15 +151,19 @@ unsigned paravirt_patch_default(u8 type,
14778 if (opfunc == NULL)
14779 /* If there's no function, patch it with a ud2a (BUG) */
14780 ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
14781 - else if (opfunc == _paravirt_nop)
14782 + else if (opfunc == (void *)_paravirt_nop)
14783 /* If the operation is a nop, then nop the callsite */
14784 ret = paravirt_patch_nop();
14785
14786 /* identity functions just return their single argument */
14787 - else if (opfunc == _paravirt_ident_32)
14788 + else if (opfunc == (void *)_paravirt_ident_32)
14789 ret = paravirt_patch_ident_32(insnbuf, len);
14790 - else if (opfunc == _paravirt_ident_64)
14791 + else if (opfunc == (void *)_paravirt_ident_64)
14792 ret = paravirt_patch_ident_64(insnbuf, len);
14793 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
14794 + else if (opfunc == (void *)__raw_callee_save__paravirt_ident_64)
14795 + ret = paravirt_patch_ident_64(insnbuf, len);
14796 +#endif
14797
14798 else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
14799 type == PARAVIRT_PATCH(pv_cpu_ops.irq_enable_sysexit) ||
14800 @@ -178,7 +188,7 @@ unsigned paravirt_patch_insns(void *insn
14801 if (insn_len > len || start == NULL)
14802 insn_len = len;
14803 else
14804 - memcpy(insnbuf, start, insn_len);
14805 + memcpy(insnbuf, ktla_ktva(start), insn_len);
14806
14807 return insn_len;
14808 }
14809 @@ -294,22 +304,22 @@ void arch_flush_lazy_mmu_mode(void)
14810 preempt_enable();
14811 }
14812
14813 -struct pv_info pv_info = {
14814 +struct pv_info pv_info __read_only = {
14815 .name = "bare hardware",
14816 .paravirt_enabled = 0,
14817 .kernel_rpl = 0,
14818 .shared_kernel_pmd = 1, /* Only used when CONFIG_X86_PAE is set */
14819 };
14820
14821 -struct pv_init_ops pv_init_ops = {
14822 +struct pv_init_ops pv_init_ops __read_only = {
14823 .patch = native_patch,
14824 };
14825
14826 -struct pv_time_ops pv_time_ops = {
14827 +struct pv_time_ops pv_time_ops __read_only = {
14828 .sched_clock = native_sched_clock,
14829 };
14830
14831 -struct pv_irq_ops pv_irq_ops = {
14832 +struct pv_irq_ops pv_irq_ops __read_only = {
14833 .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
14834 .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
14835 .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
14836 @@ -321,7 +331,7 @@ struct pv_irq_ops pv_irq_ops = {
14837 #endif
14838 };
14839
14840 -struct pv_cpu_ops pv_cpu_ops = {
14841 +struct pv_cpu_ops pv_cpu_ops __read_only = {
14842 .cpuid = native_cpuid,
14843 .get_debugreg = native_get_debugreg,
14844 .set_debugreg = native_set_debugreg,
14845 @@ -382,21 +392,26 @@ struct pv_cpu_ops pv_cpu_ops = {
14846 .end_context_switch = paravirt_nop,
14847 };
14848
14849 -struct pv_apic_ops pv_apic_ops = {
14850 +struct pv_apic_ops pv_apic_ops __read_only = {
14851 #ifdef CONFIG_X86_LOCAL_APIC
14852 .startup_ipi_hook = paravirt_nop,
14853 #endif
14854 };
14855
14856 -#if defined(CONFIG_X86_32) && !defined(CONFIG_X86_PAE)
14857 +#ifdef CONFIG_X86_32
14858 +#ifdef CONFIG_X86_PAE
14859 +/* 64-bit pagetable entries */
14860 +#define PTE_IDENT PV_CALLEE_SAVE(_paravirt_ident_64)
14861 +#else
14862 /* 32-bit pagetable entries */
14863 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_32)
14864 +#endif
14865 #else
14866 /* 64-bit pagetable entries */
14867 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
14868 #endif
14869
14870 -struct pv_mmu_ops pv_mmu_ops = {
14871 +struct pv_mmu_ops pv_mmu_ops __read_only = {
14872
14873 .read_cr2 = native_read_cr2,
14874 .write_cr2 = native_write_cr2,
14875 @@ -446,6 +461,7 @@ struct pv_mmu_ops pv_mmu_ops = {
14876 .make_pud = PTE_IDENT,
14877
14878 .set_pgd = native_set_pgd,
14879 + .set_pgd_batched = native_set_pgd_batched,
14880 #endif
14881 #endif /* PAGETABLE_LEVELS >= 3 */
14882
14883 @@ -465,6 +481,12 @@ struct pv_mmu_ops pv_mmu_ops = {
14884 },
14885
14886 .set_fixmap = native_set_fixmap,
14887 +
14888 +#ifdef CONFIG_PAX_KERNEXEC
14889 + .pax_open_kernel = native_pax_open_kernel,
14890 + .pax_close_kernel = native_pax_close_kernel,
14891 +#endif
14892 +
14893 };
14894
14895 EXPORT_SYMBOL_GPL(pv_time_ops);
14896 diff -urNp linux-3.0.9/arch/x86/kernel/paravirt-spinlocks.c linux-3.0.9/arch/x86/kernel/paravirt-spinlocks.c
14897 --- linux-3.0.9/arch/x86/kernel/paravirt-spinlocks.c 2011-11-11 13:12:24.000000000 -0500
14898 +++ linux-3.0.9/arch/x86/kernel/paravirt-spinlocks.c 2011-11-15 20:02:59.000000000 -0500
14899 @@ -13,7 +13,7 @@ default_spin_lock_flags(arch_spinlock_t
14900 arch_spin_lock(lock);
14901 }
14902
14903 -struct pv_lock_ops pv_lock_ops = {
14904 +struct pv_lock_ops pv_lock_ops __read_only = {
14905 #ifdef CONFIG_SMP
14906 .spin_is_locked = __ticket_spin_is_locked,
14907 .spin_is_contended = __ticket_spin_is_contended,
14908 diff -urNp linux-3.0.9/arch/x86/kernel/pci-iommu_table.c linux-3.0.9/arch/x86/kernel/pci-iommu_table.c
14909 --- linux-3.0.9/arch/x86/kernel/pci-iommu_table.c 2011-11-11 13:12:24.000000000 -0500
14910 +++ linux-3.0.9/arch/x86/kernel/pci-iommu_table.c 2011-11-15 20:02:59.000000000 -0500
14911 @@ -2,7 +2,7 @@
14912 #include <asm/iommu_table.h>
14913 #include <linux/string.h>
14914 #include <linux/kallsyms.h>
14915 -
14916 +#include <linux/sched.h>
14917
14918 #define DEBUG 1
14919
14920 @@ -51,6 +51,8 @@ void __init check_iommu_entries(struct i
14921 {
14922 struct iommu_table_entry *p, *q, *x;
14923
14924 + pax_track_stack();
14925 +
14926 /* Simple cyclic dependency checker. */
14927 for (p = start; p < finish; p++) {
14928 q = find_dependents_of(start, finish, p);
14929 diff -urNp linux-3.0.9/arch/x86/kernel/process_32.c linux-3.0.9/arch/x86/kernel/process_32.c
14930 --- linux-3.0.9/arch/x86/kernel/process_32.c 2011-11-11 13:12:24.000000000 -0500
14931 +++ linux-3.0.9/arch/x86/kernel/process_32.c 2011-11-15 20:02:59.000000000 -0500
14932 @@ -65,6 +65,7 @@ asmlinkage void ret_from_fork(void) __as
14933 unsigned long thread_saved_pc(struct task_struct *tsk)
14934 {
14935 return ((unsigned long *)tsk->thread.sp)[3];
14936 +//XXX return tsk->thread.eip;
14937 }
14938
14939 #ifndef CONFIG_SMP
14940 @@ -126,15 +127,14 @@ void __show_regs(struct pt_regs *regs, i
14941 unsigned long sp;
14942 unsigned short ss, gs;
14943
14944 - if (user_mode_vm(regs)) {
14945 + if (user_mode(regs)) {
14946 sp = regs->sp;
14947 ss = regs->ss & 0xffff;
14948 - gs = get_user_gs(regs);
14949 } else {
14950 sp = kernel_stack_pointer(regs);
14951 savesegment(ss, ss);
14952 - savesegment(gs, gs);
14953 }
14954 + gs = get_user_gs(regs);
14955
14956 show_regs_common();
14957
14958 @@ -196,13 +196,14 @@ int copy_thread(unsigned long clone_flag
14959 struct task_struct *tsk;
14960 int err;
14961
14962 - childregs = task_pt_regs(p);
14963 + childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
14964 *childregs = *regs;
14965 childregs->ax = 0;
14966 childregs->sp = sp;
14967
14968 p->thread.sp = (unsigned long) childregs;
14969 p->thread.sp0 = (unsigned long) (childregs+1);
14970 + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
14971
14972 p->thread.ip = (unsigned long) ret_from_fork;
14973
14974 @@ -292,7 +293,7 @@ __switch_to(struct task_struct *prev_p,
14975 struct thread_struct *prev = &prev_p->thread,
14976 *next = &next_p->thread;
14977 int cpu = smp_processor_id();
14978 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
14979 + struct tss_struct *tss = init_tss + cpu;
14980 bool preload_fpu;
14981
14982 /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
14983 @@ -327,6 +328,10 @@ __switch_to(struct task_struct *prev_p,
14984 */
14985 lazy_save_gs(prev->gs);
14986
14987 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14988 + __set_fs(task_thread_info(next_p)->addr_limit);
14989 +#endif
14990 +
14991 /*
14992 * Load the per-thread Thread-Local Storage descriptor.
14993 */
14994 @@ -362,6 +367,9 @@ __switch_to(struct task_struct *prev_p,
14995 */
14996 arch_end_context_switch(next_p);
14997
14998 + percpu_write(current_task, next_p);
14999 + percpu_write(current_tinfo, &next_p->tinfo);
15000 +
15001 if (preload_fpu)
15002 __math_state_restore();
15003
15004 @@ -371,8 +379,6 @@ __switch_to(struct task_struct *prev_p,
15005 if (prev->gs | next->gs)
15006 lazy_load_gs(next->gs);
15007
15008 - percpu_write(current_task, next_p);
15009 -
15010 return prev_p;
15011 }
15012
15013 @@ -402,4 +408,3 @@ unsigned long get_wchan(struct task_stru
15014 } while (count++ < 16);
15015 return 0;
15016 }
15017 -
15018 diff -urNp linux-3.0.9/arch/x86/kernel/process_64.c linux-3.0.9/arch/x86/kernel/process_64.c
15019 --- linux-3.0.9/arch/x86/kernel/process_64.c 2011-11-11 13:12:24.000000000 -0500
15020 +++ linux-3.0.9/arch/x86/kernel/process_64.c 2011-11-15 20:02:59.000000000 -0500
15021 @@ -87,7 +87,7 @@ static void __exit_idle(void)
15022 void exit_idle(void)
15023 {
15024 /* idle loop has pid 0 */
15025 - if (current->pid)
15026 + if (task_pid_nr(current))
15027 return;
15028 __exit_idle();
15029 }
15030 @@ -260,8 +260,7 @@ int copy_thread(unsigned long clone_flag
15031 struct pt_regs *childregs;
15032 struct task_struct *me = current;
15033
15034 - childregs = ((struct pt_regs *)
15035 - (THREAD_SIZE + task_stack_page(p))) - 1;
15036 + childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
15037 *childregs = *regs;
15038
15039 childregs->ax = 0;
15040 @@ -273,6 +272,7 @@ int copy_thread(unsigned long clone_flag
15041 p->thread.sp = (unsigned long) childregs;
15042 p->thread.sp0 = (unsigned long) (childregs+1);
15043 p->thread.usersp = me->thread.usersp;
15044 + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
15045
15046 set_tsk_thread_flag(p, TIF_FORK);
15047
15048 @@ -375,7 +375,7 @@ __switch_to(struct task_struct *prev_p,
15049 struct thread_struct *prev = &prev_p->thread;
15050 struct thread_struct *next = &next_p->thread;
15051 int cpu = smp_processor_id();
15052 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
15053 + struct tss_struct *tss = init_tss + cpu;
15054 unsigned fsindex, gsindex;
15055 bool preload_fpu;
15056
15057 @@ -471,10 +471,9 @@ __switch_to(struct task_struct *prev_p,
15058 prev->usersp = percpu_read(old_rsp);
15059 percpu_write(old_rsp, next->usersp);
15060 percpu_write(current_task, next_p);
15061 + percpu_write(current_tinfo, &next_p->tinfo);
15062
15063 - percpu_write(kernel_stack,
15064 - (unsigned long)task_stack_page(next_p) +
15065 - THREAD_SIZE - KERNEL_STACK_OFFSET);
15066 + percpu_write(kernel_stack, next->sp0);
15067
15068 /*
15069 * Now maybe reload the debug registers and handle I/O bitmaps
15070 @@ -536,12 +535,11 @@ unsigned long get_wchan(struct task_stru
15071 if (!p || p == current || p->state == TASK_RUNNING)
15072 return 0;
15073 stack = (unsigned long)task_stack_page(p);
15074 - if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
15075 + if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
15076 return 0;
15077 fp = *(u64 *)(p->thread.sp);
15078 do {
15079 - if (fp < (unsigned long)stack ||
15080 - fp >= (unsigned long)stack+THREAD_SIZE)
15081 + if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
15082 return 0;
15083 ip = *(u64 *)(fp+8);
15084 if (!in_sched_functions(ip))
15085 diff -urNp linux-3.0.9/arch/x86/kernel/process.c linux-3.0.9/arch/x86/kernel/process.c
15086 --- linux-3.0.9/arch/x86/kernel/process.c 2011-11-11 13:12:24.000000000 -0500
15087 +++ linux-3.0.9/arch/x86/kernel/process.c 2011-11-15 20:02:59.000000000 -0500
15088 @@ -48,16 +48,33 @@ void free_thread_xstate(struct task_stru
15089
15090 void free_thread_info(struct thread_info *ti)
15091 {
15092 - free_thread_xstate(ti->task);
15093 free_pages((unsigned long)ti, get_order(THREAD_SIZE));
15094 }
15095
15096 +static struct kmem_cache *task_struct_cachep;
15097 +
15098 void arch_task_cache_init(void)
15099 {
15100 - task_xstate_cachep =
15101 - kmem_cache_create("task_xstate", xstate_size,
15102 + /* create a slab on which task_structs can be allocated */
15103 + task_struct_cachep =
15104 + kmem_cache_create("task_struct", sizeof(struct task_struct),
15105 + ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
15106 +
15107 + task_xstate_cachep =
15108 + kmem_cache_create("task_xstate", xstate_size,
15109 __alignof__(union thread_xstate),
15110 - SLAB_PANIC | SLAB_NOTRACK, NULL);
15111 + SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
15112 +}
15113 +
15114 +struct task_struct *alloc_task_struct_node(int node)
15115 +{
15116 + return kmem_cache_alloc_node(task_struct_cachep, GFP_KERNEL, node);
15117 +}
15118 +
15119 +void free_task_struct(struct task_struct *task)
15120 +{
15121 + free_thread_xstate(task);
15122 + kmem_cache_free(task_struct_cachep, task);
15123 }
15124
15125 /*
15126 @@ -70,7 +87,7 @@ void exit_thread(void)
15127 unsigned long *bp = t->io_bitmap_ptr;
15128
15129 if (bp) {
15130 - struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
15131 + struct tss_struct *tss = init_tss + get_cpu();
15132
15133 t->io_bitmap_ptr = NULL;
15134 clear_thread_flag(TIF_IO_BITMAP);
15135 @@ -106,7 +123,7 @@ void show_regs_common(void)
15136
15137 printk(KERN_CONT "\n");
15138 printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s",
15139 - current->pid, current->comm, print_tainted(),
15140 + task_pid_nr(current), current->comm, print_tainted(),
15141 init_utsname()->release,
15142 (int)strcspn(init_utsname()->version, " "),
15143 init_utsname()->version);
15144 @@ -120,6 +137,9 @@ void flush_thread(void)
15145 {
15146 struct task_struct *tsk = current;
15147
15148 +#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
15149 + loadsegment(gs, 0);
15150 +#endif
15151 flush_ptrace_hw_breakpoint(tsk);
15152 memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
15153 /*
15154 @@ -282,10 +302,10 @@ int kernel_thread(int (*fn)(void *), voi
15155 regs.di = (unsigned long) arg;
15156
15157 #ifdef CONFIG_X86_32
15158 - regs.ds = __USER_DS;
15159 - regs.es = __USER_DS;
15160 + regs.ds = __KERNEL_DS;
15161 + regs.es = __KERNEL_DS;
15162 regs.fs = __KERNEL_PERCPU;
15163 - regs.gs = __KERNEL_STACK_CANARY;
15164 + savesegment(gs, regs.gs);
15165 #else
15166 regs.ss = __KERNEL_DS;
15167 #endif
15168 @@ -403,7 +423,7 @@ void default_idle(void)
15169 EXPORT_SYMBOL(default_idle);
15170 #endif
15171
15172 -void stop_this_cpu(void *dummy)
15173 +__noreturn void stop_this_cpu(void *dummy)
15174 {
15175 local_irq_disable();
15176 /*
15177 @@ -668,16 +688,37 @@ static int __init idle_setup(char *str)
15178 }
15179 early_param("idle", idle_setup);
15180
15181 -unsigned long arch_align_stack(unsigned long sp)
15182 +#ifdef CONFIG_PAX_RANDKSTACK
15183 +void pax_randomize_kstack(struct pt_regs *regs)
15184 {
15185 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
15186 - sp -= get_random_int() % 8192;
15187 - return sp & ~0xf;
15188 -}
15189 + struct thread_struct *thread = &current->thread;
15190 + unsigned long time;
15191
15192 -unsigned long arch_randomize_brk(struct mm_struct *mm)
15193 -{
15194 - unsigned long range_end = mm->brk + 0x02000000;
15195 - return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
15196 -}
15197 + if (!randomize_va_space)
15198 + return;
15199 +
15200 + if (v8086_mode(regs))
15201 + return;
15202
15203 + rdtscl(time);
15204 +
15205 + /* P4 seems to return a 0 LSB, ignore it */
15206 +#ifdef CONFIG_MPENTIUM4
15207 + time &= 0x3EUL;
15208 + time <<= 2;
15209 +#elif defined(CONFIG_X86_64)
15210 + time &= 0xFUL;
15211 + time <<= 4;
15212 +#else
15213 + time &= 0x1FUL;
15214 + time <<= 3;
15215 +#endif
15216 +
15217 + thread->sp0 ^= time;
15218 + load_sp0(init_tss + smp_processor_id(), thread);
15219 +
15220 +#ifdef CONFIG_X86_64
15221 + percpu_write(kernel_stack, thread->sp0);
15222 +#endif
15223 +}
15224 +#endif
15225 diff -urNp linux-3.0.9/arch/x86/kernel/ptrace.c linux-3.0.9/arch/x86/kernel/ptrace.c
15226 --- linux-3.0.9/arch/x86/kernel/ptrace.c 2011-11-11 13:12:24.000000000 -0500
15227 +++ linux-3.0.9/arch/x86/kernel/ptrace.c 2011-11-15 20:02:59.000000000 -0500
15228 @@ -821,7 +821,7 @@ long arch_ptrace(struct task_struct *chi
15229 unsigned long addr, unsigned long data)
15230 {
15231 int ret;
15232 - unsigned long __user *datap = (unsigned long __user *)data;
15233 + unsigned long __user *datap = (__force unsigned long __user *)data;
15234
15235 switch (request) {
15236 /* read the word at location addr in the USER area. */
15237 @@ -906,14 +906,14 @@ long arch_ptrace(struct task_struct *chi
15238 if ((int) addr < 0)
15239 return -EIO;
15240 ret = do_get_thread_area(child, addr,
15241 - (struct user_desc __user *)data);
15242 + (__force struct user_desc __user *) data);
15243 break;
15244
15245 case PTRACE_SET_THREAD_AREA:
15246 if ((int) addr < 0)
15247 return -EIO;
15248 ret = do_set_thread_area(child, addr,
15249 - (struct user_desc __user *)data, 0);
15250 + (__force struct user_desc __user *) data, 0);
15251 break;
15252 #endif
15253
15254 @@ -1330,7 +1330,7 @@ static void fill_sigtrap_info(struct tas
15255 memset(info, 0, sizeof(*info));
15256 info->si_signo = SIGTRAP;
15257 info->si_code = si_code;
15258 - info->si_addr = user_mode_vm(regs) ? (void __user *)regs->ip : NULL;
15259 + info->si_addr = user_mode(regs) ? (__force void __user *)regs->ip : NULL;
15260 }
15261
15262 void user_single_step_siginfo(struct task_struct *tsk,
15263 diff -urNp linux-3.0.9/arch/x86/kernel/pvclock.c linux-3.0.9/arch/x86/kernel/pvclock.c
15264 --- linux-3.0.9/arch/x86/kernel/pvclock.c 2011-11-11 13:12:24.000000000 -0500
15265 +++ linux-3.0.9/arch/x86/kernel/pvclock.c 2011-11-15 20:02:59.000000000 -0500
15266 @@ -81,11 +81,11 @@ unsigned long pvclock_tsc_khz(struct pvc
15267 return pv_tsc_khz;
15268 }
15269
15270 -static atomic64_t last_value = ATOMIC64_INIT(0);
15271 +static atomic64_unchecked_t last_value = ATOMIC64_INIT(0);
15272
15273 void pvclock_resume(void)
15274 {
15275 - atomic64_set(&last_value, 0);
15276 + atomic64_set_unchecked(&last_value, 0);
15277 }
15278
15279 cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
15280 @@ -121,11 +121,11 @@ cycle_t pvclock_clocksource_read(struct
15281 * updating at the same time, and one of them could be slightly behind,
15282 * making the assumption that last_value always go forward fail to hold.
15283 */
15284 - last = atomic64_read(&last_value);
15285 + last = atomic64_read_unchecked(&last_value);
15286 do {
15287 if (ret < last)
15288 return last;
15289 - last = atomic64_cmpxchg(&last_value, last, ret);
15290 + last = atomic64_cmpxchg_unchecked(&last_value, last, ret);
15291 } while (unlikely(last != ret));
15292
15293 return ret;
15294 diff -urNp linux-3.0.9/arch/x86/kernel/reboot.c linux-3.0.9/arch/x86/kernel/reboot.c
15295 --- linux-3.0.9/arch/x86/kernel/reboot.c 2011-11-11 13:12:24.000000000 -0500
15296 +++ linux-3.0.9/arch/x86/kernel/reboot.c 2011-11-15 20:02:59.000000000 -0500
15297 @@ -35,7 +35,7 @@ void (*pm_power_off)(void);
15298 EXPORT_SYMBOL(pm_power_off);
15299
15300 static const struct desc_ptr no_idt = {};
15301 -static int reboot_mode;
15302 +static unsigned short reboot_mode;
15303 enum reboot_type reboot_type = BOOT_ACPI;
15304 int reboot_force;
15305
15306 @@ -315,13 +315,17 @@ core_initcall(reboot_init);
15307 extern const unsigned char machine_real_restart_asm[];
15308 extern const u64 machine_real_restart_gdt[3];
15309
15310 -void machine_real_restart(unsigned int type)
15311 +__noreturn void machine_real_restart(unsigned int type)
15312 {
15313 void *restart_va;
15314 unsigned long restart_pa;
15315 - void (*restart_lowmem)(unsigned int);
15316 + void (* __noreturn restart_lowmem)(unsigned int);
15317 u64 *lowmem_gdt;
15318
15319 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
15320 + struct desc_struct *gdt;
15321 +#endif
15322 +
15323 local_irq_disable();
15324
15325 /* Write zero to CMOS register number 0x0f, which the BIOS POST
15326 @@ -347,14 +351,14 @@ void machine_real_restart(unsigned int t
15327 boot)". This seems like a fairly standard thing that gets set by
15328 REBOOT.COM programs, and the previous reset routine did this
15329 too. */
15330 - *((unsigned short *)0x472) = reboot_mode;
15331 + *(unsigned short *)(__va(0x472)) = reboot_mode;
15332
15333 /* Patch the GDT in the low memory trampoline */
15334 lowmem_gdt = TRAMPOLINE_SYM(machine_real_restart_gdt);
15335
15336 restart_va = TRAMPOLINE_SYM(machine_real_restart_asm);
15337 restart_pa = virt_to_phys(restart_va);
15338 - restart_lowmem = (void (*)(unsigned int))restart_pa;
15339 + restart_lowmem = (void *)restart_pa;
15340
15341 /* GDT[0]: GDT self-pointer */
15342 lowmem_gdt[0] =
15343 @@ -365,7 +369,33 @@ void machine_real_restart(unsigned int t
15344 GDT_ENTRY(0x009b, restart_pa, 0xffff);
15345
15346 /* Jump to the identity-mapped low memory code */
15347 +
15348 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
15349 + gdt = get_cpu_gdt_table(smp_processor_id());
15350 + pax_open_kernel();
15351 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15352 + gdt[GDT_ENTRY_KERNEL_DS].type = 3;
15353 + gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
15354 + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
15355 +#endif
15356 +#ifdef CONFIG_PAX_KERNEXEC
15357 + gdt[GDT_ENTRY_KERNEL_CS].base0 = 0;
15358 + gdt[GDT_ENTRY_KERNEL_CS].base1 = 0;
15359 + gdt[GDT_ENTRY_KERNEL_CS].base2 = 0;
15360 + gdt[GDT_ENTRY_KERNEL_CS].limit0 = 0xffff;
15361 + gdt[GDT_ENTRY_KERNEL_CS].limit = 0xf;
15362 + gdt[GDT_ENTRY_KERNEL_CS].g = 1;
15363 +#endif
15364 + pax_close_kernel();
15365 +#endif
15366 +
15367 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
15368 + asm volatile("push %0; push %1; lret\n" : : "i" (__KERNEL_CS), "rm" (restart_lowmem), "a" (type));
15369 + unreachable();
15370 +#else
15371 restart_lowmem(type);
15372 +#endif
15373 +
15374 }
15375 #ifdef CONFIG_APM_MODULE
15376 EXPORT_SYMBOL(machine_real_restart);
15377 @@ -523,7 +553,7 @@ void __attribute__((weak)) mach_reboot_f
15378 * try to force a triple fault and then cycle between hitting the keyboard
15379 * controller and doing that
15380 */
15381 -static void native_machine_emergency_restart(void)
15382 +__noreturn static void native_machine_emergency_restart(void)
15383 {
15384 int i;
15385 int attempt = 0;
15386 @@ -647,13 +677,13 @@ void native_machine_shutdown(void)
15387 #endif
15388 }
15389
15390 -static void __machine_emergency_restart(int emergency)
15391 +static __noreturn void __machine_emergency_restart(int emergency)
15392 {
15393 reboot_emergency = emergency;
15394 machine_ops.emergency_restart();
15395 }
15396
15397 -static void native_machine_restart(char *__unused)
15398 +static __noreturn void native_machine_restart(char *__unused)
15399 {
15400 printk("machine restart\n");
15401
15402 @@ -662,7 +692,7 @@ static void native_machine_restart(char
15403 __machine_emergency_restart(0);
15404 }
15405
15406 -static void native_machine_halt(void)
15407 +static __noreturn void native_machine_halt(void)
15408 {
15409 /* stop other cpus and apics */
15410 machine_shutdown();
15411 @@ -673,7 +703,7 @@ static void native_machine_halt(void)
15412 stop_this_cpu(NULL);
15413 }
15414
15415 -static void native_machine_power_off(void)
15416 +__noreturn static void native_machine_power_off(void)
15417 {
15418 if (pm_power_off) {
15419 if (!reboot_force)
15420 @@ -682,6 +712,7 @@ static void native_machine_power_off(voi
15421 }
15422 /* a fallback in case there is no PM info available */
15423 tboot_shutdown(TB_SHUTDOWN_HALT);
15424 + unreachable();
15425 }
15426
15427 struct machine_ops machine_ops = {
15428 diff -urNp linux-3.0.9/arch/x86/kernel/setup.c linux-3.0.9/arch/x86/kernel/setup.c
15429 --- linux-3.0.9/arch/x86/kernel/setup.c 2011-11-11 13:12:24.000000000 -0500
15430 +++ linux-3.0.9/arch/x86/kernel/setup.c 2011-11-15 20:02:59.000000000 -0500
15431 @@ -447,7 +447,7 @@ static void __init parse_setup_data(void
15432
15433 switch (data->type) {
15434 case SETUP_E820_EXT:
15435 - parse_e820_ext(data);
15436 + parse_e820_ext((struct setup_data __force_kernel *)data);
15437 break;
15438 case SETUP_DTB:
15439 add_dtb(pa_data);
15440 @@ -650,7 +650,7 @@ static void __init trim_bios_range(void)
15441 * area (640->1Mb) as ram even though it is not.
15442 * take them out.
15443 */
15444 - e820_remove_range(BIOS_BEGIN, BIOS_END - BIOS_BEGIN, E820_RAM, 1);
15445 + e820_remove_range(ISA_START_ADDRESS, ISA_END_ADDRESS - ISA_START_ADDRESS, E820_RAM, 1);
15446 sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
15447 }
15448
15449 @@ -773,14 +773,14 @@ void __init setup_arch(char **cmdline_p)
15450
15451 if (!boot_params.hdr.root_flags)
15452 root_mountflags &= ~MS_RDONLY;
15453 - init_mm.start_code = (unsigned long) _text;
15454 - init_mm.end_code = (unsigned long) _etext;
15455 + init_mm.start_code = ktla_ktva((unsigned long) _text);
15456 + init_mm.end_code = ktla_ktva((unsigned long) _etext);
15457 init_mm.end_data = (unsigned long) _edata;
15458 init_mm.brk = _brk_end;
15459
15460 - code_resource.start = virt_to_phys(_text);
15461 - code_resource.end = virt_to_phys(_etext)-1;
15462 - data_resource.start = virt_to_phys(_etext);
15463 + code_resource.start = virt_to_phys(ktla_ktva(_text));
15464 + code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
15465 + data_resource.start = virt_to_phys(_sdata);
15466 data_resource.end = virt_to_phys(_edata)-1;
15467 bss_resource.start = virt_to_phys(&__bss_start);
15468 bss_resource.end = virt_to_phys(&__bss_stop)-1;
15469 diff -urNp linux-3.0.9/arch/x86/kernel/setup_percpu.c linux-3.0.9/arch/x86/kernel/setup_percpu.c
15470 --- linux-3.0.9/arch/x86/kernel/setup_percpu.c 2011-11-11 13:12:24.000000000 -0500
15471 +++ linux-3.0.9/arch/x86/kernel/setup_percpu.c 2011-11-15 20:02:59.000000000 -0500
15472 @@ -21,19 +21,17 @@
15473 #include <asm/cpu.h>
15474 #include <asm/stackprotector.h>
15475
15476 -DEFINE_PER_CPU(int, cpu_number);
15477 +#ifdef CONFIG_SMP
15478 +DEFINE_PER_CPU(unsigned int, cpu_number);
15479 EXPORT_PER_CPU_SYMBOL(cpu_number);
15480 +#endif
15481
15482 -#ifdef CONFIG_X86_64
15483 #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
15484 -#else
15485 -#define BOOT_PERCPU_OFFSET 0
15486 -#endif
15487
15488 DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
15489 EXPORT_PER_CPU_SYMBOL(this_cpu_off);
15490
15491 -unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
15492 +unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
15493 [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
15494 };
15495 EXPORT_SYMBOL(__per_cpu_offset);
15496 @@ -155,10 +153,10 @@ static inline void setup_percpu_segment(
15497 {
15498 #ifdef CONFIG_X86_32
15499 struct desc_struct gdt;
15500 + unsigned long base = per_cpu_offset(cpu);
15501
15502 - pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
15503 - 0x2 | DESCTYPE_S, 0x8);
15504 - gdt.s = 1;
15505 + pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
15506 + 0x83 | DESCTYPE_S, 0xC);
15507 write_gdt_entry(get_cpu_gdt_table(cpu),
15508 GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
15509 #endif
15510 @@ -207,6 +205,11 @@ void __init setup_per_cpu_areas(void)
15511 /* alrighty, percpu areas up and running */
15512 delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
15513 for_each_possible_cpu(cpu) {
15514 +#ifdef CONFIG_CC_STACKPROTECTOR
15515 +#ifdef CONFIG_X86_32
15516 + unsigned long canary = per_cpu(stack_canary.canary, cpu);
15517 +#endif
15518 +#endif
15519 per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
15520 per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
15521 per_cpu(cpu_number, cpu) = cpu;
15522 @@ -247,6 +250,12 @@ void __init setup_per_cpu_areas(void)
15523 */
15524 set_cpu_numa_node(cpu, early_cpu_to_node(cpu));
15525 #endif
15526 +#ifdef CONFIG_CC_STACKPROTECTOR
15527 +#ifdef CONFIG_X86_32
15528 + if (!cpu)
15529 + per_cpu(stack_canary.canary, cpu) = canary;
15530 +#endif
15531 +#endif
15532 /*
15533 * Up to this point, the boot CPU has been using .init.data
15534 * area. Reload any changed state for the boot CPU.
15535 diff -urNp linux-3.0.9/arch/x86/kernel/signal.c linux-3.0.9/arch/x86/kernel/signal.c
15536 --- linux-3.0.9/arch/x86/kernel/signal.c 2011-11-11 13:12:24.000000000 -0500
15537 +++ linux-3.0.9/arch/x86/kernel/signal.c 2011-11-15 20:02:59.000000000 -0500
15538 @@ -198,7 +198,7 @@ static unsigned long align_sigframe(unsi
15539 * Align the stack pointer according to the i386 ABI,
15540 * i.e. so that on function entry ((sp + 4) & 15) == 0.
15541 */
15542 - sp = ((sp + 4) & -16ul) - 4;
15543 + sp = ((sp - 12) & -16ul) - 4;
15544 #else /* !CONFIG_X86_32 */
15545 sp = round_down(sp, 16) - 8;
15546 #endif
15547 @@ -249,11 +249,11 @@ get_sigframe(struct k_sigaction *ka, str
15548 * Return an always-bogus address instead so we will die with SIGSEGV.
15549 */
15550 if (onsigstack && !likely(on_sig_stack(sp)))
15551 - return (void __user *)-1L;
15552 + return (__force void __user *)-1L;
15553
15554 /* save i387 state */
15555 if (used_math() && save_i387_xstate(*fpstate) < 0)
15556 - return (void __user *)-1L;
15557 + return (__force void __user *)-1L;
15558
15559 return (void __user *)sp;
15560 }
15561 @@ -308,9 +308,9 @@ __setup_frame(int sig, struct k_sigactio
15562 }
15563
15564 if (current->mm->context.vdso)
15565 - restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
15566 + restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
15567 else
15568 - restorer = &frame->retcode;
15569 + restorer = (void __user *)&frame->retcode;
15570 if (ka->sa.sa_flags & SA_RESTORER)
15571 restorer = ka->sa.sa_restorer;
15572
15573 @@ -324,7 +324,7 @@ __setup_frame(int sig, struct k_sigactio
15574 * reasons and because gdb uses it as a signature to notice
15575 * signal handler stack frames.
15576 */
15577 - err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
15578 + err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
15579
15580 if (err)
15581 return -EFAULT;
15582 @@ -378,7 +378,10 @@ static int __setup_rt_frame(int sig, str
15583 err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
15584
15585 /* Set up to return from userspace. */
15586 - restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
15587 + if (current->mm->context.vdso)
15588 + restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
15589 + else
15590 + restorer = (void __user *)&frame->retcode;
15591 if (ka->sa.sa_flags & SA_RESTORER)
15592 restorer = ka->sa.sa_restorer;
15593 put_user_ex(restorer, &frame->pretcode);
15594 @@ -390,7 +393,7 @@ static int __setup_rt_frame(int sig, str
15595 * reasons and because gdb uses it as a signature to notice
15596 * signal handler stack frames.
15597 */
15598 - put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
15599 + put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
15600 } put_user_catch(err);
15601
15602 if (err)
15603 @@ -769,6 +772,8 @@ static void do_signal(struct pt_regs *re
15604 int signr;
15605 sigset_t *oldset;
15606
15607 + pax_track_stack();
15608 +
15609 /*
15610 * We want the common case to go fast, which is why we may in certain
15611 * cases get here from kernel mode. Just return without doing anything
15612 @@ -776,7 +781,7 @@ static void do_signal(struct pt_regs *re
15613 * X86_32: vm86 regs switched out by assembly code before reaching
15614 * here, so testing against kernel CS suffices.
15615 */
15616 - if (!user_mode(regs))
15617 + if (!user_mode_novm(regs))
15618 return;
15619
15620 if (current_thread_info()->status & TS_RESTORE_SIGMASK)
15621 diff -urNp linux-3.0.9/arch/x86/kernel/smpboot.c linux-3.0.9/arch/x86/kernel/smpboot.c
15622 --- linux-3.0.9/arch/x86/kernel/smpboot.c 2011-11-11 13:12:24.000000000 -0500
15623 +++ linux-3.0.9/arch/x86/kernel/smpboot.c 2011-11-15 20:02:59.000000000 -0500
15624 @@ -709,17 +709,20 @@ static int __cpuinit do_boot_cpu(int api
15625 set_idle_for_cpu(cpu, c_idle.idle);
15626 do_rest:
15627 per_cpu(current_task, cpu) = c_idle.idle;
15628 + per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
15629 #ifdef CONFIG_X86_32
15630 /* Stack for startup_32 can be just as for start_secondary onwards */
15631 irq_ctx_init(cpu);
15632 #else
15633 clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
15634 initial_gs = per_cpu_offset(cpu);
15635 - per_cpu(kernel_stack, cpu) =
15636 - (unsigned long)task_stack_page(c_idle.idle) -
15637 - KERNEL_STACK_OFFSET + THREAD_SIZE;
15638 + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
15639 #endif
15640 +
15641 + pax_open_kernel();
15642 early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
15643 + pax_close_kernel();
15644 +
15645 initial_code = (unsigned long)start_secondary;
15646 stack_start = c_idle.idle->thread.sp;
15647
15648 @@ -861,6 +864,12 @@ int __cpuinit native_cpu_up(unsigned int
15649
15650 per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
15651
15652 +#ifdef CONFIG_PAX_PER_CPU_PGD
15653 + clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
15654 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
15655 + KERNEL_PGD_PTRS);
15656 +#endif
15657 +
15658 err = do_boot_cpu(apicid, cpu);
15659 if (err) {
15660 pr_debug("do_boot_cpu failed %d\n", err);
15661 diff -urNp linux-3.0.9/arch/x86/kernel/step.c linux-3.0.9/arch/x86/kernel/step.c
15662 --- linux-3.0.9/arch/x86/kernel/step.c 2011-11-11 13:12:24.000000000 -0500
15663 +++ linux-3.0.9/arch/x86/kernel/step.c 2011-11-15 20:02:59.000000000 -0500
15664 @@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
15665 struct desc_struct *desc;
15666 unsigned long base;
15667
15668 - seg &= ~7UL;
15669 + seg >>= 3;
15670
15671 mutex_lock(&child->mm->context.lock);
15672 - if (unlikely((seg >> 3) >= child->mm->context.size))
15673 + if (unlikely(seg >= child->mm->context.size))
15674 addr = -1L; /* bogus selector, access would fault */
15675 else {
15676 desc = child->mm->context.ldt + seg;
15677 @@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struc
15678 addr += base;
15679 }
15680 mutex_unlock(&child->mm->context.lock);
15681 - }
15682 + } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
15683 + addr = ktla_ktva(addr);
15684
15685 return addr;
15686 }
15687 @@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct t
15688 unsigned char opcode[15];
15689 unsigned long addr = convert_ip_to_linear(child, regs);
15690
15691 + if (addr == -EINVAL)
15692 + return 0;
15693 +
15694 copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
15695 for (i = 0; i < copied; i++) {
15696 switch (opcode[i]) {
15697 @@ -74,7 +78,7 @@ static int is_setting_trap_flag(struct t
15698
15699 #ifdef CONFIG_X86_64
15700 case 0x40 ... 0x4f:
15701 - if (regs->cs != __USER_CS)
15702 + if ((regs->cs & 0xffff) != __USER_CS)
15703 /* 32-bit mode: register increment */
15704 return 0;
15705 /* 64-bit mode: REX prefix */
15706 diff -urNp linux-3.0.9/arch/x86/kernel/syscall_table_32.S linux-3.0.9/arch/x86/kernel/syscall_table_32.S
15707 --- linux-3.0.9/arch/x86/kernel/syscall_table_32.S 2011-11-11 13:12:24.000000000 -0500
15708 +++ linux-3.0.9/arch/x86/kernel/syscall_table_32.S 2011-11-15 20:02:59.000000000 -0500
15709 @@ -1,3 +1,4 @@
15710 +.section .rodata,"a",@progbits
15711 ENTRY(sys_call_table)
15712 .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
15713 .long sys_exit
15714 diff -urNp linux-3.0.9/arch/x86/kernel/sys_i386_32.c linux-3.0.9/arch/x86/kernel/sys_i386_32.c
15715 --- linux-3.0.9/arch/x86/kernel/sys_i386_32.c 2011-11-11 13:12:24.000000000 -0500
15716 +++ linux-3.0.9/arch/x86/kernel/sys_i386_32.c 2011-11-15 20:02:59.000000000 -0500
15717 @@ -24,17 +24,224 @@
15718
15719 #include <asm/syscalls.h>
15720
15721 -/*
15722 - * Do a system call from kernel instead of calling sys_execve so we
15723 - * end up with proper pt_regs.
15724 - */
15725 -int kernel_execve(const char *filename,
15726 - const char *const argv[],
15727 - const char *const envp[])
15728 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
15729 {
15730 - long __res;
15731 - asm volatile ("int $0x80"
15732 - : "=a" (__res)
15733 - : "0" (__NR_execve), "b" (filename), "c" (argv), "d" (envp) : "memory");
15734 - return __res;
15735 + unsigned long pax_task_size = TASK_SIZE;
15736 +
15737 +#ifdef CONFIG_PAX_SEGMEXEC
15738 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
15739 + pax_task_size = SEGMEXEC_TASK_SIZE;
15740 +#endif
15741 +
15742 + if (len > pax_task_size || addr > pax_task_size - len)
15743 + return -EINVAL;
15744 +
15745 + return 0;
15746 +}
15747 +
15748 +unsigned long
15749 +arch_get_unmapped_area(struct file *filp, unsigned long addr,
15750 + unsigned long len, unsigned long pgoff, unsigned long flags)
15751 +{
15752 + struct mm_struct *mm = current->mm;
15753 + struct vm_area_struct *vma;
15754 + unsigned long start_addr, pax_task_size = TASK_SIZE;
15755 +
15756 +#ifdef CONFIG_PAX_SEGMEXEC
15757 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
15758 + pax_task_size = SEGMEXEC_TASK_SIZE;
15759 +#endif
15760 +
15761 + pax_task_size -= PAGE_SIZE;
15762 +
15763 + if (len > pax_task_size)
15764 + return -ENOMEM;
15765 +
15766 + if (flags & MAP_FIXED)
15767 + return addr;
15768 +
15769 +#ifdef CONFIG_PAX_RANDMMAP
15770 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
15771 +#endif
15772 +
15773 + if (addr) {
15774 + addr = PAGE_ALIGN(addr);
15775 + if (pax_task_size - len >= addr) {
15776 + vma = find_vma(mm, addr);
15777 + if (check_heap_stack_gap(vma, addr, len))
15778 + return addr;
15779 + }
15780 + }
15781 + if (len > mm->cached_hole_size) {
15782 + start_addr = addr = mm->free_area_cache;
15783 + } else {
15784 + start_addr = addr = mm->mmap_base;
15785 + mm->cached_hole_size = 0;
15786 + }
15787 +
15788 +#ifdef CONFIG_PAX_PAGEEXEC
15789 + if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
15790 + start_addr = 0x00110000UL;
15791 +
15792 +#ifdef CONFIG_PAX_RANDMMAP
15793 + if (mm->pax_flags & MF_PAX_RANDMMAP)
15794 + start_addr += mm->delta_mmap & 0x03FFF000UL;
15795 +#endif
15796 +
15797 + if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
15798 + start_addr = addr = mm->mmap_base;
15799 + else
15800 + addr = start_addr;
15801 + }
15802 +#endif
15803 +
15804 +full_search:
15805 + for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
15806 + /* At this point: (!vma || addr < vma->vm_end). */
15807 + if (pax_task_size - len < addr) {
15808 + /*
15809 + * Start a new search - just in case we missed
15810 + * some holes.
15811 + */
15812 + if (start_addr != mm->mmap_base) {
15813 + start_addr = addr = mm->mmap_base;
15814 + mm->cached_hole_size = 0;
15815 + goto full_search;
15816 + }
15817 + return -ENOMEM;
15818 + }
15819 + if (check_heap_stack_gap(vma, addr, len))
15820 + break;
15821 + if (addr + mm->cached_hole_size < vma->vm_start)
15822 + mm->cached_hole_size = vma->vm_start - addr;
15823 + addr = vma->vm_end;
15824 + if (mm->start_brk <= addr && addr < mm->mmap_base) {
15825 + start_addr = addr = mm->mmap_base;
15826 + mm->cached_hole_size = 0;
15827 + goto full_search;
15828 + }
15829 + }
15830 +
15831 + /*
15832 + * Remember the place where we stopped the search:
15833 + */
15834 + mm->free_area_cache = addr + len;
15835 + return addr;
15836 +}
15837 +
15838 +unsigned long
15839 +arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
15840 + const unsigned long len, const unsigned long pgoff,
15841 + const unsigned long flags)
15842 +{
15843 + struct vm_area_struct *vma;
15844 + struct mm_struct *mm = current->mm;
15845 + unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
15846 +
15847 +#ifdef CONFIG_PAX_SEGMEXEC
15848 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
15849 + pax_task_size = SEGMEXEC_TASK_SIZE;
15850 +#endif
15851 +
15852 + pax_task_size -= PAGE_SIZE;
15853 +
15854 + /* requested length too big for entire address space */
15855 + if (len > pax_task_size)
15856 + return -ENOMEM;
15857 +
15858 + if (flags & MAP_FIXED)
15859 + return addr;
15860 +
15861 +#ifdef CONFIG_PAX_PAGEEXEC
15862 + if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
15863 + goto bottomup;
15864 +#endif
15865 +
15866 +#ifdef CONFIG_PAX_RANDMMAP
15867 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
15868 +#endif
15869 +
15870 + /* requesting a specific address */
15871 + if (addr) {
15872 + addr = PAGE_ALIGN(addr);
15873 + if (pax_task_size - len >= addr) {
15874 + vma = find_vma(mm, addr);
15875 + if (check_heap_stack_gap(vma, addr, len))
15876 + return addr;
15877 + }
15878 + }
15879 +
15880 + /* check if free_area_cache is useful for us */
15881 + if (len <= mm->cached_hole_size) {
15882 + mm->cached_hole_size = 0;
15883 + mm->free_area_cache = mm->mmap_base;
15884 + }
15885 +
15886 + /* either no address requested or can't fit in requested address hole */
15887 + addr = mm->free_area_cache;
15888 +
15889 + /* make sure it can fit in the remaining address space */
15890 + if (addr > len) {
15891 + vma = find_vma(mm, addr-len);
15892 + if (check_heap_stack_gap(vma, addr - len, len))
15893 + /* remember the address as a hint for next time */
15894 + return (mm->free_area_cache = addr-len);
15895 + }
15896 +
15897 + if (mm->mmap_base < len)
15898 + goto bottomup;
15899 +
15900 + addr = mm->mmap_base-len;
15901 +
15902 + do {
15903 + /*
15904 + * Lookup failure means no vma is above this address,
15905 + * else if new region fits below vma->vm_start,
15906 + * return with success:
15907 + */
15908 + vma = find_vma(mm, addr);
15909 + if (check_heap_stack_gap(vma, addr, len))
15910 + /* remember the address as a hint for next time */
15911 + return (mm->free_area_cache = addr);
15912 +
15913 + /* remember the largest hole we saw so far */
15914 + if (addr + mm->cached_hole_size < vma->vm_start)
15915 + mm->cached_hole_size = vma->vm_start - addr;
15916 +
15917 + /* try just below the current vma->vm_start */
15918 + addr = skip_heap_stack_gap(vma, len);
15919 + } while (!IS_ERR_VALUE(addr));
15920 +
15921 +bottomup:
15922 + /*
15923 + * A failed mmap() very likely causes application failure,
15924 + * so fall back to the bottom-up function here. This scenario
15925 + * can happen with large stack limits and large mmap()
15926 + * allocations.
15927 + */
15928 +
15929 +#ifdef CONFIG_PAX_SEGMEXEC
15930 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
15931 + mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
15932 + else
15933 +#endif
15934 +
15935 + mm->mmap_base = TASK_UNMAPPED_BASE;
15936 +
15937 +#ifdef CONFIG_PAX_RANDMMAP
15938 + if (mm->pax_flags & MF_PAX_RANDMMAP)
15939 + mm->mmap_base += mm->delta_mmap;
15940 +#endif
15941 +
15942 + mm->free_area_cache = mm->mmap_base;
15943 + mm->cached_hole_size = ~0UL;
15944 + addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
15945 + /*
15946 + * Restore the topdown base:
15947 + */
15948 + mm->mmap_base = base;
15949 + mm->free_area_cache = base;
15950 + mm->cached_hole_size = ~0UL;
15951 +
15952 + return addr;
15953 }
15954 diff -urNp linux-3.0.9/arch/x86/kernel/sys_x86_64.c linux-3.0.9/arch/x86/kernel/sys_x86_64.c
15955 --- linux-3.0.9/arch/x86/kernel/sys_x86_64.c 2011-11-11 13:12:24.000000000 -0500
15956 +++ linux-3.0.9/arch/x86/kernel/sys_x86_64.c 2011-11-15 20:02:59.000000000 -0500
15957 @@ -32,8 +32,8 @@ out:
15958 return error;
15959 }
15960
15961 -static void find_start_end(unsigned long flags, unsigned long *begin,
15962 - unsigned long *end)
15963 +static void find_start_end(struct mm_struct *mm, unsigned long flags,
15964 + unsigned long *begin, unsigned long *end)
15965 {
15966 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
15967 unsigned long new_begin;
15968 @@ -52,7 +52,7 @@ static void find_start_end(unsigned long
15969 *begin = new_begin;
15970 }
15971 } else {
15972 - *begin = TASK_UNMAPPED_BASE;
15973 + *begin = mm->mmap_base;
15974 *end = TASK_SIZE;
15975 }
15976 }
15977 @@ -69,16 +69,19 @@ arch_get_unmapped_area(struct file *filp
15978 if (flags & MAP_FIXED)
15979 return addr;
15980
15981 - find_start_end(flags, &begin, &end);
15982 + find_start_end(mm, flags, &begin, &end);
15983
15984 if (len > end)
15985 return -ENOMEM;
15986
15987 +#ifdef CONFIG_PAX_RANDMMAP
15988 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
15989 +#endif
15990 +
15991 if (addr) {
15992 addr = PAGE_ALIGN(addr);
15993 vma = find_vma(mm, addr);
15994 - if (end - len >= addr &&
15995 - (!vma || addr + len <= vma->vm_start))
15996 + if (end - len >= addr && check_heap_stack_gap(vma, addr, len))
15997 return addr;
15998 }
15999 if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
16000 @@ -106,7 +109,7 @@ full_search:
16001 }
16002 return -ENOMEM;
16003 }
16004 - if (!vma || addr + len <= vma->vm_start) {
16005 + if (check_heap_stack_gap(vma, addr, len)) {
16006 /*
16007 * Remember the place where we stopped the search:
16008 */
16009 @@ -128,7 +131,7 @@ arch_get_unmapped_area_topdown(struct fi
16010 {
16011 struct vm_area_struct *vma;
16012 struct mm_struct *mm = current->mm;
16013 - unsigned long addr = addr0;
16014 + unsigned long base = mm->mmap_base, addr = addr0;
16015
16016 /* requested length too big for entire address space */
16017 if (len > TASK_SIZE)
16018 @@ -141,13 +144,18 @@ arch_get_unmapped_area_topdown(struct fi
16019 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
16020 goto bottomup;
16021
16022 +#ifdef CONFIG_PAX_RANDMMAP
16023 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
16024 +#endif
16025 +
16026 /* requesting a specific address */
16027 if (addr) {
16028 addr = PAGE_ALIGN(addr);
16029 - vma = find_vma(mm, addr);
16030 - if (TASK_SIZE - len >= addr &&
16031 - (!vma || addr + len <= vma->vm_start))
16032 - return addr;
16033 + if (TASK_SIZE - len >= addr) {
16034 + vma = find_vma(mm, addr);
16035 + if (check_heap_stack_gap(vma, addr, len))
16036 + return addr;
16037 + }
16038 }
16039
16040 /* check if free_area_cache is useful for us */
16041 @@ -162,7 +170,7 @@ arch_get_unmapped_area_topdown(struct fi
16042 /* make sure it can fit in the remaining address space */
16043 if (addr > len) {
16044 vma = find_vma(mm, addr-len);
16045 - if (!vma || addr <= vma->vm_start)
16046 + if (check_heap_stack_gap(vma, addr - len, len))
16047 /* remember the address as a hint for next time */
16048 return mm->free_area_cache = addr-len;
16049 }
16050 @@ -179,7 +187,7 @@ arch_get_unmapped_area_topdown(struct fi
16051 * return with success:
16052 */
16053 vma = find_vma(mm, addr);
16054 - if (!vma || addr+len <= vma->vm_start)
16055 + if (check_heap_stack_gap(vma, addr, len))
16056 /* remember the address as a hint for next time */
16057 return mm->free_area_cache = addr;
16058
16059 @@ -188,8 +196,8 @@ arch_get_unmapped_area_topdown(struct fi
16060 mm->cached_hole_size = vma->vm_start - addr;
16061
16062 /* try just below the current vma->vm_start */
16063 - addr = vma->vm_start-len;
16064 - } while (len < vma->vm_start);
16065 + addr = skip_heap_stack_gap(vma, len);
16066 + } while (!IS_ERR_VALUE(addr));
16067
16068 bottomup:
16069 /*
16070 @@ -198,13 +206,21 @@ bottomup:
16071 * can happen with large stack limits and large mmap()
16072 * allocations.
16073 */
16074 + mm->mmap_base = TASK_UNMAPPED_BASE;
16075 +
16076 +#ifdef CONFIG_PAX_RANDMMAP
16077 + if (mm->pax_flags & MF_PAX_RANDMMAP)
16078 + mm->mmap_base += mm->delta_mmap;
16079 +#endif
16080 +
16081 + mm->free_area_cache = mm->mmap_base;
16082 mm->cached_hole_size = ~0UL;
16083 - mm->free_area_cache = TASK_UNMAPPED_BASE;
16084 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
16085 /*
16086 * Restore the topdown base:
16087 */
16088 - mm->free_area_cache = mm->mmap_base;
16089 + mm->mmap_base = base;
16090 + mm->free_area_cache = base;
16091 mm->cached_hole_size = ~0UL;
16092
16093 return addr;
16094 diff -urNp linux-3.0.9/arch/x86/kernel/tboot.c linux-3.0.9/arch/x86/kernel/tboot.c
16095 --- linux-3.0.9/arch/x86/kernel/tboot.c 2011-11-11 13:12:24.000000000 -0500
16096 +++ linux-3.0.9/arch/x86/kernel/tboot.c 2011-11-15 20:02:59.000000000 -0500
16097 @@ -217,7 +217,7 @@ static int tboot_setup_sleep(void)
16098
16099 void tboot_shutdown(u32 shutdown_type)
16100 {
16101 - void (*shutdown)(void);
16102 + void (* __noreturn shutdown)(void);
16103
16104 if (!tboot_enabled())
16105 return;
16106 @@ -239,7 +239,7 @@ void tboot_shutdown(u32 shutdown_type)
16107
16108 switch_to_tboot_pt();
16109
16110 - shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
16111 + shutdown = (void *)tboot->shutdown_entry;
16112 shutdown();
16113
16114 /* should not reach here */
16115 @@ -296,7 +296,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1
16116 tboot_shutdown(acpi_shutdown_map[sleep_state]);
16117 }
16118
16119 -static atomic_t ap_wfs_count;
16120 +static atomic_unchecked_t ap_wfs_count;
16121
16122 static int tboot_wait_for_aps(int num_aps)
16123 {
16124 @@ -320,9 +320,9 @@ static int __cpuinit tboot_cpu_callback(
16125 {
16126 switch (action) {
16127 case CPU_DYING:
16128 - atomic_inc(&ap_wfs_count);
16129 + atomic_inc_unchecked(&ap_wfs_count);
16130 if (num_online_cpus() == 1)
16131 - if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
16132 + if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
16133 return NOTIFY_BAD;
16134 break;
16135 }
16136 @@ -341,7 +341,7 @@ static __init int tboot_late_init(void)
16137
16138 tboot_create_trampoline();
16139
16140 - atomic_set(&ap_wfs_count, 0);
16141 + atomic_set_unchecked(&ap_wfs_count, 0);
16142 register_hotcpu_notifier(&tboot_cpu_notifier);
16143 return 0;
16144 }
16145 diff -urNp linux-3.0.9/arch/x86/kernel/time.c linux-3.0.9/arch/x86/kernel/time.c
16146 --- linux-3.0.9/arch/x86/kernel/time.c 2011-11-11 13:12:24.000000000 -0500
16147 +++ linux-3.0.9/arch/x86/kernel/time.c 2011-11-15 20:02:59.000000000 -0500
16148 @@ -30,9 +30,9 @@ unsigned long profile_pc(struct pt_regs
16149 {
16150 unsigned long pc = instruction_pointer(regs);
16151
16152 - if (!user_mode_vm(regs) && in_lock_functions(pc)) {
16153 + if (!user_mode(regs) && in_lock_functions(pc)) {
16154 #ifdef CONFIG_FRAME_POINTER
16155 - return *(unsigned long *)(regs->bp + sizeof(long));
16156 + return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
16157 #else
16158 unsigned long *sp =
16159 (unsigned long *)kernel_stack_pointer(regs);
16160 @@ -41,11 +41,17 @@ unsigned long profile_pc(struct pt_regs
16161 * or above a saved flags. Eflags has bits 22-31 zero,
16162 * kernel addresses don't.
16163 */
16164 +
16165 +#ifdef CONFIG_PAX_KERNEXEC
16166 + return ktla_ktva(sp[0]);
16167 +#else
16168 if (sp[0] >> 22)
16169 return sp[0];
16170 if (sp[1] >> 22)
16171 return sp[1];
16172 #endif
16173 +
16174 +#endif
16175 }
16176 return pc;
16177 }
16178 diff -urNp linux-3.0.9/arch/x86/kernel/tls.c linux-3.0.9/arch/x86/kernel/tls.c
16179 --- linux-3.0.9/arch/x86/kernel/tls.c 2011-11-11 13:12:24.000000000 -0500
16180 +++ linux-3.0.9/arch/x86/kernel/tls.c 2011-11-15 20:02:59.000000000 -0500
16181 @@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
16182 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
16183 return -EINVAL;
16184
16185 +#ifdef CONFIG_PAX_SEGMEXEC
16186 + if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
16187 + return -EINVAL;
16188 +#endif
16189 +
16190 set_tls_desc(p, idx, &info, 1);
16191
16192 return 0;
16193 diff -urNp linux-3.0.9/arch/x86/kernel/trampoline_32.S linux-3.0.9/arch/x86/kernel/trampoline_32.S
16194 --- linux-3.0.9/arch/x86/kernel/trampoline_32.S 2011-11-11 13:12:24.000000000 -0500
16195 +++ linux-3.0.9/arch/x86/kernel/trampoline_32.S 2011-11-15 20:02:59.000000000 -0500
16196 @@ -32,6 +32,12 @@
16197 #include <asm/segment.h>
16198 #include <asm/page_types.h>
16199
16200 +#ifdef CONFIG_PAX_KERNEXEC
16201 +#define ta(X) (X)
16202 +#else
16203 +#define ta(X) ((X) - __PAGE_OFFSET)
16204 +#endif
16205 +
16206 #ifdef CONFIG_SMP
16207
16208 .section ".x86_trampoline","a"
16209 @@ -62,7 +68,7 @@ r_base = .
16210 inc %ax # protected mode (PE) bit
16211 lmsw %ax # into protected mode
16212 # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
16213 - ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
16214 + ljmpl $__BOOT_CS, $ta(startup_32_smp)
16215
16216 # These need to be in the same 64K segment as the above;
16217 # hence we don't use the boot_gdt_descr defined in head.S
16218 diff -urNp linux-3.0.9/arch/x86/kernel/trampoline_64.S linux-3.0.9/arch/x86/kernel/trampoline_64.S
16219 --- linux-3.0.9/arch/x86/kernel/trampoline_64.S 2011-11-11 13:12:24.000000000 -0500
16220 +++ linux-3.0.9/arch/x86/kernel/trampoline_64.S 2011-11-15 20:02:59.000000000 -0500
16221 @@ -90,7 +90,7 @@ startup_32:
16222 movl $__KERNEL_DS, %eax # Initialize the %ds segment register
16223 movl %eax, %ds
16224
16225 - movl $X86_CR4_PAE, %eax
16226 + movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
16227 movl %eax, %cr4 # Enable PAE mode
16228
16229 # Setup trampoline 4 level pagetables
16230 @@ -138,7 +138,7 @@ tidt:
16231 # so the kernel can live anywhere
16232 .balign 4
16233 tgdt:
16234 - .short tgdt_end - tgdt # gdt limit
16235 + .short tgdt_end - tgdt - 1 # gdt limit
16236 .long tgdt - r_base
16237 .short 0
16238 .quad 0x00cf9b000000ffff # __KERNEL32_CS
16239 diff -urNp linux-3.0.9/arch/x86/kernel/traps.c linux-3.0.9/arch/x86/kernel/traps.c
16240 --- linux-3.0.9/arch/x86/kernel/traps.c 2011-11-11 13:12:24.000000000 -0500
16241 +++ linux-3.0.9/arch/x86/kernel/traps.c 2011-11-15 20:02:59.000000000 -0500
16242 @@ -70,12 +70,6 @@ asmlinkage int system_call(void);
16243
16244 /* Do we ignore FPU interrupts ? */
16245 char ignore_fpu_irq;
16246 -
16247 -/*
16248 - * The IDT has to be page-aligned to simplify the Pentium
16249 - * F0 0F bug workaround.
16250 - */
16251 -gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
16252 #endif
16253
16254 DECLARE_BITMAP(used_vectors, NR_VECTORS);
16255 @@ -117,13 +111,13 @@ static inline void preempt_conditional_c
16256 }
16257
16258 static void __kprobes
16259 -do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
16260 +do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
16261 long error_code, siginfo_t *info)
16262 {
16263 struct task_struct *tsk = current;
16264
16265 #ifdef CONFIG_X86_32
16266 - if (regs->flags & X86_VM_MASK) {
16267 + if (v8086_mode(regs)) {
16268 /*
16269 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
16270 * On nmi (interrupt 2), do_trap should not be called.
16271 @@ -134,7 +128,7 @@ do_trap(int trapnr, int signr, char *str
16272 }
16273 #endif
16274
16275 - if (!user_mode(regs))
16276 + if (!user_mode_novm(regs))
16277 goto kernel_trap;
16278
16279 #ifdef CONFIG_X86_32
16280 @@ -157,7 +151,7 @@ trap_signal:
16281 printk_ratelimit()) {
16282 printk(KERN_INFO
16283 "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
16284 - tsk->comm, tsk->pid, str,
16285 + tsk->comm, task_pid_nr(tsk), str,
16286 regs->ip, regs->sp, error_code);
16287 print_vma_addr(" in ", regs->ip);
16288 printk("\n");
16289 @@ -174,8 +168,20 @@ kernel_trap:
16290 if (!fixup_exception(regs)) {
16291 tsk->thread.error_code = error_code;
16292 tsk->thread.trap_no = trapnr;
16293 +
16294 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
16295 + if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
16296 + str = "PAX: suspicious stack segment fault";
16297 +#endif
16298 +
16299 die(str, regs, error_code);
16300 }
16301 +
16302 +#ifdef CONFIG_PAX_REFCOUNT
16303 + if (trapnr == 4)
16304 + pax_report_refcount_overflow(regs);
16305 +#endif
16306 +
16307 return;
16308
16309 #ifdef CONFIG_X86_32
16310 @@ -264,14 +270,30 @@ do_general_protection(struct pt_regs *re
16311 conditional_sti(regs);
16312
16313 #ifdef CONFIG_X86_32
16314 - if (regs->flags & X86_VM_MASK)
16315 + if (v8086_mode(regs))
16316 goto gp_in_vm86;
16317 #endif
16318
16319 tsk = current;
16320 - if (!user_mode(regs))
16321 + if (!user_mode_novm(regs))
16322 goto gp_in_kernel;
16323
16324 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
16325 + if (!(__supported_pte_mask & _PAGE_NX) && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
16326 + struct mm_struct *mm = tsk->mm;
16327 + unsigned long limit;
16328 +
16329 + down_write(&mm->mmap_sem);
16330 + limit = mm->context.user_cs_limit;
16331 + if (limit < TASK_SIZE) {
16332 + track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
16333 + up_write(&mm->mmap_sem);
16334 + return;
16335 + }
16336 + up_write(&mm->mmap_sem);
16337 + }
16338 +#endif
16339 +
16340 tsk->thread.error_code = error_code;
16341 tsk->thread.trap_no = 13;
16342
16343 @@ -304,6 +326,13 @@ gp_in_kernel:
16344 if (notify_die(DIE_GPF, "general protection fault", regs,
16345 error_code, 13, SIGSEGV) == NOTIFY_STOP)
16346 return;
16347 +
16348 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
16349 + if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
16350 + die("PAX: suspicious general protection fault", regs, error_code);
16351 + else
16352 +#endif
16353 +
16354 die("general protection fault", regs, error_code);
16355 }
16356
16357 @@ -433,6 +462,17 @@ static notrace __kprobes void default_do
16358 dotraplinkage notrace __kprobes void
16359 do_nmi(struct pt_regs *regs, long error_code)
16360 {
16361 +
16362 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
16363 + if (!user_mode(regs)) {
16364 + unsigned long cs = regs->cs & 0xFFFF;
16365 + unsigned long ip = ktva_ktla(regs->ip);
16366 +
16367 + if ((cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS) && ip <= (unsigned long)_etext)
16368 + regs->ip = ip;
16369 + }
16370 +#endif
16371 +
16372 nmi_enter();
16373
16374 inc_irq_stat(__nmi_count);
16375 @@ -569,7 +609,7 @@ dotraplinkage void __kprobes do_debug(st
16376 /* It's safe to allow irq's after DR6 has been saved */
16377 preempt_conditional_sti(regs);
16378
16379 - if (regs->flags & X86_VM_MASK) {
16380 + if (v8086_mode(regs)) {
16381 handle_vm86_trap((struct kernel_vm86_regs *) regs,
16382 error_code, 1);
16383 preempt_conditional_cli(regs);
16384 @@ -583,7 +623,7 @@ dotraplinkage void __kprobes do_debug(st
16385 * We already checked v86 mode above, so we can check for kernel mode
16386 * by just checking the CPL of CS.
16387 */
16388 - if ((dr6 & DR_STEP) && !user_mode(regs)) {
16389 + if ((dr6 & DR_STEP) && !user_mode_novm(regs)) {
16390 tsk->thread.debugreg6 &= ~DR_STEP;
16391 set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
16392 regs->flags &= ~X86_EFLAGS_TF;
16393 @@ -612,7 +652,7 @@ void math_error(struct pt_regs *regs, in
16394 return;
16395 conditional_sti(regs);
16396
16397 - if (!user_mode_vm(regs))
16398 + if (!user_mode(regs))
16399 {
16400 if (!fixup_exception(regs)) {
16401 task->thread.error_code = error_code;
16402 @@ -723,7 +763,7 @@ asmlinkage void __attribute__((weak)) sm
16403 void __math_state_restore(void)
16404 {
16405 struct thread_info *thread = current_thread_info();
16406 - struct task_struct *tsk = thread->task;
16407 + struct task_struct *tsk = current;
16408
16409 /*
16410 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
16411 @@ -750,8 +790,7 @@ void __math_state_restore(void)
16412 */
16413 asmlinkage void math_state_restore(void)
16414 {
16415 - struct thread_info *thread = current_thread_info();
16416 - struct task_struct *tsk = thread->task;
16417 + struct task_struct *tsk = current;
16418
16419 if (!tsk_used_math(tsk)) {
16420 local_irq_enable();
16421 diff -urNp linux-3.0.9/arch/x86/kernel/verify_cpu.S linux-3.0.9/arch/x86/kernel/verify_cpu.S
16422 --- linux-3.0.9/arch/x86/kernel/verify_cpu.S 2011-11-11 13:12:24.000000000 -0500
16423 +++ linux-3.0.9/arch/x86/kernel/verify_cpu.S 2011-11-15 20:02:59.000000000 -0500
16424 @@ -20,6 +20,7 @@
16425 * arch/x86/boot/compressed/head_64.S: Boot cpu verification
16426 * arch/x86/kernel/trampoline_64.S: secondary processor verification
16427 * arch/x86/kernel/head_32.S: processor startup
16428 + * arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume
16429 *
16430 * verify_cpu, returns the status of longmode and SSE in register %eax.
16431 * 0: Success 1: Failure
16432 diff -urNp linux-3.0.9/arch/x86/kernel/vm86_32.c linux-3.0.9/arch/x86/kernel/vm86_32.c
16433 --- linux-3.0.9/arch/x86/kernel/vm86_32.c 2011-11-11 13:12:24.000000000 -0500
16434 +++ linux-3.0.9/arch/x86/kernel/vm86_32.c 2011-11-15 20:02:59.000000000 -0500
16435 @@ -41,6 +41,7 @@
16436 #include <linux/ptrace.h>
16437 #include <linux/audit.h>
16438 #include <linux/stddef.h>
16439 +#include <linux/grsecurity.h>
16440
16441 #include <asm/uaccess.h>
16442 #include <asm/io.h>
16443 @@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke
16444 do_exit(SIGSEGV);
16445 }
16446
16447 - tss = &per_cpu(init_tss, get_cpu());
16448 + tss = init_tss + get_cpu();
16449 current->thread.sp0 = current->thread.saved_sp0;
16450 current->thread.sysenter_cs = __KERNEL_CS;
16451 load_sp0(tss, &current->thread);
16452 @@ -208,6 +209,13 @@ int sys_vm86old(struct vm86_struct __use
16453 struct task_struct *tsk;
16454 int tmp, ret = -EPERM;
16455
16456 +#ifdef CONFIG_GRKERNSEC_VM86
16457 + if (!capable(CAP_SYS_RAWIO)) {
16458 + gr_handle_vm86();
16459 + goto out;
16460 + }
16461 +#endif
16462 +
16463 tsk = current;
16464 if (tsk->thread.saved_sp0)
16465 goto out;
16466 @@ -238,6 +246,14 @@ int sys_vm86(unsigned long cmd, unsigned
16467 int tmp, ret;
16468 struct vm86plus_struct __user *v86;
16469
16470 +#ifdef CONFIG_GRKERNSEC_VM86
16471 + if (!capable(CAP_SYS_RAWIO)) {
16472 + gr_handle_vm86();
16473 + ret = -EPERM;
16474 + goto out;
16475 + }
16476 +#endif
16477 +
16478 tsk = current;
16479 switch (cmd) {
16480 case VM86_REQUEST_IRQ:
16481 @@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm
16482 tsk->thread.saved_fs = info->regs32->fs;
16483 tsk->thread.saved_gs = get_user_gs(info->regs32);
16484
16485 - tss = &per_cpu(init_tss, get_cpu());
16486 + tss = init_tss + get_cpu();
16487 tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
16488 if (cpu_has_sep)
16489 tsk->thread.sysenter_cs = 0;
16490 @@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_re
16491 goto cannot_handle;
16492 if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
16493 goto cannot_handle;
16494 - intr_ptr = (unsigned long __user *) (i << 2);
16495 + intr_ptr = (__force unsigned long __user *) (i << 2);
16496 if (get_user(segoffs, intr_ptr))
16497 goto cannot_handle;
16498 if ((segoffs >> 16) == BIOSSEG)
16499 diff -urNp linux-3.0.9/arch/x86/kernel/vmlinux.lds.S linux-3.0.9/arch/x86/kernel/vmlinux.lds.S
16500 --- linux-3.0.9/arch/x86/kernel/vmlinux.lds.S 2011-11-11 13:12:24.000000000 -0500
16501 +++ linux-3.0.9/arch/x86/kernel/vmlinux.lds.S 2011-11-15 20:02:59.000000000 -0500
16502 @@ -26,6 +26,13 @@
16503 #include <asm/page_types.h>
16504 #include <asm/cache.h>
16505 #include <asm/boot.h>
16506 +#include <asm/segment.h>
16507 +
16508 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
16509 +#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
16510 +#else
16511 +#define __KERNEL_TEXT_OFFSET 0
16512 +#endif
16513
16514 #undef i386 /* in case the preprocessor is a 32bit one */
16515
16516 @@ -69,31 +76,46 @@ jiffies_64 = jiffies;
16517
16518 PHDRS {
16519 text PT_LOAD FLAGS(5); /* R_E */
16520 +#ifdef CONFIG_X86_32
16521 + module PT_LOAD FLAGS(5); /* R_E */
16522 +#endif
16523 +#ifdef CONFIG_XEN
16524 + rodata PT_LOAD FLAGS(5); /* R_E */
16525 +#else
16526 + rodata PT_LOAD FLAGS(4); /* R__ */
16527 +#endif
16528 data PT_LOAD FLAGS(6); /* RW_ */
16529 #ifdef CONFIG_X86_64
16530 user PT_LOAD FLAGS(5); /* R_E */
16531 +#endif
16532 + init.begin PT_LOAD FLAGS(6); /* RW_ */
16533 #ifdef CONFIG_SMP
16534 percpu PT_LOAD FLAGS(6); /* RW_ */
16535 #endif
16536 + text.init PT_LOAD FLAGS(5); /* R_E */
16537 + text.exit PT_LOAD FLAGS(5); /* R_E */
16538 init PT_LOAD FLAGS(7); /* RWE */
16539 -#endif
16540 note PT_NOTE FLAGS(0); /* ___ */
16541 }
16542
16543 SECTIONS
16544 {
16545 #ifdef CONFIG_X86_32
16546 - . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
16547 - phys_startup_32 = startup_32 - LOAD_OFFSET;
16548 + . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
16549 #else
16550 - . = __START_KERNEL;
16551 - phys_startup_64 = startup_64 - LOAD_OFFSET;
16552 + . = __START_KERNEL;
16553 #endif
16554
16555 /* Text and read-only data */
16556 - .text : AT(ADDR(.text) - LOAD_OFFSET) {
16557 - _text = .;
16558 + .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
16559 /* bootstrapping code */
16560 +#ifdef CONFIG_X86_32
16561 + phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
16562 +#else
16563 + phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
16564 +#endif
16565 + __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
16566 + _text = .;
16567 HEAD_TEXT
16568 #ifdef CONFIG_X86_32
16569 . = ALIGN(PAGE_SIZE);
16570 @@ -109,13 +131,47 @@ SECTIONS
16571 IRQENTRY_TEXT
16572 *(.fixup)
16573 *(.gnu.warning)
16574 - /* End of text section */
16575 - _etext = .;
16576 } :text = 0x9090
16577
16578 - NOTES :text :note
16579 + . += __KERNEL_TEXT_OFFSET;
16580 +
16581 +#ifdef CONFIG_X86_32
16582 + . = ALIGN(PAGE_SIZE);
16583 + .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
16584 +
16585 +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
16586 + MODULES_EXEC_VADDR = .;
16587 + BYTE(0)
16588 + . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
16589 + . = ALIGN(HPAGE_SIZE);
16590 + MODULES_EXEC_END = . - 1;
16591 +#endif
16592 +
16593 + } :module
16594 +#endif
16595 +
16596 + .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
16597 + /* End of text section */
16598 + _etext = . - __KERNEL_TEXT_OFFSET;
16599 + }
16600 +
16601 +#ifdef CONFIG_X86_32
16602 + . = ALIGN(PAGE_SIZE);
16603 + .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
16604 + *(.idt)
16605 + . = ALIGN(PAGE_SIZE);
16606 + *(.empty_zero_page)
16607 + *(.initial_pg_fixmap)
16608 + *(.initial_pg_pmd)
16609 + *(.initial_page_table)
16610 + *(.swapper_pg_dir)
16611 + } :rodata
16612 +#endif
16613 +
16614 + . = ALIGN(PAGE_SIZE);
16615 + NOTES :rodata :note
16616
16617 - EXCEPTION_TABLE(16) :text = 0x9090
16618 + EXCEPTION_TABLE(16) :rodata
16619
16620 #if defined(CONFIG_DEBUG_RODATA)
16621 /* .text should occupy whole number of pages */
16622 @@ -127,16 +183,20 @@ SECTIONS
16623
16624 /* Data */
16625 .data : AT(ADDR(.data) - LOAD_OFFSET) {
16626 +
16627 +#ifdef CONFIG_PAX_KERNEXEC
16628 + . = ALIGN(HPAGE_SIZE);
16629 +#else
16630 + . = ALIGN(PAGE_SIZE);
16631 +#endif
16632 +
16633 /* Start of data section */
16634 _sdata = .;
16635
16636 /* init_task */
16637 INIT_TASK_DATA(THREAD_SIZE)
16638
16639 -#ifdef CONFIG_X86_32
16640 - /* 32 bit has nosave before _edata */
16641 NOSAVE_DATA
16642 -#endif
16643
16644 PAGE_ALIGNED_DATA(PAGE_SIZE)
16645
16646 @@ -208,12 +268,19 @@ SECTIONS
16647 #endif /* CONFIG_X86_64 */
16648
16649 /* Init code and data - will be freed after init */
16650 - . = ALIGN(PAGE_SIZE);
16651 .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
16652 + BYTE(0)
16653 +
16654 +#ifdef CONFIG_PAX_KERNEXEC
16655 + . = ALIGN(HPAGE_SIZE);
16656 +#else
16657 + . = ALIGN(PAGE_SIZE);
16658 +#endif
16659 +
16660 __init_begin = .; /* paired with __init_end */
16661 - }
16662 + } :init.begin
16663
16664 -#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
16665 +#ifdef CONFIG_SMP
16666 /*
16667 * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
16668 * output PHDR, so the next output section - .init.text - should
16669 @@ -222,12 +289,27 @@ SECTIONS
16670 PERCPU_VADDR(INTERNODE_CACHE_BYTES, 0, :percpu)
16671 #endif
16672
16673 - INIT_TEXT_SECTION(PAGE_SIZE)
16674 -#ifdef CONFIG_X86_64
16675 - :init
16676 -#endif
16677 + . = ALIGN(PAGE_SIZE);
16678 + init_begin = .;
16679 + .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
16680 + VMLINUX_SYMBOL(_sinittext) = .;
16681 + INIT_TEXT
16682 + VMLINUX_SYMBOL(_einittext) = .;
16683 + . = ALIGN(PAGE_SIZE);
16684 + } :text.init
16685
16686 - INIT_DATA_SECTION(16)
16687 + /*
16688 + * .exit.text is discard at runtime, not link time, to deal with
16689 + * references from .altinstructions and .eh_frame
16690 + */
16691 + .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
16692 + EXIT_TEXT
16693 + . = ALIGN(16);
16694 + } :text.exit
16695 + . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
16696 +
16697 + . = ALIGN(PAGE_SIZE);
16698 + INIT_DATA_SECTION(16) :init
16699
16700 /*
16701 * Code and data for a variety of lowlevel trampolines, to be
16702 @@ -301,19 +383,12 @@ SECTIONS
16703 }
16704
16705 . = ALIGN(8);
16706 - /*
16707 - * .exit.text is discard at runtime, not link time, to deal with
16708 - * references from .altinstructions and .eh_frame
16709 - */
16710 - .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
16711 - EXIT_TEXT
16712 - }
16713
16714 .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
16715 EXIT_DATA
16716 }
16717
16718 -#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
16719 +#ifndef CONFIG_SMP
16720 PERCPU_SECTION(INTERNODE_CACHE_BYTES)
16721 #endif
16722
16723 @@ -332,16 +407,10 @@ SECTIONS
16724 .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
16725 __smp_locks = .;
16726 *(.smp_locks)
16727 - . = ALIGN(PAGE_SIZE);
16728 __smp_locks_end = .;
16729 + . = ALIGN(PAGE_SIZE);
16730 }
16731
16732 -#ifdef CONFIG_X86_64
16733 - .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
16734 - NOSAVE_DATA
16735 - }
16736 -#endif
16737 -
16738 /* BSS */
16739 . = ALIGN(PAGE_SIZE);
16740 .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
16741 @@ -357,6 +426,7 @@ SECTIONS
16742 __brk_base = .;
16743 . += 64 * 1024; /* 64k alignment slop space */
16744 *(.brk_reservation) /* areas brk users have reserved */
16745 + . = ALIGN(HPAGE_SIZE);
16746 __brk_limit = .;
16747 }
16748
16749 @@ -383,13 +453,12 @@ SECTIONS
16750 * for the boot processor.
16751 */
16752 #define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
16753 -INIT_PER_CPU(gdt_page);
16754 INIT_PER_CPU(irq_stack_union);
16755
16756 /*
16757 * Build-time check on the image size:
16758 */
16759 -. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
16760 +. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
16761 "kernel image bigger than KERNEL_IMAGE_SIZE");
16762
16763 #ifdef CONFIG_SMP
16764 diff -urNp linux-3.0.9/arch/x86/kernel/vsyscall_64.c linux-3.0.9/arch/x86/kernel/vsyscall_64.c
16765 --- linux-3.0.9/arch/x86/kernel/vsyscall_64.c 2011-11-11 13:12:24.000000000 -0500
16766 +++ linux-3.0.9/arch/x86/kernel/vsyscall_64.c 2011-11-15 20:02:59.000000000 -0500
16767 @@ -53,7 +53,7 @@ DEFINE_VVAR(int, vgetcpu_mode);
16768 DEFINE_VVAR(struct vsyscall_gtod_data, vsyscall_gtod_data) =
16769 {
16770 .lock = __SEQLOCK_UNLOCKED(__vsyscall_gtod_data.lock),
16771 - .sysctl_enabled = 1,
16772 + .sysctl_enabled = 0,
16773 };
16774
16775 void update_vsyscall_tz(void)
16776 @@ -231,7 +231,7 @@ static long __vsyscall(3) venosys_1(void
16777 static ctl_table kernel_table2[] = {
16778 { .procname = "vsyscall64",
16779 .data = &vsyscall_gtod_data.sysctl_enabled, .maxlen = sizeof(int),
16780 - .mode = 0644,
16781 + .mode = 0444,
16782 .proc_handler = proc_dointvec },
16783 {}
16784 };
16785 diff -urNp linux-3.0.9/arch/x86/kernel/x8664_ksyms_64.c linux-3.0.9/arch/x86/kernel/x8664_ksyms_64.c
16786 --- linux-3.0.9/arch/x86/kernel/x8664_ksyms_64.c 2011-11-11 13:12:24.000000000 -0500
16787 +++ linux-3.0.9/arch/x86/kernel/x8664_ksyms_64.c 2011-11-15 20:02:59.000000000 -0500
16788 @@ -29,8 +29,6 @@ EXPORT_SYMBOL(__put_user_8);
16789 EXPORT_SYMBOL(copy_user_generic_string);
16790 EXPORT_SYMBOL(copy_user_generic_unrolled);
16791 EXPORT_SYMBOL(__copy_user_nocache);
16792 -EXPORT_SYMBOL(_copy_from_user);
16793 -EXPORT_SYMBOL(_copy_to_user);
16794
16795 EXPORT_SYMBOL(copy_page);
16796 EXPORT_SYMBOL(clear_page);
16797 diff -urNp linux-3.0.9/arch/x86/kernel/xsave.c linux-3.0.9/arch/x86/kernel/xsave.c
16798 --- linux-3.0.9/arch/x86/kernel/xsave.c 2011-11-11 13:12:24.000000000 -0500
16799 +++ linux-3.0.9/arch/x86/kernel/xsave.c 2011-11-15 20:02:59.000000000 -0500
16800 @@ -130,7 +130,7 @@ int check_for_xstate(struct i387_fxsave_
16801 fx_sw_user->xstate_size > fx_sw_user->extended_size)
16802 return -EINVAL;
16803
16804 - err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
16805 + err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
16806 fx_sw_user->extended_size -
16807 FP_XSTATE_MAGIC2_SIZE));
16808 if (err)
16809 @@ -267,7 +267,7 @@ fx_only:
16810 * the other extended state.
16811 */
16812 xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
16813 - return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
16814 + return fxrstor_checking((struct i387_fxsave_struct __force_kernel *)buf);
16815 }
16816
16817 /*
16818 @@ -299,7 +299,7 @@ int restore_i387_xstate(void __user *buf
16819 if (use_xsave())
16820 err = restore_user_xstate(buf);
16821 else
16822 - err = fxrstor_checking((__force struct i387_fxsave_struct *)
16823 + err = fxrstor_checking((struct i387_fxsave_struct __force_kernel *)
16824 buf);
16825 if (unlikely(err)) {
16826 /*
16827 diff -urNp linux-3.0.9/arch/x86/kvm/emulate.c linux-3.0.9/arch/x86/kvm/emulate.c
16828 --- linux-3.0.9/arch/x86/kvm/emulate.c 2011-11-11 13:12:24.000000000 -0500
16829 +++ linux-3.0.9/arch/x86/kvm/emulate.c 2011-11-15 20:02:59.000000000 -0500
16830 @@ -96,7 +96,7 @@
16831 #define Src2ImmByte (2<<29)
16832 #define Src2One (3<<29)
16833 #define Src2Imm (4<<29)
16834 -#define Src2Mask (7<<29)
16835 +#define Src2Mask (7U<<29)
16836
16837 #define X2(x...) x, x
16838 #define X3(x...) X2(x), x
16839 @@ -207,6 +207,7 @@ struct gprefix {
16840
16841 #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix, _dsttype) \
16842 do { \
16843 + unsigned long _tmp; \
16844 __asm__ __volatile__ ( \
16845 _PRE_EFLAGS("0", "4", "2") \
16846 _op _suffix " %"_x"3,%1; " \
16847 @@ -220,8 +221,6 @@ struct gprefix {
16848 /* Raw emulation: instruction has two explicit operands. */
16849 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
16850 do { \
16851 - unsigned long _tmp; \
16852 - \
16853 switch ((_dst).bytes) { \
16854 case 2: \
16855 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w",u16);\
16856 @@ -237,7 +236,6 @@ struct gprefix {
16857
16858 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
16859 do { \
16860 - unsigned long _tmp; \
16861 switch ((_dst).bytes) { \
16862 case 1: \
16863 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b",u8); \
16864 diff -urNp linux-3.0.9/arch/x86/kvm/lapic.c linux-3.0.9/arch/x86/kvm/lapic.c
16865 --- linux-3.0.9/arch/x86/kvm/lapic.c 2011-11-11 13:12:24.000000000 -0500
16866 +++ linux-3.0.9/arch/x86/kvm/lapic.c 2011-11-15 20:02:59.000000000 -0500
16867 @@ -53,7 +53,7 @@
16868 #define APIC_BUS_CYCLE_NS 1
16869
16870 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
16871 -#define apic_debug(fmt, arg...)
16872 +#define apic_debug(fmt, arg...) do {} while (0)
16873
16874 #define APIC_LVT_NUM 6
16875 /* 14 is the version for Xeon and Pentium 8.4.8*/
16876 diff -urNp linux-3.0.9/arch/x86/kvm/mmu.c linux-3.0.9/arch/x86/kvm/mmu.c
16877 --- linux-3.0.9/arch/x86/kvm/mmu.c 2011-11-11 13:12:24.000000000 -0500
16878 +++ linux-3.0.9/arch/x86/kvm/mmu.c 2011-11-15 20:02:59.000000000 -0500
16879 @@ -3238,7 +3238,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *
16880
16881 pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);
16882
16883 - invlpg_counter = atomic_read(&vcpu->kvm->arch.invlpg_counter);
16884 + invlpg_counter = atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter);
16885
16886 /*
16887 * Assume that the pte write on a page table of the same type
16888 @@ -3270,7 +3270,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *
16889 }
16890
16891 spin_lock(&vcpu->kvm->mmu_lock);
16892 - if (atomic_read(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
16893 + if (atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
16894 gentry = 0;
16895 kvm_mmu_free_some_pages(vcpu);
16896 ++vcpu->kvm->stat.mmu_pte_write;
16897 diff -urNp linux-3.0.9/arch/x86/kvm/paging_tmpl.h linux-3.0.9/arch/x86/kvm/paging_tmpl.h
16898 --- linux-3.0.9/arch/x86/kvm/paging_tmpl.h 2011-11-11 13:12:24.000000000 -0500
16899 +++ linux-3.0.9/arch/x86/kvm/paging_tmpl.h 2011-11-15 20:02:59.000000000 -0500
16900 @@ -182,7 +182,7 @@ walk:
16901 break;
16902 }
16903
16904 - ptep_user = (pt_element_t __user *)((void *)host_addr + offset);
16905 + ptep_user = (pt_element_t __force_user *)((void *)host_addr + offset);
16906 if (unlikely(__copy_from_user(&pte, ptep_user, sizeof(pte)))) {
16907 present = false;
16908 break;
16909 @@ -583,6 +583,8 @@ static int FNAME(page_fault)(struct kvm_
16910 unsigned long mmu_seq;
16911 bool map_writable;
16912
16913 + pax_track_stack();
16914 +
16915 pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
16916
16917 r = mmu_topup_memory_caches(vcpu);
16918 @@ -703,7 +705,7 @@ static void FNAME(invlpg)(struct kvm_vcp
16919 if (need_flush)
16920 kvm_flush_remote_tlbs(vcpu->kvm);
16921
16922 - atomic_inc(&vcpu->kvm->arch.invlpg_counter);
16923 + atomic_inc_unchecked(&vcpu->kvm->arch.invlpg_counter);
16924
16925 spin_unlock(&vcpu->kvm->mmu_lock);
16926
16927 diff -urNp linux-3.0.9/arch/x86/kvm/svm.c linux-3.0.9/arch/x86/kvm/svm.c
16928 --- linux-3.0.9/arch/x86/kvm/svm.c 2011-11-11 13:12:24.000000000 -0500
16929 +++ linux-3.0.9/arch/x86/kvm/svm.c 2011-11-15 20:02:59.000000000 -0500
16930 @@ -3377,7 +3377,11 @@ static void reload_tss(struct kvm_vcpu *
16931 int cpu = raw_smp_processor_id();
16932
16933 struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
16934 +
16935 + pax_open_kernel();
16936 sd->tss_desc->type = 9; /* available 32/64-bit TSS */
16937 + pax_close_kernel();
16938 +
16939 load_TR_desc();
16940 }
16941
16942 @@ -3755,6 +3759,10 @@ static void svm_vcpu_run(struct kvm_vcpu
16943 #endif
16944 #endif
16945
16946 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
16947 + __set_fs(current_thread_info()->addr_limit);
16948 +#endif
16949 +
16950 reload_tss(vcpu);
16951
16952 local_irq_disable();
16953 diff -urNp linux-3.0.9/arch/x86/kvm/vmx.c linux-3.0.9/arch/x86/kvm/vmx.c
16954 --- linux-3.0.9/arch/x86/kvm/vmx.c 2011-11-11 13:12:24.000000000 -0500
16955 +++ linux-3.0.9/arch/x86/kvm/vmx.c 2011-11-15 20:02:59.000000000 -0500
16956 @@ -797,7 +797,11 @@ static void reload_tss(void)
16957 struct desc_struct *descs;
16958
16959 descs = (void *)gdt->address;
16960 +
16961 + pax_open_kernel();
16962 descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
16963 + pax_close_kernel();
16964 +
16965 load_TR_desc();
16966 }
16967
16968 @@ -1747,8 +1751,11 @@ static __init int hardware_setup(void)
16969 if (!cpu_has_vmx_flexpriority())
16970 flexpriority_enabled = 0;
16971
16972 - if (!cpu_has_vmx_tpr_shadow())
16973 - kvm_x86_ops->update_cr8_intercept = NULL;
16974 + if (!cpu_has_vmx_tpr_shadow()) {
16975 + pax_open_kernel();
16976 + *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
16977 + pax_close_kernel();
16978 + }
16979
16980 if (enable_ept && !cpu_has_vmx_ept_2m_page())
16981 kvm_disable_largepages();
16982 @@ -2814,7 +2821,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
16983 vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
16984
16985 asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
16986 - vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
16987 + vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
16988 vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
16989 vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
16990 vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host));
16991 @@ -4211,6 +4218,12 @@ static void __noclone vmx_vcpu_run(struc
16992 "jmp .Lkvm_vmx_return \n\t"
16993 ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
16994 ".Lkvm_vmx_return: "
16995 +
16996 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
16997 + "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
16998 + ".Lkvm_vmx_return2: "
16999 +#endif
17000 +
17001 /* Save guest registers, load host registers, keep flags */
17002 "mov %0, %c[wordsize](%%"R"sp) \n\t"
17003 "pop %0 \n\t"
17004 @@ -4259,6 +4272,11 @@ static void __noclone vmx_vcpu_run(struc
17005 #endif
17006 [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
17007 [wordsize]"i"(sizeof(ulong))
17008 +
17009 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17010 + ,[cs]"i"(__KERNEL_CS)
17011 +#endif
17012 +
17013 : "cc", "memory"
17014 , R"ax", R"bx", R"di", R"si"
17015 #ifdef CONFIG_X86_64
17016 @@ -4276,7 +4294,16 @@ static void __noclone vmx_vcpu_run(struc
17017
17018 vmx->idt_vectoring_info = vmcs_read32(IDT_VECTORING_INFO_FIELD);
17019
17020 - asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
17021 + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
17022 +
17023 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17024 + loadsegment(fs, __KERNEL_PERCPU);
17025 +#endif
17026 +
17027 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
17028 + __set_fs(current_thread_info()->addr_limit);
17029 +#endif
17030 +
17031 vmx->launched = 1;
17032
17033 vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
17034 diff -urNp linux-3.0.9/arch/x86/kvm/x86.c linux-3.0.9/arch/x86/kvm/x86.c
17035 --- linux-3.0.9/arch/x86/kvm/x86.c 2011-11-11 13:12:24.000000000 -0500
17036 +++ linux-3.0.9/arch/x86/kvm/x86.c 2011-11-15 20:02:59.000000000 -0500
17037 @@ -1313,8 +1313,8 @@ static int xen_hvm_config(struct kvm_vcp
17038 {
17039 struct kvm *kvm = vcpu->kvm;
17040 int lm = is_long_mode(vcpu);
17041 - u8 *blob_addr = lm ? (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_64
17042 - : (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_32;
17043 + u8 __user *blob_addr = lm ? (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_64
17044 + : (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_32;
17045 u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
17046 : kvm->arch.xen_hvm_config.blob_size_32;
17047 u32 page_num = data & ~PAGE_MASK;
17048 @@ -2057,6 +2057,8 @@ long kvm_arch_dev_ioctl(struct file *fil
17049 if (n < msr_list.nmsrs)
17050 goto out;
17051 r = -EFAULT;
17052 + if (num_msrs_to_save > ARRAY_SIZE(msrs_to_save))
17053 + goto out;
17054 if (copy_to_user(user_msr_list->indices, &msrs_to_save,
17055 num_msrs_to_save * sizeof(u32)))
17056 goto out;
17057 @@ -2229,15 +2231,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(str
17058 struct kvm_cpuid2 *cpuid,
17059 struct kvm_cpuid_entry2 __user *entries)
17060 {
17061 - int r;
17062 + int r, i;
17063
17064 r = -E2BIG;
17065 if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
17066 goto out;
17067 r = -EFAULT;
17068 - if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
17069 - cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
17070 + if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
17071 goto out;
17072 + for (i = 0; i < cpuid->nent; ++i) {
17073 + struct kvm_cpuid_entry2 cpuid_entry;
17074 + if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
17075 + goto out;
17076 + vcpu->arch.cpuid_entries[i] = cpuid_entry;
17077 + }
17078 vcpu->arch.cpuid_nent = cpuid->nent;
17079 kvm_apic_set_version(vcpu);
17080 kvm_x86_ops->cpuid_update(vcpu);
17081 @@ -2252,15 +2259,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(str
17082 struct kvm_cpuid2 *cpuid,
17083 struct kvm_cpuid_entry2 __user *entries)
17084 {
17085 - int r;
17086 + int r, i;
17087
17088 r = -E2BIG;
17089 if (cpuid->nent < vcpu->arch.cpuid_nent)
17090 goto out;
17091 r = -EFAULT;
17092 - if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
17093 - vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
17094 + if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
17095 goto out;
17096 + for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
17097 + struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
17098 + if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
17099 + goto out;
17100 + }
17101 return 0;
17102
17103 out:
17104 @@ -2579,7 +2590,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
17105 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
17106 struct kvm_interrupt *irq)
17107 {
17108 - if (irq->irq < 0 || irq->irq >= 256)
17109 + if (irq->irq >= 256)
17110 return -EINVAL;
17111 if (irqchip_in_kernel(vcpu->kvm))
17112 return -ENXIO;
17113 @@ -4878,7 +4889,7 @@ void kvm_after_handle_nmi(struct kvm_vcp
17114 }
17115 EXPORT_SYMBOL_GPL(kvm_after_handle_nmi);
17116
17117 -int kvm_arch_init(void *opaque)
17118 +int kvm_arch_init(const void *opaque)
17119 {
17120 int r;
17121 struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
17122 diff -urNp linux-3.0.9/arch/x86/lguest/boot.c linux-3.0.9/arch/x86/lguest/boot.c
17123 --- linux-3.0.9/arch/x86/lguest/boot.c 2011-11-11 13:12:24.000000000 -0500
17124 +++ linux-3.0.9/arch/x86/lguest/boot.c 2011-11-15 20:02:59.000000000 -0500
17125 @@ -1176,9 +1176,10 @@ static __init int early_put_chars(u32 vt
17126 * Rebooting also tells the Host we're finished, but the RESTART flag tells the
17127 * Launcher to reboot us.
17128 */
17129 -static void lguest_restart(char *reason)
17130 +static __noreturn void lguest_restart(char *reason)
17131 {
17132 hcall(LHCALL_SHUTDOWN, __pa(reason), LGUEST_SHUTDOWN_RESTART, 0, 0);
17133 + BUG();
17134 }
17135
17136 /*G:050
17137 diff -urNp linux-3.0.9/arch/x86/lib/atomic64_32.c linux-3.0.9/arch/x86/lib/atomic64_32.c
17138 --- linux-3.0.9/arch/x86/lib/atomic64_32.c 2011-11-11 13:12:24.000000000 -0500
17139 +++ linux-3.0.9/arch/x86/lib/atomic64_32.c 2011-11-15 20:02:59.000000000 -0500
17140 @@ -8,18 +8,30 @@
17141
17142 long long atomic64_read_cx8(long long, const atomic64_t *v);
17143 EXPORT_SYMBOL(atomic64_read_cx8);
17144 +long long atomic64_read_unchecked_cx8(long long, const atomic64_unchecked_t *v);
17145 +EXPORT_SYMBOL(atomic64_read_unchecked_cx8);
17146 long long atomic64_set_cx8(long long, const atomic64_t *v);
17147 EXPORT_SYMBOL(atomic64_set_cx8);
17148 +long long atomic64_set_unchecked_cx8(long long, const atomic64_unchecked_t *v);
17149 +EXPORT_SYMBOL(atomic64_set_unchecked_cx8);
17150 long long atomic64_xchg_cx8(long long, unsigned high);
17151 EXPORT_SYMBOL(atomic64_xchg_cx8);
17152 long long atomic64_add_return_cx8(long long a, atomic64_t *v);
17153 EXPORT_SYMBOL(atomic64_add_return_cx8);
17154 +long long atomic64_add_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
17155 +EXPORT_SYMBOL(atomic64_add_return_unchecked_cx8);
17156 long long atomic64_sub_return_cx8(long long a, atomic64_t *v);
17157 EXPORT_SYMBOL(atomic64_sub_return_cx8);
17158 +long long atomic64_sub_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
17159 +EXPORT_SYMBOL(atomic64_sub_return_unchecked_cx8);
17160 long long atomic64_inc_return_cx8(long long a, atomic64_t *v);
17161 EXPORT_SYMBOL(atomic64_inc_return_cx8);
17162 +long long atomic64_inc_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
17163 +EXPORT_SYMBOL(atomic64_inc_return_unchecked_cx8);
17164 long long atomic64_dec_return_cx8(long long a, atomic64_t *v);
17165 EXPORT_SYMBOL(atomic64_dec_return_cx8);
17166 +long long atomic64_dec_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
17167 +EXPORT_SYMBOL(atomic64_dec_return_unchecked_cx8);
17168 long long atomic64_dec_if_positive_cx8(atomic64_t *v);
17169 EXPORT_SYMBOL(atomic64_dec_if_positive_cx8);
17170 int atomic64_inc_not_zero_cx8(atomic64_t *v);
17171 @@ -30,26 +42,46 @@ EXPORT_SYMBOL(atomic64_add_unless_cx8);
17172 #ifndef CONFIG_X86_CMPXCHG64
17173 long long atomic64_read_386(long long, const atomic64_t *v);
17174 EXPORT_SYMBOL(atomic64_read_386);
17175 +long long atomic64_read_unchecked_386(long long, const atomic64_unchecked_t *v);
17176 +EXPORT_SYMBOL(atomic64_read_unchecked_386);
17177 long long atomic64_set_386(long long, const atomic64_t *v);
17178 EXPORT_SYMBOL(atomic64_set_386);
17179 +long long atomic64_set_unchecked_386(long long, const atomic64_unchecked_t *v);
17180 +EXPORT_SYMBOL(atomic64_set_unchecked_386);
17181 long long atomic64_xchg_386(long long, unsigned high);
17182 EXPORT_SYMBOL(atomic64_xchg_386);
17183 long long atomic64_add_return_386(long long a, atomic64_t *v);
17184 EXPORT_SYMBOL(atomic64_add_return_386);
17185 +long long atomic64_add_return_unchecked_386(long long a, atomic64_unchecked_t *v);
17186 +EXPORT_SYMBOL(atomic64_add_return_unchecked_386);
17187 long long atomic64_sub_return_386(long long a, atomic64_t *v);
17188 EXPORT_SYMBOL(atomic64_sub_return_386);
17189 +long long atomic64_sub_return_unchecked_386(long long a, atomic64_unchecked_t *v);
17190 +EXPORT_SYMBOL(atomic64_sub_return_unchecked_386);
17191 long long atomic64_inc_return_386(long long a, atomic64_t *v);
17192 EXPORT_SYMBOL(atomic64_inc_return_386);
17193 +long long atomic64_inc_return_unchecked_386(long long a, atomic64_unchecked_t *v);
17194 +EXPORT_SYMBOL(atomic64_inc_return_unchecked_386);
17195 long long atomic64_dec_return_386(long long a, atomic64_t *v);
17196 EXPORT_SYMBOL(atomic64_dec_return_386);
17197 +long long atomic64_dec_return_unchecked_386(long long a, atomic64_unchecked_t *v);
17198 +EXPORT_SYMBOL(atomic64_dec_return_unchecked_386);
17199 long long atomic64_add_386(long long a, atomic64_t *v);
17200 EXPORT_SYMBOL(atomic64_add_386);
17201 +long long atomic64_add_unchecked_386(long long a, atomic64_unchecked_t *v);
17202 +EXPORT_SYMBOL(atomic64_add_unchecked_386);
17203 long long atomic64_sub_386(long long a, atomic64_t *v);
17204 EXPORT_SYMBOL(atomic64_sub_386);
17205 +long long atomic64_sub_unchecked_386(long long a, atomic64_unchecked_t *v);
17206 +EXPORT_SYMBOL(atomic64_sub_unchecked_386);
17207 long long atomic64_inc_386(long long a, atomic64_t *v);
17208 EXPORT_SYMBOL(atomic64_inc_386);
17209 +long long atomic64_inc_unchecked_386(long long a, atomic64_unchecked_t *v);
17210 +EXPORT_SYMBOL(atomic64_inc_unchecked_386);
17211 long long atomic64_dec_386(long long a, atomic64_t *v);
17212 EXPORT_SYMBOL(atomic64_dec_386);
17213 +long long atomic64_dec_unchecked_386(long long a, atomic64_unchecked_t *v);
17214 +EXPORT_SYMBOL(atomic64_dec_unchecked_386);
17215 long long atomic64_dec_if_positive_386(atomic64_t *v);
17216 EXPORT_SYMBOL(atomic64_dec_if_positive_386);
17217 int atomic64_inc_not_zero_386(atomic64_t *v);
17218 diff -urNp linux-3.0.9/arch/x86/lib/atomic64_386_32.S linux-3.0.9/arch/x86/lib/atomic64_386_32.S
17219 --- linux-3.0.9/arch/x86/lib/atomic64_386_32.S 2011-11-11 13:12:24.000000000 -0500
17220 +++ linux-3.0.9/arch/x86/lib/atomic64_386_32.S 2011-11-15 20:02:59.000000000 -0500
17221 @@ -48,6 +48,10 @@ BEGIN(read)
17222 movl (v), %eax
17223 movl 4(v), %edx
17224 RET_ENDP
17225 +BEGIN(read_unchecked)
17226 + movl (v), %eax
17227 + movl 4(v), %edx
17228 +RET_ENDP
17229 #undef v
17230
17231 #define v %esi
17232 @@ -55,6 +59,10 @@ BEGIN(set)
17233 movl %ebx, (v)
17234 movl %ecx, 4(v)
17235 RET_ENDP
17236 +BEGIN(set_unchecked)
17237 + movl %ebx, (v)
17238 + movl %ecx, 4(v)
17239 +RET_ENDP
17240 #undef v
17241
17242 #define v %esi
17243 @@ -70,6 +78,20 @@ RET_ENDP
17244 BEGIN(add)
17245 addl %eax, (v)
17246 adcl %edx, 4(v)
17247 +
17248 +#ifdef CONFIG_PAX_REFCOUNT
17249 + jno 0f
17250 + subl %eax, (v)
17251 + sbbl %edx, 4(v)
17252 + int $4
17253 +0:
17254 + _ASM_EXTABLE(0b, 0b)
17255 +#endif
17256 +
17257 +RET_ENDP
17258 +BEGIN(add_unchecked)
17259 + addl %eax, (v)
17260 + adcl %edx, 4(v)
17261 RET_ENDP
17262 #undef v
17263
17264 @@ -77,6 +99,24 @@ RET_ENDP
17265 BEGIN(add_return)
17266 addl (v), %eax
17267 adcl 4(v), %edx
17268 +
17269 +#ifdef CONFIG_PAX_REFCOUNT
17270 + into
17271 +1234:
17272 + _ASM_EXTABLE(1234b, 2f)
17273 +#endif
17274 +
17275 + movl %eax, (v)
17276 + movl %edx, 4(v)
17277 +
17278 +#ifdef CONFIG_PAX_REFCOUNT
17279 +2:
17280 +#endif
17281 +
17282 +RET_ENDP
17283 +BEGIN(add_return_unchecked)
17284 + addl (v), %eax
17285 + adcl 4(v), %edx
17286 movl %eax, (v)
17287 movl %edx, 4(v)
17288 RET_ENDP
17289 @@ -86,6 +126,20 @@ RET_ENDP
17290 BEGIN(sub)
17291 subl %eax, (v)
17292 sbbl %edx, 4(v)
17293 +
17294 +#ifdef CONFIG_PAX_REFCOUNT
17295 + jno 0f
17296 + addl %eax, (v)
17297 + adcl %edx, 4(v)
17298 + int $4
17299 +0:
17300 + _ASM_EXTABLE(0b, 0b)
17301 +#endif
17302 +
17303 +RET_ENDP
17304 +BEGIN(sub_unchecked)
17305 + subl %eax, (v)
17306 + sbbl %edx, 4(v)
17307 RET_ENDP
17308 #undef v
17309
17310 @@ -96,6 +150,27 @@ BEGIN(sub_return)
17311 sbbl $0, %edx
17312 addl (v), %eax
17313 adcl 4(v), %edx
17314 +
17315 +#ifdef CONFIG_PAX_REFCOUNT
17316 + into
17317 +1234:
17318 + _ASM_EXTABLE(1234b, 2f)
17319 +#endif
17320 +
17321 + movl %eax, (v)
17322 + movl %edx, 4(v)
17323 +
17324 +#ifdef CONFIG_PAX_REFCOUNT
17325 +2:
17326 +#endif
17327 +
17328 +RET_ENDP
17329 +BEGIN(sub_return_unchecked)
17330 + negl %edx
17331 + negl %eax
17332 + sbbl $0, %edx
17333 + addl (v), %eax
17334 + adcl 4(v), %edx
17335 movl %eax, (v)
17336 movl %edx, 4(v)
17337 RET_ENDP
17338 @@ -105,6 +180,20 @@ RET_ENDP
17339 BEGIN(inc)
17340 addl $1, (v)
17341 adcl $0, 4(v)
17342 +
17343 +#ifdef CONFIG_PAX_REFCOUNT
17344 + jno 0f
17345 + subl $1, (v)
17346 + sbbl $0, 4(v)
17347 + int $4
17348 +0:
17349 + _ASM_EXTABLE(0b, 0b)
17350 +#endif
17351 +
17352 +RET_ENDP
17353 +BEGIN(inc_unchecked)
17354 + addl $1, (v)
17355 + adcl $0, 4(v)
17356 RET_ENDP
17357 #undef v
17358
17359 @@ -114,6 +203,26 @@ BEGIN(inc_return)
17360 movl 4(v), %edx
17361 addl $1, %eax
17362 adcl $0, %edx
17363 +
17364 +#ifdef CONFIG_PAX_REFCOUNT
17365 + into
17366 +1234:
17367 + _ASM_EXTABLE(1234b, 2f)
17368 +#endif
17369 +
17370 + movl %eax, (v)
17371 + movl %edx, 4(v)
17372 +
17373 +#ifdef CONFIG_PAX_REFCOUNT
17374 +2:
17375 +#endif
17376 +
17377 +RET_ENDP
17378 +BEGIN(inc_return_unchecked)
17379 + movl (v), %eax
17380 + movl 4(v), %edx
17381 + addl $1, %eax
17382 + adcl $0, %edx
17383 movl %eax, (v)
17384 movl %edx, 4(v)
17385 RET_ENDP
17386 @@ -123,6 +232,20 @@ RET_ENDP
17387 BEGIN(dec)
17388 subl $1, (v)
17389 sbbl $0, 4(v)
17390 +
17391 +#ifdef CONFIG_PAX_REFCOUNT
17392 + jno 0f
17393 + addl $1, (v)
17394 + adcl $0, 4(v)
17395 + int $4
17396 +0:
17397 + _ASM_EXTABLE(0b, 0b)
17398 +#endif
17399 +
17400 +RET_ENDP
17401 +BEGIN(dec_unchecked)
17402 + subl $1, (v)
17403 + sbbl $0, 4(v)
17404 RET_ENDP
17405 #undef v
17406
17407 @@ -132,6 +255,26 @@ BEGIN(dec_return)
17408 movl 4(v), %edx
17409 subl $1, %eax
17410 sbbl $0, %edx
17411 +
17412 +#ifdef CONFIG_PAX_REFCOUNT
17413 + into
17414 +1234:
17415 + _ASM_EXTABLE(1234b, 2f)
17416 +#endif
17417 +
17418 + movl %eax, (v)
17419 + movl %edx, 4(v)
17420 +
17421 +#ifdef CONFIG_PAX_REFCOUNT
17422 +2:
17423 +#endif
17424 +
17425 +RET_ENDP
17426 +BEGIN(dec_return_unchecked)
17427 + movl (v), %eax
17428 + movl 4(v), %edx
17429 + subl $1, %eax
17430 + sbbl $0, %edx
17431 movl %eax, (v)
17432 movl %edx, 4(v)
17433 RET_ENDP
17434 @@ -143,6 +286,13 @@ BEGIN(add_unless)
17435 adcl %edx, %edi
17436 addl (v), %eax
17437 adcl 4(v), %edx
17438 +
17439 +#ifdef CONFIG_PAX_REFCOUNT
17440 + into
17441 +1234:
17442 + _ASM_EXTABLE(1234b, 2f)
17443 +#endif
17444 +
17445 cmpl %eax, %esi
17446 je 3f
17447 1:
17448 @@ -168,6 +318,13 @@ BEGIN(inc_not_zero)
17449 1:
17450 addl $1, %eax
17451 adcl $0, %edx
17452 +
17453 +#ifdef CONFIG_PAX_REFCOUNT
17454 + into
17455 +1234:
17456 + _ASM_EXTABLE(1234b, 2f)
17457 +#endif
17458 +
17459 movl %eax, (v)
17460 movl %edx, 4(v)
17461 movl $1, %eax
17462 @@ -186,6 +343,13 @@ BEGIN(dec_if_positive)
17463 movl 4(v), %edx
17464 subl $1, %eax
17465 sbbl $0, %edx
17466 +
17467 +#ifdef CONFIG_PAX_REFCOUNT
17468 + into
17469 +1234:
17470 + _ASM_EXTABLE(1234b, 1f)
17471 +#endif
17472 +
17473 js 1f
17474 movl %eax, (v)
17475 movl %edx, 4(v)
17476 diff -urNp linux-3.0.9/arch/x86/lib/atomic64_cx8_32.S linux-3.0.9/arch/x86/lib/atomic64_cx8_32.S
17477 --- linux-3.0.9/arch/x86/lib/atomic64_cx8_32.S 2011-11-11 13:12:24.000000000 -0500
17478 +++ linux-3.0.9/arch/x86/lib/atomic64_cx8_32.S 2011-11-15 20:02:59.000000000 -0500
17479 @@ -35,10 +35,20 @@ ENTRY(atomic64_read_cx8)
17480 CFI_STARTPROC
17481
17482 read64 %ecx
17483 + pax_force_retaddr
17484 ret
17485 CFI_ENDPROC
17486 ENDPROC(atomic64_read_cx8)
17487
17488 +ENTRY(atomic64_read_unchecked_cx8)
17489 + CFI_STARTPROC
17490 +
17491 + read64 %ecx
17492 + pax_force_retaddr
17493 + ret
17494 + CFI_ENDPROC
17495 +ENDPROC(atomic64_read_unchecked_cx8)
17496 +
17497 ENTRY(atomic64_set_cx8)
17498 CFI_STARTPROC
17499
17500 @@ -48,10 +58,25 @@ ENTRY(atomic64_set_cx8)
17501 cmpxchg8b (%esi)
17502 jne 1b
17503
17504 + pax_force_retaddr
17505 ret
17506 CFI_ENDPROC
17507 ENDPROC(atomic64_set_cx8)
17508
17509 +ENTRY(atomic64_set_unchecked_cx8)
17510 + CFI_STARTPROC
17511 +
17512 +1:
17513 +/* we don't need LOCK_PREFIX since aligned 64-bit writes
17514 + * are atomic on 586 and newer */
17515 + cmpxchg8b (%esi)
17516 + jne 1b
17517 +
17518 + pax_force_retaddr
17519 + ret
17520 + CFI_ENDPROC
17521 +ENDPROC(atomic64_set_unchecked_cx8)
17522 +
17523 ENTRY(atomic64_xchg_cx8)
17524 CFI_STARTPROC
17525
17526 @@ -62,12 +87,13 @@ ENTRY(atomic64_xchg_cx8)
17527 cmpxchg8b (%esi)
17528 jne 1b
17529
17530 + pax_force_retaddr
17531 ret
17532 CFI_ENDPROC
17533 ENDPROC(atomic64_xchg_cx8)
17534
17535 -.macro addsub_return func ins insc
17536 -ENTRY(atomic64_\func\()_return_cx8)
17537 +.macro addsub_return func ins insc unchecked=""
17538 +ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
17539 CFI_STARTPROC
17540 SAVE ebp
17541 SAVE ebx
17542 @@ -84,27 +110,44 @@ ENTRY(atomic64_\func\()_return_cx8)
17543 movl %edx, %ecx
17544 \ins\()l %esi, %ebx
17545 \insc\()l %edi, %ecx
17546 +
17547 +.ifb \unchecked
17548 +#ifdef CONFIG_PAX_REFCOUNT
17549 + into
17550 +2:
17551 + _ASM_EXTABLE(2b, 3f)
17552 +#endif
17553 +.endif
17554 +
17555 LOCK_PREFIX
17556 cmpxchg8b (%ebp)
17557 jne 1b
17558 -
17559 -10:
17560 movl %ebx, %eax
17561 movl %ecx, %edx
17562 +
17563 +.ifb \unchecked
17564 +#ifdef CONFIG_PAX_REFCOUNT
17565 +3:
17566 +#endif
17567 +.endif
17568 +
17569 RESTORE edi
17570 RESTORE esi
17571 RESTORE ebx
17572 RESTORE ebp
17573 + pax_force_retaddr
17574 ret
17575 CFI_ENDPROC
17576 -ENDPROC(atomic64_\func\()_return_cx8)
17577 +ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
17578 .endm
17579
17580 addsub_return add add adc
17581 addsub_return sub sub sbb
17582 +addsub_return add add adc _unchecked
17583 +addsub_return sub sub sbb _unchecked
17584
17585 -.macro incdec_return func ins insc
17586 -ENTRY(atomic64_\func\()_return_cx8)
17587 +.macro incdec_return func ins insc unchecked
17588 +ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
17589 CFI_STARTPROC
17590 SAVE ebx
17591
17592 @@ -114,21 +157,39 @@ ENTRY(atomic64_\func\()_return_cx8)
17593 movl %edx, %ecx
17594 \ins\()l $1, %ebx
17595 \insc\()l $0, %ecx
17596 +
17597 +.ifb \unchecked
17598 +#ifdef CONFIG_PAX_REFCOUNT
17599 + into
17600 +2:
17601 + _ASM_EXTABLE(2b, 3f)
17602 +#endif
17603 +.endif
17604 +
17605 LOCK_PREFIX
17606 cmpxchg8b (%esi)
17607 jne 1b
17608
17609 -10:
17610 movl %ebx, %eax
17611 movl %ecx, %edx
17612 +
17613 +.ifb \unchecked
17614 +#ifdef CONFIG_PAX_REFCOUNT
17615 +3:
17616 +#endif
17617 +.endif
17618 +
17619 RESTORE ebx
17620 + pax_force_retaddr
17621 ret
17622 CFI_ENDPROC
17623 -ENDPROC(atomic64_\func\()_return_cx8)
17624 +ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
17625 .endm
17626
17627 incdec_return inc add adc
17628 incdec_return dec sub sbb
17629 +incdec_return inc add adc _unchecked
17630 +incdec_return dec sub sbb _unchecked
17631
17632 ENTRY(atomic64_dec_if_positive_cx8)
17633 CFI_STARTPROC
17634 @@ -140,6 +201,13 @@ ENTRY(atomic64_dec_if_positive_cx8)
17635 movl %edx, %ecx
17636 subl $1, %ebx
17637 sbb $0, %ecx
17638 +
17639 +#ifdef CONFIG_PAX_REFCOUNT
17640 + into
17641 +1234:
17642 + _ASM_EXTABLE(1234b, 2f)
17643 +#endif
17644 +
17645 js 2f
17646 LOCK_PREFIX
17647 cmpxchg8b (%esi)
17648 @@ -149,6 +217,7 @@ ENTRY(atomic64_dec_if_positive_cx8)
17649 movl %ebx, %eax
17650 movl %ecx, %edx
17651 RESTORE ebx
17652 + pax_force_retaddr
17653 ret
17654 CFI_ENDPROC
17655 ENDPROC(atomic64_dec_if_positive_cx8)
17656 @@ -174,6 +243,13 @@ ENTRY(atomic64_add_unless_cx8)
17657 movl %edx, %ecx
17658 addl %esi, %ebx
17659 adcl %edi, %ecx
17660 +
17661 +#ifdef CONFIG_PAX_REFCOUNT
17662 + into
17663 +1234:
17664 + _ASM_EXTABLE(1234b, 3f)
17665 +#endif
17666 +
17667 LOCK_PREFIX
17668 cmpxchg8b (%ebp)
17669 jne 1b
17670 @@ -184,6 +260,7 @@ ENTRY(atomic64_add_unless_cx8)
17671 CFI_ADJUST_CFA_OFFSET -8
17672 RESTORE ebx
17673 RESTORE ebp
17674 + pax_force_retaddr
17675 ret
17676 4:
17677 cmpl %edx, 4(%esp)
17678 @@ -206,6 +283,13 @@ ENTRY(atomic64_inc_not_zero_cx8)
17679 movl %edx, %ecx
17680 addl $1, %ebx
17681 adcl $0, %ecx
17682 +
17683 +#ifdef CONFIG_PAX_REFCOUNT
17684 + into
17685 +1234:
17686 + _ASM_EXTABLE(1234b, 3f)
17687 +#endif
17688 +
17689 LOCK_PREFIX
17690 cmpxchg8b (%esi)
17691 jne 1b
17692 @@ -213,6 +297,7 @@ ENTRY(atomic64_inc_not_zero_cx8)
17693 movl $1, %eax
17694 3:
17695 RESTORE ebx
17696 + pax_force_retaddr
17697 ret
17698 4:
17699 testl %edx, %edx
17700 diff -urNp linux-3.0.9/arch/x86/lib/checksum_32.S linux-3.0.9/arch/x86/lib/checksum_32.S
17701 --- linux-3.0.9/arch/x86/lib/checksum_32.S 2011-11-11 13:12:24.000000000 -0500
17702 +++ linux-3.0.9/arch/x86/lib/checksum_32.S 2011-11-15 20:02:59.000000000 -0500
17703 @@ -28,7 +28,8 @@
17704 #include <linux/linkage.h>
17705 #include <asm/dwarf2.h>
17706 #include <asm/errno.h>
17707 -
17708 +#include <asm/segment.h>
17709 +
17710 /*
17711 * computes a partial checksum, e.g. for TCP/UDP fragments
17712 */
17713 @@ -296,9 +297,24 @@ unsigned int csum_partial_copy_generic (
17714
17715 #define ARGBASE 16
17716 #define FP 12
17717 -
17718 -ENTRY(csum_partial_copy_generic)
17719 +
17720 +ENTRY(csum_partial_copy_generic_to_user)
17721 CFI_STARTPROC
17722 +
17723 +#ifdef CONFIG_PAX_MEMORY_UDEREF
17724 + pushl_cfi %gs
17725 + popl_cfi %es
17726 + jmp csum_partial_copy_generic
17727 +#endif
17728 +
17729 +ENTRY(csum_partial_copy_generic_from_user)
17730 +
17731 +#ifdef CONFIG_PAX_MEMORY_UDEREF
17732 + pushl_cfi %gs
17733 + popl_cfi %ds
17734 +#endif
17735 +
17736 +ENTRY(csum_partial_copy_generic)
17737 subl $4,%esp
17738 CFI_ADJUST_CFA_OFFSET 4
17739 pushl_cfi %edi
17740 @@ -320,7 +336,7 @@ ENTRY(csum_partial_copy_generic)
17741 jmp 4f
17742 SRC(1: movw (%esi), %bx )
17743 addl $2, %esi
17744 -DST( movw %bx, (%edi) )
17745 +DST( movw %bx, %es:(%edi) )
17746 addl $2, %edi
17747 addw %bx, %ax
17748 adcl $0, %eax
17749 @@ -332,30 +348,30 @@ DST( movw %bx, (%edi) )
17750 SRC(1: movl (%esi), %ebx )
17751 SRC( movl 4(%esi), %edx )
17752 adcl %ebx, %eax
17753 -DST( movl %ebx, (%edi) )
17754 +DST( movl %ebx, %es:(%edi) )
17755 adcl %edx, %eax
17756 -DST( movl %edx, 4(%edi) )
17757 +DST( movl %edx, %es:4(%edi) )
17758
17759 SRC( movl 8(%esi), %ebx )
17760 SRC( movl 12(%esi), %edx )
17761 adcl %ebx, %eax
17762 -DST( movl %ebx, 8(%edi) )
17763 +DST( movl %ebx, %es:8(%edi) )
17764 adcl %edx, %eax
17765 -DST( movl %edx, 12(%edi) )
17766 +DST( movl %edx, %es:12(%edi) )
17767
17768 SRC( movl 16(%esi), %ebx )
17769 SRC( movl 20(%esi), %edx )
17770 adcl %ebx, %eax
17771 -DST( movl %ebx, 16(%edi) )
17772 +DST( movl %ebx, %es:16(%edi) )
17773 adcl %edx, %eax
17774 -DST( movl %edx, 20(%edi) )
17775 +DST( movl %edx, %es:20(%edi) )
17776
17777 SRC( movl 24(%esi), %ebx )
17778 SRC( movl 28(%esi), %edx )
17779 adcl %ebx, %eax
17780 -DST( movl %ebx, 24(%edi) )
17781 +DST( movl %ebx, %es:24(%edi) )
17782 adcl %edx, %eax
17783 -DST( movl %edx, 28(%edi) )
17784 +DST( movl %edx, %es:28(%edi) )
17785
17786 lea 32(%esi), %esi
17787 lea 32(%edi), %edi
17788 @@ -369,7 +385,7 @@ DST( movl %edx, 28(%edi) )
17789 shrl $2, %edx # This clears CF
17790 SRC(3: movl (%esi), %ebx )
17791 adcl %ebx, %eax
17792 -DST( movl %ebx, (%edi) )
17793 +DST( movl %ebx, %es:(%edi) )
17794 lea 4(%esi), %esi
17795 lea 4(%edi), %edi
17796 dec %edx
17797 @@ -381,12 +397,12 @@ DST( movl %ebx, (%edi) )
17798 jb 5f
17799 SRC( movw (%esi), %cx )
17800 leal 2(%esi), %esi
17801 -DST( movw %cx, (%edi) )
17802 +DST( movw %cx, %es:(%edi) )
17803 leal 2(%edi), %edi
17804 je 6f
17805 shll $16,%ecx
17806 SRC(5: movb (%esi), %cl )
17807 -DST( movb %cl, (%edi) )
17808 +DST( movb %cl, %es:(%edi) )
17809 6: addl %ecx, %eax
17810 adcl $0, %eax
17811 7:
17812 @@ -397,7 +413,7 @@ DST( movb %cl, (%edi) )
17813
17814 6001:
17815 movl ARGBASE+20(%esp), %ebx # src_err_ptr
17816 - movl $-EFAULT, (%ebx)
17817 + movl $-EFAULT, %ss:(%ebx)
17818
17819 # zero the complete destination - computing the rest
17820 # is too much work
17821 @@ -410,11 +426,15 @@ DST( movb %cl, (%edi) )
17822
17823 6002:
17824 movl ARGBASE+24(%esp), %ebx # dst_err_ptr
17825 - movl $-EFAULT,(%ebx)
17826 + movl $-EFAULT,%ss:(%ebx)
17827 jmp 5000b
17828
17829 .previous
17830
17831 + pushl_cfi %ss
17832 + popl_cfi %ds
17833 + pushl_cfi %ss
17834 + popl_cfi %es
17835 popl_cfi %ebx
17836 CFI_RESTORE ebx
17837 popl_cfi %esi
17838 @@ -424,26 +444,43 @@ DST( movb %cl, (%edi) )
17839 popl_cfi %ecx # equivalent to addl $4,%esp
17840 ret
17841 CFI_ENDPROC
17842 -ENDPROC(csum_partial_copy_generic)
17843 +ENDPROC(csum_partial_copy_generic_to_user)
17844
17845 #else
17846
17847 /* Version for PentiumII/PPro */
17848
17849 #define ROUND1(x) \
17850 + nop; nop; nop; \
17851 SRC(movl x(%esi), %ebx ) ; \
17852 addl %ebx, %eax ; \
17853 - DST(movl %ebx, x(%edi) ) ;
17854 + DST(movl %ebx, %es:x(%edi)) ;
17855
17856 #define ROUND(x) \
17857 + nop; nop; nop; \
17858 SRC(movl x(%esi), %ebx ) ; \
17859 adcl %ebx, %eax ; \
17860 - DST(movl %ebx, x(%edi) ) ;
17861 + DST(movl %ebx, %es:x(%edi)) ;
17862
17863 #define ARGBASE 12
17864 -
17865 -ENTRY(csum_partial_copy_generic)
17866 +
17867 +ENTRY(csum_partial_copy_generic_to_user)
17868 CFI_STARTPROC
17869 +
17870 +#ifdef CONFIG_PAX_MEMORY_UDEREF
17871 + pushl_cfi %gs
17872 + popl_cfi %es
17873 + jmp csum_partial_copy_generic
17874 +#endif
17875 +
17876 +ENTRY(csum_partial_copy_generic_from_user)
17877 +
17878 +#ifdef CONFIG_PAX_MEMORY_UDEREF
17879 + pushl_cfi %gs
17880 + popl_cfi %ds
17881 +#endif
17882 +
17883 +ENTRY(csum_partial_copy_generic)
17884 pushl_cfi %ebx
17885 CFI_REL_OFFSET ebx, 0
17886 pushl_cfi %edi
17887 @@ -464,7 +501,7 @@ ENTRY(csum_partial_copy_generic)
17888 subl %ebx, %edi
17889 lea -1(%esi),%edx
17890 andl $-32,%edx
17891 - lea 3f(%ebx,%ebx), %ebx
17892 + lea 3f(%ebx,%ebx,2), %ebx
17893 testl %esi, %esi
17894 jmp *%ebx
17895 1: addl $64,%esi
17896 @@ -485,19 +522,19 @@ ENTRY(csum_partial_copy_generic)
17897 jb 5f
17898 SRC( movw (%esi), %dx )
17899 leal 2(%esi), %esi
17900 -DST( movw %dx, (%edi) )
17901 +DST( movw %dx, %es:(%edi) )
17902 leal 2(%edi), %edi
17903 je 6f
17904 shll $16,%edx
17905 5:
17906 SRC( movb (%esi), %dl )
17907 -DST( movb %dl, (%edi) )
17908 +DST( movb %dl, %es:(%edi) )
17909 6: addl %edx, %eax
17910 adcl $0, %eax
17911 7:
17912 .section .fixup, "ax"
17913 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
17914 - movl $-EFAULT, (%ebx)
17915 + movl $-EFAULT, %ss:(%ebx)
17916 # zero the complete destination (computing the rest is too much work)
17917 movl ARGBASE+8(%esp),%edi # dst
17918 movl ARGBASE+12(%esp),%ecx # len
17919 @@ -505,10 +542,17 @@ DST( movb %dl, (%edi) )
17920 rep; stosb
17921 jmp 7b
17922 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
17923 - movl $-EFAULT, (%ebx)
17924 + movl $-EFAULT, %ss:(%ebx)
17925 jmp 7b
17926 .previous
17927
17928 +#ifdef CONFIG_PAX_MEMORY_UDEREF
17929 + pushl_cfi %ss
17930 + popl_cfi %ds
17931 + pushl_cfi %ss
17932 + popl_cfi %es
17933 +#endif
17934 +
17935 popl_cfi %esi
17936 CFI_RESTORE esi
17937 popl_cfi %edi
17938 @@ -517,7 +561,7 @@ DST( movb %dl, (%edi) )
17939 CFI_RESTORE ebx
17940 ret
17941 CFI_ENDPROC
17942 -ENDPROC(csum_partial_copy_generic)
17943 +ENDPROC(csum_partial_copy_generic_to_user)
17944
17945 #undef ROUND
17946 #undef ROUND1
17947 diff -urNp linux-3.0.9/arch/x86/lib/clear_page_64.S linux-3.0.9/arch/x86/lib/clear_page_64.S
17948 --- linux-3.0.9/arch/x86/lib/clear_page_64.S 2011-11-11 13:12:24.000000000 -0500
17949 +++ linux-3.0.9/arch/x86/lib/clear_page_64.S 2011-11-15 20:02:59.000000000 -0500
17950 @@ -11,6 +11,7 @@ ENTRY(clear_page_c)
17951 movl $4096/8,%ecx
17952 xorl %eax,%eax
17953 rep stosq
17954 + pax_force_retaddr
17955 ret
17956 CFI_ENDPROC
17957 ENDPROC(clear_page_c)
17958 @@ -20,6 +21,7 @@ ENTRY(clear_page_c_e)
17959 movl $4096,%ecx
17960 xorl %eax,%eax
17961 rep stosb
17962 + pax_force_retaddr
17963 ret
17964 CFI_ENDPROC
17965 ENDPROC(clear_page_c_e)
17966 @@ -43,6 +45,7 @@ ENTRY(clear_page)
17967 leaq 64(%rdi),%rdi
17968 jnz .Lloop
17969 nop
17970 + pax_force_retaddr
17971 ret
17972 CFI_ENDPROC
17973 .Lclear_page_end:
17974 @@ -58,7 +61,7 @@ ENDPROC(clear_page)
17975
17976 #include <asm/cpufeature.h>
17977
17978 - .section .altinstr_replacement,"ax"
17979 + .section .altinstr_replacement,"a"
17980 1: .byte 0xeb /* jmp <disp8> */
17981 .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
17982 2: .byte 0xeb /* jmp <disp8> */
17983 diff -urNp linux-3.0.9/arch/x86/lib/cmpxchg16b_emu.S linux-3.0.9/arch/x86/lib/cmpxchg16b_emu.S
17984 --- linux-3.0.9/arch/x86/lib/cmpxchg16b_emu.S 2011-11-11 13:12:24.000000000 -0500
17985 +++ linux-3.0.9/arch/x86/lib/cmpxchg16b_emu.S 2011-11-15 20:02:59.000000000 -0500
17986 @@ -53,11 +53,13 @@ this_cpu_cmpxchg16b_emu:
17987
17988 popf
17989 mov $1, %al
17990 + pax_force_retaddr
17991 ret
17992
17993 not_same:
17994 popf
17995 xor %al,%al
17996 + pax_force_retaddr
17997 ret
17998
17999 CFI_ENDPROC
18000 diff -urNp linux-3.0.9/arch/x86/lib/copy_page_64.S linux-3.0.9/arch/x86/lib/copy_page_64.S
18001 --- linux-3.0.9/arch/x86/lib/copy_page_64.S 2011-11-11 13:12:24.000000000 -0500
18002 +++ linux-3.0.9/arch/x86/lib/copy_page_64.S 2011-11-15 20:02:59.000000000 -0500
18003 @@ -2,12 +2,14 @@
18004
18005 #include <linux/linkage.h>
18006 #include <asm/dwarf2.h>
18007 +#include <asm/alternative-asm.h>
18008
18009 ALIGN
18010 copy_page_c:
18011 CFI_STARTPROC
18012 movl $4096/8,%ecx
18013 rep movsq
18014 + pax_force_retaddr
18015 ret
18016 CFI_ENDPROC
18017 ENDPROC(copy_page_c)
18018 @@ -94,6 +96,7 @@ ENTRY(copy_page)
18019 CFI_RESTORE r13
18020 addq $3*8,%rsp
18021 CFI_ADJUST_CFA_OFFSET -3*8
18022 + pax_force_retaddr
18023 ret
18024 .Lcopy_page_end:
18025 CFI_ENDPROC
18026 @@ -104,7 +107,7 @@ ENDPROC(copy_page)
18027
18028 #include <asm/cpufeature.h>
18029
18030 - .section .altinstr_replacement,"ax"
18031 + .section .altinstr_replacement,"a"
18032 1: .byte 0xeb /* jmp <disp8> */
18033 .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
18034 2:
18035 diff -urNp linux-3.0.9/arch/x86/lib/copy_user_64.S linux-3.0.9/arch/x86/lib/copy_user_64.S
18036 --- linux-3.0.9/arch/x86/lib/copy_user_64.S 2011-11-11 13:12:24.000000000 -0500
18037 +++ linux-3.0.9/arch/x86/lib/copy_user_64.S 2011-11-15 20:02:59.000000000 -0500
18038 @@ -16,6 +16,7 @@
18039 #include <asm/thread_info.h>
18040 #include <asm/cpufeature.h>
18041 #include <asm/alternative-asm.h>
18042 +#include <asm/pgtable.h>
18043
18044 /*
18045 * By placing feature2 after feature1 in altinstructions section, we logically
18046 @@ -29,7 +30,7 @@
18047 .byte 0xe9 /* 32bit jump */
18048 .long \orig-1f /* by default jump to orig */
18049 1:
18050 - .section .altinstr_replacement,"ax"
18051 + .section .altinstr_replacement,"a"
18052 2: .byte 0xe9 /* near jump with 32bit immediate */
18053 .long \alt1-1b /* offset */ /* or alternatively to alt1 */
18054 3: .byte 0xe9 /* near jump with 32bit immediate */
18055 @@ -71,47 +72,20 @@
18056 #endif
18057 .endm
18058
18059 -/* Standard copy_to_user with segment limit checking */
18060 -ENTRY(_copy_to_user)
18061 - CFI_STARTPROC
18062 - GET_THREAD_INFO(%rax)
18063 - movq %rdi,%rcx
18064 - addq %rdx,%rcx
18065 - jc bad_to_user
18066 - cmpq TI_addr_limit(%rax),%rcx
18067 - ja bad_to_user
18068 - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
18069 - copy_user_generic_unrolled,copy_user_generic_string, \
18070 - copy_user_enhanced_fast_string
18071 - CFI_ENDPROC
18072 -ENDPROC(_copy_to_user)
18073 -
18074 -/* Standard copy_from_user with segment limit checking */
18075 -ENTRY(_copy_from_user)
18076 - CFI_STARTPROC
18077 - GET_THREAD_INFO(%rax)
18078 - movq %rsi,%rcx
18079 - addq %rdx,%rcx
18080 - jc bad_from_user
18081 - cmpq TI_addr_limit(%rax),%rcx
18082 - ja bad_from_user
18083 - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
18084 - copy_user_generic_unrolled,copy_user_generic_string, \
18085 - copy_user_enhanced_fast_string
18086 - CFI_ENDPROC
18087 -ENDPROC(_copy_from_user)
18088 -
18089 .section .fixup,"ax"
18090 /* must zero dest */
18091 ENTRY(bad_from_user)
18092 bad_from_user:
18093 CFI_STARTPROC
18094 + testl %edx,%edx
18095 + js bad_to_user
18096 movl %edx,%ecx
18097 xorl %eax,%eax
18098 rep
18099 stosb
18100 bad_to_user:
18101 movl %edx,%eax
18102 + pax_force_retaddr
18103 ret
18104 CFI_ENDPROC
18105 ENDPROC(bad_from_user)
18106 @@ -179,6 +153,7 @@ ENTRY(copy_user_generic_unrolled)
18107 decl %ecx
18108 jnz 21b
18109 23: xor %eax,%eax
18110 + pax_force_retaddr
18111 ret
18112
18113 .section .fixup,"ax"
18114 @@ -251,6 +226,7 @@ ENTRY(copy_user_generic_string)
18115 3: rep
18116 movsb
18117 4: xorl %eax,%eax
18118 + pax_force_retaddr
18119 ret
18120
18121 .section .fixup,"ax"
18122 @@ -287,6 +263,7 @@ ENTRY(copy_user_enhanced_fast_string)
18123 1: rep
18124 movsb
18125 2: xorl %eax,%eax
18126 + pax_force_retaddr
18127 ret
18128
18129 .section .fixup,"ax"
18130 diff -urNp linux-3.0.9/arch/x86/lib/copy_user_nocache_64.S linux-3.0.9/arch/x86/lib/copy_user_nocache_64.S
18131 --- linux-3.0.9/arch/x86/lib/copy_user_nocache_64.S 2011-11-11 13:12:24.000000000 -0500
18132 +++ linux-3.0.9/arch/x86/lib/copy_user_nocache_64.S 2011-11-15 20:02:59.000000000 -0500
18133 @@ -8,12 +8,14 @@
18134
18135 #include <linux/linkage.h>
18136 #include <asm/dwarf2.h>
18137 +#include <asm/alternative-asm.h>
18138
18139 #define FIX_ALIGNMENT 1
18140
18141 #include <asm/current.h>
18142 #include <asm/asm-offsets.h>
18143 #include <asm/thread_info.h>
18144 +#include <asm/pgtable.h>
18145
18146 .macro ALIGN_DESTINATION
18147 #ifdef FIX_ALIGNMENT
18148 @@ -50,6 +52,15 @@
18149 */
18150 ENTRY(__copy_user_nocache)
18151 CFI_STARTPROC
18152 +
18153 +#ifdef CONFIG_PAX_MEMORY_UDEREF
18154 + mov $PAX_USER_SHADOW_BASE,%rcx
18155 + cmp %rcx,%rsi
18156 + jae 1f
18157 + add %rcx,%rsi
18158 +1:
18159 +#endif
18160 +
18161 cmpl $8,%edx
18162 jb 20f /* less then 8 bytes, go to byte copy loop */
18163 ALIGN_DESTINATION
18164 @@ -98,6 +109,7 @@ ENTRY(__copy_user_nocache)
18165 jnz 21b
18166 23: xorl %eax,%eax
18167 sfence
18168 + pax_force_retaddr
18169 ret
18170
18171 .section .fixup,"ax"
18172 diff -urNp linux-3.0.9/arch/x86/lib/csum-copy_64.S linux-3.0.9/arch/x86/lib/csum-copy_64.S
18173 --- linux-3.0.9/arch/x86/lib/csum-copy_64.S 2011-11-11 13:12:24.000000000 -0500
18174 +++ linux-3.0.9/arch/x86/lib/csum-copy_64.S 2011-11-15 20:02:59.000000000 -0500
18175 @@ -8,6 +8,7 @@
18176 #include <linux/linkage.h>
18177 #include <asm/dwarf2.h>
18178 #include <asm/errno.h>
18179 +#include <asm/alternative-asm.h>
18180
18181 /*
18182 * Checksum copy with exception handling.
18183 @@ -228,6 +229,7 @@ ENTRY(csum_partial_copy_generic)
18184 CFI_RESTORE rbp
18185 addq $7*8, %rsp
18186 CFI_ADJUST_CFA_OFFSET -7*8
18187 + pax_force_retaddr
18188 ret
18189 CFI_RESTORE_STATE
18190
18191 diff -urNp linux-3.0.9/arch/x86/lib/csum-wrappers_64.c linux-3.0.9/arch/x86/lib/csum-wrappers_64.c
18192 --- linux-3.0.9/arch/x86/lib/csum-wrappers_64.c 2011-11-11 13:12:24.000000000 -0500
18193 +++ linux-3.0.9/arch/x86/lib/csum-wrappers_64.c 2011-11-15 20:02:59.000000000 -0500
18194 @@ -52,7 +52,13 @@ csum_partial_copy_from_user(const void _
18195 len -= 2;
18196 }
18197 }
18198 - isum = csum_partial_copy_generic((__force const void *)src,
18199 +
18200 +#ifdef CONFIG_PAX_MEMORY_UDEREF
18201 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
18202 + src += PAX_USER_SHADOW_BASE;
18203 +#endif
18204 +
18205 + isum = csum_partial_copy_generic((const void __force_kernel *)src,
18206 dst, len, isum, errp, NULL);
18207 if (unlikely(*errp))
18208 goto out_err;
18209 @@ -105,7 +111,13 @@ csum_partial_copy_to_user(const void *sr
18210 }
18211
18212 *errp = 0;
18213 - return csum_partial_copy_generic(src, (void __force *)dst,
18214 +
18215 +#ifdef CONFIG_PAX_MEMORY_UDEREF
18216 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
18217 + dst += PAX_USER_SHADOW_BASE;
18218 +#endif
18219 +
18220 + return csum_partial_copy_generic(src, (void __force_kernel *)dst,
18221 len, isum, NULL, errp);
18222 }
18223 EXPORT_SYMBOL(csum_partial_copy_to_user);
18224 diff -urNp linux-3.0.9/arch/x86/lib/getuser.S linux-3.0.9/arch/x86/lib/getuser.S
18225 --- linux-3.0.9/arch/x86/lib/getuser.S 2011-11-11 13:12:24.000000000 -0500
18226 +++ linux-3.0.9/arch/x86/lib/getuser.S 2011-11-15 20:02:59.000000000 -0500
18227 @@ -33,15 +33,38 @@
18228 #include <asm/asm-offsets.h>
18229 #include <asm/thread_info.h>
18230 #include <asm/asm.h>
18231 +#include <asm/segment.h>
18232 +#include <asm/pgtable.h>
18233 +#include <asm/alternative-asm.h>
18234 +
18235 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18236 +#define __copyuser_seg gs;
18237 +#else
18238 +#define __copyuser_seg
18239 +#endif
18240
18241 .text
18242 ENTRY(__get_user_1)
18243 CFI_STARTPROC
18244 +
18245 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
18246 GET_THREAD_INFO(%_ASM_DX)
18247 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
18248 jae bad_get_user
18249 -1: movzb (%_ASM_AX),%edx
18250 +
18251 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
18252 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
18253 + cmp %_ASM_DX,%_ASM_AX
18254 + jae 1234f
18255 + add %_ASM_DX,%_ASM_AX
18256 +1234:
18257 +#endif
18258 +
18259 +#endif
18260 +
18261 +1: __copyuser_seg movzb (%_ASM_AX),%edx
18262 xor %eax,%eax
18263 + pax_force_retaddr
18264 ret
18265 CFI_ENDPROC
18266 ENDPROC(__get_user_1)
18267 @@ -49,12 +72,26 @@ ENDPROC(__get_user_1)
18268 ENTRY(__get_user_2)
18269 CFI_STARTPROC
18270 add $1,%_ASM_AX
18271 +
18272 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
18273 jc bad_get_user
18274 GET_THREAD_INFO(%_ASM_DX)
18275 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
18276 jae bad_get_user
18277 -2: movzwl -1(%_ASM_AX),%edx
18278 +
18279 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
18280 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
18281 + cmp %_ASM_DX,%_ASM_AX
18282 + jae 1234f
18283 + add %_ASM_DX,%_ASM_AX
18284 +1234:
18285 +#endif
18286 +
18287 +#endif
18288 +
18289 +2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
18290 xor %eax,%eax
18291 + pax_force_retaddr
18292 ret
18293 CFI_ENDPROC
18294 ENDPROC(__get_user_2)
18295 @@ -62,12 +99,26 @@ ENDPROC(__get_user_2)
18296 ENTRY(__get_user_4)
18297 CFI_STARTPROC
18298 add $3,%_ASM_AX
18299 +
18300 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
18301 jc bad_get_user
18302 GET_THREAD_INFO(%_ASM_DX)
18303 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
18304 jae bad_get_user
18305 -3: mov -3(%_ASM_AX),%edx
18306 +
18307 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
18308 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
18309 + cmp %_ASM_DX,%_ASM_AX
18310 + jae 1234f
18311 + add %_ASM_DX,%_ASM_AX
18312 +1234:
18313 +#endif
18314 +
18315 +#endif
18316 +
18317 +3: __copyuser_seg mov -3(%_ASM_AX),%edx
18318 xor %eax,%eax
18319 + pax_force_retaddr
18320 ret
18321 CFI_ENDPROC
18322 ENDPROC(__get_user_4)
18323 @@ -80,8 +131,18 @@ ENTRY(__get_user_8)
18324 GET_THREAD_INFO(%_ASM_DX)
18325 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
18326 jae bad_get_user
18327 +
18328 +#ifdef CONFIG_PAX_MEMORY_UDEREF
18329 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
18330 + cmp %_ASM_DX,%_ASM_AX
18331 + jae 1234f
18332 + add %_ASM_DX,%_ASM_AX
18333 +1234:
18334 +#endif
18335 +
18336 4: movq -7(%_ASM_AX),%_ASM_DX
18337 xor %eax,%eax
18338 + pax_force_retaddr
18339 ret
18340 CFI_ENDPROC
18341 ENDPROC(__get_user_8)
18342 @@ -91,6 +152,7 @@ bad_get_user:
18343 CFI_STARTPROC
18344 xor %edx,%edx
18345 mov $(-EFAULT),%_ASM_AX
18346 + pax_force_retaddr
18347 ret
18348 CFI_ENDPROC
18349 END(bad_get_user)
18350 diff -urNp linux-3.0.9/arch/x86/lib/insn.c linux-3.0.9/arch/x86/lib/insn.c
18351 --- linux-3.0.9/arch/x86/lib/insn.c 2011-11-11 13:12:24.000000000 -0500
18352 +++ linux-3.0.9/arch/x86/lib/insn.c 2011-11-15 20:02:59.000000000 -0500
18353 @@ -21,6 +21,11 @@
18354 #include <linux/string.h>
18355 #include <asm/inat.h>
18356 #include <asm/insn.h>
18357 +#ifdef __KERNEL__
18358 +#include <asm/pgtable_types.h>
18359 +#else
18360 +#define ktla_ktva(addr) addr
18361 +#endif
18362
18363 #define get_next(t, insn) \
18364 ({t r; r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); r; })
18365 @@ -40,8 +45,8 @@
18366 void insn_init(struct insn *insn, const void *kaddr, int x86_64)
18367 {
18368 memset(insn, 0, sizeof(*insn));
18369 - insn->kaddr = kaddr;
18370 - insn->next_byte = kaddr;
18371 + insn->kaddr = ktla_ktva(kaddr);
18372 + insn->next_byte = ktla_ktva(kaddr);
18373 insn->x86_64 = x86_64 ? 1 : 0;
18374 insn->opnd_bytes = 4;
18375 if (x86_64)
18376 diff -urNp linux-3.0.9/arch/x86/lib/iomap_copy_64.S linux-3.0.9/arch/x86/lib/iomap_copy_64.S
18377 --- linux-3.0.9/arch/x86/lib/iomap_copy_64.S 2011-11-11 13:12:24.000000000 -0500
18378 +++ linux-3.0.9/arch/x86/lib/iomap_copy_64.S 2011-11-15 20:02:59.000000000 -0500
18379 @@ -17,6 +17,7 @@
18380
18381 #include <linux/linkage.h>
18382 #include <asm/dwarf2.h>
18383 +#include <asm/alternative-asm.h>
18384
18385 /*
18386 * override generic version in lib/iomap_copy.c
18387 @@ -25,6 +26,7 @@ ENTRY(__iowrite32_copy)
18388 CFI_STARTPROC
18389 movl %edx,%ecx
18390 rep movsd
18391 + pax_force_retaddr
18392 ret
18393 CFI_ENDPROC
18394 ENDPROC(__iowrite32_copy)
18395 diff -urNp linux-3.0.9/arch/x86/lib/memcpy_64.S linux-3.0.9/arch/x86/lib/memcpy_64.S
18396 --- linux-3.0.9/arch/x86/lib/memcpy_64.S 2011-11-11 13:12:24.000000000 -0500
18397 +++ linux-3.0.9/arch/x86/lib/memcpy_64.S 2011-11-15 20:02:59.000000000 -0500
18398 @@ -34,6 +34,7 @@
18399 rep movsq
18400 movl %edx, %ecx
18401 rep movsb
18402 + pax_force_retaddr
18403 ret
18404 .Lmemcpy_e:
18405 .previous
18406 @@ -51,6 +52,7 @@
18407
18408 movl %edx, %ecx
18409 rep movsb
18410 + pax_force_retaddr
18411 ret
18412 .Lmemcpy_e_e:
18413 .previous
18414 @@ -141,6 +143,7 @@ ENTRY(memcpy)
18415 movq %r9, 1*8(%rdi)
18416 movq %r10, -2*8(%rdi, %rdx)
18417 movq %r11, -1*8(%rdi, %rdx)
18418 + pax_force_retaddr
18419 retq
18420 .p2align 4
18421 .Lless_16bytes:
18422 @@ -153,6 +156,7 @@ ENTRY(memcpy)
18423 movq -1*8(%rsi, %rdx), %r9
18424 movq %r8, 0*8(%rdi)
18425 movq %r9, -1*8(%rdi, %rdx)
18426 + pax_force_retaddr
18427 retq
18428 .p2align 4
18429 .Lless_8bytes:
18430 @@ -166,6 +170,7 @@ ENTRY(memcpy)
18431 movl -4(%rsi, %rdx), %r8d
18432 movl %ecx, (%rdi)
18433 movl %r8d, -4(%rdi, %rdx)
18434 + pax_force_retaddr
18435 retq
18436 .p2align 4
18437 .Lless_3bytes:
18438 @@ -183,6 +188,7 @@ ENTRY(memcpy)
18439 jnz .Lloop_1
18440
18441 .Lend:
18442 + pax_force_retaddr
18443 retq
18444 CFI_ENDPROC
18445 ENDPROC(memcpy)
18446 diff -urNp linux-3.0.9/arch/x86/lib/memmove_64.S linux-3.0.9/arch/x86/lib/memmove_64.S
18447 --- linux-3.0.9/arch/x86/lib/memmove_64.S 2011-11-11 13:12:24.000000000 -0500
18448 +++ linux-3.0.9/arch/x86/lib/memmove_64.S 2011-11-15 20:02:59.000000000 -0500
18449 @@ -9,6 +9,7 @@
18450 #include <linux/linkage.h>
18451 #include <asm/dwarf2.h>
18452 #include <asm/cpufeature.h>
18453 +#include <asm/alternative-asm.h>
18454
18455 #undef memmove
18456
18457 @@ -201,6 +202,7 @@ ENTRY(memmove)
18458 movb (%rsi), %r11b
18459 movb %r11b, (%rdi)
18460 13:
18461 + pax_force_retaddr
18462 retq
18463 CFI_ENDPROC
18464
18465 @@ -209,6 +211,7 @@ ENTRY(memmove)
18466 /* Forward moving data. */
18467 movq %rdx, %rcx
18468 rep movsb
18469 + pax_force_retaddr
18470 retq
18471 .Lmemmove_end_forward_efs:
18472 .previous
18473 diff -urNp linux-3.0.9/arch/x86/lib/memset_64.S linux-3.0.9/arch/x86/lib/memset_64.S
18474 --- linux-3.0.9/arch/x86/lib/memset_64.S 2011-11-11 13:12:24.000000000 -0500
18475 +++ linux-3.0.9/arch/x86/lib/memset_64.S 2011-11-15 20:02:59.000000000 -0500
18476 @@ -31,6 +31,7 @@
18477 movl %r8d,%ecx
18478 rep stosb
18479 movq %r9,%rax
18480 + pax_force_retaddr
18481 ret
18482 .Lmemset_e:
18483 .previous
18484 @@ -53,6 +54,7 @@
18485 movl %edx,%ecx
18486 rep stosb
18487 movq %r9,%rax
18488 + pax_force_retaddr
18489 ret
18490 .Lmemset_e_e:
18491 .previous
18492 @@ -121,6 +123,7 @@ ENTRY(__memset)
18493
18494 .Lende:
18495 movq %r10,%rax
18496 + pax_force_retaddr
18497 ret
18498
18499 CFI_RESTORE_STATE
18500 diff -urNp linux-3.0.9/arch/x86/lib/mmx_32.c linux-3.0.9/arch/x86/lib/mmx_32.c
18501 --- linux-3.0.9/arch/x86/lib/mmx_32.c 2011-11-11 13:12:24.000000000 -0500
18502 +++ linux-3.0.9/arch/x86/lib/mmx_32.c 2011-11-15 20:02:59.000000000 -0500
18503 @@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
18504 {
18505 void *p;
18506 int i;
18507 + unsigned long cr0;
18508
18509 if (unlikely(in_interrupt()))
18510 return __memcpy(to, from, len);
18511 @@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *
18512 kernel_fpu_begin();
18513
18514 __asm__ __volatile__ (
18515 - "1: prefetch (%0)\n" /* This set is 28 bytes */
18516 - " prefetch 64(%0)\n"
18517 - " prefetch 128(%0)\n"
18518 - " prefetch 192(%0)\n"
18519 - " prefetch 256(%0)\n"
18520 + "1: prefetch (%1)\n" /* This set is 28 bytes */
18521 + " prefetch 64(%1)\n"
18522 + " prefetch 128(%1)\n"
18523 + " prefetch 192(%1)\n"
18524 + " prefetch 256(%1)\n"
18525 "2: \n"
18526 ".section .fixup, \"ax\"\n"
18527 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
18528 + "3: \n"
18529 +
18530 +#ifdef CONFIG_PAX_KERNEXEC
18531 + " movl %%cr0, %0\n"
18532 + " movl %0, %%eax\n"
18533 + " andl $0xFFFEFFFF, %%eax\n"
18534 + " movl %%eax, %%cr0\n"
18535 +#endif
18536 +
18537 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
18538 +
18539 +#ifdef CONFIG_PAX_KERNEXEC
18540 + " movl %0, %%cr0\n"
18541 +#endif
18542 +
18543 " jmp 2b\n"
18544 ".previous\n"
18545 _ASM_EXTABLE(1b, 3b)
18546 - : : "r" (from));
18547 + : "=&r" (cr0) : "r" (from) : "ax");
18548
18549 for ( ; i > 5; i--) {
18550 __asm__ __volatile__ (
18551 - "1: prefetch 320(%0)\n"
18552 - "2: movq (%0), %%mm0\n"
18553 - " movq 8(%0), %%mm1\n"
18554 - " movq 16(%0), %%mm2\n"
18555 - " movq 24(%0), %%mm3\n"
18556 - " movq %%mm0, (%1)\n"
18557 - " movq %%mm1, 8(%1)\n"
18558 - " movq %%mm2, 16(%1)\n"
18559 - " movq %%mm3, 24(%1)\n"
18560 - " movq 32(%0), %%mm0\n"
18561 - " movq 40(%0), %%mm1\n"
18562 - " movq 48(%0), %%mm2\n"
18563 - " movq 56(%0), %%mm3\n"
18564 - " movq %%mm0, 32(%1)\n"
18565 - " movq %%mm1, 40(%1)\n"
18566 - " movq %%mm2, 48(%1)\n"
18567 - " movq %%mm3, 56(%1)\n"
18568 + "1: prefetch 320(%1)\n"
18569 + "2: movq (%1), %%mm0\n"
18570 + " movq 8(%1), %%mm1\n"
18571 + " movq 16(%1), %%mm2\n"
18572 + " movq 24(%1), %%mm3\n"
18573 + " movq %%mm0, (%2)\n"
18574 + " movq %%mm1, 8(%2)\n"
18575 + " movq %%mm2, 16(%2)\n"
18576 + " movq %%mm3, 24(%2)\n"
18577 + " movq 32(%1), %%mm0\n"
18578 + " movq 40(%1), %%mm1\n"
18579 + " movq 48(%1), %%mm2\n"
18580 + " movq 56(%1), %%mm3\n"
18581 + " movq %%mm0, 32(%2)\n"
18582 + " movq %%mm1, 40(%2)\n"
18583 + " movq %%mm2, 48(%2)\n"
18584 + " movq %%mm3, 56(%2)\n"
18585 ".section .fixup, \"ax\"\n"
18586 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
18587 + "3:\n"
18588 +
18589 +#ifdef CONFIG_PAX_KERNEXEC
18590 + " movl %%cr0, %0\n"
18591 + " movl %0, %%eax\n"
18592 + " andl $0xFFFEFFFF, %%eax\n"
18593 + " movl %%eax, %%cr0\n"
18594 +#endif
18595 +
18596 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
18597 +
18598 +#ifdef CONFIG_PAX_KERNEXEC
18599 + " movl %0, %%cr0\n"
18600 +#endif
18601 +
18602 " jmp 2b\n"
18603 ".previous\n"
18604 _ASM_EXTABLE(1b, 3b)
18605 - : : "r" (from), "r" (to) : "memory");
18606 + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
18607
18608 from += 64;
18609 to += 64;
18610 @@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
18611 static void fast_copy_page(void *to, void *from)
18612 {
18613 int i;
18614 + unsigned long cr0;
18615
18616 kernel_fpu_begin();
18617
18618 @@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi
18619 * but that is for later. -AV
18620 */
18621 __asm__ __volatile__(
18622 - "1: prefetch (%0)\n"
18623 - " prefetch 64(%0)\n"
18624 - " prefetch 128(%0)\n"
18625 - " prefetch 192(%0)\n"
18626 - " prefetch 256(%0)\n"
18627 + "1: prefetch (%1)\n"
18628 + " prefetch 64(%1)\n"
18629 + " prefetch 128(%1)\n"
18630 + " prefetch 192(%1)\n"
18631 + " prefetch 256(%1)\n"
18632 "2: \n"
18633 ".section .fixup, \"ax\"\n"
18634 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
18635 + "3: \n"
18636 +
18637 +#ifdef CONFIG_PAX_KERNEXEC
18638 + " movl %%cr0, %0\n"
18639 + " movl %0, %%eax\n"
18640 + " andl $0xFFFEFFFF, %%eax\n"
18641 + " movl %%eax, %%cr0\n"
18642 +#endif
18643 +
18644 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
18645 +
18646 +#ifdef CONFIG_PAX_KERNEXEC
18647 + " movl %0, %%cr0\n"
18648 +#endif
18649 +
18650 " jmp 2b\n"
18651 ".previous\n"
18652 - _ASM_EXTABLE(1b, 3b) : : "r" (from));
18653 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
18654
18655 for (i = 0; i < (4096-320)/64; i++) {
18656 __asm__ __volatile__ (
18657 - "1: prefetch 320(%0)\n"
18658 - "2: movq (%0), %%mm0\n"
18659 - " movntq %%mm0, (%1)\n"
18660 - " movq 8(%0), %%mm1\n"
18661 - " movntq %%mm1, 8(%1)\n"
18662 - " movq 16(%0), %%mm2\n"
18663 - " movntq %%mm2, 16(%1)\n"
18664 - " movq 24(%0), %%mm3\n"
18665 - " movntq %%mm3, 24(%1)\n"
18666 - " movq 32(%0), %%mm4\n"
18667 - " movntq %%mm4, 32(%1)\n"
18668 - " movq 40(%0), %%mm5\n"
18669 - " movntq %%mm5, 40(%1)\n"
18670 - " movq 48(%0), %%mm6\n"
18671 - " movntq %%mm6, 48(%1)\n"
18672 - " movq 56(%0), %%mm7\n"
18673 - " movntq %%mm7, 56(%1)\n"
18674 + "1: prefetch 320(%1)\n"
18675 + "2: movq (%1), %%mm0\n"
18676 + " movntq %%mm0, (%2)\n"
18677 + " movq 8(%1), %%mm1\n"
18678 + " movntq %%mm1, 8(%2)\n"
18679 + " movq 16(%1), %%mm2\n"
18680 + " movntq %%mm2, 16(%2)\n"
18681 + " movq 24(%1), %%mm3\n"
18682 + " movntq %%mm3, 24(%2)\n"
18683 + " movq 32(%1), %%mm4\n"
18684 + " movntq %%mm4, 32(%2)\n"
18685 + " movq 40(%1), %%mm5\n"
18686 + " movntq %%mm5, 40(%2)\n"
18687 + " movq 48(%1), %%mm6\n"
18688 + " movntq %%mm6, 48(%2)\n"
18689 + " movq 56(%1), %%mm7\n"
18690 + " movntq %%mm7, 56(%2)\n"
18691 ".section .fixup, \"ax\"\n"
18692 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
18693 + "3:\n"
18694 +
18695 +#ifdef CONFIG_PAX_KERNEXEC
18696 + " movl %%cr0, %0\n"
18697 + " movl %0, %%eax\n"
18698 + " andl $0xFFFEFFFF, %%eax\n"
18699 + " movl %%eax, %%cr0\n"
18700 +#endif
18701 +
18702 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
18703 +
18704 +#ifdef CONFIG_PAX_KERNEXEC
18705 + " movl %0, %%cr0\n"
18706 +#endif
18707 +
18708 " jmp 2b\n"
18709 ".previous\n"
18710 - _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
18711 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
18712
18713 from += 64;
18714 to += 64;
18715 @@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
18716 static void fast_copy_page(void *to, void *from)
18717 {
18718 int i;
18719 + unsigned long cr0;
18720
18721 kernel_fpu_begin();
18722
18723 __asm__ __volatile__ (
18724 - "1: prefetch (%0)\n"
18725 - " prefetch 64(%0)\n"
18726 - " prefetch 128(%0)\n"
18727 - " prefetch 192(%0)\n"
18728 - " prefetch 256(%0)\n"
18729 + "1: prefetch (%1)\n"
18730 + " prefetch 64(%1)\n"
18731 + " prefetch 128(%1)\n"
18732 + " prefetch 192(%1)\n"
18733 + " prefetch 256(%1)\n"
18734 "2: \n"
18735 ".section .fixup, \"ax\"\n"
18736 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
18737 + "3: \n"
18738 +
18739 +#ifdef CONFIG_PAX_KERNEXEC
18740 + " movl %%cr0, %0\n"
18741 + " movl %0, %%eax\n"
18742 + " andl $0xFFFEFFFF, %%eax\n"
18743 + " movl %%eax, %%cr0\n"
18744 +#endif
18745 +
18746 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
18747 +
18748 +#ifdef CONFIG_PAX_KERNEXEC
18749 + " movl %0, %%cr0\n"
18750 +#endif
18751 +
18752 " jmp 2b\n"
18753 ".previous\n"
18754 - _ASM_EXTABLE(1b, 3b) : : "r" (from));
18755 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
18756
18757 for (i = 0; i < 4096/64; i++) {
18758 __asm__ __volatile__ (
18759 - "1: prefetch 320(%0)\n"
18760 - "2: movq (%0), %%mm0\n"
18761 - " movq 8(%0), %%mm1\n"
18762 - " movq 16(%0), %%mm2\n"
18763 - " movq 24(%0), %%mm3\n"
18764 - " movq %%mm0, (%1)\n"
18765 - " movq %%mm1, 8(%1)\n"
18766 - " movq %%mm2, 16(%1)\n"
18767 - " movq %%mm3, 24(%1)\n"
18768 - " movq 32(%0), %%mm0\n"
18769 - " movq 40(%0), %%mm1\n"
18770 - " movq 48(%0), %%mm2\n"
18771 - " movq 56(%0), %%mm3\n"
18772 - " movq %%mm0, 32(%1)\n"
18773 - " movq %%mm1, 40(%1)\n"
18774 - " movq %%mm2, 48(%1)\n"
18775 - " movq %%mm3, 56(%1)\n"
18776 + "1: prefetch 320(%1)\n"
18777 + "2: movq (%1), %%mm0\n"
18778 + " movq 8(%1), %%mm1\n"
18779 + " movq 16(%1), %%mm2\n"
18780 + " movq 24(%1), %%mm3\n"
18781 + " movq %%mm0, (%2)\n"
18782 + " movq %%mm1, 8(%2)\n"
18783 + " movq %%mm2, 16(%2)\n"
18784 + " movq %%mm3, 24(%2)\n"
18785 + " movq 32(%1), %%mm0\n"
18786 + " movq 40(%1), %%mm1\n"
18787 + " movq 48(%1), %%mm2\n"
18788 + " movq 56(%1), %%mm3\n"
18789 + " movq %%mm0, 32(%2)\n"
18790 + " movq %%mm1, 40(%2)\n"
18791 + " movq %%mm2, 48(%2)\n"
18792 + " movq %%mm3, 56(%2)\n"
18793 ".section .fixup, \"ax\"\n"
18794 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
18795 + "3:\n"
18796 +
18797 +#ifdef CONFIG_PAX_KERNEXEC
18798 + " movl %%cr0, %0\n"
18799 + " movl %0, %%eax\n"
18800 + " andl $0xFFFEFFFF, %%eax\n"
18801 + " movl %%eax, %%cr0\n"
18802 +#endif
18803 +
18804 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
18805 +
18806 +#ifdef CONFIG_PAX_KERNEXEC
18807 + " movl %0, %%cr0\n"
18808 +#endif
18809 +
18810 " jmp 2b\n"
18811 ".previous\n"
18812 _ASM_EXTABLE(1b, 3b)
18813 - : : "r" (from), "r" (to) : "memory");
18814 + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
18815
18816 from += 64;
18817 to += 64;
18818 diff -urNp linux-3.0.9/arch/x86/lib/msr-reg.S linux-3.0.9/arch/x86/lib/msr-reg.S
18819 --- linux-3.0.9/arch/x86/lib/msr-reg.S 2011-11-11 13:12:24.000000000 -0500
18820 +++ linux-3.0.9/arch/x86/lib/msr-reg.S 2011-11-15 20:02:59.000000000 -0500
18821 @@ -3,6 +3,7 @@
18822 #include <asm/dwarf2.h>
18823 #include <asm/asm.h>
18824 #include <asm/msr.h>
18825 +#include <asm/alternative-asm.h>
18826
18827 #ifdef CONFIG_X86_64
18828 /*
18829 @@ -37,6 +38,7 @@ ENTRY(native_\op\()_safe_regs)
18830 movl %edi, 28(%r10)
18831 popq_cfi %rbp
18832 popq_cfi %rbx
18833 + pax_force_retaddr
18834 ret
18835 3:
18836 CFI_RESTORE_STATE
18837 diff -urNp linux-3.0.9/arch/x86/lib/putuser.S linux-3.0.9/arch/x86/lib/putuser.S
18838 --- linux-3.0.9/arch/x86/lib/putuser.S 2011-11-11 13:12:24.000000000 -0500
18839 +++ linux-3.0.9/arch/x86/lib/putuser.S 2011-11-15 20:02:59.000000000 -0500
18840 @@ -15,7 +15,9 @@
18841 #include <asm/thread_info.h>
18842 #include <asm/errno.h>
18843 #include <asm/asm.h>
18844 -
18845 +#include <asm/segment.h>
18846 +#include <asm/pgtable.h>
18847 +#include <asm/alternative-asm.h>
18848
18849 /*
18850 * __put_user_X
18851 @@ -29,52 +31,119 @@
18852 * as they get called from within inline assembly.
18853 */
18854
18855 -#define ENTER CFI_STARTPROC ; \
18856 - GET_THREAD_INFO(%_ASM_BX)
18857 -#define EXIT ret ; \
18858 +#define ENTER CFI_STARTPROC
18859 +#define EXIT pax_force_retaddr; ret ; \
18860 CFI_ENDPROC
18861
18862 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
18863 +#define _DEST %_ASM_CX,%_ASM_BX
18864 +#else
18865 +#define _DEST %_ASM_CX
18866 +#endif
18867 +
18868 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18869 +#define __copyuser_seg gs;
18870 +#else
18871 +#define __copyuser_seg
18872 +#endif
18873 +
18874 .text
18875 ENTRY(__put_user_1)
18876 ENTER
18877 +
18878 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
18879 + GET_THREAD_INFO(%_ASM_BX)
18880 cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
18881 jae bad_put_user
18882 -1: movb %al,(%_ASM_CX)
18883 +
18884 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
18885 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
18886 + cmp %_ASM_BX,%_ASM_CX
18887 + jb 1234f
18888 + xor %ebx,%ebx
18889 +1234:
18890 +#endif
18891 +
18892 +#endif
18893 +
18894 +1: __copyuser_seg movb %al,(_DEST)
18895 xor %eax,%eax
18896 EXIT
18897 ENDPROC(__put_user_1)
18898
18899 ENTRY(__put_user_2)
18900 ENTER
18901 +
18902 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
18903 + GET_THREAD_INFO(%_ASM_BX)
18904 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
18905 sub $1,%_ASM_BX
18906 cmp %_ASM_BX,%_ASM_CX
18907 jae bad_put_user
18908 -2: movw %ax,(%_ASM_CX)
18909 +
18910 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
18911 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
18912 + cmp %_ASM_BX,%_ASM_CX
18913 + jb 1234f
18914 + xor %ebx,%ebx
18915 +1234:
18916 +#endif
18917 +
18918 +#endif
18919 +
18920 +2: __copyuser_seg movw %ax,(_DEST)
18921 xor %eax,%eax
18922 EXIT
18923 ENDPROC(__put_user_2)
18924
18925 ENTRY(__put_user_4)
18926 ENTER
18927 +
18928 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
18929 + GET_THREAD_INFO(%_ASM_BX)
18930 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
18931 sub $3,%_ASM_BX
18932 cmp %_ASM_BX,%_ASM_CX
18933 jae bad_put_user
18934 -3: movl %eax,(%_ASM_CX)
18935 +
18936 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
18937 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
18938 + cmp %_ASM_BX,%_ASM_CX
18939 + jb 1234f
18940 + xor %ebx,%ebx
18941 +1234:
18942 +#endif
18943 +
18944 +#endif
18945 +
18946 +3: __copyuser_seg movl %eax,(_DEST)
18947 xor %eax,%eax
18948 EXIT
18949 ENDPROC(__put_user_4)
18950
18951 ENTRY(__put_user_8)
18952 ENTER
18953 +
18954 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
18955 + GET_THREAD_INFO(%_ASM_BX)
18956 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
18957 sub $7,%_ASM_BX
18958 cmp %_ASM_BX,%_ASM_CX
18959 jae bad_put_user
18960 -4: mov %_ASM_AX,(%_ASM_CX)
18961 +
18962 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
18963 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
18964 + cmp %_ASM_BX,%_ASM_CX
18965 + jb 1234f
18966 + xor %ebx,%ebx
18967 +1234:
18968 +#endif
18969 +
18970 +#endif
18971 +
18972 +4: __copyuser_seg mov %_ASM_AX,(_DEST)
18973 #ifdef CONFIG_X86_32
18974 -5: movl %edx,4(%_ASM_CX)
18975 +5: __copyuser_seg movl %edx,4(_DEST)
18976 #endif
18977 xor %eax,%eax
18978 EXIT
18979 diff -urNp linux-3.0.9/arch/x86/lib/rwlock_64.S linux-3.0.9/arch/x86/lib/rwlock_64.S
18980 --- linux-3.0.9/arch/x86/lib/rwlock_64.S 2011-11-11 13:12:24.000000000 -0500
18981 +++ linux-3.0.9/arch/x86/lib/rwlock_64.S 2011-11-15 20:02:59.000000000 -0500
18982 @@ -17,6 +17,7 @@ ENTRY(__write_lock_failed)
18983 LOCK_PREFIX
18984 subl $RW_LOCK_BIAS,(%rdi)
18985 jnz __write_lock_failed
18986 + pax_force_retaddr
18987 ret
18988 CFI_ENDPROC
18989 END(__write_lock_failed)
18990 @@ -33,6 +34,7 @@ ENTRY(__read_lock_failed)
18991 LOCK_PREFIX
18992 decl (%rdi)
18993 js __read_lock_failed
18994 + pax_force_retaddr
18995 ret
18996 CFI_ENDPROC
18997 END(__read_lock_failed)
18998 diff -urNp linux-3.0.9/arch/x86/lib/rwsem_64.S linux-3.0.9/arch/x86/lib/rwsem_64.S
18999 --- linux-3.0.9/arch/x86/lib/rwsem_64.S 2011-11-11 13:12:24.000000000 -0500
19000 +++ linux-3.0.9/arch/x86/lib/rwsem_64.S 2011-11-15 20:02:59.000000000 -0500
19001 @@ -51,6 +51,7 @@ ENTRY(call_rwsem_down_read_failed)
19002 popq_cfi %rdx
19003 CFI_RESTORE rdx
19004 restore_common_regs
19005 + pax_force_retaddr
19006 ret
19007 CFI_ENDPROC
19008 ENDPROC(call_rwsem_down_read_failed)
19009 @@ -61,6 +62,7 @@ ENTRY(call_rwsem_down_write_failed)
19010 movq %rax,%rdi
19011 call rwsem_down_write_failed
19012 restore_common_regs
19013 + pax_force_retaddr
19014 ret
19015 CFI_ENDPROC
19016 ENDPROC(call_rwsem_down_write_failed)
19017 @@ -73,7 +75,8 @@ ENTRY(call_rwsem_wake)
19018 movq %rax,%rdi
19019 call rwsem_wake
19020 restore_common_regs
19021 -1: ret
19022 +1: pax_force_retaddr
19023 + ret
19024 CFI_ENDPROC
19025 ENDPROC(call_rwsem_wake)
19026
19027 @@ -88,6 +91,7 @@ ENTRY(call_rwsem_downgrade_wake)
19028 popq_cfi %rdx
19029 CFI_RESTORE rdx
19030 restore_common_regs
19031 + pax_force_retaddr
19032 ret
19033 CFI_ENDPROC
19034 ENDPROC(call_rwsem_downgrade_wake)
19035 diff -urNp linux-3.0.9/arch/x86/lib/thunk_64.S linux-3.0.9/arch/x86/lib/thunk_64.S
19036 --- linux-3.0.9/arch/x86/lib/thunk_64.S 2011-11-11 13:12:24.000000000 -0500
19037 +++ linux-3.0.9/arch/x86/lib/thunk_64.S 2011-11-15 20:02:59.000000000 -0500
19038 @@ -10,7 +10,8 @@
19039 #include <asm/dwarf2.h>
19040 #include <asm/calling.h>
19041 #include <asm/rwlock.h>
19042 -
19043 + #include <asm/alternative-asm.h>
19044 +
19045 /* rdi: arg1 ... normal C conventions. rax is saved/restored. */
19046 .macro thunk name,func
19047 .globl \name
19048 @@ -50,5 +51,6 @@
19049 SAVE_ARGS
19050 restore:
19051 RESTORE_ARGS
19052 - ret
19053 + pax_force_retaddr
19054 + ret
19055 CFI_ENDPROC
19056 diff -urNp linux-3.0.9/arch/x86/lib/usercopy_32.c linux-3.0.9/arch/x86/lib/usercopy_32.c
19057 --- linux-3.0.9/arch/x86/lib/usercopy_32.c 2011-11-11 13:12:24.000000000 -0500
19058 +++ linux-3.0.9/arch/x86/lib/usercopy_32.c 2011-11-15 20:02:59.000000000 -0500
19059 @@ -43,7 +43,7 @@ do { \
19060 __asm__ __volatile__( \
19061 " testl %1,%1\n" \
19062 " jz 2f\n" \
19063 - "0: lodsb\n" \
19064 + "0: "__copyuser_seg"lodsb\n" \
19065 " stosb\n" \
19066 " testb %%al,%%al\n" \
19067 " jz 1f\n" \
19068 @@ -128,10 +128,12 @@ do { \
19069 int __d0; \
19070 might_fault(); \
19071 __asm__ __volatile__( \
19072 + __COPYUSER_SET_ES \
19073 "0: rep; stosl\n" \
19074 " movl %2,%0\n" \
19075 "1: rep; stosb\n" \
19076 "2:\n" \
19077 + __COPYUSER_RESTORE_ES \
19078 ".section .fixup,\"ax\"\n" \
19079 "3: lea 0(%2,%0,4),%0\n" \
19080 " jmp 2b\n" \
19081 @@ -200,6 +202,7 @@ long strnlen_user(const char __user *s,
19082 might_fault();
19083
19084 __asm__ __volatile__(
19085 + __COPYUSER_SET_ES
19086 " testl %0, %0\n"
19087 " jz 3f\n"
19088 " andl %0,%%ecx\n"
19089 @@ -208,6 +211,7 @@ long strnlen_user(const char __user *s,
19090 " subl %%ecx,%0\n"
19091 " addl %0,%%eax\n"
19092 "1:\n"
19093 + __COPYUSER_RESTORE_ES
19094 ".section .fixup,\"ax\"\n"
19095 "2: xorl %%eax,%%eax\n"
19096 " jmp 1b\n"
19097 @@ -227,7 +231,7 @@ EXPORT_SYMBOL(strnlen_user);
19098
19099 #ifdef CONFIG_X86_INTEL_USERCOPY
19100 static unsigned long
19101 -__copy_user_intel(void __user *to, const void *from, unsigned long size)
19102 +__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
19103 {
19104 int d0, d1;
19105 __asm__ __volatile__(
19106 @@ -239,36 +243,36 @@ __copy_user_intel(void __user *to, const
19107 " .align 2,0x90\n"
19108 "3: movl 0(%4), %%eax\n"
19109 "4: movl 4(%4), %%edx\n"
19110 - "5: movl %%eax, 0(%3)\n"
19111 - "6: movl %%edx, 4(%3)\n"
19112 + "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
19113 + "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
19114 "7: movl 8(%4), %%eax\n"
19115 "8: movl 12(%4),%%edx\n"
19116 - "9: movl %%eax, 8(%3)\n"
19117 - "10: movl %%edx, 12(%3)\n"
19118 + "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
19119 + "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
19120 "11: movl 16(%4), %%eax\n"
19121 "12: movl 20(%4), %%edx\n"
19122 - "13: movl %%eax, 16(%3)\n"
19123 - "14: movl %%edx, 20(%3)\n"
19124 + "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
19125 + "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
19126 "15: movl 24(%4), %%eax\n"
19127 "16: movl 28(%4), %%edx\n"
19128 - "17: movl %%eax, 24(%3)\n"
19129 - "18: movl %%edx, 28(%3)\n"
19130 + "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
19131 + "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
19132 "19: movl 32(%4), %%eax\n"
19133 "20: movl 36(%4), %%edx\n"
19134 - "21: movl %%eax, 32(%3)\n"
19135 - "22: movl %%edx, 36(%3)\n"
19136 + "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
19137 + "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
19138 "23: movl 40(%4), %%eax\n"
19139 "24: movl 44(%4), %%edx\n"
19140 - "25: movl %%eax, 40(%3)\n"
19141 - "26: movl %%edx, 44(%3)\n"
19142 + "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
19143 + "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
19144 "27: movl 48(%4), %%eax\n"
19145 "28: movl 52(%4), %%edx\n"
19146 - "29: movl %%eax, 48(%3)\n"
19147 - "30: movl %%edx, 52(%3)\n"
19148 + "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
19149 + "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
19150 "31: movl 56(%4), %%eax\n"
19151 "32: movl 60(%4), %%edx\n"
19152 - "33: movl %%eax, 56(%3)\n"
19153 - "34: movl %%edx, 60(%3)\n"
19154 + "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
19155 + "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
19156 " addl $-64, %0\n"
19157 " addl $64, %4\n"
19158 " addl $64, %3\n"
19159 @@ -278,10 +282,119 @@ __copy_user_intel(void __user *to, const
19160 " shrl $2, %0\n"
19161 " andl $3, %%eax\n"
19162 " cld\n"
19163 + __COPYUSER_SET_ES
19164 "99: rep; movsl\n"
19165 "36: movl %%eax, %0\n"
19166 "37: rep; movsb\n"
19167 "100:\n"
19168 + __COPYUSER_RESTORE_ES
19169 + ".section .fixup,\"ax\"\n"
19170 + "101: lea 0(%%eax,%0,4),%0\n"
19171 + " jmp 100b\n"
19172 + ".previous\n"
19173 + ".section __ex_table,\"a\"\n"
19174 + " .align 4\n"
19175 + " .long 1b,100b\n"
19176 + " .long 2b,100b\n"
19177 + " .long 3b,100b\n"
19178 + " .long 4b,100b\n"
19179 + " .long 5b,100b\n"
19180 + " .long 6b,100b\n"
19181 + " .long 7b,100b\n"
19182 + " .long 8b,100b\n"
19183 + " .long 9b,100b\n"
19184 + " .long 10b,100b\n"
19185 + " .long 11b,100b\n"
19186 + " .long 12b,100b\n"
19187 + " .long 13b,100b\n"
19188 + " .long 14b,100b\n"
19189 + " .long 15b,100b\n"
19190 + " .long 16b,100b\n"
19191 + " .long 17b,100b\n"
19192 + " .long 18b,100b\n"
19193 + " .long 19b,100b\n"
19194 + " .long 20b,100b\n"
19195 + " .long 21b,100b\n"
19196 + " .long 22b,100b\n"
19197 + " .long 23b,100b\n"
19198 + " .long 24b,100b\n"
19199 + " .long 25b,100b\n"
19200 + " .long 26b,100b\n"
19201 + " .long 27b,100b\n"
19202 + " .long 28b,100b\n"
19203 + " .long 29b,100b\n"
19204 + " .long 30b,100b\n"
19205 + " .long 31b,100b\n"
19206 + " .long 32b,100b\n"
19207 + " .long 33b,100b\n"
19208 + " .long 34b,100b\n"
19209 + " .long 35b,100b\n"
19210 + " .long 36b,100b\n"
19211 + " .long 37b,100b\n"
19212 + " .long 99b,101b\n"
19213 + ".previous"
19214 + : "=&c"(size), "=&D" (d0), "=&S" (d1)
19215 + : "1"(to), "2"(from), "0"(size)
19216 + : "eax", "edx", "memory");
19217 + return size;
19218 +}
19219 +
19220 +static unsigned long
19221 +__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
19222 +{
19223 + int d0, d1;
19224 + __asm__ __volatile__(
19225 + " .align 2,0x90\n"
19226 + "1: "__copyuser_seg" movl 32(%4), %%eax\n"
19227 + " cmpl $67, %0\n"
19228 + " jbe 3f\n"
19229 + "2: "__copyuser_seg" movl 64(%4), %%eax\n"
19230 + " .align 2,0x90\n"
19231 + "3: "__copyuser_seg" movl 0(%4), %%eax\n"
19232 + "4: "__copyuser_seg" movl 4(%4), %%edx\n"
19233 + "5: movl %%eax, 0(%3)\n"
19234 + "6: movl %%edx, 4(%3)\n"
19235 + "7: "__copyuser_seg" movl 8(%4), %%eax\n"
19236 + "8: "__copyuser_seg" movl 12(%4),%%edx\n"
19237 + "9: movl %%eax, 8(%3)\n"
19238 + "10: movl %%edx, 12(%3)\n"
19239 + "11: "__copyuser_seg" movl 16(%4), %%eax\n"
19240 + "12: "__copyuser_seg" movl 20(%4), %%edx\n"
19241 + "13: movl %%eax, 16(%3)\n"
19242 + "14: movl %%edx, 20(%3)\n"
19243 + "15: "__copyuser_seg" movl 24(%4), %%eax\n"
19244 + "16: "__copyuser_seg" movl 28(%4), %%edx\n"
19245 + "17: movl %%eax, 24(%3)\n"
19246 + "18: movl %%edx, 28(%3)\n"
19247 + "19: "__copyuser_seg" movl 32(%4), %%eax\n"
19248 + "20: "__copyuser_seg" movl 36(%4), %%edx\n"
19249 + "21: movl %%eax, 32(%3)\n"
19250 + "22: movl %%edx, 36(%3)\n"
19251 + "23: "__copyuser_seg" movl 40(%4), %%eax\n"
19252 + "24: "__copyuser_seg" movl 44(%4), %%edx\n"
19253 + "25: movl %%eax, 40(%3)\n"
19254 + "26: movl %%edx, 44(%3)\n"
19255 + "27: "__copyuser_seg" movl 48(%4), %%eax\n"
19256 + "28: "__copyuser_seg" movl 52(%4), %%edx\n"
19257 + "29: movl %%eax, 48(%3)\n"
19258 + "30: movl %%edx, 52(%3)\n"
19259 + "31: "__copyuser_seg" movl 56(%4), %%eax\n"
19260 + "32: "__copyuser_seg" movl 60(%4), %%edx\n"
19261 + "33: movl %%eax, 56(%3)\n"
19262 + "34: movl %%edx, 60(%3)\n"
19263 + " addl $-64, %0\n"
19264 + " addl $64, %4\n"
19265 + " addl $64, %3\n"
19266 + " cmpl $63, %0\n"
19267 + " ja 1b\n"
19268 + "35: movl %0, %%eax\n"
19269 + " shrl $2, %0\n"
19270 + " andl $3, %%eax\n"
19271 + " cld\n"
19272 + "99: rep; "__copyuser_seg" movsl\n"
19273 + "36: movl %%eax, %0\n"
19274 + "37: rep; "__copyuser_seg" movsb\n"
19275 + "100:\n"
19276 ".section .fixup,\"ax\"\n"
19277 "101: lea 0(%%eax,%0,4),%0\n"
19278 " jmp 100b\n"
19279 @@ -339,41 +452,41 @@ __copy_user_zeroing_intel(void *to, cons
19280 int d0, d1;
19281 __asm__ __volatile__(
19282 " .align 2,0x90\n"
19283 - "0: movl 32(%4), %%eax\n"
19284 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
19285 " cmpl $67, %0\n"
19286 " jbe 2f\n"
19287 - "1: movl 64(%4), %%eax\n"
19288 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
19289 " .align 2,0x90\n"
19290 - "2: movl 0(%4), %%eax\n"
19291 - "21: movl 4(%4), %%edx\n"
19292 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
19293 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
19294 " movl %%eax, 0(%3)\n"
19295 " movl %%edx, 4(%3)\n"
19296 - "3: movl 8(%4), %%eax\n"
19297 - "31: movl 12(%4),%%edx\n"
19298 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
19299 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
19300 " movl %%eax, 8(%3)\n"
19301 " movl %%edx, 12(%3)\n"
19302 - "4: movl 16(%4), %%eax\n"
19303 - "41: movl 20(%4), %%edx\n"
19304 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
19305 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
19306 " movl %%eax, 16(%3)\n"
19307 " movl %%edx, 20(%3)\n"
19308 - "10: movl 24(%4), %%eax\n"
19309 - "51: movl 28(%4), %%edx\n"
19310 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
19311 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
19312 " movl %%eax, 24(%3)\n"
19313 " movl %%edx, 28(%3)\n"
19314 - "11: movl 32(%4), %%eax\n"
19315 - "61: movl 36(%4), %%edx\n"
19316 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
19317 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
19318 " movl %%eax, 32(%3)\n"
19319 " movl %%edx, 36(%3)\n"
19320 - "12: movl 40(%4), %%eax\n"
19321 - "71: movl 44(%4), %%edx\n"
19322 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
19323 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
19324 " movl %%eax, 40(%3)\n"
19325 " movl %%edx, 44(%3)\n"
19326 - "13: movl 48(%4), %%eax\n"
19327 - "81: movl 52(%4), %%edx\n"
19328 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
19329 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
19330 " movl %%eax, 48(%3)\n"
19331 " movl %%edx, 52(%3)\n"
19332 - "14: movl 56(%4), %%eax\n"
19333 - "91: movl 60(%4), %%edx\n"
19334 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
19335 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
19336 " movl %%eax, 56(%3)\n"
19337 " movl %%edx, 60(%3)\n"
19338 " addl $-64, %0\n"
19339 @@ -385,9 +498,9 @@ __copy_user_zeroing_intel(void *to, cons
19340 " shrl $2, %0\n"
19341 " andl $3, %%eax\n"
19342 " cld\n"
19343 - "6: rep; movsl\n"
19344 + "6: rep; "__copyuser_seg" movsl\n"
19345 " movl %%eax,%0\n"
19346 - "7: rep; movsb\n"
19347 + "7: rep; "__copyuser_seg" movsb\n"
19348 "8:\n"
19349 ".section .fixup,\"ax\"\n"
19350 "9: lea 0(%%eax,%0,4),%0\n"
19351 @@ -440,41 +553,41 @@ static unsigned long __copy_user_zeroing
19352
19353 __asm__ __volatile__(
19354 " .align 2,0x90\n"
19355 - "0: movl 32(%4), %%eax\n"
19356 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
19357 " cmpl $67, %0\n"
19358 " jbe 2f\n"
19359 - "1: movl 64(%4), %%eax\n"
19360 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
19361 " .align 2,0x90\n"
19362 - "2: movl 0(%4), %%eax\n"
19363 - "21: movl 4(%4), %%edx\n"
19364 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
19365 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
19366 " movnti %%eax, 0(%3)\n"
19367 " movnti %%edx, 4(%3)\n"
19368 - "3: movl 8(%4), %%eax\n"
19369 - "31: movl 12(%4),%%edx\n"
19370 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
19371 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
19372 " movnti %%eax, 8(%3)\n"
19373 " movnti %%edx, 12(%3)\n"
19374 - "4: movl 16(%4), %%eax\n"
19375 - "41: movl 20(%4), %%edx\n"
19376 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
19377 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
19378 " movnti %%eax, 16(%3)\n"
19379 " movnti %%edx, 20(%3)\n"
19380 - "10: movl 24(%4), %%eax\n"
19381 - "51: movl 28(%4), %%edx\n"
19382 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
19383 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
19384 " movnti %%eax, 24(%3)\n"
19385 " movnti %%edx, 28(%3)\n"
19386 - "11: movl 32(%4), %%eax\n"
19387 - "61: movl 36(%4), %%edx\n"
19388 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
19389 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
19390 " movnti %%eax, 32(%3)\n"
19391 " movnti %%edx, 36(%3)\n"
19392 - "12: movl 40(%4), %%eax\n"
19393 - "71: movl 44(%4), %%edx\n"
19394 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
19395 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
19396 " movnti %%eax, 40(%3)\n"
19397 " movnti %%edx, 44(%3)\n"
19398 - "13: movl 48(%4), %%eax\n"
19399 - "81: movl 52(%4), %%edx\n"
19400 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
19401 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
19402 " movnti %%eax, 48(%3)\n"
19403 " movnti %%edx, 52(%3)\n"
19404 - "14: movl 56(%4), %%eax\n"
19405 - "91: movl 60(%4), %%edx\n"
19406 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
19407 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
19408 " movnti %%eax, 56(%3)\n"
19409 " movnti %%edx, 60(%3)\n"
19410 " addl $-64, %0\n"
19411 @@ -487,9 +600,9 @@ static unsigned long __copy_user_zeroing
19412 " shrl $2, %0\n"
19413 " andl $3, %%eax\n"
19414 " cld\n"
19415 - "6: rep; movsl\n"
19416 + "6: rep; "__copyuser_seg" movsl\n"
19417 " movl %%eax,%0\n"
19418 - "7: rep; movsb\n"
19419 + "7: rep; "__copyuser_seg" movsb\n"
19420 "8:\n"
19421 ".section .fixup,\"ax\"\n"
19422 "9: lea 0(%%eax,%0,4),%0\n"
19423 @@ -537,41 +650,41 @@ static unsigned long __copy_user_intel_n
19424
19425 __asm__ __volatile__(
19426 " .align 2,0x90\n"
19427 - "0: movl 32(%4), %%eax\n"
19428 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
19429 " cmpl $67, %0\n"
19430 " jbe 2f\n"
19431 - "1: movl 64(%4), %%eax\n"
19432 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
19433 " .align 2,0x90\n"
19434 - "2: movl 0(%4), %%eax\n"
19435 - "21: movl 4(%4), %%edx\n"
19436 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
19437 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
19438 " movnti %%eax, 0(%3)\n"
19439 " movnti %%edx, 4(%3)\n"
19440 - "3: movl 8(%4), %%eax\n"
19441 - "31: movl 12(%4),%%edx\n"
19442 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
19443 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
19444 " movnti %%eax, 8(%3)\n"
19445 " movnti %%edx, 12(%3)\n"
19446 - "4: movl 16(%4), %%eax\n"
19447 - "41: movl 20(%4), %%edx\n"
19448 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
19449 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
19450 " movnti %%eax, 16(%3)\n"
19451 " movnti %%edx, 20(%3)\n"
19452 - "10: movl 24(%4), %%eax\n"
19453 - "51: movl 28(%4), %%edx\n"
19454 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
19455 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
19456 " movnti %%eax, 24(%3)\n"
19457 " movnti %%edx, 28(%3)\n"
19458 - "11: movl 32(%4), %%eax\n"
19459 - "61: movl 36(%4), %%edx\n"
19460 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
19461 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
19462 " movnti %%eax, 32(%3)\n"
19463 " movnti %%edx, 36(%3)\n"
19464 - "12: movl 40(%4), %%eax\n"
19465 - "71: movl 44(%4), %%edx\n"
19466 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
19467 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
19468 " movnti %%eax, 40(%3)\n"
19469 " movnti %%edx, 44(%3)\n"
19470 - "13: movl 48(%4), %%eax\n"
19471 - "81: movl 52(%4), %%edx\n"
19472 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
19473 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
19474 " movnti %%eax, 48(%3)\n"
19475 " movnti %%edx, 52(%3)\n"
19476 - "14: movl 56(%4), %%eax\n"
19477 - "91: movl 60(%4), %%edx\n"
19478 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
19479 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
19480 " movnti %%eax, 56(%3)\n"
19481 " movnti %%edx, 60(%3)\n"
19482 " addl $-64, %0\n"
19483 @@ -584,9 +697,9 @@ static unsigned long __copy_user_intel_n
19484 " shrl $2, %0\n"
19485 " andl $3, %%eax\n"
19486 " cld\n"
19487 - "6: rep; movsl\n"
19488 + "6: rep; "__copyuser_seg" movsl\n"
19489 " movl %%eax,%0\n"
19490 - "7: rep; movsb\n"
19491 + "7: rep; "__copyuser_seg" movsb\n"
19492 "8:\n"
19493 ".section .fixup,\"ax\"\n"
19494 "9: lea 0(%%eax,%0,4),%0\n"
19495 @@ -629,32 +742,36 @@ static unsigned long __copy_user_intel_n
19496 */
19497 unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
19498 unsigned long size);
19499 -unsigned long __copy_user_intel(void __user *to, const void *from,
19500 +unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
19501 + unsigned long size);
19502 +unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
19503 unsigned long size);
19504 unsigned long __copy_user_zeroing_intel_nocache(void *to,
19505 const void __user *from, unsigned long size);
19506 #endif /* CONFIG_X86_INTEL_USERCOPY */
19507
19508 /* Generic arbitrary sized copy. */
19509 -#define __copy_user(to, from, size) \
19510 +#define __copy_user(to, from, size, prefix, set, restore) \
19511 do { \
19512 int __d0, __d1, __d2; \
19513 __asm__ __volatile__( \
19514 + set \
19515 " cmp $7,%0\n" \
19516 " jbe 1f\n" \
19517 " movl %1,%0\n" \
19518 " negl %0\n" \
19519 " andl $7,%0\n" \
19520 " subl %0,%3\n" \
19521 - "4: rep; movsb\n" \
19522 + "4: rep; "prefix"movsb\n" \
19523 " movl %3,%0\n" \
19524 " shrl $2,%0\n" \
19525 " andl $3,%3\n" \
19526 " .align 2,0x90\n" \
19527 - "0: rep; movsl\n" \
19528 + "0: rep; "prefix"movsl\n" \
19529 " movl %3,%0\n" \
19530 - "1: rep; movsb\n" \
19531 + "1: rep; "prefix"movsb\n" \
19532 "2:\n" \
19533 + restore \
19534 ".section .fixup,\"ax\"\n" \
19535 "5: addl %3,%0\n" \
19536 " jmp 2b\n" \
19537 @@ -682,14 +799,14 @@ do { \
19538 " negl %0\n" \
19539 " andl $7,%0\n" \
19540 " subl %0,%3\n" \
19541 - "4: rep; movsb\n" \
19542 + "4: rep; "__copyuser_seg"movsb\n" \
19543 " movl %3,%0\n" \
19544 " shrl $2,%0\n" \
19545 " andl $3,%3\n" \
19546 " .align 2,0x90\n" \
19547 - "0: rep; movsl\n" \
19548 + "0: rep; "__copyuser_seg"movsl\n" \
19549 " movl %3,%0\n" \
19550 - "1: rep; movsb\n" \
19551 + "1: rep; "__copyuser_seg"movsb\n" \
19552 "2:\n" \
19553 ".section .fixup,\"ax\"\n" \
19554 "5: addl %3,%0\n" \
19555 @@ -775,9 +892,9 @@ survive:
19556 }
19557 #endif
19558 if (movsl_is_ok(to, from, n))
19559 - __copy_user(to, from, n);
19560 + __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
19561 else
19562 - n = __copy_user_intel(to, from, n);
19563 + n = __generic_copy_to_user_intel(to, from, n);
19564 return n;
19565 }
19566 EXPORT_SYMBOL(__copy_to_user_ll);
19567 @@ -797,10 +914,9 @@ unsigned long __copy_from_user_ll_nozero
19568 unsigned long n)
19569 {
19570 if (movsl_is_ok(to, from, n))
19571 - __copy_user(to, from, n);
19572 + __copy_user(to, from, n, __copyuser_seg, "", "");
19573 else
19574 - n = __copy_user_intel((void __user *)to,
19575 - (const void *)from, n);
19576 + n = __generic_copy_from_user_intel(to, from, n);
19577 return n;
19578 }
19579 EXPORT_SYMBOL(__copy_from_user_ll_nozero);
19580 @@ -827,65 +943,50 @@ unsigned long __copy_from_user_ll_nocach
19581 if (n > 64 && cpu_has_xmm2)
19582 n = __copy_user_intel_nocache(to, from, n);
19583 else
19584 - __copy_user(to, from, n);
19585 + __copy_user(to, from, n, __copyuser_seg, "", "");
19586 #else
19587 - __copy_user(to, from, n);
19588 + __copy_user(to, from, n, __copyuser_seg, "", "");
19589 #endif
19590 return n;
19591 }
19592 EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
19593
19594 -/**
19595 - * copy_to_user: - Copy a block of data into user space.
19596 - * @to: Destination address, in user space.
19597 - * @from: Source address, in kernel space.
19598 - * @n: Number of bytes to copy.
19599 - *
19600 - * Context: User context only. This function may sleep.
19601 - *
19602 - * Copy data from kernel space to user space.
19603 - *
19604 - * Returns number of bytes that could not be copied.
19605 - * On success, this will be zero.
19606 - */
19607 -unsigned long
19608 -copy_to_user(void __user *to, const void *from, unsigned long n)
19609 +void copy_from_user_overflow(void)
19610 {
19611 - if (access_ok(VERIFY_WRITE, to, n))
19612 - n = __copy_to_user(to, from, n);
19613 - return n;
19614 + WARN(1, "Buffer overflow detected!\n");
19615 }
19616 -EXPORT_SYMBOL(copy_to_user);
19617 +EXPORT_SYMBOL(copy_from_user_overflow);
19618
19619 -/**
19620 - * copy_from_user: - Copy a block of data from user space.
19621 - * @to: Destination address, in kernel space.
19622 - * @from: Source address, in user space.
19623 - * @n: Number of bytes to copy.
19624 - *
19625 - * Context: User context only. This function may sleep.
19626 - *
19627 - * Copy data from user space to kernel space.
19628 - *
19629 - * Returns number of bytes that could not be copied.
19630 - * On success, this will be zero.
19631 - *
19632 - * If some data could not be copied, this function will pad the copied
19633 - * data to the requested size using zero bytes.
19634 - */
19635 -unsigned long
19636 -_copy_from_user(void *to, const void __user *from, unsigned long n)
19637 +void copy_to_user_overflow(void)
19638 {
19639 - if (access_ok(VERIFY_READ, from, n))
19640 - n = __copy_from_user(to, from, n);
19641 - else
19642 - memset(to, 0, n);
19643 - return n;
19644 + WARN(1, "Buffer overflow detected!\n");
19645 }
19646 -EXPORT_SYMBOL(_copy_from_user);
19647 +EXPORT_SYMBOL(copy_to_user_overflow);
19648
19649 -void copy_from_user_overflow(void)
19650 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19651 +void __set_fs(mm_segment_t x)
19652 {
19653 - WARN(1, "Buffer overflow detected!\n");
19654 + switch (x.seg) {
19655 + case 0:
19656 + loadsegment(gs, 0);
19657 + break;
19658 + case TASK_SIZE_MAX:
19659 + loadsegment(gs, __USER_DS);
19660 + break;
19661 + case -1UL:
19662 + loadsegment(gs, __KERNEL_DS);
19663 + break;
19664 + default:
19665 + BUG();
19666 + }
19667 + return;
19668 }
19669 -EXPORT_SYMBOL(copy_from_user_overflow);
19670 +EXPORT_SYMBOL(__set_fs);
19671 +
19672 +void set_fs(mm_segment_t x)
19673 +{
19674 + current_thread_info()->addr_limit = x;
19675 + __set_fs(x);
19676 +}
19677 +EXPORT_SYMBOL(set_fs);
19678 +#endif
19679 diff -urNp linux-3.0.9/arch/x86/lib/usercopy_64.c linux-3.0.9/arch/x86/lib/usercopy_64.c
19680 --- linux-3.0.9/arch/x86/lib/usercopy_64.c 2011-11-11 13:12:24.000000000 -0500
19681 +++ linux-3.0.9/arch/x86/lib/usercopy_64.c 2011-11-15 20:02:59.000000000 -0500
19682 @@ -42,6 +42,12 @@ long
19683 __strncpy_from_user(char *dst, const char __user *src, long count)
19684 {
19685 long res;
19686 +
19687 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19688 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
19689 + src += PAX_USER_SHADOW_BASE;
19690 +#endif
19691 +
19692 __do_strncpy_from_user(dst, src, count, res);
19693 return res;
19694 }
19695 @@ -65,6 +71,12 @@ unsigned long __clear_user(void __user *
19696 {
19697 long __d0;
19698 might_fault();
19699 +
19700 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19701 + if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
19702 + addr += PAX_USER_SHADOW_BASE;
19703 +#endif
19704 +
19705 /* no memory constraint because it doesn't change any memory gcc knows
19706 about */
19707 asm volatile(
19708 @@ -151,10 +163,18 @@ EXPORT_SYMBOL(strlen_user);
19709
19710 unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
19711 {
19712 - if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
19713 - return copy_user_generic((__force void *)to, (__force void *)from, len);
19714 - }
19715 - return len;
19716 + if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
19717 +
19718 +#ifdef CONFIG_PAX_MEMORY_UDEREF
19719 + if ((unsigned long)to < PAX_USER_SHADOW_BASE)
19720 + to += PAX_USER_SHADOW_BASE;
19721 + if ((unsigned long)from < PAX_USER_SHADOW_BASE)
19722 + from += PAX_USER_SHADOW_BASE;
19723 +#endif
19724 +
19725 + return copy_user_generic((void __force_kernel *)to, (void __force_kernel *)from, len);
19726 + }
19727 + return len;
19728 }
19729 EXPORT_SYMBOL(copy_in_user);
19730
19731 @@ -164,7 +184,7 @@ EXPORT_SYMBOL(copy_in_user);
19732 * it is not necessary to optimize tail handling.
19733 */
19734 unsigned long
19735 -copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
19736 +copy_user_handle_tail(char __user *to, char __user *from, unsigned len, unsigned zerorest)
19737 {
19738 char c;
19739 unsigned zero_len;
19740 diff -urNp linux-3.0.9/arch/x86/Makefile linux-3.0.9/arch/x86/Makefile
19741 --- linux-3.0.9/arch/x86/Makefile 2011-11-11 13:12:24.000000000 -0500
19742 +++ linux-3.0.9/arch/x86/Makefile 2011-11-15 20:02:59.000000000 -0500
19743 @@ -44,6 +44,7 @@ ifeq ($(CONFIG_X86_32),y)
19744 else
19745 BITS := 64
19746 UTS_MACHINE := x86_64
19747 + biarch := $(call cc-option,-m64)
19748 CHECKFLAGS += -D__x86_64__ -m64
19749
19750 KBUILD_AFLAGS += -m64
19751 @@ -195,3 +196,12 @@ define archhelp
19752 echo ' FDARGS="..." arguments for the booted kernel'
19753 echo ' FDINITRD=file initrd for the booted kernel'
19754 endef
19755 +
19756 +define OLD_LD
19757 +
19758 +*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
19759 +*** Please upgrade your binutils to 2.18 or newer
19760 +endef
19761 +
19762 +archprepare:
19763 + $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
19764 diff -urNp linux-3.0.9/arch/x86/mm/extable.c linux-3.0.9/arch/x86/mm/extable.c
19765 --- linux-3.0.9/arch/x86/mm/extable.c 2011-11-11 13:12:24.000000000 -0500
19766 +++ linux-3.0.9/arch/x86/mm/extable.c 2011-11-15 20:02:59.000000000 -0500
19767 @@ -8,7 +8,7 @@ int fixup_exception(struct pt_regs *regs
19768 const struct exception_table_entry *fixup;
19769
19770 #ifdef CONFIG_PNPBIOS
19771 - if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
19772 + if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
19773 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
19774 extern u32 pnp_bios_is_utter_crap;
19775 pnp_bios_is_utter_crap = 1;
19776 diff -urNp linux-3.0.9/arch/x86/mm/fault.c linux-3.0.9/arch/x86/mm/fault.c
19777 --- linux-3.0.9/arch/x86/mm/fault.c 2011-11-11 13:12:24.000000000 -0500
19778 +++ linux-3.0.9/arch/x86/mm/fault.c 2011-11-15 20:02:59.000000000 -0500
19779 @@ -13,10 +13,18 @@
19780 #include <linux/perf_event.h> /* perf_sw_event */
19781 #include <linux/hugetlb.h> /* hstate_index_to_shift */
19782 #include <linux/prefetch.h> /* prefetchw */
19783 +#include <linux/unistd.h>
19784 +#include <linux/compiler.h>
19785
19786 #include <asm/traps.h> /* dotraplinkage, ... */
19787 #include <asm/pgalloc.h> /* pgd_*(), ... */
19788 #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
19789 +#include <asm/vsyscall.h>
19790 +#include <asm/tlbflush.h>
19791 +
19792 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19793 +#include <asm/stacktrace.h>
19794 +#endif
19795
19796 /*
19797 * Page fault error code bits:
19798 @@ -54,7 +62,7 @@ static inline int __kprobes notify_page_
19799 int ret = 0;
19800
19801 /* kprobe_running() needs smp_processor_id() */
19802 - if (kprobes_built_in() && !user_mode_vm(regs)) {
19803 + if (kprobes_built_in() && !user_mode(regs)) {
19804 preempt_disable();
19805 if (kprobe_running() && kprobe_fault_handler(regs, 14))
19806 ret = 1;
19807 @@ -115,7 +123,10 @@ check_prefetch_opcode(struct pt_regs *re
19808 return !instr_lo || (instr_lo>>1) == 1;
19809 case 0x00:
19810 /* Prefetch instruction is 0x0F0D or 0x0F18 */
19811 - if (probe_kernel_address(instr, opcode))
19812 + if (user_mode(regs)) {
19813 + if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
19814 + return 0;
19815 + } else if (probe_kernel_address(instr, opcode))
19816 return 0;
19817
19818 *prefetch = (instr_lo == 0xF) &&
19819 @@ -149,7 +160,10 @@ is_prefetch(struct pt_regs *regs, unsign
19820 while (instr < max_instr) {
19821 unsigned char opcode;
19822
19823 - if (probe_kernel_address(instr, opcode))
19824 + if (user_mode(regs)) {
19825 + if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
19826 + break;
19827 + } else if (probe_kernel_address(instr, opcode))
19828 break;
19829
19830 instr++;
19831 @@ -180,6 +194,30 @@ force_sig_info_fault(int si_signo, int s
19832 force_sig_info(si_signo, &info, tsk);
19833 }
19834
19835 +#ifdef CONFIG_PAX_EMUTRAMP
19836 +static int pax_handle_fetch_fault(struct pt_regs *regs);
19837 +#endif
19838 +
19839 +#ifdef CONFIG_PAX_PAGEEXEC
19840 +static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
19841 +{
19842 + pgd_t *pgd;
19843 + pud_t *pud;
19844 + pmd_t *pmd;
19845 +
19846 + pgd = pgd_offset(mm, address);
19847 + if (!pgd_present(*pgd))
19848 + return NULL;
19849 + pud = pud_offset(pgd, address);
19850 + if (!pud_present(*pud))
19851 + return NULL;
19852 + pmd = pmd_offset(pud, address);
19853 + if (!pmd_present(*pmd))
19854 + return NULL;
19855 + return pmd;
19856 +}
19857 +#endif
19858 +
19859 DEFINE_SPINLOCK(pgd_lock);
19860 LIST_HEAD(pgd_list);
19861
19862 @@ -230,10 +268,22 @@ void vmalloc_sync_all(void)
19863 for (address = VMALLOC_START & PMD_MASK;
19864 address >= TASK_SIZE && address < FIXADDR_TOP;
19865 address += PMD_SIZE) {
19866 +
19867 +#ifdef CONFIG_PAX_PER_CPU_PGD
19868 + unsigned long cpu;
19869 +#else
19870 struct page *page;
19871 +#endif
19872
19873 spin_lock(&pgd_lock);
19874 +
19875 +#ifdef CONFIG_PAX_PER_CPU_PGD
19876 + for (cpu = 0; cpu < NR_CPUS; ++cpu) {
19877 + pgd_t *pgd = get_cpu_pgd(cpu);
19878 + pmd_t *ret;
19879 +#else
19880 list_for_each_entry(page, &pgd_list, lru) {
19881 + pgd_t *pgd = page_address(page);
19882 spinlock_t *pgt_lock;
19883 pmd_t *ret;
19884
19885 @@ -241,8 +291,13 @@ void vmalloc_sync_all(void)
19886 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
19887
19888 spin_lock(pgt_lock);
19889 - ret = vmalloc_sync_one(page_address(page), address);
19890 +#endif
19891 +
19892 + ret = vmalloc_sync_one(pgd, address);
19893 +
19894 +#ifndef CONFIG_PAX_PER_CPU_PGD
19895 spin_unlock(pgt_lock);
19896 +#endif
19897
19898 if (!ret)
19899 break;
19900 @@ -276,6 +331,11 @@ static noinline __kprobes int vmalloc_fa
19901 * an interrupt in the middle of a task switch..
19902 */
19903 pgd_paddr = read_cr3();
19904 +
19905 +#ifdef CONFIG_PAX_PER_CPU_PGD
19906 + BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
19907 +#endif
19908 +
19909 pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
19910 if (!pmd_k)
19911 return -1;
19912 @@ -371,7 +431,14 @@ static noinline __kprobes int vmalloc_fa
19913 * happen within a race in page table update. In the later
19914 * case just flush:
19915 */
19916 +
19917 +#ifdef CONFIG_PAX_PER_CPU_PGD
19918 + BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
19919 + pgd = pgd_offset_cpu(smp_processor_id(), address);
19920 +#else
19921 pgd = pgd_offset(current->active_mm, address);
19922 +#endif
19923 +
19924 pgd_ref = pgd_offset_k(address);
19925 if (pgd_none(*pgd_ref))
19926 return -1;
19927 @@ -533,7 +600,7 @@ static int is_errata93(struct pt_regs *r
19928 static int is_errata100(struct pt_regs *regs, unsigned long address)
19929 {
19930 #ifdef CONFIG_X86_64
19931 - if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
19932 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
19933 return 1;
19934 #endif
19935 return 0;
19936 @@ -560,7 +627,7 @@ static int is_f00f_bug(struct pt_regs *r
19937 }
19938
19939 static const char nx_warning[] = KERN_CRIT
19940 -"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
19941 +"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
19942
19943 static void
19944 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
19945 @@ -569,14 +636,25 @@ show_fault_oops(struct pt_regs *regs, un
19946 if (!oops_may_print())
19947 return;
19948
19949 - if (error_code & PF_INSTR) {
19950 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) {
19951 unsigned int level;
19952
19953 pte_t *pte = lookup_address(address, &level);
19954
19955 if (pte && pte_present(*pte) && !pte_exec(*pte))
19956 - printk(nx_warning, current_uid());
19957 + printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
19958 + }
19959 +
19960 +#ifdef CONFIG_PAX_KERNEXEC
19961 + if (init_mm.start_code <= address && address < init_mm.end_code) {
19962 + if (current->signal->curr_ip)
19963 + printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
19964 + &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
19965 + else
19966 + printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
19967 + current->comm, task_pid_nr(current), current_uid(), current_euid());
19968 }
19969 +#endif
19970
19971 printk(KERN_ALERT "BUG: unable to handle kernel ");
19972 if (address < PAGE_SIZE)
19973 @@ -702,6 +780,66 @@ __bad_area_nosemaphore(struct pt_regs *r
19974 unsigned long address, int si_code)
19975 {
19976 struct task_struct *tsk = current;
19977 +#if defined(CONFIG_X86_64) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
19978 + struct mm_struct *mm = tsk->mm;
19979 +#endif
19980 +
19981 +#ifdef CONFIG_X86_64
19982 + if (mm && (error_code & PF_INSTR) && mm->context.vdso) {
19983 + if (regs->ip == VSYSCALL_ADDR(__NR_vgettimeofday) ||
19984 + regs->ip == VSYSCALL_ADDR(__NR_vtime) ||
19985 + regs->ip == VSYSCALL_ADDR(__NR_vgetcpu)) {
19986 + regs->ip += mm->context.vdso - PAGE_SIZE - VSYSCALL_START;
19987 + return;
19988 + }
19989 + }
19990 +#endif
19991 +
19992 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
19993 + if (mm && (error_code & PF_USER)) {
19994 + unsigned long ip = regs->ip;
19995 +
19996 + if (v8086_mode(regs))
19997 + ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
19998 +
19999 + /*
20000 + * It's possible to have interrupts off here:
20001 + */
20002 + local_irq_enable();
20003 +
20004 +#ifdef CONFIG_PAX_PAGEEXEC
20005 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) &&
20006 + (((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && ip == address))) {
20007 +
20008 +#ifdef CONFIG_PAX_EMUTRAMP
20009 + switch (pax_handle_fetch_fault(regs)) {
20010 + case 2:
20011 + return;
20012 + }
20013 +#endif
20014 +
20015 + pax_report_fault(regs, (void *)ip, (void *)regs->sp);
20016 + do_group_exit(SIGKILL);
20017 + }
20018 +#endif
20019 +
20020 +#ifdef CONFIG_PAX_SEGMEXEC
20021 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address)) {
20022 +
20023 +#ifdef CONFIG_PAX_EMUTRAMP
20024 + switch (pax_handle_fetch_fault(regs)) {
20025 + case 2:
20026 + return;
20027 + }
20028 +#endif
20029 +
20030 + pax_report_fault(regs, (void *)ip, (void *)regs->sp);
20031 + do_group_exit(SIGKILL);
20032 + }
20033 +#endif
20034 +
20035 + }
20036 +#endif
20037
20038 /* User mode accesses just cause a SIGSEGV */
20039 if (error_code & PF_USER) {
20040 @@ -871,6 +1009,99 @@ static int spurious_fault_check(unsigned
20041 return 1;
20042 }
20043
20044 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
20045 +static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
20046 +{
20047 + pte_t *pte;
20048 + pmd_t *pmd;
20049 + spinlock_t *ptl;
20050 + unsigned char pte_mask;
20051 +
20052 + if ((__supported_pte_mask & _PAGE_NX) || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
20053 + !(mm->pax_flags & MF_PAX_PAGEEXEC))
20054 + return 0;
20055 +
20056 + /* PaX: it's our fault, let's handle it if we can */
20057 +
20058 + /* PaX: take a look at read faults before acquiring any locks */
20059 + if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
20060 + /* instruction fetch attempt from a protected page in user mode */
20061 + up_read(&mm->mmap_sem);
20062 +
20063 +#ifdef CONFIG_PAX_EMUTRAMP
20064 + switch (pax_handle_fetch_fault(regs)) {
20065 + case 2:
20066 + return 1;
20067 + }
20068 +#endif
20069 +
20070 + pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
20071 + do_group_exit(SIGKILL);
20072 + }
20073 +
20074 + pmd = pax_get_pmd(mm, address);
20075 + if (unlikely(!pmd))
20076 + return 0;
20077 +
20078 + pte = pte_offset_map_lock(mm, pmd, address, &ptl);
20079 + if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
20080 + pte_unmap_unlock(pte, ptl);
20081 + return 0;
20082 + }
20083 +
20084 + if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
20085 + /* write attempt to a protected page in user mode */
20086 + pte_unmap_unlock(pte, ptl);
20087 + return 0;
20088 + }
20089 +
20090 +#ifdef CONFIG_SMP
20091 + if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
20092 +#else
20093 + if (likely(address > get_limit(regs->cs)))
20094 +#endif
20095 + {
20096 + set_pte(pte, pte_mkread(*pte));
20097 + __flush_tlb_one(address);
20098 + pte_unmap_unlock(pte, ptl);
20099 + up_read(&mm->mmap_sem);
20100 + return 1;
20101 + }
20102 +
20103 + pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
20104 +
20105 + /*
20106 + * PaX: fill DTLB with user rights and retry
20107 + */
20108 + __asm__ __volatile__ (
20109 + "orb %2,(%1)\n"
20110 +#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
20111 +/*
20112 + * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
20113 + * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
20114 + * page fault when examined during a TLB load attempt. this is true not only
20115 + * for PTEs holding a non-present entry but also present entries that will
20116 + * raise a page fault (such as those set up by PaX, or the copy-on-write
20117 + * mechanism). in effect it means that we do *not* need to flush the TLBs
20118 + * for our target pages since their PTEs are simply not in the TLBs at all.
20119 +
20120 + * the best thing in omitting it is that we gain around 15-20% speed in the
20121 + * fast path of the page fault handler and can get rid of tracing since we
20122 + * can no longer flush unintended entries.
20123 + */
20124 + "invlpg (%0)\n"
20125 +#endif
20126 + __copyuser_seg"testb $0,(%0)\n"
20127 + "xorb %3,(%1)\n"
20128 + :
20129 + : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
20130 + : "memory", "cc");
20131 + pte_unmap_unlock(pte, ptl);
20132 + up_read(&mm->mmap_sem);
20133 + return 1;
20134 +}
20135 +#endif
20136 +
20137 /*
20138 * Handle a spurious fault caused by a stale TLB entry.
20139 *
20140 @@ -943,6 +1174,9 @@ int show_unhandled_signals = 1;
20141 static inline int
20142 access_error(unsigned long error_code, struct vm_area_struct *vma)
20143 {
20144 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
20145 + return 1;
20146 +
20147 if (error_code & PF_WRITE) {
20148 /* write, present and write, not present: */
20149 if (unlikely(!(vma->vm_flags & VM_WRITE)))
20150 @@ -976,19 +1210,33 @@ do_page_fault(struct pt_regs *regs, unsi
20151 {
20152 struct vm_area_struct *vma;
20153 struct task_struct *tsk;
20154 - unsigned long address;
20155 struct mm_struct *mm;
20156 int fault;
20157 int write = error_code & PF_WRITE;
20158 unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
20159 (write ? FAULT_FLAG_WRITE : 0);
20160
20161 + /* Get the faulting address: */
20162 + unsigned long address = read_cr2();
20163 +
20164 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20165 + if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
20166 + if (!search_exception_tables(regs->ip)) {
20167 + bad_area_nosemaphore(regs, error_code, address);
20168 + return;
20169 + }
20170 + if (address < PAX_USER_SHADOW_BASE) {
20171 + printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
20172 + printk(KERN_ERR "PAX: faulting IP: %pA\n", (void *)regs->ip);
20173 + show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
20174 + } else
20175 + address -= PAX_USER_SHADOW_BASE;
20176 + }
20177 +#endif
20178 +
20179 tsk = current;
20180 mm = tsk->mm;
20181
20182 - /* Get the faulting address: */
20183 - address = read_cr2();
20184 -
20185 /*
20186 * Detect and handle instructions that would cause a page fault for
20187 * both a tracked kernel page and a userspace page.
20188 @@ -1048,7 +1296,7 @@ do_page_fault(struct pt_regs *regs, unsi
20189 * User-mode registers count as a user access even for any
20190 * potential system fault or CPU buglet:
20191 */
20192 - if (user_mode_vm(regs)) {
20193 + if (user_mode(regs)) {
20194 local_irq_enable();
20195 error_code |= PF_USER;
20196 } else {
20197 @@ -1103,6 +1351,11 @@ retry:
20198 might_sleep();
20199 }
20200
20201 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
20202 + if (pax_handle_pageexec_fault(regs, mm, address, error_code))
20203 + return;
20204 +#endif
20205 +
20206 vma = find_vma(mm, address);
20207 if (unlikely(!vma)) {
20208 bad_area(regs, error_code, address);
20209 @@ -1114,18 +1367,24 @@ retry:
20210 bad_area(regs, error_code, address);
20211 return;
20212 }
20213 - if (error_code & PF_USER) {
20214 - /*
20215 - * Accessing the stack below %sp is always a bug.
20216 - * The large cushion allows instructions like enter
20217 - * and pusha to work. ("enter $65535, $31" pushes
20218 - * 32 pointers and then decrements %sp by 65535.)
20219 - */
20220 - if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
20221 - bad_area(regs, error_code, address);
20222 - return;
20223 - }
20224 + /*
20225 + * Accessing the stack below %sp is always a bug.
20226 + * The large cushion allows instructions like enter
20227 + * and pusha to work. ("enter $65535, $31" pushes
20228 + * 32 pointers and then decrements %sp by 65535.)
20229 + */
20230 + if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
20231 + bad_area(regs, error_code, address);
20232 + return;
20233 }
20234 +
20235 +#ifdef CONFIG_PAX_SEGMEXEC
20236 + if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
20237 + bad_area(regs, error_code, address);
20238 + return;
20239 + }
20240 +#endif
20241 +
20242 if (unlikely(expand_stack(vma, address))) {
20243 bad_area(regs, error_code, address);
20244 return;
20245 @@ -1180,3 +1439,199 @@ good_area:
20246
20247 up_read(&mm->mmap_sem);
20248 }
20249 +
20250 +#ifdef CONFIG_PAX_EMUTRAMP
20251 +static int pax_handle_fetch_fault_32(struct pt_regs *regs)
20252 +{
20253 + int err;
20254 +
20255 + do { /* PaX: gcc trampoline emulation #1 */
20256 + unsigned char mov1, mov2;
20257 + unsigned short jmp;
20258 + unsigned int addr1, addr2;
20259 +
20260 +#ifdef CONFIG_X86_64
20261 + if ((regs->ip + 11) >> 32)
20262 + break;
20263 +#endif
20264 +
20265 + err = get_user(mov1, (unsigned char __user *)regs->ip);
20266 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
20267 + err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
20268 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
20269 + err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
20270 +
20271 + if (err)
20272 + break;
20273 +
20274 + if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
20275 + regs->cx = addr1;
20276 + regs->ax = addr2;
20277 + regs->ip = addr2;
20278 + return 2;
20279 + }
20280 + } while (0);
20281 +
20282 + do { /* PaX: gcc trampoline emulation #2 */
20283 + unsigned char mov, jmp;
20284 + unsigned int addr1, addr2;
20285 +
20286 +#ifdef CONFIG_X86_64
20287 + if ((regs->ip + 9) >> 32)
20288 + break;
20289 +#endif
20290 +
20291 + err = get_user(mov, (unsigned char __user *)regs->ip);
20292 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
20293 + err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
20294 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
20295 +
20296 + if (err)
20297 + break;
20298 +
20299 + if (mov == 0xB9 && jmp == 0xE9) {
20300 + regs->cx = addr1;
20301 + regs->ip = (unsigned int)(regs->ip + addr2 + 10);
20302 + return 2;
20303 + }
20304 + } while (0);
20305 +
20306 + return 1; /* PaX in action */
20307 +}
20308 +
20309 +#ifdef CONFIG_X86_64
20310 +static int pax_handle_fetch_fault_64(struct pt_regs *regs)
20311 +{
20312 + int err;
20313 +
20314 + do { /* PaX: gcc trampoline emulation #1 */
20315 + unsigned short mov1, mov2, jmp1;
20316 + unsigned char jmp2;
20317 + unsigned int addr1;
20318 + unsigned long addr2;
20319 +
20320 + err = get_user(mov1, (unsigned short __user *)regs->ip);
20321 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
20322 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
20323 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
20324 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
20325 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
20326 +
20327 + if (err)
20328 + break;
20329 +
20330 + if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
20331 + regs->r11 = addr1;
20332 + regs->r10 = addr2;
20333 + regs->ip = addr1;
20334 + return 2;
20335 + }
20336 + } while (0);
20337 +
20338 + do { /* PaX: gcc trampoline emulation #2 */
20339 + unsigned short mov1, mov2, jmp1;
20340 + unsigned char jmp2;
20341 + unsigned long addr1, addr2;
20342 +
20343 + err = get_user(mov1, (unsigned short __user *)regs->ip);
20344 + err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
20345 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
20346 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
20347 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
20348 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
20349 +
20350 + if (err)
20351 + break;
20352 +
20353 + if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
20354 + regs->r11 = addr1;
20355 + regs->r10 = addr2;
20356 + regs->ip = addr1;
20357 + return 2;
20358 + }
20359 + } while (0);
20360 +
20361 + return 1; /* PaX in action */
20362 +}
20363 +#endif
20364 +
20365 +/*
20366 + * PaX: decide what to do with offenders (regs->ip = fault address)
20367 + *
20368 + * returns 1 when task should be killed
20369 + * 2 when gcc trampoline was detected
20370 + */
20371 +static int pax_handle_fetch_fault(struct pt_regs *regs)
20372 +{
20373 + if (v8086_mode(regs))
20374 + return 1;
20375 +
20376 + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
20377 + return 1;
20378 +
20379 +#ifdef CONFIG_X86_32
20380 + return pax_handle_fetch_fault_32(regs);
20381 +#else
20382 + if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
20383 + return pax_handle_fetch_fault_32(regs);
20384 + else
20385 + return pax_handle_fetch_fault_64(regs);
20386 +#endif
20387 +}
20388 +#endif
20389 +
20390 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
20391 +void pax_report_insns(void *pc, void *sp)
20392 +{
20393 + long i;
20394 +
20395 + printk(KERN_ERR "PAX: bytes at PC: ");
20396 + for (i = 0; i < 20; i++) {
20397 + unsigned char c;
20398 + if (get_user(c, (unsigned char __force_user *)pc+i))
20399 + printk(KERN_CONT "?? ");
20400 + else
20401 + printk(KERN_CONT "%02x ", c);
20402 + }
20403 + printk("\n");
20404 +
20405 + printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
20406 + for (i = -1; i < 80 / (long)sizeof(long); i++) {
20407 + unsigned long c;
20408 + if (get_user(c, (unsigned long __force_user *)sp+i))
20409 +#ifdef CONFIG_X86_32
20410 + printk(KERN_CONT "???????? ");
20411 +#else
20412 + printk(KERN_CONT "???????????????? ");
20413 +#endif
20414 + else
20415 + printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
20416 + }
20417 + printk("\n");
20418 +}
20419 +#endif
20420 +
20421 +/**
20422 + * probe_kernel_write(): safely attempt to write to a location
20423 + * @dst: address to write to
20424 + * @src: pointer to the data that shall be written
20425 + * @size: size of the data chunk
20426 + *
20427 + * Safely write to address @dst from the buffer at @src. If a kernel fault
20428 + * happens, handle that and return -EFAULT.
20429 + */
20430 +long notrace probe_kernel_write(void *dst, const void *src, size_t size)
20431 +{
20432 + long ret;
20433 + mm_segment_t old_fs = get_fs();
20434 +
20435 + set_fs(KERNEL_DS);
20436 + pagefault_disable();
20437 + pax_open_kernel();
20438 + ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
20439 + pax_close_kernel();
20440 + pagefault_enable();
20441 + set_fs(old_fs);
20442 +
20443 + return ret ? -EFAULT : 0;
20444 +}
20445 diff -urNp linux-3.0.9/arch/x86/mm/gup.c linux-3.0.9/arch/x86/mm/gup.c
20446 --- linux-3.0.9/arch/x86/mm/gup.c 2011-11-11 13:12:24.000000000 -0500
20447 +++ linux-3.0.9/arch/x86/mm/gup.c 2011-11-15 20:02:59.000000000 -0500
20448 @@ -253,7 +253,7 @@ int __get_user_pages_fast(unsigned long
20449 addr = start;
20450 len = (unsigned long) nr_pages << PAGE_SHIFT;
20451 end = start + len;
20452 - if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
20453 + if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
20454 (void __user *)start, len)))
20455 return 0;
20456
20457 diff -urNp linux-3.0.9/arch/x86/mm/highmem_32.c linux-3.0.9/arch/x86/mm/highmem_32.c
20458 --- linux-3.0.9/arch/x86/mm/highmem_32.c 2011-11-11 13:12:24.000000000 -0500
20459 +++ linux-3.0.9/arch/x86/mm/highmem_32.c 2011-11-15 20:02:59.000000000 -0500
20460 @@ -44,7 +44,10 @@ void *kmap_atomic_prot(struct page *page
20461 idx = type + KM_TYPE_NR*smp_processor_id();
20462 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
20463 BUG_ON(!pte_none(*(kmap_pte-idx)));
20464 +
20465 + pax_open_kernel();
20466 set_pte(kmap_pte-idx, mk_pte(page, prot));
20467 + pax_close_kernel();
20468
20469 return (void *)vaddr;
20470 }
20471 diff -urNp linux-3.0.9/arch/x86/mm/hugetlbpage.c linux-3.0.9/arch/x86/mm/hugetlbpage.c
20472 --- linux-3.0.9/arch/x86/mm/hugetlbpage.c 2011-11-11 13:12:24.000000000 -0500
20473 +++ linux-3.0.9/arch/x86/mm/hugetlbpage.c 2011-11-15 20:02:59.000000000 -0500
20474 @@ -266,13 +266,20 @@ static unsigned long hugetlb_get_unmappe
20475 struct hstate *h = hstate_file(file);
20476 struct mm_struct *mm = current->mm;
20477 struct vm_area_struct *vma;
20478 - unsigned long start_addr;
20479 + unsigned long start_addr, pax_task_size = TASK_SIZE;
20480 +
20481 +#ifdef CONFIG_PAX_SEGMEXEC
20482 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
20483 + pax_task_size = SEGMEXEC_TASK_SIZE;
20484 +#endif
20485 +
20486 + pax_task_size -= PAGE_SIZE;
20487
20488 if (len > mm->cached_hole_size) {
20489 - start_addr = mm->free_area_cache;
20490 + start_addr = mm->free_area_cache;
20491 } else {
20492 - start_addr = TASK_UNMAPPED_BASE;
20493 - mm->cached_hole_size = 0;
20494 + start_addr = mm->mmap_base;
20495 + mm->cached_hole_size = 0;
20496 }
20497
20498 full_search:
20499 @@ -280,26 +287,27 @@ full_search:
20500
20501 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
20502 /* At this point: (!vma || addr < vma->vm_end). */
20503 - if (TASK_SIZE - len < addr) {
20504 + if (pax_task_size - len < addr) {
20505 /*
20506 * Start a new search - just in case we missed
20507 * some holes.
20508 */
20509 - if (start_addr != TASK_UNMAPPED_BASE) {
20510 - start_addr = TASK_UNMAPPED_BASE;
20511 + if (start_addr != mm->mmap_base) {
20512 + start_addr = mm->mmap_base;
20513 mm->cached_hole_size = 0;
20514 goto full_search;
20515 }
20516 return -ENOMEM;
20517 }
20518 - if (!vma || addr + len <= vma->vm_start) {
20519 - mm->free_area_cache = addr + len;
20520 - return addr;
20521 - }
20522 + if (check_heap_stack_gap(vma, addr, len))
20523 + break;
20524 if (addr + mm->cached_hole_size < vma->vm_start)
20525 mm->cached_hole_size = vma->vm_start - addr;
20526 addr = ALIGN(vma->vm_end, huge_page_size(h));
20527 }
20528 +
20529 + mm->free_area_cache = addr + len;
20530 + return addr;
20531 }
20532
20533 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
20534 @@ -308,10 +316,9 @@ static unsigned long hugetlb_get_unmappe
20535 {
20536 struct hstate *h = hstate_file(file);
20537 struct mm_struct *mm = current->mm;
20538 - struct vm_area_struct *vma, *prev_vma;
20539 - unsigned long base = mm->mmap_base, addr = addr0;
20540 + struct vm_area_struct *vma;
20541 + unsigned long base = mm->mmap_base, addr;
20542 unsigned long largest_hole = mm->cached_hole_size;
20543 - int first_time = 1;
20544
20545 /* don't allow allocations above current base */
20546 if (mm->free_area_cache > base)
20547 @@ -321,64 +328,63 @@ static unsigned long hugetlb_get_unmappe
20548 largest_hole = 0;
20549 mm->free_area_cache = base;
20550 }
20551 -try_again:
20552 +
20553 /* make sure it can fit in the remaining address space */
20554 if (mm->free_area_cache < len)
20555 goto fail;
20556
20557 /* either no address requested or can't fit in requested address hole */
20558 - addr = (mm->free_area_cache - len) & huge_page_mask(h);
20559 + addr = (mm->free_area_cache - len);
20560 do {
20561 + addr &= huge_page_mask(h);
20562 + vma = find_vma(mm, addr);
20563 /*
20564 * Lookup failure means no vma is above this address,
20565 * i.e. return with success:
20566 - */
20567 - if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
20568 - return addr;
20569 -
20570 - /*
20571 * new region fits between prev_vma->vm_end and
20572 * vma->vm_start, use it:
20573 */
20574 - if (addr + len <= vma->vm_start &&
20575 - (!prev_vma || (addr >= prev_vma->vm_end))) {
20576 + if (check_heap_stack_gap(vma, addr, len)) {
20577 /* remember the address as a hint for next time */
20578 - mm->cached_hole_size = largest_hole;
20579 - return (mm->free_area_cache = addr);
20580 - } else {
20581 - /* pull free_area_cache down to the first hole */
20582 - if (mm->free_area_cache == vma->vm_end) {
20583 - mm->free_area_cache = vma->vm_start;
20584 - mm->cached_hole_size = largest_hole;
20585 - }
20586 + mm->cached_hole_size = largest_hole;
20587 + return (mm->free_area_cache = addr);
20588 + }
20589 + /* pull free_area_cache down to the first hole */
20590 + if (mm->free_area_cache == vma->vm_end) {
20591 + mm->free_area_cache = vma->vm_start;
20592 + mm->cached_hole_size = largest_hole;
20593 }
20594
20595 /* remember the largest hole we saw so far */
20596 if (addr + largest_hole < vma->vm_start)
20597 - largest_hole = vma->vm_start - addr;
20598 + largest_hole = vma->vm_start - addr;
20599
20600 /* try just below the current vma->vm_start */
20601 - addr = (vma->vm_start - len) & huge_page_mask(h);
20602 - } while (len <= vma->vm_start);
20603 + addr = skip_heap_stack_gap(vma, len);
20604 + } while (!IS_ERR_VALUE(addr));
20605
20606 fail:
20607 /*
20608 - * if hint left us with no space for the requested
20609 - * mapping then try again:
20610 - */
20611 - if (first_time) {
20612 - mm->free_area_cache = base;
20613 - largest_hole = 0;
20614 - first_time = 0;
20615 - goto try_again;
20616 - }
20617 - /*
20618 * A failed mmap() very likely causes application failure,
20619 * so fall back to the bottom-up function here. This scenario
20620 * can happen with large stack limits and large mmap()
20621 * allocations.
20622 */
20623 - mm->free_area_cache = TASK_UNMAPPED_BASE;
20624 +
20625 +#ifdef CONFIG_PAX_SEGMEXEC
20626 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
20627 + mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
20628 + else
20629 +#endif
20630 +
20631 + mm->mmap_base = TASK_UNMAPPED_BASE;
20632 +
20633 +#ifdef CONFIG_PAX_RANDMMAP
20634 + if (mm->pax_flags & MF_PAX_RANDMMAP)
20635 + mm->mmap_base += mm->delta_mmap;
20636 +#endif
20637 +
20638 + mm->free_area_cache = mm->mmap_base;
20639 mm->cached_hole_size = ~0UL;
20640 addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
20641 len, pgoff, flags);
20642 @@ -386,6 +392,7 @@ fail:
20643 /*
20644 * Restore the topdown base:
20645 */
20646 + mm->mmap_base = base;
20647 mm->free_area_cache = base;
20648 mm->cached_hole_size = ~0UL;
20649
20650 @@ -399,10 +406,19 @@ hugetlb_get_unmapped_area(struct file *f
20651 struct hstate *h = hstate_file(file);
20652 struct mm_struct *mm = current->mm;
20653 struct vm_area_struct *vma;
20654 + unsigned long pax_task_size = TASK_SIZE;
20655
20656 if (len & ~huge_page_mask(h))
20657 return -EINVAL;
20658 - if (len > TASK_SIZE)
20659 +
20660 +#ifdef CONFIG_PAX_SEGMEXEC
20661 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
20662 + pax_task_size = SEGMEXEC_TASK_SIZE;
20663 +#endif
20664 +
20665 + pax_task_size -= PAGE_SIZE;
20666 +
20667 + if (len > pax_task_size)
20668 return -ENOMEM;
20669
20670 if (flags & MAP_FIXED) {
20671 @@ -414,8 +430,7 @@ hugetlb_get_unmapped_area(struct file *f
20672 if (addr) {
20673 addr = ALIGN(addr, huge_page_size(h));
20674 vma = find_vma(mm, addr);
20675 - if (TASK_SIZE - len >= addr &&
20676 - (!vma || addr + len <= vma->vm_start))
20677 + if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
20678 return addr;
20679 }
20680 if (mm->get_unmapped_area == arch_get_unmapped_area)
20681 diff -urNp linux-3.0.9/arch/x86/mm/init_32.c linux-3.0.9/arch/x86/mm/init_32.c
20682 --- linux-3.0.9/arch/x86/mm/init_32.c 2011-11-11 13:12:24.000000000 -0500
20683 +++ linux-3.0.9/arch/x86/mm/init_32.c 2011-11-15 20:02:59.000000000 -0500
20684 @@ -74,36 +74,6 @@ static __init void *alloc_low_page(void)
20685 }
20686
20687 /*
20688 - * Creates a middle page table and puts a pointer to it in the
20689 - * given global directory entry. This only returns the gd entry
20690 - * in non-PAE compilation mode, since the middle layer is folded.
20691 - */
20692 -static pmd_t * __init one_md_table_init(pgd_t *pgd)
20693 -{
20694 - pud_t *pud;
20695 - pmd_t *pmd_table;
20696 -
20697 -#ifdef CONFIG_X86_PAE
20698 - if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
20699 - if (after_bootmem)
20700 - pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
20701 - else
20702 - pmd_table = (pmd_t *)alloc_low_page();
20703 - paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
20704 - set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
20705 - pud = pud_offset(pgd, 0);
20706 - BUG_ON(pmd_table != pmd_offset(pud, 0));
20707 -
20708 - return pmd_table;
20709 - }
20710 -#endif
20711 - pud = pud_offset(pgd, 0);
20712 - pmd_table = pmd_offset(pud, 0);
20713 -
20714 - return pmd_table;
20715 -}
20716 -
20717 -/*
20718 * Create a page table and place a pointer to it in a middle page
20719 * directory entry:
20720 */
20721 @@ -123,13 +93,28 @@ static pte_t * __init one_page_table_ini
20722 page_table = (pte_t *)alloc_low_page();
20723
20724 paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
20725 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
20726 + set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
20727 +#else
20728 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
20729 +#endif
20730 BUG_ON(page_table != pte_offset_kernel(pmd, 0));
20731 }
20732
20733 return pte_offset_kernel(pmd, 0);
20734 }
20735
20736 +static pmd_t * __init one_md_table_init(pgd_t *pgd)
20737 +{
20738 + pud_t *pud;
20739 + pmd_t *pmd_table;
20740 +
20741 + pud = pud_offset(pgd, 0);
20742 + pmd_table = pmd_offset(pud, 0);
20743 +
20744 + return pmd_table;
20745 +}
20746 +
20747 pmd_t * __init populate_extra_pmd(unsigned long vaddr)
20748 {
20749 int pgd_idx = pgd_index(vaddr);
20750 @@ -203,6 +188,7 @@ page_table_range_init(unsigned long star
20751 int pgd_idx, pmd_idx;
20752 unsigned long vaddr;
20753 pgd_t *pgd;
20754 + pud_t *pud;
20755 pmd_t *pmd;
20756 pte_t *pte = NULL;
20757
20758 @@ -212,8 +198,13 @@ page_table_range_init(unsigned long star
20759 pgd = pgd_base + pgd_idx;
20760
20761 for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
20762 - pmd = one_md_table_init(pgd);
20763 - pmd = pmd + pmd_index(vaddr);
20764 + pud = pud_offset(pgd, vaddr);
20765 + pmd = pmd_offset(pud, vaddr);
20766 +
20767 +#ifdef CONFIG_X86_PAE
20768 + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
20769 +#endif
20770 +
20771 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
20772 pmd++, pmd_idx++) {
20773 pte = page_table_kmap_check(one_page_table_init(pmd),
20774 @@ -225,11 +216,20 @@ page_table_range_init(unsigned long star
20775 }
20776 }
20777
20778 -static inline int is_kernel_text(unsigned long addr)
20779 +static inline int is_kernel_text(unsigned long start, unsigned long end)
20780 {
20781 - if (addr >= (unsigned long)_text && addr <= (unsigned long)__init_end)
20782 - return 1;
20783 - return 0;
20784 + if ((start > ktla_ktva((unsigned long)_etext) ||
20785 + end <= ktla_ktva((unsigned long)_stext)) &&
20786 + (start > ktla_ktva((unsigned long)_einittext) ||
20787 + end <= ktla_ktva((unsigned long)_sinittext)) &&
20788 +
20789 +#ifdef CONFIG_ACPI_SLEEP
20790 + (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
20791 +#endif
20792 +
20793 + (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
20794 + return 0;
20795 + return 1;
20796 }
20797
20798 /*
20799 @@ -246,9 +246,10 @@ kernel_physical_mapping_init(unsigned lo
20800 unsigned long last_map_addr = end;
20801 unsigned long start_pfn, end_pfn;
20802 pgd_t *pgd_base = swapper_pg_dir;
20803 - int pgd_idx, pmd_idx, pte_ofs;
20804 + unsigned int pgd_idx, pmd_idx, pte_ofs;
20805 unsigned long pfn;
20806 pgd_t *pgd;
20807 + pud_t *pud;
20808 pmd_t *pmd;
20809 pte_t *pte;
20810 unsigned pages_2m, pages_4k;
20811 @@ -281,8 +282,13 @@ repeat:
20812 pfn = start_pfn;
20813 pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
20814 pgd = pgd_base + pgd_idx;
20815 - for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
20816 - pmd = one_md_table_init(pgd);
20817 + for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
20818 + pud = pud_offset(pgd, 0);
20819 + pmd = pmd_offset(pud, 0);
20820 +
20821 +#ifdef CONFIG_X86_PAE
20822 + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
20823 +#endif
20824
20825 if (pfn >= end_pfn)
20826 continue;
20827 @@ -294,14 +300,13 @@ repeat:
20828 #endif
20829 for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
20830 pmd++, pmd_idx++) {
20831 - unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
20832 + unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
20833
20834 /*
20835 * Map with big pages if possible, otherwise
20836 * create normal page tables:
20837 */
20838 if (use_pse) {
20839 - unsigned int addr2;
20840 pgprot_t prot = PAGE_KERNEL_LARGE;
20841 /*
20842 * first pass will use the same initial
20843 @@ -311,11 +316,7 @@ repeat:
20844 __pgprot(PTE_IDENT_ATTR |
20845 _PAGE_PSE);
20846
20847 - addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
20848 - PAGE_OFFSET + PAGE_SIZE-1;
20849 -
20850 - if (is_kernel_text(addr) ||
20851 - is_kernel_text(addr2))
20852 + if (is_kernel_text(address, address + PMD_SIZE))
20853 prot = PAGE_KERNEL_LARGE_EXEC;
20854
20855 pages_2m++;
20856 @@ -332,7 +333,7 @@ repeat:
20857 pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
20858 pte += pte_ofs;
20859 for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
20860 - pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
20861 + pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
20862 pgprot_t prot = PAGE_KERNEL;
20863 /*
20864 * first pass will use the same initial
20865 @@ -340,7 +341,7 @@ repeat:
20866 */
20867 pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
20868
20869 - if (is_kernel_text(addr))
20870 + if (is_kernel_text(address, address + PAGE_SIZE))
20871 prot = PAGE_KERNEL_EXEC;
20872
20873 pages_4k++;
20874 @@ -472,7 +473,7 @@ void __init native_pagetable_setup_start
20875
20876 pud = pud_offset(pgd, va);
20877 pmd = pmd_offset(pud, va);
20878 - if (!pmd_present(*pmd))
20879 + if (!pmd_present(*pmd) || pmd_huge(*pmd))
20880 break;
20881
20882 pte = pte_offset_kernel(pmd, va);
20883 @@ -524,12 +525,10 @@ void __init early_ioremap_page_table_ran
20884
20885 static void __init pagetable_init(void)
20886 {
20887 - pgd_t *pgd_base = swapper_pg_dir;
20888 -
20889 - permanent_kmaps_init(pgd_base);
20890 + permanent_kmaps_init(swapper_pg_dir);
20891 }
20892
20893 -pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
20894 +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
20895 EXPORT_SYMBOL_GPL(__supported_pte_mask);
20896
20897 /* user-defined highmem size */
20898 @@ -757,6 +756,12 @@ void __init mem_init(void)
20899
20900 pci_iommu_alloc();
20901
20902 +#ifdef CONFIG_PAX_PER_CPU_PGD
20903 + clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
20904 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
20905 + KERNEL_PGD_PTRS);
20906 +#endif
20907 +
20908 #ifdef CONFIG_FLATMEM
20909 BUG_ON(!mem_map);
20910 #endif
20911 @@ -774,7 +779,7 @@ void __init mem_init(void)
20912 set_highmem_pages_init();
20913
20914 codesize = (unsigned long) &_etext - (unsigned long) &_text;
20915 - datasize = (unsigned long) &_edata - (unsigned long) &_etext;
20916 + datasize = (unsigned long) &_edata - (unsigned long) &_sdata;
20917 initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
20918
20919 printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
20920 @@ -815,10 +820,10 @@ void __init mem_init(void)
20921 ((unsigned long)&__init_end -
20922 (unsigned long)&__init_begin) >> 10,
20923
20924 - (unsigned long)&_etext, (unsigned long)&_edata,
20925 - ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
20926 + (unsigned long)&_sdata, (unsigned long)&_edata,
20927 + ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
20928
20929 - (unsigned long)&_text, (unsigned long)&_etext,
20930 + ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
20931 ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
20932
20933 /*
20934 @@ -896,6 +901,7 @@ void set_kernel_text_rw(void)
20935 if (!kernel_set_to_readonly)
20936 return;
20937
20938 + start = ktla_ktva(start);
20939 pr_debug("Set kernel text: %lx - %lx for read write\n",
20940 start, start+size);
20941
20942 @@ -910,6 +916,7 @@ void set_kernel_text_ro(void)
20943 if (!kernel_set_to_readonly)
20944 return;
20945
20946 + start = ktla_ktva(start);
20947 pr_debug("Set kernel text: %lx - %lx for read only\n",
20948 start, start+size);
20949
20950 @@ -938,6 +945,7 @@ void mark_rodata_ro(void)
20951 unsigned long start = PFN_ALIGN(_text);
20952 unsigned long size = PFN_ALIGN(_etext) - start;
20953
20954 + start = ktla_ktva(start);
20955 set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
20956 printk(KERN_INFO "Write protecting the kernel text: %luk\n",
20957 size >> 10);
20958 diff -urNp linux-3.0.9/arch/x86/mm/init_64.c linux-3.0.9/arch/x86/mm/init_64.c
20959 --- linux-3.0.9/arch/x86/mm/init_64.c 2011-11-11 13:12:24.000000000 -0500
20960 +++ linux-3.0.9/arch/x86/mm/init_64.c 2011-11-15 20:02:59.000000000 -0500
20961 @@ -75,7 +75,7 @@ early_param("gbpages", parse_direct_gbpa
20962 * around without checking the pgd every time.
20963 */
20964
20965 -pteval_t __supported_pte_mask __read_mostly = ~_PAGE_IOMAP;
20966 +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_IOMAP);
20967 EXPORT_SYMBOL_GPL(__supported_pte_mask);
20968
20969 int force_personality32;
20970 @@ -108,12 +108,22 @@ void sync_global_pgds(unsigned long star
20971
20972 for (address = start; address <= end; address += PGDIR_SIZE) {
20973 const pgd_t *pgd_ref = pgd_offset_k(address);
20974 +
20975 +#ifdef CONFIG_PAX_PER_CPU_PGD
20976 + unsigned long cpu;
20977 +#else
20978 struct page *page;
20979 +#endif
20980
20981 if (pgd_none(*pgd_ref))
20982 continue;
20983
20984 spin_lock(&pgd_lock);
20985 +
20986 +#ifdef CONFIG_PAX_PER_CPU_PGD
20987 + for (cpu = 0; cpu < NR_CPUS; ++cpu) {
20988 + pgd_t *pgd = pgd_offset_cpu(cpu, address);
20989 +#else
20990 list_for_each_entry(page, &pgd_list, lru) {
20991 pgd_t *pgd;
20992 spinlock_t *pgt_lock;
20993 @@ -122,6 +132,7 @@ void sync_global_pgds(unsigned long star
20994 /* the pgt_lock only for Xen */
20995 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
20996 spin_lock(pgt_lock);
20997 +#endif
20998
20999 if (pgd_none(*pgd))
21000 set_pgd(pgd, *pgd_ref);
21001 @@ -129,7 +140,10 @@ void sync_global_pgds(unsigned long star
21002 BUG_ON(pgd_page_vaddr(*pgd)
21003 != pgd_page_vaddr(*pgd_ref));
21004
21005 +#ifndef CONFIG_PAX_PER_CPU_PGD
21006 spin_unlock(pgt_lock);
21007 +#endif
21008 +
21009 }
21010 spin_unlock(&pgd_lock);
21011 }
21012 @@ -203,7 +217,9 @@ void set_pte_vaddr_pud(pud_t *pud_page,
21013 pmd = fill_pmd(pud, vaddr);
21014 pte = fill_pte(pmd, vaddr);
21015
21016 + pax_open_kernel();
21017 set_pte(pte, new_pte);
21018 + pax_close_kernel();
21019
21020 /*
21021 * It's enough to flush this one mapping.
21022 @@ -262,14 +278,12 @@ static void __init __init_extra_mapping(
21023 pgd = pgd_offset_k((unsigned long)__va(phys));
21024 if (pgd_none(*pgd)) {
21025 pud = (pud_t *) spp_getpage();
21026 - set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
21027 - _PAGE_USER));
21028 + set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
21029 }
21030 pud = pud_offset(pgd, (unsigned long)__va(phys));
21031 if (pud_none(*pud)) {
21032 pmd = (pmd_t *) spp_getpage();
21033 - set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
21034 - _PAGE_USER));
21035 + set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
21036 }
21037 pmd = pmd_offset(pud, phys);
21038 BUG_ON(!pmd_none(*pmd));
21039 @@ -330,7 +344,7 @@ static __ref void *alloc_low_page(unsign
21040 if (pfn >= pgt_buf_top)
21041 panic("alloc_low_page: ran out of memory");
21042
21043 - adr = early_memremap(pfn * PAGE_SIZE, PAGE_SIZE);
21044 + adr = (void __force_kernel *)early_memremap(pfn * PAGE_SIZE, PAGE_SIZE);
21045 clear_page(adr);
21046 *phys = pfn * PAGE_SIZE;
21047 return adr;
21048 @@ -346,7 +360,7 @@ static __ref void *map_low_page(void *vi
21049
21050 phys = __pa(virt);
21051 left = phys & (PAGE_SIZE - 1);
21052 - adr = early_memremap(phys & PAGE_MASK, PAGE_SIZE);
21053 + adr = (void __force_kernel *)early_memremap(phys & PAGE_MASK, PAGE_SIZE);
21054 adr = (void *)(((unsigned long)adr) | left);
21055
21056 return adr;
21057 @@ -693,6 +707,12 @@ void __init mem_init(void)
21058
21059 pci_iommu_alloc();
21060
21061 +#ifdef CONFIG_PAX_PER_CPU_PGD
21062 + clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
21063 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
21064 + KERNEL_PGD_PTRS);
21065 +#endif
21066 +
21067 /* clear_bss() already clear the empty_zero_page */
21068
21069 reservedpages = 0;
21070 @@ -853,8 +873,8 @@ int kern_addr_valid(unsigned long addr)
21071 static struct vm_area_struct gate_vma = {
21072 .vm_start = VSYSCALL_START,
21073 .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
21074 - .vm_page_prot = PAGE_READONLY_EXEC,
21075 - .vm_flags = VM_READ | VM_EXEC
21076 + .vm_page_prot = PAGE_READONLY,
21077 + .vm_flags = VM_READ
21078 };
21079
21080 struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
21081 @@ -888,7 +908,7 @@ int in_gate_area_no_mm(unsigned long add
21082
21083 const char *arch_vma_name(struct vm_area_struct *vma)
21084 {
21085 - if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
21086 + if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
21087 return "[vdso]";
21088 if (vma == &gate_vma)
21089 return "[vsyscall]";
21090 diff -urNp linux-3.0.9/arch/x86/mm/init.c linux-3.0.9/arch/x86/mm/init.c
21091 --- linux-3.0.9/arch/x86/mm/init.c 2011-11-11 13:12:24.000000000 -0500
21092 +++ linux-3.0.9/arch/x86/mm/init.c 2011-11-15 20:02:59.000000000 -0500
21093 @@ -31,7 +31,7 @@ int direct_gbpages
21094 static void __init find_early_table_space(unsigned long end, int use_pse,
21095 int use_gbpages)
21096 {
21097 - unsigned long puds, pmds, ptes, tables, start = 0, good_end = end;
21098 + unsigned long puds, pmds, ptes, tables, start = 0x100000, good_end = end;
21099 phys_addr_t base;
21100
21101 puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
21102 @@ -312,12 +312,34 @@ unsigned long __init_refok init_memory_m
21103 */
21104 int devmem_is_allowed(unsigned long pagenr)
21105 {
21106 - if (pagenr <= 256)
21107 +#ifdef CONFIG_GRKERNSEC_KMEM
21108 + /* allow BDA */
21109 + if (!pagenr)
21110 + return 1;
21111 + /* allow EBDA */
21112 + if ((0x9f000 >> PAGE_SHIFT) == pagenr)
21113 + return 1;
21114 +#else
21115 + if (!pagenr)
21116 + return 1;
21117 +#ifdef CONFIG_VM86
21118 + if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
21119 + return 1;
21120 +#endif
21121 +#endif
21122 +
21123 + if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
21124 return 1;
21125 +#ifdef CONFIG_GRKERNSEC_KMEM
21126 + /* throw out everything else below 1MB */
21127 + if (pagenr <= 256)
21128 + return 0;
21129 +#endif
21130 if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
21131 return 0;
21132 if (!page_is_ram(pagenr))
21133 return 1;
21134 +
21135 return 0;
21136 }
21137
21138 @@ -372,6 +394,86 @@ void free_init_pages(char *what, unsigne
21139
21140 void free_initmem(void)
21141 {
21142 +
21143 +#ifdef CONFIG_PAX_KERNEXEC
21144 +#ifdef CONFIG_X86_32
21145 + /* PaX: limit KERNEL_CS to actual size */
21146 + unsigned long addr, limit;
21147 + struct desc_struct d;
21148 + int cpu;
21149 +
21150 + limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
21151 + limit = (limit - 1UL) >> PAGE_SHIFT;
21152 +
21153 + memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
21154 + for (cpu = 0; cpu < NR_CPUS; cpu++) {
21155 + pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
21156 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
21157 + }
21158 +
21159 + /* PaX: make KERNEL_CS read-only */
21160 + addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
21161 + if (!paravirt_enabled())
21162 + set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
21163 +/*
21164 + for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
21165 + pgd = pgd_offset_k(addr);
21166 + pud = pud_offset(pgd, addr);
21167 + pmd = pmd_offset(pud, addr);
21168 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
21169 + }
21170 +*/
21171 +#ifdef CONFIG_X86_PAE
21172 + set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
21173 +/*
21174 + for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
21175 + pgd = pgd_offset_k(addr);
21176 + pud = pud_offset(pgd, addr);
21177 + pmd = pmd_offset(pud, addr);
21178 + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
21179 + }
21180 +*/
21181 +#endif
21182 +
21183 +#ifdef CONFIG_MODULES
21184 + set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
21185 +#endif
21186 +
21187 +#else
21188 + pgd_t *pgd;
21189 + pud_t *pud;
21190 + pmd_t *pmd;
21191 + unsigned long addr, end;
21192 +
21193 + /* PaX: make kernel code/rodata read-only, rest non-executable */
21194 + for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
21195 + pgd = pgd_offset_k(addr);
21196 + pud = pud_offset(pgd, addr);
21197 + pmd = pmd_offset(pud, addr);
21198 + if (!pmd_present(*pmd))
21199 + continue;
21200 + if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
21201 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
21202 + else
21203 + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
21204 + }
21205 +
21206 + addr = (unsigned long)__va(__pa(__START_KERNEL_map));
21207 + end = addr + KERNEL_IMAGE_SIZE;
21208 + for (; addr < end; addr += PMD_SIZE) {
21209 + pgd = pgd_offset_k(addr);
21210 + pud = pud_offset(pgd, addr);
21211 + pmd = pmd_offset(pud, addr);
21212 + if (!pmd_present(*pmd))
21213 + continue;
21214 + if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
21215 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
21216 + }
21217 +#endif
21218 +
21219 + flush_tlb_all();
21220 +#endif
21221 +
21222 free_init_pages("unused kernel memory",
21223 (unsigned long)(&__init_begin),
21224 (unsigned long)(&__init_end));
21225 diff -urNp linux-3.0.9/arch/x86/mm/iomap_32.c linux-3.0.9/arch/x86/mm/iomap_32.c
21226 --- linux-3.0.9/arch/x86/mm/iomap_32.c 2011-11-11 13:12:24.000000000 -0500
21227 +++ linux-3.0.9/arch/x86/mm/iomap_32.c 2011-11-15 20:02:59.000000000 -0500
21228 @@ -64,7 +64,11 @@ void *kmap_atomic_prot_pfn(unsigned long
21229 type = kmap_atomic_idx_push();
21230 idx = type + KM_TYPE_NR * smp_processor_id();
21231 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
21232 +
21233 + pax_open_kernel();
21234 set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
21235 + pax_close_kernel();
21236 +
21237 arch_flush_lazy_mmu_mode();
21238
21239 return (void *)vaddr;
21240 diff -urNp linux-3.0.9/arch/x86/mm/ioremap.c linux-3.0.9/arch/x86/mm/ioremap.c
21241 --- linux-3.0.9/arch/x86/mm/ioremap.c 2011-11-11 13:12:24.000000000 -0500
21242 +++ linux-3.0.9/arch/x86/mm/ioremap.c 2011-11-15 20:02:59.000000000 -0500
21243 @@ -97,7 +97,7 @@ static void __iomem *__ioremap_caller(re
21244 for (pfn = phys_addr >> PAGE_SHIFT; pfn <= last_pfn; pfn++) {
21245 int is_ram = page_is_ram(pfn);
21246
21247 - if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
21248 + if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
21249 return NULL;
21250 WARN_ON_ONCE(is_ram);
21251 }
21252 @@ -344,7 +344,7 @@ static int __init early_ioremap_debug_se
21253 early_param("early_ioremap_debug", early_ioremap_debug_setup);
21254
21255 static __initdata int after_paging_init;
21256 -static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
21257 +static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
21258
21259 static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
21260 {
21261 @@ -381,8 +381,7 @@ void __init early_ioremap_init(void)
21262 slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
21263
21264 pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
21265 - memset(bm_pte, 0, sizeof(bm_pte));
21266 - pmd_populate_kernel(&init_mm, pmd, bm_pte);
21267 + pmd_populate_user(&init_mm, pmd, bm_pte);
21268
21269 /*
21270 * The boot-ioremap range spans multiple pmds, for which
21271 diff -urNp linux-3.0.9/arch/x86/mm/kmemcheck/kmemcheck.c linux-3.0.9/arch/x86/mm/kmemcheck/kmemcheck.c
21272 --- linux-3.0.9/arch/x86/mm/kmemcheck/kmemcheck.c 2011-11-11 13:12:24.000000000 -0500
21273 +++ linux-3.0.9/arch/x86/mm/kmemcheck/kmemcheck.c 2011-11-15 20:02:59.000000000 -0500
21274 @@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
21275 * memory (e.g. tracked pages)? For now, we need this to avoid
21276 * invoking kmemcheck for PnP BIOS calls.
21277 */
21278 - if (regs->flags & X86_VM_MASK)
21279 + if (v8086_mode(regs))
21280 return false;
21281 - if (regs->cs != __KERNEL_CS)
21282 + if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
21283 return false;
21284
21285 pte = kmemcheck_pte_lookup(address);
21286 diff -urNp linux-3.0.9/arch/x86/mm/mmap.c linux-3.0.9/arch/x86/mm/mmap.c
21287 --- linux-3.0.9/arch/x86/mm/mmap.c 2011-11-11 13:12:24.000000000 -0500
21288 +++ linux-3.0.9/arch/x86/mm/mmap.c 2011-11-15 20:02:59.000000000 -0500
21289 @@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
21290 * Leave an at least ~128 MB hole with possible stack randomization.
21291 */
21292 #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
21293 -#define MAX_GAP (TASK_SIZE/6*5)
21294 +#define MAX_GAP (pax_task_size/6*5)
21295
21296 /*
21297 * True on X86_32 or when emulating IA32 on X86_64
21298 @@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
21299 return rnd << PAGE_SHIFT;
21300 }
21301
21302 -static unsigned long mmap_base(void)
21303 +static unsigned long mmap_base(struct mm_struct *mm)
21304 {
21305 unsigned long gap = rlimit(RLIMIT_STACK);
21306 + unsigned long pax_task_size = TASK_SIZE;
21307 +
21308 +#ifdef CONFIG_PAX_SEGMEXEC
21309 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
21310 + pax_task_size = SEGMEXEC_TASK_SIZE;
21311 +#endif
21312
21313 if (gap < MIN_GAP)
21314 gap = MIN_GAP;
21315 else if (gap > MAX_GAP)
21316 gap = MAX_GAP;
21317
21318 - return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
21319 + return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
21320 }
21321
21322 /*
21323 * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
21324 * does, but not when emulating X86_32
21325 */
21326 -static unsigned long mmap_legacy_base(void)
21327 +static unsigned long mmap_legacy_base(struct mm_struct *mm)
21328 {
21329 - if (mmap_is_ia32())
21330 + if (mmap_is_ia32()) {
21331 +
21332 +#ifdef CONFIG_PAX_SEGMEXEC
21333 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
21334 + return SEGMEXEC_TASK_UNMAPPED_BASE;
21335 + else
21336 +#endif
21337 +
21338 return TASK_UNMAPPED_BASE;
21339 - else
21340 + } else
21341 return TASK_UNMAPPED_BASE + mmap_rnd();
21342 }
21343
21344 @@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo
21345 void arch_pick_mmap_layout(struct mm_struct *mm)
21346 {
21347 if (mmap_is_legacy()) {
21348 - mm->mmap_base = mmap_legacy_base();
21349 + mm->mmap_base = mmap_legacy_base(mm);
21350 +
21351 +#ifdef CONFIG_PAX_RANDMMAP
21352 + if (mm->pax_flags & MF_PAX_RANDMMAP)
21353 + mm->mmap_base += mm->delta_mmap;
21354 +#endif
21355 +
21356 mm->get_unmapped_area = arch_get_unmapped_area;
21357 mm->unmap_area = arch_unmap_area;
21358 } else {
21359 - mm->mmap_base = mmap_base();
21360 + mm->mmap_base = mmap_base(mm);
21361 +
21362 +#ifdef CONFIG_PAX_RANDMMAP
21363 + if (mm->pax_flags & MF_PAX_RANDMMAP)
21364 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
21365 +#endif
21366 +
21367 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
21368 mm->unmap_area = arch_unmap_area_topdown;
21369 }
21370 diff -urNp linux-3.0.9/arch/x86/mm/mmio-mod.c linux-3.0.9/arch/x86/mm/mmio-mod.c
21371 --- linux-3.0.9/arch/x86/mm/mmio-mod.c 2011-11-11 13:12:24.000000000 -0500
21372 +++ linux-3.0.9/arch/x86/mm/mmio-mod.c 2011-11-15 20:02:59.000000000 -0500
21373 @@ -195,7 +195,7 @@ static void pre(struct kmmio_probe *p, s
21374 break;
21375 default:
21376 {
21377 - unsigned char *ip = (unsigned char *)instptr;
21378 + unsigned char *ip = (unsigned char *)ktla_ktva(instptr);
21379 my_trace->opcode = MMIO_UNKNOWN_OP;
21380 my_trace->width = 0;
21381 my_trace->value = (*ip) << 16 | *(ip + 1) << 8 |
21382 @@ -235,7 +235,7 @@ static void post(struct kmmio_probe *p,
21383 static void ioremap_trace_core(resource_size_t offset, unsigned long size,
21384 void __iomem *addr)
21385 {
21386 - static atomic_t next_id;
21387 + static atomic_unchecked_t next_id;
21388 struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
21389 /* These are page-unaligned. */
21390 struct mmiotrace_map map = {
21391 @@ -259,7 +259,7 @@ static void ioremap_trace_core(resource_
21392 .private = trace
21393 },
21394 .phys = offset,
21395 - .id = atomic_inc_return(&next_id)
21396 + .id = atomic_inc_return_unchecked(&next_id)
21397 };
21398 map.map_id = trace->id;
21399
21400 diff -urNp linux-3.0.9/arch/x86/mm/pageattr.c linux-3.0.9/arch/x86/mm/pageattr.c
21401 --- linux-3.0.9/arch/x86/mm/pageattr.c 2011-11-11 13:12:24.000000000 -0500
21402 +++ linux-3.0.9/arch/x86/mm/pageattr.c 2011-11-15 20:02:59.000000000 -0500
21403 @@ -261,7 +261,7 @@ static inline pgprot_t static_protection
21404 */
21405 #ifdef CONFIG_PCI_BIOS
21406 if (pcibios_enabled && within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
21407 - pgprot_val(forbidden) |= _PAGE_NX;
21408 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
21409 #endif
21410
21411 /*
21412 @@ -269,9 +269,10 @@ static inline pgprot_t static_protection
21413 * Does not cover __inittext since that is gone later on. On
21414 * 64bit we do not enforce !NX on the low mapping
21415 */
21416 - if (within(address, (unsigned long)_text, (unsigned long)_etext))
21417 - pgprot_val(forbidden) |= _PAGE_NX;
21418 + if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
21419 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
21420
21421 +#ifdef CONFIG_DEBUG_RODATA
21422 /*
21423 * The .rodata section needs to be read-only. Using the pfn
21424 * catches all aliases.
21425 @@ -279,6 +280,7 @@ static inline pgprot_t static_protection
21426 if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
21427 __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
21428 pgprot_val(forbidden) |= _PAGE_RW;
21429 +#endif
21430
21431 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
21432 /*
21433 @@ -317,6 +319,13 @@ static inline pgprot_t static_protection
21434 }
21435 #endif
21436
21437 +#ifdef CONFIG_PAX_KERNEXEC
21438 + if (within(pfn, __pa((unsigned long)&_text), __pa((unsigned long)&_sdata))) {
21439 + pgprot_val(forbidden) |= _PAGE_RW;
21440 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
21441 + }
21442 +#endif
21443 +
21444 prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
21445
21446 return prot;
21447 @@ -369,23 +378,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
21448 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
21449 {
21450 /* change init_mm */
21451 + pax_open_kernel();
21452 set_pte_atomic(kpte, pte);
21453 +
21454 #ifdef CONFIG_X86_32
21455 if (!SHARED_KERNEL_PMD) {
21456 +
21457 +#ifdef CONFIG_PAX_PER_CPU_PGD
21458 + unsigned long cpu;
21459 +#else
21460 struct page *page;
21461 +#endif
21462
21463 +#ifdef CONFIG_PAX_PER_CPU_PGD
21464 + for (cpu = 0; cpu < NR_CPUS; ++cpu) {
21465 + pgd_t *pgd = get_cpu_pgd(cpu);
21466 +#else
21467 list_for_each_entry(page, &pgd_list, lru) {
21468 - pgd_t *pgd;
21469 + pgd_t *pgd = (pgd_t *)page_address(page);
21470 +#endif
21471 +
21472 pud_t *pud;
21473 pmd_t *pmd;
21474
21475 - pgd = (pgd_t *)page_address(page) + pgd_index(address);
21476 + pgd += pgd_index(address);
21477 pud = pud_offset(pgd, address);
21478 pmd = pmd_offset(pud, address);
21479 set_pte_atomic((pte_t *)pmd, pte);
21480 }
21481 }
21482 #endif
21483 + pax_close_kernel();
21484 }
21485
21486 static int
21487 diff -urNp linux-3.0.9/arch/x86/mm/pageattr-test.c linux-3.0.9/arch/x86/mm/pageattr-test.c
21488 --- linux-3.0.9/arch/x86/mm/pageattr-test.c 2011-11-11 13:12:24.000000000 -0500
21489 +++ linux-3.0.9/arch/x86/mm/pageattr-test.c 2011-11-15 20:02:59.000000000 -0500
21490 @@ -36,7 +36,7 @@ enum {
21491
21492 static int pte_testbit(pte_t pte)
21493 {
21494 - return pte_flags(pte) & _PAGE_UNUSED1;
21495 + return pte_flags(pte) & _PAGE_CPA_TEST;
21496 }
21497
21498 struct split_state {
21499 diff -urNp linux-3.0.9/arch/x86/mm/pat.c linux-3.0.9/arch/x86/mm/pat.c
21500 --- linux-3.0.9/arch/x86/mm/pat.c 2011-11-11 13:12:24.000000000 -0500
21501 +++ linux-3.0.9/arch/x86/mm/pat.c 2011-11-15 20:02:59.000000000 -0500
21502 @@ -361,7 +361,7 @@ int free_memtype(u64 start, u64 end)
21503
21504 if (!entry) {
21505 printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
21506 - current->comm, current->pid, start, end);
21507 + current->comm, task_pid_nr(current), start, end);
21508 return -EINVAL;
21509 }
21510
21511 @@ -492,8 +492,8 @@ static inline int range_is_allowed(unsig
21512 while (cursor < to) {
21513 if (!devmem_is_allowed(pfn)) {
21514 printk(KERN_INFO
21515 - "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
21516 - current->comm, from, to);
21517 + "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n",
21518 + current->comm, from, to, cursor);
21519 return 0;
21520 }
21521 cursor += PAGE_SIZE;
21522 @@ -557,7 +557,7 @@ int kernel_map_sync_memtype(u64 base, un
21523 printk(KERN_INFO
21524 "%s:%d ioremap_change_attr failed %s "
21525 "for %Lx-%Lx\n",
21526 - current->comm, current->pid,
21527 + current->comm, task_pid_nr(current),
21528 cattr_name(flags),
21529 base, (unsigned long long)(base + size));
21530 return -EINVAL;
21531 @@ -593,7 +593,7 @@ static int reserve_pfn_range(u64 paddr,
21532 if (want_flags != flags) {
21533 printk(KERN_WARNING
21534 "%s:%d map pfn RAM range req %s for %Lx-%Lx, got %s\n",
21535 - current->comm, current->pid,
21536 + current->comm, task_pid_nr(current),
21537 cattr_name(want_flags),
21538 (unsigned long long)paddr,
21539 (unsigned long long)(paddr + size),
21540 @@ -615,7 +615,7 @@ static int reserve_pfn_range(u64 paddr,
21541 free_memtype(paddr, paddr + size);
21542 printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
21543 " for %Lx-%Lx, got %s\n",
21544 - current->comm, current->pid,
21545 + current->comm, task_pid_nr(current),
21546 cattr_name(want_flags),
21547 (unsigned long long)paddr,
21548 (unsigned long long)(paddr + size),
21549 diff -urNp linux-3.0.9/arch/x86/mm/pf_in.c linux-3.0.9/arch/x86/mm/pf_in.c
21550 --- linux-3.0.9/arch/x86/mm/pf_in.c 2011-11-11 13:12:24.000000000 -0500
21551 +++ linux-3.0.9/arch/x86/mm/pf_in.c 2011-11-15 20:02:59.000000000 -0500
21552 @@ -148,7 +148,7 @@ enum reason_type get_ins_type(unsigned l
21553 int i;
21554 enum reason_type rv = OTHERS;
21555
21556 - p = (unsigned char *)ins_addr;
21557 + p = (unsigned char *)ktla_ktva(ins_addr);
21558 p += skip_prefix(p, &prf);
21559 p += get_opcode(p, &opcode);
21560
21561 @@ -168,7 +168,7 @@ static unsigned int get_ins_reg_width(un
21562 struct prefix_bits prf;
21563 int i;
21564
21565 - p = (unsigned char *)ins_addr;
21566 + p = (unsigned char *)ktla_ktva(ins_addr);
21567 p += skip_prefix(p, &prf);
21568 p += get_opcode(p, &opcode);
21569
21570 @@ -191,7 +191,7 @@ unsigned int get_ins_mem_width(unsigned
21571 struct prefix_bits prf;
21572 int i;
21573
21574 - p = (unsigned char *)ins_addr;
21575 + p = (unsigned char *)ktla_ktva(ins_addr);
21576 p += skip_prefix(p, &prf);
21577 p += get_opcode(p, &opcode);
21578
21579 @@ -415,7 +415,7 @@ unsigned long get_ins_reg_val(unsigned l
21580 struct prefix_bits prf;
21581 int i;
21582
21583 - p = (unsigned char *)ins_addr;
21584 + p = (unsigned char *)ktla_ktva(ins_addr);
21585 p += skip_prefix(p, &prf);
21586 p += get_opcode(p, &opcode);
21587 for (i = 0; i < ARRAY_SIZE(reg_rop); i++)
21588 @@ -470,7 +470,7 @@ unsigned long get_ins_imm_val(unsigned l
21589 struct prefix_bits prf;
21590 int i;
21591
21592 - p = (unsigned char *)ins_addr;
21593 + p = (unsigned char *)ktla_ktva(ins_addr);
21594 p += skip_prefix(p, &prf);
21595 p += get_opcode(p, &opcode);
21596 for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
21597 diff -urNp linux-3.0.9/arch/x86/mm/pgtable_32.c linux-3.0.9/arch/x86/mm/pgtable_32.c
21598 --- linux-3.0.9/arch/x86/mm/pgtable_32.c 2011-11-11 13:12:24.000000000 -0500
21599 +++ linux-3.0.9/arch/x86/mm/pgtable_32.c 2011-11-15 20:02:59.000000000 -0500
21600 @@ -48,10 +48,13 @@ void set_pte_vaddr(unsigned long vaddr,
21601 return;
21602 }
21603 pte = pte_offset_kernel(pmd, vaddr);
21604 +
21605 + pax_open_kernel();
21606 if (pte_val(pteval))
21607 set_pte_at(&init_mm, vaddr, pte, pteval);
21608 else
21609 pte_clear(&init_mm, vaddr, pte);
21610 + pax_close_kernel();
21611
21612 /*
21613 * It's enough to flush this one mapping.
21614 diff -urNp linux-3.0.9/arch/x86/mm/pgtable.c linux-3.0.9/arch/x86/mm/pgtable.c
21615 --- linux-3.0.9/arch/x86/mm/pgtable.c 2011-11-11 13:12:24.000000000 -0500
21616 +++ linux-3.0.9/arch/x86/mm/pgtable.c 2011-11-15 20:02:59.000000000 -0500
21617 @@ -84,10 +84,52 @@ static inline void pgd_list_del(pgd_t *p
21618 list_del(&page->lru);
21619 }
21620
21621 -#define UNSHARED_PTRS_PER_PGD \
21622 - (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
21623 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21624 +pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
21625
21626 +void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
21627 +{
21628 + while (count--)
21629 + *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
21630 +}
21631 +#endif
21632 +
21633 +#ifdef CONFIG_PAX_PER_CPU_PGD
21634 +void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
21635 +{
21636 + while (count--)
21637 +
21638 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21639 + *dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
21640 +#else
21641 + *dst++ = *src++;
21642 +#endif
21643
21644 +}
21645 +#endif
21646 +
21647 +#ifdef CONFIG_X86_64
21648 +#define pxd_t pud_t
21649 +#define pyd_t pgd_t
21650 +#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
21651 +#define pxd_free(mm, pud) pud_free((mm), (pud))
21652 +#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
21653 +#define pyd_offset(mm ,address) pgd_offset((mm), (address))
21654 +#define PYD_SIZE PGDIR_SIZE
21655 +#else
21656 +#define pxd_t pmd_t
21657 +#define pyd_t pud_t
21658 +#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
21659 +#define pxd_free(mm, pud) pmd_free((mm), (pud))
21660 +#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
21661 +#define pyd_offset(mm ,address) pud_offset((mm), (address))
21662 +#define PYD_SIZE PUD_SIZE
21663 +#endif
21664 +
21665 +#ifdef CONFIG_PAX_PER_CPU_PGD
21666 +static inline void pgd_ctor(struct mm_struct *mm, pgd_t *pgd) {}
21667 +static inline void pgd_dtor(pgd_t *pgd) {}
21668 +#else
21669 static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
21670 {
21671 BUILD_BUG_ON(sizeof(virt_to_page(pgd)->index) < sizeof(mm));
21672 @@ -128,6 +170,7 @@ static void pgd_dtor(pgd_t *pgd)
21673 pgd_list_del(pgd);
21674 spin_unlock(&pgd_lock);
21675 }
21676 +#endif
21677
21678 /*
21679 * List of all pgd's needed for non-PAE so it can invalidate entries
21680 @@ -140,7 +183,7 @@ static void pgd_dtor(pgd_t *pgd)
21681 * -- wli
21682 */
21683
21684 -#ifdef CONFIG_X86_PAE
21685 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
21686 /*
21687 * In PAE mode, we need to do a cr3 reload (=tlb flush) when
21688 * updating the top-level pagetable entries to guarantee the
21689 @@ -152,7 +195,7 @@ static void pgd_dtor(pgd_t *pgd)
21690 * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
21691 * and initialize the kernel pmds here.
21692 */
21693 -#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
21694 +#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
21695
21696 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
21697 {
21698 @@ -170,36 +213,38 @@ void pud_populate(struct mm_struct *mm,
21699 */
21700 flush_tlb_mm(mm);
21701 }
21702 +#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
21703 +#define PREALLOCATED_PXDS USER_PGD_PTRS
21704 #else /* !CONFIG_X86_PAE */
21705
21706 /* No need to prepopulate any pagetable entries in non-PAE modes. */
21707 -#define PREALLOCATED_PMDS 0
21708 +#define PREALLOCATED_PXDS 0
21709
21710 #endif /* CONFIG_X86_PAE */
21711
21712 -static void free_pmds(pmd_t *pmds[])
21713 +static void free_pxds(pxd_t *pxds[])
21714 {
21715 int i;
21716
21717 - for(i = 0; i < PREALLOCATED_PMDS; i++)
21718 - if (pmds[i])
21719 - free_page((unsigned long)pmds[i]);
21720 + for(i = 0; i < PREALLOCATED_PXDS; i++)
21721 + if (pxds[i])
21722 + free_page((unsigned long)pxds[i]);
21723 }
21724
21725 -static int preallocate_pmds(pmd_t *pmds[])
21726 +static int preallocate_pxds(pxd_t *pxds[])
21727 {
21728 int i;
21729 bool failed = false;
21730
21731 - for(i = 0; i < PREALLOCATED_PMDS; i++) {
21732 - pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
21733 - if (pmd == NULL)
21734 + for(i = 0; i < PREALLOCATED_PXDS; i++) {
21735 + pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
21736 + if (pxd == NULL)
21737 failed = true;
21738 - pmds[i] = pmd;
21739 + pxds[i] = pxd;
21740 }
21741
21742 if (failed) {
21743 - free_pmds(pmds);
21744 + free_pxds(pxds);
21745 return -ENOMEM;
21746 }
21747
21748 @@ -212,51 +257,55 @@ static int preallocate_pmds(pmd_t *pmds[
21749 * preallocate which never got a corresponding vma will need to be
21750 * freed manually.
21751 */
21752 -static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
21753 +static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
21754 {
21755 int i;
21756
21757 - for(i = 0; i < PREALLOCATED_PMDS; i++) {
21758 + for(i = 0; i < PREALLOCATED_PXDS; i++) {
21759 pgd_t pgd = pgdp[i];
21760
21761 if (pgd_val(pgd) != 0) {
21762 - pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
21763 + pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
21764
21765 - pgdp[i] = native_make_pgd(0);
21766 + set_pgd(pgdp + i, native_make_pgd(0));
21767
21768 - paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
21769 - pmd_free(mm, pmd);
21770 + paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
21771 + pxd_free(mm, pxd);
21772 }
21773 }
21774 }
21775
21776 -static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
21777 +static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
21778 {
21779 - pud_t *pud;
21780 + pyd_t *pyd;
21781 unsigned long addr;
21782 int i;
21783
21784 - if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
21785 + if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
21786 return;
21787
21788 - pud = pud_offset(pgd, 0);
21789 +#ifdef CONFIG_X86_64
21790 + pyd = pyd_offset(mm, 0L);
21791 +#else
21792 + pyd = pyd_offset(pgd, 0L);
21793 +#endif
21794
21795 - for (addr = i = 0; i < PREALLOCATED_PMDS;
21796 - i++, pud++, addr += PUD_SIZE) {
21797 - pmd_t *pmd = pmds[i];
21798 + for (addr = i = 0; i < PREALLOCATED_PXDS;
21799 + i++, pyd++, addr += PYD_SIZE) {
21800 + pxd_t *pxd = pxds[i];
21801
21802 if (i >= KERNEL_PGD_BOUNDARY)
21803 - memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
21804 - sizeof(pmd_t) * PTRS_PER_PMD);
21805 + memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
21806 + sizeof(pxd_t) * PTRS_PER_PMD);
21807
21808 - pud_populate(mm, pud, pmd);
21809 + pyd_populate(mm, pyd, pxd);
21810 }
21811 }
21812
21813 pgd_t *pgd_alloc(struct mm_struct *mm)
21814 {
21815 pgd_t *pgd;
21816 - pmd_t *pmds[PREALLOCATED_PMDS];
21817 + pxd_t *pxds[PREALLOCATED_PXDS];
21818
21819 pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
21820
21821 @@ -265,11 +314,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
21822
21823 mm->pgd = pgd;
21824
21825 - if (preallocate_pmds(pmds) != 0)
21826 + if (preallocate_pxds(pxds) != 0)
21827 goto out_free_pgd;
21828
21829 if (paravirt_pgd_alloc(mm) != 0)
21830 - goto out_free_pmds;
21831 + goto out_free_pxds;
21832
21833 /*
21834 * Make sure that pre-populating the pmds is atomic with
21835 @@ -279,14 +328,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
21836 spin_lock(&pgd_lock);
21837
21838 pgd_ctor(mm, pgd);
21839 - pgd_prepopulate_pmd(mm, pgd, pmds);
21840 + pgd_prepopulate_pxd(mm, pgd, pxds);
21841
21842 spin_unlock(&pgd_lock);
21843
21844 return pgd;
21845
21846 -out_free_pmds:
21847 - free_pmds(pmds);
21848 +out_free_pxds:
21849 + free_pxds(pxds);
21850 out_free_pgd:
21851 free_page((unsigned long)pgd);
21852 out:
21853 @@ -295,7 +344,7 @@ out:
21854
21855 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
21856 {
21857 - pgd_mop_up_pmds(mm, pgd);
21858 + pgd_mop_up_pxds(mm, pgd);
21859 pgd_dtor(pgd);
21860 paravirt_pgd_free(mm, pgd);
21861 free_page((unsigned long)pgd);
21862 diff -urNp linux-3.0.9/arch/x86/mm/setup_nx.c linux-3.0.9/arch/x86/mm/setup_nx.c
21863 --- linux-3.0.9/arch/x86/mm/setup_nx.c 2011-11-11 13:12:24.000000000 -0500
21864 +++ linux-3.0.9/arch/x86/mm/setup_nx.c 2011-11-15 20:02:59.000000000 -0500
21865 @@ -5,8 +5,10 @@
21866 #include <asm/pgtable.h>
21867 #include <asm/proto.h>
21868
21869 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
21870 static int disable_nx __cpuinitdata;
21871
21872 +#ifndef CONFIG_PAX_PAGEEXEC
21873 /*
21874 * noexec = on|off
21875 *
21876 @@ -28,12 +30,17 @@ static int __init noexec_setup(char *str
21877 return 0;
21878 }
21879 early_param("noexec", noexec_setup);
21880 +#endif
21881 +
21882 +#endif
21883
21884 void __cpuinit x86_configure_nx(void)
21885 {
21886 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
21887 if (cpu_has_nx && !disable_nx)
21888 __supported_pte_mask |= _PAGE_NX;
21889 else
21890 +#endif
21891 __supported_pte_mask &= ~_PAGE_NX;
21892 }
21893
21894 diff -urNp linux-3.0.9/arch/x86/mm/tlb.c linux-3.0.9/arch/x86/mm/tlb.c
21895 --- linux-3.0.9/arch/x86/mm/tlb.c 2011-11-11 13:12:24.000000000 -0500
21896 +++ linux-3.0.9/arch/x86/mm/tlb.c 2011-11-15 20:02:59.000000000 -0500
21897 @@ -65,7 +65,11 @@ void leave_mm(int cpu)
21898 BUG();
21899 cpumask_clear_cpu(cpu,
21900 mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
21901 +
21902 +#ifndef CONFIG_PAX_PER_CPU_PGD
21903 load_cr3(swapper_pg_dir);
21904 +#endif
21905 +
21906 }
21907 EXPORT_SYMBOL_GPL(leave_mm);
21908
21909 diff -urNp linux-3.0.9/arch/x86/net/bpf_jit_comp.c linux-3.0.9/arch/x86/net/bpf_jit_comp.c
21910 --- linux-3.0.9/arch/x86/net/bpf_jit_comp.c 2011-11-11 13:12:24.000000000 -0500
21911 +++ linux-3.0.9/arch/x86/net/bpf_jit_comp.c 2011-11-15 20:02:59.000000000 -0500
21912 @@ -589,7 +589,9 @@ cond_branch: f_offset = addrs[i + filt
21913 module_free(NULL, image);
21914 return;
21915 }
21916 + pax_open_kernel();
21917 memcpy(image + proglen, temp, ilen);
21918 + pax_close_kernel();
21919 }
21920 proglen += ilen;
21921 addrs[i] = proglen;
21922 @@ -609,7 +611,7 @@ cond_branch: f_offset = addrs[i + filt
21923 break;
21924 }
21925 if (proglen == oldproglen) {
21926 - image = module_alloc(max_t(unsigned int,
21927 + image = module_alloc_exec(max_t(unsigned int,
21928 proglen,
21929 sizeof(struct work_struct)));
21930 if (!image)
21931 diff -urNp linux-3.0.9/arch/x86/net/bpf_jit.S linux-3.0.9/arch/x86/net/bpf_jit.S
21932 --- linux-3.0.9/arch/x86/net/bpf_jit.S 2011-11-11 13:12:24.000000000 -0500
21933 +++ linux-3.0.9/arch/x86/net/bpf_jit.S 2011-11-15 20:02:59.000000000 -0500
21934 @@ -9,6 +9,7 @@
21935 */
21936 #include <linux/linkage.h>
21937 #include <asm/dwarf2.h>
21938 +#include <asm/alternative-asm.h>
21939
21940 /*
21941 * Calling convention :
21942 @@ -35,6 +36,7 @@ sk_load_word:
21943 jle bpf_slow_path_word
21944 mov (SKBDATA,%rsi),%eax
21945 bswap %eax /* ntohl() */
21946 + pax_force_retaddr
21947 ret
21948
21949
21950 @@ -53,6 +55,7 @@ sk_load_half:
21951 jle bpf_slow_path_half
21952 movzwl (SKBDATA,%rsi),%eax
21953 rol $8,%ax # ntohs()
21954 + pax_force_retaddr
21955 ret
21956
21957 sk_load_byte_ind:
21958 @@ -66,6 +69,7 @@ sk_load_byte:
21959 cmp %esi,%r9d /* if (offset >= hlen) goto bpf_slow_path_byte */
21960 jle bpf_slow_path_byte
21961 movzbl (SKBDATA,%rsi),%eax
21962 + pax_force_retaddr
21963 ret
21964
21965 /**
21966 @@ -82,6 +86,7 @@ ENTRY(sk_load_byte_msh)
21967 movzbl (SKBDATA,%rsi),%ebx
21968 and $15,%bl
21969 shl $2,%bl
21970 + pax_force_retaddr
21971 ret
21972 CFI_ENDPROC
21973 ENDPROC(sk_load_byte_msh)
21974 @@ -91,6 +96,7 @@ bpf_error:
21975 xor %eax,%eax
21976 mov -8(%rbp),%rbx
21977 leaveq
21978 + pax_force_retaddr
21979 ret
21980
21981 /* rsi contains offset and can be scratched */
21982 @@ -113,6 +119,7 @@ bpf_slow_path_word:
21983 js bpf_error
21984 mov -12(%rbp),%eax
21985 bswap %eax
21986 + pax_force_retaddr
21987 ret
21988
21989 bpf_slow_path_half:
21990 @@ -121,12 +128,14 @@ bpf_slow_path_half:
21991 mov -12(%rbp),%ax
21992 rol $8,%ax
21993 movzwl %ax,%eax
21994 + pax_force_retaddr
21995 ret
21996
21997 bpf_slow_path_byte:
21998 bpf_slow_path_common(1)
21999 js bpf_error
22000 movzbl -12(%rbp),%eax
22001 + pax_force_retaddr
22002 ret
22003
22004 bpf_slow_path_byte_msh:
22005 @@ -137,4 +146,5 @@ bpf_slow_path_byte_msh:
22006 and $15,%al
22007 shl $2,%al
22008 xchg %eax,%ebx
22009 + pax_force_retaddr
22010 ret
22011 diff -urNp linux-3.0.9/arch/x86/oprofile/backtrace.c linux-3.0.9/arch/x86/oprofile/backtrace.c
22012 --- linux-3.0.9/arch/x86/oprofile/backtrace.c 2011-11-11 13:12:24.000000000 -0500
22013 +++ linux-3.0.9/arch/x86/oprofile/backtrace.c 2011-11-15 20:02:59.000000000 -0500
22014 @@ -83,11 +83,11 @@ dump_user_backtrace_32(struct stack_fram
22015 struct stack_frame_ia32 *fp;
22016 unsigned long bytes;
22017
22018 - bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
22019 + bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead));
22020 if (bytes != sizeof(bufhead))
22021 return NULL;
22022
22023 - fp = (struct stack_frame_ia32 *) compat_ptr(bufhead[0].next_frame);
22024 + fp = (struct stack_frame_ia32 __force_kernel *) compat_ptr(bufhead[0].next_frame);
22025
22026 oprofile_add_trace(bufhead[0].return_address);
22027
22028 @@ -129,7 +129,7 @@ static struct stack_frame *dump_user_bac
22029 struct stack_frame bufhead[2];
22030 unsigned long bytes;
22031
22032 - bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
22033 + bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead));
22034 if (bytes != sizeof(bufhead))
22035 return NULL;
22036
22037 @@ -148,7 +148,7 @@ x86_backtrace(struct pt_regs * const reg
22038 {
22039 struct stack_frame *head = (struct stack_frame *)frame_pointer(regs);
22040
22041 - if (!user_mode_vm(regs)) {
22042 + if (!user_mode(regs)) {
22043 unsigned long stack = kernel_stack_pointer(regs);
22044 if (depth)
22045 dump_trace(NULL, regs, (unsigned long *)stack, 0,
22046 diff -urNp linux-3.0.9/arch/x86/pci/mrst.c linux-3.0.9/arch/x86/pci/mrst.c
22047 --- linux-3.0.9/arch/x86/pci/mrst.c 2011-11-11 13:12:24.000000000 -0500
22048 +++ linux-3.0.9/arch/x86/pci/mrst.c 2011-11-15 20:02:59.000000000 -0500
22049 @@ -234,7 +234,9 @@ int __init pci_mrst_init(void)
22050 printk(KERN_INFO "Moorestown platform detected, using MRST PCI ops\n");
22051 pci_mmcfg_late_init();
22052 pcibios_enable_irq = mrst_pci_irq_enable;
22053 - pci_root_ops = pci_mrst_ops;
22054 + pax_open_kernel();
22055 + memcpy((void *)&pci_root_ops, &pci_mrst_ops, sizeof(pci_mrst_ops));
22056 + pax_close_kernel();
22057 /* Continue with standard init */
22058 return 1;
22059 }
22060 diff -urNp linux-3.0.9/arch/x86/pci/pcbios.c linux-3.0.9/arch/x86/pci/pcbios.c
22061 --- linux-3.0.9/arch/x86/pci/pcbios.c 2011-11-11 13:12:24.000000000 -0500
22062 +++ linux-3.0.9/arch/x86/pci/pcbios.c 2011-11-15 20:02:59.000000000 -0500
22063 @@ -79,50 +79,93 @@ union bios32 {
22064 static struct {
22065 unsigned long address;
22066 unsigned short segment;
22067 -} bios32_indirect = { 0, __KERNEL_CS };
22068 +} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
22069
22070 /*
22071 * Returns the entry point for the given service, NULL on error
22072 */
22073
22074 -static unsigned long bios32_service(unsigned long service)
22075 +static unsigned long __devinit bios32_service(unsigned long service)
22076 {
22077 unsigned char return_code; /* %al */
22078 unsigned long address; /* %ebx */
22079 unsigned long length; /* %ecx */
22080 unsigned long entry; /* %edx */
22081 unsigned long flags;
22082 + struct desc_struct d, *gdt;
22083
22084 local_irq_save(flags);
22085 - __asm__("lcall *(%%edi); cld"
22086 +
22087 + gdt = get_cpu_gdt_table(smp_processor_id());
22088 +
22089 + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
22090 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
22091 + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
22092 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
22093 +
22094 + __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
22095 : "=a" (return_code),
22096 "=b" (address),
22097 "=c" (length),
22098 "=d" (entry)
22099 : "0" (service),
22100 "1" (0),
22101 - "D" (&bios32_indirect));
22102 + "D" (&bios32_indirect),
22103 + "r"(__PCIBIOS_DS)
22104 + : "memory");
22105 +
22106 + pax_open_kernel();
22107 + gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
22108 + gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
22109 + gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
22110 + gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
22111 + pax_close_kernel();
22112 +
22113 local_irq_restore(flags);
22114
22115 switch (return_code) {
22116 - case 0:
22117 - return address + entry;
22118 - case 0x80: /* Not present */
22119 - printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
22120 - return 0;
22121 - default: /* Shouldn't happen */
22122 - printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
22123 - service, return_code);
22124 + case 0: {
22125 + int cpu;
22126 + unsigned char flags;
22127 +
22128 + printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
22129 + if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
22130 + printk(KERN_WARNING "bios32_service: not valid\n");
22131 return 0;
22132 + }
22133 + address = address + PAGE_OFFSET;
22134 + length += 16UL; /* some BIOSs underreport this... */
22135 + flags = 4;
22136 + if (length >= 64*1024*1024) {
22137 + length >>= PAGE_SHIFT;
22138 + flags |= 8;
22139 + }
22140 +
22141 + for (cpu = 0; cpu < NR_CPUS; cpu++) {
22142 + gdt = get_cpu_gdt_table(cpu);
22143 + pack_descriptor(&d, address, length, 0x9b, flags);
22144 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
22145 + pack_descriptor(&d, address, length, 0x93, flags);
22146 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
22147 + }
22148 + return entry;
22149 + }
22150 + case 0x80: /* Not present */
22151 + printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
22152 + return 0;
22153 + default: /* Shouldn't happen */
22154 + printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
22155 + service, return_code);
22156 + return 0;
22157 }
22158 }
22159
22160 static struct {
22161 unsigned long address;
22162 unsigned short segment;
22163 -} pci_indirect = { 0, __KERNEL_CS };
22164 +} pci_indirect __read_only = { 0, __PCIBIOS_CS };
22165
22166 -static int pci_bios_present;
22167 +static int pci_bios_present __read_only;
22168
22169 static int __devinit check_pcibios(void)
22170 {
22171 @@ -131,11 +174,13 @@ static int __devinit check_pcibios(void)
22172 unsigned long flags, pcibios_entry;
22173
22174 if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
22175 - pci_indirect.address = pcibios_entry + PAGE_OFFSET;
22176 + pci_indirect.address = pcibios_entry;
22177
22178 local_irq_save(flags);
22179 - __asm__(
22180 - "lcall *(%%edi); cld\n\t"
22181 + __asm__("movw %w6, %%ds\n\t"
22182 + "lcall *%%ss:(%%edi); cld\n\t"
22183 + "push %%ss\n\t"
22184 + "pop %%ds\n\t"
22185 "jc 1f\n\t"
22186 "xor %%ah, %%ah\n"
22187 "1:"
22188 @@ -144,7 +189,8 @@ static int __devinit check_pcibios(void)
22189 "=b" (ebx),
22190 "=c" (ecx)
22191 : "1" (PCIBIOS_PCI_BIOS_PRESENT),
22192 - "D" (&pci_indirect)
22193 + "D" (&pci_indirect),
22194 + "r" (__PCIBIOS_DS)
22195 : "memory");
22196 local_irq_restore(flags);
22197
22198 @@ -188,7 +234,10 @@ static int pci_bios_read(unsigned int se
22199
22200 switch (len) {
22201 case 1:
22202 - __asm__("lcall *(%%esi); cld\n\t"
22203 + __asm__("movw %w6, %%ds\n\t"
22204 + "lcall *%%ss:(%%esi); cld\n\t"
22205 + "push %%ss\n\t"
22206 + "pop %%ds\n\t"
22207 "jc 1f\n\t"
22208 "xor %%ah, %%ah\n"
22209 "1:"
22210 @@ -197,7 +246,8 @@ static int pci_bios_read(unsigned int se
22211 : "1" (PCIBIOS_READ_CONFIG_BYTE),
22212 "b" (bx),
22213 "D" ((long)reg),
22214 - "S" (&pci_indirect));
22215 + "S" (&pci_indirect),
22216 + "r" (__PCIBIOS_DS));
22217 /*
22218 * Zero-extend the result beyond 8 bits, do not trust the
22219 * BIOS having done it:
22220 @@ -205,7 +255,10 @@ static int pci_bios_read(unsigned int se
22221 *value &= 0xff;
22222 break;
22223 case 2:
22224 - __asm__("lcall *(%%esi); cld\n\t"
22225 + __asm__("movw %w6, %%ds\n\t"
22226 + "lcall *%%ss:(%%esi); cld\n\t"
22227 + "push %%ss\n\t"
22228 + "pop %%ds\n\t"
22229 "jc 1f\n\t"
22230 "xor %%ah, %%ah\n"
22231 "1:"
22232 @@ -214,7 +267,8 @@ static int pci_bios_read(unsigned int se
22233 : "1" (PCIBIOS_READ_CONFIG_WORD),
22234 "b" (bx),
22235 "D" ((long)reg),
22236 - "S" (&pci_indirect));
22237 + "S" (&pci_indirect),
22238 + "r" (__PCIBIOS_DS));
22239 /*
22240 * Zero-extend the result beyond 16 bits, do not trust the
22241 * BIOS having done it:
22242 @@ -222,7 +276,10 @@ static int pci_bios_read(unsigned int se
22243 *value &= 0xffff;
22244 break;
22245 case 4:
22246 - __asm__("lcall *(%%esi); cld\n\t"
22247 + __asm__("movw %w6, %%ds\n\t"
22248 + "lcall *%%ss:(%%esi); cld\n\t"
22249 + "push %%ss\n\t"
22250 + "pop %%ds\n\t"
22251 "jc 1f\n\t"
22252 "xor %%ah, %%ah\n"
22253 "1:"
22254 @@ -231,7 +288,8 @@ static int pci_bios_read(unsigned int se
22255 : "1" (PCIBIOS_READ_CONFIG_DWORD),
22256 "b" (bx),
22257 "D" ((long)reg),
22258 - "S" (&pci_indirect));
22259 + "S" (&pci_indirect),
22260 + "r" (__PCIBIOS_DS));
22261 break;
22262 }
22263
22264 @@ -254,7 +312,10 @@ static int pci_bios_write(unsigned int s
22265
22266 switch (len) {
22267 case 1:
22268 - __asm__("lcall *(%%esi); cld\n\t"
22269 + __asm__("movw %w6, %%ds\n\t"
22270 + "lcall *%%ss:(%%esi); cld\n\t"
22271 + "push %%ss\n\t"
22272 + "pop %%ds\n\t"
22273 "jc 1f\n\t"
22274 "xor %%ah, %%ah\n"
22275 "1:"
22276 @@ -263,10 +324,14 @@ static int pci_bios_write(unsigned int s
22277 "c" (value),
22278 "b" (bx),
22279 "D" ((long)reg),
22280 - "S" (&pci_indirect));
22281 + "S" (&pci_indirect),
22282 + "r" (__PCIBIOS_DS));
22283 break;
22284 case 2:
22285 - __asm__("lcall *(%%esi); cld\n\t"
22286 + __asm__("movw %w6, %%ds\n\t"
22287 + "lcall *%%ss:(%%esi); cld\n\t"
22288 + "push %%ss\n\t"
22289 + "pop %%ds\n\t"
22290 "jc 1f\n\t"
22291 "xor %%ah, %%ah\n"
22292 "1:"
22293 @@ -275,10 +340,14 @@ static int pci_bios_write(unsigned int s
22294 "c" (value),
22295 "b" (bx),
22296 "D" ((long)reg),
22297 - "S" (&pci_indirect));
22298 + "S" (&pci_indirect),
22299 + "r" (__PCIBIOS_DS));
22300 break;
22301 case 4:
22302 - __asm__("lcall *(%%esi); cld\n\t"
22303 + __asm__("movw %w6, %%ds\n\t"
22304 + "lcall *%%ss:(%%esi); cld\n\t"
22305 + "push %%ss\n\t"
22306 + "pop %%ds\n\t"
22307 "jc 1f\n\t"
22308 "xor %%ah, %%ah\n"
22309 "1:"
22310 @@ -287,7 +356,8 @@ static int pci_bios_write(unsigned int s
22311 "c" (value),
22312 "b" (bx),
22313 "D" ((long)reg),
22314 - "S" (&pci_indirect));
22315 + "S" (&pci_indirect),
22316 + "r" (__PCIBIOS_DS));
22317 break;
22318 }
22319
22320 @@ -392,10 +462,13 @@ struct irq_routing_table * pcibios_get_i
22321
22322 DBG("PCI: Fetching IRQ routing table... ");
22323 __asm__("push %%es\n\t"
22324 + "movw %w8, %%ds\n\t"
22325 "push %%ds\n\t"
22326 "pop %%es\n\t"
22327 - "lcall *(%%esi); cld\n\t"
22328 + "lcall *%%ss:(%%esi); cld\n\t"
22329 "pop %%es\n\t"
22330 + "push %%ss\n\t"
22331 + "pop %%ds\n"
22332 "jc 1f\n\t"
22333 "xor %%ah, %%ah\n"
22334 "1:"
22335 @@ -406,7 +479,8 @@ struct irq_routing_table * pcibios_get_i
22336 "1" (0),
22337 "D" ((long) &opt),
22338 "S" (&pci_indirect),
22339 - "m" (opt)
22340 + "m" (opt),
22341 + "r" (__PCIBIOS_DS)
22342 : "memory");
22343 DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
22344 if (ret & 0xff00)
22345 @@ -430,7 +504,10 @@ int pcibios_set_irq_routing(struct pci_d
22346 {
22347 int ret;
22348
22349 - __asm__("lcall *(%%esi); cld\n\t"
22350 + __asm__("movw %w5, %%ds\n\t"
22351 + "lcall *%%ss:(%%esi); cld\n\t"
22352 + "push %%ss\n\t"
22353 + "pop %%ds\n"
22354 "jc 1f\n\t"
22355 "xor %%ah, %%ah\n"
22356 "1:"
22357 @@ -438,7 +515,8 @@ int pcibios_set_irq_routing(struct pci_d
22358 : "0" (PCIBIOS_SET_PCI_HW_INT),
22359 "b" ((dev->bus->number << 8) | dev->devfn),
22360 "c" ((irq << 8) | (pin + 10)),
22361 - "S" (&pci_indirect));
22362 + "S" (&pci_indirect),
22363 + "r" (__PCIBIOS_DS));
22364 return !(ret & 0xff00);
22365 }
22366 EXPORT_SYMBOL(pcibios_set_irq_routing);
22367 diff -urNp linux-3.0.9/arch/x86/platform/efi/efi_32.c linux-3.0.9/arch/x86/platform/efi/efi_32.c
22368 --- linux-3.0.9/arch/x86/platform/efi/efi_32.c 2011-11-11 13:12:24.000000000 -0500
22369 +++ linux-3.0.9/arch/x86/platform/efi/efi_32.c 2011-11-15 20:02:59.000000000 -0500
22370 @@ -38,70 +38,56 @@
22371 */
22372
22373 static unsigned long efi_rt_eflags;
22374 -static pgd_t efi_bak_pg_dir_pointer[2];
22375 +static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
22376
22377 -void efi_call_phys_prelog(void)
22378 +void __init efi_call_phys_prelog(void)
22379 {
22380 - unsigned long cr4;
22381 - unsigned long temp;
22382 struct desc_ptr gdt_descr;
22383
22384 - local_irq_save(efi_rt_eflags);
22385 +#ifdef CONFIG_PAX_KERNEXEC
22386 + struct desc_struct d;
22387 +#endif
22388
22389 - /*
22390 - * If I don't have PAE, I should just duplicate two entries in page
22391 - * directory. If I have PAE, I just need to duplicate one entry in
22392 - * page directory.
22393 - */
22394 - cr4 = read_cr4_safe();
22395 + local_irq_save(efi_rt_eflags);
22396
22397 - if (cr4 & X86_CR4_PAE) {
22398 - efi_bak_pg_dir_pointer[0].pgd =
22399 - swapper_pg_dir[pgd_index(0)].pgd;
22400 - swapper_pg_dir[0].pgd =
22401 - swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
22402 - } else {
22403 - efi_bak_pg_dir_pointer[0].pgd =
22404 - swapper_pg_dir[pgd_index(0)].pgd;
22405 - efi_bak_pg_dir_pointer[1].pgd =
22406 - swapper_pg_dir[pgd_index(0x400000)].pgd;
22407 - swapper_pg_dir[pgd_index(0)].pgd =
22408 - swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
22409 - temp = PAGE_OFFSET + 0x400000;
22410 - swapper_pg_dir[pgd_index(0x400000)].pgd =
22411 - swapper_pg_dir[pgd_index(temp)].pgd;
22412 - }
22413 + clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
22414 + clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22415 + min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
22416
22417 /*
22418 * After the lock is released, the original page table is restored.
22419 */
22420 __flush_tlb_all();
22421
22422 +#ifdef CONFIG_PAX_KERNEXEC
22423 + pack_descriptor(&d, 0, 0xFFFFF, 0x9B, 0xC);
22424 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
22425 + pack_descriptor(&d, 0, 0xFFFFF, 0x93, 0xC);
22426 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
22427 +#endif
22428 +
22429 gdt_descr.address = __pa(get_cpu_gdt_table(0));
22430 gdt_descr.size = GDT_SIZE - 1;
22431 load_gdt(&gdt_descr);
22432 }
22433
22434 -void efi_call_phys_epilog(void)
22435 +void __init efi_call_phys_epilog(void)
22436 {
22437 - unsigned long cr4;
22438 struct desc_ptr gdt_descr;
22439
22440 +#ifdef CONFIG_PAX_KERNEXEC
22441 + struct desc_struct d;
22442 +
22443 + memset(&d, 0, sizeof d);
22444 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
22445 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
22446 +#endif
22447 +
22448 gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
22449 gdt_descr.size = GDT_SIZE - 1;
22450 load_gdt(&gdt_descr);
22451
22452 - cr4 = read_cr4_safe();
22453 -
22454 - if (cr4 & X86_CR4_PAE) {
22455 - swapper_pg_dir[pgd_index(0)].pgd =
22456 - efi_bak_pg_dir_pointer[0].pgd;
22457 - } else {
22458 - swapper_pg_dir[pgd_index(0)].pgd =
22459 - efi_bak_pg_dir_pointer[0].pgd;
22460 - swapper_pg_dir[pgd_index(0x400000)].pgd =
22461 - efi_bak_pg_dir_pointer[1].pgd;
22462 - }
22463 + clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
22464
22465 /*
22466 * After the lock is released, the original page table is restored.
22467 diff -urNp linux-3.0.9/arch/x86/platform/efi/efi_stub_32.S linux-3.0.9/arch/x86/platform/efi/efi_stub_32.S
22468 --- linux-3.0.9/arch/x86/platform/efi/efi_stub_32.S 2011-11-11 13:12:24.000000000 -0500
22469 +++ linux-3.0.9/arch/x86/platform/efi/efi_stub_32.S 2011-11-15 20:02:59.000000000 -0500
22470 @@ -6,7 +6,9 @@
22471 */
22472
22473 #include <linux/linkage.h>
22474 +#include <linux/init.h>
22475 #include <asm/page_types.h>
22476 +#include <asm/segment.h>
22477
22478 /*
22479 * efi_call_phys(void *, ...) is a function with variable parameters.
22480 @@ -20,7 +22,7 @@
22481 * service functions will comply with gcc calling convention, too.
22482 */
22483
22484 -.text
22485 +__INIT
22486 ENTRY(efi_call_phys)
22487 /*
22488 * 0. The function can only be called in Linux kernel. So CS has been
22489 @@ -36,9 +38,11 @@ ENTRY(efi_call_phys)
22490 * The mapping of lower virtual memory has been created in prelog and
22491 * epilog.
22492 */
22493 - movl $1f, %edx
22494 - subl $__PAGE_OFFSET, %edx
22495 - jmp *%edx
22496 + movl $(__KERNEXEC_EFI_DS), %edx
22497 + mov %edx, %ds
22498 + mov %edx, %es
22499 + mov %edx, %ss
22500 + ljmp $(__KERNEXEC_EFI_CS),$1f-__PAGE_OFFSET
22501 1:
22502
22503 /*
22504 @@ -47,14 +51,8 @@ ENTRY(efi_call_phys)
22505 * parameter 2, ..., param n. To make things easy, we save the return
22506 * address of efi_call_phys in a global variable.
22507 */
22508 - popl %edx
22509 - movl %edx, saved_return_addr
22510 - /* get the function pointer into ECX*/
22511 - popl %ecx
22512 - movl %ecx, efi_rt_function_ptr
22513 - movl $2f, %edx
22514 - subl $__PAGE_OFFSET, %edx
22515 - pushl %edx
22516 + popl (saved_return_addr)
22517 + popl (efi_rt_function_ptr)
22518
22519 /*
22520 * 3. Clear PG bit in %CR0.
22521 @@ -73,9 +71,8 @@ ENTRY(efi_call_phys)
22522 /*
22523 * 5. Call the physical function.
22524 */
22525 - jmp *%ecx
22526 + call *(efi_rt_function_ptr-__PAGE_OFFSET)
22527
22528 -2:
22529 /*
22530 * 6. After EFI runtime service returns, control will return to
22531 * following instruction. We'd better readjust stack pointer first.
22532 @@ -88,35 +85,32 @@ ENTRY(efi_call_phys)
22533 movl %cr0, %edx
22534 orl $0x80000000, %edx
22535 movl %edx, %cr0
22536 - jmp 1f
22537 -1:
22538 +
22539 /*
22540 * 8. Now restore the virtual mode from flat mode by
22541 * adding EIP with PAGE_OFFSET.
22542 */
22543 - movl $1f, %edx
22544 - jmp *%edx
22545 + ljmp $(__KERNEL_CS),$1f+__PAGE_OFFSET
22546 1:
22547 + movl $(__KERNEL_DS), %edx
22548 + mov %edx, %ds
22549 + mov %edx, %es
22550 + mov %edx, %ss
22551
22552 /*
22553 * 9. Balance the stack. And because EAX contain the return value,
22554 * we'd better not clobber it.
22555 */
22556 - leal efi_rt_function_ptr, %edx
22557 - movl (%edx), %ecx
22558 - pushl %ecx
22559 + pushl (efi_rt_function_ptr)
22560
22561 /*
22562 - * 10. Push the saved return address onto the stack and return.
22563 + * 10. Return to the saved return address.
22564 */
22565 - leal saved_return_addr, %edx
22566 - movl (%edx), %ecx
22567 - pushl %ecx
22568 - ret
22569 + jmpl *(saved_return_addr)
22570 ENDPROC(efi_call_phys)
22571 .previous
22572
22573 -.data
22574 +__INITDATA
22575 saved_return_addr:
22576 .long 0
22577 efi_rt_function_ptr:
22578 diff -urNp linux-3.0.9/arch/x86/platform/efi/efi_stub_64.S linux-3.0.9/arch/x86/platform/efi/efi_stub_64.S
22579 --- linux-3.0.9/arch/x86/platform/efi/efi_stub_64.S 2011-11-11 13:12:24.000000000 -0500
22580 +++ linux-3.0.9/arch/x86/platform/efi/efi_stub_64.S 2011-11-15 20:02:59.000000000 -0500
22581 @@ -7,6 +7,7 @@
22582 */
22583
22584 #include <linux/linkage.h>
22585 +#include <asm/alternative-asm.h>
22586
22587 #define SAVE_XMM \
22588 mov %rsp, %rax; \
22589 @@ -40,6 +41,7 @@ ENTRY(efi_call0)
22590 call *%rdi
22591 addq $32, %rsp
22592 RESTORE_XMM
22593 + pax_force_retaddr
22594 ret
22595 ENDPROC(efi_call0)
22596
22597 @@ -50,6 +52,7 @@ ENTRY(efi_call1)
22598 call *%rdi
22599 addq $32, %rsp
22600 RESTORE_XMM
22601 + pax_force_retaddr
22602 ret
22603 ENDPROC(efi_call1)
22604
22605 @@ -60,6 +63,7 @@ ENTRY(efi_call2)
22606 call *%rdi
22607 addq $32, %rsp
22608 RESTORE_XMM
22609 + pax_force_retaddr
22610 ret
22611 ENDPROC(efi_call2)
22612
22613 @@ -71,6 +75,7 @@ ENTRY(efi_call3)
22614 call *%rdi
22615 addq $32, %rsp
22616 RESTORE_XMM
22617 + pax_force_retaddr
22618 ret
22619 ENDPROC(efi_call3)
22620
22621 @@ -83,6 +88,7 @@ ENTRY(efi_call4)
22622 call *%rdi
22623 addq $32, %rsp
22624 RESTORE_XMM
22625 + pax_force_retaddr
22626 ret
22627 ENDPROC(efi_call4)
22628
22629 @@ -96,6 +102,7 @@ ENTRY(efi_call5)
22630 call *%rdi
22631 addq $48, %rsp
22632 RESTORE_XMM
22633 + pax_force_retaddr
22634 ret
22635 ENDPROC(efi_call5)
22636
22637 @@ -112,5 +119,6 @@ ENTRY(efi_call6)
22638 call *%rdi
22639 addq $48, %rsp
22640 RESTORE_XMM
22641 + pax_force_retaddr
22642 ret
22643 ENDPROC(efi_call6)
22644 diff -urNp linux-3.0.9/arch/x86/platform/mrst/mrst.c linux-3.0.9/arch/x86/platform/mrst/mrst.c
22645 --- linux-3.0.9/arch/x86/platform/mrst/mrst.c 2011-11-11 13:12:24.000000000 -0500
22646 +++ linux-3.0.9/arch/x86/platform/mrst/mrst.c 2011-11-15 20:02:59.000000000 -0500
22647 @@ -239,14 +239,16 @@ static int mrst_i8042_detect(void)
22648 }
22649
22650 /* Reboot and power off are handled by the SCU on a MID device */
22651 -static void mrst_power_off(void)
22652 +static __noreturn void mrst_power_off(void)
22653 {
22654 intel_scu_ipc_simple_command(0xf1, 1);
22655 + BUG();
22656 }
22657
22658 -static void mrst_reboot(void)
22659 +static __noreturn void mrst_reboot(void)
22660 {
22661 intel_scu_ipc_simple_command(0xf1, 0);
22662 + BUG();
22663 }
22664
22665 /*
22666 diff -urNp linux-3.0.9/arch/x86/platform/uv/tlb_uv.c linux-3.0.9/arch/x86/platform/uv/tlb_uv.c
22667 --- linux-3.0.9/arch/x86/platform/uv/tlb_uv.c 2011-11-11 13:12:24.000000000 -0500
22668 +++ linux-3.0.9/arch/x86/platform/uv/tlb_uv.c 2011-11-15 20:02:59.000000000 -0500
22669 @@ -370,6 +370,8 @@ static void reset_with_ipi(struct bau_ta
22670 cpumask_t mask;
22671 struct reset_args reset_args;
22672
22673 + pax_track_stack();
22674 +
22675 reset_args.sender = sender;
22676 cpus_clear(mask);
22677 /* find a single cpu for each uvhub in this distribution mask */
22678 diff -urNp linux-3.0.9/arch/x86/power/cpu.c linux-3.0.9/arch/x86/power/cpu.c
22679 --- linux-3.0.9/arch/x86/power/cpu.c 2011-11-11 13:12:24.000000000 -0500
22680 +++ linux-3.0.9/arch/x86/power/cpu.c 2011-11-15 20:02:59.000000000 -0500
22681 @@ -130,7 +130,7 @@ static void do_fpu_end(void)
22682 static void fix_processor_context(void)
22683 {
22684 int cpu = smp_processor_id();
22685 - struct tss_struct *t = &per_cpu(init_tss, cpu);
22686 + struct tss_struct *t = init_tss + cpu;
22687
22688 set_tss_desc(cpu, t); /*
22689 * This just modifies memory; should not be
22690 @@ -140,7 +140,9 @@ static void fix_processor_context(void)
22691 */
22692
22693 #ifdef CONFIG_X86_64
22694 + pax_open_kernel();
22695 get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
22696 + pax_close_kernel();
22697
22698 syscall_init(); /* This sets MSR_*STAR and related */
22699 #endif
22700 diff -urNp linux-3.0.9/arch/x86/vdso/Makefile linux-3.0.9/arch/x86/vdso/Makefile
22701 --- linux-3.0.9/arch/x86/vdso/Makefile 2011-11-11 13:12:24.000000000 -0500
22702 +++ linux-3.0.9/arch/x86/vdso/Makefile 2011-11-15 20:02:59.000000000 -0500
22703 @@ -136,7 +136,7 @@ quiet_cmd_vdso = VDSO $@
22704 -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
22705 sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
22706
22707 -VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
22708 +VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
22709 GCOV_PROFILE := n
22710
22711 #
22712 diff -urNp linux-3.0.9/arch/x86/vdso/vdso32-setup.c linux-3.0.9/arch/x86/vdso/vdso32-setup.c
22713 --- linux-3.0.9/arch/x86/vdso/vdso32-setup.c 2011-11-11 13:12:24.000000000 -0500
22714 +++ linux-3.0.9/arch/x86/vdso/vdso32-setup.c 2011-11-15 20:02:59.000000000 -0500
22715 @@ -25,6 +25,7 @@
22716 #include <asm/tlbflush.h>
22717 #include <asm/vdso.h>
22718 #include <asm/proto.h>
22719 +#include <asm/mman.h>
22720
22721 enum {
22722 VDSO_DISABLED = 0,
22723 @@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m
22724 void enable_sep_cpu(void)
22725 {
22726 int cpu = get_cpu();
22727 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
22728 + struct tss_struct *tss = init_tss + cpu;
22729
22730 if (!boot_cpu_has(X86_FEATURE_SEP)) {
22731 put_cpu();
22732 @@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
22733 gate_vma.vm_start = FIXADDR_USER_START;
22734 gate_vma.vm_end = FIXADDR_USER_END;
22735 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
22736 - gate_vma.vm_page_prot = __P101;
22737 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
22738 /*
22739 * Make sure the vDSO gets into every core dump.
22740 * Dumping its contents makes post-mortem fully interpretable later
22741 @@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l
22742 if (compat)
22743 addr = VDSO_HIGH_BASE;
22744 else {
22745 - addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
22746 + addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
22747 if (IS_ERR_VALUE(addr)) {
22748 ret = addr;
22749 goto up_fail;
22750 }
22751 }
22752
22753 - current->mm->context.vdso = (void *)addr;
22754 + current->mm->context.vdso = addr;
22755
22756 if (compat_uses_vma || !compat) {
22757 /*
22758 @@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l
22759 }
22760
22761 current_thread_info()->sysenter_return =
22762 - VDSO32_SYMBOL(addr, SYSENTER_RETURN);
22763 + (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
22764
22765 up_fail:
22766 if (ret)
22767 - current->mm->context.vdso = NULL;
22768 + current->mm->context.vdso = 0;
22769
22770 up_write(&mm->mmap_sem);
22771
22772 @@ -412,8 +413,14 @@ __initcall(ia32_binfmt_init);
22773
22774 const char *arch_vma_name(struct vm_area_struct *vma)
22775 {
22776 - if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
22777 + if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
22778 return "[vdso]";
22779 +
22780 +#ifdef CONFIG_PAX_SEGMEXEC
22781 + if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
22782 + return "[vdso]";
22783 +#endif
22784 +
22785 return NULL;
22786 }
22787
22788 @@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(stru
22789 * Check to see if the corresponding task was created in compat vdso
22790 * mode.
22791 */
22792 - if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
22793 + if (mm && mm->context.vdso == VDSO_HIGH_BASE)
22794 return &gate_vma;
22795 return NULL;
22796 }
22797 diff -urNp linux-3.0.9/arch/x86/vdso/vma.c linux-3.0.9/arch/x86/vdso/vma.c
22798 --- linux-3.0.9/arch/x86/vdso/vma.c 2011-11-11 13:12:24.000000000 -0500
22799 +++ linux-3.0.9/arch/x86/vdso/vma.c 2011-11-15 20:02:59.000000000 -0500
22800 @@ -15,18 +15,19 @@
22801 #include <asm/proto.h>
22802 #include <asm/vdso.h>
22803
22804 -unsigned int __read_mostly vdso_enabled = 1;
22805 -
22806 extern char vdso_start[], vdso_end[];
22807 extern unsigned short vdso_sync_cpuid;
22808 +extern char __vsyscall_0;
22809
22810 static struct page **vdso_pages;
22811 +static struct page *vsyscall_page;
22812 static unsigned vdso_size;
22813
22814 static int __init init_vdso_vars(void)
22815 {
22816 - int npages = (vdso_end - vdso_start + PAGE_SIZE - 1) / PAGE_SIZE;
22817 - int i;
22818 + size_t nbytes = vdso_end - vdso_start;
22819 + size_t npages = (nbytes + PAGE_SIZE - 1) / PAGE_SIZE;
22820 + size_t i;
22821
22822 vdso_size = npages << PAGE_SHIFT;
22823 vdso_pages = kmalloc(sizeof(struct page *) * npages, GFP_KERNEL);
22824 @@ -34,19 +35,19 @@ static int __init init_vdso_vars(void)
22825 goto oom;
22826 for (i = 0; i < npages; i++) {
22827 struct page *p;
22828 - p = alloc_page(GFP_KERNEL);
22829 + p = alloc_page(GFP_KERNEL | __GFP_ZERO);
22830 if (!p)
22831 goto oom;
22832 vdso_pages[i] = p;
22833 - copy_page(page_address(p), vdso_start + i*PAGE_SIZE);
22834 + memcpy(page_address(p), vdso_start + i*PAGE_SIZE, nbytes > PAGE_SIZE ? PAGE_SIZE : nbytes);
22835 + nbytes -= PAGE_SIZE;
22836 }
22837 + vsyscall_page = pfn_to_page((__pa_symbol(&__vsyscall_0)) >> PAGE_SHIFT);
22838
22839 return 0;
22840
22841 oom:
22842 - printk("Cannot allocate vdso\n");
22843 - vdso_enabled = 0;
22844 - return -ENOMEM;
22845 + panic("Cannot allocate vdso\n");
22846 }
22847 subsys_initcall(init_vdso_vars);
22848
22849 @@ -80,37 +81,35 @@ int arch_setup_additional_pages(struct l
22850 unsigned long addr;
22851 int ret;
22852
22853 - if (!vdso_enabled)
22854 - return 0;
22855 -
22856 down_write(&mm->mmap_sem);
22857 - addr = vdso_addr(mm->start_stack, vdso_size);
22858 - addr = get_unmapped_area(NULL, addr, vdso_size, 0, 0);
22859 + addr = vdso_addr(mm->start_stack, vdso_size + PAGE_SIZE);
22860 + addr = get_unmapped_area(NULL, addr, vdso_size + PAGE_SIZE, 0, 0);
22861 if (IS_ERR_VALUE(addr)) {
22862 ret = addr;
22863 goto up_fail;
22864 }
22865
22866 - current->mm->context.vdso = (void *)addr;
22867 + mm->context.vdso = addr + PAGE_SIZE;
22868
22869 - ret = install_special_mapping(mm, addr, vdso_size,
22870 + ret = install_special_mapping(mm, addr, PAGE_SIZE,
22871 VM_READ|VM_EXEC|
22872 - VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC|
22873 + VM_MAYREAD|VM_MAYEXEC|
22874 VM_ALWAYSDUMP,
22875 - vdso_pages);
22876 + &vsyscall_page);
22877 if (ret) {
22878 - current->mm->context.vdso = NULL;
22879 + mm->context.vdso = 0;
22880 goto up_fail;
22881 }
22882
22883 + ret = install_special_mapping(mm, addr + PAGE_SIZE, vdso_size,
22884 + VM_READ|VM_EXEC|
22885 + VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC|
22886 + VM_ALWAYSDUMP,
22887 + vdso_pages);
22888 + if (ret)
22889 + mm->context.vdso = 0;
22890 +
22891 up_fail:
22892 up_write(&mm->mmap_sem);
22893 return ret;
22894 }
22895 -
22896 -static __init int vdso_setup(char *s)
22897 -{
22898 - vdso_enabled = simple_strtoul(s, NULL, 0);
22899 - return 0;
22900 -}
22901 -__setup("vdso=", vdso_setup);
22902 diff -urNp linux-3.0.9/arch/x86/xen/enlighten.c linux-3.0.9/arch/x86/xen/enlighten.c
22903 --- linux-3.0.9/arch/x86/xen/enlighten.c 2011-11-11 13:12:24.000000000 -0500
22904 +++ linux-3.0.9/arch/x86/xen/enlighten.c 2011-11-15 20:02:59.000000000 -0500
22905 @@ -85,8 +85,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
22906
22907 struct shared_info xen_dummy_shared_info;
22908
22909 -void *xen_initial_gdt;
22910 -
22911 RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
22912 __read_mostly int xen_have_vector_callback;
22913 EXPORT_SYMBOL_GPL(xen_have_vector_callback);
22914 @@ -1010,7 +1008,7 @@ static const struct pv_apic_ops xen_apic
22915 #endif
22916 };
22917
22918 -static void xen_reboot(int reason)
22919 +static __noreturn void xen_reboot(int reason)
22920 {
22921 struct sched_shutdown r = { .reason = reason };
22922
22923 @@ -1018,17 +1016,17 @@ static void xen_reboot(int reason)
22924 BUG();
22925 }
22926
22927 -static void xen_restart(char *msg)
22928 +static __noreturn void xen_restart(char *msg)
22929 {
22930 xen_reboot(SHUTDOWN_reboot);
22931 }
22932
22933 -static void xen_emergency_restart(void)
22934 +static __noreturn void xen_emergency_restart(void)
22935 {
22936 xen_reboot(SHUTDOWN_reboot);
22937 }
22938
22939 -static void xen_machine_halt(void)
22940 +static __noreturn void xen_machine_halt(void)
22941 {
22942 xen_reboot(SHUTDOWN_poweroff);
22943 }
22944 @@ -1134,7 +1132,17 @@ asmlinkage void __init xen_start_kernel(
22945 __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
22946
22947 /* Work out if we support NX */
22948 - x86_configure_nx();
22949 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
22950 + if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
22951 + (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
22952 + unsigned l, h;
22953 +
22954 + __supported_pte_mask |= _PAGE_NX;
22955 + rdmsr(MSR_EFER, l, h);
22956 + l |= EFER_NX;
22957 + wrmsr(MSR_EFER, l, h);
22958 + }
22959 +#endif
22960
22961 xen_setup_features();
22962
22963 @@ -1165,13 +1173,6 @@ asmlinkage void __init xen_start_kernel(
22964
22965 machine_ops = xen_machine_ops;
22966
22967 - /*
22968 - * The only reliable way to retain the initial address of the
22969 - * percpu gdt_page is to remember it here, so we can go and
22970 - * mark it RW later, when the initial percpu area is freed.
22971 - */
22972 - xen_initial_gdt = &per_cpu(gdt_page, 0);
22973 -
22974 xen_smp_init();
22975
22976 #ifdef CONFIG_ACPI_NUMA
22977 diff -urNp linux-3.0.9/arch/x86/xen/mmu.c linux-3.0.9/arch/x86/xen/mmu.c
22978 --- linux-3.0.9/arch/x86/xen/mmu.c 2011-11-11 13:12:24.000000000 -0500
22979 +++ linux-3.0.9/arch/x86/xen/mmu.c 2011-11-15 20:02:59.000000000 -0500
22980 @@ -1683,6 +1683,8 @@ pgd_t * __init xen_setup_kernel_pagetabl
22981 convert_pfn_mfn(init_level4_pgt);
22982 convert_pfn_mfn(level3_ident_pgt);
22983 convert_pfn_mfn(level3_kernel_pgt);
22984 + convert_pfn_mfn(level3_vmalloc_pgt);
22985 + convert_pfn_mfn(level3_vmemmap_pgt);
22986
22987 l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
22988 l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
22989 @@ -1701,7 +1703,10 @@ pgd_t * __init xen_setup_kernel_pagetabl
22990 set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
22991 set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
22992 set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
22993 + set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
22994 + set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
22995 set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
22996 + set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
22997 set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
22998 set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
22999
23000 @@ -1913,6 +1918,7 @@ static void __init xen_post_allocator_in
23001 pv_mmu_ops.set_pud = xen_set_pud;
23002 #if PAGETABLE_LEVELS == 4
23003 pv_mmu_ops.set_pgd = xen_set_pgd;
23004 + pv_mmu_ops.set_pgd_batched = xen_set_pgd;
23005 #endif
23006
23007 /* This will work as long as patching hasn't happened yet
23008 @@ -1994,6 +2000,7 @@ static const struct pv_mmu_ops xen_mmu_o
23009 .pud_val = PV_CALLEE_SAVE(xen_pud_val),
23010 .make_pud = PV_CALLEE_SAVE(xen_make_pud),
23011 .set_pgd = xen_set_pgd_hyper,
23012 + .set_pgd_batched = xen_set_pgd_hyper,
23013
23014 .alloc_pud = xen_alloc_pmd_init,
23015 .release_pud = xen_release_pmd_init,
23016 diff -urNp linux-3.0.9/arch/x86/xen/smp.c linux-3.0.9/arch/x86/xen/smp.c
23017 --- linux-3.0.9/arch/x86/xen/smp.c 2011-11-11 13:12:24.000000000 -0500
23018 +++ linux-3.0.9/arch/x86/xen/smp.c 2011-11-15 20:02:59.000000000 -0500
23019 @@ -194,11 +194,6 @@ static void __init xen_smp_prepare_boot_
23020 {
23021 BUG_ON(smp_processor_id() != 0);
23022 native_smp_prepare_boot_cpu();
23023 -
23024 - /* We've switched to the "real" per-cpu gdt, so make sure the
23025 - old memory can be recycled */
23026 - make_lowmem_page_readwrite(xen_initial_gdt);
23027 -
23028 xen_filter_cpu_maps();
23029 xen_setup_vcpu_info_placement();
23030 }
23031 @@ -275,12 +270,12 @@ cpu_initialize_context(unsigned int cpu,
23032 gdt = get_cpu_gdt_table(cpu);
23033
23034 ctxt->flags = VGCF_IN_KERNEL;
23035 - ctxt->user_regs.ds = __USER_DS;
23036 - ctxt->user_regs.es = __USER_DS;
23037 + ctxt->user_regs.ds = __KERNEL_DS;
23038 + ctxt->user_regs.es = __KERNEL_DS;
23039 ctxt->user_regs.ss = __KERNEL_DS;
23040 #ifdef CONFIG_X86_32
23041 ctxt->user_regs.fs = __KERNEL_PERCPU;
23042 - ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
23043 + savesegment(gs, ctxt->user_regs.gs);
23044 #else
23045 ctxt->gs_base_kernel = per_cpu_offset(cpu);
23046 #endif
23047 @@ -331,13 +326,12 @@ static int __cpuinit xen_cpu_up(unsigned
23048 int rc;
23049
23050 per_cpu(current_task, cpu) = idle;
23051 + per_cpu(current_tinfo, cpu) = &idle->tinfo;
23052 #ifdef CONFIG_X86_32
23053 irq_ctx_init(cpu);
23054 #else
23055 clear_tsk_thread_flag(idle, TIF_FORK);
23056 - per_cpu(kernel_stack, cpu) =
23057 - (unsigned long)task_stack_page(idle) -
23058 - KERNEL_STACK_OFFSET + THREAD_SIZE;
23059 + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
23060 #endif
23061 xen_setup_runstate_info(cpu);
23062 xen_setup_timer(cpu);
23063 diff -urNp linux-3.0.9/arch/x86/xen/xen-asm_32.S linux-3.0.9/arch/x86/xen/xen-asm_32.S
23064 --- linux-3.0.9/arch/x86/xen/xen-asm_32.S 2011-11-11 13:12:24.000000000 -0500
23065 +++ linux-3.0.9/arch/x86/xen/xen-asm_32.S 2011-11-15 20:02:59.000000000 -0500
23066 @@ -83,14 +83,14 @@ ENTRY(xen_iret)
23067 ESP_OFFSET=4 # bytes pushed onto stack
23068
23069 /*
23070 - * Store vcpu_info pointer for easy access. Do it this way to
23071 - * avoid having to reload %fs
23072 + * Store vcpu_info pointer for easy access.
23073 */
23074 #ifdef CONFIG_SMP
23075 - GET_THREAD_INFO(%eax)
23076 - movl TI_cpu(%eax), %eax
23077 - movl __per_cpu_offset(,%eax,4), %eax
23078 - mov xen_vcpu(%eax), %eax
23079 + push %fs
23080 + mov $(__KERNEL_PERCPU), %eax
23081 + mov %eax, %fs
23082 + mov PER_CPU_VAR(xen_vcpu), %eax
23083 + pop %fs
23084 #else
23085 movl xen_vcpu, %eax
23086 #endif
23087 diff -urNp linux-3.0.9/arch/x86/xen/xen-head.S linux-3.0.9/arch/x86/xen/xen-head.S
23088 --- linux-3.0.9/arch/x86/xen/xen-head.S 2011-11-11 13:12:24.000000000 -0500
23089 +++ linux-3.0.9/arch/x86/xen/xen-head.S 2011-11-15 20:02:59.000000000 -0500
23090 @@ -19,6 +19,17 @@ ENTRY(startup_xen)
23091 #ifdef CONFIG_X86_32
23092 mov %esi,xen_start_info
23093 mov $init_thread_union+THREAD_SIZE,%esp
23094 +#ifdef CONFIG_SMP
23095 + movl $cpu_gdt_table,%edi
23096 + movl $__per_cpu_load,%eax
23097 + movw %ax,__KERNEL_PERCPU + 2(%edi)
23098 + rorl $16,%eax
23099 + movb %al,__KERNEL_PERCPU + 4(%edi)
23100 + movb %ah,__KERNEL_PERCPU + 7(%edi)
23101 + movl $__per_cpu_end - 1,%eax
23102 + subl $__per_cpu_start,%eax
23103 + movw %ax,__KERNEL_PERCPU + 0(%edi)
23104 +#endif
23105 #else
23106 mov %rsi,xen_start_info
23107 mov $init_thread_union+THREAD_SIZE,%rsp
23108 diff -urNp linux-3.0.9/arch/x86/xen/xen-ops.h linux-3.0.9/arch/x86/xen/xen-ops.h
23109 --- linux-3.0.9/arch/x86/xen/xen-ops.h 2011-11-11 13:12:24.000000000 -0500
23110 +++ linux-3.0.9/arch/x86/xen/xen-ops.h 2011-11-15 20:02:59.000000000 -0500
23111 @@ -10,8 +10,6 @@
23112 extern const char xen_hypervisor_callback[];
23113 extern const char xen_failsafe_callback[];
23114
23115 -extern void *xen_initial_gdt;
23116 -
23117 struct trap_info;
23118 void xen_copy_trap_info(struct trap_info *traps);
23119
23120 diff -urNp linux-3.0.9/block/blk-iopoll.c linux-3.0.9/block/blk-iopoll.c
23121 --- linux-3.0.9/block/blk-iopoll.c 2011-11-11 13:12:24.000000000 -0500
23122 +++ linux-3.0.9/block/blk-iopoll.c 2011-11-15 20:02:59.000000000 -0500
23123 @@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
23124 }
23125 EXPORT_SYMBOL(blk_iopoll_complete);
23126
23127 -static void blk_iopoll_softirq(struct softirq_action *h)
23128 +static void blk_iopoll_softirq(void)
23129 {
23130 struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
23131 int rearm = 0, budget = blk_iopoll_budget;
23132 diff -urNp linux-3.0.9/block/blk-map.c linux-3.0.9/block/blk-map.c
23133 --- linux-3.0.9/block/blk-map.c 2011-11-11 13:12:24.000000000 -0500
23134 +++ linux-3.0.9/block/blk-map.c 2011-11-15 20:02:59.000000000 -0500
23135 @@ -301,7 +301,7 @@ int blk_rq_map_kern(struct request_queue
23136 if (!len || !kbuf)
23137 return -EINVAL;
23138
23139 - do_copy = !blk_rq_aligned(q, addr, len) || object_is_on_stack(kbuf);
23140 + do_copy = !blk_rq_aligned(q, addr, len) || object_starts_on_stack(kbuf);
23141 if (do_copy)
23142 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
23143 else
23144 diff -urNp linux-3.0.9/block/blk-softirq.c linux-3.0.9/block/blk-softirq.c
23145 --- linux-3.0.9/block/blk-softirq.c 2011-11-11 13:12:24.000000000 -0500
23146 +++ linux-3.0.9/block/blk-softirq.c 2011-11-15 20:02:59.000000000 -0500
23147 @@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head,
23148 * Softirq action handler - move entries to local list and loop over them
23149 * while passing them to the queue registered handler.
23150 */
23151 -static void blk_done_softirq(struct softirq_action *h)
23152 +static void blk_done_softirq(void)
23153 {
23154 struct list_head *cpu_list, local_list;
23155
23156 diff -urNp linux-3.0.9/block/bsg.c linux-3.0.9/block/bsg.c
23157 --- linux-3.0.9/block/bsg.c 2011-11-11 13:12:24.000000000 -0500
23158 +++ linux-3.0.9/block/bsg.c 2011-11-15 20:02:59.000000000 -0500
23159 @@ -176,16 +176,24 @@ static int blk_fill_sgv4_hdr_rq(struct r
23160 struct sg_io_v4 *hdr, struct bsg_device *bd,
23161 fmode_t has_write_perm)
23162 {
23163 + unsigned char tmpcmd[sizeof(rq->__cmd)];
23164 + unsigned char *cmdptr;
23165 +
23166 if (hdr->request_len > BLK_MAX_CDB) {
23167 rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
23168 if (!rq->cmd)
23169 return -ENOMEM;
23170 - }
23171 + cmdptr = rq->cmd;
23172 + } else
23173 + cmdptr = tmpcmd;
23174
23175 - if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request,
23176 + if (copy_from_user(cmdptr, (void __user *)(unsigned long)hdr->request,
23177 hdr->request_len))
23178 return -EFAULT;
23179
23180 + if (cmdptr != rq->cmd)
23181 + memcpy(rq->cmd, cmdptr, hdr->request_len);
23182 +
23183 if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
23184 if (blk_verify_command(rq->cmd, has_write_perm))
23185 return -EPERM;
23186 @@ -249,7 +257,7 @@ bsg_map_hdr(struct bsg_device *bd, struc
23187 struct request *rq, *next_rq = NULL;
23188 int ret, rw;
23189 unsigned int dxfer_len;
23190 - void *dxferp = NULL;
23191 + void __user *dxferp = NULL;
23192 struct bsg_class_device *bcd = &q->bsg_dev;
23193
23194 /* if the LLD has been removed then the bsg_unregister_queue will
23195 @@ -291,7 +299,7 @@ bsg_map_hdr(struct bsg_device *bd, struc
23196 rq->next_rq = next_rq;
23197 next_rq->cmd_type = rq->cmd_type;
23198
23199 - dxferp = (void*)(unsigned long)hdr->din_xferp;
23200 + dxferp = (void __user *)(unsigned long)hdr->din_xferp;
23201 ret = blk_rq_map_user(q, next_rq, NULL, dxferp,
23202 hdr->din_xfer_len, GFP_KERNEL);
23203 if (ret)
23204 @@ -300,10 +308,10 @@ bsg_map_hdr(struct bsg_device *bd, struc
23205
23206 if (hdr->dout_xfer_len) {
23207 dxfer_len = hdr->dout_xfer_len;
23208 - dxferp = (void*)(unsigned long)hdr->dout_xferp;
23209 + dxferp = (void __user *)(unsigned long)hdr->dout_xferp;
23210 } else if (hdr->din_xfer_len) {
23211 dxfer_len = hdr->din_xfer_len;
23212 - dxferp = (void*)(unsigned long)hdr->din_xferp;
23213 + dxferp = (void __user *)(unsigned long)hdr->din_xferp;
23214 } else
23215 dxfer_len = 0;
23216
23217 @@ -445,7 +453,7 @@ static int blk_complete_sgv4_hdr_rq(stru
23218 int len = min_t(unsigned int, hdr->max_response_len,
23219 rq->sense_len);
23220
23221 - ret = copy_to_user((void*)(unsigned long)hdr->response,
23222 + ret = copy_to_user((void __user *)(unsigned long)hdr->response,
23223 rq->sense, len);
23224 if (!ret)
23225 hdr->response_len = len;
23226 diff -urNp linux-3.0.9/block/compat_ioctl.c linux-3.0.9/block/compat_ioctl.c
23227 --- linux-3.0.9/block/compat_ioctl.c 2011-11-11 13:12:24.000000000 -0500
23228 +++ linux-3.0.9/block/compat_ioctl.c 2011-11-15 20:02:59.000000000 -0500
23229 @@ -354,7 +354,7 @@ static int compat_fd_ioctl(struct block_
23230 err |= __get_user(f->spec1, &uf->spec1);
23231 err |= __get_user(f->fmt_gap, &uf->fmt_gap);
23232 err |= __get_user(name, &uf->name);
23233 - f->name = compat_ptr(name);
23234 + f->name = (void __force_kernel *)compat_ptr(name);
23235 if (err) {
23236 err = -EFAULT;
23237 goto out;
23238 diff -urNp linux-3.0.9/block/scsi_ioctl.c linux-3.0.9/block/scsi_ioctl.c
23239 --- linux-3.0.9/block/scsi_ioctl.c 2011-11-11 13:12:24.000000000 -0500
23240 +++ linux-3.0.9/block/scsi_ioctl.c 2011-11-15 20:02:59.000000000 -0500
23241 @@ -222,8 +222,20 @@ EXPORT_SYMBOL(blk_verify_command);
23242 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
23243 struct sg_io_hdr *hdr, fmode_t mode)
23244 {
23245 - if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
23246 + unsigned char tmpcmd[sizeof(rq->__cmd)];
23247 + unsigned char *cmdptr;
23248 +
23249 + if (rq->cmd != rq->__cmd)
23250 + cmdptr = rq->cmd;
23251 + else
23252 + cmdptr = tmpcmd;
23253 +
23254 + if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
23255 return -EFAULT;
23256 +
23257 + if (cmdptr != rq->cmd)
23258 + memcpy(rq->cmd, cmdptr, hdr->cmd_len);
23259 +
23260 if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
23261 return -EPERM;
23262
23263 @@ -432,6 +444,8 @@ int sg_scsi_ioctl(struct request_queue *
23264 int err;
23265 unsigned int in_len, out_len, bytes, opcode, cmdlen;
23266 char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
23267 + unsigned char tmpcmd[sizeof(rq->__cmd)];
23268 + unsigned char *cmdptr;
23269
23270 if (!sic)
23271 return -EINVAL;
23272 @@ -465,9 +479,18 @@ int sg_scsi_ioctl(struct request_queue *
23273 */
23274 err = -EFAULT;
23275 rq->cmd_len = cmdlen;
23276 - if (copy_from_user(rq->cmd, sic->data, cmdlen))
23277 +
23278 + if (rq->cmd != rq->__cmd)
23279 + cmdptr = rq->cmd;
23280 + else
23281 + cmdptr = tmpcmd;
23282 +
23283 + if (copy_from_user(cmdptr, sic->data, cmdlen))
23284 goto error;
23285
23286 + if (rq->cmd != cmdptr)
23287 + memcpy(rq->cmd, cmdptr, cmdlen);
23288 +
23289 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
23290 goto error;
23291
23292 diff -urNp linux-3.0.9/crypto/cryptd.c linux-3.0.9/crypto/cryptd.c
23293 --- linux-3.0.9/crypto/cryptd.c 2011-11-11 13:12:24.000000000 -0500
23294 +++ linux-3.0.9/crypto/cryptd.c 2011-11-15 20:02:59.000000000 -0500
23295 @@ -63,7 +63,7 @@ struct cryptd_blkcipher_ctx {
23296
23297 struct cryptd_blkcipher_request_ctx {
23298 crypto_completion_t complete;
23299 -};
23300 +} __no_const;
23301
23302 struct cryptd_hash_ctx {
23303 struct crypto_shash *child;
23304 @@ -80,7 +80,7 @@ struct cryptd_aead_ctx {
23305
23306 struct cryptd_aead_request_ctx {
23307 crypto_completion_t complete;
23308 -};
23309 +} __no_const;
23310
23311 static void cryptd_queue_worker(struct work_struct *work);
23312
23313 diff -urNp linux-3.0.9/crypto/gf128mul.c linux-3.0.9/crypto/gf128mul.c
23314 --- linux-3.0.9/crypto/gf128mul.c 2011-11-11 13:12:24.000000000 -0500
23315 +++ linux-3.0.9/crypto/gf128mul.c 2011-11-15 20:02:59.000000000 -0500
23316 @@ -182,7 +182,7 @@ void gf128mul_lle(be128 *r, const be128
23317 for (i = 0; i < 7; ++i)
23318 gf128mul_x_lle(&p[i + 1], &p[i]);
23319
23320 - memset(r, 0, sizeof(r));
23321 + memset(r, 0, sizeof(*r));
23322 for (i = 0;;) {
23323 u8 ch = ((u8 *)b)[15 - i];
23324
23325 @@ -220,7 +220,7 @@ void gf128mul_bbe(be128 *r, const be128
23326 for (i = 0; i < 7; ++i)
23327 gf128mul_x_bbe(&p[i + 1], &p[i]);
23328
23329 - memset(r, 0, sizeof(r));
23330 + memset(r, 0, sizeof(*r));
23331 for (i = 0;;) {
23332 u8 ch = ((u8 *)b)[i];
23333
23334 diff -urNp linux-3.0.9/crypto/serpent.c linux-3.0.9/crypto/serpent.c
23335 --- linux-3.0.9/crypto/serpent.c 2011-11-11 13:12:24.000000000 -0500
23336 +++ linux-3.0.9/crypto/serpent.c 2011-11-15 20:02:59.000000000 -0500
23337 @@ -224,6 +224,8 @@ static int serpent_setkey(struct crypto_
23338 u32 r0,r1,r2,r3,r4;
23339 int i;
23340
23341 + pax_track_stack();
23342 +
23343 /* Copy key, add padding */
23344
23345 for (i = 0; i < keylen; ++i)
23346 diff -urNp linux-3.0.9/Documentation/dontdiff linux-3.0.9/Documentation/dontdiff
23347 --- linux-3.0.9/Documentation/dontdiff 2011-11-11 13:12:24.000000000 -0500
23348 +++ linux-3.0.9/Documentation/dontdiff 2011-11-15 20:02:59.000000000 -0500
23349 @@ -5,6 +5,7 @@
23350 *.cis
23351 *.cpio
23352 *.csp
23353 +*.dbg
23354 *.dsp
23355 *.dvi
23356 *.elf
23357 @@ -48,9 +49,11 @@
23358 *.tab.h
23359 *.tex
23360 *.ver
23361 +*.vim
23362 *.xml
23363 *.xz
23364 *_MODULES
23365 +*_reg_safe.h
23366 *_vga16.c
23367 *~
23368 \#*#
23369 @@ -70,6 +73,7 @@ Kerntypes
23370 Module.markers
23371 Module.symvers
23372 PENDING
23373 +PERF*
23374 SCCS
23375 System.map*
23376 TAGS
23377 @@ -98,14 +102,18 @@ bzImage*
23378 capability_names.h
23379 capflags.c
23380 classlist.h*
23381 +clut_vga16.c
23382 +common-cmds.h
23383 comp*.log
23384 compile.h*
23385 conf
23386 config
23387 config-*
23388 config_data.h*
23389 +config.c
23390 config.mak
23391 config.mak.autogen
23392 +config.tmp
23393 conmakehash
23394 consolemap_deftbl.c*
23395 cpustr.h
23396 @@ -126,12 +134,14 @@ fore200e_pca_fw.c*
23397 gconf
23398 gconf.glade.h
23399 gen-devlist
23400 +gen-kdb_cmds.c
23401 gen_crc32table
23402 gen_init_cpio
23403 generated
23404 genheaders
23405 genksyms
23406 *_gray256.c
23407 +hash
23408 hpet_example
23409 hugepage-mmap
23410 hugepage-shm
23411 @@ -146,7 +156,7 @@ int32.c
23412 int4.c
23413 int8.c
23414 kallsyms
23415 -kconfig
23416 +kern_constants.h
23417 keywords.c
23418 ksym.c*
23419 ksym.h*
23420 @@ -154,7 +164,6 @@ kxgettext
23421 lkc_defs.h
23422 lex.c
23423 lex.*.c
23424 -linux
23425 logo_*.c
23426 logo_*_clut224.c
23427 logo_*_mono.c
23428 @@ -166,7 +175,6 @@ machtypes.h
23429 map
23430 map_hugetlb
23431 maui_boot.h
23432 -media
23433 mconf
23434 miboot*
23435 mk_elfconfig
23436 @@ -174,6 +182,7 @@ mkboot
23437 mkbugboot
23438 mkcpustr
23439 mkdep
23440 +mkpiggy
23441 mkprep
23442 mkregtable
23443 mktables
23444 @@ -209,6 +218,7 @@ r300_reg_safe.h
23445 r420_reg_safe.h
23446 r600_reg_safe.h
23447 recordmcount
23448 +regdb.c
23449 relocs
23450 rlim_names.h
23451 rn50_reg_safe.h
23452 @@ -219,6 +229,7 @@ setup
23453 setup.bin
23454 setup.elf
23455 sImage
23456 +slabinfo
23457 sm_tbl*
23458 split-include
23459 syscalltab.h
23460 @@ -229,6 +240,7 @@ tftpboot.img
23461 timeconst.h
23462 times.h*
23463 trix_boot.h
23464 +user_constants.h
23465 utsrelease.h*
23466 vdso-syms.lds
23467 vdso.lds
23468 @@ -246,7 +258,9 @@ vmlinux
23469 vmlinux-*
23470 vmlinux.aout
23471 vmlinux.bin.all
23472 +vmlinux.bin.bz2
23473 vmlinux.lds
23474 +vmlinux.relocs
23475 vmlinuz
23476 voffset.h
23477 vsyscall.lds
23478 @@ -254,6 +268,7 @@ vsyscall_32.lds
23479 wanxlfw.inc
23480 uImage
23481 unifdef
23482 +utsrelease.h
23483 wakeup.bin
23484 wakeup.elf
23485 wakeup.lds
23486 diff -urNp linux-3.0.9/Documentation/kernel-parameters.txt linux-3.0.9/Documentation/kernel-parameters.txt
23487 --- linux-3.0.9/Documentation/kernel-parameters.txt 2011-11-11 13:12:24.000000000 -0500
23488 +++ linux-3.0.9/Documentation/kernel-parameters.txt 2011-11-15 20:02:59.000000000 -0500
23489 @@ -1883,6 +1883,13 @@ bytes respectively. Such letter suffixes
23490 the specified number of seconds. This is to be used if
23491 your oopses keep scrolling off the screen.
23492
23493 + pax_nouderef [X86] disables UDEREF. Most likely needed under certain
23494 + virtualization environments that don't cope well with the
23495 + expand down segment used by UDEREF on X86-32 or the frequent
23496 + page table updates on X86-64.
23497 +
23498 + pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
23499 +
23500 pcbit= [HW,ISDN]
23501
23502 pcd. [PARIDE]
23503 diff -urNp linux-3.0.9/drivers/acpi/apei/cper.c linux-3.0.9/drivers/acpi/apei/cper.c
23504 --- linux-3.0.9/drivers/acpi/apei/cper.c 2011-11-11 13:12:24.000000000 -0500
23505 +++ linux-3.0.9/drivers/acpi/apei/cper.c 2011-11-15 20:02:59.000000000 -0500
23506 @@ -38,12 +38,12 @@
23507 */
23508 u64 cper_next_record_id(void)
23509 {
23510 - static atomic64_t seq;
23511 + static atomic64_unchecked_t seq;
23512
23513 - if (!atomic64_read(&seq))
23514 - atomic64_set(&seq, ((u64)get_seconds()) << 32);
23515 + if (!atomic64_read_unchecked(&seq))
23516 + atomic64_set_unchecked(&seq, ((u64)get_seconds()) << 32);
23517
23518 - return atomic64_inc_return(&seq);
23519 + return atomic64_inc_return_unchecked(&seq);
23520 }
23521 EXPORT_SYMBOL_GPL(cper_next_record_id);
23522
23523 diff -urNp linux-3.0.9/drivers/acpi/ec_sys.c linux-3.0.9/drivers/acpi/ec_sys.c
23524 --- linux-3.0.9/drivers/acpi/ec_sys.c 2011-11-11 13:12:24.000000000 -0500
23525 +++ linux-3.0.9/drivers/acpi/ec_sys.c 2011-11-15 20:02:59.000000000 -0500
23526 @@ -11,6 +11,7 @@
23527 #include <linux/kernel.h>
23528 #include <linux/acpi.h>
23529 #include <linux/debugfs.h>
23530 +#include <asm/uaccess.h>
23531 #include "internal.h"
23532
23533 MODULE_AUTHOR("Thomas Renninger <trenn@suse.de>");
23534 @@ -39,7 +40,7 @@ static ssize_t acpi_ec_read_io(struct fi
23535 * struct acpi_ec *ec = ((struct seq_file *)f->private_data)->private;
23536 */
23537 unsigned int size = EC_SPACE_SIZE;
23538 - u8 *data = (u8 *) buf;
23539 + u8 data;
23540 loff_t init_off = *off;
23541 int err = 0;
23542
23543 @@ -52,9 +53,11 @@ static ssize_t acpi_ec_read_io(struct fi
23544 size = count;
23545
23546 while (size) {
23547 - err = ec_read(*off, &data[*off - init_off]);
23548 + err = ec_read(*off, &data);
23549 if (err)
23550 return err;
23551 + if (put_user(data, &buf[*off - init_off]))
23552 + return -EFAULT;
23553 *off += 1;
23554 size--;
23555 }
23556 @@ -70,7 +73,6 @@ static ssize_t acpi_ec_write_io(struct f
23557
23558 unsigned int size = count;
23559 loff_t init_off = *off;
23560 - u8 *data = (u8 *) buf;
23561 int err = 0;
23562
23563 if (*off >= EC_SPACE_SIZE)
23564 @@ -81,7 +83,9 @@ static ssize_t acpi_ec_write_io(struct f
23565 }
23566
23567 while (size) {
23568 - u8 byte_write = data[*off - init_off];
23569 + u8 byte_write;
23570 + if (get_user(byte_write, &buf[*off - init_off]))
23571 + return -EFAULT;
23572 err = ec_write(*off, byte_write);
23573 if (err)
23574 return err;
23575 diff -urNp linux-3.0.9/drivers/acpi/proc.c linux-3.0.9/drivers/acpi/proc.c
23576 --- linux-3.0.9/drivers/acpi/proc.c 2011-11-11 13:12:24.000000000 -0500
23577 +++ linux-3.0.9/drivers/acpi/proc.c 2011-11-15 20:02:59.000000000 -0500
23578 @@ -342,19 +342,13 @@ acpi_system_write_wakeup_device(struct f
23579 size_t count, loff_t * ppos)
23580 {
23581 struct list_head *node, *next;
23582 - char strbuf[5];
23583 - char str[5] = "";
23584 - unsigned int len = count;
23585 -
23586 - if (len > 4)
23587 - len = 4;
23588 - if (len < 0)
23589 - return -EFAULT;
23590 + char strbuf[5] = {0};
23591
23592 - if (copy_from_user(strbuf, buffer, len))
23593 + if (count > 4)
23594 + count = 4;
23595 + if (copy_from_user(strbuf, buffer, count))
23596 return -EFAULT;
23597 - strbuf[len] = '\0';
23598 - sscanf(strbuf, "%s", str);
23599 + strbuf[count] = '\0';
23600
23601 mutex_lock(&acpi_device_lock);
23602 list_for_each_safe(node, next, &acpi_wakeup_device_list) {
23603 @@ -363,7 +357,7 @@ acpi_system_write_wakeup_device(struct f
23604 if (!dev->wakeup.flags.valid)
23605 continue;
23606
23607 - if (!strncmp(dev->pnp.bus_id, str, 4)) {
23608 + if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
23609 if (device_can_wakeup(&dev->dev)) {
23610 bool enable = !device_may_wakeup(&dev->dev);
23611 device_set_wakeup_enable(&dev->dev, enable);
23612 diff -urNp linux-3.0.9/drivers/acpi/processor_driver.c linux-3.0.9/drivers/acpi/processor_driver.c
23613 --- linux-3.0.9/drivers/acpi/processor_driver.c 2011-11-11 13:12:24.000000000 -0500
23614 +++ linux-3.0.9/drivers/acpi/processor_driver.c 2011-11-15 20:02:59.000000000 -0500
23615 @@ -473,7 +473,7 @@ static int __cpuinit acpi_processor_add(
23616 return 0;
23617 #endif
23618
23619 - BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
23620 + BUG_ON(pr->id >= nr_cpu_ids);
23621
23622 /*
23623 * Buggy BIOS check
23624 diff -urNp linux-3.0.9/drivers/ata/libata-core.c linux-3.0.9/drivers/ata/libata-core.c
23625 --- linux-3.0.9/drivers/ata/libata-core.c 2011-11-11 13:12:24.000000000 -0500
23626 +++ linux-3.0.9/drivers/ata/libata-core.c 2011-11-15 20:02:59.000000000 -0500
23627 @@ -4753,7 +4753,7 @@ void ata_qc_free(struct ata_queued_cmd *
23628 struct ata_port *ap;
23629 unsigned int tag;
23630
23631 - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
23632 + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
23633 ap = qc->ap;
23634
23635 qc->flags = 0;
23636 @@ -4769,7 +4769,7 @@ void __ata_qc_complete(struct ata_queued
23637 struct ata_port *ap;
23638 struct ata_link *link;
23639
23640 - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
23641 + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
23642 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
23643 ap = qc->ap;
23644 link = qc->dev->link;
23645 @@ -5774,6 +5774,7 @@ static void ata_finalize_port_ops(struct
23646 return;
23647
23648 spin_lock(&lock);
23649 + pax_open_kernel();
23650
23651 for (cur = ops->inherits; cur; cur = cur->inherits) {
23652 void **inherit = (void **)cur;
23653 @@ -5787,8 +5788,9 @@ static void ata_finalize_port_ops(struct
23654 if (IS_ERR(*pp))
23655 *pp = NULL;
23656
23657 - ops->inherits = NULL;
23658 + *(struct ata_port_operations **)&ops->inherits = NULL;
23659
23660 + pax_close_kernel();
23661 spin_unlock(&lock);
23662 }
23663
23664 diff -urNp linux-3.0.9/drivers/ata/libata-eh.c linux-3.0.9/drivers/ata/libata-eh.c
23665 --- linux-3.0.9/drivers/ata/libata-eh.c 2011-11-11 13:12:24.000000000 -0500
23666 +++ linux-3.0.9/drivers/ata/libata-eh.c 2011-11-15 20:02:59.000000000 -0500
23667 @@ -2518,6 +2518,8 @@ void ata_eh_report(struct ata_port *ap)
23668 {
23669 struct ata_link *link;
23670
23671 + pax_track_stack();
23672 +
23673 ata_for_each_link(link, ap, HOST_FIRST)
23674 ata_eh_link_report(link);
23675 }
23676 diff -urNp linux-3.0.9/drivers/ata/pata_arasan_cf.c linux-3.0.9/drivers/ata/pata_arasan_cf.c
23677 --- linux-3.0.9/drivers/ata/pata_arasan_cf.c 2011-11-11 13:12:24.000000000 -0500
23678 +++ linux-3.0.9/drivers/ata/pata_arasan_cf.c 2011-11-15 20:02:59.000000000 -0500
23679 @@ -862,7 +862,9 @@ static int __devinit arasan_cf_probe(str
23680 /* Handle platform specific quirks */
23681 if (pdata->quirk) {
23682 if (pdata->quirk & CF_BROKEN_PIO) {
23683 - ap->ops->set_piomode = NULL;
23684 + pax_open_kernel();
23685 + *(void **)&ap->ops->set_piomode = NULL;
23686 + pax_close_kernel();
23687 ap->pio_mask = 0;
23688 }
23689 if (pdata->quirk & CF_BROKEN_MWDMA)
23690 diff -urNp linux-3.0.9/drivers/atm/adummy.c linux-3.0.9/drivers/atm/adummy.c
23691 --- linux-3.0.9/drivers/atm/adummy.c 2011-11-11 13:12:24.000000000 -0500
23692 +++ linux-3.0.9/drivers/atm/adummy.c 2011-11-15 20:02:59.000000000 -0500
23693 @@ -114,7 +114,7 @@ adummy_send(struct atm_vcc *vcc, struct
23694 vcc->pop(vcc, skb);
23695 else
23696 dev_kfree_skb_any(skb);
23697 - atomic_inc(&vcc->stats->tx);
23698 + atomic_inc_unchecked(&vcc->stats->tx);
23699
23700 return 0;
23701 }
23702 diff -urNp linux-3.0.9/drivers/atm/ambassador.c linux-3.0.9/drivers/atm/ambassador.c
23703 --- linux-3.0.9/drivers/atm/ambassador.c 2011-11-11 13:12:24.000000000 -0500
23704 +++ linux-3.0.9/drivers/atm/ambassador.c 2011-11-15 20:02:59.000000000 -0500
23705 @@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev,
23706 PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
23707
23708 // VC layer stats
23709 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
23710 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
23711
23712 // free the descriptor
23713 kfree (tx_descr);
23714 @@ -495,7 +495,7 @@ static void rx_complete (amb_dev * dev,
23715 dump_skb ("<<<", vc, skb);
23716
23717 // VC layer stats
23718 - atomic_inc(&atm_vcc->stats->rx);
23719 + atomic_inc_unchecked(&atm_vcc->stats->rx);
23720 __net_timestamp(skb);
23721 // end of our responsibility
23722 atm_vcc->push (atm_vcc, skb);
23723 @@ -510,7 +510,7 @@ static void rx_complete (amb_dev * dev,
23724 } else {
23725 PRINTK (KERN_INFO, "dropped over-size frame");
23726 // should we count this?
23727 - atomic_inc(&atm_vcc->stats->rx_drop);
23728 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
23729 }
23730
23731 } else {
23732 @@ -1342,7 +1342,7 @@ static int amb_send (struct atm_vcc * at
23733 }
23734
23735 if (check_area (skb->data, skb->len)) {
23736 - atomic_inc(&atm_vcc->stats->tx_err);
23737 + atomic_inc_unchecked(&atm_vcc->stats->tx_err);
23738 return -ENOMEM; // ?
23739 }
23740
23741 diff -urNp linux-3.0.9/drivers/atm/atmtcp.c linux-3.0.9/drivers/atm/atmtcp.c
23742 --- linux-3.0.9/drivers/atm/atmtcp.c 2011-11-11 13:12:24.000000000 -0500
23743 +++ linux-3.0.9/drivers/atm/atmtcp.c 2011-11-15 20:02:59.000000000 -0500
23744 @@ -207,7 +207,7 @@ static int atmtcp_v_send(struct atm_vcc
23745 if (vcc->pop) vcc->pop(vcc,skb);
23746 else dev_kfree_skb(skb);
23747 if (dev_data) return 0;
23748 - atomic_inc(&vcc->stats->tx_err);
23749 + atomic_inc_unchecked(&vcc->stats->tx_err);
23750 return -ENOLINK;
23751 }
23752 size = skb->len+sizeof(struct atmtcp_hdr);
23753 @@ -215,7 +215,7 @@ static int atmtcp_v_send(struct atm_vcc
23754 if (!new_skb) {
23755 if (vcc->pop) vcc->pop(vcc,skb);
23756 else dev_kfree_skb(skb);
23757 - atomic_inc(&vcc->stats->tx_err);
23758 + atomic_inc_unchecked(&vcc->stats->tx_err);
23759 return -ENOBUFS;
23760 }
23761 hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
23762 @@ -226,8 +226,8 @@ static int atmtcp_v_send(struct atm_vcc
23763 if (vcc->pop) vcc->pop(vcc,skb);
23764 else dev_kfree_skb(skb);
23765 out_vcc->push(out_vcc,new_skb);
23766 - atomic_inc(&vcc->stats->tx);
23767 - atomic_inc(&out_vcc->stats->rx);
23768 + atomic_inc_unchecked(&vcc->stats->tx);
23769 + atomic_inc_unchecked(&out_vcc->stats->rx);
23770 return 0;
23771 }
23772
23773 @@ -301,7 +301,7 @@ static int atmtcp_c_send(struct atm_vcc
23774 out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
23775 read_unlock(&vcc_sklist_lock);
23776 if (!out_vcc) {
23777 - atomic_inc(&vcc->stats->tx_err);
23778 + atomic_inc_unchecked(&vcc->stats->tx_err);
23779 goto done;
23780 }
23781 skb_pull(skb,sizeof(struct atmtcp_hdr));
23782 @@ -313,8 +313,8 @@ static int atmtcp_c_send(struct atm_vcc
23783 __net_timestamp(new_skb);
23784 skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
23785 out_vcc->push(out_vcc,new_skb);
23786 - atomic_inc(&vcc->stats->tx);
23787 - atomic_inc(&out_vcc->stats->rx);
23788 + atomic_inc_unchecked(&vcc->stats->tx);
23789 + atomic_inc_unchecked(&out_vcc->stats->rx);
23790 done:
23791 if (vcc->pop) vcc->pop(vcc,skb);
23792 else dev_kfree_skb(skb);
23793 diff -urNp linux-3.0.9/drivers/atm/eni.c linux-3.0.9/drivers/atm/eni.c
23794 --- linux-3.0.9/drivers/atm/eni.c 2011-11-11 13:12:24.000000000 -0500
23795 +++ linux-3.0.9/drivers/atm/eni.c 2011-11-15 20:02:59.000000000 -0500
23796 @@ -526,7 +526,7 @@ static int rx_aal0(struct atm_vcc *vcc)
23797 DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
23798 vcc->dev->number);
23799 length = 0;
23800 - atomic_inc(&vcc->stats->rx_err);
23801 + atomic_inc_unchecked(&vcc->stats->rx_err);
23802 }
23803 else {
23804 length = ATM_CELL_SIZE-1; /* no HEC */
23805 @@ -581,7 +581,7 @@ static int rx_aal5(struct atm_vcc *vcc)
23806 size);
23807 }
23808 eff = length = 0;
23809 - atomic_inc(&vcc->stats->rx_err);
23810 + atomic_inc_unchecked(&vcc->stats->rx_err);
23811 }
23812 else {
23813 size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
23814 @@ -598,7 +598,7 @@ static int rx_aal5(struct atm_vcc *vcc)
23815 "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
23816 vcc->dev->number,vcc->vci,length,size << 2,descr);
23817 length = eff = 0;
23818 - atomic_inc(&vcc->stats->rx_err);
23819 + atomic_inc_unchecked(&vcc->stats->rx_err);
23820 }
23821 }
23822 skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
23823 @@ -771,7 +771,7 @@ rx_dequeued++;
23824 vcc->push(vcc,skb);
23825 pushed++;
23826 }
23827 - atomic_inc(&vcc->stats->rx);
23828 + atomic_inc_unchecked(&vcc->stats->rx);
23829 }
23830 wake_up(&eni_dev->rx_wait);
23831 }
23832 @@ -1228,7 +1228,7 @@ static void dequeue_tx(struct atm_dev *d
23833 PCI_DMA_TODEVICE);
23834 if (vcc->pop) vcc->pop(vcc,skb);
23835 else dev_kfree_skb_irq(skb);
23836 - atomic_inc(&vcc->stats->tx);
23837 + atomic_inc_unchecked(&vcc->stats->tx);
23838 wake_up(&eni_dev->tx_wait);
23839 dma_complete++;
23840 }
23841 @@ -1568,7 +1568,7 @@ tx_complete++;
23842 /*--------------------------------- entries ---------------------------------*/
23843
23844
23845 -static const char *media_name[] __devinitdata = {
23846 +static const char *media_name[] __devinitconst = {
23847 "MMF", "SMF", "MMF", "03?", /* 0- 3 */
23848 "UTP", "05?", "06?", "07?", /* 4- 7 */
23849 "TAXI","09?", "10?", "11?", /* 8-11 */
23850 diff -urNp linux-3.0.9/drivers/atm/firestream.c linux-3.0.9/drivers/atm/firestream.c
23851 --- linux-3.0.9/drivers/atm/firestream.c 2011-11-11 13:12:24.000000000 -0500
23852 +++ linux-3.0.9/drivers/atm/firestream.c 2011-11-15 20:02:59.000000000 -0500
23853 @@ -749,7 +749,7 @@ static void process_txdone_queue (struct
23854 }
23855 }
23856
23857 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
23858 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
23859
23860 fs_dprintk (FS_DEBUG_TXMEM, "i");
23861 fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
23862 @@ -816,7 +816,7 @@ static void process_incoming (struct fs_
23863 #endif
23864 skb_put (skb, qe->p1 & 0xffff);
23865 ATM_SKB(skb)->vcc = atm_vcc;
23866 - atomic_inc(&atm_vcc->stats->rx);
23867 + atomic_inc_unchecked(&atm_vcc->stats->rx);
23868 __net_timestamp(skb);
23869 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
23870 atm_vcc->push (atm_vcc, skb);
23871 @@ -837,12 +837,12 @@ static void process_incoming (struct fs_
23872 kfree (pe);
23873 }
23874 if (atm_vcc)
23875 - atomic_inc(&atm_vcc->stats->rx_drop);
23876 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
23877 break;
23878 case 0x1f: /* Reassembly abort: no buffers. */
23879 /* Silently increment error counter. */
23880 if (atm_vcc)
23881 - atomic_inc(&atm_vcc->stats->rx_drop);
23882 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
23883 break;
23884 default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
23885 printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
23886 diff -urNp linux-3.0.9/drivers/atm/fore200e.c linux-3.0.9/drivers/atm/fore200e.c
23887 --- linux-3.0.9/drivers/atm/fore200e.c 2011-11-11 13:12:24.000000000 -0500
23888 +++ linux-3.0.9/drivers/atm/fore200e.c 2011-11-15 20:02:59.000000000 -0500
23889 @@ -933,9 +933,9 @@ fore200e_tx_irq(struct fore200e* fore200
23890 #endif
23891 /* check error condition */
23892 if (*entry->status & STATUS_ERROR)
23893 - atomic_inc(&vcc->stats->tx_err);
23894 + atomic_inc_unchecked(&vcc->stats->tx_err);
23895 else
23896 - atomic_inc(&vcc->stats->tx);
23897 + atomic_inc_unchecked(&vcc->stats->tx);
23898 }
23899 }
23900
23901 @@ -1084,7 +1084,7 @@ fore200e_push_rpd(struct fore200e* fore2
23902 if (skb == NULL) {
23903 DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
23904
23905 - atomic_inc(&vcc->stats->rx_drop);
23906 + atomic_inc_unchecked(&vcc->stats->rx_drop);
23907 return -ENOMEM;
23908 }
23909
23910 @@ -1127,14 +1127,14 @@ fore200e_push_rpd(struct fore200e* fore2
23911
23912 dev_kfree_skb_any(skb);
23913
23914 - atomic_inc(&vcc->stats->rx_drop);
23915 + atomic_inc_unchecked(&vcc->stats->rx_drop);
23916 return -ENOMEM;
23917 }
23918
23919 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
23920
23921 vcc->push(vcc, skb);
23922 - atomic_inc(&vcc->stats->rx);
23923 + atomic_inc_unchecked(&vcc->stats->rx);
23924
23925 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
23926
23927 @@ -1212,7 +1212,7 @@ fore200e_rx_irq(struct fore200e* fore200
23928 DPRINTK(2, "damaged PDU on %d.%d.%d\n",
23929 fore200e->atm_dev->number,
23930 entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
23931 - atomic_inc(&vcc->stats->rx_err);
23932 + atomic_inc_unchecked(&vcc->stats->rx_err);
23933 }
23934 }
23935
23936 @@ -1657,7 +1657,7 @@ fore200e_send(struct atm_vcc *vcc, struc
23937 goto retry_here;
23938 }
23939
23940 - atomic_inc(&vcc->stats->tx_err);
23941 + atomic_inc_unchecked(&vcc->stats->tx_err);
23942
23943 fore200e->tx_sat++;
23944 DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
23945 diff -urNp linux-3.0.9/drivers/atm/he.c linux-3.0.9/drivers/atm/he.c
23946 --- linux-3.0.9/drivers/atm/he.c 2011-11-11 13:12:24.000000000 -0500
23947 +++ linux-3.0.9/drivers/atm/he.c 2011-11-15 20:02:59.000000000 -0500
23948 @@ -1709,7 +1709,7 @@ he_service_rbrq(struct he_dev *he_dev, i
23949
23950 if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
23951 hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
23952 - atomic_inc(&vcc->stats->rx_drop);
23953 + atomic_inc_unchecked(&vcc->stats->rx_drop);
23954 goto return_host_buffers;
23955 }
23956
23957 @@ -1736,7 +1736,7 @@ he_service_rbrq(struct he_dev *he_dev, i
23958 RBRQ_LEN_ERR(he_dev->rbrq_head)
23959 ? "LEN_ERR" : "",
23960 vcc->vpi, vcc->vci);
23961 - atomic_inc(&vcc->stats->rx_err);
23962 + atomic_inc_unchecked(&vcc->stats->rx_err);
23963 goto return_host_buffers;
23964 }
23965
23966 @@ -1788,7 +1788,7 @@ he_service_rbrq(struct he_dev *he_dev, i
23967 vcc->push(vcc, skb);
23968 spin_lock(&he_dev->global_lock);
23969
23970 - atomic_inc(&vcc->stats->rx);
23971 + atomic_inc_unchecked(&vcc->stats->rx);
23972
23973 return_host_buffers:
23974 ++pdus_assembled;
23975 @@ -2114,7 +2114,7 @@ __enqueue_tpd(struct he_dev *he_dev, str
23976 tpd->vcc->pop(tpd->vcc, tpd->skb);
23977 else
23978 dev_kfree_skb_any(tpd->skb);
23979 - atomic_inc(&tpd->vcc->stats->tx_err);
23980 + atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
23981 }
23982 pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
23983 return;
23984 @@ -2526,7 +2526,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
23985 vcc->pop(vcc, skb);
23986 else
23987 dev_kfree_skb_any(skb);
23988 - atomic_inc(&vcc->stats->tx_err);
23989 + atomic_inc_unchecked(&vcc->stats->tx_err);
23990 return -EINVAL;
23991 }
23992
23993 @@ -2537,7 +2537,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
23994 vcc->pop(vcc, skb);
23995 else
23996 dev_kfree_skb_any(skb);
23997 - atomic_inc(&vcc->stats->tx_err);
23998 + atomic_inc_unchecked(&vcc->stats->tx_err);
23999 return -EINVAL;
24000 }
24001 #endif
24002 @@ -2549,7 +2549,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
24003 vcc->pop(vcc, skb);
24004 else
24005 dev_kfree_skb_any(skb);
24006 - atomic_inc(&vcc->stats->tx_err);
24007 + atomic_inc_unchecked(&vcc->stats->tx_err);
24008 spin_unlock_irqrestore(&he_dev->global_lock, flags);
24009 return -ENOMEM;
24010 }
24011 @@ -2591,7 +2591,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
24012 vcc->pop(vcc, skb);
24013 else
24014 dev_kfree_skb_any(skb);
24015 - atomic_inc(&vcc->stats->tx_err);
24016 + atomic_inc_unchecked(&vcc->stats->tx_err);
24017 spin_unlock_irqrestore(&he_dev->global_lock, flags);
24018 return -ENOMEM;
24019 }
24020 @@ -2622,7 +2622,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
24021 __enqueue_tpd(he_dev, tpd, cid);
24022 spin_unlock_irqrestore(&he_dev->global_lock, flags);
24023
24024 - atomic_inc(&vcc->stats->tx);
24025 + atomic_inc_unchecked(&vcc->stats->tx);
24026
24027 return 0;
24028 }
24029 diff -urNp linux-3.0.9/drivers/atm/horizon.c linux-3.0.9/drivers/atm/horizon.c
24030 --- linux-3.0.9/drivers/atm/horizon.c 2011-11-11 13:12:24.000000000 -0500
24031 +++ linux-3.0.9/drivers/atm/horizon.c 2011-11-15 20:02:59.000000000 -0500
24032 @@ -1034,7 +1034,7 @@ static void rx_schedule (hrz_dev * dev,
24033 {
24034 struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
24035 // VC layer stats
24036 - atomic_inc(&vcc->stats->rx);
24037 + atomic_inc_unchecked(&vcc->stats->rx);
24038 __net_timestamp(skb);
24039 // end of our responsibility
24040 vcc->push (vcc, skb);
24041 @@ -1186,7 +1186,7 @@ static void tx_schedule (hrz_dev * const
24042 dev->tx_iovec = NULL;
24043
24044 // VC layer stats
24045 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
24046 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
24047
24048 // free the skb
24049 hrz_kfree_skb (skb);
24050 diff -urNp linux-3.0.9/drivers/atm/idt77252.c linux-3.0.9/drivers/atm/idt77252.c
24051 --- linux-3.0.9/drivers/atm/idt77252.c 2011-11-11 13:12:24.000000000 -0500
24052 +++ linux-3.0.9/drivers/atm/idt77252.c 2011-11-15 20:02:59.000000000 -0500
24053 @@ -811,7 +811,7 @@ drain_scq(struct idt77252_dev *card, str
24054 else
24055 dev_kfree_skb(skb);
24056
24057 - atomic_inc(&vcc->stats->tx);
24058 + atomic_inc_unchecked(&vcc->stats->tx);
24059 }
24060
24061 atomic_dec(&scq->used);
24062 @@ -1074,13 +1074,13 @@ dequeue_rx(struct idt77252_dev *card, st
24063 if ((sb = dev_alloc_skb(64)) == NULL) {
24064 printk("%s: Can't allocate buffers for aal0.\n",
24065 card->name);
24066 - atomic_add(i, &vcc->stats->rx_drop);
24067 + atomic_add_unchecked(i, &vcc->stats->rx_drop);
24068 break;
24069 }
24070 if (!atm_charge(vcc, sb->truesize)) {
24071 RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
24072 card->name);
24073 - atomic_add(i - 1, &vcc->stats->rx_drop);
24074 + atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
24075 dev_kfree_skb(sb);
24076 break;
24077 }
24078 @@ -1097,7 +1097,7 @@ dequeue_rx(struct idt77252_dev *card, st
24079 ATM_SKB(sb)->vcc = vcc;
24080 __net_timestamp(sb);
24081 vcc->push(vcc, sb);
24082 - atomic_inc(&vcc->stats->rx);
24083 + atomic_inc_unchecked(&vcc->stats->rx);
24084
24085 cell += ATM_CELL_PAYLOAD;
24086 }
24087 @@ -1134,13 +1134,13 @@ dequeue_rx(struct idt77252_dev *card, st
24088 "(CDC: %08x)\n",
24089 card->name, len, rpp->len, readl(SAR_REG_CDC));
24090 recycle_rx_pool_skb(card, rpp);
24091 - atomic_inc(&vcc->stats->rx_err);
24092 + atomic_inc_unchecked(&vcc->stats->rx_err);
24093 return;
24094 }
24095 if (stat & SAR_RSQE_CRC) {
24096 RXPRINTK("%s: AAL5 CRC error.\n", card->name);
24097 recycle_rx_pool_skb(card, rpp);
24098 - atomic_inc(&vcc->stats->rx_err);
24099 + atomic_inc_unchecked(&vcc->stats->rx_err);
24100 return;
24101 }
24102 if (skb_queue_len(&rpp->queue) > 1) {
24103 @@ -1151,7 +1151,7 @@ dequeue_rx(struct idt77252_dev *card, st
24104 RXPRINTK("%s: Can't alloc RX skb.\n",
24105 card->name);
24106 recycle_rx_pool_skb(card, rpp);
24107 - atomic_inc(&vcc->stats->rx_err);
24108 + atomic_inc_unchecked(&vcc->stats->rx_err);
24109 return;
24110 }
24111 if (!atm_charge(vcc, skb->truesize)) {
24112 @@ -1170,7 +1170,7 @@ dequeue_rx(struct idt77252_dev *card, st
24113 __net_timestamp(skb);
24114
24115 vcc->push(vcc, skb);
24116 - atomic_inc(&vcc->stats->rx);
24117 + atomic_inc_unchecked(&vcc->stats->rx);
24118
24119 return;
24120 }
24121 @@ -1192,7 +1192,7 @@ dequeue_rx(struct idt77252_dev *card, st
24122 __net_timestamp(skb);
24123
24124 vcc->push(vcc, skb);
24125 - atomic_inc(&vcc->stats->rx);
24126 + atomic_inc_unchecked(&vcc->stats->rx);
24127
24128 if (skb->truesize > SAR_FB_SIZE_3)
24129 add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
24130 @@ -1303,14 +1303,14 @@ idt77252_rx_raw(struct idt77252_dev *car
24131 if (vcc->qos.aal != ATM_AAL0) {
24132 RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
24133 card->name, vpi, vci);
24134 - atomic_inc(&vcc->stats->rx_drop);
24135 + atomic_inc_unchecked(&vcc->stats->rx_drop);
24136 goto drop;
24137 }
24138
24139 if ((sb = dev_alloc_skb(64)) == NULL) {
24140 printk("%s: Can't allocate buffers for AAL0.\n",
24141 card->name);
24142 - atomic_inc(&vcc->stats->rx_err);
24143 + atomic_inc_unchecked(&vcc->stats->rx_err);
24144 goto drop;
24145 }
24146
24147 @@ -1329,7 +1329,7 @@ idt77252_rx_raw(struct idt77252_dev *car
24148 ATM_SKB(sb)->vcc = vcc;
24149 __net_timestamp(sb);
24150 vcc->push(vcc, sb);
24151 - atomic_inc(&vcc->stats->rx);
24152 + atomic_inc_unchecked(&vcc->stats->rx);
24153
24154 drop:
24155 skb_pull(queue, 64);
24156 @@ -1954,13 +1954,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s
24157
24158 if (vc == NULL) {
24159 printk("%s: NULL connection in send().\n", card->name);
24160 - atomic_inc(&vcc->stats->tx_err);
24161 + atomic_inc_unchecked(&vcc->stats->tx_err);
24162 dev_kfree_skb(skb);
24163 return -EINVAL;
24164 }
24165 if (!test_bit(VCF_TX, &vc->flags)) {
24166 printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
24167 - atomic_inc(&vcc->stats->tx_err);
24168 + atomic_inc_unchecked(&vcc->stats->tx_err);
24169 dev_kfree_skb(skb);
24170 return -EINVAL;
24171 }
24172 @@ -1972,14 +1972,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s
24173 break;
24174 default:
24175 printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
24176 - atomic_inc(&vcc->stats->tx_err);
24177 + atomic_inc_unchecked(&vcc->stats->tx_err);
24178 dev_kfree_skb(skb);
24179 return -EINVAL;
24180 }
24181
24182 if (skb_shinfo(skb)->nr_frags != 0) {
24183 printk("%s: No scatter-gather yet.\n", card->name);
24184 - atomic_inc(&vcc->stats->tx_err);
24185 + atomic_inc_unchecked(&vcc->stats->tx_err);
24186 dev_kfree_skb(skb);
24187 return -EINVAL;
24188 }
24189 @@ -1987,7 +1987,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s
24190
24191 err = queue_skb(card, vc, skb, oam);
24192 if (err) {
24193 - atomic_inc(&vcc->stats->tx_err);
24194 + atomic_inc_unchecked(&vcc->stats->tx_err);
24195 dev_kfree_skb(skb);
24196 return err;
24197 }
24198 @@ -2010,7 +2010,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v
24199 skb = dev_alloc_skb(64);
24200 if (!skb) {
24201 printk("%s: Out of memory in send_oam().\n", card->name);
24202 - atomic_inc(&vcc->stats->tx_err);
24203 + atomic_inc_unchecked(&vcc->stats->tx_err);
24204 return -ENOMEM;
24205 }
24206 atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
24207 diff -urNp linux-3.0.9/drivers/atm/iphase.c linux-3.0.9/drivers/atm/iphase.c
24208 --- linux-3.0.9/drivers/atm/iphase.c 2011-11-11 13:12:24.000000000 -0500
24209 +++ linux-3.0.9/drivers/atm/iphase.c 2011-11-15 20:02:59.000000000 -0500
24210 @@ -1120,7 +1120,7 @@ static int rx_pkt(struct atm_dev *dev)
24211 status = (u_short) (buf_desc_ptr->desc_mode);
24212 if (status & (RX_CER | RX_PTE | RX_OFL))
24213 {
24214 - atomic_inc(&vcc->stats->rx_err);
24215 + atomic_inc_unchecked(&vcc->stats->rx_err);
24216 IF_ERR(printk("IA: bad packet, dropping it");)
24217 if (status & RX_CER) {
24218 IF_ERR(printk(" cause: packet CRC error\n");)
24219 @@ -1143,7 +1143,7 @@ static int rx_pkt(struct atm_dev *dev)
24220 len = dma_addr - buf_addr;
24221 if (len > iadev->rx_buf_sz) {
24222 printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
24223 - atomic_inc(&vcc->stats->rx_err);
24224 + atomic_inc_unchecked(&vcc->stats->rx_err);
24225 goto out_free_desc;
24226 }
24227
24228 @@ -1293,7 +1293,7 @@ static void rx_dle_intr(struct atm_dev *
24229 ia_vcc = INPH_IA_VCC(vcc);
24230 if (ia_vcc == NULL)
24231 {
24232 - atomic_inc(&vcc->stats->rx_err);
24233 + atomic_inc_unchecked(&vcc->stats->rx_err);
24234 dev_kfree_skb_any(skb);
24235 atm_return(vcc, atm_guess_pdu2truesize(len));
24236 goto INCR_DLE;
24237 @@ -1305,7 +1305,7 @@ static void rx_dle_intr(struct atm_dev *
24238 if ((length > iadev->rx_buf_sz) || (length >
24239 (skb->len - sizeof(struct cpcs_trailer))))
24240 {
24241 - atomic_inc(&vcc->stats->rx_err);
24242 + atomic_inc_unchecked(&vcc->stats->rx_err);
24243 IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
24244 length, skb->len);)
24245 dev_kfree_skb_any(skb);
24246 @@ -1321,7 +1321,7 @@ static void rx_dle_intr(struct atm_dev *
24247
24248 IF_RX(printk("rx_dle_intr: skb push");)
24249 vcc->push(vcc,skb);
24250 - atomic_inc(&vcc->stats->rx);
24251 + atomic_inc_unchecked(&vcc->stats->rx);
24252 iadev->rx_pkt_cnt++;
24253 }
24254 INCR_DLE:
24255 @@ -2801,15 +2801,15 @@ static int ia_ioctl(struct atm_dev *dev,
24256 {
24257 struct k_sonet_stats *stats;
24258 stats = &PRIV(_ia_dev[board])->sonet_stats;
24259 - printk("section_bip: %d\n", atomic_read(&stats->section_bip));
24260 - printk("line_bip : %d\n", atomic_read(&stats->line_bip));
24261 - printk("path_bip : %d\n", atomic_read(&stats->path_bip));
24262 - printk("line_febe : %d\n", atomic_read(&stats->line_febe));
24263 - printk("path_febe : %d\n", atomic_read(&stats->path_febe));
24264 - printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
24265 - printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
24266 - printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
24267 - printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
24268 + printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
24269 + printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
24270 + printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
24271 + printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
24272 + printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
24273 + printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
24274 + printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
24275 + printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
24276 + printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
24277 }
24278 ia_cmds.status = 0;
24279 break;
24280 @@ -2914,7 +2914,7 @@ static int ia_pkt_tx (struct atm_vcc *vc
24281 if ((desc == 0) || (desc > iadev->num_tx_desc))
24282 {
24283 IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
24284 - atomic_inc(&vcc->stats->tx);
24285 + atomic_inc_unchecked(&vcc->stats->tx);
24286 if (vcc->pop)
24287 vcc->pop(vcc, skb);
24288 else
24289 @@ -3019,14 +3019,14 @@ static int ia_pkt_tx (struct atm_vcc *vc
24290 ATM_DESC(skb) = vcc->vci;
24291 skb_queue_tail(&iadev->tx_dma_q, skb);
24292
24293 - atomic_inc(&vcc->stats->tx);
24294 + atomic_inc_unchecked(&vcc->stats->tx);
24295 iadev->tx_pkt_cnt++;
24296 /* Increment transaction counter */
24297 writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
24298
24299 #if 0
24300 /* add flow control logic */
24301 - if (atomic_read(&vcc->stats->tx) % 20 == 0) {
24302 + if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
24303 if (iavcc->vc_desc_cnt > 10) {
24304 vcc->tx_quota = vcc->tx_quota * 3 / 4;
24305 printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
24306 diff -urNp linux-3.0.9/drivers/atm/lanai.c linux-3.0.9/drivers/atm/lanai.c
24307 --- linux-3.0.9/drivers/atm/lanai.c 2011-11-11 13:12:24.000000000 -0500
24308 +++ linux-3.0.9/drivers/atm/lanai.c 2011-11-15 20:02:59.000000000 -0500
24309 @@ -1303,7 +1303,7 @@ static void lanai_send_one_aal5(struct l
24310 vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
24311 lanai_endtx(lanai, lvcc);
24312 lanai_free_skb(lvcc->tx.atmvcc, skb);
24313 - atomic_inc(&lvcc->tx.atmvcc->stats->tx);
24314 + atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
24315 }
24316
24317 /* Try to fill the buffer - don't call unless there is backlog */
24318 @@ -1426,7 +1426,7 @@ static void vcc_rx_aal5(struct lanai_vcc
24319 ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
24320 __net_timestamp(skb);
24321 lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
24322 - atomic_inc(&lvcc->rx.atmvcc->stats->rx);
24323 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
24324 out:
24325 lvcc->rx.buf.ptr = end;
24326 cardvcc_write(lvcc, endptr, vcc_rxreadptr);
24327 @@ -1668,7 +1668,7 @@ static int handle_service(struct lanai_d
24328 DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
24329 "vcc %d\n", lanai->number, (unsigned int) s, vci);
24330 lanai->stats.service_rxnotaal5++;
24331 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
24332 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
24333 return 0;
24334 }
24335 if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
24336 @@ -1680,7 +1680,7 @@ static int handle_service(struct lanai_d
24337 int bytes;
24338 read_unlock(&vcc_sklist_lock);
24339 DPRINTK("got trashed rx pdu on vci %d\n", vci);
24340 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
24341 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
24342 lvcc->stats.x.aal5.service_trash++;
24343 bytes = (SERVICE_GET_END(s) * 16) -
24344 (((unsigned long) lvcc->rx.buf.ptr) -
24345 @@ -1692,7 +1692,7 @@ static int handle_service(struct lanai_d
24346 }
24347 if (s & SERVICE_STREAM) {
24348 read_unlock(&vcc_sklist_lock);
24349 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
24350 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
24351 lvcc->stats.x.aal5.service_stream++;
24352 printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
24353 "PDU on VCI %d!\n", lanai->number, vci);
24354 @@ -1700,7 +1700,7 @@ static int handle_service(struct lanai_d
24355 return 0;
24356 }
24357 DPRINTK("got rx crc error on vci %d\n", vci);
24358 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
24359 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
24360 lvcc->stats.x.aal5.service_rxcrc++;
24361 lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
24362 cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
24363 diff -urNp linux-3.0.9/drivers/atm/nicstar.c linux-3.0.9/drivers/atm/nicstar.c
24364 --- linux-3.0.9/drivers/atm/nicstar.c 2011-11-11 13:12:24.000000000 -0500
24365 +++ linux-3.0.9/drivers/atm/nicstar.c 2011-11-15 20:02:59.000000000 -0500
24366 @@ -1654,7 +1654,7 @@ static int ns_send(struct atm_vcc *vcc,
24367 if ((vc = (vc_map *) vcc->dev_data) == NULL) {
24368 printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n",
24369 card->index);
24370 - atomic_inc(&vcc->stats->tx_err);
24371 + atomic_inc_unchecked(&vcc->stats->tx_err);
24372 dev_kfree_skb_any(skb);
24373 return -EINVAL;
24374 }
24375 @@ -1662,7 +1662,7 @@ static int ns_send(struct atm_vcc *vcc,
24376 if (!vc->tx) {
24377 printk("nicstar%d: Trying to transmit on a non-tx VC.\n",
24378 card->index);
24379 - atomic_inc(&vcc->stats->tx_err);
24380 + atomic_inc_unchecked(&vcc->stats->tx_err);
24381 dev_kfree_skb_any(skb);
24382 return -EINVAL;
24383 }
24384 @@ -1670,14 +1670,14 @@ static int ns_send(struct atm_vcc *vcc,
24385 if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0) {
24386 printk("nicstar%d: Only AAL0 and AAL5 are supported.\n",
24387 card->index);
24388 - atomic_inc(&vcc->stats->tx_err);
24389 + atomic_inc_unchecked(&vcc->stats->tx_err);
24390 dev_kfree_skb_any(skb);
24391 return -EINVAL;
24392 }
24393
24394 if (skb_shinfo(skb)->nr_frags != 0) {
24395 printk("nicstar%d: No scatter-gather yet.\n", card->index);
24396 - atomic_inc(&vcc->stats->tx_err);
24397 + atomic_inc_unchecked(&vcc->stats->tx_err);
24398 dev_kfree_skb_any(skb);
24399 return -EINVAL;
24400 }
24401 @@ -1725,11 +1725,11 @@ static int ns_send(struct atm_vcc *vcc,
24402 }
24403
24404 if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
24405 - atomic_inc(&vcc->stats->tx_err);
24406 + atomic_inc_unchecked(&vcc->stats->tx_err);
24407 dev_kfree_skb_any(skb);
24408 return -EIO;
24409 }
24410 - atomic_inc(&vcc->stats->tx);
24411 + atomic_inc_unchecked(&vcc->stats->tx);
24412
24413 return 0;
24414 }
24415 @@ -2046,14 +2046,14 @@ static void dequeue_rx(ns_dev * card, ns
24416 printk
24417 ("nicstar%d: Can't allocate buffers for aal0.\n",
24418 card->index);
24419 - atomic_add(i, &vcc->stats->rx_drop);
24420 + atomic_add_unchecked(i, &vcc->stats->rx_drop);
24421 break;
24422 }
24423 if (!atm_charge(vcc, sb->truesize)) {
24424 RXPRINTK
24425 ("nicstar%d: atm_charge() dropped aal0 packets.\n",
24426 card->index);
24427 - atomic_add(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
24428 + atomic_add_unchecked(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
24429 dev_kfree_skb_any(sb);
24430 break;
24431 }
24432 @@ -2068,7 +2068,7 @@ static void dequeue_rx(ns_dev * card, ns
24433 ATM_SKB(sb)->vcc = vcc;
24434 __net_timestamp(sb);
24435 vcc->push(vcc, sb);
24436 - atomic_inc(&vcc->stats->rx);
24437 + atomic_inc_unchecked(&vcc->stats->rx);
24438 cell += ATM_CELL_PAYLOAD;
24439 }
24440
24441 @@ -2085,7 +2085,7 @@ static void dequeue_rx(ns_dev * card, ns
24442 if (iovb == NULL) {
24443 printk("nicstar%d: Out of iovec buffers.\n",
24444 card->index);
24445 - atomic_inc(&vcc->stats->rx_drop);
24446 + atomic_inc_unchecked(&vcc->stats->rx_drop);
24447 recycle_rx_buf(card, skb);
24448 return;
24449 }
24450 @@ -2109,7 +2109,7 @@ static void dequeue_rx(ns_dev * card, ns
24451 small or large buffer itself. */
24452 } else if (NS_PRV_IOVCNT(iovb) >= NS_MAX_IOVECS) {
24453 printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
24454 - atomic_inc(&vcc->stats->rx_err);
24455 + atomic_inc_unchecked(&vcc->stats->rx_err);
24456 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
24457 NS_MAX_IOVECS);
24458 NS_PRV_IOVCNT(iovb) = 0;
24459 @@ -2129,7 +2129,7 @@ static void dequeue_rx(ns_dev * card, ns
24460 ("nicstar%d: Expected a small buffer, and this is not one.\n",
24461 card->index);
24462 which_list(card, skb);
24463 - atomic_inc(&vcc->stats->rx_err);
24464 + atomic_inc_unchecked(&vcc->stats->rx_err);
24465 recycle_rx_buf(card, skb);
24466 vc->rx_iov = NULL;
24467 recycle_iov_buf(card, iovb);
24468 @@ -2142,7 +2142,7 @@ static void dequeue_rx(ns_dev * card, ns
24469 ("nicstar%d: Expected a large buffer, and this is not one.\n",
24470 card->index);
24471 which_list(card, skb);
24472 - atomic_inc(&vcc->stats->rx_err);
24473 + atomic_inc_unchecked(&vcc->stats->rx_err);
24474 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
24475 NS_PRV_IOVCNT(iovb));
24476 vc->rx_iov = NULL;
24477 @@ -2165,7 +2165,7 @@ static void dequeue_rx(ns_dev * card, ns
24478 printk(" - PDU size mismatch.\n");
24479 else
24480 printk(".\n");
24481 - atomic_inc(&vcc->stats->rx_err);
24482 + atomic_inc_unchecked(&vcc->stats->rx_err);
24483 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
24484 NS_PRV_IOVCNT(iovb));
24485 vc->rx_iov = NULL;
24486 @@ -2179,7 +2179,7 @@ static void dequeue_rx(ns_dev * card, ns
24487 /* skb points to a small buffer */
24488 if (!atm_charge(vcc, skb->truesize)) {
24489 push_rxbufs(card, skb);
24490 - atomic_inc(&vcc->stats->rx_drop);
24491 + atomic_inc_unchecked(&vcc->stats->rx_drop);
24492 } else {
24493 skb_put(skb, len);
24494 dequeue_sm_buf(card, skb);
24495 @@ -2189,7 +2189,7 @@ static void dequeue_rx(ns_dev * card, ns
24496 ATM_SKB(skb)->vcc = vcc;
24497 __net_timestamp(skb);
24498 vcc->push(vcc, skb);
24499 - atomic_inc(&vcc->stats->rx);
24500 + atomic_inc_unchecked(&vcc->stats->rx);
24501 }
24502 } else if (NS_PRV_IOVCNT(iovb) == 2) { /* One small plus one large buffer */
24503 struct sk_buff *sb;
24504 @@ -2200,7 +2200,7 @@ static void dequeue_rx(ns_dev * card, ns
24505 if (len <= NS_SMBUFSIZE) {
24506 if (!atm_charge(vcc, sb->truesize)) {
24507 push_rxbufs(card, sb);
24508 - atomic_inc(&vcc->stats->rx_drop);
24509 + atomic_inc_unchecked(&vcc->stats->rx_drop);
24510 } else {
24511 skb_put(sb, len);
24512 dequeue_sm_buf(card, sb);
24513 @@ -2210,7 +2210,7 @@ static void dequeue_rx(ns_dev * card, ns
24514 ATM_SKB(sb)->vcc = vcc;
24515 __net_timestamp(sb);
24516 vcc->push(vcc, sb);
24517 - atomic_inc(&vcc->stats->rx);
24518 + atomic_inc_unchecked(&vcc->stats->rx);
24519 }
24520
24521 push_rxbufs(card, skb);
24522 @@ -2219,7 +2219,7 @@ static void dequeue_rx(ns_dev * card, ns
24523
24524 if (!atm_charge(vcc, skb->truesize)) {
24525 push_rxbufs(card, skb);
24526 - atomic_inc(&vcc->stats->rx_drop);
24527 + atomic_inc_unchecked(&vcc->stats->rx_drop);
24528 } else {
24529 dequeue_lg_buf(card, skb);
24530 #ifdef NS_USE_DESTRUCTORS
24531 @@ -2232,7 +2232,7 @@ static void dequeue_rx(ns_dev * card, ns
24532 ATM_SKB(skb)->vcc = vcc;
24533 __net_timestamp(skb);
24534 vcc->push(vcc, skb);
24535 - atomic_inc(&vcc->stats->rx);
24536 + atomic_inc_unchecked(&vcc->stats->rx);
24537 }
24538
24539 push_rxbufs(card, sb);
24540 @@ -2253,7 +2253,7 @@ static void dequeue_rx(ns_dev * card, ns
24541 printk
24542 ("nicstar%d: Out of huge buffers.\n",
24543 card->index);
24544 - atomic_inc(&vcc->stats->rx_drop);
24545 + atomic_inc_unchecked(&vcc->stats->rx_drop);
24546 recycle_iovec_rx_bufs(card,
24547 (struct iovec *)
24548 iovb->data,
24549 @@ -2304,7 +2304,7 @@ static void dequeue_rx(ns_dev * card, ns
24550 card->hbpool.count++;
24551 } else
24552 dev_kfree_skb_any(hb);
24553 - atomic_inc(&vcc->stats->rx_drop);
24554 + atomic_inc_unchecked(&vcc->stats->rx_drop);
24555 } else {
24556 /* Copy the small buffer to the huge buffer */
24557 sb = (struct sk_buff *)iov->iov_base;
24558 @@ -2341,7 +2341,7 @@ static void dequeue_rx(ns_dev * card, ns
24559 #endif /* NS_USE_DESTRUCTORS */
24560 __net_timestamp(hb);
24561 vcc->push(vcc, hb);
24562 - atomic_inc(&vcc->stats->rx);
24563 + atomic_inc_unchecked(&vcc->stats->rx);
24564 }
24565 }
24566
24567 diff -urNp linux-3.0.9/drivers/atm/solos-pci.c linux-3.0.9/drivers/atm/solos-pci.c
24568 --- linux-3.0.9/drivers/atm/solos-pci.c 2011-11-11 13:12:24.000000000 -0500
24569 +++ linux-3.0.9/drivers/atm/solos-pci.c 2011-11-15 20:02:59.000000000 -0500
24570 @@ -714,7 +714,7 @@ void solos_bh(unsigned long card_arg)
24571 }
24572 atm_charge(vcc, skb->truesize);
24573 vcc->push(vcc, skb);
24574 - atomic_inc(&vcc->stats->rx);
24575 + atomic_inc_unchecked(&vcc->stats->rx);
24576 break;
24577
24578 case PKT_STATUS:
24579 @@ -899,6 +899,8 @@ static int print_buffer(struct sk_buff *
24580 char msg[500];
24581 char item[10];
24582
24583 + pax_track_stack();
24584 +
24585 len = buf->len;
24586 for (i = 0; i < len; i++){
24587 if(i % 8 == 0)
24588 @@ -1008,7 +1010,7 @@ static uint32_t fpga_tx(struct solos_car
24589 vcc = SKB_CB(oldskb)->vcc;
24590
24591 if (vcc) {
24592 - atomic_inc(&vcc->stats->tx);
24593 + atomic_inc_unchecked(&vcc->stats->tx);
24594 solos_pop(vcc, oldskb);
24595 } else
24596 dev_kfree_skb_irq(oldskb);
24597 diff -urNp linux-3.0.9/drivers/atm/suni.c linux-3.0.9/drivers/atm/suni.c
24598 --- linux-3.0.9/drivers/atm/suni.c 2011-11-11 13:12:24.000000000 -0500
24599 +++ linux-3.0.9/drivers/atm/suni.c 2011-11-15 20:02:59.000000000 -0500
24600 @@ -50,8 +50,8 @@ static DEFINE_SPINLOCK(sunis_lock);
24601
24602
24603 #define ADD_LIMITED(s,v) \
24604 - atomic_add((v),&stats->s); \
24605 - if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
24606 + atomic_add_unchecked((v),&stats->s); \
24607 + if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
24608
24609
24610 static void suni_hz(unsigned long from_timer)
24611 diff -urNp linux-3.0.9/drivers/atm/uPD98402.c linux-3.0.9/drivers/atm/uPD98402.c
24612 --- linux-3.0.9/drivers/atm/uPD98402.c 2011-11-11 13:12:24.000000000 -0500
24613 +++ linux-3.0.9/drivers/atm/uPD98402.c 2011-11-15 20:02:59.000000000 -0500
24614 @@ -42,7 +42,7 @@ static int fetch_stats(struct atm_dev *d
24615 struct sonet_stats tmp;
24616 int error = 0;
24617
24618 - atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
24619 + atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
24620 sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
24621 if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
24622 if (zero && !error) {
24623 @@ -161,9 +161,9 @@ static int uPD98402_ioctl(struct atm_dev
24624
24625
24626 #define ADD_LIMITED(s,v) \
24627 - { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
24628 - if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
24629 - atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
24630 + { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
24631 + if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
24632 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
24633
24634
24635 static void stat_event(struct atm_dev *dev)
24636 @@ -194,7 +194,7 @@ static void uPD98402_int(struct atm_dev
24637 if (reason & uPD98402_INT_PFM) stat_event(dev);
24638 if (reason & uPD98402_INT_PCO) {
24639 (void) GET(PCOCR); /* clear interrupt cause */
24640 - atomic_add(GET(HECCT),
24641 + atomic_add_unchecked(GET(HECCT),
24642 &PRIV(dev)->sonet_stats.uncorr_hcs);
24643 }
24644 if ((reason & uPD98402_INT_RFO) &&
24645 @@ -222,9 +222,9 @@ static int uPD98402_start(struct atm_dev
24646 PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
24647 uPD98402_INT_LOS),PIMR); /* enable them */
24648 (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
24649 - atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
24650 - atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
24651 - atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
24652 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
24653 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
24654 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
24655 return 0;
24656 }
24657
24658 diff -urNp linux-3.0.9/drivers/atm/zatm.c linux-3.0.9/drivers/atm/zatm.c
24659 --- linux-3.0.9/drivers/atm/zatm.c 2011-11-11 13:12:24.000000000 -0500
24660 +++ linux-3.0.9/drivers/atm/zatm.c 2011-11-15 20:02:59.000000000 -0500
24661 @@ -459,7 +459,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
24662 }
24663 if (!size) {
24664 dev_kfree_skb_irq(skb);
24665 - if (vcc) atomic_inc(&vcc->stats->rx_err);
24666 + if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
24667 continue;
24668 }
24669 if (!atm_charge(vcc,skb->truesize)) {
24670 @@ -469,7 +469,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
24671 skb->len = size;
24672 ATM_SKB(skb)->vcc = vcc;
24673 vcc->push(vcc,skb);
24674 - atomic_inc(&vcc->stats->rx);
24675 + atomic_inc_unchecked(&vcc->stats->rx);
24676 }
24677 zout(pos & 0xffff,MTA(mbx));
24678 #if 0 /* probably a stupid idea */
24679 @@ -733,7 +733,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD
24680 skb_queue_head(&zatm_vcc->backlog,skb);
24681 break;
24682 }
24683 - atomic_inc(&vcc->stats->tx);
24684 + atomic_inc_unchecked(&vcc->stats->tx);
24685 wake_up(&zatm_vcc->tx_wait);
24686 }
24687
24688 diff -urNp linux-3.0.9/drivers/base/devtmpfs.c linux-3.0.9/drivers/base/devtmpfs.c
24689 --- linux-3.0.9/drivers/base/devtmpfs.c 2011-11-11 13:12:24.000000000 -0500
24690 +++ linux-3.0.9/drivers/base/devtmpfs.c 2011-11-15 20:02:59.000000000 -0500
24691 @@ -357,7 +357,7 @@ int devtmpfs_mount(const char *mntdir)
24692 if (!dev_mnt)
24693 return 0;
24694
24695 - err = sys_mount("devtmpfs", (char *)mntdir, "devtmpfs", MS_SILENT, NULL);
24696 + err = sys_mount((char __force_user *)"devtmpfs", (char __force_user *)mntdir, (char __force_user *)"devtmpfs", MS_SILENT, NULL);
24697 if (err)
24698 printk(KERN_INFO "devtmpfs: error mounting %i\n", err);
24699 else
24700 diff -urNp linux-3.0.9/drivers/base/power/wakeup.c linux-3.0.9/drivers/base/power/wakeup.c
24701 --- linux-3.0.9/drivers/base/power/wakeup.c 2011-11-11 13:12:24.000000000 -0500
24702 +++ linux-3.0.9/drivers/base/power/wakeup.c 2011-11-15 20:02:59.000000000 -0500
24703 @@ -29,14 +29,14 @@ bool events_check_enabled;
24704 * They need to be modified together atomically, so it's better to use one
24705 * atomic variable to hold them both.
24706 */
24707 -static atomic_t combined_event_count = ATOMIC_INIT(0);
24708 +static atomic_unchecked_t combined_event_count = ATOMIC_INIT(0);
24709
24710 #define IN_PROGRESS_BITS (sizeof(int) * 4)
24711 #define MAX_IN_PROGRESS ((1 << IN_PROGRESS_BITS) - 1)
24712
24713 static void split_counters(unsigned int *cnt, unsigned int *inpr)
24714 {
24715 - unsigned int comb = atomic_read(&combined_event_count);
24716 + unsigned int comb = atomic_read_unchecked(&combined_event_count);
24717
24718 *cnt = (comb >> IN_PROGRESS_BITS);
24719 *inpr = comb & MAX_IN_PROGRESS;
24720 @@ -350,7 +350,7 @@ static void wakeup_source_activate(struc
24721 ws->last_time = ktime_get();
24722
24723 /* Increment the counter of events in progress. */
24724 - atomic_inc(&combined_event_count);
24725 + atomic_inc_unchecked(&combined_event_count);
24726 }
24727
24728 /**
24729 @@ -440,7 +440,7 @@ static void wakeup_source_deactivate(str
24730 * Increment the counter of registered wakeup events and decrement the
24731 * couter of wakeup events in progress simultaneously.
24732 */
24733 - atomic_add(MAX_IN_PROGRESS, &combined_event_count);
24734 + atomic_add_unchecked(MAX_IN_PROGRESS, &combined_event_count);
24735 }
24736
24737 /**
24738 diff -urNp linux-3.0.9/drivers/block/cciss.c linux-3.0.9/drivers/block/cciss.c
24739 --- linux-3.0.9/drivers/block/cciss.c 2011-11-11 13:12:24.000000000 -0500
24740 +++ linux-3.0.9/drivers/block/cciss.c 2011-11-15 20:02:59.000000000 -0500
24741 @@ -1179,6 +1179,8 @@ static int cciss_ioctl32_passthru(struct
24742 int err;
24743 u32 cp;
24744
24745 + memset(&arg64, 0, sizeof(arg64));
24746 +
24747 err = 0;
24748 err |=
24749 copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
24750 @@ -2986,7 +2988,7 @@ static void start_io(ctlr_info_t *h)
24751 while (!list_empty(&h->reqQ)) {
24752 c = list_entry(h->reqQ.next, CommandList_struct, list);
24753 /* can't do anything if fifo is full */
24754 - if ((h->access.fifo_full(h))) {
24755 + if ((h->access->fifo_full(h))) {
24756 dev_warn(&h->pdev->dev, "fifo full\n");
24757 break;
24758 }
24759 @@ -2996,7 +2998,7 @@ static void start_io(ctlr_info_t *h)
24760 h->Qdepth--;
24761
24762 /* Tell the controller execute command */
24763 - h->access.submit_command(h, c);
24764 + h->access->submit_command(h, c);
24765
24766 /* Put job onto the completed Q */
24767 addQ(&h->cmpQ, c);
24768 @@ -3422,17 +3424,17 @@ startio:
24769
24770 static inline unsigned long get_next_completion(ctlr_info_t *h)
24771 {
24772 - return h->access.command_completed(h);
24773 + return h->access->command_completed(h);
24774 }
24775
24776 static inline int interrupt_pending(ctlr_info_t *h)
24777 {
24778 - return h->access.intr_pending(h);
24779 + return h->access->intr_pending(h);
24780 }
24781
24782 static inline long interrupt_not_for_us(ctlr_info_t *h)
24783 {
24784 - return ((h->access.intr_pending(h) == 0) ||
24785 + return ((h->access->intr_pending(h) == 0) ||
24786 (h->interrupts_enabled == 0));
24787 }
24788
24789 @@ -3465,7 +3467,7 @@ static inline u32 next_command(ctlr_info
24790 u32 a;
24791
24792 if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
24793 - return h->access.command_completed(h);
24794 + return h->access->command_completed(h);
24795
24796 if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
24797 a = *(h->reply_pool_head); /* Next cmd in ring buffer */
24798 @@ -4020,7 +4022,7 @@ static void __devinit cciss_put_controll
24799 trans_support & CFGTBL_Trans_use_short_tags);
24800
24801 /* Change the access methods to the performant access methods */
24802 - h->access = SA5_performant_access;
24803 + h->access = &SA5_performant_access;
24804 h->transMethod = CFGTBL_Trans_Performant;
24805
24806 return;
24807 @@ -4292,7 +4294,7 @@ static int __devinit cciss_pci_init(ctlr
24808 if (prod_index < 0)
24809 return -ENODEV;
24810 h->product_name = products[prod_index].product_name;
24811 - h->access = *(products[prod_index].access);
24812 + h->access = products[prod_index].access;
24813
24814 if (cciss_board_disabled(h)) {
24815 dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
24816 @@ -5009,7 +5011,7 @@ reinit_after_soft_reset:
24817 }
24818
24819 /* make sure the board interrupts are off */
24820 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
24821 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
24822 rc = cciss_request_irq(h, do_cciss_msix_intr, do_cciss_intx);
24823 if (rc)
24824 goto clean2;
24825 @@ -5061,7 +5063,7 @@ reinit_after_soft_reset:
24826 * fake ones to scoop up any residual completions.
24827 */
24828 spin_lock_irqsave(&h->lock, flags);
24829 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
24830 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
24831 spin_unlock_irqrestore(&h->lock, flags);
24832 free_irq(h->intr[PERF_MODE_INT], h);
24833 rc = cciss_request_irq(h, cciss_msix_discard_completions,
24834 @@ -5081,9 +5083,9 @@ reinit_after_soft_reset:
24835 dev_info(&h->pdev->dev, "Board READY.\n");
24836 dev_info(&h->pdev->dev,
24837 "Waiting for stale completions to drain.\n");
24838 - h->access.set_intr_mask(h, CCISS_INTR_ON);
24839 + h->access->set_intr_mask(h, CCISS_INTR_ON);
24840 msleep(10000);
24841 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
24842 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
24843
24844 rc = controller_reset_failed(h->cfgtable);
24845 if (rc)
24846 @@ -5106,7 +5108,7 @@ reinit_after_soft_reset:
24847 cciss_scsi_setup(h);
24848
24849 /* Turn the interrupts on so we can service requests */
24850 - h->access.set_intr_mask(h, CCISS_INTR_ON);
24851 + h->access->set_intr_mask(h, CCISS_INTR_ON);
24852
24853 /* Get the firmware version */
24854 inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
24855 @@ -5178,7 +5180,7 @@ static void cciss_shutdown(struct pci_de
24856 kfree(flush_buf);
24857 if (return_code != IO_OK)
24858 dev_warn(&h->pdev->dev, "Error flushing cache\n");
24859 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
24860 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
24861 free_irq(h->intr[PERF_MODE_INT], h);
24862 }
24863
24864 diff -urNp linux-3.0.9/drivers/block/cciss.h linux-3.0.9/drivers/block/cciss.h
24865 --- linux-3.0.9/drivers/block/cciss.h 2011-11-11 13:12:24.000000000 -0500
24866 +++ linux-3.0.9/drivers/block/cciss.h 2011-11-15 20:02:59.000000000 -0500
24867 @@ -100,7 +100,7 @@ struct ctlr_info
24868 /* information about each logical volume */
24869 drive_info_struct *drv[CISS_MAX_LUN];
24870
24871 - struct access_method access;
24872 + struct access_method *access;
24873
24874 /* queue and queue Info */
24875 struct list_head reqQ;
24876 diff -urNp linux-3.0.9/drivers/block/cpqarray.c linux-3.0.9/drivers/block/cpqarray.c
24877 --- linux-3.0.9/drivers/block/cpqarray.c 2011-11-11 13:12:24.000000000 -0500
24878 +++ linux-3.0.9/drivers/block/cpqarray.c 2011-11-15 20:02:59.000000000 -0500
24879 @@ -404,7 +404,7 @@ static int __devinit cpqarray_register_c
24880 if (register_blkdev(COMPAQ_SMART2_MAJOR+i, hba[i]->devname)) {
24881 goto Enomem4;
24882 }
24883 - hba[i]->access.set_intr_mask(hba[i], 0);
24884 + hba[i]->access->set_intr_mask(hba[i], 0);
24885 if (request_irq(hba[i]->intr, do_ida_intr,
24886 IRQF_DISABLED|IRQF_SHARED, hba[i]->devname, hba[i]))
24887 {
24888 @@ -459,7 +459,7 @@ static int __devinit cpqarray_register_c
24889 add_timer(&hba[i]->timer);
24890
24891 /* Enable IRQ now that spinlock and rate limit timer are set up */
24892 - hba[i]->access.set_intr_mask(hba[i], FIFO_NOT_EMPTY);
24893 + hba[i]->access->set_intr_mask(hba[i], FIFO_NOT_EMPTY);
24894
24895 for(j=0; j<NWD; j++) {
24896 struct gendisk *disk = ida_gendisk[i][j];
24897 @@ -694,7 +694,7 @@ DBGINFO(
24898 for(i=0; i<NR_PRODUCTS; i++) {
24899 if (board_id == products[i].board_id) {
24900 c->product_name = products[i].product_name;
24901 - c->access = *(products[i].access);
24902 + c->access = products[i].access;
24903 break;
24904 }
24905 }
24906 @@ -792,7 +792,7 @@ static int __devinit cpqarray_eisa_detec
24907 hba[ctlr]->intr = intr;
24908 sprintf(hba[ctlr]->devname, "ida%d", nr_ctlr);
24909 hba[ctlr]->product_name = products[j].product_name;
24910 - hba[ctlr]->access = *(products[j].access);
24911 + hba[ctlr]->access = products[j].access;
24912 hba[ctlr]->ctlr = ctlr;
24913 hba[ctlr]->board_id = board_id;
24914 hba[ctlr]->pci_dev = NULL; /* not PCI */
24915 @@ -911,6 +911,8 @@ static void do_ida_request(struct reques
24916 struct scatterlist tmp_sg[SG_MAX];
24917 int i, dir, seg;
24918
24919 + pax_track_stack();
24920 +
24921 queue_next:
24922 creq = blk_peek_request(q);
24923 if (!creq)
24924 @@ -980,7 +982,7 @@ static void start_io(ctlr_info_t *h)
24925
24926 while((c = h->reqQ) != NULL) {
24927 /* Can't do anything if we're busy */
24928 - if (h->access.fifo_full(h) == 0)
24929 + if (h->access->fifo_full(h) == 0)
24930 return;
24931
24932 /* Get the first entry from the request Q */
24933 @@ -988,7 +990,7 @@ static void start_io(ctlr_info_t *h)
24934 h->Qdepth--;
24935
24936 /* Tell the controller to do our bidding */
24937 - h->access.submit_command(h, c);
24938 + h->access->submit_command(h, c);
24939
24940 /* Get onto the completion Q */
24941 addQ(&h->cmpQ, c);
24942 @@ -1050,7 +1052,7 @@ static irqreturn_t do_ida_intr(int irq,
24943 unsigned long flags;
24944 __u32 a,a1;
24945
24946 - istat = h->access.intr_pending(h);
24947 + istat = h->access->intr_pending(h);
24948 /* Is this interrupt for us? */
24949 if (istat == 0)
24950 return IRQ_NONE;
24951 @@ -1061,7 +1063,7 @@ static irqreturn_t do_ida_intr(int irq,
24952 */
24953 spin_lock_irqsave(IDA_LOCK(h->ctlr), flags);
24954 if (istat & FIFO_NOT_EMPTY) {
24955 - while((a = h->access.command_completed(h))) {
24956 + while((a = h->access->command_completed(h))) {
24957 a1 = a; a &= ~3;
24958 if ((c = h->cmpQ) == NULL)
24959 {
24960 @@ -1449,11 +1451,11 @@ static int sendcmd(
24961 /*
24962 * Disable interrupt
24963 */
24964 - info_p->access.set_intr_mask(info_p, 0);
24965 + info_p->access->set_intr_mask(info_p, 0);
24966 /* Make sure there is room in the command FIFO */
24967 /* Actually it should be completely empty at this time. */
24968 for (i = 200000; i > 0; i--) {
24969 - temp = info_p->access.fifo_full(info_p);
24970 + temp = info_p->access->fifo_full(info_p);
24971 if (temp != 0) {
24972 break;
24973 }
24974 @@ -1466,7 +1468,7 @@ DBG(
24975 /*
24976 * Send the cmd
24977 */
24978 - info_p->access.submit_command(info_p, c);
24979 + info_p->access->submit_command(info_p, c);
24980 complete = pollcomplete(ctlr);
24981
24982 pci_unmap_single(info_p->pci_dev, (dma_addr_t) c->req.sg[0].addr,
24983 @@ -1549,9 +1551,9 @@ static int revalidate_allvol(ctlr_info_t
24984 * we check the new geometry. Then turn interrupts back on when
24985 * we're done.
24986 */
24987 - host->access.set_intr_mask(host, 0);
24988 + host->access->set_intr_mask(host, 0);
24989 getgeometry(ctlr);
24990 - host->access.set_intr_mask(host, FIFO_NOT_EMPTY);
24991 + host->access->set_intr_mask(host, FIFO_NOT_EMPTY);
24992
24993 for(i=0; i<NWD; i++) {
24994 struct gendisk *disk = ida_gendisk[ctlr][i];
24995 @@ -1591,7 +1593,7 @@ static int pollcomplete(int ctlr)
24996 /* Wait (up to 2 seconds) for a command to complete */
24997
24998 for (i = 200000; i > 0; i--) {
24999 - done = hba[ctlr]->access.command_completed(hba[ctlr]);
25000 + done = hba[ctlr]->access->command_completed(hba[ctlr]);
25001 if (done == 0) {
25002 udelay(10); /* a short fixed delay */
25003 } else
25004 diff -urNp linux-3.0.9/drivers/block/cpqarray.h linux-3.0.9/drivers/block/cpqarray.h
25005 --- linux-3.0.9/drivers/block/cpqarray.h 2011-11-11 13:12:24.000000000 -0500
25006 +++ linux-3.0.9/drivers/block/cpqarray.h 2011-11-15 20:02:59.000000000 -0500
25007 @@ -99,7 +99,7 @@ struct ctlr_info {
25008 drv_info_t drv[NWD];
25009 struct proc_dir_entry *proc;
25010
25011 - struct access_method access;
25012 + struct access_method *access;
25013
25014 cmdlist_t *reqQ;
25015 cmdlist_t *cmpQ;
25016 diff -urNp linux-3.0.9/drivers/block/DAC960.c linux-3.0.9/drivers/block/DAC960.c
25017 --- linux-3.0.9/drivers/block/DAC960.c 2011-11-11 13:12:24.000000000 -0500
25018 +++ linux-3.0.9/drivers/block/DAC960.c 2011-11-15 20:02:59.000000000 -0500
25019 @@ -1980,6 +1980,8 @@ static bool DAC960_V1_ReadDeviceConfigur
25020 unsigned long flags;
25021 int Channel, TargetID;
25022
25023 + pax_track_stack();
25024 +
25025 if (!init_dma_loaf(Controller->PCIDevice, &local_dma,
25026 DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
25027 sizeof(DAC960_SCSI_Inquiry_T) +
25028 diff -urNp linux-3.0.9/drivers/block/drbd/drbd_int.h linux-3.0.9/drivers/block/drbd/drbd_int.h
25029 --- linux-3.0.9/drivers/block/drbd/drbd_int.h 2011-11-11 13:12:24.000000000 -0500
25030 +++ linux-3.0.9/drivers/block/drbd/drbd_int.h 2011-11-15 20:02:59.000000000 -0500
25031 @@ -737,7 +737,7 @@ struct drbd_request;
25032 struct drbd_epoch {
25033 struct list_head list;
25034 unsigned int barrier_nr;
25035 - atomic_t epoch_size; /* increased on every request added. */
25036 + atomic_unchecked_t epoch_size; /* increased on every request added. */
25037 atomic_t active; /* increased on every req. added, and dec on every finished. */
25038 unsigned long flags;
25039 };
25040 @@ -1109,7 +1109,7 @@ struct drbd_conf {
25041 void *int_dig_in;
25042 void *int_dig_vv;
25043 wait_queue_head_t seq_wait;
25044 - atomic_t packet_seq;
25045 + atomic_unchecked_t packet_seq;
25046 unsigned int peer_seq;
25047 spinlock_t peer_seq_lock;
25048 unsigned int minor;
25049 @@ -1618,30 +1618,30 @@ static inline int drbd_setsockopt(struct
25050
25051 static inline void drbd_tcp_cork(struct socket *sock)
25052 {
25053 - int __user val = 1;
25054 + int val = 1;
25055 (void) drbd_setsockopt(sock, SOL_TCP, TCP_CORK,
25056 - (char __user *)&val, sizeof(val));
25057 + (char __force_user *)&val, sizeof(val));
25058 }
25059
25060 static inline void drbd_tcp_uncork(struct socket *sock)
25061 {
25062 - int __user val = 0;
25063 + int val = 0;
25064 (void) drbd_setsockopt(sock, SOL_TCP, TCP_CORK,
25065 - (char __user *)&val, sizeof(val));
25066 + (char __force_user *)&val, sizeof(val));
25067 }
25068
25069 static inline void drbd_tcp_nodelay(struct socket *sock)
25070 {
25071 - int __user val = 1;
25072 + int val = 1;
25073 (void) drbd_setsockopt(sock, SOL_TCP, TCP_NODELAY,
25074 - (char __user *)&val, sizeof(val));
25075 + (char __force_user *)&val, sizeof(val));
25076 }
25077
25078 static inline void drbd_tcp_quickack(struct socket *sock)
25079 {
25080 - int __user val = 2;
25081 + int val = 2;
25082 (void) drbd_setsockopt(sock, SOL_TCP, TCP_QUICKACK,
25083 - (char __user *)&val, sizeof(val));
25084 + (char __force_user *)&val, sizeof(val));
25085 }
25086
25087 void drbd_bump_write_ordering(struct drbd_conf *mdev, enum write_ordering_e wo);
25088 diff -urNp linux-3.0.9/drivers/block/drbd/drbd_main.c linux-3.0.9/drivers/block/drbd/drbd_main.c
25089 --- linux-3.0.9/drivers/block/drbd/drbd_main.c 2011-11-11 13:12:24.000000000 -0500
25090 +++ linux-3.0.9/drivers/block/drbd/drbd_main.c 2011-11-15 20:02:59.000000000 -0500
25091 @@ -2397,7 +2397,7 @@ static int _drbd_send_ack(struct drbd_co
25092 p.sector = sector;
25093 p.block_id = block_id;
25094 p.blksize = blksize;
25095 - p.seq_num = cpu_to_be32(atomic_add_return(1, &mdev->packet_seq));
25096 + p.seq_num = cpu_to_be32(atomic_add_return_unchecked(1, &mdev->packet_seq));
25097
25098 if (!mdev->meta.socket || mdev->state.conn < C_CONNECTED)
25099 return false;
25100 @@ -2696,7 +2696,7 @@ int drbd_send_dblock(struct drbd_conf *m
25101 p.sector = cpu_to_be64(req->sector);
25102 p.block_id = (unsigned long)req;
25103 p.seq_num = cpu_to_be32(req->seq_num =
25104 - atomic_add_return(1, &mdev->packet_seq));
25105 + atomic_add_return_unchecked(1, &mdev->packet_seq));
25106
25107 dp_flags = bio_flags_to_wire(mdev, req->master_bio->bi_rw);
25108
25109 @@ -2981,7 +2981,7 @@ void drbd_init_set_defaults(struct drbd_
25110 atomic_set(&mdev->unacked_cnt, 0);
25111 atomic_set(&mdev->local_cnt, 0);
25112 atomic_set(&mdev->net_cnt, 0);
25113 - atomic_set(&mdev->packet_seq, 0);
25114 + atomic_set_unchecked(&mdev->packet_seq, 0);
25115 atomic_set(&mdev->pp_in_use, 0);
25116 atomic_set(&mdev->pp_in_use_by_net, 0);
25117 atomic_set(&mdev->rs_sect_in, 0);
25118 @@ -3063,8 +3063,8 @@ void drbd_mdev_cleanup(struct drbd_conf
25119 mdev->receiver.t_state);
25120
25121 /* no need to lock it, I'm the only thread alive */
25122 - if (atomic_read(&mdev->current_epoch->epoch_size) != 0)
25123 - dev_err(DEV, "epoch_size:%d\n", atomic_read(&mdev->current_epoch->epoch_size));
25124 + if (atomic_read_unchecked(&mdev->current_epoch->epoch_size) != 0)
25125 + dev_err(DEV, "epoch_size:%d\n", atomic_read_unchecked(&mdev->current_epoch->epoch_size));
25126 mdev->al_writ_cnt =
25127 mdev->bm_writ_cnt =
25128 mdev->read_cnt =
25129 diff -urNp linux-3.0.9/drivers/block/drbd/drbd_nl.c linux-3.0.9/drivers/block/drbd/drbd_nl.c
25130 --- linux-3.0.9/drivers/block/drbd/drbd_nl.c 2011-11-11 13:12:24.000000000 -0500
25131 +++ linux-3.0.9/drivers/block/drbd/drbd_nl.c 2011-11-15 20:02:59.000000000 -0500
25132 @@ -2359,7 +2359,7 @@ static void drbd_connector_callback(stru
25133 module_put(THIS_MODULE);
25134 }
25135
25136 -static atomic_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
25137 +static atomic_unchecked_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
25138
25139 static unsigned short *
25140 __tl_add_blob(unsigned short *tl, enum drbd_tags tag, const void *data,
25141 @@ -2430,7 +2430,7 @@ void drbd_bcast_state(struct drbd_conf *
25142 cn_reply->id.idx = CN_IDX_DRBD;
25143 cn_reply->id.val = CN_VAL_DRBD;
25144
25145 - cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
25146 + cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
25147 cn_reply->ack = 0; /* not used here. */
25148 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
25149 (int)((char *)tl - (char *)reply->tag_list);
25150 @@ -2462,7 +2462,7 @@ void drbd_bcast_ev_helper(struct drbd_co
25151 cn_reply->id.idx = CN_IDX_DRBD;
25152 cn_reply->id.val = CN_VAL_DRBD;
25153
25154 - cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
25155 + cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
25156 cn_reply->ack = 0; /* not used here. */
25157 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
25158 (int)((char *)tl - (char *)reply->tag_list);
25159 @@ -2540,7 +2540,7 @@ void drbd_bcast_ee(struct drbd_conf *mde
25160 cn_reply->id.idx = CN_IDX_DRBD;
25161 cn_reply->id.val = CN_VAL_DRBD;
25162
25163 - cn_reply->seq = atomic_add_return(1,&drbd_nl_seq);
25164 + cn_reply->seq = atomic_add_return_unchecked(1,&drbd_nl_seq);
25165 cn_reply->ack = 0; // not used here.
25166 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
25167 (int)((char*)tl - (char*)reply->tag_list);
25168 @@ -2579,7 +2579,7 @@ void drbd_bcast_sync_progress(struct drb
25169 cn_reply->id.idx = CN_IDX_DRBD;
25170 cn_reply->id.val = CN_VAL_DRBD;
25171
25172 - cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
25173 + cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
25174 cn_reply->ack = 0; /* not used here. */
25175 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
25176 (int)((char *)tl - (char *)reply->tag_list);
25177 diff -urNp linux-3.0.9/drivers/block/drbd/drbd_receiver.c linux-3.0.9/drivers/block/drbd/drbd_receiver.c
25178 --- linux-3.0.9/drivers/block/drbd/drbd_receiver.c 2011-11-11 13:12:24.000000000 -0500
25179 +++ linux-3.0.9/drivers/block/drbd/drbd_receiver.c 2011-11-15 20:02:59.000000000 -0500
25180 @@ -894,7 +894,7 @@ retry:
25181 sock->sk->sk_sndtimeo = mdev->net_conf->timeout*HZ/10;
25182 sock->sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
25183
25184 - atomic_set(&mdev->packet_seq, 0);
25185 + atomic_set_unchecked(&mdev->packet_seq, 0);
25186 mdev->peer_seq = 0;
25187
25188 drbd_thread_start(&mdev->asender);
25189 @@ -985,7 +985,7 @@ static enum finish_epoch drbd_may_finish
25190 do {
25191 next_epoch = NULL;
25192
25193 - epoch_size = atomic_read(&epoch->epoch_size);
25194 + epoch_size = atomic_read_unchecked(&epoch->epoch_size);
25195
25196 switch (ev & ~EV_CLEANUP) {
25197 case EV_PUT:
25198 @@ -1020,7 +1020,7 @@ static enum finish_epoch drbd_may_finish
25199 rv = FE_DESTROYED;
25200 } else {
25201 epoch->flags = 0;
25202 - atomic_set(&epoch->epoch_size, 0);
25203 + atomic_set_unchecked(&epoch->epoch_size, 0);
25204 /* atomic_set(&epoch->active, 0); is already zero */
25205 if (rv == FE_STILL_LIVE)
25206 rv = FE_RECYCLED;
25207 @@ -1191,14 +1191,14 @@ static int receive_Barrier(struct drbd_c
25208 drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
25209 drbd_flush(mdev);
25210
25211 - if (atomic_read(&mdev->current_epoch->epoch_size)) {
25212 + if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
25213 epoch = kmalloc(sizeof(struct drbd_epoch), GFP_NOIO);
25214 if (epoch)
25215 break;
25216 }
25217
25218 epoch = mdev->current_epoch;
25219 - wait_event(mdev->ee_wait, atomic_read(&epoch->epoch_size) == 0);
25220 + wait_event(mdev->ee_wait, atomic_read_unchecked(&epoch->epoch_size) == 0);
25221
25222 D_ASSERT(atomic_read(&epoch->active) == 0);
25223 D_ASSERT(epoch->flags == 0);
25224 @@ -1210,11 +1210,11 @@ static int receive_Barrier(struct drbd_c
25225 }
25226
25227 epoch->flags = 0;
25228 - atomic_set(&epoch->epoch_size, 0);
25229 + atomic_set_unchecked(&epoch->epoch_size, 0);
25230 atomic_set(&epoch->active, 0);
25231
25232 spin_lock(&mdev->epoch_lock);
25233 - if (atomic_read(&mdev->current_epoch->epoch_size)) {
25234 + if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
25235 list_add(&epoch->list, &mdev->current_epoch->list);
25236 mdev->current_epoch = epoch;
25237 mdev->epochs++;
25238 @@ -1663,7 +1663,7 @@ static int receive_Data(struct drbd_conf
25239 spin_unlock(&mdev->peer_seq_lock);
25240
25241 drbd_send_ack_dp(mdev, P_NEG_ACK, p, data_size);
25242 - atomic_inc(&mdev->current_epoch->epoch_size);
25243 + atomic_inc_unchecked(&mdev->current_epoch->epoch_size);
25244 return drbd_drain_block(mdev, data_size);
25245 }
25246
25247 @@ -1689,7 +1689,7 @@ static int receive_Data(struct drbd_conf
25248
25249 spin_lock(&mdev->epoch_lock);
25250 e->epoch = mdev->current_epoch;
25251 - atomic_inc(&e->epoch->epoch_size);
25252 + atomic_inc_unchecked(&e->epoch->epoch_size);
25253 atomic_inc(&e->epoch->active);
25254 spin_unlock(&mdev->epoch_lock);
25255
25256 @@ -3885,7 +3885,7 @@ static void drbd_disconnect(struct drbd_
25257 D_ASSERT(list_empty(&mdev->done_ee));
25258
25259 /* ok, no more ee's on the fly, it is safe to reset the epoch_size */
25260 - atomic_set(&mdev->current_epoch->epoch_size, 0);
25261 + atomic_set_unchecked(&mdev->current_epoch->epoch_size, 0);
25262 D_ASSERT(list_empty(&mdev->current_epoch->list));
25263 }
25264
25265 diff -urNp linux-3.0.9/drivers/block/loop.c linux-3.0.9/drivers/block/loop.c
25266 --- linux-3.0.9/drivers/block/loop.c 2011-11-11 13:12:24.000000000 -0500
25267 +++ linux-3.0.9/drivers/block/loop.c 2011-11-15 20:02:59.000000000 -0500
25268 @@ -283,7 +283,7 @@ static int __do_lo_send_write(struct fil
25269 mm_segment_t old_fs = get_fs();
25270
25271 set_fs(get_ds());
25272 - bw = file->f_op->write(file, buf, len, &pos);
25273 + bw = file->f_op->write(file, (const char __force_user *)buf, len, &pos);
25274 set_fs(old_fs);
25275 if (likely(bw == len))
25276 return 0;
25277 diff -urNp linux-3.0.9/drivers/block/nbd.c linux-3.0.9/drivers/block/nbd.c
25278 --- linux-3.0.9/drivers/block/nbd.c 2011-11-11 13:12:24.000000000 -0500
25279 +++ linux-3.0.9/drivers/block/nbd.c 2011-11-15 20:02:59.000000000 -0500
25280 @@ -157,6 +157,8 @@ static int sock_xmit(struct nbd_device *
25281 struct kvec iov;
25282 sigset_t blocked, oldset;
25283
25284 + pax_track_stack();
25285 +
25286 if (unlikely(!sock)) {
25287 printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
25288 lo->disk->disk_name, (send ? "send" : "recv"));
25289 @@ -572,6 +574,8 @@ static void do_nbd_request(struct reques
25290 static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
25291 unsigned int cmd, unsigned long arg)
25292 {
25293 + pax_track_stack();
25294 +
25295 switch (cmd) {
25296 case NBD_DISCONNECT: {
25297 struct request sreq;
25298 diff -urNp linux-3.0.9/drivers/char/agp/frontend.c linux-3.0.9/drivers/char/agp/frontend.c
25299 --- linux-3.0.9/drivers/char/agp/frontend.c 2011-11-11 13:12:24.000000000 -0500
25300 +++ linux-3.0.9/drivers/char/agp/frontend.c 2011-11-15 20:02:59.000000000 -0500
25301 @@ -817,7 +817,7 @@ static int agpioc_reserve_wrap(struct ag
25302 if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
25303 return -EFAULT;
25304
25305 - if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
25306 + if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
25307 return -EFAULT;
25308
25309 client = agp_find_client_by_pid(reserve.pid);
25310 diff -urNp linux-3.0.9/drivers/char/briq_panel.c linux-3.0.9/drivers/char/briq_panel.c
25311 --- linux-3.0.9/drivers/char/briq_panel.c 2011-11-11 13:12:24.000000000 -0500
25312 +++ linux-3.0.9/drivers/char/briq_panel.c 2011-11-15 20:02:59.000000000 -0500
25313 @@ -9,6 +9,7 @@
25314 #include <linux/types.h>
25315 #include <linux/errno.h>
25316 #include <linux/tty.h>
25317 +#include <linux/mutex.h>
25318 #include <linux/timer.h>
25319 #include <linux/kernel.h>
25320 #include <linux/wait.h>
25321 @@ -34,6 +35,7 @@ static int vfd_is_open;
25322 static unsigned char vfd[40];
25323 static int vfd_cursor;
25324 static unsigned char ledpb, led;
25325 +static DEFINE_MUTEX(vfd_mutex);
25326
25327 static void update_vfd(void)
25328 {
25329 @@ -140,12 +142,15 @@ static ssize_t briq_panel_write(struct f
25330 if (!vfd_is_open)
25331 return -EBUSY;
25332
25333 + mutex_lock(&vfd_mutex);
25334 for (;;) {
25335 char c;
25336 if (!indx)
25337 break;
25338 - if (get_user(c, buf))
25339 + if (get_user(c, buf)) {
25340 + mutex_unlock(&vfd_mutex);
25341 return -EFAULT;
25342 + }
25343 if (esc) {
25344 set_led(c);
25345 esc = 0;
25346 @@ -175,6 +180,7 @@ static ssize_t briq_panel_write(struct f
25347 buf++;
25348 }
25349 update_vfd();
25350 + mutex_unlock(&vfd_mutex);
25351
25352 return len;
25353 }
25354 diff -urNp linux-3.0.9/drivers/char/genrtc.c linux-3.0.9/drivers/char/genrtc.c
25355 --- linux-3.0.9/drivers/char/genrtc.c 2011-11-11 13:12:24.000000000 -0500
25356 +++ linux-3.0.9/drivers/char/genrtc.c 2011-11-15 20:02:59.000000000 -0500
25357 @@ -273,6 +273,7 @@ static int gen_rtc_ioctl(struct file *fi
25358 switch (cmd) {
25359
25360 case RTC_PLL_GET:
25361 + memset(&pll, 0, sizeof(pll));
25362 if (get_rtc_pll(&pll))
25363 return -EINVAL;
25364 else
25365 diff -urNp linux-3.0.9/drivers/char/hpet.c linux-3.0.9/drivers/char/hpet.c
25366 --- linux-3.0.9/drivers/char/hpet.c 2011-11-11 13:12:24.000000000 -0500
25367 +++ linux-3.0.9/drivers/char/hpet.c 2011-11-15 20:02:59.000000000 -0500
25368 @@ -572,7 +572,7 @@ static inline unsigned long hpet_time_di
25369 }
25370
25371 static int
25372 -hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
25373 +hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg,
25374 struct hpet_info *info)
25375 {
25376 struct hpet_timer __iomem *timer;
25377 diff -urNp linux-3.0.9/drivers/char/ipmi/ipmi_msghandler.c linux-3.0.9/drivers/char/ipmi/ipmi_msghandler.c
25378 --- linux-3.0.9/drivers/char/ipmi/ipmi_msghandler.c 2011-11-11 13:12:24.000000000 -0500
25379 +++ linux-3.0.9/drivers/char/ipmi/ipmi_msghandler.c 2011-11-15 20:02:59.000000000 -0500
25380 @@ -415,7 +415,7 @@ struct ipmi_smi {
25381 struct proc_dir_entry *proc_dir;
25382 char proc_dir_name[10];
25383
25384 - atomic_t stats[IPMI_NUM_STATS];
25385 + atomic_unchecked_t stats[IPMI_NUM_STATS];
25386
25387 /*
25388 * run_to_completion duplicate of smb_info, smi_info
25389 @@ -448,9 +448,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
25390
25391
25392 #define ipmi_inc_stat(intf, stat) \
25393 - atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
25394 + atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
25395 #define ipmi_get_stat(intf, stat) \
25396 - ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
25397 + ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
25398
25399 static int is_lan_addr(struct ipmi_addr *addr)
25400 {
25401 @@ -2868,7 +2868,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
25402 INIT_LIST_HEAD(&intf->cmd_rcvrs);
25403 init_waitqueue_head(&intf->waitq);
25404 for (i = 0; i < IPMI_NUM_STATS; i++)
25405 - atomic_set(&intf->stats[i], 0);
25406 + atomic_set_unchecked(&intf->stats[i], 0);
25407
25408 intf->proc_dir = NULL;
25409
25410 @@ -4220,6 +4220,8 @@ static void send_panic_events(char *str)
25411 struct ipmi_smi_msg smi_msg;
25412 struct ipmi_recv_msg recv_msg;
25413
25414 + pax_track_stack();
25415 +
25416 si = (struct ipmi_system_interface_addr *) &addr;
25417 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
25418 si->channel = IPMI_BMC_CHANNEL;
25419 diff -urNp linux-3.0.9/drivers/char/ipmi/ipmi_si_intf.c linux-3.0.9/drivers/char/ipmi/ipmi_si_intf.c
25420 --- linux-3.0.9/drivers/char/ipmi/ipmi_si_intf.c 2011-11-11 13:12:24.000000000 -0500
25421 +++ linux-3.0.9/drivers/char/ipmi/ipmi_si_intf.c 2011-11-15 20:02:59.000000000 -0500
25422 @@ -277,7 +277,7 @@ struct smi_info {
25423 unsigned char slave_addr;
25424
25425 /* Counters and things for the proc filesystem. */
25426 - atomic_t stats[SI_NUM_STATS];
25427 + atomic_unchecked_t stats[SI_NUM_STATS];
25428
25429 struct task_struct *thread;
25430
25431 @@ -286,9 +286,9 @@ struct smi_info {
25432 };
25433
25434 #define smi_inc_stat(smi, stat) \
25435 - atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
25436 + atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
25437 #define smi_get_stat(smi, stat) \
25438 - ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
25439 + ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
25440
25441 #define SI_MAX_PARMS 4
25442
25443 @@ -3230,7 +3230,7 @@ static int try_smi_init(struct smi_info
25444 atomic_set(&new_smi->req_events, 0);
25445 new_smi->run_to_completion = 0;
25446 for (i = 0; i < SI_NUM_STATS; i++)
25447 - atomic_set(&new_smi->stats[i], 0);
25448 + atomic_set_unchecked(&new_smi->stats[i], 0);
25449
25450 new_smi->interrupt_disabled = 1;
25451 atomic_set(&new_smi->stop_operation, 0);
25452 diff -urNp linux-3.0.9/drivers/char/Kconfig linux-3.0.9/drivers/char/Kconfig
25453 --- linux-3.0.9/drivers/char/Kconfig 2011-11-11 13:12:24.000000000 -0500
25454 +++ linux-3.0.9/drivers/char/Kconfig 2011-11-15 20:02:59.000000000 -0500
25455 @@ -8,7 +8,8 @@ source "drivers/tty/Kconfig"
25456
25457 config DEVKMEM
25458 bool "/dev/kmem virtual device support"
25459 - default y
25460 + default n
25461 + depends on !GRKERNSEC_KMEM
25462 help
25463 Say Y here if you want to support the /dev/kmem device. The
25464 /dev/kmem device is rarely used, but can be used for certain
25465 @@ -596,6 +597,7 @@ config DEVPORT
25466 bool
25467 depends on !M68K
25468 depends on ISA || PCI
25469 + depends on !GRKERNSEC_KMEM
25470 default y
25471
25472 source "drivers/s390/char/Kconfig"
25473 diff -urNp linux-3.0.9/drivers/char/mbcs.c linux-3.0.9/drivers/char/mbcs.c
25474 --- linux-3.0.9/drivers/char/mbcs.c 2011-11-11 13:12:24.000000000 -0500
25475 +++ linux-3.0.9/drivers/char/mbcs.c 2011-11-15 20:02:59.000000000 -0500
25476 @@ -800,7 +800,7 @@ static int mbcs_remove(struct cx_dev *de
25477 return 0;
25478 }
25479
25480 -static const struct cx_device_id __devinitdata mbcs_id_table[] = {
25481 +static const struct cx_device_id __devinitconst mbcs_id_table[] = {
25482 {
25483 .part_num = MBCS_PART_NUM,
25484 .mfg_num = MBCS_MFG_NUM,
25485 diff -urNp linux-3.0.9/drivers/char/mem.c linux-3.0.9/drivers/char/mem.c
25486 --- linux-3.0.9/drivers/char/mem.c 2011-11-11 13:12:24.000000000 -0500
25487 +++ linux-3.0.9/drivers/char/mem.c 2011-11-15 20:02:59.000000000 -0500
25488 @@ -18,6 +18,7 @@
25489 #include <linux/raw.h>
25490 #include <linux/tty.h>
25491 #include <linux/capability.h>
25492 +#include <linux/security.h>
25493 #include <linux/ptrace.h>
25494 #include <linux/device.h>
25495 #include <linux/highmem.h>
25496 @@ -34,6 +35,10 @@
25497 # include <linux/efi.h>
25498 #endif
25499
25500 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
25501 +extern struct file_operations grsec_fops;
25502 +#endif
25503 +
25504 static inline unsigned long size_inside_page(unsigned long start,
25505 unsigned long size)
25506 {
25507 @@ -65,9 +70,13 @@ static inline int range_is_allowed(unsig
25508
25509 while (cursor < to) {
25510 if (!devmem_is_allowed(pfn)) {
25511 +#ifdef CONFIG_GRKERNSEC_KMEM
25512 + gr_handle_mem_readwrite(from, to);
25513 +#else
25514 printk(KERN_INFO
25515 "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
25516 current->comm, from, to);
25517 +#endif
25518 return 0;
25519 }
25520 cursor += PAGE_SIZE;
25521 @@ -75,6 +84,11 @@ static inline int range_is_allowed(unsig
25522 }
25523 return 1;
25524 }
25525 +#elif defined(CONFIG_GRKERNSEC_KMEM)
25526 +static inline int range_is_allowed(unsigned long pfn, unsigned long size)
25527 +{
25528 + return 0;
25529 +}
25530 #else
25531 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
25532 {
25533 @@ -117,6 +131,7 @@ static ssize_t read_mem(struct file *fil
25534
25535 while (count > 0) {
25536 unsigned long remaining;
25537 + char *temp;
25538
25539 sz = size_inside_page(p, count);
25540
25541 @@ -132,7 +147,23 @@ static ssize_t read_mem(struct file *fil
25542 if (!ptr)
25543 return -EFAULT;
25544
25545 - remaining = copy_to_user(buf, ptr, sz);
25546 +#ifdef CONFIG_PAX_USERCOPY
25547 + temp = kmalloc(sz, GFP_KERNEL);
25548 + if (!temp) {
25549 + unxlate_dev_mem_ptr(p, ptr);
25550 + return -ENOMEM;
25551 + }
25552 + memcpy(temp, ptr, sz);
25553 +#else
25554 + temp = ptr;
25555 +#endif
25556 +
25557 + remaining = copy_to_user(buf, temp, sz);
25558 +
25559 +#ifdef CONFIG_PAX_USERCOPY
25560 + kfree(temp);
25561 +#endif
25562 +
25563 unxlate_dev_mem_ptr(p, ptr);
25564 if (remaining)
25565 return -EFAULT;
25566 @@ -395,9 +426,8 @@ static ssize_t read_kmem(struct file *fi
25567 size_t count, loff_t *ppos)
25568 {
25569 unsigned long p = *ppos;
25570 - ssize_t low_count, read, sz;
25571 + ssize_t low_count, read, sz, err = 0;
25572 char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
25573 - int err = 0;
25574
25575 read = 0;
25576 if (p < (unsigned long) high_memory) {
25577 @@ -419,6 +449,8 @@ static ssize_t read_kmem(struct file *fi
25578 }
25579 #endif
25580 while (low_count > 0) {
25581 + char *temp;
25582 +
25583 sz = size_inside_page(p, low_count);
25584
25585 /*
25586 @@ -428,7 +460,22 @@ static ssize_t read_kmem(struct file *fi
25587 */
25588 kbuf = xlate_dev_kmem_ptr((char *)p);
25589
25590 - if (copy_to_user(buf, kbuf, sz))
25591 +#ifdef CONFIG_PAX_USERCOPY
25592 + temp = kmalloc(sz, GFP_KERNEL);
25593 + if (!temp)
25594 + return -ENOMEM;
25595 + memcpy(temp, kbuf, sz);
25596 +#else
25597 + temp = kbuf;
25598 +#endif
25599 +
25600 + err = copy_to_user(buf, temp, sz);
25601 +
25602 +#ifdef CONFIG_PAX_USERCOPY
25603 + kfree(temp);
25604 +#endif
25605 +
25606 + if (err)
25607 return -EFAULT;
25608 buf += sz;
25609 p += sz;
25610 @@ -866,6 +913,9 @@ static const struct memdev {
25611 #ifdef CONFIG_CRASH_DUMP
25612 [12] = { "oldmem", 0, &oldmem_fops, NULL },
25613 #endif
25614 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
25615 + [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
25616 +#endif
25617 };
25618
25619 static int memory_open(struct inode *inode, struct file *filp)
25620 diff -urNp linux-3.0.9/drivers/char/nvram.c linux-3.0.9/drivers/char/nvram.c
25621 --- linux-3.0.9/drivers/char/nvram.c 2011-11-11 13:12:24.000000000 -0500
25622 +++ linux-3.0.9/drivers/char/nvram.c 2011-11-15 20:02:59.000000000 -0500
25623 @@ -246,7 +246,7 @@ static ssize_t nvram_read(struct file *f
25624
25625 spin_unlock_irq(&rtc_lock);
25626
25627 - if (copy_to_user(buf, contents, tmp - contents))
25628 + if (tmp - contents > sizeof(contents) || copy_to_user(buf, contents, tmp - contents))
25629 return -EFAULT;
25630
25631 *ppos = i;
25632 diff -urNp linux-3.0.9/drivers/char/random.c linux-3.0.9/drivers/char/random.c
25633 --- linux-3.0.9/drivers/char/random.c 2011-11-11 13:12:24.000000000 -0500
25634 +++ linux-3.0.9/drivers/char/random.c 2011-11-15 20:02:59.000000000 -0500
25635 @@ -261,8 +261,13 @@
25636 /*
25637 * Configuration information
25638 */
25639 +#ifdef CONFIG_GRKERNSEC_RANDNET
25640 +#define INPUT_POOL_WORDS 512
25641 +#define OUTPUT_POOL_WORDS 128
25642 +#else
25643 #define INPUT_POOL_WORDS 128
25644 #define OUTPUT_POOL_WORDS 32
25645 +#endif
25646 #define SEC_XFER_SIZE 512
25647 #define EXTRACT_SIZE 10
25648
25649 @@ -300,10 +305,17 @@ static struct poolinfo {
25650 int poolwords;
25651 int tap1, tap2, tap3, tap4, tap5;
25652 } poolinfo_table[] = {
25653 +#ifdef CONFIG_GRKERNSEC_RANDNET
25654 + /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
25655 + { 512, 411, 308, 208, 104, 1 },
25656 + /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
25657 + { 128, 103, 76, 51, 25, 1 },
25658 +#else
25659 /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
25660 { 128, 103, 76, 51, 25, 1 },
25661 /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
25662 { 32, 26, 20, 14, 7, 1 },
25663 +#endif
25664 #if 0
25665 /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
25666 { 2048, 1638, 1231, 819, 411, 1 },
25667 @@ -909,7 +921,7 @@ static ssize_t extract_entropy_user(stru
25668
25669 extract_buf(r, tmp);
25670 i = min_t(int, nbytes, EXTRACT_SIZE);
25671 - if (copy_to_user(buf, tmp, i)) {
25672 + if (i > sizeof(tmp) || copy_to_user(buf, tmp, i)) {
25673 ret = -EFAULT;
25674 break;
25675 }
25676 @@ -1214,7 +1226,7 @@ EXPORT_SYMBOL(generate_random_uuid);
25677 #include <linux/sysctl.h>
25678
25679 static int min_read_thresh = 8, min_write_thresh;
25680 -static int max_read_thresh = INPUT_POOL_WORDS * 32;
25681 +static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
25682 static int max_write_thresh = INPUT_POOL_WORDS * 32;
25683 static char sysctl_bootid[16];
25684
25685 diff -urNp linux-3.0.9/drivers/char/sonypi.c linux-3.0.9/drivers/char/sonypi.c
25686 --- linux-3.0.9/drivers/char/sonypi.c 2011-11-11 13:12:24.000000000 -0500
25687 +++ linux-3.0.9/drivers/char/sonypi.c 2011-11-15 20:02:59.000000000 -0500
25688 @@ -55,6 +55,7 @@
25689 #include <asm/uaccess.h>
25690 #include <asm/io.h>
25691 #include <asm/system.h>
25692 +#include <asm/local.h>
25693
25694 #include <linux/sonypi.h>
25695
25696 @@ -491,7 +492,7 @@ static struct sonypi_device {
25697 spinlock_t fifo_lock;
25698 wait_queue_head_t fifo_proc_list;
25699 struct fasync_struct *fifo_async;
25700 - int open_count;
25701 + local_t open_count;
25702 int model;
25703 struct input_dev *input_jog_dev;
25704 struct input_dev *input_key_dev;
25705 @@ -898,7 +899,7 @@ static int sonypi_misc_fasync(int fd, st
25706 static int sonypi_misc_release(struct inode *inode, struct file *file)
25707 {
25708 mutex_lock(&sonypi_device.lock);
25709 - sonypi_device.open_count--;
25710 + local_dec(&sonypi_device.open_count);
25711 mutex_unlock(&sonypi_device.lock);
25712 return 0;
25713 }
25714 @@ -907,9 +908,9 @@ static int sonypi_misc_open(struct inode
25715 {
25716 mutex_lock(&sonypi_device.lock);
25717 /* Flush input queue on first open */
25718 - if (!sonypi_device.open_count)
25719 + if (!local_read(&sonypi_device.open_count))
25720 kfifo_reset(&sonypi_device.fifo);
25721 - sonypi_device.open_count++;
25722 + local_inc(&sonypi_device.open_count);
25723 mutex_unlock(&sonypi_device.lock);
25724
25725 return 0;
25726 diff -urNp linux-3.0.9/drivers/char/tpm/tpm_bios.c linux-3.0.9/drivers/char/tpm/tpm_bios.c
25727 --- linux-3.0.9/drivers/char/tpm/tpm_bios.c 2011-11-11 13:12:24.000000000 -0500
25728 +++ linux-3.0.9/drivers/char/tpm/tpm_bios.c 2011-11-15 20:02:59.000000000 -0500
25729 @@ -173,7 +173,7 @@ static void *tpm_bios_measurements_start
25730 event = addr;
25731
25732 if ((event->event_type == 0 && event->event_size == 0) ||
25733 - ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
25734 + (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
25735 return NULL;
25736
25737 return addr;
25738 @@ -198,7 +198,7 @@ static void *tpm_bios_measurements_next(
25739 return NULL;
25740
25741 if ((event->event_type == 0 && event->event_size == 0) ||
25742 - ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
25743 + (event->event_size >= limit - v - sizeof(struct tcpa_event)))
25744 return NULL;
25745
25746 (*pos)++;
25747 @@ -291,7 +291,8 @@ static int tpm_binary_bios_measurements_
25748 int i;
25749
25750 for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
25751 - seq_putc(m, data[i]);
25752 + if (!seq_putc(m, data[i]))
25753 + return -EFAULT;
25754
25755 return 0;
25756 }
25757 @@ -410,8 +411,13 @@ static int read_log(struct tpm_bios_log
25758 log->bios_event_log_end = log->bios_event_log + len;
25759
25760 virt = acpi_os_map_memory(start, len);
25761 + if (!virt) {
25762 + kfree(log->bios_event_log);
25763 + log->bios_event_log = NULL;
25764 + return -EFAULT;
25765 + }
25766
25767 - memcpy(log->bios_event_log, virt, len);
25768 + memcpy(log->bios_event_log, (const char __force_kernel *)virt, len);
25769
25770 acpi_os_unmap_memory(virt, len);
25771 return 0;
25772 diff -urNp linux-3.0.9/drivers/char/tpm/tpm.c linux-3.0.9/drivers/char/tpm/tpm.c
25773 --- linux-3.0.9/drivers/char/tpm/tpm.c 2011-11-11 13:12:24.000000000 -0500
25774 +++ linux-3.0.9/drivers/char/tpm/tpm.c 2011-11-15 20:02:59.000000000 -0500
25775 @@ -414,7 +414,7 @@ static ssize_t tpm_transmit(struct tpm_c
25776 chip->vendor.req_complete_val)
25777 goto out_recv;
25778
25779 - if ((status == chip->vendor.req_canceled)) {
25780 + if (status == chip->vendor.req_canceled) {
25781 dev_err(chip->dev, "Operation Canceled\n");
25782 rc = -ECANCELED;
25783 goto out;
25784 @@ -847,6 +847,8 @@ ssize_t tpm_show_pubek(struct device *de
25785
25786 struct tpm_chip *chip = dev_get_drvdata(dev);
25787
25788 + pax_track_stack();
25789 +
25790 tpm_cmd.header.in = tpm_readpubek_header;
25791 err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
25792 "attempting to read the PUBEK");
25793 diff -urNp linux-3.0.9/drivers/char/virtio_console.c linux-3.0.9/drivers/char/virtio_console.c
25794 --- linux-3.0.9/drivers/char/virtio_console.c 2011-11-11 13:12:24.000000000 -0500
25795 +++ linux-3.0.9/drivers/char/virtio_console.c 2011-11-15 20:02:59.000000000 -0500
25796 @@ -555,7 +555,7 @@ static ssize_t fill_readbuf(struct port
25797 if (to_user) {
25798 ssize_t ret;
25799
25800 - ret = copy_to_user(out_buf, buf->buf + buf->offset, out_count);
25801 + ret = copy_to_user((char __force_user *)out_buf, buf->buf + buf->offset, out_count);
25802 if (ret)
25803 return -EFAULT;
25804 } else {
25805 @@ -654,7 +654,7 @@ static ssize_t port_fops_read(struct fil
25806 if (!port_has_data(port) && !port->host_connected)
25807 return 0;
25808
25809 - return fill_readbuf(port, ubuf, count, true);
25810 + return fill_readbuf(port, (char __force_kernel *)ubuf, count, true);
25811 }
25812
25813 static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
25814 diff -urNp linux-3.0.9/drivers/crypto/hifn_795x.c linux-3.0.9/drivers/crypto/hifn_795x.c
25815 --- linux-3.0.9/drivers/crypto/hifn_795x.c 2011-11-11 13:12:24.000000000 -0500
25816 +++ linux-3.0.9/drivers/crypto/hifn_795x.c 2011-11-15 20:02:59.000000000 -0500
25817 @@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device
25818 0xCA, 0x34, 0x2B, 0x2E};
25819 struct scatterlist sg;
25820
25821 + pax_track_stack();
25822 +
25823 memset(src, 0, sizeof(src));
25824 memset(ctx.key, 0, sizeof(ctx.key));
25825
25826 diff -urNp linux-3.0.9/drivers/crypto/padlock-aes.c linux-3.0.9/drivers/crypto/padlock-aes.c
25827 --- linux-3.0.9/drivers/crypto/padlock-aes.c 2011-11-11 13:12:24.000000000 -0500
25828 +++ linux-3.0.9/drivers/crypto/padlock-aes.c 2011-11-15 20:02:59.000000000 -0500
25829 @@ -109,6 +109,8 @@ static int aes_set_key(struct crypto_tfm
25830 struct crypto_aes_ctx gen_aes;
25831 int cpu;
25832
25833 + pax_track_stack();
25834 +
25835 if (key_len % 8) {
25836 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
25837 return -EINVAL;
25838 diff -urNp linux-3.0.9/drivers/dma/ioat/dma_v3.c linux-3.0.9/drivers/dma/ioat/dma_v3.c
25839 --- linux-3.0.9/drivers/dma/ioat/dma_v3.c 2011-11-11 13:12:24.000000000 -0500
25840 +++ linux-3.0.9/drivers/dma/ioat/dma_v3.c 2011-11-15 20:02:59.000000000 -0500
25841 @@ -73,10 +73,10 @@
25842 /* provide a lookup table for setting the source address in the base or
25843 * extended descriptor of an xor or pq descriptor
25844 */
25845 -static const u8 xor_idx_to_desc __read_mostly = 0xd0;
25846 -static const u8 xor_idx_to_field[] __read_mostly = { 1, 4, 5, 6, 7, 0, 1, 2 };
25847 -static const u8 pq_idx_to_desc __read_mostly = 0xf8;
25848 -static const u8 pq_idx_to_field[] __read_mostly = { 1, 4, 5, 0, 1, 2, 4, 5 };
25849 +static const u8 xor_idx_to_desc = 0xd0;
25850 +static const u8 xor_idx_to_field[] = { 1, 4, 5, 6, 7, 0, 1, 2 };
25851 +static const u8 pq_idx_to_desc = 0xf8;
25852 +static const u8 pq_idx_to_field[] = { 1, 4, 5, 0, 1, 2, 4, 5 };
25853
25854 static dma_addr_t xor_get_src(struct ioat_raw_descriptor *descs[2], int idx)
25855 {
25856 diff -urNp linux-3.0.9/drivers/edac/amd64_edac.c linux-3.0.9/drivers/edac/amd64_edac.c
25857 --- linux-3.0.9/drivers/edac/amd64_edac.c 2011-11-11 13:12:24.000000000 -0500
25858 +++ linux-3.0.9/drivers/edac/amd64_edac.c 2011-11-15 20:02:59.000000000 -0500
25859 @@ -2670,7 +2670,7 @@ static void __devexit amd64_remove_one_i
25860 * PCI core identifies what devices are on a system during boot, and then
25861 * inquiry this table to see if this driver is for a given device found.
25862 */
25863 -static const struct pci_device_id amd64_pci_table[] __devinitdata = {
25864 +static const struct pci_device_id amd64_pci_table[] __devinitconst = {
25865 {
25866 .vendor = PCI_VENDOR_ID_AMD,
25867 .device = PCI_DEVICE_ID_AMD_K8_NB_MEMCTL,
25868 diff -urNp linux-3.0.9/drivers/edac/amd76x_edac.c linux-3.0.9/drivers/edac/amd76x_edac.c
25869 --- linux-3.0.9/drivers/edac/amd76x_edac.c 2011-11-11 13:12:24.000000000 -0500
25870 +++ linux-3.0.9/drivers/edac/amd76x_edac.c 2011-11-15 20:02:59.000000000 -0500
25871 @@ -321,7 +321,7 @@ static void __devexit amd76x_remove_one(
25872 edac_mc_free(mci);
25873 }
25874
25875 -static const struct pci_device_id amd76x_pci_tbl[] __devinitdata = {
25876 +static const struct pci_device_id amd76x_pci_tbl[] __devinitconst = {
25877 {
25878 PCI_VEND_DEV(AMD, FE_GATE_700C), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
25879 AMD762},
25880 diff -urNp linux-3.0.9/drivers/edac/e752x_edac.c linux-3.0.9/drivers/edac/e752x_edac.c
25881 --- linux-3.0.9/drivers/edac/e752x_edac.c 2011-11-11 13:12:24.000000000 -0500
25882 +++ linux-3.0.9/drivers/edac/e752x_edac.c 2011-11-15 20:02:59.000000000 -0500
25883 @@ -1380,7 +1380,7 @@ static void __devexit e752x_remove_one(s
25884 edac_mc_free(mci);
25885 }
25886
25887 -static const struct pci_device_id e752x_pci_tbl[] __devinitdata = {
25888 +static const struct pci_device_id e752x_pci_tbl[] __devinitconst = {
25889 {
25890 PCI_VEND_DEV(INTEL, 7520_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
25891 E7520},
25892 diff -urNp linux-3.0.9/drivers/edac/e7xxx_edac.c linux-3.0.9/drivers/edac/e7xxx_edac.c
25893 --- linux-3.0.9/drivers/edac/e7xxx_edac.c 2011-11-11 13:12:24.000000000 -0500
25894 +++ linux-3.0.9/drivers/edac/e7xxx_edac.c 2011-11-15 20:02:59.000000000 -0500
25895 @@ -525,7 +525,7 @@ static void __devexit e7xxx_remove_one(s
25896 edac_mc_free(mci);
25897 }
25898
25899 -static const struct pci_device_id e7xxx_pci_tbl[] __devinitdata = {
25900 +static const struct pci_device_id e7xxx_pci_tbl[] __devinitconst = {
25901 {
25902 PCI_VEND_DEV(INTEL, 7205_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
25903 E7205},
25904 diff -urNp linux-3.0.9/drivers/edac/edac_pci_sysfs.c linux-3.0.9/drivers/edac/edac_pci_sysfs.c
25905 --- linux-3.0.9/drivers/edac/edac_pci_sysfs.c 2011-11-11 13:12:24.000000000 -0500
25906 +++ linux-3.0.9/drivers/edac/edac_pci_sysfs.c 2011-11-15 20:02:59.000000000 -0500
25907 @@ -26,8 +26,8 @@ static int edac_pci_log_pe = 1; /* log
25908 static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
25909 static int edac_pci_poll_msec = 1000; /* one second workq period */
25910
25911 -static atomic_t pci_parity_count = ATOMIC_INIT(0);
25912 -static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
25913 +static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
25914 +static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
25915
25916 static struct kobject *edac_pci_top_main_kobj;
25917 static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
25918 @@ -582,7 +582,7 @@ static void edac_pci_dev_parity_test(str
25919 edac_printk(KERN_CRIT, EDAC_PCI,
25920 "Signaled System Error on %s\n",
25921 pci_name(dev));
25922 - atomic_inc(&pci_nonparity_count);
25923 + atomic_inc_unchecked(&pci_nonparity_count);
25924 }
25925
25926 if (status & (PCI_STATUS_PARITY)) {
25927 @@ -590,7 +590,7 @@ static void edac_pci_dev_parity_test(str
25928 "Master Data Parity Error on %s\n",
25929 pci_name(dev));
25930
25931 - atomic_inc(&pci_parity_count);
25932 + atomic_inc_unchecked(&pci_parity_count);
25933 }
25934
25935 if (status & (PCI_STATUS_DETECTED_PARITY)) {
25936 @@ -598,7 +598,7 @@ static void edac_pci_dev_parity_test(str
25937 "Detected Parity Error on %s\n",
25938 pci_name(dev));
25939
25940 - atomic_inc(&pci_parity_count);
25941 + atomic_inc_unchecked(&pci_parity_count);
25942 }
25943 }
25944
25945 @@ -619,7 +619,7 @@ static void edac_pci_dev_parity_test(str
25946 edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
25947 "Signaled System Error on %s\n",
25948 pci_name(dev));
25949 - atomic_inc(&pci_nonparity_count);
25950 + atomic_inc_unchecked(&pci_nonparity_count);
25951 }
25952
25953 if (status & (PCI_STATUS_PARITY)) {
25954 @@ -627,7 +627,7 @@ static void edac_pci_dev_parity_test(str
25955 "Master Data Parity Error on "
25956 "%s\n", pci_name(dev));
25957
25958 - atomic_inc(&pci_parity_count);
25959 + atomic_inc_unchecked(&pci_parity_count);
25960 }
25961
25962 if (status & (PCI_STATUS_DETECTED_PARITY)) {
25963 @@ -635,7 +635,7 @@ static void edac_pci_dev_parity_test(str
25964 "Detected Parity Error on %s\n",
25965 pci_name(dev));
25966
25967 - atomic_inc(&pci_parity_count);
25968 + atomic_inc_unchecked(&pci_parity_count);
25969 }
25970 }
25971 }
25972 @@ -677,7 +677,7 @@ void edac_pci_do_parity_check(void)
25973 if (!check_pci_errors)
25974 return;
25975
25976 - before_count = atomic_read(&pci_parity_count);
25977 + before_count = atomic_read_unchecked(&pci_parity_count);
25978
25979 /* scan all PCI devices looking for a Parity Error on devices and
25980 * bridges.
25981 @@ -689,7 +689,7 @@ void edac_pci_do_parity_check(void)
25982 /* Only if operator has selected panic on PCI Error */
25983 if (edac_pci_get_panic_on_pe()) {
25984 /* If the count is different 'after' from 'before' */
25985 - if (before_count != atomic_read(&pci_parity_count))
25986 + if (before_count != atomic_read_unchecked(&pci_parity_count))
25987 panic("EDAC: PCI Parity Error");
25988 }
25989 }
25990 diff -urNp linux-3.0.9/drivers/edac/i3000_edac.c linux-3.0.9/drivers/edac/i3000_edac.c
25991 --- linux-3.0.9/drivers/edac/i3000_edac.c 2011-11-11 13:12:24.000000000 -0500
25992 +++ linux-3.0.9/drivers/edac/i3000_edac.c 2011-11-15 20:02:59.000000000 -0500
25993 @@ -470,7 +470,7 @@ static void __devexit i3000_remove_one(s
25994 edac_mc_free(mci);
25995 }
25996
25997 -static const struct pci_device_id i3000_pci_tbl[] __devinitdata = {
25998 +static const struct pci_device_id i3000_pci_tbl[] __devinitconst = {
25999 {
26000 PCI_VEND_DEV(INTEL, 3000_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
26001 I3000},
26002 diff -urNp linux-3.0.9/drivers/edac/i3200_edac.c linux-3.0.9/drivers/edac/i3200_edac.c
26003 --- linux-3.0.9/drivers/edac/i3200_edac.c 2011-11-11 13:12:24.000000000 -0500
26004 +++ linux-3.0.9/drivers/edac/i3200_edac.c 2011-11-15 20:02:59.000000000 -0500
26005 @@ -456,7 +456,7 @@ static void __devexit i3200_remove_one(s
26006 edac_mc_free(mci);
26007 }
26008
26009 -static const struct pci_device_id i3200_pci_tbl[] __devinitdata = {
26010 +static const struct pci_device_id i3200_pci_tbl[] __devinitconst = {
26011 {
26012 PCI_VEND_DEV(INTEL, 3200_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
26013 I3200},
26014 diff -urNp linux-3.0.9/drivers/edac/i5000_edac.c linux-3.0.9/drivers/edac/i5000_edac.c
26015 --- linux-3.0.9/drivers/edac/i5000_edac.c 2011-11-11 13:12:24.000000000 -0500
26016 +++ linux-3.0.9/drivers/edac/i5000_edac.c 2011-11-15 20:02:59.000000000 -0500
26017 @@ -1516,7 +1516,7 @@ static void __devexit i5000_remove_one(s
26018 *
26019 * The "E500P" device is the first device supported.
26020 */
26021 -static const struct pci_device_id i5000_pci_tbl[] __devinitdata = {
26022 +static const struct pci_device_id i5000_pci_tbl[] __devinitconst = {
26023 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_I5000_DEV16),
26024 .driver_data = I5000P},
26025
26026 diff -urNp linux-3.0.9/drivers/edac/i5100_edac.c linux-3.0.9/drivers/edac/i5100_edac.c
26027 --- linux-3.0.9/drivers/edac/i5100_edac.c 2011-11-11 13:12:24.000000000 -0500
26028 +++ linux-3.0.9/drivers/edac/i5100_edac.c 2011-11-15 20:02:59.000000000 -0500
26029 @@ -1051,7 +1051,7 @@ static void __devexit i5100_remove_one(s
26030 edac_mc_free(mci);
26031 }
26032
26033 -static const struct pci_device_id i5100_pci_tbl[] __devinitdata = {
26034 +static const struct pci_device_id i5100_pci_tbl[] __devinitconst = {
26035 /* Device 16, Function 0, Channel 0 Memory Map, Error Flag/Mask, ... */
26036 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5100_16) },
26037 { 0, }
26038 diff -urNp linux-3.0.9/drivers/edac/i5400_edac.c linux-3.0.9/drivers/edac/i5400_edac.c
26039 --- linux-3.0.9/drivers/edac/i5400_edac.c 2011-11-11 13:12:24.000000000 -0500
26040 +++ linux-3.0.9/drivers/edac/i5400_edac.c 2011-11-15 20:02:59.000000000 -0500
26041 @@ -1383,7 +1383,7 @@ static void __devexit i5400_remove_one(s
26042 *
26043 * The "E500P" device is the first device supported.
26044 */
26045 -static const struct pci_device_id i5400_pci_tbl[] __devinitdata = {
26046 +static const struct pci_device_id i5400_pci_tbl[] __devinitconst = {
26047 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5400_ERR)},
26048 {0,} /* 0 terminated list. */
26049 };
26050 diff -urNp linux-3.0.9/drivers/edac/i7300_edac.c linux-3.0.9/drivers/edac/i7300_edac.c
26051 --- linux-3.0.9/drivers/edac/i7300_edac.c 2011-11-11 13:12:24.000000000 -0500
26052 +++ linux-3.0.9/drivers/edac/i7300_edac.c 2011-11-15 20:02:59.000000000 -0500
26053 @@ -1191,7 +1191,7 @@ static void __devexit i7300_remove_one(s
26054 *
26055 * Has only 8086:360c PCI ID
26056 */
26057 -static const struct pci_device_id i7300_pci_tbl[] __devinitdata = {
26058 +static const struct pci_device_id i7300_pci_tbl[] __devinitconst = {
26059 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_I7300_MCH_ERR)},
26060 {0,} /* 0 terminated list. */
26061 };
26062 diff -urNp linux-3.0.9/drivers/edac/i7core_edac.c linux-3.0.9/drivers/edac/i7core_edac.c
26063 --- linux-3.0.9/drivers/edac/i7core_edac.c 2011-11-11 13:12:24.000000000 -0500
26064 +++ linux-3.0.9/drivers/edac/i7core_edac.c 2011-11-15 20:02:59.000000000 -0500
26065 @@ -359,7 +359,7 @@ static const struct pci_id_table pci_dev
26066 /*
26067 * pci_device_id table for which devices we are looking for
26068 */
26069 -static const struct pci_device_id i7core_pci_tbl[] __devinitdata = {
26070 +static const struct pci_device_id i7core_pci_tbl[] __devinitconst = {
26071 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_X58_HUB_MGMT)},
26072 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LYNNFIELD_QPI_LINK0)},
26073 {0,} /* 0 terminated list. */
26074 diff -urNp linux-3.0.9/drivers/edac/i82443bxgx_edac.c linux-3.0.9/drivers/edac/i82443bxgx_edac.c
26075 --- linux-3.0.9/drivers/edac/i82443bxgx_edac.c 2011-11-11 13:12:24.000000000 -0500
26076 +++ linux-3.0.9/drivers/edac/i82443bxgx_edac.c 2011-11-15 20:02:59.000000000 -0500
26077 @@ -380,7 +380,7 @@ static void __devexit i82443bxgx_edacmc_
26078
26079 EXPORT_SYMBOL_GPL(i82443bxgx_edacmc_remove_one);
26080
26081 -static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitdata = {
26082 +static const struct pci_device_id i82443bxgx_pci_tbl[] __devinitconst = {
26083 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_0)},
26084 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_2)},
26085 {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0)},
26086 diff -urNp linux-3.0.9/drivers/edac/i82860_edac.c linux-3.0.9/drivers/edac/i82860_edac.c
26087 --- linux-3.0.9/drivers/edac/i82860_edac.c 2011-11-11 13:12:24.000000000 -0500
26088 +++ linux-3.0.9/drivers/edac/i82860_edac.c 2011-11-15 20:02:59.000000000 -0500
26089 @@ -270,7 +270,7 @@ static void __devexit i82860_remove_one(
26090 edac_mc_free(mci);
26091 }
26092
26093 -static const struct pci_device_id i82860_pci_tbl[] __devinitdata = {
26094 +static const struct pci_device_id i82860_pci_tbl[] __devinitconst = {
26095 {
26096 PCI_VEND_DEV(INTEL, 82860_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
26097 I82860},
26098 diff -urNp linux-3.0.9/drivers/edac/i82875p_edac.c linux-3.0.9/drivers/edac/i82875p_edac.c
26099 --- linux-3.0.9/drivers/edac/i82875p_edac.c 2011-11-11 13:12:24.000000000 -0500
26100 +++ linux-3.0.9/drivers/edac/i82875p_edac.c 2011-11-15 20:02:59.000000000 -0500
26101 @@ -511,7 +511,7 @@ static void __devexit i82875p_remove_one
26102 edac_mc_free(mci);
26103 }
26104
26105 -static const struct pci_device_id i82875p_pci_tbl[] __devinitdata = {
26106 +static const struct pci_device_id i82875p_pci_tbl[] __devinitconst = {
26107 {
26108 PCI_VEND_DEV(INTEL, 82875_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
26109 I82875P},
26110 diff -urNp linux-3.0.9/drivers/edac/i82975x_edac.c linux-3.0.9/drivers/edac/i82975x_edac.c
26111 --- linux-3.0.9/drivers/edac/i82975x_edac.c 2011-11-11 13:12:24.000000000 -0500
26112 +++ linux-3.0.9/drivers/edac/i82975x_edac.c 2011-11-15 20:02:59.000000000 -0500
26113 @@ -604,7 +604,7 @@ static void __devexit i82975x_remove_one
26114 edac_mc_free(mci);
26115 }
26116
26117 -static const struct pci_device_id i82975x_pci_tbl[] __devinitdata = {
26118 +static const struct pci_device_id i82975x_pci_tbl[] __devinitconst = {
26119 {
26120 PCI_VEND_DEV(INTEL, 82975_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
26121 I82975X
26122 diff -urNp linux-3.0.9/drivers/edac/mce_amd.h linux-3.0.9/drivers/edac/mce_amd.h
26123 --- linux-3.0.9/drivers/edac/mce_amd.h 2011-11-11 13:12:24.000000000 -0500
26124 +++ linux-3.0.9/drivers/edac/mce_amd.h 2011-11-15 20:02:59.000000000 -0500
26125 @@ -83,7 +83,7 @@ struct amd_decoder_ops {
26126 bool (*dc_mce)(u16, u8);
26127 bool (*ic_mce)(u16, u8);
26128 bool (*nb_mce)(u16, u8);
26129 -};
26130 +} __no_const;
26131
26132 void amd_report_gart_errors(bool);
26133 void amd_register_ecc_decoder(void (*f)(int, struct mce *, u32));
26134 diff -urNp linux-3.0.9/drivers/edac/r82600_edac.c linux-3.0.9/drivers/edac/r82600_edac.c
26135 --- linux-3.0.9/drivers/edac/r82600_edac.c 2011-11-11 13:12:24.000000000 -0500
26136 +++ linux-3.0.9/drivers/edac/r82600_edac.c 2011-11-15 20:02:59.000000000 -0500
26137 @@ -373,7 +373,7 @@ static void __devexit r82600_remove_one(
26138 edac_mc_free(mci);
26139 }
26140
26141 -static const struct pci_device_id r82600_pci_tbl[] __devinitdata = {
26142 +static const struct pci_device_id r82600_pci_tbl[] __devinitconst = {
26143 {
26144 PCI_DEVICE(PCI_VENDOR_ID_RADISYS, R82600_BRIDGE_ID)
26145 },
26146 diff -urNp linux-3.0.9/drivers/edac/x38_edac.c linux-3.0.9/drivers/edac/x38_edac.c
26147 --- linux-3.0.9/drivers/edac/x38_edac.c 2011-11-11 13:12:24.000000000 -0500
26148 +++ linux-3.0.9/drivers/edac/x38_edac.c 2011-11-15 20:02:59.000000000 -0500
26149 @@ -440,7 +440,7 @@ static void __devexit x38_remove_one(str
26150 edac_mc_free(mci);
26151 }
26152
26153 -static const struct pci_device_id x38_pci_tbl[] __devinitdata = {
26154 +static const struct pci_device_id x38_pci_tbl[] __devinitconst = {
26155 {
26156 PCI_VEND_DEV(INTEL, X38_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
26157 X38},
26158 diff -urNp linux-3.0.9/drivers/firewire/core-card.c linux-3.0.9/drivers/firewire/core-card.c
26159 --- linux-3.0.9/drivers/firewire/core-card.c 2011-11-11 13:12:24.000000000 -0500
26160 +++ linux-3.0.9/drivers/firewire/core-card.c 2011-11-15 20:02:59.000000000 -0500
26161 @@ -657,7 +657,7 @@ void fw_card_release(struct kref *kref)
26162
26163 void fw_core_remove_card(struct fw_card *card)
26164 {
26165 - struct fw_card_driver dummy_driver = dummy_driver_template;
26166 + fw_card_driver_no_const dummy_driver = dummy_driver_template;
26167
26168 card->driver->update_phy_reg(card, 4,
26169 PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
26170 diff -urNp linux-3.0.9/drivers/firewire/core-cdev.c linux-3.0.9/drivers/firewire/core-cdev.c
26171 --- linux-3.0.9/drivers/firewire/core-cdev.c 2011-11-11 13:12:24.000000000 -0500
26172 +++ linux-3.0.9/drivers/firewire/core-cdev.c 2011-11-15 20:02:59.000000000 -0500
26173 @@ -1313,8 +1313,7 @@ static int init_iso_resource(struct clie
26174 int ret;
26175
26176 if ((request->channels == 0 && request->bandwidth == 0) ||
26177 - request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
26178 - request->bandwidth < 0)
26179 + request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
26180 return -EINVAL;
26181
26182 r = kmalloc(sizeof(*r), GFP_KERNEL);
26183 diff -urNp linux-3.0.9/drivers/firewire/core.h linux-3.0.9/drivers/firewire/core.h
26184 --- linux-3.0.9/drivers/firewire/core.h 2011-11-11 13:12:24.000000000 -0500
26185 +++ linux-3.0.9/drivers/firewire/core.h 2011-11-15 20:02:59.000000000 -0500
26186 @@ -101,6 +101,7 @@ struct fw_card_driver {
26187
26188 int (*stop_iso)(struct fw_iso_context *ctx);
26189 };
26190 +typedef struct fw_card_driver __no_const fw_card_driver_no_const;
26191
26192 void fw_card_initialize(struct fw_card *card,
26193 const struct fw_card_driver *driver, struct device *device);
26194 diff -urNp linux-3.0.9/drivers/firewire/core-transaction.c linux-3.0.9/drivers/firewire/core-transaction.c
26195 --- linux-3.0.9/drivers/firewire/core-transaction.c 2011-11-11 13:12:24.000000000 -0500
26196 +++ linux-3.0.9/drivers/firewire/core-transaction.c 2011-11-15 20:02:59.000000000 -0500
26197 @@ -37,6 +37,7 @@
26198 #include <linux/timer.h>
26199 #include <linux/types.h>
26200 #include <linux/workqueue.h>
26201 +#include <linux/sched.h>
26202
26203 #include <asm/byteorder.h>
26204
26205 @@ -422,6 +423,8 @@ int fw_run_transaction(struct fw_card *c
26206 struct transaction_callback_data d;
26207 struct fw_transaction t;
26208
26209 + pax_track_stack();
26210 +
26211 init_timer_on_stack(&t.split_timeout_timer);
26212 init_completion(&d.done);
26213 d.payload = payload;
26214 diff -urNp linux-3.0.9/drivers/firmware/dmi_scan.c linux-3.0.9/drivers/firmware/dmi_scan.c
26215 --- linux-3.0.9/drivers/firmware/dmi_scan.c 2011-11-11 13:12:24.000000000 -0500
26216 +++ linux-3.0.9/drivers/firmware/dmi_scan.c 2011-11-15 20:02:59.000000000 -0500
26217 @@ -449,11 +449,6 @@ void __init dmi_scan_machine(void)
26218 }
26219 }
26220 else {
26221 - /*
26222 - * no iounmap() for that ioremap(); it would be a no-op, but
26223 - * it's so early in setup that sucker gets confused into doing
26224 - * what it shouldn't if we actually call it.
26225 - */
26226 p = dmi_ioremap(0xF0000, 0x10000);
26227 if (p == NULL)
26228 goto error;
26229 @@ -725,7 +720,7 @@ int dmi_walk(void (*decode)(const struct
26230 if (buf == NULL)
26231 return -1;
26232
26233 - dmi_table(buf, dmi_len, dmi_num, decode, private_data);
26234 + dmi_table((char __force_kernel *)buf, dmi_len, dmi_num, decode, private_data);
26235
26236 iounmap(buf);
26237 return 0;
26238 diff -urNp linux-3.0.9/drivers/gpio/vr41xx_giu.c linux-3.0.9/drivers/gpio/vr41xx_giu.c
26239 --- linux-3.0.9/drivers/gpio/vr41xx_giu.c 2011-11-11 13:12:24.000000000 -0500
26240 +++ linux-3.0.9/drivers/gpio/vr41xx_giu.c 2011-11-15 20:02:59.000000000 -0500
26241 @@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
26242 printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
26243 maskl, pendl, maskh, pendh);
26244
26245 - atomic_inc(&irq_err_count);
26246 + atomic_inc_unchecked(&irq_err_count);
26247
26248 return -EINVAL;
26249 }
26250 diff -urNp linux-3.0.9/drivers/gpu/drm/drm_crtc.c linux-3.0.9/drivers/gpu/drm/drm_crtc.c
26251 --- linux-3.0.9/drivers/gpu/drm/drm_crtc.c 2011-11-11 13:12:24.000000000 -0500
26252 +++ linux-3.0.9/drivers/gpu/drm/drm_crtc.c 2011-11-15 20:02:59.000000000 -0500
26253 @@ -1372,7 +1372,7 @@ int drm_mode_getconnector(struct drm_dev
26254 */
26255 if ((out_resp->count_modes >= mode_count) && mode_count) {
26256 copied = 0;
26257 - mode_ptr = (struct drm_mode_modeinfo *)(unsigned long)out_resp->modes_ptr;
26258 + mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
26259 list_for_each_entry(mode, &connector->modes, head) {
26260 drm_crtc_convert_to_umode(&u_mode, mode);
26261 if (copy_to_user(mode_ptr + copied,
26262 @@ -1387,8 +1387,8 @@ int drm_mode_getconnector(struct drm_dev
26263
26264 if ((out_resp->count_props >= props_count) && props_count) {
26265 copied = 0;
26266 - prop_ptr = (uint32_t *)(unsigned long)(out_resp->props_ptr);
26267 - prop_values = (uint64_t *)(unsigned long)(out_resp->prop_values_ptr);
26268 + prop_ptr = (uint32_t __user *)(unsigned long)(out_resp->props_ptr);
26269 + prop_values = (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr);
26270 for (i = 0; i < DRM_CONNECTOR_MAX_PROPERTY; i++) {
26271 if (connector->property_ids[i] != 0) {
26272 if (put_user(connector->property_ids[i],
26273 @@ -1410,7 +1410,7 @@ int drm_mode_getconnector(struct drm_dev
26274
26275 if ((out_resp->count_encoders >= encoders_count) && encoders_count) {
26276 copied = 0;
26277 - encoder_ptr = (uint32_t *)(unsigned long)(out_resp->encoders_ptr);
26278 + encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr);
26279 for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
26280 if (connector->encoder_ids[i] != 0) {
26281 if (put_user(connector->encoder_ids[i],
26282 @@ -1569,7 +1569,7 @@ int drm_mode_setcrtc(struct drm_device *
26283 }
26284
26285 for (i = 0; i < crtc_req->count_connectors; i++) {
26286 - set_connectors_ptr = (uint32_t *)(unsigned long)crtc_req->set_connectors_ptr;
26287 + set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
26288 if (get_user(out_id, &set_connectors_ptr[i])) {
26289 ret = -EFAULT;
26290 goto out;
26291 @@ -1850,7 +1850,7 @@ int drm_mode_dirtyfb_ioctl(struct drm_de
26292 fb = obj_to_fb(obj);
26293
26294 num_clips = r->num_clips;
26295 - clips_ptr = (struct drm_clip_rect *)(unsigned long)r->clips_ptr;
26296 + clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
26297
26298 if (!num_clips != !clips_ptr) {
26299 ret = -EINVAL;
26300 @@ -2270,7 +2270,7 @@ int drm_mode_getproperty_ioctl(struct dr
26301 out_resp->flags = property->flags;
26302
26303 if ((out_resp->count_values >= value_count) && value_count) {
26304 - values_ptr = (uint64_t *)(unsigned long)out_resp->values_ptr;
26305 + values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr;
26306 for (i = 0; i < value_count; i++) {
26307 if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) {
26308 ret = -EFAULT;
26309 @@ -2283,7 +2283,7 @@ int drm_mode_getproperty_ioctl(struct dr
26310 if (property->flags & DRM_MODE_PROP_ENUM) {
26311 if ((out_resp->count_enum_blobs >= enum_count) && enum_count) {
26312 copied = 0;
26313 - enum_ptr = (struct drm_mode_property_enum *)(unsigned long)out_resp->enum_blob_ptr;
26314 + enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr;
26315 list_for_each_entry(prop_enum, &property->enum_blob_list, head) {
26316
26317 if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) {
26318 @@ -2306,7 +2306,7 @@ int drm_mode_getproperty_ioctl(struct dr
26319 if ((out_resp->count_enum_blobs >= blob_count) && blob_count) {
26320 copied = 0;
26321 blob_id_ptr = (uint32_t *)(unsigned long)out_resp->enum_blob_ptr;
26322 - blob_length_ptr = (uint32_t *)(unsigned long)out_resp->values_ptr;
26323 + blob_length_ptr = (uint32_t __user *)(unsigned long)out_resp->values_ptr;
26324
26325 list_for_each_entry(prop_blob, &property->enum_blob_list, head) {
26326 if (put_user(prop_blob->base.id, blob_id_ptr + copied)) {
26327 @@ -2367,7 +2367,7 @@ int drm_mode_getblob_ioctl(struct drm_de
26328 struct drm_mode_get_blob *out_resp = data;
26329 struct drm_property_blob *blob;
26330 int ret = 0;
26331 - void *blob_ptr;
26332 + void __user *blob_ptr;
26333
26334 if (!drm_core_check_feature(dev, DRIVER_MODESET))
26335 return -EINVAL;
26336 @@ -2381,7 +2381,7 @@ int drm_mode_getblob_ioctl(struct drm_de
26337 blob = obj_to_blob(obj);
26338
26339 if (out_resp->length == blob->length) {
26340 - blob_ptr = (void *)(unsigned long)out_resp->data;
26341 + blob_ptr = (void __user *)(unsigned long)out_resp->data;
26342 if (copy_to_user(blob_ptr, blob->data, blob->length)){
26343 ret = -EFAULT;
26344 goto done;
26345 diff -urNp linux-3.0.9/drivers/gpu/drm/drm_crtc_helper.c linux-3.0.9/drivers/gpu/drm/drm_crtc_helper.c
26346 --- linux-3.0.9/drivers/gpu/drm/drm_crtc_helper.c 2011-11-11 13:12:24.000000000 -0500
26347 +++ linux-3.0.9/drivers/gpu/drm/drm_crtc_helper.c 2011-11-15 20:02:59.000000000 -0500
26348 @@ -276,7 +276,7 @@ static bool drm_encoder_crtc_ok(struct d
26349 struct drm_crtc *tmp;
26350 int crtc_mask = 1;
26351
26352 - WARN(!crtc, "checking null crtc?\n");
26353 + BUG_ON(!crtc);
26354
26355 dev = crtc->dev;
26356
26357 @@ -343,6 +343,8 @@ bool drm_crtc_helper_set_mode(struct drm
26358 struct drm_encoder *encoder;
26359 bool ret = true;
26360
26361 + pax_track_stack();
26362 +
26363 crtc->enabled = drm_helper_crtc_in_use(crtc);
26364 if (!crtc->enabled)
26365 return true;
26366 diff -urNp linux-3.0.9/drivers/gpu/drm/drm_drv.c linux-3.0.9/drivers/gpu/drm/drm_drv.c
26367 --- linux-3.0.9/drivers/gpu/drm/drm_drv.c 2011-11-11 13:12:24.000000000 -0500
26368 +++ linux-3.0.9/drivers/gpu/drm/drm_drv.c 2011-11-15 20:02:59.000000000 -0500
26369 @@ -307,7 +307,7 @@ module_exit(drm_core_exit);
26370 /**
26371 * Copy and IOCTL return string to user space
26372 */
26373 -static int drm_copy_field(char *buf, size_t *buf_len, const char *value)
26374 +static int drm_copy_field(char __user *buf, size_t *buf_len, const char *value)
26375 {
26376 int len;
26377
26378 @@ -386,7 +386,7 @@ long drm_ioctl(struct file *filp,
26379
26380 dev = file_priv->minor->dev;
26381 atomic_inc(&dev->ioctl_count);
26382 - atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
26383 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
26384 ++file_priv->ioctl_count;
26385
26386 DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
26387 diff -urNp linux-3.0.9/drivers/gpu/drm/drm_fops.c linux-3.0.9/drivers/gpu/drm/drm_fops.c
26388 --- linux-3.0.9/drivers/gpu/drm/drm_fops.c 2011-11-11 13:12:24.000000000 -0500
26389 +++ linux-3.0.9/drivers/gpu/drm/drm_fops.c 2011-11-15 20:02:59.000000000 -0500
26390 @@ -70,7 +70,7 @@ static int drm_setup(struct drm_device *
26391 }
26392
26393 for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
26394 - atomic_set(&dev->counts[i], 0);
26395 + atomic_set_unchecked(&dev->counts[i], 0);
26396
26397 dev->sigdata.lock = NULL;
26398
26399 @@ -134,8 +134,8 @@ int drm_open(struct inode *inode, struct
26400
26401 retcode = drm_open_helper(inode, filp, dev);
26402 if (!retcode) {
26403 - atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
26404 - if (!dev->open_count++)
26405 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
26406 + if (local_inc_return(&dev->open_count) == 1)
26407 retcode = drm_setup(dev);
26408 }
26409 if (!retcode) {
26410 @@ -472,7 +472,7 @@ int drm_release(struct inode *inode, str
26411
26412 mutex_lock(&drm_global_mutex);
26413
26414 - DRM_DEBUG("open_count = %d\n", dev->open_count);
26415 + DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
26416
26417 if (dev->driver->preclose)
26418 dev->driver->preclose(dev, file_priv);
26419 @@ -484,7 +484,7 @@ int drm_release(struct inode *inode, str
26420 DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
26421 task_pid_nr(current),
26422 (long)old_encode_dev(file_priv->minor->device),
26423 - dev->open_count);
26424 + local_read(&dev->open_count));
26425
26426 /* if the master has gone away we can't do anything with the lock */
26427 if (file_priv->minor->master)
26428 @@ -565,8 +565,8 @@ int drm_release(struct inode *inode, str
26429 * End inline drm_release
26430 */
26431
26432 - atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
26433 - if (!--dev->open_count) {
26434 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
26435 + if (local_dec_and_test(&dev->open_count)) {
26436 if (atomic_read(&dev->ioctl_count)) {
26437 DRM_ERROR("Device busy: %d\n",
26438 atomic_read(&dev->ioctl_count));
26439 diff -urNp linux-3.0.9/drivers/gpu/drm/drm_global.c linux-3.0.9/drivers/gpu/drm/drm_global.c
26440 --- linux-3.0.9/drivers/gpu/drm/drm_global.c 2011-11-11 13:12:24.000000000 -0500
26441 +++ linux-3.0.9/drivers/gpu/drm/drm_global.c 2011-11-15 20:02:59.000000000 -0500
26442 @@ -36,7 +36,7 @@
26443 struct drm_global_item {
26444 struct mutex mutex;
26445 void *object;
26446 - int refcount;
26447 + atomic_t refcount;
26448 };
26449
26450 static struct drm_global_item glob[DRM_GLOBAL_NUM];
26451 @@ -49,7 +49,7 @@ void drm_global_init(void)
26452 struct drm_global_item *item = &glob[i];
26453 mutex_init(&item->mutex);
26454 item->object = NULL;
26455 - item->refcount = 0;
26456 + atomic_set(&item->refcount, 0);
26457 }
26458 }
26459
26460 @@ -59,7 +59,7 @@ void drm_global_release(void)
26461 for (i = 0; i < DRM_GLOBAL_NUM; ++i) {
26462 struct drm_global_item *item = &glob[i];
26463 BUG_ON(item->object != NULL);
26464 - BUG_ON(item->refcount != 0);
26465 + BUG_ON(atomic_read(&item->refcount) != 0);
26466 }
26467 }
26468
26469 @@ -70,7 +70,7 @@ int drm_global_item_ref(struct drm_globa
26470 void *object;
26471
26472 mutex_lock(&item->mutex);
26473 - if (item->refcount == 0) {
26474 + if (atomic_read(&item->refcount) == 0) {
26475 item->object = kzalloc(ref->size, GFP_KERNEL);
26476 if (unlikely(item->object == NULL)) {
26477 ret = -ENOMEM;
26478 @@ -83,7 +83,7 @@ int drm_global_item_ref(struct drm_globa
26479 goto out_err;
26480
26481 }
26482 - ++item->refcount;
26483 + atomic_inc(&item->refcount);
26484 ref->object = item->object;
26485 object = item->object;
26486 mutex_unlock(&item->mutex);
26487 @@ -100,9 +100,9 @@ void drm_global_item_unref(struct drm_gl
26488 struct drm_global_item *item = &glob[ref->global_type];
26489
26490 mutex_lock(&item->mutex);
26491 - BUG_ON(item->refcount == 0);
26492 + BUG_ON(atomic_read(&item->refcount) == 0);
26493 BUG_ON(ref->object != item->object);
26494 - if (--item->refcount == 0) {
26495 + if (atomic_dec_and_test(&item->refcount)) {
26496 ref->release(ref);
26497 item->object = NULL;
26498 }
26499 diff -urNp linux-3.0.9/drivers/gpu/drm/drm_info.c linux-3.0.9/drivers/gpu/drm/drm_info.c
26500 --- linux-3.0.9/drivers/gpu/drm/drm_info.c 2011-11-11 13:12:24.000000000 -0500
26501 +++ linux-3.0.9/drivers/gpu/drm/drm_info.c 2011-11-15 20:02:59.000000000 -0500
26502 @@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void
26503 struct drm_local_map *map;
26504 struct drm_map_list *r_list;
26505
26506 - /* Hardcoded from _DRM_FRAME_BUFFER,
26507 - _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
26508 - _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
26509 - const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
26510 + static const char * const types[] = {
26511 + [_DRM_FRAME_BUFFER] = "FB",
26512 + [_DRM_REGISTERS] = "REG",
26513 + [_DRM_SHM] = "SHM",
26514 + [_DRM_AGP] = "AGP",
26515 + [_DRM_SCATTER_GATHER] = "SG",
26516 + [_DRM_CONSISTENT] = "PCI",
26517 + [_DRM_GEM] = "GEM" };
26518 const char *type;
26519 int i;
26520
26521 @@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void
26522 map = r_list->map;
26523 if (!map)
26524 continue;
26525 - if (map->type < 0 || map->type > 5)
26526 + if (map->type >= ARRAY_SIZE(types))
26527 type = "??";
26528 else
26529 type = types[map->type];
26530 @@ -290,7 +294,11 @@ int drm_vma_info(struct seq_file *m, voi
26531 vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
26532 vma->vm_flags & VM_LOCKED ? 'l' : '-',
26533 vma->vm_flags & VM_IO ? 'i' : '-',
26534 +#ifdef CONFIG_GRKERNSEC_HIDESYM
26535 + 0);
26536 +#else
26537 vma->vm_pgoff);
26538 +#endif
26539
26540 #if defined(__i386__)
26541 pgprot = pgprot_val(vma->vm_page_prot);
26542 diff -urNp linux-3.0.9/drivers/gpu/drm/drm_ioc32.c linux-3.0.9/drivers/gpu/drm/drm_ioc32.c
26543 --- linux-3.0.9/drivers/gpu/drm/drm_ioc32.c 2011-11-11 13:12:24.000000000 -0500
26544 +++ linux-3.0.9/drivers/gpu/drm/drm_ioc32.c 2011-11-15 20:02:59.000000000 -0500
26545 @@ -455,7 +455,7 @@ static int compat_drm_infobufs(struct fi
26546 request = compat_alloc_user_space(nbytes);
26547 if (!access_ok(VERIFY_WRITE, request, nbytes))
26548 return -EFAULT;
26549 - list = (struct drm_buf_desc *) (request + 1);
26550 + list = (struct drm_buf_desc __user *) (request + 1);
26551
26552 if (__put_user(count, &request->count)
26553 || __put_user(list, &request->list))
26554 @@ -516,7 +516,7 @@ static int compat_drm_mapbufs(struct fil
26555 request = compat_alloc_user_space(nbytes);
26556 if (!access_ok(VERIFY_WRITE, request, nbytes))
26557 return -EFAULT;
26558 - list = (struct drm_buf_pub *) (request + 1);
26559 + list = (struct drm_buf_pub __user *) (request + 1);
26560
26561 if (__put_user(count, &request->count)
26562 || __put_user(list, &request->list))
26563 diff -urNp linux-3.0.9/drivers/gpu/drm/drm_ioctl.c linux-3.0.9/drivers/gpu/drm/drm_ioctl.c
26564 --- linux-3.0.9/drivers/gpu/drm/drm_ioctl.c 2011-11-11 13:12:24.000000000 -0500
26565 +++ linux-3.0.9/drivers/gpu/drm/drm_ioctl.c 2011-11-15 20:02:59.000000000 -0500
26566 @@ -256,7 +256,7 @@ int drm_getstats(struct drm_device *dev,
26567 stats->data[i].value =
26568 (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
26569 else
26570 - stats->data[i].value = atomic_read(&dev->counts[i]);
26571 + stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
26572 stats->data[i].type = dev->types[i];
26573 }
26574
26575 diff -urNp linux-3.0.9/drivers/gpu/drm/drm_lock.c linux-3.0.9/drivers/gpu/drm/drm_lock.c
26576 --- linux-3.0.9/drivers/gpu/drm/drm_lock.c 2011-11-11 13:12:24.000000000 -0500
26577 +++ linux-3.0.9/drivers/gpu/drm/drm_lock.c 2011-11-15 20:02:59.000000000 -0500
26578 @@ -89,7 +89,7 @@ int drm_lock(struct drm_device *dev, voi
26579 if (drm_lock_take(&master->lock, lock->context)) {
26580 master->lock.file_priv = file_priv;
26581 master->lock.lock_time = jiffies;
26582 - atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
26583 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
26584 break; /* Got lock */
26585 }
26586
26587 @@ -160,7 +160,7 @@ int drm_unlock(struct drm_device *dev, v
26588 return -EINVAL;
26589 }
26590
26591 - atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
26592 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
26593
26594 if (drm_lock_free(&master->lock, lock->context)) {
26595 /* FIXME: Should really bail out here. */
26596 diff -urNp linux-3.0.9/drivers/gpu/drm/i810/i810_dma.c linux-3.0.9/drivers/gpu/drm/i810/i810_dma.c
26597 --- linux-3.0.9/drivers/gpu/drm/i810/i810_dma.c 2011-11-11 13:12:24.000000000 -0500
26598 +++ linux-3.0.9/drivers/gpu/drm/i810/i810_dma.c 2011-11-15 20:02:59.000000000 -0500
26599 @@ -950,8 +950,8 @@ static int i810_dma_vertex(struct drm_de
26600 dma->buflist[vertex->idx],
26601 vertex->discard, vertex->used);
26602
26603 - atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
26604 - atomic_inc(&dev->counts[_DRM_STAT_DMA]);
26605 + atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
26606 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
26607 sarea_priv->last_enqueue = dev_priv->counter - 1;
26608 sarea_priv->last_dispatch = (int)hw_status[5];
26609
26610 @@ -1111,8 +1111,8 @@ static int i810_dma_mc(struct drm_device
26611 i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
26612 mc->last_render);
26613
26614 - atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
26615 - atomic_inc(&dev->counts[_DRM_STAT_DMA]);
26616 + atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
26617 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
26618 sarea_priv->last_enqueue = dev_priv->counter - 1;
26619 sarea_priv->last_dispatch = (int)hw_status[5];
26620
26621 diff -urNp linux-3.0.9/drivers/gpu/drm/i810/i810_drv.h linux-3.0.9/drivers/gpu/drm/i810/i810_drv.h
26622 --- linux-3.0.9/drivers/gpu/drm/i810/i810_drv.h 2011-11-11 13:12:24.000000000 -0500
26623 +++ linux-3.0.9/drivers/gpu/drm/i810/i810_drv.h 2011-11-15 20:02:59.000000000 -0500
26624 @@ -108,8 +108,8 @@ typedef struct drm_i810_private {
26625 int page_flipping;
26626
26627 wait_queue_head_t irq_queue;
26628 - atomic_t irq_received;
26629 - atomic_t irq_emitted;
26630 + atomic_unchecked_t irq_received;
26631 + atomic_unchecked_t irq_emitted;
26632
26633 int front_offset;
26634 } drm_i810_private_t;
26635 diff -urNp linux-3.0.9/drivers/gpu/drm/i915/i915_debugfs.c linux-3.0.9/drivers/gpu/drm/i915/i915_debugfs.c
26636 --- linux-3.0.9/drivers/gpu/drm/i915/i915_debugfs.c 2011-11-11 13:12:24.000000000 -0500
26637 +++ linux-3.0.9/drivers/gpu/drm/i915/i915_debugfs.c 2011-11-15 20:02:59.000000000 -0500
26638 @@ -497,7 +497,7 @@ static int i915_interrupt_info(struct se
26639 I915_READ(GTIMR));
26640 }
26641 seq_printf(m, "Interrupts received: %d\n",
26642 - atomic_read(&dev_priv->irq_received));
26643 + atomic_read_unchecked(&dev_priv->irq_received));
26644 for (i = 0; i < I915_NUM_RINGS; i++) {
26645 if (IS_GEN6(dev)) {
26646 seq_printf(m, "Graphics Interrupt mask (%s): %08x\n",
26647 @@ -1147,7 +1147,7 @@ static int i915_opregion(struct seq_file
26648 return ret;
26649
26650 if (opregion->header)
26651 - seq_write(m, opregion->header, OPREGION_SIZE);
26652 + seq_write(m, (const void __force_kernel *)opregion->header, OPREGION_SIZE);
26653
26654 mutex_unlock(&dev->struct_mutex);
26655
26656 diff -urNp linux-3.0.9/drivers/gpu/drm/i915/i915_dma.c linux-3.0.9/drivers/gpu/drm/i915/i915_dma.c
26657 --- linux-3.0.9/drivers/gpu/drm/i915/i915_dma.c 2011-11-11 13:12:24.000000000 -0500
26658 +++ linux-3.0.9/drivers/gpu/drm/i915/i915_dma.c 2011-11-15 20:02:59.000000000 -0500
26659 @@ -1169,7 +1169,7 @@ static bool i915_switcheroo_can_switch(s
26660 bool can_switch;
26661
26662 spin_lock(&dev->count_lock);
26663 - can_switch = (dev->open_count == 0);
26664 + can_switch = (local_read(&dev->open_count) == 0);
26665 spin_unlock(&dev->count_lock);
26666 return can_switch;
26667 }
26668 diff -urNp linux-3.0.9/drivers/gpu/drm/i915/i915_drv.h linux-3.0.9/drivers/gpu/drm/i915/i915_drv.h
26669 --- linux-3.0.9/drivers/gpu/drm/i915/i915_drv.h 2011-11-11 13:12:24.000000000 -0500
26670 +++ linux-3.0.9/drivers/gpu/drm/i915/i915_drv.h 2011-11-15 20:02:59.000000000 -0500
26671 @@ -219,7 +219,7 @@ struct drm_i915_display_funcs {
26672 /* render clock increase/decrease */
26673 /* display clock increase/decrease */
26674 /* pll clock increase/decrease */
26675 -};
26676 +} __no_const;
26677
26678 struct intel_device_info {
26679 u8 gen;
26680 @@ -300,7 +300,7 @@ typedef struct drm_i915_private {
26681 int current_page;
26682 int page_flipping;
26683
26684 - atomic_t irq_received;
26685 + atomic_unchecked_t irq_received;
26686
26687 /* protects the irq masks */
26688 spinlock_t irq_lock;
26689 @@ -874,7 +874,7 @@ struct drm_i915_gem_object {
26690 * will be page flipped away on the next vblank. When it
26691 * reaches 0, dev_priv->pending_flip_queue will be woken up.
26692 */
26693 - atomic_t pending_flip;
26694 + atomic_unchecked_t pending_flip;
26695 };
26696
26697 #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
26698 @@ -1247,7 +1247,7 @@ extern int intel_setup_gmbus(struct drm_
26699 extern void intel_teardown_gmbus(struct drm_device *dev);
26700 extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed);
26701 extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit);
26702 -extern inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
26703 +static inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
26704 {
26705 return container_of(adapter, struct intel_gmbus, adapter)->force_bit;
26706 }
26707 diff -urNp linux-3.0.9/drivers/gpu/drm/i915/i915_gem_execbuffer.c linux-3.0.9/drivers/gpu/drm/i915/i915_gem_execbuffer.c
26708 --- linux-3.0.9/drivers/gpu/drm/i915/i915_gem_execbuffer.c 2011-11-11 13:12:24.000000000 -0500
26709 +++ linux-3.0.9/drivers/gpu/drm/i915/i915_gem_execbuffer.c 2011-11-15 20:02:59.000000000 -0500
26710 @@ -188,7 +188,7 @@ i915_gem_object_set_to_gpu_domain(struct
26711 i915_gem_clflush_object(obj);
26712
26713 if (obj->base.pending_write_domain)
26714 - cd->flips |= atomic_read(&obj->pending_flip);
26715 + cd->flips |= atomic_read_unchecked(&obj->pending_flip);
26716
26717 /* The actual obj->write_domain will be updated with
26718 * pending_write_domain after we emit the accumulated flush for all
26719 diff -urNp linux-3.0.9/drivers/gpu/drm/i915/i915_irq.c linux-3.0.9/drivers/gpu/drm/i915/i915_irq.c
26720 --- linux-3.0.9/drivers/gpu/drm/i915/i915_irq.c 2011-11-11 13:12:24.000000000 -0500
26721 +++ linux-3.0.9/drivers/gpu/drm/i915/i915_irq.c 2011-11-15 20:02:59.000000000 -0500
26722 @@ -473,7 +473,7 @@ static irqreturn_t ivybridge_irq_handler
26723 u32 de_iir, gt_iir, de_ier, pch_iir, pm_iir;
26724 struct drm_i915_master_private *master_priv;
26725
26726 - atomic_inc(&dev_priv->irq_received);
26727 + atomic_inc_unchecked(&dev_priv->irq_received);
26728
26729 /* disable master interrupt before clearing iir */
26730 de_ier = I915_READ(DEIER);
26731 @@ -563,7 +563,7 @@ static irqreturn_t ironlake_irq_handler(
26732 struct drm_i915_master_private *master_priv;
26733 u32 bsd_usr_interrupt = GT_BSD_USER_INTERRUPT;
26734
26735 - atomic_inc(&dev_priv->irq_received);
26736 + atomic_inc_unchecked(&dev_priv->irq_received);
26737
26738 if (IS_GEN6(dev))
26739 bsd_usr_interrupt = GT_GEN6_BSD_USER_INTERRUPT;
26740 @@ -1226,7 +1226,7 @@ static irqreturn_t i915_driver_irq_handl
26741 int ret = IRQ_NONE, pipe;
26742 bool blc_event = false;
26743
26744 - atomic_inc(&dev_priv->irq_received);
26745 + atomic_inc_unchecked(&dev_priv->irq_received);
26746
26747 iir = I915_READ(IIR);
26748
26749 @@ -1735,7 +1735,7 @@ static void ironlake_irq_preinstall(stru
26750 {
26751 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
26752
26753 - atomic_set(&dev_priv->irq_received, 0);
26754 + atomic_set_unchecked(&dev_priv->irq_received, 0);
26755
26756 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
26757 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
26758 @@ -1899,7 +1899,7 @@ static void i915_driver_irq_preinstall(s
26759 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
26760 int pipe;
26761
26762 - atomic_set(&dev_priv->irq_received, 0);
26763 + atomic_set_unchecked(&dev_priv->irq_received, 0);
26764
26765 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
26766 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
26767 diff -urNp linux-3.0.9/drivers/gpu/drm/i915/intel_display.c linux-3.0.9/drivers/gpu/drm/i915/intel_display.c
26768 --- linux-3.0.9/drivers/gpu/drm/i915/intel_display.c 2011-11-11 13:12:24.000000000 -0500
26769 +++ linux-3.0.9/drivers/gpu/drm/i915/intel_display.c 2011-11-15 20:02:59.000000000 -0500
26770 @@ -1961,7 +1961,7 @@ intel_pipe_set_base(struct drm_crtc *crt
26771
26772 wait_event(dev_priv->pending_flip_queue,
26773 atomic_read(&dev_priv->mm.wedged) ||
26774 - atomic_read(&obj->pending_flip) == 0);
26775 + atomic_read_unchecked(&obj->pending_flip) == 0);
26776
26777 /* Big Hammer, we also need to ensure that any pending
26778 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
26779 @@ -2548,7 +2548,7 @@ static void intel_crtc_wait_for_pending_
26780 obj = to_intel_framebuffer(crtc->fb)->obj;
26781 dev_priv = crtc->dev->dev_private;
26782 wait_event(dev_priv->pending_flip_queue,
26783 - atomic_read(&obj->pending_flip) == 0);
26784 + atomic_read_unchecked(&obj->pending_flip) == 0);
26785 }
26786
26787 static bool intel_crtc_driving_pch(struct drm_crtc *crtc)
26788 @@ -6225,7 +6225,7 @@ static void do_intel_finish_page_flip(st
26789
26790 atomic_clear_mask(1 << intel_crtc->plane,
26791 &obj->pending_flip.counter);
26792 - if (atomic_read(&obj->pending_flip) == 0)
26793 + if (atomic_read_unchecked(&obj->pending_flip) == 0)
26794 wake_up(&dev_priv->pending_flip_queue);
26795
26796 schedule_work(&work->work);
26797 @@ -6514,7 +6514,7 @@ static int intel_crtc_page_flip(struct d
26798 /* Block clients from rendering to the new back buffer until
26799 * the flip occurs and the object is no longer visible.
26800 */
26801 - atomic_add(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
26802 + atomic_add_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
26803
26804 ret = dev_priv->display.queue_flip(dev, crtc, fb, obj);
26805 if (ret)
26806 @@ -6527,7 +6527,7 @@ static int intel_crtc_page_flip(struct d
26807 return 0;
26808
26809 cleanup_pending:
26810 - atomic_sub(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
26811 + atomic_sub_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
26812 cleanup_objs:
26813 drm_gem_object_unreference(&work->old_fb_obj->base);
26814 drm_gem_object_unreference(&obj->base);
26815 diff -urNp linux-3.0.9/drivers/gpu/drm/mga/mga_drv.h linux-3.0.9/drivers/gpu/drm/mga/mga_drv.h
26816 --- linux-3.0.9/drivers/gpu/drm/mga/mga_drv.h 2011-11-11 13:12:24.000000000 -0500
26817 +++ linux-3.0.9/drivers/gpu/drm/mga/mga_drv.h 2011-11-15 20:02:59.000000000 -0500
26818 @@ -120,9 +120,9 @@ typedef struct drm_mga_private {
26819 u32 clear_cmd;
26820 u32 maccess;
26821
26822 - atomic_t vbl_received; /**< Number of vblanks received. */
26823 + atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
26824 wait_queue_head_t fence_queue;
26825 - atomic_t last_fence_retired;
26826 + atomic_unchecked_t last_fence_retired;
26827 u32 next_fence_to_post;
26828
26829 unsigned int fb_cpp;
26830 diff -urNp linux-3.0.9/drivers/gpu/drm/mga/mga_irq.c linux-3.0.9/drivers/gpu/drm/mga/mga_irq.c
26831 --- linux-3.0.9/drivers/gpu/drm/mga/mga_irq.c 2011-11-11 13:12:24.000000000 -0500
26832 +++ linux-3.0.9/drivers/gpu/drm/mga/mga_irq.c 2011-11-15 20:02:59.000000000 -0500
26833 @@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_de
26834 if (crtc != 0)
26835 return 0;
26836
26837 - return atomic_read(&dev_priv->vbl_received);
26838 + return atomic_read_unchecked(&dev_priv->vbl_received);
26839 }
26840
26841
26842 @@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
26843 /* VBLANK interrupt */
26844 if (status & MGA_VLINEPEN) {
26845 MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
26846 - atomic_inc(&dev_priv->vbl_received);
26847 + atomic_inc_unchecked(&dev_priv->vbl_received);
26848 drm_handle_vblank(dev, 0);
26849 handled = 1;
26850 }
26851 @@ -79,7 +79,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
26852 if ((prim_start & ~0x03) != (prim_end & ~0x03))
26853 MGA_WRITE(MGA_PRIMEND, prim_end);
26854
26855 - atomic_inc(&dev_priv->last_fence_retired);
26856 + atomic_inc_unchecked(&dev_priv->last_fence_retired);
26857 DRM_WAKEUP(&dev_priv->fence_queue);
26858 handled = 1;
26859 }
26860 @@ -130,7 +130,7 @@ int mga_driver_fence_wait(struct drm_dev
26861 * using fences.
26862 */
26863 DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
26864 - (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
26865 + (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
26866 - *sequence) <= (1 << 23)));
26867
26868 *sequence = cur_fence;
26869 diff -urNp linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_bios.c linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_bios.c
26870 --- linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_bios.c 2011-11-11 13:12:24.000000000 -0500
26871 +++ linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_bios.c 2011-11-15 20:02:59.000000000 -0500
26872 @@ -200,7 +200,7 @@ struct methods {
26873 const char desc[8];
26874 void (*loadbios)(struct drm_device *, uint8_t *);
26875 const bool rw;
26876 -};
26877 +} __do_const;
26878
26879 static struct methods shadow_methods[] = {
26880 { "PRAMIN", load_vbios_pramin, true },
26881 @@ -5488,7 +5488,7 @@ parse_bit_displayport_tbl_entry(struct d
26882 struct bit_table {
26883 const char id;
26884 int (* const parse_fn)(struct drm_device *, struct nvbios *, struct bit_entry *);
26885 -};
26886 +} __no_const;
26887
26888 #define BIT_TABLE(id, funcid) ((struct bit_table){ id, parse_bit_##funcid##_tbl_entry })
26889
26890 diff -urNp linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_drv.h linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_drv.h
26891 --- linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-11-11 13:12:24.000000000 -0500
26892 +++ linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-11-15 20:02:59.000000000 -0500
26893 @@ -227,7 +227,7 @@ struct nouveau_channel {
26894 struct list_head pending;
26895 uint32_t sequence;
26896 uint32_t sequence_ack;
26897 - atomic_t last_sequence_irq;
26898 + atomic_unchecked_t last_sequence_irq;
26899 } fence;
26900
26901 /* DMA push buffer */
26902 @@ -304,7 +304,7 @@ struct nouveau_exec_engine {
26903 u32 handle, u16 class);
26904 void (*set_tile_region)(struct drm_device *dev, int i);
26905 void (*tlb_flush)(struct drm_device *, int engine);
26906 -};
26907 +} __no_const;
26908
26909 struct nouveau_instmem_engine {
26910 void *priv;
26911 @@ -325,13 +325,13 @@ struct nouveau_instmem_engine {
26912 struct nouveau_mc_engine {
26913 int (*init)(struct drm_device *dev);
26914 void (*takedown)(struct drm_device *dev);
26915 -};
26916 +} __no_const;
26917
26918 struct nouveau_timer_engine {
26919 int (*init)(struct drm_device *dev);
26920 void (*takedown)(struct drm_device *dev);
26921 uint64_t (*read)(struct drm_device *dev);
26922 -};
26923 +} __no_const;
26924
26925 struct nouveau_fb_engine {
26926 int num_tiles;
26927 @@ -494,7 +494,7 @@ struct nouveau_vram_engine {
26928 void (*put)(struct drm_device *, struct nouveau_mem **);
26929
26930 bool (*flags_valid)(struct drm_device *, u32 tile_flags);
26931 -};
26932 +} __no_const;
26933
26934 struct nouveau_engine {
26935 struct nouveau_instmem_engine instmem;
26936 @@ -640,7 +640,7 @@ struct drm_nouveau_private {
26937 struct drm_global_reference mem_global_ref;
26938 struct ttm_bo_global_ref bo_global_ref;
26939 struct ttm_bo_device bdev;
26940 - atomic_t validate_sequence;
26941 + atomic_unchecked_t validate_sequence;
26942 } ttm;
26943
26944 struct {
26945 diff -urNp linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_fence.c linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_fence.c
26946 --- linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_fence.c 2011-11-11 13:12:24.000000000 -0500
26947 +++ linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_fence.c 2011-11-15 20:02:59.000000000 -0500
26948 @@ -85,7 +85,7 @@ nouveau_fence_update(struct nouveau_chan
26949 if (USE_REFCNT(dev))
26950 sequence = nvchan_rd32(chan, 0x48);
26951 else
26952 - sequence = atomic_read(&chan->fence.last_sequence_irq);
26953 + sequence = atomic_read_unchecked(&chan->fence.last_sequence_irq);
26954
26955 if (chan->fence.sequence_ack == sequence)
26956 goto out;
26957 @@ -544,7 +544,7 @@ nouveau_fence_channel_init(struct nouvea
26958
26959 INIT_LIST_HEAD(&chan->fence.pending);
26960 spin_lock_init(&chan->fence.lock);
26961 - atomic_set(&chan->fence.last_sequence_irq, 0);
26962 + atomic_set_unchecked(&chan->fence.last_sequence_irq, 0);
26963 return 0;
26964 }
26965
26966 diff -urNp linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_gem.c linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_gem.c
26967 --- linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_gem.c 2011-11-11 13:12:24.000000000 -0500
26968 +++ linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_gem.c 2011-11-15 20:02:59.000000000 -0500
26969 @@ -249,7 +249,7 @@ validate_init(struct nouveau_channel *ch
26970 int trycnt = 0;
26971 int ret, i;
26972
26973 - sequence = atomic_add_return(1, &dev_priv->ttm.validate_sequence);
26974 + sequence = atomic_add_return_unchecked(1, &dev_priv->ttm.validate_sequence);
26975 retry:
26976 if (++trycnt > 100000) {
26977 NV_ERROR(dev, "%s failed and gave up.\n", __func__);
26978 diff -urNp linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_state.c linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_state.c
26979 --- linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_state.c 2011-11-11 13:12:24.000000000 -0500
26980 +++ linux-3.0.9/drivers/gpu/drm/nouveau/nouveau_state.c 2011-11-15 20:02:59.000000000 -0500
26981 @@ -488,7 +488,7 @@ static bool nouveau_switcheroo_can_switc
26982 bool can_switch;
26983
26984 spin_lock(&dev->count_lock);
26985 - can_switch = (dev->open_count == 0);
26986 + can_switch = (local_read(&dev->open_count) == 0);
26987 spin_unlock(&dev->count_lock);
26988 return can_switch;
26989 }
26990 diff -urNp linux-3.0.9/drivers/gpu/drm/nouveau/nv04_graph.c linux-3.0.9/drivers/gpu/drm/nouveau/nv04_graph.c
26991 --- linux-3.0.9/drivers/gpu/drm/nouveau/nv04_graph.c 2011-11-11 13:12:24.000000000 -0500
26992 +++ linux-3.0.9/drivers/gpu/drm/nouveau/nv04_graph.c 2011-11-15 20:02:59.000000000 -0500
26993 @@ -560,7 +560,7 @@ static int
26994 nv04_graph_mthd_set_ref(struct nouveau_channel *chan,
26995 u32 class, u32 mthd, u32 data)
26996 {
26997 - atomic_set(&chan->fence.last_sequence_irq, data);
26998 + atomic_set_unchecked(&chan->fence.last_sequence_irq, data);
26999 return 0;
27000 }
27001
27002 diff -urNp linux-3.0.9/drivers/gpu/drm/r128/r128_cce.c linux-3.0.9/drivers/gpu/drm/r128/r128_cce.c
27003 --- linux-3.0.9/drivers/gpu/drm/r128/r128_cce.c 2011-11-11 13:12:24.000000000 -0500
27004 +++ linux-3.0.9/drivers/gpu/drm/r128/r128_cce.c 2011-11-15 20:02:59.000000000 -0500
27005 @@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_d
27006
27007 /* GH: Simple idle check.
27008 */
27009 - atomic_set(&dev_priv->idle_count, 0);
27010 + atomic_set_unchecked(&dev_priv->idle_count, 0);
27011
27012 /* We don't support anything other than bus-mastering ring mode,
27013 * but the ring can be in either AGP or PCI space for the ring
27014 diff -urNp linux-3.0.9/drivers/gpu/drm/r128/r128_drv.h linux-3.0.9/drivers/gpu/drm/r128/r128_drv.h
27015 --- linux-3.0.9/drivers/gpu/drm/r128/r128_drv.h 2011-11-11 13:12:24.000000000 -0500
27016 +++ linux-3.0.9/drivers/gpu/drm/r128/r128_drv.h 2011-11-15 20:02:59.000000000 -0500
27017 @@ -90,14 +90,14 @@ typedef struct drm_r128_private {
27018 int is_pci;
27019 unsigned long cce_buffers_offset;
27020
27021 - atomic_t idle_count;
27022 + atomic_unchecked_t idle_count;
27023
27024 int page_flipping;
27025 int current_page;
27026 u32 crtc_offset;
27027 u32 crtc_offset_cntl;
27028
27029 - atomic_t vbl_received;
27030 + atomic_unchecked_t vbl_received;
27031
27032 u32 color_fmt;
27033 unsigned int front_offset;
27034 diff -urNp linux-3.0.9/drivers/gpu/drm/r128/r128_irq.c linux-3.0.9/drivers/gpu/drm/r128/r128_irq.c
27035 --- linux-3.0.9/drivers/gpu/drm/r128/r128_irq.c 2011-11-11 13:12:24.000000000 -0500
27036 +++ linux-3.0.9/drivers/gpu/drm/r128/r128_irq.c 2011-11-15 20:02:59.000000000 -0500
27037 @@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_d
27038 if (crtc != 0)
27039 return 0;
27040
27041 - return atomic_read(&dev_priv->vbl_received);
27042 + return atomic_read_unchecked(&dev_priv->vbl_received);
27043 }
27044
27045 irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
27046 @@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_
27047 /* VBLANK interrupt */
27048 if (status & R128_CRTC_VBLANK_INT) {
27049 R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
27050 - atomic_inc(&dev_priv->vbl_received);
27051 + atomic_inc_unchecked(&dev_priv->vbl_received);
27052 drm_handle_vblank(dev, 0);
27053 return IRQ_HANDLED;
27054 }
27055 diff -urNp linux-3.0.9/drivers/gpu/drm/r128/r128_state.c linux-3.0.9/drivers/gpu/drm/r128/r128_state.c
27056 --- linux-3.0.9/drivers/gpu/drm/r128/r128_state.c 2011-11-11 13:12:24.000000000 -0500
27057 +++ linux-3.0.9/drivers/gpu/drm/r128/r128_state.c 2011-11-15 20:02:59.000000000 -0500
27058 @@ -321,10 +321,10 @@ static void r128_clear_box(drm_r128_priv
27059
27060 static void r128_cce_performance_boxes(drm_r128_private_t *dev_priv)
27061 {
27062 - if (atomic_read(&dev_priv->idle_count) == 0)
27063 + if (atomic_read_unchecked(&dev_priv->idle_count) == 0)
27064 r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
27065 else
27066 - atomic_set(&dev_priv->idle_count, 0);
27067 + atomic_set_unchecked(&dev_priv->idle_count, 0);
27068 }
27069
27070 #endif
27071 diff -urNp linux-3.0.9/drivers/gpu/drm/radeon/atom.c linux-3.0.9/drivers/gpu/drm/radeon/atom.c
27072 --- linux-3.0.9/drivers/gpu/drm/radeon/atom.c 2011-11-11 13:12:24.000000000 -0500
27073 +++ linux-3.0.9/drivers/gpu/drm/radeon/atom.c 2011-11-15 20:02:59.000000000 -0500
27074 @@ -1254,6 +1254,8 @@ struct atom_context *atom_parse(struct c
27075 char name[512];
27076 int i;
27077
27078 + pax_track_stack();
27079 +
27080 ctx->card = card;
27081 ctx->bios = bios;
27082
27083 diff -urNp linux-3.0.9/drivers/gpu/drm/radeon/mkregtable.c linux-3.0.9/drivers/gpu/drm/radeon/mkregtable.c
27084 --- linux-3.0.9/drivers/gpu/drm/radeon/mkregtable.c 2011-11-11 13:12:24.000000000 -0500
27085 +++ linux-3.0.9/drivers/gpu/drm/radeon/mkregtable.c 2011-11-15 20:02:59.000000000 -0500
27086 @@ -637,14 +637,14 @@ static int parser_auth(struct table *t,
27087 regex_t mask_rex;
27088 regmatch_t match[4];
27089 char buf[1024];
27090 - size_t end;
27091 + long end;
27092 int len;
27093 int done = 0;
27094 int r;
27095 unsigned o;
27096 struct offset *offset;
27097 char last_reg_s[10];
27098 - int last_reg;
27099 + unsigned long last_reg;
27100
27101 if (regcomp
27102 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
27103 diff -urNp linux-3.0.9/drivers/gpu/drm/radeon/radeon_atombios.c linux-3.0.9/drivers/gpu/drm/radeon/radeon_atombios.c
27104 --- linux-3.0.9/drivers/gpu/drm/radeon/radeon_atombios.c 2011-11-11 13:12:24.000000000 -0500
27105 +++ linux-3.0.9/drivers/gpu/drm/radeon/radeon_atombios.c 2011-11-15 20:02:59.000000000 -0500
27106 @@ -545,6 +545,8 @@ bool radeon_get_atom_connector_info_from
27107 struct radeon_gpio_rec gpio;
27108 struct radeon_hpd hpd;
27109
27110 + pax_track_stack();
27111 +
27112 if (!atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset))
27113 return false;
27114
27115 diff -urNp linux-3.0.9/drivers/gpu/drm/radeon/radeon_device.c linux-3.0.9/drivers/gpu/drm/radeon/radeon_device.c
27116 --- linux-3.0.9/drivers/gpu/drm/radeon/radeon_device.c 2011-11-11 13:12:24.000000000 -0500
27117 +++ linux-3.0.9/drivers/gpu/drm/radeon/radeon_device.c 2011-11-15 20:02:59.000000000 -0500
27118 @@ -678,7 +678,7 @@ static bool radeon_switcheroo_can_switch
27119 bool can_switch;
27120
27121 spin_lock(&dev->count_lock);
27122 - can_switch = (dev->open_count == 0);
27123 + can_switch = (local_read(&dev->open_count) == 0);
27124 spin_unlock(&dev->count_lock);
27125 return can_switch;
27126 }
27127 diff -urNp linux-3.0.9/drivers/gpu/drm/radeon/radeon_display.c linux-3.0.9/drivers/gpu/drm/radeon/radeon_display.c
27128 --- linux-3.0.9/drivers/gpu/drm/radeon/radeon_display.c 2011-11-11 13:12:24.000000000 -0500
27129 +++ linux-3.0.9/drivers/gpu/drm/radeon/radeon_display.c 2011-11-15 20:02:59.000000000 -0500
27130 @@ -946,6 +946,8 @@ void radeon_compute_pll_legacy(struct ra
27131 uint32_t post_div;
27132 u32 pll_out_min, pll_out_max;
27133
27134 + pax_track_stack();
27135 +
27136 DRM_DEBUG_KMS("PLL freq %llu %u %u\n", freq, pll->min_ref_div, pll->max_ref_div);
27137 freq = freq * 1000;
27138
27139 diff -urNp linux-3.0.9/drivers/gpu/drm/radeon/radeon_drv.h linux-3.0.9/drivers/gpu/drm/radeon/radeon_drv.h
27140 --- linux-3.0.9/drivers/gpu/drm/radeon/radeon_drv.h 2011-11-11 13:12:24.000000000 -0500
27141 +++ linux-3.0.9/drivers/gpu/drm/radeon/radeon_drv.h 2011-11-15 20:02:59.000000000 -0500
27142 @@ -255,7 +255,7 @@ typedef struct drm_radeon_private {
27143
27144 /* SW interrupt */
27145 wait_queue_head_t swi_queue;
27146 - atomic_t swi_emitted;
27147 + atomic_unchecked_t swi_emitted;
27148 int vblank_crtc;
27149 uint32_t irq_enable_reg;
27150 uint32_t r500_disp_irq_reg;
27151 diff -urNp linux-3.0.9/drivers/gpu/drm/radeon/radeon_fence.c linux-3.0.9/drivers/gpu/drm/radeon/radeon_fence.c
27152 --- linux-3.0.9/drivers/gpu/drm/radeon/radeon_fence.c 2011-11-11 13:12:24.000000000 -0500
27153 +++ linux-3.0.9/drivers/gpu/drm/radeon/radeon_fence.c 2011-11-15 20:02:59.000000000 -0500
27154 @@ -78,7 +78,7 @@ int radeon_fence_emit(struct radeon_devi
27155 write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
27156 return 0;
27157 }
27158 - fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
27159 + fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
27160 if (!rdev->cp.ready)
27161 /* FIXME: cp is not running assume everythings is done right
27162 * away
27163 @@ -373,7 +373,7 @@ int radeon_fence_driver_init(struct rade
27164 return r;
27165 }
27166 radeon_fence_write(rdev, 0);
27167 - atomic_set(&rdev->fence_drv.seq, 0);
27168 + atomic_set_unchecked(&rdev->fence_drv.seq, 0);
27169 INIT_LIST_HEAD(&rdev->fence_drv.created);
27170 INIT_LIST_HEAD(&rdev->fence_drv.emited);
27171 INIT_LIST_HEAD(&rdev->fence_drv.signaled);
27172 diff -urNp linux-3.0.9/drivers/gpu/drm/radeon/radeon.h linux-3.0.9/drivers/gpu/drm/radeon/radeon.h
27173 --- linux-3.0.9/drivers/gpu/drm/radeon/radeon.h 2011-11-11 13:12:24.000000000 -0500
27174 +++ linux-3.0.9/drivers/gpu/drm/radeon/radeon.h 2011-11-15 20:02:59.000000000 -0500
27175 @@ -192,7 +192,7 @@ extern int sumo_get_temp(struct radeon_d
27176 */
27177 struct radeon_fence_driver {
27178 uint32_t scratch_reg;
27179 - atomic_t seq;
27180 + atomic_unchecked_t seq;
27181 uint32_t last_seq;
27182 unsigned long last_jiffies;
27183 unsigned long last_timeout;
27184 @@ -962,7 +962,7 @@ struct radeon_asic {
27185 void (*pre_page_flip)(struct radeon_device *rdev, int crtc);
27186 u32 (*page_flip)(struct radeon_device *rdev, int crtc, u64 crtc_base);
27187 void (*post_page_flip)(struct radeon_device *rdev, int crtc);
27188 -};
27189 +} __no_const;
27190
27191 /*
27192 * Asic structures
27193 diff -urNp linux-3.0.9/drivers/gpu/drm/radeon/radeon_ioc32.c linux-3.0.9/drivers/gpu/drm/radeon/radeon_ioc32.c
27194 --- linux-3.0.9/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-11-11 13:12:24.000000000 -0500
27195 +++ linux-3.0.9/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-11-15 20:02:59.000000000 -0500
27196 @@ -359,7 +359,7 @@ static int compat_radeon_cp_setparam(str
27197 request = compat_alloc_user_space(sizeof(*request));
27198 if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
27199 || __put_user(req32.param, &request->param)
27200 - || __put_user((void __user *)(unsigned long)req32.value,
27201 + || __put_user((unsigned long)req32.value,
27202 &request->value))
27203 return -EFAULT;
27204
27205 diff -urNp linux-3.0.9/drivers/gpu/drm/radeon/radeon_irq.c linux-3.0.9/drivers/gpu/drm/radeon/radeon_irq.c
27206 --- linux-3.0.9/drivers/gpu/drm/radeon/radeon_irq.c 2011-11-11 13:12:24.000000000 -0500
27207 +++ linux-3.0.9/drivers/gpu/drm/radeon/radeon_irq.c 2011-11-15 20:02:59.000000000 -0500
27208 @@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_de
27209 unsigned int ret;
27210 RING_LOCALS;
27211
27212 - atomic_inc(&dev_priv->swi_emitted);
27213 - ret = atomic_read(&dev_priv->swi_emitted);
27214 + atomic_inc_unchecked(&dev_priv->swi_emitted);
27215 + ret = atomic_read_unchecked(&dev_priv->swi_emitted);
27216
27217 BEGIN_RING(4);
27218 OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
27219 @@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct
27220 drm_radeon_private_t *dev_priv =
27221 (drm_radeon_private_t *) dev->dev_private;
27222
27223 - atomic_set(&dev_priv->swi_emitted, 0);
27224 + atomic_set_unchecked(&dev_priv->swi_emitted, 0);
27225 DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
27226
27227 dev->max_vblank_count = 0x001fffff;
27228 diff -urNp linux-3.0.9/drivers/gpu/drm/radeon/radeon_state.c linux-3.0.9/drivers/gpu/drm/radeon/radeon_state.c
27229 --- linux-3.0.9/drivers/gpu/drm/radeon/radeon_state.c 2011-11-11 13:12:24.000000000 -0500
27230 +++ linux-3.0.9/drivers/gpu/drm/radeon/radeon_state.c 2011-11-15 20:02:59.000000000 -0500
27231 @@ -2168,7 +2168,7 @@ static int radeon_cp_clear(struct drm_de
27232 if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS)
27233 sarea_priv->nbox = RADEON_NR_SAREA_CLIPRECTS;
27234
27235 - if (DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
27236 + if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS || DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
27237 sarea_priv->nbox * sizeof(depth_boxes[0])))
27238 return -EFAULT;
27239
27240 @@ -3031,7 +3031,7 @@ static int radeon_cp_getparam(struct drm
27241 {
27242 drm_radeon_private_t *dev_priv = dev->dev_private;
27243 drm_radeon_getparam_t *param = data;
27244 - int value;
27245 + int value = 0;
27246
27247 DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
27248
27249 diff -urNp linux-3.0.9/drivers/gpu/drm/radeon/radeon_ttm.c linux-3.0.9/drivers/gpu/drm/radeon/radeon_ttm.c
27250 --- linux-3.0.9/drivers/gpu/drm/radeon/radeon_ttm.c 2011-11-11 13:12:24.000000000 -0500
27251 +++ linux-3.0.9/drivers/gpu/drm/radeon/radeon_ttm.c 2011-11-15 20:02:59.000000000 -0500
27252 @@ -649,8 +649,10 @@ int radeon_mmap(struct file *filp, struc
27253 }
27254 if (unlikely(ttm_vm_ops == NULL)) {
27255 ttm_vm_ops = vma->vm_ops;
27256 - radeon_ttm_vm_ops = *ttm_vm_ops;
27257 - radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
27258 + pax_open_kernel();
27259 + memcpy((void *)&radeon_ttm_vm_ops, ttm_vm_ops, sizeof(radeon_ttm_vm_ops));
27260 + *(void **)&radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
27261 + pax_close_kernel();
27262 }
27263 vma->vm_ops = &radeon_ttm_vm_ops;
27264 return 0;
27265 diff -urNp linux-3.0.9/drivers/gpu/drm/radeon/rs690.c linux-3.0.9/drivers/gpu/drm/radeon/rs690.c
27266 --- linux-3.0.9/drivers/gpu/drm/radeon/rs690.c 2011-11-11 13:12:24.000000000 -0500
27267 +++ linux-3.0.9/drivers/gpu/drm/radeon/rs690.c 2011-11-15 20:02:59.000000000 -0500
27268 @@ -304,9 +304,11 @@ void rs690_crtc_bandwidth_compute(struct
27269 if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
27270 rdev->pm.sideport_bandwidth.full)
27271 rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
27272 - read_delay_latency.full = dfixed_const(370 * 800 * 1000);
27273 + read_delay_latency.full = dfixed_const(800 * 1000);
27274 read_delay_latency.full = dfixed_div(read_delay_latency,
27275 rdev->pm.igp_sideport_mclk);
27276 + a.full = dfixed_const(370);
27277 + read_delay_latency.full = dfixed_mul(read_delay_latency, a);
27278 } else {
27279 if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
27280 rdev->pm.k8_bandwidth.full)
27281 diff -urNp linux-3.0.9/drivers/gpu/drm/ttm/ttm_page_alloc.c linux-3.0.9/drivers/gpu/drm/ttm/ttm_page_alloc.c
27282 --- linux-3.0.9/drivers/gpu/drm/ttm/ttm_page_alloc.c 2011-11-11 13:12:24.000000000 -0500
27283 +++ linux-3.0.9/drivers/gpu/drm/ttm/ttm_page_alloc.c 2011-11-15 20:02:59.000000000 -0500
27284 @@ -398,9 +398,9 @@ static int ttm_pool_get_num_unused_pages
27285 static int ttm_pool_mm_shrink(struct shrinker *shrink,
27286 struct shrink_control *sc)
27287 {
27288 - static atomic_t start_pool = ATOMIC_INIT(0);
27289 + static atomic_unchecked_t start_pool = ATOMIC_INIT(0);
27290 unsigned i;
27291 - unsigned pool_offset = atomic_add_return(1, &start_pool);
27292 + unsigned pool_offset = atomic_add_return_unchecked(1, &start_pool);
27293 struct ttm_page_pool *pool;
27294 int shrink_pages = sc->nr_to_scan;
27295
27296 diff -urNp linux-3.0.9/drivers/gpu/drm/via/via_drv.h linux-3.0.9/drivers/gpu/drm/via/via_drv.h
27297 --- linux-3.0.9/drivers/gpu/drm/via/via_drv.h 2011-11-11 13:12:24.000000000 -0500
27298 +++ linux-3.0.9/drivers/gpu/drm/via/via_drv.h 2011-11-15 20:02:59.000000000 -0500
27299 @@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
27300 typedef uint32_t maskarray_t[5];
27301
27302 typedef struct drm_via_irq {
27303 - atomic_t irq_received;
27304 + atomic_unchecked_t irq_received;
27305 uint32_t pending_mask;
27306 uint32_t enable_mask;
27307 wait_queue_head_t irq_queue;
27308 @@ -75,7 +75,7 @@ typedef struct drm_via_private {
27309 struct timeval last_vblank;
27310 int last_vblank_valid;
27311 unsigned usec_per_vblank;
27312 - atomic_t vbl_received;
27313 + atomic_unchecked_t vbl_received;
27314 drm_via_state_t hc_state;
27315 char pci_buf[VIA_PCI_BUF_SIZE];
27316 const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
27317 diff -urNp linux-3.0.9/drivers/gpu/drm/via/via_irq.c linux-3.0.9/drivers/gpu/drm/via/via_irq.c
27318 --- linux-3.0.9/drivers/gpu/drm/via/via_irq.c 2011-11-11 13:12:24.000000000 -0500
27319 +++ linux-3.0.9/drivers/gpu/drm/via/via_irq.c 2011-11-15 20:02:59.000000000 -0500
27320 @@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_de
27321 if (crtc != 0)
27322 return 0;
27323
27324 - return atomic_read(&dev_priv->vbl_received);
27325 + return atomic_read_unchecked(&dev_priv->vbl_received);
27326 }
27327
27328 irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
27329 @@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_I
27330
27331 status = VIA_READ(VIA_REG_INTERRUPT);
27332 if (status & VIA_IRQ_VBLANK_PENDING) {
27333 - atomic_inc(&dev_priv->vbl_received);
27334 - if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
27335 + atomic_inc_unchecked(&dev_priv->vbl_received);
27336 + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
27337 do_gettimeofday(&cur_vblank);
27338 if (dev_priv->last_vblank_valid) {
27339 dev_priv->usec_per_vblank =
27340 @@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
27341 dev_priv->last_vblank = cur_vblank;
27342 dev_priv->last_vblank_valid = 1;
27343 }
27344 - if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
27345 + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
27346 DRM_DEBUG("US per vblank is: %u\n",
27347 dev_priv->usec_per_vblank);
27348 }
27349 @@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
27350
27351 for (i = 0; i < dev_priv->num_irqs; ++i) {
27352 if (status & cur_irq->pending_mask) {
27353 - atomic_inc(&cur_irq->irq_received);
27354 + atomic_inc_unchecked(&cur_irq->irq_received);
27355 DRM_WAKEUP(&cur_irq->irq_queue);
27356 handled = 1;
27357 if (dev_priv->irq_map[drm_via_irq_dma0_td] == i)
27358 @@ -243,11 +243,11 @@ via_driver_irq_wait(struct drm_device *d
27359 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
27360 ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
27361 masks[irq][4]));
27362 - cur_irq_sequence = atomic_read(&cur_irq->irq_received);
27363 + cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
27364 } else {
27365 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
27366 (((cur_irq_sequence =
27367 - atomic_read(&cur_irq->irq_received)) -
27368 + atomic_read_unchecked(&cur_irq->irq_received)) -
27369 *sequence) <= (1 << 23)));
27370 }
27371 *sequence = cur_irq_sequence;
27372 @@ -285,7 +285,7 @@ void via_driver_irq_preinstall(struct dr
27373 }
27374
27375 for (i = 0; i < dev_priv->num_irqs; ++i) {
27376 - atomic_set(&cur_irq->irq_received, 0);
27377 + atomic_set_unchecked(&cur_irq->irq_received, 0);
27378 cur_irq->enable_mask = dev_priv->irq_masks[i][0];
27379 cur_irq->pending_mask = dev_priv->irq_masks[i][1];
27380 DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
27381 @@ -367,7 +367,7 @@ int via_wait_irq(struct drm_device *dev,
27382 switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
27383 case VIA_IRQ_RELATIVE:
27384 irqwait->request.sequence +=
27385 - atomic_read(&cur_irq->irq_received);
27386 + atomic_read_unchecked(&cur_irq->irq_received);
27387 irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
27388 case VIA_IRQ_ABSOLUTE:
27389 break;
27390 diff -urNp linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
27391 --- linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h 2011-11-11 13:12:24.000000000 -0500
27392 +++ linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h 2011-11-15 20:02:59.000000000 -0500
27393 @@ -240,7 +240,7 @@ struct vmw_private {
27394 * Fencing and IRQs.
27395 */
27396
27397 - atomic_t fence_seq;
27398 + atomic_unchecked_t fence_seq;
27399 wait_queue_head_t fence_queue;
27400 wait_queue_head_t fifo_queue;
27401 atomic_t fence_queue_waiters;
27402 diff -urNp linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
27403 --- linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c 2011-11-11 13:12:24.000000000 -0500
27404 +++ linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c 2011-11-15 20:02:59.000000000 -0500
27405 @@ -610,7 +610,7 @@ int vmw_execbuf_ioctl(struct drm_device
27406 struct drm_vmw_fence_rep fence_rep;
27407 struct drm_vmw_fence_rep __user *user_fence_rep;
27408 int ret;
27409 - void *user_cmd;
27410 + void __user *user_cmd;
27411 void *cmd;
27412 uint32_t sequence;
27413 struct vmw_sw_context *sw_context = &dev_priv->ctx;
27414 diff -urNp linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
27415 --- linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c 2011-11-11 13:12:24.000000000 -0500
27416 +++ linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c 2011-11-15 20:02:59.000000000 -0500
27417 @@ -151,7 +151,7 @@ int vmw_wait_lag(struct vmw_private *dev
27418 while (!vmw_lag_lt(queue, us)) {
27419 spin_lock(&queue->lock);
27420 if (list_empty(&queue->head))
27421 - sequence = atomic_read(&dev_priv->fence_seq);
27422 + sequence = atomic_read_unchecked(&dev_priv->fence_seq);
27423 else {
27424 fence = list_first_entry(&queue->head,
27425 struct vmw_fence, head);
27426 diff -urNp linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
27427 --- linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-11-11 13:12:24.000000000 -0500
27428 +++ linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-11-15 20:02:59.000000000 -0500
27429 @@ -137,7 +137,7 @@ int vmw_fifo_init(struct vmw_private *de
27430 (unsigned int) min,
27431 (unsigned int) fifo->capabilities);
27432
27433 - atomic_set(&dev_priv->fence_seq, dev_priv->last_read_sequence);
27434 + atomic_set_unchecked(&dev_priv->fence_seq, dev_priv->last_read_sequence);
27435 iowrite32(dev_priv->last_read_sequence, fifo_mem + SVGA_FIFO_FENCE);
27436 vmw_fence_queue_init(&fifo->fence_queue);
27437 return vmw_fifo_send_fence(dev_priv, &dummy);
27438 @@ -356,7 +356,7 @@ void *vmw_fifo_reserve(struct vmw_privat
27439 if (reserveable)
27440 iowrite32(bytes, fifo_mem +
27441 SVGA_FIFO_RESERVED);
27442 - return fifo_mem + (next_cmd >> 2);
27443 + return (__le32 __force_kernel *)fifo_mem + (next_cmd >> 2);
27444 } else {
27445 need_bounce = true;
27446 }
27447 @@ -476,7 +476,7 @@ int vmw_fifo_send_fence(struct vmw_priva
27448
27449 fm = vmw_fifo_reserve(dev_priv, bytes);
27450 if (unlikely(fm == NULL)) {
27451 - *sequence = atomic_read(&dev_priv->fence_seq);
27452 + *sequence = atomic_read_unchecked(&dev_priv->fence_seq);
27453 ret = -ENOMEM;
27454 (void)vmw_fallback_wait(dev_priv, false, true, *sequence,
27455 false, 3*HZ);
27456 @@ -484,7 +484,7 @@ int vmw_fifo_send_fence(struct vmw_priva
27457 }
27458
27459 do {
27460 - *sequence = atomic_add_return(1, &dev_priv->fence_seq);
27461 + *sequence = atomic_add_return_unchecked(1, &dev_priv->fence_seq);
27462 } while (*sequence == 0);
27463
27464 if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
27465 diff -urNp linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
27466 --- linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c 2011-11-11 13:12:24.000000000 -0500
27467 +++ linux-3.0.9/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c 2011-11-15 20:02:59.000000000 -0500
27468 @@ -100,7 +100,7 @@ bool vmw_fence_signaled(struct vmw_priva
27469 * emitted. Then the fence is stale and signaled.
27470 */
27471
27472 - ret = ((atomic_read(&dev_priv->fence_seq) - sequence)
27473 + ret = ((atomic_read_unchecked(&dev_priv->fence_seq) - sequence)
27474 > VMW_FENCE_WRAP);
27475
27476 return ret;
27477 @@ -131,7 +131,7 @@ int vmw_fallback_wait(struct vmw_private
27478
27479 if (fifo_idle)
27480 down_read(&fifo_state->rwsem);
27481 - signal_seq = atomic_read(&dev_priv->fence_seq);
27482 + signal_seq = atomic_read_unchecked(&dev_priv->fence_seq);
27483 ret = 0;
27484
27485 for (;;) {
27486 diff -urNp linux-3.0.9/drivers/hid/hid-core.c linux-3.0.9/drivers/hid/hid-core.c
27487 --- linux-3.0.9/drivers/hid/hid-core.c 2011-11-11 13:12:24.000000000 -0500
27488 +++ linux-3.0.9/drivers/hid/hid-core.c 2011-11-15 20:02:59.000000000 -0500
27489 @@ -1940,7 +1940,7 @@ static bool hid_ignore(struct hid_device
27490
27491 int hid_add_device(struct hid_device *hdev)
27492 {
27493 - static atomic_t id = ATOMIC_INIT(0);
27494 + static atomic_unchecked_t id = ATOMIC_INIT(0);
27495 int ret;
27496
27497 if (WARN_ON(hdev->status & HID_STAT_ADDED))
27498 @@ -1955,7 +1955,7 @@ int hid_add_device(struct hid_device *hd
27499 /* XXX hack, any other cleaner solution after the driver core
27500 * is converted to allow more than 20 bytes as the device name? */
27501 dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
27502 - hdev->vendor, hdev->product, atomic_inc_return(&id));
27503 + hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
27504
27505 hid_debug_register(hdev, dev_name(&hdev->dev));
27506 ret = device_add(&hdev->dev);
27507 diff -urNp linux-3.0.9/drivers/hid/usbhid/hiddev.c linux-3.0.9/drivers/hid/usbhid/hiddev.c
27508 --- linux-3.0.9/drivers/hid/usbhid/hiddev.c 2011-11-11 13:12:24.000000000 -0500
27509 +++ linux-3.0.9/drivers/hid/usbhid/hiddev.c 2011-11-15 20:02:59.000000000 -0500
27510 @@ -624,7 +624,7 @@ static long hiddev_ioctl(struct file *fi
27511 break;
27512
27513 case HIDIOCAPPLICATION:
27514 - if (arg < 0 || arg >= hid->maxapplication)
27515 + if (arg >= hid->maxapplication)
27516 break;
27517
27518 for (i = 0; i < hid->maxcollection; i++)
27519 diff -urNp linux-3.0.9/drivers/hwmon/acpi_power_meter.c linux-3.0.9/drivers/hwmon/acpi_power_meter.c
27520 --- linux-3.0.9/drivers/hwmon/acpi_power_meter.c 2011-11-11 13:12:24.000000000 -0500
27521 +++ linux-3.0.9/drivers/hwmon/acpi_power_meter.c 2011-11-15 20:02:59.000000000 -0500
27522 @@ -316,8 +316,6 @@ static ssize_t set_trip(struct device *d
27523 return res;
27524
27525 temp /= 1000;
27526 - if (temp < 0)
27527 - return -EINVAL;
27528
27529 mutex_lock(&resource->lock);
27530 resource->trip[attr->index - 7] = temp;
27531 diff -urNp linux-3.0.9/drivers/hwmon/sht15.c linux-3.0.9/drivers/hwmon/sht15.c
27532 --- linux-3.0.9/drivers/hwmon/sht15.c 2011-11-11 13:12:24.000000000 -0500
27533 +++ linux-3.0.9/drivers/hwmon/sht15.c 2011-11-15 20:02:59.000000000 -0500
27534 @@ -166,7 +166,7 @@ struct sht15_data {
27535 int supply_uV;
27536 bool supply_uV_valid;
27537 struct work_struct update_supply_work;
27538 - atomic_t interrupt_handled;
27539 + atomic_unchecked_t interrupt_handled;
27540 };
27541
27542 /**
27543 @@ -509,13 +509,13 @@ static int sht15_measurement(struct sht1
27544 return ret;
27545
27546 gpio_direction_input(data->pdata->gpio_data);
27547 - atomic_set(&data->interrupt_handled, 0);
27548 + atomic_set_unchecked(&data->interrupt_handled, 0);
27549
27550 enable_irq(gpio_to_irq(data->pdata->gpio_data));
27551 if (gpio_get_value(data->pdata->gpio_data) == 0) {
27552 disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
27553 /* Only relevant if the interrupt hasn't occurred. */
27554 - if (!atomic_read(&data->interrupt_handled))
27555 + if (!atomic_read_unchecked(&data->interrupt_handled))
27556 schedule_work(&data->read_work);
27557 }
27558 ret = wait_event_timeout(data->wait_queue,
27559 @@ -782,7 +782,7 @@ static irqreturn_t sht15_interrupt_fired
27560
27561 /* First disable the interrupt */
27562 disable_irq_nosync(irq);
27563 - atomic_inc(&data->interrupt_handled);
27564 + atomic_inc_unchecked(&data->interrupt_handled);
27565 /* Then schedule a reading work struct */
27566 if (data->state != SHT15_READING_NOTHING)
27567 schedule_work(&data->read_work);
27568 @@ -804,11 +804,11 @@ static void sht15_bh_read_data(struct wo
27569 * If not, then start the interrupt again - care here as could
27570 * have gone low in meantime so verify it hasn't!
27571 */
27572 - atomic_set(&data->interrupt_handled, 0);
27573 + atomic_set_unchecked(&data->interrupt_handled, 0);
27574 enable_irq(gpio_to_irq(data->pdata->gpio_data));
27575 /* If still not occurred or another handler has been scheduled */
27576 if (gpio_get_value(data->pdata->gpio_data)
27577 - || atomic_read(&data->interrupt_handled))
27578 + || atomic_read_unchecked(&data->interrupt_handled))
27579 return;
27580 }
27581
27582 diff -urNp linux-3.0.9/drivers/hwmon/w83791d.c linux-3.0.9/drivers/hwmon/w83791d.c
27583 --- linux-3.0.9/drivers/hwmon/w83791d.c 2011-11-11 13:12:24.000000000 -0500
27584 +++ linux-3.0.9/drivers/hwmon/w83791d.c 2011-11-15 20:02:59.000000000 -0500
27585 @@ -329,8 +329,8 @@ static int w83791d_detect(struct i2c_cli
27586 struct i2c_board_info *info);
27587 static int w83791d_remove(struct i2c_client *client);
27588
27589 -static int w83791d_read(struct i2c_client *client, u8 register);
27590 -static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
27591 +static int w83791d_read(struct i2c_client *client, u8 reg);
27592 +static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
27593 static struct w83791d_data *w83791d_update_device(struct device *dev);
27594
27595 #ifdef DEBUG
27596 diff -urNp linux-3.0.9/drivers/i2c/busses/i2c-amd756-s4882.c linux-3.0.9/drivers/i2c/busses/i2c-amd756-s4882.c
27597 --- linux-3.0.9/drivers/i2c/busses/i2c-amd756-s4882.c 2011-11-11 13:12:24.000000000 -0500
27598 +++ linux-3.0.9/drivers/i2c/busses/i2c-amd756-s4882.c 2011-11-15 20:02:59.000000000 -0500
27599 @@ -43,7 +43,7 @@
27600 extern struct i2c_adapter amd756_smbus;
27601
27602 static struct i2c_adapter *s4882_adapter;
27603 -static struct i2c_algorithm *s4882_algo;
27604 +static i2c_algorithm_no_const *s4882_algo;
27605
27606 /* Wrapper access functions for multiplexed SMBus */
27607 static DEFINE_MUTEX(amd756_lock);
27608 diff -urNp linux-3.0.9/drivers/i2c/busses/i2c-nforce2-s4985.c linux-3.0.9/drivers/i2c/busses/i2c-nforce2-s4985.c
27609 --- linux-3.0.9/drivers/i2c/busses/i2c-nforce2-s4985.c 2011-11-11 13:12:24.000000000 -0500
27610 +++ linux-3.0.9/drivers/i2c/busses/i2c-nforce2-s4985.c 2011-11-15 20:02:59.000000000 -0500
27611 @@ -41,7 +41,7 @@
27612 extern struct i2c_adapter *nforce2_smbus;
27613
27614 static struct i2c_adapter *s4985_adapter;
27615 -static struct i2c_algorithm *s4985_algo;
27616 +static i2c_algorithm_no_const *s4985_algo;
27617
27618 /* Wrapper access functions for multiplexed SMBus */
27619 static DEFINE_MUTEX(nforce2_lock);
27620 diff -urNp linux-3.0.9/drivers/i2c/i2c-mux.c linux-3.0.9/drivers/i2c/i2c-mux.c
27621 --- linux-3.0.9/drivers/i2c/i2c-mux.c 2011-11-11 13:12:24.000000000 -0500
27622 +++ linux-3.0.9/drivers/i2c/i2c-mux.c 2011-11-15 20:02:59.000000000 -0500
27623 @@ -28,7 +28,7 @@
27624 /* multiplexer per channel data */
27625 struct i2c_mux_priv {
27626 struct i2c_adapter adap;
27627 - struct i2c_algorithm algo;
27628 + i2c_algorithm_no_const algo;
27629
27630 struct i2c_adapter *parent;
27631 void *mux_dev; /* the mux chip/device */
27632 diff -urNp linux-3.0.9/drivers/ide/aec62xx.c linux-3.0.9/drivers/ide/aec62xx.c
27633 --- linux-3.0.9/drivers/ide/aec62xx.c 2011-11-11 13:12:24.000000000 -0500
27634 +++ linux-3.0.9/drivers/ide/aec62xx.c 2011-11-15 20:02:59.000000000 -0500
27635 @@ -181,7 +181,7 @@ static const struct ide_port_ops atp86x_
27636 .cable_detect = atp86x_cable_detect,
27637 };
27638
27639 -static const struct ide_port_info aec62xx_chipsets[] __devinitdata = {
27640 +static const struct ide_port_info aec62xx_chipsets[] __devinitconst = {
27641 { /* 0: AEC6210 */
27642 .name = DRV_NAME,
27643 .init_chipset = init_chipset_aec62xx,
27644 diff -urNp linux-3.0.9/drivers/ide/alim15x3.c linux-3.0.9/drivers/ide/alim15x3.c
27645 --- linux-3.0.9/drivers/ide/alim15x3.c 2011-11-11 13:12:24.000000000 -0500
27646 +++ linux-3.0.9/drivers/ide/alim15x3.c 2011-11-15 20:02:59.000000000 -0500
27647 @@ -512,7 +512,7 @@ static const struct ide_dma_ops ali_dma_
27648 .dma_sff_read_status = ide_dma_sff_read_status,
27649 };
27650
27651 -static const struct ide_port_info ali15x3_chipset __devinitdata = {
27652 +static const struct ide_port_info ali15x3_chipset __devinitconst = {
27653 .name = DRV_NAME,
27654 .init_chipset = init_chipset_ali15x3,
27655 .init_hwif = init_hwif_ali15x3,
27656 diff -urNp linux-3.0.9/drivers/ide/amd74xx.c linux-3.0.9/drivers/ide/amd74xx.c
27657 --- linux-3.0.9/drivers/ide/amd74xx.c 2011-11-11 13:12:24.000000000 -0500
27658 +++ linux-3.0.9/drivers/ide/amd74xx.c 2011-11-15 20:02:59.000000000 -0500
27659 @@ -223,7 +223,7 @@ static const struct ide_port_ops amd_por
27660 .udma_mask = udma, \
27661 }
27662
27663 -static const struct ide_port_info amd74xx_chipsets[] __devinitdata = {
27664 +static const struct ide_port_info amd74xx_chipsets[] __devinitconst = {
27665 /* 0: AMD7401 */ DECLARE_AMD_DEV(0x00, ATA_UDMA2),
27666 /* 1: AMD7409 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA4),
27667 /* 2: AMD7411/7441 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA5),
27668 diff -urNp linux-3.0.9/drivers/ide/atiixp.c linux-3.0.9/drivers/ide/atiixp.c
27669 --- linux-3.0.9/drivers/ide/atiixp.c 2011-11-11 13:12:24.000000000 -0500
27670 +++ linux-3.0.9/drivers/ide/atiixp.c 2011-11-15 20:02:59.000000000 -0500
27671 @@ -139,7 +139,7 @@ static const struct ide_port_ops atiixp_
27672 .cable_detect = atiixp_cable_detect,
27673 };
27674
27675 -static const struct ide_port_info atiixp_pci_info[] __devinitdata = {
27676 +static const struct ide_port_info atiixp_pci_info[] __devinitconst = {
27677 { /* 0: IXP200/300/400/700 */
27678 .name = DRV_NAME,
27679 .enablebits = {{0x48,0x01,0x00}, {0x48,0x08,0x00}},
27680 diff -urNp linux-3.0.9/drivers/ide/cmd64x.c linux-3.0.9/drivers/ide/cmd64x.c
27681 --- linux-3.0.9/drivers/ide/cmd64x.c 2011-11-11 13:12:24.000000000 -0500
27682 +++ linux-3.0.9/drivers/ide/cmd64x.c 2011-11-15 20:02:59.000000000 -0500
27683 @@ -327,7 +327,7 @@ static const struct ide_dma_ops cmd646_r
27684 .dma_sff_read_status = ide_dma_sff_read_status,
27685 };
27686
27687 -static const struct ide_port_info cmd64x_chipsets[] __devinitdata = {
27688 +static const struct ide_port_info cmd64x_chipsets[] __devinitconst = {
27689 { /* 0: CMD643 */
27690 .name = DRV_NAME,
27691 .init_chipset = init_chipset_cmd64x,
27692 diff -urNp linux-3.0.9/drivers/ide/cs5520.c linux-3.0.9/drivers/ide/cs5520.c
27693 --- linux-3.0.9/drivers/ide/cs5520.c 2011-11-11 13:12:24.000000000 -0500
27694 +++ linux-3.0.9/drivers/ide/cs5520.c 2011-11-15 20:02:59.000000000 -0500
27695 @@ -94,7 +94,7 @@ static const struct ide_port_ops cs5520_
27696 .set_dma_mode = cs5520_set_dma_mode,
27697 };
27698
27699 -static const struct ide_port_info cyrix_chipset __devinitdata = {
27700 +static const struct ide_port_info cyrix_chipset __devinitconst = {
27701 .name = DRV_NAME,
27702 .enablebits = { { 0x60, 0x01, 0x01 }, { 0x60, 0x02, 0x02 } },
27703 .port_ops = &cs5520_port_ops,
27704 diff -urNp linux-3.0.9/drivers/ide/cs5530.c linux-3.0.9/drivers/ide/cs5530.c
27705 --- linux-3.0.9/drivers/ide/cs5530.c 2011-11-11 13:12:24.000000000 -0500
27706 +++ linux-3.0.9/drivers/ide/cs5530.c 2011-11-15 20:02:59.000000000 -0500
27707 @@ -245,7 +245,7 @@ static const struct ide_port_ops cs5530_
27708 .udma_filter = cs5530_udma_filter,
27709 };
27710
27711 -static const struct ide_port_info cs5530_chipset __devinitdata = {
27712 +static const struct ide_port_info cs5530_chipset __devinitconst = {
27713 .name = DRV_NAME,
27714 .init_chipset = init_chipset_cs5530,
27715 .init_hwif = init_hwif_cs5530,
27716 diff -urNp linux-3.0.9/drivers/ide/cs5535.c linux-3.0.9/drivers/ide/cs5535.c
27717 --- linux-3.0.9/drivers/ide/cs5535.c 2011-11-11 13:12:24.000000000 -0500
27718 +++ linux-3.0.9/drivers/ide/cs5535.c 2011-11-15 20:02:59.000000000 -0500
27719 @@ -170,7 +170,7 @@ static const struct ide_port_ops cs5535_
27720 .cable_detect = cs5535_cable_detect,
27721 };
27722
27723 -static const struct ide_port_info cs5535_chipset __devinitdata = {
27724 +static const struct ide_port_info cs5535_chipset __devinitconst = {
27725 .name = DRV_NAME,
27726 .port_ops = &cs5535_port_ops,
27727 .host_flags = IDE_HFLAG_SINGLE | IDE_HFLAG_POST_SET_MODE,
27728 diff -urNp linux-3.0.9/drivers/ide/cy82c693.c linux-3.0.9/drivers/ide/cy82c693.c
27729 --- linux-3.0.9/drivers/ide/cy82c693.c 2011-11-11 13:12:24.000000000 -0500
27730 +++ linux-3.0.9/drivers/ide/cy82c693.c 2011-11-15 20:02:59.000000000 -0500
27731 @@ -161,7 +161,7 @@ static const struct ide_port_ops cy82c69
27732 .set_dma_mode = cy82c693_set_dma_mode,
27733 };
27734
27735 -static const struct ide_port_info cy82c693_chipset __devinitdata = {
27736 +static const struct ide_port_info cy82c693_chipset __devinitconst = {
27737 .name = DRV_NAME,
27738 .init_iops = init_iops_cy82c693,
27739 .port_ops = &cy82c693_port_ops,
27740 diff -urNp linux-3.0.9/drivers/ide/hpt366.c linux-3.0.9/drivers/ide/hpt366.c
27741 --- linux-3.0.9/drivers/ide/hpt366.c 2011-11-11 13:12:24.000000000 -0500
27742 +++ linux-3.0.9/drivers/ide/hpt366.c 2011-11-15 20:02:59.000000000 -0500
27743 @@ -443,7 +443,7 @@ static struct hpt_timings hpt37x_timings
27744 }
27745 };
27746
27747 -static const struct hpt_info hpt36x __devinitdata = {
27748 +static const struct hpt_info hpt36x __devinitconst = {
27749 .chip_name = "HPT36x",
27750 .chip_type = HPT36x,
27751 .udma_mask = HPT366_ALLOW_ATA66_3 ? (HPT366_ALLOW_ATA66_4 ? ATA_UDMA4 : ATA_UDMA3) : ATA_UDMA2,
27752 @@ -451,7 +451,7 @@ static const struct hpt_info hpt36x __de
27753 .timings = &hpt36x_timings
27754 };
27755
27756 -static const struct hpt_info hpt370 __devinitdata = {
27757 +static const struct hpt_info hpt370 __devinitconst = {
27758 .chip_name = "HPT370",
27759 .chip_type = HPT370,
27760 .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
27761 @@ -459,7 +459,7 @@ static const struct hpt_info hpt370 __de
27762 .timings = &hpt37x_timings
27763 };
27764
27765 -static const struct hpt_info hpt370a __devinitdata = {
27766 +static const struct hpt_info hpt370a __devinitconst = {
27767 .chip_name = "HPT370A",
27768 .chip_type = HPT370A,
27769 .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
27770 @@ -467,7 +467,7 @@ static const struct hpt_info hpt370a __d
27771 .timings = &hpt37x_timings
27772 };
27773
27774 -static const struct hpt_info hpt374 __devinitdata = {
27775 +static const struct hpt_info hpt374 __devinitconst = {
27776 .chip_name = "HPT374",
27777 .chip_type = HPT374,
27778 .udma_mask = ATA_UDMA5,
27779 @@ -475,7 +475,7 @@ static const struct hpt_info hpt374 __de
27780 .timings = &hpt37x_timings
27781 };
27782
27783 -static const struct hpt_info hpt372 __devinitdata = {
27784 +static const struct hpt_info hpt372 __devinitconst = {
27785 .chip_name = "HPT372",
27786 .chip_type = HPT372,
27787 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
27788 @@ -483,7 +483,7 @@ static const struct hpt_info hpt372 __de
27789 .timings = &hpt37x_timings
27790 };
27791
27792 -static const struct hpt_info hpt372a __devinitdata = {
27793 +static const struct hpt_info hpt372a __devinitconst = {
27794 .chip_name = "HPT372A",
27795 .chip_type = HPT372A,
27796 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
27797 @@ -491,7 +491,7 @@ static const struct hpt_info hpt372a __d
27798 .timings = &hpt37x_timings
27799 };
27800
27801 -static const struct hpt_info hpt302 __devinitdata = {
27802 +static const struct hpt_info hpt302 __devinitconst = {
27803 .chip_name = "HPT302",
27804 .chip_type = HPT302,
27805 .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
27806 @@ -499,7 +499,7 @@ static const struct hpt_info hpt302 __de
27807 .timings = &hpt37x_timings
27808 };
27809
27810 -static const struct hpt_info hpt371 __devinitdata = {
27811 +static const struct hpt_info hpt371 __devinitconst = {
27812 .chip_name = "HPT371",
27813 .chip_type = HPT371,
27814 .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
27815 @@ -507,7 +507,7 @@ static const struct hpt_info hpt371 __de
27816 .timings = &hpt37x_timings
27817 };
27818
27819 -static const struct hpt_info hpt372n __devinitdata = {
27820 +static const struct hpt_info hpt372n __devinitconst = {
27821 .chip_name = "HPT372N",
27822 .chip_type = HPT372N,
27823 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
27824 @@ -515,7 +515,7 @@ static const struct hpt_info hpt372n __d
27825 .timings = &hpt37x_timings
27826 };
27827
27828 -static const struct hpt_info hpt302n __devinitdata = {
27829 +static const struct hpt_info hpt302n __devinitconst = {
27830 .chip_name = "HPT302N",
27831 .chip_type = HPT302N,
27832 .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
27833 @@ -523,7 +523,7 @@ static const struct hpt_info hpt302n __d
27834 .timings = &hpt37x_timings
27835 };
27836
27837 -static const struct hpt_info hpt371n __devinitdata = {
27838 +static const struct hpt_info hpt371n __devinitconst = {
27839 .chip_name = "HPT371N",
27840 .chip_type = HPT371N,
27841 .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
27842 @@ -1361,7 +1361,7 @@ static const struct ide_dma_ops hpt36x_d
27843 .dma_sff_read_status = ide_dma_sff_read_status,
27844 };
27845
27846 -static const struct ide_port_info hpt366_chipsets[] __devinitdata = {
27847 +static const struct ide_port_info hpt366_chipsets[] __devinitconst = {
27848 { /* 0: HPT36x */
27849 .name = DRV_NAME,
27850 .init_chipset = init_chipset_hpt366,
27851 diff -urNp linux-3.0.9/drivers/ide/ide-cd.c linux-3.0.9/drivers/ide/ide-cd.c
27852 --- linux-3.0.9/drivers/ide/ide-cd.c 2011-11-11 13:12:24.000000000 -0500
27853 +++ linux-3.0.9/drivers/ide/ide-cd.c 2011-11-15 20:02:59.000000000 -0500
27854 @@ -769,7 +769,7 @@ static void cdrom_do_block_pc(ide_drive_
27855 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
27856 if ((unsigned long)buf & alignment
27857 || blk_rq_bytes(rq) & q->dma_pad_mask
27858 - || object_is_on_stack(buf))
27859 + || object_starts_on_stack(buf))
27860 drive->dma = 0;
27861 }
27862 }
27863 diff -urNp linux-3.0.9/drivers/ide/ide-floppy.c linux-3.0.9/drivers/ide/ide-floppy.c
27864 --- linux-3.0.9/drivers/ide/ide-floppy.c 2011-11-11 13:12:24.000000000 -0500
27865 +++ linux-3.0.9/drivers/ide/ide-floppy.c 2011-11-15 20:02:59.000000000 -0500
27866 @@ -379,6 +379,8 @@ static int ide_floppy_get_capacity(ide_d
27867 u8 pc_buf[256], header_len, desc_cnt;
27868 int i, rc = 1, blocks, length;
27869
27870 + pax_track_stack();
27871 +
27872 ide_debug_log(IDE_DBG_FUNC, "enter");
27873
27874 drive->bios_cyl = 0;
27875 diff -urNp linux-3.0.9/drivers/ide/ide-pci-generic.c linux-3.0.9/drivers/ide/ide-pci-generic.c
27876 --- linux-3.0.9/drivers/ide/ide-pci-generic.c 2011-11-11 13:12:24.000000000 -0500
27877 +++ linux-3.0.9/drivers/ide/ide-pci-generic.c 2011-11-15 20:02:59.000000000 -0500
27878 @@ -53,7 +53,7 @@ static const struct ide_port_ops netcell
27879 .udma_mask = ATA_UDMA6, \
27880 }
27881
27882 -static const struct ide_port_info generic_chipsets[] __devinitdata = {
27883 +static const struct ide_port_info generic_chipsets[] __devinitconst = {
27884 /* 0: Unknown */
27885 DECLARE_GENERIC_PCI_DEV(0),
27886
27887 diff -urNp linux-3.0.9/drivers/ide/it8172.c linux-3.0.9/drivers/ide/it8172.c
27888 --- linux-3.0.9/drivers/ide/it8172.c 2011-11-11 13:12:24.000000000 -0500
27889 +++ linux-3.0.9/drivers/ide/it8172.c 2011-11-15 20:02:59.000000000 -0500
27890 @@ -115,7 +115,7 @@ static const struct ide_port_ops it8172_
27891 .set_dma_mode = it8172_set_dma_mode,
27892 };
27893
27894 -static const struct ide_port_info it8172_port_info __devinitdata = {
27895 +static const struct ide_port_info it8172_port_info __devinitconst = {
27896 .name = DRV_NAME,
27897 .port_ops = &it8172_port_ops,
27898 .enablebits = { {0x41, 0x80, 0x80}, {0x00, 0x00, 0x00} },
27899 diff -urNp linux-3.0.9/drivers/ide/it8213.c linux-3.0.9/drivers/ide/it8213.c
27900 --- linux-3.0.9/drivers/ide/it8213.c 2011-11-11 13:12:24.000000000 -0500
27901 +++ linux-3.0.9/drivers/ide/it8213.c 2011-11-15 20:02:59.000000000 -0500
27902 @@ -156,7 +156,7 @@ static const struct ide_port_ops it8213_
27903 .cable_detect = it8213_cable_detect,
27904 };
27905
27906 -static const struct ide_port_info it8213_chipset __devinitdata = {
27907 +static const struct ide_port_info it8213_chipset __devinitconst = {
27908 .name = DRV_NAME,
27909 .enablebits = { {0x41, 0x80, 0x80} },
27910 .port_ops = &it8213_port_ops,
27911 diff -urNp linux-3.0.9/drivers/ide/it821x.c linux-3.0.9/drivers/ide/it821x.c
27912 --- linux-3.0.9/drivers/ide/it821x.c 2011-11-11 13:12:24.000000000 -0500
27913 +++ linux-3.0.9/drivers/ide/it821x.c 2011-11-15 20:02:59.000000000 -0500
27914 @@ -630,7 +630,7 @@ static const struct ide_port_ops it821x_
27915 .cable_detect = it821x_cable_detect,
27916 };
27917
27918 -static const struct ide_port_info it821x_chipset __devinitdata = {
27919 +static const struct ide_port_info it821x_chipset __devinitconst = {
27920 .name = DRV_NAME,
27921 .init_chipset = init_chipset_it821x,
27922 .init_hwif = init_hwif_it821x,
27923 diff -urNp linux-3.0.9/drivers/ide/jmicron.c linux-3.0.9/drivers/ide/jmicron.c
27924 --- linux-3.0.9/drivers/ide/jmicron.c 2011-11-11 13:12:24.000000000 -0500
27925 +++ linux-3.0.9/drivers/ide/jmicron.c 2011-11-15 20:02:59.000000000 -0500
27926 @@ -102,7 +102,7 @@ static const struct ide_port_ops jmicron
27927 .cable_detect = jmicron_cable_detect,
27928 };
27929
27930 -static const struct ide_port_info jmicron_chipset __devinitdata = {
27931 +static const struct ide_port_info jmicron_chipset __devinitconst = {
27932 .name = DRV_NAME,
27933 .enablebits = { { 0x40, 0x01, 0x01 }, { 0x40, 0x10, 0x10 } },
27934 .port_ops = &jmicron_port_ops,
27935 diff -urNp linux-3.0.9/drivers/ide/ns87415.c linux-3.0.9/drivers/ide/ns87415.c
27936 --- linux-3.0.9/drivers/ide/ns87415.c 2011-11-11 13:12:24.000000000 -0500
27937 +++ linux-3.0.9/drivers/ide/ns87415.c 2011-11-15 20:02:59.000000000 -0500
27938 @@ -293,7 +293,7 @@ static const struct ide_dma_ops ns87415_
27939 .dma_sff_read_status = superio_dma_sff_read_status,
27940 };
27941
27942 -static const struct ide_port_info ns87415_chipset __devinitdata = {
27943 +static const struct ide_port_info ns87415_chipset __devinitconst = {
27944 .name = DRV_NAME,
27945 .init_hwif = init_hwif_ns87415,
27946 .tp_ops = &ns87415_tp_ops,
27947 diff -urNp linux-3.0.9/drivers/ide/opti621.c linux-3.0.9/drivers/ide/opti621.c
27948 --- linux-3.0.9/drivers/ide/opti621.c 2011-11-11 13:12:24.000000000 -0500
27949 +++ linux-3.0.9/drivers/ide/opti621.c 2011-11-15 20:02:59.000000000 -0500
27950 @@ -131,7 +131,7 @@ static const struct ide_port_ops opti621
27951 .set_pio_mode = opti621_set_pio_mode,
27952 };
27953
27954 -static const struct ide_port_info opti621_chipset __devinitdata = {
27955 +static const struct ide_port_info opti621_chipset __devinitconst = {
27956 .name = DRV_NAME,
27957 .enablebits = { {0x45, 0x80, 0x00}, {0x40, 0x08, 0x00} },
27958 .port_ops = &opti621_port_ops,
27959 diff -urNp linux-3.0.9/drivers/ide/pdc202xx_new.c linux-3.0.9/drivers/ide/pdc202xx_new.c
27960 --- linux-3.0.9/drivers/ide/pdc202xx_new.c 2011-11-11 13:12:24.000000000 -0500
27961 +++ linux-3.0.9/drivers/ide/pdc202xx_new.c 2011-11-15 20:02:59.000000000 -0500
27962 @@ -465,7 +465,7 @@ static const struct ide_port_ops pdcnew_
27963 .udma_mask = udma, \
27964 }
27965
27966 -static const struct ide_port_info pdcnew_chipsets[] __devinitdata = {
27967 +static const struct ide_port_info pdcnew_chipsets[] __devinitconst = {
27968 /* 0: PDC202{68,70} */ DECLARE_PDCNEW_DEV(ATA_UDMA5),
27969 /* 1: PDC202{69,71,75,76,77} */ DECLARE_PDCNEW_DEV(ATA_UDMA6),
27970 };
27971 diff -urNp linux-3.0.9/drivers/ide/pdc202xx_old.c linux-3.0.9/drivers/ide/pdc202xx_old.c
27972 --- linux-3.0.9/drivers/ide/pdc202xx_old.c 2011-11-11 13:12:24.000000000 -0500
27973 +++ linux-3.0.9/drivers/ide/pdc202xx_old.c 2011-11-15 20:02:59.000000000 -0500
27974 @@ -270,7 +270,7 @@ static const struct ide_dma_ops pdc2026x
27975 .max_sectors = sectors, \
27976 }
27977
27978 -static const struct ide_port_info pdc202xx_chipsets[] __devinitdata = {
27979 +static const struct ide_port_info pdc202xx_chipsets[] __devinitconst = {
27980 { /* 0: PDC20246 */
27981 .name = DRV_NAME,
27982 .init_chipset = init_chipset_pdc202xx,
27983 diff -urNp linux-3.0.9/drivers/ide/piix.c linux-3.0.9/drivers/ide/piix.c
27984 --- linux-3.0.9/drivers/ide/piix.c 2011-11-11 13:12:24.000000000 -0500
27985 +++ linux-3.0.9/drivers/ide/piix.c 2011-11-15 20:02:59.000000000 -0500
27986 @@ -344,7 +344,7 @@ static const struct ide_port_ops ich_por
27987 .udma_mask = udma, \
27988 }
27989
27990 -static const struct ide_port_info piix_pci_info[] __devinitdata = {
27991 +static const struct ide_port_info piix_pci_info[] __devinitconst = {
27992 /* 0: MPIIX */
27993 { /*
27994 * MPIIX actually has only a single IDE channel mapped to
27995 diff -urNp linux-3.0.9/drivers/ide/rz1000.c linux-3.0.9/drivers/ide/rz1000.c
27996 --- linux-3.0.9/drivers/ide/rz1000.c 2011-11-11 13:12:24.000000000 -0500
27997 +++ linux-3.0.9/drivers/ide/rz1000.c 2011-11-15 20:02:59.000000000 -0500
27998 @@ -38,7 +38,7 @@ static int __devinit rz1000_disable_read
27999 }
28000 }
28001
28002 -static const struct ide_port_info rz1000_chipset __devinitdata = {
28003 +static const struct ide_port_info rz1000_chipset __devinitconst = {
28004 .name = DRV_NAME,
28005 .host_flags = IDE_HFLAG_NO_DMA,
28006 };
28007 diff -urNp linux-3.0.9/drivers/ide/sc1200.c linux-3.0.9/drivers/ide/sc1200.c
28008 --- linux-3.0.9/drivers/ide/sc1200.c 2011-11-11 13:12:24.000000000 -0500
28009 +++ linux-3.0.9/drivers/ide/sc1200.c 2011-11-15 20:02:59.000000000 -0500
28010 @@ -291,7 +291,7 @@ static const struct ide_dma_ops sc1200_d
28011 .dma_sff_read_status = ide_dma_sff_read_status,
28012 };
28013
28014 -static const struct ide_port_info sc1200_chipset __devinitdata = {
28015 +static const struct ide_port_info sc1200_chipset __devinitconst = {
28016 .name = DRV_NAME,
28017 .port_ops = &sc1200_port_ops,
28018 .dma_ops = &sc1200_dma_ops,
28019 diff -urNp linux-3.0.9/drivers/ide/scc_pata.c linux-3.0.9/drivers/ide/scc_pata.c
28020 --- linux-3.0.9/drivers/ide/scc_pata.c 2011-11-11 13:12:24.000000000 -0500
28021 +++ linux-3.0.9/drivers/ide/scc_pata.c 2011-11-15 20:02:59.000000000 -0500
28022 @@ -811,7 +811,7 @@ static const struct ide_dma_ops scc_dma_
28023 .dma_sff_read_status = scc_dma_sff_read_status,
28024 };
28025
28026 -static const struct ide_port_info scc_chipset __devinitdata = {
28027 +static const struct ide_port_info scc_chipset __devinitconst = {
28028 .name = "sccIDE",
28029 .init_iops = init_iops_scc,
28030 .init_dma = scc_init_dma,
28031 diff -urNp linux-3.0.9/drivers/ide/serverworks.c linux-3.0.9/drivers/ide/serverworks.c
28032 --- linux-3.0.9/drivers/ide/serverworks.c 2011-11-11 13:12:24.000000000 -0500
28033 +++ linux-3.0.9/drivers/ide/serverworks.c 2011-11-15 20:02:59.000000000 -0500
28034 @@ -337,7 +337,7 @@ static const struct ide_port_ops svwks_p
28035 .cable_detect = svwks_cable_detect,
28036 };
28037
28038 -static const struct ide_port_info serverworks_chipsets[] __devinitdata = {
28039 +static const struct ide_port_info serverworks_chipsets[] __devinitconst = {
28040 { /* 0: OSB4 */
28041 .name = DRV_NAME,
28042 .init_chipset = init_chipset_svwks,
28043 diff -urNp linux-3.0.9/drivers/ide/setup-pci.c linux-3.0.9/drivers/ide/setup-pci.c
28044 --- linux-3.0.9/drivers/ide/setup-pci.c 2011-11-11 13:12:24.000000000 -0500
28045 +++ linux-3.0.9/drivers/ide/setup-pci.c 2011-11-15 20:02:59.000000000 -0500
28046 @@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev
28047 int ret, i, n_ports = dev2 ? 4 : 2;
28048 struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
28049
28050 + pax_track_stack();
28051 +
28052 for (i = 0; i < n_ports / 2; i++) {
28053 ret = ide_setup_pci_controller(pdev[i], d, !i);
28054 if (ret < 0)
28055 diff -urNp linux-3.0.9/drivers/ide/siimage.c linux-3.0.9/drivers/ide/siimage.c
28056 --- linux-3.0.9/drivers/ide/siimage.c 2011-11-11 13:12:24.000000000 -0500
28057 +++ linux-3.0.9/drivers/ide/siimage.c 2011-11-15 20:02:59.000000000 -0500
28058 @@ -719,7 +719,7 @@ static const struct ide_dma_ops sil_dma_
28059 .udma_mask = ATA_UDMA6, \
28060 }
28061
28062 -static const struct ide_port_info siimage_chipsets[] __devinitdata = {
28063 +static const struct ide_port_info siimage_chipsets[] __devinitconst = {
28064 /* 0: SiI680 */ DECLARE_SII_DEV(&sil_pata_port_ops),
28065 /* 1: SiI3112 */ DECLARE_SII_DEV(&sil_sata_port_ops)
28066 };
28067 diff -urNp linux-3.0.9/drivers/ide/sis5513.c linux-3.0.9/drivers/ide/sis5513.c
28068 --- linux-3.0.9/drivers/ide/sis5513.c 2011-11-11 13:12:24.000000000 -0500
28069 +++ linux-3.0.9/drivers/ide/sis5513.c 2011-11-15 20:02:59.000000000 -0500
28070 @@ -563,7 +563,7 @@ static const struct ide_port_ops sis_ata
28071 .cable_detect = sis_cable_detect,
28072 };
28073
28074 -static const struct ide_port_info sis5513_chipset __devinitdata = {
28075 +static const struct ide_port_info sis5513_chipset __devinitconst = {
28076 .name = DRV_NAME,
28077 .init_chipset = init_chipset_sis5513,
28078 .enablebits = { {0x4a, 0x02, 0x02}, {0x4a, 0x04, 0x04} },
28079 diff -urNp linux-3.0.9/drivers/ide/sl82c105.c linux-3.0.9/drivers/ide/sl82c105.c
28080 --- linux-3.0.9/drivers/ide/sl82c105.c 2011-11-11 13:12:24.000000000 -0500
28081 +++ linux-3.0.9/drivers/ide/sl82c105.c 2011-11-15 20:02:59.000000000 -0500
28082 @@ -299,7 +299,7 @@ static const struct ide_dma_ops sl82c105
28083 .dma_sff_read_status = ide_dma_sff_read_status,
28084 };
28085
28086 -static const struct ide_port_info sl82c105_chipset __devinitdata = {
28087 +static const struct ide_port_info sl82c105_chipset __devinitconst = {
28088 .name = DRV_NAME,
28089 .init_chipset = init_chipset_sl82c105,
28090 .enablebits = {{0x40,0x01,0x01}, {0x40,0x10,0x10}},
28091 diff -urNp linux-3.0.9/drivers/ide/slc90e66.c linux-3.0.9/drivers/ide/slc90e66.c
28092 --- linux-3.0.9/drivers/ide/slc90e66.c 2011-11-11 13:12:24.000000000 -0500
28093 +++ linux-3.0.9/drivers/ide/slc90e66.c 2011-11-15 20:02:59.000000000 -0500
28094 @@ -132,7 +132,7 @@ static const struct ide_port_ops slc90e6
28095 .cable_detect = slc90e66_cable_detect,
28096 };
28097
28098 -static const struct ide_port_info slc90e66_chipset __devinitdata = {
28099 +static const struct ide_port_info slc90e66_chipset __devinitconst = {
28100 .name = DRV_NAME,
28101 .enablebits = { {0x41, 0x80, 0x80}, {0x43, 0x80, 0x80} },
28102 .port_ops = &slc90e66_port_ops,
28103 diff -urNp linux-3.0.9/drivers/ide/tc86c001.c linux-3.0.9/drivers/ide/tc86c001.c
28104 --- linux-3.0.9/drivers/ide/tc86c001.c 2011-11-11 13:12:24.000000000 -0500
28105 +++ linux-3.0.9/drivers/ide/tc86c001.c 2011-11-15 20:02:59.000000000 -0500
28106 @@ -191,7 +191,7 @@ static const struct ide_dma_ops tc86c001
28107 .dma_sff_read_status = ide_dma_sff_read_status,
28108 };
28109
28110 -static const struct ide_port_info tc86c001_chipset __devinitdata = {
28111 +static const struct ide_port_info tc86c001_chipset __devinitconst = {
28112 .name = DRV_NAME,
28113 .init_hwif = init_hwif_tc86c001,
28114 .port_ops = &tc86c001_port_ops,
28115 diff -urNp linux-3.0.9/drivers/ide/triflex.c linux-3.0.9/drivers/ide/triflex.c
28116 --- linux-3.0.9/drivers/ide/triflex.c 2011-11-11 13:12:24.000000000 -0500
28117 +++ linux-3.0.9/drivers/ide/triflex.c 2011-11-15 20:02:59.000000000 -0500
28118 @@ -92,7 +92,7 @@ static const struct ide_port_ops triflex
28119 .set_dma_mode = triflex_set_mode,
28120 };
28121
28122 -static const struct ide_port_info triflex_device __devinitdata = {
28123 +static const struct ide_port_info triflex_device __devinitconst = {
28124 .name = DRV_NAME,
28125 .enablebits = {{0x80, 0x01, 0x01}, {0x80, 0x02, 0x02}},
28126 .port_ops = &triflex_port_ops,
28127 diff -urNp linux-3.0.9/drivers/ide/trm290.c linux-3.0.9/drivers/ide/trm290.c
28128 --- linux-3.0.9/drivers/ide/trm290.c 2011-11-11 13:12:24.000000000 -0500
28129 +++ linux-3.0.9/drivers/ide/trm290.c 2011-11-15 20:02:59.000000000 -0500
28130 @@ -324,7 +324,7 @@ static struct ide_dma_ops trm290_dma_ops
28131 .dma_check = trm290_dma_check,
28132 };
28133
28134 -static const struct ide_port_info trm290_chipset __devinitdata = {
28135 +static const struct ide_port_info trm290_chipset __devinitconst = {
28136 .name = DRV_NAME,
28137 .init_hwif = init_hwif_trm290,
28138 .tp_ops = &trm290_tp_ops,
28139 diff -urNp linux-3.0.9/drivers/ide/via82cxxx.c linux-3.0.9/drivers/ide/via82cxxx.c
28140 --- linux-3.0.9/drivers/ide/via82cxxx.c 2011-11-11 13:12:24.000000000 -0500
28141 +++ linux-3.0.9/drivers/ide/via82cxxx.c 2011-11-15 20:02:59.000000000 -0500
28142 @@ -403,7 +403,7 @@ static const struct ide_port_ops via_por
28143 .cable_detect = via82cxxx_cable_detect,
28144 };
28145
28146 -static const struct ide_port_info via82cxxx_chipset __devinitdata = {
28147 +static const struct ide_port_info via82cxxx_chipset __devinitconst = {
28148 .name = DRV_NAME,
28149 .init_chipset = init_chipset_via82cxxx,
28150 .enablebits = { { 0x40, 0x02, 0x02 }, { 0x40, 0x01, 0x01 } },
28151 diff -urNp linux-3.0.9/drivers/infiniband/core/cm.c linux-3.0.9/drivers/infiniband/core/cm.c
28152 --- linux-3.0.9/drivers/infiniband/core/cm.c 2011-11-11 13:12:24.000000000 -0500
28153 +++ linux-3.0.9/drivers/infiniband/core/cm.c 2011-11-15 20:02:59.000000000 -0500
28154 @@ -113,7 +113,7 @@ static char const counter_group_names[CM
28155
28156 struct cm_counter_group {
28157 struct kobject obj;
28158 - atomic_long_t counter[CM_ATTR_COUNT];
28159 + atomic_long_unchecked_t counter[CM_ATTR_COUNT];
28160 };
28161
28162 struct cm_counter_attribute {
28163 @@ -1387,7 +1387,7 @@ static void cm_dup_req_handler(struct cm
28164 struct ib_mad_send_buf *msg = NULL;
28165 int ret;
28166
28167 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28168 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28169 counter[CM_REQ_COUNTER]);
28170
28171 /* Quick state check to discard duplicate REQs. */
28172 @@ -1765,7 +1765,7 @@ static void cm_dup_rep_handler(struct cm
28173 if (!cm_id_priv)
28174 return;
28175
28176 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28177 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28178 counter[CM_REP_COUNTER]);
28179 ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
28180 if (ret)
28181 @@ -1932,7 +1932,7 @@ static int cm_rtu_handler(struct cm_work
28182 if (cm_id_priv->id.state != IB_CM_REP_SENT &&
28183 cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
28184 spin_unlock_irq(&cm_id_priv->lock);
28185 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28186 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28187 counter[CM_RTU_COUNTER]);
28188 goto out;
28189 }
28190 @@ -2115,7 +2115,7 @@ static int cm_dreq_handler(struct cm_wor
28191 cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
28192 dreq_msg->local_comm_id);
28193 if (!cm_id_priv) {
28194 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28195 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28196 counter[CM_DREQ_COUNTER]);
28197 cm_issue_drep(work->port, work->mad_recv_wc);
28198 return -EINVAL;
28199 @@ -2140,7 +2140,7 @@ static int cm_dreq_handler(struct cm_wor
28200 case IB_CM_MRA_REP_RCVD:
28201 break;
28202 case IB_CM_TIMEWAIT:
28203 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28204 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28205 counter[CM_DREQ_COUNTER]);
28206 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
28207 goto unlock;
28208 @@ -2154,7 +2154,7 @@ static int cm_dreq_handler(struct cm_wor
28209 cm_free_msg(msg);
28210 goto deref;
28211 case IB_CM_DREQ_RCVD:
28212 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28213 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28214 counter[CM_DREQ_COUNTER]);
28215 goto unlock;
28216 default:
28217 @@ -2521,7 +2521,7 @@ static int cm_mra_handler(struct cm_work
28218 ib_modify_mad(cm_id_priv->av.port->mad_agent,
28219 cm_id_priv->msg, timeout)) {
28220 if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
28221 - atomic_long_inc(&work->port->
28222 + atomic_long_inc_unchecked(&work->port->
28223 counter_group[CM_RECV_DUPLICATES].
28224 counter[CM_MRA_COUNTER]);
28225 goto out;
28226 @@ -2530,7 +2530,7 @@ static int cm_mra_handler(struct cm_work
28227 break;
28228 case IB_CM_MRA_REQ_RCVD:
28229 case IB_CM_MRA_REP_RCVD:
28230 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28231 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28232 counter[CM_MRA_COUNTER]);
28233 /* fall through */
28234 default:
28235 @@ -2692,7 +2692,7 @@ static int cm_lap_handler(struct cm_work
28236 case IB_CM_LAP_IDLE:
28237 break;
28238 case IB_CM_MRA_LAP_SENT:
28239 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28240 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28241 counter[CM_LAP_COUNTER]);
28242 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
28243 goto unlock;
28244 @@ -2708,7 +2708,7 @@ static int cm_lap_handler(struct cm_work
28245 cm_free_msg(msg);
28246 goto deref;
28247 case IB_CM_LAP_RCVD:
28248 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28249 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28250 counter[CM_LAP_COUNTER]);
28251 goto unlock;
28252 default:
28253 @@ -2992,7 +2992,7 @@ static int cm_sidr_req_handler(struct cm
28254 cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
28255 if (cur_cm_id_priv) {
28256 spin_unlock_irq(&cm.lock);
28257 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
28258 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
28259 counter[CM_SIDR_REQ_COUNTER]);
28260 goto out; /* Duplicate message. */
28261 }
28262 @@ -3204,10 +3204,10 @@ static void cm_send_handler(struct ib_ma
28263 if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
28264 msg->retries = 1;
28265
28266 - atomic_long_add(1 + msg->retries,
28267 + atomic_long_add_unchecked(1 + msg->retries,
28268 &port->counter_group[CM_XMIT].counter[attr_index]);
28269 if (msg->retries)
28270 - atomic_long_add(msg->retries,
28271 + atomic_long_add_unchecked(msg->retries,
28272 &port->counter_group[CM_XMIT_RETRIES].
28273 counter[attr_index]);
28274
28275 @@ -3417,7 +3417,7 @@ static void cm_recv_handler(struct ib_ma
28276 }
28277
28278 attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
28279 - atomic_long_inc(&port->counter_group[CM_RECV].
28280 + atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
28281 counter[attr_id - CM_ATTR_ID_OFFSET]);
28282
28283 work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
28284 @@ -3615,7 +3615,7 @@ static ssize_t cm_show_counter(struct ko
28285 cm_attr = container_of(attr, struct cm_counter_attribute, attr);
28286
28287 return sprintf(buf, "%ld\n",
28288 - atomic_long_read(&group->counter[cm_attr->index]));
28289 + atomic_long_read_unchecked(&group->counter[cm_attr->index]));
28290 }
28291
28292 static const struct sysfs_ops cm_counter_ops = {
28293 diff -urNp linux-3.0.9/drivers/infiniband/core/fmr_pool.c linux-3.0.9/drivers/infiniband/core/fmr_pool.c
28294 --- linux-3.0.9/drivers/infiniband/core/fmr_pool.c 2011-11-11 13:12:24.000000000 -0500
28295 +++ linux-3.0.9/drivers/infiniband/core/fmr_pool.c 2011-11-15 20:02:59.000000000 -0500
28296 @@ -97,8 +97,8 @@ struct ib_fmr_pool {
28297
28298 struct task_struct *thread;
28299
28300 - atomic_t req_ser;
28301 - atomic_t flush_ser;
28302 + atomic_unchecked_t req_ser;
28303 + atomic_unchecked_t flush_ser;
28304
28305 wait_queue_head_t force_wait;
28306 };
28307 @@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *p
28308 struct ib_fmr_pool *pool = pool_ptr;
28309
28310 do {
28311 - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
28312 + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
28313 ib_fmr_batch_release(pool);
28314
28315 - atomic_inc(&pool->flush_ser);
28316 + atomic_inc_unchecked(&pool->flush_ser);
28317 wake_up_interruptible(&pool->force_wait);
28318
28319 if (pool->flush_function)
28320 @@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *p
28321 }
28322
28323 set_current_state(TASK_INTERRUPTIBLE);
28324 - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
28325 + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
28326 !kthread_should_stop())
28327 schedule();
28328 __set_current_state(TASK_RUNNING);
28329 @@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(s
28330 pool->dirty_watermark = params->dirty_watermark;
28331 pool->dirty_len = 0;
28332 spin_lock_init(&pool->pool_lock);
28333 - atomic_set(&pool->req_ser, 0);
28334 - atomic_set(&pool->flush_ser, 0);
28335 + atomic_set_unchecked(&pool->req_ser, 0);
28336 + atomic_set_unchecked(&pool->flush_ser, 0);
28337 init_waitqueue_head(&pool->force_wait);
28338
28339 pool->thread = kthread_run(ib_fmr_cleanup_thread,
28340 @@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool
28341 }
28342 spin_unlock_irq(&pool->pool_lock);
28343
28344 - serial = atomic_inc_return(&pool->req_ser);
28345 + serial = atomic_inc_return_unchecked(&pool->req_ser);
28346 wake_up_process(pool->thread);
28347
28348 if (wait_event_interruptible(pool->force_wait,
28349 - atomic_read(&pool->flush_ser) - serial >= 0))
28350 + atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
28351 return -EINTR;
28352
28353 return 0;
28354 @@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr
28355 } else {
28356 list_add_tail(&fmr->list, &pool->dirty_list);
28357 if (++pool->dirty_len >= pool->dirty_watermark) {
28358 - atomic_inc(&pool->req_ser);
28359 + atomic_inc_unchecked(&pool->req_ser);
28360 wake_up_process(pool->thread);
28361 }
28362 }
28363 diff -urNp linux-3.0.9/drivers/infiniband/hw/cxgb4/mem.c linux-3.0.9/drivers/infiniband/hw/cxgb4/mem.c
28364 --- linux-3.0.9/drivers/infiniband/hw/cxgb4/mem.c 2011-11-11 13:12:24.000000000 -0500
28365 +++ linux-3.0.9/drivers/infiniband/hw/cxgb4/mem.c 2011-11-15 20:02:59.000000000 -0500
28366 @@ -122,7 +122,7 @@ static int write_tpt_entry(struct c4iw_r
28367 int err;
28368 struct fw_ri_tpte tpt;
28369 u32 stag_idx;
28370 - static atomic_t key;
28371 + static atomic_unchecked_t key;
28372
28373 if (c4iw_fatal_error(rdev))
28374 return -EIO;
28375 @@ -135,7 +135,7 @@ static int write_tpt_entry(struct c4iw_r
28376 &rdev->resource.tpt_fifo_lock);
28377 if (!stag_idx)
28378 return -ENOMEM;
28379 - *stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff);
28380 + *stag = (stag_idx << 8) | (atomic_inc_return_unchecked(&key) & 0xff);
28381 }
28382 PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
28383 __func__, stag_state, type, pdid, stag_idx);
28384 diff -urNp linux-3.0.9/drivers/infiniband/hw/ipath/ipath_fs.c linux-3.0.9/drivers/infiniband/hw/ipath/ipath_fs.c
28385 --- linux-3.0.9/drivers/infiniband/hw/ipath/ipath_fs.c 2011-11-11 13:12:24.000000000 -0500
28386 +++ linux-3.0.9/drivers/infiniband/hw/ipath/ipath_fs.c 2011-11-15 20:02:59.000000000 -0500
28387 @@ -113,6 +113,8 @@ static ssize_t atomic_counters_read(stru
28388 struct infinipath_counters counters;
28389 struct ipath_devdata *dd;
28390
28391 + pax_track_stack();
28392 +
28393 dd = file->f_path.dentry->d_inode->i_private;
28394 dd->ipath_f_read_counters(dd, &counters);
28395
28396 diff -urNp linux-3.0.9/drivers/infiniband/hw/ipath/ipath_rc.c linux-3.0.9/drivers/infiniband/hw/ipath/ipath_rc.c
28397 --- linux-3.0.9/drivers/infiniband/hw/ipath/ipath_rc.c 2011-11-11 13:12:24.000000000 -0500
28398 +++ linux-3.0.9/drivers/infiniband/hw/ipath/ipath_rc.c 2011-11-15 20:02:59.000000000 -0500
28399 @@ -1868,7 +1868,7 @@ void ipath_rc_rcv(struct ipath_ibdev *de
28400 struct ib_atomic_eth *ateth;
28401 struct ipath_ack_entry *e;
28402 u64 vaddr;
28403 - atomic64_t *maddr;
28404 + atomic64_unchecked_t *maddr;
28405 u64 sdata;
28406 u32 rkey;
28407 u8 next;
28408 @@ -1903,11 +1903,11 @@ void ipath_rc_rcv(struct ipath_ibdev *de
28409 IB_ACCESS_REMOTE_ATOMIC)))
28410 goto nack_acc_unlck;
28411 /* Perform atomic OP and save result. */
28412 - maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
28413 + maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
28414 sdata = be64_to_cpu(ateth->swap_data);
28415 e = &qp->s_ack_queue[qp->r_head_ack_queue];
28416 e->atomic_data = (opcode == OP(FETCH_ADD)) ?
28417 - (u64) atomic64_add_return(sdata, maddr) - sdata :
28418 + (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
28419 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
28420 be64_to_cpu(ateth->compare_data),
28421 sdata);
28422 diff -urNp linux-3.0.9/drivers/infiniband/hw/ipath/ipath_ruc.c linux-3.0.9/drivers/infiniband/hw/ipath/ipath_ruc.c
28423 --- linux-3.0.9/drivers/infiniband/hw/ipath/ipath_ruc.c 2011-11-11 13:12:24.000000000 -0500
28424 +++ linux-3.0.9/drivers/infiniband/hw/ipath/ipath_ruc.c 2011-11-15 20:02:59.000000000 -0500
28425 @@ -266,7 +266,7 @@ static void ipath_ruc_loopback(struct ip
28426 unsigned long flags;
28427 struct ib_wc wc;
28428 u64 sdata;
28429 - atomic64_t *maddr;
28430 + atomic64_unchecked_t *maddr;
28431 enum ib_wc_status send_status;
28432
28433 /*
28434 @@ -382,11 +382,11 @@ again:
28435 IB_ACCESS_REMOTE_ATOMIC)))
28436 goto acc_err;
28437 /* Perform atomic OP and save result. */
28438 - maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
28439 + maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
28440 sdata = wqe->wr.wr.atomic.compare_add;
28441 *(u64 *) sqp->s_sge.sge.vaddr =
28442 (wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD) ?
28443 - (u64) atomic64_add_return(sdata, maddr) - sdata :
28444 + (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
28445 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
28446 sdata, wqe->wr.wr.atomic.swap);
28447 goto send_comp;
28448 diff -urNp linux-3.0.9/drivers/infiniband/hw/nes/nes.c linux-3.0.9/drivers/infiniband/hw/nes/nes.c
28449 --- linux-3.0.9/drivers/infiniband/hw/nes/nes.c 2011-11-11 13:12:24.000000000 -0500
28450 +++ linux-3.0.9/drivers/infiniband/hw/nes/nes.c 2011-11-15 20:02:59.000000000 -0500
28451 @@ -103,7 +103,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limi
28452 LIST_HEAD(nes_adapter_list);
28453 static LIST_HEAD(nes_dev_list);
28454
28455 -atomic_t qps_destroyed;
28456 +atomic_unchecked_t qps_destroyed;
28457
28458 static unsigned int ee_flsh_adapter;
28459 static unsigned int sysfs_nonidx_addr;
28460 @@ -275,7 +275,7 @@ static void nes_cqp_rem_ref_callback(str
28461 struct nes_qp *nesqp = cqp_request->cqp_callback_pointer;
28462 struct nes_adapter *nesadapter = nesdev->nesadapter;
28463
28464 - atomic_inc(&qps_destroyed);
28465 + atomic_inc_unchecked(&qps_destroyed);
28466
28467 /* Free the control structures */
28468
28469 diff -urNp linux-3.0.9/drivers/infiniband/hw/nes/nes_cm.c linux-3.0.9/drivers/infiniband/hw/nes/nes_cm.c
28470 --- linux-3.0.9/drivers/infiniband/hw/nes/nes_cm.c 2011-11-11 13:12:24.000000000 -0500
28471 +++ linux-3.0.9/drivers/infiniband/hw/nes/nes_cm.c 2011-11-15 20:02:59.000000000 -0500
28472 @@ -68,14 +68,14 @@ u32 cm_packets_dropped;
28473 u32 cm_packets_retrans;
28474 u32 cm_packets_created;
28475 u32 cm_packets_received;
28476 -atomic_t cm_listens_created;
28477 -atomic_t cm_listens_destroyed;
28478 +atomic_unchecked_t cm_listens_created;
28479 +atomic_unchecked_t cm_listens_destroyed;
28480 u32 cm_backlog_drops;
28481 -atomic_t cm_loopbacks;
28482 -atomic_t cm_nodes_created;
28483 -atomic_t cm_nodes_destroyed;
28484 -atomic_t cm_accel_dropped_pkts;
28485 -atomic_t cm_resets_recvd;
28486 +atomic_unchecked_t cm_loopbacks;
28487 +atomic_unchecked_t cm_nodes_created;
28488 +atomic_unchecked_t cm_nodes_destroyed;
28489 +atomic_unchecked_t cm_accel_dropped_pkts;
28490 +atomic_unchecked_t cm_resets_recvd;
28491
28492 static inline int mini_cm_accelerated(struct nes_cm_core *,
28493 struct nes_cm_node *);
28494 @@ -151,13 +151,13 @@ static struct nes_cm_ops nes_cm_api = {
28495
28496 static struct nes_cm_core *g_cm_core;
28497
28498 -atomic_t cm_connects;
28499 -atomic_t cm_accepts;
28500 -atomic_t cm_disconnects;
28501 -atomic_t cm_closes;
28502 -atomic_t cm_connecteds;
28503 -atomic_t cm_connect_reqs;
28504 -atomic_t cm_rejects;
28505 +atomic_unchecked_t cm_connects;
28506 +atomic_unchecked_t cm_accepts;
28507 +atomic_unchecked_t cm_disconnects;
28508 +atomic_unchecked_t cm_closes;
28509 +atomic_unchecked_t cm_connecteds;
28510 +atomic_unchecked_t cm_connect_reqs;
28511 +atomic_unchecked_t cm_rejects;
28512
28513
28514 /**
28515 @@ -1045,7 +1045,7 @@ static int mini_cm_dec_refcnt_listen(str
28516 kfree(listener);
28517 listener = NULL;
28518 ret = 0;
28519 - atomic_inc(&cm_listens_destroyed);
28520 + atomic_inc_unchecked(&cm_listens_destroyed);
28521 } else {
28522 spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
28523 }
28524 @@ -1240,7 +1240,7 @@ static struct nes_cm_node *make_cm_node(
28525 cm_node->rem_mac);
28526
28527 add_hte_node(cm_core, cm_node);
28528 - atomic_inc(&cm_nodes_created);
28529 + atomic_inc_unchecked(&cm_nodes_created);
28530
28531 return cm_node;
28532 }
28533 @@ -1298,7 +1298,7 @@ static int rem_ref_cm_node(struct nes_cm
28534 }
28535
28536 atomic_dec(&cm_core->node_cnt);
28537 - atomic_inc(&cm_nodes_destroyed);
28538 + atomic_inc_unchecked(&cm_nodes_destroyed);
28539 nesqp = cm_node->nesqp;
28540 if (nesqp) {
28541 nesqp->cm_node = NULL;
28542 @@ -1365,7 +1365,7 @@ static int process_options(struct nes_cm
28543
28544 static void drop_packet(struct sk_buff *skb)
28545 {
28546 - atomic_inc(&cm_accel_dropped_pkts);
28547 + atomic_inc_unchecked(&cm_accel_dropped_pkts);
28548 dev_kfree_skb_any(skb);
28549 }
28550
28551 @@ -1428,7 +1428,7 @@ static void handle_rst_pkt(struct nes_cm
28552 {
28553
28554 int reset = 0; /* whether to send reset in case of err.. */
28555 - atomic_inc(&cm_resets_recvd);
28556 + atomic_inc_unchecked(&cm_resets_recvd);
28557 nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
28558 " refcnt=%d\n", cm_node, cm_node->state,
28559 atomic_read(&cm_node->ref_count));
28560 @@ -2057,7 +2057,7 @@ static struct nes_cm_node *mini_cm_conne
28561 rem_ref_cm_node(cm_node->cm_core, cm_node);
28562 return NULL;
28563 }
28564 - atomic_inc(&cm_loopbacks);
28565 + atomic_inc_unchecked(&cm_loopbacks);
28566 loopbackremotenode->loopbackpartner = cm_node;
28567 loopbackremotenode->tcp_cntxt.rcv_wscale =
28568 NES_CM_DEFAULT_RCV_WND_SCALE;
28569 @@ -2332,7 +2332,7 @@ static int mini_cm_recv_pkt(struct nes_c
28570 add_ref_cm_node(cm_node);
28571 } else if (cm_node->state == NES_CM_STATE_TSA) {
28572 rem_ref_cm_node(cm_core, cm_node);
28573 - atomic_inc(&cm_accel_dropped_pkts);
28574 + atomic_inc_unchecked(&cm_accel_dropped_pkts);
28575 dev_kfree_skb_any(skb);
28576 break;
28577 }
28578 @@ -2638,7 +2638,7 @@ static int nes_cm_disconn_true(struct ne
28579
28580 if ((cm_id) && (cm_id->event_handler)) {
28581 if (issue_disconn) {
28582 - atomic_inc(&cm_disconnects);
28583 + atomic_inc_unchecked(&cm_disconnects);
28584 cm_event.event = IW_CM_EVENT_DISCONNECT;
28585 cm_event.status = disconn_status;
28586 cm_event.local_addr = cm_id->local_addr;
28587 @@ -2660,7 +2660,7 @@ static int nes_cm_disconn_true(struct ne
28588 }
28589
28590 if (issue_close) {
28591 - atomic_inc(&cm_closes);
28592 + atomic_inc_unchecked(&cm_closes);
28593 nes_disconnect(nesqp, 1);
28594
28595 cm_id->provider_data = nesqp;
28596 @@ -2791,7 +2791,7 @@ int nes_accept(struct iw_cm_id *cm_id, s
28597
28598 nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
28599 nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
28600 - atomic_inc(&cm_accepts);
28601 + atomic_inc_unchecked(&cm_accepts);
28602
28603 nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
28604 netdev_refcnt_read(nesvnic->netdev));
28605 @@ -3001,7 +3001,7 @@ int nes_reject(struct iw_cm_id *cm_id, c
28606
28607 struct nes_cm_core *cm_core;
28608
28609 - atomic_inc(&cm_rejects);
28610 + atomic_inc_unchecked(&cm_rejects);
28611 cm_node = (struct nes_cm_node *) cm_id->provider_data;
28612 loopback = cm_node->loopbackpartner;
28613 cm_core = cm_node->cm_core;
28614 @@ -3067,7 +3067,7 @@ int nes_connect(struct iw_cm_id *cm_id,
28615 ntohl(cm_id->local_addr.sin_addr.s_addr),
28616 ntohs(cm_id->local_addr.sin_port));
28617
28618 - atomic_inc(&cm_connects);
28619 + atomic_inc_unchecked(&cm_connects);
28620 nesqp->active_conn = 1;
28621
28622 /* cache the cm_id in the qp */
28623 @@ -3173,7 +3173,7 @@ int nes_create_listen(struct iw_cm_id *c
28624 g_cm_core->api->stop_listener(g_cm_core, (void *)cm_node);
28625 return err;
28626 }
28627 - atomic_inc(&cm_listens_created);
28628 + atomic_inc_unchecked(&cm_listens_created);
28629 }
28630
28631 cm_id->add_ref(cm_id);
28632 @@ -3278,7 +3278,7 @@ static void cm_event_connected(struct ne
28633 if (nesqp->destroyed) {
28634 return;
28635 }
28636 - atomic_inc(&cm_connecteds);
28637 + atomic_inc_unchecked(&cm_connecteds);
28638 nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
28639 " local port 0x%04X. jiffies = %lu.\n",
28640 nesqp->hwqp.qp_id,
28641 @@ -3493,7 +3493,7 @@ static void cm_event_reset(struct nes_cm
28642
28643 cm_id->add_ref(cm_id);
28644 ret = cm_id->event_handler(cm_id, &cm_event);
28645 - atomic_inc(&cm_closes);
28646 + atomic_inc_unchecked(&cm_closes);
28647 cm_event.event = IW_CM_EVENT_CLOSE;
28648 cm_event.status = 0;
28649 cm_event.provider_data = cm_id->provider_data;
28650 @@ -3529,7 +3529,7 @@ static void cm_event_mpa_req(struct nes_
28651 return;
28652 cm_id = cm_node->cm_id;
28653
28654 - atomic_inc(&cm_connect_reqs);
28655 + atomic_inc_unchecked(&cm_connect_reqs);
28656 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
28657 cm_node, cm_id, jiffies);
28658
28659 @@ -3567,7 +3567,7 @@ static void cm_event_mpa_reject(struct n
28660 return;
28661 cm_id = cm_node->cm_id;
28662
28663 - atomic_inc(&cm_connect_reqs);
28664 + atomic_inc_unchecked(&cm_connect_reqs);
28665 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
28666 cm_node, cm_id, jiffies);
28667
28668 diff -urNp linux-3.0.9/drivers/infiniband/hw/nes/nes.h linux-3.0.9/drivers/infiniband/hw/nes/nes.h
28669 --- linux-3.0.9/drivers/infiniband/hw/nes/nes.h 2011-11-11 13:12:24.000000000 -0500
28670 +++ linux-3.0.9/drivers/infiniband/hw/nes/nes.h 2011-11-15 20:02:59.000000000 -0500
28671 @@ -175,17 +175,17 @@ extern unsigned int nes_debug_level;
28672 extern unsigned int wqm_quanta;
28673 extern struct list_head nes_adapter_list;
28674
28675 -extern atomic_t cm_connects;
28676 -extern atomic_t cm_accepts;
28677 -extern atomic_t cm_disconnects;
28678 -extern atomic_t cm_closes;
28679 -extern atomic_t cm_connecteds;
28680 -extern atomic_t cm_connect_reqs;
28681 -extern atomic_t cm_rejects;
28682 -extern atomic_t mod_qp_timouts;
28683 -extern atomic_t qps_created;
28684 -extern atomic_t qps_destroyed;
28685 -extern atomic_t sw_qps_destroyed;
28686 +extern atomic_unchecked_t cm_connects;
28687 +extern atomic_unchecked_t cm_accepts;
28688 +extern atomic_unchecked_t cm_disconnects;
28689 +extern atomic_unchecked_t cm_closes;
28690 +extern atomic_unchecked_t cm_connecteds;
28691 +extern atomic_unchecked_t cm_connect_reqs;
28692 +extern atomic_unchecked_t cm_rejects;
28693 +extern atomic_unchecked_t mod_qp_timouts;
28694 +extern atomic_unchecked_t qps_created;
28695 +extern atomic_unchecked_t qps_destroyed;
28696 +extern atomic_unchecked_t sw_qps_destroyed;
28697 extern u32 mh_detected;
28698 extern u32 mh_pauses_sent;
28699 extern u32 cm_packets_sent;
28700 @@ -194,14 +194,14 @@ extern u32 cm_packets_created;
28701 extern u32 cm_packets_received;
28702 extern u32 cm_packets_dropped;
28703 extern u32 cm_packets_retrans;
28704 -extern atomic_t cm_listens_created;
28705 -extern atomic_t cm_listens_destroyed;
28706 +extern atomic_unchecked_t cm_listens_created;
28707 +extern atomic_unchecked_t cm_listens_destroyed;
28708 extern u32 cm_backlog_drops;
28709 -extern atomic_t cm_loopbacks;
28710 -extern atomic_t cm_nodes_created;
28711 -extern atomic_t cm_nodes_destroyed;
28712 -extern atomic_t cm_accel_dropped_pkts;
28713 -extern atomic_t cm_resets_recvd;
28714 +extern atomic_unchecked_t cm_loopbacks;
28715 +extern atomic_unchecked_t cm_nodes_created;
28716 +extern atomic_unchecked_t cm_nodes_destroyed;
28717 +extern atomic_unchecked_t cm_accel_dropped_pkts;
28718 +extern atomic_unchecked_t cm_resets_recvd;
28719
28720 extern u32 int_mod_timer_init;
28721 extern u32 int_mod_cq_depth_256;
28722 diff -urNp linux-3.0.9/drivers/infiniband/hw/nes/nes_nic.c linux-3.0.9/drivers/infiniband/hw/nes/nes_nic.c
28723 --- linux-3.0.9/drivers/infiniband/hw/nes/nes_nic.c 2011-11-11 13:12:24.000000000 -0500
28724 +++ linux-3.0.9/drivers/infiniband/hw/nes/nes_nic.c 2011-11-15 20:02:59.000000000 -0500
28725 @@ -1274,31 +1274,31 @@ static void nes_netdev_get_ethtool_stats
28726 target_stat_values[++index] = mh_detected;
28727 target_stat_values[++index] = mh_pauses_sent;
28728 target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
28729 - target_stat_values[++index] = atomic_read(&cm_connects);
28730 - target_stat_values[++index] = atomic_read(&cm_accepts);
28731 - target_stat_values[++index] = atomic_read(&cm_disconnects);
28732 - target_stat_values[++index] = atomic_read(&cm_connecteds);
28733 - target_stat_values[++index] = atomic_read(&cm_connect_reqs);
28734 - target_stat_values[++index] = atomic_read(&cm_rejects);
28735 - target_stat_values[++index] = atomic_read(&mod_qp_timouts);
28736 - target_stat_values[++index] = atomic_read(&qps_created);
28737 - target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
28738 - target_stat_values[++index] = atomic_read(&qps_destroyed);
28739 - target_stat_values[++index] = atomic_read(&cm_closes);
28740 + target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
28741 + target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
28742 + target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
28743 + target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
28744 + target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
28745 + target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
28746 + target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
28747 + target_stat_values[++index] = atomic_read_unchecked(&qps_created);
28748 + target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
28749 + target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
28750 + target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
28751 target_stat_values[++index] = cm_packets_sent;
28752 target_stat_values[++index] = cm_packets_bounced;
28753 target_stat_values[++index] = cm_packets_created;
28754 target_stat_values[++index] = cm_packets_received;
28755 target_stat_values[++index] = cm_packets_dropped;
28756 target_stat_values[++index] = cm_packets_retrans;
28757 - target_stat_values[++index] = atomic_read(&cm_listens_created);
28758 - target_stat_values[++index] = atomic_read(&cm_listens_destroyed);
28759 + target_stat_values[++index] = atomic_read_unchecked(&cm_listens_created);
28760 + target_stat_values[++index] = atomic_read_unchecked(&cm_listens_destroyed);
28761 target_stat_values[++index] = cm_backlog_drops;
28762 - target_stat_values[++index] = atomic_read(&cm_loopbacks);
28763 - target_stat_values[++index] = atomic_read(&cm_nodes_created);
28764 - target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
28765 - target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
28766 - target_stat_values[++index] = atomic_read(&cm_resets_recvd);
28767 + target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
28768 + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
28769 + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
28770 + target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
28771 + target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
28772 target_stat_values[++index] = nesadapter->free_4kpbl;
28773 target_stat_values[++index] = nesadapter->free_256pbl;
28774 target_stat_values[++index] = int_mod_timer_init;
28775 diff -urNp linux-3.0.9/drivers/infiniband/hw/nes/nes_verbs.c linux-3.0.9/drivers/infiniband/hw/nes/nes_verbs.c
28776 --- linux-3.0.9/drivers/infiniband/hw/nes/nes_verbs.c 2011-11-11 13:12:24.000000000 -0500
28777 +++ linux-3.0.9/drivers/infiniband/hw/nes/nes_verbs.c 2011-11-15 20:02:59.000000000 -0500
28778 @@ -46,9 +46,9 @@
28779
28780 #include <rdma/ib_umem.h>
28781
28782 -atomic_t mod_qp_timouts;
28783 -atomic_t qps_created;
28784 -atomic_t sw_qps_destroyed;
28785 +atomic_unchecked_t mod_qp_timouts;
28786 +atomic_unchecked_t qps_created;
28787 +atomic_unchecked_t sw_qps_destroyed;
28788
28789 static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
28790
28791 @@ -1141,7 +1141,7 @@ static struct ib_qp *nes_create_qp(struc
28792 if (init_attr->create_flags)
28793 return ERR_PTR(-EINVAL);
28794
28795 - atomic_inc(&qps_created);
28796 + atomic_inc_unchecked(&qps_created);
28797 switch (init_attr->qp_type) {
28798 case IB_QPT_RC:
28799 if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
28800 @@ -1470,7 +1470,7 @@ static int nes_destroy_qp(struct ib_qp *
28801 struct iw_cm_event cm_event;
28802 int ret;
28803
28804 - atomic_inc(&sw_qps_destroyed);
28805 + atomic_inc_unchecked(&sw_qps_destroyed);
28806 nesqp->destroyed = 1;
28807
28808 /* Blow away the connection if it exists. */
28809 diff -urNp linux-3.0.9/drivers/infiniband/hw/qib/qib.h linux-3.0.9/drivers/infiniband/hw/qib/qib.h
28810 --- linux-3.0.9/drivers/infiniband/hw/qib/qib.h 2011-11-11 13:12:24.000000000 -0500
28811 +++ linux-3.0.9/drivers/infiniband/hw/qib/qib.h 2011-11-15 20:02:59.000000000 -0500
28812 @@ -51,6 +51,7 @@
28813 #include <linux/completion.h>
28814 #include <linux/kref.h>
28815 #include <linux/sched.h>
28816 +#include <linux/slab.h>
28817
28818 #include "qib_common.h"
28819 #include "qib_verbs.h"
28820 diff -urNp linux-3.0.9/drivers/input/gameport/gameport.c linux-3.0.9/drivers/input/gameport/gameport.c
28821 --- linux-3.0.9/drivers/input/gameport/gameport.c 2011-11-11 13:12:24.000000000 -0500
28822 +++ linux-3.0.9/drivers/input/gameport/gameport.c 2011-11-15 20:02:59.000000000 -0500
28823 @@ -488,14 +488,14 @@ EXPORT_SYMBOL(gameport_set_phys);
28824 */
28825 static void gameport_init_port(struct gameport *gameport)
28826 {
28827 - static atomic_t gameport_no = ATOMIC_INIT(0);
28828 + static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
28829
28830 __module_get(THIS_MODULE);
28831
28832 mutex_init(&gameport->drv_mutex);
28833 device_initialize(&gameport->dev);
28834 dev_set_name(&gameport->dev, "gameport%lu",
28835 - (unsigned long)atomic_inc_return(&gameport_no) - 1);
28836 + (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
28837 gameport->dev.bus = &gameport_bus;
28838 gameport->dev.release = gameport_release_port;
28839 if (gameport->parent)
28840 diff -urNp linux-3.0.9/drivers/input/input.c linux-3.0.9/drivers/input/input.c
28841 --- linux-3.0.9/drivers/input/input.c 2011-11-11 13:12:24.000000000 -0500
28842 +++ linux-3.0.9/drivers/input/input.c 2011-11-15 20:02:59.000000000 -0500
28843 @@ -1814,7 +1814,7 @@ static void input_cleanse_bitmasks(struc
28844 */
28845 int input_register_device(struct input_dev *dev)
28846 {
28847 - static atomic_t input_no = ATOMIC_INIT(0);
28848 + static atomic_unchecked_t input_no = ATOMIC_INIT(0);
28849 struct input_handler *handler;
28850 const char *path;
28851 int error;
28852 @@ -1851,7 +1851,7 @@ int input_register_device(struct input_d
28853 dev->setkeycode = input_default_setkeycode;
28854
28855 dev_set_name(&dev->dev, "input%ld",
28856 - (unsigned long) atomic_inc_return(&input_no) - 1);
28857 + (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
28858
28859 error = device_add(&dev->dev);
28860 if (error)
28861 diff -urNp linux-3.0.9/drivers/input/joystick/sidewinder.c linux-3.0.9/drivers/input/joystick/sidewinder.c
28862 --- linux-3.0.9/drivers/input/joystick/sidewinder.c 2011-11-11 13:12:24.000000000 -0500
28863 +++ linux-3.0.9/drivers/input/joystick/sidewinder.c 2011-11-15 20:02:59.000000000 -0500
28864 @@ -30,6 +30,7 @@
28865 #include <linux/kernel.h>
28866 #include <linux/module.h>
28867 #include <linux/slab.h>
28868 +#include <linux/sched.h>
28869 #include <linux/init.h>
28870 #include <linux/input.h>
28871 #include <linux/gameport.h>
28872 @@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
28873 unsigned char buf[SW_LENGTH];
28874 int i;
28875
28876 + pax_track_stack();
28877 +
28878 i = sw_read_packet(sw->gameport, buf, sw->length, 0);
28879
28880 if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
28881 diff -urNp linux-3.0.9/drivers/input/joystick/xpad.c linux-3.0.9/drivers/input/joystick/xpad.c
28882 --- linux-3.0.9/drivers/input/joystick/xpad.c 2011-11-11 13:12:24.000000000 -0500
28883 +++ linux-3.0.9/drivers/input/joystick/xpad.c 2011-11-15 20:02:59.000000000 -0500
28884 @@ -689,7 +689,7 @@ static void xpad_led_set(struct led_clas
28885
28886 static int xpad_led_probe(struct usb_xpad *xpad)
28887 {
28888 - static atomic_t led_seq = ATOMIC_INIT(0);
28889 + static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
28890 long led_no;
28891 struct xpad_led *led;
28892 struct led_classdev *led_cdev;
28893 @@ -702,7 +702,7 @@ static int xpad_led_probe(struct usb_xpa
28894 if (!led)
28895 return -ENOMEM;
28896
28897 - led_no = (long)atomic_inc_return(&led_seq) - 1;
28898 + led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
28899
28900 snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
28901 led->xpad = xpad;
28902 diff -urNp linux-3.0.9/drivers/input/mousedev.c linux-3.0.9/drivers/input/mousedev.c
28903 --- linux-3.0.9/drivers/input/mousedev.c 2011-11-11 13:12:24.000000000 -0500
28904 +++ linux-3.0.9/drivers/input/mousedev.c 2011-11-15 20:02:59.000000000 -0500
28905 @@ -763,7 +763,7 @@ static ssize_t mousedev_read(struct file
28906
28907 spin_unlock_irq(&client->packet_lock);
28908
28909 - if (copy_to_user(buffer, data, count))
28910 + if (count > sizeof(data) || copy_to_user(buffer, data, count))
28911 return -EFAULT;
28912
28913 return count;
28914 diff -urNp linux-3.0.9/drivers/input/serio/serio.c linux-3.0.9/drivers/input/serio/serio.c
28915 --- linux-3.0.9/drivers/input/serio/serio.c 2011-11-11 13:12:24.000000000 -0500
28916 +++ linux-3.0.9/drivers/input/serio/serio.c 2011-11-15 20:02:59.000000000 -0500
28917 @@ -497,7 +497,7 @@ static void serio_release_port(struct de
28918 */
28919 static void serio_init_port(struct serio *serio)
28920 {
28921 - static atomic_t serio_no = ATOMIC_INIT(0);
28922 + static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
28923
28924 __module_get(THIS_MODULE);
28925
28926 @@ -508,7 +508,7 @@ static void serio_init_port(struct serio
28927 mutex_init(&serio->drv_mutex);
28928 device_initialize(&serio->dev);
28929 dev_set_name(&serio->dev, "serio%ld",
28930 - (long)atomic_inc_return(&serio_no) - 1);
28931 + (long)atomic_inc_return_unchecked(&serio_no) - 1);
28932 serio->dev.bus = &serio_bus;
28933 serio->dev.release = serio_release_port;
28934 serio->dev.groups = serio_device_attr_groups;
28935 diff -urNp linux-3.0.9/drivers/isdn/capi/capi.c linux-3.0.9/drivers/isdn/capi/capi.c
28936 --- linux-3.0.9/drivers/isdn/capi/capi.c 2011-11-11 13:12:24.000000000 -0500
28937 +++ linux-3.0.9/drivers/isdn/capi/capi.c 2011-11-15 20:02:59.000000000 -0500
28938 @@ -83,8 +83,8 @@ struct capiminor {
28939
28940 struct capi20_appl *ap;
28941 u32 ncci;
28942 - atomic_t datahandle;
28943 - atomic_t msgid;
28944 + atomic_unchecked_t datahandle;
28945 + atomic_unchecked_t msgid;
28946
28947 struct tty_port port;
28948 int ttyinstop;
28949 @@ -397,7 +397,7 @@ gen_data_b3_resp_for(struct capiminor *m
28950 capimsg_setu16(s, 2, mp->ap->applid);
28951 capimsg_setu8 (s, 4, CAPI_DATA_B3);
28952 capimsg_setu8 (s, 5, CAPI_RESP);
28953 - capimsg_setu16(s, 6, atomic_inc_return(&mp->msgid));
28954 + capimsg_setu16(s, 6, atomic_inc_return_unchecked(&mp->msgid));
28955 capimsg_setu32(s, 8, mp->ncci);
28956 capimsg_setu16(s, 12, datahandle);
28957 }
28958 @@ -518,14 +518,14 @@ static void handle_minor_send(struct cap
28959 mp->outbytes -= len;
28960 spin_unlock_bh(&mp->outlock);
28961
28962 - datahandle = atomic_inc_return(&mp->datahandle);
28963 + datahandle = atomic_inc_return_unchecked(&mp->datahandle);
28964 skb_push(skb, CAPI_DATA_B3_REQ_LEN);
28965 memset(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
28966 capimsg_setu16(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
28967 capimsg_setu16(skb->data, 2, mp->ap->applid);
28968 capimsg_setu8 (skb->data, 4, CAPI_DATA_B3);
28969 capimsg_setu8 (skb->data, 5, CAPI_REQ);
28970 - capimsg_setu16(skb->data, 6, atomic_inc_return(&mp->msgid));
28971 + capimsg_setu16(skb->data, 6, atomic_inc_return_unchecked(&mp->msgid));
28972 capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */
28973 capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */
28974 capimsg_setu16(skb->data, 16, len); /* Data length */
28975 diff -urNp linux-3.0.9/drivers/isdn/gigaset/common.c linux-3.0.9/drivers/isdn/gigaset/common.c
28976 --- linux-3.0.9/drivers/isdn/gigaset/common.c 2011-11-11 13:12:24.000000000 -0500
28977 +++ linux-3.0.9/drivers/isdn/gigaset/common.c 2011-11-15 20:02:59.000000000 -0500
28978 @@ -723,7 +723,7 @@ struct cardstate *gigaset_initcs(struct
28979 cs->commands_pending = 0;
28980 cs->cur_at_seq = 0;
28981 cs->gotfwver = -1;
28982 - cs->open_count = 0;
28983 + local_set(&cs->open_count, 0);
28984 cs->dev = NULL;
28985 cs->tty = NULL;
28986 cs->tty_dev = NULL;
28987 diff -urNp linux-3.0.9/drivers/isdn/gigaset/gigaset.h linux-3.0.9/drivers/isdn/gigaset/gigaset.h
28988 --- linux-3.0.9/drivers/isdn/gigaset/gigaset.h 2011-11-11 13:12:24.000000000 -0500
28989 +++ linux-3.0.9/drivers/isdn/gigaset/gigaset.h 2011-11-15 20:02:59.000000000 -0500
28990 @@ -35,6 +35,7 @@
28991 #include <linux/tty_driver.h>
28992 #include <linux/list.h>
28993 #include <asm/atomic.h>
28994 +#include <asm/local.h>
28995
28996 #define GIG_VERSION {0, 5, 0, 0}
28997 #define GIG_COMPAT {0, 4, 0, 0}
28998 @@ -433,7 +434,7 @@ struct cardstate {
28999 spinlock_t cmdlock;
29000 unsigned curlen, cmdbytes;
29001
29002 - unsigned open_count;
29003 + local_t open_count;
29004 struct tty_struct *tty;
29005 struct tasklet_struct if_wake_tasklet;
29006 unsigned control_state;
29007 diff -urNp linux-3.0.9/drivers/isdn/gigaset/interface.c linux-3.0.9/drivers/isdn/gigaset/interface.c
29008 --- linux-3.0.9/drivers/isdn/gigaset/interface.c 2011-11-11 13:12:24.000000000 -0500
29009 +++ linux-3.0.9/drivers/isdn/gigaset/interface.c 2011-11-15 20:02:59.000000000 -0500
29010 @@ -162,9 +162,7 @@ static int if_open(struct tty_struct *tt
29011 }
29012 tty->driver_data = cs;
29013
29014 - ++cs->open_count;
29015 -
29016 - if (cs->open_count == 1) {
29017 + if (local_inc_return(&cs->open_count) == 1) {
29018 spin_lock_irqsave(&cs->lock, flags);
29019 cs->tty = tty;
29020 spin_unlock_irqrestore(&cs->lock, flags);
29021 @@ -192,10 +190,10 @@ static void if_close(struct tty_struct *
29022
29023 if (!cs->connected)
29024 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
29025 - else if (!cs->open_count)
29026 + else if (!local_read(&cs->open_count))
29027 dev_warn(cs->dev, "%s: device not opened\n", __func__);
29028 else {
29029 - if (!--cs->open_count) {
29030 + if (!local_dec_return(&cs->open_count)) {
29031 spin_lock_irqsave(&cs->lock, flags);
29032 cs->tty = NULL;
29033 spin_unlock_irqrestore(&cs->lock, flags);
29034 @@ -230,7 +228,7 @@ static int if_ioctl(struct tty_struct *t
29035 if (!cs->connected) {
29036 gig_dbg(DEBUG_IF, "not connected");
29037 retval = -ENODEV;
29038 - } else if (!cs->open_count)
29039 + } else if (!local_read(&cs->open_count))
29040 dev_warn(cs->dev, "%s: device not opened\n", __func__);
29041 else {
29042 retval = 0;
29043 @@ -360,7 +358,7 @@ static int if_write(struct tty_struct *t
29044 retval = -ENODEV;
29045 goto done;
29046 }
29047 - if (!cs->open_count) {
29048 + if (!local_read(&cs->open_count)) {
29049 dev_warn(cs->dev, "%s: device not opened\n", __func__);
29050 retval = -ENODEV;
29051 goto done;
29052 @@ -413,7 +411,7 @@ static int if_write_room(struct tty_stru
29053 if (!cs->connected) {
29054 gig_dbg(DEBUG_IF, "not connected");
29055 retval = -ENODEV;
29056 - } else if (!cs->open_count)
29057 + } else if (!local_read(&cs->open_count))
29058 dev_warn(cs->dev, "%s: device not opened\n", __func__);
29059 else if (cs->mstate != MS_LOCKED) {
29060 dev_warn(cs->dev, "can't write to unlocked device\n");
29061 @@ -443,7 +441,7 @@ static int if_chars_in_buffer(struct tty
29062
29063 if (!cs->connected)
29064 gig_dbg(DEBUG_IF, "not connected");
29065 - else if (!cs->open_count)
29066 + else if (!local_read(&cs->open_count))
29067 dev_warn(cs->dev, "%s: device not opened\n", __func__);
29068 else if (cs->mstate != MS_LOCKED)
29069 dev_warn(cs->dev, "can't write to unlocked device\n");
29070 @@ -471,7 +469,7 @@ static void if_throttle(struct tty_struc
29071
29072 if (!cs->connected)
29073 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
29074 - else if (!cs->open_count)
29075 + else if (!local_read(&cs->open_count))
29076 dev_warn(cs->dev, "%s: device not opened\n", __func__);
29077 else
29078 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
29079 @@ -495,7 +493,7 @@ static void if_unthrottle(struct tty_str
29080
29081 if (!cs->connected)
29082 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
29083 - else if (!cs->open_count)
29084 + else if (!local_read(&cs->open_count))
29085 dev_warn(cs->dev, "%s: device not opened\n", __func__);
29086 else
29087 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
29088 @@ -526,7 +524,7 @@ static void if_set_termios(struct tty_st
29089 goto out;
29090 }
29091
29092 - if (!cs->open_count) {
29093 + if (!local_read(&cs->open_count)) {
29094 dev_warn(cs->dev, "%s: device not opened\n", __func__);
29095 goto out;
29096 }
29097 diff -urNp linux-3.0.9/drivers/isdn/hardware/avm/b1.c linux-3.0.9/drivers/isdn/hardware/avm/b1.c
29098 --- linux-3.0.9/drivers/isdn/hardware/avm/b1.c 2011-11-11 13:12:24.000000000 -0500
29099 +++ linux-3.0.9/drivers/isdn/hardware/avm/b1.c 2011-11-15 20:02:59.000000000 -0500
29100 @@ -176,7 +176,7 @@ int b1_load_t4file(avmcard *card, capilo
29101 }
29102 if (left) {
29103 if (t4file->user) {
29104 - if (copy_from_user(buf, dp, left))
29105 + if (left > sizeof buf || copy_from_user(buf, dp, left))
29106 return -EFAULT;
29107 } else {
29108 memcpy(buf, dp, left);
29109 @@ -224,7 +224,7 @@ int b1_load_config(avmcard *card, capilo
29110 }
29111 if (left) {
29112 if (config->user) {
29113 - if (copy_from_user(buf, dp, left))
29114 + if (left > sizeof buf || copy_from_user(buf, dp, left))
29115 return -EFAULT;
29116 } else {
29117 memcpy(buf, dp, left);
29118 diff -urNp linux-3.0.9/drivers/isdn/hardware/eicon/capidtmf.c linux-3.0.9/drivers/isdn/hardware/eicon/capidtmf.c
29119 --- linux-3.0.9/drivers/isdn/hardware/eicon/capidtmf.c 2011-11-11 13:12:24.000000000 -0500
29120 +++ linux-3.0.9/drivers/isdn/hardware/eicon/capidtmf.c 2011-11-15 20:02:59.000000000 -0500
29121 @@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_sta
29122 byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
29123 short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
29124
29125 + pax_track_stack();
29126
29127 if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
29128 {
29129 diff -urNp linux-3.0.9/drivers/isdn/hardware/eicon/capifunc.c linux-3.0.9/drivers/isdn/hardware/eicon/capifunc.c
29130 --- linux-3.0.9/drivers/isdn/hardware/eicon/capifunc.c 2011-11-11 13:12:24.000000000 -0500
29131 +++ linux-3.0.9/drivers/isdn/hardware/eicon/capifunc.c 2011-11-15 20:02:59.000000000 -0500
29132 @@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
29133 IDI_SYNC_REQ req;
29134 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
29135
29136 + pax_track_stack();
29137 +
29138 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
29139
29140 for (x = 0; x < MAX_DESCRIPTORS; x++) {
29141 diff -urNp linux-3.0.9/drivers/isdn/hardware/eicon/diddfunc.c linux-3.0.9/drivers/isdn/hardware/eicon/diddfunc.c
29142 --- linux-3.0.9/drivers/isdn/hardware/eicon/diddfunc.c 2011-11-11 13:12:24.000000000 -0500
29143 +++ linux-3.0.9/drivers/isdn/hardware/eicon/diddfunc.c 2011-11-15 20:02:59.000000000 -0500
29144 @@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_di
29145 IDI_SYNC_REQ req;
29146 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
29147
29148 + pax_track_stack();
29149 +
29150 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
29151
29152 for (x = 0; x < MAX_DESCRIPTORS; x++) {
29153 diff -urNp linux-3.0.9/drivers/isdn/hardware/eicon/divasfunc.c linux-3.0.9/drivers/isdn/hardware/eicon/divasfunc.c
29154 --- linux-3.0.9/drivers/isdn/hardware/eicon/divasfunc.c 2011-11-11 13:12:24.000000000 -0500
29155 +++ linux-3.0.9/drivers/isdn/hardware/eicon/divasfunc.c 2011-11-15 20:02:59.000000000 -0500
29156 @@ -160,6 +160,8 @@ static int DIVA_INIT_FUNCTION connect_di
29157 IDI_SYNC_REQ req;
29158 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
29159
29160 + pax_track_stack();
29161 +
29162 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
29163
29164 for (x = 0; x < MAX_DESCRIPTORS; x++) {
29165 diff -urNp linux-3.0.9/drivers/isdn/hardware/eicon/divasync.h linux-3.0.9/drivers/isdn/hardware/eicon/divasync.h
29166 --- linux-3.0.9/drivers/isdn/hardware/eicon/divasync.h 2011-11-11 13:12:24.000000000 -0500
29167 +++ linux-3.0.9/drivers/isdn/hardware/eicon/divasync.h 2011-11-15 20:02:59.000000000 -0500
29168 @@ -146,7 +146,7 @@ typedef struct _diva_didd_add_adapter {
29169 } diva_didd_add_adapter_t;
29170 typedef struct _diva_didd_remove_adapter {
29171 IDI_CALL p_request;
29172 -} diva_didd_remove_adapter_t;
29173 +} __no_const diva_didd_remove_adapter_t;
29174 typedef struct _diva_didd_read_adapter_array {
29175 void * buffer;
29176 dword length;
29177 diff -urNp linux-3.0.9/drivers/isdn/hardware/eicon/idifunc.c linux-3.0.9/drivers/isdn/hardware/eicon/idifunc.c
29178 --- linux-3.0.9/drivers/isdn/hardware/eicon/idifunc.c 2011-11-11 13:12:24.000000000 -0500
29179 +++ linux-3.0.9/drivers/isdn/hardware/eicon/idifunc.c 2011-11-15 20:02:59.000000000 -0500
29180 @@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_di
29181 IDI_SYNC_REQ req;
29182 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
29183
29184 + pax_track_stack();
29185 +
29186 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
29187
29188 for (x = 0; x < MAX_DESCRIPTORS; x++) {
29189 diff -urNp linux-3.0.9/drivers/isdn/hardware/eicon/message.c linux-3.0.9/drivers/isdn/hardware/eicon/message.c
29190 --- linux-3.0.9/drivers/isdn/hardware/eicon/message.c 2011-11-11 13:12:24.000000000 -0500
29191 +++ linux-3.0.9/drivers/isdn/hardware/eicon/message.c 2011-11-15 20:02:59.000000000 -0500
29192 @@ -4886,6 +4886,8 @@ static void sig_ind(PLCI *plci)
29193 dword d;
29194 word w;
29195
29196 + pax_track_stack();
29197 +
29198 a = plci->adapter;
29199 Id = ((word)plci->Id<<8)|a->Id;
29200 PUT_WORD(&SS_Ind[4],0x0000);
29201 @@ -7480,6 +7482,8 @@ static word add_b1(PLCI *plci, API_PARSE
29202 word j, n, w;
29203 dword d;
29204
29205 + pax_track_stack();
29206 +
29207
29208 for(i=0;i<8;i++) bp_parms[i].length = 0;
29209 for(i=0;i<2;i++) global_config[i].length = 0;
29210 @@ -7954,6 +7958,8 @@ static word add_b23(PLCI *plci, API_PARS
29211 const byte llc3[] = {4,3,2,2,6,6,0};
29212 const byte header[] = {0,2,3,3,0,0,0};
29213
29214 + pax_track_stack();
29215 +
29216 for(i=0;i<8;i++) bp_parms[i].length = 0;
29217 for(i=0;i<6;i++) b2_config_parms[i].length = 0;
29218 for(i=0;i<5;i++) b3_config_parms[i].length = 0;
29219 @@ -14741,6 +14747,8 @@ static void group_optimization(DIVA_CAPI
29220 word appl_number_group_type[MAX_APPL];
29221 PLCI *auxplci;
29222
29223 + pax_track_stack();
29224 +
29225 set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
29226
29227 if(!a->group_optimization_enabled)
29228 diff -urNp linux-3.0.9/drivers/isdn/hardware/eicon/mntfunc.c linux-3.0.9/drivers/isdn/hardware/eicon/mntfunc.c
29229 --- linux-3.0.9/drivers/isdn/hardware/eicon/mntfunc.c 2011-11-11 13:12:24.000000000 -0500
29230 +++ linux-3.0.9/drivers/isdn/hardware/eicon/mntfunc.c 2011-11-15 20:02:59.000000000 -0500
29231 @@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_di
29232 IDI_SYNC_REQ req;
29233 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
29234
29235 + pax_track_stack();
29236 +
29237 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
29238
29239 for (x = 0; x < MAX_DESCRIPTORS; x++) {
29240 diff -urNp linux-3.0.9/drivers/isdn/hardware/eicon/xdi_adapter.h linux-3.0.9/drivers/isdn/hardware/eicon/xdi_adapter.h
29241 --- linux-3.0.9/drivers/isdn/hardware/eicon/xdi_adapter.h 2011-11-11 13:12:24.000000000 -0500
29242 +++ linux-3.0.9/drivers/isdn/hardware/eicon/xdi_adapter.h 2011-11-15 20:02:59.000000000 -0500
29243 @@ -44,7 +44,7 @@ typedef struct _xdi_mbox_t {
29244 typedef struct _diva_os_idi_adapter_interface {
29245 diva_init_card_proc_t cleanup_adapter_proc;
29246 diva_cmd_card_proc_t cmd_proc;
29247 -} diva_os_idi_adapter_interface_t;
29248 +} __no_const diva_os_idi_adapter_interface_t;
29249
29250 typedef struct _diva_os_xdi_adapter {
29251 struct list_head link;
29252 diff -urNp linux-3.0.9/drivers/isdn/i4l/isdn_common.c linux-3.0.9/drivers/isdn/i4l/isdn_common.c
29253 --- linux-3.0.9/drivers/isdn/i4l/isdn_common.c 2011-11-11 13:12:24.000000000 -0500
29254 +++ linux-3.0.9/drivers/isdn/i4l/isdn_common.c 2011-11-15 20:02:59.000000000 -0500
29255 @@ -1286,6 +1286,8 @@ isdn_ioctl(struct file *file, uint cmd,
29256 } iocpar;
29257 void __user *argp = (void __user *)arg;
29258
29259 + pax_track_stack();
29260 +
29261 #define name iocpar.name
29262 #define bname iocpar.bname
29263 #define iocts iocpar.iocts
29264 diff -urNp linux-3.0.9/drivers/isdn/icn/icn.c linux-3.0.9/drivers/isdn/icn/icn.c
29265 --- linux-3.0.9/drivers/isdn/icn/icn.c 2011-11-11 13:12:24.000000000 -0500
29266 +++ linux-3.0.9/drivers/isdn/icn/icn.c 2011-11-15 20:02:59.000000000 -0500
29267 @@ -1045,7 +1045,7 @@ icn_writecmd(const u_char * buf, int len
29268 if (count > len)
29269 count = len;
29270 if (user) {
29271 - if (copy_from_user(msg, buf, count))
29272 + if (count > sizeof msg || copy_from_user(msg, buf, count))
29273 return -EFAULT;
29274 } else
29275 memcpy(msg, buf, count);
29276 diff -urNp linux-3.0.9/drivers/lguest/core.c linux-3.0.9/drivers/lguest/core.c
29277 --- linux-3.0.9/drivers/lguest/core.c 2011-11-11 13:12:24.000000000 -0500
29278 +++ linux-3.0.9/drivers/lguest/core.c 2011-11-15 20:02:59.000000000 -0500
29279 @@ -92,9 +92,17 @@ static __init int map_switcher(void)
29280 * it's worked so far. The end address needs +1 because __get_vm_area
29281 * allocates an extra guard page, so we need space for that.
29282 */
29283 +
29284 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
29285 + switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
29286 + VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
29287 + + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
29288 +#else
29289 switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
29290 VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
29291 + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
29292 +#endif
29293 +
29294 if (!switcher_vma) {
29295 err = -ENOMEM;
29296 printk("lguest: could not map switcher pages high\n");
29297 @@ -119,7 +127,7 @@ static __init int map_switcher(void)
29298 * Now the Switcher is mapped at the right address, we can't fail!
29299 * Copy in the compiled-in Switcher code (from <arch>_switcher.S).
29300 */
29301 - memcpy(switcher_vma->addr, start_switcher_text,
29302 + memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
29303 end_switcher_text - start_switcher_text);
29304
29305 printk(KERN_INFO "lguest: mapped switcher at %p\n",
29306 diff -urNp linux-3.0.9/drivers/lguest/x86/core.c linux-3.0.9/drivers/lguest/x86/core.c
29307 --- linux-3.0.9/drivers/lguest/x86/core.c 2011-11-11 13:12:24.000000000 -0500
29308 +++ linux-3.0.9/drivers/lguest/x86/core.c 2011-11-15 20:02:59.000000000 -0500
29309 @@ -59,7 +59,7 @@ static struct {
29310 /* Offset from where switcher.S was compiled to where we've copied it */
29311 static unsigned long switcher_offset(void)
29312 {
29313 - return SWITCHER_ADDR - (unsigned long)start_switcher_text;
29314 + return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
29315 }
29316
29317 /* This cpu's struct lguest_pages. */
29318 @@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg
29319 * These copies are pretty cheap, so we do them unconditionally: */
29320 /* Save the current Host top-level page directory.
29321 */
29322 +
29323 +#ifdef CONFIG_PAX_PER_CPU_PGD
29324 + pages->state.host_cr3 = read_cr3();
29325 +#else
29326 pages->state.host_cr3 = __pa(current->mm->pgd);
29327 +#endif
29328 +
29329 /*
29330 * Set up the Guest's page tables to see this CPU's pages (and no
29331 * other CPU's pages).
29332 @@ -547,7 +553,7 @@ void __init lguest_arch_host_init(void)
29333 * compiled-in switcher code and the high-mapped copy we just made.
29334 */
29335 for (i = 0; i < IDT_ENTRIES; i++)
29336 - default_idt_entries[i] += switcher_offset();
29337 + default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
29338
29339 /*
29340 * Set up the Switcher's per-cpu areas.
29341 @@ -630,7 +636,7 @@ void __init lguest_arch_host_init(void)
29342 * it will be undisturbed when we switch. To change %cs and jump we
29343 * need this structure to feed to Intel's "lcall" instruction.
29344 */
29345 - lguest_entry.offset = (long)switch_to_guest + switcher_offset();
29346 + lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
29347 lguest_entry.segment = LGUEST_CS;
29348
29349 /*
29350 diff -urNp linux-3.0.9/drivers/lguest/x86/switcher_32.S linux-3.0.9/drivers/lguest/x86/switcher_32.S
29351 --- linux-3.0.9/drivers/lguest/x86/switcher_32.S 2011-11-11 13:12:24.000000000 -0500
29352 +++ linux-3.0.9/drivers/lguest/x86/switcher_32.S 2011-11-15 20:02:59.000000000 -0500
29353 @@ -87,6 +87,7 @@
29354 #include <asm/page.h>
29355 #include <asm/segment.h>
29356 #include <asm/lguest.h>
29357 +#include <asm/processor-flags.h>
29358
29359 // We mark the start of the code to copy
29360 // It's placed in .text tho it's never run here
29361 @@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
29362 // Changes type when we load it: damn Intel!
29363 // For after we switch over our page tables
29364 // That entry will be read-only: we'd crash.
29365 +
29366 +#ifdef CONFIG_PAX_KERNEXEC
29367 + mov %cr0, %edx
29368 + xor $X86_CR0_WP, %edx
29369 + mov %edx, %cr0
29370 +#endif
29371 +
29372 movl $(GDT_ENTRY_TSS*8), %edx
29373 ltr %dx
29374
29375 @@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
29376 // Let's clear it again for our return.
29377 // The GDT descriptor of the Host
29378 // Points to the table after two "size" bytes
29379 - movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
29380 + movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
29381 // Clear "used" from type field (byte 5, bit 2)
29382 - andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
29383 + andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
29384 +
29385 +#ifdef CONFIG_PAX_KERNEXEC
29386 + mov %cr0, %eax
29387 + xor $X86_CR0_WP, %eax
29388 + mov %eax, %cr0
29389 +#endif
29390
29391 // Once our page table's switched, the Guest is live!
29392 // The Host fades as we run this final step.
29393 @@ -295,13 +309,12 @@ deliver_to_host:
29394 // I consulted gcc, and it gave
29395 // These instructions, which I gladly credit:
29396 leal (%edx,%ebx,8), %eax
29397 - movzwl (%eax),%edx
29398 - movl 4(%eax), %eax
29399 - xorw %ax, %ax
29400 - orl %eax, %edx
29401 + movl 4(%eax), %edx
29402 + movw (%eax), %dx
29403 // Now the address of the handler's in %edx
29404 // We call it now: its "iret" drops us home.
29405 - jmp *%edx
29406 + ljmp $__KERNEL_CS, $1f
29407 +1: jmp *%edx
29408
29409 // Every interrupt can come to us here
29410 // But we must truly tell each apart.
29411 diff -urNp linux-3.0.9/drivers/macintosh/macio_asic.c linux-3.0.9/drivers/macintosh/macio_asic.c
29412 --- linux-3.0.9/drivers/macintosh/macio_asic.c 2011-11-11 13:12:24.000000000 -0500
29413 +++ linux-3.0.9/drivers/macintosh/macio_asic.c 2011-11-15 20:02:59.000000000 -0500
29414 @@ -748,7 +748,7 @@ static void __devexit macio_pci_remove(s
29415 * MacIO is matched against any Apple ID, it's probe() function
29416 * will then decide wether it applies or not
29417 */
29418 -static const struct pci_device_id __devinitdata pci_ids [] = { {
29419 +static const struct pci_device_id __devinitconst pci_ids [] = { {
29420 .vendor = PCI_VENDOR_ID_APPLE,
29421 .device = PCI_ANY_ID,
29422 .subvendor = PCI_ANY_ID,
29423 diff -urNp linux-3.0.9/drivers/md/dm.c linux-3.0.9/drivers/md/dm.c
29424 --- linux-3.0.9/drivers/md/dm.c 2011-11-11 13:12:24.000000000 -0500
29425 +++ linux-3.0.9/drivers/md/dm.c 2011-11-15 20:02:59.000000000 -0500
29426 @@ -164,9 +164,9 @@ struct mapped_device {
29427 /*
29428 * Event handling.
29429 */
29430 - atomic_t event_nr;
29431 + atomic_unchecked_t event_nr;
29432 wait_queue_head_t eventq;
29433 - atomic_t uevent_seq;
29434 + atomic_unchecked_t uevent_seq;
29435 struct list_head uevent_list;
29436 spinlock_t uevent_lock; /* Protect access to uevent_list */
29437
29438 @@ -1842,8 +1842,8 @@ static struct mapped_device *alloc_dev(i
29439 rwlock_init(&md->map_lock);
29440 atomic_set(&md->holders, 1);
29441 atomic_set(&md->open_count, 0);
29442 - atomic_set(&md->event_nr, 0);
29443 - atomic_set(&md->uevent_seq, 0);
29444 + atomic_set_unchecked(&md->event_nr, 0);
29445 + atomic_set_unchecked(&md->uevent_seq, 0);
29446 INIT_LIST_HEAD(&md->uevent_list);
29447 spin_lock_init(&md->uevent_lock);
29448
29449 @@ -1977,7 +1977,7 @@ static void event_callback(void *context
29450
29451 dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
29452
29453 - atomic_inc(&md->event_nr);
29454 + atomic_inc_unchecked(&md->event_nr);
29455 wake_up(&md->eventq);
29456 }
29457
29458 @@ -2553,18 +2553,18 @@ int dm_kobject_uevent(struct mapped_devi
29459
29460 uint32_t dm_next_uevent_seq(struct mapped_device *md)
29461 {
29462 - return atomic_add_return(1, &md->uevent_seq);
29463 + return atomic_add_return_unchecked(1, &md->uevent_seq);
29464 }
29465
29466 uint32_t dm_get_event_nr(struct mapped_device *md)
29467 {
29468 - return atomic_read(&md->event_nr);
29469 + return atomic_read_unchecked(&md->event_nr);
29470 }
29471
29472 int dm_wait_event(struct mapped_device *md, int event_nr)
29473 {
29474 return wait_event_interruptible(md->eventq,
29475 - (event_nr != atomic_read(&md->event_nr)));
29476 + (event_nr != atomic_read_unchecked(&md->event_nr)));
29477 }
29478
29479 void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
29480 diff -urNp linux-3.0.9/drivers/md/dm-ioctl.c linux-3.0.9/drivers/md/dm-ioctl.c
29481 --- linux-3.0.9/drivers/md/dm-ioctl.c 2011-11-11 13:12:24.000000000 -0500
29482 +++ linux-3.0.9/drivers/md/dm-ioctl.c 2011-11-15 20:02:59.000000000 -0500
29483 @@ -1551,7 +1551,7 @@ static int validate_params(uint cmd, str
29484 cmd == DM_LIST_VERSIONS_CMD)
29485 return 0;
29486
29487 - if ((cmd == DM_DEV_CREATE_CMD)) {
29488 + if (cmd == DM_DEV_CREATE_CMD) {
29489 if (!*param->name) {
29490 DMWARN("name not supplied when creating device");
29491 return -EINVAL;
29492 diff -urNp linux-3.0.9/drivers/md/dm-raid1.c linux-3.0.9/drivers/md/dm-raid1.c
29493 --- linux-3.0.9/drivers/md/dm-raid1.c 2011-11-11 13:12:24.000000000 -0500
29494 +++ linux-3.0.9/drivers/md/dm-raid1.c 2011-11-15 20:02:59.000000000 -0500
29495 @@ -40,7 +40,7 @@ enum dm_raid1_error {
29496
29497 struct mirror {
29498 struct mirror_set *ms;
29499 - atomic_t error_count;
29500 + atomic_unchecked_t error_count;
29501 unsigned long error_type;
29502 struct dm_dev *dev;
29503 sector_t offset;
29504 @@ -185,7 +185,7 @@ static struct mirror *get_valid_mirror(s
29505 struct mirror *m;
29506
29507 for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++)
29508 - if (!atomic_read(&m->error_count))
29509 + if (!atomic_read_unchecked(&m->error_count))
29510 return m;
29511
29512 return NULL;
29513 @@ -217,7 +217,7 @@ static void fail_mirror(struct mirror *m
29514 * simple way to tell if a device has encountered
29515 * errors.
29516 */
29517 - atomic_inc(&m->error_count);
29518 + atomic_inc_unchecked(&m->error_count);
29519
29520 if (test_and_set_bit(error_type, &m->error_type))
29521 return;
29522 @@ -408,7 +408,7 @@ static struct mirror *choose_mirror(stru
29523 struct mirror *m = get_default_mirror(ms);
29524
29525 do {
29526 - if (likely(!atomic_read(&m->error_count)))
29527 + if (likely(!atomic_read_unchecked(&m->error_count)))
29528 return m;
29529
29530 if (m-- == ms->mirror)
29531 @@ -422,7 +422,7 @@ static int default_ok(struct mirror *m)
29532 {
29533 struct mirror *default_mirror = get_default_mirror(m->ms);
29534
29535 - return !atomic_read(&default_mirror->error_count);
29536 + return !atomic_read_unchecked(&default_mirror->error_count);
29537 }
29538
29539 static int mirror_available(struct mirror_set *ms, struct bio *bio)
29540 @@ -559,7 +559,7 @@ static void do_reads(struct mirror_set *
29541 */
29542 if (likely(region_in_sync(ms, region, 1)))
29543 m = choose_mirror(ms, bio->bi_sector);
29544 - else if (m && atomic_read(&m->error_count))
29545 + else if (m && atomic_read_unchecked(&m->error_count))
29546 m = NULL;
29547
29548 if (likely(m))
29549 @@ -937,7 +937,7 @@ static int get_mirror(struct mirror_set
29550 }
29551
29552 ms->mirror[mirror].ms = ms;
29553 - atomic_set(&(ms->mirror[mirror].error_count), 0);
29554 + atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
29555 ms->mirror[mirror].error_type = 0;
29556 ms->mirror[mirror].offset = offset;
29557
29558 @@ -1347,7 +1347,7 @@ static void mirror_resume(struct dm_targ
29559 */
29560 static char device_status_char(struct mirror *m)
29561 {
29562 - if (!atomic_read(&(m->error_count)))
29563 + if (!atomic_read_unchecked(&(m->error_count)))
29564 return 'A';
29565
29566 return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' :
29567 diff -urNp linux-3.0.9/drivers/md/dm-stripe.c linux-3.0.9/drivers/md/dm-stripe.c
29568 --- linux-3.0.9/drivers/md/dm-stripe.c 2011-11-11 13:12:24.000000000 -0500
29569 +++ linux-3.0.9/drivers/md/dm-stripe.c 2011-11-15 20:02:59.000000000 -0500
29570 @@ -20,7 +20,7 @@ struct stripe {
29571 struct dm_dev *dev;
29572 sector_t physical_start;
29573
29574 - atomic_t error_count;
29575 + atomic_unchecked_t error_count;
29576 };
29577
29578 struct stripe_c {
29579 @@ -192,7 +192,7 @@ static int stripe_ctr(struct dm_target *
29580 kfree(sc);
29581 return r;
29582 }
29583 - atomic_set(&(sc->stripe[i].error_count), 0);
29584 + atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
29585 }
29586
29587 ti->private = sc;
29588 @@ -314,7 +314,7 @@ static int stripe_status(struct dm_targe
29589 DMEMIT("%d ", sc->stripes);
29590 for (i = 0; i < sc->stripes; i++) {
29591 DMEMIT("%s ", sc->stripe[i].dev->name);
29592 - buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
29593 + buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
29594 'D' : 'A';
29595 }
29596 buffer[i] = '\0';
29597 @@ -361,8 +361,8 @@ static int stripe_end_io(struct dm_targe
29598 */
29599 for (i = 0; i < sc->stripes; i++)
29600 if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
29601 - atomic_inc(&(sc->stripe[i].error_count));
29602 - if (atomic_read(&(sc->stripe[i].error_count)) <
29603 + atomic_inc_unchecked(&(sc->stripe[i].error_count));
29604 + if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
29605 DM_IO_ERROR_THRESHOLD)
29606 schedule_work(&sc->trigger_event);
29607 }
29608 diff -urNp linux-3.0.9/drivers/md/dm-table.c linux-3.0.9/drivers/md/dm-table.c
29609 --- linux-3.0.9/drivers/md/dm-table.c 2011-11-11 13:12:24.000000000 -0500
29610 +++ linux-3.0.9/drivers/md/dm-table.c 2011-11-15 20:02:59.000000000 -0500
29611 @@ -390,7 +390,7 @@ static int device_area_is_invalid(struct
29612 if (!dev_size)
29613 return 0;
29614
29615 - if ((start >= dev_size) || (start + len > dev_size)) {
29616 + if ((start >= dev_size) || (len > dev_size - start)) {
29617 DMWARN("%s: %s too small for target: "
29618 "start=%llu, len=%llu, dev_size=%llu",
29619 dm_device_name(ti->table->md), bdevname(bdev, b),
29620 diff -urNp linux-3.0.9/drivers/md/md.c linux-3.0.9/drivers/md/md.c
29621 --- linux-3.0.9/drivers/md/md.c 2011-11-11 13:12:24.000000000 -0500
29622 +++ linux-3.0.9/drivers/md/md.c 2011-11-15 20:02:59.000000000 -0500
29623 @@ -231,10 +231,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev);
29624 * start build, activate spare
29625 */
29626 static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
29627 -static atomic_t md_event_count;
29628 +static atomic_unchecked_t md_event_count;
29629 void md_new_event(mddev_t *mddev)
29630 {
29631 - atomic_inc(&md_event_count);
29632 + atomic_inc_unchecked(&md_event_count);
29633 wake_up(&md_event_waiters);
29634 }
29635 EXPORT_SYMBOL_GPL(md_new_event);
29636 @@ -244,7 +244,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
29637 */
29638 static void md_new_event_inintr(mddev_t *mddev)
29639 {
29640 - atomic_inc(&md_event_count);
29641 + atomic_inc_unchecked(&md_event_count);
29642 wake_up(&md_event_waiters);
29643 }
29644
29645 @@ -1475,7 +1475,7 @@ static int super_1_load(mdk_rdev_t *rdev
29646
29647 rdev->preferred_minor = 0xffff;
29648 rdev->data_offset = le64_to_cpu(sb->data_offset);
29649 - atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
29650 + atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
29651
29652 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
29653 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
29654 @@ -1653,7 +1653,7 @@ static void super_1_sync(mddev_t *mddev,
29655 else
29656 sb->resync_offset = cpu_to_le64(0);
29657
29658 - sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
29659 + sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
29660
29661 sb->raid_disks = cpu_to_le32(mddev->raid_disks);
29662 sb->size = cpu_to_le64(mddev->dev_sectors);
29663 @@ -2446,7 +2446,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_sho
29664 static ssize_t
29665 errors_show(mdk_rdev_t *rdev, char *page)
29666 {
29667 - return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
29668 + return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
29669 }
29670
29671 static ssize_t
29672 @@ -2455,7 +2455,7 @@ errors_store(mdk_rdev_t *rdev, const cha
29673 char *e;
29674 unsigned long n = simple_strtoul(buf, &e, 10);
29675 if (*buf && (*e == 0 || *e == '\n')) {
29676 - atomic_set(&rdev->corrected_errors, n);
29677 + atomic_set_unchecked(&rdev->corrected_errors, n);
29678 return len;
29679 }
29680 return -EINVAL;
29681 @@ -2811,8 +2811,8 @@ void md_rdev_init(mdk_rdev_t *rdev)
29682 rdev->last_read_error.tv_sec = 0;
29683 rdev->last_read_error.tv_nsec = 0;
29684 atomic_set(&rdev->nr_pending, 0);
29685 - atomic_set(&rdev->read_errors, 0);
29686 - atomic_set(&rdev->corrected_errors, 0);
29687 + atomic_set_unchecked(&rdev->read_errors, 0);
29688 + atomic_set_unchecked(&rdev->corrected_errors, 0);
29689
29690 INIT_LIST_HEAD(&rdev->same_set);
29691 init_waitqueue_head(&rdev->blocked_wait);
29692 @@ -6440,7 +6440,7 @@ static int md_seq_show(struct seq_file *
29693
29694 spin_unlock(&pers_lock);
29695 seq_printf(seq, "\n");
29696 - mi->event = atomic_read(&md_event_count);
29697 + mi->event = atomic_read_unchecked(&md_event_count);
29698 return 0;
29699 }
29700 if (v == (void*)2) {
29701 @@ -6529,7 +6529,7 @@ static int md_seq_show(struct seq_file *
29702 chunk_kb ? "KB" : "B");
29703 if (bitmap->file) {
29704 seq_printf(seq, ", file: ");
29705 - seq_path(seq, &bitmap->file->f_path, " \t\n");
29706 + seq_path(seq, &bitmap->file->f_path, " \t\n\\");
29707 }
29708
29709 seq_printf(seq, "\n");
29710 @@ -6563,7 +6563,7 @@ static int md_seq_open(struct inode *ino
29711 else {
29712 struct seq_file *p = file->private_data;
29713 p->private = mi;
29714 - mi->event = atomic_read(&md_event_count);
29715 + mi->event = atomic_read_unchecked(&md_event_count);
29716 }
29717 return error;
29718 }
29719 @@ -6579,7 +6579,7 @@ static unsigned int mdstat_poll(struct f
29720 /* always allow read */
29721 mask = POLLIN | POLLRDNORM;
29722
29723 - if (mi->event != atomic_read(&md_event_count))
29724 + if (mi->event != atomic_read_unchecked(&md_event_count))
29725 mask |= POLLERR | POLLPRI;
29726 return mask;
29727 }
29728 @@ -6623,7 +6623,7 @@ static int is_mddev_idle(mddev_t *mddev,
29729 struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
29730 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
29731 (int)part_stat_read(&disk->part0, sectors[1]) -
29732 - atomic_read(&disk->sync_io);
29733 + atomic_read_unchecked(&disk->sync_io);
29734 /* sync IO will cause sync_io to increase before the disk_stats
29735 * as sync_io is counted when a request starts, and
29736 * disk_stats is counted when it completes.
29737 diff -urNp linux-3.0.9/drivers/md/md.h linux-3.0.9/drivers/md/md.h
29738 --- linux-3.0.9/drivers/md/md.h 2011-11-11 13:12:24.000000000 -0500
29739 +++ linux-3.0.9/drivers/md/md.h 2011-11-15 20:02:59.000000000 -0500
29740 @@ -97,13 +97,13 @@ struct mdk_rdev_s
29741 * only maintained for arrays that
29742 * support hot removal
29743 */
29744 - atomic_t read_errors; /* number of consecutive read errors that
29745 + atomic_unchecked_t read_errors; /* number of consecutive read errors that
29746 * we have tried to ignore.
29747 */
29748 struct timespec last_read_error; /* monotonic time since our
29749 * last read error
29750 */
29751 - atomic_t corrected_errors; /* number of corrected read errors,
29752 + atomic_unchecked_t corrected_errors; /* number of corrected read errors,
29753 * for reporting to userspace and storing
29754 * in superblock.
29755 */
29756 @@ -344,7 +344,7 @@ static inline void rdev_dec_pending(mdk_
29757
29758 static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
29759 {
29760 - atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
29761 + atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
29762 }
29763
29764 struct mdk_personality
29765 diff -urNp linux-3.0.9/drivers/md/raid10.c linux-3.0.9/drivers/md/raid10.c
29766 --- linux-3.0.9/drivers/md/raid10.c 2011-11-11 13:12:24.000000000 -0500
29767 +++ linux-3.0.9/drivers/md/raid10.c 2011-11-15 20:02:59.000000000 -0500
29768 @@ -1186,7 +1186,7 @@ static void end_sync_read(struct bio *bi
29769 if (test_bit(BIO_UPTODATE, &bio->bi_flags))
29770 set_bit(R10BIO_Uptodate, &r10_bio->state);
29771 else {
29772 - atomic_add(r10_bio->sectors,
29773 + atomic_add_unchecked(r10_bio->sectors,
29774 &conf->mirrors[d].rdev->corrected_errors);
29775 if (!test_bit(MD_RECOVERY_SYNC, &conf->mddev->recovery))
29776 md_error(r10_bio->mddev,
29777 @@ -1394,7 +1394,7 @@ static void check_decay_read_errors(mdde
29778 {
29779 struct timespec cur_time_mon;
29780 unsigned long hours_since_last;
29781 - unsigned int read_errors = atomic_read(&rdev->read_errors);
29782 + unsigned int read_errors = atomic_read_unchecked(&rdev->read_errors);
29783
29784 ktime_get_ts(&cur_time_mon);
29785
29786 @@ -1416,9 +1416,9 @@ static void check_decay_read_errors(mdde
29787 * overflowing the shift of read_errors by hours_since_last.
29788 */
29789 if (hours_since_last >= 8 * sizeof(read_errors))
29790 - atomic_set(&rdev->read_errors, 0);
29791 + atomic_set_unchecked(&rdev->read_errors, 0);
29792 else
29793 - atomic_set(&rdev->read_errors, read_errors >> hours_since_last);
29794 + atomic_set_unchecked(&rdev->read_errors, read_errors >> hours_since_last);
29795 }
29796
29797 /*
29798 @@ -1448,8 +1448,8 @@ static void fix_read_error(conf_t *conf,
29799 return;
29800
29801 check_decay_read_errors(mddev, rdev);
29802 - atomic_inc(&rdev->read_errors);
29803 - if (atomic_read(&rdev->read_errors) > max_read_errors) {
29804 + atomic_inc_unchecked(&rdev->read_errors);
29805 + if (atomic_read_unchecked(&rdev->read_errors) > max_read_errors) {
29806 char b[BDEVNAME_SIZE];
29807 bdevname(rdev->bdev, b);
29808
29809 @@ -1457,7 +1457,7 @@ static void fix_read_error(conf_t *conf,
29810 "md/raid10:%s: %s: Raid device exceeded "
29811 "read_error threshold [cur %d:max %d]\n",
29812 mdname(mddev), b,
29813 - atomic_read(&rdev->read_errors), max_read_errors);
29814 + atomic_read_unchecked(&rdev->read_errors), max_read_errors);
29815 printk(KERN_NOTICE
29816 "md/raid10:%s: %s: Failing raid device\n",
29817 mdname(mddev), b);
29818 @@ -1520,7 +1520,7 @@ static void fix_read_error(conf_t *conf,
29819 test_bit(In_sync, &rdev->flags)) {
29820 atomic_inc(&rdev->nr_pending);
29821 rcu_read_unlock();
29822 - atomic_add(s, &rdev->corrected_errors);
29823 + atomic_add_unchecked(s, &rdev->corrected_errors);
29824 if (sync_page_io(rdev,
29825 r10_bio->devs[sl].addr +
29826 sect,
29827 diff -urNp linux-3.0.9/drivers/md/raid1.c linux-3.0.9/drivers/md/raid1.c
29828 --- linux-3.0.9/drivers/md/raid1.c 2011-11-11 13:12:24.000000000 -0500
29829 +++ linux-3.0.9/drivers/md/raid1.c 2011-11-15 20:02:59.000000000 -0500
29830 @@ -1263,7 +1263,7 @@ static int fix_sync_read_error(r1bio_t *
29831 rdev_dec_pending(rdev, mddev);
29832 md_error(mddev, rdev);
29833 } else
29834 - atomic_add(s, &rdev->corrected_errors);
29835 + atomic_add_unchecked(s, &rdev->corrected_errors);
29836 }
29837 d = start;
29838 while (d != r1_bio->read_disk) {
29839 @@ -1492,7 +1492,7 @@ static void fix_read_error(conf_t *conf,
29840 /* Well, this device is dead */
29841 md_error(mddev, rdev);
29842 else {
29843 - atomic_add(s, &rdev->corrected_errors);
29844 + atomic_add_unchecked(s, &rdev->corrected_errors);
29845 printk(KERN_INFO
29846 "md/raid1:%s: read error corrected "
29847 "(%d sectors at %llu on %s)\n",
29848 diff -urNp linux-3.0.9/drivers/md/raid5.c linux-3.0.9/drivers/md/raid5.c
29849 --- linux-3.0.9/drivers/md/raid5.c 2011-11-11 13:12:24.000000000 -0500
29850 +++ linux-3.0.9/drivers/md/raid5.c 2011-11-15 20:02:59.000000000 -0500
29851 @@ -550,7 +550,7 @@ static void ops_run_io(struct stripe_hea
29852 bi->bi_next = NULL;
29853 if ((rw & WRITE) &&
29854 test_bit(R5_ReWrite, &sh->dev[i].flags))
29855 - atomic_add(STRIPE_SECTORS,
29856 + atomic_add_unchecked(STRIPE_SECTORS,
29857 &rdev->corrected_errors);
29858 generic_make_request(bi);
29859 } else {
29860 @@ -1596,15 +1596,15 @@ static void raid5_end_read_request(struc
29861 clear_bit(R5_ReadError, &sh->dev[i].flags);
29862 clear_bit(R5_ReWrite, &sh->dev[i].flags);
29863 }
29864 - if (atomic_read(&conf->disks[i].rdev->read_errors))
29865 - atomic_set(&conf->disks[i].rdev->read_errors, 0);
29866 + if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
29867 + atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
29868 } else {
29869 const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
29870 int retry = 0;
29871 rdev = conf->disks[i].rdev;
29872
29873 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
29874 - atomic_inc(&rdev->read_errors);
29875 + atomic_inc_unchecked(&rdev->read_errors);
29876 if (conf->mddev->degraded >= conf->max_degraded)
29877 printk_rl(KERN_WARNING
29878 "md/raid:%s: read error not correctable "
29879 @@ -1622,7 +1622,7 @@ static void raid5_end_read_request(struc
29880 (unsigned long long)(sh->sector
29881 + rdev->data_offset),
29882 bdn);
29883 - else if (atomic_read(&rdev->read_errors)
29884 + else if (atomic_read_unchecked(&rdev->read_errors)
29885 > conf->max_nr_stripes)
29886 printk(KERN_WARNING
29887 "md/raid:%s: Too many read errors, failing device %s.\n",
29888 @@ -1945,6 +1945,7 @@ static sector_t compute_blocknr(struct s
29889 sector_t r_sector;
29890 struct stripe_head sh2;
29891
29892 + pax_track_stack();
29893
29894 chunk_offset = sector_div(new_sector, sectors_per_chunk);
29895 stripe = new_sector;
29896 diff -urNp linux-3.0.9/drivers/media/common/saa7146_hlp.c linux-3.0.9/drivers/media/common/saa7146_hlp.c
29897 --- linux-3.0.9/drivers/media/common/saa7146_hlp.c 2011-11-11 13:12:24.000000000 -0500
29898 +++ linux-3.0.9/drivers/media/common/saa7146_hlp.c 2011-11-15 20:02:59.000000000 -0500
29899 @@ -353,6 +353,8 @@ static void calculate_clipping_registers
29900
29901 int x[32], y[32], w[32], h[32];
29902
29903 + pax_track_stack();
29904 +
29905 /* clear out memory */
29906 memset(&line_list[0], 0x00, sizeof(u32)*32);
29907 memset(&pixel_list[0], 0x00, sizeof(u32)*32);
29908 diff -urNp linux-3.0.9/drivers/media/dvb/dvb-core/dvb_ca_en50221.c linux-3.0.9/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
29909 --- linux-3.0.9/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-11-11 13:12:24.000000000 -0500
29910 +++ linux-3.0.9/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-11-15 20:02:59.000000000 -0500
29911 @@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(stru
29912 u8 buf[HOST_LINK_BUF_SIZE];
29913 int i;
29914
29915 + pax_track_stack();
29916 +
29917 dprintk("%s\n", __func__);
29918
29919 /* check if we have space for a link buf in the rx_buffer */
29920 @@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(s
29921 unsigned long timeout;
29922 int written;
29923
29924 + pax_track_stack();
29925 +
29926 dprintk("%s\n", __func__);
29927
29928 /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
29929 diff -urNp linux-3.0.9/drivers/media/dvb/dvb-core/dvb_demux.h linux-3.0.9/drivers/media/dvb/dvb-core/dvb_demux.h
29930 --- linux-3.0.9/drivers/media/dvb/dvb-core/dvb_demux.h 2011-11-11 13:12:24.000000000 -0500
29931 +++ linux-3.0.9/drivers/media/dvb/dvb-core/dvb_demux.h 2011-11-15 20:02:59.000000000 -0500
29932 @@ -68,12 +68,12 @@ struct dvb_demux_feed {
29933 union {
29934 struct dmx_ts_feed ts;
29935 struct dmx_section_feed sec;
29936 - } feed;
29937 + } __no_const feed;
29938
29939 union {
29940 dmx_ts_cb ts;
29941 dmx_section_cb sec;
29942 - } cb;
29943 + } __no_const cb;
29944
29945 struct dvb_demux *demux;
29946 void *priv;
29947 diff -urNp linux-3.0.9/drivers/media/dvb/dvb-core/dvbdev.c linux-3.0.9/drivers/media/dvb/dvb-core/dvbdev.c
29948 --- linux-3.0.9/drivers/media/dvb/dvb-core/dvbdev.c 2011-11-11 13:12:24.000000000 -0500
29949 +++ linux-3.0.9/drivers/media/dvb/dvb-core/dvbdev.c 2011-11-15 20:02:59.000000000 -0500
29950 @@ -192,7 +192,7 @@ int dvb_register_device(struct dvb_adapt
29951 const struct dvb_device *template, void *priv, int type)
29952 {
29953 struct dvb_device *dvbdev;
29954 - struct file_operations *dvbdevfops;
29955 + file_operations_no_const *dvbdevfops;
29956 struct device *clsdev;
29957 int minor;
29958 int id;
29959 diff -urNp linux-3.0.9/drivers/media/dvb/dvb-usb/cxusb.c linux-3.0.9/drivers/media/dvb/dvb-usb/cxusb.c
29960 --- linux-3.0.9/drivers/media/dvb/dvb-usb/cxusb.c 2011-11-11 13:12:24.000000000 -0500
29961 +++ linux-3.0.9/drivers/media/dvb/dvb-usb/cxusb.c 2011-11-15 20:02:59.000000000 -0500
29962 @@ -1059,7 +1059,7 @@ static struct dib0070_config dib7070p_di
29963 struct dib0700_adapter_state {
29964 int (*set_param_save) (struct dvb_frontend *,
29965 struct dvb_frontend_parameters *);
29966 -};
29967 +} __no_const;
29968
29969 static int dib7070_set_param_override(struct dvb_frontend *fe,
29970 struct dvb_frontend_parameters *fep)
29971 diff -urNp linux-3.0.9/drivers/media/dvb/dvb-usb/dib0700_core.c linux-3.0.9/drivers/media/dvb/dvb-usb/dib0700_core.c
29972 --- linux-3.0.9/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-11-11 13:12:24.000000000 -0500
29973 +++ linux-3.0.9/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-11-15 20:02:59.000000000 -0500
29974 @@ -478,6 +478,8 @@ int dib0700_download_firmware(struct usb
29975 if (!buf)
29976 return -ENOMEM;
29977
29978 + pax_track_stack();
29979 +
29980 while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
29981 deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",
29982 hx.addr, hx.len, hx.chk);
29983 diff -urNp linux-3.0.9/drivers/media/dvb/dvb-usb/dibusb.h linux-3.0.9/drivers/media/dvb/dvb-usb/dibusb.h
29984 --- linux-3.0.9/drivers/media/dvb/dvb-usb/dibusb.h 2011-11-11 13:12:24.000000000 -0500
29985 +++ linux-3.0.9/drivers/media/dvb/dvb-usb/dibusb.h 2011-11-15 20:02:59.000000000 -0500
29986 @@ -97,7 +97,7 @@
29987 #define DIBUSB_IOCTL_CMD_DISABLE_STREAM 0x02
29988
29989 struct dibusb_state {
29990 - struct dib_fe_xfer_ops ops;
29991 + dib_fe_xfer_ops_no_const ops;
29992 int mt2060_present;
29993 u8 tuner_addr;
29994 };
29995 diff -urNp linux-3.0.9/drivers/media/dvb/dvb-usb/dw2102.c linux-3.0.9/drivers/media/dvb/dvb-usb/dw2102.c
29996 --- linux-3.0.9/drivers/media/dvb/dvb-usb/dw2102.c 2011-11-11 13:12:24.000000000 -0500
29997 +++ linux-3.0.9/drivers/media/dvb/dvb-usb/dw2102.c 2011-11-15 20:02:59.000000000 -0500
29998 @@ -95,7 +95,7 @@ struct su3000_state {
29999
30000 struct s6x0_state {
30001 int (*old_set_voltage)(struct dvb_frontend *f, fe_sec_voltage_t v);
30002 -};
30003 +} __no_const;
30004
30005 /* debug */
30006 static int dvb_usb_dw2102_debug;
30007 diff -urNp linux-3.0.9/drivers/media/dvb/dvb-usb/lmedm04.c linux-3.0.9/drivers/media/dvb/dvb-usb/lmedm04.c
30008 --- linux-3.0.9/drivers/media/dvb/dvb-usb/lmedm04.c 2011-11-11 13:12:24.000000000 -0500
30009 +++ linux-3.0.9/drivers/media/dvb/dvb-usb/lmedm04.c 2011-11-15 20:02:59.000000000 -0500
30010 @@ -742,6 +742,7 @@ static int lme2510_download_firmware(str
30011 usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
30012 0x06, 0x80, 0x0200, 0x00, data, 0x0109, 1000);
30013
30014 + pax_track_stack();
30015
30016 data[0] = 0x8a;
30017 len_in = 1;
30018 @@ -764,6 +765,8 @@ static void lme_coldreset(struct usb_dev
30019 int ret = 0, len_in;
30020 u8 data[512] = {0};
30021
30022 + pax_track_stack();
30023 +
30024 data[0] = 0x0a;
30025 len_in = 1;
30026 info("FRM Firmware Cold Reset");
30027 diff -urNp linux-3.0.9/drivers/media/dvb/frontends/dib3000.h linux-3.0.9/drivers/media/dvb/frontends/dib3000.h
30028 --- linux-3.0.9/drivers/media/dvb/frontends/dib3000.h 2011-11-11 13:12:24.000000000 -0500
30029 +++ linux-3.0.9/drivers/media/dvb/frontends/dib3000.h 2011-11-15 20:02:59.000000000 -0500
30030 @@ -40,10 +40,11 @@ struct dib_fe_xfer_ops
30031 int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff);
30032 int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl);
30033 };
30034 +typedef struct dib_fe_xfer_ops __no_const dib_fe_xfer_ops_no_const;
30035
30036 #if defined(CONFIG_DVB_DIB3000MB) || (defined(CONFIG_DVB_DIB3000MB_MODULE) && defined(MODULE))
30037 extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
30038 - struct i2c_adapter* i2c, struct dib_fe_xfer_ops *xfer_ops);
30039 + struct i2c_adapter* i2c, dib_fe_xfer_ops_no_const *xfer_ops);
30040 #else
30041 static inline struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
30042 struct i2c_adapter* i2c, struct dib_fe_xfer_ops *xfer_ops)
30043 diff -urNp linux-3.0.9/drivers/media/dvb/frontends/dib3000mb.c linux-3.0.9/drivers/media/dvb/frontends/dib3000mb.c
30044 --- linux-3.0.9/drivers/media/dvb/frontends/dib3000mb.c 2011-11-11 13:12:24.000000000 -0500
30045 +++ linux-3.0.9/drivers/media/dvb/frontends/dib3000mb.c 2011-11-15 20:02:59.000000000 -0500
30046 @@ -756,7 +756,7 @@ static int dib3000mb_tuner_pass_ctrl(str
30047 static struct dvb_frontend_ops dib3000mb_ops;
30048
30049 struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
30050 - struct i2c_adapter* i2c, struct dib_fe_xfer_ops *xfer_ops)
30051 + struct i2c_adapter* i2c, dib_fe_xfer_ops_no_const *xfer_ops)
30052 {
30053 struct dib3000_state* state = NULL;
30054
30055 diff -urNp linux-3.0.9/drivers/media/dvb/frontends/mb86a16.c linux-3.0.9/drivers/media/dvb/frontends/mb86a16.c
30056 --- linux-3.0.9/drivers/media/dvb/frontends/mb86a16.c 2011-11-11 13:12:24.000000000 -0500
30057 +++ linux-3.0.9/drivers/media/dvb/frontends/mb86a16.c 2011-11-15 20:02:59.000000000 -0500
30058 @@ -1060,6 +1060,8 @@ static int mb86a16_set_fe(struct mb86a16
30059 int ret = -1;
30060 int sync;
30061
30062 + pax_track_stack();
30063 +
30064 dprintk(verbose, MB86A16_INFO, 1, "freq=%d Mhz, symbrt=%d Ksps", state->frequency, state->srate);
30065
30066 fcp = 3000;
30067 diff -urNp linux-3.0.9/drivers/media/dvb/frontends/or51211.c linux-3.0.9/drivers/media/dvb/frontends/or51211.c
30068 --- linux-3.0.9/drivers/media/dvb/frontends/or51211.c 2011-11-11 13:12:24.000000000 -0500
30069 +++ linux-3.0.9/drivers/media/dvb/frontends/or51211.c 2011-11-15 20:02:59.000000000 -0500
30070 @@ -113,6 +113,8 @@ static int or51211_load_firmware (struct
30071 u8 tudata[585];
30072 int i;
30073
30074 + pax_track_stack();
30075 +
30076 dprintk("Firmware is %zd bytes\n",fw->size);
30077
30078 /* Get eprom data */
30079 diff -urNp linux-3.0.9/drivers/media/dvb/ngene/ngene-cards.c linux-3.0.9/drivers/media/dvb/ngene/ngene-cards.c
30080 --- linux-3.0.9/drivers/media/dvb/ngene/ngene-cards.c 2011-11-11 13:12:24.000000000 -0500
30081 +++ linux-3.0.9/drivers/media/dvb/ngene/ngene-cards.c 2011-11-15 20:02:59.000000000 -0500
30082 @@ -379,7 +379,7 @@ static struct ngene_info ngene_info_m780
30083
30084 /****************************************************************************/
30085
30086 -static const struct pci_device_id ngene_id_tbl[] __devinitdata = {
30087 +static const struct pci_device_id ngene_id_tbl[] __devinitconst = {
30088 NGENE_ID(0x18c3, 0xabc3, ngene_info_cineS2),
30089 NGENE_ID(0x18c3, 0xabc4, ngene_info_cineS2),
30090 NGENE_ID(0x18c3, 0xdb01, ngene_info_satixS2),
30091 diff -urNp linux-3.0.9/drivers/media/video/cx18/cx18-driver.c linux-3.0.9/drivers/media/video/cx18/cx18-driver.c
30092 --- linux-3.0.9/drivers/media/video/cx18/cx18-driver.c 2011-11-11 13:12:24.000000000 -0500
30093 +++ linux-3.0.9/drivers/media/video/cx18/cx18-driver.c 2011-11-15 20:02:59.000000000 -0500
30094 @@ -327,6 +327,8 @@ void cx18_read_eeprom(struct cx18 *cx, s
30095 struct i2c_client c;
30096 u8 eedata[256];
30097
30098 + pax_track_stack();
30099 +
30100 memset(&c, 0, sizeof(c));
30101 strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
30102 c.adapter = &cx->i2c_adap[0];
30103 diff -urNp linux-3.0.9/drivers/media/video/cx23885/cx23885-input.c linux-3.0.9/drivers/media/video/cx23885/cx23885-input.c
30104 --- linux-3.0.9/drivers/media/video/cx23885/cx23885-input.c 2011-11-11 13:12:24.000000000 -0500
30105 +++ linux-3.0.9/drivers/media/video/cx23885/cx23885-input.c 2011-11-15 20:02:59.000000000 -0500
30106 @@ -53,6 +53,8 @@ static void cx23885_input_process_measur
30107 bool handle = false;
30108 struct ir_raw_event ir_core_event[64];
30109
30110 + pax_track_stack();
30111 +
30112 do {
30113 num = 0;
30114 v4l2_subdev_call(dev->sd_ir, ir, rx_read, (u8 *) ir_core_event,
30115 diff -urNp linux-3.0.9/drivers/media/video/cx88/cx88-alsa.c linux-3.0.9/drivers/media/video/cx88/cx88-alsa.c
30116 --- linux-3.0.9/drivers/media/video/cx88/cx88-alsa.c 2011-11-11 13:12:24.000000000 -0500
30117 +++ linux-3.0.9/drivers/media/video/cx88/cx88-alsa.c 2011-11-15 20:02:59.000000000 -0500
30118 @@ -764,7 +764,7 @@ static struct snd_kcontrol_new snd_cx88_
30119 * Only boards with eeprom and byte 1 at eeprom=1 have it
30120 */
30121
30122 -static const struct pci_device_id const cx88_audio_pci_tbl[] __devinitdata = {
30123 +static const struct pci_device_id const cx88_audio_pci_tbl[] __devinitconst = {
30124 {0x14f1,0x8801,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
30125 {0x14f1,0x8811,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
30126 {0, }
30127 diff -urNp linux-3.0.9/drivers/media/video/pvrusb2/pvrusb2-eeprom.c linux-3.0.9/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
30128 --- linux-3.0.9/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-11-11 13:12:24.000000000 -0500
30129 +++ linux-3.0.9/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-11-15 20:02:59.000000000 -0500
30130 @@ -120,6 +120,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw
30131 u8 *eeprom;
30132 struct tveeprom tvdata;
30133
30134 + pax_track_stack();
30135 +
30136 memset(&tvdata,0,sizeof(tvdata));
30137
30138 eeprom = pvr2_eeprom_fetch(hdw);
30139 diff -urNp linux-3.0.9/drivers/media/video/saa7134/saa6752hs.c linux-3.0.9/drivers/media/video/saa7134/saa6752hs.c
30140 --- linux-3.0.9/drivers/media/video/saa7134/saa6752hs.c 2011-11-11 13:12:24.000000000 -0500
30141 +++ linux-3.0.9/drivers/media/video/saa7134/saa6752hs.c 2011-11-15 20:02:59.000000000 -0500
30142 @@ -682,6 +682,8 @@ static int saa6752hs_init(struct v4l2_su
30143 unsigned char localPAT[256];
30144 unsigned char localPMT[256];
30145
30146 + pax_track_stack();
30147 +
30148 /* Set video format - must be done first as it resets other settings */
30149 set_reg8(client, 0x41, h->video_format);
30150
30151 diff -urNp linux-3.0.9/drivers/media/video/saa7164/saa7164-cmd.c linux-3.0.9/drivers/media/video/saa7164/saa7164-cmd.c
30152 --- linux-3.0.9/drivers/media/video/saa7164/saa7164-cmd.c 2011-11-11 13:12:24.000000000 -0500
30153 +++ linux-3.0.9/drivers/media/video/saa7164/saa7164-cmd.c 2011-11-15 20:02:59.000000000 -0500
30154 @@ -88,6 +88,8 @@ int saa7164_irq_dequeue(struct saa7164_d
30155 u8 tmp[512];
30156 dprintk(DBGLVL_CMD, "%s()\n", __func__);
30157
30158 + pax_track_stack();
30159 +
30160 /* While any outstand message on the bus exists... */
30161 do {
30162
30163 @@ -141,6 +143,8 @@ int saa7164_cmd_dequeue(struct saa7164_d
30164 u8 tmp[512];
30165 dprintk(DBGLVL_CMD, "%s()\n", __func__);
30166
30167 + pax_track_stack();
30168 +
30169 while (loop) {
30170
30171 struct tmComResInfo tRsp = { 0, 0, 0, 0, 0, 0 };
30172 diff -urNp linux-3.0.9/drivers/media/video/timblogiw.c linux-3.0.9/drivers/media/video/timblogiw.c
30173 --- linux-3.0.9/drivers/media/video/timblogiw.c 2011-11-11 13:12:24.000000000 -0500
30174 +++ linux-3.0.9/drivers/media/video/timblogiw.c 2011-11-15 20:02:59.000000000 -0500
30175 @@ -745,7 +745,7 @@ static int timblogiw_mmap(struct file *f
30176
30177 /* Platform device functions */
30178
30179 -static __devinitconst struct v4l2_ioctl_ops timblogiw_ioctl_ops = {
30180 +static __devinitconst v4l2_ioctl_ops_no_const timblogiw_ioctl_ops = {
30181 .vidioc_querycap = timblogiw_querycap,
30182 .vidioc_enum_fmt_vid_cap = timblogiw_enum_fmt,
30183 .vidioc_g_fmt_vid_cap = timblogiw_g_fmt,
30184 diff -urNp linux-3.0.9/drivers/media/video/usbvision/usbvision-core.c linux-3.0.9/drivers/media/video/usbvision/usbvision-core.c
30185 --- linux-3.0.9/drivers/media/video/usbvision/usbvision-core.c 2011-11-11 13:12:24.000000000 -0500
30186 +++ linux-3.0.9/drivers/media/video/usbvision/usbvision-core.c 2011-11-15 20:02:59.000000000 -0500
30187 @@ -707,6 +707,8 @@ static enum parse_state usbvision_parse_
30188 unsigned char rv, gv, bv;
30189 static unsigned char *Y, *U, *V;
30190
30191 + pax_track_stack();
30192 +
30193 frame = usbvision->cur_frame;
30194 image_size = frame->frmwidth * frame->frmheight;
30195 if ((frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
30196 diff -urNp linux-3.0.9/drivers/media/video/videobuf-dma-sg.c linux-3.0.9/drivers/media/video/videobuf-dma-sg.c
30197 --- linux-3.0.9/drivers/media/video/videobuf-dma-sg.c 2011-11-11 13:12:24.000000000 -0500
30198 +++ linux-3.0.9/drivers/media/video/videobuf-dma-sg.c 2011-11-15 20:02:59.000000000 -0500
30199 @@ -606,6 +606,8 @@ void *videobuf_sg_alloc(size_t size)
30200 {
30201 struct videobuf_queue q;
30202
30203 + pax_track_stack();
30204 +
30205 /* Required to make generic handler to call __videobuf_alloc */
30206 q.int_ops = &sg_ops;
30207
30208 diff -urNp linux-3.0.9/drivers/message/fusion/mptbase.c linux-3.0.9/drivers/message/fusion/mptbase.c
30209 --- linux-3.0.9/drivers/message/fusion/mptbase.c 2011-11-11 13:12:24.000000000 -0500
30210 +++ linux-3.0.9/drivers/message/fusion/mptbase.c 2011-11-15 20:02:59.000000000 -0500
30211 @@ -6681,8 +6681,13 @@ static int mpt_iocinfo_proc_show(struct
30212 seq_printf(m, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
30213 seq_printf(m, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
30214
30215 +#ifdef CONFIG_GRKERNSEC_HIDESYM
30216 + seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n", NULL, NULL);
30217 +#else
30218 seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
30219 (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
30220 +#endif
30221 +
30222 /*
30223 * Rounding UP to nearest 4-kB boundary here...
30224 */
30225 diff -urNp linux-3.0.9/drivers/message/fusion/mptsas.c linux-3.0.9/drivers/message/fusion/mptsas.c
30226 --- linux-3.0.9/drivers/message/fusion/mptsas.c 2011-11-11 13:12:24.000000000 -0500
30227 +++ linux-3.0.9/drivers/message/fusion/mptsas.c 2011-11-15 20:02:59.000000000 -0500
30228 @@ -439,6 +439,23 @@ mptsas_is_end_device(struct mptsas_devin
30229 return 0;
30230 }
30231
30232 +static inline void
30233 +mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
30234 +{
30235 + if (phy_info->port_details) {
30236 + phy_info->port_details->rphy = rphy;
30237 + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
30238 + ioc->name, rphy));
30239 + }
30240 +
30241 + if (rphy) {
30242 + dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
30243 + &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
30244 + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
30245 + ioc->name, rphy, rphy->dev.release));
30246 + }
30247 +}
30248 +
30249 /* no mutex */
30250 static void
30251 mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
30252 @@ -477,23 +494,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *p
30253 return NULL;
30254 }
30255
30256 -static inline void
30257 -mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
30258 -{
30259 - if (phy_info->port_details) {
30260 - phy_info->port_details->rphy = rphy;
30261 - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
30262 - ioc->name, rphy));
30263 - }
30264 -
30265 - if (rphy) {
30266 - dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
30267 - &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
30268 - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
30269 - ioc->name, rphy, rphy->dev.release));
30270 - }
30271 -}
30272 -
30273 static inline struct sas_port *
30274 mptsas_get_port(struct mptsas_phyinfo *phy_info)
30275 {
30276 diff -urNp linux-3.0.9/drivers/message/fusion/mptscsih.c linux-3.0.9/drivers/message/fusion/mptscsih.c
30277 --- linux-3.0.9/drivers/message/fusion/mptscsih.c 2011-11-11 13:12:24.000000000 -0500
30278 +++ linux-3.0.9/drivers/message/fusion/mptscsih.c 2011-11-15 20:02:59.000000000 -0500
30279 @@ -1268,15 +1268,16 @@ mptscsih_info(struct Scsi_Host *SChost)
30280
30281 h = shost_priv(SChost);
30282
30283 - if (h) {
30284 - if (h->info_kbuf == NULL)
30285 - if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
30286 - return h->info_kbuf;
30287 - h->info_kbuf[0] = '\0';
30288 + if (!h)
30289 + return NULL;
30290
30291 - mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
30292 - h->info_kbuf[size-1] = '\0';
30293 - }
30294 + if (h->info_kbuf == NULL)
30295 + if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
30296 + return h->info_kbuf;
30297 + h->info_kbuf[0] = '\0';
30298 +
30299 + mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
30300 + h->info_kbuf[size-1] = '\0';
30301
30302 return h->info_kbuf;
30303 }
30304 diff -urNp linux-3.0.9/drivers/message/i2o/i2o_config.c linux-3.0.9/drivers/message/i2o/i2o_config.c
30305 --- linux-3.0.9/drivers/message/i2o/i2o_config.c 2011-11-11 13:12:24.000000000 -0500
30306 +++ linux-3.0.9/drivers/message/i2o/i2o_config.c 2011-11-15 20:02:59.000000000 -0500
30307 @@ -781,6 +781,8 @@ static int i2o_cfg_passthru(unsigned lon
30308 struct i2o_message *msg;
30309 unsigned int iop;
30310
30311 + pax_track_stack();
30312 +
30313 if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
30314 return -EFAULT;
30315
30316 diff -urNp linux-3.0.9/drivers/message/i2o/i2o_proc.c linux-3.0.9/drivers/message/i2o/i2o_proc.c
30317 --- linux-3.0.9/drivers/message/i2o/i2o_proc.c 2011-11-11 13:12:24.000000000 -0500
30318 +++ linux-3.0.9/drivers/message/i2o/i2o_proc.c 2011-11-15 20:02:59.000000000 -0500
30319 @@ -255,13 +255,6 @@ static char *scsi_devices[] = {
30320 "Array Controller Device"
30321 };
30322
30323 -static char *chtostr(u8 * chars, int n)
30324 -{
30325 - char tmp[256];
30326 - tmp[0] = 0;
30327 - return strncat(tmp, (char *)chars, n);
30328 -}
30329 -
30330 static int i2o_report_query_status(struct seq_file *seq, int block_status,
30331 char *group)
30332 {
30333 @@ -838,8 +831,7 @@ static int i2o_seq_show_ddm_table(struct
30334
30335 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
30336 seq_printf(seq, "%-#8x", ddm_table.module_id);
30337 - seq_printf(seq, "%-29s",
30338 - chtostr(ddm_table.module_name_version, 28));
30339 + seq_printf(seq, "%-.28s", ddm_table.module_name_version);
30340 seq_printf(seq, "%9d ", ddm_table.data_size);
30341 seq_printf(seq, "%8d", ddm_table.code_size);
30342
30343 @@ -940,8 +932,8 @@ static int i2o_seq_show_drivers_stored(s
30344
30345 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
30346 seq_printf(seq, "%-#8x", dst->module_id);
30347 - seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
30348 - seq_printf(seq, "%-9s", chtostr(dst->date, 8));
30349 + seq_printf(seq, "%-.28s", dst->module_name_version);
30350 + seq_printf(seq, "%-.8s", dst->date);
30351 seq_printf(seq, "%8d ", dst->module_size);
30352 seq_printf(seq, "%8d ", dst->mpb_size);
30353 seq_printf(seq, "0x%04x", dst->module_flags);
30354 @@ -1272,14 +1264,10 @@ static int i2o_seq_show_dev_identity(str
30355 seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
30356 seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
30357 seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
30358 - seq_printf(seq, "Vendor info : %s\n",
30359 - chtostr((u8 *) (work32 + 2), 16));
30360 - seq_printf(seq, "Product info : %s\n",
30361 - chtostr((u8 *) (work32 + 6), 16));
30362 - seq_printf(seq, "Description : %s\n",
30363 - chtostr((u8 *) (work32 + 10), 16));
30364 - seq_printf(seq, "Product rev. : %s\n",
30365 - chtostr((u8 *) (work32 + 14), 8));
30366 + seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
30367 + seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
30368 + seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
30369 + seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
30370
30371 seq_printf(seq, "Serial number : ");
30372 print_serial_number(seq, (u8 *) (work32 + 16),
30373 @@ -1324,10 +1312,8 @@ static int i2o_seq_show_ddm_identity(str
30374 }
30375
30376 seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
30377 - seq_printf(seq, "Module name : %s\n",
30378 - chtostr(result.module_name, 24));
30379 - seq_printf(seq, "Module revision : %s\n",
30380 - chtostr(result.module_rev, 8));
30381 + seq_printf(seq, "Module name : %.24s\n", result.module_name);
30382 + seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
30383
30384 seq_printf(seq, "Serial number : ");
30385 print_serial_number(seq, result.serial_number, sizeof(result) - 36);
30386 @@ -1358,14 +1344,10 @@ static int i2o_seq_show_uinfo(struct seq
30387 return 0;
30388 }
30389
30390 - seq_printf(seq, "Device name : %s\n",
30391 - chtostr(result.device_name, 64));
30392 - seq_printf(seq, "Service name : %s\n",
30393 - chtostr(result.service_name, 64));
30394 - seq_printf(seq, "Physical name : %s\n",
30395 - chtostr(result.physical_location, 64));
30396 - seq_printf(seq, "Instance number : %s\n",
30397 - chtostr(result.instance_number, 4));
30398 + seq_printf(seq, "Device name : %.64s\n", result.device_name);
30399 + seq_printf(seq, "Service name : %.64s\n", result.service_name);
30400 + seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
30401 + seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
30402
30403 return 0;
30404 }
30405 diff -urNp linux-3.0.9/drivers/message/i2o/iop.c linux-3.0.9/drivers/message/i2o/iop.c
30406 --- linux-3.0.9/drivers/message/i2o/iop.c 2011-11-11 13:12:24.000000000 -0500
30407 +++ linux-3.0.9/drivers/message/i2o/iop.c 2011-11-15 20:02:59.000000000 -0500
30408 @@ -111,10 +111,10 @@ u32 i2o_cntxt_list_add(struct i2o_contro
30409
30410 spin_lock_irqsave(&c->context_list_lock, flags);
30411
30412 - if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
30413 - atomic_inc(&c->context_list_counter);
30414 + if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
30415 + atomic_inc_unchecked(&c->context_list_counter);
30416
30417 - entry->context = atomic_read(&c->context_list_counter);
30418 + entry->context = atomic_read_unchecked(&c->context_list_counter);
30419
30420 list_add(&entry->list, &c->context_list);
30421
30422 @@ -1077,7 +1077,7 @@ struct i2o_controller *i2o_iop_alloc(voi
30423
30424 #if BITS_PER_LONG == 64
30425 spin_lock_init(&c->context_list_lock);
30426 - atomic_set(&c->context_list_counter, 0);
30427 + atomic_set_unchecked(&c->context_list_counter, 0);
30428 INIT_LIST_HEAD(&c->context_list);
30429 #endif
30430
30431 diff -urNp linux-3.0.9/drivers/mfd/ab3100-core.c linux-3.0.9/drivers/mfd/ab3100-core.c
30432 --- linux-3.0.9/drivers/mfd/ab3100-core.c 2011-11-11 13:12:24.000000000 -0500
30433 +++ linux-3.0.9/drivers/mfd/ab3100-core.c 2011-11-15 20:02:59.000000000 -0500
30434 @@ -809,7 +809,7 @@ struct ab_family_id {
30435 char *name;
30436 };
30437
30438 -static const struct ab_family_id ids[] __devinitdata = {
30439 +static const struct ab_family_id ids[] __devinitconst = {
30440 /* AB3100 */
30441 {
30442 .id = 0xc0,
30443 diff -urNp linux-3.0.9/drivers/mfd/abx500-core.c linux-3.0.9/drivers/mfd/abx500-core.c
30444 --- linux-3.0.9/drivers/mfd/abx500-core.c 2011-11-11 13:12:24.000000000 -0500
30445 +++ linux-3.0.9/drivers/mfd/abx500-core.c 2011-11-15 20:02:59.000000000 -0500
30446 @@ -14,7 +14,7 @@ static LIST_HEAD(abx500_list);
30447
30448 struct abx500_device_entry {
30449 struct list_head list;
30450 - struct abx500_ops ops;
30451 + abx500_ops_no_const ops;
30452 struct device *dev;
30453 };
30454
30455 diff -urNp linux-3.0.9/drivers/mfd/janz-cmodio.c linux-3.0.9/drivers/mfd/janz-cmodio.c
30456 --- linux-3.0.9/drivers/mfd/janz-cmodio.c 2011-11-11 13:12:24.000000000 -0500
30457 +++ linux-3.0.9/drivers/mfd/janz-cmodio.c 2011-11-15 20:02:59.000000000 -0500
30458 @@ -13,6 +13,7 @@
30459
30460 #include <linux/kernel.h>
30461 #include <linux/module.h>
30462 +#include <linux/slab.h>
30463 #include <linux/init.h>
30464 #include <linux/pci.h>
30465 #include <linux/interrupt.h>
30466 diff -urNp linux-3.0.9/drivers/mfd/wm8350-i2c.c linux-3.0.9/drivers/mfd/wm8350-i2c.c
30467 --- linux-3.0.9/drivers/mfd/wm8350-i2c.c 2011-11-11 13:12:24.000000000 -0500
30468 +++ linux-3.0.9/drivers/mfd/wm8350-i2c.c 2011-11-15 20:02:59.000000000 -0500
30469 @@ -44,6 +44,8 @@ static int wm8350_i2c_write_device(struc
30470 u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
30471 int ret;
30472
30473 + pax_track_stack();
30474 +
30475 if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
30476 return -EINVAL;
30477
30478 diff -urNp linux-3.0.9/drivers/misc/lis3lv02d/lis3lv02d.c linux-3.0.9/drivers/misc/lis3lv02d/lis3lv02d.c
30479 --- linux-3.0.9/drivers/misc/lis3lv02d/lis3lv02d.c 2011-11-11 13:12:24.000000000 -0500
30480 +++ linux-3.0.9/drivers/misc/lis3lv02d/lis3lv02d.c 2011-11-15 20:02:59.000000000 -0500
30481 @@ -437,7 +437,7 @@ static irqreturn_t lis302dl_interrupt(in
30482 * the lid is closed. This leads to interrupts as soon as a little move
30483 * is done.
30484 */
30485 - atomic_inc(&lis3_dev.count);
30486 + atomic_inc_unchecked(&lis3_dev.count);
30487
30488 wake_up_interruptible(&lis3_dev.misc_wait);
30489 kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
30490 @@ -520,7 +520,7 @@ static int lis3lv02d_misc_open(struct in
30491 if (lis3_dev.pm_dev)
30492 pm_runtime_get_sync(lis3_dev.pm_dev);
30493
30494 - atomic_set(&lis3_dev.count, 0);
30495 + atomic_set_unchecked(&lis3_dev.count, 0);
30496 return 0;
30497 }
30498
30499 @@ -547,7 +547,7 @@ static ssize_t lis3lv02d_misc_read(struc
30500 add_wait_queue(&lis3_dev.misc_wait, &wait);
30501 while (true) {
30502 set_current_state(TASK_INTERRUPTIBLE);
30503 - data = atomic_xchg(&lis3_dev.count, 0);
30504 + data = atomic_xchg_unchecked(&lis3_dev.count, 0);
30505 if (data)
30506 break;
30507
30508 @@ -585,7 +585,7 @@ out:
30509 static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
30510 {
30511 poll_wait(file, &lis3_dev.misc_wait, wait);
30512 - if (atomic_read(&lis3_dev.count))
30513 + if (atomic_read_unchecked(&lis3_dev.count))
30514 return POLLIN | POLLRDNORM;
30515 return 0;
30516 }
30517 diff -urNp linux-3.0.9/drivers/misc/lis3lv02d/lis3lv02d.h linux-3.0.9/drivers/misc/lis3lv02d/lis3lv02d.h
30518 --- linux-3.0.9/drivers/misc/lis3lv02d/lis3lv02d.h 2011-11-11 13:12:24.000000000 -0500
30519 +++ linux-3.0.9/drivers/misc/lis3lv02d/lis3lv02d.h 2011-11-15 20:02:59.000000000 -0500
30520 @@ -265,7 +265,7 @@ struct lis3lv02d {
30521 struct input_polled_dev *idev; /* input device */
30522 struct platform_device *pdev; /* platform device */
30523 struct regulator_bulk_data regulators[2];
30524 - atomic_t count; /* interrupt count after last read */
30525 + atomic_unchecked_t count; /* interrupt count after last read */
30526 union axis_conversion ac; /* hw -> logical axis */
30527 int mapped_btns[3];
30528
30529 diff -urNp linux-3.0.9/drivers/misc/sgi-gru/gruhandles.c linux-3.0.9/drivers/misc/sgi-gru/gruhandles.c
30530 --- linux-3.0.9/drivers/misc/sgi-gru/gruhandles.c 2011-11-11 13:12:24.000000000 -0500
30531 +++ linux-3.0.9/drivers/misc/sgi-gru/gruhandles.c 2011-11-15 20:02:59.000000000 -0500
30532 @@ -44,8 +44,8 @@ static void update_mcs_stats(enum mcs_op
30533 unsigned long nsec;
30534
30535 nsec = CLKS2NSEC(clks);
30536 - atomic_long_inc(&mcs_op_statistics[op].count);
30537 - atomic_long_add(nsec, &mcs_op_statistics[op].total);
30538 + atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
30539 + atomic_long_add_unchecked(nsec, &mcs_op_statistics[op].total);
30540 if (mcs_op_statistics[op].max < nsec)
30541 mcs_op_statistics[op].max = nsec;
30542 }
30543 diff -urNp linux-3.0.9/drivers/misc/sgi-gru/gruprocfs.c linux-3.0.9/drivers/misc/sgi-gru/gruprocfs.c
30544 --- linux-3.0.9/drivers/misc/sgi-gru/gruprocfs.c 2011-11-11 13:12:24.000000000 -0500
30545 +++ linux-3.0.9/drivers/misc/sgi-gru/gruprocfs.c 2011-11-15 20:02:59.000000000 -0500
30546 @@ -32,9 +32,9 @@
30547
30548 #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
30549
30550 -static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
30551 +static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
30552 {
30553 - unsigned long val = atomic_long_read(v);
30554 + unsigned long val = atomic_long_read_unchecked(v);
30555
30556 seq_printf(s, "%16lu %s\n", val, id);
30557 }
30558 @@ -134,8 +134,8 @@ static int mcs_statistics_show(struct se
30559
30560 seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks");
30561 for (op = 0; op < mcsop_last; op++) {
30562 - count = atomic_long_read(&mcs_op_statistics[op].count);
30563 - total = atomic_long_read(&mcs_op_statistics[op].total);
30564 + count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
30565 + total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
30566 max = mcs_op_statistics[op].max;
30567 seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
30568 count ? total / count : 0, max);
30569 diff -urNp linux-3.0.9/drivers/misc/sgi-gru/grutables.h linux-3.0.9/drivers/misc/sgi-gru/grutables.h
30570 --- linux-3.0.9/drivers/misc/sgi-gru/grutables.h 2011-11-11 13:12:24.000000000 -0500
30571 +++ linux-3.0.9/drivers/misc/sgi-gru/grutables.h 2011-11-15 20:02:59.000000000 -0500
30572 @@ -167,82 +167,82 @@ extern unsigned int gru_max_gids;
30573 * GRU statistics.
30574 */
30575 struct gru_stats_s {
30576 - atomic_long_t vdata_alloc;
30577 - atomic_long_t vdata_free;
30578 - atomic_long_t gts_alloc;
30579 - atomic_long_t gts_free;
30580 - atomic_long_t gms_alloc;
30581 - atomic_long_t gms_free;
30582 - atomic_long_t gts_double_allocate;
30583 - atomic_long_t assign_context;
30584 - atomic_long_t assign_context_failed;
30585 - atomic_long_t free_context;
30586 - atomic_long_t load_user_context;
30587 - atomic_long_t load_kernel_context;
30588 - atomic_long_t lock_kernel_context;
30589 - atomic_long_t unlock_kernel_context;
30590 - atomic_long_t steal_user_context;
30591 - atomic_long_t steal_kernel_context;
30592 - atomic_long_t steal_context_failed;
30593 - atomic_long_t nopfn;
30594 - atomic_long_t asid_new;
30595 - atomic_long_t asid_next;
30596 - atomic_long_t asid_wrap;
30597 - atomic_long_t asid_reuse;
30598 - atomic_long_t intr;
30599 - atomic_long_t intr_cbr;
30600 - atomic_long_t intr_tfh;
30601 - atomic_long_t intr_spurious;
30602 - atomic_long_t intr_mm_lock_failed;
30603 - atomic_long_t call_os;
30604 - atomic_long_t call_os_wait_queue;
30605 - atomic_long_t user_flush_tlb;
30606 - atomic_long_t user_unload_context;
30607 - atomic_long_t user_exception;
30608 - atomic_long_t set_context_option;
30609 - atomic_long_t check_context_retarget_intr;
30610 - atomic_long_t check_context_unload;
30611 - atomic_long_t tlb_dropin;
30612 - atomic_long_t tlb_preload_page;
30613 - atomic_long_t tlb_dropin_fail_no_asid;
30614 - atomic_long_t tlb_dropin_fail_upm;
30615 - atomic_long_t tlb_dropin_fail_invalid;
30616 - atomic_long_t tlb_dropin_fail_range_active;
30617 - atomic_long_t tlb_dropin_fail_idle;
30618 - atomic_long_t tlb_dropin_fail_fmm;
30619 - atomic_long_t tlb_dropin_fail_no_exception;
30620 - atomic_long_t tfh_stale_on_fault;
30621 - atomic_long_t mmu_invalidate_range;
30622 - atomic_long_t mmu_invalidate_page;
30623 - atomic_long_t flush_tlb;
30624 - atomic_long_t flush_tlb_gru;
30625 - atomic_long_t flush_tlb_gru_tgh;
30626 - atomic_long_t flush_tlb_gru_zero_asid;
30627 -
30628 - atomic_long_t copy_gpa;
30629 - atomic_long_t read_gpa;
30630 -
30631 - atomic_long_t mesq_receive;
30632 - atomic_long_t mesq_receive_none;
30633 - atomic_long_t mesq_send;
30634 - atomic_long_t mesq_send_failed;
30635 - atomic_long_t mesq_noop;
30636 - atomic_long_t mesq_send_unexpected_error;
30637 - atomic_long_t mesq_send_lb_overflow;
30638 - atomic_long_t mesq_send_qlimit_reached;
30639 - atomic_long_t mesq_send_amo_nacked;
30640 - atomic_long_t mesq_send_put_nacked;
30641 - atomic_long_t mesq_page_overflow;
30642 - atomic_long_t mesq_qf_locked;
30643 - atomic_long_t mesq_qf_noop_not_full;
30644 - atomic_long_t mesq_qf_switch_head_failed;
30645 - atomic_long_t mesq_qf_unexpected_error;
30646 - atomic_long_t mesq_noop_unexpected_error;
30647 - atomic_long_t mesq_noop_lb_overflow;
30648 - atomic_long_t mesq_noop_qlimit_reached;
30649 - atomic_long_t mesq_noop_amo_nacked;
30650 - atomic_long_t mesq_noop_put_nacked;
30651 - atomic_long_t mesq_noop_page_overflow;
30652 + atomic_long_unchecked_t vdata_alloc;
30653 + atomic_long_unchecked_t vdata_free;
30654 + atomic_long_unchecked_t gts_alloc;
30655 + atomic_long_unchecked_t gts_free;
30656 + atomic_long_unchecked_t gms_alloc;
30657 + atomic_long_unchecked_t gms_free;
30658 + atomic_long_unchecked_t gts_double_allocate;
30659 + atomic_long_unchecked_t assign_context;
30660 + atomic_long_unchecked_t assign_context_failed;
30661 + atomic_long_unchecked_t free_context;
30662 + atomic_long_unchecked_t load_user_context;
30663 + atomic_long_unchecked_t load_kernel_context;
30664 + atomic_long_unchecked_t lock_kernel_context;
30665 + atomic_long_unchecked_t unlock_kernel_context;
30666 + atomic_long_unchecked_t steal_user_context;
30667 + atomic_long_unchecked_t steal_kernel_context;
30668 + atomic_long_unchecked_t steal_context_failed;
30669 + atomic_long_unchecked_t nopfn;
30670 + atomic_long_unchecked_t asid_new;
30671 + atomic_long_unchecked_t asid_next;
30672 + atomic_long_unchecked_t asid_wrap;
30673 + atomic_long_unchecked_t asid_reuse;
30674 + atomic_long_unchecked_t intr;
30675 + atomic_long_unchecked_t intr_cbr;
30676 + atomic_long_unchecked_t intr_tfh;
30677 + atomic_long_unchecked_t intr_spurious;
30678 + atomic_long_unchecked_t intr_mm_lock_failed;
30679 + atomic_long_unchecked_t call_os;
30680 + atomic_long_unchecked_t call_os_wait_queue;
30681 + atomic_long_unchecked_t user_flush_tlb;
30682 + atomic_long_unchecked_t user_unload_context;
30683 + atomic_long_unchecked_t user_exception;
30684 + atomic_long_unchecked_t set_context_option;
30685 + atomic_long_unchecked_t check_context_retarget_intr;
30686 + atomic_long_unchecked_t check_context_unload;
30687 + atomic_long_unchecked_t tlb_dropin;
30688 + atomic_long_unchecked_t tlb_preload_page;
30689 + atomic_long_unchecked_t tlb_dropin_fail_no_asid;
30690 + atomic_long_unchecked_t tlb_dropin_fail_upm;
30691 + atomic_long_unchecked_t tlb_dropin_fail_invalid;
30692 + atomic_long_unchecked_t tlb_dropin_fail_range_active;
30693 + atomic_long_unchecked_t tlb_dropin_fail_idle;
30694 + atomic_long_unchecked_t tlb_dropin_fail_fmm;
30695 + atomic_long_unchecked_t tlb_dropin_fail_no_exception;
30696 + atomic_long_unchecked_t tfh_stale_on_fault;
30697 + atomic_long_unchecked_t mmu_invalidate_range;
30698 + atomic_long_unchecked_t mmu_invalidate_page;
30699 + atomic_long_unchecked_t flush_tlb;
30700 + atomic_long_unchecked_t flush_tlb_gru;
30701 + atomic_long_unchecked_t flush_tlb_gru_tgh;
30702 + atomic_long_unchecked_t flush_tlb_gru_zero_asid;
30703 +
30704 + atomic_long_unchecked_t copy_gpa;
30705 + atomic_long_unchecked_t read_gpa;
30706 +
30707 + atomic_long_unchecked_t mesq_receive;
30708 + atomic_long_unchecked_t mesq_receive_none;
30709 + atomic_long_unchecked_t mesq_send;
30710 + atomic_long_unchecked_t mesq_send_failed;
30711 + atomic_long_unchecked_t mesq_noop;
30712 + atomic_long_unchecked_t mesq_send_unexpected_error;
30713 + atomic_long_unchecked_t mesq_send_lb_overflow;
30714 + atomic_long_unchecked_t mesq_send_qlimit_reached;
30715 + atomic_long_unchecked_t mesq_send_amo_nacked;
30716 + atomic_long_unchecked_t mesq_send_put_nacked;
30717 + atomic_long_unchecked_t mesq_page_overflow;
30718 + atomic_long_unchecked_t mesq_qf_locked;
30719 + atomic_long_unchecked_t mesq_qf_noop_not_full;
30720 + atomic_long_unchecked_t mesq_qf_switch_head_failed;
30721 + atomic_long_unchecked_t mesq_qf_unexpected_error;
30722 + atomic_long_unchecked_t mesq_noop_unexpected_error;
30723 + atomic_long_unchecked_t mesq_noop_lb_overflow;
30724 + atomic_long_unchecked_t mesq_noop_qlimit_reached;
30725 + atomic_long_unchecked_t mesq_noop_amo_nacked;
30726 + atomic_long_unchecked_t mesq_noop_put_nacked;
30727 + atomic_long_unchecked_t mesq_noop_page_overflow;
30728
30729 };
30730
30731 @@ -251,8 +251,8 @@ enum mcs_op {cchop_allocate, cchop_start
30732 tghop_invalidate, mcsop_last};
30733
30734 struct mcs_op_statistic {
30735 - atomic_long_t count;
30736 - atomic_long_t total;
30737 + atomic_long_unchecked_t count;
30738 + atomic_long_unchecked_t total;
30739 unsigned long max;
30740 };
30741
30742 @@ -275,7 +275,7 @@ extern struct mcs_op_statistic mcs_op_st
30743
30744 #define STAT(id) do { \
30745 if (gru_options & OPT_STATS) \
30746 - atomic_long_inc(&gru_stats.id); \
30747 + atomic_long_inc_unchecked(&gru_stats.id); \
30748 } while (0)
30749
30750 #ifdef CONFIG_SGI_GRU_DEBUG
30751 diff -urNp linux-3.0.9/drivers/misc/sgi-xp/xpc.h linux-3.0.9/drivers/misc/sgi-xp/xpc.h
30752 --- linux-3.0.9/drivers/misc/sgi-xp/xpc.h 2011-11-11 13:12:24.000000000 -0500
30753 +++ linux-3.0.9/drivers/misc/sgi-xp/xpc.h 2011-11-15 20:02:59.000000000 -0500
30754 @@ -835,6 +835,7 @@ struct xpc_arch_operations {
30755 void (*received_payload) (struct xpc_channel *, void *);
30756 void (*notify_senders_of_disconnect) (struct xpc_channel *);
30757 };
30758 +typedef struct xpc_arch_operations __no_const xpc_arch_operations_no_const;
30759
30760 /* struct xpc_partition act_state values (for XPC HB) */
30761
30762 @@ -876,7 +877,7 @@ extern struct xpc_registration xpc_regis
30763 /* found in xpc_main.c */
30764 extern struct device *xpc_part;
30765 extern struct device *xpc_chan;
30766 -extern struct xpc_arch_operations xpc_arch_ops;
30767 +extern xpc_arch_operations_no_const xpc_arch_ops;
30768 extern int xpc_disengage_timelimit;
30769 extern int xpc_disengage_timedout;
30770 extern int xpc_activate_IRQ_rcvd;
30771 diff -urNp linux-3.0.9/drivers/misc/sgi-xp/xpc_main.c linux-3.0.9/drivers/misc/sgi-xp/xpc_main.c
30772 --- linux-3.0.9/drivers/misc/sgi-xp/xpc_main.c 2011-11-11 13:12:24.000000000 -0500
30773 +++ linux-3.0.9/drivers/misc/sgi-xp/xpc_main.c 2011-11-15 20:02:59.000000000 -0500
30774 @@ -162,7 +162,7 @@ static struct notifier_block xpc_die_not
30775 .notifier_call = xpc_system_die,
30776 };
30777
30778 -struct xpc_arch_operations xpc_arch_ops;
30779 +xpc_arch_operations_no_const xpc_arch_ops;
30780
30781 /*
30782 * Timer function to enforce the timelimit on the partition disengage.
30783 diff -urNp linux-3.0.9/drivers/misc/sgi-xp/xp.h linux-3.0.9/drivers/misc/sgi-xp/xp.h
30784 --- linux-3.0.9/drivers/misc/sgi-xp/xp.h 2011-11-11 13:12:24.000000000 -0500
30785 +++ linux-3.0.9/drivers/misc/sgi-xp/xp.h 2011-11-15 20:02:59.000000000 -0500
30786 @@ -289,7 +289,7 @@ struct xpc_interface {
30787 xpc_notify_func, void *);
30788 void (*received) (short, int, void *);
30789 enum xp_retval (*partid_to_nasids) (short, void *);
30790 -};
30791 +} __no_const;
30792
30793 extern struct xpc_interface xpc_interface;
30794
30795 diff -urNp linux-3.0.9/drivers/mmc/host/sdhci-pci.c linux-3.0.9/drivers/mmc/host/sdhci-pci.c
30796 --- linux-3.0.9/drivers/mmc/host/sdhci-pci.c 2011-11-11 13:12:24.000000000 -0500
30797 +++ linux-3.0.9/drivers/mmc/host/sdhci-pci.c 2011-11-15 20:02:59.000000000 -0500
30798 @@ -524,7 +524,7 @@ static const struct sdhci_pci_fixes sdhc
30799 .probe = via_probe,
30800 };
30801
30802 -static const struct pci_device_id pci_ids[] __devinitdata = {
30803 +static const struct pci_device_id pci_ids[] __devinitconst = {
30804 {
30805 .vendor = PCI_VENDOR_ID_RICOH,
30806 .device = PCI_DEVICE_ID_RICOH_R5C822,
30807 diff -urNp linux-3.0.9/drivers/mtd/chips/cfi_cmdset_0001.c linux-3.0.9/drivers/mtd/chips/cfi_cmdset_0001.c
30808 --- linux-3.0.9/drivers/mtd/chips/cfi_cmdset_0001.c 2011-11-11 13:12:24.000000000 -0500
30809 +++ linux-3.0.9/drivers/mtd/chips/cfi_cmdset_0001.c 2011-11-15 20:02:59.000000000 -0500
30810 @@ -757,6 +757,8 @@ static int chip_ready (struct map_info *
30811 struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
30812 unsigned long timeo = jiffies + HZ;
30813
30814 + pax_track_stack();
30815 +
30816 /* Prevent setting state FL_SYNCING for chip in suspended state. */
30817 if (mode == FL_SYNCING && chip->oldstate != FL_READY)
30818 goto sleep;
30819 @@ -1653,6 +1655,8 @@ static int __xipram do_write_buffer(stru
30820 unsigned long initial_adr;
30821 int initial_len = len;
30822
30823 + pax_track_stack();
30824 +
30825 wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
30826 adr += chip->start;
30827 initial_adr = adr;
30828 @@ -1871,6 +1875,8 @@ static int __xipram do_erase_oneblock(st
30829 int retries = 3;
30830 int ret;
30831
30832 + pax_track_stack();
30833 +
30834 adr += chip->start;
30835
30836 retry:
30837 diff -urNp linux-3.0.9/drivers/mtd/chips/cfi_cmdset_0020.c linux-3.0.9/drivers/mtd/chips/cfi_cmdset_0020.c
30838 --- linux-3.0.9/drivers/mtd/chips/cfi_cmdset_0020.c 2011-11-11 13:12:24.000000000 -0500
30839 +++ linux-3.0.9/drivers/mtd/chips/cfi_cmdset_0020.c 2011-11-15 20:02:59.000000000 -0500
30840 @@ -255,6 +255,8 @@ static inline int do_read_onechip(struct
30841 unsigned long cmd_addr;
30842 struct cfi_private *cfi = map->fldrv_priv;
30843
30844 + pax_track_stack();
30845 +
30846 adr += chip->start;
30847
30848 /* Ensure cmd read/writes are aligned. */
30849 @@ -429,6 +431,8 @@ static inline int do_write_buffer(struct
30850 DECLARE_WAITQUEUE(wait, current);
30851 int wbufsize, z;
30852
30853 + pax_track_stack();
30854 +
30855 /* M58LW064A requires bus alignment for buffer wriets -- saw */
30856 if (adr & (map_bankwidth(map)-1))
30857 return -EINVAL;
30858 @@ -743,6 +747,8 @@ static inline int do_erase_oneblock(stru
30859 DECLARE_WAITQUEUE(wait, current);
30860 int ret = 0;
30861
30862 + pax_track_stack();
30863 +
30864 adr += chip->start;
30865
30866 /* Let's determine this according to the interleave only once */
30867 @@ -1048,6 +1054,8 @@ static inline int do_lock_oneblock(struc
30868 unsigned long timeo = jiffies + HZ;
30869 DECLARE_WAITQUEUE(wait, current);
30870
30871 + pax_track_stack();
30872 +
30873 adr += chip->start;
30874
30875 /* Let's determine this according to the interleave only once */
30876 @@ -1197,6 +1205,8 @@ static inline int do_unlock_oneblock(str
30877 unsigned long timeo = jiffies + HZ;
30878 DECLARE_WAITQUEUE(wait, current);
30879
30880 + pax_track_stack();
30881 +
30882 adr += chip->start;
30883
30884 /* Let's determine this according to the interleave only once */
30885 diff -urNp linux-3.0.9/drivers/mtd/devices/doc2000.c linux-3.0.9/drivers/mtd/devices/doc2000.c
30886 --- linux-3.0.9/drivers/mtd/devices/doc2000.c 2011-11-11 13:12:24.000000000 -0500
30887 +++ linux-3.0.9/drivers/mtd/devices/doc2000.c 2011-11-15 20:02:59.000000000 -0500
30888 @@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
30889
30890 /* The ECC will not be calculated correctly if less than 512 is written */
30891 /* DBB-
30892 - if (len != 0x200 && eccbuf)
30893 + if (len != 0x200)
30894 printk(KERN_WARNING
30895 "ECC needs a full sector write (adr: %lx size %lx)\n",
30896 (long) to, (long) len);
30897 diff -urNp linux-3.0.9/drivers/mtd/devices/doc2001.c linux-3.0.9/drivers/mtd/devices/doc2001.c
30898 --- linux-3.0.9/drivers/mtd/devices/doc2001.c 2011-11-11 13:12:24.000000000 -0500
30899 +++ linux-3.0.9/drivers/mtd/devices/doc2001.c 2011-11-15 20:02:59.000000000 -0500
30900 @@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
30901 struct Nand *mychip = &this->chips[from >> (this->chipshift)];
30902
30903 /* Don't allow read past end of device */
30904 - if (from >= this->totlen)
30905 + if (from >= this->totlen || !len)
30906 return -EINVAL;
30907
30908 /* Don't allow a single read to cross a 512-byte block boundary */
30909 diff -urNp linux-3.0.9/drivers/mtd/ftl.c linux-3.0.9/drivers/mtd/ftl.c
30910 --- linux-3.0.9/drivers/mtd/ftl.c 2011-11-11 13:12:24.000000000 -0500
30911 +++ linux-3.0.9/drivers/mtd/ftl.c 2011-11-15 20:02:59.000000000 -0500
30912 @@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *
30913 loff_t offset;
30914 uint16_t srcunitswap = cpu_to_le16(srcunit);
30915
30916 + pax_track_stack();
30917 +
30918 eun = &part->EUNInfo[srcunit];
30919 xfer = &part->XferInfo[xferunit];
30920 DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
30921 diff -urNp linux-3.0.9/drivers/mtd/inftlcore.c linux-3.0.9/drivers/mtd/inftlcore.c
30922 --- linux-3.0.9/drivers/mtd/inftlcore.c 2011-11-11 13:12:24.000000000 -0500
30923 +++ linux-3.0.9/drivers/mtd/inftlcore.c 2011-11-15 20:02:59.000000000 -0500
30924 @@ -259,6 +259,8 @@ static u16 INFTL_foldchain(struct INFTLr
30925 struct inftl_oob oob;
30926 size_t retlen;
30927
30928 + pax_track_stack();
30929 +
30930 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
30931 "pending=%d)\n", inftl, thisVUC, pendingblock);
30932
30933 diff -urNp linux-3.0.9/drivers/mtd/inftlmount.c linux-3.0.9/drivers/mtd/inftlmount.c
30934 --- linux-3.0.9/drivers/mtd/inftlmount.c 2011-11-11 13:12:24.000000000 -0500
30935 +++ linux-3.0.9/drivers/mtd/inftlmount.c 2011-11-15 20:02:59.000000000 -0500
30936 @@ -53,6 +53,8 @@ static int find_boot_record(struct INFTL
30937 struct INFTLPartition *ip;
30938 size_t retlen;
30939
30940 + pax_track_stack();
30941 +
30942 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
30943
30944 /*
30945 diff -urNp linux-3.0.9/drivers/mtd/lpddr/qinfo_probe.c linux-3.0.9/drivers/mtd/lpddr/qinfo_probe.c
30946 --- linux-3.0.9/drivers/mtd/lpddr/qinfo_probe.c 2011-11-11 13:12:24.000000000 -0500
30947 +++ linux-3.0.9/drivers/mtd/lpddr/qinfo_probe.c 2011-11-15 20:02:59.000000000 -0500
30948 @@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map
30949 {
30950 map_word pfow_val[4];
30951
30952 + pax_track_stack();
30953 +
30954 /* Check identification string */
30955 pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
30956 pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
30957 diff -urNp linux-3.0.9/drivers/mtd/mtdchar.c linux-3.0.9/drivers/mtd/mtdchar.c
30958 --- linux-3.0.9/drivers/mtd/mtdchar.c 2011-11-11 13:12:24.000000000 -0500
30959 +++ linux-3.0.9/drivers/mtd/mtdchar.c 2011-11-15 20:02:59.000000000 -0500
30960 @@ -554,6 +554,8 @@ static int mtd_ioctl(struct file *file,
30961 u_long size;
30962 struct mtd_info_user info;
30963
30964 + pax_track_stack();
30965 +
30966 DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
30967
30968 size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
30969 diff -urNp linux-3.0.9/drivers/mtd/nand/denali.c linux-3.0.9/drivers/mtd/nand/denali.c
30970 --- linux-3.0.9/drivers/mtd/nand/denali.c 2011-11-11 13:12:24.000000000 -0500
30971 +++ linux-3.0.9/drivers/mtd/nand/denali.c 2011-11-15 20:02:59.000000000 -0500
30972 @@ -26,6 +26,7 @@
30973 #include <linux/pci.h>
30974 #include <linux/mtd/mtd.h>
30975 #include <linux/module.h>
30976 +#include <linux/slab.h>
30977
30978 #include "denali.h"
30979
30980 diff -urNp linux-3.0.9/drivers/mtd/nftlcore.c linux-3.0.9/drivers/mtd/nftlcore.c
30981 --- linux-3.0.9/drivers/mtd/nftlcore.c 2011-11-11 13:12:24.000000000 -0500
30982 +++ linux-3.0.9/drivers/mtd/nftlcore.c 2011-11-15 20:02:59.000000000 -0500
30983 @@ -264,6 +264,8 @@ static u16 NFTL_foldchain (struct NFTLre
30984 int inplace = 1;
30985 size_t retlen;
30986
30987 + pax_track_stack();
30988 +
30989 memset(BlockMap, 0xff, sizeof(BlockMap));
30990 memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
30991
30992 diff -urNp linux-3.0.9/drivers/mtd/nftlmount.c linux-3.0.9/drivers/mtd/nftlmount.c
30993 --- linux-3.0.9/drivers/mtd/nftlmount.c 2011-11-11 13:12:24.000000000 -0500
30994 +++ linux-3.0.9/drivers/mtd/nftlmount.c 2011-11-15 20:02:59.000000000 -0500
30995 @@ -24,6 +24,7 @@
30996 #include <asm/errno.h>
30997 #include <linux/delay.h>
30998 #include <linux/slab.h>
30999 +#include <linux/sched.h>
31000 #include <linux/mtd/mtd.h>
31001 #include <linux/mtd/nand.h>
31002 #include <linux/mtd/nftl.h>
31003 @@ -45,6 +46,8 @@ static int find_boot_record(struct NFTLr
31004 struct mtd_info *mtd = nftl->mbd.mtd;
31005 unsigned int i;
31006
31007 + pax_track_stack();
31008 +
31009 /* Assume logical EraseSize == physical erasesize for starting the scan.
31010 We'll sort it out later if we find a MediaHeader which says otherwise */
31011 /* Actually, we won't. The new DiskOnChip driver has already scanned
31012 diff -urNp linux-3.0.9/drivers/mtd/ubi/build.c linux-3.0.9/drivers/mtd/ubi/build.c
31013 --- linux-3.0.9/drivers/mtd/ubi/build.c 2011-11-11 13:12:24.000000000 -0500
31014 +++ linux-3.0.9/drivers/mtd/ubi/build.c 2011-11-15 20:02:59.000000000 -0500
31015 @@ -1287,7 +1287,7 @@ module_exit(ubi_exit);
31016 static int __init bytes_str_to_int(const char *str)
31017 {
31018 char *endp;
31019 - unsigned long result;
31020 + unsigned long result, scale = 1;
31021
31022 result = simple_strtoul(str, &endp, 0);
31023 if (str == endp || result >= INT_MAX) {
31024 @@ -1298,11 +1298,11 @@ static int __init bytes_str_to_int(const
31025
31026 switch (*endp) {
31027 case 'G':
31028 - result *= 1024;
31029 + scale *= 1024;
31030 case 'M':
31031 - result *= 1024;
31032 + scale *= 1024;
31033 case 'K':
31034 - result *= 1024;
31035 + scale *= 1024;
31036 if (endp[1] == 'i' && endp[2] == 'B')
31037 endp += 2;
31038 case '\0':
31039 @@ -1313,7 +1313,13 @@ static int __init bytes_str_to_int(const
31040 return -EINVAL;
31041 }
31042
31043 - return result;
31044 + if ((intoverflow_t)result*scale >= INT_MAX) {
31045 + printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
31046 + str);
31047 + return -EINVAL;
31048 + }
31049 +
31050 + return result*scale;
31051 }
31052
31053 /**
31054 diff -urNp linux-3.0.9/drivers/net/atlx/atl2.c linux-3.0.9/drivers/net/atlx/atl2.c
31055 --- linux-3.0.9/drivers/net/atlx/atl2.c 2011-11-11 13:12:24.000000000 -0500
31056 +++ linux-3.0.9/drivers/net/atlx/atl2.c 2011-11-15 20:02:59.000000000 -0500
31057 @@ -2840,7 +2840,7 @@ static void atl2_force_ps(struct atl2_hw
31058 */
31059
31060 #define ATL2_PARAM(X, desc) \
31061 - static const int __devinitdata X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
31062 + static const int __devinitconst X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
31063 MODULE_PARM(X, "1-" __MODULE_STRING(ATL2_MAX_NIC) "i"); \
31064 MODULE_PARM_DESC(X, desc);
31065 #else
31066 diff -urNp linux-3.0.9/drivers/net/bna/bfa_ioc_ct.c linux-3.0.9/drivers/net/bna/bfa_ioc_ct.c
31067 --- linux-3.0.9/drivers/net/bna/bfa_ioc_ct.c 2011-11-11 13:12:24.000000000 -0500
31068 +++ linux-3.0.9/drivers/net/bna/bfa_ioc_ct.c 2011-11-15 20:02:59.000000000 -0500
31069 @@ -48,7 +48,21 @@ static void bfa_ioc_ct_sync_ack(struct b
31070 static bool bfa_ioc_ct_sync_complete(struct bfa_ioc *ioc);
31071 static enum bfa_status bfa_ioc_ct_pll_init(void __iomem *rb, bool fcmode);
31072
31073 -static struct bfa_ioc_hwif nw_hwif_ct;
31074 +static struct bfa_ioc_hwif nw_hwif_ct = {
31075 + .ioc_pll_init = bfa_ioc_ct_pll_init,
31076 + .ioc_firmware_lock = bfa_ioc_ct_firmware_lock,
31077 + .ioc_firmware_unlock = bfa_ioc_ct_firmware_unlock,
31078 + .ioc_reg_init = bfa_ioc_ct_reg_init,
31079 + .ioc_map_port = bfa_ioc_ct_map_port,
31080 + .ioc_isr_mode_set = bfa_ioc_ct_isr_mode_set,
31081 + .ioc_notify_fail = bfa_ioc_ct_notify_fail,
31082 + .ioc_ownership_reset = bfa_ioc_ct_ownership_reset,
31083 + .ioc_sync_start = bfa_ioc_ct_sync_start,
31084 + .ioc_sync_join = bfa_ioc_ct_sync_join,
31085 + .ioc_sync_leave = bfa_ioc_ct_sync_leave,
31086 + .ioc_sync_ack = bfa_ioc_ct_sync_ack,
31087 + .ioc_sync_complete = bfa_ioc_ct_sync_complete
31088 +};
31089
31090 /**
31091 * Called from bfa_ioc_attach() to map asic specific calls.
31092 @@ -56,20 +70,6 @@ static struct bfa_ioc_hwif nw_hwif_ct;
31093 void
31094 bfa_nw_ioc_set_ct_hwif(struct bfa_ioc *ioc)
31095 {
31096 - nw_hwif_ct.ioc_pll_init = bfa_ioc_ct_pll_init;
31097 - nw_hwif_ct.ioc_firmware_lock = bfa_ioc_ct_firmware_lock;
31098 - nw_hwif_ct.ioc_firmware_unlock = bfa_ioc_ct_firmware_unlock;
31099 - nw_hwif_ct.ioc_reg_init = bfa_ioc_ct_reg_init;
31100 - nw_hwif_ct.ioc_map_port = bfa_ioc_ct_map_port;
31101 - nw_hwif_ct.ioc_isr_mode_set = bfa_ioc_ct_isr_mode_set;
31102 - nw_hwif_ct.ioc_notify_fail = bfa_ioc_ct_notify_fail;
31103 - nw_hwif_ct.ioc_ownership_reset = bfa_ioc_ct_ownership_reset;
31104 - nw_hwif_ct.ioc_sync_start = bfa_ioc_ct_sync_start;
31105 - nw_hwif_ct.ioc_sync_join = bfa_ioc_ct_sync_join;
31106 - nw_hwif_ct.ioc_sync_leave = bfa_ioc_ct_sync_leave;
31107 - nw_hwif_ct.ioc_sync_ack = bfa_ioc_ct_sync_ack;
31108 - nw_hwif_ct.ioc_sync_complete = bfa_ioc_ct_sync_complete;
31109 -
31110 ioc->ioc_hwif = &nw_hwif_ct;
31111 }
31112
31113 diff -urNp linux-3.0.9/drivers/net/bna/bnad.c linux-3.0.9/drivers/net/bna/bnad.c
31114 --- linux-3.0.9/drivers/net/bna/bnad.c 2011-11-11 13:12:24.000000000 -0500
31115 +++ linux-3.0.9/drivers/net/bna/bnad.c 2011-11-15 20:02:59.000000000 -0500
31116 @@ -1681,7 +1681,14 @@ bnad_setup_tx(struct bnad *bnad, uint tx
31117 struct bna_intr_info *intr_info =
31118 &res_info[BNA_TX_RES_INTR_T_TXCMPL].res_u.intr_info;
31119 struct bna_tx_config *tx_config = &bnad->tx_config[tx_id];
31120 - struct bna_tx_event_cbfn tx_cbfn;
31121 + static struct bna_tx_event_cbfn tx_cbfn = {
31122 + /* Initialize the tx event handlers */
31123 + .tcb_setup_cbfn = bnad_cb_tcb_setup,
31124 + .tcb_destroy_cbfn = bnad_cb_tcb_destroy,
31125 + .tx_stall_cbfn = bnad_cb_tx_stall,
31126 + .tx_resume_cbfn = bnad_cb_tx_resume,
31127 + .tx_cleanup_cbfn = bnad_cb_tx_cleanup
31128 + };
31129 struct bna_tx *tx;
31130 unsigned long flags;
31131
31132 @@ -1690,13 +1697,6 @@ bnad_setup_tx(struct bnad *bnad, uint tx
31133 tx_config->txq_depth = bnad->txq_depth;
31134 tx_config->tx_type = BNA_TX_T_REGULAR;
31135
31136 - /* Initialize the tx event handlers */
31137 - tx_cbfn.tcb_setup_cbfn = bnad_cb_tcb_setup;
31138 - tx_cbfn.tcb_destroy_cbfn = bnad_cb_tcb_destroy;
31139 - tx_cbfn.tx_stall_cbfn = bnad_cb_tx_stall;
31140 - tx_cbfn.tx_resume_cbfn = bnad_cb_tx_resume;
31141 - tx_cbfn.tx_cleanup_cbfn = bnad_cb_tx_cleanup;
31142 -
31143 /* Get BNA's resource requirement for one tx object */
31144 spin_lock_irqsave(&bnad->bna_lock, flags);
31145 bna_tx_res_req(bnad->num_txq_per_tx,
31146 @@ -1827,21 +1827,21 @@ bnad_setup_rx(struct bnad *bnad, uint rx
31147 struct bna_intr_info *intr_info =
31148 &res_info[BNA_RX_RES_T_INTR].res_u.intr_info;
31149 struct bna_rx_config *rx_config = &bnad->rx_config[rx_id];
31150 - struct bna_rx_event_cbfn rx_cbfn;
31151 + static struct bna_rx_event_cbfn rx_cbfn = {
31152 + /* Initialize the Rx event handlers */
31153 + .rcb_setup_cbfn = bnad_cb_rcb_setup,
31154 + .rcb_destroy_cbfn = bnad_cb_rcb_destroy,
31155 + .ccb_setup_cbfn = bnad_cb_ccb_setup,
31156 + .ccb_destroy_cbfn = bnad_cb_ccb_destroy,
31157 + .rx_cleanup_cbfn = bnad_cb_rx_cleanup,
31158 + .rx_post_cbfn = bnad_cb_rx_post
31159 + };
31160 struct bna_rx *rx;
31161 unsigned long flags;
31162
31163 /* Initialize the Rx object configuration */
31164 bnad_init_rx_config(bnad, rx_config);
31165
31166 - /* Initialize the Rx event handlers */
31167 - rx_cbfn.rcb_setup_cbfn = bnad_cb_rcb_setup;
31168 - rx_cbfn.rcb_destroy_cbfn = bnad_cb_rcb_destroy;
31169 - rx_cbfn.ccb_setup_cbfn = bnad_cb_ccb_setup;
31170 - rx_cbfn.ccb_destroy_cbfn = bnad_cb_ccb_destroy;
31171 - rx_cbfn.rx_cleanup_cbfn = bnad_cb_rx_cleanup;
31172 - rx_cbfn.rx_post_cbfn = bnad_cb_rx_post;
31173 -
31174 /* Get BNA's resource requirement for one Rx object */
31175 spin_lock_irqsave(&bnad->bna_lock, flags);
31176 bna_rx_res_req(rx_config, res_info);
31177 diff -urNp linux-3.0.9/drivers/net/bnx2.c linux-3.0.9/drivers/net/bnx2.c
31178 --- linux-3.0.9/drivers/net/bnx2.c 2011-11-11 13:12:24.000000000 -0500
31179 +++ linux-3.0.9/drivers/net/bnx2.c 2011-11-15 20:02:59.000000000 -0500
31180 @@ -5831,6 +5831,8 @@ bnx2_test_nvram(struct bnx2 *bp)
31181 int rc = 0;
31182 u32 magic, csum;
31183
31184 + pax_track_stack();
31185 +
31186 if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
31187 goto test_nvram_done;
31188
31189 diff -urNp linux-3.0.9/drivers/net/bnx2x/bnx2x_ethtool.c linux-3.0.9/drivers/net/bnx2x/bnx2x_ethtool.c
31190 --- linux-3.0.9/drivers/net/bnx2x/bnx2x_ethtool.c 2011-11-11 13:12:24.000000000 -0500
31191 +++ linux-3.0.9/drivers/net/bnx2x/bnx2x_ethtool.c 2011-11-15 20:02:59.000000000 -0500
31192 @@ -1705,6 +1705,8 @@ static int bnx2x_test_nvram(struct bnx2x
31193 int i, rc;
31194 u32 magic, crc;
31195
31196 + pax_track_stack();
31197 +
31198 if (BP_NOMCP(bp))
31199 return 0;
31200
31201 diff -urNp linux-3.0.9/drivers/net/can/mscan/mscan.c linux-3.0.9/drivers/net/can/mscan/mscan.c
31202 --- linux-3.0.9/drivers/net/can/mscan/mscan.c 2011-11-11 13:12:24.000000000 -0500
31203 +++ linux-3.0.9/drivers/net/can/mscan/mscan.c 2011-11-15 20:02:59.000000000 -0500
31204 @@ -261,11 +261,13 @@ static netdev_tx_t mscan_start_xmit(stru
31205 void __iomem *data = &regs->tx.dsr1_0;
31206 u16 *payload = (u16 *)frame->data;
31207
31208 - /* It is safe to write into dsr[dlc+1] */
31209 - for (i = 0; i < (frame->can_dlc + 1) / 2; i++) {
31210 + for (i = 0; i < frame->can_dlc / 2; i++) {
31211 out_be16(data, *payload++);
31212 data += 2 + _MSCAN_RESERVED_DSR_SIZE;
31213 }
31214 + /* write remaining byte if necessary */
31215 + if (frame->can_dlc & 1)
31216 + out_8(data, frame->data[frame->can_dlc - 1]);
31217 }
31218
31219 out_8(&regs->tx.dlr, frame->can_dlc);
31220 @@ -330,10 +332,13 @@ static void mscan_get_rx_frame(struct ne
31221 void __iomem *data = &regs->rx.dsr1_0;
31222 u16 *payload = (u16 *)frame->data;
31223
31224 - for (i = 0; i < (frame->can_dlc + 1) / 2; i++) {
31225 + for (i = 0; i < frame->can_dlc / 2; i++) {
31226 *payload++ = in_be16(data);
31227 data += 2 + _MSCAN_RESERVED_DSR_SIZE;
31228 }
31229 + /* read remaining byte if necessary */
31230 + if (frame->can_dlc & 1)
31231 + frame->data[frame->can_dlc - 1] = in_8(data);
31232 }
31233
31234 out_8(&regs->canrflg, MSCAN_RXF);
31235 diff -urNp linux-3.0.9/drivers/net/cxgb3/l2t.h linux-3.0.9/drivers/net/cxgb3/l2t.h
31236 --- linux-3.0.9/drivers/net/cxgb3/l2t.h 2011-11-11 13:12:24.000000000 -0500
31237 +++ linux-3.0.9/drivers/net/cxgb3/l2t.h 2011-11-15 20:02:59.000000000 -0500
31238 @@ -87,7 +87,7 @@ typedef void (*arp_failure_handler_func)
31239 */
31240 struct l2t_skb_cb {
31241 arp_failure_handler_func arp_failure_handler;
31242 -};
31243 +} __no_const;
31244
31245 #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb)
31246
31247 diff -urNp linux-3.0.9/drivers/net/cxgb4/cxgb4_main.c linux-3.0.9/drivers/net/cxgb4/cxgb4_main.c
31248 --- linux-3.0.9/drivers/net/cxgb4/cxgb4_main.c 2011-11-11 13:12:24.000000000 -0500
31249 +++ linux-3.0.9/drivers/net/cxgb4/cxgb4_main.c 2011-11-15 20:02:59.000000000 -0500
31250 @@ -3396,6 +3396,8 @@ static int __devinit enable_msix(struct
31251 unsigned int nchan = adap->params.nports;
31252 struct msix_entry entries[MAX_INGQ + 1];
31253
31254 + pax_track_stack();
31255 +
31256 for (i = 0; i < ARRAY_SIZE(entries); ++i)
31257 entries[i].entry = i;
31258
31259 diff -urNp linux-3.0.9/drivers/net/cxgb4/t4_hw.c linux-3.0.9/drivers/net/cxgb4/t4_hw.c
31260 --- linux-3.0.9/drivers/net/cxgb4/t4_hw.c 2011-11-11 13:12:24.000000000 -0500
31261 +++ linux-3.0.9/drivers/net/cxgb4/t4_hw.c 2011-11-15 20:02:59.000000000 -0500
31262 @@ -362,6 +362,8 @@ static int get_vpd_params(struct adapter
31263 u8 vpd[VPD_LEN], csum;
31264 unsigned int vpdr_len, kw_offset, id_len;
31265
31266 + pax_track_stack();
31267 +
31268 ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(vpd), vpd);
31269 if (ret < 0)
31270 return ret;
31271 diff -urNp linux-3.0.9/drivers/net/e1000e/82571.c linux-3.0.9/drivers/net/e1000e/82571.c
31272 --- linux-3.0.9/drivers/net/e1000e/82571.c 2011-11-11 13:12:24.000000000 -0500
31273 +++ linux-3.0.9/drivers/net/e1000e/82571.c 2011-11-15 20:02:59.000000000 -0500
31274 @@ -239,7 +239,7 @@ static s32 e1000_init_mac_params_82571(s
31275 {
31276 struct e1000_hw *hw = &adapter->hw;
31277 struct e1000_mac_info *mac = &hw->mac;
31278 - struct e1000_mac_operations *func = &mac->ops;
31279 + e1000_mac_operations_no_const *func = &mac->ops;
31280 u32 swsm = 0;
31281 u32 swsm2 = 0;
31282 bool force_clear_smbi = false;
31283 diff -urNp linux-3.0.9/drivers/net/e1000e/es2lan.c linux-3.0.9/drivers/net/e1000e/es2lan.c
31284 --- linux-3.0.9/drivers/net/e1000e/es2lan.c 2011-11-11 13:12:24.000000000 -0500
31285 +++ linux-3.0.9/drivers/net/e1000e/es2lan.c 2011-11-15 20:02:59.000000000 -0500
31286 @@ -205,7 +205,7 @@ static s32 e1000_init_mac_params_80003es
31287 {
31288 struct e1000_hw *hw = &adapter->hw;
31289 struct e1000_mac_info *mac = &hw->mac;
31290 - struct e1000_mac_operations *func = &mac->ops;
31291 + e1000_mac_operations_no_const *func = &mac->ops;
31292
31293 /* Set media type */
31294 switch (adapter->pdev->device) {
31295 diff -urNp linux-3.0.9/drivers/net/e1000e/hw.h linux-3.0.9/drivers/net/e1000e/hw.h
31296 --- linux-3.0.9/drivers/net/e1000e/hw.h 2011-11-11 13:12:24.000000000 -0500
31297 +++ linux-3.0.9/drivers/net/e1000e/hw.h 2011-11-15 20:02:59.000000000 -0500
31298 @@ -776,6 +776,7 @@ struct e1000_mac_operations {
31299 void (*write_vfta)(struct e1000_hw *, u32, u32);
31300 s32 (*read_mac_addr)(struct e1000_hw *);
31301 };
31302 +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
31303
31304 /* Function pointers for the PHY. */
31305 struct e1000_phy_operations {
31306 @@ -799,6 +800,7 @@ struct e1000_phy_operations {
31307 void (*power_up)(struct e1000_hw *);
31308 void (*power_down)(struct e1000_hw *);
31309 };
31310 +typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
31311
31312 /* Function pointers for the NVM. */
31313 struct e1000_nvm_operations {
31314 @@ -810,9 +812,10 @@ struct e1000_nvm_operations {
31315 s32 (*validate)(struct e1000_hw *);
31316 s32 (*write)(struct e1000_hw *, u16, u16, u16 *);
31317 };
31318 +typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
31319
31320 struct e1000_mac_info {
31321 - struct e1000_mac_operations ops;
31322 + e1000_mac_operations_no_const ops;
31323 u8 addr[ETH_ALEN];
31324 u8 perm_addr[ETH_ALEN];
31325
31326 @@ -853,7 +856,7 @@ struct e1000_mac_info {
31327 };
31328
31329 struct e1000_phy_info {
31330 - struct e1000_phy_operations ops;
31331 + e1000_phy_operations_no_const ops;
31332
31333 enum e1000_phy_type type;
31334
31335 @@ -887,7 +890,7 @@ struct e1000_phy_info {
31336 };
31337
31338 struct e1000_nvm_info {
31339 - struct e1000_nvm_operations ops;
31340 + e1000_nvm_operations_no_const ops;
31341
31342 enum e1000_nvm_type type;
31343 enum e1000_nvm_override override;
31344 diff -urNp linux-3.0.9/drivers/net/fealnx.c linux-3.0.9/drivers/net/fealnx.c
31345 --- linux-3.0.9/drivers/net/fealnx.c 2011-11-11 13:12:24.000000000 -0500
31346 +++ linux-3.0.9/drivers/net/fealnx.c 2011-11-15 20:02:59.000000000 -0500
31347 @@ -150,7 +150,7 @@ struct chip_info {
31348 int flags;
31349 };
31350
31351 -static const struct chip_info skel_netdrv_tbl[] __devinitdata = {
31352 +static const struct chip_info skel_netdrv_tbl[] __devinitconst = {
31353 { "100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
31354 { "100/10M Ethernet PCI Adapter", HAS_CHIP_XCVR },
31355 { "1000/100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
31356 diff -urNp linux-3.0.9/drivers/net/hamradio/6pack.c linux-3.0.9/drivers/net/hamradio/6pack.c
31357 --- linux-3.0.9/drivers/net/hamradio/6pack.c 2011-11-11 13:12:24.000000000 -0500
31358 +++ linux-3.0.9/drivers/net/hamradio/6pack.c 2011-11-15 20:02:59.000000000 -0500
31359 @@ -463,6 +463,8 @@ static void sixpack_receive_buf(struct t
31360 unsigned char buf[512];
31361 int count1;
31362
31363 + pax_track_stack();
31364 +
31365 if (!count)
31366 return;
31367
31368 diff -urNp linux-3.0.9/drivers/net/igb/e1000_hw.h linux-3.0.9/drivers/net/igb/e1000_hw.h
31369 --- linux-3.0.9/drivers/net/igb/e1000_hw.h 2011-11-11 13:12:24.000000000 -0500
31370 +++ linux-3.0.9/drivers/net/igb/e1000_hw.h 2011-11-15 20:02:59.000000000 -0500
31371 @@ -314,6 +314,7 @@ struct e1000_mac_operations {
31372 s32 (*read_mac_addr)(struct e1000_hw *);
31373 s32 (*get_speed_and_duplex)(struct e1000_hw *, u16 *, u16 *);
31374 };
31375 +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
31376
31377 struct e1000_phy_operations {
31378 s32 (*acquire)(struct e1000_hw *);
31379 @@ -330,6 +331,7 @@ struct e1000_phy_operations {
31380 s32 (*set_d3_lplu_state)(struct e1000_hw *, bool);
31381 s32 (*write_reg)(struct e1000_hw *, u32, u16);
31382 };
31383 +typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
31384
31385 struct e1000_nvm_operations {
31386 s32 (*acquire)(struct e1000_hw *);
31387 @@ -339,6 +341,7 @@ struct e1000_nvm_operations {
31388 s32 (*update)(struct e1000_hw *);
31389 s32 (*validate)(struct e1000_hw *);
31390 };
31391 +typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
31392
31393 struct e1000_info {
31394 s32 (*get_invariants)(struct e1000_hw *);
31395 @@ -350,7 +353,7 @@ struct e1000_info {
31396 extern const struct e1000_info e1000_82575_info;
31397
31398 struct e1000_mac_info {
31399 - struct e1000_mac_operations ops;
31400 + e1000_mac_operations_no_const ops;
31401
31402 u8 addr[6];
31403 u8 perm_addr[6];
31404 @@ -388,7 +391,7 @@ struct e1000_mac_info {
31405 };
31406
31407 struct e1000_phy_info {
31408 - struct e1000_phy_operations ops;
31409 + e1000_phy_operations_no_const ops;
31410
31411 enum e1000_phy_type type;
31412
31413 @@ -423,7 +426,7 @@ struct e1000_phy_info {
31414 };
31415
31416 struct e1000_nvm_info {
31417 - struct e1000_nvm_operations ops;
31418 + e1000_nvm_operations_no_const ops;
31419 enum e1000_nvm_type type;
31420 enum e1000_nvm_override override;
31421
31422 @@ -468,6 +471,7 @@ struct e1000_mbx_operations {
31423 s32 (*check_for_ack)(struct e1000_hw *, u16);
31424 s32 (*check_for_rst)(struct e1000_hw *, u16);
31425 };
31426 +typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
31427
31428 struct e1000_mbx_stats {
31429 u32 msgs_tx;
31430 @@ -479,7 +483,7 @@ struct e1000_mbx_stats {
31431 };
31432
31433 struct e1000_mbx_info {
31434 - struct e1000_mbx_operations ops;
31435 + e1000_mbx_operations_no_const ops;
31436 struct e1000_mbx_stats stats;
31437 u32 timeout;
31438 u32 usec_delay;
31439 diff -urNp linux-3.0.9/drivers/net/igbvf/vf.h linux-3.0.9/drivers/net/igbvf/vf.h
31440 --- linux-3.0.9/drivers/net/igbvf/vf.h 2011-11-11 13:12:24.000000000 -0500
31441 +++ linux-3.0.9/drivers/net/igbvf/vf.h 2011-11-15 20:02:59.000000000 -0500
31442 @@ -189,9 +189,10 @@ struct e1000_mac_operations {
31443 s32 (*read_mac_addr)(struct e1000_hw *);
31444 s32 (*set_vfta)(struct e1000_hw *, u16, bool);
31445 };
31446 +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
31447
31448 struct e1000_mac_info {
31449 - struct e1000_mac_operations ops;
31450 + e1000_mac_operations_no_const ops;
31451 u8 addr[6];
31452 u8 perm_addr[6];
31453
31454 @@ -213,6 +214,7 @@ struct e1000_mbx_operations {
31455 s32 (*check_for_ack)(struct e1000_hw *);
31456 s32 (*check_for_rst)(struct e1000_hw *);
31457 };
31458 +typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
31459
31460 struct e1000_mbx_stats {
31461 u32 msgs_tx;
31462 @@ -224,7 +226,7 @@ struct e1000_mbx_stats {
31463 };
31464
31465 struct e1000_mbx_info {
31466 - struct e1000_mbx_operations ops;
31467 + e1000_mbx_operations_no_const ops;
31468 struct e1000_mbx_stats stats;
31469 u32 timeout;
31470 u32 usec_delay;
31471 diff -urNp linux-3.0.9/drivers/net/ixgb/ixgb_main.c linux-3.0.9/drivers/net/ixgb/ixgb_main.c
31472 --- linux-3.0.9/drivers/net/ixgb/ixgb_main.c 2011-11-11 13:12:24.000000000 -0500
31473 +++ linux-3.0.9/drivers/net/ixgb/ixgb_main.c 2011-11-15 20:02:59.000000000 -0500
31474 @@ -1070,6 +1070,8 @@ ixgb_set_multi(struct net_device *netdev
31475 u32 rctl;
31476 int i;
31477
31478 + pax_track_stack();
31479 +
31480 /* Check for Promiscuous and All Multicast modes */
31481
31482 rctl = IXGB_READ_REG(hw, RCTL);
31483 diff -urNp linux-3.0.9/drivers/net/ixgb/ixgb_param.c linux-3.0.9/drivers/net/ixgb/ixgb_param.c
31484 --- linux-3.0.9/drivers/net/ixgb/ixgb_param.c 2011-11-11 13:12:24.000000000 -0500
31485 +++ linux-3.0.9/drivers/net/ixgb/ixgb_param.c 2011-11-15 20:02:59.000000000 -0500
31486 @@ -261,6 +261,9 @@ void __devinit
31487 ixgb_check_options(struct ixgb_adapter *adapter)
31488 {
31489 int bd = adapter->bd_number;
31490 +
31491 + pax_track_stack();
31492 +
31493 if (bd >= IXGB_MAX_NIC) {
31494 pr_notice("Warning: no configuration for board #%i\n", bd);
31495 pr_notice("Using defaults for all values\n");
31496 diff -urNp linux-3.0.9/drivers/net/ixgbe/ixgbe_type.h linux-3.0.9/drivers/net/ixgbe/ixgbe_type.h
31497 --- linux-3.0.9/drivers/net/ixgbe/ixgbe_type.h 2011-11-11 13:12:24.000000000 -0500
31498 +++ linux-3.0.9/drivers/net/ixgbe/ixgbe_type.h 2011-11-15 20:02:59.000000000 -0500
31499 @@ -2584,6 +2584,7 @@ struct ixgbe_eeprom_operations {
31500 s32 (*update_checksum)(struct ixgbe_hw *);
31501 u16 (*calc_checksum)(struct ixgbe_hw *);
31502 };
31503 +typedef struct ixgbe_eeprom_operations __no_const ixgbe_eeprom_operations_no_const;
31504
31505 struct ixgbe_mac_operations {
31506 s32 (*init_hw)(struct ixgbe_hw *);
31507 @@ -2639,6 +2640,7 @@ struct ixgbe_mac_operations {
31508 /* Flow Control */
31509 s32 (*fc_enable)(struct ixgbe_hw *, s32);
31510 };
31511 +typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
31512
31513 struct ixgbe_phy_operations {
31514 s32 (*identify)(struct ixgbe_hw *);
31515 @@ -2658,9 +2660,10 @@ struct ixgbe_phy_operations {
31516 s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8);
31517 s32 (*check_overtemp)(struct ixgbe_hw *);
31518 };
31519 +typedef struct ixgbe_phy_operations __no_const ixgbe_phy_operations_no_const;
31520
31521 struct ixgbe_eeprom_info {
31522 - struct ixgbe_eeprom_operations ops;
31523 + ixgbe_eeprom_operations_no_const ops;
31524 enum ixgbe_eeprom_type type;
31525 u32 semaphore_delay;
31526 u16 word_size;
31527 @@ -2670,7 +2673,7 @@ struct ixgbe_eeprom_info {
31528
31529 #define IXGBE_FLAGS_DOUBLE_RESET_REQUIRED 0x01
31530 struct ixgbe_mac_info {
31531 - struct ixgbe_mac_operations ops;
31532 + ixgbe_mac_operations_no_const ops;
31533 enum ixgbe_mac_type type;
31534 u8 addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
31535 u8 perm_addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
31536 @@ -2698,7 +2701,7 @@ struct ixgbe_mac_info {
31537 };
31538
31539 struct ixgbe_phy_info {
31540 - struct ixgbe_phy_operations ops;
31541 + ixgbe_phy_operations_no_const ops;
31542 struct mdio_if_info mdio;
31543 enum ixgbe_phy_type type;
31544 u32 id;
31545 @@ -2726,6 +2729,7 @@ struct ixgbe_mbx_operations {
31546 s32 (*check_for_ack)(struct ixgbe_hw *, u16);
31547 s32 (*check_for_rst)(struct ixgbe_hw *, u16);
31548 };
31549 +typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const;
31550
31551 struct ixgbe_mbx_stats {
31552 u32 msgs_tx;
31553 @@ -2737,7 +2741,7 @@ struct ixgbe_mbx_stats {
31554 };
31555
31556 struct ixgbe_mbx_info {
31557 - struct ixgbe_mbx_operations ops;
31558 + ixgbe_mbx_operations_no_const ops;
31559 struct ixgbe_mbx_stats stats;
31560 u32 timeout;
31561 u32 usec_delay;
31562 diff -urNp linux-3.0.9/drivers/net/ixgbevf/vf.h linux-3.0.9/drivers/net/ixgbevf/vf.h
31563 --- linux-3.0.9/drivers/net/ixgbevf/vf.h 2011-11-11 13:12:24.000000000 -0500
31564 +++ linux-3.0.9/drivers/net/ixgbevf/vf.h 2011-11-15 20:02:59.000000000 -0500
31565 @@ -70,6 +70,7 @@ struct ixgbe_mac_operations {
31566 s32 (*clear_vfta)(struct ixgbe_hw *);
31567 s32 (*set_vfta)(struct ixgbe_hw *, u32, u32, bool);
31568 };
31569 +typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
31570
31571 enum ixgbe_mac_type {
31572 ixgbe_mac_unknown = 0,
31573 @@ -79,7 +80,7 @@ enum ixgbe_mac_type {
31574 };
31575
31576 struct ixgbe_mac_info {
31577 - struct ixgbe_mac_operations ops;
31578 + ixgbe_mac_operations_no_const ops;
31579 u8 addr[6];
31580 u8 perm_addr[6];
31581
31582 @@ -103,6 +104,7 @@ struct ixgbe_mbx_operations {
31583 s32 (*check_for_ack)(struct ixgbe_hw *);
31584 s32 (*check_for_rst)(struct ixgbe_hw *);
31585 };
31586 +typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const;
31587
31588 struct ixgbe_mbx_stats {
31589 u32 msgs_tx;
31590 @@ -114,7 +116,7 @@ struct ixgbe_mbx_stats {
31591 };
31592
31593 struct ixgbe_mbx_info {
31594 - struct ixgbe_mbx_operations ops;
31595 + ixgbe_mbx_operations_no_const ops;
31596 struct ixgbe_mbx_stats stats;
31597 u32 timeout;
31598 u32 udelay;
31599 diff -urNp linux-3.0.9/drivers/net/ksz884x.c linux-3.0.9/drivers/net/ksz884x.c
31600 --- linux-3.0.9/drivers/net/ksz884x.c 2011-11-11 13:12:24.000000000 -0500
31601 +++ linux-3.0.9/drivers/net/ksz884x.c 2011-11-15 20:02:59.000000000 -0500
31602 @@ -6534,6 +6534,8 @@ static void netdev_get_ethtool_stats(str
31603 int rc;
31604 u64 counter[TOTAL_PORT_COUNTER_NUM];
31605
31606 + pax_track_stack();
31607 +
31608 mutex_lock(&hw_priv->lock);
31609 n = SWITCH_PORT_NUM;
31610 for (i = 0, p = port->first_port; i < port->mib_port_cnt; i++, p++) {
31611 diff -urNp linux-3.0.9/drivers/net/mlx4/main.c linux-3.0.9/drivers/net/mlx4/main.c
31612 --- linux-3.0.9/drivers/net/mlx4/main.c 2011-11-11 13:12:24.000000000 -0500
31613 +++ linux-3.0.9/drivers/net/mlx4/main.c 2011-11-15 20:02:59.000000000 -0500
31614 @@ -40,6 +40,7 @@
31615 #include <linux/dma-mapping.h>
31616 #include <linux/slab.h>
31617 #include <linux/io-mapping.h>
31618 +#include <linux/sched.h>
31619
31620 #include <linux/mlx4/device.h>
31621 #include <linux/mlx4/doorbell.h>
31622 @@ -764,6 +765,8 @@ static int mlx4_init_hca(struct mlx4_dev
31623 u64 icm_size;
31624 int err;
31625
31626 + pax_track_stack();
31627 +
31628 err = mlx4_QUERY_FW(dev);
31629 if (err) {
31630 if (err == -EACCES)
31631 diff -urNp linux-3.0.9/drivers/net/niu.c linux-3.0.9/drivers/net/niu.c
31632 --- linux-3.0.9/drivers/net/niu.c 2011-11-11 13:12:24.000000000 -0500
31633 +++ linux-3.0.9/drivers/net/niu.c 2011-11-15 20:02:59.000000000 -0500
31634 @@ -9056,6 +9056,8 @@ static void __devinit niu_try_msix(struc
31635 int i, num_irqs, err;
31636 u8 first_ldg;
31637
31638 + pax_track_stack();
31639 +
31640 first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
31641 for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
31642 ldg_num_map[i] = first_ldg + i;
31643 diff -urNp linux-3.0.9/drivers/net/pcnet32.c linux-3.0.9/drivers/net/pcnet32.c
31644 --- linux-3.0.9/drivers/net/pcnet32.c 2011-11-11 13:12:24.000000000 -0500
31645 +++ linux-3.0.9/drivers/net/pcnet32.c 2011-11-15 20:02:59.000000000 -0500
31646 @@ -82,7 +82,7 @@ static int cards_found;
31647 /*
31648 * VLB I/O addresses
31649 */
31650 -static unsigned int pcnet32_portlist[] __initdata =
31651 +static unsigned int pcnet32_portlist[] __devinitdata =
31652 { 0x300, 0x320, 0x340, 0x360, 0 };
31653
31654 static int pcnet32_debug;
31655 @@ -270,7 +270,7 @@ struct pcnet32_private {
31656 struct sk_buff **rx_skbuff;
31657 dma_addr_t *tx_dma_addr;
31658 dma_addr_t *rx_dma_addr;
31659 - struct pcnet32_access a;
31660 + struct pcnet32_access *a;
31661 spinlock_t lock; /* Guard lock */
31662 unsigned int cur_rx, cur_tx; /* The next free ring entry */
31663 unsigned int rx_ring_size; /* current rx ring size */
31664 @@ -460,9 +460,9 @@ static void pcnet32_netif_start(struct n
31665 u16 val;
31666
31667 netif_wake_queue(dev);
31668 - val = lp->a.read_csr(ioaddr, CSR3);
31669 + val = lp->a->read_csr(ioaddr, CSR3);
31670 val &= 0x00ff;
31671 - lp->a.write_csr(ioaddr, CSR3, val);
31672 + lp->a->write_csr(ioaddr, CSR3, val);
31673 napi_enable(&lp->napi);
31674 }
31675
31676 @@ -730,7 +730,7 @@ static u32 pcnet32_get_link(struct net_d
31677 r = mii_link_ok(&lp->mii_if);
31678 } else if (lp->chip_version >= PCNET32_79C970A) {
31679 ulong ioaddr = dev->base_addr; /* card base I/O address */
31680 - r = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
31681 + r = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
31682 } else { /* can not detect link on really old chips */
31683 r = 1;
31684 }
31685 @@ -792,7 +792,7 @@ static int pcnet32_set_ringparam(struct
31686 pcnet32_netif_stop(dev);
31687
31688 spin_lock_irqsave(&lp->lock, flags);
31689 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
31690 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
31691
31692 size = min(ering->tx_pending, (unsigned int)TX_MAX_RING_SIZE);
31693
31694 @@ -868,7 +868,7 @@ static void pcnet32_ethtool_test(struct
31695 static int pcnet32_loopback_test(struct net_device *dev, uint64_t * data1)
31696 {
31697 struct pcnet32_private *lp = netdev_priv(dev);
31698 - struct pcnet32_access *a = &lp->a; /* access to registers */
31699 + struct pcnet32_access *a = lp->a; /* access to registers */
31700 ulong ioaddr = dev->base_addr; /* card base I/O address */
31701 struct sk_buff *skb; /* sk buff */
31702 int x, i; /* counters */
31703 @@ -888,21 +888,21 @@ static int pcnet32_loopback_test(struct
31704 pcnet32_netif_stop(dev);
31705
31706 spin_lock_irqsave(&lp->lock, flags);
31707 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
31708 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* stop the chip */
31709
31710 numbuffs = min(numbuffs, (int)min(lp->rx_ring_size, lp->tx_ring_size));
31711
31712 /* Reset the PCNET32 */
31713 - lp->a.reset(ioaddr);
31714 - lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
31715 + lp->a->reset(ioaddr);
31716 + lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
31717
31718 /* switch pcnet32 to 32bit mode */
31719 - lp->a.write_bcr(ioaddr, 20, 2);
31720 + lp->a->write_bcr(ioaddr, 20, 2);
31721
31722 /* purge & init rings but don't actually restart */
31723 pcnet32_restart(dev, 0x0000);
31724
31725 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
31726 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
31727
31728 /* Initialize Transmit buffers. */
31729 size = data_len + 15;
31730 @@ -947,10 +947,10 @@ static int pcnet32_loopback_test(struct
31731
31732 /* set int loopback in CSR15 */
31733 x = a->read_csr(ioaddr, CSR15) & 0xfffc;
31734 - lp->a.write_csr(ioaddr, CSR15, x | 0x0044);
31735 + lp->a->write_csr(ioaddr, CSR15, x | 0x0044);
31736
31737 teststatus = cpu_to_le16(0x8000);
31738 - lp->a.write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
31739 + lp->a->write_csr(ioaddr, CSR0, CSR0_START); /* Set STRT bit */
31740
31741 /* Check status of descriptors */
31742 for (x = 0; x < numbuffs; x++) {
31743 @@ -969,7 +969,7 @@ static int pcnet32_loopback_test(struct
31744 }
31745 }
31746
31747 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
31748 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP); /* Set STOP bit */
31749 wmb();
31750 if (netif_msg_hw(lp) && netif_msg_pktdata(lp)) {
31751 netdev_printk(KERN_DEBUG, dev, "RX loopback packets:\n");
31752 @@ -1015,7 +1015,7 @@ clean_up:
31753 pcnet32_restart(dev, CSR0_NORMAL);
31754 } else {
31755 pcnet32_purge_rx_ring(dev);
31756 - lp->a.write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
31757 + lp->a->write_bcr(ioaddr, 20, 4); /* return to 16bit mode */
31758 }
31759 spin_unlock_irqrestore(&lp->lock, flags);
31760
31761 @@ -1026,7 +1026,7 @@ static int pcnet32_set_phys_id(struct ne
31762 enum ethtool_phys_id_state state)
31763 {
31764 struct pcnet32_private *lp = netdev_priv(dev);
31765 - struct pcnet32_access *a = &lp->a;
31766 + struct pcnet32_access *a = lp->a;
31767 ulong ioaddr = dev->base_addr;
31768 unsigned long flags;
31769 int i;
31770 @@ -1067,7 +1067,7 @@ static int pcnet32_suspend(struct net_de
31771 {
31772 int csr5;
31773 struct pcnet32_private *lp = netdev_priv(dev);
31774 - struct pcnet32_access *a = &lp->a;
31775 + struct pcnet32_access *a = lp->a;
31776 ulong ioaddr = dev->base_addr;
31777 int ticks;
31778
31779 @@ -1324,8 +1324,8 @@ static int pcnet32_poll(struct napi_stru
31780 spin_lock_irqsave(&lp->lock, flags);
31781 if (pcnet32_tx(dev)) {
31782 /* reset the chip to clear the error condition, then restart */
31783 - lp->a.reset(ioaddr);
31784 - lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
31785 + lp->a->reset(ioaddr);
31786 + lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
31787 pcnet32_restart(dev, CSR0_START);
31788 netif_wake_queue(dev);
31789 }
31790 @@ -1337,12 +1337,12 @@ static int pcnet32_poll(struct napi_stru
31791 __napi_complete(napi);
31792
31793 /* clear interrupt masks */
31794 - val = lp->a.read_csr(ioaddr, CSR3);
31795 + val = lp->a->read_csr(ioaddr, CSR3);
31796 val &= 0x00ff;
31797 - lp->a.write_csr(ioaddr, CSR3, val);
31798 + lp->a->write_csr(ioaddr, CSR3, val);
31799
31800 /* Set interrupt enable. */
31801 - lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN);
31802 + lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN);
31803
31804 spin_unlock_irqrestore(&lp->lock, flags);
31805 }
31806 @@ -1365,7 +1365,7 @@ static void pcnet32_get_regs(struct net_
31807 int i, csr0;
31808 u16 *buff = ptr;
31809 struct pcnet32_private *lp = netdev_priv(dev);
31810 - struct pcnet32_access *a = &lp->a;
31811 + struct pcnet32_access *a = lp->a;
31812 ulong ioaddr = dev->base_addr;
31813 unsigned long flags;
31814
31815 @@ -1401,9 +1401,9 @@ static void pcnet32_get_regs(struct net_
31816 for (j = 0; j < PCNET32_MAX_PHYS; j++) {
31817 if (lp->phymask & (1 << j)) {
31818 for (i = 0; i < PCNET32_REGS_PER_PHY; i++) {
31819 - lp->a.write_bcr(ioaddr, 33,
31820 + lp->a->write_bcr(ioaddr, 33,
31821 (j << 5) | i);
31822 - *buff++ = lp->a.read_bcr(ioaddr, 34);
31823 + *buff++ = lp->a->read_bcr(ioaddr, 34);
31824 }
31825 }
31826 }
31827 @@ -1785,7 +1785,7 @@ pcnet32_probe1(unsigned long ioaddr, int
31828 ((cards_found >= MAX_UNITS) || full_duplex[cards_found]))
31829 lp->options |= PCNET32_PORT_FD;
31830
31831 - lp->a = *a;
31832 + lp->a = a;
31833
31834 /* prior to register_netdev, dev->name is not yet correct */
31835 if (pcnet32_alloc_ring(dev, pci_name(lp->pci_dev))) {
31836 @@ -1844,7 +1844,7 @@ pcnet32_probe1(unsigned long ioaddr, int
31837 if (lp->mii) {
31838 /* lp->phycount and lp->phymask are set to 0 by memset above */
31839
31840 - lp->mii_if.phy_id = ((lp->a.read_bcr(ioaddr, 33)) >> 5) & 0x1f;
31841 + lp->mii_if.phy_id = ((lp->a->read_bcr(ioaddr, 33)) >> 5) & 0x1f;
31842 /* scan for PHYs */
31843 for (i = 0; i < PCNET32_MAX_PHYS; i++) {
31844 unsigned short id1, id2;
31845 @@ -1864,7 +1864,7 @@ pcnet32_probe1(unsigned long ioaddr, int
31846 pr_info("Found PHY %04x:%04x at address %d\n",
31847 id1, id2, i);
31848 }
31849 - lp->a.write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
31850 + lp->a->write_bcr(ioaddr, 33, (lp->mii_if.phy_id) << 5);
31851 if (lp->phycount > 1)
31852 lp->options |= PCNET32_PORT_MII;
31853 }
31854 @@ -2020,10 +2020,10 @@ static int pcnet32_open(struct net_devic
31855 }
31856
31857 /* Reset the PCNET32 */
31858 - lp->a.reset(ioaddr);
31859 + lp->a->reset(ioaddr);
31860
31861 /* switch pcnet32 to 32bit mode */
31862 - lp->a.write_bcr(ioaddr, 20, 2);
31863 + lp->a->write_bcr(ioaddr, 20, 2);
31864
31865 netif_printk(lp, ifup, KERN_DEBUG, dev,
31866 "%s() irq %d tx/rx rings %#x/%#x init %#x\n",
31867 @@ -2032,14 +2032,14 @@ static int pcnet32_open(struct net_devic
31868 (u32) (lp->init_dma_addr));
31869
31870 /* set/reset autoselect bit */
31871 - val = lp->a.read_bcr(ioaddr, 2) & ~2;
31872 + val = lp->a->read_bcr(ioaddr, 2) & ~2;
31873 if (lp->options & PCNET32_PORT_ASEL)
31874 val |= 2;
31875 - lp->a.write_bcr(ioaddr, 2, val);
31876 + lp->a->write_bcr(ioaddr, 2, val);
31877
31878 /* handle full duplex setting */
31879 if (lp->mii_if.full_duplex) {
31880 - val = lp->a.read_bcr(ioaddr, 9) & ~3;
31881 + val = lp->a->read_bcr(ioaddr, 9) & ~3;
31882 if (lp->options & PCNET32_PORT_FD) {
31883 val |= 1;
31884 if (lp->options == (PCNET32_PORT_FD | PCNET32_PORT_AUI))
31885 @@ -2049,14 +2049,14 @@ static int pcnet32_open(struct net_devic
31886 if (lp->chip_version == 0x2627)
31887 val |= 3;
31888 }
31889 - lp->a.write_bcr(ioaddr, 9, val);
31890 + lp->a->write_bcr(ioaddr, 9, val);
31891 }
31892
31893 /* set/reset GPSI bit in test register */
31894 - val = lp->a.read_csr(ioaddr, 124) & ~0x10;
31895 + val = lp->a->read_csr(ioaddr, 124) & ~0x10;
31896 if ((lp->options & PCNET32_PORT_PORTSEL) == PCNET32_PORT_GPSI)
31897 val |= 0x10;
31898 - lp->a.write_csr(ioaddr, 124, val);
31899 + lp->a->write_csr(ioaddr, 124, val);
31900
31901 /* Allied Telesyn AT 2700/2701 FX are 100Mbit only and do not negotiate */
31902 if (pdev && pdev->subsystem_vendor == PCI_VENDOR_ID_AT &&
31903 @@ -2075,24 +2075,24 @@ static int pcnet32_open(struct net_devic
31904 * duplex, and/or enable auto negotiation, and clear DANAS
31905 */
31906 if (lp->mii && !(lp->options & PCNET32_PORT_ASEL)) {
31907 - lp->a.write_bcr(ioaddr, 32,
31908 - lp->a.read_bcr(ioaddr, 32) | 0x0080);
31909 + lp->a->write_bcr(ioaddr, 32,
31910 + lp->a->read_bcr(ioaddr, 32) | 0x0080);
31911 /* disable Auto Negotiation, set 10Mpbs, HD */
31912 - val = lp->a.read_bcr(ioaddr, 32) & ~0xb8;
31913 + val = lp->a->read_bcr(ioaddr, 32) & ~0xb8;
31914 if (lp->options & PCNET32_PORT_FD)
31915 val |= 0x10;
31916 if (lp->options & PCNET32_PORT_100)
31917 val |= 0x08;
31918 - lp->a.write_bcr(ioaddr, 32, val);
31919 + lp->a->write_bcr(ioaddr, 32, val);
31920 } else {
31921 if (lp->options & PCNET32_PORT_ASEL) {
31922 - lp->a.write_bcr(ioaddr, 32,
31923 - lp->a.read_bcr(ioaddr,
31924 + lp->a->write_bcr(ioaddr, 32,
31925 + lp->a->read_bcr(ioaddr,
31926 32) | 0x0080);
31927 /* enable auto negotiate, setup, disable fd */
31928 - val = lp->a.read_bcr(ioaddr, 32) & ~0x98;
31929 + val = lp->a->read_bcr(ioaddr, 32) & ~0x98;
31930 val |= 0x20;
31931 - lp->a.write_bcr(ioaddr, 32, val);
31932 + lp->a->write_bcr(ioaddr, 32, val);
31933 }
31934 }
31935 } else {
31936 @@ -2105,10 +2105,10 @@ static int pcnet32_open(struct net_devic
31937 * There is really no good other way to handle multiple PHYs
31938 * other than turning off all automatics
31939 */
31940 - val = lp->a.read_bcr(ioaddr, 2);
31941 - lp->a.write_bcr(ioaddr, 2, val & ~2);
31942 - val = lp->a.read_bcr(ioaddr, 32);
31943 - lp->a.write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
31944 + val = lp->a->read_bcr(ioaddr, 2);
31945 + lp->a->write_bcr(ioaddr, 2, val & ~2);
31946 + val = lp->a->read_bcr(ioaddr, 32);
31947 + lp->a->write_bcr(ioaddr, 32, val & ~(1 << 7)); /* stop MII manager */
31948
31949 if (!(lp->options & PCNET32_PORT_ASEL)) {
31950 /* setup ecmd */
31951 @@ -2118,7 +2118,7 @@ static int pcnet32_open(struct net_devic
31952 ethtool_cmd_speed_set(&ecmd,
31953 (lp->options & PCNET32_PORT_100) ?
31954 SPEED_100 : SPEED_10);
31955 - bcr9 = lp->a.read_bcr(ioaddr, 9);
31956 + bcr9 = lp->a->read_bcr(ioaddr, 9);
31957
31958 if (lp->options & PCNET32_PORT_FD) {
31959 ecmd.duplex = DUPLEX_FULL;
31960 @@ -2127,7 +2127,7 @@ static int pcnet32_open(struct net_devic
31961 ecmd.duplex = DUPLEX_HALF;
31962 bcr9 |= ~(1 << 0);
31963 }
31964 - lp->a.write_bcr(ioaddr, 9, bcr9);
31965 + lp->a->write_bcr(ioaddr, 9, bcr9);
31966 }
31967
31968 for (i = 0; i < PCNET32_MAX_PHYS; i++) {
31969 @@ -2158,9 +2158,9 @@ static int pcnet32_open(struct net_devic
31970
31971 #ifdef DO_DXSUFLO
31972 if (lp->dxsuflo) { /* Disable transmit stop on underflow */
31973 - val = lp->a.read_csr(ioaddr, CSR3);
31974 + val = lp->a->read_csr(ioaddr, CSR3);
31975 val |= 0x40;
31976 - lp->a.write_csr(ioaddr, CSR3, val);
31977 + lp->a->write_csr(ioaddr, CSR3, val);
31978 }
31979 #endif
31980
31981 @@ -2176,11 +2176,11 @@ static int pcnet32_open(struct net_devic
31982 napi_enable(&lp->napi);
31983
31984 /* Re-initialize the PCNET32, and start it when done. */
31985 - lp->a.write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
31986 - lp->a.write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
31987 + lp->a->write_csr(ioaddr, 1, (lp->init_dma_addr & 0xffff));
31988 + lp->a->write_csr(ioaddr, 2, (lp->init_dma_addr >> 16));
31989
31990 - lp->a.write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
31991 - lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
31992 + lp->a->write_csr(ioaddr, CSR4, 0x0915); /* auto tx pad */
31993 + lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
31994
31995 netif_start_queue(dev);
31996
31997 @@ -2192,19 +2192,19 @@ static int pcnet32_open(struct net_devic
31998
31999 i = 0;
32000 while (i++ < 100)
32001 - if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
32002 + if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
32003 break;
32004 /*
32005 * We used to clear the InitDone bit, 0x0100, here but Mark Stockton
32006 * reports that doing so triggers a bug in the '974.
32007 */
32008 - lp->a.write_csr(ioaddr, CSR0, CSR0_NORMAL);
32009 + lp->a->write_csr(ioaddr, CSR0, CSR0_NORMAL);
32010
32011 netif_printk(lp, ifup, KERN_DEBUG, dev,
32012 "pcnet32 open after %d ticks, init block %#x csr0 %4.4x\n",
32013 i,
32014 (u32) (lp->init_dma_addr),
32015 - lp->a.read_csr(ioaddr, CSR0));
32016 + lp->a->read_csr(ioaddr, CSR0));
32017
32018 spin_unlock_irqrestore(&lp->lock, flags);
32019
32020 @@ -2218,7 +2218,7 @@ err_free_ring:
32021 * Switch back to 16bit mode to avoid problems with dumb
32022 * DOS packet driver after a warm reboot
32023 */
32024 - lp->a.write_bcr(ioaddr, 20, 4);
32025 + lp->a->write_bcr(ioaddr, 20, 4);
32026
32027 err_free_irq:
32028 spin_unlock_irqrestore(&lp->lock, flags);
32029 @@ -2323,7 +2323,7 @@ static void pcnet32_restart(struct net_d
32030
32031 /* wait for stop */
32032 for (i = 0; i < 100; i++)
32033 - if (lp->a.read_csr(ioaddr, CSR0) & CSR0_STOP)
32034 + if (lp->a->read_csr(ioaddr, CSR0) & CSR0_STOP)
32035 break;
32036
32037 if (i >= 100)
32038 @@ -2335,13 +2335,13 @@ static void pcnet32_restart(struct net_d
32039 return;
32040
32041 /* ReInit Ring */
32042 - lp->a.write_csr(ioaddr, CSR0, CSR0_INIT);
32043 + lp->a->write_csr(ioaddr, CSR0, CSR0_INIT);
32044 i = 0;
32045 while (i++ < 1000)
32046 - if (lp->a.read_csr(ioaddr, CSR0) & CSR0_IDON)
32047 + if (lp->a->read_csr(ioaddr, CSR0) & CSR0_IDON)
32048 break;
32049
32050 - lp->a.write_csr(ioaddr, CSR0, csr0_bits);
32051 + lp->a->write_csr(ioaddr, CSR0, csr0_bits);
32052 }
32053
32054 static void pcnet32_tx_timeout(struct net_device *dev)
32055 @@ -2353,8 +2353,8 @@ static void pcnet32_tx_timeout(struct ne
32056 /* Transmitter timeout, serious problems. */
32057 if (pcnet32_debug & NETIF_MSG_DRV)
32058 pr_err("%s: transmit timed out, status %4.4x, resetting\n",
32059 - dev->name, lp->a.read_csr(ioaddr, CSR0));
32060 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
32061 + dev->name, lp->a->read_csr(ioaddr, CSR0));
32062 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
32063 dev->stats.tx_errors++;
32064 if (netif_msg_tx_err(lp)) {
32065 int i;
32066 @@ -2397,7 +2397,7 @@ static netdev_tx_t pcnet32_start_xmit(st
32067
32068 netif_printk(lp, tx_queued, KERN_DEBUG, dev,
32069 "%s() called, csr0 %4.4x\n",
32070 - __func__, lp->a.read_csr(ioaddr, CSR0));
32071 + __func__, lp->a->read_csr(ioaddr, CSR0));
32072
32073 /* Default status -- will not enable Successful-TxDone
32074 * interrupt when that option is available to us.
32075 @@ -2427,7 +2427,7 @@ static netdev_tx_t pcnet32_start_xmit(st
32076 dev->stats.tx_bytes += skb->len;
32077
32078 /* Trigger an immediate send poll. */
32079 - lp->a.write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
32080 + lp->a->write_csr(ioaddr, CSR0, CSR0_INTEN | CSR0_TXPOLL);
32081
32082 if (lp->tx_ring[(entry + 1) & lp->tx_mod_mask].base != 0) {
32083 lp->tx_full = 1;
32084 @@ -2452,16 +2452,16 @@ pcnet32_interrupt(int irq, void *dev_id)
32085
32086 spin_lock(&lp->lock);
32087
32088 - csr0 = lp->a.read_csr(ioaddr, CSR0);
32089 + csr0 = lp->a->read_csr(ioaddr, CSR0);
32090 while ((csr0 & 0x8f00) && --boguscnt >= 0) {
32091 if (csr0 == 0xffff)
32092 break; /* PCMCIA remove happened */
32093 /* Acknowledge all of the current interrupt sources ASAP. */
32094 - lp->a.write_csr(ioaddr, CSR0, csr0 & ~0x004f);
32095 + lp->a->write_csr(ioaddr, CSR0, csr0 & ~0x004f);
32096
32097 netif_printk(lp, intr, KERN_DEBUG, dev,
32098 "interrupt csr0=%#2.2x new csr=%#2.2x\n",
32099 - csr0, lp->a.read_csr(ioaddr, CSR0));
32100 + csr0, lp->a->read_csr(ioaddr, CSR0));
32101
32102 /* Log misc errors. */
32103 if (csr0 & 0x4000)
32104 @@ -2488,19 +2488,19 @@ pcnet32_interrupt(int irq, void *dev_id)
32105 if (napi_schedule_prep(&lp->napi)) {
32106 u16 val;
32107 /* set interrupt masks */
32108 - val = lp->a.read_csr(ioaddr, CSR3);
32109 + val = lp->a->read_csr(ioaddr, CSR3);
32110 val |= 0x5f00;
32111 - lp->a.write_csr(ioaddr, CSR3, val);
32112 + lp->a->write_csr(ioaddr, CSR3, val);
32113
32114 __napi_schedule(&lp->napi);
32115 break;
32116 }
32117 - csr0 = lp->a.read_csr(ioaddr, CSR0);
32118 + csr0 = lp->a->read_csr(ioaddr, CSR0);
32119 }
32120
32121 netif_printk(lp, intr, KERN_DEBUG, dev,
32122 "exiting interrupt, csr0=%#4.4x\n",
32123 - lp->a.read_csr(ioaddr, CSR0));
32124 + lp->a->read_csr(ioaddr, CSR0));
32125
32126 spin_unlock(&lp->lock);
32127
32128 @@ -2520,20 +2520,20 @@ static int pcnet32_close(struct net_devi
32129
32130 spin_lock_irqsave(&lp->lock, flags);
32131
32132 - dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
32133 + dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
32134
32135 netif_printk(lp, ifdown, KERN_DEBUG, dev,
32136 "Shutting down ethercard, status was %2.2x\n",
32137 - lp->a.read_csr(ioaddr, CSR0));
32138 + lp->a->read_csr(ioaddr, CSR0));
32139
32140 /* We stop the PCNET32 here -- it occasionally polls memory if we don't. */
32141 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
32142 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
32143
32144 /*
32145 * Switch back to 16bit mode to avoid problems with dumb
32146 * DOS packet driver after a warm reboot
32147 */
32148 - lp->a.write_bcr(ioaddr, 20, 4);
32149 + lp->a->write_bcr(ioaddr, 20, 4);
32150
32151 spin_unlock_irqrestore(&lp->lock, flags);
32152
32153 @@ -2556,7 +2556,7 @@ static struct net_device_stats *pcnet32_
32154 unsigned long flags;
32155
32156 spin_lock_irqsave(&lp->lock, flags);
32157 - dev->stats.rx_missed_errors = lp->a.read_csr(ioaddr, 112);
32158 + dev->stats.rx_missed_errors = lp->a->read_csr(ioaddr, 112);
32159 spin_unlock_irqrestore(&lp->lock, flags);
32160
32161 return &dev->stats;
32162 @@ -2578,10 +2578,10 @@ static void pcnet32_load_multicast(struc
32163 if (dev->flags & IFF_ALLMULTI) {
32164 ib->filter[0] = cpu_to_le32(~0U);
32165 ib->filter[1] = cpu_to_le32(~0U);
32166 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
32167 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
32168 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
32169 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
32170 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER, 0xffff);
32171 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+1, 0xffff);
32172 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+2, 0xffff);
32173 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER+3, 0xffff);
32174 return;
32175 }
32176 /* clear the multicast filter */
32177 @@ -2601,7 +2601,7 @@ static void pcnet32_load_multicast(struc
32178 mcast_table[crc >> 4] |= cpu_to_le16(1 << (crc & 0xf));
32179 }
32180 for (i = 0; i < 4; i++)
32181 - lp->a.write_csr(ioaddr, PCNET32_MC_FILTER + i,
32182 + lp->a->write_csr(ioaddr, PCNET32_MC_FILTER + i,
32183 le16_to_cpu(mcast_table[i]));
32184 }
32185
32186 @@ -2616,28 +2616,28 @@ static void pcnet32_set_multicast_list(s
32187
32188 spin_lock_irqsave(&lp->lock, flags);
32189 suspended = pcnet32_suspend(dev, &flags, 0);
32190 - csr15 = lp->a.read_csr(ioaddr, CSR15);
32191 + csr15 = lp->a->read_csr(ioaddr, CSR15);
32192 if (dev->flags & IFF_PROMISC) {
32193 /* Log any net taps. */
32194 netif_info(lp, hw, dev, "Promiscuous mode enabled\n");
32195 lp->init_block->mode =
32196 cpu_to_le16(0x8000 | (lp->options & PCNET32_PORT_PORTSEL) <<
32197 7);
32198 - lp->a.write_csr(ioaddr, CSR15, csr15 | 0x8000);
32199 + lp->a->write_csr(ioaddr, CSR15, csr15 | 0x8000);
32200 } else {
32201 lp->init_block->mode =
32202 cpu_to_le16((lp->options & PCNET32_PORT_PORTSEL) << 7);
32203 - lp->a.write_csr(ioaddr, CSR15, csr15 & 0x7fff);
32204 + lp->a->write_csr(ioaddr, CSR15, csr15 & 0x7fff);
32205 pcnet32_load_multicast(dev);
32206 }
32207
32208 if (suspended) {
32209 int csr5;
32210 /* clear SUSPEND (SPND) - CSR5 bit 0 */
32211 - csr5 = lp->a.read_csr(ioaddr, CSR5);
32212 - lp->a.write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
32213 + csr5 = lp->a->read_csr(ioaddr, CSR5);
32214 + lp->a->write_csr(ioaddr, CSR5, csr5 & (~CSR5_SUSPEND));
32215 } else {
32216 - lp->a.write_csr(ioaddr, CSR0, CSR0_STOP);
32217 + lp->a->write_csr(ioaddr, CSR0, CSR0_STOP);
32218 pcnet32_restart(dev, CSR0_NORMAL);
32219 netif_wake_queue(dev);
32220 }
32221 @@ -2655,8 +2655,8 @@ static int mdio_read(struct net_device *
32222 if (!lp->mii)
32223 return 0;
32224
32225 - lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
32226 - val_out = lp->a.read_bcr(ioaddr, 34);
32227 + lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
32228 + val_out = lp->a->read_bcr(ioaddr, 34);
32229
32230 return val_out;
32231 }
32232 @@ -2670,8 +2670,8 @@ static void mdio_write(struct net_device
32233 if (!lp->mii)
32234 return;
32235
32236 - lp->a.write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
32237 - lp->a.write_bcr(ioaddr, 34, val);
32238 + lp->a->write_bcr(ioaddr, 33, ((phy_id & 0x1f) << 5) | (reg_num & 0x1f));
32239 + lp->a->write_bcr(ioaddr, 34, val);
32240 }
32241
32242 static int pcnet32_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
32243 @@ -2748,7 +2748,7 @@ static void pcnet32_check_media(struct n
32244 curr_link = mii_link_ok(&lp->mii_if);
32245 } else {
32246 ulong ioaddr = dev->base_addr; /* card base I/O address */
32247 - curr_link = (lp->a.read_bcr(ioaddr, 4) != 0xc0);
32248 + curr_link = (lp->a->read_bcr(ioaddr, 4) != 0xc0);
32249 }
32250 if (!curr_link) {
32251 if (prev_link || verbose) {
32252 @@ -2771,13 +2771,13 @@ static void pcnet32_check_media(struct n
32253 (ecmd.duplex == DUPLEX_FULL)
32254 ? "full" : "half");
32255 }
32256 - bcr9 = lp->a.read_bcr(dev->base_addr, 9);
32257 + bcr9 = lp->a->read_bcr(dev->base_addr, 9);
32258 if ((bcr9 & (1 << 0)) != lp->mii_if.full_duplex) {
32259 if (lp->mii_if.full_duplex)
32260 bcr9 |= (1 << 0);
32261 else
32262 bcr9 &= ~(1 << 0);
32263 - lp->a.write_bcr(dev->base_addr, 9, bcr9);
32264 + lp->a->write_bcr(dev->base_addr, 9, bcr9);
32265 }
32266 } else {
32267 netif_info(lp, link, dev, "link up\n");
32268 diff -urNp linux-3.0.9/drivers/net/ppp_generic.c linux-3.0.9/drivers/net/ppp_generic.c
32269 --- linux-3.0.9/drivers/net/ppp_generic.c 2011-11-11 13:12:24.000000000 -0500
32270 +++ linux-3.0.9/drivers/net/ppp_generic.c 2011-11-15 20:02:59.000000000 -0500
32271 @@ -987,7 +987,6 @@ ppp_net_ioctl(struct net_device *dev, st
32272 void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
32273 struct ppp_stats stats;
32274 struct ppp_comp_stats cstats;
32275 - char *vers;
32276
32277 switch (cmd) {
32278 case SIOCGPPPSTATS:
32279 @@ -1009,8 +1008,7 @@ ppp_net_ioctl(struct net_device *dev, st
32280 break;
32281
32282 case SIOCGPPPVER:
32283 - vers = PPP_VERSION;
32284 - if (copy_to_user(addr, vers, strlen(vers) + 1))
32285 + if (copy_to_user(addr, PPP_VERSION, sizeof(PPP_VERSION)))
32286 break;
32287 err = 0;
32288 break;
32289 diff -urNp linux-3.0.9/drivers/net/r8169.c linux-3.0.9/drivers/net/r8169.c
32290 --- linux-3.0.9/drivers/net/r8169.c 2011-11-11 13:12:24.000000000 -0500
32291 +++ linux-3.0.9/drivers/net/r8169.c 2011-11-15 20:02:59.000000000 -0500
32292 @@ -645,12 +645,12 @@ struct rtl8169_private {
32293 struct mdio_ops {
32294 void (*write)(void __iomem *, int, int);
32295 int (*read)(void __iomem *, int);
32296 - } mdio_ops;
32297 + } __no_const mdio_ops;
32298
32299 struct pll_power_ops {
32300 void (*down)(struct rtl8169_private *);
32301 void (*up)(struct rtl8169_private *);
32302 - } pll_power_ops;
32303 + } __no_const pll_power_ops;
32304
32305 int (*set_speed)(struct net_device *, u8 aneg, u16 sp, u8 dpx, u32 adv);
32306 int (*get_settings)(struct net_device *, struct ethtool_cmd *);
32307 diff -urNp linux-3.0.9/drivers/net/sis190.c linux-3.0.9/drivers/net/sis190.c
32308 --- linux-3.0.9/drivers/net/sis190.c 2011-11-11 13:12:24.000000000 -0500
32309 +++ linux-3.0.9/drivers/net/sis190.c 2011-11-15 20:02:59.000000000 -0500
32310 @@ -1623,7 +1623,7 @@ static int __devinit sis190_get_mac_addr
32311 static int __devinit sis190_get_mac_addr_from_apc(struct pci_dev *pdev,
32312 struct net_device *dev)
32313 {
32314 - static const u16 __devinitdata ids[] = { 0x0965, 0x0966, 0x0968 };
32315 + static const u16 __devinitconst ids[] = { 0x0965, 0x0966, 0x0968 };
32316 struct sis190_private *tp = netdev_priv(dev);
32317 struct pci_dev *isa_bridge;
32318 u8 reg, tmp8;
32319 diff -urNp linux-3.0.9/drivers/net/sundance.c linux-3.0.9/drivers/net/sundance.c
32320 --- linux-3.0.9/drivers/net/sundance.c 2011-11-11 13:12:24.000000000 -0500
32321 +++ linux-3.0.9/drivers/net/sundance.c 2011-11-15 20:02:59.000000000 -0500
32322 @@ -218,7 +218,7 @@ enum {
32323 struct pci_id_info {
32324 const char *name;
32325 };
32326 -static const struct pci_id_info pci_id_tbl[] __devinitdata = {
32327 +static const struct pci_id_info pci_id_tbl[] __devinitconst = {
32328 {"D-Link DFE-550TX FAST Ethernet Adapter"},
32329 {"D-Link DFE-550FX 100Mbps Fiber-optics Adapter"},
32330 {"D-Link DFE-580TX 4 port Server Adapter"},
32331 diff -urNp linux-3.0.9/drivers/net/tg3.h linux-3.0.9/drivers/net/tg3.h
32332 --- linux-3.0.9/drivers/net/tg3.h 2011-11-11 13:12:24.000000000 -0500
32333 +++ linux-3.0.9/drivers/net/tg3.h 2011-11-15 20:02:59.000000000 -0500
32334 @@ -134,6 +134,7 @@
32335 #define CHIPREV_ID_5750_A0 0x4000
32336 #define CHIPREV_ID_5750_A1 0x4001
32337 #define CHIPREV_ID_5750_A3 0x4003
32338 +#define CHIPREV_ID_5750_C1 0x4201
32339 #define CHIPREV_ID_5750_C2 0x4202
32340 #define CHIPREV_ID_5752_A0_HW 0x5000
32341 #define CHIPREV_ID_5752_A0 0x6000
32342 diff -urNp linux-3.0.9/drivers/net/tokenring/abyss.c linux-3.0.9/drivers/net/tokenring/abyss.c
32343 --- linux-3.0.9/drivers/net/tokenring/abyss.c 2011-11-11 13:12:24.000000000 -0500
32344 +++ linux-3.0.9/drivers/net/tokenring/abyss.c 2011-11-15 20:02:59.000000000 -0500
32345 @@ -451,10 +451,12 @@ static struct pci_driver abyss_driver =
32346
32347 static int __init abyss_init (void)
32348 {
32349 - abyss_netdev_ops = tms380tr_netdev_ops;
32350 + pax_open_kernel();
32351 + memcpy((void *)&abyss_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
32352
32353 - abyss_netdev_ops.ndo_open = abyss_open;
32354 - abyss_netdev_ops.ndo_stop = abyss_close;
32355 + *(void **)&abyss_netdev_ops.ndo_open = abyss_open;
32356 + *(void **)&abyss_netdev_ops.ndo_stop = abyss_close;
32357 + pax_close_kernel();
32358
32359 return pci_register_driver(&abyss_driver);
32360 }
32361 diff -urNp linux-3.0.9/drivers/net/tokenring/madgemc.c linux-3.0.9/drivers/net/tokenring/madgemc.c
32362 --- linux-3.0.9/drivers/net/tokenring/madgemc.c 2011-11-11 13:12:24.000000000 -0500
32363 +++ linux-3.0.9/drivers/net/tokenring/madgemc.c 2011-11-15 20:02:59.000000000 -0500
32364 @@ -744,9 +744,11 @@ static struct mca_driver madgemc_driver
32365
32366 static int __init madgemc_init (void)
32367 {
32368 - madgemc_netdev_ops = tms380tr_netdev_ops;
32369 - madgemc_netdev_ops.ndo_open = madgemc_open;
32370 - madgemc_netdev_ops.ndo_stop = madgemc_close;
32371 + pax_open_kernel();
32372 + memcpy((void *)&madgemc_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
32373 + *(void **)&madgemc_netdev_ops.ndo_open = madgemc_open;
32374 + *(void **)&madgemc_netdev_ops.ndo_stop = madgemc_close;
32375 + pax_close_kernel();
32376
32377 return mca_register_driver (&madgemc_driver);
32378 }
32379 diff -urNp linux-3.0.9/drivers/net/tokenring/proteon.c linux-3.0.9/drivers/net/tokenring/proteon.c
32380 --- linux-3.0.9/drivers/net/tokenring/proteon.c 2011-11-11 13:12:24.000000000 -0500
32381 +++ linux-3.0.9/drivers/net/tokenring/proteon.c 2011-11-15 20:02:59.000000000 -0500
32382 @@ -353,9 +353,11 @@ static int __init proteon_init(void)
32383 struct platform_device *pdev;
32384 int i, num = 0, err = 0;
32385
32386 - proteon_netdev_ops = tms380tr_netdev_ops;
32387 - proteon_netdev_ops.ndo_open = proteon_open;
32388 - proteon_netdev_ops.ndo_stop = tms380tr_close;
32389 + pax_open_kernel();
32390 + memcpy((void *)&proteon_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
32391 + *(void **)&proteon_netdev_ops.ndo_open = proteon_open;
32392 + *(void **)&proteon_netdev_ops.ndo_stop = tms380tr_close;
32393 + pax_close_kernel();
32394
32395 err = platform_driver_register(&proteon_driver);
32396 if (err)
32397 diff -urNp linux-3.0.9/drivers/net/tokenring/skisa.c linux-3.0.9/drivers/net/tokenring/skisa.c
32398 --- linux-3.0.9/drivers/net/tokenring/skisa.c 2011-11-11 13:12:24.000000000 -0500
32399 +++ linux-3.0.9/drivers/net/tokenring/skisa.c 2011-11-15 20:02:59.000000000 -0500
32400 @@ -363,9 +363,11 @@ static int __init sk_isa_init(void)
32401 struct platform_device *pdev;
32402 int i, num = 0, err = 0;
32403
32404 - sk_isa_netdev_ops = tms380tr_netdev_ops;
32405 - sk_isa_netdev_ops.ndo_open = sk_isa_open;
32406 - sk_isa_netdev_ops.ndo_stop = tms380tr_close;
32407 + pax_open_kernel();
32408 + memcpy((void *)&sk_isa_netdev_ops, &tms380tr_netdev_ops, sizeof(tms380tr_netdev_ops));
32409 + *(void **)&sk_isa_netdev_ops.ndo_open = sk_isa_open;
32410 + *(void **)&sk_isa_netdev_ops.ndo_stop = tms380tr_close;
32411 + pax_close_kernel();
32412
32413 err = platform_driver_register(&sk_isa_driver);
32414 if (err)
32415 diff -urNp linux-3.0.9/drivers/net/tulip/de2104x.c linux-3.0.9/drivers/net/tulip/de2104x.c
32416 --- linux-3.0.9/drivers/net/tulip/de2104x.c 2011-11-11 13:12:24.000000000 -0500
32417 +++ linux-3.0.9/drivers/net/tulip/de2104x.c 2011-11-15 20:02:59.000000000 -0500
32418 @@ -1794,6 +1794,8 @@ static void __devinit de21041_get_srom_i
32419 struct de_srom_info_leaf *il;
32420 void *bufp;
32421
32422 + pax_track_stack();
32423 +
32424 /* download entire eeprom */
32425 for (i = 0; i < DE_EEPROM_WORDS; i++)
32426 ((__le16 *)ee_data)[i] =
32427 diff -urNp linux-3.0.9/drivers/net/tulip/de4x5.c linux-3.0.9/drivers/net/tulip/de4x5.c
32428 --- linux-3.0.9/drivers/net/tulip/de4x5.c 2011-11-11 13:12:24.000000000 -0500
32429 +++ linux-3.0.9/drivers/net/tulip/de4x5.c 2011-11-15 20:02:59.000000000 -0500
32430 @@ -5401,7 +5401,7 @@ de4x5_ioctl(struct net_device *dev, stru
32431 for (i=0; i<ETH_ALEN; i++) {
32432 tmp.addr[i] = dev->dev_addr[i];
32433 }
32434 - if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
32435 + if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
32436 break;
32437
32438 case DE4X5_SET_HWADDR: /* Set the hardware address */
32439 @@ -5441,7 +5441,7 @@ de4x5_ioctl(struct net_device *dev, stru
32440 spin_lock_irqsave(&lp->lock, flags);
32441 memcpy(&statbuf, &lp->pktStats, ioc->len);
32442 spin_unlock_irqrestore(&lp->lock, flags);
32443 - if (copy_to_user(ioc->data, &statbuf, ioc->len))
32444 + if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
32445 return -EFAULT;
32446 break;
32447 }
32448 diff -urNp linux-3.0.9/drivers/net/tulip/eeprom.c linux-3.0.9/drivers/net/tulip/eeprom.c
32449 --- linux-3.0.9/drivers/net/tulip/eeprom.c 2011-11-11 13:12:24.000000000 -0500
32450 +++ linux-3.0.9/drivers/net/tulip/eeprom.c 2011-11-15 20:02:59.000000000 -0500
32451 @@ -81,7 +81,7 @@ static struct eeprom_fixup eeprom_fixups
32452 {NULL}};
32453
32454
32455 -static const char *block_name[] __devinitdata = {
32456 +static const char *block_name[] __devinitconst = {
32457 "21140 non-MII",
32458 "21140 MII PHY",
32459 "21142 Serial PHY",
32460 diff -urNp linux-3.0.9/drivers/net/tulip/winbond-840.c linux-3.0.9/drivers/net/tulip/winbond-840.c
32461 --- linux-3.0.9/drivers/net/tulip/winbond-840.c 2011-11-11 13:12:24.000000000 -0500
32462 +++ linux-3.0.9/drivers/net/tulip/winbond-840.c 2011-11-15 20:02:59.000000000 -0500
32463 @@ -236,7 +236,7 @@ struct pci_id_info {
32464 int drv_flags; /* Driver use, intended as capability flags. */
32465 };
32466
32467 -static const struct pci_id_info pci_id_tbl[] __devinitdata = {
32468 +static const struct pci_id_info pci_id_tbl[] __devinitconst = {
32469 { /* Sometime a Level-One switch card. */
32470 "Winbond W89c840", CanHaveMII | HasBrokenTx | FDXOnNoMII},
32471 { "Winbond W89c840", CanHaveMII | HasBrokenTx},
32472 diff -urNp linux-3.0.9/drivers/net/usb/hso.c linux-3.0.9/drivers/net/usb/hso.c
32473 --- linux-3.0.9/drivers/net/usb/hso.c 2011-11-11 13:12:24.000000000 -0500
32474 +++ linux-3.0.9/drivers/net/usb/hso.c 2011-11-15 20:02:59.000000000 -0500
32475 @@ -71,7 +71,7 @@
32476 #include <asm/byteorder.h>
32477 #include <linux/serial_core.h>
32478 #include <linux/serial.h>
32479 -
32480 +#include <asm/local.h>
32481
32482 #define MOD_AUTHOR "Option Wireless"
32483 #define MOD_DESCRIPTION "USB High Speed Option driver"
32484 @@ -257,7 +257,7 @@ struct hso_serial {
32485
32486 /* from usb_serial_port */
32487 struct tty_struct *tty;
32488 - int open_count;
32489 + local_t open_count;
32490 spinlock_t serial_lock;
32491
32492 int (*write_data) (struct hso_serial *serial);
32493 @@ -1190,7 +1190,7 @@ static void put_rxbuf_data_and_resubmit_
32494 struct urb *urb;
32495
32496 urb = serial->rx_urb[0];
32497 - if (serial->open_count > 0) {
32498 + if (local_read(&serial->open_count) > 0) {
32499 count = put_rxbuf_data(urb, serial);
32500 if (count == -1)
32501 return;
32502 @@ -1226,7 +1226,7 @@ static void hso_std_serial_read_bulk_cal
32503 DUMP1(urb->transfer_buffer, urb->actual_length);
32504
32505 /* Anyone listening? */
32506 - if (serial->open_count == 0)
32507 + if (local_read(&serial->open_count) == 0)
32508 return;
32509
32510 if (status == 0) {
32511 @@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_st
32512 spin_unlock_irq(&serial->serial_lock);
32513
32514 /* check for port already opened, if not set the termios */
32515 - serial->open_count++;
32516 - if (serial->open_count == 1) {
32517 + if (local_inc_return(&serial->open_count) == 1) {
32518 serial->rx_state = RX_IDLE;
32519 /* Force default termio settings */
32520 _hso_serial_set_termios(tty, NULL);
32521 @@ -1324,7 +1323,7 @@ static int hso_serial_open(struct tty_st
32522 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
32523 if (result) {
32524 hso_stop_serial_device(serial->parent);
32525 - serial->open_count--;
32526 + local_dec(&serial->open_count);
32527 kref_put(&serial->parent->ref, hso_serial_ref_free);
32528 }
32529 } else {
32530 @@ -1361,10 +1360,10 @@ static void hso_serial_close(struct tty_
32531
32532 /* reset the rts and dtr */
32533 /* do the actual close */
32534 - serial->open_count--;
32535 + local_dec(&serial->open_count);
32536
32537 - if (serial->open_count <= 0) {
32538 - serial->open_count = 0;
32539 + if (local_read(&serial->open_count) <= 0) {
32540 + local_set(&serial->open_count, 0);
32541 spin_lock_irq(&serial->serial_lock);
32542 if (serial->tty == tty) {
32543 serial->tty->driver_data = NULL;
32544 @@ -1446,7 +1445,7 @@ static void hso_serial_set_termios(struc
32545
32546 /* the actual setup */
32547 spin_lock_irqsave(&serial->serial_lock, flags);
32548 - if (serial->open_count)
32549 + if (local_read(&serial->open_count))
32550 _hso_serial_set_termios(tty, old);
32551 else
32552 tty->termios = old;
32553 @@ -1905,7 +1904,7 @@ static void intr_callback(struct urb *ur
32554 D1("Pending read interrupt on port %d\n", i);
32555 spin_lock(&serial->serial_lock);
32556 if (serial->rx_state == RX_IDLE &&
32557 - serial->open_count > 0) {
32558 + local_read(&serial->open_count) > 0) {
32559 /* Setup and send a ctrl req read on
32560 * port i */
32561 if (!serial->rx_urb_filled[0]) {
32562 @@ -3098,7 +3097,7 @@ static int hso_resume(struct usb_interfa
32563 /* Start all serial ports */
32564 for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
32565 if (serial_table[i] && (serial_table[i]->interface == iface)) {
32566 - if (dev2ser(serial_table[i])->open_count) {
32567 + if (local_read(&dev2ser(serial_table[i])->open_count)) {
32568 result =
32569 hso_start_serial_device(serial_table[i], GFP_NOIO);
32570 hso_kick_transmit(dev2ser(serial_table[i]));
32571 diff -urNp linux-3.0.9/drivers/net/vmxnet3/vmxnet3_ethtool.c linux-3.0.9/drivers/net/vmxnet3/vmxnet3_ethtool.c
32572 --- linux-3.0.9/drivers/net/vmxnet3/vmxnet3_ethtool.c 2011-11-11 13:12:24.000000000 -0500
32573 +++ linux-3.0.9/drivers/net/vmxnet3/vmxnet3_ethtool.c 2011-11-15 20:02:59.000000000 -0500
32574 @@ -594,8 +594,7 @@ vmxnet3_set_rss_indir(struct net_device
32575 * Return with error code if any of the queue indices
32576 * is out of range
32577 */
32578 - if (p->ring_index[i] < 0 ||
32579 - p->ring_index[i] >= adapter->num_rx_queues)
32580 + if (p->ring_index[i] >= adapter->num_rx_queues)
32581 return -EINVAL;
32582 }
32583
32584 diff -urNp linux-3.0.9/drivers/net/vxge/vxge-config.h linux-3.0.9/drivers/net/vxge/vxge-config.h
32585 --- linux-3.0.9/drivers/net/vxge/vxge-config.h 2011-11-11 13:12:24.000000000 -0500
32586 +++ linux-3.0.9/drivers/net/vxge/vxge-config.h 2011-11-15 20:02:59.000000000 -0500
32587 @@ -512,7 +512,7 @@ struct vxge_hw_uld_cbs {
32588 void (*link_down)(struct __vxge_hw_device *devh);
32589 void (*crit_err)(struct __vxge_hw_device *devh,
32590 enum vxge_hw_event type, u64 ext_data);
32591 -};
32592 +} __no_const;
32593
32594 /*
32595 * struct __vxge_hw_blockpool_entry - Block private data structure
32596 diff -urNp linux-3.0.9/drivers/net/vxge/vxge-main.c linux-3.0.9/drivers/net/vxge/vxge-main.c
32597 --- linux-3.0.9/drivers/net/vxge/vxge-main.c 2011-11-11 13:12:24.000000000 -0500
32598 +++ linux-3.0.9/drivers/net/vxge/vxge-main.c 2011-11-15 20:02:59.000000000 -0500
32599 @@ -98,6 +98,8 @@ static inline void VXGE_COMPLETE_VPATH_T
32600 struct sk_buff *completed[NR_SKB_COMPLETED];
32601 int more;
32602
32603 + pax_track_stack();
32604 +
32605 do {
32606 more = 0;
32607 skb_ptr = completed;
32608 @@ -1920,6 +1922,8 @@ static enum vxge_hw_status vxge_rth_conf
32609 u8 mtable[256] = {0}; /* CPU to vpath mapping */
32610 int index;
32611
32612 + pax_track_stack();
32613 +
32614 /*
32615 * Filling
32616 * - itable with bucket numbers
32617 diff -urNp linux-3.0.9/drivers/net/vxge/vxge-traffic.h linux-3.0.9/drivers/net/vxge/vxge-traffic.h
32618 --- linux-3.0.9/drivers/net/vxge/vxge-traffic.h 2011-11-11 13:12:24.000000000 -0500
32619 +++ linux-3.0.9/drivers/net/vxge/vxge-traffic.h 2011-11-15 20:02:59.000000000 -0500
32620 @@ -2088,7 +2088,7 @@ struct vxge_hw_mempool_cbs {
32621 struct vxge_hw_mempool_dma *dma_object,
32622 u32 index,
32623 u32 is_last);
32624 -};
32625 +} __no_const;
32626
32627 #define VXGE_HW_VIRTUAL_PATH_HANDLE(vpath) \
32628 ((struct __vxge_hw_vpath_handle *)(vpath)->vpath_handles.next)
32629 diff -urNp linux-3.0.9/drivers/net/wan/cycx_x25.c linux-3.0.9/drivers/net/wan/cycx_x25.c
32630 --- linux-3.0.9/drivers/net/wan/cycx_x25.c 2011-11-11 13:12:24.000000000 -0500
32631 +++ linux-3.0.9/drivers/net/wan/cycx_x25.c 2011-11-15 20:02:59.000000000 -0500
32632 @@ -1018,6 +1018,8 @@ static void hex_dump(char *msg, unsigned
32633 unsigned char hex[1024],
32634 * phex = hex;
32635
32636 + pax_track_stack();
32637 +
32638 if (len >= (sizeof(hex) / 2))
32639 len = (sizeof(hex) / 2) - 1;
32640
32641 diff -urNp linux-3.0.9/drivers/net/wan/hdlc_x25.c linux-3.0.9/drivers/net/wan/hdlc_x25.c
32642 --- linux-3.0.9/drivers/net/wan/hdlc_x25.c 2011-11-11 13:12:24.000000000 -0500
32643 +++ linux-3.0.9/drivers/net/wan/hdlc_x25.c 2011-11-15 20:02:59.000000000 -0500
32644 @@ -136,16 +136,16 @@ static netdev_tx_t x25_xmit(struct sk_bu
32645
32646 static int x25_open(struct net_device *dev)
32647 {
32648 - struct lapb_register_struct cb;
32649 + static struct lapb_register_struct cb = {
32650 + .connect_confirmation = x25_connected,
32651 + .connect_indication = x25_connected,
32652 + .disconnect_confirmation = x25_disconnected,
32653 + .disconnect_indication = x25_disconnected,
32654 + .data_indication = x25_data_indication,
32655 + .data_transmit = x25_data_transmit
32656 + };
32657 int result;
32658
32659 - cb.connect_confirmation = x25_connected;
32660 - cb.connect_indication = x25_connected;
32661 - cb.disconnect_confirmation = x25_disconnected;
32662 - cb.disconnect_indication = x25_disconnected;
32663 - cb.data_indication = x25_data_indication;
32664 - cb.data_transmit = x25_data_transmit;
32665 -
32666 result = lapb_register(dev, &cb);
32667 if (result != LAPB_OK)
32668 return result;
32669 diff -urNp linux-3.0.9/drivers/net/wimax/i2400m/usb-fw.c linux-3.0.9/drivers/net/wimax/i2400m/usb-fw.c
32670 --- linux-3.0.9/drivers/net/wimax/i2400m/usb-fw.c 2011-11-11 13:12:24.000000000 -0500
32671 +++ linux-3.0.9/drivers/net/wimax/i2400m/usb-fw.c 2011-11-15 20:02:59.000000000 -0500
32672 @@ -287,6 +287,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(stru
32673 int do_autopm = 1;
32674 DECLARE_COMPLETION_ONSTACK(notif_completion);
32675
32676 + pax_track_stack();
32677 +
32678 d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
32679 i2400m, ack, ack_size);
32680 BUG_ON(_ack == i2400m->bm_ack_buf);
32681 diff -urNp linux-3.0.9/drivers/net/wireless/airo.c linux-3.0.9/drivers/net/wireless/airo.c
32682 --- linux-3.0.9/drivers/net/wireless/airo.c 2011-11-11 13:12:24.000000000 -0500
32683 +++ linux-3.0.9/drivers/net/wireless/airo.c 2011-11-15 20:02:59.000000000 -0500
32684 @@ -3003,6 +3003,8 @@ static void airo_process_scan_results (s
32685 BSSListElement * loop_net;
32686 BSSListElement * tmp_net;
32687
32688 + pax_track_stack();
32689 +
32690 /* Blow away current list of scan results */
32691 list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
32692 list_move_tail (&loop_net->list, &ai->network_free_list);
32693 @@ -3794,6 +3796,8 @@ static u16 setup_card(struct airo_info *
32694 WepKeyRid wkr;
32695 int rc;
32696
32697 + pax_track_stack();
32698 +
32699 memset( &mySsid, 0, sizeof( mySsid ) );
32700 kfree (ai->flash);
32701 ai->flash = NULL;
32702 @@ -4753,6 +4757,8 @@ static int proc_stats_rid_open( struct i
32703 __le32 *vals = stats.vals;
32704 int len;
32705
32706 + pax_track_stack();
32707 +
32708 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
32709 return -ENOMEM;
32710 data = file->private_data;
32711 @@ -5476,6 +5482,8 @@ static int proc_BSSList_open( struct ino
32712 /* If doLoseSync is not 1, we won't do a Lose Sync */
32713 int doLoseSync = -1;
32714
32715 + pax_track_stack();
32716 +
32717 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
32718 return -ENOMEM;
32719 data = file->private_data;
32720 @@ -7181,6 +7189,8 @@ static int airo_get_aplist(struct net_de
32721 int i;
32722 int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
32723
32724 + pax_track_stack();
32725 +
32726 qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
32727 if (!qual)
32728 return -ENOMEM;
32729 @@ -7741,6 +7751,8 @@ static void airo_read_wireless_stats(str
32730 CapabilityRid cap_rid;
32731 __le32 *vals = stats_rid.vals;
32732
32733 + pax_track_stack();
32734 +
32735 /* Get stats out of the card */
32736 clear_bit(JOB_WSTATS, &local->jobs);
32737 if (local->power.event) {
32738 diff -urNp linux-3.0.9/drivers/net/wireless/ath/ath5k/debug.c linux-3.0.9/drivers/net/wireless/ath/ath5k/debug.c
32739 --- linux-3.0.9/drivers/net/wireless/ath/ath5k/debug.c 2011-11-11 13:12:24.000000000 -0500
32740 +++ linux-3.0.9/drivers/net/wireless/ath/ath5k/debug.c 2011-11-15 20:02:59.000000000 -0500
32741 @@ -204,6 +204,8 @@ static ssize_t read_file_beacon(struct f
32742 unsigned int v;
32743 u64 tsf;
32744
32745 + pax_track_stack();
32746 +
32747 v = ath5k_hw_reg_read(sc->ah, AR5K_BEACON);
32748 len += snprintf(buf+len, sizeof(buf)-len,
32749 "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
32750 @@ -323,6 +325,8 @@ static ssize_t read_file_debug(struct fi
32751 unsigned int len = 0;
32752 unsigned int i;
32753
32754 + pax_track_stack();
32755 +
32756 len += snprintf(buf+len, sizeof(buf)-len,
32757 "DEBUG LEVEL: 0x%08x\n\n", sc->debug.level);
32758
32759 @@ -384,6 +388,8 @@ static ssize_t read_file_antenna(struct
32760 unsigned int i;
32761 unsigned int v;
32762
32763 + pax_track_stack();
32764 +
32765 len += snprintf(buf+len, sizeof(buf)-len, "antenna mode\t%d\n",
32766 sc->ah->ah_ant_mode);
32767 len += snprintf(buf+len, sizeof(buf)-len, "default antenna\t%d\n",
32768 @@ -494,6 +500,8 @@ static ssize_t read_file_misc(struct fil
32769 unsigned int len = 0;
32770 u32 filt = ath5k_hw_get_rx_filter(sc->ah);
32771
32772 + pax_track_stack();
32773 +
32774 len += snprintf(buf+len, sizeof(buf)-len, "bssid-mask: %pM\n",
32775 sc->bssidmask);
32776 len += snprintf(buf+len, sizeof(buf)-len, "filter-flags: 0x%x ",
32777 @@ -550,6 +558,8 @@ static ssize_t read_file_frameerrors(str
32778 unsigned int len = 0;
32779 int i;
32780
32781 + pax_track_stack();
32782 +
32783 len += snprintf(buf+len, sizeof(buf)-len,
32784 "RX\n---------------------\n");
32785 len += snprintf(buf+len, sizeof(buf)-len, "CRC\t%u\t(%u%%)\n",
32786 @@ -667,6 +677,8 @@ static ssize_t read_file_ani(struct file
32787 char buf[700];
32788 unsigned int len = 0;
32789
32790 + pax_track_stack();
32791 +
32792 len += snprintf(buf+len, sizeof(buf)-len,
32793 "HW has PHY error counters:\t%s\n",
32794 sc->ah->ah_capabilities.cap_has_phyerr_counters ?
32795 @@ -827,6 +839,8 @@ static ssize_t read_file_queue(struct fi
32796 struct ath5k_buf *bf, *bf0;
32797 int i, n;
32798
32799 + pax_track_stack();
32800 +
32801 len += snprintf(buf+len, sizeof(buf)-len,
32802 "available txbuffers: %d\n", sc->txbuf_len);
32803
32804 diff -urNp linux-3.0.9/drivers/net/wireless/ath/ath9k/ar9003_calib.c linux-3.0.9/drivers/net/wireless/ath/ath9k/ar9003_calib.c
32805 --- linux-3.0.9/drivers/net/wireless/ath/ath9k/ar9003_calib.c 2011-11-11 13:12:24.000000000 -0500
32806 +++ linux-3.0.9/drivers/net/wireless/ath/ath9k/ar9003_calib.c 2011-11-15 20:02:59.000000000 -0500
32807 @@ -758,6 +758,8 @@ static void ar9003_hw_tx_iq_cal_post_pro
32808 int i, im, j;
32809 int nmeasurement;
32810
32811 + pax_track_stack();
32812 +
32813 for (i = 0; i < AR9300_MAX_CHAINS; i++) {
32814 if (ah->txchainmask & (1 << i))
32815 num_chains++;
32816 diff -urNp linux-3.0.9/drivers/net/wireless/ath/ath9k/ar9003_paprd.c linux-3.0.9/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
32817 --- linux-3.0.9/drivers/net/wireless/ath/ath9k/ar9003_paprd.c 2011-11-11 13:12:24.000000000 -0500
32818 +++ linux-3.0.9/drivers/net/wireless/ath/ath9k/ar9003_paprd.c 2011-11-15 20:02:59.000000000 -0500
32819 @@ -356,6 +356,8 @@ static bool create_pa_curve(u32 *data_L,
32820 int theta_low_bin = 0;
32821 int i;
32822
32823 + pax_track_stack();
32824 +
32825 /* disregard any bin that contains <= 16 samples */
32826 thresh_accum_cnt = 16;
32827 scale_factor = 5;
32828 diff -urNp linux-3.0.9/drivers/net/wireless/ath/ath9k/debug.c linux-3.0.9/drivers/net/wireless/ath/ath9k/debug.c
32829 --- linux-3.0.9/drivers/net/wireless/ath/ath9k/debug.c 2011-11-11 13:12:24.000000000 -0500
32830 +++ linux-3.0.9/drivers/net/wireless/ath/ath9k/debug.c 2011-11-15 20:02:59.000000000 -0500
32831 @@ -337,6 +337,8 @@ static ssize_t read_file_interrupt(struc
32832 char buf[512];
32833 unsigned int len = 0;
32834
32835 + pax_track_stack();
32836 +
32837 if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
32838 len += snprintf(buf + len, sizeof(buf) - len,
32839 "%8s: %10u\n", "RXLP", sc->debug.stats.istats.rxlp);
32840 @@ -427,6 +429,8 @@ static ssize_t read_file_wiphy(struct fi
32841 u8 addr[ETH_ALEN];
32842 u32 tmp;
32843
32844 + pax_track_stack();
32845 +
32846 len += snprintf(buf + len, sizeof(buf) - len,
32847 "%s (chan=%d center-freq: %d MHz channel-type: %d (%s))\n",
32848 wiphy_name(sc->hw->wiphy),
32849 diff -urNp linux-3.0.9/drivers/net/wireless/ath/ath9k/htc_drv_debug.c linux-3.0.9/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
32850 --- linux-3.0.9/drivers/net/wireless/ath/ath9k/htc_drv_debug.c 2011-11-11 13:12:24.000000000 -0500
32851 +++ linux-3.0.9/drivers/net/wireless/ath/ath9k/htc_drv_debug.c 2011-11-15 20:02:59.000000000 -0500
32852 @@ -31,6 +31,8 @@ static ssize_t read_file_tgt_int_stats(s
32853 unsigned int len = 0;
32854 int ret = 0;
32855
32856 + pax_track_stack();
32857 +
32858 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
32859
32860 ath9k_htc_ps_wakeup(priv);
32861 @@ -89,6 +91,8 @@ static ssize_t read_file_tgt_tx_stats(st
32862 unsigned int len = 0;
32863 int ret = 0;
32864
32865 + pax_track_stack();
32866 +
32867 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
32868
32869 ath9k_htc_ps_wakeup(priv);
32870 @@ -159,6 +163,8 @@ static ssize_t read_file_tgt_rx_stats(st
32871 unsigned int len = 0;
32872 int ret = 0;
32873
32874 + pax_track_stack();
32875 +
32876 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
32877
32878 ath9k_htc_ps_wakeup(priv);
32879 @@ -203,6 +209,8 @@ static ssize_t read_file_xmit(struct fil
32880 char buf[512];
32881 unsigned int len = 0;
32882
32883 + pax_track_stack();
32884 +
32885 len += snprintf(buf + len, sizeof(buf) - len,
32886 "%20s : %10u\n", "Buffers queued",
32887 priv->debug.tx_stats.buf_queued);
32888 @@ -376,6 +384,8 @@ static ssize_t read_file_slot(struct fil
32889 char buf[512];
32890 unsigned int len = 0;
32891
32892 + pax_track_stack();
32893 +
32894 spin_lock_bh(&priv->tx.tx_lock);
32895
32896 len += snprintf(buf + len, sizeof(buf) - len, "TX slot bitmap : ");
32897 @@ -411,6 +421,8 @@ static ssize_t read_file_queue(struct fi
32898 char buf[512];
32899 unsigned int len = 0;
32900
32901 + pax_track_stack();
32902 +
32903 len += snprintf(buf + len, sizeof(buf) - len, "%20s : %10u\n",
32904 "Mgmt endpoint", skb_queue_len(&priv->tx.mgmt_ep_queue));
32905
32906 diff -urNp linux-3.0.9/drivers/net/wireless/ath/ath9k/hw.h linux-3.0.9/drivers/net/wireless/ath/ath9k/hw.h
32907 --- linux-3.0.9/drivers/net/wireless/ath/ath9k/hw.h 2011-11-11 13:12:24.000000000 -0500
32908 +++ linux-3.0.9/drivers/net/wireless/ath/ath9k/hw.h 2011-11-15 20:02:59.000000000 -0500
32909 @@ -585,7 +585,7 @@ struct ath_hw_private_ops {
32910
32911 /* ANI */
32912 void (*ani_cache_ini_regs)(struct ath_hw *ah);
32913 -};
32914 +} __no_const;
32915
32916 /**
32917 * struct ath_hw_ops - callbacks used by hardware code and driver code
32918 @@ -637,7 +637,7 @@ struct ath_hw_ops {
32919 void (*antdiv_comb_conf_set)(struct ath_hw *ah,
32920 struct ath_hw_antcomb_conf *antconf);
32921
32922 -};
32923 +} __no_const;
32924
32925 struct ath_nf_limits {
32926 s16 max;
32927 @@ -650,7 +650,7 @@ struct ath_nf_limits {
32928 #define AH_UNPLUGGED 0x2 /* The card has been physically removed. */
32929
32930 struct ath_hw {
32931 - struct ath_ops reg_ops;
32932 + ath_ops_no_const reg_ops;
32933
32934 struct ieee80211_hw *hw;
32935 struct ath_common common;
32936 diff -urNp linux-3.0.9/drivers/net/wireless/ath/ath.h linux-3.0.9/drivers/net/wireless/ath/ath.h
32937 --- linux-3.0.9/drivers/net/wireless/ath/ath.h 2011-11-11 13:12:24.000000000 -0500
32938 +++ linux-3.0.9/drivers/net/wireless/ath/ath.h 2011-11-15 20:02:59.000000000 -0500
32939 @@ -121,6 +121,7 @@ struct ath_ops {
32940 void (*write_flush) (void *);
32941 u32 (*rmw)(void *, u32 reg_offset, u32 set, u32 clr);
32942 };
32943 +typedef struct ath_ops __no_const ath_ops_no_const;
32944
32945 struct ath_common;
32946 struct ath_bus_ops;
32947 diff -urNp linux-3.0.9/drivers/net/wireless/ipw2x00/ipw2100.c linux-3.0.9/drivers/net/wireless/ipw2x00/ipw2100.c
32948 --- linux-3.0.9/drivers/net/wireless/ipw2x00/ipw2100.c 2011-11-11 13:12:24.000000000 -0500
32949 +++ linux-3.0.9/drivers/net/wireless/ipw2x00/ipw2100.c 2011-11-15 20:02:59.000000000 -0500
32950 @@ -2100,6 +2100,8 @@ static int ipw2100_set_essid(struct ipw2
32951 int err;
32952 DECLARE_SSID_BUF(ssid);
32953
32954 + pax_track_stack();
32955 +
32956 IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
32957
32958 if (ssid_len)
32959 @@ -5449,6 +5451,8 @@ static int ipw2100_set_key(struct ipw210
32960 struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
32961 int err;
32962
32963 + pax_track_stack();
32964 +
32965 IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
32966 idx, keylen, len);
32967
32968 diff -urNp linux-3.0.9/drivers/net/wireless/ipw2x00/libipw_rx.c linux-3.0.9/drivers/net/wireless/ipw2x00/libipw_rx.c
32969 --- linux-3.0.9/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-11-11 13:12:24.000000000 -0500
32970 +++ linux-3.0.9/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-11-15 20:02:59.000000000 -0500
32971 @@ -1565,6 +1565,8 @@ static void libipw_process_probe_respons
32972 unsigned long flags;
32973 DECLARE_SSID_BUF(ssid);
32974
32975 + pax_track_stack();
32976 +
32977 LIBIPW_DEBUG_SCAN("'%s' (%pM"
32978 "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
32979 print_ssid(ssid, info_element->data, info_element->len),
32980 diff -urNp linux-3.0.9/drivers/net/wireless/iwlegacy/iwl3945-base.c linux-3.0.9/drivers/net/wireless/iwlegacy/iwl3945-base.c
32981 --- linux-3.0.9/drivers/net/wireless/iwlegacy/iwl3945-base.c 2011-11-11 13:12:24.000000000 -0500
32982 +++ linux-3.0.9/drivers/net/wireless/iwlegacy/iwl3945-base.c 2011-11-15 20:02:59.000000000 -0500
32983 @@ -3962,7 +3962,9 @@ static int iwl3945_pci_probe(struct pci_
32984 */
32985 if (iwl3945_mod_params.disable_hw_scan) {
32986 IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
32987 - iwl3945_hw_ops.hw_scan = NULL;
32988 + pax_open_kernel();
32989 + *(void **)&iwl3945_hw_ops.hw_scan = NULL;
32990 + pax_close_kernel();
32991 }
32992
32993 IWL_DEBUG_INFO(priv, "*** LOAD DRIVER ***\n");
32994 diff -urNp linux-3.0.9/drivers/net/wireless/iwlwifi/iwl-agn-rs.c linux-3.0.9/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
32995 --- linux-3.0.9/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-11-11 13:12:24.000000000 -0500
32996 +++ linux-3.0.9/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-11-15 20:02:59.000000000 -0500
32997 @@ -910,6 +910,8 @@ static void rs_tx_status(void *priv_r, s
32998 struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
32999 struct iwl_rxon_context *ctx = sta_priv->common.ctx;
33000
33001 + pax_track_stack();
33002 +
33003 IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
33004
33005 /* Treat uninitialized rate scaling data same as non-existing. */
33006 @@ -2918,6 +2920,8 @@ static void rs_fill_link_cmd(struct iwl_
33007 container_of(lq_sta, struct iwl_station_priv, lq_sta);
33008 struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
33009
33010 + pax_track_stack();
33011 +
33012 /* Override starting rate (index 0) if needed for debug purposes */
33013 rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
33014
33015 diff -urNp linux-3.0.9/drivers/net/wireless/iwlwifi/iwl-debugfs.c linux-3.0.9/drivers/net/wireless/iwlwifi/iwl-debugfs.c
33016 --- linux-3.0.9/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-11-11 13:12:24.000000000 -0500
33017 +++ linux-3.0.9/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-11-15 20:02:59.000000000 -0500
33018 @@ -548,6 +548,8 @@ static ssize_t iwl_dbgfs_status_read(str
33019 int pos = 0;
33020 const size_t bufsz = sizeof(buf);
33021
33022 + pax_track_stack();
33023 +
33024 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
33025 test_bit(STATUS_HCMD_ACTIVE, &priv->status));
33026 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_INT_ENABLED:\t %d\n",
33027 @@ -680,6 +682,8 @@ static ssize_t iwl_dbgfs_qos_read(struct
33028 char buf[256 * NUM_IWL_RXON_CTX];
33029 const size_t bufsz = sizeof(buf);
33030
33031 + pax_track_stack();
33032 +
33033 for_each_context(priv, ctx) {
33034 pos += scnprintf(buf + pos, bufsz - pos, "context %d:\n",
33035 ctx->ctxid);
33036 diff -urNp linux-3.0.9/drivers/net/wireless/iwlwifi/iwl-debug.h linux-3.0.9/drivers/net/wireless/iwlwifi/iwl-debug.h
33037 --- linux-3.0.9/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-11-11 13:12:24.000000000 -0500
33038 +++ linux-3.0.9/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-11-15 20:02:59.000000000 -0500
33039 @@ -68,8 +68,8 @@ do {
33040 } while (0)
33041
33042 #else
33043 -#define IWL_DEBUG(__priv, level, fmt, args...)
33044 -#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
33045 +#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
33046 +#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
33047 static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
33048 const void *p, u32 len)
33049 {}
33050 diff -urNp linux-3.0.9/drivers/net/wireless/iwmc3200wifi/debugfs.c linux-3.0.9/drivers/net/wireless/iwmc3200wifi/debugfs.c
33051 --- linux-3.0.9/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-11-11 13:12:24.000000000 -0500
33052 +++ linux-3.0.9/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-11-15 20:02:59.000000000 -0500
33053 @@ -327,6 +327,8 @@ static ssize_t iwm_debugfs_fw_err_read(s
33054 int buf_len = 512;
33055 size_t len = 0;
33056
33057 + pax_track_stack();
33058 +
33059 if (*ppos != 0)
33060 return 0;
33061 if (count < sizeof(buf))
33062 diff -urNp linux-3.0.9/drivers/net/wireless/mac80211_hwsim.c linux-3.0.9/drivers/net/wireless/mac80211_hwsim.c
33063 --- linux-3.0.9/drivers/net/wireless/mac80211_hwsim.c 2011-11-11 13:12:24.000000000 -0500
33064 +++ linux-3.0.9/drivers/net/wireless/mac80211_hwsim.c 2011-11-15 20:02:59.000000000 -0500
33065 @@ -1260,9 +1260,11 @@ static int __init init_mac80211_hwsim(vo
33066 return -EINVAL;
33067
33068 if (fake_hw_scan) {
33069 - mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan;
33070 - mac80211_hwsim_ops.sw_scan_start = NULL;
33071 - mac80211_hwsim_ops.sw_scan_complete = NULL;
33072 + pax_open_kernel();
33073 + *(void **)&mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan;
33074 + *(void **)&mac80211_hwsim_ops.sw_scan_start = NULL;
33075 + *(void **)&mac80211_hwsim_ops.sw_scan_complete = NULL;
33076 + pax_close_kernel();
33077 }
33078
33079 spin_lock_init(&hwsim_radio_lock);
33080 diff -urNp linux-3.0.9/drivers/net/wireless/rndis_wlan.c linux-3.0.9/drivers/net/wireless/rndis_wlan.c
33081 --- linux-3.0.9/drivers/net/wireless/rndis_wlan.c 2011-11-11 13:12:24.000000000 -0500
33082 +++ linux-3.0.9/drivers/net/wireless/rndis_wlan.c 2011-11-15 20:02:59.000000000 -0500
33083 @@ -1277,7 +1277,7 @@ static int set_rts_threshold(struct usbn
33084
33085 netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold);
33086
33087 - if (rts_threshold < 0 || rts_threshold > 2347)
33088 + if (rts_threshold > 2347)
33089 rts_threshold = 2347;
33090
33091 tmp = cpu_to_le32(rts_threshold);
33092 diff -urNp linux-3.0.9/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c linux-3.0.9/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
33093 --- linux-3.0.9/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c 2011-11-11 13:12:24.000000000 -0500
33094 +++ linux-3.0.9/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c 2011-11-15 20:02:59.000000000 -0500
33095 @@ -837,6 +837,8 @@ bool _rtl92c_phy_sw_chnl_step_by_step(st
33096 u8 rfpath;
33097 u8 num_total_rfpath = rtlphy->num_total_rfpath;
33098
33099 + pax_track_stack();
33100 +
33101 precommoncmdcnt = 0;
33102 _rtl92c_phy_set_sw_chnl_cmdarray(precommoncmd, precommoncmdcnt++,
33103 MAX_PRECMD_CNT,
33104 diff -urNp linux-3.0.9/drivers/net/wireless/wl1251/wl1251.h linux-3.0.9/drivers/net/wireless/wl1251/wl1251.h
33105 --- linux-3.0.9/drivers/net/wireless/wl1251/wl1251.h 2011-11-11 13:12:24.000000000 -0500
33106 +++ linux-3.0.9/drivers/net/wireless/wl1251/wl1251.h 2011-11-15 20:02:59.000000000 -0500
33107 @@ -266,7 +266,7 @@ struct wl1251_if_operations {
33108 void (*reset)(struct wl1251 *wl);
33109 void (*enable_irq)(struct wl1251 *wl);
33110 void (*disable_irq)(struct wl1251 *wl);
33111 -};
33112 +} __no_const;
33113
33114 struct wl1251 {
33115 struct ieee80211_hw *hw;
33116 diff -urNp linux-3.0.9/drivers/net/wireless/wl12xx/spi.c linux-3.0.9/drivers/net/wireless/wl12xx/spi.c
33117 --- linux-3.0.9/drivers/net/wireless/wl12xx/spi.c 2011-11-11 13:12:24.000000000 -0500
33118 +++ linux-3.0.9/drivers/net/wireless/wl12xx/spi.c 2011-11-15 20:02:59.000000000 -0500
33119 @@ -280,6 +280,8 @@ static void wl1271_spi_raw_write(struct
33120 u32 chunk_len;
33121 int i;
33122
33123 + pax_track_stack();
33124 +
33125 WARN_ON(len > WL1271_AGGR_BUFFER_SIZE);
33126
33127 spi_message_init(&m);
33128 diff -urNp linux-3.0.9/drivers/oprofile/buffer_sync.c linux-3.0.9/drivers/oprofile/buffer_sync.c
33129 --- linux-3.0.9/drivers/oprofile/buffer_sync.c 2011-11-11 13:12:24.000000000 -0500
33130 +++ linux-3.0.9/drivers/oprofile/buffer_sync.c 2011-11-15 20:02:59.000000000 -0500
33131 @@ -343,7 +343,7 @@ static void add_data(struct op_entry *en
33132 if (cookie == NO_COOKIE)
33133 offset = pc;
33134 if (cookie == INVALID_COOKIE) {
33135 - atomic_inc(&oprofile_stats.sample_lost_no_mapping);
33136 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
33137 offset = pc;
33138 }
33139 if (cookie != last_cookie) {
33140 @@ -387,14 +387,14 @@ add_sample(struct mm_struct *mm, struct
33141 /* add userspace sample */
33142
33143 if (!mm) {
33144 - atomic_inc(&oprofile_stats.sample_lost_no_mm);
33145 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
33146 return 0;
33147 }
33148
33149 cookie = lookup_dcookie(mm, s->eip, &offset);
33150
33151 if (cookie == INVALID_COOKIE) {
33152 - atomic_inc(&oprofile_stats.sample_lost_no_mapping);
33153 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
33154 return 0;
33155 }
33156
33157 @@ -563,7 +563,7 @@ void sync_buffer(int cpu)
33158 /* ignore backtraces if failed to add a sample */
33159 if (state == sb_bt_start) {
33160 state = sb_bt_ignore;
33161 - atomic_inc(&oprofile_stats.bt_lost_no_mapping);
33162 + atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
33163 }
33164 }
33165 release_mm(mm);
33166 diff -urNp linux-3.0.9/drivers/oprofile/event_buffer.c linux-3.0.9/drivers/oprofile/event_buffer.c
33167 --- linux-3.0.9/drivers/oprofile/event_buffer.c 2011-11-11 13:12:24.000000000 -0500
33168 +++ linux-3.0.9/drivers/oprofile/event_buffer.c 2011-11-15 20:02:59.000000000 -0500
33169 @@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
33170 }
33171
33172 if (buffer_pos == buffer_size) {
33173 - atomic_inc(&oprofile_stats.event_lost_overflow);
33174 + atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
33175 return;
33176 }
33177
33178 diff -urNp linux-3.0.9/drivers/oprofile/oprof.c linux-3.0.9/drivers/oprofile/oprof.c
33179 --- linux-3.0.9/drivers/oprofile/oprof.c 2011-11-11 13:12:24.000000000 -0500
33180 +++ linux-3.0.9/drivers/oprofile/oprof.c 2011-11-15 20:02:59.000000000 -0500
33181 @@ -110,7 +110,7 @@ static void switch_worker(struct work_st
33182 if (oprofile_ops.switch_events())
33183 return;
33184
33185 - atomic_inc(&oprofile_stats.multiplex_counter);
33186 + atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
33187 start_switch_worker();
33188 }
33189
33190 diff -urNp linux-3.0.9/drivers/oprofile/oprofilefs.c linux-3.0.9/drivers/oprofile/oprofilefs.c
33191 --- linux-3.0.9/drivers/oprofile/oprofilefs.c 2011-11-11 13:12:24.000000000 -0500
33192 +++ linux-3.0.9/drivers/oprofile/oprofilefs.c 2011-11-15 20:02:59.000000000 -0500
33193 @@ -186,7 +186,7 @@ static const struct file_operations atom
33194
33195
33196 int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
33197 - char const *name, atomic_t *val)
33198 + char const *name, atomic_unchecked_t *val)
33199 {
33200 return __oprofilefs_create_file(sb, root, name,
33201 &atomic_ro_fops, 0444, val);
33202 diff -urNp linux-3.0.9/drivers/oprofile/oprofile_stats.c linux-3.0.9/drivers/oprofile/oprofile_stats.c
33203 --- linux-3.0.9/drivers/oprofile/oprofile_stats.c 2011-11-11 13:12:24.000000000 -0500
33204 +++ linux-3.0.9/drivers/oprofile/oprofile_stats.c 2011-11-15 20:02:59.000000000 -0500
33205 @@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
33206 cpu_buf->sample_invalid_eip = 0;
33207 }
33208
33209 - atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
33210 - atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
33211 - atomic_set(&oprofile_stats.event_lost_overflow, 0);
33212 - atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
33213 - atomic_set(&oprofile_stats.multiplex_counter, 0);
33214 + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
33215 + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
33216 + atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
33217 + atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
33218 + atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
33219 }
33220
33221
33222 diff -urNp linux-3.0.9/drivers/oprofile/oprofile_stats.h linux-3.0.9/drivers/oprofile/oprofile_stats.h
33223 --- linux-3.0.9/drivers/oprofile/oprofile_stats.h 2011-11-11 13:12:24.000000000 -0500
33224 +++ linux-3.0.9/drivers/oprofile/oprofile_stats.h 2011-11-15 20:02:59.000000000 -0500
33225 @@ -13,11 +13,11 @@
33226 #include <asm/atomic.h>
33227
33228 struct oprofile_stat_struct {
33229 - atomic_t sample_lost_no_mm;
33230 - atomic_t sample_lost_no_mapping;
33231 - atomic_t bt_lost_no_mapping;
33232 - atomic_t event_lost_overflow;
33233 - atomic_t multiplex_counter;
33234 + atomic_unchecked_t sample_lost_no_mm;
33235 + atomic_unchecked_t sample_lost_no_mapping;
33236 + atomic_unchecked_t bt_lost_no_mapping;
33237 + atomic_unchecked_t event_lost_overflow;
33238 + atomic_unchecked_t multiplex_counter;
33239 };
33240
33241 extern struct oprofile_stat_struct oprofile_stats;
33242 diff -urNp linux-3.0.9/drivers/parport/procfs.c linux-3.0.9/drivers/parport/procfs.c
33243 --- linux-3.0.9/drivers/parport/procfs.c 2011-11-11 13:12:24.000000000 -0500
33244 +++ linux-3.0.9/drivers/parport/procfs.c 2011-11-15 20:02:59.000000000 -0500
33245 @@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
33246
33247 *ppos += len;
33248
33249 - return copy_to_user(result, buffer, len) ? -EFAULT : 0;
33250 + return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
33251 }
33252
33253 #ifdef CONFIG_PARPORT_1284
33254 @@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table
33255
33256 *ppos += len;
33257
33258 - return copy_to_user (result, buffer, len) ? -EFAULT : 0;
33259 + return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
33260 }
33261 #endif /* IEEE1284.3 support. */
33262
33263 diff -urNp linux-3.0.9/drivers/pci/hotplug/cpci_hotplug.h linux-3.0.9/drivers/pci/hotplug/cpci_hotplug.h
33264 --- linux-3.0.9/drivers/pci/hotplug/cpci_hotplug.h 2011-11-11 13:12:24.000000000 -0500
33265 +++ linux-3.0.9/drivers/pci/hotplug/cpci_hotplug.h 2011-11-15 20:02:59.000000000 -0500
33266 @@ -59,7 +59,7 @@ struct cpci_hp_controller_ops {
33267 int (*hardware_test) (struct slot* slot, u32 value);
33268 u8 (*get_power) (struct slot* slot);
33269 int (*set_power) (struct slot* slot, int value);
33270 -};
33271 +} __no_const;
33272
33273 struct cpci_hp_controller {
33274 unsigned int irq;
33275 diff -urNp linux-3.0.9/drivers/pci/hotplug/cpqphp_nvram.c linux-3.0.9/drivers/pci/hotplug/cpqphp_nvram.c
33276 --- linux-3.0.9/drivers/pci/hotplug/cpqphp_nvram.c 2011-11-11 13:12:24.000000000 -0500
33277 +++ linux-3.0.9/drivers/pci/hotplug/cpqphp_nvram.c 2011-11-15 20:02:59.000000000 -0500
33278 @@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
33279
33280 void compaq_nvram_init (void __iomem *rom_start)
33281 {
33282 +
33283 +#ifndef CONFIG_PAX_KERNEXEC
33284 if (rom_start) {
33285 compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
33286 }
33287 +#endif
33288 +
33289 dbg("int15 entry = %p\n", compaq_int15_entry_point);
33290
33291 /* initialize our int15 lock */
33292 diff -urNp linux-3.0.9/drivers/pci/pcie/aspm.c linux-3.0.9/drivers/pci/pcie/aspm.c
33293 --- linux-3.0.9/drivers/pci/pcie/aspm.c 2011-11-11 13:12:24.000000000 -0500
33294 +++ linux-3.0.9/drivers/pci/pcie/aspm.c 2011-11-15 20:02:59.000000000 -0500
33295 @@ -27,9 +27,9 @@
33296 #define MODULE_PARAM_PREFIX "pcie_aspm."
33297
33298 /* Note: those are not register definitions */
33299 -#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
33300 -#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
33301 -#define ASPM_STATE_L1 (4) /* L1 state */
33302 +#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
33303 +#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
33304 +#define ASPM_STATE_L1 (4U) /* L1 state */
33305 #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
33306 #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
33307
33308 diff -urNp linux-3.0.9/drivers/pci/probe.c linux-3.0.9/drivers/pci/probe.c
33309 --- linux-3.0.9/drivers/pci/probe.c 2011-11-11 13:12:24.000000000 -0500
33310 +++ linux-3.0.9/drivers/pci/probe.c 2011-11-15 20:02:59.000000000 -0500
33311 @@ -129,7 +129,7 @@ int __pci_read_base(struct pci_dev *dev,
33312 u32 l, sz, mask;
33313 u16 orig_cmd;
33314
33315 - mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
33316 + mask = type ? (u32)PCI_ROM_ADDRESS_MASK : ~0;
33317
33318 if (!dev->mmio_always_on) {
33319 pci_read_config_word(dev, PCI_COMMAND, &orig_cmd);
33320 diff -urNp linux-3.0.9/drivers/pci/proc.c linux-3.0.9/drivers/pci/proc.c
33321 --- linux-3.0.9/drivers/pci/proc.c 2011-11-11 13:12:24.000000000 -0500
33322 +++ linux-3.0.9/drivers/pci/proc.c 2011-11-15 20:02:59.000000000 -0500
33323 @@ -476,7 +476,16 @@ static const struct file_operations proc
33324 static int __init pci_proc_init(void)
33325 {
33326 struct pci_dev *dev = NULL;
33327 +
33328 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
33329 +#ifdef CONFIG_GRKERNSEC_PROC_USER
33330 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
33331 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
33332 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
33333 +#endif
33334 +#else
33335 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
33336 +#endif
33337 proc_create("devices", 0, proc_bus_pci_dir,
33338 &proc_bus_pci_dev_operations);
33339 proc_initialized = 1;
33340 diff -urNp linux-3.0.9/drivers/pci/xen-pcifront.c linux-3.0.9/drivers/pci/xen-pcifront.c
33341 --- linux-3.0.9/drivers/pci/xen-pcifront.c 2011-11-11 13:12:24.000000000 -0500
33342 +++ linux-3.0.9/drivers/pci/xen-pcifront.c 2011-11-15 20:02:59.000000000 -0500
33343 @@ -187,6 +187,8 @@ static int pcifront_bus_read(struct pci_
33344 struct pcifront_sd *sd = bus->sysdata;
33345 struct pcifront_device *pdev = pcifront_get_pdev(sd);
33346
33347 + pax_track_stack();
33348 +
33349 if (verbose_request)
33350 dev_info(&pdev->xdev->dev,
33351 "read dev=%04x:%02x:%02x.%01x - offset %x size %d\n",
33352 @@ -226,6 +228,8 @@ static int pcifront_bus_write(struct pci
33353 struct pcifront_sd *sd = bus->sysdata;
33354 struct pcifront_device *pdev = pcifront_get_pdev(sd);
33355
33356 + pax_track_stack();
33357 +
33358 if (verbose_request)
33359 dev_info(&pdev->xdev->dev,
33360 "write dev=%04x:%02x:%02x.%01x - "
33361 @@ -258,6 +262,8 @@ static int pci_frontend_enable_msix(stru
33362 struct pcifront_device *pdev = pcifront_get_pdev(sd);
33363 struct msi_desc *entry;
33364
33365 + pax_track_stack();
33366 +
33367 if (nvec > SH_INFO_MAX_VEC) {
33368 dev_err(&dev->dev, "too much vector for pci frontend: %x."
33369 " Increase SH_INFO_MAX_VEC.\n", nvec);
33370 @@ -309,6 +315,8 @@ static void pci_frontend_disable_msix(st
33371 struct pcifront_sd *sd = dev->bus->sysdata;
33372 struct pcifront_device *pdev = pcifront_get_pdev(sd);
33373
33374 + pax_track_stack();
33375 +
33376 err = do_pci_op(pdev, &op);
33377
33378 /* What should do for error ? */
33379 @@ -328,6 +336,8 @@ static int pci_frontend_enable_msi(struc
33380 struct pcifront_sd *sd = dev->bus->sysdata;
33381 struct pcifront_device *pdev = pcifront_get_pdev(sd);
33382
33383 + pax_track_stack();
33384 +
33385 err = do_pci_op(pdev, &op);
33386 if (likely(!err)) {
33387 vector[0] = op.value;
33388 diff -urNp linux-3.0.9/drivers/platform/x86/thinkpad_acpi.c linux-3.0.9/drivers/platform/x86/thinkpad_acpi.c
33389 --- linux-3.0.9/drivers/platform/x86/thinkpad_acpi.c 2011-11-11 13:12:24.000000000 -0500
33390 +++ linux-3.0.9/drivers/platform/x86/thinkpad_acpi.c 2011-11-15 20:02:59.000000000 -0500
33391 @@ -2094,7 +2094,7 @@ static int hotkey_mask_get(void)
33392 return 0;
33393 }
33394
33395 -void static hotkey_mask_warn_incomplete_mask(void)
33396 +static void hotkey_mask_warn_incomplete_mask(void)
33397 {
33398 /* log only what the user can fix... */
33399 const u32 wantedmask = hotkey_driver_mask &
33400 diff -urNp linux-3.0.9/drivers/pnp/pnpbios/bioscalls.c linux-3.0.9/drivers/pnp/pnpbios/bioscalls.c
33401 --- linux-3.0.9/drivers/pnp/pnpbios/bioscalls.c 2011-11-11 13:12:24.000000000 -0500
33402 +++ linux-3.0.9/drivers/pnp/pnpbios/bioscalls.c 2011-11-15 20:02:59.000000000 -0500
33403 @@ -59,7 +59,7 @@ do { \
33404 set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
33405 } while(0)
33406
33407 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
33408 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
33409 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
33410
33411 /*
33412 @@ -96,7 +96,10 @@ static inline u16 call_pnp_bios(u16 func
33413
33414 cpu = get_cpu();
33415 save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
33416 +
33417 + pax_open_kernel();
33418 get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
33419 + pax_close_kernel();
33420
33421 /* On some boxes IRQ's during PnP BIOS calls are deadly. */
33422 spin_lock_irqsave(&pnp_bios_lock, flags);
33423 @@ -134,7 +137,10 @@ static inline u16 call_pnp_bios(u16 func
33424 :"memory");
33425 spin_unlock_irqrestore(&pnp_bios_lock, flags);
33426
33427 + pax_open_kernel();
33428 get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
33429 + pax_close_kernel();
33430 +
33431 put_cpu();
33432
33433 /* If we get here and this is set then the PnP BIOS faulted on us. */
33434 @@ -468,7 +474,7 @@ int pnp_bios_read_escd(char *data, u32 n
33435 return status;
33436 }
33437
33438 -void pnpbios_calls_init(union pnp_bios_install_struct *header)
33439 +void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
33440 {
33441 int i;
33442
33443 @@ -476,6 +482,8 @@ void pnpbios_calls_init(union pnp_bios_i
33444 pnp_bios_callpoint.offset = header->fields.pm16offset;
33445 pnp_bios_callpoint.segment = PNP_CS16;
33446
33447 + pax_open_kernel();
33448 +
33449 for_each_possible_cpu(i) {
33450 struct desc_struct *gdt = get_cpu_gdt_table(i);
33451 if (!gdt)
33452 @@ -487,4 +495,6 @@ void pnpbios_calls_init(union pnp_bios_i
33453 set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
33454 (unsigned long)__va(header->fields.pm16dseg));
33455 }
33456 +
33457 + pax_close_kernel();
33458 }
33459 diff -urNp linux-3.0.9/drivers/pnp/resource.c linux-3.0.9/drivers/pnp/resource.c
33460 --- linux-3.0.9/drivers/pnp/resource.c 2011-11-11 13:12:24.000000000 -0500
33461 +++ linux-3.0.9/drivers/pnp/resource.c 2011-11-15 20:02:59.000000000 -0500
33462 @@ -360,7 +360,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
33463 return 1;
33464
33465 /* check if the resource is valid */
33466 - if (*irq < 0 || *irq > 15)
33467 + if (*irq > 15)
33468 return 0;
33469
33470 /* check if the resource is reserved */
33471 @@ -424,7 +424,7 @@ int pnp_check_dma(struct pnp_dev *dev, s
33472 return 1;
33473
33474 /* check if the resource is valid */
33475 - if (*dma < 0 || *dma == 4 || *dma > 7)
33476 + if (*dma == 4 || *dma > 7)
33477 return 0;
33478
33479 /* check if the resource is reserved */
33480 diff -urNp linux-3.0.9/drivers/power/bq27x00_battery.c linux-3.0.9/drivers/power/bq27x00_battery.c
33481 --- linux-3.0.9/drivers/power/bq27x00_battery.c 2011-11-11 13:12:24.000000000 -0500
33482 +++ linux-3.0.9/drivers/power/bq27x00_battery.c 2011-11-15 20:02:59.000000000 -0500
33483 @@ -67,7 +67,7 @@
33484 struct bq27x00_device_info;
33485 struct bq27x00_access_methods {
33486 int (*read)(struct bq27x00_device_info *di, u8 reg, bool single);
33487 -};
33488 +} __no_const;
33489
33490 enum bq27x00_chip { BQ27000, BQ27500 };
33491
33492 diff -urNp linux-3.0.9/drivers/regulator/max8660.c linux-3.0.9/drivers/regulator/max8660.c
33493 --- linux-3.0.9/drivers/regulator/max8660.c 2011-11-11 13:12:24.000000000 -0500
33494 +++ linux-3.0.9/drivers/regulator/max8660.c 2011-11-15 20:02:59.000000000 -0500
33495 @@ -383,8 +383,10 @@ static int __devinit max8660_probe(struc
33496 max8660->shadow_regs[MAX8660_OVER1] = 5;
33497 } else {
33498 /* Otherwise devices can be toggled via software */
33499 - max8660_dcdc_ops.enable = max8660_dcdc_enable;
33500 - max8660_dcdc_ops.disable = max8660_dcdc_disable;
33501 + pax_open_kernel();
33502 + *(void **)&max8660_dcdc_ops.enable = max8660_dcdc_enable;
33503 + *(void **)&max8660_dcdc_ops.disable = max8660_dcdc_disable;
33504 + pax_close_kernel();
33505 }
33506
33507 /*
33508 diff -urNp linux-3.0.9/drivers/regulator/mc13892-regulator.c linux-3.0.9/drivers/regulator/mc13892-regulator.c
33509 --- linux-3.0.9/drivers/regulator/mc13892-regulator.c 2011-11-11 13:12:24.000000000 -0500
33510 +++ linux-3.0.9/drivers/regulator/mc13892-regulator.c 2011-11-15 20:02:59.000000000 -0500
33511 @@ -564,10 +564,12 @@ static int __devinit mc13892_regulator_p
33512 }
33513 mc13xxx_unlock(mc13892);
33514
33515 - mc13892_regulators[MC13892_VCAM].desc.ops->set_mode
33516 + pax_open_kernel();
33517 + *(void **)&mc13892_regulators[MC13892_VCAM].desc.ops->set_mode
33518 = mc13892_vcam_set_mode;
33519 - mc13892_regulators[MC13892_VCAM].desc.ops->get_mode
33520 + *(void **)&mc13892_regulators[MC13892_VCAM].desc.ops->get_mode
33521 = mc13892_vcam_get_mode;
33522 + pax_close_kernel();
33523 for (i = 0; i < pdata->num_regulators; i++) {
33524 init_data = &pdata->regulators[i];
33525 priv->regulators[i] = regulator_register(
33526 diff -urNp linux-3.0.9/drivers/rtc/rtc-dev.c linux-3.0.9/drivers/rtc/rtc-dev.c
33527 --- linux-3.0.9/drivers/rtc/rtc-dev.c 2011-11-11 13:12:24.000000000 -0500
33528 +++ linux-3.0.9/drivers/rtc/rtc-dev.c 2011-11-15 20:02:59.000000000 -0500
33529 @@ -14,6 +14,7 @@
33530 #include <linux/module.h>
33531 #include <linux/rtc.h>
33532 #include <linux/sched.h>
33533 +#include <linux/grsecurity.h>
33534 #include "rtc-core.h"
33535
33536 static dev_t rtc_devt;
33537 @@ -345,6 +346,8 @@ static long rtc_dev_ioctl(struct file *f
33538 if (copy_from_user(&tm, uarg, sizeof(tm)))
33539 return -EFAULT;
33540
33541 + gr_log_timechange();
33542 +
33543 return rtc_set_time(rtc, &tm);
33544
33545 case RTC_PIE_ON:
33546 diff -urNp linux-3.0.9/drivers/scsi/aacraid/aacraid.h linux-3.0.9/drivers/scsi/aacraid/aacraid.h
33547 --- linux-3.0.9/drivers/scsi/aacraid/aacraid.h 2011-11-11 13:12:24.000000000 -0500
33548 +++ linux-3.0.9/drivers/scsi/aacraid/aacraid.h 2011-11-15 20:02:59.000000000 -0500
33549 @@ -492,7 +492,7 @@ struct adapter_ops
33550 int (*adapter_scsi)(struct fib * fib, struct scsi_cmnd * cmd);
33551 /* Administrative operations */
33552 int (*adapter_comm)(struct aac_dev * dev, int comm);
33553 -};
33554 +} __no_const;
33555
33556 /*
33557 * Define which interrupt handler needs to be installed
33558 diff -urNp linux-3.0.9/drivers/scsi/aacraid/commctrl.c linux-3.0.9/drivers/scsi/aacraid/commctrl.c
33559 --- linux-3.0.9/drivers/scsi/aacraid/commctrl.c 2011-11-11 13:12:24.000000000 -0500
33560 +++ linux-3.0.9/drivers/scsi/aacraid/commctrl.c 2011-11-15 20:02:59.000000000 -0500
33561 @@ -482,6 +482,7 @@ static int aac_send_raw_srb(struct aac_d
33562 u32 actual_fibsize64, actual_fibsize = 0;
33563 int i;
33564
33565 + pax_track_stack();
33566
33567 if (dev->in_reset) {
33568 dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
33569 diff -urNp linux-3.0.9/drivers/scsi/aacraid/linit.c linux-3.0.9/drivers/scsi/aacraid/linit.c
33570 --- linux-3.0.9/drivers/scsi/aacraid/linit.c 2011-11-11 13:12:24.000000000 -0500
33571 +++ linux-3.0.9/drivers/scsi/aacraid/linit.c 2011-11-15 20:02:59.000000000 -0500
33572 @@ -92,7 +92,7 @@ static DECLARE_PCI_DEVICE_TABLE(aac_pci_
33573 #elif defined(__devinitconst)
33574 static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
33575 #else
33576 -static const struct pci_device_id aac_pci_tbl[] __devinitdata = {
33577 +static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
33578 #endif
33579 { 0x1028, 0x0001, 0x1028, 0x0001, 0, 0, 0 }, /* PERC 2/Si (Iguana/PERC2Si) */
33580 { 0x1028, 0x0002, 0x1028, 0x0002, 0, 0, 1 }, /* PERC 3/Di (Opal/PERC3Di) */
33581 diff -urNp linux-3.0.9/drivers/scsi/aic94xx/aic94xx_init.c linux-3.0.9/drivers/scsi/aic94xx/aic94xx_init.c
33582 --- linux-3.0.9/drivers/scsi/aic94xx/aic94xx_init.c 2011-11-11 13:12:24.000000000 -0500
33583 +++ linux-3.0.9/drivers/scsi/aic94xx/aic94xx_init.c 2011-11-15 20:02:59.000000000 -0500
33584 @@ -1012,7 +1012,7 @@ static struct sas_domain_function_templa
33585 .lldd_control_phy = asd_control_phy,
33586 };
33587
33588 -static const struct pci_device_id aic94xx_pci_table[] __devinitdata = {
33589 +static const struct pci_device_id aic94xx_pci_table[] __devinitconst = {
33590 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x410),0, 0, 1},
33591 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x412),0, 0, 1},
33592 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x416),0, 0, 1},
33593 diff -urNp linux-3.0.9/drivers/scsi/bfa/bfad.c linux-3.0.9/drivers/scsi/bfa/bfad.c
33594 --- linux-3.0.9/drivers/scsi/bfa/bfad.c 2011-11-11 13:12:24.000000000 -0500
33595 +++ linux-3.0.9/drivers/scsi/bfa/bfad.c 2011-11-15 20:02:59.000000000 -0500
33596 @@ -1032,6 +1032,8 @@ bfad_start_ops(struct bfad_s *bfad) {
33597 struct bfad_vport_s *vport, *vport_new;
33598 struct bfa_fcs_driver_info_s driver_info;
33599
33600 + pax_track_stack();
33601 +
33602 /* Fill the driver_info info to fcs*/
33603 memset(&driver_info, 0, sizeof(driver_info));
33604 strncpy(driver_info.version, BFAD_DRIVER_VERSION,
33605 diff -urNp linux-3.0.9/drivers/scsi/bfa/bfa_fcs_lport.c linux-3.0.9/drivers/scsi/bfa/bfa_fcs_lport.c
33606 --- linux-3.0.9/drivers/scsi/bfa/bfa_fcs_lport.c 2011-11-11 13:12:24.000000000 -0500
33607 +++ linux-3.0.9/drivers/scsi/bfa/bfa_fcs_lport.c 2011-11-15 20:02:59.000000000 -0500
33608 @@ -1559,6 +1559,8 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
33609 u16 len, count;
33610 u16 templen;
33611
33612 + pax_track_stack();
33613 +
33614 /*
33615 * get hba attributes
33616 */
33617 @@ -1836,6 +1838,8 @@ bfa_fcs_lport_fdmi_build_portattr_block(
33618 u8 count = 0;
33619 u16 templen;
33620
33621 + pax_track_stack();
33622 +
33623 /*
33624 * get port attributes
33625 */
33626 diff -urNp linux-3.0.9/drivers/scsi/bfa/bfa_fcs_rport.c linux-3.0.9/drivers/scsi/bfa/bfa_fcs_rport.c
33627 --- linux-3.0.9/drivers/scsi/bfa/bfa_fcs_rport.c 2011-11-11 13:12:24.000000000 -0500
33628 +++ linux-3.0.9/drivers/scsi/bfa/bfa_fcs_rport.c 2011-11-15 20:02:59.000000000 -0500
33629 @@ -1844,6 +1844,8 @@ bfa_fcs_rport_process_rpsc(struct bfa_fc
33630 struct fc_rpsc_speed_info_s speeds;
33631 struct bfa_port_attr_s pport_attr;
33632
33633 + pax_track_stack();
33634 +
33635 bfa_trc(port->fcs, rx_fchs->s_id);
33636 bfa_trc(port->fcs, rx_fchs->d_id);
33637
33638 diff -urNp linux-3.0.9/drivers/scsi/bfa/bfa.h linux-3.0.9/drivers/scsi/bfa/bfa.h
33639 --- linux-3.0.9/drivers/scsi/bfa/bfa.h 2011-11-11 13:12:24.000000000 -0500
33640 +++ linux-3.0.9/drivers/scsi/bfa/bfa.h 2011-11-15 20:02:59.000000000 -0500
33641 @@ -238,7 +238,7 @@ struct bfa_hwif_s {
33642 u32 *nvecs, u32 *maxvec);
33643 void (*hw_msix_get_rme_range) (struct bfa_s *bfa, u32 *start,
33644 u32 *end);
33645 -};
33646 +} __no_const;
33647 typedef void (*bfa_cb_iocfc_t) (void *cbarg, enum bfa_status status);
33648
33649 struct bfa_iocfc_s {
33650 diff -urNp linux-3.0.9/drivers/scsi/bfa/bfa_ioc.h linux-3.0.9/drivers/scsi/bfa/bfa_ioc.h
33651 --- linux-3.0.9/drivers/scsi/bfa/bfa_ioc.h 2011-11-11 13:12:24.000000000 -0500
33652 +++ linux-3.0.9/drivers/scsi/bfa/bfa_ioc.h 2011-11-15 20:02:59.000000000 -0500
33653 @@ -196,7 +196,7 @@ struct bfa_ioc_cbfn_s {
33654 bfa_ioc_disable_cbfn_t disable_cbfn;
33655 bfa_ioc_hbfail_cbfn_t hbfail_cbfn;
33656 bfa_ioc_reset_cbfn_t reset_cbfn;
33657 -};
33658 +} __no_const;
33659
33660 /*
33661 * Heartbeat failure notification queue element.
33662 @@ -268,7 +268,7 @@ struct bfa_ioc_hwif_s {
33663 void (*ioc_sync_leave) (struct bfa_ioc_s *ioc);
33664 void (*ioc_sync_ack) (struct bfa_ioc_s *ioc);
33665 bfa_boolean_t (*ioc_sync_complete) (struct bfa_ioc_s *ioc);
33666 -};
33667 +} __no_const;
33668
33669 #define bfa_ioc_pcifn(__ioc) ((__ioc)->pcidev.pci_func)
33670 #define bfa_ioc_devid(__ioc) ((__ioc)->pcidev.device_id)
33671 diff -urNp linux-3.0.9/drivers/scsi/BusLogic.c linux-3.0.9/drivers/scsi/BusLogic.c
33672 --- linux-3.0.9/drivers/scsi/BusLogic.c 2011-11-11 13:12:24.000000000 -0500
33673 +++ linux-3.0.9/drivers/scsi/BusLogic.c 2011-11-15 20:02:59.000000000 -0500
33674 @@ -962,6 +962,8 @@ static int __init BusLogic_InitializeFla
33675 static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
33676 *PrototypeHostAdapter)
33677 {
33678 + pax_track_stack();
33679 +
33680 /*
33681 If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
33682 Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
33683 diff -urNp linux-3.0.9/drivers/scsi/dpt_i2o.c linux-3.0.9/drivers/scsi/dpt_i2o.c
33684 --- linux-3.0.9/drivers/scsi/dpt_i2o.c 2011-11-11 13:12:24.000000000 -0500
33685 +++ linux-3.0.9/drivers/scsi/dpt_i2o.c 2011-11-15 20:02:59.000000000 -0500
33686 @@ -1811,6 +1811,8 @@ static int adpt_i2o_passthru(adpt_hba* p
33687 dma_addr_t addr;
33688 ulong flags = 0;
33689
33690 + pax_track_stack();
33691 +
33692 memset(&msg, 0, MAX_MESSAGE_SIZE*4);
33693 // get user msg size in u32s
33694 if(get_user(size, &user_msg[0])){
33695 @@ -2317,6 +2319,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pH
33696 s32 rcode;
33697 dma_addr_t addr;
33698
33699 + pax_track_stack();
33700 +
33701 memset(msg, 0 , sizeof(msg));
33702 len = scsi_bufflen(cmd);
33703 direction = 0x00000000;
33704 diff -urNp linux-3.0.9/drivers/scsi/eata.c linux-3.0.9/drivers/scsi/eata.c
33705 --- linux-3.0.9/drivers/scsi/eata.c 2011-11-11 13:12:24.000000000 -0500
33706 +++ linux-3.0.9/drivers/scsi/eata.c 2011-11-15 20:02:59.000000000 -0500
33707 @@ -1087,6 +1087,8 @@ static int port_detect(unsigned long por
33708 struct hostdata *ha;
33709 char name[16];
33710
33711 + pax_track_stack();
33712 +
33713 sprintf(name, "%s%d", driver_name, j);
33714
33715 if (!request_region(port_base, REGION_SIZE, driver_name)) {
33716 diff -urNp linux-3.0.9/drivers/scsi/fcoe/fcoe_ctlr.c linux-3.0.9/drivers/scsi/fcoe/fcoe_ctlr.c
33717 --- linux-3.0.9/drivers/scsi/fcoe/fcoe_ctlr.c 2011-11-11 13:12:24.000000000 -0500
33718 +++ linux-3.0.9/drivers/scsi/fcoe/fcoe_ctlr.c 2011-11-15 20:02:59.000000000 -0500
33719 @@ -2503,6 +2503,8 @@ static int fcoe_ctlr_vn_recv(struct fcoe
33720 } buf;
33721 int rc;
33722
33723 + pax_track_stack();
33724 +
33725 fiph = (struct fip_header *)skb->data;
33726 sub = fiph->fip_subcode;
33727
33728 diff -urNp linux-3.0.9/drivers/scsi/gdth.c linux-3.0.9/drivers/scsi/gdth.c
33729 --- linux-3.0.9/drivers/scsi/gdth.c 2011-11-11 13:12:24.000000000 -0500
33730 +++ linux-3.0.9/drivers/scsi/gdth.c 2011-11-15 20:02:59.000000000 -0500
33731 @@ -4107,6 +4107,8 @@ static int ioc_lockdrv(void __user *arg)
33732 unsigned long flags;
33733 gdth_ha_str *ha;
33734
33735 + pax_track_stack();
33736 +
33737 if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
33738 return -EFAULT;
33739 ha = gdth_find_ha(ldrv.ionode);
33740 @@ -4139,6 +4141,8 @@ static int ioc_resetdrv(void __user *arg
33741 gdth_ha_str *ha;
33742 int rval;
33743
33744 + pax_track_stack();
33745 +
33746 if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
33747 res.number >= MAX_HDRIVES)
33748 return -EFAULT;
33749 @@ -4174,6 +4178,8 @@ static int ioc_general(void __user *arg,
33750 gdth_ha_str *ha;
33751 int rval;
33752
33753 + pax_track_stack();
33754 +
33755 if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
33756 return -EFAULT;
33757 ha = gdth_find_ha(gen.ionode);
33758 @@ -4642,6 +4648,9 @@ static void gdth_flush(gdth_ha_str *ha)
33759 int i;
33760 gdth_cmd_str gdtcmd;
33761 char cmnd[MAX_COMMAND_SIZE];
33762 +
33763 + pax_track_stack();
33764 +
33765 memset(cmnd, 0xff, MAX_COMMAND_SIZE);
33766
33767 TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
33768 diff -urNp linux-3.0.9/drivers/scsi/gdth_proc.c linux-3.0.9/drivers/scsi/gdth_proc.c
33769 --- linux-3.0.9/drivers/scsi/gdth_proc.c 2011-11-11 13:12:24.000000000 -0500
33770 +++ linux-3.0.9/drivers/scsi/gdth_proc.c 2011-11-15 20:02:59.000000000 -0500
33771 @@ -47,6 +47,9 @@ static int gdth_set_asc_info(struct Scsi
33772 u64 paddr;
33773
33774 char cmnd[MAX_COMMAND_SIZE];
33775 +
33776 + pax_track_stack();
33777 +
33778 memset(cmnd, 0xff, 12);
33779 memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
33780
33781 @@ -175,6 +178,8 @@ static int gdth_get_info(char *buffer,ch
33782 gdth_hget_str *phg;
33783 char cmnd[MAX_COMMAND_SIZE];
33784
33785 + pax_track_stack();
33786 +
33787 gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
33788 estr = kmalloc(sizeof(*estr), GFP_KERNEL);
33789 if (!gdtcmd || !estr)
33790 diff -urNp linux-3.0.9/drivers/scsi/hosts.c linux-3.0.9/drivers/scsi/hosts.c
33791 --- linux-3.0.9/drivers/scsi/hosts.c 2011-11-11 13:12:24.000000000 -0500
33792 +++ linux-3.0.9/drivers/scsi/hosts.c 2011-11-15 20:02:59.000000000 -0500
33793 @@ -42,7 +42,7 @@
33794 #include "scsi_logging.h"
33795
33796
33797 -static atomic_t scsi_host_next_hn; /* host_no for next new host */
33798 +static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
33799
33800
33801 static void scsi_host_cls_release(struct device *dev)
33802 @@ -357,7 +357,7 @@ struct Scsi_Host *scsi_host_alloc(struct
33803 * subtract one because we increment first then return, but we need to
33804 * know what the next host number was before increment
33805 */
33806 - shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
33807 + shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
33808 shost->dma_channel = 0xff;
33809
33810 /* These three are default values which can be overridden */
33811 diff -urNp linux-3.0.9/drivers/scsi/hpsa.c linux-3.0.9/drivers/scsi/hpsa.c
33812 --- linux-3.0.9/drivers/scsi/hpsa.c 2011-11-11 13:12:24.000000000 -0500
33813 +++ linux-3.0.9/drivers/scsi/hpsa.c 2011-11-15 20:02:59.000000000 -0500
33814 @@ -498,7 +498,7 @@ static inline u32 next_command(struct ct
33815 u32 a;
33816
33817 if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
33818 - return h->access.command_completed(h);
33819 + return h->access->command_completed(h);
33820
33821 if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
33822 a = *(h->reply_pool_head); /* Next cmd in ring buffer */
33823 @@ -2955,7 +2955,7 @@ static void start_io(struct ctlr_info *h
33824 while (!list_empty(&h->reqQ)) {
33825 c = list_entry(h->reqQ.next, struct CommandList, list);
33826 /* can't do anything if fifo is full */
33827 - if ((h->access.fifo_full(h))) {
33828 + if ((h->access->fifo_full(h))) {
33829 dev_warn(&h->pdev->dev, "fifo full\n");
33830 break;
33831 }
33832 @@ -2965,7 +2965,7 @@ static void start_io(struct ctlr_info *h
33833 h->Qdepth--;
33834
33835 /* Tell the controller execute command */
33836 - h->access.submit_command(h, c);
33837 + h->access->submit_command(h, c);
33838
33839 /* Put job onto the completed Q */
33840 addQ(&h->cmpQ, c);
33841 @@ -2974,17 +2974,17 @@ static void start_io(struct ctlr_info *h
33842
33843 static inline unsigned long get_next_completion(struct ctlr_info *h)
33844 {
33845 - return h->access.command_completed(h);
33846 + return h->access->command_completed(h);
33847 }
33848
33849 static inline bool interrupt_pending(struct ctlr_info *h)
33850 {
33851 - return h->access.intr_pending(h);
33852 + return h->access->intr_pending(h);
33853 }
33854
33855 static inline long interrupt_not_for_us(struct ctlr_info *h)
33856 {
33857 - return (h->access.intr_pending(h) == 0) ||
33858 + return (h->access->intr_pending(h) == 0) ||
33859 (h->interrupts_enabled == 0);
33860 }
33861
33862 @@ -3881,7 +3881,7 @@ static int __devinit hpsa_pci_init(struc
33863 if (prod_index < 0)
33864 return -ENODEV;
33865 h->product_name = products[prod_index].product_name;
33866 - h->access = *(products[prod_index].access);
33867 + h->access = products[prod_index].access;
33868
33869 if (hpsa_board_disabled(h->pdev)) {
33870 dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
33871 @@ -4158,7 +4158,7 @@ reinit_after_soft_reset:
33872 }
33873
33874 /* make sure the board interrupts are off */
33875 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
33876 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
33877
33878 if (hpsa_request_irq(h, do_hpsa_intr_msi, do_hpsa_intr_intx))
33879 goto clean2;
33880 @@ -4192,7 +4192,7 @@ reinit_after_soft_reset:
33881 * fake ones to scoop up any residual completions.
33882 */
33883 spin_lock_irqsave(&h->lock, flags);
33884 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
33885 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
33886 spin_unlock_irqrestore(&h->lock, flags);
33887 free_irq(h->intr[h->intr_mode], h);
33888 rc = hpsa_request_irq(h, hpsa_msix_discard_completions,
33889 @@ -4211,9 +4211,9 @@ reinit_after_soft_reset:
33890 dev_info(&h->pdev->dev, "Board READY.\n");
33891 dev_info(&h->pdev->dev,
33892 "Waiting for stale completions to drain.\n");
33893 - h->access.set_intr_mask(h, HPSA_INTR_ON);
33894 + h->access->set_intr_mask(h, HPSA_INTR_ON);
33895 msleep(10000);
33896 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
33897 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
33898
33899 rc = controller_reset_failed(h->cfgtable);
33900 if (rc)
33901 @@ -4234,7 +4234,7 @@ reinit_after_soft_reset:
33902 }
33903
33904 /* Turn the interrupts on so we can service requests */
33905 - h->access.set_intr_mask(h, HPSA_INTR_ON);
33906 + h->access->set_intr_mask(h, HPSA_INTR_ON);
33907
33908 hpsa_hba_inquiry(h);
33909 hpsa_register_scsi(h); /* hook ourselves into SCSI subsystem */
33910 @@ -4287,7 +4287,7 @@ static void hpsa_shutdown(struct pci_dev
33911 * To write all data in the battery backed cache to disks
33912 */
33913 hpsa_flush_cache(h);
33914 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
33915 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
33916 free_irq(h->intr[h->intr_mode], h);
33917 #ifdef CONFIG_PCI_MSI
33918 if (h->msix_vector)
33919 @@ -4450,7 +4450,7 @@ static __devinit void hpsa_enter_perform
33920 return;
33921 }
33922 /* Change the access methods to the performant access methods */
33923 - h->access = SA5_performant_access;
33924 + h->access = &SA5_performant_access;
33925 h->transMethod = CFGTBL_Trans_Performant;
33926 }
33927
33928 diff -urNp linux-3.0.9/drivers/scsi/hpsa.h linux-3.0.9/drivers/scsi/hpsa.h
33929 --- linux-3.0.9/drivers/scsi/hpsa.h 2011-11-11 13:12:24.000000000 -0500
33930 +++ linux-3.0.9/drivers/scsi/hpsa.h 2011-11-15 20:02:59.000000000 -0500
33931 @@ -73,7 +73,7 @@ struct ctlr_info {
33932 unsigned int msix_vector;
33933 unsigned int msi_vector;
33934 int intr_mode; /* either PERF_MODE_INT or SIMPLE_MODE_INT */
33935 - struct access_method access;
33936 + struct access_method *access;
33937
33938 /* queue and queue Info */
33939 struct list_head reqQ;
33940 diff -urNp linux-3.0.9/drivers/scsi/ips.h linux-3.0.9/drivers/scsi/ips.h
33941 --- linux-3.0.9/drivers/scsi/ips.h 2011-11-11 13:12:24.000000000 -0500
33942 +++ linux-3.0.9/drivers/scsi/ips.h 2011-11-15 20:02:59.000000000 -0500
33943 @@ -1027,7 +1027,7 @@ typedef struct {
33944 int (*intr)(struct ips_ha *);
33945 void (*enableint)(struct ips_ha *);
33946 uint32_t (*statupd)(struct ips_ha *);
33947 -} ips_hw_func_t;
33948 +} __no_const ips_hw_func_t;
33949
33950 typedef struct ips_ha {
33951 uint8_t ha_id[IPS_MAX_CHANNELS+1];
33952 diff -urNp linux-3.0.9/drivers/scsi/libfc/fc_exch.c linux-3.0.9/drivers/scsi/libfc/fc_exch.c
33953 --- linux-3.0.9/drivers/scsi/libfc/fc_exch.c 2011-11-11 13:12:24.000000000 -0500
33954 +++ linux-3.0.9/drivers/scsi/libfc/fc_exch.c 2011-11-15 20:02:59.000000000 -0500
33955 @@ -105,12 +105,12 @@ struct fc_exch_mgr {
33956 * all together if not used XXX
33957 */
33958 struct {
33959 - atomic_t no_free_exch;
33960 - atomic_t no_free_exch_xid;
33961 - atomic_t xid_not_found;
33962 - atomic_t xid_busy;
33963 - atomic_t seq_not_found;
33964 - atomic_t non_bls_resp;
33965 + atomic_unchecked_t no_free_exch;
33966 + atomic_unchecked_t no_free_exch_xid;
33967 + atomic_unchecked_t xid_not_found;
33968 + atomic_unchecked_t xid_busy;
33969 + atomic_unchecked_t seq_not_found;
33970 + atomic_unchecked_t non_bls_resp;
33971 } stats;
33972 };
33973
33974 @@ -700,7 +700,7 @@ static struct fc_exch *fc_exch_em_alloc(
33975 /* allocate memory for exchange */
33976 ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
33977 if (!ep) {
33978 - atomic_inc(&mp->stats.no_free_exch);
33979 + atomic_inc_unchecked(&mp->stats.no_free_exch);
33980 goto out;
33981 }
33982 memset(ep, 0, sizeof(*ep));
33983 @@ -761,7 +761,7 @@ out:
33984 return ep;
33985 err:
33986 spin_unlock_bh(&pool->lock);
33987 - atomic_inc(&mp->stats.no_free_exch_xid);
33988 + atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
33989 mempool_free(ep, mp->ep_pool);
33990 return NULL;
33991 }
33992 @@ -906,7 +906,7 @@ static enum fc_pf_rjt_reason fc_seq_look
33993 xid = ntohs(fh->fh_ox_id); /* we originated exch */
33994 ep = fc_exch_find(mp, xid);
33995 if (!ep) {
33996 - atomic_inc(&mp->stats.xid_not_found);
33997 + atomic_inc_unchecked(&mp->stats.xid_not_found);
33998 reject = FC_RJT_OX_ID;
33999 goto out;
34000 }
34001 @@ -936,7 +936,7 @@ static enum fc_pf_rjt_reason fc_seq_look
34002 ep = fc_exch_find(mp, xid);
34003 if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
34004 if (ep) {
34005 - atomic_inc(&mp->stats.xid_busy);
34006 + atomic_inc_unchecked(&mp->stats.xid_busy);
34007 reject = FC_RJT_RX_ID;
34008 goto rel;
34009 }
34010 @@ -947,7 +947,7 @@ static enum fc_pf_rjt_reason fc_seq_look
34011 }
34012 xid = ep->xid; /* get our XID */
34013 } else if (!ep) {
34014 - atomic_inc(&mp->stats.xid_not_found);
34015 + atomic_inc_unchecked(&mp->stats.xid_not_found);
34016 reject = FC_RJT_RX_ID; /* XID not found */
34017 goto out;
34018 }
34019 @@ -964,7 +964,7 @@ static enum fc_pf_rjt_reason fc_seq_look
34020 } else {
34021 sp = &ep->seq;
34022 if (sp->id != fh->fh_seq_id) {
34023 - atomic_inc(&mp->stats.seq_not_found);
34024 + atomic_inc_unchecked(&mp->stats.seq_not_found);
34025 reject = FC_RJT_SEQ_ID; /* sequence/exch should exist */
34026 goto rel;
34027 }
34028 @@ -1392,22 +1392,22 @@ static void fc_exch_recv_seq_resp(struct
34029
34030 ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
34031 if (!ep) {
34032 - atomic_inc(&mp->stats.xid_not_found);
34033 + atomic_inc_unchecked(&mp->stats.xid_not_found);
34034 goto out;
34035 }
34036 if (ep->esb_stat & ESB_ST_COMPLETE) {
34037 - atomic_inc(&mp->stats.xid_not_found);
34038 + atomic_inc_unchecked(&mp->stats.xid_not_found);
34039 goto rel;
34040 }
34041 if (ep->rxid == FC_XID_UNKNOWN)
34042 ep->rxid = ntohs(fh->fh_rx_id);
34043 if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
34044 - atomic_inc(&mp->stats.xid_not_found);
34045 + atomic_inc_unchecked(&mp->stats.xid_not_found);
34046 goto rel;
34047 }
34048 if (ep->did != ntoh24(fh->fh_s_id) &&
34049 ep->did != FC_FID_FLOGI) {
34050 - atomic_inc(&mp->stats.xid_not_found);
34051 + atomic_inc_unchecked(&mp->stats.xid_not_found);
34052 goto rel;
34053 }
34054 sof = fr_sof(fp);
34055 @@ -1416,7 +1416,7 @@ static void fc_exch_recv_seq_resp(struct
34056 sp->ssb_stat |= SSB_ST_RESP;
34057 sp->id = fh->fh_seq_id;
34058 } else if (sp->id != fh->fh_seq_id) {
34059 - atomic_inc(&mp->stats.seq_not_found);
34060 + atomic_inc_unchecked(&mp->stats.seq_not_found);
34061 goto rel;
34062 }
34063
34064 @@ -1480,9 +1480,9 @@ static void fc_exch_recv_resp(struct fc_
34065 sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
34066
34067 if (!sp)
34068 - atomic_inc(&mp->stats.xid_not_found);
34069 + atomic_inc_unchecked(&mp->stats.xid_not_found);
34070 else
34071 - atomic_inc(&mp->stats.non_bls_resp);
34072 + atomic_inc_unchecked(&mp->stats.non_bls_resp);
34073
34074 fc_frame_free(fp);
34075 }
34076 diff -urNp linux-3.0.9/drivers/scsi/libsas/sas_ata.c linux-3.0.9/drivers/scsi/libsas/sas_ata.c
34077 --- linux-3.0.9/drivers/scsi/libsas/sas_ata.c 2011-11-11 13:12:24.000000000 -0500
34078 +++ linux-3.0.9/drivers/scsi/libsas/sas_ata.c 2011-11-15 20:02:59.000000000 -0500
34079 @@ -368,7 +368,7 @@ static struct ata_port_operations sas_sa
34080 .postreset = ata_std_postreset,
34081 .error_handler = ata_std_error_handler,
34082 .post_internal_cmd = sas_ata_post_internal,
34083 - .qc_defer = ata_std_qc_defer,
34084 + .qc_defer = ata_std_qc_defer,
34085 .qc_prep = ata_noop_qc_prep,
34086 .qc_issue = sas_ata_qc_issue,
34087 .qc_fill_rtf = sas_ata_qc_fill_rtf,
34088 diff -urNp linux-3.0.9/drivers/scsi/lpfc/lpfc_debugfs.c linux-3.0.9/drivers/scsi/lpfc/lpfc_debugfs.c
34089 --- linux-3.0.9/drivers/scsi/lpfc/lpfc_debugfs.c 2011-11-11 13:12:24.000000000 -0500
34090 +++ linux-3.0.9/drivers/scsi/lpfc/lpfc_debugfs.c 2011-11-15 20:02:59.000000000 -0500
34091 @@ -104,7 +104,7 @@ MODULE_PARM_DESC(lpfc_debugfs_mask_disc_
34092
34093 #include <linux/debugfs.h>
34094
34095 -static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
34096 +static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
34097 static unsigned long lpfc_debugfs_start_time = 0L;
34098
34099 /* iDiag */
34100 @@ -141,7 +141,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_v
34101 lpfc_debugfs_enable = 0;
34102
34103 len = 0;
34104 - index = (atomic_read(&vport->disc_trc_cnt) + 1) &
34105 + index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
34106 (lpfc_debugfs_max_disc_trc - 1);
34107 for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
34108 dtp = vport->disc_trc + i;
34109 @@ -202,7 +202,7 @@ lpfc_debugfs_slow_ring_trc_data(struct l
34110 lpfc_debugfs_enable = 0;
34111
34112 len = 0;
34113 - index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
34114 + index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
34115 (lpfc_debugfs_max_slow_ring_trc - 1);
34116 for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
34117 dtp = phba->slow_ring_trc + i;
34118 @@ -380,6 +380,8 @@ lpfc_debugfs_dumpHBASlim_data(struct lpf
34119 uint32_t *ptr;
34120 char buffer[1024];
34121
34122 + pax_track_stack();
34123 +
34124 off = 0;
34125 spin_lock_irq(&phba->hbalock);
34126
34127 @@ -617,14 +619,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport
34128 !vport || !vport->disc_trc)
34129 return;
34130
34131 - index = atomic_inc_return(&vport->disc_trc_cnt) &
34132 + index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
34133 (lpfc_debugfs_max_disc_trc - 1);
34134 dtp = vport->disc_trc + index;
34135 dtp->fmt = fmt;
34136 dtp->data1 = data1;
34137 dtp->data2 = data2;
34138 dtp->data3 = data3;
34139 - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
34140 + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
34141 dtp->jif = jiffies;
34142 #endif
34143 return;
34144 @@ -655,14 +657,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_h
34145 !phba || !phba->slow_ring_trc)
34146 return;
34147
34148 - index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
34149 + index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
34150 (lpfc_debugfs_max_slow_ring_trc - 1);
34151 dtp = phba->slow_ring_trc + index;
34152 dtp->fmt = fmt;
34153 dtp->data1 = data1;
34154 dtp->data2 = data2;
34155 dtp->data3 = data3;
34156 - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
34157 + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
34158 dtp->jif = jiffies;
34159 #endif
34160 return;
34161 @@ -2606,7 +2608,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
34162 "slow_ring buffer\n");
34163 goto debug_failed;
34164 }
34165 - atomic_set(&phba->slow_ring_trc_cnt, 0);
34166 + atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
34167 memset(phba->slow_ring_trc, 0,
34168 (sizeof(struct lpfc_debugfs_trc) *
34169 lpfc_debugfs_max_slow_ring_trc));
34170 @@ -2652,7 +2654,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
34171 "buffer\n");
34172 goto debug_failed;
34173 }
34174 - atomic_set(&vport->disc_trc_cnt, 0);
34175 + atomic_set_unchecked(&vport->disc_trc_cnt, 0);
34176
34177 snprintf(name, sizeof(name), "discovery_trace");
34178 vport->debug_disc_trc =
34179 diff -urNp linux-3.0.9/drivers/scsi/lpfc/lpfc.h linux-3.0.9/drivers/scsi/lpfc/lpfc.h
34180 --- linux-3.0.9/drivers/scsi/lpfc/lpfc.h 2011-11-11 13:12:24.000000000 -0500
34181 +++ linux-3.0.9/drivers/scsi/lpfc/lpfc.h 2011-11-15 20:02:59.000000000 -0500
34182 @@ -425,7 +425,7 @@ struct lpfc_vport {
34183 struct dentry *debug_nodelist;
34184 struct dentry *vport_debugfs_root;
34185 struct lpfc_debugfs_trc *disc_trc;
34186 - atomic_t disc_trc_cnt;
34187 + atomic_unchecked_t disc_trc_cnt;
34188 #endif
34189 uint8_t stat_data_enabled;
34190 uint8_t stat_data_blocked;
34191 @@ -832,8 +832,8 @@ struct lpfc_hba {
34192 struct timer_list fabric_block_timer;
34193 unsigned long bit_flags;
34194 #define FABRIC_COMANDS_BLOCKED 0
34195 - atomic_t num_rsrc_err;
34196 - atomic_t num_cmd_success;
34197 + atomic_unchecked_t num_rsrc_err;
34198 + atomic_unchecked_t num_cmd_success;
34199 unsigned long last_rsrc_error_time;
34200 unsigned long last_ramp_down_time;
34201 unsigned long last_ramp_up_time;
34202 @@ -847,7 +847,7 @@ struct lpfc_hba {
34203 struct dentry *debug_dumpDif; /* BlockGuard BPL*/
34204 struct dentry *debug_slow_ring_trc;
34205 struct lpfc_debugfs_trc *slow_ring_trc;
34206 - atomic_t slow_ring_trc_cnt;
34207 + atomic_unchecked_t slow_ring_trc_cnt;
34208 /* iDiag debugfs sub-directory */
34209 struct dentry *idiag_root;
34210 struct dentry *idiag_pci_cfg;
34211 diff -urNp linux-3.0.9/drivers/scsi/lpfc/lpfc_init.c linux-3.0.9/drivers/scsi/lpfc/lpfc_init.c
34212 --- linux-3.0.9/drivers/scsi/lpfc/lpfc_init.c 2011-11-11 13:12:24.000000000 -0500
34213 +++ linux-3.0.9/drivers/scsi/lpfc/lpfc_init.c 2011-11-15 20:02:59.000000000 -0500
34214 @@ -9971,8 +9971,10 @@ lpfc_init(void)
34215 printk(LPFC_COPYRIGHT "\n");
34216
34217 if (lpfc_enable_npiv) {
34218 - lpfc_transport_functions.vport_create = lpfc_vport_create;
34219 - lpfc_transport_functions.vport_delete = lpfc_vport_delete;
34220 + pax_open_kernel();
34221 + *(void **)&lpfc_transport_functions.vport_create = lpfc_vport_create;
34222 + *(void **)&lpfc_transport_functions.vport_delete = lpfc_vport_delete;
34223 + pax_close_kernel();
34224 }
34225 lpfc_transport_template =
34226 fc_attach_transport(&lpfc_transport_functions);
34227 diff -urNp linux-3.0.9/drivers/scsi/lpfc/lpfc_scsi.c linux-3.0.9/drivers/scsi/lpfc/lpfc_scsi.c
34228 --- linux-3.0.9/drivers/scsi/lpfc/lpfc_scsi.c 2011-11-11 13:12:24.000000000 -0500
34229 +++ linux-3.0.9/drivers/scsi/lpfc/lpfc_scsi.c 2011-11-15 20:02:59.000000000 -0500
34230 @@ -297,7 +297,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hb
34231 uint32_t evt_posted;
34232
34233 spin_lock_irqsave(&phba->hbalock, flags);
34234 - atomic_inc(&phba->num_rsrc_err);
34235 + atomic_inc_unchecked(&phba->num_rsrc_err);
34236 phba->last_rsrc_error_time = jiffies;
34237
34238 if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
34239 @@ -338,7 +338,7 @@ lpfc_rampup_queue_depth(struct lpfc_vpor
34240 unsigned long flags;
34241 struct lpfc_hba *phba = vport->phba;
34242 uint32_t evt_posted;
34243 - atomic_inc(&phba->num_cmd_success);
34244 + atomic_inc_unchecked(&phba->num_cmd_success);
34245
34246 if (vport->cfg_lun_queue_depth <= queue_depth)
34247 return;
34248 @@ -382,8 +382,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
34249 unsigned long num_rsrc_err, num_cmd_success;
34250 int i;
34251
34252 - num_rsrc_err = atomic_read(&phba->num_rsrc_err);
34253 - num_cmd_success = atomic_read(&phba->num_cmd_success);
34254 + num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
34255 + num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
34256
34257 vports = lpfc_create_vport_work_array(phba);
34258 if (vports != NULL)
34259 @@ -403,8 +403,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
34260 }
34261 }
34262 lpfc_destroy_vport_work_array(phba, vports);
34263 - atomic_set(&phba->num_rsrc_err, 0);
34264 - atomic_set(&phba->num_cmd_success, 0);
34265 + atomic_set_unchecked(&phba->num_rsrc_err, 0);
34266 + atomic_set_unchecked(&phba->num_cmd_success, 0);
34267 }
34268
34269 /**
34270 @@ -438,8 +438,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_h
34271 }
34272 }
34273 lpfc_destroy_vport_work_array(phba, vports);
34274 - atomic_set(&phba->num_rsrc_err, 0);
34275 - atomic_set(&phba->num_cmd_success, 0);
34276 + atomic_set_unchecked(&phba->num_rsrc_err, 0);
34277 + atomic_set_unchecked(&phba->num_cmd_success, 0);
34278 }
34279
34280 /**
34281 diff -urNp linux-3.0.9/drivers/scsi/megaraid/megaraid_mbox.c linux-3.0.9/drivers/scsi/megaraid/megaraid_mbox.c
34282 --- linux-3.0.9/drivers/scsi/megaraid/megaraid_mbox.c 2011-11-11 13:12:24.000000000 -0500
34283 +++ linux-3.0.9/drivers/scsi/megaraid/megaraid_mbox.c 2011-11-15 20:02:59.000000000 -0500
34284 @@ -3503,6 +3503,8 @@ megaraid_cmm_register(adapter_t *adapter
34285 int rval;
34286 int i;
34287
34288 + pax_track_stack();
34289 +
34290 // Allocate memory for the base list of scb for management module.
34291 adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
34292
34293 diff -urNp linux-3.0.9/drivers/scsi/osd/osd_initiator.c linux-3.0.9/drivers/scsi/osd/osd_initiator.c
34294 --- linux-3.0.9/drivers/scsi/osd/osd_initiator.c 2011-11-11 13:12:24.000000000 -0500
34295 +++ linux-3.0.9/drivers/scsi/osd/osd_initiator.c 2011-11-15 20:02:59.000000000 -0500
34296 @@ -97,6 +97,8 @@ static int _osd_get_print_system_info(st
34297 int nelem = ARRAY_SIZE(get_attrs), a = 0;
34298 int ret;
34299
34300 + pax_track_stack();
34301 +
34302 or = osd_start_request(od, GFP_KERNEL);
34303 if (!or)
34304 return -ENOMEM;
34305 diff -urNp linux-3.0.9/drivers/scsi/pmcraid.c linux-3.0.9/drivers/scsi/pmcraid.c
34306 --- linux-3.0.9/drivers/scsi/pmcraid.c 2011-11-11 13:12:24.000000000 -0500
34307 +++ linux-3.0.9/drivers/scsi/pmcraid.c 2011-11-15 20:02:59.000000000 -0500
34308 @@ -201,8 +201,8 @@ static int pmcraid_slave_alloc(struct sc
34309 res->scsi_dev = scsi_dev;
34310 scsi_dev->hostdata = res;
34311 res->change_detected = 0;
34312 - atomic_set(&res->read_failures, 0);
34313 - atomic_set(&res->write_failures, 0);
34314 + atomic_set_unchecked(&res->read_failures, 0);
34315 + atomic_set_unchecked(&res->write_failures, 0);
34316 rc = 0;
34317 }
34318 spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
34319 @@ -2677,9 +2677,9 @@ static int pmcraid_error_handler(struct
34320
34321 /* If this was a SCSI read/write command keep count of errors */
34322 if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
34323 - atomic_inc(&res->read_failures);
34324 + atomic_inc_unchecked(&res->read_failures);
34325 else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
34326 - atomic_inc(&res->write_failures);
34327 + atomic_inc_unchecked(&res->write_failures);
34328
34329 if (!RES_IS_GSCSI(res->cfg_entry) &&
34330 masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
34331 @@ -3535,7 +3535,7 @@ static int pmcraid_queuecommand_lck(
34332 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
34333 * hrrq_id assigned here in queuecommand
34334 */
34335 - ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
34336 + ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
34337 pinstance->num_hrrq;
34338 cmd->cmd_done = pmcraid_io_done;
34339
34340 @@ -3860,7 +3860,7 @@ static long pmcraid_ioctl_passthrough(
34341 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
34342 * hrrq_id assigned here in queuecommand
34343 */
34344 - ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
34345 + ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
34346 pinstance->num_hrrq;
34347
34348 if (request_size) {
34349 @@ -4498,7 +4498,7 @@ static void pmcraid_worker_function(stru
34350
34351 pinstance = container_of(workp, struct pmcraid_instance, worker_q);
34352 /* add resources only after host is added into system */
34353 - if (!atomic_read(&pinstance->expose_resources))
34354 + if (!atomic_read_unchecked(&pinstance->expose_resources))
34355 return;
34356
34357 fw_version = be16_to_cpu(pinstance->inq_data->fw_version);
34358 @@ -5332,8 +5332,8 @@ static int __devinit pmcraid_init_instan
34359 init_waitqueue_head(&pinstance->reset_wait_q);
34360
34361 atomic_set(&pinstance->outstanding_cmds, 0);
34362 - atomic_set(&pinstance->last_message_id, 0);
34363 - atomic_set(&pinstance->expose_resources, 0);
34364 + atomic_set_unchecked(&pinstance->last_message_id, 0);
34365 + atomic_set_unchecked(&pinstance->expose_resources, 0);
34366
34367 INIT_LIST_HEAD(&pinstance->free_res_q);
34368 INIT_LIST_HEAD(&pinstance->used_res_q);
34369 @@ -6048,7 +6048,7 @@ static int __devinit pmcraid_probe(
34370 /* Schedule worker thread to handle CCN and take care of adding and
34371 * removing devices to OS
34372 */
34373 - atomic_set(&pinstance->expose_resources, 1);
34374 + atomic_set_unchecked(&pinstance->expose_resources, 1);
34375 schedule_work(&pinstance->worker_q);
34376 return rc;
34377
34378 diff -urNp linux-3.0.9/drivers/scsi/pmcraid.h linux-3.0.9/drivers/scsi/pmcraid.h
34379 --- linux-3.0.9/drivers/scsi/pmcraid.h 2011-11-11 13:12:24.000000000 -0500
34380 +++ linux-3.0.9/drivers/scsi/pmcraid.h 2011-11-15 20:02:59.000000000 -0500
34381 @@ -749,7 +749,7 @@ struct pmcraid_instance {
34382 struct pmcraid_isr_param hrrq_vector[PMCRAID_NUM_MSIX_VECTORS];
34383
34384 /* Message id as filled in last fired IOARCB, used to identify HRRQ */
34385 - atomic_t last_message_id;
34386 + atomic_unchecked_t last_message_id;
34387
34388 /* configuration table */
34389 struct pmcraid_config_table *cfg_table;
34390 @@ -778,7 +778,7 @@ struct pmcraid_instance {
34391 atomic_t outstanding_cmds;
34392
34393 /* should add/delete resources to mid-layer now ?*/
34394 - atomic_t expose_resources;
34395 + atomic_unchecked_t expose_resources;
34396
34397
34398
34399 @@ -814,8 +814,8 @@ struct pmcraid_resource_entry {
34400 struct pmcraid_config_table_entry_ext cfg_entry_ext;
34401 };
34402 struct scsi_device *scsi_dev; /* Link scsi_device structure */
34403 - atomic_t read_failures; /* count of failed READ commands */
34404 - atomic_t write_failures; /* count of failed WRITE commands */
34405 + atomic_unchecked_t read_failures; /* count of failed READ commands */
34406 + atomic_unchecked_t write_failures; /* count of failed WRITE commands */
34407
34408 /* To indicate add/delete/modify during CCN */
34409 u8 change_detected;
34410 diff -urNp linux-3.0.9/drivers/scsi/qla2xxx/qla_def.h linux-3.0.9/drivers/scsi/qla2xxx/qla_def.h
34411 --- linux-3.0.9/drivers/scsi/qla2xxx/qla_def.h 2011-11-11 13:12:24.000000000 -0500
34412 +++ linux-3.0.9/drivers/scsi/qla2xxx/qla_def.h 2011-11-15 20:02:59.000000000 -0500
34413 @@ -2244,7 +2244,7 @@ struct isp_operations {
34414 int (*get_flash_version) (struct scsi_qla_host *, void *);
34415 int (*start_scsi) (srb_t *);
34416 int (*abort_isp) (struct scsi_qla_host *);
34417 -};
34418 +} __no_const;
34419
34420 /* MSI-X Support *************************************************************/
34421
34422 diff -urNp linux-3.0.9/drivers/scsi/qla4xxx/ql4_def.h linux-3.0.9/drivers/scsi/qla4xxx/ql4_def.h
34423 --- linux-3.0.9/drivers/scsi/qla4xxx/ql4_def.h 2011-11-11 13:12:24.000000000 -0500
34424 +++ linux-3.0.9/drivers/scsi/qla4xxx/ql4_def.h 2011-11-15 20:02:59.000000000 -0500
34425 @@ -256,7 +256,7 @@ struct ddb_entry {
34426 atomic_t retry_relogin_timer; /* Min Time between relogins
34427 * (4000 only) */
34428 atomic_t relogin_timer; /* Max Time to wait for relogin to complete */
34429 - atomic_t relogin_retry_count; /* Num of times relogin has been
34430 + atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
34431 * retried */
34432
34433 uint16_t port;
34434 diff -urNp linux-3.0.9/drivers/scsi/qla4xxx/ql4_init.c linux-3.0.9/drivers/scsi/qla4xxx/ql4_init.c
34435 --- linux-3.0.9/drivers/scsi/qla4xxx/ql4_init.c 2011-11-11 13:12:24.000000000 -0500
34436 +++ linux-3.0.9/drivers/scsi/qla4xxx/ql4_init.c 2011-11-15 20:02:59.000000000 -0500
34437 @@ -680,7 +680,7 @@ static struct ddb_entry * qla4xxx_alloc_
34438 ddb_entry->fw_ddb_index = fw_ddb_index;
34439 atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
34440 atomic_set(&ddb_entry->relogin_timer, 0);
34441 - atomic_set(&ddb_entry->relogin_retry_count, 0);
34442 + atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
34443 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
34444 list_add_tail(&ddb_entry->list, &ha->ddb_list);
34445 ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
34446 @@ -1433,7 +1433,7 @@ int qla4xxx_process_ddb_changed(struct s
34447 if ((ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE) &&
34448 (atomic_read(&ddb_entry->state) != DDB_STATE_ONLINE)) {
34449 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
34450 - atomic_set(&ddb_entry->relogin_retry_count, 0);
34451 + atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
34452 atomic_set(&ddb_entry->relogin_timer, 0);
34453 clear_bit(DF_RELOGIN, &ddb_entry->flags);
34454 iscsi_unblock_session(ddb_entry->sess);
34455 diff -urNp linux-3.0.9/drivers/scsi/qla4xxx/ql4_os.c linux-3.0.9/drivers/scsi/qla4xxx/ql4_os.c
34456 --- linux-3.0.9/drivers/scsi/qla4xxx/ql4_os.c 2011-11-11 13:12:24.000000000 -0500
34457 +++ linux-3.0.9/drivers/scsi/qla4xxx/ql4_os.c 2011-11-15 20:02:59.000000000 -0500
34458 @@ -811,13 +811,13 @@ static void qla4xxx_timer(struct scsi_ql
34459 ddb_entry->fw_ddb_device_state ==
34460 DDB_DS_SESSION_FAILED) {
34461 /* Reset retry relogin timer */
34462 - atomic_inc(&ddb_entry->relogin_retry_count);
34463 + atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
34464 DEBUG2(printk("scsi%ld: ddb [%d] relogin"
34465 " timed out-retrying"
34466 " relogin (%d)\n",
34467 ha->host_no,
34468 ddb_entry->fw_ddb_index,
34469 - atomic_read(&ddb_entry->
34470 + atomic_read_unchecked(&ddb_entry->
34471 relogin_retry_count))
34472 );
34473 start_dpc++;
34474 diff -urNp linux-3.0.9/drivers/scsi/scsi.c linux-3.0.9/drivers/scsi/scsi.c
34475 --- linux-3.0.9/drivers/scsi/scsi.c 2011-11-11 13:12:24.000000000 -0500
34476 +++ linux-3.0.9/drivers/scsi/scsi.c 2011-11-15 20:02:59.000000000 -0500
34477 @@ -655,7 +655,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *
34478 unsigned long timeout;
34479 int rtn = 0;
34480
34481 - atomic_inc(&cmd->device->iorequest_cnt);
34482 + atomic_inc_unchecked(&cmd->device->iorequest_cnt);
34483
34484 /* check if the device is still usable */
34485 if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
34486 diff -urNp linux-3.0.9/drivers/scsi/scsi_debug.c linux-3.0.9/drivers/scsi/scsi_debug.c
34487 --- linux-3.0.9/drivers/scsi/scsi_debug.c 2011-11-11 13:12:24.000000000 -0500
34488 +++ linux-3.0.9/drivers/scsi/scsi_debug.c 2011-11-15 20:02:59.000000000 -0500
34489 @@ -1493,6 +1493,8 @@ static int resp_mode_select(struct scsi_
34490 unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
34491 unsigned char *cmd = (unsigned char *)scp->cmnd;
34492
34493 + pax_track_stack();
34494 +
34495 if ((errsts = check_readiness(scp, 1, devip)))
34496 return errsts;
34497 memset(arr, 0, sizeof(arr));
34498 @@ -1590,6 +1592,8 @@ static int resp_log_sense(struct scsi_cm
34499 unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
34500 unsigned char *cmd = (unsigned char *)scp->cmnd;
34501
34502 + pax_track_stack();
34503 +
34504 if ((errsts = check_readiness(scp, 1, devip)))
34505 return errsts;
34506 memset(arr, 0, sizeof(arr));
34507 diff -urNp linux-3.0.9/drivers/scsi/scsi_lib.c linux-3.0.9/drivers/scsi/scsi_lib.c
34508 --- linux-3.0.9/drivers/scsi/scsi_lib.c 2011-11-11 13:12:24.000000000 -0500
34509 +++ linux-3.0.9/drivers/scsi/scsi_lib.c 2011-11-15 20:02:59.000000000 -0500
34510 @@ -1412,7 +1412,7 @@ static void scsi_kill_request(struct req
34511 shost = sdev->host;
34512 scsi_init_cmd_errh(cmd);
34513 cmd->result = DID_NO_CONNECT << 16;
34514 - atomic_inc(&cmd->device->iorequest_cnt);
34515 + atomic_inc_unchecked(&cmd->device->iorequest_cnt);
34516
34517 /*
34518 * SCSI request completion path will do scsi_device_unbusy(),
34519 @@ -1438,9 +1438,9 @@ static void scsi_softirq_done(struct req
34520
34521 INIT_LIST_HEAD(&cmd->eh_entry);
34522
34523 - atomic_inc(&cmd->device->iodone_cnt);
34524 + atomic_inc_unchecked(&cmd->device->iodone_cnt);
34525 if (cmd->result)
34526 - atomic_inc(&cmd->device->ioerr_cnt);
34527 + atomic_inc_unchecked(&cmd->device->ioerr_cnt);
34528
34529 disposition = scsi_decide_disposition(cmd);
34530 if (disposition != SUCCESS &&
34531 diff -urNp linux-3.0.9/drivers/scsi/scsi_sysfs.c linux-3.0.9/drivers/scsi/scsi_sysfs.c
34532 --- linux-3.0.9/drivers/scsi/scsi_sysfs.c 2011-11-11 13:12:24.000000000 -0500
34533 +++ linux-3.0.9/drivers/scsi/scsi_sysfs.c 2011-11-15 20:02:59.000000000 -0500
34534 @@ -622,7 +622,7 @@ show_iostat_##field(struct device *dev,
34535 char *buf) \
34536 { \
34537 struct scsi_device *sdev = to_scsi_device(dev); \
34538 - unsigned long long count = atomic_read(&sdev->field); \
34539 + unsigned long long count = atomic_read_unchecked(&sdev->field); \
34540 return snprintf(buf, 20, "0x%llx\n", count); \
34541 } \
34542 static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
34543 diff -urNp linux-3.0.9/drivers/scsi/scsi_tgt_lib.c linux-3.0.9/drivers/scsi/scsi_tgt_lib.c
34544 --- linux-3.0.9/drivers/scsi/scsi_tgt_lib.c 2011-11-11 13:12:24.000000000 -0500
34545 +++ linux-3.0.9/drivers/scsi/scsi_tgt_lib.c 2011-11-15 20:02:59.000000000 -0500
34546 @@ -362,7 +362,7 @@ static int scsi_map_user_pages(struct sc
34547 int err;
34548
34549 dprintk("%lx %u\n", uaddr, len);
34550 - err = blk_rq_map_user(q, rq, NULL, (void *)uaddr, len, GFP_KERNEL);
34551 + err = blk_rq_map_user(q, rq, NULL, (void __user *)uaddr, len, GFP_KERNEL);
34552 if (err) {
34553 /*
34554 * TODO: need to fixup sg_tablesize, max_segment_size,
34555 diff -urNp linux-3.0.9/drivers/scsi/scsi_transport_fc.c linux-3.0.9/drivers/scsi/scsi_transport_fc.c
34556 --- linux-3.0.9/drivers/scsi/scsi_transport_fc.c 2011-11-11 13:12:24.000000000 -0500
34557 +++ linux-3.0.9/drivers/scsi/scsi_transport_fc.c 2011-11-15 20:02:59.000000000 -0500
34558 @@ -484,7 +484,7 @@ static DECLARE_TRANSPORT_CLASS(fc_vport_
34559 * Netlink Infrastructure
34560 */
34561
34562 -static atomic_t fc_event_seq;
34563 +static atomic_unchecked_t fc_event_seq;
34564
34565 /**
34566 * fc_get_event_number - Obtain the next sequential FC event number
34567 @@ -497,7 +497,7 @@ static atomic_t fc_event_seq;
34568 u32
34569 fc_get_event_number(void)
34570 {
34571 - return atomic_add_return(1, &fc_event_seq);
34572 + return atomic_add_return_unchecked(1, &fc_event_seq);
34573 }
34574 EXPORT_SYMBOL(fc_get_event_number);
34575
34576 @@ -645,7 +645,7 @@ static __init int fc_transport_init(void
34577 {
34578 int error;
34579
34580 - atomic_set(&fc_event_seq, 0);
34581 + atomic_set_unchecked(&fc_event_seq, 0);
34582
34583 error = transport_class_register(&fc_host_class);
34584 if (error)
34585 @@ -835,7 +835,7 @@ static int fc_str_to_dev_loss(const char
34586 char *cp;
34587
34588 *val = simple_strtoul(buf, &cp, 0);
34589 - if ((*cp && (*cp != '\n')) || (*val < 0))
34590 + if (*cp && (*cp != '\n'))
34591 return -EINVAL;
34592 /*
34593 * Check for overflow; dev_loss_tmo is u32
34594 diff -urNp linux-3.0.9/drivers/scsi/scsi_transport_iscsi.c linux-3.0.9/drivers/scsi/scsi_transport_iscsi.c
34595 --- linux-3.0.9/drivers/scsi/scsi_transport_iscsi.c 2011-11-11 13:12:24.000000000 -0500
34596 +++ linux-3.0.9/drivers/scsi/scsi_transport_iscsi.c 2011-11-15 20:02:59.000000000 -0500
34597 @@ -83,7 +83,7 @@ struct iscsi_internal {
34598 struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
34599 };
34600
34601 -static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
34602 +static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
34603 static struct workqueue_struct *iscsi_eh_timer_workq;
34604
34605 /*
34606 @@ -761,7 +761,7 @@ int iscsi_add_session(struct iscsi_cls_s
34607 int err;
34608
34609 ihost = shost->shost_data;
34610 - session->sid = atomic_add_return(1, &iscsi_session_nr);
34611 + session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
34612
34613 if (id == ISCSI_MAX_TARGET) {
34614 for (id = 0; id < ISCSI_MAX_TARGET; id++) {
34615 @@ -2200,7 +2200,7 @@ static __init int iscsi_transport_init(v
34616 printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
34617 ISCSI_TRANSPORT_VERSION);
34618
34619 - atomic_set(&iscsi_session_nr, 0);
34620 + atomic_set_unchecked(&iscsi_session_nr, 0);
34621
34622 err = class_register(&iscsi_transport_class);
34623 if (err)
34624 diff -urNp linux-3.0.9/drivers/scsi/scsi_transport_srp.c linux-3.0.9/drivers/scsi/scsi_transport_srp.c
34625 --- linux-3.0.9/drivers/scsi/scsi_transport_srp.c 2011-11-11 13:12:24.000000000 -0500
34626 +++ linux-3.0.9/drivers/scsi/scsi_transport_srp.c 2011-11-15 20:02:59.000000000 -0500
34627 @@ -33,7 +33,7 @@
34628 #include "scsi_transport_srp_internal.h"
34629
34630 struct srp_host_attrs {
34631 - atomic_t next_port_id;
34632 + atomic_unchecked_t next_port_id;
34633 };
34634 #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
34635
34636 @@ -62,7 +62,7 @@ static int srp_host_setup(struct transpo
34637 struct Scsi_Host *shost = dev_to_shost(dev);
34638 struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
34639
34640 - atomic_set(&srp_host->next_port_id, 0);
34641 + atomic_set_unchecked(&srp_host->next_port_id, 0);
34642 return 0;
34643 }
34644
34645 @@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct S
34646 memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
34647 rport->roles = ids->roles;
34648
34649 - id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
34650 + id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
34651 dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
34652
34653 transport_setup_device(&rport->dev);
34654 diff -urNp linux-3.0.9/drivers/scsi/sg.c linux-3.0.9/drivers/scsi/sg.c
34655 --- linux-3.0.9/drivers/scsi/sg.c 2011-11-11 13:12:24.000000000 -0500
34656 +++ linux-3.0.9/drivers/scsi/sg.c 2011-11-15 20:02:59.000000000 -0500
34657 @@ -1075,7 +1075,7 @@ sg_ioctl(struct file *filp, unsigned int
34658 sdp->disk->disk_name,
34659 MKDEV(SCSI_GENERIC_MAJOR, sdp->index),
34660 NULL,
34661 - (char *)arg);
34662 + (char __user *)arg);
34663 case BLKTRACESTART:
34664 return blk_trace_startstop(sdp->device->request_queue, 1);
34665 case BLKTRACESTOP:
34666 @@ -2310,7 +2310,7 @@ struct sg_proc_leaf {
34667 const struct file_operations * fops;
34668 };
34669
34670 -static struct sg_proc_leaf sg_proc_leaf_arr[] = {
34671 +static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
34672 {"allow_dio", &adio_fops},
34673 {"debug", &debug_fops},
34674 {"def_reserved_size", &dressz_fops},
34675 @@ -2325,7 +2325,7 @@ sg_proc_init(void)
34676 {
34677 int k, mask;
34678 int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
34679 - struct sg_proc_leaf * leaf;
34680 + const struct sg_proc_leaf * leaf;
34681
34682 sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
34683 if (!sg_proc_sgp)
34684 diff -urNp linux-3.0.9/drivers/scsi/sym53c8xx_2/sym_glue.c linux-3.0.9/drivers/scsi/sym53c8xx_2/sym_glue.c
34685 --- linux-3.0.9/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-11-11 13:12:24.000000000 -0500
34686 +++ linux-3.0.9/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-11-15 20:02:59.000000000 -0500
34687 @@ -1756,6 +1756,8 @@ static int __devinit sym2_probe(struct p
34688 int do_iounmap = 0;
34689 int do_disable_device = 1;
34690
34691 + pax_track_stack();
34692 +
34693 memset(&sym_dev, 0, sizeof(sym_dev));
34694 memset(&nvram, 0, sizeof(nvram));
34695 sym_dev.pdev = pdev;
34696 diff -urNp linux-3.0.9/drivers/scsi/vmw_pvscsi.c linux-3.0.9/drivers/scsi/vmw_pvscsi.c
34697 --- linux-3.0.9/drivers/scsi/vmw_pvscsi.c 2011-11-11 13:12:24.000000000 -0500
34698 +++ linux-3.0.9/drivers/scsi/vmw_pvscsi.c 2011-11-15 20:02:59.000000000 -0500
34699 @@ -447,6 +447,8 @@ static void pvscsi_setup_all_rings(const
34700 dma_addr_t base;
34701 unsigned i;
34702
34703 + pax_track_stack();
34704 +
34705 cmd.ringsStatePPN = adapter->ringStatePA >> PAGE_SHIFT;
34706 cmd.reqRingNumPages = adapter->req_pages;
34707 cmd.cmpRingNumPages = adapter->cmp_pages;
34708 diff -urNp linux-3.0.9/drivers/spi/dw_spi_pci.c linux-3.0.9/drivers/spi/dw_spi_pci.c
34709 --- linux-3.0.9/drivers/spi/dw_spi_pci.c 2011-11-11 13:12:24.000000000 -0500
34710 +++ linux-3.0.9/drivers/spi/dw_spi_pci.c 2011-11-15 20:02:59.000000000 -0500
34711 @@ -148,7 +148,7 @@ static int spi_resume(struct pci_dev *pd
34712 #define spi_resume NULL
34713 #endif
34714
34715 -static const struct pci_device_id pci_ids[] __devinitdata = {
34716 +static const struct pci_device_id pci_ids[] __devinitconst = {
34717 /* Intel MID platform SPI controller 0 */
34718 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x0800) },
34719 {},
34720 diff -urNp linux-3.0.9/drivers/spi/spi.c linux-3.0.9/drivers/spi/spi.c
34721 --- linux-3.0.9/drivers/spi/spi.c 2011-11-11 13:12:24.000000000 -0500
34722 +++ linux-3.0.9/drivers/spi/spi.c 2011-11-15 20:02:59.000000000 -0500
34723 @@ -1023,7 +1023,7 @@ int spi_bus_unlock(struct spi_master *ma
34724 EXPORT_SYMBOL_GPL(spi_bus_unlock);
34725
34726 /* portable code must never pass more than 32 bytes */
34727 -#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
34728 +#define SPI_BUFSIZ max(32UL,SMP_CACHE_BYTES)
34729
34730 static u8 *buf;
34731
34732 diff -urNp linux-3.0.9/drivers/staging/ath6kl/os/linux/ar6000_drv.c linux-3.0.9/drivers/staging/ath6kl/os/linux/ar6000_drv.c
34733 --- linux-3.0.9/drivers/staging/ath6kl/os/linux/ar6000_drv.c 2011-11-11 13:12:24.000000000 -0500
34734 +++ linux-3.0.9/drivers/staging/ath6kl/os/linux/ar6000_drv.c 2011-11-15 20:02:59.000000000 -0500
34735 @@ -362,7 +362,7 @@ static struct ar_cookie s_ar_cookie_mem[
34736 (((ar)->arTargetType == TARGET_TYPE_AR6003) ? AR6003_HOST_INTEREST_ITEM_ADDRESS(item) : 0))
34737
34738
34739 -static struct net_device_ops ar6000_netdev_ops = {
34740 +static net_device_ops_no_const ar6000_netdev_ops = {
34741 .ndo_init = NULL,
34742 .ndo_open = ar6000_open,
34743 .ndo_stop = ar6000_close,
34744 diff -urNp linux-3.0.9/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h linux-3.0.9/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h
34745 --- linux-3.0.9/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h 2011-11-11 13:12:24.000000000 -0500
34746 +++ linux-3.0.9/drivers/staging/ath6kl/os/linux/include/ar6k_pal.h 2011-11-15 20:02:59.000000000 -0500
34747 @@ -30,7 +30,7 @@ typedef bool (*ar6k_pal_recv_pkt_t)(void
34748 typedef struct ar6k_pal_config_s
34749 {
34750 ar6k_pal_recv_pkt_t fpar6k_pal_recv_pkt;
34751 -}ar6k_pal_config_t;
34752 +} __no_const ar6k_pal_config_t;
34753
34754 void register_pal_cb(ar6k_pal_config_t *palConfig_p);
34755 #endif /* _AR6K_PAL_H_ */
34756 diff -urNp linux-3.0.9/drivers/staging/brcm80211/brcmfmac/dhd_linux.c linux-3.0.9/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
34757 --- linux-3.0.9/drivers/staging/brcm80211/brcmfmac/dhd_linux.c 2011-11-11 13:12:24.000000000 -0500
34758 +++ linux-3.0.9/drivers/staging/brcm80211/brcmfmac/dhd_linux.c 2011-11-15 20:02:59.000000000 -0500
34759 @@ -853,14 +853,14 @@ static void dhd_op_if(dhd_if_t *ifp)
34760 free_netdev(ifp->net);
34761 }
34762 /* Allocate etherdev, including space for private structure */
34763 - ifp->net = alloc_etherdev(sizeof(dhd));
34764 + ifp->net = alloc_etherdev(sizeof(*dhd));
34765 if (!ifp->net) {
34766 DHD_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
34767 ret = -ENOMEM;
34768 }
34769 if (ret == 0) {
34770 strcpy(ifp->net->name, ifp->name);
34771 - memcpy(netdev_priv(ifp->net), &dhd, sizeof(dhd));
34772 + memcpy(netdev_priv(ifp->net), dhd, sizeof(*dhd));
34773 err = dhd_net_attach(&dhd->pub, ifp->idx);
34774 if (err != 0) {
34775 DHD_ERROR(("%s: dhd_net_attach failed, "
34776 @@ -1872,7 +1872,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
34777 strcpy(nv_path, nvram_path);
34778
34779 /* Allocate etherdev, including space for private structure */
34780 - net = alloc_etherdev(sizeof(dhd));
34781 + net = alloc_etherdev(sizeof(*dhd));
34782 if (!net) {
34783 DHD_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
34784 goto fail;
34785 @@ -1888,7 +1888,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
34786 /*
34787 * Save the dhd_info into the priv
34788 */
34789 - memcpy(netdev_priv(net), &dhd, sizeof(dhd));
34790 + memcpy(netdev_priv(net), dhd, sizeof(*dhd));
34791
34792 /* Set network interface name if it was provided as module parameter */
34793 if (iface_name[0]) {
34794 @@ -2004,7 +2004,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
34795 /*
34796 * Save the dhd_info into the priv
34797 */
34798 - memcpy(netdev_priv(net), &dhd, sizeof(dhd));
34799 + memcpy(netdev_priv(net), dhd, sizeof(*dhd));
34800
34801 #if defined(CUSTOMER_HW2) && defined(CONFIG_WIFI_CONTROL_FUNC)
34802 g_bus = bus;
34803 diff -urNp linux-3.0.9/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_int.h linux-3.0.9/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_int.h
34804 --- linux-3.0.9/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_int.h 2011-11-11 13:12:24.000000000 -0500
34805 +++ linux-3.0.9/drivers/staging/brcm80211/brcmsmac/phy/wlc_phy_int.h 2011-11-15 20:02:59.000000000 -0500
34806 @@ -593,7 +593,7 @@ struct phy_func_ptr {
34807 initfn_t carrsuppr;
34808 rxsigpwrfn_t rxsigpwr;
34809 detachfn_t detach;
34810 -};
34811 +} __no_const;
34812 typedef struct phy_func_ptr phy_func_ptr_t;
34813
34814 struct phy_info {
34815 diff -urNp linux-3.0.9/drivers/staging/brcm80211/include/bcmsdh.h linux-3.0.9/drivers/staging/brcm80211/include/bcmsdh.h
34816 --- linux-3.0.9/drivers/staging/brcm80211/include/bcmsdh.h 2011-11-11 13:12:24.000000000 -0500
34817 +++ linux-3.0.9/drivers/staging/brcm80211/include/bcmsdh.h 2011-11-15 20:02:59.000000000 -0500
34818 @@ -185,7 +185,7 @@ typedef struct {
34819 u16 func, uint bustype, void *regsva, void *param);
34820 /* detach from device */
34821 void (*detach) (void *ch);
34822 -} bcmsdh_driver_t;
34823 +} __no_const bcmsdh_driver_t;
34824
34825 /* platform specific/high level functions */
34826 extern int bcmsdh_register(bcmsdh_driver_t *driver);
34827 diff -urNp linux-3.0.9/drivers/staging/et131x/et1310_tx.c linux-3.0.9/drivers/staging/et131x/et1310_tx.c
34828 --- linux-3.0.9/drivers/staging/et131x/et1310_tx.c 2011-11-11 13:12:24.000000000 -0500
34829 +++ linux-3.0.9/drivers/staging/et131x/et1310_tx.c 2011-11-15 20:02:59.000000000 -0500
34830 @@ -635,11 +635,11 @@ inline void et131x_free_send_packet(stru
34831 struct net_device_stats *stats = &etdev->net_stats;
34832
34833 if (tcb->flags & fMP_DEST_BROAD)
34834 - atomic_inc(&etdev->Stats.brdcstxmt);
34835 + atomic_inc_unchecked(&etdev->Stats.brdcstxmt);
34836 else if (tcb->flags & fMP_DEST_MULTI)
34837 - atomic_inc(&etdev->Stats.multixmt);
34838 + atomic_inc_unchecked(&etdev->Stats.multixmt);
34839 else
34840 - atomic_inc(&etdev->Stats.unixmt);
34841 + atomic_inc_unchecked(&etdev->Stats.unixmt);
34842
34843 if (tcb->skb) {
34844 stats->tx_bytes += tcb->skb->len;
34845 diff -urNp linux-3.0.9/drivers/staging/et131x/et131x_adapter.h linux-3.0.9/drivers/staging/et131x/et131x_adapter.h
34846 --- linux-3.0.9/drivers/staging/et131x/et131x_adapter.h 2011-11-11 13:12:24.000000000 -0500
34847 +++ linux-3.0.9/drivers/staging/et131x/et131x_adapter.h 2011-11-15 20:02:59.000000000 -0500
34848 @@ -110,11 +110,11 @@ typedef struct _ce_stats_t {
34849 * operations
34850 */
34851 u32 unircv; /* # multicast packets received */
34852 - atomic_t unixmt; /* # multicast packets for Tx */
34853 + atomic_unchecked_t unixmt; /* # multicast packets for Tx */
34854 u32 multircv; /* # multicast packets received */
34855 - atomic_t multixmt; /* # multicast packets for Tx */
34856 + atomic_unchecked_t multixmt; /* # multicast packets for Tx */
34857 u32 brdcstrcv; /* # broadcast packets received */
34858 - atomic_t brdcstxmt; /* # broadcast packets for Tx */
34859 + atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */
34860 u32 norcvbuf; /* # Rx packets discarded */
34861 u32 noxmtbuf; /* # Tx packets discarded */
34862
34863 diff -urNp linux-3.0.9/drivers/staging/hv/channel.c linux-3.0.9/drivers/staging/hv/channel.c
34864 --- linux-3.0.9/drivers/staging/hv/channel.c 2011-11-11 13:12:24.000000000 -0500
34865 +++ linux-3.0.9/drivers/staging/hv/channel.c 2011-11-15 20:02:59.000000000 -0500
34866 @@ -433,8 +433,8 @@ int vmbus_establish_gpadl(struct vmbus_c
34867 int ret = 0;
34868 int t;
34869
34870 - next_gpadl_handle = atomic_read(&vmbus_connection.next_gpadl_handle);
34871 - atomic_inc(&vmbus_connection.next_gpadl_handle);
34872 + next_gpadl_handle = atomic_read_unchecked(&vmbus_connection.next_gpadl_handle);
34873 + atomic_inc_unchecked(&vmbus_connection.next_gpadl_handle);
34874
34875 ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount);
34876 if (ret)
34877 diff -urNp linux-3.0.9/drivers/staging/hv/hv.c linux-3.0.9/drivers/staging/hv/hv.c
34878 --- linux-3.0.9/drivers/staging/hv/hv.c 2011-11-11 13:12:24.000000000 -0500
34879 +++ linux-3.0.9/drivers/staging/hv/hv.c 2011-11-15 20:02:59.000000000 -0500
34880 @@ -132,7 +132,7 @@ static u64 do_hypercall(u64 control, voi
34881 u64 output_address = (output) ? virt_to_phys(output) : 0;
34882 u32 output_address_hi = output_address >> 32;
34883 u32 output_address_lo = output_address & 0xFFFFFFFF;
34884 - volatile void *hypercall_page = hv_context.hypercall_page;
34885 + volatile void *hypercall_page = ktva_ktla(hv_context.hypercall_page);
34886
34887 __asm__ __volatile__ ("call *%8" : "=d"(hv_status_hi),
34888 "=a"(hv_status_lo) : "d" (control_hi),
34889 diff -urNp linux-3.0.9/drivers/staging/hv/hv_mouse.c linux-3.0.9/drivers/staging/hv/hv_mouse.c
34890 --- linux-3.0.9/drivers/staging/hv/hv_mouse.c 2011-11-11 13:12:24.000000000 -0500
34891 +++ linux-3.0.9/drivers/staging/hv/hv_mouse.c 2011-11-15 20:02:59.000000000 -0500
34892 @@ -879,8 +879,10 @@ static void reportdesc_callback(struct h
34893 if (hid_dev) {
34894 DPRINT_INFO(INPUTVSC_DRV, "hid_device created");
34895
34896 - hid_dev->ll_driver->open = mousevsc_hid_open;
34897 - hid_dev->ll_driver->close = mousevsc_hid_close;
34898 + pax_open_kernel();
34899 + *(void **)&hid_dev->ll_driver->open = mousevsc_hid_open;
34900 + *(void **)&hid_dev->ll_driver->close = mousevsc_hid_close;
34901 + pax_close_kernel();
34902
34903 hid_dev->bus = BUS_VIRTUAL;
34904 hid_dev->vendor = input_device_ctx->device_info.vendor;
34905 diff -urNp linux-3.0.9/drivers/staging/hv/hyperv_vmbus.h linux-3.0.9/drivers/staging/hv/hyperv_vmbus.h
34906 --- linux-3.0.9/drivers/staging/hv/hyperv_vmbus.h 2011-11-11 13:12:24.000000000 -0500
34907 +++ linux-3.0.9/drivers/staging/hv/hyperv_vmbus.h 2011-11-15 20:02:59.000000000 -0500
34908 @@ -559,7 +559,7 @@ enum vmbus_connect_state {
34909 struct vmbus_connection {
34910 enum vmbus_connect_state conn_state;
34911
34912 - atomic_t next_gpadl_handle;
34913 + atomic_unchecked_t next_gpadl_handle;
34914
34915 /*
34916 * Represents channel interrupts. Each bit position represents a
34917 diff -urNp linux-3.0.9/drivers/staging/hv/rndis_filter.c linux-3.0.9/drivers/staging/hv/rndis_filter.c
34918 --- linux-3.0.9/drivers/staging/hv/rndis_filter.c 2011-11-11 13:12:24.000000000 -0500
34919 +++ linux-3.0.9/drivers/staging/hv/rndis_filter.c 2011-11-15 20:02:59.000000000 -0500
34920 @@ -43,7 +43,7 @@ struct rndis_device {
34921
34922 enum rndis_device_state state;
34923 u32 link_stat;
34924 - atomic_t new_req_id;
34925 + atomic_unchecked_t new_req_id;
34926
34927 spinlock_t request_lock;
34928 struct list_head req_list;
34929 @@ -117,7 +117,7 @@ static struct rndis_request *get_rndis_r
34930 * template
34931 */
34932 set = &rndis_msg->msg.set_req;
34933 - set->req_id = atomic_inc_return(&dev->new_req_id);
34934 + set->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
34935
34936 /* Add to the request list */
34937 spin_lock_irqsave(&dev->request_lock, flags);
34938 @@ -637,7 +637,7 @@ static void rndis_filter_halt_device(str
34939
34940 /* Setup the rndis set */
34941 halt = &request->request_msg.msg.halt_req;
34942 - halt->req_id = atomic_inc_return(&dev->new_req_id);
34943 + halt->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
34944
34945 /* Ignore return since this msg is optional. */
34946 rndis_filter_send_request(dev, request);
34947 diff -urNp linux-3.0.9/drivers/staging/hv/vmbus_drv.c linux-3.0.9/drivers/staging/hv/vmbus_drv.c
34948 --- linux-3.0.9/drivers/staging/hv/vmbus_drv.c 2011-11-11 13:12:24.000000000 -0500
34949 +++ linux-3.0.9/drivers/staging/hv/vmbus_drv.c 2011-11-15 20:02:59.000000000 -0500
34950 @@ -668,11 +668,11 @@ int vmbus_child_device_register(struct h
34951 {
34952 int ret = 0;
34953
34954 - static atomic_t device_num = ATOMIC_INIT(0);
34955 + static atomic_unchecked_t device_num = ATOMIC_INIT(0);
34956
34957 /* Set the device name. Otherwise, device_register() will fail. */
34958 dev_set_name(&child_device_obj->device, "vmbus_0_%d",
34959 - atomic_inc_return(&device_num));
34960 + atomic_inc_return_unchecked(&device_num));
34961
34962 /* The new device belongs to this bus */
34963 child_device_obj->device.bus = &hv_bus; /* device->dev.bus; */
34964 diff -urNp linux-3.0.9/drivers/staging/iio/ring_generic.h linux-3.0.9/drivers/staging/iio/ring_generic.h
34965 --- linux-3.0.9/drivers/staging/iio/ring_generic.h 2011-11-11 13:12:24.000000000 -0500
34966 +++ linux-3.0.9/drivers/staging/iio/ring_generic.h 2011-11-15 20:02:59.000000000 -0500
34967 @@ -62,7 +62,7 @@ struct iio_ring_access_funcs {
34968
34969 int (*is_enabled)(struct iio_ring_buffer *ring);
34970 int (*enable)(struct iio_ring_buffer *ring);
34971 -};
34972 +} __no_const;
34973
34974 struct iio_ring_setup_ops {
34975 int (*preenable)(struct iio_dev *);
34976 diff -urNp linux-3.0.9/drivers/staging/octeon/ethernet.c linux-3.0.9/drivers/staging/octeon/ethernet.c
34977 --- linux-3.0.9/drivers/staging/octeon/ethernet.c 2011-11-11 13:12:24.000000000 -0500
34978 +++ linux-3.0.9/drivers/staging/octeon/ethernet.c 2011-11-15 20:02:59.000000000 -0500
34979 @@ -258,11 +258,11 @@ static struct net_device_stats *cvm_oct_
34980 * since the RX tasklet also increments it.
34981 */
34982 #ifdef CONFIG_64BIT
34983 - atomic64_add(rx_status.dropped_packets,
34984 - (atomic64_t *)&priv->stats.rx_dropped);
34985 + atomic64_add_unchecked(rx_status.dropped_packets,
34986 + (atomic64_unchecked_t *)&priv->stats.rx_dropped);
34987 #else
34988 - atomic_add(rx_status.dropped_packets,
34989 - (atomic_t *)&priv->stats.rx_dropped);
34990 + atomic_add_unchecked(rx_status.dropped_packets,
34991 + (atomic_unchecked_t *)&priv->stats.rx_dropped);
34992 #endif
34993 }
34994
34995 diff -urNp linux-3.0.9/drivers/staging/octeon/ethernet-rx.c linux-3.0.9/drivers/staging/octeon/ethernet-rx.c
34996 --- linux-3.0.9/drivers/staging/octeon/ethernet-rx.c 2011-11-11 13:12:24.000000000 -0500
34997 +++ linux-3.0.9/drivers/staging/octeon/ethernet-rx.c 2011-11-15 20:02:59.000000000 -0500
34998 @@ -417,11 +417,11 @@ static int cvm_oct_napi_poll(struct napi
34999 /* Increment RX stats for virtual ports */
35000 if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
35001 #ifdef CONFIG_64BIT
35002 - atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
35003 - atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
35004 + atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
35005 + atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
35006 #else
35007 - atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
35008 - atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
35009 + atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
35010 + atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
35011 #endif
35012 }
35013 netif_receive_skb(skb);
35014 @@ -433,9 +433,9 @@ static int cvm_oct_napi_poll(struct napi
35015 dev->name);
35016 */
35017 #ifdef CONFIG_64BIT
35018 - atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
35019 + atomic64_unchecked_add(1, (atomic64_unchecked_t *)&priv->stats.rx_dropped);
35020 #else
35021 - atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
35022 + atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_dropped);
35023 #endif
35024 dev_kfree_skb_irq(skb);
35025 }
35026 diff -urNp linux-3.0.9/drivers/staging/pohmelfs/inode.c linux-3.0.9/drivers/staging/pohmelfs/inode.c
35027 --- linux-3.0.9/drivers/staging/pohmelfs/inode.c 2011-11-11 13:12:24.000000000 -0500
35028 +++ linux-3.0.9/drivers/staging/pohmelfs/inode.c 2011-11-15 20:02:59.000000000 -0500
35029 @@ -1856,7 +1856,7 @@ static int pohmelfs_fill_super(struct su
35030 mutex_init(&psb->mcache_lock);
35031 psb->mcache_root = RB_ROOT;
35032 psb->mcache_timeout = msecs_to_jiffies(5000);
35033 - atomic_long_set(&psb->mcache_gen, 0);
35034 + atomic_long_set_unchecked(&psb->mcache_gen, 0);
35035
35036 psb->trans_max_pages = 100;
35037
35038 @@ -1871,7 +1871,7 @@ static int pohmelfs_fill_super(struct su
35039 INIT_LIST_HEAD(&psb->crypto_ready_list);
35040 INIT_LIST_HEAD(&psb->crypto_active_list);
35041
35042 - atomic_set(&psb->trans_gen, 1);
35043 + atomic_set_unchecked(&psb->trans_gen, 1);
35044 atomic_long_set(&psb->total_inodes, 0);
35045
35046 mutex_init(&psb->state_lock);
35047 diff -urNp linux-3.0.9/drivers/staging/pohmelfs/mcache.c linux-3.0.9/drivers/staging/pohmelfs/mcache.c
35048 --- linux-3.0.9/drivers/staging/pohmelfs/mcache.c 2011-11-11 13:12:24.000000000 -0500
35049 +++ linux-3.0.9/drivers/staging/pohmelfs/mcache.c 2011-11-15 20:02:59.000000000 -0500
35050 @@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
35051 m->data = data;
35052 m->start = start;
35053 m->size = size;
35054 - m->gen = atomic_long_inc_return(&psb->mcache_gen);
35055 + m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
35056
35057 mutex_lock(&psb->mcache_lock);
35058 err = pohmelfs_mcache_insert(psb, m);
35059 diff -urNp linux-3.0.9/drivers/staging/pohmelfs/netfs.h linux-3.0.9/drivers/staging/pohmelfs/netfs.h
35060 --- linux-3.0.9/drivers/staging/pohmelfs/netfs.h 2011-11-11 13:12:24.000000000 -0500
35061 +++ linux-3.0.9/drivers/staging/pohmelfs/netfs.h 2011-11-15 20:02:59.000000000 -0500
35062 @@ -571,14 +571,14 @@ struct pohmelfs_config;
35063 struct pohmelfs_sb {
35064 struct rb_root mcache_root;
35065 struct mutex mcache_lock;
35066 - atomic_long_t mcache_gen;
35067 + atomic_long_unchecked_t mcache_gen;
35068 unsigned long mcache_timeout;
35069
35070 unsigned int idx;
35071
35072 unsigned int trans_retries;
35073
35074 - atomic_t trans_gen;
35075 + atomic_unchecked_t trans_gen;
35076
35077 unsigned int crypto_attached_size;
35078 unsigned int crypto_align_size;
35079 diff -urNp linux-3.0.9/drivers/staging/pohmelfs/trans.c linux-3.0.9/drivers/staging/pohmelfs/trans.c
35080 --- linux-3.0.9/drivers/staging/pohmelfs/trans.c 2011-11-11 13:12:24.000000000 -0500
35081 +++ linux-3.0.9/drivers/staging/pohmelfs/trans.c 2011-11-15 20:02:59.000000000 -0500
35082 @@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_tran
35083 int err;
35084 struct netfs_cmd *cmd = t->iovec.iov_base;
35085
35086 - t->gen = atomic_inc_return(&psb->trans_gen);
35087 + t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
35088
35089 cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
35090 t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
35091 diff -urNp linux-3.0.9/drivers/staging/rtl8712/rtl871x_io.h linux-3.0.9/drivers/staging/rtl8712/rtl871x_io.h
35092 --- linux-3.0.9/drivers/staging/rtl8712/rtl871x_io.h 2011-11-11 13:12:24.000000000 -0500
35093 +++ linux-3.0.9/drivers/staging/rtl8712/rtl871x_io.h 2011-11-15 20:02:59.000000000 -0500
35094 @@ -83,7 +83,7 @@ struct _io_ops {
35095 u8 *pmem);
35096 u32 (*_write_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt,
35097 u8 *pmem);
35098 -};
35099 +} __no_const;
35100
35101 struct io_req {
35102 struct list_head list;
35103 diff -urNp linux-3.0.9/drivers/staging/sbe-2t3e3/netdev.c linux-3.0.9/drivers/staging/sbe-2t3e3/netdev.c
35104 --- linux-3.0.9/drivers/staging/sbe-2t3e3/netdev.c 2011-11-11 13:12:24.000000000 -0500
35105 +++ linux-3.0.9/drivers/staging/sbe-2t3e3/netdev.c 2011-11-15 20:02:59.000000000 -0500
35106 @@ -51,7 +51,7 @@ int t3e3_ioctl(struct net_device *dev, s
35107 t3e3_if_config(sc, cmd_2t3e3, (char *)&param, &resp, &rlen);
35108
35109 if (rlen)
35110 - if (copy_to_user(data, &resp, rlen))
35111 + if (rlen > sizeof resp || copy_to_user(data, &resp, rlen))
35112 return -EFAULT;
35113
35114 return 0;
35115 diff -urNp linux-3.0.9/drivers/staging/tty/stallion.c linux-3.0.9/drivers/staging/tty/stallion.c
35116 --- linux-3.0.9/drivers/staging/tty/stallion.c 2011-11-11 13:12:24.000000000 -0500
35117 +++ linux-3.0.9/drivers/staging/tty/stallion.c 2011-11-15 20:02:59.000000000 -0500
35118 @@ -2406,6 +2406,8 @@ static int stl_getportstruct(struct stlp
35119 struct stlport stl_dummyport;
35120 struct stlport *portp;
35121
35122 + pax_track_stack();
35123 +
35124 if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport)))
35125 return -EFAULT;
35126 portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
35127 diff -urNp linux-3.0.9/drivers/staging/usbip/usbip_common.h linux-3.0.9/drivers/staging/usbip/usbip_common.h
35128 --- linux-3.0.9/drivers/staging/usbip/usbip_common.h 2011-11-11 13:12:24.000000000 -0500
35129 +++ linux-3.0.9/drivers/staging/usbip/usbip_common.h 2011-11-15 20:02:59.000000000 -0500
35130 @@ -315,7 +315,7 @@ struct usbip_device {
35131 void (*shutdown)(struct usbip_device *);
35132 void (*reset)(struct usbip_device *);
35133 void (*unusable)(struct usbip_device *);
35134 - } eh_ops;
35135 + } __no_const eh_ops;
35136 };
35137
35138 void usbip_pack_pdu(struct usbip_header *pdu, struct urb *urb, int cmd,
35139 diff -urNp linux-3.0.9/drivers/staging/usbip/vhci.h linux-3.0.9/drivers/staging/usbip/vhci.h
35140 --- linux-3.0.9/drivers/staging/usbip/vhci.h 2011-11-11 13:12:24.000000000 -0500
35141 +++ linux-3.0.9/drivers/staging/usbip/vhci.h 2011-11-15 20:02:59.000000000 -0500
35142 @@ -94,7 +94,7 @@ struct vhci_hcd {
35143 unsigned resuming:1;
35144 unsigned long re_timeout;
35145
35146 - atomic_t seqnum;
35147 + atomic_unchecked_t seqnum;
35148
35149 /*
35150 * NOTE:
35151 diff -urNp linux-3.0.9/drivers/staging/usbip/vhci_hcd.c linux-3.0.9/drivers/staging/usbip/vhci_hcd.c
35152 --- linux-3.0.9/drivers/staging/usbip/vhci_hcd.c 2011-11-11 13:12:24.000000000 -0500
35153 +++ linux-3.0.9/drivers/staging/usbip/vhci_hcd.c 2011-11-15 20:02:59.000000000 -0500
35154 @@ -511,7 +511,7 @@ static void vhci_tx_urb(struct urb *urb)
35155 return;
35156 }
35157
35158 - priv->seqnum = atomic_inc_return(&the_controller->seqnum);
35159 + priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
35160 if (priv->seqnum == 0xffff)
35161 dev_info(&urb->dev->dev, "seqnum max\n");
35162
35163 @@ -765,7 +765,7 @@ static int vhci_urb_dequeue(struct usb_h
35164 return -ENOMEM;
35165 }
35166
35167 - unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
35168 + unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
35169 if (unlink->seqnum == 0xffff)
35170 pr_info("seqnum max\n");
35171
35172 @@ -955,7 +955,7 @@ static int vhci_start(struct usb_hcd *hc
35173 vdev->rhport = rhport;
35174 }
35175
35176 - atomic_set(&vhci->seqnum, 0);
35177 + atomic_set_unchecked(&vhci->seqnum, 0);
35178 spin_lock_init(&vhci->lock);
35179
35180 hcd->power_budget = 0; /* no limit */
35181 diff -urNp linux-3.0.9/drivers/staging/usbip/vhci_rx.c linux-3.0.9/drivers/staging/usbip/vhci_rx.c
35182 --- linux-3.0.9/drivers/staging/usbip/vhci_rx.c 2011-11-11 13:12:24.000000000 -0500
35183 +++ linux-3.0.9/drivers/staging/usbip/vhci_rx.c 2011-11-15 20:02:59.000000000 -0500
35184 @@ -76,7 +76,7 @@ static void vhci_recv_ret_submit(struct
35185 if (!urb) {
35186 pr_err("cannot find a urb of seqnum %u\n", pdu->base.seqnum);
35187 pr_info("max seqnum %d\n",
35188 - atomic_read(&the_controller->seqnum));
35189 + atomic_read_unchecked(&the_controller->seqnum));
35190 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
35191 return;
35192 }
35193 diff -urNp linux-3.0.9/drivers/staging/vt6655/hostap.c linux-3.0.9/drivers/staging/vt6655/hostap.c
35194 --- linux-3.0.9/drivers/staging/vt6655/hostap.c 2011-11-11 13:12:24.000000000 -0500
35195 +++ linux-3.0.9/drivers/staging/vt6655/hostap.c 2011-11-15 20:02:59.000000000 -0500
35196 @@ -79,14 +79,13 @@ static int msglevel
35197 *
35198 */
35199
35200 +static net_device_ops_no_const apdev_netdev_ops;
35201 +
35202 static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
35203 {
35204 PSDevice apdev_priv;
35205 struct net_device *dev = pDevice->dev;
35206 int ret;
35207 - const struct net_device_ops apdev_netdev_ops = {
35208 - .ndo_start_xmit = pDevice->tx_80211,
35209 - };
35210
35211 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Enabling hostapd mode\n", dev->name);
35212
35213 @@ -98,6 +97,8 @@ static int hostap_enable_hostapd(PSDevic
35214 *apdev_priv = *pDevice;
35215 memcpy(pDevice->apdev->dev_addr, dev->dev_addr, ETH_ALEN);
35216
35217 + /* only half broken now */
35218 + apdev_netdev_ops.ndo_start_xmit = pDevice->tx_80211;
35219 pDevice->apdev->netdev_ops = &apdev_netdev_ops;
35220
35221 pDevice->apdev->type = ARPHRD_IEEE80211;
35222 diff -urNp linux-3.0.9/drivers/staging/vt6656/hostap.c linux-3.0.9/drivers/staging/vt6656/hostap.c
35223 --- linux-3.0.9/drivers/staging/vt6656/hostap.c 2011-11-11 13:12:24.000000000 -0500
35224 +++ linux-3.0.9/drivers/staging/vt6656/hostap.c 2011-11-15 20:02:59.000000000 -0500
35225 @@ -80,14 +80,13 @@ static int msglevel
35226 *
35227 */
35228
35229 +static net_device_ops_no_const apdev_netdev_ops;
35230 +
35231 static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
35232 {
35233 PSDevice apdev_priv;
35234 struct net_device *dev = pDevice->dev;
35235 int ret;
35236 - const struct net_device_ops apdev_netdev_ops = {
35237 - .ndo_start_xmit = pDevice->tx_80211,
35238 - };
35239
35240 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Enabling hostapd mode\n", dev->name);
35241
35242 @@ -99,6 +98,8 @@ static int hostap_enable_hostapd(PSDevic
35243 *apdev_priv = *pDevice;
35244 memcpy(pDevice->apdev->dev_addr, dev->dev_addr, ETH_ALEN);
35245
35246 + /* only half broken now */
35247 + apdev_netdev_ops.ndo_start_xmit = pDevice->tx_80211;
35248 pDevice->apdev->netdev_ops = &apdev_netdev_ops;
35249
35250 pDevice->apdev->type = ARPHRD_IEEE80211;
35251 diff -urNp linux-3.0.9/drivers/staging/wlan-ng/hfa384x_usb.c linux-3.0.9/drivers/staging/wlan-ng/hfa384x_usb.c
35252 --- linux-3.0.9/drivers/staging/wlan-ng/hfa384x_usb.c 2011-11-11 13:12:24.000000000 -0500
35253 +++ linux-3.0.9/drivers/staging/wlan-ng/hfa384x_usb.c 2011-11-15 20:02:59.000000000 -0500
35254 @@ -204,7 +204,7 @@ static void unlocked_usbctlx_complete(hf
35255
35256 struct usbctlx_completor {
35257 int (*complete) (struct usbctlx_completor *);
35258 -};
35259 +} __no_const;
35260
35261 static int
35262 hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
35263 diff -urNp linux-3.0.9/drivers/staging/zcache/tmem.c linux-3.0.9/drivers/staging/zcache/tmem.c
35264 --- linux-3.0.9/drivers/staging/zcache/tmem.c 2011-11-11 13:12:24.000000000 -0500
35265 +++ linux-3.0.9/drivers/staging/zcache/tmem.c 2011-11-15 20:02:59.000000000 -0500
35266 @@ -39,7 +39,7 @@
35267 * A tmem host implementation must use this function to register callbacks
35268 * for memory allocation.
35269 */
35270 -static struct tmem_hostops tmem_hostops;
35271 +static tmem_hostops_no_const tmem_hostops;
35272
35273 static void tmem_objnode_tree_init(void);
35274
35275 @@ -53,7 +53,7 @@ void tmem_register_hostops(struct tmem_h
35276 * A tmem host implementation must use this function to register
35277 * callbacks for a page-accessible memory (PAM) implementation
35278 */
35279 -static struct tmem_pamops tmem_pamops;
35280 +static tmem_pamops_no_const tmem_pamops;
35281
35282 void tmem_register_pamops(struct tmem_pamops *m)
35283 {
35284 diff -urNp linux-3.0.9/drivers/staging/zcache/tmem.h linux-3.0.9/drivers/staging/zcache/tmem.h
35285 --- linux-3.0.9/drivers/staging/zcache/tmem.h 2011-11-11 13:12:24.000000000 -0500
35286 +++ linux-3.0.9/drivers/staging/zcache/tmem.h 2011-11-15 20:02:59.000000000 -0500
35287 @@ -171,6 +171,7 @@ struct tmem_pamops {
35288 int (*get_data)(struct page *, void *, struct tmem_pool *);
35289 void (*free)(void *, struct tmem_pool *);
35290 };
35291 +typedef struct tmem_pamops __no_const tmem_pamops_no_const;
35292 extern void tmem_register_pamops(struct tmem_pamops *m);
35293
35294 /* memory allocation methods provided by the host implementation */
35295 @@ -180,6 +181,7 @@ struct tmem_hostops {
35296 struct tmem_objnode *(*objnode_alloc)(struct tmem_pool *);
35297 void (*objnode_free)(struct tmem_objnode *, struct tmem_pool *);
35298 };
35299 +typedef struct tmem_hostops __no_const tmem_hostops_no_const;
35300 extern void tmem_register_hostops(struct tmem_hostops *m);
35301
35302 /* core tmem accessor functions */
35303 diff -urNp linux-3.0.9/drivers/target/target_core_alua.c linux-3.0.9/drivers/target/target_core_alua.c
35304 --- linux-3.0.9/drivers/target/target_core_alua.c 2011-11-11 13:12:24.000000000 -0500
35305 +++ linux-3.0.9/drivers/target/target_core_alua.c 2011-11-15 20:02:59.000000000 -0500
35306 @@ -695,6 +695,8 @@ static int core_alua_update_tpg_primary_
35307 char path[ALUA_METADATA_PATH_LEN];
35308 int len;
35309
35310 + pax_track_stack();
35311 +
35312 memset(path, 0, ALUA_METADATA_PATH_LEN);
35313
35314 len = snprintf(md_buf, tg_pt_gp->tg_pt_gp_md_buf_len,
35315 @@ -958,6 +960,8 @@ static int core_alua_update_tpg_secondar
35316 char path[ALUA_METADATA_PATH_LEN], wwn[ALUA_SECONDARY_METADATA_WWN_LEN];
35317 int len;
35318
35319 + pax_track_stack();
35320 +
35321 memset(path, 0, ALUA_METADATA_PATH_LEN);
35322 memset(wwn, 0, ALUA_SECONDARY_METADATA_WWN_LEN);
35323
35324 diff -urNp linux-3.0.9/drivers/target/target_core_cdb.c linux-3.0.9/drivers/target/target_core_cdb.c
35325 --- linux-3.0.9/drivers/target/target_core_cdb.c 2011-11-11 13:12:24.000000000 -0500
35326 +++ linux-3.0.9/drivers/target/target_core_cdb.c 2011-11-15 20:02:59.000000000 -0500
35327 @@ -838,6 +838,8 @@ target_emulate_modesense(struct se_cmd *
35328 int length = 0;
35329 unsigned char buf[SE_MODE_PAGE_BUF];
35330
35331 + pax_track_stack();
35332 +
35333 memset(buf, 0, SE_MODE_PAGE_BUF);
35334
35335 switch (cdb[2] & 0x3f) {
35336 diff -urNp linux-3.0.9/drivers/target/target_core_configfs.c linux-3.0.9/drivers/target/target_core_configfs.c
35337 --- linux-3.0.9/drivers/target/target_core_configfs.c 2011-11-11 13:12:24.000000000 -0500
35338 +++ linux-3.0.9/drivers/target/target_core_configfs.c 2011-11-15 20:02:59.000000000 -0500
35339 @@ -1276,6 +1276,8 @@ static ssize_t target_core_dev_pr_show_a
35340 ssize_t len = 0;
35341 int reg_count = 0, prf_isid;
35342
35343 + pax_track_stack();
35344 +
35345 if (!(su_dev->se_dev_ptr))
35346 return -ENODEV;
35347
35348 diff -urNp linux-3.0.9/drivers/target/target_core_pr.c linux-3.0.9/drivers/target/target_core_pr.c
35349 --- linux-3.0.9/drivers/target/target_core_pr.c 2011-11-11 13:12:24.000000000 -0500
35350 +++ linux-3.0.9/drivers/target/target_core_pr.c 2011-11-15 20:02:59.000000000 -0500
35351 @@ -918,6 +918,8 @@ static int __core_scsi3_check_aptpl_regi
35352 unsigned char t_port[PR_APTPL_MAX_TPORT_LEN];
35353 u16 tpgt;
35354
35355 + pax_track_stack();
35356 +
35357 memset(i_port, 0, PR_APTPL_MAX_IPORT_LEN);
35358 memset(t_port, 0, PR_APTPL_MAX_TPORT_LEN);
35359 /*
35360 @@ -1861,6 +1863,8 @@ static int __core_scsi3_update_aptpl_buf
35361 ssize_t len = 0;
35362 int reg_count = 0;
35363
35364 + pax_track_stack();
35365 +
35366 memset(buf, 0, pr_aptpl_buf_len);
35367 /*
35368 * Called to clear metadata once APTPL has been deactivated.
35369 @@ -1983,6 +1987,8 @@ static int __core_scsi3_write_aptpl_to_f
35370 char path[512];
35371 int ret;
35372
35373 + pax_track_stack();
35374 +
35375 memset(iov, 0, sizeof(struct iovec));
35376 memset(path, 0, 512);
35377
35378 diff -urNp linux-3.0.9/drivers/target/target_core_tmr.c linux-3.0.9/drivers/target/target_core_tmr.c
35379 --- linux-3.0.9/drivers/target/target_core_tmr.c 2011-11-11 13:12:24.000000000 -0500
35380 +++ linux-3.0.9/drivers/target/target_core_tmr.c 2011-11-15 20:02:59.000000000 -0500
35381 @@ -269,7 +269,7 @@ int core_tmr_lun_reset(
35382 CMD_TFO(cmd)->get_task_tag(cmd), cmd->pr_res_key,
35383 T_TASK(cmd)->t_task_cdbs,
35384 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
35385 - atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
35386 + atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
35387 atomic_read(&T_TASK(cmd)->t_transport_active),
35388 atomic_read(&T_TASK(cmd)->t_transport_stop),
35389 atomic_read(&T_TASK(cmd)->t_transport_sent));
35390 @@ -311,7 +311,7 @@ int core_tmr_lun_reset(
35391 DEBUG_LR("LUN_RESET: got t_transport_active = 1 for"
35392 " task: %p, t_fe_count: %d dev: %p\n", task,
35393 fe_count, dev);
35394 - atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
35395 + atomic_set_unchecked(&T_TASK(cmd)->t_transport_aborted, 1);
35396 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock,
35397 flags);
35398 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
35399 @@ -321,7 +321,7 @@ int core_tmr_lun_reset(
35400 }
35401 DEBUG_LR("LUN_RESET: Got t_transport_active = 0 for task: %p,"
35402 " t_fe_count: %d dev: %p\n", task, fe_count, dev);
35403 - atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
35404 + atomic_set_unchecked(&T_TASK(cmd)->t_transport_aborted, 1);
35405 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
35406 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
35407
35408 diff -urNp linux-3.0.9/drivers/target/target_core_transport.c linux-3.0.9/drivers/target/target_core_transport.c
35409 --- linux-3.0.9/drivers/target/target_core_transport.c 2011-11-11 13:12:24.000000000 -0500
35410 +++ linux-3.0.9/drivers/target/target_core_transport.c 2011-11-15 20:02:59.000000000 -0500
35411 @@ -1681,7 +1681,7 @@ struct se_device *transport_add_device_t
35412
35413 dev->queue_depth = dev_limits->queue_depth;
35414 atomic_set(&dev->depth_left, dev->queue_depth);
35415 - atomic_set(&dev->dev_ordered_id, 0);
35416 + atomic_set_unchecked(&dev->dev_ordered_id, 0);
35417
35418 se_dev_set_default_attribs(dev, dev_limits);
35419
35420 @@ -1882,7 +1882,7 @@ static int transport_check_alloc_task_at
35421 * Used to determine when ORDERED commands should go from
35422 * Dormant to Active status.
35423 */
35424 - cmd->se_ordered_id = atomic_inc_return(&SE_DEV(cmd)->dev_ordered_id);
35425 + cmd->se_ordered_id = atomic_inc_return_unchecked(&SE_DEV(cmd)->dev_ordered_id);
35426 smp_mb__after_atomic_inc();
35427 DEBUG_STA("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
35428 cmd->se_ordered_id, cmd->sam_task_attr,
35429 @@ -2169,7 +2169,7 @@ static void transport_generic_request_fa
35430 " t_transport_active: %d t_transport_stop: %d"
35431 " t_transport_sent: %d\n", T_TASK(cmd)->t_task_cdbs,
35432 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
35433 - atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
35434 + atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
35435 atomic_read(&T_TASK(cmd)->t_task_cdbs_ex_left),
35436 atomic_read(&T_TASK(cmd)->t_transport_active),
35437 atomic_read(&T_TASK(cmd)->t_transport_stop),
35438 @@ -2673,9 +2673,9 @@ check_depth:
35439 spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
35440 atomic_set(&task->task_active, 1);
35441 atomic_set(&task->task_sent, 1);
35442 - atomic_inc(&T_TASK(cmd)->t_task_cdbs_sent);
35443 + atomic_inc_unchecked(&T_TASK(cmd)->t_task_cdbs_sent);
35444
35445 - if (atomic_read(&T_TASK(cmd)->t_task_cdbs_sent) ==
35446 + if (atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent) ==
35447 T_TASK(cmd)->t_task_cdbs)
35448 atomic_set(&cmd->transport_sent, 1);
35449
35450 @@ -5568,7 +5568,7 @@ static void transport_generic_wait_for_t
35451 atomic_set(&T_TASK(cmd)->transport_lun_stop, 0);
35452 }
35453 if (!atomic_read(&T_TASK(cmd)->t_transport_active) ||
35454 - atomic_read(&T_TASK(cmd)->t_transport_aborted))
35455 + atomic_read_unchecked(&T_TASK(cmd)->t_transport_aborted))
35456 goto remove;
35457
35458 atomic_set(&T_TASK(cmd)->t_transport_stop, 1);
35459 @@ -5797,7 +5797,7 @@ int transport_check_aborted_status(struc
35460 {
35461 int ret = 0;
35462
35463 - if (atomic_read(&T_TASK(cmd)->t_transport_aborted) != 0) {
35464 + if (atomic_read_unchecked(&T_TASK(cmd)->t_transport_aborted) != 0) {
35465 if (!(send_status) ||
35466 (cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS))
35467 return 1;
35468 @@ -5825,7 +5825,7 @@ void transport_send_task_abort(struct se
35469 */
35470 if (cmd->data_direction == DMA_TO_DEVICE) {
35471 if (CMD_TFO(cmd)->write_pending_status(cmd) != 0) {
35472 - atomic_inc(&T_TASK(cmd)->t_transport_aborted);
35473 + atomic_inc_unchecked(&T_TASK(cmd)->t_transport_aborted);
35474 smp_mb__after_atomic_inc();
35475 cmd->scsi_status = SAM_STAT_TASK_ABORTED;
35476 transport_new_cmd_failure(cmd);
35477 @@ -5949,7 +5949,7 @@ static void transport_processing_shutdow
35478 CMD_TFO(cmd)->get_task_tag(cmd),
35479 T_TASK(cmd)->t_task_cdbs,
35480 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
35481 - atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
35482 + atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
35483 atomic_read(&T_TASK(cmd)->t_transport_active),
35484 atomic_read(&T_TASK(cmd)->t_transport_stop),
35485 atomic_read(&T_TASK(cmd)->t_transport_sent));
35486 diff -urNp linux-3.0.9/drivers/telephony/ixj.c linux-3.0.9/drivers/telephony/ixj.c
35487 --- linux-3.0.9/drivers/telephony/ixj.c 2011-11-11 13:12:24.000000000 -0500
35488 +++ linux-3.0.9/drivers/telephony/ixj.c 2011-11-15 20:02:59.000000000 -0500
35489 @@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
35490 bool mContinue;
35491 char *pIn, *pOut;
35492
35493 + pax_track_stack();
35494 +
35495 if (!SCI_Prepare(j))
35496 return 0;
35497
35498 diff -urNp linux-3.0.9/drivers/tty/hvc/hvcs.c linux-3.0.9/drivers/tty/hvc/hvcs.c
35499 --- linux-3.0.9/drivers/tty/hvc/hvcs.c 2011-11-11 13:12:24.000000000 -0500
35500 +++ linux-3.0.9/drivers/tty/hvc/hvcs.c 2011-11-15 20:02:59.000000000 -0500
35501 @@ -83,6 +83,7 @@
35502 #include <asm/hvcserver.h>
35503 #include <asm/uaccess.h>
35504 #include <asm/vio.h>
35505 +#include <asm/local.h>
35506
35507 /*
35508 * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
35509 @@ -270,7 +271,7 @@ struct hvcs_struct {
35510 unsigned int index;
35511
35512 struct tty_struct *tty;
35513 - int open_count;
35514 + local_t open_count;
35515
35516 /*
35517 * Used to tell the driver kernel_thread what operations need to take
35518 @@ -422,7 +423,7 @@ static ssize_t hvcs_vterm_state_store(st
35519
35520 spin_lock_irqsave(&hvcsd->lock, flags);
35521
35522 - if (hvcsd->open_count > 0) {
35523 + if (local_read(&hvcsd->open_count) > 0) {
35524 spin_unlock_irqrestore(&hvcsd->lock, flags);
35525 printk(KERN_INFO "HVCS: vterm state unchanged. "
35526 "The hvcs device node is still in use.\n");
35527 @@ -1145,7 +1146,7 @@ static int hvcs_open(struct tty_struct *
35528 if ((retval = hvcs_partner_connect(hvcsd)))
35529 goto error_release;
35530
35531 - hvcsd->open_count = 1;
35532 + local_set(&hvcsd->open_count, 1);
35533 hvcsd->tty = tty;
35534 tty->driver_data = hvcsd;
35535
35536 @@ -1179,7 +1180,7 @@ fast_open:
35537
35538 spin_lock_irqsave(&hvcsd->lock, flags);
35539 kref_get(&hvcsd->kref);
35540 - hvcsd->open_count++;
35541 + local_inc(&hvcsd->open_count);
35542 hvcsd->todo_mask |= HVCS_SCHED_READ;
35543 spin_unlock_irqrestore(&hvcsd->lock, flags);
35544
35545 @@ -1223,7 +1224,7 @@ static void hvcs_close(struct tty_struct
35546 hvcsd = tty->driver_data;
35547
35548 spin_lock_irqsave(&hvcsd->lock, flags);
35549 - if (--hvcsd->open_count == 0) {
35550 + if (local_dec_and_test(&hvcsd->open_count)) {
35551
35552 vio_disable_interrupts(hvcsd->vdev);
35553
35554 @@ -1249,10 +1250,10 @@ static void hvcs_close(struct tty_struct
35555 free_irq(irq, hvcsd);
35556 kref_put(&hvcsd->kref, destroy_hvcs_struct);
35557 return;
35558 - } else if (hvcsd->open_count < 0) {
35559 + } else if (local_read(&hvcsd->open_count) < 0) {
35560 printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
35561 " is missmanaged.\n",
35562 - hvcsd->vdev->unit_address, hvcsd->open_count);
35563 + hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
35564 }
35565
35566 spin_unlock_irqrestore(&hvcsd->lock, flags);
35567 @@ -1268,7 +1269,7 @@ static void hvcs_hangup(struct tty_struc
35568
35569 spin_lock_irqsave(&hvcsd->lock, flags);
35570 /* Preserve this so that we know how many kref refs to put */
35571 - temp_open_count = hvcsd->open_count;
35572 + temp_open_count = local_read(&hvcsd->open_count);
35573
35574 /*
35575 * Don't kref put inside the spinlock because the destruction
35576 @@ -1283,7 +1284,7 @@ static void hvcs_hangup(struct tty_struc
35577 hvcsd->tty->driver_data = NULL;
35578 hvcsd->tty = NULL;
35579
35580 - hvcsd->open_count = 0;
35581 + local_set(&hvcsd->open_count, 0);
35582
35583 /* This will drop any buffered data on the floor which is OK in a hangup
35584 * scenario. */
35585 @@ -1354,7 +1355,7 @@ static int hvcs_write(struct tty_struct
35586 * the middle of a write operation? This is a crummy place to do this
35587 * but we want to keep it all in the spinlock.
35588 */
35589 - if (hvcsd->open_count <= 0) {
35590 + if (local_read(&hvcsd->open_count) <= 0) {
35591 spin_unlock_irqrestore(&hvcsd->lock, flags);
35592 return -ENODEV;
35593 }
35594 @@ -1428,7 +1429,7 @@ static int hvcs_write_room(struct tty_st
35595 {
35596 struct hvcs_struct *hvcsd = tty->driver_data;
35597
35598 - if (!hvcsd || hvcsd->open_count <= 0)
35599 + if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
35600 return 0;
35601
35602 return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
35603 diff -urNp linux-3.0.9/drivers/tty/ipwireless/tty.c linux-3.0.9/drivers/tty/ipwireless/tty.c
35604 --- linux-3.0.9/drivers/tty/ipwireless/tty.c 2011-11-11 13:12:24.000000000 -0500
35605 +++ linux-3.0.9/drivers/tty/ipwireless/tty.c 2011-11-15 20:02:59.000000000 -0500
35606 @@ -29,6 +29,7 @@
35607 #include <linux/tty_driver.h>
35608 #include <linux/tty_flip.h>
35609 #include <linux/uaccess.h>
35610 +#include <asm/local.h>
35611
35612 #include "tty.h"
35613 #include "network.h"
35614 @@ -51,7 +52,7 @@ struct ipw_tty {
35615 int tty_type;
35616 struct ipw_network *network;
35617 struct tty_struct *linux_tty;
35618 - int open_count;
35619 + local_t open_count;
35620 unsigned int control_lines;
35621 struct mutex ipw_tty_mutex;
35622 int tx_bytes_queued;
35623 @@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *l
35624 mutex_unlock(&tty->ipw_tty_mutex);
35625 return -ENODEV;
35626 }
35627 - if (tty->open_count == 0)
35628 + if (local_read(&tty->open_count) == 0)
35629 tty->tx_bytes_queued = 0;
35630
35631 - tty->open_count++;
35632 + local_inc(&tty->open_count);
35633
35634 tty->linux_tty = linux_tty;
35635 linux_tty->driver_data = tty;
35636 @@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *l
35637
35638 static void do_ipw_close(struct ipw_tty *tty)
35639 {
35640 - tty->open_count--;
35641 -
35642 - if (tty->open_count == 0) {
35643 + if (local_dec_return(&tty->open_count) == 0) {
35644 struct tty_struct *linux_tty = tty->linux_tty;
35645
35646 if (linux_tty != NULL) {
35647 @@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct
35648 return;
35649
35650 mutex_lock(&tty->ipw_tty_mutex);
35651 - if (tty->open_count == 0) {
35652 + if (local_read(&tty->open_count) == 0) {
35653 mutex_unlock(&tty->ipw_tty_mutex);
35654 return;
35655 }
35656 @@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_
35657 return;
35658 }
35659
35660 - if (!tty->open_count) {
35661 + if (!local_read(&tty->open_count)) {
35662 mutex_unlock(&tty->ipw_tty_mutex);
35663 return;
35664 }
35665 @@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *
35666 return -ENODEV;
35667
35668 mutex_lock(&tty->ipw_tty_mutex);
35669 - if (!tty->open_count) {
35670 + if (!local_read(&tty->open_count)) {
35671 mutex_unlock(&tty->ipw_tty_mutex);
35672 return -EINVAL;
35673 }
35674 @@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_str
35675 if (!tty)
35676 return -ENODEV;
35677
35678 - if (!tty->open_count)
35679 + if (!local_read(&tty->open_count))
35680 return -EINVAL;
35681
35682 room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
35683 @@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tt
35684 if (!tty)
35685 return 0;
35686
35687 - if (!tty->open_count)
35688 + if (!local_read(&tty->open_count))
35689 return 0;
35690
35691 return tty->tx_bytes_queued;
35692 @@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struc
35693 if (!tty)
35694 return -ENODEV;
35695
35696 - if (!tty->open_count)
35697 + if (!local_read(&tty->open_count))
35698 return -EINVAL;
35699
35700 return get_control_lines(tty);
35701 @@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
35702 if (!tty)
35703 return -ENODEV;
35704
35705 - if (!tty->open_count)
35706 + if (!local_read(&tty->open_count))
35707 return -EINVAL;
35708
35709 return set_control_lines(tty, set, clear);
35710 @@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *
35711 if (!tty)
35712 return -ENODEV;
35713
35714 - if (!tty->open_count)
35715 + if (!local_read(&tty->open_count))
35716 return -EINVAL;
35717
35718 /* FIXME: Exactly how is the tty object locked here .. */
35719 @@ -582,7 +581,7 @@ void ipwireless_tty_free(struct ipw_tty
35720 against a parallel ioctl etc */
35721 mutex_lock(&ttyj->ipw_tty_mutex);
35722 }
35723 - while (ttyj->open_count)
35724 + while (local_read(&ttyj->open_count))
35725 do_ipw_close(ttyj);
35726 ipwireless_disassociate_network_ttys(network,
35727 ttyj->channel_idx);
35728 diff -urNp linux-3.0.9/drivers/tty/n_gsm.c linux-3.0.9/drivers/tty/n_gsm.c
35729 --- linux-3.0.9/drivers/tty/n_gsm.c 2011-11-11 13:12:24.000000000 -0500
35730 +++ linux-3.0.9/drivers/tty/n_gsm.c 2011-11-15 20:02:59.000000000 -0500
35731 @@ -1589,7 +1589,7 @@ static struct gsm_dlci *gsm_dlci_alloc(s
35732 return NULL;
35733 spin_lock_init(&dlci->lock);
35734 dlci->fifo = &dlci->_fifo;
35735 - if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL) < 0) {
35736 + if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL)) {
35737 kfree(dlci);
35738 return NULL;
35739 }
35740 diff -urNp linux-3.0.9/drivers/tty/n_tty.c linux-3.0.9/drivers/tty/n_tty.c
35741 --- linux-3.0.9/drivers/tty/n_tty.c 2011-11-11 13:12:24.000000000 -0500
35742 +++ linux-3.0.9/drivers/tty/n_tty.c 2011-11-15 20:02:59.000000000 -0500
35743 @@ -2123,6 +2123,7 @@ void n_tty_inherit_ops(struct tty_ldisc_
35744 {
35745 *ops = tty_ldisc_N_TTY;
35746 ops->owner = NULL;
35747 - ops->refcount = ops->flags = 0;
35748 + atomic_set(&ops->refcount, 0);
35749 + ops->flags = 0;
35750 }
35751 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
35752 diff -urNp linux-3.0.9/drivers/tty/pty.c linux-3.0.9/drivers/tty/pty.c
35753 --- linux-3.0.9/drivers/tty/pty.c 2011-11-11 13:12:24.000000000 -0500
35754 +++ linux-3.0.9/drivers/tty/pty.c 2011-11-15 20:02:59.000000000 -0500
35755 @@ -773,8 +773,10 @@ static void __init unix98_pty_init(void)
35756 register_sysctl_table(pty_root_table);
35757
35758 /* Now create the /dev/ptmx special device */
35759 + pax_open_kernel();
35760 tty_default_fops(&ptmx_fops);
35761 - ptmx_fops.open = ptmx_open;
35762 + *(void **)&ptmx_fops.open = ptmx_open;
35763 + pax_close_kernel();
35764
35765 cdev_init(&ptmx_cdev, &ptmx_fops);
35766 if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
35767 diff -urNp linux-3.0.9/drivers/tty/rocket.c linux-3.0.9/drivers/tty/rocket.c
35768 --- linux-3.0.9/drivers/tty/rocket.c 2011-11-11 13:12:24.000000000 -0500
35769 +++ linux-3.0.9/drivers/tty/rocket.c 2011-11-15 20:02:59.000000000 -0500
35770 @@ -1277,6 +1277,8 @@ static int get_ports(struct r_port *info
35771 struct rocket_ports tmp;
35772 int board;
35773
35774 + pax_track_stack();
35775 +
35776 if (!retports)
35777 return -EFAULT;
35778 memset(&tmp, 0, sizeof (tmp));
35779 diff -urNp linux-3.0.9/drivers/tty/serial/kgdboc.c linux-3.0.9/drivers/tty/serial/kgdboc.c
35780 --- linux-3.0.9/drivers/tty/serial/kgdboc.c 2011-11-11 13:12:24.000000000 -0500
35781 +++ linux-3.0.9/drivers/tty/serial/kgdboc.c 2011-11-15 20:02:59.000000000 -0500
35782 @@ -23,8 +23,9 @@
35783 #define MAX_CONFIG_LEN 40
35784
35785 static struct kgdb_io kgdboc_io_ops;
35786 +static struct kgdb_io kgdboc_io_ops_console;
35787
35788 -/* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
35789 +/* -1 = init not run yet, 0 = unconfigured, 1/2 = configured. */
35790 static int configured = -1;
35791
35792 static char config[MAX_CONFIG_LEN];
35793 @@ -147,6 +148,8 @@ static void cleanup_kgdboc(void)
35794 kgdboc_unregister_kbd();
35795 if (configured == 1)
35796 kgdb_unregister_io_module(&kgdboc_io_ops);
35797 + else if (configured == 2)
35798 + kgdb_unregister_io_module(&kgdboc_io_ops_console);
35799 }
35800
35801 static int configure_kgdboc(void)
35802 @@ -156,13 +159,13 @@ static int configure_kgdboc(void)
35803 int err;
35804 char *cptr = config;
35805 struct console *cons;
35806 + int is_console = 0;
35807
35808 err = kgdboc_option_setup(config);
35809 if (err || !strlen(config) || isspace(config[0]))
35810 goto noconfig;
35811
35812 err = -ENODEV;
35813 - kgdboc_io_ops.is_console = 0;
35814 kgdb_tty_driver = NULL;
35815
35816 kgdboc_use_kms = 0;
35817 @@ -183,7 +186,7 @@ static int configure_kgdboc(void)
35818 int idx;
35819 if (cons->device && cons->device(cons, &idx) == p &&
35820 idx == tty_line) {
35821 - kgdboc_io_ops.is_console = 1;
35822 + is_console = 1;
35823 break;
35824 }
35825 cons = cons->next;
35826 @@ -193,12 +196,16 @@ static int configure_kgdboc(void)
35827 kgdb_tty_line = tty_line;
35828
35829 do_register:
35830 - err = kgdb_register_io_module(&kgdboc_io_ops);
35831 + if (is_console) {
35832 + err = kgdb_register_io_module(&kgdboc_io_ops_console);
35833 + configured = 2;
35834 + } else {
35835 + err = kgdb_register_io_module(&kgdboc_io_ops);
35836 + configured = 1;
35837 + }
35838 if (err)
35839 goto noconfig;
35840
35841 - configured = 1;
35842 -
35843 return 0;
35844
35845 noconfig:
35846 @@ -212,7 +219,7 @@ noconfig:
35847 static int __init init_kgdboc(void)
35848 {
35849 /* Already configured? */
35850 - if (configured == 1)
35851 + if (configured >= 1)
35852 return 0;
35853
35854 return configure_kgdboc();
35855 @@ -261,7 +268,7 @@ static int param_set_kgdboc_var(const ch
35856 if (config[len - 1] == '\n')
35857 config[len - 1] = '\0';
35858
35859 - if (configured == 1)
35860 + if (configured >= 1)
35861 cleanup_kgdboc();
35862
35863 /* Go and configure with the new params. */
35864 @@ -301,6 +308,15 @@ static struct kgdb_io kgdboc_io_ops = {
35865 .post_exception = kgdboc_post_exp_handler,
35866 };
35867
35868 +static struct kgdb_io kgdboc_io_ops_console = {
35869 + .name = "kgdboc",
35870 + .read_char = kgdboc_get_char,
35871 + .write_char = kgdboc_put_char,
35872 + .pre_exception = kgdboc_pre_exp_handler,
35873 + .post_exception = kgdboc_post_exp_handler,
35874 + .is_console = 1
35875 +};
35876 +
35877 #ifdef CONFIG_KGDB_SERIAL_CONSOLE
35878 /* This is only available if kgdboc is a built in for early debugging */
35879 static int __init kgdboc_early_init(char *opt)
35880 diff -urNp linux-3.0.9/drivers/tty/serial/mfd.c linux-3.0.9/drivers/tty/serial/mfd.c
35881 --- linux-3.0.9/drivers/tty/serial/mfd.c 2011-11-11 13:12:24.000000000 -0500
35882 +++ linux-3.0.9/drivers/tty/serial/mfd.c 2011-11-15 20:02:59.000000000 -0500
35883 @@ -1423,7 +1423,7 @@ static void serial_hsu_remove(struct pci
35884 }
35885
35886 /* First 3 are UART ports, and the 4th is the DMA */
35887 -static const struct pci_device_id pci_ids[] __devinitdata = {
35888 +static const struct pci_device_id pci_ids[] __devinitconst = {
35889 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081B) },
35890 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081C) },
35891 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x081D) },
35892 diff -urNp linux-3.0.9/drivers/tty/serial/mrst_max3110.c linux-3.0.9/drivers/tty/serial/mrst_max3110.c
35893 --- linux-3.0.9/drivers/tty/serial/mrst_max3110.c 2011-11-11 13:12:24.000000000 -0500
35894 +++ linux-3.0.9/drivers/tty/serial/mrst_max3110.c 2011-11-15 20:02:59.000000000 -0500
35895 @@ -393,6 +393,8 @@ static void max3110_con_receive(struct u
35896 int loop = 1, num, total = 0;
35897 u8 recv_buf[512], *pbuf;
35898
35899 + pax_track_stack();
35900 +
35901 pbuf = recv_buf;
35902 do {
35903 num = max3110_read_multi(max, pbuf);
35904 diff -urNp linux-3.0.9/drivers/tty/tty_io.c linux-3.0.9/drivers/tty/tty_io.c
35905 --- linux-3.0.9/drivers/tty/tty_io.c 2011-11-11 13:12:24.000000000 -0500
35906 +++ linux-3.0.9/drivers/tty/tty_io.c 2011-11-15 20:02:59.000000000 -0500
35907 @@ -3238,7 +3238,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
35908
35909 void tty_default_fops(struct file_operations *fops)
35910 {
35911 - *fops = tty_fops;
35912 + memcpy((void *)fops, &tty_fops, sizeof(tty_fops));
35913 }
35914
35915 /*
35916 diff -urNp linux-3.0.9/drivers/tty/tty_ldisc.c linux-3.0.9/drivers/tty/tty_ldisc.c
35917 --- linux-3.0.9/drivers/tty/tty_ldisc.c 2011-11-11 13:12:24.000000000 -0500
35918 +++ linux-3.0.9/drivers/tty/tty_ldisc.c 2011-11-15 20:02:59.000000000 -0500
35919 @@ -74,7 +74,7 @@ static void put_ldisc(struct tty_ldisc *
35920 if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
35921 struct tty_ldisc_ops *ldo = ld->ops;
35922
35923 - ldo->refcount--;
35924 + atomic_dec(&ldo->refcount);
35925 module_put(ldo->owner);
35926 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
35927
35928 @@ -109,7 +109,7 @@ int tty_register_ldisc(int disc, struct
35929 spin_lock_irqsave(&tty_ldisc_lock, flags);
35930 tty_ldiscs[disc] = new_ldisc;
35931 new_ldisc->num = disc;
35932 - new_ldisc->refcount = 0;
35933 + atomic_set(&new_ldisc->refcount, 0);
35934 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
35935
35936 return ret;
35937 @@ -137,7 +137,7 @@ int tty_unregister_ldisc(int disc)
35938 return -EINVAL;
35939
35940 spin_lock_irqsave(&tty_ldisc_lock, flags);
35941 - if (tty_ldiscs[disc]->refcount)
35942 + if (atomic_read(&tty_ldiscs[disc]->refcount))
35943 ret = -EBUSY;
35944 else
35945 tty_ldiscs[disc] = NULL;
35946 @@ -158,7 +158,7 @@ static struct tty_ldisc_ops *get_ldops(i
35947 if (ldops) {
35948 ret = ERR_PTR(-EAGAIN);
35949 if (try_module_get(ldops->owner)) {
35950 - ldops->refcount++;
35951 + atomic_inc(&ldops->refcount);
35952 ret = ldops;
35953 }
35954 }
35955 @@ -171,7 +171,7 @@ static void put_ldops(struct tty_ldisc_o
35956 unsigned long flags;
35957
35958 spin_lock_irqsave(&tty_ldisc_lock, flags);
35959 - ldops->refcount--;
35960 + atomic_dec(&ldops->refcount);
35961 module_put(ldops->owner);
35962 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
35963 }
35964 diff -urNp linux-3.0.9/drivers/tty/vt/keyboard.c linux-3.0.9/drivers/tty/vt/keyboard.c
35965 --- linux-3.0.9/drivers/tty/vt/keyboard.c 2011-11-11 13:12:24.000000000 -0500
35966 +++ linux-3.0.9/drivers/tty/vt/keyboard.c 2011-11-15 20:02:59.000000000 -0500
35967 @@ -656,6 +656,16 @@ static void k_spec(struct vc_data *vc, u
35968 kbd->kbdmode == VC_OFF) &&
35969 value != KVAL(K_SAK))
35970 return; /* SAK is allowed even in raw mode */
35971 +
35972 +#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
35973 + {
35974 + void *func = fn_handler[value];
35975 + if (func == fn_show_state || func == fn_show_ptregs ||
35976 + func == fn_show_mem)
35977 + return;
35978 + }
35979 +#endif
35980 +
35981 fn_handler[value](vc);
35982 }
35983
35984 diff -urNp linux-3.0.9/drivers/tty/vt/vt.c linux-3.0.9/drivers/tty/vt/vt.c
35985 --- linux-3.0.9/drivers/tty/vt/vt.c 2011-11-11 13:12:24.000000000 -0500
35986 +++ linux-3.0.9/drivers/tty/vt/vt.c 2011-11-15 20:02:59.000000000 -0500
35987 @@ -259,7 +259,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier
35988
35989 static void notify_write(struct vc_data *vc, unsigned int unicode)
35990 {
35991 - struct vt_notifier_param param = { .vc = vc, unicode = unicode };
35992 + struct vt_notifier_param param = { .vc = vc, .c = unicode };
35993 atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, &param);
35994 }
35995
35996 diff -urNp linux-3.0.9/drivers/tty/vt/vt_ioctl.c linux-3.0.9/drivers/tty/vt/vt_ioctl.c
35997 --- linux-3.0.9/drivers/tty/vt/vt_ioctl.c 2011-11-11 13:12:24.000000000 -0500
35998 +++ linux-3.0.9/drivers/tty/vt/vt_ioctl.c 2011-11-15 20:02:59.000000000 -0500
35999 @@ -207,9 +207,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __
36000 if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
36001 return -EFAULT;
36002
36003 - if (!capable(CAP_SYS_TTY_CONFIG))
36004 - perm = 0;
36005 -
36006 switch (cmd) {
36007 case KDGKBENT:
36008 key_map = key_maps[s];
36009 @@ -221,6 +218,9 @@ do_kdsk_ioctl(int cmd, struct kbentry __
36010 val = (i ? K_HOLE : K_NOSUCHMAP);
36011 return put_user(val, &user_kbe->kb_value);
36012 case KDSKBENT:
36013 + if (!capable(CAP_SYS_TTY_CONFIG))
36014 + perm = 0;
36015 +
36016 if (!perm)
36017 return -EPERM;
36018 if (!i && v == K_NOSUCHMAP) {
36019 @@ -322,9 +322,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
36020 int i, j, k;
36021 int ret;
36022
36023 - if (!capable(CAP_SYS_TTY_CONFIG))
36024 - perm = 0;
36025 -
36026 kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
36027 if (!kbs) {
36028 ret = -ENOMEM;
36029 @@ -358,6 +355,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
36030 kfree(kbs);
36031 return ((p && *p) ? -EOVERFLOW : 0);
36032 case KDSKBSENT:
36033 + if (!capable(CAP_SYS_TTY_CONFIG))
36034 + perm = 0;
36035 +
36036 if (!perm) {
36037 ret = -EPERM;
36038 goto reterr;
36039 diff -urNp linux-3.0.9/drivers/uio/uio.c linux-3.0.9/drivers/uio/uio.c
36040 --- linux-3.0.9/drivers/uio/uio.c 2011-11-11 13:12:24.000000000 -0500
36041 +++ linux-3.0.9/drivers/uio/uio.c 2011-11-15 20:02:59.000000000 -0500
36042 @@ -25,6 +25,7 @@
36043 #include <linux/kobject.h>
36044 #include <linux/cdev.h>
36045 #include <linux/uio_driver.h>
36046 +#include <asm/local.h>
36047
36048 #define UIO_MAX_DEVICES (1U << MINORBITS)
36049
36050 @@ -32,10 +33,10 @@ struct uio_device {
36051 struct module *owner;
36052 struct device *dev;
36053 int minor;
36054 - atomic_t event;
36055 + atomic_unchecked_t event;
36056 struct fasync_struct *async_queue;
36057 wait_queue_head_t wait;
36058 - int vma_count;
36059 + local_t vma_count;
36060 struct uio_info *info;
36061 struct kobject *map_dir;
36062 struct kobject *portio_dir;
36063 @@ -242,7 +243,7 @@ static ssize_t show_event(struct device
36064 struct device_attribute *attr, char *buf)
36065 {
36066 struct uio_device *idev = dev_get_drvdata(dev);
36067 - return sprintf(buf, "%u\n", (unsigned int)atomic_read(&idev->event));
36068 + return sprintf(buf, "%u\n", (unsigned int)atomic_read_unchecked(&idev->event));
36069 }
36070
36071 static struct device_attribute uio_class_attributes[] = {
36072 @@ -408,7 +409,7 @@ void uio_event_notify(struct uio_info *i
36073 {
36074 struct uio_device *idev = info->uio_dev;
36075
36076 - atomic_inc(&idev->event);
36077 + atomic_inc_unchecked(&idev->event);
36078 wake_up_interruptible(&idev->wait);
36079 kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
36080 }
36081 @@ -461,7 +462,7 @@ static int uio_open(struct inode *inode,
36082 }
36083
36084 listener->dev = idev;
36085 - listener->event_count = atomic_read(&idev->event);
36086 + listener->event_count = atomic_read_unchecked(&idev->event);
36087 filep->private_data = listener;
36088
36089 if (idev->info->open) {
36090 @@ -512,7 +513,7 @@ static unsigned int uio_poll(struct file
36091 return -EIO;
36092
36093 poll_wait(filep, &idev->wait, wait);
36094 - if (listener->event_count != atomic_read(&idev->event))
36095 + if (listener->event_count != atomic_read_unchecked(&idev->event))
36096 return POLLIN | POLLRDNORM;
36097 return 0;
36098 }
36099 @@ -537,7 +538,7 @@ static ssize_t uio_read(struct file *fil
36100 do {
36101 set_current_state(TASK_INTERRUPTIBLE);
36102
36103 - event_count = atomic_read(&idev->event);
36104 + event_count = atomic_read_unchecked(&idev->event);
36105 if (event_count != listener->event_count) {
36106 if (copy_to_user(buf, &event_count, count))
36107 retval = -EFAULT;
36108 @@ -606,13 +607,13 @@ static int uio_find_mem_index(struct vm_
36109 static void uio_vma_open(struct vm_area_struct *vma)
36110 {
36111 struct uio_device *idev = vma->vm_private_data;
36112 - idev->vma_count++;
36113 + local_inc(&idev->vma_count);
36114 }
36115
36116 static void uio_vma_close(struct vm_area_struct *vma)
36117 {
36118 struct uio_device *idev = vma->vm_private_data;
36119 - idev->vma_count--;
36120 + local_dec(&idev->vma_count);
36121 }
36122
36123 static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
36124 @@ -823,7 +824,7 @@ int __uio_register_device(struct module
36125 idev->owner = owner;
36126 idev->info = info;
36127 init_waitqueue_head(&idev->wait);
36128 - atomic_set(&idev->event, 0);
36129 + atomic_set_unchecked(&idev->event, 0);
36130
36131 ret = uio_get_minor(idev);
36132 if (ret)
36133 diff -urNp linux-3.0.9/drivers/usb/atm/cxacru.c linux-3.0.9/drivers/usb/atm/cxacru.c
36134 --- linux-3.0.9/drivers/usb/atm/cxacru.c 2011-11-11 13:12:24.000000000 -0500
36135 +++ linux-3.0.9/drivers/usb/atm/cxacru.c 2011-11-15 20:02:59.000000000 -0500
36136 @@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_c
36137 ret = sscanf(buf + pos, "%x=%x%n", &index, &value, &tmp);
36138 if (ret < 2)
36139 return -EINVAL;
36140 - if (index < 0 || index > 0x7f)
36141 + if (index > 0x7f)
36142 return -EINVAL;
36143 pos += tmp;
36144
36145 diff -urNp linux-3.0.9/drivers/usb/atm/usbatm.c linux-3.0.9/drivers/usb/atm/usbatm.c
36146 --- linux-3.0.9/drivers/usb/atm/usbatm.c 2011-11-11 13:12:24.000000000 -0500
36147 +++ linux-3.0.9/drivers/usb/atm/usbatm.c 2011-11-15 20:02:59.000000000 -0500
36148 @@ -332,7 +332,7 @@ static void usbatm_extract_one_cell(stru
36149 if (printk_ratelimit())
36150 atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
36151 __func__, vpi, vci);
36152 - atomic_inc(&vcc->stats->rx_err);
36153 + atomic_inc_unchecked(&vcc->stats->rx_err);
36154 return;
36155 }
36156
36157 @@ -360,7 +360,7 @@ static void usbatm_extract_one_cell(stru
36158 if (length > ATM_MAX_AAL5_PDU) {
36159 atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
36160 __func__, length, vcc);
36161 - atomic_inc(&vcc->stats->rx_err);
36162 + atomic_inc_unchecked(&vcc->stats->rx_err);
36163 goto out;
36164 }
36165
36166 @@ -369,14 +369,14 @@ static void usbatm_extract_one_cell(stru
36167 if (sarb->len < pdu_length) {
36168 atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
36169 __func__, pdu_length, sarb->len, vcc);
36170 - atomic_inc(&vcc->stats->rx_err);
36171 + atomic_inc_unchecked(&vcc->stats->rx_err);
36172 goto out;
36173 }
36174
36175 if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
36176 atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
36177 __func__, vcc);
36178 - atomic_inc(&vcc->stats->rx_err);
36179 + atomic_inc_unchecked(&vcc->stats->rx_err);
36180 goto out;
36181 }
36182
36183 @@ -386,7 +386,7 @@ static void usbatm_extract_one_cell(stru
36184 if (printk_ratelimit())
36185 atm_err(instance, "%s: no memory for skb (length: %u)!\n",
36186 __func__, length);
36187 - atomic_inc(&vcc->stats->rx_drop);
36188 + atomic_inc_unchecked(&vcc->stats->rx_drop);
36189 goto out;
36190 }
36191
36192 @@ -411,7 +411,7 @@ static void usbatm_extract_one_cell(stru
36193
36194 vcc->push(vcc, skb);
36195
36196 - atomic_inc(&vcc->stats->rx);
36197 + atomic_inc_unchecked(&vcc->stats->rx);
36198 out:
36199 skb_trim(sarb, 0);
36200 }
36201 @@ -614,7 +614,7 @@ static void usbatm_tx_process(unsigned l
36202 struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
36203
36204 usbatm_pop(vcc, skb);
36205 - atomic_inc(&vcc->stats->tx);
36206 + atomic_inc_unchecked(&vcc->stats->tx);
36207
36208 skb = skb_dequeue(&instance->sndqueue);
36209 }
36210 @@ -773,11 +773,11 @@ static int usbatm_atm_proc_read(struct a
36211 if (!left--)
36212 return sprintf(page,
36213 "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
36214 - atomic_read(&atm_dev->stats.aal5.tx),
36215 - atomic_read(&atm_dev->stats.aal5.tx_err),
36216 - atomic_read(&atm_dev->stats.aal5.rx),
36217 - atomic_read(&atm_dev->stats.aal5.rx_err),
36218 - atomic_read(&atm_dev->stats.aal5.rx_drop));
36219 + atomic_read_unchecked(&atm_dev->stats.aal5.tx),
36220 + atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
36221 + atomic_read_unchecked(&atm_dev->stats.aal5.rx),
36222 + atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
36223 + atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
36224
36225 if (!left--) {
36226 if (instance->disconnected)
36227 diff -urNp linux-3.0.9/drivers/usb/core/devices.c linux-3.0.9/drivers/usb/core/devices.c
36228 --- linux-3.0.9/drivers/usb/core/devices.c 2011-11-11 13:12:24.000000000 -0500
36229 +++ linux-3.0.9/drivers/usb/core/devices.c 2011-11-15 20:02:59.000000000 -0500
36230 @@ -126,7 +126,7 @@ static const char format_endpt[] =
36231 * time it gets called.
36232 */
36233 static struct device_connect_event {
36234 - atomic_t count;
36235 + atomic_unchecked_t count;
36236 wait_queue_head_t wait;
36237 } device_event = {
36238 .count = ATOMIC_INIT(1),
36239 @@ -164,7 +164,7 @@ static const struct class_info clas_info
36240
36241 void usbfs_conn_disc_event(void)
36242 {
36243 - atomic_add(2, &device_event.count);
36244 + atomic_add_unchecked(2, &device_event.count);
36245 wake_up(&device_event.wait);
36246 }
36247
36248 @@ -648,7 +648,7 @@ static unsigned int usb_device_poll(stru
36249
36250 poll_wait(file, &device_event.wait, wait);
36251
36252 - event_count = atomic_read(&device_event.count);
36253 + event_count = atomic_read_unchecked(&device_event.count);
36254 if (file->f_version != event_count) {
36255 file->f_version = event_count;
36256 return POLLIN | POLLRDNORM;
36257 diff -urNp linux-3.0.9/drivers/usb/core/message.c linux-3.0.9/drivers/usb/core/message.c
36258 --- linux-3.0.9/drivers/usb/core/message.c 2011-11-11 13:12:24.000000000 -0500
36259 +++ linux-3.0.9/drivers/usb/core/message.c 2011-11-15 20:02:59.000000000 -0500
36260 @@ -869,8 +869,8 @@ char *usb_cache_string(struct usb_device
36261 buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
36262 if (buf) {
36263 len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
36264 - if (len > 0) {
36265 - smallbuf = kmalloc(++len, GFP_NOIO);
36266 + if (len++ > 0) {
36267 + smallbuf = kmalloc(len, GFP_NOIO);
36268 if (!smallbuf)
36269 return buf;
36270 memcpy(smallbuf, buf, len);
36271 diff -urNp linux-3.0.9/drivers/usb/early/ehci-dbgp.c linux-3.0.9/drivers/usb/early/ehci-dbgp.c
36272 --- linux-3.0.9/drivers/usb/early/ehci-dbgp.c 2011-11-11 13:12:24.000000000 -0500
36273 +++ linux-3.0.9/drivers/usb/early/ehci-dbgp.c 2011-11-15 20:02:59.000000000 -0500
36274 @@ -97,7 +97,8 @@ static inline u32 dbgp_len_update(u32 x,
36275
36276 #ifdef CONFIG_KGDB
36277 static struct kgdb_io kgdbdbgp_io_ops;
36278 -#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops)
36279 +static struct kgdb_io kgdbdbgp_io_ops_console;
36280 +#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops || dbg_io_ops == &kgdbdbgp_io_ops_console)
36281 #else
36282 #define dbgp_kgdb_mode (0)
36283 #endif
36284 @@ -1035,6 +1036,13 @@ static struct kgdb_io kgdbdbgp_io_ops =
36285 .write_char = kgdbdbgp_write_char,
36286 };
36287
36288 +static struct kgdb_io kgdbdbgp_io_ops_console = {
36289 + .name = "kgdbdbgp",
36290 + .read_char = kgdbdbgp_read_char,
36291 + .write_char = kgdbdbgp_write_char,
36292 + .is_console = 1
36293 +};
36294 +
36295 static int kgdbdbgp_wait_time;
36296
36297 static int __init kgdbdbgp_parse_config(char *str)
36298 @@ -1050,8 +1058,10 @@ static int __init kgdbdbgp_parse_config(
36299 ptr++;
36300 kgdbdbgp_wait_time = simple_strtoul(ptr, &ptr, 10);
36301 }
36302 - kgdb_register_io_module(&kgdbdbgp_io_ops);
36303 - kgdbdbgp_io_ops.is_console = early_dbgp_console.index != -1;
36304 + if (early_dbgp_console.index != -1)
36305 + kgdb_register_io_module(&kgdbdbgp_io_ops_console);
36306 + else
36307 + kgdb_register_io_module(&kgdbdbgp_io_ops);
36308
36309 return 0;
36310 }
36311 diff -urNp linux-3.0.9/drivers/usb/host/xhci-mem.c linux-3.0.9/drivers/usb/host/xhci-mem.c
36312 --- linux-3.0.9/drivers/usb/host/xhci-mem.c 2011-11-11 13:12:24.000000000 -0500
36313 +++ linux-3.0.9/drivers/usb/host/xhci-mem.c 2011-11-15 20:02:59.000000000 -0500
36314 @@ -1690,6 +1690,8 @@ static int xhci_check_trb_in_td_math(str
36315 unsigned int num_tests;
36316 int i, ret;
36317
36318 + pax_track_stack();
36319 +
36320 num_tests = ARRAY_SIZE(simple_test_vector);
36321 for (i = 0; i < num_tests; i++) {
36322 ret = xhci_test_trb_in_td(xhci,
36323 diff -urNp linux-3.0.9/drivers/usb/wusbcore/wa-hc.h linux-3.0.9/drivers/usb/wusbcore/wa-hc.h
36324 --- linux-3.0.9/drivers/usb/wusbcore/wa-hc.h 2011-11-11 13:12:24.000000000 -0500
36325 +++ linux-3.0.9/drivers/usb/wusbcore/wa-hc.h 2011-11-15 20:02:59.000000000 -0500
36326 @@ -192,7 +192,7 @@ struct wahc {
36327 struct list_head xfer_delayed_list;
36328 spinlock_t xfer_list_lock;
36329 struct work_struct xfer_work;
36330 - atomic_t xfer_id_count;
36331 + atomic_unchecked_t xfer_id_count;
36332 };
36333
36334
36335 @@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *
36336 INIT_LIST_HEAD(&wa->xfer_delayed_list);
36337 spin_lock_init(&wa->xfer_list_lock);
36338 INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
36339 - atomic_set(&wa->xfer_id_count, 1);
36340 + atomic_set_unchecked(&wa->xfer_id_count, 1);
36341 }
36342
36343 /**
36344 diff -urNp linux-3.0.9/drivers/usb/wusbcore/wa-xfer.c linux-3.0.9/drivers/usb/wusbcore/wa-xfer.c
36345 --- linux-3.0.9/drivers/usb/wusbcore/wa-xfer.c 2011-11-11 13:12:24.000000000 -0500
36346 +++ linux-3.0.9/drivers/usb/wusbcore/wa-xfer.c 2011-11-15 20:02:59.000000000 -0500
36347 @@ -294,7 +294,7 @@ out:
36348 */
36349 static void wa_xfer_id_init(struct wa_xfer *xfer)
36350 {
36351 - xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
36352 + xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
36353 }
36354
36355 /*
36356 diff -urNp linux-3.0.9/drivers/vhost/vhost.c linux-3.0.9/drivers/vhost/vhost.c
36357 --- linux-3.0.9/drivers/vhost/vhost.c 2011-11-11 13:12:24.000000000 -0500
36358 +++ linux-3.0.9/drivers/vhost/vhost.c 2011-11-15 20:02:59.000000000 -0500
36359 @@ -589,7 +589,7 @@ static int init_used(struct vhost_virtqu
36360 return get_user(vq->last_used_idx, &used->idx);
36361 }
36362
36363 -static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
36364 +static long vhost_set_vring(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
36365 {
36366 struct file *eventfp, *filep = NULL,
36367 *pollstart = NULL, *pollstop = NULL;
36368 diff -urNp linux-3.0.9/drivers/video/aty/aty128fb.c linux-3.0.9/drivers/video/aty/aty128fb.c
36369 --- linux-3.0.9/drivers/video/aty/aty128fb.c 2011-11-11 13:12:24.000000000 -0500
36370 +++ linux-3.0.9/drivers/video/aty/aty128fb.c 2011-11-15 20:02:59.000000000 -0500
36371 @@ -148,7 +148,7 @@ enum {
36372 };
36373
36374 /* Must match above enum */
36375 -static const char *r128_family[] __devinitdata = {
36376 +static const char *r128_family[] __devinitconst = {
36377 "AGP",
36378 "PCI",
36379 "PRO AGP",
36380 diff -urNp linux-3.0.9/drivers/video/fbcmap.c linux-3.0.9/drivers/video/fbcmap.c
36381 --- linux-3.0.9/drivers/video/fbcmap.c 2011-11-11 13:12:24.000000000 -0500
36382 +++ linux-3.0.9/drivers/video/fbcmap.c 2011-11-15 20:02:59.000000000 -0500
36383 @@ -285,8 +285,7 @@ int fb_set_user_cmap(struct fb_cmap_user
36384 rc = -ENODEV;
36385 goto out;
36386 }
36387 - if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
36388 - !info->fbops->fb_setcmap)) {
36389 + if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
36390 rc = -EINVAL;
36391 goto out1;
36392 }
36393 diff -urNp linux-3.0.9/drivers/video/fbmem.c linux-3.0.9/drivers/video/fbmem.c
36394 --- linux-3.0.9/drivers/video/fbmem.c 2011-11-11 13:12:24.000000000 -0500
36395 +++ linux-3.0.9/drivers/video/fbmem.c 2011-11-15 20:02:59.000000000 -0500
36396 @@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_in
36397 image->dx += image->width + 8;
36398 }
36399 } else if (rotate == FB_ROTATE_UD) {
36400 - for (x = 0; x < num && image->dx >= 0; x++) {
36401 + for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
36402 info->fbops->fb_imageblit(info, image);
36403 image->dx -= image->width + 8;
36404 }
36405 @@ -440,7 +440,7 @@ static void fb_do_show_logo(struct fb_in
36406 image->dy += image->height + 8;
36407 }
36408 } else if (rotate == FB_ROTATE_CCW) {
36409 - for (x = 0; x < num && image->dy >= 0; x++) {
36410 + for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
36411 info->fbops->fb_imageblit(info, image);
36412 image->dy -= image->height + 8;
36413 }
36414 @@ -939,6 +939,8 @@ fb_set_var(struct fb_info *info, struct
36415 int flags = info->flags;
36416 int ret = 0;
36417
36418 + pax_track_stack();
36419 +
36420 if (var->activate & FB_ACTIVATE_INV_MODE) {
36421 struct fb_videomode mode1, mode2;
36422
36423 @@ -1064,6 +1066,8 @@ static long do_fb_ioctl(struct fb_info *
36424 void __user *argp = (void __user *)arg;
36425 long ret = 0;
36426
36427 + pax_track_stack();
36428 +
36429 switch (cmd) {
36430 case FBIOGET_VSCREENINFO:
36431 if (!lock_fb_info(info))
36432 @@ -1143,7 +1147,7 @@ static long do_fb_ioctl(struct fb_info *
36433 return -EFAULT;
36434 if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
36435 return -EINVAL;
36436 - if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
36437 + if (con2fb.framebuffer >= FB_MAX)
36438 return -EINVAL;
36439 if (!registered_fb[con2fb.framebuffer])
36440 request_module("fb%d", con2fb.framebuffer);
36441 diff -urNp linux-3.0.9/drivers/video/geode/gx1fb_core.c linux-3.0.9/drivers/video/geode/gx1fb_core.c
36442 --- linux-3.0.9/drivers/video/geode/gx1fb_core.c 2011-11-11 13:12:24.000000000 -0500
36443 +++ linux-3.0.9/drivers/video/geode/gx1fb_core.c 2011-11-15 20:02:59.000000000 -0500
36444 @@ -29,7 +29,7 @@ static int crt_option = 1;
36445 static char panel_option[32] = "";
36446
36447 /* Modes relevant to the GX1 (taken from modedb.c) */
36448 -static const struct fb_videomode __devinitdata gx1_modedb[] = {
36449 +static const struct fb_videomode __devinitconst gx1_modedb[] = {
36450 /* 640x480-60 VESA */
36451 { NULL, 60, 640, 480, 39682, 48, 16, 33, 10, 96, 2,
36452 0, FB_VMODE_NONINTERLACED, FB_MODE_IS_VESA },
36453 diff -urNp linux-3.0.9/drivers/video/gxt4500.c linux-3.0.9/drivers/video/gxt4500.c
36454 --- linux-3.0.9/drivers/video/gxt4500.c 2011-11-11 13:12:24.000000000 -0500
36455 +++ linux-3.0.9/drivers/video/gxt4500.c 2011-11-15 20:02:59.000000000 -0500
36456 @@ -156,7 +156,7 @@ struct gxt4500_par {
36457 static char *mode_option;
36458
36459 /* default mode: 1280x1024 @ 60 Hz, 8 bpp */
36460 -static const struct fb_videomode defaultmode __devinitdata = {
36461 +static const struct fb_videomode defaultmode __devinitconst = {
36462 .refresh = 60,
36463 .xres = 1280,
36464 .yres = 1024,
36465 @@ -581,7 +581,7 @@ static int gxt4500_blank(int blank, stru
36466 return 0;
36467 }
36468
36469 -static const struct fb_fix_screeninfo gxt4500_fix __devinitdata = {
36470 +static const struct fb_fix_screeninfo gxt4500_fix __devinitconst = {
36471 .id = "IBM GXT4500P",
36472 .type = FB_TYPE_PACKED_PIXELS,
36473 .visual = FB_VISUAL_PSEUDOCOLOR,
36474 diff -urNp linux-3.0.9/drivers/video/i810/i810_accel.c linux-3.0.9/drivers/video/i810/i810_accel.c
36475 --- linux-3.0.9/drivers/video/i810/i810_accel.c 2011-11-11 13:12:24.000000000 -0500
36476 +++ linux-3.0.9/drivers/video/i810/i810_accel.c 2011-11-15 20:02:59.000000000 -0500
36477 @@ -73,6 +73,7 @@ static inline int wait_for_space(struct
36478 }
36479 }
36480 printk("ringbuffer lockup!!!\n");
36481 + printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
36482 i810_report_error(mmio);
36483 par->dev_flags |= LOCKUP;
36484 info->pixmap.scan_align = 1;
36485 diff -urNp linux-3.0.9/drivers/video/i810/i810_main.c linux-3.0.9/drivers/video/i810/i810_main.c
36486 --- linux-3.0.9/drivers/video/i810/i810_main.c 2011-11-11 13:12:24.000000000 -0500
36487 +++ linux-3.0.9/drivers/video/i810/i810_main.c 2011-11-15 20:02:59.000000000 -0500
36488 @@ -97,7 +97,7 @@ static int i810fb_blank (int blank_
36489 static void i810fb_release_resource (struct fb_info *info, struct i810fb_par *par);
36490
36491 /* PCI */
36492 -static const char *i810_pci_list[] __devinitdata = {
36493 +static const char *i810_pci_list[] __devinitconst = {
36494 "Intel(R) 810 Framebuffer Device" ,
36495 "Intel(R) 810-DC100 Framebuffer Device" ,
36496 "Intel(R) 810E Framebuffer Device" ,
36497 diff -urNp linux-3.0.9/drivers/video/jz4740_fb.c linux-3.0.9/drivers/video/jz4740_fb.c
36498 --- linux-3.0.9/drivers/video/jz4740_fb.c 2011-11-11 13:12:24.000000000 -0500
36499 +++ linux-3.0.9/drivers/video/jz4740_fb.c 2011-11-15 20:02:59.000000000 -0500
36500 @@ -136,7 +136,7 @@ struct jzfb {
36501 uint32_t pseudo_palette[16];
36502 };
36503
36504 -static const struct fb_fix_screeninfo jzfb_fix __devinitdata = {
36505 +static const struct fb_fix_screeninfo jzfb_fix __devinitconst = {
36506 .id = "JZ4740 FB",
36507 .type = FB_TYPE_PACKED_PIXELS,
36508 .visual = FB_VISUAL_TRUECOLOR,
36509 diff -urNp linux-3.0.9/drivers/video/logo/logo_linux_clut224.ppm linux-3.0.9/drivers/video/logo/logo_linux_clut224.ppm
36510 --- linux-3.0.9/drivers/video/logo/logo_linux_clut224.ppm 2011-11-11 13:12:24.000000000 -0500
36511 +++ linux-3.0.9/drivers/video/logo/logo_linux_clut224.ppm 2011-11-15 20:02:59.000000000 -0500
36512 @@ -1,1604 +1,1123 @@
36513 P3
36514 -# Standard 224-color Linux logo
36515 80 80
36516 255
36517 - 0 0 0 0 0 0 0 0 0 0 0 0
36518 - 0 0 0 0 0 0 0 0 0 0 0 0
36519 - 0 0 0 0 0 0 0 0 0 0 0 0
36520 - 0 0 0 0 0 0 0 0 0 0 0 0
36521 - 0 0 0 0 0 0 0 0 0 0 0 0
36522 - 0 0 0 0 0 0 0 0 0 0 0 0
36523 - 0 0 0 0 0 0 0 0 0 0 0 0
36524 - 0 0 0 0 0 0 0 0 0 0 0 0
36525 - 0 0 0 0 0 0 0 0 0 0 0 0
36526 - 6 6 6 6 6 6 10 10 10 10 10 10
36527 - 10 10 10 6 6 6 6 6 6 6 6 6
36528 - 0 0 0 0 0 0 0 0 0 0 0 0
36529 - 0 0 0 0 0 0 0 0 0 0 0 0
36530 - 0 0 0 0 0 0 0 0 0 0 0 0
36531 - 0 0 0 0 0 0 0 0 0 0 0 0
36532 - 0 0 0 0 0 0 0 0 0 0 0 0
36533 - 0 0 0 0 0 0 0 0 0 0 0 0
36534 - 0 0 0 0 0 0 0 0 0 0 0 0
36535 - 0 0 0 0 0 0 0 0 0 0 0 0
36536 - 0 0 0 0 0 0 0 0 0 0 0 0
36537 - 0 0 0 0 0 0 0 0 0 0 0 0
36538 - 0 0 0 0 0 0 0 0 0 0 0 0
36539 - 0 0 0 0 0 0 0 0 0 0 0 0
36540 - 0 0 0 0 0 0 0 0 0 0 0 0
36541 - 0 0 0 0 0 0 0 0 0 0 0 0
36542 - 0 0 0 0 0 0 0 0 0 0 0 0
36543 - 0 0 0 0 0 0 0 0 0 0 0 0
36544 - 0 0 0 0 0 0 0 0 0 0 0 0
36545 - 0 0 0 6 6 6 10 10 10 14 14 14
36546 - 22 22 22 26 26 26 30 30 30 34 34 34
36547 - 30 30 30 30 30 30 26 26 26 18 18 18
36548 - 14 14 14 10 10 10 6 6 6 0 0 0
36549 - 0 0 0 0 0 0 0 0 0 0 0 0
36550 - 0 0 0 0 0 0 0 0 0 0 0 0
36551 - 0 0 0 0 0 0 0 0 0 0 0 0
36552 - 0 0 0 0 0 0 0 0 0 0 0 0
36553 - 0 0 0 0 0 0 0 0 0 0 0 0
36554 - 0 0 0 0 0 0 0 0 0 0 0 0
36555 - 0 0 0 0 0 0 0 0 0 0 0 0
36556 - 0 0 0 0 0 0 0 0 0 0 0 0
36557 - 0 0 0 0 0 0 0 0 0 0 0 0
36558 - 0 0 0 0 0 1 0 0 1 0 0 0
36559 - 0 0 0 0 0 0 0 0 0 0 0 0
36560 - 0 0 0 0 0 0 0 0 0 0 0 0
36561 - 0 0 0 0 0 0 0 0 0 0 0 0
36562 - 0 0 0 0 0 0 0 0 0 0 0 0
36563 - 0 0 0 0 0 0 0 0 0 0 0 0
36564 - 0 0 0 0 0 0 0 0 0 0 0 0
36565 - 6 6 6 14 14 14 26 26 26 42 42 42
36566 - 54 54 54 66 66 66 78 78 78 78 78 78
36567 - 78 78 78 74 74 74 66 66 66 54 54 54
36568 - 42 42 42 26 26 26 18 18 18 10 10 10
36569 - 6 6 6 0 0 0 0 0 0 0 0 0
36570 - 0 0 0 0 0 0 0 0 0 0 0 0
36571 - 0 0 0 0 0 0 0 0 0 0 0 0
36572 - 0 0 0 0 0 0 0 0 0 0 0 0
36573 - 0 0 0 0 0 0 0 0 0 0 0 0
36574 - 0 0 0 0 0 0 0 0 0 0 0 0
36575 - 0 0 0 0 0 0 0 0 0 0 0 0
36576 - 0 0 0 0 0 0 0 0 0 0 0 0
36577 - 0 0 0 0 0 0 0 0 0 0 0 0
36578 - 0 0 1 0 0 0 0 0 0 0 0 0
36579 - 0 0 0 0 0 0 0 0 0 0 0 0
36580 - 0 0 0 0 0 0 0 0 0 0 0 0
36581 - 0 0 0 0 0 0 0 0 0 0 0 0
36582 - 0 0 0 0 0 0 0 0 0 0 0 0
36583 - 0 0 0 0 0 0 0 0 0 0 0 0
36584 - 0 0 0 0 0 0 0 0 0 10 10 10
36585 - 22 22 22 42 42 42 66 66 66 86 86 86
36586 - 66 66 66 38 38 38 38 38 38 22 22 22
36587 - 26 26 26 34 34 34 54 54 54 66 66 66
36588 - 86 86 86 70 70 70 46 46 46 26 26 26
36589 - 14 14 14 6 6 6 0 0 0 0 0 0
36590 - 0 0 0 0 0 0 0 0 0 0 0 0
36591 - 0 0 0 0 0 0 0 0 0 0 0 0
36592 - 0 0 0 0 0 0 0 0 0 0 0 0
36593 - 0 0 0 0 0 0 0 0 0 0 0 0
36594 - 0 0 0 0 0 0 0 0 0 0 0 0
36595 - 0 0 0 0 0 0 0 0 0 0 0 0
36596 - 0 0 0 0 0 0 0 0 0 0 0 0
36597 - 0 0 0 0 0 0 0 0 0 0 0 0
36598 - 0 0 1 0 0 1 0 0 1 0 0 0
36599 - 0 0 0 0 0 0 0 0 0 0 0 0
36600 - 0 0 0 0 0 0 0 0 0 0 0 0
36601 - 0 0 0 0 0 0 0 0 0 0 0 0
36602 - 0 0 0 0 0 0 0 0 0 0 0 0
36603 - 0 0 0 0 0 0 0 0 0 0 0 0
36604 - 0 0 0 0 0 0 10 10 10 26 26 26
36605 - 50 50 50 82 82 82 58 58 58 6 6 6
36606 - 2 2 6 2 2 6 2 2 6 2 2 6
36607 - 2 2 6 2 2 6 2 2 6 2 2 6
36608 - 6 6 6 54 54 54 86 86 86 66 66 66
36609 - 38 38 38 18 18 18 6 6 6 0 0 0
36610 - 0 0 0 0 0 0 0 0 0 0 0 0
36611 - 0 0 0 0 0 0 0 0 0 0 0 0
36612 - 0 0 0 0 0 0 0 0 0 0 0 0
36613 - 0 0 0 0 0 0 0 0 0 0 0 0
36614 - 0 0 0 0 0 0 0 0 0 0 0 0
36615 - 0 0 0 0 0 0 0 0 0 0 0 0
36616 - 0 0 0 0 0 0 0 0 0 0 0 0
36617 - 0 0 0 0 0 0 0 0 0 0 0 0
36618 - 0 0 0 0 0 0 0 0 0 0 0 0
36619 - 0 0 0 0 0 0 0 0 0 0 0 0
36620 - 0 0 0 0 0 0 0 0 0 0 0 0
36621 - 0 0 0 0 0 0 0 0 0 0 0 0
36622 - 0 0 0 0 0 0 0 0 0 0 0 0
36623 - 0 0 0 0 0 0 0 0 0 0 0 0
36624 - 0 0 0 6 6 6 22 22 22 50 50 50
36625 - 78 78 78 34 34 34 2 2 6 2 2 6
36626 - 2 2 6 2 2 6 2 2 6 2 2 6
36627 - 2 2 6 2 2 6 2 2 6 2 2 6
36628 - 2 2 6 2 2 6 6 6 6 70 70 70
36629 - 78 78 78 46 46 46 22 22 22 6 6 6
36630 - 0 0 0 0 0 0 0 0 0 0 0 0
36631 - 0 0 0 0 0 0 0 0 0 0 0 0
36632 - 0 0 0 0 0 0 0 0 0 0 0 0
36633 - 0 0 0 0 0 0 0 0 0 0 0 0
36634 - 0 0 0 0 0 0 0 0 0 0 0 0
36635 - 0 0 0 0 0 0 0 0 0 0 0 0
36636 - 0 0 0 0 0 0 0 0 0 0 0 0
36637 - 0 0 0 0 0 0 0 0 0 0 0 0
36638 - 0 0 1 0 0 1 0 0 1 0 0 0
36639 - 0 0 0 0 0 0 0 0 0 0 0 0
36640 - 0 0 0 0 0 0 0 0 0 0 0 0
36641 - 0 0 0 0 0 0 0 0 0 0 0 0
36642 - 0 0 0 0 0 0 0 0 0 0 0 0
36643 - 0 0 0 0 0 0 0 0 0 0 0 0
36644 - 6 6 6 18 18 18 42 42 42 82 82 82
36645 - 26 26 26 2 2 6 2 2 6 2 2 6
36646 - 2 2 6 2 2 6 2 2 6 2 2 6
36647 - 2 2 6 2 2 6 2 2 6 14 14 14
36648 - 46 46 46 34 34 34 6 6 6 2 2 6
36649 - 42 42 42 78 78 78 42 42 42 18 18 18
36650 - 6 6 6 0 0 0 0 0 0 0 0 0
36651 - 0 0 0 0 0 0 0 0 0 0 0 0
36652 - 0 0 0 0 0 0 0 0 0 0 0 0
36653 - 0 0 0 0 0 0 0 0 0 0 0 0
36654 - 0 0 0 0 0 0 0 0 0 0 0 0
36655 - 0 0 0 0 0 0 0 0 0 0 0 0
36656 - 0 0 0 0 0 0 0 0 0 0 0 0
36657 - 0 0 0 0 0 0 0 0 0 0 0 0
36658 - 0 0 1 0 0 0 0 0 1 0 0 0
36659 - 0 0 0 0 0 0 0 0 0 0 0 0
36660 - 0 0 0 0 0 0 0 0 0 0 0 0
36661 - 0 0 0 0 0 0 0 0 0 0 0 0
36662 - 0 0 0 0 0 0 0 0 0 0 0 0
36663 - 0 0 0 0 0 0 0 0 0 0 0 0
36664 - 10 10 10 30 30 30 66 66 66 58 58 58
36665 - 2 2 6 2 2 6 2 2 6 2 2 6
36666 - 2 2 6 2 2 6 2 2 6 2 2 6
36667 - 2 2 6 2 2 6 2 2 6 26 26 26
36668 - 86 86 86 101 101 101 46 46 46 10 10 10
36669 - 2 2 6 58 58 58 70 70 70 34 34 34
36670 - 10 10 10 0 0 0 0 0 0 0 0 0
36671 - 0 0 0 0 0 0 0 0 0 0 0 0
36672 - 0 0 0 0 0 0 0 0 0 0 0 0
36673 - 0 0 0 0 0 0 0 0 0 0 0 0
36674 - 0 0 0 0 0 0 0 0 0 0 0 0
36675 - 0 0 0 0 0 0 0 0 0 0 0 0
36676 - 0 0 0 0 0 0 0 0 0 0 0 0
36677 - 0 0 0 0 0 0 0 0 0 0 0 0
36678 - 0 0 1 0 0 1 0 0 1 0 0 0
36679 - 0 0 0 0 0 0 0 0 0 0 0 0
36680 - 0 0 0 0 0 0 0 0 0 0 0 0
36681 - 0 0 0 0 0 0 0 0 0 0 0 0
36682 - 0 0 0 0 0 0 0 0 0 0 0 0
36683 - 0 0 0 0 0 0 0 0 0 0 0 0
36684 - 14 14 14 42 42 42 86 86 86 10 10 10
36685 - 2 2 6 2 2 6 2 2 6 2 2 6
36686 - 2 2 6 2 2 6 2 2 6 2 2 6
36687 - 2 2 6 2 2 6 2 2 6 30 30 30
36688 - 94 94 94 94 94 94 58 58 58 26 26 26
36689 - 2 2 6 6 6 6 78 78 78 54 54 54
36690 - 22 22 22 6 6 6 0 0 0 0 0 0
36691 - 0 0 0 0 0 0 0 0 0 0 0 0
36692 - 0 0 0 0 0 0 0 0 0 0 0 0
36693 - 0 0 0 0 0 0 0 0 0 0 0 0
36694 - 0 0 0 0 0 0 0 0 0 0 0 0
36695 - 0 0 0 0 0 0 0 0 0 0 0 0
36696 - 0 0 0 0 0 0 0 0 0 0 0 0
36697 - 0 0 0 0 0 0 0 0 0 0 0 0
36698 - 0 0 0 0 0 0 0 0 0 0 0 0
36699 - 0 0 0 0 0 0 0 0 0 0 0 0
36700 - 0 0 0 0 0 0 0 0 0 0 0 0
36701 - 0 0 0 0 0 0 0 0 0 0 0 0
36702 - 0 0 0 0 0 0 0 0 0 0 0 0
36703 - 0 0 0 0 0 0 0 0 0 6 6 6
36704 - 22 22 22 62 62 62 62 62 62 2 2 6
36705 - 2 2 6 2 2 6 2 2 6 2 2 6
36706 - 2 2 6 2 2 6 2 2 6 2 2 6
36707 - 2 2 6 2 2 6 2 2 6 26 26 26
36708 - 54 54 54 38 38 38 18 18 18 10 10 10
36709 - 2 2 6 2 2 6 34 34 34 82 82 82
36710 - 38 38 38 14 14 14 0 0 0 0 0 0
36711 - 0 0 0 0 0 0 0 0 0 0 0 0
36712 - 0 0 0 0 0 0 0 0 0 0 0 0
36713 - 0 0 0 0 0 0 0 0 0 0 0 0
36714 - 0 0 0 0 0 0 0 0 0 0 0 0
36715 - 0 0 0 0 0 0 0 0 0 0 0 0
36716 - 0 0 0 0 0 0 0 0 0 0 0 0
36717 - 0 0 0 0 0 0 0 0 0 0 0 0
36718 - 0 0 0 0 0 1 0 0 1 0 0 0
36719 - 0 0 0 0 0 0 0 0 0 0 0 0
36720 - 0 0 0 0 0 0 0 0 0 0 0 0
36721 - 0 0 0 0 0 0 0 0 0 0 0 0
36722 - 0 0 0 0 0 0 0 0 0 0 0 0
36723 - 0 0 0 0 0 0 0 0 0 6 6 6
36724 - 30 30 30 78 78 78 30 30 30 2 2 6
36725 - 2 2 6 2 2 6 2 2 6 2 2 6
36726 - 2 2 6 2 2 6 2 2 6 2 2 6
36727 - 2 2 6 2 2 6 2 2 6 10 10 10
36728 - 10 10 10 2 2 6 2 2 6 2 2 6
36729 - 2 2 6 2 2 6 2 2 6 78 78 78
36730 - 50 50 50 18 18 18 6 6 6 0 0 0
36731 - 0 0 0 0 0 0 0 0 0 0 0 0
36732 - 0 0 0 0 0 0 0 0 0 0 0 0
36733 - 0 0 0 0 0 0 0 0 0 0 0 0
36734 - 0 0 0 0 0 0 0 0 0 0 0 0
36735 - 0 0 0 0 0 0 0 0 0 0 0 0
36736 - 0 0 0 0 0 0 0 0 0 0 0 0
36737 - 0 0 0 0 0 0 0 0 0 0 0 0
36738 - 0 0 1 0 0 0 0 0 0 0 0 0
36739 - 0 0 0 0 0 0 0 0 0 0 0 0
36740 - 0 0 0 0 0 0 0 0 0 0 0 0
36741 - 0 0 0 0 0 0 0 0 0 0 0 0
36742 - 0 0 0 0 0 0 0 0 0 0 0 0
36743 - 0 0 0 0 0 0 0 0 0 10 10 10
36744 - 38 38 38 86 86 86 14 14 14 2 2 6
36745 - 2 2 6 2 2 6 2 2 6 2 2 6
36746 - 2 2 6 2 2 6 2 2 6 2 2 6
36747 - 2 2 6 2 2 6 2 2 6 2 2 6
36748 - 2 2 6 2 2 6 2 2 6 2 2 6
36749 - 2 2 6 2 2 6 2 2 6 54 54 54
36750 - 66 66 66 26 26 26 6 6 6 0 0 0
36751 - 0 0 0 0 0 0 0 0 0 0 0 0
36752 - 0 0 0 0 0 0 0 0 0 0 0 0
36753 - 0 0 0 0 0 0 0 0 0 0 0 0
36754 - 0 0 0 0 0 0 0 0 0 0 0 0
36755 - 0 0 0 0 0 0 0 0 0 0 0 0
36756 - 0 0 0 0 0 0 0 0 0 0 0 0
36757 - 0 0 0 0 0 0 0 0 0 0 0 0
36758 - 0 0 0 0 0 1 0 0 1 0 0 0
36759 - 0 0 0 0 0 0 0 0 0 0 0 0
36760 - 0 0 0 0 0 0 0 0 0 0 0 0
36761 - 0 0 0 0 0 0 0 0 0 0 0 0
36762 - 0 0 0 0 0 0 0 0 0 0 0 0
36763 - 0 0 0 0 0 0 0 0 0 14 14 14
36764 - 42 42 42 82 82 82 2 2 6 2 2 6
36765 - 2 2 6 6 6 6 10 10 10 2 2 6
36766 - 2 2 6 2 2 6 2 2 6 2 2 6
36767 - 2 2 6 2 2 6 2 2 6 6 6 6
36768 - 14 14 14 10 10 10 2 2 6 2 2 6
36769 - 2 2 6 2 2 6 2 2 6 18 18 18
36770 - 82 82 82 34 34 34 10 10 10 0 0 0
36771 - 0 0 0 0 0 0 0 0 0 0 0 0
36772 - 0 0 0 0 0 0 0 0 0 0 0 0
36773 - 0 0 0 0 0 0 0 0 0 0 0 0
36774 - 0 0 0 0 0 0 0 0 0 0 0 0
36775 - 0 0 0 0 0 0 0 0 0 0 0 0
36776 - 0 0 0 0 0 0 0 0 0 0 0 0
36777 - 0 0 0 0 0 0 0 0 0 0 0 0
36778 - 0 0 1 0 0 0 0 0 0 0 0 0
36779 - 0 0 0 0 0 0 0 0 0 0 0 0
36780 - 0 0 0 0 0 0 0 0 0 0 0 0
36781 - 0 0 0 0 0 0 0 0 0 0 0 0
36782 - 0 0 0 0 0 0 0 0 0 0 0 0
36783 - 0 0 0 0 0 0 0 0 0 14 14 14
36784 - 46 46 46 86 86 86 2 2 6 2 2 6
36785 - 6 6 6 6 6 6 22 22 22 34 34 34
36786 - 6 6 6 2 2 6 2 2 6 2 2 6
36787 - 2 2 6 2 2 6 18 18 18 34 34 34
36788 - 10 10 10 50 50 50 22 22 22 2 2 6
36789 - 2 2 6 2 2 6 2 2 6 10 10 10
36790 - 86 86 86 42 42 42 14 14 14 0 0 0
36791 - 0 0 0 0 0 0 0 0 0 0 0 0
36792 - 0 0 0 0 0 0 0 0 0 0 0 0
36793 - 0 0 0 0 0 0 0 0 0 0 0 0
36794 - 0 0 0 0 0 0 0 0 0 0 0 0
36795 - 0 0 0 0 0 0 0 0 0 0 0 0
36796 - 0 0 0 0 0 0 0 0 0 0 0 0
36797 - 0 0 0 0 0 0 0 0 0 0 0 0
36798 - 0 0 1 0 0 1 0 0 1 0 0 0
36799 - 0 0 0 0 0 0 0 0 0 0 0 0
36800 - 0 0 0 0 0 0 0 0 0 0 0 0
36801 - 0 0 0 0 0 0 0 0 0 0 0 0
36802 - 0 0 0 0 0 0 0 0 0 0 0 0
36803 - 0 0 0 0 0 0 0 0 0 14 14 14
36804 - 46 46 46 86 86 86 2 2 6 2 2 6
36805 - 38 38 38 116 116 116 94 94 94 22 22 22
36806 - 22 22 22 2 2 6 2 2 6 2 2 6
36807 - 14 14 14 86 86 86 138 138 138 162 162 162
36808 -154 154 154 38 38 38 26 26 26 6 6 6
36809 - 2 2 6 2 2 6 2 2 6 2 2 6
36810 - 86 86 86 46 46 46 14 14 14 0 0 0
36811 - 0 0 0 0 0 0 0 0 0 0 0 0
36812 - 0 0 0 0 0 0 0 0 0 0 0 0
36813 - 0 0 0 0 0 0 0 0 0 0 0 0
36814 - 0 0 0 0 0 0 0 0 0 0 0 0
36815 - 0 0 0 0 0 0 0 0 0 0 0 0
36816 - 0 0 0 0 0 0 0 0 0 0 0 0
36817 - 0 0 0 0 0 0 0 0 0 0 0 0
36818 - 0 0 0 0 0 0 0 0 0 0 0 0
36819 - 0 0 0 0 0 0 0 0 0 0 0 0
36820 - 0 0 0 0 0 0 0 0 0 0 0 0
36821 - 0 0 0 0 0 0 0 0 0 0 0 0
36822 - 0 0 0 0 0 0 0 0 0 0 0 0
36823 - 0 0 0 0 0 0 0 0 0 14 14 14
36824 - 46 46 46 86 86 86 2 2 6 14 14 14
36825 -134 134 134 198 198 198 195 195 195 116 116 116
36826 - 10 10 10 2 2 6 2 2 6 6 6 6
36827 -101 98 89 187 187 187 210 210 210 218 218 218
36828 -214 214 214 134 134 134 14 14 14 6 6 6
36829 - 2 2 6 2 2 6 2 2 6 2 2 6
36830 - 86 86 86 50 50 50 18 18 18 6 6 6
36831 - 0 0 0 0 0 0 0 0 0 0 0 0
36832 - 0 0 0 0 0 0 0 0 0 0 0 0
36833 - 0 0 0 0 0 0 0 0 0 0 0 0
36834 - 0 0 0 0 0 0 0 0 0 0 0 0
36835 - 0 0 0 0 0 0 0 0 0 0 0 0
36836 - 0 0 0 0 0 0 0 0 0 0 0 0
36837 - 0 0 0 0 0 0 0 0 1 0 0 0
36838 - 0 0 1 0 0 1 0 0 1 0 0 0
36839 - 0 0 0 0 0 0 0 0 0 0 0 0
36840 - 0 0 0 0 0 0 0 0 0 0 0 0
36841 - 0 0 0 0 0 0 0 0 0 0 0 0
36842 - 0 0 0 0 0 0 0 0 0 0 0 0
36843 - 0 0 0 0 0 0 0 0 0 14 14 14
36844 - 46 46 46 86 86 86 2 2 6 54 54 54
36845 -218 218 218 195 195 195 226 226 226 246 246 246
36846 - 58 58 58 2 2 6 2 2 6 30 30 30
36847 -210 210 210 253 253 253 174 174 174 123 123 123
36848 -221 221 221 234 234 234 74 74 74 2 2 6
36849 - 2 2 6 2 2 6 2 2 6 2 2 6
36850 - 70 70 70 58 58 58 22 22 22 6 6 6
36851 - 0 0 0 0 0 0 0 0 0 0 0 0
36852 - 0 0 0 0 0 0 0 0 0 0 0 0
36853 - 0 0 0 0 0 0 0 0 0 0 0 0
36854 - 0 0 0 0 0 0 0 0 0 0 0 0
36855 - 0 0 0 0 0 0 0 0 0 0 0 0
36856 - 0 0 0 0 0 0 0 0 0 0 0 0
36857 - 0 0 0 0 0 0 0 0 0 0 0 0
36858 - 0 0 0 0 0 0 0 0 0 0 0 0
36859 - 0 0 0 0 0 0 0 0 0 0 0 0
36860 - 0 0 0 0 0 0 0 0 0 0 0 0
36861 - 0 0 0 0 0 0 0 0 0 0 0 0
36862 - 0 0 0 0 0 0 0 0 0 0 0 0
36863 - 0 0 0 0 0 0 0 0 0 14 14 14
36864 - 46 46 46 82 82 82 2 2 6 106 106 106
36865 -170 170 170 26 26 26 86 86 86 226 226 226
36866 -123 123 123 10 10 10 14 14 14 46 46 46
36867 -231 231 231 190 190 190 6 6 6 70 70 70
36868 - 90 90 90 238 238 238 158 158 158 2 2 6
36869 - 2 2 6 2 2 6 2 2 6 2 2 6
36870 - 70 70 70 58 58 58 22 22 22 6 6 6
36871 - 0 0 0 0 0 0 0 0 0 0 0 0
36872 - 0 0 0 0 0 0 0 0 0 0 0 0
36873 - 0 0 0 0 0 0 0 0 0 0 0 0
36874 - 0 0 0 0 0 0 0 0 0 0 0 0
36875 - 0 0 0 0 0 0 0 0 0 0 0 0
36876 - 0 0 0 0 0 0 0 0 0 0 0 0
36877 - 0 0 0 0 0 0 0 0 1 0 0 0
36878 - 0 0 1 0 0 1 0 0 1 0 0 0
36879 - 0 0 0 0 0 0 0 0 0 0 0 0
36880 - 0 0 0 0 0 0 0 0 0 0 0 0
36881 - 0 0 0 0 0 0 0 0 0 0 0 0
36882 - 0 0 0 0 0 0 0 0 0 0 0 0
36883 - 0 0 0 0 0 0 0 0 0 14 14 14
36884 - 42 42 42 86 86 86 6 6 6 116 116 116
36885 -106 106 106 6 6 6 70 70 70 149 149 149
36886 -128 128 128 18 18 18 38 38 38 54 54 54
36887 -221 221 221 106 106 106 2 2 6 14 14 14
36888 - 46 46 46 190 190 190 198 198 198 2 2 6
36889 - 2 2 6 2 2 6 2 2 6 2 2 6
36890 - 74 74 74 62 62 62 22 22 22 6 6 6
36891 - 0 0 0 0 0 0 0 0 0 0 0 0
36892 - 0 0 0 0 0 0 0 0 0 0 0 0
36893 - 0 0 0 0 0 0 0 0 0 0 0 0
36894 - 0 0 0 0 0 0 0 0 0 0 0 0
36895 - 0 0 0 0 0 0 0 0 0 0 0 0
36896 - 0 0 0 0 0 0 0 0 0 0 0 0
36897 - 0 0 0 0 0 0 0 0 1 0 0 0
36898 - 0 0 1 0 0 0 0 0 1 0 0 0
36899 - 0 0 0 0 0 0 0 0 0 0 0 0
36900 - 0 0 0 0 0 0 0 0 0 0 0 0
36901 - 0 0 0 0 0 0 0 0 0 0 0 0
36902 - 0 0 0 0 0 0 0 0 0 0 0 0
36903 - 0 0 0 0 0 0 0 0 0 14 14 14
36904 - 42 42 42 94 94 94 14 14 14 101 101 101
36905 -128 128 128 2 2 6 18 18 18 116 116 116
36906 -118 98 46 121 92 8 121 92 8 98 78 10
36907 -162 162 162 106 106 106 2 2 6 2 2 6
36908 - 2 2 6 195 195 195 195 195 195 6 6 6
36909 - 2 2 6 2 2 6 2 2 6 2 2 6
36910 - 74 74 74 62 62 62 22 22 22 6 6 6
36911 - 0 0 0 0 0 0 0 0 0 0 0 0
36912 - 0 0 0 0 0 0 0 0 0 0 0 0
36913 - 0 0 0 0 0 0 0 0 0 0 0 0
36914 - 0 0 0 0 0 0 0 0 0 0 0 0
36915 - 0 0 0 0 0 0 0 0 0 0 0 0
36916 - 0 0 0 0 0 0 0 0 0 0 0 0
36917 - 0 0 0 0 0 0 0 0 1 0 0 1
36918 - 0 0 1 0 0 0 0 0 1 0 0 0
36919 - 0 0 0 0 0 0 0 0 0 0 0 0
36920 - 0 0 0 0 0 0 0 0 0 0 0 0
36921 - 0 0 0 0 0 0 0 0 0 0 0 0
36922 - 0 0 0 0 0 0 0 0 0 0 0 0
36923 - 0 0 0 0 0 0 0 0 0 10 10 10
36924 - 38 38 38 90 90 90 14 14 14 58 58 58
36925 -210 210 210 26 26 26 54 38 6 154 114 10
36926 -226 170 11 236 186 11 225 175 15 184 144 12
36927 -215 174 15 175 146 61 37 26 9 2 2 6
36928 - 70 70 70 246 246 246 138 138 138 2 2 6
36929 - 2 2 6 2 2 6 2 2 6 2 2 6
36930 - 70 70 70 66 66 66 26 26 26 6 6 6
36931 - 0 0 0 0 0 0 0 0 0 0 0 0
36932 - 0 0 0 0 0 0 0 0 0 0 0 0
36933 - 0 0 0 0 0 0 0 0 0 0 0 0
36934 - 0 0 0 0 0 0 0 0 0 0 0 0
36935 - 0 0 0 0 0 0 0 0 0 0 0 0
36936 - 0 0 0 0 0 0 0 0 0 0 0 0
36937 - 0 0 0 0 0 0 0 0 0 0 0 0
36938 - 0 0 0 0 0 0 0 0 0 0 0 0
36939 - 0 0 0 0 0 0 0 0 0 0 0 0
36940 - 0 0 0 0 0 0 0 0 0 0 0 0
36941 - 0 0 0 0 0 0 0 0 0 0 0 0
36942 - 0 0 0 0 0 0 0 0 0 0 0 0
36943 - 0 0 0 0 0 0 0 0 0 10 10 10
36944 - 38 38 38 86 86 86 14 14 14 10 10 10
36945 -195 195 195 188 164 115 192 133 9 225 175 15
36946 -239 182 13 234 190 10 232 195 16 232 200 30
36947 -245 207 45 241 208 19 232 195 16 184 144 12
36948 -218 194 134 211 206 186 42 42 42 2 2 6
36949 - 2 2 6 2 2 6 2 2 6 2 2 6
36950 - 50 50 50 74 74 74 30 30 30 6 6 6
36951 - 0 0 0 0 0 0 0 0 0 0 0 0
36952 - 0 0 0 0 0 0 0 0 0 0 0 0
36953 - 0 0 0 0 0 0 0 0 0 0 0 0
36954 - 0 0 0 0 0 0 0 0 0 0 0 0
36955 - 0 0 0 0 0 0 0 0 0 0 0 0
36956 - 0 0 0 0 0 0 0 0 0 0 0 0
36957 - 0 0 0 0 0 0 0 0 0 0 0 0
36958 - 0 0 0 0 0 0 0 0 0 0 0 0
36959 - 0 0 0 0 0 0 0 0 0 0 0 0
36960 - 0 0 0 0 0 0 0 0 0 0 0 0
36961 - 0 0 0 0 0 0 0 0 0 0 0 0
36962 - 0 0 0 0 0 0 0 0 0 0 0 0
36963 - 0 0 0 0 0 0 0 0 0 10 10 10
36964 - 34 34 34 86 86 86 14 14 14 2 2 6
36965 -121 87 25 192 133 9 219 162 10 239 182 13
36966 -236 186 11 232 195 16 241 208 19 244 214 54
36967 -246 218 60 246 218 38 246 215 20 241 208 19
36968 -241 208 19 226 184 13 121 87 25 2 2 6
36969 - 2 2 6 2 2 6 2 2 6 2 2 6
36970 - 50 50 50 82 82 82 34 34 34 10 10 10
36971 - 0 0 0 0 0 0 0 0 0 0 0 0
36972 - 0 0 0 0 0 0 0 0 0 0 0 0
36973 - 0 0 0 0 0 0 0 0 0 0 0 0
36974 - 0 0 0 0 0 0 0 0 0 0 0 0
36975 - 0 0 0 0 0 0 0 0 0 0 0 0
36976 - 0 0 0 0 0 0 0 0 0 0 0 0
36977 - 0 0 0 0 0 0 0 0 0 0 0 0
36978 - 0 0 0 0 0 0 0 0 0 0 0 0
36979 - 0 0 0 0 0 0 0 0 0 0 0 0
36980 - 0 0 0 0 0 0 0 0 0 0 0 0
36981 - 0 0 0 0 0 0 0 0 0 0 0 0
36982 - 0 0 0 0 0 0 0 0 0 0 0 0
36983 - 0 0 0 0 0 0 0 0 0 10 10 10
36984 - 34 34 34 82 82 82 30 30 30 61 42 6
36985 -180 123 7 206 145 10 230 174 11 239 182 13
36986 -234 190 10 238 202 15 241 208 19 246 218 74
36987 -246 218 38 246 215 20 246 215 20 246 215 20
36988 -226 184 13 215 174 15 184 144 12 6 6 6
36989 - 2 2 6 2 2 6 2 2 6 2 2 6
36990 - 26 26 26 94 94 94 42 42 42 14 14 14
36991 - 0 0 0 0 0 0 0 0 0 0 0 0
36992 - 0 0 0 0 0 0 0 0 0 0 0 0
36993 - 0 0 0 0 0 0 0 0 0 0 0 0
36994 - 0 0 0 0 0 0 0 0 0 0 0 0
36995 - 0 0 0 0 0 0 0 0 0 0 0 0
36996 - 0 0 0 0 0 0 0 0 0 0 0 0
36997 - 0 0 0 0 0 0 0 0 0 0 0 0
36998 - 0 0 0 0 0 0 0 0 0 0 0 0
36999 - 0 0 0 0 0 0 0 0 0 0 0 0
37000 - 0 0 0 0 0 0 0 0 0 0 0 0
37001 - 0 0 0 0 0 0 0 0 0 0 0 0
37002 - 0 0 0 0 0 0 0 0 0 0 0 0
37003 - 0 0 0 0 0 0 0 0 0 10 10 10
37004 - 30 30 30 78 78 78 50 50 50 104 69 6
37005 -192 133 9 216 158 10 236 178 12 236 186 11
37006 -232 195 16 241 208 19 244 214 54 245 215 43
37007 -246 215 20 246 215 20 241 208 19 198 155 10
37008 -200 144 11 216 158 10 156 118 10 2 2 6
37009 - 2 2 6 2 2 6 2 2 6 2 2 6
37010 - 6 6 6 90 90 90 54 54 54 18 18 18
37011 - 6 6 6 0 0 0 0 0 0 0 0 0
37012 - 0 0 0 0 0 0 0 0 0 0 0 0
37013 - 0 0 0 0 0 0 0 0 0 0 0 0
37014 - 0 0 0 0 0 0 0 0 0 0 0 0
37015 - 0 0 0 0 0 0 0 0 0 0 0 0
37016 - 0 0 0 0 0 0 0 0 0 0 0 0
37017 - 0 0 0 0 0 0 0 0 0 0 0 0
37018 - 0 0 0 0 0 0 0 0 0 0 0 0
37019 - 0 0 0 0 0 0 0 0 0 0 0 0
37020 - 0 0 0 0 0 0 0 0 0 0 0 0
37021 - 0 0 0 0 0 0 0 0 0 0 0 0
37022 - 0 0 0 0 0 0 0 0 0 0 0 0
37023 - 0 0 0 0 0 0 0 0 0 10 10 10
37024 - 30 30 30 78 78 78 46 46 46 22 22 22
37025 -137 92 6 210 162 10 239 182 13 238 190 10
37026 -238 202 15 241 208 19 246 215 20 246 215 20
37027 -241 208 19 203 166 17 185 133 11 210 150 10
37028 -216 158 10 210 150 10 102 78 10 2 2 6
37029 - 6 6 6 54 54 54 14 14 14 2 2 6
37030 - 2 2 6 62 62 62 74 74 74 30 30 30
37031 - 10 10 10 0 0 0 0 0 0 0 0 0
37032 - 0 0 0 0 0 0 0 0 0 0 0 0
37033 - 0 0 0 0 0 0 0 0 0 0 0 0
37034 - 0 0 0 0 0 0 0 0 0 0 0 0
37035 - 0 0 0 0 0 0 0 0 0 0 0 0
37036 - 0 0 0 0 0 0 0 0 0 0 0 0
37037 - 0 0 0 0 0 0 0 0 0 0 0 0
37038 - 0 0 0 0 0 0 0 0 0 0 0 0
37039 - 0 0 0 0 0 0 0 0 0 0 0 0
37040 - 0 0 0 0 0 0 0 0 0 0 0 0
37041 - 0 0 0 0 0 0 0 0 0 0 0 0
37042 - 0 0 0 0 0 0 0 0 0 0 0 0
37043 - 0 0 0 0 0 0 0 0 0 10 10 10
37044 - 34 34 34 78 78 78 50 50 50 6 6 6
37045 - 94 70 30 139 102 15 190 146 13 226 184 13
37046 -232 200 30 232 195 16 215 174 15 190 146 13
37047 -168 122 10 192 133 9 210 150 10 213 154 11
37048 -202 150 34 182 157 106 101 98 89 2 2 6
37049 - 2 2 6 78 78 78 116 116 116 58 58 58
37050 - 2 2 6 22 22 22 90 90 90 46 46 46
37051 - 18 18 18 6 6 6 0 0 0 0 0 0
37052 - 0 0 0 0 0 0 0 0 0 0 0 0
37053 - 0 0 0 0 0 0 0 0 0 0 0 0
37054 - 0 0 0 0 0 0 0 0 0 0 0 0
37055 - 0 0 0 0 0 0 0 0 0 0 0 0
37056 - 0 0 0 0 0 0 0 0 0 0 0 0
37057 - 0 0 0 0 0 0 0 0 0 0 0 0
37058 - 0 0 0 0 0 0 0 0 0 0 0 0
37059 - 0 0 0 0 0 0 0 0 0 0 0 0
37060 - 0 0 0 0 0 0 0 0 0 0 0 0
37061 - 0 0 0 0 0 0 0 0 0 0 0 0
37062 - 0 0 0 0 0 0 0 0 0 0 0 0
37063 - 0 0 0 0 0 0 0 0 0 10 10 10
37064 - 38 38 38 86 86 86 50 50 50 6 6 6
37065 -128 128 128 174 154 114 156 107 11 168 122 10
37066 -198 155 10 184 144 12 197 138 11 200 144 11
37067 -206 145 10 206 145 10 197 138 11 188 164 115
37068 -195 195 195 198 198 198 174 174 174 14 14 14
37069 - 2 2 6 22 22 22 116 116 116 116 116 116
37070 - 22 22 22 2 2 6 74 74 74 70 70 70
37071 - 30 30 30 10 10 10 0 0 0 0 0 0
37072 - 0 0 0 0 0 0 0 0 0 0 0 0
37073 - 0 0 0 0 0 0 0 0 0 0 0 0
37074 - 0 0 0 0 0 0 0 0 0 0 0 0
37075 - 0 0 0 0 0 0 0 0 0 0 0 0
37076 - 0 0 0 0 0 0 0 0 0 0 0 0
37077 - 0 0 0 0 0 0 0 0 0 0 0 0
37078 - 0 0 0 0 0 0 0 0 0 0 0 0
37079 - 0 0 0 0 0 0 0 0 0 0 0 0
37080 - 0 0 0 0 0 0 0 0 0 0 0 0
37081 - 0 0 0 0 0 0 0 0 0 0 0 0
37082 - 0 0 0 0 0 0 0 0 0 0 0 0
37083 - 0 0 0 0 0 0 6 6 6 18 18 18
37084 - 50 50 50 101 101 101 26 26 26 10 10 10
37085 -138 138 138 190 190 190 174 154 114 156 107 11
37086 -197 138 11 200 144 11 197 138 11 192 133 9
37087 -180 123 7 190 142 34 190 178 144 187 187 187
37088 -202 202 202 221 221 221 214 214 214 66 66 66
37089 - 2 2 6 2 2 6 50 50 50 62 62 62
37090 - 6 6 6 2 2 6 10 10 10 90 90 90
37091 - 50 50 50 18 18 18 6 6 6 0 0 0
37092 - 0 0 0 0 0 0 0 0 0 0 0 0
37093 - 0 0 0 0 0 0 0 0 0 0 0 0
37094 - 0 0 0 0 0 0 0 0 0 0 0 0
37095 - 0 0 0 0 0 0 0 0 0 0 0 0
37096 - 0 0 0 0 0 0 0 0 0 0 0 0
37097 - 0 0 0 0 0 0 0 0 0 0 0 0
37098 - 0 0 0 0 0 0 0 0 0 0 0 0
37099 - 0 0 0 0 0 0 0 0 0 0 0 0
37100 - 0 0 0 0 0 0 0 0 0 0 0 0
37101 - 0 0 0 0 0 0 0 0 0 0 0 0
37102 - 0 0 0 0 0 0 0 0 0 0 0 0
37103 - 0 0 0 0 0 0 10 10 10 34 34 34
37104 - 74 74 74 74 74 74 2 2 6 6 6 6
37105 -144 144 144 198 198 198 190 190 190 178 166 146
37106 -154 121 60 156 107 11 156 107 11 168 124 44
37107 -174 154 114 187 187 187 190 190 190 210 210 210
37108 -246 246 246 253 253 253 253 253 253 182 182 182
37109 - 6 6 6 2 2 6 2 2 6 2 2 6
37110 - 2 2 6 2 2 6 2 2 6 62 62 62
37111 - 74 74 74 34 34 34 14 14 14 0 0 0
37112 - 0 0 0 0 0 0 0 0 0 0 0 0
37113 - 0 0 0 0 0 0 0 0 0 0 0 0
37114 - 0 0 0 0 0 0 0 0 0 0 0 0
37115 - 0 0 0 0 0 0 0 0 0 0 0 0
37116 - 0 0 0 0 0 0 0 0 0 0 0 0
37117 - 0 0 0 0 0 0 0 0 0 0 0 0
37118 - 0 0 0 0 0 0 0 0 0 0 0 0
37119 - 0 0 0 0 0 0 0 0 0 0 0 0
37120 - 0 0 0 0 0 0 0 0 0 0 0 0
37121 - 0 0 0 0 0 0 0 0 0 0 0 0
37122 - 0 0 0 0 0 0 0 0 0 0 0 0
37123 - 0 0 0 10 10 10 22 22 22 54 54 54
37124 - 94 94 94 18 18 18 2 2 6 46 46 46
37125 -234 234 234 221 221 221 190 190 190 190 190 190
37126 -190 190 190 187 187 187 187 187 187 190 190 190
37127 -190 190 190 195 195 195 214 214 214 242 242 242
37128 -253 253 253 253 253 253 253 253 253 253 253 253
37129 - 82 82 82 2 2 6 2 2 6 2 2 6
37130 - 2 2 6 2 2 6 2 2 6 14 14 14
37131 - 86 86 86 54 54 54 22 22 22 6 6 6
37132 - 0 0 0 0 0 0 0 0 0 0 0 0
37133 - 0 0 0 0 0 0 0 0 0 0 0 0
37134 - 0 0 0 0 0 0 0 0 0 0 0 0
37135 - 0 0 0 0 0 0 0 0 0 0 0 0
37136 - 0 0 0 0 0 0 0 0 0 0 0 0
37137 - 0 0 0 0 0 0 0 0 0 0 0 0
37138 - 0 0 0 0 0 0 0 0 0 0 0 0
37139 - 0 0 0 0 0 0 0 0 0 0 0 0
37140 - 0 0 0 0 0 0 0 0 0 0 0 0
37141 - 0 0 0 0 0 0 0 0 0 0 0 0
37142 - 0 0 0 0 0 0 0 0 0 0 0 0
37143 - 6 6 6 18 18 18 46 46 46 90 90 90
37144 - 46 46 46 18 18 18 6 6 6 182 182 182
37145 -253 253 253 246 246 246 206 206 206 190 190 190
37146 -190 190 190 190 190 190 190 190 190 190 190 190
37147 -206 206 206 231 231 231 250 250 250 253 253 253
37148 -253 253 253 253 253 253 253 253 253 253 253 253
37149 -202 202 202 14 14 14 2 2 6 2 2 6
37150 - 2 2 6 2 2 6 2 2 6 2 2 6
37151 - 42 42 42 86 86 86 42 42 42 18 18 18
37152 - 6 6 6 0 0 0 0 0 0 0 0 0
37153 - 0 0 0 0 0 0 0 0 0 0 0 0
37154 - 0 0 0 0 0 0 0 0 0 0 0 0
37155 - 0 0 0 0 0 0 0 0 0 0 0 0
37156 - 0 0 0 0 0 0 0 0 0 0 0 0
37157 - 0 0 0 0 0 0 0 0 0 0 0 0
37158 - 0 0 0 0 0 0 0 0 0 0 0 0
37159 - 0 0 0 0 0 0 0 0 0 0 0 0
37160 - 0 0 0 0 0 0 0 0 0 0 0 0
37161 - 0 0 0 0 0 0 0 0 0 0 0 0
37162 - 0 0 0 0 0 0 0 0 0 6 6 6
37163 - 14 14 14 38 38 38 74 74 74 66 66 66
37164 - 2 2 6 6 6 6 90 90 90 250 250 250
37165 -253 253 253 253 253 253 238 238 238 198 198 198
37166 -190 190 190 190 190 190 195 195 195 221 221 221
37167 -246 246 246 253 253 253 253 253 253 253 253 253
37168 -253 253 253 253 253 253 253 253 253 253 253 253
37169 -253 253 253 82 82 82 2 2 6 2 2 6
37170 - 2 2 6 2 2 6 2 2 6 2 2 6
37171 - 2 2 6 78 78 78 70 70 70 34 34 34
37172 - 14 14 14 6 6 6 0 0 0 0 0 0
37173 - 0 0 0 0 0 0 0 0 0 0 0 0
37174 - 0 0 0 0 0 0 0 0 0 0 0 0
37175 - 0 0 0 0 0 0 0 0 0 0 0 0
37176 - 0 0 0 0 0 0 0 0 0 0 0 0
37177 - 0 0 0 0 0 0 0 0 0 0 0 0
37178 - 0 0 0 0 0 0 0 0 0 0 0 0
37179 - 0 0 0 0 0 0 0 0 0 0 0 0
37180 - 0 0 0 0 0 0 0 0 0 0 0 0
37181 - 0 0 0 0 0 0 0 0 0 0 0 0
37182 - 0 0 0 0 0 0 0 0 0 14 14 14
37183 - 34 34 34 66 66 66 78 78 78 6 6 6
37184 - 2 2 6 18 18 18 218 218 218 253 253 253
37185 -253 253 253 253 253 253 253 253 253 246 246 246
37186 -226 226 226 231 231 231 246 246 246 253 253 253
37187 -253 253 253 253 253 253 253 253 253 253 253 253
37188 -253 253 253 253 253 253 253 253 253 253 253 253
37189 -253 253 253 178 178 178 2 2 6 2 2 6
37190 - 2 2 6 2 2 6 2 2 6 2 2 6
37191 - 2 2 6 18 18 18 90 90 90 62 62 62
37192 - 30 30 30 10 10 10 0 0 0 0 0 0
37193 - 0 0 0 0 0 0 0 0 0 0 0 0
37194 - 0 0 0 0 0 0 0 0 0 0 0 0
37195 - 0 0 0 0 0 0 0 0 0 0 0 0
37196 - 0 0 0 0 0 0 0 0 0 0 0 0
37197 - 0 0 0 0 0 0 0 0 0 0 0 0
37198 - 0 0 0 0 0 0 0 0 0 0 0 0
37199 - 0 0 0 0 0 0 0 0 0 0 0 0
37200 - 0 0 0 0 0 0 0 0 0 0 0 0
37201 - 0 0 0 0 0 0 0 0 0 0 0 0
37202 - 0 0 0 0 0 0 10 10 10 26 26 26
37203 - 58 58 58 90 90 90 18 18 18 2 2 6
37204 - 2 2 6 110 110 110 253 253 253 253 253 253
37205 -253 253 253 253 253 253 253 253 253 253 253 253
37206 -250 250 250 253 253 253 253 253 253 253 253 253
37207 -253 253 253 253 253 253 253 253 253 253 253 253
37208 -253 253 253 253 253 253 253 253 253 253 253 253
37209 -253 253 253 231 231 231 18 18 18 2 2 6
37210 - 2 2 6 2 2 6 2 2 6 2 2 6
37211 - 2 2 6 2 2 6 18 18 18 94 94 94
37212 - 54 54 54 26 26 26 10 10 10 0 0 0
37213 - 0 0 0 0 0 0 0 0 0 0 0 0
37214 - 0 0 0 0 0 0 0 0 0 0 0 0
37215 - 0 0 0 0 0 0 0 0 0 0 0 0
37216 - 0 0 0 0 0 0 0 0 0 0 0 0
37217 - 0 0 0 0 0 0 0 0 0 0 0 0
37218 - 0 0 0 0 0 0 0 0 0 0 0 0
37219 - 0 0 0 0 0 0 0 0 0 0 0 0
37220 - 0 0 0 0 0 0 0 0 0 0 0 0
37221 - 0 0 0 0 0 0 0 0 0 0 0 0
37222 - 0 0 0 6 6 6 22 22 22 50 50 50
37223 - 90 90 90 26 26 26 2 2 6 2 2 6
37224 - 14 14 14 195 195 195 250 250 250 253 253 253
37225 -253 253 253 253 253 253 253 253 253 253 253 253
37226 -253 253 253 253 253 253 253 253 253 253 253 253
37227 -253 253 253 253 253 253 253 253 253 253 253 253
37228 -253 253 253 253 253 253 253 253 253 253 253 253
37229 -250 250 250 242 242 242 54 54 54 2 2 6
37230 - 2 2 6 2 2 6 2 2 6 2 2 6
37231 - 2 2 6 2 2 6 2 2 6 38 38 38
37232 - 86 86 86 50 50 50 22 22 22 6 6 6
37233 - 0 0 0 0 0 0 0 0 0 0 0 0
37234 - 0 0 0 0 0 0 0 0 0 0 0 0
37235 - 0 0 0 0 0 0 0 0 0 0 0 0
37236 - 0 0 0 0 0 0 0 0 0 0 0 0
37237 - 0 0 0 0 0 0 0 0 0 0 0 0
37238 - 0 0 0 0 0 0 0 0 0 0 0 0
37239 - 0 0 0 0 0 0 0 0 0 0 0 0
37240 - 0 0 0 0 0 0 0 0 0 0 0 0
37241 - 0 0 0 0 0 0 0 0 0 0 0 0
37242 - 6 6 6 14 14 14 38 38 38 82 82 82
37243 - 34 34 34 2 2 6 2 2 6 2 2 6
37244 - 42 42 42 195 195 195 246 246 246 253 253 253
37245 -253 253 253 253 253 253 253 253 253 250 250 250
37246 -242 242 242 242 242 242 250 250 250 253 253 253
37247 -253 253 253 253 253 253 253 253 253 253 253 253
37248 -253 253 253 250 250 250 246 246 246 238 238 238
37249 -226 226 226 231 231 231 101 101 101 6 6 6
37250 - 2 2 6 2 2 6 2 2 6 2 2 6
37251 - 2 2 6 2 2 6 2 2 6 2 2 6
37252 - 38 38 38 82 82 82 42 42 42 14 14 14
37253 - 6 6 6 0 0 0 0 0 0 0 0 0
37254 - 0 0 0 0 0 0 0 0 0 0 0 0
37255 - 0 0 0 0 0 0 0 0 0 0 0 0
37256 - 0 0 0 0 0 0 0 0 0 0 0 0
37257 - 0 0 0 0 0 0 0 0 0 0 0 0
37258 - 0 0 0 0 0 0 0 0 0 0 0 0
37259 - 0 0 0 0 0 0 0 0 0 0 0 0
37260 - 0 0 0 0 0 0 0 0 0 0 0 0
37261 - 0 0 0 0 0 0 0 0 0 0 0 0
37262 - 10 10 10 26 26 26 62 62 62 66 66 66
37263 - 2 2 6 2 2 6 2 2 6 6 6 6
37264 - 70 70 70 170 170 170 206 206 206 234 234 234
37265 -246 246 246 250 250 250 250 250 250 238 238 238
37266 -226 226 226 231 231 231 238 238 238 250 250 250
37267 -250 250 250 250 250 250 246 246 246 231 231 231
37268 -214 214 214 206 206 206 202 202 202 202 202 202
37269 -198 198 198 202 202 202 182 182 182 18 18 18
37270 - 2 2 6 2 2 6 2 2 6 2 2 6
37271 - 2 2 6 2 2 6 2 2 6 2 2 6
37272 - 2 2 6 62 62 62 66 66 66 30 30 30
37273 - 10 10 10 0 0 0 0 0 0 0 0 0
37274 - 0 0 0 0 0 0 0 0 0 0 0 0
37275 - 0 0 0 0 0 0 0 0 0 0 0 0
37276 - 0 0 0 0 0 0 0 0 0 0 0 0
37277 - 0 0 0 0 0 0 0 0 0 0 0 0
37278 - 0 0 0 0 0 0 0 0 0 0 0 0
37279 - 0 0 0 0 0 0 0 0 0 0 0 0
37280 - 0 0 0 0 0 0 0 0 0 0 0 0
37281 - 0 0 0 0 0 0 0 0 0 0 0 0
37282 - 14 14 14 42 42 42 82 82 82 18 18 18
37283 - 2 2 6 2 2 6 2 2 6 10 10 10
37284 - 94 94 94 182 182 182 218 218 218 242 242 242
37285 -250 250 250 253 253 253 253 253 253 250 250 250
37286 -234 234 234 253 253 253 253 253 253 253 253 253
37287 -253 253 253 253 253 253 253 253 253 246 246 246
37288 -238 238 238 226 226 226 210 210 210 202 202 202
37289 -195 195 195 195 195 195 210 210 210 158 158 158
37290 - 6 6 6 14 14 14 50 50 50 14 14 14
37291 - 2 2 6 2 2 6 2 2 6 2 2 6
37292 - 2 2 6 6 6 6 86 86 86 46 46 46
37293 - 18 18 18 6 6 6 0 0 0 0 0 0
37294 - 0 0 0 0 0 0 0 0 0 0 0 0
37295 - 0 0 0 0 0 0 0 0 0 0 0 0
37296 - 0 0 0 0 0 0 0 0 0 0 0 0
37297 - 0 0 0 0 0 0 0 0 0 0 0 0
37298 - 0 0 0 0 0 0 0 0 0 0 0 0
37299 - 0 0 0 0 0 0 0 0 0 0 0 0
37300 - 0 0 0 0 0 0 0 0 0 0 0 0
37301 - 0 0 0 0 0 0 0 0 0 6 6 6
37302 - 22 22 22 54 54 54 70 70 70 2 2 6
37303 - 2 2 6 10 10 10 2 2 6 22 22 22
37304 -166 166 166 231 231 231 250 250 250 253 253 253
37305 -253 253 253 253 253 253 253 253 253 250 250 250
37306 -242 242 242 253 253 253 253 253 253 253 253 253
37307 -253 253 253 253 253 253 253 253 253 253 253 253
37308 -253 253 253 253 253 253 253 253 253 246 246 246
37309 -231 231 231 206 206 206 198 198 198 226 226 226
37310 - 94 94 94 2 2 6 6 6 6 38 38 38
37311 - 30 30 30 2 2 6 2 2 6 2 2 6
37312 - 2 2 6 2 2 6 62 62 62 66 66 66
37313 - 26 26 26 10 10 10 0 0 0 0 0 0
37314 - 0 0 0 0 0 0 0 0 0 0 0 0
37315 - 0 0 0 0 0 0 0 0 0 0 0 0
37316 - 0 0 0 0 0 0 0 0 0 0 0 0
37317 - 0 0 0 0 0 0 0 0 0 0 0 0
37318 - 0 0 0 0 0 0 0 0 0 0 0 0
37319 - 0 0 0 0 0 0 0 0 0 0 0 0
37320 - 0 0 0 0 0 0 0 0 0 0 0 0
37321 - 0 0 0 0 0 0 0 0 0 10 10 10
37322 - 30 30 30 74 74 74 50 50 50 2 2 6
37323 - 26 26 26 26 26 26 2 2 6 106 106 106
37324 -238 238 238 253 253 253 253 253 253 253 253 253
37325 -253 253 253 253 253 253 253 253 253 253 253 253
37326 -253 253 253 253 253 253 253 253 253 253 253 253
37327 -253 253 253 253 253 253 253 253 253 253 253 253
37328 -253 253 253 253 253 253 253 253 253 253 253 253
37329 -253 253 253 246 246 246 218 218 218 202 202 202
37330 -210 210 210 14 14 14 2 2 6 2 2 6
37331 - 30 30 30 22 22 22 2 2 6 2 2 6
37332 - 2 2 6 2 2 6 18 18 18 86 86 86
37333 - 42 42 42 14 14 14 0 0 0 0 0 0
37334 - 0 0 0 0 0 0 0 0 0 0 0 0
37335 - 0 0 0 0 0 0 0 0 0 0 0 0
37336 - 0 0 0 0 0 0 0 0 0 0 0 0
37337 - 0 0 0 0 0 0 0 0 0 0 0 0
37338 - 0 0 0 0 0 0 0 0 0 0 0 0
37339 - 0 0 0 0 0 0 0 0 0 0 0 0
37340 - 0 0 0 0 0 0 0 0 0 0 0 0
37341 - 0 0 0 0 0 0 0 0 0 14 14 14
37342 - 42 42 42 90 90 90 22 22 22 2 2 6
37343 - 42 42 42 2 2 6 18 18 18 218 218 218
37344 -253 253 253 253 253 253 253 253 253 253 253 253
37345 -253 253 253 253 253 253 253 253 253 253 253 253
37346 -253 253 253 253 253 253 253 253 253 253 253 253
37347 -253 253 253 253 253 253 253 253 253 253 253 253
37348 -253 253 253 253 253 253 253 253 253 253 253 253
37349 -253 253 253 253 253 253 250 250 250 221 221 221
37350 -218 218 218 101 101 101 2 2 6 14 14 14
37351 - 18 18 18 38 38 38 10 10 10 2 2 6
37352 - 2 2 6 2 2 6 2 2 6 78 78 78
37353 - 58 58 58 22 22 22 6 6 6 0 0 0
37354 - 0 0 0 0 0 0 0 0 0 0 0 0
37355 - 0 0 0 0 0 0 0 0 0 0 0 0
37356 - 0 0 0 0 0 0 0 0 0 0 0 0
37357 - 0 0 0 0 0 0 0 0 0 0 0 0
37358 - 0 0 0 0 0 0 0 0 0 0 0 0
37359 - 0 0 0 0 0 0 0 0 0 0 0 0
37360 - 0 0 0 0 0 0 0 0 0 0 0 0
37361 - 0 0 0 0 0 0 6 6 6 18 18 18
37362 - 54 54 54 82 82 82 2 2 6 26 26 26
37363 - 22 22 22 2 2 6 123 123 123 253 253 253
37364 -253 253 253 253 253 253 253 253 253 253 253 253
37365 -253 253 253 253 253 253 253 253 253 253 253 253
37366 -253 253 253 253 253 253 253 253 253 253 253 253
37367 -253 253 253 253 253 253 253 253 253 253 253 253
37368 -253 253 253 253 253 253 253 253 253 253 253 253
37369 -253 253 253 253 253 253 253 253 253 250 250 250
37370 -238 238 238 198 198 198 6 6 6 38 38 38
37371 - 58 58 58 26 26 26 38 38 38 2 2 6
37372 - 2 2 6 2 2 6 2 2 6 46 46 46
37373 - 78 78 78 30 30 30 10 10 10 0 0 0
37374 - 0 0 0 0 0 0 0 0 0 0 0 0
37375 - 0 0 0 0 0 0 0 0 0 0 0 0
37376 - 0 0 0 0 0 0 0 0 0 0 0 0
37377 - 0 0 0 0 0 0 0 0 0 0 0 0
37378 - 0 0 0 0 0 0 0 0 0 0 0 0
37379 - 0 0 0 0 0 0 0 0 0 0 0 0
37380 - 0 0 0 0 0 0 0 0 0 0 0 0
37381 - 0 0 0 0 0 0 10 10 10 30 30 30
37382 - 74 74 74 58 58 58 2 2 6 42 42 42
37383 - 2 2 6 22 22 22 231 231 231 253 253 253
37384 -253 253 253 253 253 253 253 253 253 253 253 253
37385 -253 253 253 253 253 253 253 253 253 250 250 250
37386 -253 253 253 253 253 253 253 253 253 253 253 253
37387 -253 253 253 253 253 253 253 253 253 253 253 253
37388 -253 253 253 253 253 253 253 253 253 253 253 253
37389 -253 253 253 253 253 253 253 253 253 253 253 253
37390 -253 253 253 246 246 246 46 46 46 38 38 38
37391 - 42 42 42 14 14 14 38 38 38 14 14 14
37392 - 2 2 6 2 2 6 2 2 6 6 6 6
37393 - 86 86 86 46 46 46 14 14 14 0 0 0
37394 - 0 0 0 0 0 0 0 0 0 0 0 0
37395 - 0 0 0 0 0 0 0 0 0 0 0 0
37396 - 0 0 0 0 0 0 0 0 0 0 0 0
37397 - 0 0 0 0 0 0 0 0 0 0 0 0
37398 - 0 0 0 0 0 0 0 0 0 0 0 0
37399 - 0 0 0 0 0 0 0 0 0 0 0 0
37400 - 0 0 0 0 0 0 0 0 0 0 0 0
37401 - 0 0 0 6 6 6 14 14 14 42 42 42
37402 - 90 90 90 18 18 18 18 18 18 26 26 26
37403 - 2 2 6 116 116 116 253 253 253 253 253 253
37404 -253 253 253 253 253 253 253 253 253 253 253 253
37405 -253 253 253 253 253 253 250 250 250 238 238 238
37406 -253 253 253 253 253 253 253 253 253 253 253 253
37407 -253 253 253 253 253 253 253 253 253 253 253 253
37408 -253 253 253 253 253 253 253 253 253 253 253 253
37409 -253 253 253 253 253 253 253 253 253 253 253 253
37410 -253 253 253 253 253 253 94 94 94 6 6 6
37411 - 2 2 6 2 2 6 10 10 10 34 34 34
37412 - 2 2 6 2 2 6 2 2 6 2 2 6
37413 - 74 74 74 58 58 58 22 22 22 6 6 6
37414 - 0 0 0 0 0 0 0 0 0 0 0 0
37415 - 0 0 0 0 0 0 0 0 0 0 0 0
37416 - 0 0 0 0 0 0 0 0 0 0 0 0
37417 - 0 0 0 0 0 0 0 0 0 0 0 0
37418 - 0 0 0 0 0 0 0 0 0 0 0 0
37419 - 0 0 0 0 0 0 0 0 0 0 0 0
37420 - 0 0 0 0 0 0 0 0 0 0 0 0
37421 - 0 0 0 10 10 10 26 26 26 66 66 66
37422 - 82 82 82 2 2 6 38 38 38 6 6 6
37423 - 14 14 14 210 210 210 253 253 253 253 253 253
37424 -253 253 253 253 253 253 253 253 253 253 253 253
37425 -253 253 253 253 253 253 246 246 246 242 242 242
37426 -253 253 253 253 253 253 253 253 253 253 253 253
37427 -253 253 253 253 253 253 253 253 253 253 253 253
37428 -253 253 253 253 253 253 253 253 253 253 253 253
37429 -253 253 253 253 253 253 253 253 253 253 253 253
37430 -253 253 253 253 253 253 144 144 144 2 2 6
37431 - 2 2 6 2 2 6 2 2 6 46 46 46
37432 - 2 2 6 2 2 6 2 2 6 2 2 6
37433 - 42 42 42 74 74 74 30 30 30 10 10 10
37434 - 0 0 0 0 0 0 0 0 0 0 0 0
37435 - 0 0 0 0 0 0 0 0 0 0 0 0
37436 - 0 0 0 0 0 0 0 0 0 0 0 0
37437 - 0 0 0 0 0 0 0 0 0 0 0 0
37438 - 0 0 0 0 0 0 0 0 0 0 0 0
37439 - 0 0 0 0 0 0 0 0 0 0 0 0
37440 - 0 0 0 0 0 0 0 0 0 0 0 0
37441 - 6 6 6 14 14 14 42 42 42 90 90 90
37442 - 26 26 26 6 6 6 42 42 42 2 2 6
37443 - 74 74 74 250 250 250 253 253 253 253 253 253
37444 -253 253 253 253 253 253 253 253 253 253 253 253
37445 -253 253 253 253 253 253 242 242 242 242 242 242
37446 -253 253 253 253 253 253 253 253 253 253 253 253
37447 -253 253 253 253 253 253 253 253 253 253 253 253
37448 -253 253 253 253 253 253 253 253 253 253 253 253
37449 -253 253 253 253 253 253 253 253 253 253 253 253
37450 -253 253 253 253 253 253 182 182 182 2 2 6
37451 - 2 2 6 2 2 6 2 2 6 46 46 46
37452 - 2 2 6 2 2 6 2 2 6 2 2 6
37453 - 10 10 10 86 86 86 38 38 38 10 10 10
37454 - 0 0 0 0 0 0 0 0 0 0 0 0
37455 - 0 0 0 0 0 0 0 0 0 0 0 0
37456 - 0 0 0 0 0 0 0 0 0 0 0 0
37457 - 0 0 0 0 0 0 0 0 0 0 0 0
37458 - 0 0 0 0 0 0 0 0 0 0 0 0
37459 - 0 0 0 0 0 0 0 0 0 0 0 0
37460 - 0 0 0 0 0 0 0 0 0 0 0 0
37461 - 10 10 10 26 26 26 66 66 66 82 82 82
37462 - 2 2 6 22 22 22 18 18 18 2 2 6
37463 -149 149 149 253 253 253 253 253 253 253 253 253
37464 -253 253 253 253 253 253 253 253 253 253 253 253
37465 -253 253 253 253 253 253 234 234 234 242 242 242
37466 -253 253 253 253 253 253 253 253 253 253 253 253
37467 -253 253 253 253 253 253 253 253 253 253 253 253
37468 -253 253 253 253 253 253 253 253 253 253 253 253
37469 -253 253 253 253 253 253 253 253 253 253 253 253
37470 -253 253 253 253 253 253 206 206 206 2 2 6
37471 - 2 2 6 2 2 6 2 2 6 38 38 38
37472 - 2 2 6 2 2 6 2 2 6 2 2 6
37473 - 6 6 6 86 86 86 46 46 46 14 14 14
37474 - 0 0 0 0 0 0 0 0 0 0 0 0
37475 - 0 0 0 0 0 0 0 0 0 0 0 0
37476 - 0 0 0 0 0 0 0 0 0 0 0 0
37477 - 0 0 0 0 0 0 0 0 0 0 0 0
37478 - 0 0 0 0 0 0 0 0 0 0 0 0
37479 - 0 0 0 0 0 0 0 0 0 0 0 0
37480 - 0 0 0 0 0 0 0 0 0 6 6 6
37481 - 18 18 18 46 46 46 86 86 86 18 18 18
37482 - 2 2 6 34 34 34 10 10 10 6 6 6
37483 -210 210 210 253 253 253 253 253 253 253 253 253
37484 -253 253 253 253 253 253 253 253 253 253 253 253
37485 -253 253 253 253 253 253 234 234 234 242 242 242
37486 -253 253 253 253 253 253 253 253 253 253 253 253
37487 -253 253 253 253 253 253 253 253 253 253 253 253
37488 -253 253 253 253 253 253 253 253 253 253 253 253
37489 -253 253 253 253 253 253 253 253 253 253 253 253
37490 -253 253 253 253 253 253 221 221 221 6 6 6
37491 - 2 2 6 2 2 6 6 6 6 30 30 30
37492 - 2 2 6 2 2 6 2 2 6 2 2 6
37493 - 2 2 6 82 82 82 54 54 54 18 18 18
37494 - 6 6 6 0 0 0 0 0 0 0 0 0
37495 - 0 0 0 0 0 0 0 0 0 0 0 0
37496 - 0 0 0 0 0 0 0 0 0 0 0 0
37497 - 0 0 0 0 0 0 0 0 0 0 0 0
37498 - 0 0 0 0 0 0 0 0 0 0 0 0
37499 - 0 0 0 0 0 0 0 0 0 0 0 0
37500 - 0 0 0 0 0 0 0 0 0 10 10 10
37501 - 26 26 26 66 66 66 62 62 62 2 2 6
37502 - 2 2 6 38 38 38 10 10 10 26 26 26
37503 -238 238 238 253 253 253 253 253 253 253 253 253
37504 -253 253 253 253 253 253 253 253 253 253 253 253
37505 -253 253 253 253 253 253 231 231 231 238 238 238
37506 -253 253 253 253 253 253 253 253 253 253 253 253
37507 -253 253 253 253 253 253 253 253 253 253 253 253
37508 -253 253 253 253 253 253 253 253 253 253 253 253
37509 -253 253 253 253 253 253 253 253 253 253 253 253
37510 -253 253 253 253 253 253 231 231 231 6 6 6
37511 - 2 2 6 2 2 6 10 10 10 30 30 30
37512 - 2 2 6 2 2 6 2 2 6 2 2 6
37513 - 2 2 6 66 66 66 58 58 58 22 22 22
37514 - 6 6 6 0 0 0 0 0 0 0 0 0
37515 - 0 0 0 0 0 0 0 0 0 0 0 0
37516 - 0 0 0 0 0 0 0 0 0 0 0 0
37517 - 0 0 0 0 0 0 0 0 0 0 0 0
37518 - 0 0 0 0 0 0 0 0 0 0 0 0
37519 - 0 0 0 0 0 0 0 0 0 0 0 0
37520 - 0 0 0 0 0 0 0 0 0 10 10 10
37521 - 38 38 38 78 78 78 6 6 6 2 2 6
37522 - 2 2 6 46 46 46 14 14 14 42 42 42
37523 -246 246 246 253 253 253 253 253 253 253 253 253
37524 -253 253 253 253 253 253 253 253 253 253 253 253
37525 -253 253 253 253 253 253 231 231 231 242 242 242
37526 -253 253 253 253 253 253 253 253 253 253 253 253
37527 -253 253 253 253 253 253 253 253 253 253 253 253
37528 -253 253 253 253 253 253 253 253 253 253 253 253
37529 -253 253 253 253 253 253 253 253 253 253 253 253
37530 -253 253 253 253 253 253 234 234 234 10 10 10
37531 - 2 2 6 2 2 6 22 22 22 14 14 14
37532 - 2 2 6 2 2 6 2 2 6 2 2 6
37533 - 2 2 6 66 66 66 62 62 62 22 22 22
37534 - 6 6 6 0 0 0 0 0 0 0 0 0
37535 - 0 0 0 0 0 0 0 0 0 0 0 0
37536 - 0 0 0 0 0 0 0 0 0 0 0 0
37537 - 0 0 0 0 0 0 0 0 0 0 0 0
37538 - 0 0 0 0 0 0 0 0 0 0 0 0
37539 - 0 0 0 0 0 0 0 0 0 0 0 0
37540 - 0 0 0 0 0 0 6 6 6 18 18 18
37541 - 50 50 50 74 74 74 2 2 6 2 2 6
37542 - 14 14 14 70 70 70 34 34 34 62 62 62
37543 -250 250 250 253 253 253 253 253 253 253 253 253
37544 -253 253 253 253 253 253 253 253 253 253 253 253
37545 -253 253 253 253 253 253 231 231 231 246 246 246
37546 -253 253 253 253 253 253 253 253 253 253 253 253
37547 -253 253 253 253 253 253 253 253 253 253 253 253
37548 -253 253 253 253 253 253 253 253 253 253 253 253
37549 -253 253 253 253 253 253 253 253 253 253 253 253
37550 -253 253 253 253 253 253 234 234 234 14 14 14
37551 - 2 2 6 2 2 6 30 30 30 2 2 6
37552 - 2 2 6 2 2 6 2 2 6 2 2 6
37553 - 2 2 6 66 66 66 62 62 62 22 22 22
37554 - 6 6 6 0 0 0 0 0 0 0 0 0
37555 - 0 0 0 0 0 0 0 0 0 0 0 0
37556 - 0 0 0 0 0 0 0 0 0 0 0 0
37557 - 0 0 0 0 0 0 0 0 0 0 0 0
37558 - 0 0 0 0 0 0 0 0 0 0 0 0
37559 - 0 0 0 0 0 0 0 0 0 0 0 0
37560 - 0 0 0 0 0 0 6 6 6 18 18 18
37561 - 54 54 54 62 62 62 2 2 6 2 2 6
37562 - 2 2 6 30 30 30 46 46 46 70 70 70
37563 -250 250 250 253 253 253 253 253 253 253 253 253
37564 -253 253 253 253 253 253 253 253 253 253 253 253
37565 -253 253 253 253 253 253 231 231 231 246 246 246
37566 -253 253 253 253 253 253 253 253 253 253 253 253
37567 -253 253 253 253 253 253 253 253 253 253 253 253
37568 -253 253 253 253 253 253 253 253 253 253 253 253
37569 -253 253 253 253 253 253 253 253 253 253 253 253
37570 -253 253 253 253 253 253 226 226 226 10 10 10
37571 - 2 2 6 6 6 6 30 30 30 2 2 6
37572 - 2 2 6 2 2 6 2 2 6 2 2 6
37573 - 2 2 6 66 66 66 58 58 58 22 22 22
37574 - 6 6 6 0 0 0 0 0 0 0 0 0
37575 - 0 0 0 0 0 0 0 0 0 0 0 0
37576 - 0 0 0 0 0 0 0 0 0 0 0 0
37577 - 0 0 0 0 0 0 0 0 0 0 0 0
37578 - 0 0 0 0 0 0 0 0 0 0 0 0
37579 - 0 0 0 0 0 0 0 0 0 0 0 0
37580 - 0 0 0 0 0 0 6 6 6 22 22 22
37581 - 58 58 58 62 62 62 2 2 6 2 2 6
37582 - 2 2 6 2 2 6 30 30 30 78 78 78
37583 -250 250 250 253 253 253 253 253 253 253 253 253
37584 -253 253 253 253 253 253 253 253 253 253 253 253
37585 -253 253 253 253 253 253 231 231 231 246 246 246
37586 -253 253 253 253 253 253 253 253 253 253 253 253
37587 -253 253 253 253 253 253 253 253 253 253 253 253
37588 -253 253 253 253 253 253 253 253 253 253 253 253
37589 -253 253 253 253 253 253 253 253 253 253 253 253
37590 -253 253 253 253 253 253 206 206 206 2 2 6
37591 - 22 22 22 34 34 34 18 14 6 22 22 22
37592 - 26 26 26 18 18 18 6 6 6 2 2 6
37593 - 2 2 6 82 82 82 54 54 54 18 18 18
37594 - 6 6 6 0 0 0 0 0 0 0 0 0
37595 - 0 0 0 0 0 0 0 0 0 0 0 0
37596 - 0 0 0 0 0 0 0 0 0 0 0 0
37597 - 0 0 0 0 0 0 0 0 0 0 0 0
37598 - 0 0 0 0 0 0 0 0 0 0 0 0
37599 - 0 0 0 0 0 0 0 0 0 0 0 0
37600 - 0 0 0 0 0 0 6 6 6 26 26 26
37601 - 62 62 62 106 106 106 74 54 14 185 133 11
37602 -210 162 10 121 92 8 6 6 6 62 62 62
37603 -238 238 238 253 253 253 253 253 253 253 253 253
37604 -253 253 253 253 253 253 253 253 253 253 253 253
37605 -253 253 253 253 253 253 231 231 231 246 246 246
37606 -253 253 253 253 253 253 253 253 253 253 253 253
37607 -253 253 253 253 253 253 253 253 253 253 253 253
37608 -253 253 253 253 253 253 253 253 253 253 253 253
37609 -253 253 253 253 253 253 253 253 253 253 253 253
37610 -253 253 253 253 253 253 158 158 158 18 18 18
37611 - 14 14 14 2 2 6 2 2 6 2 2 6
37612 - 6 6 6 18 18 18 66 66 66 38 38 38
37613 - 6 6 6 94 94 94 50 50 50 18 18 18
37614 - 6 6 6 0 0 0 0 0 0 0 0 0
37615 - 0 0 0 0 0 0 0 0 0 0 0 0
37616 - 0 0 0 0 0 0 0 0 0 0 0 0
37617 - 0 0 0 0 0 0 0 0 0 0 0 0
37618 - 0 0 0 0 0 0 0 0 0 0 0 0
37619 - 0 0 0 0 0 0 0 0 0 6 6 6
37620 - 10 10 10 10 10 10 18 18 18 38 38 38
37621 - 78 78 78 142 134 106 216 158 10 242 186 14
37622 -246 190 14 246 190 14 156 118 10 10 10 10
37623 - 90 90 90 238 238 238 253 253 253 253 253 253
37624 -253 253 253 253 253 253 253 253 253 253 253 253
37625 -253 253 253 253 253 253 231 231 231 250 250 250
37626 -253 253 253 253 253 253 253 253 253 253 253 253
37627 -253 253 253 253 253 253 253 253 253 253 253 253
37628 -253 253 253 253 253 253 253 253 253 253 253 253
37629 -253 253 253 253 253 253 253 253 253 246 230 190
37630 -238 204 91 238 204 91 181 142 44 37 26 9
37631 - 2 2 6 2 2 6 2 2 6 2 2 6
37632 - 2 2 6 2 2 6 38 38 38 46 46 46
37633 - 26 26 26 106 106 106 54 54 54 18 18 18
37634 - 6 6 6 0 0 0 0 0 0 0 0 0
37635 - 0 0 0 0 0 0 0 0 0 0 0 0
37636 - 0 0 0 0 0 0 0 0 0 0 0 0
37637 - 0 0 0 0 0 0 0 0 0 0 0 0
37638 - 0 0 0 0 0 0 0 0 0 0 0 0
37639 - 0 0 0 6 6 6 14 14 14 22 22 22
37640 - 30 30 30 38 38 38 50 50 50 70 70 70
37641 -106 106 106 190 142 34 226 170 11 242 186 14
37642 -246 190 14 246 190 14 246 190 14 154 114 10
37643 - 6 6 6 74 74 74 226 226 226 253 253 253
37644 -253 253 253 253 253 253 253 253 253 253 253 253
37645 -253 253 253 253 253 253 231 231 231 250 250 250
37646 -253 253 253 253 253 253 253 253 253 253 253 253
37647 -253 253 253 253 253 253 253 253 253 253 253 253
37648 -253 253 253 253 253 253 253 253 253 253 253 253
37649 -253 253 253 253 253 253 253 253 253 228 184 62
37650 -241 196 14 241 208 19 232 195 16 38 30 10
37651 - 2 2 6 2 2 6 2 2 6 2 2 6
37652 - 2 2 6 6 6 6 30 30 30 26 26 26
37653 -203 166 17 154 142 90 66 66 66 26 26 26
37654 - 6 6 6 0 0 0 0 0 0 0 0 0
37655 - 0 0 0 0 0 0 0 0 0 0 0 0
37656 - 0 0 0 0 0 0 0 0 0 0 0 0
37657 - 0 0 0 0 0 0 0 0 0 0 0 0
37658 - 0 0 0 0 0 0 0 0 0 0 0 0
37659 - 6 6 6 18 18 18 38 38 38 58 58 58
37660 - 78 78 78 86 86 86 101 101 101 123 123 123
37661 -175 146 61 210 150 10 234 174 13 246 186 14
37662 -246 190 14 246 190 14 246 190 14 238 190 10
37663 -102 78 10 2 2 6 46 46 46 198 198 198
37664 -253 253 253 253 253 253 253 253 253 253 253 253
37665 -253 253 253 253 253 253 234 234 234 242 242 242
37666 -253 253 253 253 253 253 253 253 253 253 253 253
37667 -253 253 253 253 253 253 253 253 253 253 253 253
37668 -253 253 253 253 253 253 253 253 253 253 253 253
37669 -253 253 253 253 253 253 253 253 253 224 178 62
37670 -242 186 14 241 196 14 210 166 10 22 18 6
37671 - 2 2 6 2 2 6 2 2 6 2 2 6
37672 - 2 2 6 2 2 6 6 6 6 121 92 8
37673 -238 202 15 232 195 16 82 82 82 34 34 34
37674 - 10 10 10 0 0 0 0 0 0 0 0 0
37675 - 0 0 0 0 0 0 0 0 0 0 0 0
37676 - 0 0 0 0 0 0 0 0 0 0 0 0
37677 - 0 0 0 0 0 0 0 0 0 0 0 0
37678 - 0 0 0 0 0 0 0 0 0 0 0 0
37679 - 14 14 14 38 38 38 70 70 70 154 122 46
37680 -190 142 34 200 144 11 197 138 11 197 138 11
37681 -213 154 11 226 170 11 242 186 14 246 190 14
37682 -246 190 14 246 190 14 246 190 14 246 190 14
37683 -225 175 15 46 32 6 2 2 6 22 22 22
37684 -158 158 158 250 250 250 253 253 253 253 253 253
37685 -253 253 253 253 253 253 253 253 253 253 253 253
37686 -253 253 253 253 253 253 253 253 253 253 253 253
37687 -253 253 253 253 253 253 253 253 253 253 253 253
37688 -253 253 253 253 253 253 253 253 253 253 253 253
37689 -253 253 253 250 250 250 242 242 242 224 178 62
37690 -239 182 13 236 186 11 213 154 11 46 32 6
37691 - 2 2 6 2 2 6 2 2 6 2 2 6
37692 - 2 2 6 2 2 6 61 42 6 225 175 15
37693 -238 190 10 236 186 11 112 100 78 42 42 42
37694 - 14 14 14 0 0 0 0 0 0 0 0 0
37695 - 0 0 0 0 0 0 0 0 0 0 0 0
37696 - 0 0 0 0 0 0 0 0 0 0 0 0
37697 - 0 0 0 0 0 0 0 0 0 0 0 0
37698 - 0 0 0 0 0 0 0 0 0 6 6 6
37699 - 22 22 22 54 54 54 154 122 46 213 154 11
37700 -226 170 11 230 174 11 226 170 11 226 170 11
37701 -236 178 12 242 186 14 246 190 14 246 190 14
37702 -246 190 14 246 190 14 246 190 14 246 190 14
37703 -241 196 14 184 144 12 10 10 10 2 2 6
37704 - 6 6 6 116 116 116 242 242 242 253 253 253
37705 -253 253 253 253 253 253 253 253 253 253 253 253
37706 -253 253 253 253 253 253 253 253 253 253 253 253
37707 -253 253 253 253 253 253 253 253 253 253 253 253
37708 -253 253 253 253 253 253 253 253 253 253 253 253
37709 -253 253 253 231 231 231 198 198 198 214 170 54
37710 -236 178 12 236 178 12 210 150 10 137 92 6
37711 - 18 14 6 2 2 6 2 2 6 2 2 6
37712 - 6 6 6 70 47 6 200 144 11 236 178 12
37713 -239 182 13 239 182 13 124 112 88 58 58 58
37714 - 22 22 22 6 6 6 0 0 0 0 0 0
37715 - 0 0 0 0 0 0 0 0 0 0 0 0
37716 - 0 0 0 0 0 0 0 0 0 0 0 0
37717 - 0 0 0 0 0 0 0 0 0 0 0 0
37718 - 0 0 0 0 0 0 0 0 0 10 10 10
37719 - 30 30 30 70 70 70 180 133 36 226 170 11
37720 -239 182 13 242 186 14 242 186 14 246 186 14
37721 -246 190 14 246 190 14 246 190 14 246 190 14
37722 -246 190 14 246 190 14 246 190 14 246 190 14
37723 -246 190 14 232 195 16 98 70 6 2 2 6
37724 - 2 2 6 2 2 6 66 66 66 221 221 221
37725 -253 253 253 253 253 253 253 253 253 253 253 253
37726 -253 253 253 253 253 253 253 253 253 253 253 253
37727 -253 253 253 253 253 253 253 253 253 253 253 253
37728 -253 253 253 253 253 253 253 253 253 253 253 253
37729 -253 253 253 206 206 206 198 198 198 214 166 58
37730 -230 174 11 230 174 11 216 158 10 192 133 9
37731 -163 110 8 116 81 8 102 78 10 116 81 8
37732 -167 114 7 197 138 11 226 170 11 239 182 13
37733 -242 186 14 242 186 14 162 146 94 78 78 78
37734 - 34 34 34 14 14 14 6 6 6 0 0 0
37735 - 0 0 0 0 0 0 0 0 0 0 0 0
37736 - 0 0 0 0 0 0 0 0 0 0 0 0
37737 - 0 0 0 0 0 0 0 0 0 0 0 0
37738 - 0 0 0 0 0 0 0 0 0 6 6 6
37739 - 30 30 30 78 78 78 190 142 34 226 170 11
37740 -239 182 13 246 190 14 246 190 14 246 190 14
37741 -246 190 14 246 190 14 246 190 14 246 190 14
37742 -246 190 14 246 190 14 246 190 14 246 190 14
37743 -246 190 14 241 196 14 203 166 17 22 18 6
37744 - 2 2 6 2 2 6 2 2 6 38 38 38
37745 -218 218 218 253 253 253 253 253 253 253 253 253
37746 -253 253 253 253 253 253 253 253 253 253 253 253
37747 -253 253 253 253 253 253 253 253 253 253 253 253
37748 -253 253 253 253 253 253 253 253 253 253 253 253
37749 -250 250 250 206 206 206 198 198 198 202 162 69
37750 -226 170 11 236 178 12 224 166 10 210 150 10
37751 -200 144 11 197 138 11 192 133 9 197 138 11
37752 -210 150 10 226 170 11 242 186 14 246 190 14
37753 -246 190 14 246 186 14 225 175 15 124 112 88
37754 - 62 62 62 30 30 30 14 14 14 6 6 6
37755 - 0 0 0 0 0 0 0 0 0 0 0 0
37756 - 0 0 0 0 0 0 0 0 0 0 0 0
37757 - 0 0 0 0 0 0 0 0 0 0 0 0
37758 - 0 0 0 0 0 0 0 0 0 10 10 10
37759 - 30 30 30 78 78 78 174 135 50 224 166 10
37760 -239 182 13 246 190 14 246 190 14 246 190 14
37761 -246 190 14 246 190 14 246 190 14 246 190 14
37762 -246 190 14 246 190 14 246 190 14 246 190 14
37763 -246 190 14 246 190 14 241 196 14 139 102 15
37764 - 2 2 6 2 2 6 2 2 6 2 2 6
37765 - 78 78 78 250 250 250 253 253 253 253 253 253
37766 -253 253 253 253 253 253 253 253 253 253 253 253
37767 -253 253 253 253 253 253 253 253 253 253 253 253
37768 -253 253 253 253 253 253 253 253 253 253 253 253
37769 -250 250 250 214 214 214 198 198 198 190 150 46
37770 -219 162 10 236 178 12 234 174 13 224 166 10
37771 -216 158 10 213 154 11 213 154 11 216 158 10
37772 -226 170 11 239 182 13 246 190 14 246 190 14
37773 -246 190 14 246 190 14 242 186 14 206 162 42
37774 -101 101 101 58 58 58 30 30 30 14 14 14
37775 - 6 6 6 0 0 0 0 0 0 0 0 0
37776 - 0 0 0 0 0 0 0 0 0 0 0 0
37777 - 0 0 0 0 0 0 0 0 0 0 0 0
37778 - 0 0 0 0 0 0 0 0 0 10 10 10
37779 - 30 30 30 74 74 74 174 135 50 216 158 10
37780 -236 178 12 246 190 14 246 190 14 246 190 14
37781 -246 190 14 246 190 14 246 190 14 246 190 14
37782 -246 190 14 246 190 14 246 190 14 246 190 14
37783 -246 190 14 246 190 14 241 196 14 226 184 13
37784 - 61 42 6 2 2 6 2 2 6 2 2 6
37785 - 22 22 22 238 238 238 253 253 253 253 253 253
37786 -253 253 253 253 253 253 253 253 253 253 253 253
37787 -253 253 253 253 253 253 253 253 253 253 253 253
37788 -253 253 253 253 253 253 253 253 253 253 253 253
37789 -253 253 253 226 226 226 187 187 187 180 133 36
37790 -216 158 10 236 178 12 239 182 13 236 178 12
37791 -230 174 11 226 170 11 226 170 11 230 174 11
37792 -236 178 12 242 186 14 246 190 14 246 190 14
37793 -246 190 14 246 190 14 246 186 14 239 182 13
37794 -206 162 42 106 106 106 66 66 66 34 34 34
37795 - 14 14 14 6 6 6 0 0 0 0 0 0
37796 - 0 0 0 0 0 0 0 0 0 0 0 0
37797 - 0 0 0 0 0 0 0 0 0 0 0 0
37798 - 0 0 0 0 0 0 0 0 0 6 6 6
37799 - 26 26 26 70 70 70 163 133 67 213 154 11
37800 -236 178 12 246 190 14 246 190 14 246 190 14
37801 -246 190 14 246 190 14 246 190 14 246 190 14
37802 -246 190 14 246 190 14 246 190 14 246 190 14
37803 -246 190 14 246 190 14 246 190 14 241 196 14
37804 -190 146 13 18 14 6 2 2 6 2 2 6
37805 - 46 46 46 246 246 246 253 253 253 253 253 253
37806 -253 253 253 253 253 253 253 253 253 253 253 253
37807 -253 253 253 253 253 253 253 253 253 253 253 253
37808 -253 253 253 253 253 253 253 253 253 253 253 253
37809 -253 253 253 221 221 221 86 86 86 156 107 11
37810 -216 158 10 236 178 12 242 186 14 246 186 14
37811 -242 186 14 239 182 13 239 182 13 242 186 14
37812 -242 186 14 246 186 14 246 190 14 246 190 14
37813 -246 190 14 246 190 14 246 190 14 246 190 14
37814 -242 186 14 225 175 15 142 122 72 66 66 66
37815 - 30 30 30 10 10 10 0 0 0 0 0 0
37816 - 0 0 0 0 0 0 0 0 0 0 0 0
37817 - 0 0 0 0 0 0 0 0 0 0 0 0
37818 - 0 0 0 0 0 0 0 0 0 6 6 6
37819 - 26 26 26 70 70 70 163 133 67 210 150 10
37820 -236 178 12 246 190 14 246 190 14 246 190 14
37821 -246 190 14 246 190 14 246 190 14 246 190 14
37822 -246 190 14 246 190 14 246 190 14 246 190 14
37823 -246 190 14 246 190 14 246 190 14 246 190 14
37824 -232 195 16 121 92 8 34 34 34 106 106 106
37825 -221 221 221 253 253 253 253 253 253 253 253 253
37826 -253 253 253 253 253 253 253 253 253 253 253 253
37827 -253 253 253 253 253 253 253 253 253 253 253 253
37828 -253 253 253 253 253 253 253 253 253 253 253 253
37829 -242 242 242 82 82 82 18 14 6 163 110 8
37830 -216 158 10 236 178 12 242 186 14 246 190 14
37831 -246 190 14 246 190 14 246 190 14 246 190 14
37832 -246 190 14 246 190 14 246 190 14 246 190 14
37833 -246 190 14 246 190 14 246 190 14 246 190 14
37834 -246 190 14 246 190 14 242 186 14 163 133 67
37835 - 46 46 46 18 18 18 6 6 6 0 0 0
37836 - 0 0 0 0 0 0 0 0 0 0 0 0
37837 - 0 0 0 0 0 0 0 0 0 0 0 0
37838 - 0 0 0 0 0 0 0 0 0 10 10 10
37839 - 30 30 30 78 78 78 163 133 67 210 150 10
37840 -236 178 12 246 186 14 246 190 14 246 190 14
37841 -246 190 14 246 190 14 246 190 14 246 190 14
37842 -246 190 14 246 190 14 246 190 14 246 190 14
37843 -246 190 14 246 190 14 246 190 14 246 190 14
37844 -241 196 14 215 174 15 190 178 144 253 253 253
37845 -253 253 253 253 253 253 253 253 253 253 253 253
37846 -253 253 253 253 253 253 253 253 253 253 253 253
37847 -253 253 253 253 253 253 253 253 253 253 253 253
37848 -253 253 253 253 253 253 253 253 253 218 218 218
37849 - 58 58 58 2 2 6 22 18 6 167 114 7
37850 -216 158 10 236 178 12 246 186 14 246 190 14
37851 -246 190 14 246 190 14 246 190 14 246 190 14
37852 -246 190 14 246 190 14 246 190 14 246 190 14
37853 -246 190 14 246 190 14 246 190 14 246 190 14
37854 -246 190 14 246 186 14 242 186 14 190 150 46
37855 - 54 54 54 22 22 22 6 6 6 0 0 0
37856 - 0 0 0 0 0 0 0 0 0 0 0 0
37857 - 0 0 0 0 0 0 0 0 0 0 0 0
37858 - 0 0 0 0 0 0 0 0 0 14 14 14
37859 - 38 38 38 86 86 86 180 133 36 213 154 11
37860 -236 178 12 246 186 14 246 190 14 246 190 14
37861 -246 190 14 246 190 14 246 190 14 246 190 14
37862 -246 190 14 246 190 14 246 190 14 246 190 14
37863 -246 190 14 246 190 14 246 190 14 246 190 14
37864 -246 190 14 232 195 16 190 146 13 214 214 214
37865 -253 253 253 253 253 253 253 253 253 253 253 253
37866 -253 253 253 253 253 253 253 253 253 253 253 253
37867 -253 253 253 253 253 253 253 253 253 253 253 253
37868 -253 253 253 250 250 250 170 170 170 26 26 26
37869 - 2 2 6 2 2 6 37 26 9 163 110 8
37870 -219 162 10 239 182 13 246 186 14 246 190 14
37871 -246 190 14 246 190 14 246 190 14 246 190 14
37872 -246 190 14 246 190 14 246 190 14 246 190 14
37873 -246 190 14 246 190 14 246 190 14 246 190 14
37874 -246 186 14 236 178 12 224 166 10 142 122 72
37875 - 46 46 46 18 18 18 6 6 6 0 0 0
37876 - 0 0 0 0 0 0 0 0 0 0 0 0
37877 - 0 0 0 0 0 0 0 0 0 0 0 0
37878 - 0 0 0 0 0 0 6 6 6 18 18 18
37879 - 50 50 50 109 106 95 192 133 9 224 166 10
37880 -242 186 14 246 190 14 246 190 14 246 190 14
37881 -246 190 14 246 190 14 246 190 14 246 190 14
37882 -246 190 14 246 190 14 246 190 14 246 190 14
37883 -246 190 14 246 190 14 246 190 14 246 190 14
37884 -242 186 14 226 184 13 210 162 10 142 110 46
37885 -226 226 226 253 253 253 253 253 253 253 253 253
37886 -253 253 253 253 253 253 253 253 253 253 253 253
37887 -253 253 253 253 253 253 253 253 253 253 253 253
37888 -198 198 198 66 66 66 2 2 6 2 2 6
37889 - 2 2 6 2 2 6 50 34 6 156 107 11
37890 -219 162 10 239 182 13 246 186 14 246 190 14
37891 -246 190 14 246 190 14 246 190 14 246 190 14
37892 -246 190 14 246 190 14 246 190 14 246 190 14
37893 -246 190 14 246 190 14 246 190 14 242 186 14
37894 -234 174 13 213 154 11 154 122 46 66 66 66
37895 - 30 30 30 10 10 10 0 0 0 0 0 0
37896 - 0 0 0 0 0 0 0 0 0 0 0 0
37897 - 0 0 0 0 0 0 0 0 0 0 0 0
37898 - 0 0 0 0 0 0 6 6 6 22 22 22
37899 - 58 58 58 154 121 60 206 145 10 234 174 13
37900 -242 186 14 246 186 14 246 190 14 246 190 14
37901 -246 190 14 246 190 14 246 190 14 246 190 14
37902 -246 190 14 246 190 14 246 190 14 246 190 14
37903 -246 190 14 246 190 14 246 190 14 246 190 14
37904 -246 186 14 236 178 12 210 162 10 163 110 8
37905 - 61 42 6 138 138 138 218 218 218 250 250 250
37906 -253 253 253 253 253 253 253 253 253 250 250 250
37907 -242 242 242 210 210 210 144 144 144 66 66 66
37908 - 6 6 6 2 2 6 2 2 6 2 2 6
37909 - 2 2 6 2 2 6 61 42 6 163 110 8
37910 -216 158 10 236 178 12 246 190 14 246 190 14
37911 -246 190 14 246 190 14 246 190 14 246 190 14
37912 -246 190 14 246 190 14 246 190 14 246 190 14
37913 -246 190 14 239 182 13 230 174 11 216 158 10
37914 -190 142 34 124 112 88 70 70 70 38 38 38
37915 - 18 18 18 6 6 6 0 0 0 0 0 0
37916 - 0 0 0 0 0 0 0 0 0 0 0 0
37917 - 0 0 0 0 0 0 0 0 0 0 0 0
37918 - 0 0 0 0 0 0 6 6 6 22 22 22
37919 - 62 62 62 168 124 44 206 145 10 224 166 10
37920 -236 178 12 239 182 13 242 186 14 242 186 14
37921 -246 186 14 246 190 14 246 190 14 246 190 14
37922 -246 190 14 246 190 14 246 190 14 246 190 14
37923 -246 190 14 246 190 14 246 190 14 246 190 14
37924 -246 190 14 236 178 12 216 158 10 175 118 6
37925 - 80 54 7 2 2 6 6 6 6 30 30 30
37926 - 54 54 54 62 62 62 50 50 50 38 38 38
37927 - 14 14 14 2 2 6 2 2 6 2 2 6
37928 - 2 2 6 2 2 6 2 2 6 2 2 6
37929 - 2 2 6 6 6 6 80 54 7 167 114 7
37930 -213 154 11 236 178 12 246 190 14 246 190 14
37931 -246 190 14 246 190 14 246 190 14 246 190 14
37932 -246 190 14 242 186 14 239 182 13 239 182 13
37933 -230 174 11 210 150 10 174 135 50 124 112 88
37934 - 82 82 82 54 54 54 34 34 34 18 18 18
37935 - 6 6 6 0 0 0 0 0 0 0 0 0
37936 - 0 0 0 0 0 0 0 0 0 0 0 0
37937 - 0 0 0 0 0 0 0 0 0 0 0 0
37938 - 0 0 0 0 0 0 6 6 6 18 18 18
37939 - 50 50 50 158 118 36 192 133 9 200 144 11
37940 -216 158 10 219 162 10 224 166 10 226 170 11
37941 -230 174 11 236 178 12 239 182 13 239 182 13
37942 -242 186 14 246 186 14 246 190 14 246 190 14
37943 -246 190 14 246 190 14 246 190 14 246 190 14
37944 -246 186 14 230 174 11 210 150 10 163 110 8
37945 -104 69 6 10 10 10 2 2 6 2 2 6
37946 - 2 2 6 2 2 6 2 2 6 2 2 6
37947 - 2 2 6 2 2 6 2 2 6 2 2 6
37948 - 2 2 6 2 2 6 2 2 6 2 2 6
37949 - 2 2 6 6 6 6 91 60 6 167 114 7
37950 -206 145 10 230 174 11 242 186 14 246 190 14
37951 -246 190 14 246 190 14 246 186 14 242 186 14
37952 -239 182 13 230 174 11 224 166 10 213 154 11
37953 -180 133 36 124 112 88 86 86 86 58 58 58
37954 - 38 38 38 22 22 22 10 10 10 6 6 6
37955 - 0 0 0 0 0 0 0 0 0 0 0 0
37956 - 0 0 0 0 0 0 0 0 0 0 0 0
37957 - 0 0 0 0 0 0 0 0 0 0 0 0
37958 - 0 0 0 0 0 0 0 0 0 14 14 14
37959 - 34 34 34 70 70 70 138 110 50 158 118 36
37960 -167 114 7 180 123 7 192 133 9 197 138 11
37961 -200 144 11 206 145 10 213 154 11 219 162 10
37962 -224 166 10 230 174 11 239 182 13 242 186 14
37963 -246 186 14 246 186 14 246 186 14 246 186 14
37964 -239 182 13 216 158 10 185 133 11 152 99 6
37965 -104 69 6 18 14 6 2 2 6 2 2 6
37966 - 2 2 6 2 2 6 2 2 6 2 2 6
37967 - 2 2 6 2 2 6 2 2 6 2 2 6
37968 - 2 2 6 2 2 6 2 2 6 2 2 6
37969 - 2 2 6 6 6 6 80 54 7 152 99 6
37970 -192 133 9 219 162 10 236 178 12 239 182 13
37971 -246 186 14 242 186 14 239 182 13 236 178 12
37972 -224 166 10 206 145 10 192 133 9 154 121 60
37973 - 94 94 94 62 62 62 42 42 42 22 22 22
37974 - 14 14 14 6 6 6 0 0 0 0 0 0
37975 - 0 0 0 0 0 0 0 0 0 0 0 0
37976 - 0 0 0 0 0 0 0 0 0 0 0 0
37977 - 0 0 0 0 0 0 0 0 0 0 0 0
37978 - 0 0 0 0 0 0 0 0 0 6 6 6
37979 - 18 18 18 34 34 34 58 58 58 78 78 78
37980 -101 98 89 124 112 88 142 110 46 156 107 11
37981 -163 110 8 167 114 7 175 118 6 180 123 7
37982 -185 133 11 197 138 11 210 150 10 219 162 10
37983 -226 170 11 236 178 12 236 178 12 234 174 13
37984 -219 162 10 197 138 11 163 110 8 130 83 6
37985 - 91 60 6 10 10 10 2 2 6 2 2 6
37986 - 18 18 18 38 38 38 38 38 38 38 38 38
37987 - 38 38 38 38 38 38 38 38 38 38 38 38
37988 - 38 38 38 38 38 38 26 26 26 2 2 6
37989 - 2 2 6 6 6 6 70 47 6 137 92 6
37990 -175 118 6 200 144 11 219 162 10 230 174 11
37991 -234 174 13 230 174 11 219 162 10 210 150 10
37992 -192 133 9 163 110 8 124 112 88 82 82 82
37993 - 50 50 50 30 30 30 14 14 14 6 6 6
37994 - 0 0 0 0 0 0 0 0 0 0 0 0
37995 - 0 0 0 0 0 0 0 0 0 0 0 0
37996 - 0 0 0 0 0 0 0 0 0 0 0 0
37997 - 0 0 0 0 0 0 0 0 0 0 0 0
37998 - 0 0 0 0 0 0 0 0 0 0 0 0
37999 - 6 6 6 14 14 14 22 22 22 34 34 34
38000 - 42 42 42 58 58 58 74 74 74 86 86 86
38001 -101 98 89 122 102 70 130 98 46 121 87 25
38002 -137 92 6 152 99 6 163 110 8 180 123 7
38003 -185 133 11 197 138 11 206 145 10 200 144 11
38004 -180 123 7 156 107 11 130 83 6 104 69 6
38005 - 50 34 6 54 54 54 110 110 110 101 98 89
38006 - 86 86 86 82 82 82 78 78 78 78 78 78
38007 - 78 78 78 78 78 78 78 78 78 78 78 78
38008 - 78 78 78 82 82 82 86 86 86 94 94 94
38009 -106 106 106 101 101 101 86 66 34 124 80 6
38010 -156 107 11 180 123 7 192 133 9 200 144 11
38011 -206 145 10 200 144 11 192 133 9 175 118 6
38012 -139 102 15 109 106 95 70 70 70 42 42 42
38013 - 22 22 22 10 10 10 0 0 0 0 0 0
38014 - 0 0 0 0 0 0 0 0 0 0 0 0
38015 - 0 0 0 0 0 0 0 0 0 0 0 0
38016 - 0 0 0 0 0 0 0 0 0 0 0 0
38017 - 0 0 0 0 0 0 0 0 0 0 0 0
38018 - 0 0 0 0 0 0 0 0 0 0 0 0
38019 - 0 0 0 0 0 0 6 6 6 10 10 10
38020 - 14 14 14 22 22 22 30 30 30 38 38 38
38021 - 50 50 50 62 62 62 74 74 74 90 90 90
38022 -101 98 89 112 100 78 121 87 25 124 80 6
38023 -137 92 6 152 99 6 152 99 6 152 99 6
38024 -138 86 6 124 80 6 98 70 6 86 66 30
38025 -101 98 89 82 82 82 58 58 58 46 46 46
38026 - 38 38 38 34 34 34 34 34 34 34 34 34
38027 - 34 34 34 34 34 34 34 34 34 34 34 34
38028 - 34 34 34 34 34 34 38 38 38 42 42 42
38029 - 54 54 54 82 82 82 94 86 76 91 60 6
38030 -134 86 6 156 107 11 167 114 7 175 118 6
38031 -175 118 6 167 114 7 152 99 6 121 87 25
38032 -101 98 89 62 62 62 34 34 34 18 18 18
38033 - 6 6 6 0 0 0 0 0 0 0 0 0
38034 - 0 0 0 0 0 0 0 0 0 0 0 0
38035 - 0 0 0 0 0 0 0 0 0 0 0 0
38036 - 0 0 0 0 0 0 0 0 0 0 0 0
38037 - 0 0 0 0 0 0 0 0 0 0 0 0
38038 - 0 0 0 0 0 0 0 0 0 0 0 0
38039 - 0 0 0 0 0 0 0 0 0 0 0 0
38040 - 0 0 0 6 6 6 6 6 6 10 10 10
38041 - 18 18 18 22 22 22 30 30 30 42 42 42
38042 - 50 50 50 66 66 66 86 86 86 101 98 89
38043 -106 86 58 98 70 6 104 69 6 104 69 6
38044 -104 69 6 91 60 6 82 62 34 90 90 90
38045 - 62 62 62 38 38 38 22 22 22 14 14 14
38046 - 10 10 10 10 10 10 10 10 10 10 10 10
38047 - 10 10 10 10 10 10 6 6 6 10 10 10
38048 - 10 10 10 10 10 10 10 10 10 14 14 14
38049 - 22 22 22 42 42 42 70 70 70 89 81 66
38050 - 80 54 7 104 69 6 124 80 6 137 92 6
38051 -134 86 6 116 81 8 100 82 52 86 86 86
38052 - 58 58 58 30 30 30 14 14 14 6 6 6
38053 - 0 0 0 0 0 0 0 0 0 0 0 0
38054 - 0 0 0 0 0 0 0 0 0 0 0 0
38055 - 0 0 0 0 0 0 0 0 0 0 0 0
38056 - 0 0 0 0 0 0 0 0 0 0 0 0
38057 - 0 0 0 0 0 0 0 0 0 0 0 0
38058 - 0 0 0 0 0 0 0 0 0 0 0 0
38059 - 0 0 0 0 0 0 0 0 0 0 0 0
38060 - 0 0 0 0 0 0 0 0 0 0 0 0
38061 - 0 0 0 6 6 6 10 10 10 14 14 14
38062 - 18 18 18 26 26 26 38 38 38 54 54 54
38063 - 70 70 70 86 86 86 94 86 76 89 81 66
38064 - 89 81 66 86 86 86 74 74 74 50 50 50
38065 - 30 30 30 14 14 14 6 6 6 0 0 0
38066 - 0 0 0 0 0 0 0 0 0 0 0 0
38067 - 0 0 0 0 0 0 0 0 0 0 0 0
38068 - 0 0 0 0 0 0 0 0 0 0 0 0
38069 - 6 6 6 18 18 18 34 34 34 58 58 58
38070 - 82 82 82 89 81 66 89 81 66 89 81 66
38071 - 94 86 66 94 86 76 74 74 74 50 50 50
38072 - 26 26 26 14 14 14 6 6 6 0 0 0
38073 - 0 0 0 0 0 0 0 0 0 0 0 0
38074 - 0 0 0 0 0 0 0 0 0 0 0 0
38075 - 0 0 0 0 0 0 0 0 0 0 0 0
38076 - 0 0 0 0 0 0 0 0 0 0 0 0
38077 - 0 0 0 0 0 0 0 0 0 0 0 0
38078 - 0 0 0 0 0 0 0 0 0 0 0 0
38079 - 0 0 0 0 0 0 0 0 0 0 0 0
38080 - 0 0 0 0 0 0 0 0 0 0 0 0
38081 - 0 0 0 0 0 0 0 0 0 0 0 0
38082 - 6 6 6 6 6 6 14 14 14 18 18 18
38083 - 30 30 30 38 38 38 46 46 46 54 54 54
38084 - 50 50 50 42 42 42 30 30 30 18 18 18
38085 - 10 10 10 0 0 0 0 0 0 0 0 0
38086 - 0 0 0 0 0 0 0 0 0 0 0 0
38087 - 0 0 0 0 0 0 0 0 0 0 0 0
38088 - 0 0 0 0 0 0 0 0 0 0 0 0
38089 - 0 0 0 6 6 6 14 14 14 26 26 26
38090 - 38 38 38 50 50 50 58 58 58 58 58 58
38091 - 54 54 54 42 42 42 30 30 30 18 18 18
38092 - 10 10 10 0 0 0 0 0 0 0 0 0
38093 - 0 0 0 0 0 0 0 0 0 0 0 0
38094 - 0 0 0 0 0 0 0 0 0 0 0 0
38095 - 0 0 0 0 0 0 0 0 0 0 0 0
38096 - 0 0 0 0 0 0 0 0 0 0 0 0
38097 - 0 0 0 0 0 0 0 0 0 0 0 0
38098 - 0 0 0 0 0 0 0 0 0 0 0 0
38099 - 0 0 0 0 0 0 0 0 0 0 0 0
38100 - 0 0 0 0 0 0 0 0 0 0 0 0
38101 - 0 0 0 0 0 0 0 0 0 0 0 0
38102 - 0 0 0 0 0 0 0 0 0 6 6 6
38103 - 6 6 6 10 10 10 14 14 14 18 18 18
38104 - 18 18 18 14 14 14 10 10 10 6 6 6
38105 - 0 0 0 0 0 0 0 0 0 0 0 0
38106 - 0 0 0 0 0 0 0 0 0 0 0 0
38107 - 0 0 0 0 0 0 0 0 0 0 0 0
38108 - 0 0 0 0 0 0 0 0 0 0 0 0
38109 - 0 0 0 0 0 0 0 0 0 6 6 6
38110 - 14 14 14 18 18 18 22 22 22 22 22 22
38111 - 18 18 18 14 14 14 10 10 10 6 6 6
38112 - 0 0 0 0 0 0 0 0 0 0 0 0
38113 - 0 0 0 0 0 0 0 0 0 0 0 0
38114 - 0 0 0 0 0 0 0 0 0 0 0 0
38115 - 0 0 0 0 0 0 0 0 0 0 0 0
38116 - 0 0 0 0 0 0 0 0 0 0 0 0
38117 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38118 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38119 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38120 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38121 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38122 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38123 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38124 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38125 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38126 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38127 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38128 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38129 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38130 +4 4 4 4 4 4
38131 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38132 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38133 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38134 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38135 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38136 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38137 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38138 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38139 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38140 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38141 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38142 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38143 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38144 +4 4 4 4 4 4
38145 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38146 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38147 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38148 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38149 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38150 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38151 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38152 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38153 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38154 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38155 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38156 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38157 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38158 +4 4 4 4 4 4
38159 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38160 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38161 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38162 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38163 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38164 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38165 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38166 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38167 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38168 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38169 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38170 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38171 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38172 +4 4 4 4 4 4
38173 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38174 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38175 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38176 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38177 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38178 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38179 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38180 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38181 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38182 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38183 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38184 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38185 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38186 +4 4 4 4 4 4
38187 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38188 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38189 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38190 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38191 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38192 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38193 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38194 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38195 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38196 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38197 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38198 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38199 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38200 +4 4 4 4 4 4
38201 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38202 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38203 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38204 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38205 +4 4 4 4 4 4 4 4 4 3 3 3 0 0 0 0 0 0
38206 +0 0 0 0 0 0 0 0 0 0 0 0 3 3 3 4 4 4
38207 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38208 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38209 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38210 +4 4 4 4 4 4 4 4 4 4 4 4 1 1 1 0 0 0
38211 +0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
38212 +4 4 4 4 4 4 4 4 4 2 1 0 2 1 0 3 2 2
38213 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38214 +4 4 4 4 4 4
38215 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38216 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38217 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38218 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38219 +4 4 4 4 4 4 2 2 2 0 0 0 3 4 3 26 28 28
38220 +37 38 37 37 38 37 14 17 19 2 2 2 0 0 0 2 2 2
38221 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38222 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38223 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38224 +4 4 4 4 4 4 3 3 3 0 0 0 1 1 1 6 6 6
38225 +2 2 2 0 0 0 3 3 3 4 4 4 4 4 4 4 4 4
38226 +4 4 5 3 3 3 1 0 0 0 0 0 1 0 0 0 0 0
38227 +1 1 1 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38228 +4 4 4 4 4 4
38229 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38230 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38231 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38232 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38233 +2 2 2 0 0 0 0 0 0 14 17 19 60 74 84 137 136 137
38234 +153 152 153 137 136 137 125 124 125 60 73 81 6 6 6 3 1 0
38235 +0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
38236 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38237 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38238 +4 4 4 4 4 4 0 0 0 4 4 4 41 54 63 125 124 125
38239 +60 73 81 6 6 6 4 0 0 3 3 3 4 4 4 4 4 4
38240 +4 4 4 0 0 0 6 9 11 41 54 63 41 65 82 22 30 35
38241 +2 2 2 2 1 0 4 4 4 4 4 4 4 4 4 4 4 4
38242 +4 4 4 4 4 4
38243 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38244 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38245 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38246 +4 4 4 4 4 4 5 5 5 5 5 5 2 2 2 0 0 0
38247 +4 0 0 6 6 6 41 54 63 137 136 137 174 174 174 167 166 167
38248 +165 164 165 165 164 165 163 162 163 163 162 163 125 124 125 41 54 63
38249 +1 1 1 0 0 0 0 0 0 3 3 3 5 5 5 4 4 4
38250 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38251 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
38252 +3 3 3 2 0 0 4 0 0 60 73 81 156 155 156 167 166 167
38253 +163 162 163 85 115 134 5 7 8 0 0 0 4 4 4 5 5 5
38254 +0 0 0 2 5 5 55 98 126 90 154 193 90 154 193 72 125 159
38255 +37 51 59 2 0 0 1 1 1 4 5 5 4 4 4 4 4 4
38256 +4 4 4 4 4 4
38257 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38258 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38259 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38260 +4 4 4 5 5 5 4 4 4 1 1 1 0 0 0 3 3 3
38261 +37 38 37 125 124 125 163 162 163 174 174 174 158 157 158 158 157 158
38262 +156 155 156 156 155 156 158 157 158 165 164 165 174 174 174 166 165 166
38263 +125 124 125 16 19 21 1 0 0 0 0 0 0 0 0 4 4 4
38264 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
38265 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 1 1 1
38266 +0 0 0 0 0 0 37 38 37 153 152 153 174 174 174 158 157 158
38267 +174 174 174 163 162 163 37 38 37 4 3 3 4 0 0 1 1 1
38268 +0 0 0 22 40 52 101 161 196 101 161 196 90 154 193 101 161 196
38269 +64 123 161 14 17 19 0 0 0 4 4 4 4 4 4 4 4 4
38270 +4 4 4 4 4 4
38271 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38272 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38273 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
38274 +5 5 5 2 2 2 0 0 0 4 0 0 24 26 27 85 115 134
38275 +156 155 156 174 174 174 167 166 167 156 155 156 154 153 154 157 156 157
38276 +156 155 156 156 155 156 155 154 155 153 152 153 158 157 158 167 166 167
38277 +174 174 174 156 155 156 60 74 84 16 19 21 0 0 0 0 0 0
38278 +1 1 1 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
38279 +4 4 4 5 5 5 6 6 6 3 3 3 0 0 0 4 0 0
38280 +13 16 17 60 73 81 137 136 137 165 164 165 156 155 156 153 152 153
38281 +174 174 174 177 184 187 60 73 81 3 1 0 0 0 0 1 1 2
38282 +22 30 35 64 123 161 136 185 209 90 154 193 90 154 193 90 154 193
38283 +90 154 193 21 29 34 0 0 0 3 2 2 4 4 5 4 4 4
38284 +4 4 4 4 4 4
38285 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38286 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38287 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 3 3 3
38288 +0 0 0 0 0 0 10 13 16 60 74 84 157 156 157 174 174 174
38289 +174 174 174 158 157 158 153 152 153 154 153 154 156 155 156 155 154 155
38290 +156 155 156 155 154 155 154 153 154 157 156 157 154 153 154 153 152 153
38291 +163 162 163 174 174 174 177 184 187 137 136 137 60 73 81 13 16 17
38292 +4 0 0 0 0 0 3 3 3 5 5 5 4 4 4 4 4 4
38293 +5 5 5 4 4 4 1 1 1 0 0 0 3 3 3 41 54 63
38294 +131 129 131 174 174 174 174 174 174 174 174 174 167 166 167 174 174 174
38295 +190 197 201 137 136 137 24 26 27 4 0 0 16 21 25 50 82 103
38296 +90 154 193 136 185 209 90 154 193 101 161 196 101 161 196 101 161 196
38297 +31 91 132 3 6 7 0 0 0 4 4 4 4 4 4 4 4 4
38298 +4 4 4 4 4 4
38299 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38300 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38301 +4 4 4 4 4 4 4 4 4 2 2 2 0 0 0 4 0 0
38302 +4 0 0 43 57 68 137 136 137 177 184 187 174 174 174 163 162 163
38303 +155 154 155 155 154 155 156 155 156 155 154 155 158 157 158 165 164 165
38304 +167 166 167 166 165 166 163 162 163 157 156 157 155 154 155 155 154 155
38305 +153 152 153 156 155 156 167 166 167 174 174 174 174 174 174 131 129 131
38306 +41 54 63 5 5 5 0 0 0 0 0 0 3 3 3 4 4 4
38307 +1 1 1 0 0 0 1 0 0 26 28 28 125 124 125 174 174 174
38308 +177 184 187 174 174 174 174 174 174 156 155 156 131 129 131 137 136 137
38309 +125 124 125 24 26 27 4 0 0 41 65 82 90 154 193 136 185 209
38310 +136 185 209 101 161 196 53 118 160 37 112 160 90 154 193 34 86 122
38311 +7 12 15 0 0 0 4 4 4 4 4 4 4 4 4 4 4 4
38312 +4 4 4 4 4 4
38313 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38314 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38315 +4 4 4 3 3 3 0 0 0 0 0 0 5 5 5 37 38 37
38316 +125 124 125 167 166 167 174 174 174 167 166 167 158 157 158 155 154 155
38317 +156 155 156 156 155 156 156 155 156 163 162 163 167 166 167 155 154 155
38318 +137 136 137 153 152 153 156 155 156 165 164 165 163 162 163 156 155 156
38319 +156 155 156 156 155 156 155 154 155 158 157 158 166 165 166 174 174 174
38320 +167 166 167 125 124 125 37 38 37 1 0 0 0 0 0 0 0 0
38321 +0 0 0 24 26 27 60 74 84 158 157 158 174 174 174 174 174 174
38322 +166 165 166 158 157 158 125 124 125 41 54 63 13 16 17 6 6 6
38323 +6 6 6 37 38 37 80 127 157 136 185 209 101 161 196 101 161 196
38324 +90 154 193 28 67 93 6 10 14 13 20 25 13 20 25 6 10 14
38325 +1 1 2 4 3 3 4 4 4 4 4 4 4 4 4 4 4 4
38326 +4 4 4 4 4 4
38327 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38328 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38329 +1 1 1 1 0 0 4 3 3 37 38 37 60 74 84 153 152 153
38330 +167 166 167 167 166 167 158 157 158 154 153 154 155 154 155 156 155 156
38331 +157 156 157 158 157 158 167 166 167 167 166 167 131 129 131 43 57 68
38332 +26 28 28 37 38 37 60 73 81 131 129 131 165 164 165 166 165 166
38333 +158 157 158 155 154 155 156 155 156 156 155 156 156 155 156 158 157 158
38334 +165 164 165 174 174 174 163 162 163 60 74 84 16 19 21 13 16 17
38335 +60 73 81 131 129 131 174 174 174 174 174 174 167 166 167 165 164 165
38336 +137 136 137 60 73 81 24 26 27 4 0 0 4 0 0 16 19 21
38337 +52 104 138 101 161 196 136 185 209 136 185 209 90 154 193 27 99 146
38338 +13 20 25 4 5 7 2 5 5 4 5 7 1 1 2 0 0 0
38339 +4 4 4 4 4 4 3 3 3 2 2 2 2 2 2 4 4 4
38340 +4 4 4 4 4 4
38341 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38342 +4 4 4 4 4 4 4 4 4 4 4 4 3 3 3 0 0 0
38343 +0 0 0 13 16 17 60 73 81 137 136 137 174 174 174 166 165 166
38344 +158 157 158 156 155 156 157 156 157 156 155 156 155 154 155 158 157 158
38345 +167 166 167 174 174 174 153 152 153 60 73 81 16 19 21 4 0 0
38346 +4 0 0 4 0 0 6 6 6 26 28 28 60 74 84 158 157 158
38347 +174 174 174 166 165 166 157 156 157 155 154 155 156 155 156 156 155 156
38348 +155 154 155 158 157 158 167 166 167 167 166 167 131 129 131 125 124 125
38349 +137 136 137 167 166 167 167 166 167 174 174 174 158 157 158 125 124 125
38350 +16 19 21 4 0 0 4 0 0 10 13 16 49 76 92 107 159 188
38351 +136 185 209 136 185 209 90 154 193 26 108 161 22 40 52 6 10 14
38352 +2 3 3 1 1 2 1 1 2 4 4 5 4 4 5 4 4 5
38353 +4 4 5 2 2 1 0 0 0 0 0 0 0 0 0 2 2 2
38354 +4 4 4 4 4 4
38355 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38356 +4 4 4 5 5 5 3 3 3 0 0 0 1 0 0 4 0 0
38357 +37 51 59 131 129 131 167 166 167 167 166 167 163 162 163 157 156 157
38358 +157 156 157 155 154 155 153 152 153 157 156 157 167 166 167 174 174 174
38359 +153 152 153 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
38360 +4 3 3 4 3 3 4 0 0 6 6 6 4 0 0 37 38 37
38361 +125 124 125 174 174 174 174 174 174 165 164 165 156 155 156 154 153 154
38362 +156 155 156 156 155 156 155 154 155 163 162 163 158 157 158 163 162 163
38363 +174 174 174 174 174 174 174 174 174 125 124 125 37 38 37 0 0 0
38364 +4 0 0 6 9 11 41 54 63 90 154 193 136 185 209 146 190 211
38365 +136 185 209 37 112 160 22 40 52 6 10 14 3 6 7 1 1 2
38366 +1 1 2 3 3 3 1 1 2 3 3 3 4 4 4 4 4 4
38367 +2 2 2 2 0 0 16 19 21 37 38 37 24 26 27 0 0 0
38368 +0 0 0 4 4 4
38369 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
38370 +4 4 4 0 0 0 0 0 0 0 0 0 26 28 28 120 125 127
38371 +158 157 158 174 174 174 165 164 165 157 156 157 155 154 155 156 155 156
38372 +153 152 153 153 152 153 167 166 167 174 174 174 174 174 174 125 124 125
38373 +37 38 37 4 0 0 0 0 0 4 0 0 4 3 3 4 4 4
38374 +4 4 4 4 4 4 5 5 5 4 0 0 4 0 0 4 0 0
38375 +4 3 3 43 57 68 137 136 137 174 174 174 174 174 174 165 164 165
38376 +154 153 154 153 152 153 153 152 153 153 152 153 163 162 163 174 174 174
38377 +174 174 174 153 152 153 60 73 81 6 6 6 4 0 0 4 3 3
38378 +32 43 50 80 127 157 136 185 209 146 190 211 146 190 211 90 154 193
38379 +28 67 93 28 67 93 40 71 93 3 6 7 1 1 2 2 5 5
38380 +50 82 103 79 117 143 26 37 45 0 0 0 3 3 3 1 1 1
38381 +0 0 0 41 54 63 137 136 137 174 174 174 153 152 153 60 73 81
38382 +2 0 0 0 0 0
38383 +4 4 4 4 4 4 4 4 4 4 4 4 6 6 6 2 2 2
38384 +0 0 0 2 0 0 24 26 27 60 74 84 153 152 153 174 174 174
38385 +174 174 174 157 156 157 154 153 154 156 155 156 154 153 154 153 152 153
38386 +165 164 165 174 174 174 177 184 187 137 136 137 43 57 68 6 6 6
38387 +4 0 0 2 0 0 3 3 3 5 5 5 5 5 5 4 4 4
38388 +4 4 4 4 4 4 4 4 4 5 5 5 6 6 6 4 3 3
38389 +4 0 0 4 0 0 24 26 27 60 73 81 153 152 153 174 174 174
38390 +174 174 174 158 157 158 158 157 158 174 174 174 174 174 174 158 157 158
38391 +60 74 84 24 26 27 4 0 0 4 0 0 17 23 27 59 113 148
38392 +136 185 209 191 222 234 146 190 211 136 185 209 31 91 132 7 11 13
38393 +22 40 52 101 161 196 90 154 193 6 9 11 3 4 4 43 95 132
38394 +136 185 209 172 205 220 55 98 126 0 0 0 0 0 0 2 0 0
38395 +26 28 28 153 152 153 177 184 187 167 166 167 177 184 187 165 164 165
38396 +37 38 37 0 0 0
38397 +4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
38398 +13 16 17 60 73 81 137 136 137 174 174 174 174 174 174 165 164 165
38399 +153 152 153 153 152 153 155 154 155 154 153 154 158 157 158 174 174 174
38400 +177 184 187 163 162 163 60 73 81 16 19 21 4 0 0 4 0 0
38401 +4 3 3 4 4 4 5 5 5 5 5 5 4 4 4 5 5 5
38402 +5 5 5 5 5 5 5 5 5 4 4 4 4 4 4 5 5 5
38403 +6 6 6 4 0 0 4 0 0 4 0 0 24 26 27 60 74 84
38404 +166 165 166 174 174 174 177 184 187 165 164 165 125 124 125 24 26 27
38405 +4 0 0 4 0 0 5 5 5 50 82 103 136 185 209 172 205 220
38406 +146 190 211 136 185 209 26 108 161 22 40 52 7 12 15 44 81 103
38407 +71 116 144 28 67 93 37 51 59 41 65 82 100 139 164 101 161 196
38408 +90 154 193 90 154 193 28 67 93 0 0 0 0 0 0 26 28 28
38409 +125 124 125 167 166 167 163 162 163 153 152 153 163 162 163 174 174 174
38410 +85 115 134 4 0 0
38411 +4 4 4 5 5 5 4 4 4 1 0 0 4 0 0 34 47 55
38412 +125 124 125 174 174 174 174 174 174 167 166 167 157 156 157 153 152 153
38413 +155 154 155 155 154 155 158 157 158 166 165 166 167 166 167 154 153 154
38414 +125 124 125 26 28 28 4 0 0 4 0 0 4 0 0 5 5 5
38415 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 1 1 1
38416 +0 0 0 0 0 0 1 1 1 4 4 4 4 4 4 4 4 4
38417 +5 5 5 5 5 5 4 3 3 4 0 0 4 0 0 6 6 6
38418 +37 38 37 131 129 131 137 136 137 37 38 37 0 0 0 4 0 0
38419 +4 5 5 43 61 72 90 154 193 172 205 220 146 190 211 136 185 209
38420 +90 154 193 28 67 93 13 20 25 43 61 72 71 116 144 44 81 103
38421 +2 5 5 7 11 13 59 113 148 101 161 196 90 154 193 28 67 93
38422 +13 20 25 6 10 14 0 0 0 13 16 17 60 73 81 137 136 137
38423 +166 165 166 158 157 158 156 155 156 154 153 154 167 166 167 174 174 174
38424 +60 73 81 4 0 0
38425 +4 4 4 4 4 4 0 0 0 3 3 3 60 74 84 174 174 174
38426 +174 174 174 167 166 167 163 162 163 155 154 155 157 156 157 155 154 155
38427 +156 155 156 163 162 163 167 166 167 158 157 158 125 124 125 37 38 37
38428 +4 3 3 4 0 0 4 0 0 6 6 6 6 6 6 5 5 5
38429 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 2 3 3
38430 +10 13 16 7 11 13 1 0 0 0 0 0 2 2 1 4 4 4
38431 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 4 0 0
38432 +4 0 0 7 11 13 13 16 17 4 0 0 3 3 3 34 47 55
38433 +80 127 157 146 190 211 172 205 220 136 185 209 136 185 209 136 185 209
38434 +28 67 93 22 40 52 55 98 126 55 98 126 21 29 34 7 11 13
38435 +50 82 103 101 161 196 101 161 196 35 83 115 13 20 25 2 2 1
38436 +1 1 2 1 1 2 37 51 59 131 129 131 174 174 174 174 174 174
38437 +167 166 167 163 162 163 163 162 163 167 166 167 174 174 174 125 124 125
38438 +16 19 21 4 0 0
38439 +4 4 4 4 0 0 4 0 0 60 74 84 174 174 174 174 174 174
38440 +158 157 158 155 154 155 155 154 155 156 155 156 155 154 155 158 157 158
38441 +167 166 167 165 164 165 131 129 131 60 73 81 13 16 17 4 0 0
38442 +4 0 0 4 3 3 6 6 6 4 3 3 5 5 5 4 4 4
38443 +4 4 4 3 2 2 0 0 0 0 0 0 7 11 13 45 69 86
38444 +80 127 157 71 116 144 43 61 72 7 11 13 0 0 0 1 1 1
38445 +4 3 3 4 4 4 4 4 4 4 4 4 6 6 6 5 5 5
38446 +3 2 2 4 0 0 1 0 0 21 29 34 59 113 148 136 185 209
38447 +146 190 211 136 185 209 136 185 209 136 185 209 136 185 209 136 185 209
38448 +68 124 159 44 81 103 22 40 52 13 16 17 43 61 72 90 154 193
38449 +136 185 209 59 113 148 21 29 34 3 4 3 1 1 1 0 0 0
38450 +24 26 27 125 124 125 163 162 163 174 174 174 166 165 166 165 164 165
38451 +163 162 163 125 124 125 125 124 125 125 124 125 125 124 125 26 28 28
38452 +4 0 0 4 3 3
38453 +3 3 3 0 0 0 24 26 27 153 152 153 177 184 187 158 157 158
38454 +156 155 156 156 155 156 155 154 155 155 154 155 165 164 165 174 174 174
38455 +155 154 155 60 74 84 26 28 28 4 0 0 4 0 0 3 1 0
38456 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 3 3
38457 +2 0 0 0 0 0 0 0 0 32 43 50 72 125 159 101 161 196
38458 +136 185 209 101 161 196 101 161 196 79 117 143 32 43 50 0 0 0
38459 +0 0 0 2 2 2 4 4 4 4 4 4 3 3 3 1 0 0
38460 +0 0 0 4 5 5 49 76 92 101 161 196 146 190 211 146 190 211
38461 +136 185 209 136 185 209 136 185 209 136 185 209 136 185 209 90 154 193
38462 +28 67 93 13 16 17 37 51 59 80 127 157 136 185 209 90 154 193
38463 +22 40 52 6 9 11 3 4 3 2 2 1 16 19 21 60 73 81
38464 +137 136 137 163 162 163 158 157 158 166 165 166 167 166 167 153 152 153
38465 +60 74 84 37 38 37 6 6 6 13 16 17 4 0 0 1 0 0
38466 +3 2 2 4 4 4
38467 +3 2 2 4 0 0 37 38 37 137 136 137 167 166 167 158 157 158
38468 +157 156 157 154 153 154 157 156 157 167 166 167 174 174 174 125 124 125
38469 +37 38 37 4 0 0 4 0 0 4 0 0 4 3 3 4 4 4
38470 +4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
38471 +0 0 0 16 21 25 55 98 126 90 154 193 136 185 209 101 161 196
38472 +101 161 196 101 161 196 136 185 209 136 185 209 101 161 196 55 98 126
38473 +14 17 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
38474 +22 40 52 90 154 193 146 190 211 146 190 211 136 185 209 136 185 209
38475 +136 185 209 136 185 209 136 185 209 101 161 196 35 83 115 7 11 13
38476 +17 23 27 59 113 148 136 185 209 101 161 196 34 86 122 7 12 15
38477 +2 5 5 3 4 3 6 6 6 60 73 81 131 129 131 163 162 163
38478 +166 165 166 174 174 174 174 174 174 163 162 163 125 124 125 41 54 63
38479 +13 16 17 4 0 0 4 0 0 4 0 0 1 0 0 2 2 2
38480 +4 4 4 4 4 4
38481 +1 1 1 2 1 0 43 57 68 137 136 137 153 152 153 153 152 153
38482 +163 162 163 156 155 156 165 164 165 167 166 167 60 74 84 6 6 6
38483 +4 0 0 4 0 0 5 5 5 4 4 4 4 4 4 4 4 4
38484 +4 5 5 6 6 6 4 3 3 0 0 0 0 0 0 11 15 18
38485 +40 71 93 100 139 164 101 161 196 101 161 196 101 161 196 101 161 196
38486 +101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 136 185 209
38487 +101 161 196 45 69 86 6 6 6 0 0 0 17 23 27 55 98 126
38488 +136 185 209 146 190 211 136 185 209 136 185 209 136 185 209 136 185 209
38489 +136 185 209 136 185 209 90 154 193 22 40 52 7 11 13 50 82 103
38490 +136 185 209 136 185 209 53 118 160 22 40 52 7 11 13 2 5 5
38491 +3 4 3 37 38 37 125 124 125 157 156 157 166 165 166 167 166 167
38492 +174 174 174 174 174 174 137 136 137 60 73 81 4 0 0 4 0 0
38493 +4 0 0 4 0 0 5 5 5 3 3 3 3 3 3 4 4 4
38494 +4 4 4 4 4 4
38495 +4 0 0 4 0 0 41 54 63 137 136 137 125 124 125 131 129 131
38496 +155 154 155 167 166 167 174 174 174 60 74 84 6 6 6 4 0 0
38497 +4 3 3 6 6 6 4 4 4 4 4 4 4 4 4 5 5 5
38498 +4 4 4 1 1 1 0 0 0 3 6 7 41 65 82 72 125 159
38499 +101 161 196 101 161 196 101 161 196 90 154 193 90 154 193 101 161 196
38500 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
38501 +136 185 209 136 185 209 80 127 157 55 98 126 101 161 196 146 190 211
38502 +136 185 209 136 185 209 136 185 209 101 161 196 136 185 209 101 161 196
38503 +136 185 209 101 161 196 35 83 115 22 30 35 101 161 196 172 205 220
38504 +90 154 193 28 67 93 7 11 13 2 5 5 3 4 3 13 16 17
38505 +85 115 134 167 166 167 174 174 174 174 174 174 174 174 174 174 174 174
38506 +167 166 167 60 74 84 13 16 17 4 0 0 4 0 0 4 3 3
38507 +6 6 6 5 5 5 4 4 4 5 5 5 4 4 4 5 5 5
38508 +5 5 5 5 5 5
38509 +1 1 1 4 0 0 41 54 63 137 136 137 137 136 137 125 124 125
38510 +131 129 131 167 166 167 157 156 157 37 38 37 6 6 6 4 0 0
38511 +6 6 6 5 5 5 4 4 4 4 4 4 4 5 5 2 2 1
38512 +0 0 0 0 0 0 26 37 45 58 111 146 101 161 196 101 161 196
38513 +101 161 196 90 154 193 90 154 193 90 154 193 101 161 196 101 161 196
38514 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
38515 +101 161 196 136 185 209 136 185 209 136 185 209 146 190 211 136 185 209
38516 +136 185 209 101 161 196 136 185 209 136 185 209 101 161 196 136 185 209
38517 +101 161 196 136 185 209 136 185 209 136 185 209 136 185 209 16 89 141
38518 +7 11 13 2 5 5 2 5 5 13 16 17 60 73 81 154 154 154
38519 +174 174 174 174 174 174 174 174 174 174 174 174 163 162 163 125 124 125
38520 +24 26 27 4 0 0 4 0 0 4 0 0 5 5 5 5 5 5
38521 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
38522 +5 5 5 4 4 4
38523 +4 0 0 6 6 6 37 38 37 137 136 137 137 136 137 131 129 131
38524 +131 129 131 153 152 153 131 129 131 26 28 28 4 0 0 4 3 3
38525 +6 6 6 4 4 4 4 4 4 4 4 4 0 0 0 0 0 0
38526 +13 20 25 51 88 114 90 154 193 101 161 196 101 161 196 90 154 193
38527 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
38528 +101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 101 161 196
38529 +101 161 196 136 185 209 101 161 196 136 185 209 136 185 209 101 161 196
38530 +136 185 209 101 161 196 136 185 209 101 161 196 101 161 196 101 161 196
38531 +136 185 209 136 185 209 136 185 209 37 112 160 21 29 34 5 7 8
38532 +2 5 5 13 16 17 43 57 68 131 129 131 174 174 174 174 174 174
38533 +174 174 174 167 166 167 157 156 157 125 124 125 37 38 37 4 0 0
38534 +4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
38535 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38536 +4 4 4 4 4 4
38537 +1 1 1 4 0 0 41 54 63 153 152 153 137 136 137 137 136 137
38538 +137 136 137 153 152 153 125 124 125 24 26 27 4 0 0 3 2 2
38539 +4 4 4 4 4 4 4 3 3 4 0 0 3 6 7 43 61 72
38540 +64 123 161 101 161 196 90 154 193 90 154 193 90 154 193 90 154 193
38541 +90 154 193 90 154 193 90 154 193 90 154 193 101 161 196 90 154 193
38542 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
38543 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
38544 +136 185 209 101 161 196 101 161 196 136 185 209 136 185 209 101 161 196
38545 +101 161 196 90 154 193 28 67 93 13 16 17 7 11 13 3 6 7
38546 +37 51 59 125 124 125 163 162 163 174 174 174 167 166 167 166 165 166
38547 +167 166 167 131 129 131 60 73 81 4 0 0 4 0 0 4 0 0
38548 +3 3 3 5 5 5 6 6 6 4 4 4 4 4 4 4 4 4
38549 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38550 +4 4 4 4 4 4
38551 +4 0 0 4 0 0 41 54 63 137 136 137 153 152 153 137 136 137
38552 +153 152 153 157 156 157 125 124 125 24 26 27 0 0 0 2 2 2
38553 +4 4 4 4 4 4 2 0 0 0 0 0 28 67 93 90 154 193
38554 +90 154 193 90 154 193 90 154 193 90 154 193 64 123 161 90 154 193
38555 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
38556 +90 154 193 101 161 196 101 161 196 101 161 196 90 154 193 136 185 209
38557 +101 161 196 101 161 196 136 185 209 101 161 196 136 185 209 101 161 196
38558 +101 161 196 101 161 196 136 185 209 101 161 196 101 161 196 90 154 193
38559 +35 83 115 13 16 17 3 6 7 2 5 5 13 16 17 60 74 84
38560 +154 154 154 166 165 166 165 164 165 158 157 158 163 162 163 157 156 157
38561 +60 74 84 13 16 17 4 0 0 4 0 0 3 2 2 4 4 4
38562 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38563 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38564 +4 4 4 4 4 4
38565 +1 1 1 4 0 0 41 54 63 157 156 157 155 154 155 137 136 137
38566 +153 152 153 158 157 158 137 136 137 26 28 28 2 0 0 2 2 2
38567 +4 4 4 4 4 4 1 0 0 6 10 14 34 86 122 90 154 193
38568 +64 123 161 90 154 193 64 123 161 90 154 193 90 154 193 90 154 193
38569 +64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
38570 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
38571 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
38572 +136 185 209 101 161 196 136 185 209 90 154 193 26 108 161 22 40 52
38573 +13 16 17 5 7 8 2 5 5 2 5 5 37 38 37 165 164 165
38574 +174 174 174 163 162 163 154 154 154 165 164 165 167 166 167 60 73 81
38575 +6 6 6 4 0 0 4 0 0 4 4 4 4 4 4 4 4 4
38576 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38577 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38578 +4 4 4 4 4 4
38579 +4 0 0 6 6 6 41 54 63 156 155 156 158 157 158 153 152 153
38580 +156 155 156 165 164 165 137 136 137 26 28 28 0 0 0 2 2 2
38581 +4 4 5 4 4 4 2 0 0 7 12 15 31 96 139 64 123 161
38582 +90 154 193 64 123 161 90 154 193 90 154 193 64 123 161 90 154 193
38583 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
38584 +90 154 193 90 154 193 90 154 193 101 161 196 101 161 196 101 161 196
38585 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
38586 +101 161 196 136 185 209 26 108 161 22 40 52 7 11 13 5 7 8
38587 +2 5 5 2 5 5 2 5 5 2 2 1 37 38 37 158 157 158
38588 +174 174 174 154 154 154 156 155 156 167 166 167 165 164 165 37 38 37
38589 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38590 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38591 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38592 +4 4 4 4 4 4
38593 +3 1 0 4 0 0 60 73 81 157 156 157 163 162 163 153 152 153
38594 +158 157 158 167 166 167 137 136 137 26 28 28 2 0 0 2 2 2
38595 +4 5 5 4 4 4 4 0 0 7 12 15 24 86 132 26 108 161
38596 +37 112 160 64 123 161 90 154 193 64 123 161 90 154 193 90 154 193
38597 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
38598 +90 154 193 101 161 196 90 154 193 101 161 196 101 161 196 101 161 196
38599 +101 161 196 101 161 196 101 161 196 136 185 209 101 161 196 136 185 209
38600 +90 154 193 35 83 115 13 16 17 13 16 17 7 11 13 3 6 7
38601 +5 7 8 6 6 6 3 4 3 2 2 1 30 32 34 154 154 154
38602 +167 166 167 154 154 154 154 154 154 174 174 174 165 164 165 37 38 37
38603 +6 6 6 4 0 0 6 6 6 4 4 4 4 4 4 4 4 4
38604 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38605 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38606 +4 4 4 4 4 4
38607 +4 0 0 4 0 0 41 54 63 163 162 163 166 165 166 154 154 154
38608 +163 162 163 174 174 174 137 136 137 26 28 28 0 0 0 2 2 2
38609 +4 5 5 4 4 5 1 1 2 6 10 14 28 67 93 18 97 151
38610 +18 97 151 18 97 151 26 108 161 37 112 160 37 112 160 90 154 193
38611 +64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
38612 +90 154 193 101 161 196 101 161 196 90 154 193 101 161 196 101 161 196
38613 +101 161 196 101 161 196 101 161 196 136 185 209 90 154 193 16 89 141
38614 +13 20 25 7 11 13 5 7 8 5 7 8 2 5 5 4 5 5
38615 +3 4 3 4 5 5 3 4 3 0 0 0 37 38 37 158 157 158
38616 +174 174 174 158 157 158 158 157 158 167 166 167 174 174 174 41 54 63
38617 +4 0 0 3 2 2 5 5 5 4 4 4 4 4 4 4 4 4
38618 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38619 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38620 +4 4 4 4 4 4
38621 +1 1 1 4 0 0 60 73 81 165 164 165 174 174 174 158 157 158
38622 +167 166 167 174 174 174 153 152 153 26 28 28 2 0 0 2 2 2
38623 +4 5 5 4 4 4 4 0 0 7 12 15 10 87 144 10 87 144
38624 +18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
38625 +26 108 161 37 112 160 53 118 160 90 154 193 90 154 193 90 154 193
38626 +90 154 193 90 154 193 101 161 196 101 161 196 101 161 196 101 161 196
38627 +101 161 196 136 185 209 90 154 193 26 108 161 22 40 52 13 16 17
38628 +7 11 13 3 6 7 5 7 8 5 7 8 2 5 5 4 5 5
38629 +4 5 5 6 6 6 3 4 3 0 0 0 30 32 34 158 157 158
38630 +174 174 174 156 155 156 155 154 155 165 164 165 154 153 154 37 38 37
38631 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38632 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38633 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38634 +4 4 4 4 4 4
38635 +4 0 0 4 0 0 60 73 81 167 166 167 174 174 174 163 162 163
38636 +174 174 174 174 174 174 153 152 153 26 28 28 0 0 0 3 3 3
38637 +5 5 5 4 4 4 1 1 2 7 12 15 28 67 93 18 97 151
38638 +18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
38639 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
38640 +90 154 193 26 108 161 90 154 193 90 154 193 90 154 193 101 161 196
38641 +101 161 196 26 108 161 22 40 52 13 16 17 7 11 13 2 5 5
38642 +2 5 5 6 6 6 2 5 5 4 5 5 4 5 5 4 5 5
38643 +3 4 3 5 5 5 3 4 3 2 0 0 30 32 34 137 136 137
38644 +153 152 153 137 136 137 131 129 131 137 136 137 131 129 131 37 38 37
38645 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38646 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38647 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38648 +4 4 4 4 4 4
38649 +1 1 1 4 0 0 60 73 81 167 166 167 174 174 174 166 165 166
38650 +174 174 174 177 184 187 153 152 153 30 32 34 1 0 0 3 3 3
38651 +5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
38652 +18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
38653 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
38654 +26 108 161 26 108 161 26 108 161 90 154 193 90 154 193 26 108 161
38655 +35 83 115 13 16 17 7 11 13 5 7 8 3 6 7 5 7 8
38656 +2 5 5 6 6 6 4 5 5 4 5 5 3 4 3 4 5 5
38657 +3 4 3 6 6 6 3 4 3 0 0 0 26 28 28 125 124 125
38658 +131 129 131 125 124 125 125 124 125 131 129 131 131 129 131 37 38 37
38659 +4 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38660 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38661 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38662 +4 4 4 4 4 4
38663 +3 1 0 4 0 0 60 73 81 174 174 174 177 184 187 167 166 167
38664 +174 174 174 177 184 187 153 152 153 30 32 34 0 0 0 3 3 3
38665 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
38666 +18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
38667 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
38668 +26 108 161 90 154 193 26 108 161 26 108 161 24 86 132 13 20 25
38669 +7 11 13 13 20 25 22 40 52 5 7 8 3 4 3 3 4 3
38670 +4 5 5 3 4 3 4 5 5 3 4 3 4 5 5 3 4 3
38671 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
38672 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38673 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38674 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38675 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38676 +4 4 4 4 4 4
38677 +1 1 1 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
38678 +174 174 174 190 197 201 157 156 157 30 32 34 1 0 0 3 3 3
38679 +5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
38680 +18 97 151 19 95 150 19 95 150 18 97 151 18 97 151 26 108 161
38681 +18 97 151 26 108 161 26 108 161 26 108 161 26 108 161 90 154 193
38682 +26 108 161 26 108 161 26 108 161 22 40 52 2 5 5 3 4 3
38683 +28 67 93 37 112 160 34 86 122 2 5 5 3 4 3 3 4 3
38684 +3 4 3 3 4 3 3 4 3 2 2 1 3 4 3 4 4 4
38685 +4 5 5 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
38686 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38687 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38688 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38689 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38690 +4 4 4 4 4 4
38691 +4 0 0 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
38692 +174 174 174 190 197 201 158 157 158 30 32 34 0 0 0 2 2 2
38693 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
38694 +10 87 144 19 95 150 19 95 150 18 97 151 18 97 151 18 97 151
38695 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
38696 +18 97 151 22 40 52 2 5 5 2 2 1 22 40 52 26 108 161
38697 +90 154 193 37 112 160 22 40 52 3 4 3 13 20 25 22 30 35
38698 +3 6 7 1 1 1 2 2 2 6 9 11 5 5 5 4 3 3
38699 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
38700 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38701 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38702 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38703 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38704 +4 4 4 4 4 4
38705 +1 1 1 4 0 0 60 73 81 177 184 187 193 200 203 174 174 174
38706 +177 184 187 193 200 203 163 162 163 30 32 34 4 0 0 2 2 2
38707 +5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
38708 +10 87 144 10 87 144 19 95 150 19 95 150 19 95 150 18 97 151
38709 +26 108 161 26 108 161 26 108 161 90 154 193 26 108 161 28 67 93
38710 +6 10 14 2 5 5 13 20 25 24 86 132 37 112 160 90 154 193
38711 +10 87 144 7 12 15 2 5 5 28 67 93 37 112 160 28 67 93
38712 +2 2 1 7 12 15 35 83 115 28 67 93 3 6 7 1 0 0
38713 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
38714 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38715 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38716 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38717 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38718 +4 4 4 4 4 4
38719 +4 0 0 4 0 0 60 73 81 174 174 174 190 197 201 174 174 174
38720 +177 184 187 193 200 203 163 162 163 30 32 34 0 0 0 2 2 2
38721 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
38722 +10 87 144 16 89 141 19 95 150 10 87 144 26 108 161 26 108 161
38723 +26 108 161 26 108 161 26 108 161 28 67 93 6 10 14 1 1 2
38724 +7 12 15 28 67 93 26 108 161 16 89 141 24 86 132 21 29 34
38725 +3 4 3 21 29 34 37 112 160 37 112 160 27 99 146 21 29 34
38726 +21 29 34 26 108 161 90 154 193 35 83 115 1 1 2 2 0 0
38727 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
38728 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38729 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38730 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38731 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38732 +4 4 4 4 4 4
38733 +3 1 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
38734 +190 197 201 193 200 203 165 164 165 37 38 37 4 0 0 2 2 2
38735 +5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
38736 +10 87 144 10 87 144 16 89 141 18 97 151 18 97 151 10 87 144
38737 +24 86 132 24 86 132 13 20 25 4 5 7 4 5 7 22 40 52
38738 +18 97 151 37 112 160 26 108 161 7 12 15 1 1 1 0 0 0
38739 +28 67 93 37 112 160 26 108 161 28 67 93 22 40 52 28 67 93
38740 +26 108 161 90 154 193 26 108 161 10 87 144 0 0 0 2 0 0
38741 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
38742 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38743 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38744 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38745 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38746 +4 4 4 4 4 4
38747 +4 0 0 6 6 6 60 73 81 174 174 174 193 200 203 174 174 174
38748 +190 197 201 193 200 203 165 164 165 30 32 34 0 0 0 2 2 2
38749 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
38750 +10 87 144 10 87 144 10 87 144 18 97 151 28 67 93 6 10 14
38751 +0 0 0 1 1 2 4 5 7 13 20 25 16 89 141 26 108 161
38752 +26 108 161 26 108 161 24 86 132 6 9 11 2 3 3 22 40 52
38753 +37 112 160 16 89 141 22 40 52 28 67 93 26 108 161 26 108 161
38754 +90 154 193 26 108 161 26 108 161 28 67 93 1 1 1 4 0 0
38755 +4 4 4 5 5 5 3 3 3 4 0 0 26 28 28 124 126 130
38756 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38757 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38758 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38759 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38760 +4 4 4 4 4 4
38761 +4 0 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
38762 +193 200 203 193 200 203 167 166 167 37 38 37 4 0 0 2 2 2
38763 +5 5 5 4 4 4 4 0 0 6 10 14 28 67 93 10 87 144
38764 +10 87 144 10 87 144 18 97 151 10 87 144 13 20 25 4 5 7
38765 +1 1 2 1 1 1 22 40 52 26 108 161 26 108 161 26 108 161
38766 +26 108 161 26 108 161 26 108 161 24 86 132 22 40 52 22 40 52
38767 +22 40 52 22 40 52 10 87 144 26 108 161 26 108 161 26 108 161
38768 +26 108 161 26 108 161 90 154 193 10 87 144 0 0 0 4 0 0
38769 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
38770 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38771 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38772 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38773 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38774 +4 4 4 4 4 4
38775 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
38776 +190 197 201 205 212 215 167 166 167 30 32 34 0 0 0 2 2 2
38777 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
38778 +10 87 144 10 87 144 10 87 144 10 87 144 22 40 52 1 1 2
38779 +2 0 0 1 1 2 24 86 132 26 108 161 26 108 161 26 108 161
38780 +26 108 161 19 95 150 16 89 141 10 87 144 22 40 52 22 40 52
38781 +10 87 144 26 108 161 37 112 160 26 108 161 26 108 161 26 108 161
38782 +26 108 161 26 108 161 26 108 161 28 67 93 2 0 0 3 1 0
38783 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
38784 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38785 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38786 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38787 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38788 +4 4 4 4 4 4
38789 +4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
38790 +193 200 203 193 200 203 174 174 174 37 38 37 4 0 0 2 2 2
38791 +5 5 5 4 4 4 3 2 2 1 1 2 13 20 25 10 87 144
38792 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 13 20 25
38793 +13 20 25 22 40 52 10 87 144 18 97 151 18 97 151 26 108 161
38794 +10 87 144 13 20 25 6 10 14 21 29 34 24 86 132 18 97 151
38795 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
38796 +26 108 161 90 154 193 18 97 151 13 20 25 0 0 0 4 3 3
38797 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
38798 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38799 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38800 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38801 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38802 +4 4 4 4 4 4
38803 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
38804 +190 197 201 220 221 221 167 166 167 30 32 34 1 0 0 2 2 2
38805 +5 5 5 4 4 4 4 4 5 2 5 5 4 5 7 13 20 25
38806 +28 67 93 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
38807 +10 87 144 10 87 144 18 97 151 10 87 144 18 97 151 18 97 151
38808 +28 67 93 2 3 3 0 0 0 28 67 93 26 108 161 26 108 161
38809 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
38810 +26 108 161 10 87 144 13 20 25 1 1 2 3 2 2 4 4 4
38811 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
38812 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38813 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38814 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38815 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38816 +4 4 4 4 4 4
38817 +4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
38818 +193 200 203 193 200 203 174 174 174 26 28 28 4 0 0 4 3 3
38819 +5 5 5 4 4 4 4 4 4 4 4 5 1 1 2 2 5 5
38820 +4 5 7 22 40 52 10 87 144 10 87 144 18 97 151 10 87 144
38821 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 18 97 151
38822 +10 87 144 28 67 93 22 40 52 10 87 144 26 108 161 18 97 151
38823 +18 97 151 18 97 151 26 108 161 26 108 161 26 108 161 26 108 161
38824 +22 40 52 1 1 2 0 0 0 2 3 3 4 4 4 4 4 4
38825 +4 4 4 5 5 5 4 4 4 0 0 0 26 28 28 131 129 131
38826 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38827 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38828 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38829 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38830 +4 4 4 4 4 4
38831 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
38832 +190 197 201 220 221 221 190 197 201 41 54 63 4 0 0 2 2 2
38833 +6 6 6 4 4 4 4 4 4 4 4 5 4 4 5 3 3 3
38834 +1 1 2 1 1 2 6 10 14 22 40 52 10 87 144 18 97 151
38835 +18 97 151 10 87 144 10 87 144 10 87 144 18 97 151 10 87 144
38836 +10 87 144 18 97 151 26 108 161 18 97 151 18 97 151 10 87 144
38837 +26 108 161 26 108 161 26 108 161 10 87 144 28 67 93 6 10 14
38838 +1 1 2 1 1 2 4 3 3 4 4 5 4 4 4 4 4 4
38839 +5 5 5 5 5 5 1 1 1 4 0 0 37 51 59 137 136 137
38840 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38841 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38842 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38843 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38844 +4 4 4 4 4 4
38845 +4 0 0 4 0 0 60 73 81 220 221 221 193 200 203 174 174 174
38846 +193 200 203 193 200 203 220 221 221 137 136 137 13 16 17 4 0 0
38847 +2 2 2 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5
38848 +4 4 5 4 3 3 1 1 2 4 5 7 13 20 25 28 67 93
38849 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
38850 +10 87 144 18 97 151 18 97 151 10 87 144 18 97 151 26 108 161
38851 +26 108 161 18 97 151 28 67 93 6 10 14 0 0 0 0 0 0
38852 +2 3 3 4 5 5 4 4 5 4 4 4 4 4 4 5 5 5
38853 +3 3 3 1 1 1 0 0 0 16 19 21 125 124 125 137 136 137
38854 +131 129 131 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38855 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38856 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38857 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38858 +4 4 4 4 4 4
38859 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
38860 +193 200 203 190 197 201 220 221 221 220 221 221 153 152 153 30 32 34
38861 +0 0 0 0 0 0 2 2 2 4 4 4 4 4 4 4 4 4
38862 +4 4 4 4 5 5 4 5 7 1 1 2 1 1 2 4 5 7
38863 +13 20 25 28 67 93 10 87 144 18 97 151 10 87 144 10 87 144
38864 +10 87 144 10 87 144 10 87 144 18 97 151 26 108 161 18 97 151
38865 +28 67 93 7 12 15 0 0 0 0 0 0 2 2 1 4 4 4
38866 +4 5 5 4 5 5 4 4 4 4 4 4 3 3 3 0 0 0
38867 +0 0 0 0 0 0 37 38 37 125 124 125 158 157 158 131 129 131
38868 +125 124 125 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
38869 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38870 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38871 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38872 +4 4 4 4 4 4
38873 +4 3 3 4 0 0 41 54 63 193 200 203 220 221 221 174 174 174
38874 +193 200 203 193 200 203 193 200 203 220 221 221 244 246 246 193 200 203
38875 +120 125 127 5 5 5 1 0 0 0 0 0 1 1 1 4 4 4
38876 +4 4 4 4 4 4 4 5 5 4 5 5 4 4 5 1 1 2
38877 +4 5 7 4 5 7 22 40 52 10 87 144 10 87 144 10 87 144
38878 +10 87 144 10 87 144 18 97 151 10 87 144 10 87 144 13 20 25
38879 +4 5 7 2 3 3 1 1 2 4 4 4 4 5 5 4 4 4
38880 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 1 2
38881 +24 26 27 60 74 84 153 152 153 163 162 163 137 136 137 125 124 125
38882 +125 124 125 125 124 125 125 124 125 137 136 137 125 124 125 26 28 28
38883 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
38884 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38885 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38886 +4 4 4 4 4 4
38887 +4 0 0 6 6 6 26 28 28 156 155 156 220 221 221 220 221 221
38888 +174 174 174 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
38889 +220 221 221 167 166 167 60 73 81 7 11 13 0 0 0 0 0 0
38890 +3 3 3 4 4 4 4 4 4 4 4 4 4 4 5 4 4 5
38891 +4 4 5 1 1 2 1 1 2 4 5 7 22 40 52 10 87 144
38892 +10 87 144 10 87 144 10 87 144 22 40 52 4 5 7 1 1 2
38893 +1 1 2 4 4 5 4 4 4 4 4 4 4 4 4 4 4 4
38894 +5 5 5 2 2 2 0 0 0 4 0 0 16 19 21 60 73 81
38895 +137 136 137 167 166 167 158 157 158 137 136 137 131 129 131 131 129 131
38896 +125 124 125 125 124 125 131 129 131 155 154 155 60 74 84 5 7 8
38897 +0 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38898 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38899 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38900 +4 4 4 4 4 4
38901 +5 5 5 4 0 0 4 0 0 60 73 81 193 200 203 220 221 221
38902 +193 200 203 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
38903 +220 221 221 220 221 221 220 221 221 137 136 137 43 57 68 6 6 6
38904 +4 0 0 1 1 1 4 4 4 4 4 4 4 4 4 4 4 4
38905 +4 4 5 4 4 5 3 2 2 1 1 2 2 5 5 13 20 25
38906 +22 40 52 22 40 52 13 20 25 2 3 3 1 1 2 3 3 3
38907 +4 5 7 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38908 +1 1 1 0 0 0 2 3 3 41 54 63 131 129 131 166 165 166
38909 +166 165 166 155 154 155 153 152 153 137 136 137 137 136 137 125 124 125
38910 +125 124 125 137 136 137 137 136 137 125 124 125 37 38 37 4 3 3
38911 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
38912 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38913 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38914 +4 4 4 4 4 4
38915 +4 3 3 6 6 6 6 6 6 13 16 17 60 73 81 167 166 167
38916 +220 221 221 220 221 221 220 221 221 193 200 203 193 200 203 193 200 203
38917 +205 212 215 220 221 221 220 221 221 244 246 246 205 212 215 125 124 125
38918 +24 26 27 0 0 0 0 0 0 2 2 2 5 5 5 5 5 5
38919 +4 4 4 4 4 4 4 4 4 4 4 5 1 1 2 4 5 7
38920 +4 5 7 4 5 7 1 1 2 3 2 2 4 4 5 4 4 4
38921 +4 4 4 4 4 4 5 5 5 4 4 4 0 0 0 0 0 0
38922 +2 0 0 26 28 28 125 124 125 174 174 174 174 174 174 166 165 166
38923 +156 155 156 153 152 153 137 136 137 137 136 137 131 129 131 137 136 137
38924 +137 136 137 137 136 137 60 74 84 30 32 34 4 0 0 4 0 0
38925 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38926 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38927 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38928 +4 4 4 4 4 4
38929 +5 5 5 6 6 6 4 0 0 4 0 0 6 6 6 26 28 28
38930 +125 124 125 174 174 174 220 221 221 220 221 221 220 221 221 193 200 203
38931 +205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
38932 +193 200 203 60 74 84 13 16 17 4 0 0 0 0 0 3 3 3
38933 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 5 3 3 3
38934 +1 1 2 3 3 3 4 4 5 4 4 5 4 4 4 4 4 4
38935 +5 5 5 5 5 5 2 2 2 0 0 0 0 0 0 13 16 17
38936 +60 74 84 174 174 174 193 200 203 174 174 174 167 166 167 163 162 163
38937 +153 152 153 153 152 153 137 136 137 137 136 137 153 152 153 137 136 137
38938 +125 124 125 41 54 63 24 26 27 4 0 0 4 0 0 5 5 5
38939 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38940 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38941 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38942 +4 4 4 4 4 4
38943 +4 3 3 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
38944 +6 6 6 37 38 37 131 129 131 220 221 221 220 221 221 220 221 221
38945 +193 200 203 193 200 203 220 221 221 205 212 215 220 221 221 244 246 246
38946 +244 246 246 244 246 246 174 174 174 41 54 63 0 0 0 0 0 0
38947 +0 0 0 4 4 4 5 5 5 5 5 5 4 4 4 4 4 5
38948 +4 4 5 4 4 5 4 4 4 4 4 4 6 6 6 6 6 6
38949 +3 3 3 0 0 0 2 0 0 13 16 17 60 73 81 156 155 156
38950 +220 221 221 193 200 203 174 174 174 165 164 165 163 162 163 154 153 154
38951 +153 152 153 153 152 153 158 157 158 163 162 163 137 136 137 60 73 81
38952 +13 16 17 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
38953 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38954 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38955 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38956 +4 4 4 4 4 4
38957 +5 5 5 4 3 3 4 3 3 6 6 6 6 6 6 6 6 6
38958 +6 6 6 6 6 6 6 6 6 37 38 37 167 166 167 244 246 246
38959 +244 246 246 220 221 221 205 212 215 205 212 215 220 221 221 193 200 203
38960 +220 221 221 244 246 246 244 246 246 244 246 246 137 136 137 37 38 37
38961 +3 2 2 0 0 0 1 1 1 5 5 5 5 5 5 4 4 4
38962 +4 4 4 4 4 4 4 4 4 5 5 5 4 4 4 1 1 1
38963 +0 0 0 5 5 5 43 57 68 153 152 153 193 200 203 220 221 221
38964 +177 184 187 174 174 174 167 166 167 166 165 166 158 157 158 157 156 157
38965 +158 157 158 166 165 166 156 155 156 85 115 134 13 16 17 4 0 0
38966 +4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
38967 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38968 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38969 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38970 +4 4 4 4 4 4
38971 +5 5 5 4 3 3 6 6 6 6 6 6 4 0 0 6 6 6
38972 +6 6 6 6 6 6 6 6 6 6 6 6 13 16 17 60 73 81
38973 +177 184 187 220 221 221 220 221 221 220 221 221 205 212 215 220 221 221
38974 +220 221 221 205 212 215 220 221 221 244 246 246 244 246 246 205 212 215
38975 +125 124 125 30 32 34 0 0 0 0 0 0 2 2 2 5 5 5
38976 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 0 0
38977 +37 38 37 131 129 131 205 212 215 220 221 221 193 200 203 174 174 174
38978 +174 174 174 174 174 174 167 166 167 165 164 165 166 165 166 167 166 167
38979 +158 157 158 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
38980 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
38981 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38982 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38983 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38984 +4 4 4 4 4 4
38985 +4 4 4 5 5 5 4 3 3 4 3 3 6 6 6 6 6 6
38986 +4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
38987 +26 28 28 125 124 125 205 212 215 220 221 221 220 221 221 220 221 221
38988 +205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
38989 +244 246 246 190 197 201 60 74 84 16 19 21 4 0 0 0 0 0
38990 +0 0 0 0 0 0 0 0 0 0 0 0 16 19 21 120 125 127
38991 +177 184 187 220 221 221 205 212 215 177 184 187 174 174 174 177 184 187
38992 +174 174 174 174 174 174 167 166 167 174 174 174 166 165 166 137 136 137
38993 +60 73 81 13 16 17 4 0 0 4 0 0 4 3 3 6 6 6
38994 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38995 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38996 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38997 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
38998 +4 4 4 4 4 4
38999 +5 5 5 4 3 3 5 5 5 4 3 3 6 6 6 4 0 0
39000 +6 6 6 6 6 6 4 0 0 6 6 6 4 0 0 6 6 6
39001 +6 6 6 6 6 6 37 38 37 137 136 137 193 200 203 220 221 221
39002 +220 221 221 205 212 215 220 221 221 205 212 215 205 212 215 220 221 221
39003 +220 221 221 220 221 221 244 246 246 166 165 166 43 57 68 2 2 2
39004 +0 0 0 4 0 0 16 19 21 60 73 81 157 156 157 202 210 214
39005 +220 221 221 193 200 203 177 184 187 177 184 187 177 184 187 174 174 174
39006 +174 174 174 174 174 174 174 174 174 157 156 157 60 74 84 24 26 27
39007 +4 0 0 4 0 0 4 0 0 6 6 6 4 4 4 4 4 4
39008 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39009 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39010 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39011 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39012 +4 4 4 4 4 4
39013 +4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
39014 +6 6 6 4 0 0 6 6 6 6 6 6 6 6 6 4 0 0
39015 +4 0 0 4 0 0 6 6 6 24 26 27 60 73 81 167 166 167
39016 +220 221 221 220 221 221 220 221 221 205 212 215 205 212 215 205 212 215
39017 +205 212 215 220 221 221 220 221 221 220 221 221 205 212 215 137 136 137
39018 +60 74 84 125 124 125 137 136 137 190 197 201 220 221 221 193 200 203
39019 +177 184 187 177 184 187 177 184 187 174 174 174 174 174 174 177 184 187
39020 +190 197 201 174 174 174 125 124 125 37 38 37 6 6 6 4 0 0
39021 +4 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39022 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39023 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39024 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39025 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39026 +4 4 4 4 4 4
39027 +4 4 4 4 4 4 5 5 5 5 5 5 4 3 3 6 6 6
39028 +4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 6 6 6
39029 +6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
39030 +125 124 125 193 200 203 244 246 246 220 221 221 205 212 215 205 212 215
39031 +205 212 215 193 200 203 205 212 215 205 212 215 220 221 221 220 221 221
39032 +193 200 203 193 200 203 205 212 215 193 200 203 193 200 203 177 184 187
39033 +190 197 201 190 197 201 174 174 174 190 197 201 193 200 203 190 197 201
39034 +153 152 153 60 73 81 4 0 0 4 0 0 4 0 0 3 2 2
39035 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39036 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39037 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39038 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39039 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39040 +4 4 4 4 4 4
39041 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
39042 +6 6 6 4 3 3 4 3 3 4 3 3 6 6 6 6 6 6
39043 +4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 4 0 0
39044 +4 0 0 26 28 28 131 129 131 220 221 221 244 246 246 220 221 221
39045 +205 212 215 193 200 203 205 212 215 193 200 203 193 200 203 205 212 215
39046 +220 221 221 193 200 203 193 200 203 193 200 203 190 197 201 174 174 174
39047 +174 174 174 190 197 201 193 200 203 193 200 203 167 166 167 125 124 125
39048 +6 6 6 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
39049 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39050 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39051 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39052 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39053 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39054 +4 4 4 4 4 4
39055 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
39056 +5 5 5 4 3 3 5 5 5 6 6 6 4 3 3 5 5 5
39057 +6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
39058 +4 0 0 4 0 0 6 6 6 41 54 63 158 157 158 220 221 221
39059 +220 221 221 220 221 221 193 200 203 193 200 203 193 200 203 190 197 201
39060 +190 197 201 190 197 201 190 197 201 190 197 201 174 174 174 193 200 203
39061 +193 200 203 220 221 221 174 174 174 125 124 125 37 38 37 4 0 0
39062 +4 0 0 4 3 3 6 6 6 4 4 4 4 4 4 4 4 4
39063 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39064 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39065 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39066 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39067 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39068 +4 4 4 4 4 4
39069 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39070 +4 4 4 5 5 5 4 3 3 4 3 3 4 3 3 5 5 5
39071 +4 3 3 6 6 6 5 5 5 4 3 3 6 6 6 6 6 6
39072 +6 6 6 6 6 6 4 0 0 4 0 0 13 16 17 60 73 81
39073 +174 174 174 220 221 221 220 221 221 205 212 215 190 197 201 174 174 174
39074 +193 200 203 174 174 174 190 197 201 174 174 174 193 200 203 220 221 221
39075 +193 200 203 131 129 131 37 38 37 6 6 6 4 0 0 4 0 0
39076 +6 6 6 6 6 6 4 3 3 5 5 5 4 4 4 4 4 4
39077 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39078 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39079 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39080 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39081 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39082 +4 4 4 4 4 4
39083 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39084 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
39085 +5 5 5 4 3 3 4 3 3 5 5 5 4 3 3 4 3 3
39086 +5 5 5 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
39087 +6 6 6 125 124 125 174 174 174 220 221 221 220 221 221 193 200 203
39088 +193 200 203 193 200 203 193 200 203 193 200 203 220 221 221 158 157 158
39089 +60 73 81 6 6 6 4 0 0 4 0 0 5 5 5 6 6 6
39090 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
39091 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39092 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39093 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39094 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39095 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39096 +4 4 4 4 4 4
39097 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39098 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39099 +4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
39100 +5 5 5 5 5 5 6 6 6 6 6 6 4 0 0 4 0 0
39101 +4 0 0 4 0 0 26 28 28 125 124 125 174 174 174 193 200 203
39102 +193 200 203 174 174 174 193 200 203 167 166 167 125 124 125 6 6 6
39103 +6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 5 5 5
39104 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
39105 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39106 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39107 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39108 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39109 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39110 +4 4 4 4 4 4
39111 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39112 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39113 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
39114 +4 3 3 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
39115 +6 6 6 4 0 0 4 0 0 6 6 6 37 38 37 125 124 125
39116 +153 152 153 131 129 131 125 124 125 37 38 37 6 6 6 6 6 6
39117 +6 6 6 4 0 0 6 6 6 6 6 6 4 3 3 5 5 5
39118 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39119 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39120 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39121 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39122 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39123 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39124 +4 4 4 4 4 4
39125 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39126 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39127 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39128 +4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
39129 +6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
39130 +24 26 27 24 26 27 6 6 6 6 6 6 6 6 6 4 0 0
39131 +6 6 6 6 6 6 4 0 0 6 6 6 5 5 5 4 3 3
39132 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39133 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39134 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39135 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39136 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39137 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39138 +4 4 4 4 4 4
39139 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39140 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39141 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39142 +4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
39143 +4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
39144 +6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
39145 +4 0 0 6 6 6 6 6 6 4 3 3 5 5 5 4 4 4
39146 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39147 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39148 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39149 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39150 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39151 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39152 +4 4 4 4 4 4
39153 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39154 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39155 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39156 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 5 5 5
39157 +5 5 5 5 5 5 4 0 0 6 6 6 4 0 0 6 6 6
39158 +6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 4 0 0
39159 +6 6 6 4 3 3 5 5 5 4 3 3 5 5 5 4 4 4
39160 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39161 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39162 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39163 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39164 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39165 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39166 +4 4 4 4 4 4
39167 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39168 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39169 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39170 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
39171 +4 3 3 6 6 6 4 3 3 6 6 6 6 6 6 6 6 6
39172 +4 0 0 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
39173 +6 6 6 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
39174 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39175 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39176 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39177 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39178 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39179 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39180 +4 4 4 4 4 4
39181 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39182 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39183 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39184 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39185 +4 4 4 5 5 5 4 3 3 5 5 5 4 0 0 6 6 6
39186 +6 6 6 4 0 0 6 6 6 6 6 6 4 0 0 6 6 6
39187 +4 3 3 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
39188 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39189 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39190 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39191 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39192 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39193 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39194 +4 4 4 4 4 4
39195 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39196 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39197 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39198 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39199 +4 4 4 5 5 5 4 3 3 5 5 5 6 6 6 4 3 3
39200 +4 3 3 6 6 6 6 6 6 4 3 3 6 6 6 4 3 3
39201 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39202 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39203 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39204 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39205 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39206 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39207 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39208 +4 4 4 4 4 4
39209 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39210 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39211 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39212 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39213 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 6 6 6
39214 +5 5 5 4 3 3 4 3 3 4 3 3 5 5 5 5 5 5
39215 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39216 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39217 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39218 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39219 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39220 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39221 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39222 +4 4 4 4 4 4
39223 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39224 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39225 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39226 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39227 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
39228 +5 5 5 4 3 3 5 5 5 5 5 5 4 4 4 4 4 4
39229 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39230 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39231 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39232 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39233 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39234 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39235 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
39236 +4 4 4 4 4 4
39237 diff -urNp linux-3.0.9/drivers/video/udlfb.c linux-3.0.9/drivers/video/udlfb.c
39238 --- linux-3.0.9/drivers/video/udlfb.c 2011-11-11 13:12:24.000000000 -0500
39239 +++ linux-3.0.9/drivers/video/udlfb.c 2011-11-15 20:02:59.000000000 -0500
39240 @@ -586,11 +586,11 @@ int dlfb_handle_damage(struct dlfb_data
39241 dlfb_urb_completion(urb);
39242
39243 error:
39244 - atomic_add(bytes_sent, &dev->bytes_sent);
39245 - atomic_add(bytes_identical, &dev->bytes_identical);
39246 - atomic_add(width*height*2, &dev->bytes_rendered);
39247 + atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
39248 + atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
39249 + atomic_add_unchecked(width*height*2, &dev->bytes_rendered);
39250 end_cycles = get_cycles();
39251 - atomic_add(((unsigned int) ((end_cycles - start_cycles)
39252 + atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
39253 >> 10)), /* Kcycles */
39254 &dev->cpu_kcycles_used);
39255
39256 @@ -711,11 +711,11 @@ static void dlfb_dpy_deferred_io(struct
39257 dlfb_urb_completion(urb);
39258
39259 error:
39260 - atomic_add(bytes_sent, &dev->bytes_sent);
39261 - atomic_add(bytes_identical, &dev->bytes_identical);
39262 - atomic_add(bytes_rendered, &dev->bytes_rendered);
39263 + atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
39264 + atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
39265 + atomic_add_unchecked(bytes_rendered, &dev->bytes_rendered);
39266 end_cycles = get_cycles();
39267 - atomic_add(((unsigned int) ((end_cycles - start_cycles)
39268 + atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
39269 >> 10)), /* Kcycles */
39270 &dev->cpu_kcycles_used);
39271 }
39272 @@ -1307,7 +1307,7 @@ static ssize_t metrics_bytes_rendered_sh
39273 struct fb_info *fb_info = dev_get_drvdata(fbdev);
39274 struct dlfb_data *dev = fb_info->par;
39275 return snprintf(buf, PAGE_SIZE, "%u\n",
39276 - atomic_read(&dev->bytes_rendered));
39277 + atomic_read_unchecked(&dev->bytes_rendered));
39278 }
39279
39280 static ssize_t metrics_bytes_identical_show(struct device *fbdev,
39281 @@ -1315,7 +1315,7 @@ static ssize_t metrics_bytes_identical_s
39282 struct fb_info *fb_info = dev_get_drvdata(fbdev);
39283 struct dlfb_data *dev = fb_info->par;
39284 return snprintf(buf, PAGE_SIZE, "%u\n",
39285 - atomic_read(&dev->bytes_identical));
39286 + atomic_read_unchecked(&dev->bytes_identical));
39287 }
39288
39289 static ssize_t metrics_bytes_sent_show(struct device *fbdev,
39290 @@ -1323,7 +1323,7 @@ static ssize_t metrics_bytes_sent_show(s
39291 struct fb_info *fb_info = dev_get_drvdata(fbdev);
39292 struct dlfb_data *dev = fb_info->par;
39293 return snprintf(buf, PAGE_SIZE, "%u\n",
39294 - atomic_read(&dev->bytes_sent));
39295 + atomic_read_unchecked(&dev->bytes_sent));
39296 }
39297
39298 static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
39299 @@ -1331,7 +1331,7 @@ static ssize_t metrics_cpu_kcycles_used_
39300 struct fb_info *fb_info = dev_get_drvdata(fbdev);
39301 struct dlfb_data *dev = fb_info->par;
39302 return snprintf(buf, PAGE_SIZE, "%u\n",
39303 - atomic_read(&dev->cpu_kcycles_used));
39304 + atomic_read_unchecked(&dev->cpu_kcycles_used));
39305 }
39306
39307 static ssize_t edid_show(
39308 @@ -1388,10 +1388,10 @@ static ssize_t metrics_reset_store(struc
39309 struct fb_info *fb_info = dev_get_drvdata(fbdev);
39310 struct dlfb_data *dev = fb_info->par;
39311
39312 - atomic_set(&dev->bytes_rendered, 0);
39313 - atomic_set(&dev->bytes_identical, 0);
39314 - atomic_set(&dev->bytes_sent, 0);
39315 - atomic_set(&dev->cpu_kcycles_used, 0);
39316 + atomic_set_unchecked(&dev->bytes_rendered, 0);
39317 + atomic_set_unchecked(&dev->bytes_identical, 0);
39318 + atomic_set_unchecked(&dev->bytes_sent, 0);
39319 + atomic_set_unchecked(&dev->cpu_kcycles_used, 0);
39320
39321 return count;
39322 }
39323 diff -urNp linux-3.0.9/drivers/video/uvesafb.c linux-3.0.9/drivers/video/uvesafb.c
39324 --- linux-3.0.9/drivers/video/uvesafb.c 2011-11-11 13:12:24.000000000 -0500
39325 +++ linux-3.0.9/drivers/video/uvesafb.c 2011-11-15 20:02:59.000000000 -0500
39326 @@ -19,6 +19,7 @@
39327 #include <linux/io.h>
39328 #include <linux/mutex.h>
39329 #include <linux/slab.h>
39330 +#include <linux/moduleloader.h>
39331 #include <video/edid.h>
39332 #include <video/uvesafb.h>
39333 #ifdef CONFIG_X86
39334 @@ -121,7 +122,7 @@ static int uvesafb_helper_start(void)
39335 NULL,
39336 };
39337
39338 - return call_usermodehelper(v86d_path, argv, envp, 1);
39339 + return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
39340 }
39341
39342 /*
39343 @@ -569,10 +570,32 @@ static int __devinit uvesafb_vbe_getpmi(
39344 if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
39345 par->pmi_setpal = par->ypan = 0;
39346 } else {
39347 +
39348 +#ifdef CONFIG_PAX_KERNEXEC
39349 +#ifdef CONFIG_MODULES
39350 + par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
39351 +#endif
39352 + if (!par->pmi_code) {
39353 + par->pmi_setpal = par->ypan = 0;
39354 + return 0;
39355 + }
39356 +#endif
39357 +
39358 par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
39359 + task->t.regs.edi);
39360 +
39361 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
39362 + pax_open_kernel();
39363 + memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
39364 + pax_close_kernel();
39365 +
39366 + par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
39367 + par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
39368 +#else
39369 par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
39370 par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
39371 +#endif
39372 +
39373 printk(KERN_INFO "uvesafb: protected mode interface info at "
39374 "%04x:%04x\n",
39375 (u16)task->t.regs.es, (u16)task->t.regs.edi);
39376 @@ -1821,6 +1844,11 @@ out:
39377 if (par->vbe_modes)
39378 kfree(par->vbe_modes);
39379
39380 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
39381 + if (par->pmi_code)
39382 + module_free_exec(NULL, par->pmi_code);
39383 +#endif
39384 +
39385 framebuffer_release(info);
39386 return err;
39387 }
39388 @@ -1847,6 +1875,12 @@ static int uvesafb_remove(struct platfor
39389 kfree(par->vbe_state_orig);
39390 if (par->vbe_state_saved)
39391 kfree(par->vbe_state_saved);
39392 +
39393 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
39394 + if (par->pmi_code)
39395 + module_free_exec(NULL, par->pmi_code);
39396 +#endif
39397 +
39398 }
39399
39400 framebuffer_release(info);
39401 diff -urNp linux-3.0.9/drivers/video/vesafb.c linux-3.0.9/drivers/video/vesafb.c
39402 --- linux-3.0.9/drivers/video/vesafb.c 2011-11-11 13:12:24.000000000 -0500
39403 +++ linux-3.0.9/drivers/video/vesafb.c 2011-11-15 20:02:59.000000000 -0500
39404 @@ -9,6 +9,7 @@
39405 */
39406
39407 #include <linux/module.h>
39408 +#include <linux/moduleloader.h>
39409 #include <linux/kernel.h>
39410 #include <linux/errno.h>
39411 #include <linux/string.h>
39412 @@ -52,8 +53,8 @@ static int vram_remap __initdata; /*
39413 static int vram_total __initdata; /* Set total amount of memory */
39414 static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
39415 static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
39416 -static void (*pmi_start)(void) __read_mostly;
39417 -static void (*pmi_pal) (void) __read_mostly;
39418 +static void (*pmi_start)(void) __read_only;
39419 +static void (*pmi_pal) (void) __read_only;
39420 static int depth __read_mostly;
39421 static int vga_compat __read_mostly;
39422 /* --------------------------------------------------------------------- */
39423 @@ -233,6 +234,7 @@ static int __init vesafb_probe(struct pl
39424 unsigned int size_vmode;
39425 unsigned int size_remap;
39426 unsigned int size_total;
39427 + void *pmi_code = NULL;
39428
39429 if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
39430 return -ENODEV;
39431 @@ -275,10 +277,6 @@ static int __init vesafb_probe(struct pl
39432 size_remap = size_total;
39433 vesafb_fix.smem_len = size_remap;
39434
39435 -#ifndef __i386__
39436 - screen_info.vesapm_seg = 0;
39437 -#endif
39438 -
39439 if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
39440 printk(KERN_WARNING
39441 "vesafb: cannot reserve video memory at 0x%lx\n",
39442 @@ -307,9 +305,21 @@ static int __init vesafb_probe(struct pl
39443 printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
39444 vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
39445
39446 +#ifdef __i386__
39447 +
39448 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
39449 + pmi_code = module_alloc_exec(screen_info.vesapm_size);
39450 + if (!pmi_code)
39451 +#elif !defined(CONFIG_PAX_KERNEXEC)
39452 + if (0)
39453 +#endif
39454 +
39455 +#endif
39456 + screen_info.vesapm_seg = 0;
39457 +
39458 if (screen_info.vesapm_seg) {
39459 - printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
39460 - screen_info.vesapm_seg,screen_info.vesapm_off);
39461 + printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
39462 + screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
39463 }
39464
39465 if (screen_info.vesapm_seg < 0xc000)
39466 @@ -317,9 +327,25 @@ static int __init vesafb_probe(struct pl
39467
39468 if (ypan || pmi_setpal) {
39469 unsigned short *pmi_base;
39470 +
39471 pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
39472 - pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
39473 - pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
39474 +
39475 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
39476 + pax_open_kernel();
39477 + memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
39478 +#else
39479 + pmi_code = pmi_base;
39480 +#endif
39481 +
39482 + pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
39483 + pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
39484 +
39485 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
39486 + pmi_start = ktva_ktla(pmi_start);
39487 + pmi_pal = ktva_ktla(pmi_pal);
39488 + pax_close_kernel();
39489 +#endif
39490 +
39491 printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
39492 if (pmi_base[3]) {
39493 printk(KERN_INFO "vesafb: pmi: ports = ");
39494 @@ -488,6 +514,11 @@ static int __init vesafb_probe(struct pl
39495 info->node, info->fix.id);
39496 return 0;
39497 err:
39498 +
39499 +#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
39500 + module_free_exec(NULL, pmi_code);
39501 +#endif
39502 +
39503 if (info->screen_base)
39504 iounmap(info->screen_base);
39505 framebuffer_release(info);
39506 diff -urNp linux-3.0.9/drivers/video/via/via_clock.h linux-3.0.9/drivers/video/via/via_clock.h
39507 --- linux-3.0.9/drivers/video/via/via_clock.h 2011-11-11 13:12:24.000000000 -0500
39508 +++ linux-3.0.9/drivers/video/via/via_clock.h 2011-11-15 20:02:59.000000000 -0500
39509 @@ -56,7 +56,7 @@ struct via_clock {
39510
39511 void (*set_engine_pll_state)(u8 state);
39512 void (*set_engine_pll)(struct via_pll_config config);
39513 -};
39514 +} __no_const;
39515
39516
39517 static inline u32 get_pll_internal_frequency(u32 ref_freq,
39518 diff -urNp linux-3.0.9/drivers/virtio/virtio_balloon.c linux-3.0.9/drivers/virtio/virtio_balloon.c
39519 --- linux-3.0.9/drivers/virtio/virtio_balloon.c 2011-11-11 13:12:24.000000000 -0500
39520 +++ linux-3.0.9/drivers/virtio/virtio_balloon.c 2011-11-15 20:02:59.000000000 -0500
39521 @@ -174,6 +174,8 @@ static void update_balloon_stats(struct
39522 struct sysinfo i;
39523 int idx = 0;
39524
39525 + pax_track_stack();
39526 +
39527 all_vm_events(events);
39528 si_meminfo(&i);
39529
39530 diff -urNp linux-3.0.9/fs/9p/vfs_inode.c linux-3.0.9/fs/9p/vfs_inode.c
39531 --- linux-3.0.9/fs/9p/vfs_inode.c 2011-11-11 13:12:24.000000000 -0500
39532 +++ linux-3.0.9/fs/9p/vfs_inode.c 2011-11-15 20:02:59.000000000 -0500
39533 @@ -1264,7 +1264,7 @@ static void *v9fs_vfs_follow_link(struct
39534 void
39535 v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
39536 {
39537 - char *s = nd_get_link(nd);
39538 + const char *s = nd_get_link(nd);
39539
39540 P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
39541 IS_ERR(s) ? "<error>" : s);
39542 diff -urNp linux-3.0.9/fs/aio.c linux-3.0.9/fs/aio.c
39543 --- linux-3.0.9/fs/aio.c 2011-11-11 13:12:24.000000000 -0500
39544 +++ linux-3.0.9/fs/aio.c 2011-11-15 20:02:59.000000000 -0500
39545 @@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx
39546 size += sizeof(struct io_event) * nr_events;
39547 nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
39548
39549 - if (nr_pages < 0)
39550 + if (nr_pages <= 0)
39551 return -EINVAL;
39552
39553 nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
39554 @@ -1088,6 +1088,8 @@ static int read_events(struct kioctx *ct
39555 struct aio_timeout to;
39556 int retry = 0;
39557
39558 + pax_track_stack();
39559 +
39560 /* needed to zero any padding within an entry (there shouldn't be
39561 * any, but C is fun!
39562 */
39563 @@ -1381,22 +1383,27 @@ static ssize_t aio_fsync(struct kiocb *i
39564 static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
39565 {
39566 ssize_t ret;
39567 + struct iovec iovstack;
39568
39569 #ifdef CONFIG_COMPAT
39570 if (compat)
39571 ret = compat_rw_copy_check_uvector(type,
39572 (struct compat_iovec __user *)kiocb->ki_buf,
39573 - kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
39574 + kiocb->ki_nbytes, 1, &iovstack,
39575 &kiocb->ki_iovec);
39576 else
39577 #endif
39578 ret = rw_copy_check_uvector(type,
39579 (struct iovec __user *)kiocb->ki_buf,
39580 - kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
39581 + kiocb->ki_nbytes, 1, &iovstack,
39582 &kiocb->ki_iovec);
39583 if (ret < 0)
39584 goto out;
39585
39586 + if (kiocb->ki_iovec == &iovstack) {
39587 + kiocb->ki_inline_vec = iovstack;
39588 + kiocb->ki_iovec = &kiocb->ki_inline_vec;
39589 + }
39590 kiocb->ki_nr_segs = kiocb->ki_nbytes;
39591 kiocb->ki_cur_seg = 0;
39592 /* ki_nbytes/left now reflect bytes instead of segs */
39593 diff -urNp linux-3.0.9/fs/attr.c linux-3.0.9/fs/attr.c
39594 --- linux-3.0.9/fs/attr.c 2011-11-11 13:12:24.000000000 -0500
39595 +++ linux-3.0.9/fs/attr.c 2011-11-15 20:02:59.000000000 -0500
39596 @@ -98,6 +98,7 @@ int inode_newsize_ok(const struct inode
39597 unsigned long limit;
39598
39599 limit = rlimit(RLIMIT_FSIZE);
39600 + gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
39601 if (limit != RLIM_INFINITY && offset > limit)
39602 goto out_sig;
39603 if (offset > inode->i_sb->s_maxbytes)
39604 diff -urNp linux-3.0.9/fs/autofs4/waitq.c linux-3.0.9/fs/autofs4/waitq.c
39605 --- linux-3.0.9/fs/autofs4/waitq.c 2011-11-11 13:12:24.000000000 -0500
39606 +++ linux-3.0.9/fs/autofs4/waitq.c 2011-11-15 20:02:59.000000000 -0500
39607 @@ -60,7 +60,7 @@ static int autofs4_write(struct file *fi
39608 {
39609 unsigned long sigpipe, flags;
39610 mm_segment_t fs;
39611 - const char *data = (const char *)addr;
39612 + const char __user *data = (const char __force_user *)addr;
39613 ssize_t wr = 0;
39614
39615 /** WARNING: this is not safe for writing more than PIPE_BUF bytes! **/
39616 diff -urNp linux-3.0.9/fs/befs/linuxvfs.c linux-3.0.9/fs/befs/linuxvfs.c
39617 --- linux-3.0.9/fs/befs/linuxvfs.c 2011-11-11 13:12:24.000000000 -0500
39618 +++ linux-3.0.9/fs/befs/linuxvfs.c 2011-11-15 20:02:59.000000000 -0500
39619 @@ -503,7 +503,7 @@ static void befs_put_link(struct dentry
39620 {
39621 befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
39622 if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
39623 - char *link = nd_get_link(nd);
39624 + const char *link = nd_get_link(nd);
39625 if (!IS_ERR(link))
39626 kfree(link);
39627 }
39628 diff -urNp linux-3.0.9/fs/binfmt_aout.c linux-3.0.9/fs/binfmt_aout.c
39629 --- linux-3.0.9/fs/binfmt_aout.c 2011-11-11 13:12:24.000000000 -0500
39630 +++ linux-3.0.9/fs/binfmt_aout.c 2011-11-15 20:02:59.000000000 -0500
39631 @@ -16,6 +16,7 @@
39632 #include <linux/string.h>
39633 #include <linux/fs.h>
39634 #include <linux/file.h>
39635 +#include <linux/security.h>
39636 #include <linux/stat.h>
39637 #include <linux/fcntl.h>
39638 #include <linux/ptrace.h>
39639 @@ -86,6 +87,8 @@ static int aout_core_dump(struct coredum
39640 #endif
39641 # define START_STACK(u) ((void __user *)u.start_stack)
39642
39643 + memset(&dump, 0, sizeof(dump));
39644 +
39645 fs = get_fs();
39646 set_fs(KERNEL_DS);
39647 has_dumped = 1;
39648 @@ -97,10 +100,12 @@ static int aout_core_dump(struct coredum
39649
39650 /* If the size of the dump file exceeds the rlimit, then see what would happen
39651 if we wrote the stack, but not the data area. */
39652 + gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
39653 if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > cprm->limit)
39654 dump.u_dsize = 0;
39655
39656 /* Make sure we have enough room to write the stack and data areas. */
39657 + gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
39658 if ((dump.u_ssize + 1) * PAGE_SIZE > cprm->limit)
39659 dump.u_ssize = 0;
39660
39661 @@ -234,6 +239,8 @@ static int load_aout_binary(struct linux
39662 rlim = rlimit(RLIMIT_DATA);
39663 if (rlim >= RLIM_INFINITY)
39664 rlim = ~0;
39665 +
39666 + gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
39667 if (ex.a_data + ex.a_bss > rlim)
39668 return -ENOMEM;
39669
39670 @@ -262,6 +269,27 @@ static int load_aout_binary(struct linux
39671 install_exec_creds(bprm);
39672 current->flags &= ~PF_FORKNOEXEC;
39673
39674 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
39675 + current->mm->pax_flags = 0UL;
39676 +#endif
39677 +
39678 +#ifdef CONFIG_PAX_PAGEEXEC
39679 + if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
39680 + current->mm->pax_flags |= MF_PAX_PAGEEXEC;
39681 +
39682 +#ifdef CONFIG_PAX_EMUTRAMP
39683 + if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
39684 + current->mm->pax_flags |= MF_PAX_EMUTRAMP;
39685 +#endif
39686 +
39687 +#ifdef CONFIG_PAX_MPROTECT
39688 + if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
39689 + current->mm->pax_flags |= MF_PAX_MPROTECT;
39690 +#endif
39691 +
39692 + }
39693 +#endif
39694 +
39695 if (N_MAGIC(ex) == OMAGIC) {
39696 unsigned long text_addr, map_size;
39697 loff_t pos;
39698 @@ -334,7 +362,7 @@ static int load_aout_binary(struct linux
39699
39700 down_write(&current->mm->mmap_sem);
39701 error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
39702 - PROT_READ | PROT_WRITE | PROT_EXEC,
39703 + PROT_READ | PROT_WRITE,
39704 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
39705 fd_offset + ex.a_text);
39706 up_write(&current->mm->mmap_sem);
39707 diff -urNp linux-3.0.9/fs/binfmt_elf.c linux-3.0.9/fs/binfmt_elf.c
39708 --- linux-3.0.9/fs/binfmt_elf.c 2011-11-11 13:12:24.000000000 -0500
39709 +++ linux-3.0.9/fs/binfmt_elf.c 2011-11-15 20:02:59.000000000 -0500
39710 @@ -51,6 +51,10 @@ static int elf_core_dump(struct coredump
39711 #define elf_core_dump NULL
39712 #endif
39713
39714 +#ifdef CONFIG_PAX_MPROTECT
39715 +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
39716 +#endif
39717 +
39718 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
39719 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
39720 #else
39721 @@ -70,6 +74,11 @@ static struct linux_binfmt elf_format =
39722 .load_binary = load_elf_binary,
39723 .load_shlib = load_elf_library,
39724 .core_dump = elf_core_dump,
39725 +
39726 +#ifdef CONFIG_PAX_MPROTECT
39727 + .handle_mprotect= elf_handle_mprotect,
39728 +#endif
39729 +
39730 .min_coredump = ELF_EXEC_PAGESIZE,
39731 };
39732
39733 @@ -77,6 +86,8 @@ static struct linux_binfmt elf_format =
39734
39735 static int set_brk(unsigned long start, unsigned long end)
39736 {
39737 + unsigned long e = end;
39738 +
39739 start = ELF_PAGEALIGN(start);
39740 end = ELF_PAGEALIGN(end);
39741 if (end > start) {
39742 @@ -87,7 +98,7 @@ static int set_brk(unsigned long start,
39743 if (BAD_ADDR(addr))
39744 return addr;
39745 }
39746 - current->mm->start_brk = current->mm->brk = end;
39747 + current->mm->start_brk = current->mm->brk = e;
39748 return 0;
39749 }
39750
39751 @@ -148,12 +159,15 @@ create_elf_tables(struct linux_binprm *b
39752 elf_addr_t __user *u_rand_bytes;
39753 const char *k_platform = ELF_PLATFORM;
39754 const char *k_base_platform = ELF_BASE_PLATFORM;
39755 - unsigned char k_rand_bytes[16];
39756 + u32 k_rand_bytes[4];
39757 int items;
39758 elf_addr_t *elf_info;
39759 int ei_index = 0;
39760 const struct cred *cred = current_cred();
39761 struct vm_area_struct *vma;
39762 + unsigned long saved_auxv[AT_VECTOR_SIZE];
39763 +
39764 + pax_track_stack();
39765
39766 /*
39767 * In some cases (e.g. Hyper-Threading), we want to avoid L1
39768 @@ -195,8 +209,12 @@ create_elf_tables(struct linux_binprm *b
39769 * Generate 16 random bytes for userspace PRNG seeding.
39770 */
39771 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
39772 - u_rand_bytes = (elf_addr_t __user *)
39773 - STACK_ALLOC(p, sizeof(k_rand_bytes));
39774 + srandom32(k_rand_bytes[0] ^ random32());
39775 + srandom32(k_rand_bytes[1] ^ random32());
39776 + srandom32(k_rand_bytes[2] ^ random32());
39777 + srandom32(k_rand_bytes[3] ^ random32());
39778 + p = STACK_ROUND(p, sizeof(k_rand_bytes));
39779 + u_rand_bytes = (elf_addr_t __user *) p;
39780 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
39781 return -EFAULT;
39782
39783 @@ -308,9 +326,11 @@ create_elf_tables(struct linux_binprm *b
39784 return -EFAULT;
39785 current->mm->env_end = p;
39786
39787 + memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
39788 +
39789 /* Put the elf_info on the stack in the right place. */
39790 sp = (elf_addr_t __user *)envp + 1;
39791 - if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
39792 + if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
39793 return -EFAULT;
39794 return 0;
39795 }
39796 @@ -381,10 +401,10 @@ static unsigned long load_elf_interp(str
39797 {
39798 struct elf_phdr *elf_phdata;
39799 struct elf_phdr *eppnt;
39800 - unsigned long load_addr = 0;
39801 + unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
39802 int load_addr_set = 0;
39803 unsigned long last_bss = 0, elf_bss = 0;
39804 - unsigned long error = ~0UL;
39805 + unsigned long error = -EINVAL;
39806 unsigned long total_size;
39807 int retval, i, size;
39808
39809 @@ -430,6 +450,11 @@ static unsigned long load_elf_interp(str
39810 goto out_close;
39811 }
39812
39813 +#ifdef CONFIG_PAX_SEGMEXEC
39814 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
39815 + pax_task_size = SEGMEXEC_TASK_SIZE;
39816 +#endif
39817 +
39818 eppnt = elf_phdata;
39819 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
39820 if (eppnt->p_type == PT_LOAD) {
39821 @@ -473,8 +498,8 @@ static unsigned long load_elf_interp(str
39822 k = load_addr + eppnt->p_vaddr;
39823 if (BAD_ADDR(k) ||
39824 eppnt->p_filesz > eppnt->p_memsz ||
39825 - eppnt->p_memsz > TASK_SIZE ||
39826 - TASK_SIZE - eppnt->p_memsz < k) {
39827 + eppnt->p_memsz > pax_task_size ||
39828 + pax_task_size - eppnt->p_memsz < k) {
39829 error = -ENOMEM;
39830 goto out_close;
39831 }
39832 @@ -528,6 +553,193 @@ out:
39833 return error;
39834 }
39835
39836 +#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
39837 +static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
39838 +{
39839 + unsigned long pax_flags = 0UL;
39840 +
39841 +#ifdef CONFIG_PAX_PAGEEXEC
39842 + if (elf_phdata->p_flags & PF_PAGEEXEC)
39843 + pax_flags |= MF_PAX_PAGEEXEC;
39844 +#endif
39845 +
39846 +#ifdef CONFIG_PAX_SEGMEXEC
39847 + if (elf_phdata->p_flags & PF_SEGMEXEC)
39848 + pax_flags |= MF_PAX_SEGMEXEC;
39849 +#endif
39850 +
39851 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
39852 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
39853 + if ((__supported_pte_mask & _PAGE_NX))
39854 + pax_flags &= ~MF_PAX_SEGMEXEC;
39855 + else
39856 + pax_flags &= ~MF_PAX_PAGEEXEC;
39857 + }
39858 +#endif
39859 +
39860 +#ifdef CONFIG_PAX_EMUTRAMP
39861 + if (elf_phdata->p_flags & PF_EMUTRAMP)
39862 + pax_flags |= MF_PAX_EMUTRAMP;
39863 +#endif
39864 +
39865 +#ifdef CONFIG_PAX_MPROTECT
39866 + if (elf_phdata->p_flags & PF_MPROTECT)
39867 + pax_flags |= MF_PAX_MPROTECT;
39868 +#endif
39869 +
39870 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
39871 + if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
39872 + pax_flags |= MF_PAX_RANDMMAP;
39873 +#endif
39874 +
39875 + return pax_flags;
39876 +}
39877 +#endif
39878 +
39879 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
39880 +static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
39881 +{
39882 + unsigned long pax_flags = 0UL;
39883 +
39884 +#ifdef CONFIG_PAX_PAGEEXEC
39885 + if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
39886 + pax_flags |= MF_PAX_PAGEEXEC;
39887 +#endif
39888 +
39889 +#ifdef CONFIG_PAX_SEGMEXEC
39890 + if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
39891 + pax_flags |= MF_PAX_SEGMEXEC;
39892 +#endif
39893 +
39894 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
39895 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
39896 + if ((__supported_pte_mask & _PAGE_NX))
39897 + pax_flags &= ~MF_PAX_SEGMEXEC;
39898 + else
39899 + pax_flags &= ~MF_PAX_PAGEEXEC;
39900 + }
39901 +#endif
39902 +
39903 +#ifdef CONFIG_PAX_EMUTRAMP
39904 + if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
39905 + pax_flags |= MF_PAX_EMUTRAMP;
39906 +#endif
39907 +
39908 +#ifdef CONFIG_PAX_MPROTECT
39909 + if (!(elf_phdata->p_flags & PF_NOMPROTECT))
39910 + pax_flags |= MF_PAX_MPROTECT;
39911 +#endif
39912 +
39913 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
39914 + if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
39915 + pax_flags |= MF_PAX_RANDMMAP;
39916 +#endif
39917 +
39918 + return pax_flags;
39919 +}
39920 +#endif
39921 +
39922 +#ifdef CONFIG_PAX_EI_PAX
39923 +static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
39924 +{
39925 + unsigned long pax_flags = 0UL;
39926 +
39927 +#ifdef CONFIG_PAX_PAGEEXEC
39928 + if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
39929 + pax_flags |= MF_PAX_PAGEEXEC;
39930 +#endif
39931 +
39932 +#ifdef CONFIG_PAX_SEGMEXEC
39933 + if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
39934 + pax_flags |= MF_PAX_SEGMEXEC;
39935 +#endif
39936 +
39937 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
39938 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
39939 + if ((__supported_pte_mask & _PAGE_NX))
39940 + pax_flags &= ~MF_PAX_SEGMEXEC;
39941 + else
39942 + pax_flags &= ~MF_PAX_PAGEEXEC;
39943 + }
39944 +#endif
39945 +
39946 +#ifdef CONFIG_PAX_EMUTRAMP
39947 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
39948 + pax_flags |= MF_PAX_EMUTRAMP;
39949 +#endif
39950 +
39951 +#ifdef CONFIG_PAX_MPROTECT
39952 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
39953 + pax_flags |= MF_PAX_MPROTECT;
39954 +#endif
39955 +
39956 +#ifdef CONFIG_PAX_ASLR
39957 + if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
39958 + pax_flags |= MF_PAX_RANDMMAP;
39959 +#endif
39960 +
39961 + return pax_flags;
39962 +}
39963 +#endif
39964 +
39965 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
39966 +static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
39967 +{
39968 + unsigned long pax_flags = 0UL;
39969 +
39970 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
39971 + unsigned long i;
39972 + int found_flags = 0;
39973 +#endif
39974 +
39975 +#ifdef CONFIG_PAX_EI_PAX
39976 + pax_flags = pax_parse_ei_pax(elf_ex);
39977 +#endif
39978 +
39979 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
39980 + for (i = 0UL; i < elf_ex->e_phnum; i++)
39981 + if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
39982 + if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
39983 + ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
39984 + ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
39985 + ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
39986 + ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
39987 + return -EINVAL;
39988 +
39989 +#ifdef CONFIG_PAX_SOFTMODE
39990 + if (pax_softmode)
39991 + pax_flags = pax_parse_softmode(&elf_phdata[i]);
39992 + else
39993 +#endif
39994 +
39995 + pax_flags = pax_parse_hardmode(&elf_phdata[i]);
39996 + found_flags = 1;
39997 + break;
39998 + }
39999 +#endif
40000 +
40001 +#if !defined(CONFIG_PAX_EI_PAX) && defined(CONFIG_PAX_PT_PAX_FLAGS)
40002 + if (found_flags == 0) {
40003 + struct elf_phdr phdr;
40004 + memset(&phdr, 0, sizeof(phdr));
40005 + phdr.p_flags = PF_NOEMUTRAMP;
40006 +#ifdef CONFIG_PAX_SOFTMODE
40007 + if (pax_softmode)
40008 + pax_flags = pax_parse_softmode(&phdr);
40009 + else
40010 +#endif
40011 + pax_flags = pax_parse_hardmode(&phdr);
40012 + }
40013 +#endif
40014 +
40015 + if (0 > pax_check_flags(&pax_flags))
40016 + return -EINVAL;
40017 +
40018 + current->mm->pax_flags = pax_flags;
40019 + return 0;
40020 +}
40021 +#endif
40022 +
40023 /*
40024 * These are the functions used to load ELF style executables and shared
40025 * libraries. There is no binary dependent code anywhere else.
40026 @@ -544,6 +756,11 @@ static unsigned long randomize_stack_top
40027 {
40028 unsigned int random_variable = 0;
40029
40030 +#ifdef CONFIG_PAX_RANDUSTACK
40031 + if (randomize_va_space)
40032 + return stack_top - current->mm->delta_stack;
40033 +#endif
40034 +
40035 if ((current->flags & PF_RANDOMIZE) &&
40036 !(current->personality & ADDR_NO_RANDOMIZE)) {
40037 random_variable = get_random_int() & STACK_RND_MASK;
40038 @@ -562,7 +779,7 @@ static int load_elf_binary(struct linux_
40039 unsigned long load_addr = 0, load_bias = 0;
40040 int load_addr_set = 0;
40041 char * elf_interpreter = NULL;
40042 - unsigned long error;
40043 + unsigned long error = 0;
40044 struct elf_phdr *elf_ppnt, *elf_phdata;
40045 unsigned long elf_bss, elf_brk;
40046 int retval, i;
40047 @@ -572,11 +789,11 @@ static int load_elf_binary(struct linux_
40048 unsigned long start_code, end_code, start_data, end_data;
40049 unsigned long reloc_func_desc __maybe_unused = 0;
40050 int executable_stack = EXSTACK_DEFAULT;
40051 - unsigned long def_flags = 0;
40052 struct {
40053 struct elfhdr elf_ex;
40054 struct elfhdr interp_elf_ex;
40055 } *loc;
40056 + unsigned long pax_task_size = TASK_SIZE;
40057
40058 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
40059 if (!loc) {
40060 @@ -714,11 +931,81 @@ static int load_elf_binary(struct linux_
40061
40062 /* OK, This is the point of no return */
40063 current->flags &= ~PF_FORKNOEXEC;
40064 - current->mm->def_flags = def_flags;
40065 +
40066 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
40067 + current->mm->pax_flags = 0UL;
40068 +#endif
40069 +
40070 +#ifdef CONFIG_PAX_DLRESOLVE
40071 + current->mm->call_dl_resolve = 0UL;
40072 +#endif
40073 +
40074 +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
40075 + current->mm->call_syscall = 0UL;
40076 +#endif
40077 +
40078 +#ifdef CONFIG_PAX_ASLR
40079 + current->mm->delta_mmap = 0UL;
40080 + current->mm->delta_stack = 0UL;
40081 +#endif
40082 +
40083 + current->mm->def_flags = 0;
40084 +
40085 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
40086 + if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
40087 + send_sig(SIGKILL, current, 0);
40088 + goto out_free_dentry;
40089 + }
40090 +#endif
40091 +
40092 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
40093 + pax_set_initial_flags(bprm);
40094 +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
40095 + if (pax_set_initial_flags_func)
40096 + (pax_set_initial_flags_func)(bprm);
40097 +#endif
40098 +
40099 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
40100 + if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !(__supported_pte_mask & _PAGE_NX)) {
40101 + current->mm->context.user_cs_limit = PAGE_SIZE;
40102 + current->mm->def_flags |= VM_PAGEEXEC;
40103 + }
40104 +#endif
40105 +
40106 +#ifdef CONFIG_PAX_SEGMEXEC
40107 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
40108 + current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
40109 + current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
40110 + pax_task_size = SEGMEXEC_TASK_SIZE;
40111 + current->mm->def_flags |= VM_NOHUGEPAGE;
40112 + }
40113 +#endif
40114 +
40115 +#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
40116 + if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
40117 + set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
40118 + put_cpu();
40119 + }
40120 +#endif
40121
40122 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
40123 may depend on the personality. */
40124 SET_PERSONALITY(loc->elf_ex);
40125 +
40126 +#ifdef CONFIG_PAX_ASLR
40127 + if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
40128 + current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
40129 + current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
40130 + }
40131 +#endif
40132 +
40133 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
40134 + if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
40135 + executable_stack = EXSTACK_DISABLE_X;
40136 + current->personality &= ~READ_IMPLIES_EXEC;
40137 + } else
40138 +#endif
40139 +
40140 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
40141 current->personality |= READ_IMPLIES_EXEC;
40142
40143 @@ -809,6 +1096,20 @@ static int load_elf_binary(struct linux_
40144 #else
40145 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
40146 #endif
40147 +
40148 +#ifdef CONFIG_PAX_RANDMMAP
40149 + /* PaX: randomize base address at the default exe base if requested */
40150 + if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
40151 +#ifdef CONFIG_SPARC64
40152 + load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
40153 +#else
40154 + load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
40155 +#endif
40156 + load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
40157 + elf_flags |= MAP_FIXED;
40158 + }
40159 +#endif
40160 +
40161 }
40162
40163 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
40164 @@ -841,9 +1142,9 @@ static int load_elf_binary(struct linux_
40165 * allowed task size. Note that p_filesz must always be
40166 * <= p_memsz so it is only necessary to check p_memsz.
40167 */
40168 - if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
40169 - elf_ppnt->p_memsz > TASK_SIZE ||
40170 - TASK_SIZE - elf_ppnt->p_memsz < k) {
40171 + if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
40172 + elf_ppnt->p_memsz > pax_task_size ||
40173 + pax_task_size - elf_ppnt->p_memsz < k) {
40174 /* set_brk can never work. Avoid overflows. */
40175 send_sig(SIGKILL, current, 0);
40176 retval = -EINVAL;
40177 @@ -871,6 +1172,11 @@ static int load_elf_binary(struct linux_
40178 start_data += load_bias;
40179 end_data += load_bias;
40180
40181 +#ifdef CONFIG_PAX_RANDMMAP
40182 + if (current->mm->pax_flags & MF_PAX_RANDMMAP)
40183 + elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
40184 +#endif
40185 +
40186 /* Calling set_brk effectively mmaps the pages that we need
40187 * for the bss and break sections. We must do this before
40188 * mapping in the interpreter, to make sure it doesn't wind
40189 @@ -882,9 +1188,11 @@ static int load_elf_binary(struct linux_
40190 goto out_free_dentry;
40191 }
40192 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
40193 - send_sig(SIGSEGV, current, 0);
40194 - retval = -EFAULT; /* Nobody gets to see this, but.. */
40195 - goto out_free_dentry;
40196 + /*
40197 + * This bss-zeroing can fail if the ELF
40198 + * file specifies odd protections. So
40199 + * we don't check the return value
40200 + */
40201 }
40202
40203 if (elf_interpreter) {
40204 @@ -1099,7 +1407,7 @@ out:
40205 * Decide what to dump of a segment, part, all or none.
40206 */
40207 static unsigned long vma_dump_size(struct vm_area_struct *vma,
40208 - unsigned long mm_flags)
40209 + unsigned long mm_flags, long signr)
40210 {
40211 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
40212
40213 @@ -1133,7 +1441,7 @@ static unsigned long vma_dump_size(struc
40214 if (vma->vm_file == NULL)
40215 return 0;
40216
40217 - if (FILTER(MAPPED_PRIVATE))
40218 + if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
40219 goto whole;
40220
40221 /*
40222 @@ -1355,9 +1663,9 @@ static void fill_auxv_note(struct memelf
40223 {
40224 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
40225 int i = 0;
40226 - do
40227 + do {
40228 i += 2;
40229 - while (auxv[i - 2] != AT_NULL);
40230 + } while (auxv[i - 2] != AT_NULL);
40231 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
40232 }
40233
40234 @@ -1863,14 +2171,14 @@ static void fill_extnum_info(struct elfh
40235 }
40236
40237 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
40238 - unsigned long mm_flags)
40239 + struct coredump_params *cprm)
40240 {
40241 struct vm_area_struct *vma;
40242 size_t size = 0;
40243
40244 for (vma = first_vma(current, gate_vma); vma != NULL;
40245 vma = next_vma(vma, gate_vma))
40246 - size += vma_dump_size(vma, mm_flags);
40247 + size += vma_dump_size(vma, cprm->mm_flags, cprm->signr);
40248 return size;
40249 }
40250
40251 @@ -1964,7 +2272,7 @@ static int elf_core_dump(struct coredump
40252
40253 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
40254
40255 - offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
40256 + offset += elf_core_vma_data_size(gate_vma, cprm);
40257 offset += elf_core_extra_data_size();
40258 e_shoff = offset;
40259
40260 @@ -1978,10 +2286,12 @@ static int elf_core_dump(struct coredump
40261 offset = dataoff;
40262
40263 size += sizeof(*elf);
40264 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
40265 if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
40266 goto end_coredump;
40267
40268 size += sizeof(*phdr4note);
40269 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
40270 if (size > cprm->limit
40271 || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
40272 goto end_coredump;
40273 @@ -1995,7 +2305,7 @@ static int elf_core_dump(struct coredump
40274 phdr.p_offset = offset;
40275 phdr.p_vaddr = vma->vm_start;
40276 phdr.p_paddr = 0;
40277 - phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
40278 + phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags, cprm->signr);
40279 phdr.p_memsz = vma->vm_end - vma->vm_start;
40280 offset += phdr.p_filesz;
40281 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
40282 @@ -2006,6 +2316,7 @@ static int elf_core_dump(struct coredump
40283 phdr.p_align = ELF_EXEC_PAGESIZE;
40284
40285 size += sizeof(phdr);
40286 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
40287 if (size > cprm->limit
40288 || !dump_write(cprm->file, &phdr, sizeof(phdr)))
40289 goto end_coredump;
40290 @@ -2030,7 +2341,7 @@ static int elf_core_dump(struct coredump
40291 unsigned long addr;
40292 unsigned long end;
40293
40294 - end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
40295 + end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags, cprm->signr);
40296
40297 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
40298 struct page *page;
40299 @@ -2039,6 +2350,7 @@ static int elf_core_dump(struct coredump
40300 page = get_dump_page(addr);
40301 if (page) {
40302 void *kaddr = kmap(page);
40303 + gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
40304 stop = ((size += PAGE_SIZE) > cprm->limit) ||
40305 !dump_write(cprm->file, kaddr,
40306 PAGE_SIZE);
40307 @@ -2056,6 +2368,7 @@ static int elf_core_dump(struct coredump
40308
40309 if (e_phnum == PN_XNUM) {
40310 size += sizeof(*shdr4extnum);
40311 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
40312 if (size > cprm->limit
40313 || !dump_write(cprm->file, shdr4extnum,
40314 sizeof(*shdr4extnum)))
40315 @@ -2076,6 +2389,97 @@ out:
40316
40317 #endif /* CONFIG_ELF_CORE */
40318
40319 +#ifdef CONFIG_PAX_MPROTECT
40320 +/* PaX: non-PIC ELF libraries need relocations on their executable segments
40321 + * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
40322 + * we'll remove VM_MAYWRITE for good on RELRO segments.
40323 + *
40324 + * The checks favour ld-linux.so behaviour which operates on a per ELF segment
40325 + * basis because we want to allow the common case and not the special ones.
40326 + */
40327 +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
40328 +{
40329 + struct elfhdr elf_h;
40330 + struct elf_phdr elf_p;
40331 + unsigned long i;
40332 + unsigned long oldflags;
40333 + bool is_textrel_rw, is_textrel_rx, is_relro;
40334 +
40335 + if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
40336 + return;
40337 +
40338 + oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
40339 + newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
40340 +
40341 +#ifdef CONFIG_PAX_ELFRELOCS
40342 + /* possible TEXTREL */
40343 + is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
40344 + is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
40345 +#else
40346 + is_textrel_rw = false;
40347 + is_textrel_rx = false;
40348 +#endif
40349 +
40350 + /* possible RELRO */
40351 + is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
40352 +
40353 + if (!is_textrel_rw && !is_textrel_rx && !is_relro)
40354 + return;
40355 +
40356 + if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
40357 + memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
40358 +
40359 +#ifdef CONFIG_PAX_ETEXECRELOCS
40360 + ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
40361 +#else
40362 + ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
40363 +#endif
40364 +
40365 + (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
40366 + !elf_check_arch(&elf_h) ||
40367 + elf_h.e_phentsize != sizeof(struct elf_phdr) ||
40368 + elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
40369 + return;
40370 +
40371 + for (i = 0UL; i < elf_h.e_phnum; i++) {
40372 + if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
40373 + return;
40374 + switch (elf_p.p_type) {
40375 + case PT_DYNAMIC:
40376 + if (!is_textrel_rw && !is_textrel_rx)
40377 + continue;
40378 + i = 0UL;
40379 + while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
40380 + elf_dyn dyn;
40381 +
40382 + if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
40383 + return;
40384 + if (dyn.d_tag == DT_NULL)
40385 + return;
40386 + if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
40387 + gr_log_textrel(vma);
40388 + if (is_textrel_rw)
40389 + vma->vm_flags |= VM_MAYWRITE;
40390 + else
40391 + /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
40392 + vma->vm_flags &= ~VM_MAYWRITE;
40393 + return;
40394 + }
40395 + i++;
40396 + }
40397 + return;
40398 +
40399 + case PT_GNU_RELRO:
40400 + if (!is_relro)
40401 + continue;
40402 + if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
40403 + vma->vm_flags &= ~VM_MAYWRITE;
40404 + return;
40405 + }
40406 + }
40407 +}
40408 +#endif
40409 +
40410 static int __init init_elf_binfmt(void)
40411 {
40412 return register_binfmt(&elf_format);
40413 diff -urNp linux-3.0.9/fs/binfmt_flat.c linux-3.0.9/fs/binfmt_flat.c
40414 --- linux-3.0.9/fs/binfmt_flat.c 2011-11-11 13:12:24.000000000 -0500
40415 +++ linux-3.0.9/fs/binfmt_flat.c 2011-11-15 20:02:59.000000000 -0500
40416 @@ -567,7 +567,9 @@ static int load_flat_file(struct linux_b
40417 realdatastart = (unsigned long) -ENOMEM;
40418 printk("Unable to allocate RAM for process data, errno %d\n",
40419 (int)-realdatastart);
40420 + down_write(&current->mm->mmap_sem);
40421 do_munmap(current->mm, textpos, text_len);
40422 + up_write(&current->mm->mmap_sem);
40423 ret = realdatastart;
40424 goto err;
40425 }
40426 @@ -591,8 +593,10 @@ static int load_flat_file(struct linux_b
40427 }
40428 if (IS_ERR_VALUE(result)) {
40429 printk("Unable to read data+bss, errno %d\n", (int)-result);
40430 + down_write(&current->mm->mmap_sem);
40431 do_munmap(current->mm, textpos, text_len);
40432 do_munmap(current->mm, realdatastart, len);
40433 + up_write(&current->mm->mmap_sem);
40434 ret = result;
40435 goto err;
40436 }
40437 @@ -661,8 +665,10 @@ static int load_flat_file(struct linux_b
40438 }
40439 if (IS_ERR_VALUE(result)) {
40440 printk("Unable to read code+data+bss, errno %d\n",(int)-result);
40441 + down_write(&current->mm->mmap_sem);
40442 do_munmap(current->mm, textpos, text_len + data_len + extra +
40443 MAX_SHARED_LIBS * sizeof(unsigned long));
40444 + up_write(&current->mm->mmap_sem);
40445 ret = result;
40446 goto err;
40447 }
40448 diff -urNp linux-3.0.9/fs/bio.c linux-3.0.9/fs/bio.c
40449 --- linux-3.0.9/fs/bio.c 2011-11-11 13:12:24.000000000 -0500
40450 +++ linux-3.0.9/fs/bio.c 2011-11-15 20:02:59.000000000 -0500
40451 @@ -1233,7 +1233,7 @@ static void bio_copy_kern_endio(struct b
40452 const int read = bio_data_dir(bio) == READ;
40453 struct bio_map_data *bmd = bio->bi_private;
40454 int i;
40455 - char *p = bmd->sgvecs[0].iov_base;
40456 + char *p = (char __force_kernel *)bmd->sgvecs[0].iov_base;
40457
40458 __bio_for_each_segment(bvec, bio, i, 0) {
40459 char *addr = page_address(bvec->bv_page);
40460 diff -urNp linux-3.0.9/fs/block_dev.c linux-3.0.9/fs/block_dev.c
40461 --- linux-3.0.9/fs/block_dev.c 2011-11-11 13:12:24.000000000 -0500
40462 +++ linux-3.0.9/fs/block_dev.c 2011-11-15 20:02:59.000000000 -0500
40463 @@ -671,7 +671,7 @@ static bool bd_may_claim(struct block_de
40464 else if (bdev->bd_contains == bdev)
40465 return true; /* is a whole device which isn't held */
40466
40467 - else if (whole->bd_holder == bd_may_claim)
40468 + else if (whole->bd_holder == (void *)bd_may_claim)
40469 return true; /* is a partition of a device that is being partitioned */
40470 else if (whole->bd_holder != NULL)
40471 return false; /* is a partition of a held device */
40472 diff -urNp linux-3.0.9/fs/btrfs/ctree.c linux-3.0.9/fs/btrfs/ctree.c
40473 --- linux-3.0.9/fs/btrfs/ctree.c 2011-11-11 13:12:24.000000000 -0500
40474 +++ linux-3.0.9/fs/btrfs/ctree.c 2011-11-15 20:02:59.000000000 -0500
40475 @@ -454,9 +454,12 @@ static noinline int __btrfs_cow_block(st
40476 free_extent_buffer(buf);
40477 add_root_to_dirty_list(root);
40478 } else {
40479 - if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
40480 - parent_start = parent->start;
40481 - else
40482 + if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
40483 + if (parent)
40484 + parent_start = parent->start;
40485 + else
40486 + parent_start = 0;
40487 + } else
40488 parent_start = 0;
40489
40490 WARN_ON(trans->transid != btrfs_header_generation(parent));
40491 diff -urNp linux-3.0.9/fs/btrfs/inode.c linux-3.0.9/fs/btrfs/inode.c
40492 --- linux-3.0.9/fs/btrfs/inode.c 2011-11-11 13:12:24.000000000 -0500
40493 +++ linux-3.0.9/fs/btrfs/inode.c 2011-11-15 20:02:59.000000000 -0500
40494 @@ -6896,7 +6896,7 @@ fail:
40495 return -ENOMEM;
40496 }
40497
40498 -static int btrfs_getattr(struct vfsmount *mnt,
40499 +int btrfs_getattr(struct vfsmount *mnt,
40500 struct dentry *dentry, struct kstat *stat)
40501 {
40502 struct inode *inode = dentry->d_inode;
40503 @@ -6908,6 +6908,14 @@ static int btrfs_getattr(struct vfsmount
40504 return 0;
40505 }
40506
40507 +EXPORT_SYMBOL(btrfs_getattr);
40508 +
40509 +dev_t get_btrfs_dev_from_inode(struct inode *inode)
40510 +{
40511 + return BTRFS_I(inode)->root->anon_super.s_dev;
40512 +}
40513 +EXPORT_SYMBOL(get_btrfs_dev_from_inode);
40514 +
40515 /*
40516 * If a file is moved, it will inherit the cow and compression flags of the new
40517 * directory.
40518 diff -urNp linux-3.0.9/fs/btrfs/ioctl.c linux-3.0.9/fs/btrfs/ioctl.c
40519 --- linux-3.0.9/fs/btrfs/ioctl.c 2011-11-11 13:12:24.000000000 -0500
40520 +++ linux-3.0.9/fs/btrfs/ioctl.c 2011-11-15 20:02:59.000000000 -0500
40521 @@ -2676,9 +2676,12 @@ long btrfs_ioctl_space_info(struct btrfs
40522 for (i = 0; i < num_types; i++) {
40523 struct btrfs_space_info *tmp;
40524
40525 + /* Don't copy in more than we allocated */
40526 if (!slot_count)
40527 break;
40528
40529 + slot_count--;
40530 +
40531 info = NULL;
40532 rcu_read_lock();
40533 list_for_each_entry_rcu(tmp, &root->fs_info->space_info,
40534 @@ -2700,15 +2703,12 @@ long btrfs_ioctl_space_info(struct btrfs
40535 memcpy(dest, &space, sizeof(space));
40536 dest++;
40537 space_args.total_spaces++;
40538 - slot_count--;
40539 }
40540 - if (!slot_count)
40541 - break;
40542 }
40543 up_read(&info->groups_sem);
40544 }
40545
40546 - user_dest = (struct btrfs_ioctl_space_info *)
40547 + user_dest = (struct btrfs_ioctl_space_info __user *)
40548 (arg + sizeof(struct btrfs_ioctl_space_args));
40549
40550 if (copy_to_user(user_dest, dest_orig, alloc_size))
40551 diff -urNp linux-3.0.9/fs/btrfs/relocation.c linux-3.0.9/fs/btrfs/relocation.c
40552 --- linux-3.0.9/fs/btrfs/relocation.c 2011-11-11 13:12:24.000000000 -0500
40553 +++ linux-3.0.9/fs/btrfs/relocation.c 2011-11-15 20:02:59.000000000 -0500
40554 @@ -1242,7 +1242,7 @@ static int __update_reloc_root(struct bt
40555 }
40556 spin_unlock(&rc->reloc_root_tree.lock);
40557
40558 - BUG_ON((struct btrfs_root *)node->data != root);
40559 + BUG_ON(!node || (struct btrfs_root *)node->data != root);
40560
40561 if (!del) {
40562 spin_lock(&rc->reloc_root_tree.lock);
40563 diff -urNp linux-3.0.9/fs/cachefiles/bind.c linux-3.0.9/fs/cachefiles/bind.c
40564 --- linux-3.0.9/fs/cachefiles/bind.c 2011-11-11 13:12:24.000000000 -0500
40565 +++ linux-3.0.9/fs/cachefiles/bind.c 2011-11-15 20:02:59.000000000 -0500
40566 @@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef
40567 args);
40568
40569 /* start by checking things over */
40570 - ASSERT(cache->fstop_percent >= 0 &&
40571 - cache->fstop_percent < cache->fcull_percent &&
40572 + ASSERT(cache->fstop_percent < cache->fcull_percent &&
40573 cache->fcull_percent < cache->frun_percent &&
40574 cache->frun_percent < 100);
40575
40576 - ASSERT(cache->bstop_percent >= 0 &&
40577 - cache->bstop_percent < cache->bcull_percent &&
40578 + ASSERT(cache->bstop_percent < cache->bcull_percent &&
40579 cache->bcull_percent < cache->brun_percent &&
40580 cache->brun_percent < 100);
40581
40582 diff -urNp linux-3.0.9/fs/cachefiles/daemon.c linux-3.0.9/fs/cachefiles/daemon.c
40583 --- linux-3.0.9/fs/cachefiles/daemon.c 2011-11-11 13:12:24.000000000 -0500
40584 +++ linux-3.0.9/fs/cachefiles/daemon.c 2011-11-15 20:02:59.000000000 -0500
40585 @@ -196,7 +196,7 @@ static ssize_t cachefiles_daemon_read(st
40586 if (n > buflen)
40587 return -EMSGSIZE;
40588
40589 - if (copy_to_user(_buffer, buffer, n) != 0)
40590 + if (n > sizeof(buffer) || copy_to_user(_buffer, buffer, n) != 0)
40591 return -EFAULT;
40592
40593 return n;
40594 @@ -222,7 +222,7 @@ static ssize_t cachefiles_daemon_write(s
40595 if (test_bit(CACHEFILES_DEAD, &cache->flags))
40596 return -EIO;
40597
40598 - if (datalen < 0 || datalen > PAGE_SIZE - 1)
40599 + if (datalen > PAGE_SIZE - 1)
40600 return -EOPNOTSUPP;
40601
40602 /* drag the command string into the kernel so we can parse it */
40603 @@ -386,7 +386,7 @@ static int cachefiles_daemon_fstop(struc
40604 if (args[0] != '%' || args[1] != '\0')
40605 return -EINVAL;
40606
40607 - if (fstop < 0 || fstop >= cache->fcull_percent)
40608 + if (fstop >= cache->fcull_percent)
40609 return cachefiles_daemon_range_error(cache, args);
40610
40611 cache->fstop_percent = fstop;
40612 @@ -458,7 +458,7 @@ static int cachefiles_daemon_bstop(struc
40613 if (args[0] != '%' || args[1] != '\0')
40614 return -EINVAL;
40615
40616 - if (bstop < 0 || bstop >= cache->bcull_percent)
40617 + if (bstop >= cache->bcull_percent)
40618 return cachefiles_daemon_range_error(cache, args);
40619
40620 cache->bstop_percent = bstop;
40621 diff -urNp linux-3.0.9/fs/cachefiles/internal.h linux-3.0.9/fs/cachefiles/internal.h
40622 --- linux-3.0.9/fs/cachefiles/internal.h 2011-11-11 13:12:24.000000000 -0500
40623 +++ linux-3.0.9/fs/cachefiles/internal.h 2011-11-15 20:02:59.000000000 -0500
40624 @@ -57,7 +57,7 @@ struct cachefiles_cache {
40625 wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
40626 struct rb_root active_nodes; /* active nodes (can't be culled) */
40627 rwlock_t active_lock; /* lock for active_nodes */
40628 - atomic_t gravecounter; /* graveyard uniquifier */
40629 + atomic_unchecked_t gravecounter; /* graveyard uniquifier */
40630 unsigned frun_percent; /* when to stop culling (% files) */
40631 unsigned fcull_percent; /* when to start culling (% files) */
40632 unsigned fstop_percent; /* when to stop allocating (% files) */
40633 @@ -169,19 +169,19 @@ extern int cachefiles_check_in_use(struc
40634 * proc.c
40635 */
40636 #ifdef CONFIG_CACHEFILES_HISTOGRAM
40637 -extern atomic_t cachefiles_lookup_histogram[HZ];
40638 -extern atomic_t cachefiles_mkdir_histogram[HZ];
40639 -extern atomic_t cachefiles_create_histogram[HZ];
40640 +extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
40641 +extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
40642 +extern atomic_unchecked_t cachefiles_create_histogram[HZ];
40643
40644 extern int __init cachefiles_proc_init(void);
40645 extern void cachefiles_proc_cleanup(void);
40646 static inline
40647 -void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
40648 +void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
40649 {
40650 unsigned long jif = jiffies - start_jif;
40651 if (jif >= HZ)
40652 jif = HZ - 1;
40653 - atomic_inc(&histogram[jif]);
40654 + atomic_inc_unchecked(&histogram[jif]);
40655 }
40656
40657 #else
40658 diff -urNp linux-3.0.9/fs/cachefiles/namei.c linux-3.0.9/fs/cachefiles/namei.c
40659 --- linux-3.0.9/fs/cachefiles/namei.c 2011-11-11 13:12:24.000000000 -0500
40660 +++ linux-3.0.9/fs/cachefiles/namei.c 2011-11-15 20:02:59.000000000 -0500
40661 @@ -318,7 +318,7 @@ try_again:
40662 /* first step is to make up a grave dentry in the graveyard */
40663 sprintf(nbuffer, "%08x%08x",
40664 (uint32_t) get_seconds(),
40665 - (uint32_t) atomic_inc_return(&cache->gravecounter));
40666 + (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
40667
40668 /* do the multiway lock magic */
40669 trap = lock_rename(cache->graveyard, dir);
40670 diff -urNp linux-3.0.9/fs/cachefiles/proc.c linux-3.0.9/fs/cachefiles/proc.c
40671 --- linux-3.0.9/fs/cachefiles/proc.c 2011-11-11 13:12:24.000000000 -0500
40672 +++ linux-3.0.9/fs/cachefiles/proc.c 2011-11-15 20:02:59.000000000 -0500
40673 @@ -14,9 +14,9 @@
40674 #include <linux/seq_file.h>
40675 #include "internal.h"
40676
40677 -atomic_t cachefiles_lookup_histogram[HZ];
40678 -atomic_t cachefiles_mkdir_histogram[HZ];
40679 -atomic_t cachefiles_create_histogram[HZ];
40680 +atomic_unchecked_t cachefiles_lookup_histogram[HZ];
40681 +atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
40682 +atomic_unchecked_t cachefiles_create_histogram[HZ];
40683
40684 /*
40685 * display the latency histogram
40686 @@ -35,9 +35,9 @@ static int cachefiles_histogram_show(str
40687 return 0;
40688 default:
40689 index = (unsigned long) v - 3;
40690 - x = atomic_read(&cachefiles_lookup_histogram[index]);
40691 - y = atomic_read(&cachefiles_mkdir_histogram[index]);
40692 - z = atomic_read(&cachefiles_create_histogram[index]);
40693 + x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
40694 + y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
40695 + z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
40696 if (x == 0 && y == 0 && z == 0)
40697 return 0;
40698
40699 diff -urNp linux-3.0.9/fs/cachefiles/rdwr.c linux-3.0.9/fs/cachefiles/rdwr.c
40700 --- linux-3.0.9/fs/cachefiles/rdwr.c 2011-11-11 13:12:24.000000000 -0500
40701 +++ linux-3.0.9/fs/cachefiles/rdwr.c 2011-11-15 20:02:59.000000000 -0500
40702 @@ -945,7 +945,7 @@ int cachefiles_write_page(struct fscache
40703 old_fs = get_fs();
40704 set_fs(KERNEL_DS);
40705 ret = file->f_op->write(
40706 - file, (const void __user *) data, len, &pos);
40707 + file, (const void __force_user *) data, len, &pos);
40708 set_fs(old_fs);
40709 kunmap(page);
40710 if (ret != len)
40711 diff -urNp linux-3.0.9/fs/ceph/dir.c linux-3.0.9/fs/ceph/dir.c
40712 --- linux-3.0.9/fs/ceph/dir.c 2011-11-11 13:12:24.000000000 -0500
40713 +++ linux-3.0.9/fs/ceph/dir.c 2011-11-15 20:02:59.000000000 -0500
40714 @@ -226,7 +226,7 @@ static int ceph_readdir(struct file *fil
40715 struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
40716 struct ceph_mds_client *mdsc = fsc->mdsc;
40717 unsigned frag = fpos_frag(filp->f_pos);
40718 - int off = fpos_off(filp->f_pos);
40719 + unsigned int off = fpos_off(filp->f_pos);
40720 int err;
40721 u32 ftype;
40722 struct ceph_mds_reply_info_parsed *rinfo;
40723 diff -urNp linux-3.0.9/fs/cifs/cifs_debug.c linux-3.0.9/fs/cifs/cifs_debug.c
40724 --- linux-3.0.9/fs/cifs/cifs_debug.c 2011-11-11 13:12:24.000000000 -0500
40725 +++ linux-3.0.9/fs/cifs/cifs_debug.c 2011-11-15 20:02:59.000000000 -0500
40726 @@ -265,8 +265,8 @@ static ssize_t cifs_stats_proc_write(str
40727
40728 if (c == '1' || c == 'y' || c == 'Y' || c == '0') {
40729 #ifdef CONFIG_CIFS_STATS2
40730 - atomic_set(&totBufAllocCount, 0);
40731 - atomic_set(&totSmBufAllocCount, 0);
40732 + atomic_set_unchecked(&totBufAllocCount, 0);
40733 + atomic_set_unchecked(&totSmBufAllocCount, 0);
40734 #endif /* CONFIG_CIFS_STATS2 */
40735 spin_lock(&cifs_tcp_ses_lock);
40736 list_for_each(tmp1, &cifs_tcp_ses_list) {
40737 @@ -279,25 +279,25 @@ static ssize_t cifs_stats_proc_write(str
40738 tcon = list_entry(tmp3,
40739 struct cifs_tcon,
40740 tcon_list);
40741 - atomic_set(&tcon->num_smbs_sent, 0);
40742 - atomic_set(&tcon->num_writes, 0);
40743 - atomic_set(&tcon->num_reads, 0);
40744 - atomic_set(&tcon->num_oplock_brks, 0);
40745 - atomic_set(&tcon->num_opens, 0);
40746 - atomic_set(&tcon->num_posixopens, 0);
40747 - atomic_set(&tcon->num_posixmkdirs, 0);
40748 - atomic_set(&tcon->num_closes, 0);
40749 - atomic_set(&tcon->num_deletes, 0);
40750 - atomic_set(&tcon->num_mkdirs, 0);
40751 - atomic_set(&tcon->num_rmdirs, 0);
40752 - atomic_set(&tcon->num_renames, 0);
40753 - atomic_set(&tcon->num_t2renames, 0);
40754 - atomic_set(&tcon->num_ffirst, 0);
40755 - atomic_set(&tcon->num_fnext, 0);
40756 - atomic_set(&tcon->num_fclose, 0);
40757 - atomic_set(&tcon->num_hardlinks, 0);
40758 - atomic_set(&tcon->num_symlinks, 0);
40759 - atomic_set(&tcon->num_locks, 0);
40760 + atomic_set_unchecked(&tcon->num_smbs_sent, 0);
40761 + atomic_set_unchecked(&tcon->num_writes, 0);
40762 + atomic_set_unchecked(&tcon->num_reads, 0);
40763 + atomic_set_unchecked(&tcon->num_oplock_brks, 0);
40764 + atomic_set_unchecked(&tcon->num_opens, 0);
40765 + atomic_set_unchecked(&tcon->num_posixopens, 0);
40766 + atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
40767 + atomic_set_unchecked(&tcon->num_closes, 0);
40768 + atomic_set_unchecked(&tcon->num_deletes, 0);
40769 + atomic_set_unchecked(&tcon->num_mkdirs, 0);
40770 + atomic_set_unchecked(&tcon->num_rmdirs, 0);
40771 + atomic_set_unchecked(&tcon->num_renames, 0);
40772 + atomic_set_unchecked(&tcon->num_t2renames, 0);
40773 + atomic_set_unchecked(&tcon->num_ffirst, 0);
40774 + atomic_set_unchecked(&tcon->num_fnext, 0);
40775 + atomic_set_unchecked(&tcon->num_fclose, 0);
40776 + atomic_set_unchecked(&tcon->num_hardlinks, 0);
40777 + atomic_set_unchecked(&tcon->num_symlinks, 0);
40778 + atomic_set_unchecked(&tcon->num_locks, 0);
40779 }
40780 }
40781 }
40782 @@ -327,8 +327,8 @@ static int cifs_stats_proc_show(struct s
40783 smBufAllocCount.counter, cifs_min_small);
40784 #ifdef CONFIG_CIFS_STATS2
40785 seq_printf(m, "Total Large %d Small %d Allocations\n",
40786 - atomic_read(&totBufAllocCount),
40787 - atomic_read(&totSmBufAllocCount));
40788 + atomic_read_unchecked(&totBufAllocCount),
40789 + atomic_read_unchecked(&totSmBufAllocCount));
40790 #endif /* CONFIG_CIFS_STATS2 */
40791
40792 seq_printf(m, "Operations (MIDs): %d\n", atomic_read(&midCount));
40793 @@ -357,41 +357,41 @@ static int cifs_stats_proc_show(struct s
40794 if (tcon->need_reconnect)
40795 seq_puts(m, "\tDISCONNECTED ");
40796 seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
40797 - atomic_read(&tcon->num_smbs_sent),
40798 - atomic_read(&tcon->num_oplock_brks));
40799 + atomic_read_unchecked(&tcon->num_smbs_sent),
40800 + atomic_read_unchecked(&tcon->num_oplock_brks));
40801 seq_printf(m, "\nReads: %d Bytes: %lld",
40802 - atomic_read(&tcon->num_reads),
40803 + atomic_read_unchecked(&tcon->num_reads),
40804 (long long)(tcon->bytes_read));
40805 seq_printf(m, "\nWrites: %d Bytes: %lld",
40806 - atomic_read(&tcon->num_writes),
40807 + atomic_read_unchecked(&tcon->num_writes),
40808 (long long)(tcon->bytes_written));
40809 seq_printf(m, "\nFlushes: %d",
40810 - atomic_read(&tcon->num_flushes));
40811 + atomic_read_unchecked(&tcon->num_flushes));
40812 seq_printf(m, "\nLocks: %d HardLinks: %d "
40813 "Symlinks: %d",
40814 - atomic_read(&tcon->num_locks),
40815 - atomic_read(&tcon->num_hardlinks),
40816 - atomic_read(&tcon->num_symlinks));
40817 + atomic_read_unchecked(&tcon->num_locks),
40818 + atomic_read_unchecked(&tcon->num_hardlinks),
40819 + atomic_read_unchecked(&tcon->num_symlinks));
40820 seq_printf(m, "\nOpens: %d Closes: %d "
40821 "Deletes: %d",
40822 - atomic_read(&tcon->num_opens),
40823 - atomic_read(&tcon->num_closes),
40824 - atomic_read(&tcon->num_deletes));
40825 + atomic_read_unchecked(&tcon->num_opens),
40826 + atomic_read_unchecked(&tcon->num_closes),
40827 + atomic_read_unchecked(&tcon->num_deletes));
40828 seq_printf(m, "\nPosix Opens: %d "
40829 "Posix Mkdirs: %d",
40830 - atomic_read(&tcon->num_posixopens),
40831 - atomic_read(&tcon->num_posixmkdirs));
40832 + atomic_read_unchecked(&tcon->num_posixopens),
40833 + atomic_read_unchecked(&tcon->num_posixmkdirs));
40834 seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
40835 - atomic_read(&tcon->num_mkdirs),
40836 - atomic_read(&tcon->num_rmdirs));
40837 + atomic_read_unchecked(&tcon->num_mkdirs),
40838 + atomic_read_unchecked(&tcon->num_rmdirs));
40839 seq_printf(m, "\nRenames: %d T2 Renames %d",
40840 - atomic_read(&tcon->num_renames),
40841 - atomic_read(&tcon->num_t2renames));
40842 + atomic_read_unchecked(&tcon->num_renames),
40843 + atomic_read_unchecked(&tcon->num_t2renames));
40844 seq_printf(m, "\nFindFirst: %d FNext %d "
40845 "FClose %d",
40846 - atomic_read(&tcon->num_ffirst),
40847 - atomic_read(&tcon->num_fnext),
40848 - atomic_read(&tcon->num_fclose));
40849 + atomic_read_unchecked(&tcon->num_ffirst),
40850 + atomic_read_unchecked(&tcon->num_fnext),
40851 + atomic_read_unchecked(&tcon->num_fclose));
40852 }
40853 }
40854 }
40855 diff -urNp linux-3.0.9/fs/cifs/cifsfs.c linux-3.0.9/fs/cifs/cifsfs.c
40856 --- linux-3.0.9/fs/cifs/cifsfs.c 2011-11-11 13:12:24.000000000 -0500
40857 +++ linux-3.0.9/fs/cifs/cifsfs.c 2011-11-15 20:02:59.000000000 -0500
40858 @@ -996,7 +996,7 @@ cifs_init_request_bufs(void)
40859 cifs_req_cachep = kmem_cache_create("cifs_request",
40860 CIFSMaxBufSize +
40861 MAX_CIFS_HDR_SIZE, 0,
40862 - SLAB_HWCACHE_ALIGN, NULL);
40863 + SLAB_HWCACHE_ALIGN | SLAB_USERCOPY, NULL);
40864 if (cifs_req_cachep == NULL)
40865 return -ENOMEM;
40866
40867 @@ -1023,7 +1023,7 @@ cifs_init_request_bufs(void)
40868 efficient to alloc 1 per page off the slab compared to 17K (5page)
40869 alloc of large cifs buffers even when page debugging is on */
40870 cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq",
40871 - MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN,
40872 + MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN | SLAB_USERCOPY,
40873 NULL);
40874 if (cifs_sm_req_cachep == NULL) {
40875 mempool_destroy(cifs_req_poolp);
40876 @@ -1108,8 +1108,8 @@ init_cifs(void)
40877 atomic_set(&bufAllocCount, 0);
40878 atomic_set(&smBufAllocCount, 0);
40879 #ifdef CONFIG_CIFS_STATS2
40880 - atomic_set(&totBufAllocCount, 0);
40881 - atomic_set(&totSmBufAllocCount, 0);
40882 + atomic_set_unchecked(&totBufAllocCount, 0);
40883 + atomic_set_unchecked(&totSmBufAllocCount, 0);
40884 #endif /* CONFIG_CIFS_STATS2 */
40885
40886 atomic_set(&midCount, 0);
40887 diff -urNp linux-3.0.9/fs/cifs/cifsglob.h linux-3.0.9/fs/cifs/cifsglob.h
40888 --- linux-3.0.9/fs/cifs/cifsglob.h 2011-11-11 13:12:24.000000000 -0500
40889 +++ linux-3.0.9/fs/cifs/cifsglob.h 2011-11-15 20:02:59.000000000 -0500
40890 @@ -381,28 +381,28 @@ struct cifs_tcon {
40891 __u16 Flags; /* optional support bits */
40892 enum statusEnum tidStatus;
40893 #ifdef CONFIG_CIFS_STATS
40894 - atomic_t num_smbs_sent;
40895 - atomic_t num_writes;
40896 - atomic_t num_reads;
40897 - atomic_t num_flushes;
40898 - atomic_t num_oplock_brks;
40899 - atomic_t num_opens;
40900 - atomic_t num_closes;
40901 - atomic_t num_deletes;
40902 - atomic_t num_mkdirs;
40903 - atomic_t num_posixopens;
40904 - atomic_t num_posixmkdirs;
40905 - atomic_t num_rmdirs;
40906 - atomic_t num_renames;
40907 - atomic_t num_t2renames;
40908 - atomic_t num_ffirst;
40909 - atomic_t num_fnext;
40910 - atomic_t num_fclose;
40911 - atomic_t num_hardlinks;
40912 - atomic_t num_symlinks;
40913 - atomic_t num_locks;
40914 - atomic_t num_acl_get;
40915 - atomic_t num_acl_set;
40916 + atomic_unchecked_t num_smbs_sent;
40917 + atomic_unchecked_t num_writes;
40918 + atomic_unchecked_t num_reads;
40919 + atomic_unchecked_t num_flushes;
40920 + atomic_unchecked_t num_oplock_brks;
40921 + atomic_unchecked_t num_opens;
40922 + atomic_unchecked_t num_closes;
40923 + atomic_unchecked_t num_deletes;
40924 + atomic_unchecked_t num_mkdirs;
40925 + atomic_unchecked_t num_posixopens;
40926 + atomic_unchecked_t num_posixmkdirs;
40927 + atomic_unchecked_t num_rmdirs;
40928 + atomic_unchecked_t num_renames;
40929 + atomic_unchecked_t num_t2renames;
40930 + atomic_unchecked_t num_ffirst;
40931 + atomic_unchecked_t num_fnext;
40932 + atomic_unchecked_t num_fclose;
40933 + atomic_unchecked_t num_hardlinks;
40934 + atomic_unchecked_t num_symlinks;
40935 + atomic_unchecked_t num_locks;
40936 + atomic_unchecked_t num_acl_get;
40937 + atomic_unchecked_t num_acl_set;
40938 #ifdef CONFIG_CIFS_STATS2
40939 unsigned long long time_writes;
40940 unsigned long long time_reads;
40941 @@ -613,7 +613,7 @@ convert_delimiter(char *path, char delim
40942 }
40943
40944 #ifdef CONFIG_CIFS_STATS
40945 -#define cifs_stats_inc atomic_inc
40946 +#define cifs_stats_inc atomic_inc_unchecked
40947
40948 static inline void cifs_stats_bytes_written(struct cifs_tcon *tcon,
40949 unsigned int bytes)
40950 @@ -911,8 +911,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnect
40951 /* Various Debug counters */
40952 GLOBAL_EXTERN atomic_t bufAllocCount; /* current number allocated */
40953 #ifdef CONFIG_CIFS_STATS2
40954 -GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */
40955 -GLOBAL_EXTERN atomic_t totSmBufAllocCount;
40956 +GLOBAL_EXTERN atomic_unchecked_t totBufAllocCount; /* total allocated over all time */
40957 +GLOBAL_EXTERN atomic_unchecked_t totSmBufAllocCount;
40958 #endif
40959 GLOBAL_EXTERN atomic_t smBufAllocCount;
40960 GLOBAL_EXTERN atomic_t midCount;
40961 diff -urNp linux-3.0.9/fs/cifs/link.c linux-3.0.9/fs/cifs/link.c
40962 --- linux-3.0.9/fs/cifs/link.c 2011-11-11 13:12:24.000000000 -0500
40963 +++ linux-3.0.9/fs/cifs/link.c 2011-11-15 20:02:59.000000000 -0500
40964 @@ -587,7 +587,7 @@ symlink_exit:
40965
40966 void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
40967 {
40968 - char *p = nd_get_link(nd);
40969 + const char *p = nd_get_link(nd);
40970 if (!IS_ERR(p))
40971 kfree(p);
40972 }
40973 diff -urNp linux-3.0.9/fs/cifs/misc.c linux-3.0.9/fs/cifs/misc.c
40974 --- linux-3.0.9/fs/cifs/misc.c 2011-11-11 13:12:24.000000000 -0500
40975 +++ linux-3.0.9/fs/cifs/misc.c 2011-11-15 20:02:59.000000000 -0500
40976 @@ -156,7 +156,7 @@ cifs_buf_get(void)
40977 memset(ret_buf, 0, sizeof(struct smb_hdr) + 3);
40978 atomic_inc(&bufAllocCount);
40979 #ifdef CONFIG_CIFS_STATS2
40980 - atomic_inc(&totBufAllocCount);
40981 + atomic_inc_unchecked(&totBufAllocCount);
40982 #endif /* CONFIG_CIFS_STATS2 */
40983 }
40984
40985 @@ -191,7 +191,7 @@ cifs_small_buf_get(void)
40986 /* memset(ret_buf, 0, sizeof(struct smb_hdr) + 27);*/
40987 atomic_inc(&smBufAllocCount);
40988 #ifdef CONFIG_CIFS_STATS2
40989 - atomic_inc(&totSmBufAllocCount);
40990 + atomic_inc_unchecked(&totSmBufAllocCount);
40991 #endif /* CONFIG_CIFS_STATS2 */
40992
40993 }
40994 diff -urNp linux-3.0.9/fs/coda/cache.c linux-3.0.9/fs/coda/cache.c
40995 --- linux-3.0.9/fs/coda/cache.c 2011-11-11 13:12:24.000000000 -0500
40996 +++ linux-3.0.9/fs/coda/cache.c 2011-11-15 20:02:59.000000000 -0500
40997 @@ -24,7 +24,7 @@
40998 #include "coda_linux.h"
40999 #include "coda_cache.h"
41000
41001 -static atomic_t permission_epoch = ATOMIC_INIT(0);
41002 +static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
41003
41004 /* replace or extend an acl cache hit */
41005 void coda_cache_enter(struct inode *inode, int mask)
41006 @@ -32,7 +32,7 @@ void coda_cache_enter(struct inode *inod
41007 struct coda_inode_info *cii = ITOC(inode);
41008
41009 spin_lock(&cii->c_lock);
41010 - cii->c_cached_epoch = atomic_read(&permission_epoch);
41011 + cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
41012 if (cii->c_uid != current_fsuid()) {
41013 cii->c_uid = current_fsuid();
41014 cii->c_cached_perm = mask;
41015 @@ -46,14 +46,14 @@ void coda_cache_clear_inode(struct inode
41016 {
41017 struct coda_inode_info *cii = ITOC(inode);
41018 spin_lock(&cii->c_lock);
41019 - cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
41020 + cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
41021 spin_unlock(&cii->c_lock);
41022 }
41023
41024 /* remove all acl caches */
41025 void coda_cache_clear_all(struct super_block *sb)
41026 {
41027 - atomic_inc(&permission_epoch);
41028 + atomic_inc_unchecked(&permission_epoch);
41029 }
41030
41031
41032 @@ -66,7 +66,7 @@ int coda_cache_check(struct inode *inode
41033 spin_lock(&cii->c_lock);
41034 hit = (mask & cii->c_cached_perm) == mask &&
41035 cii->c_uid == current_fsuid() &&
41036 - cii->c_cached_epoch == atomic_read(&permission_epoch);
41037 + cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
41038 spin_unlock(&cii->c_lock);
41039
41040 return hit;
41041 diff -urNp linux-3.0.9/fs/compat_binfmt_elf.c linux-3.0.9/fs/compat_binfmt_elf.c
41042 --- linux-3.0.9/fs/compat_binfmt_elf.c 2011-11-11 13:12:24.000000000 -0500
41043 +++ linux-3.0.9/fs/compat_binfmt_elf.c 2011-11-15 20:02:59.000000000 -0500
41044 @@ -30,11 +30,13 @@
41045 #undef elf_phdr
41046 #undef elf_shdr
41047 #undef elf_note
41048 +#undef elf_dyn
41049 #undef elf_addr_t
41050 #define elfhdr elf32_hdr
41051 #define elf_phdr elf32_phdr
41052 #define elf_shdr elf32_shdr
41053 #define elf_note elf32_note
41054 +#define elf_dyn Elf32_Dyn
41055 #define elf_addr_t Elf32_Addr
41056
41057 /*
41058 diff -urNp linux-3.0.9/fs/compat.c linux-3.0.9/fs/compat.c
41059 --- linux-3.0.9/fs/compat.c 2011-11-11 13:12:24.000000000 -0500
41060 +++ linux-3.0.9/fs/compat.c 2011-11-15 20:02:59.000000000 -0500
41061 @@ -133,8 +133,8 @@ asmlinkage long compat_sys_utimes(const
41062 static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
41063 {
41064 compat_ino_t ino = stat->ino;
41065 - typeof(ubuf->st_uid) uid = 0;
41066 - typeof(ubuf->st_gid) gid = 0;
41067 + typeof(((struct compat_stat *)0)->st_uid) uid = 0;
41068 + typeof(((struct compat_stat *)0)->st_gid) gid = 0;
41069 int err;
41070
41071 SET_UID(uid, stat->uid);
41072 @@ -508,7 +508,7 @@ compat_sys_io_setup(unsigned nr_reqs, u3
41073
41074 set_fs(KERNEL_DS);
41075 /* The __user pointer cast is valid because of the set_fs() */
41076 - ret = sys_io_setup(nr_reqs, (aio_context_t __user *) &ctx64);
41077 + ret = sys_io_setup(nr_reqs, (aio_context_t __force_user *) &ctx64);
41078 set_fs(oldfs);
41079 /* truncating is ok because it's a user address */
41080 if (!ret)
41081 @@ -566,7 +566,7 @@ ssize_t compat_rw_copy_check_uvector(int
41082 goto out;
41083
41084 ret = -EINVAL;
41085 - if (nr_segs > UIO_MAXIOV || nr_segs < 0)
41086 + if (nr_segs > UIO_MAXIOV)
41087 goto out;
41088 if (nr_segs > fast_segs) {
41089 ret = -ENOMEM;
41090 @@ -848,6 +848,7 @@ struct compat_old_linux_dirent {
41091
41092 struct compat_readdir_callback {
41093 struct compat_old_linux_dirent __user *dirent;
41094 + struct file * file;
41095 int result;
41096 };
41097
41098 @@ -865,6 +866,10 @@ static int compat_fillonedir(void *__buf
41099 buf->result = -EOVERFLOW;
41100 return -EOVERFLOW;
41101 }
41102 +
41103 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
41104 + return 0;
41105 +
41106 buf->result++;
41107 dirent = buf->dirent;
41108 if (!access_ok(VERIFY_WRITE, dirent,
41109 @@ -897,6 +902,7 @@ asmlinkage long compat_sys_old_readdir(u
41110
41111 buf.result = 0;
41112 buf.dirent = dirent;
41113 + buf.file = file;
41114
41115 error = vfs_readdir(file, compat_fillonedir, &buf);
41116 if (buf.result)
41117 @@ -917,6 +923,7 @@ struct compat_linux_dirent {
41118 struct compat_getdents_callback {
41119 struct compat_linux_dirent __user *current_dir;
41120 struct compat_linux_dirent __user *previous;
41121 + struct file * file;
41122 int count;
41123 int error;
41124 };
41125 @@ -938,6 +945,10 @@ static int compat_filldir(void *__buf, c
41126 buf->error = -EOVERFLOW;
41127 return -EOVERFLOW;
41128 }
41129 +
41130 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
41131 + return 0;
41132 +
41133 dirent = buf->previous;
41134 if (dirent) {
41135 if (__put_user(offset, &dirent->d_off))
41136 @@ -985,6 +996,7 @@ asmlinkage long compat_sys_getdents(unsi
41137 buf.previous = NULL;
41138 buf.count = count;
41139 buf.error = 0;
41140 + buf.file = file;
41141
41142 error = vfs_readdir(file, compat_filldir, &buf);
41143 if (error >= 0)
41144 @@ -1006,6 +1018,7 @@ out:
41145 struct compat_getdents_callback64 {
41146 struct linux_dirent64 __user *current_dir;
41147 struct linux_dirent64 __user *previous;
41148 + struct file * file;
41149 int count;
41150 int error;
41151 };
41152 @@ -1022,6 +1035,10 @@ static int compat_filldir64(void * __buf
41153 buf->error = -EINVAL; /* only used if we fail.. */
41154 if (reclen > buf->count)
41155 return -EINVAL;
41156 +
41157 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
41158 + return 0;
41159 +
41160 dirent = buf->previous;
41161
41162 if (dirent) {
41163 @@ -1073,13 +1090,14 @@ asmlinkage long compat_sys_getdents64(un
41164 buf.previous = NULL;
41165 buf.count = count;
41166 buf.error = 0;
41167 + buf.file = file;
41168
41169 error = vfs_readdir(file, compat_filldir64, &buf);
41170 if (error >= 0)
41171 error = buf.error;
41172 lastdirent = buf.previous;
41173 if (lastdirent) {
41174 - typeof(lastdirent->d_off) d_off = file->f_pos;
41175 + typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
41176 if (__put_user_unaligned(d_off, &lastdirent->d_off))
41177 error = -EFAULT;
41178 else
41179 @@ -1446,6 +1464,8 @@ int compat_core_sys_select(int n, compat
41180 struct fdtable *fdt;
41181 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
41182
41183 + pax_track_stack();
41184 +
41185 if (n < 0)
41186 goto out_nofds;
41187
41188 @@ -1904,7 +1924,7 @@ asmlinkage long compat_sys_nfsservctl(in
41189 oldfs = get_fs();
41190 set_fs(KERNEL_DS);
41191 /* The __user pointer casts are valid because of the set_fs() */
41192 - err = sys_nfsservctl(cmd, (void __user *) karg, (void __user *) kres);
41193 + err = sys_nfsservctl(cmd, (void __force_user *) karg, (void __force_user *) kres);
41194 set_fs(oldfs);
41195
41196 if (err)
41197 diff -urNp linux-3.0.9/fs/compat_ioctl.c linux-3.0.9/fs/compat_ioctl.c
41198 --- linux-3.0.9/fs/compat_ioctl.c 2011-11-11 13:12:24.000000000 -0500
41199 +++ linux-3.0.9/fs/compat_ioctl.c 2011-11-15 20:02:59.000000000 -0500
41200 @@ -208,6 +208,8 @@ static int do_video_set_spu_palette(unsi
41201
41202 err = get_user(palp, &up->palette);
41203 err |= get_user(length, &up->length);
41204 + if (err)
41205 + return -EFAULT;
41206
41207 up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
41208 err = put_user(compat_ptr(palp), &up_native->palette);
41209 @@ -619,7 +621,7 @@ static int serial_struct_ioctl(unsigned
41210 return -EFAULT;
41211 if (__get_user(udata, &ss32->iomem_base))
41212 return -EFAULT;
41213 - ss.iomem_base = compat_ptr(udata);
41214 + ss.iomem_base = (unsigned char __force_kernel *)compat_ptr(udata);
41215 if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) ||
41216 __get_user(ss.port_high, &ss32->port_high))
41217 return -EFAULT;
41218 @@ -794,7 +796,7 @@ static int compat_ioctl_preallocate(stru
41219 copy_in_user(&p->l_len, &p32->l_len, sizeof(s64)) ||
41220 copy_in_user(&p->l_sysid, &p32->l_sysid, sizeof(s32)) ||
41221 copy_in_user(&p->l_pid, &p32->l_pid, sizeof(u32)) ||
41222 - copy_in_user(&p->l_pad, &p32->l_pad, 4*sizeof(u32)))
41223 + copy_in_user(p->l_pad, &p32->l_pad, 4*sizeof(u32)))
41224 return -EFAULT;
41225
41226 return ioctl_preallocate(file, p);
41227 @@ -1638,8 +1640,8 @@ asmlinkage long compat_sys_ioctl(unsigne
41228 static int __init init_sys32_ioctl_cmp(const void *p, const void *q)
41229 {
41230 unsigned int a, b;
41231 - a = *(unsigned int *)p;
41232 - b = *(unsigned int *)q;
41233 + a = *(const unsigned int *)p;
41234 + b = *(const unsigned int *)q;
41235 if (a > b)
41236 return 1;
41237 if (a < b)
41238 diff -urNp linux-3.0.9/fs/configfs/dir.c linux-3.0.9/fs/configfs/dir.c
41239 --- linux-3.0.9/fs/configfs/dir.c 2011-11-11 13:12:24.000000000 -0500
41240 +++ linux-3.0.9/fs/configfs/dir.c 2011-11-15 20:02:59.000000000 -0500
41241 @@ -1575,7 +1575,8 @@ static int configfs_readdir(struct file
41242 }
41243 for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
41244 struct configfs_dirent *next;
41245 - const char * name;
41246 + const unsigned char * name;
41247 + char d_name[sizeof(next->s_dentry->d_iname)];
41248 int len;
41249 struct inode *inode = NULL;
41250
41251 @@ -1585,7 +1586,12 @@ static int configfs_readdir(struct file
41252 continue;
41253
41254 name = configfs_get_name(next);
41255 - len = strlen(name);
41256 + if (next->s_dentry && name == next->s_dentry->d_iname) {
41257 + len = next->s_dentry->d_name.len;
41258 + memcpy(d_name, name, len);
41259 + name = d_name;
41260 + } else
41261 + len = strlen(name);
41262
41263 /*
41264 * We'll have a dentry and an inode for
41265 diff -urNp linux-3.0.9/fs/dcache.c linux-3.0.9/fs/dcache.c
41266 --- linux-3.0.9/fs/dcache.c 2011-11-11 13:12:24.000000000 -0500
41267 +++ linux-3.0.9/fs/dcache.c 2011-11-15 20:02:59.000000000 -0500
41268 @@ -3089,7 +3089,7 @@ void __init vfs_caches_init(unsigned lon
41269 mempages -= reserve;
41270
41271 names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
41272 - SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
41273 + SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
41274
41275 dcache_init();
41276 inode_init();
41277 diff -urNp linux-3.0.9/fs/ecryptfs/inode.c linux-3.0.9/fs/ecryptfs/inode.c
41278 --- linux-3.0.9/fs/ecryptfs/inode.c 2011-11-11 13:12:24.000000000 -0500
41279 +++ linux-3.0.9/fs/ecryptfs/inode.c 2011-11-15 20:02:59.000000000 -0500
41280 @@ -704,7 +704,7 @@ static int ecryptfs_readlink_lower(struc
41281 old_fs = get_fs();
41282 set_fs(get_ds());
41283 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
41284 - (char __user *)lower_buf,
41285 + (char __force_user *)lower_buf,
41286 lower_bufsiz);
41287 set_fs(old_fs);
41288 if (rc < 0)
41289 @@ -750,7 +750,7 @@ static void *ecryptfs_follow_link(struct
41290 }
41291 old_fs = get_fs();
41292 set_fs(get_ds());
41293 - rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
41294 + rc = dentry->d_inode->i_op->readlink(dentry, (char __force_user *)buf, len);
41295 set_fs(old_fs);
41296 if (rc < 0) {
41297 kfree(buf);
41298 @@ -765,7 +765,7 @@ out:
41299 static void
41300 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
41301 {
41302 - char *buf = nd_get_link(nd);
41303 + const char *buf = nd_get_link(nd);
41304 if (!IS_ERR(buf)) {
41305 /* Free the char* */
41306 kfree(buf);
41307 diff -urNp linux-3.0.9/fs/ecryptfs/miscdev.c linux-3.0.9/fs/ecryptfs/miscdev.c
41308 --- linux-3.0.9/fs/ecryptfs/miscdev.c 2011-11-11 13:12:24.000000000 -0500
41309 +++ linux-3.0.9/fs/ecryptfs/miscdev.c 2011-11-15 20:02:59.000000000 -0500
41310 @@ -328,7 +328,7 @@ check_list:
41311 goto out_unlock_msg_ctx;
41312 i = 5;
41313 if (msg_ctx->msg) {
41314 - if (copy_to_user(&buf[i], packet_length, packet_length_size))
41315 + if (packet_length_size > sizeof(packet_length) || copy_to_user(&buf[i], packet_length, packet_length_size))
41316 goto out_unlock_msg_ctx;
41317 i += packet_length_size;
41318 if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
41319 diff -urNp linux-3.0.9/fs/ecryptfs/read_write.c linux-3.0.9/fs/ecryptfs/read_write.c
41320 --- linux-3.0.9/fs/ecryptfs/read_write.c 2011-11-11 13:12:24.000000000 -0500
41321 +++ linux-3.0.9/fs/ecryptfs/read_write.c 2011-11-15 20:02:59.000000000 -0500
41322 @@ -48,7 +48,7 @@ int ecryptfs_write_lower(struct inode *e
41323 return -EIO;
41324 fs_save = get_fs();
41325 set_fs(get_ds());
41326 - rc = vfs_write(lower_file, data, size, &offset);
41327 + rc = vfs_write(lower_file, (const char __force_user *)data, size, &offset);
41328 set_fs(fs_save);
41329 mark_inode_dirty_sync(ecryptfs_inode);
41330 return rc;
41331 @@ -235,7 +235,7 @@ int ecryptfs_read_lower(char *data, loff
41332 return -EIO;
41333 fs_save = get_fs();
41334 set_fs(get_ds());
41335 - rc = vfs_read(lower_file, data, size, &offset);
41336 + rc = vfs_read(lower_file, (char __force_user *)data, size, &offset);
41337 set_fs(fs_save);
41338 return rc;
41339 }
41340 diff -urNp linux-3.0.9/fs/exec.c linux-3.0.9/fs/exec.c
41341 --- linux-3.0.9/fs/exec.c 2011-11-11 13:12:24.000000000 -0500
41342 +++ linux-3.0.9/fs/exec.c 2011-11-15 20:02:59.000000000 -0500
41343 @@ -55,12 +55,24 @@
41344 #include <linux/pipe_fs_i.h>
41345 #include <linux/oom.h>
41346 #include <linux/compat.h>
41347 +#include <linux/random.h>
41348 +#include <linux/seq_file.h>
41349 +
41350 +#ifdef CONFIG_PAX_REFCOUNT
41351 +#include <linux/kallsyms.h>
41352 +#include <linux/kdebug.h>
41353 +#endif
41354
41355 #include <asm/uaccess.h>
41356 #include <asm/mmu_context.h>
41357 #include <asm/tlb.h>
41358 #include "internal.h"
41359
41360 +#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
41361 +void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
41362 +EXPORT_SYMBOL(pax_set_initial_flags_func);
41363 +#endif
41364 +
41365 int core_uses_pid;
41366 char core_pattern[CORENAME_MAX_SIZE] = "core";
41367 unsigned int core_pipe_limit;
41368 @@ -70,7 +82,7 @@ struct core_name {
41369 char *corename;
41370 int used, size;
41371 };
41372 -static atomic_t call_count = ATOMIC_INIT(1);
41373 +static atomic_unchecked_t call_count = ATOMIC_INIT(1);
41374
41375 /* The maximal length of core_pattern is also specified in sysctl.c */
41376
41377 @@ -116,7 +128,7 @@ SYSCALL_DEFINE1(uselib, const char __use
41378 char *tmp = getname(library);
41379 int error = PTR_ERR(tmp);
41380 static const struct open_flags uselib_flags = {
41381 - .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
41382 + .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC | FMODE_GREXEC,
41383 .acc_mode = MAY_READ | MAY_EXEC | MAY_OPEN,
41384 .intent = LOOKUP_OPEN
41385 };
41386 @@ -195,18 +207,10 @@ static struct page *get_arg_page(struct
41387 int write)
41388 {
41389 struct page *page;
41390 - int ret;
41391
41392 -#ifdef CONFIG_STACK_GROWSUP
41393 - if (write) {
41394 - ret = expand_downwards(bprm->vma, pos);
41395 - if (ret < 0)
41396 - return NULL;
41397 - }
41398 -#endif
41399 - ret = get_user_pages(current, bprm->mm, pos,
41400 - 1, write, 1, &page, NULL);
41401 - if (ret <= 0)
41402 + if (0 > expand_downwards(bprm->vma, pos))
41403 + return NULL;
41404 + if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
41405 return NULL;
41406
41407 if (write) {
41408 @@ -281,6 +285,11 @@ static int __bprm_mm_init(struct linux_b
41409 vma->vm_end = STACK_TOP_MAX;
41410 vma->vm_start = vma->vm_end - PAGE_SIZE;
41411 vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
41412 +
41413 +#ifdef CONFIG_PAX_SEGMEXEC
41414 + vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
41415 +#endif
41416 +
41417 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
41418 INIT_LIST_HEAD(&vma->anon_vma_chain);
41419
41420 @@ -295,6 +304,12 @@ static int __bprm_mm_init(struct linux_b
41421 mm->stack_vm = mm->total_vm = 1;
41422 up_write(&mm->mmap_sem);
41423 bprm->p = vma->vm_end - sizeof(void *);
41424 +
41425 +#ifdef CONFIG_PAX_RANDUSTACK
41426 + if (randomize_va_space)
41427 + bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
41428 +#endif
41429 +
41430 return 0;
41431 err:
41432 up_write(&mm->mmap_sem);
41433 @@ -403,19 +418,7 @@ err:
41434 return err;
41435 }
41436
41437 -struct user_arg_ptr {
41438 -#ifdef CONFIG_COMPAT
41439 - bool is_compat;
41440 -#endif
41441 - union {
41442 - const char __user *const __user *native;
41443 -#ifdef CONFIG_COMPAT
41444 - compat_uptr_t __user *compat;
41445 -#endif
41446 - } ptr;
41447 -};
41448 -
41449 -static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
41450 +const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
41451 {
41452 const char __user *native;
41453
41454 @@ -424,14 +427,14 @@ static const char __user *get_user_arg_p
41455 compat_uptr_t compat;
41456
41457 if (get_user(compat, argv.ptr.compat + nr))
41458 - return ERR_PTR(-EFAULT);
41459 + return (const char __force_user *)ERR_PTR(-EFAULT);
41460
41461 return compat_ptr(compat);
41462 }
41463 #endif
41464
41465 if (get_user(native, argv.ptr.native + nr))
41466 - return ERR_PTR(-EFAULT);
41467 + return (const char __force_user *)ERR_PTR(-EFAULT);
41468
41469 return native;
41470 }
41471 @@ -450,7 +453,7 @@ static int count(struct user_arg_ptr arg
41472 if (!p)
41473 break;
41474
41475 - if (IS_ERR(p))
41476 + if (IS_ERR((const char __force_kernel *)p))
41477 return -EFAULT;
41478
41479 if (i++ >= max)
41480 @@ -484,7 +487,7 @@ static int copy_strings(int argc, struct
41481
41482 ret = -EFAULT;
41483 str = get_user_arg_ptr(argv, argc);
41484 - if (IS_ERR(str))
41485 + if (IS_ERR((const char __force_kernel *)str))
41486 goto out;
41487
41488 len = strnlen_user(str, MAX_ARG_STRLEN);
41489 @@ -566,7 +569,7 @@ int copy_strings_kernel(int argc, const
41490 int r;
41491 mm_segment_t oldfs = get_fs();
41492 struct user_arg_ptr argv = {
41493 - .ptr.native = (const char __user *const __user *)__argv,
41494 + .ptr.native = (const char __force_user *const __force_user *)__argv,
41495 };
41496
41497 set_fs(KERNEL_DS);
41498 @@ -601,7 +604,8 @@ static int shift_arg_pages(struct vm_are
41499 unsigned long new_end = old_end - shift;
41500 struct mmu_gather tlb;
41501
41502 - BUG_ON(new_start > new_end);
41503 + if (new_start >= new_end || new_start < mmap_min_addr)
41504 + return -ENOMEM;
41505
41506 /*
41507 * ensure there are no vmas between where we want to go
41508 @@ -610,6 +614,10 @@ static int shift_arg_pages(struct vm_are
41509 if (vma != find_vma(mm, new_start))
41510 return -EFAULT;
41511
41512 +#ifdef CONFIG_PAX_SEGMEXEC
41513 + BUG_ON(pax_find_mirror_vma(vma));
41514 +#endif
41515 +
41516 /*
41517 * cover the whole range: [new_start, old_end)
41518 */
41519 @@ -690,10 +698,6 @@ int setup_arg_pages(struct linux_binprm
41520 stack_top = arch_align_stack(stack_top);
41521 stack_top = PAGE_ALIGN(stack_top);
41522
41523 - if (unlikely(stack_top < mmap_min_addr) ||
41524 - unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
41525 - return -ENOMEM;
41526 -
41527 stack_shift = vma->vm_end - stack_top;
41528
41529 bprm->p -= stack_shift;
41530 @@ -705,8 +709,28 @@ int setup_arg_pages(struct linux_binprm
41531 bprm->exec -= stack_shift;
41532
41533 down_write(&mm->mmap_sem);
41534 +
41535 + /* Move stack pages down in memory. */
41536 + if (stack_shift) {
41537 + ret = shift_arg_pages(vma, stack_shift);
41538 + if (ret)
41539 + goto out_unlock;
41540 + }
41541 +
41542 vm_flags = VM_STACK_FLAGS;
41543
41544 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
41545 + if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
41546 + vm_flags &= ~VM_EXEC;
41547 +
41548 +#ifdef CONFIG_PAX_MPROTECT
41549 + if (mm->pax_flags & MF_PAX_MPROTECT)
41550 + vm_flags &= ~VM_MAYEXEC;
41551 +#endif
41552 +
41553 + }
41554 +#endif
41555 +
41556 /*
41557 * Adjust stack execute permissions; explicitly enable for
41558 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
41559 @@ -725,13 +749,6 @@ int setup_arg_pages(struct linux_binprm
41560 goto out_unlock;
41561 BUG_ON(prev != vma);
41562
41563 - /* Move stack pages down in memory. */
41564 - if (stack_shift) {
41565 - ret = shift_arg_pages(vma, stack_shift);
41566 - if (ret)
41567 - goto out_unlock;
41568 - }
41569 -
41570 /* mprotect_fixup is overkill to remove the temporary stack flags */
41571 vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
41572
41573 @@ -771,7 +788,7 @@ struct file *open_exec(const char *name)
41574 struct file *file;
41575 int err;
41576 static const struct open_flags open_exec_flags = {
41577 - .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
41578 + .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC | FMODE_GREXEC,
41579 .acc_mode = MAY_EXEC | MAY_OPEN,
41580 .intent = LOOKUP_OPEN
41581 };
41582 @@ -812,7 +829,7 @@ int kernel_read(struct file *file, loff_
41583 old_fs = get_fs();
41584 set_fs(get_ds());
41585 /* The cast to a user pointer is valid due to the set_fs() */
41586 - result = vfs_read(file, (void __user *)addr, count, &pos);
41587 + result = vfs_read(file, (void __force_user *)addr, count, &pos);
41588 set_fs(old_fs);
41589 return result;
41590 }
41591 @@ -1236,7 +1253,7 @@ int check_unsafe_exec(struct linux_binpr
41592 }
41593 rcu_read_unlock();
41594
41595 - if (p->fs->users > n_fs) {
41596 + if (atomic_read(&p->fs->users) > n_fs) {
41597 bprm->unsafe |= LSM_UNSAFE_SHARE;
41598 } else {
41599 res = -EAGAIN;
41600 @@ -1430,11 +1447,35 @@ static int do_execve_common(const char *
41601 struct user_arg_ptr envp,
41602 struct pt_regs *regs)
41603 {
41604 +#ifdef CONFIG_GRKERNSEC
41605 + struct file *old_exec_file;
41606 + struct acl_subject_label *old_acl;
41607 + struct rlimit old_rlim[RLIM_NLIMITS];
41608 +#endif
41609 struct linux_binprm *bprm;
41610 struct file *file;
41611 struct files_struct *displaced;
41612 bool clear_in_exec;
41613 int retval;
41614 + const struct cred *cred = current_cred();
41615 +
41616 + gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
41617 +
41618 + /*
41619 + * We move the actual failure in case of RLIMIT_NPROC excess from
41620 + * set*uid() to execve() because too many poorly written programs
41621 + * don't check setuid() return code. Here we additionally recheck
41622 + * whether NPROC limit is still exceeded.
41623 + */
41624 + if ((current->flags & PF_NPROC_EXCEEDED) &&
41625 + atomic_read(&cred->user->processes) > rlimit(RLIMIT_NPROC)) {
41626 + retval = -EAGAIN;
41627 + goto out_ret;
41628 + }
41629 +
41630 + /* We're below the limit (still or again), so we don't want to make
41631 + * further execve() calls fail. */
41632 + current->flags &= ~PF_NPROC_EXCEEDED;
41633
41634 retval = unshare_files(&displaced);
41635 if (retval)
41636 @@ -1466,6 +1507,16 @@ static int do_execve_common(const char *
41637 bprm->filename = filename;
41638 bprm->interp = filename;
41639
41640 + if (gr_process_user_ban()) {
41641 + retval = -EPERM;
41642 + goto out_file;
41643 + }
41644 +
41645 + if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
41646 + retval = -EACCES;
41647 + goto out_file;
41648 + }
41649 +
41650 retval = bprm_mm_init(bprm);
41651 if (retval)
41652 goto out_file;
41653 @@ -1495,9 +1546,40 @@ static int do_execve_common(const char *
41654 if (retval < 0)
41655 goto out;
41656
41657 + if (!gr_tpe_allow(file)) {
41658 + retval = -EACCES;
41659 + goto out;
41660 + }
41661 +
41662 + if (gr_check_crash_exec(file)) {
41663 + retval = -EACCES;
41664 + goto out;
41665 + }
41666 +
41667 + gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
41668 +
41669 + gr_handle_exec_args(bprm, argv);
41670 +
41671 +#ifdef CONFIG_GRKERNSEC
41672 + old_acl = current->acl;
41673 + memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
41674 + old_exec_file = current->exec_file;
41675 + get_file(file);
41676 + current->exec_file = file;
41677 +#endif
41678 +
41679 + retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
41680 + bprm->unsafe & LSM_UNSAFE_SHARE);
41681 + if (retval < 0)
41682 + goto out_fail;
41683 +
41684 retval = search_binary_handler(bprm,regs);
41685 if (retval < 0)
41686 - goto out;
41687 + goto out_fail;
41688 +#ifdef CONFIG_GRKERNSEC
41689 + if (old_exec_file)
41690 + fput(old_exec_file);
41691 +#endif
41692
41693 /* execve succeeded */
41694 current->fs->in_exec = 0;
41695 @@ -1508,6 +1590,14 @@ static int do_execve_common(const char *
41696 put_files_struct(displaced);
41697 return retval;
41698
41699 +out_fail:
41700 +#ifdef CONFIG_GRKERNSEC
41701 + current->acl = old_acl;
41702 + memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
41703 + fput(current->exec_file);
41704 + current->exec_file = old_exec_file;
41705 +#endif
41706 +
41707 out:
41708 if (bprm->mm) {
41709 acct_arg_size(bprm, 0);
41710 @@ -1581,7 +1671,7 @@ static int expand_corename(struct core_n
41711 {
41712 char *old_corename = cn->corename;
41713
41714 - cn->size = CORENAME_MAX_SIZE * atomic_inc_return(&call_count);
41715 + cn->size = CORENAME_MAX_SIZE * atomic_inc_return_unchecked(&call_count);
41716 cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
41717
41718 if (!cn->corename) {
41719 @@ -1669,7 +1759,7 @@ static int format_corename(struct core_n
41720 int pid_in_pattern = 0;
41721 int err = 0;
41722
41723 - cn->size = CORENAME_MAX_SIZE * atomic_read(&call_count);
41724 + cn->size = CORENAME_MAX_SIZE * atomic_read_unchecked(&call_count);
41725 cn->corename = kmalloc(cn->size, GFP_KERNEL);
41726 cn->used = 0;
41727
41728 @@ -1760,6 +1850,219 @@ out:
41729 return ispipe;
41730 }
41731
41732 +int pax_check_flags(unsigned long *flags)
41733 +{
41734 + int retval = 0;
41735 +
41736 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
41737 + if (*flags & MF_PAX_SEGMEXEC)
41738 + {
41739 + *flags &= ~MF_PAX_SEGMEXEC;
41740 + retval = -EINVAL;
41741 + }
41742 +#endif
41743 +
41744 + if ((*flags & MF_PAX_PAGEEXEC)
41745 +
41746 +#ifdef CONFIG_PAX_PAGEEXEC
41747 + && (*flags & MF_PAX_SEGMEXEC)
41748 +#endif
41749 +
41750 + )
41751 + {
41752 + *flags &= ~MF_PAX_PAGEEXEC;
41753 + retval = -EINVAL;
41754 + }
41755 +
41756 + if ((*flags & MF_PAX_MPROTECT)
41757 +
41758 +#ifdef CONFIG_PAX_MPROTECT
41759 + && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
41760 +#endif
41761 +
41762 + )
41763 + {
41764 + *flags &= ~MF_PAX_MPROTECT;
41765 + retval = -EINVAL;
41766 + }
41767 +
41768 + if ((*flags & MF_PAX_EMUTRAMP)
41769 +
41770 +#ifdef CONFIG_PAX_EMUTRAMP
41771 + && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
41772 +#endif
41773 +
41774 + )
41775 + {
41776 + *flags &= ~MF_PAX_EMUTRAMP;
41777 + retval = -EINVAL;
41778 + }
41779 +
41780 + return retval;
41781 +}
41782 +
41783 +EXPORT_SYMBOL(pax_check_flags);
41784 +
41785 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
41786 +void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
41787 +{
41788 + struct task_struct *tsk = current;
41789 + struct mm_struct *mm = current->mm;
41790 + char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
41791 + char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
41792 + char *path_exec = NULL;
41793 + char *path_fault = NULL;
41794 + unsigned long start = 0UL, end = 0UL, offset = 0UL;
41795 +
41796 + if (buffer_exec && buffer_fault) {
41797 + struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
41798 +
41799 + down_read(&mm->mmap_sem);
41800 + vma = mm->mmap;
41801 + while (vma && (!vma_exec || !vma_fault)) {
41802 + if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
41803 + vma_exec = vma;
41804 + if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
41805 + vma_fault = vma;
41806 + vma = vma->vm_next;
41807 + }
41808 + if (vma_exec) {
41809 + path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
41810 + if (IS_ERR(path_exec))
41811 + path_exec = "<path too long>";
41812 + else {
41813 + path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
41814 + if (path_exec) {
41815 + *path_exec = 0;
41816 + path_exec = buffer_exec;
41817 + } else
41818 + path_exec = "<path too long>";
41819 + }
41820 + }
41821 + if (vma_fault) {
41822 + start = vma_fault->vm_start;
41823 + end = vma_fault->vm_end;
41824 + offset = vma_fault->vm_pgoff << PAGE_SHIFT;
41825 + if (vma_fault->vm_file) {
41826 + path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
41827 + if (IS_ERR(path_fault))
41828 + path_fault = "<path too long>";
41829 + else {
41830 + path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
41831 + if (path_fault) {
41832 + *path_fault = 0;
41833 + path_fault = buffer_fault;
41834 + } else
41835 + path_fault = "<path too long>";
41836 + }
41837 + } else
41838 + path_fault = "<anonymous mapping>";
41839 + }
41840 + up_read(&mm->mmap_sem);
41841 + }
41842 + if (tsk->signal->curr_ip)
41843 + printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
41844 + else
41845 + printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
41846 + printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
41847 + "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
41848 + task_uid(tsk), task_euid(tsk), pc, sp);
41849 + free_page((unsigned long)buffer_exec);
41850 + free_page((unsigned long)buffer_fault);
41851 + pax_report_insns(pc, sp);
41852 + do_coredump(SIGKILL, SIGKILL, regs);
41853 +}
41854 +#endif
41855 +
41856 +#ifdef CONFIG_PAX_REFCOUNT
41857 +void pax_report_refcount_overflow(struct pt_regs *regs)
41858 +{
41859 + if (current->signal->curr_ip)
41860 + printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
41861 + &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
41862 + else
41863 + printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
41864 + current->comm, task_pid_nr(current), current_uid(), current_euid());
41865 + print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
41866 + show_regs(regs);
41867 + force_sig_info(SIGKILL, SEND_SIG_FORCED, current);
41868 +}
41869 +#endif
41870 +
41871 +#ifdef CONFIG_PAX_USERCOPY
41872 +/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
41873 +int object_is_on_stack(const void *obj, unsigned long len)
41874 +{
41875 + const void * const stack = task_stack_page(current);
41876 + const void * const stackend = stack + THREAD_SIZE;
41877 +
41878 +#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
41879 + const void *frame = NULL;
41880 + const void *oldframe;
41881 +#endif
41882 +
41883 + if (obj + len < obj)
41884 + return -1;
41885 +
41886 + if (obj + len <= stack || stackend <= obj)
41887 + return 0;
41888 +
41889 + if (obj < stack || stackend < obj + len)
41890 + return -1;
41891 +
41892 +#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
41893 + oldframe = __builtin_frame_address(1);
41894 + if (oldframe)
41895 + frame = __builtin_frame_address(2);
41896 + /*
41897 + low ----------------------------------------------> high
41898 + [saved bp][saved ip][args][local vars][saved bp][saved ip]
41899 + ^----------------^
41900 + allow copies only within here
41901 + */
41902 + while (stack <= frame && frame < stackend) {
41903 + /* if obj + len extends past the last frame, this
41904 + check won't pass and the next frame will be 0,
41905 + causing us to bail out and correctly report
41906 + the copy as invalid
41907 + */
41908 + if (obj + len <= frame)
41909 + return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
41910 + oldframe = frame;
41911 + frame = *(const void * const *)frame;
41912 + }
41913 + return -1;
41914 +#else
41915 + return 1;
41916 +#endif
41917 +}
41918 +
41919 +
41920 +NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
41921 +{
41922 + if (current->signal->curr_ip)
41923 + printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
41924 + &current->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
41925 + else
41926 + printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
41927 + to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
41928 + dump_stack();
41929 + gr_handle_kernel_exploit();
41930 + do_group_exit(SIGKILL);
41931 +}
41932 +#endif
41933 +
41934 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
41935 +void pax_track_stack(void)
41936 +{
41937 + unsigned long sp = (unsigned long)&sp;
41938 + if (sp < current_thread_info()->lowest_stack &&
41939 + sp > (unsigned long)task_stack_page(current))
41940 + current_thread_info()->lowest_stack = sp;
41941 +}
41942 +EXPORT_SYMBOL(pax_track_stack);
41943 +#endif
41944 +
41945 static int zap_process(struct task_struct *start, int exit_code)
41946 {
41947 struct task_struct *t;
41948 @@ -1971,17 +2274,17 @@ static void wait_for_dump_helpers(struct
41949 pipe = file->f_path.dentry->d_inode->i_pipe;
41950
41951 pipe_lock(pipe);
41952 - pipe->readers++;
41953 - pipe->writers--;
41954 + atomic_inc(&pipe->readers);
41955 + atomic_dec(&pipe->writers);
41956
41957 - while ((pipe->readers > 1) && (!signal_pending(current))) {
41958 + while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
41959 wake_up_interruptible_sync(&pipe->wait);
41960 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
41961 pipe_wait(pipe);
41962 }
41963
41964 - pipe->readers--;
41965 - pipe->writers++;
41966 + atomic_dec(&pipe->readers);
41967 + atomic_inc(&pipe->writers);
41968 pipe_unlock(pipe);
41969
41970 }
41971 @@ -2042,7 +2345,7 @@ void do_coredump(long signr, int exit_co
41972 int retval = 0;
41973 int flag = 0;
41974 int ispipe;
41975 - static atomic_t core_dump_count = ATOMIC_INIT(0);
41976 + static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
41977 struct coredump_params cprm = {
41978 .signr = signr,
41979 .regs = regs,
41980 @@ -2057,6 +2360,9 @@ void do_coredump(long signr, int exit_co
41981
41982 audit_core_dumps(signr);
41983
41984 + if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
41985 + gr_handle_brute_attach(current, cprm.mm_flags);
41986 +
41987 binfmt = mm->binfmt;
41988 if (!binfmt || !binfmt->core_dump)
41989 goto fail;
41990 @@ -2097,6 +2403,8 @@ void do_coredump(long signr, int exit_co
41991 goto fail_corename;
41992 }
41993
41994 + gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
41995 +
41996 if (ispipe) {
41997 int dump_count;
41998 char **helper_argv;
41999 @@ -2124,7 +2432,7 @@ void do_coredump(long signr, int exit_co
42000 }
42001 cprm.limit = RLIM_INFINITY;
42002
42003 - dump_count = atomic_inc_return(&core_dump_count);
42004 + dump_count = atomic_inc_return_unchecked(&core_dump_count);
42005 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
42006 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
42007 task_tgid_vnr(current), current->comm);
42008 @@ -2194,7 +2502,7 @@ close_fail:
42009 filp_close(cprm.file, NULL);
42010 fail_dropcount:
42011 if (ispipe)
42012 - atomic_dec(&core_dump_count);
42013 + atomic_dec_unchecked(&core_dump_count);
42014 fail_unlock:
42015 kfree(cn.corename);
42016 fail_corename:
42017 @@ -2213,7 +2521,7 @@ fail:
42018 */
42019 int dump_write(struct file *file, const void *addr, int nr)
42020 {
42021 - return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, addr, nr, &file->f_pos) == nr;
42022 + return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, (const char __force_user *)addr, nr, &file->f_pos) == nr;
42023 }
42024 EXPORT_SYMBOL(dump_write);
42025
42026 diff -urNp linux-3.0.9/fs/ext2/balloc.c linux-3.0.9/fs/ext2/balloc.c
42027 --- linux-3.0.9/fs/ext2/balloc.c 2011-11-11 13:12:24.000000000 -0500
42028 +++ linux-3.0.9/fs/ext2/balloc.c 2011-11-15 20:02:59.000000000 -0500
42029 @@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
42030
42031 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
42032 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
42033 - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
42034 + if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
42035 sbi->s_resuid != current_fsuid() &&
42036 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
42037 return 0;
42038 diff -urNp linux-3.0.9/fs/ext3/balloc.c linux-3.0.9/fs/ext3/balloc.c
42039 --- linux-3.0.9/fs/ext3/balloc.c 2011-11-11 13:12:24.000000000 -0500
42040 +++ linux-3.0.9/fs/ext3/balloc.c 2011-11-15 20:02:59.000000000 -0500
42041 @@ -1441,7 +1441,7 @@ static int ext3_has_free_blocks(struct e
42042
42043 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
42044 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
42045 - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
42046 + if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
42047 sbi->s_resuid != current_fsuid() &&
42048 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
42049 return 0;
42050 diff -urNp linux-3.0.9/fs/ext3/ioctl.c linux-3.0.9/fs/ext3/ioctl.c
42051 --- linux-3.0.9/fs/ext3/ioctl.c 2011-11-11 13:12:24.000000000 -0500
42052 +++ linux-3.0.9/fs/ext3/ioctl.c 2011-11-15 20:02:59.000000000 -0500
42053 @@ -285,7 +285,7 @@ group_add_out:
42054 if (!capable(CAP_SYS_ADMIN))
42055 return -EPERM;
42056
42057 - if (copy_from_user(&range, (struct fstrim_range *)arg,
42058 + if (copy_from_user(&range, (struct fstrim_range __user *)arg,
42059 sizeof(range)))
42060 return -EFAULT;
42061
42062 @@ -293,7 +293,7 @@ group_add_out:
42063 if (ret < 0)
42064 return ret;
42065
42066 - if (copy_to_user((struct fstrim_range *)arg, &range,
42067 + if (copy_to_user((struct fstrim_range __user *)arg, &range,
42068 sizeof(range)))
42069 return -EFAULT;
42070
42071 diff -urNp linux-3.0.9/fs/ext4/balloc.c linux-3.0.9/fs/ext4/balloc.c
42072 --- linux-3.0.9/fs/ext4/balloc.c 2011-11-11 13:12:24.000000000 -0500
42073 +++ linux-3.0.9/fs/ext4/balloc.c 2011-11-15 20:02:59.000000000 -0500
42074 @@ -394,8 +394,8 @@ static int ext4_has_free_blocks(struct e
42075 /* Hm, nope. Are (enough) root reserved blocks available? */
42076 if (sbi->s_resuid == current_fsuid() ||
42077 ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
42078 - capable(CAP_SYS_RESOURCE) ||
42079 - (flags & EXT4_MB_USE_ROOT_BLOCKS)) {
42080 + (flags & EXT4_MB_USE_ROOT_BLOCKS) ||
42081 + capable_nolog(CAP_SYS_RESOURCE)) {
42082
42083 if (free_blocks >= (nblocks + dirty_blocks))
42084 return 1;
42085 diff -urNp linux-3.0.9/fs/ext4/ext4.h linux-3.0.9/fs/ext4/ext4.h
42086 --- linux-3.0.9/fs/ext4/ext4.h 2011-11-11 13:12:24.000000000 -0500
42087 +++ linux-3.0.9/fs/ext4/ext4.h 2011-11-15 20:02:59.000000000 -0500
42088 @@ -1177,19 +1177,19 @@ struct ext4_sb_info {
42089 unsigned long s_mb_last_start;
42090
42091 /* stats for buddy allocator */
42092 - atomic_t s_bal_reqs; /* number of reqs with len > 1 */
42093 - atomic_t s_bal_success; /* we found long enough chunks */
42094 - atomic_t s_bal_allocated; /* in blocks */
42095 - atomic_t s_bal_ex_scanned; /* total extents scanned */
42096 - atomic_t s_bal_goals; /* goal hits */
42097 - atomic_t s_bal_breaks; /* too long searches */
42098 - atomic_t s_bal_2orders; /* 2^order hits */
42099 + atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
42100 + atomic_unchecked_t s_bal_success; /* we found long enough chunks */
42101 + atomic_unchecked_t s_bal_allocated; /* in blocks */
42102 + atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
42103 + atomic_unchecked_t s_bal_goals; /* goal hits */
42104 + atomic_unchecked_t s_bal_breaks; /* too long searches */
42105 + atomic_unchecked_t s_bal_2orders; /* 2^order hits */
42106 spinlock_t s_bal_lock;
42107 unsigned long s_mb_buddies_generated;
42108 unsigned long long s_mb_generation_time;
42109 - atomic_t s_mb_lost_chunks;
42110 - atomic_t s_mb_preallocated;
42111 - atomic_t s_mb_discarded;
42112 + atomic_unchecked_t s_mb_lost_chunks;
42113 + atomic_unchecked_t s_mb_preallocated;
42114 + atomic_unchecked_t s_mb_discarded;
42115 atomic_t s_lock_busy;
42116
42117 /* locality groups */
42118 diff -urNp linux-3.0.9/fs/ext4/file.c linux-3.0.9/fs/ext4/file.c
42119 --- linux-3.0.9/fs/ext4/file.c 2011-11-11 13:12:24.000000000 -0500
42120 +++ linux-3.0.9/fs/ext4/file.c 2011-11-15 20:02:59.000000000 -0500
42121 @@ -181,8 +181,8 @@ static int ext4_file_open(struct inode *
42122 path.dentry = mnt->mnt_root;
42123 cp = d_path(&path, buf, sizeof(buf));
42124 if (!IS_ERR(cp)) {
42125 - memcpy(sbi->s_es->s_last_mounted, cp,
42126 - sizeof(sbi->s_es->s_last_mounted));
42127 + strlcpy(sbi->s_es->s_last_mounted, cp,
42128 + sizeof(sbi->s_es->s_last_mounted));
42129 ext4_mark_super_dirty(sb);
42130 }
42131 }
42132 diff -urNp linux-3.0.9/fs/ext4/ioctl.c linux-3.0.9/fs/ext4/ioctl.c
42133 --- linux-3.0.9/fs/ext4/ioctl.c 2011-11-11 13:12:24.000000000 -0500
42134 +++ linux-3.0.9/fs/ext4/ioctl.c 2011-11-15 20:02:59.000000000 -0500
42135 @@ -344,7 +344,7 @@ mext_out:
42136 if (!blk_queue_discard(q))
42137 return -EOPNOTSUPP;
42138
42139 - if (copy_from_user(&range, (struct fstrim_range *)arg,
42140 + if (copy_from_user(&range, (struct fstrim_range __user *)arg,
42141 sizeof(range)))
42142 return -EFAULT;
42143
42144 @@ -354,7 +354,7 @@ mext_out:
42145 if (ret < 0)
42146 return ret;
42147
42148 - if (copy_to_user((struct fstrim_range *)arg, &range,
42149 + if (copy_to_user((struct fstrim_range __user *)arg, &range,
42150 sizeof(range)))
42151 return -EFAULT;
42152
42153 diff -urNp linux-3.0.9/fs/ext4/mballoc.c linux-3.0.9/fs/ext4/mballoc.c
42154 --- linux-3.0.9/fs/ext4/mballoc.c 2011-11-11 13:12:24.000000000 -0500
42155 +++ linux-3.0.9/fs/ext4/mballoc.c 2011-11-15 20:02:59.000000000 -0500
42156 @@ -1793,7 +1793,7 @@ void ext4_mb_simple_scan_group(struct ex
42157 BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
42158
42159 if (EXT4_SB(sb)->s_mb_stats)
42160 - atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
42161 + atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
42162
42163 break;
42164 }
42165 @@ -2087,7 +2087,7 @@ repeat:
42166 ac->ac_status = AC_STATUS_CONTINUE;
42167 ac->ac_flags |= EXT4_MB_HINT_FIRST;
42168 cr = 3;
42169 - atomic_inc(&sbi->s_mb_lost_chunks);
42170 + atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
42171 goto repeat;
42172 }
42173 }
42174 @@ -2130,6 +2130,8 @@ static int ext4_mb_seq_groups_show(struc
42175 ext4_grpblk_t counters[16];
42176 } sg;
42177
42178 + pax_track_stack();
42179 +
42180 group--;
42181 if (group == 0)
42182 seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
42183 @@ -2553,25 +2555,25 @@ int ext4_mb_release(struct super_block *
42184 if (sbi->s_mb_stats) {
42185 printk(KERN_INFO
42186 "EXT4-fs: mballoc: %u blocks %u reqs (%u success)\n",
42187 - atomic_read(&sbi->s_bal_allocated),
42188 - atomic_read(&sbi->s_bal_reqs),
42189 - atomic_read(&sbi->s_bal_success));
42190 + atomic_read_unchecked(&sbi->s_bal_allocated),
42191 + atomic_read_unchecked(&sbi->s_bal_reqs),
42192 + atomic_read_unchecked(&sbi->s_bal_success));
42193 printk(KERN_INFO
42194 "EXT4-fs: mballoc: %u extents scanned, %u goal hits, "
42195 "%u 2^N hits, %u breaks, %u lost\n",
42196 - atomic_read(&sbi->s_bal_ex_scanned),
42197 - atomic_read(&sbi->s_bal_goals),
42198 - atomic_read(&sbi->s_bal_2orders),
42199 - atomic_read(&sbi->s_bal_breaks),
42200 - atomic_read(&sbi->s_mb_lost_chunks));
42201 + atomic_read_unchecked(&sbi->s_bal_ex_scanned),
42202 + atomic_read_unchecked(&sbi->s_bal_goals),
42203 + atomic_read_unchecked(&sbi->s_bal_2orders),
42204 + atomic_read_unchecked(&sbi->s_bal_breaks),
42205 + atomic_read_unchecked(&sbi->s_mb_lost_chunks));
42206 printk(KERN_INFO
42207 "EXT4-fs: mballoc: %lu generated and it took %Lu\n",
42208 sbi->s_mb_buddies_generated++,
42209 sbi->s_mb_generation_time);
42210 printk(KERN_INFO
42211 "EXT4-fs: mballoc: %u preallocated, %u discarded\n",
42212 - atomic_read(&sbi->s_mb_preallocated),
42213 - atomic_read(&sbi->s_mb_discarded));
42214 + atomic_read_unchecked(&sbi->s_mb_preallocated),
42215 + atomic_read_unchecked(&sbi->s_mb_discarded));
42216 }
42217
42218 free_percpu(sbi->s_locality_groups);
42219 @@ -3041,16 +3043,16 @@ static void ext4_mb_collect_stats(struct
42220 struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
42221
42222 if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
42223 - atomic_inc(&sbi->s_bal_reqs);
42224 - atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
42225 + atomic_inc_unchecked(&sbi->s_bal_reqs);
42226 + atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
42227 if (ac->ac_b_ex.fe_len >= ac->ac_o_ex.fe_len)
42228 - atomic_inc(&sbi->s_bal_success);
42229 - atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
42230 + atomic_inc_unchecked(&sbi->s_bal_success);
42231 + atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
42232 if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
42233 ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
42234 - atomic_inc(&sbi->s_bal_goals);
42235 + atomic_inc_unchecked(&sbi->s_bal_goals);
42236 if (ac->ac_found > sbi->s_mb_max_to_scan)
42237 - atomic_inc(&sbi->s_bal_breaks);
42238 + atomic_inc_unchecked(&sbi->s_bal_breaks);
42239 }
42240
42241 if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
42242 @@ -3448,7 +3450,7 @@ ext4_mb_new_inode_pa(struct ext4_allocat
42243 trace_ext4_mb_new_inode_pa(ac, pa);
42244
42245 ext4_mb_use_inode_pa(ac, pa);
42246 - atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
42247 + atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
42248
42249 ei = EXT4_I(ac->ac_inode);
42250 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
42251 @@ -3508,7 +3510,7 @@ ext4_mb_new_group_pa(struct ext4_allocat
42252 trace_ext4_mb_new_group_pa(ac, pa);
42253
42254 ext4_mb_use_group_pa(ac, pa);
42255 - atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
42256 + atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
42257
42258 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
42259 lg = ac->ac_lg;
42260 @@ -3595,7 +3597,7 @@ ext4_mb_release_inode_pa(struct ext4_bud
42261 * from the bitmap and continue.
42262 */
42263 }
42264 - atomic_add(free, &sbi->s_mb_discarded);
42265 + atomic_add_unchecked(free, &sbi->s_mb_discarded);
42266
42267 return err;
42268 }
42269 @@ -3613,7 +3615,7 @@ ext4_mb_release_group_pa(struct ext4_bud
42270 ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
42271 BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
42272 mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
42273 - atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
42274 + atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
42275 trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
42276
42277 return 0;
42278 diff -urNp linux-3.0.9/fs/fcntl.c linux-3.0.9/fs/fcntl.c
42279 --- linux-3.0.9/fs/fcntl.c 2011-11-11 13:12:24.000000000 -0500
42280 +++ linux-3.0.9/fs/fcntl.c 2011-11-15 20:02:59.000000000 -0500
42281 @@ -224,6 +224,11 @@ int __f_setown(struct file *filp, struct
42282 if (err)
42283 return err;
42284
42285 + if (gr_handle_chroot_fowner(pid, type))
42286 + return -ENOENT;
42287 + if (gr_check_protected_task_fowner(pid, type))
42288 + return -EACCES;
42289 +
42290 f_modown(filp, pid, type, force);
42291 return 0;
42292 }
42293 @@ -266,7 +271,7 @@ pid_t f_getown(struct file *filp)
42294
42295 static int f_setown_ex(struct file *filp, unsigned long arg)
42296 {
42297 - struct f_owner_ex * __user owner_p = (void * __user)arg;
42298 + struct f_owner_ex __user *owner_p = (void __user *)arg;
42299 struct f_owner_ex owner;
42300 struct pid *pid;
42301 int type;
42302 @@ -306,7 +311,7 @@ static int f_setown_ex(struct file *filp
42303
42304 static int f_getown_ex(struct file *filp, unsigned long arg)
42305 {
42306 - struct f_owner_ex * __user owner_p = (void * __user)arg;
42307 + struct f_owner_ex __user *owner_p = (void __user *)arg;
42308 struct f_owner_ex owner;
42309 int ret = 0;
42310
42311 @@ -348,6 +353,7 @@ static long do_fcntl(int fd, unsigned in
42312 switch (cmd) {
42313 case F_DUPFD:
42314 case F_DUPFD_CLOEXEC:
42315 + gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
42316 if (arg >= rlimit(RLIMIT_NOFILE))
42317 break;
42318 err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
42319 @@ -835,14 +841,14 @@ static int __init fcntl_init(void)
42320 * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
42321 * is defined as O_NONBLOCK on some platforms and not on others.
42322 */
42323 - BUILD_BUG_ON(19 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
42324 + BUILD_BUG_ON(20 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
42325 O_RDONLY | O_WRONLY | O_RDWR |
42326 O_CREAT | O_EXCL | O_NOCTTY |
42327 O_TRUNC | O_APPEND | /* O_NONBLOCK | */
42328 __O_SYNC | O_DSYNC | FASYNC |
42329 O_DIRECT | O_LARGEFILE | O_DIRECTORY |
42330 O_NOFOLLOW | O_NOATIME | O_CLOEXEC |
42331 - __FMODE_EXEC | O_PATH
42332 + __FMODE_EXEC | O_PATH | FMODE_GREXEC
42333 ));
42334
42335 fasync_cache = kmem_cache_create("fasync_cache",
42336 diff -urNp linux-3.0.9/fs/fifo.c linux-3.0.9/fs/fifo.c
42337 --- linux-3.0.9/fs/fifo.c 2011-11-11 13:12:24.000000000 -0500
42338 +++ linux-3.0.9/fs/fifo.c 2011-11-15 20:02:59.000000000 -0500
42339 @@ -58,10 +58,10 @@ static int fifo_open(struct inode *inode
42340 */
42341 filp->f_op = &read_pipefifo_fops;
42342 pipe->r_counter++;
42343 - if (pipe->readers++ == 0)
42344 + if (atomic_inc_return(&pipe->readers) == 1)
42345 wake_up_partner(inode);
42346
42347 - if (!pipe->writers) {
42348 + if (!atomic_read(&pipe->writers)) {
42349 if ((filp->f_flags & O_NONBLOCK)) {
42350 /* suppress POLLHUP until we have
42351 * seen a writer */
42352 @@ -81,15 +81,15 @@ static int fifo_open(struct inode *inode
42353 * errno=ENXIO when there is no process reading the FIFO.
42354 */
42355 ret = -ENXIO;
42356 - if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
42357 + if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
42358 goto err;
42359
42360 filp->f_op = &write_pipefifo_fops;
42361 pipe->w_counter++;
42362 - if (!pipe->writers++)
42363 + if (atomic_inc_return(&pipe->writers) == 1)
42364 wake_up_partner(inode);
42365
42366 - if (!pipe->readers) {
42367 + if (!atomic_read(&pipe->readers)) {
42368 wait_for_partner(inode, &pipe->r_counter);
42369 if (signal_pending(current))
42370 goto err_wr;
42371 @@ -105,11 +105,11 @@ static int fifo_open(struct inode *inode
42372 */
42373 filp->f_op = &rdwr_pipefifo_fops;
42374
42375 - pipe->readers++;
42376 - pipe->writers++;
42377 + atomic_inc(&pipe->readers);
42378 + atomic_inc(&pipe->writers);
42379 pipe->r_counter++;
42380 pipe->w_counter++;
42381 - if (pipe->readers == 1 || pipe->writers == 1)
42382 + if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
42383 wake_up_partner(inode);
42384 break;
42385
42386 @@ -123,19 +123,19 @@ static int fifo_open(struct inode *inode
42387 return 0;
42388
42389 err_rd:
42390 - if (!--pipe->readers)
42391 + if (atomic_dec_and_test(&pipe->readers))
42392 wake_up_interruptible(&pipe->wait);
42393 ret = -ERESTARTSYS;
42394 goto err;
42395
42396 err_wr:
42397 - if (!--pipe->writers)
42398 + if (atomic_dec_and_test(&pipe->writers))
42399 wake_up_interruptible(&pipe->wait);
42400 ret = -ERESTARTSYS;
42401 goto err;
42402
42403 err:
42404 - if (!pipe->readers && !pipe->writers)
42405 + if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
42406 free_pipe_info(inode);
42407
42408 err_nocleanup:
42409 diff -urNp linux-3.0.9/fs/file.c linux-3.0.9/fs/file.c
42410 --- linux-3.0.9/fs/file.c 2011-11-11 13:12:24.000000000 -0500
42411 +++ linux-3.0.9/fs/file.c 2011-11-15 20:02:59.000000000 -0500
42412 @@ -15,6 +15,7 @@
42413 #include <linux/slab.h>
42414 #include <linux/vmalloc.h>
42415 #include <linux/file.h>
42416 +#include <linux/security.h>
42417 #include <linux/fdtable.h>
42418 #include <linux/bitops.h>
42419 #include <linux/interrupt.h>
42420 @@ -254,6 +255,7 @@ int expand_files(struct files_struct *fi
42421 * N.B. For clone tasks sharing a files structure, this test
42422 * will limit the total number of files that can be opened.
42423 */
42424 + gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
42425 if (nr >= rlimit(RLIMIT_NOFILE))
42426 return -EMFILE;
42427
42428 diff -urNp linux-3.0.9/fs/filesystems.c linux-3.0.9/fs/filesystems.c
42429 --- linux-3.0.9/fs/filesystems.c 2011-11-11 13:12:24.000000000 -0500
42430 +++ linux-3.0.9/fs/filesystems.c 2011-11-15 20:02:59.000000000 -0500
42431 @@ -274,7 +274,12 @@ struct file_system_type *get_fs_type(con
42432 int len = dot ? dot - name : strlen(name);
42433
42434 fs = __get_fs_type(name, len);
42435 +
42436 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
42437 + if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
42438 +#else
42439 if (!fs && (request_module("%.*s", len, name) == 0))
42440 +#endif
42441 fs = __get_fs_type(name, len);
42442
42443 if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
42444 diff -urNp linux-3.0.9/fs/fscache/cookie.c linux-3.0.9/fs/fscache/cookie.c
42445 --- linux-3.0.9/fs/fscache/cookie.c 2011-11-11 13:12:24.000000000 -0500
42446 +++ linux-3.0.9/fs/fscache/cookie.c 2011-11-15 20:02:59.000000000 -0500
42447 @@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire
42448 parent ? (char *) parent->def->name : "<no-parent>",
42449 def->name, netfs_data);
42450
42451 - fscache_stat(&fscache_n_acquires);
42452 + fscache_stat_unchecked(&fscache_n_acquires);
42453
42454 /* if there's no parent cookie, then we don't create one here either */
42455 if (!parent) {
42456 - fscache_stat(&fscache_n_acquires_null);
42457 + fscache_stat_unchecked(&fscache_n_acquires_null);
42458 _leave(" [no parent]");
42459 return NULL;
42460 }
42461 @@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire
42462 /* allocate and initialise a cookie */
42463 cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
42464 if (!cookie) {
42465 - fscache_stat(&fscache_n_acquires_oom);
42466 + fscache_stat_unchecked(&fscache_n_acquires_oom);
42467 _leave(" [ENOMEM]");
42468 return NULL;
42469 }
42470 @@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire
42471
42472 switch (cookie->def->type) {
42473 case FSCACHE_COOKIE_TYPE_INDEX:
42474 - fscache_stat(&fscache_n_cookie_index);
42475 + fscache_stat_unchecked(&fscache_n_cookie_index);
42476 break;
42477 case FSCACHE_COOKIE_TYPE_DATAFILE:
42478 - fscache_stat(&fscache_n_cookie_data);
42479 + fscache_stat_unchecked(&fscache_n_cookie_data);
42480 break;
42481 default:
42482 - fscache_stat(&fscache_n_cookie_special);
42483 + fscache_stat_unchecked(&fscache_n_cookie_special);
42484 break;
42485 }
42486
42487 @@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire
42488 if (fscache_acquire_non_index_cookie(cookie) < 0) {
42489 atomic_dec(&parent->n_children);
42490 __fscache_cookie_put(cookie);
42491 - fscache_stat(&fscache_n_acquires_nobufs);
42492 + fscache_stat_unchecked(&fscache_n_acquires_nobufs);
42493 _leave(" = NULL");
42494 return NULL;
42495 }
42496 }
42497
42498 - fscache_stat(&fscache_n_acquires_ok);
42499 + fscache_stat_unchecked(&fscache_n_acquires_ok);
42500 _leave(" = %p", cookie);
42501 return cookie;
42502 }
42503 @@ -168,7 +168,7 @@ static int fscache_acquire_non_index_coo
42504 cache = fscache_select_cache_for_object(cookie->parent);
42505 if (!cache) {
42506 up_read(&fscache_addremove_sem);
42507 - fscache_stat(&fscache_n_acquires_no_cache);
42508 + fscache_stat_unchecked(&fscache_n_acquires_no_cache);
42509 _leave(" = -ENOMEDIUM [no cache]");
42510 return -ENOMEDIUM;
42511 }
42512 @@ -256,12 +256,12 @@ static int fscache_alloc_object(struct f
42513 object = cache->ops->alloc_object(cache, cookie);
42514 fscache_stat_d(&fscache_n_cop_alloc_object);
42515 if (IS_ERR(object)) {
42516 - fscache_stat(&fscache_n_object_no_alloc);
42517 + fscache_stat_unchecked(&fscache_n_object_no_alloc);
42518 ret = PTR_ERR(object);
42519 goto error;
42520 }
42521
42522 - fscache_stat(&fscache_n_object_alloc);
42523 + fscache_stat_unchecked(&fscache_n_object_alloc);
42524
42525 object->debug_id = atomic_inc_return(&fscache_object_debug_id);
42526
42527 @@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fsca
42528 struct fscache_object *object;
42529 struct hlist_node *_p;
42530
42531 - fscache_stat(&fscache_n_updates);
42532 + fscache_stat_unchecked(&fscache_n_updates);
42533
42534 if (!cookie) {
42535 - fscache_stat(&fscache_n_updates_null);
42536 + fscache_stat_unchecked(&fscache_n_updates_null);
42537 _leave(" [no cookie]");
42538 return;
42539 }
42540 @@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct
42541 struct fscache_object *object;
42542 unsigned long event;
42543
42544 - fscache_stat(&fscache_n_relinquishes);
42545 + fscache_stat_unchecked(&fscache_n_relinquishes);
42546 if (retire)
42547 - fscache_stat(&fscache_n_relinquishes_retire);
42548 + fscache_stat_unchecked(&fscache_n_relinquishes_retire);
42549
42550 if (!cookie) {
42551 - fscache_stat(&fscache_n_relinquishes_null);
42552 + fscache_stat_unchecked(&fscache_n_relinquishes_null);
42553 _leave(" [no cookie]");
42554 return;
42555 }
42556 @@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct
42557
42558 /* wait for the cookie to finish being instantiated (or to fail) */
42559 if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
42560 - fscache_stat(&fscache_n_relinquishes_waitcrt);
42561 + fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
42562 wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
42563 fscache_wait_bit, TASK_UNINTERRUPTIBLE);
42564 }
42565 diff -urNp linux-3.0.9/fs/fscache/internal.h linux-3.0.9/fs/fscache/internal.h
42566 --- linux-3.0.9/fs/fscache/internal.h 2011-11-11 13:12:24.000000000 -0500
42567 +++ linux-3.0.9/fs/fscache/internal.h 2011-11-15 20:02:59.000000000 -0500
42568 @@ -144,94 +144,94 @@ extern void fscache_proc_cleanup(void);
42569 extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
42570 extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
42571
42572 -extern atomic_t fscache_n_op_pend;
42573 -extern atomic_t fscache_n_op_run;
42574 -extern atomic_t fscache_n_op_enqueue;
42575 -extern atomic_t fscache_n_op_deferred_release;
42576 -extern atomic_t fscache_n_op_release;
42577 -extern atomic_t fscache_n_op_gc;
42578 -extern atomic_t fscache_n_op_cancelled;
42579 -extern atomic_t fscache_n_op_rejected;
42580 -
42581 -extern atomic_t fscache_n_attr_changed;
42582 -extern atomic_t fscache_n_attr_changed_ok;
42583 -extern atomic_t fscache_n_attr_changed_nobufs;
42584 -extern atomic_t fscache_n_attr_changed_nomem;
42585 -extern atomic_t fscache_n_attr_changed_calls;
42586 -
42587 -extern atomic_t fscache_n_allocs;
42588 -extern atomic_t fscache_n_allocs_ok;
42589 -extern atomic_t fscache_n_allocs_wait;
42590 -extern atomic_t fscache_n_allocs_nobufs;
42591 -extern atomic_t fscache_n_allocs_intr;
42592 -extern atomic_t fscache_n_allocs_object_dead;
42593 -extern atomic_t fscache_n_alloc_ops;
42594 -extern atomic_t fscache_n_alloc_op_waits;
42595 -
42596 -extern atomic_t fscache_n_retrievals;
42597 -extern atomic_t fscache_n_retrievals_ok;
42598 -extern atomic_t fscache_n_retrievals_wait;
42599 -extern atomic_t fscache_n_retrievals_nodata;
42600 -extern atomic_t fscache_n_retrievals_nobufs;
42601 -extern atomic_t fscache_n_retrievals_intr;
42602 -extern atomic_t fscache_n_retrievals_nomem;
42603 -extern atomic_t fscache_n_retrievals_object_dead;
42604 -extern atomic_t fscache_n_retrieval_ops;
42605 -extern atomic_t fscache_n_retrieval_op_waits;
42606 -
42607 -extern atomic_t fscache_n_stores;
42608 -extern atomic_t fscache_n_stores_ok;
42609 -extern atomic_t fscache_n_stores_again;
42610 -extern atomic_t fscache_n_stores_nobufs;
42611 -extern atomic_t fscache_n_stores_oom;
42612 -extern atomic_t fscache_n_store_ops;
42613 -extern atomic_t fscache_n_store_calls;
42614 -extern atomic_t fscache_n_store_pages;
42615 -extern atomic_t fscache_n_store_radix_deletes;
42616 -extern atomic_t fscache_n_store_pages_over_limit;
42617 -
42618 -extern atomic_t fscache_n_store_vmscan_not_storing;
42619 -extern atomic_t fscache_n_store_vmscan_gone;
42620 -extern atomic_t fscache_n_store_vmscan_busy;
42621 -extern atomic_t fscache_n_store_vmscan_cancelled;
42622 -
42623 -extern atomic_t fscache_n_marks;
42624 -extern atomic_t fscache_n_uncaches;
42625 -
42626 -extern atomic_t fscache_n_acquires;
42627 -extern atomic_t fscache_n_acquires_null;
42628 -extern atomic_t fscache_n_acquires_no_cache;
42629 -extern atomic_t fscache_n_acquires_ok;
42630 -extern atomic_t fscache_n_acquires_nobufs;
42631 -extern atomic_t fscache_n_acquires_oom;
42632 -
42633 -extern atomic_t fscache_n_updates;
42634 -extern atomic_t fscache_n_updates_null;
42635 -extern atomic_t fscache_n_updates_run;
42636 -
42637 -extern atomic_t fscache_n_relinquishes;
42638 -extern atomic_t fscache_n_relinquishes_null;
42639 -extern atomic_t fscache_n_relinquishes_waitcrt;
42640 -extern atomic_t fscache_n_relinquishes_retire;
42641 -
42642 -extern atomic_t fscache_n_cookie_index;
42643 -extern atomic_t fscache_n_cookie_data;
42644 -extern atomic_t fscache_n_cookie_special;
42645 -
42646 -extern atomic_t fscache_n_object_alloc;
42647 -extern atomic_t fscache_n_object_no_alloc;
42648 -extern atomic_t fscache_n_object_lookups;
42649 -extern atomic_t fscache_n_object_lookups_negative;
42650 -extern atomic_t fscache_n_object_lookups_positive;
42651 -extern atomic_t fscache_n_object_lookups_timed_out;
42652 -extern atomic_t fscache_n_object_created;
42653 -extern atomic_t fscache_n_object_avail;
42654 -extern atomic_t fscache_n_object_dead;
42655 -
42656 -extern atomic_t fscache_n_checkaux_none;
42657 -extern atomic_t fscache_n_checkaux_okay;
42658 -extern atomic_t fscache_n_checkaux_update;
42659 -extern atomic_t fscache_n_checkaux_obsolete;
42660 +extern atomic_unchecked_t fscache_n_op_pend;
42661 +extern atomic_unchecked_t fscache_n_op_run;
42662 +extern atomic_unchecked_t fscache_n_op_enqueue;
42663 +extern atomic_unchecked_t fscache_n_op_deferred_release;
42664 +extern atomic_unchecked_t fscache_n_op_release;
42665 +extern atomic_unchecked_t fscache_n_op_gc;
42666 +extern atomic_unchecked_t fscache_n_op_cancelled;
42667 +extern atomic_unchecked_t fscache_n_op_rejected;
42668 +
42669 +extern atomic_unchecked_t fscache_n_attr_changed;
42670 +extern atomic_unchecked_t fscache_n_attr_changed_ok;
42671 +extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
42672 +extern atomic_unchecked_t fscache_n_attr_changed_nomem;
42673 +extern atomic_unchecked_t fscache_n_attr_changed_calls;
42674 +
42675 +extern atomic_unchecked_t fscache_n_allocs;
42676 +extern atomic_unchecked_t fscache_n_allocs_ok;
42677 +extern atomic_unchecked_t fscache_n_allocs_wait;
42678 +extern atomic_unchecked_t fscache_n_allocs_nobufs;
42679 +extern atomic_unchecked_t fscache_n_allocs_intr;
42680 +extern atomic_unchecked_t fscache_n_allocs_object_dead;
42681 +extern atomic_unchecked_t fscache_n_alloc_ops;
42682 +extern atomic_unchecked_t fscache_n_alloc_op_waits;
42683 +
42684 +extern atomic_unchecked_t fscache_n_retrievals;
42685 +extern atomic_unchecked_t fscache_n_retrievals_ok;
42686 +extern atomic_unchecked_t fscache_n_retrievals_wait;
42687 +extern atomic_unchecked_t fscache_n_retrievals_nodata;
42688 +extern atomic_unchecked_t fscache_n_retrievals_nobufs;
42689 +extern atomic_unchecked_t fscache_n_retrievals_intr;
42690 +extern atomic_unchecked_t fscache_n_retrievals_nomem;
42691 +extern atomic_unchecked_t fscache_n_retrievals_object_dead;
42692 +extern atomic_unchecked_t fscache_n_retrieval_ops;
42693 +extern atomic_unchecked_t fscache_n_retrieval_op_waits;
42694 +
42695 +extern atomic_unchecked_t fscache_n_stores;
42696 +extern atomic_unchecked_t fscache_n_stores_ok;
42697 +extern atomic_unchecked_t fscache_n_stores_again;
42698 +extern atomic_unchecked_t fscache_n_stores_nobufs;
42699 +extern atomic_unchecked_t fscache_n_stores_oom;
42700 +extern atomic_unchecked_t fscache_n_store_ops;
42701 +extern atomic_unchecked_t fscache_n_store_calls;
42702 +extern atomic_unchecked_t fscache_n_store_pages;
42703 +extern atomic_unchecked_t fscache_n_store_radix_deletes;
42704 +extern atomic_unchecked_t fscache_n_store_pages_over_limit;
42705 +
42706 +extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
42707 +extern atomic_unchecked_t fscache_n_store_vmscan_gone;
42708 +extern atomic_unchecked_t fscache_n_store_vmscan_busy;
42709 +extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
42710 +
42711 +extern atomic_unchecked_t fscache_n_marks;
42712 +extern atomic_unchecked_t fscache_n_uncaches;
42713 +
42714 +extern atomic_unchecked_t fscache_n_acquires;
42715 +extern atomic_unchecked_t fscache_n_acquires_null;
42716 +extern atomic_unchecked_t fscache_n_acquires_no_cache;
42717 +extern atomic_unchecked_t fscache_n_acquires_ok;
42718 +extern atomic_unchecked_t fscache_n_acquires_nobufs;
42719 +extern atomic_unchecked_t fscache_n_acquires_oom;
42720 +
42721 +extern atomic_unchecked_t fscache_n_updates;
42722 +extern atomic_unchecked_t fscache_n_updates_null;
42723 +extern atomic_unchecked_t fscache_n_updates_run;
42724 +
42725 +extern atomic_unchecked_t fscache_n_relinquishes;
42726 +extern atomic_unchecked_t fscache_n_relinquishes_null;
42727 +extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
42728 +extern atomic_unchecked_t fscache_n_relinquishes_retire;
42729 +
42730 +extern atomic_unchecked_t fscache_n_cookie_index;
42731 +extern atomic_unchecked_t fscache_n_cookie_data;
42732 +extern atomic_unchecked_t fscache_n_cookie_special;
42733 +
42734 +extern atomic_unchecked_t fscache_n_object_alloc;
42735 +extern atomic_unchecked_t fscache_n_object_no_alloc;
42736 +extern atomic_unchecked_t fscache_n_object_lookups;
42737 +extern atomic_unchecked_t fscache_n_object_lookups_negative;
42738 +extern atomic_unchecked_t fscache_n_object_lookups_positive;
42739 +extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
42740 +extern atomic_unchecked_t fscache_n_object_created;
42741 +extern atomic_unchecked_t fscache_n_object_avail;
42742 +extern atomic_unchecked_t fscache_n_object_dead;
42743 +
42744 +extern atomic_unchecked_t fscache_n_checkaux_none;
42745 +extern atomic_unchecked_t fscache_n_checkaux_okay;
42746 +extern atomic_unchecked_t fscache_n_checkaux_update;
42747 +extern atomic_unchecked_t fscache_n_checkaux_obsolete;
42748
42749 extern atomic_t fscache_n_cop_alloc_object;
42750 extern atomic_t fscache_n_cop_lookup_object;
42751 @@ -255,6 +255,11 @@ static inline void fscache_stat(atomic_t
42752 atomic_inc(stat);
42753 }
42754
42755 +static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
42756 +{
42757 + atomic_inc_unchecked(stat);
42758 +}
42759 +
42760 static inline void fscache_stat_d(atomic_t *stat)
42761 {
42762 atomic_dec(stat);
42763 @@ -267,6 +272,7 @@ extern const struct file_operations fsca
42764
42765 #define __fscache_stat(stat) (NULL)
42766 #define fscache_stat(stat) do {} while (0)
42767 +#define fscache_stat_unchecked(stat) do {} while (0)
42768 #define fscache_stat_d(stat) do {} while (0)
42769 #endif
42770
42771 diff -urNp linux-3.0.9/fs/fscache/object.c linux-3.0.9/fs/fscache/object.c
42772 --- linux-3.0.9/fs/fscache/object.c 2011-11-11 13:12:24.000000000 -0500
42773 +++ linux-3.0.9/fs/fscache/object.c 2011-11-15 20:02:59.000000000 -0500
42774 @@ -128,7 +128,7 @@ static void fscache_object_state_machine
42775 /* update the object metadata on disk */
42776 case FSCACHE_OBJECT_UPDATING:
42777 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
42778 - fscache_stat(&fscache_n_updates_run);
42779 + fscache_stat_unchecked(&fscache_n_updates_run);
42780 fscache_stat(&fscache_n_cop_update_object);
42781 object->cache->ops->update_object(object);
42782 fscache_stat_d(&fscache_n_cop_update_object);
42783 @@ -217,7 +217,7 @@ static void fscache_object_state_machine
42784 spin_lock(&object->lock);
42785 object->state = FSCACHE_OBJECT_DEAD;
42786 spin_unlock(&object->lock);
42787 - fscache_stat(&fscache_n_object_dead);
42788 + fscache_stat_unchecked(&fscache_n_object_dead);
42789 goto terminal_transit;
42790
42791 /* handle the parent cache of this object being withdrawn from
42792 @@ -232,7 +232,7 @@ static void fscache_object_state_machine
42793 spin_lock(&object->lock);
42794 object->state = FSCACHE_OBJECT_DEAD;
42795 spin_unlock(&object->lock);
42796 - fscache_stat(&fscache_n_object_dead);
42797 + fscache_stat_unchecked(&fscache_n_object_dead);
42798 goto terminal_transit;
42799
42800 /* complain about the object being woken up once it is
42801 @@ -461,7 +461,7 @@ static void fscache_lookup_object(struct
42802 parent->cookie->def->name, cookie->def->name,
42803 object->cache->tag->name);
42804
42805 - fscache_stat(&fscache_n_object_lookups);
42806 + fscache_stat_unchecked(&fscache_n_object_lookups);
42807 fscache_stat(&fscache_n_cop_lookup_object);
42808 ret = object->cache->ops->lookup_object(object);
42809 fscache_stat_d(&fscache_n_cop_lookup_object);
42810 @@ -472,7 +472,7 @@ static void fscache_lookup_object(struct
42811 if (ret == -ETIMEDOUT) {
42812 /* probably stuck behind another object, so move this one to
42813 * the back of the queue */
42814 - fscache_stat(&fscache_n_object_lookups_timed_out);
42815 + fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
42816 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
42817 }
42818
42819 @@ -495,7 +495,7 @@ void fscache_object_lookup_negative(stru
42820
42821 spin_lock(&object->lock);
42822 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
42823 - fscache_stat(&fscache_n_object_lookups_negative);
42824 + fscache_stat_unchecked(&fscache_n_object_lookups_negative);
42825
42826 /* transit here to allow write requests to begin stacking up
42827 * and read requests to begin returning ENODATA */
42828 @@ -541,7 +541,7 @@ void fscache_obtained_object(struct fsca
42829 * result, in which case there may be data available */
42830 spin_lock(&object->lock);
42831 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
42832 - fscache_stat(&fscache_n_object_lookups_positive);
42833 + fscache_stat_unchecked(&fscache_n_object_lookups_positive);
42834
42835 clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
42836
42837 @@ -555,7 +555,7 @@ void fscache_obtained_object(struct fsca
42838 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
42839 } else {
42840 ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
42841 - fscache_stat(&fscache_n_object_created);
42842 + fscache_stat_unchecked(&fscache_n_object_created);
42843
42844 object->state = FSCACHE_OBJECT_AVAILABLE;
42845 spin_unlock(&object->lock);
42846 @@ -602,7 +602,7 @@ static void fscache_object_available(str
42847 fscache_enqueue_dependents(object);
42848
42849 fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
42850 - fscache_stat(&fscache_n_object_avail);
42851 + fscache_stat_unchecked(&fscache_n_object_avail);
42852
42853 _leave("");
42854 }
42855 @@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(
42856 enum fscache_checkaux result;
42857
42858 if (!object->cookie->def->check_aux) {
42859 - fscache_stat(&fscache_n_checkaux_none);
42860 + fscache_stat_unchecked(&fscache_n_checkaux_none);
42861 return FSCACHE_CHECKAUX_OKAY;
42862 }
42863
42864 @@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(
42865 switch (result) {
42866 /* entry okay as is */
42867 case FSCACHE_CHECKAUX_OKAY:
42868 - fscache_stat(&fscache_n_checkaux_okay);
42869 + fscache_stat_unchecked(&fscache_n_checkaux_okay);
42870 break;
42871
42872 /* entry requires update */
42873 case FSCACHE_CHECKAUX_NEEDS_UPDATE:
42874 - fscache_stat(&fscache_n_checkaux_update);
42875 + fscache_stat_unchecked(&fscache_n_checkaux_update);
42876 break;
42877
42878 /* entry requires deletion */
42879 case FSCACHE_CHECKAUX_OBSOLETE:
42880 - fscache_stat(&fscache_n_checkaux_obsolete);
42881 + fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
42882 break;
42883
42884 default:
42885 diff -urNp linux-3.0.9/fs/fscache/operation.c linux-3.0.9/fs/fscache/operation.c
42886 --- linux-3.0.9/fs/fscache/operation.c 2011-11-11 13:12:24.000000000 -0500
42887 +++ linux-3.0.9/fs/fscache/operation.c 2011-11-15 20:02:59.000000000 -0500
42888 @@ -17,7 +17,7 @@
42889 #include <linux/slab.h>
42890 #include "internal.h"
42891
42892 -atomic_t fscache_op_debug_id;
42893 +atomic_unchecked_t fscache_op_debug_id;
42894 EXPORT_SYMBOL(fscache_op_debug_id);
42895
42896 /**
42897 @@ -38,7 +38,7 @@ void fscache_enqueue_operation(struct fs
42898 ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
42899 ASSERTCMP(atomic_read(&op->usage), >, 0);
42900
42901 - fscache_stat(&fscache_n_op_enqueue);
42902 + fscache_stat_unchecked(&fscache_n_op_enqueue);
42903 switch (op->flags & FSCACHE_OP_TYPE) {
42904 case FSCACHE_OP_ASYNC:
42905 _debug("queue async");
42906 @@ -69,7 +69,7 @@ static void fscache_run_op(struct fscach
42907 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
42908 if (op->processor)
42909 fscache_enqueue_operation(op);
42910 - fscache_stat(&fscache_n_op_run);
42911 + fscache_stat_unchecked(&fscache_n_op_run);
42912 }
42913
42914 /*
42915 @@ -98,11 +98,11 @@ int fscache_submit_exclusive_op(struct f
42916 if (object->n_ops > 1) {
42917 atomic_inc(&op->usage);
42918 list_add_tail(&op->pend_link, &object->pending_ops);
42919 - fscache_stat(&fscache_n_op_pend);
42920 + fscache_stat_unchecked(&fscache_n_op_pend);
42921 } else if (!list_empty(&object->pending_ops)) {
42922 atomic_inc(&op->usage);
42923 list_add_tail(&op->pend_link, &object->pending_ops);
42924 - fscache_stat(&fscache_n_op_pend);
42925 + fscache_stat_unchecked(&fscache_n_op_pend);
42926 fscache_start_operations(object);
42927 } else {
42928 ASSERTCMP(object->n_in_progress, ==, 0);
42929 @@ -118,7 +118,7 @@ int fscache_submit_exclusive_op(struct f
42930 object->n_exclusive++; /* reads and writes must wait */
42931 atomic_inc(&op->usage);
42932 list_add_tail(&op->pend_link, &object->pending_ops);
42933 - fscache_stat(&fscache_n_op_pend);
42934 + fscache_stat_unchecked(&fscache_n_op_pend);
42935 ret = 0;
42936 } else {
42937 /* not allowed to submit ops in any other state */
42938 @@ -203,11 +203,11 @@ int fscache_submit_op(struct fscache_obj
42939 if (object->n_exclusive > 0) {
42940 atomic_inc(&op->usage);
42941 list_add_tail(&op->pend_link, &object->pending_ops);
42942 - fscache_stat(&fscache_n_op_pend);
42943 + fscache_stat_unchecked(&fscache_n_op_pend);
42944 } else if (!list_empty(&object->pending_ops)) {
42945 atomic_inc(&op->usage);
42946 list_add_tail(&op->pend_link, &object->pending_ops);
42947 - fscache_stat(&fscache_n_op_pend);
42948 + fscache_stat_unchecked(&fscache_n_op_pend);
42949 fscache_start_operations(object);
42950 } else {
42951 ASSERTCMP(object->n_exclusive, ==, 0);
42952 @@ -219,12 +219,12 @@ int fscache_submit_op(struct fscache_obj
42953 object->n_ops++;
42954 atomic_inc(&op->usage);
42955 list_add_tail(&op->pend_link, &object->pending_ops);
42956 - fscache_stat(&fscache_n_op_pend);
42957 + fscache_stat_unchecked(&fscache_n_op_pend);
42958 ret = 0;
42959 } else if (object->state == FSCACHE_OBJECT_DYING ||
42960 object->state == FSCACHE_OBJECT_LC_DYING ||
42961 object->state == FSCACHE_OBJECT_WITHDRAWING) {
42962 - fscache_stat(&fscache_n_op_rejected);
42963 + fscache_stat_unchecked(&fscache_n_op_rejected);
42964 ret = -ENOBUFS;
42965 } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
42966 fscache_report_unexpected_submission(object, op, ostate);
42967 @@ -294,7 +294,7 @@ int fscache_cancel_op(struct fscache_ope
42968
42969 ret = -EBUSY;
42970 if (!list_empty(&op->pend_link)) {
42971 - fscache_stat(&fscache_n_op_cancelled);
42972 + fscache_stat_unchecked(&fscache_n_op_cancelled);
42973 list_del_init(&op->pend_link);
42974 object->n_ops--;
42975 if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
42976 @@ -331,7 +331,7 @@ void fscache_put_operation(struct fscach
42977 if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
42978 BUG();
42979
42980 - fscache_stat(&fscache_n_op_release);
42981 + fscache_stat_unchecked(&fscache_n_op_release);
42982
42983 if (op->release) {
42984 op->release(op);
42985 @@ -348,7 +348,7 @@ void fscache_put_operation(struct fscach
42986 * lock, and defer it otherwise */
42987 if (!spin_trylock(&object->lock)) {
42988 _debug("defer put");
42989 - fscache_stat(&fscache_n_op_deferred_release);
42990 + fscache_stat_unchecked(&fscache_n_op_deferred_release);
42991
42992 cache = object->cache;
42993 spin_lock(&cache->op_gc_list_lock);
42994 @@ -410,7 +410,7 @@ void fscache_operation_gc(struct work_st
42995
42996 _debug("GC DEFERRED REL OBJ%x OP%x",
42997 object->debug_id, op->debug_id);
42998 - fscache_stat(&fscache_n_op_gc);
42999 + fscache_stat_unchecked(&fscache_n_op_gc);
43000
43001 ASSERTCMP(atomic_read(&op->usage), ==, 0);
43002
43003 diff -urNp linux-3.0.9/fs/fscache/page.c linux-3.0.9/fs/fscache/page.c
43004 --- linux-3.0.9/fs/fscache/page.c 2011-11-11 13:12:24.000000000 -0500
43005 +++ linux-3.0.9/fs/fscache/page.c 2011-11-15 20:02:59.000000000 -0500
43006 @@ -60,7 +60,7 @@ bool __fscache_maybe_release_page(struct
43007 val = radix_tree_lookup(&cookie->stores, page->index);
43008 if (!val) {
43009 rcu_read_unlock();
43010 - fscache_stat(&fscache_n_store_vmscan_not_storing);
43011 + fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
43012 __fscache_uncache_page(cookie, page);
43013 return true;
43014 }
43015 @@ -90,11 +90,11 @@ bool __fscache_maybe_release_page(struct
43016 spin_unlock(&cookie->stores_lock);
43017
43018 if (xpage) {
43019 - fscache_stat(&fscache_n_store_vmscan_cancelled);
43020 - fscache_stat(&fscache_n_store_radix_deletes);
43021 + fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
43022 + fscache_stat_unchecked(&fscache_n_store_radix_deletes);
43023 ASSERTCMP(xpage, ==, page);
43024 } else {
43025 - fscache_stat(&fscache_n_store_vmscan_gone);
43026 + fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
43027 }
43028
43029 wake_up_bit(&cookie->flags, 0);
43030 @@ -107,7 +107,7 @@ page_busy:
43031 /* we might want to wait here, but that could deadlock the allocator as
43032 * the work threads writing to the cache may all end up sleeping
43033 * on memory allocation */
43034 - fscache_stat(&fscache_n_store_vmscan_busy);
43035 + fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
43036 return false;
43037 }
43038 EXPORT_SYMBOL(__fscache_maybe_release_page);
43039 @@ -131,7 +131,7 @@ static void fscache_end_page_write(struc
43040 FSCACHE_COOKIE_STORING_TAG);
43041 if (!radix_tree_tag_get(&cookie->stores, page->index,
43042 FSCACHE_COOKIE_PENDING_TAG)) {
43043 - fscache_stat(&fscache_n_store_radix_deletes);
43044 + fscache_stat_unchecked(&fscache_n_store_radix_deletes);
43045 xpage = radix_tree_delete(&cookie->stores, page->index);
43046 }
43047 spin_unlock(&cookie->stores_lock);
43048 @@ -152,7 +152,7 @@ static void fscache_attr_changed_op(stru
43049
43050 _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
43051
43052 - fscache_stat(&fscache_n_attr_changed_calls);
43053 + fscache_stat_unchecked(&fscache_n_attr_changed_calls);
43054
43055 if (fscache_object_is_active(object)) {
43056 fscache_stat(&fscache_n_cop_attr_changed);
43057 @@ -177,11 +177,11 @@ int __fscache_attr_changed(struct fscach
43058
43059 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
43060
43061 - fscache_stat(&fscache_n_attr_changed);
43062 + fscache_stat_unchecked(&fscache_n_attr_changed);
43063
43064 op = kzalloc(sizeof(*op), GFP_KERNEL);
43065 if (!op) {
43066 - fscache_stat(&fscache_n_attr_changed_nomem);
43067 + fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
43068 _leave(" = -ENOMEM");
43069 return -ENOMEM;
43070 }
43071 @@ -199,7 +199,7 @@ int __fscache_attr_changed(struct fscach
43072 if (fscache_submit_exclusive_op(object, op) < 0)
43073 goto nobufs;
43074 spin_unlock(&cookie->lock);
43075 - fscache_stat(&fscache_n_attr_changed_ok);
43076 + fscache_stat_unchecked(&fscache_n_attr_changed_ok);
43077 fscache_put_operation(op);
43078 _leave(" = 0");
43079 return 0;
43080 @@ -207,7 +207,7 @@ int __fscache_attr_changed(struct fscach
43081 nobufs:
43082 spin_unlock(&cookie->lock);
43083 kfree(op);
43084 - fscache_stat(&fscache_n_attr_changed_nobufs);
43085 + fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
43086 _leave(" = %d", -ENOBUFS);
43087 return -ENOBUFS;
43088 }
43089 @@ -243,7 +243,7 @@ static struct fscache_retrieval *fscache
43090 /* allocate a retrieval operation and attempt to submit it */
43091 op = kzalloc(sizeof(*op), GFP_NOIO);
43092 if (!op) {
43093 - fscache_stat(&fscache_n_retrievals_nomem);
43094 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
43095 return NULL;
43096 }
43097
43098 @@ -271,13 +271,13 @@ static int fscache_wait_for_deferred_loo
43099 return 0;
43100 }
43101
43102 - fscache_stat(&fscache_n_retrievals_wait);
43103 + fscache_stat_unchecked(&fscache_n_retrievals_wait);
43104
43105 jif = jiffies;
43106 if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
43107 fscache_wait_bit_interruptible,
43108 TASK_INTERRUPTIBLE) != 0) {
43109 - fscache_stat(&fscache_n_retrievals_intr);
43110 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
43111 _leave(" = -ERESTARTSYS");
43112 return -ERESTARTSYS;
43113 }
43114 @@ -295,8 +295,8 @@ static int fscache_wait_for_deferred_loo
43115 */
43116 static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
43117 struct fscache_retrieval *op,
43118 - atomic_t *stat_op_waits,
43119 - atomic_t *stat_object_dead)
43120 + atomic_unchecked_t *stat_op_waits,
43121 + atomic_unchecked_t *stat_object_dead)
43122 {
43123 int ret;
43124
43125 @@ -304,7 +304,7 @@ static int fscache_wait_for_retrieval_ac
43126 goto check_if_dead;
43127
43128 _debug(">>> WT");
43129 - fscache_stat(stat_op_waits);
43130 + fscache_stat_unchecked(stat_op_waits);
43131 if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
43132 fscache_wait_bit_interruptible,
43133 TASK_INTERRUPTIBLE) < 0) {
43134 @@ -321,7 +321,7 @@ static int fscache_wait_for_retrieval_ac
43135
43136 check_if_dead:
43137 if (unlikely(fscache_object_is_dead(object))) {
43138 - fscache_stat(stat_object_dead);
43139 + fscache_stat_unchecked(stat_object_dead);
43140 return -ENOBUFS;
43141 }
43142 return 0;
43143 @@ -348,7 +348,7 @@ int __fscache_read_or_alloc_page(struct
43144
43145 _enter("%p,%p,,,", cookie, page);
43146
43147 - fscache_stat(&fscache_n_retrievals);
43148 + fscache_stat_unchecked(&fscache_n_retrievals);
43149
43150 if (hlist_empty(&cookie->backing_objects))
43151 goto nobufs;
43152 @@ -381,7 +381,7 @@ int __fscache_read_or_alloc_page(struct
43153 goto nobufs_unlock;
43154 spin_unlock(&cookie->lock);
43155
43156 - fscache_stat(&fscache_n_retrieval_ops);
43157 + fscache_stat_unchecked(&fscache_n_retrieval_ops);
43158
43159 /* pin the netfs read context in case we need to do the actual netfs
43160 * read because we've encountered a cache read failure */
43161 @@ -411,15 +411,15 @@ int __fscache_read_or_alloc_page(struct
43162
43163 error:
43164 if (ret == -ENOMEM)
43165 - fscache_stat(&fscache_n_retrievals_nomem);
43166 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
43167 else if (ret == -ERESTARTSYS)
43168 - fscache_stat(&fscache_n_retrievals_intr);
43169 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
43170 else if (ret == -ENODATA)
43171 - fscache_stat(&fscache_n_retrievals_nodata);
43172 + fscache_stat_unchecked(&fscache_n_retrievals_nodata);
43173 else if (ret < 0)
43174 - fscache_stat(&fscache_n_retrievals_nobufs);
43175 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
43176 else
43177 - fscache_stat(&fscache_n_retrievals_ok);
43178 + fscache_stat_unchecked(&fscache_n_retrievals_ok);
43179
43180 fscache_put_retrieval(op);
43181 _leave(" = %d", ret);
43182 @@ -429,7 +429,7 @@ nobufs_unlock:
43183 spin_unlock(&cookie->lock);
43184 kfree(op);
43185 nobufs:
43186 - fscache_stat(&fscache_n_retrievals_nobufs);
43187 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
43188 _leave(" = -ENOBUFS");
43189 return -ENOBUFS;
43190 }
43191 @@ -467,7 +467,7 @@ int __fscache_read_or_alloc_pages(struct
43192
43193 _enter("%p,,%d,,,", cookie, *nr_pages);
43194
43195 - fscache_stat(&fscache_n_retrievals);
43196 + fscache_stat_unchecked(&fscache_n_retrievals);
43197
43198 if (hlist_empty(&cookie->backing_objects))
43199 goto nobufs;
43200 @@ -497,7 +497,7 @@ int __fscache_read_or_alloc_pages(struct
43201 goto nobufs_unlock;
43202 spin_unlock(&cookie->lock);
43203
43204 - fscache_stat(&fscache_n_retrieval_ops);
43205 + fscache_stat_unchecked(&fscache_n_retrieval_ops);
43206
43207 /* pin the netfs read context in case we need to do the actual netfs
43208 * read because we've encountered a cache read failure */
43209 @@ -527,15 +527,15 @@ int __fscache_read_or_alloc_pages(struct
43210
43211 error:
43212 if (ret == -ENOMEM)
43213 - fscache_stat(&fscache_n_retrievals_nomem);
43214 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
43215 else if (ret == -ERESTARTSYS)
43216 - fscache_stat(&fscache_n_retrievals_intr);
43217 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
43218 else if (ret == -ENODATA)
43219 - fscache_stat(&fscache_n_retrievals_nodata);
43220 + fscache_stat_unchecked(&fscache_n_retrievals_nodata);
43221 else if (ret < 0)
43222 - fscache_stat(&fscache_n_retrievals_nobufs);
43223 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
43224 else
43225 - fscache_stat(&fscache_n_retrievals_ok);
43226 + fscache_stat_unchecked(&fscache_n_retrievals_ok);
43227
43228 fscache_put_retrieval(op);
43229 _leave(" = %d", ret);
43230 @@ -545,7 +545,7 @@ nobufs_unlock:
43231 spin_unlock(&cookie->lock);
43232 kfree(op);
43233 nobufs:
43234 - fscache_stat(&fscache_n_retrievals_nobufs);
43235 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
43236 _leave(" = -ENOBUFS");
43237 return -ENOBUFS;
43238 }
43239 @@ -569,7 +569,7 @@ int __fscache_alloc_page(struct fscache_
43240
43241 _enter("%p,%p,,,", cookie, page);
43242
43243 - fscache_stat(&fscache_n_allocs);
43244 + fscache_stat_unchecked(&fscache_n_allocs);
43245
43246 if (hlist_empty(&cookie->backing_objects))
43247 goto nobufs;
43248 @@ -595,7 +595,7 @@ int __fscache_alloc_page(struct fscache_
43249 goto nobufs_unlock;
43250 spin_unlock(&cookie->lock);
43251
43252 - fscache_stat(&fscache_n_alloc_ops);
43253 + fscache_stat_unchecked(&fscache_n_alloc_ops);
43254
43255 ret = fscache_wait_for_retrieval_activation(
43256 object, op,
43257 @@ -611,11 +611,11 @@ int __fscache_alloc_page(struct fscache_
43258
43259 error:
43260 if (ret == -ERESTARTSYS)
43261 - fscache_stat(&fscache_n_allocs_intr);
43262 + fscache_stat_unchecked(&fscache_n_allocs_intr);
43263 else if (ret < 0)
43264 - fscache_stat(&fscache_n_allocs_nobufs);
43265 + fscache_stat_unchecked(&fscache_n_allocs_nobufs);
43266 else
43267 - fscache_stat(&fscache_n_allocs_ok);
43268 + fscache_stat_unchecked(&fscache_n_allocs_ok);
43269
43270 fscache_put_retrieval(op);
43271 _leave(" = %d", ret);
43272 @@ -625,7 +625,7 @@ nobufs_unlock:
43273 spin_unlock(&cookie->lock);
43274 kfree(op);
43275 nobufs:
43276 - fscache_stat(&fscache_n_allocs_nobufs);
43277 + fscache_stat_unchecked(&fscache_n_allocs_nobufs);
43278 _leave(" = -ENOBUFS");
43279 return -ENOBUFS;
43280 }
43281 @@ -666,7 +666,7 @@ static void fscache_write_op(struct fsca
43282
43283 spin_lock(&cookie->stores_lock);
43284
43285 - fscache_stat(&fscache_n_store_calls);
43286 + fscache_stat_unchecked(&fscache_n_store_calls);
43287
43288 /* find a page to store */
43289 page = NULL;
43290 @@ -677,7 +677,7 @@ static void fscache_write_op(struct fsca
43291 page = results[0];
43292 _debug("gang %d [%lx]", n, page->index);
43293 if (page->index > op->store_limit) {
43294 - fscache_stat(&fscache_n_store_pages_over_limit);
43295 + fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
43296 goto superseded;
43297 }
43298
43299 @@ -689,7 +689,7 @@ static void fscache_write_op(struct fsca
43300 spin_unlock(&cookie->stores_lock);
43301 spin_unlock(&object->lock);
43302
43303 - fscache_stat(&fscache_n_store_pages);
43304 + fscache_stat_unchecked(&fscache_n_store_pages);
43305 fscache_stat(&fscache_n_cop_write_page);
43306 ret = object->cache->ops->write_page(op, page);
43307 fscache_stat_d(&fscache_n_cop_write_page);
43308 @@ -757,7 +757,7 @@ int __fscache_write_page(struct fscache_
43309 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
43310 ASSERT(PageFsCache(page));
43311
43312 - fscache_stat(&fscache_n_stores);
43313 + fscache_stat_unchecked(&fscache_n_stores);
43314
43315 op = kzalloc(sizeof(*op), GFP_NOIO);
43316 if (!op)
43317 @@ -808,7 +808,7 @@ int __fscache_write_page(struct fscache_
43318 spin_unlock(&cookie->stores_lock);
43319 spin_unlock(&object->lock);
43320
43321 - op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
43322 + op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
43323 op->store_limit = object->store_limit;
43324
43325 if (fscache_submit_op(object, &op->op) < 0)
43326 @@ -816,8 +816,8 @@ int __fscache_write_page(struct fscache_
43327
43328 spin_unlock(&cookie->lock);
43329 radix_tree_preload_end();
43330 - fscache_stat(&fscache_n_store_ops);
43331 - fscache_stat(&fscache_n_stores_ok);
43332 + fscache_stat_unchecked(&fscache_n_store_ops);
43333 + fscache_stat_unchecked(&fscache_n_stores_ok);
43334
43335 /* the work queue now carries its own ref on the object */
43336 fscache_put_operation(&op->op);
43337 @@ -825,14 +825,14 @@ int __fscache_write_page(struct fscache_
43338 return 0;
43339
43340 already_queued:
43341 - fscache_stat(&fscache_n_stores_again);
43342 + fscache_stat_unchecked(&fscache_n_stores_again);
43343 already_pending:
43344 spin_unlock(&cookie->stores_lock);
43345 spin_unlock(&object->lock);
43346 spin_unlock(&cookie->lock);
43347 radix_tree_preload_end();
43348 kfree(op);
43349 - fscache_stat(&fscache_n_stores_ok);
43350 + fscache_stat_unchecked(&fscache_n_stores_ok);
43351 _leave(" = 0");
43352 return 0;
43353
43354 @@ -851,14 +851,14 @@ nobufs:
43355 spin_unlock(&cookie->lock);
43356 radix_tree_preload_end();
43357 kfree(op);
43358 - fscache_stat(&fscache_n_stores_nobufs);
43359 + fscache_stat_unchecked(&fscache_n_stores_nobufs);
43360 _leave(" = -ENOBUFS");
43361 return -ENOBUFS;
43362
43363 nomem_free:
43364 kfree(op);
43365 nomem:
43366 - fscache_stat(&fscache_n_stores_oom);
43367 + fscache_stat_unchecked(&fscache_n_stores_oom);
43368 _leave(" = -ENOMEM");
43369 return -ENOMEM;
43370 }
43371 @@ -876,7 +876,7 @@ void __fscache_uncache_page(struct fscac
43372 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
43373 ASSERTCMP(page, !=, NULL);
43374
43375 - fscache_stat(&fscache_n_uncaches);
43376 + fscache_stat_unchecked(&fscache_n_uncaches);
43377
43378 /* cache withdrawal may beat us to it */
43379 if (!PageFsCache(page))
43380 @@ -929,7 +929,7 @@ void fscache_mark_pages_cached(struct fs
43381 unsigned long loop;
43382
43383 #ifdef CONFIG_FSCACHE_STATS
43384 - atomic_add(pagevec->nr, &fscache_n_marks);
43385 + atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
43386 #endif
43387
43388 for (loop = 0; loop < pagevec->nr; loop++) {
43389 diff -urNp linux-3.0.9/fs/fscache/stats.c linux-3.0.9/fs/fscache/stats.c
43390 --- linux-3.0.9/fs/fscache/stats.c 2011-11-11 13:12:24.000000000 -0500
43391 +++ linux-3.0.9/fs/fscache/stats.c 2011-11-15 20:02:59.000000000 -0500
43392 @@ -18,95 +18,95 @@
43393 /*
43394 * operation counters
43395 */
43396 -atomic_t fscache_n_op_pend;
43397 -atomic_t fscache_n_op_run;
43398 -atomic_t fscache_n_op_enqueue;
43399 -atomic_t fscache_n_op_requeue;
43400 -atomic_t fscache_n_op_deferred_release;
43401 -atomic_t fscache_n_op_release;
43402 -atomic_t fscache_n_op_gc;
43403 -atomic_t fscache_n_op_cancelled;
43404 -atomic_t fscache_n_op_rejected;
43405 -
43406 -atomic_t fscache_n_attr_changed;
43407 -atomic_t fscache_n_attr_changed_ok;
43408 -atomic_t fscache_n_attr_changed_nobufs;
43409 -atomic_t fscache_n_attr_changed_nomem;
43410 -atomic_t fscache_n_attr_changed_calls;
43411 -
43412 -atomic_t fscache_n_allocs;
43413 -atomic_t fscache_n_allocs_ok;
43414 -atomic_t fscache_n_allocs_wait;
43415 -atomic_t fscache_n_allocs_nobufs;
43416 -atomic_t fscache_n_allocs_intr;
43417 -atomic_t fscache_n_allocs_object_dead;
43418 -atomic_t fscache_n_alloc_ops;
43419 -atomic_t fscache_n_alloc_op_waits;
43420 -
43421 -atomic_t fscache_n_retrievals;
43422 -atomic_t fscache_n_retrievals_ok;
43423 -atomic_t fscache_n_retrievals_wait;
43424 -atomic_t fscache_n_retrievals_nodata;
43425 -atomic_t fscache_n_retrievals_nobufs;
43426 -atomic_t fscache_n_retrievals_intr;
43427 -atomic_t fscache_n_retrievals_nomem;
43428 -atomic_t fscache_n_retrievals_object_dead;
43429 -atomic_t fscache_n_retrieval_ops;
43430 -atomic_t fscache_n_retrieval_op_waits;
43431 -
43432 -atomic_t fscache_n_stores;
43433 -atomic_t fscache_n_stores_ok;
43434 -atomic_t fscache_n_stores_again;
43435 -atomic_t fscache_n_stores_nobufs;
43436 -atomic_t fscache_n_stores_oom;
43437 -atomic_t fscache_n_store_ops;
43438 -atomic_t fscache_n_store_calls;
43439 -atomic_t fscache_n_store_pages;
43440 -atomic_t fscache_n_store_radix_deletes;
43441 -atomic_t fscache_n_store_pages_over_limit;
43442 -
43443 -atomic_t fscache_n_store_vmscan_not_storing;
43444 -atomic_t fscache_n_store_vmscan_gone;
43445 -atomic_t fscache_n_store_vmscan_busy;
43446 -atomic_t fscache_n_store_vmscan_cancelled;
43447 -
43448 -atomic_t fscache_n_marks;
43449 -atomic_t fscache_n_uncaches;
43450 -
43451 -atomic_t fscache_n_acquires;
43452 -atomic_t fscache_n_acquires_null;
43453 -atomic_t fscache_n_acquires_no_cache;
43454 -atomic_t fscache_n_acquires_ok;
43455 -atomic_t fscache_n_acquires_nobufs;
43456 -atomic_t fscache_n_acquires_oom;
43457 -
43458 -atomic_t fscache_n_updates;
43459 -atomic_t fscache_n_updates_null;
43460 -atomic_t fscache_n_updates_run;
43461 -
43462 -atomic_t fscache_n_relinquishes;
43463 -atomic_t fscache_n_relinquishes_null;
43464 -atomic_t fscache_n_relinquishes_waitcrt;
43465 -atomic_t fscache_n_relinquishes_retire;
43466 -
43467 -atomic_t fscache_n_cookie_index;
43468 -atomic_t fscache_n_cookie_data;
43469 -atomic_t fscache_n_cookie_special;
43470 -
43471 -atomic_t fscache_n_object_alloc;
43472 -atomic_t fscache_n_object_no_alloc;
43473 -atomic_t fscache_n_object_lookups;
43474 -atomic_t fscache_n_object_lookups_negative;
43475 -atomic_t fscache_n_object_lookups_positive;
43476 -atomic_t fscache_n_object_lookups_timed_out;
43477 -atomic_t fscache_n_object_created;
43478 -atomic_t fscache_n_object_avail;
43479 -atomic_t fscache_n_object_dead;
43480 -
43481 -atomic_t fscache_n_checkaux_none;
43482 -atomic_t fscache_n_checkaux_okay;
43483 -atomic_t fscache_n_checkaux_update;
43484 -atomic_t fscache_n_checkaux_obsolete;
43485 +atomic_unchecked_t fscache_n_op_pend;
43486 +atomic_unchecked_t fscache_n_op_run;
43487 +atomic_unchecked_t fscache_n_op_enqueue;
43488 +atomic_unchecked_t fscache_n_op_requeue;
43489 +atomic_unchecked_t fscache_n_op_deferred_release;
43490 +atomic_unchecked_t fscache_n_op_release;
43491 +atomic_unchecked_t fscache_n_op_gc;
43492 +atomic_unchecked_t fscache_n_op_cancelled;
43493 +atomic_unchecked_t fscache_n_op_rejected;
43494 +
43495 +atomic_unchecked_t fscache_n_attr_changed;
43496 +atomic_unchecked_t fscache_n_attr_changed_ok;
43497 +atomic_unchecked_t fscache_n_attr_changed_nobufs;
43498 +atomic_unchecked_t fscache_n_attr_changed_nomem;
43499 +atomic_unchecked_t fscache_n_attr_changed_calls;
43500 +
43501 +atomic_unchecked_t fscache_n_allocs;
43502 +atomic_unchecked_t fscache_n_allocs_ok;
43503 +atomic_unchecked_t fscache_n_allocs_wait;
43504 +atomic_unchecked_t fscache_n_allocs_nobufs;
43505 +atomic_unchecked_t fscache_n_allocs_intr;
43506 +atomic_unchecked_t fscache_n_allocs_object_dead;
43507 +atomic_unchecked_t fscache_n_alloc_ops;
43508 +atomic_unchecked_t fscache_n_alloc_op_waits;
43509 +
43510 +atomic_unchecked_t fscache_n_retrievals;
43511 +atomic_unchecked_t fscache_n_retrievals_ok;
43512 +atomic_unchecked_t fscache_n_retrievals_wait;
43513 +atomic_unchecked_t fscache_n_retrievals_nodata;
43514 +atomic_unchecked_t fscache_n_retrievals_nobufs;
43515 +atomic_unchecked_t fscache_n_retrievals_intr;
43516 +atomic_unchecked_t fscache_n_retrievals_nomem;
43517 +atomic_unchecked_t fscache_n_retrievals_object_dead;
43518 +atomic_unchecked_t fscache_n_retrieval_ops;
43519 +atomic_unchecked_t fscache_n_retrieval_op_waits;
43520 +
43521 +atomic_unchecked_t fscache_n_stores;
43522 +atomic_unchecked_t fscache_n_stores_ok;
43523 +atomic_unchecked_t fscache_n_stores_again;
43524 +atomic_unchecked_t fscache_n_stores_nobufs;
43525 +atomic_unchecked_t fscache_n_stores_oom;
43526 +atomic_unchecked_t fscache_n_store_ops;
43527 +atomic_unchecked_t fscache_n_store_calls;
43528 +atomic_unchecked_t fscache_n_store_pages;
43529 +atomic_unchecked_t fscache_n_store_radix_deletes;
43530 +atomic_unchecked_t fscache_n_store_pages_over_limit;
43531 +
43532 +atomic_unchecked_t fscache_n_store_vmscan_not_storing;
43533 +atomic_unchecked_t fscache_n_store_vmscan_gone;
43534 +atomic_unchecked_t fscache_n_store_vmscan_busy;
43535 +atomic_unchecked_t fscache_n_store_vmscan_cancelled;
43536 +
43537 +atomic_unchecked_t fscache_n_marks;
43538 +atomic_unchecked_t fscache_n_uncaches;
43539 +
43540 +atomic_unchecked_t fscache_n_acquires;
43541 +atomic_unchecked_t fscache_n_acquires_null;
43542 +atomic_unchecked_t fscache_n_acquires_no_cache;
43543 +atomic_unchecked_t fscache_n_acquires_ok;
43544 +atomic_unchecked_t fscache_n_acquires_nobufs;
43545 +atomic_unchecked_t fscache_n_acquires_oom;
43546 +
43547 +atomic_unchecked_t fscache_n_updates;
43548 +atomic_unchecked_t fscache_n_updates_null;
43549 +atomic_unchecked_t fscache_n_updates_run;
43550 +
43551 +atomic_unchecked_t fscache_n_relinquishes;
43552 +atomic_unchecked_t fscache_n_relinquishes_null;
43553 +atomic_unchecked_t fscache_n_relinquishes_waitcrt;
43554 +atomic_unchecked_t fscache_n_relinquishes_retire;
43555 +
43556 +atomic_unchecked_t fscache_n_cookie_index;
43557 +atomic_unchecked_t fscache_n_cookie_data;
43558 +atomic_unchecked_t fscache_n_cookie_special;
43559 +
43560 +atomic_unchecked_t fscache_n_object_alloc;
43561 +atomic_unchecked_t fscache_n_object_no_alloc;
43562 +atomic_unchecked_t fscache_n_object_lookups;
43563 +atomic_unchecked_t fscache_n_object_lookups_negative;
43564 +atomic_unchecked_t fscache_n_object_lookups_positive;
43565 +atomic_unchecked_t fscache_n_object_lookups_timed_out;
43566 +atomic_unchecked_t fscache_n_object_created;
43567 +atomic_unchecked_t fscache_n_object_avail;
43568 +atomic_unchecked_t fscache_n_object_dead;
43569 +
43570 +atomic_unchecked_t fscache_n_checkaux_none;
43571 +atomic_unchecked_t fscache_n_checkaux_okay;
43572 +atomic_unchecked_t fscache_n_checkaux_update;
43573 +atomic_unchecked_t fscache_n_checkaux_obsolete;
43574
43575 atomic_t fscache_n_cop_alloc_object;
43576 atomic_t fscache_n_cop_lookup_object;
43577 @@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq
43578 seq_puts(m, "FS-Cache statistics\n");
43579
43580 seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
43581 - atomic_read(&fscache_n_cookie_index),
43582 - atomic_read(&fscache_n_cookie_data),
43583 - atomic_read(&fscache_n_cookie_special));
43584 + atomic_read_unchecked(&fscache_n_cookie_index),
43585 + atomic_read_unchecked(&fscache_n_cookie_data),
43586 + atomic_read_unchecked(&fscache_n_cookie_special));
43587
43588 seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
43589 - atomic_read(&fscache_n_object_alloc),
43590 - atomic_read(&fscache_n_object_no_alloc),
43591 - atomic_read(&fscache_n_object_avail),
43592 - atomic_read(&fscache_n_object_dead));
43593 + atomic_read_unchecked(&fscache_n_object_alloc),
43594 + atomic_read_unchecked(&fscache_n_object_no_alloc),
43595 + atomic_read_unchecked(&fscache_n_object_avail),
43596 + atomic_read_unchecked(&fscache_n_object_dead));
43597 seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
43598 - atomic_read(&fscache_n_checkaux_none),
43599 - atomic_read(&fscache_n_checkaux_okay),
43600 - atomic_read(&fscache_n_checkaux_update),
43601 - atomic_read(&fscache_n_checkaux_obsolete));
43602 + atomic_read_unchecked(&fscache_n_checkaux_none),
43603 + atomic_read_unchecked(&fscache_n_checkaux_okay),
43604 + atomic_read_unchecked(&fscache_n_checkaux_update),
43605 + atomic_read_unchecked(&fscache_n_checkaux_obsolete));
43606
43607 seq_printf(m, "Pages : mrk=%u unc=%u\n",
43608 - atomic_read(&fscache_n_marks),
43609 - atomic_read(&fscache_n_uncaches));
43610 + atomic_read_unchecked(&fscache_n_marks),
43611 + atomic_read_unchecked(&fscache_n_uncaches));
43612
43613 seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
43614 " oom=%u\n",
43615 - atomic_read(&fscache_n_acquires),
43616 - atomic_read(&fscache_n_acquires_null),
43617 - atomic_read(&fscache_n_acquires_no_cache),
43618 - atomic_read(&fscache_n_acquires_ok),
43619 - atomic_read(&fscache_n_acquires_nobufs),
43620 - atomic_read(&fscache_n_acquires_oom));
43621 + atomic_read_unchecked(&fscache_n_acquires),
43622 + atomic_read_unchecked(&fscache_n_acquires_null),
43623 + atomic_read_unchecked(&fscache_n_acquires_no_cache),
43624 + atomic_read_unchecked(&fscache_n_acquires_ok),
43625 + atomic_read_unchecked(&fscache_n_acquires_nobufs),
43626 + atomic_read_unchecked(&fscache_n_acquires_oom));
43627
43628 seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
43629 - atomic_read(&fscache_n_object_lookups),
43630 - atomic_read(&fscache_n_object_lookups_negative),
43631 - atomic_read(&fscache_n_object_lookups_positive),
43632 - atomic_read(&fscache_n_object_created),
43633 - atomic_read(&fscache_n_object_lookups_timed_out));
43634 + atomic_read_unchecked(&fscache_n_object_lookups),
43635 + atomic_read_unchecked(&fscache_n_object_lookups_negative),
43636 + atomic_read_unchecked(&fscache_n_object_lookups_positive),
43637 + atomic_read_unchecked(&fscache_n_object_created),
43638 + atomic_read_unchecked(&fscache_n_object_lookups_timed_out));
43639
43640 seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
43641 - atomic_read(&fscache_n_updates),
43642 - atomic_read(&fscache_n_updates_null),
43643 - atomic_read(&fscache_n_updates_run));
43644 + atomic_read_unchecked(&fscache_n_updates),
43645 + atomic_read_unchecked(&fscache_n_updates_null),
43646 + atomic_read_unchecked(&fscache_n_updates_run));
43647
43648 seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
43649 - atomic_read(&fscache_n_relinquishes),
43650 - atomic_read(&fscache_n_relinquishes_null),
43651 - atomic_read(&fscache_n_relinquishes_waitcrt),
43652 - atomic_read(&fscache_n_relinquishes_retire));
43653 + atomic_read_unchecked(&fscache_n_relinquishes),
43654 + atomic_read_unchecked(&fscache_n_relinquishes_null),
43655 + atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
43656 + atomic_read_unchecked(&fscache_n_relinquishes_retire));
43657
43658 seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
43659 - atomic_read(&fscache_n_attr_changed),
43660 - atomic_read(&fscache_n_attr_changed_ok),
43661 - atomic_read(&fscache_n_attr_changed_nobufs),
43662 - atomic_read(&fscache_n_attr_changed_nomem),
43663 - atomic_read(&fscache_n_attr_changed_calls));
43664 + atomic_read_unchecked(&fscache_n_attr_changed),
43665 + atomic_read_unchecked(&fscache_n_attr_changed_ok),
43666 + atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
43667 + atomic_read_unchecked(&fscache_n_attr_changed_nomem),
43668 + atomic_read_unchecked(&fscache_n_attr_changed_calls));
43669
43670 seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
43671 - atomic_read(&fscache_n_allocs),
43672 - atomic_read(&fscache_n_allocs_ok),
43673 - atomic_read(&fscache_n_allocs_wait),
43674 - atomic_read(&fscache_n_allocs_nobufs),
43675 - atomic_read(&fscache_n_allocs_intr));
43676 + atomic_read_unchecked(&fscache_n_allocs),
43677 + atomic_read_unchecked(&fscache_n_allocs_ok),
43678 + atomic_read_unchecked(&fscache_n_allocs_wait),
43679 + atomic_read_unchecked(&fscache_n_allocs_nobufs),
43680 + atomic_read_unchecked(&fscache_n_allocs_intr));
43681 seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
43682 - atomic_read(&fscache_n_alloc_ops),
43683 - atomic_read(&fscache_n_alloc_op_waits),
43684 - atomic_read(&fscache_n_allocs_object_dead));
43685 + atomic_read_unchecked(&fscache_n_alloc_ops),
43686 + atomic_read_unchecked(&fscache_n_alloc_op_waits),
43687 + atomic_read_unchecked(&fscache_n_allocs_object_dead));
43688
43689 seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
43690 " int=%u oom=%u\n",
43691 - atomic_read(&fscache_n_retrievals),
43692 - atomic_read(&fscache_n_retrievals_ok),
43693 - atomic_read(&fscache_n_retrievals_wait),
43694 - atomic_read(&fscache_n_retrievals_nodata),
43695 - atomic_read(&fscache_n_retrievals_nobufs),
43696 - atomic_read(&fscache_n_retrievals_intr),
43697 - atomic_read(&fscache_n_retrievals_nomem));
43698 + atomic_read_unchecked(&fscache_n_retrievals),
43699 + atomic_read_unchecked(&fscache_n_retrievals_ok),
43700 + atomic_read_unchecked(&fscache_n_retrievals_wait),
43701 + atomic_read_unchecked(&fscache_n_retrievals_nodata),
43702 + atomic_read_unchecked(&fscache_n_retrievals_nobufs),
43703 + atomic_read_unchecked(&fscache_n_retrievals_intr),
43704 + atomic_read_unchecked(&fscache_n_retrievals_nomem));
43705 seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
43706 - atomic_read(&fscache_n_retrieval_ops),
43707 - atomic_read(&fscache_n_retrieval_op_waits),
43708 - atomic_read(&fscache_n_retrievals_object_dead));
43709 + atomic_read_unchecked(&fscache_n_retrieval_ops),
43710 + atomic_read_unchecked(&fscache_n_retrieval_op_waits),
43711 + atomic_read_unchecked(&fscache_n_retrievals_object_dead));
43712
43713 seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
43714 - atomic_read(&fscache_n_stores),
43715 - atomic_read(&fscache_n_stores_ok),
43716 - atomic_read(&fscache_n_stores_again),
43717 - atomic_read(&fscache_n_stores_nobufs),
43718 - atomic_read(&fscache_n_stores_oom));
43719 + atomic_read_unchecked(&fscache_n_stores),
43720 + atomic_read_unchecked(&fscache_n_stores_ok),
43721 + atomic_read_unchecked(&fscache_n_stores_again),
43722 + atomic_read_unchecked(&fscache_n_stores_nobufs),
43723 + atomic_read_unchecked(&fscache_n_stores_oom));
43724 seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
43725 - atomic_read(&fscache_n_store_ops),
43726 - atomic_read(&fscache_n_store_calls),
43727 - atomic_read(&fscache_n_store_pages),
43728 - atomic_read(&fscache_n_store_radix_deletes),
43729 - atomic_read(&fscache_n_store_pages_over_limit));
43730 + atomic_read_unchecked(&fscache_n_store_ops),
43731 + atomic_read_unchecked(&fscache_n_store_calls),
43732 + atomic_read_unchecked(&fscache_n_store_pages),
43733 + atomic_read_unchecked(&fscache_n_store_radix_deletes),
43734 + atomic_read_unchecked(&fscache_n_store_pages_over_limit));
43735
43736 seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
43737 - atomic_read(&fscache_n_store_vmscan_not_storing),
43738 - atomic_read(&fscache_n_store_vmscan_gone),
43739 - atomic_read(&fscache_n_store_vmscan_busy),
43740 - atomic_read(&fscache_n_store_vmscan_cancelled));
43741 + atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
43742 + atomic_read_unchecked(&fscache_n_store_vmscan_gone),
43743 + atomic_read_unchecked(&fscache_n_store_vmscan_busy),
43744 + atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
43745
43746 seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
43747 - atomic_read(&fscache_n_op_pend),
43748 - atomic_read(&fscache_n_op_run),
43749 - atomic_read(&fscache_n_op_enqueue),
43750 - atomic_read(&fscache_n_op_cancelled),
43751 - atomic_read(&fscache_n_op_rejected));
43752 + atomic_read_unchecked(&fscache_n_op_pend),
43753 + atomic_read_unchecked(&fscache_n_op_run),
43754 + atomic_read_unchecked(&fscache_n_op_enqueue),
43755 + atomic_read_unchecked(&fscache_n_op_cancelled),
43756 + atomic_read_unchecked(&fscache_n_op_rejected));
43757 seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
43758 - atomic_read(&fscache_n_op_deferred_release),
43759 - atomic_read(&fscache_n_op_release),
43760 - atomic_read(&fscache_n_op_gc));
43761 + atomic_read_unchecked(&fscache_n_op_deferred_release),
43762 + atomic_read_unchecked(&fscache_n_op_release),
43763 + atomic_read_unchecked(&fscache_n_op_gc));
43764
43765 seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
43766 atomic_read(&fscache_n_cop_alloc_object),
43767 diff -urNp linux-3.0.9/fs/fs_struct.c linux-3.0.9/fs/fs_struct.c
43768 --- linux-3.0.9/fs/fs_struct.c 2011-11-11 13:12:24.000000000 -0500
43769 +++ linux-3.0.9/fs/fs_struct.c 2011-11-15 20:02:59.000000000 -0500
43770 @@ -4,6 +4,7 @@
43771 #include <linux/path.h>
43772 #include <linux/slab.h>
43773 #include <linux/fs_struct.h>
43774 +#include <linux/grsecurity.h>
43775 #include "internal.h"
43776
43777 static inline void path_get_longterm(struct path *path)
43778 @@ -31,6 +32,7 @@ void set_fs_root(struct fs_struct *fs, s
43779 old_root = fs->root;
43780 fs->root = *path;
43781 path_get_longterm(path);
43782 + gr_set_chroot_entries(current, path);
43783 write_seqcount_end(&fs->seq);
43784 spin_unlock(&fs->lock);
43785 if (old_root.dentry)
43786 @@ -74,6 +76,7 @@ void chroot_fs_refs(struct path *old_roo
43787 && fs->root.mnt == old_root->mnt) {
43788 path_get_longterm(new_root);
43789 fs->root = *new_root;
43790 + gr_set_chroot_entries(p, new_root);
43791 count++;
43792 }
43793 if (fs->pwd.dentry == old_root->dentry
43794 @@ -109,7 +112,8 @@ void exit_fs(struct task_struct *tsk)
43795 spin_lock(&fs->lock);
43796 write_seqcount_begin(&fs->seq);
43797 tsk->fs = NULL;
43798 - kill = !--fs->users;
43799 + gr_clear_chroot_entries(tsk);
43800 + kill = !atomic_dec_return(&fs->users);
43801 write_seqcount_end(&fs->seq);
43802 spin_unlock(&fs->lock);
43803 task_unlock(tsk);
43804 @@ -123,7 +127,7 @@ struct fs_struct *copy_fs_struct(struct
43805 struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
43806 /* We don't need to lock fs - think why ;-) */
43807 if (fs) {
43808 - fs->users = 1;
43809 + atomic_set(&fs->users, 1);
43810 fs->in_exec = 0;
43811 spin_lock_init(&fs->lock);
43812 seqcount_init(&fs->seq);
43813 @@ -132,6 +136,9 @@ struct fs_struct *copy_fs_struct(struct
43814 spin_lock(&old->lock);
43815 fs->root = old->root;
43816 path_get_longterm(&fs->root);
43817 + /* instead of calling gr_set_chroot_entries here,
43818 + we call it from every caller of this function
43819 + */
43820 fs->pwd = old->pwd;
43821 path_get_longterm(&fs->pwd);
43822 spin_unlock(&old->lock);
43823 @@ -150,8 +157,9 @@ int unshare_fs_struct(void)
43824
43825 task_lock(current);
43826 spin_lock(&fs->lock);
43827 - kill = !--fs->users;
43828 + kill = !atomic_dec_return(&fs->users);
43829 current->fs = new_fs;
43830 + gr_set_chroot_entries(current, &new_fs->root);
43831 spin_unlock(&fs->lock);
43832 task_unlock(current);
43833
43834 @@ -170,7 +178,7 @@ EXPORT_SYMBOL(current_umask);
43835
43836 /* to be mentioned only in INIT_TASK */
43837 struct fs_struct init_fs = {
43838 - .users = 1,
43839 + .users = ATOMIC_INIT(1),
43840 .lock = __SPIN_LOCK_UNLOCKED(init_fs.lock),
43841 .seq = SEQCNT_ZERO,
43842 .umask = 0022,
43843 @@ -186,12 +194,13 @@ void daemonize_fs_struct(void)
43844 task_lock(current);
43845
43846 spin_lock(&init_fs.lock);
43847 - init_fs.users++;
43848 + atomic_inc(&init_fs.users);
43849 spin_unlock(&init_fs.lock);
43850
43851 spin_lock(&fs->lock);
43852 current->fs = &init_fs;
43853 - kill = !--fs->users;
43854 + gr_set_chroot_entries(current, &current->fs->root);
43855 + kill = !atomic_dec_return(&fs->users);
43856 spin_unlock(&fs->lock);
43857
43858 task_unlock(current);
43859 diff -urNp linux-3.0.9/fs/fuse/cuse.c linux-3.0.9/fs/fuse/cuse.c
43860 --- linux-3.0.9/fs/fuse/cuse.c 2011-11-11 13:12:24.000000000 -0500
43861 +++ linux-3.0.9/fs/fuse/cuse.c 2011-11-15 20:02:59.000000000 -0500
43862 @@ -586,10 +586,12 @@ static int __init cuse_init(void)
43863 INIT_LIST_HEAD(&cuse_conntbl[i]);
43864
43865 /* inherit and extend fuse_dev_operations */
43866 - cuse_channel_fops = fuse_dev_operations;
43867 - cuse_channel_fops.owner = THIS_MODULE;
43868 - cuse_channel_fops.open = cuse_channel_open;
43869 - cuse_channel_fops.release = cuse_channel_release;
43870 + pax_open_kernel();
43871 + memcpy((void *)&cuse_channel_fops, &fuse_dev_operations, sizeof(fuse_dev_operations));
43872 + *(void **)&cuse_channel_fops.owner = THIS_MODULE;
43873 + *(void **)&cuse_channel_fops.open = cuse_channel_open;
43874 + *(void **)&cuse_channel_fops.release = cuse_channel_release;
43875 + pax_close_kernel();
43876
43877 cuse_class = class_create(THIS_MODULE, "cuse");
43878 if (IS_ERR(cuse_class))
43879 diff -urNp linux-3.0.9/fs/fuse/dev.c linux-3.0.9/fs/fuse/dev.c
43880 --- linux-3.0.9/fs/fuse/dev.c 2011-11-11 13:12:24.000000000 -0500
43881 +++ linux-3.0.9/fs/fuse/dev.c 2011-11-15 20:02:59.000000000 -0500
43882 @@ -1242,7 +1242,7 @@ static ssize_t fuse_dev_splice_read(stru
43883 ret = 0;
43884 pipe_lock(pipe);
43885
43886 - if (!pipe->readers) {
43887 + if (!atomic_read(&pipe->readers)) {
43888 send_sig(SIGPIPE, current, 0);
43889 if (!ret)
43890 ret = -EPIPE;
43891 diff -urNp linux-3.0.9/fs/fuse/dir.c linux-3.0.9/fs/fuse/dir.c
43892 --- linux-3.0.9/fs/fuse/dir.c 2011-11-11 13:12:24.000000000 -0500
43893 +++ linux-3.0.9/fs/fuse/dir.c 2011-11-15 20:02:59.000000000 -0500
43894 @@ -1148,7 +1148,7 @@ static char *read_link(struct dentry *de
43895 return link;
43896 }
43897
43898 -static void free_link(char *link)
43899 +static void free_link(const char *link)
43900 {
43901 if (!IS_ERR(link))
43902 free_page((unsigned long) link);
43903 diff -urNp linux-3.0.9/fs/gfs2/inode.c linux-3.0.9/fs/gfs2/inode.c
43904 --- linux-3.0.9/fs/gfs2/inode.c 2011-11-11 13:12:24.000000000 -0500
43905 +++ linux-3.0.9/fs/gfs2/inode.c 2011-11-15 20:02:59.000000000 -0500
43906 @@ -1525,7 +1525,7 @@ out:
43907
43908 static void gfs2_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
43909 {
43910 - char *s = nd_get_link(nd);
43911 + const char *s = nd_get_link(nd);
43912 if (!IS_ERR(s))
43913 kfree(s);
43914 }
43915 diff -urNp linux-3.0.9/fs/hfsplus/catalog.c linux-3.0.9/fs/hfsplus/catalog.c
43916 --- linux-3.0.9/fs/hfsplus/catalog.c 2011-11-11 13:12:24.000000000 -0500
43917 +++ linux-3.0.9/fs/hfsplus/catalog.c 2011-11-15 20:02:59.000000000 -0500
43918 @@ -179,6 +179,8 @@ int hfsplus_find_cat(struct super_block
43919 int err;
43920 u16 type;
43921
43922 + pax_track_stack();
43923 +
43924 hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
43925 err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
43926 if (err)
43927 @@ -210,6 +212,8 @@ int hfsplus_create_cat(u32 cnid, struct
43928 int entry_size;
43929 int err;
43930
43931 + pax_track_stack();
43932 +
43933 dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n",
43934 str->name, cnid, inode->i_nlink);
43935 hfs_find_init(HFSPLUS_SB(sb)->cat_tree, &fd);
43936 @@ -349,6 +353,8 @@ int hfsplus_rename_cat(u32 cnid,
43937 int entry_size, type;
43938 int err = 0;
43939
43940 + pax_track_stack();
43941 +
43942 dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n",
43943 cnid, src_dir->i_ino, src_name->name,
43944 dst_dir->i_ino, dst_name->name);
43945 diff -urNp linux-3.0.9/fs/hfsplus/dir.c linux-3.0.9/fs/hfsplus/dir.c
43946 --- linux-3.0.9/fs/hfsplus/dir.c 2011-11-11 13:12:24.000000000 -0500
43947 +++ linux-3.0.9/fs/hfsplus/dir.c 2011-11-15 20:02:59.000000000 -0500
43948 @@ -129,6 +129,8 @@ static int hfsplus_readdir(struct file *
43949 struct hfsplus_readdir_data *rd;
43950 u16 type;
43951
43952 + pax_track_stack();
43953 +
43954 if (filp->f_pos >= inode->i_size)
43955 return 0;
43956
43957 diff -urNp linux-3.0.9/fs/hfsplus/inode.c linux-3.0.9/fs/hfsplus/inode.c
43958 --- linux-3.0.9/fs/hfsplus/inode.c 2011-11-11 13:12:24.000000000 -0500
43959 +++ linux-3.0.9/fs/hfsplus/inode.c 2011-11-15 20:02:59.000000000 -0500
43960 @@ -489,6 +489,8 @@ int hfsplus_cat_read_inode(struct inode
43961 int res = 0;
43962 u16 type;
43963
43964 + pax_track_stack();
43965 +
43966 type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
43967
43968 HFSPLUS_I(inode)->linkid = 0;
43969 @@ -552,6 +554,8 @@ int hfsplus_cat_write_inode(struct inode
43970 struct hfs_find_data fd;
43971 hfsplus_cat_entry entry;
43972
43973 + pax_track_stack();
43974 +
43975 if (HFSPLUS_IS_RSRC(inode))
43976 main_inode = HFSPLUS_I(inode)->rsrc_inode;
43977
43978 diff -urNp linux-3.0.9/fs/hfsplus/ioctl.c linux-3.0.9/fs/hfsplus/ioctl.c
43979 --- linux-3.0.9/fs/hfsplus/ioctl.c 2011-11-11 13:12:24.000000000 -0500
43980 +++ linux-3.0.9/fs/hfsplus/ioctl.c 2011-11-15 20:02:59.000000000 -0500
43981 @@ -122,6 +122,8 @@ int hfsplus_setxattr(struct dentry *dent
43982 struct hfsplus_cat_file *file;
43983 int res;
43984
43985 + pax_track_stack();
43986 +
43987 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
43988 return -EOPNOTSUPP;
43989
43990 @@ -166,6 +168,8 @@ ssize_t hfsplus_getxattr(struct dentry *
43991 struct hfsplus_cat_file *file;
43992 ssize_t res = 0;
43993
43994 + pax_track_stack();
43995 +
43996 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
43997 return -EOPNOTSUPP;
43998
43999 diff -urNp linux-3.0.9/fs/hfsplus/super.c linux-3.0.9/fs/hfsplus/super.c
44000 --- linux-3.0.9/fs/hfsplus/super.c 2011-11-11 13:12:24.000000000 -0500
44001 +++ linux-3.0.9/fs/hfsplus/super.c 2011-11-15 20:02:59.000000000 -0500
44002 @@ -340,6 +340,8 @@ static int hfsplus_fill_super(struct sup
44003 struct nls_table *nls = NULL;
44004 int err;
44005
44006 + pax_track_stack();
44007 +
44008 err = -EINVAL;
44009 sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
44010 if (!sbi)
44011 diff -urNp linux-3.0.9/fs/hugetlbfs/inode.c linux-3.0.9/fs/hugetlbfs/inode.c
44012 --- linux-3.0.9/fs/hugetlbfs/inode.c 2011-11-11 13:12:24.000000000 -0500
44013 +++ linux-3.0.9/fs/hugetlbfs/inode.c 2011-11-15 20:02:59.000000000 -0500
44014 @@ -914,7 +914,7 @@ static struct file_system_type hugetlbfs
44015 .kill_sb = kill_litter_super,
44016 };
44017
44018 -static struct vfsmount *hugetlbfs_vfsmount;
44019 +struct vfsmount *hugetlbfs_vfsmount;
44020
44021 static int can_do_hugetlb_shm(void)
44022 {
44023 diff -urNp linux-3.0.9/fs/inode.c linux-3.0.9/fs/inode.c
44024 --- linux-3.0.9/fs/inode.c 2011-11-11 13:12:24.000000000 -0500
44025 +++ linux-3.0.9/fs/inode.c 2011-11-15 20:02:59.000000000 -0500
44026 @@ -829,8 +829,8 @@ unsigned int get_next_ino(void)
44027
44028 #ifdef CONFIG_SMP
44029 if (unlikely((res & (LAST_INO_BATCH-1)) == 0)) {
44030 - static atomic_t shared_last_ino;
44031 - int next = atomic_add_return(LAST_INO_BATCH, &shared_last_ino);
44032 + static atomic_unchecked_t shared_last_ino;
44033 + int next = atomic_add_return_unchecked(LAST_INO_BATCH, &shared_last_ino);
44034
44035 res = next - LAST_INO_BATCH;
44036 }
44037 diff -urNp linux-3.0.9/fs/jbd/checkpoint.c linux-3.0.9/fs/jbd/checkpoint.c
44038 --- linux-3.0.9/fs/jbd/checkpoint.c 2011-11-11 13:12:24.000000000 -0500
44039 +++ linux-3.0.9/fs/jbd/checkpoint.c 2011-11-15 20:02:59.000000000 -0500
44040 @@ -350,6 +350,8 @@ int log_do_checkpoint(journal_t *journal
44041 tid_t this_tid;
44042 int result;
44043
44044 + pax_track_stack();
44045 +
44046 jbd_debug(1, "Start checkpoint\n");
44047
44048 /*
44049 diff -urNp linux-3.0.9/fs/jffs2/compr_rtime.c linux-3.0.9/fs/jffs2/compr_rtime.c
44050 --- linux-3.0.9/fs/jffs2/compr_rtime.c 2011-11-11 13:12:24.000000000 -0500
44051 +++ linux-3.0.9/fs/jffs2/compr_rtime.c 2011-11-15 20:02:59.000000000 -0500
44052 @@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned
44053 int outpos = 0;
44054 int pos=0;
44055
44056 + pax_track_stack();
44057 +
44058 memset(positions,0,sizeof(positions));
44059
44060 while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
44061 @@ -78,6 +80,8 @@ static int jffs2_rtime_decompress(unsign
44062 int outpos = 0;
44063 int pos=0;
44064
44065 + pax_track_stack();
44066 +
44067 memset(positions,0,sizeof(positions));
44068
44069 while (outpos<destlen) {
44070 diff -urNp linux-3.0.9/fs/jffs2/compr_rubin.c linux-3.0.9/fs/jffs2/compr_rubin.c
44071 --- linux-3.0.9/fs/jffs2/compr_rubin.c 2011-11-11 13:12:24.000000000 -0500
44072 +++ linux-3.0.9/fs/jffs2/compr_rubin.c 2011-11-15 20:02:59.000000000 -0500
44073 @@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsig
44074 int ret;
44075 uint32_t mysrclen, mydstlen;
44076
44077 + pax_track_stack();
44078 +
44079 mysrclen = *sourcelen;
44080 mydstlen = *dstlen - 8;
44081
44082 diff -urNp linux-3.0.9/fs/jffs2/erase.c linux-3.0.9/fs/jffs2/erase.c
44083 --- linux-3.0.9/fs/jffs2/erase.c 2011-11-11 13:12:24.000000000 -0500
44084 +++ linux-3.0.9/fs/jffs2/erase.c 2011-11-15 20:02:59.000000000 -0500
44085 @@ -439,7 +439,8 @@ static void jffs2_mark_erased_block(stru
44086 struct jffs2_unknown_node marker = {
44087 .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
44088 .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
44089 - .totlen = cpu_to_je32(c->cleanmarker_size)
44090 + .totlen = cpu_to_je32(c->cleanmarker_size),
44091 + .hdr_crc = cpu_to_je32(0)
44092 };
44093
44094 jffs2_prealloc_raw_node_refs(c, jeb, 1);
44095 diff -urNp linux-3.0.9/fs/jffs2/wbuf.c linux-3.0.9/fs/jffs2/wbuf.c
44096 --- linux-3.0.9/fs/jffs2/wbuf.c 2011-11-11 13:12:24.000000000 -0500
44097 +++ linux-3.0.9/fs/jffs2/wbuf.c 2011-11-15 20:02:59.000000000 -0500
44098 @@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
44099 {
44100 .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
44101 .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
44102 - .totlen = constant_cpu_to_je32(8)
44103 + .totlen = constant_cpu_to_je32(8),
44104 + .hdr_crc = constant_cpu_to_je32(0)
44105 };
44106
44107 /*
44108 diff -urNp linux-3.0.9/fs/jffs2/xattr.c linux-3.0.9/fs/jffs2/xattr.c
44109 --- linux-3.0.9/fs/jffs2/xattr.c 2011-11-11 13:12:24.000000000 -0500
44110 +++ linux-3.0.9/fs/jffs2/xattr.c 2011-11-15 20:02:59.000000000 -0500
44111 @@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct
44112
44113 BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
44114
44115 + pax_track_stack();
44116 +
44117 /* Phase.1 : Merge same xref */
44118 for (i=0; i < XREF_TMPHASH_SIZE; i++)
44119 xref_tmphash[i] = NULL;
44120 diff -urNp linux-3.0.9/fs/jfs/super.c linux-3.0.9/fs/jfs/super.c
44121 --- linux-3.0.9/fs/jfs/super.c 2011-11-11 13:12:24.000000000 -0500
44122 +++ linux-3.0.9/fs/jfs/super.c 2011-11-15 20:02:59.000000000 -0500
44123 @@ -803,7 +803,7 @@ static int __init init_jfs_fs(void)
44124
44125 jfs_inode_cachep =
44126 kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
44127 - SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
44128 + SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY,
44129 init_once);
44130 if (jfs_inode_cachep == NULL)
44131 return -ENOMEM;
44132 diff -urNp linux-3.0.9/fs/Kconfig.binfmt linux-3.0.9/fs/Kconfig.binfmt
44133 --- linux-3.0.9/fs/Kconfig.binfmt 2011-11-11 13:12:24.000000000 -0500
44134 +++ linux-3.0.9/fs/Kconfig.binfmt 2011-11-15 20:02:59.000000000 -0500
44135 @@ -86,7 +86,7 @@ config HAVE_AOUT
44136
44137 config BINFMT_AOUT
44138 tristate "Kernel support for a.out and ECOFF binaries"
44139 - depends on HAVE_AOUT
44140 + depends on HAVE_AOUT && BROKEN
44141 ---help---
44142 A.out (Assembler.OUTput) is a set of formats for libraries and
44143 executables used in the earliest versions of UNIX. Linux used
44144 diff -urNp linux-3.0.9/fs/libfs.c linux-3.0.9/fs/libfs.c
44145 --- linux-3.0.9/fs/libfs.c 2011-11-11 13:12:24.000000000 -0500
44146 +++ linux-3.0.9/fs/libfs.c 2011-11-15 20:02:59.000000000 -0500
44147 @@ -163,6 +163,9 @@ int dcache_readdir(struct file * filp, v
44148
44149 for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
44150 struct dentry *next;
44151 + char d_name[sizeof(next->d_iname)];
44152 + const unsigned char *name;
44153 +
44154 next = list_entry(p, struct dentry, d_u.d_child);
44155 spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
44156 if (!simple_positive(next)) {
44157 @@ -172,7 +175,12 @@ int dcache_readdir(struct file * filp, v
44158
44159 spin_unlock(&next->d_lock);
44160 spin_unlock(&dentry->d_lock);
44161 - if (filldir(dirent, next->d_name.name,
44162 + name = next->d_name.name;
44163 + if (name == next->d_iname) {
44164 + memcpy(d_name, name, next->d_name.len);
44165 + name = d_name;
44166 + }
44167 + if (filldir(dirent, name,
44168 next->d_name.len, filp->f_pos,
44169 next->d_inode->i_ino,
44170 dt_type(next->d_inode)) < 0)
44171 diff -urNp linux-3.0.9/fs/lockd/clntproc.c linux-3.0.9/fs/lockd/clntproc.c
44172 --- linux-3.0.9/fs/lockd/clntproc.c 2011-11-11 13:12:24.000000000 -0500
44173 +++ linux-3.0.9/fs/lockd/clntproc.c 2011-11-15 20:02:59.000000000 -0500
44174 @@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt
44175 /*
44176 * Cookie counter for NLM requests
44177 */
44178 -static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
44179 +static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
44180
44181 void nlmclnt_next_cookie(struct nlm_cookie *c)
44182 {
44183 - u32 cookie = atomic_inc_return(&nlm_cookie);
44184 + u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
44185
44186 memcpy(c->data, &cookie, 4);
44187 c->len=4;
44188 @@ -620,6 +620,8 @@ nlmclnt_reclaim(struct nlm_host *host, s
44189 struct nlm_rqst reqst, *req;
44190 int status;
44191
44192 + pax_track_stack();
44193 +
44194 req = &reqst;
44195 memset(req, 0, sizeof(*req));
44196 locks_init_lock(&req->a_args.lock.fl);
44197 diff -urNp linux-3.0.9/fs/locks.c linux-3.0.9/fs/locks.c
44198 --- linux-3.0.9/fs/locks.c 2011-11-11 13:12:24.000000000 -0500
44199 +++ linux-3.0.9/fs/locks.c 2011-11-15 20:02:59.000000000 -0500
44200 @@ -2043,16 +2043,16 @@ void locks_remove_flock(struct file *fil
44201 return;
44202
44203 if (filp->f_op && filp->f_op->flock) {
44204 - struct file_lock fl = {
44205 + struct file_lock flock = {
44206 .fl_pid = current->tgid,
44207 .fl_file = filp,
44208 .fl_flags = FL_FLOCK,
44209 .fl_type = F_UNLCK,
44210 .fl_end = OFFSET_MAX,
44211 };
44212 - filp->f_op->flock(filp, F_SETLKW, &fl);
44213 - if (fl.fl_ops && fl.fl_ops->fl_release_private)
44214 - fl.fl_ops->fl_release_private(&fl);
44215 + filp->f_op->flock(filp, F_SETLKW, &flock);
44216 + if (flock.fl_ops && flock.fl_ops->fl_release_private)
44217 + flock.fl_ops->fl_release_private(&flock);
44218 }
44219
44220 lock_flocks();
44221 diff -urNp linux-3.0.9/fs/logfs/super.c linux-3.0.9/fs/logfs/super.c
44222 --- linux-3.0.9/fs/logfs/super.c 2011-11-11 13:12:24.000000000 -0500
44223 +++ linux-3.0.9/fs/logfs/super.c 2011-11-15 20:02:59.000000000 -0500
44224 @@ -266,6 +266,8 @@ static int logfs_recover_sb(struct super
44225 struct logfs_disk_super _ds1, *ds1 = &_ds1;
44226 int err, valid0, valid1;
44227
44228 + pax_track_stack();
44229 +
44230 /* read first superblock */
44231 err = wbuf_read(sb, super->s_sb_ofs[0], sizeof(*ds0), ds0);
44232 if (err)
44233 diff -urNp linux-3.0.9/fs/namei.c linux-3.0.9/fs/namei.c
44234 --- linux-3.0.9/fs/namei.c 2011-11-11 13:12:24.000000000 -0500
44235 +++ linux-3.0.9/fs/namei.c 2011-11-16 17:53:31.000000000 -0500
44236 @@ -239,21 +239,23 @@ int generic_permission(struct inode *ino
44237 return ret;
44238
44239 /*
44240 - * Read/write DACs are always overridable.
44241 - * Executable DACs are overridable for all directories and
44242 - * for non-directories that have least one exec bit set.
44243 + * Searching includes executable on directories, else just read.
44244 */
44245 - if (!(mask & MAY_EXEC) || execute_ok(inode))
44246 - if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
44247 + mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
44248 + if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE))) {
44249 + if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
44250 return 0;
44251 + }
44252
44253 /*
44254 - * Searching includes executable on directories, else just read.
44255 + * Read/write DACs are always overridable.
44256 + * Executable DACs are overridable for all directories and
44257 + * for non-directories that have least one exec bit set.
44258 */
44259 - mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
44260 - if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
44261 - if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
44262 + if (!(mask & MAY_EXEC) || execute_ok(inode)) {
44263 + if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
44264 return 0;
44265 + }
44266
44267 return -EACCES;
44268 }
44269 @@ -595,9 +597,12 @@ static inline int exec_permission(struct
44270 if (ret == -ECHILD)
44271 return ret;
44272
44273 - if (ns_capable(ns, CAP_DAC_OVERRIDE) ||
44274 - ns_capable(ns, CAP_DAC_READ_SEARCH))
44275 + if (ns_capable_nolog(ns, CAP_DAC_OVERRIDE))
44276 goto ok;
44277 + else {
44278 + if (ns_capable(ns, CAP_DAC_READ_SEARCH) || ns_capable(ns, CAP_DAC_OVERRIDE))
44279 + goto ok;
44280 + }
44281
44282 return ret;
44283 ok:
44284 @@ -705,11 +710,19 @@ follow_link(struct path *link, struct na
44285 return error;
44286 }
44287
44288 + if (gr_handle_follow_link(dentry->d_parent->d_inode,
44289 + dentry->d_inode, dentry, nd->path.mnt)) {
44290 + error = -EACCES;
44291 + *p = ERR_PTR(error); /* no ->put_link(), please */
44292 + path_put(&nd->path);
44293 + return error;
44294 + }
44295 +
44296 nd->last_type = LAST_BIND;
44297 *p = dentry->d_inode->i_op->follow_link(dentry, nd);
44298 error = PTR_ERR(*p);
44299 if (!IS_ERR(*p)) {
44300 - char *s = nd_get_link(nd);
44301 + const char *s = nd_get_link(nd);
44302 error = 0;
44303 if (s)
44304 error = __vfs_follow_link(nd, s);
44305 @@ -1606,6 +1619,12 @@ static int path_lookupat(int dfd, const
44306 if (!err)
44307 err = complete_walk(nd);
44308
44309 + if (!(nd->flags & LOOKUP_PARENT) && !gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
44310 + if (!err)
44311 + path_put(&nd->path);
44312 + err = -ENOENT;
44313 + }
44314 +
44315 if (!err && nd->flags & LOOKUP_DIRECTORY) {
44316 if (!nd->inode->i_op->lookup) {
44317 path_put(&nd->path);
44318 @@ -1633,6 +1652,9 @@ static int do_path_lookup(int dfd, const
44319 retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd);
44320
44321 if (likely(!retval)) {
44322 + if (*name != '/' && nd->path.dentry && nd->inode && !gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
44323 + return -ENOENT;
44324 +
44325 if (unlikely(!audit_dummy_context())) {
44326 if (nd->path.dentry && nd->inode)
44327 audit_inode(name, nd->path.dentry);
44328 @@ -1949,6 +1971,30 @@ int vfs_create(struct inode *dir, struct
44329 return error;
44330 }
44331
44332 +/*
44333 + * Note that while the flag value (low two bits) for sys_open means:
44334 + * 00 - read-only
44335 + * 01 - write-only
44336 + * 10 - read-write
44337 + * 11 - special
44338 + * it is changed into
44339 + * 00 - no permissions needed
44340 + * 01 - read-permission
44341 + * 10 - write-permission
44342 + * 11 - read-write
44343 + * for the internal routines (ie open_namei()/follow_link() etc)
44344 + * This is more logical, and also allows the 00 "no perm needed"
44345 + * to be used for symlinks (where the permissions are checked
44346 + * later).
44347 + *
44348 +*/
44349 +static inline int open_to_namei_flags(int flag)
44350 +{
44351 + if ((flag+1) & O_ACCMODE)
44352 + flag++;
44353 + return flag;
44354 +}
44355 +
44356 static int may_open(struct path *path, int acc_mode, int flag)
44357 {
44358 struct dentry *dentry = path->dentry;
44359 @@ -2001,7 +2047,27 @@ static int may_open(struct path *path, i
44360 /*
44361 * Ensure there are no outstanding leases on the file.
44362 */
44363 - return break_lease(inode, flag);
44364 + error = break_lease(inode, flag);
44365 +
44366 + if (error)
44367 + return error;
44368 +
44369 + if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
44370 + error = -EPERM;
44371 + goto exit;
44372 + }
44373 +
44374 + if (gr_handle_rawio(inode)) {
44375 + error = -EPERM;
44376 + goto exit;
44377 + }
44378 +
44379 + if (!gr_acl_handle_open(dentry, path->mnt, open_to_namei_flags(flag))) {
44380 + error = -EACCES;
44381 + goto exit;
44382 + }
44383 +exit:
44384 + return error;
44385 }
44386
44387 static int handle_truncate(struct file *filp)
44388 @@ -2027,30 +2093,6 @@ static int handle_truncate(struct file *
44389 }
44390
44391 /*
44392 - * Note that while the flag value (low two bits) for sys_open means:
44393 - * 00 - read-only
44394 - * 01 - write-only
44395 - * 10 - read-write
44396 - * 11 - special
44397 - * it is changed into
44398 - * 00 - no permissions needed
44399 - * 01 - read-permission
44400 - * 10 - write-permission
44401 - * 11 - read-write
44402 - * for the internal routines (ie open_namei()/follow_link() etc)
44403 - * This is more logical, and also allows the 00 "no perm needed"
44404 - * to be used for symlinks (where the permissions are checked
44405 - * later).
44406 - *
44407 -*/
44408 -static inline int open_to_namei_flags(int flag)
44409 -{
44410 - if ((flag+1) & O_ACCMODE)
44411 - flag++;
44412 - return flag;
44413 -}
44414 -
44415 -/*
44416 * Handle the last step of open()
44417 */
44418 static struct file *do_last(struct nameidata *nd, struct path *path,
44419 @@ -2059,6 +2101,7 @@ static struct file *do_last(struct namei
44420 struct dentry *dir = nd->path.dentry;
44421 struct dentry *dentry;
44422 int open_flag = op->open_flag;
44423 + int flag = open_to_namei_flags(open_flag);
44424 int will_truncate = open_flag & O_TRUNC;
44425 int want_write = 0;
44426 int acc_mode = op->acc_mode;
44427 @@ -2079,6 +2122,10 @@ static struct file *do_last(struct namei
44428 error = complete_walk(nd);
44429 if (error)
44430 return ERR_PTR(error);
44431 + if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
44432 + error = -ENOENT;
44433 + goto exit;
44434 + }
44435 audit_inode(pathname, nd->path.dentry);
44436 if (open_flag & O_CREAT) {
44437 error = -EISDIR;
44438 @@ -2089,6 +2136,10 @@ static struct file *do_last(struct namei
44439 error = complete_walk(nd);
44440 if (error)
44441 return ERR_PTR(error);
44442 + if (!gr_acl_handle_hidden_file(dir, nd->path.mnt)) {
44443 + error = -ENOENT;
44444 + goto exit;
44445 + }
44446 audit_inode(pathname, dir);
44447 goto ok;
44448 }
44449 @@ -2111,6 +2162,11 @@ static struct file *do_last(struct namei
44450 if (error)
44451 return ERR_PTR(-ECHILD);
44452
44453 + if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
44454 + error = -ENOENT;
44455 + goto exit;
44456 + }
44457 +
44458 error = -ENOTDIR;
44459 if (nd->flags & LOOKUP_DIRECTORY) {
44460 if (!nd->inode->i_op->lookup)
44461 @@ -2150,6 +2206,12 @@ static struct file *do_last(struct namei
44462 /* Negative dentry, just create the file */
44463 if (!dentry->d_inode) {
44464 int mode = op->mode;
44465 +
44466 + if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, path->mnt, flag, mode)) {
44467 + error = -EACCES;
44468 + goto exit_mutex_unlock;
44469 + }
44470 +
44471 if (!IS_POSIXACL(dir->d_inode))
44472 mode &= ~current_umask();
44473 /*
44474 @@ -2173,6 +2235,8 @@ static struct file *do_last(struct namei
44475 error = vfs_create(dir->d_inode, dentry, mode, nd);
44476 if (error)
44477 goto exit_mutex_unlock;
44478 + else
44479 + gr_handle_create(path->dentry, path->mnt);
44480 mutex_unlock(&dir->d_inode->i_mutex);
44481 dput(nd->path.dentry);
44482 nd->path.dentry = dentry;
44483 @@ -2182,6 +2246,19 @@ static struct file *do_last(struct namei
44484 /*
44485 * It already exists.
44486 */
44487 +
44488 + if (!gr_acl_handle_hidden_file(dentry, nd->path.mnt)) {
44489 + error = -ENOENT;
44490 + goto exit_mutex_unlock;
44491 + }
44492 +
44493 + /* only check if O_CREAT is specified, all other checks need to go
44494 + into may_open */
44495 + if (gr_handle_fifo(path->dentry, path->mnt, dir, flag, acc_mode)) {
44496 + error = -EACCES;
44497 + goto exit_mutex_unlock;
44498 + }
44499 +
44500 mutex_unlock(&dir->d_inode->i_mutex);
44501 audit_inode(pathname, path->dentry);
44502
44503 @@ -2398,6 +2475,10 @@ struct dentry *lookup_create(struct name
44504 }
44505 return dentry;
44506 eexist:
44507 + if (!gr_acl_handle_hidden_file(dentry, nd->path.mnt)) {
44508 + dput(dentry);
44509 + return ERR_PTR(-ENOENT);
44510 + }
44511 dput(dentry);
44512 dentry = ERR_PTR(-EEXIST);
44513 fail:
44514 @@ -2475,6 +2556,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
44515 error = may_mknod(mode);
44516 if (error)
44517 goto out_dput;
44518 +
44519 + if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
44520 + error = -EPERM;
44521 + goto out_dput;
44522 + }
44523 +
44524 + if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
44525 + error = -EACCES;
44526 + goto out_dput;
44527 + }
44528 +
44529 error = mnt_want_write(nd.path.mnt);
44530 if (error)
44531 goto out_dput;
44532 @@ -2495,6 +2587,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
44533 }
44534 out_drop_write:
44535 mnt_drop_write(nd.path.mnt);
44536 +
44537 + if (!error)
44538 + gr_handle_create(dentry, nd.path.mnt);
44539 out_dput:
44540 dput(dentry);
44541 out_unlock:
44542 @@ -2547,6 +2642,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
44543 if (IS_ERR(dentry))
44544 goto out_unlock;
44545
44546 + if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
44547 + error = -EACCES;
44548 + goto out_dput;
44549 + }
44550 +
44551 if (!IS_POSIXACL(nd.path.dentry->d_inode))
44552 mode &= ~current_umask();
44553 error = mnt_want_write(nd.path.mnt);
44554 @@ -2558,6 +2658,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
44555 error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
44556 out_drop_write:
44557 mnt_drop_write(nd.path.mnt);
44558 +
44559 + if (!error)
44560 + gr_handle_create(dentry, nd.path.mnt);
44561 +
44562 out_dput:
44563 dput(dentry);
44564 out_unlock:
44565 @@ -2640,6 +2744,8 @@ static long do_rmdir(int dfd, const char
44566 char * name;
44567 struct dentry *dentry;
44568 struct nameidata nd;
44569 + ino_t saved_ino = 0;
44570 + dev_t saved_dev = 0;
44571
44572 error = user_path_parent(dfd, pathname, &nd, &name);
44573 if (error)
44574 @@ -2668,6 +2774,15 @@ static long do_rmdir(int dfd, const char
44575 error = -ENOENT;
44576 goto exit3;
44577 }
44578 +
44579 + saved_ino = dentry->d_inode->i_ino;
44580 + saved_dev = gr_get_dev_from_dentry(dentry);
44581 +
44582 + if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
44583 + error = -EACCES;
44584 + goto exit3;
44585 + }
44586 +
44587 error = mnt_want_write(nd.path.mnt);
44588 if (error)
44589 goto exit3;
44590 @@ -2675,6 +2790,8 @@ static long do_rmdir(int dfd, const char
44591 if (error)
44592 goto exit4;
44593 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
44594 + if (!error && (saved_dev || saved_ino))
44595 + gr_handle_delete(saved_ino, saved_dev);
44596 exit4:
44597 mnt_drop_write(nd.path.mnt);
44598 exit3:
44599 @@ -2737,6 +2854,8 @@ static long do_unlinkat(int dfd, const c
44600 struct dentry *dentry;
44601 struct nameidata nd;
44602 struct inode *inode = NULL;
44603 + ino_t saved_ino = 0;
44604 + dev_t saved_dev = 0;
44605
44606 error = user_path_parent(dfd, pathname, &nd, &name);
44607 if (error)
44608 @@ -2759,6 +2878,16 @@ static long do_unlinkat(int dfd, const c
44609 if (!inode)
44610 goto slashes;
44611 ihold(inode);
44612 +
44613 + if (inode->i_nlink <= 1) {
44614 + saved_ino = inode->i_ino;
44615 + saved_dev = gr_get_dev_from_dentry(dentry);
44616 + }
44617 + if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
44618 + error = -EACCES;
44619 + goto exit2;
44620 + }
44621 +
44622 error = mnt_want_write(nd.path.mnt);
44623 if (error)
44624 goto exit2;
44625 @@ -2766,6 +2895,8 @@ static long do_unlinkat(int dfd, const c
44626 if (error)
44627 goto exit3;
44628 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
44629 + if (!error && (saved_ino || saved_dev))
44630 + gr_handle_delete(saved_ino, saved_dev);
44631 exit3:
44632 mnt_drop_write(nd.path.mnt);
44633 exit2:
44634 @@ -2843,6 +2974,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
44635 if (IS_ERR(dentry))
44636 goto out_unlock;
44637
44638 + if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
44639 + error = -EACCES;
44640 + goto out_dput;
44641 + }
44642 +
44643 error = mnt_want_write(nd.path.mnt);
44644 if (error)
44645 goto out_dput;
44646 @@ -2850,6 +2986,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
44647 if (error)
44648 goto out_drop_write;
44649 error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
44650 + if (!error)
44651 + gr_handle_create(dentry, nd.path.mnt);
44652 out_drop_write:
44653 mnt_drop_write(nd.path.mnt);
44654 out_dput:
44655 @@ -2958,6 +3096,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
44656 error = PTR_ERR(new_dentry);
44657 if (IS_ERR(new_dentry))
44658 goto out_unlock;
44659 +
44660 + if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
44661 + old_path.dentry->d_inode,
44662 + old_path.dentry->d_inode->i_mode, to)) {
44663 + error = -EACCES;
44664 + goto out_dput;
44665 + }
44666 +
44667 + if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
44668 + old_path.dentry, old_path.mnt, to)) {
44669 + error = -EACCES;
44670 + goto out_dput;
44671 + }
44672 +
44673 error = mnt_want_write(nd.path.mnt);
44674 if (error)
44675 goto out_dput;
44676 @@ -2965,6 +3117,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
44677 if (error)
44678 goto out_drop_write;
44679 error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
44680 + if (!error)
44681 + gr_handle_create(new_dentry, nd.path.mnt);
44682 out_drop_write:
44683 mnt_drop_write(nd.path.mnt);
44684 out_dput:
44685 @@ -3142,6 +3296,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
44686 char *to;
44687 int error;
44688
44689 + pax_track_stack();
44690 +
44691 error = user_path_parent(olddfd, oldname, &oldnd, &from);
44692 if (error)
44693 goto exit;
44694 @@ -3198,6 +3354,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
44695 if (new_dentry == trap)
44696 goto exit5;
44697
44698 + error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
44699 + old_dentry, old_dir->d_inode, oldnd.path.mnt,
44700 + to);
44701 + if (error)
44702 + goto exit5;
44703 +
44704 error = mnt_want_write(oldnd.path.mnt);
44705 if (error)
44706 goto exit5;
44707 @@ -3207,6 +3369,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
44708 goto exit6;
44709 error = vfs_rename(old_dir->d_inode, old_dentry,
44710 new_dir->d_inode, new_dentry);
44711 + if (!error)
44712 + gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
44713 + new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
44714 exit6:
44715 mnt_drop_write(oldnd.path.mnt);
44716 exit5:
44717 @@ -3232,6 +3397,8 @@ SYSCALL_DEFINE2(rename, const char __use
44718
44719 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
44720 {
44721 + char tmpbuf[64];
44722 + const char *newlink;
44723 int len;
44724
44725 len = PTR_ERR(link);
44726 @@ -3241,7 +3408,14 @@ int vfs_readlink(struct dentry *dentry,
44727 len = strlen(link);
44728 if (len > (unsigned) buflen)
44729 len = buflen;
44730 - if (copy_to_user(buffer, link, len))
44731 +
44732 + if (len < sizeof(tmpbuf)) {
44733 + memcpy(tmpbuf, link, len);
44734 + newlink = tmpbuf;
44735 + } else
44736 + newlink = link;
44737 +
44738 + if (copy_to_user(buffer, newlink, len))
44739 len = -EFAULT;
44740 out:
44741 return len;
44742 diff -urNp linux-3.0.9/fs/namespace.c linux-3.0.9/fs/namespace.c
44743 --- linux-3.0.9/fs/namespace.c 2011-11-11 13:12:24.000000000 -0500
44744 +++ linux-3.0.9/fs/namespace.c 2011-11-15 20:02:59.000000000 -0500
44745 @@ -1329,6 +1329,9 @@ static int do_umount(struct vfsmount *mn
44746 if (!(sb->s_flags & MS_RDONLY))
44747 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
44748 up_write(&sb->s_umount);
44749 +
44750 + gr_log_remount(mnt->mnt_devname, retval);
44751 +
44752 return retval;
44753 }
44754
44755 @@ -1348,6 +1351,9 @@ static int do_umount(struct vfsmount *mn
44756 br_write_unlock(vfsmount_lock);
44757 up_write(&namespace_sem);
44758 release_mounts(&umount_list);
44759 +
44760 + gr_log_unmount(mnt->mnt_devname, retval);
44761 +
44762 return retval;
44763 }
44764
44765 @@ -2339,6 +2345,16 @@ long do_mount(char *dev_name, char *dir_
44766 MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
44767 MS_STRICTATIME);
44768
44769 + if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
44770 + retval = -EPERM;
44771 + goto dput_out;
44772 + }
44773 +
44774 + if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
44775 + retval = -EPERM;
44776 + goto dput_out;
44777 + }
44778 +
44779 if (flags & MS_REMOUNT)
44780 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
44781 data_page);
44782 @@ -2353,6 +2369,9 @@ long do_mount(char *dev_name, char *dir_
44783 dev_name, data_page);
44784 dput_out:
44785 path_put(&path);
44786 +
44787 + gr_log_mount(dev_name, dir_name, retval);
44788 +
44789 return retval;
44790 }
44791
44792 @@ -2576,6 +2595,11 @@ SYSCALL_DEFINE2(pivot_root, const char _
44793 if (error)
44794 goto out2;
44795
44796 + if (gr_handle_chroot_pivot()) {
44797 + error = -EPERM;
44798 + goto out2;
44799 + }
44800 +
44801 get_fs_root(current->fs, &root);
44802 error = lock_mount(&old);
44803 if (error)
44804 diff -urNp linux-3.0.9/fs/ncpfs/dir.c linux-3.0.9/fs/ncpfs/dir.c
44805 --- linux-3.0.9/fs/ncpfs/dir.c 2011-11-11 13:12:24.000000000 -0500
44806 +++ linux-3.0.9/fs/ncpfs/dir.c 2011-11-15 20:02:59.000000000 -0500
44807 @@ -299,6 +299,8 @@ ncp_lookup_validate(struct dentry *dentr
44808 int res, val = 0, len;
44809 __u8 __name[NCP_MAXPATHLEN + 1];
44810
44811 + pax_track_stack();
44812 +
44813 if (dentry == dentry->d_sb->s_root)
44814 return 1;
44815
44816 @@ -844,6 +846,8 @@ static struct dentry *ncp_lookup(struct
44817 int error, res, len;
44818 __u8 __name[NCP_MAXPATHLEN + 1];
44819
44820 + pax_track_stack();
44821 +
44822 error = -EIO;
44823 if (!ncp_conn_valid(server))
44824 goto finished;
44825 @@ -931,6 +935,8 @@ int ncp_create_new(struct inode *dir, st
44826 PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
44827 dentry->d_parent->d_name.name, dentry->d_name.name, mode);
44828
44829 + pax_track_stack();
44830 +
44831 ncp_age_dentry(server, dentry);
44832 len = sizeof(__name);
44833 error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
44834 @@ -992,6 +998,8 @@ static int ncp_mkdir(struct inode *dir,
44835 int error, len;
44836 __u8 __name[NCP_MAXPATHLEN + 1];
44837
44838 + pax_track_stack();
44839 +
44840 DPRINTK("ncp_mkdir: making %s/%s\n",
44841 dentry->d_parent->d_name.name, dentry->d_name.name);
44842
44843 @@ -1140,6 +1148,8 @@ static int ncp_rename(struct inode *old_
44844 int old_len, new_len;
44845 __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
44846
44847 + pax_track_stack();
44848 +
44849 DPRINTK("ncp_rename: %s/%s to %s/%s\n",
44850 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
44851 new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
44852 diff -urNp linux-3.0.9/fs/ncpfs/inode.c linux-3.0.9/fs/ncpfs/inode.c
44853 --- linux-3.0.9/fs/ncpfs/inode.c 2011-11-11 13:12:24.000000000 -0500
44854 +++ linux-3.0.9/fs/ncpfs/inode.c 2011-11-15 20:02:59.000000000 -0500
44855 @@ -461,6 +461,8 @@ static int ncp_fill_super(struct super_b
44856 #endif
44857 struct ncp_entry_info finfo;
44858
44859 + pax_track_stack();
44860 +
44861 memset(&data, 0, sizeof(data));
44862 server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
44863 if (!server)
44864 diff -urNp linux-3.0.9/fs/nfs/inode.c linux-3.0.9/fs/nfs/inode.c
44865 --- linux-3.0.9/fs/nfs/inode.c 2011-11-11 13:12:24.000000000 -0500
44866 +++ linux-3.0.9/fs/nfs/inode.c 2011-11-15 20:02:59.000000000 -0500
44867 @@ -150,7 +150,7 @@ static void nfs_zap_caches_locked(struct
44868 nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
44869 nfsi->attrtimeo_timestamp = jiffies;
44870
44871 - memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
44872 + memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_I(inode)->cookieverf));
44873 if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
44874 nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
44875 else
44876 @@ -1000,16 +1000,16 @@ static int nfs_size_need_update(const st
44877 return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
44878 }
44879
44880 -static atomic_long_t nfs_attr_generation_counter;
44881 +static atomic_long_unchecked_t nfs_attr_generation_counter;
44882
44883 static unsigned long nfs_read_attr_generation_counter(void)
44884 {
44885 - return atomic_long_read(&nfs_attr_generation_counter);
44886 + return atomic_long_read_unchecked(&nfs_attr_generation_counter);
44887 }
44888
44889 unsigned long nfs_inc_attr_generation_counter(void)
44890 {
44891 - return atomic_long_inc_return(&nfs_attr_generation_counter);
44892 + return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
44893 }
44894
44895 void nfs_fattr_init(struct nfs_fattr *fattr)
44896 diff -urNp linux-3.0.9/fs/nfsd/nfs4state.c linux-3.0.9/fs/nfsd/nfs4state.c
44897 --- linux-3.0.9/fs/nfsd/nfs4state.c 2011-11-11 13:12:24.000000000 -0500
44898 +++ linux-3.0.9/fs/nfsd/nfs4state.c 2011-11-15 20:02:59.000000000 -0500
44899 @@ -3804,6 +3804,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
44900 unsigned int strhashval;
44901 int err;
44902
44903 + pax_track_stack();
44904 +
44905 dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
44906 (long long) lock->lk_offset,
44907 (long long) lock->lk_length);
44908 diff -urNp linux-3.0.9/fs/nfsd/nfs4xdr.c linux-3.0.9/fs/nfsd/nfs4xdr.c
44909 --- linux-3.0.9/fs/nfsd/nfs4xdr.c 2011-11-11 13:12:24.000000000 -0500
44910 +++ linux-3.0.9/fs/nfsd/nfs4xdr.c 2011-11-15 20:02:59.000000000 -0500
44911 @@ -1800,6 +1800,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, s
44912 .dentry = dentry,
44913 };
44914
44915 + pax_track_stack();
44916 +
44917 BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
44918 BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
44919 BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
44920 diff -urNp linux-3.0.9/fs/nfsd/vfs.c linux-3.0.9/fs/nfsd/vfs.c
44921 --- linux-3.0.9/fs/nfsd/vfs.c 2011-11-11 13:12:24.000000000 -0500
44922 +++ linux-3.0.9/fs/nfsd/vfs.c 2011-11-15 20:02:59.000000000 -0500
44923 @@ -896,7 +896,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
44924 } else {
44925 oldfs = get_fs();
44926 set_fs(KERNEL_DS);
44927 - host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
44928 + host_err = vfs_readv(file, (struct iovec __force_user *)vec, vlen, &offset);
44929 set_fs(oldfs);
44930 }
44931
44932 @@ -1000,7 +1000,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
44933
44934 /* Write the data. */
44935 oldfs = get_fs(); set_fs(KERNEL_DS);
44936 - host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
44937 + host_err = vfs_writev(file, (struct iovec __force_user *)vec, vlen, &offset);
44938 set_fs(oldfs);
44939 if (host_err < 0)
44940 goto out_nfserr;
44941 @@ -1535,7 +1535,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
44942 */
44943
44944 oldfs = get_fs(); set_fs(KERNEL_DS);
44945 - host_err = inode->i_op->readlink(dentry, buf, *lenp);
44946 + host_err = inode->i_op->readlink(dentry, (char __force_user *)buf, *lenp);
44947 set_fs(oldfs);
44948
44949 if (host_err < 0)
44950 diff -urNp linux-3.0.9/fs/notify/fanotify/fanotify_user.c linux-3.0.9/fs/notify/fanotify/fanotify_user.c
44951 --- linux-3.0.9/fs/notify/fanotify/fanotify_user.c 2011-11-11 13:12:24.000000000 -0500
44952 +++ linux-3.0.9/fs/notify/fanotify/fanotify_user.c 2011-11-15 20:02:59.000000000 -0500
44953 @@ -276,7 +276,8 @@ static ssize_t copy_event_to_user(struct
44954 goto out_close_fd;
44955
44956 ret = -EFAULT;
44957 - if (copy_to_user(buf, &fanotify_event_metadata,
44958 + if (fanotify_event_metadata.event_len > sizeof fanotify_event_metadata ||
44959 + copy_to_user(buf, &fanotify_event_metadata,
44960 fanotify_event_metadata.event_len))
44961 goto out_kill_access_response;
44962
44963 diff -urNp linux-3.0.9/fs/notify/notification.c linux-3.0.9/fs/notify/notification.c
44964 --- linux-3.0.9/fs/notify/notification.c 2011-11-11 13:12:24.000000000 -0500
44965 +++ linux-3.0.9/fs/notify/notification.c 2011-11-15 20:02:59.000000000 -0500
44966 @@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event
44967 * get set to 0 so it will never get 'freed'
44968 */
44969 static struct fsnotify_event *q_overflow_event;
44970 -static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
44971 +static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
44972
44973 /**
44974 * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
44975 @@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = A
44976 */
44977 u32 fsnotify_get_cookie(void)
44978 {
44979 - return atomic_inc_return(&fsnotify_sync_cookie);
44980 + return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
44981 }
44982 EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
44983
44984 diff -urNp linux-3.0.9/fs/ntfs/dir.c linux-3.0.9/fs/ntfs/dir.c
44985 --- linux-3.0.9/fs/ntfs/dir.c 2011-11-11 13:12:24.000000000 -0500
44986 +++ linux-3.0.9/fs/ntfs/dir.c 2011-11-15 20:02:59.000000000 -0500
44987 @@ -1329,7 +1329,7 @@ find_next_index_buffer:
44988 ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
44989 ~(s64)(ndir->itype.index.block_size - 1)));
44990 /* Bounds checks. */
44991 - if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
44992 + if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
44993 ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
44994 "inode 0x%lx or driver bug.", vdir->i_ino);
44995 goto err_out;
44996 diff -urNp linux-3.0.9/fs/ntfs/file.c linux-3.0.9/fs/ntfs/file.c
44997 --- linux-3.0.9/fs/ntfs/file.c 2011-11-11 13:12:24.000000000 -0500
44998 +++ linux-3.0.9/fs/ntfs/file.c 2011-11-15 20:02:59.000000000 -0500
44999 @@ -2222,6 +2222,6 @@ const struct inode_operations ntfs_file_
45000 #endif /* NTFS_RW */
45001 };
45002
45003 -const struct file_operations ntfs_empty_file_ops = {};
45004 +const struct file_operations ntfs_empty_file_ops __read_only;
45005
45006 -const struct inode_operations ntfs_empty_inode_ops = {};
45007 +const struct inode_operations ntfs_empty_inode_ops __read_only;
45008 diff -urNp linux-3.0.9/fs/ocfs2/localalloc.c linux-3.0.9/fs/ocfs2/localalloc.c
45009 --- linux-3.0.9/fs/ocfs2/localalloc.c 2011-11-11 13:12:24.000000000 -0500
45010 +++ linux-3.0.9/fs/ocfs2/localalloc.c 2011-11-15 20:02:59.000000000 -0500
45011 @@ -1283,7 +1283,7 @@ static int ocfs2_local_alloc_slide_windo
45012 goto bail;
45013 }
45014
45015 - atomic_inc(&osb->alloc_stats.moves);
45016 + atomic_inc_unchecked(&osb->alloc_stats.moves);
45017
45018 bail:
45019 if (handle)
45020 diff -urNp linux-3.0.9/fs/ocfs2/namei.c linux-3.0.9/fs/ocfs2/namei.c
45021 --- linux-3.0.9/fs/ocfs2/namei.c 2011-11-11 13:12:24.000000000 -0500
45022 +++ linux-3.0.9/fs/ocfs2/namei.c 2011-11-15 20:02:59.000000000 -0500
45023 @@ -1063,6 +1063,8 @@ static int ocfs2_rename(struct inode *ol
45024 struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
45025 struct ocfs2_dir_lookup_result target_insert = { NULL, };
45026
45027 + pax_track_stack();
45028 +
45029 /* At some point it might be nice to break this function up a
45030 * bit. */
45031
45032 diff -urNp linux-3.0.9/fs/ocfs2/ocfs2.h linux-3.0.9/fs/ocfs2/ocfs2.h
45033 --- linux-3.0.9/fs/ocfs2/ocfs2.h 2011-11-11 13:12:24.000000000 -0500
45034 +++ linux-3.0.9/fs/ocfs2/ocfs2.h 2011-11-15 20:02:59.000000000 -0500
45035 @@ -235,11 +235,11 @@ enum ocfs2_vol_state
45036
45037 struct ocfs2_alloc_stats
45038 {
45039 - atomic_t moves;
45040 - atomic_t local_data;
45041 - atomic_t bitmap_data;
45042 - atomic_t bg_allocs;
45043 - atomic_t bg_extends;
45044 + atomic_unchecked_t moves;
45045 + atomic_unchecked_t local_data;
45046 + atomic_unchecked_t bitmap_data;
45047 + atomic_unchecked_t bg_allocs;
45048 + atomic_unchecked_t bg_extends;
45049 };
45050
45051 enum ocfs2_local_alloc_state
45052 diff -urNp linux-3.0.9/fs/ocfs2/suballoc.c linux-3.0.9/fs/ocfs2/suballoc.c
45053 --- linux-3.0.9/fs/ocfs2/suballoc.c 2011-11-11 13:12:24.000000000 -0500
45054 +++ linux-3.0.9/fs/ocfs2/suballoc.c 2011-11-15 20:02:59.000000000 -0500
45055 @@ -872,7 +872,7 @@ static int ocfs2_reserve_suballoc_bits(s
45056 mlog_errno(status);
45057 goto bail;
45058 }
45059 - atomic_inc(&osb->alloc_stats.bg_extends);
45060 + atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
45061
45062 /* You should never ask for this much metadata */
45063 BUG_ON(bits_wanted >
45064 @@ -2008,7 +2008,7 @@ int ocfs2_claim_metadata(handle_t *handl
45065 mlog_errno(status);
45066 goto bail;
45067 }
45068 - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
45069 + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
45070
45071 *suballoc_loc = res.sr_bg_blkno;
45072 *suballoc_bit_start = res.sr_bit_offset;
45073 @@ -2172,7 +2172,7 @@ int ocfs2_claim_new_inode_at_loc(handle_
45074 trace_ocfs2_claim_new_inode_at_loc((unsigned long long)di_blkno,
45075 res->sr_bits);
45076
45077 - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
45078 + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
45079
45080 BUG_ON(res->sr_bits != 1);
45081
45082 @@ -2214,7 +2214,7 @@ int ocfs2_claim_new_inode(handle_t *hand
45083 mlog_errno(status);
45084 goto bail;
45085 }
45086 - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
45087 + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
45088
45089 BUG_ON(res.sr_bits != 1);
45090
45091 @@ -2318,7 +2318,7 @@ int __ocfs2_claim_clusters(handle_t *han
45092 cluster_start,
45093 num_clusters);
45094 if (!status)
45095 - atomic_inc(&osb->alloc_stats.local_data);
45096 + atomic_inc_unchecked(&osb->alloc_stats.local_data);
45097 } else {
45098 if (min_clusters > (osb->bitmap_cpg - 1)) {
45099 /* The only paths asking for contiguousness
45100 @@ -2344,7 +2344,7 @@ int __ocfs2_claim_clusters(handle_t *han
45101 ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
45102 res.sr_bg_blkno,
45103 res.sr_bit_offset);
45104 - atomic_inc(&osb->alloc_stats.bitmap_data);
45105 + atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
45106 *num_clusters = res.sr_bits;
45107 }
45108 }
45109 diff -urNp linux-3.0.9/fs/ocfs2/super.c linux-3.0.9/fs/ocfs2/super.c
45110 --- linux-3.0.9/fs/ocfs2/super.c 2011-11-11 13:12:24.000000000 -0500
45111 +++ linux-3.0.9/fs/ocfs2/super.c 2011-11-15 20:02:59.000000000 -0500
45112 @@ -300,11 +300,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
45113 "%10s => GlobalAllocs: %d LocalAllocs: %d "
45114 "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
45115 "Stats",
45116 - atomic_read(&osb->alloc_stats.bitmap_data),
45117 - atomic_read(&osb->alloc_stats.local_data),
45118 - atomic_read(&osb->alloc_stats.bg_allocs),
45119 - atomic_read(&osb->alloc_stats.moves),
45120 - atomic_read(&osb->alloc_stats.bg_extends));
45121 + atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
45122 + atomic_read_unchecked(&osb->alloc_stats.local_data),
45123 + atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
45124 + atomic_read_unchecked(&osb->alloc_stats.moves),
45125 + atomic_read_unchecked(&osb->alloc_stats.bg_extends));
45126
45127 out += snprintf(buf + out, len - out,
45128 "%10s => State: %u Descriptor: %llu Size: %u bits "
45129 @@ -2112,11 +2112,11 @@ static int ocfs2_initialize_super(struct
45130 spin_lock_init(&osb->osb_xattr_lock);
45131 ocfs2_init_steal_slots(osb);
45132
45133 - atomic_set(&osb->alloc_stats.moves, 0);
45134 - atomic_set(&osb->alloc_stats.local_data, 0);
45135 - atomic_set(&osb->alloc_stats.bitmap_data, 0);
45136 - atomic_set(&osb->alloc_stats.bg_allocs, 0);
45137 - atomic_set(&osb->alloc_stats.bg_extends, 0);
45138 + atomic_set_unchecked(&osb->alloc_stats.moves, 0);
45139 + atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
45140 + atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
45141 + atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
45142 + atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
45143
45144 /* Copy the blockcheck stats from the superblock probe */
45145 osb->osb_ecc_stats = *stats;
45146 diff -urNp linux-3.0.9/fs/ocfs2/symlink.c linux-3.0.9/fs/ocfs2/symlink.c
45147 --- linux-3.0.9/fs/ocfs2/symlink.c 2011-11-11 13:12:24.000000000 -0500
45148 +++ linux-3.0.9/fs/ocfs2/symlink.c 2011-11-15 20:02:59.000000000 -0500
45149 @@ -142,7 +142,7 @@ bail:
45150
45151 static void ocfs2_fast_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
45152 {
45153 - char *link = nd_get_link(nd);
45154 + const char *link = nd_get_link(nd);
45155 if (!IS_ERR(link))
45156 kfree(link);
45157 }
45158 diff -urNp linux-3.0.9/fs/open.c linux-3.0.9/fs/open.c
45159 --- linux-3.0.9/fs/open.c 2011-11-11 13:12:24.000000000 -0500
45160 +++ linux-3.0.9/fs/open.c 2011-11-15 20:02:59.000000000 -0500
45161 @@ -112,6 +112,10 @@ static long do_sys_truncate(const char _
45162 error = locks_verify_truncate(inode, NULL, length);
45163 if (!error)
45164 error = security_path_truncate(&path);
45165 +
45166 + if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
45167 + error = -EACCES;
45168 +
45169 if (!error)
45170 error = do_truncate(path.dentry, length, 0, NULL);
45171
45172 @@ -358,6 +362,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
45173 if (__mnt_is_readonly(path.mnt))
45174 res = -EROFS;
45175
45176 + if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
45177 + res = -EACCES;
45178 +
45179 out_path_release:
45180 path_put(&path);
45181 out:
45182 @@ -384,6 +391,8 @@ SYSCALL_DEFINE1(chdir, const char __user
45183 if (error)
45184 goto dput_and_out;
45185
45186 + gr_log_chdir(path.dentry, path.mnt);
45187 +
45188 set_fs_pwd(current->fs, &path);
45189
45190 dput_and_out:
45191 @@ -410,6 +419,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
45192 goto out_putf;
45193
45194 error = inode_permission(inode, MAY_EXEC | MAY_CHDIR);
45195 +
45196 + if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
45197 + error = -EPERM;
45198 +
45199 + if (!error)
45200 + gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
45201 +
45202 if (!error)
45203 set_fs_pwd(current->fs, &file->f_path);
45204 out_putf:
45205 @@ -438,7 +454,13 @@ SYSCALL_DEFINE1(chroot, const char __use
45206 if (error)
45207 goto dput_and_out;
45208
45209 + if (gr_handle_chroot_chroot(path.dentry, path.mnt))
45210 + goto dput_and_out;
45211 +
45212 set_fs_root(current->fs, &path);
45213 +
45214 + gr_handle_chroot_chdir(&path);
45215 +
45216 error = 0;
45217 dput_and_out:
45218 path_put(&path);
45219 @@ -466,12 +488,25 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
45220 err = mnt_want_write_file(file);
45221 if (err)
45222 goto out_putf;
45223 +
45224 mutex_lock(&inode->i_mutex);
45225 +
45226 + if (!gr_acl_handle_fchmod(dentry, file->f_vfsmnt, mode)) {
45227 + err = -EACCES;
45228 + goto out_unlock;
45229 + }
45230 +
45231 err = security_path_chmod(dentry, file->f_vfsmnt, mode);
45232 if (err)
45233 goto out_unlock;
45234 if (mode == (mode_t) -1)
45235 mode = inode->i_mode;
45236 +
45237 + if (gr_handle_chroot_chmod(dentry, file->f_vfsmnt, mode)) {
45238 + err = -EACCES;
45239 + goto out_unlock;
45240 + }
45241 +
45242 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
45243 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
45244 err = notify_change(dentry, &newattrs);
45245 @@ -499,12 +534,25 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
45246 error = mnt_want_write(path.mnt);
45247 if (error)
45248 goto dput_and_out;
45249 +
45250 mutex_lock(&inode->i_mutex);
45251 +
45252 + if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
45253 + error = -EACCES;
45254 + goto out_unlock;
45255 + }
45256 +
45257 error = security_path_chmod(path.dentry, path.mnt, mode);
45258 if (error)
45259 goto out_unlock;
45260 if (mode == (mode_t) -1)
45261 mode = inode->i_mode;
45262 +
45263 + if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
45264 + error = -EACCES;
45265 + goto out_unlock;
45266 + }
45267 +
45268 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
45269 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
45270 error = notify_change(path.dentry, &newattrs);
45271 @@ -528,6 +576,9 @@ static int chown_common(struct path *pat
45272 int error;
45273 struct iattr newattrs;
45274
45275 + if (!gr_acl_handle_chown(path->dentry, path->mnt))
45276 + return -EACCES;
45277 +
45278 newattrs.ia_valid = ATTR_CTIME;
45279 if (user != (uid_t) -1) {
45280 newattrs.ia_valid |= ATTR_UID;
45281 @@ -998,7 +1049,10 @@ long do_sys_open(int dfd, const char __u
45282 if (!IS_ERR(tmp)) {
45283 fd = get_unused_fd_flags(flags);
45284 if (fd >= 0) {
45285 - struct file *f = do_filp_open(dfd, tmp, &op, lookup);
45286 + struct file *f;
45287 + /* don't allow to be set by userland */
45288 + flags &= ~FMODE_GREXEC;
45289 + f = do_filp_open(dfd, tmp, &op, lookup);
45290 if (IS_ERR(f)) {
45291 put_unused_fd(fd);
45292 fd = PTR_ERR(f);
45293 diff -urNp linux-3.0.9/fs/partitions/ldm.c linux-3.0.9/fs/partitions/ldm.c
45294 --- linux-3.0.9/fs/partitions/ldm.c 2011-11-11 13:12:24.000000000 -0500
45295 +++ linux-3.0.9/fs/partitions/ldm.c 2011-11-15 20:02:59.000000000 -0500
45296 @@ -1311,6 +1311,7 @@ static bool ldm_frag_add (const u8 *data
45297 ldm_error ("A VBLK claims to have %d parts.", num);
45298 return false;
45299 }
45300 +
45301 if (rec >= num) {
45302 ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
45303 return false;
45304 @@ -1322,7 +1323,7 @@ static bool ldm_frag_add (const u8 *data
45305 goto found;
45306 }
45307
45308 - f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
45309 + f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
45310 if (!f) {
45311 ldm_crit ("Out of memory.");
45312 return false;
45313 diff -urNp linux-3.0.9/fs/pipe.c linux-3.0.9/fs/pipe.c
45314 --- linux-3.0.9/fs/pipe.c 2011-11-11 13:12:24.000000000 -0500
45315 +++ linux-3.0.9/fs/pipe.c 2011-11-15 20:02:59.000000000 -0500
45316 @@ -420,9 +420,9 @@ redo:
45317 }
45318 if (bufs) /* More to do? */
45319 continue;
45320 - if (!pipe->writers)
45321 + if (!atomic_read(&pipe->writers))
45322 break;
45323 - if (!pipe->waiting_writers) {
45324 + if (!atomic_read(&pipe->waiting_writers)) {
45325 /* syscall merging: Usually we must not sleep
45326 * if O_NONBLOCK is set, or if we got some data.
45327 * But if a writer sleeps in kernel space, then
45328 @@ -481,7 +481,7 @@ pipe_write(struct kiocb *iocb, const str
45329 mutex_lock(&inode->i_mutex);
45330 pipe = inode->i_pipe;
45331
45332 - if (!pipe->readers) {
45333 + if (!atomic_read(&pipe->readers)) {
45334 send_sig(SIGPIPE, current, 0);
45335 ret = -EPIPE;
45336 goto out;
45337 @@ -530,7 +530,7 @@ redo1:
45338 for (;;) {
45339 int bufs;
45340
45341 - if (!pipe->readers) {
45342 + if (!atomic_read(&pipe->readers)) {
45343 send_sig(SIGPIPE, current, 0);
45344 if (!ret)
45345 ret = -EPIPE;
45346 @@ -616,9 +616,9 @@ redo2:
45347 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
45348 do_wakeup = 0;
45349 }
45350 - pipe->waiting_writers++;
45351 + atomic_inc(&pipe->waiting_writers);
45352 pipe_wait(pipe);
45353 - pipe->waiting_writers--;
45354 + atomic_dec(&pipe->waiting_writers);
45355 }
45356 out:
45357 mutex_unlock(&inode->i_mutex);
45358 @@ -685,7 +685,7 @@ pipe_poll(struct file *filp, poll_table
45359 mask = 0;
45360 if (filp->f_mode & FMODE_READ) {
45361 mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
45362 - if (!pipe->writers && filp->f_version != pipe->w_counter)
45363 + if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
45364 mask |= POLLHUP;
45365 }
45366
45367 @@ -695,7 +695,7 @@ pipe_poll(struct file *filp, poll_table
45368 * Most Unices do not set POLLERR for FIFOs but on Linux they
45369 * behave exactly like pipes for poll().
45370 */
45371 - if (!pipe->readers)
45372 + if (!atomic_read(&pipe->readers))
45373 mask |= POLLERR;
45374 }
45375
45376 @@ -709,10 +709,10 @@ pipe_release(struct inode *inode, int de
45377
45378 mutex_lock(&inode->i_mutex);
45379 pipe = inode->i_pipe;
45380 - pipe->readers -= decr;
45381 - pipe->writers -= decw;
45382 + atomic_sub(decr, &pipe->readers);
45383 + atomic_sub(decw, &pipe->writers);
45384
45385 - if (!pipe->readers && !pipe->writers) {
45386 + if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
45387 free_pipe_info(inode);
45388 } else {
45389 wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
45390 @@ -802,7 +802,7 @@ pipe_read_open(struct inode *inode, stru
45391
45392 if (inode->i_pipe) {
45393 ret = 0;
45394 - inode->i_pipe->readers++;
45395 + atomic_inc(&inode->i_pipe->readers);
45396 }
45397
45398 mutex_unlock(&inode->i_mutex);
45399 @@ -819,7 +819,7 @@ pipe_write_open(struct inode *inode, str
45400
45401 if (inode->i_pipe) {
45402 ret = 0;
45403 - inode->i_pipe->writers++;
45404 + atomic_inc(&inode->i_pipe->writers);
45405 }
45406
45407 mutex_unlock(&inode->i_mutex);
45408 @@ -837,9 +837,9 @@ pipe_rdwr_open(struct inode *inode, stru
45409 if (inode->i_pipe) {
45410 ret = 0;
45411 if (filp->f_mode & FMODE_READ)
45412 - inode->i_pipe->readers++;
45413 + atomic_inc(&inode->i_pipe->readers);
45414 if (filp->f_mode & FMODE_WRITE)
45415 - inode->i_pipe->writers++;
45416 + atomic_inc(&inode->i_pipe->writers);
45417 }
45418
45419 mutex_unlock(&inode->i_mutex);
45420 @@ -931,7 +931,7 @@ void free_pipe_info(struct inode *inode)
45421 inode->i_pipe = NULL;
45422 }
45423
45424 -static struct vfsmount *pipe_mnt __read_mostly;
45425 +struct vfsmount *pipe_mnt __read_mostly;
45426
45427 /*
45428 * pipefs_dname() is called from d_path().
45429 @@ -961,7 +961,8 @@ static struct inode * get_pipe_inode(voi
45430 goto fail_iput;
45431 inode->i_pipe = pipe;
45432
45433 - pipe->readers = pipe->writers = 1;
45434 + atomic_set(&pipe->readers, 1);
45435 + atomic_set(&pipe->writers, 1);
45436 inode->i_fop = &rdwr_pipefifo_fops;
45437
45438 /*
45439 diff -urNp linux-3.0.9/fs/proc/array.c linux-3.0.9/fs/proc/array.c
45440 --- linux-3.0.9/fs/proc/array.c 2011-11-11 13:12:24.000000000 -0500
45441 +++ linux-3.0.9/fs/proc/array.c 2011-11-15 20:02:59.000000000 -0500
45442 @@ -60,6 +60,7 @@
45443 #include <linux/tty.h>
45444 #include <linux/string.h>
45445 #include <linux/mman.h>
45446 +#include <linux/grsecurity.h>
45447 #include <linux/proc_fs.h>
45448 #include <linux/ioport.h>
45449 #include <linux/uaccess.h>
45450 @@ -337,6 +338,21 @@ static void task_cpus_allowed(struct seq
45451 seq_putc(m, '\n');
45452 }
45453
45454 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
45455 +static inline void task_pax(struct seq_file *m, struct task_struct *p)
45456 +{
45457 + if (p->mm)
45458 + seq_printf(m, "PaX:\t%c%c%c%c%c\n",
45459 + p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
45460 + p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
45461 + p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
45462 + p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
45463 + p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
45464 + else
45465 + seq_printf(m, "PaX:\t-----\n");
45466 +}
45467 +#endif
45468 +
45469 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
45470 struct pid *pid, struct task_struct *task)
45471 {
45472 @@ -354,9 +370,24 @@ int proc_pid_status(struct seq_file *m,
45473 task_cpus_allowed(m, task);
45474 cpuset_task_status_allowed(m, task);
45475 task_context_switch_counts(m, task);
45476 +
45477 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
45478 + task_pax(m, task);
45479 +#endif
45480 +
45481 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
45482 + task_grsec_rbac(m, task);
45483 +#endif
45484 +
45485 return 0;
45486 }
45487
45488 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
45489 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
45490 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
45491 + _mm->pax_flags & MF_PAX_SEGMEXEC))
45492 +#endif
45493 +
45494 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
45495 struct pid *pid, struct task_struct *task, int whole)
45496 {
45497 @@ -375,9 +406,11 @@ static int do_task_stat(struct seq_file
45498 cputime_t cutime, cstime, utime, stime;
45499 cputime_t cgtime, gtime;
45500 unsigned long rsslim = 0;
45501 - char tcomm[sizeof(task->comm)];
45502 + char tcomm[sizeof(task->comm)] = { 0 };
45503 unsigned long flags;
45504
45505 + pax_track_stack();
45506 +
45507 state = *get_task_state(task);
45508 vsize = eip = esp = 0;
45509 permitted = ptrace_may_access(task, PTRACE_MODE_READ);
45510 @@ -449,6 +482,19 @@ static int do_task_stat(struct seq_file
45511 gtime = task->gtime;
45512 }
45513
45514 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
45515 + if (PAX_RAND_FLAGS(mm)) {
45516 + eip = 0;
45517 + esp = 0;
45518 + wchan = 0;
45519 + }
45520 +#endif
45521 +#ifdef CONFIG_GRKERNSEC_HIDESYM
45522 + wchan = 0;
45523 + eip =0;
45524 + esp =0;
45525 +#endif
45526 +
45527 /* scale priority and nice values from timeslices to -20..20 */
45528 /* to make it look like a "normal" Unix priority/nice value */
45529 priority = task_prio(task);
45530 @@ -489,9 +535,15 @@ static int do_task_stat(struct seq_file
45531 vsize,
45532 mm ? get_mm_rss(mm) : 0,
45533 rsslim,
45534 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
45535 + PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
45536 + PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
45537 + PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
45538 +#else
45539 mm ? (permitted ? mm->start_code : 1) : 0,
45540 mm ? (permitted ? mm->end_code : 1) : 0,
45541 (permitted && mm) ? mm->start_stack : 0,
45542 +#endif
45543 esp,
45544 eip,
45545 /* The signal information here is obsolete.
45546 @@ -544,3 +596,18 @@ int proc_pid_statm(struct seq_file *m, s
45547
45548 return 0;
45549 }
45550 +
45551 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
45552 +int proc_pid_ipaddr(struct task_struct *task, char *buffer)
45553 +{
45554 + u32 curr_ip = 0;
45555 + unsigned long flags;
45556 +
45557 + if (lock_task_sighand(task, &flags)) {
45558 + curr_ip = task->signal->curr_ip;
45559 + unlock_task_sighand(task, &flags);
45560 + }
45561 +
45562 + return sprintf(buffer, "%pI4\n", &curr_ip);
45563 +}
45564 +#endif
45565 diff -urNp linux-3.0.9/fs/proc/base.c linux-3.0.9/fs/proc/base.c
45566 --- linux-3.0.9/fs/proc/base.c 2011-11-11 13:12:24.000000000 -0500
45567 +++ linux-3.0.9/fs/proc/base.c 2011-11-15 20:02:59.000000000 -0500
45568 @@ -107,6 +107,22 @@ struct pid_entry {
45569 union proc_op op;
45570 };
45571
45572 +struct getdents_callback {
45573 + struct linux_dirent __user * current_dir;
45574 + struct linux_dirent __user * previous;
45575 + struct file * file;
45576 + int count;
45577 + int error;
45578 +};
45579 +
45580 +static int gr_fake_filldir(void * __buf, const char *name, int namlen,
45581 + loff_t offset, u64 ino, unsigned int d_type)
45582 +{
45583 + struct getdents_callback * buf = (struct getdents_callback *) __buf;
45584 + buf->error = -EINVAL;
45585 + return 0;
45586 +}
45587 +
45588 #define NOD(NAME, MODE, IOP, FOP, OP) { \
45589 .name = (NAME), \
45590 .len = sizeof(NAME) - 1, \
45591 @@ -209,6 +225,9 @@ static struct mm_struct *__check_mem_per
45592 if (task == current)
45593 return mm;
45594
45595 + if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
45596 + return ERR_PTR(-EPERM);
45597 +
45598 /*
45599 * If current is actively ptrace'ing, and would also be
45600 * permitted to freshly attach with ptrace now, permit it.
45601 @@ -282,6 +301,9 @@ static int proc_pid_cmdline(struct task_
45602 if (!mm->arg_end)
45603 goto out_mm; /* Shh! No looking before we're done */
45604
45605 + if (gr_acl_handle_procpidmem(task))
45606 + goto out_mm;
45607 +
45608 len = mm->arg_end - mm->arg_start;
45609
45610 if (len > PAGE_SIZE)
45611 @@ -309,12 +331,28 @@ out:
45612 return res;
45613 }
45614
45615 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
45616 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
45617 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
45618 + _mm->pax_flags & MF_PAX_SEGMEXEC))
45619 +#endif
45620 +
45621 static int proc_pid_auxv(struct task_struct *task, char *buffer)
45622 {
45623 struct mm_struct *mm = mm_for_maps(task);
45624 int res = PTR_ERR(mm);
45625 if (mm && !IS_ERR(mm)) {
45626 unsigned int nwords = 0;
45627 +
45628 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
45629 + /* allow if we're currently ptracing this task */
45630 + if (PAX_RAND_FLAGS(mm) &&
45631 + (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
45632 + mmput(mm);
45633 + return 0;
45634 + }
45635 +#endif
45636 +
45637 do {
45638 nwords += 2;
45639 } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
45640 @@ -328,7 +366,7 @@ static int proc_pid_auxv(struct task_str
45641 }
45642
45643
45644 -#ifdef CONFIG_KALLSYMS
45645 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
45646 /*
45647 * Provides a wchan file via kallsyms in a proper one-value-per-file format.
45648 * Returns the resolved symbol. If that fails, simply return the address.
45649 @@ -367,7 +405,7 @@ static void unlock_trace(struct task_str
45650 mutex_unlock(&task->signal->cred_guard_mutex);
45651 }
45652
45653 -#ifdef CONFIG_STACKTRACE
45654 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
45655
45656 #define MAX_STACK_TRACE_DEPTH 64
45657
45658 @@ -558,7 +596,7 @@ static int proc_pid_limits(struct task_s
45659 return count;
45660 }
45661
45662 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
45663 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
45664 static int proc_pid_syscall(struct task_struct *task, char *buffer)
45665 {
45666 long nr;
45667 @@ -587,7 +625,7 @@ static int proc_pid_syscall(struct task_
45668 /************************************************************************/
45669
45670 /* permission checks */
45671 -static int proc_fd_access_allowed(struct inode *inode)
45672 +static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
45673 {
45674 struct task_struct *task;
45675 int allowed = 0;
45676 @@ -597,7 +635,10 @@ static int proc_fd_access_allowed(struct
45677 */
45678 task = get_proc_task(inode);
45679 if (task) {
45680 - allowed = ptrace_may_access(task, PTRACE_MODE_READ);
45681 + if (log)
45682 + allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
45683 + else
45684 + allowed = ptrace_may_access(task, PTRACE_MODE_READ);
45685 put_task_struct(task);
45686 }
45687 return allowed;
45688 @@ -978,6 +1019,9 @@ static ssize_t environ_read(struct file
45689 if (!task)
45690 goto out_no_task;
45691
45692 + if (gr_acl_handle_procpidmem(task))
45693 + goto out;
45694 +
45695 ret = -ENOMEM;
45696 page = (char *)__get_free_page(GFP_TEMPORARY);
45697 if (!page)
45698 @@ -1614,7 +1658,7 @@ static void *proc_pid_follow_link(struct
45699 path_put(&nd->path);
45700
45701 /* Are we allowed to snoop on the tasks file descriptors? */
45702 - if (!proc_fd_access_allowed(inode))
45703 + if (!proc_fd_access_allowed(inode,0))
45704 goto out;
45705
45706 error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
45707 @@ -1653,8 +1697,18 @@ static int proc_pid_readlink(struct dent
45708 struct path path;
45709
45710 /* Are we allowed to snoop on the tasks file descriptors? */
45711 - if (!proc_fd_access_allowed(inode))
45712 - goto out;
45713 + /* logging this is needed for learning on chromium to work properly,
45714 + but we don't want to flood the logs from 'ps' which does a readlink
45715 + on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
45716 + CAP_SYS_PTRACE as it's not necessary for its basic functionality
45717 + */
45718 + if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
45719 + if (!proc_fd_access_allowed(inode,0))
45720 + goto out;
45721 + } else {
45722 + if (!proc_fd_access_allowed(inode,1))
45723 + goto out;
45724 + }
45725
45726 error = PROC_I(inode)->op.proc_get_link(inode, &path);
45727 if (error)
45728 @@ -1719,7 +1773,11 @@ struct inode *proc_pid_make_inode(struct
45729 rcu_read_lock();
45730 cred = __task_cred(task);
45731 inode->i_uid = cred->euid;
45732 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
45733 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
45734 +#else
45735 inode->i_gid = cred->egid;
45736 +#endif
45737 rcu_read_unlock();
45738 }
45739 security_task_to_inode(task, inode);
45740 @@ -1737,6 +1795,9 @@ int pid_getattr(struct vfsmount *mnt, st
45741 struct inode *inode = dentry->d_inode;
45742 struct task_struct *task;
45743 const struct cred *cred;
45744 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45745 + const struct cred *tmpcred = current_cred();
45746 +#endif
45747
45748 generic_fillattr(inode, stat);
45749
45750 @@ -1744,13 +1805,41 @@ int pid_getattr(struct vfsmount *mnt, st
45751 stat->uid = 0;
45752 stat->gid = 0;
45753 task = pid_task(proc_pid(inode), PIDTYPE_PID);
45754 +
45755 + if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
45756 + rcu_read_unlock();
45757 + return -ENOENT;
45758 + }
45759 +
45760 if (task) {
45761 + cred = __task_cred(task);
45762 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45763 + if (!tmpcred->uid || (tmpcred->uid == cred->uid)
45764 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
45765 + || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
45766 +#endif
45767 + ) {
45768 +#endif
45769 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
45770 +#ifdef CONFIG_GRKERNSEC_PROC_USER
45771 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
45772 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45773 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
45774 +#endif
45775 task_dumpable(task)) {
45776 - cred = __task_cred(task);
45777 stat->uid = cred->euid;
45778 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
45779 + stat->gid = CONFIG_GRKERNSEC_PROC_GID;
45780 +#else
45781 stat->gid = cred->egid;
45782 +#endif
45783 + }
45784 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45785 + } else {
45786 + rcu_read_unlock();
45787 + return -ENOENT;
45788 }
45789 +#endif
45790 }
45791 rcu_read_unlock();
45792 return 0;
45793 @@ -1787,11 +1876,20 @@ int pid_revalidate(struct dentry *dentry
45794
45795 if (task) {
45796 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
45797 +#ifdef CONFIG_GRKERNSEC_PROC_USER
45798 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
45799 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45800 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
45801 +#endif
45802 task_dumpable(task)) {
45803 rcu_read_lock();
45804 cred = __task_cred(task);
45805 inode->i_uid = cred->euid;
45806 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
45807 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
45808 +#else
45809 inode->i_gid = cred->egid;
45810 +#endif
45811 rcu_read_unlock();
45812 } else {
45813 inode->i_uid = 0;
45814 @@ -1909,7 +2007,8 @@ static int proc_fd_info(struct inode *in
45815 int fd = proc_fd(inode);
45816
45817 if (task) {
45818 - files = get_files_struct(task);
45819 + if (!gr_acl_handle_procpidmem(task))
45820 + files = get_files_struct(task);
45821 put_task_struct(task);
45822 }
45823 if (files) {
45824 @@ -2177,11 +2276,21 @@ static const struct file_operations proc
45825 */
45826 static int proc_fd_permission(struct inode *inode, int mask, unsigned int flags)
45827 {
45828 + struct task_struct *task;
45829 int rv = generic_permission(inode, mask, flags, NULL);
45830 - if (rv == 0)
45831 - return 0;
45832 +
45833 if (task_pid(current) == proc_pid(inode))
45834 rv = 0;
45835 +
45836 + task = get_proc_task(inode);
45837 + if (task == NULL)
45838 + return rv;
45839 +
45840 + if (gr_acl_handle_procpidmem(task))
45841 + rv = -EACCES;
45842 +
45843 + put_task_struct(task);
45844 +
45845 return rv;
45846 }
45847
45848 @@ -2291,6 +2400,9 @@ static struct dentry *proc_pident_lookup
45849 if (!task)
45850 goto out_no_task;
45851
45852 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
45853 + goto out;
45854 +
45855 /*
45856 * Yes, it does not scale. And it should not. Don't add
45857 * new entries into /proc/<tgid>/ without very good reasons.
45858 @@ -2335,6 +2447,9 @@ static int proc_pident_readdir(struct fi
45859 if (!task)
45860 goto out_no_task;
45861
45862 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
45863 + goto out;
45864 +
45865 ret = 0;
45866 i = filp->f_pos;
45867 switch (i) {
45868 @@ -2605,7 +2720,7 @@ static void *proc_self_follow_link(struc
45869 static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
45870 void *cookie)
45871 {
45872 - char *s = nd_get_link(nd);
45873 + const char *s = nd_get_link(nd);
45874 if (!IS_ERR(s))
45875 __putname(s);
45876 }
45877 @@ -2664,6 +2779,7 @@ static struct dentry *proc_base_instanti
45878 if (p->fop)
45879 inode->i_fop = p->fop;
45880 ei->op = p->op;
45881 +
45882 d_add(dentry, inode);
45883 error = NULL;
45884 out:
45885 @@ -2803,7 +2919,7 @@ static const struct pid_entry tgid_base_
45886 REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
45887 #endif
45888 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
45889 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
45890 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
45891 INF("syscall", S_IRUGO, proc_pid_syscall),
45892 #endif
45893 INF("cmdline", S_IRUGO, proc_pid_cmdline),
45894 @@ -2828,10 +2944,10 @@ static const struct pid_entry tgid_base_
45895 #ifdef CONFIG_SECURITY
45896 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
45897 #endif
45898 -#ifdef CONFIG_KALLSYMS
45899 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
45900 INF("wchan", S_IRUGO, proc_pid_wchan),
45901 #endif
45902 -#ifdef CONFIG_STACKTRACE
45903 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
45904 ONE("stack", S_IRUGO, proc_pid_stack),
45905 #endif
45906 #ifdef CONFIG_SCHEDSTATS
45907 @@ -2865,6 +2981,9 @@ static const struct pid_entry tgid_base_
45908 #ifdef CONFIG_HARDWALL
45909 INF("hardwall", S_IRUGO, proc_pid_hardwall),
45910 #endif
45911 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
45912 + INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
45913 +#endif
45914 };
45915
45916 static int proc_tgid_base_readdir(struct file * filp,
45917 @@ -2990,7 +3109,14 @@ static struct dentry *proc_pid_instantia
45918 if (!inode)
45919 goto out;
45920
45921 +#ifdef CONFIG_GRKERNSEC_PROC_USER
45922 + inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
45923 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45924 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
45925 + inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
45926 +#else
45927 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
45928 +#endif
45929 inode->i_op = &proc_tgid_base_inode_operations;
45930 inode->i_fop = &proc_tgid_base_operations;
45931 inode->i_flags|=S_IMMUTABLE;
45932 @@ -3032,7 +3158,14 @@ struct dentry *proc_pid_lookup(struct in
45933 if (!task)
45934 goto out;
45935
45936 + if (!has_group_leader_pid(task))
45937 + goto out_put_task;
45938 +
45939 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
45940 + goto out_put_task;
45941 +
45942 result = proc_pid_instantiate(dir, dentry, task, NULL);
45943 +out_put_task:
45944 put_task_struct(task);
45945 out:
45946 return result;
45947 @@ -3097,6 +3230,11 @@ int proc_pid_readdir(struct file * filp,
45948 {
45949 unsigned int nr;
45950 struct task_struct *reaper;
45951 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45952 + const struct cred *tmpcred = current_cred();
45953 + const struct cred *itercred;
45954 +#endif
45955 + filldir_t __filldir = filldir;
45956 struct tgid_iter iter;
45957 struct pid_namespace *ns;
45958
45959 @@ -3120,8 +3258,27 @@ int proc_pid_readdir(struct file * filp,
45960 for (iter = next_tgid(ns, iter);
45961 iter.task;
45962 iter.tgid += 1, iter = next_tgid(ns, iter)) {
45963 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45964 + rcu_read_lock();
45965 + itercred = __task_cred(iter.task);
45966 +#endif
45967 + if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
45968 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45969 + || (tmpcred->uid && (itercred->uid != tmpcred->uid)
45970 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
45971 + && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
45972 +#endif
45973 + )
45974 +#endif
45975 + )
45976 + __filldir = &gr_fake_filldir;
45977 + else
45978 + __filldir = filldir;
45979 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45980 + rcu_read_unlock();
45981 +#endif
45982 filp->f_pos = iter.tgid + TGID_OFFSET;
45983 - if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
45984 + if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
45985 put_task_struct(iter.task);
45986 goto out;
45987 }
45988 @@ -3149,7 +3306,7 @@ static const struct pid_entry tid_base_s
45989 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
45990 #endif
45991 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
45992 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
45993 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
45994 INF("syscall", S_IRUGO, proc_pid_syscall),
45995 #endif
45996 INF("cmdline", S_IRUGO, proc_pid_cmdline),
45997 @@ -3173,10 +3330,10 @@ static const struct pid_entry tid_base_s
45998 #ifdef CONFIG_SECURITY
45999 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
46000 #endif
46001 -#ifdef CONFIG_KALLSYMS
46002 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
46003 INF("wchan", S_IRUGO, proc_pid_wchan),
46004 #endif
46005 -#ifdef CONFIG_STACKTRACE
46006 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
46007 ONE("stack", S_IRUGO, proc_pid_stack),
46008 #endif
46009 #ifdef CONFIG_SCHEDSTATS
46010 diff -urNp linux-3.0.9/fs/proc/cmdline.c linux-3.0.9/fs/proc/cmdline.c
46011 --- linux-3.0.9/fs/proc/cmdline.c 2011-11-11 13:12:24.000000000 -0500
46012 +++ linux-3.0.9/fs/proc/cmdline.c 2011-11-15 20:02:59.000000000 -0500
46013 @@ -23,7 +23,11 @@ static const struct file_operations cmdl
46014
46015 static int __init proc_cmdline_init(void)
46016 {
46017 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
46018 + proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
46019 +#else
46020 proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
46021 +#endif
46022 return 0;
46023 }
46024 module_init(proc_cmdline_init);
46025 diff -urNp linux-3.0.9/fs/proc/devices.c linux-3.0.9/fs/proc/devices.c
46026 --- linux-3.0.9/fs/proc/devices.c 2011-11-11 13:12:24.000000000 -0500
46027 +++ linux-3.0.9/fs/proc/devices.c 2011-11-15 20:02:59.000000000 -0500
46028 @@ -64,7 +64,11 @@ static const struct file_operations proc
46029
46030 static int __init proc_devices_init(void)
46031 {
46032 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
46033 + proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
46034 +#else
46035 proc_create("devices", 0, NULL, &proc_devinfo_operations);
46036 +#endif
46037 return 0;
46038 }
46039 module_init(proc_devices_init);
46040 diff -urNp linux-3.0.9/fs/proc/inode.c linux-3.0.9/fs/proc/inode.c
46041 --- linux-3.0.9/fs/proc/inode.c 2011-11-11 13:12:24.000000000 -0500
46042 +++ linux-3.0.9/fs/proc/inode.c 2011-11-15 20:02:59.000000000 -0500
46043 @@ -18,12 +18,18 @@
46044 #include <linux/module.h>
46045 #include <linux/sysctl.h>
46046 #include <linux/slab.h>
46047 +#include <linux/grsecurity.h>
46048
46049 #include <asm/system.h>
46050 #include <asm/uaccess.h>
46051
46052 #include "internal.h"
46053
46054 +#ifdef CONFIG_PROC_SYSCTL
46055 +extern const struct inode_operations proc_sys_inode_operations;
46056 +extern const struct inode_operations proc_sys_dir_operations;
46057 +#endif
46058 +
46059 static void proc_evict_inode(struct inode *inode)
46060 {
46061 struct proc_dir_entry *de;
46062 @@ -49,6 +55,13 @@ static void proc_evict_inode(struct inod
46063 ns_ops = PROC_I(inode)->ns_ops;
46064 if (ns_ops && ns_ops->put)
46065 ns_ops->put(PROC_I(inode)->ns);
46066 +
46067 +#ifdef CONFIG_PROC_SYSCTL
46068 + if (inode->i_op == &proc_sys_inode_operations ||
46069 + inode->i_op == &proc_sys_dir_operations)
46070 + gr_handle_delete(inode->i_ino, inode->i_sb->s_dev);
46071 +#endif
46072 +
46073 }
46074
46075 static struct kmem_cache * proc_inode_cachep;
46076 @@ -440,7 +453,11 @@ struct inode *proc_get_inode(struct supe
46077 if (de->mode) {
46078 inode->i_mode = de->mode;
46079 inode->i_uid = de->uid;
46080 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
46081 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
46082 +#else
46083 inode->i_gid = de->gid;
46084 +#endif
46085 }
46086 if (de->size)
46087 inode->i_size = de->size;
46088 diff -urNp linux-3.0.9/fs/proc/internal.h linux-3.0.9/fs/proc/internal.h
46089 --- linux-3.0.9/fs/proc/internal.h 2011-11-11 13:12:24.000000000 -0500
46090 +++ linux-3.0.9/fs/proc/internal.h 2011-11-15 20:02:59.000000000 -0500
46091 @@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
46092 struct pid *pid, struct task_struct *task);
46093 extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
46094 struct pid *pid, struct task_struct *task);
46095 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
46096 +extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
46097 +#endif
46098 extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
46099
46100 extern const struct file_operations proc_maps_operations;
46101 diff -urNp linux-3.0.9/fs/proc/Kconfig linux-3.0.9/fs/proc/Kconfig
46102 --- linux-3.0.9/fs/proc/Kconfig 2011-11-11 13:12:24.000000000 -0500
46103 +++ linux-3.0.9/fs/proc/Kconfig 2011-11-15 20:02:59.000000000 -0500
46104 @@ -30,12 +30,12 @@ config PROC_FS
46105
46106 config PROC_KCORE
46107 bool "/proc/kcore support" if !ARM
46108 - depends on PROC_FS && MMU
46109 + depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
46110
46111 config PROC_VMCORE
46112 bool "/proc/vmcore support"
46113 - depends on PROC_FS && CRASH_DUMP
46114 - default y
46115 + depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
46116 + default n
46117 help
46118 Exports the dump image of crashed kernel in ELF format.
46119
46120 @@ -59,8 +59,8 @@ config PROC_SYSCTL
46121 limited in memory.
46122
46123 config PROC_PAGE_MONITOR
46124 - default y
46125 - depends on PROC_FS && MMU
46126 + default n
46127 + depends on PROC_FS && MMU && !GRKERNSEC
46128 bool "Enable /proc page monitoring" if EXPERT
46129 help
46130 Various /proc files exist to monitor process memory utilization:
46131 diff -urNp linux-3.0.9/fs/proc/kcore.c linux-3.0.9/fs/proc/kcore.c
46132 --- linux-3.0.9/fs/proc/kcore.c 2011-11-11 13:12:24.000000000 -0500
46133 +++ linux-3.0.9/fs/proc/kcore.c 2011-11-15 20:02:59.000000000 -0500
46134 @@ -321,6 +321,8 @@ static void elf_kcore_store_hdr(char *bu
46135 off_t offset = 0;
46136 struct kcore_list *m;
46137
46138 + pax_track_stack();
46139 +
46140 /* setup ELF header */
46141 elf = (struct elfhdr *) bufp;
46142 bufp += sizeof(struct elfhdr);
46143 @@ -478,9 +480,10 @@ read_kcore(struct file *file, char __use
46144 * the addresses in the elf_phdr on our list.
46145 */
46146 start = kc_offset_to_vaddr(*fpos - elf_buflen);
46147 - if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
46148 + tsz = PAGE_SIZE - (start & ~PAGE_MASK);
46149 + if (tsz > buflen)
46150 tsz = buflen;
46151 -
46152 +
46153 while (buflen) {
46154 struct kcore_list *m;
46155
46156 @@ -509,20 +512,23 @@ read_kcore(struct file *file, char __use
46157 kfree(elf_buf);
46158 } else {
46159 if (kern_addr_valid(start)) {
46160 - unsigned long n;
46161 + char *elf_buf;
46162 + mm_segment_t oldfs;
46163
46164 - n = copy_to_user(buffer, (char *)start, tsz);
46165 - /*
46166 - * We cannot distingush between fault on source
46167 - * and fault on destination. When this happens
46168 - * we clear too and hope it will trigger the
46169 - * EFAULT again.
46170 - */
46171 - if (n) {
46172 - if (clear_user(buffer + tsz - n,
46173 - n))
46174 + elf_buf = kmalloc(tsz, GFP_KERNEL);
46175 + if (!elf_buf)
46176 + return -ENOMEM;
46177 + oldfs = get_fs();
46178 + set_fs(KERNEL_DS);
46179 + if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
46180 + set_fs(oldfs);
46181 + if (copy_to_user(buffer, elf_buf, tsz)) {
46182 + kfree(elf_buf);
46183 return -EFAULT;
46184 + }
46185 }
46186 + set_fs(oldfs);
46187 + kfree(elf_buf);
46188 } else {
46189 if (clear_user(buffer, tsz))
46190 return -EFAULT;
46191 @@ -542,6 +548,9 @@ read_kcore(struct file *file, char __use
46192
46193 static int open_kcore(struct inode *inode, struct file *filp)
46194 {
46195 +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
46196 + return -EPERM;
46197 +#endif
46198 if (!capable(CAP_SYS_RAWIO))
46199 return -EPERM;
46200 if (kcore_need_update)
46201 diff -urNp linux-3.0.9/fs/proc/meminfo.c linux-3.0.9/fs/proc/meminfo.c
46202 --- linux-3.0.9/fs/proc/meminfo.c 2011-11-11 13:12:24.000000000 -0500
46203 +++ linux-3.0.9/fs/proc/meminfo.c 2011-11-15 20:02:59.000000000 -0500
46204 @@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_
46205 unsigned long pages[NR_LRU_LISTS];
46206 int lru;
46207
46208 + pax_track_stack();
46209 +
46210 /*
46211 * display in kilobytes.
46212 */
46213 @@ -157,7 +159,7 @@ static int meminfo_proc_show(struct seq_
46214 vmi.used >> 10,
46215 vmi.largest_chunk >> 10
46216 #ifdef CONFIG_MEMORY_FAILURE
46217 - ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
46218 + ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
46219 #endif
46220 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
46221 ,K(global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) *
46222 diff -urNp linux-3.0.9/fs/proc/nommu.c linux-3.0.9/fs/proc/nommu.c
46223 --- linux-3.0.9/fs/proc/nommu.c 2011-11-11 13:12:24.000000000 -0500
46224 +++ linux-3.0.9/fs/proc/nommu.c 2011-11-15 20:02:59.000000000 -0500
46225 @@ -66,7 +66,7 @@ static int nommu_region_show(struct seq_
46226 if (len < 1)
46227 len = 1;
46228 seq_printf(m, "%*c", len, ' ');
46229 - seq_path(m, &file->f_path, "");
46230 + seq_path(m, &file->f_path, "\n\\");
46231 }
46232
46233 seq_putc(m, '\n');
46234 diff -urNp linux-3.0.9/fs/proc/proc_net.c linux-3.0.9/fs/proc/proc_net.c
46235 --- linux-3.0.9/fs/proc/proc_net.c 2011-11-11 13:12:24.000000000 -0500
46236 +++ linux-3.0.9/fs/proc/proc_net.c 2011-11-15 20:02:59.000000000 -0500
46237 @@ -105,6 +105,17 @@ static struct net *get_proc_task_net(str
46238 struct task_struct *task;
46239 struct nsproxy *ns;
46240 struct net *net = NULL;
46241 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
46242 + const struct cred *cred = current_cred();
46243 +#endif
46244 +
46245 +#ifdef CONFIG_GRKERNSEC_PROC_USER
46246 + if (cred->fsuid)
46247 + return net;
46248 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
46249 + if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
46250 + return net;
46251 +#endif
46252
46253 rcu_read_lock();
46254 task = pid_task(proc_pid(dir), PIDTYPE_PID);
46255 diff -urNp linux-3.0.9/fs/proc/proc_sysctl.c linux-3.0.9/fs/proc/proc_sysctl.c
46256 --- linux-3.0.9/fs/proc/proc_sysctl.c 2011-11-11 13:12:24.000000000 -0500
46257 +++ linux-3.0.9/fs/proc/proc_sysctl.c 2011-11-15 20:02:59.000000000 -0500
46258 @@ -8,11 +8,13 @@
46259 #include <linux/namei.h>
46260 #include "internal.h"
46261
46262 +extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
46263 +
46264 static const struct dentry_operations proc_sys_dentry_operations;
46265 static const struct file_operations proc_sys_file_operations;
46266 -static const struct inode_operations proc_sys_inode_operations;
46267 +const struct inode_operations proc_sys_inode_operations;
46268 static const struct file_operations proc_sys_dir_file_operations;
46269 -static const struct inode_operations proc_sys_dir_operations;
46270 +const struct inode_operations proc_sys_dir_operations;
46271
46272 static struct inode *proc_sys_make_inode(struct super_block *sb,
46273 struct ctl_table_header *head, struct ctl_table *table)
46274 @@ -121,8 +123,14 @@ static struct dentry *proc_sys_lookup(st
46275
46276 err = NULL;
46277 d_set_d_op(dentry, &proc_sys_dentry_operations);
46278 +
46279 + gr_handle_proc_create(dentry, inode);
46280 +
46281 d_add(dentry, inode);
46282
46283 + if (gr_handle_sysctl(p, MAY_EXEC))
46284 + err = ERR_PTR(-ENOENT);
46285 +
46286 out:
46287 sysctl_head_finish(head);
46288 return err;
46289 @@ -202,6 +210,9 @@ static int proc_sys_fill_cache(struct fi
46290 return -ENOMEM;
46291 } else {
46292 d_set_d_op(child, &proc_sys_dentry_operations);
46293 +
46294 + gr_handle_proc_create(child, inode);
46295 +
46296 d_add(child, inode);
46297 }
46298 } else {
46299 @@ -230,6 +241,9 @@ static int scan(struct ctl_table_header
46300 if (*pos < file->f_pos)
46301 continue;
46302
46303 + if (gr_handle_sysctl(table, 0))
46304 + continue;
46305 +
46306 res = proc_sys_fill_cache(file, dirent, filldir, head, table);
46307 if (res)
46308 return res;
46309 @@ -355,6 +369,9 @@ static int proc_sys_getattr(struct vfsmo
46310 if (IS_ERR(head))
46311 return PTR_ERR(head);
46312
46313 + if (table && gr_handle_sysctl(table, MAY_EXEC))
46314 + return -ENOENT;
46315 +
46316 generic_fillattr(inode, stat);
46317 if (table)
46318 stat->mode = (stat->mode & S_IFMT) | table->mode;
46319 @@ -374,13 +391,13 @@ static const struct file_operations proc
46320 .llseek = generic_file_llseek,
46321 };
46322
46323 -static const struct inode_operations proc_sys_inode_operations = {
46324 +const struct inode_operations proc_sys_inode_operations = {
46325 .permission = proc_sys_permission,
46326 .setattr = proc_sys_setattr,
46327 .getattr = proc_sys_getattr,
46328 };
46329
46330 -static const struct inode_operations proc_sys_dir_operations = {
46331 +const struct inode_operations proc_sys_dir_operations = {
46332 .lookup = proc_sys_lookup,
46333 .permission = proc_sys_permission,
46334 .setattr = proc_sys_setattr,
46335 diff -urNp linux-3.0.9/fs/proc/root.c linux-3.0.9/fs/proc/root.c
46336 --- linux-3.0.9/fs/proc/root.c 2011-11-11 13:12:24.000000000 -0500
46337 +++ linux-3.0.9/fs/proc/root.c 2011-11-15 20:02:59.000000000 -0500
46338 @@ -123,7 +123,15 @@ void __init proc_root_init(void)
46339 #ifdef CONFIG_PROC_DEVICETREE
46340 proc_device_tree_init();
46341 #endif
46342 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
46343 +#ifdef CONFIG_GRKERNSEC_PROC_USER
46344 + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
46345 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
46346 + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
46347 +#endif
46348 +#else
46349 proc_mkdir("bus", NULL);
46350 +#endif
46351 proc_sys_init();
46352 }
46353
46354 diff -urNp linux-3.0.9/fs/proc/task_mmu.c linux-3.0.9/fs/proc/task_mmu.c
46355 --- linux-3.0.9/fs/proc/task_mmu.c 2011-11-11 13:12:24.000000000 -0500
46356 +++ linux-3.0.9/fs/proc/task_mmu.c 2011-11-15 20:02:59.000000000 -0500
46357 @@ -51,8 +51,13 @@ void task_mem(struct seq_file *m, struct
46358 "VmExe:\t%8lu kB\n"
46359 "VmLib:\t%8lu kB\n"
46360 "VmPTE:\t%8lu kB\n"
46361 - "VmSwap:\t%8lu kB\n",
46362 - hiwater_vm << (PAGE_SHIFT-10),
46363 + "VmSwap:\t%8lu kB\n"
46364 +
46365 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
46366 + "CsBase:\t%8lx\nCsLim:\t%8lx\n"
46367 +#endif
46368 +
46369 + ,hiwater_vm << (PAGE_SHIFT-10),
46370 (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
46371 mm->locked_vm << (PAGE_SHIFT-10),
46372 hiwater_rss << (PAGE_SHIFT-10),
46373 @@ -60,7 +65,13 @@ void task_mem(struct seq_file *m, struct
46374 data << (PAGE_SHIFT-10),
46375 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
46376 (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10,
46377 - swap << (PAGE_SHIFT-10));
46378 + swap << (PAGE_SHIFT-10)
46379 +
46380 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
46381 + , mm->context.user_cs_base, mm->context.user_cs_limit
46382 +#endif
46383 +
46384 + );
46385 }
46386
46387 unsigned long task_vsize(struct mm_struct *mm)
46388 @@ -207,6 +218,12 @@ static int do_maps_open(struct inode *in
46389 return ret;
46390 }
46391
46392 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
46393 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
46394 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
46395 + _mm->pax_flags & MF_PAX_SEGMEXEC))
46396 +#endif
46397 +
46398 static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
46399 {
46400 struct mm_struct *mm = vma->vm_mm;
46401 @@ -225,13 +242,13 @@ static void show_map_vma(struct seq_file
46402 pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
46403 }
46404
46405 - /* We don't show the stack guard page in /proc/maps */
46406 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
46407 + start = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start;
46408 + end = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end;
46409 +#else
46410 start = vma->vm_start;
46411 - if (stack_guard_page_start(vma, start))
46412 - start += PAGE_SIZE;
46413 end = vma->vm_end;
46414 - if (stack_guard_page_end(vma, end))
46415 - end -= PAGE_SIZE;
46416 +#endif
46417
46418 seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
46419 start,
46420 @@ -240,7 +257,11 @@ static void show_map_vma(struct seq_file
46421 flags & VM_WRITE ? 'w' : '-',
46422 flags & VM_EXEC ? 'x' : '-',
46423 flags & VM_MAYSHARE ? 's' : 'p',
46424 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
46425 + PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
46426 +#else
46427 pgoff,
46428 +#endif
46429 MAJOR(dev), MINOR(dev), ino, &len);
46430
46431 /*
46432 @@ -249,7 +270,7 @@ static void show_map_vma(struct seq_file
46433 */
46434 if (file) {
46435 pad_len_spaces(m, len);
46436 - seq_path(m, &file->f_path, "\n");
46437 + seq_path(m, &file->f_path, "\n\\");
46438 } else {
46439 const char *name = arch_vma_name(vma);
46440 if (!name) {
46441 @@ -257,8 +278,9 @@ static void show_map_vma(struct seq_file
46442 if (vma->vm_start <= mm->brk &&
46443 vma->vm_end >= mm->start_brk) {
46444 name = "[heap]";
46445 - } else if (vma->vm_start <= mm->start_stack &&
46446 - vma->vm_end >= mm->start_stack) {
46447 + } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
46448 + (vma->vm_start <= mm->start_stack &&
46449 + vma->vm_end >= mm->start_stack)) {
46450 name = "[stack]";
46451 }
46452 } else {
46453 @@ -433,11 +455,16 @@ static int show_smap(struct seq_file *m,
46454 };
46455
46456 memset(&mss, 0, sizeof mss);
46457 - mss.vma = vma;
46458 - /* mmap_sem is held in m_start */
46459 - if (vma->vm_mm && !is_vm_hugetlb_page(vma))
46460 - walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
46461 -
46462 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
46463 + if (!PAX_RAND_FLAGS(vma->vm_mm)) {
46464 +#endif
46465 + mss.vma = vma;
46466 + /* mmap_sem is held in m_start */
46467 + if (vma->vm_mm && !is_vm_hugetlb_page(vma))
46468 + walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
46469 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
46470 + }
46471 +#endif
46472 show_map_vma(m, vma);
46473
46474 seq_printf(m,
46475 @@ -455,7 +482,11 @@ static int show_smap(struct seq_file *m,
46476 "KernelPageSize: %8lu kB\n"
46477 "MMUPageSize: %8lu kB\n"
46478 "Locked: %8lu kB\n",
46479 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
46480 + PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
46481 +#else
46482 (vma->vm_end - vma->vm_start) >> 10,
46483 +#endif
46484 mss.resident >> 10,
46485 (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
46486 mss.shared_clean >> 10,
46487 @@ -1031,7 +1062,7 @@ static int show_numa_map(struct seq_file
46488
46489 if (file) {
46490 seq_printf(m, " file=");
46491 - seq_path(m, &file->f_path, "\n\t= ");
46492 + seq_path(m, &file->f_path, "\n\t\\= ");
46493 } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
46494 seq_printf(m, " heap");
46495 } else if (vma->vm_start <= mm->start_stack &&
46496 diff -urNp linux-3.0.9/fs/proc/task_nommu.c linux-3.0.9/fs/proc/task_nommu.c
46497 --- linux-3.0.9/fs/proc/task_nommu.c 2011-11-11 13:12:24.000000000 -0500
46498 +++ linux-3.0.9/fs/proc/task_nommu.c 2011-11-15 20:02:59.000000000 -0500
46499 @@ -51,7 +51,7 @@ void task_mem(struct seq_file *m, struct
46500 else
46501 bytes += kobjsize(mm);
46502
46503 - if (current->fs && current->fs->users > 1)
46504 + if (current->fs && atomic_read(&current->fs->users) > 1)
46505 sbytes += kobjsize(current->fs);
46506 else
46507 bytes += kobjsize(current->fs);
46508 @@ -166,7 +166,7 @@ static int nommu_vma_show(struct seq_fil
46509
46510 if (file) {
46511 pad_len_spaces(m, len);
46512 - seq_path(m, &file->f_path, "");
46513 + seq_path(m, &file->f_path, "\n\\");
46514 } else if (mm) {
46515 if (vma->vm_start <= mm->start_stack &&
46516 vma->vm_end >= mm->start_stack) {
46517 diff -urNp linux-3.0.9/fs/quota/netlink.c linux-3.0.9/fs/quota/netlink.c
46518 --- linux-3.0.9/fs/quota/netlink.c 2011-11-11 13:12:24.000000000 -0500
46519 +++ linux-3.0.9/fs/quota/netlink.c 2011-11-15 20:02:59.000000000 -0500
46520 @@ -33,7 +33,7 @@ static struct genl_family quota_genl_fam
46521 void quota_send_warning(short type, unsigned int id, dev_t dev,
46522 const char warntype)
46523 {
46524 - static atomic_t seq;
46525 + static atomic_unchecked_t seq;
46526 struct sk_buff *skb;
46527 void *msg_head;
46528 int ret;
46529 @@ -49,7 +49,7 @@ void quota_send_warning(short type, unsi
46530 "VFS: Not enough memory to send quota warning.\n");
46531 return;
46532 }
46533 - msg_head = genlmsg_put(skb, 0, atomic_add_return(1, &seq),
46534 + msg_head = genlmsg_put(skb, 0, atomic_add_return_unchecked(1, &seq),
46535 &quota_genl_family, 0, QUOTA_NL_C_WARNING);
46536 if (!msg_head) {
46537 printk(KERN_ERR
46538 diff -urNp linux-3.0.9/fs/readdir.c linux-3.0.9/fs/readdir.c
46539 --- linux-3.0.9/fs/readdir.c 2011-11-11 13:12:24.000000000 -0500
46540 +++ linux-3.0.9/fs/readdir.c 2011-11-15 20:02:59.000000000 -0500
46541 @@ -17,6 +17,7 @@
46542 #include <linux/security.h>
46543 #include <linux/syscalls.h>
46544 #include <linux/unistd.h>
46545 +#include <linux/namei.h>
46546
46547 #include <asm/uaccess.h>
46548
46549 @@ -67,6 +68,7 @@ struct old_linux_dirent {
46550
46551 struct readdir_callback {
46552 struct old_linux_dirent __user * dirent;
46553 + struct file * file;
46554 int result;
46555 };
46556
46557 @@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons
46558 buf->result = -EOVERFLOW;
46559 return -EOVERFLOW;
46560 }
46561 +
46562 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
46563 + return 0;
46564 +
46565 buf->result++;
46566 dirent = buf->dirent;
46567 if (!access_ok(VERIFY_WRITE, dirent,
46568 @@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
46569
46570 buf.result = 0;
46571 buf.dirent = dirent;
46572 + buf.file = file;
46573
46574 error = vfs_readdir(file, fillonedir, &buf);
46575 if (buf.result)
46576 @@ -142,6 +149,7 @@ struct linux_dirent {
46577 struct getdents_callback {
46578 struct linux_dirent __user * current_dir;
46579 struct linux_dirent __user * previous;
46580 + struct file * file;
46581 int count;
46582 int error;
46583 };
46584 @@ -163,6 +171,10 @@ static int filldir(void * __buf, const c
46585 buf->error = -EOVERFLOW;
46586 return -EOVERFLOW;
46587 }
46588 +
46589 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
46590 + return 0;
46591 +
46592 dirent = buf->previous;
46593 if (dirent) {
46594 if (__put_user(offset, &dirent->d_off))
46595 @@ -210,6 +222,7 @@ SYSCALL_DEFINE3(getdents, unsigned int,
46596 buf.previous = NULL;
46597 buf.count = count;
46598 buf.error = 0;
46599 + buf.file = file;
46600
46601 error = vfs_readdir(file, filldir, &buf);
46602 if (error >= 0)
46603 @@ -229,6 +242,7 @@ out:
46604 struct getdents_callback64 {
46605 struct linux_dirent64 __user * current_dir;
46606 struct linux_dirent64 __user * previous;
46607 + struct file *file;
46608 int count;
46609 int error;
46610 };
46611 @@ -244,6 +258,10 @@ static int filldir64(void * __buf, const
46612 buf->error = -EINVAL; /* only used if we fail.. */
46613 if (reclen > buf->count)
46614 return -EINVAL;
46615 +
46616 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
46617 + return 0;
46618 +
46619 dirent = buf->previous;
46620 if (dirent) {
46621 if (__put_user(offset, &dirent->d_off))
46622 @@ -291,6 +309,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
46623
46624 buf.current_dir = dirent;
46625 buf.previous = NULL;
46626 + buf.file = file;
46627 buf.count = count;
46628 buf.error = 0;
46629
46630 @@ -299,7 +318,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
46631 error = buf.error;
46632 lastdirent = buf.previous;
46633 if (lastdirent) {
46634 - typeof(lastdirent->d_off) d_off = file->f_pos;
46635 + typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
46636 if (__put_user(d_off, &lastdirent->d_off))
46637 error = -EFAULT;
46638 else
46639 diff -urNp linux-3.0.9/fs/reiserfs/dir.c linux-3.0.9/fs/reiserfs/dir.c
46640 --- linux-3.0.9/fs/reiserfs/dir.c 2011-11-11 13:12:24.000000000 -0500
46641 +++ linux-3.0.9/fs/reiserfs/dir.c 2011-11-15 20:02:59.000000000 -0500
46642 @@ -66,6 +66,8 @@ int reiserfs_readdir_dentry(struct dentr
46643 struct reiserfs_dir_entry de;
46644 int ret = 0;
46645
46646 + pax_track_stack();
46647 +
46648 reiserfs_write_lock(inode->i_sb);
46649
46650 reiserfs_check_lock_depth(inode->i_sb, "readdir");
46651 diff -urNp linux-3.0.9/fs/reiserfs/do_balan.c linux-3.0.9/fs/reiserfs/do_balan.c
46652 --- linux-3.0.9/fs/reiserfs/do_balan.c 2011-11-11 13:12:24.000000000 -0500
46653 +++ linux-3.0.9/fs/reiserfs/do_balan.c 2011-11-15 20:02:59.000000000 -0500
46654 @@ -2051,7 +2051,7 @@ void do_balance(struct tree_balance *tb,
46655 return;
46656 }
46657
46658 - atomic_inc(&(fs_generation(tb->tb_sb)));
46659 + atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
46660 do_balance_starts(tb);
46661
46662 /* balance leaf returns 0 except if combining L R and S into
46663 diff -urNp linux-3.0.9/fs/reiserfs/journal.c linux-3.0.9/fs/reiserfs/journal.c
46664 --- linux-3.0.9/fs/reiserfs/journal.c 2011-11-11 13:12:24.000000000 -0500
46665 +++ linux-3.0.9/fs/reiserfs/journal.c 2011-11-15 20:02:59.000000000 -0500
46666 @@ -2299,6 +2299,8 @@ static struct buffer_head *reiserfs_brea
46667 struct buffer_head *bh;
46668 int i, j;
46669
46670 + pax_track_stack();
46671 +
46672 bh = __getblk(dev, block, bufsize);
46673 if (buffer_uptodate(bh))
46674 return (bh);
46675 diff -urNp linux-3.0.9/fs/reiserfs/namei.c linux-3.0.9/fs/reiserfs/namei.c
46676 --- linux-3.0.9/fs/reiserfs/namei.c 2011-11-11 13:12:24.000000000 -0500
46677 +++ linux-3.0.9/fs/reiserfs/namei.c 2011-11-15 20:02:59.000000000 -0500
46678 @@ -1225,6 +1225,8 @@ static int reiserfs_rename(struct inode
46679 unsigned long savelink = 1;
46680 struct timespec ctime;
46681
46682 + pax_track_stack();
46683 +
46684 /* three balancings: (1) old name removal, (2) new name insertion
46685 and (3) maybe "save" link insertion
46686 stat data updates: (1) old directory,
46687 diff -urNp linux-3.0.9/fs/reiserfs/procfs.c linux-3.0.9/fs/reiserfs/procfs.c
46688 --- linux-3.0.9/fs/reiserfs/procfs.c 2011-11-11 13:12:24.000000000 -0500
46689 +++ linux-3.0.9/fs/reiserfs/procfs.c 2011-11-15 20:02:59.000000000 -0500
46690 @@ -113,7 +113,7 @@ static int show_super(struct seq_file *m
46691 "SMALL_TAILS " : "NO_TAILS ",
46692 replay_only(sb) ? "REPLAY_ONLY " : "",
46693 convert_reiserfs(sb) ? "CONV " : "",
46694 - atomic_read(&r->s_generation_counter),
46695 + atomic_read_unchecked(&r->s_generation_counter),
46696 SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
46697 SF(s_do_balance), SF(s_unneeded_left_neighbor),
46698 SF(s_good_search_by_key_reada), SF(s_bmaps),
46699 @@ -299,6 +299,8 @@ static int show_journal(struct seq_file
46700 struct journal_params *jp = &rs->s_v1.s_journal;
46701 char b[BDEVNAME_SIZE];
46702
46703 + pax_track_stack();
46704 +
46705 seq_printf(m, /* on-disk fields */
46706 "jp_journal_1st_block: \t%i\n"
46707 "jp_journal_dev: \t%s[%x]\n"
46708 diff -urNp linux-3.0.9/fs/reiserfs/stree.c linux-3.0.9/fs/reiserfs/stree.c
46709 --- linux-3.0.9/fs/reiserfs/stree.c 2011-11-11 13:12:24.000000000 -0500
46710 +++ linux-3.0.9/fs/reiserfs/stree.c 2011-11-15 20:02:59.000000000 -0500
46711 @@ -1196,6 +1196,8 @@ int reiserfs_delete_item(struct reiserfs
46712 int iter = 0;
46713 #endif
46714
46715 + pax_track_stack();
46716 +
46717 BUG_ON(!th->t_trans_id);
46718
46719 init_tb_struct(th, &s_del_balance, sb, path,
46720 @@ -1333,6 +1335,8 @@ void reiserfs_delete_solid_item(struct r
46721 int retval;
46722 int quota_cut_bytes = 0;
46723
46724 + pax_track_stack();
46725 +
46726 BUG_ON(!th->t_trans_id);
46727
46728 le_key2cpu_key(&cpu_key, key);
46729 @@ -1562,6 +1566,8 @@ int reiserfs_cut_from_item(struct reiser
46730 int quota_cut_bytes;
46731 loff_t tail_pos = 0;
46732
46733 + pax_track_stack();
46734 +
46735 BUG_ON(!th->t_trans_id);
46736
46737 init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
46738 @@ -1957,6 +1963,8 @@ int reiserfs_paste_into_item(struct reis
46739 int retval;
46740 int fs_gen;
46741
46742 + pax_track_stack();
46743 +
46744 BUG_ON(!th->t_trans_id);
46745
46746 fs_gen = get_generation(inode->i_sb);
46747 @@ -2045,6 +2053,8 @@ int reiserfs_insert_item(struct reiserfs
46748 int fs_gen = 0;
46749 int quota_bytes = 0;
46750
46751 + pax_track_stack();
46752 +
46753 BUG_ON(!th->t_trans_id);
46754
46755 if (inode) { /* Do we count quotas for item? */
46756 diff -urNp linux-3.0.9/fs/reiserfs/super.c linux-3.0.9/fs/reiserfs/super.c
46757 --- linux-3.0.9/fs/reiserfs/super.c 2011-11-11 13:12:24.000000000 -0500
46758 +++ linux-3.0.9/fs/reiserfs/super.c 2011-11-15 20:02:59.000000000 -0500
46759 @@ -927,6 +927,8 @@ static int reiserfs_parse_options(struct
46760 {.option_name = NULL}
46761 };
46762
46763 + pax_track_stack();
46764 +
46765 *blocks = 0;
46766 if (!options || !*options)
46767 /* use default configuration: create tails, journaling on, no
46768 diff -urNp linux-3.0.9/fs/select.c linux-3.0.9/fs/select.c
46769 --- linux-3.0.9/fs/select.c 2011-11-11 13:12:24.000000000 -0500
46770 +++ linux-3.0.9/fs/select.c 2011-11-15 20:02:59.000000000 -0500
46771 @@ -20,6 +20,7 @@
46772 #include <linux/module.h>
46773 #include <linux/slab.h>
46774 #include <linux/poll.h>
46775 +#include <linux/security.h>
46776 #include <linux/personality.h> /* for STICKY_TIMEOUTS */
46777 #include <linux/file.h>
46778 #include <linux/fdtable.h>
46779 @@ -403,6 +404,8 @@ int do_select(int n, fd_set_bits *fds, s
46780 int retval, i, timed_out = 0;
46781 unsigned long slack = 0;
46782
46783 + pax_track_stack();
46784 +
46785 rcu_read_lock();
46786 retval = max_select_fd(n, fds);
46787 rcu_read_unlock();
46788 @@ -528,6 +531,8 @@ int core_sys_select(int n, fd_set __user
46789 /* Allocate small arguments on the stack to save memory and be faster */
46790 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
46791
46792 + pax_track_stack();
46793 +
46794 ret = -EINVAL;
46795 if (n < 0)
46796 goto out_nofds;
46797 @@ -837,6 +842,9 @@ int do_sys_poll(struct pollfd __user *uf
46798 struct poll_list *walk = head;
46799 unsigned long todo = nfds;
46800
46801 + pax_track_stack();
46802 +
46803 + gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
46804 if (nfds > rlimit(RLIMIT_NOFILE))
46805 return -EINVAL;
46806
46807 diff -urNp linux-3.0.9/fs/seq_file.c linux-3.0.9/fs/seq_file.c
46808 --- linux-3.0.9/fs/seq_file.c 2011-11-11 13:12:24.000000000 -0500
46809 +++ linux-3.0.9/fs/seq_file.c 2011-11-15 20:02:59.000000000 -0500
46810 @@ -76,7 +76,8 @@ static int traverse(struct seq_file *m,
46811 return 0;
46812 }
46813 if (!m->buf) {
46814 - m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
46815 + m->size = PAGE_SIZE;
46816 + m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
46817 if (!m->buf)
46818 return -ENOMEM;
46819 }
46820 @@ -116,7 +117,8 @@ static int traverse(struct seq_file *m,
46821 Eoverflow:
46822 m->op->stop(m, p);
46823 kfree(m->buf);
46824 - m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
46825 + m->size <<= 1;
46826 + m->buf = kmalloc(m->size, GFP_KERNEL);
46827 return !m->buf ? -ENOMEM : -EAGAIN;
46828 }
46829
46830 @@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char
46831 m->version = file->f_version;
46832 /* grab buffer if we didn't have one */
46833 if (!m->buf) {
46834 - m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
46835 + m->size = PAGE_SIZE;
46836 + m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
46837 if (!m->buf)
46838 goto Enomem;
46839 }
46840 @@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char
46841 goto Fill;
46842 m->op->stop(m, p);
46843 kfree(m->buf);
46844 - m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
46845 + m->size <<= 1;
46846 + m->buf = kmalloc(m->size, GFP_KERNEL);
46847 if (!m->buf)
46848 goto Enomem;
46849 m->count = 0;
46850 @@ -549,7 +553,7 @@ static void single_stop(struct seq_file
46851 int single_open(struct file *file, int (*show)(struct seq_file *, void *),
46852 void *data)
46853 {
46854 - struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL);
46855 + seq_operations_no_const *op = kmalloc(sizeof(*op), GFP_KERNEL);
46856 int res = -ENOMEM;
46857
46858 if (op) {
46859 diff -urNp linux-3.0.9/fs/splice.c linux-3.0.9/fs/splice.c
46860 --- linux-3.0.9/fs/splice.c 2011-11-11 13:12:24.000000000 -0500
46861 +++ linux-3.0.9/fs/splice.c 2011-11-15 20:02:59.000000000 -0500
46862 @@ -194,7 +194,7 @@ ssize_t splice_to_pipe(struct pipe_inode
46863 pipe_lock(pipe);
46864
46865 for (;;) {
46866 - if (!pipe->readers) {
46867 + if (!atomic_read(&pipe->readers)) {
46868 send_sig(SIGPIPE, current, 0);
46869 if (!ret)
46870 ret = -EPIPE;
46871 @@ -248,9 +248,9 @@ ssize_t splice_to_pipe(struct pipe_inode
46872 do_wakeup = 0;
46873 }
46874
46875 - pipe->waiting_writers++;
46876 + atomic_inc(&pipe->waiting_writers);
46877 pipe_wait(pipe);
46878 - pipe->waiting_writers--;
46879 + atomic_dec(&pipe->waiting_writers);
46880 }
46881
46882 pipe_unlock(pipe);
46883 @@ -320,6 +320,8 @@ __generic_file_splice_read(struct file *
46884 .spd_release = spd_release_page,
46885 };
46886
46887 + pax_track_stack();
46888 +
46889 if (splice_grow_spd(pipe, &spd))
46890 return -ENOMEM;
46891
46892 @@ -560,7 +562,7 @@ static ssize_t kernel_readv(struct file
46893 old_fs = get_fs();
46894 set_fs(get_ds());
46895 /* The cast to a user pointer is valid due to the set_fs() */
46896 - res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
46897 + res = vfs_readv(file, (const struct iovec __force_user *)vec, vlen, &pos);
46898 set_fs(old_fs);
46899
46900 return res;
46901 @@ -575,7 +577,7 @@ static ssize_t kernel_write(struct file
46902 old_fs = get_fs();
46903 set_fs(get_ds());
46904 /* The cast to a user pointer is valid due to the set_fs() */
46905 - res = vfs_write(file, (const char __user *)buf, count, &pos);
46906 + res = vfs_write(file, (const char __force_user *)buf, count, &pos);
46907 set_fs(old_fs);
46908
46909 return res;
46910 @@ -603,6 +605,8 @@ ssize_t default_file_splice_read(struct
46911 .spd_release = spd_release_page,
46912 };
46913
46914 + pax_track_stack();
46915 +
46916 if (splice_grow_spd(pipe, &spd))
46917 return -ENOMEM;
46918
46919 @@ -626,7 +630,7 @@ ssize_t default_file_splice_read(struct
46920 goto err;
46921
46922 this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
46923 - vec[i].iov_base = (void __user *) page_address(page);
46924 + vec[i].iov_base = (void __force_user *) page_address(page);
46925 vec[i].iov_len = this_len;
46926 spd.pages[i] = page;
46927 spd.nr_pages++;
46928 @@ -846,10 +850,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
46929 int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
46930 {
46931 while (!pipe->nrbufs) {
46932 - if (!pipe->writers)
46933 + if (!atomic_read(&pipe->writers))
46934 return 0;
46935
46936 - if (!pipe->waiting_writers && sd->num_spliced)
46937 + if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
46938 return 0;
46939
46940 if (sd->flags & SPLICE_F_NONBLOCK)
46941 @@ -1182,7 +1186,7 @@ ssize_t splice_direct_to_actor(struct fi
46942 * out of the pipe right after the splice_to_pipe(). So set
46943 * PIPE_READERS appropriately.
46944 */
46945 - pipe->readers = 1;
46946 + atomic_set(&pipe->readers, 1);
46947
46948 current->splice_pipe = pipe;
46949 }
46950 @@ -1619,6 +1623,8 @@ static long vmsplice_to_pipe(struct file
46951 };
46952 long ret;
46953
46954 + pax_track_stack();
46955 +
46956 pipe = get_pipe_info(file);
46957 if (!pipe)
46958 return -EBADF;
46959 @@ -1734,9 +1740,9 @@ static int ipipe_prep(struct pipe_inode_
46960 ret = -ERESTARTSYS;
46961 break;
46962 }
46963 - if (!pipe->writers)
46964 + if (!atomic_read(&pipe->writers))
46965 break;
46966 - if (!pipe->waiting_writers) {
46967 + if (!atomic_read(&pipe->waiting_writers)) {
46968 if (flags & SPLICE_F_NONBLOCK) {
46969 ret = -EAGAIN;
46970 break;
46971 @@ -1768,7 +1774,7 @@ static int opipe_prep(struct pipe_inode_
46972 pipe_lock(pipe);
46973
46974 while (pipe->nrbufs >= pipe->buffers) {
46975 - if (!pipe->readers) {
46976 + if (!atomic_read(&pipe->readers)) {
46977 send_sig(SIGPIPE, current, 0);
46978 ret = -EPIPE;
46979 break;
46980 @@ -1781,9 +1787,9 @@ static int opipe_prep(struct pipe_inode_
46981 ret = -ERESTARTSYS;
46982 break;
46983 }
46984 - pipe->waiting_writers++;
46985 + atomic_inc(&pipe->waiting_writers);
46986 pipe_wait(pipe);
46987 - pipe->waiting_writers--;
46988 + atomic_dec(&pipe->waiting_writers);
46989 }
46990
46991 pipe_unlock(pipe);
46992 @@ -1819,14 +1825,14 @@ retry:
46993 pipe_double_lock(ipipe, opipe);
46994
46995 do {
46996 - if (!opipe->readers) {
46997 + if (!atomic_read(&opipe->readers)) {
46998 send_sig(SIGPIPE, current, 0);
46999 if (!ret)
47000 ret = -EPIPE;
47001 break;
47002 }
47003
47004 - if (!ipipe->nrbufs && !ipipe->writers)
47005 + if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
47006 break;
47007
47008 /*
47009 @@ -1923,7 +1929,7 @@ static int link_pipe(struct pipe_inode_i
47010 pipe_double_lock(ipipe, opipe);
47011
47012 do {
47013 - if (!opipe->readers) {
47014 + if (!atomic_read(&opipe->readers)) {
47015 send_sig(SIGPIPE, current, 0);
47016 if (!ret)
47017 ret = -EPIPE;
47018 @@ -1968,7 +1974,7 @@ static int link_pipe(struct pipe_inode_i
47019 * return EAGAIN if we have the potential of some data in the
47020 * future, otherwise just return 0
47021 */
47022 - if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
47023 + if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
47024 ret = -EAGAIN;
47025
47026 pipe_unlock(ipipe);
47027 diff -urNp linux-3.0.9/fs/sysfs/file.c linux-3.0.9/fs/sysfs/file.c
47028 --- linux-3.0.9/fs/sysfs/file.c 2011-11-11 13:12:24.000000000 -0500
47029 +++ linux-3.0.9/fs/sysfs/file.c 2011-11-15 20:02:59.000000000 -0500
47030 @@ -37,7 +37,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent
47031
47032 struct sysfs_open_dirent {
47033 atomic_t refcnt;
47034 - atomic_t event;
47035 + atomic_unchecked_t event;
47036 wait_queue_head_t poll;
47037 struct list_head buffers; /* goes through sysfs_buffer.list */
47038 };
47039 @@ -81,7 +81,7 @@ static int fill_read_buffer(struct dentr
47040 if (!sysfs_get_active(attr_sd))
47041 return -ENODEV;
47042
47043 - buffer->event = atomic_read(&attr_sd->s_attr.open->event);
47044 + buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
47045 count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
47046
47047 sysfs_put_active(attr_sd);
47048 @@ -287,7 +287,7 @@ static int sysfs_get_open_dirent(struct
47049 return -ENOMEM;
47050
47051 atomic_set(&new_od->refcnt, 0);
47052 - atomic_set(&new_od->event, 1);
47053 + atomic_set_unchecked(&new_od->event, 1);
47054 init_waitqueue_head(&new_od->poll);
47055 INIT_LIST_HEAD(&new_od->buffers);
47056 goto retry;
47057 @@ -432,7 +432,7 @@ static unsigned int sysfs_poll(struct fi
47058
47059 sysfs_put_active(attr_sd);
47060
47061 - if (buffer->event != atomic_read(&od->event))
47062 + if (buffer->event != atomic_read_unchecked(&od->event))
47063 goto trigger;
47064
47065 return DEFAULT_POLLMASK;
47066 @@ -451,7 +451,7 @@ void sysfs_notify_dirent(struct sysfs_di
47067
47068 od = sd->s_attr.open;
47069 if (od) {
47070 - atomic_inc(&od->event);
47071 + atomic_inc_unchecked(&od->event);
47072 wake_up_interruptible(&od->poll);
47073 }
47074
47075 diff -urNp linux-3.0.9/fs/sysfs/mount.c linux-3.0.9/fs/sysfs/mount.c
47076 --- linux-3.0.9/fs/sysfs/mount.c 2011-11-11 13:12:24.000000000 -0500
47077 +++ linux-3.0.9/fs/sysfs/mount.c 2011-11-15 20:02:59.000000000 -0500
47078 @@ -36,7 +36,11 @@ struct sysfs_dirent sysfs_root = {
47079 .s_name = "",
47080 .s_count = ATOMIC_INIT(1),
47081 .s_flags = SYSFS_DIR | (KOBJ_NS_TYPE_NONE << SYSFS_NS_TYPE_SHIFT),
47082 +#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
47083 + .s_mode = S_IFDIR | S_IRWXU,
47084 +#else
47085 .s_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
47086 +#endif
47087 .s_ino = 1,
47088 };
47089
47090 diff -urNp linux-3.0.9/fs/sysfs/symlink.c linux-3.0.9/fs/sysfs/symlink.c
47091 --- linux-3.0.9/fs/sysfs/symlink.c 2011-11-11 13:12:24.000000000 -0500
47092 +++ linux-3.0.9/fs/sysfs/symlink.c 2011-11-15 20:02:59.000000000 -0500
47093 @@ -286,7 +286,7 @@ static void *sysfs_follow_link(struct de
47094
47095 static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
47096 {
47097 - char *page = nd_get_link(nd);
47098 + const char *page = nd_get_link(nd);
47099 if (!IS_ERR(page))
47100 free_page((unsigned long)page);
47101 }
47102 diff -urNp linux-3.0.9/fs/udf/inode.c linux-3.0.9/fs/udf/inode.c
47103 --- linux-3.0.9/fs/udf/inode.c 2011-11-11 13:12:24.000000000 -0500
47104 +++ linux-3.0.9/fs/udf/inode.c 2011-11-15 20:02:59.000000000 -0500
47105 @@ -560,6 +560,8 @@ static struct buffer_head *inode_getblk(
47106 int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
47107 int lastblock = 0;
47108
47109 + pax_track_stack();
47110 +
47111 prev_epos.offset = udf_file_entry_alloc_offset(inode);
47112 prev_epos.block = iinfo->i_location;
47113 prev_epos.bh = NULL;
47114 diff -urNp linux-3.0.9/fs/udf/misc.c linux-3.0.9/fs/udf/misc.c
47115 --- linux-3.0.9/fs/udf/misc.c 2011-11-11 13:12:24.000000000 -0500
47116 +++ linux-3.0.9/fs/udf/misc.c 2011-11-15 20:02:59.000000000 -0500
47117 @@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t id
47118
47119 u8 udf_tag_checksum(const struct tag *t)
47120 {
47121 - u8 *data = (u8 *)t;
47122 + const u8 *data = (const u8 *)t;
47123 u8 checksum = 0;
47124 int i;
47125 for (i = 0; i < sizeof(struct tag); ++i)
47126 diff -urNp linux-3.0.9/fs/utimes.c linux-3.0.9/fs/utimes.c
47127 --- linux-3.0.9/fs/utimes.c 2011-11-11 13:12:24.000000000 -0500
47128 +++ linux-3.0.9/fs/utimes.c 2011-11-15 20:02:59.000000000 -0500
47129 @@ -1,6 +1,7 @@
47130 #include <linux/compiler.h>
47131 #include <linux/file.h>
47132 #include <linux/fs.h>
47133 +#include <linux/security.h>
47134 #include <linux/linkage.h>
47135 #include <linux/mount.h>
47136 #include <linux/namei.h>
47137 @@ -101,6 +102,12 @@ static int utimes_common(struct path *pa
47138 goto mnt_drop_write_and_out;
47139 }
47140 }
47141 +
47142 + if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
47143 + error = -EACCES;
47144 + goto mnt_drop_write_and_out;
47145 + }
47146 +
47147 mutex_lock(&inode->i_mutex);
47148 error = notify_change(path->dentry, &newattrs);
47149 mutex_unlock(&inode->i_mutex);
47150 diff -urNp linux-3.0.9/fs/xattr_acl.c linux-3.0.9/fs/xattr_acl.c
47151 --- linux-3.0.9/fs/xattr_acl.c 2011-11-11 13:12:24.000000000 -0500
47152 +++ linux-3.0.9/fs/xattr_acl.c 2011-11-15 20:02:59.000000000 -0500
47153 @@ -17,8 +17,8 @@
47154 struct posix_acl *
47155 posix_acl_from_xattr(const void *value, size_t size)
47156 {
47157 - posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
47158 - posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
47159 + const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
47160 + const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
47161 int count;
47162 struct posix_acl *acl;
47163 struct posix_acl_entry *acl_e;
47164 diff -urNp linux-3.0.9/fs/xattr.c linux-3.0.9/fs/xattr.c
47165 --- linux-3.0.9/fs/xattr.c 2011-11-11 13:12:24.000000000 -0500
47166 +++ linux-3.0.9/fs/xattr.c 2011-11-15 20:02:59.000000000 -0500
47167 @@ -254,7 +254,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
47168 * Extended attribute SET operations
47169 */
47170 static long
47171 -setxattr(struct dentry *d, const char __user *name, const void __user *value,
47172 +setxattr(struct path *path, const char __user *name, const void __user *value,
47173 size_t size, int flags)
47174 {
47175 int error;
47176 @@ -278,7 +278,13 @@ setxattr(struct dentry *d, const char __
47177 return PTR_ERR(kvalue);
47178 }
47179
47180 - error = vfs_setxattr(d, kname, kvalue, size, flags);
47181 + if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
47182 + error = -EACCES;
47183 + goto out;
47184 + }
47185 +
47186 + error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
47187 +out:
47188 kfree(kvalue);
47189 return error;
47190 }
47191 @@ -295,7 +301,7 @@ SYSCALL_DEFINE5(setxattr, const char __u
47192 return error;
47193 error = mnt_want_write(path.mnt);
47194 if (!error) {
47195 - error = setxattr(path.dentry, name, value, size, flags);
47196 + error = setxattr(&path, name, value, size, flags);
47197 mnt_drop_write(path.mnt);
47198 }
47199 path_put(&path);
47200 @@ -314,7 +320,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __
47201 return error;
47202 error = mnt_want_write(path.mnt);
47203 if (!error) {
47204 - error = setxattr(path.dentry, name, value, size, flags);
47205 + error = setxattr(&path, name, value, size, flags);
47206 mnt_drop_write(path.mnt);
47207 }
47208 path_put(&path);
47209 @@ -325,17 +331,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, cons
47210 const void __user *,value, size_t, size, int, flags)
47211 {
47212 struct file *f;
47213 - struct dentry *dentry;
47214 int error = -EBADF;
47215
47216 f = fget(fd);
47217 if (!f)
47218 return error;
47219 - dentry = f->f_path.dentry;
47220 - audit_inode(NULL, dentry);
47221 + audit_inode(NULL, f->f_path.dentry);
47222 error = mnt_want_write_file(f);
47223 if (!error) {
47224 - error = setxattr(dentry, name, value, size, flags);
47225 + error = setxattr(&f->f_path, name, value, size, flags);
47226 mnt_drop_write(f->f_path.mnt);
47227 }
47228 fput(f);
47229 diff -urNp linux-3.0.9/fs/xfs/linux-2.6/xfs_ioctl32.c linux-3.0.9/fs/xfs/linux-2.6/xfs_ioctl32.c
47230 --- linux-3.0.9/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-11-11 13:12:24.000000000 -0500
47231 +++ linux-3.0.9/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-11-15 20:02:59.000000000 -0500
47232 @@ -73,6 +73,7 @@ xfs_compat_ioc_fsgeometry_v1(
47233 xfs_fsop_geom_t fsgeo;
47234 int error;
47235
47236 + memset(&fsgeo, 0, sizeof(fsgeo));
47237 error = xfs_fs_geometry(mp, &fsgeo, 3);
47238 if (error)
47239 return -error;
47240 diff -urNp linux-3.0.9/fs/xfs/linux-2.6/xfs_ioctl.c linux-3.0.9/fs/xfs/linux-2.6/xfs_ioctl.c
47241 --- linux-3.0.9/fs/xfs/linux-2.6/xfs_ioctl.c 2011-11-11 13:12:24.000000000 -0500
47242 +++ linux-3.0.9/fs/xfs/linux-2.6/xfs_ioctl.c 2011-11-15 20:02:59.000000000 -0500
47243 @@ -128,7 +128,7 @@ xfs_find_handle(
47244 }
47245
47246 error = -EFAULT;
47247 - if (copy_to_user(hreq->ohandle, &handle, hsize) ||
47248 + if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
47249 copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
47250 goto out_put;
47251
47252 diff -urNp linux-3.0.9/fs/xfs/linux-2.6/xfs_iops.c linux-3.0.9/fs/xfs/linux-2.6/xfs_iops.c
47253 --- linux-3.0.9/fs/xfs/linux-2.6/xfs_iops.c 2011-11-11 13:12:24.000000000 -0500
47254 +++ linux-3.0.9/fs/xfs/linux-2.6/xfs_iops.c 2011-11-15 20:02:59.000000000 -0500
47255 @@ -437,7 +437,7 @@ xfs_vn_put_link(
47256 struct nameidata *nd,
47257 void *p)
47258 {
47259 - char *s = nd_get_link(nd);
47260 + const char *s = nd_get_link(nd);
47261
47262 if (!IS_ERR(s))
47263 kfree(s);
47264 diff -urNp linux-3.0.9/fs/xfs/xfs_bmap.c linux-3.0.9/fs/xfs/xfs_bmap.c
47265 --- linux-3.0.9/fs/xfs/xfs_bmap.c 2011-11-11 13:12:24.000000000 -0500
47266 +++ linux-3.0.9/fs/xfs/xfs_bmap.c 2011-11-15 20:02:59.000000000 -0500
47267 @@ -253,7 +253,7 @@ xfs_bmap_validate_ret(
47268 int nmap,
47269 int ret_nmap);
47270 #else
47271 -#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
47272 +#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
47273 #endif /* DEBUG */
47274
47275 STATIC int
47276 diff -urNp linux-3.0.9/fs/xfs/xfs_dir2_sf.c linux-3.0.9/fs/xfs/xfs_dir2_sf.c
47277 --- linux-3.0.9/fs/xfs/xfs_dir2_sf.c 2011-11-11 13:12:24.000000000 -0500
47278 +++ linux-3.0.9/fs/xfs/xfs_dir2_sf.c 2011-11-15 20:02:59.000000000 -0500
47279 @@ -780,7 +780,15 @@ xfs_dir2_sf_getdents(
47280 }
47281
47282 ino = xfs_dir2_sf_get_inumber(sfp, xfs_dir2_sf_inumberp(sfep));
47283 - if (filldir(dirent, (char *)sfep->name, sfep->namelen,
47284 + if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
47285 + char name[sfep->namelen];
47286 + memcpy(name, sfep->name, sfep->namelen);
47287 + if (filldir(dirent, name, sfep->namelen,
47288 + off & 0x7fffffff, ino, DT_UNKNOWN)) {
47289 + *offset = off & 0x7fffffff;
47290 + return 0;
47291 + }
47292 + } else if (filldir(dirent, (char *)sfep->name, sfep->namelen,
47293 off & 0x7fffffff, ino, DT_UNKNOWN)) {
47294 *offset = off & 0x7fffffff;
47295 return 0;
47296 diff -urNp linux-3.0.9/grsecurity/gracl_alloc.c linux-3.0.9/grsecurity/gracl_alloc.c
47297 --- linux-3.0.9/grsecurity/gracl_alloc.c 1969-12-31 19:00:00.000000000 -0500
47298 +++ linux-3.0.9/grsecurity/gracl_alloc.c 2011-11-15 20:02:59.000000000 -0500
47299 @@ -0,0 +1,105 @@
47300 +#include <linux/kernel.h>
47301 +#include <linux/mm.h>
47302 +#include <linux/slab.h>
47303 +#include <linux/vmalloc.h>
47304 +#include <linux/gracl.h>
47305 +#include <linux/grsecurity.h>
47306 +
47307 +static unsigned long alloc_stack_next = 1;
47308 +static unsigned long alloc_stack_size = 1;
47309 +static void **alloc_stack;
47310 +
47311 +static __inline__ int
47312 +alloc_pop(void)
47313 +{
47314 + if (alloc_stack_next == 1)
47315 + return 0;
47316 +
47317 + kfree(alloc_stack[alloc_stack_next - 2]);
47318 +
47319 + alloc_stack_next--;
47320 +
47321 + return 1;
47322 +}
47323 +
47324 +static __inline__ int
47325 +alloc_push(void *buf)
47326 +{
47327 + if (alloc_stack_next >= alloc_stack_size)
47328 + return 1;
47329 +
47330 + alloc_stack[alloc_stack_next - 1] = buf;
47331 +
47332 + alloc_stack_next++;
47333 +
47334 + return 0;
47335 +}
47336 +
47337 +void *
47338 +acl_alloc(unsigned long len)
47339 +{
47340 + void *ret = NULL;
47341 +
47342 + if (!len || len > PAGE_SIZE)
47343 + goto out;
47344 +
47345 + ret = kmalloc(len, GFP_KERNEL);
47346 +
47347 + if (ret) {
47348 + if (alloc_push(ret)) {
47349 + kfree(ret);
47350 + ret = NULL;
47351 + }
47352 + }
47353 +
47354 +out:
47355 + return ret;
47356 +}
47357 +
47358 +void *
47359 +acl_alloc_num(unsigned long num, unsigned long len)
47360 +{
47361 + if (!len || (num > (PAGE_SIZE / len)))
47362 + return NULL;
47363 +
47364 + return acl_alloc(num * len);
47365 +}
47366 +
47367 +void
47368 +acl_free_all(void)
47369 +{
47370 + if (gr_acl_is_enabled() || !alloc_stack)
47371 + return;
47372 +
47373 + while (alloc_pop()) ;
47374 +
47375 + if (alloc_stack) {
47376 + if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
47377 + kfree(alloc_stack);
47378 + else
47379 + vfree(alloc_stack);
47380 + }
47381 +
47382 + alloc_stack = NULL;
47383 + alloc_stack_size = 1;
47384 + alloc_stack_next = 1;
47385 +
47386 + return;
47387 +}
47388 +
47389 +int
47390 +acl_alloc_stack_init(unsigned long size)
47391 +{
47392 + if ((size * sizeof (void *)) <= PAGE_SIZE)
47393 + alloc_stack =
47394 + (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
47395 + else
47396 + alloc_stack = (void **) vmalloc(size * sizeof (void *));
47397 +
47398 + alloc_stack_size = size;
47399 +
47400 + if (!alloc_stack)
47401 + return 0;
47402 + else
47403 + return 1;
47404 +}
47405 diff -urNp linux-3.0.9/grsecurity/gracl.c linux-3.0.9/grsecurity/gracl.c
47406 --- linux-3.0.9/grsecurity/gracl.c 1969-12-31 19:00:00.000000000 -0500
47407 +++ linux-3.0.9/grsecurity/gracl.c 2011-11-16 17:50:21.000000000 -0500
47408 @@ -0,0 +1,4155 @@
47409 +#include <linux/kernel.h>
47410 +#include <linux/module.h>
47411 +#include <linux/sched.h>
47412 +#include <linux/mm.h>
47413 +#include <linux/file.h>
47414 +#include <linux/fs.h>
47415 +#include <linux/namei.h>
47416 +#include <linux/mount.h>
47417 +#include <linux/tty.h>
47418 +#include <linux/proc_fs.h>
47419 +#include <linux/lglock.h>
47420 +#include <linux/slab.h>
47421 +#include <linux/vmalloc.h>
47422 +#include <linux/types.h>
47423 +#include <linux/sysctl.h>
47424 +#include <linux/netdevice.h>
47425 +#include <linux/ptrace.h>
47426 +#include <linux/gracl.h>
47427 +#include <linux/gralloc.h>
47428 +#include <linux/grsecurity.h>
47429 +#include <linux/grinternal.h>
47430 +#include <linux/pid_namespace.h>
47431 +#include <linux/fdtable.h>
47432 +#include <linux/percpu.h>
47433 +
47434 +#include <asm/uaccess.h>
47435 +#include <asm/errno.h>
47436 +#include <asm/mman.h>
47437 +
47438 +static struct acl_role_db acl_role_set;
47439 +static struct name_db name_set;
47440 +static struct inodev_db inodev_set;
47441 +
47442 +/* for keeping track of userspace pointers used for subjects, so we
47443 + can share references in the kernel as well
47444 +*/
47445 +
47446 +static struct path real_root;
47447 +
47448 +static struct acl_subj_map_db subj_map_set;
47449 +
47450 +static struct acl_role_label *default_role;
47451 +
47452 +static struct acl_role_label *role_list;
47453 +
47454 +static u16 acl_sp_role_value;
47455 +
47456 +extern char *gr_shared_page[4];
47457 +static DEFINE_MUTEX(gr_dev_mutex);
47458 +DEFINE_RWLOCK(gr_inode_lock);
47459 +
47460 +struct gr_arg *gr_usermode;
47461 +
47462 +static unsigned int gr_status __read_only = GR_STATUS_INIT;
47463 +
47464 +extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
47465 +extern void gr_clear_learn_entries(void);
47466 +
47467 +#ifdef CONFIG_GRKERNSEC_RESLOG
47468 +extern void gr_log_resource(const struct task_struct *task,
47469 + const int res, const unsigned long wanted, const int gt);
47470 +#endif
47471 +
47472 +unsigned char *gr_system_salt;
47473 +unsigned char *gr_system_sum;
47474 +
47475 +static struct sprole_pw **acl_special_roles = NULL;
47476 +static __u16 num_sprole_pws = 0;
47477 +
47478 +static struct acl_role_label *kernel_role = NULL;
47479 +
47480 +static unsigned int gr_auth_attempts = 0;
47481 +static unsigned long gr_auth_expires = 0UL;
47482 +
47483 +#ifdef CONFIG_NET
47484 +extern struct vfsmount *sock_mnt;
47485 +#endif
47486 +
47487 +extern struct vfsmount *pipe_mnt;
47488 +extern struct vfsmount *shm_mnt;
47489 +#ifdef CONFIG_HUGETLBFS
47490 +extern struct vfsmount *hugetlbfs_vfsmount;
47491 +#endif
47492 +
47493 +static struct acl_object_label *fakefs_obj_rw;
47494 +static struct acl_object_label *fakefs_obj_rwx;
47495 +
47496 +extern int gr_init_uidset(void);
47497 +extern void gr_free_uidset(void);
47498 +extern void gr_remove_uid(uid_t uid);
47499 +extern int gr_find_uid(uid_t uid);
47500 +
47501 +DECLARE_BRLOCK(vfsmount_lock);
47502 +
47503 +__inline__ int
47504 +gr_acl_is_enabled(void)
47505 +{
47506 + return (gr_status & GR_READY);
47507 +}
47508 +
47509 +#ifdef CONFIG_BTRFS_FS
47510 +extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
47511 +extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
47512 +#endif
47513 +
47514 +static inline dev_t __get_dev(const struct dentry *dentry)
47515 +{
47516 +#ifdef CONFIG_BTRFS_FS
47517 + if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
47518 + return get_btrfs_dev_from_inode(dentry->d_inode);
47519 + else
47520 +#endif
47521 + return dentry->d_inode->i_sb->s_dev;
47522 +}
47523 +
47524 +dev_t gr_get_dev_from_dentry(struct dentry *dentry)
47525 +{
47526 + return __get_dev(dentry);
47527 +}
47528 +
47529 +static char gr_task_roletype_to_char(struct task_struct *task)
47530 +{
47531 + switch (task->role->roletype &
47532 + (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
47533 + GR_ROLE_SPECIAL)) {
47534 + case GR_ROLE_DEFAULT:
47535 + return 'D';
47536 + case GR_ROLE_USER:
47537 + return 'U';
47538 + case GR_ROLE_GROUP:
47539 + return 'G';
47540 + case GR_ROLE_SPECIAL:
47541 + return 'S';
47542 + }
47543 +
47544 + return 'X';
47545 +}
47546 +
47547 +char gr_roletype_to_char(void)
47548 +{
47549 + return gr_task_roletype_to_char(current);
47550 +}
47551 +
47552 +__inline__ int
47553 +gr_acl_tpe_check(void)
47554 +{
47555 + if (unlikely(!(gr_status & GR_READY)))
47556 + return 0;
47557 + if (current->role->roletype & GR_ROLE_TPE)
47558 + return 1;
47559 + else
47560 + return 0;
47561 +}
47562 +
47563 +int
47564 +gr_handle_rawio(const struct inode *inode)
47565 +{
47566 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
47567 + if (inode && S_ISBLK(inode->i_mode) &&
47568 + grsec_enable_chroot_caps && proc_is_chrooted(current) &&
47569 + !capable(CAP_SYS_RAWIO))
47570 + return 1;
47571 +#endif
47572 + return 0;
47573 +}
47574 +
47575 +static int
47576 +gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
47577 +{
47578 + if (likely(lena != lenb))
47579 + return 0;
47580 +
47581 + return !memcmp(a, b, lena);
47582 +}
47583 +
47584 +static int prepend(char **buffer, int *buflen, const char *str, int namelen)
47585 +{
47586 + *buflen -= namelen;
47587 + if (*buflen < 0)
47588 + return -ENAMETOOLONG;
47589 + *buffer -= namelen;
47590 + memcpy(*buffer, str, namelen);
47591 + return 0;
47592 +}
47593 +
47594 +static int prepend_name(char **buffer, int *buflen, struct qstr *name)
47595 +{
47596 + return prepend(buffer, buflen, name->name, name->len);
47597 +}
47598 +
47599 +static int prepend_path(const struct path *path, struct path *root,
47600 + char **buffer, int *buflen)
47601 +{
47602 + struct dentry *dentry = path->dentry;
47603 + struct vfsmount *vfsmnt = path->mnt;
47604 + bool slash = false;
47605 + int error = 0;
47606 +
47607 + while (dentry != root->dentry || vfsmnt != root->mnt) {
47608 + struct dentry * parent;
47609 +
47610 + if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
47611 + /* Global root? */
47612 + if (vfsmnt->mnt_parent == vfsmnt) {
47613 + goto out;
47614 + }
47615 + dentry = vfsmnt->mnt_mountpoint;
47616 + vfsmnt = vfsmnt->mnt_parent;
47617 + continue;
47618 + }
47619 + parent = dentry->d_parent;
47620 + prefetch(parent);
47621 + spin_lock(&dentry->d_lock);
47622 + error = prepend_name(buffer, buflen, &dentry->d_name);
47623 + spin_unlock(&dentry->d_lock);
47624 + if (!error)
47625 + error = prepend(buffer, buflen, "/", 1);
47626 + if (error)
47627 + break;
47628 +
47629 + slash = true;
47630 + dentry = parent;
47631 + }
47632 +
47633 +out:
47634 + if (!error && !slash)
47635 + error = prepend(buffer, buflen, "/", 1);
47636 +
47637 + return error;
47638 +}
47639 +
47640 +/* this must be called with vfsmount_lock and rename_lock held */
47641 +
47642 +static char *__our_d_path(const struct path *path, struct path *root,
47643 + char *buf, int buflen)
47644 +{
47645 + char *res = buf + buflen;
47646 + int error;
47647 +
47648 + prepend(&res, &buflen, "\0", 1);
47649 + error = prepend_path(path, root, &res, &buflen);
47650 + if (error)
47651 + return ERR_PTR(error);
47652 +
47653 + return res;
47654 +}
47655 +
47656 +static char *
47657 +gen_full_path(struct path *path, struct path *root, char *buf, int buflen)
47658 +{
47659 + char *retval;
47660 +
47661 + retval = __our_d_path(path, root, buf, buflen);
47662 + if (unlikely(IS_ERR(retval)))
47663 + retval = strcpy(buf, "<path too long>");
47664 + else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
47665 + retval[1] = '\0';
47666 +
47667 + return retval;
47668 +}
47669 +
47670 +static char *
47671 +__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
47672 + char *buf, int buflen)
47673 +{
47674 + struct path path;
47675 + char *res;
47676 +
47677 + path.dentry = (struct dentry *)dentry;
47678 + path.mnt = (struct vfsmount *)vfsmnt;
47679 +
47680 + /* we can use real_root.dentry, real_root.mnt, because this is only called
47681 + by the RBAC system */
47682 + res = gen_full_path(&path, &real_root, buf, buflen);
47683 +
47684 + return res;
47685 +}
47686 +
47687 +static char *
47688 +d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
47689 + char *buf, int buflen)
47690 +{
47691 + char *res;
47692 + struct path path;
47693 + struct path root;
47694 + struct task_struct *reaper = &init_task;
47695 +
47696 + path.dentry = (struct dentry *)dentry;
47697 + path.mnt = (struct vfsmount *)vfsmnt;
47698 +
47699 + /* we can't use real_root.dentry, real_root.mnt, because they belong only to the RBAC system */
47700 + get_fs_root(reaper->fs, &root);
47701 +
47702 + write_seqlock(&rename_lock);
47703 + br_read_lock(vfsmount_lock);
47704 + res = gen_full_path(&path, &root, buf, buflen);
47705 + br_read_unlock(vfsmount_lock);
47706 + write_sequnlock(&rename_lock);
47707 +
47708 + path_put(&root);
47709 + return res;
47710 +}
47711 +
47712 +static char *
47713 +gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
47714 +{
47715 + char *ret;
47716 + write_seqlock(&rename_lock);
47717 + br_read_lock(vfsmount_lock);
47718 + ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
47719 + PAGE_SIZE);
47720 + br_read_unlock(vfsmount_lock);
47721 + write_sequnlock(&rename_lock);
47722 + return ret;
47723 +}
47724 +
47725 +static char *
47726 +gr_to_proc_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
47727 +{
47728 + char *ret;
47729 + char *buf;
47730 + int buflen;
47731 +
47732 + write_seqlock(&rename_lock);
47733 + br_read_lock(vfsmount_lock);
47734 + buf = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
47735 + ret = __d_real_path(dentry, mnt, buf, PAGE_SIZE - 6);
47736 + buflen = (int)(ret - buf);
47737 + if (buflen >= 5)
47738 + prepend(&ret, &buflen, "/proc", 5);
47739 + else
47740 + ret = strcpy(buf, "<path too long>");
47741 + br_read_unlock(vfsmount_lock);
47742 + write_sequnlock(&rename_lock);
47743 + return ret;
47744 +}
47745 +
47746 +char *
47747 +gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
47748 +{
47749 + return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
47750 + PAGE_SIZE);
47751 +}
47752 +
47753 +char *
47754 +gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
47755 +{
47756 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
47757 + PAGE_SIZE);
47758 +}
47759 +
47760 +char *
47761 +gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
47762 +{
47763 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
47764 + PAGE_SIZE);
47765 +}
47766 +
47767 +char *
47768 +gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
47769 +{
47770 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
47771 + PAGE_SIZE);
47772 +}
47773 +
47774 +char *
47775 +gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
47776 +{
47777 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
47778 + PAGE_SIZE);
47779 +}
47780 +
47781 +__inline__ __u32
47782 +to_gr_audit(const __u32 reqmode)
47783 +{
47784 + /* masks off auditable permission flags, then shifts them to create
47785 + auditing flags, and adds the special case of append auditing if
47786 + we're requesting write */
47787 + return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
47788 +}
47789 +
47790 +struct acl_subject_label *
47791 +lookup_subject_map(const struct acl_subject_label *userp)
47792 +{
47793 + unsigned int index = shash(userp, subj_map_set.s_size);
47794 + struct subject_map *match;
47795 +
47796 + match = subj_map_set.s_hash[index];
47797 +
47798 + while (match && match->user != userp)
47799 + match = match->next;
47800 +
47801 + if (match != NULL)
47802 + return match->kernel;
47803 + else
47804 + return NULL;
47805 +}
47806 +
47807 +static void
47808 +insert_subj_map_entry(struct subject_map *subjmap)
47809 +{
47810 + unsigned int index = shash(subjmap->user, subj_map_set.s_size);
47811 + struct subject_map **curr;
47812 +
47813 + subjmap->prev = NULL;
47814 +
47815 + curr = &subj_map_set.s_hash[index];
47816 + if (*curr != NULL)
47817 + (*curr)->prev = subjmap;
47818 +
47819 + subjmap->next = *curr;
47820 + *curr = subjmap;
47821 +
47822 + return;
47823 +}
47824 +
47825 +static struct acl_role_label *
47826 +lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
47827 + const gid_t gid)
47828 +{
47829 + unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
47830 + struct acl_role_label *match;
47831 + struct role_allowed_ip *ipp;
47832 + unsigned int x;
47833 + u32 curr_ip = task->signal->curr_ip;
47834 +
47835 + task->signal->saved_ip = curr_ip;
47836 +
47837 + match = acl_role_set.r_hash[index];
47838 +
47839 + while (match) {
47840 + if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
47841 + for (x = 0; x < match->domain_child_num; x++) {
47842 + if (match->domain_children[x] == uid)
47843 + goto found;
47844 + }
47845 + } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
47846 + break;
47847 + match = match->next;
47848 + }
47849 +found:
47850 + if (match == NULL) {
47851 + try_group:
47852 + index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
47853 + match = acl_role_set.r_hash[index];
47854 +
47855 + while (match) {
47856 + if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
47857 + for (x = 0; x < match->domain_child_num; x++) {
47858 + if (match->domain_children[x] == gid)
47859 + goto found2;
47860 + }
47861 + } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
47862 + break;
47863 + match = match->next;
47864 + }
47865 +found2:
47866 + if (match == NULL)
47867 + match = default_role;
47868 + if (match->allowed_ips == NULL)
47869 + return match;
47870 + else {
47871 + for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
47872 + if (likely
47873 + ((ntohl(curr_ip) & ipp->netmask) ==
47874 + (ntohl(ipp->addr) & ipp->netmask)))
47875 + return match;
47876 + }
47877 + match = default_role;
47878 + }
47879 + } else if (match->allowed_ips == NULL) {
47880 + return match;
47881 + } else {
47882 + for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
47883 + if (likely
47884 + ((ntohl(curr_ip) & ipp->netmask) ==
47885 + (ntohl(ipp->addr) & ipp->netmask)))
47886 + return match;
47887 + }
47888 + goto try_group;
47889 + }
47890 +
47891 + return match;
47892 +}
47893 +
47894 +struct acl_subject_label *
47895 +lookup_acl_subj_label(const ino_t ino, const dev_t dev,
47896 + const struct acl_role_label *role)
47897 +{
47898 + unsigned int index = fhash(ino, dev, role->subj_hash_size);
47899 + struct acl_subject_label *match;
47900 +
47901 + match = role->subj_hash[index];
47902 +
47903 + while (match && (match->inode != ino || match->device != dev ||
47904 + (match->mode & GR_DELETED))) {
47905 + match = match->next;
47906 + }
47907 +
47908 + if (match && !(match->mode & GR_DELETED))
47909 + return match;
47910 + else
47911 + return NULL;
47912 +}
47913 +
47914 +struct acl_subject_label *
47915 +lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
47916 + const struct acl_role_label *role)
47917 +{
47918 + unsigned int index = fhash(ino, dev, role->subj_hash_size);
47919 + struct acl_subject_label *match;
47920 +
47921 + match = role->subj_hash[index];
47922 +
47923 + while (match && (match->inode != ino || match->device != dev ||
47924 + !(match->mode & GR_DELETED))) {
47925 + match = match->next;
47926 + }
47927 +
47928 + if (match && (match->mode & GR_DELETED))
47929 + return match;
47930 + else
47931 + return NULL;
47932 +}
47933 +
47934 +static struct acl_object_label *
47935 +lookup_acl_obj_label(const ino_t ino, const dev_t dev,
47936 + const struct acl_subject_label *subj)
47937 +{
47938 + unsigned int index = fhash(ino, dev, subj->obj_hash_size);
47939 + struct acl_object_label *match;
47940 +
47941 + match = subj->obj_hash[index];
47942 +
47943 + while (match && (match->inode != ino || match->device != dev ||
47944 + (match->mode & GR_DELETED))) {
47945 + match = match->next;
47946 + }
47947 +
47948 + if (match && !(match->mode & GR_DELETED))
47949 + return match;
47950 + else
47951 + return NULL;
47952 +}
47953 +
47954 +static struct acl_object_label *
47955 +lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
47956 + const struct acl_subject_label *subj)
47957 +{
47958 + unsigned int index = fhash(ino, dev, subj->obj_hash_size);
47959 + struct acl_object_label *match;
47960 +
47961 + match = subj->obj_hash[index];
47962 +
47963 + while (match && (match->inode != ino || match->device != dev ||
47964 + !(match->mode & GR_DELETED))) {
47965 + match = match->next;
47966 + }
47967 +
47968 + if (match && (match->mode & GR_DELETED))
47969 + return match;
47970 +
47971 + match = subj->obj_hash[index];
47972 +
47973 + while (match && (match->inode != ino || match->device != dev ||
47974 + (match->mode & GR_DELETED))) {
47975 + match = match->next;
47976 + }
47977 +
47978 + if (match && !(match->mode & GR_DELETED))
47979 + return match;
47980 + else
47981 + return NULL;
47982 +}
47983 +
47984 +static struct name_entry *
47985 +lookup_name_entry(const char *name)
47986 +{
47987 + unsigned int len = strlen(name);
47988 + unsigned int key = full_name_hash(name, len);
47989 + unsigned int index = key % name_set.n_size;
47990 + struct name_entry *match;
47991 +
47992 + match = name_set.n_hash[index];
47993 +
47994 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
47995 + match = match->next;
47996 +
47997 + return match;
47998 +}
47999 +
48000 +static struct name_entry *
48001 +lookup_name_entry_create(const char *name)
48002 +{
48003 + unsigned int len = strlen(name);
48004 + unsigned int key = full_name_hash(name, len);
48005 + unsigned int index = key % name_set.n_size;
48006 + struct name_entry *match;
48007 +
48008 + match = name_set.n_hash[index];
48009 +
48010 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
48011 + !match->deleted))
48012 + match = match->next;
48013 +
48014 + if (match && match->deleted)
48015 + return match;
48016 +
48017 + match = name_set.n_hash[index];
48018 +
48019 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
48020 + match->deleted))
48021 + match = match->next;
48022 +
48023 + if (match && !match->deleted)
48024 + return match;
48025 + else
48026 + return NULL;
48027 +}
48028 +
48029 +static struct inodev_entry *
48030 +lookup_inodev_entry(const ino_t ino, const dev_t dev)
48031 +{
48032 + unsigned int index = fhash(ino, dev, inodev_set.i_size);
48033 + struct inodev_entry *match;
48034 +
48035 + match = inodev_set.i_hash[index];
48036 +
48037 + while (match && (match->nentry->inode != ino || match->nentry->device != dev))
48038 + match = match->next;
48039 +
48040 + return match;
48041 +}
48042 +
48043 +static void
48044 +insert_inodev_entry(struct inodev_entry *entry)
48045 +{
48046 + unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
48047 + inodev_set.i_size);
48048 + struct inodev_entry **curr;
48049 +
48050 + entry->prev = NULL;
48051 +
48052 + curr = &inodev_set.i_hash[index];
48053 + if (*curr != NULL)
48054 + (*curr)->prev = entry;
48055 +
48056 + entry->next = *curr;
48057 + *curr = entry;
48058 +
48059 + return;
48060 +}
48061 +
48062 +static void
48063 +__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
48064 +{
48065 + unsigned int index =
48066 + rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
48067 + struct acl_role_label **curr;
48068 + struct acl_role_label *tmp;
48069 +
48070 + curr = &acl_role_set.r_hash[index];
48071 +
48072 + /* if role was already inserted due to domains and already has
48073 + a role in the same bucket as it attached, then we need to
48074 + combine these two buckets
48075 + */
48076 + if (role->next) {
48077 + tmp = role->next;
48078 + while (tmp->next)
48079 + tmp = tmp->next;
48080 + tmp->next = *curr;
48081 + } else
48082 + role->next = *curr;
48083 + *curr = role;
48084 +
48085 + return;
48086 +}
48087 +
48088 +static void
48089 +insert_acl_role_label(struct acl_role_label *role)
48090 +{
48091 + int i;
48092 +
48093 + if (role_list == NULL) {
48094 + role_list = role;
48095 + role->prev = NULL;
48096 + } else {
48097 + role->prev = role_list;
48098 + role_list = role;
48099 + }
48100 +
48101 + /* used for hash chains */
48102 + role->next = NULL;
48103 +
48104 + if (role->roletype & GR_ROLE_DOMAIN) {
48105 + for (i = 0; i < role->domain_child_num; i++)
48106 + __insert_acl_role_label(role, role->domain_children[i]);
48107 + } else
48108 + __insert_acl_role_label(role, role->uidgid);
48109 +}
48110 +
48111 +static int
48112 +insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
48113 +{
48114 + struct name_entry **curr, *nentry;
48115 + struct inodev_entry *ientry;
48116 + unsigned int len = strlen(name);
48117 + unsigned int key = full_name_hash(name, len);
48118 + unsigned int index = key % name_set.n_size;
48119 +
48120 + curr = &name_set.n_hash[index];
48121 +
48122 + while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
48123 + curr = &((*curr)->next);
48124 +
48125 + if (*curr != NULL)
48126 + return 1;
48127 +
48128 + nentry = acl_alloc(sizeof (struct name_entry));
48129 + if (nentry == NULL)
48130 + return 0;
48131 + ientry = acl_alloc(sizeof (struct inodev_entry));
48132 + if (ientry == NULL)
48133 + return 0;
48134 + ientry->nentry = nentry;
48135 +
48136 + nentry->key = key;
48137 + nentry->name = name;
48138 + nentry->inode = inode;
48139 + nentry->device = device;
48140 + nentry->len = len;
48141 + nentry->deleted = deleted;
48142 +
48143 + nentry->prev = NULL;
48144 + curr = &name_set.n_hash[index];
48145 + if (*curr != NULL)
48146 + (*curr)->prev = nentry;
48147 + nentry->next = *curr;
48148 + *curr = nentry;
48149 +
48150 + /* insert us into the table searchable by inode/dev */
48151 + insert_inodev_entry(ientry);
48152 +
48153 + return 1;
48154 +}
48155 +
48156 +static void
48157 +insert_acl_obj_label(struct acl_object_label *obj,
48158 + struct acl_subject_label *subj)
48159 +{
48160 + unsigned int index =
48161 + fhash(obj->inode, obj->device, subj->obj_hash_size);
48162 + struct acl_object_label **curr;
48163 +
48164 +
48165 + obj->prev = NULL;
48166 +
48167 + curr = &subj->obj_hash[index];
48168 + if (*curr != NULL)
48169 + (*curr)->prev = obj;
48170 +
48171 + obj->next = *curr;
48172 + *curr = obj;
48173 +
48174 + return;
48175 +}
48176 +
48177 +static void
48178 +insert_acl_subj_label(struct acl_subject_label *obj,
48179 + struct acl_role_label *role)
48180 +{
48181 + unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
48182 + struct acl_subject_label **curr;
48183 +
48184 + obj->prev = NULL;
48185 +
48186 + curr = &role->subj_hash[index];
48187 + if (*curr != NULL)
48188 + (*curr)->prev = obj;
48189 +
48190 + obj->next = *curr;
48191 + *curr = obj;
48192 +
48193 + return;
48194 +}
48195 +
48196 +/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
48197 +
48198 +static void *
48199 +create_table(__u32 * len, int elementsize)
48200 +{
48201 + unsigned int table_sizes[] = {
48202 + 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
48203 + 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
48204 + 4194301, 8388593, 16777213, 33554393, 67108859
48205 + };
48206 + void *newtable = NULL;
48207 + unsigned int pwr = 0;
48208 +
48209 + while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
48210 + table_sizes[pwr] <= *len)
48211 + pwr++;
48212 +
48213 + if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
48214 + return newtable;
48215 +
48216 + if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
48217 + newtable =
48218 + kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
48219 + else
48220 + newtable = vmalloc(table_sizes[pwr] * elementsize);
48221 +
48222 + *len = table_sizes[pwr];
48223 +
48224 + return newtable;
48225 +}
48226 +
48227 +static int
48228 +init_variables(const struct gr_arg *arg)
48229 +{
48230 + struct task_struct *reaper = &init_task;
48231 + unsigned int stacksize;
48232 +
48233 + subj_map_set.s_size = arg->role_db.num_subjects;
48234 + acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
48235 + name_set.n_size = arg->role_db.num_objects;
48236 + inodev_set.i_size = arg->role_db.num_objects;
48237 +
48238 + if (!subj_map_set.s_size || !acl_role_set.r_size ||
48239 + !name_set.n_size || !inodev_set.i_size)
48240 + return 1;
48241 +
48242 + if (!gr_init_uidset())
48243 + return 1;
48244 +
48245 + /* set up the stack that holds allocation info */
48246 +
48247 + stacksize = arg->role_db.num_pointers + 5;
48248 +
48249 + if (!acl_alloc_stack_init(stacksize))
48250 + return 1;
48251 +
48252 + /* grab reference for the real root dentry and vfsmount */
48253 + get_fs_root(reaper->fs, &real_root);
48254 +
48255 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
48256 + printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root.dentry), real_root.dentry->d_inode->i_ino);
48257 +#endif
48258 +
48259 + fakefs_obj_rw = acl_alloc(sizeof(struct acl_object_label));
48260 + if (fakefs_obj_rw == NULL)
48261 + return 1;
48262 + fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE;
48263 +
48264 + fakefs_obj_rwx = acl_alloc(sizeof(struct acl_object_label));
48265 + if (fakefs_obj_rwx == NULL)
48266 + return 1;
48267 + fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
48268 +
48269 + subj_map_set.s_hash =
48270 + (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
48271 + acl_role_set.r_hash =
48272 + (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
48273 + name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
48274 + inodev_set.i_hash =
48275 + (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
48276 +
48277 + if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
48278 + !name_set.n_hash || !inodev_set.i_hash)
48279 + return 1;
48280 +
48281 + memset(subj_map_set.s_hash, 0,
48282 + sizeof(struct subject_map *) * subj_map_set.s_size);
48283 + memset(acl_role_set.r_hash, 0,
48284 + sizeof (struct acl_role_label *) * acl_role_set.r_size);
48285 + memset(name_set.n_hash, 0,
48286 + sizeof (struct name_entry *) * name_set.n_size);
48287 + memset(inodev_set.i_hash, 0,
48288 + sizeof (struct inodev_entry *) * inodev_set.i_size);
48289 +
48290 + return 0;
48291 +}
48292 +
48293 +/* free information not needed after startup
48294 + currently contains user->kernel pointer mappings for subjects
48295 +*/
48296 +
48297 +static void
48298 +free_init_variables(void)
48299 +{
48300 + __u32 i;
48301 +
48302 + if (subj_map_set.s_hash) {
48303 + for (i = 0; i < subj_map_set.s_size; i++) {
48304 + if (subj_map_set.s_hash[i]) {
48305 + kfree(subj_map_set.s_hash[i]);
48306 + subj_map_set.s_hash[i] = NULL;
48307 + }
48308 + }
48309 +
48310 + if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
48311 + PAGE_SIZE)
48312 + kfree(subj_map_set.s_hash);
48313 + else
48314 + vfree(subj_map_set.s_hash);
48315 + }
48316 +
48317 + return;
48318 +}
48319 +
48320 +static void
48321 +free_variables(void)
48322 +{
48323 + struct acl_subject_label *s;
48324 + struct acl_role_label *r;
48325 + struct task_struct *task, *task2;
48326 + unsigned int x;
48327 +
48328 + gr_clear_learn_entries();
48329 +
48330 + read_lock(&tasklist_lock);
48331 + do_each_thread(task2, task) {
48332 + task->acl_sp_role = 0;
48333 + task->acl_role_id = 0;
48334 + task->acl = NULL;
48335 + task->role = NULL;
48336 + } while_each_thread(task2, task);
48337 + read_unlock(&tasklist_lock);
48338 +
48339 + /* release the reference to the real root dentry and vfsmount */
48340 + path_put(&real_root);
48341 +
48342 + /* free all object hash tables */
48343 +
48344 + FOR_EACH_ROLE_START(r)
48345 + if (r->subj_hash == NULL)
48346 + goto next_role;
48347 + FOR_EACH_SUBJECT_START(r, s, x)
48348 + if (s->obj_hash == NULL)
48349 + break;
48350 + if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
48351 + kfree(s->obj_hash);
48352 + else
48353 + vfree(s->obj_hash);
48354 + FOR_EACH_SUBJECT_END(s, x)
48355 + FOR_EACH_NESTED_SUBJECT_START(r, s)
48356 + if (s->obj_hash == NULL)
48357 + break;
48358 + if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
48359 + kfree(s->obj_hash);
48360 + else
48361 + vfree(s->obj_hash);
48362 + FOR_EACH_NESTED_SUBJECT_END(s)
48363 + if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
48364 + kfree(r->subj_hash);
48365 + else
48366 + vfree(r->subj_hash);
48367 + r->subj_hash = NULL;
48368 +next_role:
48369 + FOR_EACH_ROLE_END(r)
48370 +
48371 + acl_free_all();
48372 +
48373 + if (acl_role_set.r_hash) {
48374 + if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
48375 + PAGE_SIZE)
48376 + kfree(acl_role_set.r_hash);
48377 + else
48378 + vfree(acl_role_set.r_hash);
48379 + }
48380 + if (name_set.n_hash) {
48381 + if ((name_set.n_size * sizeof (struct name_entry *)) <=
48382 + PAGE_SIZE)
48383 + kfree(name_set.n_hash);
48384 + else
48385 + vfree(name_set.n_hash);
48386 + }
48387 +
48388 + if (inodev_set.i_hash) {
48389 + if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
48390 + PAGE_SIZE)
48391 + kfree(inodev_set.i_hash);
48392 + else
48393 + vfree(inodev_set.i_hash);
48394 + }
48395 +
48396 + gr_free_uidset();
48397 +
48398 + memset(&name_set, 0, sizeof (struct name_db));
48399 + memset(&inodev_set, 0, sizeof (struct inodev_db));
48400 + memset(&acl_role_set, 0, sizeof (struct acl_role_db));
48401 + memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
48402 +
48403 + default_role = NULL;
48404 + role_list = NULL;
48405 +
48406 + return;
48407 +}
48408 +
48409 +static __u32
48410 +count_user_objs(struct acl_object_label *userp)
48411 +{
48412 + struct acl_object_label o_tmp;
48413 + __u32 num = 0;
48414 +
48415 + while (userp) {
48416 + if (copy_from_user(&o_tmp, userp,
48417 + sizeof (struct acl_object_label)))
48418 + break;
48419 +
48420 + userp = o_tmp.prev;
48421 + num++;
48422 + }
48423 +
48424 + return num;
48425 +}
48426 +
48427 +static struct acl_subject_label *
48428 +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
48429 +
48430 +static int
48431 +copy_user_glob(struct acl_object_label *obj)
48432 +{
48433 + struct acl_object_label *g_tmp, **guser;
48434 + unsigned int len;
48435 + char *tmp;
48436 +
48437 + if (obj->globbed == NULL)
48438 + return 0;
48439 +
48440 + guser = &obj->globbed;
48441 + while (*guser) {
48442 + g_tmp = (struct acl_object_label *)
48443 + acl_alloc(sizeof (struct acl_object_label));
48444 + if (g_tmp == NULL)
48445 + return -ENOMEM;
48446 +
48447 + if (copy_from_user(g_tmp, *guser,
48448 + sizeof (struct acl_object_label)))
48449 + return -EFAULT;
48450 +
48451 + len = strnlen_user(g_tmp->filename, PATH_MAX);
48452 +
48453 + if (!len || len >= PATH_MAX)
48454 + return -EINVAL;
48455 +
48456 + if ((tmp = (char *) acl_alloc(len)) == NULL)
48457 + return -ENOMEM;
48458 +
48459 + if (copy_from_user(tmp, g_tmp->filename, len))
48460 + return -EFAULT;
48461 + tmp[len-1] = '\0';
48462 + g_tmp->filename = tmp;
48463 +
48464 + *guser = g_tmp;
48465 + guser = &(g_tmp->next);
48466 + }
48467 +
48468 + return 0;
48469 +}
48470 +
48471 +static int
48472 +copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
48473 + struct acl_role_label *role)
48474 +{
48475 + struct acl_object_label *o_tmp;
48476 + unsigned int len;
48477 + int ret;
48478 + char *tmp;
48479 +
48480 + while (userp) {
48481 + if ((o_tmp = (struct acl_object_label *)
48482 + acl_alloc(sizeof (struct acl_object_label))) == NULL)
48483 + return -ENOMEM;
48484 +
48485 + if (copy_from_user(o_tmp, userp,
48486 + sizeof (struct acl_object_label)))
48487 + return -EFAULT;
48488 +
48489 + userp = o_tmp->prev;
48490 +
48491 + len = strnlen_user(o_tmp->filename, PATH_MAX);
48492 +
48493 + if (!len || len >= PATH_MAX)
48494 + return -EINVAL;
48495 +
48496 + if ((tmp = (char *) acl_alloc(len)) == NULL)
48497 + return -ENOMEM;
48498 +
48499 + if (copy_from_user(tmp, o_tmp->filename, len))
48500 + return -EFAULT;
48501 + tmp[len-1] = '\0';
48502 + o_tmp->filename = tmp;
48503 +
48504 + insert_acl_obj_label(o_tmp, subj);
48505 + if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
48506 + o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
48507 + return -ENOMEM;
48508 +
48509 + ret = copy_user_glob(o_tmp);
48510 + if (ret)
48511 + return ret;
48512 +
48513 + if (o_tmp->nested) {
48514 + o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
48515 + if (IS_ERR(o_tmp->nested))
48516 + return PTR_ERR(o_tmp->nested);
48517 +
48518 + /* insert into nested subject list */
48519 + o_tmp->nested->next = role->hash->first;
48520 + role->hash->first = o_tmp->nested;
48521 + }
48522 + }
48523 +
48524 + return 0;
48525 +}
48526 +
48527 +static __u32
48528 +count_user_subjs(struct acl_subject_label *userp)
48529 +{
48530 + struct acl_subject_label s_tmp;
48531 + __u32 num = 0;
48532 +
48533 + while (userp) {
48534 + if (copy_from_user(&s_tmp, userp,
48535 + sizeof (struct acl_subject_label)))
48536 + break;
48537 +
48538 + userp = s_tmp.prev;
48539 + /* do not count nested subjects against this count, since
48540 + they are not included in the hash table, but are
48541 + attached to objects. We have already counted
48542 + the subjects in userspace for the allocation
48543 + stack
48544 + */
48545 + if (!(s_tmp.mode & GR_NESTED))
48546 + num++;
48547 + }
48548 +
48549 + return num;
48550 +}
48551 +
48552 +static int
48553 +copy_user_allowedips(struct acl_role_label *rolep)
48554 +{
48555 + struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
48556 +
48557 + ruserip = rolep->allowed_ips;
48558 +
48559 + while (ruserip) {
48560 + rlast = rtmp;
48561 +
48562 + if ((rtmp = (struct role_allowed_ip *)
48563 + acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
48564 + return -ENOMEM;
48565 +
48566 + if (copy_from_user(rtmp, ruserip,
48567 + sizeof (struct role_allowed_ip)))
48568 + return -EFAULT;
48569 +
48570 + ruserip = rtmp->prev;
48571 +
48572 + if (!rlast) {
48573 + rtmp->prev = NULL;
48574 + rolep->allowed_ips = rtmp;
48575 + } else {
48576 + rlast->next = rtmp;
48577 + rtmp->prev = rlast;
48578 + }
48579 +
48580 + if (!ruserip)
48581 + rtmp->next = NULL;
48582 + }
48583 +
48584 + return 0;
48585 +}
48586 +
48587 +static int
48588 +copy_user_transitions(struct acl_role_label *rolep)
48589 +{
48590 + struct role_transition *rusertp, *rtmp = NULL, *rlast;
48591 +
48592 + unsigned int len;
48593 + char *tmp;
48594 +
48595 + rusertp = rolep->transitions;
48596 +
48597 + while (rusertp) {
48598 + rlast = rtmp;
48599 +
48600 + if ((rtmp = (struct role_transition *)
48601 + acl_alloc(sizeof (struct role_transition))) == NULL)
48602 + return -ENOMEM;
48603 +
48604 + if (copy_from_user(rtmp, rusertp,
48605 + sizeof (struct role_transition)))
48606 + return -EFAULT;
48607 +
48608 + rusertp = rtmp->prev;
48609 +
48610 + len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
48611 +
48612 + if (!len || len >= GR_SPROLE_LEN)
48613 + return -EINVAL;
48614 +
48615 + if ((tmp = (char *) acl_alloc(len)) == NULL)
48616 + return -ENOMEM;
48617 +
48618 + if (copy_from_user(tmp, rtmp->rolename, len))
48619 + return -EFAULT;
48620 + tmp[len-1] = '\0';
48621 + rtmp->rolename = tmp;
48622 +
48623 + if (!rlast) {
48624 + rtmp->prev = NULL;
48625 + rolep->transitions = rtmp;
48626 + } else {
48627 + rlast->next = rtmp;
48628 + rtmp->prev = rlast;
48629 + }
48630 +
48631 + if (!rusertp)
48632 + rtmp->next = NULL;
48633 + }
48634 +
48635 + return 0;
48636 +}
48637 +
48638 +static struct acl_subject_label *
48639 +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
48640 +{
48641 + struct acl_subject_label *s_tmp = NULL, *s_tmp2;
48642 + unsigned int len;
48643 + char *tmp;
48644 + __u32 num_objs;
48645 + struct acl_ip_label **i_tmp, *i_utmp2;
48646 + struct gr_hash_struct ghash;
48647 + struct subject_map *subjmap;
48648 + unsigned int i_num;
48649 + int err;
48650 +
48651 + s_tmp = lookup_subject_map(userp);
48652 +
48653 + /* we've already copied this subject into the kernel, just return
48654 + the reference to it, and don't copy it over again
48655 + */
48656 + if (s_tmp)
48657 + return(s_tmp);
48658 +
48659 + if ((s_tmp = (struct acl_subject_label *)
48660 + acl_alloc(sizeof (struct acl_subject_label))) == NULL)
48661 + return ERR_PTR(-ENOMEM);
48662 +
48663 + subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
48664 + if (subjmap == NULL)
48665 + return ERR_PTR(-ENOMEM);
48666 +
48667 + subjmap->user = userp;
48668 + subjmap->kernel = s_tmp;
48669 + insert_subj_map_entry(subjmap);
48670 +
48671 + if (copy_from_user(s_tmp, userp,
48672 + sizeof (struct acl_subject_label)))
48673 + return ERR_PTR(-EFAULT);
48674 +
48675 + len = strnlen_user(s_tmp->filename, PATH_MAX);
48676 +
48677 + if (!len || len >= PATH_MAX)
48678 + return ERR_PTR(-EINVAL);
48679 +
48680 + if ((tmp = (char *) acl_alloc(len)) == NULL)
48681 + return ERR_PTR(-ENOMEM);
48682 +
48683 + if (copy_from_user(tmp, s_tmp->filename, len))
48684 + return ERR_PTR(-EFAULT);
48685 + tmp[len-1] = '\0';
48686 + s_tmp->filename = tmp;
48687 +
48688 + if (!strcmp(s_tmp->filename, "/"))
48689 + role->root_label = s_tmp;
48690 +
48691 + if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
48692 + return ERR_PTR(-EFAULT);
48693 +
48694 + /* copy user and group transition tables */
48695 +
48696 + if (s_tmp->user_trans_num) {
48697 + uid_t *uidlist;
48698 +
48699 + uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
48700 + if (uidlist == NULL)
48701 + return ERR_PTR(-ENOMEM);
48702 + if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
48703 + return ERR_PTR(-EFAULT);
48704 +
48705 + s_tmp->user_transitions = uidlist;
48706 + }
48707 +
48708 + if (s_tmp->group_trans_num) {
48709 + gid_t *gidlist;
48710 +
48711 + gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
48712 + if (gidlist == NULL)
48713 + return ERR_PTR(-ENOMEM);
48714 + if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
48715 + return ERR_PTR(-EFAULT);
48716 +
48717 + s_tmp->group_transitions = gidlist;
48718 + }
48719 +
48720 + /* set up object hash table */
48721 + num_objs = count_user_objs(ghash.first);
48722 +
48723 + s_tmp->obj_hash_size = num_objs;
48724 + s_tmp->obj_hash =
48725 + (struct acl_object_label **)
48726 + create_table(&(s_tmp->obj_hash_size), sizeof(void *));
48727 +
48728 + if (!s_tmp->obj_hash)
48729 + return ERR_PTR(-ENOMEM);
48730 +
48731 + memset(s_tmp->obj_hash, 0,
48732 + s_tmp->obj_hash_size *
48733 + sizeof (struct acl_object_label *));
48734 +
48735 + /* add in objects */
48736 + err = copy_user_objs(ghash.first, s_tmp, role);
48737 +
48738 + if (err)
48739 + return ERR_PTR(err);
48740 +
48741 + /* set pointer for parent subject */
48742 + if (s_tmp->parent_subject) {
48743 + s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
48744 +
48745 + if (IS_ERR(s_tmp2))
48746 + return s_tmp2;
48747 +
48748 + s_tmp->parent_subject = s_tmp2;
48749 + }
48750 +
48751 + /* add in ip acls */
48752 +
48753 + if (!s_tmp->ip_num) {
48754 + s_tmp->ips = NULL;
48755 + goto insert;
48756 + }
48757 +
48758 + i_tmp =
48759 + (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
48760 + sizeof (struct acl_ip_label *));
48761 +
48762 + if (!i_tmp)
48763 + return ERR_PTR(-ENOMEM);
48764 +
48765 + for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
48766 + *(i_tmp + i_num) =
48767 + (struct acl_ip_label *)
48768 + acl_alloc(sizeof (struct acl_ip_label));
48769 + if (!*(i_tmp + i_num))
48770 + return ERR_PTR(-ENOMEM);
48771 +
48772 + if (copy_from_user
48773 + (&i_utmp2, s_tmp->ips + i_num,
48774 + sizeof (struct acl_ip_label *)))
48775 + return ERR_PTR(-EFAULT);
48776 +
48777 + if (copy_from_user
48778 + (*(i_tmp + i_num), i_utmp2,
48779 + sizeof (struct acl_ip_label)))
48780 + return ERR_PTR(-EFAULT);
48781 +
48782 + if ((*(i_tmp + i_num))->iface == NULL)
48783 + continue;
48784 +
48785 + len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
48786 + if (!len || len >= IFNAMSIZ)
48787 + return ERR_PTR(-EINVAL);
48788 + tmp = acl_alloc(len);
48789 + if (tmp == NULL)
48790 + return ERR_PTR(-ENOMEM);
48791 + if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
48792 + return ERR_PTR(-EFAULT);
48793 + (*(i_tmp + i_num))->iface = tmp;
48794 + }
48795 +
48796 + s_tmp->ips = i_tmp;
48797 +
48798 +insert:
48799 + if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
48800 + s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
48801 + return ERR_PTR(-ENOMEM);
48802 +
48803 + return s_tmp;
48804 +}
48805 +
48806 +static int
48807 +copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
48808 +{
48809 + struct acl_subject_label s_pre;
48810 + struct acl_subject_label * ret;
48811 + int err;
48812 +
48813 + while (userp) {
48814 + if (copy_from_user(&s_pre, userp,
48815 + sizeof (struct acl_subject_label)))
48816 + return -EFAULT;
48817 +
48818 + /* do not add nested subjects here, add
48819 + while parsing objects
48820 + */
48821 +
48822 + if (s_pre.mode & GR_NESTED) {
48823 + userp = s_pre.prev;
48824 + continue;
48825 + }
48826 +
48827 + ret = do_copy_user_subj(userp, role);
48828 +
48829 + err = PTR_ERR(ret);
48830 + if (IS_ERR(ret))
48831 + return err;
48832 +
48833 + insert_acl_subj_label(ret, role);
48834 +
48835 + userp = s_pre.prev;
48836 + }
48837 +
48838 + return 0;
48839 +}
48840 +
48841 +static int
48842 +copy_user_acl(struct gr_arg *arg)
48843 +{
48844 + struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
48845 + struct sprole_pw *sptmp;
48846 + struct gr_hash_struct *ghash;
48847 + uid_t *domainlist;
48848 + unsigned int r_num;
48849 + unsigned int len;
48850 + char *tmp;
48851 + int err = 0;
48852 + __u16 i;
48853 + __u32 num_subjs;
48854 +
48855 + /* we need a default and kernel role */
48856 + if (arg->role_db.num_roles < 2)
48857 + return -EINVAL;
48858 +
48859 + /* copy special role authentication info from userspace */
48860 +
48861 + num_sprole_pws = arg->num_sprole_pws;
48862 + acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
48863 +
48864 + if (!acl_special_roles) {
48865 + err = -ENOMEM;
48866 + goto cleanup;
48867 + }
48868 +
48869 + for (i = 0; i < num_sprole_pws; i++) {
48870 + sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
48871 + if (!sptmp) {
48872 + err = -ENOMEM;
48873 + goto cleanup;
48874 + }
48875 + if (copy_from_user(sptmp, arg->sprole_pws + i,
48876 + sizeof (struct sprole_pw))) {
48877 + err = -EFAULT;
48878 + goto cleanup;
48879 + }
48880 +
48881 + len =
48882 + strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
48883 +
48884 + if (!len || len >= GR_SPROLE_LEN) {
48885 + err = -EINVAL;
48886 + goto cleanup;
48887 + }
48888 +
48889 + if ((tmp = (char *) acl_alloc(len)) == NULL) {
48890 + err = -ENOMEM;
48891 + goto cleanup;
48892 + }
48893 +
48894 + if (copy_from_user(tmp, sptmp->rolename, len)) {
48895 + err = -EFAULT;
48896 + goto cleanup;
48897 + }
48898 + tmp[len-1] = '\0';
48899 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
48900 + printk(KERN_ALERT "Copying special role %s\n", tmp);
48901 +#endif
48902 + sptmp->rolename = tmp;
48903 + acl_special_roles[i] = sptmp;
48904 + }
48905 +
48906 + r_utmp = (struct acl_role_label **) arg->role_db.r_table;
48907 +
48908 + for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
48909 + r_tmp = acl_alloc(sizeof (struct acl_role_label));
48910 +
48911 + if (!r_tmp) {
48912 + err = -ENOMEM;
48913 + goto cleanup;
48914 + }
48915 +
48916 + if (copy_from_user(&r_utmp2, r_utmp + r_num,
48917 + sizeof (struct acl_role_label *))) {
48918 + err = -EFAULT;
48919 + goto cleanup;
48920 + }
48921 +
48922 + if (copy_from_user(r_tmp, r_utmp2,
48923 + sizeof (struct acl_role_label))) {
48924 + err = -EFAULT;
48925 + goto cleanup;
48926 + }
48927 +
48928 + len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
48929 +
48930 + if (!len || len >= PATH_MAX) {
48931 + err = -EINVAL;
48932 + goto cleanup;
48933 + }
48934 +
48935 + if ((tmp = (char *) acl_alloc(len)) == NULL) {
48936 + err = -ENOMEM;
48937 + goto cleanup;
48938 + }
48939 + if (copy_from_user(tmp, r_tmp->rolename, len)) {
48940 + err = -EFAULT;
48941 + goto cleanup;
48942 + }
48943 + tmp[len-1] = '\0';
48944 + r_tmp->rolename = tmp;
48945 +
48946 + if (!strcmp(r_tmp->rolename, "default")
48947 + && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
48948 + default_role = r_tmp;
48949 + } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
48950 + kernel_role = r_tmp;
48951 + }
48952 +
48953 + if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
48954 + err = -ENOMEM;
48955 + goto cleanup;
48956 + }
48957 + if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
48958 + err = -EFAULT;
48959 + goto cleanup;
48960 + }
48961 +
48962 + r_tmp->hash = ghash;
48963 +
48964 + num_subjs = count_user_subjs(r_tmp->hash->first);
48965 +
48966 + r_tmp->subj_hash_size = num_subjs;
48967 + r_tmp->subj_hash =
48968 + (struct acl_subject_label **)
48969 + create_table(&(r_tmp->subj_hash_size), sizeof(void *));
48970 +
48971 + if (!r_tmp->subj_hash) {
48972 + err = -ENOMEM;
48973 + goto cleanup;
48974 + }
48975 +
48976 + err = copy_user_allowedips(r_tmp);
48977 + if (err)
48978 + goto cleanup;
48979 +
48980 + /* copy domain info */
48981 + if (r_tmp->domain_children != NULL) {
48982 + domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
48983 + if (domainlist == NULL) {
48984 + err = -ENOMEM;
48985 + goto cleanup;
48986 + }
48987 + if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
48988 + err = -EFAULT;
48989 + goto cleanup;
48990 + }
48991 + r_tmp->domain_children = domainlist;
48992 + }
48993 +
48994 + err = copy_user_transitions(r_tmp);
48995 + if (err)
48996 + goto cleanup;
48997 +
48998 + memset(r_tmp->subj_hash, 0,
48999 + r_tmp->subj_hash_size *
49000 + sizeof (struct acl_subject_label *));
49001 +
49002 + err = copy_user_subjs(r_tmp->hash->first, r_tmp);
49003 +
49004 + if (err)
49005 + goto cleanup;
49006 +
49007 + /* set nested subject list to null */
49008 + r_tmp->hash->first = NULL;
49009 +
49010 + insert_acl_role_label(r_tmp);
49011 + }
49012 +
49013 + goto return_err;
49014 + cleanup:
49015 + free_variables();
49016 + return_err:
49017 + return err;
49018 +
49019 +}
49020 +
49021 +static int
49022 +gracl_init(struct gr_arg *args)
49023 +{
49024 + int error = 0;
49025 +
49026 + memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
49027 + memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
49028 +
49029 + if (init_variables(args)) {
49030 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
49031 + error = -ENOMEM;
49032 + free_variables();
49033 + goto out;
49034 + }
49035 +
49036 + error = copy_user_acl(args);
49037 + free_init_variables();
49038 + if (error) {
49039 + free_variables();
49040 + goto out;
49041 + }
49042 +
49043 + if ((error = gr_set_acls(0))) {
49044 + free_variables();
49045 + goto out;
49046 + }
49047 +
49048 + pax_open_kernel();
49049 + gr_status |= GR_READY;
49050 + pax_close_kernel();
49051 +
49052 + out:
49053 + return error;
49054 +}
49055 +
49056 +/* derived from glibc fnmatch() 0: match, 1: no match*/
49057 +
49058 +static int
49059 +glob_match(const char *p, const char *n)
49060 +{
49061 + char c;
49062 +
49063 + while ((c = *p++) != '\0') {
49064 + switch (c) {
49065 + case '?':
49066 + if (*n == '\0')
49067 + return 1;
49068 + else if (*n == '/')
49069 + return 1;
49070 + break;
49071 + case '\\':
49072 + if (*n != c)
49073 + return 1;
49074 + break;
49075 + case '*':
49076 + for (c = *p++; c == '?' || c == '*'; c = *p++) {
49077 + if (*n == '/')
49078 + return 1;
49079 + else if (c == '?') {
49080 + if (*n == '\0')
49081 + return 1;
49082 + else
49083 + ++n;
49084 + }
49085 + }
49086 + if (c == '\0') {
49087 + return 0;
49088 + } else {
49089 + const char *endp;
49090 +
49091 + if ((endp = strchr(n, '/')) == NULL)
49092 + endp = n + strlen(n);
49093 +
49094 + if (c == '[') {
49095 + for (--p; n < endp; ++n)
49096 + if (!glob_match(p, n))
49097 + return 0;
49098 + } else if (c == '/') {
49099 + while (*n != '\0' && *n != '/')
49100 + ++n;
49101 + if (*n == '/' && !glob_match(p, n + 1))
49102 + return 0;
49103 + } else {
49104 + for (--p; n < endp; ++n)
49105 + if (*n == c && !glob_match(p, n))
49106 + return 0;
49107 + }
49108 +
49109 + return 1;
49110 + }
49111 + case '[':
49112 + {
49113 + int not;
49114 + char cold;
49115 +
49116 + if (*n == '\0' || *n == '/')
49117 + return 1;
49118 +
49119 + not = (*p == '!' || *p == '^');
49120 + if (not)
49121 + ++p;
49122 +
49123 + c = *p++;
49124 + for (;;) {
49125 + unsigned char fn = (unsigned char)*n;
49126 +
49127 + if (c == '\0')
49128 + return 1;
49129 + else {
49130 + if (c == fn)
49131 + goto matched;
49132 + cold = c;
49133 + c = *p++;
49134 +
49135 + if (c == '-' && *p != ']') {
49136 + unsigned char cend = *p++;
49137 +
49138 + if (cend == '\0')
49139 + return 1;
49140 +
49141 + if (cold <= fn && fn <= cend)
49142 + goto matched;
49143 +
49144 + c = *p++;
49145 + }
49146 + }
49147 +
49148 + if (c == ']')
49149 + break;
49150 + }
49151 + if (!not)
49152 + return 1;
49153 + break;
49154 + matched:
49155 + while (c != ']') {
49156 + if (c == '\0')
49157 + return 1;
49158 +
49159 + c = *p++;
49160 + }
49161 + if (not)
49162 + return 1;
49163 + }
49164 + break;
49165 + default:
49166 + if (c != *n)
49167 + return 1;
49168 + }
49169 +
49170 + ++n;
49171 + }
49172 +
49173 + if (*n == '\0')
49174 + return 0;
49175 +
49176 + if (*n == '/')
49177 + return 0;
49178 +
49179 + return 1;
49180 +}
49181 +
49182 +static struct acl_object_label *
49183 +chk_glob_label(struct acl_object_label *globbed,
49184 + struct dentry *dentry, struct vfsmount *mnt, char **path)
49185 +{
49186 + struct acl_object_label *tmp;
49187 +
49188 + if (*path == NULL)
49189 + *path = gr_to_filename_nolock(dentry, mnt);
49190 +
49191 + tmp = globbed;
49192 +
49193 + while (tmp) {
49194 + if (!glob_match(tmp->filename, *path))
49195 + return tmp;
49196 + tmp = tmp->next;
49197 + }
49198 +
49199 + return NULL;
49200 +}
49201 +
49202 +static struct acl_object_label *
49203 +__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
49204 + const ino_t curr_ino, const dev_t curr_dev,
49205 + const struct acl_subject_label *subj, char **path, const int checkglob)
49206 +{
49207 + struct acl_subject_label *tmpsubj;
49208 + struct acl_object_label *retval;
49209 + struct acl_object_label *retval2;
49210 +
49211 + tmpsubj = (struct acl_subject_label *) subj;
49212 + read_lock(&gr_inode_lock);
49213 + do {
49214 + retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
49215 + if (retval) {
49216 + if (checkglob && retval->globbed) {
49217 + retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
49218 + (struct vfsmount *)orig_mnt, path);
49219 + if (retval2)
49220 + retval = retval2;
49221 + }
49222 + break;
49223 + }
49224 + } while ((tmpsubj = tmpsubj->parent_subject));
49225 + read_unlock(&gr_inode_lock);
49226 +
49227 + return retval;
49228 +}
49229 +
49230 +static __inline__ struct acl_object_label *
49231 +full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
49232 + struct dentry *curr_dentry,
49233 + const struct acl_subject_label *subj, char **path, const int checkglob)
49234 +{
49235 + int newglob = checkglob;
49236 + ino_t inode;
49237 + dev_t device;
49238 +
49239 + /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
49240 + as we don't want a / * rule to match instead of the / object
49241 + don't do this for create lookups that call this function though, since they're looking up
49242 + on the parent and thus need globbing checks on all paths
49243 + */
49244 + if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
49245 + newglob = GR_NO_GLOB;
49246 +
49247 + spin_lock(&curr_dentry->d_lock);
49248 + inode = curr_dentry->d_inode->i_ino;
49249 + device = __get_dev(curr_dentry);
49250 + spin_unlock(&curr_dentry->d_lock);
49251 +
49252 + return __full_lookup(orig_dentry, orig_mnt, inode, device, subj, path, newglob);
49253 +}
49254 +
49255 +static struct acl_object_label *
49256 +__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
49257 + const struct acl_subject_label *subj, char *path, const int checkglob)
49258 +{
49259 + struct dentry *dentry = (struct dentry *) l_dentry;
49260 + struct vfsmount *mnt = (struct vfsmount *) l_mnt;
49261 + struct acl_object_label *retval;
49262 + struct dentry *parent;
49263 +
49264 + write_seqlock(&rename_lock);
49265 + br_read_lock(vfsmount_lock);
49266 +
49267 + if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
49268 +#ifdef CONFIG_NET
49269 + mnt == sock_mnt ||
49270 +#endif
49271 +#ifdef CONFIG_HUGETLBFS
49272 + (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
49273 +#endif
49274 + /* ignore Eric Biederman */
49275 + IS_PRIVATE(l_dentry->d_inode))) {
49276 + retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw;
49277 + goto out;
49278 + }
49279 +
49280 + for (;;) {
49281 + if (dentry == real_root.dentry && mnt == real_root.mnt)
49282 + break;
49283 +
49284 + if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
49285 + if (mnt->mnt_parent == mnt)
49286 + break;
49287 +
49288 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
49289 + if (retval != NULL)
49290 + goto out;
49291 +
49292 + dentry = mnt->mnt_mountpoint;
49293 + mnt = mnt->mnt_parent;
49294 + continue;
49295 + }
49296 +
49297 + parent = dentry->d_parent;
49298 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
49299 + if (retval != NULL)
49300 + goto out;
49301 +
49302 + dentry = parent;
49303 + }
49304 +
49305 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
49306 +
49307 + /* real_root is pinned so we don't have to hold a reference */
49308 + if (retval == NULL)
49309 + retval = full_lookup(l_dentry, l_mnt, real_root.dentry, subj, &path, checkglob);
49310 +out:
49311 + br_read_unlock(vfsmount_lock);
49312 + write_sequnlock(&rename_lock);
49313 +
49314 + BUG_ON(retval == NULL);
49315 +
49316 + return retval;
49317 +}
49318 +
49319 +static __inline__ struct acl_object_label *
49320 +chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
49321 + const struct acl_subject_label *subj)
49322 +{
49323 + char *path = NULL;
49324 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
49325 +}
49326 +
49327 +static __inline__ struct acl_object_label *
49328 +chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
49329 + const struct acl_subject_label *subj)
49330 +{
49331 + char *path = NULL;
49332 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
49333 +}
49334 +
49335 +static __inline__ struct acl_object_label *
49336 +chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
49337 + const struct acl_subject_label *subj, char *path)
49338 +{
49339 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
49340 +}
49341 +
49342 +static struct acl_subject_label *
49343 +chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
49344 + const struct acl_role_label *role)
49345 +{
49346 + struct dentry *dentry = (struct dentry *) l_dentry;
49347 + struct vfsmount *mnt = (struct vfsmount *) l_mnt;
49348 + struct acl_subject_label *retval;
49349 + struct dentry *parent;
49350 +
49351 + write_seqlock(&rename_lock);
49352 + br_read_lock(vfsmount_lock);
49353 +
49354 + for (;;) {
49355 + if (dentry == real_root.dentry && mnt == real_root.mnt)
49356 + break;
49357 + if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
49358 + if (mnt->mnt_parent == mnt)
49359 + break;
49360 +
49361 + spin_lock(&dentry->d_lock);
49362 + read_lock(&gr_inode_lock);
49363 + retval =
49364 + lookup_acl_subj_label(dentry->d_inode->i_ino,
49365 + __get_dev(dentry), role);
49366 + read_unlock(&gr_inode_lock);
49367 + spin_unlock(&dentry->d_lock);
49368 + if (retval != NULL)
49369 + goto out;
49370 +
49371 + dentry = mnt->mnt_mountpoint;
49372 + mnt = mnt->mnt_parent;
49373 + continue;
49374 + }
49375 +
49376 + spin_lock(&dentry->d_lock);
49377 + read_lock(&gr_inode_lock);
49378 + retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
49379 + __get_dev(dentry), role);
49380 + read_unlock(&gr_inode_lock);
49381 + parent = dentry->d_parent;
49382 + spin_unlock(&dentry->d_lock);
49383 +
49384 + if (retval != NULL)
49385 + goto out;
49386 +
49387 + dentry = parent;
49388 + }
49389 +
49390 + spin_lock(&dentry->d_lock);
49391 + read_lock(&gr_inode_lock);
49392 + retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
49393 + __get_dev(dentry), role);
49394 + read_unlock(&gr_inode_lock);
49395 + spin_unlock(&dentry->d_lock);
49396 +
49397 + if (unlikely(retval == NULL)) {
49398 + /* real_root is pinned, we don't need to hold a reference */
49399 + read_lock(&gr_inode_lock);
49400 + retval = lookup_acl_subj_label(real_root.dentry->d_inode->i_ino,
49401 + __get_dev(real_root.dentry), role);
49402 + read_unlock(&gr_inode_lock);
49403 + }
49404 +out:
49405 + br_read_unlock(vfsmount_lock);
49406 + write_sequnlock(&rename_lock);
49407 +
49408 + BUG_ON(retval == NULL);
49409 +
49410 + return retval;
49411 +}
49412 +
49413 +static void
49414 +gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
49415 +{
49416 + struct task_struct *task = current;
49417 + const struct cred *cred = current_cred();
49418 +
49419 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
49420 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
49421 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
49422 + 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
49423 +
49424 + return;
49425 +}
49426 +
49427 +static void
49428 +gr_log_learn_sysctl(const char *path, const __u32 mode)
49429 +{
49430 + struct task_struct *task = current;
49431 + const struct cred *cred = current_cred();
49432 +
49433 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
49434 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
49435 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
49436 + 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
49437 +
49438 + return;
49439 +}
49440 +
49441 +static void
49442 +gr_log_learn_id_change(const char type, const unsigned int real,
49443 + const unsigned int effective, const unsigned int fs)
49444 +{
49445 + struct task_struct *task = current;
49446 + const struct cred *cred = current_cred();
49447 +
49448 + security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
49449 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
49450 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
49451 + type, real, effective, fs, &task->signal->saved_ip);
49452 +
49453 + return;
49454 +}
49455 +
49456 +__u32
49457 +gr_search_file(const struct dentry * dentry, const __u32 mode,
49458 + const struct vfsmount * mnt)
49459 +{
49460 + __u32 retval = mode;
49461 + struct acl_subject_label *curracl;
49462 + struct acl_object_label *currobj;
49463 +
49464 + if (unlikely(!(gr_status & GR_READY)))
49465 + return (mode & ~GR_AUDITS);
49466 +
49467 + curracl = current->acl;
49468 +
49469 + currobj = chk_obj_label(dentry, mnt, curracl);
49470 + retval = currobj->mode & mode;
49471 +
49472 + /* if we're opening a specified transfer file for writing
49473 + (e.g. /dev/initctl), then transfer our role to init
49474 + */
49475 + if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
49476 + current->role->roletype & GR_ROLE_PERSIST)) {
49477 + struct task_struct *task = init_pid_ns.child_reaper;
49478 +
49479 + if (task->role != current->role) {
49480 + task->acl_sp_role = 0;
49481 + task->acl_role_id = current->acl_role_id;
49482 + task->role = current->role;
49483 + rcu_read_lock();
49484 + read_lock(&grsec_exec_file_lock);
49485 + gr_apply_subject_to_task(task);
49486 + read_unlock(&grsec_exec_file_lock);
49487 + rcu_read_unlock();
49488 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
49489 + }
49490 + }
49491 +
49492 + if (unlikely
49493 + ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
49494 + && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
49495 + __u32 new_mode = mode;
49496 +
49497 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
49498 +
49499 + retval = new_mode;
49500 +
49501 + if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
49502 + new_mode |= GR_INHERIT;
49503 +
49504 + if (!(mode & GR_NOLEARN))
49505 + gr_log_learn(dentry, mnt, new_mode);
49506 + }
49507 +
49508 + return retval;
49509 +}
49510 +
49511 +struct acl_object_label *gr_get_create_object(const struct dentry *new_dentry,
49512 + const struct dentry *parent,
49513 + const struct vfsmount *mnt)
49514 +{
49515 + struct name_entry *match;
49516 + struct acl_object_label *matchpo;
49517 + struct acl_subject_label *curracl;
49518 + char *path;
49519 +
49520 + if (unlikely(!(gr_status & GR_READY)))
49521 + return NULL;
49522 +
49523 + preempt_disable();
49524 + path = gr_to_filename_rbac(new_dentry, mnt);
49525 + match = lookup_name_entry_create(path);
49526 +
49527 + curracl = current->acl;
49528 +
49529 + if (match) {
49530 + read_lock(&gr_inode_lock);
49531 + matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
49532 + read_unlock(&gr_inode_lock);
49533 +
49534 + if (matchpo) {
49535 + preempt_enable();
49536 + return matchpo;
49537 + }
49538 + }
49539 +
49540 + // lookup parent
49541 +
49542 + matchpo = chk_obj_create_label(parent, mnt, curracl, path);
49543 +
49544 + preempt_enable();
49545 + return matchpo;
49546 +}
49547 +
49548 +__u32
49549 +gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
49550 + const struct vfsmount * mnt, const __u32 mode)
49551 +{
49552 + struct acl_object_label *matchpo;
49553 + __u32 retval;
49554 +
49555 + if (unlikely(!(gr_status & GR_READY)))
49556 + return (mode & ~GR_AUDITS);
49557 +
49558 + matchpo = gr_get_create_object(new_dentry, parent, mnt);
49559 +
49560 + retval = matchpo->mode & mode;
49561 +
49562 + if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
49563 + && (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))) {
49564 + __u32 new_mode = mode;
49565 +
49566 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
49567 +
49568 + gr_log_learn(new_dentry, mnt, new_mode);
49569 + return new_mode;
49570 + }
49571 +
49572 + return retval;
49573 +}
49574 +
49575 +__u32
49576 +gr_check_link(const struct dentry * new_dentry,
49577 + const struct dentry * parent_dentry,
49578 + const struct vfsmount * parent_mnt,
49579 + const struct dentry * old_dentry, const struct vfsmount * old_mnt)
49580 +{
49581 + struct acl_object_label *obj;
49582 + __u32 oldmode, newmode;
49583 + __u32 needmode;
49584 + __u32 checkmodes = GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC | GR_SETID | GR_READ |
49585 + GR_DELETE | GR_INHERIT;
49586 +
49587 + if (unlikely(!(gr_status & GR_READY)))
49588 + return (GR_CREATE | GR_LINK);
49589 +
49590 + obj = chk_obj_label(old_dentry, old_mnt, current->acl);
49591 + oldmode = obj->mode;
49592 +
49593 + obj = gr_get_create_object(new_dentry, parent_dentry, parent_mnt);
49594 + newmode = obj->mode;
49595 +
49596 + needmode = newmode & checkmodes;
49597 +
49598 + // old name for hardlink must have at least the permissions of the new name
49599 + if ((oldmode & needmode) != needmode)
49600 + goto bad;
49601 +
49602 + // if old name had restrictions/auditing, make sure the new name does as well
49603 + needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
49604 +
49605 + // don't allow hardlinking of suid/sgid files without permission
49606 + if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
49607 + needmode |= GR_SETID;
49608 +
49609 + if ((newmode & needmode) != needmode)
49610 + goto bad;
49611 +
49612 + // enforce minimum permissions
49613 + if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
49614 + return newmode;
49615 +bad:
49616 + needmode = oldmode;
49617 + if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
49618 + needmode |= GR_SETID;
49619 +
49620 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
49621 + gr_log_learn(old_dentry, old_mnt, needmode | GR_CREATE | GR_LINK);
49622 + return (GR_CREATE | GR_LINK);
49623 + } else if (newmode & GR_SUPPRESS)
49624 + return GR_SUPPRESS;
49625 + else
49626 + return 0;
49627 +}
49628 +
49629 +int
49630 +gr_check_hidden_task(const struct task_struct *task)
49631 +{
49632 + if (unlikely(!(gr_status & GR_READY)))
49633 + return 0;
49634 +
49635 + if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
49636 + return 1;
49637 +
49638 + return 0;
49639 +}
49640 +
49641 +int
49642 +gr_check_protected_task(const struct task_struct *task)
49643 +{
49644 + if (unlikely(!(gr_status & GR_READY) || !task))
49645 + return 0;
49646 +
49647 + if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
49648 + task->acl != current->acl)
49649 + return 1;
49650 +
49651 + return 0;
49652 +}
49653 +
49654 +int
49655 +gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
49656 +{
49657 + struct task_struct *p;
49658 + int ret = 0;
49659 +
49660 + if (unlikely(!(gr_status & GR_READY) || !pid))
49661 + return ret;
49662 +
49663 + read_lock(&tasklist_lock);
49664 + do_each_pid_task(pid, type, p) {
49665 + if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
49666 + p->acl != current->acl) {
49667 + ret = 1;
49668 + goto out;
49669 + }
49670 + } while_each_pid_task(pid, type, p);
49671 +out:
49672 + read_unlock(&tasklist_lock);
49673 +
49674 + return ret;
49675 +}
49676 +
49677 +void
49678 +gr_copy_label(struct task_struct *tsk)
49679 +{
49680 + tsk->signal->used_accept = 0;
49681 + tsk->acl_sp_role = 0;
49682 + tsk->acl_role_id = current->acl_role_id;
49683 + tsk->acl = current->acl;
49684 + tsk->role = current->role;
49685 + tsk->signal->curr_ip = current->signal->curr_ip;
49686 + tsk->signal->saved_ip = current->signal->saved_ip;
49687 + if (current->exec_file)
49688 + get_file(current->exec_file);
49689 + tsk->exec_file = current->exec_file;
49690 + tsk->is_writable = current->is_writable;
49691 + if (unlikely(current->signal->used_accept)) {
49692 + current->signal->curr_ip = 0;
49693 + current->signal->saved_ip = 0;
49694 + }
49695 +
49696 + return;
49697 +}
49698 +
49699 +static void
49700 +gr_set_proc_res(struct task_struct *task)
49701 +{
49702 + struct acl_subject_label *proc;
49703 + unsigned short i;
49704 +
49705 + proc = task->acl;
49706 +
49707 + if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
49708 + return;
49709 +
49710 + for (i = 0; i < RLIM_NLIMITS; i++) {
49711 + if (!(proc->resmask & (1 << i)))
49712 + continue;
49713 +
49714 + task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
49715 + task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
49716 + }
49717 +
49718 + return;
49719 +}
49720 +
49721 +extern int __gr_process_user_ban(struct user_struct *user);
49722 +
49723 +int
49724 +gr_check_user_change(int real, int effective, int fs)
49725 +{
49726 + unsigned int i;
49727 + __u16 num;
49728 + uid_t *uidlist;
49729 + int curuid;
49730 + int realok = 0;
49731 + int effectiveok = 0;
49732 + int fsok = 0;
49733 +
49734 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
49735 + struct user_struct *user;
49736 +
49737 + if (real == -1)
49738 + goto skipit;
49739 +
49740 + user = find_user(real);
49741 + if (user == NULL)
49742 + goto skipit;
49743 +
49744 + if (__gr_process_user_ban(user)) {
49745 + /* for find_user */
49746 + free_uid(user);
49747 + return 1;
49748 + }
49749 +
49750 + /* for find_user */
49751 + free_uid(user);
49752 +
49753 +skipit:
49754 +#endif
49755 +
49756 + if (unlikely(!(gr_status & GR_READY)))
49757 + return 0;
49758 +
49759 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
49760 + gr_log_learn_id_change('u', real, effective, fs);
49761 +
49762 + num = current->acl->user_trans_num;
49763 + uidlist = current->acl->user_transitions;
49764 +
49765 + if (uidlist == NULL)
49766 + return 0;
49767 +
49768 + if (real == -1)
49769 + realok = 1;
49770 + if (effective == -1)
49771 + effectiveok = 1;
49772 + if (fs == -1)
49773 + fsok = 1;
49774 +
49775 + if (current->acl->user_trans_type & GR_ID_ALLOW) {
49776 + for (i = 0; i < num; i++) {
49777 + curuid = (int)uidlist[i];
49778 + if (real == curuid)
49779 + realok = 1;
49780 + if (effective == curuid)
49781 + effectiveok = 1;
49782 + if (fs == curuid)
49783 + fsok = 1;
49784 + }
49785 + } else if (current->acl->user_trans_type & GR_ID_DENY) {
49786 + for (i = 0; i < num; i++) {
49787 + curuid = (int)uidlist[i];
49788 + if (real == curuid)
49789 + break;
49790 + if (effective == curuid)
49791 + break;
49792 + if (fs == curuid)
49793 + break;
49794 + }
49795 + /* not in deny list */
49796 + if (i == num) {
49797 + realok = 1;
49798 + effectiveok = 1;
49799 + fsok = 1;
49800 + }
49801 + }
49802 +
49803 + if (realok && effectiveok && fsok)
49804 + return 0;
49805 + else {
49806 + gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
49807 + return 1;
49808 + }
49809 +}
49810 +
49811 +int
49812 +gr_check_group_change(int real, int effective, int fs)
49813 +{
49814 + unsigned int i;
49815 + __u16 num;
49816 + gid_t *gidlist;
49817 + int curgid;
49818 + int realok = 0;
49819 + int effectiveok = 0;
49820 + int fsok = 0;
49821 +
49822 + if (unlikely(!(gr_status & GR_READY)))
49823 + return 0;
49824 +
49825 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
49826 + gr_log_learn_id_change('g', real, effective, fs);
49827 +
49828 + num = current->acl->group_trans_num;
49829 + gidlist = current->acl->group_transitions;
49830 +
49831 + if (gidlist == NULL)
49832 + return 0;
49833 +
49834 + if (real == -1)
49835 + realok = 1;
49836 + if (effective == -1)
49837 + effectiveok = 1;
49838 + if (fs == -1)
49839 + fsok = 1;
49840 +
49841 + if (current->acl->group_trans_type & GR_ID_ALLOW) {
49842 + for (i = 0; i < num; i++) {
49843 + curgid = (int)gidlist[i];
49844 + if (real == curgid)
49845 + realok = 1;
49846 + if (effective == curgid)
49847 + effectiveok = 1;
49848 + if (fs == curgid)
49849 + fsok = 1;
49850 + }
49851 + } else if (current->acl->group_trans_type & GR_ID_DENY) {
49852 + for (i = 0; i < num; i++) {
49853 + curgid = (int)gidlist[i];
49854 + if (real == curgid)
49855 + break;
49856 + if (effective == curgid)
49857 + break;
49858 + if (fs == curgid)
49859 + break;
49860 + }
49861 + /* not in deny list */
49862 + if (i == num) {
49863 + realok = 1;
49864 + effectiveok = 1;
49865 + fsok = 1;
49866 + }
49867 + }
49868 +
49869 + if (realok && effectiveok && fsok)
49870 + return 0;
49871 + else {
49872 + gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
49873 + return 1;
49874 + }
49875 +}
49876 +
49877 +void
49878 +gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
49879 +{
49880 + struct acl_role_label *role = task->role;
49881 + struct acl_subject_label *subj = NULL;
49882 + struct acl_object_label *obj;
49883 + struct file *filp;
49884 +
49885 + if (unlikely(!(gr_status & GR_READY)))
49886 + return;
49887 +
49888 + filp = task->exec_file;
49889 +
49890 + /* kernel process, we'll give them the kernel role */
49891 + if (unlikely(!filp)) {
49892 + task->role = kernel_role;
49893 + task->acl = kernel_role->root_label;
49894 + return;
49895 + } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
49896 + role = lookup_acl_role_label(task, uid, gid);
49897 +
49898 + /* perform subject lookup in possibly new role
49899 + we can use this result below in the case where role == task->role
49900 + */
49901 + subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
49902 +
49903 + /* if we changed uid/gid, but result in the same role
49904 + and are using inheritance, don't lose the inherited subject
49905 + if current subject is other than what normal lookup
49906 + would result in, we arrived via inheritance, don't
49907 + lose subject
49908 + */
49909 + if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
49910 + (subj == task->acl)))
49911 + task->acl = subj;
49912 +
49913 + task->role = role;
49914 +
49915 + task->is_writable = 0;
49916 +
49917 + /* ignore additional mmap checks for processes that are writable
49918 + by the default ACL */
49919 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
49920 + if (unlikely(obj->mode & GR_WRITE))
49921 + task->is_writable = 1;
49922 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
49923 + if (unlikely(obj->mode & GR_WRITE))
49924 + task->is_writable = 1;
49925 +
49926 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
49927 + printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
49928 +#endif
49929 +
49930 + gr_set_proc_res(task);
49931 +
49932 + return;
49933 +}
49934 +
49935 +int
49936 +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
49937 + const int unsafe_share)
49938 +{
49939 + struct task_struct *task = current;
49940 + struct acl_subject_label *newacl;
49941 + struct acl_object_label *obj;
49942 + __u32 retmode;
49943 +
49944 + if (unlikely(!(gr_status & GR_READY)))
49945 + return 0;
49946 +
49947 + newacl = chk_subj_label(dentry, mnt, task->role);
49948 +
49949 + task_lock(task);
49950 + if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
49951 + !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
49952 + !(task->role->roletype & GR_ROLE_GOD) &&
49953 + !gr_search_file(dentry, GR_PTRACERD, mnt) &&
49954 + !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
49955 + task_unlock(task);
49956 + if (unsafe_share)
49957 + gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
49958 + else
49959 + gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
49960 + return -EACCES;
49961 + }
49962 + task_unlock(task);
49963 +
49964 + obj = chk_obj_label(dentry, mnt, task->acl);
49965 + retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
49966 +
49967 + if (!(task->acl->mode & GR_INHERITLEARN) &&
49968 + ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
49969 + if (obj->nested)
49970 + task->acl = obj->nested;
49971 + else
49972 + task->acl = newacl;
49973 + } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
49974 + gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
49975 +
49976 + task->is_writable = 0;
49977 +
49978 + /* ignore additional mmap checks for processes that are writable
49979 + by the default ACL */
49980 + obj = chk_obj_label(dentry, mnt, default_role->root_label);
49981 + if (unlikely(obj->mode & GR_WRITE))
49982 + task->is_writable = 1;
49983 + obj = chk_obj_label(dentry, mnt, task->role->root_label);
49984 + if (unlikely(obj->mode & GR_WRITE))
49985 + task->is_writable = 1;
49986 +
49987 + gr_set_proc_res(task);
49988 +
49989 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
49990 + printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
49991 +#endif
49992 + return 0;
49993 +}
49994 +
49995 +/* always called with valid inodev ptr */
49996 +static void
49997 +do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
49998 +{
49999 + struct acl_object_label *matchpo;
50000 + struct acl_subject_label *matchps;
50001 + struct acl_subject_label *subj;
50002 + struct acl_role_label *role;
50003 + unsigned int x;
50004 +
50005 + FOR_EACH_ROLE_START(role)
50006 + FOR_EACH_SUBJECT_START(role, subj, x)
50007 + if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
50008 + matchpo->mode |= GR_DELETED;
50009 + FOR_EACH_SUBJECT_END(subj,x)
50010 + FOR_EACH_NESTED_SUBJECT_START(role, subj)
50011 + if (subj->inode == ino && subj->device == dev)
50012 + subj->mode |= GR_DELETED;
50013 + FOR_EACH_NESTED_SUBJECT_END(subj)
50014 + if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
50015 + matchps->mode |= GR_DELETED;
50016 + FOR_EACH_ROLE_END(role)
50017 +
50018 + inodev->nentry->deleted = 1;
50019 +
50020 + return;
50021 +}
50022 +
50023 +void
50024 +gr_handle_delete(const ino_t ino, const dev_t dev)
50025 +{
50026 + struct inodev_entry *inodev;
50027 +
50028 + if (unlikely(!(gr_status & GR_READY)))
50029 + return;
50030 +
50031 + write_lock(&gr_inode_lock);
50032 + inodev = lookup_inodev_entry(ino, dev);
50033 + if (inodev != NULL)
50034 + do_handle_delete(inodev, ino, dev);
50035 + write_unlock(&gr_inode_lock);
50036 +
50037 + return;
50038 +}
50039 +
50040 +static void
50041 +update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
50042 + const ino_t newinode, const dev_t newdevice,
50043 + struct acl_subject_label *subj)
50044 +{
50045 + unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
50046 + struct acl_object_label *match;
50047 +
50048 + match = subj->obj_hash[index];
50049 +
50050 + while (match && (match->inode != oldinode ||
50051 + match->device != olddevice ||
50052 + !(match->mode & GR_DELETED)))
50053 + match = match->next;
50054 +
50055 + if (match && (match->inode == oldinode)
50056 + && (match->device == olddevice)
50057 + && (match->mode & GR_DELETED)) {
50058 + if (match->prev == NULL) {
50059 + subj->obj_hash[index] = match->next;
50060 + if (match->next != NULL)
50061 + match->next->prev = NULL;
50062 + } else {
50063 + match->prev->next = match->next;
50064 + if (match->next != NULL)
50065 + match->next->prev = match->prev;
50066 + }
50067 + match->prev = NULL;
50068 + match->next = NULL;
50069 + match->inode = newinode;
50070 + match->device = newdevice;
50071 + match->mode &= ~GR_DELETED;
50072 +
50073 + insert_acl_obj_label(match, subj);
50074 + }
50075 +
50076 + return;
50077 +}
50078 +
50079 +static void
50080 +update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
50081 + const ino_t newinode, const dev_t newdevice,
50082 + struct acl_role_label *role)
50083 +{
50084 + unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
50085 + struct acl_subject_label *match;
50086 +
50087 + match = role->subj_hash[index];
50088 +
50089 + while (match && (match->inode != oldinode ||
50090 + match->device != olddevice ||
50091 + !(match->mode & GR_DELETED)))
50092 + match = match->next;
50093 +
50094 + if (match && (match->inode == oldinode)
50095 + && (match->device == olddevice)
50096 + && (match->mode & GR_DELETED)) {
50097 + if (match->prev == NULL) {
50098 + role->subj_hash[index] = match->next;
50099 + if (match->next != NULL)
50100 + match->next->prev = NULL;
50101 + } else {
50102 + match->prev->next = match->next;
50103 + if (match->next != NULL)
50104 + match->next->prev = match->prev;
50105 + }
50106 + match->prev = NULL;
50107 + match->next = NULL;
50108 + match->inode = newinode;
50109 + match->device = newdevice;
50110 + match->mode &= ~GR_DELETED;
50111 +
50112 + insert_acl_subj_label(match, role);
50113 + }
50114 +
50115 + return;
50116 +}
50117 +
50118 +static void
50119 +update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
50120 + const ino_t newinode, const dev_t newdevice)
50121 +{
50122 + unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
50123 + struct inodev_entry *match;
50124 +
50125 + match = inodev_set.i_hash[index];
50126 +
50127 + while (match && (match->nentry->inode != oldinode ||
50128 + match->nentry->device != olddevice || !match->nentry->deleted))
50129 + match = match->next;
50130 +
50131 + if (match && (match->nentry->inode == oldinode)
50132 + && (match->nentry->device == olddevice) &&
50133 + match->nentry->deleted) {
50134 + if (match->prev == NULL) {
50135 + inodev_set.i_hash[index] = match->next;
50136 + if (match->next != NULL)
50137 + match->next->prev = NULL;
50138 + } else {
50139 + match->prev->next = match->next;
50140 + if (match->next != NULL)
50141 + match->next->prev = match->prev;
50142 + }
50143 + match->prev = NULL;
50144 + match->next = NULL;
50145 + match->nentry->inode = newinode;
50146 + match->nentry->device = newdevice;
50147 + match->nentry->deleted = 0;
50148 +
50149 + insert_inodev_entry(match);
50150 + }
50151 +
50152 + return;
50153 +}
50154 +
50155 +static void
50156 +__do_handle_create(const struct name_entry *matchn, ino_t ino, dev_t dev)
50157 +{
50158 + struct acl_subject_label *subj;
50159 + struct acl_role_label *role;
50160 + unsigned int x;
50161 +
50162 + FOR_EACH_ROLE_START(role)
50163 + update_acl_subj_label(matchn->inode, matchn->device, ino, dev, role);
50164 +
50165 + FOR_EACH_NESTED_SUBJECT_START(role, subj)
50166 + if ((subj->inode == ino) && (subj->device == dev)) {
50167 + subj->inode = ino;
50168 + subj->device = dev;
50169 + }
50170 + FOR_EACH_NESTED_SUBJECT_END(subj)
50171 + FOR_EACH_SUBJECT_START(role, subj, x)
50172 + update_acl_obj_label(matchn->inode, matchn->device,
50173 + ino, dev, subj);
50174 + FOR_EACH_SUBJECT_END(subj,x)
50175 + FOR_EACH_ROLE_END(role)
50176 +
50177 + update_inodev_entry(matchn->inode, matchn->device, ino, dev);
50178 +
50179 + return;
50180 +}
50181 +
50182 +static void
50183 +do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
50184 + const struct vfsmount *mnt)
50185 +{
50186 + ino_t ino = dentry->d_inode->i_ino;
50187 + dev_t dev = __get_dev(dentry);
50188 +
50189 + __do_handle_create(matchn, ino, dev);
50190 +
50191 + return;
50192 +}
50193 +
50194 +void
50195 +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
50196 +{
50197 + struct name_entry *matchn;
50198 +
50199 + if (unlikely(!(gr_status & GR_READY)))
50200 + return;
50201 +
50202 + preempt_disable();
50203 + matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
50204 +
50205 + if (unlikely((unsigned long)matchn)) {
50206 + write_lock(&gr_inode_lock);
50207 + do_handle_create(matchn, dentry, mnt);
50208 + write_unlock(&gr_inode_lock);
50209 + }
50210 + preempt_enable();
50211 +
50212 + return;
50213 +}
50214 +
50215 +void
50216 +gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
50217 +{
50218 + struct name_entry *matchn;
50219 +
50220 + if (unlikely(!(gr_status & GR_READY)))
50221 + return;
50222 +
50223 + preempt_disable();
50224 + matchn = lookup_name_entry(gr_to_proc_filename_rbac(dentry, init_pid_ns.proc_mnt));
50225 +
50226 + if (unlikely((unsigned long)matchn)) {
50227 + write_lock(&gr_inode_lock);
50228 + __do_handle_create(matchn, inode->i_ino, inode->i_sb->s_dev);
50229 + write_unlock(&gr_inode_lock);
50230 + }
50231 + preempt_enable();
50232 +
50233 + return;
50234 +}
50235 +
50236 +void
50237 +gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
50238 + struct dentry *old_dentry,
50239 + struct dentry *new_dentry,
50240 + struct vfsmount *mnt, const __u8 replace)
50241 +{
50242 + struct name_entry *matchn;
50243 + struct inodev_entry *inodev;
50244 + struct inode *inode = new_dentry->d_inode;
50245 + ino_t old_ino = old_dentry->d_inode->i_ino;
50246 + dev_t old_dev = __get_dev(old_dentry);
50247 +
50248 + /* vfs_rename swaps the name and parent link for old_dentry and
50249 + new_dentry
50250 + at this point, old_dentry has the new name, parent link, and inode
50251 + for the renamed file
50252 + if a file is being replaced by a rename, new_dentry has the inode
50253 + and name for the replaced file
50254 + */
50255 +
50256 + if (unlikely(!(gr_status & GR_READY)))
50257 + return;
50258 +
50259 + preempt_disable();
50260 + matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
50261 +
50262 + /* we wouldn't have to check d_inode if it weren't for
50263 + NFS silly-renaming
50264 + */
50265 +
50266 + write_lock(&gr_inode_lock);
50267 + if (unlikely(replace && inode)) {
50268 + ino_t new_ino = inode->i_ino;
50269 + dev_t new_dev = __get_dev(new_dentry);
50270 +
50271 + inodev = lookup_inodev_entry(new_ino, new_dev);
50272 + if (inodev != NULL && ((inode->i_nlink <= 1) || S_ISDIR(inode->i_mode)))
50273 + do_handle_delete(inodev, new_ino, new_dev);
50274 + }
50275 +
50276 + inodev = lookup_inodev_entry(old_ino, old_dev);
50277 + if (inodev != NULL && ((old_dentry->d_inode->i_nlink <= 1) || S_ISDIR(old_dentry->d_inode->i_mode)))
50278 + do_handle_delete(inodev, old_ino, old_dev);
50279 +
50280 + if (unlikely((unsigned long)matchn))
50281 + do_handle_create(matchn, old_dentry, mnt);
50282 +
50283 + write_unlock(&gr_inode_lock);
50284 + preempt_enable();
50285 +
50286 + return;
50287 +}
50288 +
50289 +static int
50290 +lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
50291 + unsigned char **sum)
50292 +{
50293 + struct acl_role_label *r;
50294 + struct role_allowed_ip *ipp;
50295 + struct role_transition *trans;
50296 + unsigned int i;
50297 + int found = 0;
50298 + u32 curr_ip = current->signal->curr_ip;
50299 +
50300 + current->signal->saved_ip = curr_ip;
50301 +
50302 + /* check transition table */
50303 +
50304 + for (trans = current->role->transitions; trans; trans = trans->next) {
50305 + if (!strcmp(rolename, trans->rolename)) {
50306 + found = 1;
50307 + break;
50308 + }
50309 + }
50310 +
50311 + if (!found)
50312 + return 0;
50313 +
50314 + /* handle special roles that do not require authentication
50315 + and check ip */
50316 +
50317 + FOR_EACH_ROLE_START(r)
50318 + if (!strcmp(rolename, r->rolename) &&
50319 + (r->roletype & GR_ROLE_SPECIAL)) {
50320 + found = 0;
50321 + if (r->allowed_ips != NULL) {
50322 + for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
50323 + if ((ntohl(curr_ip) & ipp->netmask) ==
50324 + (ntohl(ipp->addr) & ipp->netmask))
50325 + found = 1;
50326 + }
50327 + } else
50328 + found = 2;
50329 + if (!found)
50330 + return 0;
50331 +
50332 + if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
50333 + ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
50334 + *salt = NULL;
50335 + *sum = NULL;
50336 + return 1;
50337 + }
50338 + }
50339 + FOR_EACH_ROLE_END(r)
50340 +
50341 + for (i = 0; i < num_sprole_pws; i++) {
50342 + if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
50343 + *salt = acl_special_roles[i]->salt;
50344 + *sum = acl_special_roles[i]->sum;
50345 + return 1;
50346 + }
50347 + }
50348 +
50349 + return 0;
50350 +}
50351 +
50352 +static void
50353 +assign_special_role(char *rolename)
50354 +{
50355 + struct acl_object_label *obj;
50356 + struct acl_role_label *r;
50357 + struct acl_role_label *assigned = NULL;
50358 + struct task_struct *tsk;
50359 + struct file *filp;
50360 +
50361 + FOR_EACH_ROLE_START(r)
50362 + if (!strcmp(rolename, r->rolename) &&
50363 + (r->roletype & GR_ROLE_SPECIAL)) {
50364 + assigned = r;
50365 + break;
50366 + }
50367 + FOR_EACH_ROLE_END(r)
50368 +
50369 + if (!assigned)
50370 + return;
50371 +
50372 + read_lock(&tasklist_lock);
50373 + read_lock(&grsec_exec_file_lock);
50374 +
50375 + tsk = current->real_parent;
50376 + if (tsk == NULL)
50377 + goto out_unlock;
50378 +
50379 + filp = tsk->exec_file;
50380 + if (filp == NULL)
50381 + goto out_unlock;
50382 +
50383 + tsk->is_writable = 0;
50384 +
50385 + tsk->acl_sp_role = 1;
50386 + tsk->acl_role_id = ++acl_sp_role_value;
50387 + tsk->role = assigned;
50388 + tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
50389 +
50390 + /* ignore additional mmap checks for processes that are writable
50391 + by the default ACL */
50392 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
50393 + if (unlikely(obj->mode & GR_WRITE))
50394 + tsk->is_writable = 1;
50395 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
50396 + if (unlikely(obj->mode & GR_WRITE))
50397 + tsk->is_writable = 1;
50398 +
50399 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
50400 + printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
50401 +#endif
50402 +
50403 +out_unlock:
50404 + read_unlock(&grsec_exec_file_lock);
50405 + read_unlock(&tasklist_lock);
50406 + return;
50407 +}
50408 +
50409 +int gr_check_secure_terminal(struct task_struct *task)
50410 +{
50411 + struct task_struct *p, *p2, *p3;
50412 + struct files_struct *files;
50413 + struct fdtable *fdt;
50414 + struct file *our_file = NULL, *file;
50415 + int i;
50416 +
50417 + if (task->signal->tty == NULL)
50418 + return 1;
50419 +
50420 + files = get_files_struct(task);
50421 + if (files != NULL) {
50422 + rcu_read_lock();
50423 + fdt = files_fdtable(files);
50424 + for (i=0; i < fdt->max_fds; i++) {
50425 + file = fcheck_files(files, i);
50426 + if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
50427 + get_file(file);
50428 + our_file = file;
50429 + }
50430 + }
50431 + rcu_read_unlock();
50432 + put_files_struct(files);
50433 + }
50434 +
50435 + if (our_file == NULL)
50436 + return 1;
50437 +
50438 + read_lock(&tasklist_lock);
50439 + do_each_thread(p2, p) {
50440 + files = get_files_struct(p);
50441 + if (files == NULL ||
50442 + (p->signal && p->signal->tty == task->signal->tty)) {
50443 + if (files != NULL)
50444 + put_files_struct(files);
50445 + continue;
50446 + }
50447 + rcu_read_lock();
50448 + fdt = files_fdtable(files);
50449 + for (i=0; i < fdt->max_fds; i++) {
50450 + file = fcheck_files(files, i);
50451 + if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
50452 + file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
50453 + p3 = task;
50454 + while (p3->pid > 0) {
50455 + if (p3 == p)
50456 + break;
50457 + p3 = p3->real_parent;
50458 + }
50459 + if (p3 == p)
50460 + break;
50461 + gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
50462 + gr_handle_alertkill(p);
50463 + rcu_read_unlock();
50464 + put_files_struct(files);
50465 + read_unlock(&tasklist_lock);
50466 + fput(our_file);
50467 + return 0;
50468 + }
50469 + }
50470 + rcu_read_unlock();
50471 + put_files_struct(files);
50472 + } while_each_thread(p2, p);
50473 + read_unlock(&tasklist_lock);
50474 +
50475 + fput(our_file);
50476 + return 1;
50477 +}
50478 +
50479 +ssize_t
50480 +write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
50481 +{
50482 + struct gr_arg_wrapper uwrap;
50483 + unsigned char *sprole_salt = NULL;
50484 + unsigned char *sprole_sum = NULL;
50485 + int error = sizeof (struct gr_arg_wrapper);
50486 + int error2 = 0;
50487 +
50488 + mutex_lock(&gr_dev_mutex);
50489 +
50490 + if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
50491 + error = -EPERM;
50492 + goto out;
50493 + }
50494 +
50495 + if (count != sizeof (struct gr_arg_wrapper)) {
50496 + gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
50497 + error = -EINVAL;
50498 + goto out;
50499 + }
50500 +
50501 +
50502 + if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
50503 + gr_auth_expires = 0;
50504 + gr_auth_attempts = 0;
50505 + }
50506 +
50507 + if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
50508 + error = -EFAULT;
50509 + goto out;
50510 + }
50511 +
50512 + if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
50513 + error = -EINVAL;
50514 + goto out;
50515 + }
50516 +
50517 + if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
50518 + error = -EFAULT;
50519 + goto out;
50520 + }
50521 +
50522 + if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
50523 + gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
50524 + time_after(gr_auth_expires, get_seconds())) {
50525 + error = -EBUSY;
50526 + goto out;
50527 + }
50528 +
50529 + /* if non-root trying to do anything other than use a special role,
50530 + do not attempt authentication, do not count towards authentication
50531 + locking
50532 + */
50533 +
50534 + if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
50535 + gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
50536 + current_uid()) {
50537 + error = -EPERM;
50538 + goto out;
50539 + }
50540 +
50541 + /* ensure pw and special role name are null terminated */
50542 +
50543 + gr_usermode->pw[GR_PW_LEN - 1] = '\0';
50544 + gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
50545 +
50546 + /* Okay.
50547 + * We have our enough of the argument structure..(we have yet
50548 + * to copy_from_user the tables themselves) . Copy the tables
50549 + * only if we need them, i.e. for loading operations. */
50550 +
50551 + switch (gr_usermode->mode) {
50552 + case GR_STATUS:
50553 + if (gr_status & GR_READY) {
50554 + error = 1;
50555 + if (!gr_check_secure_terminal(current))
50556 + error = 3;
50557 + } else
50558 + error = 2;
50559 + goto out;
50560 + case GR_SHUTDOWN:
50561 + if ((gr_status & GR_READY)
50562 + && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
50563 + pax_open_kernel();
50564 + gr_status &= ~GR_READY;
50565 + pax_close_kernel();
50566 +
50567 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
50568 + free_variables();
50569 + memset(gr_usermode, 0, sizeof (struct gr_arg));
50570 + memset(gr_system_salt, 0, GR_SALT_LEN);
50571 + memset(gr_system_sum, 0, GR_SHA_LEN);
50572 + } else if (gr_status & GR_READY) {
50573 + gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
50574 + error = -EPERM;
50575 + } else {
50576 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
50577 + error = -EAGAIN;
50578 + }
50579 + break;
50580 + case GR_ENABLE:
50581 + if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
50582 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
50583 + else {
50584 + if (gr_status & GR_READY)
50585 + error = -EAGAIN;
50586 + else
50587 + error = error2;
50588 + gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
50589 + }
50590 + break;
50591 + case GR_RELOAD:
50592 + if (!(gr_status & GR_READY)) {
50593 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
50594 + error = -EAGAIN;
50595 + } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
50596 + preempt_disable();
50597 +
50598 + pax_open_kernel();
50599 + gr_status &= ~GR_READY;
50600 + pax_close_kernel();
50601 +
50602 + free_variables();
50603 + if (!(error2 = gracl_init(gr_usermode))) {
50604 + preempt_enable();
50605 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
50606 + } else {
50607 + preempt_enable();
50608 + error = error2;
50609 + gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
50610 + }
50611 + } else {
50612 + gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
50613 + error = -EPERM;
50614 + }
50615 + break;
50616 + case GR_SEGVMOD:
50617 + if (unlikely(!(gr_status & GR_READY))) {
50618 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
50619 + error = -EAGAIN;
50620 + break;
50621 + }
50622 +
50623 + if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
50624 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
50625 + if (gr_usermode->segv_device && gr_usermode->segv_inode) {
50626 + struct acl_subject_label *segvacl;
50627 + segvacl =
50628 + lookup_acl_subj_label(gr_usermode->segv_inode,
50629 + gr_usermode->segv_device,
50630 + current->role);
50631 + if (segvacl) {
50632 + segvacl->crashes = 0;
50633 + segvacl->expires = 0;
50634 + }
50635 + } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
50636 + gr_remove_uid(gr_usermode->segv_uid);
50637 + }
50638 + } else {
50639 + gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
50640 + error = -EPERM;
50641 + }
50642 + break;
50643 + case GR_SPROLE:
50644 + case GR_SPROLEPAM:
50645 + if (unlikely(!(gr_status & GR_READY))) {
50646 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
50647 + error = -EAGAIN;
50648 + break;
50649 + }
50650 +
50651 + if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
50652 + current->role->expires = 0;
50653 + current->role->auth_attempts = 0;
50654 + }
50655 +
50656 + if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
50657 + time_after(current->role->expires, get_seconds())) {
50658 + error = -EBUSY;
50659 + goto out;
50660 + }
50661 +
50662 + if (lookup_special_role_auth
50663 + (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
50664 + && ((!sprole_salt && !sprole_sum)
50665 + || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
50666 + char *p = "";
50667 + assign_special_role(gr_usermode->sp_role);
50668 + read_lock(&tasklist_lock);
50669 + if (current->real_parent)
50670 + p = current->real_parent->role->rolename;
50671 + read_unlock(&tasklist_lock);
50672 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
50673 + p, acl_sp_role_value);
50674 + } else {
50675 + gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
50676 + error = -EPERM;
50677 + if(!(current->role->auth_attempts++))
50678 + current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
50679 +
50680 + goto out;
50681 + }
50682 + break;
50683 + case GR_UNSPROLE:
50684 + if (unlikely(!(gr_status & GR_READY))) {
50685 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
50686 + error = -EAGAIN;
50687 + break;
50688 + }
50689 +
50690 + if (current->role->roletype & GR_ROLE_SPECIAL) {
50691 + char *p = "";
50692 + int i = 0;
50693 +
50694 + read_lock(&tasklist_lock);
50695 + if (current->real_parent) {
50696 + p = current->real_parent->role->rolename;
50697 + i = current->real_parent->acl_role_id;
50698 + }
50699 + read_unlock(&tasklist_lock);
50700 +
50701 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
50702 + gr_set_acls(1);
50703 + } else {
50704 + error = -EPERM;
50705 + goto out;
50706 + }
50707 + break;
50708 + default:
50709 + gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
50710 + error = -EINVAL;
50711 + break;
50712 + }
50713 +
50714 + if (error != -EPERM)
50715 + goto out;
50716 +
50717 + if(!(gr_auth_attempts++))
50718 + gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
50719 +
50720 + out:
50721 + mutex_unlock(&gr_dev_mutex);
50722 + return error;
50723 +}
50724 +
50725 +/* must be called with
50726 + rcu_read_lock();
50727 + read_lock(&tasklist_lock);
50728 + read_lock(&grsec_exec_file_lock);
50729 +*/
50730 +int gr_apply_subject_to_task(struct task_struct *task)
50731 +{
50732 + struct acl_object_label *obj;
50733 + char *tmpname;
50734 + struct acl_subject_label *tmpsubj;
50735 + struct file *filp;
50736 + struct name_entry *nmatch;
50737 +
50738 + filp = task->exec_file;
50739 + if (filp == NULL)
50740 + return 0;
50741 +
50742 + /* the following is to apply the correct subject
50743 + on binaries running when the RBAC system
50744 + is enabled, when the binaries have been
50745 + replaced or deleted since their execution
50746 + -----
50747 + when the RBAC system starts, the inode/dev
50748 + from exec_file will be one the RBAC system
50749 + is unaware of. It only knows the inode/dev
50750 + of the present file on disk, or the absence
50751 + of it.
50752 + */
50753 + preempt_disable();
50754 + tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
50755 +
50756 + nmatch = lookup_name_entry(tmpname);
50757 + preempt_enable();
50758 + tmpsubj = NULL;
50759 + if (nmatch) {
50760 + if (nmatch->deleted)
50761 + tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
50762 + else
50763 + tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
50764 + if (tmpsubj != NULL)
50765 + task->acl = tmpsubj;
50766 + }
50767 + if (tmpsubj == NULL)
50768 + task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
50769 + task->role);
50770 + if (task->acl) {
50771 + task->is_writable = 0;
50772 + /* ignore additional mmap checks for processes that are writable
50773 + by the default ACL */
50774 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
50775 + if (unlikely(obj->mode & GR_WRITE))
50776 + task->is_writable = 1;
50777 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
50778 + if (unlikely(obj->mode & GR_WRITE))
50779 + task->is_writable = 1;
50780 +
50781 + gr_set_proc_res(task);
50782 +
50783 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
50784 + printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
50785 +#endif
50786 + } else {
50787 + return 1;
50788 + }
50789 +
50790 + return 0;
50791 +}
50792 +
50793 +int
50794 +gr_set_acls(const int type)
50795 +{
50796 + struct task_struct *task, *task2;
50797 + struct acl_role_label *role = current->role;
50798 + __u16 acl_role_id = current->acl_role_id;
50799 + const struct cred *cred;
50800 + int ret;
50801 +
50802 + rcu_read_lock();
50803 + read_lock(&tasklist_lock);
50804 + read_lock(&grsec_exec_file_lock);
50805 + do_each_thread(task2, task) {
50806 + /* check to see if we're called from the exit handler,
50807 + if so, only replace ACLs that have inherited the admin
50808 + ACL */
50809 +
50810 + if (type && (task->role != role ||
50811 + task->acl_role_id != acl_role_id))
50812 + continue;
50813 +
50814 + task->acl_role_id = 0;
50815 + task->acl_sp_role = 0;
50816 +
50817 + if (task->exec_file) {
50818 + cred = __task_cred(task);
50819 + task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
50820 + ret = gr_apply_subject_to_task(task);
50821 + if (ret) {
50822 + read_unlock(&grsec_exec_file_lock);
50823 + read_unlock(&tasklist_lock);
50824 + rcu_read_unlock();
50825 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
50826 + return ret;
50827 + }
50828 + } else {
50829 + // it's a kernel process
50830 + task->role = kernel_role;
50831 + task->acl = kernel_role->root_label;
50832 +#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
50833 + task->acl->mode &= ~GR_PROCFIND;
50834 +#endif
50835 + }
50836 + } while_each_thread(task2, task);
50837 + read_unlock(&grsec_exec_file_lock);
50838 + read_unlock(&tasklist_lock);
50839 + rcu_read_unlock();
50840 +
50841 + return 0;
50842 +}
50843 +
50844 +void
50845 +gr_learn_resource(const struct task_struct *task,
50846 + const int res, const unsigned long wanted, const int gt)
50847 +{
50848 + struct acl_subject_label *acl;
50849 + const struct cred *cred;
50850 +
50851 + if (unlikely((gr_status & GR_READY) &&
50852 + task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
50853 + goto skip_reslog;
50854 +
50855 +#ifdef CONFIG_GRKERNSEC_RESLOG
50856 + gr_log_resource(task, res, wanted, gt);
50857 +#endif
50858 + skip_reslog:
50859 +
50860 + if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
50861 + return;
50862 +
50863 + acl = task->acl;
50864 +
50865 + if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
50866 + !(acl->resmask & (1 << (unsigned short) res))))
50867 + return;
50868 +
50869 + if (wanted >= acl->res[res].rlim_cur) {
50870 + unsigned long res_add;
50871 +
50872 + res_add = wanted;
50873 + switch (res) {
50874 + case RLIMIT_CPU:
50875 + res_add += GR_RLIM_CPU_BUMP;
50876 + break;
50877 + case RLIMIT_FSIZE:
50878 + res_add += GR_RLIM_FSIZE_BUMP;
50879 + break;
50880 + case RLIMIT_DATA:
50881 + res_add += GR_RLIM_DATA_BUMP;
50882 + break;
50883 + case RLIMIT_STACK:
50884 + res_add += GR_RLIM_STACK_BUMP;
50885 + break;
50886 + case RLIMIT_CORE:
50887 + res_add += GR_RLIM_CORE_BUMP;
50888 + break;
50889 + case RLIMIT_RSS:
50890 + res_add += GR_RLIM_RSS_BUMP;
50891 + break;
50892 + case RLIMIT_NPROC:
50893 + res_add += GR_RLIM_NPROC_BUMP;
50894 + break;
50895 + case RLIMIT_NOFILE:
50896 + res_add += GR_RLIM_NOFILE_BUMP;
50897 + break;
50898 + case RLIMIT_MEMLOCK:
50899 + res_add += GR_RLIM_MEMLOCK_BUMP;
50900 + break;
50901 + case RLIMIT_AS:
50902 + res_add += GR_RLIM_AS_BUMP;
50903 + break;
50904 + case RLIMIT_LOCKS:
50905 + res_add += GR_RLIM_LOCKS_BUMP;
50906 + break;
50907 + case RLIMIT_SIGPENDING:
50908 + res_add += GR_RLIM_SIGPENDING_BUMP;
50909 + break;
50910 + case RLIMIT_MSGQUEUE:
50911 + res_add += GR_RLIM_MSGQUEUE_BUMP;
50912 + break;
50913 + case RLIMIT_NICE:
50914 + res_add += GR_RLIM_NICE_BUMP;
50915 + break;
50916 + case RLIMIT_RTPRIO:
50917 + res_add += GR_RLIM_RTPRIO_BUMP;
50918 + break;
50919 + case RLIMIT_RTTIME:
50920 + res_add += GR_RLIM_RTTIME_BUMP;
50921 + break;
50922 + }
50923 +
50924 + acl->res[res].rlim_cur = res_add;
50925 +
50926 + if (wanted > acl->res[res].rlim_max)
50927 + acl->res[res].rlim_max = res_add;
50928 +
50929 + /* only log the subject filename, since resource logging is supported for
50930 + single-subject learning only */
50931 + rcu_read_lock();
50932 + cred = __task_cred(task);
50933 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
50934 + task->role->roletype, cred->uid, cred->gid, acl->filename,
50935 + acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
50936 + "", (unsigned long) res, &task->signal->saved_ip);
50937 + rcu_read_unlock();
50938 + }
50939 +
50940 + return;
50941 +}
50942 +
50943 +#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
50944 +void
50945 +pax_set_initial_flags(struct linux_binprm *bprm)
50946 +{
50947 + struct task_struct *task = current;
50948 + struct acl_subject_label *proc;
50949 + unsigned long flags;
50950 +
50951 + if (unlikely(!(gr_status & GR_READY)))
50952 + return;
50953 +
50954 + flags = pax_get_flags(task);
50955 +
50956 + proc = task->acl;
50957 +
50958 + if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
50959 + flags &= ~MF_PAX_PAGEEXEC;
50960 + if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
50961 + flags &= ~MF_PAX_SEGMEXEC;
50962 + if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
50963 + flags &= ~MF_PAX_RANDMMAP;
50964 + if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
50965 + flags &= ~MF_PAX_EMUTRAMP;
50966 + if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
50967 + flags &= ~MF_PAX_MPROTECT;
50968 +
50969 + if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
50970 + flags |= MF_PAX_PAGEEXEC;
50971 + if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
50972 + flags |= MF_PAX_SEGMEXEC;
50973 + if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
50974 + flags |= MF_PAX_RANDMMAP;
50975 + if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
50976 + flags |= MF_PAX_EMUTRAMP;
50977 + if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
50978 + flags |= MF_PAX_MPROTECT;
50979 +
50980 + pax_set_flags(task, flags);
50981 +
50982 + return;
50983 +}
50984 +#endif
50985 +
50986 +#ifdef CONFIG_SYSCTL
50987 +/* Eric Biederman likes breaking userland ABI and every inode-based security
50988 + system to save 35kb of memory */
50989 +
50990 +/* we modify the passed in filename, but adjust it back before returning */
50991 +static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
50992 +{
50993 + struct name_entry *nmatch;
50994 + char *p, *lastp = NULL;
50995 + struct acl_object_label *obj = NULL, *tmp;
50996 + struct acl_subject_label *tmpsubj;
50997 + char c = '\0';
50998 +
50999 + read_lock(&gr_inode_lock);
51000 +
51001 + p = name + len - 1;
51002 + do {
51003 + nmatch = lookup_name_entry(name);
51004 + if (lastp != NULL)
51005 + *lastp = c;
51006 +
51007 + if (nmatch == NULL)
51008 + goto next_component;
51009 + tmpsubj = current->acl;
51010 + do {
51011 + obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
51012 + if (obj != NULL) {
51013 + tmp = obj->globbed;
51014 + while (tmp) {
51015 + if (!glob_match(tmp->filename, name)) {
51016 + obj = tmp;
51017 + goto found_obj;
51018 + }
51019 + tmp = tmp->next;
51020 + }
51021 + goto found_obj;
51022 + }
51023 + } while ((tmpsubj = tmpsubj->parent_subject));
51024 +next_component:
51025 + /* end case */
51026 + if (p == name)
51027 + break;
51028 +
51029 + while (*p != '/')
51030 + p--;
51031 + if (p == name)
51032 + lastp = p + 1;
51033 + else {
51034 + lastp = p;
51035 + p--;
51036 + }
51037 + c = *lastp;
51038 + *lastp = '\0';
51039 + } while (1);
51040 +found_obj:
51041 + read_unlock(&gr_inode_lock);
51042 + /* obj returned will always be non-null */
51043 + return obj;
51044 +}
51045 +
51046 +/* returns 0 when allowing, non-zero on error
51047 + op of 0 is used for readdir, so we don't log the names of hidden files
51048 +*/
51049 +__u32
51050 +gr_handle_sysctl(const struct ctl_table *table, const int op)
51051 +{
51052 + struct ctl_table *tmp;
51053 + const char *proc_sys = "/proc/sys";
51054 + char *path;
51055 + struct acl_object_label *obj;
51056 + unsigned short len = 0, pos = 0, depth = 0, i;
51057 + __u32 err = 0;
51058 + __u32 mode = 0;
51059 +
51060 + if (unlikely(!(gr_status & GR_READY)))
51061 + return 0;
51062 +
51063 + /* for now, ignore operations on non-sysctl entries if it's not a
51064 + readdir*/
51065 + if (table->child != NULL && op != 0)
51066 + return 0;
51067 +
51068 + mode |= GR_FIND;
51069 + /* it's only a read if it's an entry, read on dirs is for readdir */
51070 + if (op & MAY_READ)
51071 + mode |= GR_READ;
51072 + if (op & MAY_WRITE)
51073 + mode |= GR_WRITE;
51074 +
51075 + preempt_disable();
51076 +
51077 + path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
51078 +
51079 + /* it's only a read/write if it's an actual entry, not a dir
51080 + (which are opened for readdir)
51081 + */
51082 +
51083 + /* convert the requested sysctl entry into a pathname */
51084 +
51085 + for (tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
51086 + len += strlen(tmp->procname);
51087 + len++;
51088 + depth++;
51089 + }
51090 +
51091 + if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
51092 + /* deny */
51093 + goto out;
51094 + }
51095 +
51096 + memset(path, 0, PAGE_SIZE);
51097 +
51098 + memcpy(path, proc_sys, strlen(proc_sys));
51099 +
51100 + pos += strlen(proc_sys);
51101 +
51102 + for (; depth > 0; depth--) {
51103 + path[pos] = '/';
51104 + pos++;
51105 + for (i = 1, tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
51106 + if (depth == i) {
51107 + memcpy(path + pos, tmp->procname,
51108 + strlen(tmp->procname));
51109 + pos += strlen(tmp->procname);
51110 + }
51111 + i++;
51112 + }
51113 + }
51114 +
51115 + obj = gr_lookup_by_name(path, pos);
51116 + err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
51117 +
51118 + if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
51119 + ((err & mode) != mode))) {
51120 + __u32 new_mode = mode;
51121 +
51122 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
51123 +
51124 + err = 0;
51125 + gr_log_learn_sysctl(path, new_mode);
51126 + } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
51127 + gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
51128 + err = -ENOENT;
51129 + } else if (!(err & GR_FIND)) {
51130 + err = -ENOENT;
51131 + } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
51132 + gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
51133 + path, (mode & GR_READ) ? " reading" : "",
51134 + (mode & GR_WRITE) ? " writing" : "");
51135 + err = -EACCES;
51136 + } else if ((err & mode) != mode) {
51137 + err = -EACCES;
51138 + } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
51139 + gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
51140 + path, (mode & GR_READ) ? " reading" : "",
51141 + (mode & GR_WRITE) ? " writing" : "");
51142 + err = 0;
51143 + } else
51144 + err = 0;
51145 +
51146 + out:
51147 + preempt_enable();
51148 +
51149 + return err;
51150 +}
51151 +#endif
51152 +
51153 +int
51154 +gr_handle_proc_ptrace(struct task_struct *task)
51155 +{
51156 + struct file *filp;
51157 + struct task_struct *tmp = task;
51158 + struct task_struct *curtemp = current;
51159 + __u32 retmode;
51160 +
51161 +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
51162 + if (unlikely(!(gr_status & GR_READY)))
51163 + return 0;
51164 +#endif
51165 +
51166 + read_lock(&tasklist_lock);
51167 + read_lock(&grsec_exec_file_lock);
51168 + filp = task->exec_file;
51169 +
51170 + while (tmp->pid > 0) {
51171 + if (tmp == curtemp)
51172 + break;
51173 + tmp = tmp->real_parent;
51174 + }
51175 +
51176 + if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
51177 + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
51178 + read_unlock(&grsec_exec_file_lock);
51179 + read_unlock(&tasklist_lock);
51180 + return 1;
51181 + }
51182 +
51183 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
51184 + if (!(gr_status & GR_READY)) {
51185 + read_unlock(&grsec_exec_file_lock);
51186 + read_unlock(&tasklist_lock);
51187 + return 0;
51188 + }
51189 +#endif
51190 +
51191 + retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
51192 + read_unlock(&grsec_exec_file_lock);
51193 + read_unlock(&tasklist_lock);
51194 +
51195 + if (retmode & GR_NOPTRACE)
51196 + return 1;
51197 +
51198 + if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
51199 + && (current->acl != task->acl || (current->acl != current->role->root_label
51200 + && current->pid != task->pid)))
51201 + return 1;
51202 +
51203 + return 0;
51204 +}
51205 +
51206 +void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
51207 +{
51208 + if (unlikely(!(gr_status & GR_READY)))
51209 + return;
51210 +
51211 + if (!(current->role->roletype & GR_ROLE_GOD))
51212 + return;
51213 +
51214 + seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
51215 + p->role->rolename, gr_task_roletype_to_char(p),
51216 + p->acl->filename);
51217 +}
51218 +
51219 +int
51220 +gr_handle_ptrace(struct task_struct *task, const long request)
51221 +{
51222 + struct task_struct *tmp = task;
51223 + struct task_struct *curtemp = current;
51224 + __u32 retmode;
51225 +
51226 +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
51227 + if (unlikely(!(gr_status & GR_READY)))
51228 + return 0;
51229 +#endif
51230 +
51231 + read_lock(&tasklist_lock);
51232 + while (tmp->pid > 0) {
51233 + if (tmp == curtemp)
51234 + break;
51235 + tmp = tmp->real_parent;
51236 + }
51237 +
51238 + if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
51239 + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
51240 + read_unlock(&tasklist_lock);
51241 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
51242 + return 1;
51243 + }
51244 + read_unlock(&tasklist_lock);
51245 +
51246 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
51247 + if (!(gr_status & GR_READY))
51248 + return 0;
51249 +#endif
51250 +
51251 + read_lock(&grsec_exec_file_lock);
51252 + if (unlikely(!task->exec_file)) {
51253 + read_unlock(&grsec_exec_file_lock);
51254 + return 0;
51255 + }
51256 +
51257 + retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
51258 + read_unlock(&grsec_exec_file_lock);
51259 +
51260 + if (retmode & GR_NOPTRACE) {
51261 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
51262 + return 1;
51263 + }
51264 +
51265 + if (retmode & GR_PTRACERD) {
51266 + switch (request) {
51267 + case PTRACE_POKETEXT:
51268 + case PTRACE_POKEDATA:
51269 + case PTRACE_POKEUSR:
51270 +#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
51271 + case PTRACE_SETREGS:
51272 + case PTRACE_SETFPREGS:
51273 +#endif
51274 +#ifdef CONFIG_X86
51275 + case PTRACE_SETFPXREGS:
51276 +#endif
51277 +#ifdef CONFIG_ALTIVEC
51278 + case PTRACE_SETVRREGS:
51279 +#endif
51280 + return 1;
51281 + default:
51282 + return 0;
51283 + }
51284 + } else if (!(current->acl->mode & GR_POVERRIDE) &&
51285 + !(current->role->roletype & GR_ROLE_GOD) &&
51286 + (current->acl != task->acl)) {
51287 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
51288 + return 1;
51289 + }
51290 +
51291 + return 0;
51292 +}
51293 +
51294 +static int is_writable_mmap(const struct file *filp)
51295 +{
51296 + struct task_struct *task = current;
51297 + struct acl_object_label *obj, *obj2;
51298 +
51299 + if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
51300 + !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
51301 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
51302 + obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
51303 + task->role->root_label);
51304 + if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
51305 + gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
51306 + return 1;
51307 + }
51308 + }
51309 + return 0;
51310 +}
51311 +
51312 +int
51313 +gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
51314 +{
51315 + __u32 mode;
51316 +
51317 + if (unlikely(!file || !(prot & PROT_EXEC)))
51318 + return 1;
51319 +
51320 + if (is_writable_mmap(file))
51321 + return 0;
51322 +
51323 + mode =
51324 + gr_search_file(file->f_path.dentry,
51325 + GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
51326 + file->f_path.mnt);
51327 +
51328 + if (!gr_tpe_allow(file))
51329 + return 0;
51330 +
51331 + if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
51332 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
51333 + return 0;
51334 + } else if (unlikely(!(mode & GR_EXEC))) {
51335 + return 0;
51336 + } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
51337 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
51338 + return 1;
51339 + }
51340 +
51341 + return 1;
51342 +}
51343 +
51344 +int
51345 +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
51346 +{
51347 + __u32 mode;
51348 +
51349 + if (unlikely(!file || !(prot & PROT_EXEC)))
51350 + return 1;
51351 +
51352 + if (is_writable_mmap(file))
51353 + return 0;
51354 +
51355 + mode =
51356 + gr_search_file(file->f_path.dentry,
51357 + GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
51358 + file->f_path.mnt);
51359 +
51360 + if (!gr_tpe_allow(file))
51361 + return 0;
51362 +
51363 + if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
51364 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
51365 + return 0;
51366 + } else if (unlikely(!(mode & GR_EXEC))) {
51367 + return 0;
51368 + } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
51369 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
51370 + return 1;
51371 + }
51372 +
51373 + return 1;
51374 +}
51375 +
51376 +void
51377 +gr_acl_handle_psacct(struct task_struct *task, const long code)
51378 +{
51379 + unsigned long runtime;
51380 + unsigned long cputime;
51381 + unsigned int wday, cday;
51382 + __u8 whr, chr;
51383 + __u8 wmin, cmin;
51384 + __u8 wsec, csec;
51385 + struct timespec timeval;
51386 +
51387 + if (unlikely(!(gr_status & GR_READY) || !task->acl ||
51388 + !(task->acl->mode & GR_PROCACCT)))
51389 + return;
51390 +
51391 + do_posix_clock_monotonic_gettime(&timeval);
51392 + runtime = timeval.tv_sec - task->start_time.tv_sec;
51393 + wday = runtime / (3600 * 24);
51394 + runtime -= wday * (3600 * 24);
51395 + whr = runtime / 3600;
51396 + runtime -= whr * 3600;
51397 + wmin = runtime / 60;
51398 + runtime -= wmin * 60;
51399 + wsec = runtime;
51400 +
51401 + cputime = (task->utime + task->stime) / HZ;
51402 + cday = cputime / (3600 * 24);
51403 + cputime -= cday * (3600 * 24);
51404 + chr = cputime / 3600;
51405 + cputime -= chr * 3600;
51406 + cmin = cputime / 60;
51407 + cputime -= cmin * 60;
51408 + csec = cputime;
51409 +
51410 + gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
51411 +
51412 + return;
51413 +}
51414 +
51415 +void gr_set_kernel_label(struct task_struct *task)
51416 +{
51417 + if (gr_status & GR_READY) {
51418 + task->role = kernel_role;
51419 + task->acl = kernel_role->root_label;
51420 + }
51421 + return;
51422 +}
51423 +
51424 +#ifdef CONFIG_TASKSTATS
51425 +int gr_is_taskstats_denied(int pid)
51426 +{
51427 + struct task_struct *task;
51428 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
51429 + const struct cred *cred;
51430 +#endif
51431 + int ret = 0;
51432 +
51433 + /* restrict taskstats viewing to un-chrooted root users
51434 + who have the 'view' subject flag if the RBAC system is enabled
51435 + */
51436 +
51437 + rcu_read_lock();
51438 + read_lock(&tasklist_lock);
51439 + task = find_task_by_vpid(pid);
51440 + if (task) {
51441 +#ifdef CONFIG_GRKERNSEC_CHROOT
51442 + if (proc_is_chrooted(task))
51443 + ret = -EACCES;
51444 +#endif
51445 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
51446 + cred = __task_cred(task);
51447 +#ifdef CONFIG_GRKERNSEC_PROC_USER
51448 + if (cred->uid != 0)
51449 + ret = -EACCES;
51450 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
51451 + if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
51452 + ret = -EACCES;
51453 +#endif
51454 +#endif
51455 + if (gr_status & GR_READY) {
51456 + if (!(task->acl->mode & GR_VIEW))
51457 + ret = -EACCES;
51458 + }
51459 + } else
51460 + ret = -ENOENT;
51461 +
51462 + read_unlock(&tasklist_lock);
51463 + rcu_read_unlock();
51464 +
51465 + return ret;
51466 +}
51467 +#endif
51468 +
51469 +/* AUXV entries are filled via a descendant of search_binary_handler
51470 + after we've already applied the subject for the target
51471 +*/
51472 +int gr_acl_enable_at_secure(void)
51473 +{
51474 + if (unlikely(!(gr_status & GR_READY)))
51475 + return 0;
51476 +
51477 + if (current->acl->mode & GR_ATSECURE)
51478 + return 1;
51479 +
51480 + return 0;
51481 +}
51482 +
51483 +int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
51484 +{
51485 + struct task_struct *task = current;
51486 + struct dentry *dentry = file->f_path.dentry;
51487 + struct vfsmount *mnt = file->f_path.mnt;
51488 + struct acl_object_label *obj, *tmp;
51489 + struct acl_subject_label *subj;
51490 + unsigned int bufsize;
51491 + int is_not_root;
51492 + char *path;
51493 + dev_t dev = __get_dev(dentry);
51494 +
51495 + if (unlikely(!(gr_status & GR_READY)))
51496 + return 1;
51497 +
51498 + if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
51499 + return 1;
51500 +
51501 + /* ignore Eric Biederman */
51502 + if (IS_PRIVATE(dentry->d_inode))
51503 + return 1;
51504 +
51505 + subj = task->acl;
51506 + do {
51507 + obj = lookup_acl_obj_label(ino, dev, subj);
51508 + if (obj != NULL)
51509 + return (obj->mode & GR_FIND) ? 1 : 0;
51510 + } while ((subj = subj->parent_subject));
51511 +
51512 + /* this is purely an optimization since we're looking for an object
51513 + for the directory we're doing a readdir on
51514 + if it's possible for any globbed object to match the entry we're
51515 + filling into the directory, then the object we find here will be
51516 + an anchor point with attached globbed objects
51517 + */
51518 + obj = chk_obj_label_noglob(dentry, mnt, task->acl);
51519 + if (obj->globbed == NULL)
51520 + return (obj->mode & GR_FIND) ? 1 : 0;
51521 +
51522 + is_not_root = ((obj->filename[0] == '/') &&
51523 + (obj->filename[1] == '\0')) ? 0 : 1;
51524 + bufsize = PAGE_SIZE - namelen - is_not_root;
51525 +
51526 + /* check bufsize > PAGE_SIZE || bufsize == 0 */
51527 + if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
51528 + return 1;
51529 +
51530 + preempt_disable();
51531 + path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
51532 + bufsize);
51533 +
51534 + bufsize = strlen(path);
51535 +
51536 + /* if base is "/", don't append an additional slash */
51537 + if (is_not_root)
51538 + *(path + bufsize) = '/';
51539 + memcpy(path + bufsize + is_not_root, name, namelen);
51540 + *(path + bufsize + namelen + is_not_root) = '\0';
51541 +
51542 + tmp = obj->globbed;
51543 + while (tmp) {
51544 + if (!glob_match(tmp->filename, path)) {
51545 + preempt_enable();
51546 + return (tmp->mode & GR_FIND) ? 1 : 0;
51547 + }
51548 + tmp = tmp->next;
51549 + }
51550 + preempt_enable();
51551 + return (obj->mode & GR_FIND) ? 1 : 0;
51552 +}
51553 +
51554 +#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
51555 +EXPORT_SYMBOL(gr_acl_is_enabled);
51556 +#endif
51557 +EXPORT_SYMBOL(gr_learn_resource);
51558 +EXPORT_SYMBOL(gr_set_kernel_label);
51559 +#ifdef CONFIG_SECURITY
51560 +EXPORT_SYMBOL(gr_check_user_change);
51561 +EXPORT_SYMBOL(gr_check_group_change);
51562 +#endif
51563 +
51564 diff -urNp linux-3.0.9/grsecurity/gracl_cap.c linux-3.0.9/grsecurity/gracl_cap.c
51565 --- linux-3.0.9/grsecurity/gracl_cap.c 1969-12-31 19:00:00.000000000 -0500
51566 +++ linux-3.0.9/grsecurity/gracl_cap.c 2011-11-15 20:02:59.000000000 -0500
51567 @@ -0,0 +1,101 @@
51568 +#include <linux/kernel.h>
51569 +#include <linux/module.h>
51570 +#include <linux/sched.h>
51571 +#include <linux/gracl.h>
51572 +#include <linux/grsecurity.h>
51573 +#include <linux/grinternal.h>
51574 +
51575 +extern const char *captab_log[];
51576 +extern int captab_log_entries;
51577 +
51578 +int
51579 +gr_acl_is_capable(const int cap)
51580 +{
51581 + struct task_struct *task = current;
51582 + const struct cred *cred = current_cred();
51583 + struct acl_subject_label *curracl;
51584 + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
51585 + kernel_cap_t cap_audit = __cap_empty_set;
51586 +
51587 + if (!gr_acl_is_enabled())
51588 + return 1;
51589 +
51590 + curracl = task->acl;
51591 +
51592 + cap_drop = curracl->cap_lower;
51593 + cap_mask = curracl->cap_mask;
51594 + cap_audit = curracl->cap_invert_audit;
51595 +
51596 + while ((curracl = curracl->parent_subject)) {
51597 + /* if the cap isn't specified in the current computed mask but is specified in the
51598 + current level subject, and is lowered in the current level subject, then add
51599 + it to the set of dropped capabilities
51600 + otherwise, add the current level subject's mask to the current computed mask
51601 + */
51602 + if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
51603 + cap_raise(cap_mask, cap);
51604 + if (cap_raised(curracl->cap_lower, cap))
51605 + cap_raise(cap_drop, cap);
51606 + if (cap_raised(curracl->cap_invert_audit, cap))
51607 + cap_raise(cap_audit, cap);
51608 + }
51609 + }
51610 +
51611 + if (!cap_raised(cap_drop, cap)) {
51612 + if (cap_raised(cap_audit, cap))
51613 + gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
51614 + return 1;
51615 + }
51616 +
51617 + curracl = task->acl;
51618 +
51619 + if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
51620 + && cap_raised(cred->cap_effective, cap)) {
51621 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
51622 + task->role->roletype, cred->uid,
51623 + cred->gid, task->exec_file ?
51624 + gr_to_filename(task->exec_file->f_path.dentry,
51625 + task->exec_file->f_path.mnt) : curracl->filename,
51626 + curracl->filename, 0UL,
51627 + 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
51628 + return 1;
51629 + }
51630 +
51631 + if ((cap >= 0) && (cap < captab_log_entries) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
51632 + gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
51633 + return 0;
51634 +}
51635 +
51636 +int
51637 +gr_acl_is_capable_nolog(const int cap)
51638 +{
51639 + struct acl_subject_label *curracl;
51640 + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
51641 +
51642 + if (!gr_acl_is_enabled())
51643 + return 1;
51644 +
51645 + curracl = current->acl;
51646 +
51647 + cap_drop = curracl->cap_lower;
51648 + cap_mask = curracl->cap_mask;
51649 +
51650 + while ((curracl = curracl->parent_subject)) {
51651 + /* if the cap isn't specified in the current computed mask but is specified in the
51652 + current level subject, and is lowered in the current level subject, then add
51653 + it to the set of dropped capabilities
51654 + otherwise, add the current level subject's mask to the current computed mask
51655 + */
51656 + if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
51657 + cap_raise(cap_mask, cap);
51658 + if (cap_raised(curracl->cap_lower, cap))
51659 + cap_raise(cap_drop, cap);
51660 + }
51661 + }
51662 +
51663 + if (!cap_raised(cap_drop, cap))
51664 + return 1;
51665 +
51666 + return 0;
51667 +}
51668 +
51669 diff -urNp linux-3.0.9/grsecurity/gracl_fs.c linux-3.0.9/grsecurity/gracl_fs.c
51670 --- linux-3.0.9/grsecurity/gracl_fs.c 1969-12-31 19:00:00.000000000 -0500
51671 +++ linux-3.0.9/grsecurity/gracl_fs.c 2011-11-15 20:02:59.000000000 -0500
51672 @@ -0,0 +1,431 @@
51673 +#include <linux/kernel.h>
51674 +#include <linux/sched.h>
51675 +#include <linux/types.h>
51676 +#include <linux/fs.h>
51677 +#include <linux/file.h>
51678 +#include <linux/stat.h>
51679 +#include <linux/grsecurity.h>
51680 +#include <linux/grinternal.h>
51681 +#include <linux/gracl.h>
51682 +
51683 +__u32
51684 +gr_acl_handle_hidden_file(const struct dentry * dentry,
51685 + const struct vfsmount * mnt)
51686 +{
51687 + __u32 mode;
51688 +
51689 + if (unlikely(!dentry->d_inode))
51690 + return GR_FIND;
51691 +
51692 + mode =
51693 + gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
51694 +
51695 + if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
51696 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
51697 + return mode;
51698 + } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
51699 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
51700 + return 0;
51701 + } else if (unlikely(!(mode & GR_FIND)))
51702 + return 0;
51703 +
51704 + return GR_FIND;
51705 +}
51706 +
51707 +__u32
51708 +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
51709 + const int fmode)
51710 +{
51711 + __u32 reqmode = GR_FIND;
51712 + __u32 mode;
51713 +
51714 + if (unlikely(!dentry->d_inode))
51715 + return reqmode;
51716 +
51717 + if (unlikely(fmode & O_APPEND))
51718 + reqmode |= GR_APPEND;
51719 + else if (unlikely(fmode & FMODE_WRITE))
51720 + reqmode |= GR_WRITE;
51721 + if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
51722 + reqmode |= GR_READ;
51723 + if ((fmode & FMODE_GREXEC) && (fmode & __FMODE_EXEC))
51724 + reqmode &= ~GR_READ;
51725 + mode =
51726 + gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
51727 + mnt);
51728 +
51729 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
51730 + gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
51731 + reqmode & GR_READ ? " reading" : "",
51732 + reqmode & GR_WRITE ? " writing" : reqmode &
51733 + GR_APPEND ? " appending" : "");
51734 + return reqmode;
51735 + } else
51736 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
51737 + {
51738 + gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
51739 + reqmode & GR_READ ? " reading" : "",
51740 + reqmode & GR_WRITE ? " writing" : reqmode &
51741 + GR_APPEND ? " appending" : "");
51742 + return 0;
51743 + } else if (unlikely((mode & reqmode) != reqmode))
51744 + return 0;
51745 +
51746 + return reqmode;
51747 +}
51748 +
51749 +__u32
51750 +gr_acl_handle_creat(const struct dentry * dentry,
51751 + const struct dentry * p_dentry,
51752 + const struct vfsmount * p_mnt, const int fmode,
51753 + const int imode)
51754 +{
51755 + __u32 reqmode = GR_WRITE | GR_CREATE;
51756 + __u32 mode;
51757 +
51758 + if (unlikely(fmode & O_APPEND))
51759 + reqmode |= GR_APPEND;
51760 + if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
51761 + reqmode |= GR_READ;
51762 + if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
51763 + reqmode |= GR_SETID;
51764 +
51765 + mode =
51766 + gr_check_create(dentry, p_dentry, p_mnt,
51767 + reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
51768 +
51769 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
51770 + gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
51771 + reqmode & GR_READ ? " reading" : "",
51772 + reqmode & GR_WRITE ? " writing" : reqmode &
51773 + GR_APPEND ? " appending" : "");
51774 + return reqmode;
51775 + } else
51776 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
51777 + {
51778 + gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
51779 + reqmode & GR_READ ? " reading" : "",
51780 + reqmode & GR_WRITE ? " writing" : reqmode &
51781 + GR_APPEND ? " appending" : "");
51782 + return 0;
51783 + } else if (unlikely((mode & reqmode) != reqmode))
51784 + return 0;
51785 +
51786 + return reqmode;
51787 +}
51788 +
51789 +__u32
51790 +gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
51791 + const int fmode)
51792 +{
51793 + __u32 mode, reqmode = GR_FIND;
51794 +
51795 + if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
51796 + reqmode |= GR_EXEC;
51797 + if (fmode & S_IWOTH)
51798 + reqmode |= GR_WRITE;
51799 + if (fmode & S_IROTH)
51800 + reqmode |= GR_READ;
51801 +
51802 + mode =
51803 + gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
51804 + mnt);
51805 +
51806 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
51807 + gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
51808 + reqmode & GR_READ ? " reading" : "",
51809 + reqmode & GR_WRITE ? " writing" : "",
51810 + reqmode & GR_EXEC ? " executing" : "");
51811 + return reqmode;
51812 + } else
51813 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
51814 + {
51815 + gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
51816 + reqmode & GR_READ ? " reading" : "",
51817 + reqmode & GR_WRITE ? " writing" : "",
51818 + reqmode & GR_EXEC ? " executing" : "");
51819 + return 0;
51820 + } else if (unlikely((mode & reqmode) != reqmode))
51821 + return 0;
51822 +
51823 + return reqmode;
51824 +}
51825 +
51826 +static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
51827 +{
51828 + __u32 mode;
51829 +
51830 + mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
51831 +
51832 + if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
51833 + gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
51834 + return mode;
51835 + } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
51836 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
51837 + return 0;
51838 + } else if (unlikely((mode & (reqmode)) != (reqmode)))
51839 + return 0;
51840 +
51841 + return (reqmode);
51842 +}
51843 +
51844 +__u32
51845 +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
51846 +{
51847 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
51848 +}
51849 +
51850 +__u32
51851 +gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
51852 +{
51853 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
51854 +}
51855 +
51856 +__u32
51857 +gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
51858 +{
51859 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
51860 +}
51861 +
51862 +__u32
51863 +gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
51864 +{
51865 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
51866 +}
51867 +
51868 +__u32
51869 +gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
51870 + mode_t mode)
51871 +{
51872 + if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
51873 + return 1;
51874 +
51875 + if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
51876 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
51877 + GR_FCHMOD_ACL_MSG);
51878 + } else {
51879 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
51880 + }
51881 +}
51882 +
51883 +__u32
51884 +gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
51885 + mode_t mode)
51886 +{
51887 + if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
51888 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
51889 + GR_CHMOD_ACL_MSG);
51890 + } else {
51891 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
51892 + }
51893 +}
51894 +
51895 +__u32
51896 +gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
51897 +{
51898 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
51899 +}
51900 +
51901 +__u32
51902 +gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
51903 +{
51904 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
51905 +}
51906 +
51907 +__u32
51908 +gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
51909 +{
51910 + return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
51911 +}
51912 +
51913 +__u32
51914 +gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
51915 +{
51916 + return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
51917 + GR_UNIXCONNECT_ACL_MSG);
51918 +}
51919 +
51920 +/* hardlinks require at minimum create and link permission,
51921 + any additional privilege required is based on the
51922 + privilege of the file being linked to
51923 +*/
51924 +__u32
51925 +gr_acl_handle_link(const struct dentry * new_dentry,
51926 + const struct dentry * parent_dentry,
51927 + const struct vfsmount * parent_mnt,
51928 + const struct dentry * old_dentry,
51929 + const struct vfsmount * old_mnt, const char *to)
51930 +{
51931 + __u32 mode;
51932 + __u32 needmode = GR_CREATE | GR_LINK;
51933 + __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
51934 +
51935 + mode =
51936 + gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
51937 + old_mnt);
51938 +
51939 + if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
51940 + gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
51941 + return mode;
51942 + } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
51943 + gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
51944 + return 0;
51945 + } else if (unlikely((mode & needmode) != needmode))
51946 + return 0;
51947 +
51948 + return 1;
51949 +}
51950 +
51951 +__u32
51952 +gr_acl_handle_symlink(const struct dentry * new_dentry,
51953 + const struct dentry * parent_dentry,
51954 + const struct vfsmount * parent_mnt, const char *from)
51955 +{
51956 + __u32 needmode = GR_WRITE | GR_CREATE;
51957 + __u32 mode;
51958 +
51959 + mode =
51960 + gr_check_create(new_dentry, parent_dentry, parent_mnt,
51961 + GR_CREATE | GR_AUDIT_CREATE |
51962 + GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
51963 +
51964 + if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
51965 + gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
51966 + return mode;
51967 + } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
51968 + gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
51969 + return 0;
51970 + } else if (unlikely((mode & needmode) != needmode))
51971 + return 0;
51972 +
51973 + return (GR_WRITE | GR_CREATE);
51974 +}
51975 +
51976 +static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
51977 +{
51978 + __u32 mode;
51979 +
51980 + mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
51981 +
51982 + if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
51983 + gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
51984 + return mode;
51985 + } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
51986 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
51987 + return 0;
51988 + } else if (unlikely((mode & (reqmode)) != (reqmode)))
51989 + return 0;
51990 +
51991 + return (reqmode);
51992 +}
51993 +
51994 +__u32
51995 +gr_acl_handle_mknod(const struct dentry * new_dentry,
51996 + const struct dentry * parent_dentry,
51997 + const struct vfsmount * parent_mnt,
51998 + const int mode)
51999 +{
52000 + __u32 reqmode = GR_WRITE | GR_CREATE;
52001 + if (unlikely(mode & (S_ISUID | S_ISGID)))
52002 + reqmode |= GR_SETID;
52003 +
52004 + return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
52005 + reqmode, GR_MKNOD_ACL_MSG);
52006 +}
52007 +
52008 +__u32
52009 +gr_acl_handle_mkdir(const struct dentry *new_dentry,
52010 + const struct dentry *parent_dentry,
52011 + const struct vfsmount *parent_mnt)
52012 +{
52013 + return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
52014 + GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
52015 +}
52016 +
52017 +#define RENAME_CHECK_SUCCESS(old, new) \
52018 + (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
52019 + ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
52020 +
52021 +int
52022 +gr_acl_handle_rename(struct dentry *new_dentry,
52023 + struct dentry *parent_dentry,
52024 + const struct vfsmount *parent_mnt,
52025 + struct dentry *old_dentry,
52026 + struct inode *old_parent_inode,
52027 + struct vfsmount *old_mnt, const char *newname)
52028 +{
52029 + __u32 comp1, comp2;
52030 + int error = 0;
52031 +
52032 + if (unlikely(!gr_acl_is_enabled()))
52033 + return 0;
52034 +
52035 + if (!new_dentry->d_inode) {
52036 + comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
52037 + GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
52038 + GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
52039 + comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
52040 + GR_DELETE | GR_AUDIT_DELETE |
52041 + GR_AUDIT_READ | GR_AUDIT_WRITE |
52042 + GR_SUPPRESS, old_mnt);
52043 + } else {
52044 + comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
52045 + GR_CREATE | GR_DELETE |
52046 + GR_AUDIT_CREATE | GR_AUDIT_DELETE |
52047 + GR_AUDIT_READ | GR_AUDIT_WRITE |
52048 + GR_SUPPRESS, parent_mnt);
52049 + comp2 =
52050 + gr_search_file(old_dentry,
52051 + GR_READ | GR_WRITE | GR_AUDIT_READ |
52052 + GR_DELETE | GR_AUDIT_DELETE |
52053 + GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
52054 + }
52055 +
52056 + if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
52057 + ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
52058 + gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
52059 + else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
52060 + && !(comp2 & GR_SUPPRESS)) {
52061 + gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
52062 + error = -EACCES;
52063 + } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
52064 + error = -EACCES;
52065 +
52066 + return error;
52067 +}
52068 +
52069 +void
52070 +gr_acl_handle_exit(void)
52071 +{
52072 + u16 id;
52073 + char *rolename;
52074 + struct file *exec_file;
52075 +
52076 + if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
52077 + !(current->role->roletype & GR_ROLE_PERSIST))) {
52078 + id = current->acl_role_id;
52079 + rolename = current->role->rolename;
52080 + gr_set_acls(1);
52081 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
52082 + }
52083 +
52084 + write_lock(&grsec_exec_file_lock);
52085 + exec_file = current->exec_file;
52086 + current->exec_file = NULL;
52087 + write_unlock(&grsec_exec_file_lock);
52088 +
52089 + if (exec_file)
52090 + fput(exec_file);
52091 +}
52092 +
52093 +int
52094 +gr_acl_handle_procpidmem(const struct task_struct *task)
52095 +{
52096 + if (unlikely(!gr_acl_is_enabled()))
52097 + return 0;
52098 +
52099 + if (task != current && task->acl->mode & GR_PROTPROCFD)
52100 + return -EACCES;
52101 +
52102 + return 0;
52103 +}
52104 diff -urNp linux-3.0.9/grsecurity/gracl_ip.c linux-3.0.9/grsecurity/gracl_ip.c
52105 --- linux-3.0.9/grsecurity/gracl_ip.c 1969-12-31 19:00:00.000000000 -0500
52106 +++ linux-3.0.9/grsecurity/gracl_ip.c 2011-11-15 20:02:59.000000000 -0500
52107 @@ -0,0 +1,381 @@
52108 +#include <linux/kernel.h>
52109 +#include <asm/uaccess.h>
52110 +#include <asm/errno.h>
52111 +#include <net/sock.h>
52112 +#include <linux/file.h>
52113 +#include <linux/fs.h>
52114 +#include <linux/net.h>
52115 +#include <linux/in.h>
52116 +#include <linux/skbuff.h>
52117 +#include <linux/ip.h>
52118 +#include <linux/udp.h>
52119 +#include <linux/types.h>
52120 +#include <linux/sched.h>
52121 +#include <linux/netdevice.h>
52122 +#include <linux/inetdevice.h>
52123 +#include <linux/gracl.h>
52124 +#include <linux/grsecurity.h>
52125 +#include <linux/grinternal.h>
52126 +
52127 +#define GR_BIND 0x01
52128 +#define GR_CONNECT 0x02
52129 +#define GR_INVERT 0x04
52130 +#define GR_BINDOVERRIDE 0x08
52131 +#define GR_CONNECTOVERRIDE 0x10
52132 +#define GR_SOCK_FAMILY 0x20
52133 +
52134 +static const char * gr_protocols[IPPROTO_MAX] = {
52135 + "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
52136 + "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
52137 + "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
52138 + "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
52139 + "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
52140 + "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
52141 + "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
52142 + "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
52143 + "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
52144 + "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
52145 + "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
52146 + "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
52147 + "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
52148 + "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
52149 + "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
52150 + "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
52151 + "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
52152 + "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
52153 + "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
52154 + "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
52155 + "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
52156 + "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
52157 + "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
52158 + "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
52159 + "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
52160 + "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
52161 + "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
52162 + "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
52163 + "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
52164 + "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
52165 + "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
52166 + "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
52167 + };
52168 +
52169 +static const char * gr_socktypes[SOCK_MAX] = {
52170 + "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
52171 + "unknown:7", "unknown:8", "unknown:9", "packet"
52172 + };
52173 +
52174 +static const char * gr_sockfamilies[AF_MAX+1] = {
52175 + "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
52176 + "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
52177 + "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
52178 + "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154", "ciaf"
52179 + };
52180 +
52181 +const char *
52182 +gr_proto_to_name(unsigned char proto)
52183 +{
52184 + return gr_protocols[proto];
52185 +}
52186 +
52187 +const char *
52188 +gr_socktype_to_name(unsigned char type)
52189 +{
52190 + return gr_socktypes[type];
52191 +}
52192 +
52193 +const char *
52194 +gr_sockfamily_to_name(unsigned char family)
52195 +{
52196 + return gr_sockfamilies[family];
52197 +}
52198 +
52199 +int
52200 +gr_search_socket(const int domain, const int type, const int protocol)
52201 +{
52202 + struct acl_subject_label *curr;
52203 + const struct cred *cred = current_cred();
52204 +
52205 + if (unlikely(!gr_acl_is_enabled()))
52206 + goto exit;
52207 +
52208 + if ((domain < 0) || (type < 0) || (protocol < 0) ||
52209 + (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
52210 + goto exit; // let the kernel handle it
52211 +
52212 + curr = current->acl;
52213 +
52214 + if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
52215 + /* the family is allowed, if this is PF_INET allow it only if
52216 + the extra sock type/protocol checks pass */
52217 + if (domain == PF_INET)
52218 + goto inet_check;
52219 + goto exit;
52220 + } else {
52221 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
52222 + __u32 fakeip = 0;
52223 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
52224 + current->role->roletype, cred->uid,
52225 + cred->gid, current->exec_file ?
52226 + gr_to_filename(current->exec_file->f_path.dentry,
52227 + current->exec_file->f_path.mnt) :
52228 + curr->filename, curr->filename,
52229 + &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
52230 + &current->signal->saved_ip);
52231 + goto exit;
52232 + }
52233 + goto exit_fail;
52234 + }
52235 +
52236 +inet_check:
52237 + /* the rest of this checking is for IPv4 only */
52238 + if (!curr->ips)
52239 + goto exit;
52240 +
52241 + if ((curr->ip_type & (1 << type)) &&
52242 + (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
52243 + goto exit;
52244 +
52245 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
52246 + /* we don't place acls on raw sockets , and sometimes
52247 + dgram/ip sockets are opened for ioctl and not
52248 + bind/connect, so we'll fake a bind learn log */
52249 + if (type == SOCK_RAW || type == SOCK_PACKET) {
52250 + __u32 fakeip = 0;
52251 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
52252 + current->role->roletype, cred->uid,
52253 + cred->gid, current->exec_file ?
52254 + gr_to_filename(current->exec_file->f_path.dentry,
52255 + current->exec_file->f_path.mnt) :
52256 + curr->filename, curr->filename,
52257 + &fakeip, 0, type,
52258 + protocol, GR_CONNECT, &current->signal->saved_ip);
52259 + } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
52260 + __u32 fakeip = 0;
52261 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
52262 + current->role->roletype, cred->uid,
52263 + cred->gid, current->exec_file ?
52264 + gr_to_filename(current->exec_file->f_path.dentry,
52265 + current->exec_file->f_path.mnt) :
52266 + curr->filename, curr->filename,
52267 + &fakeip, 0, type,
52268 + protocol, GR_BIND, &current->signal->saved_ip);
52269 + }
52270 + /* we'll log when they use connect or bind */
52271 + goto exit;
52272 + }
52273 +
52274 +exit_fail:
52275 + if (domain == PF_INET)
52276 + gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
52277 + gr_socktype_to_name(type), gr_proto_to_name(protocol));
52278 + else
52279 + gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
52280 + gr_socktype_to_name(type), protocol);
52281 +
52282 + return 0;
52283 +exit:
52284 + return 1;
52285 +}
52286 +
52287 +int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
52288 +{
52289 + if ((ip->mode & mode) &&
52290 + (ip_port >= ip->low) &&
52291 + (ip_port <= ip->high) &&
52292 + ((ntohl(ip_addr) & our_netmask) ==
52293 + (ntohl(our_addr) & our_netmask))
52294 + && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
52295 + && (ip->type & (1 << type))) {
52296 + if (ip->mode & GR_INVERT)
52297 + return 2; // specifically denied
52298 + else
52299 + return 1; // allowed
52300 + }
52301 +
52302 + return 0; // not specifically allowed, may continue parsing
52303 +}
52304 +
52305 +static int
52306 +gr_search_connectbind(const int full_mode, struct sock *sk,
52307 + struct sockaddr_in *addr, const int type)
52308 +{
52309 + char iface[IFNAMSIZ] = {0};
52310 + struct acl_subject_label *curr;
52311 + struct acl_ip_label *ip;
52312 + struct inet_sock *isk;
52313 + struct net_device *dev;
52314 + struct in_device *idev;
52315 + unsigned long i;
52316 + int ret;
52317 + int mode = full_mode & (GR_BIND | GR_CONNECT);
52318 + __u32 ip_addr = 0;
52319 + __u32 our_addr;
52320 + __u32 our_netmask;
52321 + char *p;
52322 + __u16 ip_port = 0;
52323 + const struct cred *cred = current_cred();
52324 +
52325 + if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
52326 + return 0;
52327 +
52328 + curr = current->acl;
52329 + isk = inet_sk(sk);
52330 +
52331 + /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
52332 + if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
52333 + addr->sin_addr.s_addr = curr->inaddr_any_override;
52334 + if ((full_mode & GR_CONNECT) && isk->inet_saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
52335 + struct sockaddr_in saddr;
52336 + int err;
52337 +
52338 + saddr.sin_family = AF_INET;
52339 + saddr.sin_addr.s_addr = curr->inaddr_any_override;
52340 + saddr.sin_port = isk->inet_sport;
52341 +
52342 + err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
52343 + if (err)
52344 + return err;
52345 +
52346 + err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
52347 + if (err)
52348 + return err;
52349 + }
52350 +
52351 + if (!curr->ips)
52352 + return 0;
52353 +
52354 + ip_addr = addr->sin_addr.s_addr;
52355 + ip_port = ntohs(addr->sin_port);
52356 +
52357 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
52358 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
52359 + current->role->roletype, cred->uid,
52360 + cred->gid, current->exec_file ?
52361 + gr_to_filename(current->exec_file->f_path.dentry,
52362 + current->exec_file->f_path.mnt) :
52363 + curr->filename, curr->filename,
52364 + &ip_addr, ip_port, type,
52365 + sk->sk_protocol, mode, &current->signal->saved_ip);
52366 + return 0;
52367 + }
52368 +
52369 + for (i = 0; i < curr->ip_num; i++) {
52370 + ip = *(curr->ips + i);
52371 + if (ip->iface != NULL) {
52372 + strncpy(iface, ip->iface, IFNAMSIZ - 1);
52373 + p = strchr(iface, ':');
52374 + if (p != NULL)
52375 + *p = '\0';
52376 + dev = dev_get_by_name(sock_net(sk), iface);
52377 + if (dev == NULL)
52378 + continue;
52379 + idev = in_dev_get(dev);
52380 + if (idev == NULL) {
52381 + dev_put(dev);
52382 + continue;
52383 + }
52384 + rcu_read_lock();
52385 + for_ifa(idev) {
52386 + if (!strcmp(ip->iface, ifa->ifa_label)) {
52387 + our_addr = ifa->ifa_address;
52388 + our_netmask = 0xffffffff;
52389 + ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
52390 + if (ret == 1) {
52391 + rcu_read_unlock();
52392 + in_dev_put(idev);
52393 + dev_put(dev);
52394 + return 0;
52395 + } else if (ret == 2) {
52396 + rcu_read_unlock();
52397 + in_dev_put(idev);
52398 + dev_put(dev);
52399 + goto denied;
52400 + }
52401 + }
52402 + } endfor_ifa(idev);
52403 + rcu_read_unlock();
52404 + in_dev_put(idev);
52405 + dev_put(dev);
52406 + } else {
52407 + our_addr = ip->addr;
52408 + our_netmask = ip->netmask;
52409 + ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
52410 + if (ret == 1)
52411 + return 0;
52412 + else if (ret == 2)
52413 + goto denied;
52414 + }
52415 + }
52416 +
52417 +denied:
52418 + if (mode == GR_BIND)
52419 + gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
52420 + else if (mode == GR_CONNECT)
52421 + gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
52422 +
52423 + return -EACCES;
52424 +}
52425 +
52426 +int
52427 +gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
52428 +{
52429 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
52430 +}
52431 +
52432 +int
52433 +gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
52434 +{
52435 + return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
52436 +}
52437 +
52438 +int gr_search_listen(struct socket *sock)
52439 +{
52440 + struct sock *sk = sock->sk;
52441 + struct sockaddr_in addr;
52442 +
52443 + addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
52444 + addr.sin_port = inet_sk(sk)->inet_sport;
52445 +
52446 + return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
52447 +}
52448 +
52449 +int gr_search_accept(struct socket *sock)
52450 +{
52451 + struct sock *sk = sock->sk;
52452 + struct sockaddr_in addr;
52453 +
52454 + addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
52455 + addr.sin_port = inet_sk(sk)->inet_sport;
52456 +
52457 + return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
52458 +}
52459 +
52460 +int
52461 +gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
52462 +{
52463 + if (addr)
52464 + return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
52465 + else {
52466 + struct sockaddr_in sin;
52467 + const struct inet_sock *inet = inet_sk(sk);
52468 +
52469 + sin.sin_addr.s_addr = inet->inet_daddr;
52470 + sin.sin_port = inet->inet_dport;
52471 +
52472 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
52473 + }
52474 +}
52475 +
52476 +int
52477 +gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
52478 +{
52479 + struct sockaddr_in sin;
52480 +
52481 + if (unlikely(skb->len < sizeof (struct udphdr)))
52482 + return 0; // skip this packet
52483 +
52484 + sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
52485 + sin.sin_port = udp_hdr(skb)->source;
52486 +
52487 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
52488 +}
52489 diff -urNp linux-3.0.9/grsecurity/gracl_learn.c linux-3.0.9/grsecurity/gracl_learn.c
52490 --- linux-3.0.9/grsecurity/gracl_learn.c 1969-12-31 19:00:00.000000000 -0500
52491 +++ linux-3.0.9/grsecurity/gracl_learn.c 2011-11-15 20:02:59.000000000 -0500
52492 @@ -0,0 +1,207 @@
52493 +#include <linux/kernel.h>
52494 +#include <linux/mm.h>
52495 +#include <linux/sched.h>
52496 +#include <linux/poll.h>
52497 +#include <linux/string.h>
52498 +#include <linux/file.h>
52499 +#include <linux/types.h>
52500 +#include <linux/vmalloc.h>
52501 +#include <linux/grinternal.h>
52502 +
52503 +extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
52504 + size_t count, loff_t *ppos);
52505 +extern int gr_acl_is_enabled(void);
52506 +
52507 +static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
52508 +static int gr_learn_attached;
52509 +
52510 +/* use a 512k buffer */
52511 +#define LEARN_BUFFER_SIZE (512 * 1024)
52512 +
52513 +static DEFINE_SPINLOCK(gr_learn_lock);
52514 +static DEFINE_MUTEX(gr_learn_user_mutex);
52515 +
52516 +/* we need to maintain two buffers, so that the kernel context of grlearn
52517 + uses a semaphore around the userspace copying, and the other kernel contexts
52518 + use a spinlock when copying into the buffer, since they cannot sleep
52519 +*/
52520 +static char *learn_buffer;
52521 +static char *learn_buffer_user;
52522 +static int learn_buffer_len;
52523 +static int learn_buffer_user_len;
52524 +
52525 +static ssize_t
52526 +read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
52527 +{
52528 + DECLARE_WAITQUEUE(wait, current);
52529 + ssize_t retval = 0;
52530 +
52531 + add_wait_queue(&learn_wait, &wait);
52532 + set_current_state(TASK_INTERRUPTIBLE);
52533 + do {
52534 + mutex_lock(&gr_learn_user_mutex);
52535 + spin_lock(&gr_learn_lock);
52536 + if (learn_buffer_len)
52537 + break;
52538 + spin_unlock(&gr_learn_lock);
52539 + mutex_unlock(&gr_learn_user_mutex);
52540 + if (file->f_flags & O_NONBLOCK) {
52541 + retval = -EAGAIN;
52542 + goto out;
52543 + }
52544 + if (signal_pending(current)) {
52545 + retval = -ERESTARTSYS;
52546 + goto out;
52547 + }
52548 +
52549 + schedule();
52550 + } while (1);
52551 +
52552 + memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
52553 + learn_buffer_user_len = learn_buffer_len;
52554 + retval = learn_buffer_len;
52555 + learn_buffer_len = 0;
52556 +
52557 + spin_unlock(&gr_learn_lock);
52558 +
52559 + if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
52560 + retval = -EFAULT;
52561 +
52562 + mutex_unlock(&gr_learn_user_mutex);
52563 +out:
52564 + set_current_state(TASK_RUNNING);
52565 + remove_wait_queue(&learn_wait, &wait);
52566 + return retval;
52567 +}
52568 +
52569 +static unsigned int
52570 +poll_learn(struct file * file, poll_table * wait)
52571 +{
52572 + poll_wait(file, &learn_wait, wait);
52573 +
52574 + if (learn_buffer_len)
52575 + return (POLLIN | POLLRDNORM);
52576 +
52577 + return 0;
52578 +}
52579 +
52580 +void
52581 +gr_clear_learn_entries(void)
52582 +{
52583 + char *tmp;
52584 +
52585 + mutex_lock(&gr_learn_user_mutex);
52586 + spin_lock(&gr_learn_lock);
52587 + tmp = learn_buffer;
52588 + learn_buffer = NULL;
52589 + spin_unlock(&gr_learn_lock);
52590 + if (tmp)
52591 + vfree(tmp);
52592 + if (learn_buffer_user != NULL) {
52593 + vfree(learn_buffer_user);
52594 + learn_buffer_user = NULL;
52595 + }
52596 + learn_buffer_len = 0;
52597 + mutex_unlock(&gr_learn_user_mutex);
52598 +
52599 + return;
52600 +}
52601 +
52602 +void
52603 +gr_add_learn_entry(const char *fmt, ...)
52604 +{
52605 + va_list args;
52606 + unsigned int len;
52607 +
52608 + if (!gr_learn_attached)
52609 + return;
52610 +
52611 + spin_lock(&gr_learn_lock);
52612 +
52613 + /* leave a gap at the end so we know when it's "full" but don't have to
52614 + compute the exact length of the string we're trying to append
52615 + */
52616 + if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
52617 + spin_unlock(&gr_learn_lock);
52618 + wake_up_interruptible(&learn_wait);
52619 + return;
52620 + }
52621 + if (learn_buffer == NULL) {
52622 + spin_unlock(&gr_learn_lock);
52623 + return;
52624 + }
52625 +
52626 + va_start(args, fmt);
52627 + len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
52628 + va_end(args);
52629 +
52630 + learn_buffer_len += len + 1;
52631 +
52632 + spin_unlock(&gr_learn_lock);
52633 + wake_up_interruptible(&learn_wait);
52634 +
52635 + return;
52636 +}
52637 +
52638 +static int
52639 +open_learn(struct inode *inode, struct file *file)
52640 +{
52641 + if (file->f_mode & FMODE_READ && gr_learn_attached)
52642 + return -EBUSY;
52643 + if (file->f_mode & FMODE_READ) {
52644 + int retval = 0;
52645 + mutex_lock(&gr_learn_user_mutex);
52646 + if (learn_buffer == NULL)
52647 + learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
52648 + if (learn_buffer_user == NULL)
52649 + learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
52650 + if (learn_buffer == NULL) {
52651 + retval = -ENOMEM;
52652 + goto out_error;
52653 + }
52654 + if (learn_buffer_user == NULL) {
52655 + retval = -ENOMEM;
52656 + goto out_error;
52657 + }
52658 + learn_buffer_len = 0;
52659 + learn_buffer_user_len = 0;
52660 + gr_learn_attached = 1;
52661 +out_error:
52662 + mutex_unlock(&gr_learn_user_mutex);
52663 + return retval;
52664 + }
52665 + return 0;
52666 +}
52667 +
52668 +static int
52669 +close_learn(struct inode *inode, struct file *file)
52670 +{
52671 + if (file->f_mode & FMODE_READ) {
52672 + char *tmp = NULL;
52673 + mutex_lock(&gr_learn_user_mutex);
52674 + spin_lock(&gr_learn_lock);
52675 + tmp = learn_buffer;
52676 + learn_buffer = NULL;
52677 + spin_unlock(&gr_learn_lock);
52678 + if (tmp)
52679 + vfree(tmp);
52680 + if (learn_buffer_user != NULL) {
52681 + vfree(learn_buffer_user);
52682 + learn_buffer_user = NULL;
52683 + }
52684 + learn_buffer_len = 0;
52685 + learn_buffer_user_len = 0;
52686 + gr_learn_attached = 0;
52687 + mutex_unlock(&gr_learn_user_mutex);
52688 + }
52689 +
52690 + return 0;
52691 +}
52692 +
52693 +const struct file_operations grsec_fops = {
52694 + .read = read_learn,
52695 + .write = write_grsec_handler,
52696 + .open = open_learn,
52697 + .release = close_learn,
52698 + .poll = poll_learn,
52699 +};
52700 diff -urNp linux-3.0.9/grsecurity/gracl_res.c linux-3.0.9/grsecurity/gracl_res.c
52701 --- linux-3.0.9/grsecurity/gracl_res.c 1969-12-31 19:00:00.000000000 -0500
52702 +++ linux-3.0.9/grsecurity/gracl_res.c 2011-11-15 20:02:59.000000000 -0500
52703 @@ -0,0 +1,68 @@
52704 +#include <linux/kernel.h>
52705 +#include <linux/sched.h>
52706 +#include <linux/gracl.h>
52707 +#include <linux/grinternal.h>
52708 +
52709 +static const char *restab_log[] = {
52710 + [RLIMIT_CPU] = "RLIMIT_CPU",
52711 + [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
52712 + [RLIMIT_DATA] = "RLIMIT_DATA",
52713 + [RLIMIT_STACK] = "RLIMIT_STACK",
52714 + [RLIMIT_CORE] = "RLIMIT_CORE",
52715 + [RLIMIT_RSS] = "RLIMIT_RSS",
52716 + [RLIMIT_NPROC] = "RLIMIT_NPROC",
52717 + [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
52718 + [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
52719 + [RLIMIT_AS] = "RLIMIT_AS",
52720 + [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
52721 + [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
52722 + [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
52723 + [RLIMIT_NICE] = "RLIMIT_NICE",
52724 + [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
52725 + [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
52726 + [GR_CRASH_RES] = "RLIMIT_CRASH"
52727 +};
52728 +
52729 +void
52730 +gr_log_resource(const struct task_struct *task,
52731 + const int res, const unsigned long wanted, const int gt)
52732 +{
52733 + const struct cred *cred;
52734 + unsigned long rlim;
52735 +
52736 + if (!gr_acl_is_enabled() && !grsec_resource_logging)
52737 + return;
52738 +
52739 + // not yet supported resource
52740 + if (unlikely(!restab_log[res]))
52741 + return;
52742 +
52743 + if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
52744 + rlim = task_rlimit_max(task, res);
52745 + else
52746 + rlim = task_rlimit(task, res);
52747 +
52748 + if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
52749 + return;
52750 +
52751 + rcu_read_lock();
52752 + cred = __task_cred(task);
52753 +
52754 + if (res == RLIMIT_NPROC &&
52755 + (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
52756 + cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
52757 + goto out_rcu_unlock;
52758 + else if (res == RLIMIT_MEMLOCK &&
52759 + cap_raised(cred->cap_effective, CAP_IPC_LOCK))
52760 + goto out_rcu_unlock;
52761 + else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
52762 + goto out_rcu_unlock;
52763 + rcu_read_unlock();
52764 +
52765 + gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
52766 +
52767 + return;
52768 +out_rcu_unlock:
52769 + rcu_read_unlock();
52770 + return;
52771 +}
52772 diff -urNp linux-3.0.9/grsecurity/gracl_segv.c linux-3.0.9/grsecurity/gracl_segv.c
52773 --- linux-3.0.9/grsecurity/gracl_segv.c 1969-12-31 19:00:00.000000000 -0500
52774 +++ linux-3.0.9/grsecurity/gracl_segv.c 2011-11-15 20:02:59.000000000 -0500
52775 @@ -0,0 +1,299 @@
52776 +#include <linux/kernel.h>
52777 +#include <linux/mm.h>
52778 +#include <asm/uaccess.h>
52779 +#include <asm/errno.h>
52780 +#include <asm/mman.h>
52781 +#include <net/sock.h>
52782 +#include <linux/file.h>
52783 +#include <linux/fs.h>
52784 +#include <linux/net.h>
52785 +#include <linux/in.h>
52786 +#include <linux/slab.h>
52787 +#include <linux/types.h>
52788 +#include <linux/sched.h>
52789 +#include <linux/timer.h>
52790 +#include <linux/gracl.h>
52791 +#include <linux/grsecurity.h>
52792 +#include <linux/grinternal.h>
52793 +
52794 +static struct crash_uid *uid_set;
52795 +static unsigned short uid_used;
52796 +static DEFINE_SPINLOCK(gr_uid_lock);
52797 +extern rwlock_t gr_inode_lock;
52798 +extern struct acl_subject_label *
52799 + lookup_acl_subj_label(const ino_t inode, const dev_t dev,
52800 + struct acl_role_label *role);
52801 +
52802 +#ifdef CONFIG_BTRFS_FS
52803 +extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
52804 +extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
52805 +#endif
52806 +
52807 +static inline dev_t __get_dev(const struct dentry *dentry)
52808 +{
52809 +#ifdef CONFIG_BTRFS_FS
52810 + if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
52811 + return get_btrfs_dev_from_inode(dentry->d_inode);
52812 + else
52813 +#endif
52814 + return dentry->d_inode->i_sb->s_dev;
52815 +}
52816 +
52817 +int
52818 +gr_init_uidset(void)
52819 +{
52820 + uid_set =
52821 + kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
52822 + uid_used = 0;
52823 +
52824 + return uid_set ? 1 : 0;
52825 +}
52826 +
52827 +void
52828 +gr_free_uidset(void)
52829 +{
52830 + if (uid_set)
52831 + kfree(uid_set);
52832 +
52833 + return;
52834 +}
52835 +
52836 +int
52837 +gr_find_uid(const uid_t uid)
52838 +{
52839 + struct crash_uid *tmp = uid_set;
52840 + uid_t buid;
52841 + int low = 0, high = uid_used - 1, mid;
52842 +
52843 + while (high >= low) {
52844 + mid = (low + high) >> 1;
52845 + buid = tmp[mid].uid;
52846 + if (buid == uid)
52847 + return mid;
52848 + if (buid > uid)
52849 + high = mid - 1;
52850 + if (buid < uid)
52851 + low = mid + 1;
52852 + }
52853 +
52854 + return -1;
52855 +}
52856 +
52857 +static __inline__ void
52858 +gr_insertsort(void)
52859 +{
52860 + unsigned short i, j;
52861 + struct crash_uid index;
52862 +
52863 + for (i = 1; i < uid_used; i++) {
52864 + index = uid_set[i];
52865 + j = i;
52866 + while ((j > 0) && uid_set[j - 1].uid > index.uid) {
52867 + uid_set[j] = uid_set[j - 1];
52868 + j--;
52869 + }
52870 + uid_set[j] = index;
52871 + }
52872 +
52873 + return;
52874 +}
52875 +
52876 +static __inline__ void
52877 +gr_insert_uid(const uid_t uid, const unsigned long expires)
52878 +{
52879 + int loc;
52880 +
52881 + if (uid_used == GR_UIDTABLE_MAX)
52882 + return;
52883 +
52884 + loc = gr_find_uid(uid);
52885 +
52886 + if (loc >= 0) {
52887 + uid_set[loc].expires = expires;
52888 + return;
52889 + }
52890 +
52891 + uid_set[uid_used].uid = uid;
52892 + uid_set[uid_used].expires = expires;
52893 + uid_used++;
52894 +
52895 + gr_insertsort();
52896 +
52897 + return;
52898 +}
52899 +
52900 +void
52901 +gr_remove_uid(const unsigned short loc)
52902 +{
52903 + unsigned short i;
52904 +
52905 + for (i = loc + 1; i < uid_used; i++)
52906 + uid_set[i - 1] = uid_set[i];
52907 +
52908 + uid_used--;
52909 +
52910 + return;
52911 +}
52912 +
52913 +int
52914 +gr_check_crash_uid(const uid_t uid)
52915 +{
52916 + int loc;
52917 + int ret = 0;
52918 +
52919 + if (unlikely(!gr_acl_is_enabled()))
52920 + return 0;
52921 +
52922 + spin_lock(&gr_uid_lock);
52923 + loc = gr_find_uid(uid);
52924 +
52925 + if (loc < 0)
52926 + goto out_unlock;
52927 +
52928 + if (time_before_eq(uid_set[loc].expires, get_seconds()))
52929 + gr_remove_uid(loc);
52930 + else
52931 + ret = 1;
52932 +
52933 +out_unlock:
52934 + spin_unlock(&gr_uid_lock);
52935 + return ret;
52936 +}
52937 +
52938 +static __inline__ int
52939 +proc_is_setxid(const struct cred *cred)
52940 +{
52941 + if (cred->uid != cred->euid || cred->uid != cred->suid ||
52942 + cred->uid != cred->fsuid)
52943 + return 1;
52944 + if (cred->gid != cred->egid || cred->gid != cred->sgid ||
52945 + cred->gid != cred->fsgid)
52946 + return 1;
52947 +
52948 + return 0;
52949 +}
52950 +
52951 +extern int gr_fake_force_sig(int sig, struct task_struct *t);
52952 +
52953 +void
52954 +gr_handle_crash(struct task_struct *task, const int sig)
52955 +{
52956 + struct acl_subject_label *curr;
52957 + struct task_struct *tsk, *tsk2;
52958 + const struct cred *cred;
52959 + const struct cred *cred2;
52960 +
52961 + if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
52962 + return;
52963 +
52964 + if (unlikely(!gr_acl_is_enabled()))
52965 + return;
52966 +
52967 + curr = task->acl;
52968 +
52969 + if (!(curr->resmask & (1 << GR_CRASH_RES)))
52970 + return;
52971 +
52972 + if (time_before_eq(curr->expires, get_seconds())) {
52973 + curr->expires = 0;
52974 + curr->crashes = 0;
52975 + }
52976 +
52977 + curr->crashes++;
52978 +
52979 + if (!curr->expires)
52980 + curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
52981 +
52982 + if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
52983 + time_after(curr->expires, get_seconds())) {
52984 + rcu_read_lock();
52985 + cred = __task_cred(task);
52986 + if (cred->uid && proc_is_setxid(cred)) {
52987 + gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
52988 + spin_lock(&gr_uid_lock);
52989 + gr_insert_uid(cred->uid, curr->expires);
52990 + spin_unlock(&gr_uid_lock);
52991 + curr->expires = 0;
52992 + curr->crashes = 0;
52993 + read_lock(&tasklist_lock);
52994 + do_each_thread(tsk2, tsk) {
52995 + cred2 = __task_cred(tsk);
52996 + if (tsk != task && cred2->uid == cred->uid)
52997 + gr_fake_force_sig(SIGKILL, tsk);
52998 + } while_each_thread(tsk2, tsk);
52999 + read_unlock(&tasklist_lock);
53000 + } else {
53001 + gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
53002 + read_lock(&tasklist_lock);
53003 + read_lock(&grsec_exec_file_lock);
53004 + do_each_thread(tsk2, tsk) {
53005 + if (likely(tsk != task)) {
53006 + // if this thread has the same subject as the one that triggered
53007 + // RES_CRASH and it's the same binary, kill it
53008 + if (tsk->acl == task->acl && tsk->exec_file == task->exec_file)
53009 + gr_fake_force_sig(SIGKILL, tsk);
53010 + }
53011 + } while_each_thread(tsk2, tsk);
53012 + read_unlock(&grsec_exec_file_lock);
53013 + read_unlock(&tasklist_lock);
53014 + }
53015 + rcu_read_unlock();
53016 + }
53017 +
53018 + return;
53019 +}
53020 +
53021 +int
53022 +gr_check_crash_exec(const struct file *filp)
53023 +{
53024 + struct acl_subject_label *curr;
53025 +
53026 + if (unlikely(!gr_acl_is_enabled()))
53027 + return 0;
53028 +
53029 + read_lock(&gr_inode_lock);
53030 + curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
53031 + __get_dev(filp->f_path.dentry),
53032 + current->role);
53033 + read_unlock(&gr_inode_lock);
53034 +
53035 + if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
53036 + (!curr->crashes && !curr->expires))
53037 + return 0;
53038 +
53039 + if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
53040 + time_after(curr->expires, get_seconds()))
53041 + return 1;
53042 + else if (time_before_eq(curr->expires, get_seconds())) {
53043 + curr->crashes = 0;
53044 + curr->expires = 0;
53045 + }
53046 +
53047 + return 0;
53048 +}
53049 +
53050 +void
53051 +gr_handle_alertkill(struct task_struct *task)
53052 +{
53053 + struct acl_subject_label *curracl;
53054 + __u32 curr_ip;
53055 + struct task_struct *p, *p2;
53056 +
53057 + if (unlikely(!gr_acl_is_enabled()))
53058 + return;
53059 +
53060 + curracl = task->acl;
53061 + curr_ip = task->signal->curr_ip;
53062 +
53063 + if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
53064 + read_lock(&tasklist_lock);
53065 + do_each_thread(p2, p) {
53066 + if (p->signal->curr_ip == curr_ip)
53067 + gr_fake_force_sig(SIGKILL, p);
53068 + } while_each_thread(p2, p);
53069 + read_unlock(&tasklist_lock);
53070 + } else if (curracl->mode & GR_KILLPROC)
53071 + gr_fake_force_sig(SIGKILL, task);
53072 +
53073 + return;
53074 +}
53075 diff -urNp linux-3.0.9/grsecurity/gracl_shm.c linux-3.0.9/grsecurity/gracl_shm.c
53076 --- linux-3.0.9/grsecurity/gracl_shm.c 1969-12-31 19:00:00.000000000 -0500
53077 +++ linux-3.0.9/grsecurity/gracl_shm.c 2011-11-15 20:02:59.000000000 -0500
53078 @@ -0,0 +1,40 @@
53079 +#include <linux/kernel.h>
53080 +#include <linux/mm.h>
53081 +#include <linux/sched.h>
53082 +#include <linux/file.h>
53083 +#include <linux/ipc.h>
53084 +#include <linux/gracl.h>
53085 +#include <linux/grsecurity.h>
53086 +#include <linux/grinternal.h>
53087 +
53088 +int
53089 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
53090 + const time_t shm_createtime, const uid_t cuid, const int shmid)
53091 +{
53092 + struct task_struct *task;
53093 +
53094 + if (!gr_acl_is_enabled())
53095 + return 1;
53096 +
53097 + rcu_read_lock();
53098 + read_lock(&tasklist_lock);
53099 +
53100 + task = find_task_by_vpid(shm_cprid);
53101 +
53102 + if (unlikely(!task))
53103 + task = find_task_by_vpid(shm_lapid);
53104 +
53105 + if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
53106 + (task->pid == shm_lapid)) &&
53107 + (task->acl->mode & GR_PROTSHM) &&
53108 + (task->acl != current->acl))) {
53109 + read_unlock(&tasklist_lock);
53110 + rcu_read_unlock();
53111 + gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
53112 + return 0;
53113 + }
53114 + read_unlock(&tasklist_lock);
53115 + rcu_read_unlock();
53116 +
53117 + return 1;
53118 +}
53119 diff -urNp linux-3.0.9/grsecurity/grsec_chdir.c linux-3.0.9/grsecurity/grsec_chdir.c
53120 --- linux-3.0.9/grsecurity/grsec_chdir.c 1969-12-31 19:00:00.000000000 -0500
53121 +++ linux-3.0.9/grsecurity/grsec_chdir.c 2011-11-15 20:02:59.000000000 -0500
53122 @@ -0,0 +1,19 @@
53123 +#include <linux/kernel.h>
53124 +#include <linux/sched.h>
53125 +#include <linux/fs.h>
53126 +#include <linux/file.h>
53127 +#include <linux/grsecurity.h>
53128 +#include <linux/grinternal.h>
53129 +
53130 +void
53131 +gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
53132 +{
53133 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
53134 + if ((grsec_enable_chdir && grsec_enable_group &&
53135 + in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
53136 + !grsec_enable_group)) {
53137 + gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
53138 + }
53139 +#endif
53140 + return;
53141 +}
53142 diff -urNp linux-3.0.9/grsecurity/grsec_chroot.c linux-3.0.9/grsecurity/grsec_chroot.c
53143 --- linux-3.0.9/grsecurity/grsec_chroot.c 1969-12-31 19:00:00.000000000 -0500
53144 +++ linux-3.0.9/grsecurity/grsec_chroot.c 2011-11-15 20:02:59.000000000 -0500
53145 @@ -0,0 +1,351 @@
53146 +#include <linux/kernel.h>
53147 +#include <linux/module.h>
53148 +#include <linux/sched.h>
53149 +#include <linux/file.h>
53150 +#include <linux/fs.h>
53151 +#include <linux/mount.h>
53152 +#include <linux/types.h>
53153 +#include <linux/pid_namespace.h>
53154 +#include <linux/grsecurity.h>
53155 +#include <linux/grinternal.h>
53156 +
53157 +void gr_set_chroot_entries(struct task_struct *task, struct path *path)
53158 +{
53159 +#ifdef CONFIG_GRKERNSEC
53160 + if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
53161 + path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
53162 + task->gr_is_chrooted = 1;
53163 + else
53164 + task->gr_is_chrooted = 0;
53165 +
53166 + task->gr_chroot_dentry = path->dentry;
53167 +#endif
53168 + return;
53169 +}
53170 +
53171 +void gr_clear_chroot_entries(struct task_struct *task)
53172 +{
53173 +#ifdef CONFIG_GRKERNSEC
53174 + task->gr_is_chrooted = 0;
53175 + task->gr_chroot_dentry = NULL;
53176 +#endif
53177 + return;
53178 +}
53179 +
53180 +int
53181 +gr_handle_chroot_unix(const pid_t pid)
53182 +{
53183 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
53184 + struct task_struct *p;
53185 +
53186 + if (unlikely(!grsec_enable_chroot_unix))
53187 + return 1;
53188 +
53189 + if (likely(!proc_is_chrooted(current)))
53190 + return 1;
53191 +
53192 + rcu_read_lock();
53193 + read_lock(&tasklist_lock);
53194 + p = find_task_by_vpid_unrestricted(pid);
53195 + if (unlikely(p && !have_same_root(current, p))) {
53196 + read_unlock(&tasklist_lock);
53197 + rcu_read_unlock();
53198 + gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
53199 + return 0;
53200 + }
53201 + read_unlock(&tasklist_lock);
53202 + rcu_read_unlock();
53203 +#endif
53204 + return 1;
53205 +}
53206 +
53207 +int
53208 +gr_handle_chroot_nice(void)
53209 +{
53210 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
53211 + if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
53212 + gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
53213 + return -EPERM;
53214 + }
53215 +#endif
53216 + return 0;
53217 +}
53218 +
53219 +int
53220 +gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
53221 +{
53222 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
53223 + if (grsec_enable_chroot_nice && (niceval < task_nice(p))
53224 + && proc_is_chrooted(current)) {
53225 + gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
53226 + return -EACCES;
53227 + }
53228 +#endif
53229 + return 0;
53230 +}
53231 +
53232 +int
53233 +gr_handle_chroot_rawio(const struct inode *inode)
53234 +{
53235 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
53236 + if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
53237 + inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
53238 + return 1;
53239 +#endif
53240 + return 0;
53241 +}
53242 +
53243 +int
53244 +gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
53245 +{
53246 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
53247 + struct task_struct *p;
53248 + int ret = 0;
53249 + if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
53250 + return ret;
53251 +
53252 + read_lock(&tasklist_lock);
53253 + do_each_pid_task(pid, type, p) {
53254 + if (!have_same_root(current, p)) {
53255 + ret = 1;
53256 + goto out;
53257 + }
53258 + } while_each_pid_task(pid, type, p);
53259 +out:
53260 + read_unlock(&tasklist_lock);
53261 + return ret;
53262 +#endif
53263 + return 0;
53264 +}
53265 +
53266 +int
53267 +gr_pid_is_chrooted(struct task_struct *p)
53268 +{
53269 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
53270 + if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
53271 + return 0;
53272 +
53273 + if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
53274 + !have_same_root(current, p)) {
53275 + return 1;
53276 + }
53277 +#endif
53278 + return 0;
53279 +}
53280 +
53281 +EXPORT_SYMBOL(gr_pid_is_chrooted);
53282 +
53283 +#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
53284 +int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
53285 +{
53286 + struct path path, currentroot;
53287 + int ret = 0;
53288 +
53289 + path.dentry = (struct dentry *)u_dentry;
53290 + path.mnt = (struct vfsmount *)u_mnt;
53291 + get_fs_root(current->fs, &currentroot);
53292 + if (path_is_under(&path, &currentroot))
53293 + ret = 1;
53294 + path_put(&currentroot);
53295 +
53296 + return ret;
53297 +}
53298 +#endif
53299 +
53300 +int
53301 +gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
53302 +{
53303 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
53304 + if (!grsec_enable_chroot_fchdir)
53305 + return 1;
53306 +
53307 + if (!proc_is_chrooted(current))
53308 + return 1;
53309 + else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
53310 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
53311 + return 0;
53312 + }
53313 +#endif
53314 + return 1;
53315 +}
53316 +
53317 +int
53318 +gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
53319 + const time_t shm_createtime)
53320 +{
53321 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
53322 + struct task_struct *p;
53323 + time_t starttime;
53324 +
53325 + if (unlikely(!grsec_enable_chroot_shmat))
53326 + return 1;
53327 +
53328 + if (likely(!proc_is_chrooted(current)))
53329 + return 1;
53330 +
53331 + rcu_read_lock();
53332 + read_lock(&tasklist_lock);
53333 +
53334 + if ((p = find_task_by_vpid_unrestricted(shm_cprid))) {
53335 + starttime = p->start_time.tv_sec;
53336 + if (time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime)) {
53337 + if (have_same_root(current, p)) {
53338 + goto allow;
53339 + } else {
53340 + read_unlock(&tasklist_lock);
53341 + rcu_read_unlock();
53342 + gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
53343 + return 0;
53344 + }
53345 + }
53346 + /* creator exited, pid reuse, fall through to next check */
53347 + }
53348 + if ((p = find_task_by_vpid_unrestricted(shm_lapid))) {
53349 + if (unlikely(!have_same_root(current, p))) {
53350 + read_unlock(&tasklist_lock);
53351 + rcu_read_unlock();
53352 + gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
53353 + return 0;
53354 + }
53355 + }
53356 +
53357 +allow:
53358 + read_unlock(&tasklist_lock);
53359 + rcu_read_unlock();
53360 +#endif
53361 + return 1;
53362 +}
53363 +
53364 +void
53365 +gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
53366 +{
53367 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
53368 + if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
53369 + gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
53370 +#endif
53371 + return;
53372 +}
53373 +
53374 +int
53375 +gr_handle_chroot_mknod(const struct dentry *dentry,
53376 + const struct vfsmount *mnt, const int mode)
53377 +{
53378 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
53379 + if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
53380 + proc_is_chrooted(current)) {
53381 + gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
53382 + return -EPERM;
53383 + }
53384 +#endif
53385 + return 0;
53386 +}
53387 +
53388 +int
53389 +gr_handle_chroot_mount(const struct dentry *dentry,
53390 + const struct vfsmount *mnt, const char *dev_name)
53391 +{
53392 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
53393 + if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
53394 + gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none", dentry, mnt);
53395 + return -EPERM;
53396 + }
53397 +#endif
53398 + return 0;
53399 +}
53400 +
53401 +int
53402 +gr_handle_chroot_pivot(void)
53403 +{
53404 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
53405 + if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
53406 + gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
53407 + return -EPERM;
53408 + }
53409 +#endif
53410 + return 0;
53411 +}
53412 +
53413 +int
53414 +gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
53415 +{
53416 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
53417 + if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
53418 + !gr_is_outside_chroot(dentry, mnt)) {
53419 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
53420 + return -EPERM;
53421 + }
53422 +#endif
53423 + return 0;
53424 +}
53425 +
53426 +extern const char *captab_log[];
53427 +extern int captab_log_entries;
53428 +
53429 +int
53430 +gr_chroot_is_capable(const int cap)
53431 +{
53432 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
53433 + if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
53434 + kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
53435 + if (cap_raised(chroot_caps, cap)) {
53436 + const struct cred *creds = current_cred();
53437 + if (cap_raised(creds->cap_effective, cap) && cap < captab_log_entries) {
53438 + gr_log_cap(GR_DONT_AUDIT, GR_CAP_CHROOT_MSG, current, captab_log[cap]);
53439 + }
53440 + return 0;
53441 + }
53442 + }
53443 +#endif
53444 + return 1;
53445 +}
53446 +
53447 +int
53448 +gr_chroot_is_capable_nolog(const int cap)
53449 +{
53450 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
53451 + if (grsec_enable_chroot_caps && proc_is_chrooted(current)) {
53452 + kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
53453 + if (cap_raised(chroot_caps, cap)) {
53454 + return 0;
53455 + }
53456 + }
53457 +#endif
53458 + return 1;
53459 +}
53460 +
53461 +int
53462 +gr_handle_chroot_sysctl(const int op)
53463 +{
53464 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
53465 + if (grsec_enable_chroot_sysctl && (op & MAY_WRITE) &&
53466 + proc_is_chrooted(current))
53467 + return -EACCES;
53468 +#endif
53469 + return 0;
53470 +}
53471 +
53472 +void
53473 +gr_handle_chroot_chdir(struct path *path)
53474 +{
53475 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
53476 + if (grsec_enable_chroot_chdir)
53477 + set_fs_pwd(current->fs, path);
53478 +#endif
53479 + return;
53480 +}
53481 +
53482 +int
53483 +gr_handle_chroot_chmod(const struct dentry *dentry,
53484 + const struct vfsmount *mnt, const int mode)
53485 +{
53486 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
53487 + /* allow chmod +s on directories, but not files */
53488 + if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
53489 + ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
53490 + proc_is_chrooted(current)) {
53491 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
53492 + return -EPERM;
53493 + }
53494 +#endif
53495 + return 0;
53496 +}
53497 diff -urNp linux-3.0.9/grsecurity/grsec_disabled.c linux-3.0.9/grsecurity/grsec_disabled.c
53498 --- linux-3.0.9/grsecurity/grsec_disabled.c 1969-12-31 19:00:00.000000000 -0500
53499 +++ linux-3.0.9/grsecurity/grsec_disabled.c 2011-11-15 20:02:59.000000000 -0500
53500 @@ -0,0 +1,439 @@
53501 +#include <linux/kernel.h>
53502 +#include <linux/module.h>
53503 +#include <linux/sched.h>
53504 +#include <linux/file.h>
53505 +#include <linux/fs.h>
53506 +#include <linux/kdev_t.h>
53507 +#include <linux/net.h>
53508 +#include <linux/in.h>
53509 +#include <linux/ip.h>
53510 +#include <linux/skbuff.h>
53511 +#include <linux/sysctl.h>
53512 +
53513 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
53514 +void
53515 +pax_set_initial_flags(struct linux_binprm *bprm)
53516 +{
53517 + return;
53518 +}
53519 +#endif
53520 +
53521 +#ifdef CONFIG_SYSCTL
53522 +__u32
53523 +gr_handle_sysctl(const struct ctl_table * table, const int op)
53524 +{
53525 + return 0;
53526 +}
53527 +#endif
53528 +
53529 +#ifdef CONFIG_TASKSTATS
53530 +int gr_is_taskstats_denied(int pid)
53531 +{
53532 + return 0;
53533 +}
53534 +#endif
53535 +
53536 +int
53537 +gr_acl_is_enabled(void)
53538 +{
53539 + return 0;
53540 +}
53541 +
53542 +void
53543 +gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
53544 +{
53545 + return;
53546 +}
53547 +
53548 +int
53549 +gr_handle_rawio(const struct inode *inode)
53550 +{
53551 + return 0;
53552 +}
53553 +
53554 +void
53555 +gr_acl_handle_psacct(struct task_struct *task, const long code)
53556 +{
53557 + return;
53558 +}
53559 +
53560 +int
53561 +gr_handle_ptrace(struct task_struct *task, const long request)
53562 +{
53563 + return 0;
53564 +}
53565 +
53566 +int
53567 +gr_handle_proc_ptrace(struct task_struct *task)
53568 +{
53569 + return 0;
53570 +}
53571 +
53572 +void
53573 +gr_learn_resource(const struct task_struct *task,
53574 + const int res, const unsigned long wanted, const int gt)
53575 +{
53576 + return;
53577 +}
53578 +
53579 +int
53580 +gr_set_acls(const int type)
53581 +{
53582 + return 0;
53583 +}
53584 +
53585 +int
53586 +gr_check_hidden_task(const struct task_struct *tsk)
53587 +{
53588 + return 0;
53589 +}
53590 +
53591 +int
53592 +gr_check_protected_task(const struct task_struct *task)
53593 +{
53594 + return 0;
53595 +}
53596 +
53597 +int
53598 +gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
53599 +{
53600 + return 0;
53601 +}
53602 +
53603 +void
53604 +gr_copy_label(struct task_struct *tsk)
53605 +{
53606 + return;
53607 +}
53608 +
53609 +void
53610 +gr_set_pax_flags(struct task_struct *task)
53611 +{
53612 + return;
53613 +}
53614 +
53615 +int
53616 +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
53617 + const int unsafe_share)
53618 +{
53619 + return 0;
53620 +}
53621 +
53622 +void
53623 +gr_handle_delete(const ino_t ino, const dev_t dev)
53624 +{
53625 + return;
53626 +}
53627 +
53628 +void
53629 +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
53630 +{
53631 + return;
53632 +}
53633 +
53634 +void
53635 +gr_handle_crash(struct task_struct *task, const int sig)
53636 +{
53637 + return;
53638 +}
53639 +
53640 +int
53641 +gr_check_crash_exec(const struct file *filp)
53642 +{
53643 + return 0;
53644 +}
53645 +
53646 +int
53647 +gr_check_crash_uid(const uid_t uid)
53648 +{
53649 + return 0;
53650 +}
53651 +
53652 +void
53653 +gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
53654 + struct dentry *old_dentry,
53655 + struct dentry *new_dentry,
53656 + struct vfsmount *mnt, const __u8 replace)
53657 +{
53658 + return;
53659 +}
53660 +
53661 +int
53662 +gr_search_socket(const int family, const int type, const int protocol)
53663 +{
53664 + return 1;
53665 +}
53666 +
53667 +int
53668 +gr_search_connectbind(const int mode, const struct socket *sock,
53669 + const struct sockaddr_in *addr)
53670 +{
53671 + return 0;
53672 +}
53673 +
53674 +void
53675 +gr_handle_alertkill(struct task_struct *task)
53676 +{
53677 + return;
53678 +}
53679 +
53680 +__u32
53681 +gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
53682 +{
53683 + return 1;
53684 +}
53685 +
53686 +__u32
53687 +gr_acl_handle_hidden_file(const struct dentry * dentry,
53688 + const struct vfsmount * mnt)
53689 +{
53690 + return 1;
53691 +}
53692 +
53693 +__u32
53694 +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
53695 + const int fmode)
53696 +{
53697 + return 1;
53698 +}
53699 +
53700 +__u32
53701 +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
53702 +{
53703 + return 1;
53704 +}
53705 +
53706 +__u32
53707 +gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
53708 +{
53709 + return 1;
53710 +}
53711 +
53712 +int
53713 +gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
53714 + unsigned int *vm_flags)
53715 +{
53716 + return 1;
53717 +}
53718 +
53719 +__u32
53720 +gr_acl_handle_truncate(const struct dentry * dentry,
53721 + const struct vfsmount * mnt)
53722 +{
53723 + return 1;
53724 +}
53725 +
53726 +__u32
53727 +gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
53728 +{
53729 + return 1;
53730 +}
53731 +
53732 +__u32
53733 +gr_acl_handle_access(const struct dentry * dentry,
53734 + const struct vfsmount * mnt, const int fmode)
53735 +{
53736 + return 1;
53737 +}
53738 +
53739 +__u32
53740 +gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
53741 + mode_t mode)
53742 +{
53743 + return 1;
53744 +}
53745 +
53746 +__u32
53747 +gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
53748 + mode_t mode)
53749 +{
53750 + return 1;
53751 +}
53752 +
53753 +__u32
53754 +gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
53755 +{
53756 + return 1;
53757 +}
53758 +
53759 +__u32
53760 +gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
53761 +{
53762 + return 1;
53763 +}
53764 +
53765 +void
53766 +grsecurity_init(void)
53767 +{
53768 + return;
53769 +}
53770 +
53771 +__u32
53772 +gr_acl_handle_mknod(const struct dentry * new_dentry,
53773 + const struct dentry * parent_dentry,
53774 + const struct vfsmount * parent_mnt,
53775 + const int mode)
53776 +{
53777 + return 1;
53778 +}
53779 +
53780 +__u32
53781 +gr_acl_handle_mkdir(const struct dentry * new_dentry,
53782 + const struct dentry * parent_dentry,
53783 + const struct vfsmount * parent_mnt)
53784 +{
53785 + return 1;
53786 +}
53787 +
53788 +__u32
53789 +gr_acl_handle_symlink(const struct dentry * new_dentry,
53790 + const struct dentry * parent_dentry,
53791 + const struct vfsmount * parent_mnt, const char *from)
53792 +{
53793 + return 1;
53794 +}
53795 +
53796 +__u32
53797 +gr_acl_handle_link(const struct dentry * new_dentry,
53798 + const struct dentry * parent_dentry,
53799 + const struct vfsmount * parent_mnt,
53800 + const struct dentry * old_dentry,
53801 + const struct vfsmount * old_mnt, const char *to)
53802 +{
53803 + return 1;
53804 +}
53805 +
53806 +int
53807 +gr_acl_handle_rename(const struct dentry *new_dentry,
53808 + const struct dentry *parent_dentry,
53809 + const struct vfsmount *parent_mnt,
53810 + const struct dentry *old_dentry,
53811 + const struct inode *old_parent_inode,
53812 + const struct vfsmount *old_mnt, const char *newname)
53813 +{
53814 + return 0;
53815 +}
53816 +
53817 +int
53818 +gr_acl_handle_filldir(const struct file *file, const char *name,
53819 + const int namelen, const ino_t ino)
53820 +{
53821 + return 1;
53822 +}
53823 +
53824 +int
53825 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
53826 + const time_t shm_createtime, const uid_t cuid, const int shmid)
53827 +{
53828 + return 1;
53829 +}
53830 +
53831 +int
53832 +gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
53833 +{
53834 + return 0;
53835 +}
53836 +
53837 +int
53838 +gr_search_accept(const struct socket *sock)
53839 +{
53840 + return 0;
53841 +}
53842 +
53843 +int
53844 +gr_search_listen(const struct socket *sock)
53845 +{
53846 + return 0;
53847 +}
53848 +
53849 +int
53850 +gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
53851 +{
53852 + return 0;
53853 +}
53854 +
53855 +__u32
53856 +gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
53857 +{
53858 + return 1;
53859 +}
53860 +
53861 +__u32
53862 +gr_acl_handle_creat(const struct dentry * dentry,
53863 + const struct dentry * p_dentry,
53864 + const struct vfsmount * p_mnt, const int fmode,
53865 + const int imode)
53866 +{
53867 + return 1;
53868 +}
53869 +
53870 +void
53871 +gr_acl_handle_exit(void)
53872 +{
53873 + return;
53874 +}
53875 +
53876 +int
53877 +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
53878 +{
53879 + return 1;
53880 +}
53881 +
53882 +void
53883 +gr_set_role_label(const uid_t uid, const gid_t gid)
53884 +{
53885 + return;
53886 +}
53887 +
53888 +int
53889 +gr_acl_handle_procpidmem(const struct task_struct *task)
53890 +{
53891 + return 0;
53892 +}
53893 +
53894 +int
53895 +gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
53896 +{
53897 + return 0;
53898 +}
53899 +
53900 +int
53901 +gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
53902 +{
53903 + return 0;
53904 +}
53905 +
53906 +void
53907 +gr_set_kernel_label(struct task_struct *task)
53908 +{
53909 + return;
53910 +}
53911 +
53912 +int
53913 +gr_check_user_change(int real, int effective, int fs)
53914 +{
53915 + return 0;
53916 +}
53917 +
53918 +int
53919 +gr_check_group_change(int real, int effective, int fs)
53920 +{
53921 + return 0;
53922 +}
53923 +
53924 +int gr_acl_enable_at_secure(void)
53925 +{
53926 + return 0;
53927 +}
53928 +
53929 +dev_t gr_get_dev_from_dentry(struct dentry *dentry)
53930 +{
53931 + return dentry->d_inode->i_sb->s_dev;
53932 +}
53933 +
53934 +EXPORT_SYMBOL(gr_learn_resource);
53935 +EXPORT_SYMBOL(gr_set_kernel_label);
53936 +#ifdef CONFIG_SECURITY
53937 +EXPORT_SYMBOL(gr_check_user_change);
53938 +EXPORT_SYMBOL(gr_check_group_change);
53939 +#endif
53940 diff -urNp linux-3.0.9/grsecurity/grsec_exec.c linux-3.0.9/grsecurity/grsec_exec.c
53941 --- linux-3.0.9/grsecurity/grsec_exec.c 1969-12-31 19:00:00.000000000 -0500
53942 +++ linux-3.0.9/grsecurity/grsec_exec.c 2011-11-15 20:02:59.000000000 -0500
53943 @@ -0,0 +1,146 @@
53944 +#include <linux/kernel.h>
53945 +#include <linux/sched.h>
53946 +#include <linux/file.h>
53947 +#include <linux/binfmts.h>
53948 +#include <linux/fs.h>
53949 +#include <linux/types.h>
53950 +#include <linux/grdefs.h>
53951 +#include <linux/grsecurity.h>
53952 +#include <linux/grinternal.h>
53953 +#include <linux/capability.h>
53954 +#include <linux/module.h>
53955 +
53956 +#include <asm/uaccess.h>
53957 +
53958 +#ifdef CONFIG_GRKERNSEC_EXECLOG
53959 +static char gr_exec_arg_buf[132];
53960 +static DEFINE_MUTEX(gr_exec_arg_mutex);
53961 +#endif
53962 +
53963 +extern const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr);
53964 +
53965 +void
53966 +gr_handle_exec_args(struct linux_binprm *bprm, struct user_arg_ptr argv)
53967 +{
53968 +#ifdef CONFIG_GRKERNSEC_EXECLOG
53969 + char *grarg = gr_exec_arg_buf;
53970 + unsigned int i, x, execlen = 0;
53971 + char c;
53972 +
53973 + if (!((grsec_enable_execlog && grsec_enable_group &&
53974 + in_group_p(grsec_audit_gid))
53975 + || (grsec_enable_execlog && !grsec_enable_group)))
53976 + return;
53977 +
53978 + mutex_lock(&gr_exec_arg_mutex);
53979 + memset(grarg, 0, sizeof(gr_exec_arg_buf));
53980 +
53981 + for (i = 0; i < bprm->argc && execlen < 128; i++) {
53982 + const char __user *p;
53983 + unsigned int len;
53984 +
53985 + p = get_user_arg_ptr(argv, i);
53986 + if (IS_ERR(p))
53987 + goto log;
53988 +
53989 + len = strnlen_user(p, 128 - execlen);
53990 + if (len > 128 - execlen)
53991 + len = 128 - execlen;
53992 + else if (len > 0)
53993 + len--;
53994 + if (copy_from_user(grarg + execlen, p, len))
53995 + goto log;
53996 +
53997 + /* rewrite unprintable characters */
53998 + for (x = 0; x < len; x++) {
53999 + c = *(grarg + execlen + x);
54000 + if (c < 32 || c > 126)
54001 + *(grarg + execlen + x) = ' ';
54002 + }
54003 +
54004 + execlen += len;
54005 + *(grarg + execlen) = ' ';
54006 + *(grarg + execlen + 1) = '\0';
54007 + execlen++;
54008 + }
54009 +
54010 + log:
54011 + gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
54012 + bprm->file->f_path.mnt, grarg);
54013 + mutex_unlock(&gr_exec_arg_mutex);
54014 +#endif
54015 + return;
54016 +}
54017 +
54018 +#ifdef CONFIG_GRKERNSEC
54019 +extern int gr_acl_is_capable(const int cap);
54020 +extern int gr_acl_is_capable_nolog(const int cap);
54021 +extern int gr_chroot_is_capable(const int cap);
54022 +extern int gr_chroot_is_capable_nolog(const int cap);
54023 +#endif
54024 +
54025 +const char *captab_log[] = {
54026 + "CAP_CHOWN",
54027 + "CAP_DAC_OVERRIDE",
54028 + "CAP_DAC_READ_SEARCH",
54029 + "CAP_FOWNER",
54030 + "CAP_FSETID",
54031 + "CAP_KILL",
54032 + "CAP_SETGID",
54033 + "CAP_SETUID",
54034 + "CAP_SETPCAP",
54035 + "CAP_LINUX_IMMUTABLE",
54036 + "CAP_NET_BIND_SERVICE",
54037 + "CAP_NET_BROADCAST",
54038 + "CAP_NET_ADMIN",
54039 + "CAP_NET_RAW",
54040 + "CAP_IPC_LOCK",
54041 + "CAP_IPC_OWNER",
54042 + "CAP_SYS_MODULE",
54043 + "CAP_SYS_RAWIO",
54044 + "CAP_SYS_CHROOT",
54045 + "CAP_SYS_PTRACE",
54046 + "CAP_SYS_PACCT",
54047 + "CAP_SYS_ADMIN",
54048 + "CAP_SYS_BOOT",
54049 + "CAP_SYS_NICE",
54050 + "CAP_SYS_RESOURCE",
54051 + "CAP_SYS_TIME",
54052 + "CAP_SYS_TTY_CONFIG",
54053 + "CAP_MKNOD",
54054 + "CAP_LEASE",
54055 + "CAP_AUDIT_WRITE",
54056 + "CAP_AUDIT_CONTROL",
54057 + "CAP_SETFCAP",
54058 + "CAP_MAC_OVERRIDE",
54059 + "CAP_MAC_ADMIN",
54060 + "CAP_SYSLOG",
54061 + "CAP_WAKE_ALARM"
54062 +};
54063 +
54064 +int captab_log_entries = sizeof(captab_log)/sizeof(captab_log[0]);
54065 +
54066 +int gr_is_capable(const int cap)
54067 +{
54068 +#ifdef CONFIG_GRKERNSEC
54069 + if (gr_acl_is_capable(cap) && gr_chroot_is_capable(cap))
54070 + return 1;
54071 + return 0;
54072 +#else
54073 + return 1;
54074 +#endif
54075 +}
54076 +
54077 +int gr_is_capable_nolog(const int cap)
54078 +{
54079 +#ifdef CONFIG_GRKERNSEC
54080 + if (gr_acl_is_capable_nolog(cap) && gr_chroot_is_capable_nolog(cap))
54081 + return 1;
54082 + return 0;
54083 +#else
54084 + return 1;
54085 +#endif
54086 +}
54087 +
54088 +EXPORT_SYMBOL(gr_is_capable);
54089 +EXPORT_SYMBOL(gr_is_capable_nolog);
54090 diff -urNp linux-3.0.9/grsecurity/grsec_fifo.c linux-3.0.9/grsecurity/grsec_fifo.c
54091 --- linux-3.0.9/grsecurity/grsec_fifo.c 1969-12-31 19:00:00.000000000 -0500
54092 +++ linux-3.0.9/grsecurity/grsec_fifo.c 2011-11-15 20:02:59.000000000 -0500
54093 @@ -0,0 +1,24 @@
54094 +#include <linux/kernel.h>
54095 +#include <linux/sched.h>
54096 +#include <linux/fs.h>
54097 +#include <linux/file.h>
54098 +#include <linux/grinternal.h>
54099 +
54100 +int
54101 +gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
54102 + const struct dentry *dir, const int flag, const int acc_mode)
54103 +{
54104 +#ifdef CONFIG_GRKERNSEC_FIFO
54105 + const struct cred *cred = current_cred();
54106 +
54107 + if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
54108 + !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
54109 + (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
54110 + (cred->fsuid != dentry->d_inode->i_uid)) {
54111 + if (!inode_permission(dentry->d_inode, acc_mode))
54112 + gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
54113 + return -EACCES;
54114 + }
54115 +#endif
54116 + return 0;
54117 +}
54118 diff -urNp linux-3.0.9/grsecurity/grsec_fork.c linux-3.0.9/grsecurity/grsec_fork.c
54119 --- linux-3.0.9/grsecurity/grsec_fork.c 1969-12-31 19:00:00.000000000 -0500
54120 +++ linux-3.0.9/grsecurity/grsec_fork.c 2011-11-15 20:02:59.000000000 -0500
54121 @@ -0,0 +1,23 @@
54122 +#include <linux/kernel.h>
54123 +#include <linux/sched.h>
54124 +#include <linux/grsecurity.h>
54125 +#include <linux/grinternal.h>
54126 +#include <linux/errno.h>
54127 +
54128 +void
54129 +gr_log_forkfail(const int retval)
54130 +{
54131 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
54132 + if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
54133 + switch (retval) {
54134 + case -EAGAIN:
54135 + gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
54136 + break;
54137 + case -ENOMEM:
54138 + gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
54139 + break;
54140 + }
54141 + }
54142 +#endif
54143 + return;
54144 +}
54145 diff -urNp linux-3.0.9/grsecurity/grsec_init.c linux-3.0.9/grsecurity/grsec_init.c
54146 --- linux-3.0.9/grsecurity/grsec_init.c 1969-12-31 19:00:00.000000000 -0500
54147 +++ linux-3.0.9/grsecurity/grsec_init.c 2011-11-15 20:02:59.000000000 -0500
54148 @@ -0,0 +1,269 @@
54149 +#include <linux/kernel.h>
54150 +#include <linux/sched.h>
54151 +#include <linux/mm.h>
54152 +#include <linux/gracl.h>
54153 +#include <linux/slab.h>
54154 +#include <linux/vmalloc.h>
54155 +#include <linux/percpu.h>
54156 +#include <linux/module.h>
54157 +
54158 +int grsec_enable_brute;
54159 +int grsec_enable_link;
54160 +int grsec_enable_dmesg;
54161 +int grsec_enable_harden_ptrace;
54162 +int grsec_enable_fifo;
54163 +int grsec_enable_execlog;
54164 +int grsec_enable_signal;
54165 +int grsec_enable_forkfail;
54166 +int grsec_enable_audit_ptrace;
54167 +int grsec_enable_time;
54168 +int grsec_enable_audit_textrel;
54169 +int grsec_enable_group;
54170 +int grsec_audit_gid;
54171 +int grsec_enable_chdir;
54172 +int grsec_enable_mount;
54173 +int grsec_enable_rofs;
54174 +int grsec_enable_chroot_findtask;
54175 +int grsec_enable_chroot_mount;
54176 +int grsec_enable_chroot_shmat;
54177 +int grsec_enable_chroot_fchdir;
54178 +int grsec_enable_chroot_double;
54179 +int grsec_enable_chroot_pivot;
54180 +int grsec_enable_chroot_chdir;
54181 +int grsec_enable_chroot_chmod;
54182 +int grsec_enable_chroot_mknod;
54183 +int grsec_enable_chroot_nice;
54184 +int grsec_enable_chroot_execlog;
54185 +int grsec_enable_chroot_caps;
54186 +int grsec_enable_chroot_sysctl;
54187 +int grsec_enable_chroot_unix;
54188 +int grsec_enable_tpe;
54189 +int grsec_tpe_gid;
54190 +int grsec_enable_blackhole;
54191 +#ifdef CONFIG_IPV6_MODULE
54192 +EXPORT_SYMBOL(grsec_enable_blackhole);
54193 +#endif
54194 +int grsec_lastack_retries;
54195 +int grsec_enable_tpe_all;
54196 +int grsec_enable_tpe_invert;
54197 +int grsec_enable_socket_all;
54198 +int grsec_socket_all_gid;
54199 +int grsec_enable_socket_client;
54200 +int grsec_socket_client_gid;
54201 +int grsec_enable_socket_server;
54202 +int grsec_socket_server_gid;
54203 +int grsec_resource_logging;
54204 +int grsec_disable_privio;
54205 +int grsec_enable_log_rwxmaps;
54206 +int grsec_lock;
54207 +
54208 +DEFINE_SPINLOCK(grsec_alert_lock);
54209 +unsigned long grsec_alert_wtime = 0;
54210 +unsigned long grsec_alert_fyet = 0;
54211 +
54212 +DEFINE_SPINLOCK(grsec_audit_lock);
54213 +
54214 +DEFINE_RWLOCK(grsec_exec_file_lock);
54215 +
54216 +char *gr_shared_page[4];
54217 +
54218 +char *gr_alert_log_fmt;
54219 +char *gr_audit_log_fmt;
54220 +char *gr_alert_log_buf;
54221 +char *gr_audit_log_buf;
54222 +
54223 +extern struct gr_arg *gr_usermode;
54224 +extern unsigned char *gr_system_salt;
54225 +extern unsigned char *gr_system_sum;
54226 +
54227 +void __init
54228 +grsecurity_init(void)
54229 +{
54230 + int j;
54231 + /* create the per-cpu shared pages */
54232 +
54233 +#ifdef CONFIG_X86
54234 + memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
54235 +#endif
54236 +
54237 + for (j = 0; j < 4; j++) {
54238 + gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
54239 + if (gr_shared_page[j] == NULL) {
54240 + panic("Unable to allocate grsecurity shared page");
54241 + return;
54242 + }
54243 + }
54244 +
54245 + /* allocate log buffers */
54246 + gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
54247 + if (!gr_alert_log_fmt) {
54248 + panic("Unable to allocate grsecurity alert log format buffer");
54249 + return;
54250 + }
54251 + gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
54252 + if (!gr_audit_log_fmt) {
54253 + panic("Unable to allocate grsecurity audit log format buffer");
54254 + return;
54255 + }
54256 + gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
54257 + if (!gr_alert_log_buf) {
54258 + panic("Unable to allocate grsecurity alert log buffer");
54259 + return;
54260 + }
54261 + gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
54262 + if (!gr_audit_log_buf) {
54263 + panic("Unable to allocate grsecurity audit log buffer");
54264 + return;
54265 + }
54266 +
54267 + /* allocate memory for authentication structure */
54268 + gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
54269 + gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
54270 + gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
54271 +
54272 + if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
54273 + panic("Unable to allocate grsecurity authentication structure");
54274 + return;
54275 + }
54276 +
54277 +
54278 +#ifdef CONFIG_GRKERNSEC_IO
54279 +#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
54280 + grsec_disable_privio = 1;
54281 +#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
54282 + grsec_disable_privio = 1;
54283 +#else
54284 + grsec_disable_privio = 0;
54285 +#endif
54286 +#endif
54287 +
54288 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
54289 + /* for backward compatibility, tpe_invert always defaults to on if
54290 + enabled in the kernel
54291 + */
54292 + grsec_enable_tpe_invert = 1;
54293 +#endif
54294 +
54295 +#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
54296 +#ifndef CONFIG_GRKERNSEC_SYSCTL
54297 + grsec_lock = 1;
54298 +#endif
54299 +
54300 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
54301 + grsec_enable_audit_textrel = 1;
54302 +#endif
54303 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
54304 + grsec_enable_log_rwxmaps = 1;
54305 +#endif
54306 +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
54307 + grsec_enable_group = 1;
54308 + grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
54309 +#endif
54310 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
54311 + grsec_enable_chdir = 1;
54312 +#endif
54313 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
54314 + grsec_enable_harden_ptrace = 1;
54315 +#endif
54316 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
54317 + grsec_enable_mount = 1;
54318 +#endif
54319 +#ifdef CONFIG_GRKERNSEC_LINK
54320 + grsec_enable_link = 1;
54321 +#endif
54322 +#ifdef CONFIG_GRKERNSEC_BRUTE
54323 + grsec_enable_brute = 1;
54324 +#endif
54325 +#ifdef CONFIG_GRKERNSEC_DMESG
54326 + grsec_enable_dmesg = 1;
54327 +#endif
54328 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
54329 + grsec_enable_blackhole = 1;
54330 + grsec_lastack_retries = 4;
54331 +#endif
54332 +#ifdef CONFIG_GRKERNSEC_FIFO
54333 + grsec_enable_fifo = 1;
54334 +#endif
54335 +#ifdef CONFIG_GRKERNSEC_EXECLOG
54336 + grsec_enable_execlog = 1;
54337 +#endif
54338 +#ifdef CONFIG_GRKERNSEC_SIGNAL
54339 + grsec_enable_signal = 1;
54340 +#endif
54341 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
54342 + grsec_enable_forkfail = 1;
54343 +#endif
54344 +#ifdef CONFIG_GRKERNSEC_TIME
54345 + grsec_enable_time = 1;
54346 +#endif
54347 +#ifdef CONFIG_GRKERNSEC_RESLOG
54348 + grsec_resource_logging = 1;
54349 +#endif
54350 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
54351 + grsec_enable_chroot_findtask = 1;
54352 +#endif
54353 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
54354 + grsec_enable_chroot_unix = 1;
54355 +#endif
54356 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
54357 + grsec_enable_chroot_mount = 1;
54358 +#endif
54359 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
54360 + grsec_enable_chroot_fchdir = 1;
54361 +#endif
54362 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
54363 + grsec_enable_chroot_shmat = 1;
54364 +#endif
54365 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
54366 + grsec_enable_audit_ptrace = 1;
54367 +#endif
54368 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
54369 + grsec_enable_chroot_double = 1;
54370 +#endif
54371 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
54372 + grsec_enable_chroot_pivot = 1;
54373 +#endif
54374 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
54375 + grsec_enable_chroot_chdir = 1;
54376 +#endif
54377 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
54378 + grsec_enable_chroot_chmod = 1;
54379 +#endif
54380 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
54381 + grsec_enable_chroot_mknod = 1;
54382 +#endif
54383 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
54384 + grsec_enable_chroot_nice = 1;
54385 +#endif
54386 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
54387 + grsec_enable_chroot_execlog = 1;
54388 +#endif
54389 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
54390 + grsec_enable_chroot_caps = 1;
54391 +#endif
54392 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
54393 + grsec_enable_chroot_sysctl = 1;
54394 +#endif
54395 +#ifdef CONFIG_GRKERNSEC_TPE
54396 + grsec_enable_tpe = 1;
54397 + grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
54398 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
54399 + grsec_enable_tpe_all = 1;
54400 +#endif
54401 +#endif
54402 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
54403 + grsec_enable_socket_all = 1;
54404 + grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
54405 +#endif
54406 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
54407 + grsec_enable_socket_client = 1;
54408 + grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
54409 +#endif
54410 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
54411 + grsec_enable_socket_server = 1;
54412 + grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
54413 +#endif
54414 +#endif
54415 +
54416 + return;
54417 +}
54418 diff -urNp linux-3.0.9/grsecurity/grsec_link.c linux-3.0.9/grsecurity/grsec_link.c
54419 --- linux-3.0.9/grsecurity/grsec_link.c 1969-12-31 19:00:00.000000000 -0500
54420 +++ linux-3.0.9/grsecurity/grsec_link.c 2011-11-15 20:02:59.000000000 -0500
54421 @@ -0,0 +1,43 @@
54422 +#include <linux/kernel.h>
54423 +#include <linux/sched.h>
54424 +#include <linux/fs.h>
54425 +#include <linux/file.h>
54426 +#include <linux/grinternal.h>
54427 +
54428 +int
54429 +gr_handle_follow_link(const struct inode *parent,
54430 + const struct inode *inode,
54431 + const struct dentry *dentry, const struct vfsmount *mnt)
54432 +{
54433 +#ifdef CONFIG_GRKERNSEC_LINK
54434 + const struct cred *cred = current_cred();
54435 +
54436 + if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
54437 + (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
54438 + (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
54439 + gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
54440 + return -EACCES;
54441 + }
54442 +#endif
54443 + return 0;
54444 +}
54445 +
54446 +int
54447 +gr_handle_hardlink(const struct dentry *dentry,
54448 + const struct vfsmount *mnt,
54449 + struct inode *inode, const int mode, const char *to)
54450 +{
54451 +#ifdef CONFIG_GRKERNSEC_LINK
54452 + const struct cred *cred = current_cred();
54453 +
54454 + if (grsec_enable_link && cred->fsuid != inode->i_uid &&
54455 + (!S_ISREG(mode) || (mode & S_ISUID) ||
54456 + ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
54457 + (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
54458 + !capable(CAP_FOWNER) && cred->uid) {
54459 + gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
54460 + return -EPERM;
54461 + }
54462 +#endif
54463 + return 0;
54464 +}
54465 diff -urNp linux-3.0.9/grsecurity/grsec_log.c linux-3.0.9/grsecurity/grsec_log.c
54466 --- linux-3.0.9/grsecurity/grsec_log.c 1969-12-31 19:00:00.000000000 -0500
54467 +++ linux-3.0.9/grsecurity/grsec_log.c 2011-11-15 20:02:59.000000000 -0500
54468 @@ -0,0 +1,322 @@
54469 +#include <linux/kernel.h>
54470 +#include <linux/sched.h>
54471 +#include <linux/file.h>
54472 +#include <linux/tty.h>
54473 +#include <linux/fs.h>
54474 +#include <linux/grinternal.h>
54475 +
54476 +#ifdef CONFIG_TREE_PREEMPT_RCU
54477 +#define DISABLE_PREEMPT() preempt_disable()
54478 +#define ENABLE_PREEMPT() preempt_enable()
54479 +#else
54480 +#define DISABLE_PREEMPT()
54481 +#define ENABLE_PREEMPT()
54482 +#endif
54483 +
54484 +#define BEGIN_LOCKS(x) \
54485 + DISABLE_PREEMPT(); \
54486 + rcu_read_lock(); \
54487 + read_lock(&tasklist_lock); \
54488 + read_lock(&grsec_exec_file_lock); \
54489 + if (x != GR_DO_AUDIT) \
54490 + spin_lock(&grsec_alert_lock); \
54491 + else \
54492 + spin_lock(&grsec_audit_lock)
54493 +
54494 +#define END_LOCKS(x) \
54495 + if (x != GR_DO_AUDIT) \
54496 + spin_unlock(&grsec_alert_lock); \
54497 + else \
54498 + spin_unlock(&grsec_audit_lock); \
54499 + read_unlock(&grsec_exec_file_lock); \
54500 + read_unlock(&tasklist_lock); \
54501 + rcu_read_unlock(); \
54502 + ENABLE_PREEMPT(); \
54503 + if (x == GR_DONT_AUDIT) \
54504 + gr_handle_alertkill(current)
54505 +
54506 +enum {
54507 + FLOODING,
54508 + NO_FLOODING
54509 +};
54510 +
54511 +extern char *gr_alert_log_fmt;
54512 +extern char *gr_audit_log_fmt;
54513 +extern char *gr_alert_log_buf;
54514 +extern char *gr_audit_log_buf;
54515 +
54516 +static int gr_log_start(int audit)
54517 +{
54518 + char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
54519 + char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
54520 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
54521 +#if (CONFIG_GRKERNSEC_FLOODTIME > 0 && CONFIG_GRKERNSEC_FLOODBURST > 0)
54522 + unsigned long curr_secs = get_seconds();
54523 +
54524 + if (audit == GR_DO_AUDIT)
54525 + goto set_fmt;
54526 +
54527 + if (!grsec_alert_wtime || time_after(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)) {
54528 + grsec_alert_wtime = curr_secs;
54529 + grsec_alert_fyet = 0;
54530 + } else if (time_before_eq(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)
54531 + && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
54532 + grsec_alert_fyet++;
54533 + } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
54534 + grsec_alert_wtime = curr_secs;
54535 + grsec_alert_fyet++;
54536 + printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
54537 + return FLOODING;
54538 + }
54539 + else return FLOODING;
54540 +
54541 +set_fmt:
54542 +#endif
54543 + memset(buf, 0, PAGE_SIZE);
54544 + if (current->signal->curr_ip && gr_acl_is_enabled()) {
54545 + sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
54546 + snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
54547 + } else if (current->signal->curr_ip) {
54548 + sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
54549 + snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
54550 + } else if (gr_acl_is_enabled()) {
54551 + sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
54552 + snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
54553 + } else {
54554 + sprintf(fmt, "%s%s", loglevel, "grsec: ");
54555 + strcpy(buf, fmt);
54556 + }
54557 +
54558 + return NO_FLOODING;
54559 +}
54560 +
54561 +static void gr_log_middle(int audit, const char *msg, va_list ap)
54562 + __attribute__ ((format (printf, 2, 0)));
54563 +
54564 +static void gr_log_middle(int audit, const char *msg, va_list ap)
54565 +{
54566 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
54567 + unsigned int len = strlen(buf);
54568 +
54569 + vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
54570 +
54571 + return;
54572 +}
54573 +
54574 +static void gr_log_middle_varargs(int audit, const char *msg, ...)
54575 + __attribute__ ((format (printf, 2, 3)));
54576 +
54577 +static void gr_log_middle_varargs(int audit, const char *msg, ...)
54578 +{
54579 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
54580 + unsigned int len = strlen(buf);
54581 + va_list ap;
54582 +
54583 + va_start(ap, msg);
54584 + vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
54585 + va_end(ap);
54586 +
54587 + return;
54588 +}
54589 +
54590 +static void gr_log_end(int audit, int append_default)
54591 +{
54592 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
54593 +
54594 + if (append_default) {
54595 + unsigned int len = strlen(buf);
54596 + snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
54597 + }
54598 +
54599 + printk("%s\n", buf);
54600 +
54601 + return;
54602 +}
54603 +
54604 +void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
54605 +{
54606 + int logtype;
54607 + char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
54608 + char *str1 = NULL, *str2 = NULL, *str3 = NULL;
54609 + void *voidptr = NULL;
54610 + int num1 = 0, num2 = 0;
54611 + unsigned long ulong1 = 0, ulong2 = 0;
54612 + struct dentry *dentry = NULL;
54613 + struct vfsmount *mnt = NULL;
54614 + struct file *file = NULL;
54615 + struct task_struct *task = NULL;
54616 + const struct cred *cred, *pcred;
54617 + va_list ap;
54618 +
54619 + BEGIN_LOCKS(audit);
54620 + logtype = gr_log_start(audit);
54621 + if (logtype == FLOODING) {
54622 + END_LOCKS(audit);
54623 + return;
54624 + }
54625 + va_start(ap, argtypes);
54626 + switch (argtypes) {
54627 + case GR_TTYSNIFF:
54628 + task = va_arg(ap, struct task_struct *);
54629 + gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
54630 + break;
54631 + case GR_SYSCTL_HIDDEN:
54632 + str1 = va_arg(ap, char *);
54633 + gr_log_middle_varargs(audit, msg, result, str1);
54634 + break;
54635 + case GR_RBAC:
54636 + dentry = va_arg(ap, struct dentry *);
54637 + mnt = va_arg(ap, struct vfsmount *);
54638 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
54639 + break;
54640 + case GR_RBAC_STR:
54641 + dentry = va_arg(ap, struct dentry *);
54642 + mnt = va_arg(ap, struct vfsmount *);
54643 + str1 = va_arg(ap, char *);
54644 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
54645 + break;
54646 + case GR_STR_RBAC:
54647 + str1 = va_arg(ap, char *);
54648 + dentry = va_arg(ap, struct dentry *);
54649 + mnt = va_arg(ap, struct vfsmount *);
54650 + gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
54651 + break;
54652 + case GR_RBAC_MODE2:
54653 + dentry = va_arg(ap, struct dentry *);
54654 + mnt = va_arg(ap, struct vfsmount *);
54655 + str1 = va_arg(ap, char *);
54656 + str2 = va_arg(ap, char *);
54657 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
54658 + break;
54659 + case GR_RBAC_MODE3:
54660 + dentry = va_arg(ap, struct dentry *);
54661 + mnt = va_arg(ap, struct vfsmount *);
54662 + str1 = va_arg(ap, char *);
54663 + str2 = va_arg(ap, char *);
54664 + str3 = va_arg(ap, char *);
54665 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
54666 + break;
54667 + case GR_FILENAME:
54668 + dentry = va_arg(ap, struct dentry *);
54669 + mnt = va_arg(ap, struct vfsmount *);
54670 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
54671 + break;
54672 + case GR_STR_FILENAME:
54673 + str1 = va_arg(ap, char *);
54674 + dentry = va_arg(ap, struct dentry *);
54675 + mnt = va_arg(ap, struct vfsmount *);
54676 + gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
54677 + break;
54678 + case GR_FILENAME_STR:
54679 + dentry = va_arg(ap, struct dentry *);
54680 + mnt = va_arg(ap, struct vfsmount *);
54681 + str1 = va_arg(ap, char *);
54682 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
54683 + break;
54684 + case GR_FILENAME_TWO_INT:
54685 + dentry = va_arg(ap, struct dentry *);
54686 + mnt = va_arg(ap, struct vfsmount *);
54687 + num1 = va_arg(ap, int);
54688 + num2 = va_arg(ap, int);
54689 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
54690 + break;
54691 + case GR_FILENAME_TWO_INT_STR:
54692 + dentry = va_arg(ap, struct dentry *);
54693 + mnt = va_arg(ap, struct vfsmount *);
54694 + num1 = va_arg(ap, int);
54695 + num2 = va_arg(ap, int);
54696 + str1 = va_arg(ap, char *);
54697 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
54698 + break;
54699 + case GR_TEXTREL:
54700 + file = va_arg(ap, struct file *);
54701 + ulong1 = va_arg(ap, unsigned long);
54702 + ulong2 = va_arg(ap, unsigned long);
54703 + gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
54704 + break;
54705 + case GR_PTRACE:
54706 + task = va_arg(ap, struct task_struct *);
54707 + gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
54708 + break;
54709 + case GR_RESOURCE:
54710 + task = va_arg(ap, struct task_struct *);
54711 + cred = __task_cred(task);
54712 + pcred = __task_cred(task->real_parent);
54713 + ulong1 = va_arg(ap, unsigned long);
54714 + str1 = va_arg(ap, char *);
54715 + ulong2 = va_arg(ap, unsigned long);
54716 + gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
54717 + break;
54718 + case GR_CAP:
54719 + task = va_arg(ap, struct task_struct *);
54720 + cred = __task_cred(task);
54721 + pcred = __task_cred(task->real_parent);
54722 + str1 = va_arg(ap, char *);
54723 + gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
54724 + break;
54725 + case GR_SIG:
54726 + str1 = va_arg(ap, char *);
54727 + voidptr = va_arg(ap, void *);
54728 + gr_log_middle_varargs(audit, msg, str1, voidptr);
54729 + break;
54730 + case GR_SIG2:
54731 + task = va_arg(ap, struct task_struct *);
54732 + cred = __task_cred(task);
54733 + pcred = __task_cred(task->real_parent);
54734 + num1 = va_arg(ap, int);
54735 + gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
54736 + break;
54737 + case GR_CRASH1:
54738 + task = va_arg(ap, struct task_struct *);
54739 + cred = __task_cred(task);
54740 + pcred = __task_cred(task->real_parent);
54741 + ulong1 = va_arg(ap, unsigned long);
54742 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
54743 + break;
54744 + case GR_CRASH2:
54745 + task = va_arg(ap, struct task_struct *);
54746 + cred = __task_cred(task);
54747 + pcred = __task_cred(task->real_parent);
54748 + ulong1 = va_arg(ap, unsigned long);
54749 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
54750 + break;
54751 + case GR_RWXMAP:
54752 + file = va_arg(ap, struct file *);
54753 + gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
54754 + break;
54755 + case GR_PSACCT:
54756 + {
54757 + unsigned int wday, cday;
54758 + __u8 whr, chr;
54759 + __u8 wmin, cmin;
54760 + __u8 wsec, csec;
54761 + char cur_tty[64] = { 0 };
54762 + char parent_tty[64] = { 0 };
54763 +
54764 + task = va_arg(ap, struct task_struct *);
54765 + wday = va_arg(ap, unsigned int);
54766 + cday = va_arg(ap, unsigned int);
54767 + whr = va_arg(ap, int);
54768 + chr = va_arg(ap, int);
54769 + wmin = va_arg(ap, int);
54770 + cmin = va_arg(ap, int);
54771 + wsec = va_arg(ap, int);
54772 + csec = va_arg(ap, int);
54773 + ulong1 = va_arg(ap, unsigned long);
54774 + cred = __task_cred(task);
54775 + pcred = __task_cred(task->real_parent);
54776 +
54777 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
54778 + }
54779 + break;
54780 + default:
54781 + gr_log_middle(audit, msg, ap);
54782 + }
54783 + va_end(ap);
54784 + // these don't need DEFAULTSECARGS printed on the end
54785 + if (argtypes == GR_CRASH1 || argtypes == GR_CRASH2)
54786 + gr_log_end(audit, 0);
54787 + else
54788 + gr_log_end(audit, 1);
54789 + END_LOCKS(audit);
54790 +}
54791 diff -urNp linux-3.0.9/grsecurity/grsec_mem.c linux-3.0.9/grsecurity/grsec_mem.c
54792 --- linux-3.0.9/grsecurity/grsec_mem.c 1969-12-31 19:00:00.000000000 -0500
54793 +++ linux-3.0.9/grsecurity/grsec_mem.c 2011-11-15 20:02:59.000000000 -0500
54794 @@ -0,0 +1,33 @@
54795 +#include <linux/kernel.h>
54796 +#include <linux/sched.h>
54797 +#include <linux/mm.h>
54798 +#include <linux/mman.h>
54799 +#include <linux/grinternal.h>
54800 +
54801 +void
54802 +gr_handle_ioperm(void)
54803 +{
54804 + gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
54805 + return;
54806 +}
54807 +
54808 +void
54809 +gr_handle_iopl(void)
54810 +{
54811 + gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
54812 + return;
54813 +}
54814 +
54815 +void
54816 +gr_handle_mem_readwrite(u64 from, u64 to)
54817 +{
54818 + gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
54819 + return;
54820 +}
54821 +
54822 +void
54823 +gr_handle_vm86(void)
54824 +{
54825 + gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
54826 + return;
54827 +}
54828 diff -urNp linux-3.0.9/grsecurity/grsec_mount.c linux-3.0.9/grsecurity/grsec_mount.c
54829 --- linux-3.0.9/grsecurity/grsec_mount.c 1969-12-31 19:00:00.000000000 -0500
54830 +++ linux-3.0.9/grsecurity/grsec_mount.c 2011-11-15 20:02:59.000000000 -0500
54831 @@ -0,0 +1,62 @@
54832 +#include <linux/kernel.h>
54833 +#include <linux/sched.h>
54834 +#include <linux/mount.h>
54835 +#include <linux/grsecurity.h>
54836 +#include <linux/grinternal.h>
54837 +
54838 +void
54839 +gr_log_remount(const char *devname, const int retval)
54840 +{
54841 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
54842 + if (grsec_enable_mount && (retval >= 0))
54843 + gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
54844 +#endif
54845 + return;
54846 +}
54847 +
54848 +void
54849 +gr_log_unmount(const char *devname, const int retval)
54850 +{
54851 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
54852 + if (grsec_enable_mount && (retval >= 0))
54853 + gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
54854 +#endif
54855 + return;
54856 +}
54857 +
54858 +void
54859 +gr_log_mount(const char *from, const char *to, const int retval)
54860 +{
54861 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
54862 + if (grsec_enable_mount && (retval >= 0))
54863 + gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to);
54864 +#endif
54865 + return;
54866 +}
54867 +
54868 +int
54869 +gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
54870 +{
54871 +#ifdef CONFIG_GRKERNSEC_ROFS
54872 + if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
54873 + gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
54874 + return -EPERM;
54875 + } else
54876 + return 0;
54877 +#endif
54878 + return 0;
54879 +}
54880 +
54881 +int
54882 +gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
54883 +{
54884 +#ifdef CONFIG_GRKERNSEC_ROFS
54885 + if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
54886 + dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
54887 + gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
54888 + return -EPERM;
54889 + } else
54890 + return 0;
54891 +#endif
54892 + return 0;
54893 +}
54894 diff -urNp linux-3.0.9/grsecurity/grsec_pax.c linux-3.0.9/grsecurity/grsec_pax.c
54895 --- linux-3.0.9/grsecurity/grsec_pax.c 1969-12-31 19:00:00.000000000 -0500
54896 +++ linux-3.0.9/grsecurity/grsec_pax.c 2011-11-15 20:02:59.000000000 -0500
54897 @@ -0,0 +1,36 @@
54898 +#include <linux/kernel.h>
54899 +#include <linux/sched.h>
54900 +#include <linux/mm.h>
54901 +#include <linux/file.h>
54902 +#include <linux/grinternal.h>
54903 +#include <linux/grsecurity.h>
54904 +
54905 +void
54906 +gr_log_textrel(struct vm_area_struct * vma)
54907 +{
54908 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
54909 + if (grsec_enable_audit_textrel)
54910 + gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
54911 +#endif
54912 + return;
54913 +}
54914 +
54915 +void
54916 +gr_log_rwxmmap(struct file *file)
54917 +{
54918 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
54919 + if (grsec_enable_log_rwxmaps)
54920 + gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
54921 +#endif
54922 + return;
54923 +}
54924 +
54925 +void
54926 +gr_log_rwxmprotect(struct file *file)
54927 +{
54928 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
54929 + if (grsec_enable_log_rwxmaps)
54930 + gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
54931 +#endif
54932 + return;
54933 +}
54934 diff -urNp linux-3.0.9/grsecurity/grsec_ptrace.c linux-3.0.9/grsecurity/grsec_ptrace.c
54935 --- linux-3.0.9/grsecurity/grsec_ptrace.c 1969-12-31 19:00:00.000000000 -0500
54936 +++ linux-3.0.9/grsecurity/grsec_ptrace.c 2011-11-15 20:02:59.000000000 -0500
54937 @@ -0,0 +1,14 @@
54938 +#include <linux/kernel.h>
54939 +#include <linux/sched.h>
54940 +#include <linux/grinternal.h>
54941 +#include <linux/grsecurity.h>
54942 +
54943 +void
54944 +gr_audit_ptrace(struct task_struct *task)
54945 +{
54946 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
54947 + if (grsec_enable_audit_ptrace)
54948 + gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
54949 +#endif
54950 + return;
54951 +}
54952 diff -urNp linux-3.0.9/grsecurity/grsec_sig.c linux-3.0.9/grsecurity/grsec_sig.c
54953 --- linux-3.0.9/grsecurity/grsec_sig.c 1969-12-31 19:00:00.000000000 -0500
54954 +++ linux-3.0.9/grsecurity/grsec_sig.c 2011-11-15 20:02:59.000000000 -0500
54955 @@ -0,0 +1,206 @@
54956 +#include <linux/kernel.h>
54957 +#include <linux/sched.h>
54958 +#include <linux/delay.h>
54959 +#include <linux/grsecurity.h>
54960 +#include <linux/grinternal.h>
54961 +#include <linux/hardirq.h>
54962 +
54963 +char *signames[] = {
54964 + [SIGSEGV] = "Segmentation fault",
54965 + [SIGILL] = "Illegal instruction",
54966 + [SIGABRT] = "Abort",
54967 + [SIGBUS] = "Invalid alignment/Bus error"
54968 +};
54969 +
54970 +void
54971 +gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
54972 +{
54973 +#ifdef CONFIG_GRKERNSEC_SIGNAL
54974 + if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
54975 + (sig == SIGABRT) || (sig == SIGBUS))) {
54976 + if (t->pid == current->pid) {
54977 + gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
54978 + } else {
54979 + gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
54980 + }
54981 + }
54982 +#endif
54983 + return;
54984 +}
54985 +
54986 +int
54987 +gr_handle_signal(const struct task_struct *p, const int sig)
54988 +{
54989 +#ifdef CONFIG_GRKERNSEC
54990 + if (current->pid > 1 && gr_check_protected_task(p)) {
54991 + gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
54992 + return -EPERM;
54993 + } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
54994 + return -EPERM;
54995 + }
54996 +#endif
54997 + return 0;
54998 +}
54999 +
55000 +#ifdef CONFIG_GRKERNSEC
55001 +extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
55002 +
55003 +int gr_fake_force_sig(int sig, struct task_struct *t)
55004 +{
55005 + unsigned long int flags;
55006 + int ret, blocked, ignored;
55007 + struct k_sigaction *action;
55008 +
55009 + spin_lock_irqsave(&t->sighand->siglock, flags);
55010 + action = &t->sighand->action[sig-1];
55011 + ignored = action->sa.sa_handler == SIG_IGN;
55012 + blocked = sigismember(&t->blocked, sig);
55013 + if (blocked || ignored) {
55014 + action->sa.sa_handler = SIG_DFL;
55015 + if (blocked) {
55016 + sigdelset(&t->blocked, sig);
55017 + recalc_sigpending_and_wake(t);
55018 + }
55019 + }
55020 + if (action->sa.sa_handler == SIG_DFL)
55021 + t->signal->flags &= ~SIGNAL_UNKILLABLE;
55022 + ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
55023 +
55024 + spin_unlock_irqrestore(&t->sighand->siglock, flags);
55025 +
55026 + return ret;
55027 +}
55028 +#endif
55029 +
55030 +#ifdef CONFIG_GRKERNSEC_BRUTE
55031 +#define GR_USER_BAN_TIME (15 * 60)
55032 +
55033 +static int __get_dumpable(unsigned long mm_flags)
55034 +{
55035 + int ret;
55036 +
55037 + ret = mm_flags & MMF_DUMPABLE_MASK;
55038 + return (ret >= 2) ? 2 : ret;
55039 +}
55040 +#endif
55041 +
55042 +void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
55043 +{
55044 +#ifdef CONFIG_GRKERNSEC_BRUTE
55045 + uid_t uid = 0;
55046 +
55047 + if (!grsec_enable_brute)
55048 + return;
55049 +
55050 + rcu_read_lock();
55051 + read_lock(&tasklist_lock);
55052 + read_lock(&grsec_exec_file_lock);
55053 + if (p->real_parent && p->real_parent->exec_file == p->exec_file)
55054 + p->real_parent->brute = 1;
55055 + else {
55056 + const struct cred *cred = __task_cred(p), *cred2;
55057 + struct task_struct *tsk, *tsk2;
55058 +
55059 + if (!__get_dumpable(mm_flags) && cred->uid) {
55060 + struct user_struct *user;
55061 +
55062 + uid = cred->uid;
55063 +
55064 + /* this is put upon execution past expiration */
55065 + user = find_user(uid);
55066 + if (user == NULL)
55067 + goto unlock;
55068 + user->banned = 1;
55069 + user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
55070 + if (user->ban_expires == ~0UL)
55071 + user->ban_expires--;
55072 +
55073 + do_each_thread(tsk2, tsk) {
55074 + cred2 = __task_cred(tsk);
55075 + if (tsk != p && cred2->uid == uid)
55076 + gr_fake_force_sig(SIGKILL, tsk);
55077 + } while_each_thread(tsk2, tsk);
55078 + }
55079 + }
55080 +unlock:
55081 + read_unlock(&grsec_exec_file_lock);
55082 + read_unlock(&tasklist_lock);
55083 + rcu_read_unlock();
55084 +
55085 + if (uid)
55086 + printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
55087 +
55088 +#endif
55089 + return;
55090 +}
55091 +
55092 +void gr_handle_brute_check(void)
55093 +{
55094 +#ifdef CONFIG_GRKERNSEC_BRUTE
55095 + if (current->brute)
55096 + msleep(30 * 1000);
55097 +#endif
55098 + return;
55099 +}
55100 +
55101 +void gr_handle_kernel_exploit(void)
55102 +{
55103 +#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
55104 + const struct cred *cred;
55105 + struct task_struct *tsk, *tsk2;
55106 + struct user_struct *user;
55107 + uid_t uid;
55108 +
55109 + if (in_irq() || in_serving_softirq() || in_nmi())
55110 + panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
55111 +
55112 + uid = current_uid();
55113 +
55114 + if (uid == 0)
55115 + panic("grsec: halting the system due to suspicious kernel crash caused by root");
55116 + else {
55117 + /* kill all the processes of this user, hold a reference
55118 + to their creds struct, and prevent them from creating
55119 + another process until system reset
55120 + */
55121 + printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
55122 + /* we intentionally leak this ref */
55123 + user = get_uid(current->cred->user);
55124 + if (user) {
55125 + user->banned = 1;
55126 + user->ban_expires = ~0UL;
55127 + }
55128 +
55129 + read_lock(&tasklist_lock);
55130 + do_each_thread(tsk2, tsk) {
55131 + cred = __task_cred(tsk);
55132 + if (cred->uid == uid)
55133 + gr_fake_force_sig(SIGKILL, tsk);
55134 + } while_each_thread(tsk2, tsk);
55135 + read_unlock(&tasklist_lock);
55136 + }
55137 +#endif
55138 +}
55139 +
55140 +int __gr_process_user_ban(struct user_struct *user)
55141 +{
55142 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
55143 + if (unlikely(user->banned)) {
55144 + if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
55145 + user->banned = 0;
55146 + user->ban_expires = 0;
55147 + free_uid(user);
55148 + } else
55149 + return -EPERM;
55150 + }
55151 +#endif
55152 + return 0;
55153 +}
55154 +
55155 +int gr_process_user_ban(void)
55156 +{
55157 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
55158 + return __gr_process_user_ban(current->cred->user);
55159 +#endif
55160 + return 0;
55161 +}
55162 diff -urNp linux-3.0.9/grsecurity/grsec_sock.c linux-3.0.9/grsecurity/grsec_sock.c
55163 --- linux-3.0.9/grsecurity/grsec_sock.c 1969-12-31 19:00:00.000000000 -0500
55164 +++ linux-3.0.9/grsecurity/grsec_sock.c 2011-11-15 20:02:59.000000000 -0500
55165 @@ -0,0 +1,244 @@
55166 +#include <linux/kernel.h>
55167 +#include <linux/module.h>
55168 +#include <linux/sched.h>
55169 +#include <linux/file.h>
55170 +#include <linux/net.h>
55171 +#include <linux/in.h>
55172 +#include <linux/ip.h>
55173 +#include <net/sock.h>
55174 +#include <net/inet_sock.h>
55175 +#include <linux/grsecurity.h>
55176 +#include <linux/grinternal.h>
55177 +#include <linux/gracl.h>
55178 +
55179 +extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
55180 +extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
55181 +
55182 +EXPORT_SYMBOL(gr_search_udp_recvmsg);
55183 +EXPORT_SYMBOL(gr_search_udp_sendmsg);
55184 +
55185 +#ifdef CONFIG_UNIX_MODULE
55186 +EXPORT_SYMBOL(gr_acl_handle_unix);
55187 +EXPORT_SYMBOL(gr_acl_handle_mknod);
55188 +EXPORT_SYMBOL(gr_handle_chroot_unix);
55189 +EXPORT_SYMBOL(gr_handle_create);
55190 +#endif
55191 +
55192 +#ifdef CONFIG_GRKERNSEC
55193 +#define gr_conn_table_size 32749
55194 +struct conn_table_entry {
55195 + struct conn_table_entry *next;
55196 + struct signal_struct *sig;
55197 +};
55198 +
55199 +struct conn_table_entry *gr_conn_table[gr_conn_table_size];
55200 +DEFINE_SPINLOCK(gr_conn_table_lock);
55201 +
55202 +extern const char * gr_socktype_to_name(unsigned char type);
55203 +extern const char * gr_proto_to_name(unsigned char proto);
55204 +extern const char * gr_sockfamily_to_name(unsigned char family);
55205 +
55206 +static __inline__ int
55207 +conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
55208 +{
55209 + return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
55210 +}
55211 +
55212 +static __inline__ int
55213 +conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
55214 + __u16 sport, __u16 dport)
55215 +{
55216 + if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
55217 + sig->gr_sport == sport && sig->gr_dport == dport))
55218 + return 1;
55219 + else
55220 + return 0;
55221 +}
55222 +
55223 +static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
55224 +{
55225 + struct conn_table_entry **match;
55226 + unsigned int index;
55227 +
55228 + index = conn_hash(sig->gr_saddr, sig->gr_daddr,
55229 + sig->gr_sport, sig->gr_dport,
55230 + gr_conn_table_size);
55231 +
55232 + newent->sig = sig;
55233 +
55234 + match = &gr_conn_table[index];
55235 + newent->next = *match;
55236 + *match = newent;
55237 +
55238 + return;
55239 +}
55240 +
55241 +static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
55242 +{
55243 + struct conn_table_entry *match, *last = NULL;
55244 + unsigned int index;
55245 +
55246 + index = conn_hash(sig->gr_saddr, sig->gr_daddr,
55247 + sig->gr_sport, sig->gr_dport,
55248 + gr_conn_table_size);
55249 +
55250 + match = gr_conn_table[index];
55251 + while (match && !conn_match(match->sig,
55252 + sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
55253 + sig->gr_dport)) {
55254 + last = match;
55255 + match = match->next;
55256 + }
55257 +
55258 + if (match) {
55259 + if (last)
55260 + last->next = match->next;
55261 + else
55262 + gr_conn_table[index] = NULL;
55263 + kfree(match);
55264 + }
55265 +
55266 + return;
55267 +}
55268 +
55269 +static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
55270 + __u16 sport, __u16 dport)
55271 +{
55272 + struct conn_table_entry *match;
55273 + unsigned int index;
55274 +
55275 + index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
55276 +
55277 + match = gr_conn_table[index];
55278 + while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
55279 + match = match->next;
55280 +
55281 + if (match)
55282 + return match->sig;
55283 + else
55284 + return NULL;
55285 +}
55286 +
55287 +#endif
55288 +
55289 +void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
55290 +{
55291 +#ifdef CONFIG_GRKERNSEC
55292 + struct signal_struct *sig = task->signal;
55293 + struct conn_table_entry *newent;
55294 +
55295 + newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
55296 + if (newent == NULL)
55297 + return;
55298 + /* no bh lock needed since we are called with bh disabled */
55299 + spin_lock(&gr_conn_table_lock);
55300 + gr_del_task_from_ip_table_nolock(sig);
55301 + sig->gr_saddr = inet->inet_rcv_saddr;
55302 + sig->gr_daddr = inet->inet_daddr;
55303 + sig->gr_sport = inet->inet_sport;
55304 + sig->gr_dport = inet->inet_dport;
55305 + gr_add_to_task_ip_table_nolock(sig, newent);
55306 + spin_unlock(&gr_conn_table_lock);
55307 +#endif
55308 + return;
55309 +}
55310 +
55311 +void gr_del_task_from_ip_table(struct task_struct *task)
55312 +{
55313 +#ifdef CONFIG_GRKERNSEC
55314 + spin_lock_bh(&gr_conn_table_lock);
55315 + gr_del_task_from_ip_table_nolock(task->signal);
55316 + spin_unlock_bh(&gr_conn_table_lock);
55317 +#endif
55318 + return;
55319 +}
55320 +
55321 +void
55322 +gr_attach_curr_ip(const struct sock *sk)
55323 +{
55324 +#ifdef CONFIG_GRKERNSEC
55325 + struct signal_struct *p, *set;
55326 + const struct inet_sock *inet = inet_sk(sk);
55327 +
55328 + if (unlikely(sk->sk_protocol != IPPROTO_TCP))
55329 + return;
55330 +
55331 + set = current->signal;
55332 +
55333 + spin_lock_bh(&gr_conn_table_lock);
55334 + p = gr_lookup_task_ip_table(inet->inet_daddr, inet->inet_rcv_saddr,
55335 + inet->inet_dport, inet->inet_sport);
55336 + if (unlikely(p != NULL)) {
55337 + set->curr_ip = p->curr_ip;
55338 + set->used_accept = 1;
55339 + gr_del_task_from_ip_table_nolock(p);
55340 + spin_unlock_bh(&gr_conn_table_lock);
55341 + return;
55342 + }
55343 + spin_unlock_bh(&gr_conn_table_lock);
55344 +
55345 + set->curr_ip = inet->inet_daddr;
55346 + set->used_accept = 1;
55347 +#endif
55348 + return;
55349 +}
55350 +
55351 +int
55352 +gr_handle_sock_all(const int family, const int type, const int protocol)
55353 +{
55354 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
55355 + if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
55356 + (family != AF_UNIX)) {
55357 + if (family == AF_INET)
55358 + gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
55359 + else
55360 + gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
55361 + return -EACCES;
55362 + }
55363 +#endif
55364 + return 0;
55365 +}
55366 +
55367 +int
55368 +gr_handle_sock_server(const struct sockaddr *sck)
55369 +{
55370 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
55371 + if (grsec_enable_socket_server &&
55372 + in_group_p(grsec_socket_server_gid) &&
55373 + sck && (sck->sa_family != AF_UNIX) &&
55374 + (sck->sa_family != AF_LOCAL)) {
55375 + gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
55376 + return -EACCES;
55377 + }
55378 +#endif
55379 + return 0;
55380 +}
55381 +
55382 +int
55383 +gr_handle_sock_server_other(const struct sock *sck)
55384 +{
55385 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
55386 + if (grsec_enable_socket_server &&
55387 + in_group_p(grsec_socket_server_gid) &&
55388 + sck && (sck->sk_family != AF_UNIX) &&
55389 + (sck->sk_family != AF_LOCAL)) {
55390 + gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
55391 + return -EACCES;
55392 + }
55393 +#endif
55394 + return 0;
55395 +}
55396 +
55397 +int
55398 +gr_handle_sock_client(const struct sockaddr *sck)
55399 +{
55400 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
55401 + if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
55402 + sck && (sck->sa_family != AF_UNIX) &&
55403 + (sck->sa_family != AF_LOCAL)) {
55404 + gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
55405 + return -EACCES;
55406 + }
55407 +#endif
55408 + return 0;
55409 +}
55410 diff -urNp linux-3.0.9/grsecurity/grsec_sysctl.c linux-3.0.9/grsecurity/grsec_sysctl.c
55411 --- linux-3.0.9/grsecurity/grsec_sysctl.c 1969-12-31 19:00:00.000000000 -0500
55412 +++ linux-3.0.9/grsecurity/grsec_sysctl.c 2011-11-15 20:02:59.000000000 -0500
55413 @@ -0,0 +1,433 @@
55414 +#include <linux/kernel.h>
55415 +#include <linux/sched.h>
55416 +#include <linux/sysctl.h>
55417 +#include <linux/grsecurity.h>
55418 +#include <linux/grinternal.h>
55419 +
55420 +int
55421 +gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
55422 +{
55423 +#ifdef CONFIG_GRKERNSEC_SYSCTL
55424 + if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
55425 + gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
55426 + return -EACCES;
55427 + }
55428 +#endif
55429 + return 0;
55430 +}
55431 +
55432 +#ifdef CONFIG_GRKERNSEC_ROFS
55433 +static int __maybe_unused one = 1;
55434 +#endif
55435 +
55436 +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
55437 +struct ctl_table grsecurity_table[] = {
55438 +#ifdef CONFIG_GRKERNSEC_SYSCTL
55439 +#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
55440 +#ifdef CONFIG_GRKERNSEC_IO
55441 + {
55442 + .procname = "disable_priv_io",
55443 + .data = &grsec_disable_privio,
55444 + .maxlen = sizeof(int),
55445 + .mode = 0600,
55446 + .proc_handler = &proc_dointvec,
55447 + },
55448 +#endif
55449 +#endif
55450 +#ifdef CONFIG_GRKERNSEC_LINK
55451 + {
55452 + .procname = "linking_restrictions",
55453 + .data = &grsec_enable_link,
55454 + .maxlen = sizeof(int),
55455 + .mode = 0600,
55456 + .proc_handler = &proc_dointvec,
55457 + },
55458 +#endif
55459 +#ifdef CONFIG_GRKERNSEC_BRUTE
55460 + {
55461 + .procname = "deter_bruteforce",
55462 + .data = &grsec_enable_brute,
55463 + .maxlen = sizeof(int),
55464 + .mode = 0600,
55465 + .proc_handler = &proc_dointvec,
55466 + },
55467 +#endif
55468 +#ifdef CONFIG_GRKERNSEC_FIFO
55469 + {
55470 + .procname = "fifo_restrictions",
55471 + .data = &grsec_enable_fifo,
55472 + .maxlen = sizeof(int),
55473 + .mode = 0600,
55474 + .proc_handler = &proc_dointvec,
55475 + },
55476 +#endif
55477 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
55478 + {
55479 + .procname = "ip_blackhole",
55480 + .data = &grsec_enable_blackhole,
55481 + .maxlen = sizeof(int),
55482 + .mode = 0600,
55483 + .proc_handler = &proc_dointvec,
55484 + },
55485 + {
55486 + .procname = "lastack_retries",
55487 + .data = &grsec_lastack_retries,
55488 + .maxlen = sizeof(int),
55489 + .mode = 0600,
55490 + .proc_handler = &proc_dointvec,
55491 + },
55492 +#endif
55493 +#ifdef CONFIG_GRKERNSEC_EXECLOG
55494 + {
55495 + .procname = "exec_logging",
55496 + .data = &grsec_enable_execlog,
55497 + .maxlen = sizeof(int),
55498 + .mode = 0600,
55499 + .proc_handler = &proc_dointvec,
55500 + },
55501 +#endif
55502 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
55503 + {
55504 + .procname = "rwxmap_logging",
55505 + .data = &grsec_enable_log_rwxmaps,
55506 + .maxlen = sizeof(int),
55507 + .mode = 0600,
55508 + .proc_handler = &proc_dointvec,
55509 + },
55510 +#endif
55511 +#ifdef CONFIG_GRKERNSEC_SIGNAL
55512 + {
55513 + .procname = "signal_logging",
55514 + .data = &grsec_enable_signal,
55515 + .maxlen = sizeof(int),
55516 + .mode = 0600,
55517 + .proc_handler = &proc_dointvec,
55518 + },
55519 +#endif
55520 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
55521 + {
55522 + .procname = "forkfail_logging",
55523 + .data = &grsec_enable_forkfail,
55524 + .maxlen = sizeof(int),
55525 + .mode = 0600,
55526 + .proc_handler = &proc_dointvec,
55527 + },
55528 +#endif
55529 +#ifdef CONFIG_GRKERNSEC_TIME
55530 + {
55531 + .procname = "timechange_logging",
55532 + .data = &grsec_enable_time,
55533 + .maxlen = sizeof(int),
55534 + .mode = 0600,
55535 + .proc_handler = &proc_dointvec,
55536 + },
55537 +#endif
55538 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
55539 + {
55540 + .procname = "chroot_deny_shmat",
55541 + .data = &grsec_enable_chroot_shmat,
55542 + .maxlen = sizeof(int),
55543 + .mode = 0600,
55544 + .proc_handler = &proc_dointvec,
55545 + },
55546 +#endif
55547 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
55548 + {
55549 + .procname = "chroot_deny_unix",
55550 + .data = &grsec_enable_chroot_unix,
55551 + .maxlen = sizeof(int),
55552 + .mode = 0600,
55553 + .proc_handler = &proc_dointvec,
55554 + },
55555 +#endif
55556 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
55557 + {
55558 + .procname = "chroot_deny_mount",
55559 + .data = &grsec_enable_chroot_mount,
55560 + .maxlen = sizeof(int),
55561 + .mode = 0600,
55562 + .proc_handler = &proc_dointvec,
55563 + },
55564 +#endif
55565 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
55566 + {
55567 + .procname = "chroot_deny_fchdir",
55568 + .data = &grsec_enable_chroot_fchdir,
55569 + .maxlen = sizeof(int),
55570 + .mode = 0600,
55571 + .proc_handler = &proc_dointvec,
55572 + },
55573 +#endif
55574 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
55575 + {
55576 + .procname = "chroot_deny_chroot",
55577 + .data = &grsec_enable_chroot_double,
55578 + .maxlen = sizeof(int),
55579 + .mode = 0600,
55580 + .proc_handler = &proc_dointvec,
55581 + },
55582 +#endif
55583 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
55584 + {
55585 + .procname = "chroot_deny_pivot",
55586 + .data = &grsec_enable_chroot_pivot,
55587 + .maxlen = sizeof(int),
55588 + .mode = 0600,
55589 + .proc_handler = &proc_dointvec,
55590 + },
55591 +#endif
55592 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
55593 + {
55594 + .procname = "chroot_enforce_chdir",
55595 + .data = &grsec_enable_chroot_chdir,
55596 + .maxlen = sizeof(int),
55597 + .mode = 0600,
55598 + .proc_handler = &proc_dointvec,
55599 + },
55600 +#endif
55601 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
55602 + {
55603 + .procname = "chroot_deny_chmod",
55604 + .data = &grsec_enable_chroot_chmod,
55605 + .maxlen = sizeof(int),
55606 + .mode = 0600,
55607 + .proc_handler = &proc_dointvec,
55608 + },
55609 +#endif
55610 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
55611 + {
55612 + .procname = "chroot_deny_mknod",
55613 + .data = &grsec_enable_chroot_mknod,
55614 + .maxlen = sizeof(int),
55615 + .mode = 0600,
55616 + .proc_handler = &proc_dointvec,
55617 + },
55618 +#endif
55619 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
55620 + {
55621 + .procname = "chroot_restrict_nice",
55622 + .data = &grsec_enable_chroot_nice,
55623 + .maxlen = sizeof(int),
55624 + .mode = 0600,
55625 + .proc_handler = &proc_dointvec,
55626 + },
55627 +#endif
55628 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
55629 + {
55630 + .procname = "chroot_execlog",
55631 + .data = &grsec_enable_chroot_execlog,
55632 + .maxlen = sizeof(int),
55633 + .mode = 0600,
55634 + .proc_handler = &proc_dointvec,
55635 + },
55636 +#endif
55637 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
55638 + {
55639 + .procname = "chroot_caps",
55640 + .data = &grsec_enable_chroot_caps,
55641 + .maxlen = sizeof(int),
55642 + .mode = 0600,
55643 + .proc_handler = &proc_dointvec,
55644 + },
55645 +#endif
55646 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
55647 + {
55648 + .procname = "chroot_deny_sysctl",
55649 + .data = &grsec_enable_chroot_sysctl,
55650 + .maxlen = sizeof(int),
55651 + .mode = 0600,
55652 + .proc_handler = &proc_dointvec,
55653 + },
55654 +#endif
55655 +#ifdef CONFIG_GRKERNSEC_TPE
55656 + {
55657 + .procname = "tpe",
55658 + .data = &grsec_enable_tpe,
55659 + .maxlen = sizeof(int),
55660 + .mode = 0600,
55661 + .proc_handler = &proc_dointvec,
55662 + },
55663 + {
55664 + .procname = "tpe_gid",
55665 + .data = &grsec_tpe_gid,
55666 + .maxlen = sizeof(int),
55667 + .mode = 0600,
55668 + .proc_handler = &proc_dointvec,
55669 + },
55670 +#endif
55671 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
55672 + {
55673 + .procname = "tpe_invert",
55674 + .data = &grsec_enable_tpe_invert,
55675 + .maxlen = sizeof(int),
55676 + .mode = 0600,
55677 + .proc_handler = &proc_dointvec,
55678 + },
55679 +#endif
55680 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
55681 + {
55682 + .procname = "tpe_restrict_all",
55683 + .data = &grsec_enable_tpe_all,
55684 + .maxlen = sizeof(int),
55685 + .mode = 0600,
55686 + .proc_handler = &proc_dointvec,
55687 + },
55688 +#endif
55689 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
55690 + {
55691 + .procname = "socket_all",
55692 + .data = &grsec_enable_socket_all,
55693 + .maxlen = sizeof(int),
55694 + .mode = 0600,
55695 + .proc_handler = &proc_dointvec,
55696 + },
55697 + {
55698 + .procname = "socket_all_gid",
55699 + .data = &grsec_socket_all_gid,
55700 + .maxlen = sizeof(int),
55701 + .mode = 0600,
55702 + .proc_handler = &proc_dointvec,
55703 + },
55704 +#endif
55705 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
55706 + {
55707 + .procname = "socket_client",
55708 + .data = &grsec_enable_socket_client,
55709 + .maxlen = sizeof(int),
55710 + .mode = 0600,
55711 + .proc_handler = &proc_dointvec,
55712 + },
55713 + {
55714 + .procname = "socket_client_gid",
55715 + .data = &grsec_socket_client_gid,
55716 + .maxlen = sizeof(int),
55717 + .mode = 0600,
55718 + .proc_handler = &proc_dointvec,
55719 + },
55720 +#endif
55721 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
55722 + {
55723 + .procname = "socket_server",
55724 + .data = &grsec_enable_socket_server,
55725 + .maxlen = sizeof(int),
55726 + .mode = 0600,
55727 + .proc_handler = &proc_dointvec,
55728 + },
55729 + {
55730 + .procname = "socket_server_gid",
55731 + .data = &grsec_socket_server_gid,
55732 + .maxlen = sizeof(int),
55733 + .mode = 0600,
55734 + .proc_handler = &proc_dointvec,
55735 + },
55736 +#endif
55737 +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
55738 + {
55739 + .procname = "audit_group",
55740 + .data = &grsec_enable_group,
55741 + .maxlen = sizeof(int),
55742 + .mode = 0600,
55743 + .proc_handler = &proc_dointvec,
55744 + },
55745 + {
55746 + .procname = "audit_gid",
55747 + .data = &grsec_audit_gid,
55748 + .maxlen = sizeof(int),
55749 + .mode = 0600,
55750 + .proc_handler = &proc_dointvec,
55751 + },
55752 +#endif
55753 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
55754 + {
55755 + .procname = "audit_chdir",
55756 + .data = &grsec_enable_chdir,
55757 + .maxlen = sizeof(int),
55758 + .mode = 0600,
55759 + .proc_handler = &proc_dointvec,
55760 + },
55761 +#endif
55762 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
55763 + {
55764 + .procname = "audit_mount",
55765 + .data = &grsec_enable_mount,
55766 + .maxlen = sizeof(int),
55767 + .mode = 0600,
55768 + .proc_handler = &proc_dointvec,
55769 + },
55770 +#endif
55771 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
55772 + {
55773 + .procname = "audit_textrel",
55774 + .data = &grsec_enable_audit_textrel,
55775 + .maxlen = sizeof(int),
55776 + .mode = 0600,
55777 + .proc_handler = &proc_dointvec,
55778 + },
55779 +#endif
55780 +#ifdef CONFIG_GRKERNSEC_DMESG
55781 + {
55782 + .procname = "dmesg",
55783 + .data = &grsec_enable_dmesg,
55784 + .maxlen = sizeof(int),
55785 + .mode = 0600,
55786 + .proc_handler = &proc_dointvec,
55787 + },
55788 +#endif
55789 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
55790 + {
55791 + .procname = "chroot_findtask",
55792 + .data = &grsec_enable_chroot_findtask,
55793 + .maxlen = sizeof(int),
55794 + .mode = 0600,
55795 + .proc_handler = &proc_dointvec,
55796 + },
55797 +#endif
55798 +#ifdef CONFIG_GRKERNSEC_RESLOG
55799 + {
55800 + .procname = "resource_logging",
55801 + .data = &grsec_resource_logging,
55802 + .maxlen = sizeof(int),
55803 + .mode = 0600,
55804 + .proc_handler = &proc_dointvec,
55805 + },
55806 +#endif
55807 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
55808 + {
55809 + .procname = "audit_ptrace",
55810 + .data = &grsec_enable_audit_ptrace,
55811 + .maxlen = sizeof(int),
55812 + .mode = 0600,
55813 + .proc_handler = &proc_dointvec,
55814 + },
55815 +#endif
55816 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
55817 + {
55818 + .procname = "harden_ptrace",
55819 + .data = &grsec_enable_harden_ptrace,
55820 + .maxlen = sizeof(int),
55821 + .mode = 0600,
55822 + .proc_handler = &proc_dointvec,
55823 + },
55824 +#endif
55825 + {
55826 + .procname = "grsec_lock",
55827 + .data = &grsec_lock,
55828 + .maxlen = sizeof(int),
55829 + .mode = 0600,
55830 + .proc_handler = &proc_dointvec,
55831 + },
55832 +#endif
55833 +#ifdef CONFIG_GRKERNSEC_ROFS
55834 + {
55835 + .procname = "romount_protect",
55836 + .data = &grsec_enable_rofs,
55837 + .maxlen = sizeof(int),
55838 + .mode = 0600,
55839 + .proc_handler = &proc_dointvec_minmax,
55840 + .extra1 = &one,
55841 + .extra2 = &one,
55842 + },
55843 +#endif
55844 + { }
55845 +};
55846 +#endif
55847 diff -urNp linux-3.0.9/grsecurity/grsec_time.c linux-3.0.9/grsecurity/grsec_time.c
55848 --- linux-3.0.9/grsecurity/grsec_time.c 1969-12-31 19:00:00.000000000 -0500
55849 +++ linux-3.0.9/grsecurity/grsec_time.c 2011-11-15 20:02:59.000000000 -0500
55850 @@ -0,0 +1,16 @@
55851 +#include <linux/kernel.h>
55852 +#include <linux/sched.h>
55853 +#include <linux/grinternal.h>
55854 +#include <linux/module.h>
55855 +
55856 +void
55857 +gr_log_timechange(void)
55858 +{
55859 +#ifdef CONFIG_GRKERNSEC_TIME
55860 + if (grsec_enable_time)
55861 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
55862 +#endif
55863 + return;
55864 +}
55865 +
55866 +EXPORT_SYMBOL(gr_log_timechange);
55867 diff -urNp linux-3.0.9/grsecurity/grsec_tpe.c linux-3.0.9/grsecurity/grsec_tpe.c
55868 --- linux-3.0.9/grsecurity/grsec_tpe.c 1969-12-31 19:00:00.000000000 -0500
55869 +++ linux-3.0.9/grsecurity/grsec_tpe.c 2011-11-15 20:02:59.000000000 -0500
55870 @@ -0,0 +1,39 @@
55871 +#include <linux/kernel.h>
55872 +#include <linux/sched.h>
55873 +#include <linux/file.h>
55874 +#include <linux/fs.h>
55875 +#include <linux/grinternal.h>
55876 +
55877 +extern int gr_acl_tpe_check(void);
55878 +
55879 +int
55880 +gr_tpe_allow(const struct file *file)
55881 +{
55882 +#ifdef CONFIG_GRKERNSEC
55883 + struct inode *inode = file->f_path.dentry->d_parent->d_inode;
55884 + const struct cred *cred = current_cred();
55885 +
55886 + if (cred->uid && ((grsec_enable_tpe &&
55887 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
55888 + ((grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid)) ||
55889 + (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid)))
55890 +#else
55891 + in_group_p(grsec_tpe_gid)
55892 +#endif
55893 + ) || gr_acl_tpe_check()) &&
55894 + (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
55895 + (inode->i_mode & S_IWOTH))))) {
55896 + gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
55897 + return 0;
55898 + }
55899 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
55900 + if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
55901 + ((inode->i_uid && (inode->i_uid != cred->uid)) ||
55902 + (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
55903 + gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
55904 + return 0;
55905 + }
55906 +#endif
55907 +#endif
55908 + return 1;
55909 +}
55910 diff -urNp linux-3.0.9/grsecurity/grsum.c linux-3.0.9/grsecurity/grsum.c
55911 --- linux-3.0.9/grsecurity/grsum.c 1969-12-31 19:00:00.000000000 -0500
55912 +++ linux-3.0.9/grsecurity/grsum.c 2011-11-15 20:02:59.000000000 -0500
55913 @@ -0,0 +1,61 @@
55914 +#include <linux/err.h>
55915 +#include <linux/kernel.h>
55916 +#include <linux/sched.h>
55917 +#include <linux/mm.h>
55918 +#include <linux/scatterlist.h>
55919 +#include <linux/crypto.h>
55920 +#include <linux/gracl.h>
55921 +
55922 +
55923 +#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
55924 +#error "crypto and sha256 must be built into the kernel"
55925 +#endif
55926 +
55927 +int
55928 +chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
55929 +{
55930 + char *p;
55931 + struct crypto_hash *tfm;
55932 + struct hash_desc desc;
55933 + struct scatterlist sg;
55934 + unsigned char temp_sum[GR_SHA_LEN];
55935 + volatile int retval = 0;
55936 + volatile int dummy = 0;
55937 + unsigned int i;
55938 +
55939 + sg_init_table(&sg, 1);
55940 +
55941 + tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
55942 + if (IS_ERR(tfm)) {
55943 + /* should never happen, since sha256 should be built in */
55944 + return 1;
55945 + }
55946 +
55947 + desc.tfm = tfm;
55948 + desc.flags = 0;
55949 +
55950 + crypto_hash_init(&desc);
55951 +
55952 + p = salt;
55953 + sg_set_buf(&sg, p, GR_SALT_LEN);
55954 + crypto_hash_update(&desc, &sg, sg.length);
55955 +
55956 + p = entry->pw;
55957 + sg_set_buf(&sg, p, strlen(p));
55958 +
55959 + crypto_hash_update(&desc, &sg, sg.length);
55960 +
55961 + crypto_hash_final(&desc, temp_sum);
55962 +
55963 + memset(entry->pw, 0, GR_PW_LEN);
55964 +
55965 + for (i = 0; i < GR_SHA_LEN; i++)
55966 + if (sum[i] != temp_sum[i])
55967 + retval = 1;
55968 + else
55969 + dummy = 1; // waste a cycle
55970 +
55971 + crypto_free_hash(tfm);
55972 +
55973 + return retval;
55974 +}
55975 diff -urNp linux-3.0.9/grsecurity/Kconfig linux-3.0.9/grsecurity/Kconfig
55976 --- linux-3.0.9/grsecurity/Kconfig 1969-12-31 19:00:00.000000000 -0500
55977 +++ linux-3.0.9/grsecurity/Kconfig 2011-11-15 20:02:59.000000000 -0500
55978 @@ -0,0 +1,1037 @@
55979 +#
55980 +# grecurity configuration
55981 +#
55982 +
55983 +menu "Grsecurity"
55984 +
55985 +config GRKERNSEC
55986 + bool "Grsecurity"
55987 + select CRYPTO
55988 + select CRYPTO_SHA256
55989 + help
55990 + If you say Y here, you will be able to configure many features
55991 + that will enhance the security of your system. It is highly
55992 + recommended that you say Y here and read through the help
55993 + for each option so that you fully understand the features and
55994 + can evaluate their usefulness for your machine.
55995 +
55996 +choice
55997 + prompt "Security Level"
55998 + depends on GRKERNSEC
55999 + default GRKERNSEC_CUSTOM
56000 +
56001 +config GRKERNSEC_LOW
56002 + bool "Low"
56003 + select GRKERNSEC_LINK
56004 + select GRKERNSEC_FIFO
56005 + select GRKERNSEC_RANDNET
56006 + select GRKERNSEC_DMESG
56007 + select GRKERNSEC_CHROOT
56008 + select GRKERNSEC_CHROOT_CHDIR
56009 +
56010 + help
56011 + If you choose this option, several of the grsecurity options will
56012 + be enabled that will give you greater protection against a number
56013 + of attacks, while assuring that none of your software will have any
56014 + conflicts with the additional security measures. If you run a lot
56015 + of unusual software, or you are having problems with the higher
56016 + security levels, you should say Y here. With this option, the
56017 + following features are enabled:
56018 +
56019 + - Linking restrictions
56020 + - FIFO restrictions
56021 + - Restricted dmesg
56022 + - Enforced chdir("/") on chroot
56023 + - Runtime module disabling
56024 +
56025 +config GRKERNSEC_MEDIUM
56026 + bool "Medium"
56027 + select PAX
56028 + select PAX_EI_PAX
56029 + select PAX_PT_PAX_FLAGS
56030 + select PAX_HAVE_ACL_FLAGS
56031 + select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
56032 + select GRKERNSEC_CHROOT
56033 + select GRKERNSEC_CHROOT_SYSCTL
56034 + select GRKERNSEC_LINK
56035 + select GRKERNSEC_FIFO
56036 + select GRKERNSEC_DMESG
56037 + select GRKERNSEC_RANDNET
56038 + select GRKERNSEC_FORKFAIL
56039 + select GRKERNSEC_TIME
56040 + select GRKERNSEC_SIGNAL
56041 + select GRKERNSEC_CHROOT
56042 + select GRKERNSEC_CHROOT_UNIX
56043 + select GRKERNSEC_CHROOT_MOUNT
56044 + select GRKERNSEC_CHROOT_PIVOT
56045 + select GRKERNSEC_CHROOT_DOUBLE
56046 + select GRKERNSEC_CHROOT_CHDIR
56047 + select GRKERNSEC_CHROOT_MKNOD
56048 + select GRKERNSEC_PROC
56049 + select GRKERNSEC_PROC_USERGROUP
56050 + select PAX_RANDUSTACK
56051 + select PAX_ASLR
56052 + select PAX_RANDMMAP
56053 + select PAX_REFCOUNT if (X86 || SPARC64)
56054 + select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB))
56055 +
56056 + help
56057 + If you say Y here, several features in addition to those included
56058 + in the low additional security level will be enabled. These
56059 + features provide even more security to your system, though in rare
56060 + cases they may be incompatible with very old or poorly written
56061 + software. If you enable this option, make sure that your auth
56062 + service (identd) is running as gid 1001. With this option,
56063 + the following features (in addition to those provided in the
56064 + low additional security level) will be enabled:
56065 +
56066 + - Failed fork logging
56067 + - Time change logging
56068 + - Signal logging
56069 + - Deny mounts in chroot
56070 + - Deny double chrooting
56071 + - Deny sysctl writes in chroot
56072 + - Deny mknod in chroot
56073 + - Deny access to abstract AF_UNIX sockets out of chroot
56074 + - Deny pivot_root in chroot
56075 + - Denied reads/writes of /dev/kmem, /dev/mem, and /dev/port
56076 + - /proc restrictions with special GID set to 10 (usually wheel)
56077 + - Address Space Layout Randomization (ASLR)
56078 + - Prevent exploitation of most refcount overflows
56079 + - Bounds checking of copying between the kernel and userland
56080 +
56081 +config GRKERNSEC_HIGH
56082 + bool "High"
56083 + select GRKERNSEC_LINK
56084 + select GRKERNSEC_FIFO
56085 + select GRKERNSEC_DMESG
56086 + select GRKERNSEC_FORKFAIL
56087 + select GRKERNSEC_TIME
56088 + select GRKERNSEC_SIGNAL
56089 + select GRKERNSEC_CHROOT
56090 + select GRKERNSEC_CHROOT_SHMAT
56091 + select GRKERNSEC_CHROOT_UNIX
56092 + select GRKERNSEC_CHROOT_MOUNT
56093 + select GRKERNSEC_CHROOT_FCHDIR
56094 + select GRKERNSEC_CHROOT_PIVOT
56095 + select GRKERNSEC_CHROOT_DOUBLE
56096 + select GRKERNSEC_CHROOT_CHDIR
56097 + select GRKERNSEC_CHROOT_MKNOD
56098 + select GRKERNSEC_CHROOT_CAPS
56099 + select GRKERNSEC_CHROOT_SYSCTL
56100 + select GRKERNSEC_CHROOT_FINDTASK
56101 + select GRKERNSEC_SYSFS_RESTRICT
56102 + select GRKERNSEC_PROC
56103 + select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
56104 + select GRKERNSEC_HIDESYM
56105 + select GRKERNSEC_BRUTE
56106 + select GRKERNSEC_PROC_USERGROUP
56107 + select GRKERNSEC_KMEM
56108 + select GRKERNSEC_RESLOG
56109 + select GRKERNSEC_RANDNET
56110 + select GRKERNSEC_PROC_ADD
56111 + select GRKERNSEC_CHROOT_CHMOD
56112 + select GRKERNSEC_CHROOT_NICE
56113 + select GRKERNSEC_AUDIT_MOUNT
56114 + select GRKERNSEC_MODHARDEN if (MODULES)
56115 + select GRKERNSEC_HARDEN_PTRACE
56116 + select GRKERNSEC_VM86 if (X86_32)
56117 + select GRKERNSEC_KERN_LOCKOUT if (X86 || ARM || PPC || SPARC)
56118 + select PAX
56119 + select PAX_RANDUSTACK
56120 + select PAX_ASLR
56121 + select PAX_RANDMMAP
56122 + select PAX_NOEXEC
56123 + select PAX_MPROTECT
56124 + select PAX_EI_PAX
56125 + select PAX_PT_PAX_FLAGS
56126 + select PAX_HAVE_ACL_FLAGS
56127 + select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
56128 + select PAX_MEMORY_UDEREF if (X86 && !XEN)
56129 + select PAX_RANDKSTACK if (X86_TSC && X86)
56130 + select PAX_SEGMEXEC if (X86_32)
56131 + select PAX_PAGEEXEC
56132 + select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
56133 + select PAX_EMUTRAMP if (PARISC)
56134 + select PAX_EMUSIGRT if (PARISC)
56135 + select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
56136 + select PAX_ELFRELOCS if (PAX_ETEXECRELOCS || (IA64 || PPC || X86))
56137 + select PAX_REFCOUNT if (X86 || SPARC64)
56138 + select PAX_USERCOPY if ((X86 || PPC || SPARC || ARM) && (SLAB || SLUB || SLOB))
56139 + help
56140 + If you say Y here, many of the features of grsecurity will be
56141 + enabled, which will protect you against many kinds of attacks
56142 + against your system. The heightened security comes at a cost
56143 + of an increased chance of incompatibilities with rare software
56144 + on your machine. Since this security level enables PaX, you should
56145 + view <http://pax.grsecurity.net> and read about the PaX
56146 + project. While you are there, download chpax and run it on
56147 + binaries that cause problems with PaX. Also remember that
56148 + since the /proc restrictions are enabled, you must run your
56149 + identd as gid 1001. This security level enables the following
56150 + features in addition to those listed in the low and medium
56151 + security levels:
56152 +
56153 + - Additional /proc restrictions
56154 + - Chmod restrictions in chroot
56155 + - No signals, ptrace, or viewing of processes outside of chroot
56156 + - Capability restrictions in chroot
56157 + - Deny fchdir out of chroot
56158 + - Priority restrictions in chroot
56159 + - Segmentation-based implementation of PaX
56160 + - Mprotect restrictions
56161 + - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
56162 + - Kernel stack randomization
56163 + - Mount/unmount/remount logging
56164 + - Kernel symbol hiding
56165 + - Hardening of module auto-loading
56166 + - Ptrace restrictions
56167 + - Restricted vm86 mode
56168 + - Restricted sysfs/debugfs
56169 + - Active kernel exploit response
56170 +
56171 +config GRKERNSEC_CUSTOM
56172 + bool "Custom"
56173 + help
56174 + If you say Y here, you will be able to configure every grsecurity
56175 + option, which allows you to enable many more features that aren't
56176 + covered in the basic security levels. These additional features
56177 + include TPE, socket restrictions, and the sysctl system for
56178 + grsecurity. It is advised that you read through the help for
56179 + each option to determine its usefulness in your situation.
56180 +
56181 +endchoice
56182 +
56183 +menu "Address Space Protection"
56184 +depends on GRKERNSEC
56185 +
56186 +config GRKERNSEC_KMEM
56187 + bool "Deny reading/writing to /dev/kmem, /dev/mem, and /dev/port"
56188 + select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
56189 + help
56190 + If you say Y here, /dev/kmem and /dev/mem won't be allowed to
56191 + be written to or read from to modify or leak the contents of the running
56192 + kernel. /dev/port will also not be allowed to be opened. If you have module
56193 + support disabled, enabling this will close up four ways that are
56194 + currently used to insert malicious code into the running kernel.
56195 + Even with all these features enabled, we still highly recommend that
56196 + you use the RBAC system, as it is still possible for an attacker to
56197 + modify the running kernel through privileged I/O granted by ioperm/iopl.
56198 + If you are not using XFree86, you may be able to stop this additional
56199 + case by enabling the 'Disable privileged I/O' option. Though nothing
56200 + legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
56201 + but only to video memory, which is the only writing we allow in this
56202 + case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
56203 + not be allowed to mprotect it with PROT_WRITE later.
56204 + It is highly recommended that you say Y here if you meet all the
56205 + conditions above.
56206 +
56207 +config GRKERNSEC_VM86
56208 + bool "Restrict VM86 mode"
56209 + depends on X86_32
56210 +
56211 + help
56212 + If you say Y here, only processes with CAP_SYS_RAWIO will be able to
56213 + make use of a special execution mode on 32bit x86 processors called
56214 + Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
56215 + video cards and will still work with this option enabled. The purpose
56216 + of the option is to prevent exploitation of emulation errors in
56217 + virtualization of vm86 mode like the one discovered in VMWare in 2009.
56218 + Nearly all users should be able to enable this option.
56219 +
56220 +config GRKERNSEC_IO
56221 + bool "Disable privileged I/O"
56222 + depends on X86
56223 + select RTC_CLASS
56224 + select RTC_INTF_DEV
56225 + select RTC_DRV_CMOS
56226 +
56227 + help
56228 + If you say Y here, all ioperm and iopl calls will return an error.
56229 + Ioperm and iopl can be used to modify the running kernel.
56230 + Unfortunately, some programs need this access to operate properly,
56231 + the most notable of which are XFree86 and hwclock. hwclock can be
56232 + remedied by having RTC support in the kernel, so real-time
56233 + clock support is enabled if this option is enabled, to ensure
56234 + that hwclock operates correctly. XFree86 still will not
56235 + operate correctly with this option enabled, so DO NOT CHOOSE Y
56236 + IF YOU USE XFree86. If you use XFree86 and you still want to
56237 + protect your kernel against modification, use the RBAC system.
56238 +
56239 +config GRKERNSEC_PROC_MEMMAP
56240 + bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
56241 + default y if (PAX_NOEXEC || PAX_ASLR)
56242 + depends on PAX_NOEXEC || PAX_ASLR
56243 + help
56244 + If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
56245 + give no information about the addresses of its mappings if
56246 + PaX features that rely on random addresses are enabled on the task.
56247 + If you use PaX it is greatly recommended that you say Y here as it
56248 + closes up a hole that makes the full ASLR useless for suid
56249 + binaries.
56250 +
56251 +config GRKERNSEC_BRUTE
56252 + bool "Deter exploit bruteforcing"
56253 + help
56254 + If you say Y here, attempts to bruteforce exploits against forking
56255 + daemons such as apache or sshd, as well as against suid/sgid binaries
56256 + will be deterred. When a child of a forking daemon is killed by PaX
56257 + or crashes due to an illegal instruction or other suspicious signal,
56258 + the parent process will be delayed 30 seconds upon every subsequent
56259 + fork until the administrator is able to assess the situation and
56260 + restart the daemon.
56261 + In the suid/sgid case, the attempt is logged, the user has all their
56262 + processes terminated, and they are prevented from executing any further
56263 + processes for 15 minutes.
56264 + It is recommended that you also enable signal logging in the auditing
56265 + section so that logs are generated when a process triggers a suspicious
56266 + signal.
56267 + If the sysctl option is enabled, a sysctl option with name
56268 + "deter_bruteforce" is created.
56269 +
56270 +
56271 +config GRKERNSEC_MODHARDEN
56272 + bool "Harden module auto-loading"
56273 + depends on MODULES
56274 + help
56275 + If you say Y here, module auto-loading in response to use of some
56276 + feature implemented by an unloaded module will be restricted to
56277 + root users. Enabling this option helps defend against attacks
56278 + by unprivileged users who abuse the auto-loading behavior to
56279 + cause a vulnerable module to load that is then exploited.
56280 +
56281 + If this option prevents a legitimate use of auto-loading for a
56282 + non-root user, the administrator can execute modprobe manually
56283 + with the exact name of the module mentioned in the alert log.
56284 + Alternatively, the administrator can add the module to the list
56285 + of modules loaded at boot by modifying init scripts.
56286 +
56287 + Modification of init scripts will most likely be needed on
56288 + Ubuntu servers with encrypted home directory support enabled,
56289 + as the first non-root user logging in will cause the ecb(aes),
56290 + ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
56291 +
56292 +config GRKERNSEC_HIDESYM
56293 + bool "Hide kernel symbols"
56294 + help
56295 + If you say Y here, getting information on loaded modules, and
56296 + displaying all kernel symbols through a syscall will be restricted
56297 + to users with CAP_SYS_MODULE. For software compatibility reasons,
56298 + /proc/kallsyms will be restricted to the root user. The RBAC
56299 + system can hide that entry even from root.
56300 +
56301 + This option also prevents leaking of kernel addresses through
56302 + several /proc entries.
56303 +
56304 + Note that this option is only effective provided the following
56305 + conditions are met:
56306 + 1) The kernel using grsecurity is not precompiled by some distribution
56307 + 2) You have also enabled GRKERNSEC_DMESG
56308 + 3) You are using the RBAC system and hiding other files such as your
56309 + kernel image and System.map. Alternatively, enabling this option
56310 + causes the permissions on /boot, /lib/modules, and the kernel
56311 + source directory to change at compile time to prevent
56312 + reading by non-root users.
56313 + If the above conditions are met, this option will aid in providing a
56314 + useful protection against local kernel exploitation of overflows
56315 + and arbitrary read/write vulnerabilities.
56316 +
56317 +config GRKERNSEC_KERN_LOCKOUT
56318 + bool "Active kernel exploit response"
56319 + depends on X86 || ARM || PPC || SPARC
56320 + help
56321 + If you say Y here, when a PaX alert is triggered due to suspicious
56322 + activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
56323 + or an OOPs occurs due to bad memory accesses, instead of just
56324 + terminating the offending process (and potentially allowing
56325 + a subsequent exploit from the same user), we will take one of two
56326 + actions:
56327 + If the user was root, we will panic the system
56328 + If the user was non-root, we will log the attempt, terminate
56329 + all processes owned by the user, then prevent them from creating
56330 + any new processes until the system is restarted
56331 + This deters repeated kernel exploitation/bruteforcing attempts
56332 + and is useful for later forensics.
56333 +
56334 +endmenu
56335 +menu "Role Based Access Control Options"
56336 +depends on GRKERNSEC
56337 +
56338 +config GRKERNSEC_RBAC_DEBUG
56339 + bool
56340 +
56341 +config GRKERNSEC_NO_RBAC
56342 + bool "Disable RBAC system"
56343 + help
56344 + If you say Y here, the /dev/grsec device will be removed from the kernel,
56345 + preventing the RBAC system from being enabled. You should only say Y
56346 + here if you have no intention of using the RBAC system, so as to prevent
56347 + an attacker with root access from misusing the RBAC system to hide files
56348 + and processes when loadable module support and /dev/[k]mem have been
56349 + locked down.
56350 +
56351 +config GRKERNSEC_ACL_HIDEKERN
56352 + bool "Hide kernel processes"
56353 + help
56354 + If you say Y here, all kernel threads will be hidden to all
56355 + processes but those whose subject has the "view hidden processes"
56356 + flag.
56357 +
56358 +config GRKERNSEC_ACL_MAXTRIES
56359 + int "Maximum tries before password lockout"
56360 + default 3
56361 + help
56362 + This option enforces the maximum number of times a user can attempt
56363 + to authorize themselves with the grsecurity RBAC system before being
56364 + denied the ability to attempt authorization again for a specified time.
56365 + The lower the number, the harder it will be to brute-force a password.
56366 +
56367 +config GRKERNSEC_ACL_TIMEOUT
56368 + int "Time to wait after max password tries, in seconds"
56369 + default 30
56370 + help
56371 + This option specifies the time the user must wait after attempting to
56372 + authorize to the RBAC system with the maximum number of invalid
56373 + passwords. The higher the number, the harder it will be to brute-force
56374 + a password.
56375 +
56376 +endmenu
56377 +menu "Filesystem Protections"
56378 +depends on GRKERNSEC
56379 +
56380 +config GRKERNSEC_PROC
56381 + bool "Proc restrictions"
56382 + help
56383 + If you say Y here, the permissions of the /proc filesystem
56384 + will be altered to enhance system security and privacy. You MUST
56385 + choose either a user only restriction or a user and group restriction.
56386 + Depending upon the option you choose, you can either restrict users to
56387 + see only the processes they themselves run, or choose a group that can
56388 + view all processes and files normally restricted to root if you choose
56389 + the "restrict to user only" option. NOTE: If you're running identd as
56390 + a non-root user, you will have to run it as the group you specify here.
56391 +
56392 +config GRKERNSEC_PROC_USER
56393 + bool "Restrict /proc to user only"
56394 + depends on GRKERNSEC_PROC
56395 + help
56396 + If you say Y here, non-root users will only be able to view their own
56397 + processes, and restricts them from viewing network-related information,
56398 + and viewing kernel symbol and module information.
56399 +
56400 +config GRKERNSEC_PROC_USERGROUP
56401 + bool "Allow special group"
56402 + depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
56403 + help
56404 + If you say Y here, you will be able to select a group that will be
56405 + able to view all processes and network-related information. If you've
56406 + enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
56407 + remain hidden. This option is useful if you want to run identd as
56408 + a non-root user.
56409 +
56410 +config GRKERNSEC_PROC_GID
56411 + int "GID for special group"
56412 + depends on GRKERNSEC_PROC_USERGROUP
56413 + default 1001
56414 +
56415 +config GRKERNSEC_PROC_ADD
56416 + bool "Additional restrictions"
56417 + depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
56418 + help
56419 + If you say Y here, additional restrictions will be placed on
56420 + /proc that keep normal users from viewing device information and
56421 + slabinfo information that could be useful for exploits.
56422 +
56423 +config GRKERNSEC_LINK
56424 + bool "Linking restrictions"
56425 + help
56426 + If you say Y here, /tmp race exploits will be prevented, since users
56427 + will no longer be able to follow symlinks owned by other users in
56428 + world-writable +t directories (e.g. /tmp), unless the owner of the
56429 + symlink is the owner of the directory. users will also not be
56430 + able to hardlink to files they do not own. If the sysctl option is
56431 + enabled, a sysctl option with name "linking_restrictions" is created.
56432 +
56433 +config GRKERNSEC_FIFO
56434 + bool "FIFO restrictions"
56435 + help
56436 + If you say Y here, users will not be able to write to FIFOs they don't
56437 + own in world-writable +t directories (e.g. /tmp), unless the owner of
56438 + the FIFO is the same owner of the directory it's held in. If the sysctl
56439 + option is enabled, a sysctl option with name "fifo_restrictions" is
56440 + created.
56441 +
56442 +config GRKERNSEC_SYSFS_RESTRICT
56443 + bool "Sysfs/debugfs restriction"
56444 + depends on SYSFS
56445 + help
56446 + If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
56447 + any filesystem normally mounted under it (e.g. debugfs) will only
56448 + be accessible by root. These filesystems generally provide access
56449 + to hardware and debug information that isn't appropriate for unprivileged
56450 + users of the system. Sysfs and debugfs have also become a large source
56451 + of new vulnerabilities, ranging from infoleaks to local compromise.
56452 + There has been very little oversight with an eye toward security involved
56453 + in adding new exporters of information to these filesystems, so their
56454 + use is discouraged.
56455 + This option is equivalent to a chmod 0700 of the mount paths.
56456 +
56457 +config GRKERNSEC_ROFS
56458 + bool "Runtime read-only mount protection"
56459 + help
56460 + If you say Y here, a sysctl option with name "romount_protect" will
56461 + be created. By setting this option to 1 at runtime, filesystems
56462 + will be protected in the following ways:
56463 + * No new writable mounts will be allowed
56464 + * Existing read-only mounts won't be able to be remounted read/write
56465 + * Write operations will be denied on all block devices
56466 + This option acts independently of grsec_lock: once it is set to 1,
56467 + it cannot be turned off. Therefore, please be mindful of the resulting
56468 + behavior if this option is enabled in an init script on a read-only
56469 + filesystem. This feature is mainly intended for secure embedded systems.
56470 +
56471 +config GRKERNSEC_CHROOT
56472 + bool "Chroot jail restrictions"
56473 + help
56474 + If you say Y here, you will be able to choose several options that will
56475 + make breaking out of a chrooted jail much more difficult. If you
56476 + encounter no software incompatibilities with the following options, it
56477 + is recommended that you enable each one.
56478 +
56479 +config GRKERNSEC_CHROOT_MOUNT
56480 + bool "Deny mounts"
56481 + depends on GRKERNSEC_CHROOT
56482 + help
56483 + If you say Y here, processes inside a chroot will not be able to
56484 + mount or remount filesystems. If the sysctl option is enabled, a
56485 + sysctl option with name "chroot_deny_mount" is created.
56486 +
56487 +config GRKERNSEC_CHROOT_DOUBLE
56488 + bool "Deny double-chroots"
56489 + depends on GRKERNSEC_CHROOT
56490 + help
56491 + If you say Y here, processes inside a chroot will not be able to chroot
56492 + again outside the chroot. This is a widely used method of breaking
56493 + out of a chroot jail and should not be allowed. If the sysctl
56494 + option is enabled, a sysctl option with name
56495 + "chroot_deny_chroot" is created.
56496 +
56497 +config GRKERNSEC_CHROOT_PIVOT
56498 + bool "Deny pivot_root in chroot"
56499 + depends on GRKERNSEC_CHROOT
56500 + help
56501 + If you say Y here, processes inside a chroot will not be able to use
56502 + a function called pivot_root() that was introduced in Linux 2.3.41. It
56503 + works similar to chroot in that it changes the root filesystem. This
56504 + function could be misused in a chrooted process to attempt to break out
56505 + of the chroot, and therefore should not be allowed. If the sysctl
56506 + option is enabled, a sysctl option with name "chroot_deny_pivot" is
56507 + created.
56508 +
56509 +config GRKERNSEC_CHROOT_CHDIR
56510 + bool "Enforce chdir(\"/\") on all chroots"
56511 + depends on GRKERNSEC_CHROOT
56512 + help
56513 + If you say Y here, the current working directory of all newly-chrooted
56514 + applications will be set to the the root directory of the chroot.
56515 + The man page on chroot(2) states:
56516 + Note that this call does not change the current working
56517 + directory, so that `.' can be outside the tree rooted at
56518 + `/'. In particular, the super-user can escape from a
56519 + `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
56520 +
56521 + It is recommended that you say Y here, since it's not known to break
56522 + any software. If the sysctl option is enabled, a sysctl option with
56523 + name "chroot_enforce_chdir" is created.
56524 +
56525 +config GRKERNSEC_CHROOT_CHMOD
56526 + bool "Deny (f)chmod +s"
56527 + depends on GRKERNSEC_CHROOT
56528 + help
56529 + If you say Y here, processes inside a chroot will not be able to chmod
56530 + or fchmod files to make them have suid or sgid bits. This protects
56531 + against another published method of breaking a chroot. If the sysctl
56532 + option is enabled, a sysctl option with name "chroot_deny_chmod" is
56533 + created.
56534 +
56535 +config GRKERNSEC_CHROOT_FCHDIR
56536 + bool "Deny fchdir out of chroot"
56537 + depends on GRKERNSEC_CHROOT
56538 + help
56539 + If you say Y here, a well-known method of breaking chroots by fchdir'ing
56540 + to a file descriptor of the chrooting process that points to a directory
56541 + outside the filesystem will be stopped. If the sysctl option
56542 + is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
56543 +
56544 +config GRKERNSEC_CHROOT_MKNOD
56545 + bool "Deny mknod"
56546 + depends on GRKERNSEC_CHROOT
56547 + help
56548 + If you say Y here, processes inside a chroot will not be allowed to
56549 + mknod. The problem with using mknod inside a chroot is that it
56550 + would allow an attacker to create a device entry that is the same
56551 + as one on the physical root of your system, which could range from
56552 + anything from the console device to a device for your harddrive (which
56553 + they could then use to wipe the drive or steal data). It is recommended
56554 + that you say Y here, unless you run into software incompatibilities.
56555 + If the sysctl option is enabled, a sysctl option with name
56556 + "chroot_deny_mknod" is created.
56557 +
56558 +config GRKERNSEC_CHROOT_SHMAT
56559 + bool "Deny shmat() out of chroot"
56560 + depends on GRKERNSEC_CHROOT
56561 + help
56562 + If you say Y here, processes inside a chroot will not be able to attach
56563 + to shared memory segments that were created outside of the chroot jail.
56564 + It is recommended that you say Y here. If the sysctl option is enabled,
56565 + a sysctl option with name "chroot_deny_shmat" is created.
56566 +
56567 +config GRKERNSEC_CHROOT_UNIX
56568 + bool "Deny access to abstract AF_UNIX sockets out of chroot"
56569 + depends on GRKERNSEC_CHROOT
56570 + help
56571 + If you say Y here, processes inside a chroot will not be able to
56572 + connect to abstract (meaning not belonging to a filesystem) Unix
56573 + domain sockets that were bound outside of a chroot. It is recommended
56574 + that you say Y here. If the sysctl option is enabled, a sysctl option
56575 + with name "chroot_deny_unix" is created.
56576 +
56577 +config GRKERNSEC_CHROOT_FINDTASK
56578 + bool "Protect outside processes"
56579 + depends on GRKERNSEC_CHROOT
56580 + help
56581 + If you say Y here, processes inside a chroot will not be able to
56582 + kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
56583 + getsid, or view any process outside of the chroot. If the sysctl
56584 + option is enabled, a sysctl option with name "chroot_findtask" is
56585 + created.
56586 +
56587 +config GRKERNSEC_CHROOT_NICE
56588 + bool "Restrict priority changes"
56589 + depends on GRKERNSEC_CHROOT
56590 + help
56591 + If you say Y here, processes inside a chroot will not be able to raise
56592 + the priority of processes in the chroot, or alter the priority of
56593 + processes outside the chroot. This provides more security than simply
56594 + removing CAP_SYS_NICE from the process' capability set. If the
56595 + sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
56596 + is created.
56597 +
56598 +config GRKERNSEC_CHROOT_SYSCTL
56599 + bool "Deny sysctl writes"
56600 + depends on GRKERNSEC_CHROOT
56601 + help
56602 + If you say Y here, an attacker in a chroot will not be able to
56603 + write to sysctl entries, either by sysctl(2) or through a /proc
56604 + interface. It is strongly recommended that you say Y here. If the
56605 + sysctl option is enabled, a sysctl option with name
56606 + "chroot_deny_sysctl" is created.
56607 +
56608 +config GRKERNSEC_CHROOT_CAPS
56609 + bool "Capability restrictions"
56610 + depends on GRKERNSEC_CHROOT
56611 + help
56612 + If you say Y here, the capabilities on all processes within a
56613 + chroot jail will be lowered to stop module insertion, raw i/o,
56614 + system and net admin tasks, rebooting the system, modifying immutable
56615 + files, modifying IPC owned by another, and changing the system time.
56616 + This is left an option because it can break some apps. Disable this
56617 + if your chrooted apps are having problems performing those kinds of
56618 + tasks. If the sysctl option is enabled, a sysctl option with
56619 + name "chroot_caps" is created.
56620 +
56621 +endmenu
56622 +menu "Kernel Auditing"
56623 +depends on GRKERNSEC
56624 +
56625 +config GRKERNSEC_AUDIT_GROUP
56626 + bool "Single group for auditing"
56627 + help
56628 + If you say Y here, the exec, chdir, and (un)mount logging features
56629 + will only operate on a group you specify. This option is recommended
56630 + if you only want to watch certain users instead of having a large
56631 + amount of logs from the entire system. If the sysctl option is enabled,
56632 + a sysctl option with name "audit_group" is created.
56633 +
56634 +config GRKERNSEC_AUDIT_GID
56635 + int "GID for auditing"
56636 + depends on GRKERNSEC_AUDIT_GROUP
56637 + default 1007
56638 +
56639 +config GRKERNSEC_EXECLOG
56640 + bool "Exec logging"
56641 + help
56642 + If you say Y here, all execve() calls will be logged (since the
56643 + other exec*() calls are frontends to execve(), all execution
56644 + will be logged). Useful for shell-servers that like to keep track
56645 + of their users. If the sysctl option is enabled, a sysctl option with
56646 + name "exec_logging" is created.
56647 + WARNING: This option when enabled will produce a LOT of logs, especially
56648 + on an active system.
56649 +
56650 +config GRKERNSEC_RESLOG
56651 + bool "Resource logging"
56652 + help
56653 + If you say Y here, all attempts to overstep resource limits will
56654 + be logged with the resource name, the requested size, and the current
56655 + limit. It is highly recommended that you say Y here. If the sysctl
56656 + option is enabled, a sysctl option with name "resource_logging" is
56657 + created. If the RBAC system is enabled, the sysctl value is ignored.
56658 +
56659 +config GRKERNSEC_CHROOT_EXECLOG
56660 + bool "Log execs within chroot"
56661 + help
56662 + If you say Y here, all executions inside a chroot jail will be logged
56663 + to syslog. This can cause a large amount of logs if certain
56664 + applications (eg. djb's daemontools) are installed on the system, and
56665 + is therefore left as an option. If the sysctl option is enabled, a
56666 + sysctl option with name "chroot_execlog" is created.
56667 +
56668 +config GRKERNSEC_AUDIT_PTRACE
56669 + bool "Ptrace logging"
56670 + help
56671 + If you say Y here, all attempts to attach to a process via ptrace
56672 + will be logged. If the sysctl option is enabled, a sysctl option
56673 + with name "audit_ptrace" is created.
56674 +
56675 +config GRKERNSEC_AUDIT_CHDIR
56676 + bool "Chdir logging"
56677 + help
56678 + If you say Y here, all chdir() calls will be logged. If the sysctl
56679 + option is enabled, a sysctl option with name "audit_chdir" is created.
56680 +
56681 +config GRKERNSEC_AUDIT_MOUNT
56682 + bool "(Un)Mount logging"
56683 + help
56684 + If you say Y here, all mounts and unmounts will be logged. If the
56685 + sysctl option is enabled, a sysctl option with name "audit_mount" is
56686 + created.
56687 +
56688 +config GRKERNSEC_SIGNAL
56689 + bool "Signal logging"
56690 + help
56691 + If you say Y here, certain important signals will be logged, such as
56692 + SIGSEGV, which will as a result inform you of when a error in a program
56693 + occurred, which in some cases could mean a possible exploit attempt.
56694 + If the sysctl option is enabled, a sysctl option with name
56695 + "signal_logging" is created.
56696 +
56697 +config GRKERNSEC_FORKFAIL
56698 + bool "Fork failure logging"
56699 + help
56700 + If you say Y here, all failed fork() attempts will be logged.
56701 + This could suggest a fork bomb, or someone attempting to overstep
56702 + their process limit. If the sysctl option is enabled, a sysctl option
56703 + with name "forkfail_logging" is created.
56704 +
56705 +config GRKERNSEC_TIME
56706 + bool "Time change logging"
56707 + help
56708 + If you say Y here, any changes of the system clock will be logged.
56709 + If the sysctl option is enabled, a sysctl option with name
56710 + "timechange_logging" is created.
56711 +
56712 +config GRKERNSEC_PROC_IPADDR
56713 + bool "/proc/<pid>/ipaddr support"
56714 + help
56715 + If you say Y here, a new entry will be added to each /proc/<pid>
56716 + directory that contains the IP address of the person using the task.
56717 + The IP is carried across local TCP and AF_UNIX stream sockets.
56718 + This information can be useful for IDS/IPSes to perform remote response
56719 + to a local attack. The entry is readable by only the owner of the
56720 + process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
56721 + the RBAC system), and thus does not create privacy concerns.
56722 +
56723 +config GRKERNSEC_RWXMAP_LOG
56724 + bool 'Denied RWX mmap/mprotect logging'
56725 + depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
56726 + help
56727 + If you say Y here, calls to mmap() and mprotect() with explicit
56728 + usage of PROT_WRITE and PROT_EXEC together will be logged when
56729 + denied by the PAX_MPROTECT feature. If the sysctl option is
56730 + enabled, a sysctl option with name "rwxmap_logging" is created.
56731 +
56732 +config GRKERNSEC_AUDIT_TEXTREL
56733 + bool 'ELF text relocations logging (READ HELP)'
56734 + depends on PAX_MPROTECT
56735 + help
56736 + If you say Y here, text relocations will be logged with the filename
56737 + of the offending library or binary. The purpose of the feature is
56738 + to help Linux distribution developers get rid of libraries and
56739 + binaries that need text relocations which hinder the future progress
56740 + of PaX. Only Linux distribution developers should say Y here, and
56741 + never on a production machine, as this option creates an information
56742 + leak that could aid an attacker in defeating the randomization of
56743 + a single memory region. If the sysctl option is enabled, a sysctl
56744 + option with name "audit_textrel" is created.
56745 +
56746 +endmenu
56747 +
56748 +menu "Executable Protections"
56749 +depends on GRKERNSEC
56750 +
56751 +config GRKERNSEC_DMESG
56752 + bool "Dmesg(8) restriction"
56753 + help
56754 + If you say Y here, non-root users will not be able to use dmesg(8)
56755 + to view up to the last 4kb of messages in the kernel's log buffer.
56756 + The kernel's log buffer often contains kernel addresses and other
56757 + identifying information useful to an attacker in fingerprinting a
56758 + system for a targeted exploit.
56759 + If the sysctl option is enabled, a sysctl option with name "dmesg" is
56760 + created.
56761 +
56762 +config GRKERNSEC_HARDEN_PTRACE
56763 + bool "Deter ptrace-based process snooping"
56764 + help
56765 + If you say Y here, TTY sniffers and other malicious monitoring
56766 + programs implemented through ptrace will be defeated. If you
56767 + have been using the RBAC system, this option has already been
56768 + enabled for several years for all users, with the ability to make
56769 + fine-grained exceptions.
56770 +
56771 + This option only affects the ability of non-root users to ptrace
56772 + processes that are not a descendent of the ptracing process.
56773 + This means that strace ./binary and gdb ./binary will still work,
56774 + but attaching to arbitrary processes will not. If the sysctl
56775 + option is enabled, a sysctl option with name "harden_ptrace" is
56776 + created.
56777 +
56778 +config GRKERNSEC_TPE
56779 + bool "Trusted Path Execution (TPE)"
56780 + help
56781 + If you say Y here, you will be able to choose a gid to add to the
56782 + supplementary groups of users you want to mark as "untrusted."
56783 + These users will not be able to execute any files that are not in
56784 + root-owned directories writable only by root. If the sysctl option
56785 + is enabled, a sysctl option with name "tpe" is created.
56786 +
56787 +config GRKERNSEC_TPE_ALL
56788 + bool "Partially restrict all non-root users"
56789 + depends on GRKERNSEC_TPE
56790 + help
56791 + If you say Y here, all non-root users will be covered under
56792 + a weaker TPE restriction. This is separate from, and in addition to,
56793 + the main TPE options that you have selected elsewhere. Thus, if a
56794 + "trusted" GID is chosen, this restriction applies to even that GID.
56795 + Under this restriction, all non-root users will only be allowed to
56796 + execute files in directories they own that are not group or
56797 + world-writable, or in directories owned by root and writable only by
56798 + root. If the sysctl option is enabled, a sysctl option with name
56799 + "tpe_restrict_all" is created.
56800 +
56801 +config GRKERNSEC_TPE_INVERT
56802 + bool "Invert GID option"
56803 + depends on GRKERNSEC_TPE
56804 + help
56805 + If you say Y here, the group you specify in the TPE configuration will
56806 + decide what group TPE restrictions will be *disabled* for. This
56807 + option is useful if you want TPE restrictions to be applied to most
56808 + users on the system. If the sysctl option is enabled, a sysctl option
56809 + with name "tpe_invert" is created. Unlike other sysctl options, this
56810 + entry will default to on for backward-compatibility.
56811 +
56812 +config GRKERNSEC_TPE_GID
56813 + int "GID for untrusted users"
56814 + depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
56815 + default 1005
56816 + help
56817 + Setting this GID determines what group TPE restrictions will be
56818 + *enabled* for. If the sysctl option is enabled, a sysctl option
56819 + with name "tpe_gid" is created.
56820 +
56821 +config GRKERNSEC_TPE_GID
56822 + int "GID for trusted users"
56823 + depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
56824 + default 1005
56825 + help
56826 + Setting this GID determines what group TPE restrictions will be
56827 + *disabled* for. If the sysctl option is enabled, a sysctl option
56828 + with name "tpe_gid" is created.
56829 +
56830 +endmenu
56831 +menu "Network Protections"
56832 +depends on GRKERNSEC
56833 +
56834 +config GRKERNSEC_RANDNET
56835 + bool "Larger entropy pools"
56836 + help
56837 + If you say Y here, the entropy pools used for many features of Linux
56838 + and grsecurity will be doubled in size. Since several grsecurity
56839 + features use additional randomness, it is recommended that you say Y
56840 + here. Saying Y here has a similar effect as modifying
56841 + /proc/sys/kernel/random/poolsize.
56842 +
56843 +config GRKERNSEC_BLACKHOLE
56844 + bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
56845 + depends on NET
56846 + help
56847 + If you say Y here, neither TCP resets nor ICMP
56848 + destination-unreachable packets will be sent in response to packets
56849 + sent to ports for which no associated listening process exists.
56850 + This feature supports both IPV4 and IPV6 and exempts the
56851 + loopback interface from blackholing. Enabling this feature
56852 + makes a host more resilient to DoS attacks and reduces network
56853 + visibility against scanners.
56854 +
56855 + The blackhole feature as-implemented is equivalent to the FreeBSD
56856 + blackhole feature, as it prevents RST responses to all packets, not
56857 + just SYNs. Under most application behavior this causes no
56858 + problems, but applications (like haproxy) may not close certain
56859 + connections in a way that cleanly terminates them on the remote
56860 + end, leaving the remote host in LAST_ACK state. Because of this
56861 + side-effect and to prevent intentional LAST_ACK DoSes, this
56862 + feature also adds automatic mitigation against such attacks.
56863 + The mitigation drastically reduces the amount of time a socket
56864 + can spend in LAST_ACK state. If you're using haproxy and not
56865 + all servers it connects to have this option enabled, consider
56866 + disabling this feature on the haproxy host.
56867 +
56868 + If the sysctl option is enabled, two sysctl options with names
56869 + "ip_blackhole" and "lastack_retries" will be created.
56870 + While "ip_blackhole" takes the standard zero/non-zero on/off
56871 + toggle, "lastack_retries" uses the same kinds of values as
56872 + "tcp_retries1" and "tcp_retries2". The default value of 4
56873 + prevents a socket from lasting more than 45 seconds in LAST_ACK
56874 + state.
56875 +
56876 +config GRKERNSEC_SOCKET
56877 + bool "Socket restrictions"
56878 + depends on NET
56879 + help
56880 + If you say Y here, you will be able to choose from several options.
56881 + If you assign a GID on your system and add it to the supplementary
56882 + groups of users you want to restrict socket access to, this patch
56883 + will perform up to three things, based on the option(s) you choose.
56884 +
56885 +config GRKERNSEC_SOCKET_ALL
56886 + bool "Deny any sockets to group"
56887 + depends on GRKERNSEC_SOCKET
56888 + help
56889 + If you say Y here, you will be able to choose a GID of whose users will
56890 + be unable to connect to other hosts from your machine or run server
56891 + applications from your machine. If the sysctl option is enabled, a
56892 + sysctl option with name "socket_all" is created.
56893 +
56894 +config GRKERNSEC_SOCKET_ALL_GID
56895 + int "GID to deny all sockets for"
56896 + depends on GRKERNSEC_SOCKET_ALL
56897 + default 1004
56898 + help
56899 + Here you can choose the GID to disable socket access for. Remember to
56900 + add the users you want socket access disabled for to the GID
56901 + specified here. If the sysctl option is enabled, a sysctl option
56902 + with name "socket_all_gid" is created.
56903 +
56904 +config GRKERNSEC_SOCKET_CLIENT
56905 + bool "Deny client sockets to group"
56906 + depends on GRKERNSEC_SOCKET
56907 + help
56908 + If you say Y here, you will be able to choose a GID of whose users will
56909 + be unable to connect to other hosts from your machine, but will be
56910 + able to run servers. If this option is enabled, all users in the group
56911 + you specify will have to use passive mode when initiating ftp transfers
56912 + from the shell on your machine. If the sysctl option is enabled, a
56913 + sysctl option with name "socket_client" is created.
56914 +
56915 +config GRKERNSEC_SOCKET_CLIENT_GID
56916 + int "GID to deny client sockets for"
56917 + depends on GRKERNSEC_SOCKET_CLIENT
56918 + default 1003
56919 + help
56920 + Here you can choose the GID to disable client socket access for.
56921 + Remember to add the users you want client socket access disabled for to
56922 + the GID specified here. If the sysctl option is enabled, a sysctl
56923 + option with name "socket_client_gid" is created.
56924 +
56925 +config GRKERNSEC_SOCKET_SERVER
56926 + bool "Deny server sockets to group"
56927 + depends on GRKERNSEC_SOCKET
56928 + help
56929 + If you say Y here, you will be able to choose a GID of whose users will
56930 + be unable to run server applications from your machine. If the sysctl
56931 + option is enabled, a sysctl option with name "socket_server" is created.
56932 +
56933 +config GRKERNSEC_SOCKET_SERVER_GID
56934 + int "GID to deny server sockets for"
56935 + depends on GRKERNSEC_SOCKET_SERVER
56936 + default 1002
56937 + help
56938 + Here you can choose the GID to disable server socket access for.
56939 + Remember to add the users you want server socket access disabled for to
56940 + the GID specified here. If the sysctl option is enabled, a sysctl
56941 + option with name "socket_server_gid" is created.
56942 +
56943 +endmenu
56944 +menu "Sysctl support"
56945 +depends on GRKERNSEC && SYSCTL
56946 +
56947 +config GRKERNSEC_SYSCTL
56948 + bool "Sysctl support"
56949 + help
56950 + If you say Y here, you will be able to change the options that
56951 + grsecurity runs with at bootup, without having to recompile your
56952 + kernel. You can echo values to files in /proc/sys/kernel/grsecurity
56953 + to enable (1) or disable (0) various features. All the sysctl entries
56954 + are mutable until the "grsec_lock" entry is set to a non-zero value.
56955 + All features enabled in the kernel configuration are disabled at boot
56956 + if you do not say Y to the "Turn on features by default" option.
56957 + All options should be set at startup, and the grsec_lock entry should
56958 + be set to a non-zero value after all the options are set.
56959 + *THIS IS EXTREMELY IMPORTANT*
56960 +
56961 +config GRKERNSEC_SYSCTL_DISTRO
56962 + bool "Extra sysctl support for distro makers (READ HELP)"
56963 + depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
56964 + help
56965 + If you say Y here, additional sysctl options will be created
56966 + for features that affect processes running as root. Therefore,
56967 + it is critical when using this option that the grsec_lock entry be
56968 + enabled after boot. Only distros with prebuilt kernel packages
56969 + with this option enabled that can ensure grsec_lock is enabled
56970 + after boot should use this option.
56971 + *Failure to set grsec_lock after boot makes all grsec features
56972 + this option covers useless*
56973 +
56974 + Currently this option creates the following sysctl entries:
56975 + "Disable Privileged I/O": "disable_priv_io"
56976 +
56977 +config GRKERNSEC_SYSCTL_ON
56978 + bool "Turn on features by default"
56979 + depends on GRKERNSEC_SYSCTL
56980 + help
56981 + If you say Y here, instead of having all features enabled in the
56982 + kernel configuration disabled at boot time, the features will be
56983 + enabled at boot time. It is recommended you say Y here unless
56984 + there is some reason you would want all sysctl-tunable features to
56985 + be disabled by default. As mentioned elsewhere, it is important
56986 + to enable the grsec_lock entry once you have finished modifying
56987 + the sysctl entries.
56988 +
56989 +endmenu
56990 +menu "Logging Options"
56991 +depends on GRKERNSEC
56992 +
56993 +config GRKERNSEC_FLOODTIME
56994 + int "Seconds in between log messages (minimum)"
56995 + default 10
56996 + help
56997 + This option allows you to enforce the number of seconds between
56998 + grsecurity log messages. The default should be suitable for most
56999 + people, however, if you choose to change it, choose a value small enough
57000 + to allow informative logs to be produced, but large enough to
57001 + prevent flooding.
57002 +
57003 +config GRKERNSEC_FLOODBURST
57004 + int "Number of messages in a burst (maximum)"
57005 + default 6
57006 + help
57007 + This option allows you to choose the maximum number of messages allowed
57008 + within the flood time interval you chose in a separate option. The
57009 + default should be suitable for most people, however if you find that
57010 + many of your logs are being interpreted as flooding, you may want to
57011 + raise this value.
57012 +
57013 +endmenu
57014 +
57015 +endmenu
57016 diff -urNp linux-3.0.9/grsecurity/Makefile linux-3.0.9/grsecurity/Makefile
57017 --- linux-3.0.9/grsecurity/Makefile 1969-12-31 19:00:00.000000000 -0500
57018 +++ linux-3.0.9/grsecurity/Makefile 2011-11-15 20:02:59.000000000 -0500
57019 @@ -0,0 +1,36 @@
57020 +# grsecurity's ACL system was originally written in 2001 by Michael Dalton
57021 +# during 2001-2009 it has been completely redesigned by Brad Spengler
57022 +# into an RBAC system
57023 +#
57024 +# All code in this directory and various hooks inserted throughout the kernel
57025 +# are copyright Brad Spengler - Open Source Security, Inc., and released
57026 +# under the GPL v2 or higher
57027 +
57028 +obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
57029 + grsec_mount.o grsec_sig.o grsec_sysctl.o \
57030 + grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
57031 +
57032 +obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
57033 + gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
57034 + gracl_learn.o grsec_log.o
57035 +obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
57036 +
57037 +ifdef CONFIG_NET
57038 +obj-y += grsec_sock.o
57039 +obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
57040 +endif
57041 +
57042 +ifndef CONFIG_GRKERNSEC
57043 +obj-y += grsec_disabled.o
57044 +endif
57045 +
57046 +ifdef CONFIG_GRKERNSEC_HIDESYM
57047 +extra-y := grsec_hidesym.o
57048 +$(obj)/grsec_hidesym.o:
57049 + @-chmod -f 500 /boot
57050 + @-chmod -f 500 /lib/modules
57051 + @-chmod -f 500 /lib64/modules
57052 + @-chmod -f 500 /lib32/modules
57053 + @-chmod -f 700 .
57054 + @echo ' grsec: protected kernel image paths'
57055 +endif
57056 diff -urNp linux-3.0.9/include/acpi/acpi_bus.h linux-3.0.9/include/acpi/acpi_bus.h
57057 --- linux-3.0.9/include/acpi/acpi_bus.h 2011-11-11 13:12:24.000000000 -0500
57058 +++ linux-3.0.9/include/acpi/acpi_bus.h 2011-11-15 20:02:59.000000000 -0500
57059 @@ -107,7 +107,7 @@ struct acpi_device_ops {
57060 acpi_op_bind bind;
57061 acpi_op_unbind unbind;
57062 acpi_op_notify notify;
57063 -};
57064 +} __no_const;
57065
57066 #define ACPI_DRIVER_ALL_NOTIFY_EVENTS 0x1 /* system AND device events */
57067
57068 diff -urNp linux-3.0.9/include/asm-generic/atomic-long.h linux-3.0.9/include/asm-generic/atomic-long.h
57069 --- linux-3.0.9/include/asm-generic/atomic-long.h 2011-11-11 13:12:24.000000000 -0500
57070 +++ linux-3.0.9/include/asm-generic/atomic-long.h 2011-11-15 20:02:59.000000000 -0500
57071 @@ -22,6 +22,12 @@
57072
57073 typedef atomic64_t atomic_long_t;
57074
57075 +#ifdef CONFIG_PAX_REFCOUNT
57076 +typedef atomic64_unchecked_t atomic_long_unchecked_t;
57077 +#else
57078 +typedef atomic64_t atomic_long_unchecked_t;
57079 +#endif
57080 +
57081 #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
57082
57083 static inline long atomic_long_read(atomic_long_t *l)
57084 @@ -31,6 +37,15 @@ static inline long atomic_long_read(atom
57085 return (long)atomic64_read(v);
57086 }
57087
57088 +#ifdef CONFIG_PAX_REFCOUNT
57089 +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
57090 +{
57091 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
57092 +
57093 + return (long)atomic64_read_unchecked(v);
57094 +}
57095 +#endif
57096 +
57097 static inline void atomic_long_set(atomic_long_t *l, long i)
57098 {
57099 atomic64_t *v = (atomic64_t *)l;
57100 @@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi
57101 atomic64_set(v, i);
57102 }
57103
57104 +#ifdef CONFIG_PAX_REFCOUNT
57105 +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
57106 +{
57107 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
57108 +
57109 + atomic64_set_unchecked(v, i);
57110 +}
57111 +#endif
57112 +
57113 static inline void atomic_long_inc(atomic_long_t *l)
57114 {
57115 atomic64_t *v = (atomic64_t *)l;
57116 @@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi
57117 atomic64_inc(v);
57118 }
57119
57120 +#ifdef CONFIG_PAX_REFCOUNT
57121 +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
57122 +{
57123 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
57124 +
57125 + atomic64_inc_unchecked(v);
57126 +}
57127 +#endif
57128 +
57129 static inline void atomic_long_dec(atomic_long_t *l)
57130 {
57131 atomic64_t *v = (atomic64_t *)l;
57132 @@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomi
57133 atomic64_dec(v);
57134 }
57135
57136 +#ifdef CONFIG_PAX_REFCOUNT
57137 +static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
57138 +{
57139 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
57140 +
57141 + atomic64_dec_unchecked(v);
57142 +}
57143 +#endif
57144 +
57145 static inline void atomic_long_add(long i, atomic_long_t *l)
57146 {
57147 atomic64_t *v = (atomic64_t *)l;
57148 @@ -59,6 +101,15 @@ static inline void atomic_long_add(long
57149 atomic64_add(i, v);
57150 }
57151
57152 +#ifdef CONFIG_PAX_REFCOUNT
57153 +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
57154 +{
57155 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
57156 +
57157 + atomic64_add_unchecked(i, v);
57158 +}
57159 +#endif
57160 +
57161 static inline void atomic_long_sub(long i, atomic_long_t *l)
57162 {
57163 atomic64_t *v = (atomic64_t *)l;
57164 @@ -66,6 +117,15 @@ static inline void atomic_long_sub(long
57165 atomic64_sub(i, v);
57166 }
57167
57168 +#ifdef CONFIG_PAX_REFCOUNT
57169 +static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
57170 +{
57171 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
57172 +
57173 + atomic64_sub_unchecked(i, v);
57174 +}
57175 +#endif
57176 +
57177 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
57178 {
57179 atomic64_t *v = (atomic64_t *)l;
57180 @@ -115,6 +175,15 @@ static inline long atomic_long_inc_retur
57181 return (long)atomic64_inc_return(v);
57182 }
57183
57184 +#ifdef CONFIG_PAX_REFCOUNT
57185 +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
57186 +{
57187 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
57188 +
57189 + return (long)atomic64_inc_return_unchecked(v);
57190 +}
57191 +#endif
57192 +
57193 static inline long atomic_long_dec_return(atomic_long_t *l)
57194 {
57195 atomic64_t *v = (atomic64_t *)l;
57196 @@ -140,6 +209,12 @@ static inline long atomic_long_add_unles
57197
57198 typedef atomic_t atomic_long_t;
57199
57200 +#ifdef CONFIG_PAX_REFCOUNT
57201 +typedef atomic_unchecked_t atomic_long_unchecked_t;
57202 +#else
57203 +typedef atomic_t atomic_long_unchecked_t;
57204 +#endif
57205 +
57206 #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
57207 static inline long atomic_long_read(atomic_long_t *l)
57208 {
57209 @@ -148,6 +223,15 @@ static inline long atomic_long_read(atom
57210 return (long)atomic_read(v);
57211 }
57212
57213 +#ifdef CONFIG_PAX_REFCOUNT
57214 +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
57215 +{
57216 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
57217 +
57218 + return (long)atomic_read_unchecked(v);
57219 +}
57220 +#endif
57221 +
57222 static inline void atomic_long_set(atomic_long_t *l, long i)
57223 {
57224 atomic_t *v = (atomic_t *)l;
57225 @@ -155,6 +239,15 @@ static inline void atomic_long_set(atomi
57226 atomic_set(v, i);
57227 }
57228
57229 +#ifdef CONFIG_PAX_REFCOUNT
57230 +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
57231 +{
57232 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
57233 +
57234 + atomic_set_unchecked(v, i);
57235 +}
57236 +#endif
57237 +
57238 static inline void atomic_long_inc(atomic_long_t *l)
57239 {
57240 atomic_t *v = (atomic_t *)l;
57241 @@ -162,6 +255,15 @@ static inline void atomic_long_inc(atomi
57242 atomic_inc(v);
57243 }
57244
57245 +#ifdef CONFIG_PAX_REFCOUNT
57246 +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
57247 +{
57248 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
57249 +
57250 + atomic_inc_unchecked(v);
57251 +}
57252 +#endif
57253 +
57254 static inline void atomic_long_dec(atomic_long_t *l)
57255 {
57256 atomic_t *v = (atomic_t *)l;
57257 @@ -169,6 +271,15 @@ static inline void atomic_long_dec(atomi
57258 atomic_dec(v);
57259 }
57260
57261 +#ifdef CONFIG_PAX_REFCOUNT
57262 +static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
57263 +{
57264 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
57265 +
57266 + atomic_dec_unchecked(v);
57267 +}
57268 +#endif
57269 +
57270 static inline void atomic_long_add(long i, atomic_long_t *l)
57271 {
57272 atomic_t *v = (atomic_t *)l;
57273 @@ -176,6 +287,15 @@ static inline void atomic_long_add(long
57274 atomic_add(i, v);
57275 }
57276
57277 +#ifdef CONFIG_PAX_REFCOUNT
57278 +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
57279 +{
57280 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
57281 +
57282 + atomic_add_unchecked(i, v);
57283 +}
57284 +#endif
57285 +
57286 static inline void atomic_long_sub(long i, atomic_long_t *l)
57287 {
57288 atomic_t *v = (atomic_t *)l;
57289 @@ -183,6 +303,15 @@ static inline void atomic_long_sub(long
57290 atomic_sub(i, v);
57291 }
57292
57293 +#ifdef CONFIG_PAX_REFCOUNT
57294 +static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
57295 +{
57296 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
57297 +
57298 + atomic_sub_unchecked(i, v);
57299 +}
57300 +#endif
57301 +
57302 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
57303 {
57304 atomic_t *v = (atomic_t *)l;
57305 @@ -232,6 +361,15 @@ static inline long atomic_long_inc_retur
57306 return (long)atomic_inc_return(v);
57307 }
57308
57309 +#ifdef CONFIG_PAX_REFCOUNT
57310 +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
57311 +{
57312 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
57313 +
57314 + return (long)atomic_inc_return_unchecked(v);
57315 +}
57316 +#endif
57317 +
57318 static inline long atomic_long_dec_return(atomic_long_t *l)
57319 {
57320 atomic_t *v = (atomic_t *)l;
57321 @@ -255,4 +393,49 @@ static inline long atomic_long_add_unles
57322
57323 #endif /* BITS_PER_LONG == 64 */
57324
57325 +#ifdef CONFIG_PAX_REFCOUNT
57326 +static inline void pax_refcount_needs_these_functions(void)
57327 +{
57328 + atomic_read_unchecked((atomic_unchecked_t *)NULL);
57329 + atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
57330 + atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
57331 + atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
57332 + atomic_inc_unchecked((atomic_unchecked_t *)NULL);
57333 + (void)atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
57334 + atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
57335 + atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
57336 + atomic_dec_unchecked((atomic_unchecked_t *)NULL);
57337 + atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
57338 + (void)atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
57339 +
57340 + atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
57341 + atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
57342 + atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
57343 + atomic_long_sub_unchecked(0, (atomic_long_unchecked_t *)NULL);
57344 + atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
57345 + atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
57346 + atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
57347 +}
57348 +#else
57349 +#define atomic_read_unchecked(v) atomic_read(v)
57350 +#define atomic_set_unchecked(v, i) atomic_set((v), (i))
57351 +#define atomic_add_unchecked(i, v) atomic_add((i), (v))
57352 +#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
57353 +#define atomic_inc_unchecked(v) atomic_inc(v)
57354 +#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
57355 +#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
57356 +#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
57357 +#define atomic_dec_unchecked(v) atomic_dec(v)
57358 +#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
57359 +#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
57360 +
57361 +#define atomic_long_read_unchecked(v) atomic_long_read(v)
57362 +#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
57363 +#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
57364 +#define atomic_long_sub_unchecked(i, v) atomic_long_sub((i), (v))
57365 +#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
57366 +#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
57367 +#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
57368 +#endif
57369 +
57370 #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
57371 diff -urNp linux-3.0.9/include/asm-generic/cache.h linux-3.0.9/include/asm-generic/cache.h
57372 --- linux-3.0.9/include/asm-generic/cache.h 2011-11-11 13:12:24.000000000 -0500
57373 +++ linux-3.0.9/include/asm-generic/cache.h 2011-11-15 20:02:59.000000000 -0500
57374 @@ -6,7 +6,7 @@
57375 * cache lines need to provide their own cache.h.
57376 */
57377
57378 -#define L1_CACHE_SHIFT 5
57379 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
57380 +#define L1_CACHE_SHIFT 5UL
57381 +#define L1_CACHE_BYTES (1UL << L1_CACHE_SHIFT)
57382
57383 #endif /* __ASM_GENERIC_CACHE_H */
57384 diff -urNp linux-3.0.9/include/asm-generic/int-l64.h linux-3.0.9/include/asm-generic/int-l64.h
57385 --- linux-3.0.9/include/asm-generic/int-l64.h 2011-11-11 13:12:24.000000000 -0500
57386 +++ linux-3.0.9/include/asm-generic/int-l64.h 2011-11-15 20:02:59.000000000 -0500
57387 @@ -46,6 +46,8 @@ typedef unsigned int u32;
57388 typedef signed long s64;
57389 typedef unsigned long u64;
57390
57391 +typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
57392 +
57393 #define S8_C(x) x
57394 #define U8_C(x) x ## U
57395 #define S16_C(x) x
57396 diff -urNp linux-3.0.9/include/asm-generic/int-ll64.h linux-3.0.9/include/asm-generic/int-ll64.h
57397 --- linux-3.0.9/include/asm-generic/int-ll64.h 2011-11-11 13:12:24.000000000 -0500
57398 +++ linux-3.0.9/include/asm-generic/int-ll64.h 2011-11-15 20:02:59.000000000 -0500
57399 @@ -51,6 +51,8 @@ typedef unsigned int u32;
57400 typedef signed long long s64;
57401 typedef unsigned long long u64;
57402
57403 +typedef unsigned long long intoverflow_t;
57404 +
57405 #define S8_C(x) x
57406 #define U8_C(x) x ## U
57407 #define S16_C(x) x
57408 diff -urNp linux-3.0.9/include/asm-generic/kmap_types.h linux-3.0.9/include/asm-generic/kmap_types.h
57409 --- linux-3.0.9/include/asm-generic/kmap_types.h 2011-11-11 13:12:24.000000000 -0500
57410 +++ linux-3.0.9/include/asm-generic/kmap_types.h 2011-11-15 20:02:59.000000000 -0500
57411 @@ -29,10 +29,11 @@ KMAP_D(16) KM_IRQ_PTE,
57412 KMAP_D(17) KM_NMI,
57413 KMAP_D(18) KM_NMI_PTE,
57414 KMAP_D(19) KM_KDB,
57415 +KMAP_D(20) KM_CLEARPAGE,
57416 /*
57417 * Remember to update debug_kmap_atomic() when adding new kmap types!
57418 */
57419 -KMAP_D(20) KM_TYPE_NR
57420 +KMAP_D(21) KM_TYPE_NR
57421 };
57422
57423 #undef KMAP_D
57424 diff -urNp linux-3.0.9/include/asm-generic/pgtable.h linux-3.0.9/include/asm-generic/pgtable.h
57425 --- linux-3.0.9/include/asm-generic/pgtable.h 2011-11-11 13:12:24.000000000 -0500
57426 +++ linux-3.0.9/include/asm-generic/pgtable.h 2011-11-15 20:02:59.000000000 -0500
57427 @@ -443,6 +443,14 @@ static inline int pmd_write(pmd_t pmd)
57428 #endif /* __HAVE_ARCH_PMD_WRITE */
57429 #endif
57430
57431 +#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
57432 +static inline unsigned long pax_open_kernel(void) { return 0; }
57433 +#endif
57434 +
57435 +#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
57436 +static inline unsigned long pax_close_kernel(void) { return 0; }
57437 +#endif
57438 +
57439 #endif /* !__ASSEMBLY__ */
57440
57441 #endif /* _ASM_GENERIC_PGTABLE_H */
57442 diff -urNp linux-3.0.9/include/asm-generic/pgtable-nopmd.h linux-3.0.9/include/asm-generic/pgtable-nopmd.h
57443 --- linux-3.0.9/include/asm-generic/pgtable-nopmd.h 2011-11-11 13:12:24.000000000 -0500
57444 +++ linux-3.0.9/include/asm-generic/pgtable-nopmd.h 2011-11-15 20:02:59.000000000 -0500
57445 @@ -1,14 +1,19 @@
57446 #ifndef _PGTABLE_NOPMD_H
57447 #define _PGTABLE_NOPMD_H
57448
57449 -#ifndef __ASSEMBLY__
57450 -
57451 #include <asm-generic/pgtable-nopud.h>
57452
57453 -struct mm_struct;
57454 -
57455 #define __PAGETABLE_PMD_FOLDED
57456
57457 +#define PMD_SHIFT PUD_SHIFT
57458 +#define PTRS_PER_PMD 1
57459 +#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
57460 +#define PMD_MASK (~(PMD_SIZE-1))
57461 +
57462 +#ifndef __ASSEMBLY__
57463 +
57464 +struct mm_struct;
57465 +
57466 /*
57467 * Having the pmd type consist of a pud gets the size right, and allows
57468 * us to conceptually access the pud entry that this pmd is folded into
57469 @@ -16,11 +21,6 @@ struct mm_struct;
57470 */
57471 typedef struct { pud_t pud; } pmd_t;
57472
57473 -#define PMD_SHIFT PUD_SHIFT
57474 -#define PTRS_PER_PMD 1
57475 -#define PMD_SIZE (1UL << PMD_SHIFT)
57476 -#define PMD_MASK (~(PMD_SIZE-1))
57477 -
57478 /*
57479 * The "pud_xxx()" functions here are trivial for a folded two-level
57480 * setup: the pmd is never bad, and a pmd always exists (as it's folded
57481 diff -urNp linux-3.0.9/include/asm-generic/pgtable-nopud.h linux-3.0.9/include/asm-generic/pgtable-nopud.h
57482 --- linux-3.0.9/include/asm-generic/pgtable-nopud.h 2011-11-11 13:12:24.000000000 -0500
57483 +++ linux-3.0.9/include/asm-generic/pgtable-nopud.h 2011-11-15 20:02:59.000000000 -0500
57484 @@ -1,10 +1,15 @@
57485 #ifndef _PGTABLE_NOPUD_H
57486 #define _PGTABLE_NOPUD_H
57487
57488 -#ifndef __ASSEMBLY__
57489 -
57490 #define __PAGETABLE_PUD_FOLDED
57491
57492 +#define PUD_SHIFT PGDIR_SHIFT
57493 +#define PTRS_PER_PUD 1
57494 +#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
57495 +#define PUD_MASK (~(PUD_SIZE-1))
57496 +
57497 +#ifndef __ASSEMBLY__
57498 +
57499 /*
57500 * Having the pud type consist of a pgd gets the size right, and allows
57501 * us to conceptually access the pgd entry that this pud is folded into
57502 @@ -12,11 +17,6 @@
57503 */
57504 typedef struct { pgd_t pgd; } pud_t;
57505
57506 -#define PUD_SHIFT PGDIR_SHIFT
57507 -#define PTRS_PER_PUD 1
57508 -#define PUD_SIZE (1UL << PUD_SHIFT)
57509 -#define PUD_MASK (~(PUD_SIZE-1))
57510 -
57511 /*
57512 * The "pgd_xxx()" functions here are trivial for a folded two-level
57513 * setup: the pud is never bad, and a pud always exists (as it's folded
57514 diff -urNp linux-3.0.9/include/asm-generic/vmlinux.lds.h linux-3.0.9/include/asm-generic/vmlinux.lds.h
57515 --- linux-3.0.9/include/asm-generic/vmlinux.lds.h 2011-11-11 13:12:24.000000000 -0500
57516 +++ linux-3.0.9/include/asm-generic/vmlinux.lds.h 2011-11-15 20:02:59.000000000 -0500
57517 @@ -217,6 +217,7 @@
57518 .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
57519 VMLINUX_SYMBOL(__start_rodata) = .; \
57520 *(.rodata) *(.rodata.*) \
57521 + *(.data..read_only) \
57522 *(__vermagic) /* Kernel version magic */ \
57523 . = ALIGN(8); \
57524 VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .; \
57525 @@ -723,17 +724,18 @@
57526 * section in the linker script will go there too. @phdr should have
57527 * a leading colon.
57528 *
57529 - * Note that this macros defines __per_cpu_load as an absolute symbol.
57530 + * Note that this macros defines per_cpu_load as an absolute symbol.
57531 * If there is no need to put the percpu section at a predetermined
57532 * address, use PERCPU_SECTION.
57533 */
57534 #define PERCPU_VADDR(cacheline, vaddr, phdr) \
57535 - VMLINUX_SYMBOL(__per_cpu_load) = .; \
57536 - .data..percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
57537 + per_cpu_load = .; \
57538 + .data..percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
57539 - LOAD_OFFSET) { \
57540 + VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
57541 PERCPU_INPUT(cacheline) \
57542 } phdr \
57543 - . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data..percpu);
57544 + . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data..percpu);
57545
57546 /**
57547 * PERCPU_SECTION - define output section for percpu area, simple version
57548 diff -urNp linux-3.0.9/include/drm/drm_crtc_helper.h linux-3.0.9/include/drm/drm_crtc_helper.h
57549 --- linux-3.0.9/include/drm/drm_crtc_helper.h 2011-11-11 13:12:24.000000000 -0500
57550 +++ linux-3.0.9/include/drm/drm_crtc_helper.h 2011-11-15 20:02:59.000000000 -0500
57551 @@ -74,7 +74,7 @@ struct drm_crtc_helper_funcs {
57552
57553 /* disable crtc when not in use - more explicit than dpms off */
57554 void (*disable)(struct drm_crtc *crtc);
57555 -};
57556 +} __no_const;
57557
57558 struct drm_encoder_helper_funcs {
57559 void (*dpms)(struct drm_encoder *encoder, int mode);
57560 @@ -95,7 +95,7 @@ struct drm_encoder_helper_funcs {
57561 struct drm_connector *connector);
57562 /* disable encoder when not in use - more explicit than dpms off */
57563 void (*disable)(struct drm_encoder *encoder);
57564 -};
57565 +} __no_const;
57566
57567 struct drm_connector_helper_funcs {
57568 int (*get_modes)(struct drm_connector *connector);
57569 diff -urNp linux-3.0.9/include/drm/drmP.h linux-3.0.9/include/drm/drmP.h
57570 --- linux-3.0.9/include/drm/drmP.h 2011-11-11 13:12:24.000000000 -0500
57571 +++ linux-3.0.9/include/drm/drmP.h 2011-11-15 20:02:59.000000000 -0500
57572 @@ -73,6 +73,7 @@
57573 #include <linux/workqueue.h>
57574 #include <linux/poll.h>
57575 #include <asm/pgalloc.h>
57576 +#include <asm/local.h>
57577 #include "drm.h"
57578
57579 #include <linux/idr.h>
57580 @@ -1033,7 +1034,7 @@ struct drm_device {
57581
57582 /** \name Usage Counters */
57583 /*@{ */
57584 - int open_count; /**< Outstanding files open */
57585 + local_t open_count; /**< Outstanding files open */
57586 atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
57587 atomic_t vma_count; /**< Outstanding vma areas open */
57588 int buf_use; /**< Buffers in use -- cannot alloc */
57589 @@ -1044,7 +1045,7 @@ struct drm_device {
57590 /*@{ */
57591 unsigned long counters;
57592 enum drm_stat_type types[15];
57593 - atomic_t counts[15];
57594 + atomic_unchecked_t counts[15];
57595 /*@} */
57596
57597 struct list_head filelist;
57598 diff -urNp linux-3.0.9/include/drm/ttm/ttm_memory.h linux-3.0.9/include/drm/ttm/ttm_memory.h
57599 --- linux-3.0.9/include/drm/ttm/ttm_memory.h 2011-11-11 13:12:24.000000000 -0500
57600 +++ linux-3.0.9/include/drm/ttm/ttm_memory.h 2011-11-15 20:02:59.000000000 -0500
57601 @@ -47,7 +47,7 @@
57602
57603 struct ttm_mem_shrink {
57604 int (*do_shrink) (struct ttm_mem_shrink *);
57605 -};
57606 +} __no_const;
57607
57608 /**
57609 * struct ttm_mem_global - Global memory accounting structure.
57610 diff -urNp linux-3.0.9/include/linux/a.out.h linux-3.0.9/include/linux/a.out.h
57611 --- linux-3.0.9/include/linux/a.out.h 2011-11-11 13:12:24.000000000 -0500
57612 +++ linux-3.0.9/include/linux/a.out.h 2011-11-15 20:02:59.000000000 -0500
57613 @@ -39,6 +39,14 @@ enum machine_type {
57614 M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
57615 };
57616
57617 +/* Constants for the N_FLAGS field */
57618 +#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
57619 +#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
57620 +#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
57621 +#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
57622 +/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
57623 +#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
57624 +
57625 #if !defined (N_MAGIC)
57626 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
57627 #endif
57628 diff -urNp linux-3.0.9/include/linux/atmdev.h linux-3.0.9/include/linux/atmdev.h
57629 --- linux-3.0.9/include/linux/atmdev.h 2011-11-11 13:12:24.000000000 -0500
57630 +++ linux-3.0.9/include/linux/atmdev.h 2011-11-15 20:02:59.000000000 -0500
57631 @@ -237,7 +237,7 @@ struct compat_atm_iobuf {
57632 #endif
57633
57634 struct k_atm_aal_stats {
57635 -#define __HANDLE_ITEM(i) atomic_t i
57636 +#define __HANDLE_ITEM(i) atomic_unchecked_t i
57637 __AAL_STAT_ITEMS
57638 #undef __HANDLE_ITEM
57639 };
57640 diff -urNp linux-3.0.9/include/linux/binfmts.h linux-3.0.9/include/linux/binfmts.h
57641 --- linux-3.0.9/include/linux/binfmts.h 2011-11-11 13:12:24.000000000 -0500
57642 +++ linux-3.0.9/include/linux/binfmts.h 2011-11-15 20:02:59.000000000 -0500
57643 @@ -88,6 +88,7 @@ struct linux_binfmt {
57644 int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
57645 int (*load_shlib)(struct file *);
57646 int (*core_dump)(struct coredump_params *cprm);
57647 + void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
57648 unsigned long min_coredump; /* minimal dump size */
57649 };
57650
57651 diff -urNp linux-3.0.9/include/linux/blkdev.h linux-3.0.9/include/linux/blkdev.h
57652 --- linux-3.0.9/include/linux/blkdev.h 2011-11-11 13:12:24.000000000 -0500
57653 +++ linux-3.0.9/include/linux/blkdev.h 2011-11-15 20:02:59.000000000 -0500
57654 @@ -1308,7 +1308,7 @@ struct block_device_operations {
57655 /* this callback is with swap_lock and sometimes page table lock held */
57656 void (*swap_slot_free_notify) (struct block_device *, unsigned long);
57657 struct module *owner;
57658 -};
57659 +} __do_const;
57660
57661 extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
57662 unsigned long);
57663 diff -urNp linux-3.0.9/include/linux/blktrace_api.h linux-3.0.9/include/linux/blktrace_api.h
57664 --- linux-3.0.9/include/linux/blktrace_api.h 2011-11-11 13:12:24.000000000 -0500
57665 +++ linux-3.0.9/include/linux/blktrace_api.h 2011-11-15 20:02:59.000000000 -0500
57666 @@ -161,7 +161,7 @@ struct blk_trace {
57667 struct dentry *dir;
57668 struct dentry *dropped_file;
57669 struct dentry *msg_file;
57670 - atomic_t dropped;
57671 + atomic_unchecked_t dropped;
57672 };
57673
57674 extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
57675 diff -urNp linux-3.0.9/include/linux/byteorder/little_endian.h linux-3.0.9/include/linux/byteorder/little_endian.h
57676 --- linux-3.0.9/include/linux/byteorder/little_endian.h 2011-11-11 13:12:24.000000000 -0500
57677 +++ linux-3.0.9/include/linux/byteorder/little_endian.h 2011-11-15 20:02:59.000000000 -0500
57678 @@ -42,51 +42,51 @@
57679
57680 static inline __le64 __cpu_to_le64p(const __u64 *p)
57681 {
57682 - return (__force __le64)*p;
57683 + return (__force const __le64)*p;
57684 }
57685 static inline __u64 __le64_to_cpup(const __le64 *p)
57686 {
57687 - return (__force __u64)*p;
57688 + return (__force const __u64)*p;
57689 }
57690 static inline __le32 __cpu_to_le32p(const __u32 *p)
57691 {
57692 - return (__force __le32)*p;
57693 + return (__force const __le32)*p;
57694 }
57695 static inline __u32 __le32_to_cpup(const __le32 *p)
57696 {
57697 - return (__force __u32)*p;
57698 + return (__force const __u32)*p;
57699 }
57700 static inline __le16 __cpu_to_le16p(const __u16 *p)
57701 {
57702 - return (__force __le16)*p;
57703 + return (__force const __le16)*p;
57704 }
57705 static inline __u16 __le16_to_cpup(const __le16 *p)
57706 {
57707 - return (__force __u16)*p;
57708 + return (__force const __u16)*p;
57709 }
57710 static inline __be64 __cpu_to_be64p(const __u64 *p)
57711 {
57712 - return (__force __be64)__swab64p(p);
57713 + return (__force const __be64)__swab64p(p);
57714 }
57715 static inline __u64 __be64_to_cpup(const __be64 *p)
57716 {
57717 - return __swab64p((__u64 *)p);
57718 + return __swab64p((const __u64 *)p);
57719 }
57720 static inline __be32 __cpu_to_be32p(const __u32 *p)
57721 {
57722 - return (__force __be32)__swab32p(p);
57723 + return (__force const __be32)__swab32p(p);
57724 }
57725 static inline __u32 __be32_to_cpup(const __be32 *p)
57726 {
57727 - return __swab32p((__u32 *)p);
57728 + return __swab32p((const __u32 *)p);
57729 }
57730 static inline __be16 __cpu_to_be16p(const __u16 *p)
57731 {
57732 - return (__force __be16)__swab16p(p);
57733 + return (__force const __be16)__swab16p(p);
57734 }
57735 static inline __u16 __be16_to_cpup(const __be16 *p)
57736 {
57737 - return __swab16p((__u16 *)p);
57738 + return __swab16p((const __u16 *)p);
57739 }
57740 #define __cpu_to_le64s(x) do { (void)(x); } while (0)
57741 #define __le64_to_cpus(x) do { (void)(x); } while (0)
57742 diff -urNp linux-3.0.9/include/linux/cache.h linux-3.0.9/include/linux/cache.h
57743 --- linux-3.0.9/include/linux/cache.h 2011-11-11 13:12:24.000000000 -0500
57744 +++ linux-3.0.9/include/linux/cache.h 2011-11-15 20:02:59.000000000 -0500
57745 @@ -16,6 +16,10 @@
57746 #define __read_mostly
57747 #endif
57748
57749 +#ifndef __read_only
57750 +#define __read_only __read_mostly
57751 +#endif
57752 +
57753 #ifndef ____cacheline_aligned
57754 #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
57755 #endif
57756 diff -urNp linux-3.0.9/include/linux/capability.h linux-3.0.9/include/linux/capability.h
57757 --- linux-3.0.9/include/linux/capability.h 2011-11-11 13:12:24.000000000 -0500
57758 +++ linux-3.0.9/include/linux/capability.h 2011-11-15 20:02:59.000000000 -0500
57759 @@ -547,6 +547,9 @@ extern bool capable(int cap);
57760 extern bool ns_capable(struct user_namespace *ns, int cap);
57761 extern bool task_ns_capable(struct task_struct *t, int cap);
57762 extern bool nsown_capable(int cap);
57763 +extern bool task_ns_capable_nolog(struct task_struct *t, int cap);
57764 +extern bool ns_capable_nolog(struct user_namespace *ns, int cap);
57765 +extern bool capable_nolog(int cap);
57766
57767 /* audit system wants to get cap info from files as well */
57768 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
57769 diff -urNp linux-3.0.9/include/linux/cleancache.h linux-3.0.9/include/linux/cleancache.h
57770 --- linux-3.0.9/include/linux/cleancache.h 2011-11-11 13:12:24.000000000 -0500
57771 +++ linux-3.0.9/include/linux/cleancache.h 2011-11-15 20:02:59.000000000 -0500
57772 @@ -31,7 +31,7 @@ struct cleancache_ops {
57773 void (*flush_page)(int, struct cleancache_filekey, pgoff_t);
57774 void (*flush_inode)(int, struct cleancache_filekey);
57775 void (*flush_fs)(int);
57776 -};
57777 +} __no_const;
57778
57779 extern struct cleancache_ops
57780 cleancache_register_ops(struct cleancache_ops *ops);
57781 diff -urNp linux-3.0.9/include/linux/compiler-gcc4.h linux-3.0.9/include/linux/compiler-gcc4.h
57782 --- linux-3.0.9/include/linux/compiler-gcc4.h 2011-11-11 13:12:24.000000000 -0500
57783 +++ linux-3.0.9/include/linux/compiler-gcc4.h 2011-11-15 20:02:59.000000000 -0500
57784 @@ -31,6 +31,12 @@
57785
57786
57787 #if __GNUC_MINOR__ >= 5
57788 +
57789 +#ifdef CONSTIFY_PLUGIN
57790 +#define __no_const __attribute__((no_const))
57791 +#define __do_const __attribute__((do_const))
57792 +#endif
57793 +
57794 /*
57795 * Mark a position in code as unreachable. This can be used to
57796 * suppress control flow warnings after asm blocks that transfer
57797 @@ -46,6 +52,11 @@
57798 #define __noclone __attribute__((__noclone__))
57799
57800 #endif
57801 +
57802 +#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
57803 +#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
57804 +#define __bos0(ptr) __bos((ptr), 0)
57805 +#define __bos1(ptr) __bos((ptr), 1)
57806 #endif
57807
57808 #if __GNUC_MINOR__ > 0
57809 diff -urNp linux-3.0.9/include/linux/compiler.h linux-3.0.9/include/linux/compiler.h
57810 --- linux-3.0.9/include/linux/compiler.h 2011-11-11 13:12:24.000000000 -0500
57811 +++ linux-3.0.9/include/linux/compiler.h 2011-11-15 20:02:59.000000000 -0500
57812 @@ -5,31 +5,62 @@
57813
57814 #ifdef __CHECKER__
57815 # define __user __attribute__((noderef, address_space(1)))
57816 +# define __force_user __force __user
57817 # define __kernel __attribute__((address_space(0)))
57818 +# define __force_kernel __force __kernel
57819 # define __safe __attribute__((safe))
57820 # define __force __attribute__((force))
57821 # define __nocast __attribute__((nocast))
57822 # define __iomem __attribute__((noderef, address_space(2)))
57823 +# define __force_iomem __force __iomem
57824 # define __acquires(x) __attribute__((context(x,0,1)))
57825 # define __releases(x) __attribute__((context(x,1,0)))
57826 # define __acquire(x) __context__(x,1)
57827 # define __release(x) __context__(x,-1)
57828 # define __cond_lock(x,c) ((c) ? ({ __acquire(x); 1; }) : 0)
57829 # define __percpu __attribute__((noderef, address_space(3)))
57830 +# define __force_percpu __force __percpu
57831 #ifdef CONFIG_SPARSE_RCU_POINTER
57832 # define __rcu __attribute__((noderef, address_space(4)))
57833 +# define __force_rcu __force __rcu
57834 #else
57835 # define __rcu
57836 +# define __force_rcu
57837 #endif
57838 extern void __chk_user_ptr(const volatile void __user *);
57839 extern void __chk_io_ptr(const volatile void __iomem *);
57840 +#elif defined(CHECKER_PLUGIN)
57841 +//# define __user
57842 +//# define __force_user
57843 +//# define __kernel
57844 +//# define __force_kernel
57845 +# define __safe
57846 +# define __force
57847 +# define __nocast
57848 +# define __iomem
57849 +# define __force_iomem
57850 +# define __chk_user_ptr(x) (void)0
57851 +# define __chk_io_ptr(x) (void)0
57852 +# define __builtin_warning(x, y...) (1)
57853 +# define __acquires(x)
57854 +# define __releases(x)
57855 +# define __acquire(x) (void)0
57856 +# define __release(x) (void)0
57857 +# define __cond_lock(x,c) (c)
57858 +# define __percpu
57859 +# define __force_percpu
57860 +# define __rcu
57861 +# define __force_rcu
57862 #else
57863 # define __user
57864 +# define __force_user
57865 # define __kernel
57866 +# define __force_kernel
57867 # define __safe
57868 # define __force
57869 # define __nocast
57870 # define __iomem
57871 +# define __force_iomem
57872 # define __chk_user_ptr(x) (void)0
57873 # define __chk_io_ptr(x) (void)0
57874 # define __builtin_warning(x, y...) (1)
57875 @@ -39,7 +70,9 @@ extern void __chk_io_ptr(const volatile
57876 # define __release(x) (void)0
57877 # define __cond_lock(x,c) (c)
57878 # define __percpu
57879 +# define __force_percpu
57880 # define __rcu
57881 +# define __force_rcu
57882 #endif
57883
57884 #ifdef __KERNEL__
57885 @@ -264,6 +297,14 @@ void ftrace_likely_update(struct ftrace_
57886 # define __attribute_const__ /* unimplemented */
57887 #endif
57888
57889 +#ifndef __no_const
57890 +# define __no_const
57891 +#endif
57892 +
57893 +#ifndef __do_const
57894 +# define __do_const
57895 +#endif
57896 +
57897 /*
57898 * Tell gcc if a function is cold. The compiler will assume any path
57899 * directly leading to the call is unlikely.
57900 @@ -273,6 +314,22 @@ void ftrace_likely_update(struct ftrace_
57901 #define __cold
57902 #endif
57903
57904 +#ifndef __alloc_size
57905 +#define __alloc_size(...)
57906 +#endif
57907 +
57908 +#ifndef __bos
57909 +#define __bos(ptr, arg)
57910 +#endif
57911 +
57912 +#ifndef __bos0
57913 +#define __bos0(ptr)
57914 +#endif
57915 +
57916 +#ifndef __bos1
57917 +#define __bos1(ptr)
57918 +#endif
57919 +
57920 /* Simple shorthand for a section definition */
57921 #ifndef __section
57922 # define __section(S) __attribute__ ((__section__(#S)))
57923 @@ -306,6 +363,7 @@ void ftrace_likely_update(struct ftrace_
57924 * use is to mediate communication between process-level code and irq/NMI
57925 * handlers, all running on the same CPU.
57926 */
57927 -#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
57928 +#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
57929 +#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
57930
57931 #endif /* __LINUX_COMPILER_H */
57932 diff -urNp linux-3.0.9/include/linux/cpuset.h linux-3.0.9/include/linux/cpuset.h
57933 --- linux-3.0.9/include/linux/cpuset.h 2011-11-11 13:12:24.000000000 -0500
57934 +++ linux-3.0.9/include/linux/cpuset.h 2011-11-15 20:02:59.000000000 -0500
57935 @@ -118,7 +118,7 @@ static inline void put_mems_allowed(void
57936 * nodemask.
57937 */
57938 smp_mb();
57939 - --ACCESS_ONCE(current->mems_allowed_change_disable);
57940 + --ACCESS_ONCE_RW(current->mems_allowed_change_disable);
57941 }
57942
57943 static inline void set_mems_allowed(nodemask_t nodemask)
57944 diff -urNp linux-3.0.9/include/linux/crypto.h linux-3.0.9/include/linux/crypto.h
57945 --- linux-3.0.9/include/linux/crypto.h 2011-11-11 13:12:24.000000000 -0500
57946 +++ linux-3.0.9/include/linux/crypto.h 2011-11-15 20:02:59.000000000 -0500
57947 @@ -361,7 +361,7 @@ struct cipher_tfm {
57948 const u8 *key, unsigned int keylen);
57949 void (*cit_encrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
57950 void (*cit_decrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
57951 -};
57952 +} __no_const;
57953
57954 struct hash_tfm {
57955 int (*init)(struct hash_desc *desc);
57956 @@ -382,13 +382,13 @@ struct compress_tfm {
57957 int (*cot_decompress)(struct crypto_tfm *tfm,
57958 const u8 *src, unsigned int slen,
57959 u8 *dst, unsigned int *dlen);
57960 -};
57961 +} __no_const;
57962
57963 struct rng_tfm {
57964 int (*rng_gen_random)(struct crypto_rng *tfm, u8 *rdata,
57965 unsigned int dlen);
57966 int (*rng_reset)(struct crypto_rng *tfm, u8 *seed, unsigned int slen);
57967 -};
57968 +} __no_const;
57969
57970 #define crt_ablkcipher crt_u.ablkcipher
57971 #define crt_aead crt_u.aead
57972 diff -urNp linux-3.0.9/include/linux/decompress/mm.h linux-3.0.9/include/linux/decompress/mm.h
57973 --- linux-3.0.9/include/linux/decompress/mm.h 2011-11-11 13:12:24.000000000 -0500
57974 +++ linux-3.0.9/include/linux/decompress/mm.h 2011-11-15 20:02:59.000000000 -0500
57975 @@ -77,7 +77,7 @@ static void free(void *where)
57976 * warnings when not needed (indeed large_malloc / large_free are not
57977 * needed by inflate */
57978
57979 -#define malloc(a) kmalloc(a, GFP_KERNEL)
57980 +#define malloc(a) kmalloc((a), GFP_KERNEL)
57981 #define free(a) kfree(a)
57982
57983 #define large_malloc(a) vmalloc(a)
57984 diff -urNp linux-3.0.9/include/linux/dma-mapping.h linux-3.0.9/include/linux/dma-mapping.h
57985 --- linux-3.0.9/include/linux/dma-mapping.h 2011-11-11 13:12:24.000000000 -0500
57986 +++ linux-3.0.9/include/linux/dma-mapping.h 2011-11-15 20:02:59.000000000 -0500
57987 @@ -50,7 +50,7 @@ struct dma_map_ops {
57988 int (*dma_supported)(struct device *dev, u64 mask);
57989 int (*set_dma_mask)(struct device *dev, u64 mask);
57990 int is_phys;
57991 -};
57992 +} __do_const;
57993
57994 #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
57995
57996 diff -urNp linux-3.0.9/include/linux/efi.h linux-3.0.9/include/linux/efi.h
57997 --- linux-3.0.9/include/linux/efi.h 2011-11-11 13:12:24.000000000 -0500
57998 +++ linux-3.0.9/include/linux/efi.h 2011-11-15 20:02:59.000000000 -0500
57999 @@ -410,7 +410,7 @@ struct efivar_operations {
58000 efi_get_variable_t *get_variable;
58001 efi_get_next_variable_t *get_next_variable;
58002 efi_set_variable_t *set_variable;
58003 -};
58004 +} __no_const;
58005
58006 struct efivars {
58007 /*
58008 diff -urNp linux-3.0.9/include/linux/elf.h linux-3.0.9/include/linux/elf.h
58009 --- linux-3.0.9/include/linux/elf.h 2011-11-11 13:12:24.000000000 -0500
58010 +++ linux-3.0.9/include/linux/elf.h 2011-11-15 20:03:00.000000000 -0500
58011 @@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
58012 #define PT_GNU_EH_FRAME 0x6474e550
58013
58014 #define PT_GNU_STACK (PT_LOOS + 0x474e551)
58015 +#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
58016 +
58017 +#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
58018 +
58019 +/* Constants for the e_flags field */
58020 +#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
58021 +#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
58022 +#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
58023 +#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
58024 +/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
58025 +#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
58026
58027 /*
58028 * Extended Numbering
58029 @@ -106,6 +117,8 @@ typedef __s64 Elf64_Sxword;
58030 #define DT_DEBUG 21
58031 #define DT_TEXTREL 22
58032 #define DT_JMPREL 23
58033 +#define DT_FLAGS 30
58034 + #define DF_TEXTREL 0x00000004
58035 #define DT_ENCODING 32
58036 #define OLD_DT_LOOS 0x60000000
58037 #define DT_LOOS 0x6000000d
58038 @@ -252,6 +265,19 @@ typedef struct elf64_hdr {
58039 #define PF_W 0x2
58040 #define PF_X 0x1
58041
58042 +#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
58043 +#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
58044 +#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
58045 +#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
58046 +#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
58047 +#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
58048 +/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
58049 +/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
58050 +#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
58051 +#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
58052 +#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
58053 +#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
58054 +
58055 typedef struct elf32_phdr{
58056 Elf32_Word p_type;
58057 Elf32_Off p_offset;
58058 @@ -344,6 +370,8 @@ typedef struct elf64_shdr {
58059 #define EI_OSABI 7
58060 #define EI_PAD 8
58061
58062 +#define EI_PAX 14
58063 +
58064 #define ELFMAG0 0x7f /* EI_MAG */
58065 #define ELFMAG1 'E'
58066 #define ELFMAG2 'L'
58067 @@ -422,6 +450,7 @@ extern Elf32_Dyn _DYNAMIC [];
58068 #define elf_note elf32_note
58069 #define elf_addr_t Elf32_Off
58070 #define Elf_Half Elf32_Half
58071 +#define elf_dyn Elf32_Dyn
58072
58073 #else
58074
58075 @@ -432,6 +461,7 @@ extern Elf64_Dyn _DYNAMIC [];
58076 #define elf_note elf64_note
58077 #define elf_addr_t Elf64_Off
58078 #define Elf_Half Elf64_Half
58079 +#define elf_dyn Elf64_Dyn
58080
58081 #endif
58082
58083 diff -urNp linux-3.0.9/include/linux/firewire.h linux-3.0.9/include/linux/firewire.h
58084 --- linux-3.0.9/include/linux/firewire.h 2011-11-11 13:12:24.000000000 -0500
58085 +++ linux-3.0.9/include/linux/firewire.h 2011-11-15 20:03:00.000000000 -0500
58086 @@ -428,7 +428,7 @@ struct fw_iso_context {
58087 union {
58088 fw_iso_callback_t sc;
58089 fw_iso_mc_callback_t mc;
58090 - } callback;
58091 + } __no_const callback;
58092 void *callback_data;
58093 };
58094
58095 diff -urNp linux-3.0.9/include/linux/fscache-cache.h linux-3.0.9/include/linux/fscache-cache.h
58096 --- linux-3.0.9/include/linux/fscache-cache.h 2011-11-11 13:12:24.000000000 -0500
58097 +++ linux-3.0.9/include/linux/fscache-cache.h 2011-11-15 20:03:00.000000000 -0500
58098 @@ -102,7 +102,7 @@ struct fscache_operation {
58099 fscache_operation_release_t release;
58100 };
58101
58102 -extern atomic_t fscache_op_debug_id;
58103 +extern atomic_unchecked_t fscache_op_debug_id;
58104 extern void fscache_op_work_func(struct work_struct *work);
58105
58106 extern void fscache_enqueue_operation(struct fscache_operation *);
58107 @@ -122,7 +122,7 @@ static inline void fscache_operation_ini
58108 {
58109 INIT_WORK(&op->work, fscache_op_work_func);
58110 atomic_set(&op->usage, 1);
58111 - op->debug_id = atomic_inc_return(&fscache_op_debug_id);
58112 + op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
58113 op->processor = processor;
58114 op->release = release;
58115 INIT_LIST_HEAD(&op->pend_link);
58116 diff -urNp linux-3.0.9/include/linux/fs.h linux-3.0.9/include/linux/fs.h
58117 --- linux-3.0.9/include/linux/fs.h 2011-11-11 13:12:24.000000000 -0500
58118 +++ linux-3.0.9/include/linux/fs.h 2011-11-15 20:03:00.000000000 -0500
58119 @@ -109,6 +109,11 @@ struct inodes_stat_t {
58120 /* File was opened by fanotify and shouldn't generate fanotify events */
58121 #define FMODE_NONOTIFY ((__force fmode_t)0x1000000)
58122
58123 +/* Hack for grsec so as not to require read permission simply to execute
58124 + * a binary
58125 + */
58126 +#define FMODE_GREXEC ((__force fmode_t)0x2000000)
58127 +
58128 /*
58129 * The below are the various read and write types that we support. Some of
58130 * them include behavioral modifiers that send information down to the
58131 @@ -1571,7 +1576,8 @@ struct file_operations {
58132 int (*setlease)(struct file *, long, struct file_lock **);
58133 long (*fallocate)(struct file *file, int mode, loff_t offset,
58134 loff_t len);
58135 -};
58136 +} __do_const;
58137 +typedef struct file_operations __no_const file_operations_no_const;
58138
58139 #define IPERM_FLAG_RCU 0x0001
58140
58141 diff -urNp linux-3.0.9/include/linux/fsnotify.h linux-3.0.9/include/linux/fsnotify.h
58142 --- linux-3.0.9/include/linux/fsnotify.h 2011-11-11 13:12:24.000000000 -0500
58143 +++ linux-3.0.9/include/linux/fsnotify.h 2011-11-15 20:03:00.000000000 -0500
58144 @@ -314,7 +314,7 @@ static inline void fsnotify_change(struc
58145 */
58146 static inline const unsigned char *fsnotify_oldname_init(const unsigned char *name)
58147 {
58148 - return kstrdup(name, GFP_KERNEL);
58149 + return (const unsigned char *)kstrdup((const char *)name, GFP_KERNEL);
58150 }
58151
58152 /*
58153 diff -urNp linux-3.0.9/include/linux/fs_struct.h linux-3.0.9/include/linux/fs_struct.h
58154 --- linux-3.0.9/include/linux/fs_struct.h 2011-11-11 13:12:24.000000000 -0500
58155 +++ linux-3.0.9/include/linux/fs_struct.h 2011-11-15 20:03:00.000000000 -0500
58156 @@ -6,7 +6,7 @@
58157 #include <linux/seqlock.h>
58158
58159 struct fs_struct {
58160 - int users;
58161 + atomic_t users;
58162 spinlock_t lock;
58163 seqcount_t seq;
58164 int umask;
58165 diff -urNp linux-3.0.9/include/linux/ftrace_event.h linux-3.0.9/include/linux/ftrace_event.h
58166 --- linux-3.0.9/include/linux/ftrace_event.h 2011-11-11 13:12:24.000000000 -0500
58167 +++ linux-3.0.9/include/linux/ftrace_event.h 2011-11-15 20:03:00.000000000 -0500
58168 @@ -96,7 +96,7 @@ struct trace_event_functions {
58169 trace_print_func raw;
58170 trace_print_func hex;
58171 trace_print_func binary;
58172 -};
58173 +} __no_const;
58174
58175 struct trace_event {
58176 struct hlist_node node;
58177 @@ -247,7 +247,7 @@ extern int trace_define_field(struct ftr
58178 extern int trace_add_event_call(struct ftrace_event_call *call);
58179 extern void trace_remove_event_call(struct ftrace_event_call *call);
58180
58181 -#define is_signed_type(type) (((type)(-1)) < 0)
58182 +#define is_signed_type(type) (((type)(-1)) < (type)1)
58183
58184 int trace_set_clr_event(const char *system, const char *event, int set);
58185
58186 diff -urNp linux-3.0.9/include/linux/genhd.h linux-3.0.9/include/linux/genhd.h
58187 --- linux-3.0.9/include/linux/genhd.h 2011-11-11 13:12:24.000000000 -0500
58188 +++ linux-3.0.9/include/linux/genhd.h 2011-11-15 20:03:00.000000000 -0500
58189 @@ -184,7 +184,7 @@ struct gendisk {
58190 struct kobject *slave_dir;
58191
58192 struct timer_rand_state *random;
58193 - atomic_t sync_io; /* RAID */
58194 + atomic_unchecked_t sync_io; /* RAID */
58195 struct disk_events *ev;
58196 #ifdef CONFIG_BLK_DEV_INTEGRITY
58197 struct blk_integrity *integrity;
58198 diff -urNp linux-3.0.9/include/linux/gracl.h linux-3.0.9/include/linux/gracl.h
58199 --- linux-3.0.9/include/linux/gracl.h 1969-12-31 19:00:00.000000000 -0500
58200 +++ linux-3.0.9/include/linux/gracl.h 2011-11-15 20:03:00.000000000 -0500
58201 @@ -0,0 +1,317 @@
58202 +#ifndef GR_ACL_H
58203 +#define GR_ACL_H
58204 +
58205 +#include <linux/grdefs.h>
58206 +#include <linux/resource.h>
58207 +#include <linux/capability.h>
58208 +#include <linux/dcache.h>
58209 +#include <asm/resource.h>
58210 +
58211 +/* Major status information */
58212 +
58213 +#define GR_VERSION "grsecurity 2.2.2"
58214 +#define GRSECURITY_VERSION 0x2202
58215 +
58216 +enum {
58217 + GR_SHUTDOWN = 0,
58218 + GR_ENABLE = 1,
58219 + GR_SPROLE = 2,
58220 + GR_RELOAD = 3,
58221 + GR_SEGVMOD = 4,
58222 + GR_STATUS = 5,
58223 + GR_UNSPROLE = 6,
58224 + GR_PASSSET = 7,
58225 + GR_SPROLEPAM = 8,
58226 +};
58227 +
58228 +/* Password setup definitions
58229 + * kernel/grhash.c */
58230 +enum {
58231 + GR_PW_LEN = 128,
58232 + GR_SALT_LEN = 16,
58233 + GR_SHA_LEN = 32,
58234 +};
58235 +
58236 +enum {
58237 + GR_SPROLE_LEN = 64,
58238 +};
58239 +
58240 +enum {
58241 + GR_NO_GLOB = 0,
58242 + GR_REG_GLOB,
58243 + GR_CREATE_GLOB
58244 +};
58245 +
58246 +#define GR_NLIMITS 32
58247 +
58248 +/* Begin Data Structures */
58249 +
58250 +struct sprole_pw {
58251 + unsigned char *rolename;
58252 + unsigned char salt[GR_SALT_LEN];
58253 + unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
58254 +};
58255 +
58256 +struct name_entry {
58257 + __u32 key;
58258 + ino_t inode;
58259 + dev_t device;
58260 + char *name;
58261 + __u16 len;
58262 + __u8 deleted;
58263 + struct name_entry *prev;
58264 + struct name_entry *next;
58265 +};
58266 +
58267 +struct inodev_entry {
58268 + struct name_entry *nentry;
58269 + struct inodev_entry *prev;
58270 + struct inodev_entry *next;
58271 +};
58272 +
58273 +struct acl_role_db {
58274 + struct acl_role_label **r_hash;
58275 + __u32 r_size;
58276 +};
58277 +
58278 +struct inodev_db {
58279 + struct inodev_entry **i_hash;
58280 + __u32 i_size;
58281 +};
58282 +
58283 +struct name_db {
58284 + struct name_entry **n_hash;
58285 + __u32 n_size;
58286 +};
58287 +
58288 +struct crash_uid {
58289 + uid_t uid;
58290 + unsigned long expires;
58291 +};
58292 +
58293 +struct gr_hash_struct {
58294 + void **table;
58295 + void **nametable;
58296 + void *first;
58297 + __u32 table_size;
58298 + __u32 used_size;
58299 + int type;
58300 +};
58301 +
58302 +/* Userspace Grsecurity ACL data structures */
58303 +
58304 +struct acl_subject_label {
58305 + char *filename;
58306 + ino_t inode;
58307 + dev_t device;
58308 + __u32 mode;
58309 + kernel_cap_t cap_mask;
58310 + kernel_cap_t cap_lower;
58311 + kernel_cap_t cap_invert_audit;
58312 +
58313 + struct rlimit res[GR_NLIMITS];
58314 + __u32 resmask;
58315 +
58316 + __u8 user_trans_type;
58317 + __u8 group_trans_type;
58318 + uid_t *user_transitions;
58319 + gid_t *group_transitions;
58320 + __u16 user_trans_num;
58321 + __u16 group_trans_num;
58322 +
58323 + __u32 sock_families[2];
58324 + __u32 ip_proto[8];
58325 + __u32 ip_type;
58326 + struct acl_ip_label **ips;
58327 + __u32 ip_num;
58328 + __u32 inaddr_any_override;
58329 +
58330 + __u32 crashes;
58331 + unsigned long expires;
58332 +
58333 + struct acl_subject_label *parent_subject;
58334 + struct gr_hash_struct *hash;
58335 + struct acl_subject_label *prev;
58336 + struct acl_subject_label *next;
58337 +
58338 + struct acl_object_label **obj_hash;
58339 + __u32 obj_hash_size;
58340 + __u16 pax_flags;
58341 +};
58342 +
58343 +struct role_allowed_ip {
58344 + __u32 addr;
58345 + __u32 netmask;
58346 +
58347 + struct role_allowed_ip *prev;
58348 + struct role_allowed_ip *next;
58349 +};
58350 +
58351 +struct role_transition {
58352 + char *rolename;
58353 +
58354 + struct role_transition *prev;
58355 + struct role_transition *next;
58356 +};
58357 +
58358 +struct acl_role_label {
58359 + char *rolename;
58360 + uid_t uidgid;
58361 + __u16 roletype;
58362 +
58363 + __u16 auth_attempts;
58364 + unsigned long expires;
58365 +
58366 + struct acl_subject_label *root_label;
58367 + struct gr_hash_struct *hash;
58368 +
58369 + struct acl_role_label *prev;
58370 + struct acl_role_label *next;
58371 +
58372 + struct role_transition *transitions;
58373 + struct role_allowed_ip *allowed_ips;
58374 + uid_t *domain_children;
58375 + __u16 domain_child_num;
58376 +
58377 + struct acl_subject_label **subj_hash;
58378 + __u32 subj_hash_size;
58379 +};
58380 +
58381 +struct user_acl_role_db {
58382 + struct acl_role_label **r_table;
58383 + __u32 num_pointers; /* Number of allocations to track */
58384 + __u32 num_roles; /* Number of roles */
58385 + __u32 num_domain_children; /* Number of domain children */
58386 + __u32 num_subjects; /* Number of subjects */
58387 + __u32 num_objects; /* Number of objects */
58388 +};
58389 +
58390 +struct acl_object_label {
58391 + char *filename;
58392 + ino_t inode;
58393 + dev_t device;
58394 + __u32 mode;
58395 +
58396 + struct acl_subject_label *nested;
58397 + struct acl_object_label *globbed;
58398 +
58399 + /* next two structures not used */
58400 +
58401 + struct acl_object_label *prev;
58402 + struct acl_object_label *next;
58403 +};
58404 +
58405 +struct acl_ip_label {
58406 + char *iface;
58407 + __u32 addr;
58408 + __u32 netmask;
58409 + __u16 low, high;
58410 + __u8 mode;
58411 + __u32 type;
58412 + __u32 proto[8];
58413 +
58414 + /* next two structures not used */
58415 +
58416 + struct acl_ip_label *prev;
58417 + struct acl_ip_label *next;
58418 +};
58419 +
58420 +struct gr_arg {
58421 + struct user_acl_role_db role_db;
58422 + unsigned char pw[GR_PW_LEN];
58423 + unsigned char salt[GR_SALT_LEN];
58424 + unsigned char sum[GR_SHA_LEN];
58425 + unsigned char sp_role[GR_SPROLE_LEN];
58426 + struct sprole_pw *sprole_pws;
58427 + dev_t segv_device;
58428 + ino_t segv_inode;
58429 + uid_t segv_uid;
58430 + __u16 num_sprole_pws;
58431 + __u16 mode;
58432 +};
58433 +
58434 +struct gr_arg_wrapper {
58435 + struct gr_arg *arg;
58436 + __u32 version;
58437 + __u32 size;
58438 +};
58439 +
58440 +struct subject_map {
58441 + struct acl_subject_label *user;
58442 + struct acl_subject_label *kernel;
58443 + struct subject_map *prev;
58444 + struct subject_map *next;
58445 +};
58446 +
58447 +struct acl_subj_map_db {
58448 + struct subject_map **s_hash;
58449 + __u32 s_size;
58450 +};
58451 +
58452 +/* End Data Structures Section */
58453 +
58454 +/* Hash functions generated by empirical testing by Brad Spengler
58455 + Makes good use of the low bits of the inode. Generally 0-1 times
58456 + in loop for successful match. 0-3 for unsuccessful match.
58457 + Shift/add algorithm with modulus of table size and an XOR*/
58458 +
58459 +static __inline__ unsigned int
58460 +rhash(const uid_t uid, const __u16 type, const unsigned int sz)
58461 +{
58462 + return ((((uid + type) << (16 + type)) ^ uid) % sz);
58463 +}
58464 +
58465 + static __inline__ unsigned int
58466 +shash(const struct acl_subject_label *userp, const unsigned int sz)
58467 +{
58468 + return ((const unsigned long)userp % sz);
58469 +}
58470 +
58471 +static __inline__ unsigned int
58472 +fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
58473 +{
58474 + return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
58475 +}
58476 +
58477 +static __inline__ unsigned int
58478 +nhash(const char *name, const __u16 len, const unsigned int sz)
58479 +{
58480 + return full_name_hash((const unsigned char *)name, len) % sz;
58481 +}
58482 +
58483 +#define FOR_EACH_ROLE_START(role) \
58484 + role = role_list; \
58485 + while (role) {
58486 +
58487 +#define FOR_EACH_ROLE_END(role) \
58488 + role = role->prev; \
58489 + }
58490 +
58491 +#define FOR_EACH_SUBJECT_START(role,subj,iter) \
58492 + subj = NULL; \
58493 + iter = 0; \
58494 + while (iter < role->subj_hash_size) { \
58495 + if (subj == NULL) \
58496 + subj = role->subj_hash[iter]; \
58497 + if (subj == NULL) { \
58498 + iter++; \
58499 + continue; \
58500 + }
58501 +
58502 +#define FOR_EACH_SUBJECT_END(subj,iter) \
58503 + subj = subj->next; \
58504 + if (subj == NULL) \
58505 + iter++; \
58506 + }
58507 +
58508 +
58509 +#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
58510 + subj = role->hash->first; \
58511 + while (subj != NULL) {
58512 +
58513 +#define FOR_EACH_NESTED_SUBJECT_END(subj) \
58514 + subj = subj->next; \
58515 + }
58516 +
58517 +#endif
58518 +
58519 diff -urNp linux-3.0.9/include/linux/gralloc.h linux-3.0.9/include/linux/gralloc.h
58520 --- linux-3.0.9/include/linux/gralloc.h 1969-12-31 19:00:00.000000000 -0500
58521 +++ linux-3.0.9/include/linux/gralloc.h 2011-11-15 20:03:00.000000000 -0500
58522 @@ -0,0 +1,9 @@
58523 +#ifndef __GRALLOC_H
58524 +#define __GRALLOC_H
58525 +
58526 +void acl_free_all(void);
58527 +int acl_alloc_stack_init(unsigned long size);
58528 +void *acl_alloc(unsigned long len);
58529 +void *acl_alloc_num(unsigned long num, unsigned long len);
58530 +
58531 +#endif
58532 diff -urNp linux-3.0.9/include/linux/grdefs.h linux-3.0.9/include/linux/grdefs.h
58533 --- linux-3.0.9/include/linux/grdefs.h 1969-12-31 19:00:00.000000000 -0500
58534 +++ linux-3.0.9/include/linux/grdefs.h 2011-11-15 20:03:00.000000000 -0500
58535 @@ -0,0 +1,140 @@
58536 +#ifndef GRDEFS_H
58537 +#define GRDEFS_H
58538 +
58539 +/* Begin grsecurity status declarations */
58540 +
58541 +enum {
58542 + GR_READY = 0x01,
58543 + GR_STATUS_INIT = 0x00 // disabled state
58544 +};
58545 +
58546 +/* Begin ACL declarations */
58547 +
58548 +/* Role flags */
58549 +
58550 +enum {
58551 + GR_ROLE_USER = 0x0001,
58552 + GR_ROLE_GROUP = 0x0002,
58553 + GR_ROLE_DEFAULT = 0x0004,
58554 + GR_ROLE_SPECIAL = 0x0008,
58555 + GR_ROLE_AUTH = 0x0010,
58556 + GR_ROLE_NOPW = 0x0020,
58557 + GR_ROLE_GOD = 0x0040,
58558 + GR_ROLE_LEARN = 0x0080,
58559 + GR_ROLE_TPE = 0x0100,
58560 + GR_ROLE_DOMAIN = 0x0200,
58561 + GR_ROLE_PAM = 0x0400,
58562 + GR_ROLE_PERSIST = 0x0800
58563 +};
58564 +
58565 +/* ACL Subject and Object mode flags */
58566 +enum {
58567 + GR_DELETED = 0x80000000
58568 +};
58569 +
58570 +/* ACL Object-only mode flags */
58571 +enum {
58572 + GR_READ = 0x00000001,
58573 + GR_APPEND = 0x00000002,
58574 + GR_WRITE = 0x00000004,
58575 + GR_EXEC = 0x00000008,
58576 + GR_FIND = 0x00000010,
58577 + GR_INHERIT = 0x00000020,
58578 + GR_SETID = 0x00000040,
58579 + GR_CREATE = 0x00000080,
58580 + GR_DELETE = 0x00000100,
58581 + GR_LINK = 0x00000200,
58582 + GR_AUDIT_READ = 0x00000400,
58583 + GR_AUDIT_APPEND = 0x00000800,
58584 + GR_AUDIT_WRITE = 0x00001000,
58585 + GR_AUDIT_EXEC = 0x00002000,
58586 + GR_AUDIT_FIND = 0x00004000,
58587 + GR_AUDIT_INHERIT= 0x00008000,
58588 + GR_AUDIT_SETID = 0x00010000,
58589 + GR_AUDIT_CREATE = 0x00020000,
58590 + GR_AUDIT_DELETE = 0x00040000,
58591 + GR_AUDIT_LINK = 0x00080000,
58592 + GR_PTRACERD = 0x00100000,
58593 + GR_NOPTRACE = 0x00200000,
58594 + GR_SUPPRESS = 0x00400000,
58595 + GR_NOLEARN = 0x00800000,
58596 + GR_INIT_TRANSFER= 0x01000000
58597 +};
58598 +
58599 +#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
58600 + GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
58601 + GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
58602 +
58603 +/* ACL subject-only mode flags */
58604 +enum {
58605 + GR_KILL = 0x00000001,
58606 + GR_VIEW = 0x00000002,
58607 + GR_PROTECTED = 0x00000004,
58608 + GR_LEARN = 0x00000008,
58609 + GR_OVERRIDE = 0x00000010,
58610 + /* just a placeholder, this mode is only used in userspace */
58611 + GR_DUMMY = 0x00000020,
58612 + GR_PROTSHM = 0x00000040,
58613 + GR_KILLPROC = 0x00000080,
58614 + GR_KILLIPPROC = 0x00000100,
58615 + /* just a placeholder, this mode is only used in userspace */
58616 + GR_NOTROJAN = 0x00000200,
58617 + GR_PROTPROCFD = 0x00000400,
58618 + GR_PROCACCT = 0x00000800,
58619 + GR_RELAXPTRACE = 0x00001000,
58620 + GR_NESTED = 0x00002000,
58621 + GR_INHERITLEARN = 0x00004000,
58622 + GR_PROCFIND = 0x00008000,
58623 + GR_POVERRIDE = 0x00010000,
58624 + GR_KERNELAUTH = 0x00020000,
58625 + GR_ATSECURE = 0x00040000,
58626 + GR_SHMEXEC = 0x00080000
58627 +};
58628 +
58629 +enum {
58630 + GR_PAX_ENABLE_SEGMEXEC = 0x0001,
58631 + GR_PAX_ENABLE_PAGEEXEC = 0x0002,
58632 + GR_PAX_ENABLE_MPROTECT = 0x0004,
58633 + GR_PAX_ENABLE_RANDMMAP = 0x0008,
58634 + GR_PAX_ENABLE_EMUTRAMP = 0x0010,
58635 + GR_PAX_DISABLE_SEGMEXEC = 0x0100,
58636 + GR_PAX_DISABLE_PAGEEXEC = 0x0200,
58637 + GR_PAX_DISABLE_MPROTECT = 0x0400,
58638 + GR_PAX_DISABLE_RANDMMAP = 0x0800,
58639 + GR_PAX_DISABLE_EMUTRAMP = 0x1000,
58640 +};
58641 +
58642 +enum {
58643 + GR_ID_USER = 0x01,
58644 + GR_ID_GROUP = 0x02,
58645 +};
58646 +
58647 +enum {
58648 + GR_ID_ALLOW = 0x01,
58649 + GR_ID_DENY = 0x02,
58650 +};
58651 +
58652 +#define GR_CRASH_RES 31
58653 +#define GR_UIDTABLE_MAX 500
58654 +
58655 +/* begin resource learning section */
58656 +enum {
58657 + GR_RLIM_CPU_BUMP = 60,
58658 + GR_RLIM_FSIZE_BUMP = 50000,
58659 + GR_RLIM_DATA_BUMP = 10000,
58660 + GR_RLIM_STACK_BUMP = 1000,
58661 + GR_RLIM_CORE_BUMP = 10000,
58662 + GR_RLIM_RSS_BUMP = 500000,
58663 + GR_RLIM_NPROC_BUMP = 1,
58664 + GR_RLIM_NOFILE_BUMP = 5,
58665 + GR_RLIM_MEMLOCK_BUMP = 50000,
58666 + GR_RLIM_AS_BUMP = 500000,
58667 + GR_RLIM_LOCKS_BUMP = 2,
58668 + GR_RLIM_SIGPENDING_BUMP = 5,
58669 + GR_RLIM_MSGQUEUE_BUMP = 10000,
58670 + GR_RLIM_NICE_BUMP = 1,
58671 + GR_RLIM_RTPRIO_BUMP = 1,
58672 + GR_RLIM_RTTIME_BUMP = 1000000
58673 +};
58674 +
58675 +#endif
58676 diff -urNp linux-3.0.9/include/linux/grinternal.h linux-3.0.9/include/linux/grinternal.h
58677 --- linux-3.0.9/include/linux/grinternal.h 1969-12-31 19:00:00.000000000 -0500
58678 +++ linux-3.0.9/include/linux/grinternal.h 2011-11-15 20:03:00.000000000 -0500
58679 @@ -0,0 +1,220 @@
58680 +#ifndef __GRINTERNAL_H
58681 +#define __GRINTERNAL_H
58682 +
58683 +#ifdef CONFIG_GRKERNSEC
58684 +
58685 +#include <linux/fs.h>
58686 +#include <linux/mnt_namespace.h>
58687 +#include <linux/nsproxy.h>
58688 +#include <linux/gracl.h>
58689 +#include <linux/grdefs.h>
58690 +#include <linux/grmsg.h>
58691 +
58692 +void gr_add_learn_entry(const char *fmt, ...)
58693 + __attribute__ ((format (printf, 1, 2)));
58694 +__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
58695 + const struct vfsmount *mnt);
58696 +__u32 gr_check_create(const struct dentry *new_dentry,
58697 + const struct dentry *parent,
58698 + const struct vfsmount *mnt, const __u32 mode);
58699 +int gr_check_protected_task(const struct task_struct *task);
58700 +__u32 to_gr_audit(const __u32 reqmode);
58701 +int gr_set_acls(const int type);
58702 +int gr_apply_subject_to_task(struct task_struct *task);
58703 +int gr_acl_is_enabled(void);
58704 +char gr_roletype_to_char(void);
58705 +
58706 +void gr_handle_alertkill(struct task_struct *task);
58707 +char *gr_to_filename(const struct dentry *dentry,
58708 + const struct vfsmount *mnt);
58709 +char *gr_to_filename1(const struct dentry *dentry,
58710 + const struct vfsmount *mnt);
58711 +char *gr_to_filename2(const struct dentry *dentry,
58712 + const struct vfsmount *mnt);
58713 +char *gr_to_filename3(const struct dentry *dentry,
58714 + const struct vfsmount *mnt);
58715 +
58716 +extern int grsec_enable_harden_ptrace;
58717 +extern int grsec_enable_link;
58718 +extern int grsec_enable_fifo;
58719 +extern int grsec_enable_execve;
58720 +extern int grsec_enable_shm;
58721 +extern int grsec_enable_execlog;
58722 +extern int grsec_enable_signal;
58723 +extern int grsec_enable_audit_ptrace;
58724 +extern int grsec_enable_forkfail;
58725 +extern int grsec_enable_time;
58726 +extern int grsec_enable_rofs;
58727 +extern int grsec_enable_chroot_shmat;
58728 +extern int grsec_enable_chroot_mount;
58729 +extern int grsec_enable_chroot_double;
58730 +extern int grsec_enable_chroot_pivot;
58731 +extern int grsec_enable_chroot_chdir;
58732 +extern int grsec_enable_chroot_chmod;
58733 +extern int grsec_enable_chroot_mknod;
58734 +extern int grsec_enable_chroot_fchdir;
58735 +extern int grsec_enable_chroot_nice;
58736 +extern int grsec_enable_chroot_execlog;
58737 +extern int grsec_enable_chroot_caps;
58738 +extern int grsec_enable_chroot_sysctl;
58739 +extern int grsec_enable_chroot_unix;
58740 +extern int grsec_enable_tpe;
58741 +extern int grsec_tpe_gid;
58742 +extern int grsec_enable_tpe_all;
58743 +extern int grsec_enable_tpe_invert;
58744 +extern int grsec_enable_socket_all;
58745 +extern int grsec_socket_all_gid;
58746 +extern int grsec_enable_socket_client;
58747 +extern int grsec_socket_client_gid;
58748 +extern int grsec_enable_socket_server;
58749 +extern int grsec_socket_server_gid;
58750 +extern int grsec_audit_gid;
58751 +extern int grsec_enable_group;
58752 +extern int grsec_enable_audit_textrel;
58753 +extern int grsec_enable_log_rwxmaps;
58754 +extern int grsec_enable_mount;
58755 +extern int grsec_enable_chdir;
58756 +extern int grsec_resource_logging;
58757 +extern int grsec_enable_blackhole;
58758 +extern int grsec_lastack_retries;
58759 +extern int grsec_enable_brute;
58760 +extern int grsec_lock;
58761 +
58762 +extern spinlock_t grsec_alert_lock;
58763 +extern unsigned long grsec_alert_wtime;
58764 +extern unsigned long grsec_alert_fyet;
58765 +
58766 +extern spinlock_t grsec_audit_lock;
58767 +
58768 +extern rwlock_t grsec_exec_file_lock;
58769 +
58770 +#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
58771 + gr_to_filename2((tsk)->exec_file->f_path.dentry, \
58772 + (tsk)->exec_file->f_vfsmnt) : "/")
58773 +
58774 +#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
58775 + gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
58776 + (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
58777 +
58778 +#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
58779 + gr_to_filename((tsk)->exec_file->f_path.dentry, \
58780 + (tsk)->exec_file->f_vfsmnt) : "/")
58781 +
58782 +#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
58783 + gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
58784 + (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
58785 +
58786 +#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
58787 +
58788 +#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
58789 +
58790 +#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
58791 + (task)->pid, (cred)->uid, \
58792 + (cred)->euid, (cred)->gid, (cred)->egid, \
58793 + gr_parent_task_fullpath(task), \
58794 + (task)->real_parent->comm, (task)->real_parent->pid, \
58795 + (pcred)->uid, (pcred)->euid, \
58796 + (pcred)->gid, (pcred)->egid
58797 +
58798 +#define GR_CHROOT_CAPS {{ \
58799 + CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
58800 + CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
58801 + CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
58802 + CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
58803 + CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
58804 + CAP_TO_MASK(CAP_IPC_OWNER) | CAP_TO_MASK(CAP_SETFCAP), \
58805 + CAP_TO_MASK(CAP_SYSLOG) | CAP_TO_MASK(CAP_MAC_ADMIN) }}
58806 +
58807 +#define security_learn(normal_msg,args...) \
58808 +({ \
58809 + read_lock(&grsec_exec_file_lock); \
58810 + gr_add_learn_entry(normal_msg "\n", ## args); \
58811 + read_unlock(&grsec_exec_file_lock); \
58812 +})
58813 +
58814 +enum {
58815 + GR_DO_AUDIT,
58816 + GR_DONT_AUDIT,
58817 + /* used for non-audit messages that we shouldn't kill the task on */
58818 + GR_DONT_AUDIT_GOOD
58819 +};
58820 +
58821 +enum {
58822 + GR_TTYSNIFF,
58823 + GR_RBAC,
58824 + GR_RBAC_STR,
58825 + GR_STR_RBAC,
58826 + GR_RBAC_MODE2,
58827 + GR_RBAC_MODE3,
58828 + GR_FILENAME,
58829 + GR_SYSCTL_HIDDEN,
58830 + GR_NOARGS,
58831 + GR_ONE_INT,
58832 + GR_ONE_INT_TWO_STR,
58833 + GR_ONE_STR,
58834 + GR_STR_INT,
58835 + GR_TWO_STR_INT,
58836 + GR_TWO_INT,
58837 + GR_TWO_U64,
58838 + GR_THREE_INT,
58839 + GR_FIVE_INT_TWO_STR,
58840 + GR_TWO_STR,
58841 + GR_THREE_STR,
58842 + GR_FOUR_STR,
58843 + GR_STR_FILENAME,
58844 + GR_FILENAME_STR,
58845 + GR_FILENAME_TWO_INT,
58846 + GR_FILENAME_TWO_INT_STR,
58847 + GR_TEXTREL,
58848 + GR_PTRACE,
58849 + GR_RESOURCE,
58850 + GR_CAP,
58851 + GR_SIG,
58852 + GR_SIG2,
58853 + GR_CRASH1,
58854 + GR_CRASH2,
58855 + GR_PSACCT,
58856 + GR_RWXMAP
58857 +};
58858 +
58859 +#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
58860 +#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
58861 +#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
58862 +#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
58863 +#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
58864 +#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
58865 +#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
58866 +#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
58867 +#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
58868 +#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
58869 +#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
58870 +#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
58871 +#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
58872 +#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
58873 +#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
58874 +#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
58875 +#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
58876 +#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
58877 +#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
58878 +#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
58879 +#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
58880 +#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
58881 +#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
58882 +#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
58883 +#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
58884 +#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
58885 +#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
58886 +#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
58887 +#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
58888 +#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
58889 +#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
58890 +#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
58891 +#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
58892 +#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
58893 +#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
58894 +
58895 +void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
58896 +
58897 +#endif
58898 +
58899 +#endif
58900 diff -urNp linux-3.0.9/include/linux/grmsg.h linux-3.0.9/include/linux/grmsg.h
58901 --- linux-3.0.9/include/linux/grmsg.h 1969-12-31 19:00:00.000000000 -0500
58902 +++ linux-3.0.9/include/linux/grmsg.h 2011-11-15 20:03:00.000000000 -0500
58903 @@ -0,0 +1,108 @@
58904 +#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
58905 +#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
58906 +#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
58907 +#define GR_STOPMOD_MSG "denied modification of module state by "
58908 +#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
58909 +#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
58910 +#define GR_IOPERM_MSG "denied use of ioperm() by "
58911 +#define GR_IOPL_MSG "denied use of iopl() by "
58912 +#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
58913 +#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
58914 +#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
58915 +#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
58916 +#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
58917 +#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
58918 +#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
58919 +#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
58920 +#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
58921 +#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
58922 +#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
58923 +#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
58924 +#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
58925 +#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
58926 +#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
58927 +#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
58928 +#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
58929 +#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
58930 +#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
58931 +#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
58932 +#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
58933 +#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
58934 +#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
58935 +#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
58936 +#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
58937 +#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
58938 +#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
58939 +#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
58940 +#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
58941 +#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
58942 +#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
58943 +#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
58944 +#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
58945 +#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
58946 +#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
58947 +#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
58948 +#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
58949 +#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
58950 +#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
58951 +#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
58952 +#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
58953 +#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
58954 +#define GR_INITF_ACL_MSG "init_variables() failed %s by "
58955 +#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
58956 +#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
58957 +#define GR_SHUTS_ACL_MSG "shutdown auth success for "
58958 +#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
58959 +#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
58960 +#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
58961 +#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
58962 +#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
58963 +#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
58964 +#define GR_ENABLEF_ACL_MSG "unable to load %s for "
58965 +#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
58966 +#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
58967 +#define GR_RELOADF_ACL_MSG "failed reload of %s for "
58968 +#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
58969 +#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
58970 +#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
58971 +#define GR_SPROLEF_ACL_MSG "special role %s failure for "
58972 +#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
58973 +#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
58974 +#define GR_INVMODE_ACL_MSG "invalid mode %d by "
58975 +#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
58976 +#define GR_FAILFORK_MSG "failed fork with errno %s by "
58977 +#define GR_NICE_CHROOT_MSG "denied priority change by "
58978 +#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
58979 +#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
58980 +#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
58981 +#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
58982 +#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
58983 +#define GR_TIME_MSG "time set by "
58984 +#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
58985 +#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
58986 +#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
58987 +#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
58988 +#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
58989 +#define GR_BIND_MSG "denied bind() by "
58990 +#define GR_CONNECT_MSG "denied connect() by "
58991 +#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
58992 +#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
58993 +#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
58994 +#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
58995 +#define GR_CAP_ACL_MSG "use of %s denied for "
58996 +#define GR_CAP_CHROOT_MSG "use of %s in chroot denied for "
58997 +#define GR_CAP_ACL_MSG2 "use of %s permitted for "
58998 +#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
58999 +#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
59000 +#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
59001 +#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
59002 +#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
59003 +#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
59004 +#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
59005 +#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
59006 +#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
59007 +#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
59008 +#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
59009 +#define GR_VM86_MSG "denied use of vm86 by "
59010 +#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
59011 +#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
59012 diff -urNp linux-3.0.9/include/linux/grsecurity.h linux-3.0.9/include/linux/grsecurity.h
59013 --- linux-3.0.9/include/linux/grsecurity.h 1969-12-31 19:00:00.000000000 -0500
59014 +++ linux-3.0.9/include/linux/grsecurity.h 2011-11-15 20:03:00.000000000 -0500
59015 @@ -0,0 +1,228 @@
59016 +#ifndef GR_SECURITY_H
59017 +#define GR_SECURITY_H
59018 +#include <linux/fs.h>
59019 +#include <linux/fs_struct.h>
59020 +#include <linux/binfmts.h>
59021 +#include <linux/gracl.h>
59022 +
59023 +/* notify of brain-dead configs */
59024 +#if defined(CONFIG_GRKERNSEC_PROC_USER) && defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
59025 +#error "CONFIG_GRKERNSEC_PROC_USER and CONFIG_GRKERNSEC_PROC_USERGROUP cannot both be enabled."
59026 +#endif
59027 +#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
59028 +#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
59029 +#endif
59030 +#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
59031 +#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
59032 +#endif
59033 +#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
59034 +#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
59035 +#endif
59036 +#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
59037 +#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
59038 +#endif
59039 +#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
59040 +#error "CONFIG_PAX enabled, but no PaX options are enabled."
59041 +#endif
59042 +
59043 +#include <linux/compat.h>
59044 +
59045 +struct user_arg_ptr {
59046 +#ifdef CONFIG_COMPAT
59047 + bool is_compat;
59048 +#endif
59049 + union {
59050 + const char __user *const __user *native;
59051 +#ifdef CONFIG_COMPAT
59052 + compat_uptr_t __user *compat;
59053 +#endif
59054 + } ptr;
59055 +};
59056 +
59057 +void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
59058 +void gr_handle_brute_check(void);
59059 +void gr_handle_kernel_exploit(void);
59060 +int gr_process_user_ban(void);
59061 +
59062 +char gr_roletype_to_char(void);
59063 +
59064 +int gr_acl_enable_at_secure(void);
59065 +
59066 +int gr_check_user_change(int real, int effective, int fs);
59067 +int gr_check_group_change(int real, int effective, int fs);
59068 +
59069 +void gr_del_task_from_ip_table(struct task_struct *p);
59070 +
59071 +int gr_pid_is_chrooted(struct task_struct *p);
59072 +int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
59073 +int gr_handle_chroot_nice(void);
59074 +int gr_handle_chroot_sysctl(const int op);
59075 +int gr_handle_chroot_setpriority(struct task_struct *p,
59076 + const int niceval);
59077 +int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
59078 +int gr_handle_chroot_chroot(const struct dentry *dentry,
59079 + const struct vfsmount *mnt);
59080 +void gr_handle_chroot_chdir(struct path *path);
59081 +int gr_handle_chroot_chmod(const struct dentry *dentry,
59082 + const struct vfsmount *mnt, const int mode);
59083 +int gr_handle_chroot_mknod(const struct dentry *dentry,
59084 + const struct vfsmount *mnt, const int mode);
59085 +int gr_handle_chroot_mount(const struct dentry *dentry,
59086 + const struct vfsmount *mnt,
59087 + const char *dev_name);
59088 +int gr_handle_chroot_pivot(void);
59089 +int gr_handle_chroot_unix(const pid_t pid);
59090 +
59091 +int gr_handle_rawio(const struct inode *inode);
59092 +
59093 +void gr_handle_ioperm(void);
59094 +void gr_handle_iopl(void);
59095 +
59096 +int gr_tpe_allow(const struct file *file);
59097 +
59098 +void gr_set_chroot_entries(struct task_struct *task, struct path *path);
59099 +void gr_clear_chroot_entries(struct task_struct *task);
59100 +
59101 +void gr_log_forkfail(const int retval);
59102 +void gr_log_timechange(void);
59103 +void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
59104 +void gr_log_chdir(const struct dentry *dentry,
59105 + const struct vfsmount *mnt);
59106 +void gr_log_chroot_exec(const struct dentry *dentry,
59107 + const struct vfsmount *mnt);
59108 +void gr_handle_exec_args(struct linux_binprm *bprm, struct user_arg_ptr argv);
59109 +void gr_log_remount(const char *devname, const int retval);
59110 +void gr_log_unmount(const char *devname, const int retval);
59111 +void gr_log_mount(const char *from, const char *to, const int retval);
59112 +void gr_log_textrel(struct vm_area_struct *vma);
59113 +void gr_log_rwxmmap(struct file *file);
59114 +void gr_log_rwxmprotect(struct file *file);
59115 +
59116 +int gr_handle_follow_link(const struct inode *parent,
59117 + const struct inode *inode,
59118 + const struct dentry *dentry,
59119 + const struct vfsmount *mnt);
59120 +int gr_handle_fifo(const struct dentry *dentry,
59121 + const struct vfsmount *mnt,
59122 + const struct dentry *dir, const int flag,
59123 + const int acc_mode);
59124 +int gr_handle_hardlink(const struct dentry *dentry,
59125 + const struct vfsmount *mnt,
59126 + struct inode *inode,
59127 + const int mode, const char *to);
59128 +
59129 +int gr_is_capable(const int cap);
59130 +int gr_is_capable_nolog(const int cap);
59131 +void gr_learn_resource(const struct task_struct *task, const int limit,
59132 + const unsigned long wanted, const int gt);
59133 +void gr_copy_label(struct task_struct *tsk);
59134 +void gr_handle_crash(struct task_struct *task, const int sig);
59135 +int gr_handle_signal(const struct task_struct *p, const int sig);
59136 +int gr_check_crash_uid(const uid_t uid);
59137 +int gr_check_protected_task(const struct task_struct *task);
59138 +int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
59139 +int gr_acl_handle_mmap(const struct file *file,
59140 + const unsigned long prot);
59141 +int gr_acl_handle_mprotect(const struct file *file,
59142 + const unsigned long prot);
59143 +int gr_check_hidden_task(const struct task_struct *tsk);
59144 +__u32 gr_acl_handle_truncate(const struct dentry *dentry,
59145 + const struct vfsmount *mnt);
59146 +__u32 gr_acl_handle_utime(const struct dentry *dentry,
59147 + const struct vfsmount *mnt);
59148 +__u32 gr_acl_handle_access(const struct dentry *dentry,
59149 + const struct vfsmount *mnt, const int fmode);
59150 +__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
59151 + const struct vfsmount *mnt, mode_t mode);
59152 +__u32 gr_acl_handle_chmod(const struct dentry *dentry,
59153 + const struct vfsmount *mnt, mode_t mode);
59154 +__u32 gr_acl_handle_chown(const struct dentry *dentry,
59155 + const struct vfsmount *mnt);
59156 +__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
59157 + const struct vfsmount *mnt);
59158 +int gr_handle_ptrace(struct task_struct *task, const long request);
59159 +int gr_handle_proc_ptrace(struct task_struct *task);
59160 +__u32 gr_acl_handle_execve(const struct dentry *dentry,
59161 + const struct vfsmount *mnt);
59162 +int gr_check_crash_exec(const struct file *filp);
59163 +int gr_acl_is_enabled(void);
59164 +void gr_set_kernel_label(struct task_struct *task);
59165 +void gr_set_role_label(struct task_struct *task, const uid_t uid,
59166 + const gid_t gid);
59167 +int gr_set_proc_label(const struct dentry *dentry,
59168 + const struct vfsmount *mnt,
59169 + const int unsafe_share);
59170 +__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
59171 + const struct vfsmount *mnt);
59172 +__u32 gr_acl_handle_open(const struct dentry *dentry,
59173 + const struct vfsmount *mnt, const int fmode);
59174 +__u32 gr_acl_handle_creat(const struct dentry *dentry,
59175 + const struct dentry *p_dentry,
59176 + const struct vfsmount *p_mnt, const int fmode,
59177 + const int imode);
59178 +void gr_handle_create(const struct dentry *dentry,
59179 + const struct vfsmount *mnt);
59180 +void gr_handle_proc_create(const struct dentry *dentry,
59181 + const struct inode *inode);
59182 +__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
59183 + const struct dentry *parent_dentry,
59184 + const struct vfsmount *parent_mnt,
59185 + const int mode);
59186 +__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
59187 + const struct dentry *parent_dentry,
59188 + const struct vfsmount *parent_mnt);
59189 +__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
59190 + const struct vfsmount *mnt);
59191 +void gr_handle_delete(const ino_t ino, const dev_t dev);
59192 +__u32 gr_acl_handle_unlink(const struct dentry *dentry,
59193 + const struct vfsmount *mnt);
59194 +__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
59195 + const struct dentry *parent_dentry,
59196 + const struct vfsmount *parent_mnt,
59197 + const char *from);
59198 +__u32 gr_acl_handle_link(const struct dentry *new_dentry,
59199 + const struct dentry *parent_dentry,
59200 + const struct vfsmount *parent_mnt,
59201 + const struct dentry *old_dentry,
59202 + const struct vfsmount *old_mnt, const char *to);
59203 +int gr_acl_handle_rename(struct dentry *new_dentry,
59204 + struct dentry *parent_dentry,
59205 + const struct vfsmount *parent_mnt,
59206 + struct dentry *old_dentry,
59207 + struct inode *old_parent_inode,
59208 + struct vfsmount *old_mnt, const char *newname);
59209 +void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
59210 + struct dentry *old_dentry,
59211 + struct dentry *new_dentry,
59212 + struct vfsmount *mnt, const __u8 replace);
59213 +__u32 gr_check_link(const struct dentry *new_dentry,
59214 + const struct dentry *parent_dentry,
59215 + const struct vfsmount *parent_mnt,
59216 + const struct dentry *old_dentry,
59217 + const struct vfsmount *old_mnt);
59218 +int gr_acl_handle_filldir(const struct file *file, const char *name,
59219 + const unsigned int namelen, const ino_t ino);
59220 +
59221 +__u32 gr_acl_handle_unix(const struct dentry *dentry,
59222 + const struct vfsmount *mnt);
59223 +void gr_acl_handle_exit(void);
59224 +void gr_acl_handle_psacct(struct task_struct *task, const long code);
59225 +int gr_acl_handle_procpidmem(const struct task_struct *task);
59226 +int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
59227 +int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
59228 +void gr_audit_ptrace(struct task_struct *task);
59229 +dev_t gr_get_dev_from_dentry(struct dentry *dentry);
59230 +
59231 +#ifdef CONFIG_GRKERNSEC
59232 +void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
59233 +void gr_handle_vm86(void);
59234 +void gr_handle_mem_readwrite(u64 from, u64 to);
59235 +
59236 +extern int grsec_enable_dmesg;
59237 +extern int grsec_disable_privio;
59238 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
59239 +extern int grsec_enable_chroot_findtask;
59240 +#endif
59241 +#endif
59242 +
59243 +#endif
59244 diff -urNp linux-3.0.9/include/linux/grsock.h linux-3.0.9/include/linux/grsock.h
59245 --- linux-3.0.9/include/linux/grsock.h 1969-12-31 19:00:00.000000000 -0500
59246 +++ linux-3.0.9/include/linux/grsock.h 2011-11-15 20:03:00.000000000 -0500
59247 @@ -0,0 +1,19 @@
59248 +#ifndef __GRSOCK_H
59249 +#define __GRSOCK_H
59250 +
59251 +extern void gr_attach_curr_ip(const struct sock *sk);
59252 +extern int gr_handle_sock_all(const int family, const int type,
59253 + const int protocol);
59254 +extern int gr_handle_sock_server(const struct sockaddr *sck);
59255 +extern int gr_handle_sock_server_other(const struct sock *sck);
59256 +extern int gr_handle_sock_client(const struct sockaddr *sck);
59257 +extern int gr_search_connect(struct socket * sock,
59258 + struct sockaddr_in * addr);
59259 +extern int gr_search_bind(struct socket * sock,
59260 + struct sockaddr_in * addr);
59261 +extern int gr_search_listen(struct socket * sock);
59262 +extern int gr_search_accept(struct socket * sock);
59263 +extern int gr_search_socket(const int domain, const int type,
59264 + const int protocol);
59265 +
59266 +#endif
59267 diff -urNp linux-3.0.9/include/linux/hid.h linux-3.0.9/include/linux/hid.h
59268 --- linux-3.0.9/include/linux/hid.h 2011-11-11 13:12:24.000000000 -0500
59269 +++ linux-3.0.9/include/linux/hid.h 2011-11-15 20:03:00.000000000 -0500
59270 @@ -675,7 +675,7 @@ struct hid_ll_driver {
59271 unsigned int code, int value);
59272
59273 int (*parse)(struct hid_device *hdev);
59274 -};
59275 +} __no_const;
59276
59277 #define PM_HINT_FULLON 1<<5
59278 #define PM_HINT_NORMAL 1<<1
59279 diff -urNp linux-3.0.9/include/linux/highmem.h linux-3.0.9/include/linux/highmem.h
59280 --- linux-3.0.9/include/linux/highmem.h 2011-11-11 13:12:24.000000000 -0500
59281 +++ linux-3.0.9/include/linux/highmem.h 2011-11-15 20:03:00.000000000 -0500
59282 @@ -185,6 +185,18 @@ static inline void clear_highpage(struct
59283 kunmap_atomic(kaddr, KM_USER0);
59284 }
59285
59286 +static inline void sanitize_highpage(struct page *page)
59287 +{
59288 + void *kaddr;
59289 + unsigned long flags;
59290 +
59291 + local_irq_save(flags);
59292 + kaddr = kmap_atomic(page, KM_CLEARPAGE);
59293 + clear_page(kaddr);
59294 + kunmap_atomic(kaddr, KM_CLEARPAGE);
59295 + local_irq_restore(flags);
59296 +}
59297 +
59298 static inline void zero_user_segments(struct page *page,
59299 unsigned start1, unsigned end1,
59300 unsigned start2, unsigned end2)
59301 diff -urNp linux-3.0.9/include/linux/i2c.h linux-3.0.9/include/linux/i2c.h
59302 --- linux-3.0.9/include/linux/i2c.h 2011-11-11 13:12:24.000000000 -0500
59303 +++ linux-3.0.9/include/linux/i2c.h 2011-11-15 20:03:00.000000000 -0500
59304 @@ -346,6 +346,7 @@ struct i2c_algorithm {
59305 /* To determine what the adapter supports */
59306 u32 (*functionality) (struct i2c_adapter *);
59307 };
59308 +typedef struct i2c_algorithm __no_const i2c_algorithm_no_const;
59309
59310 /*
59311 * i2c_adapter is the structure used to identify a physical i2c bus along
59312 diff -urNp linux-3.0.9/include/linux/i2o.h linux-3.0.9/include/linux/i2o.h
59313 --- linux-3.0.9/include/linux/i2o.h 2011-11-11 13:12:24.000000000 -0500
59314 +++ linux-3.0.9/include/linux/i2o.h 2011-11-15 20:03:00.000000000 -0500
59315 @@ -564,7 +564,7 @@ struct i2o_controller {
59316 struct i2o_device *exec; /* Executive */
59317 #if BITS_PER_LONG == 64
59318 spinlock_t context_list_lock; /* lock for context_list */
59319 - atomic_t context_list_counter; /* needed for unique contexts */
59320 + atomic_unchecked_t context_list_counter; /* needed for unique contexts */
59321 struct list_head context_list; /* list of context id's
59322 and pointers */
59323 #endif
59324 diff -urNp linux-3.0.9/include/linux/init.h linux-3.0.9/include/linux/init.h
59325 --- linux-3.0.9/include/linux/init.h 2011-11-11 13:12:24.000000000 -0500
59326 +++ linux-3.0.9/include/linux/init.h 2011-11-15 20:03:00.000000000 -0500
59327 @@ -293,13 +293,13 @@ void __init parse_early_options(char *cm
59328
59329 /* Each module must use one module_init(). */
59330 #define module_init(initfn) \
59331 - static inline initcall_t __inittest(void) \
59332 + static inline __used initcall_t __inittest(void) \
59333 { return initfn; } \
59334 int init_module(void) __attribute__((alias(#initfn)));
59335
59336 /* This is only required if you want to be unloadable. */
59337 #define module_exit(exitfn) \
59338 - static inline exitcall_t __exittest(void) \
59339 + static inline __used exitcall_t __exittest(void) \
59340 { return exitfn; } \
59341 void cleanup_module(void) __attribute__((alias(#exitfn)));
59342
59343 diff -urNp linux-3.0.9/include/linux/init_task.h linux-3.0.9/include/linux/init_task.h
59344 --- linux-3.0.9/include/linux/init_task.h 2011-11-11 13:12:24.000000000 -0500
59345 +++ linux-3.0.9/include/linux/init_task.h 2011-11-15 20:03:00.000000000 -0500
59346 @@ -126,6 +126,12 @@ extern struct cred init_cred;
59347 # define INIT_PERF_EVENTS(tsk)
59348 #endif
59349
59350 +#ifdef CONFIG_X86
59351 +#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
59352 +#else
59353 +#define INIT_TASK_THREAD_INFO
59354 +#endif
59355 +
59356 /*
59357 * INIT_TASK is used to set up the first task table, touch at
59358 * your own risk!. Base=0, limit=0x1fffff (=2MB)
59359 @@ -164,6 +170,7 @@ extern struct cred init_cred;
59360 RCU_INIT_POINTER(.cred, &init_cred), \
59361 .comm = "swapper", \
59362 .thread = INIT_THREAD, \
59363 + INIT_TASK_THREAD_INFO \
59364 .fs = &init_fs, \
59365 .files = &init_files, \
59366 .signal = &init_signals, \
59367 diff -urNp linux-3.0.9/include/linux/intel-iommu.h linux-3.0.9/include/linux/intel-iommu.h
59368 --- linux-3.0.9/include/linux/intel-iommu.h 2011-11-11 13:12:24.000000000 -0500
59369 +++ linux-3.0.9/include/linux/intel-iommu.h 2011-11-15 20:03:00.000000000 -0500
59370 @@ -296,7 +296,7 @@ struct iommu_flush {
59371 u8 fm, u64 type);
59372 void (*flush_iotlb)(struct intel_iommu *iommu, u16 did, u64 addr,
59373 unsigned int size_order, u64 type);
59374 -};
59375 +} __no_const;
59376
59377 enum {
59378 SR_DMAR_FECTL_REG,
59379 diff -urNp linux-3.0.9/include/linux/interrupt.h linux-3.0.9/include/linux/interrupt.h
59380 --- linux-3.0.9/include/linux/interrupt.h 2011-11-11 13:12:24.000000000 -0500
59381 +++ linux-3.0.9/include/linux/interrupt.h 2011-11-15 20:03:00.000000000 -0500
59382 @@ -425,7 +425,7 @@ enum
59383 /* map softirq index to softirq name. update 'softirq_to_name' in
59384 * kernel/softirq.c when adding a new softirq.
59385 */
59386 -extern char *softirq_to_name[NR_SOFTIRQS];
59387 +extern const char * const softirq_to_name[NR_SOFTIRQS];
59388
59389 /* softirq mask and active fields moved to irq_cpustat_t in
59390 * asm/hardirq.h to get better cache usage. KAO
59391 @@ -433,12 +433,12 @@ extern char *softirq_to_name[NR_SOFTIRQS
59392
59393 struct softirq_action
59394 {
59395 - void (*action)(struct softirq_action *);
59396 + void (*action)(void);
59397 };
59398
59399 asmlinkage void do_softirq(void);
59400 asmlinkage void __do_softirq(void);
59401 -extern void open_softirq(int nr, void (*action)(struct softirq_action *));
59402 +extern void open_softirq(int nr, void (*action)(void));
59403 extern void softirq_init(void);
59404 static inline void __raise_softirq_irqoff(unsigned int nr)
59405 {
59406 diff -urNp linux-3.0.9/include/linux/kallsyms.h linux-3.0.9/include/linux/kallsyms.h
59407 --- linux-3.0.9/include/linux/kallsyms.h 2011-11-11 13:12:24.000000000 -0500
59408 +++ linux-3.0.9/include/linux/kallsyms.h 2011-11-15 20:03:00.000000000 -0500
59409 @@ -15,7 +15,8 @@
59410
59411 struct module;
59412
59413 -#ifdef CONFIG_KALLSYMS
59414 +#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
59415 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
59416 /* Lookup the address for a symbol. Returns 0 if not found. */
59417 unsigned long kallsyms_lookup_name(const char *name);
59418
59419 @@ -99,6 +100,16 @@ static inline int lookup_symbol_attrs(un
59420 /* Stupid that this does nothing, but I didn't create this mess. */
59421 #define __print_symbol(fmt, addr)
59422 #endif /*CONFIG_KALLSYMS*/
59423 +#else /* when included by kallsyms.c, vsnprintf.c, or
59424 + arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
59425 +extern void __print_symbol(const char *fmt, unsigned long address);
59426 +extern int sprint_backtrace(char *buffer, unsigned long address);
59427 +extern int sprint_symbol(char *buffer, unsigned long address);
59428 +const char *kallsyms_lookup(unsigned long addr,
59429 + unsigned long *symbolsize,
59430 + unsigned long *offset,
59431 + char **modname, char *namebuf);
59432 +#endif
59433
59434 /* This macro allows us to keep printk typechecking */
59435 static void __check_printsym_format(const char *fmt, ...)
59436 diff -urNp linux-3.0.9/include/linux/kgdb.h linux-3.0.9/include/linux/kgdb.h
59437 --- linux-3.0.9/include/linux/kgdb.h 2011-11-11 13:12:24.000000000 -0500
59438 +++ linux-3.0.9/include/linux/kgdb.h 2011-11-15 20:03:00.000000000 -0500
59439 @@ -53,7 +53,7 @@ extern int kgdb_connected;
59440 extern int kgdb_io_module_registered;
59441
59442 extern atomic_t kgdb_setting_breakpoint;
59443 -extern atomic_t kgdb_cpu_doing_single_step;
59444 +extern atomic_unchecked_t kgdb_cpu_doing_single_step;
59445
59446 extern struct task_struct *kgdb_usethread;
59447 extern struct task_struct *kgdb_contthread;
59448 @@ -251,7 +251,7 @@ struct kgdb_arch {
59449 void (*disable_hw_break)(struct pt_regs *regs);
59450 void (*remove_all_hw_break)(void);
59451 void (*correct_hw_break)(void);
59452 -};
59453 +} __do_const;
59454
59455 /**
59456 * struct kgdb_io - Describe the interface for an I/O driver to talk with KGDB.
59457 @@ -276,7 +276,7 @@ struct kgdb_io {
59458 void (*pre_exception) (void);
59459 void (*post_exception) (void);
59460 int is_console;
59461 -};
59462 +} __do_const;
59463
59464 extern struct kgdb_arch arch_kgdb_ops;
59465
59466 diff -urNp linux-3.0.9/include/linux/kmod.h linux-3.0.9/include/linux/kmod.h
59467 --- linux-3.0.9/include/linux/kmod.h 2011-11-11 13:12:24.000000000 -0500
59468 +++ linux-3.0.9/include/linux/kmod.h 2011-11-15 20:03:00.000000000 -0500
59469 @@ -34,6 +34,8 @@ extern char modprobe_path[]; /* for sysc
59470 * usually useless though. */
59471 extern int __request_module(bool wait, const char *name, ...) \
59472 __attribute__((format(printf, 2, 3)));
59473 +extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
59474 + __attribute__((format(printf, 3, 4)));
59475 #define request_module(mod...) __request_module(true, mod)
59476 #define request_module_nowait(mod...) __request_module(false, mod)
59477 #define try_then_request_module(x, mod...) \
59478 diff -urNp linux-3.0.9/include/linux/kvm_host.h linux-3.0.9/include/linux/kvm_host.h
59479 --- linux-3.0.9/include/linux/kvm_host.h 2011-11-11 13:12:24.000000000 -0500
59480 +++ linux-3.0.9/include/linux/kvm_host.h 2011-11-15 20:03:00.000000000 -0500
59481 @@ -307,7 +307,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
59482 void vcpu_load(struct kvm_vcpu *vcpu);
59483 void vcpu_put(struct kvm_vcpu *vcpu);
59484
59485 -int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
59486 +int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
59487 struct module *module);
59488 void kvm_exit(void);
59489
59490 @@ -446,7 +446,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
59491 struct kvm_guest_debug *dbg);
59492 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
59493
59494 -int kvm_arch_init(void *opaque);
59495 +int kvm_arch_init(const void *opaque);
59496 void kvm_arch_exit(void);
59497
59498 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
59499 diff -urNp linux-3.0.9/include/linux/libata.h linux-3.0.9/include/linux/libata.h
59500 --- linux-3.0.9/include/linux/libata.h 2011-11-11 13:12:24.000000000 -0500
59501 +++ linux-3.0.9/include/linux/libata.h 2011-11-15 20:03:00.000000000 -0500
59502 @@ -899,7 +899,7 @@ struct ata_port_operations {
59503 * fields must be pointers.
59504 */
59505 const struct ata_port_operations *inherits;
59506 -};
59507 +} __do_const;
59508
59509 struct ata_port_info {
59510 unsigned long flags;
59511 diff -urNp linux-3.0.9/include/linux/mca.h linux-3.0.9/include/linux/mca.h
59512 --- linux-3.0.9/include/linux/mca.h 2011-11-11 13:12:24.000000000 -0500
59513 +++ linux-3.0.9/include/linux/mca.h 2011-11-15 20:03:00.000000000 -0500
59514 @@ -80,7 +80,7 @@ struct mca_bus_accessor_functions {
59515 int region);
59516 void * (*mca_transform_memory)(struct mca_device *,
59517 void *memory);
59518 -};
59519 +} __no_const;
59520
59521 struct mca_bus {
59522 u64 default_dma_mask;
59523 diff -urNp linux-3.0.9/include/linux/memory.h linux-3.0.9/include/linux/memory.h
59524 --- linux-3.0.9/include/linux/memory.h 2011-11-11 13:12:24.000000000 -0500
59525 +++ linux-3.0.9/include/linux/memory.h 2011-11-15 20:03:00.000000000 -0500
59526 @@ -144,7 +144,7 @@ struct memory_accessor {
59527 size_t count);
59528 ssize_t (*write)(struct memory_accessor *, const char *buf,
59529 off_t offset, size_t count);
59530 -};
59531 +} __no_const;
59532
59533 /*
59534 * Kernel text modification mutex, used for code patching. Users of this lock
59535 diff -urNp linux-3.0.9/include/linux/mfd/abx500.h linux-3.0.9/include/linux/mfd/abx500.h
59536 --- linux-3.0.9/include/linux/mfd/abx500.h 2011-11-11 13:12:24.000000000 -0500
59537 +++ linux-3.0.9/include/linux/mfd/abx500.h 2011-11-15 20:03:00.000000000 -0500
59538 @@ -234,6 +234,7 @@ struct abx500_ops {
59539 int (*event_registers_startup_state_get) (struct device *, u8 *);
59540 int (*startup_irq_enabled) (struct device *, unsigned int);
59541 };
59542 +typedef struct abx500_ops __no_const abx500_ops_no_const;
59543
59544 int abx500_register_ops(struct device *core_dev, struct abx500_ops *ops);
59545 void abx500_remove_ops(struct device *dev);
59546 diff -urNp linux-3.0.9/include/linux/mm.h linux-3.0.9/include/linux/mm.h
59547 --- linux-3.0.9/include/linux/mm.h 2011-11-11 13:12:24.000000000 -0500
59548 +++ linux-3.0.9/include/linux/mm.h 2011-11-15 20:03:00.000000000 -0500
59549 @@ -113,7 +113,14 @@ extern unsigned int kobjsize(const void
59550
59551 #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
59552 #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
59553 +
59554 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
59555 +#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
59556 +#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
59557 +#else
59558 #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
59559 +#endif
59560 +
59561 #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
59562 #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
59563
59564 @@ -1008,34 +1015,6 @@ int set_page_dirty(struct page *page);
59565 int set_page_dirty_lock(struct page *page);
59566 int clear_page_dirty_for_io(struct page *page);
59567
59568 -/* Is the vma a continuation of the stack vma above it? */
59569 -static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
59570 -{
59571 - return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
59572 -}
59573 -
59574 -static inline int stack_guard_page_start(struct vm_area_struct *vma,
59575 - unsigned long addr)
59576 -{
59577 - return (vma->vm_flags & VM_GROWSDOWN) &&
59578 - (vma->vm_start == addr) &&
59579 - !vma_growsdown(vma->vm_prev, addr);
59580 -}
59581 -
59582 -/* Is the vma a continuation of the stack vma below it? */
59583 -static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
59584 -{
59585 - return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
59586 -}
59587 -
59588 -static inline int stack_guard_page_end(struct vm_area_struct *vma,
59589 - unsigned long addr)
59590 -{
59591 - return (vma->vm_flags & VM_GROWSUP) &&
59592 - (vma->vm_end == addr) &&
59593 - !vma_growsup(vma->vm_next, addr);
59594 -}
59595 -
59596 extern unsigned long move_page_tables(struct vm_area_struct *vma,
59597 unsigned long old_addr, struct vm_area_struct *new_vma,
59598 unsigned long new_addr, unsigned long len);
59599 @@ -1168,6 +1147,15 @@ struct shrinker {
59600 extern void register_shrinker(struct shrinker *);
59601 extern void unregister_shrinker(struct shrinker *);
59602
59603 +#ifdef CONFIG_MMU
59604 +pgprot_t vm_get_page_prot(vm_flags_t vm_flags);
59605 +#else
59606 +static inline pgprot_t vm_get_page_prot(vm_flags_t vm_flags)
59607 +{
59608 + return __pgprot(0);
59609 +}
59610 +#endif
59611 +
59612 int vma_wants_writenotify(struct vm_area_struct *vma);
59613
59614 extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
59615 @@ -1451,6 +1439,7 @@ out:
59616 }
59617
59618 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
59619 +extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
59620
59621 extern unsigned long do_brk(unsigned long, unsigned long);
59622
59623 @@ -1509,6 +1498,10 @@ extern struct vm_area_struct * find_vma(
59624 extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
59625 struct vm_area_struct **pprev);
59626
59627 +extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
59628 +extern __must_check long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
59629 +extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
59630 +
59631 /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
59632 NULL if none. Assume start_addr < end_addr. */
59633 static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
59634 @@ -1525,15 +1518,6 @@ static inline unsigned long vma_pages(st
59635 return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
59636 }
59637
59638 -#ifdef CONFIG_MMU
59639 -pgprot_t vm_get_page_prot(unsigned long vm_flags);
59640 -#else
59641 -static inline pgprot_t vm_get_page_prot(unsigned long vm_flags)
59642 -{
59643 - return __pgprot(0);
59644 -}
59645 -#endif
59646 -
59647 struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
59648 int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
59649 unsigned long pfn, unsigned long size, pgprot_t);
59650 @@ -1646,7 +1630,7 @@ extern int unpoison_memory(unsigned long
59651 extern int sysctl_memory_failure_early_kill;
59652 extern int sysctl_memory_failure_recovery;
59653 extern void shake_page(struct page *p, int access);
59654 -extern atomic_long_t mce_bad_pages;
59655 +extern atomic_long_unchecked_t mce_bad_pages;
59656 extern int soft_offline_page(struct page *page, int flags);
59657
59658 extern void dump_page(struct page *page);
59659 @@ -1660,5 +1644,11 @@ extern void copy_user_huge_page(struct p
59660 unsigned int pages_per_huge_page);
59661 #endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLBFS */
59662
59663 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
59664 +extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
59665 +#else
59666 +static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
59667 +#endif
59668 +
59669 #endif /* __KERNEL__ */
59670 #endif /* _LINUX_MM_H */
59671 diff -urNp linux-3.0.9/include/linux/mm_types.h linux-3.0.9/include/linux/mm_types.h
59672 --- linux-3.0.9/include/linux/mm_types.h 2011-11-11 13:12:24.000000000 -0500
59673 +++ linux-3.0.9/include/linux/mm_types.h 2011-11-15 20:03:00.000000000 -0500
59674 @@ -198,6 +198,8 @@ struct vm_area_struct {
59675 #ifdef CONFIG_NUMA
59676 struct mempolicy *vm_policy; /* NUMA policy for the VMA */
59677 #endif
59678 +
59679 + struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
59680 };
59681
59682 struct core_thread {
59683 @@ -330,6 +332,24 @@ struct mm_struct {
59684 #ifdef CONFIG_CPUMASK_OFFSTACK
59685 struct cpumask cpumask_allocation;
59686 #endif
59687 +
59688 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
59689 + unsigned long pax_flags;
59690 +#endif
59691 +
59692 +#ifdef CONFIG_PAX_DLRESOLVE
59693 + unsigned long call_dl_resolve;
59694 +#endif
59695 +
59696 +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
59697 + unsigned long call_syscall;
59698 +#endif
59699 +
59700 +#ifdef CONFIG_PAX_ASLR
59701 + unsigned long delta_mmap; /* randomized offset */
59702 + unsigned long delta_stack; /* randomized offset */
59703 +#endif
59704 +
59705 };
59706
59707 static inline void mm_init_cpumask(struct mm_struct *mm)
59708 diff -urNp linux-3.0.9/include/linux/mmu_notifier.h linux-3.0.9/include/linux/mmu_notifier.h
59709 --- linux-3.0.9/include/linux/mmu_notifier.h 2011-11-11 13:12:24.000000000 -0500
59710 +++ linux-3.0.9/include/linux/mmu_notifier.h 2011-11-15 20:03:00.000000000 -0500
59711 @@ -255,12 +255,12 @@ static inline void mmu_notifier_mm_destr
59712 */
59713 #define ptep_clear_flush_notify(__vma, __address, __ptep) \
59714 ({ \
59715 - pte_t __pte; \
59716 + pte_t ___pte; \
59717 struct vm_area_struct *___vma = __vma; \
59718 unsigned long ___address = __address; \
59719 - __pte = ptep_clear_flush(___vma, ___address, __ptep); \
59720 + ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
59721 mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
59722 - __pte; \
59723 + ___pte; \
59724 })
59725
59726 #define pmdp_clear_flush_notify(__vma, __address, __pmdp) \
59727 diff -urNp linux-3.0.9/include/linux/mmzone.h linux-3.0.9/include/linux/mmzone.h
59728 --- linux-3.0.9/include/linux/mmzone.h 2011-11-11 13:12:24.000000000 -0500
59729 +++ linux-3.0.9/include/linux/mmzone.h 2011-11-15 20:03:00.000000000 -0500
59730 @@ -350,7 +350,7 @@ struct zone {
59731 unsigned long flags; /* zone flags, see below */
59732
59733 /* Zone statistics */
59734 - atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
59735 + atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
59736
59737 /*
59738 * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on
59739 diff -urNp linux-3.0.9/include/linux/mod_devicetable.h linux-3.0.9/include/linux/mod_devicetable.h
59740 --- linux-3.0.9/include/linux/mod_devicetable.h 2011-11-11 13:12:24.000000000 -0500
59741 +++ linux-3.0.9/include/linux/mod_devicetable.h 2011-11-15 20:03:00.000000000 -0500
59742 @@ -12,7 +12,7 @@
59743 typedef unsigned long kernel_ulong_t;
59744 #endif
59745
59746 -#define PCI_ANY_ID (~0)
59747 +#define PCI_ANY_ID ((__u16)~0)
59748
59749 struct pci_device_id {
59750 __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
59751 @@ -131,7 +131,7 @@ struct usb_device_id {
59752 #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
59753 #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
59754
59755 -#define HID_ANY_ID (~0)
59756 +#define HID_ANY_ID (~0U)
59757
59758 struct hid_device_id {
59759 __u16 bus;
59760 diff -urNp linux-3.0.9/include/linux/module.h linux-3.0.9/include/linux/module.h
59761 --- linux-3.0.9/include/linux/module.h 2011-11-11 13:12:24.000000000 -0500
59762 +++ linux-3.0.9/include/linux/module.h 2011-11-15 20:03:00.000000000 -0500
59763 @@ -16,6 +16,7 @@
59764 #include <linux/kobject.h>
59765 #include <linux/moduleparam.h>
59766 #include <linux/tracepoint.h>
59767 +#include <linux/fs.h>
59768
59769 #include <linux/percpu.h>
59770 #include <asm/module.h>
59771 @@ -325,19 +326,16 @@ struct module
59772 int (*init)(void);
59773
59774 /* If this is non-NULL, vfree after init() returns */
59775 - void *module_init;
59776 + void *module_init_rx, *module_init_rw;
59777
59778 /* Here is the actual code + data, vfree'd on unload. */
59779 - void *module_core;
59780 + void *module_core_rx, *module_core_rw;
59781
59782 /* Here are the sizes of the init and core sections */
59783 - unsigned int init_size, core_size;
59784 + unsigned int init_size_rw, core_size_rw;
59785
59786 /* The size of the executable code in each section. */
59787 - unsigned int init_text_size, core_text_size;
59788 -
59789 - /* Size of RO sections of the module (text+rodata) */
59790 - unsigned int init_ro_size, core_ro_size;
59791 + unsigned int init_size_rx, core_size_rx;
59792
59793 /* Arch-specific module values */
59794 struct mod_arch_specific arch;
59795 @@ -393,6 +391,10 @@ struct module
59796 #ifdef CONFIG_EVENT_TRACING
59797 struct ftrace_event_call **trace_events;
59798 unsigned int num_trace_events;
59799 + struct file_operations trace_id;
59800 + struct file_operations trace_enable;
59801 + struct file_operations trace_format;
59802 + struct file_operations trace_filter;
59803 #endif
59804 #ifdef CONFIG_FTRACE_MCOUNT_RECORD
59805 unsigned int num_ftrace_callsites;
59806 @@ -443,16 +445,46 @@ bool is_module_address(unsigned long add
59807 bool is_module_percpu_address(unsigned long addr);
59808 bool is_module_text_address(unsigned long addr);
59809
59810 +static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
59811 +{
59812 +
59813 +#ifdef CONFIG_PAX_KERNEXEC
59814 + if (ktla_ktva(addr) >= (unsigned long)start &&
59815 + ktla_ktva(addr) < (unsigned long)start + size)
59816 + return 1;
59817 +#endif
59818 +
59819 + return ((void *)addr >= start && (void *)addr < start + size);
59820 +}
59821 +
59822 +static inline int within_module_core_rx(unsigned long addr, struct module *mod)
59823 +{
59824 + return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
59825 +}
59826 +
59827 +static inline int within_module_core_rw(unsigned long addr, struct module *mod)
59828 +{
59829 + return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
59830 +}
59831 +
59832 +static inline int within_module_init_rx(unsigned long addr, struct module *mod)
59833 +{
59834 + return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
59835 +}
59836 +
59837 +static inline int within_module_init_rw(unsigned long addr, struct module *mod)
59838 +{
59839 + return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
59840 +}
59841 +
59842 static inline int within_module_core(unsigned long addr, struct module *mod)
59843 {
59844 - return (unsigned long)mod->module_core <= addr &&
59845 - addr < (unsigned long)mod->module_core + mod->core_size;
59846 + return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
59847 }
59848
59849 static inline int within_module_init(unsigned long addr, struct module *mod)
59850 {
59851 - return (unsigned long)mod->module_init <= addr &&
59852 - addr < (unsigned long)mod->module_init + mod->init_size;
59853 + return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
59854 }
59855
59856 /* Search for module by name: must hold module_mutex. */
59857 diff -urNp linux-3.0.9/include/linux/moduleloader.h linux-3.0.9/include/linux/moduleloader.h
59858 --- linux-3.0.9/include/linux/moduleloader.h 2011-11-11 13:12:24.000000000 -0500
59859 +++ linux-3.0.9/include/linux/moduleloader.h 2011-11-15 20:03:00.000000000 -0500
59860 @@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
59861 sections. Returns NULL on failure. */
59862 void *module_alloc(unsigned long size);
59863
59864 +#ifdef CONFIG_PAX_KERNEXEC
59865 +void *module_alloc_exec(unsigned long size);
59866 +#else
59867 +#define module_alloc_exec(x) module_alloc(x)
59868 +#endif
59869 +
59870 /* Free memory returned from module_alloc. */
59871 void module_free(struct module *mod, void *module_region);
59872
59873 +#ifdef CONFIG_PAX_KERNEXEC
59874 +void module_free_exec(struct module *mod, void *module_region);
59875 +#else
59876 +#define module_free_exec(x, y) module_free((x), (y))
59877 +#endif
59878 +
59879 /* Apply the given relocation to the (simplified) ELF. Return -error
59880 or 0. */
59881 int apply_relocate(Elf_Shdr *sechdrs,
59882 diff -urNp linux-3.0.9/include/linux/moduleparam.h linux-3.0.9/include/linux/moduleparam.h
59883 --- linux-3.0.9/include/linux/moduleparam.h 2011-11-11 13:12:24.000000000 -0500
59884 +++ linux-3.0.9/include/linux/moduleparam.h 2011-11-15 20:03:00.000000000 -0500
59885 @@ -255,7 +255,7 @@ static inline void __kernel_param_unlock
59886 * @len is usually just sizeof(string).
59887 */
59888 #define module_param_string(name, string, len, perm) \
59889 - static const struct kparam_string __param_string_##name \
59890 + static const struct kparam_string __param_string_##name __used \
59891 = { len, string }; \
59892 __module_param_call(MODULE_PARAM_PREFIX, name, \
59893 &param_ops_string, \
59894 @@ -370,7 +370,7 @@ extern int param_get_invbool(char *buffe
59895 * module_param_named() for why this might be necessary.
59896 */
59897 #define module_param_array_named(name, array, type, nump, perm) \
59898 - static const struct kparam_array __param_arr_##name \
59899 + static const struct kparam_array __param_arr_##name __used \
59900 = { .max = ARRAY_SIZE(array), .num = nump, \
59901 .ops = &param_ops_##type, \
59902 .elemsize = sizeof(array[0]), .elem = array }; \
59903 diff -urNp linux-3.0.9/include/linux/namei.h linux-3.0.9/include/linux/namei.h
59904 --- linux-3.0.9/include/linux/namei.h 2011-11-11 13:12:24.000000000 -0500
59905 +++ linux-3.0.9/include/linux/namei.h 2011-11-15 20:03:00.000000000 -0500
59906 @@ -24,7 +24,7 @@ struct nameidata {
59907 unsigned seq;
59908 int last_type;
59909 unsigned depth;
59910 - char *saved_names[MAX_NESTED_LINKS + 1];
59911 + const char *saved_names[MAX_NESTED_LINKS + 1];
59912
59913 /* Intent data */
59914 union {
59915 @@ -93,12 +93,12 @@ extern int follow_up(struct path *);
59916 extern struct dentry *lock_rename(struct dentry *, struct dentry *);
59917 extern void unlock_rename(struct dentry *, struct dentry *);
59918
59919 -static inline void nd_set_link(struct nameidata *nd, char *path)
59920 +static inline void nd_set_link(struct nameidata *nd, const char *path)
59921 {
59922 nd->saved_names[nd->depth] = path;
59923 }
59924
59925 -static inline char *nd_get_link(struct nameidata *nd)
59926 +static inline const char *nd_get_link(const struct nameidata *nd)
59927 {
59928 return nd->saved_names[nd->depth];
59929 }
59930 diff -urNp linux-3.0.9/include/linux/netdevice.h linux-3.0.9/include/linux/netdevice.h
59931 --- linux-3.0.9/include/linux/netdevice.h 2011-11-11 13:12:24.000000000 -0500
59932 +++ linux-3.0.9/include/linux/netdevice.h 2011-11-15 20:03:00.000000000 -0500
59933 @@ -979,6 +979,7 @@ struct net_device_ops {
59934 int (*ndo_set_features)(struct net_device *dev,
59935 u32 features);
59936 };
59937 +typedef struct net_device_ops __no_const net_device_ops_no_const;
59938
59939 /*
59940 * The DEVICE structure.
59941 diff -urNp linux-3.0.9/include/linux/netfilter/xt_gradm.h linux-3.0.9/include/linux/netfilter/xt_gradm.h
59942 --- linux-3.0.9/include/linux/netfilter/xt_gradm.h 1969-12-31 19:00:00.000000000 -0500
59943 +++ linux-3.0.9/include/linux/netfilter/xt_gradm.h 2011-11-15 20:03:00.000000000 -0500
59944 @@ -0,0 +1,9 @@
59945 +#ifndef _LINUX_NETFILTER_XT_GRADM_H
59946 +#define _LINUX_NETFILTER_XT_GRADM_H 1
59947 +
59948 +struct xt_gradm_mtinfo {
59949 + __u16 flags;
59950 + __u16 invflags;
59951 +};
59952 +
59953 +#endif
59954 diff -urNp linux-3.0.9/include/linux/of_pdt.h linux-3.0.9/include/linux/of_pdt.h
59955 --- linux-3.0.9/include/linux/of_pdt.h 2011-11-11 13:12:24.000000000 -0500
59956 +++ linux-3.0.9/include/linux/of_pdt.h 2011-11-15 20:03:00.000000000 -0500
59957 @@ -32,7 +32,7 @@ struct of_pdt_ops {
59958
59959 /* return 0 on success; fill in 'len' with number of bytes in path */
59960 int (*pkg2path)(phandle node, char *buf, const int buflen, int *len);
59961 -};
59962 +} __no_const;
59963
59964 extern void *prom_early_alloc(unsigned long size);
59965
59966 diff -urNp linux-3.0.9/include/linux/oprofile.h linux-3.0.9/include/linux/oprofile.h
59967 --- linux-3.0.9/include/linux/oprofile.h 2011-11-11 13:12:24.000000000 -0500
59968 +++ linux-3.0.9/include/linux/oprofile.h 2011-11-15 20:03:00.000000000 -0500
59969 @@ -139,9 +139,9 @@ int oprofilefs_create_ulong(struct super
59970 int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
59971 char const * name, ulong * val);
59972
59973 -/** Create a file for read-only access to an atomic_t. */
59974 +/** Create a file for read-only access to an atomic_unchecked_t. */
59975 int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
59976 - char const * name, atomic_t * val);
59977 + char const * name, atomic_unchecked_t * val);
59978
59979 /** create a directory */
59980 struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
59981 diff -urNp linux-3.0.9/include/linux/padata.h linux-3.0.9/include/linux/padata.h
59982 --- linux-3.0.9/include/linux/padata.h 2011-11-11 13:12:24.000000000 -0500
59983 +++ linux-3.0.9/include/linux/padata.h 2011-11-15 20:03:00.000000000 -0500
59984 @@ -129,7 +129,7 @@ struct parallel_data {
59985 struct padata_instance *pinst;
59986 struct padata_parallel_queue __percpu *pqueue;
59987 struct padata_serial_queue __percpu *squeue;
59988 - atomic_t seq_nr;
59989 + atomic_unchecked_t seq_nr;
59990 atomic_t reorder_objects;
59991 atomic_t refcnt;
59992 unsigned int max_seq_nr;
59993 diff -urNp linux-3.0.9/include/linux/perf_event.h linux-3.0.9/include/linux/perf_event.h
59994 --- linux-3.0.9/include/linux/perf_event.h 2011-11-11 13:12:24.000000000 -0500
59995 +++ linux-3.0.9/include/linux/perf_event.h 2011-11-15 20:03:00.000000000 -0500
59996 @@ -761,8 +761,8 @@ struct perf_event {
59997
59998 enum perf_event_active_state state;
59999 unsigned int attach_state;
60000 - local64_t count;
60001 - atomic64_t child_count;
60002 + local64_t count; /* PaX: fix it one day */
60003 + atomic64_unchecked_t child_count;
60004
60005 /*
60006 * These are the total time in nanoseconds that the event
60007 @@ -813,8 +813,8 @@ struct perf_event {
60008 * These accumulate total time (in nanoseconds) that children
60009 * events have been enabled and running, respectively.
60010 */
60011 - atomic64_t child_total_time_enabled;
60012 - atomic64_t child_total_time_running;
60013 + atomic64_unchecked_t child_total_time_enabled;
60014 + atomic64_unchecked_t child_total_time_running;
60015
60016 /*
60017 * Protect attach/detach and child_list:
60018 diff -urNp linux-3.0.9/include/linux/pipe_fs_i.h linux-3.0.9/include/linux/pipe_fs_i.h
60019 --- linux-3.0.9/include/linux/pipe_fs_i.h 2011-11-11 13:12:24.000000000 -0500
60020 +++ linux-3.0.9/include/linux/pipe_fs_i.h 2011-11-15 20:03:00.000000000 -0500
60021 @@ -46,9 +46,9 @@ struct pipe_buffer {
60022 struct pipe_inode_info {
60023 wait_queue_head_t wait;
60024 unsigned int nrbufs, curbuf, buffers;
60025 - unsigned int readers;
60026 - unsigned int writers;
60027 - unsigned int waiting_writers;
60028 + atomic_t readers;
60029 + atomic_t writers;
60030 + atomic_t waiting_writers;
60031 unsigned int r_counter;
60032 unsigned int w_counter;
60033 struct page *tmp_page;
60034 diff -urNp linux-3.0.9/include/linux/pm_runtime.h linux-3.0.9/include/linux/pm_runtime.h
60035 --- linux-3.0.9/include/linux/pm_runtime.h 2011-11-11 13:12:24.000000000 -0500
60036 +++ linux-3.0.9/include/linux/pm_runtime.h 2011-11-15 20:03:00.000000000 -0500
60037 @@ -94,7 +94,7 @@ static inline bool pm_runtime_callbacks_
60038
60039 static inline void pm_runtime_mark_last_busy(struct device *dev)
60040 {
60041 - ACCESS_ONCE(dev->power.last_busy) = jiffies;
60042 + ACCESS_ONCE_RW(dev->power.last_busy) = jiffies;
60043 }
60044
60045 #else /* !CONFIG_PM_RUNTIME */
60046 diff -urNp linux-3.0.9/include/linux/poison.h linux-3.0.9/include/linux/poison.h
60047 --- linux-3.0.9/include/linux/poison.h 2011-11-11 13:12:24.000000000 -0500
60048 +++ linux-3.0.9/include/linux/poison.h 2011-11-15 20:03:00.000000000 -0500
60049 @@ -19,8 +19,8 @@
60050 * under normal circumstances, used to verify that nobody uses
60051 * non-initialized list entries.
60052 */
60053 -#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
60054 -#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
60055 +#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
60056 +#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
60057
60058 /********** include/linux/timer.h **********/
60059 /*
60060 diff -urNp linux-3.0.9/include/linux/preempt.h linux-3.0.9/include/linux/preempt.h
60061 --- linux-3.0.9/include/linux/preempt.h 2011-11-11 13:12:24.000000000 -0500
60062 +++ linux-3.0.9/include/linux/preempt.h 2011-11-15 20:03:00.000000000 -0500
60063 @@ -115,7 +115,7 @@ struct preempt_ops {
60064 void (*sched_in)(struct preempt_notifier *notifier, int cpu);
60065 void (*sched_out)(struct preempt_notifier *notifier,
60066 struct task_struct *next);
60067 -};
60068 +} __no_const;
60069
60070 /**
60071 * preempt_notifier - key for installing preemption notifiers
60072 diff -urNp linux-3.0.9/include/linux/proc_fs.h linux-3.0.9/include/linux/proc_fs.h
60073 --- linux-3.0.9/include/linux/proc_fs.h 2011-11-11 13:12:24.000000000 -0500
60074 +++ linux-3.0.9/include/linux/proc_fs.h 2011-11-15 20:03:00.000000000 -0500
60075 @@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
60076 return proc_create_data(name, mode, parent, proc_fops, NULL);
60077 }
60078
60079 +static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
60080 + struct proc_dir_entry *parent, const struct file_operations *proc_fops)
60081 +{
60082 +#ifdef CONFIG_GRKERNSEC_PROC_USER
60083 + return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
60084 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
60085 + return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
60086 +#else
60087 + return proc_create_data(name, mode, parent, proc_fops, NULL);
60088 +#endif
60089 +}
60090 +
60091 +
60092 static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
60093 mode_t mode, struct proc_dir_entry *base,
60094 read_proc_t *read_proc, void * data)
60095 @@ -258,7 +271,7 @@ union proc_op {
60096 int (*proc_show)(struct seq_file *m,
60097 struct pid_namespace *ns, struct pid *pid,
60098 struct task_struct *task);
60099 -};
60100 +} __no_const;
60101
60102 struct ctl_table_header;
60103 struct ctl_table;
60104 diff -urNp linux-3.0.9/include/linux/ptrace.h linux-3.0.9/include/linux/ptrace.h
60105 --- linux-3.0.9/include/linux/ptrace.h 2011-11-11 13:12:24.000000000 -0500
60106 +++ linux-3.0.9/include/linux/ptrace.h 2011-11-15 20:03:00.000000000 -0500
60107 @@ -115,10 +115,10 @@ extern void __ptrace_unlink(struct task_
60108 extern void exit_ptrace(struct task_struct *tracer);
60109 #define PTRACE_MODE_READ 1
60110 #define PTRACE_MODE_ATTACH 2
60111 -/* Returns 0 on success, -errno on denial. */
60112 -extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
60113 /* Returns true on success, false on denial. */
60114 extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
60115 +/* Returns true on success, false on denial. */
60116 +extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
60117
60118 static inline int ptrace_reparented(struct task_struct *child)
60119 {
60120 diff -urNp linux-3.0.9/include/linux/random.h linux-3.0.9/include/linux/random.h
60121 --- linux-3.0.9/include/linux/random.h 2011-11-11 13:12:24.000000000 -0500
60122 +++ linux-3.0.9/include/linux/random.h 2011-11-15 20:03:00.000000000 -0500
60123 @@ -69,12 +69,17 @@ void srandom32(u32 seed);
60124
60125 u32 prandom32(struct rnd_state *);
60126
60127 +static inline unsigned long pax_get_random_long(void)
60128 +{
60129 + return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
60130 +}
60131 +
60132 /*
60133 * Handle minimum values for seeds
60134 */
60135 static inline u32 __seed(u32 x, u32 m)
60136 {
60137 - return (x < m) ? x + m : x;
60138 + return (x <= m) ? x + m + 1 : x;
60139 }
60140
60141 /**
60142 diff -urNp linux-3.0.9/include/linux/reboot.h linux-3.0.9/include/linux/reboot.h
60143 --- linux-3.0.9/include/linux/reboot.h 2011-11-11 13:12:24.000000000 -0500
60144 +++ linux-3.0.9/include/linux/reboot.h 2011-11-15 20:03:00.000000000 -0500
60145 @@ -47,9 +47,9 @@ extern int unregister_reboot_notifier(st
60146 * Architecture-specific implementations of sys_reboot commands.
60147 */
60148
60149 -extern void machine_restart(char *cmd);
60150 -extern void machine_halt(void);
60151 -extern void machine_power_off(void);
60152 +extern void machine_restart(char *cmd) __noreturn;
60153 +extern void machine_halt(void) __noreturn;
60154 +extern void machine_power_off(void) __noreturn;
60155
60156 extern void machine_shutdown(void);
60157 struct pt_regs;
60158 @@ -60,9 +60,9 @@ extern void machine_crash_shutdown(struc
60159 */
60160
60161 extern void kernel_restart_prepare(char *cmd);
60162 -extern void kernel_restart(char *cmd);
60163 -extern void kernel_halt(void);
60164 -extern void kernel_power_off(void);
60165 +extern void kernel_restart(char *cmd) __noreturn;
60166 +extern void kernel_halt(void) __noreturn;
60167 +extern void kernel_power_off(void) __noreturn;
60168
60169 extern int C_A_D; /* for sysctl */
60170 void ctrl_alt_del(void);
60171 @@ -76,7 +76,7 @@ extern int orderly_poweroff(bool force);
60172 * Emergency restart, callable from an interrupt handler.
60173 */
60174
60175 -extern void emergency_restart(void);
60176 +extern void emergency_restart(void) __noreturn;
60177 #include <asm/emergency-restart.h>
60178
60179 #endif
60180 diff -urNp linux-3.0.9/include/linux/reiserfs_fs.h linux-3.0.9/include/linux/reiserfs_fs.h
60181 --- linux-3.0.9/include/linux/reiserfs_fs.h 2011-11-11 13:12:24.000000000 -0500
60182 +++ linux-3.0.9/include/linux/reiserfs_fs.h 2011-11-15 20:03:00.000000000 -0500
60183 @@ -1406,7 +1406,7 @@ static inline loff_t max_reiserfs_offset
60184 #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
60185
60186 #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
60187 -#define get_generation(s) atomic_read (&fs_generation(s))
60188 +#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
60189 #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
60190 #define __fs_changed(gen,s) (gen != get_generation (s))
60191 #define fs_changed(gen,s) \
60192 diff -urNp linux-3.0.9/include/linux/reiserfs_fs_sb.h linux-3.0.9/include/linux/reiserfs_fs_sb.h
60193 --- linux-3.0.9/include/linux/reiserfs_fs_sb.h 2011-11-11 13:12:24.000000000 -0500
60194 +++ linux-3.0.9/include/linux/reiserfs_fs_sb.h 2011-11-15 20:03:00.000000000 -0500
60195 @@ -386,7 +386,7 @@ struct reiserfs_sb_info {
60196 /* Comment? -Hans */
60197 wait_queue_head_t s_wait;
60198 /* To be obsoleted soon by per buffer seals.. -Hans */
60199 - atomic_t s_generation_counter; // increased by one every time the
60200 + atomic_unchecked_t s_generation_counter; // increased by one every time the
60201 // tree gets re-balanced
60202 unsigned long s_properties; /* File system properties. Currently holds
60203 on-disk FS format */
60204 diff -urNp linux-3.0.9/include/linux/relay.h linux-3.0.9/include/linux/relay.h
60205 --- linux-3.0.9/include/linux/relay.h 2011-11-11 13:12:24.000000000 -0500
60206 +++ linux-3.0.9/include/linux/relay.h 2011-11-15 20:03:00.000000000 -0500
60207 @@ -159,7 +159,7 @@ struct rchan_callbacks
60208 * The callback should return 0 if successful, negative if not.
60209 */
60210 int (*remove_buf_file)(struct dentry *dentry);
60211 -};
60212 +} __no_const;
60213
60214 /*
60215 * CONFIG_RELAY kernel API, kernel/relay.c
60216 diff -urNp linux-3.0.9/include/linux/rfkill.h linux-3.0.9/include/linux/rfkill.h
60217 --- linux-3.0.9/include/linux/rfkill.h 2011-11-11 13:12:24.000000000 -0500
60218 +++ linux-3.0.9/include/linux/rfkill.h 2011-11-15 20:03:00.000000000 -0500
60219 @@ -147,6 +147,7 @@ struct rfkill_ops {
60220 void (*query)(struct rfkill *rfkill, void *data);
60221 int (*set_block)(void *data, bool blocked);
60222 };
60223 +typedef struct rfkill_ops __no_const rfkill_ops_no_const;
60224
60225 #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
60226 /**
60227 diff -urNp linux-3.0.9/include/linux/rmap.h linux-3.0.9/include/linux/rmap.h
60228 --- linux-3.0.9/include/linux/rmap.h 2011-11-11 13:12:24.000000000 -0500
60229 +++ linux-3.0.9/include/linux/rmap.h 2011-11-15 20:03:00.000000000 -0500
60230 @@ -119,8 +119,8 @@ static inline void anon_vma_unlock(struc
60231 void anon_vma_init(void); /* create anon_vma_cachep */
60232 int anon_vma_prepare(struct vm_area_struct *);
60233 void unlink_anon_vmas(struct vm_area_struct *);
60234 -int anon_vma_clone(struct vm_area_struct *, struct vm_area_struct *);
60235 -int anon_vma_fork(struct vm_area_struct *, struct vm_area_struct *);
60236 +int anon_vma_clone(struct vm_area_struct *, const struct vm_area_struct *);
60237 +int anon_vma_fork(struct vm_area_struct *, const struct vm_area_struct *);
60238 void __anon_vma_link(struct vm_area_struct *);
60239
60240 static inline void anon_vma_merge(struct vm_area_struct *vma,
60241 diff -urNp linux-3.0.9/include/linux/sched.h linux-3.0.9/include/linux/sched.h
60242 --- linux-3.0.9/include/linux/sched.h 2011-11-11 13:12:24.000000000 -0500
60243 +++ linux-3.0.9/include/linux/sched.h 2011-11-15 20:03:00.000000000 -0500
60244 @@ -100,6 +100,7 @@ struct bio_list;
60245 struct fs_struct;
60246 struct perf_event_context;
60247 struct blk_plug;
60248 +struct linux_binprm;
60249
60250 /*
60251 * List of flags we want to share for kernel threads,
60252 @@ -380,10 +381,13 @@ struct user_namespace;
60253 #define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
60254
60255 extern int sysctl_max_map_count;
60256 +extern unsigned long sysctl_heap_stack_gap;
60257
60258 #include <linux/aio.h>
60259
60260 #ifdef CONFIG_MMU
60261 +extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len);
60262 +extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len);
60263 extern void arch_pick_mmap_layout(struct mm_struct *mm);
60264 extern unsigned long
60265 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
60266 @@ -629,6 +633,17 @@ struct signal_struct {
60267 #ifdef CONFIG_TASKSTATS
60268 struct taskstats *stats;
60269 #endif
60270 +
60271 +#ifdef CONFIG_GRKERNSEC
60272 + u32 curr_ip;
60273 + u32 saved_ip;
60274 + u32 gr_saddr;
60275 + u32 gr_daddr;
60276 + u16 gr_sport;
60277 + u16 gr_dport;
60278 + u8 used_accept:1;
60279 +#endif
60280 +
60281 #ifdef CONFIG_AUDIT
60282 unsigned audit_tty;
60283 struct tty_audit_buf *tty_audit_buf;
60284 @@ -710,6 +725,11 @@ struct user_struct {
60285 struct key *session_keyring; /* UID's default session keyring */
60286 #endif
60287
60288 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
60289 + unsigned int banned;
60290 + unsigned long ban_expires;
60291 +#endif
60292 +
60293 /* Hash table maintenance information */
60294 struct hlist_node uidhash_node;
60295 uid_t uid;
60296 @@ -1340,8 +1360,8 @@ struct task_struct {
60297 struct list_head thread_group;
60298
60299 struct completion *vfork_done; /* for vfork() */
60300 - int __user *set_child_tid; /* CLONE_CHILD_SETTID */
60301 - int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
60302 + pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
60303 + pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
60304
60305 cputime_t utime, stime, utimescaled, stimescaled;
60306 cputime_t gtime;
60307 @@ -1357,13 +1377,6 @@ struct task_struct {
60308 struct task_cputime cputime_expires;
60309 struct list_head cpu_timers[3];
60310
60311 -/* process credentials */
60312 - const struct cred __rcu *real_cred; /* objective and real subjective task
60313 - * credentials (COW) */
60314 - const struct cred __rcu *cred; /* effective (overridable) subjective task
60315 - * credentials (COW) */
60316 - struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
60317 -
60318 char comm[TASK_COMM_LEN]; /* executable name excluding path
60319 - access with [gs]et_task_comm (which lock
60320 it with task_lock())
60321 @@ -1380,8 +1393,16 @@ struct task_struct {
60322 #endif
60323 /* CPU-specific state of this task */
60324 struct thread_struct thread;
60325 +/* thread_info moved to task_struct */
60326 +#ifdef CONFIG_X86
60327 + struct thread_info tinfo;
60328 +#endif
60329 /* filesystem information */
60330 struct fs_struct *fs;
60331 +
60332 + const struct cred __rcu *cred; /* effective (overridable) subjective task
60333 + * credentials (COW) */
60334 +
60335 /* open file information */
60336 struct files_struct *files;
60337 /* namespaces */
60338 @@ -1428,6 +1449,11 @@ struct task_struct {
60339 struct rt_mutex_waiter *pi_blocked_on;
60340 #endif
60341
60342 +/* process credentials */
60343 + const struct cred __rcu *real_cred; /* objective and real subjective task
60344 + * credentials (COW) */
60345 + struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
60346 +
60347 #ifdef CONFIG_DEBUG_MUTEXES
60348 /* mutex deadlock detection */
60349 struct mutex_waiter *blocked_on;
60350 @@ -1538,6 +1564,21 @@ struct task_struct {
60351 unsigned long default_timer_slack_ns;
60352
60353 struct list_head *scm_work_list;
60354 +
60355 +#ifdef CONFIG_GRKERNSEC
60356 + /* grsecurity */
60357 + struct dentry *gr_chroot_dentry;
60358 + struct acl_subject_label *acl;
60359 + struct acl_role_label *role;
60360 + struct file *exec_file;
60361 + u16 acl_role_id;
60362 + /* is this the task that authenticated to the special role */
60363 + u8 acl_sp_role;
60364 + u8 is_writable;
60365 + u8 brute;
60366 + u8 gr_is_chrooted;
60367 +#endif
60368 +
60369 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
60370 /* Index of current stored address in ret_stack */
60371 int curr_ret_stack;
60372 @@ -1572,6 +1613,57 @@ struct task_struct {
60373 #endif
60374 };
60375
60376 +#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
60377 +#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
60378 +#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
60379 +#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
60380 +/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
60381 +#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
60382 +
60383 +#ifdef CONFIG_PAX_SOFTMODE
60384 +extern int pax_softmode;
60385 +#endif
60386 +
60387 +extern int pax_check_flags(unsigned long *);
60388 +
60389 +/* if tsk != current then task_lock must be held on it */
60390 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
60391 +static inline unsigned long pax_get_flags(struct task_struct *tsk)
60392 +{
60393 + if (likely(tsk->mm))
60394 + return tsk->mm->pax_flags;
60395 + else
60396 + return 0UL;
60397 +}
60398 +
60399 +/* if tsk != current then task_lock must be held on it */
60400 +static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
60401 +{
60402 + if (likely(tsk->mm)) {
60403 + tsk->mm->pax_flags = flags;
60404 + return 0;
60405 + }
60406 + return -EINVAL;
60407 +}
60408 +#endif
60409 +
60410 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
60411 +extern void pax_set_initial_flags(struct linux_binprm *bprm);
60412 +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
60413 +extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
60414 +#endif
60415 +
60416 +extern void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
60417 +extern void pax_report_insns(void *pc, void *sp);
60418 +extern void pax_report_refcount_overflow(struct pt_regs *regs);
60419 +extern NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type) ATTRIB_NORET;
60420 +
60421 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
60422 +extern void pax_track_stack(void);
60423 +#else
60424 +static inline void pax_track_stack(void) {}
60425 +#endif
60426 +
60427 /* Future-safe accessor for struct task_struct's cpus_allowed. */
60428 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
60429
60430 @@ -1768,6 +1860,7 @@ extern void thread_group_times(struct ta
60431 #define PF_DUMPCORE 0x00000200 /* dumped core */
60432 #define PF_SIGNALED 0x00000400 /* killed by a signal */
60433 #define PF_MEMALLOC 0x00000800 /* Allocating memory */
60434 +#define PF_NPROC_EXCEEDED 0x00001000 /* set_user noticed that RLIMIT_NPROC was exceeded */
60435 #define PF_USED_MATH 0x00002000 /* if unset the fpu must be initialized before use */
60436 #define PF_FREEZING 0x00004000 /* freeze in progress. do not account to load */
60437 #define PF_NOFREEZE 0x00008000 /* this thread should not be frozen */
60438 @@ -2055,7 +2148,9 @@ void yield(void);
60439 extern struct exec_domain default_exec_domain;
60440
60441 union thread_union {
60442 +#ifndef CONFIG_X86
60443 struct thread_info thread_info;
60444 +#endif
60445 unsigned long stack[THREAD_SIZE/sizeof(long)];
60446 };
60447
60448 @@ -2088,6 +2183,7 @@ extern struct pid_namespace init_pid_ns;
60449 */
60450
60451 extern struct task_struct *find_task_by_vpid(pid_t nr);
60452 +extern struct task_struct *find_task_by_vpid_unrestricted(pid_t nr);
60453 extern struct task_struct *find_task_by_pid_ns(pid_t nr,
60454 struct pid_namespace *ns);
60455
60456 @@ -2224,7 +2320,7 @@ extern void __cleanup_sighand(struct sig
60457 extern void exit_itimers(struct signal_struct *);
60458 extern void flush_itimer_signals(void);
60459
60460 -extern NORET_TYPE void do_group_exit(int);
60461 +extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
60462
60463 extern void daemonize(const char *, ...);
60464 extern int allow_signal(int);
60465 @@ -2392,13 +2488,17 @@ static inline unsigned long *end_of_stac
60466
60467 #endif
60468
60469 -static inline int object_is_on_stack(void *obj)
60470 +static inline int object_starts_on_stack(void *obj)
60471 {
60472 - void *stack = task_stack_page(current);
60473 + const void *stack = task_stack_page(current);
60474
60475 return (obj >= stack) && (obj < (stack + THREAD_SIZE));
60476 }
60477
60478 +#ifdef CONFIG_PAX_USERCOPY
60479 +extern int object_is_on_stack(const void *obj, unsigned long len);
60480 +#endif
60481 +
60482 extern void thread_info_cache_init(void);
60483
60484 #ifdef CONFIG_DEBUG_STACK_USAGE
60485 diff -urNp linux-3.0.9/include/linux/screen_info.h linux-3.0.9/include/linux/screen_info.h
60486 --- linux-3.0.9/include/linux/screen_info.h 2011-11-11 13:12:24.000000000 -0500
60487 +++ linux-3.0.9/include/linux/screen_info.h 2011-11-15 20:03:00.000000000 -0500
60488 @@ -43,7 +43,8 @@ struct screen_info {
60489 __u16 pages; /* 0x32 */
60490 __u16 vesa_attributes; /* 0x34 */
60491 __u32 capabilities; /* 0x36 */
60492 - __u8 _reserved[6]; /* 0x3a */
60493 + __u16 vesapm_size; /* 0x3a */
60494 + __u8 _reserved[4]; /* 0x3c */
60495 } __attribute__((packed));
60496
60497 #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
60498 diff -urNp linux-3.0.9/include/linux/security.h linux-3.0.9/include/linux/security.h
60499 --- linux-3.0.9/include/linux/security.h 2011-11-11 13:12:24.000000000 -0500
60500 +++ linux-3.0.9/include/linux/security.h 2011-11-15 20:03:00.000000000 -0500
60501 @@ -36,6 +36,7 @@
60502 #include <linux/key.h>
60503 #include <linux/xfrm.h>
60504 #include <linux/slab.h>
60505 +#include <linux/grsecurity.h>
60506 #include <net/flow.h>
60507
60508 /* Maximum number of letters for an LSM name string */
60509 diff -urNp linux-3.0.9/include/linux/seq_file.h linux-3.0.9/include/linux/seq_file.h
60510 --- linux-3.0.9/include/linux/seq_file.h 2011-11-11 13:12:24.000000000 -0500
60511 +++ linux-3.0.9/include/linux/seq_file.h 2011-11-15 20:03:00.000000000 -0500
60512 @@ -32,6 +32,7 @@ struct seq_operations {
60513 void * (*next) (struct seq_file *m, void *v, loff_t *pos);
60514 int (*show) (struct seq_file *m, void *v);
60515 };
60516 +typedef struct seq_operations __no_const seq_operations_no_const;
60517
60518 #define SEQ_SKIP 1
60519
60520 diff -urNp linux-3.0.9/include/linux/shmem_fs.h linux-3.0.9/include/linux/shmem_fs.h
60521 --- linux-3.0.9/include/linux/shmem_fs.h 2011-11-11 13:12:24.000000000 -0500
60522 +++ linux-3.0.9/include/linux/shmem_fs.h 2011-11-15 20:03:00.000000000 -0500
60523 @@ -10,7 +10,7 @@
60524
60525 #define SHMEM_NR_DIRECT 16
60526
60527 -#define SHMEM_SYMLINK_INLINE_LEN (SHMEM_NR_DIRECT * sizeof(swp_entry_t))
60528 +#define SHMEM_SYMLINK_INLINE_LEN 64
60529
60530 struct shmem_inode_info {
60531 spinlock_t lock;
60532 diff -urNp linux-3.0.9/include/linux/shm.h linux-3.0.9/include/linux/shm.h
60533 --- linux-3.0.9/include/linux/shm.h 2011-11-11 13:12:24.000000000 -0500
60534 +++ linux-3.0.9/include/linux/shm.h 2011-11-15 20:03:00.000000000 -0500
60535 @@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
60536 pid_t shm_cprid;
60537 pid_t shm_lprid;
60538 struct user_struct *mlock_user;
60539 +#ifdef CONFIG_GRKERNSEC
60540 + time_t shm_createtime;
60541 + pid_t shm_lapid;
60542 +#endif
60543 };
60544
60545 /* shm_mode upper byte flags */
60546 diff -urNp linux-3.0.9/include/linux/skbuff.h linux-3.0.9/include/linux/skbuff.h
60547 --- linux-3.0.9/include/linux/skbuff.h 2011-11-11 13:12:24.000000000 -0500
60548 +++ linux-3.0.9/include/linux/skbuff.h 2011-11-15 20:03:00.000000000 -0500
60549 @@ -592,7 +592,7 @@ static inline struct skb_shared_hwtstamp
60550 */
60551 static inline int skb_queue_empty(const struct sk_buff_head *list)
60552 {
60553 - return list->next == (struct sk_buff *)list;
60554 + return list->next == (const struct sk_buff *)list;
60555 }
60556
60557 /**
60558 @@ -605,7 +605,7 @@ static inline int skb_queue_empty(const
60559 static inline bool skb_queue_is_last(const struct sk_buff_head *list,
60560 const struct sk_buff *skb)
60561 {
60562 - return skb->next == (struct sk_buff *)list;
60563 + return skb->next == (const struct sk_buff *)list;
60564 }
60565
60566 /**
60567 @@ -618,7 +618,7 @@ static inline bool skb_queue_is_last(con
60568 static inline bool skb_queue_is_first(const struct sk_buff_head *list,
60569 const struct sk_buff *skb)
60570 {
60571 - return skb->prev == (struct sk_buff *)list;
60572 + return skb->prev == (const struct sk_buff *)list;
60573 }
60574
60575 /**
60576 @@ -1440,7 +1440,7 @@ static inline int pskb_network_may_pull(
60577 * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
60578 */
60579 #ifndef NET_SKB_PAD
60580 -#define NET_SKB_PAD max(32, L1_CACHE_BYTES)
60581 +#define NET_SKB_PAD max(_AC(32,UL), L1_CACHE_BYTES)
60582 #endif
60583
60584 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
60585 diff -urNp linux-3.0.9/include/linux/slab_def.h linux-3.0.9/include/linux/slab_def.h
60586 --- linux-3.0.9/include/linux/slab_def.h 2011-11-11 13:12:24.000000000 -0500
60587 +++ linux-3.0.9/include/linux/slab_def.h 2011-11-15 20:03:00.000000000 -0500
60588 @@ -96,10 +96,10 @@ struct kmem_cache {
60589 unsigned long node_allocs;
60590 unsigned long node_frees;
60591 unsigned long node_overflow;
60592 - atomic_t allochit;
60593 - atomic_t allocmiss;
60594 - atomic_t freehit;
60595 - atomic_t freemiss;
60596 + atomic_unchecked_t allochit;
60597 + atomic_unchecked_t allocmiss;
60598 + atomic_unchecked_t freehit;
60599 + atomic_unchecked_t freemiss;
60600
60601 /*
60602 * If debugging is enabled, then the allocator can add additional
60603 diff -urNp linux-3.0.9/include/linux/slab.h linux-3.0.9/include/linux/slab.h
60604 --- linux-3.0.9/include/linux/slab.h 2011-11-11 13:12:24.000000000 -0500
60605 +++ linux-3.0.9/include/linux/slab.h 2011-11-15 20:03:00.000000000 -0500
60606 @@ -11,12 +11,20 @@
60607
60608 #include <linux/gfp.h>
60609 #include <linux/types.h>
60610 +#include <linux/err.h>
60611
60612 /*
60613 * Flags to pass to kmem_cache_create().
60614 * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
60615 */
60616 #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
60617 +
60618 +#ifdef CONFIG_PAX_USERCOPY
60619 +#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
60620 +#else
60621 +#define SLAB_USERCOPY 0x00000000UL
60622 +#endif
60623 +
60624 #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
60625 #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
60626 #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
60627 @@ -87,10 +95,13 @@
60628 * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
60629 * Both make kfree a no-op.
60630 */
60631 -#define ZERO_SIZE_PTR ((void *)16)
60632 +#define ZERO_SIZE_PTR \
60633 +({ \
60634 + BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
60635 + (void *)(-MAX_ERRNO-1L); \
60636 +})
60637
60638 -#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
60639 - (unsigned long)ZERO_SIZE_PTR)
60640 +#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
60641
60642 /*
60643 * struct kmem_cache related prototypes
60644 @@ -141,6 +152,7 @@ void * __must_check krealloc(const void
60645 void kfree(const void *);
60646 void kzfree(const void *);
60647 size_t ksize(const void *);
60648 +void check_object_size(const void *ptr, unsigned long n, bool to);
60649
60650 /*
60651 * Allocator specific definitions. These are mainly used to establish optimized
60652 @@ -333,4 +345,59 @@ static inline void *kzalloc_node(size_t
60653
60654 void __init kmem_cache_init_late(void);
60655
60656 +#define kmalloc(x, y) \
60657 +({ \
60658 + void *___retval; \
60659 + intoverflow_t ___x = (intoverflow_t)x; \
60660 + if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n")) \
60661 + ___retval = NULL; \
60662 + else \
60663 + ___retval = kmalloc((size_t)___x, (y)); \
60664 + ___retval; \
60665 +})
60666 +
60667 +#define kmalloc_node(x, y, z) \
60668 +({ \
60669 + void *___retval; \
60670 + intoverflow_t ___x = (intoverflow_t)x; \
60671 + if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
60672 + ___retval = NULL; \
60673 + else \
60674 + ___retval = kmalloc_node((size_t)___x, (y), (z));\
60675 + ___retval; \
60676 +})
60677 +
60678 +#define kzalloc(x, y) \
60679 +({ \
60680 + void *___retval; \
60681 + intoverflow_t ___x = (intoverflow_t)x; \
60682 + if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n")) \
60683 + ___retval = NULL; \
60684 + else \
60685 + ___retval = kzalloc((size_t)___x, (y)); \
60686 + ___retval; \
60687 +})
60688 +
60689 +#define __krealloc(x, y, z) \
60690 +({ \
60691 + void *___retval; \
60692 + intoverflow_t ___y = (intoverflow_t)y; \
60693 + if (WARN(___y > ULONG_MAX, "__krealloc size overflow\n"))\
60694 + ___retval = NULL; \
60695 + else \
60696 + ___retval = __krealloc((x), (size_t)___y, (z)); \
60697 + ___retval; \
60698 +})
60699 +
60700 +#define krealloc(x, y, z) \
60701 +({ \
60702 + void *___retval; \
60703 + intoverflow_t ___y = (intoverflow_t)y; \
60704 + if (WARN(___y > ULONG_MAX, "krealloc size overflow\n")) \
60705 + ___retval = NULL; \
60706 + else \
60707 + ___retval = krealloc((x), (size_t)___y, (z)); \
60708 + ___retval; \
60709 +})
60710 +
60711 #endif /* _LINUX_SLAB_H */
60712 diff -urNp linux-3.0.9/include/linux/slub_def.h linux-3.0.9/include/linux/slub_def.h
60713 --- linux-3.0.9/include/linux/slub_def.h 2011-11-11 13:12:24.000000000 -0500
60714 +++ linux-3.0.9/include/linux/slub_def.h 2011-11-15 20:03:00.000000000 -0500
60715 @@ -82,7 +82,7 @@ struct kmem_cache {
60716 struct kmem_cache_order_objects max;
60717 struct kmem_cache_order_objects min;
60718 gfp_t allocflags; /* gfp flags to use on each alloc */
60719 - int refcount; /* Refcount for slab cache destroy */
60720 + atomic_t refcount; /* Refcount for slab cache destroy */
60721 void (*ctor)(void *);
60722 int inuse; /* Offset to metadata */
60723 int align; /* Alignment */
60724 @@ -218,7 +218,7 @@ static __always_inline struct kmem_cache
60725 }
60726
60727 void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
60728 -void *__kmalloc(size_t size, gfp_t flags);
60729 +void *__kmalloc(size_t size, gfp_t flags) __alloc_size(1);
60730
60731 static __always_inline void *
60732 kmalloc_order(size_t size, gfp_t flags, unsigned int order)
60733 diff -urNp linux-3.0.9/include/linux/sonet.h linux-3.0.9/include/linux/sonet.h
60734 --- linux-3.0.9/include/linux/sonet.h 2011-11-11 13:12:24.000000000 -0500
60735 +++ linux-3.0.9/include/linux/sonet.h 2011-11-15 20:03:00.000000000 -0500
60736 @@ -61,7 +61,7 @@ struct sonet_stats {
60737 #include <asm/atomic.h>
60738
60739 struct k_sonet_stats {
60740 -#define __HANDLE_ITEM(i) atomic_t i
60741 +#define __HANDLE_ITEM(i) atomic_unchecked_t i
60742 __SONET_ITEMS
60743 #undef __HANDLE_ITEM
60744 };
60745 diff -urNp linux-3.0.9/include/linux/sunrpc/clnt.h linux-3.0.9/include/linux/sunrpc/clnt.h
60746 --- linux-3.0.9/include/linux/sunrpc/clnt.h 2011-11-11 13:12:24.000000000 -0500
60747 +++ linux-3.0.9/include/linux/sunrpc/clnt.h 2011-11-15 20:03:00.000000000 -0500
60748 @@ -169,9 +169,9 @@ static inline unsigned short rpc_get_por
60749 {
60750 switch (sap->sa_family) {
60751 case AF_INET:
60752 - return ntohs(((struct sockaddr_in *)sap)->sin_port);
60753 + return ntohs(((const struct sockaddr_in *)sap)->sin_port);
60754 case AF_INET6:
60755 - return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
60756 + return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
60757 }
60758 return 0;
60759 }
60760 @@ -204,7 +204,7 @@ static inline bool __rpc_cmp_addr4(const
60761 static inline bool __rpc_copy_addr4(struct sockaddr *dst,
60762 const struct sockaddr *src)
60763 {
60764 - const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
60765 + const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
60766 struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
60767
60768 dsin->sin_family = ssin->sin_family;
60769 @@ -301,7 +301,7 @@ static inline u32 rpc_get_scope_id(const
60770 if (sa->sa_family != AF_INET6)
60771 return 0;
60772
60773 - return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
60774 + return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
60775 }
60776
60777 #endif /* __KERNEL__ */
60778 diff -urNp linux-3.0.9/include/linux/sunrpc/svc_rdma.h linux-3.0.9/include/linux/sunrpc/svc_rdma.h
60779 --- linux-3.0.9/include/linux/sunrpc/svc_rdma.h 2011-11-11 13:12:24.000000000 -0500
60780 +++ linux-3.0.9/include/linux/sunrpc/svc_rdma.h 2011-11-15 20:03:00.000000000 -0500
60781 @@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
60782 extern unsigned int svcrdma_max_requests;
60783 extern unsigned int svcrdma_max_req_size;
60784
60785 -extern atomic_t rdma_stat_recv;
60786 -extern atomic_t rdma_stat_read;
60787 -extern atomic_t rdma_stat_write;
60788 -extern atomic_t rdma_stat_sq_starve;
60789 -extern atomic_t rdma_stat_rq_starve;
60790 -extern atomic_t rdma_stat_rq_poll;
60791 -extern atomic_t rdma_stat_rq_prod;
60792 -extern atomic_t rdma_stat_sq_poll;
60793 -extern atomic_t rdma_stat_sq_prod;
60794 +extern atomic_unchecked_t rdma_stat_recv;
60795 +extern atomic_unchecked_t rdma_stat_read;
60796 +extern atomic_unchecked_t rdma_stat_write;
60797 +extern atomic_unchecked_t rdma_stat_sq_starve;
60798 +extern atomic_unchecked_t rdma_stat_rq_starve;
60799 +extern atomic_unchecked_t rdma_stat_rq_poll;
60800 +extern atomic_unchecked_t rdma_stat_rq_prod;
60801 +extern atomic_unchecked_t rdma_stat_sq_poll;
60802 +extern atomic_unchecked_t rdma_stat_sq_prod;
60803
60804 #define RPCRDMA_VERSION 1
60805
60806 diff -urNp linux-3.0.9/include/linux/sysctl.h linux-3.0.9/include/linux/sysctl.h
60807 --- linux-3.0.9/include/linux/sysctl.h 2011-11-11 13:12:24.000000000 -0500
60808 +++ linux-3.0.9/include/linux/sysctl.h 2011-11-15 20:03:00.000000000 -0500
60809 @@ -155,7 +155,11 @@ enum
60810 KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
60811 };
60812
60813 -
60814 +#ifdef CONFIG_PAX_SOFTMODE
60815 +enum {
60816 + PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
60817 +};
60818 +#endif
60819
60820 /* CTL_VM names: */
60821 enum
60822 @@ -967,6 +971,8 @@ typedef int proc_handler (struct ctl_tab
60823
60824 extern int proc_dostring(struct ctl_table *, int,
60825 void __user *, size_t *, loff_t *);
60826 +extern int proc_dostring_modpriv(struct ctl_table *, int,
60827 + void __user *, size_t *, loff_t *);
60828 extern int proc_dointvec(struct ctl_table *, int,
60829 void __user *, size_t *, loff_t *);
60830 extern int proc_dointvec_minmax(struct ctl_table *, int,
60831 diff -urNp linux-3.0.9/include/linux/tty_ldisc.h linux-3.0.9/include/linux/tty_ldisc.h
60832 --- linux-3.0.9/include/linux/tty_ldisc.h 2011-11-11 13:12:24.000000000 -0500
60833 +++ linux-3.0.9/include/linux/tty_ldisc.h 2011-11-15 20:03:00.000000000 -0500
60834 @@ -148,7 +148,7 @@ struct tty_ldisc_ops {
60835
60836 struct module *owner;
60837
60838 - int refcount;
60839 + atomic_t refcount;
60840 };
60841
60842 struct tty_ldisc {
60843 diff -urNp linux-3.0.9/include/linux/types.h linux-3.0.9/include/linux/types.h
60844 --- linux-3.0.9/include/linux/types.h 2011-11-11 13:12:24.000000000 -0500
60845 +++ linux-3.0.9/include/linux/types.h 2011-11-15 20:03:00.000000000 -0500
60846 @@ -213,10 +213,26 @@ typedef struct {
60847 int counter;
60848 } atomic_t;
60849
60850 +#ifdef CONFIG_PAX_REFCOUNT
60851 +typedef struct {
60852 + int counter;
60853 +} atomic_unchecked_t;
60854 +#else
60855 +typedef atomic_t atomic_unchecked_t;
60856 +#endif
60857 +
60858 #ifdef CONFIG_64BIT
60859 typedef struct {
60860 long counter;
60861 } atomic64_t;
60862 +
60863 +#ifdef CONFIG_PAX_REFCOUNT
60864 +typedef struct {
60865 + long counter;
60866 +} atomic64_unchecked_t;
60867 +#else
60868 +typedef atomic64_t atomic64_unchecked_t;
60869 +#endif
60870 #endif
60871
60872 struct list_head {
60873 diff -urNp linux-3.0.9/include/linux/uaccess.h linux-3.0.9/include/linux/uaccess.h
60874 --- linux-3.0.9/include/linux/uaccess.h 2011-11-11 13:12:24.000000000 -0500
60875 +++ linux-3.0.9/include/linux/uaccess.h 2011-11-15 20:03:00.000000000 -0500
60876 @@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
60877 long ret; \
60878 mm_segment_t old_fs = get_fs(); \
60879 \
60880 - set_fs(KERNEL_DS); \
60881 pagefault_disable(); \
60882 - ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
60883 - pagefault_enable(); \
60884 + set_fs(KERNEL_DS); \
60885 + ret = __copy_from_user_inatomic(&(retval), (typeof(retval) __force_user *)(addr), sizeof(retval)); \
60886 set_fs(old_fs); \
60887 + pagefault_enable(); \
60888 ret; \
60889 })
60890
60891 diff -urNp linux-3.0.9/include/linux/unaligned/access_ok.h linux-3.0.9/include/linux/unaligned/access_ok.h
60892 --- linux-3.0.9/include/linux/unaligned/access_ok.h 2011-11-11 13:12:24.000000000 -0500
60893 +++ linux-3.0.9/include/linux/unaligned/access_ok.h 2011-11-15 20:03:00.000000000 -0500
60894 @@ -6,32 +6,32 @@
60895
60896 static inline u16 get_unaligned_le16(const void *p)
60897 {
60898 - return le16_to_cpup((__le16 *)p);
60899 + return le16_to_cpup((const __le16 *)p);
60900 }
60901
60902 static inline u32 get_unaligned_le32(const void *p)
60903 {
60904 - return le32_to_cpup((__le32 *)p);
60905 + return le32_to_cpup((const __le32 *)p);
60906 }
60907
60908 static inline u64 get_unaligned_le64(const void *p)
60909 {
60910 - return le64_to_cpup((__le64 *)p);
60911 + return le64_to_cpup((const __le64 *)p);
60912 }
60913
60914 static inline u16 get_unaligned_be16(const void *p)
60915 {
60916 - return be16_to_cpup((__be16 *)p);
60917 + return be16_to_cpup((const __be16 *)p);
60918 }
60919
60920 static inline u32 get_unaligned_be32(const void *p)
60921 {
60922 - return be32_to_cpup((__be32 *)p);
60923 + return be32_to_cpup((const __be32 *)p);
60924 }
60925
60926 static inline u64 get_unaligned_be64(const void *p)
60927 {
60928 - return be64_to_cpup((__be64 *)p);
60929 + return be64_to_cpup((const __be64 *)p);
60930 }
60931
60932 static inline void put_unaligned_le16(u16 val, void *p)
60933 diff -urNp linux-3.0.9/include/linux/vermagic.h linux-3.0.9/include/linux/vermagic.h
60934 --- linux-3.0.9/include/linux/vermagic.h 2011-11-11 13:12:24.000000000 -0500
60935 +++ linux-3.0.9/include/linux/vermagic.h 2011-11-15 20:03:00.000000000 -0500
60936 @@ -26,9 +26,28 @@
60937 #define MODULE_ARCH_VERMAGIC ""
60938 #endif
60939
60940 +#ifdef CONFIG_PAX_REFCOUNT
60941 +#define MODULE_PAX_REFCOUNT "REFCOUNT "
60942 +#else
60943 +#define MODULE_PAX_REFCOUNT ""
60944 +#endif
60945 +
60946 +#ifdef CONSTIFY_PLUGIN
60947 +#define MODULE_CONSTIFY_PLUGIN "CONSTIFY_PLUGIN "
60948 +#else
60949 +#define MODULE_CONSTIFY_PLUGIN ""
60950 +#endif
60951 +
60952 +#ifdef CONFIG_GRKERNSEC
60953 +#define MODULE_GRSEC "GRSEC "
60954 +#else
60955 +#define MODULE_GRSEC ""
60956 +#endif
60957 +
60958 #define VERMAGIC_STRING \
60959 UTS_RELEASE " " \
60960 MODULE_VERMAGIC_SMP MODULE_VERMAGIC_PREEMPT \
60961 MODULE_VERMAGIC_MODULE_UNLOAD MODULE_VERMAGIC_MODVERSIONS \
60962 - MODULE_ARCH_VERMAGIC
60963 + MODULE_ARCH_VERMAGIC \
60964 + MODULE_PAX_REFCOUNT MODULE_CONSTIFY_PLUGIN MODULE_GRSEC
60965
60966 diff -urNp linux-3.0.9/include/linux/vmalloc.h linux-3.0.9/include/linux/vmalloc.h
60967 --- linux-3.0.9/include/linux/vmalloc.h 2011-11-11 13:12:24.000000000 -0500
60968 +++ linux-3.0.9/include/linux/vmalloc.h 2011-11-15 20:03:00.000000000 -0500
60969 @@ -14,6 +14,11 @@ struct vm_area_struct; /* vma defining
60970 #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
60971 #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
60972 #define VM_UNLIST 0x00000020 /* vm_struct is not listed in vmlist */
60973 +
60974 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
60975 +#define VM_KERNEXEC 0x00000040 /* allocate from executable kernel memory range */
60976 +#endif
60977 +
60978 /* bits [20..32] reserved for arch specific ioremap internals */
60979
60980 /*
60981 @@ -156,4 +161,103 @@ pcpu_free_vm_areas(struct vm_struct **vm
60982 # endif
60983 #endif
60984
60985 +#define vmalloc(x) \
60986 +({ \
60987 + void *___retval; \
60988 + intoverflow_t ___x = (intoverflow_t)x; \
60989 + if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n")) \
60990 + ___retval = NULL; \
60991 + else \
60992 + ___retval = vmalloc((unsigned long)___x); \
60993 + ___retval; \
60994 +})
60995 +
60996 +#define vzalloc(x) \
60997 +({ \
60998 + void *___retval; \
60999 + intoverflow_t ___x = (intoverflow_t)x; \
61000 + if (WARN(___x > ULONG_MAX, "vzalloc size overflow\n")) \
61001 + ___retval = NULL; \
61002 + else \
61003 + ___retval = vzalloc((unsigned long)___x); \
61004 + ___retval; \
61005 +})
61006 +
61007 +#define __vmalloc(x, y, z) \
61008 +({ \
61009 + void *___retval; \
61010 + intoverflow_t ___x = (intoverflow_t)x; \
61011 + if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
61012 + ___retval = NULL; \
61013 + else \
61014 + ___retval = __vmalloc((unsigned long)___x, (y), (z));\
61015 + ___retval; \
61016 +})
61017 +
61018 +#define vmalloc_user(x) \
61019 +({ \
61020 + void *___retval; \
61021 + intoverflow_t ___x = (intoverflow_t)x; \
61022 + if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
61023 + ___retval = NULL; \
61024 + else \
61025 + ___retval = vmalloc_user((unsigned long)___x); \
61026 + ___retval; \
61027 +})
61028 +
61029 +#define vmalloc_exec(x) \
61030 +({ \
61031 + void *___retval; \
61032 + intoverflow_t ___x = (intoverflow_t)x; \
61033 + if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
61034 + ___retval = NULL; \
61035 + else \
61036 + ___retval = vmalloc_exec((unsigned long)___x); \
61037 + ___retval; \
61038 +})
61039 +
61040 +#define vmalloc_node(x, y) \
61041 +({ \
61042 + void *___retval; \
61043 + intoverflow_t ___x = (intoverflow_t)x; \
61044 + if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
61045 + ___retval = NULL; \
61046 + else \
61047 + ___retval = vmalloc_node((unsigned long)___x, (y));\
61048 + ___retval; \
61049 +})
61050 +
61051 +#define vzalloc_node(x, y) \
61052 +({ \
61053 + void *___retval; \
61054 + intoverflow_t ___x = (intoverflow_t)x; \
61055 + if (WARN(___x > ULONG_MAX, "vzalloc_node size overflow\n"))\
61056 + ___retval = NULL; \
61057 + else \
61058 + ___retval = vzalloc_node((unsigned long)___x, (y));\
61059 + ___retval; \
61060 +})
61061 +
61062 +#define vmalloc_32(x) \
61063 +({ \
61064 + void *___retval; \
61065 + intoverflow_t ___x = (intoverflow_t)x; \
61066 + if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
61067 + ___retval = NULL; \
61068 + else \
61069 + ___retval = vmalloc_32((unsigned long)___x); \
61070 + ___retval; \
61071 +})
61072 +
61073 +#define vmalloc_32_user(x) \
61074 +({ \
61075 +void *___retval; \
61076 + intoverflow_t ___x = (intoverflow_t)x; \
61077 + if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
61078 + ___retval = NULL; \
61079 + else \
61080 + ___retval = vmalloc_32_user((unsigned long)___x);\
61081 + ___retval; \
61082 +})
61083 +
61084 #endif /* _LINUX_VMALLOC_H */
61085 diff -urNp linux-3.0.9/include/linux/vmstat.h linux-3.0.9/include/linux/vmstat.h
61086 --- linux-3.0.9/include/linux/vmstat.h 2011-11-11 13:12:24.000000000 -0500
61087 +++ linux-3.0.9/include/linux/vmstat.h 2011-11-15 20:03:00.000000000 -0500
61088 @@ -87,18 +87,18 @@ static inline void vm_events_fold_cpu(in
61089 /*
61090 * Zone based page accounting with per cpu differentials.
61091 */
61092 -extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
61093 +extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
61094
61095 static inline void zone_page_state_add(long x, struct zone *zone,
61096 enum zone_stat_item item)
61097 {
61098 - atomic_long_add(x, &zone->vm_stat[item]);
61099 - atomic_long_add(x, &vm_stat[item]);
61100 + atomic_long_add_unchecked(x, &zone->vm_stat[item]);
61101 + atomic_long_add_unchecked(x, &vm_stat[item]);
61102 }
61103
61104 static inline unsigned long global_page_state(enum zone_stat_item item)
61105 {
61106 - long x = atomic_long_read(&vm_stat[item]);
61107 + long x = atomic_long_read_unchecked(&vm_stat[item]);
61108 #ifdef CONFIG_SMP
61109 if (x < 0)
61110 x = 0;
61111 @@ -109,7 +109,7 @@ static inline unsigned long global_page_
61112 static inline unsigned long zone_page_state(struct zone *zone,
61113 enum zone_stat_item item)
61114 {
61115 - long x = atomic_long_read(&zone->vm_stat[item]);
61116 + long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
61117 #ifdef CONFIG_SMP
61118 if (x < 0)
61119 x = 0;
61120 @@ -126,7 +126,7 @@ static inline unsigned long zone_page_st
61121 static inline unsigned long zone_page_state_snapshot(struct zone *zone,
61122 enum zone_stat_item item)
61123 {
61124 - long x = atomic_long_read(&zone->vm_stat[item]);
61125 + long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
61126
61127 #ifdef CONFIG_SMP
61128 int cpu;
61129 @@ -221,8 +221,8 @@ static inline void __mod_zone_page_state
61130
61131 static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
61132 {
61133 - atomic_long_inc(&zone->vm_stat[item]);
61134 - atomic_long_inc(&vm_stat[item]);
61135 + atomic_long_inc_unchecked(&zone->vm_stat[item]);
61136 + atomic_long_inc_unchecked(&vm_stat[item]);
61137 }
61138
61139 static inline void __inc_zone_page_state(struct page *page,
61140 @@ -233,8 +233,8 @@ static inline void __inc_zone_page_state
61141
61142 static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
61143 {
61144 - atomic_long_dec(&zone->vm_stat[item]);
61145 - atomic_long_dec(&vm_stat[item]);
61146 + atomic_long_dec_unchecked(&zone->vm_stat[item]);
61147 + atomic_long_dec_unchecked(&vm_stat[item]);
61148 }
61149
61150 static inline void __dec_zone_page_state(struct page *page,
61151 diff -urNp linux-3.0.9/include/media/saa7146_vv.h linux-3.0.9/include/media/saa7146_vv.h
61152 --- linux-3.0.9/include/media/saa7146_vv.h 2011-11-11 13:12:24.000000000 -0500
61153 +++ linux-3.0.9/include/media/saa7146_vv.h 2011-11-15 20:03:00.000000000 -0500
61154 @@ -163,7 +163,7 @@ struct saa7146_ext_vv
61155 int (*std_callback)(struct saa7146_dev*, struct saa7146_standard *);
61156
61157 /* the extension can override this */
61158 - struct v4l2_ioctl_ops ops;
61159 + v4l2_ioctl_ops_no_const ops;
61160 /* pointer to the saa7146 core ops */
61161 const struct v4l2_ioctl_ops *core_ops;
61162
61163 diff -urNp linux-3.0.9/include/media/v4l2-dev.h linux-3.0.9/include/media/v4l2-dev.h
61164 --- linux-3.0.9/include/media/v4l2-dev.h 2011-11-11 13:12:24.000000000 -0500
61165 +++ linux-3.0.9/include/media/v4l2-dev.h 2011-11-15 20:03:00.000000000 -0500
61166 @@ -56,7 +56,7 @@ int v4l2_prio_check(struct v4l2_prio_sta
61167
61168
61169 struct v4l2_file_operations {
61170 - struct module *owner;
61171 + struct module * const owner;
61172 ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
61173 ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
61174 unsigned int (*poll) (struct file *, struct poll_table_struct *);
61175 @@ -68,6 +68,7 @@ struct v4l2_file_operations {
61176 int (*open) (struct file *);
61177 int (*release) (struct file *);
61178 };
61179 +typedef struct v4l2_file_operations __no_const v4l2_file_operations_no_const;
61180
61181 /*
61182 * Newer version of video_device, handled by videodev2.c
61183 diff -urNp linux-3.0.9/include/media/v4l2-ioctl.h linux-3.0.9/include/media/v4l2-ioctl.h
61184 --- linux-3.0.9/include/media/v4l2-ioctl.h 2011-11-11 13:12:24.000000000 -0500
61185 +++ linux-3.0.9/include/media/v4l2-ioctl.h 2011-11-15 20:03:00.000000000 -0500
61186 @@ -272,6 +272,7 @@ struct v4l2_ioctl_ops {
61187 long (*vidioc_default) (struct file *file, void *fh,
61188 bool valid_prio, int cmd, void *arg);
61189 };
61190 +typedef struct v4l2_ioctl_ops __no_const v4l2_ioctl_ops_no_const;
61191
61192
61193 /* v4l debugging and diagnostics */
61194 diff -urNp linux-3.0.9/include/net/caif/cfctrl.h linux-3.0.9/include/net/caif/cfctrl.h
61195 --- linux-3.0.9/include/net/caif/cfctrl.h 2011-11-11 13:12:24.000000000 -0500
61196 +++ linux-3.0.9/include/net/caif/cfctrl.h 2011-11-15 20:03:00.000000000 -0500
61197 @@ -52,7 +52,7 @@ struct cfctrl_rsp {
61198 void (*radioset_rsp)(void);
61199 void (*reject_rsp)(struct cflayer *layer, u8 linkid,
61200 struct cflayer *client_layer);
61201 -};
61202 +} __no_const;
61203
61204 /* Link Setup Parameters for CAIF-Links. */
61205 struct cfctrl_link_param {
61206 @@ -101,8 +101,8 @@ struct cfctrl_request_info {
61207 struct cfctrl {
61208 struct cfsrvl serv;
61209 struct cfctrl_rsp res;
61210 - atomic_t req_seq_no;
61211 - atomic_t rsp_seq_no;
61212 + atomic_unchecked_t req_seq_no;
61213 + atomic_unchecked_t rsp_seq_no;
61214 struct list_head list;
61215 /* Protects from simultaneous access to first_req list */
61216 spinlock_t info_list_lock;
61217 diff -urNp linux-3.0.9/include/net/flow.h linux-3.0.9/include/net/flow.h
61218 --- linux-3.0.9/include/net/flow.h 2011-11-11 13:12:24.000000000 -0500
61219 +++ linux-3.0.9/include/net/flow.h 2011-11-15 20:03:00.000000000 -0500
61220 @@ -207,6 +207,6 @@ extern struct flow_cache_object *flow_ca
61221 u8 dir, flow_resolve_t resolver, void *ctx);
61222
61223 extern void flow_cache_flush(void);
61224 -extern atomic_t flow_cache_genid;
61225 +extern atomic_unchecked_t flow_cache_genid;
61226
61227 #endif
61228 diff -urNp linux-3.0.9/include/net/inetpeer.h linux-3.0.9/include/net/inetpeer.h
61229 --- linux-3.0.9/include/net/inetpeer.h 2011-11-11 13:12:24.000000000 -0500
61230 +++ linux-3.0.9/include/net/inetpeer.h 2011-11-15 20:03:00.000000000 -0500
61231 @@ -43,8 +43,8 @@ struct inet_peer {
61232 */
61233 union {
61234 struct {
61235 - atomic_t rid; /* Frag reception counter */
61236 - atomic_t ip_id_count; /* IP ID for the next packet */
61237 + atomic_unchecked_t rid; /* Frag reception counter */
61238 + atomic_unchecked_t ip_id_count; /* IP ID for the next packet */
61239 __u32 tcp_ts;
61240 __u32 tcp_ts_stamp;
61241 u32 metrics[RTAX_MAX];
61242 @@ -108,7 +108,7 @@ static inline __u16 inet_getid(struct in
61243 {
61244 more++;
61245 inet_peer_refcheck(p);
61246 - return atomic_add_return(more, &p->ip_id_count) - more;
61247 + return atomic_add_return_unchecked(more, &p->ip_id_count) - more;
61248 }
61249
61250 #endif /* _NET_INETPEER_H */
61251 diff -urNp linux-3.0.9/include/net/ip_fib.h linux-3.0.9/include/net/ip_fib.h
61252 --- linux-3.0.9/include/net/ip_fib.h 2011-11-11 13:12:24.000000000 -0500
61253 +++ linux-3.0.9/include/net/ip_fib.h 2011-11-15 20:03:00.000000000 -0500
61254 @@ -146,7 +146,7 @@ extern __be32 fib_info_update_nh_saddr(s
61255
61256 #define FIB_RES_SADDR(net, res) \
61257 ((FIB_RES_NH(res).nh_saddr_genid == \
61258 - atomic_read(&(net)->ipv4.dev_addr_genid)) ? \
61259 + atomic_read_unchecked(&(net)->ipv4.dev_addr_genid)) ? \
61260 FIB_RES_NH(res).nh_saddr : \
61261 fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
61262 #define FIB_RES_GW(res) (FIB_RES_NH(res).nh_gw)
61263 diff -urNp linux-3.0.9/include/net/ip_vs.h linux-3.0.9/include/net/ip_vs.h
61264 --- linux-3.0.9/include/net/ip_vs.h 2011-11-11 13:12:24.000000000 -0500
61265 +++ linux-3.0.9/include/net/ip_vs.h 2011-11-15 20:03:00.000000000 -0500
61266 @@ -509,7 +509,7 @@ struct ip_vs_conn {
61267 struct ip_vs_conn *control; /* Master control connection */
61268 atomic_t n_control; /* Number of controlled ones */
61269 struct ip_vs_dest *dest; /* real server */
61270 - atomic_t in_pkts; /* incoming packet counter */
61271 + atomic_unchecked_t in_pkts; /* incoming packet counter */
61272
61273 /* packet transmitter for different forwarding methods. If it
61274 mangles the packet, it must return NF_DROP or better NF_STOLEN,
61275 @@ -647,7 +647,7 @@ struct ip_vs_dest {
61276 __be16 port; /* port number of the server */
61277 union nf_inet_addr addr; /* IP address of the server */
61278 volatile unsigned flags; /* dest status flags */
61279 - atomic_t conn_flags; /* flags to copy to conn */
61280 + atomic_unchecked_t conn_flags; /* flags to copy to conn */
61281 atomic_t weight; /* server weight */
61282
61283 atomic_t refcnt; /* reference counter */
61284 diff -urNp linux-3.0.9/include/net/irda/ircomm_core.h linux-3.0.9/include/net/irda/ircomm_core.h
61285 --- linux-3.0.9/include/net/irda/ircomm_core.h 2011-11-11 13:12:24.000000000 -0500
61286 +++ linux-3.0.9/include/net/irda/ircomm_core.h 2011-11-15 20:03:00.000000000 -0500
61287 @@ -51,7 +51,7 @@ typedef struct {
61288 int (*connect_response)(struct ircomm_cb *, struct sk_buff *);
61289 int (*disconnect_request)(struct ircomm_cb *, struct sk_buff *,
61290 struct ircomm_info *);
61291 -} call_t;
61292 +} __no_const call_t;
61293
61294 struct ircomm_cb {
61295 irda_queue_t queue;
61296 diff -urNp linux-3.0.9/include/net/irda/ircomm_tty.h linux-3.0.9/include/net/irda/ircomm_tty.h
61297 --- linux-3.0.9/include/net/irda/ircomm_tty.h 2011-11-11 13:12:24.000000000 -0500
61298 +++ linux-3.0.9/include/net/irda/ircomm_tty.h 2011-11-15 20:03:00.000000000 -0500
61299 @@ -35,6 +35,7 @@
61300 #include <linux/termios.h>
61301 #include <linux/timer.h>
61302 #include <linux/tty.h> /* struct tty_struct */
61303 +#include <asm/local.h>
61304
61305 #include <net/irda/irias_object.h>
61306 #include <net/irda/ircomm_core.h>
61307 @@ -105,8 +106,8 @@ struct ircomm_tty_cb {
61308 unsigned short close_delay;
61309 unsigned short closing_wait; /* time to wait before closing */
61310
61311 - int open_count;
61312 - int blocked_open; /* # of blocked opens */
61313 + local_t open_count;
61314 + local_t blocked_open; /* # of blocked opens */
61315
61316 /* Protect concurent access to :
61317 * o self->open_count
61318 diff -urNp linux-3.0.9/include/net/iucv/af_iucv.h linux-3.0.9/include/net/iucv/af_iucv.h
61319 --- linux-3.0.9/include/net/iucv/af_iucv.h 2011-11-11 13:12:24.000000000 -0500
61320 +++ linux-3.0.9/include/net/iucv/af_iucv.h 2011-11-15 20:03:00.000000000 -0500
61321 @@ -87,7 +87,7 @@ struct iucv_sock {
61322 struct iucv_sock_list {
61323 struct hlist_head head;
61324 rwlock_t lock;
61325 - atomic_t autobind_name;
61326 + atomic_unchecked_t autobind_name;
61327 };
61328
61329 unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
61330 diff -urNp linux-3.0.9/include/net/lapb.h linux-3.0.9/include/net/lapb.h
61331 --- linux-3.0.9/include/net/lapb.h 2011-11-11 13:12:24.000000000 -0500
61332 +++ linux-3.0.9/include/net/lapb.h 2011-11-15 20:03:00.000000000 -0500
61333 @@ -95,7 +95,7 @@ struct lapb_cb {
61334 struct sk_buff_head write_queue;
61335 struct sk_buff_head ack_queue;
61336 unsigned char window;
61337 - struct lapb_register_struct callbacks;
61338 + struct lapb_register_struct *callbacks;
61339
61340 /* FRMR control information */
61341 struct lapb_frame frmr_data;
61342 diff -urNp linux-3.0.9/include/net/neighbour.h linux-3.0.9/include/net/neighbour.h
61343 --- linux-3.0.9/include/net/neighbour.h 2011-11-11 13:12:24.000000000 -0500
61344 +++ linux-3.0.9/include/net/neighbour.h 2011-11-15 20:03:00.000000000 -0500
61345 @@ -124,7 +124,7 @@ struct neigh_ops {
61346 int (*connected_output)(struct sk_buff*);
61347 int (*hh_output)(struct sk_buff*);
61348 int (*queue_xmit)(struct sk_buff*);
61349 -};
61350 +} __do_const;
61351
61352 struct pneigh_entry {
61353 struct pneigh_entry *next;
61354 diff -urNp linux-3.0.9/include/net/netlink.h linux-3.0.9/include/net/netlink.h
61355 --- linux-3.0.9/include/net/netlink.h 2011-11-11 13:12:24.000000000 -0500
61356 +++ linux-3.0.9/include/net/netlink.h 2011-11-15 20:03:00.000000000 -0500
61357 @@ -562,7 +562,7 @@ static inline void *nlmsg_get_pos(struct
61358 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
61359 {
61360 if (mark)
61361 - skb_trim(skb, (unsigned char *) mark - skb->data);
61362 + skb_trim(skb, (const unsigned char *) mark - skb->data);
61363 }
61364
61365 /**
61366 diff -urNp linux-3.0.9/include/net/netns/ipv4.h linux-3.0.9/include/net/netns/ipv4.h
61367 --- linux-3.0.9/include/net/netns/ipv4.h 2011-11-11 13:12:24.000000000 -0500
61368 +++ linux-3.0.9/include/net/netns/ipv4.h 2011-11-15 20:03:00.000000000 -0500
61369 @@ -56,8 +56,8 @@ struct netns_ipv4 {
61370
61371 unsigned int sysctl_ping_group_range[2];
61372
61373 - atomic_t rt_genid;
61374 - atomic_t dev_addr_genid;
61375 + atomic_unchecked_t rt_genid;
61376 + atomic_unchecked_t dev_addr_genid;
61377
61378 #ifdef CONFIG_IP_MROUTE
61379 #ifndef CONFIG_IP_MROUTE_MULTIPLE_TABLES
61380 diff -urNp linux-3.0.9/include/net/sctp/sctp.h linux-3.0.9/include/net/sctp/sctp.h
61381 --- linux-3.0.9/include/net/sctp/sctp.h 2011-11-11 13:12:24.000000000 -0500
61382 +++ linux-3.0.9/include/net/sctp/sctp.h 2011-11-15 20:03:00.000000000 -0500
61383 @@ -315,9 +315,9 @@ do { \
61384
61385 #else /* SCTP_DEBUG */
61386
61387 -#define SCTP_DEBUG_PRINTK(whatever...)
61388 -#define SCTP_DEBUG_PRINTK_CONT(fmt, args...)
61389 -#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
61390 +#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
61391 +#define SCTP_DEBUG_PRINTK_CONT(fmt, args...) do {} while (0)
61392 +#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
61393 #define SCTP_ENABLE_DEBUG
61394 #define SCTP_DISABLE_DEBUG
61395 #define SCTP_ASSERT(expr, str, func)
61396 diff -urNp linux-3.0.9/include/net/sock.h linux-3.0.9/include/net/sock.h
61397 --- linux-3.0.9/include/net/sock.h 2011-11-11 13:12:24.000000000 -0500
61398 +++ linux-3.0.9/include/net/sock.h 2011-11-15 20:03:00.000000000 -0500
61399 @@ -277,7 +277,7 @@ struct sock {
61400 #ifdef CONFIG_RPS
61401 __u32 sk_rxhash;
61402 #endif
61403 - atomic_t sk_drops;
61404 + atomic_unchecked_t sk_drops;
61405 int sk_rcvbuf;
61406
61407 struct sk_filter __rcu *sk_filter;
61408 @@ -1390,7 +1390,7 @@ static inline void sk_nocaps_add(struct
61409 }
61410
61411 static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb,
61412 - char __user *from, char *to,
61413 + char __user *from, unsigned char *to,
61414 int copy, int offset)
61415 {
61416 if (skb->ip_summed == CHECKSUM_NONE) {
61417 diff -urNp linux-3.0.9/include/net/tcp.h linux-3.0.9/include/net/tcp.h
61418 --- linux-3.0.9/include/net/tcp.h 2011-11-11 13:12:24.000000000 -0500
61419 +++ linux-3.0.9/include/net/tcp.h 2011-11-15 20:03:00.000000000 -0500
61420 @@ -1374,8 +1374,8 @@ enum tcp_seq_states {
61421 struct tcp_seq_afinfo {
61422 char *name;
61423 sa_family_t family;
61424 - struct file_operations seq_fops;
61425 - struct seq_operations seq_ops;
61426 + file_operations_no_const seq_fops;
61427 + seq_operations_no_const seq_ops;
61428 };
61429
61430 struct tcp_iter_state {
61431 diff -urNp linux-3.0.9/include/net/udp.h linux-3.0.9/include/net/udp.h
61432 --- linux-3.0.9/include/net/udp.h 2011-11-11 13:12:24.000000000 -0500
61433 +++ linux-3.0.9/include/net/udp.h 2011-11-15 20:03:00.000000000 -0500
61434 @@ -234,8 +234,8 @@ struct udp_seq_afinfo {
61435 char *name;
61436 sa_family_t family;
61437 struct udp_table *udp_table;
61438 - struct file_operations seq_fops;
61439 - struct seq_operations seq_ops;
61440 + file_operations_no_const seq_fops;
61441 + seq_operations_no_const seq_ops;
61442 };
61443
61444 struct udp_iter_state {
61445 diff -urNp linux-3.0.9/include/net/xfrm.h linux-3.0.9/include/net/xfrm.h
61446 --- linux-3.0.9/include/net/xfrm.h 2011-11-11 13:12:24.000000000 -0500
61447 +++ linux-3.0.9/include/net/xfrm.h 2011-11-15 20:03:00.000000000 -0500
61448 @@ -505,7 +505,7 @@ struct xfrm_policy {
61449 struct timer_list timer;
61450
61451 struct flow_cache_object flo;
61452 - atomic_t genid;
61453 + atomic_unchecked_t genid;
61454 u32 priority;
61455 u32 index;
61456 struct xfrm_mark mark;
61457 diff -urNp linux-3.0.9/include/rdma/iw_cm.h linux-3.0.9/include/rdma/iw_cm.h
61458 --- linux-3.0.9/include/rdma/iw_cm.h 2011-11-11 13:12:24.000000000 -0500
61459 +++ linux-3.0.9/include/rdma/iw_cm.h 2011-11-15 20:03:00.000000000 -0500
61460 @@ -120,7 +120,7 @@ struct iw_cm_verbs {
61461 int backlog);
61462
61463 int (*destroy_listen)(struct iw_cm_id *cm_id);
61464 -};
61465 +} __no_const;
61466
61467 /**
61468 * iw_create_cm_id - Create an IW CM identifier.
61469 diff -urNp linux-3.0.9/include/scsi/libfc.h linux-3.0.9/include/scsi/libfc.h
61470 --- linux-3.0.9/include/scsi/libfc.h 2011-11-11 13:12:24.000000000 -0500
61471 +++ linux-3.0.9/include/scsi/libfc.h 2011-11-15 20:03:00.000000000 -0500
61472 @@ -750,6 +750,7 @@ struct libfc_function_template {
61473 */
61474 void (*disc_stop_final) (struct fc_lport *);
61475 };
61476 +typedef struct libfc_function_template __no_const libfc_function_template_no_const;
61477
61478 /**
61479 * struct fc_disc - Discovery context
61480 @@ -853,7 +854,7 @@ struct fc_lport {
61481 struct fc_vport *vport;
61482
61483 /* Operational Information */
61484 - struct libfc_function_template tt;
61485 + libfc_function_template_no_const tt;
61486 u8 link_up;
61487 u8 qfull;
61488 enum fc_lport_state state;
61489 diff -urNp linux-3.0.9/include/scsi/scsi_device.h linux-3.0.9/include/scsi/scsi_device.h
61490 --- linux-3.0.9/include/scsi/scsi_device.h 2011-11-11 13:12:24.000000000 -0500
61491 +++ linux-3.0.9/include/scsi/scsi_device.h 2011-11-15 20:03:00.000000000 -0500
61492 @@ -161,9 +161,9 @@ struct scsi_device {
61493 unsigned int max_device_blocked; /* what device_blocked counts down from */
61494 #define SCSI_DEFAULT_DEVICE_BLOCKED 3
61495
61496 - atomic_t iorequest_cnt;
61497 - atomic_t iodone_cnt;
61498 - atomic_t ioerr_cnt;
61499 + atomic_unchecked_t iorequest_cnt;
61500 + atomic_unchecked_t iodone_cnt;
61501 + atomic_unchecked_t ioerr_cnt;
61502
61503 struct device sdev_gendev,
61504 sdev_dev;
61505 diff -urNp linux-3.0.9/include/scsi/scsi_transport_fc.h linux-3.0.9/include/scsi/scsi_transport_fc.h
61506 --- linux-3.0.9/include/scsi/scsi_transport_fc.h 2011-11-11 13:12:24.000000000 -0500
61507 +++ linux-3.0.9/include/scsi/scsi_transport_fc.h 2011-11-15 20:03:00.000000000 -0500
61508 @@ -711,7 +711,7 @@ struct fc_function_template {
61509 unsigned long show_host_system_hostname:1;
61510
61511 unsigned long disable_target_scan:1;
61512 -};
61513 +} __do_const;
61514
61515
61516 /**
61517 diff -urNp linux-3.0.9/include/sound/ak4xxx-adda.h linux-3.0.9/include/sound/ak4xxx-adda.h
61518 --- linux-3.0.9/include/sound/ak4xxx-adda.h 2011-11-11 13:12:24.000000000 -0500
61519 +++ linux-3.0.9/include/sound/ak4xxx-adda.h 2011-11-15 20:03:00.000000000 -0500
61520 @@ -35,7 +35,7 @@ struct snd_ak4xxx_ops {
61521 void (*write)(struct snd_akm4xxx *ak, int chip, unsigned char reg,
61522 unsigned char val);
61523 void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
61524 -};
61525 +} __no_const;
61526
61527 #define AK4XXX_IMAGE_SIZE (AK4XXX_MAX_CHIPS * 16) /* 64 bytes */
61528
61529 diff -urNp linux-3.0.9/include/sound/hwdep.h linux-3.0.9/include/sound/hwdep.h
61530 --- linux-3.0.9/include/sound/hwdep.h 2011-11-11 13:12:24.000000000 -0500
61531 +++ linux-3.0.9/include/sound/hwdep.h 2011-11-15 20:03:00.000000000 -0500
61532 @@ -49,7 +49,7 @@ struct snd_hwdep_ops {
61533 struct snd_hwdep_dsp_status *status);
61534 int (*dsp_load)(struct snd_hwdep *hw,
61535 struct snd_hwdep_dsp_image *image);
61536 -};
61537 +} __no_const;
61538
61539 struct snd_hwdep {
61540 struct snd_card *card;
61541 diff -urNp linux-3.0.9/include/sound/info.h linux-3.0.9/include/sound/info.h
61542 --- linux-3.0.9/include/sound/info.h 2011-11-11 13:12:24.000000000 -0500
61543 +++ linux-3.0.9/include/sound/info.h 2011-11-15 20:03:00.000000000 -0500
61544 @@ -44,7 +44,7 @@ struct snd_info_entry_text {
61545 struct snd_info_buffer *buffer);
61546 void (*write)(struct snd_info_entry *entry,
61547 struct snd_info_buffer *buffer);
61548 -};
61549 +} __no_const;
61550
61551 struct snd_info_entry_ops {
61552 int (*open)(struct snd_info_entry *entry,
61553 diff -urNp linux-3.0.9/include/sound/pcm.h linux-3.0.9/include/sound/pcm.h
61554 --- linux-3.0.9/include/sound/pcm.h 2011-11-11 13:12:24.000000000 -0500
61555 +++ linux-3.0.9/include/sound/pcm.h 2011-11-15 20:03:00.000000000 -0500
61556 @@ -81,6 +81,7 @@ struct snd_pcm_ops {
61557 int (*mmap)(struct snd_pcm_substream *substream, struct vm_area_struct *vma);
61558 int (*ack)(struct snd_pcm_substream *substream);
61559 };
61560 +typedef struct snd_pcm_ops __no_const snd_pcm_ops_no_const;
61561
61562 /*
61563 *
61564 diff -urNp linux-3.0.9/include/sound/sb16_csp.h linux-3.0.9/include/sound/sb16_csp.h
61565 --- linux-3.0.9/include/sound/sb16_csp.h 2011-11-11 13:12:24.000000000 -0500
61566 +++ linux-3.0.9/include/sound/sb16_csp.h 2011-11-15 20:03:00.000000000 -0500
61567 @@ -146,7 +146,7 @@ struct snd_sb_csp_ops {
61568 int (*csp_start) (struct snd_sb_csp * p, int sample_width, int channels);
61569 int (*csp_stop) (struct snd_sb_csp * p);
61570 int (*csp_qsound_transfer) (struct snd_sb_csp * p);
61571 -};
61572 +} __no_const;
61573
61574 /*
61575 * CSP private data
61576 diff -urNp linux-3.0.9/include/sound/soc.h linux-3.0.9/include/sound/soc.h
61577 --- linux-3.0.9/include/sound/soc.h 2011-11-11 13:12:24.000000000 -0500
61578 +++ linux-3.0.9/include/sound/soc.h 2011-11-15 20:03:00.000000000 -0500
61579 @@ -636,7 +636,7 @@ struct snd_soc_platform_driver {
61580
61581 /* platform stream ops */
61582 struct snd_pcm_ops *ops;
61583 -};
61584 +} __do_const;
61585
61586 struct snd_soc_platform {
61587 const char *name;
61588 diff -urNp linux-3.0.9/include/sound/ymfpci.h linux-3.0.9/include/sound/ymfpci.h
61589 --- linux-3.0.9/include/sound/ymfpci.h 2011-11-11 13:12:24.000000000 -0500
61590 +++ linux-3.0.9/include/sound/ymfpci.h 2011-11-15 20:03:00.000000000 -0500
61591 @@ -358,7 +358,7 @@ struct snd_ymfpci {
61592 spinlock_t reg_lock;
61593 spinlock_t voice_lock;
61594 wait_queue_head_t interrupt_sleep;
61595 - atomic_t interrupt_sleep_count;
61596 + atomic_unchecked_t interrupt_sleep_count;
61597 struct snd_info_entry *proc_entry;
61598 const struct firmware *dsp_microcode;
61599 const struct firmware *controller_microcode;
61600 diff -urNp linux-3.0.9/include/target/target_core_base.h linux-3.0.9/include/target/target_core_base.h
61601 --- linux-3.0.9/include/target/target_core_base.h 2011-11-11 13:12:24.000000000 -0500
61602 +++ linux-3.0.9/include/target/target_core_base.h 2011-11-15 20:03:00.000000000 -0500
61603 @@ -364,7 +364,7 @@ struct t10_reservation_ops {
61604 int (*t10_seq_non_holder)(struct se_cmd *, unsigned char *, u32);
61605 int (*t10_pr_register)(struct se_cmd *);
61606 int (*t10_pr_clear)(struct se_cmd *);
61607 -};
61608 +} __no_const;
61609
61610 struct t10_reservation_template {
61611 /* Reservation effects all target ports */
61612 @@ -432,8 +432,8 @@ struct se_transport_task {
61613 atomic_t t_task_cdbs_left;
61614 atomic_t t_task_cdbs_ex_left;
61615 atomic_t t_task_cdbs_timeout_left;
61616 - atomic_t t_task_cdbs_sent;
61617 - atomic_t t_transport_aborted;
61618 + atomic_unchecked_t t_task_cdbs_sent;
61619 + atomic_unchecked_t t_transport_aborted;
61620 atomic_t t_transport_active;
61621 atomic_t t_transport_complete;
61622 atomic_t t_transport_queue_active;
61623 @@ -774,7 +774,7 @@ struct se_device {
61624 atomic_t active_cmds;
61625 atomic_t simple_cmds;
61626 atomic_t depth_left;
61627 - atomic_t dev_ordered_id;
61628 + atomic_unchecked_t dev_ordered_id;
61629 atomic_t dev_tur_active;
61630 atomic_t execute_tasks;
61631 atomic_t dev_status_thr_count;
61632 diff -urNp linux-3.0.9/include/trace/events/irq.h linux-3.0.9/include/trace/events/irq.h
61633 --- linux-3.0.9/include/trace/events/irq.h 2011-11-11 13:12:24.000000000 -0500
61634 +++ linux-3.0.9/include/trace/events/irq.h 2011-11-15 20:03:00.000000000 -0500
61635 @@ -36,7 +36,7 @@ struct softirq_action;
61636 */
61637 TRACE_EVENT(irq_handler_entry,
61638
61639 - TP_PROTO(int irq, struct irqaction *action),
61640 + TP_PROTO(int irq, const struct irqaction *action),
61641
61642 TP_ARGS(irq, action),
61643
61644 @@ -66,7 +66,7 @@ TRACE_EVENT(irq_handler_entry,
61645 */
61646 TRACE_EVENT(irq_handler_exit,
61647
61648 - TP_PROTO(int irq, struct irqaction *action, int ret),
61649 + TP_PROTO(int irq, const struct irqaction *action, int ret),
61650
61651 TP_ARGS(irq, action, ret),
61652
61653 diff -urNp linux-3.0.9/include/video/udlfb.h linux-3.0.9/include/video/udlfb.h
61654 --- linux-3.0.9/include/video/udlfb.h 2011-11-11 13:12:24.000000000 -0500
61655 +++ linux-3.0.9/include/video/udlfb.h 2011-11-15 20:03:00.000000000 -0500
61656 @@ -51,10 +51,10 @@ struct dlfb_data {
61657 int base8;
61658 u32 pseudo_palette[256];
61659 /* blit-only rendering path metrics, exposed through sysfs */
61660 - atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
61661 - atomic_t bytes_identical; /* saved effort with backbuffer comparison */
61662 - atomic_t bytes_sent; /* to usb, after compression including overhead */
61663 - atomic_t cpu_kcycles_used; /* transpired during pixel processing */
61664 + atomic_unchecked_t bytes_rendered; /* raw pixel-bytes driver asked to render */
61665 + atomic_unchecked_t bytes_identical; /* saved effort with backbuffer comparison */
61666 + atomic_unchecked_t bytes_sent; /* to usb, after compression including overhead */
61667 + atomic_unchecked_t cpu_kcycles_used; /* transpired during pixel processing */
61668 };
61669
61670 #define NR_USB_REQUEST_I2C_SUB_IO 0x02
61671 diff -urNp linux-3.0.9/include/video/uvesafb.h linux-3.0.9/include/video/uvesafb.h
61672 --- linux-3.0.9/include/video/uvesafb.h 2011-11-11 13:12:24.000000000 -0500
61673 +++ linux-3.0.9/include/video/uvesafb.h 2011-11-15 20:03:00.000000000 -0500
61674 @@ -177,6 +177,7 @@ struct uvesafb_par {
61675 u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
61676 u8 pmi_setpal; /* PMI for palette changes */
61677 u16 *pmi_base; /* protected mode interface location */
61678 + u8 *pmi_code; /* protected mode code location */
61679 void *pmi_start;
61680 void *pmi_pal;
61681 u8 *vbe_state_orig; /*
61682 diff -urNp linux-3.0.9/init/do_mounts.c linux-3.0.9/init/do_mounts.c
61683 --- linux-3.0.9/init/do_mounts.c 2011-11-11 13:12:24.000000000 -0500
61684 +++ linux-3.0.9/init/do_mounts.c 2011-11-15 20:03:00.000000000 -0500
61685 @@ -287,11 +287,11 @@ static void __init get_fs_names(char *pa
61686
61687 static int __init do_mount_root(char *name, char *fs, int flags, void *data)
61688 {
61689 - int err = sys_mount(name, "/root", fs, flags, data);
61690 + int err = sys_mount((char __force_user *)name, (char __force_user *)"/root", (char __force_user *)fs, flags, (void __force_user *)data);
61691 if (err)
61692 return err;
61693
61694 - sys_chdir((const char __user __force *)"/root");
61695 + sys_chdir((const char __force_user*)"/root");
61696 ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
61697 printk(KERN_INFO
61698 "VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
61699 @@ -383,18 +383,18 @@ void __init change_floppy(char *fmt, ...
61700 va_start(args, fmt);
61701 vsprintf(buf, fmt, args);
61702 va_end(args);
61703 - fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
61704 + fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
61705 if (fd >= 0) {
61706 sys_ioctl(fd, FDEJECT, 0);
61707 sys_close(fd);
61708 }
61709 printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
61710 - fd = sys_open("/dev/console", O_RDWR, 0);
61711 + fd = sys_open((__force const char __user *)"/dev/console", O_RDWR, 0);
61712 if (fd >= 0) {
61713 sys_ioctl(fd, TCGETS, (long)&termios);
61714 termios.c_lflag &= ~ICANON;
61715 sys_ioctl(fd, TCSETSF, (long)&termios);
61716 - sys_read(fd, &c, 1);
61717 + sys_read(fd, (char __user *)&c, 1);
61718 termios.c_lflag |= ICANON;
61719 sys_ioctl(fd, TCSETSF, (long)&termios);
61720 sys_close(fd);
61721 @@ -488,6 +488,6 @@ void __init prepare_namespace(void)
61722 mount_root();
61723 out:
61724 devtmpfs_mount("dev");
61725 - sys_mount(".", "/", NULL, MS_MOVE, NULL);
61726 - sys_chroot((const char __user __force *)".");
61727 + sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
61728 + sys_chroot((const char __force_user *)".");
61729 }
61730 diff -urNp linux-3.0.9/init/do_mounts.h linux-3.0.9/init/do_mounts.h
61731 --- linux-3.0.9/init/do_mounts.h 2011-11-11 13:12:24.000000000 -0500
61732 +++ linux-3.0.9/init/do_mounts.h 2011-11-15 20:03:00.000000000 -0500
61733 @@ -15,15 +15,15 @@ extern int root_mountflags;
61734
61735 static inline int create_dev(char *name, dev_t dev)
61736 {
61737 - sys_unlink(name);
61738 - return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
61739 + sys_unlink((char __force_user *)name);
61740 + return sys_mknod((char __force_user *)name, S_IFBLK|0600, new_encode_dev(dev));
61741 }
61742
61743 #if BITS_PER_LONG == 32
61744 static inline u32 bstat(char *name)
61745 {
61746 struct stat64 stat;
61747 - if (sys_stat64(name, &stat) != 0)
61748 + if (sys_stat64((char __force_user *)name, (struct stat64 __force_user *)&stat) != 0)
61749 return 0;
61750 if (!S_ISBLK(stat.st_mode))
61751 return 0;
61752 @@ -35,7 +35,7 @@ static inline u32 bstat(char *name)
61753 static inline u32 bstat(char *name)
61754 {
61755 struct stat stat;
61756 - if (sys_newstat(name, &stat) != 0)
61757 + if (sys_newstat((const char __force_user *)name, (struct stat __force_user *)&stat) != 0)
61758 return 0;
61759 if (!S_ISBLK(stat.st_mode))
61760 return 0;
61761 diff -urNp linux-3.0.9/init/do_mounts_initrd.c linux-3.0.9/init/do_mounts_initrd.c
61762 --- linux-3.0.9/init/do_mounts_initrd.c 2011-11-11 13:12:24.000000000 -0500
61763 +++ linux-3.0.9/init/do_mounts_initrd.c 2011-11-15 20:03:00.000000000 -0500
61764 @@ -44,13 +44,13 @@ static void __init handle_initrd(void)
61765 create_dev("/dev/root.old", Root_RAM0);
61766 /* mount initrd on rootfs' /root */
61767 mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
61768 - sys_mkdir("/old", 0700);
61769 - root_fd = sys_open("/", 0, 0);
61770 - old_fd = sys_open("/old", 0, 0);
61771 + sys_mkdir((const char __force_user *)"/old", 0700);
61772 + root_fd = sys_open((const char __force_user *)"/", 0, 0);
61773 + old_fd = sys_open((const char __force_user *)"/old", 0, 0);
61774 /* move initrd over / and chdir/chroot in initrd root */
61775 - sys_chdir("/root");
61776 - sys_mount(".", "/", NULL, MS_MOVE, NULL);
61777 - sys_chroot(".");
61778 + sys_chdir((const char __force_user *)"/root");
61779 + sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
61780 + sys_chroot((const char __force_user *)".");
61781
61782 /*
61783 * In case that a resume from disk is carried out by linuxrc or one of
61784 @@ -67,15 +67,15 @@ static void __init handle_initrd(void)
61785
61786 /* move initrd to rootfs' /old */
61787 sys_fchdir(old_fd);
61788 - sys_mount("/", ".", NULL, MS_MOVE, NULL);
61789 + sys_mount((char __force_user *)"/", (char __force_user *)".", NULL, MS_MOVE, NULL);
61790 /* switch root and cwd back to / of rootfs */
61791 sys_fchdir(root_fd);
61792 - sys_chroot(".");
61793 + sys_chroot((const char __force_user *)".");
61794 sys_close(old_fd);
61795 sys_close(root_fd);
61796
61797 if (new_decode_dev(real_root_dev) == Root_RAM0) {
61798 - sys_chdir("/old");
61799 + sys_chdir((const char __force_user *)"/old");
61800 return;
61801 }
61802
61803 @@ -83,17 +83,17 @@ static void __init handle_initrd(void)
61804 mount_root();
61805
61806 printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
61807 - error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
61808 + error = sys_mount((char __force_user *)"/old", (char __force_user *)"/root/initrd", NULL, MS_MOVE, NULL);
61809 if (!error)
61810 printk("okay\n");
61811 else {
61812 - int fd = sys_open("/dev/root.old", O_RDWR, 0);
61813 + int fd = sys_open((const char __force_user *)"/dev/root.old", O_RDWR, 0);
61814 if (error == -ENOENT)
61815 printk("/initrd does not exist. Ignored.\n");
61816 else
61817 printk("failed\n");
61818 printk(KERN_NOTICE "Unmounting old root\n");
61819 - sys_umount("/old", MNT_DETACH);
61820 + sys_umount((char __force_user *)"/old", MNT_DETACH);
61821 printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
61822 if (fd < 0) {
61823 error = fd;
61824 @@ -116,11 +116,11 @@ int __init initrd_load(void)
61825 * mounted in the normal path.
61826 */
61827 if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
61828 - sys_unlink("/initrd.image");
61829 + sys_unlink((const char __force_user *)"/initrd.image");
61830 handle_initrd();
61831 return 1;
61832 }
61833 }
61834 - sys_unlink("/initrd.image");
61835 + sys_unlink((const char __force_user *)"/initrd.image");
61836 return 0;
61837 }
61838 diff -urNp linux-3.0.9/init/do_mounts_md.c linux-3.0.9/init/do_mounts_md.c
61839 --- linux-3.0.9/init/do_mounts_md.c 2011-11-11 13:12:24.000000000 -0500
61840 +++ linux-3.0.9/init/do_mounts_md.c 2011-11-15 20:03:00.000000000 -0500
61841 @@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
61842 partitioned ? "_d" : "", minor,
61843 md_setup_args[ent].device_names);
61844
61845 - fd = sys_open(name, 0, 0);
61846 + fd = sys_open((char __force_user *)name, 0, 0);
61847 if (fd < 0) {
61848 printk(KERN_ERR "md: open failed - cannot start "
61849 "array %s\n", name);
61850 @@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
61851 * array without it
61852 */
61853 sys_close(fd);
61854 - fd = sys_open(name, 0, 0);
61855 + fd = sys_open((char __force_user *)name, 0, 0);
61856 sys_ioctl(fd, BLKRRPART, 0);
61857 }
61858 sys_close(fd);
61859 @@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
61860
61861 wait_for_device_probe();
61862
61863 - fd = sys_open((const char __user __force *) "/dev/md0", 0, 0);
61864 + fd = sys_open((const char __force_user *) "/dev/md0", 0, 0);
61865 if (fd >= 0) {
61866 sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
61867 sys_close(fd);
61868 diff -urNp linux-3.0.9/init/initramfs.c linux-3.0.9/init/initramfs.c
61869 --- linux-3.0.9/init/initramfs.c 2011-11-11 13:12:24.000000000 -0500
61870 +++ linux-3.0.9/init/initramfs.c 2011-11-15 20:03:00.000000000 -0500
61871 @@ -74,7 +74,7 @@ static void __init free_hash(void)
61872 }
61873 }
61874
61875 -static long __init do_utime(char __user *filename, time_t mtime)
61876 +static long __init do_utime(__force char __user *filename, time_t mtime)
61877 {
61878 struct timespec t[2];
61879
61880 @@ -109,7 +109,7 @@ static void __init dir_utime(void)
61881 struct dir_entry *de, *tmp;
61882 list_for_each_entry_safe(de, tmp, &dir_list, list) {
61883 list_del(&de->list);
61884 - do_utime(de->name, de->mtime);
61885 + do_utime((char __force_user *)de->name, de->mtime);
61886 kfree(de->name);
61887 kfree(de);
61888 }
61889 @@ -271,7 +271,7 @@ static int __init maybe_link(void)
61890 if (nlink >= 2) {
61891 char *old = find_link(major, minor, ino, mode, collected);
61892 if (old)
61893 - return (sys_link(old, collected) < 0) ? -1 : 1;
61894 + return (sys_link((char __force_user *)old, (char __force_user *)collected) < 0) ? -1 : 1;
61895 }
61896 return 0;
61897 }
61898 @@ -280,11 +280,11 @@ static void __init clean_path(char *path
61899 {
61900 struct stat st;
61901
61902 - if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
61903 + if (!sys_newlstat((char __force_user *)path, (struct stat __force_user *)&st) && (st.st_mode^mode) & S_IFMT) {
61904 if (S_ISDIR(st.st_mode))
61905 - sys_rmdir(path);
61906 + sys_rmdir((char __force_user *)path);
61907 else
61908 - sys_unlink(path);
61909 + sys_unlink((char __force_user *)path);
61910 }
61911 }
61912
61913 @@ -305,7 +305,7 @@ static int __init do_name(void)
61914 int openflags = O_WRONLY|O_CREAT;
61915 if (ml != 1)
61916 openflags |= O_TRUNC;
61917 - wfd = sys_open(collected, openflags, mode);
61918 + wfd = sys_open((char __force_user *)collected, openflags, mode);
61919
61920 if (wfd >= 0) {
61921 sys_fchown(wfd, uid, gid);
61922 @@ -317,17 +317,17 @@ static int __init do_name(void)
61923 }
61924 }
61925 } else if (S_ISDIR(mode)) {
61926 - sys_mkdir(collected, mode);
61927 - sys_chown(collected, uid, gid);
61928 - sys_chmod(collected, mode);
61929 + sys_mkdir((char __force_user *)collected, mode);
61930 + sys_chown((char __force_user *)collected, uid, gid);
61931 + sys_chmod((char __force_user *)collected, mode);
61932 dir_add(collected, mtime);
61933 } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
61934 S_ISFIFO(mode) || S_ISSOCK(mode)) {
61935 if (maybe_link() == 0) {
61936 - sys_mknod(collected, mode, rdev);
61937 - sys_chown(collected, uid, gid);
61938 - sys_chmod(collected, mode);
61939 - do_utime(collected, mtime);
61940 + sys_mknod((char __force_user *)collected, mode, rdev);
61941 + sys_chown((char __force_user *)collected, uid, gid);
61942 + sys_chmod((char __force_user *)collected, mode);
61943 + do_utime((char __force_user *)collected, mtime);
61944 }
61945 }
61946 return 0;
61947 @@ -336,15 +336,15 @@ static int __init do_name(void)
61948 static int __init do_copy(void)
61949 {
61950 if (count >= body_len) {
61951 - sys_write(wfd, victim, body_len);
61952 + sys_write(wfd, (char __force_user *)victim, body_len);
61953 sys_close(wfd);
61954 - do_utime(vcollected, mtime);
61955 + do_utime((char __force_user *)vcollected, mtime);
61956 kfree(vcollected);
61957 eat(body_len);
61958 state = SkipIt;
61959 return 0;
61960 } else {
61961 - sys_write(wfd, victim, count);
61962 + sys_write(wfd, (char __force_user *)victim, count);
61963 body_len -= count;
61964 eat(count);
61965 return 1;
61966 @@ -355,9 +355,9 @@ static int __init do_symlink(void)
61967 {
61968 collected[N_ALIGN(name_len) + body_len] = '\0';
61969 clean_path(collected, 0);
61970 - sys_symlink(collected + N_ALIGN(name_len), collected);
61971 - sys_lchown(collected, uid, gid);
61972 - do_utime(collected, mtime);
61973 + sys_symlink((char __force_user *)collected + N_ALIGN(name_len), (char __force_user *)collected);
61974 + sys_lchown((char __force_user *)collected, uid, gid);
61975 + do_utime((char __force_user *)collected, mtime);
61976 state = SkipIt;
61977 next_state = Reset;
61978 return 0;
61979 diff -urNp linux-3.0.9/init/Kconfig linux-3.0.9/init/Kconfig
61980 --- linux-3.0.9/init/Kconfig 2011-11-11 13:12:24.000000000 -0500
61981 +++ linux-3.0.9/init/Kconfig 2011-11-15 20:03:00.000000000 -0500
61982 @@ -1195,7 +1195,7 @@ config SLUB_DEBUG
61983
61984 config COMPAT_BRK
61985 bool "Disable heap randomization"
61986 - default y
61987 + default n
61988 help
61989 Randomizing heap placement makes heap exploits harder, but it
61990 also breaks ancient binaries (including anything libc5 based).
61991 diff -urNp linux-3.0.9/init/main.c linux-3.0.9/init/main.c
61992 --- linux-3.0.9/init/main.c 2011-11-11 13:12:24.000000000 -0500
61993 +++ linux-3.0.9/init/main.c 2011-11-15 20:03:00.000000000 -0500
61994 @@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void)
61995 extern void tc_init(void);
61996 #endif
61997
61998 +extern void grsecurity_init(void);
61999 +
62000 /*
62001 * Debug helper: via this flag we know that we are in 'early bootup code'
62002 * where only the boot processor is running with IRQ disabled. This means
62003 @@ -149,6 +151,49 @@ static int __init set_reset_devices(char
62004
62005 __setup("reset_devices", set_reset_devices);
62006
62007 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
62008 +extern char pax_enter_kernel_user[];
62009 +extern char pax_exit_kernel_user[];
62010 +extern pgdval_t clone_pgd_mask;
62011 +#endif
62012 +
62013 +#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
62014 +static int __init setup_pax_nouderef(char *str)
62015 +{
62016 +#ifdef CONFIG_X86_32
62017 + unsigned int cpu;
62018 + struct desc_struct *gdt;
62019 +
62020 + for (cpu = 0; cpu < NR_CPUS; cpu++) {
62021 + gdt = get_cpu_gdt_table(cpu);
62022 + gdt[GDT_ENTRY_KERNEL_DS].type = 3;
62023 + gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
62024 + gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
62025 + gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
62026 + }
62027 + asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
62028 +#else
62029 + memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
62030 + memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
62031 + clone_pgd_mask = ~(pgdval_t)0UL;
62032 +#endif
62033 +
62034 + return 0;
62035 +}
62036 +early_param("pax_nouderef", setup_pax_nouderef);
62037 +#endif
62038 +
62039 +#ifdef CONFIG_PAX_SOFTMODE
62040 +int pax_softmode;
62041 +
62042 +static int __init setup_pax_softmode(char *str)
62043 +{
62044 + get_option(&str, &pax_softmode);
62045 + return 1;
62046 +}
62047 +__setup("pax_softmode=", setup_pax_softmode);
62048 +#endif
62049 +
62050 static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
62051 const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
62052 static const char *panic_later, *panic_param;
62053 @@ -667,6 +712,7 @@ int __init_or_module do_one_initcall(ini
62054 {
62055 int count = preempt_count();
62056 int ret;
62057 + const char *msg1 = "", *msg2 = "";
62058
62059 if (initcall_debug)
62060 ret = do_one_initcall_debug(fn);
62061 @@ -679,15 +725,15 @@ int __init_or_module do_one_initcall(ini
62062 sprintf(msgbuf, "error code %d ", ret);
62063
62064 if (preempt_count() != count) {
62065 - strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
62066 + msg1 = " preemption imbalance";
62067 preempt_count() = count;
62068 }
62069 if (irqs_disabled()) {
62070 - strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
62071 + msg2 = " disabled interrupts";
62072 local_irq_enable();
62073 }
62074 - if (msgbuf[0]) {
62075 - printk("initcall %pF returned with %s\n", fn, msgbuf);
62076 + if (msgbuf[0] || *msg1 || *msg2) {
62077 + printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
62078 }
62079
62080 return ret;
62081 @@ -805,7 +851,7 @@ static int __init kernel_init(void * unu
62082 do_basic_setup();
62083
62084 /* Open the /dev/console on the rootfs, this should never fail */
62085 - if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0)
62086 + if (sys_open((const char __force_user *) "/dev/console", O_RDWR, 0) < 0)
62087 printk(KERN_WARNING "Warning: unable to open an initial console.\n");
62088
62089 (void) sys_dup(0);
62090 @@ -818,11 +864,13 @@ static int __init kernel_init(void * unu
62091 if (!ramdisk_execute_command)
62092 ramdisk_execute_command = "/init";
62093
62094 - if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
62095 + if (sys_access((const char __force_user *) ramdisk_execute_command, 0) != 0) {
62096 ramdisk_execute_command = NULL;
62097 prepare_namespace();
62098 }
62099
62100 + grsecurity_init();
62101 +
62102 /*
62103 * Ok, we have completed the initial bootup, and
62104 * we're essentially up and running. Get rid of the
62105 diff -urNp linux-3.0.9/ipc/mqueue.c linux-3.0.9/ipc/mqueue.c
62106 --- linux-3.0.9/ipc/mqueue.c 2011-11-11 13:12:24.000000000 -0500
62107 +++ linux-3.0.9/ipc/mqueue.c 2011-11-15 20:03:00.000000000 -0500
62108 @@ -156,6 +156,7 @@ static struct inode *mqueue_get_inode(st
62109 mq_bytes = (mq_msg_tblsz +
62110 (info->attr.mq_maxmsg * info->attr.mq_msgsize));
62111
62112 + gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
62113 spin_lock(&mq_lock);
62114 if (u->mq_bytes + mq_bytes < u->mq_bytes ||
62115 u->mq_bytes + mq_bytes > task_rlimit(p, RLIMIT_MSGQUEUE)) {
62116 diff -urNp linux-3.0.9/ipc/msg.c linux-3.0.9/ipc/msg.c
62117 --- linux-3.0.9/ipc/msg.c 2011-11-11 13:12:24.000000000 -0500
62118 +++ linux-3.0.9/ipc/msg.c 2011-11-15 20:03:00.000000000 -0500
62119 @@ -309,18 +309,19 @@ static inline int msg_security(struct ke
62120 return security_msg_queue_associate(msq, msgflg);
62121 }
62122
62123 +static struct ipc_ops msg_ops = {
62124 + .getnew = newque,
62125 + .associate = msg_security,
62126 + .more_checks = NULL
62127 +};
62128 +
62129 SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
62130 {
62131 struct ipc_namespace *ns;
62132 - struct ipc_ops msg_ops;
62133 struct ipc_params msg_params;
62134
62135 ns = current->nsproxy->ipc_ns;
62136
62137 - msg_ops.getnew = newque;
62138 - msg_ops.associate = msg_security;
62139 - msg_ops.more_checks = NULL;
62140 -
62141 msg_params.key = key;
62142 msg_params.flg = msgflg;
62143
62144 diff -urNp linux-3.0.9/ipc/sem.c linux-3.0.9/ipc/sem.c
62145 --- linux-3.0.9/ipc/sem.c 2011-11-11 13:12:24.000000000 -0500
62146 +++ linux-3.0.9/ipc/sem.c 2011-11-15 20:03:00.000000000 -0500
62147 @@ -318,10 +318,15 @@ static inline int sem_more_checks(struct
62148 return 0;
62149 }
62150
62151 +static struct ipc_ops sem_ops = {
62152 + .getnew = newary,
62153 + .associate = sem_security,
62154 + .more_checks = sem_more_checks
62155 +};
62156 +
62157 SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
62158 {
62159 struct ipc_namespace *ns;
62160 - struct ipc_ops sem_ops;
62161 struct ipc_params sem_params;
62162
62163 ns = current->nsproxy->ipc_ns;
62164 @@ -329,10 +334,6 @@ SYSCALL_DEFINE3(semget, key_t, key, int,
62165 if (nsems < 0 || nsems > ns->sc_semmsl)
62166 return -EINVAL;
62167
62168 - sem_ops.getnew = newary;
62169 - sem_ops.associate = sem_security;
62170 - sem_ops.more_checks = sem_more_checks;
62171 -
62172 sem_params.key = key;
62173 sem_params.flg = semflg;
62174 sem_params.u.nsems = nsems;
62175 @@ -854,6 +855,8 @@ static int semctl_main(struct ipc_namesp
62176 int nsems;
62177 struct list_head tasks;
62178
62179 + pax_track_stack();
62180 +
62181 sma = sem_lock_check(ns, semid);
62182 if (IS_ERR(sma))
62183 return PTR_ERR(sma);
62184 @@ -1301,6 +1304,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid,
62185 struct ipc_namespace *ns;
62186 struct list_head tasks;
62187
62188 + pax_track_stack();
62189 +
62190 ns = current->nsproxy->ipc_ns;
62191
62192 if (nsops < 1 || semid < 0)
62193 diff -urNp linux-3.0.9/ipc/shm.c linux-3.0.9/ipc/shm.c
62194 --- linux-3.0.9/ipc/shm.c 2011-11-11 13:12:24.000000000 -0500
62195 +++ linux-3.0.9/ipc/shm.c 2011-11-15 20:03:00.000000000 -0500
62196 @@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_name
62197 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
62198 #endif
62199
62200 +#ifdef CONFIG_GRKERNSEC
62201 +extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
62202 + const time_t shm_createtime, const uid_t cuid,
62203 + const int shmid);
62204 +extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
62205 + const time_t shm_createtime);
62206 +#endif
62207 +
62208 void shm_init_ns(struct ipc_namespace *ns)
62209 {
62210 ns->shm_ctlmax = SHMMAX;
62211 @@ -401,6 +409,14 @@ static int newseg(struct ipc_namespace *
62212 shp->shm_lprid = 0;
62213 shp->shm_atim = shp->shm_dtim = 0;
62214 shp->shm_ctim = get_seconds();
62215 +#ifdef CONFIG_GRKERNSEC
62216 + {
62217 + struct timespec timeval;
62218 + do_posix_clock_monotonic_gettime(&timeval);
62219 +
62220 + shp->shm_createtime = timeval.tv_sec;
62221 + }
62222 +#endif
62223 shp->shm_segsz = size;
62224 shp->shm_nattch = 0;
62225 shp->shm_file = file;
62226 @@ -451,18 +467,19 @@ static inline int shm_more_checks(struct
62227 return 0;
62228 }
62229
62230 +static struct ipc_ops shm_ops = {
62231 + .getnew = newseg,
62232 + .associate = shm_security,
62233 + .more_checks = shm_more_checks
62234 +};
62235 +
62236 SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
62237 {
62238 struct ipc_namespace *ns;
62239 - struct ipc_ops shm_ops;
62240 struct ipc_params shm_params;
62241
62242 ns = current->nsproxy->ipc_ns;
62243
62244 - shm_ops.getnew = newseg;
62245 - shm_ops.associate = shm_security;
62246 - shm_ops.more_checks = shm_more_checks;
62247 -
62248 shm_params.key = key;
62249 shm_params.flg = shmflg;
62250 shm_params.u.size = size;
62251 @@ -762,8 +779,6 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int,
62252 case SHM_LOCK:
62253 case SHM_UNLOCK:
62254 {
62255 - struct file *uninitialized_var(shm_file);
62256 -
62257 lru_add_drain_all(); /* drain pagevecs to lru lists */
62258
62259 shp = shm_lock_check(ns, shmid);
62260 @@ -896,9 +911,21 @@ long do_shmat(int shmid, char __user *sh
62261 if (err)
62262 goto out_unlock;
62263
62264 +#ifdef CONFIG_GRKERNSEC
62265 + if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
62266 + shp->shm_perm.cuid, shmid) ||
62267 + !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
62268 + err = -EACCES;
62269 + goto out_unlock;
62270 + }
62271 +#endif
62272 +
62273 path = shp->shm_file->f_path;
62274 path_get(&path);
62275 shp->shm_nattch++;
62276 +#ifdef CONFIG_GRKERNSEC
62277 + shp->shm_lapid = current->pid;
62278 +#endif
62279 size = i_size_read(path.dentry->d_inode);
62280 shm_unlock(shp);
62281
62282 diff -urNp linux-3.0.9/kernel/acct.c linux-3.0.9/kernel/acct.c
62283 --- linux-3.0.9/kernel/acct.c 2011-11-11 13:12:24.000000000 -0500
62284 +++ linux-3.0.9/kernel/acct.c 2011-11-15 20:03:00.000000000 -0500
62285 @@ -570,7 +570,7 @@ static void do_acct_process(struct bsd_a
62286 */
62287 flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
62288 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
62289 - file->f_op->write(file, (char *)&ac,
62290 + file->f_op->write(file, (char __force_user *)&ac,
62291 sizeof(acct_t), &file->f_pos);
62292 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
62293 set_fs(fs);
62294 diff -urNp linux-3.0.9/kernel/audit.c linux-3.0.9/kernel/audit.c
62295 --- linux-3.0.9/kernel/audit.c 2011-11-11 13:12:24.000000000 -0500
62296 +++ linux-3.0.9/kernel/audit.c 2011-11-15 20:03:00.000000000 -0500
62297 @@ -112,7 +112,7 @@ u32 audit_sig_sid = 0;
62298 3) suppressed due to audit_rate_limit
62299 4) suppressed due to audit_backlog_limit
62300 */
62301 -static atomic_t audit_lost = ATOMIC_INIT(0);
62302 +static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
62303
62304 /* The netlink socket. */
62305 static struct sock *audit_sock;
62306 @@ -234,7 +234,7 @@ void audit_log_lost(const char *message)
62307 unsigned long now;
62308 int print;
62309
62310 - atomic_inc(&audit_lost);
62311 + atomic_inc_unchecked(&audit_lost);
62312
62313 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
62314
62315 @@ -253,7 +253,7 @@ void audit_log_lost(const char *message)
62316 printk(KERN_WARNING
62317 "audit: audit_lost=%d audit_rate_limit=%d "
62318 "audit_backlog_limit=%d\n",
62319 - atomic_read(&audit_lost),
62320 + atomic_read_unchecked(&audit_lost),
62321 audit_rate_limit,
62322 audit_backlog_limit);
62323 audit_panic(message);
62324 @@ -686,7 +686,7 @@ static int audit_receive_msg(struct sk_b
62325 status_set.pid = audit_pid;
62326 status_set.rate_limit = audit_rate_limit;
62327 status_set.backlog_limit = audit_backlog_limit;
62328 - status_set.lost = atomic_read(&audit_lost);
62329 + status_set.lost = atomic_read_unchecked(&audit_lost);
62330 status_set.backlog = skb_queue_len(&audit_skb_queue);
62331 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
62332 &status_set, sizeof(status_set));
62333 diff -urNp linux-3.0.9/kernel/auditsc.c linux-3.0.9/kernel/auditsc.c
62334 --- linux-3.0.9/kernel/auditsc.c 2011-11-11 13:12:24.000000000 -0500
62335 +++ linux-3.0.9/kernel/auditsc.c 2011-11-15 20:03:00.000000000 -0500
62336 @@ -2118,7 +2118,7 @@ int auditsc_get_stamp(struct audit_conte
62337 }
62338
62339 /* global counter which is incremented every time something logs in */
62340 -static atomic_t session_id = ATOMIC_INIT(0);
62341 +static atomic_unchecked_t session_id = ATOMIC_INIT(0);
62342
62343 /**
62344 * audit_set_loginuid - set a task's audit_context loginuid
62345 @@ -2131,7 +2131,7 @@ static atomic_t session_id = ATOMIC_INIT
62346 */
62347 int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
62348 {
62349 - unsigned int sessionid = atomic_inc_return(&session_id);
62350 + unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
62351 struct audit_context *context = task->audit_context;
62352
62353 if (context && context->in_syscall) {
62354 diff -urNp linux-3.0.9/kernel/capability.c linux-3.0.9/kernel/capability.c
62355 --- linux-3.0.9/kernel/capability.c 2011-11-11 13:12:24.000000000 -0500
62356 +++ linux-3.0.9/kernel/capability.c 2011-11-15 20:03:00.000000000 -0500
62357 @@ -202,6 +202,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_
62358 * before modification is attempted and the application
62359 * fails.
62360 */
62361 + if (tocopy > ARRAY_SIZE(kdata))
62362 + return -EFAULT;
62363 +
62364 if (copy_to_user(dataptr, kdata, tocopy
62365 * sizeof(struct __user_cap_data_struct))) {
62366 return -EFAULT;
62367 @@ -374,7 +377,7 @@ bool ns_capable(struct user_namespace *n
62368 BUG();
62369 }
62370
62371 - if (security_capable(ns, current_cred(), cap) == 0) {
62372 + if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable(cap)) {
62373 current->flags |= PF_SUPERPRIV;
62374 return true;
62375 }
62376 @@ -382,6 +385,27 @@ bool ns_capable(struct user_namespace *n
62377 }
62378 EXPORT_SYMBOL(ns_capable);
62379
62380 +bool ns_capable_nolog(struct user_namespace *ns, int cap)
62381 +{
62382 + if (unlikely(!cap_valid(cap))) {
62383 + printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
62384 + BUG();
62385 + }
62386 +
62387 + if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable_nolog(cap)) {
62388 + current->flags |= PF_SUPERPRIV;
62389 + return true;
62390 + }
62391 + return false;
62392 +}
62393 +EXPORT_SYMBOL(ns_capable_nolog);
62394 +
62395 +bool capable_nolog(int cap)
62396 +{
62397 + return ns_capable_nolog(&init_user_ns, cap);
62398 +}
62399 +EXPORT_SYMBOL(capable_nolog);
62400 +
62401 /**
62402 * task_ns_capable - Determine whether current task has a superior
62403 * capability targeted at a specific task's user namespace.
62404 @@ -396,6 +420,12 @@ bool task_ns_capable(struct task_struct
62405 }
62406 EXPORT_SYMBOL(task_ns_capable);
62407
62408 +bool task_ns_capable_nolog(struct task_struct *t, int cap)
62409 +{
62410 + return ns_capable_nolog(task_cred_xxx(t, user)->user_ns, cap);
62411 +}
62412 +EXPORT_SYMBOL(task_ns_capable_nolog);
62413 +
62414 /**
62415 * nsown_capable - Check superior capability to one's own user_ns
62416 * @cap: The capability in question
62417 diff -urNp linux-3.0.9/kernel/cgroup.c linux-3.0.9/kernel/cgroup.c
62418 --- linux-3.0.9/kernel/cgroup.c 2011-11-11 13:12:24.000000000 -0500
62419 +++ linux-3.0.9/kernel/cgroup.c 2011-11-15 20:03:00.000000000 -0500
62420 @@ -593,6 +593,8 @@ static struct css_set *find_css_set(
62421 struct hlist_head *hhead;
62422 struct cg_cgroup_link *link;
62423
62424 + pax_track_stack();
62425 +
62426 /* First see if we already have a cgroup group that matches
62427 * the desired set */
62428 read_lock(&css_set_lock);
62429 diff -urNp linux-3.0.9/kernel/compat.c linux-3.0.9/kernel/compat.c
62430 --- linux-3.0.9/kernel/compat.c 2011-11-11 13:12:24.000000000 -0500
62431 +++ linux-3.0.9/kernel/compat.c 2011-11-15 20:03:00.000000000 -0500
62432 @@ -13,6 +13,7 @@
62433
62434 #include <linux/linkage.h>
62435 #include <linux/compat.h>
62436 +#include <linux/module.h>
62437 #include <linux/errno.h>
62438 #include <linux/time.h>
62439 #include <linux/signal.h>
62440 @@ -166,7 +167,7 @@ static long compat_nanosleep_restart(str
62441 mm_segment_t oldfs;
62442 long ret;
62443
62444 - restart->nanosleep.rmtp = (struct timespec __user *) &rmt;
62445 + restart->nanosleep.rmtp = (struct timespec __force_user *) &rmt;
62446 oldfs = get_fs();
62447 set_fs(KERNEL_DS);
62448 ret = hrtimer_nanosleep_restart(restart);
62449 @@ -198,7 +199,7 @@ asmlinkage long compat_sys_nanosleep(str
62450 oldfs = get_fs();
62451 set_fs(KERNEL_DS);
62452 ret = hrtimer_nanosleep(&tu,
62453 - rmtp ? (struct timespec __user *)&rmt : NULL,
62454 + rmtp ? (struct timespec __force_user *)&rmt : NULL,
62455 HRTIMER_MODE_REL, CLOCK_MONOTONIC);
62456 set_fs(oldfs);
62457
62458 @@ -307,7 +308,7 @@ asmlinkage long compat_sys_sigpending(co
62459 mm_segment_t old_fs = get_fs();
62460
62461 set_fs(KERNEL_DS);
62462 - ret = sys_sigpending((old_sigset_t __user *) &s);
62463 + ret = sys_sigpending((old_sigset_t __force_user *) &s);
62464 set_fs(old_fs);
62465 if (ret == 0)
62466 ret = put_user(s, set);
62467 @@ -330,8 +331,8 @@ asmlinkage long compat_sys_sigprocmask(i
62468 old_fs = get_fs();
62469 set_fs(KERNEL_DS);
62470 ret = sys_sigprocmask(how,
62471 - set ? (old_sigset_t __user *) &s : NULL,
62472 - oset ? (old_sigset_t __user *) &s : NULL);
62473 + set ? (old_sigset_t __force_user *) &s : NULL,
62474 + oset ? (old_sigset_t __force_user *) &s : NULL);
62475 set_fs(old_fs);
62476 if (ret == 0)
62477 if (oset)
62478 @@ -368,7 +369,7 @@ asmlinkage long compat_sys_old_getrlimit
62479 mm_segment_t old_fs = get_fs();
62480
62481 set_fs(KERNEL_DS);
62482 - ret = sys_old_getrlimit(resource, &r);
62483 + ret = sys_old_getrlimit(resource, (struct rlimit __force_user *)&r);
62484 set_fs(old_fs);
62485
62486 if (!ret) {
62487 @@ -440,7 +441,7 @@ asmlinkage long compat_sys_getrusage(int
62488 mm_segment_t old_fs = get_fs();
62489
62490 set_fs(KERNEL_DS);
62491 - ret = sys_getrusage(who, (struct rusage __user *) &r);
62492 + ret = sys_getrusage(who, (struct rusage __force_user *) &r);
62493 set_fs(old_fs);
62494
62495 if (ret)
62496 @@ -467,8 +468,8 @@ compat_sys_wait4(compat_pid_t pid, compa
62497 set_fs (KERNEL_DS);
62498 ret = sys_wait4(pid,
62499 (stat_addr ?
62500 - (unsigned int __user *) &status : NULL),
62501 - options, (struct rusage __user *) &r);
62502 + (unsigned int __force_user *) &status : NULL),
62503 + options, (struct rusage __force_user *) &r);
62504 set_fs (old_fs);
62505
62506 if (ret > 0) {
62507 @@ -493,8 +494,8 @@ asmlinkage long compat_sys_waitid(int wh
62508 memset(&info, 0, sizeof(info));
62509
62510 set_fs(KERNEL_DS);
62511 - ret = sys_waitid(which, pid, (siginfo_t __user *)&info, options,
62512 - uru ? (struct rusage __user *)&ru : NULL);
62513 + ret = sys_waitid(which, pid, (siginfo_t __force_user *)&info, options,
62514 + uru ? (struct rusage __force_user *)&ru : NULL);
62515 set_fs(old_fs);
62516
62517 if ((ret < 0) || (info.si_signo == 0))
62518 @@ -624,8 +625,8 @@ long compat_sys_timer_settime(timer_t ti
62519 oldfs = get_fs();
62520 set_fs(KERNEL_DS);
62521 err = sys_timer_settime(timer_id, flags,
62522 - (struct itimerspec __user *) &newts,
62523 - (struct itimerspec __user *) &oldts);
62524 + (struct itimerspec __force_user *) &newts,
62525 + (struct itimerspec __force_user *) &oldts);
62526 set_fs(oldfs);
62527 if (!err && old && put_compat_itimerspec(old, &oldts))
62528 return -EFAULT;
62529 @@ -642,7 +643,7 @@ long compat_sys_timer_gettime(timer_t ti
62530 oldfs = get_fs();
62531 set_fs(KERNEL_DS);
62532 err = sys_timer_gettime(timer_id,
62533 - (struct itimerspec __user *) &ts);
62534 + (struct itimerspec __force_user *) &ts);
62535 set_fs(oldfs);
62536 if (!err && put_compat_itimerspec(setting, &ts))
62537 return -EFAULT;
62538 @@ -661,7 +662,7 @@ long compat_sys_clock_settime(clockid_t
62539 oldfs = get_fs();
62540 set_fs(KERNEL_DS);
62541 err = sys_clock_settime(which_clock,
62542 - (struct timespec __user *) &ts);
62543 + (struct timespec __force_user *) &ts);
62544 set_fs(oldfs);
62545 return err;
62546 }
62547 @@ -676,7 +677,7 @@ long compat_sys_clock_gettime(clockid_t
62548 oldfs = get_fs();
62549 set_fs(KERNEL_DS);
62550 err = sys_clock_gettime(which_clock,
62551 - (struct timespec __user *) &ts);
62552 + (struct timespec __force_user *) &ts);
62553 set_fs(oldfs);
62554 if (!err && put_compat_timespec(&ts, tp))
62555 return -EFAULT;
62556 @@ -696,7 +697,7 @@ long compat_sys_clock_adjtime(clockid_t
62557
62558 oldfs = get_fs();
62559 set_fs(KERNEL_DS);
62560 - ret = sys_clock_adjtime(which_clock, (struct timex __user *) &txc);
62561 + ret = sys_clock_adjtime(which_clock, (struct timex __force_user *) &txc);
62562 set_fs(oldfs);
62563
62564 err = compat_put_timex(utp, &txc);
62565 @@ -716,7 +717,7 @@ long compat_sys_clock_getres(clockid_t w
62566 oldfs = get_fs();
62567 set_fs(KERNEL_DS);
62568 err = sys_clock_getres(which_clock,
62569 - (struct timespec __user *) &ts);
62570 + (struct timespec __force_user *) &ts);
62571 set_fs(oldfs);
62572 if (!err && tp && put_compat_timespec(&ts, tp))
62573 return -EFAULT;
62574 @@ -728,9 +729,9 @@ static long compat_clock_nanosleep_resta
62575 long err;
62576 mm_segment_t oldfs;
62577 struct timespec tu;
62578 - struct compat_timespec *rmtp = restart->nanosleep.compat_rmtp;
62579 + struct compat_timespec __user *rmtp = restart->nanosleep.compat_rmtp;
62580
62581 - restart->nanosleep.rmtp = (struct timespec __user *) &tu;
62582 + restart->nanosleep.rmtp = (struct timespec __force_user *) &tu;
62583 oldfs = get_fs();
62584 set_fs(KERNEL_DS);
62585 err = clock_nanosleep_restart(restart);
62586 @@ -762,8 +763,8 @@ long compat_sys_clock_nanosleep(clockid_
62587 oldfs = get_fs();
62588 set_fs(KERNEL_DS);
62589 err = sys_clock_nanosleep(which_clock, flags,
62590 - (struct timespec __user *) &in,
62591 - (struct timespec __user *) &out);
62592 + (struct timespec __force_user *) &in,
62593 + (struct timespec __force_user *) &out);
62594 set_fs(oldfs);
62595
62596 if ((err == -ERESTART_RESTARTBLOCK) && rmtp &&
62597 diff -urNp linux-3.0.9/kernel/configs.c linux-3.0.9/kernel/configs.c
62598 --- linux-3.0.9/kernel/configs.c 2011-11-11 13:12:24.000000000 -0500
62599 +++ linux-3.0.9/kernel/configs.c 2011-11-15 20:03:00.000000000 -0500
62600 @@ -74,8 +74,19 @@ static int __init ikconfig_init(void)
62601 struct proc_dir_entry *entry;
62602
62603 /* create the current config file */
62604 +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
62605 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
62606 + entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
62607 + &ikconfig_file_ops);
62608 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
62609 + entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
62610 + &ikconfig_file_ops);
62611 +#endif
62612 +#else
62613 entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
62614 &ikconfig_file_ops);
62615 +#endif
62616 +
62617 if (!entry)
62618 return -ENOMEM;
62619
62620 diff -urNp linux-3.0.9/kernel/cred.c linux-3.0.9/kernel/cred.c
62621 --- linux-3.0.9/kernel/cred.c 2011-11-11 13:12:24.000000000 -0500
62622 +++ linux-3.0.9/kernel/cred.c 2011-11-15 20:03:00.000000000 -0500
62623 @@ -158,6 +158,8 @@ static void put_cred_rcu(struct rcu_head
62624 */
62625 void __put_cred(struct cred *cred)
62626 {
62627 + pax_track_stack();
62628 +
62629 kdebug("__put_cred(%p{%d,%d})", cred,
62630 atomic_read(&cred->usage),
62631 read_cred_subscribers(cred));
62632 @@ -182,6 +184,8 @@ void exit_creds(struct task_struct *tsk)
62633 {
62634 struct cred *cred;
62635
62636 + pax_track_stack();
62637 +
62638 kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
62639 atomic_read(&tsk->cred->usage),
62640 read_cred_subscribers(tsk->cred));
62641 @@ -220,6 +224,8 @@ const struct cred *get_task_cred(struct
62642 {
62643 const struct cred *cred;
62644
62645 + pax_track_stack();
62646 +
62647 rcu_read_lock();
62648
62649 do {
62650 @@ -239,6 +245,8 @@ struct cred *cred_alloc_blank(void)
62651 {
62652 struct cred *new;
62653
62654 + pax_track_stack();
62655 +
62656 new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
62657 if (!new)
62658 return NULL;
62659 @@ -287,6 +295,8 @@ struct cred *prepare_creds(void)
62660 const struct cred *old;
62661 struct cred *new;
62662
62663 + pax_track_stack();
62664 +
62665 validate_process_creds();
62666
62667 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
62668 @@ -333,6 +343,8 @@ struct cred *prepare_exec_creds(void)
62669 struct thread_group_cred *tgcred = NULL;
62670 struct cred *new;
62671
62672 + pax_track_stack();
62673 +
62674 #ifdef CONFIG_KEYS
62675 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
62676 if (!tgcred)
62677 @@ -385,6 +397,8 @@ int copy_creds(struct task_struct *p, un
62678 struct cred *new;
62679 int ret;
62680
62681 + pax_track_stack();
62682 +
62683 if (
62684 #ifdef CONFIG_KEYS
62685 !p->cred->thread_keyring &&
62686 @@ -475,6 +489,8 @@ int commit_creds(struct cred *new)
62687 struct task_struct *task = current;
62688 const struct cred *old = task->real_cred;
62689
62690 + pax_track_stack();
62691 +
62692 kdebug("commit_creds(%p{%d,%d})", new,
62693 atomic_read(&new->usage),
62694 read_cred_subscribers(new));
62695 @@ -489,6 +505,8 @@ int commit_creds(struct cred *new)
62696
62697 get_cred(new); /* we will require a ref for the subj creds too */
62698
62699 + gr_set_role_label(task, new->uid, new->gid);
62700 +
62701 /* dumpability changes */
62702 if (old->euid != new->euid ||
62703 old->egid != new->egid ||
62704 @@ -508,10 +526,8 @@ int commit_creds(struct cred *new)
62705 key_fsgid_changed(task);
62706
62707 /* do it
62708 - * - What if a process setreuid()'s and this brings the
62709 - * new uid over his NPROC rlimit? We can check this now
62710 - * cheaply with the new uid cache, so if it matters
62711 - * we should be checking for it. -DaveM
62712 + * RLIMIT_NPROC limits on user->processes have already been checked
62713 + * in set_user().
62714 */
62715 alter_cred_subscribers(new, 2);
62716 if (new->user != old->user)
62717 @@ -551,6 +567,8 @@ EXPORT_SYMBOL(commit_creds);
62718 */
62719 void abort_creds(struct cred *new)
62720 {
62721 + pax_track_stack();
62722 +
62723 kdebug("abort_creds(%p{%d,%d})", new,
62724 atomic_read(&new->usage),
62725 read_cred_subscribers(new));
62726 @@ -574,6 +592,8 @@ const struct cred *override_creds(const
62727 {
62728 const struct cred *old = current->cred;
62729
62730 + pax_track_stack();
62731 +
62732 kdebug("override_creds(%p{%d,%d})", new,
62733 atomic_read(&new->usage),
62734 read_cred_subscribers(new));
62735 @@ -603,6 +623,8 @@ void revert_creds(const struct cred *old
62736 {
62737 const struct cred *override = current->cred;
62738
62739 + pax_track_stack();
62740 +
62741 kdebug("revert_creds(%p{%d,%d})", old,
62742 atomic_read(&old->usage),
62743 read_cred_subscribers(old));
62744 @@ -649,6 +671,8 @@ struct cred *prepare_kernel_cred(struct
62745 const struct cred *old;
62746 struct cred *new;
62747
62748 + pax_track_stack();
62749 +
62750 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
62751 if (!new)
62752 return NULL;
62753 @@ -703,6 +727,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
62754 */
62755 int set_security_override(struct cred *new, u32 secid)
62756 {
62757 + pax_track_stack();
62758 +
62759 return security_kernel_act_as(new, secid);
62760 }
62761 EXPORT_SYMBOL(set_security_override);
62762 @@ -722,6 +748,8 @@ int set_security_override_from_ctx(struc
62763 u32 secid;
62764 int ret;
62765
62766 + pax_track_stack();
62767 +
62768 ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
62769 if (ret < 0)
62770 return ret;
62771 diff -urNp linux-3.0.9/kernel/debug/debug_core.c linux-3.0.9/kernel/debug/debug_core.c
62772 --- linux-3.0.9/kernel/debug/debug_core.c 2011-11-11 13:12:24.000000000 -0500
62773 +++ linux-3.0.9/kernel/debug/debug_core.c 2011-11-15 20:03:00.000000000 -0500
62774 @@ -119,7 +119,7 @@ static DEFINE_RAW_SPINLOCK(dbg_slave_loc
62775 */
62776 static atomic_t masters_in_kgdb;
62777 static atomic_t slaves_in_kgdb;
62778 -static atomic_t kgdb_break_tasklet_var;
62779 +static atomic_unchecked_t kgdb_break_tasklet_var;
62780 atomic_t kgdb_setting_breakpoint;
62781
62782 struct task_struct *kgdb_usethread;
62783 @@ -129,7 +129,7 @@ int kgdb_single_step;
62784 static pid_t kgdb_sstep_pid;
62785
62786 /* to keep track of the CPU which is doing the single stepping*/
62787 -atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
62788 +atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
62789
62790 /*
62791 * If you are debugging a problem where roundup (the collection of
62792 @@ -542,7 +542,7 @@ return_normal:
62793 * kernel will only try for the value of sstep_tries before
62794 * giving up and continuing on.
62795 */
62796 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
62797 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
62798 (kgdb_info[cpu].task &&
62799 kgdb_info[cpu].task->pid != kgdb_sstep_pid) && --sstep_tries) {
62800 atomic_set(&kgdb_active, -1);
62801 @@ -636,8 +636,8 @@ cpu_master_loop:
62802 }
62803
62804 kgdb_restore:
62805 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
62806 - int sstep_cpu = atomic_read(&kgdb_cpu_doing_single_step);
62807 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
62808 + int sstep_cpu = atomic_read_unchecked(&kgdb_cpu_doing_single_step);
62809 if (kgdb_info[sstep_cpu].task)
62810 kgdb_sstep_pid = kgdb_info[sstep_cpu].task->pid;
62811 else
62812 @@ -834,18 +834,18 @@ static void kgdb_unregister_callbacks(vo
62813 static void kgdb_tasklet_bpt(unsigned long ing)
62814 {
62815 kgdb_breakpoint();
62816 - atomic_set(&kgdb_break_tasklet_var, 0);
62817 + atomic_set_unchecked(&kgdb_break_tasklet_var, 0);
62818 }
62819
62820 static DECLARE_TASKLET(kgdb_tasklet_breakpoint, kgdb_tasklet_bpt, 0);
62821
62822 void kgdb_schedule_breakpoint(void)
62823 {
62824 - if (atomic_read(&kgdb_break_tasklet_var) ||
62825 + if (atomic_read_unchecked(&kgdb_break_tasklet_var) ||
62826 atomic_read(&kgdb_active) != -1 ||
62827 atomic_read(&kgdb_setting_breakpoint))
62828 return;
62829 - atomic_inc(&kgdb_break_tasklet_var);
62830 + atomic_inc_unchecked(&kgdb_break_tasklet_var);
62831 tasklet_schedule(&kgdb_tasklet_breakpoint);
62832 }
62833 EXPORT_SYMBOL_GPL(kgdb_schedule_breakpoint);
62834 diff -urNp linux-3.0.9/kernel/debug/kdb/kdb_main.c linux-3.0.9/kernel/debug/kdb/kdb_main.c
62835 --- linux-3.0.9/kernel/debug/kdb/kdb_main.c 2011-11-11 13:12:24.000000000 -0500
62836 +++ linux-3.0.9/kernel/debug/kdb/kdb_main.c 2011-11-15 20:03:00.000000000 -0500
62837 @@ -1980,7 +1980,7 @@ static int kdb_lsmod(int argc, const cha
62838 list_for_each_entry(mod, kdb_modules, list) {
62839
62840 kdb_printf("%-20s%8u 0x%p ", mod->name,
62841 - mod->core_size, (void *)mod);
62842 + mod->core_size_rx + mod->core_size_rw, (void *)mod);
62843 #ifdef CONFIG_MODULE_UNLOAD
62844 kdb_printf("%4d ", module_refcount(mod));
62845 #endif
62846 @@ -1990,7 +1990,7 @@ static int kdb_lsmod(int argc, const cha
62847 kdb_printf(" (Loading)");
62848 else
62849 kdb_printf(" (Live)");
62850 - kdb_printf(" 0x%p", mod->module_core);
62851 + kdb_printf(" 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
62852
62853 #ifdef CONFIG_MODULE_UNLOAD
62854 {
62855 diff -urNp linux-3.0.9/kernel/events/core.c linux-3.0.9/kernel/events/core.c
62856 --- linux-3.0.9/kernel/events/core.c 2011-11-11 13:12:24.000000000 -0500
62857 +++ linux-3.0.9/kernel/events/core.c 2011-11-15 20:03:00.000000000 -0500
62858 @@ -170,7 +170,7 @@ int perf_proc_update_handler(struct ctl_
62859 return 0;
62860 }
62861
62862 -static atomic64_t perf_event_id;
62863 +static atomic64_unchecked_t perf_event_id;
62864
62865 static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
62866 enum event_type_t event_type);
62867 @@ -2488,7 +2488,7 @@ static void __perf_event_read(void *info
62868
62869 static inline u64 perf_event_count(struct perf_event *event)
62870 {
62871 - return local64_read(&event->count) + atomic64_read(&event->child_count);
62872 + return local64_read(&event->count) + atomic64_read_unchecked(&event->child_count);
62873 }
62874
62875 static u64 perf_event_read(struct perf_event *event)
62876 @@ -3023,9 +3023,9 @@ u64 perf_event_read_value(struct perf_ev
62877 mutex_lock(&event->child_mutex);
62878 total += perf_event_read(event);
62879 *enabled += event->total_time_enabled +
62880 - atomic64_read(&event->child_total_time_enabled);
62881 + atomic64_read_unchecked(&event->child_total_time_enabled);
62882 *running += event->total_time_running +
62883 - atomic64_read(&event->child_total_time_running);
62884 + atomic64_read_unchecked(&event->child_total_time_running);
62885
62886 list_for_each_entry(child, &event->child_list, child_list) {
62887 total += perf_event_read(child);
62888 @@ -3388,10 +3388,10 @@ void perf_event_update_userpage(struct p
62889 userpg->offset -= local64_read(&event->hw.prev_count);
62890
62891 userpg->time_enabled = event->total_time_enabled +
62892 - atomic64_read(&event->child_total_time_enabled);
62893 + atomic64_read_unchecked(&event->child_total_time_enabled);
62894
62895 userpg->time_running = event->total_time_running +
62896 - atomic64_read(&event->child_total_time_running);
62897 + atomic64_read_unchecked(&event->child_total_time_running);
62898
62899 barrier();
62900 ++userpg->lock;
62901 @@ -4188,11 +4188,11 @@ static void perf_output_read_one(struct
62902 values[n++] = perf_event_count(event);
62903 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
62904 values[n++] = enabled +
62905 - atomic64_read(&event->child_total_time_enabled);
62906 + atomic64_read_unchecked(&event->child_total_time_enabled);
62907 }
62908 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
62909 values[n++] = running +
62910 - atomic64_read(&event->child_total_time_running);
62911 + atomic64_read_unchecked(&event->child_total_time_running);
62912 }
62913 if (read_format & PERF_FORMAT_ID)
62914 values[n++] = primary_event_id(event);
62915 @@ -4833,12 +4833,12 @@ static void perf_event_mmap_event(struct
62916 * need to add enough zero bytes after the string to handle
62917 * the 64bit alignment we do later.
62918 */
62919 - buf = kzalloc(PATH_MAX + sizeof(u64), GFP_KERNEL);
62920 + buf = kzalloc(PATH_MAX, GFP_KERNEL);
62921 if (!buf) {
62922 name = strncpy(tmp, "//enomem", sizeof(tmp));
62923 goto got_name;
62924 }
62925 - name = d_path(&file->f_path, buf, PATH_MAX);
62926 + name = d_path(&file->f_path, buf, PATH_MAX - sizeof(u64));
62927 if (IS_ERR(name)) {
62928 name = strncpy(tmp, "//toolong", sizeof(tmp));
62929 goto got_name;
62930 @@ -6190,7 +6190,7 @@ perf_event_alloc(struct perf_event_attr
62931 event->parent = parent_event;
62932
62933 event->ns = get_pid_ns(current->nsproxy->pid_ns);
62934 - event->id = atomic64_inc_return(&perf_event_id);
62935 + event->id = atomic64_inc_return_unchecked(&perf_event_id);
62936
62937 event->state = PERF_EVENT_STATE_INACTIVE;
62938
62939 @@ -6713,10 +6713,10 @@ static void sync_child_event(struct perf
62940 /*
62941 * Add back the child's count to the parent's count:
62942 */
62943 - atomic64_add(child_val, &parent_event->child_count);
62944 - atomic64_add(child_event->total_time_enabled,
62945 + atomic64_add_unchecked(child_val, &parent_event->child_count);
62946 + atomic64_add_unchecked(child_event->total_time_enabled,
62947 &parent_event->child_total_time_enabled);
62948 - atomic64_add(child_event->total_time_running,
62949 + atomic64_add_unchecked(child_event->total_time_running,
62950 &parent_event->child_total_time_running);
62951
62952 /*
62953 diff -urNp linux-3.0.9/kernel/exit.c linux-3.0.9/kernel/exit.c
62954 --- linux-3.0.9/kernel/exit.c 2011-11-11 13:12:24.000000000 -0500
62955 +++ linux-3.0.9/kernel/exit.c 2011-11-15 20:03:00.000000000 -0500
62956 @@ -57,6 +57,10 @@
62957 #include <asm/pgtable.h>
62958 #include <asm/mmu_context.h>
62959
62960 +#ifdef CONFIG_GRKERNSEC
62961 +extern rwlock_t grsec_exec_file_lock;
62962 +#endif
62963 +
62964 static void exit_mm(struct task_struct * tsk);
62965
62966 static void __unhash_process(struct task_struct *p, bool group_dead)
62967 @@ -169,6 +173,10 @@ void release_task(struct task_struct * p
62968 struct task_struct *leader;
62969 int zap_leader;
62970 repeat:
62971 +#ifdef CONFIG_NET
62972 + gr_del_task_from_ip_table(p);
62973 +#endif
62974 +
62975 tracehook_prepare_release_task(p);
62976 /* don't need to get the RCU readlock here - the process is dead and
62977 * can't be modifying its own credentials. But shut RCU-lockdep up */
62978 @@ -338,11 +346,22 @@ static void reparent_to_kthreadd(void)
62979 {
62980 write_lock_irq(&tasklist_lock);
62981
62982 +#ifdef CONFIG_GRKERNSEC
62983 + write_lock(&grsec_exec_file_lock);
62984 + if (current->exec_file) {
62985 + fput(current->exec_file);
62986 + current->exec_file = NULL;
62987 + }
62988 + write_unlock(&grsec_exec_file_lock);
62989 +#endif
62990 +
62991 ptrace_unlink(current);
62992 /* Reparent to init */
62993 current->real_parent = current->parent = kthreadd_task;
62994 list_move_tail(&current->sibling, &current->real_parent->children);
62995
62996 + gr_set_kernel_label(current);
62997 +
62998 /* Set the exit signal to SIGCHLD so we signal init on exit */
62999 current->exit_signal = SIGCHLD;
63000
63001 @@ -394,7 +413,7 @@ int allow_signal(int sig)
63002 * know it'll be handled, so that they don't get converted to
63003 * SIGKILL or just silently dropped.
63004 */
63005 - current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
63006 + current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
63007 recalc_sigpending();
63008 spin_unlock_irq(&current->sighand->siglock);
63009 return 0;
63010 @@ -430,6 +449,17 @@ void daemonize(const char *name, ...)
63011 vsnprintf(current->comm, sizeof(current->comm), name, args);
63012 va_end(args);
63013
63014 +#ifdef CONFIG_GRKERNSEC
63015 + write_lock(&grsec_exec_file_lock);
63016 + if (current->exec_file) {
63017 + fput(current->exec_file);
63018 + current->exec_file = NULL;
63019 + }
63020 + write_unlock(&grsec_exec_file_lock);
63021 +#endif
63022 +
63023 + gr_set_kernel_label(current);
63024 +
63025 /*
63026 * If we were started as result of loading a module, close all of the
63027 * user space pages. We don't need them, and if we didn't close them
63028 @@ -904,15 +934,8 @@ NORET_TYPE void do_exit(long code)
63029 struct task_struct *tsk = current;
63030 int group_dead;
63031
63032 - profile_task_exit(tsk);
63033 -
63034 - WARN_ON(atomic_read(&tsk->fs_excl));
63035 - WARN_ON(blk_needs_flush_plug(tsk));
63036 -
63037 if (unlikely(in_interrupt()))
63038 panic("Aiee, killing interrupt handler!");
63039 - if (unlikely(!tsk->pid))
63040 - panic("Attempted to kill the idle task!");
63041
63042 /*
63043 * If do_exit is called because this processes oopsed, it's possible
63044 @@ -923,6 +946,14 @@ NORET_TYPE void do_exit(long code)
63045 */
63046 set_fs(USER_DS);
63047
63048 + profile_task_exit(tsk);
63049 +
63050 + WARN_ON(atomic_read(&tsk->fs_excl));
63051 + WARN_ON(blk_needs_flush_plug(tsk));
63052 +
63053 + if (unlikely(!tsk->pid))
63054 + panic("Attempted to kill the idle task!");
63055 +
63056 tracehook_report_exit(&code);
63057
63058 validate_creds_for_do_exit(tsk);
63059 @@ -983,6 +1014,9 @@ NORET_TYPE void do_exit(long code)
63060 tsk->exit_code = code;
63061 taskstats_exit(tsk, group_dead);
63062
63063 + gr_acl_handle_psacct(tsk, code);
63064 + gr_acl_handle_exit();
63065 +
63066 exit_mm(tsk);
63067
63068 if (group_dead)
63069 diff -urNp linux-3.0.9/kernel/fork.c linux-3.0.9/kernel/fork.c
63070 --- linux-3.0.9/kernel/fork.c 2011-11-11 13:12:24.000000000 -0500
63071 +++ linux-3.0.9/kernel/fork.c 2011-11-15 20:03:00.000000000 -0500
63072 @@ -286,7 +286,7 @@ static struct task_struct *dup_task_stru
63073 *stackend = STACK_END_MAGIC; /* for overflow detection */
63074
63075 #ifdef CONFIG_CC_STACKPROTECTOR
63076 - tsk->stack_canary = get_random_int();
63077 + tsk->stack_canary = pax_get_random_long();
63078 #endif
63079
63080 /* One for us, one for whoever does the "release_task()" (usually parent) */
63081 @@ -308,13 +308,77 @@ out:
63082 }
63083
63084 #ifdef CONFIG_MMU
63085 +static struct vm_area_struct *dup_vma(struct mm_struct *mm, struct vm_area_struct *mpnt)
63086 +{
63087 + struct vm_area_struct *tmp;
63088 + unsigned long charge;
63089 + struct mempolicy *pol;
63090 + struct file *file;
63091 +
63092 + charge = 0;
63093 + if (mpnt->vm_flags & VM_ACCOUNT) {
63094 + unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
63095 + if (security_vm_enough_memory(len))
63096 + goto fail_nomem;
63097 + charge = len;
63098 + }
63099 + tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
63100 + if (!tmp)
63101 + goto fail_nomem;
63102 + *tmp = *mpnt;
63103 + tmp->vm_mm = mm;
63104 + INIT_LIST_HEAD(&tmp->anon_vma_chain);
63105 + pol = mpol_dup(vma_policy(mpnt));
63106 + if (IS_ERR(pol))
63107 + goto fail_nomem_policy;
63108 + vma_set_policy(tmp, pol);
63109 + if (anon_vma_fork(tmp, mpnt))
63110 + goto fail_nomem_anon_vma_fork;
63111 + tmp->vm_flags &= ~VM_LOCKED;
63112 + tmp->vm_next = tmp->vm_prev = NULL;
63113 + tmp->vm_mirror = NULL;
63114 + file = tmp->vm_file;
63115 + if (file) {
63116 + struct inode *inode = file->f_path.dentry->d_inode;
63117 + struct address_space *mapping = file->f_mapping;
63118 +
63119 + get_file(file);
63120 + if (tmp->vm_flags & VM_DENYWRITE)
63121 + atomic_dec(&inode->i_writecount);
63122 + mutex_lock(&mapping->i_mmap_mutex);
63123 + if (tmp->vm_flags & VM_SHARED)
63124 + mapping->i_mmap_writable++;
63125 + flush_dcache_mmap_lock(mapping);
63126 + /* insert tmp into the share list, just after mpnt */
63127 + vma_prio_tree_add(tmp, mpnt);
63128 + flush_dcache_mmap_unlock(mapping);
63129 + mutex_unlock(&mapping->i_mmap_mutex);
63130 + }
63131 +
63132 + /*
63133 + * Clear hugetlb-related page reserves for children. This only
63134 + * affects MAP_PRIVATE mappings. Faults generated by the child
63135 + * are not guaranteed to succeed, even if read-only
63136 + */
63137 + if (is_vm_hugetlb_page(tmp))
63138 + reset_vma_resv_huge_pages(tmp);
63139 +
63140 + return tmp;
63141 +
63142 +fail_nomem_anon_vma_fork:
63143 + mpol_put(pol);
63144 +fail_nomem_policy:
63145 + kmem_cache_free(vm_area_cachep, tmp);
63146 +fail_nomem:
63147 + vm_unacct_memory(charge);
63148 + return NULL;
63149 +}
63150 +
63151 static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
63152 {
63153 struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
63154 struct rb_node **rb_link, *rb_parent;
63155 int retval;
63156 - unsigned long charge;
63157 - struct mempolicy *pol;
63158
63159 down_write(&oldmm->mmap_sem);
63160 flush_cache_dup_mm(oldmm);
63161 @@ -326,8 +390,8 @@ static int dup_mmap(struct mm_struct *mm
63162 mm->locked_vm = 0;
63163 mm->mmap = NULL;
63164 mm->mmap_cache = NULL;
63165 - mm->free_area_cache = oldmm->mmap_base;
63166 - mm->cached_hole_size = ~0UL;
63167 + mm->free_area_cache = oldmm->free_area_cache;
63168 + mm->cached_hole_size = oldmm->cached_hole_size;
63169 mm->map_count = 0;
63170 cpumask_clear(mm_cpumask(mm));
63171 mm->mm_rb = RB_ROOT;
63172 @@ -343,8 +407,6 @@ static int dup_mmap(struct mm_struct *mm
63173
63174 prev = NULL;
63175 for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
63176 - struct file *file;
63177 -
63178 if (mpnt->vm_flags & VM_DONTCOPY) {
63179 long pages = vma_pages(mpnt);
63180 mm->total_vm -= pages;
63181 @@ -352,55 +414,13 @@ static int dup_mmap(struct mm_struct *mm
63182 -pages);
63183 continue;
63184 }
63185 - charge = 0;
63186 - if (mpnt->vm_flags & VM_ACCOUNT) {
63187 - unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
63188 - if (security_vm_enough_memory(len))
63189 - goto fail_nomem;
63190 - charge = len;
63191 - }
63192 - tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
63193 - if (!tmp)
63194 - goto fail_nomem;
63195 - *tmp = *mpnt;
63196 - INIT_LIST_HEAD(&tmp->anon_vma_chain);
63197 - pol = mpol_dup(vma_policy(mpnt));
63198 - retval = PTR_ERR(pol);
63199 - if (IS_ERR(pol))
63200 - goto fail_nomem_policy;
63201 - vma_set_policy(tmp, pol);
63202 - tmp->vm_mm = mm;
63203 - if (anon_vma_fork(tmp, mpnt))
63204 - goto fail_nomem_anon_vma_fork;
63205 - tmp->vm_flags &= ~VM_LOCKED;
63206 - tmp->vm_next = tmp->vm_prev = NULL;
63207 - file = tmp->vm_file;
63208 - if (file) {
63209 - struct inode *inode = file->f_path.dentry->d_inode;
63210 - struct address_space *mapping = file->f_mapping;
63211 -
63212 - get_file(file);
63213 - if (tmp->vm_flags & VM_DENYWRITE)
63214 - atomic_dec(&inode->i_writecount);
63215 - mutex_lock(&mapping->i_mmap_mutex);
63216 - if (tmp->vm_flags & VM_SHARED)
63217 - mapping->i_mmap_writable++;
63218 - flush_dcache_mmap_lock(mapping);
63219 - /* insert tmp into the share list, just after mpnt */
63220 - vma_prio_tree_add(tmp, mpnt);
63221 - flush_dcache_mmap_unlock(mapping);
63222 - mutex_unlock(&mapping->i_mmap_mutex);
63223 + tmp = dup_vma(mm, mpnt);
63224 + if (!tmp) {
63225 + retval = -ENOMEM;
63226 + goto out;
63227 }
63228
63229 /*
63230 - * Clear hugetlb-related page reserves for children. This only
63231 - * affects MAP_PRIVATE mappings. Faults generated by the child
63232 - * are not guaranteed to succeed, even if read-only
63233 - */
63234 - if (is_vm_hugetlb_page(tmp))
63235 - reset_vma_resv_huge_pages(tmp);
63236 -
63237 - /*
63238 * Link in the new vma and copy the page table entries.
63239 */
63240 *pprev = tmp;
63241 @@ -421,6 +441,31 @@ static int dup_mmap(struct mm_struct *mm
63242 if (retval)
63243 goto out;
63244 }
63245 +
63246 +#ifdef CONFIG_PAX_SEGMEXEC
63247 + if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
63248 + struct vm_area_struct *mpnt_m;
63249 +
63250 + for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
63251 + BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
63252 +
63253 + if (!mpnt->vm_mirror)
63254 + continue;
63255 +
63256 + if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
63257 + BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
63258 + mpnt->vm_mirror = mpnt_m;
63259 + } else {
63260 + BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
63261 + mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
63262 + mpnt_m->vm_mirror->vm_mirror = mpnt_m;
63263 + mpnt->vm_mirror->vm_mirror = mpnt;
63264 + }
63265 + }
63266 + BUG_ON(mpnt_m);
63267 + }
63268 +#endif
63269 +
63270 /* a new mm has just been created */
63271 arch_dup_mmap(oldmm, mm);
63272 retval = 0;
63273 @@ -429,14 +474,6 @@ out:
63274 flush_tlb_mm(oldmm);
63275 up_write(&oldmm->mmap_sem);
63276 return retval;
63277 -fail_nomem_anon_vma_fork:
63278 - mpol_put(pol);
63279 -fail_nomem_policy:
63280 - kmem_cache_free(vm_area_cachep, tmp);
63281 -fail_nomem:
63282 - retval = -ENOMEM;
63283 - vm_unacct_memory(charge);
63284 - goto out;
63285 }
63286
63287 static inline int mm_alloc_pgd(struct mm_struct * mm)
63288 @@ -836,13 +873,14 @@ static int copy_fs(unsigned long clone_f
63289 spin_unlock(&fs->lock);
63290 return -EAGAIN;
63291 }
63292 - fs->users++;
63293 + atomic_inc(&fs->users);
63294 spin_unlock(&fs->lock);
63295 return 0;
63296 }
63297 tsk->fs = copy_fs_struct(fs);
63298 if (!tsk->fs)
63299 return -ENOMEM;
63300 + gr_set_chroot_entries(tsk, &tsk->fs->root);
63301 return 0;
63302 }
63303
63304 @@ -1104,12 +1142,16 @@ static struct task_struct *copy_process(
63305 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
63306 #endif
63307 retval = -EAGAIN;
63308 +
63309 + gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
63310 +
63311 if (atomic_read(&p->real_cred->user->processes) >=
63312 task_rlimit(p, RLIMIT_NPROC)) {
63313 - if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
63314 - p->real_cred->user != INIT_USER)
63315 + if (p->real_cred->user != INIT_USER &&
63316 + !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE))
63317 goto bad_fork_free;
63318 }
63319 + current->flags &= ~PF_NPROC_EXCEEDED;
63320
63321 retval = copy_creds(p, clone_flags);
63322 if (retval < 0)
63323 @@ -1250,6 +1292,8 @@ static struct task_struct *copy_process(
63324 if (clone_flags & CLONE_THREAD)
63325 p->tgid = current->tgid;
63326
63327 + gr_copy_label(p);
63328 +
63329 p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
63330 /*
63331 * Clear TID on mm_release()?
63332 @@ -1414,6 +1458,8 @@ bad_fork_cleanup_count:
63333 bad_fork_free:
63334 free_task(p);
63335 fork_out:
63336 + gr_log_forkfail(retval);
63337 +
63338 return ERR_PTR(retval);
63339 }
63340
63341 @@ -1502,6 +1548,8 @@ long do_fork(unsigned long clone_flags,
63342 if (clone_flags & CLONE_PARENT_SETTID)
63343 put_user(nr, parent_tidptr);
63344
63345 + gr_handle_brute_check();
63346 +
63347 if (clone_flags & CLONE_VFORK) {
63348 p->vfork_done = &vfork;
63349 init_completion(&vfork);
63350 @@ -1610,7 +1658,7 @@ static int unshare_fs(unsigned long unsh
63351 return 0;
63352
63353 /* don't need lock here; in the worst case we'll do useless copy */
63354 - if (fs->users == 1)
63355 + if (atomic_read(&fs->users) == 1)
63356 return 0;
63357
63358 *new_fsp = copy_fs_struct(fs);
63359 @@ -1697,7 +1745,8 @@ SYSCALL_DEFINE1(unshare, unsigned long,
63360 fs = current->fs;
63361 spin_lock(&fs->lock);
63362 current->fs = new_fs;
63363 - if (--fs->users)
63364 + gr_set_chroot_entries(current, &current->fs->root);
63365 + if (atomic_dec_return(&fs->users))
63366 new_fs = NULL;
63367 else
63368 new_fs = fs;
63369 diff -urNp linux-3.0.9/kernel/futex.c linux-3.0.9/kernel/futex.c
63370 --- linux-3.0.9/kernel/futex.c 2011-11-11 13:12:24.000000000 -0500
63371 +++ linux-3.0.9/kernel/futex.c 2011-11-15 20:03:00.000000000 -0500
63372 @@ -54,6 +54,7 @@
63373 #include <linux/mount.h>
63374 #include <linux/pagemap.h>
63375 #include <linux/syscalls.h>
63376 +#include <linux/ptrace.h>
63377 #include <linux/signal.h>
63378 #include <linux/module.h>
63379 #include <linux/magic.h>
63380 @@ -238,6 +239,11 @@ get_futex_key(u32 __user *uaddr, int fsh
63381 struct page *page, *page_head;
63382 int err, ro = 0;
63383
63384 +#ifdef CONFIG_PAX_SEGMEXEC
63385 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
63386 + return -EFAULT;
63387 +#endif
63388 +
63389 /*
63390 * The futex address must be "naturally" aligned.
63391 */
63392 @@ -1863,6 +1869,8 @@ static int futex_wait(u32 __user *uaddr,
63393 struct futex_q q = futex_q_init;
63394 int ret;
63395
63396 + pax_track_stack();
63397 +
63398 if (!bitset)
63399 return -EINVAL;
63400 q.bitset = bitset;
63401 @@ -2259,6 +2267,8 @@ static int futex_wait_requeue_pi(u32 __u
63402 struct futex_q q = futex_q_init;
63403 int res, ret;
63404
63405 + pax_track_stack();
63406 +
63407 if (!bitset)
63408 return -EINVAL;
63409
63410 @@ -2431,7 +2441,9 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
63411 {
63412 struct robust_list_head __user *head;
63413 unsigned long ret;
63414 +#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
63415 const struct cred *cred = current_cred(), *pcred;
63416 +#endif
63417
63418 if (!futex_cmpxchg_enabled)
63419 return -ENOSYS;
63420 @@ -2447,6 +2459,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
63421 if (!p)
63422 goto err_unlock;
63423 ret = -EPERM;
63424 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
63425 + if (!ptrace_may_access(p, PTRACE_MODE_READ))
63426 + goto err_unlock;
63427 +#else
63428 pcred = __task_cred(p);
63429 /* If victim is in different user_ns, then uids are not
63430 comparable, so we must have CAP_SYS_PTRACE */
63431 @@ -2461,6 +2477,7 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
63432 !ns_capable(pcred->user->user_ns, CAP_SYS_PTRACE))
63433 goto err_unlock;
63434 ok:
63435 +#endif
63436 head = p->robust_list;
63437 rcu_read_unlock();
63438 }
63439 @@ -2712,6 +2729,7 @@ static int __init futex_init(void)
63440 {
63441 u32 curval;
63442 int i;
63443 + mm_segment_t oldfs;
63444
63445 /*
63446 * This will fail and we want it. Some arch implementations do
63447 @@ -2723,8 +2741,11 @@ static int __init futex_init(void)
63448 * implementation, the non-functional ones will return
63449 * -ENOSYS.
63450 */
63451 + oldfs = get_fs();
63452 + set_fs(USER_DS);
63453 if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT)
63454 futex_cmpxchg_enabled = 1;
63455 + set_fs(oldfs);
63456
63457 for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
63458 plist_head_init(&futex_queues[i].chain, &futex_queues[i].lock);
63459 diff -urNp linux-3.0.9/kernel/futex_compat.c linux-3.0.9/kernel/futex_compat.c
63460 --- linux-3.0.9/kernel/futex_compat.c 2011-11-11 13:12:24.000000000 -0500
63461 +++ linux-3.0.9/kernel/futex_compat.c 2011-11-15 20:03:00.000000000 -0500
63462 @@ -10,6 +10,7 @@
63463 #include <linux/compat.h>
63464 #include <linux/nsproxy.h>
63465 #include <linux/futex.h>
63466 +#include <linux/ptrace.h>
63467
63468 #include <asm/uaccess.h>
63469
63470 @@ -136,7 +137,10 @@ compat_sys_get_robust_list(int pid, comp
63471 {
63472 struct compat_robust_list_head __user *head;
63473 unsigned long ret;
63474 - const struct cred *cred = current_cred(), *pcred;
63475 +#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
63476 + const struct cred *cred = current_cred();
63477 + const struct cred *pcred;
63478 +#endif
63479
63480 if (!futex_cmpxchg_enabled)
63481 return -ENOSYS;
63482 @@ -152,6 +156,10 @@ compat_sys_get_robust_list(int pid, comp
63483 if (!p)
63484 goto err_unlock;
63485 ret = -EPERM;
63486 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
63487 + if (!ptrace_may_access(p, PTRACE_MODE_READ))
63488 + goto err_unlock;
63489 +#else
63490 pcred = __task_cred(p);
63491 /* If victim is in different user_ns, then uids are not
63492 comparable, so we must have CAP_SYS_PTRACE */
63493 @@ -166,6 +174,7 @@ compat_sys_get_robust_list(int pid, comp
63494 !ns_capable(pcred->user->user_ns, CAP_SYS_PTRACE))
63495 goto err_unlock;
63496 ok:
63497 +#endif
63498 head = p->compat_robust_list;
63499 rcu_read_unlock();
63500 }
63501 diff -urNp linux-3.0.9/kernel/gcov/base.c linux-3.0.9/kernel/gcov/base.c
63502 --- linux-3.0.9/kernel/gcov/base.c 2011-11-11 13:12:24.000000000 -0500
63503 +++ linux-3.0.9/kernel/gcov/base.c 2011-11-15 20:03:00.000000000 -0500
63504 @@ -102,11 +102,6 @@ void gcov_enable_events(void)
63505 }
63506
63507 #ifdef CONFIG_MODULES
63508 -static inline int within(void *addr, void *start, unsigned long size)
63509 -{
63510 - return ((addr >= start) && (addr < start + size));
63511 -}
63512 -
63513 /* Update list and generate events when modules are unloaded. */
63514 static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
63515 void *data)
63516 @@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n
63517 prev = NULL;
63518 /* Remove entries located in module from linked list. */
63519 for (info = gcov_info_head; info; info = info->next) {
63520 - if (within(info, mod->module_core, mod->core_size)) {
63521 + if (within_module_core_rw((unsigned long)info, mod)) {
63522 if (prev)
63523 prev->next = info->next;
63524 else
63525 diff -urNp linux-3.0.9/kernel/hrtimer.c linux-3.0.9/kernel/hrtimer.c
63526 --- linux-3.0.9/kernel/hrtimer.c 2011-11-11 13:12:24.000000000 -0500
63527 +++ linux-3.0.9/kernel/hrtimer.c 2011-11-15 20:03:00.000000000 -0500
63528 @@ -1391,7 +1391,7 @@ void hrtimer_peek_ahead_timers(void)
63529 local_irq_restore(flags);
63530 }
63531
63532 -static void run_hrtimer_softirq(struct softirq_action *h)
63533 +static void run_hrtimer_softirq(void)
63534 {
63535 hrtimer_peek_ahead_timers();
63536 }
63537 diff -urNp linux-3.0.9/kernel/jump_label.c linux-3.0.9/kernel/jump_label.c
63538 --- linux-3.0.9/kernel/jump_label.c 2011-11-11 13:12:24.000000000 -0500
63539 +++ linux-3.0.9/kernel/jump_label.c 2011-11-15 20:03:00.000000000 -0500
63540 @@ -55,7 +55,9 @@ jump_label_sort_entries(struct jump_entr
63541
63542 size = (((unsigned long)stop - (unsigned long)start)
63543 / sizeof(struct jump_entry));
63544 + pax_open_kernel();
63545 sort(start, size, sizeof(struct jump_entry), jump_label_cmp, NULL);
63546 + pax_close_kernel();
63547 }
63548
63549 static void jump_label_update(struct jump_label_key *key, int enable);
63550 @@ -297,10 +299,12 @@ static void jump_label_invalidate_module
63551 struct jump_entry *iter_stop = iter_start + mod->num_jump_entries;
63552 struct jump_entry *iter;
63553
63554 + pax_open_kernel();
63555 for (iter = iter_start; iter < iter_stop; iter++) {
63556 if (within_module_init(iter->code, mod))
63557 iter->code = 0;
63558 }
63559 + pax_close_kernel();
63560 }
63561
63562 static int
63563 diff -urNp linux-3.0.9/kernel/kallsyms.c linux-3.0.9/kernel/kallsyms.c
63564 --- linux-3.0.9/kernel/kallsyms.c 2011-11-11 13:12:24.000000000 -0500
63565 +++ linux-3.0.9/kernel/kallsyms.c 2011-11-15 20:03:00.000000000 -0500
63566 @@ -11,6 +11,9 @@
63567 * Changed the compression method from stem compression to "table lookup"
63568 * compression (see scripts/kallsyms.c for a more complete description)
63569 */
63570 +#ifdef CONFIG_GRKERNSEC_HIDESYM
63571 +#define __INCLUDED_BY_HIDESYM 1
63572 +#endif
63573 #include <linux/kallsyms.h>
63574 #include <linux/module.h>
63575 #include <linux/init.h>
63576 @@ -53,12 +56,33 @@ extern const unsigned long kallsyms_mark
63577
63578 static inline int is_kernel_inittext(unsigned long addr)
63579 {
63580 + if (system_state != SYSTEM_BOOTING)
63581 + return 0;
63582 +
63583 if (addr >= (unsigned long)_sinittext
63584 && addr <= (unsigned long)_einittext)
63585 return 1;
63586 return 0;
63587 }
63588
63589 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
63590 +#ifdef CONFIG_MODULES
63591 +static inline int is_module_text(unsigned long addr)
63592 +{
63593 + if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
63594 + return 1;
63595 +
63596 + addr = ktla_ktva(addr);
63597 + return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
63598 +}
63599 +#else
63600 +static inline int is_module_text(unsigned long addr)
63601 +{
63602 + return 0;
63603 +}
63604 +#endif
63605 +#endif
63606 +
63607 static inline int is_kernel_text(unsigned long addr)
63608 {
63609 if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
63610 @@ -69,13 +93,28 @@ static inline int is_kernel_text(unsigne
63611
63612 static inline int is_kernel(unsigned long addr)
63613 {
63614 +
63615 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
63616 + if (is_kernel_text(addr) || is_kernel_inittext(addr))
63617 + return 1;
63618 +
63619 + if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
63620 +#else
63621 if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
63622 +#endif
63623 +
63624 return 1;
63625 return in_gate_area_no_mm(addr);
63626 }
63627
63628 static int is_ksym_addr(unsigned long addr)
63629 {
63630 +
63631 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
63632 + if (is_module_text(addr))
63633 + return 0;
63634 +#endif
63635 +
63636 if (all_var)
63637 return is_kernel(addr);
63638
63639 @@ -454,7 +493,6 @@ static unsigned long get_ksymbol_core(st
63640
63641 static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
63642 {
63643 - iter->name[0] = '\0';
63644 iter->nameoff = get_symbol_offset(new_pos);
63645 iter->pos = new_pos;
63646 }
63647 @@ -502,6 +540,11 @@ static int s_show(struct seq_file *m, vo
63648 {
63649 struct kallsym_iter *iter = m->private;
63650
63651 +#ifdef CONFIG_GRKERNSEC_HIDESYM
63652 + if (current_uid())
63653 + return 0;
63654 +#endif
63655 +
63656 /* Some debugging symbols have no name. Ignore them. */
63657 if (!iter->name[0])
63658 return 0;
63659 @@ -540,7 +583,7 @@ static int kallsyms_open(struct inode *i
63660 struct kallsym_iter *iter;
63661 int ret;
63662
63663 - iter = kmalloc(sizeof(*iter), GFP_KERNEL);
63664 + iter = kzalloc(sizeof(*iter), GFP_KERNEL);
63665 if (!iter)
63666 return -ENOMEM;
63667 reset_iter(iter, 0);
63668 diff -urNp linux-3.0.9/kernel/kexec.c linux-3.0.9/kernel/kexec.c
63669 --- linux-3.0.9/kernel/kexec.c 2011-11-11 13:12:24.000000000 -0500
63670 +++ linux-3.0.9/kernel/kexec.c 2011-11-15 20:03:00.000000000 -0500
63671 @@ -1033,7 +1033,8 @@ asmlinkage long compat_sys_kexec_load(un
63672 unsigned long flags)
63673 {
63674 struct compat_kexec_segment in;
63675 - struct kexec_segment out, __user *ksegments;
63676 + struct kexec_segment out;
63677 + struct kexec_segment __user *ksegments;
63678 unsigned long i, result;
63679
63680 /* Don't allow clients that don't understand the native
63681 diff -urNp linux-3.0.9/kernel/kmod.c linux-3.0.9/kernel/kmod.c
63682 --- linux-3.0.9/kernel/kmod.c 2011-11-11 13:12:24.000000000 -0500
63683 +++ linux-3.0.9/kernel/kmod.c 2011-11-15 20:03:00.000000000 -0500
63684 @@ -73,13 +73,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sb
63685 * If module auto-loading support is disabled then this function
63686 * becomes a no-operation.
63687 */
63688 -int __request_module(bool wait, const char *fmt, ...)
63689 +static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
63690 {
63691 - va_list args;
63692 char module_name[MODULE_NAME_LEN];
63693 unsigned int max_modprobes;
63694 int ret;
63695 - char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
63696 + char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
63697 static char *envp[] = { "HOME=/",
63698 "TERM=linux",
63699 "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
63700 @@ -88,9 +87,7 @@ int __request_module(bool wait, const ch
63701 #define MAX_KMOD_CONCURRENT 50 /* Completely arbitrary value - KAO */
63702 static int kmod_loop_msg;
63703
63704 - va_start(args, fmt);
63705 - ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
63706 - va_end(args);
63707 + ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
63708 if (ret >= MODULE_NAME_LEN)
63709 return -ENAMETOOLONG;
63710
63711 @@ -98,6 +95,20 @@ int __request_module(bool wait, const ch
63712 if (ret)
63713 return ret;
63714
63715 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
63716 + if (!current_uid()) {
63717 + /* hack to workaround consolekit/udisks stupidity */
63718 + read_lock(&tasklist_lock);
63719 + if (!strcmp(current->comm, "mount") &&
63720 + current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
63721 + read_unlock(&tasklist_lock);
63722 + printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
63723 + return -EPERM;
63724 + }
63725 + read_unlock(&tasklist_lock);
63726 + }
63727 +#endif
63728 +
63729 /* If modprobe needs a service that is in a module, we get a recursive
63730 * loop. Limit the number of running kmod threads to max_threads/2 or
63731 * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
63732 @@ -133,6 +144,47 @@ int __request_module(bool wait, const ch
63733 atomic_dec(&kmod_concurrent);
63734 return ret;
63735 }
63736 +
63737 +int ___request_module(bool wait, char *module_param, const char *fmt, ...)
63738 +{
63739 + va_list args;
63740 + int ret;
63741 +
63742 + va_start(args, fmt);
63743 + ret = ____request_module(wait, module_param, fmt, args);
63744 + va_end(args);
63745 +
63746 + return ret;
63747 +}
63748 +
63749 +int __request_module(bool wait, const char *fmt, ...)
63750 +{
63751 + va_list args;
63752 + int ret;
63753 +
63754 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
63755 + if (current_uid()) {
63756 + char module_param[MODULE_NAME_LEN];
63757 +
63758 + memset(module_param, 0, sizeof(module_param));
63759 +
63760 + snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
63761 +
63762 + va_start(args, fmt);
63763 + ret = ____request_module(wait, module_param, fmt, args);
63764 + va_end(args);
63765 +
63766 + return ret;
63767 + }
63768 +#endif
63769 +
63770 + va_start(args, fmt);
63771 + ret = ____request_module(wait, NULL, fmt, args);
63772 + va_end(args);
63773 +
63774 + return ret;
63775 +}
63776 +
63777 EXPORT_SYMBOL(__request_module);
63778 #endif /* CONFIG_MODULES */
63779
63780 @@ -222,7 +274,7 @@ static int wait_for_helper(void *data)
63781 *
63782 * Thus the __user pointer cast is valid here.
63783 */
63784 - sys_wait4(pid, (int __user *)&ret, 0, NULL);
63785 + sys_wait4(pid, (int __force_user *)&ret, 0, NULL);
63786
63787 /*
63788 * If ret is 0, either ____call_usermodehelper failed and the
63789 diff -urNp linux-3.0.9/kernel/kprobes.c linux-3.0.9/kernel/kprobes.c
63790 --- linux-3.0.9/kernel/kprobes.c 2011-11-11 13:12:24.000000000 -0500
63791 +++ linux-3.0.9/kernel/kprobes.c 2011-11-15 20:03:00.000000000 -0500
63792 @@ -185,7 +185,7 @@ static kprobe_opcode_t __kprobes *__get_
63793 * kernel image and loaded module images reside. This is required
63794 * so x86_64 can correctly handle the %rip-relative fixups.
63795 */
63796 - kip->insns = module_alloc(PAGE_SIZE);
63797 + kip->insns = module_alloc_exec(PAGE_SIZE);
63798 if (!kip->insns) {
63799 kfree(kip);
63800 return NULL;
63801 @@ -225,7 +225,7 @@ static int __kprobes collect_one_slot(st
63802 */
63803 if (!list_is_singular(&kip->list)) {
63804 list_del(&kip->list);
63805 - module_free(NULL, kip->insns);
63806 + module_free_exec(NULL, kip->insns);
63807 kfree(kip);
63808 }
63809 return 1;
63810 @@ -1936,7 +1936,7 @@ static int __init init_kprobes(void)
63811 {
63812 int i, err = 0;
63813 unsigned long offset = 0, size = 0;
63814 - char *modname, namebuf[128];
63815 + char *modname, namebuf[KSYM_NAME_LEN];
63816 const char *symbol_name;
63817 void *addr;
63818 struct kprobe_blackpoint *kb;
63819 @@ -2062,7 +2062,7 @@ static int __kprobes show_kprobe_addr(st
63820 const char *sym = NULL;
63821 unsigned int i = *(loff_t *) v;
63822 unsigned long offset = 0;
63823 - char *modname, namebuf[128];
63824 + char *modname, namebuf[KSYM_NAME_LEN];
63825
63826 head = &kprobe_table[i];
63827 preempt_disable();
63828 diff -urNp linux-3.0.9/kernel/lockdep.c linux-3.0.9/kernel/lockdep.c
63829 --- linux-3.0.9/kernel/lockdep.c 2011-11-11 13:12:24.000000000 -0500
63830 +++ linux-3.0.9/kernel/lockdep.c 2011-11-15 20:03:00.000000000 -0500
63831 @@ -583,6 +583,10 @@ static int static_obj(void *obj)
63832 end = (unsigned long) &_end,
63833 addr = (unsigned long) obj;
63834
63835 +#ifdef CONFIG_PAX_KERNEXEC
63836 + start = ktla_ktva(start);
63837 +#endif
63838 +
63839 /*
63840 * static variable?
63841 */
63842 @@ -718,6 +722,7 @@ register_lock_class(struct lockdep_map *
63843 if (!static_obj(lock->key)) {
63844 debug_locks_off();
63845 printk("INFO: trying to register non-static key.\n");
63846 + printk("lock:%pS key:%pS.\n", lock, lock->key);
63847 printk("the code is fine but needs lockdep annotation.\n");
63848 printk("turning off the locking correctness validator.\n");
63849 dump_stack();
63850 @@ -2936,7 +2941,7 @@ static int __lock_acquire(struct lockdep
63851 if (!class)
63852 return 0;
63853 }
63854 - atomic_inc((atomic_t *)&class->ops);
63855 + atomic_inc_unchecked((atomic_unchecked_t *)&class->ops);
63856 if (very_verbose(class)) {
63857 printk("\nacquire class [%p] %s", class->key, class->name);
63858 if (class->name_version > 1)
63859 diff -urNp linux-3.0.9/kernel/lockdep_proc.c linux-3.0.9/kernel/lockdep_proc.c
63860 --- linux-3.0.9/kernel/lockdep_proc.c 2011-11-11 13:12:24.000000000 -0500
63861 +++ linux-3.0.9/kernel/lockdep_proc.c 2011-11-15 20:03:00.000000000 -0500
63862 @@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v
63863
63864 static void print_name(struct seq_file *m, struct lock_class *class)
63865 {
63866 - char str[128];
63867 + char str[KSYM_NAME_LEN];
63868 const char *name = class->name;
63869
63870 if (!name) {
63871 diff -urNp linux-3.0.9/kernel/module.c linux-3.0.9/kernel/module.c
63872 --- linux-3.0.9/kernel/module.c 2011-11-11 13:12:24.000000000 -0500
63873 +++ linux-3.0.9/kernel/module.c 2011-11-15 20:03:00.000000000 -0500
63874 @@ -58,6 +58,7 @@
63875 #include <linux/jump_label.h>
63876 #include <linux/pfn.h>
63877 #include <linux/bsearch.h>
63878 +#include <linux/grsecurity.h>
63879
63880 #define CREATE_TRACE_POINTS
63881 #include <trace/events/module.h>
63882 @@ -119,7 +120,8 @@ static BLOCKING_NOTIFIER_HEAD(module_not
63883
63884 /* Bounds of module allocation, for speeding __module_address.
63885 * Protected by module_mutex. */
63886 -static unsigned long module_addr_min = -1UL, module_addr_max = 0;
63887 +static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
63888 +static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
63889
63890 int register_module_notifier(struct notifier_block * nb)
63891 {
63892 @@ -284,7 +286,7 @@ bool each_symbol_section(bool (*fn)(cons
63893 return true;
63894
63895 list_for_each_entry_rcu(mod, &modules, list) {
63896 - struct symsearch arr[] = {
63897 + struct symsearch modarr[] = {
63898 { mod->syms, mod->syms + mod->num_syms, mod->crcs,
63899 NOT_GPL_ONLY, false },
63900 { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
63901 @@ -306,7 +308,7 @@ bool each_symbol_section(bool (*fn)(cons
63902 #endif
63903 };
63904
63905 - if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
63906 + if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
63907 return true;
63908 }
63909 return false;
63910 @@ -438,7 +440,7 @@ static inline void __percpu *mod_percpu(
63911 static int percpu_modalloc(struct module *mod,
63912 unsigned long size, unsigned long align)
63913 {
63914 - if (align > PAGE_SIZE) {
63915 + if (align-1 >= PAGE_SIZE) {
63916 printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
63917 mod->name, align, PAGE_SIZE);
63918 align = PAGE_SIZE;
63919 @@ -1166,7 +1168,7 @@ resolve_symbol_wait(struct module *mod,
63920 */
63921 #ifdef CONFIG_SYSFS
63922
63923 -#ifdef CONFIG_KALLSYMS
63924 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
63925 static inline bool sect_empty(const Elf_Shdr *sect)
63926 {
63927 return !(sect->sh_flags & SHF_ALLOC) || sect->sh_size == 0;
63928 @@ -1632,21 +1634,21 @@ static void set_section_ro_nx(void *base
63929
63930 static void unset_module_core_ro_nx(struct module *mod)
63931 {
63932 - set_page_attributes(mod->module_core + mod->core_text_size,
63933 - mod->module_core + mod->core_size,
63934 + set_page_attributes(mod->module_core_rw,
63935 + mod->module_core_rw + mod->core_size_rw,
63936 set_memory_x);
63937 - set_page_attributes(mod->module_core,
63938 - mod->module_core + mod->core_ro_size,
63939 + set_page_attributes(mod->module_core_rx,
63940 + mod->module_core_rx + mod->core_size_rx,
63941 set_memory_rw);
63942 }
63943
63944 static void unset_module_init_ro_nx(struct module *mod)
63945 {
63946 - set_page_attributes(mod->module_init + mod->init_text_size,
63947 - mod->module_init + mod->init_size,
63948 + set_page_attributes(mod->module_init_rw,
63949 + mod->module_init_rw + mod->init_size_rw,
63950 set_memory_x);
63951 - set_page_attributes(mod->module_init,
63952 - mod->module_init + mod->init_ro_size,
63953 + set_page_attributes(mod->module_init_rx,
63954 + mod->module_init_rx + mod->init_size_rx,
63955 set_memory_rw);
63956 }
63957
63958 @@ -1657,14 +1659,14 @@ void set_all_modules_text_rw(void)
63959
63960 mutex_lock(&module_mutex);
63961 list_for_each_entry_rcu(mod, &modules, list) {
63962 - if ((mod->module_core) && (mod->core_text_size)) {
63963 - set_page_attributes(mod->module_core,
63964 - mod->module_core + mod->core_text_size,
63965 + if ((mod->module_core_rx) && (mod->core_size_rx)) {
63966 + set_page_attributes(mod->module_core_rx,
63967 + mod->module_core_rx + mod->core_size_rx,
63968 set_memory_rw);
63969 }
63970 - if ((mod->module_init) && (mod->init_text_size)) {
63971 - set_page_attributes(mod->module_init,
63972 - mod->module_init + mod->init_text_size,
63973 + if ((mod->module_init_rx) && (mod->init_size_rx)) {
63974 + set_page_attributes(mod->module_init_rx,
63975 + mod->module_init_rx + mod->init_size_rx,
63976 set_memory_rw);
63977 }
63978 }
63979 @@ -1678,14 +1680,14 @@ void set_all_modules_text_ro(void)
63980
63981 mutex_lock(&module_mutex);
63982 list_for_each_entry_rcu(mod, &modules, list) {
63983 - if ((mod->module_core) && (mod->core_text_size)) {
63984 - set_page_attributes(mod->module_core,
63985 - mod->module_core + mod->core_text_size,
63986 + if ((mod->module_core_rx) && (mod->core_size_rx)) {
63987 + set_page_attributes(mod->module_core_rx,
63988 + mod->module_core_rx + mod->core_size_rx,
63989 set_memory_ro);
63990 }
63991 - if ((mod->module_init) && (mod->init_text_size)) {
63992 - set_page_attributes(mod->module_init,
63993 - mod->module_init + mod->init_text_size,
63994 + if ((mod->module_init_rx) && (mod->init_size_rx)) {
63995 + set_page_attributes(mod->module_init_rx,
63996 + mod->module_init_rx + mod->init_size_rx,
63997 set_memory_ro);
63998 }
63999 }
64000 @@ -1722,16 +1724,19 @@ static void free_module(struct module *m
64001
64002 /* This may be NULL, but that's OK */
64003 unset_module_init_ro_nx(mod);
64004 - module_free(mod, mod->module_init);
64005 + module_free(mod, mod->module_init_rw);
64006 + module_free_exec(mod, mod->module_init_rx);
64007 kfree(mod->args);
64008 percpu_modfree(mod);
64009
64010 /* Free lock-classes: */
64011 - lockdep_free_key_range(mod->module_core, mod->core_size);
64012 + lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
64013 + lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
64014
64015 /* Finally, free the core (containing the module structure) */
64016 unset_module_core_ro_nx(mod);
64017 - module_free(mod, mod->module_core);
64018 + module_free_exec(mod, mod->module_core_rx);
64019 + module_free(mod, mod->module_core_rw);
64020
64021 #ifdef CONFIG_MPU
64022 update_protections(current->mm);
64023 @@ -1800,10 +1805,31 @@ static int simplify_symbols(struct modul
64024 unsigned int i;
64025 int ret = 0;
64026 const struct kernel_symbol *ksym;
64027 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
64028 + int is_fs_load = 0;
64029 + int register_filesystem_found = 0;
64030 + char *p;
64031 +
64032 + p = strstr(mod->args, "grsec_modharden_fs");
64033 + if (p) {
64034 + char *endptr = p + strlen("grsec_modharden_fs");
64035 + /* copy \0 as well */
64036 + memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
64037 + is_fs_load = 1;
64038 + }
64039 +#endif
64040
64041 for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
64042 const char *name = info->strtab + sym[i].st_name;
64043
64044 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
64045 + /* it's a real shame this will never get ripped and copied
64046 + upstream! ;(
64047 + */
64048 + if (is_fs_load && !strcmp(name, "register_filesystem"))
64049 + register_filesystem_found = 1;
64050 +#endif
64051 +
64052 switch (sym[i].st_shndx) {
64053 case SHN_COMMON:
64054 /* We compiled with -fno-common. These are not
64055 @@ -1824,7 +1850,9 @@ static int simplify_symbols(struct modul
64056 ksym = resolve_symbol_wait(mod, info, name);
64057 /* Ok if resolved. */
64058 if (ksym && !IS_ERR(ksym)) {
64059 + pax_open_kernel();
64060 sym[i].st_value = ksym->value;
64061 + pax_close_kernel();
64062 break;
64063 }
64064
64065 @@ -1843,11 +1871,20 @@ static int simplify_symbols(struct modul
64066 secbase = (unsigned long)mod_percpu(mod);
64067 else
64068 secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
64069 + pax_open_kernel();
64070 sym[i].st_value += secbase;
64071 + pax_close_kernel();
64072 break;
64073 }
64074 }
64075
64076 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
64077 + if (is_fs_load && !register_filesystem_found) {
64078 + printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
64079 + ret = -EPERM;
64080 + }
64081 +#endif
64082 +
64083 return ret;
64084 }
64085
64086 @@ -1931,22 +1968,12 @@ static void layout_sections(struct modul
64087 || s->sh_entsize != ~0UL
64088 || strstarts(sname, ".init"))
64089 continue;
64090 - s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
64091 + if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
64092 + s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
64093 + else
64094 + s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
64095 DEBUGP("\t%s\n", name);
64096 }
64097 - switch (m) {
64098 - case 0: /* executable */
64099 - mod->core_size = debug_align(mod->core_size);
64100 - mod->core_text_size = mod->core_size;
64101 - break;
64102 - case 1: /* RO: text and ro-data */
64103 - mod->core_size = debug_align(mod->core_size);
64104 - mod->core_ro_size = mod->core_size;
64105 - break;
64106 - case 3: /* whole core */
64107 - mod->core_size = debug_align(mod->core_size);
64108 - break;
64109 - }
64110 }
64111
64112 DEBUGP("Init section allocation order:\n");
64113 @@ -1960,23 +1987,13 @@ static void layout_sections(struct modul
64114 || s->sh_entsize != ~0UL
64115 || !strstarts(sname, ".init"))
64116 continue;
64117 - s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
64118 - | INIT_OFFSET_MASK);
64119 + if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
64120 + s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
64121 + else
64122 + s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
64123 + s->sh_entsize |= INIT_OFFSET_MASK;
64124 DEBUGP("\t%s\n", sname);
64125 }
64126 - switch (m) {
64127 - case 0: /* executable */
64128 - mod->init_size = debug_align(mod->init_size);
64129 - mod->init_text_size = mod->init_size;
64130 - break;
64131 - case 1: /* RO: text and ro-data */
64132 - mod->init_size = debug_align(mod->init_size);
64133 - mod->init_ro_size = mod->init_size;
64134 - break;
64135 - case 3: /* whole init */
64136 - mod->init_size = debug_align(mod->init_size);
64137 - break;
64138 - }
64139 }
64140 }
64141
64142 @@ -2141,7 +2158,7 @@ static void layout_symtab(struct module
64143
64144 /* Put symbol section at end of init part of module. */
64145 symsect->sh_flags |= SHF_ALLOC;
64146 - symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
64147 + symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
64148 info->index.sym) | INIT_OFFSET_MASK;
64149 DEBUGP("\t%s\n", info->secstrings + symsect->sh_name);
64150
64151 @@ -2158,19 +2175,19 @@ static void layout_symtab(struct module
64152 }
64153
64154 /* Append room for core symbols at end of core part. */
64155 - info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
64156 - mod->core_size = info->symoffs + ndst * sizeof(Elf_Sym);
64157 + info->symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
64158 + mod->core_size_rx = info->symoffs + ndst * sizeof(Elf_Sym);
64159
64160 /* Put string table section at end of init part of module. */
64161 strsect->sh_flags |= SHF_ALLOC;
64162 - strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
64163 + strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
64164 info->index.str) | INIT_OFFSET_MASK;
64165 DEBUGP("\t%s\n", info->secstrings + strsect->sh_name);
64166
64167 /* Append room for core symbols' strings at end of core part. */
64168 - info->stroffs = mod->core_size;
64169 + info->stroffs = mod->core_size_rx;
64170 __set_bit(0, info->strmap);
64171 - mod->core_size += bitmap_weight(info->strmap, strsect->sh_size);
64172 + mod->core_size_rx += bitmap_weight(info->strmap, strsect->sh_size);
64173 }
64174
64175 static void add_kallsyms(struct module *mod, const struct load_info *info)
64176 @@ -2186,11 +2203,13 @@ static void add_kallsyms(struct module *
64177 /* Make sure we get permanent strtab: don't use info->strtab. */
64178 mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
64179
64180 + pax_open_kernel();
64181 +
64182 /* Set types up while we still have access to sections. */
64183 for (i = 0; i < mod->num_symtab; i++)
64184 mod->symtab[i].st_info = elf_type(&mod->symtab[i], info);
64185
64186 - mod->core_symtab = dst = mod->module_core + info->symoffs;
64187 + mod->core_symtab = dst = mod->module_core_rx + info->symoffs;
64188 src = mod->symtab;
64189 *dst = *src;
64190 for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
64191 @@ -2203,10 +2222,12 @@ static void add_kallsyms(struct module *
64192 }
64193 mod->core_num_syms = ndst;
64194
64195 - mod->core_strtab = s = mod->module_core + info->stroffs;
64196 + mod->core_strtab = s = mod->module_core_rx + info->stroffs;
64197 for (*s = 0, i = 1; i < info->sechdrs[info->index.str].sh_size; ++i)
64198 if (test_bit(i, info->strmap))
64199 *++s = mod->strtab[i];
64200 +
64201 + pax_close_kernel();
64202 }
64203 #else
64204 static inline void layout_symtab(struct module *mod, struct load_info *info)
64205 @@ -2235,17 +2256,33 @@ static void dynamic_debug_remove(struct
64206 ddebug_remove_module(debug->modname);
64207 }
64208
64209 -static void *module_alloc_update_bounds(unsigned long size)
64210 +static void *module_alloc_update_bounds_rw(unsigned long size)
64211 {
64212 void *ret = module_alloc(size);
64213
64214 if (ret) {
64215 mutex_lock(&module_mutex);
64216 /* Update module bounds. */
64217 - if ((unsigned long)ret < module_addr_min)
64218 - module_addr_min = (unsigned long)ret;
64219 - if ((unsigned long)ret + size > module_addr_max)
64220 - module_addr_max = (unsigned long)ret + size;
64221 + if ((unsigned long)ret < module_addr_min_rw)
64222 + module_addr_min_rw = (unsigned long)ret;
64223 + if ((unsigned long)ret + size > module_addr_max_rw)
64224 + module_addr_max_rw = (unsigned long)ret + size;
64225 + mutex_unlock(&module_mutex);
64226 + }
64227 + return ret;
64228 +}
64229 +
64230 +static void *module_alloc_update_bounds_rx(unsigned long size)
64231 +{
64232 + void *ret = module_alloc_exec(size);
64233 +
64234 + if (ret) {
64235 + mutex_lock(&module_mutex);
64236 + /* Update module bounds. */
64237 + if ((unsigned long)ret < module_addr_min_rx)
64238 + module_addr_min_rx = (unsigned long)ret;
64239 + if ((unsigned long)ret + size > module_addr_max_rx)
64240 + module_addr_max_rx = (unsigned long)ret + size;
64241 mutex_unlock(&module_mutex);
64242 }
64243 return ret;
64244 @@ -2538,7 +2575,7 @@ static int move_module(struct module *mo
64245 void *ptr;
64246
64247 /* Do the allocs. */
64248 - ptr = module_alloc_update_bounds(mod->core_size);
64249 + ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
64250 /*
64251 * The pointer to this block is stored in the module structure
64252 * which is inside the block. Just mark it as not being a
64253 @@ -2548,23 +2585,50 @@ static int move_module(struct module *mo
64254 if (!ptr)
64255 return -ENOMEM;
64256
64257 - memset(ptr, 0, mod->core_size);
64258 - mod->module_core = ptr;
64259 + memset(ptr, 0, mod->core_size_rw);
64260 + mod->module_core_rw = ptr;
64261
64262 - ptr = module_alloc_update_bounds(mod->init_size);
64263 + ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
64264 /*
64265 * The pointer to this block is stored in the module structure
64266 * which is inside the block. This block doesn't need to be
64267 * scanned as it contains data and code that will be freed
64268 * after the module is initialized.
64269 */
64270 - kmemleak_ignore(ptr);
64271 - if (!ptr && mod->init_size) {
64272 - module_free(mod, mod->module_core);
64273 + kmemleak_not_leak(ptr);
64274 + if (!ptr && mod->init_size_rw) {
64275 + module_free(mod, mod->module_core_rw);
64276 return -ENOMEM;
64277 }
64278 - memset(ptr, 0, mod->init_size);
64279 - mod->module_init = ptr;
64280 + memset(ptr, 0, mod->init_size_rw);
64281 + mod->module_init_rw = ptr;
64282 +
64283 + ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
64284 + kmemleak_not_leak(ptr);
64285 + if (!ptr) {
64286 + module_free(mod, mod->module_init_rw);
64287 + module_free(mod, mod->module_core_rw);
64288 + return -ENOMEM;
64289 + }
64290 +
64291 + pax_open_kernel();
64292 + memset(ptr, 0, mod->core_size_rx);
64293 + pax_close_kernel();
64294 + mod->module_core_rx = ptr;
64295 +
64296 + ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
64297 + kmemleak_not_leak(ptr);
64298 + if (!ptr && mod->init_size_rx) {
64299 + module_free_exec(mod, mod->module_core_rx);
64300 + module_free(mod, mod->module_init_rw);
64301 + module_free(mod, mod->module_core_rw);
64302 + return -ENOMEM;
64303 + }
64304 +
64305 + pax_open_kernel();
64306 + memset(ptr, 0, mod->init_size_rx);
64307 + pax_close_kernel();
64308 + mod->module_init_rx = ptr;
64309
64310 /* Transfer each section which specifies SHF_ALLOC */
64311 DEBUGP("final section addresses:\n");
64312 @@ -2575,16 +2639,45 @@ static int move_module(struct module *mo
64313 if (!(shdr->sh_flags & SHF_ALLOC))
64314 continue;
64315
64316 - if (shdr->sh_entsize & INIT_OFFSET_MASK)
64317 - dest = mod->module_init
64318 - + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
64319 - else
64320 - dest = mod->module_core + shdr->sh_entsize;
64321 + if (shdr->sh_entsize & INIT_OFFSET_MASK) {
64322 + if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
64323 + dest = mod->module_init_rw
64324 + + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
64325 + else
64326 + dest = mod->module_init_rx
64327 + + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
64328 + } else {
64329 + if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
64330 + dest = mod->module_core_rw + shdr->sh_entsize;
64331 + else
64332 + dest = mod->module_core_rx + shdr->sh_entsize;
64333 + }
64334 +
64335 + if (shdr->sh_type != SHT_NOBITS) {
64336 +
64337 +#ifdef CONFIG_PAX_KERNEXEC
64338 +#ifdef CONFIG_X86_64
64339 + if ((shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_EXECINSTR))
64340 + set_memory_x((unsigned long)dest, (shdr->sh_size + PAGE_SIZE) >> PAGE_SHIFT);
64341 +#endif
64342 + if (!(shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_ALLOC)) {
64343 + pax_open_kernel();
64344 + memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
64345 + pax_close_kernel();
64346 + } else
64347 +#endif
64348
64349 - if (shdr->sh_type != SHT_NOBITS)
64350 memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
64351 + }
64352 /* Update sh_addr to point to copy in image. */
64353 - shdr->sh_addr = (unsigned long)dest;
64354 +
64355 +#ifdef CONFIG_PAX_KERNEXEC
64356 + if (shdr->sh_flags & SHF_EXECINSTR)
64357 + shdr->sh_addr = ktva_ktla((unsigned long)dest);
64358 + else
64359 +#endif
64360 +
64361 + shdr->sh_addr = (unsigned long)dest;
64362 DEBUGP("\t0x%lx %s\n",
64363 shdr->sh_addr, info->secstrings + shdr->sh_name);
64364 }
64365 @@ -2635,12 +2728,12 @@ static void flush_module_icache(const st
64366 * Do it before processing of module parameters, so the module
64367 * can provide parameter accessor functions of its own.
64368 */
64369 - if (mod->module_init)
64370 - flush_icache_range((unsigned long)mod->module_init,
64371 - (unsigned long)mod->module_init
64372 - + mod->init_size);
64373 - flush_icache_range((unsigned long)mod->module_core,
64374 - (unsigned long)mod->module_core + mod->core_size);
64375 + if (mod->module_init_rx)
64376 + flush_icache_range((unsigned long)mod->module_init_rx,
64377 + (unsigned long)mod->module_init_rx
64378 + + mod->init_size_rx);
64379 + flush_icache_range((unsigned long)mod->module_core_rx,
64380 + (unsigned long)mod->module_core_rx + mod->core_size_rx);
64381
64382 set_fs(old_fs);
64383 }
64384 @@ -2712,8 +2805,10 @@ static void module_deallocate(struct mod
64385 {
64386 kfree(info->strmap);
64387 percpu_modfree(mod);
64388 - module_free(mod, mod->module_init);
64389 - module_free(mod, mod->module_core);
64390 + module_free_exec(mod, mod->module_init_rx);
64391 + module_free_exec(mod, mod->module_core_rx);
64392 + module_free(mod, mod->module_init_rw);
64393 + module_free(mod, mod->module_core_rw);
64394 }
64395
64396 static int post_relocation(struct module *mod, const struct load_info *info)
64397 @@ -2770,9 +2865,38 @@ static struct module *load_module(void _
64398 if (err)
64399 goto free_unload;
64400
64401 + /* Now copy in args */
64402 + mod->args = strndup_user(uargs, ~0UL >> 1);
64403 + if (IS_ERR(mod->args)) {
64404 + err = PTR_ERR(mod->args);
64405 + goto free_unload;
64406 + }
64407 +
64408 /* Set up MODINFO_ATTR fields */
64409 setup_modinfo(mod, &info);
64410
64411 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
64412 + {
64413 + char *p, *p2;
64414 +
64415 + if (strstr(mod->args, "grsec_modharden_netdev")) {
64416 + printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
64417 + err = -EPERM;
64418 + goto free_modinfo;
64419 + } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
64420 + p += strlen("grsec_modharden_normal");
64421 + p2 = strstr(p, "_");
64422 + if (p2) {
64423 + *p2 = '\0';
64424 + printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
64425 + *p2 = '_';
64426 + }
64427 + err = -EPERM;
64428 + goto free_modinfo;
64429 + }
64430 + }
64431 +#endif
64432 +
64433 /* Fix up syms, so that st_value is a pointer to location. */
64434 err = simplify_symbols(mod, &info);
64435 if (err < 0)
64436 @@ -2788,13 +2912,6 @@ static struct module *load_module(void _
64437
64438 flush_module_icache(mod);
64439
64440 - /* Now copy in args */
64441 - mod->args = strndup_user(uargs, ~0UL >> 1);
64442 - if (IS_ERR(mod->args)) {
64443 - err = PTR_ERR(mod->args);
64444 - goto free_arch_cleanup;
64445 - }
64446 -
64447 /* Mark state as coming so strong_try_module_get() ignores us. */
64448 mod->state = MODULE_STATE_COMING;
64449
64450 @@ -2854,11 +2971,10 @@ static struct module *load_module(void _
64451 unlock:
64452 mutex_unlock(&module_mutex);
64453 synchronize_sched();
64454 - kfree(mod->args);
64455 - free_arch_cleanup:
64456 module_arch_cleanup(mod);
64457 free_modinfo:
64458 free_modinfo(mod);
64459 + kfree(mod->args);
64460 free_unload:
64461 module_unload_free(mod);
64462 free_module:
64463 @@ -2899,16 +3015,16 @@ SYSCALL_DEFINE3(init_module, void __user
64464 MODULE_STATE_COMING, mod);
64465
64466 /* Set RO and NX regions for core */
64467 - set_section_ro_nx(mod->module_core,
64468 - mod->core_text_size,
64469 - mod->core_ro_size,
64470 - mod->core_size);
64471 + set_section_ro_nx(mod->module_core_rx,
64472 + mod->core_size_rx,
64473 + mod->core_size_rx,
64474 + mod->core_size_rx);
64475
64476 /* Set RO and NX regions for init */
64477 - set_section_ro_nx(mod->module_init,
64478 - mod->init_text_size,
64479 - mod->init_ro_size,
64480 - mod->init_size);
64481 + set_section_ro_nx(mod->module_init_rx,
64482 + mod->init_size_rx,
64483 + mod->init_size_rx,
64484 + mod->init_size_rx);
64485
64486 do_mod_ctors(mod);
64487 /* Start the module */
64488 @@ -2954,11 +3070,12 @@ SYSCALL_DEFINE3(init_module, void __user
64489 mod->strtab = mod->core_strtab;
64490 #endif
64491 unset_module_init_ro_nx(mod);
64492 - module_free(mod, mod->module_init);
64493 - mod->module_init = NULL;
64494 - mod->init_size = 0;
64495 - mod->init_ro_size = 0;
64496 - mod->init_text_size = 0;
64497 + module_free(mod, mod->module_init_rw);
64498 + module_free_exec(mod, mod->module_init_rx);
64499 + mod->module_init_rw = NULL;
64500 + mod->module_init_rx = NULL;
64501 + mod->init_size_rw = 0;
64502 + mod->init_size_rx = 0;
64503 mutex_unlock(&module_mutex);
64504
64505 return 0;
64506 @@ -2989,10 +3106,16 @@ static const char *get_ksymbol(struct mo
64507 unsigned long nextval;
64508
64509 /* At worse, next value is at end of module */
64510 - if (within_module_init(addr, mod))
64511 - nextval = (unsigned long)mod->module_init+mod->init_text_size;
64512 + if (within_module_init_rx(addr, mod))
64513 + nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
64514 + else if (within_module_init_rw(addr, mod))
64515 + nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
64516 + else if (within_module_core_rx(addr, mod))
64517 + nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
64518 + else if (within_module_core_rw(addr, mod))
64519 + nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
64520 else
64521 - nextval = (unsigned long)mod->module_core+mod->core_text_size;
64522 + return NULL;
64523
64524 /* Scan for closest preceding symbol, and next symbol. (ELF
64525 starts real symbols at 1). */
64526 @@ -3238,7 +3361,7 @@ static int m_show(struct seq_file *m, vo
64527 char buf[8];
64528
64529 seq_printf(m, "%s %u",
64530 - mod->name, mod->init_size + mod->core_size);
64531 + mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
64532 print_unload_info(m, mod);
64533
64534 /* Informative for users. */
64535 @@ -3247,7 +3370,7 @@ static int m_show(struct seq_file *m, vo
64536 mod->state == MODULE_STATE_COMING ? "Loading":
64537 "Live");
64538 /* Used by oprofile and other similar tools. */
64539 - seq_printf(m, " 0x%pK", mod->module_core);
64540 + seq_printf(m, " 0x%pK 0x%pK", mod->module_core_rx, mod->module_core_rw);
64541
64542 /* Taints info */
64543 if (mod->taints)
64544 @@ -3283,7 +3406,17 @@ static const struct file_operations proc
64545
64546 static int __init proc_modules_init(void)
64547 {
64548 +#ifndef CONFIG_GRKERNSEC_HIDESYM
64549 +#ifdef CONFIG_GRKERNSEC_PROC_USER
64550 + proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
64551 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
64552 + proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
64553 +#else
64554 proc_create("modules", 0, NULL, &proc_modules_operations);
64555 +#endif
64556 +#else
64557 + proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
64558 +#endif
64559 return 0;
64560 }
64561 module_init(proc_modules_init);
64562 @@ -3342,12 +3475,12 @@ struct module *__module_address(unsigned
64563 {
64564 struct module *mod;
64565
64566 - if (addr < module_addr_min || addr > module_addr_max)
64567 + if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
64568 + (addr < module_addr_min_rw || addr > module_addr_max_rw))
64569 return NULL;
64570
64571 list_for_each_entry_rcu(mod, &modules, list)
64572 - if (within_module_core(addr, mod)
64573 - || within_module_init(addr, mod))
64574 + if (within_module_init(addr, mod) || within_module_core(addr, mod))
64575 return mod;
64576 return NULL;
64577 }
64578 @@ -3381,11 +3514,20 @@ bool is_module_text_address(unsigned lon
64579 */
64580 struct module *__module_text_address(unsigned long addr)
64581 {
64582 - struct module *mod = __module_address(addr);
64583 + struct module *mod;
64584 +
64585 +#ifdef CONFIG_X86_32
64586 + addr = ktla_ktva(addr);
64587 +#endif
64588 +
64589 + if (addr < module_addr_min_rx || addr > module_addr_max_rx)
64590 + return NULL;
64591 +
64592 + mod = __module_address(addr);
64593 +
64594 if (mod) {
64595 /* Make sure it's within the text section. */
64596 - if (!within(addr, mod->module_init, mod->init_text_size)
64597 - && !within(addr, mod->module_core, mod->core_text_size))
64598 + if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
64599 mod = NULL;
64600 }
64601 return mod;
64602 diff -urNp linux-3.0.9/kernel/mutex.c linux-3.0.9/kernel/mutex.c
64603 --- linux-3.0.9/kernel/mutex.c 2011-11-11 13:12:24.000000000 -0500
64604 +++ linux-3.0.9/kernel/mutex.c 2011-11-15 20:03:00.000000000 -0500
64605 @@ -198,7 +198,7 @@ __mutex_lock_common(struct mutex *lock,
64606 spin_lock_mutex(&lock->wait_lock, flags);
64607
64608 debug_mutex_lock_common(lock, &waiter);
64609 - debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
64610 + debug_mutex_add_waiter(lock, &waiter, task);
64611
64612 /* add waiting tasks to the end of the waitqueue (FIFO): */
64613 list_add_tail(&waiter.list, &lock->wait_list);
64614 @@ -227,8 +227,7 @@ __mutex_lock_common(struct mutex *lock,
64615 * TASK_UNINTERRUPTIBLE case.)
64616 */
64617 if (unlikely(signal_pending_state(state, task))) {
64618 - mutex_remove_waiter(lock, &waiter,
64619 - task_thread_info(task));
64620 + mutex_remove_waiter(lock, &waiter, task);
64621 mutex_release(&lock->dep_map, 1, ip);
64622 spin_unlock_mutex(&lock->wait_lock, flags);
64623
64624 @@ -249,7 +248,7 @@ __mutex_lock_common(struct mutex *lock,
64625 done:
64626 lock_acquired(&lock->dep_map, ip);
64627 /* got the lock - rejoice! */
64628 - mutex_remove_waiter(lock, &waiter, current_thread_info());
64629 + mutex_remove_waiter(lock, &waiter, task);
64630 mutex_set_owner(lock);
64631
64632 /* set it to 0 if there are no waiters left: */
64633 diff -urNp linux-3.0.9/kernel/mutex-debug.c linux-3.0.9/kernel/mutex-debug.c
64634 --- linux-3.0.9/kernel/mutex-debug.c 2011-11-11 13:12:24.000000000 -0500
64635 +++ linux-3.0.9/kernel/mutex-debug.c 2011-11-15 20:03:00.000000000 -0500
64636 @@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mute
64637 }
64638
64639 void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
64640 - struct thread_info *ti)
64641 + struct task_struct *task)
64642 {
64643 SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
64644
64645 /* Mark the current thread as blocked on the lock: */
64646 - ti->task->blocked_on = waiter;
64647 + task->blocked_on = waiter;
64648 }
64649
64650 void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
64651 - struct thread_info *ti)
64652 + struct task_struct *task)
64653 {
64654 DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
64655 - DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
64656 - DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
64657 - ti->task->blocked_on = NULL;
64658 + DEBUG_LOCKS_WARN_ON(waiter->task != task);
64659 + DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
64660 + task->blocked_on = NULL;
64661
64662 list_del_init(&waiter->list);
64663 waiter->task = NULL;
64664 diff -urNp linux-3.0.9/kernel/mutex-debug.h linux-3.0.9/kernel/mutex-debug.h
64665 --- linux-3.0.9/kernel/mutex-debug.h 2011-11-11 13:12:24.000000000 -0500
64666 +++ linux-3.0.9/kernel/mutex-debug.h 2011-11-15 20:03:00.000000000 -0500
64667 @@ -20,9 +20,9 @@ extern void debug_mutex_wake_waiter(stru
64668 extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
64669 extern void debug_mutex_add_waiter(struct mutex *lock,
64670 struct mutex_waiter *waiter,
64671 - struct thread_info *ti);
64672 + struct task_struct *task);
64673 extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
64674 - struct thread_info *ti);
64675 + struct task_struct *task);
64676 extern void debug_mutex_unlock(struct mutex *lock);
64677 extern void debug_mutex_init(struct mutex *lock, const char *name,
64678 struct lock_class_key *key);
64679 diff -urNp linux-3.0.9/kernel/padata.c linux-3.0.9/kernel/padata.c
64680 --- linux-3.0.9/kernel/padata.c 2011-11-11 13:12:24.000000000 -0500
64681 +++ linux-3.0.9/kernel/padata.c 2011-11-15 20:03:00.000000000 -0500
64682 @@ -132,10 +132,10 @@ int padata_do_parallel(struct padata_ins
64683 padata->pd = pd;
64684 padata->cb_cpu = cb_cpu;
64685
64686 - if (unlikely(atomic_read(&pd->seq_nr) == pd->max_seq_nr))
64687 - atomic_set(&pd->seq_nr, -1);
64688 + if (unlikely(atomic_read_unchecked(&pd->seq_nr) == pd->max_seq_nr))
64689 + atomic_set_unchecked(&pd->seq_nr, -1);
64690
64691 - padata->seq_nr = atomic_inc_return(&pd->seq_nr);
64692 + padata->seq_nr = atomic_inc_return_unchecked(&pd->seq_nr);
64693
64694 target_cpu = padata_cpu_hash(padata);
64695 queue = per_cpu_ptr(pd->pqueue, target_cpu);
64696 @@ -444,7 +444,7 @@ static struct parallel_data *padata_allo
64697 padata_init_pqueues(pd);
64698 padata_init_squeues(pd);
64699 setup_timer(&pd->timer, padata_reorder_timer, (unsigned long)pd);
64700 - atomic_set(&pd->seq_nr, -1);
64701 + atomic_set_unchecked(&pd->seq_nr, -1);
64702 atomic_set(&pd->reorder_objects, 0);
64703 atomic_set(&pd->refcnt, 0);
64704 pd->pinst = pinst;
64705 diff -urNp linux-3.0.9/kernel/panic.c linux-3.0.9/kernel/panic.c
64706 --- linux-3.0.9/kernel/panic.c 2011-11-11 13:12:24.000000000 -0500
64707 +++ linux-3.0.9/kernel/panic.c 2011-11-15 20:03:00.000000000 -0500
64708 @@ -369,7 +369,7 @@ static void warn_slowpath_common(const c
64709 const char *board;
64710
64711 printk(KERN_WARNING "------------[ cut here ]------------\n");
64712 - printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
64713 + printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
64714 board = dmi_get_system_info(DMI_PRODUCT_NAME);
64715 if (board)
64716 printk(KERN_WARNING "Hardware name: %s\n", board);
64717 @@ -424,7 +424,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
64718 */
64719 void __stack_chk_fail(void)
64720 {
64721 - panic("stack-protector: Kernel stack is corrupted in: %p\n",
64722 + dump_stack();
64723 + panic("stack-protector: Kernel stack is corrupted in: %pA\n",
64724 __builtin_return_address(0));
64725 }
64726 EXPORT_SYMBOL(__stack_chk_fail);
64727 diff -urNp linux-3.0.9/kernel/pid.c linux-3.0.9/kernel/pid.c
64728 --- linux-3.0.9/kernel/pid.c 2011-11-11 13:12:24.000000000 -0500
64729 +++ linux-3.0.9/kernel/pid.c 2011-11-15 20:03:00.000000000 -0500
64730 @@ -33,6 +33,7 @@
64731 #include <linux/rculist.h>
64732 #include <linux/bootmem.h>
64733 #include <linux/hash.h>
64734 +#include <linux/security.h>
64735 #include <linux/pid_namespace.h>
64736 #include <linux/init_task.h>
64737 #include <linux/syscalls.h>
64738 @@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT
64739
64740 int pid_max = PID_MAX_DEFAULT;
64741
64742 -#define RESERVED_PIDS 300
64743 +#define RESERVED_PIDS 500
64744
64745 int pid_max_min = RESERVED_PIDS + 1;
64746 int pid_max_max = PID_MAX_LIMIT;
64747 @@ -419,8 +420,15 @@ EXPORT_SYMBOL(pid_task);
64748 */
64749 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
64750 {
64751 + struct task_struct *task;
64752 +
64753 rcu_lockdep_assert(rcu_read_lock_held());
64754 - return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
64755 + task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
64756 +
64757 + if (gr_pid_is_chrooted(task))
64758 + return NULL;
64759 +
64760 + return task;
64761 }
64762
64763 struct task_struct *find_task_by_vpid(pid_t vnr)
64764 @@ -428,6 +436,12 @@ struct task_struct *find_task_by_vpid(pi
64765 return find_task_by_pid_ns(vnr, current->nsproxy->pid_ns);
64766 }
64767
64768 +struct task_struct *find_task_by_vpid_unrestricted(pid_t vnr)
64769 +{
64770 + rcu_lockdep_assert(rcu_read_lock_held());
64771 + return pid_task(find_pid_ns(vnr, current->nsproxy->pid_ns), PIDTYPE_PID);
64772 +}
64773 +
64774 struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
64775 {
64776 struct pid *pid;
64777 diff -urNp linux-3.0.9/kernel/posix-cpu-timers.c linux-3.0.9/kernel/posix-cpu-timers.c
64778 --- linux-3.0.9/kernel/posix-cpu-timers.c 2011-11-11 13:12:24.000000000 -0500
64779 +++ linux-3.0.9/kernel/posix-cpu-timers.c 2011-11-15 20:03:00.000000000 -0500
64780 @@ -6,6 +6,7 @@
64781 #include <linux/posix-timers.h>
64782 #include <linux/errno.h>
64783 #include <linux/math64.h>
64784 +#include <linux/security.h>
64785 #include <asm/uaccess.h>
64786 #include <linux/kernel_stat.h>
64787 #include <trace/events/timer.h>
64788 @@ -1606,14 +1607,14 @@ struct k_clock clock_posix_cpu = {
64789
64790 static __init int init_posix_cpu_timers(void)
64791 {
64792 - struct k_clock process = {
64793 + static struct k_clock process = {
64794 .clock_getres = process_cpu_clock_getres,
64795 .clock_get = process_cpu_clock_get,
64796 .timer_create = process_cpu_timer_create,
64797 .nsleep = process_cpu_nsleep,
64798 .nsleep_restart = process_cpu_nsleep_restart,
64799 };
64800 - struct k_clock thread = {
64801 + static struct k_clock thread = {
64802 .clock_getres = thread_cpu_clock_getres,
64803 .clock_get = thread_cpu_clock_get,
64804 .timer_create = thread_cpu_timer_create,
64805 diff -urNp linux-3.0.9/kernel/posix-timers.c linux-3.0.9/kernel/posix-timers.c
64806 --- linux-3.0.9/kernel/posix-timers.c 2011-11-11 13:12:24.000000000 -0500
64807 +++ linux-3.0.9/kernel/posix-timers.c 2011-11-15 20:03:00.000000000 -0500
64808 @@ -43,6 +43,7 @@
64809 #include <linux/idr.h>
64810 #include <linux/posix-clock.h>
64811 #include <linux/posix-timers.h>
64812 +#include <linux/grsecurity.h>
64813 #include <linux/syscalls.h>
64814 #include <linux/wait.h>
64815 #include <linux/workqueue.h>
64816 @@ -129,7 +130,7 @@ static DEFINE_SPINLOCK(idr_lock);
64817 * which we beg off on and pass to do_sys_settimeofday().
64818 */
64819
64820 -static struct k_clock posix_clocks[MAX_CLOCKS];
64821 +static struct k_clock *posix_clocks[MAX_CLOCKS];
64822
64823 /*
64824 * These ones are defined below.
64825 @@ -227,7 +228,7 @@ static int posix_get_boottime(const cloc
64826 */
64827 static __init int init_posix_timers(void)
64828 {
64829 - struct k_clock clock_realtime = {
64830 + static struct k_clock clock_realtime = {
64831 .clock_getres = hrtimer_get_res,
64832 .clock_get = posix_clock_realtime_get,
64833 .clock_set = posix_clock_realtime_set,
64834 @@ -239,7 +240,7 @@ static __init int init_posix_timers(void
64835 .timer_get = common_timer_get,
64836 .timer_del = common_timer_del,
64837 };
64838 - struct k_clock clock_monotonic = {
64839 + static struct k_clock clock_monotonic = {
64840 .clock_getres = hrtimer_get_res,
64841 .clock_get = posix_ktime_get_ts,
64842 .nsleep = common_nsleep,
64843 @@ -249,19 +250,19 @@ static __init int init_posix_timers(void
64844 .timer_get = common_timer_get,
64845 .timer_del = common_timer_del,
64846 };
64847 - struct k_clock clock_monotonic_raw = {
64848 + static struct k_clock clock_monotonic_raw = {
64849 .clock_getres = hrtimer_get_res,
64850 .clock_get = posix_get_monotonic_raw,
64851 };
64852 - struct k_clock clock_realtime_coarse = {
64853 + static struct k_clock clock_realtime_coarse = {
64854 .clock_getres = posix_get_coarse_res,
64855 .clock_get = posix_get_realtime_coarse,
64856 };
64857 - struct k_clock clock_monotonic_coarse = {
64858 + static struct k_clock clock_monotonic_coarse = {
64859 .clock_getres = posix_get_coarse_res,
64860 .clock_get = posix_get_monotonic_coarse,
64861 };
64862 - struct k_clock clock_boottime = {
64863 + static struct k_clock clock_boottime = {
64864 .clock_getres = hrtimer_get_res,
64865 .clock_get = posix_get_boottime,
64866 .nsleep = common_nsleep,
64867 @@ -272,6 +273,8 @@ static __init int init_posix_timers(void
64868 .timer_del = common_timer_del,
64869 };
64870
64871 + pax_track_stack();
64872 +
64873 posix_timers_register_clock(CLOCK_REALTIME, &clock_realtime);
64874 posix_timers_register_clock(CLOCK_MONOTONIC, &clock_monotonic);
64875 posix_timers_register_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
64876 @@ -473,7 +476,7 @@ void posix_timers_register_clock(const c
64877 return;
64878 }
64879
64880 - posix_clocks[clock_id] = *new_clock;
64881 + posix_clocks[clock_id] = new_clock;
64882 }
64883 EXPORT_SYMBOL_GPL(posix_timers_register_clock);
64884
64885 @@ -519,9 +522,9 @@ static struct k_clock *clockid_to_kclock
64886 return (id & CLOCKFD_MASK) == CLOCKFD ?
64887 &clock_posix_dynamic : &clock_posix_cpu;
64888
64889 - if (id >= MAX_CLOCKS || !posix_clocks[id].clock_getres)
64890 + if (id >= MAX_CLOCKS || !posix_clocks[id] || !posix_clocks[id]->clock_getres)
64891 return NULL;
64892 - return &posix_clocks[id];
64893 + return posix_clocks[id];
64894 }
64895
64896 static int common_timer_create(struct k_itimer *new_timer)
64897 @@ -959,6 +962,13 @@ SYSCALL_DEFINE2(clock_settime, const clo
64898 if (copy_from_user(&new_tp, tp, sizeof (*tp)))
64899 return -EFAULT;
64900
64901 + /* only the CLOCK_REALTIME clock can be set, all other clocks
64902 + have their clock_set fptr set to a nosettime dummy function
64903 + CLOCK_REALTIME has a NULL clock_set fptr which causes it to
64904 + call common_clock_set, which calls do_sys_settimeofday, which
64905 + we hook
64906 + */
64907 +
64908 return kc->clock_set(which_clock, &new_tp);
64909 }
64910
64911 diff -urNp linux-3.0.9/kernel/power/poweroff.c linux-3.0.9/kernel/power/poweroff.c
64912 --- linux-3.0.9/kernel/power/poweroff.c 2011-11-11 13:12:24.000000000 -0500
64913 +++ linux-3.0.9/kernel/power/poweroff.c 2011-11-15 20:03:00.000000000 -0500
64914 @@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_powerof
64915 .enable_mask = SYSRQ_ENABLE_BOOT,
64916 };
64917
64918 -static int pm_sysrq_init(void)
64919 +static int __init pm_sysrq_init(void)
64920 {
64921 register_sysrq_key('o', &sysrq_poweroff_op);
64922 return 0;
64923 diff -urNp linux-3.0.9/kernel/power/process.c linux-3.0.9/kernel/power/process.c
64924 --- linux-3.0.9/kernel/power/process.c 2011-11-11 13:12:24.000000000 -0500
64925 +++ linux-3.0.9/kernel/power/process.c 2011-11-15 20:03:00.000000000 -0500
64926 @@ -41,6 +41,7 @@ static int try_to_freeze_tasks(bool sig_
64927 u64 elapsed_csecs64;
64928 unsigned int elapsed_csecs;
64929 bool wakeup = false;
64930 + bool timedout = false;
64931
64932 do_gettimeofday(&start);
64933
64934 @@ -51,6 +52,8 @@ static int try_to_freeze_tasks(bool sig_
64935
64936 while (true) {
64937 todo = 0;
64938 + if (time_after(jiffies, end_time))
64939 + timedout = true;
64940 read_lock(&tasklist_lock);
64941 do_each_thread(g, p) {
64942 if (frozen(p) || !freezable(p))
64943 @@ -71,9 +74,13 @@ static int try_to_freeze_tasks(bool sig_
64944 * try_to_stop() after schedule() in ptrace/signal
64945 * stop sees TIF_FREEZE.
64946 */
64947 - if (!task_is_stopped_or_traced(p) &&
64948 - !freezer_should_skip(p))
64949 + if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
64950 todo++;
64951 + if (timedout) {
64952 + printk(KERN_ERR "Task refusing to freeze:\n");
64953 + sched_show_task(p);
64954 + }
64955 + }
64956 } while_each_thread(g, p);
64957 read_unlock(&tasklist_lock);
64958
64959 @@ -82,7 +89,7 @@ static int try_to_freeze_tasks(bool sig_
64960 todo += wq_busy;
64961 }
64962
64963 - if (!todo || time_after(jiffies, end_time))
64964 + if (!todo || timedout)
64965 break;
64966
64967 if (pm_wakeup_pending()) {
64968 diff -urNp linux-3.0.9/kernel/printk.c linux-3.0.9/kernel/printk.c
64969 --- linux-3.0.9/kernel/printk.c 2011-11-11 13:12:24.000000000 -0500
64970 +++ linux-3.0.9/kernel/printk.c 2011-11-15 20:03:00.000000000 -0500
64971 @@ -313,12 +313,17 @@ static int check_syslog_permissions(int
64972 if (from_file && type != SYSLOG_ACTION_OPEN)
64973 return 0;
64974
64975 +#ifdef CONFIG_GRKERNSEC_DMESG
64976 + if (grsec_enable_dmesg && !capable(CAP_SYSLOG) && !capable_nolog(CAP_SYS_ADMIN))
64977 + return -EPERM;
64978 +#endif
64979 +
64980 if (syslog_action_restricted(type)) {
64981 if (capable(CAP_SYSLOG))
64982 return 0;
64983 /* For historical reasons, accept CAP_SYS_ADMIN too, with a warning */
64984 if (capable(CAP_SYS_ADMIN)) {
64985 - WARN_ONCE(1, "Attempt to access syslog with CAP_SYS_ADMIN "
64986 + printk_once(KERN_WARNING "Attempt to access syslog with CAP_SYS_ADMIN "
64987 "but no CAP_SYSLOG (deprecated).\n");
64988 return 0;
64989 }
64990 diff -urNp linux-3.0.9/kernel/profile.c linux-3.0.9/kernel/profile.c
64991 --- linux-3.0.9/kernel/profile.c 2011-11-11 13:12:24.000000000 -0500
64992 +++ linux-3.0.9/kernel/profile.c 2011-11-15 20:03:00.000000000 -0500
64993 @@ -39,7 +39,7 @@ struct profile_hit {
64994 /* Oprofile timer tick hook */
64995 static int (*timer_hook)(struct pt_regs *) __read_mostly;
64996
64997 -static atomic_t *prof_buffer;
64998 +static atomic_unchecked_t *prof_buffer;
64999 static unsigned long prof_len, prof_shift;
65000
65001 int prof_on __read_mostly;
65002 @@ -281,7 +281,7 @@ static void profile_flip_buffers(void)
65003 hits[i].pc = 0;
65004 continue;
65005 }
65006 - atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
65007 + atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
65008 hits[i].hits = hits[i].pc = 0;
65009 }
65010 }
65011 @@ -342,9 +342,9 @@ static void do_profile_hits(int type, vo
65012 * Add the current hit(s) and flush the write-queue out
65013 * to the global buffer:
65014 */
65015 - atomic_add(nr_hits, &prof_buffer[pc]);
65016 + atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
65017 for (i = 0; i < NR_PROFILE_HIT; ++i) {
65018 - atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
65019 + atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
65020 hits[i].pc = hits[i].hits = 0;
65021 }
65022 out:
65023 @@ -419,7 +419,7 @@ static void do_profile_hits(int type, vo
65024 {
65025 unsigned long pc;
65026 pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
65027 - atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
65028 + atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
65029 }
65030 #endif /* !CONFIG_SMP */
65031
65032 @@ -517,7 +517,7 @@ read_profile(struct file *file, char __u
65033 return -EFAULT;
65034 buf++; p++; count--; read++;
65035 }
65036 - pnt = (char *)prof_buffer + p - sizeof(atomic_t);
65037 + pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
65038 if (copy_to_user(buf, (void *)pnt, count))
65039 return -EFAULT;
65040 read += count;
65041 @@ -548,7 +548,7 @@ static ssize_t write_profile(struct file
65042 }
65043 #endif
65044 profile_discard_flip_buffers();
65045 - memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
65046 + memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
65047 return count;
65048 }
65049
65050 diff -urNp linux-3.0.9/kernel/ptrace.c linux-3.0.9/kernel/ptrace.c
65051 --- linux-3.0.9/kernel/ptrace.c 2011-11-11 13:12:24.000000000 -0500
65052 +++ linux-3.0.9/kernel/ptrace.c 2011-11-15 20:03:00.000000000 -0500
65053 @@ -132,7 +132,8 @@ int ptrace_check_attach(struct task_stru
65054 return ret;
65055 }
65056
65057 -int __ptrace_may_access(struct task_struct *task, unsigned int mode)
65058 +static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
65059 + unsigned int log)
65060 {
65061 const struct cred *cred = current_cred(), *tcred;
65062
65063 @@ -158,7 +159,8 @@ int __ptrace_may_access(struct task_stru
65064 cred->gid == tcred->sgid &&
65065 cred->gid == tcred->gid))
65066 goto ok;
65067 - if (ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE))
65068 + if ((!log && ns_capable_nolog(tcred->user->user_ns, CAP_SYS_PTRACE)) ||
65069 + (log && ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE)))
65070 goto ok;
65071 rcu_read_unlock();
65072 return -EPERM;
65073 @@ -167,7 +169,9 @@ ok:
65074 smp_rmb();
65075 if (task->mm)
65076 dumpable = get_dumpable(task->mm);
65077 - if (!dumpable && !task_ns_capable(task, CAP_SYS_PTRACE))
65078 + if (!dumpable &&
65079 + ((!log && !task_ns_capable_nolog(task, CAP_SYS_PTRACE)) ||
65080 + (log && !task_ns_capable(task, CAP_SYS_PTRACE))))
65081 return -EPERM;
65082
65083 return security_ptrace_access_check(task, mode);
65084 @@ -177,7 +181,16 @@ bool ptrace_may_access(struct task_struc
65085 {
65086 int err;
65087 task_lock(task);
65088 - err = __ptrace_may_access(task, mode);
65089 + err = __ptrace_may_access(task, mode, 0);
65090 + task_unlock(task);
65091 + return !err;
65092 +}
65093 +
65094 +bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
65095 +{
65096 + int err;
65097 + task_lock(task);
65098 + err = __ptrace_may_access(task, mode, 1);
65099 task_unlock(task);
65100 return !err;
65101 }
65102 @@ -205,7 +218,7 @@ static int ptrace_attach(struct task_str
65103 goto out;
65104
65105 task_lock(task);
65106 - retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
65107 + retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
65108 task_unlock(task);
65109 if (retval)
65110 goto unlock_creds;
65111 @@ -218,7 +231,7 @@ static int ptrace_attach(struct task_str
65112 goto unlock_tasklist;
65113
65114 task->ptrace = PT_PTRACED;
65115 - if (task_ns_capable(task, CAP_SYS_PTRACE))
65116 + if (task_ns_capable_nolog(task, CAP_SYS_PTRACE))
65117 task->ptrace |= PT_PTRACE_CAP;
65118
65119 __ptrace_link(task, current);
65120 @@ -406,6 +419,8 @@ int ptrace_readdata(struct task_struct *
65121 {
65122 int copied = 0;
65123
65124 + pax_track_stack();
65125 +
65126 while (len > 0) {
65127 char buf[128];
65128 int this_len, retval;
65129 @@ -417,7 +432,7 @@ int ptrace_readdata(struct task_struct *
65130 break;
65131 return -EIO;
65132 }
65133 - if (copy_to_user(dst, buf, retval))
65134 + if (retval > sizeof(buf) || copy_to_user(dst, buf, retval))
65135 return -EFAULT;
65136 copied += retval;
65137 src += retval;
65138 @@ -431,6 +446,8 @@ int ptrace_writedata(struct task_struct
65139 {
65140 int copied = 0;
65141
65142 + pax_track_stack();
65143 +
65144 while (len > 0) {
65145 char buf[128];
65146 int this_len, retval;
65147 @@ -613,9 +630,11 @@ int ptrace_request(struct task_struct *c
65148 {
65149 int ret = -EIO;
65150 siginfo_t siginfo;
65151 - void __user *datavp = (void __user *) data;
65152 + void __user *datavp = (__force void __user *) data;
65153 unsigned long __user *datalp = datavp;
65154
65155 + pax_track_stack();
65156 +
65157 switch (request) {
65158 case PTRACE_PEEKTEXT:
65159 case PTRACE_PEEKDATA:
65160 @@ -761,14 +780,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
65161 goto out;
65162 }
65163
65164 + if (gr_handle_ptrace(child, request)) {
65165 + ret = -EPERM;
65166 + goto out_put_task_struct;
65167 + }
65168 +
65169 if (request == PTRACE_ATTACH) {
65170 ret = ptrace_attach(child);
65171 /*
65172 * Some architectures need to do book-keeping after
65173 * a ptrace attach.
65174 */
65175 - if (!ret)
65176 + if (!ret) {
65177 arch_ptrace_attach(child);
65178 + gr_audit_ptrace(child);
65179 + }
65180 goto out_put_task_struct;
65181 }
65182
65183 @@ -793,7 +819,7 @@ int generic_ptrace_peekdata(struct task_
65184 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
65185 if (copied != sizeof(tmp))
65186 return -EIO;
65187 - return put_user(tmp, (unsigned long __user *)data);
65188 + return put_user(tmp, (__force unsigned long __user *)data);
65189 }
65190
65191 int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
65192 @@ -816,6 +842,8 @@ int compat_ptrace_request(struct task_st
65193 siginfo_t siginfo;
65194 int ret;
65195
65196 + pax_track_stack();
65197 +
65198 switch (request) {
65199 case PTRACE_PEEKTEXT:
65200 case PTRACE_PEEKDATA:
65201 @@ -903,14 +931,21 @@ asmlinkage long compat_sys_ptrace(compat
65202 goto out;
65203 }
65204
65205 + if (gr_handle_ptrace(child, request)) {
65206 + ret = -EPERM;
65207 + goto out_put_task_struct;
65208 + }
65209 +
65210 if (request == PTRACE_ATTACH) {
65211 ret = ptrace_attach(child);
65212 /*
65213 * Some architectures need to do book-keeping after
65214 * a ptrace attach.
65215 */
65216 - if (!ret)
65217 + if (!ret) {
65218 arch_ptrace_attach(child);
65219 + gr_audit_ptrace(child);
65220 + }
65221 goto out_put_task_struct;
65222 }
65223
65224 diff -urNp linux-3.0.9/kernel/rcutorture.c linux-3.0.9/kernel/rcutorture.c
65225 --- linux-3.0.9/kernel/rcutorture.c 2011-11-11 13:12:24.000000000 -0500
65226 +++ linux-3.0.9/kernel/rcutorture.c 2011-11-15 20:03:00.000000000 -0500
65227 @@ -138,12 +138,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_
65228 { 0 };
65229 static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
65230 { 0 };
65231 -static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
65232 -static atomic_t n_rcu_torture_alloc;
65233 -static atomic_t n_rcu_torture_alloc_fail;
65234 -static atomic_t n_rcu_torture_free;
65235 -static atomic_t n_rcu_torture_mberror;
65236 -static atomic_t n_rcu_torture_error;
65237 +static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
65238 +static atomic_unchecked_t n_rcu_torture_alloc;
65239 +static atomic_unchecked_t n_rcu_torture_alloc_fail;
65240 +static atomic_unchecked_t n_rcu_torture_free;
65241 +static atomic_unchecked_t n_rcu_torture_mberror;
65242 +static atomic_unchecked_t n_rcu_torture_error;
65243 static long n_rcu_torture_boost_ktrerror;
65244 static long n_rcu_torture_boost_rterror;
65245 static long n_rcu_torture_boost_failure;
65246 @@ -223,11 +223,11 @@ rcu_torture_alloc(void)
65247
65248 spin_lock_bh(&rcu_torture_lock);
65249 if (list_empty(&rcu_torture_freelist)) {
65250 - atomic_inc(&n_rcu_torture_alloc_fail);
65251 + atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
65252 spin_unlock_bh(&rcu_torture_lock);
65253 return NULL;
65254 }
65255 - atomic_inc(&n_rcu_torture_alloc);
65256 + atomic_inc_unchecked(&n_rcu_torture_alloc);
65257 p = rcu_torture_freelist.next;
65258 list_del_init(p);
65259 spin_unlock_bh(&rcu_torture_lock);
65260 @@ -240,7 +240,7 @@ rcu_torture_alloc(void)
65261 static void
65262 rcu_torture_free(struct rcu_torture *p)
65263 {
65264 - atomic_inc(&n_rcu_torture_free);
65265 + atomic_inc_unchecked(&n_rcu_torture_free);
65266 spin_lock_bh(&rcu_torture_lock);
65267 list_add_tail(&p->rtort_free, &rcu_torture_freelist);
65268 spin_unlock_bh(&rcu_torture_lock);
65269 @@ -360,7 +360,7 @@ rcu_torture_cb(struct rcu_head *p)
65270 i = rp->rtort_pipe_count;
65271 if (i > RCU_TORTURE_PIPE_LEN)
65272 i = RCU_TORTURE_PIPE_LEN;
65273 - atomic_inc(&rcu_torture_wcount[i]);
65274 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
65275 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
65276 rp->rtort_mbtest = 0;
65277 rcu_torture_free(rp);
65278 @@ -407,7 +407,7 @@ static void rcu_sync_torture_deferred_fr
65279 i = rp->rtort_pipe_count;
65280 if (i > RCU_TORTURE_PIPE_LEN)
65281 i = RCU_TORTURE_PIPE_LEN;
65282 - atomic_inc(&rcu_torture_wcount[i]);
65283 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
65284 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
65285 rp->rtort_mbtest = 0;
65286 list_del(&rp->rtort_free);
65287 @@ -882,7 +882,7 @@ rcu_torture_writer(void *arg)
65288 i = old_rp->rtort_pipe_count;
65289 if (i > RCU_TORTURE_PIPE_LEN)
65290 i = RCU_TORTURE_PIPE_LEN;
65291 - atomic_inc(&rcu_torture_wcount[i]);
65292 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
65293 old_rp->rtort_pipe_count++;
65294 cur_ops->deferred_free(old_rp);
65295 }
65296 @@ -951,7 +951,7 @@ static void rcu_torture_timer(unsigned l
65297 return;
65298 }
65299 if (p->rtort_mbtest == 0)
65300 - atomic_inc(&n_rcu_torture_mberror);
65301 + atomic_inc_unchecked(&n_rcu_torture_mberror);
65302 spin_lock(&rand_lock);
65303 cur_ops->read_delay(&rand);
65304 n_rcu_torture_timers++;
65305 @@ -1013,7 +1013,7 @@ rcu_torture_reader(void *arg)
65306 continue;
65307 }
65308 if (p->rtort_mbtest == 0)
65309 - atomic_inc(&n_rcu_torture_mberror);
65310 + atomic_inc_unchecked(&n_rcu_torture_mberror);
65311 cur_ops->read_delay(&rand);
65312 preempt_disable();
65313 pipe_count = p->rtort_pipe_count;
65314 @@ -1072,16 +1072,16 @@ rcu_torture_printk(char *page)
65315 rcu_torture_current,
65316 rcu_torture_current_version,
65317 list_empty(&rcu_torture_freelist),
65318 - atomic_read(&n_rcu_torture_alloc),
65319 - atomic_read(&n_rcu_torture_alloc_fail),
65320 - atomic_read(&n_rcu_torture_free),
65321 - atomic_read(&n_rcu_torture_mberror),
65322 + atomic_read_unchecked(&n_rcu_torture_alloc),
65323 + atomic_read_unchecked(&n_rcu_torture_alloc_fail),
65324 + atomic_read_unchecked(&n_rcu_torture_free),
65325 + atomic_read_unchecked(&n_rcu_torture_mberror),
65326 n_rcu_torture_boost_ktrerror,
65327 n_rcu_torture_boost_rterror,
65328 n_rcu_torture_boost_failure,
65329 n_rcu_torture_boosts,
65330 n_rcu_torture_timers);
65331 - if (atomic_read(&n_rcu_torture_mberror) != 0 ||
65332 + if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0 ||
65333 n_rcu_torture_boost_ktrerror != 0 ||
65334 n_rcu_torture_boost_rterror != 0 ||
65335 n_rcu_torture_boost_failure != 0)
65336 @@ -1089,7 +1089,7 @@ rcu_torture_printk(char *page)
65337 cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
65338 if (i > 1) {
65339 cnt += sprintf(&page[cnt], "!!! ");
65340 - atomic_inc(&n_rcu_torture_error);
65341 + atomic_inc_unchecked(&n_rcu_torture_error);
65342 WARN_ON_ONCE(1);
65343 }
65344 cnt += sprintf(&page[cnt], "Reader Pipe: ");
65345 @@ -1103,7 +1103,7 @@ rcu_torture_printk(char *page)
65346 cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
65347 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
65348 cnt += sprintf(&page[cnt], " %d",
65349 - atomic_read(&rcu_torture_wcount[i]));
65350 + atomic_read_unchecked(&rcu_torture_wcount[i]));
65351 }
65352 cnt += sprintf(&page[cnt], "\n");
65353 if (cur_ops->stats)
65354 @@ -1412,7 +1412,7 @@ rcu_torture_cleanup(void)
65355
65356 if (cur_ops->cleanup)
65357 cur_ops->cleanup();
65358 - if (atomic_read(&n_rcu_torture_error))
65359 + if (atomic_read_unchecked(&n_rcu_torture_error))
65360 rcu_torture_print_module_parms(cur_ops, "End of test: FAILURE");
65361 else
65362 rcu_torture_print_module_parms(cur_ops, "End of test: SUCCESS");
65363 @@ -1476,17 +1476,17 @@ rcu_torture_init(void)
65364
65365 rcu_torture_current = NULL;
65366 rcu_torture_current_version = 0;
65367 - atomic_set(&n_rcu_torture_alloc, 0);
65368 - atomic_set(&n_rcu_torture_alloc_fail, 0);
65369 - atomic_set(&n_rcu_torture_free, 0);
65370 - atomic_set(&n_rcu_torture_mberror, 0);
65371 - atomic_set(&n_rcu_torture_error, 0);
65372 + atomic_set_unchecked(&n_rcu_torture_alloc, 0);
65373 + atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
65374 + atomic_set_unchecked(&n_rcu_torture_free, 0);
65375 + atomic_set_unchecked(&n_rcu_torture_mberror, 0);
65376 + atomic_set_unchecked(&n_rcu_torture_error, 0);
65377 n_rcu_torture_boost_ktrerror = 0;
65378 n_rcu_torture_boost_rterror = 0;
65379 n_rcu_torture_boost_failure = 0;
65380 n_rcu_torture_boosts = 0;
65381 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
65382 - atomic_set(&rcu_torture_wcount[i], 0);
65383 + atomic_set_unchecked(&rcu_torture_wcount[i], 0);
65384 for_each_possible_cpu(cpu) {
65385 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
65386 per_cpu(rcu_torture_count, cpu)[i] = 0;
65387 diff -urNp linux-3.0.9/kernel/rcutree.c linux-3.0.9/kernel/rcutree.c
65388 --- linux-3.0.9/kernel/rcutree.c 2011-11-11 13:12:24.000000000 -0500
65389 +++ linux-3.0.9/kernel/rcutree.c 2011-11-15 20:03:00.000000000 -0500
65390 @@ -356,9 +356,9 @@ void rcu_enter_nohz(void)
65391 }
65392 /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */
65393 smp_mb__before_atomic_inc(); /* See above. */
65394 - atomic_inc(&rdtp->dynticks);
65395 + atomic_inc_unchecked(&rdtp->dynticks);
65396 smp_mb__after_atomic_inc(); /* Force ordering with next sojourn. */
65397 - WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1);
65398 + WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks) & 0x1);
65399 local_irq_restore(flags);
65400
65401 /* If the interrupt queued a callback, get out of dyntick mode. */
65402 @@ -387,10 +387,10 @@ void rcu_exit_nohz(void)
65403 return;
65404 }
65405 smp_mb__before_atomic_inc(); /* Force ordering w/previous sojourn. */
65406 - atomic_inc(&rdtp->dynticks);
65407 + atomic_inc_unchecked(&rdtp->dynticks);
65408 /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */
65409 smp_mb__after_atomic_inc(); /* See above. */
65410 - WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
65411 + WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks) & 0x1));
65412 local_irq_restore(flags);
65413 }
65414
65415 @@ -406,14 +406,14 @@ void rcu_nmi_enter(void)
65416 struct rcu_dynticks *rdtp = &__get_cpu_var(rcu_dynticks);
65417
65418 if (rdtp->dynticks_nmi_nesting == 0 &&
65419 - (atomic_read(&rdtp->dynticks) & 0x1))
65420 + (atomic_read_unchecked(&rdtp->dynticks) & 0x1))
65421 return;
65422 rdtp->dynticks_nmi_nesting++;
65423 smp_mb__before_atomic_inc(); /* Force delay from prior write. */
65424 - atomic_inc(&rdtp->dynticks);
65425 + atomic_inc_unchecked(&rdtp->dynticks);
65426 /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */
65427 smp_mb__after_atomic_inc(); /* See above. */
65428 - WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
65429 + WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks) & 0x1));
65430 }
65431
65432 /**
65433 @@ -432,9 +432,9 @@ void rcu_nmi_exit(void)
65434 return;
65435 /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */
65436 smp_mb__before_atomic_inc(); /* See above. */
65437 - atomic_inc(&rdtp->dynticks);
65438 + atomic_inc_unchecked(&rdtp->dynticks);
65439 smp_mb__after_atomic_inc(); /* Force delay to next write. */
65440 - WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1);
65441 + WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks) & 0x1);
65442 }
65443
65444 /**
65445 @@ -469,7 +469,7 @@ void rcu_irq_exit(void)
65446 */
65447 static int dyntick_save_progress_counter(struct rcu_data *rdp)
65448 {
65449 - rdp->dynticks_snap = atomic_add_return(0, &rdp->dynticks->dynticks);
65450 + rdp->dynticks_snap = atomic_add_return_unchecked(0, &rdp->dynticks->dynticks);
65451 return 0;
65452 }
65453
65454 @@ -484,7 +484,7 @@ static int rcu_implicit_dynticks_qs(stru
65455 unsigned long curr;
65456 unsigned long snap;
65457
65458 - curr = (unsigned long)atomic_add_return(0, &rdp->dynticks->dynticks);
65459 + curr = (unsigned long)atomic_add_return_unchecked(0, &rdp->dynticks->dynticks);
65460 snap = (unsigned long)rdp->dynticks_snap;
65461
65462 /*
65463 @@ -1470,7 +1470,7 @@ __rcu_process_callbacks(struct rcu_state
65464 /*
65465 * Do softirq processing for the current CPU.
65466 */
65467 -static void rcu_process_callbacks(struct softirq_action *unused)
65468 +static void rcu_process_callbacks(void)
65469 {
65470 __rcu_process_callbacks(&rcu_sched_state,
65471 &__get_cpu_var(rcu_sched_data));
65472 diff -urNp linux-3.0.9/kernel/rcutree.h linux-3.0.9/kernel/rcutree.h
65473 --- linux-3.0.9/kernel/rcutree.h 2011-11-11 13:12:24.000000000 -0500
65474 +++ linux-3.0.9/kernel/rcutree.h 2011-11-15 20:03:00.000000000 -0500
65475 @@ -86,7 +86,7 @@
65476 struct rcu_dynticks {
65477 int dynticks_nesting; /* Track irq/process nesting level. */
65478 int dynticks_nmi_nesting; /* Track NMI nesting level. */
65479 - atomic_t dynticks; /* Even value for dynticks-idle, else odd. */
65480 + atomic_unchecked_t dynticks; /* Even value for dynticks-idle, else odd. */
65481 };
65482
65483 /* RCU's kthread states for tracing. */
65484 diff -urNp linux-3.0.9/kernel/rcutree_plugin.h linux-3.0.9/kernel/rcutree_plugin.h
65485 --- linux-3.0.9/kernel/rcutree_plugin.h 2011-11-11 13:12:24.000000000 -0500
65486 +++ linux-3.0.9/kernel/rcutree_plugin.h 2011-11-15 20:03:00.000000000 -0500
65487 @@ -822,7 +822,7 @@ void synchronize_rcu_expedited(void)
65488
65489 /* Clean up and exit. */
65490 smp_mb(); /* ensure expedited GP seen before counter increment. */
65491 - ACCESS_ONCE(sync_rcu_preempt_exp_count)++;
65492 + ACCESS_ONCE_RW(sync_rcu_preempt_exp_count)++;
65493 unlock_mb_ret:
65494 mutex_unlock(&sync_rcu_preempt_exp_mutex);
65495 mb_ret:
65496 @@ -1774,8 +1774,8 @@ EXPORT_SYMBOL_GPL(synchronize_sched_expe
65497
65498 #else /* #ifndef CONFIG_SMP */
65499
65500 -static atomic_t sync_sched_expedited_started = ATOMIC_INIT(0);
65501 -static atomic_t sync_sched_expedited_done = ATOMIC_INIT(0);
65502 +static atomic_unchecked_t sync_sched_expedited_started = ATOMIC_INIT(0);
65503 +static atomic_unchecked_t sync_sched_expedited_done = ATOMIC_INIT(0);
65504
65505 static int synchronize_sched_expedited_cpu_stop(void *data)
65506 {
65507 @@ -1830,7 +1830,7 @@ void synchronize_sched_expedited(void)
65508 int firstsnap, s, snap, trycount = 0;
65509
65510 /* Note that atomic_inc_return() implies full memory barrier. */
65511 - firstsnap = snap = atomic_inc_return(&sync_sched_expedited_started);
65512 + firstsnap = snap = atomic_inc_return_unchecked(&sync_sched_expedited_started);
65513 get_online_cpus();
65514
65515 /*
65516 @@ -1851,7 +1851,7 @@ void synchronize_sched_expedited(void)
65517 }
65518
65519 /* Check to see if someone else did our work for us. */
65520 - s = atomic_read(&sync_sched_expedited_done);
65521 + s = atomic_read_unchecked(&sync_sched_expedited_done);
65522 if (UINT_CMP_GE((unsigned)s, (unsigned)firstsnap)) {
65523 smp_mb(); /* ensure test happens before caller kfree */
65524 return;
65525 @@ -1866,7 +1866,7 @@ void synchronize_sched_expedited(void)
65526 * grace period works for us.
65527 */
65528 get_online_cpus();
65529 - snap = atomic_read(&sync_sched_expedited_started) - 1;
65530 + snap = atomic_read_unchecked(&sync_sched_expedited_started) - 1;
65531 smp_mb(); /* ensure read is before try_stop_cpus(). */
65532 }
65533
65534 @@ -1877,12 +1877,12 @@ void synchronize_sched_expedited(void)
65535 * than we did beat us to the punch.
65536 */
65537 do {
65538 - s = atomic_read(&sync_sched_expedited_done);
65539 + s = atomic_read_unchecked(&sync_sched_expedited_done);
65540 if (UINT_CMP_GE((unsigned)s, (unsigned)snap)) {
65541 smp_mb(); /* ensure test happens before caller kfree */
65542 break;
65543 }
65544 - } while (atomic_cmpxchg(&sync_sched_expedited_done, s, snap) != s);
65545 + } while (atomic_cmpxchg_unchecked(&sync_sched_expedited_done, s, snap) != s);
65546
65547 put_online_cpus();
65548 }
65549 diff -urNp linux-3.0.9/kernel/relay.c linux-3.0.9/kernel/relay.c
65550 --- linux-3.0.9/kernel/relay.c 2011-11-11 13:12:24.000000000 -0500
65551 +++ linux-3.0.9/kernel/relay.c 2011-11-15 20:03:00.000000000 -0500
65552 @@ -1236,6 +1236,8 @@ static ssize_t subbuf_splice_actor(struc
65553 };
65554 ssize_t ret;
65555
65556 + pax_track_stack();
65557 +
65558 if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
65559 return 0;
65560 if (splice_grow_spd(pipe, &spd))
65561 diff -urNp linux-3.0.9/kernel/resource.c linux-3.0.9/kernel/resource.c
65562 --- linux-3.0.9/kernel/resource.c 2011-11-11 13:12:24.000000000 -0500
65563 +++ linux-3.0.9/kernel/resource.c 2011-11-15 20:03:00.000000000 -0500
65564 @@ -141,8 +141,18 @@ static const struct file_operations proc
65565
65566 static int __init ioresources_init(void)
65567 {
65568 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
65569 +#ifdef CONFIG_GRKERNSEC_PROC_USER
65570 + proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
65571 + proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
65572 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
65573 + proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
65574 + proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
65575 +#endif
65576 +#else
65577 proc_create("ioports", 0, NULL, &proc_ioports_operations);
65578 proc_create("iomem", 0, NULL, &proc_iomem_operations);
65579 +#endif
65580 return 0;
65581 }
65582 __initcall(ioresources_init);
65583 diff -urNp linux-3.0.9/kernel/rtmutex-tester.c linux-3.0.9/kernel/rtmutex-tester.c
65584 --- linux-3.0.9/kernel/rtmutex-tester.c 2011-11-11 13:12:24.000000000 -0500
65585 +++ linux-3.0.9/kernel/rtmutex-tester.c 2011-11-15 20:03:00.000000000 -0500
65586 @@ -20,7 +20,7 @@
65587 #define MAX_RT_TEST_MUTEXES 8
65588
65589 static spinlock_t rttest_lock;
65590 -static atomic_t rttest_event;
65591 +static atomic_unchecked_t rttest_event;
65592
65593 struct test_thread_data {
65594 int opcode;
65595 @@ -61,7 +61,7 @@ static int handle_op(struct test_thread_
65596
65597 case RTTEST_LOCKCONT:
65598 td->mutexes[td->opdata] = 1;
65599 - td->event = atomic_add_return(1, &rttest_event);
65600 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65601 return 0;
65602
65603 case RTTEST_RESET:
65604 @@ -74,7 +74,7 @@ static int handle_op(struct test_thread_
65605 return 0;
65606
65607 case RTTEST_RESETEVENT:
65608 - atomic_set(&rttest_event, 0);
65609 + atomic_set_unchecked(&rttest_event, 0);
65610 return 0;
65611
65612 default:
65613 @@ -91,9 +91,9 @@ static int handle_op(struct test_thread_
65614 return ret;
65615
65616 td->mutexes[id] = 1;
65617 - td->event = atomic_add_return(1, &rttest_event);
65618 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65619 rt_mutex_lock(&mutexes[id]);
65620 - td->event = atomic_add_return(1, &rttest_event);
65621 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65622 td->mutexes[id] = 4;
65623 return 0;
65624
65625 @@ -104,9 +104,9 @@ static int handle_op(struct test_thread_
65626 return ret;
65627
65628 td->mutexes[id] = 1;
65629 - td->event = atomic_add_return(1, &rttest_event);
65630 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65631 ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
65632 - td->event = atomic_add_return(1, &rttest_event);
65633 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65634 td->mutexes[id] = ret ? 0 : 4;
65635 return ret ? -EINTR : 0;
65636
65637 @@ -115,9 +115,9 @@ static int handle_op(struct test_thread_
65638 if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
65639 return ret;
65640
65641 - td->event = atomic_add_return(1, &rttest_event);
65642 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65643 rt_mutex_unlock(&mutexes[id]);
65644 - td->event = atomic_add_return(1, &rttest_event);
65645 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65646 td->mutexes[id] = 0;
65647 return 0;
65648
65649 @@ -164,7 +164,7 @@ void schedule_rt_mutex_test(struct rt_mu
65650 break;
65651
65652 td->mutexes[dat] = 2;
65653 - td->event = atomic_add_return(1, &rttest_event);
65654 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65655 break;
65656
65657 default:
65658 @@ -184,7 +184,7 @@ void schedule_rt_mutex_test(struct rt_mu
65659 return;
65660
65661 td->mutexes[dat] = 3;
65662 - td->event = atomic_add_return(1, &rttest_event);
65663 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65664 break;
65665
65666 case RTTEST_LOCKNOWAIT:
65667 @@ -196,7 +196,7 @@ void schedule_rt_mutex_test(struct rt_mu
65668 return;
65669
65670 td->mutexes[dat] = 1;
65671 - td->event = atomic_add_return(1, &rttest_event);
65672 + td->event = atomic_add_return_unchecked(1, &rttest_event);
65673 return;
65674
65675 default:
65676 diff -urNp linux-3.0.9/kernel/sched_autogroup.c linux-3.0.9/kernel/sched_autogroup.c
65677 --- linux-3.0.9/kernel/sched_autogroup.c 2011-11-11 13:12:24.000000000 -0500
65678 +++ linux-3.0.9/kernel/sched_autogroup.c 2011-11-15 20:03:00.000000000 -0500
65679 @@ -7,7 +7,7 @@
65680
65681 unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1;
65682 static struct autogroup autogroup_default;
65683 -static atomic_t autogroup_seq_nr;
65684 +static atomic_unchecked_t autogroup_seq_nr;
65685
65686 static void __init autogroup_init(struct task_struct *init_task)
65687 {
65688 @@ -78,7 +78,7 @@ static inline struct autogroup *autogrou
65689
65690 kref_init(&ag->kref);
65691 init_rwsem(&ag->lock);
65692 - ag->id = atomic_inc_return(&autogroup_seq_nr);
65693 + ag->id = atomic_inc_return_unchecked(&autogroup_seq_nr);
65694 ag->tg = tg;
65695 #ifdef CONFIG_RT_GROUP_SCHED
65696 /*
65697 diff -urNp linux-3.0.9/kernel/sched.c linux-3.0.9/kernel/sched.c
65698 --- linux-3.0.9/kernel/sched.c 2011-11-11 13:12:24.000000000 -0500
65699 +++ linux-3.0.9/kernel/sched.c 2011-11-15 20:03:00.000000000 -0500
65700 @@ -4227,6 +4227,8 @@ static void __sched __schedule(void)
65701 struct rq *rq;
65702 int cpu;
65703
65704 + pax_track_stack();
65705 +
65706 need_resched:
65707 preempt_disable();
65708 cpu = smp_processor_id();
65709 @@ -4920,6 +4922,8 @@ int can_nice(const struct task_struct *p
65710 /* convert nice value [19,-20] to rlimit style value [1,40] */
65711 int nice_rlim = 20 - nice;
65712
65713 + gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
65714 +
65715 return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
65716 capable(CAP_SYS_NICE));
65717 }
65718 @@ -4953,7 +4957,8 @@ SYSCALL_DEFINE1(nice, int, increment)
65719 if (nice > 19)
65720 nice = 19;
65721
65722 - if (increment < 0 && !can_nice(current, nice))
65723 + if (increment < 0 && (!can_nice(current, nice) ||
65724 + gr_handle_chroot_nice()))
65725 return -EPERM;
65726
65727 retval = security_task_setnice(current, nice);
65728 @@ -5097,6 +5102,7 @@ recheck:
65729 unsigned long rlim_rtprio =
65730 task_rlimit(p, RLIMIT_RTPRIO);
65731
65732 + gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
65733 /* can't set/change the rt policy */
65734 if (policy != p->policy && !rlim_rtprio)
65735 return -EPERM;
65736 diff -urNp linux-3.0.9/kernel/sched_fair.c linux-3.0.9/kernel/sched_fair.c
65737 --- linux-3.0.9/kernel/sched_fair.c 2011-11-11 13:12:24.000000000 -0500
65738 +++ linux-3.0.9/kernel/sched_fair.c 2011-11-15 20:03:00.000000000 -0500
65739 @@ -4050,7 +4050,7 @@ static void nohz_idle_balance(int this_c
65740 * run_rebalance_domains is triggered when needed from the scheduler tick.
65741 * Also triggered for nohz idle balancing (with nohz_balancing_kick set).
65742 */
65743 -static void run_rebalance_domains(struct softirq_action *h)
65744 +static void run_rebalance_domains(void)
65745 {
65746 int this_cpu = smp_processor_id();
65747 struct rq *this_rq = cpu_rq(this_cpu);
65748 diff -urNp linux-3.0.9/kernel/signal.c linux-3.0.9/kernel/signal.c
65749 --- linux-3.0.9/kernel/signal.c 2011-11-11 13:12:24.000000000 -0500
65750 +++ linux-3.0.9/kernel/signal.c 2011-11-15 20:03:00.000000000 -0500
65751 @@ -45,12 +45,12 @@ static struct kmem_cache *sigqueue_cache
65752
65753 int print_fatal_signals __read_mostly;
65754
65755 -static void __user *sig_handler(struct task_struct *t, int sig)
65756 +static __sighandler_t sig_handler(struct task_struct *t, int sig)
65757 {
65758 return t->sighand->action[sig - 1].sa.sa_handler;
65759 }
65760
65761 -static int sig_handler_ignored(void __user *handler, int sig)
65762 +static int sig_handler_ignored(__sighandler_t handler, int sig)
65763 {
65764 /* Is it explicitly or implicitly ignored? */
65765 return handler == SIG_IGN ||
65766 @@ -60,7 +60,7 @@ static int sig_handler_ignored(void __us
65767 static int sig_task_ignored(struct task_struct *t, int sig,
65768 int from_ancestor_ns)
65769 {
65770 - void __user *handler;
65771 + __sighandler_t handler;
65772
65773 handler = sig_handler(t, sig);
65774
65775 @@ -320,6 +320,9 @@ __sigqueue_alloc(int sig, struct task_st
65776 atomic_inc(&user->sigpending);
65777 rcu_read_unlock();
65778
65779 + if (!override_rlimit)
65780 + gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
65781 +
65782 if (override_rlimit ||
65783 atomic_read(&user->sigpending) <=
65784 task_rlimit(t, RLIMIT_SIGPENDING)) {
65785 @@ -444,7 +447,7 @@ flush_signal_handlers(struct task_struct
65786
65787 int unhandled_signal(struct task_struct *tsk, int sig)
65788 {
65789 - void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
65790 + __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
65791 if (is_global_init(tsk))
65792 return 1;
65793 if (handler != SIG_IGN && handler != SIG_DFL)
65794 @@ -770,6 +773,13 @@ static int check_kill_permission(int sig
65795 }
65796 }
65797
65798 + /* allow glibc communication via tgkill to other threads in our
65799 + thread group */
65800 + if ((info == SEND_SIG_NOINFO || info->si_code != SI_TKILL ||
65801 + sig != (SIGRTMIN+1) || task_tgid_vnr(t) != info->si_pid)
65802 + && gr_handle_signal(t, sig))
65803 + return -EPERM;
65804 +
65805 return security_task_kill(t, info, sig, 0);
65806 }
65807
65808 @@ -1092,7 +1102,7 @@ __group_send_sig_info(int sig, struct si
65809 return send_signal(sig, info, p, 1);
65810 }
65811
65812 -static int
65813 +int
65814 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
65815 {
65816 return send_signal(sig, info, t, 0);
65817 @@ -1129,6 +1139,7 @@ force_sig_info(int sig, struct siginfo *
65818 unsigned long int flags;
65819 int ret, blocked, ignored;
65820 struct k_sigaction *action;
65821 + int is_unhandled = 0;
65822
65823 spin_lock_irqsave(&t->sighand->siglock, flags);
65824 action = &t->sighand->action[sig-1];
65825 @@ -1143,9 +1154,18 @@ force_sig_info(int sig, struct siginfo *
65826 }
65827 if (action->sa.sa_handler == SIG_DFL)
65828 t->signal->flags &= ~SIGNAL_UNKILLABLE;
65829 + if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
65830 + is_unhandled = 1;
65831 ret = specific_send_sig_info(sig, info, t);
65832 spin_unlock_irqrestore(&t->sighand->siglock, flags);
65833
65834 + /* only deal with unhandled signals, java etc trigger SIGSEGV during
65835 + normal operation */
65836 + if (is_unhandled) {
65837 + gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
65838 + gr_handle_crash(t, sig);
65839 + }
65840 +
65841 return ret;
65842 }
65843
65844 @@ -1212,8 +1232,11 @@ int group_send_sig_info(int sig, struct
65845 ret = check_kill_permission(sig, info, p);
65846 rcu_read_unlock();
65847
65848 - if (!ret && sig)
65849 + if (!ret && sig) {
65850 ret = do_send_sig_info(sig, info, p, true);
65851 + if (!ret)
65852 + gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
65853 + }
65854
65855 return ret;
65856 }
65857 @@ -1839,6 +1862,8 @@ void ptrace_notify(int exit_code)
65858 {
65859 siginfo_t info;
65860
65861 + pax_track_stack();
65862 +
65863 BUG_ON((exit_code & (0x7f | ~0xffff)) != SIGTRAP);
65864
65865 memset(&info, 0, sizeof info);
65866 @@ -2637,7 +2662,15 @@ do_send_specific(pid_t tgid, pid_t pid,
65867 int error = -ESRCH;
65868
65869 rcu_read_lock();
65870 - p = find_task_by_vpid(pid);
65871 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
65872 + /* allow glibc communication via tgkill to other threads in our
65873 + thread group */
65874 + if (grsec_enable_chroot_findtask && info->si_code == SI_TKILL &&
65875 + sig == (SIGRTMIN+1) && tgid == info->si_pid)
65876 + p = find_task_by_vpid_unrestricted(pid);
65877 + else
65878 +#endif
65879 + p = find_task_by_vpid(pid);
65880 if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
65881 error = check_kill_permission(sig, info, p);
65882 /*
65883 diff -urNp linux-3.0.9/kernel/smp.c linux-3.0.9/kernel/smp.c
65884 --- linux-3.0.9/kernel/smp.c 2011-11-11 13:12:24.000000000 -0500
65885 +++ linux-3.0.9/kernel/smp.c 2011-11-15 20:03:00.000000000 -0500
65886 @@ -580,22 +580,22 @@ int smp_call_function(smp_call_func_t fu
65887 }
65888 EXPORT_SYMBOL(smp_call_function);
65889
65890 -void ipi_call_lock(void)
65891 +void ipi_call_lock(void) __acquires(call_function.lock)
65892 {
65893 raw_spin_lock(&call_function.lock);
65894 }
65895
65896 -void ipi_call_unlock(void)
65897 +void ipi_call_unlock(void) __releases(call_function.lock)
65898 {
65899 raw_spin_unlock(&call_function.lock);
65900 }
65901
65902 -void ipi_call_lock_irq(void)
65903 +void ipi_call_lock_irq(void) __acquires(call_function.lock)
65904 {
65905 raw_spin_lock_irq(&call_function.lock);
65906 }
65907
65908 -void ipi_call_unlock_irq(void)
65909 +void ipi_call_unlock_irq(void) __releases(call_function.lock)
65910 {
65911 raw_spin_unlock_irq(&call_function.lock);
65912 }
65913 diff -urNp linux-3.0.9/kernel/softirq.c linux-3.0.9/kernel/softirq.c
65914 --- linux-3.0.9/kernel/softirq.c 2011-11-11 13:12:24.000000000 -0500
65915 +++ linux-3.0.9/kernel/softirq.c 2011-11-15 20:03:00.000000000 -0500
65916 @@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
65917
65918 DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
65919
65920 -char *softirq_to_name[NR_SOFTIRQS] = {
65921 +const char * const softirq_to_name[NR_SOFTIRQS] = {
65922 "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
65923 "TASKLET", "SCHED", "HRTIMER", "RCU"
65924 };
65925 @@ -235,7 +235,7 @@ restart:
65926 kstat_incr_softirqs_this_cpu(vec_nr);
65927
65928 trace_softirq_entry(vec_nr);
65929 - h->action(h);
65930 + h->action();
65931 trace_softirq_exit(vec_nr);
65932 if (unlikely(prev_count != preempt_count())) {
65933 printk(KERN_ERR "huh, entered softirq %u %s %p"
65934 @@ -385,9 +385,11 @@ void raise_softirq(unsigned int nr)
65935 local_irq_restore(flags);
65936 }
65937
65938 -void open_softirq(int nr, void (*action)(struct softirq_action *))
65939 +void open_softirq(int nr, void (*action)(void))
65940 {
65941 - softirq_vec[nr].action = action;
65942 + pax_open_kernel();
65943 + *(void **)&softirq_vec[nr].action = action;
65944 + pax_close_kernel();
65945 }
65946
65947 /*
65948 @@ -441,7 +443,7 @@ void __tasklet_hi_schedule_first(struct
65949
65950 EXPORT_SYMBOL(__tasklet_hi_schedule_first);
65951
65952 -static void tasklet_action(struct softirq_action *a)
65953 +static void tasklet_action(void)
65954 {
65955 struct tasklet_struct *list;
65956
65957 @@ -476,7 +478,7 @@ static void tasklet_action(struct softir
65958 }
65959 }
65960
65961 -static void tasklet_hi_action(struct softirq_action *a)
65962 +static void tasklet_hi_action(void)
65963 {
65964 struct tasklet_struct *list;
65965
65966 diff -urNp linux-3.0.9/kernel/sys.c linux-3.0.9/kernel/sys.c
65967 --- linux-3.0.9/kernel/sys.c 2011-11-11 13:12:24.000000000 -0500
65968 +++ linux-3.0.9/kernel/sys.c 2011-11-15 20:03:00.000000000 -0500
65969 @@ -158,6 +158,12 @@ static int set_one_prio(struct task_stru
65970 error = -EACCES;
65971 goto out;
65972 }
65973 +
65974 + if (gr_handle_chroot_setpriority(p, niceval)) {
65975 + error = -EACCES;
65976 + goto out;
65977 + }
65978 +
65979 no_nice = security_task_setnice(p, niceval);
65980 if (no_nice) {
65981 error = no_nice;
65982 @@ -541,6 +547,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
65983 goto error;
65984 }
65985
65986 + if (gr_check_group_change(new->gid, new->egid, -1))
65987 + goto error;
65988 +
65989 if (rgid != (gid_t) -1 ||
65990 (egid != (gid_t) -1 && egid != old->gid))
65991 new->sgid = new->egid;
65992 @@ -570,6 +579,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
65993 old = current_cred();
65994
65995 retval = -EPERM;
65996 +
65997 + if (gr_check_group_change(gid, gid, gid))
65998 + goto error;
65999 +
66000 if (nsown_capable(CAP_SETGID))
66001 new->gid = new->egid = new->sgid = new->fsgid = gid;
66002 else if (gid == old->gid || gid == old->sgid)
66003 @@ -595,11 +608,18 @@ static int set_user(struct cred *new)
66004 if (!new_user)
66005 return -EAGAIN;
66006
66007 + /*
66008 + * We don't fail in case of NPROC limit excess here because too many
66009 + * poorly written programs don't check set*uid() return code, assuming
66010 + * it never fails if called by root. We may still enforce NPROC limit
66011 + * for programs doing set*uid()+execve() by harmlessly deferring the
66012 + * failure to the execve() stage.
66013 + */
66014 if (atomic_read(&new_user->processes) >= rlimit(RLIMIT_NPROC) &&
66015 - new_user != INIT_USER) {
66016 - free_uid(new_user);
66017 - return -EAGAIN;
66018 - }
66019 + new_user != INIT_USER)
66020 + current->flags |= PF_NPROC_EXCEEDED;
66021 + else
66022 + current->flags &= ~PF_NPROC_EXCEEDED;
66023
66024 free_uid(new->user);
66025 new->user = new_user;
66026 @@ -650,6 +670,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
66027 goto error;
66028 }
66029
66030 + if (gr_check_user_change(new->uid, new->euid, -1))
66031 + goto error;
66032 +
66033 if (new->uid != old->uid) {
66034 retval = set_user(new);
66035 if (retval < 0)
66036 @@ -694,6 +717,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
66037 old = current_cred();
66038
66039 retval = -EPERM;
66040 +
66041 + if (gr_check_crash_uid(uid))
66042 + goto error;
66043 + if (gr_check_user_change(uid, uid, uid))
66044 + goto error;
66045 +
66046 if (nsown_capable(CAP_SETUID)) {
66047 new->suid = new->uid = uid;
66048 if (uid != old->uid) {
66049 @@ -748,6 +777,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid,
66050 goto error;
66051 }
66052
66053 + if (gr_check_user_change(ruid, euid, -1))
66054 + goto error;
66055 +
66056 if (ruid != (uid_t) -1) {
66057 new->uid = ruid;
66058 if (ruid != old->uid) {
66059 @@ -812,6 +844,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid,
66060 goto error;
66061 }
66062
66063 + if (gr_check_group_change(rgid, egid, -1))
66064 + goto error;
66065 +
66066 if (rgid != (gid_t) -1)
66067 new->gid = rgid;
66068 if (egid != (gid_t) -1)
66069 @@ -858,6 +893,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
66070 old = current_cred();
66071 old_fsuid = old->fsuid;
66072
66073 + if (gr_check_user_change(-1, -1, uid))
66074 + goto error;
66075 +
66076 if (uid == old->uid || uid == old->euid ||
66077 uid == old->suid || uid == old->fsuid ||
66078 nsown_capable(CAP_SETUID)) {
66079 @@ -868,6 +906,7 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
66080 }
66081 }
66082
66083 +error:
66084 abort_creds(new);
66085 return old_fsuid;
66086
66087 @@ -894,12 +933,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
66088 if (gid == old->gid || gid == old->egid ||
66089 gid == old->sgid || gid == old->fsgid ||
66090 nsown_capable(CAP_SETGID)) {
66091 + if (gr_check_group_change(-1, -1, gid))
66092 + goto error;
66093 +
66094 if (gid != old_fsgid) {
66095 new->fsgid = gid;
66096 goto change_okay;
66097 }
66098 }
66099
66100 +error:
66101 abort_creds(new);
66102 return old_fsgid;
66103
66104 @@ -1205,19 +1248,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_
66105 return -EFAULT;
66106
66107 down_read(&uts_sem);
66108 - error = __copy_to_user(&name->sysname, &utsname()->sysname,
66109 + error = __copy_to_user(name->sysname, &utsname()->sysname,
66110 __OLD_UTS_LEN);
66111 error |= __put_user(0, name->sysname + __OLD_UTS_LEN);
66112 - error |= __copy_to_user(&name->nodename, &utsname()->nodename,
66113 + error |= __copy_to_user(name->nodename, &utsname()->nodename,
66114 __OLD_UTS_LEN);
66115 error |= __put_user(0, name->nodename + __OLD_UTS_LEN);
66116 - error |= __copy_to_user(&name->release, &utsname()->release,
66117 + error |= __copy_to_user(name->release, &utsname()->release,
66118 __OLD_UTS_LEN);
66119 error |= __put_user(0, name->release + __OLD_UTS_LEN);
66120 - error |= __copy_to_user(&name->version, &utsname()->version,
66121 + error |= __copy_to_user(name->version, &utsname()->version,
66122 __OLD_UTS_LEN);
66123 error |= __put_user(0, name->version + __OLD_UTS_LEN);
66124 - error |= __copy_to_user(&name->machine, &utsname()->machine,
66125 + error |= __copy_to_user(name->machine, &utsname()->machine,
66126 __OLD_UTS_LEN);
66127 error |= __put_user(0, name->machine + __OLD_UTS_LEN);
66128 up_read(&uts_sem);
66129 @@ -1680,7 +1723,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
66130 error = get_dumpable(me->mm);
66131 break;
66132 case PR_SET_DUMPABLE:
66133 - if (arg2 < 0 || arg2 > 1) {
66134 + if (arg2 > 1) {
66135 error = -EINVAL;
66136 break;
66137 }
66138 diff -urNp linux-3.0.9/kernel/sysctl_binary.c linux-3.0.9/kernel/sysctl_binary.c
66139 --- linux-3.0.9/kernel/sysctl_binary.c 2011-11-11 13:12:24.000000000 -0500
66140 +++ linux-3.0.9/kernel/sysctl_binary.c 2011-11-15 20:03:00.000000000 -0500
66141 @@ -989,7 +989,7 @@ static ssize_t bin_intvec(struct file *f
66142 int i;
66143
66144 set_fs(KERNEL_DS);
66145 - result = vfs_read(file, buffer, BUFSZ - 1, &pos);
66146 + result = vfs_read(file, (char __force_user *)buffer, BUFSZ - 1, &pos);
66147 set_fs(old_fs);
66148 if (result < 0)
66149 goto out_kfree;
66150 @@ -1034,7 +1034,7 @@ static ssize_t bin_intvec(struct file *f
66151 }
66152
66153 set_fs(KERNEL_DS);
66154 - result = vfs_write(file, buffer, str - buffer, &pos);
66155 + result = vfs_write(file, (const char __force_user *)buffer, str - buffer, &pos);
66156 set_fs(old_fs);
66157 if (result < 0)
66158 goto out_kfree;
66159 @@ -1067,7 +1067,7 @@ static ssize_t bin_ulongvec(struct file
66160 int i;
66161
66162 set_fs(KERNEL_DS);
66163 - result = vfs_read(file, buffer, BUFSZ - 1, &pos);
66164 + result = vfs_read(file, (char __force_user *)buffer, BUFSZ - 1, &pos);
66165 set_fs(old_fs);
66166 if (result < 0)
66167 goto out_kfree;
66168 @@ -1112,7 +1112,7 @@ static ssize_t bin_ulongvec(struct file
66169 }
66170
66171 set_fs(KERNEL_DS);
66172 - result = vfs_write(file, buffer, str - buffer, &pos);
66173 + result = vfs_write(file, (const char __force_user *)buffer, str - buffer, &pos);
66174 set_fs(old_fs);
66175 if (result < 0)
66176 goto out_kfree;
66177 @@ -1138,7 +1138,7 @@ static ssize_t bin_uuid(struct file *fil
66178 int i;
66179
66180 set_fs(KERNEL_DS);
66181 - result = vfs_read(file, buf, sizeof(buf) - 1, &pos);
66182 + result = vfs_read(file, (char __force_user *)buf, sizeof(buf) - 1, &pos);
66183 set_fs(old_fs);
66184 if (result < 0)
66185 goto out;
66186 @@ -1185,7 +1185,7 @@ static ssize_t bin_dn_node_address(struc
66187 __le16 dnaddr;
66188
66189 set_fs(KERNEL_DS);
66190 - result = vfs_read(file, buf, sizeof(buf) - 1, &pos);
66191 + result = vfs_read(file, (char __force_user *)buf, sizeof(buf) - 1, &pos);
66192 set_fs(old_fs);
66193 if (result < 0)
66194 goto out;
66195 @@ -1233,7 +1233,7 @@ static ssize_t bin_dn_node_address(struc
66196 le16_to_cpu(dnaddr) & 0x3ff);
66197
66198 set_fs(KERNEL_DS);
66199 - result = vfs_write(file, buf, len, &pos);
66200 + result = vfs_write(file, (const char __force_user *)buf, len, &pos);
66201 set_fs(old_fs);
66202 if (result < 0)
66203 goto out;
66204 diff -urNp linux-3.0.9/kernel/sysctl.c linux-3.0.9/kernel/sysctl.c
66205 --- linux-3.0.9/kernel/sysctl.c 2011-11-11 13:12:24.000000000 -0500
66206 +++ linux-3.0.9/kernel/sysctl.c 2011-11-15 20:03:00.000000000 -0500
66207 @@ -85,6 +85,13 @@
66208
66209
66210 #if defined(CONFIG_SYSCTL)
66211 +#include <linux/grsecurity.h>
66212 +#include <linux/grinternal.h>
66213 +
66214 +extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
66215 +extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
66216 + const int op);
66217 +extern int gr_handle_chroot_sysctl(const int op);
66218
66219 /* External variables not in a header file. */
66220 extern int sysctl_overcommit_memory;
66221 @@ -197,6 +204,7 @@ static int sysrq_sysctl_handler(ctl_tabl
66222 }
66223
66224 #endif
66225 +extern struct ctl_table grsecurity_table[];
66226
66227 static struct ctl_table root_table[];
66228 static struct ctl_table_root sysctl_table_root;
66229 @@ -226,6 +234,20 @@ extern struct ctl_table epoll_table[];
66230 int sysctl_legacy_va_layout;
66231 #endif
66232
66233 +#ifdef CONFIG_PAX_SOFTMODE
66234 +static ctl_table pax_table[] = {
66235 + {
66236 + .procname = "softmode",
66237 + .data = &pax_softmode,
66238 + .maxlen = sizeof(unsigned int),
66239 + .mode = 0600,
66240 + .proc_handler = &proc_dointvec,
66241 + },
66242 +
66243 + { }
66244 +};
66245 +#endif
66246 +
66247 /* The default sysctl tables: */
66248
66249 static struct ctl_table root_table[] = {
66250 @@ -272,6 +294,22 @@ static int max_extfrag_threshold = 1000;
66251 #endif
66252
66253 static struct ctl_table kern_table[] = {
66254 +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
66255 + {
66256 + .procname = "grsecurity",
66257 + .mode = 0500,
66258 + .child = grsecurity_table,
66259 + },
66260 +#endif
66261 +
66262 +#ifdef CONFIG_PAX_SOFTMODE
66263 + {
66264 + .procname = "pax",
66265 + .mode = 0500,
66266 + .child = pax_table,
66267 + },
66268 +#endif
66269 +
66270 {
66271 .procname = "sched_child_runs_first",
66272 .data = &sysctl_sched_child_runs_first,
66273 @@ -546,7 +584,7 @@ static struct ctl_table kern_table[] = {
66274 .data = &modprobe_path,
66275 .maxlen = KMOD_PATH_LEN,
66276 .mode = 0644,
66277 - .proc_handler = proc_dostring,
66278 + .proc_handler = proc_dostring_modpriv,
66279 },
66280 {
66281 .procname = "modules_disabled",
66282 @@ -713,16 +751,20 @@ static struct ctl_table kern_table[] = {
66283 .extra1 = &zero,
66284 .extra2 = &one,
66285 },
66286 +#endif
66287 {
66288 .procname = "kptr_restrict",
66289 .data = &kptr_restrict,
66290 .maxlen = sizeof(int),
66291 .mode = 0644,
66292 .proc_handler = proc_dmesg_restrict,
66293 +#ifdef CONFIG_GRKERNSEC_HIDESYM
66294 + .extra1 = &two,
66295 +#else
66296 .extra1 = &zero,
66297 +#endif
66298 .extra2 = &two,
66299 },
66300 -#endif
66301 {
66302 .procname = "ngroups_max",
66303 .data = &ngroups_max,
66304 @@ -1205,6 +1247,13 @@ static struct ctl_table vm_table[] = {
66305 .proc_handler = proc_dointvec_minmax,
66306 .extra1 = &zero,
66307 },
66308 + {
66309 + .procname = "heap_stack_gap",
66310 + .data = &sysctl_heap_stack_gap,
66311 + .maxlen = sizeof(sysctl_heap_stack_gap),
66312 + .mode = 0644,
66313 + .proc_handler = proc_doulongvec_minmax,
66314 + },
66315 #else
66316 {
66317 .procname = "nr_trim_pages",
66318 @@ -1714,6 +1763,17 @@ static int test_perm(int mode, int op)
66319 int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
66320 {
66321 int mode;
66322 + int error;
66323 +
66324 + if (table->parent != NULL && table->parent->procname != NULL &&
66325 + table->procname != NULL &&
66326 + gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
66327 + return -EACCES;
66328 + if (gr_handle_chroot_sysctl(op))
66329 + return -EACCES;
66330 + error = gr_handle_sysctl(table, op);
66331 + if (error)
66332 + return error;
66333
66334 if (root->permissions)
66335 mode = root->permissions(root, current->nsproxy, table);
66336 @@ -2118,6 +2178,16 @@ int proc_dostring(struct ctl_table *tabl
66337 buffer, lenp, ppos);
66338 }
66339
66340 +int proc_dostring_modpriv(struct ctl_table *table, int write,
66341 + void __user *buffer, size_t *lenp, loff_t *ppos)
66342 +{
66343 + if (write && !capable(CAP_SYS_MODULE))
66344 + return -EPERM;
66345 +
66346 + return _proc_do_string(table->data, table->maxlen, write,
66347 + buffer, lenp, ppos);
66348 +}
66349 +
66350 static size_t proc_skip_spaces(char **buf)
66351 {
66352 size_t ret;
66353 @@ -2223,6 +2293,8 @@ static int proc_put_long(void __user **b
66354 len = strlen(tmp);
66355 if (len > *size)
66356 len = *size;
66357 + if (len > sizeof(tmp))
66358 + len = sizeof(tmp);
66359 if (copy_to_user(*buf, tmp, len))
66360 return -EFAULT;
66361 *size -= len;
66362 @@ -2539,8 +2611,11 @@ static int __do_proc_doulongvec_minmax(v
66363 *i = val;
66364 } else {
66365 val = convdiv * (*i) / convmul;
66366 - if (!first)
66367 + if (!first) {
66368 err = proc_put_char(&buffer, &left, '\t');
66369 + if (err)
66370 + break;
66371 + }
66372 err = proc_put_long(&buffer, &left, val, false);
66373 if (err)
66374 break;
66375 @@ -2935,6 +3010,12 @@ int proc_dostring(struct ctl_table *tabl
66376 return -ENOSYS;
66377 }
66378
66379 +int proc_dostring_modpriv(struct ctl_table *table, int write,
66380 + void __user *buffer, size_t *lenp, loff_t *ppos)
66381 +{
66382 + return -ENOSYS;
66383 +}
66384 +
66385 int proc_dointvec(struct ctl_table *table, int write,
66386 void __user *buffer, size_t *lenp, loff_t *ppos)
66387 {
66388 @@ -2991,6 +3072,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
66389 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
66390 EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
66391 EXPORT_SYMBOL(proc_dostring);
66392 +EXPORT_SYMBOL(proc_dostring_modpriv);
66393 EXPORT_SYMBOL(proc_doulongvec_minmax);
66394 EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
66395 EXPORT_SYMBOL(register_sysctl_table);
66396 diff -urNp linux-3.0.9/kernel/sysctl_check.c linux-3.0.9/kernel/sysctl_check.c
66397 --- linux-3.0.9/kernel/sysctl_check.c 2011-11-11 13:12:24.000000000 -0500
66398 +++ linux-3.0.9/kernel/sysctl_check.c 2011-11-15 20:03:00.000000000 -0500
66399 @@ -129,6 +129,7 @@ int sysctl_check_table(struct nsproxy *n
66400 set_fail(&fail, table, "Directory with extra2");
66401 } else {
66402 if ((table->proc_handler == proc_dostring) ||
66403 + (table->proc_handler == proc_dostring_modpriv) ||
66404 (table->proc_handler == proc_dointvec) ||
66405 (table->proc_handler == proc_dointvec_minmax) ||
66406 (table->proc_handler == proc_dointvec_jiffies) ||
66407 diff -urNp linux-3.0.9/kernel/taskstats.c linux-3.0.9/kernel/taskstats.c
66408 --- linux-3.0.9/kernel/taskstats.c 2011-11-11 13:12:24.000000000 -0500
66409 +++ linux-3.0.9/kernel/taskstats.c 2011-11-15 20:03:00.000000000 -0500
66410 @@ -27,9 +27,12 @@
66411 #include <linux/cgroup.h>
66412 #include <linux/fs.h>
66413 #include <linux/file.h>
66414 +#include <linux/grsecurity.h>
66415 #include <net/genetlink.h>
66416 #include <asm/atomic.h>
66417
66418 +extern int gr_is_taskstats_denied(int pid);
66419 +
66420 /*
66421 * Maximum length of a cpumask that can be specified in
66422 * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
66423 @@ -558,6 +561,9 @@ err:
66424
66425 static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
66426 {
66427 + if (gr_is_taskstats_denied(current->pid))
66428 + return -EACCES;
66429 +
66430 if (info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK])
66431 return cmd_attr_register_cpumask(info);
66432 else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK])
66433 diff -urNp linux-3.0.9/kernel/time/alarmtimer.c linux-3.0.9/kernel/time/alarmtimer.c
66434 --- linux-3.0.9/kernel/time/alarmtimer.c 2011-11-11 13:12:24.000000000 -0500
66435 +++ linux-3.0.9/kernel/time/alarmtimer.c 2011-11-15 20:03:00.000000000 -0500
66436 @@ -693,7 +693,7 @@ static int __init alarmtimer_init(void)
66437 {
66438 int error = 0;
66439 int i;
66440 - struct k_clock alarm_clock = {
66441 + static struct k_clock alarm_clock = {
66442 .clock_getres = alarm_clock_getres,
66443 .clock_get = alarm_clock_get,
66444 .timer_create = alarm_timer_create,
66445 diff -urNp linux-3.0.9/kernel/time/tick-broadcast.c linux-3.0.9/kernel/time/tick-broadcast.c
66446 --- linux-3.0.9/kernel/time/tick-broadcast.c 2011-11-11 13:12:24.000000000 -0500
66447 +++ linux-3.0.9/kernel/time/tick-broadcast.c 2011-11-15 20:03:00.000000000 -0500
66448 @@ -115,7 +115,7 @@ int tick_device_uses_broadcast(struct cl
66449 * then clear the broadcast bit.
66450 */
66451 if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
66452 - int cpu = smp_processor_id();
66453 + cpu = smp_processor_id();
66454
66455 cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
66456 tick_broadcast_clear_oneshot(cpu);
66457 diff -urNp linux-3.0.9/kernel/time/timekeeping.c linux-3.0.9/kernel/time/timekeeping.c
66458 --- linux-3.0.9/kernel/time/timekeeping.c 2011-11-11 13:12:24.000000000 -0500
66459 +++ linux-3.0.9/kernel/time/timekeeping.c 2011-11-15 20:03:00.000000000 -0500
66460 @@ -14,6 +14,7 @@
66461 #include <linux/init.h>
66462 #include <linux/mm.h>
66463 #include <linux/sched.h>
66464 +#include <linux/grsecurity.h>
66465 #include <linux/syscore_ops.h>
66466 #include <linux/clocksource.h>
66467 #include <linux/jiffies.h>
66468 @@ -361,6 +362,8 @@ int do_settimeofday(const struct timespe
66469 if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
66470 return -EINVAL;
66471
66472 + gr_log_timechange();
66473 +
66474 write_seqlock_irqsave(&xtime_lock, flags);
66475
66476 timekeeping_forward_now();
66477 diff -urNp linux-3.0.9/kernel/time/timer_list.c linux-3.0.9/kernel/time/timer_list.c
66478 --- linux-3.0.9/kernel/time/timer_list.c 2011-11-11 13:12:24.000000000 -0500
66479 +++ linux-3.0.9/kernel/time/timer_list.c 2011-11-15 20:03:00.000000000 -0500
66480 @@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base,
66481
66482 static void print_name_offset(struct seq_file *m, void *sym)
66483 {
66484 +#ifdef CONFIG_GRKERNSEC_HIDESYM
66485 + SEQ_printf(m, "<%p>", NULL);
66486 +#else
66487 char symname[KSYM_NAME_LEN];
66488
66489 if (lookup_symbol_name((unsigned long)sym, symname) < 0)
66490 SEQ_printf(m, "<%pK>", sym);
66491 else
66492 SEQ_printf(m, "%s", symname);
66493 +#endif
66494 }
66495
66496 static void
66497 @@ -112,7 +116,11 @@ next_one:
66498 static void
66499 print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
66500 {
66501 +#ifdef CONFIG_GRKERNSEC_HIDESYM
66502 + SEQ_printf(m, " .base: %p\n", NULL);
66503 +#else
66504 SEQ_printf(m, " .base: %pK\n", base);
66505 +#endif
66506 SEQ_printf(m, " .index: %d\n",
66507 base->index);
66508 SEQ_printf(m, " .resolution: %Lu nsecs\n",
66509 @@ -293,7 +301,11 @@ static int __init init_timer_list_procfs
66510 {
66511 struct proc_dir_entry *pe;
66512
66513 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
66514 + pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
66515 +#else
66516 pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
66517 +#endif
66518 if (!pe)
66519 return -ENOMEM;
66520 return 0;
66521 diff -urNp linux-3.0.9/kernel/time/timer_stats.c linux-3.0.9/kernel/time/timer_stats.c
66522 --- linux-3.0.9/kernel/time/timer_stats.c 2011-11-11 13:12:24.000000000 -0500
66523 +++ linux-3.0.9/kernel/time/timer_stats.c 2011-11-15 20:03:00.000000000 -0500
66524 @@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
66525 static unsigned long nr_entries;
66526 static struct entry entries[MAX_ENTRIES];
66527
66528 -static atomic_t overflow_count;
66529 +static atomic_unchecked_t overflow_count;
66530
66531 /*
66532 * The entries are in a hash-table, for fast lookup:
66533 @@ -140,7 +140,7 @@ static void reset_entries(void)
66534 nr_entries = 0;
66535 memset(entries, 0, sizeof(entries));
66536 memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
66537 - atomic_set(&overflow_count, 0);
66538 + atomic_set_unchecked(&overflow_count, 0);
66539 }
66540
66541 static struct entry *alloc_entry(void)
66542 @@ -261,7 +261,7 @@ void timer_stats_update_stats(void *time
66543 if (likely(entry))
66544 entry->count++;
66545 else
66546 - atomic_inc(&overflow_count);
66547 + atomic_inc_unchecked(&overflow_count);
66548
66549 out_unlock:
66550 raw_spin_unlock_irqrestore(lock, flags);
66551 @@ -269,12 +269,16 @@ void timer_stats_update_stats(void *time
66552
66553 static void print_name_offset(struct seq_file *m, unsigned long addr)
66554 {
66555 +#ifdef CONFIG_GRKERNSEC_HIDESYM
66556 + seq_printf(m, "<%p>", NULL);
66557 +#else
66558 char symname[KSYM_NAME_LEN];
66559
66560 if (lookup_symbol_name(addr, symname) < 0)
66561 seq_printf(m, "<%p>", (void *)addr);
66562 else
66563 seq_printf(m, "%s", symname);
66564 +#endif
66565 }
66566
66567 static int tstats_show(struct seq_file *m, void *v)
66568 @@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *
66569
66570 seq_puts(m, "Timer Stats Version: v0.2\n");
66571 seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
66572 - if (atomic_read(&overflow_count))
66573 + if (atomic_read_unchecked(&overflow_count))
66574 seq_printf(m, "Overflow: %d entries\n",
66575 - atomic_read(&overflow_count));
66576 + atomic_read_unchecked(&overflow_count));
66577
66578 for (i = 0; i < nr_entries; i++) {
66579 entry = entries + i;
66580 @@ -417,7 +421,11 @@ static int __init init_tstats_procfs(voi
66581 {
66582 struct proc_dir_entry *pe;
66583
66584 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
66585 + pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
66586 +#else
66587 pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
66588 +#endif
66589 if (!pe)
66590 return -ENOMEM;
66591 return 0;
66592 diff -urNp linux-3.0.9/kernel/time.c linux-3.0.9/kernel/time.c
66593 --- linux-3.0.9/kernel/time.c 2011-11-11 13:12:24.000000000 -0500
66594 +++ linux-3.0.9/kernel/time.c 2011-11-15 20:03:00.000000000 -0500
66595 @@ -163,6 +163,11 @@ int do_sys_settimeofday(const struct tim
66596 return error;
66597
66598 if (tz) {
66599 + /* we log in do_settimeofday called below, so don't log twice
66600 + */
66601 + if (!tv)
66602 + gr_log_timechange();
66603 +
66604 /* SMP safe, global irq locking makes it work. */
66605 sys_tz = *tz;
66606 update_vsyscall_tz();
66607 diff -urNp linux-3.0.9/kernel/timer.c linux-3.0.9/kernel/timer.c
66608 --- linux-3.0.9/kernel/timer.c 2011-11-11 13:12:24.000000000 -0500
66609 +++ linux-3.0.9/kernel/timer.c 2011-11-15 20:03:00.000000000 -0500
66610 @@ -1304,7 +1304,7 @@ void update_process_times(int user_tick)
66611 /*
66612 * This function runs timers and the timer-tq in bottom half context.
66613 */
66614 -static void run_timer_softirq(struct softirq_action *h)
66615 +static void run_timer_softirq(void)
66616 {
66617 struct tvec_base *base = __this_cpu_read(tvec_bases);
66618
66619 diff -urNp linux-3.0.9/kernel/trace/blktrace.c linux-3.0.9/kernel/trace/blktrace.c
66620 --- linux-3.0.9/kernel/trace/blktrace.c 2011-11-11 13:12:24.000000000 -0500
66621 +++ linux-3.0.9/kernel/trace/blktrace.c 2011-11-15 20:03:00.000000000 -0500
66622 @@ -321,7 +321,7 @@ static ssize_t blk_dropped_read(struct f
66623 struct blk_trace *bt = filp->private_data;
66624 char buf[16];
66625
66626 - snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
66627 + snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
66628
66629 return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
66630 }
66631 @@ -386,7 +386,7 @@ static int blk_subbuf_start_callback(str
66632 return 1;
66633
66634 bt = buf->chan->private_data;
66635 - atomic_inc(&bt->dropped);
66636 + atomic_inc_unchecked(&bt->dropped);
66637 return 0;
66638 }
66639
66640 @@ -487,7 +487,7 @@ int do_blk_trace_setup(struct request_qu
66641
66642 bt->dir = dir;
66643 bt->dev = dev;
66644 - atomic_set(&bt->dropped, 0);
66645 + atomic_set_unchecked(&bt->dropped, 0);
66646
66647 ret = -EIO;
66648 bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
66649 diff -urNp linux-3.0.9/kernel/trace/ftrace.c linux-3.0.9/kernel/trace/ftrace.c
66650 --- linux-3.0.9/kernel/trace/ftrace.c 2011-11-11 13:12:24.000000000 -0500
66651 +++ linux-3.0.9/kernel/trace/ftrace.c 2011-11-15 20:03:00.000000000 -0500
66652 @@ -1566,12 +1566,17 @@ ftrace_code_disable(struct module *mod,
66653 if (unlikely(ftrace_disabled))
66654 return 0;
66655
66656 + ret = ftrace_arch_code_modify_prepare();
66657 + FTRACE_WARN_ON(ret);
66658 + if (ret)
66659 + return 0;
66660 +
66661 ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
66662 + FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
66663 if (ret) {
66664 ftrace_bug(ret, ip);
66665 - return 0;
66666 }
66667 - return 1;
66668 + return ret ? 0 : 1;
66669 }
66670
66671 /*
66672 @@ -2570,7 +2575,7 @@ static void ftrace_free_entry_rcu(struct
66673
66674 int
66675 register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
66676 - void *data)
66677 + void *data)
66678 {
66679 struct ftrace_func_probe *entry;
66680 struct ftrace_page *pg;
66681 diff -urNp linux-3.0.9/kernel/trace/trace.c linux-3.0.9/kernel/trace/trace.c
66682 --- linux-3.0.9/kernel/trace/trace.c 2011-11-11 13:12:24.000000000 -0500
66683 +++ linux-3.0.9/kernel/trace/trace.c 2011-11-15 20:03:00.000000000 -0500
66684 @@ -3339,6 +3339,8 @@ static ssize_t tracing_splice_read_pipe(
66685 size_t rem;
66686 unsigned int i;
66687
66688 + pax_track_stack();
66689 +
66690 if (splice_grow_spd(pipe, &spd))
66691 return -ENOMEM;
66692
66693 @@ -3822,6 +3824,8 @@ tracing_buffers_splice_read(struct file
66694 int entries, size, i;
66695 size_t ret;
66696
66697 + pax_track_stack();
66698 +
66699 if (splice_grow_spd(pipe, &spd))
66700 return -ENOMEM;
66701
66702 @@ -3990,10 +3994,9 @@ static const struct file_operations trac
66703 };
66704 #endif
66705
66706 -static struct dentry *d_tracer;
66707 -
66708 struct dentry *tracing_init_dentry(void)
66709 {
66710 + static struct dentry *d_tracer;
66711 static int once;
66712
66713 if (d_tracer)
66714 @@ -4013,10 +4016,9 @@ struct dentry *tracing_init_dentry(void)
66715 return d_tracer;
66716 }
66717
66718 -static struct dentry *d_percpu;
66719 -
66720 struct dentry *tracing_dentry_percpu(void)
66721 {
66722 + static struct dentry *d_percpu;
66723 static int once;
66724 struct dentry *d_tracer;
66725
66726 diff -urNp linux-3.0.9/kernel/trace/trace_events.c linux-3.0.9/kernel/trace/trace_events.c
66727 --- linux-3.0.9/kernel/trace/trace_events.c 2011-11-11 13:12:24.000000000 -0500
66728 +++ linux-3.0.9/kernel/trace/trace_events.c 2011-11-15 20:03:00.000000000 -0500
66729 @@ -1318,10 +1318,6 @@ static LIST_HEAD(ftrace_module_file_list
66730 struct ftrace_module_file_ops {
66731 struct list_head list;
66732 struct module *mod;
66733 - struct file_operations id;
66734 - struct file_operations enable;
66735 - struct file_operations format;
66736 - struct file_operations filter;
66737 };
66738
66739 static struct ftrace_module_file_ops *
66740 @@ -1342,17 +1338,12 @@ trace_create_file_ops(struct module *mod
66741
66742 file_ops->mod = mod;
66743
66744 - file_ops->id = ftrace_event_id_fops;
66745 - file_ops->id.owner = mod;
66746 -
66747 - file_ops->enable = ftrace_enable_fops;
66748 - file_ops->enable.owner = mod;
66749 -
66750 - file_ops->filter = ftrace_event_filter_fops;
66751 - file_ops->filter.owner = mod;
66752 -
66753 - file_ops->format = ftrace_event_format_fops;
66754 - file_ops->format.owner = mod;
66755 + pax_open_kernel();
66756 + *(void **)&mod->trace_id.owner = mod;
66757 + *(void **)&mod->trace_enable.owner = mod;
66758 + *(void **)&mod->trace_filter.owner = mod;
66759 + *(void **)&mod->trace_format.owner = mod;
66760 + pax_close_kernel();
66761
66762 list_add(&file_ops->list, &ftrace_module_file_list);
66763
66764 @@ -1376,8 +1367,8 @@ static void trace_module_add_events(stru
66765
66766 for_each_event(call, start, end) {
66767 __trace_add_event_call(*call, mod,
66768 - &file_ops->id, &file_ops->enable,
66769 - &file_ops->filter, &file_ops->format);
66770 + &mod->trace_id, &mod->trace_enable,
66771 + &mod->trace_filter, &mod->trace_format);
66772 }
66773 }
66774
66775 diff -urNp linux-3.0.9/kernel/trace/trace_kprobe.c linux-3.0.9/kernel/trace/trace_kprobe.c
66776 --- linux-3.0.9/kernel/trace/trace_kprobe.c 2011-11-11 13:12:24.000000000 -0500
66777 +++ linux-3.0.9/kernel/trace/trace_kprobe.c 2011-11-15 20:03:00.000000000 -0500
66778 @@ -217,7 +217,7 @@ static __kprobes void FETCH_FUNC_NAME(me
66779 long ret;
66780 int maxlen = get_rloc_len(*(u32 *)dest);
66781 u8 *dst = get_rloc_data(dest);
66782 - u8 *src = addr;
66783 + const u8 __user *src = (const u8 __force_user *)addr;
66784 mm_segment_t old_fs = get_fs();
66785 if (!maxlen)
66786 return;
66787 @@ -229,7 +229,7 @@ static __kprobes void FETCH_FUNC_NAME(me
66788 pagefault_disable();
66789 do
66790 ret = __copy_from_user_inatomic(dst++, src++, 1);
66791 - while (dst[-1] && ret == 0 && src - (u8 *)addr < maxlen);
66792 + while (dst[-1] && ret == 0 && src - (const u8 __force_user *)addr < maxlen);
66793 dst[-1] = '\0';
66794 pagefault_enable();
66795 set_fs(old_fs);
66796 @@ -238,7 +238,7 @@ static __kprobes void FETCH_FUNC_NAME(me
66797 ((u8 *)get_rloc_data(dest))[0] = '\0';
66798 *(u32 *)dest = make_data_rloc(0, get_rloc_offs(*(u32 *)dest));
66799 } else
66800 - *(u32 *)dest = make_data_rloc(src - (u8 *)addr,
66801 + *(u32 *)dest = make_data_rloc(src - (const u8 __force_user *)addr,
66802 get_rloc_offs(*(u32 *)dest));
66803 }
66804 /* Return the length of string -- including null terminal byte */
66805 @@ -252,7 +252,7 @@ static __kprobes void FETCH_FUNC_NAME(me
66806 set_fs(KERNEL_DS);
66807 pagefault_disable();
66808 do {
66809 - ret = __copy_from_user_inatomic(&c, (u8 *)addr + len, 1);
66810 + ret = __copy_from_user_inatomic(&c, (const u8 __force_user *)addr + len, 1);
66811 len++;
66812 } while (c && ret == 0 && len < MAX_STRING_SIZE);
66813 pagefault_enable();
66814 diff -urNp linux-3.0.9/kernel/trace/trace_mmiotrace.c linux-3.0.9/kernel/trace/trace_mmiotrace.c
66815 --- linux-3.0.9/kernel/trace/trace_mmiotrace.c 2011-11-11 13:12:24.000000000 -0500
66816 +++ linux-3.0.9/kernel/trace/trace_mmiotrace.c 2011-11-15 20:03:00.000000000 -0500
66817 @@ -24,7 +24,7 @@ struct header_iter {
66818 static struct trace_array *mmio_trace_array;
66819 static bool overrun_detected;
66820 static unsigned long prev_overruns;
66821 -static atomic_t dropped_count;
66822 +static atomic_unchecked_t dropped_count;
66823
66824 static void mmio_reset_data(struct trace_array *tr)
66825 {
66826 @@ -127,7 +127,7 @@ static void mmio_close(struct trace_iter
66827
66828 static unsigned long count_overruns(struct trace_iterator *iter)
66829 {
66830 - unsigned long cnt = atomic_xchg(&dropped_count, 0);
66831 + unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
66832 unsigned long over = ring_buffer_overruns(iter->tr->buffer);
66833
66834 if (over > prev_overruns)
66835 @@ -317,7 +317,7 @@ static void __trace_mmiotrace_rw(struct
66836 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
66837 sizeof(*entry), 0, pc);
66838 if (!event) {
66839 - atomic_inc(&dropped_count);
66840 + atomic_inc_unchecked(&dropped_count);
66841 return;
66842 }
66843 entry = ring_buffer_event_data(event);
66844 @@ -347,7 +347,7 @@ static void __trace_mmiotrace_map(struct
66845 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
66846 sizeof(*entry), 0, pc);
66847 if (!event) {
66848 - atomic_inc(&dropped_count);
66849 + atomic_inc_unchecked(&dropped_count);
66850 return;
66851 }
66852 entry = ring_buffer_event_data(event);
66853 diff -urNp linux-3.0.9/kernel/trace/trace_output.c linux-3.0.9/kernel/trace/trace_output.c
66854 --- linux-3.0.9/kernel/trace/trace_output.c 2011-11-11 13:12:24.000000000 -0500
66855 +++ linux-3.0.9/kernel/trace/trace_output.c 2011-11-15 20:03:00.000000000 -0500
66856 @@ -278,7 +278,7 @@ int trace_seq_path(struct trace_seq *s,
66857
66858 p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
66859 if (!IS_ERR(p)) {
66860 - p = mangle_path(s->buffer + s->len, p, "\n");
66861 + p = mangle_path(s->buffer + s->len, p, "\n\\");
66862 if (p) {
66863 s->len = p - s->buffer;
66864 return 1;
66865 diff -urNp linux-3.0.9/kernel/trace/trace_stack.c linux-3.0.9/kernel/trace/trace_stack.c
66866 --- linux-3.0.9/kernel/trace/trace_stack.c 2011-11-11 13:12:24.000000000 -0500
66867 +++ linux-3.0.9/kernel/trace/trace_stack.c 2011-11-15 20:03:00.000000000 -0500
66868 @@ -50,7 +50,7 @@ static inline void check_stack(void)
66869 return;
66870
66871 /* we do not handle interrupt stacks yet */
66872 - if (!object_is_on_stack(&this_size))
66873 + if (!object_starts_on_stack(&this_size))
66874 return;
66875
66876 local_irq_save(flags);
66877 diff -urNp linux-3.0.9/kernel/trace/trace_workqueue.c linux-3.0.9/kernel/trace/trace_workqueue.c
66878 --- linux-3.0.9/kernel/trace/trace_workqueue.c 2011-11-11 13:12:24.000000000 -0500
66879 +++ linux-3.0.9/kernel/trace/trace_workqueue.c 2011-11-15 20:03:00.000000000 -0500
66880 @@ -22,7 +22,7 @@ struct cpu_workqueue_stats {
66881 int cpu;
66882 pid_t pid;
66883 /* Can be inserted from interrupt or user context, need to be atomic */
66884 - atomic_t inserted;
66885 + atomic_unchecked_t inserted;
66886 /*
66887 * Don't need to be atomic, works are serialized in a single workqueue thread
66888 * on a single CPU.
66889 @@ -60,7 +60,7 @@ probe_workqueue_insertion(void *ignore,
66890 spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
66891 list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
66892 if (node->pid == wq_thread->pid) {
66893 - atomic_inc(&node->inserted);
66894 + atomic_inc_unchecked(&node->inserted);
66895 goto found;
66896 }
66897 }
66898 @@ -210,7 +210,7 @@ static int workqueue_stat_show(struct se
66899 tsk = get_pid_task(pid, PIDTYPE_PID);
66900 if (tsk) {
66901 seq_printf(s, "%3d %6d %6u %s\n", cws->cpu,
66902 - atomic_read(&cws->inserted), cws->executed,
66903 + atomic_read_unchecked(&cws->inserted), cws->executed,
66904 tsk->comm);
66905 put_task_struct(tsk);
66906 }
66907 diff -urNp linux-3.0.9/lib/bitmap.c linux-3.0.9/lib/bitmap.c
66908 --- linux-3.0.9/lib/bitmap.c 2011-11-11 13:12:24.000000000 -0500
66909 +++ linux-3.0.9/lib/bitmap.c 2011-11-15 20:03:00.000000000 -0500
66910 @@ -421,7 +421,7 @@ int __bitmap_parse(const char *buf, unsi
66911 {
66912 int c, old_c, totaldigits, ndigits, nchunks, nbits;
66913 u32 chunk;
66914 - const char __user *ubuf = buf;
66915 + const char __user *ubuf = (const char __force_user *)buf;
66916
66917 bitmap_zero(maskp, nmaskbits);
66918
66919 @@ -506,7 +506,7 @@ int bitmap_parse_user(const char __user
66920 {
66921 if (!access_ok(VERIFY_READ, ubuf, ulen))
66922 return -EFAULT;
66923 - return __bitmap_parse((const char *)ubuf, ulen, 1, maskp, nmaskbits);
66924 + return __bitmap_parse((const char __force_kernel *)ubuf, ulen, 1, maskp, nmaskbits);
66925 }
66926 EXPORT_SYMBOL(bitmap_parse_user);
66927
66928 @@ -596,7 +596,7 @@ static int __bitmap_parselist(const char
66929 {
66930 unsigned a, b;
66931 int c, old_c, totaldigits;
66932 - const char __user *ubuf = buf;
66933 + const char __user *ubuf = (const char __force_user *)buf;
66934 int exp_digit, in_range;
66935
66936 totaldigits = c = 0;
66937 @@ -696,7 +696,7 @@ int bitmap_parselist_user(const char __u
66938 {
66939 if (!access_ok(VERIFY_READ, ubuf, ulen))
66940 return -EFAULT;
66941 - return __bitmap_parselist((const char *)ubuf,
66942 + return __bitmap_parselist((const char __force_kernel *)ubuf,
66943 ulen, 1, maskp, nmaskbits);
66944 }
66945 EXPORT_SYMBOL(bitmap_parselist_user);
66946 diff -urNp linux-3.0.9/lib/bug.c linux-3.0.9/lib/bug.c
66947 --- linux-3.0.9/lib/bug.c 2011-11-11 13:12:24.000000000 -0500
66948 +++ linux-3.0.9/lib/bug.c 2011-11-15 20:03:00.000000000 -0500
66949 @@ -133,6 +133,8 @@ enum bug_trap_type report_bug(unsigned l
66950 return BUG_TRAP_TYPE_NONE;
66951
66952 bug = find_bug(bugaddr);
66953 + if (!bug)
66954 + return BUG_TRAP_TYPE_NONE;
66955
66956 file = NULL;
66957 line = 0;
66958 diff -urNp linux-3.0.9/lib/debugobjects.c linux-3.0.9/lib/debugobjects.c
66959 --- linux-3.0.9/lib/debugobjects.c 2011-11-11 13:12:24.000000000 -0500
66960 +++ linux-3.0.9/lib/debugobjects.c 2011-11-15 20:03:00.000000000 -0500
66961 @@ -284,7 +284,7 @@ static void debug_object_is_on_stack(voi
66962 if (limit > 4)
66963 return;
66964
66965 - is_on_stack = object_is_on_stack(addr);
66966 + is_on_stack = object_starts_on_stack(addr);
66967 if (is_on_stack == onstack)
66968 return;
66969
66970 diff -urNp linux-3.0.9/lib/devres.c linux-3.0.9/lib/devres.c
66971 --- linux-3.0.9/lib/devres.c 2011-11-11 13:12:24.000000000 -0500
66972 +++ linux-3.0.9/lib/devres.c 2011-11-15 20:03:00.000000000 -0500
66973 @@ -81,7 +81,7 @@ void devm_iounmap(struct device *dev, vo
66974 {
66975 iounmap(addr);
66976 WARN_ON(devres_destroy(dev, devm_ioremap_release, devm_ioremap_match,
66977 - (void *)addr));
66978 + (void __force *)addr));
66979 }
66980 EXPORT_SYMBOL(devm_iounmap);
66981
66982 @@ -141,7 +141,7 @@ void devm_ioport_unmap(struct device *de
66983 {
66984 ioport_unmap(addr);
66985 WARN_ON(devres_destroy(dev, devm_ioport_map_release,
66986 - devm_ioport_map_match, (void *)addr));
66987 + devm_ioport_map_match, (void __force *)addr));
66988 }
66989 EXPORT_SYMBOL(devm_ioport_unmap);
66990
66991 diff -urNp linux-3.0.9/lib/dma-debug.c linux-3.0.9/lib/dma-debug.c
66992 --- linux-3.0.9/lib/dma-debug.c 2011-11-11 13:12:24.000000000 -0500
66993 +++ linux-3.0.9/lib/dma-debug.c 2011-11-15 20:03:00.000000000 -0500
66994 @@ -870,7 +870,7 @@ out:
66995
66996 static void check_for_stack(struct device *dev, void *addr)
66997 {
66998 - if (object_is_on_stack(addr))
66999 + if (object_starts_on_stack(addr))
67000 err_printk(dev, NULL, "DMA-API: device driver maps memory from"
67001 "stack [addr=%p]\n", addr);
67002 }
67003 diff -urNp linux-3.0.9/lib/extable.c linux-3.0.9/lib/extable.c
67004 --- linux-3.0.9/lib/extable.c 2011-11-11 13:12:24.000000000 -0500
67005 +++ linux-3.0.9/lib/extable.c 2011-11-15 20:03:00.000000000 -0500
67006 @@ -13,6 +13,7 @@
67007 #include <linux/init.h>
67008 #include <linux/sort.h>
67009 #include <asm/uaccess.h>
67010 +#include <asm/pgtable.h>
67011
67012 #ifndef ARCH_HAS_SORT_EXTABLE
67013 /*
67014 @@ -36,8 +37,10 @@ static int cmp_ex(const void *a, const v
67015 void sort_extable(struct exception_table_entry *start,
67016 struct exception_table_entry *finish)
67017 {
67018 + pax_open_kernel();
67019 sort(start, finish - start, sizeof(struct exception_table_entry),
67020 cmp_ex, NULL);
67021 + pax_close_kernel();
67022 }
67023
67024 #ifdef CONFIG_MODULES
67025 diff -urNp linux-3.0.9/lib/inflate.c linux-3.0.9/lib/inflate.c
67026 --- linux-3.0.9/lib/inflate.c 2011-11-11 13:12:24.000000000 -0500
67027 +++ linux-3.0.9/lib/inflate.c 2011-11-15 20:03:00.000000000 -0500
67028 @@ -269,7 +269,7 @@ static void free(void *where)
67029 malloc_ptr = free_mem_ptr;
67030 }
67031 #else
67032 -#define malloc(a) kmalloc(a, GFP_KERNEL)
67033 +#define malloc(a) kmalloc((a), GFP_KERNEL)
67034 #define free(a) kfree(a)
67035 #endif
67036
67037 diff -urNp linux-3.0.9/lib/Kconfig.debug linux-3.0.9/lib/Kconfig.debug
67038 --- linux-3.0.9/lib/Kconfig.debug 2011-11-11 13:12:24.000000000 -0500
67039 +++ linux-3.0.9/lib/Kconfig.debug 2011-11-15 20:03:00.000000000 -0500
67040 @@ -1088,6 +1088,7 @@ config LATENCYTOP
67041 depends on DEBUG_KERNEL
67042 depends on STACKTRACE_SUPPORT
67043 depends on PROC_FS
67044 + depends on !GRKERNSEC_HIDESYM
67045 select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE
67046 select KALLSYMS
67047 select KALLSYMS_ALL
67048 diff -urNp linux-3.0.9/lib/kref.c linux-3.0.9/lib/kref.c
67049 --- linux-3.0.9/lib/kref.c 2011-11-11 13:12:24.000000000 -0500
67050 +++ linux-3.0.9/lib/kref.c 2011-11-15 20:03:00.000000000 -0500
67051 @@ -52,7 +52,7 @@ void kref_get(struct kref *kref)
67052 */
67053 int kref_put(struct kref *kref, void (*release)(struct kref *kref))
67054 {
67055 - WARN_ON(release == NULL);
67056 + BUG_ON(release == NULL);
67057 WARN_ON(release == (void (*)(struct kref *))kfree);
67058
67059 if (atomic_dec_and_test(&kref->refcount)) {
67060 diff -urNp linux-3.0.9/lib/radix-tree.c linux-3.0.9/lib/radix-tree.c
67061 --- linux-3.0.9/lib/radix-tree.c 2011-11-11 13:12:24.000000000 -0500
67062 +++ linux-3.0.9/lib/radix-tree.c 2011-11-15 20:03:00.000000000 -0500
67063 @@ -80,7 +80,7 @@ struct radix_tree_preload {
67064 int nr;
67065 struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
67066 };
67067 -static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
67068 +static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
67069
67070 static inline void *ptr_to_indirect(void *ptr)
67071 {
67072 diff -urNp linux-3.0.9/lib/vsprintf.c linux-3.0.9/lib/vsprintf.c
67073 --- linux-3.0.9/lib/vsprintf.c 2011-11-11 13:12:24.000000000 -0500
67074 +++ linux-3.0.9/lib/vsprintf.c 2011-11-15 20:03:00.000000000 -0500
67075 @@ -16,6 +16,9 @@
67076 * - scnprintf and vscnprintf
67077 */
67078
67079 +#ifdef CONFIG_GRKERNSEC_HIDESYM
67080 +#define __INCLUDED_BY_HIDESYM 1
67081 +#endif
67082 #include <stdarg.h>
67083 #include <linux/module.h>
67084 #include <linux/types.h>
67085 @@ -435,7 +438,7 @@ char *symbol_string(char *buf, char *end
67086 char sym[KSYM_SYMBOL_LEN];
67087 if (ext == 'B')
67088 sprint_backtrace(sym, value);
67089 - else if (ext != 'f' && ext != 's')
67090 + else if (ext != 'f' && ext != 's' && ext != 'a')
67091 sprint_symbol(sym, value);
67092 else
67093 kallsyms_lookup(value, NULL, NULL, NULL, sym);
67094 @@ -799,7 +802,11 @@ char *uuid_string(char *buf, char *end,
67095 return string(buf, end, uuid, spec);
67096 }
67097
67098 +#ifdef CONFIG_GRKERNSEC_HIDESYM
67099 +int kptr_restrict __read_mostly = 2;
67100 +#else
67101 int kptr_restrict __read_mostly;
67102 +#endif
67103
67104 /*
67105 * Show a '%p' thing. A kernel extension is that the '%p' is followed
67106 @@ -813,6 +820,8 @@ int kptr_restrict __read_mostly;
67107 * - 'S' For symbolic direct pointers with offset
67108 * - 's' For symbolic direct pointers without offset
67109 * - 'B' For backtraced symbolic direct pointers with offset
67110 + * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
67111 + * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
67112 * - 'R' For decoded struct resource, e.g., [mem 0x0-0x1f 64bit pref]
67113 * - 'r' For raw struct resource, e.g., [mem 0x0-0x1f flags 0x201]
67114 * - 'M' For a 6-byte MAC address, it prints the address in the
67115 @@ -857,12 +866,12 @@ char *pointer(const char *fmt, char *buf
67116 {
67117 if (!ptr && *fmt != 'K') {
67118 /*
67119 - * Print (null) with the same width as a pointer so it makes
67120 + * Print (nil) with the same width as a pointer so it makes
67121 * tabular output look nice.
67122 */
67123 if (spec.field_width == -1)
67124 spec.field_width = 2 * sizeof(void *);
67125 - return string(buf, end, "(null)", spec);
67126 + return string(buf, end, "(nil)", spec);
67127 }
67128
67129 switch (*fmt) {
67130 @@ -872,6 +881,13 @@ char *pointer(const char *fmt, char *buf
67131 /* Fallthrough */
67132 case 'S':
67133 case 's':
67134 +#ifdef CONFIG_GRKERNSEC_HIDESYM
67135 + break;
67136 +#else
67137 + return symbol_string(buf, end, ptr, spec, *fmt);
67138 +#endif
67139 + case 'A':
67140 + case 'a':
67141 case 'B':
67142 return symbol_string(buf, end, ptr, spec, *fmt);
67143 case 'R':
67144 @@ -1631,11 +1647,11 @@ int bstr_printf(char *buf, size_t size,
67145 typeof(type) value; \
67146 if (sizeof(type) == 8) { \
67147 args = PTR_ALIGN(args, sizeof(u32)); \
67148 - *(u32 *)&value = *(u32 *)args; \
67149 - *((u32 *)&value + 1) = *(u32 *)(args + 4); \
67150 + *(u32 *)&value = *(const u32 *)args; \
67151 + *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
67152 } else { \
67153 args = PTR_ALIGN(args, sizeof(type)); \
67154 - value = *(typeof(type) *)args; \
67155 + value = *(const typeof(type) *)args; \
67156 } \
67157 args += sizeof(type); \
67158 value; \
67159 @@ -1698,7 +1714,7 @@ int bstr_printf(char *buf, size_t size,
67160 case FORMAT_TYPE_STR: {
67161 const char *str_arg = args;
67162 args += strlen(str_arg) + 1;
67163 - str = string(str, end, (char *)str_arg, spec);
67164 + str = string(str, end, str_arg, spec);
67165 break;
67166 }
67167
67168 diff -urNp linux-3.0.9/localversion-grsec linux-3.0.9/localversion-grsec
67169 --- linux-3.0.9/localversion-grsec 1969-12-31 19:00:00.000000000 -0500
67170 +++ linux-3.0.9/localversion-grsec 2011-11-15 20:03:00.000000000 -0500
67171 @@ -0,0 +1 @@
67172 +-grsec
67173 diff -urNp linux-3.0.9/Makefile linux-3.0.9/Makefile
67174 --- linux-3.0.9/Makefile 2011-11-11 13:12:24.000000000 -0500
67175 +++ linux-3.0.9/Makefile 2011-11-15 20:03:00.000000000 -0500
67176 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
67177
67178 HOSTCC = gcc
67179 HOSTCXX = g++
67180 -HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
67181 -HOSTCXXFLAGS = -O2
67182 +HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
67183 +HOSTCFLAGS += $(call cc-option, -Wno-empty-body)
67184 +HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
67185
67186 # Decide whether to build built-in, modular, or both.
67187 # Normally, just do built-in.
67188 @@ -365,10 +366,12 @@ LINUXINCLUDE := -I$(srctree)/arch/$(h
67189 KBUILD_CPPFLAGS := -D__KERNEL__
67190
67191 KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
67192 + -W -Wno-unused-parameter -Wno-missing-field-initializers \
67193 -fno-strict-aliasing -fno-common \
67194 -Werror-implicit-function-declaration \
67195 -Wno-format-security \
67196 -fno-delete-null-pointer-checks
67197 +KBUILD_CFLAGS += $(call cc-option, -Wno-empty-body)
67198 KBUILD_AFLAGS_KERNEL :=
67199 KBUILD_CFLAGS_KERNEL :=
67200 KBUILD_AFLAGS := -D__ASSEMBLY__
67201 @@ -407,8 +410,8 @@ export RCS_TAR_IGNORE := --exclude SCCS
67202 # Rules shared between *config targets and build targets
67203
67204 # Basic helpers built in scripts/
67205 -PHONY += scripts_basic
67206 -scripts_basic:
67207 +PHONY += scripts_basic gcc-plugins
67208 +scripts_basic: gcc-plugins
67209 $(Q)$(MAKE) $(build)=scripts/basic
67210 $(Q)rm -f .tmp_quiet_recordmcount
67211
67212 @@ -564,6 +567,36 @@ else
67213 KBUILD_CFLAGS += -O2
67214 endif
67215
67216 +ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCC)" "$(CC)"), y)
67217 +CONSTIFY_PLUGIN := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN
67218 +ifdef CONFIG_PAX_MEMORY_STACKLEAK
67219 +STACKLEAK_PLUGIN := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -fplugin-arg-stackleak_plugin-track-lowest-sp=100
67220 +endif
67221 +ifdef CONFIG_KALLOCSTAT_PLUGIN
67222 +KALLOCSTAT_PLUGIN := -fplugin=$(objtree)/tools/gcc/kallocstat_plugin.so
67223 +endif
67224 +ifdef CONFIG_PAX_KERNEXEC_PLUGIN
67225 +KERNEXEC_PLUGIN := -fplugin=$(objtree)/tools/gcc/kernexec_plugin.so
67226 +endif
67227 +ifdef CONFIG_CHECKER_PLUGIN
67228 +ifeq ($(call cc-ifversion, -ge, 0406, y), y)
67229 +CHECKER_PLUGIN := -fplugin=$(objtree)/tools/gcc/checker_plugin.so -DCHECKER_PLUGIN
67230 +endif
67231 +endif
67232 +GCC_PLUGINS := $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) $(KALLOCSTAT_PLUGIN) $(KERNEXEC_PLUGIN) $(CHECKER_PLUGIN)
67233 +export CONSTIFY_PLUGIN STACKLEAK_PLUGIN KERNEXEC_PLUGIN CHECKER_PLUGIN
67234 +gcc-plugins:
67235 + $(Q)$(MAKE) $(build)=tools/gcc
67236 +else
67237 +gcc-plugins:
67238 +ifeq ($(call cc-ifversion, -ge, 0405, y), y)
67239 + $(error Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev.))
67240 +else
67241 + $(Q)echo "warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least"
67242 +endif
67243 + $(Q)echo "PAX_MEMORY_STACKLEAK and constification will be less secure"
67244 +endif
67245 +
67246 include $(srctree)/arch/$(SRCARCH)/Makefile
67247
67248 ifneq ($(CONFIG_FRAME_WARN),0)
67249 @@ -708,7 +741,7 @@ export mod_strip_cmd
67250
67251
67252 ifeq ($(KBUILD_EXTMOD),)
67253 -core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
67254 +core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
67255
67256 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
67257 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
67258 @@ -932,6 +965,7 @@ vmlinux.o: $(modpost-init) $(vmlinux-mai
67259
67260 # The actual objects are generated when descending,
67261 # make sure no implicit rule kicks in
67262 +$(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): KBUILD_CFLAGS += $(GCC_PLUGINS)
67263 $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
67264
67265 # Handle descending into subdirectories listed in $(vmlinux-dirs)
67266 @@ -941,7 +975,7 @@ $(sort $(vmlinux-init) $(vmlinux-main))
67267 # Error messages still appears in the original language
67268
67269 PHONY += $(vmlinux-dirs)
67270 -$(vmlinux-dirs): prepare scripts
67271 +$(vmlinux-dirs): gcc-plugins prepare scripts
67272 $(Q)$(MAKE) $(build)=$@
67273
67274 # Store (new) KERNELRELASE string in include/config/kernel.release
67275 @@ -986,6 +1020,7 @@ prepare0: archprepare FORCE
67276 $(Q)$(MAKE) $(build)=. missing-syscalls
67277
67278 # All the preparing..
67279 +prepare: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS),$(KBUILD_CFLAGS))
67280 prepare: prepare0
67281
67282 # Generate some files
67283 @@ -1087,6 +1122,7 @@ all: modules
67284 # using awk while concatenating to the final file.
67285
67286 PHONY += modules
67287 +modules: KBUILD_CFLAGS += $(GCC_PLUGINS)
67288 modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
67289 $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
67290 @$(kecho) ' Building modules, stage 2.';
67291 @@ -1102,7 +1138,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modu
67292
67293 # Target to prepare building external modules
67294 PHONY += modules_prepare
67295 -modules_prepare: prepare scripts
67296 +modules_prepare: gcc-plugins prepare scripts
67297
67298 # Target to install modules
67299 PHONY += modules_install
67300 @@ -1198,7 +1234,7 @@ distclean: mrproper
67301 @find $(srctree) $(RCS_FIND_IGNORE) \
67302 \( -name '*.orig' -o -name '*.rej' -o -name '*~' \
67303 -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
67304 - -o -name '.*.rej' -o -size 0 \
67305 + -o -name '.*.rej' -o -name '*.so' -o -size 0 \
67306 -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
67307 -type f -print | xargs rm -f
67308
67309 @@ -1359,6 +1395,7 @@ PHONY += $(module-dirs) modules
67310 $(module-dirs): crmodverdir $(objtree)/Module.symvers
67311 $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
67312
67313 +modules: KBUILD_CFLAGS += $(GCC_PLUGINS)
67314 modules: $(module-dirs)
67315 @$(kecho) ' Building modules, stage 2.';
67316 $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
67317 @@ -1485,17 +1522,19 @@ else
67318 target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
67319 endif
67320
67321 -%.s: %.c prepare scripts FORCE
67322 +%.s: KBUILD_CFLAGS += $(GCC_PLUGINS)
67323 +%.s: %.c gcc-plugins prepare scripts FORCE
67324 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
67325 %.i: %.c prepare scripts FORCE
67326 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
67327 -%.o: %.c prepare scripts FORCE
67328 +%.o: KBUILD_CFLAGS += $(GCC_PLUGINS)
67329 +%.o: %.c gcc-plugins prepare scripts FORCE
67330 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
67331 %.lst: %.c prepare scripts FORCE
67332 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
67333 -%.s: %.S prepare scripts FORCE
67334 +%.s: %.S gcc-plugins prepare scripts FORCE
67335 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
67336 -%.o: %.S prepare scripts FORCE
67337 +%.o: %.S gcc-plugins prepare scripts FORCE
67338 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
67339 %.symtypes: %.c prepare scripts FORCE
67340 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
67341 @@ -1505,11 +1544,13 @@ endif
67342 $(cmd_crmodverdir)
67343 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
67344 $(build)=$(build-dir)
67345 -%/: prepare scripts FORCE
67346 +%/: KBUILD_CFLAGS += $(GCC_PLUGINS)
67347 +%/: gcc-plugins prepare scripts FORCE
67348 $(cmd_crmodverdir)
67349 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
67350 $(build)=$(build-dir)
67351 -%.ko: prepare scripts FORCE
67352 +%.ko: KBUILD_CFLAGS += $(GCC_PLUGINS)
67353 +%.ko: gcc-plugins prepare scripts FORCE
67354 $(cmd_crmodverdir)
67355 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
67356 $(build)=$(build-dir) $(@:.ko=.o)
67357 diff -urNp linux-3.0.9/mm/filemap.c linux-3.0.9/mm/filemap.c
67358 --- linux-3.0.9/mm/filemap.c 2011-11-11 13:12:24.000000000 -0500
67359 +++ linux-3.0.9/mm/filemap.c 2011-11-15 20:03:00.000000000 -0500
67360 @@ -1763,7 +1763,7 @@ int generic_file_mmap(struct file * file
67361 struct address_space *mapping = file->f_mapping;
67362
67363 if (!mapping->a_ops->readpage)
67364 - return -ENOEXEC;
67365 + return -ENODEV;
67366 file_accessed(file);
67367 vma->vm_ops = &generic_file_vm_ops;
67368 vma->vm_flags |= VM_CAN_NONLINEAR;
67369 @@ -2169,6 +2169,7 @@ inline int generic_write_checks(struct f
67370 *pos = i_size_read(inode);
67371
67372 if (limit != RLIM_INFINITY) {
67373 + gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
67374 if (*pos >= limit) {
67375 send_sig(SIGXFSZ, current, 0);
67376 return -EFBIG;
67377 diff -urNp linux-3.0.9/mm/fremap.c linux-3.0.9/mm/fremap.c
67378 --- linux-3.0.9/mm/fremap.c 2011-11-11 13:12:24.000000000 -0500
67379 +++ linux-3.0.9/mm/fremap.c 2011-11-15 20:03:00.000000000 -0500
67380 @@ -156,6 +156,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
67381 retry:
67382 vma = find_vma(mm, start);
67383
67384 +#ifdef CONFIG_PAX_SEGMEXEC
67385 + if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
67386 + goto out;
67387 +#endif
67388 +
67389 /*
67390 * Make sure the vma is shared, that it supports prefaulting,
67391 * and that the remapped range is valid and fully within
67392 diff -urNp linux-3.0.9/mm/highmem.c linux-3.0.9/mm/highmem.c
67393 --- linux-3.0.9/mm/highmem.c 2011-11-11 13:12:24.000000000 -0500
67394 +++ linux-3.0.9/mm/highmem.c 2011-11-15 20:03:00.000000000 -0500
67395 @@ -125,9 +125,10 @@ static void flush_all_zero_pkmaps(void)
67396 * So no dangers, even with speculative execution.
67397 */
67398 page = pte_page(pkmap_page_table[i]);
67399 + pax_open_kernel();
67400 pte_clear(&init_mm, (unsigned long)page_address(page),
67401 &pkmap_page_table[i]);
67402 -
67403 + pax_close_kernel();
67404 set_page_address(page, NULL);
67405 need_flush = 1;
67406 }
67407 @@ -186,9 +187,11 @@ start:
67408 }
67409 }
67410 vaddr = PKMAP_ADDR(last_pkmap_nr);
67411 +
67412 + pax_open_kernel();
67413 set_pte_at(&init_mm, vaddr,
67414 &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
67415 -
67416 + pax_close_kernel();
67417 pkmap_count[last_pkmap_nr] = 1;
67418 set_page_address(page, (void *)vaddr);
67419
67420 diff -urNp linux-3.0.9/mm/huge_memory.c linux-3.0.9/mm/huge_memory.c
67421 --- linux-3.0.9/mm/huge_memory.c 2011-11-11 13:12:24.000000000 -0500
67422 +++ linux-3.0.9/mm/huge_memory.c 2011-11-15 20:03:00.000000000 -0500
67423 @@ -702,7 +702,7 @@ out:
67424 * run pte_offset_map on the pmd, if an huge pmd could
67425 * materialize from under us from a different thread.
67426 */
67427 - if (unlikely(__pte_alloc(mm, vma, pmd, address)))
67428 + if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
67429 return VM_FAULT_OOM;
67430 /* if an huge pmd materialized from under us just retry later */
67431 if (unlikely(pmd_trans_huge(*pmd)))
67432 diff -urNp linux-3.0.9/mm/hugetlb.c linux-3.0.9/mm/hugetlb.c
67433 --- linux-3.0.9/mm/hugetlb.c 2011-11-11 13:12:24.000000000 -0500
67434 +++ linux-3.0.9/mm/hugetlb.c 2011-11-15 20:03:00.000000000 -0500
67435 @@ -2339,6 +2339,27 @@ static int unmap_ref_private(struct mm_s
67436 return 1;
67437 }
67438
67439 +#ifdef CONFIG_PAX_SEGMEXEC
67440 +static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
67441 +{
67442 + struct mm_struct *mm = vma->vm_mm;
67443 + struct vm_area_struct *vma_m;
67444 + unsigned long address_m;
67445 + pte_t *ptep_m;
67446 +
67447 + vma_m = pax_find_mirror_vma(vma);
67448 + if (!vma_m)
67449 + return;
67450 +
67451 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
67452 + address_m = address + SEGMEXEC_TASK_SIZE;
67453 + ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
67454 + get_page(page_m);
67455 + hugepage_add_anon_rmap(page_m, vma_m, address_m);
67456 + set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
67457 +}
67458 +#endif
67459 +
67460 /*
67461 * Hugetlb_cow() should be called with page lock of the original hugepage held.
67462 */
67463 @@ -2440,6 +2461,11 @@ retry_avoidcopy:
67464 make_huge_pte(vma, new_page, 1));
67465 page_remove_rmap(old_page);
67466 hugepage_add_new_anon_rmap(new_page, vma, address);
67467 +
67468 +#ifdef CONFIG_PAX_SEGMEXEC
67469 + pax_mirror_huge_pte(vma, address, new_page);
67470 +#endif
67471 +
67472 /* Make the old page be freed below */
67473 new_page = old_page;
67474 mmu_notifier_invalidate_range_end(mm,
67475 @@ -2591,6 +2617,10 @@ retry:
67476 && (vma->vm_flags & VM_SHARED)));
67477 set_huge_pte_at(mm, address, ptep, new_pte);
67478
67479 +#ifdef CONFIG_PAX_SEGMEXEC
67480 + pax_mirror_huge_pte(vma, address, page);
67481 +#endif
67482 +
67483 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
67484 /* Optimization, do the COW without a second fault */
67485 ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
67486 @@ -2620,6 +2650,10 @@ int hugetlb_fault(struct mm_struct *mm,
67487 static DEFINE_MUTEX(hugetlb_instantiation_mutex);
67488 struct hstate *h = hstate_vma(vma);
67489
67490 +#ifdef CONFIG_PAX_SEGMEXEC
67491 + struct vm_area_struct *vma_m;
67492 +#endif
67493 +
67494 ptep = huge_pte_offset(mm, address);
67495 if (ptep) {
67496 entry = huge_ptep_get(ptep);
67497 @@ -2631,6 +2665,26 @@ int hugetlb_fault(struct mm_struct *mm,
67498 VM_FAULT_SET_HINDEX(h - hstates);
67499 }
67500
67501 +#ifdef CONFIG_PAX_SEGMEXEC
67502 + vma_m = pax_find_mirror_vma(vma);
67503 + if (vma_m) {
67504 + unsigned long address_m;
67505 +
67506 + if (vma->vm_start > vma_m->vm_start) {
67507 + address_m = address;
67508 + address -= SEGMEXEC_TASK_SIZE;
67509 + vma = vma_m;
67510 + h = hstate_vma(vma);
67511 + } else
67512 + address_m = address + SEGMEXEC_TASK_SIZE;
67513 +
67514 + if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
67515 + return VM_FAULT_OOM;
67516 + address_m &= HPAGE_MASK;
67517 + unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
67518 + }
67519 +#endif
67520 +
67521 ptep = huge_pte_alloc(mm, address, huge_page_size(h));
67522 if (!ptep)
67523 return VM_FAULT_OOM;
67524 diff -urNp linux-3.0.9/mm/internal.h linux-3.0.9/mm/internal.h
67525 --- linux-3.0.9/mm/internal.h 2011-11-11 13:12:24.000000000 -0500
67526 +++ linux-3.0.9/mm/internal.h 2011-11-15 20:03:00.000000000 -0500
67527 @@ -95,6 +95,7 @@ extern void putback_lru_page(struct page
67528 * in mm/page_alloc.c
67529 */
67530 extern void __free_pages_bootmem(struct page *page, unsigned int order);
67531 +extern void free_compound_page(struct page *page);
67532 extern void prep_compound_page(struct page *page, unsigned long order);
67533 #ifdef CONFIG_MEMORY_FAILURE
67534 extern bool is_free_buddy_page(struct page *page);
67535 diff -urNp linux-3.0.9/mm/Kconfig linux-3.0.9/mm/Kconfig
67536 --- linux-3.0.9/mm/Kconfig 2011-11-11 13:12:24.000000000 -0500
67537 +++ linux-3.0.9/mm/Kconfig 2011-11-15 20:03:00.000000000 -0500
67538 @@ -240,7 +240,7 @@ config KSM
67539 config DEFAULT_MMAP_MIN_ADDR
67540 int "Low address space to protect from user allocation"
67541 depends on MMU
67542 - default 4096
67543 + default 65536
67544 help
67545 This is the portion of low virtual memory which should be protected
67546 from userspace allocation. Keeping a user from writing to low pages
67547 diff -urNp linux-3.0.9/mm/kmemleak.c linux-3.0.9/mm/kmemleak.c
67548 --- linux-3.0.9/mm/kmemleak.c 2011-11-11 13:12:24.000000000 -0500
67549 +++ linux-3.0.9/mm/kmemleak.c 2011-11-15 20:03:00.000000000 -0500
67550 @@ -357,7 +357,7 @@ static void print_unreferenced(struct se
67551
67552 for (i = 0; i < object->trace_len; i++) {
67553 void *ptr = (void *)object->trace[i];
67554 - seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
67555 + seq_printf(seq, " [<%p>] %pA\n", ptr, ptr);
67556 }
67557 }
67558
67559 diff -urNp linux-3.0.9/mm/maccess.c linux-3.0.9/mm/maccess.c
67560 --- linux-3.0.9/mm/maccess.c 2011-11-11 13:12:24.000000000 -0500
67561 +++ linux-3.0.9/mm/maccess.c 2011-11-15 20:03:00.000000000 -0500
67562 @@ -26,7 +26,7 @@ long __probe_kernel_read(void *dst, cons
67563 set_fs(KERNEL_DS);
67564 pagefault_disable();
67565 ret = __copy_from_user_inatomic(dst,
67566 - (__force const void __user *)src, size);
67567 + (const void __force_user *)src, size);
67568 pagefault_enable();
67569 set_fs(old_fs);
67570
67571 @@ -53,7 +53,7 @@ long __probe_kernel_write(void *dst, con
67572
67573 set_fs(KERNEL_DS);
67574 pagefault_disable();
67575 - ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
67576 + ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
67577 pagefault_enable();
67578 set_fs(old_fs);
67579
67580 diff -urNp linux-3.0.9/mm/madvise.c linux-3.0.9/mm/madvise.c
67581 --- linux-3.0.9/mm/madvise.c 2011-11-11 13:12:24.000000000 -0500
67582 +++ linux-3.0.9/mm/madvise.c 2011-11-15 20:03:00.000000000 -0500
67583 @@ -45,6 +45,10 @@ static long madvise_behavior(struct vm_a
67584 pgoff_t pgoff;
67585 unsigned long new_flags = vma->vm_flags;
67586
67587 +#ifdef CONFIG_PAX_SEGMEXEC
67588 + struct vm_area_struct *vma_m;
67589 +#endif
67590 +
67591 switch (behavior) {
67592 case MADV_NORMAL:
67593 new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
67594 @@ -110,6 +114,13 @@ success:
67595 /*
67596 * vm_flags is protected by the mmap_sem held in write mode.
67597 */
67598 +
67599 +#ifdef CONFIG_PAX_SEGMEXEC
67600 + vma_m = pax_find_mirror_vma(vma);
67601 + if (vma_m)
67602 + vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
67603 +#endif
67604 +
67605 vma->vm_flags = new_flags;
67606
67607 out:
67608 @@ -168,6 +179,11 @@ static long madvise_dontneed(struct vm_a
67609 struct vm_area_struct ** prev,
67610 unsigned long start, unsigned long end)
67611 {
67612 +
67613 +#ifdef CONFIG_PAX_SEGMEXEC
67614 + struct vm_area_struct *vma_m;
67615 +#endif
67616 +
67617 *prev = vma;
67618 if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
67619 return -EINVAL;
67620 @@ -180,6 +196,21 @@ static long madvise_dontneed(struct vm_a
67621 zap_page_range(vma, start, end - start, &details);
67622 } else
67623 zap_page_range(vma, start, end - start, NULL);
67624 +
67625 +#ifdef CONFIG_PAX_SEGMEXEC
67626 + vma_m = pax_find_mirror_vma(vma);
67627 + if (vma_m) {
67628 + if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
67629 + struct zap_details details = {
67630 + .nonlinear_vma = vma_m,
67631 + .last_index = ULONG_MAX,
67632 + };
67633 + zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
67634 + } else
67635 + zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
67636 + }
67637 +#endif
67638 +
67639 return 0;
67640 }
67641
67642 @@ -376,6 +407,16 @@ SYSCALL_DEFINE3(madvise, unsigned long,
67643 if (end < start)
67644 goto out;
67645
67646 +#ifdef CONFIG_PAX_SEGMEXEC
67647 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
67648 + if (end > SEGMEXEC_TASK_SIZE)
67649 + goto out;
67650 + } else
67651 +#endif
67652 +
67653 + if (end > TASK_SIZE)
67654 + goto out;
67655 +
67656 error = 0;
67657 if (end == start)
67658 goto out;
67659 diff -urNp linux-3.0.9/mm/memory.c linux-3.0.9/mm/memory.c
67660 --- linux-3.0.9/mm/memory.c 2011-11-11 13:12:24.000000000 -0500
67661 +++ linux-3.0.9/mm/memory.c 2011-11-15 20:03:00.000000000 -0500
67662 @@ -457,8 +457,12 @@ static inline void free_pmd_range(struct
67663 return;
67664
67665 pmd = pmd_offset(pud, start);
67666 +
67667 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
67668 pud_clear(pud);
67669 pmd_free_tlb(tlb, pmd, start);
67670 +#endif
67671 +
67672 }
67673
67674 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
67675 @@ -489,9 +493,12 @@ static inline void free_pud_range(struct
67676 if (end - 1 > ceiling - 1)
67677 return;
67678
67679 +#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
67680 pud = pud_offset(pgd, start);
67681 pgd_clear(pgd);
67682 pud_free_tlb(tlb, pud, start);
67683 +#endif
67684 +
67685 }
67686
67687 /*
67688 @@ -1577,12 +1584,6 @@ no_page_table:
67689 return page;
67690 }
67691
67692 -static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
67693 -{
67694 - return stack_guard_page_start(vma, addr) ||
67695 - stack_guard_page_end(vma, addr+PAGE_SIZE);
67696 -}
67697 -
67698 /**
67699 * __get_user_pages() - pin user pages in memory
67700 * @tsk: task_struct of target task
67701 @@ -1655,10 +1656,10 @@ int __get_user_pages(struct task_struct
67702 (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
67703 i = 0;
67704
67705 - do {
67706 + while (nr_pages) {
67707 struct vm_area_struct *vma;
67708
67709 - vma = find_extend_vma(mm, start);
67710 + vma = find_vma(mm, start);
67711 if (!vma && in_gate_area(mm, start)) {
67712 unsigned long pg = start & PAGE_MASK;
67713 pgd_t *pgd;
67714 @@ -1706,7 +1707,7 @@ int __get_user_pages(struct task_struct
67715 goto next_page;
67716 }
67717
67718 - if (!vma ||
67719 + if (!vma || start < vma->vm_start ||
67720 (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
67721 !(vm_flags & vma->vm_flags))
67722 return i ? : -EFAULT;
67723 @@ -1733,11 +1734,6 @@ int __get_user_pages(struct task_struct
67724 int ret;
67725 unsigned int fault_flags = 0;
67726
67727 - /* For mlock, just skip the stack guard page. */
67728 - if (foll_flags & FOLL_MLOCK) {
67729 - if (stack_guard_page(vma, start))
67730 - goto next_page;
67731 - }
67732 if (foll_flags & FOLL_WRITE)
67733 fault_flags |= FAULT_FLAG_WRITE;
67734 if (nonblocking)
67735 @@ -1811,7 +1807,7 @@ next_page:
67736 start += PAGE_SIZE;
67737 nr_pages--;
67738 } while (nr_pages && start < vma->vm_end);
67739 - } while (nr_pages);
67740 + }
67741 return i;
67742 }
67743 EXPORT_SYMBOL(__get_user_pages);
67744 @@ -2018,6 +2014,10 @@ static int insert_page(struct vm_area_st
67745 page_add_file_rmap(page);
67746 set_pte_at(mm, addr, pte, mk_pte(page, prot));
67747
67748 +#ifdef CONFIG_PAX_SEGMEXEC
67749 + pax_mirror_file_pte(vma, addr, page, ptl);
67750 +#endif
67751 +
67752 retval = 0;
67753 pte_unmap_unlock(pte, ptl);
67754 return retval;
67755 @@ -2052,10 +2052,22 @@ out:
67756 int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
67757 struct page *page)
67758 {
67759 +
67760 +#ifdef CONFIG_PAX_SEGMEXEC
67761 + struct vm_area_struct *vma_m;
67762 +#endif
67763 +
67764 if (addr < vma->vm_start || addr >= vma->vm_end)
67765 return -EFAULT;
67766 if (!page_count(page))
67767 return -EINVAL;
67768 +
67769 +#ifdef CONFIG_PAX_SEGMEXEC
67770 + vma_m = pax_find_mirror_vma(vma);
67771 + if (vma_m)
67772 + vma_m->vm_flags |= VM_INSERTPAGE;
67773 +#endif
67774 +
67775 vma->vm_flags |= VM_INSERTPAGE;
67776 return insert_page(vma, addr, page, vma->vm_page_prot);
67777 }
67778 @@ -2141,6 +2153,7 @@ int vm_insert_mixed(struct vm_area_struc
67779 unsigned long pfn)
67780 {
67781 BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
67782 + BUG_ON(vma->vm_mirror);
67783
67784 if (addr < vma->vm_start || addr >= vma->vm_end)
67785 return -EFAULT;
67786 @@ -2456,6 +2469,186 @@ static inline void cow_user_page(struct
67787 copy_user_highpage(dst, src, va, vma);
67788 }
67789
67790 +#ifdef CONFIG_PAX_SEGMEXEC
67791 +static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
67792 +{
67793 + struct mm_struct *mm = vma->vm_mm;
67794 + spinlock_t *ptl;
67795 + pte_t *pte, entry;
67796 +
67797 + pte = pte_offset_map_lock(mm, pmd, address, &ptl);
67798 + entry = *pte;
67799 + if (!pte_present(entry)) {
67800 + if (!pte_none(entry)) {
67801 + BUG_ON(pte_file(entry));
67802 + free_swap_and_cache(pte_to_swp_entry(entry));
67803 + pte_clear_not_present_full(mm, address, pte, 0);
67804 + }
67805 + } else {
67806 + struct page *page;
67807 +
67808 + flush_cache_page(vma, address, pte_pfn(entry));
67809 + entry = ptep_clear_flush(vma, address, pte);
67810 + BUG_ON(pte_dirty(entry));
67811 + page = vm_normal_page(vma, address, entry);
67812 + if (page) {
67813 + update_hiwater_rss(mm);
67814 + if (PageAnon(page))
67815 + dec_mm_counter_fast(mm, MM_ANONPAGES);
67816 + else
67817 + dec_mm_counter_fast(mm, MM_FILEPAGES);
67818 + page_remove_rmap(page);
67819 + page_cache_release(page);
67820 + }
67821 + }
67822 + pte_unmap_unlock(pte, ptl);
67823 +}
67824 +
67825 +/* PaX: if vma is mirrored, synchronize the mirror's PTE
67826 + *
67827 + * the ptl of the lower mapped page is held on entry and is not released on exit
67828 + * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
67829 + */
67830 +static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
67831 +{
67832 + struct mm_struct *mm = vma->vm_mm;
67833 + unsigned long address_m;
67834 + spinlock_t *ptl_m;
67835 + struct vm_area_struct *vma_m;
67836 + pmd_t *pmd_m;
67837 + pte_t *pte_m, entry_m;
67838 +
67839 + BUG_ON(!page_m || !PageAnon(page_m));
67840 +
67841 + vma_m = pax_find_mirror_vma(vma);
67842 + if (!vma_m)
67843 + return;
67844 +
67845 + BUG_ON(!PageLocked(page_m));
67846 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
67847 + address_m = address + SEGMEXEC_TASK_SIZE;
67848 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
67849 + pte_m = pte_offset_map(pmd_m, address_m);
67850 + ptl_m = pte_lockptr(mm, pmd_m);
67851 + if (ptl != ptl_m) {
67852 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
67853 + if (!pte_none(*pte_m))
67854 + goto out;
67855 + }
67856 +
67857 + entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
67858 + page_cache_get(page_m);
67859 + page_add_anon_rmap(page_m, vma_m, address_m);
67860 + inc_mm_counter_fast(mm, MM_ANONPAGES);
67861 + set_pte_at(mm, address_m, pte_m, entry_m);
67862 + update_mmu_cache(vma_m, address_m, entry_m);
67863 +out:
67864 + if (ptl != ptl_m)
67865 + spin_unlock(ptl_m);
67866 + pte_unmap(pte_m);
67867 + unlock_page(page_m);
67868 +}
67869 +
67870 +void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
67871 +{
67872 + struct mm_struct *mm = vma->vm_mm;
67873 + unsigned long address_m;
67874 + spinlock_t *ptl_m;
67875 + struct vm_area_struct *vma_m;
67876 + pmd_t *pmd_m;
67877 + pte_t *pte_m, entry_m;
67878 +
67879 + BUG_ON(!page_m || PageAnon(page_m));
67880 +
67881 + vma_m = pax_find_mirror_vma(vma);
67882 + if (!vma_m)
67883 + return;
67884 +
67885 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
67886 + address_m = address + SEGMEXEC_TASK_SIZE;
67887 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
67888 + pte_m = pte_offset_map(pmd_m, address_m);
67889 + ptl_m = pte_lockptr(mm, pmd_m);
67890 + if (ptl != ptl_m) {
67891 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
67892 + if (!pte_none(*pte_m))
67893 + goto out;
67894 + }
67895 +
67896 + entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
67897 + page_cache_get(page_m);
67898 + page_add_file_rmap(page_m);
67899 + inc_mm_counter_fast(mm, MM_FILEPAGES);
67900 + set_pte_at(mm, address_m, pte_m, entry_m);
67901 + update_mmu_cache(vma_m, address_m, entry_m);
67902 +out:
67903 + if (ptl != ptl_m)
67904 + spin_unlock(ptl_m);
67905 + pte_unmap(pte_m);
67906 +}
67907 +
67908 +static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
67909 +{
67910 + struct mm_struct *mm = vma->vm_mm;
67911 + unsigned long address_m;
67912 + spinlock_t *ptl_m;
67913 + struct vm_area_struct *vma_m;
67914 + pmd_t *pmd_m;
67915 + pte_t *pte_m, entry_m;
67916 +
67917 + vma_m = pax_find_mirror_vma(vma);
67918 + if (!vma_m)
67919 + return;
67920 +
67921 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
67922 + address_m = address + SEGMEXEC_TASK_SIZE;
67923 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
67924 + pte_m = pte_offset_map(pmd_m, address_m);
67925 + ptl_m = pte_lockptr(mm, pmd_m);
67926 + if (ptl != ptl_m) {
67927 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
67928 + if (!pte_none(*pte_m))
67929 + goto out;
67930 + }
67931 +
67932 + entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
67933 + set_pte_at(mm, address_m, pte_m, entry_m);
67934 +out:
67935 + if (ptl != ptl_m)
67936 + spin_unlock(ptl_m);
67937 + pte_unmap(pte_m);
67938 +}
67939 +
67940 +static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
67941 +{
67942 + struct page *page_m;
67943 + pte_t entry;
67944 +
67945 + if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
67946 + goto out;
67947 +
67948 + entry = *pte;
67949 + page_m = vm_normal_page(vma, address, entry);
67950 + if (!page_m)
67951 + pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
67952 + else if (PageAnon(page_m)) {
67953 + if (pax_find_mirror_vma(vma)) {
67954 + pte_unmap_unlock(pte, ptl);
67955 + lock_page(page_m);
67956 + pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
67957 + if (pte_same(entry, *pte))
67958 + pax_mirror_anon_pte(vma, address, page_m, ptl);
67959 + else
67960 + unlock_page(page_m);
67961 + }
67962 + } else
67963 + pax_mirror_file_pte(vma, address, page_m, ptl);
67964 +
67965 +out:
67966 + pte_unmap_unlock(pte, ptl);
67967 +}
67968 +#endif
67969 +
67970 /*
67971 * This routine handles present pages, when users try to write
67972 * to a shared page. It is done by copying the page to a new address
67973 @@ -2667,6 +2860,12 @@ gotten:
67974 */
67975 page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
67976 if (likely(pte_same(*page_table, orig_pte))) {
67977 +
67978 +#ifdef CONFIG_PAX_SEGMEXEC
67979 + if (pax_find_mirror_vma(vma))
67980 + BUG_ON(!trylock_page(new_page));
67981 +#endif
67982 +
67983 if (old_page) {
67984 if (!PageAnon(old_page)) {
67985 dec_mm_counter_fast(mm, MM_FILEPAGES);
67986 @@ -2718,6 +2917,10 @@ gotten:
67987 page_remove_rmap(old_page);
67988 }
67989
67990 +#ifdef CONFIG_PAX_SEGMEXEC
67991 + pax_mirror_anon_pte(vma, address, new_page, ptl);
67992 +#endif
67993 +
67994 /* Free the old page.. */
67995 new_page = old_page;
67996 ret |= VM_FAULT_WRITE;
67997 @@ -2997,6 +3200,11 @@ static int do_swap_page(struct mm_struct
67998 swap_free(entry);
67999 if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
68000 try_to_free_swap(page);
68001 +
68002 +#ifdef CONFIG_PAX_SEGMEXEC
68003 + if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
68004 +#endif
68005 +
68006 unlock_page(page);
68007 if (swapcache) {
68008 /*
68009 @@ -3020,6 +3228,11 @@ static int do_swap_page(struct mm_struct
68010
68011 /* No need to invalidate - it was non-present before */
68012 update_mmu_cache(vma, address, page_table);
68013 +
68014 +#ifdef CONFIG_PAX_SEGMEXEC
68015 + pax_mirror_anon_pte(vma, address, page, ptl);
68016 +#endif
68017 +
68018 unlock:
68019 pte_unmap_unlock(page_table, ptl);
68020 out:
68021 @@ -3039,40 +3252,6 @@ out_release:
68022 }
68023
68024 /*
68025 - * This is like a special single-page "expand_{down|up}wards()",
68026 - * except we must first make sure that 'address{-|+}PAGE_SIZE'
68027 - * doesn't hit another vma.
68028 - */
68029 -static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
68030 -{
68031 - address &= PAGE_MASK;
68032 - if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
68033 - struct vm_area_struct *prev = vma->vm_prev;
68034 -
68035 - /*
68036 - * Is there a mapping abutting this one below?
68037 - *
68038 - * That's only ok if it's the same stack mapping
68039 - * that has gotten split..
68040 - */
68041 - if (prev && prev->vm_end == address)
68042 - return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
68043 -
68044 - expand_downwards(vma, address - PAGE_SIZE);
68045 - }
68046 - if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
68047 - struct vm_area_struct *next = vma->vm_next;
68048 -
68049 - /* As VM_GROWSDOWN but s/below/above/ */
68050 - if (next && next->vm_start == address + PAGE_SIZE)
68051 - return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
68052 -
68053 - expand_upwards(vma, address + PAGE_SIZE);
68054 - }
68055 - return 0;
68056 -}
68057 -
68058 -/*
68059 * We enter with non-exclusive mmap_sem (to exclude vma changes,
68060 * but allow concurrent faults), and pte mapped but not yet locked.
68061 * We return with mmap_sem still held, but pte unmapped and unlocked.
68062 @@ -3081,27 +3260,23 @@ static int do_anonymous_page(struct mm_s
68063 unsigned long address, pte_t *page_table, pmd_t *pmd,
68064 unsigned int flags)
68065 {
68066 - struct page *page;
68067 + struct page *page = NULL;
68068 spinlock_t *ptl;
68069 pte_t entry;
68070
68071 - pte_unmap(page_table);
68072 -
68073 - /* Check if we need to add a guard page to the stack */
68074 - if (check_stack_guard_page(vma, address) < 0)
68075 - return VM_FAULT_SIGBUS;
68076 -
68077 - /* Use the zero-page for reads */
68078 if (!(flags & FAULT_FLAG_WRITE)) {
68079 entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
68080 vma->vm_page_prot));
68081 - page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
68082 + ptl = pte_lockptr(mm, pmd);
68083 + spin_lock(ptl);
68084 if (!pte_none(*page_table))
68085 goto unlock;
68086 goto setpte;
68087 }
68088
68089 /* Allocate our own private page. */
68090 + pte_unmap(page_table);
68091 +
68092 if (unlikely(anon_vma_prepare(vma)))
68093 goto oom;
68094 page = alloc_zeroed_user_highpage_movable(vma, address);
68095 @@ -3120,6 +3295,11 @@ static int do_anonymous_page(struct mm_s
68096 if (!pte_none(*page_table))
68097 goto release;
68098
68099 +#ifdef CONFIG_PAX_SEGMEXEC
68100 + if (pax_find_mirror_vma(vma))
68101 + BUG_ON(!trylock_page(page));
68102 +#endif
68103 +
68104 inc_mm_counter_fast(mm, MM_ANONPAGES);
68105 page_add_new_anon_rmap(page, vma, address);
68106 setpte:
68107 @@ -3127,6 +3307,12 @@ setpte:
68108
68109 /* No need to invalidate - it was non-present before */
68110 update_mmu_cache(vma, address, page_table);
68111 +
68112 +#ifdef CONFIG_PAX_SEGMEXEC
68113 + if (page)
68114 + pax_mirror_anon_pte(vma, address, page, ptl);
68115 +#endif
68116 +
68117 unlock:
68118 pte_unmap_unlock(page_table, ptl);
68119 return 0;
68120 @@ -3264,6 +3450,12 @@ static int __do_fault(struct mm_struct *
68121 */
68122 /* Only go through if we didn't race with anybody else... */
68123 if (likely(pte_same(*page_table, orig_pte))) {
68124 +
68125 +#ifdef CONFIG_PAX_SEGMEXEC
68126 + if (anon && pax_find_mirror_vma(vma))
68127 + BUG_ON(!trylock_page(page));
68128 +#endif
68129 +
68130 flush_icache_page(vma, page);
68131 entry = mk_pte(page, vma->vm_page_prot);
68132 if (flags & FAULT_FLAG_WRITE)
68133 @@ -3283,6 +3475,14 @@ static int __do_fault(struct mm_struct *
68134
68135 /* no need to invalidate: a not-present page won't be cached */
68136 update_mmu_cache(vma, address, page_table);
68137 +
68138 +#ifdef CONFIG_PAX_SEGMEXEC
68139 + if (anon)
68140 + pax_mirror_anon_pte(vma, address, page, ptl);
68141 + else
68142 + pax_mirror_file_pte(vma, address, page, ptl);
68143 +#endif
68144 +
68145 } else {
68146 if (charged)
68147 mem_cgroup_uncharge_page(page);
68148 @@ -3430,6 +3630,12 @@ int handle_pte_fault(struct mm_struct *m
68149 if (flags & FAULT_FLAG_WRITE)
68150 flush_tlb_fix_spurious_fault(vma, address);
68151 }
68152 +
68153 +#ifdef CONFIG_PAX_SEGMEXEC
68154 + pax_mirror_pte(vma, address, pte, pmd, ptl);
68155 + return 0;
68156 +#endif
68157 +
68158 unlock:
68159 pte_unmap_unlock(pte, ptl);
68160 return 0;
68161 @@ -3446,6 +3652,10 @@ int handle_mm_fault(struct mm_struct *mm
68162 pmd_t *pmd;
68163 pte_t *pte;
68164
68165 +#ifdef CONFIG_PAX_SEGMEXEC
68166 + struct vm_area_struct *vma_m;
68167 +#endif
68168 +
68169 __set_current_state(TASK_RUNNING);
68170
68171 count_vm_event(PGFAULT);
68172 @@ -3457,6 +3667,34 @@ int handle_mm_fault(struct mm_struct *mm
68173 if (unlikely(is_vm_hugetlb_page(vma)))
68174 return hugetlb_fault(mm, vma, address, flags);
68175
68176 +#ifdef CONFIG_PAX_SEGMEXEC
68177 + vma_m = pax_find_mirror_vma(vma);
68178 + if (vma_m) {
68179 + unsigned long address_m;
68180 + pgd_t *pgd_m;
68181 + pud_t *pud_m;
68182 + pmd_t *pmd_m;
68183 +
68184 + if (vma->vm_start > vma_m->vm_start) {
68185 + address_m = address;
68186 + address -= SEGMEXEC_TASK_SIZE;
68187 + vma = vma_m;
68188 + } else
68189 + address_m = address + SEGMEXEC_TASK_SIZE;
68190 +
68191 + pgd_m = pgd_offset(mm, address_m);
68192 + pud_m = pud_alloc(mm, pgd_m, address_m);
68193 + if (!pud_m)
68194 + return VM_FAULT_OOM;
68195 + pmd_m = pmd_alloc(mm, pud_m, address_m);
68196 + if (!pmd_m)
68197 + return VM_FAULT_OOM;
68198 + if (!pmd_present(*pmd_m) && __pte_alloc(mm, vma_m, pmd_m, address_m))
68199 + return VM_FAULT_OOM;
68200 + pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
68201 + }
68202 +#endif
68203 +
68204 pgd = pgd_offset(mm, address);
68205 pud = pud_alloc(mm, pgd, address);
68206 if (!pud)
68207 @@ -3486,7 +3724,7 @@ int handle_mm_fault(struct mm_struct *mm
68208 * run pte_offset_map on the pmd, if an huge pmd could
68209 * materialize from under us from a different thread.
68210 */
68211 - if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
68212 + if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
68213 return VM_FAULT_OOM;
68214 /* if an huge pmd materialized from under us just retry later */
68215 if (unlikely(pmd_trans_huge(*pmd)))
68216 @@ -3590,7 +3828,7 @@ static int __init gate_vma_init(void)
68217 gate_vma.vm_start = FIXADDR_USER_START;
68218 gate_vma.vm_end = FIXADDR_USER_END;
68219 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
68220 - gate_vma.vm_page_prot = __P101;
68221 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
68222 /*
68223 * Make sure the vDSO gets into every core dump.
68224 * Dumping its contents makes post-mortem fully interpretable later
68225 diff -urNp linux-3.0.9/mm/memory-failure.c linux-3.0.9/mm/memory-failure.c
68226 --- linux-3.0.9/mm/memory-failure.c 2011-11-11 13:12:24.000000000 -0500
68227 +++ linux-3.0.9/mm/memory-failure.c 2011-11-15 20:03:00.000000000 -0500
68228 @@ -59,7 +59,7 @@ int sysctl_memory_failure_early_kill __r
68229
68230 int sysctl_memory_failure_recovery __read_mostly = 1;
68231
68232 -atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
68233 +atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
68234
68235 #if defined(CONFIG_HWPOISON_INJECT) || defined(CONFIG_HWPOISON_INJECT_MODULE)
68236
68237 @@ -200,7 +200,7 @@ static int kill_proc_ao(struct task_stru
68238 si.si_signo = SIGBUS;
68239 si.si_errno = 0;
68240 si.si_code = BUS_MCEERR_AO;
68241 - si.si_addr = (void *)addr;
68242 + si.si_addr = (void __user *)addr;
68243 #ifdef __ARCH_SI_TRAPNO
68244 si.si_trapno = trapno;
68245 #endif
68246 @@ -1008,7 +1008,7 @@ int __memory_failure(unsigned long pfn,
68247 }
68248
68249 nr_pages = 1 << compound_trans_order(hpage);
68250 - atomic_long_add(nr_pages, &mce_bad_pages);
68251 + atomic_long_add_unchecked(nr_pages, &mce_bad_pages);
68252
68253 /*
68254 * We need/can do nothing about count=0 pages.
68255 @@ -1038,7 +1038,7 @@ int __memory_failure(unsigned long pfn,
68256 if (!PageHWPoison(hpage)
68257 || (hwpoison_filter(p) && TestClearPageHWPoison(p))
68258 || (p != hpage && TestSetPageHWPoison(hpage))) {
68259 - atomic_long_sub(nr_pages, &mce_bad_pages);
68260 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
68261 return 0;
68262 }
68263 set_page_hwpoison_huge_page(hpage);
68264 @@ -1096,7 +1096,7 @@ int __memory_failure(unsigned long pfn,
68265 }
68266 if (hwpoison_filter(p)) {
68267 if (TestClearPageHWPoison(p))
68268 - atomic_long_sub(nr_pages, &mce_bad_pages);
68269 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
68270 unlock_page(hpage);
68271 put_page(hpage);
68272 return 0;
68273 @@ -1222,7 +1222,7 @@ int unpoison_memory(unsigned long pfn)
68274 return 0;
68275 }
68276 if (TestClearPageHWPoison(p))
68277 - atomic_long_sub(nr_pages, &mce_bad_pages);
68278 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
68279 pr_info("MCE: Software-unpoisoned free page %#lx\n", pfn);
68280 return 0;
68281 }
68282 @@ -1236,7 +1236,7 @@ int unpoison_memory(unsigned long pfn)
68283 */
68284 if (TestClearPageHWPoison(page)) {
68285 pr_info("MCE: Software-unpoisoned page %#lx\n", pfn);
68286 - atomic_long_sub(nr_pages, &mce_bad_pages);
68287 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
68288 freeit = 1;
68289 if (PageHuge(page))
68290 clear_page_hwpoison_huge_page(page);
68291 @@ -1349,7 +1349,7 @@ static int soft_offline_huge_page(struct
68292 }
68293 done:
68294 if (!PageHWPoison(hpage))
68295 - atomic_long_add(1 << compound_trans_order(hpage), &mce_bad_pages);
68296 + atomic_long_add_unchecked(1 << compound_trans_order(hpage), &mce_bad_pages);
68297 set_page_hwpoison_huge_page(hpage);
68298 dequeue_hwpoisoned_huge_page(hpage);
68299 /* keep elevated page count for bad page */
68300 @@ -1480,7 +1480,7 @@ int soft_offline_page(struct page *page,
68301 return ret;
68302
68303 done:
68304 - atomic_long_add(1, &mce_bad_pages);
68305 + atomic_long_add_unchecked(1, &mce_bad_pages);
68306 SetPageHWPoison(page);
68307 /* keep elevated page count for bad page */
68308 return ret;
68309 diff -urNp linux-3.0.9/mm/mempolicy.c linux-3.0.9/mm/mempolicy.c
68310 --- linux-3.0.9/mm/mempolicy.c 2011-11-11 13:12:24.000000000 -0500
68311 +++ linux-3.0.9/mm/mempolicy.c 2011-11-15 20:03:00.000000000 -0500
68312 @@ -639,6 +639,10 @@ static int mbind_range(struct mm_struct
68313 unsigned long vmstart;
68314 unsigned long vmend;
68315
68316 +#ifdef CONFIG_PAX_SEGMEXEC
68317 + struct vm_area_struct *vma_m;
68318 +#endif
68319 +
68320 vma = find_vma_prev(mm, start, &prev);
68321 if (!vma || vma->vm_start > start)
68322 return -EFAULT;
68323 @@ -669,6 +673,16 @@ static int mbind_range(struct mm_struct
68324 err = policy_vma(vma, new_pol);
68325 if (err)
68326 goto out;
68327 +
68328 +#ifdef CONFIG_PAX_SEGMEXEC
68329 + vma_m = pax_find_mirror_vma(vma);
68330 + if (vma_m) {
68331 + err = policy_vma(vma_m, new_pol);
68332 + if (err)
68333 + goto out;
68334 + }
68335 +#endif
68336 +
68337 }
68338
68339 out:
68340 @@ -1102,6 +1116,17 @@ static long do_mbind(unsigned long start
68341
68342 if (end < start)
68343 return -EINVAL;
68344 +
68345 +#ifdef CONFIG_PAX_SEGMEXEC
68346 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
68347 + if (end > SEGMEXEC_TASK_SIZE)
68348 + return -EINVAL;
68349 + } else
68350 +#endif
68351 +
68352 + if (end > TASK_SIZE)
68353 + return -EINVAL;
68354 +
68355 if (end == start)
68356 return 0;
68357
68358 @@ -1320,6 +1345,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
68359 if (!mm)
68360 goto out;
68361
68362 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
68363 + if (mm != current->mm &&
68364 + (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
68365 + err = -EPERM;
68366 + goto out;
68367 + }
68368 +#endif
68369 +
68370 /*
68371 * Check if this process has the right to modify the specified
68372 * process. The right exists if the process has administrative
68373 @@ -1329,8 +1362,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
68374 rcu_read_lock();
68375 tcred = __task_cred(task);
68376 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
68377 - cred->uid != tcred->suid && cred->uid != tcred->uid &&
68378 - !capable(CAP_SYS_NICE)) {
68379 + cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
68380 rcu_read_unlock();
68381 err = -EPERM;
68382 goto out;
68383 diff -urNp linux-3.0.9/mm/migrate.c linux-3.0.9/mm/migrate.c
68384 --- linux-3.0.9/mm/migrate.c 2011-11-11 13:12:24.000000000 -0500
68385 +++ linux-3.0.9/mm/migrate.c 2011-11-15 20:03:00.000000000 -0500
68386 @@ -1124,6 +1124,8 @@ static int do_pages_move(struct mm_struc
68387 unsigned long chunk_start;
68388 int err;
68389
68390 + pax_track_stack();
68391 +
68392 task_nodes = cpuset_mems_allowed(task);
68393
68394 err = -ENOMEM;
68395 @@ -1308,6 +1310,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
68396 if (!mm)
68397 return -EINVAL;
68398
68399 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
68400 + if (mm != current->mm &&
68401 + (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
68402 + err = -EPERM;
68403 + goto out;
68404 + }
68405 +#endif
68406 +
68407 /*
68408 * Check if this process has the right to modify the specified
68409 * process. The right exists if the process has administrative
68410 @@ -1317,8 +1327,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
68411 rcu_read_lock();
68412 tcred = __task_cred(task);
68413 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
68414 - cred->uid != tcred->suid && cred->uid != tcred->uid &&
68415 - !capable(CAP_SYS_NICE)) {
68416 + cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
68417 rcu_read_unlock();
68418 err = -EPERM;
68419 goto out;
68420 diff -urNp linux-3.0.9/mm/mlock.c linux-3.0.9/mm/mlock.c
68421 --- linux-3.0.9/mm/mlock.c 2011-11-11 13:12:24.000000000 -0500
68422 +++ linux-3.0.9/mm/mlock.c 2011-11-15 20:03:00.000000000 -0500
68423 @@ -13,6 +13,7 @@
68424 #include <linux/pagemap.h>
68425 #include <linux/mempolicy.h>
68426 #include <linux/syscalls.h>
68427 +#include <linux/security.h>
68428 #include <linux/sched.h>
68429 #include <linux/module.h>
68430 #include <linux/rmap.h>
68431 @@ -377,6 +378,9 @@ static int do_mlock(unsigned long start,
68432 return -EINVAL;
68433 if (end == start)
68434 return 0;
68435 + if (end > TASK_SIZE)
68436 + return -EINVAL;
68437 +
68438 vma = find_vma_prev(current->mm, start, &prev);
68439 if (!vma || vma->vm_start > start)
68440 return -ENOMEM;
68441 @@ -387,6 +391,11 @@ static int do_mlock(unsigned long start,
68442 for (nstart = start ; ; ) {
68443 vm_flags_t newflags;
68444
68445 +#ifdef CONFIG_PAX_SEGMEXEC
68446 + if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
68447 + break;
68448 +#endif
68449 +
68450 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
68451
68452 newflags = vma->vm_flags | VM_LOCKED;
68453 @@ -492,6 +501,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
68454 lock_limit >>= PAGE_SHIFT;
68455
68456 /* check against resource limits */
68457 + gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
68458 if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
68459 error = do_mlock(start, len, 1);
68460 up_write(&current->mm->mmap_sem);
68461 @@ -515,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long,
68462 static int do_mlockall(int flags)
68463 {
68464 struct vm_area_struct * vma, * prev = NULL;
68465 - unsigned int def_flags = 0;
68466
68467 if (flags & MCL_FUTURE)
68468 - def_flags = VM_LOCKED;
68469 - current->mm->def_flags = def_flags;
68470 + current->mm->def_flags |= VM_LOCKED;
68471 + else
68472 + current->mm->def_flags &= ~VM_LOCKED;
68473 if (flags == MCL_FUTURE)
68474 goto out;
68475
68476 for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
68477 vm_flags_t newflags;
68478
68479 +#ifdef CONFIG_PAX_SEGMEXEC
68480 + if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
68481 + break;
68482 +#endif
68483 +
68484 + BUG_ON(vma->vm_end > TASK_SIZE);
68485 newflags = vma->vm_flags | VM_LOCKED;
68486 if (!(flags & MCL_CURRENT))
68487 newflags &= ~VM_LOCKED;
68488 @@ -557,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
68489 lock_limit >>= PAGE_SHIFT;
68490
68491 ret = -ENOMEM;
68492 + gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
68493 if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
68494 capable(CAP_IPC_LOCK))
68495 ret = do_mlockall(flags);
68496 diff -urNp linux-3.0.9/mm/mmap.c linux-3.0.9/mm/mmap.c
68497 --- linux-3.0.9/mm/mmap.c 2011-11-11 13:12:24.000000000 -0500
68498 +++ linux-3.0.9/mm/mmap.c 2011-11-15 20:03:00.000000000 -0500
68499 @@ -46,6 +46,16 @@
68500 #define arch_rebalance_pgtables(addr, len) (addr)
68501 #endif
68502
68503 +static inline void verify_mm_writelocked(struct mm_struct *mm)
68504 +{
68505 +#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
68506 + if (unlikely(down_read_trylock(&mm->mmap_sem))) {
68507 + up_read(&mm->mmap_sem);
68508 + BUG();
68509 + }
68510 +#endif
68511 +}
68512 +
68513 static void unmap_region(struct mm_struct *mm,
68514 struct vm_area_struct *vma, struct vm_area_struct *prev,
68515 unsigned long start, unsigned long end);
68516 @@ -71,22 +81,32 @@ static void unmap_region(struct mm_struc
68517 * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
68518 *
68519 */
68520 -pgprot_t protection_map[16] = {
68521 +pgprot_t protection_map[16] __read_only = {
68522 __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
68523 __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
68524 };
68525
68526 -pgprot_t vm_get_page_prot(unsigned long vm_flags)
68527 +pgprot_t vm_get_page_prot(vm_flags_t vm_flags)
68528 {
68529 - return __pgprot(pgprot_val(protection_map[vm_flags &
68530 + pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
68531 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
68532 pgprot_val(arch_vm_get_page_prot(vm_flags)));
68533 +
68534 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
68535 + if (!(__supported_pte_mask & _PAGE_NX) &&
68536 + (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
68537 + (vm_flags & (VM_READ | VM_WRITE)))
68538 + prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
68539 +#endif
68540 +
68541 + return prot;
68542 }
68543 EXPORT_SYMBOL(vm_get_page_prot);
68544
68545 int sysctl_overcommit_memory __read_mostly = OVERCOMMIT_GUESS; /* heuristic overcommit */
68546 int sysctl_overcommit_ratio __read_mostly = 50; /* default is 50% */
68547 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
68548 +unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
68549 /*
68550 * Make sure vm_committed_as in one cacheline and not cacheline shared with
68551 * other variables. It can be updated by several CPUs frequently.
68552 @@ -236,6 +256,7 @@ static struct vm_area_struct *remove_vma
68553 struct vm_area_struct *next = vma->vm_next;
68554
68555 might_sleep();
68556 + BUG_ON(vma->vm_mirror);
68557 if (vma->vm_ops && vma->vm_ops->close)
68558 vma->vm_ops->close(vma);
68559 if (vma->vm_file) {
68560 @@ -280,6 +301,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
68561 * not page aligned -Ram Gupta
68562 */
68563 rlim = rlimit(RLIMIT_DATA);
68564 + gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
68565 if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
68566 (mm->end_data - mm->start_data) > rlim)
68567 goto out;
68568 @@ -697,6 +719,12 @@ static int
68569 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
68570 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
68571 {
68572 +
68573 +#ifdef CONFIG_PAX_SEGMEXEC
68574 + if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
68575 + return 0;
68576 +#endif
68577 +
68578 if (is_mergeable_vma(vma, file, vm_flags) &&
68579 is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
68580 if (vma->vm_pgoff == vm_pgoff)
68581 @@ -716,6 +744,12 @@ static int
68582 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
68583 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
68584 {
68585 +
68586 +#ifdef CONFIG_PAX_SEGMEXEC
68587 + if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
68588 + return 0;
68589 +#endif
68590 +
68591 if (is_mergeable_vma(vma, file, vm_flags) &&
68592 is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
68593 pgoff_t vm_pglen;
68594 @@ -758,13 +792,20 @@ can_vma_merge_after(struct vm_area_struc
68595 struct vm_area_struct *vma_merge(struct mm_struct *mm,
68596 struct vm_area_struct *prev, unsigned long addr,
68597 unsigned long end, unsigned long vm_flags,
68598 - struct anon_vma *anon_vma, struct file *file,
68599 + struct anon_vma *anon_vma, struct file *file,
68600 pgoff_t pgoff, struct mempolicy *policy)
68601 {
68602 pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
68603 struct vm_area_struct *area, *next;
68604 int err;
68605
68606 +#ifdef CONFIG_PAX_SEGMEXEC
68607 + unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
68608 + struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
68609 +
68610 + BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
68611 +#endif
68612 +
68613 /*
68614 * We later require that vma->vm_flags == vm_flags,
68615 * so this tests vma->vm_flags & VM_SPECIAL, too.
68616 @@ -780,6 +821,15 @@ struct vm_area_struct *vma_merge(struct
68617 if (next && next->vm_end == end) /* cases 6, 7, 8 */
68618 next = next->vm_next;
68619
68620 +#ifdef CONFIG_PAX_SEGMEXEC
68621 + if (prev)
68622 + prev_m = pax_find_mirror_vma(prev);
68623 + if (area)
68624 + area_m = pax_find_mirror_vma(area);
68625 + if (next)
68626 + next_m = pax_find_mirror_vma(next);
68627 +#endif
68628 +
68629 /*
68630 * Can it merge with the predecessor?
68631 */
68632 @@ -799,9 +849,24 @@ struct vm_area_struct *vma_merge(struct
68633 /* cases 1, 6 */
68634 err = vma_adjust(prev, prev->vm_start,
68635 next->vm_end, prev->vm_pgoff, NULL);
68636 - } else /* cases 2, 5, 7 */
68637 +
68638 +#ifdef CONFIG_PAX_SEGMEXEC
68639 + if (!err && prev_m)
68640 + err = vma_adjust(prev_m, prev_m->vm_start,
68641 + next_m->vm_end, prev_m->vm_pgoff, NULL);
68642 +#endif
68643 +
68644 + } else { /* cases 2, 5, 7 */
68645 err = vma_adjust(prev, prev->vm_start,
68646 end, prev->vm_pgoff, NULL);
68647 +
68648 +#ifdef CONFIG_PAX_SEGMEXEC
68649 + if (!err && prev_m)
68650 + err = vma_adjust(prev_m, prev_m->vm_start,
68651 + end_m, prev_m->vm_pgoff, NULL);
68652 +#endif
68653 +
68654 + }
68655 if (err)
68656 return NULL;
68657 khugepaged_enter_vma_merge(prev);
68658 @@ -815,12 +880,27 @@ struct vm_area_struct *vma_merge(struct
68659 mpol_equal(policy, vma_policy(next)) &&
68660 can_vma_merge_before(next, vm_flags,
68661 anon_vma, file, pgoff+pglen)) {
68662 - if (prev && addr < prev->vm_end) /* case 4 */
68663 + if (prev && addr < prev->vm_end) { /* case 4 */
68664 err = vma_adjust(prev, prev->vm_start,
68665 addr, prev->vm_pgoff, NULL);
68666 - else /* cases 3, 8 */
68667 +
68668 +#ifdef CONFIG_PAX_SEGMEXEC
68669 + if (!err && prev_m)
68670 + err = vma_adjust(prev_m, prev_m->vm_start,
68671 + addr_m, prev_m->vm_pgoff, NULL);
68672 +#endif
68673 +
68674 + } else { /* cases 3, 8 */
68675 err = vma_adjust(area, addr, next->vm_end,
68676 next->vm_pgoff - pglen, NULL);
68677 +
68678 +#ifdef CONFIG_PAX_SEGMEXEC
68679 + if (!err && area_m)
68680 + err = vma_adjust(area_m, addr_m, next_m->vm_end,
68681 + next_m->vm_pgoff - pglen, NULL);
68682 +#endif
68683 +
68684 + }
68685 if (err)
68686 return NULL;
68687 khugepaged_enter_vma_merge(area);
68688 @@ -929,14 +1009,11 @@ none:
68689 void vm_stat_account(struct mm_struct *mm, unsigned long flags,
68690 struct file *file, long pages)
68691 {
68692 - const unsigned long stack_flags
68693 - = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
68694 -
68695 if (file) {
68696 mm->shared_vm += pages;
68697 if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
68698 mm->exec_vm += pages;
68699 - } else if (flags & stack_flags)
68700 + } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
68701 mm->stack_vm += pages;
68702 if (flags & (VM_RESERVED|VM_IO))
68703 mm->reserved_vm += pages;
68704 @@ -963,7 +1040,7 @@ unsigned long do_mmap_pgoff(struct file
68705 * (the exception is when the underlying filesystem is noexec
68706 * mounted, in which case we dont add PROT_EXEC.)
68707 */
68708 - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
68709 + if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
68710 if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
68711 prot |= PROT_EXEC;
68712
68713 @@ -989,7 +1066,7 @@ unsigned long do_mmap_pgoff(struct file
68714 /* Obtain the address to map to. we verify (or select) it and ensure
68715 * that it represents a valid section of the address space.
68716 */
68717 - addr = get_unmapped_area(file, addr, len, pgoff, flags);
68718 + addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
68719 if (addr & ~PAGE_MASK)
68720 return addr;
68721
68722 @@ -1000,6 +1077,36 @@ unsigned long do_mmap_pgoff(struct file
68723 vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
68724 mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
68725
68726 +#ifdef CONFIG_PAX_MPROTECT
68727 + if (mm->pax_flags & MF_PAX_MPROTECT) {
68728 +#ifndef CONFIG_PAX_MPROTECT_COMPAT
68729 + if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
68730 + gr_log_rwxmmap(file);
68731 +
68732 +#ifdef CONFIG_PAX_EMUPLT
68733 + vm_flags &= ~VM_EXEC;
68734 +#else
68735 + return -EPERM;
68736 +#endif
68737 +
68738 + }
68739 +
68740 + if (!(vm_flags & VM_EXEC))
68741 + vm_flags &= ~VM_MAYEXEC;
68742 +#else
68743 + if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
68744 + vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
68745 +#endif
68746 + else
68747 + vm_flags &= ~VM_MAYWRITE;
68748 + }
68749 +#endif
68750 +
68751 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
68752 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
68753 + vm_flags &= ~VM_PAGEEXEC;
68754 +#endif
68755 +
68756 if (flags & MAP_LOCKED)
68757 if (!can_do_mlock())
68758 return -EPERM;
68759 @@ -1011,6 +1118,7 @@ unsigned long do_mmap_pgoff(struct file
68760 locked += mm->locked_vm;
68761 lock_limit = rlimit(RLIMIT_MEMLOCK);
68762 lock_limit >>= PAGE_SHIFT;
68763 + gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
68764 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
68765 return -EAGAIN;
68766 }
68767 @@ -1081,6 +1189,9 @@ unsigned long do_mmap_pgoff(struct file
68768 if (error)
68769 return error;
68770
68771 + if (!gr_acl_handle_mmap(file, prot))
68772 + return -EACCES;
68773 +
68774 return mmap_region(file, addr, len, flags, vm_flags, pgoff);
68775 }
68776 EXPORT_SYMBOL(do_mmap_pgoff);
68777 @@ -1161,7 +1272,7 @@ int vma_wants_writenotify(struct vm_area
68778 vm_flags_t vm_flags = vma->vm_flags;
68779
68780 /* If it was private or non-writable, the write bit is already clear */
68781 - if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
68782 + if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
68783 return 0;
68784
68785 /* The backer wishes to know when pages are first written to? */
68786 @@ -1210,14 +1321,24 @@ unsigned long mmap_region(struct file *f
68787 unsigned long charged = 0;
68788 struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
68789
68790 +#ifdef CONFIG_PAX_SEGMEXEC
68791 + struct vm_area_struct *vma_m = NULL;
68792 +#endif
68793 +
68794 + /*
68795 + * mm->mmap_sem is required to protect against another thread
68796 + * changing the mappings in case we sleep.
68797 + */
68798 + verify_mm_writelocked(mm);
68799 +
68800 /* Clear old maps */
68801 error = -ENOMEM;
68802 -munmap_back:
68803 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
68804 if (vma && vma->vm_start < addr + len) {
68805 if (do_munmap(mm, addr, len))
68806 return -ENOMEM;
68807 - goto munmap_back;
68808 + vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
68809 + BUG_ON(vma && vma->vm_start < addr + len);
68810 }
68811
68812 /* Check against address space limit. */
68813 @@ -1266,6 +1387,16 @@ munmap_back:
68814 goto unacct_error;
68815 }
68816
68817 +#ifdef CONFIG_PAX_SEGMEXEC
68818 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
68819 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
68820 + if (!vma_m) {
68821 + error = -ENOMEM;
68822 + goto free_vma;
68823 + }
68824 + }
68825 +#endif
68826 +
68827 vma->vm_mm = mm;
68828 vma->vm_start = addr;
68829 vma->vm_end = addr + len;
68830 @@ -1289,6 +1420,19 @@ munmap_back:
68831 error = file->f_op->mmap(file, vma);
68832 if (error)
68833 goto unmap_and_free_vma;
68834 +
68835 +#ifdef CONFIG_PAX_SEGMEXEC
68836 + if (vma_m && (vm_flags & VM_EXECUTABLE))
68837 + added_exe_file_vma(mm);
68838 +#endif
68839 +
68840 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
68841 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
68842 + vma->vm_flags |= VM_PAGEEXEC;
68843 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
68844 + }
68845 +#endif
68846 +
68847 if (vm_flags & VM_EXECUTABLE)
68848 added_exe_file_vma(mm);
68849
68850 @@ -1324,6 +1468,11 @@ munmap_back:
68851 vma_link(mm, vma, prev, rb_link, rb_parent);
68852 file = vma->vm_file;
68853
68854 +#ifdef CONFIG_PAX_SEGMEXEC
68855 + if (vma_m)
68856 + BUG_ON(pax_mirror_vma(vma_m, vma));
68857 +#endif
68858 +
68859 /* Once vma denies write, undo our temporary denial count */
68860 if (correct_wcount)
68861 atomic_inc(&inode->i_writecount);
68862 @@ -1332,6 +1481,7 @@ out:
68863
68864 mm->total_vm += len >> PAGE_SHIFT;
68865 vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
68866 + track_exec_limit(mm, addr, addr + len, vm_flags);
68867 if (vm_flags & VM_LOCKED) {
68868 if (!mlock_vma_pages_range(vma, addr, addr + len))
68869 mm->locked_vm += (len >> PAGE_SHIFT);
68870 @@ -1349,6 +1499,12 @@ unmap_and_free_vma:
68871 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
68872 charged = 0;
68873 free_vma:
68874 +
68875 +#ifdef CONFIG_PAX_SEGMEXEC
68876 + if (vma_m)
68877 + kmem_cache_free(vm_area_cachep, vma_m);
68878 +#endif
68879 +
68880 kmem_cache_free(vm_area_cachep, vma);
68881 unacct_error:
68882 if (charged)
68883 @@ -1356,6 +1512,44 @@ unacct_error:
68884 return error;
68885 }
68886
68887 +bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len)
68888 +{
68889 + if (!vma) {
68890 +#ifdef CONFIG_STACK_GROWSUP
68891 + if (addr > sysctl_heap_stack_gap)
68892 + vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
68893 + else
68894 + vma = find_vma(current->mm, 0);
68895 + if (vma && (vma->vm_flags & VM_GROWSUP))
68896 + return false;
68897 +#endif
68898 + return true;
68899 + }
68900 +
68901 + if (addr + len > vma->vm_start)
68902 + return false;
68903 +
68904 + if (vma->vm_flags & VM_GROWSDOWN)
68905 + return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
68906 +#ifdef CONFIG_STACK_GROWSUP
68907 + else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
68908 + return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
68909 +#endif
68910 +
68911 + return true;
68912 +}
68913 +
68914 +unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len)
68915 +{
68916 + if (vma->vm_start < len)
68917 + return -ENOMEM;
68918 + if (!(vma->vm_flags & VM_GROWSDOWN))
68919 + return vma->vm_start - len;
68920 + if (sysctl_heap_stack_gap <= vma->vm_start - len)
68921 + return vma->vm_start - len - sysctl_heap_stack_gap;
68922 + return -ENOMEM;
68923 +}
68924 +
68925 /* Get an address range which is currently unmapped.
68926 * For shmat() with addr=0.
68927 *
68928 @@ -1382,18 +1576,23 @@ arch_get_unmapped_area(struct file *filp
68929 if (flags & MAP_FIXED)
68930 return addr;
68931
68932 +#ifdef CONFIG_PAX_RANDMMAP
68933 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
68934 +#endif
68935 +
68936 if (addr) {
68937 addr = PAGE_ALIGN(addr);
68938 - vma = find_vma(mm, addr);
68939 - if (TASK_SIZE - len >= addr &&
68940 - (!vma || addr + len <= vma->vm_start))
68941 - return addr;
68942 + if (TASK_SIZE - len >= addr) {
68943 + vma = find_vma(mm, addr);
68944 + if (check_heap_stack_gap(vma, addr, len))
68945 + return addr;
68946 + }
68947 }
68948 if (len > mm->cached_hole_size) {
68949 - start_addr = addr = mm->free_area_cache;
68950 + start_addr = addr = mm->free_area_cache;
68951 } else {
68952 - start_addr = addr = TASK_UNMAPPED_BASE;
68953 - mm->cached_hole_size = 0;
68954 + start_addr = addr = mm->mmap_base;
68955 + mm->cached_hole_size = 0;
68956 }
68957
68958 full_search:
68959 @@ -1404,34 +1603,40 @@ full_search:
68960 * Start a new search - just in case we missed
68961 * some holes.
68962 */
68963 - if (start_addr != TASK_UNMAPPED_BASE) {
68964 - addr = TASK_UNMAPPED_BASE;
68965 - start_addr = addr;
68966 + if (start_addr != mm->mmap_base) {
68967 + start_addr = addr = mm->mmap_base;
68968 mm->cached_hole_size = 0;
68969 goto full_search;
68970 }
68971 return -ENOMEM;
68972 }
68973 - if (!vma || addr + len <= vma->vm_start) {
68974 - /*
68975 - * Remember the place where we stopped the search:
68976 - */
68977 - mm->free_area_cache = addr + len;
68978 - return addr;
68979 - }
68980 + if (check_heap_stack_gap(vma, addr, len))
68981 + break;
68982 if (addr + mm->cached_hole_size < vma->vm_start)
68983 mm->cached_hole_size = vma->vm_start - addr;
68984 addr = vma->vm_end;
68985 }
68986 +
68987 + /*
68988 + * Remember the place where we stopped the search:
68989 + */
68990 + mm->free_area_cache = addr + len;
68991 + return addr;
68992 }
68993 #endif
68994
68995 void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
68996 {
68997 +
68998 +#ifdef CONFIG_PAX_SEGMEXEC
68999 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
69000 + return;
69001 +#endif
69002 +
69003 /*
69004 * Is this a new hole at the lowest possible address?
69005 */
69006 - if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
69007 + if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
69008 mm->free_area_cache = addr;
69009 mm->cached_hole_size = ~0UL;
69010 }
69011 @@ -1449,7 +1654,7 @@ arch_get_unmapped_area_topdown(struct fi
69012 {
69013 struct vm_area_struct *vma;
69014 struct mm_struct *mm = current->mm;
69015 - unsigned long addr = addr0;
69016 + unsigned long base = mm->mmap_base, addr = addr0;
69017
69018 /* requested length too big for entire address space */
69019 if (len > TASK_SIZE)
69020 @@ -1458,13 +1663,18 @@ arch_get_unmapped_area_topdown(struct fi
69021 if (flags & MAP_FIXED)
69022 return addr;
69023
69024 +#ifdef CONFIG_PAX_RANDMMAP
69025 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
69026 +#endif
69027 +
69028 /* requesting a specific address */
69029 if (addr) {
69030 addr = PAGE_ALIGN(addr);
69031 - vma = find_vma(mm, addr);
69032 - if (TASK_SIZE - len >= addr &&
69033 - (!vma || addr + len <= vma->vm_start))
69034 - return addr;
69035 + if (TASK_SIZE - len >= addr) {
69036 + vma = find_vma(mm, addr);
69037 + if (check_heap_stack_gap(vma, addr, len))
69038 + return addr;
69039 + }
69040 }
69041
69042 /* check if free_area_cache is useful for us */
69043 @@ -1479,7 +1689,7 @@ arch_get_unmapped_area_topdown(struct fi
69044 /* make sure it can fit in the remaining address space */
69045 if (addr > len) {
69046 vma = find_vma(mm, addr-len);
69047 - if (!vma || addr <= vma->vm_start)
69048 + if (check_heap_stack_gap(vma, addr - len, len))
69049 /* remember the address as a hint for next time */
69050 return (mm->free_area_cache = addr-len);
69051 }
69052 @@ -1496,7 +1706,7 @@ arch_get_unmapped_area_topdown(struct fi
69053 * return with success:
69054 */
69055 vma = find_vma(mm, addr);
69056 - if (!vma || addr+len <= vma->vm_start)
69057 + if (check_heap_stack_gap(vma, addr, len))
69058 /* remember the address as a hint for next time */
69059 return (mm->free_area_cache = addr);
69060
69061 @@ -1505,8 +1715,8 @@ arch_get_unmapped_area_topdown(struct fi
69062 mm->cached_hole_size = vma->vm_start - addr;
69063
69064 /* try just below the current vma->vm_start */
69065 - addr = vma->vm_start-len;
69066 - } while (len < vma->vm_start);
69067 + addr = skip_heap_stack_gap(vma, len);
69068 + } while (!IS_ERR_VALUE(addr));
69069
69070 bottomup:
69071 /*
69072 @@ -1515,13 +1725,21 @@ bottomup:
69073 * can happen with large stack limits and large mmap()
69074 * allocations.
69075 */
69076 + mm->mmap_base = TASK_UNMAPPED_BASE;
69077 +
69078 +#ifdef CONFIG_PAX_RANDMMAP
69079 + if (mm->pax_flags & MF_PAX_RANDMMAP)
69080 + mm->mmap_base += mm->delta_mmap;
69081 +#endif
69082 +
69083 + mm->free_area_cache = mm->mmap_base;
69084 mm->cached_hole_size = ~0UL;
69085 - mm->free_area_cache = TASK_UNMAPPED_BASE;
69086 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
69087 /*
69088 * Restore the topdown base:
69089 */
69090 - mm->free_area_cache = mm->mmap_base;
69091 + mm->mmap_base = base;
69092 + mm->free_area_cache = base;
69093 mm->cached_hole_size = ~0UL;
69094
69095 return addr;
69096 @@ -1530,6 +1748,12 @@ bottomup:
69097
69098 void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
69099 {
69100 +
69101 +#ifdef CONFIG_PAX_SEGMEXEC
69102 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
69103 + return;
69104 +#endif
69105 +
69106 /*
69107 * Is this a new hole at the highest possible address?
69108 */
69109 @@ -1537,8 +1761,10 @@ void arch_unmap_area_topdown(struct mm_s
69110 mm->free_area_cache = addr;
69111
69112 /* dont allow allocations above current base */
69113 - if (mm->free_area_cache > mm->mmap_base)
69114 + if (mm->free_area_cache > mm->mmap_base) {
69115 mm->free_area_cache = mm->mmap_base;
69116 + mm->cached_hole_size = ~0UL;
69117 + }
69118 }
69119
69120 unsigned long
69121 @@ -1646,6 +1872,28 @@ out:
69122 return prev ? prev->vm_next : vma;
69123 }
69124
69125 +#ifdef CONFIG_PAX_SEGMEXEC
69126 +struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
69127 +{
69128 + struct vm_area_struct *vma_m;
69129 +
69130 + BUG_ON(!vma || vma->vm_start >= vma->vm_end);
69131 + if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
69132 + BUG_ON(vma->vm_mirror);
69133 + return NULL;
69134 + }
69135 + BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
69136 + vma_m = vma->vm_mirror;
69137 + BUG_ON(!vma_m || vma_m->vm_mirror != vma);
69138 + BUG_ON(vma->vm_file != vma_m->vm_file);
69139 + BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
69140 + BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff);
69141 + BUG_ON(vma->anon_vma != vma_m->anon_vma && vma->anon_vma->root != vma_m->anon_vma->root);
69142 + BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
69143 + return vma_m;
69144 +}
69145 +#endif
69146 +
69147 /*
69148 * Verify that the stack growth is acceptable and
69149 * update accounting. This is shared with both the
69150 @@ -1662,6 +1910,7 @@ static int acct_stack_growth(struct vm_a
69151 return -ENOMEM;
69152
69153 /* Stack limit test */
69154 + gr_learn_resource(current, RLIMIT_STACK, size, 1);
69155 if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
69156 return -ENOMEM;
69157
69158 @@ -1672,6 +1921,7 @@ static int acct_stack_growth(struct vm_a
69159 locked = mm->locked_vm + grow;
69160 limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
69161 limit >>= PAGE_SHIFT;
69162 + gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
69163 if (locked > limit && !capable(CAP_IPC_LOCK))
69164 return -ENOMEM;
69165 }
69166 @@ -1702,37 +1952,48 @@ static int acct_stack_growth(struct vm_a
69167 * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
69168 * vma is the last one with address > vma->vm_end. Have to extend vma.
69169 */
69170 +#ifndef CONFIG_IA64
69171 +static
69172 +#endif
69173 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
69174 {
69175 int error;
69176 + bool locknext;
69177
69178 if (!(vma->vm_flags & VM_GROWSUP))
69179 return -EFAULT;
69180
69181 + /* Also guard against wrapping around to address 0. */
69182 + if (address < PAGE_ALIGN(address+1))
69183 + address = PAGE_ALIGN(address+1);
69184 + else
69185 + return -ENOMEM;
69186 +
69187 /*
69188 * We must make sure the anon_vma is allocated
69189 * so that the anon_vma locking is not a noop.
69190 */
69191 if (unlikely(anon_vma_prepare(vma)))
69192 return -ENOMEM;
69193 + locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
69194 + if (locknext && anon_vma_prepare(vma->vm_next))
69195 + return -ENOMEM;
69196 vma_lock_anon_vma(vma);
69197 + if (locknext)
69198 + vma_lock_anon_vma(vma->vm_next);
69199
69200 /*
69201 * vma->vm_start/vm_end cannot change under us because the caller
69202 * is required to hold the mmap_sem in read mode. We need the
69203 - * anon_vma lock to serialize against concurrent expand_stacks.
69204 - * Also guard against wrapping around to address 0.
69205 + * anon_vma locks to serialize against concurrent expand_stacks
69206 + * and expand_upwards.
69207 */
69208 - if (address < PAGE_ALIGN(address+4))
69209 - address = PAGE_ALIGN(address+4);
69210 - else {
69211 - vma_unlock_anon_vma(vma);
69212 - return -ENOMEM;
69213 - }
69214 error = 0;
69215
69216 /* Somebody else might have raced and expanded it already */
69217 - if (address > vma->vm_end) {
69218 + if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
69219 + error = -ENOMEM;
69220 + else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
69221 unsigned long size, grow;
69222
69223 size = address - vma->vm_start;
69224 @@ -1747,6 +2008,8 @@ int expand_upwards(struct vm_area_struct
69225 }
69226 }
69227 }
69228 + if (locknext)
69229 + vma_unlock_anon_vma(vma->vm_next);
69230 vma_unlock_anon_vma(vma);
69231 khugepaged_enter_vma_merge(vma);
69232 return error;
69233 @@ -1760,6 +2023,8 @@ int expand_downwards(struct vm_area_stru
69234 unsigned long address)
69235 {
69236 int error;
69237 + bool lockprev = false;
69238 + struct vm_area_struct *prev;
69239
69240 /*
69241 * We must make sure the anon_vma is allocated
69242 @@ -1773,6 +2038,15 @@ int expand_downwards(struct vm_area_stru
69243 if (error)
69244 return error;
69245
69246 + prev = vma->vm_prev;
69247 +#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
69248 + lockprev = prev && (prev->vm_flags & VM_GROWSUP);
69249 +#endif
69250 + if (lockprev && anon_vma_prepare(prev))
69251 + return -ENOMEM;
69252 + if (lockprev)
69253 + vma_lock_anon_vma(prev);
69254 +
69255 vma_lock_anon_vma(vma);
69256
69257 /*
69258 @@ -1782,9 +2056,17 @@ int expand_downwards(struct vm_area_stru
69259 */
69260
69261 /* Somebody else might have raced and expanded it already */
69262 - if (address < vma->vm_start) {
69263 + if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
69264 + error = -ENOMEM;
69265 + else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
69266 unsigned long size, grow;
69267
69268 +#ifdef CONFIG_PAX_SEGMEXEC
69269 + struct vm_area_struct *vma_m;
69270 +
69271 + vma_m = pax_find_mirror_vma(vma);
69272 +#endif
69273 +
69274 size = vma->vm_end - address;
69275 grow = (vma->vm_start - address) >> PAGE_SHIFT;
69276
69277 @@ -1794,11 +2076,22 @@ int expand_downwards(struct vm_area_stru
69278 if (!error) {
69279 vma->vm_start = address;
69280 vma->vm_pgoff -= grow;
69281 + track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
69282 +
69283 +#ifdef CONFIG_PAX_SEGMEXEC
69284 + if (vma_m) {
69285 + vma_m->vm_start -= grow << PAGE_SHIFT;
69286 + vma_m->vm_pgoff -= grow;
69287 + }
69288 +#endif
69289 +
69290 perf_event_mmap(vma);
69291 }
69292 }
69293 }
69294 vma_unlock_anon_vma(vma);
69295 + if (lockprev)
69296 + vma_unlock_anon_vma(prev);
69297 khugepaged_enter_vma_merge(vma);
69298 return error;
69299 }
69300 @@ -1868,6 +2161,13 @@ static void remove_vma_list(struct mm_st
69301 do {
69302 long nrpages = vma_pages(vma);
69303
69304 +#ifdef CONFIG_PAX_SEGMEXEC
69305 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
69306 + vma = remove_vma(vma);
69307 + continue;
69308 + }
69309 +#endif
69310 +
69311 mm->total_vm -= nrpages;
69312 vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
69313 vma = remove_vma(vma);
69314 @@ -1913,6 +2213,16 @@ detach_vmas_to_be_unmapped(struct mm_str
69315 insertion_point = (prev ? &prev->vm_next : &mm->mmap);
69316 vma->vm_prev = NULL;
69317 do {
69318 +
69319 +#ifdef CONFIG_PAX_SEGMEXEC
69320 + if (vma->vm_mirror) {
69321 + BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
69322 + vma->vm_mirror->vm_mirror = NULL;
69323 + vma->vm_mirror->vm_flags &= ~VM_EXEC;
69324 + vma->vm_mirror = NULL;
69325 + }
69326 +#endif
69327 +
69328 rb_erase(&vma->vm_rb, &mm->mm_rb);
69329 mm->map_count--;
69330 tail_vma = vma;
69331 @@ -1941,14 +2251,33 @@ static int __split_vma(struct mm_struct
69332 struct vm_area_struct *new;
69333 int err = -ENOMEM;
69334
69335 +#ifdef CONFIG_PAX_SEGMEXEC
69336 + struct vm_area_struct *vma_m, *new_m = NULL;
69337 + unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
69338 +#endif
69339 +
69340 if (is_vm_hugetlb_page(vma) && (addr &
69341 ~(huge_page_mask(hstate_vma(vma)))))
69342 return -EINVAL;
69343
69344 +#ifdef CONFIG_PAX_SEGMEXEC
69345 + vma_m = pax_find_mirror_vma(vma);
69346 +#endif
69347 +
69348 new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
69349 if (!new)
69350 goto out_err;
69351
69352 +#ifdef CONFIG_PAX_SEGMEXEC
69353 + if (vma_m) {
69354 + new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
69355 + if (!new_m) {
69356 + kmem_cache_free(vm_area_cachep, new);
69357 + goto out_err;
69358 + }
69359 + }
69360 +#endif
69361 +
69362 /* most fields are the same, copy all, and then fixup */
69363 *new = *vma;
69364
69365 @@ -1961,6 +2290,22 @@ static int __split_vma(struct mm_struct
69366 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
69367 }
69368
69369 +#ifdef CONFIG_PAX_SEGMEXEC
69370 + if (vma_m) {
69371 + *new_m = *vma_m;
69372 + INIT_LIST_HEAD(&new_m->anon_vma_chain);
69373 + new_m->vm_mirror = new;
69374 + new->vm_mirror = new_m;
69375 +
69376 + if (new_below)
69377 + new_m->vm_end = addr_m;
69378 + else {
69379 + new_m->vm_start = addr_m;
69380 + new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
69381 + }
69382 + }
69383 +#endif
69384 +
69385 pol = mpol_dup(vma_policy(vma));
69386 if (IS_ERR(pol)) {
69387 err = PTR_ERR(pol);
69388 @@ -1986,6 +2331,42 @@ static int __split_vma(struct mm_struct
69389 else
69390 err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
69391
69392 +#ifdef CONFIG_PAX_SEGMEXEC
69393 + if (!err && vma_m) {
69394 + if (anon_vma_clone(new_m, vma_m))
69395 + goto out_free_mpol;
69396 +
69397 + mpol_get(pol);
69398 + vma_set_policy(new_m, pol);
69399 +
69400 + if (new_m->vm_file) {
69401 + get_file(new_m->vm_file);
69402 + if (vma_m->vm_flags & VM_EXECUTABLE)
69403 + added_exe_file_vma(mm);
69404 + }
69405 +
69406 + if (new_m->vm_ops && new_m->vm_ops->open)
69407 + new_m->vm_ops->open(new_m);
69408 +
69409 + if (new_below)
69410 + err = vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
69411 + ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
69412 + else
69413 + err = vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
69414 +
69415 + if (err) {
69416 + if (new_m->vm_ops && new_m->vm_ops->close)
69417 + new_m->vm_ops->close(new_m);
69418 + if (new_m->vm_file) {
69419 + if (vma_m->vm_flags & VM_EXECUTABLE)
69420 + removed_exe_file_vma(mm);
69421 + fput(new_m->vm_file);
69422 + }
69423 + mpol_put(pol);
69424 + }
69425 + }
69426 +#endif
69427 +
69428 /* Success. */
69429 if (!err)
69430 return 0;
69431 @@ -1998,10 +2379,18 @@ static int __split_vma(struct mm_struct
69432 removed_exe_file_vma(mm);
69433 fput(new->vm_file);
69434 }
69435 - unlink_anon_vmas(new);
69436 out_free_mpol:
69437 mpol_put(pol);
69438 out_free_vma:
69439 +
69440 +#ifdef CONFIG_PAX_SEGMEXEC
69441 + if (new_m) {
69442 + unlink_anon_vmas(new_m);
69443 + kmem_cache_free(vm_area_cachep, new_m);
69444 + }
69445 +#endif
69446 +
69447 + unlink_anon_vmas(new);
69448 kmem_cache_free(vm_area_cachep, new);
69449 out_err:
69450 return err;
69451 @@ -2014,6 +2403,15 @@ static int __split_vma(struct mm_struct
69452 int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
69453 unsigned long addr, int new_below)
69454 {
69455 +
69456 +#ifdef CONFIG_PAX_SEGMEXEC
69457 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
69458 + BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
69459 + if (mm->map_count >= sysctl_max_map_count-1)
69460 + return -ENOMEM;
69461 + } else
69462 +#endif
69463 +
69464 if (mm->map_count >= sysctl_max_map_count)
69465 return -ENOMEM;
69466
69467 @@ -2025,11 +2423,30 @@ int split_vma(struct mm_struct *mm, stru
69468 * work. This now handles partial unmappings.
69469 * Jeremy Fitzhardinge <jeremy@goop.org>
69470 */
69471 +#ifdef CONFIG_PAX_SEGMEXEC
69472 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
69473 {
69474 + int ret = __do_munmap(mm, start, len);
69475 + if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
69476 + return ret;
69477 +
69478 + return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
69479 +}
69480 +
69481 +int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
69482 +#else
69483 +int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
69484 +#endif
69485 +{
69486 unsigned long end;
69487 struct vm_area_struct *vma, *prev, *last;
69488
69489 + /*
69490 + * mm->mmap_sem is required to protect against another thread
69491 + * changing the mappings in case we sleep.
69492 + */
69493 + verify_mm_writelocked(mm);
69494 +
69495 if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
69496 return -EINVAL;
69497
69498 @@ -2104,6 +2521,8 @@ int do_munmap(struct mm_struct *mm, unsi
69499 /* Fix up all other VM information */
69500 remove_vma_list(mm, vma);
69501
69502 + track_exec_limit(mm, start, end, 0UL);
69503 +
69504 return 0;
69505 }
69506
69507 @@ -2116,22 +2535,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
69508
69509 profile_munmap(addr);
69510
69511 +#ifdef CONFIG_PAX_SEGMEXEC
69512 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
69513 + (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
69514 + return -EINVAL;
69515 +#endif
69516 +
69517 down_write(&mm->mmap_sem);
69518 ret = do_munmap(mm, addr, len);
69519 up_write(&mm->mmap_sem);
69520 return ret;
69521 }
69522
69523 -static inline void verify_mm_writelocked(struct mm_struct *mm)
69524 -{
69525 -#ifdef CONFIG_DEBUG_VM
69526 - if (unlikely(down_read_trylock(&mm->mmap_sem))) {
69527 - WARN_ON(1);
69528 - up_read(&mm->mmap_sem);
69529 - }
69530 -#endif
69531 -}
69532 -
69533 /*
69534 * this is really a simplified "do_mmap". it only handles
69535 * anonymous maps. eventually we may be able to do some
69536 @@ -2145,6 +2560,7 @@ unsigned long do_brk(unsigned long addr,
69537 struct rb_node ** rb_link, * rb_parent;
69538 pgoff_t pgoff = addr >> PAGE_SHIFT;
69539 int error;
69540 + unsigned long charged;
69541
69542 len = PAGE_ALIGN(len);
69543 if (!len)
69544 @@ -2156,16 +2572,30 @@ unsigned long do_brk(unsigned long addr,
69545
69546 flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
69547
69548 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
69549 + if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
69550 + flags &= ~VM_EXEC;
69551 +
69552 +#ifdef CONFIG_PAX_MPROTECT
69553 + if (mm->pax_flags & MF_PAX_MPROTECT)
69554 + flags &= ~VM_MAYEXEC;
69555 +#endif
69556 +
69557 + }
69558 +#endif
69559 +
69560 error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
69561 if (error & ~PAGE_MASK)
69562 return error;
69563
69564 + charged = len >> PAGE_SHIFT;
69565 +
69566 /*
69567 * mlock MCL_FUTURE?
69568 */
69569 if (mm->def_flags & VM_LOCKED) {
69570 unsigned long locked, lock_limit;
69571 - locked = len >> PAGE_SHIFT;
69572 + locked = charged;
69573 locked += mm->locked_vm;
69574 lock_limit = rlimit(RLIMIT_MEMLOCK);
69575 lock_limit >>= PAGE_SHIFT;
69576 @@ -2182,22 +2612,22 @@ unsigned long do_brk(unsigned long addr,
69577 /*
69578 * Clear old maps. this also does some error checking for us
69579 */
69580 - munmap_back:
69581 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
69582 if (vma && vma->vm_start < addr + len) {
69583 if (do_munmap(mm, addr, len))
69584 return -ENOMEM;
69585 - goto munmap_back;
69586 + vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
69587 + BUG_ON(vma && vma->vm_start < addr + len);
69588 }
69589
69590 /* Check against address space limits *after* clearing old maps... */
69591 - if (!may_expand_vm(mm, len >> PAGE_SHIFT))
69592 + if (!may_expand_vm(mm, charged))
69593 return -ENOMEM;
69594
69595 if (mm->map_count > sysctl_max_map_count)
69596 return -ENOMEM;
69597
69598 - if (security_vm_enough_memory(len >> PAGE_SHIFT))
69599 + if (security_vm_enough_memory(charged))
69600 return -ENOMEM;
69601
69602 /* Can we just expand an old private anonymous mapping? */
69603 @@ -2211,7 +2641,7 @@ unsigned long do_brk(unsigned long addr,
69604 */
69605 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
69606 if (!vma) {
69607 - vm_unacct_memory(len >> PAGE_SHIFT);
69608 + vm_unacct_memory(charged);
69609 return -ENOMEM;
69610 }
69611
69612 @@ -2225,11 +2655,12 @@ unsigned long do_brk(unsigned long addr,
69613 vma_link(mm, vma, prev, rb_link, rb_parent);
69614 out:
69615 perf_event_mmap(vma);
69616 - mm->total_vm += len >> PAGE_SHIFT;
69617 + mm->total_vm += charged;
69618 if (flags & VM_LOCKED) {
69619 if (!mlock_vma_pages_range(vma, addr, addr + len))
69620 - mm->locked_vm += (len >> PAGE_SHIFT);
69621 + mm->locked_vm += charged;
69622 }
69623 + track_exec_limit(mm, addr, addr + len, flags);
69624 return addr;
69625 }
69626
69627 @@ -2276,8 +2707,10 @@ void exit_mmap(struct mm_struct *mm)
69628 * Walk the list again, actually closing and freeing it,
69629 * with preemption enabled, without holding any MM locks.
69630 */
69631 - while (vma)
69632 + while (vma) {
69633 + vma->vm_mirror = NULL;
69634 vma = remove_vma(vma);
69635 + }
69636
69637 BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
69638 }
69639 @@ -2291,6 +2724,13 @@ int insert_vm_struct(struct mm_struct *
69640 struct vm_area_struct * __vma, * prev;
69641 struct rb_node ** rb_link, * rb_parent;
69642
69643 +#ifdef CONFIG_PAX_SEGMEXEC
69644 + struct vm_area_struct *vma_m = NULL;
69645 +#endif
69646 +
69647 + if (security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1))
69648 + return -EPERM;
69649 +
69650 /*
69651 * The vm_pgoff of a purely anonymous vma should be irrelevant
69652 * until its first write fault, when page's anon_vma and index
69653 @@ -2313,7 +2753,22 @@ int insert_vm_struct(struct mm_struct *
69654 if ((vma->vm_flags & VM_ACCOUNT) &&
69655 security_vm_enough_memory_mm(mm, vma_pages(vma)))
69656 return -ENOMEM;
69657 +
69658 +#ifdef CONFIG_PAX_SEGMEXEC
69659 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
69660 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
69661 + if (!vma_m)
69662 + return -ENOMEM;
69663 + }
69664 +#endif
69665 +
69666 vma_link(mm, vma, prev, rb_link, rb_parent);
69667 +
69668 +#ifdef CONFIG_PAX_SEGMEXEC
69669 + if (vma_m)
69670 + BUG_ON(pax_mirror_vma(vma_m, vma));
69671 +#endif
69672 +
69673 return 0;
69674 }
69675
69676 @@ -2331,6 +2786,8 @@ struct vm_area_struct *copy_vma(struct v
69677 struct rb_node **rb_link, *rb_parent;
69678 struct mempolicy *pol;
69679
69680 + BUG_ON(vma->vm_mirror);
69681 +
69682 /*
69683 * If anonymous vma has not yet been faulted, update new pgoff
69684 * to match new location, to increase its chance of merging.
69685 @@ -2381,6 +2838,39 @@ struct vm_area_struct *copy_vma(struct v
69686 return NULL;
69687 }
69688
69689 +#ifdef CONFIG_PAX_SEGMEXEC
69690 +long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
69691 +{
69692 + struct vm_area_struct *prev_m;
69693 + struct rb_node **rb_link_m, *rb_parent_m;
69694 + struct mempolicy *pol_m;
69695 +
69696 + BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
69697 + BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
69698 + BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
69699 + *vma_m = *vma;
69700 + INIT_LIST_HEAD(&vma_m->anon_vma_chain);
69701 + if (anon_vma_clone(vma_m, vma))
69702 + return -ENOMEM;
69703 + pol_m = vma_policy(vma_m);
69704 + mpol_get(pol_m);
69705 + vma_set_policy(vma_m, pol_m);
69706 + vma_m->vm_start += SEGMEXEC_TASK_SIZE;
69707 + vma_m->vm_end += SEGMEXEC_TASK_SIZE;
69708 + vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
69709 + vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
69710 + if (vma_m->vm_file)
69711 + get_file(vma_m->vm_file);
69712 + if (vma_m->vm_ops && vma_m->vm_ops->open)
69713 + vma_m->vm_ops->open(vma_m);
69714 + find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
69715 + vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
69716 + vma_m->vm_mirror = vma;
69717 + vma->vm_mirror = vma_m;
69718 + return 0;
69719 +}
69720 +#endif
69721 +
69722 /*
69723 * Return true if the calling process may expand its vm space by the passed
69724 * number of pages
69725 @@ -2391,7 +2881,7 @@ int may_expand_vm(struct mm_struct *mm,
69726 unsigned long lim;
69727
69728 lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
69729 -
69730 + gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
69731 if (cur + npages > lim)
69732 return 0;
69733 return 1;
69734 @@ -2462,6 +2952,22 @@ int install_special_mapping(struct mm_st
69735 vma->vm_start = addr;
69736 vma->vm_end = addr + len;
69737
69738 +#ifdef CONFIG_PAX_MPROTECT
69739 + if (mm->pax_flags & MF_PAX_MPROTECT) {
69740 +#ifndef CONFIG_PAX_MPROTECT_COMPAT
69741 + if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
69742 + return -EPERM;
69743 + if (!(vm_flags & VM_EXEC))
69744 + vm_flags &= ~VM_MAYEXEC;
69745 +#else
69746 + if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
69747 + vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
69748 +#endif
69749 + else
69750 + vm_flags &= ~VM_MAYWRITE;
69751 + }
69752 +#endif
69753 +
69754 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
69755 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
69756
69757 diff -urNp linux-3.0.9/mm/mprotect.c linux-3.0.9/mm/mprotect.c
69758 --- linux-3.0.9/mm/mprotect.c 2011-11-11 13:12:24.000000000 -0500
69759 +++ linux-3.0.9/mm/mprotect.c 2011-11-15 20:03:00.000000000 -0500
69760 @@ -23,10 +23,16 @@
69761 #include <linux/mmu_notifier.h>
69762 #include <linux/migrate.h>
69763 #include <linux/perf_event.h>
69764 +
69765 +#ifdef CONFIG_PAX_MPROTECT
69766 +#include <linux/elf.h>
69767 +#endif
69768 +
69769 #include <asm/uaccess.h>
69770 #include <asm/pgtable.h>
69771 #include <asm/cacheflush.h>
69772 #include <asm/tlbflush.h>
69773 +#include <asm/mmu_context.h>
69774
69775 #ifndef pgprot_modify
69776 static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
69777 @@ -141,6 +147,48 @@ static void change_protection(struct vm_
69778 flush_tlb_range(vma, start, end);
69779 }
69780
69781 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
69782 +/* called while holding the mmap semaphor for writing except stack expansion */
69783 +void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
69784 +{
69785 + unsigned long oldlimit, newlimit = 0UL;
69786 +
69787 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || (__supported_pte_mask & _PAGE_NX))
69788 + return;
69789 +
69790 + spin_lock(&mm->page_table_lock);
69791 + oldlimit = mm->context.user_cs_limit;
69792 + if ((prot & VM_EXEC) && oldlimit < end)
69793 + /* USER_CS limit moved up */
69794 + newlimit = end;
69795 + else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
69796 + /* USER_CS limit moved down */
69797 + newlimit = start;
69798 +
69799 + if (newlimit) {
69800 + mm->context.user_cs_limit = newlimit;
69801 +
69802 +#ifdef CONFIG_SMP
69803 + wmb();
69804 + cpus_clear(mm->context.cpu_user_cs_mask);
69805 + cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
69806 +#endif
69807 +
69808 + set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
69809 + }
69810 + spin_unlock(&mm->page_table_lock);
69811 + if (newlimit == end) {
69812 + struct vm_area_struct *vma = find_vma(mm, oldlimit);
69813 +
69814 + for (; vma && vma->vm_start < end; vma = vma->vm_next)
69815 + if (is_vm_hugetlb_page(vma))
69816 + hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
69817 + else
69818 + change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
69819 + }
69820 +}
69821 +#endif
69822 +
69823 int
69824 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
69825 unsigned long start, unsigned long end, unsigned long newflags)
69826 @@ -153,11 +201,29 @@ mprotect_fixup(struct vm_area_struct *vm
69827 int error;
69828 int dirty_accountable = 0;
69829
69830 +#ifdef CONFIG_PAX_SEGMEXEC
69831 + struct vm_area_struct *vma_m = NULL;
69832 + unsigned long start_m, end_m;
69833 +
69834 + start_m = start + SEGMEXEC_TASK_SIZE;
69835 + end_m = end + SEGMEXEC_TASK_SIZE;
69836 +#endif
69837 +
69838 if (newflags == oldflags) {
69839 *pprev = vma;
69840 return 0;
69841 }
69842
69843 + if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
69844 + struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
69845 +
69846 + if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
69847 + return -ENOMEM;
69848 +
69849 + if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
69850 + return -ENOMEM;
69851 + }
69852 +
69853 /*
69854 * If we make a private mapping writable we increase our commit;
69855 * but (without finer accounting) cannot reduce our commit if we
69856 @@ -174,6 +240,42 @@ mprotect_fixup(struct vm_area_struct *vm
69857 }
69858 }
69859
69860 +#ifdef CONFIG_PAX_SEGMEXEC
69861 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
69862 + if (start != vma->vm_start) {
69863 + error = split_vma(mm, vma, start, 1);
69864 + if (error)
69865 + goto fail;
69866 + BUG_ON(!*pprev || (*pprev)->vm_next == vma);
69867 + *pprev = (*pprev)->vm_next;
69868 + }
69869 +
69870 + if (end != vma->vm_end) {
69871 + error = split_vma(mm, vma, end, 0);
69872 + if (error)
69873 + goto fail;
69874 + }
69875 +
69876 + if (pax_find_mirror_vma(vma)) {
69877 + error = __do_munmap(mm, start_m, end_m - start_m);
69878 + if (error)
69879 + goto fail;
69880 + } else {
69881 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
69882 + if (!vma_m) {
69883 + error = -ENOMEM;
69884 + goto fail;
69885 + }
69886 + vma->vm_flags = newflags;
69887 + error = pax_mirror_vma(vma_m, vma);
69888 + if (error) {
69889 + vma->vm_flags = oldflags;
69890 + goto fail;
69891 + }
69892 + }
69893 + }
69894 +#endif
69895 +
69896 /*
69897 * First try to merge with previous and/or next vma.
69898 */
69899 @@ -204,9 +306,21 @@ success:
69900 * vm_flags and vm_page_prot are protected by the mmap_sem
69901 * held in write mode.
69902 */
69903 +
69904 +#ifdef CONFIG_PAX_SEGMEXEC
69905 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
69906 + pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
69907 +#endif
69908 +
69909 vma->vm_flags = newflags;
69910 +
69911 +#ifdef CONFIG_PAX_MPROTECT
69912 + if (mm->binfmt && mm->binfmt->handle_mprotect)
69913 + mm->binfmt->handle_mprotect(vma, newflags);
69914 +#endif
69915 +
69916 vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
69917 - vm_get_page_prot(newflags));
69918 + vm_get_page_prot(vma->vm_flags));
69919
69920 if (vma_wants_writenotify(vma)) {
69921 vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
69922 @@ -248,6 +362,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
69923 end = start + len;
69924 if (end <= start)
69925 return -ENOMEM;
69926 +
69927 +#ifdef CONFIG_PAX_SEGMEXEC
69928 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
69929 + if (end > SEGMEXEC_TASK_SIZE)
69930 + return -EINVAL;
69931 + } else
69932 +#endif
69933 +
69934 + if (end > TASK_SIZE)
69935 + return -EINVAL;
69936 +
69937 if (!arch_validate_prot(prot))
69938 return -EINVAL;
69939
69940 @@ -255,7 +380,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
69941 /*
69942 * Does the application expect PROT_READ to imply PROT_EXEC:
69943 */
69944 - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
69945 + if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
69946 prot |= PROT_EXEC;
69947
69948 vm_flags = calc_vm_prot_bits(prot);
69949 @@ -287,6 +412,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
69950 if (start > vma->vm_start)
69951 prev = vma;
69952
69953 +#ifdef CONFIG_PAX_MPROTECT
69954 + if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
69955 + current->mm->binfmt->handle_mprotect(vma, vm_flags);
69956 +#endif
69957 +
69958 for (nstart = start ; ; ) {
69959 unsigned long newflags;
69960
69961 @@ -296,6 +426,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
69962
69963 /* newflags >> 4 shift VM_MAY% in place of VM_% */
69964 if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
69965 + if (prot & (PROT_WRITE | PROT_EXEC))
69966 + gr_log_rwxmprotect(vma->vm_file);
69967 +
69968 + error = -EACCES;
69969 + goto out;
69970 + }
69971 +
69972 + if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
69973 error = -EACCES;
69974 goto out;
69975 }
69976 @@ -310,6 +448,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
69977 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
69978 if (error)
69979 goto out;
69980 +
69981 + track_exec_limit(current->mm, nstart, tmp, vm_flags);
69982 +
69983 nstart = tmp;
69984
69985 if (nstart < prev->vm_end)
69986 diff -urNp linux-3.0.9/mm/mremap.c linux-3.0.9/mm/mremap.c
69987 --- linux-3.0.9/mm/mremap.c 2011-11-11 13:12:24.000000000 -0500
69988 +++ linux-3.0.9/mm/mremap.c 2011-11-15 20:03:00.000000000 -0500
69989 @@ -113,6 +113,12 @@ static void move_ptes(struct vm_area_str
69990 continue;
69991 pte = ptep_clear_flush(vma, old_addr, old_pte);
69992 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
69993 +
69994 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
69995 + if (!(__supported_pte_mask & _PAGE_NX) && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
69996 + pte = pte_exprotect(pte);
69997 +#endif
69998 +
69999 set_pte_at(mm, new_addr, new_pte, pte);
70000 }
70001
70002 @@ -272,6 +278,11 @@ static struct vm_area_struct *vma_to_res
70003 if (is_vm_hugetlb_page(vma))
70004 goto Einval;
70005
70006 +#ifdef CONFIG_PAX_SEGMEXEC
70007 + if (pax_find_mirror_vma(vma))
70008 + goto Einval;
70009 +#endif
70010 +
70011 /* We can't remap across vm area boundaries */
70012 if (old_len > vma->vm_end - addr)
70013 goto Efault;
70014 @@ -328,20 +339,25 @@ static unsigned long mremap_to(unsigned
70015 unsigned long ret = -EINVAL;
70016 unsigned long charged = 0;
70017 unsigned long map_flags;
70018 + unsigned long pax_task_size = TASK_SIZE;
70019
70020 if (new_addr & ~PAGE_MASK)
70021 goto out;
70022
70023 - if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
70024 +#ifdef CONFIG_PAX_SEGMEXEC
70025 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
70026 + pax_task_size = SEGMEXEC_TASK_SIZE;
70027 +#endif
70028 +
70029 + pax_task_size -= PAGE_SIZE;
70030 +
70031 + if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
70032 goto out;
70033
70034 /* Check if the location we're moving into overlaps the
70035 * old location at all, and fail if it does.
70036 */
70037 - if ((new_addr <= addr) && (new_addr+new_len) > addr)
70038 - goto out;
70039 -
70040 - if ((addr <= new_addr) && (addr+old_len) > new_addr)
70041 + if (addr + old_len > new_addr && new_addr + new_len > addr)
70042 goto out;
70043
70044 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
70045 @@ -413,6 +429,7 @@ unsigned long do_mremap(unsigned long ad
70046 struct vm_area_struct *vma;
70047 unsigned long ret = -EINVAL;
70048 unsigned long charged = 0;
70049 + unsigned long pax_task_size = TASK_SIZE;
70050
70051 if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
70052 goto out;
70053 @@ -431,6 +448,17 @@ unsigned long do_mremap(unsigned long ad
70054 if (!new_len)
70055 goto out;
70056
70057 +#ifdef CONFIG_PAX_SEGMEXEC
70058 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
70059 + pax_task_size = SEGMEXEC_TASK_SIZE;
70060 +#endif
70061 +
70062 + pax_task_size -= PAGE_SIZE;
70063 +
70064 + if (new_len > pax_task_size || addr > pax_task_size-new_len ||
70065 + old_len > pax_task_size || addr > pax_task_size-old_len)
70066 + goto out;
70067 +
70068 if (flags & MREMAP_FIXED) {
70069 if (flags & MREMAP_MAYMOVE)
70070 ret = mremap_to(addr, old_len, new_addr, new_len);
70071 @@ -480,6 +508,7 @@ unsigned long do_mremap(unsigned long ad
70072 addr + new_len);
70073 }
70074 ret = addr;
70075 + track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
70076 goto out;
70077 }
70078 }
70079 @@ -506,7 +535,13 @@ unsigned long do_mremap(unsigned long ad
70080 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
70081 if (ret)
70082 goto out;
70083 +
70084 + map_flags = vma->vm_flags;
70085 ret = move_vma(vma, addr, old_len, new_len, new_addr);
70086 + if (!(ret & ~PAGE_MASK)) {
70087 + track_exec_limit(current->mm, addr, addr + old_len, 0UL);
70088 + track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
70089 + }
70090 }
70091 out:
70092 if (ret & ~PAGE_MASK)
70093 diff -urNp linux-3.0.9/mm/nobootmem.c linux-3.0.9/mm/nobootmem.c
70094 --- linux-3.0.9/mm/nobootmem.c 2011-11-11 13:12:24.000000000 -0500
70095 +++ linux-3.0.9/mm/nobootmem.c 2011-11-15 20:03:00.000000000 -0500
70096 @@ -110,19 +110,30 @@ static void __init __free_pages_memory(u
70097 unsigned long __init free_all_memory_core_early(int nodeid)
70098 {
70099 int i;
70100 - u64 start, end;
70101 + u64 start, end, startrange, endrange;
70102 unsigned long count = 0;
70103 - struct range *range = NULL;
70104 + struct range *range = NULL, rangerange = { 0, 0 };
70105 int nr_range;
70106
70107 nr_range = get_free_all_memory_range(&range, nodeid);
70108 + startrange = __pa(range) >> PAGE_SHIFT;
70109 + endrange = (__pa(range + nr_range) - 1) >> PAGE_SHIFT;
70110
70111 for (i = 0; i < nr_range; i++) {
70112 start = range[i].start;
70113 end = range[i].end;
70114 + if (start <= endrange && startrange < end) {
70115 + BUG_ON(rangerange.start | rangerange.end);
70116 + rangerange = range[i];
70117 + continue;
70118 + }
70119 count += end - start;
70120 __free_pages_memory(start, end);
70121 }
70122 + start = rangerange.start;
70123 + end = rangerange.end;
70124 + count += end - start;
70125 + __free_pages_memory(start, end);
70126
70127 return count;
70128 }
70129 diff -urNp linux-3.0.9/mm/nommu.c linux-3.0.9/mm/nommu.c
70130 --- linux-3.0.9/mm/nommu.c 2011-11-11 13:12:24.000000000 -0500
70131 +++ linux-3.0.9/mm/nommu.c 2011-11-15 20:03:00.000000000 -0500
70132 @@ -63,7 +63,6 @@ int sysctl_overcommit_memory = OVERCOMMI
70133 int sysctl_overcommit_ratio = 50; /* default is 50% */
70134 int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
70135 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
70136 -int heap_stack_gap = 0;
70137
70138 atomic_long_t mmap_pages_allocated;
70139
70140 @@ -826,15 +825,6 @@ struct vm_area_struct *find_vma(struct m
70141 EXPORT_SYMBOL(find_vma);
70142
70143 /*
70144 - * find a VMA
70145 - * - we don't extend stack VMAs under NOMMU conditions
70146 - */
70147 -struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
70148 -{
70149 - return find_vma(mm, addr);
70150 -}
70151 -
70152 -/*
70153 * expand a stack to a given address
70154 * - not supported under NOMMU conditions
70155 */
70156 @@ -1554,6 +1544,7 @@ int split_vma(struct mm_struct *mm, stru
70157
70158 /* most fields are the same, copy all, and then fixup */
70159 *new = *vma;
70160 + INIT_LIST_HEAD(&new->anon_vma_chain);
70161 *region = *vma->vm_region;
70162 new->vm_region = region;
70163
70164 diff -urNp linux-3.0.9/mm/page_alloc.c linux-3.0.9/mm/page_alloc.c
70165 --- linux-3.0.9/mm/page_alloc.c 2011-11-11 13:12:24.000000000 -0500
70166 +++ linux-3.0.9/mm/page_alloc.c 2011-11-15 20:03:00.000000000 -0500
70167 @@ -340,7 +340,7 @@ out:
70168 * This usage means that zero-order pages may not be compound.
70169 */
70170
70171 -static void free_compound_page(struct page *page)
70172 +void free_compound_page(struct page *page)
70173 {
70174 __free_pages_ok(page, compound_order(page));
70175 }
70176 @@ -653,6 +653,10 @@ static bool free_pages_prepare(struct pa
70177 int i;
70178 int bad = 0;
70179
70180 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
70181 + unsigned long index = 1UL << order;
70182 +#endif
70183 +
70184 trace_mm_page_free_direct(page, order);
70185 kmemcheck_free_shadow(page, order);
70186
70187 @@ -668,6 +672,12 @@ static bool free_pages_prepare(struct pa
70188 debug_check_no_obj_freed(page_address(page),
70189 PAGE_SIZE << order);
70190 }
70191 +
70192 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
70193 + for (; index; --index)
70194 + sanitize_highpage(page + index - 1);
70195 +#endif
70196 +
70197 arch_free_page(page, order);
70198 kernel_map_pages(page, 1 << order, 0);
70199
70200 @@ -783,8 +793,10 @@ static int prep_new_page(struct page *pa
70201 arch_alloc_page(page, order);
70202 kernel_map_pages(page, 1 << order, 1);
70203
70204 +#ifndef CONFIG_PAX_MEMORY_SANITIZE
70205 if (gfp_flags & __GFP_ZERO)
70206 prep_zero_page(page, order, gfp_flags);
70207 +#endif
70208
70209 if (order && (gfp_flags & __GFP_COMP))
70210 prep_compound_page(page, order);
70211 @@ -2557,6 +2569,8 @@ void show_free_areas(unsigned int filter
70212 int cpu;
70213 struct zone *zone;
70214
70215 + pax_track_stack();
70216 +
70217 for_each_populated_zone(zone) {
70218 if (skip_free_areas_node(filter, zone_to_nid(zone)))
70219 continue;
70220 @@ -3368,7 +3382,13 @@ static int pageblock_is_reserved(unsigne
70221 unsigned long pfn;
70222
70223 for (pfn = start_pfn; pfn < end_pfn; pfn++) {
70224 +#ifdef CONFIG_X86_32
70225 + /* boot failures in VMware 8 on 32bit vanilla since
70226 + this change */
70227 + if (!pfn_valid(pfn) || PageReserved(pfn_to_page(pfn)))
70228 +#else
70229 if (!pfn_valid_within(pfn) || PageReserved(pfn_to_page(pfn)))
70230 +#endif
70231 return 1;
70232 }
70233 return 0;
70234 diff -urNp linux-3.0.9/mm/percpu.c linux-3.0.9/mm/percpu.c
70235 --- linux-3.0.9/mm/percpu.c 2011-11-11 13:12:24.000000000 -0500
70236 +++ linux-3.0.9/mm/percpu.c 2011-11-15 20:03:00.000000000 -0500
70237 @@ -121,7 +121,7 @@ static unsigned int pcpu_first_unit_cpu
70238 static unsigned int pcpu_last_unit_cpu __read_mostly;
70239
70240 /* the address of the first chunk which starts with the kernel static area */
70241 -void *pcpu_base_addr __read_mostly;
70242 +void *pcpu_base_addr __read_only;
70243 EXPORT_SYMBOL_GPL(pcpu_base_addr);
70244
70245 static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
70246 diff -urNp linux-3.0.9/mm/rmap.c linux-3.0.9/mm/rmap.c
70247 --- linux-3.0.9/mm/rmap.c 2011-11-11 13:12:24.000000000 -0500
70248 +++ linux-3.0.9/mm/rmap.c 2011-11-15 20:03:00.000000000 -0500
70249 @@ -153,6 +153,10 @@ int anon_vma_prepare(struct vm_area_stru
70250 struct anon_vma *anon_vma = vma->anon_vma;
70251 struct anon_vma_chain *avc;
70252
70253 +#ifdef CONFIG_PAX_SEGMEXEC
70254 + struct anon_vma_chain *avc_m = NULL;
70255 +#endif
70256 +
70257 might_sleep();
70258 if (unlikely(!anon_vma)) {
70259 struct mm_struct *mm = vma->vm_mm;
70260 @@ -162,6 +166,12 @@ int anon_vma_prepare(struct vm_area_stru
70261 if (!avc)
70262 goto out_enomem;
70263
70264 +#ifdef CONFIG_PAX_SEGMEXEC
70265 + avc_m = anon_vma_chain_alloc(GFP_KERNEL);
70266 + if (!avc_m)
70267 + goto out_enomem_free_avc;
70268 +#endif
70269 +
70270 anon_vma = find_mergeable_anon_vma(vma);
70271 allocated = NULL;
70272 if (!anon_vma) {
70273 @@ -175,6 +185,21 @@ int anon_vma_prepare(struct vm_area_stru
70274 /* page_table_lock to protect against threads */
70275 spin_lock(&mm->page_table_lock);
70276 if (likely(!vma->anon_vma)) {
70277 +
70278 +#ifdef CONFIG_PAX_SEGMEXEC
70279 + struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
70280 +
70281 + if (vma_m) {
70282 + BUG_ON(vma_m->anon_vma);
70283 + vma_m->anon_vma = anon_vma;
70284 + avc_m->anon_vma = anon_vma;
70285 + avc_m->vma = vma;
70286 + list_add(&avc_m->same_vma, &vma_m->anon_vma_chain);
70287 + list_add(&avc_m->same_anon_vma, &anon_vma->head);
70288 + avc_m = NULL;
70289 + }
70290 +#endif
70291 +
70292 vma->anon_vma = anon_vma;
70293 avc->anon_vma = anon_vma;
70294 avc->vma = vma;
70295 @@ -188,12 +213,24 @@ int anon_vma_prepare(struct vm_area_stru
70296
70297 if (unlikely(allocated))
70298 put_anon_vma(allocated);
70299 +
70300 +#ifdef CONFIG_PAX_SEGMEXEC
70301 + if (unlikely(avc_m))
70302 + anon_vma_chain_free(avc_m);
70303 +#endif
70304 +
70305 if (unlikely(avc))
70306 anon_vma_chain_free(avc);
70307 }
70308 return 0;
70309
70310 out_enomem_free_avc:
70311 +
70312 +#ifdef CONFIG_PAX_SEGMEXEC
70313 + if (avc_m)
70314 + anon_vma_chain_free(avc_m);
70315 +#endif
70316 +
70317 anon_vma_chain_free(avc);
70318 out_enomem:
70319 return -ENOMEM;
70320 @@ -244,7 +281,7 @@ static void anon_vma_chain_link(struct v
70321 * Attach the anon_vmas from src to dst.
70322 * Returns 0 on success, -ENOMEM on failure.
70323 */
70324 -int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
70325 +int anon_vma_clone(struct vm_area_struct *dst, const struct vm_area_struct *src)
70326 {
70327 struct anon_vma_chain *avc, *pavc;
70328 struct anon_vma *root = NULL;
70329 @@ -277,7 +314,7 @@ int anon_vma_clone(struct vm_area_struct
70330 * the corresponding VMA in the parent process is attached to.
70331 * Returns 0 on success, non-zero on failure.
70332 */
70333 -int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
70334 +int anon_vma_fork(struct vm_area_struct *vma, const struct vm_area_struct *pvma)
70335 {
70336 struct anon_vma_chain *avc;
70337 struct anon_vma *anon_vma;
70338 diff -urNp linux-3.0.9/mm/shmem.c linux-3.0.9/mm/shmem.c
70339 --- linux-3.0.9/mm/shmem.c 2011-11-11 13:12:24.000000000 -0500
70340 +++ linux-3.0.9/mm/shmem.c 2011-11-15 20:03:00.000000000 -0500
70341 @@ -31,7 +31,7 @@
70342 #include <linux/percpu_counter.h>
70343 #include <linux/swap.h>
70344
70345 -static struct vfsmount *shm_mnt;
70346 +struct vfsmount *shm_mnt;
70347
70348 #ifdef CONFIG_SHMEM
70349 /*
70350 @@ -1101,6 +1101,8 @@ static int shmem_writepage(struct page *
70351 goto unlock;
70352 }
70353 entry = shmem_swp_entry(info, index, NULL);
70354 + if (!entry)
70355 + goto unlock;
70356 if (entry->val) {
70357 /*
70358 * The more uptodate page coming down from a stacked
70359 @@ -1172,6 +1174,8 @@ static struct page *shmem_swapin(swp_ent
70360 struct vm_area_struct pvma;
70361 struct page *page;
70362
70363 + pax_track_stack();
70364 +
70365 spol = mpol_cond_copy(&mpol,
70366 mpol_shared_policy_lookup(&info->policy, idx));
70367
70368 @@ -2568,8 +2572,7 @@ int shmem_fill_super(struct super_block
70369 int err = -ENOMEM;
70370
70371 /* Round up to L1_CACHE_BYTES to resist false sharing */
70372 - sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
70373 - L1_CACHE_BYTES), GFP_KERNEL);
70374 + sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
70375 if (!sbinfo)
70376 return -ENOMEM;
70377
70378 diff -urNp linux-3.0.9/mm/slab.c linux-3.0.9/mm/slab.c
70379 --- linux-3.0.9/mm/slab.c 2011-11-11 13:12:24.000000000 -0500
70380 +++ linux-3.0.9/mm/slab.c 2011-11-15 20:03:00.000000000 -0500
70381 @@ -151,7 +151,7 @@
70382
70383 /* Legal flag mask for kmem_cache_create(). */
70384 #if DEBUG
70385 -# define CREATE_MASK (SLAB_RED_ZONE | \
70386 +# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
70387 SLAB_POISON | SLAB_HWCACHE_ALIGN | \
70388 SLAB_CACHE_DMA | \
70389 SLAB_STORE_USER | \
70390 @@ -159,7 +159,7 @@
70391 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
70392 SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
70393 #else
70394 -# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
70395 +# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
70396 SLAB_CACHE_DMA | \
70397 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
70398 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
70399 @@ -288,7 +288,7 @@ struct kmem_list3 {
70400 * Need this for bootstrapping a per node allocator.
70401 */
70402 #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
70403 -static struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
70404 +static struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
70405 #define CACHE_CACHE 0
70406 #define SIZE_AC MAX_NUMNODES
70407 #define SIZE_L3 (2 * MAX_NUMNODES)
70408 @@ -389,10 +389,10 @@ static void kmem_list3_init(struct kmem_
70409 if ((x)->max_freeable < i) \
70410 (x)->max_freeable = i; \
70411 } while (0)
70412 -#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
70413 -#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
70414 -#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
70415 -#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
70416 +#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
70417 +#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
70418 +#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
70419 +#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
70420 #else
70421 #define STATS_INC_ACTIVE(x) do { } while (0)
70422 #define STATS_DEC_ACTIVE(x) do { } while (0)
70423 @@ -538,7 +538,7 @@ static inline void *index_to_obj(struct
70424 * reciprocal_divide(offset, cache->reciprocal_buffer_size)
70425 */
70426 static inline unsigned int obj_to_index(const struct kmem_cache *cache,
70427 - const struct slab *slab, void *obj)
70428 + const struct slab *slab, const void *obj)
70429 {
70430 u32 offset = (obj - slab->s_mem);
70431 return reciprocal_divide(offset, cache->reciprocal_buffer_size);
70432 @@ -564,7 +564,7 @@ struct cache_names {
70433 static struct cache_names __initdata cache_names[] = {
70434 #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
70435 #include <linux/kmalloc_sizes.h>
70436 - {NULL,}
70437 + {NULL}
70438 #undef CACHE
70439 };
70440
70441 @@ -1530,7 +1530,7 @@ void __init kmem_cache_init(void)
70442 sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
70443 sizes[INDEX_AC].cs_size,
70444 ARCH_KMALLOC_MINALIGN,
70445 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
70446 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
70447 NULL);
70448
70449 if (INDEX_AC != INDEX_L3) {
70450 @@ -1538,7 +1538,7 @@ void __init kmem_cache_init(void)
70451 kmem_cache_create(names[INDEX_L3].name,
70452 sizes[INDEX_L3].cs_size,
70453 ARCH_KMALLOC_MINALIGN,
70454 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
70455 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
70456 NULL);
70457 }
70458
70459 @@ -1556,7 +1556,7 @@ void __init kmem_cache_init(void)
70460 sizes->cs_cachep = kmem_cache_create(names->name,
70461 sizes->cs_size,
70462 ARCH_KMALLOC_MINALIGN,
70463 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
70464 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
70465 NULL);
70466 }
70467 #ifdef CONFIG_ZONE_DMA
70468 @@ -4272,10 +4272,10 @@ static int s_show(struct seq_file *m, vo
70469 }
70470 /* cpu stats */
70471 {
70472 - unsigned long allochit = atomic_read(&cachep->allochit);
70473 - unsigned long allocmiss = atomic_read(&cachep->allocmiss);
70474 - unsigned long freehit = atomic_read(&cachep->freehit);
70475 - unsigned long freemiss = atomic_read(&cachep->freemiss);
70476 + unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
70477 + unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
70478 + unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
70479 + unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
70480
70481 seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
70482 allochit, allocmiss, freehit, freemiss);
70483 @@ -4532,15 +4532,66 @@ static const struct file_operations proc
70484
70485 static int __init slab_proc_init(void)
70486 {
70487 - proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
70488 + mode_t gr_mode = S_IRUGO;
70489 +
70490 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
70491 + gr_mode = S_IRUSR;
70492 +#endif
70493 +
70494 + proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
70495 #ifdef CONFIG_DEBUG_SLAB_LEAK
70496 - proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
70497 + proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
70498 #endif
70499 return 0;
70500 }
70501 module_init(slab_proc_init);
70502 #endif
70503
70504 +void check_object_size(const void *ptr, unsigned long n, bool to)
70505 +{
70506 +
70507 +#ifdef CONFIG_PAX_USERCOPY
70508 + struct page *page;
70509 + struct kmem_cache *cachep = NULL;
70510 + struct slab *slabp;
70511 + unsigned int objnr;
70512 + unsigned long offset;
70513 +
70514 + if (!n)
70515 + return;
70516 +
70517 + if (ZERO_OR_NULL_PTR(ptr))
70518 + goto report;
70519 +
70520 + if (!virt_addr_valid(ptr))
70521 + return;
70522 +
70523 + page = virt_to_head_page(ptr);
70524 +
70525 + if (!PageSlab(page)) {
70526 + if (object_is_on_stack(ptr, n) == -1)
70527 + goto report;
70528 + return;
70529 + }
70530 +
70531 + cachep = page_get_cache(page);
70532 + if (!(cachep->flags & SLAB_USERCOPY))
70533 + goto report;
70534 +
70535 + slabp = page_get_slab(page);
70536 + objnr = obj_to_index(cachep, slabp, ptr);
70537 + BUG_ON(objnr >= cachep->num);
70538 + offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
70539 + if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
70540 + return;
70541 +
70542 +report:
70543 + pax_report_usercopy(ptr, n, to, cachep ? cachep->name : NULL);
70544 +#endif
70545 +
70546 +}
70547 +EXPORT_SYMBOL(check_object_size);
70548 +
70549 /**
70550 * ksize - get the actual amount of memory allocated for a given object
70551 * @objp: Pointer to the object
70552 diff -urNp linux-3.0.9/mm/slob.c linux-3.0.9/mm/slob.c
70553 --- linux-3.0.9/mm/slob.c 2011-11-11 13:12:24.000000000 -0500
70554 +++ linux-3.0.9/mm/slob.c 2011-11-15 20:03:00.000000000 -0500
70555 @@ -29,7 +29,7 @@
70556 * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
70557 * alloc_pages() directly, allocating compound pages so the page order
70558 * does not have to be separately tracked, and also stores the exact
70559 - * allocation size in page->private so that it can be used to accurately
70560 + * allocation size in slob_page->size so that it can be used to accurately
70561 * provide ksize(). These objects are detected in kfree() because slob_page()
70562 * is false for them.
70563 *
70564 @@ -58,6 +58,7 @@
70565 */
70566
70567 #include <linux/kernel.h>
70568 +#include <linux/sched.h>
70569 #include <linux/slab.h>
70570 #include <linux/mm.h>
70571 #include <linux/swap.h> /* struct reclaim_state */
70572 @@ -102,7 +103,8 @@ struct slob_page {
70573 unsigned long flags; /* mandatory */
70574 atomic_t _count; /* mandatory */
70575 slobidx_t units; /* free units left in page */
70576 - unsigned long pad[2];
70577 + unsigned long pad[1];
70578 + unsigned long size; /* size when >=PAGE_SIZE */
70579 slob_t *free; /* first free slob_t in page */
70580 struct list_head list; /* linked list of free pages */
70581 };
70582 @@ -135,7 +137,7 @@ static LIST_HEAD(free_slob_large);
70583 */
70584 static inline int is_slob_page(struct slob_page *sp)
70585 {
70586 - return PageSlab((struct page *)sp);
70587 + return PageSlab((struct page *)sp) && !sp->size;
70588 }
70589
70590 static inline void set_slob_page(struct slob_page *sp)
70591 @@ -150,7 +152,7 @@ static inline void clear_slob_page(struc
70592
70593 static inline struct slob_page *slob_page(const void *addr)
70594 {
70595 - return (struct slob_page *)virt_to_page(addr);
70596 + return (struct slob_page *)virt_to_head_page(addr);
70597 }
70598
70599 /*
70600 @@ -210,7 +212,7 @@ static void set_slob(slob_t *s, slobidx_
70601 /*
70602 * Return the size of a slob block.
70603 */
70604 -static slobidx_t slob_units(slob_t *s)
70605 +static slobidx_t slob_units(const slob_t *s)
70606 {
70607 if (s->units > 0)
70608 return s->units;
70609 @@ -220,7 +222,7 @@ static slobidx_t slob_units(slob_t *s)
70610 /*
70611 * Return the next free slob block pointer after this one.
70612 */
70613 -static slob_t *slob_next(slob_t *s)
70614 +static slob_t *slob_next(const slob_t *s)
70615 {
70616 slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
70617 slobidx_t next;
70618 @@ -235,7 +237,7 @@ static slob_t *slob_next(slob_t *s)
70619 /*
70620 * Returns true if s is the last free block in its page.
70621 */
70622 -static int slob_last(slob_t *s)
70623 +static int slob_last(const slob_t *s)
70624 {
70625 return !((unsigned long)slob_next(s) & ~PAGE_MASK);
70626 }
70627 @@ -254,6 +256,7 @@ static void *slob_new_pages(gfp_t gfp, i
70628 if (!page)
70629 return NULL;
70630
70631 + set_slob_page(page);
70632 return page_address(page);
70633 }
70634
70635 @@ -370,11 +373,11 @@ static void *slob_alloc(size_t size, gfp
70636 if (!b)
70637 return NULL;
70638 sp = slob_page(b);
70639 - set_slob_page(sp);
70640
70641 spin_lock_irqsave(&slob_lock, flags);
70642 sp->units = SLOB_UNITS(PAGE_SIZE);
70643 sp->free = b;
70644 + sp->size = 0;
70645 INIT_LIST_HEAD(&sp->list);
70646 set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
70647 set_slob_page_free(sp, slob_list);
70648 @@ -476,10 +479,9 @@ out:
70649 * End of slob allocator proper. Begin kmem_cache_alloc and kmalloc frontend.
70650 */
70651
70652 -void *__kmalloc_node(size_t size, gfp_t gfp, int node)
70653 +static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
70654 {
70655 - unsigned int *m;
70656 - int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
70657 + slob_t *m;
70658 void *ret;
70659
70660 lockdep_trace_alloc(gfp);
70661 @@ -492,7 +494,10 @@ void *__kmalloc_node(size_t size, gfp_t
70662
70663 if (!m)
70664 return NULL;
70665 - *m = size;
70666 + BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
70667 + BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
70668 + m[0].units = size;
70669 + m[1].units = align;
70670 ret = (void *)m + align;
70671
70672 trace_kmalloc_node(_RET_IP_, ret,
70673 @@ -504,16 +509,25 @@ void *__kmalloc_node(size_t size, gfp_t
70674 gfp |= __GFP_COMP;
70675 ret = slob_new_pages(gfp, order, node);
70676 if (ret) {
70677 - struct page *page;
70678 - page = virt_to_page(ret);
70679 - page->private = size;
70680 + struct slob_page *sp;
70681 + sp = slob_page(ret);
70682 + sp->size = size;
70683 }
70684
70685 trace_kmalloc_node(_RET_IP_, ret,
70686 size, PAGE_SIZE << order, gfp, node);
70687 }
70688
70689 - kmemleak_alloc(ret, size, 1, gfp);
70690 + return ret;
70691 +}
70692 +
70693 +void *__kmalloc_node(size_t size, gfp_t gfp, int node)
70694 +{
70695 + int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
70696 + void *ret = __kmalloc_node_align(size, gfp, node, align);
70697 +
70698 + if (!ZERO_OR_NULL_PTR(ret))
70699 + kmemleak_alloc(ret, size, 1, gfp);
70700 return ret;
70701 }
70702 EXPORT_SYMBOL(__kmalloc_node);
70703 @@ -531,13 +545,88 @@ void kfree(const void *block)
70704 sp = slob_page(block);
70705 if (is_slob_page(sp)) {
70706 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
70707 - unsigned int *m = (unsigned int *)(block - align);
70708 - slob_free(m, *m + align);
70709 - } else
70710 + slob_t *m = (slob_t *)(block - align);
70711 + slob_free(m, m[0].units + align);
70712 + } else {
70713 + clear_slob_page(sp);
70714 + free_slob_page(sp);
70715 + sp->size = 0;
70716 put_page(&sp->page);
70717 + }
70718 }
70719 EXPORT_SYMBOL(kfree);
70720
70721 +void check_object_size(const void *ptr, unsigned long n, bool to)
70722 +{
70723 +
70724 +#ifdef CONFIG_PAX_USERCOPY
70725 + struct slob_page *sp;
70726 + const slob_t *free;
70727 + const void *base;
70728 + unsigned long flags;
70729 +
70730 + if (!n)
70731 + return;
70732 +
70733 + if (ZERO_OR_NULL_PTR(ptr))
70734 + goto report;
70735 +
70736 + if (!virt_addr_valid(ptr))
70737 + return;
70738 +
70739 + sp = slob_page(ptr);
70740 + if (!PageSlab((struct page*)sp)) {
70741 + if (object_is_on_stack(ptr, n) == -1)
70742 + goto report;
70743 + return;
70744 + }
70745 +
70746 + if (sp->size) {
70747 + base = page_address(&sp->page);
70748 + if (base <= ptr && n <= sp->size - (ptr - base))
70749 + return;
70750 + goto report;
70751 + }
70752 +
70753 + /* some tricky double walking to find the chunk */
70754 + spin_lock_irqsave(&slob_lock, flags);
70755 + base = (void *)((unsigned long)ptr & PAGE_MASK);
70756 + free = sp->free;
70757 +
70758 + while (!slob_last(free) && (void *)free <= ptr) {
70759 + base = free + slob_units(free);
70760 + free = slob_next(free);
70761 + }
70762 +
70763 + while (base < (void *)free) {
70764 + slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
70765 + int size = SLOB_UNIT * SLOB_UNITS(m + align);
70766 + int offset;
70767 +
70768 + if (ptr < base + align)
70769 + break;
70770 +
70771 + offset = ptr - base - align;
70772 + if (offset >= m) {
70773 + base += size;
70774 + continue;
70775 + }
70776 +
70777 + if (n > m - offset)
70778 + break;
70779 +
70780 + spin_unlock_irqrestore(&slob_lock, flags);
70781 + return;
70782 + }
70783 +
70784 + spin_unlock_irqrestore(&slob_lock, flags);
70785 +report:
70786 + pax_report_usercopy(ptr, n, to, NULL);
70787 +#endif
70788 +
70789 +}
70790 +EXPORT_SYMBOL(check_object_size);
70791 +
70792 /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
70793 size_t ksize(const void *block)
70794 {
70795 @@ -550,10 +639,10 @@ size_t ksize(const void *block)
70796 sp = slob_page(block);
70797 if (is_slob_page(sp)) {
70798 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
70799 - unsigned int *m = (unsigned int *)(block - align);
70800 - return SLOB_UNITS(*m) * SLOB_UNIT;
70801 + slob_t *m = (slob_t *)(block - align);
70802 + return SLOB_UNITS(m[0].units) * SLOB_UNIT;
70803 } else
70804 - return sp->page.private;
70805 + return sp->size;
70806 }
70807 EXPORT_SYMBOL(ksize);
70808
70809 @@ -569,8 +658,13 @@ struct kmem_cache *kmem_cache_create(con
70810 {
70811 struct kmem_cache *c;
70812
70813 +#ifdef CONFIG_PAX_USERCOPY
70814 + c = __kmalloc_node_align(sizeof(struct kmem_cache),
70815 + GFP_KERNEL, -1, ARCH_KMALLOC_MINALIGN);
70816 +#else
70817 c = slob_alloc(sizeof(struct kmem_cache),
70818 GFP_KERNEL, ARCH_KMALLOC_MINALIGN, -1);
70819 +#endif
70820
70821 if (c) {
70822 c->name = name;
70823 @@ -608,17 +702,25 @@ void *kmem_cache_alloc_node(struct kmem_
70824 {
70825 void *b;
70826
70827 +#ifdef CONFIG_PAX_USERCOPY
70828 + b = __kmalloc_node_align(c->size, flags, node, c->align);
70829 +#else
70830 if (c->size < PAGE_SIZE) {
70831 b = slob_alloc(c->size, flags, c->align, node);
70832 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
70833 SLOB_UNITS(c->size) * SLOB_UNIT,
70834 flags, node);
70835 } else {
70836 + struct slob_page *sp;
70837 +
70838 b = slob_new_pages(flags, get_order(c->size), node);
70839 + sp = slob_page(b);
70840 + sp->size = c->size;
70841 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
70842 PAGE_SIZE << get_order(c->size),
70843 flags, node);
70844 }
70845 +#endif
70846
70847 if (c->ctor)
70848 c->ctor(b);
70849 @@ -630,10 +732,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
70850
70851 static void __kmem_cache_free(void *b, int size)
70852 {
70853 - if (size < PAGE_SIZE)
70854 + struct slob_page *sp = slob_page(b);
70855 +
70856 + if (is_slob_page(sp))
70857 slob_free(b, size);
70858 - else
70859 + else {
70860 + clear_slob_page(sp);
70861 + free_slob_page(sp);
70862 + sp->size = 0;
70863 slob_free_pages(b, get_order(size));
70864 + }
70865 }
70866
70867 static void kmem_rcu_free(struct rcu_head *head)
70868 @@ -646,17 +754,31 @@ static void kmem_rcu_free(struct rcu_hea
70869
70870 void kmem_cache_free(struct kmem_cache *c, void *b)
70871 {
70872 + int size = c->size;
70873 +
70874 +#ifdef CONFIG_PAX_USERCOPY
70875 + if (size + c->align < PAGE_SIZE) {
70876 + size += c->align;
70877 + b -= c->align;
70878 + }
70879 +#endif
70880 +
70881 kmemleak_free_recursive(b, c->flags);
70882 if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
70883 struct slob_rcu *slob_rcu;
70884 - slob_rcu = b + (c->size - sizeof(struct slob_rcu));
70885 - slob_rcu->size = c->size;
70886 + slob_rcu = b + (size - sizeof(struct slob_rcu));
70887 + slob_rcu->size = size;
70888 call_rcu(&slob_rcu->head, kmem_rcu_free);
70889 } else {
70890 - __kmem_cache_free(b, c->size);
70891 + __kmem_cache_free(b, size);
70892 }
70893
70894 +#ifdef CONFIG_PAX_USERCOPY
70895 + trace_kfree(_RET_IP_, b);
70896 +#else
70897 trace_kmem_cache_free(_RET_IP_, b);
70898 +#endif
70899 +
70900 }
70901 EXPORT_SYMBOL(kmem_cache_free);
70902
70903 diff -urNp linux-3.0.9/mm/slub.c linux-3.0.9/mm/slub.c
70904 --- linux-3.0.9/mm/slub.c 2011-11-11 13:12:24.000000000 -0500
70905 +++ linux-3.0.9/mm/slub.c 2011-11-15 20:03:00.000000000 -0500
70906 @@ -200,7 +200,7 @@ struct track {
70907
70908 enum track_item { TRACK_ALLOC, TRACK_FREE };
70909
70910 -#ifdef CONFIG_SYSFS
70911 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
70912 static int sysfs_slab_add(struct kmem_cache *);
70913 static int sysfs_slab_alias(struct kmem_cache *, const char *);
70914 static void sysfs_slab_remove(struct kmem_cache *);
70915 @@ -442,7 +442,7 @@ static void print_track(const char *s, s
70916 if (!t->addr)
70917 return;
70918
70919 - printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
70920 + printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
70921 s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
70922 }
70923
70924 @@ -2137,6 +2137,8 @@ void kmem_cache_free(struct kmem_cache *
70925
70926 page = virt_to_head_page(x);
70927
70928 + BUG_ON(!PageSlab(page));
70929 +
70930 slab_free(s, page, x, _RET_IP_);
70931
70932 trace_kmem_cache_free(_RET_IP_, x);
70933 @@ -2170,7 +2172,7 @@ static int slub_min_objects;
70934 * Merge control. If this is set then no merging of slab caches will occur.
70935 * (Could be removed. This was introduced to pacify the merge skeptics.)
70936 */
70937 -static int slub_nomerge;
70938 +static int slub_nomerge = 1;
70939
70940 /*
70941 * Calculate the order of allocation given an slab object size.
70942 @@ -2594,7 +2596,7 @@ static int kmem_cache_open(struct kmem_c
70943 * list to avoid pounding the page allocator excessively.
70944 */
70945 set_min_partial(s, ilog2(s->size));
70946 - s->refcount = 1;
70947 + atomic_set(&s->refcount, 1);
70948 #ifdef CONFIG_NUMA
70949 s->remote_node_defrag_ratio = 1000;
70950 #endif
70951 @@ -2699,8 +2701,7 @@ static inline int kmem_cache_close(struc
70952 void kmem_cache_destroy(struct kmem_cache *s)
70953 {
70954 down_write(&slub_lock);
70955 - s->refcount--;
70956 - if (!s->refcount) {
70957 + if (atomic_dec_and_test(&s->refcount)) {
70958 list_del(&s->list);
70959 if (kmem_cache_close(s)) {
70960 printk(KERN_ERR "SLUB %s: %s called for cache that "
70961 @@ -2910,6 +2911,46 @@ void *__kmalloc_node(size_t size, gfp_t
70962 EXPORT_SYMBOL(__kmalloc_node);
70963 #endif
70964
70965 +void check_object_size(const void *ptr, unsigned long n, bool to)
70966 +{
70967 +
70968 +#ifdef CONFIG_PAX_USERCOPY
70969 + struct page *page;
70970 + struct kmem_cache *s = NULL;
70971 + unsigned long offset;
70972 +
70973 + if (!n)
70974 + return;
70975 +
70976 + if (ZERO_OR_NULL_PTR(ptr))
70977 + goto report;
70978 +
70979 + if (!virt_addr_valid(ptr))
70980 + return;
70981 +
70982 + page = virt_to_head_page(ptr);
70983 +
70984 + if (!PageSlab(page)) {
70985 + if (object_is_on_stack(ptr, n) == -1)
70986 + goto report;
70987 + return;
70988 + }
70989 +
70990 + s = page->slab;
70991 + if (!(s->flags & SLAB_USERCOPY))
70992 + goto report;
70993 +
70994 + offset = (ptr - page_address(page)) % s->size;
70995 + if (offset <= s->objsize && n <= s->objsize - offset)
70996 + return;
70997 +
70998 +report:
70999 + pax_report_usercopy(ptr, n, to, s ? s->name : NULL);
71000 +#endif
71001 +
71002 +}
71003 +EXPORT_SYMBOL(check_object_size);
71004 +
71005 size_t ksize(const void *object)
71006 {
71007 struct page *page;
71008 @@ -3154,7 +3195,7 @@ static void __init kmem_cache_bootstrap_
71009 int node;
71010
71011 list_add(&s->list, &slab_caches);
71012 - s->refcount = -1;
71013 + atomic_set(&s->refcount, -1);
71014
71015 for_each_node_state(node, N_NORMAL_MEMORY) {
71016 struct kmem_cache_node *n = get_node(s, node);
71017 @@ -3271,17 +3312,17 @@ void __init kmem_cache_init(void)
71018
71019 /* Caches that are not of the two-to-the-power-of size */
71020 if (KMALLOC_MIN_SIZE <= 32) {
71021 - kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, 0);
71022 + kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, SLAB_USERCOPY);
71023 caches++;
71024 }
71025
71026 if (KMALLOC_MIN_SIZE <= 64) {
71027 - kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, 0);
71028 + kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, SLAB_USERCOPY);
71029 caches++;
71030 }
71031
71032 for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
71033 - kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, 0);
71034 + kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, SLAB_USERCOPY);
71035 caches++;
71036 }
71037
71038 @@ -3349,7 +3390,7 @@ static int slab_unmergeable(struct kmem_
71039 /*
71040 * We may have set a slab to be unmergeable during bootstrap.
71041 */
71042 - if (s->refcount < 0)
71043 + if (atomic_read(&s->refcount) < 0)
71044 return 1;
71045
71046 return 0;
71047 @@ -3408,7 +3449,7 @@ struct kmem_cache *kmem_cache_create(con
71048 down_write(&slub_lock);
71049 s = find_mergeable(size, align, flags, name, ctor);
71050 if (s) {
71051 - s->refcount++;
71052 + atomic_inc(&s->refcount);
71053 /*
71054 * Adjust the object sizes so that we clear
71055 * the complete object on kzalloc.
71056 @@ -3417,7 +3458,7 @@ struct kmem_cache *kmem_cache_create(con
71057 s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
71058
71059 if (sysfs_slab_alias(s, name)) {
71060 - s->refcount--;
71061 + atomic_dec(&s->refcount);
71062 goto err;
71063 }
71064 up_write(&slub_lock);
71065 @@ -3545,7 +3586,7 @@ void *__kmalloc_node_track_caller(size_t
71066 }
71067 #endif
71068
71069 -#ifdef CONFIG_SYSFS
71070 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
71071 static int count_inuse(struct page *page)
71072 {
71073 return page->inuse;
71074 @@ -3935,12 +3976,12 @@ static void resiliency_test(void)
71075 validate_slab_cache(kmalloc_caches[9]);
71076 }
71077 #else
71078 -#ifdef CONFIG_SYSFS
71079 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
71080 static void resiliency_test(void) {};
71081 #endif
71082 #endif
71083
71084 -#ifdef CONFIG_SYSFS
71085 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
71086 enum slab_stat_type {
71087 SL_ALL, /* All slabs */
71088 SL_PARTIAL, /* Only partially allocated slabs */
71089 @@ -4150,7 +4191,7 @@ SLAB_ATTR_RO(ctor);
71090
71091 static ssize_t aliases_show(struct kmem_cache *s, char *buf)
71092 {
71093 - return sprintf(buf, "%d\n", s->refcount - 1);
71094 + return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
71095 }
71096 SLAB_ATTR_RO(aliases);
71097
71098 @@ -4662,6 +4703,7 @@ static char *create_unique_id(struct kme
71099 return name;
71100 }
71101
71102 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
71103 static int sysfs_slab_add(struct kmem_cache *s)
71104 {
71105 int err;
71106 @@ -4724,6 +4766,7 @@ static void sysfs_slab_remove(struct kme
71107 kobject_del(&s->kobj);
71108 kobject_put(&s->kobj);
71109 }
71110 +#endif
71111
71112 /*
71113 * Need to buffer aliases during bootup until sysfs becomes
71114 @@ -4737,6 +4780,7 @@ struct saved_alias {
71115
71116 static struct saved_alias *alias_list;
71117
71118 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
71119 static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
71120 {
71121 struct saved_alias *al;
71122 @@ -4759,6 +4803,7 @@ static int sysfs_slab_alias(struct kmem_
71123 alias_list = al;
71124 return 0;
71125 }
71126 +#endif
71127
71128 static int __init slab_sysfs_init(void)
71129 {
71130 @@ -4894,7 +4939,13 @@ static const struct file_operations proc
71131
71132 static int __init slab_proc_init(void)
71133 {
71134 - proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
71135 + mode_t gr_mode = S_IRUGO;
71136 +
71137 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
71138 + gr_mode = S_IRUSR;
71139 +#endif
71140 +
71141 + proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
71142 return 0;
71143 }
71144 module_init(slab_proc_init);
71145 diff -urNp linux-3.0.9/mm/swap.c linux-3.0.9/mm/swap.c
71146 --- linux-3.0.9/mm/swap.c 2011-11-11 13:12:24.000000000 -0500
71147 +++ linux-3.0.9/mm/swap.c 2011-11-15 20:03:00.000000000 -0500
71148 @@ -31,6 +31,7 @@
71149 #include <linux/backing-dev.h>
71150 #include <linux/memcontrol.h>
71151 #include <linux/gfp.h>
71152 +#include <linux/hugetlb.h>
71153
71154 #include "internal.h"
71155
71156 @@ -71,6 +72,8 @@ static void __put_compound_page(struct p
71157
71158 __page_cache_release(page);
71159 dtor = get_compound_page_dtor(page);
71160 + if (!PageHuge(page))
71161 + BUG_ON(dtor != free_compound_page);
71162 (*dtor)(page);
71163 }
71164
71165 diff -urNp linux-3.0.9/mm/swapfile.c linux-3.0.9/mm/swapfile.c
71166 --- linux-3.0.9/mm/swapfile.c 2011-11-11 13:12:24.000000000 -0500
71167 +++ linux-3.0.9/mm/swapfile.c 2011-11-15 20:03:00.000000000 -0500
71168 @@ -62,7 +62,7 @@ static DEFINE_MUTEX(swapon_mutex);
71169
71170 static DECLARE_WAIT_QUEUE_HEAD(proc_poll_wait);
71171 /* Activity counter to indicate that a swapon or swapoff has occurred */
71172 -static atomic_t proc_poll_event = ATOMIC_INIT(0);
71173 +static atomic_unchecked_t proc_poll_event = ATOMIC_INIT(0);
71174
71175 static inline unsigned char swap_count(unsigned char ent)
71176 {
71177 @@ -1671,7 +1671,7 @@ SYSCALL_DEFINE1(swapoff, const char __us
71178 }
71179 filp_close(swap_file, NULL);
71180 err = 0;
71181 - atomic_inc(&proc_poll_event);
71182 + atomic_inc_unchecked(&proc_poll_event);
71183 wake_up_interruptible(&proc_poll_wait);
71184
71185 out_dput:
71186 @@ -1692,8 +1692,8 @@ static unsigned swaps_poll(struct file *
71187
71188 poll_wait(file, &proc_poll_wait, wait);
71189
71190 - if (s->event != atomic_read(&proc_poll_event)) {
71191 - s->event = atomic_read(&proc_poll_event);
71192 + if (s->event != atomic_read_unchecked(&proc_poll_event)) {
71193 + s->event = atomic_read_unchecked(&proc_poll_event);
71194 return POLLIN | POLLRDNORM | POLLERR | POLLPRI;
71195 }
71196
71197 @@ -1799,7 +1799,7 @@ static int swaps_open(struct inode *inod
71198 }
71199
71200 s->seq.private = s;
71201 - s->event = atomic_read(&proc_poll_event);
71202 + s->event = atomic_read_unchecked(&proc_poll_event);
71203 return ret;
71204 }
71205
71206 @@ -2133,7 +2133,7 @@ SYSCALL_DEFINE2(swapon, const char __use
71207 (p->flags & SWP_DISCARDABLE) ? "D" : "");
71208
71209 mutex_unlock(&swapon_mutex);
71210 - atomic_inc(&proc_poll_event);
71211 + atomic_inc_unchecked(&proc_poll_event);
71212 wake_up_interruptible(&proc_poll_wait);
71213
71214 if (S_ISREG(inode->i_mode))
71215 diff -urNp linux-3.0.9/mm/util.c linux-3.0.9/mm/util.c
71216 --- linux-3.0.9/mm/util.c 2011-11-11 13:12:24.000000000 -0500
71217 +++ linux-3.0.9/mm/util.c 2011-11-15 20:03:00.000000000 -0500
71218 @@ -114,6 +114,7 @@ EXPORT_SYMBOL(memdup_user);
71219 * allocated buffer. Use this if you don't want to free the buffer immediately
71220 * like, for example, with RCU.
71221 */
71222 +#undef __krealloc
71223 void *__krealloc(const void *p, size_t new_size, gfp_t flags)
71224 {
71225 void *ret;
71226 @@ -147,6 +148,7 @@ EXPORT_SYMBOL(__krealloc);
71227 * behaves exactly like kmalloc(). If @size is 0 and @p is not a
71228 * %NULL pointer, the object pointed to is freed.
71229 */
71230 +#undef krealloc
71231 void *krealloc(const void *p, size_t new_size, gfp_t flags)
71232 {
71233 void *ret;
71234 @@ -243,6 +245,12 @@ void __vma_link_list(struct mm_struct *m
71235 void arch_pick_mmap_layout(struct mm_struct *mm)
71236 {
71237 mm->mmap_base = TASK_UNMAPPED_BASE;
71238 +
71239 +#ifdef CONFIG_PAX_RANDMMAP
71240 + if (mm->pax_flags & MF_PAX_RANDMMAP)
71241 + mm->mmap_base += mm->delta_mmap;
71242 +#endif
71243 +
71244 mm->get_unmapped_area = arch_get_unmapped_area;
71245 mm->unmap_area = arch_unmap_area;
71246 }
71247 diff -urNp linux-3.0.9/mm/vmalloc.c linux-3.0.9/mm/vmalloc.c
71248 --- linux-3.0.9/mm/vmalloc.c 2011-11-11 13:12:24.000000000 -0500
71249 +++ linux-3.0.9/mm/vmalloc.c 2011-11-16 18:00:19.000000000 -0500
71250 @@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd,
71251
71252 pte = pte_offset_kernel(pmd, addr);
71253 do {
71254 - pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
71255 - WARN_ON(!pte_none(ptent) && !pte_present(ptent));
71256 +
71257 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
71258 + if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
71259 + BUG_ON(!pte_exec(*pte));
71260 + set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
71261 + continue;
71262 + }
71263 +#endif
71264 +
71265 + {
71266 + pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
71267 + WARN_ON(!pte_none(ptent) && !pte_present(ptent));
71268 + }
71269 } while (pte++, addr += PAGE_SIZE, addr != end);
71270 }
71271
71272 @@ -91,6 +102,7 @@ static int vmap_pte_range(pmd_t *pmd, un
71273 unsigned long end, pgprot_t prot, struct page **pages, int *nr)
71274 {
71275 pte_t *pte;
71276 + int ret = -ENOMEM;
71277
71278 /*
71279 * nr is a running index into the array which helps higher level
71280 @@ -100,17 +112,30 @@ static int vmap_pte_range(pmd_t *pmd, un
71281 pte = pte_alloc_kernel(pmd, addr);
71282 if (!pte)
71283 return -ENOMEM;
71284 +
71285 + pax_open_kernel();
71286 do {
71287 struct page *page = pages[*nr];
71288
71289 - if (WARN_ON(!pte_none(*pte)))
71290 - return -EBUSY;
71291 - if (WARN_ON(!page))
71292 - return -ENOMEM;
71293 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
71294 + if (pgprot_val(prot) & _PAGE_NX)
71295 +#endif
71296 +
71297 + if (WARN_ON(!pte_none(*pte))) {
71298 + ret = -EBUSY;
71299 + goto out;
71300 + }
71301 + if (WARN_ON(!page)) {
71302 + ret = -ENOMEM;
71303 + goto out;
71304 + }
71305 set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
71306 (*nr)++;
71307 } while (pte++, addr += PAGE_SIZE, addr != end);
71308 - return 0;
71309 + ret = 0;
71310 +out:
71311 + pax_close_kernel();
71312 + return ret;
71313 }
71314
71315 static int vmap_pmd_range(pud_t *pud, unsigned long addr,
71316 @@ -191,11 +216,20 @@ int is_vmalloc_or_module_addr(const void
71317 * and fall back on vmalloc() if that fails. Others
71318 * just put it in the vmalloc space.
71319 */
71320 -#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
71321 +#ifdef CONFIG_MODULES
71322 +#ifdef MODULES_VADDR
71323 unsigned long addr = (unsigned long)x;
71324 if (addr >= MODULES_VADDR && addr < MODULES_END)
71325 return 1;
71326 #endif
71327 +
71328 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
71329 + if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
71330 + return 1;
71331 +#endif
71332 +
71333 +#endif
71334 +
71335 return is_vmalloc_addr(x);
71336 }
71337
71338 @@ -216,8 +250,14 @@ struct page *vmalloc_to_page(const void
71339
71340 if (!pgd_none(*pgd)) {
71341 pud_t *pud = pud_offset(pgd, addr);
71342 +#ifdef CONFIG_X86
71343 + if (!pud_large(*pud))
71344 +#endif
71345 if (!pud_none(*pud)) {
71346 pmd_t *pmd = pmd_offset(pud, addr);
71347 +#ifdef CONFIG_X86
71348 + if (!pmd_large(*pmd))
71349 +#endif
71350 if (!pmd_none(*pmd)) {
71351 pte_t *ptep, pte;
71352
71353 @@ -1308,6 +1348,16 @@ static struct vm_struct *__get_vm_area_n
71354 struct vm_struct *area;
71355
71356 BUG_ON(in_interrupt());
71357 +
71358 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
71359 + if (flags & VM_KERNEXEC) {
71360 + if (start != VMALLOC_START || end != VMALLOC_END)
71361 + return NULL;
71362 + start = (unsigned long)MODULES_EXEC_VADDR;
71363 + end = (unsigned long)MODULES_EXEC_END;
71364 + }
71365 +#endif
71366 +
71367 if (flags & VM_IOREMAP) {
71368 int bit = fls(size);
71369
71370 @@ -1540,6 +1590,11 @@ void *vmap(struct page **pages, unsigned
71371 if (count > totalram_pages)
71372 return NULL;
71373
71374 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
71375 + if (!(pgprot_val(prot) & _PAGE_NX))
71376 + flags |= VM_KERNEXEC;
71377 +#endif
71378 +
71379 area = get_vm_area_caller((count << PAGE_SHIFT), flags,
71380 __builtin_return_address(0));
71381 if (!area)
71382 @@ -1641,6 +1696,13 @@ void *__vmalloc_node_range(unsigned long
71383 if (!size || (size >> PAGE_SHIFT) > totalram_pages)
71384 return NULL;
71385
71386 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
71387 + if (!(pgprot_val(prot) & _PAGE_NX))
71388 + area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST | VM_KERNEXEC, VMALLOC_START, VMALLOC_END,
71389 + node, gfp_mask, caller);
71390 + else
71391 +#endif
71392 +
71393 area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST,
71394 start, end, node, gfp_mask, caller);
71395
71396 @@ -1686,6 +1748,7 @@ static void *__vmalloc_node(unsigned lon
71397 gfp_mask, prot, node, caller);
71398 }
71399
71400 +#undef __vmalloc
71401 void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
71402 {
71403 return __vmalloc_node(size, 1, gfp_mask, prot, -1,
71404 @@ -1709,6 +1772,7 @@ static inline void *__vmalloc_node_flags
71405 * For tight control over page level allocator and protection flags
71406 * use __vmalloc() instead.
71407 */
71408 +#undef vmalloc
71409 void *vmalloc(unsigned long size)
71410 {
71411 return __vmalloc_node_flags(size, -1, GFP_KERNEL | __GFP_HIGHMEM);
71412 @@ -1725,6 +1789,7 @@ EXPORT_SYMBOL(vmalloc);
71413 * For tight control over page level allocator and protection flags
71414 * use __vmalloc() instead.
71415 */
71416 +#undef vzalloc
71417 void *vzalloc(unsigned long size)
71418 {
71419 return __vmalloc_node_flags(size, -1,
71420 @@ -1739,6 +1804,7 @@ EXPORT_SYMBOL(vzalloc);
71421 * The resulting memory area is zeroed so it can be mapped to userspace
71422 * without leaking data.
71423 */
71424 +#undef vmalloc_user
71425 void *vmalloc_user(unsigned long size)
71426 {
71427 struct vm_struct *area;
71428 @@ -1766,6 +1832,7 @@ EXPORT_SYMBOL(vmalloc_user);
71429 * For tight control over page level allocator and protection flags
71430 * use __vmalloc() instead.
71431 */
71432 +#undef vmalloc_node
71433 void *vmalloc_node(unsigned long size, int node)
71434 {
71435 return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
71436 @@ -1785,6 +1852,7 @@ EXPORT_SYMBOL(vmalloc_node);
71437 * For tight control over page level allocator and protection flags
71438 * use __vmalloc_node() instead.
71439 */
71440 +#undef vzalloc_node
71441 void *vzalloc_node(unsigned long size, int node)
71442 {
71443 return __vmalloc_node_flags(size, node,
71444 @@ -1807,10 +1875,10 @@ EXPORT_SYMBOL(vzalloc_node);
71445 * For tight control over page level allocator and protection flags
71446 * use __vmalloc() instead.
71447 */
71448 -
71449 +#undef vmalloc_exec
71450 void *vmalloc_exec(unsigned long size)
71451 {
71452 - return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
71453 + return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
71454 -1, __builtin_return_address(0));
71455 }
71456
71457 @@ -1829,6 +1897,7 @@ void *vmalloc_exec(unsigned long size)
71458 * Allocate enough 32bit PA addressable pages to cover @size from the
71459 * page level allocator and map them into contiguous kernel virtual space.
71460 */
71461 +#undef vmalloc_32
71462 void *vmalloc_32(unsigned long size)
71463 {
71464 return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
71465 @@ -1843,6 +1912,7 @@ EXPORT_SYMBOL(vmalloc_32);
71466 * The resulting memory area is 32bit addressable and zeroed so it can be
71467 * mapped to userspace without leaking data.
71468 */
71469 +#undef vmalloc_32_user
71470 void *vmalloc_32_user(unsigned long size)
71471 {
71472 struct vm_struct *area;
71473 @@ -2105,6 +2175,8 @@ int remap_vmalloc_range(struct vm_area_s
71474 unsigned long uaddr = vma->vm_start;
71475 unsigned long usize = vma->vm_end - vma->vm_start;
71476
71477 + BUG_ON(vma->vm_mirror);
71478 +
71479 if ((PAGE_SIZE-1) & (unsigned long)addr)
71480 return -EINVAL;
71481
71482 diff -urNp linux-3.0.9/mm/vmstat.c linux-3.0.9/mm/vmstat.c
71483 --- linux-3.0.9/mm/vmstat.c 2011-11-11 13:12:24.000000000 -0500
71484 +++ linux-3.0.9/mm/vmstat.c 2011-11-15 20:03:00.000000000 -0500
71485 @@ -78,7 +78,7 @@ void vm_events_fold_cpu(int cpu)
71486 *
71487 * vm_stat contains the global counters
71488 */
71489 -atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
71490 +atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
71491 EXPORT_SYMBOL(vm_stat);
71492
71493 #ifdef CONFIG_SMP
71494 @@ -454,7 +454,7 @@ void refresh_cpu_vm_stats(int cpu)
71495 v = p->vm_stat_diff[i];
71496 p->vm_stat_diff[i] = 0;
71497 local_irq_restore(flags);
71498 - atomic_long_add(v, &zone->vm_stat[i]);
71499 + atomic_long_add_unchecked(v, &zone->vm_stat[i]);
71500 global_diff[i] += v;
71501 #ifdef CONFIG_NUMA
71502 /* 3 seconds idle till flush */
71503 @@ -492,7 +492,7 @@ void refresh_cpu_vm_stats(int cpu)
71504
71505 for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
71506 if (global_diff[i])
71507 - atomic_long_add(global_diff[i], &vm_stat[i]);
71508 + atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
71509 }
71510
71511 #endif
71512 @@ -1207,10 +1207,20 @@ static int __init setup_vmstat(void)
71513 start_cpu_timer(cpu);
71514 #endif
71515 #ifdef CONFIG_PROC_FS
71516 - proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
71517 - proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
71518 - proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
71519 - proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
71520 + {
71521 + mode_t gr_mode = S_IRUGO;
71522 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
71523 + gr_mode = S_IRUSR;
71524 +#endif
71525 + proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
71526 + proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
71527 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
71528 + proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
71529 +#else
71530 + proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
71531 +#endif
71532 + proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
71533 + }
71534 #endif
71535 return 0;
71536 }
71537 diff -urNp linux-3.0.9/net/8021q/vlan.c linux-3.0.9/net/8021q/vlan.c
71538 --- linux-3.0.9/net/8021q/vlan.c 2011-11-11 13:12:24.000000000 -0500
71539 +++ linux-3.0.9/net/8021q/vlan.c 2011-11-15 20:03:00.000000000 -0500
71540 @@ -591,8 +591,7 @@ static int vlan_ioctl_handler(struct net
71541 err = -EPERM;
71542 if (!capable(CAP_NET_ADMIN))
71543 break;
71544 - if ((args.u.name_type >= 0) &&
71545 - (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
71546 + if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
71547 struct vlan_net *vn;
71548
71549 vn = net_generic(net, vlan_net_id);
71550 diff -urNp linux-3.0.9/net/9p/trans_fd.c linux-3.0.9/net/9p/trans_fd.c
71551 --- linux-3.0.9/net/9p/trans_fd.c 2011-11-11 13:12:24.000000000 -0500
71552 +++ linux-3.0.9/net/9p/trans_fd.c 2011-11-15 20:03:00.000000000 -0500
71553 @@ -423,7 +423,7 @@ static int p9_fd_write(struct p9_client
71554 oldfs = get_fs();
71555 set_fs(get_ds());
71556 /* The cast to a user pointer is valid due to the set_fs() */
71557 - ret = vfs_write(ts->wr, (__force void __user *)v, len, &ts->wr->f_pos);
71558 + ret = vfs_write(ts->wr, (void __force_user *)v, len, &ts->wr->f_pos);
71559 set_fs(oldfs);
71560
71561 if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN)
71562 diff -urNp linux-3.0.9/net/9p/trans_virtio.c linux-3.0.9/net/9p/trans_virtio.c
71563 --- linux-3.0.9/net/9p/trans_virtio.c 2011-11-11 13:12:24.000000000 -0500
71564 +++ linux-3.0.9/net/9p/trans_virtio.c 2011-11-15 20:03:00.000000000 -0500
71565 @@ -327,7 +327,7 @@ req_retry_pinned:
71566 } else {
71567 char *pbuf;
71568 if (req->tc->pubuf)
71569 - pbuf = (__force char *) req->tc->pubuf;
71570 + pbuf = (char __force_kernel *) req->tc->pubuf;
71571 else
71572 pbuf = req->tc->pkbuf;
71573 outp = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, pbuf,
71574 @@ -357,7 +357,7 @@ req_retry_pinned:
71575 } else {
71576 char *pbuf;
71577 if (req->tc->pubuf)
71578 - pbuf = (__force char *) req->tc->pubuf;
71579 + pbuf = (char __force_kernel *) req->tc->pubuf;
71580 else
71581 pbuf = req->tc->pkbuf;
71582
71583 diff -urNp linux-3.0.9/net/atm/atm_misc.c linux-3.0.9/net/atm/atm_misc.c
71584 --- linux-3.0.9/net/atm/atm_misc.c 2011-11-11 13:12:24.000000000 -0500
71585 +++ linux-3.0.9/net/atm/atm_misc.c 2011-11-15 20:03:00.000000000 -0500
71586 @@ -17,7 +17,7 @@ int atm_charge(struct atm_vcc *vcc, int
71587 if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
71588 return 1;
71589 atm_return(vcc, truesize);
71590 - atomic_inc(&vcc->stats->rx_drop);
71591 + atomic_inc_unchecked(&vcc->stats->rx_drop);
71592 return 0;
71593 }
71594 EXPORT_SYMBOL(atm_charge);
71595 @@ -39,7 +39,7 @@ struct sk_buff *atm_alloc_charge(struct
71596 }
71597 }
71598 atm_return(vcc, guess);
71599 - atomic_inc(&vcc->stats->rx_drop);
71600 + atomic_inc_unchecked(&vcc->stats->rx_drop);
71601 return NULL;
71602 }
71603 EXPORT_SYMBOL(atm_alloc_charge);
71604 @@ -86,7 +86,7 @@ EXPORT_SYMBOL(atm_pcr_goal);
71605
71606 void sonet_copy_stats(struct k_sonet_stats *from, struct sonet_stats *to)
71607 {
71608 -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
71609 +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
71610 __SONET_ITEMS
71611 #undef __HANDLE_ITEM
71612 }
71613 @@ -94,7 +94,7 @@ EXPORT_SYMBOL(sonet_copy_stats);
71614
71615 void sonet_subtract_stats(struct k_sonet_stats *from, struct sonet_stats *to)
71616 {
71617 -#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
71618 +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
71619 __SONET_ITEMS
71620 #undef __HANDLE_ITEM
71621 }
71622 diff -urNp linux-3.0.9/net/atm/lec.h linux-3.0.9/net/atm/lec.h
71623 --- linux-3.0.9/net/atm/lec.h 2011-11-11 13:12:24.000000000 -0500
71624 +++ linux-3.0.9/net/atm/lec.h 2011-11-15 20:03:00.000000000 -0500
71625 @@ -48,7 +48,7 @@ struct lane2_ops {
71626 const u8 *tlvs, u32 sizeoftlvs);
71627 void (*associate_indicator) (struct net_device *dev, const u8 *mac_addr,
71628 const u8 *tlvs, u32 sizeoftlvs);
71629 -};
71630 +} __no_const;
71631
71632 /*
71633 * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
71634 diff -urNp linux-3.0.9/net/atm/mpc.h linux-3.0.9/net/atm/mpc.h
71635 --- linux-3.0.9/net/atm/mpc.h 2011-11-11 13:12:24.000000000 -0500
71636 +++ linux-3.0.9/net/atm/mpc.h 2011-11-15 20:03:00.000000000 -0500
71637 @@ -33,7 +33,7 @@ struct mpoa_client {
71638 struct mpc_parameters parameters; /* parameters for this client */
71639
71640 const struct net_device_ops *old_ops;
71641 - struct net_device_ops new_ops;
71642 + net_device_ops_no_const new_ops;
71643 };
71644
71645
71646 diff -urNp linux-3.0.9/net/atm/mpoa_caches.c linux-3.0.9/net/atm/mpoa_caches.c
71647 --- linux-3.0.9/net/atm/mpoa_caches.c 2011-11-11 13:12:24.000000000 -0500
71648 +++ linux-3.0.9/net/atm/mpoa_caches.c 2011-11-15 20:03:00.000000000 -0500
71649 @@ -255,6 +255,8 @@ static void check_resolving_entries(stru
71650 struct timeval now;
71651 struct k_message msg;
71652
71653 + pax_track_stack();
71654 +
71655 do_gettimeofday(&now);
71656
71657 read_lock_bh(&client->ingress_lock);
71658 diff -urNp linux-3.0.9/net/atm/proc.c linux-3.0.9/net/atm/proc.c
71659 --- linux-3.0.9/net/atm/proc.c 2011-11-11 13:12:24.000000000 -0500
71660 +++ linux-3.0.9/net/atm/proc.c 2011-11-15 20:03:00.000000000 -0500
71661 @@ -45,9 +45,9 @@ static void add_stats(struct seq_file *s
71662 const struct k_atm_aal_stats *stats)
71663 {
71664 seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
71665 - atomic_read(&stats->tx), atomic_read(&stats->tx_err),
71666 - atomic_read(&stats->rx), atomic_read(&stats->rx_err),
71667 - atomic_read(&stats->rx_drop));
71668 + atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
71669 + atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
71670 + atomic_read_unchecked(&stats->rx_drop));
71671 }
71672
71673 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
71674 diff -urNp linux-3.0.9/net/atm/resources.c linux-3.0.9/net/atm/resources.c
71675 --- linux-3.0.9/net/atm/resources.c 2011-11-11 13:12:24.000000000 -0500
71676 +++ linux-3.0.9/net/atm/resources.c 2011-11-15 20:03:00.000000000 -0500
71677 @@ -160,7 +160,7 @@ EXPORT_SYMBOL(atm_dev_deregister);
71678 static void copy_aal_stats(struct k_atm_aal_stats *from,
71679 struct atm_aal_stats *to)
71680 {
71681 -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
71682 +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
71683 __AAL_STAT_ITEMS
71684 #undef __HANDLE_ITEM
71685 }
71686 @@ -168,7 +168,7 @@ static void copy_aal_stats(struct k_atm_
71687 static void subtract_aal_stats(struct k_atm_aal_stats *from,
71688 struct atm_aal_stats *to)
71689 {
71690 -#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
71691 +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
71692 __AAL_STAT_ITEMS
71693 #undef __HANDLE_ITEM
71694 }
71695 diff -urNp linux-3.0.9/net/batman-adv/hard-interface.c linux-3.0.9/net/batman-adv/hard-interface.c
71696 --- linux-3.0.9/net/batman-adv/hard-interface.c 2011-11-11 13:12:24.000000000 -0500
71697 +++ linux-3.0.9/net/batman-adv/hard-interface.c 2011-11-15 20:03:00.000000000 -0500
71698 @@ -351,8 +351,8 @@ int hardif_enable_interface(struct hard_
71699 hard_iface->batman_adv_ptype.dev = hard_iface->net_dev;
71700 dev_add_pack(&hard_iface->batman_adv_ptype);
71701
71702 - atomic_set(&hard_iface->seqno, 1);
71703 - atomic_set(&hard_iface->frag_seqno, 1);
71704 + atomic_set_unchecked(&hard_iface->seqno, 1);
71705 + atomic_set_unchecked(&hard_iface->frag_seqno, 1);
71706 bat_info(hard_iface->soft_iface, "Adding interface: %s\n",
71707 hard_iface->net_dev->name);
71708
71709 diff -urNp linux-3.0.9/net/batman-adv/routing.c linux-3.0.9/net/batman-adv/routing.c
71710 --- linux-3.0.9/net/batman-adv/routing.c 2011-11-11 13:12:24.000000000 -0500
71711 +++ linux-3.0.9/net/batman-adv/routing.c 2011-11-15 20:03:00.000000000 -0500
71712 @@ -627,7 +627,7 @@ void receive_bat_packet(struct ethhdr *e
71713 return;
71714
71715 /* could be changed by schedule_own_packet() */
71716 - if_incoming_seqno = atomic_read(&if_incoming->seqno);
71717 + if_incoming_seqno = atomic_read_unchecked(&if_incoming->seqno);
71718
71719 has_directlink_flag = (batman_packet->flags & DIRECTLINK ? 1 : 0);
71720
71721 diff -urNp linux-3.0.9/net/batman-adv/send.c linux-3.0.9/net/batman-adv/send.c
71722 --- linux-3.0.9/net/batman-adv/send.c 2011-11-11 13:12:24.000000000 -0500
71723 +++ linux-3.0.9/net/batman-adv/send.c 2011-11-15 20:03:00.000000000 -0500
71724 @@ -279,7 +279,7 @@ void schedule_own_packet(struct hard_ifa
71725
71726 /* change sequence number to network order */
71727 batman_packet->seqno =
71728 - htonl((uint32_t)atomic_read(&hard_iface->seqno));
71729 + htonl((uint32_t)atomic_read_unchecked(&hard_iface->seqno));
71730
71731 if (vis_server == VIS_TYPE_SERVER_SYNC)
71732 batman_packet->flags |= VIS_SERVER;
71733 @@ -293,7 +293,7 @@ void schedule_own_packet(struct hard_ifa
71734 else
71735 batman_packet->gw_flags = 0;
71736
71737 - atomic_inc(&hard_iface->seqno);
71738 + atomic_inc_unchecked(&hard_iface->seqno);
71739
71740 slide_own_bcast_window(hard_iface);
71741 send_time = own_send_time(bat_priv);
71742 diff -urNp linux-3.0.9/net/batman-adv/soft-interface.c linux-3.0.9/net/batman-adv/soft-interface.c
71743 --- linux-3.0.9/net/batman-adv/soft-interface.c 2011-11-11 13:12:24.000000000 -0500
71744 +++ linux-3.0.9/net/batman-adv/soft-interface.c 2011-11-15 20:03:00.000000000 -0500
71745 @@ -628,7 +628,7 @@ int interface_tx(struct sk_buff *skb, st
71746
71747 /* set broadcast sequence number */
71748 bcast_packet->seqno =
71749 - htonl(atomic_inc_return(&bat_priv->bcast_seqno));
71750 + htonl(atomic_inc_return_unchecked(&bat_priv->bcast_seqno));
71751
71752 add_bcast_packet_to_list(bat_priv, skb);
71753
71754 @@ -830,7 +830,7 @@ struct net_device *softif_create(char *n
71755 atomic_set(&bat_priv->batman_queue_left, BATMAN_QUEUE_LEN);
71756
71757 atomic_set(&bat_priv->mesh_state, MESH_INACTIVE);
71758 - atomic_set(&bat_priv->bcast_seqno, 1);
71759 + atomic_set_unchecked(&bat_priv->bcast_seqno, 1);
71760 atomic_set(&bat_priv->tt_local_changed, 0);
71761
71762 bat_priv->primary_if = NULL;
71763 diff -urNp linux-3.0.9/net/batman-adv/types.h linux-3.0.9/net/batman-adv/types.h
71764 --- linux-3.0.9/net/batman-adv/types.h 2011-11-11 13:12:24.000000000 -0500
71765 +++ linux-3.0.9/net/batman-adv/types.h 2011-11-15 20:03:00.000000000 -0500
71766 @@ -38,8 +38,8 @@ struct hard_iface {
71767 int16_t if_num;
71768 char if_status;
71769 struct net_device *net_dev;
71770 - atomic_t seqno;
71771 - atomic_t frag_seqno;
71772 + atomic_unchecked_t seqno;
71773 + atomic_unchecked_t frag_seqno;
71774 unsigned char *packet_buff;
71775 int packet_len;
71776 struct kobject *hardif_obj;
71777 @@ -142,7 +142,7 @@ struct bat_priv {
71778 atomic_t orig_interval; /* uint */
71779 atomic_t hop_penalty; /* uint */
71780 atomic_t log_level; /* uint */
71781 - atomic_t bcast_seqno;
71782 + atomic_unchecked_t bcast_seqno;
71783 atomic_t bcast_queue_left;
71784 atomic_t batman_queue_left;
71785 char num_ifaces;
71786 diff -urNp linux-3.0.9/net/batman-adv/unicast.c linux-3.0.9/net/batman-adv/unicast.c
71787 --- linux-3.0.9/net/batman-adv/unicast.c 2011-11-11 13:12:24.000000000 -0500
71788 +++ linux-3.0.9/net/batman-adv/unicast.c 2011-11-15 20:03:00.000000000 -0500
71789 @@ -265,7 +265,7 @@ int frag_send_skb(struct sk_buff *skb, s
71790 frag1->flags = UNI_FRAG_HEAD | large_tail;
71791 frag2->flags = large_tail;
71792
71793 - seqno = atomic_add_return(2, &hard_iface->frag_seqno);
71794 + seqno = atomic_add_return_unchecked(2, &hard_iface->frag_seqno);
71795 frag1->seqno = htons(seqno - 1);
71796 frag2->seqno = htons(seqno);
71797
71798 diff -urNp linux-3.0.9/net/bridge/br_multicast.c linux-3.0.9/net/bridge/br_multicast.c
71799 --- linux-3.0.9/net/bridge/br_multicast.c 2011-11-11 13:12:24.000000000 -0500
71800 +++ linux-3.0.9/net/bridge/br_multicast.c 2011-11-15 20:03:00.000000000 -0500
71801 @@ -1485,7 +1485,7 @@ static int br_multicast_ipv6_rcv(struct
71802 nexthdr = ip6h->nexthdr;
71803 offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr);
71804
71805 - if (offset < 0 || nexthdr != IPPROTO_ICMPV6)
71806 + if (nexthdr != IPPROTO_ICMPV6)
71807 return 0;
71808
71809 /* Okay, we found ICMPv6 header */
71810 diff -urNp linux-3.0.9/net/bridge/netfilter/ebtables.c linux-3.0.9/net/bridge/netfilter/ebtables.c
71811 --- linux-3.0.9/net/bridge/netfilter/ebtables.c 2011-11-11 13:12:24.000000000 -0500
71812 +++ linux-3.0.9/net/bridge/netfilter/ebtables.c 2011-11-15 20:03:00.000000000 -0500
71813 @@ -1512,7 +1512,7 @@ static int do_ebt_get_ctl(struct sock *s
71814 tmp.valid_hooks = t->table->valid_hooks;
71815 }
71816 mutex_unlock(&ebt_mutex);
71817 - if (copy_to_user(user, &tmp, *len) != 0){
71818 + if (*len > sizeof(tmp) || copy_to_user(user, &tmp, *len) != 0){
71819 BUGPRINT("c2u Didn't work\n");
71820 ret = -EFAULT;
71821 break;
71822 @@ -1780,6 +1780,8 @@ static int compat_copy_everything_to_use
71823 int ret;
71824 void __user *pos;
71825
71826 + pax_track_stack();
71827 +
71828 memset(&tinfo, 0, sizeof(tinfo));
71829
71830 if (cmd == EBT_SO_GET_ENTRIES) {
71831 diff -urNp linux-3.0.9/net/caif/caif_socket.c linux-3.0.9/net/caif/caif_socket.c
71832 --- linux-3.0.9/net/caif/caif_socket.c 2011-11-11 13:12:24.000000000 -0500
71833 +++ linux-3.0.9/net/caif/caif_socket.c 2011-11-15 20:03:00.000000000 -0500
71834 @@ -48,19 +48,20 @@ static struct dentry *debugfsdir;
71835 #ifdef CONFIG_DEBUG_FS
71836 struct debug_fs_counter {
71837 atomic_t caif_nr_socks;
71838 - atomic_t caif_sock_create;
71839 - atomic_t num_connect_req;
71840 - atomic_t num_connect_resp;
71841 - atomic_t num_connect_fail_resp;
71842 - atomic_t num_disconnect;
71843 - atomic_t num_remote_shutdown_ind;
71844 - atomic_t num_tx_flow_off_ind;
71845 - atomic_t num_tx_flow_on_ind;
71846 - atomic_t num_rx_flow_off;
71847 - atomic_t num_rx_flow_on;
71848 + atomic_unchecked_t caif_sock_create;
71849 + atomic_unchecked_t num_connect_req;
71850 + atomic_unchecked_t num_connect_resp;
71851 + atomic_unchecked_t num_connect_fail_resp;
71852 + atomic_unchecked_t num_disconnect;
71853 + atomic_unchecked_t num_remote_shutdown_ind;
71854 + atomic_unchecked_t num_tx_flow_off_ind;
71855 + atomic_unchecked_t num_tx_flow_on_ind;
71856 + atomic_unchecked_t num_rx_flow_off;
71857 + atomic_unchecked_t num_rx_flow_on;
71858 };
71859 static struct debug_fs_counter cnt;
71860 #define dbfs_atomic_inc(v) atomic_inc_return(v)
71861 +#define dbfs_atomic_inc_unchecked(v) atomic_inc_return_unchecked(v)
71862 #define dbfs_atomic_dec(v) atomic_dec_return(v)
71863 #else
71864 #define dbfs_atomic_inc(v) 0
71865 @@ -161,7 +162,7 @@ static int caif_queue_rcv_skb(struct soc
71866 atomic_read(&cf_sk->sk.sk_rmem_alloc),
71867 sk_rcvbuf_lowwater(cf_sk));
71868 set_rx_flow_off(cf_sk);
71869 - dbfs_atomic_inc(&cnt.num_rx_flow_off);
71870 + dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
71871 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
71872 }
71873
71874 @@ -172,7 +173,7 @@ static int caif_queue_rcv_skb(struct soc
71875 set_rx_flow_off(cf_sk);
71876 if (net_ratelimit())
71877 pr_debug("sending flow OFF due to rmem_schedule\n");
71878 - dbfs_atomic_inc(&cnt.num_rx_flow_off);
71879 + dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
71880 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
71881 }
71882 skb->dev = NULL;
71883 @@ -233,14 +234,14 @@ static void caif_ctrl_cb(struct cflayer
71884 switch (flow) {
71885 case CAIF_CTRLCMD_FLOW_ON_IND:
71886 /* OK from modem to start sending again */
71887 - dbfs_atomic_inc(&cnt.num_tx_flow_on_ind);
71888 + dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_on_ind);
71889 set_tx_flow_on(cf_sk);
71890 cf_sk->sk.sk_state_change(&cf_sk->sk);
71891 break;
71892
71893 case CAIF_CTRLCMD_FLOW_OFF_IND:
71894 /* Modem asks us to shut up */
71895 - dbfs_atomic_inc(&cnt.num_tx_flow_off_ind);
71896 + dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_off_ind);
71897 set_tx_flow_off(cf_sk);
71898 cf_sk->sk.sk_state_change(&cf_sk->sk);
71899 break;
71900 @@ -249,7 +250,7 @@ static void caif_ctrl_cb(struct cflayer
71901 /* We're now connected */
71902 caif_client_register_refcnt(&cf_sk->layer,
71903 cfsk_hold, cfsk_put);
71904 - dbfs_atomic_inc(&cnt.num_connect_resp);
71905 + dbfs_atomic_inc_unchecked(&cnt.num_connect_resp);
71906 cf_sk->sk.sk_state = CAIF_CONNECTED;
71907 set_tx_flow_on(cf_sk);
71908 cf_sk->sk.sk_state_change(&cf_sk->sk);
71909 @@ -263,7 +264,7 @@ static void caif_ctrl_cb(struct cflayer
71910
71911 case CAIF_CTRLCMD_INIT_FAIL_RSP:
71912 /* Connect request failed */
71913 - dbfs_atomic_inc(&cnt.num_connect_fail_resp);
71914 + dbfs_atomic_inc_unchecked(&cnt.num_connect_fail_resp);
71915 cf_sk->sk.sk_err = ECONNREFUSED;
71916 cf_sk->sk.sk_state = CAIF_DISCONNECTED;
71917 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
71918 @@ -277,7 +278,7 @@ static void caif_ctrl_cb(struct cflayer
71919
71920 case CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND:
71921 /* Modem has closed this connection, or device is down. */
71922 - dbfs_atomic_inc(&cnt.num_remote_shutdown_ind);
71923 + dbfs_atomic_inc_unchecked(&cnt.num_remote_shutdown_ind);
71924 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
71925 cf_sk->sk.sk_err = ECONNRESET;
71926 set_rx_flow_on(cf_sk);
71927 @@ -297,7 +298,7 @@ static void caif_check_flow_release(stru
71928 return;
71929
71930 if (atomic_read(&sk->sk_rmem_alloc) <= sk_rcvbuf_lowwater(cf_sk)) {
71931 - dbfs_atomic_inc(&cnt.num_rx_flow_on);
71932 + dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_on);
71933 set_rx_flow_on(cf_sk);
71934 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_ON_REQ);
71935 }
71936 @@ -854,7 +855,7 @@ static int caif_connect(struct socket *s
71937 /*ifindex = id of the interface.*/
71938 cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if;
71939
71940 - dbfs_atomic_inc(&cnt.num_connect_req);
71941 + dbfs_atomic_inc_unchecked(&cnt.num_connect_req);
71942 cf_sk->layer.receive = caif_sktrecv_cb;
71943
71944 err = caif_connect_client(sock_net(sk), &cf_sk->conn_req,
71945 @@ -943,7 +944,7 @@ static int caif_release(struct socket *s
71946 spin_unlock_bh(&sk->sk_receive_queue.lock);
71947 sock->sk = NULL;
71948
71949 - dbfs_atomic_inc(&cnt.num_disconnect);
71950 + dbfs_atomic_inc_unchecked(&cnt.num_disconnect);
71951
71952 WARN_ON(IS_ERR(cf_sk->debugfs_socket_dir));
71953 if (cf_sk->debugfs_socket_dir != NULL)
71954 @@ -1122,7 +1123,7 @@ static int caif_create(struct net *net,
71955 cf_sk->conn_req.protocol = protocol;
71956 /* Increase the number of sockets created. */
71957 dbfs_atomic_inc(&cnt.caif_nr_socks);
71958 - num = dbfs_atomic_inc(&cnt.caif_sock_create);
71959 + num = dbfs_atomic_inc_unchecked(&cnt.caif_sock_create);
71960 #ifdef CONFIG_DEBUG_FS
71961 if (!IS_ERR(debugfsdir)) {
71962
71963 diff -urNp linux-3.0.9/net/caif/cfctrl.c linux-3.0.9/net/caif/cfctrl.c
71964 --- linux-3.0.9/net/caif/cfctrl.c 2011-11-11 13:12:24.000000000 -0500
71965 +++ linux-3.0.9/net/caif/cfctrl.c 2011-11-15 20:03:00.000000000 -0500
71966 @@ -9,6 +9,7 @@
71967 #include <linux/stddef.h>
71968 #include <linux/spinlock.h>
71969 #include <linux/slab.h>
71970 +#include <linux/sched.h>
71971 #include <net/caif/caif_layer.h>
71972 #include <net/caif/cfpkt.h>
71973 #include <net/caif/cfctrl.h>
71974 @@ -45,8 +46,8 @@ struct cflayer *cfctrl_create(void)
71975 dev_info.id = 0xff;
71976 memset(this, 0, sizeof(*this));
71977 cfsrvl_init(&this->serv, 0, &dev_info, false);
71978 - atomic_set(&this->req_seq_no, 1);
71979 - atomic_set(&this->rsp_seq_no, 1);
71980 + atomic_set_unchecked(&this->req_seq_no, 1);
71981 + atomic_set_unchecked(&this->rsp_seq_no, 1);
71982 this->serv.layer.receive = cfctrl_recv;
71983 sprintf(this->serv.layer.name, "ctrl");
71984 this->serv.layer.ctrlcmd = cfctrl_ctrlcmd;
71985 @@ -132,8 +133,8 @@ static void cfctrl_insert_req(struct cfc
71986 struct cfctrl_request_info *req)
71987 {
71988 spin_lock_bh(&ctrl->info_list_lock);
71989 - atomic_inc(&ctrl->req_seq_no);
71990 - req->sequence_no = atomic_read(&ctrl->req_seq_no);
71991 + atomic_inc_unchecked(&ctrl->req_seq_no);
71992 + req->sequence_no = atomic_read_unchecked(&ctrl->req_seq_no);
71993 list_add_tail(&req->list, &ctrl->list);
71994 spin_unlock_bh(&ctrl->info_list_lock);
71995 }
71996 @@ -151,7 +152,7 @@ static struct cfctrl_request_info *cfctr
71997 if (p != first)
71998 pr_warn("Requests are not received in order\n");
71999
72000 - atomic_set(&ctrl->rsp_seq_no,
72001 + atomic_set_unchecked(&ctrl->rsp_seq_no,
72002 p->sequence_no);
72003 list_del(&p->list);
72004 goto out;
72005 @@ -364,6 +365,7 @@ static int cfctrl_recv(struct cflayer *l
72006 struct cfctrl *cfctrl = container_obj(layer);
72007 struct cfctrl_request_info rsp, *req;
72008
72009 + pax_track_stack();
72010
72011 cfpkt_extr_head(pkt, &cmdrsp, 1);
72012 cmd = cmdrsp & CFCTRL_CMD_MASK;
72013 diff -urNp linux-3.0.9/net/compat.c linux-3.0.9/net/compat.c
72014 --- linux-3.0.9/net/compat.c 2011-11-11 13:12:24.000000000 -0500
72015 +++ linux-3.0.9/net/compat.c 2011-11-15 20:03:00.000000000 -0500
72016 @@ -70,9 +70,9 @@ int get_compat_msghdr(struct msghdr *kms
72017 __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
72018 __get_user(kmsg->msg_flags, &umsg->msg_flags))
72019 return -EFAULT;
72020 - kmsg->msg_name = compat_ptr(tmp1);
72021 - kmsg->msg_iov = compat_ptr(tmp2);
72022 - kmsg->msg_control = compat_ptr(tmp3);
72023 + kmsg->msg_name = (void __force_kernel *)compat_ptr(tmp1);
72024 + kmsg->msg_iov = (void __force_kernel *)compat_ptr(tmp2);
72025 + kmsg->msg_control = (void __force_kernel *)compat_ptr(tmp3);
72026 return 0;
72027 }
72028
72029 @@ -84,7 +84,7 @@ int verify_compat_iovec(struct msghdr *k
72030
72031 if (kern_msg->msg_namelen) {
72032 if (mode == VERIFY_READ) {
72033 - int err = move_addr_to_kernel(kern_msg->msg_name,
72034 + int err = move_addr_to_kernel((void __force_user *)kern_msg->msg_name,
72035 kern_msg->msg_namelen,
72036 kern_address);
72037 if (err < 0)
72038 @@ -95,7 +95,7 @@ int verify_compat_iovec(struct msghdr *k
72039 kern_msg->msg_name = NULL;
72040
72041 tot_len = iov_from_user_compat_to_kern(kern_iov,
72042 - (struct compat_iovec __user *)kern_msg->msg_iov,
72043 + (struct compat_iovec __force_user *)kern_msg->msg_iov,
72044 kern_msg->msg_iovlen);
72045 if (tot_len >= 0)
72046 kern_msg->msg_iov = kern_iov;
72047 @@ -115,20 +115,20 @@ int verify_compat_iovec(struct msghdr *k
72048
72049 #define CMSG_COMPAT_FIRSTHDR(msg) \
72050 (((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ? \
72051 - (struct compat_cmsghdr __user *)((msg)->msg_control) : \
72052 + (struct compat_cmsghdr __force_user *)((msg)->msg_control) : \
72053 (struct compat_cmsghdr __user *)NULL)
72054
72055 #define CMSG_COMPAT_OK(ucmlen, ucmsg, mhdr) \
72056 ((ucmlen) >= sizeof(struct compat_cmsghdr) && \
72057 (ucmlen) <= (unsigned long) \
72058 ((mhdr)->msg_controllen - \
72059 - ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
72060 + ((char __force_kernel *)(ucmsg) - (char *)(mhdr)->msg_control)))
72061
72062 static inline struct compat_cmsghdr __user *cmsg_compat_nxthdr(struct msghdr *msg,
72063 struct compat_cmsghdr __user *cmsg, int cmsg_len)
72064 {
72065 char __user *ptr = (char __user *)cmsg + CMSG_COMPAT_ALIGN(cmsg_len);
72066 - if ((unsigned long)(ptr + 1 - (char __user *)msg->msg_control) >
72067 + if ((unsigned long)(ptr + 1 - (char __force_user *)msg->msg_control) >
72068 msg->msg_controllen)
72069 return NULL;
72070 return (struct compat_cmsghdr __user *)ptr;
72071 @@ -220,7 +220,7 @@ int put_cmsg_compat(struct msghdr *kmsg,
72072 {
72073 struct compat_timeval ctv;
72074 struct compat_timespec cts[3];
72075 - struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
72076 + struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
72077 struct compat_cmsghdr cmhdr;
72078 int cmlen;
72079
72080 @@ -272,7 +272,7 @@ int put_cmsg_compat(struct msghdr *kmsg,
72081
72082 void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
72083 {
72084 - struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
72085 + struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
72086 int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
72087 int fdnum = scm->fp->count;
72088 struct file **fp = scm->fp->fp;
72089 @@ -369,7 +369,7 @@ static int do_set_sock_timeout(struct so
72090 return -EFAULT;
72091 old_fs = get_fs();
72092 set_fs(KERNEL_DS);
72093 - err = sock_setsockopt(sock, level, optname, (char *)&ktime, sizeof(ktime));
72094 + err = sock_setsockopt(sock, level, optname, (char __force_user *)&ktime, sizeof(ktime));
72095 set_fs(old_fs);
72096
72097 return err;
72098 @@ -430,7 +430,7 @@ static int do_get_sock_timeout(struct so
72099 len = sizeof(ktime);
72100 old_fs = get_fs();
72101 set_fs(KERNEL_DS);
72102 - err = sock_getsockopt(sock, level, optname, (char *) &ktime, &len);
72103 + err = sock_getsockopt(sock, level, optname, (char __force_user *) &ktime, (int __force_user *)&len);
72104 set_fs(old_fs);
72105
72106 if (!err) {
72107 @@ -565,7 +565,7 @@ int compat_mc_setsockopt(struct sock *so
72108 case MCAST_JOIN_GROUP:
72109 case MCAST_LEAVE_GROUP:
72110 {
72111 - struct compat_group_req __user *gr32 = (void *)optval;
72112 + struct compat_group_req __user *gr32 = (void __user *)optval;
72113 struct group_req __user *kgr =
72114 compat_alloc_user_space(sizeof(struct group_req));
72115 u32 interface;
72116 @@ -586,7 +586,7 @@ int compat_mc_setsockopt(struct sock *so
72117 case MCAST_BLOCK_SOURCE:
72118 case MCAST_UNBLOCK_SOURCE:
72119 {
72120 - struct compat_group_source_req __user *gsr32 = (void *)optval;
72121 + struct compat_group_source_req __user *gsr32 = (void __user *)optval;
72122 struct group_source_req __user *kgsr = compat_alloc_user_space(
72123 sizeof(struct group_source_req));
72124 u32 interface;
72125 @@ -607,7 +607,7 @@ int compat_mc_setsockopt(struct sock *so
72126 }
72127 case MCAST_MSFILTER:
72128 {
72129 - struct compat_group_filter __user *gf32 = (void *)optval;
72130 + struct compat_group_filter __user *gf32 = (void __user *)optval;
72131 struct group_filter __user *kgf;
72132 u32 interface, fmode, numsrc;
72133
72134 @@ -645,7 +645,7 @@ int compat_mc_getsockopt(struct sock *so
72135 char __user *optval, int __user *optlen,
72136 int (*getsockopt)(struct sock *, int, int, char __user *, int __user *))
72137 {
72138 - struct compat_group_filter __user *gf32 = (void *)optval;
72139 + struct compat_group_filter __user *gf32 = (void __user *)optval;
72140 struct group_filter __user *kgf;
72141 int __user *koptlen;
72142 u32 interface, fmode, numsrc;
72143 diff -urNp linux-3.0.9/net/core/datagram.c linux-3.0.9/net/core/datagram.c
72144 --- linux-3.0.9/net/core/datagram.c 2011-11-11 13:12:24.000000000 -0500
72145 +++ linux-3.0.9/net/core/datagram.c 2011-11-15 20:03:00.000000000 -0500
72146 @@ -285,7 +285,7 @@ int skb_kill_datagram(struct sock *sk, s
72147 }
72148
72149 kfree_skb(skb);
72150 - atomic_inc(&sk->sk_drops);
72151 + atomic_inc_unchecked(&sk->sk_drops);
72152 sk_mem_reclaim_partial(sk);
72153
72154 return err;
72155 diff -urNp linux-3.0.9/net/core/dev.c linux-3.0.9/net/core/dev.c
72156 --- linux-3.0.9/net/core/dev.c 2011-11-11 13:12:24.000000000 -0500
72157 +++ linux-3.0.9/net/core/dev.c 2011-11-15 20:03:00.000000000 -0500
72158 @@ -1125,10 +1125,14 @@ void dev_load(struct net *net, const cha
72159 if (no_module && capable(CAP_NET_ADMIN))
72160 no_module = request_module("netdev-%s", name);
72161 if (no_module && capable(CAP_SYS_MODULE)) {
72162 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
72163 + ___request_module(true, "grsec_modharden_netdev", "%s", name);
72164 +#else
72165 if (!request_module("%s", name))
72166 pr_err("Loading kernel module for a network device "
72167 "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s "
72168 "instead\n", name);
72169 +#endif
72170 }
72171 }
72172 EXPORT_SYMBOL(dev_load);
72173 @@ -1959,7 +1963,7 @@ static int illegal_highdma(struct net_de
72174
72175 struct dev_gso_cb {
72176 void (*destructor)(struct sk_buff *skb);
72177 -};
72178 +} __no_const;
72179
72180 #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
72181
72182 @@ -2912,7 +2916,7 @@ int netif_rx_ni(struct sk_buff *skb)
72183 }
72184 EXPORT_SYMBOL(netif_rx_ni);
72185
72186 -static void net_tx_action(struct softirq_action *h)
72187 +static void net_tx_action(void)
72188 {
72189 struct softnet_data *sd = &__get_cpu_var(softnet_data);
72190
72191 @@ -3761,7 +3765,7 @@ void netif_napi_del(struct napi_struct *
72192 }
72193 EXPORT_SYMBOL(netif_napi_del);
72194
72195 -static void net_rx_action(struct softirq_action *h)
72196 +static void net_rx_action(void)
72197 {
72198 struct softnet_data *sd = &__get_cpu_var(softnet_data);
72199 unsigned long time_limit = jiffies + 2;
72200 diff -urNp linux-3.0.9/net/core/flow.c linux-3.0.9/net/core/flow.c
72201 --- linux-3.0.9/net/core/flow.c 2011-11-11 13:12:24.000000000 -0500
72202 +++ linux-3.0.9/net/core/flow.c 2011-11-15 20:03:00.000000000 -0500
72203 @@ -60,7 +60,7 @@ struct flow_cache {
72204 struct timer_list rnd_timer;
72205 };
72206
72207 -atomic_t flow_cache_genid = ATOMIC_INIT(0);
72208 +atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
72209 EXPORT_SYMBOL(flow_cache_genid);
72210 static struct flow_cache flow_cache_global;
72211 static struct kmem_cache *flow_cachep __read_mostly;
72212 @@ -85,7 +85,7 @@ static void flow_cache_new_hashrnd(unsig
72213
72214 static int flow_entry_valid(struct flow_cache_entry *fle)
72215 {
72216 - if (atomic_read(&flow_cache_genid) != fle->genid)
72217 + if (atomic_read_unchecked(&flow_cache_genid) != fle->genid)
72218 return 0;
72219 if (fle->object && !fle->object->ops->check(fle->object))
72220 return 0;
72221 @@ -256,7 +256,7 @@ flow_cache_lookup(struct net *net, const
72222 hlist_add_head(&fle->u.hlist, &fcp->hash_table[hash]);
72223 fcp->hash_count++;
72224 }
72225 - } else if (likely(fle->genid == atomic_read(&flow_cache_genid))) {
72226 + } else if (likely(fle->genid == atomic_read_unchecked(&flow_cache_genid))) {
72227 flo = fle->object;
72228 if (!flo)
72229 goto ret_object;
72230 @@ -277,7 +277,7 @@ nocache:
72231 }
72232 flo = resolver(net, key, family, dir, flo, ctx);
72233 if (fle) {
72234 - fle->genid = atomic_read(&flow_cache_genid);
72235 + fle->genid = atomic_read_unchecked(&flow_cache_genid);
72236 if (!IS_ERR(flo))
72237 fle->object = flo;
72238 else
72239 diff -urNp linux-3.0.9/net/core/iovec.c linux-3.0.9/net/core/iovec.c
72240 --- linux-3.0.9/net/core/iovec.c 2011-11-11 13:12:24.000000000 -0500
72241 +++ linux-3.0.9/net/core/iovec.c 2011-11-15 20:03:00.000000000 -0500
72242 @@ -42,7 +42,7 @@ int verify_iovec(struct msghdr *m, struc
72243 if (m->msg_namelen) {
72244 if (mode == VERIFY_READ) {
72245 void __user *namep;
72246 - namep = (void __user __force *) m->msg_name;
72247 + namep = (void __force_user *) m->msg_name;
72248 err = move_addr_to_kernel(namep, m->msg_namelen,
72249 address);
72250 if (err < 0)
72251 @@ -54,7 +54,7 @@ int verify_iovec(struct msghdr *m, struc
72252 }
72253
72254 size = m->msg_iovlen * sizeof(struct iovec);
72255 - if (copy_from_user(iov, (void __user __force *) m->msg_iov, size))
72256 + if (copy_from_user(iov, (void __force_user *) m->msg_iov, size))
72257 return -EFAULT;
72258
72259 m->msg_iov = iov;
72260 diff -urNp linux-3.0.9/net/core/rtnetlink.c linux-3.0.9/net/core/rtnetlink.c
72261 --- linux-3.0.9/net/core/rtnetlink.c 2011-11-11 13:12:24.000000000 -0500
72262 +++ linux-3.0.9/net/core/rtnetlink.c 2011-11-15 20:03:00.000000000 -0500
72263 @@ -56,7 +56,7 @@
72264 struct rtnl_link {
72265 rtnl_doit_func doit;
72266 rtnl_dumpit_func dumpit;
72267 -};
72268 +} __no_const;
72269
72270 static DEFINE_MUTEX(rtnl_mutex);
72271
72272 diff -urNp linux-3.0.9/net/core/scm.c linux-3.0.9/net/core/scm.c
72273 --- linux-3.0.9/net/core/scm.c 2011-11-11 13:12:24.000000000 -0500
72274 +++ linux-3.0.9/net/core/scm.c 2011-11-15 20:03:00.000000000 -0500
72275 @@ -218,7 +218,7 @@ EXPORT_SYMBOL(__scm_send);
72276 int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
72277 {
72278 struct cmsghdr __user *cm
72279 - = (__force struct cmsghdr __user *)msg->msg_control;
72280 + = (struct cmsghdr __force_user *)msg->msg_control;
72281 struct cmsghdr cmhdr;
72282 int cmlen = CMSG_LEN(len);
72283 int err;
72284 @@ -241,7 +241,7 @@ int put_cmsg(struct msghdr * msg, int le
72285 err = -EFAULT;
72286 if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
72287 goto out;
72288 - if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
72289 + if (copy_to_user((void __force_user *)CMSG_DATA((void __force_kernel *)cm), data, cmlen - sizeof(struct cmsghdr)))
72290 goto out;
72291 cmlen = CMSG_SPACE(len);
72292 if (msg->msg_controllen < cmlen)
72293 @@ -257,7 +257,7 @@ EXPORT_SYMBOL(put_cmsg);
72294 void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
72295 {
72296 struct cmsghdr __user *cm
72297 - = (__force struct cmsghdr __user*)msg->msg_control;
72298 + = (struct cmsghdr __force_user *)msg->msg_control;
72299
72300 int fdmax = 0;
72301 int fdnum = scm->fp->count;
72302 @@ -277,7 +277,7 @@ void scm_detach_fds(struct msghdr *msg,
72303 if (fdnum < fdmax)
72304 fdmax = fdnum;
72305
72306 - for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
72307 + for (i=0, cmfptr=(int __force_user *)CMSG_DATA((void __force_kernel *)cm); i<fdmax;
72308 i++, cmfptr++)
72309 {
72310 int new_fd;
72311 diff -urNp linux-3.0.9/net/core/skbuff.c linux-3.0.9/net/core/skbuff.c
72312 --- linux-3.0.9/net/core/skbuff.c 2011-11-11 13:12:24.000000000 -0500
72313 +++ linux-3.0.9/net/core/skbuff.c 2011-11-15 20:03:00.000000000 -0500
72314 @@ -1543,6 +1543,8 @@ int skb_splice_bits(struct sk_buff *skb,
72315 struct sock *sk = skb->sk;
72316 int ret = 0;
72317
72318 + pax_track_stack();
72319 +
72320 if (splice_grow_spd(pipe, &spd))
72321 return -ENOMEM;
72322
72323 diff -urNp linux-3.0.9/net/core/sock.c linux-3.0.9/net/core/sock.c
72324 --- linux-3.0.9/net/core/sock.c 2011-11-11 13:12:24.000000000 -0500
72325 +++ linux-3.0.9/net/core/sock.c 2011-11-15 20:03:00.000000000 -0500
72326 @@ -291,7 +291,7 @@ int sock_queue_rcv_skb(struct sock *sk,
72327 */
72328 if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
72329 (unsigned)sk->sk_rcvbuf) {
72330 - atomic_inc(&sk->sk_drops);
72331 + atomic_inc_unchecked(&sk->sk_drops);
72332 return -ENOMEM;
72333 }
72334
72335 @@ -300,7 +300,7 @@ int sock_queue_rcv_skb(struct sock *sk,
72336 return err;
72337
72338 if (!sk_rmem_schedule(sk, skb->truesize)) {
72339 - atomic_inc(&sk->sk_drops);
72340 + atomic_inc_unchecked(&sk->sk_drops);
72341 return -ENOBUFS;
72342 }
72343
72344 @@ -320,7 +320,7 @@ int sock_queue_rcv_skb(struct sock *sk,
72345 skb_dst_force(skb);
72346
72347 spin_lock_irqsave(&list->lock, flags);
72348 - skb->dropcount = atomic_read(&sk->sk_drops);
72349 + skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
72350 __skb_queue_tail(list, skb);
72351 spin_unlock_irqrestore(&list->lock, flags);
72352
72353 @@ -340,7 +340,7 @@ int sk_receive_skb(struct sock *sk, stru
72354 skb->dev = NULL;
72355
72356 if (sk_rcvqueues_full(sk, skb)) {
72357 - atomic_inc(&sk->sk_drops);
72358 + atomic_inc_unchecked(&sk->sk_drops);
72359 goto discard_and_relse;
72360 }
72361 if (nested)
72362 @@ -358,7 +358,7 @@ int sk_receive_skb(struct sock *sk, stru
72363 mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
72364 } else if (sk_add_backlog(sk, skb)) {
72365 bh_unlock_sock(sk);
72366 - atomic_inc(&sk->sk_drops);
72367 + atomic_inc_unchecked(&sk->sk_drops);
72368 goto discard_and_relse;
72369 }
72370
72371 @@ -921,7 +921,7 @@ int sock_getsockopt(struct socket *sock,
72372 if (len > sizeof(peercred))
72373 len = sizeof(peercred);
72374 cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred);
72375 - if (copy_to_user(optval, &peercred, len))
72376 + if (len > sizeof(peercred) || copy_to_user(optval, &peercred, len))
72377 return -EFAULT;
72378 goto lenout;
72379 }
72380 @@ -934,7 +934,7 @@ int sock_getsockopt(struct socket *sock,
72381 return -ENOTCONN;
72382 if (lv < len)
72383 return -EINVAL;
72384 - if (copy_to_user(optval, address, len))
72385 + if (len > sizeof(address) || copy_to_user(optval, address, len))
72386 return -EFAULT;
72387 goto lenout;
72388 }
72389 @@ -967,7 +967,7 @@ int sock_getsockopt(struct socket *sock,
72390
72391 if (len > lv)
72392 len = lv;
72393 - if (copy_to_user(optval, &v, len))
72394 + if (len > sizeof(v) || copy_to_user(optval, &v, len))
72395 return -EFAULT;
72396 lenout:
72397 if (put_user(len, optlen))
72398 @@ -2024,7 +2024,7 @@ void sock_init_data(struct socket *sock,
72399 */
72400 smp_wmb();
72401 atomic_set(&sk->sk_refcnt, 1);
72402 - atomic_set(&sk->sk_drops, 0);
72403 + atomic_set_unchecked(&sk->sk_drops, 0);
72404 }
72405 EXPORT_SYMBOL(sock_init_data);
72406
72407 diff -urNp linux-3.0.9/net/decnet/sysctl_net_decnet.c linux-3.0.9/net/decnet/sysctl_net_decnet.c
72408 --- linux-3.0.9/net/decnet/sysctl_net_decnet.c 2011-11-11 13:12:24.000000000 -0500
72409 +++ linux-3.0.9/net/decnet/sysctl_net_decnet.c 2011-11-15 20:03:00.000000000 -0500
72410 @@ -173,7 +173,7 @@ static int dn_node_address_handler(ctl_t
72411
72412 if (len > *lenp) len = *lenp;
72413
72414 - if (copy_to_user(buffer, addr, len))
72415 + if (len > sizeof addr || copy_to_user(buffer, addr, len))
72416 return -EFAULT;
72417
72418 *lenp = len;
72419 @@ -236,7 +236,7 @@ static int dn_def_dev_handler(ctl_table
72420
72421 if (len > *lenp) len = *lenp;
72422
72423 - if (copy_to_user(buffer, devname, len))
72424 + if (len > sizeof devname || copy_to_user(buffer, devname, len))
72425 return -EFAULT;
72426
72427 *lenp = len;
72428 diff -urNp linux-3.0.9/net/econet/Kconfig linux-3.0.9/net/econet/Kconfig
72429 --- linux-3.0.9/net/econet/Kconfig 2011-11-11 13:12:24.000000000 -0500
72430 +++ linux-3.0.9/net/econet/Kconfig 2011-11-15 20:03:00.000000000 -0500
72431 @@ -4,7 +4,7 @@
72432
72433 config ECONET
72434 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
72435 - depends on EXPERIMENTAL && INET
72436 + depends on EXPERIMENTAL && INET && BROKEN
72437 ---help---
72438 Econet is a fairly old and slow networking protocol mainly used by
72439 Acorn computers to access file and print servers. It uses native
72440 diff -urNp linux-3.0.9/net/ipv4/fib_frontend.c linux-3.0.9/net/ipv4/fib_frontend.c
72441 --- linux-3.0.9/net/ipv4/fib_frontend.c 2011-11-11 13:12:24.000000000 -0500
72442 +++ linux-3.0.9/net/ipv4/fib_frontend.c 2011-11-15 20:03:00.000000000 -0500
72443 @@ -970,12 +970,12 @@ static int fib_inetaddr_event(struct not
72444 #ifdef CONFIG_IP_ROUTE_MULTIPATH
72445 fib_sync_up(dev);
72446 #endif
72447 - atomic_inc(&net->ipv4.dev_addr_genid);
72448 + atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
72449 rt_cache_flush(dev_net(dev), -1);
72450 break;
72451 case NETDEV_DOWN:
72452 fib_del_ifaddr(ifa, NULL);
72453 - atomic_inc(&net->ipv4.dev_addr_genid);
72454 + atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
72455 if (ifa->ifa_dev->ifa_list == NULL) {
72456 /* Last address was deleted from this interface.
72457 * Disable IP.
72458 @@ -1011,7 +1011,7 @@ static int fib_netdev_event(struct notif
72459 #ifdef CONFIG_IP_ROUTE_MULTIPATH
72460 fib_sync_up(dev);
72461 #endif
72462 - atomic_inc(&net->ipv4.dev_addr_genid);
72463 + atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
72464 rt_cache_flush(dev_net(dev), -1);
72465 break;
72466 case NETDEV_DOWN:
72467 diff -urNp linux-3.0.9/net/ipv4/fib_semantics.c linux-3.0.9/net/ipv4/fib_semantics.c
72468 --- linux-3.0.9/net/ipv4/fib_semantics.c 2011-11-11 13:12:24.000000000 -0500
72469 +++ linux-3.0.9/net/ipv4/fib_semantics.c 2011-11-15 20:03:00.000000000 -0500
72470 @@ -691,7 +691,7 @@ __be32 fib_info_update_nh_saddr(struct n
72471 nh->nh_saddr = inet_select_addr(nh->nh_dev,
72472 nh->nh_gw,
72473 nh->nh_parent->fib_scope);
72474 - nh->nh_saddr_genid = atomic_read(&net->ipv4.dev_addr_genid);
72475 + nh->nh_saddr_genid = atomic_read_unchecked(&net->ipv4.dev_addr_genid);
72476
72477 return nh->nh_saddr;
72478 }
72479 diff -urNp linux-3.0.9/net/ipv4/inet_diag.c linux-3.0.9/net/ipv4/inet_diag.c
72480 --- linux-3.0.9/net/ipv4/inet_diag.c 2011-11-11 13:12:24.000000000 -0500
72481 +++ linux-3.0.9/net/ipv4/inet_diag.c 2011-11-15 20:03:00.000000000 -0500
72482 @@ -114,8 +114,14 @@ static int inet_csk_diag_fill(struct soc
72483 r->idiag_retrans = 0;
72484
72485 r->id.idiag_if = sk->sk_bound_dev_if;
72486 +
72487 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72488 + r->id.idiag_cookie[0] = 0;
72489 + r->id.idiag_cookie[1] = 0;
72490 +#else
72491 r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
72492 r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
72493 +#endif
72494
72495 r->id.idiag_sport = inet->inet_sport;
72496 r->id.idiag_dport = inet->inet_dport;
72497 @@ -201,8 +207,15 @@ static int inet_twsk_diag_fill(struct in
72498 r->idiag_family = tw->tw_family;
72499 r->idiag_retrans = 0;
72500 r->id.idiag_if = tw->tw_bound_dev_if;
72501 +
72502 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72503 + r->id.idiag_cookie[0] = 0;
72504 + r->id.idiag_cookie[1] = 0;
72505 +#else
72506 r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
72507 r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
72508 +#endif
72509 +
72510 r->id.idiag_sport = tw->tw_sport;
72511 r->id.idiag_dport = tw->tw_dport;
72512 r->id.idiag_src[0] = tw->tw_rcv_saddr;
72513 @@ -285,12 +298,14 @@ static int inet_diag_get_exact(struct sk
72514 if (sk == NULL)
72515 goto unlock;
72516
72517 +#ifndef CONFIG_GRKERNSEC_HIDESYM
72518 err = -ESTALE;
72519 if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
72520 req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
72521 ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
72522 (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
72523 goto out;
72524 +#endif
72525
72526 err = -ENOMEM;
72527 rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
72528 @@ -580,8 +595,14 @@ static int inet_diag_fill_req(struct sk_
72529 r->idiag_retrans = req->retrans;
72530
72531 r->id.idiag_if = sk->sk_bound_dev_if;
72532 +
72533 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72534 + r->id.idiag_cookie[0] = 0;
72535 + r->id.idiag_cookie[1] = 0;
72536 +#else
72537 r->id.idiag_cookie[0] = (u32)(unsigned long)req;
72538 r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
72539 +#endif
72540
72541 tmo = req->expires - jiffies;
72542 if (tmo < 0)
72543 diff -urNp linux-3.0.9/net/ipv4/inet_hashtables.c linux-3.0.9/net/ipv4/inet_hashtables.c
72544 --- linux-3.0.9/net/ipv4/inet_hashtables.c 2011-11-11 13:12:24.000000000 -0500
72545 +++ linux-3.0.9/net/ipv4/inet_hashtables.c 2011-11-15 20:03:00.000000000 -0500
72546 @@ -18,12 +18,15 @@
72547 #include <linux/sched.h>
72548 #include <linux/slab.h>
72549 #include <linux/wait.h>
72550 +#include <linux/security.h>
72551
72552 #include <net/inet_connection_sock.h>
72553 #include <net/inet_hashtables.h>
72554 #include <net/secure_seq.h>
72555 #include <net/ip.h>
72556
72557 +extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
72558 +
72559 /*
72560 * Allocate and initialize a new local port bind bucket.
72561 * The bindhash mutex for snum's hash chain must be held here.
72562 @@ -530,6 +533,8 @@ ok:
72563 twrefcnt += inet_twsk_bind_unhash(tw, hinfo);
72564 spin_unlock(&head->lock);
72565
72566 + gr_update_task_in_ip_table(current, inet_sk(sk));
72567 +
72568 if (tw) {
72569 inet_twsk_deschedule(tw, death_row);
72570 while (twrefcnt) {
72571 diff -urNp linux-3.0.9/net/ipv4/inetpeer.c linux-3.0.9/net/ipv4/inetpeer.c
72572 --- linux-3.0.9/net/ipv4/inetpeer.c 2011-11-11 13:12:24.000000000 -0500
72573 +++ linux-3.0.9/net/ipv4/inetpeer.c 2011-11-15 20:03:00.000000000 -0500
72574 @@ -481,6 +481,8 @@ struct inet_peer *inet_getpeer(struct in
72575 unsigned int sequence;
72576 int invalidated, newrefcnt = 0;
72577
72578 + pax_track_stack();
72579 +
72580 /* Look up for the address quickly, lockless.
72581 * Because of a concurrent writer, we might not find an existing entry.
72582 */
72583 @@ -517,8 +519,8 @@ found: /* The existing node has been fo
72584 if (p) {
72585 p->daddr = *daddr;
72586 atomic_set(&p->refcnt, 1);
72587 - atomic_set(&p->rid, 0);
72588 - atomic_set(&p->ip_id_count, secure_ip_id(daddr->addr.a4));
72589 + atomic_set_unchecked(&p->rid, 0);
72590 + atomic_set_unchecked(&p->ip_id_count, secure_ip_id(daddr->addr.a4));
72591 p->tcp_ts_stamp = 0;
72592 p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
72593 p->rate_tokens = 0;
72594 diff -urNp linux-3.0.9/net/ipv4/ipconfig.c linux-3.0.9/net/ipv4/ipconfig.c
72595 --- linux-3.0.9/net/ipv4/ipconfig.c 2011-11-11 13:12:24.000000000 -0500
72596 +++ linux-3.0.9/net/ipv4/ipconfig.c 2011-11-15 20:03:00.000000000 -0500
72597 @@ -313,7 +313,7 @@ static int __init ic_devinet_ioctl(unsig
72598
72599 mm_segment_t oldfs = get_fs();
72600 set_fs(get_ds());
72601 - res = devinet_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
72602 + res = devinet_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
72603 set_fs(oldfs);
72604 return res;
72605 }
72606 @@ -324,7 +324,7 @@ static int __init ic_dev_ioctl(unsigned
72607
72608 mm_segment_t oldfs = get_fs();
72609 set_fs(get_ds());
72610 - res = dev_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
72611 + res = dev_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
72612 set_fs(oldfs);
72613 return res;
72614 }
72615 @@ -335,7 +335,7 @@ static int __init ic_route_ioctl(unsigne
72616
72617 mm_segment_t oldfs = get_fs();
72618 set_fs(get_ds());
72619 - res = ip_rt_ioctl(&init_net, cmd, (void __user *) arg);
72620 + res = ip_rt_ioctl(&init_net, cmd, (void __force_user *) arg);
72621 set_fs(oldfs);
72622 return res;
72623 }
72624 diff -urNp linux-3.0.9/net/ipv4/ip_fragment.c linux-3.0.9/net/ipv4/ip_fragment.c
72625 --- linux-3.0.9/net/ipv4/ip_fragment.c 2011-11-11 13:12:24.000000000 -0500
72626 +++ linux-3.0.9/net/ipv4/ip_fragment.c 2011-11-15 20:03:00.000000000 -0500
72627 @@ -315,7 +315,7 @@ static inline int ip_frag_too_far(struct
72628 return 0;
72629
72630 start = qp->rid;
72631 - end = atomic_inc_return(&peer->rid);
72632 + end = atomic_inc_return_unchecked(&peer->rid);
72633 qp->rid = end;
72634
72635 rc = qp->q.fragments && (end - start) > max;
72636 diff -urNp linux-3.0.9/net/ipv4/ip_sockglue.c linux-3.0.9/net/ipv4/ip_sockglue.c
72637 --- linux-3.0.9/net/ipv4/ip_sockglue.c 2011-11-11 13:12:24.000000000 -0500
72638 +++ linux-3.0.9/net/ipv4/ip_sockglue.c 2011-11-15 20:03:00.000000000 -0500
72639 @@ -1073,6 +1073,8 @@ static int do_ip_getsockopt(struct sock
72640 int val;
72641 int len;
72642
72643 + pax_track_stack();
72644 +
72645 if (level != SOL_IP)
72646 return -EOPNOTSUPP;
72647
72648 @@ -1110,7 +1112,8 @@ static int do_ip_getsockopt(struct sock
72649 len = min_t(unsigned int, len, opt->optlen);
72650 if (put_user(len, optlen))
72651 return -EFAULT;
72652 - if (copy_to_user(optval, opt->__data, len))
72653 + if ((len > (sizeof(optbuf) - sizeof(struct ip_options))) ||
72654 + copy_to_user(optval, opt->__data, len))
72655 return -EFAULT;
72656 return 0;
72657 }
72658 @@ -1238,7 +1241,7 @@ static int do_ip_getsockopt(struct sock
72659 if (sk->sk_type != SOCK_STREAM)
72660 return -ENOPROTOOPT;
72661
72662 - msg.msg_control = optval;
72663 + msg.msg_control = (void __force_kernel *)optval;
72664 msg.msg_controllen = len;
72665 msg.msg_flags = 0;
72666
72667 diff -urNp linux-3.0.9/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-3.0.9/net/ipv4/netfilter/nf_nat_snmp_basic.c
72668 --- linux-3.0.9/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-11-11 13:12:24.000000000 -0500
72669 +++ linux-3.0.9/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-11-15 20:03:00.000000000 -0500
72670 @@ -399,7 +399,7 @@ static unsigned char asn1_octets_decode(
72671
72672 *len = 0;
72673
72674 - *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
72675 + *octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
72676 if (*octets == NULL) {
72677 if (net_ratelimit())
72678 pr_notice("OOM in bsalg (%d)\n", __LINE__);
72679 diff -urNp linux-3.0.9/net/ipv4/ping.c linux-3.0.9/net/ipv4/ping.c
72680 --- linux-3.0.9/net/ipv4/ping.c 2011-11-11 13:12:24.000000000 -0500
72681 +++ linux-3.0.9/net/ipv4/ping.c 2011-11-15 20:03:00.000000000 -0500
72682 @@ -837,7 +837,7 @@ static void ping_format_sock(struct sock
72683 sk_rmem_alloc_get(sp),
72684 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
72685 atomic_read(&sp->sk_refcnt), sp,
72686 - atomic_read(&sp->sk_drops), len);
72687 + atomic_read_unchecked(&sp->sk_drops), len);
72688 }
72689
72690 static int ping_seq_show(struct seq_file *seq, void *v)
72691 diff -urNp linux-3.0.9/net/ipv4/raw.c linux-3.0.9/net/ipv4/raw.c
72692 --- linux-3.0.9/net/ipv4/raw.c 2011-11-11 13:12:24.000000000 -0500
72693 +++ linux-3.0.9/net/ipv4/raw.c 2011-11-15 20:03:00.000000000 -0500
72694 @@ -302,7 +302,7 @@ static int raw_rcv_skb(struct sock * sk,
72695 int raw_rcv(struct sock *sk, struct sk_buff *skb)
72696 {
72697 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
72698 - atomic_inc(&sk->sk_drops);
72699 + atomic_inc_unchecked(&sk->sk_drops);
72700 kfree_skb(skb);
72701 return NET_RX_DROP;
72702 }
72703 @@ -736,16 +736,20 @@ static int raw_init(struct sock *sk)
72704
72705 static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
72706 {
72707 + struct icmp_filter filter;
72708 +
72709 if (optlen > sizeof(struct icmp_filter))
72710 optlen = sizeof(struct icmp_filter);
72711 - if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
72712 + if (copy_from_user(&filter, optval, optlen))
72713 return -EFAULT;
72714 + raw_sk(sk)->filter = filter;
72715 return 0;
72716 }
72717
72718 static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
72719 {
72720 int len, ret = -EFAULT;
72721 + struct icmp_filter filter;
72722
72723 if (get_user(len, optlen))
72724 goto out;
72725 @@ -755,8 +759,9 @@ static int raw_geticmpfilter(struct sock
72726 if (len > sizeof(struct icmp_filter))
72727 len = sizeof(struct icmp_filter);
72728 ret = -EFAULT;
72729 - if (put_user(len, optlen) ||
72730 - copy_to_user(optval, &raw_sk(sk)->filter, len))
72731 + filter = raw_sk(sk)->filter;
72732 + if (put_user(len, optlen) || len > sizeof filter ||
72733 + copy_to_user(optval, &filter, len))
72734 goto out;
72735 ret = 0;
72736 out: return ret;
72737 @@ -984,7 +989,13 @@ static void raw_sock_seq_show(struct seq
72738 sk_wmem_alloc_get(sp),
72739 sk_rmem_alloc_get(sp),
72740 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
72741 - atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
72742 + atomic_read(&sp->sk_refcnt),
72743 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72744 + NULL,
72745 +#else
72746 + sp,
72747 +#endif
72748 + atomic_read_unchecked(&sp->sk_drops));
72749 }
72750
72751 static int raw_seq_show(struct seq_file *seq, void *v)
72752 diff -urNp linux-3.0.9/net/ipv4/route.c linux-3.0.9/net/ipv4/route.c
72753 --- linux-3.0.9/net/ipv4/route.c 2011-11-11 13:12:24.000000000 -0500
72754 +++ linux-3.0.9/net/ipv4/route.c 2011-11-15 20:03:00.000000000 -0500
72755 @@ -304,7 +304,7 @@ static inline unsigned int rt_hash(__be3
72756
72757 static inline int rt_genid(struct net *net)
72758 {
72759 - return atomic_read(&net->ipv4.rt_genid);
72760 + return atomic_read_unchecked(&net->ipv4.rt_genid);
72761 }
72762
72763 #ifdef CONFIG_PROC_FS
72764 @@ -832,7 +832,7 @@ static void rt_cache_invalidate(struct n
72765 unsigned char shuffle;
72766
72767 get_random_bytes(&shuffle, sizeof(shuffle));
72768 - atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
72769 + atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
72770 }
72771
72772 /*
72773 @@ -2832,7 +2832,7 @@ static int rt_fill_info(struct net *net,
72774 error = rt->dst.error;
72775 if (peer) {
72776 inet_peer_refcheck(rt->peer);
72777 - id = atomic_read(&peer->ip_id_count) & 0xffff;
72778 + id = atomic_read_unchecked(&peer->ip_id_count) & 0xffff;
72779 if (peer->tcp_ts_stamp) {
72780 ts = peer->tcp_ts;
72781 tsage = get_seconds() - peer->tcp_ts_stamp;
72782 diff -urNp linux-3.0.9/net/ipv4/tcp.c linux-3.0.9/net/ipv4/tcp.c
72783 --- linux-3.0.9/net/ipv4/tcp.c 2011-11-11 13:12:24.000000000 -0500
72784 +++ linux-3.0.9/net/ipv4/tcp.c 2011-11-15 20:03:00.000000000 -0500
72785 @@ -2122,6 +2122,8 @@ static int do_tcp_setsockopt(struct sock
72786 int val;
72787 int err = 0;
72788
72789 + pax_track_stack();
72790 +
72791 /* These are data/string values, all the others are ints */
72792 switch (optname) {
72793 case TCP_CONGESTION: {
72794 @@ -2501,6 +2503,8 @@ static int do_tcp_getsockopt(struct sock
72795 struct tcp_sock *tp = tcp_sk(sk);
72796 int val, len;
72797
72798 + pax_track_stack();
72799 +
72800 if (get_user(len, optlen))
72801 return -EFAULT;
72802
72803 diff -urNp linux-3.0.9/net/ipv4/tcp_ipv4.c linux-3.0.9/net/ipv4/tcp_ipv4.c
72804 --- linux-3.0.9/net/ipv4/tcp_ipv4.c 2011-11-11 13:12:24.000000000 -0500
72805 +++ linux-3.0.9/net/ipv4/tcp_ipv4.c 2011-11-15 20:03:00.000000000 -0500
72806 @@ -87,6 +87,9 @@ int sysctl_tcp_tw_reuse __read_mostly;
72807 int sysctl_tcp_low_latency __read_mostly;
72808 EXPORT_SYMBOL(sysctl_tcp_low_latency);
72809
72810 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72811 +extern int grsec_enable_blackhole;
72812 +#endif
72813
72814 #ifdef CONFIG_TCP_MD5SIG
72815 static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
72816 @@ -1610,6 +1613,9 @@ int tcp_v4_do_rcv(struct sock *sk, struc
72817 return 0;
72818
72819 reset:
72820 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72821 + if (!grsec_enable_blackhole)
72822 +#endif
72823 tcp_v4_send_reset(rsk, skb);
72824 discard:
72825 kfree_skb(skb);
72826 @@ -1672,12 +1678,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
72827 TCP_SKB_CB(skb)->sacked = 0;
72828
72829 sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
72830 - if (!sk)
72831 + if (!sk) {
72832 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72833 + ret = 1;
72834 +#endif
72835 goto no_tcp_socket;
72836 -
72837 + }
72838 process:
72839 - if (sk->sk_state == TCP_TIME_WAIT)
72840 + if (sk->sk_state == TCP_TIME_WAIT) {
72841 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72842 + ret = 2;
72843 +#endif
72844 goto do_time_wait;
72845 + }
72846
72847 if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
72848 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
72849 @@ -1727,6 +1740,10 @@ no_tcp_socket:
72850 bad_packet:
72851 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
72852 } else {
72853 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72854 + if (!grsec_enable_blackhole || (ret == 1 &&
72855 + (skb->dev->flags & IFF_LOOPBACK)))
72856 +#endif
72857 tcp_v4_send_reset(NULL, skb);
72858 }
72859
72860 @@ -2391,7 +2408,11 @@ static void get_openreq4(struct sock *sk
72861 0, /* non standard timer */
72862 0, /* open_requests have no inode */
72863 atomic_read(&sk->sk_refcnt),
72864 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72865 + NULL,
72866 +#else
72867 req,
72868 +#endif
72869 len);
72870 }
72871
72872 @@ -2441,7 +2462,12 @@ static void get_tcp4_sock(struct sock *s
72873 sock_i_uid(sk),
72874 icsk->icsk_probes_out,
72875 sock_i_ino(sk),
72876 - atomic_read(&sk->sk_refcnt), sk,
72877 + atomic_read(&sk->sk_refcnt),
72878 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72879 + NULL,
72880 +#else
72881 + sk,
72882 +#endif
72883 jiffies_to_clock_t(icsk->icsk_rto),
72884 jiffies_to_clock_t(icsk->icsk_ack.ato),
72885 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
72886 @@ -2469,7 +2495,13 @@ static void get_timewait4_sock(struct in
72887 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK%n",
72888 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
72889 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
72890 - atomic_read(&tw->tw_refcnt), tw, len);
72891 + atomic_read(&tw->tw_refcnt),
72892 +#ifdef CONFIG_GRKERNSEC_HIDESYM
72893 + NULL,
72894 +#else
72895 + tw,
72896 +#endif
72897 + len);
72898 }
72899
72900 #define TMPSZ 150
72901 diff -urNp linux-3.0.9/net/ipv4/tcp_minisocks.c linux-3.0.9/net/ipv4/tcp_minisocks.c
72902 --- linux-3.0.9/net/ipv4/tcp_minisocks.c 2011-11-11 13:12:24.000000000 -0500
72903 +++ linux-3.0.9/net/ipv4/tcp_minisocks.c 2011-11-15 20:03:00.000000000 -0500
72904 @@ -27,6 +27,10 @@
72905 #include <net/inet_common.h>
72906 #include <net/xfrm.h>
72907
72908 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72909 +extern int grsec_enable_blackhole;
72910 +#endif
72911 +
72912 int sysctl_tcp_syncookies __read_mostly = 1;
72913 EXPORT_SYMBOL(sysctl_tcp_syncookies);
72914
72915 @@ -745,6 +749,10 @@ listen_overflow:
72916
72917 embryonic_reset:
72918 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
72919 +
72920 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72921 + if (!grsec_enable_blackhole)
72922 +#endif
72923 if (!(flg & TCP_FLAG_RST))
72924 req->rsk_ops->send_reset(sk, skb);
72925
72926 diff -urNp linux-3.0.9/net/ipv4/tcp_output.c linux-3.0.9/net/ipv4/tcp_output.c
72927 --- linux-3.0.9/net/ipv4/tcp_output.c 2011-11-11 13:12:24.000000000 -0500
72928 +++ linux-3.0.9/net/ipv4/tcp_output.c 2011-11-15 20:03:00.000000000 -0500
72929 @@ -2421,6 +2421,8 @@ struct sk_buff *tcp_make_synack(struct s
72930 int mss;
72931 int s_data_desired = 0;
72932
72933 + pax_track_stack();
72934 +
72935 if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired)
72936 s_data_desired = cvp->s_data_desired;
72937 skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15 + s_data_desired, 1, GFP_ATOMIC);
72938 diff -urNp linux-3.0.9/net/ipv4/tcp_probe.c linux-3.0.9/net/ipv4/tcp_probe.c
72939 --- linux-3.0.9/net/ipv4/tcp_probe.c 2011-11-11 13:12:24.000000000 -0500
72940 +++ linux-3.0.9/net/ipv4/tcp_probe.c 2011-11-15 20:03:00.000000000 -0500
72941 @@ -202,7 +202,7 @@ static ssize_t tcpprobe_read(struct file
72942 if (cnt + width >= len)
72943 break;
72944
72945 - if (copy_to_user(buf + cnt, tbuf, width))
72946 + if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
72947 return -EFAULT;
72948 cnt += width;
72949 }
72950 diff -urNp linux-3.0.9/net/ipv4/tcp_timer.c linux-3.0.9/net/ipv4/tcp_timer.c
72951 --- linux-3.0.9/net/ipv4/tcp_timer.c 2011-11-11 13:12:24.000000000 -0500
72952 +++ linux-3.0.9/net/ipv4/tcp_timer.c 2011-11-15 20:03:00.000000000 -0500
72953 @@ -22,6 +22,10 @@
72954 #include <linux/gfp.h>
72955 #include <net/tcp.h>
72956
72957 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72958 +extern int grsec_lastack_retries;
72959 +#endif
72960 +
72961 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
72962 int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
72963 int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
72964 @@ -199,6 +203,13 @@ static int tcp_write_timeout(struct sock
72965 }
72966 }
72967
72968 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72969 + if ((sk->sk_state == TCP_LAST_ACK) &&
72970 + (grsec_lastack_retries > 0) &&
72971 + (grsec_lastack_retries < retry_until))
72972 + retry_until = grsec_lastack_retries;
72973 +#endif
72974 +
72975 if (retransmits_timed_out(sk, retry_until,
72976 syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
72977 /* Has it gone just too far? */
72978 diff -urNp linux-3.0.9/net/ipv4/udp.c linux-3.0.9/net/ipv4/udp.c
72979 --- linux-3.0.9/net/ipv4/udp.c 2011-11-11 13:12:24.000000000 -0500
72980 +++ linux-3.0.9/net/ipv4/udp.c 2011-11-15 20:03:00.000000000 -0500
72981 @@ -86,6 +86,7 @@
72982 #include <linux/types.h>
72983 #include <linux/fcntl.h>
72984 #include <linux/module.h>
72985 +#include <linux/security.h>
72986 #include <linux/socket.h>
72987 #include <linux/sockios.h>
72988 #include <linux/igmp.h>
72989 @@ -107,6 +108,10 @@
72990 #include <net/xfrm.h>
72991 #include "udp_impl.h"
72992
72993 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
72994 +extern int grsec_enable_blackhole;
72995 +#endif
72996 +
72997 struct udp_table udp_table __read_mostly;
72998 EXPORT_SYMBOL(udp_table);
72999
73000 @@ -564,6 +569,9 @@ found:
73001 return s;
73002 }
73003
73004 +extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
73005 +extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
73006 +
73007 /*
73008 * This routine is called by the ICMP module when it gets some
73009 * sort of error condition. If err < 0 then the socket should
73010 @@ -855,9 +863,18 @@ int udp_sendmsg(struct kiocb *iocb, stru
73011 dport = usin->sin_port;
73012 if (dport == 0)
73013 return -EINVAL;
73014 +
73015 + err = gr_search_udp_sendmsg(sk, usin);
73016 + if (err)
73017 + return err;
73018 } else {
73019 if (sk->sk_state != TCP_ESTABLISHED)
73020 return -EDESTADDRREQ;
73021 +
73022 + err = gr_search_udp_sendmsg(sk, NULL);
73023 + if (err)
73024 + return err;
73025 +
73026 daddr = inet->inet_daddr;
73027 dport = inet->inet_dport;
73028 /* Open fast path for connected socket.
73029 @@ -1098,7 +1115,7 @@ static unsigned int first_packet_length(
73030 udp_lib_checksum_complete(skb)) {
73031 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
73032 IS_UDPLITE(sk));
73033 - atomic_inc(&sk->sk_drops);
73034 + atomic_inc_unchecked(&sk->sk_drops);
73035 __skb_unlink(skb, rcvq);
73036 __skb_queue_tail(&list_kill, skb);
73037 }
73038 @@ -1184,6 +1201,10 @@ try_again:
73039 if (!skb)
73040 goto out;
73041
73042 + err = gr_search_udp_recvmsg(sk, skb);
73043 + if (err)
73044 + goto out_free;
73045 +
73046 ulen = skb->len - sizeof(struct udphdr);
73047 if (len > ulen)
73048 len = ulen;
73049 @@ -1483,7 +1504,7 @@ int udp_queue_rcv_skb(struct sock *sk, s
73050
73051 drop:
73052 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
73053 - atomic_inc(&sk->sk_drops);
73054 + atomic_inc_unchecked(&sk->sk_drops);
73055 kfree_skb(skb);
73056 return -1;
73057 }
73058 @@ -1502,7 +1523,7 @@ static void flush_stack(struct sock **st
73059 skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
73060
73061 if (!skb1) {
73062 - atomic_inc(&sk->sk_drops);
73063 + atomic_inc_unchecked(&sk->sk_drops);
73064 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
73065 IS_UDPLITE(sk));
73066 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
73067 @@ -1671,6 +1692,9 @@ int __udp4_lib_rcv(struct sk_buff *skb,
73068 goto csum_error;
73069
73070 UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
73071 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
73072 + if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
73073 +#endif
73074 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
73075
73076 /*
73077 @@ -2098,8 +2122,13 @@ static void udp4_format_sock(struct sock
73078 sk_wmem_alloc_get(sp),
73079 sk_rmem_alloc_get(sp),
73080 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
73081 - atomic_read(&sp->sk_refcnt), sp,
73082 - atomic_read(&sp->sk_drops), len);
73083 + atomic_read(&sp->sk_refcnt),
73084 +#ifdef CONFIG_GRKERNSEC_HIDESYM
73085 + NULL,
73086 +#else
73087 + sp,
73088 +#endif
73089 + atomic_read_unchecked(&sp->sk_drops), len);
73090 }
73091
73092 int udp4_seq_show(struct seq_file *seq, void *v)
73093 diff -urNp linux-3.0.9/net/ipv6/addrconf.c linux-3.0.9/net/ipv6/addrconf.c
73094 --- linux-3.0.9/net/ipv6/addrconf.c 2011-11-11 13:12:24.000000000 -0500
73095 +++ linux-3.0.9/net/ipv6/addrconf.c 2011-11-15 20:03:00.000000000 -0500
73096 @@ -2072,7 +2072,7 @@ int addrconf_set_dstaddr(struct net *net
73097 p.iph.ihl = 5;
73098 p.iph.protocol = IPPROTO_IPV6;
73099 p.iph.ttl = 64;
73100 - ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
73101 + ifr.ifr_ifru.ifru_data = (void __force_user *)&p;
73102
73103 if (ops->ndo_do_ioctl) {
73104 mm_segment_t oldfs = get_fs();
73105 diff -urNp linux-3.0.9/net/ipv6/inet6_connection_sock.c linux-3.0.9/net/ipv6/inet6_connection_sock.c
73106 --- linux-3.0.9/net/ipv6/inet6_connection_sock.c 2011-11-11 13:12:24.000000000 -0500
73107 +++ linux-3.0.9/net/ipv6/inet6_connection_sock.c 2011-11-15 20:03:00.000000000 -0500
73108 @@ -178,7 +178,7 @@ void __inet6_csk_dst_store(struct sock *
73109 #ifdef CONFIG_XFRM
73110 {
73111 struct rt6_info *rt = (struct rt6_info *)dst;
73112 - rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
73113 + rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
73114 }
73115 #endif
73116 }
73117 @@ -193,7 +193,7 @@ struct dst_entry *__inet6_csk_dst_check(
73118 #ifdef CONFIG_XFRM
73119 if (dst) {
73120 struct rt6_info *rt = (struct rt6_info *)dst;
73121 - if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
73122 + if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
73123 __sk_dst_reset(sk);
73124 dst = NULL;
73125 }
73126 diff -urNp linux-3.0.9/net/ipv6/ipv6_sockglue.c linux-3.0.9/net/ipv6/ipv6_sockglue.c
73127 --- linux-3.0.9/net/ipv6/ipv6_sockglue.c 2011-11-11 13:12:24.000000000 -0500
73128 +++ linux-3.0.9/net/ipv6/ipv6_sockglue.c 2011-11-15 20:03:00.000000000 -0500
73129 @@ -129,6 +129,8 @@ static int do_ipv6_setsockopt(struct soc
73130 int val, valbool;
73131 int retv = -ENOPROTOOPT;
73132
73133 + pax_track_stack();
73134 +
73135 if (optval == NULL)
73136 val=0;
73137 else {
73138 @@ -919,6 +921,8 @@ static int do_ipv6_getsockopt(struct soc
73139 int len;
73140 int val;
73141
73142 + pax_track_stack();
73143 +
73144 if (ip6_mroute_opt(optname))
73145 return ip6_mroute_getsockopt(sk, optname, optval, optlen);
73146
73147 @@ -960,7 +964,7 @@ static int do_ipv6_getsockopt(struct soc
73148 if (sk->sk_type != SOCK_STREAM)
73149 return -ENOPROTOOPT;
73150
73151 - msg.msg_control = optval;
73152 + msg.msg_control = (void __force_kernel *)optval;
73153 msg.msg_controllen = len;
73154 msg.msg_flags = flags;
73155
73156 diff -urNp linux-3.0.9/net/ipv6/raw.c linux-3.0.9/net/ipv6/raw.c
73157 --- linux-3.0.9/net/ipv6/raw.c 2011-11-11 13:12:24.000000000 -0500
73158 +++ linux-3.0.9/net/ipv6/raw.c 2011-11-15 20:03:00.000000000 -0500
73159 @@ -376,7 +376,7 @@ static inline int rawv6_rcv_skb(struct s
73160 {
73161 if ((raw6_sk(sk)->checksum || rcu_dereference_raw(sk->sk_filter)) &&
73162 skb_checksum_complete(skb)) {
73163 - atomic_inc(&sk->sk_drops);
73164 + atomic_inc_unchecked(&sk->sk_drops);
73165 kfree_skb(skb);
73166 return NET_RX_DROP;
73167 }
73168 @@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk
73169 struct raw6_sock *rp = raw6_sk(sk);
73170
73171 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
73172 - atomic_inc(&sk->sk_drops);
73173 + atomic_inc_unchecked(&sk->sk_drops);
73174 kfree_skb(skb);
73175 return NET_RX_DROP;
73176 }
73177 @@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk
73178
73179 if (inet->hdrincl) {
73180 if (skb_checksum_complete(skb)) {
73181 - atomic_inc(&sk->sk_drops);
73182 + atomic_inc_unchecked(&sk->sk_drops);
73183 kfree_skb(skb);
73184 return NET_RX_DROP;
73185 }
73186 @@ -601,7 +601,7 @@ out:
73187 return err;
73188 }
73189
73190 -static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
73191 +static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
73192 struct flowi6 *fl6, struct dst_entry **dstp,
73193 unsigned int flags)
73194 {
73195 @@ -742,6 +742,8 @@ static int rawv6_sendmsg(struct kiocb *i
73196 u16 proto;
73197 int err;
73198
73199 + pax_track_stack();
73200 +
73201 /* Rough check on arithmetic overflow,
73202 better check is made in ip6_append_data().
73203 */
73204 @@ -909,12 +911,15 @@ do_confirm:
73205 static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
73206 char __user *optval, int optlen)
73207 {
73208 + struct icmp6_filter filter;
73209 +
73210 switch (optname) {
73211 case ICMPV6_FILTER:
73212 if (optlen > sizeof(struct icmp6_filter))
73213 optlen = sizeof(struct icmp6_filter);
73214 - if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
73215 + if (copy_from_user(&filter, optval, optlen))
73216 return -EFAULT;
73217 + raw6_sk(sk)->filter = filter;
73218 return 0;
73219 default:
73220 return -ENOPROTOOPT;
73221 @@ -927,6 +932,7 @@ static int rawv6_geticmpfilter(struct so
73222 char __user *optval, int __user *optlen)
73223 {
73224 int len;
73225 + struct icmp6_filter filter;
73226
73227 switch (optname) {
73228 case ICMPV6_FILTER:
73229 @@ -938,7 +944,8 @@ static int rawv6_geticmpfilter(struct so
73230 len = sizeof(struct icmp6_filter);
73231 if (put_user(len, optlen))
73232 return -EFAULT;
73233 - if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
73234 + filter = raw6_sk(sk)->filter;
73235 + if (len > sizeof filter || copy_to_user(optval, &filter, len))
73236 return -EFAULT;
73237 return 0;
73238 default:
73239 @@ -1252,7 +1259,13 @@ static void raw6_sock_seq_show(struct se
73240 0, 0L, 0,
73241 sock_i_uid(sp), 0,
73242 sock_i_ino(sp),
73243 - atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
73244 + atomic_read(&sp->sk_refcnt),
73245 +#ifdef CONFIG_GRKERNSEC_HIDESYM
73246 + NULL,
73247 +#else
73248 + sp,
73249 +#endif
73250 + atomic_read_unchecked(&sp->sk_drops));
73251 }
73252
73253 static int raw6_seq_show(struct seq_file *seq, void *v)
73254 diff -urNp linux-3.0.9/net/ipv6/tcp_ipv6.c linux-3.0.9/net/ipv6/tcp_ipv6.c
73255 --- linux-3.0.9/net/ipv6/tcp_ipv6.c 2011-11-11 13:12:24.000000000 -0500
73256 +++ linux-3.0.9/net/ipv6/tcp_ipv6.c 2011-11-15 20:03:00.000000000 -0500
73257 @@ -93,6 +93,10 @@ static struct tcp_md5sig_key *tcp_v6_md5
73258 }
73259 #endif
73260
73261 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
73262 +extern int grsec_enable_blackhole;
73263 +#endif
73264 +
73265 static void tcp_v6_hash(struct sock *sk)
73266 {
73267 if (sk->sk_state != TCP_CLOSE) {
73268 @@ -1667,6 +1671,9 @@ static int tcp_v6_do_rcv(struct sock *sk
73269 return 0;
73270
73271 reset:
73272 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
73273 + if (!grsec_enable_blackhole)
73274 +#endif
73275 tcp_v6_send_reset(sk, skb);
73276 discard:
73277 if (opt_skb)
73278 @@ -1746,12 +1753,20 @@ static int tcp_v6_rcv(struct sk_buff *sk
73279 TCP_SKB_CB(skb)->sacked = 0;
73280
73281 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
73282 - if (!sk)
73283 + if (!sk) {
73284 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
73285 + ret = 1;
73286 +#endif
73287 goto no_tcp_socket;
73288 + }
73289
73290 process:
73291 - if (sk->sk_state == TCP_TIME_WAIT)
73292 + if (sk->sk_state == TCP_TIME_WAIT) {
73293 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
73294 + ret = 2;
73295 +#endif
73296 goto do_time_wait;
73297 + }
73298
73299 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
73300 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
73301 @@ -1799,6 +1814,10 @@ no_tcp_socket:
73302 bad_packet:
73303 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
73304 } else {
73305 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
73306 + if (!grsec_enable_blackhole || (ret == 1 &&
73307 + (skb->dev->flags & IFF_LOOPBACK)))
73308 +#endif
73309 tcp_v6_send_reset(NULL, skb);
73310 }
73311
73312 @@ -2059,7 +2078,13 @@ static void get_openreq6(struct seq_file
73313 uid,
73314 0, /* non standard timer */
73315 0, /* open_requests have no inode */
73316 - 0, req);
73317 + 0,
73318 +#ifdef CONFIG_GRKERNSEC_HIDESYM
73319 + NULL
73320 +#else
73321 + req
73322 +#endif
73323 + );
73324 }
73325
73326 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
73327 @@ -2109,7 +2134,12 @@ static void get_tcp6_sock(struct seq_fil
73328 sock_i_uid(sp),
73329 icsk->icsk_probes_out,
73330 sock_i_ino(sp),
73331 - atomic_read(&sp->sk_refcnt), sp,
73332 + atomic_read(&sp->sk_refcnt),
73333 +#ifdef CONFIG_GRKERNSEC_HIDESYM
73334 + NULL,
73335 +#else
73336 + sp,
73337 +#endif
73338 jiffies_to_clock_t(icsk->icsk_rto),
73339 jiffies_to_clock_t(icsk->icsk_ack.ato),
73340 (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
73341 @@ -2144,7 +2174,13 @@ static void get_timewait6_sock(struct se
73342 dest->s6_addr32[2], dest->s6_addr32[3], destp,
73343 tw->tw_substate, 0, 0,
73344 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
73345 - atomic_read(&tw->tw_refcnt), tw);
73346 + atomic_read(&tw->tw_refcnt),
73347 +#ifdef CONFIG_GRKERNSEC_HIDESYM
73348 + NULL
73349 +#else
73350 + tw
73351 +#endif
73352 + );
73353 }
73354
73355 static int tcp6_seq_show(struct seq_file *seq, void *v)
73356 diff -urNp linux-3.0.9/net/ipv6/udp.c linux-3.0.9/net/ipv6/udp.c
73357 --- linux-3.0.9/net/ipv6/udp.c 2011-11-11 13:12:24.000000000 -0500
73358 +++ linux-3.0.9/net/ipv6/udp.c 2011-11-15 20:03:00.000000000 -0500
73359 @@ -50,6 +50,10 @@
73360 #include <linux/seq_file.h>
73361 #include "udp_impl.h"
73362
73363 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
73364 +extern int grsec_enable_blackhole;
73365 +#endif
73366 +
73367 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
73368 {
73369 const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
73370 @@ -548,7 +552,7 @@ int udpv6_queue_rcv_skb(struct sock * sk
73371
73372 return 0;
73373 drop:
73374 - atomic_inc(&sk->sk_drops);
73375 + atomic_inc_unchecked(&sk->sk_drops);
73376 drop_no_sk_drops_inc:
73377 UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
73378 kfree_skb(skb);
73379 @@ -624,7 +628,7 @@ static void flush_stack(struct sock **st
73380 continue;
73381 }
73382 drop:
73383 - atomic_inc(&sk->sk_drops);
73384 + atomic_inc_unchecked(&sk->sk_drops);
73385 UDP6_INC_STATS_BH(sock_net(sk),
73386 UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
73387 UDP6_INC_STATS_BH(sock_net(sk),
73388 @@ -779,6 +783,9 @@ int __udp6_lib_rcv(struct sk_buff *skb,
73389 UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
73390 proto == IPPROTO_UDPLITE);
73391
73392 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
73393 + if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
73394 +#endif
73395 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
73396
73397 kfree_skb(skb);
73398 @@ -795,7 +802,7 @@ int __udp6_lib_rcv(struct sk_buff *skb,
73399 if (!sock_owned_by_user(sk))
73400 udpv6_queue_rcv_skb(sk, skb);
73401 else if (sk_add_backlog(sk, skb)) {
73402 - atomic_inc(&sk->sk_drops);
73403 + atomic_inc_unchecked(&sk->sk_drops);
73404 bh_unlock_sock(sk);
73405 sock_put(sk);
73406 goto discard;
73407 @@ -1408,8 +1415,13 @@ static void udp6_sock_seq_show(struct se
73408 0, 0L, 0,
73409 sock_i_uid(sp), 0,
73410 sock_i_ino(sp),
73411 - atomic_read(&sp->sk_refcnt), sp,
73412 - atomic_read(&sp->sk_drops));
73413 + atomic_read(&sp->sk_refcnt),
73414 +#ifdef CONFIG_GRKERNSEC_HIDESYM
73415 + NULL,
73416 +#else
73417 + sp,
73418 +#endif
73419 + atomic_read_unchecked(&sp->sk_drops));
73420 }
73421
73422 int udp6_seq_show(struct seq_file *seq, void *v)
73423 diff -urNp linux-3.0.9/net/irda/ircomm/ircomm_tty.c linux-3.0.9/net/irda/ircomm/ircomm_tty.c
73424 --- linux-3.0.9/net/irda/ircomm/ircomm_tty.c 2011-11-11 13:12:24.000000000 -0500
73425 +++ linux-3.0.9/net/irda/ircomm/ircomm_tty.c 2011-11-15 20:03:00.000000000 -0500
73426 @@ -282,16 +282,16 @@ static int ircomm_tty_block_til_ready(st
73427 add_wait_queue(&self->open_wait, &wait);
73428
73429 IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
73430 - __FILE__,__LINE__, tty->driver->name, self->open_count );
73431 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
73432
73433 /* As far as I can see, we protect open_count - Jean II */
73434 spin_lock_irqsave(&self->spinlock, flags);
73435 if (!tty_hung_up_p(filp)) {
73436 extra_count = 1;
73437 - self->open_count--;
73438 + local_dec(&self->open_count);
73439 }
73440 spin_unlock_irqrestore(&self->spinlock, flags);
73441 - self->blocked_open++;
73442 + local_inc(&self->blocked_open);
73443
73444 while (1) {
73445 if (tty->termios->c_cflag & CBAUD) {
73446 @@ -331,7 +331,7 @@ static int ircomm_tty_block_til_ready(st
73447 }
73448
73449 IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
73450 - __FILE__,__LINE__, tty->driver->name, self->open_count );
73451 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
73452
73453 schedule();
73454 }
73455 @@ -342,13 +342,13 @@ static int ircomm_tty_block_til_ready(st
73456 if (extra_count) {
73457 /* ++ is not atomic, so this should be protected - Jean II */
73458 spin_lock_irqsave(&self->spinlock, flags);
73459 - self->open_count++;
73460 + local_inc(&self->open_count);
73461 spin_unlock_irqrestore(&self->spinlock, flags);
73462 }
73463 - self->blocked_open--;
73464 + local_dec(&self->blocked_open);
73465
73466 IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
73467 - __FILE__,__LINE__, tty->driver->name, self->open_count);
73468 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
73469
73470 if (!retval)
73471 self->flags |= ASYNC_NORMAL_ACTIVE;
73472 @@ -417,14 +417,14 @@ static int ircomm_tty_open(struct tty_st
73473 }
73474 /* ++ is not atomic, so this should be protected - Jean II */
73475 spin_lock_irqsave(&self->spinlock, flags);
73476 - self->open_count++;
73477 + local_inc(&self->open_count);
73478
73479 tty->driver_data = self;
73480 self->tty = tty;
73481 spin_unlock_irqrestore(&self->spinlock, flags);
73482
73483 IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
73484 - self->line, self->open_count);
73485 + self->line, local_read(&self->open_count));
73486
73487 /* Not really used by us, but lets do it anyway */
73488 self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
73489 @@ -510,7 +510,7 @@ static void ircomm_tty_close(struct tty_
73490 return;
73491 }
73492
73493 - if ((tty->count == 1) && (self->open_count != 1)) {
73494 + if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
73495 /*
73496 * Uh, oh. tty->count is 1, which means that the tty
73497 * structure will be freed. state->count should always
73498 @@ -520,16 +520,16 @@ static void ircomm_tty_close(struct tty_
73499 */
73500 IRDA_DEBUG(0, "%s(), bad serial port count; "
73501 "tty->count is 1, state->count is %d\n", __func__ ,
73502 - self->open_count);
73503 - self->open_count = 1;
73504 + local_read(&self->open_count));
73505 + local_set(&self->open_count, 1);
73506 }
73507
73508 - if (--self->open_count < 0) {
73509 + if (local_dec_return(&self->open_count) < 0) {
73510 IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
73511 - __func__, self->line, self->open_count);
73512 - self->open_count = 0;
73513 + __func__, self->line, local_read(&self->open_count));
73514 + local_set(&self->open_count, 0);
73515 }
73516 - if (self->open_count) {
73517 + if (local_read(&self->open_count)) {
73518 spin_unlock_irqrestore(&self->spinlock, flags);
73519
73520 IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
73521 @@ -561,7 +561,7 @@ static void ircomm_tty_close(struct tty_
73522 tty->closing = 0;
73523 self->tty = NULL;
73524
73525 - if (self->blocked_open) {
73526 + if (local_read(&self->blocked_open)) {
73527 if (self->close_delay)
73528 schedule_timeout_interruptible(self->close_delay);
73529 wake_up_interruptible(&self->open_wait);
73530 @@ -1013,7 +1013,7 @@ static void ircomm_tty_hangup(struct tty
73531 spin_lock_irqsave(&self->spinlock, flags);
73532 self->flags &= ~ASYNC_NORMAL_ACTIVE;
73533 self->tty = NULL;
73534 - self->open_count = 0;
73535 + local_set(&self->open_count, 0);
73536 spin_unlock_irqrestore(&self->spinlock, flags);
73537
73538 wake_up_interruptible(&self->open_wait);
73539 @@ -1360,7 +1360,7 @@ static void ircomm_tty_line_info(struct
73540 seq_putc(m, '\n');
73541
73542 seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
73543 - seq_printf(m, "Open count: %d\n", self->open_count);
73544 + seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
73545 seq_printf(m, "Max data size: %d\n", self->max_data_size);
73546 seq_printf(m, "Max header size: %d\n", self->max_header_size);
73547
73548 diff -urNp linux-3.0.9/net/iucv/af_iucv.c linux-3.0.9/net/iucv/af_iucv.c
73549 --- linux-3.0.9/net/iucv/af_iucv.c 2011-11-11 13:12:24.000000000 -0500
73550 +++ linux-3.0.9/net/iucv/af_iucv.c 2011-11-15 20:03:00.000000000 -0500
73551 @@ -648,10 +648,10 @@ static int iucv_sock_autobind(struct soc
73552
73553 write_lock_bh(&iucv_sk_list.lock);
73554
73555 - sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
73556 + sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
73557 while (__iucv_get_sock_by_name(name)) {
73558 sprintf(name, "%08x",
73559 - atomic_inc_return(&iucv_sk_list.autobind_name));
73560 + atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
73561 }
73562
73563 write_unlock_bh(&iucv_sk_list.lock);
73564 diff -urNp linux-3.0.9/net/key/af_key.c linux-3.0.9/net/key/af_key.c
73565 --- linux-3.0.9/net/key/af_key.c 2011-11-11 13:12:24.000000000 -0500
73566 +++ linux-3.0.9/net/key/af_key.c 2011-11-15 20:03:00.000000000 -0500
73567 @@ -2481,6 +2481,8 @@ static int pfkey_migrate(struct sock *sk
73568 struct xfrm_migrate m[XFRM_MAX_DEPTH];
73569 struct xfrm_kmaddress k;
73570
73571 + pax_track_stack();
73572 +
73573 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
73574 ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
73575 !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
73576 @@ -3016,10 +3018,10 @@ static int pfkey_send_policy_notify(stru
73577 static u32 get_acqseq(void)
73578 {
73579 u32 res;
73580 - static atomic_t acqseq;
73581 + static atomic_unchecked_t acqseq;
73582
73583 do {
73584 - res = atomic_inc_return(&acqseq);
73585 + res = atomic_inc_return_unchecked(&acqseq);
73586 } while (!res);
73587 return res;
73588 }
73589 diff -urNp linux-3.0.9/net/lapb/lapb_iface.c linux-3.0.9/net/lapb/lapb_iface.c
73590 --- linux-3.0.9/net/lapb/lapb_iface.c 2011-11-11 13:12:24.000000000 -0500
73591 +++ linux-3.0.9/net/lapb/lapb_iface.c 2011-11-15 20:03:00.000000000 -0500
73592 @@ -158,7 +158,7 @@ int lapb_register(struct net_device *dev
73593 goto out;
73594
73595 lapb->dev = dev;
73596 - lapb->callbacks = *callbacks;
73597 + lapb->callbacks = callbacks;
73598
73599 __lapb_insert_cb(lapb);
73600
73601 @@ -380,32 +380,32 @@ int lapb_data_received(struct net_device
73602
73603 void lapb_connect_confirmation(struct lapb_cb *lapb, int reason)
73604 {
73605 - if (lapb->callbacks.connect_confirmation)
73606 - lapb->callbacks.connect_confirmation(lapb->dev, reason);
73607 + if (lapb->callbacks->connect_confirmation)
73608 + lapb->callbacks->connect_confirmation(lapb->dev, reason);
73609 }
73610
73611 void lapb_connect_indication(struct lapb_cb *lapb, int reason)
73612 {
73613 - if (lapb->callbacks.connect_indication)
73614 - lapb->callbacks.connect_indication(lapb->dev, reason);
73615 + if (lapb->callbacks->connect_indication)
73616 + lapb->callbacks->connect_indication(lapb->dev, reason);
73617 }
73618
73619 void lapb_disconnect_confirmation(struct lapb_cb *lapb, int reason)
73620 {
73621 - if (lapb->callbacks.disconnect_confirmation)
73622 - lapb->callbacks.disconnect_confirmation(lapb->dev, reason);
73623 + if (lapb->callbacks->disconnect_confirmation)
73624 + lapb->callbacks->disconnect_confirmation(lapb->dev, reason);
73625 }
73626
73627 void lapb_disconnect_indication(struct lapb_cb *lapb, int reason)
73628 {
73629 - if (lapb->callbacks.disconnect_indication)
73630 - lapb->callbacks.disconnect_indication(lapb->dev, reason);
73631 + if (lapb->callbacks->disconnect_indication)
73632 + lapb->callbacks->disconnect_indication(lapb->dev, reason);
73633 }
73634
73635 int lapb_data_indication(struct lapb_cb *lapb, struct sk_buff *skb)
73636 {
73637 - if (lapb->callbacks.data_indication)
73638 - return lapb->callbacks.data_indication(lapb->dev, skb);
73639 + if (lapb->callbacks->data_indication)
73640 + return lapb->callbacks->data_indication(lapb->dev, skb);
73641
73642 kfree_skb(skb);
73643 return NET_RX_SUCCESS; /* For now; must be != NET_RX_DROP */
73644 @@ -415,8 +415,8 @@ int lapb_data_transmit(struct lapb_cb *l
73645 {
73646 int used = 0;
73647
73648 - if (lapb->callbacks.data_transmit) {
73649 - lapb->callbacks.data_transmit(lapb->dev, skb);
73650 + if (lapb->callbacks->data_transmit) {
73651 + lapb->callbacks->data_transmit(lapb->dev, skb);
73652 used = 1;
73653 }
73654
73655 diff -urNp linux-3.0.9/net/mac80211/debugfs_sta.c linux-3.0.9/net/mac80211/debugfs_sta.c
73656 --- linux-3.0.9/net/mac80211/debugfs_sta.c 2011-11-11 13:12:24.000000000 -0500
73657 +++ linux-3.0.9/net/mac80211/debugfs_sta.c 2011-11-15 20:03:00.000000000 -0500
73658 @@ -140,6 +140,8 @@ static ssize_t sta_agg_status_read(struc
73659 struct tid_ampdu_rx *tid_rx;
73660 struct tid_ampdu_tx *tid_tx;
73661
73662 + pax_track_stack();
73663 +
73664 rcu_read_lock();
73665
73666 p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n",
73667 @@ -240,6 +242,8 @@ static ssize_t sta_ht_capa_read(struct f
73668 struct sta_info *sta = file->private_data;
73669 struct ieee80211_sta_ht_cap *htc = &sta->sta.ht_cap;
73670
73671 + pax_track_stack();
73672 +
73673 p += scnprintf(p, sizeof(buf) + buf - p, "ht %ssupported\n",
73674 htc->ht_supported ? "" : "not ");
73675 if (htc->ht_supported) {
73676 diff -urNp linux-3.0.9/net/mac80211/ieee80211_i.h linux-3.0.9/net/mac80211/ieee80211_i.h
73677 --- linux-3.0.9/net/mac80211/ieee80211_i.h 2011-11-11 13:12:24.000000000 -0500
73678 +++ linux-3.0.9/net/mac80211/ieee80211_i.h 2011-11-15 20:03:00.000000000 -0500
73679 @@ -27,6 +27,7 @@
73680 #include <net/ieee80211_radiotap.h>
73681 #include <net/cfg80211.h>
73682 #include <net/mac80211.h>
73683 +#include <asm/local.h>
73684 #include "key.h"
73685 #include "sta_info.h"
73686
73687 @@ -723,7 +724,7 @@ struct ieee80211_local {
73688 /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
73689 spinlock_t queue_stop_reason_lock;
73690
73691 - int open_count;
73692 + local_t open_count;
73693 int monitors, cooked_mntrs;
73694 /* number of interfaces with corresponding FIF_ flags */
73695 int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
73696 diff -urNp linux-3.0.9/net/mac80211/iface.c linux-3.0.9/net/mac80211/iface.c
73697 --- linux-3.0.9/net/mac80211/iface.c 2011-11-11 13:12:24.000000000 -0500
73698 +++ linux-3.0.9/net/mac80211/iface.c 2011-11-15 20:03:00.000000000 -0500
73699 @@ -211,7 +211,7 @@ static int ieee80211_do_open(struct net_
73700 break;
73701 }
73702
73703 - if (local->open_count == 0) {
73704 + if (local_read(&local->open_count) == 0) {
73705 res = drv_start(local);
73706 if (res)
73707 goto err_del_bss;
73708 @@ -235,7 +235,7 @@ static int ieee80211_do_open(struct net_
73709 memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
73710
73711 if (!is_valid_ether_addr(dev->dev_addr)) {
73712 - if (!local->open_count)
73713 + if (!local_read(&local->open_count))
73714 drv_stop(local);
73715 return -EADDRNOTAVAIL;
73716 }
73717 @@ -327,7 +327,7 @@ static int ieee80211_do_open(struct net_
73718 mutex_unlock(&local->mtx);
73719
73720 if (coming_up)
73721 - local->open_count++;
73722 + local_inc(&local->open_count);
73723
73724 if (hw_reconf_flags) {
73725 ieee80211_hw_config(local, hw_reconf_flags);
73726 @@ -347,7 +347,7 @@ static int ieee80211_do_open(struct net_
73727 err_del_interface:
73728 drv_remove_interface(local, &sdata->vif);
73729 err_stop:
73730 - if (!local->open_count)
73731 + if (!local_read(&local->open_count))
73732 drv_stop(local);
73733 err_del_bss:
73734 sdata->bss = NULL;
73735 @@ -475,7 +475,7 @@ static void ieee80211_do_stop(struct iee
73736 }
73737
73738 if (going_down)
73739 - local->open_count--;
73740 + local_dec(&local->open_count);
73741
73742 switch (sdata->vif.type) {
73743 case NL80211_IFTYPE_AP_VLAN:
73744 @@ -534,7 +534,7 @@ static void ieee80211_do_stop(struct iee
73745
73746 ieee80211_recalc_ps(local, -1);
73747
73748 - if (local->open_count == 0) {
73749 + if (local_read(&local->open_count) == 0) {
73750 if (local->ops->napi_poll)
73751 napi_disable(&local->napi);
73752 ieee80211_clear_tx_pending(local);
73753 diff -urNp linux-3.0.9/net/mac80211/main.c linux-3.0.9/net/mac80211/main.c
73754 --- linux-3.0.9/net/mac80211/main.c 2011-11-11 13:12:24.000000000 -0500
73755 +++ linux-3.0.9/net/mac80211/main.c 2011-11-15 20:03:00.000000000 -0500
73756 @@ -209,7 +209,7 @@ int ieee80211_hw_config(struct ieee80211
73757 local->hw.conf.power_level = power;
73758 }
73759
73760 - if (changed && local->open_count) {
73761 + if (changed && local_read(&local->open_count)) {
73762 ret = drv_config(local, changed);
73763 /*
73764 * Goal:
73765 diff -urNp linux-3.0.9/net/mac80211/mlme.c linux-3.0.9/net/mac80211/mlme.c
73766 --- linux-3.0.9/net/mac80211/mlme.c 2011-11-11 13:12:24.000000000 -0500
73767 +++ linux-3.0.9/net/mac80211/mlme.c 2011-11-15 20:03:00.000000000 -0500
73768 @@ -1447,6 +1447,8 @@ static bool ieee80211_assoc_success(stru
73769 bool have_higher_than_11mbit = false;
73770 u16 ap_ht_cap_flags;
73771
73772 + pax_track_stack();
73773 +
73774 /* AssocResp and ReassocResp have identical structure */
73775
73776 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
73777 diff -urNp linux-3.0.9/net/mac80211/pm.c linux-3.0.9/net/mac80211/pm.c
73778 --- linux-3.0.9/net/mac80211/pm.c 2011-11-11 13:12:24.000000000 -0500
73779 +++ linux-3.0.9/net/mac80211/pm.c 2011-11-15 20:03:00.000000000 -0500
73780 @@ -47,7 +47,7 @@ int __ieee80211_suspend(struct ieee80211
73781 cancel_work_sync(&local->dynamic_ps_enable_work);
73782 del_timer_sync(&local->dynamic_ps_timer);
73783
73784 - local->wowlan = wowlan && local->open_count;
73785 + local->wowlan = wowlan && local_read(&local->open_count);
73786 if (local->wowlan) {
73787 int err = drv_suspend(local, wowlan);
73788 if (err) {
73789 @@ -111,7 +111,7 @@ int __ieee80211_suspend(struct ieee80211
73790 }
73791
73792 /* stop hardware - this must stop RX */
73793 - if (local->open_count)
73794 + if (local_read(&local->open_count))
73795 ieee80211_stop_device(local);
73796
73797 suspend:
73798 diff -urNp linux-3.0.9/net/mac80211/rate.c linux-3.0.9/net/mac80211/rate.c
73799 --- linux-3.0.9/net/mac80211/rate.c 2011-11-11 13:12:24.000000000 -0500
73800 +++ linux-3.0.9/net/mac80211/rate.c 2011-11-15 20:03:00.000000000 -0500
73801 @@ -371,7 +371,7 @@ int ieee80211_init_rate_ctrl_alg(struct
73802
73803 ASSERT_RTNL();
73804
73805 - if (local->open_count)
73806 + if (local_read(&local->open_count))
73807 return -EBUSY;
73808
73809 if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
73810 diff -urNp linux-3.0.9/net/mac80211/rc80211_pid_debugfs.c linux-3.0.9/net/mac80211/rc80211_pid_debugfs.c
73811 --- linux-3.0.9/net/mac80211/rc80211_pid_debugfs.c 2011-11-11 13:12:24.000000000 -0500
73812 +++ linux-3.0.9/net/mac80211/rc80211_pid_debugfs.c 2011-11-15 20:03:00.000000000 -0500
73813 @@ -192,7 +192,7 @@ static ssize_t rate_control_pid_events_r
73814
73815 spin_unlock_irqrestore(&events->lock, status);
73816
73817 - if (copy_to_user(buf, pb, p))
73818 + if (p > sizeof(pb) || copy_to_user(buf, pb, p))
73819 return -EFAULT;
73820
73821 return p;
73822 diff -urNp linux-3.0.9/net/mac80211/util.c linux-3.0.9/net/mac80211/util.c
73823 --- linux-3.0.9/net/mac80211/util.c 2011-11-11 13:12:24.000000000 -0500
73824 +++ linux-3.0.9/net/mac80211/util.c 2011-11-15 20:03:00.000000000 -0500
73825 @@ -1147,7 +1147,7 @@ int ieee80211_reconfig(struct ieee80211_
73826 #endif
73827
73828 /* restart hardware */
73829 - if (local->open_count) {
73830 + if (local_read(&local->open_count)) {
73831 /*
73832 * Upon resume hardware can sometimes be goofy due to
73833 * various platform / driver / bus issues, so restarting
73834 diff -urNp linux-3.0.9/net/netfilter/ipvs/ip_vs_conn.c linux-3.0.9/net/netfilter/ipvs/ip_vs_conn.c
73835 --- linux-3.0.9/net/netfilter/ipvs/ip_vs_conn.c 2011-11-11 13:12:24.000000000 -0500
73836 +++ linux-3.0.9/net/netfilter/ipvs/ip_vs_conn.c 2011-11-15 20:03:00.000000000 -0500
73837 @@ -556,7 +556,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s
73838 /* Increase the refcnt counter of the dest */
73839 atomic_inc(&dest->refcnt);
73840
73841 - conn_flags = atomic_read(&dest->conn_flags);
73842 + conn_flags = atomic_read_unchecked(&dest->conn_flags);
73843 if (cp->protocol != IPPROTO_UDP)
73844 conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
73845 /* Bind with the destination and its corresponding transmitter */
73846 @@ -869,7 +869,7 @@ ip_vs_conn_new(const struct ip_vs_conn_p
73847 atomic_set(&cp->refcnt, 1);
73848
73849 atomic_set(&cp->n_control, 0);
73850 - atomic_set(&cp->in_pkts, 0);
73851 + atomic_set_unchecked(&cp->in_pkts, 0);
73852
73853 atomic_inc(&ipvs->conn_count);
73854 if (flags & IP_VS_CONN_F_NO_CPORT)
73855 @@ -1149,7 +1149,7 @@ static inline int todrop_entry(struct ip
73856
73857 /* Don't drop the entry if its number of incoming packets is not
73858 located in [0, 8] */
73859 - i = atomic_read(&cp->in_pkts);
73860 + i = atomic_read_unchecked(&cp->in_pkts);
73861 if (i > 8 || i < 0) return 0;
73862
73863 if (!todrop_rate[i]) return 0;
73864 diff -urNp linux-3.0.9/net/netfilter/ipvs/ip_vs_core.c linux-3.0.9/net/netfilter/ipvs/ip_vs_core.c
73865 --- linux-3.0.9/net/netfilter/ipvs/ip_vs_core.c 2011-11-11 13:12:24.000000000 -0500
73866 +++ linux-3.0.9/net/netfilter/ipvs/ip_vs_core.c 2011-11-15 20:03:00.000000000 -0500
73867 @@ -563,7 +563,7 @@ int ip_vs_leave(struct ip_vs_service *sv
73868 ret = cp->packet_xmit(skb, cp, pd->pp);
73869 /* do not touch skb anymore */
73870
73871 - atomic_inc(&cp->in_pkts);
73872 + atomic_inc_unchecked(&cp->in_pkts);
73873 ip_vs_conn_put(cp);
73874 return ret;
73875 }
73876 @@ -1613,7 +1613,7 @@ ip_vs_in(unsigned int hooknum, struct sk
73877 if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
73878 pkts = sysctl_sync_threshold(ipvs);
73879 else
73880 - pkts = atomic_add_return(1, &cp->in_pkts);
73881 + pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
73882
73883 if ((ipvs->sync_state & IP_VS_STATE_MASTER) &&
73884 cp->protocol == IPPROTO_SCTP) {
73885 diff -urNp linux-3.0.9/net/netfilter/ipvs/ip_vs_ctl.c linux-3.0.9/net/netfilter/ipvs/ip_vs_ctl.c
73886 --- linux-3.0.9/net/netfilter/ipvs/ip_vs_ctl.c 2011-11-11 13:12:24.000000000 -0500
73887 +++ linux-3.0.9/net/netfilter/ipvs/ip_vs_ctl.c 2011-11-15 20:03:00.000000000 -0500
73888 @@ -782,7 +782,7 @@ __ip_vs_update_dest(struct ip_vs_service
73889 ip_vs_rs_hash(ipvs, dest);
73890 write_unlock_bh(&ipvs->rs_lock);
73891 }
73892 - atomic_set(&dest->conn_flags, conn_flags);
73893 + atomic_set_unchecked(&dest->conn_flags, conn_flags);
73894
73895 /* bind the service */
73896 if (!dest->svc) {
73897 @@ -2027,7 +2027,7 @@ static int ip_vs_info_seq_show(struct se
73898 " %-7s %-6d %-10d %-10d\n",
73899 &dest->addr.in6,
73900 ntohs(dest->port),
73901 - ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
73902 + ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
73903 atomic_read(&dest->weight),
73904 atomic_read(&dest->activeconns),
73905 atomic_read(&dest->inactconns));
73906 @@ -2038,7 +2038,7 @@ static int ip_vs_info_seq_show(struct se
73907 "%-7s %-6d %-10d %-10d\n",
73908 ntohl(dest->addr.ip),
73909 ntohs(dest->port),
73910 - ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
73911 + ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
73912 atomic_read(&dest->weight),
73913 atomic_read(&dest->activeconns),
73914 atomic_read(&dest->inactconns));
73915 @@ -2284,6 +2284,8 @@ do_ip_vs_set_ctl(struct sock *sk, int cm
73916 struct ip_vs_dest_user *udest_compat;
73917 struct ip_vs_dest_user_kern udest;
73918
73919 + pax_track_stack();
73920 +
73921 if (!capable(CAP_NET_ADMIN))
73922 return -EPERM;
73923
73924 @@ -2498,7 +2500,7 @@ __ip_vs_get_dest_entries(struct net *net
73925
73926 entry.addr = dest->addr.ip;
73927 entry.port = dest->port;
73928 - entry.conn_flags = atomic_read(&dest->conn_flags);
73929 + entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
73930 entry.weight = atomic_read(&dest->weight);
73931 entry.u_threshold = dest->u_threshold;
73932 entry.l_threshold = dest->l_threshold;
73933 @@ -3026,7 +3028,7 @@ static int ip_vs_genl_fill_dest(struct s
73934 NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
73935
73936 NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
73937 - atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
73938 + atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
73939 NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
73940 NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
73941 NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
73942 diff -urNp linux-3.0.9/net/netfilter/ipvs/ip_vs_sync.c linux-3.0.9/net/netfilter/ipvs/ip_vs_sync.c
73943 --- linux-3.0.9/net/netfilter/ipvs/ip_vs_sync.c 2011-11-11 13:12:24.000000000 -0500
73944 +++ linux-3.0.9/net/netfilter/ipvs/ip_vs_sync.c 2011-11-15 20:03:00.000000000 -0500
73945 @@ -648,7 +648,7 @@ control:
73946 * i.e only increment in_pkts for Templates.
73947 */
73948 if (cp->flags & IP_VS_CONN_F_TEMPLATE) {
73949 - int pkts = atomic_add_return(1, &cp->in_pkts);
73950 + int pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
73951
73952 if (pkts % sysctl_sync_period(ipvs) != 1)
73953 return;
73954 @@ -794,7 +794,7 @@ static void ip_vs_proc_conn(struct net *
73955
73956 if (opt)
73957 memcpy(&cp->in_seq, opt, sizeof(*opt));
73958 - atomic_set(&cp->in_pkts, sysctl_sync_threshold(ipvs));
73959 + atomic_set_unchecked(&cp->in_pkts, sysctl_sync_threshold(ipvs));
73960 cp->state = state;
73961 cp->old_state = cp->state;
73962 /*
73963 diff -urNp linux-3.0.9/net/netfilter/ipvs/ip_vs_xmit.c linux-3.0.9/net/netfilter/ipvs/ip_vs_xmit.c
73964 --- linux-3.0.9/net/netfilter/ipvs/ip_vs_xmit.c 2011-11-11 13:12:24.000000000 -0500
73965 +++ linux-3.0.9/net/netfilter/ipvs/ip_vs_xmit.c 2011-11-15 20:03:00.000000000 -0500
73966 @@ -1151,7 +1151,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, str
73967 else
73968 rc = NF_ACCEPT;
73969 /* do not touch skb anymore */
73970 - atomic_inc(&cp->in_pkts);
73971 + atomic_inc_unchecked(&cp->in_pkts);
73972 goto out;
73973 }
73974
73975 @@ -1272,7 +1272,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb,
73976 else
73977 rc = NF_ACCEPT;
73978 /* do not touch skb anymore */
73979 - atomic_inc(&cp->in_pkts);
73980 + atomic_inc_unchecked(&cp->in_pkts);
73981 goto out;
73982 }
73983
73984 diff -urNp linux-3.0.9/net/netfilter/Kconfig linux-3.0.9/net/netfilter/Kconfig
73985 --- linux-3.0.9/net/netfilter/Kconfig 2011-11-11 13:12:24.000000000 -0500
73986 +++ linux-3.0.9/net/netfilter/Kconfig 2011-11-15 20:03:00.000000000 -0500
73987 @@ -781,6 +781,16 @@ config NETFILTER_XT_MATCH_ESP
73988
73989 To compile it as a module, choose M here. If unsure, say N.
73990
73991 +config NETFILTER_XT_MATCH_GRADM
73992 + tristate '"gradm" match support'
73993 + depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
73994 + depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
73995 + ---help---
73996 + The gradm match allows to match on grsecurity RBAC being enabled.
73997 + It is useful when iptables rules are applied early on bootup to
73998 + prevent connections to the machine (except from a trusted host)
73999 + while the RBAC system is disabled.
74000 +
74001 config NETFILTER_XT_MATCH_HASHLIMIT
74002 tristate '"hashlimit" match support'
74003 depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
74004 diff -urNp linux-3.0.9/net/netfilter/Makefile linux-3.0.9/net/netfilter/Makefile
74005 --- linux-3.0.9/net/netfilter/Makefile 2011-11-11 13:12:24.000000000 -0500
74006 +++ linux-3.0.9/net/netfilter/Makefile 2011-11-15 20:03:00.000000000 -0500
74007 @@ -81,6 +81,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) +=
74008 obj-$(CONFIG_NETFILTER_XT_MATCH_DEVGROUP) += xt_devgroup.o
74009 obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
74010 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
74011 +obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
74012 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
74013 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
74014 obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
74015 diff -urNp linux-3.0.9/net/netfilter/nfnetlink_log.c linux-3.0.9/net/netfilter/nfnetlink_log.c
74016 --- linux-3.0.9/net/netfilter/nfnetlink_log.c 2011-11-11 13:12:24.000000000 -0500
74017 +++ linux-3.0.9/net/netfilter/nfnetlink_log.c 2011-11-15 20:03:00.000000000 -0500
74018 @@ -70,7 +70,7 @@ struct nfulnl_instance {
74019 };
74020
74021 static DEFINE_SPINLOCK(instances_lock);
74022 -static atomic_t global_seq;
74023 +static atomic_unchecked_t global_seq;
74024
74025 #define INSTANCE_BUCKETS 16
74026 static struct hlist_head instance_table[INSTANCE_BUCKETS];
74027 @@ -505,7 +505,7 @@ __build_packet_message(struct nfulnl_ins
74028 /* global sequence number */
74029 if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
74030 NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
74031 - htonl(atomic_inc_return(&global_seq)));
74032 + htonl(atomic_inc_return_unchecked(&global_seq)));
74033
74034 if (data_len) {
74035 struct nlattr *nla;
74036 diff -urNp linux-3.0.9/net/netfilter/nfnetlink_queue.c linux-3.0.9/net/netfilter/nfnetlink_queue.c
74037 --- linux-3.0.9/net/netfilter/nfnetlink_queue.c 2011-11-11 13:12:24.000000000 -0500
74038 +++ linux-3.0.9/net/netfilter/nfnetlink_queue.c 2011-11-15 20:03:00.000000000 -0500
74039 @@ -58,7 +58,7 @@ struct nfqnl_instance {
74040 */
74041 spinlock_t lock;
74042 unsigned int queue_total;
74043 - atomic_t id_sequence; /* 'sequence' of pkt ids */
74044 + atomic_unchecked_t id_sequence; /* 'sequence' of pkt ids */
74045 struct list_head queue_list; /* packets in queue */
74046 };
74047
74048 @@ -272,7 +272,7 @@ nfqnl_build_packet_message(struct nfqnl_
74049 nfmsg->version = NFNETLINK_V0;
74050 nfmsg->res_id = htons(queue->queue_num);
74051
74052 - entry->id = atomic_inc_return(&queue->id_sequence);
74053 + entry->id = atomic_inc_return_unchecked(&queue->id_sequence);
74054 pmsg.packet_id = htonl(entry->id);
74055 pmsg.hw_protocol = entskb->protocol;
74056 pmsg.hook = entry->hook;
74057 @@ -870,7 +870,7 @@ static int seq_show(struct seq_file *s,
74058 inst->peer_pid, inst->queue_total,
74059 inst->copy_mode, inst->copy_range,
74060 inst->queue_dropped, inst->queue_user_dropped,
74061 - atomic_read(&inst->id_sequence), 1);
74062 + atomic_read_unchecked(&inst->id_sequence), 1);
74063 }
74064
74065 static const struct seq_operations nfqnl_seq_ops = {
74066 diff -urNp linux-3.0.9/net/netfilter/xt_gradm.c linux-3.0.9/net/netfilter/xt_gradm.c
74067 --- linux-3.0.9/net/netfilter/xt_gradm.c 1969-12-31 19:00:00.000000000 -0500
74068 +++ linux-3.0.9/net/netfilter/xt_gradm.c 2011-11-15 20:03:00.000000000 -0500
74069 @@ -0,0 +1,51 @@
74070 +/*
74071 + * gradm match for netfilter
74072 + * Copyright © Zbigniew Krzystolik, 2010
74073 + *
74074 + * This program is free software; you can redistribute it and/or modify
74075 + * it under the terms of the GNU General Public License; either version
74076 + * 2 or 3 as published by the Free Software Foundation.
74077 + */
74078 +#include <linux/module.h>
74079 +#include <linux/moduleparam.h>
74080 +#include <linux/skbuff.h>
74081 +#include <linux/netfilter/x_tables.h>
74082 +#include <linux/grsecurity.h>
74083 +#include <linux/netfilter/xt_gradm.h>
74084 +
74085 +static bool
74086 +gradm_mt(const struct sk_buff *skb, struct xt_action_param *par)
74087 +{
74088 + const struct xt_gradm_mtinfo *info = par->matchinfo;
74089 + bool retval = false;
74090 + if (gr_acl_is_enabled())
74091 + retval = true;
74092 + return retval ^ info->invflags;
74093 +}
74094 +
74095 +static struct xt_match gradm_mt_reg __read_mostly = {
74096 + .name = "gradm",
74097 + .revision = 0,
74098 + .family = NFPROTO_UNSPEC,
74099 + .match = gradm_mt,
74100 + .matchsize = XT_ALIGN(sizeof(struct xt_gradm_mtinfo)),
74101 + .me = THIS_MODULE,
74102 +};
74103 +
74104 +static int __init gradm_mt_init(void)
74105 +{
74106 + return xt_register_match(&gradm_mt_reg);
74107 +}
74108 +
74109 +static void __exit gradm_mt_exit(void)
74110 +{
74111 + xt_unregister_match(&gradm_mt_reg);
74112 +}
74113 +
74114 +module_init(gradm_mt_init);
74115 +module_exit(gradm_mt_exit);
74116 +MODULE_AUTHOR("Zbigniew Krzystolik <zbyniu@destrukcja.pl>");
74117 +MODULE_DESCRIPTION("Xtables: Grsecurity RBAC match");
74118 +MODULE_LICENSE("GPL");
74119 +MODULE_ALIAS("ipt_gradm");
74120 +MODULE_ALIAS("ip6t_gradm");
74121 diff -urNp linux-3.0.9/net/netfilter/xt_statistic.c linux-3.0.9/net/netfilter/xt_statistic.c
74122 --- linux-3.0.9/net/netfilter/xt_statistic.c 2011-11-11 13:12:24.000000000 -0500
74123 +++ linux-3.0.9/net/netfilter/xt_statistic.c 2011-11-15 20:03:00.000000000 -0500
74124 @@ -18,7 +18,7 @@
74125 #include <linux/netfilter/x_tables.h>
74126
74127 struct xt_statistic_priv {
74128 - atomic_t count;
74129 + atomic_unchecked_t count;
74130 } ____cacheline_aligned_in_smp;
74131
74132 MODULE_LICENSE("GPL");
74133 @@ -41,9 +41,9 @@ statistic_mt(const struct sk_buff *skb,
74134 break;
74135 case XT_STATISTIC_MODE_NTH:
74136 do {
74137 - oval = atomic_read(&info->master->count);
74138 + oval = atomic_read_unchecked(&info->master->count);
74139 nval = (oval == info->u.nth.every) ? 0 : oval + 1;
74140 - } while (atomic_cmpxchg(&info->master->count, oval, nval) != oval);
74141 + } while (atomic_cmpxchg_unchecked(&info->master->count, oval, nval) != oval);
74142 if (nval == 0)
74143 ret = !ret;
74144 break;
74145 @@ -63,7 +63,7 @@ static int statistic_mt_check(const stru
74146 info->master = kzalloc(sizeof(*info->master), GFP_KERNEL);
74147 if (info->master == NULL)
74148 return -ENOMEM;
74149 - atomic_set(&info->master->count, info->u.nth.count);
74150 + atomic_set_unchecked(&info->master->count, info->u.nth.count);
74151
74152 return 0;
74153 }
74154 diff -urNp linux-3.0.9/net/netlink/af_netlink.c linux-3.0.9/net/netlink/af_netlink.c
74155 --- linux-3.0.9/net/netlink/af_netlink.c 2011-11-11 13:12:24.000000000 -0500
74156 +++ linux-3.0.9/net/netlink/af_netlink.c 2011-11-15 20:03:00.000000000 -0500
74157 @@ -742,7 +742,7 @@ static void netlink_overrun(struct sock
74158 sk->sk_error_report(sk);
74159 }
74160 }
74161 - atomic_inc(&sk->sk_drops);
74162 + atomic_inc_unchecked(&sk->sk_drops);
74163 }
74164
74165 static struct sock *netlink_getsockbypid(struct sock *ssk, u32 pid)
74166 @@ -1994,7 +1994,7 @@ static int netlink_seq_show(struct seq_f
74167 sk_wmem_alloc_get(s),
74168 nlk->cb,
74169 atomic_read(&s->sk_refcnt),
74170 - atomic_read(&s->sk_drops),
74171 + atomic_read_unchecked(&s->sk_drops),
74172 sock_i_ino(s)
74173 );
74174
74175 diff -urNp linux-3.0.9/net/netrom/af_netrom.c linux-3.0.9/net/netrom/af_netrom.c
74176 --- linux-3.0.9/net/netrom/af_netrom.c 2011-11-11 13:12:24.000000000 -0500
74177 +++ linux-3.0.9/net/netrom/af_netrom.c 2011-11-15 20:03:00.000000000 -0500
74178 @@ -839,6 +839,7 @@ static int nr_getname(struct socket *soc
74179 struct sock *sk = sock->sk;
74180 struct nr_sock *nr = nr_sk(sk);
74181
74182 + memset(sax, 0, sizeof(*sax));
74183 lock_sock(sk);
74184 if (peer != 0) {
74185 if (sk->sk_state != TCP_ESTABLISHED) {
74186 @@ -853,7 +854,6 @@ static int nr_getname(struct socket *soc
74187 *uaddr_len = sizeof(struct full_sockaddr_ax25);
74188 } else {
74189 sax->fsa_ax25.sax25_family = AF_NETROM;
74190 - sax->fsa_ax25.sax25_ndigis = 0;
74191 sax->fsa_ax25.sax25_call = nr->source_addr;
74192 *uaddr_len = sizeof(struct sockaddr_ax25);
74193 }
74194 diff -urNp linux-3.0.9/net/packet/af_packet.c linux-3.0.9/net/packet/af_packet.c
74195 --- linux-3.0.9/net/packet/af_packet.c 2011-11-11 13:12:24.000000000 -0500
74196 +++ linux-3.0.9/net/packet/af_packet.c 2011-11-15 20:03:00.000000000 -0500
74197 @@ -647,7 +647,7 @@ static int packet_rcv(struct sk_buff *sk
74198
74199 spin_lock(&sk->sk_receive_queue.lock);
74200 po->stats.tp_packets++;
74201 - skb->dropcount = atomic_read(&sk->sk_drops);
74202 + skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
74203 __skb_queue_tail(&sk->sk_receive_queue, skb);
74204 spin_unlock(&sk->sk_receive_queue.lock);
74205 sk->sk_data_ready(sk, skb->len);
74206 @@ -656,7 +656,7 @@ static int packet_rcv(struct sk_buff *sk
74207 drop_n_acct:
74208 spin_lock(&sk->sk_receive_queue.lock);
74209 po->stats.tp_drops++;
74210 - atomic_inc(&sk->sk_drops);
74211 + atomic_inc_unchecked(&sk->sk_drops);
74212 spin_unlock(&sk->sk_receive_queue.lock);
74213
74214 drop_n_restore:
74215 @@ -2171,7 +2171,7 @@ static int packet_getsockopt(struct sock
74216 case PACKET_HDRLEN:
74217 if (len > sizeof(int))
74218 len = sizeof(int);
74219 - if (copy_from_user(&val, optval, len))
74220 + if (len > sizeof(val) || copy_from_user(&val, optval, len))
74221 return -EFAULT;
74222 switch (val) {
74223 case TPACKET_V1:
74224 @@ -2209,7 +2209,7 @@ static int packet_getsockopt(struct sock
74225
74226 if (put_user(len, optlen))
74227 return -EFAULT;
74228 - if (copy_to_user(optval, data, len))
74229 + if (len > sizeof(st) || copy_to_user(optval, data, len))
74230 return -EFAULT;
74231 return 0;
74232 }
74233 diff -urNp linux-3.0.9/net/phonet/af_phonet.c linux-3.0.9/net/phonet/af_phonet.c
74234 --- linux-3.0.9/net/phonet/af_phonet.c 2011-11-11 13:12:24.000000000 -0500
74235 +++ linux-3.0.9/net/phonet/af_phonet.c 2011-11-15 20:03:00.000000000 -0500
74236 @@ -41,7 +41,7 @@ static struct phonet_protocol *phonet_pr
74237 {
74238 struct phonet_protocol *pp;
74239
74240 - if (protocol >= PHONET_NPROTO)
74241 + if (protocol < 0 || protocol >= PHONET_NPROTO)
74242 return NULL;
74243
74244 rcu_read_lock();
74245 @@ -469,7 +469,7 @@ int __init_or_module phonet_proto_regist
74246 {
74247 int err = 0;
74248
74249 - if (protocol >= PHONET_NPROTO)
74250 + if (protocol < 0 || protocol >= PHONET_NPROTO)
74251 return -EINVAL;
74252
74253 err = proto_register(pp->prot, 1);
74254 diff -urNp linux-3.0.9/net/phonet/pep.c linux-3.0.9/net/phonet/pep.c
74255 --- linux-3.0.9/net/phonet/pep.c 2011-11-11 13:12:24.000000000 -0500
74256 +++ linux-3.0.9/net/phonet/pep.c 2011-11-15 20:03:00.000000000 -0500
74257 @@ -387,7 +387,7 @@ static int pipe_do_rcv(struct sock *sk,
74258
74259 case PNS_PEP_CTRL_REQ:
74260 if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) {
74261 - atomic_inc(&sk->sk_drops);
74262 + atomic_inc_unchecked(&sk->sk_drops);
74263 break;
74264 }
74265 __skb_pull(skb, 4);
74266 @@ -408,7 +408,7 @@ static int pipe_do_rcv(struct sock *sk,
74267 }
74268
74269 if (pn->rx_credits == 0) {
74270 - atomic_inc(&sk->sk_drops);
74271 + atomic_inc_unchecked(&sk->sk_drops);
74272 err = -ENOBUFS;
74273 break;
74274 }
74275 @@ -556,7 +556,7 @@ static int pipe_handler_do_rcv(struct so
74276 }
74277
74278 if (pn->rx_credits == 0) {
74279 - atomic_inc(&sk->sk_drops);
74280 + atomic_inc_unchecked(&sk->sk_drops);
74281 err = NET_RX_DROP;
74282 break;
74283 }
74284 diff -urNp linux-3.0.9/net/phonet/socket.c linux-3.0.9/net/phonet/socket.c
74285 --- linux-3.0.9/net/phonet/socket.c 2011-11-11 13:12:24.000000000 -0500
74286 +++ linux-3.0.9/net/phonet/socket.c 2011-11-15 20:03:00.000000000 -0500
74287 @@ -612,8 +612,13 @@ static int pn_sock_seq_show(struct seq_f
74288 pn->resource, sk->sk_state,
74289 sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
74290 sock_i_uid(sk), sock_i_ino(sk),
74291 - atomic_read(&sk->sk_refcnt), sk,
74292 - atomic_read(&sk->sk_drops), &len);
74293 + atomic_read(&sk->sk_refcnt),
74294 +#ifdef CONFIG_GRKERNSEC_HIDESYM
74295 + NULL,
74296 +#else
74297 + sk,
74298 +#endif
74299 + atomic_read_unchecked(&sk->sk_drops), &len);
74300 }
74301 seq_printf(seq, "%*s\n", 127 - len, "");
74302 return 0;
74303 diff -urNp linux-3.0.9/net/rds/cong.c linux-3.0.9/net/rds/cong.c
74304 --- linux-3.0.9/net/rds/cong.c 2011-11-11 13:12:24.000000000 -0500
74305 +++ linux-3.0.9/net/rds/cong.c 2011-11-15 20:03:00.000000000 -0500
74306 @@ -77,7 +77,7 @@
74307 * finds that the saved generation number is smaller than the global generation
74308 * number, it wakes up the process.
74309 */
74310 -static atomic_t rds_cong_generation = ATOMIC_INIT(0);
74311 +static atomic_unchecked_t rds_cong_generation = ATOMIC_INIT(0);
74312
74313 /*
74314 * Congestion monitoring
74315 @@ -232,7 +232,7 @@ void rds_cong_map_updated(struct rds_con
74316 rdsdebug("waking map %p for %pI4\n",
74317 map, &map->m_addr);
74318 rds_stats_inc(s_cong_update_received);
74319 - atomic_inc(&rds_cong_generation);
74320 + atomic_inc_unchecked(&rds_cong_generation);
74321 if (waitqueue_active(&map->m_waitq))
74322 wake_up(&map->m_waitq);
74323 if (waitqueue_active(&rds_poll_waitq))
74324 @@ -258,7 +258,7 @@ EXPORT_SYMBOL_GPL(rds_cong_map_updated);
74325
74326 int rds_cong_updated_since(unsigned long *recent)
74327 {
74328 - unsigned long gen = atomic_read(&rds_cong_generation);
74329 + unsigned long gen = atomic_read_unchecked(&rds_cong_generation);
74330
74331 if (likely(*recent == gen))
74332 return 0;
74333 diff -urNp linux-3.0.9/net/rds/ib_cm.c linux-3.0.9/net/rds/ib_cm.c
74334 --- linux-3.0.9/net/rds/ib_cm.c 2011-11-11 13:12:24.000000000 -0500
74335 +++ linux-3.0.9/net/rds/ib_cm.c 2011-11-15 20:03:00.000000000 -0500
74336 @@ -720,7 +720,7 @@ void rds_ib_conn_shutdown(struct rds_con
74337 /* Clear the ACK state */
74338 clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
74339 #ifdef KERNEL_HAS_ATOMIC64
74340 - atomic64_set(&ic->i_ack_next, 0);
74341 + atomic64_set_unchecked(&ic->i_ack_next, 0);
74342 #else
74343 ic->i_ack_next = 0;
74344 #endif
74345 diff -urNp linux-3.0.9/net/rds/ib.h linux-3.0.9/net/rds/ib.h
74346 --- linux-3.0.9/net/rds/ib.h 2011-11-11 13:12:24.000000000 -0500
74347 +++ linux-3.0.9/net/rds/ib.h 2011-11-15 20:03:00.000000000 -0500
74348 @@ -127,7 +127,7 @@ struct rds_ib_connection {
74349 /* sending acks */
74350 unsigned long i_ack_flags;
74351 #ifdef KERNEL_HAS_ATOMIC64
74352 - atomic64_t i_ack_next; /* next ACK to send */
74353 + atomic64_unchecked_t i_ack_next; /* next ACK to send */
74354 #else
74355 spinlock_t i_ack_lock; /* protect i_ack_next */
74356 u64 i_ack_next; /* next ACK to send */
74357 diff -urNp linux-3.0.9/net/rds/ib_recv.c linux-3.0.9/net/rds/ib_recv.c
74358 --- linux-3.0.9/net/rds/ib_recv.c 2011-11-11 13:12:24.000000000 -0500
74359 +++ linux-3.0.9/net/rds/ib_recv.c 2011-11-15 20:03:00.000000000 -0500
74360 @@ -592,7 +592,7 @@ static u64 rds_ib_get_ack(struct rds_ib_
74361 static void rds_ib_set_ack(struct rds_ib_connection *ic, u64 seq,
74362 int ack_required)
74363 {
74364 - atomic64_set(&ic->i_ack_next, seq);
74365 + atomic64_set_unchecked(&ic->i_ack_next, seq);
74366 if (ack_required) {
74367 smp_mb__before_clear_bit();
74368 set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
74369 @@ -604,7 +604,7 @@ static u64 rds_ib_get_ack(struct rds_ib_
74370 clear_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
74371 smp_mb__after_clear_bit();
74372
74373 - return atomic64_read(&ic->i_ack_next);
74374 + return atomic64_read_unchecked(&ic->i_ack_next);
74375 }
74376 #endif
74377
74378 diff -urNp linux-3.0.9/net/rds/iw_cm.c linux-3.0.9/net/rds/iw_cm.c
74379 --- linux-3.0.9/net/rds/iw_cm.c 2011-11-11 13:12:24.000000000 -0500
74380 +++ linux-3.0.9/net/rds/iw_cm.c 2011-11-15 20:03:00.000000000 -0500
74381 @@ -664,7 +664,7 @@ void rds_iw_conn_shutdown(struct rds_con
74382 /* Clear the ACK state */
74383 clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
74384 #ifdef KERNEL_HAS_ATOMIC64
74385 - atomic64_set(&ic->i_ack_next, 0);
74386 + atomic64_set_unchecked(&ic->i_ack_next, 0);
74387 #else
74388 ic->i_ack_next = 0;
74389 #endif
74390 diff -urNp linux-3.0.9/net/rds/iw.h linux-3.0.9/net/rds/iw.h
74391 --- linux-3.0.9/net/rds/iw.h 2011-11-11 13:12:24.000000000 -0500
74392 +++ linux-3.0.9/net/rds/iw.h 2011-11-15 20:03:00.000000000 -0500
74393 @@ -133,7 +133,7 @@ struct rds_iw_connection {
74394 /* sending acks */
74395 unsigned long i_ack_flags;
74396 #ifdef KERNEL_HAS_ATOMIC64
74397 - atomic64_t i_ack_next; /* next ACK to send */
74398 + atomic64_unchecked_t i_ack_next; /* next ACK to send */
74399 #else
74400 spinlock_t i_ack_lock; /* protect i_ack_next */
74401 u64 i_ack_next; /* next ACK to send */
74402 diff -urNp linux-3.0.9/net/rds/iw_rdma.c linux-3.0.9/net/rds/iw_rdma.c
74403 --- linux-3.0.9/net/rds/iw_rdma.c 2011-11-11 13:12:24.000000000 -0500
74404 +++ linux-3.0.9/net/rds/iw_rdma.c 2011-11-15 20:03:00.000000000 -0500
74405 @@ -182,6 +182,8 @@ int rds_iw_update_cm_id(struct rds_iw_de
74406 struct rdma_cm_id *pcm_id;
74407 int rc;
74408
74409 + pax_track_stack();
74410 +
74411 src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
74412 dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
74413
74414 diff -urNp linux-3.0.9/net/rds/iw_recv.c linux-3.0.9/net/rds/iw_recv.c
74415 --- linux-3.0.9/net/rds/iw_recv.c 2011-11-11 13:12:24.000000000 -0500
74416 +++ linux-3.0.9/net/rds/iw_recv.c 2011-11-15 20:03:00.000000000 -0500
74417 @@ -427,7 +427,7 @@ static u64 rds_iw_get_ack(struct rds_iw_
74418 static void rds_iw_set_ack(struct rds_iw_connection *ic, u64 seq,
74419 int ack_required)
74420 {
74421 - atomic64_set(&ic->i_ack_next, seq);
74422 + atomic64_set_unchecked(&ic->i_ack_next, seq);
74423 if (ack_required) {
74424 smp_mb__before_clear_bit();
74425 set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
74426 @@ -439,7 +439,7 @@ static u64 rds_iw_get_ack(struct rds_iw_
74427 clear_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
74428 smp_mb__after_clear_bit();
74429
74430 - return atomic64_read(&ic->i_ack_next);
74431 + return atomic64_read_unchecked(&ic->i_ack_next);
74432 }
74433 #endif
74434
74435 diff -urNp linux-3.0.9/net/rds/tcp.c linux-3.0.9/net/rds/tcp.c
74436 --- linux-3.0.9/net/rds/tcp.c 2011-11-11 13:12:24.000000000 -0500
74437 +++ linux-3.0.9/net/rds/tcp.c 2011-11-15 20:03:00.000000000 -0500
74438 @@ -58,7 +58,7 @@ void rds_tcp_nonagle(struct socket *sock
74439 int val = 1;
74440
74441 set_fs(KERNEL_DS);
74442 - sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __user *)&val,
74443 + sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __force_user *)&val,
74444 sizeof(val));
74445 set_fs(oldfs);
74446 }
74447 diff -urNp linux-3.0.9/net/rds/tcp_send.c linux-3.0.9/net/rds/tcp_send.c
74448 --- linux-3.0.9/net/rds/tcp_send.c 2011-11-11 13:12:24.000000000 -0500
74449 +++ linux-3.0.9/net/rds/tcp_send.c 2011-11-15 20:03:00.000000000 -0500
74450 @@ -43,7 +43,7 @@ static void rds_tcp_cork(struct socket *
74451
74452 oldfs = get_fs();
74453 set_fs(KERNEL_DS);
74454 - sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __user *)&val,
74455 + sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __force_user *)&val,
74456 sizeof(val));
74457 set_fs(oldfs);
74458 }
74459 diff -urNp linux-3.0.9/net/rxrpc/af_rxrpc.c linux-3.0.9/net/rxrpc/af_rxrpc.c
74460 --- linux-3.0.9/net/rxrpc/af_rxrpc.c 2011-11-11 13:12:24.000000000 -0500
74461 +++ linux-3.0.9/net/rxrpc/af_rxrpc.c 2011-11-15 20:03:00.000000000 -0500
74462 @@ -39,7 +39,7 @@ static const struct proto_ops rxrpc_rpc_
74463 __be32 rxrpc_epoch;
74464
74465 /* current debugging ID */
74466 -atomic_t rxrpc_debug_id;
74467 +atomic_unchecked_t rxrpc_debug_id;
74468
74469 /* count of skbs currently in use */
74470 atomic_t rxrpc_n_skbs;
74471 diff -urNp linux-3.0.9/net/rxrpc/ar-ack.c linux-3.0.9/net/rxrpc/ar-ack.c
74472 --- linux-3.0.9/net/rxrpc/ar-ack.c 2011-11-11 13:12:24.000000000 -0500
74473 +++ linux-3.0.9/net/rxrpc/ar-ack.c 2011-11-15 20:03:00.000000000 -0500
74474 @@ -175,7 +175,7 @@ static void rxrpc_resend(struct rxrpc_ca
74475
74476 _enter("{%d,%d,%d,%d},",
74477 call->acks_hard, call->acks_unacked,
74478 - atomic_read(&call->sequence),
74479 + atomic_read_unchecked(&call->sequence),
74480 CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
74481
74482 stop = 0;
74483 @@ -199,7 +199,7 @@ static void rxrpc_resend(struct rxrpc_ca
74484
74485 /* each Tx packet has a new serial number */
74486 sp->hdr.serial =
74487 - htonl(atomic_inc_return(&call->conn->serial));
74488 + htonl(atomic_inc_return_unchecked(&call->conn->serial));
74489
74490 hdr = (struct rxrpc_header *) txb->head;
74491 hdr->serial = sp->hdr.serial;
74492 @@ -403,7 +403,7 @@ static void rxrpc_rotate_tx_window(struc
74493 */
74494 static void rxrpc_clear_tx_window(struct rxrpc_call *call)
74495 {
74496 - rxrpc_rotate_tx_window(call, atomic_read(&call->sequence));
74497 + rxrpc_rotate_tx_window(call, atomic_read_unchecked(&call->sequence));
74498 }
74499
74500 /*
74501 @@ -629,7 +629,7 @@ process_further:
74502
74503 latest = ntohl(sp->hdr.serial);
74504 hard = ntohl(ack.firstPacket);
74505 - tx = atomic_read(&call->sequence);
74506 + tx = atomic_read_unchecked(&call->sequence);
74507
74508 _proto("Rx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
74509 latest,
74510 @@ -842,6 +842,8 @@ void rxrpc_process_call(struct work_stru
74511 u32 abort_code = RX_PROTOCOL_ERROR;
74512 u8 *acks = NULL;
74513
74514 + pax_track_stack();
74515 +
74516 //printk("\n--------------------\n");
74517 _enter("{%d,%s,%lx} [%lu]",
74518 call->debug_id, rxrpc_call_states[call->state], call->events,
74519 @@ -1161,7 +1163,7 @@ void rxrpc_process_call(struct work_stru
74520 goto maybe_reschedule;
74521
74522 send_ACK_with_skew:
74523 - ack.maxSkew = htons(atomic_read(&call->conn->hi_serial) -
74524 + ack.maxSkew = htons(atomic_read_unchecked(&call->conn->hi_serial) -
74525 ntohl(ack.serial));
74526 send_ACK:
74527 mtu = call->conn->trans->peer->if_mtu;
74528 @@ -1173,7 +1175,7 @@ send_ACK:
74529 ackinfo.rxMTU = htonl(5692);
74530 ackinfo.jumbo_max = htonl(4);
74531
74532 - hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
74533 + hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
74534 _proto("Tx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
74535 ntohl(hdr.serial),
74536 ntohs(ack.maxSkew),
74537 @@ -1191,7 +1193,7 @@ send_ACK:
74538 send_message:
74539 _debug("send message");
74540
74541 - hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
74542 + hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
74543 _proto("Tx %s %%%u", rxrpc_pkts[hdr.type], ntohl(hdr.serial));
74544 send_message_2:
74545
74546 diff -urNp linux-3.0.9/net/rxrpc/ar-call.c linux-3.0.9/net/rxrpc/ar-call.c
74547 --- linux-3.0.9/net/rxrpc/ar-call.c 2011-11-11 13:12:24.000000000 -0500
74548 +++ linux-3.0.9/net/rxrpc/ar-call.c 2011-11-15 20:03:00.000000000 -0500
74549 @@ -83,7 +83,7 @@ static struct rxrpc_call *rxrpc_alloc_ca
74550 spin_lock_init(&call->lock);
74551 rwlock_init(&call->state_lock);
74552 atomic_set(&call->usage, 1);
74553 - call->debug_id = atomic_inc_return(&rxrpc_debug_id);
74554 + call->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
74555 call->state = RXRPC_CALL_CLIENT_SEND_REQUEST;
74556
74557 memset(&call->sock_node, 0xed, sizeof(call->sock_node));
74558 diff -urNp linux-3.0.9/net/rxrpc/ar-connection.c linux-3.0.9/net/rxrpc/ar-connection.c
74559 --- linux-3.0.9/net/rxrpc/ar-connection.c 2011-11-11 13:12:24.000000000 -0500
74560 +++ linux-3.0.9/net/rxrpc/ar-connection.c 2011-11-15 20:03:00.000000000 -0500
74561 @@ -206,7 +206,7 @@ static struct rxrpc_connection *rxrpc_al
74562 rwlock_init(&conn->lock);
74563 spin_lock_init(&conn->state_lock);
74564 atomic_set(&conn->usage, 1);
74565 - conn->debug_id = atomic_inc_return(&rxrpc_debug_id);
74566 + conn->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
74567 conn->avail_calls = RXRPC_MAXCALLS;
74568 conn->size_align = 4;
74569 conn->header_size = sizeof(struct rxrpc_header);
74570 diff -urNp linux-3.0.9/net/rxrpc/ar-connevent.c linux-3.0.9/net/rxrpc/ar-connevent.c
74571 --- linux-3.0.9/net/rxrpc/ar-connevent.c 2011-11-11 13:12:24.000000000 -0500
74572 +++ linux-3.0.9/net/rxrpc/ar-connevent.c 2011-11-15 20:03:00.000000000 -0500
74573 @@ -109,7 +109,7 @@ static int rxrpc_abort_connection(struct
74574
74575 len = iov[0].iov_len + iov[1].iov_len;
74576
74577 - hdr.serial = htonl(atomic_inc_return(&conn->serial));
74578 + hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
74579 _proto("Tx CONN ABORT %%%u { %d }", ntohl(hdr.serial), abort_code);
74580
74581 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
74582 diff -urNp linux-3.0.9/net/rxrpc/ar-input.c linux-3.0.9/net/rxrpc/ar-input.c
74583 --- linux-3.0.9/net/rxrpc/ar-input.c 2011-11-11 13:12:24.000000000 -0500
74584 +++ linux-3.0.9/net/rxrpc/ar-input.c 2011-11-15 20:03:00.000000000 -0500
74585 @@ -340,9 +340,9 @@ void rxrpc_fast_process_packet(struct rx
74586 /* track the latest serial number on this connection for ACK packet
74587 * information */
74588 serial = ntohl(sp->hdr.serial);
74589 - hi_serial = atomic_read(&call->conn->hi_serial);
74590 + hi_serial = atomic_read_unchecked(&call->conn->hi_serial);
74591 while (serial > hi_serial)
74592 - hi_serial = atomic_cmpxchg(&call->conn->hi_serial, hi_serial,
74593 + hi_serial = atomic_cmpxchg_unchecked(&call->conn->hi_serial, hi_serial,
74594 serial);
74595
74596 /* request ACK generation for any ACK or DATA packet that requests
74597 diff -urNp linux-3.0.9/net/rxrpc/ar-internal.h linux-3.0.9/net/rxrpc/ar-internal.h
74598 --- linux-3.0.9/net/rxrpc/ar-internal.h 2011-11-11 13:12:24.000000000 -0500
74599 +++ linux-3.0.9/net/rxrpc/ar-internal.h 2011-11-15 20:03:00.000000000 -0500
74600 @@ -272,8 +272,8 @@ struct rxrpc_connection {
74601 int error; /* error code for local abort */
74602 int debug_id; /* debug ID for printks */
74603 unsigned call_counter; /* call ID counter */
74604 - atomic_t serial; /* packet serial number counter */
74605 - atomic_t hi_serial; /* highest serial number received */
74606 + atomic_unchecked_t serial; /* packet serial number counter */
74607 + atomic_unchecked_t hi_serial; /* highest serial number received */
74608 u8 avail_calls; /* number of calls available */
74609 u8 size_align; /* data size alignment (for security) */
74610 u8 header_size; /* rxrpc + security header size */
74611 @@ -346,7 +346,7 @@ struct rxrpc_call {
74612 spinlock_t lock;
74613 rwlock_t state_lock; /* lock for state transition */
74614 atomic_t usage;
74615 - atomic_t sequence; /* Tx data packet sequence counter */
74616 + atomic_unchecked_t sequence; /* Tx data packet sequence counter */
74617 u32 abort_code; /* local/remote abort code */
74618 enum { /* current state of call */
74619 RXRPC_CALL_CLIENT_SEND_REQUEST, /* - client sending request phase */
74620 @@ -420,7 +420,7 @@ static inline void rxrpc_abort_call(stru
74621 */
74622 extern atomic_t rxrpc_n_skbs;
74623 extern __be32 rxrpc_epoch;
74624 -extern atomic_t rxrpc_debug_id;
74625 +extern atomic_unchecked_t rxrpc_debug_id;
74626 extern struct workqueue_struct *rxrpc_workqueue;
74627
74628 /*
74629 diff -urNp linux-3.0.9/net/rxrpc/ar-local.c linux-3.0.9/net/rxrpc/ar-local.c
74630 --- linux-3.0.9/net/rxrpc/ar-local.c 2011-11-11 13:12:24.000000000 -0500
74631 +++ linux-3.0.9/net/rxrpc/ar-local.c 2011-11-15 20:03:00.000000000 -0500
74632 @@ -45,7 +45,7 @@ struct rxrpc_local *rxrpc_alloc_local(st
74633 spin_lock_init(&local->lock);
74634 rwlock_init(&local->services_lock);
74635 atomic_set(&local->usage, 1);
74636 - local->debug_id = atomic_inc_return(&rxrpc_debug_id);
74637 + local->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
74638 memcpy(&local->srx, srx, sizeof(*srx));
74639 }
74640
74641 diff -urNp linux-3.0.9/net/rxrpc/ar-output.c linux-3.0.9/net/rxrpc/ar-output.c
74642 --- linux-3.0.9/net/rxrpc/ar-output.c 2011-11-11 13:12:24.000000000 -0500
74643 +++ linux-3.0.9/net/rxrpc/ar-output.c 2011-11-15 20:03:00.000000000 -0500
74644 @@ -681,9 +681,9 @@ static int rxrpc_send_data(struct kiocb
74645 sp->hdr.cid = call->cid;
74646 sp->hdr.callNumber = call->call_id;
74647 sp->hdr.seq =
74648 - htonl(atomic_inc_return(&call->sequence));
74649 + htonl(atomic_inc_return_unchecked(&call->sequence));
74650 sp->hdr.serial =
74651 - htonl(atomic_inc_return(&conn->serial));
74652 + htonl(atomic_inc_return_unchecked(&conn->serial));
74653 sp->hdr.type = RXRPC_PACKET_TYPE_DATA;
74654 sp->hdr.userStatus = 0;
74655 sp->hdr.securityIndex = conn->security_ix;
74656 diff -urNp linux-3.0.9/net/rxrpc/ar-peer.c linux-3.0.9/net/rxrpc/ar-peer.c
74657 --- linux-3.0.9/net/rxrpc/ar-peer.c 2011-11-11 13:12:24.000000000 -0500
74658 +++ linux-3.0.9/net/rxrpc/ar-peer.c 2011-11-15 20:03:00.000000000 -0500
74659 @@ -72,7 +72,7 @@ static struct rxrpc_peer *rxrpc_alloc_pe
74660 INIT_LIST_HEAD(&peer->error_targets);
74661 spin_lock_init(&peer->lock);
74662 atomic_set(&peer->usage, 1);
74663 - peer->debug_id = atomic_inc_return(&rxrpc_debug_id);
74664 + peer->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
74665 memcpy(&peer->srx, srx, sizeof(*srx));
74666
74667 rxrpc_assess_MTU_size(peer);
74668 diff -urNp linux-3.0.9/net/rxrpc/ar-proc.c linux-3.0.9/net/rxrpc/ar-proc.c
74669 --- linux-3.0.9/net/rxrpc/ar-proc.c 2011-11-11 13:12:24.000000000 -0500
74670 +++ linux-3.0.9/net/rxrpc/ar-proc.c 2011-11-15 20:03:00.000000000 -0500
74671 @@ -164,8 +164,8 @@ static int rxrpc_connection_seq_show(str
74672 atomic_read(&conn->usage),
74673 rxrpc_conn_states[conn->state],
74674 key_serial(conn->key),
74675 - atomic_read(&conn->serial),
74676 - atomic_read(&conn->hi_serial));
74677 + atomic_read_unchecked(&conn->serial),
74678 + atomic_read_unchecked(&conn->hi_serial));
74679
74680 return 0;
74681 }
74682 diff -urNp linux-3.0.9/net/rxrpc/ar-transport.c linux-3.0.9/net/rxrpc/ar-transport.c
74683 --- linux-3.0.9/net/rxrpc/ar-transport.c 2011-11-11 13:12:24.000000000 -0500
74684 +++ linux-3.0.9/net/rxrpc/ar-transport.c 2011-11-15 20:03:00.000000000 -0500
74685 @@ -47,7 +47,7 @@ static struct rxrpc_transport *rxrpc_all
74686 spin_lock_init(&trans->client_lock);
74687 rwlock_init(&trans->conn_lock);
74688 atomic_set(&trans->usage, 1);
74689 - trans->debug_id = atomic_inc_return(&rxrpc_debug_id);
74690 + trans->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
74691
74692 if (peer->srx.transport.family == AF_INET) {
74693 switch (peer->srx.transport_type) {
74694 diff -urNp linux-3.0.9/net/rxrpc/rxkad.c linux-3.0.9/net/rxrpc/rxkad.c
74695 --- linux-3.0.9/net/rxrpc/rxkad.c 2011-11-11 13:12:24.000000000 -0500
74696 +++ linux-3.0.9/net/rxrpc/rxkad.c 2011-11-15 20:03:00.000000000 -0500
74697 @@ -211,6 +211,8 @@ static int rxkad_secure_packet_encrypt(c
74698 u16 check;
74699 int nsg;
74700
74701 + pax_track_stack();
74702 +
74703 sp = rxrpc_skb(skb);
74704
74705 _enter("");
74706 @@ -338,6 +340,8 @@ static int rxkad_verify_packet_auth(cons
74707 u16 check;
74708 int nsg;
74709
74710 + pax_track_stack();
74711 +
74712 _enter("");
74713
74714 sp = rxrpc_skb(skb);
74715 @@ -610,7 +614,7 @@ static int rxkad_issue_challenge(struct
74716
74717 len = iov[0].iov_len + iov[1].iov_len;
74718
74719 - hdr.serial = htonl(atomic_inc_return(&conn->serial));
74720 + hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
74721 _proto("Tx CHALLENGE %%%u", ntohl(hdr.serial));
74722
74723 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
74724 @@ -660,7 +664,7 @@ static int rxkad_send_response(struct rx
74725
74726 len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len;
74727
74728 - hdr->serial = htonl(atomic_inc_return(&conn->serial));
74729 + hdr->serial = htonl(atomic_inc_return_unchecked(&conn->serial));
74730 _proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
74731
74732 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
74733 diff -urNp linux-3.0.9/net/sctp/proc.c linux-3.0.9/net/sctp/proc.c
74734 --- linux-3.0.9/net/sctp/proc.c 2011-11-11 13:12:24.000000000 -0500
74735 +++ linux-3.0.9/net/sctp/proc.c 2011-11-15 20:03:00.000000000 -0500
74736 @@ -318,7 +318,8 @@ static int sctp_assocs_seq_show(struct s
74737 seq_printf(seq,
74738 "%8pK %8pK %-3d %-3d %-2d %-4d "
74739 "%4d %8d %8d %7d %5lu %-5d %5d ",
74740 - assoc, sk, sctp_sk(sk)->type, sk->sk_state,
74741 + assoc, sk,
74742 + sctp_sk(sk)->type, sk->sk_state,
74743 assoc->state, hash,
74744 assoc->assoc_id,
74745 assoc->sndbuf_used,
74746 diff -urNp linux-3.0.9/net/sctp/socket.c linux-3.0.9/net/sctp/socket.c
74747 --- linux-3.0.9/net/sctp/socket.c 2011-11-11 13:12:24.000000000 -0500
74748 +++ linux-3.0.9/net/sctp/socket.c 2011-11-15 20:03:00.000000000 -0500
74749 @@ -4452,7 +4452,7 @@ static int sctp_getsockopt_peer_addrs(st
74750 addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
74751 if (space_left < addrlen)
74752 return -ENOMEM;
74753 - if (copy_to_user(to, &temp, addrlen))
74754 + if (addrlen > sizeof(temp) || copy_to_user(to, &temp, addrlen))
74755 return -EFAULT;
74756 to += addrlen;
74757 cnt++;
74758 diff -urNp linux-3.0.9/net/socket.c linux-3.0.9/net/socket.c
74759 --- linux-3.0.9/net/socket.c 2011-11-11 13:12:24.000000000 -0500
74760 +++ linux-3.0.9/net/socket.c 2011-11-15 20:03:00.000000000 -0500
74761 @@ -88,6 +88,7 @@
74762 #include <linux/nsproxy.h>
74763 #include <linux/magic.h>
74764 #include <linux/slab.h>
74765 +#include <linux/in.h>
74766
74767 #include <asm/uaccess.h>
74768 #include <asm/unistd.h>
74769 @@ -105,6 +106,8 @@
74770 #include <linux/sockios.h>
74771 #include <linux/atalk.h>
74772
74773 +#include <linux/grsock.h>
74774 +
74775 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
74776 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
74777 unsigned long nr_segs, loff_t pos);
74778 @@ -321,7 +324,7 @@ static struct dentry *sockfs_mount(struc
74779 &sockfs_dentry_operations, SOCKFS_MAGIC);
74780 }
74781
74782 -static struct vfsmount *sock_mnt __read_mostly;
74783 +struct vfsmount *sock_mnt __read_mostly;
74784
74785 static struct file_system_type sock_fs_type = {
74786 .name = "sockfs",
74787 @@ -1187,6 +1190,8 @@ int __sock_create(struct net *net, int f
74788 return -EAFNOSUPPORT;
74789 if (type < 0 || type >= SOCK_MAX)
74790 return -EINVAL;
74791 + if (protocol < 0)
74792 + return -EINVAL;
74793
74794 /* Compatibility.
74795
74796 @@ -1319,6 +1324,16 @@ SYSCALL_DEFINE3(socket, int, family, int
74797 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
74798 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
74799
74800 + if(!gr_search_socket(family, type, protocol)) {
74801 + retval = -EACCES;
74802 + goto out;
74803 + }
74804 +
74805 + if (gr_handle_sock_all(family, type, protocol)) {
74806 + retval = -EACCES;
74807 + goto out;
74808 + }
74809 +
74810 retval = sock_create(family, type, protocol, &sock);
74811 if (retval < 0)
74812 goto out;
74813 @@ -1431,6 +1446,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
74814 if (sock) {
74815 err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
74816 if (err >= 0) {
74817 + if (gr_handle_sock_server((struct sockaddr *)&address)) {
74818 + err = -EACCES;
74819 + goto error;
74820 + }
74821 + err = gr_search_bind(sock, (struct sockaddr_in *)&address);
74822 + if (err)
74823 + goto error;
74824 +
74825 err = security_socket_bind(sock,
74826 (struct sockaddr *)&address,
74827 addrlen);
74828 @@ -1439,6 +1462,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
74829 (struct sockaddr *)
74830 &address, addrlen);
74831 }
74832 +error:
74833 fput_light(sock->file, fput_needed);
74834 }
74835 return err;
74836 @@ -1462,10 +1486,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
74837 if ((unsigned)backlog > somaxconn)
74838 backlog = somaxconn;
74839
74840 + if (gr_handle_sock_server_other(sock->sk)) {
74841 + err = -EPERM;
74842 + goto error;
74843 + }
74844 +
74845 + err = gr_search_listen(sock);
74846 + if (err)
74847 + goto error;
74848 +
74849 err = security_socket_listen(sock, backlog);
74850 if (!err)
74851 err = sock->ops->listen(sock, backlog);
74852
74853 +error:
74854 fput_light(sock->file, fput_needed);
74855 }
74856 return err;
74857 @@ -1509,6 +1543,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
74858 newsock->type = sock->type;
74859 newsock->ops = sock->ops;
74860
74861 + if (gr_handle_sock_server_other(sock->sk)) {
74862 + err = -EPERM;
74863 + sock_release(newsock);
74864 + goto out_put;
74865 + }
74866 +
74867 + err = gr_search_accept(sock);
74868 + if (err) {
74869 + sock_release(newsock);
74870 + goto out_put;
74871 + }
74872 +
74873 /*
74874 * We don't need try_module_get here, as the listening socket (sock)
74875 * has the protocol module (sock->ops->owner) held.
74876 @@ -1547,6 +1593,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
74877 fd_install(newfd, newfile);
74878 err = newfd;
74879
74880 + gr_attach_curr_ip(newsock->sk);
74881 +
74882 out_put:
74883 fput_light(sock->file, fput_needed);
74884 out:
74885 @@ -1579,6 +1627,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct
74886 int, addrlen)
74887 {
74888 struct socket *sock;
74889 + struct sockaddr *sck;
74890 struct sockaddr_storage address;
74891 int err, fput_needed;
74892
74893 @@ -1589,6 +1638,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct
74894 if (err < 0)
74895 goto out_put;
74896
74897 + sck = (struct sockaddr *)&address;
74898 +
74899 + if (gr_handle_sock_client(sck)) {
74900 + err = -EACCES;
74901 + goto out_put;
74902 + }
74903 +
74904 + err = gr_search_connect(sock, (struct sockaddr_in *)sck);
74905 + if (err)
74906 + goto out_put;
74907 +
74908 err =
74909 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
74910 if (err)
74911 @@ -1890,6 +1950,8 @@ static int __sys_sendmsg(struct socket *
74912 unsigned char *ctl_buf = ctl;
74913 int err, ctl_len, iov_size, total_len;
74914
74915 + pax_track_stack();
74916 +
74917 err = -EFAULT;
74918 if (MSG_CMSG_COMPAT & flags) {
74919 if (get_compat_msghdr(msg_sys, msg_compat))
74920 @@ -1950,7 +2012,7 @@ static int __sys_sendmsg(struct socket *
74921 * checking falls down on this.
74922 */
74923 if (copy_from_user(ctl_buf,
74924 - (void __user __force *)msg_sys->msg_control,
74925 + (void __force_user *)msg_sys->msg_control,
74926 ctl_len))
74927 goto out_freectl;
74928 msg_sys->msg_control = ctl_buf;
74929 @@ -2120,7 +2182,7 @@ static int __sys_recvmsg(struct socket *
74930 * kernel msghdr to use the kernel address space)
74931 */
74932
74933 - uaddr = (__force void __user *)msg_sys->msg_name;
74934 + uaddr = (void __force_user *)msg_sys->msg_name;
74935 uaddr_len = COMPAT_NAMELEN(msg);
74936 if (MSG_CMSG_COMPAT & flags) {
74937 err = verify_compat_iovec(msg_sys, iov,
74938 @@ -2748,7 +2810,7 @@ static int ethtool_ioctl(struct net *net
74939 }
74940
74941 ifr = compat_alloc_user_space(buf_size);
74942 - rxnfc = (void *)ifr + ALIGN(sizeof(struct ifreq), 8);
74943 + rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
74944
74945 if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
74946 return -EFAULT;
74947 @@ -2772,12 +2834,12 @@ static int ethtool_ioctl(struct net *net
74948 offsetof(struct ethtool_rxnfc, fs.ring_cookie));
74949
74950 if (copy_in_user(rxnfc, compat_rxnfc,
74951 - (void *)(&rxnfc->fs.m_ext + 1) -
74952 - (void *)rxnfc) ||
74953 + (void __user *)(&rxnfc->fs.m_ext + 1) -
74954 + (void __user *)rxnfc) ||
74955 copy_in_user(&rxnfc->fs.ring_cookie,
74956 &compat_rxnfc->fs.ring_cookie,
74957 - (void *)(&rxnfc->fs.location + 1) -
74958 - (void *)&rxnfc->fs.ring_cookie) ||
74959 + (void __user *)(&rxnfc->fs.location + 1) -
74960 + (void __user *)&rxnfc->fs.ring_cookie) ||
74961 copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
74962 sizeof(rxnfc->rule_cnt)))
74963 return -EFAULT;
74964 @@ -2789,12 +2851,12 @@ static int ethtool_ioctl(struct net *net
74965
74966 if (convert_out) {
74967 if (copy_in_user(compat_rxnfc, rxnfc,
74968 - (const void *)(&rxnfc->fs.m_ext + 1) -
74969 - (const void *)rxnfc) ||
74970 + (const void __user *)(&rxnfc->fs.m_ext + 1) -
74971 + (const void __user *)rxnfc) ||
74972 copy_in_user(&compat_rxnfc->fs.ring_cookie,
74973 &rxnfc->fs.ring_cookie,
74974 - (const void *)(&rxnfc->fs.location + 1) -
74975 - (const void *)&rxnfc->fs.ring_cookie) ||
74976 + (const void __user *)(&rxnfc->fs.location + 1) -
74977 + (const void __user *)&rxnfc->fs.ring_cookie) ||
74978 copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
74979 sizeof(rxnfc->rule_cnt)))
74980 return -EFAULT;
74981 @@ -2864,7 +2926,7 @@ static int bond_ioctl(struct net *net, u
74982 old_fs = get_fs();
74983 set_fs(KERNEL_DS);
74984 err = dev_ioctl(net, cmd,
74985 - (struct ifreq __user __force *) &kifr);
74986 + (struct ifreq __force_user *) &kifr);
74987 set_fs(old_fs);
74988
74989 return err;
74990 @@ -2973,7 +3035,7 @@ static int compat_sioc_ifmap(struct net
74991
74992 old_fs = get_fs();
74993 set_fs(KERNEL_DS);
74994 - err = dev_ioctl(net, cmd, (void __user __force *)&ifr);
74995 + err = dev_ioctl(net, cmd, (void __force_user *)&ifr);
74996 set_fs(old_fs);
74997
74998 if (cmd == SIOCGIFMAP && !err) {
74999 @@ -3078,7 +3140,7 @@ static int routing_ioctl(struct net *net
75000 ret |= __get_user(rtdev, &(ur4->rt_dev));
75001 if (rtdev) {
75002 ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
75003 - r4.rt_dev = (char __user __force *)devname;
75004 + r4.rt_dev = (char __force_user *)devname;
75005 devname[15] = 0;
75006 } else
75007 r4.rt_dev = NULL;
75008 @@ -3318,8 +3380,8 @@ int kernel_getsockopt(struct socket *soc
75009 int __user *uoptlen;
75010 int err;
75011
75012 - uoptval = (char __user __force *) optval;
75013 - uoptlen = (int __user __force *) optlen;
75014 + uoptval = (char __force_user *) optval;
75015 + uoptlen = (int __force_user *) optlen;
75016
75017 set_fs(KERNEL_DS);
75018 if (level == SOL_SOCKET)
75019 @@ -3339,7 +3401,7 @@ int kernel_setsockopt(struct socket *soc
75020 char __user *uoptval;
75021 int err;
75022
75023 - uoptval = (char __user __force *) optval;
75024 + uoptval = (char __force_user *) optval;
75025
75026 set_fs(KERNEL_DS);
75027 if (level == SOL_SOCKET)
75028 diff -urNp linux-3.0.9/net/sunrpc/sched.c linux-3.0.9/net/sunrpc/sched.c
75029 --- linux-3.0.9/net/sunrpc/sched.c 2011-11-11 13:12:24.000000000 -0500
75030 +++ linux-3.0.9/net/sunrpc/sched.c 2011-11-15 20:03:00.000000000 -0500
75031 @@ -234,9 +234,9 @@ static int rpc_wait_bit_killable(void *w
75032 #ifdef RPC_DEBUG
75033 static void rpc_task_set_debuginfo(struct rpc_task *task)
75034 {
75035 - static atomic_t rpc_pid;
75036 + static atomic_unchecked_t rpc_pid;
75037
75038 - task->tk_pid = atomic_inc_return(&rpc_pid);
75039 + task->tk_pid = atomic_inc_return_unchecked(&rpc_pid);
75040 }
75041 #else
75042 static inline void rpc_task_set_debuginfo(struct rpc_task *task)
75043 diff -urNp linux-3.0.9/net/sunrpc/svcsock.c linux-3.0.9/net/sunrpc/svcsock.c
75044 --- linux-3.0.9/net/sunrpc/svcsock.c 2011-11-11 13:12:24.000000000 -0500
75045 +++ linux-3.0.9/net/sunrpc/svcsock.c 2011-11-15 20:03:00.000000000 -0500
75046 @@ -392,7 +392,7 @@ static int svc_partial_recvfrom(struct s
75047 int buflen, unsigned int base)
75048 {
75049 size_t save_iovlen;
75050 - void __user *save_iovbase;
75051 + void *save_iovbase;
75052 unsigned int i;
75053 int ret;
75054
75055 diff -urNp linux-3.0.9/net/sunrpc/xprtrdma/svc_rdma.c linux-3.0.9/net/sunrpc/xprtrdma/svc_rdma.c
75056 --- linux-3.0.9/net/sunrpc/xprtrdma/svc_rdma.c 2011-11-11 13:12:24.000000000 -0500
75057 +++ linux-3.0.9/net/sunrpc/xprtrdma/svc_rdma.c 2011-11-15 20:03:00.000000000 -0500
75058 @@ -61,15 +61,15 @@ unsigned int svcrdma_max_req_size = RPCR
75059 static unsigned int min_max_inline = 4096;
75060 static unsigned int max_max_inline = 65536;
75061
75062 -atomic_t rdma_stat_recv;
75063 -atomic_t rdma_stat_read;
75064 -atomic_t rdma_stat_write;
75065 -atomic_t rdma_stat_sq_starve;
75066 -atomic_t rdma_stat_rq_starve;
75067 -atomic_t rdma_stat_rq_poll;
75068 -atomic_t rdma_stat_rq_prod;
75069 -atomic_t rdma_stat_sq_poll;
75070 -atomic_t rdma_stat_sq_prod;
75071 +atomic_unchecked_t rdma_stat_recv;
75072 +atomic_unchecked_t rdma_stat_read;
75073 +atomic_unchecked_t rdma_stat_write;
75074 +atomic_unchecked_t rdma_stat_sq_starve;
75075 +atomic_unchecked_t rdma_stat_rq_starve;
75076 +atomic_unchecked_t rdma_stat_rq_poll;
75077 +atomic_unchecked_t rdma_stat_rq_prod;
75078 +atomic_unchecked_t rdma_stat_sq_poll;
75079 +atomic_unchecked_t rdma_stat_sq_prod;
75080
75081 /* Temporary NFS request map and context caches */
75082 struct kmem_cache *svc_rdma_map_cachep;
75083 @@ -109,7 +109,7 @@ static int read_reset_stat(ctl_table *ta
75084 len -= *ppos;
75085 if (len > *lenp)
75086 len = *lenp;
75087 - if (len && copy_to_user(buffer, str_buf, len))
75088 + if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
75089 return -EFAULT;
75090 *lenp = len;
75091 *ppos += len;
75092 @@ -150,63 +150,63 @@ static ctl_table svcrdma_parm_table[] =
75093 {
75094 .procname = "rdma_stat_read",
75095 .data = &rdma_stat_read,
75096 - .maxlen = sizeof(atomic_t),
75097 + .maxlen = sizeof(atomic_unchecked_t),
75098 .mode = 0644,
75099 .proc_handler = read_reset_stat,
75100 },
75101 {
75102 .procname = "rdma_stat_recv",
75103 .data = &rdma_stat_recv,
75104 - .maxlen = sizeof(atomic_t),
75105 + .maxlen = sizeof(atomic_unchecked_t),
75106 .mode = 0644,
75107 .proc_handler = read_reset_stat,
75108 },
75109 {
75110 .procname = "rdma_stat_write",
75111 .data = &rdma_stat_write,
75112 - .maxlen = sizeof(atomic_t),
75113 + .maxlen = sizeof(atomic_unchecked_t),
75114 .mode = 0644,
75115 .proc_handler = read_reset_stat,
75116 },
75117 {
75118 .procname = "rdma_stat_sq_starve",
75119 .data = &rdma_stat_sq_starve,
75120 - .maxlen = sizeof(atomic_t),
75121 + .maxlen = sizeof(atomic_unchecked_t),
75122 .mode = 0644,
75123 .proc_handler = read_reset_stat,
75124 },
75125 {
75126 .procname = "rdma_stat_rq_starve",
75127 .data = &rdma_stat_rq_starve,
75128 - .maxlen = sizeof(atomic_t),
75129 + .maxlen = sizeof(atomic_unchecked_t),
75130 .mode = 0644,
75131 .proc_handler = read_reset_stat,
75132 },
75133 {
75134 .procname = "rdma_stat_rq_poll",
75135 .data = &rdma_stat_rq_poll,
75136 - .maxlen = sizeof(atomic_t),
75137 + .maxlen = sizeof(atomic_unchecked_t),
75138 .mode = 0644,
75139 .proc_handler = read_reset_stat,
75140 },
75141 {
75142 .procname = "rdma_stat_rq_prod",
75143 .data = &rdma_stat_rq_prod,
75144 - .maxlen = sizeof(atomic_t),
75145 + .maxlen = sizeof(atomic_unchecked_t),
75146 .mode = 0644,
75147 .proc_handler = read_reset_stat,
75148 },
75149 {
75150 .procname = "rdma_stat_sq_poll",
75151 .data = &rdma_stat_sq_poll,
75152 - .maxlen = sizeof(atomic_t),
75153 + .maxlen = sizeof(atomic_unchecked_t),
75154 .mode = 0644,
75155 .proc_handler = read_reset_stat,
75156 },
75157 {
75158 .procname = "rdma_stat_sq_prod",
75159 .data = &rdma_stat_sq_prod,
75160 - .maxlen = sizeof(atomic_t),
75161 + .maxlen = sizeof(atomic_unchecked_t),
75162 .mode = 0644,
75163 .proc_handler = read_reset_stat,
75164 },
75165 diff -urNp linux-3.0.9/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c linux-3.0.9/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
75166 --- linux-3.0.9/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 2011-11-11 13:12:24.000000000 -0500
75167 +++ linux-3.0.9/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 2011-11-15 20:03:00.000000000 -0500
75168 @@ -499,7 +499,7 @@ next_sge:
75169 svc_rdma_put_context(ctxt, 0);
75170 goto out;
75171 }
75172 - atomic_inc(&rdma_stat_read);
75173 + atomic_inc_unchecked(&rdma_stat_read);
75174
75175 if (read_wr.num_sge < chl_map->ch[ch_no].count) {
75176 chl_map->ch[ch_no].count -= read_wr.num_sge;
75177 @@ -609,7 +609,7 @@ int svc_rdma_recvfrom(struct svc_rqst *r
75178 dto_q);
75179 list_del_init(&ctxt->dto_q);
75180 } else {
75181 - atomic_inc(&rdma_stat_rq_starve);
75182 + atomic_inc_unchecked(&rdma_stat_rq_starve);
75183 clear_bit(XPT_DATA, &xprt->xpt_flags);
75184 ctxt = NULL;
75185 }
75186 @@ -629,7 +629,7 @@ int svc_rdma_recvfrom(struct svc_rqst *r
75187 dprintk("svcrdma: processing ctxt=%p on xprt=%p, rqstp=%p, status=%d\n",
75188 ctxt, rdma_xprt, rqstp, ctxt->wc_status);
75189 BUG_ON(ctxt->wc_status != IB_WC_SUCCESS);
75190 - atomic_inc(&rdma_stat_recv);
75191 + atomic_inc_unchecked(&rdma_stat_recv);
75192
75193 /* Build up the XDR from the receive buffers. */
75194 rdma_build_arg_xdr(rqstp, ctxt, ctxt->byte_len);
75195 diff -urNp linux-3.0.9/net/sunrpc/xprtrdma/svc_rdma_sendto.c linux-3.0.9/net/sunrpc/xprtrdma/svc_rdma_sendto.c
75196 --- linux-3.0.9/net/sunrpc/xprtrdma/svc_rdma_sendto.c 2011-11-11 13:12:24.000000000 -0500
75197 +++ linux-3.0.9/net/sunrpc/xprtrdma/svc_rdma_sendto.c 2011-11-15 20:03:00.000000000 -0500
75198 @@ -362,7 +362,7 @@ static int send_write(struct svcxprt_rdm
75199 write_wr.wr.rdma.remote_addr = to;
75200
75201 /* Post It */
75202 - atomic_inc(&rdma_stat_write);
75203 + atomic_inc_unchecked(&rdma_stat_write);
75204 if (svc_rdma_send(xprt, &write_wr))
75205 goto err;
75206 return 0;
75207 diff -urNp linux-3.0.9/net/sunrpc/xprtrdma/svc_rdma_transport.c linux-3.0.9/net/sunrpc/xprtrdma/svc_rdma_transport.c
75208 --- linux-3.0.9/net/sunrpc/xprtrdma/svc_rdma_transport.c 2011-11-11 13:12:24.000000000 -0500
75209 +++ linux-3.0.9/net/sunrpc/xprtrdma/svc_rdma_transport.c 2011-11-15 20:03:00.000000000 -0500
75210 @@ -298,7 +298,7 @@ static void rq_cq_reap(struct svcxprt_rd
75211 return;
75212
75213 ib_req_notify_cq(xprt->sc_rq_cq, IB_CQ_NEXT_COMP);
75214 - atomic_inc(&rdma_stat_rq_poll);
75215 + atomic_inc_unchecked(&rdma_stat_rq_poll);
75216
75217 while ((ret = ib_poll_cq(xprt->sc_rq_cq, 1, &wc)) > 0) {
75218 ctxt = (struct svc_rdma_op_ctxt *)(unsigned long)wc.wr_id;
75219 @@ -320,7 +320,7 @@ static void rq_cq_reap(struct svcxprt_rd
75220 }
75221
75222 if (ctxt)
75223 - atomic_inc(&rdma_stat_rq_prod);
75224 + atomic_inc_unchecked(&rdma_stat_rq_prod);
75225
75226 set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
75227 /*
75228 @@ -392,7 +392,7 @@ static void sq_cq_reap(struct svcxprt_rd
75229 return;
75230
75231 ib_req_notify_cq(xprt->sc_sq_cq, IB_CQ_NEXT_COMP);
75232 - atomic_inc(&rdma_stat_sq_poll);
75233 + atomic_inc_unchecked(&rdma_stat_sq_poll);
75234 while ((ret = ib_poll_cq(cq, 1, &wc)) > 0) {
75235 if (wc.status != IB_WC_SUCCESS)
75236 /* Close the transport */
75237 @@ -410,7 +410,7 @@ static void sq_cq_reap(struct svcxprt_rd
75238 }
75239
75240 if (ctxt)
75241 - atomic_inc(&rdma_stat_sq_prod);
75242 + atomic_inc_unchecked(&rdma_stat_sq_prod);
75243 }
75244
75245 static void sq_comp_handler(struct ib_cq *cq, void *cq_context)
75246 @@ -1272,7 +1272,7 @@ int svc_rdma_send(struct svcxprt_rdma *x
75247 spin_lock_bh(&xprt->sc_lock);
75248 if (xprt->sc_sq_depth < atomic_read(&xprt->sc_sq_count) + wr_count) {
75249 spin_unlock_bh(&xprt->sc_lock);
75250 - atomic_inc(&rdma_stat_sq_starve);
75251 + atomic_inc_unchecked(&rdma_stat_sq_starve);
75252
75253 /* See if we can opportunistically reap SQ WR to make room */
75254 sq_cq_reap(xprt);
75255 diff -urNp linux-3.0.9/net/sysctl_net.c linux-3.0.9/net/sysctl_net.c
75256 --- linux-3.0.9/net/sysctl_net.c 2011-11-11 13:12:24.000000000 -0500
75257 +++ linux-3.0.9/net/sysctl_net.c 2011-11-15 20:03:00.000000000 -0500
75258 @@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ct
75259 struct ctl_table *table)
75260 {
75261 /* Allow network administrator to have same access as root. */
75262 - if (capable(CAP_NET_ADMIN)) {
75263 + if (capable_nolog(CAP_NET_ADMIN)) {
75264 int mode = (table->mode >> 6) & 7;
75265 return (mode << 6) | (mode << 3) | mode;
75266 }
75267 diff -urNp linux-3.0.9/net/tipc/link.c linux-3.0.9/net/tipc/link.c
75268 --- linux-3.0.9/net/tipc/link.c 2011-11-11 13:12:24.000000000 -0500
75269 +++ linux-3.0.9/net/tipc/link.c 2011-11-15 20:03:00.000000000 -0500
75270 @@ -1170,7 +1170,7 @@ static int link_send_sections_long(struc
75271 struct tipc_msg fragm_hdr;
75272 struct sk_buff *buf, *buf_chain, *prev;
75273 u32 fragm_crs, fragm_rest, hsz, sect_rest;
75274 - const unchar *sect_crs;
75275 + const unchar __user *sect_crs;
75276 int curr_sect;
75277 u32 fragm_no;
75278
75279 @@ -1214,7 +1214,7 @@ again:
75280
75281 if (!sect_rest) {
75282 sect_rest = msg_sect[++curr_sect].iov_len;
75283 - sect_crs = (const unchar *)msg_sect[curr_sect].iov_base;
75284 + sect_crs = (const unchar __user *)msg_sect[curr_sect].iov_base;
75285 }
75286
75287 if (sect_rest < fragm_rest)
75288 @@ -1233,7 +1233,7 @@ error:
75289 }
75290 } else
75291 skb_copy_to_linear_data_offset(buf, fragm_crs,
75292 - sect_crs, sz);
75293 + (const void __force_kernel *)sect_crs, sz);
75294 sect_crs += sz;
75295 sect_rest -= sz;
75296 fragm_crs += sz;
75297 diff -urNp linux-3.0.9/net/tipc/msg.c linux-3.0.9/net/tipc/msg.c
75298 --- linux-3.0.9/net/tipc/msg.c 2011-11-11 13:12:24.000000000 -0500
75299 +++ linux-3.0.9/net/tipc/msg.c 2011-11-15 20:03:00.000000000 -0500
75300 @@ -101,7 +101,7 @@ int tipc_msg_build(struct tipc_msg *hdr,
75301 msg_sect[cnt].iov_len);
75302 else
75303 skb_copy_to_linear_data_offset(*buf, pos,
75304 - msg_sect[cnt].iov_base,
75305 + (const void __force_kernel *)msg_sect[cnt].iov_base,
75306 msg_sect[cnt].iov_len);
75307 pos += msg_sect[cnt].iov_len;
75308 }
75309 diff -urNp linux-3.0.9/net/tipc/subscr.c linux-3.0.9/net/tipc/subscr.c
75310 --- linux-3.0.9/net/tipc/subscr.c 2011-11-11 13:12:24.000000000 -0500
75311 +++ linux-3.0.9/net/tipc/subscr.c 2011-11-15 20:03:00.000000000 -0500
75312 @@ -101,7 +101,7 @@ static void subscr_send_event(struct sub
75313 {
75314 struct iovec msg_sect;
75315
75316 - msg_sect.iov_base = (void *)&sub->evt;
75317 + msg_sect.iov_base = (void __force_user *)&sub->evt;
75318 msg_sect.iov_len = sizeof(struct tipc_event);
75319
75320 sub->evt.event = htohl(event, sub->swap);
75321 diff -urNp linux-3.0.9/net/unix/af_unix.c linux-3.0.9/net/unix/af_unix.c
75322 --- linux-3.0.9/net/unix/af_unix.c 2011-11-11 13:12:24.000000000 -0500
75323 +++ linux-3.0.9/net/unix/af_unix.c 2011-11-15 20:03:00.000000000 -0500
75324 @@ -767,6 +767,12 @@ static struct sock *unix_find_other(stru
75325 err = -ECONNREFUSED;
75326 if (!S_ISSOCK(inode->i_mode))
75327 goto put_fail;
75328 +
75329 + if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
75330 + err = -EACCES;
75331 + goto put_fail;
75332 + }
75333 +
75334 u = unix_find_socket_byinode(inode);
75335 if (!u)
75336 goto put_fail;
75337 @@ -787,6 +793,13 @@ static struct sock *unix_find_other(stru
75338 if (u) {
75339 struct dentry *dentry;
75340 dentry = unix_sk(u)->dentry;
75341 +
75342 + if (!gr_handle_chroot_unix(pid_vnr(u->sk_peer_pid))) {
75343 + err = -EPERM;
75344 + sock_put(u);
75345 + goto fail;
75346 + }
75347 +
75348 if (dentry)
75349 touch_atime(unix_sk(u)->mnt, dentry);
75350 } else
75351 @@ -872,11 +885,18 @@ static int unix_bind(struct socket *sock
75352 err = security_path_mknod(&nd.path, dentry, mode, 0);
75353 if (err)
75354 goto out_mknod_drop_write;
75355 + if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
75356 + err = -EACCES;
75357 + goto out_mknod_drop_write;
75358 + }
75359 err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
75360 out_mknod_drop_write:
75361 mnt_drop_write(nd.path.mnt);
75362 if (err)
75363 goto out_mknod_dput;
75364 +
75365 + gr_handle_create(dentry, nd.path.mnt);
75366 +
75367 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
75368 dput(nd.path.dentry);
75369 nd.path.dentry = dentry;
75370 diff -urNp linux-3.0.9/net/wireless/core.h linux-3.0.9/net/wireless/core.h
75371 --- linux-3.0.9/net/wireless/core.h 2011-11-11 13:12:24.000000000 -0500
75372 +++ linux-3.0.9/net/wireless/core.h 2011-11-15 20:03:00.000000000 -0500
75373 @@ -27,7 +27,7 @@ struct cfg80211_registered_device {
75374 struct mutex mtx;
75375
75376 /* rfkill support */
75377 - struct rfkill_ops rfkill_ops;
75378 + rfkill_ops_no_const rfkill_ops;
75379 struct rfkill *rfkill;
75380 struct work_struct rfkill_sync;
75381
75382 diff -urNp linux-3.0.9/net/wireless/wext-core.c linux-3.0.9/net/wireless/wext-core.c
75383 --- linux-3.0.9/net/wireless/wext-core.c 2011-11-11 13:12:24.000000000 -0500
75384 +++ linux-3.0.9/net/wireless/wext-core.c 2011-11-15 20:03:00.000000000 -0500
75385 @@ -746,8 +746,7 @@ static int ioctl_standard_iw_point(struc
75386 */
75387
75388 /* Support for very large requests */
75389 - if ((descr->flags & IW_DESCR_FLAG_NOMAX) &&
75390 - (user_length > descr->max_tokens)) {
75391 + if (user_length > descr->max_tokens) {
75392 /* Allow userspace to GET more than max so
75393 * we can support any size GET requests.
75394 * There is still a limit : -ENOMEM.
75395 @@ -784,22 +783,6 @@ static int ioctl_standard_iw_point(struc
75396 }
75397 }
75398
75399 - if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) {
75400 - /*
75401 - * If this is a GET, but not NOMAX, it means that the extra
75402 - * data is not bounded by userspace, but by max_tokens. Thus
75403 - * set the length to max_tokens. This matches the extra data
75404 - * allocation.
75405 - * The driver should fill it with the number of tokens it
75406 - * provided, and it may check iwp->length rather than having
75407 - * knowledge of max_tokens. If the driver doesn't change the
75408 - * iwp->length, this ioctl just copies back max_token tokens
75409 - * filled with zeroes. Hopefully the driver isn't claiming
75410 - * them to be valid data.
75411 - */
75412 - iwp->length = descr->max_tokens;
75413 - }
75414 -
75415 err = handler(dev, info, (union iwreq_data *) iwp, extra);
75416
75417 iwp->length += essid_compat;
75418 diff -urNp linux-3.0.9/net/xfrm/xfrm_policy.c linux-3.0.9/net/xfrm/xfrm_policy.c
75419 --- linux-3.0.9/net/xfrm/xfrm_policy.c 2011-11-11 13:12:24.000000000 -0500
75420 +++ linux-3.0.9/net/xfrm/xfrm_policy.c 2011-11-15 20:03:00.000000000 -0500
75421 @@ -299,7 +299,7 @@ static void xfrm_policy_kill(struct xfrm
75422 {
75423 policy->walk.dead = 1;
75424
75425 - atomic_inc(&policy->genid);
75426 + atomic_inc_unchecked(&policy->genid);
75427
75428 if (del_timer(&policy->timer))
75429 xfrm_pol_put(policy);
75430 @@ -583,7 +583,7 @@ int xfrm_policy_insert(int dir, struct x
75431 hlist_add_head(&policy->bydst, chain);
75432 xfrm_pol_hold(policy);
75433 net->xfrm.policy_count[dir]++;
75434 - atomic_inc(&flow_cache_genid);
75435 + atomic_inc_unchecked(&flow_cache_genid);
75436 if (delpol)
75437 __xfrm_policy_unlink(delpol, dir);
75438 policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
75439 @@ -1528,7 +1528,7 @@ free_dst:
75440 goto out;
75441 }
75442
75443 -static int inline
75444 +static inline int
75445 xfrm_dst_alloc_copy(void **target, const void *src, int size)
75446 {
75447 if (!*target) {
75448 @@ -1540,7 +1540,7 @@ xfrm_dst_alloc_copy(void **target, const
75449 return 0;
75450 }
75451
75452 -static int inline
75453 +static inline int
75454 xfrm_dst_update_parent(struct dst_entry *dst, const struct xfrm_selector *sel)
75455 {
75456 #ifdef CONFIG_XFRM_SUB_POLICY
75457 @@ -1552,7 +1552,7 @@ xfrm_dst_update_parent(struct dst_entry
75458 #endif
75459 }
75460
75461 -static int inline
75462 +static inline int
75463 xfrm_dst_update_origin(struct dst_entry *dst, const struct flowi *fl)
75464 {
75465 #ifdef CONFIG_XFRM_SUB_POLICY
75466 @@ -1646,7 +1646,7 @@ xfrm_resolve_and_create_bundle(struct xf
75467
75468 xdst->num_pols = num_pols;
75469 memcpy(xdst->pols, pols, sizeof(struct xfrm_policy*) * num_pols);
75470 - xdst->policy_genid = atomic_read(&pols[0]->genid);
75471 + xdst->policy_genid = atomic_read_unchecked(&pols[0]->genid);
75472
75473 return xdst;
75474 }
75475 @@ -2333,7 +2333,7 @@ static int xfrm_bundle_ok(struct xfrm_ds
75476 if (xdst->xfrm_genid != dst->xfrm->genid)
75477 return 0;
75478 if (xdst->num_pols > 0 &&
75479 - xdst->policy_genid != atomic_read(&xdst->pols[0]->genid))
75480 + xdst->policy_genid != atomic_read_unchecked(&xdst->pols[0]->genid))
75481 return 0;
75482
75483 mtu = dst_mtu(dst->child);
75484 @@ -2861,7 +2861,7 @@ static int xfrm_policy_migrate(struct xf
75485 sizeof(pol->xfrm_vec[i].saddr));
75486 pol->xfrm_vec[i].encap_family = mp->new_family;
75487 /* flush bundles */
75488 - atomic_inc(&pol->genid);
75489 + atomic_inc_unchecked(&pol->genid);
75490 }
75491 }
75492
75493 diff -urNp linux-3.0.9/net/xfrm/xfrm_user.c linux-3.0.9/net/xfrm/xfrm_user.c
75494 --- linux-3.0.9/net/xfrm/xfrm_user.c 2011-11-11 13:12:24.000000000 -0500
75495 +++ linux-3.0.9/net/xfrm/xfrm_user.c 2011-11-15 20:03:00.000000000 -0500
75496 @@ -1394,6 +1394,8 @@ static int copy_to_user_tmpl(struct xfrm
75497 struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
75498 int i;
75499
75500 + pax_track_stack();
75501 +
75502 if (xp->xfrm_nr == 0)
75503 return 0;
75504
75505 @@ -2062,6 +2064,8 @@ static int xfrm_do_migrate(struct sk_buf
75506 int err;
75507 int n = 0;
75508
75509 + pax_track_stack();
75510 +
75511 if (attrs[XFRMA_MIGRATE] == NULL)
75512 return -EINVAL;
75513
75514 diff -urNp linux-3.0.9/scripts/basic/fixdep.c linux-3.0.9/scripts/basic/fixdep.c
75515 --- linux-3.0.9/scripts/basic/fixdep.c 2011-11-11 13:12:24.000000000 -0500
75516 +++ linux-3.0.9/scripts/basic/fixdep.c 2011-11-15 20:03:00.000000000 -0500
75517 @@ -161,7 +161,7 @@ static unsigned int strhash(const char *
75518 /*
75519 * Lookup a value in the configuration string.
75520 */
75521 -static int is_defined_config(const char *name, int len, unsigned int hash)
75522 +static int is_defined_config(const char *name, unsigned int len, unsigned int hash)
75523 {
75524 struct item *aux;
75525
75526 @@ -211,10 +211,10 @@ static void clear_config(void)
75527 /*
75528 * Record the use of a CONFIG_* word.
75529 */
75530 -static void use_config(const char *m, int slen)
75531 +static void use_config(const char *m, unsigned int slen)
75532 {
75533 unsigned int hash = strhash(m, slen);
75534 - int c, i;
75535 + unsigned int c, i;
75536
75537 if (is_defined_config(m, slen, hash))
75538 return;
75539 @@ -235,9 +235,9 @@ static void use_config(const char *m, in
75540
75541 static void parse_config_file(const char *map, size_t len)
75542 {
75543 - const int *end = (const int *) (map + len);
75544 + const unsigned int *end = (const unsigned int *) (map + len);
75545 /* start at +1, so that p can never be < map */
75546 - const int *m = (const int *) map + 1;
75547 + const unsigned int *m = (const unsigned int *) map + 1;
75548 const char *p, *q;
75549
75550 for (; m < end; m++) {
75551 @@ -405,7 +405,7 @@ static void print_deps(void)
75552 static void traps(void)
75553 {
75554 static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
75555 - int *p = (int *)test;
75556 + unsigned int *p = (unsigned int *)test;
75557
75558 if (*p != INT_CONF) {
75559 fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
75560 diff -urNp linux-3.0.9/scripts/gcc-plugin.sh linux-3.0.9/scripts/gcc-plugin.sh
75561 --- linux-3.0.9/scripts/gcc-plugin.sh 1969-12-31 19:00:00.000000000 -0500
75562 +++ linux-3.0.9/scripts/gcc-plugin.sh 2011-11-15 20:03:00.000000000 -0500
75563 @@ -0,0 +1,2 @@
75564 +#!/bin/sh
75565 +echo "#include \"gcc-plugin.h\"\n#include \"rtl.h\"" | $1 -x c -shared - -o /dev/null -I`$2 -print-file-name=plugin`/include >/dev/null 2>&1 && echo "y"
75566 diff -urNp linux-3.0.9/scripts/Makefile.build linux-3.0.9/scripts/Makefile.build
75567 --- linux-3.0.9/scripts/Makefile.build 2011-11-11 13:12:24.000000000 -0500
75568 +++ linux-3.0.9/scripts/Makefile.build 2011-11-15 20:03:00.000000000 -0500
75569 @@ -109,7 +109,7 @@ endif
75570 endif
75571
75572 # Do not include host rules unless needed
75573 -ifneq ($(hostprogs-y)$(hostprogs-m),)
75574 +ifneq ($(hostprogs-y)$(hostprogs-m)$(hostlibs-y)$(hostlibs-m),)
75575 include scripts/Makefile.host
75576 endif
75577
75578 diff -urNp linux-3.0.9/scripts/Makefile.clean linux-3.0.9/scripts/Makefile.clean
75579 --- linux-3.0.9/scripts/Makefile.clean 2011-11-11 13:12:24.000000000 -0500
75580 +++ linux-3.0.9/scripts/Makefile.clean 2011-11-15 20:03:00.000000000 -0500
75581 @@ -43,7 +43,8 @@ subdir-ymn := $(addprefix $(obj)/,$(subd
75582 __clean-files := $(extra-y) $(always) \
75583 $(targets) $(clean-files) \
75584 $(host-progs) \
75585 - $(hostprogs-y) $(hostprogs-m) $(hostprogs-)
75586 + $(hostprogs-y) $(hostprogs-m) $(hostprogs-) \
75587 + $(hostlibs-y) $(hostlibs-m) $(hostlibs-)
75588
75589 __clean-files := $(filter-out $(no-clean-files), $(__clean-files))
75590
75591 diff -urNp linux-3.0.9/scripts/Makefile.host linux-3.0.9/scripts/Makefile.host
75592 --- linux-3.0.9/scripts/Makefile.host 2011-11-11 13:12:24.000000000 -0500
75593 +++ linux-3.0.9/scripts/Makefile.host 2011-11-15 20:03:00.000000000 -0500
75594 @@ -31,6 +31,7 @@
75595 # Note: Shared libraries consisting of C++ files are not supported
75596
75597 __hostprogs := $(sort $(hostprogs-y) $(hostprogs-m))
75598 +__hostlibs := $(sort $(hostlibs-y) $(hostlibs-m))
75599
75600 # C code
75601 # Executables compiled from a single .c file
75602 @@ -54,6 +55,7 @@ host-cxxobjs := $(sort $(foreach m,$(hos
75603 # Shared libaries (only .c supported)
75604 # Shared libraries (.so) - all .so files referenced in "xxx-objs"
75605 host-cshlib := $(sort $(filter %.so, $(host-cobjs)))
75606 +host-cshlib += $(sort $(filter %.so, $(__hostlibs)))
75607 # Remove .so files from "xxx-objs"
75608 host-cobjs := $(filter-out %.so,$(host-cobjs))
75609
75610 diff -urNp linux-3.0.9/scripts/mod/file2alias.c linux-3.0.9/scripts/mod/file2alias.c
75611 --- linux-3.0.9/scripts/mod/file2alias.c 2011-11-11 13:12:24.000000000 -0500
75612 +++ linux-3.0.9/scripts/mod/file2alias.c 2011-11-15 20:03:00.000000000 -0500
75613 @@ -72,7 +72,7 @@ static void device_id_check(const char *
75614 unsigned long size, unsigned long id_size,
75615 void *symval)
75616 {
75617 - int i;
75618 + unsigned int i;
75619
75620 if (size % id_size || size < id_size) {
75621 if (cross_build != 0)
75622 @@ -102,7 +102,7 @@ static void device_id_check(const char *
75623 /* USB is special because the bcdDevice can be matched against a numeric range */
75624 /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
75625 static void do_usb_entry(struct usb_device_id *id,
75626 - unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
75627 + unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
75628 unsigned char range_lo, unsigned char range_hi,
75629 unsigned char max, struct module *mod)
75630 {
75631 @@ -203,7 +203,7 @@ static void do_usb_entry_multi(struct us
75632 {
75633 unsigned int devlo, devhi;
75634 unsigned char chi, clo, max;
75635 - int ndigits;
75636 + unsigned int ndigits;
75637
75638 id->match_flags = TO_NATIVE(id->match_flags);
75639 id->idVendor = TO_NATIVE(id->idVendor);
75640 @@ -437,7 +437,7 @@ static void do_pnp_device_entry(void *sy
75641 for (i = 0; i < count; i++) {
75642 const char *id = (char *)devs[i].id;
75643 char acpi_id[sizeof(devs[0].id)];
75644 - int j;
75645 + unsigned int j;
75646
75647 buf_printf(&mod->dev_table_buf,
75648 "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
75649 @@ -467,7 +467,7 @@ static void do_pnp_card_entries(void *sy
75650
75651 for (j = 0; j < PNP_MAX_DEVICES; j++) {
75652 const char *id = (char *)card->devs[j].id;
75653 - int i2, j2;
75654 + unsigned int i2, j2;
75655 int dup = 0;
75656
75657 if (!id[0])
75658 @@ -493,7 +493,7 @@ static void do_pnp_card_entries(void *sy
75659 /* add an individual alias for every device entry */
75660 if (!dup) {
75661 char acpi_id[sizeof(card->devs[0].id)];
75662 - int k;
75663 + unsigned int k;
75664
75665 buf_printf(&mod->dev_table_buf,
75666 "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
75667 @@ -786,7 +786,7 @@ static void dmi_ascii_filter(char *d, co
75668 static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
75669 char *alias)
75670 {
75671 - int i, j;
75672 + unsigned int i, j;
75673
75674 sprintf(alias, "dmi*");
75675
75676 diff -urNp linux-3.0.9/scripts/mod/modpost.c linux-3.0.9/scripts/mod/modpost.c
75677 --- linux-3.0.9/scripts/mod/modpost.c 2011-11-11 13:12:24.000000000 -0500
75678 +++ linux-3.0.9/scripts/mod/modpost.c 2011-11-15 20:03:00.000000000 -0500
75679 @@ -892,6 +892,7 @@ enum mismatch {
75680 ANY_INIT_TO_ANY_EXIT,
75681 ANY_EXIT_TO_ANY_INIT,
75682 EXPORT_TO_INIT_EXIT,
75683 + DATA_TO_TEXT
75684 };
75685
75686 struct sectioncheck {
75687 @@ -1000,6 +1001,12 @@ const struct sectioncheck sectioncheck[]
75688 .tosec = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
75689 .mismatch = EXPORT_TO_INIT_EXIT,
75690 .symbol_white_list = { DEFAULT_SYMBOL_WHITE_LIST, NULL },
75691 +},
75692 +/* Do not reference code from writable data */
75693 +{
75694 + .fromsec = { DATA_SECTIONS, NULL },
75695 + .tosec = { TEXT_SECTIONS, NULL },
75696 + .mismatch = DATA_TO_TEXT
75697 }
75698 };
75699
75700 @@ -1122,10 +1129,10 @@ static Elf_Sym *find_elf_symbol(struct e
75701 continue;
75702 if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
75703 continue;
75704 - if (sym->st_value == addr)
75705 - return sym;
75706 /* Find a symbol nearby - addr are maybe negative */
75707 d = sym->st_value - addr;
75708 + if (d == 0)
75709 + return sym;
75710 if (d < 0)
75711 d = addr - sym->st_value;
75712 if (d < distance) {
75713 @@ -1404,6 +1411,14 @@ static void report_sec_mismatch(const ch
75714 tosym, prl_to, prl_to, tosym);
75715 free(prl_to);
75716 break;
75717 + case DATA_TO_TEXT:
75718 +/*
75719 + fprintf(stderr,
75720 + "The variable %s references\n"
75721 + "the %s %s%s%s\n",
75722 + fromsym, to, sec2annotation(tosec), tosym, to_p);
75723 +*/
75724 + break;
75725 }
75726 fprintf(stderr, "\n");
75727 }
75728 @@ -1629,7 +1644,7 @@ static void section_rel(const char *modn
75729 static void check_sec_ref(struct module *mod, const char *modname,
75730 struct elf_info *elf)
75731 {
75732 - int i;
75733 + unsigned int i;
75734 Elf_Shdr *sechdrs = elf->sechdrs;
75735
75736 /* Walk through all sections */
75737 @@ -1727,7 +1742,7 @@ void __attribute__((format(printf, 2, 3)
75738 va_end(ap);
75739 }
75740
75741 -void buf_write(struct buffer *buf, const char *s, int len)
75742 +void buf_write(struct buffer *buf, const char *s, unsigned int len)
75743 {
75744 if (buf->size - buf->pos < len) {
75745 buf->size += len + SZ;
75746 @@ -1939,7 +1954,7 @@ static void write_if_changed(struct buff
75747 if (fstat(fileno(file), &st) < 0)
75748 goto close_write;
75749
75750 - if (st.st_size != b->pos)
75751 + if (st.st_size != (off_t)b->pos)
75752 goto close_write;
75753
75754 tmp = NOFAIL(malloc(b->pos));
75755 diff -urNp linux-3.0.9/scripts/mod/modpost.h linux-3.0.9/scripts/mod/modpost.h
75756 --- linux-3.0.9/scripts/mod/modpost.h 2011-11-11 13:12:24.000000000 -0500
75757 +++ linux-3.0.9/scripts/mod/modpost.h 2011-11-15 20:03:00.000000000 -0500
75758 @@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *e
75759
75760 struct buffer {
75761 char *p;
75762 - int pos;
75763 - int size;
75764 + unsigned int pos;
75765 + unsigned int size;
75766 };
75767
75768 void __attribute__((format(printf, 2, 3)))
75769 buf_printf(struct buffer *buf, const char *fmt, ...);
75770
75771 void
75772 -buf_write(struct buffer *buf, const char *s, int len);
75773 +buf_write(struct buffer *buf, const char *s, unsigned int len);
75774
75775 struct module {
75776 struct module *next;
75777 diff -urNp linux-3.0.9/scripts/mod/sumversion.c linux-3.0.9/scripts/mod/sumversion.c
75778 --- linux-3.0.9/scripts/mod/sumversion.c 2011-11-11 13:12:24.000000000 -0500
75779 +++ linux-3.0.9/scripts/mod/sumversion.c 2011-11-15 20:03:00.000000000 -0500
75780 @@ -470,7 +470,7 @@ static void write_version(const char *fi
75781 goto out;
75782 }
75783
75784 - if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
75785 + if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
75786 warn("writing sum in %s failed: %s\n",
75787 filename, strerror(errno));
75788 goto out;
75789 diff -urNp linux-3.0.9/scripts/pnmtologo.c linux-3.0.9/scripts/pnmtologo.c
75790 --- linux-3.0.9/scripts/pnmtologo.c 2011-11-11 13:12:24.000000000 -0500
75791 +++ linux-3.0.9/scripts/pnmtologo.c 2011-11-15 20:03:00.000000000 -0500
75792 @@ -237,14 +237,14 @@ static void write_header(void)
75793 fprintf(out, " * Linux logo %s\n", logoname);
75794 fputs(" */\n\n", out);
75795 fputs("#include <linux/linux_logo.h>\n\n", out);
75796 - fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
75797 + fprintf(out, "static unsigned char %s_data[] = {\n",
75798 logoname);
75799 }
75800
75801 static void write_footer(void)
75802 {
75803 fputs("\n};\n\n", out);
75804 - fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
75805 + fprintf(out, "const struct linux_logo %s = {\n", logoname);
75806 fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
75807 fprintf(out, "\t.width\t\t= %d,\n", logo_width);
75808 fprintf(out, "\t.height\t\t= %d,\n", logo_height);
75809 @@ -374,7 +374,7 @@ static void write_logo_clut224(void)
75810 fputs("\n};\n\n", out);
75811
75812 /* write logo clut */
75813 - fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
75814 + fprintf(out, "static unsigned char %s_clut[] = {\n",
75815 logoname);
75816 write_hex_cnt = 0;
75817 for (i = 0; i < logo_clutsize; i++) {
75818 diff -urNp linux-3.0.9/security/apparmor/lsm.c linux-3.0.9/security/apparmor/lsm.c
75819 --- linux-3.0.9/security/apparmor/lsm.c 2011-11-11 13:12:24.000000000 -0500
75820 +++ linux-3.0.9/security/apparmor/lsm.c 2011-11-15 20:03:00.000000000 -0500
75821 @@ -621,7 +621,7 @@ static int apparmor_task_setrlimit(struc
75822 return error;
75823 }
75824
75825 -static struct security_operations apparmor_ops = {
75826 +static struct security_operations apparmor_ops __read_only = {
75827 .name = "apparmor",
75828
75829 .ptrace_access_check = apparmor_ptrace_access_check,
75830 diff -urNp linux-3.0.9/security/commoncap.c linux-3.0.9/security/commoncap.c
75831 --- linux-3.0.9/security/commoncap.c 2011-11-11 13:12:24.000000000 -0500
75832 +++ linux-3.0.9/security/commoncap.c 2011-11-15 20:03:00.000000000 -0500
75833 @@ -28,6 +28,7 @@
75834 #include <linux/prctl.h>
75835 #include <linux/securebits.h>
75836 #include <linux/user_namespace.h>
75837 +#include <net/sock.h>
75838
75839 /*
75840 * If a non-root user executes a setuid-root binary in
75841 @@ -58,7 +59,7 @@ int cap_netlink_send(struct sock *sk, st
75842
75843 int cap_netlink_recv(struct sk_buff *skb, int cap)
75844 {
75845 - if (!cap_raised(current_cap(), cap))
75846 + if (!cap_raised(current_cap(), cap) || !gr_is_capable(cap))
75847 return -EPERM;
75848 return 0;
75849 }
75850 @@ -575,6 +576,9 @@ int cap_bprm_secureexec(struct linux_bin
75851 {
75852 const struct cred *cred = current_cred();
75853
75854 + if (gr_acl_enable_at_secure())
75855 + return 1;
75856 +
75857 if (cred->uid != 0) {
75858 if (bprm->cap_effective)
75859 return 1;
75860 diff -urNp linux-3.0.9/security/integrity/ima/ima_api.c linux-3.0.9/security/integrity/ima/ima_api.c
75861 --- linux-3.0.9/security/integrity/ima/ima_api.c 2011-11-11 13:12:24.000000000 -0500
75862 +++ linux-3.0.9/security/integrity/ima/ima_api.c 2011-11-15 20:03:00.000000000 -0500
75863 @@ -75,7 +75,7 @@ void ima_add_violation(struct inode *ino
75864 int result;
75865
75866 /* can overflow, only indicator */
75867 - atomic_long_inc(&ima_htable.violations);
75868 + atomic_long_inc_unchecked(&ima_htable.violations);
75869
75870 entry = kmalloc(sizeof(*entry), GFP_KERNEL);
75871 if (!entry) {
75872 diff -urNp linux-3.0.9/security/integrity/ima/ima_fs.c linux-3.0.9/security/integrity/ima/ima_fs.c
75873 --- linux-3.0.9/security/integrity/ima/ima_fs.c 2011-11-11 13:12:24.000000000 -0500
75874 +++ linux-3.0.9/security/integrity/ima/ima_fs.c 2011-11-15 20:03:00.000000000 -0500
75875 @@ -28,12 +28,12 @@
75876 static int valid_policy = 1;
75877 #define TMPBUFLEN 12
75878 static ssize_t ima_show_htable_value(char __user *buf, size_t count,
75879 - loff_t *ppos, atomic_long_t *val)
75880 + loff_t *ppos, atomic_long_unchecked_t *val)
75881 {
75882 char tmpbuf[TMPBUFLEN];
75883 ssize_t len;
75884
75885 - len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
75886 + len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
75887 return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
75888 }
75889
75890 diff -urNp linux-3.0.9/security/integrity/ima/ima.h linux-3.0.9/security/integrity/ima/ima.h
75891 --- linux-3.0.9/security/integrity/ima/ima.h 2011-11-11 13:12:24.000000000 -0500
75892 +++ linux-3.0.9/security/integrity/ima/ima.h 2011-11-15 20:03:00.000000000 -0500
75893 @@ -85,8 +85,8 @@ void ima_add_violation(struct inode *ino
75894 extern spinlock_t ima_queue_lock;
75895
75896 struct ima_h_table {
75897 - atomic_long_t len; /* number of stored measurements in the list */
75898 - atomic_long_t violations;
75899 + atomic_long_unchecked_t len; /* number of stored measurements in the list */
75900 + atomic_long_unchecked_t violations;
75901 struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
75902 };
75903 extern struct ima_h_table ima_htable;
75904 diff -urNp linux-3.0.9/security/integrity/ima/ima_queue.c linux-3.0.9/security/integrity/ima/ima_queue.c
75905 --- linux-3.0.9/security/integrity/ima/ima_queue.c 2011-11-11 13:12:24.000000000 -0500
75906 +++ linux-3.0.9/security/integrity/ima/ima_queue.c 2011-11-15 20:03:00.000000000 -0500
75907 @@ -79,7 +79,7 @@ static int ima_add_digest_entry(struct i
75908 INIT_LIST_HEAD(&qe->later);
75909 list_add_tail_rcu(&qe->later, &ima_measurements);
75910
75911 - atomic_long_inc(&ima_htable.len);
75912 + atomic_long_inc_unchecked(&ima_htable.len);
75913 key = ima_hash_key(entry->digest);
75914 hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
75915 return 0;
75916 diff -urNp linux-3.0.9/security/Kconfig linux-3.0.9/security/Kconfig
75917 --- linux-3.0.9/security/Kconfig 2011-11-11 13:12:24.000000000 -0500
75918 +++ linux-3.0.9/security/Kconfig 2011-11-15 20:03:00.000000000 -0500
75919 @@ -4,6 +4,558 @@
75920
75921 menu "Security options"
75922
75923 +source grsecurity/Kconfig
75924 +
75925 +menu "PaX"
75926 +
75927 + config ARCH_TRACK_EXEC_LIMIT
75928 + bool
75929 +
75930 + config PAX_KERNEXEC_PLUGIN
75931 + bool
75932 +
75933 + config PAX_PER_CPU_PGD
75934 + bool
75935 +
75936 + config TASK_SIZE_MAX_SHIFT
75937 + int
75938 + depends on X86_64
75939 + default 47 if !PAX_PER_CPU_PGD
75940 + default 42 if PAX_PER_CPU_PGD
75941 +
75942 + config PAX_ENABLE_PAE
75943 + bool
75944 + default y if (X86_32 && (MPENTIUM4 || MK8 || MPSC || MCORE2 || MATOM))
75945 +
75946 +config PAX
75947 + bool "Enable various PaX features"
75948 + depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS || PARISC || PPC || SPARC || X86)
75949 + help
75950 + This allows you to enable various PaX features. PaX adds
75951 + intrusion prevention mechanisms to the kernel that reduce
75952 + the risks posed by exploitable memory corruption bugs.
75953 +
75954 +menu "PaX Control"
75955 + depends on PAX
75956 +
75957 +config PAX_SOFTMODE
75958 + bool 'Support soft mode'
75959 + select PAX_PT_PAX_FLAGS
75960 + help
75961 + Enabling this option will allow you to run PaX in soft mode, that
75962 + is, PaX features will not be enforced by default, only on executables
75963 + marked explicitly. You must also enable PT_PAX_FLAGS support as it
75964 + is the only way to mark executables for soft mode use.
75965 +
75966 + Soft mode can be activated by using the "pax_softmode=1" kernel command
75967 + line option on boot. Furthermore you can control various PaX features
75968 + at runtime via the entries in /proc/sys/kernel/pax.
75969 +
75970 +config PAX_EI_PAX
75971 + bool 'Use legacy ELF header marking'
75972 + help
75973 + Enabling this option will allow you to control PaX features on
75974 + a per executable basis via the 'chpax' utility available at
75975 + http://pax.grsecurity.net/. The control flags will be read from
75976 + an otherwise reserved part of the ELF header. This marking has
75977 + numerous drawbacks (no support for soft-mode, toolchain does not
75978 + know about the non-standard use of the ELF header) therefore it
75979 + has been deprecated in favour of PT_PAX_FLAGS support.
75980 +
75981 + Note that if you enable PT_PAX_FLAGS marking support as well,
75982 + the PT_PAX_FLAG marks will override the legacy EI_PAX marks.
75983 +
75984 +config PAX_PT_PAX_FLAGS
75985 + bool 'Use ELF program header marking'
75986 + help
75987 + Enabling this option will allow you to control PaX features on
75988 + a per executable basis via the 'paxctl' utility available at
75989 + http://pax.grsecurity.net/. The control flags will be read from
75990 + a PaX specific ELF program header (PT_PAX_FLAGS). This marking
75991 + has the benefits of supporting both soft mode and being fully
75992 + integrated into the toolchain (the binutils patch is available
75993 + from http://pax.grsecurity.net).
75994 +
75995 + If your toolchain does not support PT_PAX_FLAGS markings,
75996 + you can create one in most cases with 'paxctl -C'.
75997 +
75998 + Note that if you enable the legacy EI_PAX marking support as well,
75999 + the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
76000 +
76001 +choice
76002 + prompt 'MAC system integration'
76003 + default PAX_HAVE_ACL_FLAGS
76004 + help
76005 + Mandatory Access Control systems have the option of controlling
76006 + PaX flags on a per executable basis, choose the method supported
76007 + by your particular system.
76008 +
76009 + - "none": if your MAC system does not interact with PaX,
76010 + - "direct": if your MAC system defines pax_set_initial_flags() itself,
76011 + - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
76012 +
76013 + NOTE: this option is for developers/integrators only.
76014 +
76015 + config PAX_NO_ACL_FLAGS
76016 + bool 'none'
76017 +
76018 + config PAX_HAVE_ACL_FLAGS
76019 + bool 'direct'
76020 +
76021 + config PAX_HOOK_ACL_FLAGS
76022 + bool 'hook'
76023 +endchoice
76024 +
76025 +endmenu
76026 +
76027 +menu "Non-executable pages"
76028 + depends on PAX
76029 +
76030 +config PAX_NOEXEC
76031 + bool "Enforce non-executable pages"
76032 + depends on (PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS) && (ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86)
76033 + help
76034 + By design some architectures do not allow for protecting memory
76035 + pages against execution or even if they do, Linux does not make
76036 + use of this feature. In practice this means that if a page is
76037 + readable (such as the stack or heap) it is also executable.
76038 +
76039 + There is a well known exploit technique that makes use of this
76040 + fact and a common programming mistake where an attacker can
76041 + introduce code of his choice somewhere in the attacked program's
76042 + memory (typically the stack or the heap) and then execute it.
76043 +
76044 + If the attacked program was running with different (typically
76045 + higher) privileges than that of the attacker, then he can elevate
76046 + his own privilege level (e.g. get a root shell, write to files for
76047 + which he does not have write access to, etc).
76048 +
76049 + Enabling this option will let you choose from various features
76050 + that prevent the injection and execution of 'foreign' code in
76051 + a program.
76052 +
76053 + This will also break programs that rely on the old behaviour and
76054 + expect that dynamically allocated memory via the malloc() family
76055 + of functions is executable (which it is not). Notable examples
76056 + are the XFree86 4.x server, the java runtime and wine.
76057 +
76058 +config PAX_PAGEEXEC
76059 + bool "Paging based non-executable pages"
76060 + depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MATOM || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
76061 + select S390_SWITCH_AMODE if S390
76062 + select S390_EXEC_PROTECT if S390
76063 + select ARCH_TRACK_EXEC_LIMIT if X86_32
76064 + help
76065 + This implementation is based on the paging feature of the CPU.
76066 + On i386 without hardware non-executable bit support there is a
76067 + variable but usually low performance impact, however on Intel's
76068 + P4 core based CPUs it is very high so you should not enable this
76069 + for kernels meant to be used on such CPUs.
76070 +
76071 + On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
76072 + with hardware non-executable bit support there is no performance
76073 + impact, on ppc the impact is negligible.
76074 +
76075 + Note that several architectures require various emulations due to
76076 + badly designed userland ABIs, this will cause a performance impact
76077 + but will disappear as soon as userland is fixed. For example, ppc
76078 + userland MUST have been built with secure-plt by a recent toolchain.
76079 +
76080 +config PAX_SEGMEXEC
76081 + bool "Segmentation based non-executable pages"
76082 + depends on PAX_NOEXEC && X86_32
76083 + help
76084 + This implementation is based on the segmentation feature of the
76085 + CPU and has a very small performance impact, however applications
76086 + will be limited to a 1.5 GB address space instead of the normal
76087 + 3 GB.
76088 +
76089 +config PAX_EMUTRAMP
76090 + bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
76091 + default y if PARISC
76092 + help
76093 + There are some programs and libraries that for one reason or
76094 + another attempt to execute special small code snippets from
76095 + non-executable memory pages. Most notable examples are the
76096 + signal handler return code generated by the kernel itself and
76097 + the GCC trampolines.
76098 +
76099 + If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
76100 + such programs will no longer work under your kernel.
76101 +
76102 + As a remedy you can say Y here and use the 'chpax' or 'paxctl'
76103 + utilities to enable trampoline emulation for the affected programs
76104 + yet still have the protection provided by the non-executable pages.
76105 +
76106 + On parisc you MUST enable this option and EMUSIGRT as well, otherwise
76107 + your system will not even boot.
76108 +
76109 + Alternatively you can say N here and use the 'chpax' or 'paxctl'
76110 + utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
76111 + for the affected files.
76112 +
76113 + NOTE: enabling this feature *may* open up a loophole in the
76114 + protection provided by non-executable pages that an attacker
76115 + could abuse. Therefore the best solution is to not have any
76116 + files on your system that would require this option. This can
76117 + be achieved by not using libc5 (which relies on the kernel
76118 + signal handler return code) and not using or rewriting programs
76119 + that make use of the nested function implementation of GCC.
76120 + Skilled users can just fix GCC itself so that it implements
76121 + nested function calls in a way that does not interfere with PaX.
76122 +
76123 +config PAX_EMUSIGRT
76124 + bool "Automatically emulate sigreturn trampolines"
76125 + depends on PAX_EMUTRAMP && PARISC
76126 + default y
76127 + help
76128 + Enabling this option will have the kernel automatically detect
76129 + and emulate signal return trampolines executing on the stack
76130 + that would otherwise lead to task termination.
76131 +
76132 + This solution is intended as a temporary one for users with
76133 + legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
76134 + Modula-3 runtime, etc) or executables linked to such, basically
76135 + everything that does not specify its own SA_RESTORER function in
76136 + normal executable memory like glibc 2.1+ does.
76137 +
76138 + On parisc you MUST enable this option, otherwise your system will
76139 + not even boot.
76140 +
76141 + NOTE: this feature cannot be disabled on a per executable basis
76142 + and since it *does* open up a loophole in the protection provided
76143 + by non-executable pages, the best solution is to not have any
76144 + files on your system that would require this option.
76145 +
76146 +config PAX_MPROTECT
76147 + bool "Restrict mprotect()"
76148 + depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
76149 + help
76150 + Enabling this option will prevent programs from
76151 + - changing the executable status of memory pages that were
76152 + not originally created as executable,
76153 + - making read-only executable pages writable again,
76154 + - creating executable pages from anonymous memory,
76155 + - making read-only-after-relocations (RELRO) data pages writable again.
76156 +
76157 + You should say Y here to complete the protection provided by
76158 + the enforcement of non-executable pages.
76159 +
76160 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control
76161 + this feature on a per file basis.
76162 +
76163 +config PAX_MPROTECT_COMPAT
76164 + bool "Use legacy/compat protection demoting (read help)"
76165 + depends on PAX_MPROTECT
76166 + default n
76167 + help
76168 + The current implementation of PAX_MPROTECT denies RWX allocations/mprotects
76169 + by sending the proper error code to the application. For some broken
76170 + userland, this can cause problems with Python or other applications. The
76171 + current implementation however allows for applications like clamav to
76172 + detect if JIT compilation/execution is allowed and to fall back gracefully
76173 + to an interpreter-based mode if it does not. While we encourage everyone
76174 + to use the current implementation as-is and push upstream to fix broken
76175 + userland (note that the RWX logging option can assist with this), in some
76176 + environments this may not be possible. Having to disable MPROTECT
76177 + completely on certain binaries reduces the security benefit of PaX,
76178 + so this option is provided for those environments to revert to the old
76179 + behavior.
76180 +
76181 +config PAX_ELFRELOCS
76182 + bool "Allow ELF text relocations (read help)"
76183 + depends on PAX_MPROTECT
76184 + default n
76185 + help
76186 + Non-executable pages and mprotect() restrictions are effective
76187 + in preventing the introduction of new executable code into an
76188 + attacked task's address space. There remain only two venues
76189 + for this kind of attack: if the attacker can execute already
76190 + existing code in the attacked task then he can either have it
76191 + create and mmap() a file containing his code or have it mmap()
76192 + an already existing ELF library that does not have position
76193 + independent code in it and use mprotect() on it to make it
76194 + writable and copy his code there. While protecting against
76195 + the former approach is beyond PaX, the latter can be prevented
76196 + by having only PIC ELF libraries on one's system (which do not
76197 + need to relocate their code). If you are sure this is your case,
76198 + as is the case with all modern Linux distributions, then leave
76199 + this option disabled. You should say 'n' here.
76200 +
76201 +config PAX_ETEXECRELOCS
76202 + bool "Allow ELF ET_EXEC text relocations"
76203 + depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
76204 + select PAX_ELFRELOCS
76205 + default y
76206 + help
76207 + On some architectures there are incorrectly created applications
76208 + that require text relocations and would not work without enabling
76209 + this option. If you are an alpha, ia64 or parisc user, you should
76210 + enable this option and disable it once you have made sure that
76211 + none of your applications need it.
76212 +
76213 +config PAX_EMUPLT
76214 + bool "Automatically emulate ELF PLT"
76215 + depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
76216 + default y
76217 + help
76218 + Enabling this option will have the kernel automatically detect
76219 + and emulate the Procedure Linkage Table entries in ELF files.
76220 + On some architectures such entries are in writable memory, and
76221 + become non-executable leading to task termination. Therefore
76222 + it is mandatory that you enable this option on alpha, parisc,
76223 + sparc and sparc64, otherwise your system would not even boot.
76224 +
76225 + NOTE: this feature *does* open up a loophole in the protection
76226 + provided by the non-executable pages, therefore the proper
76227 + solution is to modify the toolchain to produce a PLT that does
76228 + not need to be writable.
76229 +
76230 +config PAX_DLRESOLVE
76231 + bool 'Emulate old glibc resolver stub'
76232 + depends on PAX_EMUPLT && SPARC
76233 + default n
76234 + help
76235 + This option is needed if userland has an old glibc (before 2.4)
76236 + that puts a 'save' instruction into the runtime generated resolver
76237 + stub that needs special emulation.
76238 +
76239 +config PAX_KERNEXEC
76240 + bool "Enforce non-executable kernel pages"
76241 + depends on (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN
76242 + select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
76243 + select PAX_KERNEXEC_PLUGIN if X86_64
76244 + help
76245 + This is the kernel land equivalent of PAGEEXEC and MPROTECT,
76246 + that is, enabling this option will make it harder to inject
76247 + and execute 'foreign' code in kernel memory itself.
76248 +
76249 + Note that on x86_64 kernels there is a known regression when
76250 + this feature and KVM/VMX are both enabled in the host kernel.
76251 +
76252 +config PAX_KERNEXEC_MODULE_TEXT
76253 + int "Minimum amount of memory reserved for module code"
76254 + default "4"
76255 + depends on PAX_KERNEXEC && X86_32 && MODULES
76256 + help
76257 + Due to implementation details the kernel must reserve a fixed
76258 + amount of memory for module code at compile time that cannot be
76259 + changed at runtime. Here you can specify the minimum amount
76260 + in MB that will be reserved. Due to the same implementation
76261 + details this size will always be rounded up to the next 2/4 MB
76262 + boundary (depends on PAE) so the actually available memory for
76263 + module code will usually be more than this minimum.
76264 +
76265 + The default 4 MB should be enough for most users but if you have
76266 + an excessive number of modules (e.g., most distribution configs
76267 + compile many drivers as modules) or use huge modules such as
76268 + nvidia's kernel driver, you will need to adjust this amount.
76269 + A good rule of thumb is to look at your currently loaded kernel
76270 + modules and add up their sizes.
76271 +
76272 +endmenu
76273 +
76274 +menu "Address Space Layout Randomization"
76275 + depends on PAX
76276 +
76277 +config PAX_ASLR
76278 + bool "Address Space Layout Randomization"
76279 + depends on PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS
76280 + help
76281 + Many if not most exploit techniques rely on the knowledge of
76282 + certain addresses in the attacked program. The following options
76283 + will allow the kernel to apply a certain amount of randomization
76284 + to specific parts of the program thereby forcing an attacker to
76285 + guess them in most cases. Any failed guess will most likely crash
76286 + the attacked program which allows the kernel to detect such attempts
76287 + and react on them. PaX itself provides no reaction mechanisms,
76288 + instead it is strongly encouraged that you make use of Nergal's
76289 + segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
76290 + (http://www.grsecurity.net/) built-in crash detection features or
76291 + develop one yourself.
76292 +
76293 + By saying Y here you can choose to randomize the following areas:
76294 + - top of the task's kernel stack
76295 + - top of the task's userland stack
76296 + - base address for mmap() requests that do not specify one
76297 + (this includes all libraries)
76298 + - base address of the main executable
76299 +
76300 + It is strongly recommended to say Y here as address space layout
76301 + randomization has negligible impact on performance yet it provides
76302 + a very effective protection.
76303 +
76304 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control
76305 + this feature on a per file basis.
76306 +
76307 +config PAX_RANDKSTACK
76308 + bool "Randomize kernel stack base"
76309 + depends on X86_TSC && X86
76310 + help
76311 + By saying Y here the kernel will randomize every task's kernel
76312 + stack on every system call. This will not only force an attacker
76313 + to guess it but also prevent him from making use of possible
76314 + leaked information about it.
76315 +
76316 + Since the kernel stack is a rather scarce resource, randomization
76317 + may cause unexpected stack overflows, therefore you should very
76318 + carefully test your system. Note that once enabled in the kernel
76319 + configuration, this feature cannot be disabled on a per file basis.
76320 +
76321 +config PAX_RANDUSTACK
76322 + bool "Randomize user stack base"
76323 + depends on PAX_ASLR
76324 + help
76325 + By saying Y here the kernel will randomize every task's userland
76326 + stack. The randomization is done in two steps where the second
76327 + one may apply a big amount of shift to the top of the stack and
76328 + cause problems for programs that want to use lots of memory (more
76329 + than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
76330 + For this reason the second step can be controlled by 'chpax' or
76331 + 'paxctl' on a per file basis.
76332 +
76333 +config PAX_RANDMMAP
76334 + bool "Randomize mmap() base"
76335 + depends on PAX_ASLR
76336 + help
76337 + By saying Y here the kernel will use a randomized base address for
76338 + mmap() requests that do not specify one themselves. As a result
76339 + all dynamically loaded libraries will appear at random addresses
76340 + and therefore be harder to exploit by a technique where an attacker
76341 + attempts to execute library code for his purposes (e.g. spawn a
76342 + shell from an exploited program that is running at an elevated
76343 + privilege level).
76344 +
76345 + Furthermore, if a program is relinked as a dynamic ELF file, its
76346 + base address will be randomized as well, completing the full
76347 + randomization of the address space layout. Attacking such programs
76348 + becomes a guess game. You can find an example of doing this at
76349 + http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
76350 + http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
76351 +
76352 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
76353 + feature on a per file basis.
76354 +
76355 +endmenu
76356 +
76357 +menu "Miscellaneous hardening features"
76358 +
76359 +config PAX_MEMORY_SANITIZE
76360 + bool "Sanitize all freed memory"
76361 + help
76362 + By saying Y here the kernel will erase memory pages as soon as they
76363 + are freed. This in turn reduces the lifetime of data stored in the
76364 + pages, making it less likely that sensitive information such as
76365 + passwords, cryptographic secrets, etc stay in memory for too long.
76366 +
76367 + This is especially useful for programs whose runtime is short, long
76368 + lived processes and the kernel itself benefit from this as long as
76369 + they operate on whole memory pages and ensure timely freeing of pages
76370 + that may hold sensitive information.
76371 +
76372 + The tradeoff is performance impact, on a single CPU system kernel
76373 + compilation sees a 3% slowdown, other systems and workloads may vary
76374 + and you are advised to test this feature on your expected workload
76375 + before deploying it.
76376 +
76377 + Note that this feature does not protect data stored in live pages,
76378 + e.g., process memory swapped to disk may stay there for a long time.
76379 +
76380 +config PAX_MEMORY_STACKLEAK
76381 + bool "Sanitize kernel stack"
76382 + depends on X86
76383 + help
76384 + By saying Y here the kernel will erase the kernel stack before it
76385 + returns from a system call. This in turn reduces the information
76386 + that a kernel stack leak bug can reveal.
76387 +
76388 + Note that such a bug can still leak information that was put on
76389 + the stack by the current system call (the one eventually triggering
76390 + the bug) but traces of earlier system calls on the kernel stack
76391 + cannot leak anymore.
76392 +
76393 + The tradeoff is performance impact: on a single CPU system kernel
76394 + compilation sees a 1% slowdown, other systems and workloads may vary
76395 + and you are advised to test this feature on your expected workload
76396 + before deploying it.
76397 +
76398 + Note: full support for this feature requires gcc with plugin support
76399 + so make sure your compiler is at least gcc 4.5.0 (cross compilation
76400 + is not supported). Using older gcc versions means that functions
76401 + with large enough stack frames may leave uninitialized memory behind
76402 + that may be exposed to a later syscall leaking the stack.
76403 +
76404 +config PAX_MEMORY_UDEREF
76405 + bool "Prevent invalid userland pointer dereference"
76406 + depends on X86 && !UML_X86 && !XEN
76407 + select PAX_PER_CPU_PGD if X86_64
76408 + help
76409 + By saying Y here the kernel will be prevented from dereferencing
76410 + userland pointers in contexts where the kernel expects only kernel
76411 + pointers. This is both a useful runtime debugging feature and a
76412 + security measure that prevents exploiting a class of kernel bugs.
76413 +
76414 + The tradeoff is that some virtualization solutions may experience
76415 + a huge slowdown and therefore you should not enable this feature
76416 + for kernels meant to run in such environments. Whether a given VM
76417 + solution is affected or not is best determined by simply trying it
76418 + out, the performance impact will be obvious right on boot as this
76419 + mechanism engages from very early on. A good rule of thumb is that
76420 + VMs running on CPUs without hardware virtualization support (i.e.,
76421 + the majority of IA-32 CPUs) will likely experience the slowdown.
76422 +
76423 +config PAX_REFCOUNT
76424 + bool "Prevent various kernel object reference counter overflows"
76425 + depends on GRKERNSEC && (X86 || SPARC64)
76426 + help
76427 + By saying Y here the kernel will detect and prevent overflowing
76428 + various (but not all) kinds of object reference counters. Such
76429 + overflows can normally occur due to bugs only and are often, if
76430 + not always, exploitable.
76431 +
76432 + The tradeoff is that data structures protected by an overflowed
76433 + refcount will never be freed and therefore will leak memory. Note
76434 + that this leak also happens even without this protection but in
76435 + that case the overflow can eventually trigger the freeing of the
76436 + data structure while it is still being used elsewhere, resulting
76437 + in the exploitable situation that this feature prevents.
76438 +
76439 + Since this has a negligible performance impact, you should enable
76440 + this feature.
76441 +
76442 +config PAX_USERCOPY
76443 + bool "Harden heap object copies between kernel and userland"
76444 + depends on X86 || PPC || SPARC || ARM
76445 + depends on GRKERNSEC && (SLAB || SLUB || SLOB)
76446 + help
76447 + By saying Y here the kernel will enforce the size of heap objects
76448 + when they are copied in either direction between the kernel and
76449 + userland, even if only a part of the heap object is copied.
76450 +
76451 + Specifically, this checking prevents information leaking from the
76452 + kernel heap during kernel to userland copies (if the kernel heap
76453 + object is otherwise fully initialized) and prevents kernel heap
76454 + overflows during userland to kernel copies.
76455 +
76456 + Note that the current implementation provides the strictest bounds
76457 + checks for the SLUB allocator.
76458 +
76459 + Enabling this option also enables per-slab cache protection against
76460 + data in a given cache being copied into/out of via userland
76461 + accessors. Though the whitelist of regions will be reduced over
76462 + time, it notably protects important data structures like task structs.
76463 +
76464 + If frame pointers are enabled on x86, this option will also restrict
76465 + copies into and out of the kernel stack to local variables within a
76466 + single frame.
76467 +
76468 + Since this has a negligible performance impact, you should enable
76469 + this feature.
76470 +
76471 +endmenu
76472 +
76473 +endmenu
76474 +
76475 config KEYS
76476 bool "Enable access key retention support"
76477 help
76478 @@ -167,7 +719,7 @@ config INTEL_TXT
76479 config LSM_MMAP_MIN_ADDR
76480 int "Low address space for LSM to protect from user allocation"
76481 depends on SECURITY && SECURITY_SELINUX
76482 - default 32768 if ARM
76483 + default 32768 if ALPHA || ARM || PARISC || SPARC32
76484 default 65536
76485 help
76486 This is the portion of low virtual memory which should be protected
76487 diff -urNp linux-3.0.9/security/keys/compat.c linux-3.0.9/security/keys/compat.c
76488 --- linux-3.0.9/security/keys/compat.c 2011-11-11 13:12:24.000000000 -0500
76489 +++ linux-3.0.9/security/keys/compat.c 2011-11-15 20:03:00.000000000 -0500
76490 @@ -44,7 +44,7 @@ long compat_keyctl_instantiate_key_iov(
76491 if (ret == 0)
76492 goto no_payload_free;
76493
76494 - ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
76495 + ret = keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, ioc, ret, ringid);
76496
76497 if (iov != iovstack)
76498 kfree(iov);
76499 diff -urNp linux-3.0.9/security/keys/keyctl.c linux-3.0.9/security/keys/keyctl.c
76500 --- linux-3.0.9/security/keys/keyctl.c 2011-11-11 13:12:24.000000000 -0500
76501 +++ linux-3.0.9/security/keys/keyctl.c 2011-11-15 20:03:00.000000000 -0500
76502 @@ -921,7 +921,7 @@ static int keyctl_change_reqkey_auth(str
76503 /*
76504 * Copy the iovec data from userspace
76505 */
76506 -static long copy_from_user_iovec(void *buffer, const struct iovec *iov,
76507 +static long copy_from_user_iovec(void *buffer, const struct iovec __user *iov,
76508 unsigned ioc)
76509 {
76510 for (; ioc > 0; ioc--) {
76511 @@ -943,7 +943,7 @@ static long copy_from_user_iovec(void *b
76512 * If successful, 0 will be returned.
76513 */
76514 long keyctl_instantiate_key_common(key_serial_t id,
76515 - const struct iovec *payload_iov,
76516 + const struct iovec __user *payload_iov,
76517 unsigned ioc,
76518 size_t plen,
76519 key_serial_t ringid)
76520 @@ -1038,7 +1038,7 @@ long keyctl_instantiate_key(key_serial_t
76521 [0].iov_len = plen
76522 };
76523
76524 - return keyctl_instantiate_key_common(id, iov, 1, plen, ringid);
76525 + return keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, 1, plen, ringid);
76526 }
76527
76528 return keyctl_instantiate_key_common(id, NULL, 0, 0, ringid);
76529 @@ -1071,7 +1071,7 @@ long keyctl_instantiate_key_iov(key_seri
76530 if (ret == 0)
76531 goto no_payload_free;
76532
76533 - ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
76534 + ret = keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, ioc, ret, ringid);
76535
76536 if (iov != iovstack)
76537 kfree(iov);
76538 diff -urNp linux-3.0.9/security/keys/keyring.c linux-3.0.9/security/keys/keyring.c
76539 --- linux-3.0.9/security/keys/keyring.c 2011-11-11 13:12:24.000000000 -0500
76540 +++ linux-3.0.9/security/keys/keyring.c 2011-11-15 20:03:00.000000000 -0500
76541 @@ -215,15 +215,15 @@ static long keyring_read(const struct ke
76542 ret = -EFAULT;
76543
76544 for (loop = 0; loop < klist->nkeys; loop++) {
76545 + key_serial_t serial;
76546 key = klist->keys[loop];
76547 + serial = key->serial;
76548
76549 tmp = sizeof(key_serial_t);
76550 if (tmp > buflen)
76551 tmp = buflen;
76552
76553 - if (copy_to_user(buffer,
76554 - &key->serial,
76555 - tmp) != 0)
76556 + if (copy_to_user(buffer, &serial, tmp))
76557 goto error;
76558
76559 buflen -= tmp;
76560 diff -urNp linux-3.0.9/security/min_addr.c linux-3.0.9/security/min_addr.c
76561 --- linux-3.0.9/security/min_addr.c 2011-11-11 13:12:24.000000000 -0500
76562 +++ linux-3.0.9/security/min_addr.c 2011-11-15 20:03:00.000000000 -0500
76563 @@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG
76564 */
76565 static void update_mmap_min_addr(void)
76566 {
76567 +#ifndef SPARC
76568 #ifdef CONFIG_LSM_MMAP_MIN_ADDR
76569 if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
76570 mmap_min_addr = dac_mmap_min_addr;
76571 @@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
76572 #else
76573 mmap_min_addr = dac_mmap_min_addr;
76574 #endif
76575 +#endif
76576 }
76577
76578 /*
76579 diff -urNp linux-3.0.9/security/security.c linux-3.0.9/security/security.c
76580 --- linux-3.0.9/security/security.c 2011-11-11 13:12:24.000000000 -0500
76581 +++ linux-3.0.9/security/security.c 2011-11-15 20:03:00.000000000 -0500
76582 @@ -25,8 +25,8 @@ static __initdata char chosen_lsm[SECURI
76583 /* things that live in capability.c */
76584 extern void __init security_fixup_ops(struct security_operations *ops);
76585
76586 -static struct security_operations *security_ops;
76587 -static struct security_operations default_security_ops = {
76588 +static struct security_operations *security_ops __read_only;
76589 +static struct security_operations default_security_ops __read_only = {
76590 .name = "default",
76591 };
76592
76593 @@ -67,7 +67,9 @@ int __init security_init(void)
76594
76595 void reset_security_ops(void)
76596 {
76597 + pax_open_kernel();
76598 security_ops = &default_security_ops;
76599 + pax_close_kernel();
76600 }
76601
76602 /* Save user chosen LSM */
76603 diff -urNp linux-3.0.9/security/selinux/hooks.c linux-3.0.9/security/selinux/hooks.c
76604 --- linux-3.0.9/security/selinux/hooks.c 2011-11-11 13:12:24.000000000 -0500
76605 +++ linux-3.0.9/security/selinux/hooks.c 2011-11-15 20:03:00.000000000 -0500
76606 @@ -93,7 +93,6 @@
76607 #define NUM_SEL_MNT_OPTS 5
76608
76609 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
76610 -extern struct security_operations *security_ops;
76611
76612 /* SECMARK reference count */
76613 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
76614 @@ -5454,7 +5453,7 @@ static int selinux_key_getsecurity(struc
76615
76616 #endif
76617
76618 -static struct security_operations selinux_ops = {
76619 +static struct security_operations selinux_ops __read_only = {
76620 .name = "selinux",
76621
76622 .ptrace_access_check = selinux_ptrace_access_check,
76623 diff -urNp linux-3.0.9/security/selinux/include/xfrm.h linux-3.0.9/security/selinux/include/xfrm.h
76624 --- linux-3.0.9/security/selinux/include/xfrm.h 2011-11-11 13:12:24.000000000 -0500
76625 +++ linux-3.0.9/security/selinux/include/xfrm.h 2011-11-15 20:03:00.000000000 -0500
76626 @@ -48,7 +48,7 @@ int selinux_xfrm_decode_session(struct s
76627
76628 static inline void selinux_xfrm_notify_policyload(void)
76629 {
76630 - atomic_inc(&flow_cache_genid);
76631 + atomic_inc_unchecked(&flow_cache_genid);
76632 }
76633 #else
76634 static inline int selinux_xfrm_enabled(void)
76635 diff -urNp linux-3.0.9/security/selinux/ss/services.c linux-3.0.9/security/selinux/ss/services.c
76636 --- linux-3.0.9/security/selinux/ss/services.c 2011-11-11 13:12:24.000000000 -0500
76637 +++ linux-3.0.9/security/selinux/ss/services.c 2011-11-15 20:03:00.000000000 -0500
76638 @@ -1814,6 +1814,8 @@ int security_load_policy(void *data, siz
76639 int rc = 0;
76640 struct policy_file file = { data, len }, *fp = &file;
76641
76642 + pax_track_stack();
76643 +
76644 if (!ss_initialized) {
76645 avtab_cache_init();
76646 rc = policydb_read(&policydb, fp);
76647 diff -urNp linux-3.0.9/security/smack/smack_lsm.c linux-3.0.9/security/smack/smack_lsm.c
76648 --- linux-3.0.9/security/smack/smack_lsm.c 2011-11-11 13:12:24.000000000 -0500
76649 +++ linux-3.0.9/security/smack/smack_lsm.c 2011-11-15 20:03:00.000000000 -0500
76650 @@ -3392,7 +3392,7 @@ static int smack_inode_getsecctx(struct
76651 return 0;
76652 }
76653
76654 -struct security_operations smack_ops = {
76655 +struct security_operations smack_ops __read_only = {
76656 .name = "smack",
76657
76658 .ptrace_access_check = smack_ptrace_access_check,
76659 diff -urNp linux-3.0.9/security/tomoyo/tomoyo.c linux-3.0.9/security/tomoyo/tomoyo.c
76660 --- linux-3.0.9/security/tomoyo/tomoyo.c 2011-11-11 13:12:24.000000000 -0500
76661 +++ linux-3.0.9/security/tomoyo/tomoyo.c 2011-11-15 20:03:00.000000000 -0500
76662 @@ -240,7 +240,7 @@ static int tomoyo_sb_pivotroot(struct pa
76663 * tomoyo_security_ops is a "struct security_operations" which is used for
76664 * registering TOMOYO.
76665 */
76666 -static struct security_operations tomoyo_security_ops = {
76667 +static struct security_operations tomoyo_security_ops __read_only = {
76668 .name = "tomoyo",
76669 .cred_alloc_blank = tomoyo_cred_alloc_blank,
76670 .cred_prepare = tomoyo_cred_prepare,
76671 diff -urNp linux-3.0.9/sound/aoa/codecs/onyx.c linux-3.0.9/sound/aoa/codecs/onyx.c
76672 --- linux-3.0.9/sound/aoa/codecs/onyx.c 2011-11-11 13:12:24.000000000 -0500
76673 +++ linux-3.0.9/sound/aoa/codecs/onyx.c 2011-11-15 20:03:00.000000000 -0500
76674 @@ -54,7 +54,7 @@ struct onyx {
76675 spdif_locked:1,
76676 analog_locked:1,
76677 original_mute:2;
76678 - int open_count;
76679 + local_t open_count;
76680 struct codec_info *codec_info;
76681
76682 /* mutex serializes concurrent access to the device
76683 @@ -753,7 +753,7 @@ static int onyx_open(struct codec_info_i
76684 struct onyx *onyx = cii->codec_data;
76685
76686 mutex_lock(&onyx->mutex);
76687 - onyx->open_count++;
76688 + local_inc(&onyx->open_count);
76689 mutex_unlock(&onyx->mutex);
76690
76691 return 0;
76692 @@ -765,8 +765,7 @@ static int onyx_close(struct codec_info_
76693 struct onyx *onyx = cii->codec_data;
76694
76695 mutex_lock(&onyx->mutex);
76696 - onyx->open_count--;
76697 - if (!onyx->open_count)
76698 + if (local_dec_and_test(&onyx->open_count))
76699 onyx->spdif_locked = onyx->analog_locked = 0;
76700 mutex_unlock(&onyx->mutex);
76701
76702 diff -urNp linux-3.0.9/sound/aoa/codecs/onyx.h linux-3.0.9/sound/aoa/codecs/onyx.h
76703 --- linux-3.0.9/sound/aoa/codecs/onyx.h 2011-11-11 13:12:24.000000000 -0500
76704 +++ linux-3.0.9/sound/aoa/codecs/onyx.h 2011-11-15 20:03:00.000000000 -0500
76705 @@ -11,6 +11,7 @@
76706 #include <linux/i2c.h>
76707 #include <asm/pmac_low_i2c.h>
76708 #include <asm/prom.h>
76709 +#include <asm/local.h>
76710
76711 /* PCM3052 register definitions */
76712
76713 diff -urNp linux-3.0.9/sound/core/oss/pcm_oss.c linux-3.0.9/sound/core/oss/pcm_oss.c
76714 --- linux-3.0.9/sound/core/oss/pcm_oss.c 2011-11-11 13:12:24.000000000 -0500
76715 +++ linux-3.0.9/sound/core/oss/pcm_oss.c 2011-11-15 20:03:00.000000000 -0500
76716 @@ -1189,10 +1189,10 @@ snd_pcm_sframes_t snd_pcm_oss_write3(str
76717 if (in_kernel) {
76718 mm_segment_t fs;
76719 fs = snd_enter_user();
76720 - ret = snd_pcm_lib_write(substream, (void __force __user *)ptr, frames);
76721 + ret = snd_pcm_lib_write(substream, (void __force_user *)ptr, frames);
76722 snd_leave_user(fs);
76723 } else {
76724 - ret = snd_pcm_lib_write(substream, (void __force __user *)ptr, frames);
76725 + ret = snd_pcm_lib_write(substream, (void __force_user *)ptr, frames);
76726 }
76727 if (ret != -EPIPE && ret != -ESTRPIPE)
76728 break;
76729 @@ -1234,10 +1234,10 @@ snd_pcm_sframes_t snd_pcm_oss_read3(stru
76730 if (in_kernel) {
76731 mm_segment_t fs;
76732 fs = snd_enter_user();
76733 - ret = snd_pcm_lib_read(substream, (void __force __user *)ptr, frames);
76734 + ret = snd_pcm_lib_read(substream, (void __force_user *)ptr, frames);
76735 snd_leave_user(fs);
76736 } else {
76737 - ret = snd_pcm_lib_read(substream, (void __force __user *)ptr, frames);
76738 + ret = snd_pcm_lib_read(substream, (void __force_user *)ptr, frames);
76739 }
76740 if (ret == -EPIPE) {
76741 if (runtime->status->state == SNDRV_PCM_STATE_DRAINING) {
76742 @@ -1337,7 +1337,7 @@ static ssize_t snd_pcm_oss_write2(struct
76743 struct snd_pcm_plugin_channel *channels;
76744 size_t oss_frame_bytes = (runtime->oss.plugin_first->src_width * runtime->oss.plugin_first->src_format.channels) / 8;
76745 if (!in_kernel) {
76746 - if (copy_from_user(runtime->oss.buffer, (const char __force __user *)buf, bytes))
76747 + if (copy_from_user(runtime->oss.buffer, (const char __force_user *)buf, bytes))
76748 return -EFAULT;
76749 buf = runtime->oss.buffer;
76750 }
76751 @@ -1407,7 +1407,7 @@ static ssize_t snd_pcm_oss_write1(struct
76752 }
76753 } else {
76754 tmp = snd_pcm_oss_write2(substream,
76755 - (const char __force *)buf,
76756 + (const char __force_kernel *)buf,
76757 runtime->oss.period_bytes, 0);
76758 if (tmp <= 0)
76759 goto err;
76760 @@ -1433,7 +1433,7 @@ static ssize_t snd_pcm_oss_read2(struct
76761 struct snd_pcm_runtime *runtime = substream->runtime;
76762 snd_pcm_sframes_t frames, frames1;
76763 #ifdef CONFIG_SND_PCM_OSS_PLUGINS
76764 - char __user *final_dst = (char __force __user *)buf;
76765 + char __user *final_dst = (char __force_user *)buf;
76766 if (runtime->oss.plugin_first) {
76767 struct snd_pcm_plugin_channel *channels;
76768 size_t oss_frame_bytes = (runtime->oss.plugin_last->dst_width * runtime->oss.plugin_last->dst_format.channels) / 8;
76769 @@ -1495,7 +1495,7 @@ static ssize_t snd_pcm_oss_read1(struct
76770 xfer += tmp;
76771 runtime->oss.buffer_used -= tmp;
76772 } else {
76773 - tmp = snd_pcm_oss_read2(substream, (char __force *)buf,
76774 + tmp = snd_pcm_oss_read2(substream, (char __force_kernel *)buf,
76775 runtime->oss.period_bytes, 0);
76776 if (tmp <= 0)
76777 goto err;
76778 @@ -1663,7 +1663,7 @@ static int snd_pcm_oss_sync(struct snd_p
76779 size1);
76780 size1 /= runtime->channels; /* frames */
76781 fs = snd_enter_user();
76782 - snd_pcm_lib_write(substream, (void __force __user *)runtime->oss.buffer, size1);
76783 + snd_pcm_lib_write(substream, (void __force_user *)runtime->oss.buffer, size1);
76784 snd_leave_user(fs);
76785 }
76786 } else if (runtime->access == SNDRV_PCM_ACCESS_RW_NONINTERLEAVED) {
76787 diff -urNp linux-3.0.9/sound/core/pcm_compat.c linux-3.0.9/sound/core/pcm_compat.c
76788 --- linux-3.0.9/sound/core/pcm_compat.c 2011-11-11 13:12:24.000000000 -0500
76789 +++ linux-3.0.9/sound/core/pcm_compat.c 2011-11-15 20:03:00.000000000 -0500
76790 @@ -31,7 +31,7 @@ static int snd_pcm_ioctl_delay_compat(st
76791 int err;
76792
76793 fs = snd_enter_user();
76794 - err = snd_pcm_delay(substream, &delay);
76795 + err = snd_pcm_delay(substream, (snd_pcm_sframes_t __force_user *)&delay);
76796 snd_leave_user(fs);
76797 if (err < 0)
76798 return err;
76799 diff -urNp linux-3.0.9/sound/core/pcm_native.c linux-3.0.9/sound/core/pcm_native.c
76800 --- linux-3.0.9/sound/core/pcm_native.c 2011-11-11 13:12:24.000000000 -0500
76801 +++ linux-3.0.9/sound/core/pcm_native.c 2011-11-15 20:03:00.000000000 -0500
76802 @@ -2770,11 +2770,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_
76803 switch (substream->stream) {
76804 case SNDRV_PCM_STREAM_PLAYBACK:
76805 result = snd_pcm_playback_ioctl1(NULL, substream, cmd,
76806 - (void __user *)arg);
76807 + (void __force_user *)arg);
76808 break;
76809 case SNDRV_PCM_STREAM_CAPTURE:
76810 result = snd_pcm_capture_ioctl1(NULL, substream, cmd,
76811 - (void __user *)arg);
76812 + (void __force_user *)arg);
76813 break;
76814 default:
76815 result = -EINVAL;
76816 diff -urNp linux-3.0.9/sound/core/seq/seq_device.c linux-3.0.9/sound/core/seq/seq_device.c
76817 --- linux-3.0.9/sound/core/seq/seq_device.c 2011-11-11 13:12:24.000000000 -0500
76818 +++ linux-3.0.9/sound/core/seq/seq_device.c 2011-11-15 20:03:00.000000000 -0500
76819 @@ -63,7 +63,7 @@ struct ops_list {
76820 int argsize; /* argument size */
76821
76822 /* operators */
76823 - struct snd_seq_dev_ops ops;
76824 + struct snd_seq_dev_ops *ops;
76825
76826 /* registred devices */
76827 struct list_head dev_list; /* list of devices */
76828 @@ -332,7 +332,7 @@ int snd_seq_device_register_driver(char
76829
76830 mutex_lock(&ops->reg_mutex);
76831 /* copy driver operators */
76832 - ops->ops = *entry;
76833 + ops->ops = entry;
76834 ops->driver |= DRIVER_LOADED;
76835 ops->argsize = argsize;
76836
76837 @@ -462,7 +462,7 @@ static int init_device(struct snd_seq_de
76838 dev->name, ops->id, ops->argsize, dev->argsize);
76839 return -EINVAL;
76840 }
76841 - if (ops->ops.init_device(dev) >= 0) {
76842 + if (ops->ops->init_device(dev) >= 0) {
76843 dev->status = SNDRV_SEQ_DEVICE_REGISTERED;
76844 ops->num_init_devices++;
76845 } else {
76846 @@ -489,7 +489,7 @@ static int free_device(struct snd_seq_de
76847 dev->name, ops->id, ops->argsize, dev->argsize);
76848 return -EINVAL;
76849 }
76850 - if ((result = ops->ops.free_device(dev)) >= 0 || result == -ENXIO) {
76851 + if ((result = ops->ops->free_device(dev)) >= 0 || result == -ENXIO) {
76852 dev->status = SNDRV_SEQ_DEVICE_FREE;
76853 dev->driver_data = NULL;
76854 ops->num_init_devices--;
76855 diff -urNp linux-3.0.9/sound/drivers/mts64.c linux-3.0.9/sound/drivers/mts64.c
76856 --- linux-3.0.9/sound/drivers/mts64.c 2011-11-11 13:12:24.000000000 -0500
76857 +++ linux-3.0.9/sound/drivers/mts64.c 2011-11-15 20:03:00.000000000 -0500
76858 @@ -28,6 +28,7 @@
76859 #include <sound/initval.h>
76860 #include <sound/rawmidi.h>
76861 #include <sound/control.h>
76862 +#include <asm/local.h>
76863
76864 #define CARD_NAME "Miditerminal 4140"
76865 #define DRIVER_NAME "MTS64"
76866 @@ -66,7 +67,7 @@ struct mts64 {
76867 struct pardevice *pardev;
76868 int pardev_claimed;
76869
76870 - int open_count;
76871 + local_t open_count;
76872 int current_midi_output_port;
76873 int current_midi_input_port;
76874 u8 mode[MTS64_NUM_INPUT_PORTS];
76875 @@ -696,7 +697,7 @@ static int snd_mts64_rawmidi_open(struct
76876 {
76877 struct mts64 *mts = substream->rmidi->private_data;
76878
76879 - if (mts->open_count == 0) {
76880 + if (local_read(&mts->open_count) == 0) {
76881 /* We don't need a spinlock here, because this is just called
76882 if the device has not been opened before.
76883 So there aren't any IRQs from the device */
76884 @@ -704,7 +705,7 @@ static int snd_mts64_rawmidi_open(struct
76885
76886 msleep(50);
76887 }
76888 - ++(mts->open_count);
76889 + local_inc(&mts->open_count);
76890
76891 return 0;
76892 }
76893 @@ -714,8 +715,7 @@ static int snd_mts64_rawmidi_close(struc
76894 struct mts64 *mts = substream->rmidi->private_data;
76895 unsigned long flags;
76896
76897 - --(mts->open_count);
76898 - if (mts->open_count == 0) {
76899 + if (local_dec_return(&mts->open_count) == 0) {
76900 /* We need the spinlock_irqsave here because we can still
76901 have IRQs at this point */
76902 spin_lock_irqsave(&mts->lock, flags);
76903 @@ -724,8 +724,8 @@ static int snd_mts64_rawmidi_close(struc
76904
76905 msleep(500);
76906
76907 - } else if (mts->open_count < 0)
76908 - mts->open_count = 0;
76909 + } else if (local_read(&mts->open_count) < 0)
76910 + local_set(&mts->open_count, 0);
76911
76912 return 0;
76913 }
76914 diff -urNp linux-3.0.9/sound/drivers/opl4/opl4_lib.c linux-3.0.9/sound/drivers/opl4/opl4_lib.c
76915 --- linux-3.0.9/sound/drivers/opl4/opl4_lib.c 2011-11-11 13:12:24.000000000 -0500
76916 +++ linux-3.0.9/sound/drivers/opl4/opl4_lib.c 2011-11-15 20:03:00.000000000 -0500
76917 @@ -28,7 +28,7 @@ MODULE_AUTHOR("Clemens Ladisch <clemens@
76918 MODULE_DESCRIPTION("OPL4 driver");
76919 MODULE_LICENSE("GPL");
76920
76921 -static void inline snd_opl4_wait(struct snd_opl4 *opl4)
76922 +static inline void snd_opl4_wait(struct snd_opl4 *opl4)
76923 {
76924 int timeout = 10;
76925 while ((inb(opl4->fm_port) & OPL4_STATUS_BUSY) && --timeout > 0)
76926 diff -urNp linux-3.0.9/sound/drivers/portman2x4.c linux-3.0.9/sound/drivers/portman2x4.c
76927 --- linux-3.0.9/sound/drivers/portman2x4.c 2011-11-11 13:12:24.000000000 -0500
76928 +++ linux-3.0.9/sound/drivers/portman2x4.c 2011-11-15 20:03:00.000000000 -0500
76929 @@ -47,6 +47,7 @@
76930 #include <sound/initval.h>
76931 #include <sound/rawmidi.h>
76932 #include <sound/control.h>
76933 +#include <asm/local.h>
76934
76935 #define CARD_NAME "Portman 2x4"
76936 #define DRIVER_NAME "portman"
76937 @@ -84,7 +85,7 @@ struct portman {
76938 struct pardevice *pardev;
76939 int pardev_claimed;
76940
76941 - int open_count;
76942 + local_t open_count;
76943 int mode[PORTMAN_NUM_INPUT_PORTS];
76944 struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
76945 };
76946 diff -urNp linux-3.0.9/sound/firewire/amdtp.c linux-3.0.9/sound/firewire/amdtp.c
76947 --- linux-3.0.9/sound/firewire/amdtp.c 2011-11-11 13:12:24.000000000 -0500
76948 +++ linux-3.0.9/sound/firewire/amdtp.c 2011-11-15 20:03:00.000000000 -0500
76949 @@ -371,7 +371,7 @@ static void queue_out_packet(struct amdt
76950 ptr = s->pcm_buffer_pointer + data_blocks;
76951 if (ptr >= pcm->runtime->buffer_size)
76952 ptr -= pcm->runtime->buffer_size;
76953 - ACCESS_ONCE(s->pcm_buffer_pointer) = ptr;
76954 + ACCESS_ONCE_RW(s->pcm_buffer_pointer) = ptr;
76955
76956 s->pcm_period_pointer += data_blocks;
76957 if (s->pcm_period_pointer >= pcm->runtime->period_size) {
76958 @@ -511,7 +511,7 @@ EXPORT_SYMBOL(amdtp_out_stream_start);
76959 */
76960 void amdtp_out_stream_update(struct amdtp_out_stream *s)
76961 {
76962 - ACCESS_ONCE(s->source_node_id_field) =
76963 + ACCESS_ONCE_RW(s->source_node_id_field) =
76964 (fw_parent_device(s->unit)->card->node_id & 0x3f) << 24;
76965 }
76966 EXPORT_SYMBOL(amdtp_out_stream_update);
76967 diff -urNp linux-3.0.9/sound/firewire/amdtp.h linux-3.0.9/sound/firewire/amdtp.h
76968 --- linux-3.0.9/sound/firewire/amdtp.h 2011-11-11 13:12:24.000000000 -0500
76969 +++ linux-3.0.9/sound/firewire/amdtp.h 2011-11-15 20:03:00.000000000 -0500
76970 @@ -146,7 +146,7 @@ static inline void amdtp_out_stream_pcm_
76971 static inline void amdtp_out_stream_pcm_trigger(struct amdtp_out_stream *s,
76972 struct snd_pcm_substream *pcm)
76973 {
76974 - ACCESS_ONCE(s->pcm) = pcm;
76975 + ACCESS_ONCE_RW(s->pcm) = pcm;
76976 }
76977
76978 /**
76979 diff -urNp linux-3.0.9/sound/firewire/isight.c linux-3.0.9/sound/firewire/isight.c
76980 --- linux-3.0.9/sound/firewire/isight.c 2011-11-11 13:12:24.000000000 -0500
76981 +++ linux-3.0.9/sound/firewire/isight.c 2011-11-15 20:03:00.000000000 -0500
76982 @@ -97,7 +97,7 @@ static void isight_update_pointers(struc
76983 ptr += count;
76984 if (ptr >= runtime->buffer_size)
76985 ptr -= runtime->buffer_size;
76986 - ACCESS_ONCE(isight->buffer_pointer) = ptr;
76987 + ACCESS_ONCE_RW(isight->buffer_pointer) = ptr;
76988
76989 isight->period_counter += count;
76990 if (isight->period_counter >= runtime->period_size) {
76991 @@ -308,7 +308,7 @@ static int isight_hw_params(struct snd_p
76992 if (err < 0)
76993 return err;
76994
76995 - ACCESS_ONCE(isight->pcm_active) = true;
76996 + ACCESS_ONCE_RW(isight->pcm_active) = true;
76997
76998 return 0;
76999 }
77000 @@ -341,7 +341,7 @@ static int isight_hw_free(struct snd_pcm
77001 {
77002 struct isight *isight = substream->private_data;
77003
77004 - ACCESS_ONCE(isight->pcm_active) = false;
77005 + ACCESS_ONCE_RW(isight->pcm_active) = false;
77006
77007 mutex_lock(&isight->mutex);
77008 isight_stop_streaming(isight);
77009 @@ -434,10 +434,10 @@ static int isight_trigger(struct snd_pcm
77010
77011 switch (cmd) {
77012 case SNDRV_PCM_TRIGGER_START:
77013 - ACCESS_ONCE(isight->pcm_running) = true;
77014 + ACCESS_ONCE_RW(isight->pcm_running) = true;
77015 break;
77016 case SNDRV_PCM_TRIGGER_STOP:
77017 - ACCESS_ONCE(isight->pcm_running) = false;
77018 + ACCESS_ONCE_RW(isight->pcm_running) = false;
77019 break;
77020 default:
77021 return -EINVAL;
77022 diff -urNp linux-3.0.9/sound/isa/cmi8330.c linux-3.0.9/sound/isa/cmi8330.c
77023 --- linux-3.0.9/sound/isa/cmi8330.c 2011-11-11 13:12:24.000000000 -0500
77024 +++ linux-3.0.9/sound/isa/cmi8330.c 2011-11-15 20:03:00.000000000 -0500
77025 @@ -172,7 +172,7 @@ struct snd_cmi8330 {
77026
77027 struct snd_pcm *pcm;
77028 struct snd_cmi8330_stream {
77029 - struct snd_pcm_ops ops;
77030 + snd_pcm_ops_no_const ops;
77031 snd_pcm_open_callback_t open;
77032 void *private_data; /* sb or wss */
77033 } streams[2];
77034 diff -urNp linux-3.0.9/sound/oss/sb_audio.c linux-3.0.9/sound/oss/sb_audio.c
77035 --- linux-3.0.9/sound/oss/sb_audio.c 2011-11-11 13:12:24.000000000 -0500
77036 +++ linux-3.0.9/sound/oss/sb_audio.c 2011-11-15 20:03:00.000000000 -0500
77037 @@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
77038 buf16 = (signed short *)(localbuf + localoffs);
77039 while (c)
77040 {
77041 - locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
77042 + locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
77043 if (copy_from_user(lbuf8,
77044 userbuf+useroffs + p,
77045 locallen))
77046 diff -urNp linux-3.0.9/sound/oss/swarm_cs4297a.c linux-3.0.9/sound/oss/swarm_cs4297a.c
77047 --- linux-3.0.9/sound/oss/swarm_cs4297a.c 2011-11-11 13:12:24.000000000 -0500
77048 +++ linux-3.0.9/sound/oss/swarm_cs4297a.c 2011-11-15 20:03:00.000000000 -0500
77049 @@ -2606,7 +2606,6 @@ static int __init cs4297a_init(void)
77050 {
77051 struct cs4297a_state *s;
77052 u32 pwr, id;
77053 - mm_segment_t fs;
77054 int rval;
77055 #ifndef CONFIG_BCM_CS4297A_CSWARM
77056 u64 cfg;
77057 @@ -2696,22 +2695,23 @@ static int __init cs4297a_init(void)
77058 if (!rval) {
77059 char *sb1250_duart_present;
77060
77061 +#if 0
77062 + mm_segment_t fs;
77063 fs = get_fs();
77064 set_fs(KERNEL_DS);
77065 -#if 0
77066 val = SOUND_MASK_LINE;
77067 mixer_ioctl(s, SOUND_MIXER_WRITE_RECSRC, (unsigned long) &val);
77068 for (i = 0; i < ARRAY_SIZE(initvol); i++) {
77069 val = initvol[i].vol;
77070 mixer_ioctl(s, initvol[i].mixch, (unsigned long) &val);
77071 }
77072 + set_fs(fs);
77073 // cs4297a_write_ac97(s, 0x18, 0x0808);
77074 #else
77075 // cs4297a_write_ac97(s, 0x5e, 0x180);
77076 cs4297a_write_ac97(s, 0x02, 0x0808);
77077 cs4297a_write_ac97(s, 0x18, 0x0808);
77078 #endif
77079 - set_fs(fs);
77080
77081 list_add(&s->list, &cs4297a_devs);
77082
77083 diff -urNp linux-3.0.9/sound/pci/hda/hda_codec.h linux-3.0.9/sound/pci/hda/hda_codec.h
77084 --- linux-3.0.9/sound/pci/hda/hda_codec.h 2011-11-11 13:12:24.000000000 -0500
77085 +++ linux-3.0.9/sound/pci/hda/hda_codec.h 2011-11-15 20:03:00.000000000 -0500
77086 @@ -615,7 +615,7 @@ struct hda_bus_ops {
77087 /* notify power-up/down from codec to controller */
77088 void (*pm_notify)(struct hda_bus *bus);
77089 #endif
77090 -};
77091 +} __no_const;
77092
77093 /* template to pass to the bus constructor */
77094 struct hda_bus_template {
77095 @@ -713,6 +713,7 @@ struct hda_codec_ops {
77096 #endif
77097 void (*reboot_notify)(struct hda_codec *codec);
77098 };
77099 +typedef struct hda_codec_ops __no_const hda_codec_ops_no_const;
77100
77101 /* record for amp information cache */
77102 struct hda_cache_head {
77103 @@ -743,7 +744,7 @@ struct hda_pcm_ops {
77104 struct snd_pcm_substream *substream);
77105 int (*cleanup)(struct hda_pcm_stream *info, struct hda_codec *codec,
77106 struct snd_pcm_substream *substream);
77107 -};
77108 +} __no_const;
77109
77110 /* PCM information for each substream */
77111 struct hda_pcm_stream {
77112 @@ -801,7 +802,7 @@ struct hda_codec {
77113 const char *modelname; /* model name for preset */
77114
77115 /* set by patch */
77116 - struct hda_codec_ops patch_ops;
77117 + hda_codec_ops_no_const patch_ops;
77118
77119 /* PCM to create, set by patch_ops.build_pcms callback */
77120 unsigned int num_pcms;
77121 diff -urNp linux-3.0.9/sound/pci/ice1712/ice1712.h linux-3.0.9/sound/pci/ice1712/ice1712.h
77122 --- linux-3.0.9/sound/pci/ice1712/ice1712.h 2011-11-11 13:12:24.000000000 -0500
77123 +++ linux-3.0.9/sound/pci/ice1712/ice1712.h 2011-11-15 20:03:00.000000000 -0500
77124 @@ -269,7 +269,7 @@ struct snd_ak4xxx_private {
77125 unsigned int mask_flags; /* total mask bits */
77126 struct snd_akm4xxx_ops {
77127 void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
77128 - } ops;
77129 + } __no_const ops;
77130 };
77131
77132 struct snd_ice1712_spdif {
77133 @@ -285,7 +285,7 @@ struct snd_ice1712_spdif {
77134 int (*default_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
77135 void (*stream_get)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
77136 int (*stream_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
77137 - } ops;
77138 + } __no_const ops;
77139 };
77140
77141
77142 diff -urNp linux-3.0.9/sound/pci/ymfpci/ymfpci_main.c linux-3.0.9/sound/pci/ymfpci/ymfpci_main.c
77143 --- linux-3.0.9/sound/pci/ymfpci/ymfpci_main.c 2011-11-11 13:12:24.000000000 -0500
77144 +++ linux-3.0.9/sound/pci/ymfpci/ymfpci_main.c 2011-11-15 20:03:00.000000000 -0500
77145 @@ -202,8 +202,8 @@ static void snd_ymfpci_hw_stop(struct sn
77146 if ((snd_ymfpci_readl(chip, YDSXGR_STATUS) & 2) == 0)
77147 break;
77148 }
77149 - if (atomic_read(&chip->interrupt_sleep_count)) {
77150 - atomic_set(&chip->interrupt_sleep_count, 0);
77151 + if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
77152 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
77153 wake_up(&chip->interrupt_sleep);
77154 }
77155 __end:
77156 @@ -787,7 +787,7 @@ static void snd_ymfpci_irq_wait(struct s
77157 continue;
77158 init_waitqueue_entry(&wait, current);
77159 add_wait_queue(&chip->interrupt_sleep, &wait);
77160 - atomic_inc(&chip->interrupt_sleep_count);
77161 + atomic_inc_unchecked(&chip->interrupt_sleep_count);
77162 schedule_timeout_uninterruptible(msecs_to_jiffies(50));
77163 remove_wait_queue(&chip->interrupt_sleep, &wait);
77164 }
77165 @@ -825,8 +825,8 @@ static irqreturn_t snd_ymfpci_interrupt(
77166 snd_ymfpci_writel(chip, YDSXGR_MODE, mode);
77167 spin_unlock(&chip->reg_lock);
77168
77169 - if (atomic_read(&chip->interrupt_sleep_count)) {
77170 - atomic_set(&chip->interrupt_sleep_count, 0);
77171 + if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
77172 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
77173 wake_up(&chip->interrupt_sleep);
77174 }
77175 }
77176 @@ -2363,7 +2363,7 @@ int __devinit snd_ymfpci_create(struct s
77177 spin_lock_init(&chip->reg_lock);
77178 spin_lock_init(&chip->voice_lock);
77179 init_waitqueue_head(&chip->interrupt_sleep);
77180 - atomic_set(&chip->interrupt_sleep_count, 0);
77181 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
77182 chip->card = card;
77183 chip->pci = pci;
77184 chip->irq = -1;
77185 diff -urNp linux-3.0.9/sound/soc/soc-core.c linux-3.0.9/sound/soc/soc-core.c
77186 --- linux-3.0.9/sound/soc/soc-core.c 2011-11-11 13:12:24.000000000 -0500
77187 +++ linux-3.0.9/sound/soc/soc-core.c 2011-11-15 20:03:00.000000000 -0500
77188 @@ -1021,7 +1021,7 @@ static snd_pcm_uframes_t soc_pcm_pointer
77189 }
77190
77191 /* ASoC PCM operations */
77192 -static struct snd_pcm_ops soc_pcm_ops = {
77193 +static snd_pcm_ops_no_const soc_pcm_ops = {
77194 .open = soc_pcm_open,
77195 .close = soc_codec_close,
77196 .hw_params = soc_pcm_hw_params,
77197 @@ -2128,6 +2128,7 @@ static int soc_new_pcm(struct snd_soc_pc
77198 rtd->pcm = pcm;
77199 pcm->private_data = rtd;
77200 if (platform->driver->ops) {
77201 + /* this whole logic is broken... */
77202 soc_pcm_ops.mmap = platform->driver->ops->mmap;
77203 soc_pcm_ops.pointer = platform->driver->ops->pointer;
77204 soc_pcm_ops.ioctl = platform->driver->ops->ioctl;
77205 diff -urNp linux-3.0.9/sound/usb/card.h linux-3.0.9/sound/usb/card.h
77206 --- linux-3.0.9/sound/usb/card.h 2011-11-11 13:12:24.000000000 -0500
77207 +++ linux-3.0.9/sound/usb/card.h 2011-11-15 20:03:00.000000000 -0500
77208 @@ -44,6 +44,7 @@ struct snd_urb_ops {
77209 int (*prepare_sync)(struct snd_usb_substream *subs, struct snd_pcm_runtime *runtime, struct urb *u);
77210 int (*retire_sync)(struct snd_usb_substream *subs, struct snd_pcm_runtime *runtime, struct urb *u);
77211 };
77212 +typedef struct snd_urb_ops __no_const snd_urb_ops_no_const;
77213
77214 struct snd_usb_substream {
77215 struct snd_usb_stream *stream;
77216 @@ -93,7 +94,7 @@ struct snd_usb_substream {
77217 struct snd_pcm_hw_constraint_list rate_list; /* limited rates */
77218 spinlock_t lock;
77219
77220 - struct snd_urb_ops ops; /* callbacks (must be filled at init) */
77221 + snd_urb_ops_no_const ops; /* callbacks (must be filled at init) */
77222 };
77223
77224 struct snd_usb_stream {
77225 diff -urNp linux-3.0.9/tools/gcc/checker_plugin.c linux-3.0.9/tools/gcc/checker_plugin.c
77226 --- linux-3.0.9/tools/gcc/checker_plugin.c 1969-12-31 19:00:00.000000000 -0500
77227 +++ linux-3.0.9/tools/gcc/checker_plugin.c 2011-11-15 20:03:00.000000000 -0500
77228 @@ -0,0 +1,169 @@
77229 +/*
77230 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
77231 + * Licensed under the GPL v2
77232 + *
77233 + * Note: the choice of the license means that the compilation process is
77234 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
77235 + * but for the kernel it doesn't matter since it doesn't link against
77236 + * any of the gcc libraries
77237 + *
77238 + * gcc plugin to implement various sparse (source code checker) features
77239 + *
77240 + * TODO:
77241 + * - define separate __iomem, __percpu and __rcu address spaces (lots of code to patch)
77242 + *
77243 + * BUGS:
77244 + * - none known
77245 + */
77246 +#include "gcc-plugin.h"
77247 +#include "config.h"
77248 +#include "system.h"
77249 +#include "coretypes.h"
77250 +#include "tree.h"
77251 +#include "tree-pass.h"
77252 +#include "intl.h"
77253 +#include "plugin-version.h"
77254 +#include "tm.h"
77255 +#include "toplev.h"
77256 +#include "basic-block.h"
77257 +#include "gimple.h"
77258 +//#include "expr.h" where are you...
77259 +#include "diagnostic.h"
77260 +#include "rtl.h"
77261 +#include "emit-rtl.h"
77262 +#include "function.h"
77263 +#include "tree-flow.h"
77264 +#include "target.h"
77265 +
77266 +extern void c_register_addr_space (const char *str, addr_space_t as);
77267 +extern enum machine_mode default_addr_space_pointer_mode (addr_space_t);
77268 +extern enum machine_mode default_addr_space_address_mode (addr_space_t);
77269 +extern bool default_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as);
77270 +extern bool default_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as);
77271 +extern rtx default_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as);
77272 +
77273 +extern void print_gimple_stmt(FILE *, gimple, int, int);
77274 +extern rtx emit_move_insn(rtx x, rtx y);
77275 +
77276 +int plugin_is_GPL_compatible;
77277 +
77278 +static struct plugin_info checker_plugin_info = {
77279 + .version = "201110031940",
77280 +};
77281 +
77282 +#define ADDR_SPACE_KERNEL 0
77283 +#define ADDR_SPACE_FORCE_KERNEL 1
77284 +#define ADDR_SPACE_USER 2
77285 +#define ADDR_SPACE_FORCE_USER 3
77286 +#define ADDR_SPACE_IOMEM 0
77287 +#define ADDR_SPACE_FORCE_IOMEM 0
77288 +#define ADDR_SPACE_PERCPU 0
77289 +#define ADDR_SPACE_FORCE_PERCPU 0
77290 +#define ADDR_SPACE_RCU 0
77291 +#define ADDR_SPACE_FORCE_RCU 0
77292 +
77293 +static enum machine_mode checker_addr_space_pointer_mode(addr_space_t addrspace)
77294 +{
77295 + return default_addr_space_pointer_mode(ADDR_SPACE_GENERIC);
77296 +}
77297 +
77298 +static enum machine_mode checker_addr_space_address_mode(addr_space_t addrspace)
77299 +{
77300 + return default_addr_space_address_mode(ADDR_SPACE_GENERIC);
77301 +}
77302 +
77303 +static bool checker_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as)
77304 +{
77305 + return default_addr_space_valid_pointer_mode(mode, as);
77306 +}
77307 +
77308 +static bool checker_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as)
77309 +{
77310 + return default_addr_space_legitimate_address_p(mode, mem, strict, ADDR_SPACE_GENERIC);
77311 +}
77312 +
77313 +static rtx checker_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as)
77314 +{
77315 + return default_addr_space_legitimize_address(x, oldx, mode, as);
77316 +}
77317 +
77318 +static bool checker_addr_space_subset_p(addr_space_t subset, addr_space_t superset)
77319 +{
77320 + if (subset == ADDR_SPACE_FORCE_KERNEL && superset == ADDR_SPACE_KERNEL)
77321 + return true;
77322 +
77323 + if (subset == ADDR_SPACE_FORCE_USER && superset == ADDR_SPACE_USER)
77324 + return true;
77325 +
77326 + if (subset == ADDR_SPACE_FORCE_IOMEM && superset == ADDR_SPACE_IOMEM)
77327 + return true;
77328 +
77329 + if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_USER)
77330 + return true;
77331 +
77332 + if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_IOMEM)
77333 + return true;
77334 +
77335 + if (subset == ADDR_SPACE_USER && superset == ADDR_SPACE_FORCE_KERNEL)
77336 + return true;
77337 +
77338 + if (subset == ADDR_SPACE_IOMEM && superset == ADDR_SPACE_FORCE_KERNEL)
77339 + return true;
77340 +
77341 + return subset == superset;
77342 +}
77343 +
77344 +static rtx checker_addr_space_convert(rtx op, tree from_type, tree to_type)
77345 +{
77346 +// addr_space_t from_as = TYPE_ADDR_SPACE(TREE_TYPE(from_type));
77347 +// addr_space_t to_as = TYPE_ADDR_SPACE(TREE_TYPE(to_type));
77348 +
77349 + return op;
77350 +}
77351 +
77352 +static void register_checker_address_spaces(void *event_data, void *data)
77353 +{
77354 + c_register_addr_space("__kernel", ADDR_SPACE_KERNEL);
77355 + c_register_addr_space("__force_kernel", ADDR_SPACE_FORCE_KERNEL);
77356 + c_register_addr_space("__user", ADDR_SPACE_USER);
77357 + c_register_addr_space("__force_user", ADDR_SPACE_FORCE_USER);
77358 +// c_register_addr_space("__iomem", ADDR_SPACE_IOMEM);
77359 +// c_register_addr_space("__force_iomem", ADDR_SPACE_FORCE_IOMEM);
77360 +// c_register_addr_space("__percpu", ADDR_SPACE_PERCPU);
77361 +// c_register_addr_space("__force_percpu", ADDR_SPACE_FORCE_PERCPU);
77362 +// c_register_addr_space("__rcu", ADDR_SPACE_RCU);
77363 +// c_register_addr_space("__force_rcu", ADDR_SPACE_FORCE_RCU);
77364 +
77365 + targetm.addr_space.pointer_mode = checker_addr_space_pointer_mode;
77366 + targetm.addr_space.address_mode = checker_addr_space_address_mode;
77367 + targetm.addr_space.valid_pointer_mode = checker_addr_space_valid_pointer_mode;
77368 + targetm.addr_space.legitimate_address_p = checker_addr_space_legitimate_address_p;
77369 +// targetm.addr_space.legitimize_address = checker_addr_space_legitimize_address;
77370 + targetm.addr_space.subset_p = checker_addr_space_subset_p;
77371 + targetm.addr_space.convert = checker_addr_space_convert;
77372 +}
77373 +
77374 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
77375 +{
77376 + const char * const plugin_name = plugin_info->base_name;
77377 + const int argc = plugin_info->argc;
77378 + const struct plugin_argument * const argv = plugin_info->argv;
77379 + int i;
77380 +
77381 + if (!plugin_default_version_check(version, &gcc_version)) {
77382 + error(G_("incompatible gcc/plugin versions"));
77383 + return 1;
77384 + }
77385 +
77386 + register_callback(plugin_name, PLUGIN_INFO, NULL, &checker_plugin_info);
77387 +
77388 + for (i = 0; i < argc; ++i)
77389 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
77390 +
77391 + if (TARGET_64BIT == 0)
77392 + return 0;
77393 +
77394 + register_callback (plugin_name, PLUGIN_PRAGMAS, register_checker_address_spaces, NULL);
77395 +
77396 + return 0;
77397 +}
77398 diff -urNp linux-3.0.9/tools/gcc/constify_plugin.c linux-3.0.9/tools/gcc/constify_plugin.c
77399 --- linux-3.0.9/tools/gcc/constify_plugin.c 1969-12-31 19:00:00.000000000 -0500
77400 +++ linux-3.0.9/tools/gcc/constify_plugin.c 2011-11-15 20:03:00.000000000 -0500
77401 @@ -0,0 +1,293 @@
77402 +/*
77403 + * Copyright 2011 by Emese Revfy <re.emese@gmail.com>
77404 + * Copyright 2011 by PaX Team <pageexec@freemail.hu>
77405 + * Licensed under the GPL v2, or (at your option) v3
77406 + *
77407 + * This gcc plugin constifies all structures which contain only function pointers or are explicitly marked for constification.
77408 + *
77409 + * Homepage:
77410 + * http://www.grsecurity.net/~ephox/const_plugin/
77411 + *
77412 + * Usage:
77413 + * $ gcc -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -o constify_plugin.so constify_plugin.c
77414 + * $ gcc -fplugin=constify_plugin.so test.c -O2
77415 + */
77416 +
77417 +#include "gcc-plugin.h"
77418 +#include "config.h"
77419 +#include "system.h"
77420 +#include "coretypes.h"
77421 +#include "tree.h"
77422 +#include "tree-pass.h"
77423 +#include "intl.h"
77424 +#include "plugin-version.h"
77425 +#include "tm.h"
77426 +#include "toplev.h"
77427 +#include "function.h"
77428 +#include "tree-flow.h"
77429 +#include "plugin.h"
77430 +#include "diagnostic.h"
77431 +//#include "c-tree.h"
77432 +
77433 +#define C_TYPE_FIELDS_READONLY(TYPE) TREE_LANG_FLAG_1(TYPE)
77434 +
77435 +int plugin_is_GPL_compatible;
77436 +
77437 +static struct plugin_info const_plugin_info = {
77438 + .version = "20110826",
77439 + .help = "no-constify\tturn off constification\n",
77440 +};
77441 +
77442 +static void constify_type(tree type);
77443 +static bool walk_struct(tree node);
77444 +
77445 +static tree deconstify_type(tree old_type)
77446 +{
77447 + tree new_type, field;
77448 +
77449 + new_type = build_qualified_type(old_type, TYPE_QUALS(old_type) & ~TYPE_QUAL_CONST);
77450 + TYPE_FIELDS(new_type) = copy_list(TYPE_FIELDS(new_type));
77451 + for (field = TYPE_FIELDS(new_type); field; field = TREE_CHAIN(field))
77452 + DECL_FIELD_CONTEXT(field) = new_type;
77453 + TYPE_READONLY(new_type) = 0;
77454 + C_TYPE_FIELDS_READONLY(new_type) = 0;
77455 + return new_type;
77456 +}
77457 +
77458 +static tree handle_no_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
77459 +{
77460 + tree type;
77461 +
77462 + *no_add_attrs = true;
77463 + if (TREE_CODE(*node) == FUNCTION_DECL) {
77464 + error("%qE attribute does not apply to functions", name);
77465 + return NULL_TREE;
77466 + }
77467 +
77468 + if (TREE_CODE(*node) == VAR_DECL) {
77469 + error("%qE attribute does not apply to variables", name);
77470 + return NULL_TREE;
77471 + }
77472 +
77473 + if (TYPE_P(*node)) {
77474 + if (TREE_CODE(*node) == RECORD_TYPE || TREE_CODE(*node) == UNION_TYPE)
77475 + *no_add_attrs = false;
77476 + else
77477 + error("%qE attribute applies to struct and union types only", name);
77478 + return NULL_TREE;
77479 + }
77480 +
77481 + type = TREE_TYPE(*node);
77482 +
77483 + if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE) {
77484 + error("%qE attribute applies to struct and union types only", name);
77485 + return NULL_TREE;
77486 + }
77487 +
77488 + if (lookup_attribute(IDENTIFIER_POINTER(name), TYPE_ATTRIBUTES(type))) {
77489 + error("%qE attribute is already applied to the type", name);
77490 + return NULL_TREE;
77491 + }
77492 +
77493 + if (TREE_CODE(*node) == TYPE_DECL && !TYPE_READONLY(type)) {
77494 + error("%qE attribute used on type that is not constified", name);
77495 + return NULL_TREE;
77496 + }
77497 +
77498 + if (TREE_CODE(*node) == TYPE_DECL) {
77499 + TREE_TYPE(*node) = deconstify_type(type);
77500 + TREE_READONLY(*node) = 0;
77501 + return NULL_TREE;
77502 + }
77503 +
77504 + return NULL_TREE;
77505 +}
77506 +
77507 +static tree handle_do_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
77508 +{
77509 + *no_add_attrs = true;
77510 + if (!TYPE_P(*node)) {
77511 + error("%qE attribute applies to types only", name);
77512 + return NULL_TREE;
77513 + }
77514 +
77515 + if (TREE_CODE(*node) != RECORD_TYPE && TREE_CODE(*node) != UNION_TYPE) {
77516 + error("%qE attribute applies to struct and union types only", name);
77517 + return NULL_TREE;
77518 + }
77519 +
77520 + *no_add_attrs = false;
77521 + constify_type(*node);
77522 + return NULL_TREE;
77523 +}
77524 +
77525 +static struct attribute_spec no_const_attr = {
77526 + .name = "no_const",
77527 + .min_length = 0,
77528 + .max_length = 0,
77529 + .decl_required = false,
77530 + .type_required = false,
77531 + .function_type_required = false,
77532 + .handler = handle_no_const_attribute
77533 +};
77534 +
77535 +static struct attribute_spec do_const_attr = {
77536 + .name = "do_const",
77537 + .min_length = 0,
77538 + .max_length = 0,
77539 + .decl_required = false,
77540 + .type_required = false,
77541 + .function_type_required = false,
77542 + .handler = handle_do_const_attribute
77543 +};
77544 +
77545 +static void register_attributes(void *event_data, void *data)
77546 +{
77547 + register_attribute(&no_const_attr);
77548 + register_attribute(&do_const_attr);
77549 +}
77550 +
77551 +static void constify_type(tree type)
77552 +{
77553 + TYPE_READONLY(type) = 1;
77554 + C_TYPE_FIELDS_READONLY(type) = 1;
77555 +}
77556 +
77557 +static bool is_fptr(tree field)
77558 +{
77559 + tree ptr = TREE_TYPE(field);
77560 +
77561 + if (TREE_CODE(ptr) != POINTER_TYPE)
77562 + return false;
77563 +
77564 + return TREE_CODE(TREE_TYPE(ptr)) == FUNCTION_TYPE;
77565 +}
77566 +
77567 +static bool walk_struct(tree node)
77568 +{
77569 + tree field;
77570 +
77571 + if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node)))
77572 + return false;
77573 +
77574 + if (TYPE_FIELDS(node) == NULL_TREE)
77575 + return false;
77576 +
77577 + for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
77578 + tree type = TREE_TYPE(field);
77579 + enum tree_code code = TREE_CODE(type);
77580 + if (code == RECORD_TYPE || code == UNION_TYPE) {
77581 + if (!(walk_struct(type)))
77582 + return false;
77583 + } else if (!is_fptr(field) && !TREE_READONLY(field))
77584 + return false;
77585 + }
77586 + return true;
77587 +}
77588 +
77589 +static void finish_type(void *event_data, void *data)
77590 +{
77591 + tree type = (tree)event_data;
77592 +
77593 + if (type == NULL_TREE)
77594 + return;
77595 +
77596 + if (TYPE_READONLY(type))
77597 + return;
77598 +
77599 + if (walk_struct(type))
77600 + constify_type(type);
77601 +}
77602 +
77603 +static unsigned int check_local_variables(void);
77604 +
77605 +struct gimple_opt_pass pass_local_variable = {
77606 + {
77607 + .type = GIMPLE_PASS,
77608 + .name = "check_local_variables",
77609 + .gate = NULL,
77610 + .execute = check_local_variables,
77611 + .sub = NULL,
77612 + .next = NULL,
77613 + .static_pass_number = 0,
77614 + .tv_id = TV_NONE,
77615 + .properties_required = 0,
77616 + .properties_provided = 0,
77617 + .properties_destroyed = 0,
77618 + .todo_flags_start = 0,
77619 + .todo_flags_finish = 0
77620 + }
77621 +};
77622 +
77623 +static unsigned int check_local_variables(void)
77624 +{
77625 + tree var;
77626 + referenced_var_iterator rvi;
77627 +
77628 +#if __GNUC__ == 4 && __GNUC_MINOR__ == 5
77629 + FOR_EACH_REFERENCED_VAR(var, rvi) {
77630 +#else
77631 + FOR_EACH_REFERENCED_VAR(cfun, var, rvi) {
77632 +#endif
77633 + tree type = TREE_TYPE(var);
77634 +
77635 + if (!DECL_P(var) || TREE_STATIC(var) || DECL_EXTERNAL(var))
77636 + continue;
77637 +
77638 + if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
77639 + continue;
77640 +
77641 + if (!TYPE_READONLY(type))
77642 + continue;
77643 +
77644 +// if (lookup_attribute("no_const", DECL_ATTRIBUTES(var)))
77645 +// continue;
77646 +
77647 +// if (lookup_attribute("no_const", TYPE_ATTRIBUTES(type)))
77648 +// continue;
77649 +
77650 + if (walk_struct(type)) {
77651 + error("constified variable %qE cannot be local", var);
77652 + return 1;
77653 + }
77654 + }
77655 + return 0;
77656 +}
77657 +
77658 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
77659 +{
77660 + const char * const plugin_name = plugin_info->base_name;
77661 + const int argc = plugin_info->argc;
77662 + const struct plugin_argument * const argv = plugin_info->argv;
77663 + int i;
77664 + bool constify = true;
77665 +
77666 + struct register_pass_info local_variable_pass_info = {
77667 + .pass = &pass_local_variable.pass,
77668 + .reference_pass_name = "*referenced_vars",
77669 + .ref_pass_instance_number = 0,
77670 + .pos_op = PASS_POS_INSERT_AFTER
77671 + };
77672 +
77673 + if (!plugin_default_version_check(version, &gcc_version)) {
77674 + error(G_("incompatible gcc/plugin versions"));
77675 + return 1;
77676 + }
77677 +
77678 + for (i = 0; i < argc; ++i) {
77679 + if (!(strcmp(argv[i].key, "no-constify"))) {
77680 + constify = false;
77681 + continue;
77682 + }
77683 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
77684 + }
77685 +
77686 + register_callback(plugin_name, PLUGIN_INFO, NULL, &const_plugin_info);
77687 + if (constify) {
77688 + register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
77689 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &local_variable_pass_info);
77690 + }
77691 + register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
77692 +
77693 + return 0;
77694 +}
77695 diff -urNp linux-3.0.9/tools/gcc/kallocstat_plugin.c linux-3.0.9/tools/gcc/kallocstat_plugin.c
77696 --- linux-3.0.9/tools/gcc/kallocstat_plugin.c 1969-12-31 19:00:00.000000000 -0500
77697 +++ linux-3.0.9/tools/gcc/kallocstat_plugin.c 2011-11-15 20:03:00.000000000 -0500
77698 @@ -0,0 +1,165 @@
77699 +/*
77700 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
77701 + * Licensed under the GPL v2
77702 + *
77703 + * Note: the choice of the license means that the compilation process is
77704 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
77705 + * but for the kernel it doesn't matter since it doesn't link against
77706 + * any of the gcc libraries
77707 + *
77708 + * gcc plugin to find the distribution of k*alloc sizes
77709 + *
77710 + * TODO:
77711 + *
77712 + * BUGS:
77713 + * - none known
77714 + */
77715 +#include "gcc-plugin.h"
77716 +#include "config.h"
77717 +#include "system.h"
77718 +#include "coretypes.h"
77719 +#include "tree.h"
77720 +#include "tree-pass.h"
77721 +#include "intl.h"
77722 +#include "plugin-version.h"
77723 +#include "tm.h"
77724 +#include "toplev.h"
77725 +#include "basic-block.h"
77726 +#include "gimple.h"
77727 +//#include "expr.h" where are you...
77728 +#include "diagnostic.h"
77729 +#include "rtl.h"
77730 +#include "emit-rtl.h"
77731 +#include "function.h"
77732 +
77733 +extern void print_gimple_stmt(FILE *, gimple, int, int);
77734 +
77735 +int plugin_is_GPL_compatible;
77736 +
77737 +static const char * const kalloc_functions[] = {
77738 + "__kmalloc",
77739 + "kmalloc",
77740 + "kmalloc_large",
77741 + "kmalloc_node",
77742 + "kmalloc_order",
77743 + "kmalloc_order_trace",
77744 + "kmalloc_slab",
77745 + "kzalloc",
77746 + "kzalloc_node",
77747 +};
77748 +
77749 +static struct plugin_info kallocstat_plugin_info = {
77750 + .version = "201109121100",
77751 +};
77752 +
77753 +static unsigned int execute_kallocstat(void);
77754 +
77755 +static struct gimple_opt_pass kallocstat_pass = {
77756 + .pass = {
77757 + .type = GIMPLE_PASS,
77758 + .name = "kallocstat",
77759 + .gate = NULL,
77760 + .execute = execute_kallocstat,
77761 + .sub = NULL,
77762 + .next = NULL,
77763 + .static_pass_number = 0,
77764 + .tv_id = TV_NONE,
77765 + .properties_required = 0,
77766 + .properties_provided = 0,
77767 + .properties_destroyed = 0,
77768 + .todo_flags_start = 0,
77769 + .todo_flags_finish = 0
77770 + }
77771 +};
77772 +
77773 +static bool is_kalloc(const char *fnname)
77774 +{
77775 + size_t i;
77776 +
77777 + for (i = 0; i < ARRAY_SIZE(kalloc_functions); i++)
77778 + if (!strcmp(fnname, kalloc_functions[i]))
77779 + return true;
77780 + return false;
77781 +}
77782 +
77783 +static unsigned int execute_kallocstat(void)
77784 +{
77785 + basic_block bb;
77786 +
77787 + // 1. loop through BBs and GIMPLE statements
77788 + FOR_EACH_BB(bb) {
77789 + gimple_stmt_iterator gsi;
77790 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
77791 + // gimple match:
77792 + tree fndecl, size;
77793 + gimple call_stmt;
77794 + const char *fnname;
77795 +
77796 + // is it a call
77797 + call_stmt = gsi_stmt(gsi);
77798 + if (!is_gimple_call(call_stmt))
77799 + continue;
77800 + fndecl = gimple_call_fndecl(call_stmt);
77801 + if (fndecl == NULL_TREE)
77802 + continue;
77803 + if (TREE_CODE(fndecl) != FUNCTION_DECL)
77804 + continue;
77805 +
77806 + // is it a call to k*alloc
77807 + fnname = IDENTIFIER_POINTER(DECL_NAME(fndecl));
77808 + if (!is_kalloc(fnname))
77809 + continue;
77810 +
77811 + // is the size arg the result of a simple const assignment
77812 + size = gimple_call_arg(call_stmt, 0);
77813 + while (true) {
77814 + gimple def_stmt;
77815 + expanded_location xloc;
77816 + size_t size_val;
77817 +
77818 + if (TREE_CODE(size) != SSA_NAME)
77819 + break;
77820 + def_stmt = SSA_NAME_DEF_STMT(size);
77821 + if (!def_stmt || !is_gimple_assign(def_stmt))
77822 + break;
77823 + if (gimple_num_ops(def_stmt) != 2)
77824 + break;
77825 + size = gimple_assign_rhs1(def_stmt);
77826 + if (!TREE_CONSTANT(size))
77827 + continue;
77828 + xloc = expand_location(gimple_location(def_stmt));
77829 + if (!xloc.file)
77830 + xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl));
77831 + size_val = TREE_INT_CST_LOW(size);
77832 + fprintf(stderr, "kallocsize: %8zu %8zx %s %s:%u\n", size_val, size_val, fnname, xloc.file, xloc.line);
77833 + break;
77834 + }
77835 +//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
77836 +//debug_tree(gimple_call_fn(call_stmt));
77837 +//print_node(stderr, "pax", fndecl, 4);
77838 + }
77839 + }
77840 +
77841 + return 0;
77842 +}
77843 +
77844 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
77845 +{
77846 + const char * const plugin_name = plugin_info->base_name;
77847 + struct register_pass_info kallocstat_pass_info = {
77848 + .pass = &kallocstat_pass.pass,
77849 + .reference_pass_name = "ssa",
77850 + .ref_pass_instance_number = 0,
77851 + .pos_op = PASS_POS_INSERT_AFTER
77852 + };
77853 +
77854 + if (!plugin_default_version_check(version, &gcc_version)) {
77855 + error(G_("incompatible gcc/plugin versions"));
77856 + return 1;
77857 + }
77858 +
77859 + register_callback(plugin_name, PLUGIN_INFO, NULL, &kallocstat_plugin_info);
77860 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kallocstat_pass_info);
77861 +
77862 + return 0;
77863 +}
77864 diff -urNp linux-3.0.9/tools/gcc/kernexec_plugin.c linux-3.0.9/tools/gcc/kernexec_plugin.c
77865 --- linux-3.0.9/tools/gcc/kernexec_plugin.c 1969-12-31 19:00:00.000000000 -0500
77866 +++ linux-3.0.9/tools/gcc/kernexec_plugin.c 2011-11-15 20:03:00.000000000 -0500
77867 @@ -0,0 +1,273 @@
77868 +/*
77869 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
77870 + * Licensed under the GPL v2
77871 + *
77872 + * Note: the choice of the license means that the compilation process is
77873 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
77874 + * but for the kernel it doesn't matter since it doesn't link against
77875 + * any of the gcc libraries
77876 + *
77877 + * gcc plugin to make KERNEXEC/amd64 almost as good as it is on i386
77878 + *
77879 + * TODO:
77880 + *
77881 + * BUGS:
77882 + * - none known
77883 + */
77884 +#include "gcc-plugin.h"
77885 +#include "config.h"
77886 +#include "system.h"
77887 +#include "coretypes.h"
77888 +#include "tree.h"
77889 +#include "tree-pass.h"
77890 +#include "intl.h"
77891 +#include "plugin-version.h"
77892 +#include "tm.h"
77893 +#include "toplev.h"
77894 +#include "basic-block.h"
77895 +#include "gimple.h"
77896 +//#include "expr.h" where are you...
77897 +#include "diagnostic.h"
77898 +#include "rtl.h"
77899 +#include "emit-rtl.h"
77900 +#include "function.h"
77901 +#include "tree-flow.h"
77902 +
77903 +extern void print_gimple_stmt(FILE *, gimple, int, int);
77904 +extern rtx emit_move_insn(rtx x, rtx y);
77905 +
77906 +int plugin_is_GPL_compatible;
77907 +
77908 +static struct plugin_info kernexec_plugin_info = {
77909 + .version = "201110032145",
77910 +};
77911 +
77912 +static unsigned int execute_kernexec_fptr(void);
77913 +static unsigned int execute_kernexec_retaddr(void);
77914 +static bool kernexec_cmodel_check(void);
77915 +
77916 +static struct gimple_opt_pass kernexec_fptr_pass = {
77917 + .pass = {
77918 + .type = GIMPLE_PASS,
77919 + .name = "kernexec_fptr",
77920 + .gate = kernexec_cmodel_check,
77921 + .execute = execute_kernexec_fptr,
77922 + .sub = NULL,
77923 + .next = NULL,
77924 + .static_pass_number = 0,
77925 + .tv_id = TV_NONE,
77926 + .properties_required = 0,
77927 + .properties_provided = 0,
77928 + .properties_destroyed = 0,
77929 + .todo_flags_start = 0,
77930 + .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi
77931 + }
77932 +};
77933 +
77934 +static struct rtl_opt_pass kernexec_retaddr_pass = {
77935 + .pass = {
77936 + .type = RTL_PASS,
77937 + .name = "kernexec_retaddr",
77938 + .gate = kernexec_cmodel_check,
77939 + .execute = execute_kernexec_retaddr,
77940 + .sub = NULL,
77941 + .next = NULL,
77942 + .static_pass_number = 0,
77943 + .tv_id = TV_NONE,
77944 + .properties_required = 0,
77945 + .properties_provided = 0,
77946 + .properties_destroyed = 0,
77947 + .todo_flags_start = 0,
77948 + .todo_flags_finish = TODO_dump_func | TODO_ggc_collect
77949 + }
77950 +};
77951 +
77952 +static bool kernexec_cmodel_check(void)
77953 +{
77954 + tree section;
77955 +
77956 + if (ix86_cmodel != CM_KERNEL)
77957 + return false;
77958 +
77959 + section = lookup_attribute("__section__", DECL_ATTRIBUTES(current_function_decl));
77960 + if (!section || !TREE_VALUE(section))
77961 + return true;
77962 +
77963 + section = TREE_VALUE(TREE_VALUE(section));
77964 + if (strncmp(TREE_STRING_POINTER(section), ".vsyscall_", 10))
77965 + return true;
77966 +
77967 + return false;
77968 +}
77969 +
77970 +/*
77971 + * add special KERNEXEC instrumentation: force MSB of fptr to 1, which will produce
77972 + * a non-canonical address from a userland ptr and will just trigger a GPF on dereference
77973 + */
77974 +static void kernexec_instrument_fptr(gimple_stmt_iterator gsi)
77975 +{
77976 + gimple assign_intptr, assign_new_fptr, call_stmt;
77977 + tree intptr, old_fptr, new_fptr, kernexec_mask;
77978 +
77979 + call_stmt = gsi_stmt(gsi);
77980 + old_fptr = gimple_call_fn(call_stmt);
77981 +
77982 + // create temporary unsigned long variable used for bitops and cast fptr to it
77983 + intptr = create_tmp_var(long_unsigned_type_node, NULL);
77984 + add_referenced_var(intptr);
77985 + mark_sym_for_renaming(intptr);
77986 + assign_intptr = gimple_build_assign(intptr, fold_convert(long_unsigned_type_node, old_fptr));
77987 + update_stmt(assign_intptr);
77988 + gsi_insert_before(&gsi, assign_intptr, GSI_SAME_STMT);
77989 +
77990 + // apply logical or to temporary unsigned long and bitmask
77991 + kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0x8000000000000000LL);
77992 +// kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0xffffffff80000000LL);
77993 + assign_intptr = gimple_build_assign(intptr, fold_build2(BIT_IOR_EXPR, long_long_unsigned_type_node, intptr, kernexec_mask));
77994 + update_stmt(assign_intptr);
77995 + gsi_insert_before(&gsi, assign_intptr, GSI_SAME_STMT);
77996 +
77997 + // cast temporary unsigned long back to a temporary fptr variable
77998 + new_fptr = create_tmp_var(TREE_TYPE(old_fptr), NULL);
77999 + add_referenced_var(new_fptr);
78000 + mark_sym_for_renaming(new_fptr);
78001 + assign_new_fptr = gimple_build_assign(new_fptr, fold_convert(TREE_TYPE(old_fptr), intptr));
78002 + update_stmt(assign_new_fptr);
78003 + gsi_insert_before(&gsi, assign_new_fptr, GSI_SAME_STMT);
78004 +
78005 + // replace call stmt fn with the new fptr
78006 + gimple_call_set_fn(call_stmt, new_fptr);
78007 + update_stmt(call_stmt);
78008 +}
78009 +
78010 +/*
78011 + * find all C level function pointer dereferences and forcibly set the highest bit of the pointer
78012 + */
78013 +static unsigned int execute_kernexec_fptr(void)
78014 +{
78015 + basic_block bb;
78016 + gimple_stmt_iterator gsi;
78017 +
78018 + // 1. loop through BBs and GIMPLE statements
78019 + FOR_EACH_BB(bb) {
78020 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
78021 + // gimple match: h_1 = get_fptr (); D.2709_3 = h_1 (x_2(D));
78022 + tree fn;
78023 + gimple call_stmt;
78024 +
78025 + // is it a call ...
78026 + call_stmt = gsi_stmt(gsi);
78027 + if (!is_gimple_call(call_stmt))
78028 + continue;
78029 + fn = gimple_call_fn(call_stmt);
78030 + if (TREE_CODE(fn) == ADDR_EXPR)
78031 + continue;
78032 + if (TREE_CODE(fn) != SSA_NAME)
78033 + gcc_unreachable();
78034 +
78035 + // ... through a function pointer
78036 + fn = SSA_NAME_VAR(fn);
78037 + if (TREE_CODE(fn) != VAR_DECL && TREE_CODE(fn) != PARM_DECL)
78038 + continue;
78039 + fn = TREE_TYPE(fn);
78040 + if (TREE_CODE(fn) != POINTER_TYPE)
78041 + continue;
78042 + fn = TREE_TYPE(fn);
78043 + if (TREE_CODE(fn) != FUNCTION_TYPE)
78044 + continue;
78045 +
78046 + kernexec_instrument_fptr(gsi);
78047 +
78048 +//debug_tree(gimple_call_fn(call_stmt));
78049 +//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
78050 + }
78051 + }
78052 +
78053 + return 0;
78054 +}
78055 +
78056 +// add special KERNEXEC instrumentation: btsq $63,(%rsp) just before retn
78057 +static void kernexec_instrument_retaddr(rtx insn)
78058 +{
78059 + rtx btsq;
78060 + rtvec argvec, constraintvec, labelvec;
78061 + int line;
78062 +
78063 + // create asm volatile("btsq $63,(%%rsp)":::)
78064 + argvec = rtvec_alloc(0);
78065 + constraintvec = rtvec_alloc(0);
78066 + labelvec = rtvec_alloc(0);
78067 + line = expand_location(RTL_LOCATION(insn)).line;
78068 + btsq = gen_rtx_ASM_OPERANDS(VOIDmode, "btsq $63,(%%rsp)", empty_string, 0, argvec, constraintvec, labelvec, line);
78069 + MEM_VOLATILE_P(btsq) = 1;
78070 + RTX_FRAME_RELATED_P(btsq) = 1;
78071 + emit_insn_before(btsq, insn);
78072 +}
78073 +
78074 +/*
78075 + * find all asm level function returns and forcibly set the highest bit of the return address
78076 + */
78077 +static unsigned int execute_kernexec_retaddr(void)
78078 +{
78079 + rtx insn;
78080 +
78081 + // 1. find function returns
78082 + for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
78083 + // rtl match: (jump_insn 41 40 42 2 (return) fptr.c:42 634 {return_internal} (nil))
78084 + // (jump_insn 12 9 11 2 (parallel [ (return) (unspec [ (0) ] UNSPEC_REP) ]) fptr.c:46 635 {return_internal_long} (nil))
78085 + rtx body;
78086 +
78087 + // is it a retn
78088 + if (!JUMP_P(insn))
78089 + continue;
78090 + body = PATTERN(insn);
78091 + if (GET_CODE(body) == PARALLEL)
78092 + body = XVECEXP(body, 0, 0);
78093 + if (GET_CODE(body) != RETURN)
78094 + continue;
78095 + kernexec_instrument_retaddr(insn);
78096 + }
78097 +
78098 +// print_simple_rtl(stderr, get_insns());
78099 +// print_rtl(stderr, get_insns());
78100 +
78101 + return 0;
78102 +}
78103 +
78104 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
78105 +{
78106 + const char * const plugin_name = plugin_info->base_name;
78107 + const int argc = plugin_info->argc;
78108 + const struct plugin_argument * const argv = plugin_info->argv;
78109 + int i;
78110 + struct register_pass_info kernexec_fptr_pass_info = {
78111 + .pass = &kernexec_fptr_pass.pass,
78112 + .reference_pass_name = "ssa",
78113 + .ref_pass_instance_number = 0,
78114 + .pos_op = PASS_POS_INSERT_AFTER
78115 + };
78116 + struct register_pass_info kernexec_retaddr_pass_info = {
78117 + .pass = &kernexec_retaddr_pass.pass,
78118 + .reference_pass_name = "pro_and_epilogue",
78119 + .ref_pass_instance_number = 0,
78120 + .pos_op = PASS_POS_INSERT_AFTER
78121 + };
78122 +
78123 + if (!plugin_default_version_check(version, &gcc_version)) {
78124 + error(G_("incompatible gcc/plugin versions"));
78125 + return 1;
78126 + }
78127 +
78128 + register_callback(plugin_name, PLUGIN_INFO, NULL, &kernexec_plugin_info);
78129 +
78130 + for (i = 0; i < argc; ++i)
78131 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
78132 +
78133 + if (TARGET_64BIT == 0)
78134 + return 0;
78135 +
78136 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_fptr_pass_info);
78137 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_retaddr_pass_info);
78138 +
78139 + return 0;
78140 +}
78141 diff -urNp linux-3.0.9/tools/gcc/Makefile linux-3.0.9/tools/gcc/Makefile
78142 --- linux-3.0.9/tools/gcc/Makefile 1969-12-31 19:00:00.000000000 -0500
78143 +++ linux-3.0.9/tools/gcc/Makefile 2011-11-15 20:03:00.000000000 -0500
78144 @@ -0,0 +1,21 @@
78145 +#CC := gcc
78146 +#PLUGIN_SOURCE_FILES := pax_plugin.c
78147 +#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES))
78148 +GCCPLUGINS_DIR := $(shell $(HOSTCC) -print-file-name=plugin)
78149 +#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W
78150 +
78151 +HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include
78152 +
78153 +hostlibs-y := constify_plugin.so
78154 +hostlibs-$(CONFIG_PAX_MEMORY_STACKLEAK) += stackleak_plugin.so
78155 +hostlibs-$(CONFIG_KALLOCSTAT_PLUGIN) += kallocstat_plugin.so
78156 +hostlibs-$(CONFIG_PAX_KERNEXEC_PLUGIN) += kernexec_plugin.so
78157 +hostlibs-$(CONFIG_CHECKER_PLUGIN) += checker_plugin.so
78158 +
78159 +always := $(hostlibs-y)
78160 +
78161 +stackleak_plugin-objs := stackleak_plugin.o
78162 +constify_plugin-objs := constify_plugin.o
78163 +kallocstat_plugin-objs := kallocstat_plugin.o
78164 +kernexec_plugin-objs := kernexec_plugin.o
78165 +checker_plugin-objs := checker_plugin.o
78166 diff -urNp linux-3.0.9/tools/gcc/stackleak_plugin.c linux-3.0.9/tools/gcc/stackleak_plugin.c
78167 --- linux-3.0.9/tools/gcc/stackleak_plugin.c 1969-12-31 19:00:00.000000000 -0500
78168 +++ linux-3.0.9/tools/gcc/stackleak_plugin.c 2011-11-15 20:03:00.000000000 -0500
78169 @@ -0,0 +1,251 @@
78170 +/*
78171 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
78172 + * Licensed under the GPL v2
78173 + *
78174 + * Note: the choice of the license means that the compilation process is
78175 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
78176 + * but for the kernel it doesn't matter since it doesn't link against
78177 + * any of the gcc libraries
78178 + *
78179 + * gcc plugin to help implement various PaX features
78180 + *
78181 + * - track lowest stack pointer
78182 + *
78183 + * TODO:
78184 + * - initialize all local variables
78185 + *
78186 + * BUGS:
78187 + * - none known
78188 + */
78189 +#include "gcc-plugin.h"
78190 +#include "config.h"
78191 +#include "system.h"
78192 +#include "coretypes.h"
78193 +#include "tree.h"
78194 +#include "tree-pass.h"
78195 +#include "intl.h"
78196 +#include "plugin-version.h"
78197 +#include "tm.h"
78198 +#include "toplev.h"
78199 +#include "basic-block.h"
78200 +#include "gimple.h"
78201 +//#include "expr.h" where are you...
78202 +#include "diagnostic.h"
78203 +#include "rtl.h"
78204 +#include "emit-rtl.h"
78205 +#include "function.h"
78206 +
78207 +int plugin_is_GPL_compatible;
78208 +
78209 +static int track_frame_size = -1;
78210 +static const char track_function[] = "pax_track_stack";
78211 +static bool init_locals;
78212 +
78213 +static struct plugin_info stackleak_plugin_info = {
78214 + .version = "201109112100",
78215 + .help = "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n"
78216 +// "initialize-locals\t\tforcibly initialize all stack frames\n"
78217 +};
78218 +
78219 +static bool gate_stackleak_track_stack(void);
78220 +static unsigned int execute_stackleak_tree_instrument(void);
78221 +static unsigned int execute_stackleak_final(void);
78222 +
78223 +static struct gimple_opt_pass stackleak_tree_instrument_pass = {
78224 + .pass = {
78225 + .type = GIMPLE_PASS,
78226 + .name = "stackleak_tree_instrument",
78227 + .gate = gate_stackleak_track_stack,
78228 + .execute = execute_stackleak_tree_instrument,
78229 + .sub = NULL,
78230 + .next = NULL,
78231 + .static_pass_number = 0,
78232 + .tv_id = TV_NONE,
78233 + .properties_required = PROP_gimple_leh | PROP_cfg,
78234 + .properties_provided = 0,
78235 + .properties_destroyed = 0,
78236 + .todo_flags_start = 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts,
78237 + .todo_flags_finish = TODO_verify_stmts | TODO_dump_func
78238 + }
78239 +};
78240 +
78241 +static struct rtl_opt_pass stackleak_final_rtl_opt_pass = {
78242 + .pass = {
78243 + .type = RTL_PASS,
78244 + .name = "stackleak_final",
78245 + .gate = gate_stackleak_track_stack,
78246 + .execute = execute_stackleak_final,
78247 + .sub = NULL,
78248 + .next = NULL,
78249 + .static_pass_number = 0,
78250 + .tv_id = TV_NONE,
78251 + .properties_required = 0,
78252 + .properties_provided = 0,
78253 + .properties_destroyed = 0,
78254 + .todo_flags_start = 0,
78255 + .todo_flags_finish = TODO_dump_func
78256 + }
78257 +};
78258 +
78259 +static bool gate_stackleak_track_stack(void)
78260 +{
78261 + return track_frame_size >= 0;
78262 +}
78263 +
78264 +static void stackleak_add_instrumentation(gimple_stmt_iterator *gsi, bool before)
78265 +{
78266 + gimple call;
78267 + tree fndecl, type;
78268 +
78269 + // insert call to void pax_track_stack(void)
78270 + type = build_function_type_list(void_type_node, NULL_TREE);
78271 + fndecl = build_fn_decl(track_function, type);
78272 + DECL_ASSEMBLER_NAME(fndecl); // for LTO
78273 + call = gimple_build_call(fndecl, 0);
78274 + if (before)
78275 + gsi_insert_before(gsi, call, GSI_CONTINUE_LINKING);
78276 + else
78277 + gsi_insert_after(gsi, call, GSI_CONTINUE_LINKING);
78278 +}
78279 +
78280 +static unsigned int execute_stackleak_tree_instrument(void)
78281 +{
78282 + basic_block bb, entry_bb;
78283 + gimple_stmt_iterator gsi;
78284 + bool prologue_instrumented = false;
78285 +
78286 + entry_bb = ENTRY_BLOCK_PTR_FOR_FUNCTION(cfun)->next_bb;
78287 +
78288 + // 1. loop through BBs and GIMPLE statements
78289 + FOR_EACH_BB(bb) {
78290 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
78291 + // gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes <tree_list 0xb7576450>
78292 + tree fndecl;
78293 + gimple stmt = gsi_stmt(gsi);
78294 +
78295 + if (!is_gimple_call(stmt))
78296 + continue;
78297 + fndecl = gimple_call_fndecl(stmt);
78298 + if (!fndecl)
78299 + continue;
78300 + if (TREE_CODE(fndecl) != FUNCTION_DECL)
78301 + continue;
78302 + if (!DECL_BUILT_IN(fndecl))
78303 + continue;
78304 + if (DECL_BUILT_IN_CLASS(fndecl) != BUILT_IN_NORMAL)
78305 + continue;
78306 + if (DECL_FUNCTION_CODE(fndecl) != BUILT_IN_ALLOCA)
78307 + continue;
78308 +
78309 + // 2. insert track call after each __builtin_alloca call
78310 + stackleak_add_instrumentation(&gsi, false);
78311 + if (bb == entry_bb)
78312 + prologue_instrumented = true;
78313 +// print_node(stderr, "pax", fndecl, 4);
78314 + }
78315 + }
78316 +
78317 + // 3. insert track call at the beginning
78318 + if (!prologue_instrumented) {
78319 + gsi = gsi_start_bb(entry_bb);
78320 + stackleak_add_instrumentation(&gsi, true);
78321 + }
78322 +
78323 + return 0;
78324 +}
78325 +
78326 +static unsigned int execute_stackleak_final(void)
78327 +{
78328 + rtx insn;
78329 +
78330 + if (cfun->calls_alloca)
78331 + return 0;
78332 +
78333 + // keep calls only if function frame is big enough
78334 + if (get_frame_size() >= track_frame_size)
78335 + return 0;
78336 +
78337 + // 1. find pax_track_stack calls
78338 + for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
78339 + // rtl match: (call_insn 8 7 9 3 (call (mem (symbol_ref ("pax_track_stack") [flags 0x41] <function_decl 0xb7470e80 pax_track_stack>) [0 S1 A8]) (4)) -1 (nil) (nil))
78340 + rtx body;
78341 +
78342 + if (!CALL_P(insn))
78343 + continue;
78344 + body = PATTERN(insn);
78345 + if (GET_CODE(body) != CALL)
78346 + continue;
78347 + body = XEXP(body, 0);
78348 + if (GET_CODE(body) != MEM)
78349 + continue;
78350 + body = XEXP(body, 0);
78351 + if (GET_CODE(body) != SYMBOL_REF)
78352 + continue;
78353 + if (strcmp(XSTR(body, 0), track_function))
78354 + continue;
78355 +// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
78356 + // 2. delete call
78357 + delete_insn_and_edges(insn);
78358 + }
78359 +
78360 +// print_simple_rtl(stderr, get_insns());
78361 +// print_rtl(stderr, get_insns());
78362 +// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
78363 +
78364 + return 0;
78365 +}
78366 +
78367 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
78368 +{
78369 + const char * const plugin_name = plugin_info->base_name;
78370 + const int argc = plugin_info->argc;
78371 + const struct plugin_argument * const argv = plugin_info->argv;
78372 + int i;
78373 + struct register_pass_info stackleak_tree_instrument_pass_info = {
78374 + .pass = &stackleak_tree_instrument_pass.pass,
78375 +// .reference_pass_name = "tree_profile",
78376 + .reference_pass_name = "optimized",
78377 + .ref_pass_instance_number = 0,
78378 + .pos_op = PASS_POS_INSERT_AFTER
78379 + };
78380 + struct register_pass_info stackleak_final_pass_info = {
78381 + .pass = &stackleak_final_rtl_opt_pass.pass,
78382 + .reference_pass_name = "final",
78383 + .ref_pass_instance_number = 0,
78384 + .pos_op = PASS_POS_INSERT_BEFORE
78385 + };
78386 +
78387 + if (!plugin_default_version_check(version, &gcc_version)) {
78388 + error(G_("incompatible gcc/plugin versions"));
78389 + return 1;
78390 + }
78391 +
78392 + register_callback(plugin_name, PLUGIN_INFO, NULL, &stackleak_plugin_info);
78393 +
78394 + for (i = 0; i < argc; ++i) {
78395 + if (!strcmp(argv[i].key, "track-lowest-sp")) {
78396 + if (!argv[i].value) {
78397 + error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
78398 + continue;
78399 + }
78400 + track_frame_size = atoi(argv[i].value);
78401 + if (argv[i].value[0] < '0' || argv[i].value[0] > '9' || track_frame_size < 0)
78402 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
78403 + continue;
78404 + }
78405 + if (!strcmp(argv[i].key, "initialize-locals")) {
78406 + if (argv[i].value) {
78407 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
78408 + continue;
78409 + }
78410 + init_locals = true;
78411 + continue;
78412 + }
78413 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
78414 + }
78415 +
78416 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_tree_instrument_pass_info);
78417 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_final_pass_info);
78418 +
78419 + return 0;
78420 +}
78421 diff -urNp linux-3.0.9/tools/perf/util/include/asm/alternative-asm.h linux-3.0.9/tools/perf/util/include/asm/alternative-asm.h
78422 --- linux-3.0.9/tools/perf/util/include/asm/alternative-asm.h 2011-11-11 13:12:24.000000000 -0500
78423 +++ linux-3.0.9/tools/perf/util/include/asm/alternative-asm.h 2011-11-15 20:03:00.000000000 -0500
78424 @@ -5,4 +5,7 @@
78425
78426 #define altinstruction_entry #
78427
78428 + .macro pax_force_retaddr rip=0
78429 + .endm
78430 +
78431 #endif
78432 diff -urNp linux-3.0.9/usr/gen_init_cpio.c linux-3.0.9/usr/gen_init_cpio.c
78433 --- linux-3.0.9/usr/gen_init_cpio.c 2011-11-11 13:12:24.000000000 -0500
78434 +++ linux-3.0.9/usr/gen_init_cpio.c 2011-11-15 20:03:00.000000000 -0500
78435 @@ -303,7 +303,7 @@ static int cpio_mkfile(const char *name,
78436 int retval;
78437 int rc = -1;
78438 int namesize;
78439 - int i;
78440 + unsigned int i;
78441
78442 mode |= S_IFREG;
78443
78444 @@ -392,9 +392,10 @@ static char *cpio_replace_env(char *new_
78445 *env_var = *expanded = '\0';
78446 strncat(env_var, start + 2, end - start - 2);
78447 strncat(expanded, new_location, start - new_location);
78448 - strncat(expanded, getenv(env_var), PATH_MAX);
78449 - strncat(expanded, end + 1, PATH_MAX);
78450 + strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
78451 + strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
78452 strncpy(new_location, expanded, PATH_MAX);
78453 + new_location[PATH_MAX] = 0;
78454 } else
78455 break;
78456 }
78457 diff -urNp linux-3.0.9/virt/kvm/kvm_main.c linux-3.0.9/virt/kvm/kvm_main.c
78458 --- linux-3.0.9/virt/kvm/kvm_main.c 2011-11-11 13:12:24.000000000 -0500
78459 +++ linux-3.0.9/virt/kvm/kvm_main.c 2011-11-15 20:03:00.000000000 -0500
78460 @@ -73,7 +73,7 @@ LIST_HEAD(vm_list);
78461
78462 static cpumask_var_t cpus_hardware_enabled;
78463 static int kvm_usage_count = 0;
78464 -static atomic_t hardware_enable_failed;
78465 +static atomic_unchecked_t hardware_enable_failed;
78466
78467 struct kmem_cache *kvm_vcpu_cache;
78468 EXPORT_SYMBOL_GPL(kvm_vcpu_cache);
78469 @@ -2176,7 +2176,7 @@ static void hardware_enable_nolock(void
78470
78471 if (r) {
78472 cpumask_clear_cpu(cpu, cpus_hardware_enabled);
78473 - atomic_inc(&hardware_enable_failed);
78474 + atomic_inc_unchecked(&hardware_enable_failed);
78475 printk(KERN_INFO "kvm: enabling virtualization on "
78476 "CPU%d failed\n", cpu);
78477 }
78478 @@ -2230,10 +2230,10 @@ static int hardware_enable_all(void)
78479
78480 kvm_usage_count++;
78481 if (kvm_usage_count == 1) {
78482 - atomic_set(&hardware_enable_failed, 0);
78483 + atomic_set_unchecked(&hardware_enable_failed, 0);
78484 on_each_cpu(hardware_enable_nolock, NULL, 1);
78485
78486 - if (atomic_read(&hardware_enable_failed)) {
78487 + if (atomic_read_unchecked(&hardware_enable_failed)) {
78488 hardware_disable_all_nolock();
78489 r = -EBUSY;
78490 }
78491 @@ -2498,7 +2498,7 @@ static void kvm_sched_out(struct preempt
78492 kvm_arch_vcpu_put(vcpu);
78493 }
78494
78495 -int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
78496 +int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
78497 struct module *module)
78498 {
78499 int r;
78500 @@ -2561,7 +2561,7 @@ int kvm_init(void *opaque, unsigned vcpu
78501 if (!vcpu_align)
78502 vcpu_align = __alignof__(struct kvm_vcpu);
78503 kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align,
78504 - 0, NULL);
78505 + SLAB_USERCOPY, NULL);
78506 if (!kvm_vcpu_cache) {
78507 r = -ENOMEM;
78508 goto out_free_3;
78509 @@ -2571,9 +2571,11 @@ int kvm_init(void *opaque, unsigned vcpu
78510 if (r)
78511 goto out_free;
78512
78513 - kvm_chardev_ops.owner = module;
78514 - kvm_vm_fops.owner = module;
78515 - kvm_vcpu_fops.owner = module;
78516 + pax_open_kernel();
78517 + *(void **)&kvm_chardev_ops.owner = module;
78518 + *(void **)&kvm_vm_fops.owner = module;
78519 + *(void **)&kvm_vcpu_fops.owner = module;
78520 + pax_close_kernel();
78521
78522 r = misc_register(&kvm_dev);
78523 if (r) {
Unofficial grsecurity patch archive (https://github.com/slashbeast/grsecurity-scrape)