]> git.ipfire.org Git - thirdparty/grsecurity-scrape.git/blob - test/grsecurity-2.9.1-3.5.4-201209151148.patch
projects / thirdparty / grsecurity-scrape.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Auto commit, 1 new patch{es}.
[thirdparty/grsecurity-scrape.git] / test / grsecurity-2.9.1-3.5.4-201209151148.patch
1 diff --git a/Documentation/dontdiff b/Documentation/dontdiff
2 index b4a898f..cd023f2 100644
3 --- a/Documentation/dontdiff
4 +++ b/Documentation/dontdiff
5 @@ -2,9 +2,11 @@
6 *.aux
7 *.bin
8 *.bz2
9 +*.c.[012]*.*
10 *.cis
11 *.cpio
12 *.csp
13 +*.dbg
14 *.dsp
15 *.dvi
16 *.elf
17 @@ -14,6 +16,7 @@
18 *.gcov
19 *.gen.S
20 *.gif
21 +*.gmo
22 *.grep
23 *.grp
24 *.gz
25 @@ -48,14 +51,17 @@
26 *.tab.h
27 *.tex
28 *.ver
29 +*.vim
30 *.xml
31 *.xz
32 *_MODULES
33 +*_reg_safe.h
34 *_vga16.c
35 *~
36 \#*#
37 *.9
38 -.*
39 +.[^g]*
40 +.gen*
41 .*.d
42 .mm
43 53c700_d.h
44 @@ -69,6 +75,7 @@ Image
45 Module.markers
46 Module.symvers
47 PENDING
48 +PERF*
49 SCCS
50 System.map*
51 TAGS
52 @@ -80,6 +87,7 @@ aic7*seq.h*
53 aicasm
54 aicdb.h*
55 altivec*.c
56 +ashldi3.S
57 asm-offsets.h
58 asm_offsets.h
59 autoconf.h*
60 @@ -92,19 +100,24 @@ bounds.h
61 bsetup
62 btfixupprep
63 build
64 +builtin-policy.h
65 bvmlinux
66 bzImage*
67 capability_names.h
68 capflags.c
69 classlist.h*
70 +clut_vga16.c
71 +common-cmds.h
72 comp*.log
73 compile.h*
74 conf
75 config
76 config-*
77 config_data.h*
78 +config.c
79 config.mak
80 config.mak.autogen
81 +config.tmp
82 conmakehash
83 consolemap_deftbl.c*
84 cpustr.h
85 @@ -115,9 +128,11 @@ devlist.h*
86 dnotify_test
87 docproc
88 dslm
89 +dtc-lexer.lex.c
90 elf2ecoff
91 elfconfig.h*
92 evergreen_reg_safe.h
93 +exception_policy.conf
94 fixdep
95 flask.h
96 fore200e_mkfirm
97 @@ -125,12 +140,15 @@ fore200e_pca_fw.c*
98 gconf
99 gconf.glade.h
100 gen-devlist
101 +gen-kdb_cmds.c
102 gen_crc32table
103 gen_init_cpio
104 generated
105 genheaders
106 genksyms
107 *_gray256.c
108 +hash
109 +hid-example
110 hpet_example
111 hugepage-mmap
112 hugepage-shm
113 @@ -145,7 +163,7 @@ int32.c
114 int4.c
115 int8.c
116 kallsyms
117 -kconfig
118 +kern_constants.h
119 keywords.c
120 ksym.c*
121 ksym.h*
122 @@ -153,7 +171,7 @@ kxgettext
123 lkc_defs.h
124 lex.c
125 lex.*.c
126 -linux
127 +lib1funcs.S
128 logo_*.c
129 logo_*_clut224.c
130 logo_*_mono.c
131 @@ -164,14 +182,15 @@ machtypes.h
132 map
133 map_hugetlb
134 maui_boot.h
135 -media
136 mconf
137 +mdp
138 miboot*
139 mk_elfconfig
140 mkboot
141 mkbugboot
142 mkcpustr
143 mkdep
144 +mkpiggy
145 mkprep
146 mkregtable
147 mktables
148 @@ -188,6 +207,8 @@ oui.c*
149 page-types
150 parse.c
151 parse.h
152 +parse-events*
153 +pasyms.h
154 patches*
155 pca200e.bin
156 pca200e_ecd.bin2
157 @@ -197,6 +218,7 @@ perf-archive
158 piggyback
159 piggy.gzip
160 piggy.S
161 +pmu-*
162 pnmtologo
163 ppc_defs.h*
164 pss_boot.h
165 @@ -206,7 +228,10 @@ r200_reg_safe.h
166 r300_reg_safe.h
167 r420_reg_safe.h
168 r600_reg_safe.h
169 +realmode.lds
170 +realmode.relocs
171 recordmcount
172 +regdb.c
173 relocs
174 rlim_names.h
175 rn50_reg_safe.h
176 @@ -216,8 +241,11 @@ series
177 setup
178 setup.bin
179 setup.elf
180 +size_overflow_hash.h
181 sImage
182 +slabinfo
183 sm_tbl*
184 +sortextable
185 split-include
186 syscalltab.h
187 tables.c
188 @@ -227,6 +255,7 @@ tftpboot.img
189 timeconst.h
190 times.h*
191 trix_boot.h
192 +user_constants.h
193 utsrelease.h*
194 vdso-syms.lds
195 vdso.lds
196 @@ -238,13 +267,17 @@ vdso32.lds
197 vdso32.so.dbg
198 vdso64.lds
199 vdso64.so.dbg
200 +vdsox32.lds
201 +vdsox32-syms.lds
202 version.h*
203 vmImage
204 vmlinux
205 vmlinux-*
206 vmlinux.aout
207 vmlinux.bin.all
208 +vmlinux.bin.bz2
209 vmlinux.lds
210 +vmlinux.relocs
211 vmlinuz
212 voffset.h
213 vsyscall.lds
214 @@ -252,9 +285,11 @@ vsyscall_32.lds
215 wanxlfw.inc
216 uImage
217 unifdef
218 +utsrelease.h
219 wakeup.bin
220 wakeup.elf
221 wakeup.lds
222 zImage*
223 zconf.hash.c
224 +zconf.lex.c
225 zoffset.h
226 diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
227 index a92c5eb..7530459 100644
228 --- a/Documentation/kernel-parameters.txt
229 +++ b/Documentation/kernel-parameters.txt
230 @@ -2051,6 +2051,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
231 the specified number of seconds. This is to be used if
232 your oopses keep scrolling off the screen.
233
234 + pax_nouderef [X86] disables UDEREF. Most likely needed under certain
235 + virtualization environments that don't cope well with the
236 + expand down segment used by UDEREF on X86-32 or the frequent
237 + page table updates on X86-64.
238 +
239 + pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
240 +
241 pcbit= [HW,ISDN]
242
243 pcd. [PARIDE]
244 diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt
245 index 13d6166..8c235b6 100644
246 --- a/Documentation/sysctl/fs.txt
247 +++ b/Documentation/sysctl/fs.txt
248 @@ -163,16 +163,22 @@ This value can be used to query and set the core dump mode for setuid
249 or otherwise protected/tainted binaries. The modes are
250
251 0 - (default) - traditional behaviour. Any process which has changed
252 - privilege levels or is execute only will not be dumped
253 + privilege levels or is execute only will not be dumped.
254 1 - (debug) - all processes dump core when possible. The core dump is
255 owned by the current user and no security is applied. This is
256 intended for system debugging situations only. Ptrace is unchecked.
257 + This is insecure as it allows regular users to examine the memory
258 + contents of privileged processes.
259 2 - (suidsafe) - any binary which normally would not be dumped is dumped
260 - readable by root only. This allows the end user to remove
261 - such a dump but not access it directly. For security reasons
262 - core dumps in this mode will not overwrite one another or
263 - other files. This mode is appropriate when administrators are
264 - attempting to debug problems in a normal environment.
265 + anyway, but only if the "core_pattern" kernel sysctl is set to
266 + either a pipe handler or a fully qualified path. (For more details
267 + on this limitation, see CVE-2006-2451.) This mode is appropriate
268 + when administrators are attempting to debug problems in a normal
269 + environment, and either have a core dump pipe handler that knows
270 + to treat privileged core dumps with care, or specific directory
271 + defined for catching core dumps. If a core dump happens without
272 + a pipe handler or fully qualifid path, a message will be emitted
273 + to syslog warning about the lack of a correct setting.
274
275 ==============================================================
276
277 diff --git a/Makefile b/Makefile
278 index 6453ead..f5148e2 100644
279 --- a/Makefile
280 +++ b/Makefile
281 @@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
282
283 HOSTCC = gcc
284 HOSTCXX = g++
285 -HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
286 -HOSTCXXFLAGS = -O2
287 +HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
288 +HOSTCLFAGS += $(call cc-option, -Wno-empty-body)
289 +HOSTCXXFLAGS = -O2 -Wall -W -fno-delete-null-pointer-checks
290
291 # Decide whether to build built-in, modular, or both.
292 # Normally, just do built-in.
293 @@ -404,8 +405,8 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn \
294 # Rules shared between *config targets and build targets
295
296 # Basic helpers built in scripts/
297 -PHONY += scripts_basic
298 -scripts_basic:
299 +PHONY += scripts_basic gcc-plugins
300 +scripts_basic: gcc-plugins
301 $(Q)$(MAKE) $(build)=scripts/basic
302 $(Q)rm -f .tmp_quiet_recordmcount
303
304 @@ -561,6 +562,60 @@ else
305 KBUILD_CFLAGS += -O2
306 endif
307
308 +ifndef DISABLE_PAX_PLUGINS
309 +PLUGINCC := $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCC)" "$(HOSTCXX)" "$(CC)")
310 +ifneq ($(PLUGINCC),)
311 +ifndef DISABLE_PAX_CONSTIFY_PLUGIN
312 +ifndef CONFIG_UML
313 +CONSTIFY_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN
314 +endif
315 +endif
316 +ifdef CONFIG_PAX_MEMORY_STACKLEAK
317 +STACKLEAK_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -DSTACKLEAK_PLUGIN
318 +STACKLEAK_PLUGIN_CFLAGS += -fplugin-arg-stackleak_plugin-track-lowest-sp=100
319 +endif
320 +ifdef CONFIG_KALLOCSTAT_PLUGIN
321 +KALLOCSTAT_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/kallocstat_plugin.so
322 +endif
323 +ifdef CONFIG_PAX_KERNEXEC_PLUGIN
324 +KERNEXEC_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/kernexec_plugin.so
325 +KERNEXEC_PLUGIN_CFLAGS += -fplugin-arg-kernexec_plugin-method=$(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD) -DKERNEXEC_PLUGIN
326 +KERNEXEC_PLUGIN_AFLAGS := -DKERNEXEC_PLUGIN
327 +endif
328 +ifdef CONFIG_CHECKER_PLUGIN
329 +ifeq ($(call cc-ifversion, -ge, 0406, y), y)
330 +CHECKER_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/checker_plugin.so -DCHECKER_PLUGIN
331 +endif
332 +endif
333 +COLORIZE_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/colorize_plugin.so
334 +ifdef CONFIG_PAX_SIZE_OVERFLOW
335 +SIZE_OVERFLOW_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/size_overflow_plugin.so -DSIZE_OVERFLOW_PLUGIN
336 +endif
337 +ifdef CONFIG_PAX_LATENT_ENTROPY
338 +LATENT_ENTROPY_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/latent_entropy_plugin.so -DLATENT_ENTROPY_PLUGIN
339 +endif
340 +GCC_PLUGINS_CFLAGS := $(CONSTIFY_PLUGIN_CFLAGS) $(STACKLEAK_PLUGIN_CFLAGS) $(KALLOCSTAT_PLUGIN_CFLAGS)
341 +GCC_PLUGINS_CFLAGS += $(KERNEXEC_PLUGIN_CFLAGS) $(CHECKER_PLUGIN_CFLAGS) $(COLORIZE_PLUGIN_CFLAGS)
342 +GCC_PLUGINS_CFLAGS += $(SIZE_OVERFLOW_PLUGIN_CFLAGS) $(LATENT_ENTROPY_PLUGIN_CFLAGS)
343 +GCC_PLUGINS_AFLAGS := $(KERNEXEC_PLUGIN_AFLAGS)
344 +export PLUGINCC GCC_PLUGINS_CFLAGS GCC_PLUGINS_AFLAGS CONSTIFY_PLUGIN
345 +ifeq ($(KBUILD_EXTMOD),)
346 +gcc-plugins:
347 + $(Q)$(MAKE) $(build)=tools/gcc
348 +else
349 +gcc-plugins: ;
350 +endif
351 +else
352 +gcc-plugins:
353 +ifeq ($(call cc-ifversion, -ge, 0405, y), y)
354 + $(error Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev. If you choose to ignore this error and lessen the improvements provided by this patch, re-run make with the DISABLE_PAX_PLUGINS=y argument.))
355 +else
356 + $(Q)echo "warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least"
357 +endif
358 + $(Q)echo "PAX_MEMORY_STACKLEAK and other features will be less secure"
359 +endif
360 +endif
361 +
362 include $(srctree)/arch/$(SRCARCH)/Makefile
363
364 ifdef CONFIG_READABLE_ASM
365 @@ -715,7 +770,7 @@ export mod_strip_cmd
366
367
368 ifeq ($(KBUILD_EXTMOD),)
369 -core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
370 +core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
371
372 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
373 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
374 @@ -762,6 +817,8 @@ endif
375
376 # The actual objects are generated when descending,
377 # make sure no implicit rule kicks in
378 +$(filter-out $(init-y),$(vmlinux-deps)): KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
379 +$(filter-out $(init-y),$(vmlinux-deps)): KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
380 $(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
381
382 # Handle descending into subdirectories listed in $(vmlinux-dirs)
383 @@ -771,7 +828,7 @@ $(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
384 # Error messages still appears in the original language
385
386 PHONY += $(vmlinux-dirs)
387 -$(vmlinux-dirs): prepare scripts
388 +$(vmlinux-dirs): gcc-plugins prepare scripts
389 $(Q)$(MAKE) $(build)=$@
390
391 # Store (new) KERNELRELASE string in include/config/kernel.release
392 @@ -815,6 +872,7 @@ prepare0: archprepare FORCE
393 $(Q)$(MAKE) $(build)=.
394
395 # All the preparing..
396 +prepare: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS),$(KBUILD_CFLAGS))
397 prepare: prepare0
398
399 # Generate some files
400 @@ -922,6 +980,8 @@ all: modules
401 # using awk while concatenating to the final file.
402
403 PHONY += modules
404 +modules: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
405 +modules: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
406 modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
407 $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
408 @$(kecho) ' Building modules, stage 2.';
409 @@ -937,7 +997,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
410
411 # Target to prepare building external modules
412 PHONY += modules_prepare
413 -modules_prepare: prepare scripts
414 +modules_prepare: gcc-plugins prepare scripts
415
416 # Target to install modules
417 PHONY += modules_install
418 @@ -994,7 +1054,7 @@ CLEAN_DIRS += $(MODVERDIR)
419 MRPROPER_DIRS += include/config usr/include include/generated \
420 arch/*/include/generated
421 MRPROPER_FILES += .config .config.old .version .old_version \
422 - include/linux/version.h \
423 + include/linux/version.h tools/gcc/size_overflow_hash.h\
424 Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS
425
426 # clean - Delete most, but leave enough to build external modules
427 @@ -1032,6 +1092,7 @@ distclean: mrproper
428 \( -name '*.orig' -o -name '*.rej' -o -name '*~' \
429 -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
430 -o -name '.*.rej' \
431 + -o -name '.*.rej' -o -name '*.so' \
432 -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
433 -type f -print | xargs rm -f
434
435 @@ -1192,6 +1253,8 @@ PHONY += $(module-dirs) modules
436 $(module-dirs): crmodverdir $(objtree)/Module.symvers
437 $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
438
439 +modules: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
440 +modules: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
441 modules: $(module-dirs)
442 @$(kecho) ' Building modules, stage 2.';
443 $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
444 @@ -1326,17 +1389,21 @@ else
445 target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
446 endif
447
448 -%.s: %.c prepare scripts FORCE
449 +%.s: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
450 +%.s: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
451 +%.s: %.c gcc-plugins prepare scripts FORCE
452 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
453 %.i: %.c prepare scripts FORCE
454 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
455 -%.o: %.c prepare scripts FORCE
456 +%.o: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
457 +%.o: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
458 +%.o: %.c gcc-plugins prepare scripts FORCE
459 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
460 %.lst: %.c prepare scripts FORCE
461 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
462 -%.s: %.S prepare scripts FORCE
463 +%.s: %.S gcc-plugins prepare scripts FORCE
464 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
465 -%.o: %.S prepare scripts FORCE
466 +%.o: %.S gcc-plugins prepare scripts FORCE
467 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
468 %.symtypes: %.c prepare scripts FORCE
469 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
470 @@ -1346,11 +1413,15 @@ endif
471 $(cmd_crmodverdir)
472 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
473 $(build)=$(build-dir)
474 -%/: prepare scripts FORCE
475 +%/: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
476 +%/: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
477 +%/: gcc-plugins prepare scripts FORCE
478 $(cmd_crmodverdir)
479 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
480 $(build)=$(build-dir)
481 -%.ko: prepare scripts FORCE
482 +%.ko: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
483 +%.ko: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
484 +%.ko: gcc-plugins prepare scripts FORCE
485 $(cmd_crmodverdir)
486 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
487 $(build)=$(build-dir) $(@:.ko=.o)
488 diff --git a/arch/alpha/include/asm/atomic.h b/arch/alpha/include/asm/atomic.h
489 index 3bb7ffe..347a54c 100644
490 --- a/arch/alpha/include/asm/atomic.h
491 +++ b/arch/alpha/include/asm/atomic.h
492 @@ -250,6 +250,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
493 #define atomic_dec(v) atomic_sub(1,(v))
494 #define atomic64_dec(v) atomic64_sub(1,(v))
495
496 +#define atomic64_read_unchecked(v) atomic64_read(v)
497 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
498 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
499 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
500 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
501 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
502 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
503 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
504 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
505 +
506 #define smp_mb__before_atomic_dec() smp_mb()
507 #define smp_mb__after_atomic_dec() smp_mb()
508 #define smp_mb__before_atomic_inc() smp_mb()
509 diff --git a/arch/alpha/include/asm/cache.h b/arch/alpha/include/asm/cache.h
510 index ad368a9..fbe0f25 100644
511 --- a/arch/alpha/include/asm/cache.h
512 +++ b/arch/alpha/include/asm/cache.h
513 @@ -4,19 +4,19 @@
514 #ifndef __ARCH_ALPHA_CACHE_H
515 #define __ARCH_ALPHA_CACHE_H
516
517 +#include <linux/const.h>
518
519 /* Bytes per L1 (data) cache line. */
520 #if defined(CONFIG_ALPHA_GENERIC) || defined(CONFIG_ALPHA_EV6)
521 -# define L1_CACHE_BYTES 64
522 # define L1_CACHE_SHIFT 6
523 #else
524 /* Both EV4 and EV5 are write-through, read-allocate,
525 direct-mapped, physical.
526 */
527 -# define L1_CACHE_BYTES 32
528 # define L1_CACHE_SHIFT 5
529 #endif
530
531 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
532 #define SMP_CACHE_BYTES L1_CACHE_BYTES
533
534 #endif
535 diff --git a/arch/alpha/include/asm/elf.h b/arch/alpha/include/asm/elf.h
536 index 968d999..d36b2df 100644
537 --- a/arch/alpha/include/asm/elf.h
538 +++ b/arch/alpha/include/asm/elf.h
539 @@ -91,6 +91,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
540
541 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
542
543 +#ifdef CONFIG_PAX_ASLR
544 +#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
545 +
546 +#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
547 +#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
548 +#endif
549 +
550 /* $0 is set by ld.so to a pointer to a function which might be
551 registered using atexit. This provides a mean for the dynamic
552 linker to call DT_FINI functions for shared libraries that have
553 diff --git a/arch/alpha/include/asm/pgalloc.h b/arch/alpha/include/asm/pgalloc.h
554 index bc2a0da..8ad11ee 100644
555 --- a/arch/alpha/include/asm/pgalloc.h
556 +++ b/arch/alpha/include/asm/pgalloc.h
557 @@ -29,6 +29,12 @@ pgd_populate(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
558 pgd_set(pgd, pmd);
559 }
560
561 +static inline void
562 +pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
563 +{
564 + pgd_populate(mm, pgd, pmd);
565 +}
566 +
567 extern pgd_t *pgd_alloc(struct mm_struct *mm);
568
569 static inline void
570 diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h
571 index 81a4342..348b927 100644
572 --- a/arch/alpha/include/asm/pgtable.h
573 +++ b/arch/alpha/include/asm/pgtable.h
574 @@ -102,6 +102,17 @@ struct vm_area_struct;
575 #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
576 #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
577 #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
578 +
579 +#ifdef CONFIG_PAX_PAGEEXEC
580 +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
581 +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
582 +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
583 +#else
584 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
585 +# define PAGE_COPY_NOEXEC PAGE_COPY
586 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
587 +#endif
588 +
589 #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
590
591 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
592 diff --git a/arch/alpha/kernel/module.c b/arch/alpha/kernel/module.c
593 index 2fd00b7..cfd5069 100644
594 --- a/arch/alpha/kernel/module.c
595 +++ b/arch/alpha/kernel/module.c
596 @@ -160,7 +160,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, const char *strtab,
597
598 /* The small sections were sorted to the end of the segment.
599 The following should definitely cover them. */
600 - gp = (u64)me->module_core + me->core_size - 0x8000;
601 + gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
602 got = sechdrs[me->arch.gotsecindex].sh_addr;
603
604 for (i = 0; i < n; i++) {
605 diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
606 index 98a1036..fb54ccf 100644
607 --- a/arch/alpha/kernel/osf_sys.c
608 +++ b/arch/alpha/kernel/osf_sys.c
609 @@ -1312,7 +1312,7 @@ arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
610 /* At this point: (!vma || addr < vma->vm_end). */
611 if (limit - len < addr)
612 return -ENOMEM;
613 - if (!vma || addr + len <= vma->vm_start)
614 + if (check_heap_stack_gap(vma, addr, len))
615 return addr;
616 addr = vma->vm_end;
617 vma = vma->vm_next;
618 @@ -1348,6 +1348,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
619 merely specific addresses, but regions of memory -- perhaps
620 this feature should be incorporated into all ports? */
621
622 +#ifdef CONFIG_PAX_RANDMMAP
623 + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
624 +#endif
625 +
626 if (addr) {
627 addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
628 if (addr != (unsigned long) -ENOMEM)
629 @@ -1355,8 +1359,8 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
630 }
631
632 /* Next, try allocating at TASK_UNMAPPED_BASE. */
633 - addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
634 - len, limit);
635 + addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
636 +
637 if (addr != (unsigned long) -ENOMEM)
638 return addr;
639
640 diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
641 index 5eecab1..609abc0 100644
642 --- a/arch/alpha/mm/fault.c
643 +++ b/arch/alpha/mm/fault.c
644 @@ -53,6 +53,124 @@ __load_new_mm_context(struct mm_struct *next_mm)
645 __reload_thread(pcb);
646 }
647
648 +#ifdef CONFIG_PAX_PAGEEXEC
649 +/*
650 + * PaX: decide what to do with offenders (regs->pc = fault address)
651 + *
652 + * returns 1 when task should be killed
653 + * 2 when patched PLT trampoline was detected
654 + * 3 when unpatched PLT trampoline was detected
655 + */
656 +static int pax_handle_fetch_fault(struct pt_regs *regs)
657 +{
658 +
659 +#ifdef CONFIG_PAX_EMUPLT
660 + int err;
661 +
662 + do { /* PaX: patched PLT emulation #1 */
663 + unsigned int ldah, ldq, jmp;
664 +
665 + err = get_user(ldah, (unsigned int *)regs->pc);
666 + err |= get_user(ldq, (unsigned int *)(regs->pc+4));
667 + err |= get_user(jmp, (unsigned int *)(regs->pc+8));
668 +
669 + if (err)
670 + break;
671 +
672 + if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
673 + (ldq & 0xFFFF0000U) == 0xA77B0000U &&
674 + jmp == 0x6BFB0000U)
675 + {
676 + unsigned long r27, addr;
677 + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
678 + unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
679 +
680 + addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
681 + err = get_user(r27, (unsigned long *)addr);
682 + if (err)
683 + break;
684 +
685 + regs->r27 = r27;
686 + regs->pc = r27;
687 + return 2;
688 + }
689 + } while (0);
690 +
691 + do { /* PaX: patched PLT emulation #2 */
692 + unsigned int ldah, lda, br;
693 +
694 + err = get_user(ldah, (unsigned int *)regs->pc);
695 + err |= get_user(lda, (unsigned int *)(regs->pc+4));
696 + err |= get_user(br, (unsigned int *)(regs->pc+8));
697 +
698 + if (err)
699 + break;
700 +
701 + if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
702 + (lda & 0xFFFF0000U) == 0xA77B0000U &&
703 + (br & 0xFFE00000U) == 0xC3E00000U)
704 + {
705 + unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
706 + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
707 + unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
708 +
709 + regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
710 + regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
711 + return 2;
712 + }
713 + } while (0);
714 +
715 + do { /* PaX: unpatched PLT emulation */
716 + unsigned int br;
717 +
718 + err = get_user(br, (unsigned int *)regs->pc);
719 +
720 + if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
721 + unsigned int br2, ldq, nop, jmp;
722 + unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
723 +
724 + addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
725 + err = get_user(br2, (unsigned int *)addr);
726 + err |= get_user(ldq, (unsigned int *)(addr+4));
727 + err |= get_user(nop, (unsigned int *)(addr+8));
728 + err |= get_user(jmp, (unsigned int *)(addr+12));
729 + err |= get_user(resolver, (unsigned long *)(addr+16));
730 +
731 + if (err)
732 + break;
733 +
734 + if (br2 == 0xC3600000U &&
735 + ldq == 0xA77B000CU &&
736 + nop == 0x47FF041FU &&
737 + jmp == 0x6B7B0000U)
738 + {
739 + regs->r28 = regs->pc+4;
740 + regs->r27 = addr+16;
741 + regs->pc = resolver;
742 + return 3;
743 + }
744 + }
745 + } while (0);
746 +#endif
747 +
748 + return 1;
749 +}
750 +
751 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
752 +{
753 + unsigned long i;
754 +
755 + printk(KERN_ERR "PAX: bytes at PC: ");
756 + for (i = 0; i < 5; i++) {
757 + unsigned int c;
758 + if (get_user(c, (unsigned int *)pc+i))
759 + printk(KERN_CONT "???????? ");
760 + else
761 + printk(KERN_CONT "%08x ", c);
762 + }
763 + printk("\n");
764 +}
765 +#endif
766
767 /*
768 * This routine handles page faults. It determines the address,
769 @@ -130,8 +248,29 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
770 good_area:
771 si_code = SEGV_ACCERR;
772 if (cause < 0) {
773 - if (!(vma->vm_flags & VM_EXEC))
774 + if (!(vma->vm_flags & VM_EXEC)) {
775 +
776 +#ifdef CONFIG_PAX_PAGEEXEC
777 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
778 + goto bad_area;
779 +
780 + up_read(&mm->mmap_sem);
781 + switch (pax_handle_fetch_fault(regs)) {
782 +
783 +#ifdef CONFIG_PAX_EMUPLT
784 + case 2:
785 + case 3:
786 + return;
787 +#endif
788 +
789 + }
790 + pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
791 + do_group_exit(SIGKILL);
792 +#else
793 goto bad_area;
794 +#endif
795 +
796 + }
797 } else if (!cause) {
798 /* Allow reads even for write-only mappings */
799 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
800 diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
801 index c79f61f..9ac0642 100644
802 --- a/arch/arm/include/asm/atomic.h
803 +++ b/arch/arm/include/asm/atomic.h
804 @@ -17,17 +17,35 @@
805 #include <asm/barrier.h>
806 #include <asm/cmpxchg.h>
807
808 +#ifdef CONFIG_GENERIC_ATOMIC64
809 +#include <asm-generic/atomic64.h>
810 +#endif
811 +
812 #define ATOMIC_INIT(i) { (i) }
813
814 #ifdef __KERNEL__
815
816 +#define _ASM_EXTABLE(from, to) \
817 +" .pushsection __ex_table,\"a\"\n"\
818 +" .align 3\n" \
819 +" .long " #from ", " #to"\n" \
820 +" .popsection"
821 +
822 /*
823 * On ARM, ordinary assignment (str instruction) doesn't clear the local
824 * strex/ldrex monitor on some implementations. The reason we can use it for
825 * atomic_set() is the clrex or dummy strex done on every exception return.
826 */
827 #define atomic_read(v) (*(volatile int *)&(v)->counter)
828 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
829 +{
830 + return v->counter;
831 +}
832 #define atomic_set(v,i) (((v)->counter) = (i))
833 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
834 +{
835 + v->counter = i;
836 +}
837
838 #if __LINUX_ARM_ARCH__ >= 6
839
840 @@ -42,6 +60,35 @@ static inline void atomic_add(int i, atomic_t *v)
841 int result;
842
843 __asm__ __volatile__("@ atomic_add\n"
844 +"1: ldrex %1, [%3]\n"
845 +" adds %0, %1, %4\n"
846 +
847 +#ifdef CONFIG_PAX_REFCOUNT
848 +" bvc 3f\n"
849 +"2: bkpt 0xf103\n"
850 +"3:\n"
851 +#endif
852 +
853 +" strex %1, %0, [%3]\n"
854 +" teq %1, #0\n"
855 +" bne 1b"
856 +
857 +#ifdef CONFIG_PAX_REFCOUNT
858 +"\n4:\n"
859 + _ASM_EXTABLE(2b, 4b)
860 +#endif
861 +
862 + : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
863 + : "r" (&v->counter), "Ir" (i)
864 + : "cc");
865 +}
866 +
867 +static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
868 +{
869 + unsigned long tmp;
870 + int result;
871 +
872 + __asm__ __volatile__("@ atomic_add_unchecked\n"
873 "1: ldrex %0, [%3]\n"
874 " add %0, %0, %4\n"
875 " strex %1, %0, [%3]\n"
876 @@ -60,6 +107,42 @@ static inline int atomic_add_return(int i, atomic_t *v)
877 smp_mb();
878
879 __asm__ __volatile__("@ atomic_add_return\n"
880 +"1: ldrex %1, [%3]\n"
881 +" adds %0, %1, %4\n"
882 +
883 +#ifdef CONFIG_PAX_REFCOUNT
884 +" bvc 3f\n"
885 +" mov %0, %1\n"
886 +"2: bkpt 0xf103\n"
887 +"3:\n"
888 +#endif
889 +
890 +" strex %1, %0, [%3]\n"
891 +" teq %1, #0\n"
892 +" bne 1b"
893 +
894 +#ifdef CONFIG_PAX_REFCOUNT
895 +"\n4:\n"
896 + _ASM_EXTABLE(2b, 4b)
897 +#endif
898 +
899 + : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
900 + : "r" (&v->counter), "Ir" (i)
901 + : "cc");
902 +
903 + smp_mb();
904 +
905 + return result;
906 +}
907 +
908 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
909 +{
910 + unsigned long tmp;
911 + int result;
912 +
913 + smp_mb();
914 +
915 + __asm__ __volatile__("@ atomic_add_return_unchecked\n"
916 "1: ldrex %0, [%3]\n"
917 " add %0, %0, %4\n"
918 " strex %1, %0, [%3]\n"
919 @@ -80,6 +163,35 @@ static inline void atomic_sub(int i, atomic_t *v)
920 int result;
921
922 __asm__ __volatile__("@ atomic_sub\n"
923 +"1: ldrex %1, [%3]\n"
924 +" subs %0, %1, %4\n"
925 +
926 +#ifdef CONFIG_PAX_REFCOUNT
927 +" bvc 3f\n"
928 +"2: bkpt 0xf103\n"
929 +"3:\n"
930 +#endif
931 +
932 +" strex %1, %0, [%3]\n"
933 +" teq %1, #0\n"
934 +" bne 1b"
935 +
936 +#ifdef CONFIG_PAX_REFCOUNT
937 +"\n4:\n"
938 + _ASM_EXTABLE(2b, 4b)
939 +#endif
940 +
941 + : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
942 + : "r" (&v->counter), "Ir" (i)
943 + : "cc");
944 +}
945 +
946 +static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
947 +{
948 + unsigned long tmp;
949 + int result;
950 +
951 + __asm__ __volatile__("@ atomic_sub_unchecked\n"
952 "1: ldrex %0, [%3]\n"
953 " sub %0, %0, %4\n"
954 " strex %1, %0, [%3]\n"
955 @@ -98,11 +210,25 @@ static inline int atomic_sub_return(int i, atomic_t *v)
956 smp_mb();
957
958 __asm__ __volatile__("@ atomic_sub_return\n"
959 -"1: ldrex %0, [%3]\n"
960 -" sub %0, %0, %4\n"
961 +"1: ldrex %1, [%3]\n"
962 +" subs %0, %1, %4\n"
963 +
964 +#ifdef CONFIG_PAX_REFCOUNT
965 +" bvc 3f\n"
966 +" mov %0, %1\n"
967 +"2: bkpt 0xf103\n"
968 +"3:\n"
969 +#endif
970 +
971 " strex %1, %0, [%3]\n"
972 " teq %1, #0\n"
973 " bne 1b"
974 +
975 +#ifdef CONFIG_PAX_REFCOUNT
976 +"\n4:\n"
977 + _ASM_EXTABLE(2b, 4b)
978 +#endif
979 +
980 : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
981 : "r" (&v->counter), "Ir" (i)
982 : "cc");
983 @@ -134,6 +260,28 @@ static inline int atomic_cmpxchg(atomic_t *ptr, int old, int new)
984 return oldval;
985 }
986
987 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *ptr, int old, int new)
988 +{
989 + unsigned long oldval, res;
990 +
991 + smp_mb();
992 +
993 + do {
994 + __asm__ __volatile__("@ atomic_cmpxchg_unchecked\n"
995 + "ldrex %1, [%3]\n"
996 + "mov %0, #0\n"
997 + "teq %1, %4\n"
998 + "strexeq %0, %5, [%3]\n"
999 + : "=&r" (res), "=&r" (oldval), "+Qo" (ptr->counter)
1000 + : "r" (&ptr->counter), "Ir" (old), "r" (new)
1001 + : "cc");
1002 + } while (res);
1003 +
1004 + smp_mb();
1005 +
1006 + return oldval;
1007 +}
1008 +
1009 static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
1010 {
1011 unsigned long tmp, tmp2;
1012 @@ -167,7 +315,17 @@ static inline int atomic_add_return(int i, atomic_t *v)
1013
1014 return val;
1015 }
1016 +
1017 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
1018 +{
1019 + return atomic_add_return(i, v);
1020 +}
1021 +
1022 #define atomic_add(i, v) (void) atomic_add_return(i, v)
1023 +static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
1024 +{
1025 + (void) atomic_add_return(i, v);
1026 +}
1027
1028 static inline int atomic_sub_return(int i, atomic_t *v)
1029 {
1030 @@ -182,6 +340,10 @@ static inline int atomic_sub_return(int i, atomic_t *v)
1031 return val;
1032 }
1033 #define atomic_sub(i, v) (void) atomic_sub_return(i, v)
1034 +static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
1035 +{
1036 + (void) atomic_sub_return(i, v);
1037 +}
1038
1039 static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
1040 {
1041 @@ -197,6 +359,11 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
1042 return ret;
1043 }
1044
1045 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
1046 +{
1047 + return atomic_cmpxchg(v, old, new);
1048 +}
1049 +
1050 static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
1051 {
1052 unsigned long flags;
1053 @@ -209,6 +376,10 @@ static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
1054 #endif /* __LINUX_ARM_ARCH__ */
1055
1056 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
1057 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
1058 +{
1059 + return xchg(&v->counter, new);
1060 +}
1061
1062 static inline int __atomic_add_unless(atomic_t *v, int a, int u)
1063 {
1064 @@ -221,11 +392,27 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
1065 }
1066
1067 #define atomic_inc(v) atomic_add(1, v)
1068 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
1069 +{
1070 + atomic_add_unchecked(1, v);
1071 +}
1072 #define atomic_dec(v) atomic_sub(1, v)
1073 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
1074 +{
1075 + atomic_sub_unchecked(1, v);
1076 +}
1077
1078 #define atomic_inc_and_test(v) (atomic_add_return(1, v) == 0)
1079 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
1080 +{
1081 + return atomic_add_return_unchecked(1, v) == 0;
1082 +}
1083 #define atomic_dec_and_test(v) (atomic_sub_return(1, v) == 0)
1084 #define atomic_inc_return(v) (atomic_add_return(1, v))
1085 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
1086 +{
1087 + return atomic_add_return_unchecked(1, v);
1088 +}
1089 #define atomic_dec_return(v) (atomic_sub_return(1, v))
1090 #define atomic_sub_and_test(i, v) (atomic_sub_return(i, v) == 0)
1091
1092 @@ -241,6 +428,14 @@ typedef struct {
1093 u64 __aligned(8) counter;
1094 } atomic64_t;
1095
1096 +#ifdef CONFIG_PAX_REFCOUNT
1097 +typedef struct {
1098 + u64 __aligned(8) counter;
1099 +} atomic64_unchecked_t;
1100 +#else
1101 +typedef atomic64_t atomic64_unchecked_t;
1102 +#endif
1103 +
1104 #define ATOMIC64_INIT(i) { (i) }
1105
1106 static inline u64 atomic64_read(const atomic64_t *v)
1107 @@ -256,6 +451,19 @@ static inline u64 atomic64_read(const atomic64_t *v)
1108 return result;
1109 }
1110
1111 +static inline u64 atomic64_read_unchecked(atomic64_unchecked_t *v)
1112 +{
1113 + u64 result;
1114 +
1115 + __asm__ __volatile__("@ atomic64_read_unchecked\n"
1116 +" ldrexd %0, %H0, [%1]"
1117 + : "=&r" (result)
1118 + : "r" (&v->counter), "Qo" (v->counter)
1119 + );
1120 +
1121 + return result;
1122 +}
1123 +
1124 static inline void atomic64_set(atomic64_t *v, u64 i)
1125 {
1126 u64 tmp;
1127 @@ -270,6 +478,20 @@ static inline void atomic64_set(atomic64_t *v, u64 i)
1128 : "cc");
1129 }
1130
1131 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, u64 i)
1132 +{
1133 + u64 tmp;
1134 +
1135 + __asm__ __volatile__("@ atomic64_set_unchecked\n"
1136 +"1: ldrexd %0, %H0, [%2]\n"
1137 +" strexd %0, %3, %H3, [%2]\n"
1138 +" teq %0, #0\n"
1139 +" bne 1b"
1140 + : "=&r" (tmp), "=Qo" (v->counter)
1141 + : "r" (&v->counter), "r" (i)
1142 + : "cc");
1143 +}
1144 +
1145 static inline void atomic64_add(u64 i, atomic64_t *v)
1146 {
1147 u64 result;
1148 @@ -278,6 +500,36 @@ static inline void atomic64_add(u64 i, atomic64_t *v)
1149 __asm__ __volatile__("@ atomic64_add\n"
1150 "1: ldrexd %0, %H0, [%3]\n"
1151 " adds %0, %0, %4\n"
1152 +" adcs %H0, %H0, %H4\n"
1153 +
1154 +#ifdef CONFIG_PAX_REFCOUNT
1155 +" bvc 3f\n"
1156 +"2: bkpt 0xf103\n"
1157 +"3:\n"
1158 +#endif
1159 +
1160 +" strexd %1, %0, %H0, [%3]\n"
1161 +" teq %1, #0\n"
1162 +" bne 1b"
1163 +
1164 +#ifdef CONFIG_PAX_REFCOUNT
1165 +"\n4:\n"
1166 + _ASM_EXTABLE(2b, 4b)
1167 +#endif
1168 +
1169 + : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
1170 + : "r" (&v->counter), "r" (i)
1171 + : "cc");
1172 +}
1173 +
1174 +static inline void atomic64_add_unchecked(u64 i, atomic64_unchecked_t *v)
1175 +{
1176 + u64 result;
1177 + unsigned long tmp;
1178 +
1179 + __asm__ __volatile__("@ atomic64_add_unchecked\n"
1180 +"1: ldrexd %0, %H0, [%3]\n"
1181 +" adds %0, %0, %4\n"
1182 " adc %H0, %H0, %H4\n"
1183 " strexd %1, %0, %H0, [%3]\n"
1184 " teq %1, #0\n"
1185 @@ -289,12 +541,49 @@ static inline void atomic64_add(u64 i, atomic64_t *v)
1186
1187 static inline u64 atomic64_add_return(u64 i, atomic64_t *v)
1188 {
1189 - u64 result;
1190 - unsigned long tmp;
1191 + u64 result, tmp;
1192
1193 smp_mb();
1194
1195 __asm__ __volatile__("@ atomic64_add_return\n"
1196 +"1: ldrexd %1, %H1, [%3]\n"
1197 +" adds %0, %1, %4\n"
1198 +" adcs %H0, %H1, %H4\n"
1199 +
1200 +#ifdef CONFIG_PAX_REFCOUNT
1201 +" bvc 3f\n"
1202 +" mov %0, %1\n"
1203 +" mov %H0, %H1\n"
1204 +"2: bkpt 0xf103\n"
1205 +"3:\n"
1206 +#endif
1207 +
1208 +" strexd %1, %0, %H0, [%3]\n"
1209 +" teq %1, #0\n"
1210 +" bne 1b"
1211 +
1212 +#ifdef CONFIG_PAX_REFCOUNT
1213 +"\n4:\n"
1214 + _ASM_EXTABLE(2b, 4b)
1215 +#endif
1216 +
1217 + : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
1218 + : "r" (&v->counter), "r" (i)
1219 + : "cc");
1220 +
1221 + smp_mb();
1222 +
1223 + return result;
1224 +}
1225 +
1226 +static inline u64 atomic64_add_return_unchecked(u64 i, atomic64_unchecked_t *v)
1227 +{
1228 + u64 result;
1229 + unsigned long tmp;
1230 +
1231 + smp_mb();
1232 +
1233 + __asm__ __volatile__("@ atomic64_add_return_unchecked\n"
1234 "1: ldrexd %0, %H0, [%3]\n"
1235 " adds %0, %0, %4\n"
1236 " adc %H0, %H0, %H4\n"
1237 @@ -318,6 +607,36 @@ static inline void atomic64_sub(u64 i, atomic64_t *v)
1238 __asm__ __volatile__("@ atomic64_sub\n"
1239 "1: ldrexd %0, %H0, [%3]\n"
1240 " subs %0, %0, %4\n"
1241 +" sbcs %H0, %H0, %H4\n"
1242 +
1243 +#ifdef CONFIG_PAX_REFCOUNT
1244 +" bvc 3f\n"
1245 +"2: bkpt 0xf103\n"
1246 +"3:\n"
1247 +#endif
1248 +
1249 +" strexd %1, %0, %H0, [%3]\n"
1250 +" teq %1, #0\n"
1251 +" bne 1b"
1252 +
1253 +#ifdef CONFIG_PAX_REFCOUNT
1254 +"\n4:\n"
1255 + _ASM_EXTABLE(2b, 4b)
1256 +#endif
1257 +
1258 + : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
1259 + : "r" (&v->counter), "r" (i)
1260 + : "cc");
1261 +}
1262 +
1263 +static inline void atomic64_sub_unchecked(u64 i, atomic64_unchecked_t *v)
1264 +{
1265 + u64 result;
1266 + unsigned long tmp;
1267 +
1268 + __asm__ __volatile__("@ atomic64_sub_unchecked\n"
1269 +"1: ldrexd %0, %H0, [%3]\n"
1270 +" subs %0, %0, %4\n"
1271 " sbc %H0, %H0, %H4\n"
1272 " strexd %1, %0, %H0, [%3]\n"
1273 " teq %1, #0\n"
1274 @@ -329,18 +648,32 @@ static inline void atomic64_sub(u64 i, atomic64_t *v)
1275
1276 static inline u64 atomic64_sub_return(u64 i, atomic64_t *v)
1277 {
1278 - u64 result;
1279 - unsigned long tmp;
1280 + u64 result, tmp;
1281
1282 smp_mb();
1283
1284 __asm__ __volatile__("@ atomic64_sub_return\n"
1285 -"1: ldrexd %0, %H0, [%3]\n"
1286 -" subs %0, %0, %4\n"
1287 -" sbc %H0, %H0, %H4\n"
1288 +"1: ldrexd %1, %H1, [%3]\n"
1289 +" subs %0, %1, %4\n"
1290 +" sbcs %H0, %H1, %H4\n"
1291 +
1292 +#ifdef CONFIG_PAX_REFCOUNT
1293 +" bvc 3f\n"
1294 +" mov %0, %1\n"
1295 +" mov %H0, %H1\n"
1296 +"2: bkpt 0xf103\n"
1297 +"3:\n"
1298 +#endif
1299 +
1300 " strexd %1, %0, %H0, [%3]\n"
1301 " teq %1, #0\n"
1302 " bne 1b"
1303 +
1304 +#ifdef CONFIG_PAX_REFCOUNT
1305 +"\n4:\n"
1306 + _ASM_EXTABLE(2b, 4b)
1307 +#endif
1308 +
1309 : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
1310 : "r" (&v->counter), "r" (i)
1311 : "cc");
1312 @@ -374,6 +707,30 @@ static inline u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old, u64 new)
1313 return oldval;
1314 }
1315
1316 +static inline u64 atomic64_cmpxchg_unchecked(atomic64_unchecked_t *ptr, u64 old, u64 new)
1317 +{
1318 + u64 oldval;
1319 + unsigned long res;
1320 +
1321 + smp_mb();
1322 +
1323 + do {
1324 + __asm__ __volatile__("@ atomic64_cmpxchg_unchecked\n"
1325 + "ldrexd %1, %H1, [%3]\n"
1326 + "mov %0, #0\n"
1327 + "teq %1, %4\n"
1328 + "teqeq %H1, %H4\n"
1329 + "strexdeq %0, %5, %H5, [%3]"
1330 + : "=&r" (res), "=&r" (oldval), "+Qo" (ptr->counter)
1331 + : "r" (&ptr->counter), "r" (old), "r" (new)
1332 + : "cc");
1333 + } while (res);
1334 +
1335 + smp_mb();
1336 +
1337 + return oldval;
1338 +}
1339 +
1340 static inline u64 atomic64_xchg(atomic64_t *ptr, u64 new)
1341 {
1342 u64 result;
1343 @@ -397,21 +754,34 @@ static inline u64 atomic64_xchg(atomic64_t *ptr, u64 new)
1344
1345 static inline u64 atomic64_dec_if_positive(atomic64_t *v)
1346 {
1347 - u64 result;
1348 - unsigned long tmp;
1349 + u64 result, tmp;
1350
1351 smp_mb();
1352
1353 __asm__ __volatile__("@ atomic64_dec_if_positive\n"
1354 -"1: ldrexd %0, %H0, [%3]\n"
1355 -" subs %0, %0, #1\n"
1356 -" sbc %H0, %H0, #0\n"
1357 +"1: ldrexd %1, %H1, [%3]\n"
1358 +" subs %0, %1, #1\n"
1359 +" sbcs %H0, %H1, #0\n"
1360 +
1361 +#ifdef CONFIG_PAX_REFCOUNT
1362 +" bvc 3f\n"
1363 +" mov %0, %1\n"
1364 +" mov %H0, %H1\n"
1365 +"2: bkpt 0xf103\n"
1366 +"3:\n"
1367 +#endif
1368 +
1369 " teq %H0, #0\n"
1370 -" bmi 2f\n"
1371 +" bmi 4f\n"
1372 " strexd %1, %0, %H0, [%3]\n"
1373 " teq %1, #0\n"
1374 " bne 1b\n"
1375 -"2:"
1376 +"4:\n"
1377 +
1378 +#ifdef CONFIG_PAX_REFCOUNT
1379 + _ASM_EXTABLE(2b, 4b)
1380 +#endif
1381 +
1382 : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
1383 : "r" (&v->counter)
1384 : "cc");
1385 @@ -434,13 +804,25 @@ static inline int atomic64_add_unless(atomic64_t *v, u64 a, u64 u)
1386 " teq %0, %5\n"
1387 " teqeq %H0, %H5\n"
1388 " moveq %1, #0\n"
1389 -" beq 2f\n"
1390 +" beq 4f\n"
1391 " adds %0, %0, %6\n"
1392 -" adc %H0, %H0, %H6\n"
1393 +" adcs %H0, %H0, %H6\n"
1394 +
1395 +#ifdef CONFIG_PAX_REFCOUNT
1396 +" bvc 3f\n"
1397 +"2: bkpt 0xf103\n"
1398 +"3:\n"
1399 +#endif
1400 +
1401 " strexd %2, %0, %H0, [%4]\n"
1402 " teq %2, #0\n"
1403 " bne 1b\n"
1404 -"2:"
1405 +"4:\n"
1406 +
1407 +#ifdef CONFIG_PAX_REFCOUNT
1408 + _ASM_EXTABLE(2b, 4b)
1409 +#endif
1410 +
1411 : "=&r" (val), "+r" (ret), "=&r" (tmp), "+Qo" (v->counter)
1412 : "r" (&v->counter), "r" (u), "r" (a)
1413 : "cc");
1414 @@ -453,10 +835,13 @@ static inline int atomic64_add_unless(atomic64_t *v, u64 a, u64 u)
1415
1416 #define atomic64_add_negative(a, v) (atomic64_add_return((a), (v)) < 0)
1417 #define atomic64_inc(v) atomic64_add(1LL, (v))
1418 +#define atomic64_inc_unchecked(v) atomic64_add_unchecked(1LL, (v))
1419 #define atomic64_inc_return(v) atomic64_add_return(1LL, (v))
1420 +#define atomic64_inc_return_unchecked(v) atomic64_add_return_unchecked(1LL, (v))
1421 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
1422 #define atomic64_sub_and_test(a, v) (atomic64_sub_return((a), (v)) == 0)
1423 #define atomic64_dec(v) atomic64_sub(1LL, (v))
1424 +#define atomic64_dec_unchecked(v) atomic64_sub_unchecked(1LL, (v))
1425 #define atomic64_dec_return(v) atomic64_sub_return(1LL, (v))
1426 #define atomic64_dec_and_test(v) (atomic64_dec_return((v)) == 0)
1427 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1LL, 0LL)
1428 diff --git a/arch/arm/include/asm/cache.h b/arch/arm/include/asm/cache.h
1429 index 75fe66b..2255c86 100644
1430 --- a/arch/arm/include/asm/cache.h
1431 +++ b/arch/arm/include/asm/cache.h
1432 @@ -4,8 +4,10 @@
1433 #ifndef __ASMARM_CACHE_H
1434 #define __ASMARM_CACHE_H
1435
1436 +#include <linux/const.h>
1437 +
1438 #define L1_CACHE_SHIFT CONFIG_ARM_L1_CACHE_SHIFT
1439 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
1440 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
1441
1442 /*
1443 * Memory returned by kmalloc() may be used for DMA, so we must make
1444 diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
1445 index e4448e1..7bc86b7 100644
1446 --- a/arch/arm/include/asm/cacheflush.h
1447 +++ b/arch/arm/include/asm/cacheflush.h
1448 @@ -108,7 +108,7 @@ struct cpu_cache_fns {
1449 void (*dma_unmap_area)(const void *, size_t, int);
1450
1451 void (*dma_flush_range)(const void *, const void *);
1452 -};
1453 +} __no_const;
1454
1455 /*
1456 * Select the calling method
1457 diff --git a/arch/arm/include/asm/cmpxchg.h b/arch/arm/include/asm/cmpxchg.h
1458 index 7eb18c1..e38b6d2 100644
1459 --- a/arch/arm/include/asm/cmpxchg.h
1460 +++ b/arch/arm/include/asm/cmpxchg.h
1461 @@ -102,6 +102,8 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, int size
1462
1463 #define xchg(ptr,x) \
1464 ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
1465 +#define xchg_unchecked(ptr,x) \
1466 + ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
1467
1468 #include <asm-generic/cmpxchg-local.h>
1469
1470 diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
1471 index 38050b1..9d90e8b 100644
1472 --- a/arch/arm/include/asm/elf.h
1473 +++ b/arch/arm/include/asm/elf.h
1474 @@ -116,7 +116,14 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
1475 the loader. We need to make sure that it is out of the way of the program
1476 that it will "exec", and that there is sufficient room for the brk. */
1477
1478 -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
1479 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1480 +
1481 +#ifdef CONFIG_PAX_ASLR
1482 +#define PAX_ELF_ET_DYN_BASE 0x00008000UL
1483 +
1484 +#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
1485 +#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
1486 +#endif
1487
1488 /* When the program starts, a1 contains a pointer to a function to be
1489 registered with atexit, as per the SVR4 ABI. A value of 0 means we
1490 @@ -126,8 +133,4 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
1491 extern void elf_set_personality(const struct elf32_hdr *);
1492 #define SET_PERSONALITY(ex) elf_set_personality(&(ex))
1493
1494 -struct mm_struct;
1495 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
1496 -#define arch_randomize_brk arch_randomize_brk
1497 -
1498 #endif
1499 diff --git a/arch/arm/include/asm/kmap_types.h b/arch/arm/include/asm/kmap_types.h
1500 index e51b1e8..32a3113 100644
1501 --- a/arch/arm/include/asm/kmap_types.h
1502 +++ b/arch/arm/include/asm/kmap_types.h
1503 @@ -21,6 +21,7 @@ enum km_type {
1504 KM_L1_CACHE,
1505 KM_L2_CACHE,
1506 KM_KDB,
1507 + KM_CLEARPAGE,
1508 KM_TYPE_NR
1509 };
1510
1511 diff --git a/arch/arm/include/asm/outercache.h b/arch/arm/include/asm/outercache.h
1512 index 53426c6..c7baff3 100644
1513 --- a/arch/arm/include/asm/outercache.h
1514 +++ b/arch/arm/include/asm/outercache.h
1515 @@ -35,7 +35,7 @@ struct outer_cache_fns {
1516 #endif
1517 void (*set_debug)(unsigned long);
1518 void (*resume)(void);
1519 -};
1520 +} __no_const;
1521
1522 #ifdef CONFIG_OUTER_CACHE
1523
1524 diff --git a/arch/arm/include/asm/page.h b/arch/arm/include/asm/page.h
1525 index ecf9019..b71d9a1 100644
1526 --- a/arch/arm/include/asm/page.h
1527 +++ b/arch/arm/include/asm/page.h
1528 @@ -114,7 +114,7 @@ struct cpu_user_fns {
1529 void (*cpu_clear_user_highpage)(struct page *page, unsigned long vaddr);
1530 void (*cpu_copy_user_highpage)(struct page *to, struct page *from,
1531 unsigned long vaddr, struct vm_area_struct *vma);
1532 -};
1533 +} __no_const;
1534
1535 #ifdef MULTI_USER
1536 extern struct cpu_user_fns cpu_user;
1537 diff --git a/arch/arm/include/asm/pgalloc.h b/arch/arm/include/asm/pgalloc.h
1538 index 943504f..bf8d667 100644
1539 --- a/arch/arm/include/asm/pgalloc.h
1540 +++ b/arch/arm/include/asm/pgalloc.h
1541 @@ -43,6 +43,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
1542 set_pud(pud, __pud(__pa(pmd) | PMD_TYPE_TABLE));
1543 }
1544
1545 +static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
1546 +{
1547 + pud_populate(mm, pud, pmd);
1548 +}
1549 +
1550 #else /* !CONFIG_ARM_LPAE */
1551
1552 /*
1553 @@ -51,6 +56,7 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
1554 #define pmd_alloc_one(mm,addr) ({ BUG(); ((pmd_t *)2); })
1555 #define pmd_free(mm, pmd) do { } while (0)
1556 #define pud_populate(mm,pmd,pte) BUG()
1557 +#define pud_populate_kernel(mm,pmd,pte) BUG()
1558
1559 #endif /* CONFIG_ARM_LPAE */
1560
1561 diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
1562 index af7b0bd..6750a8c 100644
1563 --- a/arch/arm/include/asm/thread_info.h
1564 +++ b/arch/arm/include/asm/thread_info.h
1565 @@ -148,6 +148,12 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
1566 #define TIF_NOTIFY_RESUME 2 /* callback before returning to user */
1567 #define TIF_SYSCALL_TRACE 8
1568 #define TIF_SYSCALL_AUDIT 9
1569 +
1570 +/* within 8 bits of TIF_SYSCALL_TRACE
1571 + to meet flexible second operand requirements
1572 +*/
1573 +#define TIF_GRSEC_SETXID 10
1574 +
1575 #define TIF_POLLING_NRFLAG 16
1576 #define TIF_USING_IWMMXT 17
1577 #define TIF_MEMDIE 18 /* is terminating due to OOM killer */
1578 @@ -163,9 +169,11 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
1579 #define _TIF_POLLING_NRFLAG (1 << TIF_POLLING_NRFLAG)
1580 #define _TIF_USING_IWMMXT (1 << TIF_USING_IWMMXT)
1581 #define _TIF_SECCOMP (1 << TIF_SECCOMP)
1582 +#define _TIF_GRSEC_SETXID (1 << TIF_GRSEC_SETXID)
1583
1584 /* Checks for any syscall work in entry-common.S */
1585 -#define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT)
1586 +#define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \
1587 + _TIF_GRSEC_SETXID)
1588
1589 /*
1590 * Change these and you break ASM code in entry-common.S
1591 diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
1592 index 71f6536..602f279 100644
1593 --- a/arch/arm/include/asm/uaccess.h
1594 +++ b/arch/arm/include/asm/uaccess.h
1595 @@ -22,6 +22,8 @@
1596 #define VERIFY_READ 0
1597 #define VERIFY_WRITE 1
1598
1599 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
1600 +
1601 /*
1602 * The exception table consists of pairs of addresses: the first is the
1603 * address of an instruction that is allowed to fault, and the second is
1604 @@ -387,8 +389,23 @@ do { \
1605
1606
1607 #ifdef CONFIG_MMU
1608 -extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
1609 -extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
1610 +extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n);
1611 +extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n);
1612 +
1613 +static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
1614 +{
1615 + if (!__builtin_constant_p(n))
1616 + check_object_size(to, n, false);
1617 + return ___copy_from_user(to, from, n);
1618 +}
1619 +
1620 +static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
1621 +{
1622 + if (!__builtin_constant_p(n))
1623 + check_object_size(from, n, true);
1624 + return ___copy_to_user(to, from, n);
1625 +}
1626 +
1627 extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
1628 extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
1629 extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
1630 @@ -403,6 +420,9 @@ extern unsigned long __must_check __strnlen_user(const char __user *s, long n);
1631
1632 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
1633 {
1634 + if ((long)n < 0)
1635 + return n;
1636 +
1637 if (access_ok(VERIFY_READ, from, n))
1638 n = __copy_from_user(to, from, n);
1639 else /* security hole - plug it */
1640 @@ -412,6 +432,9 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __u
1641
1642 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
1643 {
1644 + if ((long)n < 0)
1645 + return n;
1646 +
1647 if (access_ok(VERIFY_WRITE, to, n))
1648 n = __copy_to_user(to, from, n);
1649 return n;
1650 diff --git a/arch/arm/kernel/armksyms.c b/arch/arm/kernel/armksyms.c
1651 index b57c75e..ed2d6b2 100644
1652 --- a/arch/arm/kernel/armksyms.c
1653 +++ b/arch/arm/kernel/armksyms.c
1654 @@ -94,8 +94,8 @@ EXPORT_SYMBOL(__strncpy_from_user);
1655 #ifdef CONFIG_MMU
1656 EXPORT_SYMBOL(copy_page);
1657
1658 -EXPORT_SYMBOL(__copy_from_user);
1659 -EXPORT_SYMBOL(__copy_to_user);
1660 +EXPORT_SYMBOL(___copy_from_user);
1661 +EXPORT_SYMBOL(___copy_to_user);
1662 EXPORT_SYMBOL(__clear_user);
1663
1664 EXPORT_SYMBOL(__get_user_1);
1665 diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
1666 index 693b744..e684262 100644
1667 --- a/arch/arm/kernel/process.c
1668 +++ b/arch/arm/kernel/process.c
1669 @@ -28,7 +28,6 @@
1670 #include <linux/tick.h>
1671 #include <linux/utsname.h>
1672 #include <linux/uaccess.h>
1673 -#include <linux/random.h>
1674 #include <linux/hw_breakpoint.h>
1675 #include <linux/cpuidle.h>
1676
1677 @@ -256,9 +255,10 @@ void machine_power_off(void)
1678 machine_shutdown();
1679 if (pm_power_off)
1680 pm_power_off();
1681 + BUG();
1682 }
1683
1684 -void machine_restart(char *cmd)
1685 +__noreturn void machine_restart(char *cmd)
1686 {
1687 machine_shutdown();
1688
1689 @@ -501,12 +501,6 @@ unsigned long get_wchan(struct task_struct *p)
1690 return 0;
1691 }
1692
1693 -unsigned long arch_randomize_brk(struct mm_struct *mm)
1694 -{
1695 - unsigned long range_end = mm->brk + 0x02000000;
1696 - return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
1697 -}
1698 -
1699 #ifdef CONFIG_MMU
1700 /*
1701 * The vectors page is always readable from user space for the
1702 diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
1703 index 14e3826..d832d89 100644
1704 --- a/arch/arm/kernel/ptrace.c
1705 +++ b/arch/arm/kernel/ptrace.c
1706 @@ -907,10 +907,19 @@ long arch_ptrace(struct task_struct *child, long request,
1707 return ret;
1708 }
1709
1710 +#ifdef CONFIG_GRKERNSEC_SETXID
1711 +extern void gr_delayed_cred_worker(void);
1712 +#endif
1713 +
1714 asmlinkage int syscall_trace(int why, struct pt_regs *regs, int scno)
1715 {
1716 unsigned long ip;
1717
1718 +#ifdef CONFIG_GRKERNSEC_SETXID
1719 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
1720 + gr_delayed_cred_worker();
1721 +#endif
1722 +
1723 if (why)
1724 audit_syscall_exit(regs);
1725 else
1726 diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
1727 index e15d83b..8c466dd 100644
1728 --- a/arch/arm/kernel/setup.c
1729 +++ b/arch/arm/kernel/setup.c
1730 @@ -112,13 +112,13 @@ struct processor processor __read_mostly;
1731 struct cpu_tlb_fns cpu_tlb __read_mostly;
1732 #endif
1733 #ifdef MULTI_USER
1734 -struct cpu_user_fns cpu_user __read_mostly;
1735 +struct cpu_user_fns cpu_user __read_only;
1736 #endif
1737 #ifdef MULTI_CACHE
1738 -struct cpu_cache_fns cpu_cache __read_mostly;
1739 +struct cpu_cache_fns cpu_cache __read_only;
1740 #endif
1741 #ifdef CONFIG_OUTER_CACHE
1742 -struct outer_cache_fns outer_cache __read_mostly;
1743 +struct outer_cache_fns outer_cache __read_only;
1744 EXPORT_SYMBOL(outer_cache);
1745 #endif
1746
1747 diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
1748 index c7cae6b..e1e523c 100644
1749 --- a/arch/arm/kernel/traps.c
1750 +++ b/arch/arm/kernel/traps.c
1751 @@ -264,6 +264,8 @@ static int __die(const char *str, int err, struct thread_info *thread, struct pt
1752
1753 static DEFINE_RAW_SPINLOCK(die_lock);
1754
1755 +extern void gr_handle_kernel_exploit(void);
1756 +
1757 /*
1758 * This function is protected against re-entrancy.
1759 */
1760 @@ -296,6 +298,9 @@ void die(const char *str, struct pt_regs *regs, int err)
1761 panic("Fatal exception in interrupt");
1762 if (panic_on_oops)
1763 panic("Fatal exception");
1764 +
1765 + gr_handle_kernel_exploit();
1766 +
1767 if (ret != NOTIFY_STOP)
1768 do_exit(SIGSEGV);
1769 }
1770 diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
1771 index 66a477a..bee61d3 100644
1772 --- a/arch/arm/lib/copy_from_user.S
1773 +++ b/arch/arm/lib/copy_from_user.S
1774 @@ -16,7 +16,7 @@
1775 /*
1776 * Prototype:
1777 *
1778 - * size_t __copy_from_user(void *to, const void *from, size_t n)
1779 + * size_t ___copy_from_user(void *to, const void *from, size_t n)
1780 *
1781 * Purpose:
1782 *
1783 @@ -84,11 +84,11 @@
1784
1785 .text
1786
1787 -ENTRY(__copy_from_user)
1788 +ENTRY(___copy_from_user)
1789
1790 #include "copy_template.S"
1791
1792 -ENDPROC(__copy_from_user)
1793 +ENDPROC(___copy_from_user)
1794
1795 .pushsection .fixup,"ax"
1796 .align 0
1797 diff --git a/arch/arm/lib/copy_page.S b/arch/arm/lib/copy_page.S
1798 index 6ee2f67..d1cce76 100644
1799 --- a/arch/arm/lib/copy_page.S
1800 +++ b/arch/arm/lib/copy_page.S
1801 @@ -10,6 +10,7 @@
1802 * ASM optimised string functions
1803 */
1804 #include <linux/linkage.h>
1805 +#include <linux/const.h>
1806 #include <asm/assembler.h>
1807 #include <asm/asm-offsets.h>
1808 #include <asm/cache.h>
1809 diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S
1810 index d066df6..df28194 100644
1811 --- a/arch/arm/lib/copy_to_user.S
1812 +++ b/arch/arm/lib/copy_to_user.S
1813 @@ -16,7 +16,7 @@
1814 /*
1815 * Prototype:
1816 *
1817 - * size_t __copy_to_user(void *to, const void *from, size_t n)
1818 + * size_t ___copy_to_user(void *to, const void *from, size_t n)
1819 *
1820 * Purpose:
1821 *
1822 @@ -88,11 +88,11 @@
1823 .text
1824
1825 ENTRY(__copy_to_user_std)
1826 -WEAK(__copy_to_user)
1827 +WEAK(___copy_to_user)
1828
1829 #include "copy_template.S"
1830
1831 -ENDPROC(__copy_to_user)
1832 +ENDPROC(___copy_to_user)
1833 ENDPROC(__copy_to_user_std)
1834
1835 .pushsection .fixup,"ax"
1836 diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
1837 index 025f742..8432b08 100644
1838 --- a/arch/arm/lib/uaccess_with_memcpy.c
1839 +++ b/arch/arm/lib/uaccess_with_memcpy.c
1840 @@ -104,7 +104,7 @@ out:
1841 }
1842
1843 unsigned long
1844 -__copy_to_user(void __user *to, const void *from, unsigned long n)
1845 +___copy_to_user(void __user *to, const void *from, unsigned long n)
1846 {
1847 /*
1848 * This test is stubbed out of the main function above to keep
1849 diff --git a/arch/arm/mach-kirkwood/common.c b/arch/arm/mach-kirkwood/common.c
1850 index f261cd2..4ae63fb 100644
1851 --- a/arch/arm/mach-kirkwood/common.c
1852 +++ b/arch/arm/mach-kirkwood/common.c
1853 @@ -128,7 +128,7 @@ static void clk_gate_fn_disable(struct clk_hw *hw)
1854 clk_gate_ops.disable(hw);
1855 }
1856
1857 -static struct clk_ops clk_gate_fn_ops;
1858 +static clk_ops_no_const clk_gate_fn_ops;
1859
1860 static struct clk __init *clk_register_gate_fn(struct device *dev,
1861 const char *name,
1862 diff --git a/arch/arm/mach-omap2/board-n8x0.c b/arch/arm/mach-omap2/board-n8x0.c
1863 index 2c5d0ed..7d9099c 100644
1864 --- a/arch/arm/mach-omap2/board-n8x0.c
1865 +++ b/arch/arm/mach-omap2/board-n8x0.c
1866 @@ -594,7 +594,7 @@ static int n8x0_menelaus_late_init(struct device *dev)
1867 }
1868 #endif
1869
1870 -static struct menelaus_platform_data n8x0_menelaus_platform_data __initdata = {
1871 +static struct menelaus_platform_data n8x0_menelaus_platform_data __initconst = {
1872 .late_init = n8x0_menelaus_late_init,
1873 };
1874
1875 diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
1876 index c3bd834..e81ef02 100644
1877 --- a/arch/arm/mm/fault.c
1878 +++ b/arch/arm/mm/fault.c
1879 @@ -174,6 +174,13 @@ __do_user_fault(struct task_struct *tsk, unsigned long addr,
1880 }
1881 #endif
1882
1883 +#ifdef CONFIG_PAX_PAGEEXEC
1884 + if (fsr & FSR_LNX_PF) {
1885 + pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
1886 + do_group_exit(SIGKILL);
1887 + }
1888 +#endif
1889 +
1890 tsk->thread.address = addr;
1891 tsk->thread.error_code = fsr;
1892 tsk->thread.trap_no = 14;
1893 @@ -397,6 +404,33 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
1894 }
1895 #endif /* CONFIG_MMU */
1896
1897 +#ifdef CONFIG_PAX_PAGEEXEC
1898 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
1899 +{
1900 + long i;
1901 +
1902 + printk(KERN_ERR "PAX: bytes at PC: ");
1903 + for (i = 0; i < 20; i++) {
1904 + unsigned char c;
1905 + if (get_user(c, (__force unsigned char __user *)pc+i))
1906 + printk(KERN_CONT "?? ");
1907 + else
1908 + printk(KERN_CONT "%02x ", c);
1909 + }
1910 + printk("\n");
1911 +
1912 + printk(KERN_ERR "PAX: bytes at SP-4: ");
1913 + for (i = -1; i < 20; i++) {
1914 + unsigned long c;
1915 + if (get_user(c, (__force unsigned long __user *)sp+i))
1916 + printk(KERN_CONT "???????? ");
1917 + else
1918 + printk(KERN_CONT "%08lx ", c);
1919 + }
1920 + printk("\n");
1921 +}
1922 +#endif
1923 +
1924 /*
1925 * First Level Translation Fault Handler
1926 *
1927 @@ -574,6 +608,20 @@ do_PrefetchAbort(unsigned long addr, unsigned int ifsr, struct pt_regs *regs)
1928 const struct fsr_info *inf = ifsr_info + fsr_fs(ifsr);
1929 struct siginfo info;
1930
1931 +#ifdef CONFIG_PAX_REFCOUNT
1932 + if (fsr_fs(ifsr) == 2) {
1933 + unsigned int bkpt;
1934 +
1935 + if (!probe_kernel_address((unsigned int *)addr, bkpt) && bkpt == 0xe12f1073) {
1936 + current->thread.error_code = ifsr;
1937 + current->thread.trap_no = 0;
1938 + pax_report_refcount_overflow(regs);
1939 + fixup_exception(regs);
1940 + return;
1941 + }
1942 + }
1943 +#endif
1944 +
1945 if (!inf->fn(addr, ifsr | FSR_LNX_PF, regs))
1946 return;
1947
1948 diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
1949 index ce8cb19..3ec539d 100644
1950 --- a/arch/arm/mm/mmap.c
1951 +++ b/arch/arm/mm/mmap.c
1952 @@ -93,6 +93,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
1953 if (len > TASK_SIZE)
1954 return -ENOMEM;
1955
1956 +#ifdef CONFIG_PAX_RANDMMAP
1957 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
1958 +#endif
1959 +
1960 if (addr) {
1961 if (do_align)
1962 addr = COLOUR_ALIGN(addr, pgoff);
1963 @@ -100,15 +104,14 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
1964 addr = PAGE_ALIGN(addr);
1965
1966 vma = find_vma(mm, addr);
1967 - if (TASK_SIZE - len >= addr &&
1968 - (!vma || addr + len <= vma->vm_start))
1969 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
1970 return addr;
1971 }
1972 if (len > mm->cached_hole_size) {
1973 - start_addr = addr = mm->free_area_cache;
1974 + start_addr = addr = mm->free_area_cache;
1975 } else {
1976 - start_addr = addr = mm->mmap_base;
1977 - mm->cached_hole_size = 0;
1978 + start_addr = addr = mm->mmap_base;
1979 + mm->cached_hole_size = 0;
1980 }
1981
1982 full_search:
1983 @@ -124,14 +127,14 @@ full_search:
1984 * Start a new search - just in case we missed
1985 * some holes.
1986 */
1987 - if (start_addr != TASK_UNMAPPED_BASE) {
1988 - start_addr = addr = TASK_UNMAPPED_BASE;
1989 + if (start_addr != mm->mmap_base) {
1990 + start_addr = addr = mm->mmap_base;
1991 mm->cached_hole_size = 0;
1992 goto full_search;
1993 }
1994 return -ENOMEM;
1995 }
1996 - if (!vma || addr + len <= vma->vm_start) {
1997 + if (check_heap_stack_gap(vma, addr, len)) {
1998 /*
1999 * Remember the place where we stopped the search:
2000 */
2001 @@ -266,10 +269,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
2002
2003 if (mmap_is_legacy()) {
2004 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
2005 +
2006 +#ifdef CONFIG_PAX_RANDMMAP
2007 + if (mm->pax_flags & MF_PAX_RANDMMAP)
2008 + mm->mmap_base += mm->delta_mmap;
2009 +#endif
2010 +
2011 mm->get_unmapped_area = arch_get_unmapped_area;
2012 mm->unmap_area = arch_unmap_area;
2013 } else {
2014 mm->mmap_base = mmap_base(random_factor);
2015 +
2016 +#ifdef CONFIG_PAX_RANDMMAP
2017 + if (mm->pax_flags & MF_PAX_RANDMMAP)
2018 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
2019 +#endif
2020 +
2021 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
2022 mm->unmap_area = arch_unmap_area_topdown;
2023 }
2024 diff --git a/arch/arm/plat-orion/include/plat/addr-map.h b/arch/arm/plat-orion/include/plat/addr-map.h
2025 index fd556f7..af2e7d2 100644
2026 --- a/arch/arm/plat-orion/include/plat/addr-map.h
2027 +++ b/arch/arm/plat-orion/include/plat/addr-map.h
2028 @@ -26,7 +26,7 @@ struct orion_addr_map_cfg {
2029 value in bridge_virt_base */
2030 void __iomem *(*win_cfg_base) (const struct orion_addr_map_cfg *cfg,
2031 const int win);
2032 -};
2033 +} __no_const;
2034
2035 /*
2036 * Information needed to setup one address mapping.
2037 diff --git a/arch/arm/plat-samsung/include/plat/dma-ops.h b/arch/arm/plat-samsung/include/plat/dma-ops.h
2038 index 71a6827..e7fbc23 100644
2039 --- a/arch/arm/plat-samsung/include/plat/dma-ops.h
2040 +++ b/arch/arm/plat-samsung/include/plat/dma-ops.h
2041 @@ -43,7 +43,7 @@ struct samsung_dma_ops {
2042 int (*started)(unsigned ch);
2043 int (*flush)(unsigned ch);
2044 int (*stop)(unsigned ch);
2045 -};
2046 +} __no_const;
2047
2048 extern void *samsung_dmadev_get_ops(void);
2049 extern void *s3c_dma_get_ops(void);
2050 diff --git a/arch/arm/plat-samsung/include/plat/ehci.h b/arch/arm/plat-samsung/include/plat/ehci.h
2051 index 5f28cae..3d23723 100644
2052 --- a/arch/arm/plat-samsung/include/plat/ehci.h
2053 +++ b/arch/arm/plat-samsung/include/plat/ehci.h
2054 @@ -14,7 +14,7 @@
2055 struct s5p_ehci_platdata {
2056 int (*phy_init)(struct platform_device *pdev, int type);
2057 int (*phy_exit)(struct platform_device *pdev, int type);
2058 -};
2059 +} __no_const;
2060
2061 extern void s5p_ehci_set_platdata(struct s5p_ehci_platdata *pd);
2062
2063 diff --git a/arch/avr32/include/asm/cache.h b/arch/avr32/include/asm/cache.h
2064 index c3a58a1..78fbf54 100644
2065 --- a/arch/avr32/include/asm/cache.h
2066 +++ b/arch/avr32/include/asm/cache.h
2067 @@ -1,8 +1,10 @@
2068 #ifndef __ASM_AVR32_CACHE_H
2069 #define __ASM_AVR32_CACHE_H
2070
2071 +#include <linux/const.h>
2072 +
2073 #define L1_CACHE_SHIFT 5
2074 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
2075 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
2076
2077 /*
2078 * Memory returned by kmalloc() may be used for DMA, so we must make
2079 diff --git a/arch/avr32/include/asm/elf.h b/arch/avr32/include/asm/elf.h
2080 index 3b3159b..425ea94 100644
2081 --- a/arch/avr32/include/asm/elf.h
2082 +++ b/arch/avr32/include/asm/elf.h
2083 @@ -84,8 +84,14 @@ typedef struct user_fpu_struct elf_fpregset_t;
2084 the loader. We need to make sure that it is out of the way of the program
2085 that it will "exec", and that there is sufficient room for the brk. */
2086
2087 -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
2088 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
2089
2090 +#ifdef CONFIG_PAX_ASLR
2091 +#define PAX_ELF_ET_DYN_BASE 0x00001000UL
2092 +
2093 +#define PAX_DELTA_MMAP_LEN 15
2094 +#define PAX_DELTA_STACK_LEN 15
2095 +#endif
2096
2097 /* This yields a mask that user programs can use to figure out what
2098 instruction set this CPU supports. This could be done in user space,
2099 diff --git a/arch/avr32/include/asm/kmap_types.h b/arch/avr32/include/asm/kmap_types.h
2100 index b7f5c68..556135c 100644
2101 --- a/arch/avr32/include/asm/kmap_types.h
2102 +++ b/arch/avr32/include/asm/kmap_types.h
2103 @@ -22,7 +22,8 @@ D(10) KM_IRQ0,
2104 D(11) KM_IRQ1,
2105 D(12) KM_SOFTIRQ0,
2106 D(13) KM_SOFTIRQ1,
2107 -D(14) KM_TYPE_NR
2108 +D(14) KM_CLEARPAGE,
2109 +D(15) KM_TYPE_NR
2110 };
2111
2112 #undef D
2113 diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
2114 index f7040a1..db9f300 100644
2115 --- a/arch/avr32/mm/fault.c
2116 +++ b/arch/avr32/mm/fault.c
2117 @@ -41,6 +41,23 @@ static inline int notify_page_fault(struct pt_regs *regs, int trap)
2118
2119 int exception_trace = 1;
2120
2121 +#ifdef CONFIG_PAX_PAGEEXEC
2122 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
2123 +{
2124 + unsigned long i;
2125 +
2126 + printk(KERN_ERR "PAX: bytes at PC: ");
2127 + for (i = 0; i < 20; i++) {
2128 + unsigned char c;
2129 + if (get_user(c, (unsigned char *)pc+i))
2130 + printk(KERN_CONT "???????? ");
2131 + else
2132 + printk(KERN_CONT "%02x ", c);
2133 + }
2134 + printk("\n");
2135 +}
2136 +#endif
2137 +
2138 /*
2139 * This routine handles page faults. It determines the address and the
2140 * problem, and then passes it off to one of the appropriate routines.
2141 @@ -156,6 +173,16 @@ bad_area:
2142 up_read(&mm->mmap_sem);
2143
2144 if (user_mode(regs)) {
2145 +
2146 +#ifdef CONFIG_PAX_PAGEEXEC
2147 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
2148 + if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
2149 + pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
2150 + do_group_exit(SIGKILL);
2151 + }
2152 + }
2153 +#endif
2154 +
2155 if (exception_trace && printk_ratelimit())
2156 printk("%s%s[%d]: segfault at %08lx pc %08lx "
2157 "sp %08lx ecr %lu\n",
2158 diff --git a/arch/blackfin/include/asm/cache.h b/arch/blackfin/include/asm/cache.h
2159 index 568885a..f8008df 100644
2160 --- a/arch/blackfin/include/asm/cache.h
2161 +++ b/arch/blackfin/include/asm/cache.h
2162 @@ -7,6 +7,7 @@
2163 #ifndef __ARCH_BLACKFIN_CACHE_H
2164 #define __ARCH_BLACKFIN_CACHE_H
2165
2166 +#include <linux/const.h>
2167 #include <linux/linkage.h> /* for asmlinkage */
2168
2169 /*
2170 @@ -14,7 +15,7 @@
2171 * Blackfin loads 32 bytes for cache
2172 */
2173 #define L1_CACHE_SHIFT 5
2174 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
2175 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
2176 #define SMP_CACHE_BYTES L1_CACHE_BYTES
2177
2178 #define ARCH_DMA_MINALIGN L1_CACHE_BYTES
2179 diff --git a/arch/cris/include/arch-v10/arch/cache.h b/arch/cris/include/arch-v10/arch/cache.h
2180 index aea2718..3639a60 100644
2181 --- a/arch/cris/include/arch-v10/arch/cache.h
2182 +++ b/arch/cris/include/arch-v10/arch/cache.h
2183 @@ -1,8 +1,9 @@
2184 #ifndef _ASM_ARCH_CACHE_H
2185 #define _ASM_ARCH_CACHE_H
2186
2187 +#include <linux/const.h>
2188 /* Etrax 100LX have 32-byte cache-lines. */
2189 -#define L1_CACHE_BYTES 32
2190 #define L1_CACHE_SHIFT 5
2191 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
2192
2193 #endif /* _ASM_ARCH_CACHE_H */
2194 diff --git a/arch/cris/include/arch-v32/arch/cache.h b/arch/cris/include/arch-v32/arch/cache.h
2195 index 7caf25d..ee65ac5 100644
2196 --- a/arch/cris/include/arch-v32/arch/cache.h
2197 +++ b/arch/cris/include/arch-v32/arch/cache.h
2198 @@ -1,11 +1,12 @@
2199 #ifndef _ASM_CRIS_ARCH_CACHE_H
2200 #define _ASM_CRIS_ARCH_CACHE_H
2201
2202 +#include <linux/const.h>
2203 #include <arch/hwregs/dma.h>
2204
2205 /* A cache-line is 32 bytes. */
2206 -#define L1_CACHE_BYTES 32
2207 #define L1_CACHE_SHIFT 5
2208 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
2209
2210 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
2211
2212 diff --git a/arch/frv/include/asm/atomic.h b/arch/frv/include/asm/atomic.h
2213 index b86329d..6709906 100644
2214 --- a/arch/frv/include/asm/atomic.h
2215 +++ b/arch/frv/include/asm/atomic.h
2216 @@ -186,6 +186,16 @@ static inline void atomic64_dec(atomic64_t *v)
2217 #define atomic64_cmpxchg(v, old, new) (__cmpxchg_64(old, new, &(v)->counter))
2218 #define atomic64_xchg(v, new) (__xchg_64(new, &(v)->counter))
2219
2220 +#define atomic64_read_unchecked(v) atomic64_read(v)
2221 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
2222 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
2223 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
2224 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
2225 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
2226 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
2227 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
2228 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
2229 +
2230 static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
2231 {
2232 int c, old;
2233 diff --git a/arch/frv/include/asm/cache.h b/arch/frv/include/asm/cache.h
2234 index 2797163..c2a401d 100644
2235 --- a/arch/frv/include/asm/cache.h
2236 +++ b/arch/frv/include/asm/cache.h
2237 @@ -12,10 +12,11 @@
2238 #ifndef __ASM_CACHE_H
2239 #define __ASM_CACHE_H
2240
2241 +#include <linux/const.h>
2242
2243 /* bytes per L1 cache line */
2244 #define L1_CACHE_SHIFT (CONFIG_FRV_L1_CACHE_SHIFT)
2245 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
2246 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
2247
2248 #define __cacheline_aligned __attribute__((aligned(L1_CACHE_BYTES)))
2249 #define ____cacheline_aligned __attribute__((aligned(L1_CACHE_BYTES)))
2250 diff --git a/arch/frv/include/asm/kmap_types.h b/arch/frv/include/asm/kmap_types.h
2251 index f8e16b2..c73ff79 100644
2252 --- a/arch/frv/include/asm/kmap_types.h
2253 +++ b/arch/frv/include/asm/kmap_types.h
2254 @@ -23,6 +23,7 @@ enum km_type {
2255 KM_IRQ1,
2256 KM_SOFTIRQ0,
2257 KM_SOFTIRQ1,
2258 + KM_CLEARPAGE,
2259 KM_TYPE_NR
2260 };
2261
2262 diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c
2263 index 385fd30..6c3d97e 100644
2264 --- a/arch/frv/mm/elf-fdpic.c
2265 +++ b/arch/frv/mm/elf-fdpic.c
2266 @@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
2267 if (addr) {
2268 addr = PAGE_ALIGN(addr);
2269 vma = find_vma(current->mm, addr);
2270 - if (TASK_SIZE - len >= addr &&
2271 - (!vma || addr + len <= vma->vm_start))
2272 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
2273 goto success;
2274 }
2275
2276 @@ -89,7 +88,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
2277 for (; vma; vma = vma->vm_next) {
2278 if (addr > limit)
2279 break;
2280 - if (addr + len <= vma->vm_start)
2281 + if (check_heap_stack_gap(vma, addr, len))
2282 goto success;
2283 addr = vma->vm_end;
2284 }
2285 @@ -104,7 +103,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
2286 for (; vma; vma = vma->vm_next) {
2287 if (addr > limit)
2288 break;
2289 - if (addr + len <= vma->vm_start)
2290 + if (check_heap_stack_gap(vma, addr, len))
2291 goto success;
2292 addr = vma->vm_end;
2293 }
2294 diff --git a/arch/h8300/include/asm/cache.h b/arch/h8300/include/asm/cache.h
2295 index c635028..6d9445a 100644
2296 --- a/arch/h8300/include/asm/cache.h
2297 +++ b/arch/h8300/include/asm/cache.h
2298 @@ -1,8 +1,10 @@
2299 #ifndef __ARCH_H8300_CACHE_H
2300 #define __ARCH_H8300_CACHE_H
2301
2302 +#include <linux/const.h>
2303 +
2304 /* bytes per L1 cache line */
2305 -#define L1_CACHE_BYTES 4
2306 +#define L1_CACHE_BYTES _AC(4,UL)
2307
2308 /* m68k-elf-gcc 2.95.2 doesn't like these */
2309
2310 diff --git a/arch/hexagon/include/asm/cache.h b/arch/hexagon/include/asm/cache.h
2311 index 0f01de2..d37d309 100644
2312 --- a/arch/hexagon/include/asm/cache.h
2313 +++ b/arch/hexagon/include/asm/cache.h
2314 @@ -21,9 +21,11 @@
2315 #ifndef __ASM_CACHE_H
2316 #define __ASM_CACHE_H
2317
2318 +#include <linux/const.h>
2319 +
2320 /* Bytes per L1 cache line */
2321 -#define L1_CACHE_SHIFT (5)
2322 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
2323 +#define L1_CACHE_SHIFT 5
2324 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
2325
2326 #define __cacheline_aligned __aligned(L1_CACHE_BYTES)
2327 #define ____cacheline_aligned __aligned(L1_CACHE_BYTES)
2328 diff --git a/arch/ia64/include/asm/atomic.h b/arch/ia64/include/asm/atomic.h
2329 index 6e6fe18..a6ae668 100644
2330 --- a/arch/ia64/include/asm/atomic.h
2331 +++ b/arch/ia64/include/asm/atomic.h
2332 @@ -208,6 +208,16 @@ atomic64_add_negative (__s64 i, atomic64_t *v)
2333 #define atomic64_inc(v) atomic64_add(1, (v))
2334 #define atomic64_dec(v) atomic64_sub(1, (v))
2335
2336 +#define atomic64_read_unchecked(v) atomic64_read(v)
2337 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
2338 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
2339 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
2340 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
2341 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
2342 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
2343 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
2344 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
2345 +
2346 /* Atomic operations are already serializing */
2347 #define smp_mb__before_atomic_dec() barrier()
2348 #define smp_mb__after_atomic_dec() barrier()
2349 diff --git a/arch/ia64/include/asm/cache.h b/arch/ia64/include/asm/cache.h
2350 index 988254a..e1ee885 100644
2351 --- a/arch/ia64/include/asm/cache.h
2352 +++ b/arch/ia64/include/asm/cache.h
2353 @@ -1,6 +1,7 @@
2354 #ifndef _ASM_IA64_CACHE_H
2355 #define _ASM_IA64_CACHE_H
2356
2357 +#include <linux/const.h>
2358
2359 /*
2360 * Copyright (C) 1998-2000 Hewlett-Packard Co
2361 @@ -9,7 +10,7 @@
2362
2363 /* Bytes per L1 (data) cache line. */
2364 #define L1_CACHE_SHIFT CONFIG_IA64_L1_CACHE_SHIFT
2365 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
2366 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
2367
2368 #ifdef CONFIG_SMP
2369 # define SMP_CACHE_SHIFT L1_CACHE_SHIFT
2370 diff --git a/arch/ia64/include/asm/elf.h b/arch/ia64/include/asm/elf.h
2371 index b5298eb..67c6e62 100644
2372 --- a/arch/ia64/include/asm/elf.h
2373 +++ b/arch/ia64/include/asm/elf.h
2374 @@ -42,6 +42,13 @@
2375 */
2376 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
2377
2378 +#ifdef CONFIG_PAX_ASLR
2379 +#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
2380 +
2381 +#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
2382 +#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
2383 +#endif
2384 +
2385 #define PT_IA_64_UNWIND 0x70000001
2386
2387 /* IA-64 relocations: */
2388 diff --git a/arch/ia64/include/asm/pgalloc.h b/arch/ia64/include/asm/pgalloc.h
2389 index 96a8d92..617a1cf 100644
2390 --- a/arch/ia64/include/asm/pgalloc.h
2391 +++ b/arch/ia64/include/asm/pgalloc.h
2392 @@ -39,6 +39,12 @@ pgd_populate(struct mm_struct *mm, pgd_t * pgd_entry, pud_t * pud)
2393 pgd_val(*pgd_entry) = __pa(pud);
2394 }
2395
2396 +static inline void
2397 +pgd_populate_kernel(struct mm_struct *mm, pgd_t * pgd_entry, pud_t * pud)
2398 +{
2399 + pgd_populate(mm, pgd_entry, pud);
2400 +}
2401 +
2402 static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
2403 {
2404 return quicklist_alloc(0, GFP_KERNEL, NULL);
2405 @@ -57,6 +63,12 @@ pud_populate(struct mm_struct *mm, pud_t * pud_entry, pmd_t * pmd)
2406 pud_val(*pud_entry) = __pa(pmd);
2407 }
2408
2409 +static inline void
2410 +pud_populate_kernel(struct mm_struct *mm, pud_t * pud_entry, pmd_t * pmd)
2411 +{
2412 + pud_populate(mm, pud_entry, pmd);
2413 +}
2414 +
2415 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
2416 {
2417 return quicklist_alloc(0, GFP_KERNEL, NULL);
2418 diff --git a/arch/ia64/include/asm/pgtable.h b/arch/ia64/include/asm/pgtable.h
2419 index 815810c..d60bd4c 100644
2420 --- a/arch/ia64/include/asm/pgtable.h
2421 +++ b/arch/ia64/include/asm/pgtable.h
2422 @@ -12,7 +12,7 @@
2423 * David Mosberger-Tang <davidm@hpl.hp.com>
2424 */
2425
2426 -
2427 +#include <linux/const.h>
2428 #include <asm/mman.h>
2429 #include <asm/page.h>
2430 #include <asm/processor.h>
2431 @@ -142,6 +142,17 @@
2432 #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
2433 #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
2434 #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
2435 +
2436 +#ifdef CONFIG_PAX_PAGEEXEC
2437 +# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
2438 +# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
2439 +# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
2440 +#else
2441 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
2442 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
2443 +# define PAGE_COPY_NOEXEC PAGE_COPY
2444 +#endif
2445 +
2446 #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
2447 #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
2448 #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
2449 diff --git a/arch/ia64/include/asm/spinlock.h b/arch/ia64/include/asm/spinlock.h
2450 index 54ff557..70c88b7 100644
2451 --- a/arch/ia64/include/asm/spinlock.h
2452 +++ b/arch/ia64/include/asm/spinlock.h
2453 @@ -71,7 +71,7 @@ static __always_inline void __ticket_spin_unlock(arch_spinlock_t *lock)
2454 unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
2455
2456 asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
2457 - ACCESS_ONCE(*p) = (tmp + 2) & ~1;
2458 + ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
2459 }
2460
2461 static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
2462 diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
2463 index 449c8c0..432a3d2 100644
2464 --- a/arch/ia64/include/asm/uaccess.h
2465 +++ b/arch/ia64/include/asm/uaccess.h
2466 @@ -257,7 +257,7 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
2467 const void *__cu_from = (from); \
2468 long __cu_len = (n); \
2469 \
2470 - if (__access_ok(__cu_to, __cu_len, get_fs())) \
2471 + if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) \
2472 __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
2473 __cu_len; \
2474 })
2475 @@ -269,7 +269,7 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
2476 long __cu_len = (n); \
2477 \
2478 __chk_user_ptr(__cu_from); \
2479 - if (__access_ok(__cu_from, __cu_len, get_fs())) \
2480 + if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) \
2481 __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
2482 __cu_len; \
2483 })
2484 diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
2485 index 24603be..948052d 100644
2486 --- a/arch/ia64/kernel/module.c
2487 +++ b/arch/ia64/kernel/module.c
2488 @@ -307,8 +307,7 @@ plt_target (struct plt_entry *plt)
2489 void
2490 module_free (struct module *mod, void *module_region)
2491 {
2492 - if (mod && mod->arch.init_unw_table &&
2493 - module_region == mod->module_init) {
2494 + if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
2495 unw_remove_unwind_table(mod->arch.init_unw_table);
2496 mod->arch.init_unw_table = NULL;
2497 }
2498 @@ -494,15 +493,39 @@ module_frob_arch_sections (Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, char *secstrings,
2499 }
2500
2501 static inline int
2502 +in_init_rx (const struct module *mod, uint64_t addr)
2503 +{
2504 + return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
2505 +}
2506 +
2507 +static inline int
2508 +in_init_rw (const struct module *mod, uint64_t addr)
2509 +{
2510 + return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
2511 +}
2512 +
2513 +static inline int
2514 in_init (const struct module *mod, uint64_t addr)
2515 {
2516 - return addr - (uint64_t) mod->module_init < mod->init_size;
2517 + return in_init_rx(mod, addr) || in_init_rw(mod, addr);
2518 +}
2519 +
2520 +static inline int
2521 +in_core_rx (const struct module *mod, uint64_t addr)
2522 +{
2523 + return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
2524 +}
2525 +
2526 +static inline int
2527 +in_core_rw (const struct module *mod, uint64_t addr)
2528 +{
2529 + return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
2530 }
2531
2532 static inline int
2533 in_core (const struct module *mod, uint64_t addr)
2534 {
2535 - return addr - (uint64_t) mod->module_core < mod->core_size;
2536 + return in_core_rx(mod, addr) || in_core_rw(mod, addr);
2537 }
2538
2539 static inline int
2540 @@ -685,7 +708,14 @@ do_reloc (struct module *mod, uint8_t r_type, Elf64_Sym *sym, uint64_t addend,
2541 break;
2542
2543 case RV_BDREL:
2544 - val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
2545 + if (in_init_rx(mod, val))
2546 + val -= (uint64_t) mod->module_init_rx;
2547 + else if (in_init_rw(mod, val))
2548 + val -= (uint64_t) mod->module_init_rw;
2549 + else if (in_core_rx(mod, val))
2550 + val -= (uint64_t) mod->module_core_rx;
2551 + else if (in_core_rw(mod, val))
2552 + val -= (uint64_t) mod->module_core_rw;
2553 break;
2554
2555 case RV_LTV:
2556 @@ -820,15 +850,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs, const char *strtab, unsigned int symind
2557 * addresses have been selected...
2558 */
2559 uint64_t gp;
2560 - if (mod->core_size > MAX_LTOFF)
2561 + if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
2562 /*
2563 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
2564 * at the end of the module.
2565 */
2566 - gp = mod->core_size - MAX_LTOFF / 2;
2567 + gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
2568 else
2569 - gp = mod->core_size / 2;
2570 - gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
2571 + gp = (mod->core_size_rx + mod->core_size_rw) / 2;
2572 + gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
2573 mod->arch.gp = gp;
2574 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
2575 }
2576 diff --git a/arch/ia64/kernel/sys_ia64.c b/arch/ia64/kernel/sys_ia64.c
2577 index d9439ef..b9a4303 100644
2578 --- a/arch/ia64/kernel/sys_ia64.c
2579 +++ b/arch/ia64/kernel/sys_ia64.c
2580 @@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
2581 if (REGION_NUMBER(addr) == RGN_HPAGE)
2582 addr = 0;
2583 #endif
2584 +
2585 +#ifdef CONFIG_PAX_RANDMMAP
2586 + if (mm->pax_flags & MF_PAX_RANDMMAP)
2587 + addr = mm->free_area_cache;
2588 + else
2589 +#endif
2590 +
2591 if (!addr)
2592 addr = mm->free_area_cache;
2593
2594 @@ -61,14 +68,14 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
2595 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
2596 /* At this point: (!vma || addr < vma->vm_end). */
2597 if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
2598 - if (start_addr != TASK_UNMAPPED_BASE) {
2599 + if (start_addr != mm->mmap_base) {
2600 /* Start a new search --- just in case we missed some holes. */
2601 - addr = TASK_UNMAPPED_BASE;
2602 + addr = mm->mmap_base;
2603 goto full_search;
2604 }
2605 return -ENOMEM;
2606 }
2607 - if (!vma || addr + len <= vma->vm_start) {
2608 + if (check_heap_stack_gap(vma, addr, len)) {
2609 /* Remember the address where we stopped this search: */
2610 mm->free_area_cache = addr + len;
2611 return addr;
2612 diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
2613 index 0ccb28f..8992469 100644
2614 --- a/arch/ia64/kernel/vmlinux.lds.S
2615 +++ b/arch/ia64/kernel/vmlinux.lds.S
2616 @@ -198,7 +198,7 @@ SECTIONS {
2617 /* Per-cpu data: */
2618 . = ALIGN(PERCPU_PAGE_SIZE);
2619 PERCPU_VADDR(SMP_CACHE_BYTES, PERCPU_ADDR, :percpu)
2620 - __phys_per_cpu_start = __per_cpu_load;
2621 + __phys_per_cpu_start = per_cpu_load;
2622 /*
2623 * ensure percpu data fits
2624 * into percpu page size
2625 diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
2626 index 02d29c2..ea893df 100644
2627 --- a/arch/ia64/mm/fault.c
2628 +++ b/arch/ia64/mm/fault.c
2629 @@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned long address)
2630 return pte_present(pte);
2631 }
2632
2633 +#ifdef CONFIG_PAX_PAGEEXEC
2634 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
2635 +{
2636 + unsigned long i;
2637 +
2638 + printk(KERN_ERR "PAX: bytes at PC: ");
2639 + for (i = 0; i < 8; i++) {
2640 + unsigned int c;
2641 + if (get_user(c, (unsigned int *)pc+i))
2642 + printk(KERN_CONT "???????? ");
2643 + else
2644 + printk(KERN_CONT "%08x ", c);
2645 + }
2646 + printk("\n");
2647 +}
2648 +#endif
2649 +
2650 void __kprobes
2651 ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
2652 {
2653 @@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *re
2654 mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
2655 | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
2656
2657 - if ((vma->vm_flags & mask) != mask)
2658 + if ((vma->vm_flags & mask) != mask) {
2659 +
2660 +#ifdef CONFIG_PAX_PAGEEXEC
2661 + if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
2662 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
2663 + goto bad_area;
2664 +
2665 + up_read(&mm->mmap_sem);
2666 + pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
2667 + do_group_exit(SIGKILL);
2668 + }
2669 +#endif
2670 +
2671 goto bad_area;
2672
2673 + }
2674 +
2675 /*
2676 * If for any reason at all we couldn't handle the fault, make
2677 * sure we exit gracefully rather than endlessly redo the
2678 diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
2679 index 5ca674b..e0e1b70 100644
2680 --- a/arch/ia64/mm/hugetlbpage.c
2681 +++ b/arch/ia64/mm/hugetlbpage.c
2682 @@ -171,7 +171,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
2683 /* At this point: (!vmm || addr < vmm->vm_end). */
2684 if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
2685 return -ENOMEM;
2686 - if (!vmm || (addr + len) <= vmm->vm_start)
2687 + if (check_heap_stack_gap(vmm, addr, len))
2688 return addr;
2689 addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
2690 }
2691 diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
2692 index 0eab454..bd794f2 100644
2693 --- a/arch/ia64/mm/init.c
2694 +++ b/arch/ia64/mm/init.c
2695 @@ -120,6 +120,19 @@ ia64_init_addr_space (void)
2696 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
2697 vma->vm_end = vma->vm_start + PAGE_SIZE;
2698 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
2699 +
2700 +#ifdef CONFIG_PAX_PAGEEXEC
2701 + if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
2702 + vma->vm_flags &= ~VM_EXEC;
2703 +
2704 +#ifdef CONFIG_PAX_MPROTECT
2705 + if (current->mm->pax_flags & MF_PAX_MPROTECT)
2706 + vma->vm_flags &= ~VM_MAYEXEC;
2707 +#endif
2708 +
2709 + }
2710 +#endif
2711 +
2712 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
2713 down_write(&current->mm->mmap_sem);
2714 if (insert_vm_struct(current->mm, vma)) {
2715 diff --git a/arch/m32r/include/asm/cache.h b/arch/m32r/include/asm/cache.h
2716 index 40b3ee9..8c2c112 100644
2717 --- a/arch/m32r/include/asm/cache.h
2718 +++ b/arch/m32r/include/asm/cache.h
2719 @@ -1,8 +1,10 @@
2720 #ifndef _ASM_M32R_CACHE_H
2721 #define _ASM_M32R_CACHE_H
2722
2723 +#include <linux/const.h>
2724 +
2725 /* L1 cache line size */
2726 #define L1_CACHE_SHIFT 4
2727 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
2728 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
2729
2730 #endif /* _ASM_M32R_CACHE_H */
2731 diff --git a/arch/m32r/lib/usercopy.c b/arch/m32r/lib/usercopy.c
2732 index 82abd15..d95ae5d 100644
2733 --- a/arch/m32r/lib/usercopy.c
2734 +++ b/arch/m32r/lib/usercopy.c
2735 @@ -14,6 +14,9 @@
2736 unsigned long
2737 __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
2738 {
2739 + if ((long)n < 0)
2740 + return n;
2741 +
2742 prefetch(from);
2743 if (access_ok(VERIFY_WRITE, to, n))
2744 __copy_user(to,from,n);
2745 @@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
2746 unsigned long
2747 __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
2748 {
2749 + if ((long)n < 0)
2750 + return n;
2751 +
2752 prefetchw(to);
2753 if (access_ok(VERIFY_READ, from, n))
2754 __copy_user_zeroing(to,from,n);
2755 diff --git a/arch/m68k/include/asm/cache.h b/arch/m68k/include/asm/cache.h
2756 index 0395c51..5f26031 100644
2757 --- a/arch/m68k/include/asm/cache.h
2758 +++ b/arch/m68k/include/asm/cache.h
2759 @@ -4,9 +4,11 @@
2760 #ifndef __ARCH_M68K_CACHE_H
2761 #define __ARCH_M68K_CACHE_H
2762
2763 +#include <linux/const.h>
2764 +
2765 /* bytes per L1 cache line */
2766 #define L1_CACHE_SHIFT 4
2767 -#define L1_CACHE_BYTES (1<< L1_CACHE_SHIFT)
2768 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
2769
2770 #define ARCH_DMA_MINALIGN L1_CACHE_BYTES
2771
2772 diff --git a/arch/microblaze/include/asm/cache.h b/arch/microblaze/include/asm/cache.h
2773 index 4efe96a..60e8699 100644
2774 --- a/arch/microblaze/include/asm/cache.h
2775 +++ b/arch/microblaze/include/asm/cache.h
2776 @@ -13,11 +13,12 @@
2777 #ifndef _ASM_MICROBLAZE_CACHE_H
2778 #define _ASM_MICROBLAZE_CACHE_H
2779
2780 +#include <linux/const.h>
2781 #include <asm/registers.h>
2782
2783 #define L1_CACHE_SHIFT 5
2784 /* word-granular cache in microblaze */
2785 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
2786 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
2787
2788 #define SMP_CACHE_BYTES L1_CACHE_BYTES
2789
2790 diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
2791 index 3f4c5cb..3439c6e 100644
2792 --- a/arch/mips/include/asm/atomic.h
2793 +++ b/arch/mips/include/asm/atomic.h
2794 @@ -21,6 +21,10 @@
2795 #include <asm/cmpxchg.h>
2796 #include <asm/war.h>
2797
2798 +#ifdef CONFIG_GENERIC_ATOMIC64
2799 +#include <asm-generic/atomic64.h>
2800 +#endif
2801 +
2802 #define ATOMIC_INIT(i) { (i) }
2803
2804 /*
2805 @@ -765,6 +769,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
2806 */
2807 #define atomic64_add_negative(i, v) (atomic64_add_return(i, (v)) < 0)
2808
2809 +#define atomic64_read_unchecked(v) atomic64_read(v)
2810 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
2811 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
2812 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
2813 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
2814 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
2815 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
2816 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
2817 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
2818 +
2819 #endif /* CONFIG_64BIT */
2820
2821 /*
2822 diff --git a/arch/mips/include/asm/cache.h b/arch/mips/include/asm/cache.h
2823 index b4db69f..8f3b093 100644
2824 --- a/arch/mips/include/asm/cache.h
2825 +++ b/arch/mips/include/asm/cache.h
2826 @@ -9,10 +9,11 @@
2827 #ifndef _ASM_CACHE_H
2828 #define _ASM_CACHE_H
2829
2830 +#include <linux/const.h>
2831 #include <kmalloc.h>
2832
2833 #define L1_CACHE_SHIFT CONFIG_MIPS_L1_CACHE_SHIFT
2834 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
2835 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
2836
2837 #define SMP_CACHE_SHIFT L1_CACHE_SHIFT
2838 #define SMP_CACHE_BYTES L1_CACHE_BYTES
2839 diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
2840 index 455c0ac..ad65fbe 100644
2841 --- a/arch/mips/include/asm/elf.h
2842 +++ b/arch/mips/include/asm/elf.h
2843 @@ -372,13 +372,16 @@ extern const char *__elf_platform;
2844 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
2845 #endif
2846
2847 +#ifdef CONFIG_PAX_ASLR
2848 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
2849 +
2850 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2851 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2852 +#endif
2853 +
2854 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
2855 struct linux_binprm;
2856 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
2857 int uses_interp);
2858
2859 -struct mm_struct;
2860 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2861 -#define arch_randomize_brk arch_randomize_brk
2862 -
2863 #endif /* _ASM_ELF_H */
2864 diff --git a/arch/mips/include/asm/exec.h b/arch/mips/include/asm/exec.h
2865 index c1f6afa..38cc6e9 100644
2866 --- a/arch/mips/include/asm/exec.h
2867 +++ b/arch/mips/include/asm/exec.h
2868 @@ -12,6 +12,6 @@
2869 #ifndef _ASM_EXEC_H
2870 #define _ASM_EXEC_H
2871
2872 -extern unsigned long arch_align_stack(unsigned long sp);
2873 +#define arch_align_stack(x) ((x) & ~0xfUL)
2874
2875 #endif /* _ASM_EXEC_H */
2876 diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
2877 index da9bd7d..91aa7ab 100644
2878 --- a/arch/mips/include/asm/page.h
2879 +++ b/arch/mips/include/asm/page.h
2880 @@ -98,7 +98,7 @@ extern void copy_user_highpage(struct page *to, struct page *from,
2881 #ifdef CONFIG_CPU_MIPS32
2882 typedef struct { unsigned long pte_low, pte_high; } pte_t;
2883 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
2884 - #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
2885 + #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
2886 #else
2887 typedef struct { unsigned long long pte; } pte_t;
2888 #define pte_val(x) ((x).pte)
2889 diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h
2890 index 881d18b..cea38bc 100644
2891 --- a/arch/mips/include/asm/pgalloc.h
2892 +++ b/arch/mips/include/asm/pgalloc.h
2893 @@ -37,6 +37,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
2894 {
2895 set_pud(pud, __pud((unsigned long)pmd));
2896 }
2897 +
2898 +static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
2899 +{
2900 + pud_populate(mm, pud, pmd);
2901 +}
2902 #endif
2903
2904 /*
2905 diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
2906 index ca97e0e..cd08920 100644
2907 --- a/arch/mips/include/asm/thread_info.h
2908 +++ b/arch/mips/include/asm/thread_info.h
2909 @@ -111,6 +111,8 @@ register struct thread_info *__current_thread_info __asm__("$28");
2910 #define TIF_32BIT_ADDR 23 /* 32-bit address space (o32/n32) */
2911 #define TIF_FPUBOUND 24 /* thread bound to FPU-full CPU set */
2912 #define TIF_LOAD_WATCH 25 /* If set, load watch registers */
2913 +/* li takes a 32bit immediate */
2914 +#define TIF_GRSEC_SETXID 29 /* update credentials on syscall entry/exit */
2915 #define TIF_SYSCALL_TRACE 31 /* syscall trace active */
2916
2917 #ifdef CONFIG_MIPS32_O32
2918 @@ -134,15 +136,18 @@ register struct thread_info *__current_thread_info __asm__("$28");
2919 #define _TIF_32BIT_ADDR (1<<TIF_32BIT_ADDR)
2920 #define _TIF_FPUBOUND (1<<TIF_FPUBOUND)
2921 #define _TIF_LOAD_WATCH (1<<TIF_LOAD_WATCH)
2922 +#define _TIF_GRSEC_SETXID (1<<TIF_GRSEC_SETXID)
2923 +
2924 +#define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_GRSEC_SETXID)
2925
2926 /* work to do in syscall_trace_leave() */
2927 -#define _TIF_WORK_SYSCALL_EXIT (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT)
2928 +#define _TIF_WORK_SYSCALL_EXIT (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_GRSEC_SETXID)
2929
2930 /* work to do on interrupt/exception return */
2931 #define _TIF_WORK_MASK (0x0000ffef & \
2932 ~(_TIF_SECCOMP | _TIF_SYSCALL_AUDIT))
2933 /* work to do on any return to u-space */
2934 -#define _TIF_ALLWORK_MASK (0x8000ffff & ~_TIF_SECCOMP)
2935 +#define _TIF_ALLWORK_MASK ((0x8000ffff & ~_TIF_SECCOMP) | _TIF_GRSEC_SETXID)
2936
2937 #endif /* __KERNEL__ */
2938
2939 diff --git a/arch/mips/kernel/binfmt_elfn32.c b/arch/mips/kernel/binfmt_elfn32.c
2940 index 9fdd8bc..4bd7f1a 100644
2941 --- a/arch/mips/kernel/binfmt_elfn32.c
2942 +++ b/arch/mips/kernel/binfmt_elfn32.c
2943 @@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
2944 #undef ELF_ET_DYN_BASE
2945 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
2946
2947 +#ifdef CONFIG_PAX_ASLR
2948 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
2949 +
2950 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2951 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2952 +#endif
2953 +
2954 #include <asm/processor.h>
2955 #include <linux/module.h>
2956 #include <linux/elfcore.h>
2957 diff --git a/arch/mips/kernel/binfmt_elfo32.c b/arch/mips/kernel/binfmt_elfo32.c
2958 index ff44823..97f8906 100644
2959 --- a/arch/mips/kernel/binfmt_elfo32.c
2960 +++ b/arch/mips/kernel/binfmt_elfo32.c
2961 @@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
2962 #undef ELF_ET_DYN_BASE
2963 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
2964
2965 +#ifdef CONFIG_PAX_ASLR
2966 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
2967 +
2968 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2969 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2970 +#endif
2971 +
2972 #include <asm/processor.h>
2973
2974 /*
2975 diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
2976 index e9a5fd7..378809a 100644
2977 --- a/arch/mips/kernel/process.c
2978 +++ b/arch/mips/kernel/process.c
2979 @@ -480,15 +480,3 @@ unsigned long get_wchan(struct task_struct *task)
2980 out:
2981 return pc;
2982 }
2983 -
2984 -/*
2985 - * Don't forget that the stack pointer must be aligned on a 8 bytes
2986 - * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
2987 - */
2988 -unsigned long arch_align_stack(unsigned long sp)
2989 -{
2990 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
2991 - sp -= get_random_int() & ~PAGE_MASK;
2992 -
2993 - return sp & ALMASK;
2994 -}
2995 diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
2996 index 4812c6d..2069554 100644
2997 --- a/arch/mips/kernel/ptrace.c
2998 +++ b/arch/mips/kernel/ptrace.c
2999 @@ -528,6 +528,10 @@ static inline int audit_arch(void)
3000 return arch;
3001 }
3002
3003 +#ifdef CONFIG_GRKERNSEC_SETXID
3004 +extern void gr_delayed_cred_worker(void);
3005 +#endif
3006 +
3007 /*
3008 * Notification of system call entry/exit
3009 * - triggered by current->work.syscall_trace
3010 @@ -537,6 +541,11 @@ asmlinkage void syscall_trace_enter(struct pt_regs *regs)
3011 /* do the secure computing check first */
3012 secure_computing_strict(regs->regs[2]);
3013
3014 +#ifdef CONFIG_GRKERNSEC_SETXID
3015 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
3016 + gr_delayed_cred_worker();
3017 +#endif
3018 +
3019 if (!(current->ptrace & PT_PTRACED))
3020 goto out;
3021
3022 diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
3023 index a632bc1..0b77c7c 100644
3024 --- a/arch/mips/kernel/scall32-o32.S
3025 +++ b/arch/mips/kernel/scall32-o32.S
3026 @@ -52,7 +52,7 @@ NESTED(handle_sys, PT_SIZE, sp)
3027
3028 stack_done:
3029 lw t0, TI_FLAGS($28) # syscall tracing enabled?
3030 - li t1, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
3031 + li t1, _TIF_SYSCALL_WORK
3032 and t0, t1
3033 bnez t0, syscall_trace_entry # -> yes
3034
3035 diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
3036 index 3b5a5e9..e1ee86d 100644
3037 --- a/arch/mips/kernel/scall64-64.S
3038 +++ b/arch/mips/kernel/scall64-64.S
3039 @@ -54,7 +54,7 @@ NESTED(handle_sys64, PT_SIZE, sp)
3040
3041 sd a3, PT_R26(sp) # save a3 for syscall restarting
3042
3043 - li t1, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
3044 + li t1, _TIF_SYSCALL_WORK
3045 LONG_L t0, TI_FLAGS($28) # syscall tracing enabled?
3046 and t0, t1, t0
3047 bnez t0, syscall_trace_entry
3048 diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
3049 index 6be6f70..1859577 100644
3050 --- a/arch/mips/kernel/scall64-n32.S
3051 +++ b/arch/mips/kernel/scall64-n32.S
3052 @@ -53,7 +53,7 @@ NESTED(handle_sysn32, PT_SIZE, sp)
3053
3054 sd a3, PT_R26(sp) # save a3 for syscall restarting
3055
3056 - li t1, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
3057 + li t1, _TIF_SYSCALL_WORK
3058 LONG_L t0, TI_FLAGS($28) # syscall tracing enabled?
3059 and t0, t1, t0
3060 bnez t0, n32_syscall_trace_entry
3061 diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
3062 index 5422855..74e63a3 100644
3063 --- a/arch/mips/kernel/scall64-o32.S
3064 +++ b/arch/mips/kernel/scall64-o32.S
3065 @@ -81,7 +81,7 @@ NESTED(handle_sys, PT_SIZE, sp)
3066 PTR 4b, bad_stack
3067 .previous
3068
3069 - li t1, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT
3070 + li t1, _TIF_SYSCALL_WORK
3071 LONG_L t0, TI_FLAGS($28) # syscall tracing enabled?
3072 and t0, t1, t0
3073 bnez t0, trace_a_syscall
3074 diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
3075 index c14f6df..537e729 100644
3076 --- a/arch/mips/mm/fault.c
3077 +++ b/arch/mips/mm/fault.c
3078 @@ -27,6 +27,23 @@
3079 #include <asm/highmem.h> /* For VMALLOC_END */
3080 #include <linux/kdebug.h>
3081
3082 +#ifdef CONFIG_PAX_PAGEEXEC
3083 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
3084 +{
3085 + unsigned long i;
3086 +
3087 + printk(KERN_ERR "PAX: bytes at PC: ");
3088 + for (i = 0; i < 5; i++) {
3089 + unsigned int c;
3090 + if (get_user(c, (unsigned int *)pc+i))
3091 + printk(KERN_CONT "???????? ");
3092 + else
3093 + printk(KERN_CONT "%08x ", c);
3094 + }
3095 + printk("\n");
3096 +}
3097 +#endif
3098 +
3099 /*
3100 * This routine handles page faults. It determines the address,
3101 * and the problem, and then passes it off to one of the appropriate
3102 diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
3103 index 302d779..7d35bf8 100644
3104 --- a/arch/mips/mm/mmap.c
3105 +++ b/arch/mips/mm/mmap.c
3106 @@ -95,6 +95,11 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
3107 do_color_align = 1;
3108
3109 /* requesting a specific address */
3110 +
3111 +#ifdef CONFIG_PAX_RANDMMAP
3112 + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
3113 +#endif
3114 +
3115 if (addr) {
3116 if (do_color_align)
3117 addr = COLOUR_ALIGN(addr, pgoff);
3118 @@ -102,8 +107,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
3119 addr = PAGE_ALIGN(addr);
3120
3121 vma = find_vma(mm, addr);
3122 - if (TASK_SIZE - len >= addr &&
3123 - (!vma || addr + len <= vma->vm_start))
3124 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vmm, addr, len))
3125 return addr;
3126 }
3127
3128 @@ -118,7 +122,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
3129 /* At this point: (!vma || addr < vma->vm_end). */
3130 if (TASK_SIZE - len < addr)
3131 return -ENOMEM;
3132 - if (!vma || addr + len <= vma->vm_start)
3133 + if (check_heap_stack_gap(vmm, addr, len))
3134 return addr;
3135 addr = vma->vm_end;
3136 if (do_color_align)
3137 @@ -145,7 +149,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
3138 /* make sure it can fit in the remaining address space */
3139 if (likely(addr > len)) {
3140 vma = find_vma(mm, addr - len);
3141 - if (!vma || addr <= vma->vm_start) {
3142 + if (check_heap_stack_gap(vmm, addr - len, len))
3143 /* cache the address as a hint for next time */
3144 return mm->free_area_cache = addr - len;
3145 }
3146 @@ -165,7 +169,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
3147 * return with success:
3148 */
3149 vma = find_vma(mm, addr);
3150 - if (likely(!vma || addr + len <= vma->vm_start)) {
3151 + if (check_heap_stack_gap(vmm, addr, len)) {
3152 /* cache the address as a hint for next time */
3153 return mm->free_area_cache = addr;
3154 }
3155 @@ -242,30 +246,3 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
3156 mm->unmap_area = arch_unmap_area_topdown;
3157 }
3158 }
3159 -
3160 -static inline unsigned long brk_rnd(void)
3161 -{
3162 - unsigned long rnd = get_random_int();
3163 -
3164 - rnd = rnd << PAGE_SHIFT;
3165 - /* 8MB for 32bit, 256MB for 64bit */
3166 - if (TASK_IS_32BIT_ADDR)
3167 - rnd = rnd & 0x7ffffful;
3168 - else
3169 - rnd = rnd & 0xffffffful;
3170 -
3171 - return rnd;
3172 -}
3173 -
3174 -unsigned long arch_randomize_brk(struct mm_struct *mm)
3175 -{
3176 - unsigned long base = mm->brk;
3177 - unsigned long ret;
3178 -
3179 - ret = PAGE_ALIGN(base + brk_rnd());
3180 -
3181 - if (ret < mm->brk)
3182 - return mm->brk;
3183 -
3184 - return ret;
3185 -}
3186 diff --git a/arch/mn10300/proc-mn103e010/include/proc/cache.h b/arch/mn10300/proc-mn103e010/include/proc/cache.h
3187 index 967d144..db12197 100644
3188 --- a/arch/mn10300/proc-mn103e010/include/proc/cache.h
3189 +++ b/arch/mn10300/proc-mn103e010/include/proc/cache.h
3190 @@ -11,12 +11,14 @@
3191 #ifndef _ASM_PROC_CACHE_H
3192 #define _ASM_PROC_CACHE_H
3193
3194 +#include <linux/const.h>
3195 +
3196 /* L1 cache */
3197
3198 #define L1_CACHE_NWAYS 4 /* number of ways in caches */
3199 #define L1_CACHE_NENTRIES 256 /* number of entries in each way */
3200 -#define L1_CACHE_BYTES 16 /* bytes per entry */
3201 #define L1_CACHE_SHIFT 4 /* shift for bytes per entry */
3202 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT) /* bytes per entry */
3203 #define L1_CACHE_WAYDISP 0x1000 /* displacement of one way from the next */
3204
3205 #define L1_CACHE_TAG_VALID 0x00000001 /* cache tag valid bit */
3206 diff --git a/arch/mn10300/proc-mn2ws0050/include/proc/cache.h b/arch/mn10300/proc-mn2ws0050/include/proc/cache.h
3207 index bcb5df2..84fabd2 100644
3208 --- a/arch/mn10300/proc-mn2ws0050/include/proc/cache.h
3209 +++ b/arch/mn10300/proc-mn2ws0050/include/proc/cache.h
3210 @@ -16,13 +16,15 @@
3211 #ifndef _ASM_PROC_CACHE_H
3212 #define _ASM_PROC_CACHE_H
3213
3214 +#include <linux/const.h>
3215 +
3216 /*
3217 * L1 cache
3218 */
3219 #define L1_CACHE_NWAYS 4 /* number of ways in caches */
3220 #define L1_CACHE_NENTRIES 128 /* number of entries in each way */
3221 -#define L1_CACHE_BYTES 32 /* bytes per entry */
3222 #define L1_CACHE_SHIFT 5 /* shift for bytes per entry */
3223 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT) /* bytes per entry */
3224 #define L1_CACHE_WAYDISP 0x1000 /* distance from one way to the next */
3225
3226 #define L1_CACHE_TAG_VALID 0x00000001 /* cache tag valid bit */
3227 diff --git a/arch/openrisc/include/asm/cache.h b/arch/openrisc/include/asm/cache.h
3228 index 4ce7a01..449202a 100644
3229 --- a/arch/openrisc/include/asm/cache.h
3230 +++ b/arch/openrisc/include/asm/cache.h
3231 @@ -19,11 +19,13 @@
3232 #ifndef __ASM_OPENRISC_CACHE_H
3233 #define __ASM_OPENRISC_CACHE_H
3234
3235 +#include <linux/const.h>
3236 +
3237 /* FIXME: How can we replace these with values from the CPU...
3238 * they shouldn't be hard-coded!
3239 */
3240
3241 -#define L1_CACHE_BYTES 16
3242 #define L1_CACHE_SHIFT 4
3243 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
3244
3245 #endif /* __ASM_OPENRISC_CACHE_H */
3246 diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
3247 index af9cf30..2aae9b2 100644
3248 --- a/arch/parisc/include/asm/atomic.h
3249 +++ b/arch/parisc/include/asm/atomic.h
3250 @@ -229,6 +229,16 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
3251
3252 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
3253
3254 +#define atomic64_read_unchecked(v) atomic64_read(v)
3255 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
3256 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
3257 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
3258 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
3259 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
3260 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
3261 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
3262 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
3263 +
3264 #endif /* !CONFIG_64BIT */
3265
3266
3267 diff --git a/arch/parisc/include/asm/cache.h b/arch/parisc/include/asm/cache.h
3268 index 47f11c7..3420df2 100644
3269 --- a/arch/parisc/include/asm/cache.h
3270 +++ b/arch/parisc/include/asm/cache.h
3271 @@ -5,6 +5,7 @@
3272 #ifndef __ARCH_PARISC_CACHE_H
3273 #define __ARCH_PARISC_CACHE_H
3274
3275 +#include <linux/const.h>
3276
3277 /*
3278 * PA 2.0 processors have 64-byte cachelines; PA 1.1 processors have
3279 @@ -15,13 +16,13 @@
3280 * just ruin performance.
3281 */
3282 #ifdef CONFIG_PA20
3283 -#define L1_CACHE_BYTES 64
3284 #define L1_CACHE_SHIFT 6
3285 #else
3286 -#define L1_CACHE_BYTES 32
3287 #define L1_CACHE_SHIFT 5
3288 #endif
3289
3290 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
3291 +
3292 #ifndef __ASSEMBLY__
3293
3294 #define SMP_CACHE_BYTES L1_CACHE_BYTES
3295 diff --git a/arch/parisc/include/asm/elf.h b/arch/parisc/include/asm/elf.h
3296 index 19f6cb1..6c78cf2 100644
3297 --- a/arch/parisc/include/asm/elf.h
3298 +++ b/arch/parisc/include/asm/elf.h
3299 @@ -342,6 +342,13 @@ struct pt_regs; /* forward declaration... */
3300
3301 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
3302
3303 +#ifdef CONFIG_PAX_ASLR
3304 +#define PAX_ELF_ET_DYN_BASE 0x10000UL
3305 +
3306 +#define PAX_DELTA_MMAP_LEN 16
3307 +#define PAX_DELTA_STACK_LEN 16
3308 +#endif
3309 +
3310 /* This yields a mask that user programs can use to figure out what
3311 instruction set this CPU supports. This could be done in user space,
3312 but it's not easy, and we've already done it here. */
3313 diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
3314 index fc987a1..6e068ef 100644
3315 --- a/arch/parisc/include/asm/pgalloc.h
3316 +++ b/arch/parisc/include/asm/pgalloc.h
3317 @@ -61,6 +61,11 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
3318 (__u32)(__pa((unsigned long)pmd) >> PxD_VALUE_SHIFT));
3319 }
3320
3321 +static inline void pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
3322 +{
3323 + pgd_populate(mm, pgd, pmd);
3324 +}
3325 +
3326 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
3327 {
3328 pmd_t *pmd = (pmd_t *)__get_free_pages(GFP_KERNEL|__GFP_REPEAT,
3329 @@ -93,6 +98,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
3330 #define pmd_alloc_one(mm, addr) ({ BUG(); ((pmd_t *)2); })
3331 #define pmd_free(mm, x) do { } while (0)
3332 #define pgd_populate(mm, pmd, pte) BUG()
3333 +#define pgd_populate_kernel(mm, pmd, pte) BUG()
3334
3335 #endif
3336
3337 diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
3338 index ee99f23..802b0a1 100644
3339 --- a/arch/parisc/include/asm/pgtable.h
3340 +++ b/arch/parisc/include/asm/pgtable.h
3341 @@ -212,6 +212,17 @@ struct vm_area_struct;
3342 #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
3343 #define PAGE_COPY PAGE_EXECREAD
3344 #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
3345 +
3346 +#ifdef CONFIG_PAX_PAGEEXEC
3347 +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
3348 +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
3349 +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
3350 +#else
3351 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
3352 +# define PAGE_COPY_NOEXEC PAGE_COPY
3353 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
3354 +#endif
3355 +
3356 #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
3357 #define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL_EXEC)
3358 #define PAGE_KERNEL_RWX __pgprot(_PAGE_KERNEL_RWX)
3359 diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
3360 index 4ba2c93..f5e3974 100644
3361 --- a/arch/parisc/include/asm/uaccess.h
3362 +++ b/arch/parisc/include/asm/uaccess.h
3363 @@ -251,10 +251,10 @@ static inline unsigned long __must_check copy_from_user(void *to,
3364 const void __user *from,
3365 unsigned long n)
3366 {
3367 - int sz = __compiletime_object_size(to);
3368 + size_t sz = __compiletime_object_size(to);
3369 int ret = -EFAULT;
3370
3371 - if (likely(sz == -1 || !__builtin_constant_p(n) || sz >= n))
3372 + if (likely(sz == (size_t)-1 || !__builtin_constant_p(n) || sz >= n))
3373 ret = __copy_from_user(to, from, n);
3374 else
3375 copy_from_user_overflow();
3376 diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
3377 index 5e34ccf..672bc9c 100644
3378 --- a/arch/parisc/kernel/module.c
3379 +++ b/arch/parisc/kernel/module.c
3380 @@ -98,16 +98,38 @@
3381
3382 /* three functions to determine where in the module core
3383 * or init pieces the location is */
3384 +static inline int in_init_rx(struct module *me, void *loc)
3385 +{
3386 + return (loc >= me->module_init_rx &&
3387 + loc < (me->module_init_rx + me->init_size_rx));
3388 +}
3389 +
3390 +static inline int in_init_rw(struct module *me, void *loc)
3391 +{
3392 + return (loc >= me->module_init_rw &&
3393 + loc < (me->module_init_rw + me->init_size_rw));
3394 +}
3395 +
3396 static inline int in_init(struct module *me, void *loc)
3397 {
3398 - return (loc >= me->module_init &&
3399 - loc <= (me->module_init + me->init_size));
3400 + return in_init_rx(me, loc) || in_init_rw(me, loc);
3401 +}
3402 +
3403 +static inline int in_core_rx(struct module *me, void *loc)
3404 +{
3405 + return (loc >= me->module_core_rx &&
3406 + loc < (me->module_core_rx + me->core_size_rx));
3407 +}
3408 +
3409 +static inline int in_core_rw(struct module *me, void *loc)
3410 +{
3411 + return (loc >= me->module_core_rw &&
3412 + loc < (me->module_core_rw + me->core_size_rw));
3413 }
3414
3415 static inline int in_core(struct module *me, void *loc)
3416 {
3417 - return (loc >= me->module_core &&
3418 - loc <= (me->module_core + me->core_size));
3419 + return in_core_rx(me, loc) || in_core_rw(me, loc);
3420 }
3421
3422 static inline int in_local(struct module *me, void *loc)
3423 @@ -373,13 +395,13 @@ int module_frob_arch_sections(CONST Elf_Ehdr *hdr,
3424 }
3425
3426 /* align things a bit */
3427 - me->core_size = ALIGN(me->core_size, 16);
3428 - me->arch.got_offset = me->core_size;
3429 - me->core_size += gots * sizeof(struct got_entry);
3430 + me->core_size_rw = ALIGN(me->core_size_rw, 16);
3431 + me->arch.got_offset = me->core_size_rw;
3432 + me->core_size_rw += gots * sizeof(struct got_entry);
3433
3434 - me->core_size = ALIGN(me->core_size, 16);
3435 - me->arch.fdesc_offset = me->core_size;
3436 - me->core_size += fdescs * sizeof(Elf_Fdesc);
3437 + me->core_size_rw = ALIGN(me->core_size_rw, 16);
3438 + me->arch.fdesc_offset = me->core_size_rw;
3439 + me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
3440
3441 me->arch.got_max = gots;
3442 me->arch.fdesc_max = fdescs;
3443 @@ -397,7 +419,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
3444
3445 BUG_ON(value == 0);
3446
3447 - got = me->module_core + me->arch.got_offset;
3448 + got = me->module_core_rw + me->arch.got_offset;
3449 for (i = 0; got[i].addr; i++)
3450 if (got[i].addr == value)
3451 goto out;
3452 @@ -415,7 +437,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
3453 #ifdef CONFIG_64BIT
3454 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
3455 {
3456 - Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
3457 + Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
3458
3459 if (!value) {
3460 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
3461 @@ -433,7 +455,7 @@ static Elf_Addr get_fdesc(struct module *me, unsigned long value)
3462
3463 /* Create new one */
3464 fdesc->addr = value;
3465 - fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
3466 + fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
3467 return (Elf_Addr)fdesc;
3468 }
3469 #endif /* CONFIG_64BIT */
3470 @@ -845,7 +867,7 @@ register_unwind_table(struct module *me,
3471
3472 table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
3473 end = table + sechdrs[me->arch.unwind_section].sh_size;
3474 - gp = (Elf_Addr)me->module_core + me->arch.got_offset;
3475 + gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
3476
3477 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
3478 me->arch.unwind_section, table, end, gp);
3479 diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
3480 index c9b9322..02d8940 100644
3481 --- a/arch/parisc/kernel/sys_parisc.c
3482 +++ b/arch/parisc/kernel/sys_parisc.c
3483 @@ -43,7 +43,7 @@ static unsigned long get_unshared_area(unsigned long addr, unsigned long len)
3484 /* At this point: (!vma || addr < vma->vm_end). */
3485 if (TASK_SIZE - len < addr)
3486 return -ENOMEM;
3487 - if (!vma || addr + len <= vma->vm_start)
3488 + if (check_heap_stack_gap(vma, addr, len))
3489 return addr;
3490 addr = vma->vm_end;
3491 }
3492 @@ -79,7 +79,7 @@ static unsigned long get_shared_area(struct address_space *mapping,
3493 /* At this point: (!vma || addr < vma->vm_end). */
3494 if (TASK_SIZE - len < addr)
3495 return -ENOMEM;
3496 - if (!vma || addr + len <= vma->vm_start)
3497 + if (check_heap_stack_gap(vma, addr, len))
3498 return addr;
3499 addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
3500 if (addr < vma->vm_end) /* handle wraparound */
3501 @@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
3502 if (flags & MAP_FIXED)
3503 return addr;
3504 if (!addr)
3505 - addr = TASK_UNMAPPED_BASE;
3506 + addr = current->mm->mmap_base;
3507
3508 if (filp) {
3509 addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
3510 diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
3511 index 45ba99f..8e22c33 100644
3512 --- a/arch/parisc/kernel/traps.c
3513 +++ b/arch/parisc/kernel/traps.c
3514 @@ -732,9 +732,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
3515
3516 down_read(&current->mm->mmap_sem);
3517 vma = find_vma(current->mm,regs->iaoq[0]);
3518 - if (vma && (regs->iaoq[0] >= vma->vm_start)
3519 - && (vma->vm_flags & VM_EXEC)) {
3520 -
3521 + if (vma && (regs->iaoq[0] >= vma->vm_start)) {
3522 fault_address = regs->iaoq[0];
3523 fault_space = regs->iasq[0];
3524
3525 diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
3526 index 18162ce..94de376 100644
3527 --- a/arch/parisc/mm/fault.c
3528 +++ b/arch/parisc/mm/fault.c
3529 @@ -15,6 +15,7 @@
3530 #include <linux/sched.h>
3531 #include <linux/interrupt.h>
3532 #include <linux/module.h>
3533 +#include <linux/unistd.h>
3534
3535 #include <asm/uaccess.h>
3536 #include <asm/traps.h>
3537 @@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, exception_data);
3538 static unsigned long
3539 parisc_acctyp(unsigned long code, unsigned int inst)
3540 {
3541 - if (code == 6 || code == 16)
3542 + if (code == 6 || code == 7 || code == 16)
3543 return VM_EXEC;
3544
3545 switch (inst & 0xf0000000) {
3546 @@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsigned int inst)
3547 }
3548 #endif
3549
3550 +#ifdef CONFIG_PAX_PAGEEXEC
3551 +/*
3552 + * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
3553 + *
3554 + * returns 1 when task should be killed
3555 + * 2 when rt_sigreturn trampoline was detected
3556 + * 3 when unpatched PLT trampoline was detected
3557 + */
3558 +static int pax_handle_fetch_fault(struct pt_regs *regs)
3559 +{
3560 +
3561 +#ifdef CONFIG_PAX_EMUPLT
3562 + int err;
3563 +
3564 + do { /* PaX: unpatched PLT emulation */
3565 + unsigned int bl, depwi;
3566 +
3567 + err = get_user(bl, (unsigned int *)instruction_pointer(regs));
3568 + err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
3569 +
3570 + if (err)
3571 + break;
3572 +
3573 + if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
3574 + unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
3575 +
3576 + err = get_user(ldw, (unsigned int *)addr);
3577 + err |= get_user(bv, (unsigned int *)(addr+4));
3578 + err |= get_user(ldw2, (unsigned int *)(addr+8));
3579 +
3580 + if (err)
3581 + break;
3582 +
3583 + if (ldw == 0x0E801096U &&
3584 + bv == 0xEAC0C000U &&
3585 + ldw2 == 0x0E881095U)
3586 + {
3587 + unsigned int resolver, map;
3588 +
3589 + err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
3590 + err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
3591 + if (err)
3592 + break;
3593 +
3594 + regs->gr[20] = instruction_pointer(regs)+8;
3595 + regs->gr[21] = map;
3596 + regs->gr[22] = resolver;
3597 + regs->iaoq[0] = resolver | 3UL;
3598 + regs->iaoq[1] = regs->iaoq[0] + 4;
3599 + return 3;
3600 + }
3601 + }
3602 + } while (0);
3603 +#endif
3604 +
3605 +#ifdef CONFIG_PAX_EMUTRAMP
3606 +
3607 +#ifndef CONFIG_PAX_EMUSIGRT
3608 + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
3609 + return 1;
3610 +#endif
3611 +
3612 + do { /* PaX: rt_sigreturn emulation */
3613 + unsigned int ldi1, ldi2, bel, nop;
3614 +
3615 + err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
3616 + err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
3617 + err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
3618 + err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
3619 +
3620 + if (err)
3621 + break;
3622 +
3623 + if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
3624 + ldi2 == 0x3414015AU &&
3625 + bel == 0xE4008200U &&
3626 + nop == 0x08000240U)
3627 + {
3628 + regs->gr[25] = (ldi1 & 2) >> 1;
3629 + regs->gr[20] = __NR_rt_sigreturn;
3630 + regs->gr[31] = regs->iaoq[1] + 16;
3631 + regs->sr[0] = regs->iasq[1];
3632 + regs->iaoq[0] = 0x100UL;
3633 + regs->iaoq[1] = regs->iaoq[0] + 4;
3634 + regs->iasq[0] = regs->sr[2];
3635 + regs->iasq[1] = regs->sr[2];
3636 + return 2;
3637 + }
3638 + } while (0);
3639 +#endif
3640 +
3641 + return 1;
3642 +}
3643 +
3644 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
3645 +{
3646 + unsigned long i;
3647 +
3648 + printk(KERN_ERR "PAX: bytes at PC: ");
3649 + for (i = 0; i < 5; i++) {
3650 + unsigned int c;
3651 + if (get_user(c, (unsigned int *)pc+i))
3652 + printk(KERN_CONT "???????? ");
3653 + else
3654 + printk(KERN_CONT "%08x ", c);
3655 + }
3656 + printk("\n");
3657 +}
3658 +#endif
3659 +
3660 int fixup_exception(struct pt_regs *regs)
3661 {
3662 const struct exception_table_entry *fix;
3663 @@ -192,8 +303,33 @@ good_area:
3664
3665 acc_type = parisc_acctyp(code,regs->iir);
3666
3667 - if ((vma->vm_flags & acc_type) != acc_type)
3668 + if ((vma->vm_flags & acc_type) != acc_type) {
3669 +
3670 +#ifdef CONFIG_PAX_PAGEEXEC
3671 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
3672 + (address & ~3UL) == instruction_pointer(regs))
3673 + {
3674 + up_read(&mm->mmap_sem);
3675 + switch (pax_handle_fetch_fault(regs)) {
3676 +
3677 +#ifdef CONFIG_PAX_EMUPLT
3678 + case 3:
3679 + return;
3680 +#endif
3681 +
3682 +#ifdef CONFIG_PAX_EMUTRAMP
3683 + case 2:
3684 + return;
3685 +#endif
3686 +
3687 + }
3688 + pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
3689 + do_group_exit(SIGKILL);
3690 + }
3691 +#endif
3692 +
3693 goto bad_area;
3694 + }
3695
3696 /*
3697 * If for any reason at all we couldn't handle the fault, make
3698 diff --git a/arch/powerpc/include/asm/atomic.h b/arch/powerpc/include/asm/atomic.h
3699 index da29032..f76c24c 100644
3700 --- a/arch/powerpc/include/asm/atomic.h
3701 +++ b/arch/powerpc/include/asm/atomic.h
3702 @@ -522,6 +522,16 @@ static __inline__ long atomic64_inc_not_zero(atomic64_t *v)
3703 return t1;
3704 }
3705
3706 +#define atomic64_read_unchecked(v) atomic64_read(v)
3707 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
3708 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
3709 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
3710 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
3711 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
3712 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
3713 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
3714 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
3715 +
3716 #endif /* __powerpc64__ */
3717
3718 #endif /* __KERNEL__ */
3719 diff --git a/arch/powerpc/include/asm/cache.h b/arch/powerpc/include/asm/cache.h
3720 index 9e495c9..b6878e5 100644
3721 --- a/arch/powerpc/include/asm/cache.h
3722 +++ b/arch/powerpc/include/asm/cache.h
3723 @@ -3,6 +3,7 @@
3724
3725 #ifdef __KERNEL__
3726
3727 +#include <linux/const.h>
3728
3729 /* bytes per L1 cache line */
3730 #if defined(CONFIG_8xx) || defined(CONFIG_403GCX)
3731 @@ -22,7 +23,7 @@
3732 #define L1_CACHE_SHIFT 7
3733 #endif
3734
3735 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
3736 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
3737
3738 #define SMP_CACHE_BYTES L1_CACHE_BYTES
3739
3740 diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
3741 index 3bf9cca..e7457d0 100644
3742 --- a/arch/powerpc/include/asm/elf.h
3743 +++ b/arch/powerpc/include/asm/elf.h
3744 @@ -178,8 +178,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[ELF_NVSRHALFREG];
3745 the loader. We need to make sure that it is out of the way of the program
3746 that it will "exec", and that there is sufficient room for the brk. */
3747
3748 -extern unsigned long randomize_et_dyn(unsigned long base);
3749 -#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
3750 +#define ELF_ET_DYN_BASE (0x20000000)
3751 +
3752 +#ifdef CONFIG_PAX_ASLR
3753 +#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
3754 +
3755 +#ifdef __powerpc64__
3756 +#define PAX_DELTA_MMAP_LEN (is_32bit_task() ? 16 : 28)
3757 +#define PAX_DELTA_STACK_LEN (is_32bit_task() ? 16 : 28)
3758 +#else
3759 +#define PAX_DELTA_MMAP_LEN 15
3760 +#define PAX_DELTA_STACK_LEN 15
3761 +#endif
3762 +#endif
3763
3764 /*
3765 * Our registers are always unsigned longs, whether we're a 32 bit
3766 @@ -274,9 +285,6 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
3767 (0x7ff >> (PAGE_SHIFT - 12)) : \
3768 (0x3ffff >> (PAGE_SHIFT - 12)))
3769
3770 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
3771 -#define arch_randomize_brk arch_randomize_brk
3772 -
3773 #endif /* __KERNEL__ */
3774
3775 /*
3776 diff --git a/arch/powerpc/include/asm/exec.h b/arch/powerpc/include/asm/exec.h
3777 index 8196e9c..d83a9f3 100644
3778 --- a/arch/powerpc/include/asm/exec.h
3779 +++ b/arch/powerpc/include/asm/exec.h
3780 @@ -4,6 +4,6 @@
3781 #ifndef _ASM_POWERPC_EXEC_H
3782 #define _ASM_POWERPC_EXEC_H
3783
3784 -extern unsigned long arch_align_stack(unsigned long sp);
3785 +#define arch_align_stack(x) ((x) & ~0xfUL)
3786
3787 #endif /* _ASM_POWERPC_EXEC_H */
3788 diff --git a/arch/powerpc/include/asm/kmap_types.h b/arch/powerpc/include/asm/kmap_types.h
3789 index bca8fdc..61e9580 100644
3790 --- a/arch/powerpc/include/asm/kmap_types.h
3791 +++ b/arch/powerpc/include/asm/kmap_types.h
3792 @@ -27,6 +27,7 @@ enum km_type {
3793 KM_PPC_SYNC_PAGE,
3794 KM_PPC_SYNC_ICACHE,
3795 KM_KDB,
3796 + KM_CLEARPAGE,
3797 KM_TYPE_NR
3798 };
3799
3800 diff --git a/arch/powerpc/include/asm/mman.h b/arch/powerpc/include/asm/mman.h
3801 index d4a7f64..451de1c 100644
3802 --- a/arch/powerpc/include/asm/mman.h
3803 +++ b/arch/powerpc/include/asm/mman.h
3804 @@ -44,7 +44,7 @@ static inline unsigned long arch_calc_vm_prot_bits(unsigned long prot)
3805 }
3806 #define arch_calc_vm_prot_bits(prot) arch_calc_vm_prot_bits(prot)
3807
3808 -static inline pgprot_t arch_vm_get_page_prot(unsigned long vm_flags)
3809 +static inline pgprot_t arch_vm_get_page_prot(vm_flags_t vm_flags)
3810 {
3811 return (vm_flags & VM_SAO) ? __pgprot(_PAGE_SAO) : __pgprot(0);
3812 }
3813 diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
3814 index f072e97..b436dee 100644
3815 --- a/arch/powerpc/include/asm/page.h
3816 +++ b/arch/powerpc/include/asm/page.h
3817 @@ -220,8 +220,9 @@ extern long long virt_phys_offset;
3818 * and needs to be executable. This means the whole heap ends
3819 * up being executable.
3820 */
3821 -#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
3822 - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3823 +#define VM_DATA_DEFAULT_FLAGS32 \
3824 + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
3825 + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3826
3827 #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
3828 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3829 @@ -249,6 +250,9 @@ extern long long virt_phys_offset;
3830 #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
3831 #endif
3832
3833 +#define ktla_ktva(addr) (addr)
3834 +#define ktva_ktla(addr) (addr)
3835 +
3836 /*
3837 * Use the top bit of the higher-level page table entries to indicate whether
3838 * the entries we point to contain hugepages. This works because we know that
3839 diff --git a/arch/powerpc/include/asm/page_64.h b/arch/powerpc/include/asm/page_64.h
3840 index fed85e6..da5c71b 100644
3841 --- a/arch/powerpc/include/asm/page_64.h
3842 +++ b/arch/powerpc/include/asm/page_64.h
3843 @@ -146,15 +146,18 @@ do { \
3844 * stack by default, so in the absence of a PT_GNU_STACK program header
3845 * we turn execute permission off.
3846 */
3847 -#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
3848 - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3849 +#define VM_STACK_DEFAULT_FLAGS32 \
3850 + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
3851 + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3852
3853 #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
3854 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3855
3856 +#ifndef CONFIG_PAX_PAGEEXEC
3857 #define VM_STACK_DEFAULT_FLAGS \
3858 (is_32bit_task() ? \
3859 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
3860 +#endif
3861
3862 #include <asm-generic/getorder.h>
3863
3864 diff --git a/arch/powerpc/include/asm/pgalloc-64.h b/arch/powerpc/include/asm/pgalloc-64.h
3865 index 292725c..f87ae14 100644
3866 --- a/arch/powerpc/include/asm/pgalloc-64.h
3867 +++ b/arch/powerpc/include/asm/pgalloc-64.h
3868 @@ -50,6 +50,7 @@ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
3869 #ifndef CONFIG_PPC_64K_PAGES
3870
3871 #define pgd_populate(MM, PGD, PUD) pgd_set(PGD, PUD)
3872 +#define pgd_populate_kernel(MM, PGD, PUD) pgd_populate((MM), (PGD), (PUD))
3873
3874 static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
3875 {
3876 @@ -67,6 +68,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
3877 pud_set(pud, (unsigned long)pmd);
3878 }
3879
3880 +static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
3881 +{
3882 + pud_populate(mm, pud, pmd);
3883 +}
3884 +
3885 #define pmd_populate(mm, pmd, pte_page) \
3886 pmd_populate_kernel(mm, pmd, page_address(pte_page))
3887 #define pmd_populate_kernel(mm, pmd, pte) pmd_set(pmd, (unsigned long)(pte))
3888 @@ -76,6 +82,7 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
3889 #else /* CONFIG_PPC_64K_PAGES */
3890
3891 #define pud_populate(mm, pud, pmd) pud_set(pud, (unsigned long)pmd)
3892 +#define pud_populate_kernel(mm, pud, pmd) pud_populate((mm), (pud), (pmd))
3893
3894 static inline void pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd,
3895 pte_t *pte)
3896 diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
3897 index 2e0e411..7899c68 100644
3898 --- a/arch/powerpc/include/asm/pgtable.h
3899 +++ b/arch/powerpc/include/asm/pgtable.h
3900 @@ -2,6 +2,7 @@
3901 #define _ASM_POWERPC_PGTABLE_H
3902 #ifdef __KERNEL__
3903
3904 +#include <linux/const.h>
3905 #ifndef __ASSEMBLY__
3906 #include <asm/processor.h> /* For TASK_SIZE */
3907 #include <asm/mmu.h>
3908 diff --git a/arch/powerpc/include/asm/pte-hash32.h b/arch/powerpc/include/asm/pte-hash32.h
3909 index 4aad413..85d86bf 100644
3910 --- a/arch/powerpc/include/asm/pte-hash32.h
3911 +++ b/arch/powerpc/include/asm/pte-hash32.h
3912 @@ -21,6 +21,7 @@
3913 #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
3914 #define _PAGE_USER 0x004 /* usermode access allowed */
3915 #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
3916 +#define _PAGE_EXEC _PAGE_GUARDED
3917 #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
3918 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
3919 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
3920 diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
3921 index 360585d..c3930ef 100644
3922 --- a/arch/powerpc/include/asm/reg.h
3923 +++ b/arch/powerpc/include/asm/reg.h
3924 @@ -212,6 +212,7 @@
3925 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
3926 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
3927 #define DSISR_NOHPTE 0x40000000 /* no translation found */
3928 +#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
3929 #define DSISR_PROTFAULT 0x08000000 /* protection fault */
3930 #define DSISR_ISSTORE 0x02000000 /* access was a store */
3931 #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
3932 diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/asm/thread_info.h
3933 index 68831e9..379c695 100644
3934 --- a/arch/powerpc/include/asm/thread_info.h
3935 +++ b/arch/powerpc/include/asm/thread_info.h
3936 @@ -91,12 +91,14 @@ static inline struct thread_info *current_thread_info(void)
3937 #define TIF_PERFMON_CTXSW 6 /* perfmon needs ctxsw calls */
3938 #define TIF_SYSCALL_AUDIT 7 /* syscall auditing active */
3939 #define TIF_SINGLESTEP 8 /* singlestepping active */
3940 -#define TIF_MEMDIE 9 /* is terminating due to OOM killer */
3941 #define TIF_SECCOMP 10 /* secure computing */
3942 #define TIF_RESTOREALL 11 /* Restore all regs (implies NOERROR) */
3943 #define TIF_NOERROR 12 /* Force successful syscall return */
3944 #define TIF_NOTIFY_RESUME 13 /* callback before returning to user */
3945 #define TIF_SYSCALL_TRACEPOINT 15 /* syscall tracepoint instrumentation */
3946 +#define TIF_MEMDIE 16 /* is terminating due to OOM killer */
3947 +/* mask must be expressable within 16 bits to satisfy 'andi' instruction reqs */
3948 +#define TIF_GRSEC_SETXID 9 /* update credentials on syscall entry/exit */
3949
3950 /* as above, but as bit values */
3951 #define _TIF_SYSCALL_TRACE (1<<TIF_SYSCALL_TRACE)
3952 @@ -113,8 +115,10 @@ static inline struct thread_info *current_thread_info(void)
3953 #define _TIF_NOERROR (1<<TIF_NOERROR)
3954 #define _TIF_NOTIFY_RESUME (1<<TIF_NOTIFY_RESUME)
3955 #define _TIF_SYSCALL_TRACEPOINT (1<<TIF_SYSCALL_TRACEPOINT)
3956 +#define _TIF_GRSEC_SETXID (1<<TIF_GRSEC_SETXID)
3957 #define _TIF_SYSCALL_T_OR_A (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \
3958 - _TIF_SECCOMP | _TIF_SYSCALL_TRACEPOINT)
3959 + _TIF_SECCOMP | _TIF_SYSCALL_TRACEPOINT | \
3960 + _TIF_GRSEC_SETXID)
3961
3962 #define _TIF_USER_WORK_MASK (_TIF_SIGPENDING | _TIF_NEED_RESCHED | \
3963 _TIF_NOTIFY_RESUME)
3964 diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
3965 index 17bb40c..353c98b 100644
3966 --- a/arch/powerpc/include/asm/uaccess.h
3967 +++ b/arch/powerpc/include/asm/uaccess.h
3968 @@ -13,6 +13,8 @@
3969 #define VERIFY_READ 0
3970 #define VERIFY_WRITE 1
3971
3972 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
3973 +
3974 /*
3975 * The fs value determines whether argument validity checking should be
3976 * performed or not. If get_fs() == USER_DS, checking is performed, with
3977 @@ -329,52 +331,6 @@ do { \
3978 extern unsigned long __copy_tofrom_user(void __user *to,
3979 const void __user *from, unsigned long size);
3980
3981 -#ifndef __powerpc64__
3982 -
3983 -static inline unsigned long copy_from_user(void *to,
3984 - const void __user *from, unsigned long n)
3985 -{
3986 - unsigned long over;
3987 -
3988 - if (access_ok(VERIFY_READ, from, n))
3989 - return __copy_tofrom_user((__force void __user *)to, from, n);
3990 - if ((unsigned long)from < TASK_SIZE) {
3991 - over = (unsigned long)from + n - TASK_SIZE;
3992 - return __copy_tofrom_user((__force void __user *)to, from,
3993 - n - over) + over;
3994 - }
3995 - return n;
3996 -}
3997 -
3998 -static inline unsigned long copy_to_user(void __user *to,
3999 - const void *from, unsigned long n)
4000 -{
4001 - unsigned long over;
4002 -
4003 - if (access_ok(VERIFY_WRITE, to, n))
4004 - return __copy_tofrom_user(to, (__force void __user *)from, n);
4005 - if ((unsigned long)to < TASK_SIZE) {
4006 - over = (unsigned long)to + n - TASK_SIZE;
4007 - return __copy_tofrom_user(to, (__force void __user *)from,
4008 - n - over) + over;
4009 - }
4010 - return n;
4011 -}
4012 -
4013 -#else /* __powerpc64__ */
4014 -
4015 -#define __copy_in_user(to, from, size) \
4016 - __copy_tofrom_user((to), (from), (size))
4017 -
4018 -extern unsigned long copy_from_user(void *to, const void __user *from,
4019 - unsigned long n);
4020 -extern unsigned long copy_to_user(void __user *to, const void *from,
4021 - unsigned long n);
4022 -extern unsigned long copy_in_user(void __user *to, const void __user *from,
4023 - unsigned long n);
4024 -
4025 -#endif /* __powerpc64__ */
4026 -
4027 static inline unsigned long __copy_from_user_inatomic(void *to,
4028 const void __user *from, unsigned long n)
4029 {
4030 @@ -398,6 +354,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
4031 if (ret == 0)
4032 return 0;
4033 }
4034 +
4035 + if (!__builtin_constant_p(n))
4036 + check_object_size(to, n, false);
4037 +
4038 return __copy_tofrom_user((__force void __user *)to, from, n);
4039 }
4040
4041 @@ -424,6 +384,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
4042 if (ret == 0)
4043 return 0;
4044 }
4045 +
4046 + if (!__builtin_constant_p(n))
4047 + check_object_size(from, n, true);
4048 +
4049 return __copy_tofrom_user(to, (__force const void __user *)from, n);
4050 }
4051
4052 @@ -441,6 +405,92 @@ static inline unsigned long __copy_to_user(void __user *to,
4053 return __copy_to_user_inatomic(to, from, size);
4054 }
4055
4056 +#ifndef __powerpc64__
4057 +
4058 +static inline unsigned long __must_check copy_from_user(void *to,
4059 + const void __user *from, unsigned long n)
4060 +{
4061 + unsigned long over;
4062 +
4063 + if ((long)n < 0)
4064 + return n;
4065 +
4066 + if (access_ok(VERIFY_READ, from, n)) {
4067 + if (!__builtin_constant_p(n))
4068 + check_object_size(to, n, false);
4069 + return __copy_tofrom_user((__force void __user *)to, from, n);
4070 + }
4071 + if ((unsigned long)from < TASK_SIZE) {
4072 + over = (unsigned long)from + n - TASK_SIZE;
4073 + if (!__builtin_constant_p(n - over))
4074 + check_object_size(to, n - over, false);
4075 + return __copy_tofrom_user((__force void __user *)to, from,
4076 + n - over) + over;
4077 + }
4078 + return n;
4079 +}
4080 +
4081 +static inline unsigned long __must_check copy_to_user(void __user *to,
4082 + const void *from, unsigned long n)
4083 +{
4084 + unsigned long over;
4085 +
4086 + if ((long)n < 0)
4087 + return n;
4088 +
4089 + if (access_ok(VERIFY_WRITE, to, n)) {
4090 + if (!__builtin_constant_p(n))
4091 + check_object_size(from, n, true);
4092 + return __copy_tofrom_user(to, (__force void __user *)from, n);
4093 + }
4094 + if ((unsigned long)to < TASK_SIZE) {
4095 + over = (unsigned long)to + n - TASK_SIZE;
4096 + if (!__builtin_constant_p(n))
4097 + check_object_size(from, n - over, true);
4098 + return __copy_tofrom_user(to, (__force void __user *)from,
4099 + n - over) + over;
4100 + }
4101 + return n;
4102 +}
4103 +
4104 +#else /* __powerpc64__ */
4105 +
4106 +#define __copy_in_user(to, from, size) \
4107 + __copy_tofrom_user((to), (from), (size))
4108 +
4109 +static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
4110 +{
4111 + if ((long)n < 0 || n > INT_MAX)
4112 + return n;
4113 +
4114 + if (!__builtin_constant_p(n))
4115 + check_object_size(to, n, false);
4116 +
4117 + if (likely(access_ok(VERIFY_READ, from, n)))
4118 + n = __copy_from_user(to, from, n);
4119 + else
4120 + memset(to, 0, n);
4121 + return n;
4122 +}
4123 +
4124 +static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
4125 +{
4126 + if ((long)n < 0 || n > INT_MAX)
4127 + return n;
4128 +
4129 + if (likely(access_ok(VERIFY_WRITE, to, n))) {
4130 + if (!__builtin_constant_p(n))
4131 + check_object_size(from, n, true);
4132 + n = __copy_to_user(to, from, n);
4133 + }
4134 + return n;
4135 +}
4136 +
4137 +extern unsigned long copy_in_user(void __user *to, const void __user *from,
4138 + unsigned long n);
4139 +
4140 +#endif /* __powerpc64__ */
4141 +
4142 extern unsigned long __clear_user(void __user *addr, unsigned long size);
4143
4144 static inline unsigned long clear_user(void __user *addr, unsigned long size)
4145 diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S
4146 index 7215cc2..a9730c1 100644
4147 --- a/arch/powerpc/kernel/exceptions-64e.S
4148 +++ b/arch/powerpc/kernel/exceptions-64e.S
4149 @@ -661,6 +661,7 @@ storage_fault_common:
4150 std r14,_DAR(r1)
4151 std r15,_DSISR(r1)
4152 addi r3,r1,STACK_FRAME_OVERHEAD
4153 + bl .save_nvgprs
4154 mr r4,r14
4155 mr r5,r15
4156 ld r14,PACA_EXGEN+EX_R14(r13)
4157 @@ -669,8 +670,7 @@ storage_fault_common:
4158 cmpdi r3,0
4159 bne- 1f
4160 b .ret_from_except_lite
4161 -1: bl .save_nvgprs
4162 - mr r5,r3
4163 +1: mr r5,r3
4164 addi r3,r1,STACK_FRAME_OVERHEAD
4165 ld r4,_DAR(r1)
4166 bl .bad_page_fault
4167 diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
4168 index 1c06d29..c2a339b 100644
4169 --- a/arch/powerpc/kernel/exceptions-64s.S
4170 +++ b/arch/powerpc/kernel/exceptions-64s.S
4171 @@ -888,10 +888,10 @@ handle_page_fault:
4172 11: ld r4,_DAR(r1)
4173 ld r5,_DSISR(r1)
4174 addi r3,r1,STACK_FRAME_OVERHEAD
4175 + bl .save_nvgprs
4176 bl .do_page_fault
4177 cmpdi r3,0
4178 beq+ 12f
4179 - bl .save_nvgprs
4180 mr r5,r3
4181 addi r3,r1,STACK_FRAME_OVERHEAD
4182 lwz r4,_DAR(r1)
4183 diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
4184 index 2e3200c..72095ce 100644
4185 --- a/arch/powerpc/kernel/module_32.c
4186 +++ b/arch/powerpc/kernel/module_32.c
4187 @@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr *hdr,
4188 me->arch.core_plt_section = i;
4189 }
4190 if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
4191 - printk("Module doesn't contain .plt or .init.plt sections.\n");
4192 + printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
4193 return -ENOEXEC;
4194 }
4195
4196 @@ -192,11 +192,16 @@ static uint32_t do_plt_call(void *location,
4197
4198 DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
4199 /* Init, or core PLT? */
4200 - if (location >= mod->module_core
4201 - && location < mod->module_core + mod->core_size)
4202 + if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
4203 + (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
4204 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
4205 - else
4206 + else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
4207 + (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
4208 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
4209 + else {
4210 + printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
4211 + return ~0UL;
4212 + }
4213
4214 /* Find this entry, or if that fails, the next avail. entry */
4215 while (entry->jump[0]) {
4216 diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
4217 index 1a1f2dd..f4d1bb4 100644
4218 --- a/arch/powerpc/kernel/process.c
4219 +++ b/arch/powerpc/kernel/process.c
4220 @@ -681,8 +681,8 @@ void show_regs(struct pt_regs * regs)
4221 * Lookup NIP late so we have the best change of getting the
4222 * above info out without failing
4223 */
4224 - printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
4225 - printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
4226 + printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
4227 + printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
4228 #endif
4229 show_stack(current, (unsigned long *) regs->gpr[1]);
4230 if (!user_mode(regs))
4231 @@ -1181,10 +1181,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
4232 newsp = stack[0];
4233 ip = stack[STACK_FRAME_LR_SAVE];
4234 if (!firstframe || ip != lr) {
4235 - printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
4236 + printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
4237 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
4238 if ((ip == rth || ip == mrth) && curr_frame >= 0) {
4239 - printk(" (%pS)",
4240 + printk(" (%pA)",
4241 (void *)current->ret_stack[curr_frame].ret);
4242 curr_frame--;
4243 }
4244 @@ -1204,7 +1204,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
4245 struct pt_regs *regs = (struct pt_regs *)
4246 (sp + STACK_FRAME_OVERHEAD);
4247 lr = regs->link;
4248 - printk("--- Exception: %lx at %pS\n LR = %pS\n",
4249 + printk("--- Exception: %lx at %pA\n LR = %pA\n",
4250 regs->trap, (void *)regs->nip, (void *)lr);
4251 firstframe = 1;
4252 }
4253 @@ -1246,58 +1246,3 @@ void __ppc64_runlatch_off(void)
4254 mtspr(SPRN_CTRLT, ctrl);
4255 }
4256 #endif /* CONFIG_PPC64 */
4257 -
4258 -unsigned long arch_align_stack(unsigned long sp)
4259 -{
4260 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
4261 - sp -= get_random_int() & ~PAGE_MASK;
4262 - return sp & ~0xf;
4263 -}
4264 -
4265 -static inline unsigned long brk_rnd(void)
4266 -{
4267 - unsigned long rnd = 0;
4268 -
4269 - /* 8MB for 32bit, 1GB for 64bit */
4270 - if (is_32bit_task())
4271 - rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
4272 - else
4273 - rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
4274 -
4275 - return rnd << PAGE_SHIFT;
4276 -}
4277 -
4278 -unsigned long arch_randomize_brk(struct mm_struct *mm)
4279 -{
4280 - unsigned long base = mm->brk;
4281 - unsigned long ret;
4282 -
4283 -#ifdef CONFIG_PPC_STD_MMU_64
4284 - /*
4285 - * If we are using 1TB segments and we are allowed to randomise
4286 - * the heap, we can put it above 1TB so it is backed by a 1TB
4287 - * segment. Otherwise the heap will be in the bottom 1TB
4288 - * which always uses 256MB segments and this may result in a
4289 - * performance penalty.
4290 - */
4291 - if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
4292 - base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
4293 -#endif
4294 -
4295 - ret = PAGE_ALIGN(base + brk_rnd());
4296 -
4297 - if (ret < mm->brk)
4298 - return mm->brk;
4299 -
4300 - return ret;
4301 -}
4302 -
4303 -unsigned long randomize_et_dyn(unsigned long base)
4304 -{
4305 - unsigned long ret = PAGE_ALIGN(base + brk_rnd());
4306 -
4307 - if (ret < base)
4308 - return base;
4309 -
4310 - return ret;
4311 -}
4312 diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
4313 index c10fc28..c4ef063 100644
4314 --- a/arch/powerpc/kernel/ptrace.c
4315 +++ b/arch/powerpc/kernel/ptrace.c
4316 @@ -1660,6 +1660,10 @@ long arch_ptrace(struct task_struct *child, long request,
4317 return ret;
4318 }
4319
4320 +#ifdef CONFIG_GRKERNSEC_SETXID
4321 +extern void gr_delayed_cred_worker(void);
4322 +#endif
4323 +
4324 /*
4325 * We must return the syscall number to actually look up in the table.
4326 * This can be -1L to skip running any syscall at all.
4327 @@ -1670,6 +1674,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
4328
4329 secure_computing_strict(regs->gpr[0]);
4330
4331 +#ifdef CONFIG_GRKERNSEC_SETXID
4332 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
4333 + gr_delayed_cred_worker();
4334 +#endif
4335 +
4336 if (test_thread_flag(TIF_SYSCALL_TRACE) &&
4337 tracehook_report_syscall_entry(regs))
4338 /*
4339 @@ -1704,6 +1713,11 @@ void do_syscall_trace_leave(struct pt_regs *regs)
4340 {
4341 int step;
4342
4343 +#ifdef CONFIG_GRKERNSEC_SETXID
4344 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
4345 + gr_delayed_cred_worker();
4346 +#endif
4347 +
4348 audit_syscall_exit(regs);
4349
4350 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
4351 diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
4352 index 8b4c049..dcd6ef3 100644
4353 --- a/arch/powerpc/kernel/signal_32.c
4354 +++ b/arch/powerpc/kernel/signal_32.c
4355 @@ -852,7 +852,7 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
4356 /* Save user registers on the stack */
4357 frame = &rt_sf->uc.uc_mcontext;
4358 addr = frame;
4359 - if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
4360 + if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
4361 if (save_user_regs(regs, frame, 0, 1))
4362 goto badframe;
4363 regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
4364 diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
4365 index d183f87..1867f1a 100644
4366 --- a/arch/powerpc/kernel/signal_64.c
4367 +++ b/arch/powerpc/kernel/signal_64.c
4368 @@ -430,7 +430,7 @@ int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info,
4369 current->thread.fpscr.val = 0;
4370
4371 /* Set up to return from userspace. */
4372 - if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
4373 + if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
4374 regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
4375 } else {
4376 err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
4377 diff --git a/arch/powerpc/kernel/syscalls.c b/arch/powerpc/kernel/syscalls.c
4378 index f2496f2..4e3cc47 100644
4379 --- a/arch/powerpc/kernel/syscalls.c
4380 +++ b/arch/powerpc/kernel/syscalls.c
4381 @@ -107,11 +107,11 @@ long ppc64_personality(unsigned long personality)
4382 long ret;
4383
4384 if (personality(current->personality) == PER_LINUX32
4385 - && personality == PER_LINUX)
4386 - personality = PER_LINUX32;
4387 + && personality(personality) == PER_LINUX)
4388 + personality = (personality & ~PER_MASK) | PER_LINUX32;
4389 ret = sys_personality(personality);
4390 - if (ret == PER_LINUX32)
4391 - ret = PER_LINUX;
4392 + if (personality(ret) == PER_LINUX32)
4393 + ret = (ret & ~PER_MASK) | PER_LINUX;
4394 return ret;
4395 }
4396 #endif
4397 diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
4398 index ae0843f..f16372c 100644
4399 --- a/arch/powerpc/kernel/traps.c
4400 +++ b/arch/powerpc/kernel/traps.c
4401 @@ -133,6 +133,8 @@ static unsigned __kprobes long oops_begin(struct pt_regs *regs)
4402 return flags;
4403 }
4404
4405 +extern void gr_handle_kernel_exploit(void);
4406 +
4407 static void __kprobes oops_end(unsigned long flags, struct pt_regs *regs,
4408 int signr)
4409 {
4410 @@ -182,6 +184,9 @@ static void __kprobes oops_end(unsigned long flags, struct pt_regs *regs,
4411 panic("Fatal exception in interrupt");
4412 if (panic_on_oops)
4413 panic("Fatal exception");
4414 +
4415 + gr_handle_kernel_exploit();
4416 +
4417 do_exit(signr);
4418 }
4419
4420 diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
4421 index 9eb5b9b..e45498a 100644
4422 --- a/arch/powerpc/kernel/vdso.c
4423 +++ b/arch/powerpc/kernel/vdso.c
4424 @@ -34,6 +34,7 @@
4425 #include <asm/firmware.h>
4426 #include <asm/vdso.h>
4427 #include <asm/vdso_datapage.h>
4428 +#include <asm/mman.h>
4429
4430 #include "setup.h"
4431
4432 @@ -218,7 +219,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
4433 vdso_base = VDSO32_MBASE;
4434 #endif
4435
4436 - current->mm->context.vdso_base = 0;
4437 + current->mm->context.vdso_base = ~0UL;
4438
4439 /* vDSO has a problem and was disabled, just don't "enable" it for the
4440 * process
4441 @@ -238,7 +239,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
4442 vdso_base = get_unmapped_area(NULL, vdso_base,
4443 (vdso_pages << PAGE_SHIFT) +
4444 ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
4445 - 0, 0);
4446 + 0, MAP_PRIVATE | MAP_EXECUTABLE);
4447 if (IS_ERR_VALUE(vdso_base)) {
4448 rc = vdso_base;
4449 goto fail_mmapsem;
4450 diff --git a/arch/powerpc/lib/usercopy_64.c b/arch/powerpc/lib/usercopy_64.c
4451 index 5eea6f3..5d10396 100644
4452 --- a/arch/powerpc/lib/usercopy_64.c
4453 +++ b/arch/powerpc/lib/usercopy_64.c
4454 @@ -9,22 +9,6 @@
4455 #include <linux/module.h>
4456 #include <asm/uaccess.h>
4457
4458 -unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
4459 -{
4460 - if (likely(access_ok(VERIFY_READ, from, n)))
4461 - n = __copy_from_user(to, from, n);
4462 - else
4463 - memset(to, 0, n);
4464 - return n;
4465 -}
4466 -
4467 -unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
4468 -{
4469 - if (likely(access_ok(VERIFY_WRITE, to, n)))
4470 - n = __copy_to_user(to, from, n);
4471 - return n;
4472 -}
4473 -
4474 unsigned long copy_in_user(void __user *to, const void __user *from,
4475 unsigned long n)
4476 {
4477 @@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *to, const void __user *from,
4478 return n;
4479 }
4480
4481 -EXPORT_SYMBOL(copy_from_user);
4482 -EXPORT_SYMBOL(copy_to_user);
4483 EXPORT_SYMBOL(copy_in_user);
4484
4485 diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
4486 index 08ffcf5..a0ab912 100644
4487 --- a/arch/powerpc/mm/fault.c
4488 +++ b/arch/powerpc/mm/fault.c
4489 @@ -32,6 +32,10 @@
4490 #include <linux/perf_event.h>
4491 #include <linux/magic.h>
4492 #include <linux/ratelimit.h>
4493 +#include <linux/slab.h>
4494 +#include <linux/pagemap.h>
4495 +#include <linux/compiler.h>
4496 +#include <linux/unistd.h>
4497
4498 #include <asm/firmware.h>
4499 #include <asm/page.h>
4500 @@ -68,6 +72,33 @@ static inline int notify_page_fault(struct pt_regs *regs)
4501 }
4502 #endif
4503
4504 +#ifdef CONFIG_PAX_PAGEEXEC
4505 +/*
4506 + * PaX: decide what to do with offenders (regs->nip = fault address)
4507 + *
4508 + * returns 1 when task should be killed
4509 + */
4510 +static int pax_handle_fetch_fault(struct pt_regs *regs)
4511 +{
4512 + return 1;
4513 +}
4514 +
4515 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
4516 +{
4517 + unsigned long i;
4518 +
4519 + printk(KERN_ERR "PAX: bytes at PC: ");
4520 + for (i = 0; i < 5; i++) {
4521 + unsigned int c;
4522 + if (get_user(c, (unsigned int __user *)pc+i))
4523 + printk(KERN_CONT "???????? ");
4524 + else
4525 + printk(KERN_CONT "%08x ", c);
4526 + }
4527 + printk("\n");
4528 +}
4529 +#endif
4530 +
4531 /*
4532 * Check whether the instruction at regs->nip is a store using
4533 * an update addressing form which will update r1.
4534 @@ -215,7 +246,7 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
4535 * indicate errors in DSISR but can validly be set in SRR1.
4536 */
4537 if (trap == 0x400)
4538 - error_code &= 0x48200000;
4539 + error_code &= 0x58200000;
4540 else
4541 is_write = error_code & DSISR_ISSTORE;
4542 #else
4543 @@ -366,7 +397,7 @@ good_area:
4544 * "undefined". Of those that can be set, this is the only
4545 * one which seems bad.
4546 */
4547 - if (error_code & 0x10000000)
4548 + if (error_code & DSISR_GUARDED)
4549 /* Guarded storage error. */
4550 goto bad_area;
4551 #endif /* CONFIG_8xx */
4552 @@ -381,7 +412,7 @@ good_area:
4553 * processors use the same I/D cache coherency mechanism
4554 * as embedded.
4555 */
4556 - if (error_code & DSISR_PROTFAULT)
4557 + if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
4558 goto bad_area;
4559 #endif /* CONFIG_PPC_STD_MMU */
4560
4561 @@ -463,6 +494,23 @@ bad_area:
4562 bad_area_nosemaphore:
4563 /* User mode accesses cause a SIGSEGV */
4564 if (user_mode(regs)) {
4565 +
4566 +#ifdef CONFIG_PAX_PAGEEXEC
4567 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
4568 +#ifdef CONFIG_PPC_STD_MMU
4569 + if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
4570 +#else
4571 + if (is_exec && regs->nip == address) {
4572 +#endif
4573 + switch (pax_handle_fetch_fault(regs)) {
4574 + }
4575 +
4576 + pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
4577 + do_group_exit(SIGKILL);
4578 + }
4579 + }
4580 +#endif
4581 +
4582 _exception(SIGSEGV, regs, code, address);
4583 return 0;
4584 }
4585 diff --git a/arch/powerpc/mm/mmap_64.c b/arch/powerpc/mm/mmap_64.c
4586 index 67a42ed..1c7210c 100644
4587 --- a/arch/powerpc/mm/mmap_64.c
4588 +++ b/arch/powerpc/mm/mmap_64.c
4589 @@ -91,10 +91,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
4590 */
4591 if (mmap_is_legacy()) {
4592 mm->mmap_base = TASK_UNMAPPED_BASE;
4593 +
4594 +#ifdef CONFIG_PAX_RANDMMAP
4595 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4596 + mm->mmap_base += mm->delta_mmap;
4597 +#endif
4598 +
4599 mm->get_unmapped_area = arch_get_unmapped_area;
4600 mm->unmap_area = arch_unmap_area;
4601 } else {
4602 mm->mmap_base = mmap_base();
4603 +
4604 +#ifdef CONFIG_PAX_RANDMMAP
4605 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4606 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4607 +#endif
4608 +
4609 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4610 mm->unmap_area = arch_unmap_area_topdown;
4611 }
4612 diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
4613 index 73709f7..6b90313 100644
4614 --- a/arch/powerpc/mm/slice.c
4615 +++ b/arch/powerpc/mm/slice.c
4616 @@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
4617 if ((mm->task_size - len) < addr)
4618 return 0;
4619 vma = find_vma(mm, addr);
4620 - return (!vma || (addr + len) <= vma->vm_start);
4621 + return check_heap_stack_gap(vma, addr, len);
4622 }
4623
4624 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
4625 @@ -256,7 +256,7 @@ full_search:
4626 addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT);
4627 continue;
4628 }
4629 - if (!vma || addr + len <= vma->vm_start) {
4630 + if (check_heap_stack_gap(vma, addr, len)) {
4631 /*
4632 * Remember the place where we stopped the search:
4633 */
4634 @@ -313,10 +313,14 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
4635 }
4636 }
4637
4638 - addr = mm->mmap_base;
4639 - while (addr > len) {
4640 + if (mm->mmap_base < len)
4641 + addr = -ENOMEM;
4642 + else
4643 + addr = mm->mmap_base - len;
4644 +
4645 + while (!IS_ERR_VALUE(addr)) {
4646 /* Go down by chunk size */
4647 - addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
4648 + addr = _ALIGN_DOWN(addr, 1ul << pshift);
4649
4650 /* Check for hit with different page size */
4651 mask = slice_range_to_mask(addr, len);
4652 @@ -336,7 +340,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
4653 * return with success:
4654 */
4655 vma = find_vma(mm, addr);
4656 - if (!vma || (addr + len) <= vma->vm_start) {
4657 + if (check_heap_stack_gap(vma, addr, len)) {
4658 /* remember the address as a hint for next time */
4659 if (use_cache)
4660 mm->free_area_cache = addr;
4661 @@ -348,7 +352,7 @@ static unsigned long slice_find_area_topdown(struct mm_struct *mm,
4662 mm->cached_hole_size = vma->vm_start - addr;
4663
4664 /* try just below the current vma->vm_start */
4665 - addr = vma->vm_start;
4666 + addr = skip_heap_stack_gap(vma, len);
4667 }
4668
4669 /*
4670 @@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
4671 if (fixed && addr > (mm->task_size - len))
4672 return -EINVAL;
4673
4674 +#ifdef CONFIG_PAX_RANDMMAP
4675 + if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
4676 + addr = 0;
4677 +#endif
4678 +
4679 /* If hint, make sure it matches our alignment restrictions */
4680 if (!fixed && addr) {
4681 addr = _ALIGN_UP(addr, 1ul << pshift);
4682 diff --git a/arch/s390/include/asm/atomic.h b/arch/s390/include/asm/atomic.h
4683 index 748347b..81bc6c7 100644
4684 --- a/arch/s390/include/asm/atomic.h
4685 +++ b/arch/s390/include/asm/atomic.h
4686 @@ -326,6 +326,16 @@ static inline long long atomic64_dec_if_positive(atomic64_t *v)
4687 #define atomic64_dec_and_test(_v) (atomic64_sub_return(1, _v) == 0)
4688 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
4689
4690 +#define atomic64_read_unchecked(v) atomic64_read(v)
4691 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
4692 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
4693 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
4694 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
4695 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
4696 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
4697 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
4698 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
4699 +
4700 #define smp_mb__before_atomic_dec() smp_mb()
4701 #define smp_mb__after_atomic_dec() smp_mb()
4702 #define smp_mb__before_atomic_inc() smp_mb()
4703 diff --git a/arch/s390/include/asm/cache.h b/arch/s390/include/asm/cache.h
4704 index 2a30d5a..5e5586f 100644
4705 --- a/arch/s390/include/asm/cache.h
4706 +++ b/arch/s390/include/asm/cache.h
4707 @@ -11,8 +11,10 @@
4708 #ifndef __ARCH_S390_CACHE_H
4709 #define __ARCH_S390_CACHE_H
4710
4711 -#define L1_CACHE_BYTES 256
4712 +#include <linux/const.h>
4713 +
4714 #define L1_CACHE_SHIFT 8
4715 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
4716 #define NET_SKB_PAD 32
4717
4718 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
4719 diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
4720 index 06151e6..598f9a5 100644
4721 --- a/arch/s390/include/asm/elf.h
4722 +++ b/arch/s390/include/asm/elf.h
4723 @@ -161,8 +161,14 @@ extern unsigned int vdso_enabled;
4724 the loader. We need to make sure that it is out of the way of the program
4725 that it will "exec", and that there is sufficient room for the brk. */
4726
4727 -extern unsigned long randomize_et_dyn(unsigned long base);
4728 -#define ELF_ET_DYN_BASE (randomize_et_dyn(STACK_TOP / 3 * 2))
4729 +#define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
4730 +
4731 +#ifdef CONFIG_PAX_ASLR
4732 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
4733 +
4734 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26)
4735 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26)
4736 +#endif
4737
4738 /* This yields a mask that user programs can use to figure out what
4739 instruction set this CPU supports. */
4740 @@ -182,7 +188,8 @@ extern char elf_platform[];
4741 #define ELF_PLATFORM (elf_platform)
4742
4743 #ifndef CONFIG_64BIT
4744 -#define SET_PERSONALITY(ex) set_personality(PER_LINUX)
4745 +#define SET_PERSONALITY(ex) \
4746 + set_personality(PER_LINUX | (current->personality & (~PER_MASK)))
4747 #else /* CONFIG_64BIT */
4748 #define SET_PERSONALITY(ex) \
4749 do { \
4750 @@ -210,7 +217,4 @@ struct linux_binprm;
4751 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
4752 int arch_setup_additional_pages(struct linux_binprm *, int);
4753
4754 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
4755 -#define arch_randomize_brk arch_randomize_brk
4756 -
4757 #endif
4758 diff --git a/arch/s390/include/asm/exec.h b/arch/s390/include/asm/exec.h
4759 index c4a93d6..4d2a9b4 100644
4760 --- a/arch/s390/include/asm/exec.h
4761 +++ b/arch/s390/include/asm/exec.h
4762 @@ -7,6 +7,6 @@
4763 #ifndef __ASM_EXEC_H
4764 #define __ASM_EXEC_H
4765
4766 -extern unsigned long arch_align_stack(unsigned long sp);
4767 +#define arch_align_stack(x) ((x) & ~0xfUL)
4768
4769 #endif /* __ASM_EXEC_H */
4770 diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
4771 index 1f3a79b..44d7f9c 100644
4772 --- a/arch/s390/include/asm/uaccess.h
4773 +++ b/arch/s390/include/asm/uaccess.h
4774 @@ -241,6 +241,10 @@ static inline unsigned long __must_check
4775 copy_to_user(void __user *to, const void *from, unsigned long n)
4776 {
4777 might_fault();
4778 +
4779 + if ((long)n < 0)
4780 + return n;
4781 +
4782 if (access_ok(VERIFY_WRITE, to, n))
4783 n = __copy_to_user(to, from, n);
4784 return n;
4785 @@ -266,6 +270,9 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
4786 static inline unsigned long __must_check
4787 __copy_from_user(void *to, const void __user *from, unsigned long n)
4788 {
4789 + if ((long)n < 0)
4790 + return n;
4791 +
4792 if (__builtin_constant_p(n) && (n <= 256))
4793 return uaccess.copy_from_user_small(n, from, to);
4794 else
4795 @@ -297,10 +304,14 @@ __compiletime_warning("copy_from_user() buffer size is not provably correct")
4796 static inline unsigned long __must_check
4797 copy_from_user(void *to, const void __user *from, unsigned long n)
4798 {
4799 - unsigned int sz = __compiletime_object_size(to);
4800 + size_t sz = __compiletime_object_size(to);
4801
4802 might_fault();
4803 - if (unlikely(sz != -1 && sz < n)) {
4804 +
4805 + if ((long)n < 0)
4806 + return n;
4807 +
4808 + if (unlikely(sz != (size_t)-1 && sz < n)) {
4809 copy_from_user_overflow();
4810 return n;
4811 }
4812 diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
4813 index dfcb343..eda788a 100644
4814 --- a/arch/s390/kernel/module.c
4815 +++ b/arch/s390/kernel/module.c
4816 @@ -161,11 +161,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
4817
4818 /* Increase core size by size of got & plt and set start
4819 offsets for got and plt. */
4820 - me->core_size = ALIGN(me->core_size, 4);
4821 - me->arch.got_offset = me->core_size;
4822 - me->core_size += me->arch.got_size;
4823 - me->arch.plt_offset = me->core_size;
4824 - me->core_size += me->arch.plt_size;
4825 + me->core_size_rw = ALIGN(me->core_size_rw, 4);
4826 + me->arch.got_offset = me->core_size_rw;
4827 + me->core_size_rw += me->arch.got_size;
4828 + me->arch.plt_offset = me->core_size_rx;
4829 + me->core_size_rx += me->arch.plt_size;
4830 return 0;
4831 }
4832
4833 @@ -242,7 +242,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
4834 if (info->got_initialized == 0) {
4835 Elf_Addr *gotent;
4836
4837 - gotent = me->module_core + me->arch.got_offset +
4838 + gotent = me->module_core_rw + me->arch.got_offset +
4839 info->got_offset;
4840 *gotent = val;
4841 info->got_initialized = 1;
4842 @@ -266,7 +266,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
4843 else if (r_type == R_390_GOTENT ||
4844 r_type == R_390_GOTPLTENT)
4845 *(unsigned int *) loc =
4846 - (val + (Elf_Addr) me->module_core - loc) >> 1;
4847 + (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
4848 else if (r_type == R_390_GOT64 ||
4849 r_type == R_390_GOTPLT64)
4850 *(unsigned long *) loc = val;
4851 @@ -280,7 +280,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
4852 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
4853 if (info->plt_initialized == 0) {
4854 unsigned int *ip;
4855 - ip = me->module_core + me->arch.plt_offset +
4856 + ip = me->module_core_rx + me->arch.plt_offset +
4857 info->plt_offset;
4858 #ifndef CONFIG_64BIT
4859 ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
4860 @@ -305,7 +305,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
4861 val - loc + 0xffffUL < 0x1ffffeUL) ||
4862 (r_type == R_390_PLT32DBL &&
4863 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
4864 - val = (Elf_Addr) me->module_core +
4865 + val = (Elf_Addr) me->module_core_rx +
4866 me->arch.plt_offset +
4867 info->plt_offset;
4868 val += rela->r_addend - loc;
4869 @@ -327,7 +327,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
4870 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
4871 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
4872 val = val + rela->r_addend -
4873 - ((Elf_Addr) me->module_core + me->arch.got_offset);
4874 + ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
4875 if (r_type == R_390_GOTOFF16)
4876 *(unsigned short *) loc = val;
4877 else if (r_type == R_390_GOTOFF32)
4878 @@ -337,7 +337,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
4879 break;
4880 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
4881 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
4882 - val = (Elf_Addr) me->module_core + me->arch.got_offset +
4883 + val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
4884 rela->r_addend - loc;
4885 if (r_type == R_390_GOTPC)
4886 *(unsigned int *) loc = val;
4887 diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
4888 index 60055ce..ee4b252 100644
4889 --- a/arch/s390/kernel/process.c
4890 +++ b/arch/s390/kernel/process.c
4891 @@ -316,39 +316,3 @@ unsigned long get_wchan(struct task_struct *p)
4892 }
4893 return 0;
4894 }
4895 -
4896 -unsigned long arch_align_stack(unsigned long sp)
4897 -{
4898 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
4899 - sp -= get_random_int() & ~PAGE_MASK;
4900 - return sp & ~0xf;
4901 -}
4902 -
4903 -static inline unsigned long brk_rnd(void)
4904 -{
4905 - /* 8MB for 32bit, 1GB for 64bit */
4906 - if (is_32bit_task())
4907 - return (get_random_int() & 0x7ffUL) << PAGE_SHIFT;
4908 - else
4909 - return (get_random_int() & 0x3ffffUL) << PAGE_SHIFT;
4910 -}
4911 -
4912 -unsigned long arch_randomize_brk(struct mm_struct *mm)
4913 -{
4914 - unsigned long ret = PAGE_ALIGN(mm->brk + brk_rnd());
4915 -
4916 - if (ret < mm->brk)
4917 - return mm->brk;
4918 - return ret;
4919 -}
4920 -
4921 -unsigned long randomize_et_dyn(unsigned long base)
4922 -{
4923 - unsigned long ret = PAGE_ALIGN(base + brk_rnd());
4924 -
4925 - if (!(current->flags & PF_RANDOMIZE))
4926 - return base;
4927 - if (ret < base)
4928 - return base;
4929 - return ret;
4930 -}
4931 diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
4932 index a64fe53..5c66963 100644
4933 --- a/arch/s390/mm/mmap.c
4934 +++ b/arch/s390/mm/mmap.c
4935 @@ -92,10 +92,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
4936 */
4937 if (mmap_is_legacy()) {
4938 mm->mmap_base = TASK_UNMAPPED_BASE;
4939 +
4940 +#ifdef CONFIG_PAX_RANDMMAP
4941 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4942 + mm->mmap_base += mm->delta_mmap;
4943 +#endif
4944 +
4945 mm->get_unmapped_area = arch_get_unmapped_area;
4946 mm->unmap_area = arch_unmap_area;
4947 } else {
4948 mm->mmap_base = mmap_base();
4949 +
4950 +#ifdef CONFIG_PAX_RANDMMAP
4951 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4952 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4953 +#endif
4954 +
4955 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4956 mm->unmap_area = arch_unmap_area_topdown;
4957 }
4958 @@ -174,10 +186,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
4959 */
4960 if (mmap_is_legacy()) {
4961 mm->mmap_base = TASK_UNMAPPED_BASE;
4962 +
4963 +#ifdef CONFIG_PAX_RANDMMAP
4964 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4965 + mm->mmap_base += mm->delta_mmap;
4966 +#endif
4967 +
4968 mm->get_unmapped_area = s390_get_unmapped_area;
4969 mm->unmap_area = arch_unmap_area;
4970 } else {
4971 mm->mmap_base = mmap_base();
4972 +
4973 +#ifdef CONFIG_PAX_RANDMMAP
4974 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4975 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4976 +#endif
4977 +
4978 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
4979 mm->unmap_area = arch_unmap_area_topdown;
4980 }
4981 diff --git a/arch/score/include/asm/cache.h b/arch/score/include/asm/cache.h
4982 index ae3d59f..f65f075 100644
4983 --- a/arch/score/include/asm/cache.h
4984 +++ b/arch/score/include/asm/cache.h
4985 @@ -1,7 +1,9 @@
4986 #ifndef _ASM_SCORE_CACHE_H
4987 #define _ASM_SCORE_CACHE_H
4988
4989 +#include <linux/const.h>
4990 +
4991 #define L1_CACHE_SHIFT 4
4992 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
4993 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
4994
4995 #endif /* _ASM_SCORE_CACHE_H */
4996 diff --git a/arch/score/include/asm/exec.h b/arch/score/include/asm/exec.h
4997 index f9f3cd5..58ff438 100644
4998 --- a/arch/score/include/asm/exec.h
4999 +++ b/arch/score/include/asm/exec.h
5000 @@ -1,6 +1,6 @@
5001 #ifndef _ASM_SCORE_EXEC_H
5002 #define _ASM_SCORE_EXEC_H
5003
5004 -extern unsigned long arch_align_stack(unsigned long sp);
5005 +#define arch_align_stack(x) (x)
5006
5007 #endif /* _ASM_SCORE_EXEC_H */
5008 diff --git a/arch/score/kernel/process.c b/arch/score/kernel/process.c
5009 index 2707023..1c2a3b7 100644
5010 --- a/arch/score/kernel/process.c
5011 +++ b/arch/score/kernel/process.c
5012 @@ -159,8 +159,3 @@ unsigned long get_wchan(struct task_struct *task)
5013
5014 return task_pt_regs(task)->cp0_epc;
5015 }
5016 -
5017 -unsigned long arch_align_stack(unsigned long sp)
5018 -{
5019 - return sp;
5020 -}
5021 diff --git a/arch/sh/include/asm/cache.h b/arch/sh/include/asm/cache.h
5022 index ef9e555..331bd29 100644
5023 --- a/arch/sh/include/asm/cache.h
5024 +++ b/arch/sh/include/asm/cache.h
5025 @@ -9,10 +9,11 @@
5026 #define __ASM_SH_CACHE_H
5027 #ifdef __KERNEL__
5028
5029 +#include <linux/const.h>
5030 #include <linux/init.h>
5031 #include <cpu/cache.h>
5032
5033 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
5034 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
5035
5036 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
5037
5038 diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c
5039 index afeb710..d1d1289 100644
5040 --- a/arch/sh/mm/mmap.c
5041 +++ b/arch/sh/mm/mmap.c
5042 @@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
5043 addr = PAGE_ALIGN(addr);
5044
5045 vma = find_vma(mm, addr);
5046 - if (TASK_SIZE - len >= addr &&
5047 - (!vma || addr + len <= vma->vm_start))
5048 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
5049 return addr;
5050 }
5051
5052 @@ -106,7 +105,7 @@ full_search:
5053 }
5054 return -ENOMEM;
5055 }
5056 - if (likely(!vma || addr + len <= vma->vm_start)) {
5057 + if (likely(check_heap_stack_gap(vma, addr, len))) {
5058 /*
5059 * Remember the place where we stopped the search:
5060 */
5061 @@ -157,8 +156,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5062 addr = PAGE_ALIGN(addr);
5063
5064 vma = find_vma(mm, addr);
5065 - if (TASK_SIZE - len >= addr &&
5066 - (!vma || addr + len <= vma->vm_start))
5067 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
5068 return addr;
5069 }
5070
5071 @@ -179,7 +177,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5072 /* make sure it can fit in the remaining address space */
5073 if (likely(addr > len)) {
5074 vma = find_vma(mm, addr-len);
5075 - if (!vma || addr <= vma->vm_start) {
5076 + if (check_heap_stack_gap(vma, addr - len, len)) {
5077 /* remember the address as a hint for next time */
5078 return (mm->free_area_cache = addr-len);
5079 }
5080 @@ -188,18 +186,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5081 if (unlikely(mm->mmap_base < len))
5082 goto bottomup;
5083
5084 - addr = mm->mmap_base-len;
5085 - if (do_colour_align)
5086 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5087 + addr = mm->mmap_base - len;
5088
5089 do {
5090 + if (do_colour_align)
5091 + addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5092 /*
5093 * Lookup failure means no vma is above this address,
5094 * else if new region fits below vma->vm_start,
5095 * return with success:
5096 */
5097 vma = find_vma(mm, addr);
5098 - if (likely(!vma || addr+len <= vma->vm_start)) {
5099 + if (likely(check_heap_stack_gap(vma, addr, len))) {
5100 /* remember the address as a hint for next time */
5101 return (mm->free_area_cache = addr);
5102 }
5103 @@ -209,10 +207,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5104 mm->cached_hole_size = vma->vm_start - addr;
5105
5106 /* try just below the current vma->vm_start */
5107 - addr = vma->vm_start-len;
5108 - if (do_colour_align)
5109 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5110 - } while (likely(len < vma->vm_start));
5111 + addr = skip_heap_stack_gap(vma, len);
5112 + } while (!IS_ERR_VALUE(addr));
5113
5114 bottomup:
5115 /*
5116 diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
5117 index ce35a1c..2e7b8f9 100644
5118 --- a/arch/sparc/include/asm/atomic_64.h
5119 +++ b/arch/sparc/include/asm/atomic_64.h
5120 @@ -14,18 +14,40 @@
5121 #define ATOMIC64_INIT(i) { (i) }
5122
5123 #define atomic_read(v) (*(volatile int *)&(v)->counter)
5124 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
5125 +{
5126 + return v->counter;
5127 +}
5128 #define atomic64_read(v) (*(volatile long *)&(v)->counter)
5129 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
5130 +{
5131 + return v->counter;
5132 +}
5133
5134 #define atomic_set(v, i) (((v)->counter) = i)
5135 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
5136 +{
5137 + v->counter = i;
5138 +}
5139 #define atomic64_set(v, i) (((v)->counter) = i)
5140 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
5141 +{
5142 + v->counter = i;
5143 +}
5144
5145 extern void atomic_add(int, atomic_t *);
5146 +extern void atomic_add_unchecked(int, atomic_unchecked_t *);
5147 extern void atomic64_add(long, atomic64_t *);
5148 +extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
5149 extern void atomic_sub(int, atomic_t *);
5150 +extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
5151 extern void atomic64_sub(long, atomic64_t *);
5152 +extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
5153
5154 extern int atomic_add_ret(int, atomic_t *);
5155 +extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
5156 extern long atomic64_add_ret(long, atomic64_t *);
5157 +extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
5158 extern int atomic_sub_ret(int, atomic_t *);
5159 extern long atomic64_sub_ret(long, atomic64_t *);
5160
5161 @@ -33,13 +55,29 @@ extern long atomic64_sub_ret(long, atomic64_t *);
5162 #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
5163
5164 #define atomic_inc_return(v) atomic_add_ret(1, v)
5165 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
5166 +{
5167 + return atomic_add_ret_unchecked(1, v);
5168 +}
5169 #define atomic64_inc_return(v) atomic64_add_ret(1, v)
5170 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
5171 +{
5172 + return atomic64_add_ret_unchecked(1, v);
5173 +}
5174
5175 #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
5176 #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
5177
5178 #define atomic_add_return(i, v) atomic_add_ret(i, v)
5179 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
5180 +{
5181 + return atomic_add_ret_unchecked(i, v);
5182 +}
5183 #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
5184 +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
5185 +{
5186 + return atomic64_add_ret_unchecked(i, v);
5187 +}
5188
5189 /*
5190 * atomic_inc_and_test - increment and test
5191 @@ -50,6 +88,10 @@ extern long atomic64_sub_ret(long, atomic64_t *);
5192 * other cases.
5193 */
5194 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
5195 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
5196 +{
5197 + return atomic_inc_return_unchecked(v) == 0;
5198 +}
5199 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
5200
5201 #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
5202 @@ -59,25 +101,60 @@ extern long atomic64_sub_ret(long, atomic64_t *);
5203 #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
5204
5205 #define atomic_inc(v) atomic_add(1, v)
5206 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
5207 +{
5208 + atomic_add_unchecked(1, v);
5209 +}
5210 #define atomic64_inc(v) atomic64_add(1, v)
5211 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
5212 +{
5213 + atomic64_add_unchecked(1, v);
5214 +}
5215
5216 #define atomic_dec(v) atomic_sub(1, v)
5217 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
5218 +{
5219 + atomic_sub_unchecked(1, v);
5220 +}
5221 #define atomic64_dec(v) atomic64_sub(1, v)
5222 +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
5223 +{
5224 + atomic64_sub_unchecked(1, v);
5225 +}
5226
5227 #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
5228 #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
5229
5230 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
5231 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
5232 +{
5233 + return cmpxchg(&v->counter, old, new);
5234 +}
5235 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
5236 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
5237 +{
5238 + return xchg(&v->counter, new);
5239 +}
5240
5241 static inline int __atomic_add_unless(atomic_t *v, int a, int u)
5242 {
5243 - int c, old;
5244 + int c, old, new;
5245 c = atomic_read(v);
5246 for (;;) {
5247 - if (unlikely(c == (u)))
5248 + if (unlikely(c == u))
5249 break;
5250 - old = atomic_cmpxchg((v), c, c + (a));
5251 +
5252 + asm volatile("addcc %2, %0, %0\n"
5253 +
5254 +#ifdef CONFIG_PAX_REFCOUNT
5255 + "tvs %%icc, 6\n"
5256 +#endif
5257 +
5258 + : "=r" (new)
5259 + : "0" (c), "ir" (a)
5260 + : "cc");
5261 +
5262 + old = atomic_cmpxchg(v, c, new);
5263 if (likely(old == c))
5264 break;
5265 c = old;
5266 @@ -88,20 +165,35 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
5267 #define atomic64_cmpxchg(v, o, n) \
5268 ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
5269 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
5270 +static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
5271 +{
5272 + return xchg(&v->counter, new);
5273 +}
5274
5275 static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
5276 {
5277 - long c, old;
5278 + long c, old, new;
5279 c = atomic64_read(v);
5280 for (;;) {
5281 - if (unlikely(c == (u)))
5282 + if (unlikely(c == u))
5283 break;
5284 - old = atomic64_cmpxchg((v), c, c + (a));
5285 +
5286 + asm volatile("addcc %2, %0, %0\n"
5287 +
5288 +#ifdef CONFIG_PAX_REFCOUNT
5289 + "tvs %%xcc, 6\n"
5290 +#endif
5291 +
5292 + : "=r" (new)
5293 + : "0" (c), "ir" (a)
5294 + : "cc");
5295 +
5296 + old = atomic64_cmpxchg(v, c, new);
5297 if (likely(old == c))
5298 break;
5299 c = old;
5300 }
5301 - return c != (u);
5302 + return c != u;
5303 }
5304
5305 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
5306 diff --git a/arch/sparc/include/asm/cache.h b/arch/sparc/include/asm/cache.h
5307 index 5bb6991..5c2132e 100644
5308 --- a/arch/sparc/include/asm/cache.h
5309 +++ b/arch/sparc/include/asm/cache.h
5310 @@ -7,10 +7,12 @@
5311 #ifndef _SPARC_CACHE_H
5312 #define _SPARC_CACHE_H
5313
5314 +#include <linux/const.h>
5315 +
5316 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
5317
5318 #define L1_CACHE_SHIFT 5
5319 -#define L1_CACHE_BYTES 32
5320 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
5321
5322 #ifdef CONFIG_SPARC32
5323 #define SMP_CACHE_BYTES_SHIFT 5
5324 diff --git a/arch/sparc/include/asm/elf_32.h b/arch/sparc/include/asm/elf_32.h
5325 index 2d4d755..81b6662 100644
5326 --- a/arch/sparc/include/asm/elf_32.h
5327 +++ b/arch/sparc/include/asm/elf_32.h
5328 @@ -114,6 +114,13 @@ typedef struct {
5329
5330 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
5331
5332 +#ifdef CONFIG_PAX_ASLR
5333 +#define PAX_ELF_ET_DYN_BASE 0x10000UL
5334 +
5335 +#define PAX_DELTA_MMAP_LEN 16
5336 +#define PAX_DELTA_STACK_LEN 16
5337 +#endif
5338 +
5339 /* This yields a mask that user programs can use to figure out what
5340 instruction set this cpu supports. This can NOT be done in userspace
5341 on Sparc. */
5342 diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
5343 index 7df8b7f..4946269 100644
5344 --- a/arch/sparc/include/asm/elf_64.h
5345 +++ b/arch/sparc/include/asm/elf_64.h
5346 @@ -180,6 +180,13 @@ typedef struct {
5347 #define ELF_ET_DYN_BASE 0x0000010000000000UL
5348 #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
5349
5350 +#ifdef CONFIG_PAX_ASLR
5351 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
5352 +
5353 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
5354 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
5355 +#endif
5356 +
5357 extern unsigned long sparc64_elf_hwcap;
5358 #define ELF_HWCAP sparc64_elf_hwcap
5359
5360 diff --git a/arch/sparc/include/asm/pgalloc_32.h b/arch/sparc/include/asm/pgalloc_32.h
5361 index e5b169b46..e90b4fa 100644
5362 --- a/arch/sparc/include/asm/pgalloc_32.h
5363 +++ b/arch/sparc/include/asm/pgalloc_32.h
5364 @@ -46,6 +46,7 @@ static inline void pgd_set(pgd_t * pgdp, pmd_t * pmdp)
5365 }
5366
5367 #define pgd_populate(MM, PGD, PMD) pgd_set(PGD, PMD)
5368 +#define pgd_populate_kernel(MM, PGD, PMD) pgd_populate((MM), (PGD), (PMD))
5369
5370 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm,
5371 unsigned long address)
5372 diff --git a/arch/sparc/include/asm/pgalloc_64.h b/arch/sparc/include/asm/pgalloc_64.h
5373 index 40b2d7a..22a665b 100644
5374 --- a/arch/sparc/include/asm/pgalloc_64.h
5375 +++ b/arch/sparc/include/asm/pgalloc_64.h
5376 @@ -26,6 +26,7 @@ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
5377 }
5378
5379 #define pud_populate(MM, PUD, PMD) pud_set(PUD, PMD)
5380 +#define pud_populate_kernel(MM, PUD, PMD) pud_populate((MM), (PUD), (PMD))
5381
5382 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
5383 {
5384 diff --git a/arch/sparc/include/asm/pgtable_32.h b/arch/sparc/include/asm/pgtable_32.h
5385 index cbbbed5..97f72f9 100644
5386 --- a/arch/sparc/include/asm/pgtable_32.h
5387 +++ b/arch/sparc/include/asm/pgtable_32.h
5388 @@ -50,6 +50,9 @@ extern unsigned long calc_highpages(void);
5389 #define PAGE_SHARED SRMMU_PAGE_SHARED
5390 #define PAGE_COPY SRMMU_PAGE_COPY
5391 #define PAGE_READONLY SRMMU_PAGE_RDONLY
5392 +#define PAGE_SHARED_NOEXEC SRMMU_PAGE_SHARED_NOEXEC
5393 +#define PAGE_COPY_NOEXEC SRMMU_PAGE_COPY_NOEXEC
5394 +#define PAGE_READONLY_NOEXEC SRMMU_PAGE_RDONLY_NOEXEC
5395 #define PAGE_KERNEL SRMMU_PAGE_KERNEL
5396
5397 /* Top-level page directory */
5398 @@ -61,18 +64,18 @@ extern unsigned long ptr_in_current_pgd;
5399
5400 /* xwr */
5401 #define __P000 PAGE_NONE
5402 -#define __P001 PAGE_READONLY
5403 -#define __P010 PAGE_COPY
5404 -#define __P011 PAGE_COPY
5405 +#define __P001 PAGE_READONLY_NOEXEC
5406 +#define __P010 PAGE_COPY_NOEXEC
5407 +#define __P011 PAGE_COPY_NOEXEC
5408 #define __P100 PAGE_READONLY
5409 #define __P101 PAGE_READONLY
5410 #define __P110 PAGE_COPY
5411 #define __P111 PAGE_COPY
5412
5413 #define __S000 PAGE_NONE
5414 -#define __S001 PAGE_READONLY
5415 -#define __S010 PAGE_SHARED
5416 -#define __S011 PAGE_SHARED
5417 +#define __S001 PAGE_READONLY_NOEXEC
5418 +#define __S010 PAGE_SHARED_NOEXEC
5419 +#define __S011 PAGE_SHARED_NOEXEC
5420 #define __S100 PAGE_READONLY
5421 #define __S101 PAGE_READONLY
5422 #define __S110 PAGE_SHARED
5423 diff --git a/arch/sparc/include/asm/pgtsrmmu.h b/arch/sparc/include/asm/pgtsrmmu.h
5424 index 79da178..c2eede8 100644
5425 --- a/arch/sparc/include/asm/pgtsrmmu.h
5426 +++ b/arch/sparc/include/asm/pgtsrmmu.h
5427 @@ -115,6 +115,11 @@
5428 SRMMU_EXEC | SRMMU_REF)
5429 #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
5430 SRMMU_EXEC | SRMMU_REF)
5431 +
5432 +#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
5433 +#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
5434 +#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
5435 +
5436 #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
5437 SRMMU_DIRTY | SRMMU_REF)
5438
5439 diff --git a/arch/sparc/include/asm/spinlock_64.h b/arch/sparc/include/asm/spinlock_64.h
5440 index 9689176..63c18ea 100644
5441 --- a/arch/sparc/include/asm/spinlock_64.h
5442 +++ b/arch/sparc/include/asm/spinlock_64.h
5443 @@ -92,14 +92,19 @@ static inline void arch_spin_lock_flags(arch_spinlock_t *lock, unsigned long fla
5444
5445 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
5446
5447 -static void inline arch_read_lock(arch_rwlock_t *lock)
5448 +static inline void arch_read_lock(arch_rwlock_t *lock)
5449 {
5450 unsigned long tmp1, tmp2;
5451
5452 __asm__ __volatile__ (
5453 "1: ldsw [%2], %0\n"
5454 " brlz,pn %0, 2f\n"
5455 -"4: add %0, 1, %1\n"
5456 +"4: addcc %0, 1, %1\n"
5457 +
5458 +#ifdef CONFIG_PAX_REFCOUNT
5459 +" tvs %%icc, 6\n"
5460 +#endif
5461 +
5462 " cas [%2], %0, %1\n"
5463 " cmp %0, %1\n"
5464 " bne,pn %%icc, 1b\n"
5465 @@ -112,10 +117,10 @@ static void inline arch_read_lock(arch_rwlock_t *lock)
5466 " .previous"
5467 : "=&r" (tmp1), "=&r" (tmp2)
5468 : "r" (lock)
5469 - : "memory");
5470 + : "memory", "cc");
5471 }
5472
5473 -static int inline arch_read_trylock(arch_rwlock_t *lock)
5474 +static inline int arch_read_trylock(arch_rwlock_t *lock)
5475 {
5476 int tmp1, tmp2;
5477
5478 @@ -123,7 +128,12 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
5479 "1: ldsw [%2], %0\n"
5480 " brlz,a,pn %0, 2f\n"
5481 " mov 0, %0\n"
5482 -" add %0, 1, %1\n"
5483 +" addcc %0, 1, %1\n"
5484 +
5485 +#ifdef CONFIG_PAX_REFCOUNT
5486 +" tvs %%icc, 6\n"
5487 +#endif
5488 +
5489 " cas [%2], %0, %1\n"
5490 " cmp %0, %1\n"
5491 " bne,pn %%icc, 1b\n"
5492 @@ -136,13 +146,18 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
5493 return tmp1;
5494 }
5495
5496 -static void inline arch_read_unlock(arch_rwlock_t *lock)
5497 +static inline void arch_read_unlock(arch_rwlock_t *lock)
5498 {
5499 unsigned long tmp1, tmp2;
5500
5501 __asm__ __volatile__(
5502 "1: lduw [%2], %0\n"
5503 -" sub %0, 1, %1\n"
5504 +" subcc %0, 1, %1\n"
5505 +
5506 +#ifdef CONFIG_PAX_REFCOUNT
5507 +" tvs %%icc, 6\n"
5508 +#endif
5509 +
5510 " cas [%2], %0, %1\n"
5511 " cmp %0, %1\n"
5512 " bne,pn %%xcc, 1b\n"
5513 @@ -152,7 +167,7 @@ static void inline arch_read_unlock(arch_rwlock_t *lock)
5514 : "memory");
5515 }
5516
5517 -static void inline arch_write_lock(arch_rwlock_t *lock)
5518 +static inline void arch_write_lock(arch_rwlock_t *lock)
5519 {
5520 unsigned long mask, tmp1, tmp2;
5521
5522 @@ -177,7 +192,7 @@ static void inline arch_write_lock(arch_rwlock_t *lock)
5523 : "memory");
5524 }
5525
5526 -static void inline arch_write_unlock(arch_rwlock_t *lock)
5527 +static inline void arch_write_unlock(arch_rwlock_t *lock)
5528 {
5529 __asm__ __volatile__(
5530 " stw %%g0, [%0]"
5531 @@ -186,7 +201,7 @@ static void inline arch_write_unlock(arch_rwlock_t *lock)
5532 : "memory");
5533 }
5534
5535 -static int inline arch_write_trylock(arch_rwlock_t *lock)
5536 +static inline int arch_write_trylock(arch_rwlock_t *lock)
5537 {
5538 unsigned long mask, tmp1, tmp2, result;
5539
5540 diff --git a/arch/sparc/include/asm/thread_info_32.h b/arch/sparc/include/asm/thread_info_32.h
5541 index e6cd224..3a71793 100644
5542 --- a/arch/sparc/include/asm/thread_info_32.h
5543 +++ b/arch/sparc/include/asm/thread_info_32.h
5544 @@ -49,6 +49,8 @@ struct thread_info {
5545 unsigned long w_saved;
5546
5547 struct restart_block restart_block;
5548 +
5549 + unsigned long lowest_stack;
5550 };
5551
5552 /*
5553 diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h
5554 index cfa8c38..13f30d3 100644
5555 --- a/arch/sparc/include/asm/thread_info_64.h
5556 +++ b/arch/sparc/include/asm/thread_info_64.h
5557 @@ -63,6 +63,8 @@ struct thread_info {
5558 struct pt_regs *kern_una_regs;
5559 unsigned int kern_una_insn;
5560
5561 + unsigned long lowest_stack;
5562 +
5563 unsigned long fpregs[0] __attribute__ ((aligned(64)));
5564 };
5565
5566 @@ -193,10 +195,11 @@ register struct thread_info *current_thread_info_reg asm("g6");
5567 #define TIF_UNALIGNED 5 /* allowed to do unaligned accesses */
5568 /* flag bit 6 is available */
5569 #define TIF_32BIT 7 /* 32-bit binary */
5570 -/* flag bit 8 is available */
5571 +#define TIF_GRSEC_SETXID 8 /* update credentials on syscall entry/exit */
5572 #define TIF_SECCOMP 9 /* secure computing */
5573 #define TIF_SYSCALL_AUDIT 10 /* syscall auditing active */
5574 #define TIF_SYSCALL_TRACEPOINT 11 /* syscall tracepoint instrumentation */
5575 +
5576 /* NOTE: Thread flags >= 12 should be ones we have no interest
5577 * in using in assembly, else we can't use the mask as
5578 * an immediate value in instructions such as andcc.
5579 @@ -215,12 +218,18 @@ register struct thread_info *current_thread_info_reg asm("g6");
5580 #define _TIF_SYSCALL_AUDIT (1<<TIF_SYSCALL_AUDIT)
5581 #define _TIF_SYSCALL_TRACEPOINT (1<<TIF_SYSCALL_TRACEPOINT)
5582 #define _TIF_POLLING_NRFLAG (1<<TIF_POLLING_NRFLAG)
5583 +#define _TIF_GRSEC_SETXID (1<<TIF_GRSEC_SETXID)
5584
5585 #define _TIF_USER_WORK_MASK ((0xff << TI_FLAG_WSAVED_SHIFT) | \
5586 _TIF_DO_NOTIFY_RESUME_MASK | \
5587 _TIF_NEED_RESCHED)
5588 #define _TIF_DO_NOTIFY_RESUME_MASK (_TIF_NOTIFY_RESUME | _TIF_SIGPENDING)
5589
5590 +#define _TIF_WORK_SYSCALL \
5591 + (_TIF_SYSCALL_TRACE | _TIF_SECCOMP | _TIF_SYSCALL_AUDIT | \
5592 + _TIF_SYSCALL_TRACEPOINT | _TIF_GRSEC_SETXID)
5593 +
5594 +
5595 /*
5596 * Thread-synchronous status.
5597 *
5598 diff --git a/arch/sparc/include/asm/uaccess.h b/arch/sparc/include/asm/uaccess.h
5599 index 0167d26..9acd8ed 100644
5600 --- a/arch/sparc/include/asm/uaccess.h
5601 +++ b/arch/sparc/include/asm/uaccess.h
5602 @@ -1,5 +1,13 @@
5603 #ifndef ___ASM_SPARC_UACCESS_H
5604 #define ___ASM_SPARC_UACCESS_H
5605 +
5606 +#ifdef __KERNEL__
5607 +#ifndef __ASSEMBLY__
5608 +#include <linux/types.h>
5609 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
5610 +#endif
5611 +#endif
5612 +
5613 #if defined(__sparc__) && defined(__arch64__)
5614 #include <asm/uaccess_64.h>
5615 #else
5616 diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
5617 index 53a28dd..50c38c3 100644
5618 --- a/arch/sparc/include/asm/uaccess_32.h
5619 +++ b/arch/sparc/include/asm/uaccess_32.h
5620 @@ -250,27 +250,46 @@ extern unsigned long __copy_user(void __user *to, const void __user *from, unsig
5621
5622 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
5623 {
5624 - if (n && __access_ok((unsigned long) to, n))
5625 + if ((long)n < 0)
5626 + return n;
5627 +
5628 + if (n && __access_ok((unsigned long) to, n)) {
5629 + if (!__builtin_constant_p(n))
5630 + check_object_size(from, n, true);
5631 return __copy_user(to, (__force void __user *) from, n);
5632 - else
5633 + } else
5634 return n;
5635 }
5636
5637 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
5638 {
5639 + if ((long)n < 0)
5640 + return n;
5641 +
5642 + if (!__builtin_constant_p(n))
5643 + check_object_size(from, n, true);
5644 +
5645 return __copy_user(to, (__force void __user *) from, n);
5646 }
5647
5648 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
5649 {
5650 - if (n && __access_ok((unsigned long) from, n))
5651 + if ((long)n < 0)
5652 + return n;
5653 +
5654 + if (n && __access_ok((unsigned long) from, n)) {
5655 + if (!__builtin_constant_p(n))
5656 + check_object_size(to, n, false);
5657 return __copy_user((__force void __user *) to, from, n);
5658 - else
5659 + } else
5660 return n;
5661 }
5662
5663 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
5664 {
5665 + if ((long)n < 0)
5666 + return n;
5667 +
5668 return __copy_user((__force void __user *) to, from, n);
5669 }
5670
5671 diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h
5672 index 7c831d8..d440ca7 100644
5673 --- a/arch/sparc/include/asm/uaccess_64.h
5674 +++ b/arch/sparc/include/asm/uaccess_64.h
5675 @@ -10,6 +10,7 @@
5676 #include <linux/compiler.h>
5677 #include <linux/string.h>
5678 #include <linux/thread_info.h>
5679 +#include <linux/kernel.h>
5680 #include <asm/asi.h>
5681 #include <asm/spitfire.h>
5682 #include <asm-generic/uaccess-unaligned.h>
5683 @@ -214,8 +215,15 @@ extern unsigned long copy_from_user_fixup(void *to, const void __user *from,
5684 static inline unsigned long __must_check
5685 copy_from_user(void *to, const void __user *from, unsigned long size)
5686 {
5687 - unsigned long ret = ___copy_from_user(to, from, size);
5688 + unsigned long ret;
5689
5690 + if ((long)size < 0 || size > INT_MAX)
5691 + return size;
5692 +
5693 + if (!__builtin_constant_p(size))
5694 + check_object_size(to, size, false);
5695 +
5696 + ret = ___copy_from_user(to, from, size);
5697 if (unlikely(ret))
5698 ret = copy_from_user_fixup(to, from, size);
5699
5700 @@ -231,8 +239,15 @@ extern unsigned long copy_to_user_fixup(void __user *to, const void *from,
5701 static inline unsigned long __must_check
5702 copy_to_user(void __user *to, const void *from, unsigned long size)
5703 {
5704 - unsigned long ret = ___copy_to_user(to, from, size);
5705 + unsigned long ret;
5706
5707 + if ((long)size < 0 || size > INT_MAX)
5708 + return size;
5709 +
5710 + if (!__builtin_constant_p(size))
5711 + check_object_size(from, size, true);
5712 +
5713 + ret = ___copy_to_user(to, from, size);
5714 if (unlikely(ret))
5715 ret = copy_to_user_fixup(to, from, size);
5716 return ret;
5717 diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
5718 index 6cf591b..b49e65a 100644
5719 --- a/arch/sparc/kernel/Makefile
5720 +++ b/arch/sparc/kernel/Makefile
5721 @@ -3,7 +3,7 @@
5722 #
5723
5724 asflags-y := -ansi
5725 -ccflags-y := -Werror
5726 +#ccflags-y := -Werror
5727
5728 extra-y := head_$(BITS).o
5729
5730 diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
5731 index cb36e82..1c1462f 100644
5732 --- a/arch/sparc/kernel/process_32.c
5733 +++ b/arch/sparc/kernel/process_32.c
5734 @@ -126,14 +126,14 @@ void show_regs(struct pt_regs *r)
5735
5736 printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
5737 r->psr, r->pc, r->npc, r->y, print_tainted());
5738 - printk("PC: <%pS>\n", (void *) r->pc);
5739 + printk("PC: <%pA>\n", (void *) r->pc);
5740 printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
5741 r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
5742 r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
5743 printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
5744 r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
5745 r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
5746 - printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
5747 + printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
5748
5749 printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
5750 rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
5751 @@ -168,7 +168,7 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
5752 rw = (struct reg_window32 *) fp;
5753 pc = rw->ins[7];
5754 printk("[%08lx : ", pc);
5755 - printk("%pS ] ", (void *) pc);
5756 + printk("%pA ] ", (void *) pc);
5757 fp = rw->ins[6];
5758 } while (++count < 16);
5759 printk("\n");
5760 diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
5761 index aff0c72..9067b39 100644
5762 --- a/arch/sparc/kernel/process_64.c
5763 +++ b/arch/sparc/kernel/process_64.c
5764 @@ -179,14 +179,14 @@ static void show_regwindow(struct pt_regs *regs)
5765 printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
5766 rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
5767 if (regs->tstate & TSTATE_PRIV)
5768 - printk("I7: <%pS>\n", (void *) rwk->ins[7]);
5769 + printk("I7: <%pA>\n", (void *) rwk->ins[7]);
5770 }
5771
5772 void show_regs(struct pt_regs *regs)
5773 {
5774 printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
5775 regs->tpc, regs->tnpc, regs->y, print_tainted());
5776 - printk("TPC: <%pS>\n", (void *) regs->tpc);
5777 + printk("TPC: <%pA>\n", (void *) regs->tpc);
5778 printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
5779 regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
5780 regs->u_regs[3]);
5781 @@ -199,7 +199,7 @@ void show_regs(struct pt_regs *regs)
5782 printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
5783 regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
5784 regs->u_regs[15]);
5785 - printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
5786 + printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
5787 show_regwindow(regs);
5788 show_stack(current, (unsigned long *) regs->u_regs[UREG_FP]);
5789 }
5790 @@ -284,7 +284,7 @@ void arch_trigger_all_cpu_backtrace(void)
5791 ((tp && tp->task) ? tp->task->pid : -1));
5792
5793 if (gp->tstate & TSTATE_PRIV) {
5794 - printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
5795 + printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
5796 (void *) gp->tpc,
5797 (void *) gp->o7,
5798 (void *) gp->i7,
5799 diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
5800 index 484daba..0674139 100644
5801 --- a/arch/sparc/kernel/ptrace_64.c
5802 +++ b/arch/sparc/kernel/ptrace_64.c
5803 @@ -1057,6 +1057,10 @@ long arch_ptrace(struct task_struct *child, long request,
5804 return ret;
5805 }
5806
5807 +#ifdef CONFIG_GRKERNSEC_SETXID
5808 +extern void gr_delayed_cred_worker(void);
5809 +#endif
5810 +
5811 asmlinkage int syscall_trace_enter(struct pt_regs *regs)
5812 {
5813 int ret = 0;
5814 @@ -1064,6 +1068,11 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
5815 /* do the secure computing check first */
5816 secure_computing_strict(regs->u_regs[UREG_G1]);
5817
5818 +#ifdef CONFIG_GRKERNSEC_SETXID
5819 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
5820 + gr_delayed_cred_worker();
5821 +#endif
5822 +
5823 if (test_thread_flag(TIF_SYSCALL_TRACE))
5824 ret = tracehook_report_syscall_entry(regs);
5825
5826 @@ -1084,6 +1093,11 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
5827
5828 asmlinkage void syscall_trace_leave(struct pt_regs *regs)
5829 {
5830 +#ifdef CONFIG_GRKERNSEC_SETXID
5831 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
5832 + gr_delayed_cred_worker();
5833 +#endif
5834 +
5835 audit_syscall_exit(regs);
5836
5837 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
5838 diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c
5839 index 0c9b31b..7cb7aee 100644
5840 --- a/arch/sparc/kernel/sys_sparc_32.c
5841 +++ b/arch/sparc/kernel/sys_sparc_32.c
5842 @@ -54,7 +54,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
5843 if (len > TASK_SIZE - PAGE_SIZE)
5844 return -ENOMEM;
5845 if (!addr)
5846 - addr = TASK_UNMAPPED_BASE;
5847 + addr = current->mm->mmap_base;
5848
5849 if (flags & MAP_SHARED)
5850 addr = COLOUR_ALIGN(addr);
5851 @@ -65,7 +65,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
5852 /* At this point: (!vmm || addr < vmm->vm_end). */
5853 if (TASK_SIZE - PAGE_SIZE - len < addr)
5854 return -ENOMEM;
5855 - if (!vmm || addr + len <= vmm->vm_start)
5856 + if (check_heap_stack_gap(vmm, addr, len))
5857 return addr;
5858 addr = vmm->vm_end;
5859 if (flags & MAP_SHARED)
5860 diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
5861 index 275f74f..81bf5b8 100644
5862 --- a/arch/sparc/kernel/sys_sparc_64.c
5863 +++ b/arch/sparc/kernel/sys_sparc_64.c
5864 @@ -124,7 +124,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
5865 /* We do not accept a shared mapping if it would violate
5866 * cache aliasing constraints.
5867 */
5868 - if ((flags & MAP_SHARED) &&
5869 + if ((filp || (flags & MAP_SHARED)) &&
5870 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
5871 return -EINVAL;
5872 return addr;
5873 @@ -139,6 +139,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
5874 if (filp || (flags & MAP_SHARED))
5875 do_color_align = 1;
5876
5877 +#ifdef CONFIG_PAX_RANDMMAP
5878 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
5879 +#endif
5880 +
5881 if (addr) {
5882 if (do_color_align)
5883 addr = COLOUR_ALIGN(addr, pgoff);
5884 @@ -146,15 +150,14 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
5885 addr = PAGE_ALIGN(addr);
5886
5887 vma = find_vma(mm, addr);
5888 - if (task_size - len >= addr &&
5889 - (!vma || addr + len <= vma->vm_start))
5890 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
5891 return addr;
5892 }
5893
5894 if (len > mm->cached_hole_size) {
5895 - start_addr = addr = mm->free_area_cache;
5896 + start_addr = addr = mm->free_area_cache;
5897 } else {
5898 - start_addr = addr = TASK_UNMAPPED_BASE;
5899 + start_addr = addr = mm->mmap_base;
5900 mm->cached_hole_size = 0;
5901 }
5902
5903 @@ -174,14 +177,14 @@ full_search:
5904 vma = find_vma(mm, VA_EXCLUDE_END);
5905 }
5906 if (unlikely(task_size < addr)) {
5907 - if (start_addr != TASK_UNMAPPED_BASE) {
5908 - start_addr = addr = TASK_UNMAPPED_BASE;
5909 + if (start_addr != mm->mmap_base) {
5910 + start_addr = addr = mm->mmap_base;
5911 mm->cached_hole_size = 0;
5912 goto full_search;
5913 }
5914 return -ENOMEM;
5915 }
5916 - if (likely(!vma || addr + len <= vma->vm_start)) {
5917 + if (likely(check_heap_stack_gap(vma, addr, len))) {
5918 /*
5919 * Remember the place where we stopped the search:
5920 */
5921 @@ -215,7 +218,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5922 /* We do not accept a shared mapping if it would violate
5923 * cache aliasing constraints.
5924 */
5925 - if ((flags & MAP_SHARED) &&
5926 + if ((filp || (flags & MAP_SHARED)) &&
5927 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
5928 return -EINVAL;
5929 return addr;
5930 @@ -236,8 +239,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5931 addr = PAGE_ALIGN(addr);
5932
5933 vma = find_vma(mm, addr);
5934 - if (task_size - len >= addr &&
5935 - (!vma || addr + len <= vma->vm_start))
5936 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
5937 return addr;
5938 }
5939
5940 @@ -258,7 +260,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5941 /* make sure it can fit in the remaining address space */
5942 if (likely(addr > len)) {
5943 vma = find_vma(mm, addr-len);
5944 - if (!vma || addr <= vma->vm_start) {
5945 + if (check_heap_stack_gap(vma, addr - len, len)) {
5946 /* remember the address as a hint for next time */
5947 return (mm->free_area_cache = addr-len);
5948 }
5949 @@ -267,18 +269,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5950 if (unlikely(mm->mmap_base < len))
5951 goto bottomup;
5952
5953 - addr = mm->mmap_base-len;
5954 - if (do_color_align)
5955 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5956 + addr = mm->mmap_base - len;
5957
5958 do {
5959 + if (do_color_align)
5960 + addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5961 /*
5962 * Lookup failure means no vma is above this address,
5963 * else if new region fits below vma->vm_start,
5964 * return with success:
5965 */
5966 vma = find_vma(mm, addr);
5967 - if (likely(!vma || addr+len <= vma->vm_start)) {
5968 + if (likely(check_heap_stack_gap(vma, addr, len))) {
5969 /* remember the address as a hint for next time */
5970 return (mm->free_area_cache = addr);
5971 }
5972 @@ -288,10 +290,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
5973 mm->cached_hole_size = vma->vm_start - addr;
5974
5975 /* try just below the current vma->vm_start */
5976 - addr = vma->vm_start-len;
5977 - if (do_color_align)
5978 - addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5979 - } while (likely(len < vma->vm_start));
5980 + addr = skip_heap_stack_gap(vma, len);
5981 + } while (!IS_ERR_VALUE(addr));
5982
5983 bottomup:
5984 /*
5985 @@ -390,6 +390,12 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
5986 gap == RLIM_INFINITY ||
5987 sysctl_legacy_va_layout) {
5988 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
5989 +
5990 +#ifdef CONFIG_PAX_RANDMMAP
5991 + if (mm->pax_flags & MF_PAX_RANDMMAP)
5992 + mm->mmap_base += mm->delta_mmap;
5993 +#endif
5994 +
5995 mm->get_unmapped_area = arch_get_unmapped_area;
5996 mm->unmap_area = arch_unmap_area;
5997 } else {
5998 @@ -402,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
5999 gap = (task_size / 6 * 5);
6000
6001 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
6002 +
6003 +#ifdef CONFIG_PAX_RANDMMAP
6004 + if (mm->pax_flags & MF_PAX_RANDMMAP)
6005 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
6006 +#endif
6007 +
6008 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
6009 mm->unmap_area = arch_unmap_area_topdown;
6010 }
6011 diff --git a/arch/sparc/kernel/syscalls.S b/arch/sparc/kernel/syscalls.S
6012 index 1d7e274..b39c527 100644
6013 --- a/arch/sparc/kernel/syscalls.S
6014 +++ b/arch/sparc/kernel/syscalls.S
6015 @@ -62,7 +62,7 @@ sys32_rt_sigreturn:
6016 #endif
6017 .align 32
6018 1: ldx [%g6 + TI_FLAGS], %l5
6019 - andcc %l5, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %g0
6020 + andcc %l5, _TIF_WORK_SYSCALL, %g0
6021 be,pt %icc, rtrap
6022 nop
6023 call syscall_trace_leave
6024 @@ -179,7 +179,7 @@ linux_sparc_syscall32:
6025
6026 srl %i5, 0, %o5 ! IEU1
6027 srl %i2, 0, %o2 ! IEU0 Group
6028 - andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %g0
6029 + andcc %l0, _TIF_WORK_SYSCALL, %g0
6030 bne,pn %icc, linux_syscall_trace32 ! CTI
6031 mov %i0, %l5 ! IEU1
6032 call %l7 ! CTI Group brk forced
6033 @@ -202,7 +202,7 @@ linux_sparc_syscall:
6034
6035 mov %i3, %o3 ! IEU1
6036 mov %i4, %o4 ! IEU0 Group
6037 - andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %g0
6038 + andcc %l0, _TIF_WORK_SYSCALL, %g0
6039 bne,pn %icc, linux_syscall_trace ! CTI Group
6040 mov %i0, %l5 ! IEU0
6041 2: call %l7 ! CTI Group brk forced
6042 @@ -226,7 +226,7 @@ ret_sys_call:
6043
6044 cmp %o0, -ERESTART_RESTARTBLOCK
6045 bgeu,pn %xcc, 1f
6046 - andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %l6
6047 + andcc %l0, _TIF_WORK_SYSCALL, %l6
6048 80:
6049 /* System call success, clear Carry condition code. */
6050 andn %g3, %g2, %g3
6051 @@ -241,7 +241,7 @@ ret_sys_call:
6052 /* System call failure, set Carry condition code.
6053 * Also, get abs(errno) to return to the process.
6054 */
6055 - andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %l6
6056 + andcc %l0, _TIF_WORK_SYSCALL, %l6
6057 sub %g0, %o0, %o0
6058 or %g3, %g2, %g3
6059 stx %o0, [%sp + PTREGS_OFF + PT_V9_I0]
6060 diff --git a/arch/sparc/kernel/traps_32.c b/arch/sparc/kernel/traps_32.c
6061 index a5785ea..405c5f7 100644
6062 --- a/arch/sparc/kernel/traps_32.c
6063 +++ b/arch/sparc/kernel/traps_32.c
6064 @@ -44,6 +44,8 @@ static void instruction_dump(unsigned long *pc)
6065 #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
6066 #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
6067
6068 +extern void gr_handle_kernel_exploit(void);
6069 +
6070 void die_if_kernel(char *str, struct pt_regs *regs)
6071 {
6072 static int die_counter;
6073 @@ -76,15 +78,17 @@ void die_if_kernel(char *str, struct pt_regs *regs)
6074 count++ < 30 &&
6075 (((unsigned long) rw) >= PAGE_OFFSET) &&
6076 !(((unsigned long) rw) & 0x7)) {
6077 - printk("Caller[%08lx]: %pS\n", rw->ins[7],
6078 + printk("Caller[%08lx]: %pA\n", rw->ins[7],
6079 (void *) rw->ins[7]);
6080 rw = (struct reg_window32 *)rw->ins[6];
6081 }
6082 }
6083 printk("Instruction DUMP:");
6084 instruction_dump ((unsigned long *) regs->pc);
6085 - if(regs->psr & PSR_PS)
6086 + if(regs->psr & PSR_PS) {
6087 + gr_handle_kernel_exploit();
6088 do_exit(SIGKILL);
6089 + }
6090 do_exit(SIGSEGV);
6091 }
6092
6093 diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
6094 index 3b05e66..6ea2917 100644
6095 --- a/arch/sparc/kernel/traps_64.c
6096 +++ b/arch/sparc/kernel/traps_64.c
6097 @@ -75,7 +75,7 @@ static void dump_tl1_traplog(struct tl1_traplog *p)
6098 i + 1,
6099 p->trapstack[i].tstate, p->trapstack[i].tpc,
6100 p->trapstack[i].tnpc, p->trapstack[i].tt);
6101 - printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
6102 + printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
6103 }
6104 }
6105
6106 @@ -95,6 +95,12 @@ void bad_trap(struct pt_regs *regs, long lvl)
6107
6108 lvl -= 0x100;
6109 if (regs->tstate & TSTATE_PRIV) {
6110 +
6111 +#ifdef CONFIG_PAX_REFCOUNT
6112 + if (lvl == 6)
6113 + pax_report_refcount_overflow(regs);
6114 +#endif
6115 +
6116 sprintf(buffer, "Kernel bad sw trap %lx", lvl);
6117 die_if_kernel(buffer, regs);
6118 }
6119 @@ -113,11 +119,16 @@ void bad_trap(struct pt_regs *regs, long lvl)
6120 void bad_trap_tl1(struct pt_regs *regs, long lvl)
6121 {
6122 char buffer[32];
6123 -
6124 +
6125 if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
6126 0, lvl, SIGTRAP) == NOTIFY_STOP)
6127 return;
6128
6129 +#ifdef CONFIG_PAX_REFCOUNT
6130 + if (lvl == 6)
6131 + pax_report_refcount_overflow(regs);
6132 +#endif
6133 +
6134 dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
6135
6136 sprintf (buffer, "Bad trap %lx at tl>0", lvl);
6137 @@ -1141,7 +1152,7 @@ static void cheetah_log_errors(struct pt_regs *regs, struct cheetah_err_info *in
6138 regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
6139 printk("%s" "ERROR(%d): ",
6140 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
6141 - printk("TPC<%pS>\n", (void *) regs->tpc);
6142 + printk("TPC<%pA>\n", (void *) regs->tpc);
6143 printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
6144 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
6145 (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
6146 @@ -1748,7 +1759,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
6147 smp_processor_id(),
6148 (type & 0x1) ? 'I' : 'D',
6149 regs->tpc);
6150 - printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
6151 + printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
6152 panic("Irrecoverable Cheetah+ parity error.");
6153 }
6154
6155 @@ -1756,7 +1767,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
6156 smp_processor_id(),
6157 (type & 0x1) ? 'I' : 'D',
6158 regs->tpc);
6159 - printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
6160 + printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
6161 }
6162
6163 struct sun4v_error_entry {
6164 @@ -1963,9 +1974,9 @@ void sun4v_itlb_error_report(struct pt_regs *regs, int tl)
6165
6166 printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
6167 regs->tpc, tl);
6168 - printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
6169 + printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
6170 printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
6171 - printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
6172 + printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
6173 (void *) regs->u_regs[UREG_I7]);
6174 printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
6175 "pte[%lx] error[%lx]\n",
6176 @@ -1987,9 +1998,9 @@ void sun4v_dtlb_error_report(struct pt_regs *regs, int tl)
6177
6178 printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
6179 regs->tpc, tl);
6180 - printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
6181 + printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
6182 printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
6183 - printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
6184 + printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
6185 (void *) regs->u_regs[UREG_I7]);
6186 printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
6187 "pte[%lx] error[%lx]\n",
6188 @@ -2195,13 +2206,13 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
6189 fp = (unsigned long)sf->fp + STACK_BIAS;
6190 }
6191
6192 - printk(" [%016lx] %pS\n", pc, (void *) pc);
6193 + printk(" [%016lx] %pA\n", pc, (void *) pc);
6194 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
6195 if ((pc + 8UL) == (unsigned long) &return_to_handler) {
6196 int index = tsk->curr_ret_stack;
6197 if (tsk->ret_stack && index >= graph) {
6198 pc = tsk->ret_stack[index - graph].ret;
6199 - printk(" [%016lx] %pS\n", pc, (void *) pc);
6200 + printk(" [%016lx] %pA\n", pc, (void *) pc);
6201 graph++;
6202 }
6203 }
6204 @@ -2226,6 +2237,8 @@ static inline struct reg_window *kernel_stack_up(struct reg_window *rw)
6205 return (struct reg_window *) (fp + STACK_BIAS);
6206 }
6207
6208 +extern void gr_handle_kernel_exploit(void);
6209 +
6210 void die_if_kernel(char *str, struct pt_regs *regs)
6211 {
6212 static int die_counter;
6213 @@ -2254,7 +2267,7 @@ void die_if_kernel(char *str, struct pt_regs *regs)
6214 while (rw &&
6215 count++ < 30 &&
6216 kstack_valid(tp, (unsigned long) rw)) {
6217 - printk("Caller[%016lx]: %pS\n", rw->ins[7],
6218 + printk("Caller[%016lx]: %pA\n", rw->ins[7],
6219 (void *) rw->ins[7]);
6220
6221 rw = kernel_stack_up(rw);
6222 @@ -2267,8 +2280,10 @@ void die_if_kernel(char *str, struct pt_regs *regs)
6223 }
6224 user_instruction_dump ((unsigned int __user *) regs->tpc);
6225 }
6226 - if (regs->tstate & TSTATE_PRIV)
6227 + if (regs->tstate & TSTATE_PRIV) {
6228 + gr_handle_kernel_exploit();
6229 do_exit(SIGKILL);
6230 + }
6231 do_exit(SIGSEGV);
6232 }
6233 EXPORT_SYMBOL(die_if_kernel);
6234 diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
6235 index f81d038..e7a4680 100644
6236 --- a/arch/sparc/kernel/unaligned_64.c
6237 +++ b/arch/sparc/kernel/unaligned_64.c
6238 @@ -278,7 +278,7 @@ static void log_unaligned(struct pt_regs *regs)
6239 static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
6240
6241 if (__ratelimit(&ratelimit)) {
6242 - printk("Kernel unaligned access at TPC[%lx] %pS\n",
6243 + printk("Kernel unaligned access at TPC[%lx] %pA\n",
6244 regs->tpc, (void *) regs->tpc);
6245 }
6246 }
6247 diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
6248 index dff4096..bd9a388 100644
6249 --- a/arch/sparc/lib/Makefile
6250 +++ b/arch/sparc/lib/Makefile
6251 @@ -2,7 +2,7 @@
6252 #
6253
6254 asflags-y := -ansi -DST_DIV0=0x02
6255 -ccflags-y := -Werror
6256 +#ccflags-y := -Werror
6257
6258 lib-$(CONFIG_SPARC32) += ashrdi3.o
6259 lib-$(CONFIG_SPARC32) += memcpy.o memset.o
6260 diff --git a/arch/sparc/lib/atomic_64.S b/arch/sparc/lib/atomic_64.S
6261 index 4d502da..527c48d 100644
6262 --- a/arch/sparc/lib/atomic_64.S
6263 +++ b/arch/sparc/lib/atomic_64.S
6264 @@ -17,7 +17,12 @@
6265 ENTRY(atomic_add) /* %o0 = increment, %o1 = atomic_ptr */
6266 BACKOFF_SETUP(%o2)
6267 1: lduw [%o1], %g1
6268 - add %g1, %o0, %g7
6269 + addcc %g1, %o0, %g7
6270 +
6271 +#ifdef CONFIG_PAX_REFCOUNT
6272 + tvs %icc, 6
6273 +#endif
6274 +
6275 cas [%o1], %g1, %g7
6276 cmp %g1, %g7
6277 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6278 @@ -27,10 +32,28 @@ ENTRY(atomic_add) /* %o0 = increment, %o1 = atomic_ptr */
6279 2: BACKOFF_SPIN(%o2, %o3, 1b)
6280 ENDPROC(atomic_add)
6281
6282 +ENTRY(atomic_add_unchecked) /* %o0 = increment, %o1 = atomic_ptr */
6283 + BACKOFF_SETUP(%o2)
6284 +1: lduw [%o1], %g1
6285 + add %g1, %o0, %g7
6286 + cas [%o1], %g1, %g7
6287 + cmp %g1, %g7
6288 + bne,pn %icc, 2f
6289 + nop
6290 + retl
6291 + nop
6292 +2: BACKOFF_SPIN(%o2, %o3, 1b)
6293 +ENDPROC(atomic_add_unchecked)
6294 +
6295 ENTRY(atomic_sub) /* %o0 = decrement, %o1 = atomic_ptr */
6296 BACKOFF_SETUP(%o2)
6297 1: lduw [%o1], %g1
6298 - sub %g1, %o0, %g7
6299 + subcc %g1, %o0, %g7
6300 +
6301 +#ifdef CONFIG_PAX_REFCOUNT
6302 + tvs %icc, 6
6303 +#endif
6304 +
6305 cas [%o1], %g1, %g7
6306 cmp %g1, %g7
6307 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6308 @@ -40,10 +63,28 @@ ENTRY(atomic_sub) /* %o0 = decrement, %o1 = atomic_ptr */
6309 2: BACKOFF_SPIN(%o2, %o3, 1b)
6310 ENDPROC(atomic_sub)
6311
6312 +ENTRY(atomic_sub_unchecked) /* %o0 = decrement, %o1 = atomic_ptr */
6313 + BACKOFF_SETUP(%o2)
6314 +1: lduw [%o1], %g1
6315 + sub %g1, %o0, %g7
6316 + cas [%o1], %g1, %g7
6317 + cmp %g1, %g7
6318 + bne,pn %icc, 2f
6319 + nop
6320 + retl
6321 + nop
6322 +2: BACKOFF_SPIN(%o2, %o3, 1b)
6323 +ENDPROC(atomic_sub_unchecked)
6324 +
6325 ENTRY(atomic_add_ret) /* %o0 = increment, %o1 = atomic_ptr */
6326 BACKOFF_SETUP(%o2)
6327 1: lduw [%o1], %g1
6328 - add %g1, %o0, %g7
6329 + addcc %g1, %o0, %g7
6330 +
6331 +#ifdef CONFIG_PAX_REFCOUNT
6332 + tvs %icc, 6
6333 +#endif
6334 +
6335 cas [%o1], %g1, %g7
6336 cmp %g1, %g7
6337 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6338 @@ -53,10 +94,29 @@ ENTRY(atomic_add_ret) /* %o0 = increment, %o1 = atomic_ptr */
6339 2: BACKOFF_SPIN(%o2, %o3, 1b)
6340 ENDPROC(atomic_add_ret)
6341
6342 +ENTRY(atomic_add_ret_unchecked) /* %o0 = increment, %o1 = atomic_ptr */
6343 + BACKOFF_SETUP(%o2)
6344 +1: lduw [%o1], %g1
6345 + addcc %g1, %o0, %g7
6346 + cas [%o1], %g1, %g7
6347 + cmp %g1, %g7
6348 + bne,pn %icc, 2f
6349 + add %g7, %o0, %g7
6350 + sra %g7, 0, %o0
6351 + retl
6352 + nop
6353 +2: BACKOFF_SPIN(%o2, %o3, 1b)
6354 +ENDPROC(atomic_add_ret_unchecked)
6355 +
6356 ENTRY(atomic_sub_ret) /* %o0 = decrement, %o1 = atomic_ptr */
6357 BACKOFF_SETUP(%o2)
6358 1: lduw [%o1], %g1
6359 - sub %g1, %o0, %g7
6360 + subcc %g1, %o0, %g7
6361 +
6362 +#ifdef CONFIG_PAX_REFCOUNT
6363 + tvs %icc, 6
6364 +#endif
6365 +
6366 cas [%o1], %g1, %g7
6367 cmp %g1, %g7
6368 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6369 @@ -69,7 +129,12 @@ ENDPROC(atomic_sub_ret)
6370 ENTRY(atomic64_add) /* %o0 = increment, %o1 = atomic_ptr */
6371 BACKOFF_SETUP(%o2)
6372 1: ldx [%o1], %g1
6373 - add %g1, %o0, %g7
6374 + addcc %g1, %o0, %g7
6375 +
6376 +#ifdef CONFIG_PAX_REFCOUNT
6377 + tvs %xcc, 6
6378 +#endif
6379 +
6380 casx [%o1], %g1, %g7
6381 cmp %g1, %g7
6382 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6383 @@ -79,10 +144,28 @@ ENTRY(atomic64_add) /* %o0 = increment, %o1 = atomic_ptr */
6384 2: BACKOFF_SPIN(%o2, %o3, 1b)
6385 ENDPROC(atomic64_add)
6386
6387 +ENTRY(atomic64_add_unchecked) /* %o0 = increment, %o1 = atomic_ptr */
6388 + BACKOFF_SETUP(%o2)
6389 +1: ldx [%o1], %g1
6390 + addcc %g1, %o0, %g7
6391 + casx [%o1], %g1, %g7
6392 + cmp %g1, %g7
6393 + bne,pn %xcc, 2f
6394 + nop
6395 + retl
6396 + nop
6397 +2: BACKOFF_SPIN(%o2, %o3, 1b)
6398 +ENDPROC(atomic64_add_unchecked)
6399 +
6400 ENTRY(atomic64_sub) /* %o0 = decrement, %o1 = atomic_ptr */
6401 BACKOFF_SETUP(%o2)
6402 1: ldx [%o1], %g1
6403 - sub %g1, %o0, %g7
6404 + subcc %g1, %o0, %g7
6405 +
6406 +#ifdef CONFIG_PAX_REFCOUNT
6407 + tvs %xcc, 6
6408 +#endif
6409 +
6410 casx [%o1], %g1, %g7
6411 cmp %g1, %g7
6412 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6413 @@ -92,10 +175,28 @@ ENTRY(atomic64_sub) /* %o0 = decrement, %o1 = atomic_ptr */
6414 2: BACKOFF_SPIN(%o2, %o3, 1b)
6415 ENDPROC(atomic64_sub)
6416
6417 +ENTRY(atomic64_sub_unchecked) /* %o0 = decrement, %o1 = atomic_ptr */
6418 + BACKOFF_SETUP(%o2)
6419 +1: ldx [%o1], %g1
6420 + subcc %g1, %o0, %g7
6421 + casx [%o1], %g1, %g7
6422 + cmp %g1, %g7
6423 + bne,pn %xcc, 2f
6424 + nop
6425 + retl
6426 + nop
6427 +2: BACKOFF_SPIN(%o2, %o3, 1b)
6428 +ENDPROC(atomic64_sub_unchecked)
6429 +
6430 ENTRY(atomic64_add_ret) /* %o0 = increment, %o1 = atomic_ptr */
6431 BACKOFF_SETUP(%o2)
6432 1: ldx [%o1], %g1
6433 - add %g1, %o0, %g7
6434 + addcc %g1, %o0, %g7
6435 +
6436 +#ifdef CONFIG_PAX_REFCOUNT
6437 + tvs %xcc, 6
6438 +#endif
6439 +
6440 casx [%o1], %g1, %g7
6441 cmp %g1, %g7
6442 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6443 @@ -105,10 +206,29 @@ ENTRY(atomic64_add_ret) /* %o0 = increment, %o1 = atomic_ptr */
6444 2: BACKOFF_SPIN(%o2, %o3, 1b)
6445 ENDPROC(atomic64_add_ret)
6446
6447 +ENTRY(atomic64_add_ret_unchecked) /* %o0 = increment, %o1 = atomic_ptr */
6448 + BACKOFF_SETUP(%o2)
6449 +1: ldx [%o1], %g1
6450 + addcc %g1, %o0, %g7
6451 + casx [%o1], %g1, %g7
6452 + cmp %g1, %g7
6453 + bne,pn %xcc, 2f
6454 + add %g7, %o0, %g7
6455 + mov %g7, %o0
6456 + retl
6457 + nop
6458 +2: BACKOFF_SPIN(%o2, %o3, 1b)
6459 +ENDPROC(atomic64_add_ret_unchecked)
6460 +
6461 ENTRY(atomic64_sub_ret) /* %o0 = decrement, %o1 = atomic_ptr */
6462 BACKOFF_SETUP(%o2)
6463 1: ldx [%o1], %g1
6464 - sub %g1, %o0, %g7
6465 + subcc %g1, %o0, %g7
6466 +
6467 +#ifdef CONFIG_PAX_REFCOUNT
6468 + tvs %xcc, 6
6469 +#endif
6470 +
6471 casx [%o1], %g1, %g7
6472 cmp %g1, %g7
6473 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6474 diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
6475 index 3b31218..345c609 100644
6476 --- a/arch/sparc/lib/ksyms.c
6477 +++ b/arch/sparc/lib/ksyms.c
6478 @@ -109,12 +109,18 @@ EXPORT_SYMBOL(__downgrade_write);
6479
6480 /* Atomic counter implementation. */
6481 EXPORT_SYMBOL(atomic_add);
6482 +EXPORT_SYMBOL(atomic_add_unchecked);
6483 EXPORT_SYMBOL(atomic_add_ret);
6484 +EXPORT_SYMBOL(atomic_add_ret_unchecked);
6485 EXPORT_SYMBOL(atomic_sub);
6486 +EXPORT_SYMBOL(atomic_sub_unchecked);
6487 EXPORT_SYMBOL(atomic_sub_ret);
6488 EXPORT_SYMBOL(atomic64_add);
6489 +EXPORT_SYMBOL(atomic64_add_unchecked);
6490 EXPORT_SYMBOL(atomic64_add_ret);
6491 +EXPORT_SYMBOL(atomic64_add_ret_unchecked);
6492 EXPORT_SYMBOL(atomic64_sub);
6493 +EXPORT_SYMBOL(atomic64_sub_unchecked);
6494 EXPORT_SYMBOL(atomic64_sub_ret);
6495
6496 /* Atomic bit operations. */
6497 diff --git a/arch/sparc/mm/Makefile b/arch/sparc/mm/Makefile
6498 index 30c3ecc..736f015 100644
6499 --- a/arch/sparc/mm/Makefile
6500 +++ b/arch/sparc/mm/Makefile
6501 @@ -2,7 +2,7 @@
6502 #
6503
6504 asflags-y := -ansi
6505 -ccflags-y := -Werror
6506 +#ccflags-y := -Werror
6507
6508 obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o gup.o
6509 obj-y += fault_$(BITS).o
6510 diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
6511 index f46cf6b..7235ec9 100644
6512 --- a/arch/sparc/mm/fault_32.c
6513 +++ b/arch/sparc/mm/fault_32.c
6514 @@ -21,6 +21,9 @@
6515 #include <linux/perf_event.h>
6516 #include <linux/interrupt.h>
6517 #include <linux/kdebug.h>
6518 +#include <linux/slab.h>
6519 +#include <linux/pagemap.h>
6520 +#include <linux/compiler.h>
6521
6522 #include <asm/page.h>
6523 #include <asm/pgtable.h>
6524 @@ -177,6 +180,277 @@ static unsigned long compute_si_addr(struct pt_regs *regs, int text_fault)
6525 return safe_compute_effective_address(regs, insn);
6526 }
6527
6528 +#ifdef CONFIG_PAX_PAGEEXEC
6529 +#ifdef CONFIG_PAX_DLRESOLVE
6530 +static void pax_emuplt_close(struct vm_area_struct *vma)
6531 +{
6532 + vma->vm_mm->call_dl_resolve = 0UL;
6533 +}
6534 +
6535 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
6536 +{
6537 + unsigned int *kaddr;
6538 +
6539 + vmf->page = alloc_page(GFP_HIGHUSER);
6540 + if (!vmf->page)
6541 + return VM_FAULT_OOM;
6542 +
6543 + kaddr = kmap(vmf->page);
6544 + memset(kaddr, 0, PAGE_SIZE);
6545 + kaddr[0] = 0x9DE3BFA8U; /* save */
6546 + flush_dcache_page(vmf->page);
6547 + kunmap(vmf->page);
6548 + return VM_FAULT_MAJOR;
6549 +}
6550 +
6551 +static const struct vm_operations_struct pax_vm_ops = {
6552 + .close = pax_emuplt_close,
6553 + .fault = pax_emuplt_fault
6554 +};
6555 +
6556 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
6557 +{
6558 + int ret;
6559 +
6560 + INIT_LIST_HEAD(&vma->anon_vma_chain);
6561 + vma->vm_mm = current->mm;
6562 + vma->vm_start = addr;
6563 + vma->vm_end = addr + PAGE_SIZE;
6564 + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
6565 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
6566 + vma->vm_ops = &pax_vm_ops;
6567 +
6568 + ret = insert_vm_struct(current->mm, vma);
6569 + if (ret)
6570 + return ret;
6571 +
6572 + ++current->mm->total_vm;
6573 + return 0;
6574 +}
6575 +#endif
6576 +
6577 +/*
6578 + * PaX: decide what to do with offenders (regs->pc = fault address)
6579 + *
6580 + * returns 1 when task should be killed
6581 + * 2 when patched PLT trampoline was detected
6582 + * 3 when unpatched PLT trampoline was detected
6583 + */
6584 +static int pax_handle_fetch_fault(struct pt_regs *regs)
6585 +{
6586 +
6587 +#ifdef CONFIG_PAX_EMUPLT
6588 + int err;
6589 +
6590 + do { /* PaX: patched PLT emulation #1 */
6591 + unsigned int sethi1, sethi2, jmpl;
6592 +
6593 + err = get_user(sethi1, (unsigned int *)regs->pc);
6594 + err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
6595 + err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
6596 +
6597 + if (err)
6598 + break;
6599 +
6600 + if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
6601 + (sethi2 & 0xFFC00000U) == 0x03000000U &&
6602 + (jmpl & 0xFFFFE000U) == 0x81C06000U)
6603 + {
6604 + unsigned int addr;
6605 +
6606 + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
6607 + addr = regs->u_regs[UREG_G1];
6608 + addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
6609 + regs->pc = addr;
6610 + regs->npc = addr+4;
6611 + return 2;
6612 + }
6613 + } while (0);
6614 +
6615 + do { /* PaX: patched PLT emulation #2 */
6616 + unsigned int ba;
6617 +
6618 + err = get_user(ba, (unsigned int *)regs->pc);
6619 +
6620 + if (err)
6621 + break;
6622 +
6623 + if ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30480000U) {
6624 + unsigned int addr;
6625 +
6626 + if ((ba & 0xFFC00000U) == 0x30800000U)
6627 + addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
6628 + else
6629 + addr = regs->pc + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
6630 + regs->pc = addr;
6631 + regs->npc = addr+4;
6632 + return 2;
6633 + }
6634 + } while (0);
6635 +
6636 + do { /* PaX: patched PLT emulation #3 */
6637 + unsigned int sethi, bajmpl, nop;
6638 +
6639 + err = get_user(sethi, (unsigned int *)regs->pc);
6640 + err |= get_user(bajmpl, (unsigned int *)(regs->pc+4));
6641 + err |= get_user(nop, (unsigned int *)(regs->pc+8));
6642 +
6643 + if (err)
6644 + break;
6645 +
6646 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
6647 + ((bajmpl & 0xFFFFE000U) == 0x81C06000U || (bajmpl & 0xFFF80000U) == 0x30480000U) &&
6648 + nop == 0x01000000U)
6649 + {
6650 + unsigned int addr;
6651 +
6652 + addr = (sethi & 0x003FFFFFU) << 10;
6653 + regs->u_regs[UREG_G1] = addr;
6654 + if ((bajmpl & 0xFFFFE000U) == 0x81C06000U)
6655 + addr += (((bajmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
6656 + else
6657 + addr = regs->pc + ((((bajmpl | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
6658 + regs->pc = addr;
6659 + regs->npc = addr+4;
6660 + return 2;
6661 + }
6662 + } while (0);
6663 +
6664 + do { /* PaX: unpatched PLT emulation step 1 */
6665 + unsigned int sethi, ba, nop;
6666 +
6667 + err = get_user(sethi, (unsigned int *)regs->pc);
6668 + err |= get_user(ba, (unsigned int *)(regs->pc+4));
6669 + err |= get_user(nop, (unsigned int *)(regs->pc+8));
6670 +
6671 + if (err)
6672 + break;
6673 +
6674 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
6675 + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
6676 + nop == 0x01000000U)
6677 + {
6678 + unsigned int addr, save, call;
6679 +
6680 + if ((ba & 0xFFC00000U) == 0x30800000U)
6681 + addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
6682 + else
6683 + addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
6684 +
6685 + err = get_user(save, (unsigned int *)addr);
6686 + err |= get_user(call, (unsigned int *)(addr+4));
6687 + err |= get_user(nop, (unsigned int *)(addr+8));
6688 + if (err)
6689 + break;
6690 +
6691 +#ifdef CONFIG_PAX_DLRESOLVE
6692 + if (save == 0x9DE3BFA8U &&
6693 + (call & 0xC0000000U) == 0x40000000U &&
6694 + nop == 0x01000000U)
6695 + {
6696 + struct vm_area_struct *vma;
6697 + unsigned long call_dl_resolve;
6698 +
6699 + down_read(&current->mm->mmap_sem);
6700 + call_dl_resolve = current->mm->call_dl_resolve;
6701 + up_read(&current->mm->mmap_sem);
6702 + if (likely(call_dl_resolve))
6703 + goto emulate;
6704 +
6705 + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
6706 +
6707 + down_write(&current->mm->mmap_sem);
6708 + if (current->mm->call_dl_resolve) {
6709 + call_dl_resolve = current->mm->call_dl_resolve;
6710 + up_write(&current->mm->mmap_sem);
6711 + if (vma)
6712 + kmem_cache_free(vm_area_cachep, vma);
6713 + goto emulate;
6714 + }
6715 +
6716 + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
6717 + if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
6718 + up_write(&current->mm->mmap_sem);
6719 + if (vma)
6720 + kmem_cache_free(vm_area_cachep, vma);
6721 + return 1;
6722 + }
6723 +
6724 + if (pax_insert_vma(vma, call_dl_resolve)) {
6725 + up_write(&current->mm->mmap_sem);
6726 + kmem_cache_free(vm_area_cachep, vma);
6727 + return 1;
6728 + }
6729 +
6730 + current->mm->call_dl_resolve = call_dl_resolve;
6731 + up_write(&current->mm->mmap_sem);
6732 +
6733 +emulate:
6734 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
6735 + regs->pc = call_dl_resolve;
6736 + regs->npc = addr+4;
6737 + return 3;
6738 + }
6739 +#endif
6740 +
6741 + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
6742 + if ((save & 0xFFC00000U) == 0x05000000U &&
6743 + (call & 0xFFFFE000U) == 0x85C0A000U &&
6744 + nop == 0x01000000U)
6745 + {
6746 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
6747 + regs->u_regs[UREG_G2] = addr + 4;
6748 + addr = (save & 0x003FFFFFU) << 10;
6749 + addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
6750 + regs->pc = addr;
6751 + regs->npc = addr+4;
6752 + return 3;
6753 + }
6754 + }
6755 + } while (0);
6756 +
6757 + do { /* PaX: unpatched PLT emulation step 2 */
6758 + unsigned int save, call, nop;
6759 +
6760 + err = get_user(save, (unsigned int *)(regs->pc-4));
6761 + err |= get_user(call, (unsigned int *)regs->pc);
6762 + err |= get_user(nop, (unsigned int *)(regs->pc+4));
6763 + if (err)
6764 + break;
6765 +
6766 + if (save == 0x9DE3BFA8U &&
6767 + (call & 0xC0000000U) == 0x40000000U &&
6768 + nop == 0x01000000U)
6769 + {
6770 + unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
6771 +
6772 + regs->u_regs[UREG_RETPC] = regs->pc;
6773 + regs->pc = dl_resolve;
6774 + regs->npc = dl_resolve+4;
6775 + return 3;
6776 + }
6777 + } while (0);
6778 +#endif
6779 +
6780 + return 1;
6781 +}
6782 +
6783 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
6784 +{
6785 + unsigned long i;
6786 +
6787 + printk(KERN_ERR "PAX: bytes at PC: ");
6788 + for (i = 0; i < 8; i++) {
6789 + unsigned int c;
6790 + if (get_user(c, (unsigned int *)pc+i))
6791 + printk(KERN_CONT "???????? ");
6792 + else
6793 + printk(KERN_CONT "%08x ", c);
6794 + }
6795 + printk("\n");
6796 +}
6797 +#endif
6798 +
6799 static noinline void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
6800 int text_fault)
6801 {
6802 @@ -248,6 +522,24 @@ good_area:
6803 if (!(vma->vm_flags & VM_WRITE))
6804 goto bad_area;
6805 } else {
6806 +
6807 +#ifdef CONFIG_PAX_PAGEEXEC
6808 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
6809 + up_read(&mm->mmap_sem);
6810 + switch (pax_handle_fetch_fault(regs)) {
6811 +
6812 +#ifdef CONFIG_PAX_EMUPLT
6813 + case 2:
6814 + case 3:
6815 + return;
6816 +#endif
6817 +
6818 + }
6819 + pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
6820 + do_group_exit(SIGKILL);
6821 + }
6822 +#endif
6823 +
6824 /* Allow reads even for write-only mappings */
6825 if (!(vma->vm_flags & (VM_READ | VM_EXEC)))
6826 goto bad_area;
6827 diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
6828 index 1fe0429..8dd5dd5 100644
6829 --- a/arch/sparc/mm/fault_64.c
6830 +++ b/arch/sparc/mm/fault_64.c
6831 @@ -21,6 +21,9 @@
6832 #include <linux/kprobes.h>
6833 #include <linux/kdebug.h>
6834 #include <linux/percpu.h>
6835 +#include <linux/slab.h>
6836 +#include <linux/pagemap.h>
6837 +#include <linux/compiler.h>
6838
6839 #include <asm/page.h>
6840 #include <asm/pgtable.h>
6841 @@ -74,7 +77,7 @@ static void __kprobes bad_kernel_pc(struct pt_regs *regs, unsigned long vaddr)
6842 printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
6843 regs->tpc);
6844 printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
6845 - printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
6846 + printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
6847 printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
6848 dump_stack();
6849 unhandled_fault(regs->tpc, current, regs);
6850 @@ -272,6 +275,466 @@ static void noinline __kprobes bogus_32bit_fault_address(struct pt_regs *regs,
6851 show_regs(regs);
6852 }
6853
6854 +#ifdef CONFIG_PAX_PAGEEXEC
6855 +#ifdef CONFIG_PAX_DLRESOLVE
6856 +static void pax_emuplt_close(struct vm_area_struct *vma)
6857 +{
6858 + vma->vm_mm->call_dl_resolve = 0UL;
6859 +}
6860 +
6861 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
6862 +{
6863 + unsigned int *kaddr;
6864 +
6865 + vmf->page = alloc_page(GFP_HIGHUSER);
6866 + if (!vmf->page)
6867 + return VM_FAULT_OOM;
6868 +
6869 + kaddr = kmap(vmf->page);
6870 + memset(kaddr, 0, PAGE_SIZE);
6871 + kaddr[0] = 0x9DE3BFA8U; /* save */
6872 + flush_dcache_page(vmf->page);
6873 + kunmap(vmf->page);
6874 + return VM_FAULT_MAJOR;
6875 +}
6876 +
6877 +static const struct vm_operations_struct pax_vm_ops = {
6878 + .close = pax_emuplt_close,
6879 + .fault = pax_emuplt_fault
6880 +};
6881 +
6882 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
6883 +{
6884 + int ret;
6885 +
6886 + INIT_LIST_HEAD(&vma->anon_vma_chain);
6887 + vma->vm_mm = current->mm;
6888 + vma->vm_start = addr;
6889 + vma->vm_end = addr + PAGE_SIZE;
6890 + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
6891 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
6892 + vma->vm_ops = &pax_vm_ops;
6893 +
6894 + ret = insert_vm_struct(current->mm, vma);
6895 + if (ret)
6896 + return ret;
6897 +
6898 + ++current->mm->total_vm;
6899 + return 0;
6900 +}
6901 +#endif
6902 +
6903 +/*
6904 + * PaX: decide what to do with offenders (regs->tpc = fault address)
6905 + *
6906 + * returns 1 when task should be killed
6907 + * 2 when patched PLT trampoline was detected
6908 + * 3 when unpatched PLT trampoline was detected
6909 + */
6910 +static int pax_handle_fetch_fault(struct pt_regs *regs)
6911 +{
6912 +
6913 +#ifdef CONFIG_PAX_EMUPLT
6914 + int err;
6915 +
6916 + do { /* PaX: patched PLT emulation #1 */
6917 + unsigned int sethi1, sethi2, jmpl;
6918 +
6919 + err = get_user(sethi1, (unsigned int *)regs->tpc);
6920 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
6921 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
6922 +
6923 + if (err)
6924 + break;
6925 +
6926 + if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
6927 + (sethi2 & 0xFFC00000U) == 0x03000000U &&
6928 + (jmpl & 0xFFFFE000U) == 0x81C06000U)
6929 + {
6930 + unsigned long addr;
6931 +
6932 + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
6933 + addr = regs->u_regs[UREG_G1];
6934 + addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
6935 +
6936 + if (test_thread_flag(TIF_32BIT))
6937 + addr &= 0xFFFFFFFFUL;
6938 +
6939 + regs->tpc = addr;
6940 + regs->tnpc = addr+4;
6941 + return 2;
6942 + }
6943 + } while (0);
6944 +
6945 + do { /* PaX: patched PLT emulation #2 */
6946 + unsigned int ba;
6947 +
6948 + err = get_user(ba, (unsigned int *)regs->tpc);
6949 +
6950 + if (err)
6951 + break;
6952 +
6953 + if ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30480000U) {
6954 + unsigned long addr;
6955 +
6956 + if ((ba & 0xFFC00000U) == 0x30800000U)
6957 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
6958 + else
6959 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
6960 +
6961 + if (test_thread_flag(TIF_32BIT))
6962 + addr &= 0xFFFFFFFFUL;
6963 +
6964 + regs->tpc = addr;
6965 + regs->tnpc = addr+4;
6966 + return 2;
6967 + }
6968 + } while (0);
6969 +
6970 + do { /* PaX: patched PLT emulation #3 */
6971 + unsigned int sethi, bajmpl, nop;
6972 +
6973 + err = get_user(sethi, (unsigned int *)regs->tpc);
6974 + err |= get_user(bajmpl, (unsigned int *)(regs->tpc+4));
6975 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
6976 +
6977 + if (err)
6978 + break;
6979 +
6980 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
6981 + ((bajmpl & 0xFFFFE000U) == 0x81C06000U || (bajmpl & 0xFFF80000U) == 0x30480000U) &&
6982 + nop == 0x01000000U)
6983 + {
6984 + unsigned long addr;
6985 +
6986 + addr = (sethi & 0x003FFFFFU) << 10;
6987 + regs->u_regs[UREG_G1] = addr;
6988 + if ((bajmpl & 0xFFFFE000U) == 0x81C06000U)
6989 + addr += (((bajmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
6990 + else
6991 + addr = regs->tpc + ((((bajmpl | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
6992 +
6993 + if (test_thread_flag(TIF_32BIT))
6994 + addr &= 0xFFFFFFFFUL;
6995 +
6996 + regs->tpc = addr;
6997 + regs->tnpc = addr+4;
6998 + return 2;
6999 + }
7000 + } while (0);
7001 +
7002 + do { /* PaX: patched PLT emulation #4 */
7003 + unsigned int sethi, mov1, call, mov2;
7004 +
7005 + err = get_user(sethi, (unsigned int *)regs->tpc);
7006 + err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
7007 + err |= get_user(call, (unsigned int *)(regs->tpc+8));
7008 + err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
7009 +
7010 + if (err)
7011 + break;
7012 +
7013 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
7014 + mov1 == 0x8210000FU &&
7015 + (call & 0xC0000000U) == 0x40000000U &&
7016 + mov2 == 0x9E100001U)
7017 + {
7018 + unsigned long addr;
7019 +
7020 + regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
7021 + addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
7022 +
7023 + if (test_thread_flag(TIF_32BIT))
7024 + addr &= 0xFFFFFFFFUL;
7025 +
7026 + regs->tpc = addr;
7027 + regs->tnpc = addr+4;
7028 + return 2;
7029 + }
7030 + } while (0);
7031 +
7032 + do { /* PaX: patched PLT emulation #5 */
7033 + unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
7034 +
7035 + err = get_user(sethi, (unsigned int *)regs->tpc);
7036 + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
7037 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
7038 + err |= get_user(or1, (unsigned int *)(regs->tpc+12));
7039 + err |= get_user(or2, (unsigned int *)(regs->tpc+16));
7040 + err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
7041 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
7042 + err |= get_user(nop, (unsigned int *)(regs->tpc+28));
7043 +
7044 + if (err)
7045 + break;
7046 +
7047 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
7048 + (sethi1 & 0xFFC00000U) == 0x03000000U &&
7049 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
7050 + (or1 & 0xFFFFE000U) == 0x82106000U &&
7051 + (or2 & 0xFFFFE000U) == 0x8A116000U &&
7052 + sllx == 0x83287020U &&
7053 + jmpl == 0x81C04005U &&
7054 + nop == 0x01000000U)
7055 + {
7056 + unsigned long addr;
7057 +
7058 + regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
7059 + regs->u_regs[UREG_G1] <<= 32;
7060 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
7061 + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
7062 + regs->tpc = addr;
7063 + regs->tnpc = addr+4;
7064 + return 2;
7065 + }
7066 + } while (0);
7067 +
7068 + do { /* PaX: patched PLT emulation #6 */
7069 + unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
7070 +
7071 + err = get_user(sethi, (unsigned int *)regs->tpc);
7072 + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
7073 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
7074 + err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
7075 + err |= get_user(or, (unsigned int *)(regs->tpc+16));
7076 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
7077 + err |= get_user(nop, (unsigned int *)(regs->tpc+24));
7078 +
7079 + if (err)
7080 + break;
7081 +
7082 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
7083 + (sethi1 & 0xFFC00000U) == 0x03000000U &&
7084 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
7085 + sllx == 0x83287020U &&
7086 + (or & 0xFFFFE000U) == 0x8A116000U &&
7087 + jmpl == 0x81C04005U &&
7088 + nop == 0x01000000U)
7089 + {
7090 + unsigned long addr;
7091 +
7092 + regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
7093 + regs->u_regs[UREG_G1] <<= 32;
7094 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
7095 + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
7096 + regs->tpc = addr;
7097 + regs->tnpc = addr+4;
7098 + return 2;
7099 + }
7100 + } while (0);
7101 +
7102 + do { /* PaX: unpatched PLT emulation step 1 */
7103 + unsigned int sethi, ba, nop;
7104 +
7105 + err = get_user(sethi, (unsigned int *)regs->tpc);
7106 + err |= get_user(ba, (unsigned int *)(regs->tpc+4));
7107 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
7108 +
7109 + if (err)
7110 + break;
7111 +
7112 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
7113 + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
7114 + nop == 0x01000000U)
7115 + {
7116 + unsigned long addr;
7117 + unsigned int save, call;
7118 + unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
7119 +
7120 + if ((ba & 0xFFC00000U) == 0x30800000U)
7121 + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
7122 + else
7123 + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
7124 +
7125 + if (test_thread_flag(TIF_32BIT))
7126 + addr &= 0xFFFFFFFFUL;
7127 +
7128 + err = get_user(save, (unsigned int *)addr);
7129 + err |= get_user(call, (unsigned int *)(addr+4));
7130 + err |= get_user(nop, (unsigned int *)(addr+8));
7131 + if (err)
7132 + break;
7133 +
7134 +#ifdef CONFIG_PAX_DLRESOLVE
7135 + if (save == 0x9DE3BFA8U &&
7136 + (call & 0xC0000000U) == 0x40000000U &&
7137 + nop == 0x01000000U)
7138 + {
7139 + struct vm_area_struct *vma;
7140 + unsigned long call_dl_resolve;
7141 +
7142 + down_read(&current->mm->mmap_sem);
7143 + call_dl_resolve = current->mm->call_dl_resolve;
7144 + up_read(&current->mm->mmap_sem);
7145 + if (likely(call_dl_resolve))
7146 + goto emulate;
7147 +
7148 + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
7149 +
7150 + down_write(&current->mm->mmap_sem);
7151 + if (current->mm->call_dl_resolve) {
7152 + call_dl_resolve = current->mm->call_dl_resolve;
7153 + up_write(&current->mm->mmap_sem);
7154 + if (vma)
7155 + kmem_cache_free(vm_area_cachep, vma);
7156 + goto emulate;
7157 + }
7158 +
7159 + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
7160 + if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
7161 + up_write(&current->mm->mmap_sem);
7162 + if (vma)
7163 + kmem_cache_free(vm_area_cachep, vma);
7164 + return 1;
7165 + }
7166 +
7167 + if (pax_insert_vma(vma, call_dl_resolve)) {
7168 + up_write(&current->mm->mmap_sem);
7169 + kmem_cache_free(vm_area_cachep, vma);
7170 + return 1;
7171 + }
7172 +
7173 + current->mm->call_dl_resolve = call_dl_resolve;
7174 + up_write(&current->mm->mmap_sem);
7175 +
7176 +emulate:
7177 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7178 + regs->tpc = call_dl_resolve;
7179 + regs->tnpc = addr+4;
7180 + return 3;
7181 + }
7182 +#endif
7183 +
7184 + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
7185 + if ((save & 0xFFC00000U) == 0x05000000U &&
7186 + (call & 0xFFFFE000U) == 0x85C0A000U &&
7187 + nop == 0x01000000U)
7188 + {
7189 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7190 + regs->u_regs[UREG_G2] = addr + 4;
7191 + addr = (save & 0x003FFFFFU) << 10;
7192 + addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
7193 +
7194 + if (test_thread_flag(TIF_32BIT))
7195 + addr &= 0xFFFFFFFFUL;
7196 +
7197 + regs->tpc = addr;
7198 + regs->tnpc = addr+4;
7199 + return 3;
7200 + }
7201 +
7202 + /* PaX: 64-bit PLT stub */
7203 + err = get_user(sethi1, (unsigned int *)addr);
7204 + err |= get_user(sethi2, (unsigned int *)(addr+4));
7205 + err |= get_user(or1, (unsigned int *)(addr+8));
7206 + err |= get_user(or2, (unsigned int *)(addr+12));
7207 + err |= get_user(sllx, (unsigned int *)(addr+16));
7208 + err |= get_user(add, (unsigned int *)(addr+20));
7209 + err |= get_user(jmpl, (unsigned int *)(addr+24));
7210 + err |= get_user(nop, (unsigned int *)(addr+28));
7211 + if (err)
7212 + break;
7213 +
7214 + if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
7215 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
7216 + (or1 & 0xFFFFE000U) == 0x88112000U &&
7217 + (or2 & 0xFFFFE000U) == 0x8A116000U &&
7218 + sllx == 0x89293020U &&
7219 + add == 0x8A010005U &&
7220 + jmpl == 0x89C14000U &&
7221 + nop == 0x01000000U)
7222 + {
7223 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7224 + regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
7225 + regs->u_regs[UREG_G4] <<= 32;
7226 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
7227 + regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
7228 + regs->u_regs[UREG_G4] = addr + 24;
7229 + addr = regs->u_regs[UREG_G5];
7230 + regs->tpc = addr;
7231 + regs->tnpc = addr+4;
7232 + return 3;
7233 + }
7234 + }
7235 + } while (0);
7236 +
7237 +#ifdef CONFIG_PAX_DLRESOLVE
7238 + do { /* PaX: unpatched PLT emulation step 2 */
7239 + unsigned int save, call, nop;
7240 +
7241 + err = get_user(save, (unsigned int *)(regs->tpc-4));
7242 + err |= get_user(call, (unsigned int *)regs->tpc);
7243 + err |= get_user(nop, (unsigned int *)(regs->tpc+4));
7244 + if (err)
7245 + break;
7246 +
7247 + if (save == 0x9DE3BFA8U &&
7248 + (call & 0xC0000000U) == 0x40000000U &&
7249 + nop == 0x01000000U)
7250 + {
7251 + unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
7252 +
7253 + if (test_thread_flag(TIF_32BIT))
7254 + dl_resolve &= 0xFFFFFFFFUL;
7255 +
7256 + regs->u_regs[UREG_RETPC] = regs->tpc;
7257 + regs->tpc = dl_resolve;
7258 + regs->tnpc = dl_resolve+4;
7259 + return 3;
7260 + }
7261 + } while (0);
7262 +#endif
7263 +
7264 + do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
7265 + unsigned int sethi, ba, nop;
7266 +
7267 + err = get_user(sethi, (unsigned int *)regs->tpc);
7268 + err |= get_user(ba, (unsigned int *)(regs->tpc+4));
7269 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
7270 +
7271 + if (err)
7272 + break;
7273 +
7274 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
7275 + (ba & 0xFFF00000U) == 0x30600000U &&
7276 + nop == 0x01000000U)
7277 + {
7278 + unsigned long addr;
7279 +
7280 + addr = (sethi & 0x003FFFFFU) << 10;
7281 + regs->u_regs[UREG_G1] = addr;
7282 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
7283 +
7284 + if (test_thread_flag(TIF_32BIT))
7285 + addr &= 0xFFFFFFFFUL;
7286 +
7287 + regs->tpc = addr;
7288 + regs->tnpc = addr+4;
7289 + return 2;
7290 + }
7291 + } while (0);
7292 +
7293 +#endif
7294 +
7295 + return 1;
7296 +}
7297 +
7298 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
7299 +{
7300 + unsigned long i;
7301 +
7302 + printk(KERN_ERR "PAX: bytes at PC: ");
7303 + for (i = 0; i < 8; i++) {
7304 + unsigned int c;
7305 + if (get_user(c, (unsigned int *)pc+i))
7306 + printk(KERN_CONT "???????? ");
7307 + else
7308 + printk(KERN_CONT "%08x ", c);
7309 + }
7310 + printk("\n");
7311 +}
7312 +#endif
7313 +
7314 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
7315 {
7316 struct mm_struct *mm = current->mm;
7317 @@ -343,6 +806,29 @@ retry:
7318 if (!vma)
7319 goto bad_area;
7320
7321 +#ifdef CONFIG_PAX_PAGEEXEC
7322 + /* PaX: detect ITLB misses on non-exec pages */
7323 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
7324 + !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
7325 + {
7326 + if (address != regs->tpc)
7327 + goto good_area;
7328 +
7329 + up_read(&mm->mmap_sem);
7330 + switch (pax_handle_fetch_fault(regs)) {
7331 +
7332 +#ifdef CONFIG_PAX_EMUPLT
7333 + case 2:
7334 + case 3:
7335 + return;
7336 +#endif
7337 +
7338 + }
7339 + pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
7340 + do_group_exit(SIGKILL);
7341 + }
7342 +#endif
7343 +
7344 /* Pure DTLB misses do not tell us whether the fault causing
7345 * load/store/atomic was a write or not, it only says that there
7346 * was no match. So in such a case we (carefully) read the
7347 diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
7348 index 07e1453..0a7d9e9 100644
7349 --- a/arch/sparc/mm/hugetlbpage.c
7350 +++ b/arch/sparc/mm/hugetlbpage.c
7351 @@ -67,7 +67,7 @@ full_search:
7352 }
7353 return -ENOMEM;
7354 }
7355 - if (likely(!vma || addr + len <= vma->vm_start)) {
7356 + if (likely(check_heap_stack_gap(vma, addr, len))) {
7357 /*
7358 * Remember the place where we stopped the search:
7359 */
7360 @@ -106,7 +106,7 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
7361 /* make sure it can fit in the remaining address space */
7362 if (likely(addr > len)) {
7363 vma = find_vma(mm, addr-len);
7364 - if (!vma || addr <= vma->vm_start) {
7365 + if (check_heap_stack_gap(vma, addr - len, len)) {
7366 /* remember the address as a hint for next time */
7367 return (mm->free_area_cache = addr-len);
7368 }
7369 @@ -115,16 +115,17 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
7370 if (unlikely(mm->mmap_base < len))
7371 goto bottomup;
7372
7373 - addr = (mm->mmap_base-len) & HPAGE_MASK;
7374 + addr = mm->mmap_base - len;
7375
7376 do {
7377 + addr &= HPAGE_MASK;
7378 /*
7379 * Lookup failure means no vma is above this address,
7380 * else if new region fits below vma->vm_start,
7381 * return with success:
7382 */
7383 vma = find_vma(mm, addr);
7384 - if (likely(!vma || addr+len <= vma->vm_start)) {
7385 + if (likely(check_heap_stack_gap(vma, addr, len))) {
7386 /* remember the address as a hint for next time */
7387 return (mm->free_area_cache = addr);
7388 }
7389 @@ -134,8 +135,8 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
7390 mm->cached_hole_size = vma->vm_start - addr;
7391
7392 /* try just below the current vma->vm_start */
7393 - addr = (vma->vm_start-len) & HPAGE_MASK;
7394 - } while (likely(len < vma->vm_start));
7395 + addr = skip_heap_stack_gap(vma, len);
7396 + } while (!IS_ERR_VALUE(addr));
7397
7398 bottomup:
7399 /*
7400 @@ -181,8 +182,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
7401 if (addr) {
7402 addr = ALIGN(addr, HPAGE_SIZE);
7403 vma = find_vma(mm, addr);
7404 - if (task_size - len >= addr &&
7405 - (!vma || addr + len <= vma->vm_start))
7406 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
7407 return addr;
7408 }
7409 if (mm->get_unmapped_area == arch_get_unmapped_area)
7410 diff --git a/arch/tile/include/asm/atomic_64.h b/arch/tile/include/asm/atomic_64.h
7411 index f4500c6..889656c 100644
7412 --- a/arch/tile/include/asm/atomic_64.h
7413 +++ b/arch/tile/include/asm/atomic_64.h
7414 @@ -143,6 +143,16 @@ static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
7415
7416 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
7417
7418 +#define atomic64_read_unchecked(v) atomic64_read(v)
7419 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
7420 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
7421 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
7422 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
7423 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
7424 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
7425 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
7426 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
7427 +
7428 /* Atomic dec and inc don't implement barrier, so provide them if needed. */
7429 #define smp_mb__before_atomic_dec() smp_mb()
7430 #define smp_mb__after_atomic_dec() smp_mb()
7431 diff --git a/arch/tile/include/asm/cache.h b/arch/tile/include/asm/cache.h
7432 index 392e533..536b092 100644
7433 --- a/arch/tile/include/asm/cache.h
7434 +++ b/arch/tile/include/asm/cache.h
7435 @@ -15,11 +15,12 @@
7436 #ifndef _ASM_TILE_CACHE_H
7437 #define _ASM_TILE_CACHE_H
7438
7439 +#include <linux/const.h>
7440 #include <arch/chip.h>
7441
7442 /* bytes per L1 data cache line */
7443 #define L1_CACHE_SHIFT CHIP_L1D_LOG_LINE_SIZE()
7444 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
7445 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
7446
7447 /* bytes per L2 cache line */
7448 #define L2_CACHE_SHIFT CHIP_L2_LOG_LINE_SIZE()
7449 diff --git a/arch/tile/include/asm/uaccess.h b/arch/tile/include/asm/uaccess.h
7450 index 9ab078a..d6635c2 100644
7451 --- a/arch/tile/include/asm/uaccess.h
7452 +++ b/arch/tile/include/asm/uaccess.h
7453 @@ -403,9 +403,9 @@ static inline unsigned long __must_check copy_from_user(void *to,
7454 const void __user *from,
7455 unsigned long n)
7456 {
7457 - int sz = __compiletime_object_size(to);
7458 + size_t sz = __compiletime_object_size(to);
7459
7460 - if (likely(sz == -1 || sz >= n))
7461 + if (likely(sz == (size_t)-1 || sz >= n))
7462 n = _copy_from_user(to, from, n);
7463 else
7464 copy_from_user_overflow();
7465 diff --git a/arch/um/Makefile b/arch/um/Makefile
7466 index 0970910..13adb57a 100644
7467 --- a/arch/um/Makefile
7468 +++ b/arch/um/Makefile
7469 @@ -62,6 +62,10 @@ USER_CFLAGS = $(patsubst $(KERNEL_DEFINES),,$(patsubst -D__KERNEL__,,\
7470 $(patsubst -I%,,$(KBUILD_CFLAGS)))) $(ARCH_INCLUDE) $(MODE_INCLUDE) \
7471 $(filter -I%,$(CFLAGS)) -D_FILE_OFFSET_BITS=64 -idirafter include
7472
7473 +ifdef CONSTIFY_PLUGIN
7474 +USER_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
7475 +endif
7476 +
7477 #This will adjust *FLAGS accordingly to the platform.
7478 include $(srctree)/$(ARCH_DIR)/Makefile-os-$(OS)
7479
7480 diff --git a/arch/um/include/asm/cache.h b/arch/um/include/asm/cache.h
7481 index 19e1bdd..3665b77 100644
7482 --- a/arch/um/include/asm/cache.h
7483 +++ b/arch/um/include/asm/cache.h
7484 @@ -1,6 +1,7 @@
7485 #ifndef __UM_CACHE_H
7486 #define __UM_CACHE_H
7487
7488 +#include <linux/const.h>
7489
7490 #if defined(CONFIG_UML_X86) && !defined(CONFIG_64BIT)
7491 # define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
7492 @@ -12,6 +13,6 @@
7493 # define L1_CACHE_SHIFT 5
7494 #endif
7495
7496 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
7497 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
7498
7499 #endif
7500 diff --git a/arch/um/include/asm/kmap_types.h b/arch/um/include/asm/kmap_types.h
7501 index 6c03acd..a5e0215 100644
7502 --- a/arch/um/include/asm/kmap_types.h
7503 +++ b/arch/um/include/asm/kmap_types.h
7504 @@ -23,6 +23,7 @@ enum km_type {
7505 KM_IRQ1,
7506 KM_SOFTIRQ0,
7507 KM_SOFTIRQ1,
7508 + KM_CLEARPAGE,
7509 KM_TYPE_NR
7510 };
7511
7512 diff --git a/arch/um/include/asm/page.h b/arch/um/include/asm/page.h
7513 index 7cfc3ce..cbd1a58 100644
7514 --- a/arch/um/include/asm/page.h
7515 +++ b/arch/um/include/asm/page.h
7516 @@ -14,6 +14,9 @@
7517 #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
7518 #define PAGE_MASK (~(PAGE_SIZE-1))
7519
7520 +#define ktla_ktva(addr) (addr)
7521 +#define ktva_ktla(addr) (addr)
7522 +
7523 #ifndef __ASSEMBLY__
7524
7525 struct page;
7526 diff --git a/arch/um/include/asm/pgtable-3level.h b/arch/um/include/asm/pgtable-3level.h
7527 index 0032f92..cd151e0 100644
7528 --- a/arch/um/include/asm/pgtable-3level.h
7529 +++ b/arch/um/include/asm/pgtable-3level.h
7530 @@ -58,6 +58,7 @@
7531 #define pud_present(x) (pud_val(x) & _PAGE_PRESENT)
7532 #define pud_populate(mm, pud, pmd) \
7533 set_pud(pud, __pud(_PAGE_TABLE + __pa(pmd)))
7534 +#define pud_populate_kernel(mm, pud, pmd) pud_populate((mm), (pud), (pmd))
7535
7536 #ifdef CONFIG_64BIT
7537 #define set_pud(pudptr, pudval) set_64bit((u64 *) (pudptr), pud_val(pudval))
7538 diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
7539 index ccb9a9d..cc425bb 100644
7540 --- a/arch/um/kernel/process.c
7541 +++ b/arch/um/kernel/process.c
7542 @@ -407,22 +407,6 @@ int singlestepping(void * t)
7543 return 2;
7544 }
7545
7546 -/*
7547 - * Only x86 and x86_64 have an arch_align_stack().
7548 - * All other arches have "#define arch_align_stack(x) (x)"
7549 - * in their asm/system.h
7550 - * As this is included in UML from asm-um/system-generic.h,
7551 - * we can use it to behave as the subarch does.
7552 - */
7553 -#ifndef arch_align_stack
7554 -unsigned long arch_align_stack(unsigned long sp)
7555 -{
7556 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
7557 - sp -= get_random_int() % 8192;
7558 - return sp & ~0xf;
7559 -}
7560 -#endif
7561 -
7562 unsigned long get_wchan(struct task_struct *p)
7563 {
7564 unsigned long stack_page, sp, ip;
7565 diff --git a/arch/unicore32/include/asm/cache.h b/arch/unicore32/include/asm/cache.h
7566 index ad8f795..2c7eec6 100644
7567 --- a/arch/unicore32/include/asm/cache.h
7568 +++ b/arch/unicore32/include/asm/cache.h
7569 @@ -12,8 +12,10 @@
7570 #ifndef __UNICORE_CACHE_H__
7571 #define __UNICORE_CACHE_H__
7572
7573 -#define L1_CACHE_SHIFT (5)
7574 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
7575 +#include <linux/const.h>
7576 +
7577 +#define L1_CACHE_SHIFT 5
7578 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
7579
7580 /*
7581 * Memory returned by kmalloc() may be used for DMA, so we must make
7582 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
7583 index c70684f..698fa4b 100644
7584 --- a/arch/x86/Kconfig
7585 +++ b/arch/x86/Kconfig
7586 @@ -218,7 +218,7 @@ config X86_HT
7587
7588 config X86_32_LAZY_GS
7589 def_bool y
7590 - depends on X86_32 && !CC_STACKPROTECTOR
7591 + depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
7592
7593 config ARCH_HWEIGHT_CFLAGS
7594 string
7595 @@ -1047,7 +1047,7 @@ choice
7596
7597 config NOHIGHMEM
7598 bool "off"
7599 - depends on !X86_NUMAQ
7600 + depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
7601 ---help---
7602 Linux can use up to 64 Gigabytes of physical memory on x86 systems.
7603 However, the address space of 32-bit x86 processors is only 4
7604 @@ -1084,7 +1084,7 @@ config NOHIGHMEM
7605
7606 config HIGHMEM4G
7607 bool "4GB"
7608 - depends on !X86_NUMAQ
7609 + depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
7610 ---help---
7611 Select this if you have a 32-bit processor and between 1 and 4
7612 gigabytes of physical RAM.
7613 @@ -1138,7 +1138,7 @@ config PAGE_OFFSET
7614 hex
7615 default 0xB0000000 if VMSPLIT_3G_OPT
7616 default 0x80000000 if VMSPLIT_2G
7617 - default 0x78000000 if VMSPLIT_2G_OPT
7618 + default 0x70000000 if VMSPLIT_2G_OPT
7619 default 0x40000000 if VMSPLIT_1G
7620 default 0xC0000000
7621 depends on X86_32
7622 @@ -1526,6 +1526,7 @@ config SECCOMP
7623
7624 config CC_STACKPROTECTOR
7625 bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
7626 + depends on X86_64 || !PAX_MEMORY_UDEREF
7627 ---help---
7628 This option turns on the -fstack-protector GCC feature. This
7629 feature puts, at the beginning of functions, a canary value on
7630 @@ -1583,6 +1584,7 @@ config KEXEC_JUMP
7631 config PHYSICAL_START
7632 hex "Physical address where the kernel is loaded" if (EXPERT || CRASH_DUMP)
7633 default "0x1000000"
7634 + range 0x400000 0x40000000
7635 ---help---
7636 This gives the physical address where the kernel is loaded.
7637
7638 @@ -1646,6 +1648,7 @@ config X86_NEED_RELOCS
7639 config PHYSICAL_ALIGN
7640 hex "Alignment value to which kernel should be aligned" if X86_32
7641 default "0x1000000"
7642 + range 0x400000 0x1000000 if PAX_KERNEXEC
7643 range 0x2000 0x1000000
7644 ---help---
7645 This value puts the alignment restrictions on physical address
7646 @@ -1677,9 +1680,10 @@ config HOTPLUG_CPU
7647 Say N if you want to disable CPU hotplug.
7648
7649 config COMPAT_VDSO
7650 - def_bool y
7651 + def_bool n
7652 prompt "Compat VDSO support"
7653 depends on X86_32 || IA32_EMULATION
7654 + depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
7655 ---help---
7656 Map the 32-bit VDSO to the predictable old-style address too.
7657
7658 diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
7659 index 706e12e..62e4feb 100644
7660 --- a/arch/x86/Kconfig.cpu
7661 +++ b/arch/x86/Kconfig.cpu
7662 @@ -334,7 +334,7 @@ config X86_PPRO_FENCE
7663
7664 config X86_F00F_BUG
7665 def_bool y
7666 - depends on M586MMX || M586TSC || M586 || M486 || M386
7667 + depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
7668
7669 config X86_INVD_BUG
7670 def_bool y
7671 @@ -358,7 +358,7 @@ config X86_POPAD_OK
7672
7673 config X86_ALIGNMENT_16
7674 def_bool y
7675 - depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
7676 + depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
7677
7678 config X86_INTEL_USERCOPY
7679 def_bool y
7680 @@ -404,7 +404,7 @@ config X86_CMPXCHG64
7681 # generates cmov.
7682 config X86_CMOV
7683 def_bool y
7684 - depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
7685 + depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
7686
7687 config X86_MINIMUM_CPU_FAMILY
7688 int
7689 diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
7690 index e46c214..ab62fd1 100644
7691 --- a/arch/x86/Kconfig.debug
7692 +++ b/arch/x86/Kconfig.debug
7693 @@ -84,7 +84,7 @@ config X86_PTDUMP
7694 config DEBUG_RODATA
7695 bool "Write protect kernel read-only data structures"
7696 default y
7697 - depends on DEBUG_KERNEL
7698 + depends on DEBUG_KERNEL && BROKEN
7699 ---help---
7700 Mark the kernel read-only data as write-protected in the pagetables,
7701 in order to catch accidental (and incorrect) writes to such const
7702 @@ -102,7 +102,7 @@ config DEBUG_RODATA_TEST
7703
7704 config DEBUG_SET_MODULE_RONX
7705 bool "Set loadable kernel module data as NX and text as RO"
7706 - depends on MODULES
7707 + depends on MODULES && BROKEN
7708 ---help---
7709 This option helps catch unintended modifications to loadable
7710 kernel module's text and read-only data. It also prevents execution
7711 @@ -275,7 +275,7 @@ config OPTIMIZE_INLINING
7712
7713 config DEBUG_STRICT_USER_COPY_CHECKS
7714 bool "Strict copy size checks"
7715 - depends on DEBUG_KERNEL && !TRACE_BRANCH_PROFILING
7716 + depends on DEBUG_KERNEL && !TRACE_BRANCH_PROFILING && !PAX_SIZE_OVERFLOW
7717 ---help---
7718 Enabling this option turns a certain set of sanity checks for user
7719 copy operations into compile time failures.
7720 diff --git a/arch/x86/Makefile b/arch/x86/Makefile
7721 index 1f25214..39422b3 100644
7722 --- a/arch/x86/Makefile
7723 +++ b/arch/x86/Makefile
7724 @@ -46,6 +46,7 @@ else
7725 UTS_MACHINE := x86_64
7726 CHECKFLAGS += -D__x86_64__ -m64
7727
7728 + biarch := $(call cc-option,-m64)
7729 KBUILD_AFLAGS += -m64
7730 KBUILD_CFLAGS += -m64
7731
7732 @@ -222,3 +223,12 @@ define archhelp
7733 echo ' FDARGS="..." arguments for the booted kernel'
7734 echo ' FDINITRD=file initrd for the booted kernel'
7735 endef
7736 +
7737 +define OLD_LD
7738 +
7739 +*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
7740 +*** Please upgrade your binutils to 2.18 or newer
7741 +endef
7742 +
7743 +archprepare:
7744 + $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
7745 diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
7746 index 5a747dd..ff7b12c 100644
7747 --- a/arch/x86/boot/Makefile
7748 +++ b/arch/x86/boot/Makefile
7749 @@ -64,6 +64,9 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -g -Os -D_SETUP -D__KERNEL__ \
7750 $(call cc-option, -fno-stack-protector) \
7751 $(call cc-option, -mpreferred-stack-boundary=2)
7752 KBUILD_CFLAGS += $(call cc-option, -m32)
7753 +ifdef CONSTIFY_PLUGIN
7754 +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
7755 +endif
7756 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
7757 GCOV_PROFILE := n
7758
7759 diff --git a/arch/x86/boot/bitops.h b/arch/x86/boot/bitops.h
7760 index 878e4b9..20537ab 100644
7761 --- a/arch/x86/boot/bitops.h
7762 +++ b/arch/x86/boot/bitops.h
7763 @@ -26,7 +26,7 @@ static inline int variable_test_bit(int nr, const void *addr)
7764 u8 v;
7765 const u32 *p = (const u32 *)addr;
7766
7767 - asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
7768 + asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
7769 return v;
7770 }
7771
7772 @@ -37,7 +37,7 @@ static inline int variable_test_bit(int nr, const void *addr)
7773
7774 static inline void set_bit(int nr, void *addr)
7775 {
7776 - asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
7777 + asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
7778 }
7779
7780 #endif /* BOOT_BITOPS_H */
7781 diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h
7782 index 18997e5..83d9c67 100644
7783 --- a/arch/x86/boot/boot.h
7784 +++ b/arch/x86/boot/boot.h
7785 @@ -85,7 +85,7 @@ static inline void io_delay(void)
7786 static inline u16 ds(void)
7787 {
7788 u16 seg;
7789 - asm("movw %%ds,%0" : "=rm" (seg));
7790 + asm volatile("movw %%ds,%0" : "=rm" (seg));
7791 return seg;
7792 }
7793
7794 @@ -181,7 +181,7 @@ static inline void wrgs32(u32 v, addr_t addr)
7795 static inline int memcmp(const void *s1, const void *s2, size_t len)
7796 {
7797 u8 diff;
7798 - asm("repe; cmpsb; setnz %0"
7799 + asm volatile("repe; cmpsb; setnz %0"
7800 : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
7801 return diff;
7802 }
7803 diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
7804 index e398bb5..3a382ca 100644
7805 --- a/arch/x86/boot/compressed/Makefile
7806 +++ b/arch/x86/boot/compressed/Makefile
7807 @@ -14,6 +14,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=small
7808 KBUILD_CFLAGS += $(cflags-y)
7809 KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
7810 KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
7811 +ifdef CONSTIFY_PLUGIN
7812 +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
7813 +endif
7814
7815 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
7816 GCOV_PROFILE := n
7817 diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
7818 index 4e85f5f..39fa641 100644
7819 --- a/arch/x86/boot/compressed/eboot.c
7820 +++ b/arch/x86/boot/compressed/eboot.c
7821 @@ -142,7 +142,6 @@ again:
7822 *addr = max_addr;
7823 }
7824
7825 -free_pool:
7826 efi_call_phys1(sys_table->boottime->free_pool, map);
7827
7828 fail:
7829 @@ -206,7 +205,6 @@ static efi_status_t low_alloc(unsigned long size, unsigned long align,
7830 if (i == map_size / desc_size)
7831 status = EFI_NOT_FOUND;
7832
7833 -free_pool:
7834 efi_call_phys1(sys_table->boottime->free_pool, map);
7835 fail:
7836 return status;
7837 diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
7838 index c85e3ac..6f5aa80 100644
7839 --- a/arch/x86/boot/compressed/head_32.S
7840 +++ b/arch/x86/boot/compressed/head_32.S
7841 @@ -106,7 +106,7 @@ preferred_addr:
7842 notl %eax
7843 andl %eax, %ebx
7844 #else
7845 - movl $LOAD_PHYSICAL_ADDR, %ebx
7846 + movl $____LOAD_PHYSICAL_ADDR, %ebx
7847 #endif
7848
7849 /* Target address to relocate to for decompression */
7850 @@ -192,7 +192,7 @@ relocated:
7851 * and where it was actually loaded.
7852 */
7853 movl %ebp, %ebx
7854 - subl $LOAD_PHYSICAL_ADDR, %ebx
7855 + subl $____LOAD_PHYSICAL_ADDR, %ebx
7856 jz 2f /* Nothing to be done if loaded at compiled addr. */
7857 /*
7858 * Process relocations.
7859 @@ -200,8 +200,7 @@ relocated:
7860
7861 1: subl $4, %edi
7862 movl (%edi), %ecx
7863 - testl %ecx, %ecx
7864 - jz 2f
7865 + jecxz 2f
7866 addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
7867 jmp 1b
7868 2:
7869 diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
7870 index 87e03a1..0d94c76 100644
7871 --- a/arch/x86/boot/compressed/head_64.S
7872 +++ b/arch/x86/boot/compressed/head_64.S
7873 @@ -91,7 +91,7 @@ ENTRY(startup_32)
7874 notl %eax
7875 andl %eax, %ebx
7876 #else
7877 - movl $LOAD_PHYSICAL_ADDR, %ebx
7878 + movl $____LOAD_PHYSICAL_ADDR, %ebx
7879 #endif
7880
7881 /* Target address to relocate to for decompression */
7882 @@ -263,7 +263,7 @@ preferred_addr:
7883 notq %rax
7884 andq %rax, %rbp
7885 #else
7886 - movq $LOAD_PHYSICAL_ADDR, %rbp
7887 + movq $____LOAD_PHYSICAL_ADDR, %rbp
7888 #endif
7889
7890 /* Target address to relocate to for decompression */
7891 diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
7892 index 7116dcb..d9ae1d7 100644
7893 --- a/arch/x86/boot/compressed/misc.c
7894 +++ b/arch/x86/boot/compressed/misc.c
7895 @@ -310,7 +310,7 @@ static void parse_elf(void *output)
7896 case PT_LOAD:
7897 #ifdef CONFIG_RELOCATABLE
7898 dest = output;
7899 - dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
7900 + dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
7901 #else
7902 dest = (void *)(phdr->p_paddr);
7903 #endif
7904 @@ -365,7 +365,7 @@ asmlinkage void decompress_kernel(void *rmode, memptr heap,
7905 error("Destination address too large");
7906 #endif
7907 #ifndef CONFIG_RELOCATABLE
7908 - if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
7909 + if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
7910 error("Wrong destination address");
7911 #endif
7912
7913 diff --git a/arch/x86/boot/cpucheck.c b/arch/x86/boot/cpucheck.c
7914 index 4d3ff03..e4972ff 100644
7915 --- a/arch/x86/boot/cpucheck.c
7916 +++ b/arch/x86/boot/cpucheck.c
7917 @@ -74,7 +74,7 @@ static int has_fpu(void)
7918 u16 fcw = -1, fsw = -1;
7919 u32 cr0;
7920
7921 - asm("movl %%cr0,%0" : "=r" (cr0));
7922 + asm volatile("movl %%cr0,%0" : "=r" (cr0));
7923 if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
7924 cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
7925 asm volatile("movl %0,%%cr0" : : "r" (cr0));
7926 @@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
7927 {
7928 u32 f0, f1;
7929
7930 - asm("pushfl ; "
7931 + asm volatile("pushfl ; "
7932 "pushfl ; "
7933 "popl %0 ; "
7934 "movl %0,%1 ; "
7935 @@ -115,7 +115,7 @@ static void get_flags(void)
7936 set_bit(X86_FEATURE_FPU, cpu.flags);
7937
7938 if (has_eflag(X86_EFLAGS_ID)) {
7939 - asm("cpuid"
7940 + asm volatile("cpuid"
7941 : "=a" (max_intel_level),
7942 "=b" (cpu_vendor[0]),
7943 "=d" (cpu_vendor[1]),
7944 @@ -124,7 +124,7 @@ static void get_flags(void)
7945
7946 if (max_intel_level >= 0x00000001 &&
7947 max_intel_level <= 0x0000ffff) {
7948 - asm("cpuid"
7949 + asm volatile("cpuid"
7950 : "=a" (tfms),
7951 "=c" (cpu.flags[4]),
7952 "=d" (cpu.flags[0])
7953 @@ -136,7 +136,7 @@ static void get_flags(void)
7954 cpu.model += ((tfms >> 16) & 0xf) << 4;
7955 }
7956
7957 - asm("cpuid"
7958 + asm volatile("cpuid"
7959 : "=a" (max_amd_level)
7960 : "a" (0x80000000)
7961 : "ebx", "ecx", "edx");
7962 @@ -144,7 +144,7 @@ static void get_flags(void)
7963 if (max_amd_level >= 0x80000001 &&
7964 max_amd_level <= 0x8000ffff) {
7965 u32 eax = 0x80000001;
7966 - asm("cpuid"
7967 + asm volatile("cpuid"
7968 : "+a" (eax),
7969 "=c" (cpu.flags[6]),
7970 "=d" (cpu.flags[1])
7971 @@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
7972 u32 ecx = MSR_K7_HWCR;
7973 u32 eax, edx;
7974
7975 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7976 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7977 eax &= ~(1 << 15);
7978 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7979 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7980
7981 get_flags(); /* Make sure it really did something */
7982 err = check_flags();
7983 @@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
7984 u32 ecx = MSR_VIA_FCR;
7985 u32 eax, edx;
7986
7987 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7988 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7989 eax |= (1<<1)|(1<<7);
7990 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7991 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7992
7993 set_bit(X86_FEATURE_CX8, cpu.flags);
7994 err = check_flags();
7995 @@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
7996 u32 eax, edx;
7997 u32 level = 1;
7998
7999 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
8000 - asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
8001 - asm("cpuid"
8002 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
8003 + asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
8004 + asm volatile("cpuid"
8005 : "+a" (level), "=d" (cpu.flags[0])
8006 : : "ecx", "ebx");
8007 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
8008 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
8009
8010 err = check_flags();
8011 }
8012 diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
8013 index efe5acf..22a3784 100644
8014 --- a/arch/x86/boot/header.S
8015 +++ b/arch/x86/boot/header.S
8016 @@ -391,10 +391,14 @@ setup_data: .quad 0 # 64-bit physical pointer to
8017 # single linked list of
8018 # struct setup_data
8019
8020 -pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
8021 +pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
8022
8023 #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
8024 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
8025 +#define VO_INIT_SIZE (VO__end - VO__text - __PAGE_OFFSET - ____LOAD_PHYSICAL_ADDR)
8026 +#else
8027 #define VO_INIT_SIZE (VO__end - VO__text)
8028 +#endif
8029 #if ZO_INIT_SIZE > VO_INIT_SIZE
8030 #define INIT_SIZE ZO_INIT_SIZE
8031 #else
8032 diff --git a/arch/x86/boot/memory.c b/arch/x86/boot/memory.c
8033 index db75d07..8e6d0af 100644
8034 --- a/arch/x86/boot/memory.c
8035 +++ b/arch/x86/boot/memory.c
8036 @@ -19,7 +19,7 @@
8037
8038 static int detect_memory_e820(void)
8039 {
8040 - int count = 0;
8041 + unsigned int count = 0;
8042 struct biosregs ireg, oreg;
8043 struct e820entry *desc = boot_params.e820_map;
8044 static struct e820entry buf; /* static so it is zeroed */
8045 diff --git a/arch/x86/boot/video-vesa.c b/arch/x86/boot/video-vesa.c
8046 index 11e8c6e..fdbb1ed 100644
8047 --- a/arch/x86/boot/video-vesa.c
8048 +++ b/arch/x86/boot/video-vesa.c
8049 @@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
8050
8051 boot_params.screen_info.vesapm_seg = oreg.es;
8052 boot_params.screen_info.vesapm_off = oreg.di;
8053 + boot_params.screen_info.vesapm_size = oreg.cx;
8054 }
8055
8056 /*
8057 diff --git a/arch/x86/boot/video.c b/arch/x86/boot/video.c
8058 index 43eda28..5ab5fdb 100644
8059 --- a/arch/x86/boot/video.c
8060 +++ b/arch/x86/boot/video.c
8061 @@ -96,7 +96,7 @@ static void store_mode_params(void)
8062 static unsigned int get_entry(void)
8063 {
8064 char entry_buf[4];
8065 - int i, len = 0;
8066 + unsigned int i, len = 0;
8067 int key;
8068 unsigned int v;
8069
8070 diff --git a/arch/x86/crypto/aes-x86_64-asm_64.S b/arch/x86/crypto/aes-x86_64-asm_64.S
8071 index 5b577d5..3c1fed4 100644
8072 --- a/arch/x86/crypto/aes-x86_64-asm_64.S
8073 +++ b/arch/x86/crypto/aes-x86_64-asm_64.S
8074 @@ -8,6 +8,8 @@
8075 * including this sentence is retained in full.
8076 */
8077
8078 +#include <asm/alternative-asm.h>
8079 +
8080 .extern crypto_ft_tab
8081 .extern crypto_it_tab
8082 .extern crypto_fl_tab
8083 @@ -71,6 +73,8 @@ FUNC: movq r1,r2; \
8084 je B192; \
8085 leaq 32(r9),r9;
8086
8087 +#define ret pax_force_retaddr 0, 1; ret
8088 +
8089 #define epilogue(r1,r2,r3,r4,r5,r6,r7,r8,r9) \
8090 movq r1,r2; \
8091 movq r3,r4; \
8092 diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
8093 index 3470624..201259d 100644
8094 --- a/arch/x86/crypto/aesni-intel_asm.S
8095 +++ b/arch/x86/crypto/aesni-intel_asm.S
8096 @@ -31,6 +31,7 @@
8097
8098 #include <linux/linkage.h>
8099 #include <asm/inst.h>
8100 +#include <asm/alternative-asm.h>
8101
8102 #ifdef __x86_64__
8103 .data
8104 @@ -1436,7 +1437,9 @@ _return_T_done_decrypt:
8105 pop %r14
8106 pop %r13
8107 pop %r12
8108 + pax_force_retaddr 0, 1
8109 ret
8110 +ENDPROC(aesni_gcm_dec)
8111
8112
8113 /*****************************************************************************
8114 @@ -1699,7 +1702,9 @@ _return_T_done_encrypt:
8115 pop %r14
8116 pop %r13
8117 pop %r12
8118 + pax_force_retaddr 0, 1
8119 ret
8120 +ENDPROC(aesni_gcm_enc)
8121
8122 #endif
8123
8124 @@ -1714,6 +1719,7 @@ _key_expansion_256a:
8125 pxor %xmm1, %xmm0
8126 movaps %xmm0, (TKEYP)
8127 add $0x10, TKEYP
8128 + pax_force_retaddr_bts
8129 ret
8130
8131 .align 4
8132 @@ -1738,6 +1744,7 @@ _key_expansion_192a:
8133 shufps $0b01001110, %xmm2, %xmm1
8134 movaps %xmm1, 0x10(TKEYP)
8135 add $0x20, TKEYP
8136 + pax_force_retaddr_bts
8137 ret
8138
8139 .align 4
8140 @@ -1757,6 +1764,7 @@ _key_expansion_192b:
8141
8142 movaps %xmm0, (TKEYP)
8143 add $0x10, TKEYP
8144 + pax_force_retaddr_bts
8145 ret
8146
8147 .align 4
8148 @@ -1769,6 +1777,7 @@ _key_expansion_256b:
8149 pxor %xmm1, %xmm2
8150 movaps %xmm2, (TKEYP)
8151 add $0x10, TKEYP
8152 + pax_force_retaddr_bts
8153 ret
8154
8155 /*
8156 @@ -1881,7 +1890,9 @@ ENTRY(aesni_set_key)
8157 #ifndef __x86_64__
8158 popl KEYP
8159 #endif
8160 + pax_force_retaddr 0, 1
8161 ret
8162 +ENDPROC(aesni_set_key)
8163
8164 /*
8165 * void aesni_enc(struct crypto_aes_ctx *ctx, u8 *dst, const u8 *src)
8166 @@ -1902,7 +1913,9 @@ ENTRY(aesni_enc)
8167 popl KLEN
8168 popl KEYP
8169 #endif
8170 + pax_force_retaddr 0, 1
8171 ret
8172 +ENDPROC(aesni_enc)
8173
8174 /*
8175 * _aesni_enc1: internal ABI
8176 @@ -1959,6 +1972,7 @@ _aesni_enc1:
8177 AESENC KEY STATE
8178 movaps 0x70(TKEYP), KEY
8179 AESENCLAST KEY STATE
8180 + pax_force_retaddr_bts
8181 ret
8182
8183 /*
8184 @@ -2067,6 +2081,7 @@ _aesni_enc4:
8185 AESENCLAST KEY STATE2
8186 AESENCLAST KEY STATE3
8187 AESENCLAST KEY STATE4
8188 + pax_force_retaddr_bts
8189 ret
8190
8191 /*
8192 @@ -2089,7 +2104,9 @@ ENTRY(aesni_dec)
8193 popl KLEN
8194 popl KEYP
8195 #endif
8196 + pax_force_retaddr 0, 1
8197 ret
8198 +ENDPROC(aesni_dec)
8199
8200 /*
8201 * _aesni_dec1: internal ABI
8202 @@ -2146,6 +2163,7 @@ _aesni_dec1:
8203 AESDEC KEY STATE
8204 movaps 0x70(TKEYP), KEY
8205 AESDECLAST KEY STATE
8206 + pax_force_retaddr_bts
8207 ret
8208
8209 /*
8210 @@ -2254,6 +2272,7 @@ _aesni_dec4:
8211 AESDECLAST KEY STATE2
8212 AESDECLAST KEY STATE3
8213 AESDECLAST KEY STATE4
8214 + pax_force_retaddr_bts
8215 ret
8216
8217 /*
8218 @@ -2311,7 +2330,9 @@ ENTRY(aesni_ecb_enc)
8219 popl KEYP
8220 popl LEN
8221 #endif
8222 + pax_force_retaddr 0, 1
8223 ret
8224 +ENDPROC(aesni_ecb_enc)
8225
8226 /*
8227 * void aesni_ecb_dec(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
8228 @@ -2369,7 +2390,9 @@ ENTRY(aesni_ecb_dec)
8229 popl KEYP
8230 popl LEN
8231 #endif
8232 + pax_force_retaddr 0, 1
8233 ret
8234 +ENDPROC(aesni_ecb_dec)
8235
8236 /*
8237 * void aesni_cbc_enc(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
8238 @@ -2410,7 +2433,9 @@ ENTRY(aesni_cbc_enc)
8239 popl LEN
8240 popl IVP
8241 #endif
8242 + pax_force_retaddr 0, 1
8243 ret
8244 +ENDPROC(aesni_cbc_enc)
8245
8246 /*
8247 * void aesni_cbc_dec(struct crypto_aes_ctx *ctx, const u8 *dst, u8 *src,
8248 @@ -2500,7 +2525,9 @@ ENTRY(aesni_cbc_dec)
8249 popl LEN
8250 popl IVP
8251 #endif
8252 + pax_force_retaddr 0, 1
8253 ret
8254 +ENDPROC(aesni_cbc_dec)
8255
8256 #ifdef __x86_64__
8257 .align 16
8258 @@ -2526,6 +2553,7 @@ _aesni_inc_init:
8259 mov $1, TCTR_LOW
8260 MOVQ_R64_XMM TCTR_LOW INC
8261 MOVQ_R64_XMM CTR TCTR_LOW
8262 + pax_force_retaddr_bts
8263 ret
8264
8265 /*
8266 @@ -2554,6 +2582,7 @@ _aesni_inc:
8267 .Linc_low:
8268 movaps CTR, IV
8269 PSHUFB_XMM BSWAP_MASK IV
8270 + pax_force_retaddr_bts
8271 ret
8272
8273 /*
8274 @@ -2614,5 +2643,7 @@ ENTRY(aesni_ctr_enc)
8275 .Lctr_enc_ret:
8276 movups IV, (IVP)
8277 .Lctr_enc_just_ret:
8278 + pax_force_retaddr 0, 1
8279 ret
8280 +ENDPROC(aesni_ctr_enc)
8281 #endif
8282 diff --git a/arch/x86/crypto/blowfish-x86_64-asm_64.S b/arch/x86/crypto/blowfish-x86_64-asm_64.S
8283 index 391d245..67f35c2 100644
8284 --- a/arch/x86/crypto/blowfish-x86_64-asm_64.S
8285 +++ b/arch/x86/crypto/blowfish-x86_64-asm_64.S
8286 @@ -20,6 +20,8 @@
8287 *
8288 */
8289
8290 +#include <asm/alternative-asm.h>
8291 +
8292 .file "blowfish-x86_64-asm.S"
8293 .text
8294
8295 @@ -151,9 +153,11 @@ __blowfish_enc_blk:
8296 jnz __enc_xor;
8297
8298 write_block();
8299 + pax_force_retaddr 0, 1
8300 ret;
8301 __enc_xor:
8302 xor_block();
8303 + pax_force_retaddr 0, 1
8304 ret;
8305
8306 .align 8
8307 @@ -188,6 +192,7 @@ blowfish_dec_blk:
8308
8309 movq %r11, %rbp;
8310
8311 + pax_force_retaddr 0, 1
8312 ret;
8313
8314 /**********************************************************************
8315 @@ -342,6 +347,7 @@ __blowfish_enc_blk_4way:
8316
8317 popq %rbx;
8318 popq %rbp;
8319 + pax_force_retaddr 0, 1
8320 ret;
8321
8322 __enc_xor4:
8323 @@ -349,6 +355,7 @@ __enc_xor4:
8324
8325 popq %rbx;
8326 popq %rbp;
8327 + pax_force_retaddr 0, 1
8328 ret;
8329
8330 .align 8
8331 @@ -386,5 +393,6 @@ blowfish_dec_blk_4way:
8332 popq %rbx;
8333 popq %rbp;
8334
8335 + pax_force_retaddr 0, 1
8336 ret;
8337
8338 diff --git a/arch/x86/crypto/camellia-x86_64-asm_64.S b/arch/x86/crypto/camellia-x86_64-asm_64.S
8339 index 0b33743..7a56206 100644
8340 --- a/arch/x86/crypto/camellia-x86_64-asm_64.S
8341 +++ b/arch/x86/crypto/camellia-x86_64-asm_64.S
8342 @@ -20,6 +20,8 @@
8343 *
8344 */
8345
8346 +#include <asm/alternative-asm.h>
8347 +
8348 .file "camellia-x86_64-asm_64.S"
8349 .text
8350
8351 @@ -229,12 +231,14 @@ __enc_done:
8352 enc_outunpack(mov, RT1);
8353
8354 movq RRBP, %rbp;
8355 + pax_force_retaddr 0, 1
8356 ret;
8357
8358 __enc_xor:
8359 enc_outunpack(xor, RT1);
8360
8361 movq RRBP, %rbp;
8362 + pax_force_retaddr 0, 1
8363 ret;
8364
8365 .global camellia_dec_blk;
8366 @@ -275,6 +279,7 @@ __dec_rounds16:
8367 dec_outunpack();
8368
8369 movq RRBP, %rbp;
8370 + pax_force_retaddr 0, 1
8371 ret;
8372
8373 /**********************************************************************
8374 @@ -468,6 +473,7 @@ __enc2_done:
8375
8376 movq RRBP, %rbp;
8377 popq %rbx;
8378 + pax_force_retaddr 0, 1
8379 ret;
8380
8381 __enc2_xor:
8382 @@ -475,6 +481,7 @@ __enc2_xor:
8383
8384 movq RRBP, %rbp;
8385 popq %rbx;
8386 + pax_force_retaddr 0, 1
8387 ret;
8388
8389 .global camellia_dec_blk_2way;
8390 @@ -517,4 +524,5 @@ __dec2_rounds16:
8391
8392 movq RRBP, %rbp;
8393 movq RXOR, %rbx;
8394 + pax_force_retaddr 0, 1
8395 ret;
8396 diff --git a/arch/x86/crypto/salsa20-x86_64-asm_64.S b/arch/x86/crypto/salsa20-x86_64-asm_64.S
8397 index 6214a9b..1f4fc9a 100644
8398 --- a/arch/x86/crypto/salsa20-x86_64-asm_64.S
8399 +++ b/arch/x86/crypto/salsa20-x86_64-asm_64.S
8400 @@ -1,3 +1,5 @@
8401 +#include <asm/alternative-asm.h>
8402 +
8403 # enter ECRYPT_encrypt_bytes
8404 .text
8405 .p2align 5
8406 @@ -790,6 +792,7 @@ ECRYPT_encrypt_bytes:
8407 add %r11,%rsp
8408 mov %rdi,%rax
8409 mov %rsi,%rdx
8410 + pax_force_retaddr 0, 1
8411 ret
8412 # bytesatleast65:
8413 ._bytesatleast65:
8414 @@ -891,6 +894,7 @@ ECRYPT_keysetup:
8415 add %r11,%rsp
8416 mov %rdi,%rax
8417 mov %rsi,%rdx
8418 + pax_force_retaddr
8419 ret
8420 # enter ECRYPT_ivsetup
8421 .text
8422 @@ -917,4 +921,5 @@ ECRYPT_ivsetup:
8423 add %r11,%rsp
8424 mov %rdi,%rax
8425 mov %rsi,%rdx
8426 + pax_force_retaddr
8427 ret
8428 diff --git a/arch/x86/crypto/serpent-sse2-x86_64-asm_64.S b/arch/x86/crypto/serpent-sse2-x86_64-asm_64.S
8429 index 3ee1ff0..cbc568b 100644
8430 --- a/arch/x86/crypto/serpent-sse2-x86_64-asm_64.S
8431 +++ b/arch/x86/crypto/serpent-sse2-x86_64-asm_64.S
8432 @@ -24,6 +24,8 @@
8433 *
8434 */
8435
8436 +#include <asm/alternative-asm.h>
8437 +
8438 .file "serpent-sse2-x86_64-asm_64.S"
8439 .text
8440
8441 @@ -692,12 +694,14 @@ __serpent_enc_blk_8way:
8442 write_blocks(%rsi, RA1, RB1, RC1, RD1, RK0, RK1, RK2);
8443 write_blocks(%rax, RA2, RB2, RC2, RD2, RK0, RK1, RK2);
8444
8445 + pax_force_retaddr
8446 ret;
8447
8448 __enc_xor8:
8449 xor_blocks(%rsi, RA1, RB1, RC1, RD1, RK0, RK1, RK2);
8450 xor_blocks(%rax, RA2, RB2, RC2, RD2, RK0, RK1, RK2);
8451
8452 + pax_force_retaddr
8453 ret;
8454
8455 .align 8
8456 @@ -755,4 +759,5 @@ serpent_dec_blk_8way:
8457 write_blocks(%rsi, RC1, RD1, RB1, RE1, RK0, RK1, RK2);
8458 write_blocks(%rax, RC2, RD2, RB2, RE2, RK0, RK1, RK2);
8459
8460 + pax_force_retaddr
8461 ret;
8462 diff --git a/arch/x86/crypto/sha1_ssse3_asm.S b/arch/x86/crypto/sha1_ssse3_asm.S
8463 index b2c2f57..8470cab 100644
8464 --- a/arch/x86/crypto/sha1_ssse3_asm.S
8465 +++ b/arch/x86/crypto/sha1_ssse3_asm.S
8466 @@ -28,6 +28,8 @@
8467 * (at your option) any later version.
8468 */
8469
8470 +#include <asm/alternative-asm.h>
8471 +
8472 #define CTX %rdi // arg1
8473 #define BUF %rsi // arg2
8474 #define CNT %rdx // arg3
8475 @@ -104,6 +106,7 @@
8476 pop %r12
8477 pop %rbp
8478 pop %rbx
8479 + pax_force_retaddr 0, 1
8480 ret
8481
8482 .size \name, .-\name
8483 diff --git a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S
8484 index 5b012a2..36d5364 100644
8485 --- a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S
8486 +++ b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S
8487 @@ -20,6 +20,8 @@
8488 *
8489 */
8490
8491 +#include <asm/alternative-asm.h>
8492 +
8493 .file "twofish-x86_64-asm-3way.S"
8494 .text
8495
8496 @@ -260,6 +262,7 @@ __twofish_enc_blk_3way:
8497 popq %r13;
8498 popq %r14;
8499 popq %r15;
8500 + pax_force_retaddr 0, 1
8501 ret;
8502
8503 __enc_xor3:
8504 @@ -271,6 +274,7 @@ __enc_xor3:
8505 popq %r13;
8506 popq %r14;
8507 popq %r15;
8508 + pax_force_retaddr 0, 1
8509 ret;
8510
8511 .global twofish_dec_blk_3way
8512 @@ -312,5 +316,6 @@ twofish_dec_blk_3way:
8513 popq %r13;
8514 popq %r14;
8515 popq %r15;
8516 + pax_force_retaddr 0, 1
8517 ret;
8518
8519 diff --git a/arch/x86/crypto/twofish-x86_64-asm_64.S b/arch/x86/crypto/twofish-x86_64-asm_64.S
8520 index 7bcf3fc..f53832f 100644
8521 --- a/arch/x86/crypto/twofish-x86_64-asm_64.S
8522 +++ b/arch/x86/crypto/twofish-x86_64-asm_64.S
8523 @@ -21,6 +21,7 @@
8524 .text
8525
8526 #include <asm/asm-offsets.h>
8527 +#include <asm/alternative-asm.h>
8528
8529 #define a_offset 0
8530 #define b_offset 4
8531 @@ -268,6 +269,7 @@ twofish_enc_blk:
8532
8533 popq R1
8534 movq $1,%rax
8535 + pax_force_retaddr 0, 1
8536 ret
8537
8538 twofish_dec_blk:
8539 @@ -319,4 +321,5 @@ twofish_dec_blk:
8540
8541 popq R1
8542 movq $1,%rax
8543 + pax_force_retaddr 0, 1
8544 ret
8545 diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
8546 index 07b3a68..bd2a388 100644
8547 --- a/arch/x86/ia32/ia32_aout.c
8548 +++ b/arch/x86/ia32/ia32_aout.c
8549 @@ -159,6 +159,8 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file,
8550 unsigned long dump_start, dump_size;
8551 struct user32 dump;
8552
8553 + memset(&dump, 0, sizeof(dump));
8554 +
8555 fs = get_fs();
8556 set_fs(KERNEL_DS);
8557 has_dumped = 1;
8558 diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
8559 index 673ac9b..7a8c5df 100644
8560 --- a/arch/x86/ia32/ia32_signal.c
8561 +++ b/arch/x86/ia32/ia32_signal.c
8562 @@ -162,7 +162,7 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr,
8563 }
8564 seg = get_fs();
8565 set_fs(KERNEL_DS);
8566 - ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss, regs->sp);
8567 + ret = do_sigaltstack(uss_ptr ? (const stack_t __force_user *)&uss : NULL, (stack_t __force_user *)&uoss, regs->sp);
8568 set_fs(seg);
8569 if (ret >= 0 && uoss_ptr) {
8570 if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t)))
8571 @@ -361,7 +361,7 @@ static int ia32_setup_sigcontext(struct sigcontext_ia32 __user *sc,
8572 */
8573 static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
8574 size_t frame_size,
8575 - void **fpstate)
8576 + void __user **fpstate)
8577 {
8578 unsigned long sp;
8579
8580 @@ -382,7 +382,7 @@ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
8581
8582 if (used_math()) {
8583 sp = sp - sig_xstate_ia32_size;
8584 - *fpstate = (struct _fpstate_ia32 *) sp;
8585 + *fpstate = (struct _fpstate_ia32 __user *) sp;
8586 if (save_i387_xstate_ia32(*fpstate) < 0)
8587 return (void __user *) -1L;
8588 }
8589 @@ -390,7 +390,7 @@ static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
8590 sp -= frame_size;
8591 /* Align the stack pointer according to the i386 ABI,
8592 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
8593 - sp = ((sp + 4) & -16ul) - 4;
8594 + sp = ((sp - 12) & -16ul) - 4;
8595 return (void __user *) sp;
8596 }
8597
8598 @@ -448,7 +448,7 @@ int ia32_setup_frame(int sig, struct k_sigaction *ka,
8599 * These are actually not used anymore, but left because some
8600 * gdb versions depend on them as a marker.
8601 */
8602 - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
8603 + put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
8604 } put_user_catch(err);
8605
8606 if (err)
8607 @@ -490,7 +490,7 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
8608 0xb8,
8609 __NR_ia32_rt_sigreturn,
8610 0x80cd,
8611 - 0,
8612 + 0
8613 };
8614
8615 frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
8616 @@ -520,16 +520,18 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
8617
8618 if (ka->sa.sa_flags & SA_RESTORER)
8619 restorer = ka->sa.sa_restorer;
8620 + else if (current->mm->context.vdso)
8621 + /* Return stub is in 32bit vsyscall page */
8622 + restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
8623 else
8624 - restorer = VDSO32_SYMBOL(current->mm->context.vdso,
8625 - rt_sigreturn);
8626 + restorer = &frame->retcode;
8627 put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
8628
8629 /*
8630 * Not actually used anymore, but left because some gdb
8631 * versions need it.
8632 */
8633 - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
8634 + put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
8635 } put_user_catch(err);
8636
8637 if (err)
8638 diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
8639 index 20e5f7b..f33c779 100644
8640 --- a/arch/x86/ia32/ia32entry.S
8641 +++ b/arch/x86/ia32/ia32entry.S
8642 @@ -14,8 +14,10 @@
8643 #include <asm/segment.h>
8644 #include <asm/irqflags.h>
8645 #include <asm/asm.h>
8646 +#include <asm/pgtable.h>
8647 #include <linux/linkage.h>
8648 #include <linux/err.h>
8649 +#include <asm/alternative-asm.h>
8650
8651 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
8652 #include <linux/elf-em.h>
8653 @@ -95,6 +97,32 @@ ENTRY(native_irq_enable_sysexit)
8654 ENDPROC(native_irq_enable_sysexit)
8655 #endif
8656
8657 + .macro pax_enter_kernel_user
8658 + pax_set_fptr_mask
8659 +#ifdef CONFIG_PAX_MEMORY_UDEREF
8660 + call pax_enter_kernel_user
8661 +#endif
8662 + .endm
8663 +
8664 + .macro pax_exit_kernel_user
8665 +#ifdef CONFIG_PAX_MEMORY_UDEREF
8666 + call pax_exit_kernel_user
8667 +#endif
8668 +#ifdef CONFIG_PAX_RANDKSTACK
8669 + pushq %rax
8670 + pushq %r11
8671 + call pax_randomize_kstack
8672 + popq %r11
8673 + popq %rax
8674 +#endif
8675 + .endm
8676 +
8677 +.macro pax_erase_kstack
8678 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
8679 + call pax_erase_kstack
8680 +#endif
8681 +.endm
8682 +
8683 /*
8684 * 32bit SYSENTER instruction entry.
8685 *
8686 @@ -121,12 +149,6 @@ ENTRY(ia32_sysenter_target)
8687 CFI_REGISTER rsp,rbp
8688 SWAPGS_UNSAFE_STACK
8689 movq PER_CPU_VAR(kernel_stack), %rsp
8690 - addq $(KERNEL_STACK_OFFSET),%rsp
8691 - /*
8692 - * No need to follow this irqs on/off section: the syscall
8693 - * disabled irqs, here we enable it straight after entry:
8694 - */
8695 - ENABLE_INTERRUPTS(CLBR_NONE)
8696 movl %ebp,%ebp /* zero extension */
8697 pushq_cfi $__USER32_DS
8698 /*CFI_REL_OFFSET ss,0*/
8699 @@ -134,22 +156,42 @@ ENTRY(ia32_sysenter_target)
8700 CFI_REL_OFFSET rsp,0
8701 pushfq_cfi
8702 /*CFI_REL_OFFSET rflags,0*/
8703 - movl TI_sysenter_return+THREAD_INFO(%rsp,3*8-KERNEL_STACK_OFFSET),%r10d
8704 - CFI_REGISTER rip,r10
8705 + orl $X86_EFLAGS_IF,(%rsp)
8706 + GET_THREAD_INFO(%r11)
8707 + movl TI_sysenter_return(%r11), %r11d
8708 + CFI_REGISTER rip,r11
8709 pushq_cfi $__USER32_CS
8710 /*CFI_REL_OFFSET cs,0*/
8711 movl %eax, %eax
8712 - pushq_cfi %r10
8713 + pushq_cfi %r11
8714 CFI_REL_OFFSET rip,0
8715 pushq_cfi %rax
8716 cld
8717 SAVE_ARGS 0,1,0
8718 + pax_enter_kernel_user
8719 +
8720 +#ifdef CONFIG_PAX_RANDKSTACK
8721 + pax_erase_kstack
8722 +#endif
8723 +
8724 + /*
8725 + * No need to follow this irqs on/off section: the syscall
8726 + * disabled irqs, here we enable it straight after entry:
8727 + */
8728 + ENABLE_INTERRUPTS(CLBR_NONE)
8729 /* no need to do an access_ok check here because rbp has been
8730 32bit zero extended */
8731 +
8732 +#ifdef CONFIG_PAX_MEMORY_UDEREF
8733 + mov $PAX_USER_SHADOW_BASE,%r11
8734 + add %r11,%rbp
8735 +#endif
8736 +
8737 1: movl (%rbp),%ebp
8738 _ASM_EXTABLE(1b,ia32_badarg)
8739 - orl $TS_COMPAT,TI_status+THREAD_INFO(%rsp,RIP-ARGOFFSET)
8740 - testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
8741 + GET_THREAD_INFO(%r11)
8742 + orl $TS_COMPAT,TI_status(%r11)
8743 + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
8744 CFI_REMEMBER_STATE
8745 jnz sysenter_tracesys
8746 cmpq $(IA32_NR_syscalls-1),%rax
8747 @@ -159,12 +201,15 @@ sysenter_do_call:
8748 sysenter_dispatch:
8749 call *ia32_sys_call_table(,%rax,8)
8750 movq %rax,RAX-ARGOFFSET(%rsp)
8751 + GET_THREAD_INFO(%r11)
8752 DISABLE_INTERRUPTS(CLBR_NONE)
8753 TRACE_IRQS_OFF
8754 - testl $_TIF_ALLWORK_MASK,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
8755 + testl $_TIF_ALLWORK_MASK,TI_flags(%r11)
8756 jnz sysexit_audit
8757 sysexit_from_sys_call:
8758 - andl $~TS_COMPAT,TI_status+THREAD_INFO(%rsp,RIP-ARGOFFSET)
8759 + pax_exit_kernel_user
8760 + pax_erase_kstack
8761 + andl $~TS_COMPAT,TI_status(%r11)
8762 /* clear IF, that popfq doesn't enable interrupts early */
8763 andl $~0x200,EFLAGS-R11(%rsp)
8764 movl RIP-R11(%rsp),%edx /* User %eip */
8765 @@ -190,6 +235,9 @@ sysexit_from_sys_call:
8766 movl %eax,%esi /* 2nd arg: syscall number */
8767 movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
8768 call __audit_syscall_entry
8769 +
8770 + pax_erase_kstack
8771 +
8772 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
8773 cmpq $(IA32_NR_syscalls-1),%rax
8774 ja ia32_badsys
8775 @@ -201,7 +249,7 @@ sysexit_from_sys_call:
8776 .endm
8777
8778 .macro auditsys_exit exit
8779 - testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
8780 + testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
8781 jnz ia32_ret_from_sys_call
8782 TRACE_IRQS_ON
8783 sti
8784 @@ -212,11 +260,12 @@ sysexit_from_sys_call:
8785 1: setbe %al /* 1 if error, 0 if not */
8786 movzbl %al,%edi /* zero-extend that into %edi */
8787 call __audit_syscall_exit
8788 + GET_THREAD_INFO(%r11)
8789 movq RAX-ARGOFFSET(%rsp),%rax /* reload syscall return value */
8790 movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
8791 cli
8792 TRACE_IRQS_OFF
8793 - testl %edi,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
8794 + testl %edi,TI_flags(%r11)
8795 jz \exit
8796 CLEAR_RREGS -ARGOFFSET
8797 jmp int_with_check
8798 @@ -234,7 +283,7 @@ sysexit_audit:
8799
8800 sysenter_tracesys:
8801 #ifdef CONFIG_AUDITSYSCALL
8802 - testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
8803 + testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
8804 jz sysenter_auditsys
8805 #endif
8806 SAVE_REST
8807 @@ -246,6 +295,9 @@ sysenter_tracesys:
8808 RESTORE_REST
8809 cmpq $(IA32_NR_syscalls-1),%rax
8810 ja int_ret_from_sys_call /* sysenter_tracesys has set RAX(%rsp) */
8811 +
8812 + pax_erase_kstack
8813 +
8814 jmp sysenter_do_call
8815 CFI_ENDPROC
8816 ENDPROC(ia32_sysenter_target)
8817 @@ -273,19 +325,25 @@ ENDPROC(ia32_sysenter_target)
8818 ENTRY(ia32_cstar_target)
8819 CFI_STARTPROC32 simple
8820 CFI_SIGNAL_FRAME
8821 - CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
8822 + CFI_DEF_CFA rsp,0
8823 CFI_REGISTER rip,rcx
8824 /*CFI_REGISTER rflags,r11*/
8825 SWAPGS_UNSAFE_STACK
8826 movl %esp,%r8d
8827 CFI_REGISTER rsp,r8
8828 movq PER_CPU_VAR(kernel_stack),%rsp
8829 + SAVE_ARGS 8*6,0,0
8830 + pax_enter_kernel_user
8831 +
8832 +#ifdef CONFIG_PAX_RANDKSTACK
8833 + pax_erase_kstack
8834 +#endif
8835 +
8836 /*
8837 * No need to follow this irqs on/off section: the syscall
8838 * disabled irqs and here we enable it straight after entry:
8839 */
8840 ENABLE_INTERRUPTS(CLBR_NONE)
8841 - SAVE_ARGS 8,0,0
8842 movl %eax,%eax /* zero extension */
8843 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
8844 movq %rcx,RIP-ARGOFFSET(%rsp)
8845 @@ -301,10 +359,17 @@ ENTRY(ia32_cstar_target)
8846 /* no need to do an access_ok check here because r8 has been
8847 32bit zero extended */
8848 /* hardware stack frame is complete now */
8849 +
8850 +#ifdef CONFIG_PAX_MEMORY_UDEREF
8851 + mov $PAX_USER_SHADOW_BASE,%r11
8852 + add %r11,%r8
8853 +#endif
8854 +
8855 1: movl (%r8),%r9d
8856 _ASM_EXTABLE(1b,ia32_badarg)
8857 - orl $TS_COMPAT,TI_status+THREAD_INFO(%rsp,RIP-ARGOFFSET)
8858 - testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
8859 + GET_THREAD_INFO(%r11)
8860 + orl $TS_COMPAT,TI_status(%r11)
8861 + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
8862 CFI_REMEMBER_STATE
8863 jnz cstar_tracesys
8864 cmpq $IA32_NR_syscalls-1,%rax
8865 @@ -314,12 +379,15 @@ cstar_do_call:
8866 cstar_dispatch:
8867 call *ia32_sys_call_table(,%rax,8)
8868 movq %rax,RAX-ARGOFFSET(%rsp)
8869 + GET_THREAD_INFO(%r11)
8870 DISABLE_INTERRUPTS(CLBR_NONE)
8871 TRACE_IRQS_OFF
8872 - testl $_TIF_ALLWORK_MASK,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
8873 + testl $_TIF_ALLWORK_MASK,TI_flags(%r11)
8874 jnz sysretl_audit
8875 sysretl_from_sys_call:
8876 - andl $~TS_COMPAT,TI_status+THREAD_INFO(%rsp,RIP-ARGOFFSET)
8877 + pax_exit_kernel_user
8878 + pax_erase_kstack
8879 + andl $~TS_COMPAT,TI_status(%r11)
8880 RESTORE_ARGS 0,-ARG_SKIP,0,0,0
8881 movl RIP-ARGOFFSET(%rsp),%ecx
8882 CFI_REGISTER rip,rcx
8883 @@ -347,7 +415,7 @@ sysretl_audit:
8884
8885 cstar_tracesys:
8886 #ifdef CONFIG_AUDITSYSCALL
8887 - testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
8888 + testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
8889 jz cstar_auditsys
8890 #endif
8891 xchgl %r9d,%ebp
8892 @@ -361,6 +429,9 @@ cstar_tracesys:
8893 xchgl %ebp,%r9d
8894 cmpq $(IA32_NR_syscalls-1),%rax
8895 ja int_ret_from_sys_call /* cstar_tracesys has set RAX(%rsp) */
8896 +
8897 + pax_erase_kstack
8898 +
8899 jmp cstar_do_call
8900 END(ia32_cstar_target)
8901
8902 @@ -401,19 +472,26 @@ ENTRY(ia32_syscall)
8903 CFI_REL_OFFSET rip,RIP-RIP
8904 PARAVIRT_ADJUST_EXCEPTION_FRAME
8905 SWAPGS
8906 - /*
8907 - * No need to follow this irqs on/off section: the syscall
8908 - * disabled irqs and here we enable it straight after entry:
8909 - */
8910 - ENABLE_INTERRUPTS(CLBR_NONE)
8911 movl %eax,%eax
8912 pushq_cfi %rax
8913 cld
8914 /* note the registers are not zero extended to the sf.
8915 this could be a problem. */
8916 SAVE_ARGS 0,1,0
8917 - orl $TS_COMPAT,TI_status+THREAD_INFO(%rsp,RIP-ARGOFFSET)
8918 - testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
8919 + pax_enter_kernel_user
8920 +
8921 +#ifdef CONFIG_PAX_RANDKSTACK
8922 + pax_erase_kstack
8923 +#endif
8924 +
8925 + /*
8926 + * No need to follow this irqs on/off section: the syscall
8927 + * disabled irqs and here we enable it straight after entry:
8928 + */
8929 + ENABLE_INTERRUPTS(CLBR_NONE)
8930 + GET_THREAD_INFO(%r11)
8931 + orl $TS_COMPAT,TI_status(%r11)
8932 + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
8933 jnz ia32_tracesys
8934 cmpq $(IA32_NR_syscalls-1),%rax
8935 ja ia32_badsys
8936 @@ -436,6 +514,9 @@ ia32_tracesys:
8937 RESTORE_REST
8938 cmpq $(IA32_NR_syscalls-1),%rax
8939 ja int_ret_from_sys_call /* ia32_tracesys has set RAX(%rsp) */
8940 +
8941 + pax_erase_kstack
8942 +
8943 jmp ia32_do_call
8944 END(ia32_syscall)
8945
8946 diff --git a/arch/x86/ia32/sys_ia32.c b/arch/x86/ia32/sys_ia32.c
8947 index 4540bec..714d913 100644
8948 --- a/arch/x86/ia32/sys_ia32.c
8949 +++ b/arch/x86/ia32/sys_ia32.c
8950 @@ -69,8 +69,8 @@ asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long offset_low,
8951 */
8952 static int cp_stat64(struct stat64 __user *ubuf, struct kstat *stat)
8953 {
8954 - typeof(ubuf->st_uid) uid = 0;
8955 - typeof(ubuf->st_gid) gid = 0;
8956 + typeof(((struct stat64 *)0)->st_uid) uid = 0;
8957 + typeof(((struct stat64 *)0)->st_gid) gid = 0;
8958 SET_UID(uid, from_kuid_munged(current_user_ns(), stat->uid));
8959 SET_GID(gid, from_kgid_munged(current_user_ns(), stat->gid));
8960 if (!access_ok(VERIFY_WRITE, ubuf, sizeof(struct stat64)) ||
8961 @@ -287,7 +287,7 @@ asmlinkage long sys32_sigaction(int sig, struct old_sigaction32 __user *act,
8962 return ret;
8963 }
8964
8965 -asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int *stat_addr,
8966 +asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int __user *stat_addr,
8967 int options)
8968 {
8969 return compat_sys_wait4(pid, stat_addr, options, NULL);
8970 @@ -303,7 +303,7 @@ asmlinkage long sys32_sched_rr_get_interval(compat_pid_t pid,
8971 mm_segment_t old_fs = get_fs();
8972
8973 set_fs(KERNEL_DS);
8974 - ret = sys_sched_rr_get_interval(pid, (struct timespec __user *)&t);
8975 + ret = sys_sched_rr_get_interval(pid, (struct timespec __force_user *)&t);
8976 set_fs(old_fs);
8977 if (put_compat_timespec(&t, interval))
8978 return -EFAULT;
8979 @@ -319,7 +319,7 @@ asmlinkage long sys32_rt_sigpending(compat_sigset_t __user *set,
8980 mm_segment_t old_fs = get_fs();
8981
8982 set_fs(KERNEL_DS);
8983 - ret = sys_rt_sigpending((sigset_t __user *)&s, sigsetsize);
8984 + ret = sys_rt_sigpending((sigset_t __force_user *)&s, sigsetsize);
8985 set_fs(old_fs);
8986 if (!ret) {
8987 switch (_NSIG_WORDS) {
8988 @@ -344,7 +344,7 @@ asmlinkage long sys32_rt_sigqueueinfo(int pid, int sig,
8989 if (copy_siginfo_from_user32(&info, uinfo))
8990 return -EFAULT;
8991 set_fs(KERNEL_DS);
8992 - ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __user *)&info);
8993 + ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __force_user *)&info);
8994 set_fs(old_fs);
8995 return ret;
8996 }
8997 @@ -376,7 +376,7 @@ asmlinkage long sys32_sendfile(int out_fd, int in_fd,
8998 return -EFAULT;
8999
9000 set_fs(KERNEL_DS);
9001 - ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __user *)&of : NULL,
9002 + ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __force_user *)&of : NULL,
9003 count);
9004 set_fs(old_fs);
9005
9006 diff --git a/arch/x86/include/asm/alternative-asm.h b/arch/x86/include/asm/alternative-asm.h
9007 index 952bd01..7692c6f 100644
9008 --- a/arch/x86/include/asm/alternative-asm.h
9009 +++ b/arch/x86/include/asm/alternative-asm.h
9010 @@ -15,6 +15,45 @@
9011 .endm
9012 #endif
9013
9014 +#ifdef KERNEXEC_PLUGIN
9015 + .macro pax_force_retaddr_bts rip=0
9016 + btsq $63,\rip(%rsp)
9017 + .endm
9018 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS
9019 + .macro pax_force_retaddr rip=0, reload=0
9020 + btsq $63,\rip(%rsp)
9021 + .endm
9022 + .macro pax_force_fptr ptr
9023 + btsq $63,\ptr
9024 + .endm
9025 + .macro pax_set_fptr_mask
9026 + .endm
9027 +#endif
9028 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
9029 + .macro pax_force_retaddr rip=0, reload=0
9030 + .if \reload
9031 + pax_set_fptr_mask
9032 + .endif
9033 + orq %r10,\rip(%rsp)
9034 + .endm
9035 + .macro pax_force_fptr ptr
9036 + orq %r10,\ptr
9037 + .endm
9038 + .macro pax_set_fptr_mask
9039 + movabs $0x8000000000000000,%r10
9040 + .endm
9041 +#endif
9042 +#else
9043 + .macro pax_force_retaddr rip=0, reload=0
9044 + .endm
9045 + .macro pax_force_fptr ptr
9046 + .endm
9047 + .macro pax_force_retaddr_bts rip=0
9048 + .endm
9049 + .macro pax_set_fptr_mask
9050 + .endm
9051 +#endif
9052 +
9053 .macro altinstruction_entry orig alt feature orig_len alt_len
9054 .long \orig - .
9055 .long \alt - .
9056 diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h
9057 index 49331be..9706065 100644
9058 --- a/arch/x86/include/asm/alternative.h
9059 +++ b/arch/x86/include/asm/alternative.h
9060 @@ -89,7 +89,7 @@ static inline int alternatives_text_reserved(void *start, void *end)
9061 ".section .discard,\"aw\",@progbits\n" \
9062 " .byte 0xff + (664f-663f) - (662b-661b)\n" /* rlen <= slen */ \
9063 ".previous\n" \
9064 - ".section .altinstr_replacement, \"ax\"\n" \
9065 + ".section .altinstr_replacement, \"a\"\n" \
9066 "663:\n\t" newinstr "\n664:\n" /* replacement */ \
9067 ".previous"
9068
9069 diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
9070 index eaff479..3025a63 100644
9071 --- a/arch/x86/include/asm/apic.h
9072 +++ b/arch/x86/include/asm/apic.h
9073 @@ -44,7 +44,7 @@ static inline void generic_apic_probe(void)
9074
9075 #ifdef CONFIG_X86_LOCAL_APIC
9076
9077 -extern unsigned int apic_verbosity;
9078 +extern int apic_verbosity;
9079 extern int local_apic_timer_c2_ok;
9080
9081 extern int disable_apic;
9082 diff --git a/arch/x86/include/asm/apm.h b/arch/x86/include/asm/apm.h
9083 index 20370c6..a2eb9b0 100644
9084 --- a/arch/x86/include/asm/apm.h
9085 +++ b/arch/x86/include/asm/apm.h
9086 @@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in,
9087 __asm__ __volatile__(APM_DO_ZERO_SEGS
9088 "pushl %%edi\n\t"
9089 "pushl %%ebp\n\t"
9090 - "lcall *%%cs:apm_bios_entry\n\t"
9091 + "lcall *%%ss:apm_bios_entry\n\t"
9092 "setc %%al\n\t"
9093 "popl %%ebp\n\t"
9094 "popl %%edi\n\t"
9095 @@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_asm(u32 func, u32 ebx_in,
9096 __asm__ __volatile__(APM_DO_ZERO_SEGS
9097 "pushl %%edi\n\t"
9098 "pushl %%ebp\n\t"
9099 - "lcall *%%cs:apm_bios_entry\n\t"
9100 + "lcall *%%ss:apm_bios_entry\n\t"
9101 "setc %%bl\n\t"
9102 "popl %%ebp\n\t"
9103 "popl %%edi\n\t"
9104 diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
9105 index 58cb6d4..a4b806c 100644
9106 --- a/arch/x86/include/asm/atomic.h
9107 +++ b/arch/x86/include/asm/atomic.h
9108 @@ -22,7 +22,18 @@
9109 */
9110 static inline int atomic_read(const atomic_t *v)
9111 {
9112 - return (*(volatile int *)&(v)->counter);
9113 + return (*(volatile const int *)&(v)->counter);
9114 +}
9115 +
9116 +/**
9117 + * atomic_read_unchecked - read atomic variable
9118 + * @v: pointer of type atomic_unchecked_t
9119 + *
9120 + * Atomically reads the value of @v.
9121 + */
9122 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
9123 +{
9124 + return (*(volatile const int *)&(v)->counter);
9125 }
9126
9127 /**
9128 @@ -38,6 +49,18 @@ static inline void atomic_set(atomic_t *v, int i)
9129 }
9130
9131 /**
9132 + * atomic_set_unchecked - set atomic variable
9133 + * @v: pointer of type atomic_unchecked_t
9134 + * @i: required value
9135 + *
9136 + * Atomically sets the value of @v to @i.
9137 + */
9138 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
9139 +{
9140 + v->counter = i;
9141 +}
9142 +
9143 +/**
9144 * atomic_add - add integer to atomic variable
9145 * @i: integer value to add
9146 * @v: pointer of type atomic_t
9147 @@ -46,7 +69,29 @@ static inline void atomic_set(atomic_t *v, int i)
9148 */
9149 static inline void atomic_add(int i, atomic_t *v)
9150 {
9151 - asm volatile(LOCK_PREFIX "addl %1,%0"
9152 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
9153 +
9154 +#ifdef CONFIG_PAX_REFCOUNT
9155 + "jno 0f\n"
9156 + LOCK_PREFIX "subl %1,%0\n"
9157 + "int $4\n0:\n"
9158 + _ASM_EXTABLE(0b, 0b)
9159 +#endif
9160 +
9161 + : "+m" (v->counter)
9162 + : "ir" (i));
9163 +}
9164 +
9165 +/**
9166 + * atomic_add_unchecked - add integer to atomic variable
9167 + * @i: integer value to add
9168 + * @v: pointer of type atomic_unchecked_t
9169 + *
9170 + * Atomically adds @i to @v.
9171 + */
9172 +static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
9173 +{
9174 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
9175 : "+m" (v->counter)
9176 : "ir" (i));
9177 }
9178 @@ -60,7 +105,29 @@ static inline void atomic_add(int i, atomic_t *v)
9179 */
9180 static inline void atomic_sub(int i, atomic_t *v)
9181 {
9182 - asm volatile(LOCK_PREFIX "subl %1,%0"
9183 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
9184 +
9185 +#ifdef CONFIG_PAX_REFCOUNT
9186 + "jno 0f\n"
9187 + LOCK_PREFIX "addl %1,%0\n"
9188 + "int $4\n0:\n"
9189 + _ASM_EXTABLE(0b, 0b)
9190 +#endif
9191 +
9192 + : "+m" (v->counter)
9193 + : "ir" (i));
9194 +}
9195 +
9196 +/**
9197 + * atomic_sub_unchecked - subtract integer from atomic variable
9198 + * @i: integer value to subtract
9199 + * @v: pointer of type atomic_unchecked_t
9200 + *
9201 + * Atomically subtracts @i from @v.
9202 + */
9203 +static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
9204 +{
9205 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
9206 : "+m" (v->counter)
9207 : "ir" (i));
9208 }
9209 @@ -78,7 +145,16 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
9210 {
9211 unsigned char c;
9212
9213 - asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
9214 + asm volatile(LOCK_PREFIX "subl %2,%0\n"
9215 +
9216 +#ifdef CONFIG_PAX_REFCOUNT
9217 + "jno 0f\n"
9218 + LOCK_PREFIX "addl %2,%0\n"
9219 + "int $4\n0:\n"
9220 + _ASM_EXTABLE(0b, 0b)
9221 +#endif
9222 +
9223 + "sete %1\n"
9224 : "+m" (v->counter), "=qm" (c)
9225 : "ir" (i) : "memory");
9226 return c;
9227 @@ -92,7 +168,27 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
9228 */
9229 static inline void atomic_inc(atomic_t *v)
9230 {
9231 - asm volatile(LOCK_PREFIX "incl %0"
9232 + asm volatile(LOCK_PREFIX "incl %0\n"
9233 +
9234 +#ifdef CONFIG_PAX_REFCOUNT
9235 + "jno 0f\n"
9236 + LOCK_PREFIX "decl %0\n"
9237 + "int $4\n0:\n"
9238 + _ASM_EXTABLE(0b, 0b)
9239 +#endif
9240 +
9241 + : "+m" (v->counter));
9242 +}
9243 +
9244 +/**
9245 + * atomic_inc_unchecked - increment atomic variable
9246 + * @v: pointer of type atomic_unchecked_t
9247 + *
9248 + * Atomically increments @v by 1.
9249 + */
9250 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
9251 +{
9252 + asm volatile(LOCK_PREFIX "incl %0\n"
9253 : "+m" (v->counter));
9254 }
9255
9256 @@ -104,7 +200,27 @@ static inline void atomic_inc(atomic_t *v)
9257 */
9258 static inline void atomic_dec(atomic_t *v)
9259 {
9260 - asm volatile(LOCK_PREFIX "decl %0"
9261 + asm volatile(LOCK_PREFIX "decl %0\n"
9262 +
9263 +#ifdef CONFIG_PAX_REFCOUNT
9264 + "jno 0f\n"
9265 + LOCK_PREFIX "incl %0\n"
9266 + "int $4\n0:\n"
9267 + _ASM_EXTABLE(0b, 0b)
9268 +#endif
9269 +
9270 + : "+m" (v->counter));
9271 +}
9272 +
9273 +/**
9274 + * atomic_dec_unchecked - decrement atomic variable
9275 + * @v: pointer of type atomic_unchecked_t
9276 + *
9277 + * Atomically decrements @v by 1.
9278 + */
9279 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
9280 +{
9281 + asm volatile(LOCK_PREFIX "decl %0\n"
9282 : "+m" (v->counter));
9283 }
9284
9285 @@ -120,7 +236,16 @@ static inline int atomic_dec_and_test(atomic_t *v)
9286 {
9287 unsigned char c;
9288
9289 - asm volatile(LOCK_PREFIX "decl %0; sete %1"
9290 + asm volatile(LOCK_PREFIX "decl %0\n"
9291 +
9292 +#ifdef CONFIG_PAX_REFCOUNT
9293 + "jno 0f\n"
9294 + LOCK_PREFIX "incl %0\n"
9295 + "int $4\n0:\n"
9296 + _ASM_EXTABLE(0b, 0b)
9297 +#endif
9298 +
9299 + "sete %1\n"
9300 : "+m" (v->counter), "=qm" (c)
9301 : : "memory");
9302 return c != 0;
9303 @@ -138,7 +263,35 @@ static inline int atomic_inc_and_test(atomic_t *v)
9304 {
9305 unsigned char c;
9306
9307 - asm volatile(LOCK_PREFIX "incl %0; sete %1"
9308 + asm volatile(LOCK_PREFIX "incl %0\n"
9309 +
9310 +#ifdef CONFIG_PAX_REFCOUNT
9311 + "jno 0f\n"
9312 + LOCK_PREFIX "decl %0\n"
9313 + "int $4\n0:\n"
9314 + _ASM_EXTABLE(0b, 0b)
9315 +#endif
9316 +
9317 + "sete %1\n"
9318 + : "+m" (v->counter), "=qm" (c)
9319 + : : "memory");
9320 + return c != 0;
9321 +}
9322 +
9323 +/**
9324 + * atomic_inc_and_test_unchecked - increment and test
9325 + * @v: pointer of type atomic_unchecked_t
9326 + *
9327 + * Atomically increments @v by 1
9328 + * and returns true if the result is zero, or false for all
9329 + * other cases.
9330 + */
9331 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
9332 +{
9333 + unsigned char c;
9334 +
9335 + asm volatile(LOCK_PREFIX "incl %0\n"
9336 + "sete %1\n"
9337 : "+m" (v->counter), "=qm" (c)
9338 : : "memory");
9339 return c != 0;
9340 @@ -157,7 +310,16 @@ static inline int atomic_add_negative(int i, atomic_t *v)
9341 {
9342 unsigned char c;
9343
9344 - asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
9345 + asm volatile(LOCK_PREFIX "addl %2,%0\n"
9346 +
9347 +#ifdef CONFIG_PAX_REFCOUNT
9348 + "jno 0f\n"
9349 + LOCK_PREFIX "subl %2,%0\n"
9350 + "int $4\n0:\n"
9351 + _ASM_EXTABLE(0b, 0b)
9352 +#endif
9353 +
9354 + "sets %1\n"
9355 : "+m" (v->counter), "=qm" (c)
9356 : "ir" (i) : "memory");
9357 return c;
9358 @@ -179,7 +341,7 @@ static inline int atomic_add_return(int i, atomic_t *v)
9359 goto no_xadd;
9360 #endif
9361 /* Modern 486+ processor */
9362 - return i + xadd(&v->counter, i);
9363 + return i + xadd_check_overflow(&v->counter, i);
9364
9365 #ifdef CONFIG_M386
9366 no_xadd: /* Legacy 386 processor */
9367 @@ -192,6 +354,34 @@ no_xadd: /* Legacy 386 processor */
9368 }
9369
9370 /**
9371 + * atomic_add_return_unchecked - add integer and return
9372 + * @i: integer value to add
9373 + * @v: pointer of type atomic_unchecked_t
9374 + *
9375 + * Atomically adds @i to @v and returns @i + @v
9376 + */
9377 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
9378 +{
9379 +#ifdef CONFIG_M386
9380 + int __i;
9381 + unsigned long flags;
9382 + if (unlikely(boot_cpu_data.x86 <= 3))
9383 + goto no_xadd;
9384 +#endif
9385 + /* Modern 486+ processor */
9386 + return i + xadd(&v->counter, i);
9387 +
9388 +#ifdef CONFIG_M386
9389 +no_xadd: /* Legacy 386 processor */
9390 + raw_local_irq_save(flags);
9391 + __i = atomic_read_unchecked(v);
9392 + atomic_set_unchecked(v, i + __i);
9393 + raw_local_irq_restore(flags);
9394 + return i + __i;
9395 +#endif
9396 +}
9397 +
9398 +/**
9399 * atomic_sub_return - subtract integer and return
9400 * @v: pointer of type atomic_t
9401 * @i: integer value to subtract
9402 @@ -204,6 +394,10 @@ static inline int atomic_sub_return(int i, atomic_t *v)
9403 }
9404
9405 #define atomic_inc_return(v) (atomic_add_return(1, v))
9406 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
9407 +{
9408 + return atomic_add_return_unchecked(1, v);
9409 +}
9410 #define atomic_dec_return(v) (atomic_sub_return(1, v))
9411
9412 static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
9413 @@ -211,11 +405,21 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
9414 return cmpxchg(&v->counter, old, new);
9415 }
9416
9417 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
9418 +{
9419 + return cmpxchg(&v->counter, old, new);
9420 +}
9421 +
9422 static inline int atomic_xchg(atomic_t *v, int new)
9423 {
9424 return xchg(&v->counter, new);
9425 }
9426
9427 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
9428 +{
9429 + return xchg(&v->counter, new);
9430 +}
9431 +
9432 /**
9433 * __atomic_add_unless - add unless the number is already a given value
9434 * @v: pointer of type atomic_t
9435 @@ -227,12 +431,25 @@ static inline int atomic_xchg(atomic_t *v, int new)
9436 */
9437 static inline int __atomic_add_unless(atomic_t *v, int a, int u)
9438 {
9439 - int c, old;
9440 + int c, old, new;
9441 c = atomic_read(v);
9442 for (;;) {
9443 - if (unlikely(c == (u)))
9444 + if (unlikely(c == u))
9445 break;
9446 - old = atomic_cmpxchg((v), c, c + (a));
9447 +
9448 + asm volatile("addl %2,%0\n"
9449 +
9450 +#ifdef CONFIG_PAX_REFCOUNT
9451 + "jno 0f\n"
9452 + "subl %2,%0\n"
9453 + "int $4\n0:\n"
9454 + _ASM_EXTABLE(0b, 0b)
9455 +#endif
9456 +
9457 + : "=r" (new)
9458 + : "0" (c), "ir" (a));
9459 +
9460 + old = atomic_cmpxchg(v, c, new);
9461 if (likely(old == c))
9462 break;
9463 c = old;
9464 @@ -240,6 +457,48 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
9465 return c;
9466 }
9467
9468 +/**
9469 + * atomic_inc_not_zero_hint - increment if not null
9470 + * @v: pointer of type atomic_t
9471 + * @hint: probable value of the atomic before the increment
9472 + *
9473 + * This version of atomic_inc_not_zero() gives a hint of probable
9474 + * value of the atomic. This helps processor to not read the memory
9475 + * before doing the atomic read/modify/write cycle, lowering
9476 + * number of bus transactions on some arches.
9477 + *
9478 + * Returns: 0 if increment was not done, 1 otherwise.
9479 + */
9480 +#define atomic_inc_not_zero_hint atomic_inc_not_zero_hint
9481 +static inline int atomic_inc_not_zero_hint(atomic_t *v, int hint)
9482 +{
9483 + int val, c = hint, new;
9484 +
9485 + /* sanity test, should be removed by compiler if hint is a constant */
9486 + if (!hint)
9487 + return __atomic_add_unless(v, 1, 0);
9488 +
9489 + do {
9490 + asm volatile("incl %0\n"
9491 +
9492 +#ifdef CONFIG_PAX_REFCOUNT
9493 + "jno 0f\n"
9494 + "decl %0\n"
9495 + "int $4\n0:\n"
9496 + _ASM_EXTABLE(0b, 0b)
9497 +#endif
9498 +
9499 + : "=r" (new)
9500 + : "0" (c));
9501 +
9502 + val = atomic_cmpxchg(v, c, new);
9503 + if (val == c)
9504 + return 1;
9505 + c = val;
9506 + } while (c);
9507 +
9508 + return 0;
9509 +}
9510
9511 /*
9512 * atomic_dec_if_positive - decrement by 1 if old value positive
9513 @@ -293,14 +552,37 @@ static inline void atomic_or_long(unsigned long *v1, unsigned long v2)
9514 #endif
9515
9516 /* These are x86-specific, used by some header files */
9517 -#define atomic_clear_mask(mask, addr) \
9518 - asm volatile(LOCK_PREFIX "andl %0,%1" \
9519 - : : "r" (~(mask)), "m" (*(addr)) : "memory")
9520 +static inline void atomic_clear_mask(unsigned int mask, atomic_t *v)
9521 +{
9522 + asm volatile(LOCK_PREFIX "andl %1,%0"
9523 + : "+m" (v->counter)
9524 + : "r" (~(mask))
9525 + : "memory");
9526 +}
9527
9528 -#define atomic_set_mask(mask, addr) \
9529 - asm volatile(LOCK_PREFIX "orl %0,%1" \
9530 - : : "r" ((unsigned)(mask)), "m" (*(addr)) \
9531 - : "memory")
9532 +static inline void atomic_clear_mask_unchecked(unsigned int mask, atomic_unchecked_t *v)
9533 +{
9534 + asm volatile(LOCK_PREFIX "andl %1,%0"
9535 + : "+m" (v->counter)
9536 + : "r" (~(mask))
9537 + : "memory");
9538 +}
9539 +
9540 +static inline void atomic_set_mask(unsigned int mask, atomic_t *v)
9541 +{
9542 + asm volatile(LOCK_PREFIX "orl %1,%0"
9543 + : "+m" (v->counter)
9544 + : "r" (mask)
9545 + : "memory");
9546 +}
9547 +
9548 +static inline void atomic_set_mask_unchecked(unsigned int mask, atomic_unchecked_t *v)
9549 +{
9550 + asm volatile(LOCK_PREFIX "orl %1,%0"
9551 + : "+m" (v->counter)
9552 + : "r" (mask)
9553 + : "memory");
9554 +}
9555
9556 /* Atomic operations are already serializing on x86 */
9557 #define smp_mb__before_atomic_dec() barrier()
9558 diff --git a/arch/x86/include/asm/atomic64_32.h b/arch/x86/include/asm/atomic64_32.h
9559 index b154de7..aadebd8 100644
9560 --- a/arch/x86/include/asm/atomic64_32.h
9561 +++ b/arch/x86/include/asm/atomic64_32.h
9562 @@ -12,6 +12,14 @@ typedef struct {
9563 u64 __aligned(8) counter;
9564 } atomic64_t;
9565
9566 +#ifdef CONFIG_PAX_REFCOUNT
9567 +typedef struct {
9568 + u64 __aligned(8) counter;
9569 +} atomic64_unchecked_t;
9570 +#else
9571 +typedef atomic64_t atomic64_unchecked_t;
9572 +#endif
9573 +
9574 #define ATOMIC64_INIT(val) { (val) }
9575
9576 #define __ATOMIC64_DECL(sym) void atomic64_##sym(atomic64_t *, ...)
9577 @@ -37,21 +45,31 @@ typedef struct {
9578 ATOMIC64_DECL_ONE(sym##_386)
9579
9580 ATOMIC64_DECL_ONE(add_386);
9581 +ATOMIC64_DECL_ONE(add_unchecked_386);
9582 ATOMIC64_DECL_ONE(sub_386);
9583 +ATOMIC64_DECL_ONE(sub_unchecked_386);
9584 ATOMIC64_DECL_ONE(inc_386);
9585 +ATOMIC64_DECL_ONE(inc_unchecked_386);
9586 ATOMIC64_DECL_ONE(dec_386);
9587 +ATOMIC64_DECL_ONE(dec_unchecked_386);
9588 #endif
9589
9590 #define alternative_atomic64(f, out, in...) \
9591 __alternative_atomic64(f, f, ASM_OUTPUT2(out), ## in)
9592
9593 ATOMIC64_DECL(read);
9594 +ATOMIC64_DECL(read_unchecked);
9595 ATOMIC64_DECL(set);
9596 +ATOMIC64_DECL(set_unchecked);
9597 ATOMIC64_DECL(xchg);
9598 ATOMIC64_DECL(add_return);
9599 +ATOMIC64_DECL(add_return_unchecked);
9600 ATOMIC64_DECL(sub_return);
9601 +ATOMIC64_DECL(sub_return_unchecked);
9602 ATOMIC64_DECL(inc_return);
9603 +ATOMIC64_DECL(inc_return_unchecked);
9604 ATOMIC64_DECL(dec_return);
9605 +ATOMIC64_DECL(dec_return_unchecked);
9606 ATOMIC64_DECL(dec_if_positive);
9607 ATOMIC64_DECL(inc_not_zero);
9608 ATOMIC64_DECL(add_unless);
9609 @@ -77,6 +95,21 @@ static inline long long atomic64_cmpxchg(atomic64_t *v, long long o, long long n
9610 }
9611
9612 /**
9613 + * atomic64_cmpxchg_unchecked - cmpxchg atomic64 variable
9614 + * @p: pointer to type atomic64_unchecked_t
9615 + * @o: expected value
9616 + * @n: new value
9617 + *
9618 + * Atomically sets @v to @n if it was equal to @o and returns
9619 + * the old value.
9620 + */
9621 +
9622 +static inline long long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long long o, long long n)
9623 +{
9624 + return cmpxchg64(&v->counter, o, n);
9625 +}
9626 +
9627 +/**
9628 * atomic64_xchg - xchg atomic64 variable
9629 * @v: pointer to type atomic64_t
9630 * @n: value to assign
9631 @@ -112,6 +145,22 @@ static inline void atomic64_set(atomic64_t *v, long long i)
9632 }
9633
9634 /**
9635 + * atomic64_set_unchecked - set atomic64 variable
9636 + * @v: pointer to type atomic64_unchecked_t
9637 + * @n: value to assign
9638 + *
9639 + * Atomically sets the value of @v to @n.
9640 + */
9641 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
9642 +{
9643 + unsigned high = (unsigned)(i >> 32);
9644 + unsigned low = (unsigned)i;
9645 + alternative_atomic64(set, /* no output */,
9646 + "S" (v), "b" (low), "c" (high)
9647 + : "eax", "edx", "memory");
9648 +}
9649 +
9650 +/**
9651 * atomic64_read - read atomic64 variable
9652 * @v: pointer to type atomic64_t
9653 *
9654 @@ -125,6 +174,19 @@ static inline long long atomic64_read(const atomic64_t *v)
9655 }
9656
9657 /**
9658 + * atomic64_read_unchecked - read atomic64 variable
9659 + * @v: pointer to type atomic64_unchecked_t
9660 + *
9661 + * Atomically reads the value of @v and returns it.
9662 + */
9663 +static inline long long atomic64_read_unchecked(atomic64_unchecked_t *v)
9664 +{
9665 + long long r;
9666 + alternative_atomic64(read, "=&A" (r), "c" (v) : "memory");
9667 + return r;
9668 + }
9669 +
9670 +/**
9671 * atomic64_add_return - add and return
9672 * @i: integer value to add
9673 * @v: pointer to type atomic64_t
9674 @@ -139,6 +201,21 @@ static inline long long atomic64_add_return(long long i, atomic64_t *v)
9675 return i;
9676 }
9677
9678 +/**
9679 + * atomic64_add_return_unchecked - add and return
9680 + * @i: integer value to add
9681 + * @v: pointer to type atomic64_unchecked_t
9682 + *
9683 + * Atomically adds @i to @v and returns @i + *@v
9684 + */
9685 +static inline long long atomic64_add_return_unchecked(long long i, atomic64_unchecked_t *v)
9686 +{
9687 + alternative_atomic64(add_return_unchecked,
9688 + ASM_OUTPUT2("+A" (i), "+c" (v)),
9689 + ASM_NO_INPUT_CLOBBER("memory"));
9690 + return i;
9691 +}
9692 +
9693 /*
9694 * Other variants with different arithmetic operators:
9695 */
9696 @@ -158,6 +235,14 @@ static inline long long atomic64_inc_return(atomic64_t *v)
9697 return a;
9698 }
9699
9700 +static inline long long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
9701 +{
9702 + long long a;
9703 + alternative_atomic64(inc_return_unchecked, "=&A" (a),
9704 + "S" (v) : "memory", "ecx");
9705 + return a;
9706 +}
9707 +
9708 static inline long long atomic64_dec_return(atomic64_t *v)
9709 {
9710 long long a;
9711 @@ -182,6 +267,21 @@ static inline long long atomic64_add(long long i, atomic64_t *v)
9712 }
9713
9714 /**
9715 + * atomic64_add_unchecked - add integer to atomic64 variable
9716 + * @i: integer value to add
9717 + * @v: pointer to type atomic64_unchecked_t
9718 + *
9719 + * Atomically adds @i to @v.
9720 + */
9721 +static inline long long atomic64_add_unchecked(long long i, atomic64_unchecked_t *v)
9722 +{
9723 + __alternative_atomic64(add_unchecked, add_return_unchecked,
9724 + ASM_OUTPUT2("+A" (i), "+c" (v)),
9725 + ASM_NO_INPUT_CLOBBER("memory"));
9726 + return i;
9727 +}
9728 +
9729 +/**
9730 * atomic64_sub - subtract the atomic64 variable
9731 * @i: integer value to subtract
9732 * @v: pointer to type atomic64_t
9733 diff --git a/arch/x86/include/asm/atomic64_64.h b/arch/x86/include/asm/atomic64_64.h
9734 index 0e1cbfc..5623683 100644
9735 --- a/arch/x86/include/asm/atomic64_64.h
9736 +++ b/arch/x86/include/asm/atomic64_64.h
9737 @@ -18,7 +18,19 @@
9738 */
9739 static inline long atomic64_read(const atomic64_t *v)
9740 {
9741 - return (*(volatile long *)&(v)->counter);
9742 + return (*(volatile const long *)&(v)->counter);
9743 +}
9744 +
9745 +/**
9746 + * atomic64_read_unchecked - read atomic64 variable
9747 + * @v: pointer of type atomic64_unchecked_t
9748 + *
9749 + * Atomically reads the value of @v.
9750 + * Doesn't imply a read memory barrier.
9751 + */
9752 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
9753 +{
9754 + return (*(volatile const long *)&(v)->counter);
9755 }
9756
9757 /**
9758 @@ -34,6 +46,18 @@ static inline void atomic64_set(atomic64_t *v, long i)
9759 }
9760
9761 /**
9762 + * atomic64_set_unchecked - set atomic64 variable
9763 + * @v: pointer to type atomic64_unchecked_t
9764 + * @i: required value
9765 + *
9766 + * Atomically sets the value of @v to @i.
9767 + */
9768 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
9769 +{
9770 + v->counter = i;
9771 +}
9772 +
9773 +/**
9774 * atomic64_add - add integer to atomic64 variable
9775 * @i: integer value to add
9776 * @v: pointer to type atomic64_t
9777 @@ -42,6 +66,28 @@ static inline void atomic64_set(atomic64_t *v, long i)
9778 */
9779 static inline void atomic64_add(long i, atomic64_t *v)
9780 {
9781 + asm volatile(LOCK_PREFIX "addq %1,%0\n"
9782 +
9783 +#ifdef CONFIG_PAX_REFCOUNT
9784 + "jno 0f\n"
9785 + LOCK_PREFIX "subq %1,%0\n"
9786 + "int $4\n0:\n"
9787 + _ASM_EXTABLE(0b, 0b)
9788 +#endif
9789 +
9790 + : "=m" (v->counter)
9791 + : "er" (i), "m" (v->counter));
9792 +}
9793 +
9794 +/**
9795 + * atomic64_add_unchecked - add integer to atomic64 variable
9796 + * @i: integer value to add
9797 + * @v: pointer to type atomic64_unchecked_t
9798 + *
9799 + * Atomically adds @i to @v.
9800 + */
9801 +static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
9802 +{
9803 asm volatile(LOCK_PREFIX "addq %1,%0"
9804 : "=m" (v->counter)
9805 : "er" (i), "m" (v->counter));
9806 @@ -56,7 +102,29 @@ static inline void atomic64_add(long i, atomic64_t *v)
9807 */
9808 static inline void atomic64_sub(long i, atomic64_t *v)
9809 {
9810 - asm volatile(LOCK_PREFIX "subq %1,%0"
9811 + asm volatile(LOCK_PREFIX "subq %1,%0\n"
9812 +
9813 +#ifdef CONFIG_PAX_REFCOUNT
9814 + "jno 0f\n"
9815 + LOCK_PREFIX "addq %1,%0\n"
9816 + "int $4\n0:\n"
9817 + _ASM_EXTABLE(0b, 0b)
9818 +#endif
9819 +
9820 + : "=m" (v->counter)
9821 + : "er" (i), "m" (v->counter));
9822 +}
9823 +
9824 +/**
9825 + * atomic64_sub_unchecked - subtract the atomic64 variable
9826 + * @i: integer value to subtract
9827 + * @v: pointer to type atomic64_unchecked_t
9828 + *
9829 + * Atomically subtracts @i from @v.
9830 + */
9831 +static inline void atomic64_sub_unchecked(long i, atomic64_unchecked_t *v)
9832 +{
9833 + asm volatile(LOCK_PREFIX "subq %1,%0\n"
9834 : "=m" (v->counter)
9835 : "er" (i), "m" (v->counter));
9836 }
9837 @@ -74,7 +142,16 @@ static inline int atomic64_sub_and_test(long i, atomic64_t *v)
9838 {
9839 unsigned char c;
9840
9841 - asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
9842 + asm volatile(LOCK_PREFIX "subq %2,%0\n"
9843 +
9844 +#ifdef CONFIG_PAX_REFCOUNT
9845 + "jno 0f\n"
9846 + LOCK_PREFIX "addq %2,%0\n"
9847 + "int $4\n0:\n"
9848 + _ASM_EXTABLE(0b, 0b)
9849 +#endif
9850 +
9851 + "sete %1\n"
9852 : "=m" (v->counter), "=qm" (c)
9853 : "er" (i), "m" (v->counter) : "memory");
9854 return c;
9855 @@ -88,6 +165,27 @@ static inline int atomic64_sub_and_test(long i, atomic64_t *v)
9856 */
9857 static inline void atomic64_inc(atomic64_t *v)
9858 {
9859 + asm volatile(LOCK_PREFIX "incq %0\n"
9860 +
9861 +#ifdef CONFIG_PAX_REFCOUNT
9862 + "jno 0f\n"
9863 + LOCK_PREFIX "decq %0\n"
9864 + "int $4\n0:\n"
9865 + _ASM_EXTABLE(0b, 0b)
9866 +#endif
9867 +
9868 + : "=m" (v->counter)
9869 + : "m" (v->counter));
9870 +}
9871 +
9872 +/**
9873 + * atomic64_inc_unchecked - increment atomic64 variable
9874 + * @v: pointer to type atomic64_unchecked_t
9875 + *
9876 + * Atomically increments @v by 1.
9877 + */
9878 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
9879 +{
9880 asm volatile(LOCK_PREFIX "incq %0"
9881 : "=m" (v->counter)
9882 : "m" (v->counter));
9883 @@ -101,7 +199,28 @@ static inline void atomic64_inc(atomic64_t *v)
9884 */
9885 static inline void atomic64_dec(atomic64_t *v)
9886 {
9887 - asm volatile(LOCK_PREFIX "decq %0"
9888 + asm volatile(LOCK_PREFIX "decq %0\n"
9889 +
9890 +#ifdef CONFIG_PAX_REFCOUNT
9891 + "jno 0f\n"
9892 + LOCK_PREFIX "incq %0\n"
9893 + "int $4\n0:\n"
9894 + _ASM_EXTABLE(0b, 0b)
9895 +#endif
9896 +
9897 + : "=m" (v->counter)
9898 + : "m" (v->counter));
9899 +}
9900 +
9901 +/**
9902 + * atomic64_dec_unchecked - decrement atomic64 variable
9903 + * @v: pointer to type atomic64_t
9904 + *
9905 + * Atomically decrements @v by 1.
9906 + */
9907 +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
9908 +{
9909 + asm volatile(LOCK_PREFIX "decq %0\n"
9910 : "=m" (v->counter)
9911 : "m" (v->counter));
9912 }
9913 @@ -118,7 +237,16 @@ static inline int atomic64_dec_and_test(atomic64_t *v)
9914 {
9915 unsigned char c;
9916
9917 - asm volatile(LOCK_PREFIX "decq %0; sete %1"
9918 + asm volatile(LOCK_PREFIX "decq %0\n"
9919 +
9920 +#ifdef CONFIG_PAX_REFCOUNT
9921 + "jno 0f\n"
9922 + LOCK_PREFIX "incq %0\n"
9923 + "int $4\n0:\n"
9924 + _ASM_EXTABLE(0b, 0b)
9925 +#endif
9926 +
9927 + "sete %1\n"
9928 : "=m" (v->counter), "=qm" (c)
9929 : "m" (v->counter) : "memory");
9930 return c != 0;
9931 @@ -136,7 +264,16 @@ static inline int atomic64_inc_and_test(atomic64_t *v)
9932 {
9933 unsigned char c;
9934
9935 - asm volatile(LOCK_PREFIX "incq %0; sete %1"
9936 + asm volatile(LOCK_PREFIX "incq %0\n"
9937 +
9938 +#ifdef CONFIG_PAX_REFCOUNT
9939 + "jno 0f\n"
9940 + LOCK_PREFIX "decq %0\n"
9941 + "int $4\n0:\n"
9942 + _ASM_EXTABLE(0b, 0b)
9943 +#endif
9944 +
9945 + "sete %1\n"
9946 : "=m" (v->counter), "=qm" (c)
9947 : "m" (v->counter) : "memory");
9948 return c != 0;
9949 @@ -155,7 +292,16 @@ static inline int atomic64_add_negative(long i, atomic64_t *v)
9950 {
9951 unsigned char c;
9952
9953 - asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
9954 + asm volatile(LOCK_PREFIX "addq %2,%0\n"
9955 +
9956 +#ifdef CONFIG_PAX_REFCOUNT
9957 + "jno 0f\n"
9958 + LOCK_PREFIX "subq %2,%0\n"
9959 + "int $4\n0:\n"
9960 + _ASM_EXTABLE(0b, 0b)
9961 +#endif
9962 +
9963 + "sets %1\n"
9964 : "=m" (v->counter), "=qm" (c)
9965 : "er" (i), "m" (v->counter) : "memory");
9966 return c;
9967 @@ -170,6 +316,18 @@ static inline int atomic64_add_negative(long i, atomic64_t *v)
9968 */
9969 static inline long atomic64_add_return(long i, atomic64_t *v)
9970 {
9971 + return i + xadd_check_overflow(&v->counter, i);
9972 +}
9973 +
9974 +/**
9975 + * atomic64_add_return_unchecked - add and return
9976 + * @i: integer value to add
9977 + * @v: pointer to type atomic64_unchecked_t
9978 + *
9979 + * Atomically adds @i to @v and returns @i + @v
9980 + */
9981 +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
9982 +{
9983 return i + xadd(&v->counter, i);
9984 }
9985
9986 @@ -179,6 +337,10 @@ static inline long atomic64_sub_return(long i, atomic64_t *v)
9987 }
9988
9989 #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
9990 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
9991 +{
9992 + return atomic64_add_return_unchecked(1, v);
9993 +}
9994 #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
9995
9996 static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
9997 @@ -186,6 +348,11 @@ static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
9998 return cmpxchg(&v->counter, old, new);
9999 }
10000
10001 +static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
10002 +{
10003 + return cmpxchg(&v->counter, old, new);
10004 +}
10005 +
10006 static inline long atomic64_xchg(atomic64_t *v, long new)
10007 {
10008 return xchg(&v->counter, new);
10009 @@ -202,17 +369,30 @@ static inline long atomic64_xchg(atomic64_t *v, long new)
10010 */
10011 static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
10012 {
10013 - long c, old;
10014 + long c, old, new;
10015 c = atomic64_read(v);
10016 for (;;) {
10017 - if (unlikely(c == (u)))
10018 + if (unlikely(c == u))
10019 break;
10020 - old = atomic64_cmpxchg((v), c, c + (a));
10021 +
10022 + asm volatile("add %2,%0\n"
10023 +
10024 +#ifdef CONFIG_PAX_REFCOUNT
10025 + "jno 0f\n"
10026 + "sub %2,%0\n"
10027 + "int $4\n0:\n"
10028 + _ASM_EXTABLE(0b, 0b)
10029 +#endif
10030 +
10031 + : "=r" (new)
10032 + : "0" (c), "ir" (a));
10033 +
10034 + old = atomic64_cmpxchg(v, c, new);
10035 if (likely(old == c))
10036 break;
10037 c = old;
10038 }
10039 - return c != (u);
10040 + return c != u;
10041 }
10042
10043 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
10044 diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
10045 index a6983b2..63f48a2 100644
10046 --- a/arch/x86/include/asm/bitops.h
10047 +++ b/arch/x86/include/asm/bitops.h
10048 @@ -40,7 +40,7 @@
10049 * a mask operation on a byte.
10050 */
10051 #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
10052 -#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
10053 +#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
10054 #define CONST_MASK(nr) (1 << ((nr) & 7))
10055
10056 /**
10057 diff --git a/arch/x86/include/asm/boot.h b/arch/x86/include/asm/boot.h
10058 index b13fe63..0dab13a 100644
10059 --- a/arch/x86/include/asm/boot.h
10060 +++ b/arch/x86/include/asm/boot.h
10061 @@ -11,10 +11,15 @@
10062 #include <asm/pgtable_types.h>
10063
10064 /* Physical address where kernel should be loaded. */
10065 -#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
10066 +#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
10067 + (CONFIG_PHYSICAL_ALIGN - 1)) \
10068 & ~(CONFIG_PHYSICAL_ALIGN - 1))
10069
10070 +#ifndef __ASSEMBLY__
10071 +extern unsigned char __LOAD_PHYSICAL_ADDR[];
10072 +#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
10073 +#endif
10074 +
10075 /* Minimum kernel alignment, as a power of two */
10076 #ifdef CONFIG_X86_64
10077 #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
10078 diff --git a/arch/x86/include/asm/cache.h b/arch/x86/include/asm/cache.h
10079 index 48f99f1..d78ebf9 100644
10080 --- a/arch/x86/include/asm/cache.h
10081 +++ b/arch/x86/include/asm/cache.h
10082 @@ -5,12 +5,13 @@
10083
10084 /* L1 cache line size */
10085 #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
10086 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
10087 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
10088
10089 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
10090 +#define __read_only __attribute__((__section__(".data..read_only")))
10091
10092 #define INTERNODE_CACHE_SHIFT CONFIG_X86_INTERNODE_CACHE_SHIFT
10093 -#define INTERNODE_CACHE_BYTES (1 << INTERNODE_CACHE_SHIFT)
10094 +#define INTERNODE_CACHE_BYTES (_AC(1,UL) << INTERNODE_CACHE_SHIFT)
10095
10096 #ifdef CONFIG_X86_VSMP
10097 #ifdef CONFIG_SMP
10098 diff --git a/arch/x86/include/asm/cacheflush.h b/arch/x86/include/asm/cacheflush.h
10099 index 9863ee3..4a1f8e1 100644
10100 --- a/arch/x86/include/asm/cacheflush.h
10101 +++ b/arch/x86/include/asm/cacheflush.h
10102 @@ -27,7 +27,7 @@ static inline unsigned long get_page_memtype(struct page *pg)
10103 unsigned long pg_flags = pg->flags & _PGMT_MASK;
10104
10105 if (pg_flags == _PGMT_DEFAULT)
10106 - return -1;
10107 + return ~0UL;
10108 else if (pg_flags == _PGMT_WC)
10109 return _PAGE_CACHE_WC;
10110 else if (pg_flags == _PGMT_UC_MINUS)
10111 diff --git a/arch/x86/include/asm/checksum_32.h b/arch/x86/include/asm/checksum_32.h
10112 index 46fc474..b02b0f9 100644
10113 --- a/arch/x86/include/asm/checksum_32.h
10114 +++ b/arch/x86/include/asm/checksum_32.h
10115 @@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_generic(const void *src, void *dst,
10116 int len, __wsum sum,
10117 int *src_err_ptr, int *dst_err_ptr);
10118
10119 +asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
10120 + int len, __wsum sum,
10121 + int *src_err_ptr, int *dst_err_ptr);
10122 +
10123 +asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
10124 + int len, __wsum sum,
10125 + int *src_err_ptr, int *dst_err_ptr);
10126 +
10127 /*
10128 * Note: when you get a NULL pointer exception here this means someone
10129 * passed in an incorrect kernel address to one of these functions.
10130 @@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_from_user(const void __user *src,
10131 int *err_ptr)
10132 {
10133 might_sleep();
10134 - return csum_partial_copy_generic((__force void *)src, dst,
10135 + return csum_partial_copy_generic_from_user((__force void *)src, dst,
10136 len, sum, err_ptr, NULL);
10137 }
10138
10139 @@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_user(const void *src,
10140 {
10141 might_sleep();
10142 if (access_ok(VERIFY_WRITE, dst, len))
10143 - return csum_partial_copy_generic(src, (__force void *)dst,
10144 + return csum_partial_copy_generic_to_user(src, (__force void *)dst,
10145 len, sum, NULL, err_ptr);
10146
10147 if (len)
10148 diff --git a/arch/x86/include/asm/cmpxchg.h b/arch/x86/include/asm/cmpxchg.h
10149 index 99480e5..d81165b 100644
10150 --- a/arch/x86/include/asm/cmpxchg.h
10151 +++ b/arch/x86/include/asm/cmpxchg.h
10152 @@ -14,8 +14,12 @@ extern void __cmpxchg_wrong_size(void)
10153 __compiletime_error("Bad argument size for cmpxchg");
10154 extern void __xadd_wrong_size(void)
10155 __compiletime_error("Bad argument size for xadd");
10156 +extern void __xadd_check_overflow_wrong_size(void)
10157 + __compiletime_error("Bad argument size for xadd_check_overflow");
10158 extern void __add_wrong_size(void)
10159 __compiletime_error("Bad argument size for add");
10160 +extern void __add_check_overflow_wrong_size(void)
10161 + __compiletime_error("Bad argument size for add_check_overflow");
10162
10163 /*
10164 * Constants for operation sizes. On 32-bit, the 64-bit size it set to
10165 @@ -67,6 +71,34 @@ extern void __add_wrong_size(void)
10166 __ret; \
10167 })
10168
10169 +#define __xchg_op_check_overflow(ptr, arg, op, lock) \
10170 + ({ \
10171 + __typeof__ (*(ptr)) __ret = (arg); \
10172 + switch (sizeof(*(ptr))) { \
10173 + case __X86_CASE_L: \
10174 + asm volatile (lock #op "l %0, %1\n" \
10175 + "jno 0f\n" \
10176 + "mov %0,%1\n" \
10177 + "int $4\n0:\n" \
10178 + _ASM_EXTABLE(0b, 0b) \
10179 + : "+r" (__ret), "+m" (*(ptr)) \
10180 + : : "memory", "cc"); \
10181 + break; \
10182 + case __X86_CASE_Q: \
10183 + asm volatile (lock #op "q %q0, %1\n" \
10184 + "jno 0f\n" \
10185 + "mov %0,%1\n" \
10186 + "int $4\n0:\n" \
10187 + _ASM_EXTABLE(0b, 0b) \
10188 + : "+r" (__ret), "+m" (*(ptr)) \
10189 + : : "memory", "cc"); \
10190 + break; \
10191 + default: \
10192 + __ ## op ## _check_overflow_wrong_size(); \
10193 + } \
10194 + __ret; \
10195 + })
10196 +
10197 /*
10198 * Note: no "lock" prefix even on SMP: xchg always implies lock anyway.
10199 * Since this is generally used to protect other memory information, we
10200 @@ -167,6 +199,9 @@ extern void __add_wrong_size(void)
10201 #define xadd_sync(ptr, inc) __xadd((ptr), (inc), "lock; ")
10202 #define xadd_local(ptr, inc) __xadd((ptr), (inc), "")
10203
10204 +#define __xadd_check_overflow(ptr, inc, lock) __xchg_op_check_overflow((ptr), (inc), xadd, lock)
10205 +#define xadd_check_overflow(ptr, inc) __xadd_check_overflow((ptr), (inc), LOCK_PREFIX)
10206 +
10207 #define __add(ptr, inc, lock) \
10208 ({ \
10209 __typeof__ (*(ptr)) __ret = (inc); \
10210 diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
10211 index f91e80f..7731066 100644
10212 --- a/arch/x86/include/asm/cpufeature.h
10213 +++ b/arch/x86/include/asm/cpufeature.h
10214 @@ -202,11 +202,12 @@
10215 #define X86_FEATURE_BMI1 (9*32+ 3) /* 1st group bit manipulation extensions */
10216 #define X86_FEATURE_HLE (9*32+ 4) /* Hardware Lock Elision */
10217 #define X86_FEATURE_AVX2 (9*32+ 5) /* AVX2 instructions */
10218 -#define X86_FEATURE_SMEP (9*32+ 7) /* Supervisor Mode Execution Protection */
10219 +#define X86_FEATURE_SMEP (9*32+ 7) /* Supervisor Mode Execution Prevention */
10220 #define X86_FEATURE_BMI2 (9*32+ 8) /* 2nd group bit manipulation extensions */
10221 #define X86_FEATURE_ERMS (9*32+ 9) /* Enhanced REP MOVSB/STOSB */
10222 #define X86_FEATURE_INVPCID (9*32+10) /* Invalidate Processor Context ID */
10223 #define X86_FEATURE_RTM (9*32+11) /* Restricted Transactional Memory */
10224 +#define X86_FEATURE_SMAP (9*32+20) /* Supervisor Mode Access Prevention */
10225
10226 #if defined(__KERNEL__) && !defined(__ASSEMBLY__)
10227
10228 @@ -371,7 +372,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
10229 ".section .discard,\"aw\",@progbits\n"
10230 " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
10231 ".previous\n"
10232 - ".section .altinstr_replacement,\"ax\"\n"
10233 + ".section .altinstr_replacement,\"a\"\n"
10234 "3: movb $1,%0\n"
10235 "4:\n"
10236 ".previous\n"
10237 diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
10238 index 8bf1c06..f723dfd 100644
10239 --- a/arch/x86/include/asm/desc.h
10240 +++ b/arch/x86/include/asm/desc.h
10241 @@ -4,6 +4,7 @@
10242 #include <asm/desc_defs.h>
10243 #include <asm/ldt.h>
10244 #include <asm/mmu.h>
10245 +#include <asm/pgtable.h>
10246
10247 #include <linux/smp.h>
10248 #include <linux/percpu.h>
10249 @@ -17,6 +18,7 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in
10250
10251 desc->type = (info->read_exec_only ^ 1) << 1;
10252 desc->type |= info->contents << 2;
10253 + desc->type |= info->seg_not_present ^ 1;
10254
10255 desc->s = 1;
10256 desc->dpl = 0x3;
10257 @@ -35,19 +37,14 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in
10258 }
10259
10260 extern struct desc_ptr idt_descr;
10261 -extern gate_desc idt_table[];
10262 extern struct desc_ptr nmi_idt_descr;
10263 -extern gate_desc nmi_idt_table[];
10264 -
10265 -struct gdt_page {
10266 - struct desc_struct gdt[GDT_ENTRIES];
10267 -} __attribute__((aligned(PAGE_SIZE)));
10268 -
10269 -DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
10270 +extern gate_desc idt_table[256];
10271 +extern gate_desc nmi_idt_table[256];
10272
10273 +extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
10274 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
10275 {
10276 - return per_cpu(gdt_page, cpu).gdt;
10277 + return cpu_gdt_table[cpu];
10278 }
10279
10280 #ifdef CONFIG_X86_64
10281 @@ -72,8 +69,14 @@ static inline void pack_gate(gate_desc *gate, unsigned char type,
10282 unsigned long base, unsigned dpl, unsigned flags,
10283 unsigned short seg)
10284 {
10285 - gate->a = (seg << 16) | (base & 0xffff);
10286 - gate->b = (base & 0xffff0000) | (((0x80 | type | (dpl << 5)) & 0xff) << 8);
10287 + gate->gate.offset_low = base;
10288 + gate->gate.seg = seg;
10289 + gate->gate.reserved = 0;
10290 + gate->gate.type = type;
10291 + gate->gate.s = 0;
10292 + gate->gate.dpl = dpl;
10293 + gate->gate.p = 1;
10294 + gate->gate.offset_high = base >> 16;
10295 }
10296
10297 #endif
10298 @@ -118,12 +121,16 @@ static inline void paravirt_free_ldt(struct desc_struct *ldt, unsigned entries)
10299
10300 static inline void native_write_idt_entry(gate_desc *idt, int entry, const gate_desc *gate)
10301 {
10302 + pax_open_kernel();
10303 memcpy(&idt[entry], gate, sizeof(*gate));
10304 + pax_close_kernel();
10305 }
10306
10307 static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry, const void *desc)
10308 {
10309 + pax_open_kernel();
10310 memcpy(&ldt[entry], desc, 8);
10311 + pax_close_kernel();
10312 }
10313
10314 static inline void
10315 @@ -137,7 +144,9 @@ native_write_gdt_entry(struct desc_struct *gdt, int entry, const void *desc, int
10316 default: size = sizeof(*gdt); break;
10317 }
10318
10319 + pax_open_kernel();
10320 memcpy(&gdt[entry], desc, size);
10321 + pax_close_kernel();
10322 }
10323
10324 static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
10325 @@ -210,7 +219,9 @@ static inline void native_set_ldt(const void *addr, unsigned int entries)
10326
10327 static inline void native_load_tr_desc(void)
10328 {
10329 + pax_open_kernel();
10330 asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
10331 + pax_close_kernel();
10332 }
10333
10334 static inline void native_load_gdt(const struct desc_ptr *dtr)
10335 @@ -247,8 +258,10 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
10336 struct desc_struct *gdt = get_cpu_gdt_table(cpu);
10337 unsigned int i;
10338
10339 + pax_open_kernel();
10340 for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
10341 gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
10342 + pax_close_kernel();
10343 }
10344
10345 #define _LDT_empty(info) \
10346 @@ -311,7 +324,7 @@ static inline void set_desc_limit(struct desc_struct *desc, unsigned long limit)
10347 }
10348
10349 #ifdef CONFIG_X86_64
10350 -static inline void set_nmi_gate(int gate, void *addr)
10351 +static inline void set_nmi_gate(int gate, const void *addr)
10352 {
10353 gate_desc s;
10354
10355 @@ -320,7 +333,7 @@ static inline void set_nmi_gate(int gate, void *addr)
10356 }
10357 #endif
10358
10359 -static inline void _set_gate(int gate, unsigned type, void *addr,
10360 +static inline void _set_gate(int gate, unsigned type, const void *addr,
10361 unsigned dpl, unsigned ist, unsigned seg)
10362 {
10363 gate_desc s;
10364 @@ -339,7 +352,7 @@ static inline void _set_gate(int gate, unsigned type, void *addr,
10365 * Pentium F0 0F bugfix can have resulted in the mapped
10366 * IDT being write-protected.
10367 */
10368 -static inline void set_intr_gate(unsigned int n, void *addr)
10369 +static inline void set_intr_gate(unsigned int n, const void *addr)
10370 {
10371 BUG_ON((unsigned)n > 0xFF);
10372 _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
10373 @@ -369,19 +382,19 @@ static inline void alloc_intr_gate(unsigned int n, void *addr)
10374 /*
10375 * This routine sets up an interrupt gate at directory privilege level 3.
10376 */
10377 -static inline void set_system_intr_gate(unsigned int n, void *addr)
10378 +static inline void set_system_intr_gate(unsigned int n, const void *addr)
10379 {
10380 BUG_ON((unsigned)n > 0xFF);
10381 _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
10382 }
10383
10384 -static inline void set_system_trap_gate(unsigned int n, void *addr)
10385 +static inline void set_system_trap_gate(unsigned int n, const void *addr)
10386 {
10387 BUG_ON((unsigned)n > 0xFF);
10388 _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
10389 }
10390
10391 -static inline void set_trap_gate(unsigned int n, void *addr)
10392 +static inline void set_trap_gate(unsigned int n, const void *addr)
10393 {
10394 BUG_ON((unsigned)n > 0xFF);
10395 _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
10396 @@ -390,19 +403,31 @@ static inline void set_trap_gate(unsigned int n, void *addr)
10397 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
10398 {
10399 BUG_ON((unsigned)n > 0xFF);
10400 - _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
10401 + _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
10402 }
10403
10404 -static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
10405 +static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
10406 {
10407 BUG_ON((unsigned)n > 0xFF);
10408 _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
10409 }
10410
10411 -static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
10412 +static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
10413 {
10414 BUG_ON((unsigned)n > 0xFF);
10415 _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
10416 }
10417
10418 +#ifdef CONFIG_X86_32
10419 +static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
10420 +{
10421 + struct desc_struct d;
10422 +
10423 + if (likely(limit))
10424 + limit = (limit - 1UL) >> PAGE_SHIFT;
10425 + pack_descriptor(&d, base, limit, 0xFB, 0xC);
10426 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
10427 +}
10428 +#endif
10429 +
10430 #endif /* _ASM_X86_DESC_H */
10431 diff --git a/arch/x86/include/asm/desc_defs.h b/arch/x86/include/asm/desc_defs.h
10432 index 278441f..b95a174 100644
10433 --- a/arch/x86/include/asm/desc_defs.h
10434 +++ b/arch/x86/include/asm/desc_defs.h
10435 @@ -31,6 +31,12 @@ struct desc_struct {
10436 unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
10437 unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
10438 };
10439 + struct {
10440 + u16 offset_low;
10441 + u16 seg;
10442 + unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
10443 + unsigned offset_high: 16;
10444 + } gate;
10445 };
10446 } __attribute__((packed));
10447
10448 diff --git a/arch/x86/include/asm/e820.h b/arch/x86/include/asm/e820.h
10449 index 3778256..c5d4fce 100644
10450 --- a/arch/x86/include/asm/e820.h
10451 +++ b/arch/x86/include/asm/e820.h
10452 @@ -69,7 +69,7 @@ struct e820map {
10453 #define ISA_START_ADDRESS 0xa0000
10454 #define ISA_END_ADDRESS 0x100000
10455
10456 -#define BIOS_BEGIN 0x000a0000
10457 +#define BIOS_BEGIN 0x000c0000
10458 #define BIOS_END 0x00100000
10459
10460 #define BIOS_ROM_BASE 0xffe00000
10461 diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
10462 index 5939f44..f8845f6 100644
10463 --- a/arch/x86/include/asm/elf.h
10464 +++ b/arch/x86/include/asm/elf.h
10465 @@ -243,7 +243,25 @@ extern int force_personality32;
10466 the loader. We need to make sure that it is out of the way of the program
10467 that it will "exec", and that there is sufficient room for the brk. */
10468
10469 +#ifdef CONFIG_PAX_SEGMEXEC
10470 +#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
10471 +#else
10472 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
10473 +#endif
10474 +
10475 +#ifdef CONFIG_PAX_ASLR
10476 +#ifdef CONFIG_X86_32
10477 +#define PAX_ELF_ET_DYN_BASE 0x10000000UL
10478 +
10479 +#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
10480 +#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
10481 +#else
10482 +#define PAX_ELF_ET_DYN_BASE 0x400000UL
10483 +
10484 +#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_ADDR32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
10485 +#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_ADDR32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
10486 +#endif
10487 +#endif
10488
10489 /* This yields a mask that user programs can use to figure out what
10490 instruction set this CPU supports. This could be done in user space,
10491 @@ -296,16 +314,12 @@ do { \
10492
10493 #define ARCH_DLINFO \
10494 do { \
10495 - if (vdso_enabled) \
10496 - NEW_AUX_ENT(AT_SYSINFO_EHDR, \
10497 - (unsigned long)current->mm->context.vdso); \
10498 + NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso); \
10499 } while (0)
10500
10501 #define ARCH_DLINFO_X32 \
10502 do { \
10503 - if (vdso_enabled) \
10504 - NEW_AUX_ENT(AT_SYSINFO_EHDR, \
10505 - (unsigned long)current->mm->context.vdso); \
10506 + NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso); \
10507 } while (0)
10508
10509 #define AT_SYSINFO 32
10510 @@ -320,7 +334,7 @@ else \
10511
10512 #endif /* !CONFIG_X86_32 */
10513
10514 -#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
10515 +#define VDSO_CURRENT_BASE (current->mm->context.vdso)
10516
10517 #define VDSO_ENTRY \
10518 ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
10519 @@ -336,9 +350,6 @@ extern int x32_setup_additional_pages(struct linux_binprm *bprm,
10520 extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
10521 #define compat_arch_setup_additional_pages syscall32_setup_pages
10522
10523 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
10524 -#define arch_randomize_brk arch_randomize_brk
10525 -
10526 /*
10527 * True on X86_32 or when emulating IA32 on X86_64
10528 */
10529 diff --git a/arch/x86/include/asm/emergency-restart.h b/arch/x86/include/asm/emergency-restart.h
10530 index cc70c1c..d96d011 100644
10531 --- a/arch/x86/include/asm/emergency-restart.h
10532 +++ b/arch/x86/include/asm/emergency-restart.h
10533 @@ -15,6 +15,6 @@ enum reboot_type {
10534
10535 extern enum reboot_type reboot_type;
10536
10537 -extern void machine_emergency_restart(void);
10538 +extern void machine_emergency_restart(void) __noreturn;
10539
10540 #endif /* _ASM_X86_EMERGENCY_RESTART_H */
10541 diff --git a/arch/x86/include/asm/fpu-internal.h b/arch/x86/include/asm/fpu-internal.h
10542 index 75f4c6d..ee3eb8f 100644
10543 --- a/arch/x86/include/asm/fpu-internal.h
10544 +++ b/arch/x86/include/asm/fpu-internal.h
10545 @@ -86,6 +86,11 @@ static inline int fxrstor_checking(struct i387_fxsave_struct *fx)
10546 {
10547 int err;
10548
10549 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10550 + if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
10551 + fx = (struct i387_fxsave_struct __user *)((void *)fx + PAX_USER_SHADOW_BASE);
10552 +#endif
10553 +
10554 /* See comment in fxsave() below. */
10555 #ifdef CONFIG_AS_FXSAVEQ
10556 asm volatile("1: fxrstorq %[fx]\n\t"
10557 @@ -115,6 +120,11 @@ static inline int fxsave_user(struct i387_fxsave_struct __user *fx)
10558 {
10559 int err;
10560
10561 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10562 + if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
10563 + fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
10564 +#endif
10565 +
10566 /*
10567 * Clear the bytes not touched by the fxsave and reserved
10568 * for the SW usage.
10569 @@ -271,7 +281,7 @@ static inline int restore_fpu_checking(struct task_struct *tsk)
10570 "emms\n\t" /* clear stack tags */
10571 "fildl %P[addr]", /* set F?P to defined value */
10572 X86_FEATURE_FXSAVE_LEAK,
10573 - [addr] "m" (tsk->thread.fpu.has_fpu));
10574 + [addr] "m" (init_tss[smp_processor_id()].x86_tss.sp0));
10575
10576 return fpu_restore_checking(&tsk->thread.fpu);
10577 }
10578 diff --git a/arch/x86/include/asm/futex.h b/arch/x86/include/asm/futex.h
10579 index 71ecbcb..bac10b7 100644
10580 --- a/arch/x86/include/asm/futex.h
10581 +++ b/arch/x86/include/asm/futex.h
10582 @@ -11,16 +11,18 @@
10583 #include <asm/processor.h>
10584
10585 #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
10586 + typecheck(u32 __user *, uaddr); \
10587 asm volatile("1:\t" insn "\n" \
10588 "2:\t.section .fixup,\"ax\"\n" \
10589 "3:\tmov\t%3, %1\n" \
10590 "\tjmp\t2b\n" \
10591 "\t.previous\n" \
10592 _ASM_EXTABLE(1b, 3b) \
10593 - : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
10594 + : "=r" (oldval), "=r" (ret), "+m" (*(u32 __user *)____m(uaddr))\
10595 : "i" (-EFAULT), "0" (oparg), "1" (0))
10596
10597 #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
10598 + typecheck(u32 __user *, uaddr); \
10599 asm volatile("1:\tmovl %2, %0\n" \
10600 "\tmovl\t%0, %3\n" \
10601 "\t" insn "\n" \
10602 @@ -33,7 +35,7 @@
10603 _ASM_EXTABLE(1b, 4b) \
10604 _ASM_EXTABLE(2b, 4b) \
10605 : "=&a" (oldval), "=&r" (ret), \
10606 - "+m" (*uaddr), "=&r" (tem) \
10607 + "+m" (*(u32 __user *)____m(uaddr)), "=&r" (tem) \
10608 : "r" (oparg), "i" (-EFAULT), "1" (0))
10609
10610 static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
10611 @@ -60,10 +62,10 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
10612
10613 switch (op) {
10614 case FUTEX_OP_SET:
10615 - __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
10616 + __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
10617 break;
10618 case FUTEX_OP_ADD:
10619 - __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
10620 + __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
10621 uaddr, oparg);
10622 break;
10623 case FUTEX_OP_OR:
10624 @@ -122,13 +124,13 @@ static inline int futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
10625 if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
10626 return -EFAULT;
10627
10628 - asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %4, %2\n"
10629 + asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %4, %2\n"
10630 "2:\t.section .fixup, \"ax\"\n"
10631 "3:\tmov %3, %0\n"
10632 "\tjmp 2b\n"
10633 "\t.previous\n"
10634 _ASM_EXTABLE(1b, 3b)
10635 - : "+r" (ret), "=a" (oldval), "+m" (*uaddr)
10636 + : "+r" (ret), "=a" (oldval), "+m" (*(u32 __user *)____m(uaddr))
10637 : "i" (-EFAULT), "r" (newval), "1" (oldval)
10638 : "memory"
10639 );
10640 diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
10641 index eb92a6e..b98b2f4 100644
10642 --- a/arch/x86/include/asm/hw_irq.h
10643 +++ b/arch/x86/include/asm/hw_irq.h
10644 @@ -136,8 +136,8 @@ extern void setup_ioapic_dest(void);
10645 extern void enable_IO_APIC(void);
10646
10647 /* Statistics */
10648 -extern atomic_t irq_err_count;
10649 -extern atomic_t irq_mis_count;
10650 +extern atomic_unchecked_t irq_err_count;
10651 +extern atomic_unchecked_t irq_mis_count;
10652
10653 /* EISA */
10654 extern void eisa_set_level_irq(unsigned int irq);
10655 diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
10656 index d8e8eef..99f81ae 100644
10657 --- a/arch/x86/include/asm/io.h
10658 +++ b/arch/x86/include/asm/io.h
10659 @@ -194,6 +194,17 @@ extern void set_iounmap_nonlazy(void);
10660
10661 #include <linux/vmalloc.h>
10662
10663 +#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
10664 +static inline int valid_phys_addr_range(unsigned long addr, size_t count)
10665 +{
10666 + return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
10667 +}
10668 +
10669 +static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
10670 +{
10671 + return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
10672 +}
10673 +
10674 /*
10675 * Convert a virtual cached pointer to an uncached pointer
10676 */
10677 diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
10678 index bba3cf8..06bc8da 100644
10679 --- a/arch/x86/include/asm/irqflags.h
10680 +++ b/arch/x86/include/asm/irqflags.h
10681 @@ -141,6 +141,11 @@ static inline notrace unsigned long arch_local_irq_save(void)
10682 sti; \
10683 sysexit
10684
10685 +#define GET_CR0_INTO_RDI mov %cr0, %rdi
10686 +#define SET_RDI_INTO_CR0 mov %rdi, %cr0
10687 +#define GET_CR3_INTO_RDI mov %cr3, %rdi
10688 +#define SET_RDI_INTO_CR3 mov %rdi, %cr3
10689 +
10690 #else
10691 #define INTERRUPT_RETURN iret
10692 #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
10693 diff --git a/arch/x86/include/asm/kprobes.h b/arch/x86/include/asm/kprobes.h
10694 index 5478825..839e88c 100644
10695 --- a/arch/x86/include/asm/kprobes.h
10696 +++ b/arch/x86/include/asm/kprobes.h
10697 @@ -37,13 +37,8 @@ typedef u8 kprobe_opcode_t;
10698 #define RELATIVEJUMP_SIZE 5
10699 #define RELATIVECALL_OPCODE 0xe8
10700 #define RELATIVE_ADDR_SIZE 4
10701 -#define MAX_STACK_SIZE 64
10702 -#define MIN_STACK_SIZE(ADDR) \
10703 - (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
10704 - THREAD_SIZE - (unsigned long)(ADDR))) \
10705 - ? (MAX_STACK_SIZE) \
10706 - : (((unsigned long)current_thread_info()) + \
10707 - THREAD_SIZE - (unsigned long)(ADDR)))
10708 +#define MAX_STACK_SIZE 64UL
10709 +#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
10710
10711 #define flush_insn_slot(p) do { } while (0)
10712
10713 diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
10714 index db7c1f2..92f130a 100644
10715 --- a/arch/x86/include/asm/kvm_host.h
10716 +++ b/arch/x86/include/asm/kvm_host.h
10717 @@ -680,7 +680,7 @@ struct kvm_x86_ops {
10718 int (*check_intercept)(struct kvm_vcpu *vcpu,
10719 struct x86_instruction_info *info,
10720 enum x86_intercept_stage stage);
10721 -};
10722 +} __do_const;
10723
10724 struct kvm_arch_async_pf {
10725 u32 token;
10726 diff --git a/arch/x86/include/asm/local.h b/arch/x86/include/asm/local.h
10727 index c8bed0d..e5721fa 100644
10728 --- a/arch/x86/include/asm/local.h
10729 +++ b/arch/x86/include/asm/local.h
10730 @@ -17,26 +17,58 @@ typedef struct {
10731
10732 static inline void local_inc(local_t *l)
10733 {
10734 - asm volatile(_ASM_INC "%0"
10735 + asm volatile(_ASM_INC "%0\n"
10736 +
10737 +#ifdef CONFIG_PAX_REFCOUNT
10738 + "jno 0f\n"
10739 + _ASM_DEC "%0\n"
10740 + "int $4\n0:\n"
10741 + _ASM_EXTABLE(0b, 0b)
10742 +#endif
10743 +
10744 : "+m" (l->a.counter));
10745 }
10746
10747 static inline void local_dec(local_t *l)
10748 {
10749 - asm volatile(_ASM_DEC "%0"
10750 + asm volatile(_ASM_DEC "%0\n"
10751 +
10752 +#ifdef CONFIG_PAX_REFCOUNT
10753 + "jno 0f\n"
10754 + _ASM_INC "%0\n"
10755 + "int $4\n0:\n"
10756 + _ASM_EXTABLE(0b, 0b)
10757 +#endif
10758 +
10759 : "+m" (l->a.counter));
10760 }
10761
10762 static inline void local_add(long i, local_t *l)
10763 {
10764 - asm volatile(_ASM_ADD "%1,%0"
10765 + asm volatile(_ASM_ADD "%1,%0\n"
10766 +
10767 +#ifdef CONFIG_PAX_REFCOUNT
10768 + "jno 0f\n"
10769 + _ASM_SUB "%1,%0\n"
10770 + "int $4\n0:\n"
10771 + _ASM_EXTABLE(0b, 0b)
10772 +#endif
10773 +
10774 : "+m" (l->a.counter)
10775 : "ir" (i));
10776 }
10777
10778 static inline void local_sub(long i, local_t *l)
10779 {
10780 - asm volatile(_ASM_SUB "%1,%0"
10781 + asm volatile(_ASM_SUB "%1,%0\n"
10782 +
10783 +#ifdef CONFIG_PAX_REFCOUNT
10784 + "jno 0f\n"
10785 + _ASM_ADD "%1,%0\n"
10786 + "int $4\n0:\n"
10787 + _ASM_EXTABLE(0b, 0b)
10788 +#endif
10789 +
10790 : "+m" (l->a.counter)
10791 : "ir" (i));
10792 }
10793 @@ -54,7 +86,16 @@ static inline int local_sub_and_test(long i, local_t *l)
10794 {
10795 unsigned char c;
10796
10797 - asm volatile(_ASM_SUB "%2,%0; sete %1"
10798 + asm volatile(_ASM_SUB "%2,%0\n"
10799 +
10800 +#ifdef CONFIG_PAX_REFCOUNT
10801 + "jno 0f\n"
10802 + _ASM_ADD "%2,%0\n"
10803 + "int $4\n0:\n"
10804 + _ASM_EXTABLE(0b, 0b)
10805 +#endif
10806 +
10807 + "sete %1\n"
10808 : "+m" (l->a.counter), "=qm" (c)
10809 : "ir" (i) : "memory");
10810 return c;
10811 @@ -72,7 +113,16 @@ static inline int local_dec_and_test(local_t *l)
10812 {
10813 unsigned char c;
10814
10815 - asm volatile(_ASM_DEC "%0; sete %1"
10816 + asm volatile(_ASM_DEC "%0\n"
10817 +
10818 +#ifdef CONFIG_PAX_REFCOUNT
10819 + "jno 0f\n"
10820 + _ASM_INC "%0\n"
10821 + "int $4\n0:\n"
10822 + _ASM_EXTABLE(0b, 0b)
10823 +#endif
10824 +
10825 + "sete %1\n"
10826 : "+m" (l->a.counter), "=qm" (c)
10827 : : "memory");
10828 return c != 0;
10829 @@ -90,7 +140,16 @@ static inline int local_inc_and_test(local_t *l)
10830 {
10831 unsigned char c;
10832
10833 - asm volatile(_ASM_INC "%0; sete %1"
10834 + asm volatile(_ASM_INC "%0\n"
10835 +
10836 +#ifdef CONFIG_PAX_REFCOUNT
10837 + "jno 0f\n"
10838 + _ASM_DEC "%0\n"
10839 + "int $4\n0:\n"
10840 + _ASM_EXTABLE(0b, 0b)
10841 +#endif
10842 +
10843 + "sete %1\n"
10844 : "+m" (l->a.counter), "=qm" (c)
10845 : : "memory");
10846 return c != 0;
10847 @@ -109,7 +168,16 @@ static inline int local_add_negative(long i, local_t *l)
10848 {
10849 unsigned char c;
10850
10851 - asm volatile(_ASM_ADD "%2,%0; sets %1"
10852 + asm volatile(_ASM_ADD "%2,%0\n"
10853 +
10854 +#ifdef CONFIG_PAX_REFCOUNT
10855 + "jno 0f\n"
10856 + _ASM_SUB "%2,%0\n"
10857 + "int $4\n0:\n"
10858 + _ASM_EXTABLE(0b, 0b)
10859 +#endif
10860 +
10861 + "sets %1\n"
10862 : "+m" (l->a.counter), "=qm" (c)
10863 : "ir" (i) : "memory");
10864 return c;
10865 @@ -132,7 +200,15 @@ static inline long local_add_return(long i, local_t *l)
10866 #endif
10867 /* Modern 486+ processor */
10868 __i = i;
10869 - asm volatile(_ASM_XADD "%0, %1;"
10870 + asm volatile(_ASM_XADD "%0, %1\n"
10871 +
10872 +#ifdef CONFIG_PAX_REFCOUNT
10873 + "jno 0f\n"
10874 + _ASM_MOV "%0,%1\n"
10875 + "int $4\n0:\n"
10876 + _ASM_EXTABLE(0b, 0b)
10877 +#endif
10878 +
10879 : "+r" (i), "+m" (l->a.counter)
10880 : : "memory");
10881 return i + __i;
10882 diff --git a/arch/x86/include/asm/mman.h b/arch/x86/include/asm/mman.h
10883 index 593e51d..fa69c9a 100644
10884 --- a/arch/x86/include/asm/mman.h
10885 +++ b/arch/x86/include/asm/mman.h
10886 @@ -5,4 +5,14 @@
10887
10888 #include <asm-generic/mman.h>
10889
10890 +#ifdef __KERNEL__
10891 +#ifndef __ASSEMBLY__
10892 +#ifdef CONFIG_X86_32
10893 +#define arch_mmap_check i386_mmap_check
10894 +int i386_mmap_check(unsigned long addr, unsigned long len,
10895 + unsigned long flags);
10896 +#endif
10897 +#endif
10898 +#endif
10899 +
10900 #endif /* _ASM_X86_MMAN_H */
10901 diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h
10902 index 5f55e69..e20bfb1 100644
10903 --- a/arch/x86/include/asm/mmu.h
10904 +++ b/arch/x86/include/asm/mmu.h
10905 @@ -9,7 +9,7 @@
10906 * we put the segment information here.
10907 */
10908 typedef struct {
10909 - void *ldt;
10910 + struct desc_struct *ldt;
10911 int size;
10912
10913 #ifdef CONFIG_X86_64
10914 @@ -18,7 +18,19 @@ typedef struct {
10915 #endif
10916
10917 struct mutex lock;
10918 - void *vdso;
10919 + unsigned long vdso;
10920 +
10921 +#ifdef CONFIG_X86_32
10922 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
10923 + unsigned long user_cs_base;
10924 + unsigned long user_cs_limit;
10925 +
10926 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
10927 + cpumask_t cpu_user_cs_mask;
10928 +#endif
10929 +
10930 +#endif
10931 +#endif
10932 } mm_context_t;
10933
10934 #ifdef CONFIG_SMP
10935 diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
10936 index cdbf367..adb37ac 100644
10937 --- a/arch/x86/include/asm/mmu_context.h
10938 +++ b/arch/x86/include/asm/mmu_context.h
10939 @@ -24,6 +24,18 @@ void destroy_context(struct mm_struct *mm);
10940
10941 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
10942 {
10943 +
10944 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10945 + unsigned int i;
10946 + pgd_t *pgd;
10947 +
10948 + pax_open_kernel();
10949 + pgd = get_cpu_pgd(smp_processor_id());
10950 + for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
10951 + set_pgd_batched(pgd+i, native_make_pgd(0));
10952 + pax_close_kernel();
10953 +#endif
10954 +
10955 #ifdef CONFIG_SMP
10956 if (this_cpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
10957 this_cpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
10958 @@ -34,16 +46,30 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
10959 struct task_struct *tsk)
10960 {
10961 unsigned cpu = smp_processor_id();
10962 +#if defined(CONFIG_X86_32) && defined(CONFIG_SMP) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
10963 + int tlbstate = TLBSTATE_OK;
10964 +#endif
10965
10966 if (likely(prev != next)) {
10967 #ifdef CONFIG_SMP
10968 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
10969 + tlbstate = this_cpu_read(cpu_tlbstate.state);
10970 +#endif
10971 this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK);
10972 this_cpu_write(cpu_tlbstate.active_mm, next);
10973 #endif
10974 cpumask_set_cpu(cpu, mm_cpumask(next));
10975
10976 /* Re-load page tables */
10977 +#ifdef CONFIG_PAX_PER_CPU_PGD
10978 + pax_open_kernel();
10979 + __clone_user_pgds(get_cpu_pgd(cpu), next->pgd);
10980 + __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd);
10981 + pax_close_kernel();
10982 + load_cr3(get_cpu_pgd(cpu));
10983 +#else
10984 load_cr3(next->pgd);
10985 +#endif
10986
10987 /* stop flush ipis for the previous mm */
10988 cpumask_clear_cpu(cpu, mm_cpumask(prev));
10989 @@ -53,9 +79,38 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
10990 */
10991 if (unlikely(prev->context.ldt != next->context.ldt))
10992 load_LDT_nolock(&next->context);
10993 - }
10994 +
10995 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
10996 + if (!(__supported_pte_mask & _PAGE_NX)) {
10997 + smp_mb__before_clear_bit();
10998 + cpu_clear(cpu, prev->context.cpu_user_cs_mask);
10999 + smp_mb__after_clear_bit();
11000 + cpu_set(cpu, next->context.cpu_user_cs_mask);
11001 + }
11002 +#endif
11003 +
11004 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
11005 + if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
11006 + prev->context.user_cs_limit != next->context.user_cs_limit))
11007 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
11008 #ifdef CONFIG_SMP
11009 + else if (unlikely(tlbstate != TLBSTATE_OK))
11010 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
11011 +#endif
11012 +#endif
11013 +
11014 + }
11015 else {
11016 +
11017 +#ifdef CONFIG_PAX_PER_CPU_PGD
11018 + pax_open_kernel();
11019 + __clone_user_pgds(get_cpu_pgd(cpu), next->pgd);
11020 + __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd);
11021 + pax_close_kernel();
11022 + load_cr3(get_cpu_pgd(cpu));
11023 +#endif
11024 +
11025 +#ifdef CONFIG_SMP
11026 this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK);
11027 BUG_ON(this_cpu_read(cpu_tlbstate.active_mm) != next);
11028
11029 @@ -64,11 +119,28 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
11030 * tlb flush IPI delivery. We must reload CR3
11031 * to make sure to use no freed page tables.
11032 */
11033 +
11034 +#ifndef CONFIG_PAX_PER_CPU_PGD
11035 load_cr3(next->pgd);
11036 +#endif
11037 +
11038 load_LDT_nolock(&next->context);
11039 +
11040 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
11041 + if (!(__supported_pte_mask & _PAGE_NX))
11042 + cpu_set(cpu, next->context.cpu_user_cs_mask);
11043 +#endif
11044 +
11045 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
11046 +#ifdef CONFIG_PAX_PAGEEXEC
11047 + if (!((next->pax_flags & MF_PAX_PAGEEXEC) && (__supported_pte_mask & _PAGE_NX)))
11048 +#endif
11049 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
11050 +#endif
11051 +
11052 }
11053 +#endif
11054 }
11055 -#endif
11056 }
11057
11058 #define activate_mm(prev, next) \
11059 diff --git a/arch/x86/include/asm/module.h b/arch/x86/include/asm/module.h
11060 index 9eae775..c914fea 100644
11061 --- a/arch/x86/include/asm/module.h
11062 +++ b/arch/x86/include/asm/module.h
11063 @@ -5,6 +5,7 @@
11064
11065 #ifdef CONFIG_X86_64
11066 /* X86_64 does not define MODULE_PROC_FAMILY */
11067 +#define MODULE_PROC_FAMILY ""
11068 #elif defined CONFIG_M386
11069 #define MODULE_PROC_FAMILY "386 "
11070 #elif defined CONFIG_M486
11071 @@ -59,8 +60,20 @@
11072 #error unknown processor family
11073 #endif
11074
11075 -#ifdef CONFIG_X86_32
11076 -# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY
11077 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS
11078 +#define MODULE_PAX_KERNEXEC "KERNEXEC_BTS "
11079 +#elif defined(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR)
11080 +#define MODULE_PAX_KERNEXEC "KERNEXEC_OR "
11081 +#else
11082 +#define MODULE_PAX_KERNEXEC ""
11083 #endif
11084
11085 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11086 +#define MODULE_PAX_UDEREF "UDEREF "
11087 +#else
11088 +#define MODULE_PAX_UDEREF ""
11089 +#endif
11090 +
11091 +#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
11092 +
11093 #endif /* _ASM_X86_MODULE_H */
11094 diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
11095 index 320f7bb..e89f8f8 100644
11096 --- a/arch/x86/include/asm/page_64_types.h
11097 +++ b/arch/x86/include/asm/page_64_types.h
11098 @@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
11099
11100 /* duplicated to the one in bootmem.h */
11101 extern unsigned long max_pfn;
11102 -extern unsigned long phys_base;
11103 +extern const unsigned long phys_base;
11104
11105 extern unsigned long __phys_addr(unsigned long);
11106 #define __phys_reloc_hide(x) (x)
11107 diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
11108 index 6cbbabf..11b3aed 100644
11109 --- a/arch/x86/include/asm/paravirt.h
11110 +++ b/arch/x86/include/asm/paravirt.h
11111 @@ -668,6 +668,18 @@ static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)
11112 val);
11113 }
11114
11115 +static inline void set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
11116 +{
11117 + pgdval_t val = native_pgd_val(pgd);
11118 +
11119 + if (sizeof(pgdval_t) > sizeof(long))
11120 + PVOP_VCALL3(pv_mmu_ops.set_pgd_batched, pgdp,
11121 + val, (u64)val >> 32);
11122 + else
11123 + PVOP_VCALL2(pv_mmu_ops.set_pgd_batched, pgdp,
11124 + val);
11125 +}
11126 +
11127 static inline void pgd_clear(pgd_t *pgdp)
11128 {
11129 set_pgd(pgdp, __pgd(0));
11130 @@ -749,6 +761,21 @@ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
11131 pv_mmu_ops.set_fixmap(idx, phys, flags);
11132 }
11133
11134 +#ifdef CONFIG_PAX_KERNEXEC
11135 +static inline unsigned long pax_open_kernel(void)
11136 +{
11137 + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
11138 +}
11139 +
11140 +static inline unsigned long pax_close_kernel(void)
11141 +{
11142 + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
11143 +}
11144 +#else
11145 +static inline unsigned long pax_open_kernel(void) { return 0; }
11146 +static inline unsigned long pax_close_kernel(void) { return 0; }
11147 +#endif
11148 +
11149 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
11150
11151 static inline int arch_spin_is_locked(struct arch_spinlock *lock)
11152 @@ -965,7 +992,7 @@ extern void default_banner(void);
11153
11154 #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
11155 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
11156 -#define PARA_INDIRECT(addr) *%cs:addr
11157 +#define PARA_INDIRECT(addr) *%ss:addr
11158 #endif
11159
11160 #define INTERRUPT_RETURN \
11161 @@ -1040,6 +1067,21 @@ extern void default_banner(void);
11162 PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
11163 CLBR_NONE, \
11164 jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
11165 +
11166 +#define GET_CR0_INTO_RDI \
11167 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
11168 + mov %rax,%rdi
11169 +
11170 +#define SET_RDI_INTO_CR0 \
11171 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
11172 +
11173 +#define GET_CR3_INTO_RDI \
11174 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
11175 + mov %rax,%rdi
11176 +
11177 +#define SET_RDI_INTO_CR3 \
11178 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
11179 +
11180 #endif /* CONFIG_X86_32 */
11181
11182 #endif /* __ASSEMBLY__ */
11183 diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
11184 index 8e8b9a4..f07d725 100644
11185 --- a/arch/x86/include/asm/paravirt_types.h
11186 +++ b/arch/x86/include/asm/paravirt_types.h
11187 @@ -84,20 +84,20 @@ struct pv_init_ops {
11188 */
11189 unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
11190 unsigned long addr, unsigned len);
11191 -};
11192 +} __no_const;
11193
11194
11195 struct pv_lazy_ops {
11196 /* Set deferred update mode, used for batching operations. */
11197 void (*enter)(void);
11198 void (*leave)(void);
11199 -};
11200 +} __no_const;
11201
11202 struct pv_time_ops {
11203 unsigned long long (*sched_clock)(void);
11204 unsigned long long (*steal_clock)(int cpu);
11205 unsigned long (*get_tsc_khz)(void);
11206 -};
11207 +} __no_const;
11208
11209 struct pv_cpu_ops {
11210 /* hooks for various privileged instructions */
11211 @@ -193,7 +193,7 @@ struct pv_cpu_ops {
11212
11213 void (*start_context_switch)(struct task_struct *prev);
11214 void (*end_context_switch)(struct task_struct *next);
11215 -};
11216 +} __no_const;
11217
11218 struct pv_irq_ops {
11219 /*
11220 @@ -224,7 +224,7 @@ struct pv_apic_ops {
11221 unsigned long start_eip,
11222 unsigned long start_esp);
11223 #endif
11224 -};
11225 +} __no_const;
11226
11227 struct pv_mmu_ops {
11228 unsigned long (*read_cr2)(void);
11229 @@ -313,6 +313,7 @@ struct pv_mmu_ops {
11230 struct paravirt_callee_save make_pud;
11231
11232 void (*set_pgd)(pgd_t *pudp, pgd_t pgdval);
11233 + void (*set_pgd_batched)(pgd_t *pudp, pgd_t pgdval);
11234 #endif /* PAGETABLE_LEVELS == 4 */
11235 #endif /* PAGETABLE_LEVELS >= 3 */
11236
11237 @@ -324,6 +325,12 @@ struct pv_mmu_ops {
11238 an mfn. We can tell which is which from the index. */
11239 void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
11240 phys_addr_t phys, pgprot_t flags);
11241 +
11242 +#ifdef CONFIG_PAX_KERNEXEC
11243 + unsigned long (*pax_open_kernel)(void);
11244 + unsigned long (*pax_close_kernel)(void);
11245 +#endif
11246 +
11247 };
11248
11249 struct arch_spinlock;
11250 @@ -334,7 +341,7 @@ struct pv_lock_ops {
11251 void (*spin_lock_flags)(struct arch_spinlock *lock, unsigned long flags);
11252 int (*spin_trylock)(struct arch_spinlock *lock);
11253 void (*spin_unlock)(struct arch_spinlock *lock);
11254 -};
11255 +} __no_const;
11256
11257 /* This contains all the paravirt structures: we get a convenient
11258 * number for each function using the offset which we use to indicate
11259 diff --git a/arch/x86/include/asm/pgalloc.h b/arch/x86/include/asm/pgalloc.h
11260 index b4389a4..7024269 100644
11261 --- a/arch/x86/include/asm/pgalloc.h
11262 +++ b/arch/x86/include/asm/pgalloc.h
11263 @@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(struct mm_struct *mm,
11264 pmd_t *pmd, pte_t *pte)
11265 {
11266 paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
11267 + set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
11268 +}
11269 +
11270 +static inline void pmd_populate_user(struct mm_struct *mm,
11271 + pmd_t *pmd, pte_t *pte)
11272 +{
11273 + paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
11274 set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
11275 }
11276
11277 @@ -99,12 +106,22 @@ static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
11278
11279 #ifdef CONFIG_X86_PAE
11280 extern void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd);
11281 +static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
11282 +{
11283 + pud_populate(mm, pudp, pmd);
11284 +}
11285 #else /* !CONFIG_X86_PAE */
11286 static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
11287 {
11288 paravirt_alloc_pmd(mm, __pa(pmd) >> PAGE_SHIFT);
11289 set_pud(pud, __pud(_PAGE_TABLE | __pa(pmd)));
11290 }
11291 +
11292 +static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
11293 +{
11294 + paravirt_alloc_pmd(mm, __pa(pmd) >> PAGE_SHIFT);
11295 + set_pud(pud, __pud(_KERNPG_TABLE | __pa(pmd)));
11296 +}
11297 #endif /* CONFIG_X86_PAE */
11298
11299 #if PAGETABLE_LEVELS > 3
11300 @@ -114,6 +131,12 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
11301 set_pgd(pgd, __pgd(_PAGE_TABLE | __pa(pud)));
11302 }
11303
11304 +static inline void pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
11305 +{
11306 + paravirt_alloc_pud(mm, __pa(pud) >> PAGE_SHIFT);
11307 + set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(pud)));
11308 +}
11309 +
11310 static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
11311 {
11312 return (pud_t *)get_zeroed_page(GFP_KERNEL|__GFP_REPEAT);
11313 diff --git a/arch/x86/include/asm/pgtable-2level.h b/arch/x86/include/asm/pgtable-2level.h
11314 index 98391db..8f6984e 100644
11315 --- a/arch/x86/include/asm/pgtable-2level.h
11316 +++ b/arch/x86/include/asm/pgtable-2level.h
11317 @@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t *ptep , pte_t pte)
11318
11319 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
11320 {
11321 + pax_open_kernel();
11322 *pmdp = pmd;
11323 + pax_close_kernel();
11324 }
11325
11326 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
11327 diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
11328 index cb00ccc..17e9054 100644
11329 --- a/arch/x86/include/asm/pgtable-3level.h
11330 +++ b/arch/x86/include/asm/pgtable-3level.h
11331 @@ -92,12 +92,16 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
11332
11333 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
11334 {
11335 + pax_open_kernel();
11336 set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
11337 + pax_close_kernel();
11338 }
11339
11340 static inline void native_set_pud(pud_t *pudp, pud_t pud)
11341 {
11342 + pax_open_kernel();
11343 set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
11344 + pax_close_kernel();
11345 }
11346
11347 /*
11348 diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
11349 index 49afb3f..91a8c63 100644
11350 --- a/arch/x86/include/asm/pgtable.h
11351 +++ b/arch/x86/include/asm/pgtable.h
11352 @@ -44,6 +44,7 @@ extern struct mm_struct *pgd_page_get_mm(struct page *page);
11353
11354 #ifndef __PAGETABLE_PUD_FOLDED
11355 #define set_pgd(pgdp, pgd) native_set_pgd(pgdp, pgd)
11356 +#define set_pgd_batched(pgdp, pgd) native_set_pgd_batched(pgdp, pgd)
11357 #define pgd_clear(pgd) native_pgd_clear(pgd)
11358 #endif
11359
11360 @@ -81,12 +82,51 @@ extern struct mm_struct *pgd_page_get_mm(struct page *page);
11361
11362 #define arch_end_context_switch(prev) do {} while(0)
11363
11364 +#define pax_open_kernel() native_pax_open_kernel()
11365 +#define pax_close_kernel() native_pax_close_kernel()
11366 #endif /* CONFIG_PARAVIRT */
11367
11368 +#define __HAVE_ARCH_PAX_OPEN_KERNEL
11369 +#define __HAVE_ARCH_PAX_CLOSE_KERNEL
11370 +
11371 +#ifdef CONFIG_PAX_KERNEXEC
11372 +static inline unsigned long native_pax_open_kernel(void)
11373 +{
11374 + unsigned long cr0;
11375 +
11376 + preempt_disable();
11377 + barrier();
11378 + cr0 = read_cr0() ^ X86_CR0_WP;
11379 + BUG_ON(unlikely(cr0 & X86_CR0_WP));
11380 + write_cr0(cr0);
11381 + return cr0 ^ X86_CR0_WP;
11382 +}
11383 +
11384 +static inline unsigned long native_pax_close_kernel(void)
11385 +{
11386 + unsigned long cr0;
11387 +
11388 + cr0 = read_cr0() ^ X86_CR0_WP;
11389 + BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
11390 + write_cr0(cr0);
11391 + barrier();
11392 + preempt_enable_no_resched();
11393 + return cr0 ^ X86_CR0_WP;
11394 +}
11395 +#else
11396 +static inline unsigned long native_pax_open_kernel(void) { return 0; }
11397 +static inline unsigned long native_pax_close_kernel(void) { return 0; }
11398 +#endif
11399 +
11400 /*
11401 * The following only work if pte_present() is true.
11402 * Undefined behaviour if not..
11403 */
11404 +static inline int pte_user(pte_t pte)
11405 +{
11406 + return pte_val(pte) & _PAGE_USER;
11407 +}
11408 +
11409 static inline int pte_dirty(pte_t pte)
11410 {
11411 return pte_flags(pte) & _PAGE_DIRTY;
11412 @@ -196,9 +236,29 @@ static inline pte_t pte_wrprotect(pte_t pte)
11413 return pte_clear_flags(pte, _PAGE_RW);
11414 }
11415
11416 +static inline pte_t pte_mkread(pte_t pte)
11417 +{
11418 + return __pte(pte_val(pte) | _PAGE_USER);
11419 +}
11420 +
11421 static inline pte_t pte_mkexec(pte_t pte)
11422 {
11423 - return pte_clear_flags(pte, _PAGE_NX);
11424 +#ifdef CONFIG_X86_PAE
11425 + if (__supported_pte_mask & _PAGE_NX)
11426 + return pte_clear_flags(pte, _PAGE_NX);
11427 + else
11428 +#endif
11429 + return pte_set_flags(pte, _PAGE_USER);
11430 +}
11431 +
11432 +static inline pte_t pte_exprotect(pte_t pte)
11433 +{
11434 +#ifdef CONFIG_X86_PAE
11435 + if (__supported_pte_mask & _PAGE_NX)
11436 + return pte_set_flags(pte, _PAGE_NX);
11437 + else
11438 +#endif
11439 + return pte_clear_flags(pte, _PAGE_USER);
11440 }
11441
11442 static inline pte_t pte_mkdirty(pte_t pte)
11443 @@ -390,6 +450,15 @@ pte_t *populate_extra_pte(unsigned long vaddr);
11444 #endif
11445
11446 #ifndef __ASSEMBLY__
11447 +
11448 +#ifdef CONFIG_PAX_PER_CPU_PGD
11449 +extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
11450 +static inline pgd_t *get_cpu_pgd(unsigned int cpu)
11451 +{
11452 + return cpu_pgd[cpu];
11453 +}
11454 +#endif
11455 +
11456 #include <linux/mm_types.h>
11457
11458 static inline int pte_none(pte_t pte)
11459 @@ -560,7 +629,7 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
11460
11461 static inline int pgd_bad(pgd_t pgd)
11462 {
11463 - return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
11464 + return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
11465 }
11466
11467 static inline int pgd_none(pgd_t pgd)
11468 @@ -583,7 +652,12 @@ static inline int pgd_none(pgd_t pgd)
11469 * pgd_offset() returns a (pgd_t *)
11470 * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
11471 */
11472 -#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
11473 +#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
11474 +
11475 +#ifdef CONFIG_PAX_PER_CPU_PGD
11476 +#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
11477 +#endif
11478 +
11479 /*
11480 * a shortcut which implies the use of the kernel's pgd, instead
11481 * of a process's
11482 @@ -594,6 +668,20 @@ static inline int pgd_none(pgd_t pgd)
11483 #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
11484 #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
11485
11486 +#ifdef CONFIG_X86_32
11487 +#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
11488 +#else
11489 +#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
11490 +#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
11491 +
11492 +#ifdef CONFIG_PAX_MEMORY_UDEREF
11493 +#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
11494 +#else
11495 +#define PAX_USER_SHADOW_BASE (_AC(0,UL))
11496 +#endif
11497 +
11498 +#endif
11499 +
11500 #ifndef __ASSEMBLY__
11501
11502 extern int direct_gbpages;
11503 @@ -758,11 +846,23 @@ static inline void pmdp_set_wrprotect(struct mm_struct *mm,
11504 * dst and src can be on the same page, but the range must not overlap,
11505 * and must not cross a page boundary.
11506 */
11507 -static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
11508 +static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
11509 {
11510 - memcpy(dst, src, count * sizeof(pgd_t));
11511 + pax_open_kernel();
11512 + while (count--)
11513 + *dst++ = *src++;
11514 + pax_close_kernel();
11515 }
11516
11517 +#ifdef CONFIG_PAX_PER_CPU_PGD
11518 +extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src);
11519 +#endif
11520 +
11521 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
11522 +extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src);
11523 +#else
11524 +static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src) {}
11525 +#endif
11526
11527 #include <asm-generic/pgtable.h>
11528 #endif /* __ASSEMBLY__ */
11529 diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
11530 index 0c92113..34a77c6 100644
11531 --- a/arch/x86/include/asm/pgtable_32.h
11532 +++ b/arch/x86/include/asm/pgtable_32.h
11533 @@ -25,9 +25,6 @@
11534 struct mm_struct;
11535 struct vm_area_struct;
11536
11537 -extern pgd_t swapper_pg_dir[1024];
11538 -extern pgd_t initial_page_table[1024];
11539 -
11540 static inline void pgtable_cache_init(void) { }
11541 static inline void check_pgt_cache(void) { }
11542 void paging_init(void);
11543 @@ -48,6 +45,12 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
11544 # include <asm/pgtable-2level.h>
11545 #endif
11546
11547 +extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
11548 +extern pgd_t initial_page_table[PTRS_PER_PGD];
11549 +#ifdef CONFIG_X86_PAE
11550 +extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
11551 +#endif
11552 +
11553 #if defined(CONFIG_HIGHPTE)
11554 #define pte_offset_map(dir, address) \
11555 ((pte_t *)kmap_atomic(pmd_page(*(dir))) + \
11556 @@ -62,7 +65,9 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
11557 /* Clear a kernel PTE and flush it from the TLB */
11558 #define kpte_clear_flush(ptep, vaddr) \
11559 do { \
11560 + pax_open_kernel(); \
11561 pte_clear(&init_mm, (vaddr), (ptep)); \
11562 + pax_close_kernel(); \
11563 __flush_tlb_one((vaddr)); \
11564 } while (0)
11565
11566 @@ -74,6 +79,9 @@ do { \
11567
11568 #endif /* !__ASSEMBLY__ */
11569
11570 +#define HAVE_ARCH_UNMAPPED_AREA
11571 +#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
11572 +
11573 /*
11574 * kern_addr_valid() is (1) for FLATMEM and (0) for
11575 * SPARSEMEM and DISCONTIGMEM
11576 diff --git a/arch/x86/include/asm/pgtable_32_types.h b/arch/x86/include/asm/pgtable_32_types.h
11577 index ed5903b..c7fe163 100644
11578 --- a/arch/x86/include/asm/pgtable_32_types.h
11579 +++ b/arch/x86/include/asm/pgtable_32_types.h
11580 @@ -8,7 +8,7 @@
11581 */
11582 #ifdef CONFIG_X86_PAE
11583 # include <asm/pgtable-3level_types.h>
11584 -# define PMD_SIZE (1UL << PMD_SHIFT)
11585 +# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
11586 # define PMD_MASK (~(PMD_SIZE - 1))
11587 #else
11588 # include <asm/pgtable-2level_types.h>
11589 @@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set once high_memory is set */
11590 # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
11591 #endif
11592
11593 +#ifdef CONFIG_PAX_KERNEXEC
11594 +#ifndef __ASSEMBLY__
11595 +extern unsigned char MODULES_EXEC_VADDR[];
11596 +extern unsigned char MODULES_EXEC_END[];
11597 +#endif
11598 +#include <asm/boot.h>
11599 +#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
11600 +#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
11601 +#else
11602 +#define ktla_ktva(addr) (addr)
11603 +#define ktva_ktla(addr) (addr)
11604 +#endif
11605 +
11606 #define MODULES_VADDR VMALLOC_START
11607 #define MODULES_END VMALLOC_END
11608 #define MODULES_LEN (MODULES_VADDR - MODULES_END)
11609 diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
11610 index 975f709..9f779c9 100644
11611 --- a/arch/x86/include/asm/pgtable_64.h
11612 +++ b/arch/x86/include/asm/pgtable_64.h
11613 @@ -16,10 +16,14 @@
11614
11615 extern pud_t level3_kernel_pgt[512];
11616 extern pud_t level3_ident_pgt[512];
11617 +extern pud_t level3_vmalloc_start_pgt[512];
11618 +extern pud_t level3_vmalloc_end_pgt[512];
11619 +extern pud_t level3_vmemmap_pgt[512];
11620 +extern pud_t level2_vmemmap_pgt[512];
11621 extern pmd_t level2_kernel_pgt[512];
11622 extern pmd_t level2_fixmap_pgt[512];
11623 -extern pmd_t level2_ident_pgt[512];
11624 -extern pgd_t init_level4_pgt[];
11625 +extern pmd_t level2_ident_pgt[512*2];
11626 +extern pgd_t init_level4_pgt[512];
11627
11628 #define swapper_pg_dir init_level4_pgt
11629
11630 @@ -61,7 +65,9 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
11631
11632 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
11633 {
11634 + pax_open_kernel();
11635 *pmdp = pmd;
11636 + pax_close_kernel();
11637 }
11638
11639 static inline void native_pmd_clear(pmd_t *pmd)
11640 @@ -97,7 +103,9 @@ static inline pmd_t native_pmdp_get_and_clear(pmd_t *xp)
11641
11642 static inline void native_set_pud(pud_t *pudp, pud_t pud)
11643 {
11644 + pax_open_kernel();
11645 *pudp = pud;
11646 + pax_close_kernel();
11647 }
11648
11649 static inline void native_pud_clear(pud_t *pud)
11650 @@ -107,6 +115,13 @@ static inline void native_pud_clear(pud_t *pud)
11651
11652 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
11653 {
11654 + pax_open_kernel();
11655 + *pgdp = pgd;
11656 + pax_close_kernel();
11657 +}
11658 +
11659 +static inline void native_set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
11660 +{
11661 *pgdp = pgd;
11662 }
11663
11664 diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
11665 index 766ea16..5b96cb3 100644
11666 --- a/arch/x86/include/asm/pgtable_64_types.h
11667 +++ b/arch/x86/include/asm/pgtable_64_types.h
11668 @@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
11669 #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
11670 #define MODULES_END _AC(0xffffffffff000000, UL)
11671 #define MODULES_LEN (MODULES_END - MODULES_VADDR)
11672 +#define MODULES_EXEC_VADDR MODULES_VADDR
11673 +#define MODULES_EXEC_END MODULES_END
11674 +
11675 +#define ktla_ktva(addr) (addr)
11676 +#define ktva_ktla(addr) (addr)
11677
11678 #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
11679 diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
11680 index 013286a..8b42f4f 100644
11681 --- a/arch/x86/include/asm/pgtable_types.h
11682 +++ b/arch/x86/include/asm/pgtable_types.h
11683 @@ -16,13 +16,12 @@
11684 #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
11685 #define _PAGE_BIT_PAT 7 /* on 4KB pages */
11686 #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
11687 -#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
11688 +#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
11689 #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
11690 #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
11691 #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
11692 -#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
11693 -#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
11694 -#define _PAGE_BIT_SPLITTING _PAGE_BIT_UNUSED1 /* only valid on a PSE pmd */
11695 +#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
11696 +#define _PAGE_BIT_SPLITTING _PAGE_BIT_SPECIAL /* only valid on a PSE pmd */
11697 #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
11698
11699 /* If _PAGE_BIT_PRESENT is clear, we use these: */
11700 @@ -40,7 +39,6 @@
11701 #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
11702 #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
11703 #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
11704 -#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
11705 #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
11706 #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
11707 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
11708 @@ -57,8 +55,10 @@
11709
11710 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
11711 #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
11712 -#else
11713 +#elif defined(CONFIG_KMEMCHECK)
11714 #define _PAGE_NX (_AT(pteval_t, 0))
11715 +#else
11716 +#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
11717 #endif
11718
11719 #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
11720 @@ -96,6 +96,9 @@
11721 #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
11722 _PAGE_ACCESSED)
11723
11724 +#define PAGE_READONLY_NOEXEC PAGE_READONLY
11725 +#define PAGE_SHARED_NOEXEC PAGE_SHARED
11726 +
11727 #define __PAGE_KERNEL_EXEC \
11728 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
11729 #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
11730 @@ -106,7 +109,7 @@
11731 #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
11732 #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
11733 #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
11734 -#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
11735 +#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
11736 #define __PAGE_KERNEL_VVAR (__PAGE_KERNEL_RO | _PAGE_USER)
11737 #define __PAGE_KERNEL_VVAR_NOCACHE (__PAGE_KERNEL_VVAR | _PAGE_PCD | _PAGE_PWT)
11738 #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
11739 @@ -168,8 +171,8 @@
11740 * bits are combined, this will alow user to access the high address mapped
11741 * VDSO in the presence of CONFIG_COMPAT_VDSO
11742 */
11743 -#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
11744 -#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
11745 +#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
11746 +#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
11747 #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
11748 #endif
11749
11750 @@ -207,7 +210,17 @@ static inline pgdval_t pgd_flags(pgd_t pgd)
11751 {
11752 return native_pgd_val(pgd) & PTE_FLAGS_MASK;
11753 }
11754 +#endif
11755
11756 +#if PAGETABLE_LEVELS == 3
11757 +#include <asm-generic/pgtable-nopud.h>
11758 +#endif
11759 +
11760 +#if PAGETABLE_LEVELS == 2
11761 +#include <asm-generic/pgtable-nopmd.h>
11762 +#endif
11763 +
11764 +#ifndef __ASSEMBLY__
11765 #if PAGETABLE_LEVELS > 3
11766 typedef struct { pudval_t pud; } pud_t;
11767
11768 @@ -221,8 +234,6 @@ static inline pudval_t native_pud_val(pud_t pud)
11769 return pud.pud;
11770 }
11771 #else
11772 -#include <asm-generic/pgtable-nopud.h>
11773 -
11774 static inline pudval_t native_pud_val(pud_t pud)
11775 {
11776 return native_pgd_val(pud.pgd);
11777 @@ -242,8 +253,6 @@ static inline pmdval_t native_pmd_val(pmd_t pmd)
11778 return pmd.pmd;
11779 }
11780 #else
11781 -#include <asm-generic/pgtable-nopmd.h>
11782 -
11783 static inline pmdval_t native_pmd_val(pmd_t pmd)
11784 {
11785 return native_pgd_val(pmd.pud.pgd);
11786 @@ -283,7 +292,6 @@ typedef struct page *pgtable_t;
11787
11788 extern pteval_t __supported_pte_mask;
11789 extern void set_nx(void);
11790 -extern int nx_enabled;
11791
11792 #define pgprot_writecombine pgprot_writecombine
11793 extern pgprot_t pgprot_writecombine(pgprot_t prot);
11794 diff --git a/arch/x86/include/asm/processor-flags.h b/arch/x86/include/asm/processor-flags.h
11795 index f8ab3ea..67889db 100644
11796 --- a/arch/x86/include/asm/processor-flags.h
11797 +++ b/arch/x86/include/asm/processor-flags.h
11798 @@ -63,6 +63,7 @@
11799 #define X86_CR4_RDWRGSFS 0x00010000 /* enable RDWRGSFS support */
11800 #define X86_CR4_OSXSAVE 0x00040000 /* enable xsave and xrestore */
11801 #define X86_CR4_SMEP 0x00100000 /* enable SMEP support */
11802 +#define X86_CR4_SMAP 0x00200000 /* enable SMAP support */
11803
11804 /*
11805 * x86-64 Task Priority Register, CR8
11806 diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
11807 index 39bc577..538233f 100644
11808 --- a/arch/x86/include/asm/processor.h
11809 +++ b/arch/x86/include/asm/processor.h
11810 @@ -276,7 +276,7 @@ struct tss_struct {
11811
11812 } ____cacheline_aligned;
11813
11814 -DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
11815 +extern struct tss_struct init_tss[NR_CPUS];
11816
11817 /*
11818 * Save the original ist values for checking stack pointers during debugging
11819 @@ -809,11 +809,18 @@ static inline void spin_lock_prefetch(const void *x)
11820 */
11821 #define TASK_SIZE PAGE_OFFSET
11822 #define TASK_SIZE_MAX TASK_SIZE
11823 +
11824 +#ifdef CONFIG_PAX_SEGMEXEC
11825 +#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
11826 +#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
11827 +#else
11828 #define STACK_TOP TASK_SIZE
11829 -#define STACK_TOP_MAX STACK_TOP
11830 +#endif
11831 +
11832 +#define STACK_TOP_MAX TASK_SIZE
11833
11834 #define INIT_THREAD { \
11835 - .sp0 = sizeof(init_stack) + (long)&init_stack, \
11836 + .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
11837 .vm86_info = NULL, \
11838 .sysenter_cs = __KERNEL_CS, \
11839 .io_bitmap_ptr = NULL, \
11840 @@ -827,7 +834,7 @@ static inline void spin_lock_prefetch(const void *x)
11841 */
11842 #define INIT_TSS { \
11843 .x86_tss = { \
11844 - .sp0 = sizeof(init_stack) + (long)&init_stack, \
11845 + .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
11846 .ss0 = __KERNEL_DS, \
11847 .ss1 = __KERNEL_CS, \
11848 .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
11849 @@ -838,11 +845,7 @@ static inline void spin_lock_prefetch(const void *x)
11850 extern unsigned long thread_saved_pc(struct task_struct *tsk);
11851
11852 #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
11853 -#define KSTK_TOP(info) \
11854 -({ \
11855 - unsigned long *__ptr = (unsigned long *)(info); \
11856 - (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
11857 -})
11858 +#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
11859
11860 /*
11861 * The below -8 is to reserve 8 bytes on top of the ring0 stack.
11862 @@ -857,7 +860,7 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
11863 #define task_pt_regs(task) \
11864 ({ \
11865 struct pt_regs *__regs__; \
11866 - __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
11867 + __regs__ = (struct pt_regs *)((task)->thread.sp0); \
11868 __regs__ - 1; \
11869 })
11870
11871 @@ -867,13 +870,13 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
11872 /*
11873 * User space process size. 47bits minus one guard page.
11874 */
11875 -#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
11876 +#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
11877
11878 /* This decides where the kernel will search for a free chunk of vm
11879 * space during mmap's.
11880 */
11881 #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
11882 - 0xc0000000 : 0xFFFFe000)
11883 + 0xc0000000 : 0xFFFFf000)
11884
11885 #define TASK_SIZE (test_thread_flag(TIF_ADDR32) ? \
11886 IA32_PAGE_OFFSET : TASK_SIZE_MAX)
11887 @@ -884,11 +887,11 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
11888 #define STACK_TOP_MAX TASK_SIZE_MAX
11889
11890 #define INIT_THREAD { \
11891 - .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
11892 + .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
11893 }
11894
11895 #define INIT_TSS { \
11896 - .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
11897 + .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
11898 }
11899
11900 /*
11901 @@ -916,6 +919,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
11902 */
11903 #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
11904
11905 +#ifdef CONFIG_PAX_SEGMEXEC
11906 +#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
11907 +#endif
11908 +
11909 #define KSTK_EIP(task) (task_pt_regs(task)->ip)
11910
11911 /* Get/set a process' ability to use the timestamp counter instruction */
11912 @@ -976,12 +983,12 @@ extern bool cpu_has_amd_erratum(const int *);
11913 #define cpu_has_amd_erratum(x) (false)
11914 #endif /* CONFIG_CPU_SUP_AMD */
11915
11916 -extern unsigned long arch_align_stack(unsigned long sp);
11917 +#define arch_align_stack(x) ((x) & ~0xfUL)
11918 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
11919
11920 void default_idle(void);
11921 bool set_pm_idle_to_default(void);
11922
11923 -void stop_this_cpu(void *dummy);
11924 +void stop_this_cpu(void *dummy) __noreturn;
11925
11926 #endif /* _ASM_X86_PROCESSOR_H */
11927 diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
11928 index dcfde52..dbfea06 100644
11929 --- a/arch/x86/include/asm/ptrace.h
11930 +++ b/arch/x86/include/asm/ptrace.h
11931 @@ -155,28 +155,29 @@ static inline unsigned long regs_return_value(struct pt_regs *regs)
11932 }
11933
11934 /*
11935 - * user_mode_vm(regs) determines whether a register set came from user mode.
11936 + * user_mode(regs) determines whether a register set came from user mode.
11937 * This is true if V8086 mode was enabled OR if the register set was from
11938 * protected mode with RPL-3 CS value. This tricky test checks that with
11939 * one comparison. Many places in the kernel can bypass this full check
11940 - * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
11941 + * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
11942 + * be used.
11943 */
11944 -static inline int user_mode(struct pt_regs *regs)
11945 +static inline int user_mode_novm(struct pt_regs *regs)
11946 {
11947 #ifdef CONFIG_X86_32
11948 return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
11949 #else
11950 - return !!(regs->cs & 3);
11951 + return !!(regs->cs & SEGMENT_RPL_MASK);
11952 #endif
11953 }
11954
11955 -static inline int user_mode_vm(struct pt_regs *regs)
11956 +static inline int user_mode(struct pt_regs *regs)
11957 {
11958 #ifdef CONFIG_X86_32
11959 return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
11960 USER_RPL;
11961 #else
11962 - return user_mode(regs);
11963 + return user_mode_novm(regs);
11964 #endif
11965 }
11966
11967 @@ -192,15 +193,16 @@ static inline int v8086_mode(struct pt_regs *regs)
11968 #ifdef CONFIG_X86_64
11969 static inline bool user_64bit_mode(struct pt_regs *regs)
11970 {
11971 + unsigned long cs = regs->cs & 0xffff;
11972 #ifndef CONFIG_PARAVIRT
11973 /*
11974 * On non-paravirt systems, this is the only long mode CPL 3
11975 * selector. We do not allow long mode selectors in the LDT.
11976 */
11977 - return regs->cs == __USER_CS;
11978 + return cs == __USER_CS;
11979 #else
11980 /* Headers are too twisted for this to go in paravirt.h. */
11981 - return regs->cs == __USER_CS || regs->cs == pv_info.extra_user_64bit_cs;
11982 + return cs == __USER_CS || cs == pv_info.extra_user_64bit_cs;
11983 #endif
11984 }
11985 #endif
11986 diff --git a/arch/x86/include/asm/realmode.h b/arch/x86/include/asm/realmode.h
11987 index fce3f4a..3f69f2a 100644
11988 --- a/arch/x86/include/asm/realmode.h
11989 +++ b/arch/x86/include/asm/realmode.h
11990 @@ -30,7 +30,7 @@ struct real_mode_header {
11991 struct trampoline_header {
11992 #ifdef CONFIG_X86_32
11993 u32 start;
11994 - u16 gdt_pad;
11995 + u16 boot_cs;
11996 u16 gdt_limit;
11997 u32 gdt_base;
11998 #else
11999 diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h
12000 index 92f29706..d0a1a53 100644
12001 --- a/arch/x86/include/asm/reboot.h
12002 +++ b/arch/x86/include/asm/reboot.h
12003 @@ -6,19 +6,19 @@
12004 struct pt_regs;
12005
12006 struct machine_ops {
12007 - void (*restart)(char *cmd);
12008 - void (*halt)(void);
12009 - void (*power_off)(void);
12010 + void (* __noreturn restart)(char *cmd);
12011 + void (* __noreturn halt)(void);
12012 + void (* __noreturn power_off)(void);
12013 void (*shutdown)(void);
12014 void (*crash_shutdown)(struct pt_regs *);
12015 - void (*emergency_restart)(void);
12016 -};
12017 + void (* __noreturn emergency_restart)(void);
12018 +} __no_const;
12019
12020 extern struct machine_ops machine_ops;
12021
12022 void native_machine_crash_shutdown(struct pt_regs *regs);
12023 void native_machine_shutdown(void);
12024 -void machine_real_restart(unsigned int type);
12025 +void __noreturn machine_real_restart(unsigned int type);
12026 /* These must match dispatch_table in reboot_32.S */
12027 #define MRR_BIOS 0
12028 #define MRR_APM 1
12029 diff --git a/arch/x86/include/asm/rwsem.h b/arch/x86/include/asm/rwsem.h
12030 index 2dbe4a7..ce1db00 100644
12031 --- a/arch/x86/include/asm/rwsem.h
12032 +++ b/arch/x86/include/asm/rwsem.h
12033 @@ -64,6 +64,14 @@ static inline void __down_read(struct rw_semaphore *sem)
12034 {
12035 asm volatile("# beginning down_read\n\t"
12036 LOCK_PREFIX _ASM_INC "(%1)\n\t"
12037 +
12038 +#ifdef CONFIG_PAX_REFCOUNT
12039 + "jno 0f\n"
12040 + LOCK_PREFIX _ASM_DEC "(%1)\n"
12041 + "int $4\n0:\n"
12042 + _ASM_EXTABLE(0b, 0b)
12043 +#endif
12044 +
12045 /* adds 0x00000001 */
12046 " jns 1f\n"
12047 " call call_rwsem_down_read_failed\n"
12048 @@ -85,6 +93,14 @@ static inline int __down_read_trylock(struct rw_semaphore *sem)
12049 "1:\n\t"
12050 " mov %1,%2\n\t"
12051 " add %3,%2\n\t"
12052 +
12053 +#ifdef CONFIG_PAX_REFCOUNT
12054 + "jno 0f\n"
12055 + "sub %3,%2\n"
12056 + "int $4\n0:\n"
12057 + _ASM_EXTABLE(0b, 0b)
12058 +#endif
12059 +
12060 " jle 2f\n\t"
12061 LOCK_PREFIX " cmpxchg %2,%0\n\t"
12062 " jnz 1b\n\t"
12063 @@ -104,6 +120,14 @@ static inline void __down_write_nested(struct rw_semaphore *sem, int subclass)
12064 long tmp;
12065 asm volatile("# beginning down_write\n\t"
12066 LOCK_PREFIX " xadd %1,(%2)\n\t"
12067 +
12068 +#ifdef CONFIG_PAX_REFCOUNT
12069 + "jno 0f\n"
12070 + "mov %1,(%2)\n"
12071 + "int $4\n0:\n"
12072 + _ASM_EXTABLE(0b, 0b)
12073 +#endif
12074 +
12075 /* adds 0xffff0001, returns the old value */
12076 " test %1,%1\n\t"
12077 /* was the count 0 before? */
12078 @@ -141,6 +165,14 @@ static inline void __up_read(struct rw_semaphore *sem)
12079 long tmp;
12080 asm volatile("# beginning __up_read\n\t"
12081 LOCK_PREFIX " xadd %1,(%2)\n\t"
12082 +
12083 +#ifdef CONFIG_PAX_REFCOUNT
12084 + "jno 0f\n"
12085 + "mov %1,(%2)\n"
12086 + "int $4\n0:\n"
12087 + _ASM_EXTABLE(0b, 0b)
12088 +#endif
12089 +
12090 /* subtracts 1, returns the old value */
12091 " jns 1f\n\t"
12092 " call call_rwsem_wake\n" /* expects old value in %edx */
12093 @@ -159,6 +191,14 @@ static inline void __up_write(struct rw_semaphore *sem)
12094 long tmp;
12095 asm volatile("# beginning __up_write\n\t"
12096 LOCK_PREFIX " xadd %1,(%2)\n\t"
12097 +
12098 +#ifdef CONFIG_PAX_REFCOUNT
12099 + "jno 0f\n"
12100 + "mov %1,(%2)\n"
12101 + "int $4\n0:\n"
12102 + _ASM_EXTABLE(0b, 0b)
12103 +#endif
12104 +
12105 /* subtracts 0xffff0001, returns the old value */
12106 " jns 1f\n\t"
12107 " call call_rwsem_wake\n" /* expects old value in %edx */
12108 @@ -176,6 +216,14 @@ static inline void __downgrade_write(struct rw_semaphore *sem)
12109 {
12110 asm volatile("# beginning __downgrade_write\n\t"
12111 LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
12112 +
12113 +#ifdef CONFIG_PAX_REFCOUNT
12114 + "jno 0f\n"
12115 + LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
12116 + "int $4\n0:\n"
12117 + _ASM_EXTABLE(0b, 0b)
12118 +#endif
12119 +
12120 /*
12121 * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
12122 * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
12123 @@ -194,7 +242,15 @@ static inline void __downgrade_write(struct rw_semaphore *sem)
12124 */
12125 static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem)
12126 {
12127 - asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
12128 + asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
12129 +
12130 +#ifdef CONFIG_PAX_REFCOUNT
12131 + "jno 0f\n"
12132 + LOCK_PREFIX _ASM_SUB "%1,%0\n"
12133 + "int $4\n0:\n"
12134 + _ASM_EXTABLE(0b, 0b)
12135 +#endif
12136 +
12137 : "+m" (sem->count)
12138 : "er" (delta));
12139 }
12140 @@ -204,7 +260,7 @@ static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem)
12141 */
12142 static inline long rwsem_atomic_update(long delta, struct rw_semaphore *sem)
12143 {
12144 - return delta + xadd(&sem->count, delta);
12145 + return delta + xadd_check_overflow(&sem->count, delta);
12146 }
12147
12148 #endif /* __KERNEL__ */
12149 diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
12150 index c48a950..c6d7468 100644
12151 --- a/arch/x86/include/asm/segment.h
12152 +++ b/arch/x86/include/asm/segment.h
12153 @@ -64,10 +64,15 @@
12154 * 26 - ESPFIX small SS
12155 * 27 - per-cpu [ offset to per-cpu data area ]
12156 * 28 - stack_canary-20 [ for stack protector ]
12157 - * 29 - unused
12158 - * 30 - unused
12159 + * 29 - PCI BIOS CS
12160 + * 30 - PCI BIOS DS
12161 * 31 - TSS for double fault handler
12162 */
12163 +#define GDT_ENTRY_KERNEXEC_EFI_CS (1)
12164 +#define GDT_ENTRY_KERNEXEC_EFI_DS (2)
12165 +#define __KERNEXEC_EFI_CS (GDT_ENTRY_KERNEXEC_EFI_CS*8)
12166 +#define __KERNEXEC_EFI_DS (GDT_ENTRY_KERNEXEC_EFI_DS*8)
12167 +
12168 #define GDT_ENTRY_TLS_MIN 6
12169 #define GDT_ENTRY_TLS_MAX (GDT_ENTRY_TLS_MIN + GDT_ENTRY_TLS_ENTRIES - 1)
12170
12171 @@ -79,6 +84,8 @@
12172
12173 #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE+0)
12174
12175 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
12176 +
12177 #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE+1)
12178
12179 #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE+4)
12180 @@ -104,6 +111,12 @@
12181 #define __KERNEL_STACK_CANARY 0
12182 #endif
12183
12184 +#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE+17)
12185 +#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
12186 +
12187 +#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE+18)
12188 +#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
12189 +
12190 #define GDT_ENTRY_DOUBLEFAULT_TSS 31
12191
12192 /*
12193 @@ -141,7 +154,7 @@
12194 */
12195
12196 /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
12197 -#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
12198 +#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
12199
12200
12201 #else
12202 @@ -165,6 +178,8 @@
12203 #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS*8+3)
12204 #define __USER32_DS __USER_DS
12205
12206 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
12207 +
12208 #define GDT_ENTRY_TSS 8 /* needs two entries */
12209 #define GDT_ENTRY_LDT 10 /* needs two entries */
12210 #define GDT_ENTRY_TLS_MIN 12
12211 @@ -185,6 +200,7 @@
12212 #endif
12213
12214 #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS*8)
12215 +#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS*8)
12216 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS*8)
12217 #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS*8+3)
12218 #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS*8+3)
12219 @@ -265,7 +281,7 @@ static inline unsigned long get_limit(unsigned long segment)
12220 {
12221 unsigned long __limit;
12222 asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
12223 - return __limit + 1;
12224 + return __limit;
12225 }
12226
12227 #endif /* !__ASSEMBLY__ */
12228 diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
12229 index f483945..64a7851 100644
12230 --- a/arch/x86/include/asm/smp.h
12231 +++ b/arch/x86/include/asm/smp.h
12232 @@ -36,7 +36,7 @@ DECLARE_PER_CPU(cpumask_var_t, cpu_core_map);
12233 /* cpus sharing the last level cache: */
12234 DECLARE_PER_CPU(cpumask_var_t, cpu_llc_shared_map);
12235 DECLARE_PER_CPU(u16, cpu_llc_id);
12236 -DECLARE_PER_CPU(int, cpu_number);
12237 +DECLARE_PER_CPU(unsigned int, cpu_number);
12238
12239 static inline struct cpumask *cpu_sibling_mask(int cpu)
12240 {
12241 @@ -79,7 +79,7 @@ struct smp_ops {
12242
12243 void (*send_call_func_ipi)(const struct cpumask *mask);
12244 void (*send_call_func_single_ipi)(int cpu);
12245 -};
12246 +} __no_const;
12247
12248 /* Globals due to paravirt */
12249 extern void set_cpu_sibling_map(int cpu);
12250 @@ -195,14 +195,8 @@ extern unsigned disabled_cpus __cpuinitdata;
12251 extern int safe_smp_processor_id(void);
12252
12253 #elif defined(CONFIG_X86_64_SMP)
12254 -#define raw_smp_processor_id() (this_cpu_read(cpu_number))
12255 -
12256 -#define stack_smp_processor_id() \
12257 -({ \
12258 - struct thread_info *ti; \
12259 - __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
12260 - ti->cpu; \
12261 -})
12262 +#define raw_smp_processor_id() (this_cpu_read(cpu_number))
12263 +#define stack_smp_processor_id() raw_smp_processor_id()
12264 #define safe_smp_processor_id() smp_processor_id()
12265
12266 #endif
12267 diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h
12268 index b315a33..8849ab0 100644
12269 --- a/arch/x86/include/asm/spinlock.h
12270 +++ b/arch/x86/include/asm/spinlock.h
12271 @@ -173,6 +173,14 @@ static inline int arch_write_can_lock(arch_rwlock_t *lock)
12272 static inline void arch_read_lock(arch_rwlock_t *rw)
12273 {
12274 asm volatile(LOCK_PREFIX READ_LOCK_SIZE(dec) " (%0)\n\t"
12275 +
12276 +#ifdef CONFIG_PAX_REFCOUNT
12277 + "jno 0f\n"
12278 + LOCK_PREFIX READ_LOCK_SIZE(inc) " (%0)\n"
12279 + "int $4\n0:\n"
12280 + _ASM_EXTABLE(0b, 0b)
12281 +#endif
12282 +
12283 "jns 1f\n"
12284 "call __read_lock_failed\n\t"
12285 "1:\n"
12286 @@ -182,6 +190,14 @@ static inline void arch_read_lock(arch_rwlock_t *rw)
12287 static inline void arch_write_lock(arch_rwlock_t *rw)
12288 {
12289 asm volatile(LOCK_PREFIX WRITE_LOCK_SUB(%1) "(%0)\n\t"
12290 +
12291 +#ifdef CONFIG_PAX_REFCOUNT
12292 + "jno 0f\n"
12293 + LOCK_PREFIX WRITE_LOCK_ADD(%1) "(%0)\n"
12294 + "int $4\n0:\n"
12295 + _ASM_EXTABLE(0b, 0b)
12296 +#endif
12297 +
12298 "jz 1f\n"
12299 "call __write_lock_failed\n\t"
12300 "1:\n"
12301 @@ -211,13 +227,29 @@ static inline int arch_write_trylock(arch_rwlock_t *lock)
12302
12303 static inline void arch_read_unlock(arch_rwlock_t *rw)
12304 {
12305 - asm volatile(LOCK_PREFIX READ_LOCK_SIZE(inc) " %0"
12306 + asm volatile(LOCK_PREFIX READ_LOCK_SIZE(inc) " %0\n"
12307 +
12308 +#ifdef CONFIG_PAX_REFCOUNT
12309 + "jno 0f\n"
12310 + LOCK_PREFIX READ_LOCK_SIZE(dec) " %0\n"
12311 + "int $4\n0:\n"
12312 + _ASM_EXTABLE(0b, 0b)
12313 +#endif
12314 +
12315 :"+m" (rw->lock) : : "memory");
12316 }
12317
12318 static inline void arch_write_unlock(arch_rwlock_t *rw)
12319 {
12320 - asm volatile(LOCK_PREFIX WRITE_LOCK_ADD(%1) "%0"
12321 + asm volatile(LOCK_PREFIX WRITE_LOCK_ADD(%1) "%0\n"
12322 +
12323 +#ifdef CONFIG_PAX_REFCOUNT
12324 + "jno 0f\n"
12325 + LOCK_PREFIX WRITE_LOCK_SUB(%1) "%0\n"
12326 + "int $4\n0:\n"
12327 + _ASM_EXTABLE(0b, 0b)
12328 +#endif
12329 +
12330 : "+m" (rw->write) : "i" (RW_LOCK_BIAS) : "memory");
12331 }
12332
12333 diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h
12334 index 6a99859..03cb807 100644
12335 --- a/arch/x86/include/asm/stackprotector.h
12336 +++ b/arch/x86/include/asm/stackprotector.h
12337 @@ -47,7 +47,7 @@
12338 * head_32 for boot CPU and setup_per_cpu_areas() for others.
12339 */
12340 #define GDT_STACK_CANARY_INIT \
12341 - [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18),
12342 + [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x17),
12343
12344 /*
12345 * Initialize the stackprotector canary value.
12346 @@ -112,7 +112,7 @@ static inline void setup_stack_canary_segment(int cpu)
12347
12348 static inline void load_stack_canary_segment(void)
12349 {
12350 -#ifdef CONFIG_X86_32
12351 +#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
12352 asm volatile ("mov %0, %%gs" : : "r" (0));
12353 #endif
12354 }
12355 diff --git a/arch/x86/include/asm/stacktrace.h b/arch/x86/include/asm/stacktrace.h
12356 index 70bbe39..4ae2bd4 100644
12357 --- a/arch/x86/include/asm/stacktrace.h
12358 +++ b/arch/x86/include/asm/stacktrace.h
12359 @@ -11,28 +11,20 @@
12360
12361 extern int kstack_depth_to_print;
12362
12363 -struct thread_info;
12364 +struct task_struct;
12365 struct stacktrace_ops;
12366
12367 -typedef unsigned long (*walk_stack_t)(struct thread_info *tinfo,
12368 - unsigned long *stack,
12369 - unsigned long bp,
12370 - const struct stacktrace_ops *ops,
12371 - void *data,
12372 - unsigned long *end,
12373 - int *graph);
12374 +typedef unsigned long walk_stack_t(struct task_struct *task,
12375 + void *stack_start,
12376 + unsigned long *stack,
12377 + unsigned long bp,
12378 + const struct stacktrace_ops *ops,
12379 + void *data,
12380 + unsigned long *end,
12381 + int *graph);
12382
12383 -extern unsigned long
12384 -print_context_stack(struct thread_info *tinfo,
12385 - unsigned long *stack, unsigned long bp,
12386 - const struct stacktrace_ops *ops, void *data,
12387 - unsigned long *end, int *graph);
12388 -
12389 -extern unsigned long
12390 -print_context_stack_bp(struct thread_info *tinfo,
12391 - unsigned long *stack, unsigned long bp,
12392 - const struct stacktrace_ops *ops, void *data,
12393 - unsigned long *end, int *graph);
12394 +extern walk_stack_t print_context_stack;
12395 +extern walk_stack_t print_context_stack_bp;
12396
12397 /* Generic stack tracer with callbacks */
12398
12399 @@ -40,7 +32,7 @@ struct stacktrace_ops {
12400 void (*address)(void *data, unsigned long address, int reliable);
12401 /* On negative return stop dumping */
12402 int (*stack)(void *data, char *name);
12403 - walk_stack_t walk_stack;
12404 + walk_stack_t *walk_stack;
12405 };
12406
12407 void dump_trace(struct task_struct *tsk, struct pt_regs *regs,
12408 diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
12409 index 4ec45b3..a4f0a8a 100644
12410 --- a/arch/x86/include/asm/switch_to.h
12411 +++ b/arch/x86/include/asm/switch_to.h
12412 @@ -108,7 +108,7 @@ do { \
12413 "call __switch_to\n\t" \
12414 "movq "__percpu_arg([current_task])",%%rsi\n\t" \
12415 __switch_canary \
12416 - "movq %P[thread_info](%%rsi),%%r8\n\t" \
12417 + "movq "__percpu_arg([thread_info])",%%r8\n\t" \
12418 "movq %%rax,%%rdi\n\t" \
12419 "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
12420 "jnz ret_from_fork\n\t" \
12421 @@ -119,7 +119,7 @@ do { \
12422 [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
12423 [ti_flags] "i" (offsetof(struct thread_info, flags)), \
12424 [_tif_fork] "i" (_TIF_FORK), \
12425 - [thread_info] "i" (offsetof(struct task_struct, stack)), \
12426 + [thread_info] "m" (current_tinfo), \
12427 [current_task] "m" (current_task) \
12428 __switch_canary_iparam \
12429 : "memory", "cc" __EXTRA_CLOBBER)
12430 diff --git a/arch/x86/include/asm/sys_ia32.h b/arch/x86/include/asm/sys_ia32.h
12431 index 3fda9db4..4ca1c61 100644
12432 --- a/arch/x86/include/asm/sys_ia32.h
12433 +++ b/arch/x86/include/asm/sys_ia32.h
12434 @@ -40,7 +40,7 @@ asmlinkage long sys32_sigaction(int, struct old_sigaction32 __user *,
12435 struct old_sigaction32 __user *);
12436 asmlinkage long sys32_alarm(unsigned int);
12437
12438 -asmlinkage long sys32_waitpid(compat_pid_t, unsigned int *, int);
12439 +asmlinkage long sys32_waitpid(compat_pid_t, unsigned int __user *, int);
12440 asmlinkage long sys32_sysfs(int, u32, u32);
12441
12442 asmlinkage long sys32_sched_rr_get_interval(compat_pid_t,
12443 diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
12444 index 89f794f..1422765 100644
12445 --- a/arch/x86/include/asm/thread_info.h
12446 +++ b/arch/x86/include/asm/thread_info.h
12447 @@ -10,6 +10,7 @@
12448 #include <linux/compiler.h>
12449 #include <asm/page.h>
12450 #include <asm/types.h>
12451 +#include <asm/percpu.h>
12452
12453 /*
12454 * low level task data that entry.S needs immediate access to
12455 @@ -24,7 +25,6 @@ struct exec_domain;
12456 #include <linux/atomic.h>
12457
12458 struct thread_info {
12459 - struct task_struct *task; /* main task structure */
12460 struct exec_domain *exec_domain; /* execution domain */
12461 __u32 flags; /* low level flags */
12462 __u32 status; /* thread synchronous flags */
12463 @@ -34,19 +34,13 @@ struct thread_info {
12464 mm_segment_t addr_limit;
12465 struct restart_block restart_block;
12466 void __user *sysenter_return;
12467 -#ifdef CONFIG_X86_32
12468 - unsigned long previous_esp; /* ESP of the previous stack in
12469 - case of nested (IRQ) stacks
12470 - */
12471 - __u8 supervisor_stack[0];
12472 -#endif
12473 + unsigned long lowest_stack;
12474 unsigned int sig_on_uaccess_error:1;
12475 unsigned int uaccess_err:1; /* uaccess failed */
12476 };
12477
12478 -#define INIT_THREAD_INFO(tsk) \
12479 +#define INIT_THREAD_INFO \
12480 { \
12481 - .task = &tsk, \
12482 .exec_domain = &default_exec_domain, \
12483 .flags = 0, \
12484 .cpu = 0, \
12485 @@ -57,7 +51,7 @@ struct thread_info {
12486 }, \
12487 }
12488
12489 -#define init_thread_info (init_thread_union.thread_info)
12490 +#define init_thread_info (init_thread_union.stack)
12491 #define init_stack (init_thread_union.stack)
12492
12493 #else /* !__ASSEMBLY__ */
12494 @@ -98,6 +92,7 @@ struct thread_info {
12495 #define TIF_SYSCALL_TRACEPOINT 28 /* syscall tracepoint instrumentation */
12496 #define TIF_ADDR32 29 /* 32-bit address space on 64 bits */
12497 #define TIF_X32 30 /* 32-bit native x86-64 binary */
12498 +#define TIF_GRSEC_SETXID 31 /* update credentials on syscall entry/exit */
12499
12500 #define _TIF_SYSCALL_TRACE (1 << TIF_SYSCALL_TRACE)
12501 #define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME)
12502 @@ -122,16 +117,18 @@ struct thread_info {
12503 #define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT)
12504 #define _TIF_ADDR32 (1 << TIF_ADDR32)
12505 #define _TIF_X32 (1 << TIF_X32)
12506 +#define _TIF_GRSEC_SETXID (1 << TIF_GRSEC_SETXID)
12507
12508 /* work to do in syscall_trace_enter() */
12509 #define _TIF_WORK_SYSCALL_ENTRY \
12510 (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_EMU | _TIF_SYSCALL_AUDIT | \
12511 - _TIF_SECCOMP | _TIF_SINGLESTEP | _TIF_SYSCALL_TRACEPOINT)
12512 + _TIF_SECCOMP | _TIF_SINGLESTEP | _TIF_SYSCALL_TRACEPOINT | \
12513 + _TIF_GRSEC_SETXID)
12514
12515 /* work to do in syscall_trace_leave() */
12516 #define _TIF_WORK_SYSCALL_EXIT \
12517 (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_SINGLESTEP | \
12518 - _TIF_SYSCALL_TRACEPOINT)
12519 + _TIF_SYSCALL_TRACEPOINT | _TIF_GRSEC_SETXID)
12520
12521 /* work to do on interrupt/exception return */
12522 #define _TIF_WORK_MASK \
12523 @@ -141,7 +138,8 @@ struct thread_info {
12524
12525 /* work to do on any return to user space */
12526 #define _TIF_ALLWORK_MASK \
12527 - ((0x0000FFFF & ~_TIF_SECCOMP) | _TIF_SYSCALL_TRACEPOINT)
12528 + ((0x0000FFFF & ~_TIF_SECCOMP) | _TIF_SYSCALL_TRACEPOINT | \
12529 + _TIF_GRSEC_SETXID)
12530
12531 /* Only used for 64 bit */
12532 #define _TIF_DO_NOTIFY_MASK \
12533 @@ -157,45 +155,40 @@ struct thread_info {
12534
12535 #define PREEMPT_ACTIVE 0x10000000
12536
12537 -#ifdef CONFIG_X86_32
12538 -
12539 -#define STACK_WARN (THREAD_SIZE/8)
12540 -/*
12541 - * macros/functions for gaining access to the thread information structure
12542 - *
12543 - * preempt_count needs to be 1 initially, until the scheduler is functional.
12544 - */
12545 -#ifndef __ASSEMBLY__
12546 -
12547 -
12548 -/* how to get the current stack pointer from C */
12549 -register unsigned long current_stack_pointer asm("esp") __used;
12550 -
12551 -/* how to get the thread information struct from C */
12552 -static inline struct thread_info *current_thread_info(void)
12553 -{
12554 - return (struct thread_info *)
12555 - (current_stack_pointer & ~(THREAD_SIZE - 1));
12556 -}
12557 -
12558 -#else /* !__ASSEMBLY__ */
12559 -
12560 +#ifdef __ASSEMBLY__
12561 /* how to get the thread information struct from ASM */
12562 #define GET_THREAD_INFO(reg) \
12563 - movl $-THREAD_SIZE, reg; \
12564 - andl %esp, reg
12565 + mov PER_CPU_VAR(current_tinfo), reg
12566
12567 /* use this one if reg already contains %esp */
12568 -#define GET_THREAD_INFO_WITH_ESP(reg) \
12569 - andl $-THREAD_SIZE, reg
12570 +#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
12571 +#else
12572 +/* how to get the thread information struct from C */
12573 +DECLARE_PER_CPU(struct thread_info *, current_tinfo);
12574 +
12575 +static __always_inline struct thread_info *current_thread_info(void)
12576 +{
12577 + return this_cpu_read_stable(current_tinfo);
12578 +}
12579 +#endif
12580 +
12581 +#ifdef CONFIG_X86_32
12582 +
12583 +#define STACK_WARN (THREAD_SIZE/8)
12584 +/*
12585 + * macros/functions for gaining access to the thread information structure
12586 + *
12587 + * preempt_count needs to be 1 initially, until the scheduler is functional.
12588 + */
12589 +#ifndef __ASSEMBLY__
12590 +
12591 +/* how to get the current stack pointer from C */
12592 +register unsigned long current_stack_pointer asm("esp") __used;
12593
12594 #endif
12595
12596 #else /* X86_32 */
12597
12598 -#include <asm/percpu.h>
12599 -#define KERNEL_STACK_OFFSET (5*8)
12600 -
12601 /*
12602 * macros/functions for gaining access to the thread information structure
12603 * preempt_count needs to be 1 initially, until the scheduler is functional.
12604 @@ -203,27 +196,8 @@ static inline struct thread_info *current_thread_info(void)
12605 #ifndef __ASSEMBLY__
12606 DECLARE_PER_CPU(unsigned long, kernel_stack);
12607
12608 -static inline struct thread_info *current_thread_info(void)
12609 -{
12610 - struct thread_info *ti;
12611 - ti = (void *)(this_cpu_read_stable(kernel_stack) +
12612 - KERNEL_STACK_OFFSET - THREAD_SIZE);
12613 - return ti;
12614 -}
12615 -
12616 -#else /* !__ASSEMBLY__ */
12617 -
12618 -/* how to get the thread information struct from ASM */
12619 -#define GET_THREAD_INFO(reg) \
12620 - movq PER_CPU_VAR(kernel_stack),reg ; \
12621 - subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
12622 -
12623 -/*
12624 - * Same if PER_CPU_VAR(kernel_stack) is, perhaps with some offset, already in
12625 - * a certain register (to be used in assembler memory operands).
12626 - */
12627 -#define THREAD_INFO(reg, off) KERNEL_STACK_OFFSET+(off)-THREAD_SIZE(reg)
12628 -
12629 +/* how to get the current stack pointer from C */
12630 +register unsigned long current_stack_pointer asm("rsp") __used;
12631 #endif
12632
12633 #endif /* !X86_32 */
12634 @@ -284,5 +258,12 @@ static inline bool is_ia32_task(void)
12635 extern void arch_task_cache_init(void);
12636 extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
12637 extern void arch_release_task_struct(struct task_struct *tsk);
12638 +
12639 +#define __HAVE_THREAD_FUNCTIONS
12640 +#define task_thread_info(task) (&(task)->tinfo)
12641 +#define task_stack_page(task) ((task)->stack)
12642 +#define setup_thread_stack(p, org) do {} while (0)
12643 +#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
12644 +
12645 #endif
12646 #endif /* _ASM_X86_THREAD_INFO_H */
12647 diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
12648 index e1f3a17..1ab364d 100644
12649 --- a/arch/x86/include/asm/uaccess.h
12650 +++ b/arch/x86/include/asm/uaccess.h
12651 @@ -7,12 +7,15 @@
12652 #include <linux/compiler.h>
12653 #include <linux/thread_info.h>
12654 #include <linux/string.h>
12655 +#include <linux/sched.h>
12656 #include <asm/asm.h>
12657 #include <asm/page.h>
12658
12659 #define VERIFY_READ 0
12660 #define VERIFY_WRITE 1
12661
12662 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
12663 +
12664 /*
12665 * The fs value determines whether argument validity checking should be
12666 * performed or not. If get_fs() == USER_DS, checking is performed, with
12667 @@ -28,7 +31,12 @@
12668
12669 #define get_ds() (KERNEL_DS)
12670 #define get_fs() (current_thread_info()->addr_limit)
12671 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
12672 +void __set_fs(mm_segment_t x);
12673 +void set_fs(mm_segment_t x);
12674 +#else
12675 #define set_fs(x) (current_thread_info()->addr_limit = (x))
12676 +#endif
12677
12678 #define segment_eq(a, b) ((a).seg == (b).seg)
12679
12680 @@ -76,8 +84,33 @@
12681 * checks that the pointer is in the user space range - after calling
12682 * this function, memory access functions may still return -EFAULT.
12683 */
12684 -#define access_ok(type, addr, size) \
12685 - (likely(__range_not_ok(addr, size, user_addr_max()) == 0))
12686 +#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size, user_addr_max()) == 0))
12687 +#define access_ok(type, addr, size) \
12688 +({ \
12689 + long __size = size; \
12690 + unsigned long __addr = (unsigned long)addr; \
12691 + unsigned long __addr_ao = __addr & PAGE_MASK; \
12692 + unsigned long __end_ao = __addr + __size - 1; \
12693 + bool __ret_ao = __range_not_ok(__addr, __size, user_addr_max()) == 0;\
12694 + if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
12695 + while(__addr_ao <= __end_ao) { \
12696 + char __c_ao; \
12697 + __addr_ao += PAGE_SIZE; \
12698 + if (__size > PAGE_SIZE) \
12699 + cond_resched(); \
12700 + if (__get_user(__c_ao, (char __user *)__addr)) \
12701 + break; \
12702 + if (type != VERIFY_WRITE) { \
12703 + __addr = __addr_ao; \
12704 + continue; \
12705 + } \
12706 + if (__put_user(__c_ao, (char __user *)__addr)) \
12707 + break; \
12708 + __addr = __addr_ao; \
12709 + } \
12710 + } \
12711 + __ret_ao; \
12712 +})
12713
12714 /*
12715 * The exception table consists of pairs of addresses relative to the
12716 @@ -188,12 +221,20 @@ extern int __get_user_bad(void);
12717 asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
12718 : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
12719
12720 -
12721 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
12722 +#define __copyuser_seg "gs;"
12723 +#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
12724 +#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
12725 +#else
12726 +#define __copyuser_seg
12727 +#define __COPYUSER_SET_ES
12728 +#define __COPYUSER_RESTORE_ES
12729 +#endif
12730
12731 #ifdef CONFIG_X86_32
12732 #define __put_user_asm_u64(x, addr, err, errret) \
12733 - asm volatile("1: movl %%eax,0(%2)\n" \
12734 - "2: movl %%edx,4(%2)\n" \
12735 + asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \
12736 + "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
12737 "3:\n" \
12738 ".section .fixup,\"ax\"\n" \
12739 "4: movl %3,%0\n" \
12740 @@ -205,8 +246,8 @@ extern int __get_user_bad(void);
12741 : "A" (x), "r" (addr), "i" (errret), "0" (err))
12742
12743 #define __put_user_asm_ex_u64(x, addr) \
12744 - asm volatile("1: movl %%eax,0(%1)\n" \
12745 - "2: movl %%edx,4(%1)\n" \
12746 + asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \
12747 + "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
12748 "3:\n" \
12749 _ASM_EXTABLE_EX(1b, 2b) \
12750 _ASM_EXTABLE_EX(2b, 3b) \
12751 @@ -258,7 +299,7 @@ extern void __put_user_8(void);
12752 __typeof__(*(ptr)) __pu_val; \
12753 __chk_user_ptr(ptr); \
12754 might_fault(); \
12755 - __pu_val = x; \
12756 + __pu_val = (x); \
12757 switch (sizeof(*(ptr))) { \
12758 case 1: \
12759 __put_user_x(1, __pu_val, ptr, __ret_pu); \
12760 @@ -379,7 +420,7 @@ do { \
12761 } while (0)
12762
12763 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
12764 - asm volatile("1: mov"itype" %2,%"rtype"1\n" \
12765 + asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
12766 "2:\n" \
12767 ".section .fixup,\"ax\"\n" \
12768 "3: mov %3,%0\n" \
12769 @@ -387,7 +428,7 @@ do { \
12770 " jmp 2b\n" \
12771 ".previous\n" \
12772 _ASM_EXTABLE(1b, 3b) \
12773 - : "=r" (err), ltype(x) \
12774 + : "=r" (err), ltype (x) \
12775 : "m" (__m(addr)), "i" (errret), "0" (err))
12776
12777 #define __get_user_size_ex(x, ptr, size) \
12778 @@ -412,7 +453,7 @@ do { \
12779 } while (0)
12780
12781 #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
12782 - asm volatile("1: mov"itype" %1,%"rtype"0\n" \
12783 + asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
12784 "2:\n" \
12785 _ASM_EXTABLE_EX(1b, 2b) \
12786 : ltype(x) : "m" (__m(addr)))
12787 @@ -429,13 +470,24 @@ do { \
12788 int __gu_err; \
12789 unsigned long __gu_val; \
12790 __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
12791 - (x) = (__force __typeof__(*(ptr)))__gu_val; \
12792 + (x) = (__typeof__(*(ptr)))__gu_val; \
12793 __gu_err; \
12794 })
12795
12796 /* FIXME: this hack is definitely wrong -AK */
12797 struct __large_struct { unsigned long buf[100]; };
12798 -#define __m(x) (*(struct __large_struct __user *)(x))
12799 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12800 +#define ____m(x) \
12801 +({ \
12802 + unsigned long ____x = (unsigned long)(x); \
12803 + if (____x < PAX_USER_SHADOW_BASE) \
12804 + ____x += PAX_USER_SHADOW_BASE; \
12805 + (void __user *)____x; \
12806 +})
12807 +#else
12808 +#define ____m(x) (x)
12809 +#endif
12810 +#define __m(x) (*(struct __large_struct __user *)____m(x))
12811
12812 /*
12813 * Tell gcc we read from memory instead of writing: this is because
12814 @@ -443,7 +495,7 @@ struct __large_struct { unsigned long buf[100]; };
12815 * aliasing issues.
12816 */
12817 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
12818 - asm volatile("1: mov"itype" %"rtype"1,%2\n" \
12819 + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
12820 "2:\n" \
12821 ".section .fixup,\"ax\"\n" \
12822 "3: mov %3,%0\n" \
12823 @@ -451,10 +503,10 @@ struct __large_struct { unsigned long buf[100]; };
12824 ".previous\n" \
12825 _ASM_EXTABLE(1b, 3b) \
12826 : "=r"(err) \
12827 - : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
12828 + : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
12829
12830 #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
12831 - asm volatile("1: mov"itype" %"rtype"0,%1\n" \
12832 + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
12833 "2:\n" \
12834 _ASM_EXTABLE_EX(1b, 2b) \
12835 : : ltype(x), "m" (__m(addr)))
12836 @@ -493,8 +545,12 @@ struct __large_struct { unsigned long buf[100]; };
12837 * On error, the variable @x is set to zero.
12838 */
12839
12840 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12841 +#define __get_user(x, ptr) get_user((x), (ptr))
12842 +#else
12843 #define __get_user(x, ptr) \
12844 __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
12845 +#endif
12846
12847 /**
12848 * __put_user: - Write a simple value into user space, with less checking.
12849 @@ -516,8 +572,12 @@ struct __large_struct { unsigned long buf[100]; };
12850 * Returns zero on success, or -EFAULT on error.
12851 */
12852
12853 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12854 +#define __put_user(x, ptr) put_user((x), (ptr))
12855 +#else
12856 #define __put_user(x, ptr) \
12857 __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
12858 +#endif
12859
12860 #define __get_user_unaligned __get_user
12861 #define __put_user_unaligned __put_user
12862 @@ -535,7 +595,7 @@ struct __large_struct { unsigned long buf[100]; };
12863 #define get_user_ex(x, ptr) do { \
12864 unsigned long __gue_val; \
12865 __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
12866 - (x) = (__force __typeof__(*(ptr)))__gue_val; \
12867 + (x) = (__typeof__(*(ptr)))__gue_val; \
12868 } while (0)
12869
12870 #ifdef CONFIG_X86_WP_WORKS_OK
12871 diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h
12872 index 576e39b..ccd0a39 100644
12873 --- a/arch/x86/include/asm/uaccess_32.h
12874 +++ b/arch/x86/include/asm/uaccess_32.h
12875 @@ -11,15 +11,15 @@
12876 #include <asm/page.h>
12877
12878 unsigned long __must_check __copy_to_user_ll
12879 - (void __user *to, const void *from, unsigned long n);
12880 + (void __user *to, const void *from, unsigned long n) __size_overflow(3);
12881 unsigned long __must_check __copy_from_user_ll
12882 - (void *to, const void __user *from, unsigned long n);
12883 + (void *to, const void __user *from, unsigned long n) __size_overflow(3);
12884 unsigned long __must_check __copy_from_user_ll_nozero
12885 - (void *to, const void __user *from, unsigned long n);
12886 + (void *to, const void __user *from, unsigned long n) __size_overflow(3);
12887 unsigned long __must_check __copy_from_user_ll_nocache
12888 - (void *to, const void __user *from, unsigned long n);
12889 + (void *to, const void __user *from, unsigned long n) __size_overflow(3);
12890 unsigned long __must_check __copy_from_user_ll_nocache_nozero
12891 - (void *to, const void __user *from, unsigned long n);
12892 + (void *to, const void __user *from, unsigned long n) __size_overflow(3);
12893
12894 /**
12895 * __copy_to_user_inatomic: - Copy a block of data into user space, with less checking.
12896 @@ -43,6 +43,9 @@ unsigned long __must_check __copy_from_user_ll_nocache_nozero
12897 static __always_inline unsigned long __must_check
12898 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
12899 {
12900 + if ((long)n < 0)
12901 + return n;
12902 +
12903 if (__builtin_constant_p(n)) {
12904 unsigned long ret;
12905
12906 @@ -61,6 +64,8 @@ __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
12907 return ret;
12908 }
12909 }
12910 + if (!__builtin_constant_p(n))
12911 + check_object_size(from, n, true);
12912 return __copy_to_user_ll(to, from, n);
12913 }
12914
12915 @@ -82,12 +87,16 @@ static __always_inline unsigned long __must_check
12916 __copy_to_user(void __user *to, const void *from, unsigned long n)
12917 {
12918 might_fault();
12919 +
12920 return __copy_to_user_inatomic(to, from, n);
12921 }
12922
12923 static __always_inline unsigned long
12924 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
12925 {
12926 + if ((long)n < 0)
12927 + return n;
12928 +
12929 /* Avoid zeroing the tail if the copy fails..
12930 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
12931 * but as the zeroing behaviour is only significant when n is not
12932 @@ -137,6 +146,10 @@ static __always_inline unsigned long
12933 __copy_from_user(void *to, const void __user *from, unsigned long n)
12934 {
12935 might_fault();
12936 +
12937 + if ((long)n < 0)
12938 + return n;
12939 +
12940 if (__builtin_constant_p(n)) {
12941 unsigned long ret;
12942
12943 @@ -152,6 +165,8 @@ __copy_from_user(void *to, const void __user *from, unsigned long n)
12944 return ret;
12945 }
12946 }
12947 + if (!__builtin_constant_p(n))
12948 + check_object_size(to, n, false);
12949 return __copy_from_user_ll(to, from, n);
12950 }
12951
12952 @@ -159,6 +174,10 @@ static __always_inline unsigned long __copy_from_user_nocache(void *to,
12953 const void __user *from, unsigned long n)
12954 {
12955 might_fault();
12956 +
12957 + if ((long)n < 0)
12958 + return n;
12959 +
12960 if (__builtin_constant_p(n)) {
12961 unsigned long ret;
12962
12963 @@ -181,15 +200,19 @@ static __always_inline unsigned long
12964 __copy_from_user_inatomic_nocache(void *to, const void __user *from,
12965 unsigned long n)
12966 {
12967 - return __copy_from_user_ll_nocache_nozero(to, from, n);
12968 + if ((long)n < 0)
12969 + return n;
12970 +
12971 + return __copy_from_user_ll_nocache_nozero(to, from, n);
12972 }
12973
12974 -unsigned long __must_check copy_to_user(void __user *to,
12975 - const void *from, unsigned long n);
12976 -unsigned long __must_check _copy_from_user(void *to,
12977 - const void __user *from,
12978 - unsigned long n);
12979 -
12980 +extern void copy_to_user_overflow(void)
12981 +#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
12982 + __compiletime_error("copy_to_user() buffer size is not provably correct")
12983 +#else
12984 + __compiletime_warning("copy_to_user() buffer size is not provably correct")
12985 +#endif
12986 +;
12987
12988 extern void copy_from_user_overflow(void)
12989 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
12990 @@ -199,21 +222,65 @@ extern void copy_from_user_overflow(void)
12991 #endif
12992 ;
12993
12994 -static inline unsigned long __must_check copy_from_user(void *to,
12995 - const void __user *from,
12996 - unsigned long n)
12997 +/**
12998 + * copy_to_user: - Copy a block of data into user space.
12999 + * @to: Destination address, in user space.
13000 + * @from: Source address, in kernel space.
13001 + * @n: Number of bytes to copy.
13002 + *
13003 + * Context: User context only. This function may sleep.
13004 + *
13005 + * Copy data from kernel space to user space.
13006 + *
13007 + * Returns number of bytes that could not be copied.
13008 + * On success, this will be zero.
13009 + */
13010 +static inline unsigned long __must_check
13011 +copy_to_user(void __user *to, const void *from, unsigned long n)
13012 {
13013 - int sz = __compiletime_object_size(to);
13014 + size_t sz = __compiletime_object_size(from);
13015
13016 - if (likely(sz == -1 || sz >= n))
13017 - n = _copy_from_user(to, from, n);
13018 - else
13019 + if (unlikely(sz != (size_t)-1 && sz < n))
13020 + copy_to_user_overflow();
13021 + else if (access_ok(VERIFY_WRITE, to, n))
13022 + n = __copy_to_user(to, from, n);
13023 + return n;
13024 +}
13025 +
13026 +/**
13027 + * copy_from_user: - Copy a block of data from user space.
13028 + * @to: Destination address, in kernel space.
13029 + * @from: Source address, in user space.
13030 + * @n: Number of bytes to copy.
13031 + *
13032 + * Context: User context only. This function may sleep.
13033 + *
13034 + * Copy data from user space to kernel space.
13035 + *
13036 + * Returns number of bytes that could not be copied.
13037 + * On success, this will be zero.
13038 + *
13039 + * If some data could not be copied, this function will pad the copied
13040 + * data to the requested size using zero bytes.
13041 + */
13042 +static inline unsigned long __must_check
13043 +copy_from_user(void *to, const void __user *from, unsigned long n)
13044 +{
13045 + size_t sz = __compiletime_object_size(to);
13046 +
13047 + if (unlikely(sz != (size_t)-1 && sz < n))
13048 copy_from_user_overflow();
13049 -
13050 + else if (access_ok(VERIFY_READ, from, n))
13051 + n = __copy_from_user(to, from, n);
13052 + else if ((long)n > 0) {
13053 + if (!__builtin_constant_p(n))
13054 + check_object_size(to, n, false);
13055 + memset(to, 0, n);
13056 + }
13057 return n;
13058 }
13059
13060 -unsigned long __must_check clear_user(void __user *mem, unsigned long len);
13061 -unsigned long __must_check __clear_user(void __user *mem, unsigned long len);
13062 +unsigned long __must_check clear_user(void __user *mem, unsigned long len) __size_overflow(2);
13063 +unsigned long __must_check __clear_user(void __user *mem, unsigned long len) __size_overflow(2);
13064
13065 #endif /* _ASM_X86_UACCESS_32_H */
13066 diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
13067 index 8e796fb..468c55a 100644
13068 --- a/arch/x86/include/asm/uaccess_64.h
13069 +++ b/arch/x86/include/asm/uaccess_64.h
13070 @@ -10,6 +10,9 @@
13071 #include <asm/alternative.h>
13072 #include <asm/cpufeature.h>
13073 #include <asm/page.h>
13074 +#include <asm/pgtable.h>
13075 +
13076 +#define set_fs(x) (current_thread_info()->addr_limit = (x))
13077
13078 /*
13079 * Copy To/From Userspace
13080 @@ -17,12 +20,12 @@
13081
13082 /* Handles exceptions in both to and from, but doesn't do access_ok */
13083 __must_check unsigned long
13084 -copy_user_generic_string(void *to, const void *from, unsigned len);
13085 +copy_user_generic_string(void *to, const void *from, unsigned long len) __size_overflow(3);
13086 __must_check unsigned long
13087 -copy_user_generic_unrolled(void *to, const void *from, unsigned len);
13088 +copy_user_generic_unrolled(void *to, const void *from, unsigned long len) __size_overflow(3);
13089
13090 -static __always_inline __must_check unsigned long
13091 -copy_user_generic(void *to, const void *from, unsigned len)
13092 +static __always_inline __must_check __size_overflow(3) unsigned long
13093 +copy_user_generic(void *to, const void *from, unsigned long len)
13094 {
13095 unsigned ret;
13096
13097 @@ -32,142 +35,238 @@ copy_user_generic(void *to, const void *from, unsigned len)
13098 ASM_OUTPUT2("=a" (ret), "=D" (to), "=S" (from),
13099 "=d" (len)),
13100 "1" (to), "2" (from), "3" (len)
13101 - : "memory", "rcx", "r8", "r9", "r10", "r11");
13102 + : "memory", "rcx", "r8", "r9", "r11");
13103 return ret;
13104 }
13105
13106 +static __always_inline __must_check unsigned long
13107 +__copy_to_user(void __user *to, const void *from, unsigned long len) __size_overflow(3);
13108 +static __always_inline __must_check unsigned long
13109 +__copy_from_user(void *to, const void __user *from, unsigned long len) __size_overflow(3);
13110 __must_check unsigned long
13111 -_copy_to_user(void __user *to, const void *from, unsigned len);
13112 -__must_check unsigned long
13113 -_copy_from_user(void *to, const void __user *from, unsigned len);
13114 -__must_check unsigned long
13115 -copy_in_user(void __user *to, const void __user *from, unsigned len);
13116 +copy_in_user(void __user *to, const void __user *from, unsigned long len) __size_overflow(3);
13117 +
13118 +extern void copy_to_user_overflow(void)
13119 +#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
13120 + __compiletime_error("copy_to_user() buffer size is not provably correct")
13121 +#else
13122 + __compiletime_warning("copy_to_user() buffer size is not provably correct")
13123 +#endif
13124 +;
13125 +
13126 +extern void copy_from_user_overflow(void)
13127 +#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
13128 + __compiletime_error("copy_from_user() buffer size is not provably correct")
13129 +#else
13130 + __compiletime_warning("copy_from_user() buffer size is not provably correct")
13131 +#endif
13132 +;
13133
13134 static inline unsigned long __must_check copy_from_user(void *to,
13135 const void __user *from,
13136 unsigned long n)
13137 {
13138 - int sz = __compiletime_object_size(to);
13139 -
13140 might_fault();
13141 - if (likely(sz == -1 || sz >= n))
13142 - n = _copy_from_user(to, from, n);
13143 -#ifdef CONFIG_DEBUG_VM
13144 - else
13145 - WARN(1, "Buffer overflow detected!\n");
13146 -#endif
13147 +
13148 + if (access_ok(VERIFY_READ, from, n))
13149 + n = __copy_from_user(to, from, n);
13150 + else if (n < INT_MAX) {
13151 + if (!__builtin_constant_p(n))
13152 + check_object_size(to, n, false);
13153 + memset(to, 0, n);
13154 + }
13155 return n;
13156 }
13157
13158 static __always_inline __must_check
13159 -int copy_to_user(void __user *dst, const void *src, unsigned size)
13160 +int copy_to_user(void __user *dst, const void *src, unsigned long size)
13161 {
13162 might_fault();
13163
13164 - return _copy_to_user(dst, src, size);
13165 + if (access_ok(VERIFY_WRITE, dst, size))
13166 + size = __copy_to_user(dst, src, size);
13167 + return size;
13168 }
13169
13170 static __always_inline __must_check
13171 -int __copy_from_user(void *dst, const void __user *src, unsigned size)
13172 +unsigned long __copy_from_user(void *dst, const void __user *src, unsigned long size)
13173 {
13174 - int ret = 0;
13175 + size_t sz = __compiletime_object_size(dst);
13176 + unsigned ret = 0;
13177
13178 might_fault();
13179 - if (!__builtin_constant_p(size))
13180 - return copy_user_generic(dst, (__force void *)src, size);
13181 +
13182 + if (size > INT_MAX)
13183 + return size;
13184 +
13185 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13186 + if (!__access_ok(VERIFY_READ, src, size))
13187 + return size;
13188 +#endif
13189 +
13190 + if (unlikely(sz != (size_t)-1 && sz < size)) {
13191 + copy_from_user_overflow();
13192 + return size;
13193 + }
13194 +
13195 + if (!__builtin_constant_p(size)) {
13196 + check_object_size(dst, size, false);
13197 +
13198 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13199 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
13200 + src += PAX_USER_SHADOW_BASE;
13201 +#endif
13202 +
13203 + return copy_user_generic(dst, (__force_kernel const void *)src, size);
13204 + }
13205 switch (size) {
13206 - case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
13207 + case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
13208 ret, "b", "b", "=q", 1);
13209 return ret;
13210 - case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
13211 + case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
13212 ret, "w", "w", "=r", 2);
13213 return ret;
13214 - case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
13215 + case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
13216 ret, "l", "k", "=r", 4);
13217 return ret;
13218 - case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
13219 + case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
13220 ret, "q", "", "=r", 8);
13221 return ret;
13222 case 10:
13223 - __get_user_asm(*(u64 *)dst, (u64 __user *)src,
13224 + __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
13225 ret, "q", "", "=r", 10);
13226 if (unlikely(ret))
13227 return ret;
13228 __get_user_asm(*(u16 *)(8 + (char *)dst),
13229 - (u16 __user *)(8 + (char __user *)src),
13230 + (const u16 __user *)(8 + (const char __user *)src),
13231 ret, "w", "w", "=r", 2);
13232 return ret;
13233 case 16:
13234 - __get_user_asm(*(u64 *)dst, (u64 __user *)src,
13235 + __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
13236 ret, "q", "", "=r", 16);
13237 if (unlikely(ret))
13238 return ret;
13239 __get_user_asm(*(u64 *)(8 + (char *)dst),
13240 - (u64 __user *)(8 + (char __user *)src),
13241 + (const u64 __user *)(8 + (const char __user *)src),
13242 ret, "q", "", "=r", 8);
13243 return ret;
13244 default:
13245 - return copy_user_generic(dst, (__force void *)src, size);
13246 +
13247 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13248 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
13249 + src += PAX_USER_SHADOW_BASE;
13250 +#endif
13251 +
13252 + return copy_user_generic(dst, (__force_kernel const void *)src, size);
13253 }
13254 }
13255
13256 static __always_inline __must_check
13257 -int __copy_to_user(void __user *dst, const void *src, unsigned size)
13258 +unsigned long __copy_to_user(void __user *dst, const void *src, unsigned long size)
13259 {
13260 - int ret = 0;
13261 + size_t sz = __compiletime_object_size(src);
13262 + unsigned ret = 0;
13263
13264 might_fault();
13265 - if (!__builtin_constant_p(size))
13266 - return copy_user_generic((__force void *)dst, src, size);
13267 +
13268 + if (size > INT_MAX)
13269 + return size;
13270 +
13271 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13272 + if (!__access_ok(VERIFY_WRITE, dst, size))
13273 + return size;
13274 +#endif
13275 +
13276 + if (unlikely(sz != (size_t)-1 && sz < size)) {
13277 + copy_to_user_overflow();
13278 + return size;
13279 + }
13280 +
13281 + if (!__builtin_constant_p(size)) {
13282 + check_object_size(src, size, true);
13283 +
13284 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13285 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
13286 + dst += PAX_USER_SHADOW_BASE;
13287 +#endif
13288 +
13289 + return copy_user_generic((__force_kernel void *)dst, src, size);
13290 + }
13291 switch (size) {
13292 - case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
13293 + case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
13294 ret, "b", "b", "iq", 1);
13295 return ret;
13296 - case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
13297 + case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
13298 ret, "w", "w", "ir", 2);
13299 return ret;
13300 - case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
13301 + case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
13302 ret, "l", "k", "ir", 4);
13303 return ret;
13304 - case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
13305 + case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
13306 ret, "q", "", "er", 8);
13307 return ret;
13308 case 10:
13309 - __put_user_asm(*(u64 *)src, (u64 __user *)dst,
13310 + __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
13311 ret, "q", "", "er", 10);
13312 if (unlikely(ret))
13313 return ret;
13314 asm("":::"memory");
13315 - __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
13316 + __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
13317 ret, "w", "w", "ir", 2);
13318 return ret;
13319 case 16:
13320 - __put_user_asm(*(u64 *)src, (u64 __user *)dst,
13321 + __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
13322 ret, "q", "", "er", 16);
13323 if (unlikely(ret))
13324 return ret;
13325 asm("":::"memory");
13326 - __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
13327 + __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
13328 ret, "q", "", "er", 8);
13329 return ret;
13330 default:
13331 - return copy_user_generic((__force void *)dst, src, size);
13332 +
13333 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13334 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
13335 + dst += PAX_USER_SHADOW_BASE;
13336 +#endif
13337 +
13338 + return copy_user_generic((__force_kernel void *)dst, src, size);
13339 }
13340 }
13341
13342 static __always_inline __must_check
13343 -int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
13344 +unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned long size)
13345 {
13346 - int ret = 0;
13347 + unsigned ret = 0;
13348
13349 might_fault();
13350 - if (!__builtin_constant_p(size))
13351 - return copy_user_generic((__force void *)dst,
13352 - (__force void *)src, size);
13353 +
13354 + if (size > INT_MAX)
13355 + return size;
13356 +
13357 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13358 + if (!__access_ok(VERIFY_READ, src, size))
13359 + return size;
13360 + if (!__access_ok(VERIFY_WRITE, dst, size))
13361 + return size;
13362 +#endif
13363 +
13364 + if (!__builtin_constant_p(size)) {
13365 +
13366 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13367 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
13368 + src += PAX_USER_SHADOW_BASE;
13369 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
13370 + dst += PAX_USER_SHADOW_BASE;
13371 +#endif
13372 +
13373 + return copy_user_generic((__force_kernel void *)dst,
13374 + (__force_kernel const void *)src, size);
13375 + }
13376 switch (size) {
13377 case 1: {
13378 u8 tmp;
13379 - __get_user_asm(tmp, (u8 __user *)src,
13380 + __get_user_asm(tmp, (const u8 __user *)src,
13381 ret, "b", "b", "=q", 1);
13382 if (likely(!ret))
13383 __put_user_asm(tmp, (u8 __user *)dst,
13384 @@ -176,7 +275,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
13385 }
13386 case 2: {
13387 u16 tmp;
13388 - __get_user_asm(tmp, (u16 __user *)src,
13389 + __get_user_asm(tmp, (const u16 __user *)src,
13390 ret, "w", "w", "=r", 2);
13391 if (likely(!ret))
13392 __put_user_asm(tmp, (u16 __user *)dst,
13393 @@ -186,7 +285,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
13394
13395 case 4: {
13396 u32 tmp;
13397 - __get_user_asm(tmp, (u32 __user *)src,
13398 + __get_user_asm(tmp, (const u32 __user *)src,
13399 ret, "l", "k", "=r", 4);
13400 if (likely(!ret))
13401 __put_user_asm(tmp, (u32 __user *)dst,
13402 @@ -195,7 +294,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
13403 }
13404 case 8: {
13405 u64 tmp;
13406 - __get_user_asm(tmp, (u64 __user *)src,
13407 + __get_user_asm(tmp, (const u64 __user *)src,
13408 ret, "q", "", "=r", 8);
13409 if (likely(!ret))
13410 __put_user_asm(tmp, (u64 __user *)dst,
13411 @@ -203,44 +302,89 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
13412 return ret;
13413 }
13414 default:
13415 - return copy_user_generic((__force void *)dst,
13416 - (__force void *)src, size);
13417 +
13418 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13419 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
13420 + src += PAX_USER_SHADOW_BASE;
13421 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
13422 + dst += PAX_USER_SHADOW_BASE;
13423 +#endif
13424 +
13425 + return copy_user_generic((__force_kernel void *)dst,
13426 + (__force_kernel const void *)src, size);
13427 }
13428 }
13429
13430 -__must_check unsigned long clear_user(void __user *mem, unsigned long len);
13431 -__must_check unsigned long __clear_user(void __user *mem, unsigned long len);
13432 +__must_check unsigned long clear_user(void __user *mem, unsigned long len) __size_overflow(2);
13433 +__must_check unsigned long __clear_user(void __user *mem, unsigned long len) __size_overflow(2);
13434
13435 static __must_check __always_inline int
13436 -__copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
13437 +__copy_from_user_inatomic(void *dst, const void __user *src, unsigned long size)
13438 {
13439 - return copy_user_generic(dst, (__force const void *)src, size);
13440 + if (size > INT_MAX)
13441 + return size;
13442 +
13443 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13444 + if (!__access_ok(VERIFY_READ, src, size))
13445 + return size;
13446 +
13447 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
13448 + src += PAX_USER_SHADOW_BASE;
13449 +#endif
13450 +
13451 + return copy_user_generic(dst, (__force_kernel const void *)src, size);
13452 }
13453
13454 -static __must_check __always_inline int
13455 -__copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
13456 +static __must_check __always_inline unsigned long
13457 +__copy_to_user_inatomic(void __user *dst, const void *src, unsigned long size)
13458 {
13459 - return copy_user_generic((__force void *)dst, src, size);
13460 + if (size > INT_MAX)
13461 + return size;
13462 +
13463 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13464 + if (!__access_ok(VERIFY_WRITE, dst, size))
13465 + return size;
13466 +
13467 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
13468 + dst += PAX_USER_SHADOW_BASE;
13469 +#endif
13470 +
13471 + return copy_user_generic((__force_kernel void *)dst, src, size);
13472 }
13473
13474 -extern long __copy_user_nocache(void *dst, const void __user *src,
13475 - unsigned size, int zerorest);
13476 +extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
13477 + unsigned long size, int zerorest) __size_overflow(3);
13478
13479 -static inline int
13480 -__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
13481 +static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned long size)
13482 {
13483 might_sleep();
13484 +
13485 + if (size > INT_MAX)
13486 + return size;
13487 +
13488 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13489 + if (!__access_ok(VERIFY_READ, src, size))
13490 + return size;
13491 +#endif
13492 +
13493 return __copy_user_nocache(dst, src, size, 1);
13494 }
13495
13496 -static inline int
13497 -__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
13498 - unsigned size)
13499 +static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
13500 + unsigned long size)
13501 {
13502 + if (size > INT_MAX)
13503 + return size;
13504 +
13505 +#ifdef CONFIG_PAX_MEMORY_UDEREF
13506 + if (!__access_ok(VERIFY_READ, src, size))
13507 + return size;
13508 +#endif
13509 +
13510 return __copy_user_nocache(dst, src, size, 0);
13511 }
13512
13513 -unsigned long
13514 -copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
13515 +extern unsigned long
13516 +copy_user_handle_tail(char __user *to, char __user *from, unsigned long len, unsigned zerorest) __size_overflow(3);
13517
13518 #endif /* _ASM_X86_UACCESS_64_H */
13519 diff --git a/arch/x86/include/asm/vdso.h b/arch/x86/include/asm/vdso.h
13520 index bb05228..d763d5b 100644
13521 --- a/arch/x86/include/asm/vdso.h
13522 +++ b/arch/x86/include/asm/vdso.h
13523 @@ -11,7 +11,7 @@ extern const char VDSO32_PRELINK[];
13524 #define VDSO32_SYMBOL(base, name) \
13525 ({ \
13526 extern const char VDSO32_##name[]; \
13527 - (void *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
13528 + (void __user *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \
13529 })
13530 #endif
13531
13532 diff --git a/arch/x86/include/asm/word-at-a-time.h b/arch/x86/include/asm/word-at-a-time.h
13533 index 5b238981..77fdd78 100644
13534 --- a/arch/x86/include/asm/word-at-a-time.h
13535 +++ b/arch/x86/include/asm/word-at-a-time.h
13536 @@ -11,7 +11,7 @@
13537 * and shift, for example.
13538 */
13539 struct word_at_a_time {
13540 - const unsigned long one_bits, high_bits;
13541 + unsigned long one_bits, high_bits;
13542 };
13543
13544 #define WORD_AT_A_TIME_CONSTANTS { REPEAT_BYTE(0x01), REPEAT_BYTE(0x80) }
13545 diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h
13546 index c090af1..7e7bf16 100644
13547 --- a/arch/x86/include/asm/x86_init.h
13548 +++ b/arch/x86/include/asm/x86_init.h
13549 @@ -29,7 +29,7 @@ struct x86_init_mpparse {
13550 void (*mpc_oem_bus_info)(struct mpc_bus *m, char *name);
13551 void (*find_smp_config)(void);
13552 void (*get_smp_config)(unsigned int early);
13553 -};
13554 +} __no_const;
13555
13556 /**
13557 * struct x86_init_resources - platform specific resource related ops
13558 @@ -43,7 +43,7 @@ struct x86_init_resources {
13559 void (*probe_roms)(void);
13560 void (*reserve_resources)(void);
13561 char *(*memory_setup)(void);
13562 -};
13563 +} __no_const;
13564
13565 /**
13566 * struct x86_init_irqs - platform specific interrupt setup
13567 @@ -56,7 +56,7 @@ struct x86_init_irqs {
13568 void (*pre_vector_init)(void);
13569 void (*intr_init)(void);
13570 void (*trap_init)(void);
13571 -};
13572 +} __no_const;
13573
13574 /**
13575 * struct x86_init_oem - oem platform specific customizing functions
13576 @@ -66,7 +66,7 @@ struct x86_init_irqs {
13577 struct x86_init_oem {
13578 void (*arch_setup)(void);
13579 void (*banner)(void);
13580 -};
13581 +} __no_const;
13582
13583 /**
13584 * struct x86_init_mapping - platform specific initial kernel pagetable setup
13585 @@ -77,7 +77,7 @@ struct x86_init_oem {
13586 */
13587 struct x86_init_mapping {
13588 void (*pagetable_reserve)(u64 start, u64 end);
13589 -};
13590 +} __no_const;
13591
13592 /**
13593 * struct x86_init_paging - platform specific paging functions
13594 @@ -87,7 +87,7 @@ struct x86_init_mapping {
13595 struct x86_init_paging {
13596 void (*pagetable_setup_start)(pgd_t *base);
13597 void (*pagetable_setup_done)(pgd_t *base);
13598 -};
13599 +} __no_const;
13600
13601 /**
13602 * struct x86_init_timers - platform specific timer setup
13603 @@ -102,7 +102,7 @@ struct x86_init_timers {
13604 void (*tsc_pre_init)(void);
13605 void (*timer_init)(void);
13606 void (*wallclock_init)(void);
13607 -};
13608 +} __no_const;
13609
13610 /**
13611 * struct x86_init_iommu - platform specific iommu setup
13612 @@ -110,7 +110,7 @@ struct x86_init_timers {
13613 */
13614 struct x86_init_iommu {
13615 int (*iommu_init)(void);
13616 -};
13617 +} __no_const;
13618
13619 /**
13620 * struct x86_init_pci - platform specific pci init functions
13621 @@ -124,7 +124,7 @@ struct x86_init_pci {
13622 int (*init)(void);
13623 void (*init_irq)(void);
13624 void (*fixup_irqs)(void);
13625 -};
13626 +} __no_const;
13627
13628 /**
13629 * struct x86_init_ops - functions for platform specific setup
13630 @@ -140,7 +140,7 @@ struct x86_init_ops {
13631 struct x86_init_timers timers;
13632 struct x86_init_iommu iommu;
13633 struct x86_init_pci pci;
13634 -};
13635 +} __no_const;
13636
13637 /**
13638 * struct x86_cpuinit_ops - platform specific cpu hotplug setups
13639 @@ -151,7 +151,7 @@ struct x86_cpuinit_ops {
13640 void (*setup_percpu_clockev)(void);
13641 void (*early_percpu_clock_init)(void);
13642 void (*fixup_cpu_id)(struct cpuinfo_x86 *c, int node);
13643 -};
13644 +} __no_const;
13645
13646 /**
13647 * struct x86_platform_ops - platform specific runtime functions
13648 @@ -177,7 +177,7 @@ struct x86_platform_ops {
13649 int (*i8042_detect)(void);
13650 void (*save_sched_clock_state)(void);
13651 void (*restore_sched_clock_state)(void);
13652 -};
13653 +} __no_const;
13654
13655 struct pci_dev;
13656
13657 @@ -186,14 +186,14 @@ struct x86_msi_ops {
13658 void (*teardown_msi_irq)(unsigned int irq);
13659 void (*teardown_msi_irqs)(struct pci_dev *dev);
13660 void (*restore_msi_irqs)(struct pci_dev *dev, int irq);
13661 -};
13662 +} __no_const;
13663
13664 struct x86_io_apic_ops {
13665 void (*init) (void);
13666 unsigned int (*read) (unsigned int apic, unsigned int reg);
13667 void (*write) (unsigned int apic, unsigned int reg, unsigned int value);
13668 void (*modify)(unsigned int apic, unsigned int reg, unsigned int value);
13669 -};
13670 +} __no_const;
13671
13672 extern struct x86_init_ops x86_init;
13673 extern struct x86_cpuinit_ops x86_cpuinit;
13674 diff --git a/arch/x86/include/asm/xsave.h b/arch/x86/include/asm/xsave.h
13675 index 8a1b6f9..a29c4e4 100644
13676 --- a/arch/x86/include/asm/xsave.h
13677 +++ b/arch/x86/include/asm/xsave.h
13678 @@ -65,6 +65,11 @@ static inline int xsave_user(struct xsave_struct __user *buf)
13679 {
13680 int err;
13681
13682 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
13683 + if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
13684 + buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
13685 +#endif
13686 +
13687 /*
13688 * Clear the xsave header first, so that reserved fields are
13689 * initialized to zero.
13690 @@ -93,10 +98,15 @@ static inline int xsave_user(struct xsave_struct __user *buf)
13691 static inline int xrestore_user(struct xsave_struct __user *buf, u64 mask)
13692 {
13693 int err;
13694 - struct xsave_struct *xstate = ((__force struct xsave_struct *)buf);
13695 + struct xsave_struct *xstate = ((__force_kernel struct xsave_struct *)buf);
13696 u32 lmask = mask;
13697 u32 hmask = mask >> 32;
13698
13699 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
13700 + if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
13701 + xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
13702 +#endif
13703 +
13704 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
13705 "2:\n"
13706 ".section .fixup,\"ax\"\n"
13707 diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
13708 index 95bf99de..de9235c 100644
13709 --- a/arch/x86/kernel/acpi/sleep.c
13710 +++ b/arch/x86/kernel/acpi/sleep.c
13711 @@ -73,8 +73,12 @@ int acpi_suspend_lowlevel(void)
13712 #else /* CONFIG_64BIT */
13713 #ifdef CONFIG_SMP
13714 stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
13715 +
13716 + pax_open_kernel();
13717 early_gdt_descr.address =
13718 (unsigned long)get_cpu_gdt_table(smp_processor_id());
13719 + pax_close_kernel();
13720 +
13721 initial_gs = per_cpu_offset(smp_processor_id());
13722 #endif
13723 initial_code = (unsigned long)wakeup_long64;
13724 diff --git a/arch/x86/kernel/acpi/wakeup_32.S b/arch/x86/kernel/acpi/wakeup_32.S
13725 index 7261083..5c12053 100644
13726 --- a/arch/x86/kernel/acpi/wakeup_32.S
13727 +++ b/arch/x86/kernel/acpi/wakeup_32.S
13728 @@ -30,13 +30,11 @@ wakeup_pmode_return:
13729 # and restore the stack ... but you need gdt for this to work
13730 movl saved_context_esp, %esp
13731
13732 - movl %cs:saved_magic, %eax
13733 - cmpl $0x12345678, %eax
13734 + cmpl $0x12345678, saved_magic
13735 jne bogus_magic
13736
13737 # jump to place where we left off
13738 - movl saved_eip, %eax
13739 - jmp *%eax
13740 + jmp *(saved_eip)
13741
13742 bogus_magic:
13743 jmp bogus_magic
13744 diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
13745 index 73ef56c..0238021 100644
13746 --- a/arch/x86/kernel/alternative.c
13747 +++ b/arch/x86/kernel/alternative.c
13748 @@ -276,6 +276,13 @@ void __init_or_module apply_alternatives(struct alt_instr *start,
13749 */
13750 for (a = start; a < end; a++) {
13751 instr = (u8 *)&a->instr_offset + a->instr_offset;
13752 +
13753 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
13754 + instr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
13755 + if (instr < (u8 *)_text || (u8 *)_einittext <= instr)
13756 + instr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
13757 +#endif
13758 +
13759 replacement = (u8 *)&a->repl_offset + a->repl_offset;
13760 BUG_ON(a->replacementlen > a->instrlen);
13761 BUG_ON(a->instrlen > sizeof(insnbuf));
13762 @@ -307,10 +314,16 @@ static void alternatives_smp_lock(const s32 *start, const s32 *end,
13763 for (poff = start; poff < end; poff++) {
13764 u8 *ptr = (u8 *)poff + *poff;
13765
13766 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
13767 + ptr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
13768 + if (ptr < (u8 *)_text || (u8 *)_einittext <= ptr)
13769 + ptr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
13770 +#endif
13771 +
13772 if (!*poff || ptr < text || ptr >= text_end)
13773 continue;
13774 /* turn DS segment override prefix into lock prefix */
13775 - if (*ptr == 0x3e)
13776 + if (*ktla_ktva(ptr) == 0x3e)
13777 text_poke(ptr, ((unsigned char []){0xf0}), 1);
13778 };
13779 mutex_unlock(&text_mutex);
13780 @@ -328,10 +341,16 @@ static void alternatives_smp_unlock(const s32 *start, const s32 *end,
13781 for (poff = start; poff < end; poff++) {
13782 u8 *ptr = (u8 *)poff + *poff;
13783
13784 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
13785 + ptr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
13786 + if (ptr < (u8 *)_text || (u8 *)_einittext <= ptr)
13787 + ptr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
13788 +#endif
13789 +
13790 if (!*poff || ptr < text || ptr >= text_end)
13791 continue;
13792 /* turn lock prefix into DS segment override prefix */
13793 - if (*ptr == 0xf0)
13794 + if (*ktla_ktva(ptr) == 0xf0)
13795 text_poke(ptr, ((unsigned char []){0x3E}), 1);
13796 };
13797 mutex_unlock(&text_mutex);
13798 @@ -500,7 +519,7 @@ void __init_or_module apply_paravirt(struct paravirt_patch_site *start,
13799
13800 BUG_ON(p->len > MAX_PATCH_LEN);
13801 /* prep the buffer with the original instructions */
13802 - memcpy(insnbuf, p->instr, p->len);
13803 + memcpy(insnbuf, ktla_ktva(p->instr), p->len);
13804 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
13805 (unsigned long)p->instr, p->len);
13806
13807 @@ -568,7 +587,7 @@ void __init alternative_instructions(void)
13808 if (smp_alt_once)
13809 free_init_pages("SMP alternatives",
13810 (unsigned long)__smp_locks,
13811 - (unsigned long)__smp_locks_end);
13812 + PAGE_ALIGN((unsigned long)__smp_locks_end));
13813
13814 restart_nmi();
13815 }
13816 @@ -585,13 +604,17 @@ void __init alternative_instructions(void)
13817 * instructions. And on the local CPU you need to be protected again NMI or MCE
13818 * handlers seeing an inconsistent instruction while you patch.
13819 */
13820 -void *__init_or_module text_poke_early(void *addr, const void *opcode,
13821 +void *__kprobes text_poke_early(void *addr, const void *opcode,
13822 size_t len)
13823 {
13824 unsigned long flags;
13825 local_irq_save(flags);
13826 - memcpy(addr, opcode, len);
13827 +
13828 + pax_open_kernel();
13829 + memcpy(ktla_ktva(addr), opcode, len);
13830 sync_core();
13831 + pax_close_kernel();
13832 +
13833 local_irq_restore(flags);
13834 /* Could also do a CLFLUSH here to speed up CPU recovery; but
13835 that causes hangs on some VIA CPUs. */
13836 @@ -613,36 +636,22 @@ void *__init_or_module text_poke_early(void *addr, const void *opcode,
13837 */
13838 void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
13839 {
13840 - unsigned long flags;
13841 - char *vaddr;
13842 + unsigned char *vaddr = ktla_ktva(addr);
13843 struct page *pages[2];
13844 - int i;
13845 + size_t i;
13846
13847 if (!core_kernel_text((unsigned long)addr)) {
13848 - pages[0] = vmalloc_to_page(addr);
13849 - pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
13850 + pages[0] = vmalloc_to_page(vaddr);
13851 + pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
13852 } else {
13853 - pages[0] = virt_to_page(addr);
13854 + pages[0] = virt_to_page(vaddr);
13855 WARN_ON(!PageReserved(pages[0]));
13856 - pages[1] = virt_to_page(addr + PAGE_SIZE);
13857 + pages[1] = virt_to_page(vaddr + PAGE_SIZE);
13858 }
13859 BUG_ON(!pages[0]);
13860 - local_irq_save(flags);
13861 - set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
13862 - if (pages[1])
13863 - set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
13864 - vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
13865 - memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
13866 - clear_fixmap(FIX_TEXT_POKE0);
13867 - if (pages[1])
13868 - clear_fixmap(FIX_TEXT_POKE1);
13869 - local_flush_tlb();
13870 - sync_core();
13871 - /* Could also do a CLFLUSH here to speed up CPU recovery; but
13872 - that causes hangs on some VIA CPUs. */
13873 + text_poke_early(addr, opcode, len);
13874 for (i = 0; i < len; i++)
13875 - BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
13876 - local_irq_restore(flags);
13877 + BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
13878 return addr;
13879 }
13880
13881 diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
13882 index 39a222e..85a7767 100644
13883 --- a/arch/x86/kernel/apic/apic.c
13884 +++ b/arch/x86/kernel/apic/apic.c
13885 @@ -185,7 +185,7 @@ int first_system_vector = 0xfe;
13886 /*
13887 * Debug level, exported for io_apic.c
13888 */
13889 -unsigned int apic_verbosity;
13890 +int apic_verbosity;
13891
13892 int pic_mode;
13893
13894 @@ -1923,7 +1923,7 @@ void smp_error_interrupt(struct pt_regs *regs)
13895 apic_write(APIC_ESR, 0);
13896 v1 = apic_read(APIC_ESR);
13897 ack_APIC_irq();
13898 - atomic_inc(&irq_err_count);
13899 + atomic_inc_unchecked(&irq_err_count);
13900
13901 apic_printk(APIC_DEBUG, KERN_DEBUG "APIC error on CPU%d: %02x(%02x)",
13902 smp_processor_id(), v0 , v1);
13903 diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
13904 index 5f0ff59..f9e01bc 100644
13905 --- a/arch/x86/kernel/apic/io_apic.c
13906 +++ b/arch/x86/kernel/apic/io_apic.c
13907 @@ -1084,7 +1084,7 @@ int IO_APIC_get_PCI_irq_vector(int bus, int slot, int pin,
13908 }
13909 EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
13910
13911 -void lock_vector_lock(void)
13912 +void lock_vector_lock(void) __acquires(vector_lock)
13913 {
13914 /* Used to the online set of cpus does not change
13915 * during assign_irq_vector.
13916 @@ -1092,7 +1092,7 @@ void lock_vector_lock(void)
13917 raw_spin_lock(&vector_lock);
13918 }
13919
13920 -void unlock_vector_lock(void)
13921 +void unlock_vector_lock(void) __releases(vector_lock)
13922 {
13923 raw_spin_unlock(&vector_lock);
13924 }
13925 @@ -2369,7 +2369,7 @@ static void ack_apic_edge(struct irq_data *data)
13926 ack_APIC_irq();
13927 }
13928
13929 -atomic_t irq_mis_count;
13930 +atomic_unchecked_t irq_mis_count;
13931
13932 #ifdef CONFIG_GENERIC_PENDING_IRQ
13933 static bool io_apic_level_ack_pending(struct irq_cfg *cfg)
13934 @@ -2510,7 +2510,7 @@ static void ack_apic_level(struct irq_data *data)
13935 * at the cpu.
13936 */
13937 if (!(v & (1 << (i & 0x1f)))) {
13938 - atomic_inc(&irq_mis_count);
13939 + atomic_inc_unchecked(&irq_mis_count);
13940
13941 eoi_ioapic_irq(irq, cfg);
13942 }
13943 diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
13944 index 07b0c0d..1df6f42 100644
13945 --- a/arch/x86/kernel/apm_32.c
13946 +++ b/arch/x86/kernel/apm_32.c
13947 @@ -410,7 +410,7 @@ static DEFINE_MUTEX(apm_mutex);
13948 * This is for buggy BIOS's that refer to (real mode) segment 0x40
13949 * even though they are called in protected mode.
13950 */
13951 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
13952 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
13953 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
13954
13955 static const char driver_version[] = "1.16ac"; /* no spaces */
13956 @@ -588,7 +588,10 @@ static long __apm_bios_call(void *_call)
13957 BUG_ON(cpu != 0);
13958 gdt = get_cpu_gdt_table(cpu);
13959 save_desc_40 = gdt[0x40 / 8];
13960 +
13961 + pax_open_kernel();
13962 gdt[0x40 / 8] = bad_bios_desc;
13963 + pax_close_kernel();
13964
13965 apm_irq_save(flags);
13966 APM_DO_SAVE_SEGS;
13967 @@ -597,7 +600,11 @@ static long __apm_bios_call(void *_call)
13968 &call->esi);
13969 APM_DO_RESTORE_SEGS;
13970 apm_irq_restore(flags);
13971 +
13972 + pax_open_kernel();
13973 gdt[0x40 / 8] = save_desc_40;
13974 + pax_close_kernel();
13975 +
13976 put_cpu();
13977
13978 return call->eax & 0xff;
13979 @@ -664,7 +671,10 @@ static long __apm_bios_call_simple(void *_call)
13980 BUG_ON(cpu != 0);
13981 gdt = get_cpu_gdt_table(cpu);
13982 save_desc_40 = gdt[0x40 / 8];
13983 +
13984 + pax_open_kernel();
13985 gdt[0x40 / 8] = bad_bios_desc;
13986 + pax_close_kernel();
13987
13988 apm_irq_save(flags);
13989 APM_DO_SAVE_SEGS;
13990 @@ -672,7 +682,11 @@ static long __apm_bios_call_simple(void *_call)
13991 &call->eax);
13992 APM_DO_RESTORE_SEGS;
13993 apm_irq_restore(flags);
13994 +
13995 + pax_open_kernel();
13996 gdt[0x40 / 8] = save_desc_40;
13997 + pax_close_kernel();
13998 +
13999 put_cpu();
14000 return error;
14001 }
14002 @@ -2345,12 +2359,15 @@ static int __init apm_init(void)
14003 * code to that CPU.
14004 */
14005 gdt = get_cpu_gdt_table(0);
14006 +
14007 + pax_open_kernel();
14008 set_desc_base(&gdt[APM_CS >> 3],
14009 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
14010 set_desc_base(&gdt[APM_CS_16 >> 3],
14011 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
14012 set_desc_base(&gdt[APM_DS >> 3],
14013 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
14014 + pax_close_kernel();
14015
14016 proc_create("apm", 0, NULL, &apm_file_ops);
14017
14018 diff --git a/arch/x86/kernel/asm-offsets.c b/arch/x86/kernel/asm-offsets.c
14019 index 68de2dc..1f3c720 100644
14020 --- a/arch/x86/kernel/asm-offsets.c
14021 +++ b/arch/x86/kernel/asm-offsets.c
14022 @@ -33,6 +33,8 @@ void common(void) {
14023 OFFSET(TI_status, thread_info, status);
14024 OFFSET(TI_addr_limit, thread_info, addr_limit);
14025 OFFSET(TI_preempt_count, thread_info, preempt_count);
14026 + OFFSET(TI_lowest_stack, thread_info, lowest_stack);
14027 + DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
14028
14029 BLANK();
14030 OFFSET(crypto_tfm_ctx_offset, crypto_tfm, __crt_ctx);
14031 @@ -53,8 +55,26 @@ void common(void) {
14032 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
14033 OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
14034 OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
14035 +
14036 +#ifdef CONFIG_PAX_KERNEXEC
14037 + OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
14038 #endif
14039
14040 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14041 + OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
14042 + OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
14043 +#ifdef CONFIG_X86_64
14044 + OFFSET(PV_MMU_set_pgd_batched, pv_mmu_ops, set_pgd_batched);
14045 +#endif
14046 +#endif
14047 +
14048 +#endif
14049 +
14050 + BLANK();
14051 + DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
14052 + DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
14053 + DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
14054 +
14055 #ifdef CONFIG_XEN
14056 BLANK();
14057 OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
14058 diff --git a/arch/x86/kernel/asm-offsets_64.c b/arch/x86/kernel/asm-offsets_64.c
14059 index 1b4754f..fbb4227 100644
14060 --- a/arch/x86/kernel/asm-offsets_64.c
14061 +++ b/arch/x86/kernel/asm-offsets_64.c
14062 @@ -76,6 +76,7 @@ int main(void)
14063 BLANK();
14064 #undef ENTRY
14065
14066 + DEFINE(TSS_size, sizeof(struct tss_struct));
14067 OFFSET(TSS_ist, tss_struct, x86_tss.ist);
14068 BLANK();
14069
14070 diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
14071 index 6ab6aa2..8f71507 100644
14072 --- a/arch/x86/kernel/cpu/Makefile
14073 +++ b/arch/x86/kernel/cpu/Makefile
14074 @@ -8,10 +8,6 @@ CFLAGS_REMOVE_common.o = -pg
14075 CFLAGS_REMOVE_perf_event.o = -pg
14076 endif
14077
14078 -# Make sure load_percpu_segment has no stackprotector
14079 -nostackp := $(call cc-option, -fno-stack-protector)
14080 -CFLAGS_common.o := $(nostackp)
14081 -
14082 obj-y := intel_cacheinfo.o scattered.o topology.o
14083 obj-y += proc.o capflags.o powerflags.o common.o
14084 obj-y += vmware.o hypervisor.o sched.o mshyperv.o
14085 diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
14086 index 146bb62..ac9c74a 100644
14087 --- a/arch/x86/kernel/cpu/amd.c
14088 +++ b/arch/x86/kernel/cpu/amd.c
14089 @@ -691,7 +691,7 @@ static unsigned int __cpuinit amd_size_cache(struct cpuinfo_x86 *c,
14090 unsigned int size)
14091 {
14092 /* AMD errata T13 (order #21922) */
14093 - if ((c->x86 == 6)) {
14094 + if (c->x86 == 6) {
14095 /* Duron Rev A0 */
14096 if (c->x86_model == 3 && c->x86_mask == 0)
14097 size = 64;
14098 diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
14099 index 6b9333b..4c3083a 100644
14100 --- a/arch/x86/kernel/cpu/common.c
14101 +++ b/arch/x86/kernel/cpu/common.c
14102 @@ -86,60 +86,6 @@ static const struct cpu_dev __cpuinitconst default_cpu = {
14103
14104 static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
14105
14106 -DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
14107 -#ifdef CONFIG_X86_64
14108 - /*
14109 - * We need valid kernel segments for data and code in long mode too
14110 - * IRET will check the segment types kkeil 2000/10/28
14111 - * Also sysret mandates a special GDT layout
14112 - *
14113 - * TLS descriptors are currently at a different place compared to i386.
14114 - * Hopefully nobody expects them at a fixed place (Wine?)
14115 - */
14116 - [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
14117 - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
14118 - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
14119 - [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
14120 - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
14121 - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
14122 -#else
14123 - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
14124 - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
14125 - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
14126 - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
14127 - /*
14128 - * Segments used for calling PnP BIOS have byte granularity.
14129 - * They code segments and data segments have fixed 64k limits,
14130 - * the transfer segment sizes are set at run time.
14131 - */
14132 - /* 32-bit code */
14133 - [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
14134 - /* 16-bit code */
14135 - [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
14136 - /* 16-bit data */
14137 - [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
14138 - /* 16-bit data */
14139 - [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
14140 - /* 16-bit data */
14141 - [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
14142 - /*
14143 - * The APM segments have byte granularity and their bases
14144 - * are set at run time. All have 64k limits.
14145 - */
14146 - /* 32-bit code */
14147 - [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
14148 - /* 16-bit code */
14149 - [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
14150 - /* data */
14151 - [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
14152 -
14153 - [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
14154 - [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
14155 - GDT_STACK_CANARY_INIT
14156 -#endif
14157 -} };
14158 -EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
14159 -
14160 static int __init x86_xsave_setup(char *s)
14161 {
14162 setup_clear_cpu_cap(X86_FEATURE_XSAVE);
14163 @@ -374,7 +320,7 @@ void switch_to_new_gdt(int cpu)
14164 {
14165 struct desc_ptr gdt_descr;
14166
14167 - gdt_descr.address = (long)get_cpu_gdt_table(cpu);
14168 + gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
14169 gdt_descr.size = GDT_SIZE - 1;
14170 load_gdt(&gdt_descr);
14171 /* Reload the per-cpu base */
14172 @@ -841,6 +787,10 @@ static void __cpuinit identify_cpu(struct cpuinfo_x86 *c)
14173 /* Filter out anything that depends on CPUID levels we don't have */
14174 filter_cpuid_features(c, true);
14175
14176 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
14177 + setup_clear_cpu_cap(X86_FEATURE_SEP);
14178 +#endif
14179 +
14180 /* If the model name is still unset, do table lookup. */
14181 if (!c->x86_model_id[0]) {
14182 const char *p;
14183 @@ -1021,10 +971,12 @@ static __init int setup_disablecpuid(char *arg)
14184 }
14185 __setup("clearcpuid=", setup_disablecpuid);
14186
14187 +DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
14188 +EXPORT_PER_CPU_SYMBOL(current_tinfo);
14189 +
14190 #ifdef CONFIG_X86_64
14191 struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
14192 -struct desc_ptr nmi_idt_descr = { NR_VECTORS * 16 - 1,
14193 - (unsigned long) nmi_idt_table };
14194 +struct desc_ptr nmi_idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) nmi_idt_table };
14195
14196 DEFINE_PER_CPU_FIRST(union irq_stack_union,
14197 irq_stack_union) __aligned(PAGE_SIZE);
14198 @@ -1038,7 +990,7 @@ DEFINE_PER_CPU(struct task_struct *, current_task) ____cacheline_aligned =
14199 EXPORT_PER_CPU_SYMBOL(current_task);
14200
14201 DEFINE_PER_CPU(unsigned long, kernel_stack) =
14202 - (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
14203 + (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
14204 EXPORT_PER_CPU_SYMBOL(kernel_stack);
14205
14206 DEFINE_PER_CPU(char *, irq_stack_ptr) =
14207 @@ -1132,7 +1084,7 @@ struct pt_regs * __cpuinit idle_regs(struct pt_regs *regs)
14208 {
14209 memset(regs, 0, sizeof(struct pt_regs));
14210 regs->fs = __KERNEL_PERCPU;
14211 - regs->gs = __KERNEL_STACK_CANARY;
14212 + savesegment(gs, regs->gs);
14213
14214 return regs;
14215 }
14216 @@ -1187,7 +1139,7 @@ void __cpuinit cpu_init(void)
14217 int i;
14218
14219 cpu = stack_smp_processor_id();
14220 - t = &per_cpu(init_tss, cpu);
14221 + t = init_tss + cpu;
14222 oist = &per_cpu(orig_ist, cpu);
14223
14224 #ifdef CONFIG_NUMA
14225 @@ -1213,7 +1165,7 @@ void __cpuinit cpu_init(void)
14226 switch_to_new_gdt(cpu);
14227 loadsegment(fs, 0);
14228
14229 - load_idt((const struct desc_ptr *)&idt_descr);
14230 + load_idt(&idt_descr);
14231
14232 memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
14233 syscall_init();
14234 @@ -1222,7 +1174,6 @@ void __cpuinit cpu_init(void)
14235 wrmsrl(MSR_KERNEL_GS_BASE, 0);
14236 barrier();
14237
14238 - x86_configure_nx();
14239 if (cpu != 0)
14240 enable_x2apic();
14241
14242 @@ -1278,7 +1229,7 @@ void __cpuinit cpu_init(void)
14243 {
14244 int cpu = smp_processor_id();
14245 struct task_struct *curr = current;
14246 - struct tss_struct *t = &per_cpu(init_tss, cpu);
14247 + struct tss_struct *t = init_tss + cpu;
14248 struct thread_struct *thread = &curr->thread;
14249
14250 if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
14251 diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
14252 index 3e6ff6c..54b4992 100644
14253 --- a/arch/x86/kernel/cpu/intel.c
14254 +++ b/arch/x86/kernel/cpu/intel.c
14255 @@ -174,7 +174,7 @@ static void __cpuinit trap_init_f00f_bug(void)
14256 * Update the IDT descriptor and reload the IDT so that
14257 * it uses the read-only mapped virtual address.
14258 */
14259 - idt_descr.address = fix_to_virt(FIX_F00F_IDT);
14260 + idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
14261 load_idt(&idt_descr);
14262 }
14263 #endif
14264 diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
14265 index c46ed49..5dc0a53 100644
14266 --- a/arch/x86/kernel/cpu/mcheck/mce.c
14267 +++ b/arch/x86/kernel/cpu/mcheck/mce.c
14268 @@ -42,6 +42,7 @@
14269 #include <asm/processor.h>
14270 #include <asm/mce.h>
14271 #include <asm/msr.h>
14272 +#include <asm/local.h>
14273
14274 #include "mce-internal.h"
14275
14276 @@ -250,7 +251,7 @@ static void print_mce(struct mce *m)
14277 !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
14278 m->cs, m->ip);
14279
14280 - if (m->cs == __KERNEL_CS)
14281 + if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
14282 print_symbol("{%s}", m->ip);
14283 pr_cont("\n");
14284 }
14285 @@ -283,10 +284,10 @@ static void print_mce(struct mce *m)
14286
14287 #define PANIC_TIMEOUT 5 /* 5 seconds */
14288
14289 -static atomic_t mce_paniced;
14290 +static atomic_unchecked_t mce_paniced;
14291
14292 static int fake_panic;
14293 -static atomic_t mce_fake_paniced;
14294 +static atomic_unchecked_t mce_fake_paniced;
14295
14296 /* Panic in progress. Enable interrupts and wait for final IPI */
14297 static void wait_for_panic(void)
14298 @@ -310,7 +311,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp)
14299 /*
14300 * Make sure only one CPU runs in machine check panic
14301 */
14302 - if (atomic_inc_return(&mce_paniced) > 1)
14303 + if (atomic_inc_return_unchecked(&mce_paniced) > 1)
14304 wait_for_panic();
14305 barrier();
14306
14307 @@ -318,7 +319,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp)
14308 console_verbose();
14309 } else {
14310 /* Don't log too much for fake panic */
14311 - if (atomic_inc_return(&mce_fake_paniced) > 1)
14312 + if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
14313 return;
14314 }
14315 /* First print corrected ones that are still unlogged */
14316 @@ -686,7 +687,7 @@ static int mce_timed_out(u64 *t)
14317 * might have been modified by someone else.
14318 */
14319 rmb();
14320 - if (atomic_read(&mce_paniced))
14321 + if (atomic_read_unchecked(&mce_paniced))
14322 wait_for_panic();
14323 if (!monarch_timeout)
14324 goto out;
14325 @@ -1581,7 +1582,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
14326 }
14327
14328 /* Call the installed machine check handler for this CPU setup. */
14329 -void (*machine_check_vector)(struct pt_regs *, long error_code) =
14330 +void (*machine_check_vector)(struct pt_regs *, long error_code) __read_only =
14331 unexpected_machine_check;
14332
14333 /*
14334 @@ -1604,7 +1605,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
14335 return;
14336 }
14337
14338 + pax_open_kernel();
14339 machine_check_vector = do_machine_check;
14340 + pax_close_kernel();
14341
14342 __mcheck_cpu_init_generic();
14343 __mcheck_cpu_init_vendor(c);
14344 @@ -1618,7 +1621,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
14345 */
14346
14347 static DEFINE_SPINLOCK(mce_chrdev_state_lock);
14348 -static int mce_chrdev_open_count; /* #times opened */
14349 +static local_t mce_chrdev_open_count; /* #times opened */
14350 static int mce_chrdev_open_exclu; /* already open exclusive? */
14351
14352 static int mce_chrdev_open(struct inode *inode, struct file *file)
14353 @@ -1626,7 +1629,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
14354 spin_lock(&mce_chrdev_state_lock);
14355
14356 if (mce_chrdev_open_exclu ||
14357 - (mce_chrdev_open_count && (file->f_flags & O_EXCL))) {
14358 + (local_read(&mce_chrdev_open_count) && (file->f_flags & O_EXCL))) {
14359 spin_unlock(&mce_chrdev_state_lock);
14360
14361 return -EBUSY;
14362 @@ -1634,7 +1637,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
14363
14364 if (file->f_flags & O_EXCL)
14365 mce_chrdev_open_exclu = 1;
14366 - mce_chrdev_open_count++;
14367 + local_inc(&mce_chrdev_open_count);
14368
14369 spin_unlock(&mce_chrdev_state_lock);
14370
14371 @@ -1645,7 +1648,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file)
14372 {
14373 spin_lock(&mce_chrdev_state_lock);
14374
14375 - mce_chrdev_open_count--;
14376 + local_dec(&mce_chrdev_open_count);
14377 mce_chrdev_open_exclu = 0;
14378
14379 spin_unlock(&mce_chrdev_state_lock);
14380 @@ -2370,7 +2373,7 @@ struct dentry *mce_get_debugfs_dir(void)
14381 static void mce_reset(void)
14382 {
14383 cpu_missing = 0;
14384 - atomic_set(&mce_fake_paniced, 0);
14385 + atomic_set_unchecked(&mce_fake_paniced, 0);
14386 atomic_set(&mce_executing, 0);
14387 atomic_set(&mce_callin, 0);
14388 atomic_set(&global_nwo, 0);
14389 diff --git a/arch/x86/kernel/cpu/mcheck/p5.c b/arch/x86/kernel/cpu/mcheck/p5.c
14390 index 2d5454c..51987eb 100644
14391 --- a/arch/x86/kernel/cpu/mcheck/p5.c
14392 +++ b/arch/x86/kernel/cpu/mcheck/p5.c
14393 @@ -11,6 +11,7 @@
14394 #include <asm/processor.h>
14395 #include <asm/mce.h>
14396 #include <asm/msr.h>
14397 +#include <asm/pgtable.h>
14398
14399 /* By default disabled */
14400 int mce_p5_enabled __read_mostly;
14401 @@ -49,7 +50,9 @@ void intel_p5_mcheck_init(struct cpuinfo_x86 *c)
14402 if (!cpu_has(c, X86_FEATURE_MCE))
14403 return;
14404
14405 + pax_open_kernel();
14406 machine_check_vector = pentium_machine_check;
14407 + pax_close_kernel();
14408 /* Make sure the vector pointer is visible before we enable MCEs: */
14409 wmb();
14410
14411 diff --git a/arch/x86/kernel/cpu/mcheck/winchip.c b/arch/x86/kernel/cpu/mcheck/winchip.c
14412 index 2d7998f..17c9de1 100644
14413 --- a/arch/x86/kernel/cpu/mcheck/winchip.c
14414 +++ b/arch/x86/kernel/cpu/mcheck/winchip.c
14415 @@ -10,6 +10,7 @@
14416 #include <asm/processor.h>
14417 #include <asm/mce.h>
14418 #include <asm/msr.h>
14419 +#include <asm/pgtable.h>
14420
14421 /* Machine check handler for WinChip C6: */
14422 static void winchip_machine_check(struct pt_regs *regs, long error_code)
14423 @@ -23,7 +24,9 @@ void winchip_mcheck_init(struct cpuinfo_x86 *c)
14424 {
14425 u32 lo, hi;
14426
14427 + pax_open_kernel();
14428 machine_check_vector = winchip_machine_check;
14429 + pax_close_kernel();
14430 /* Make sure the vector pointer is visible before we enable MCEs: */
14431 wmb();
14432
14433 diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
14434 index 6b96110..0da73eb 100644
14435 --- a/arch/x86/kernel/cpu/mtrr/main.c
14436 +++ b/arch/x86/kernel/cpu/mtrr/main.c
14437 @@ -62,7 +62,7 @@ static DEFINE_MUTEX(mtrr_mutex);
14438 u64 size_or_mask, size_and_mask;
14439 static bool mtrr_aps_delayed_init;
14440
14441 -static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
14442 +static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
14443
14444 const struct mtrr_ops *mtrr_if;
14445
14446 diff --git a/arch/x86/kernel/cpu/mtrr/mtrr.h b/arch/x86/kernel/cpu/mtrr/mtrr.h
14447 index df5e41f..816c719 100644
14448 --- a/arch/x86/kernel/cpu/mtrr/mtrr.h
14449 +++ b/arch/x86/kernel/cpu/mtrr/mtrr.h
14450 @@ -25,7 +25,7 @@ struct mtrr_ops {
14451 int (*validate_add_page)(unsigned long base, unsigned long size,
14452 unsigned int type);
14453 int (*have_wrcomb)(void);
14454 -};
14455 +} __do_const;
14456
14457 extern int generic_get_free_region(unsigned long base, unsigned long size,
14458 int replace_reg);
14459 diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
14460 index c4706cf..264b0f7 100644
14461 --- a/arch/x86/kernel/cpu/perf_event.c
14462 +++ b/arch/x86/kernel/cpu/perf_event.c
14463 @@ -1837,7 +1837,7 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
14464 break;
14465
14466 perf_callchain_store(entry, frame.return_address);
14467 - fp = frame.next_frame;
14468 + fp = (const void __force_user *)frame.next_frame;
14469 }
14470 }
14471
14472 diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
14473 index 13ad899..f642b9a 100644
14474 --- a/arch/x86/kernel/crash.c
14475 +++ b/arch/x86/kernel/crash.c
14476 @@ -36,10 +36,8 @@ static void kdump_nmi_callback(int cpu, struct pt_regs *regs)
14477 {
14478 #ifdef CONFIG_X86_32
14479 struct pt_regs fixed_regs;
14480 -#endif
14481
14482 -#ifdef CONFIG_X86_32
14483 - if (!user_mode_vm(regs)) {
14484 + if (!user_mode(regs)) {
14485 crash_fixup_ss_esp(&fixed_regs, regs);
14486 regs = &fixed_regs;
14487 }
14488 diff --git a/arch/x86/kernel/doublefault_32.c b/arch/x86/kernel/doublefault_32.c
14489 index 37250fe..bf2ec74 100644
14490 --- a/arch/x86/kernel/doublefault_32.c
14491 +++ b/arch/x86/kernel/doublefault_32.c
14492 @@ -11,7 +11,7 @@
14493
14494 #define DOUBLEFAULT_STACKSIZE (1024)
14495 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
14496 -#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
14497 +#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
14498
14499 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
14500
14501 @@ -21,7 +21,7 @@ static void doublefault_fn(void)
14502 unsigned long gdt, tss;
14503
14504 store_gdt(&gdt_desc);
14505 - gdt = gdt_desc.address;
14506 + gdt = (unsigned long)gdt_desc.address;
14507
14508 printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
14509
14510 @@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cacheline_aligned = {
14511 /* 0x2 bit is always set */
14512 .flags = X86_EFLAGS_SF | 0x2,
14513 .sp = STACK_START,
14514 - .es = __USER_DS,
14515 + .es = __KERNEL_DS,
14516 .cs = __KERNEL_CS,
14517 .ss = __KERNEL_DS,
14518 - .ds = __USER_DS,
14519 + .ds = __KERNEL_DS,
14520 .fs = __KERNEL_PERCPU,
14521
14522 .__cr3 = __pa_nodebug(swapper_pg_dir),
14523 diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
14524 index 571246d..81f335c 100644
14525 --- a/arch/x86/kernel/dumpstack.c
14526 +++ b/arch/x86/kernel/dumpstack.c
14527 @@ -2,6 +2,9 @@
14528 * Copyright (C) 1991, 1992 Linus Torvalds
14529 * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
14530 */
14531 +#ifdef CONFIG_GRKERNSEC_HIDESYM
14532 +#define __INCLUDED_BY_HIDESYM 1
14533 +#endif
14534 #include <linux/kallsyms.h>
14535 #include <linux/kprobes.h>
14536 #include <linux/uaccess.h>
14537 @@ -35,16 +38,14 @@ void printk_address(unsigned long address, int reliable)
14538 static void
14539 print_ftrace_graph_addr(unsigned long addr, void *data,
14540 const struct stacktrace_ops *ops,
14541 - struct thread_info *tinfo, int *graph)
14542 + struct task_struct *task, int *graph)
14543 {
14544 - struct task_struct *task;
14545 unsigned long ret_addr;
14546 int index;
14547
14548 if (addr != (unsigned long)return_to_handler)
14549 return;
14550
14551 - task = tinfo->task;
14552 index = task->curr_ret_stack;
14553
14554 if (!task->ret_stack || index < *graph)
14555 @@ -61,7 +62,7 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
14556 static inline void
14557 print_ftrace_graph_addr(unsigned long addr, void *data,
14558 const struct stacktrace_ops *ops,
14559 - struct thread_info *tinfo, int *graph)
14560 + struct task_struct *task, int *graph)
14561 { }
14562 #endif
14563
14564 @@ -72,10 +73,8 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
14565 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
14566 */
14567
14568 -static inline int valid_stack_ptr(struct thread_info *tinfo,
14569 - void *p, unsigned int size, void *end)
14570 +static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
14571 {
14572 - void *t = tinfo;
14573 if (end) {
14574 if (p < end && p >= (end-THREAD_SIZE))
14575 return 1;
14576 @@ -86,14 +85,14 @@ static inline int valid_stack_ptr(struct thread_info *tinfo,
14577 }
14578
14579 unsigned long
14580 -print_context_stack(struct thread_info *tinfo,
14581 +print_context_stack(struct task_struct *task, void *stack_start,
14582 unsigned long *stack, unsigned long bp,
14583 const struct stacktrace_ops *ops, void *data,
14584 unsigned long *end, int *graph)
14585 {
14586 struct stack_frame *frame = (struct stack_frame *)bp;
14587
14588 - while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
14589 + while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
14590 unsigned long addr;
14591
14592 addr = *stack;
14593 @@ -105,7 +104,7 @@ print_context_stack(struct thread_info *tinfo,
14594 } else {
14595 ops->address(data, addr, 0);
14596 }
14597 - print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
14598 + print_ftrace_graph_addr(addr, data, ops, task, graph);
14599 }
14600 stack++;
14601 }
14602 @@ -114,7 +113,7 @@ print_context_stack(struct thread_info *tinfo,
14603 EXPORT_SYMBOL_GPL(print_context_stack);
14604
14605 unsigned long
14606 -print_context_stack_bp(struct thread_info *tinfo,
14607 +print_context_stack_bp(struct task_struct *task, void *stack_start,
14608 unsigned long *stack, unsigned long bp,
14609 const struct stacktrace_ops *ops, void *data,
14610 unsigned long *end, int *graph)
14611 @@ -122,7 +121,7 @@ print_context_stack_bp(struct thread_info *tinfo,
14612 struct stack_frame *frame = (struct stack_frame *)bp;
14613 unsigned long *ret_addr = &frame->return_address;
14614
14615 - while (valid_stack_ptr(tinfo, ret_addr, sizeof(*ret_addr), end)) {
14616 + while (valid_stack_ptr(stack_start, ret_addr, sizeof(*ret_addr), end)) {
14617 unsigned long addr = *ret_addr;
14618
14619 if (!__kernel_text_address(addr))
14620 @@ -131,7 +130,7 @@ print_context_stack_bp(struct thread_info *tinfo,
14621 ops->address(data, addr, 1);
14622 frame = frame->next_frame;
14623 ret_addr = &frame->return_address;
14624 - print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
14625 + print_ftrace_graph_addr(addr, data, ops, task, graph);
14626 }
14627
14628 return (unsigned long)frame;
14629 @@ -189,7 +188,7 @@ void dump_stack(void)
14630
14631 bp = stack_frame(current, NULL);
14632 printk("Pid: %d, comm: %.20s %s %s %.*s\n",
14633 - current->pid, current->comm, print_tainted(),
14634 + task_pid_nr(current), current->comm, print_tainted(),
14635 init_utsname()->release,
14636 (int)strcspn(init_utsname()->version, " "),
14637 init_utsname()->version);
14638 @@ -225,6 +224,8 @@ unsigned __kprobes long oops_begin(void)
14639 }
14640 EXPORT_SYMBOL_GPL(oops_begin);
14641
14642 +extern void gr_handle_kernel_exploit(void);
14643 +
14644 void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
14645 {
14646 if (regs && kexec_should_crash(current))
14647 @@ -246,7 +247,10 @@ void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
14648 panic("Fatal exception in interrupt");
14649 if (panic_on_oops)
14650 panic("Fatal exception");
14651 - do_exit(signr);
14652 +
14653 + gr_handle_kernel_exploit();
14654 +
14655 + do_group_exit(signr);
14656 }
14657
14658 int __kprobes __die(const char *str, struct pt_regs *regs, long err)
14659 @@ -273,7 +277,7 @@ int __kprobes __die(const char *str, struct pt_regs *regs, long err)
14660
14661 show_regs(regs);
14662 #ifdef CONFIG_X86_32
14663 - if (user_mode_vm(regs)) {
14664 + if (user_mode(regs)) {
14665 sp = regs->sp;
14666 ss = regs->ss & 0xffff;
14667 } else {
14668 @@ -301,7 +305,7 @@ void die(const char *str, struct pt_regs *regs, long err)
14669 unsigned long flags = oops_begin();
14670 int sig = SIGSEGV;
14671
14672 - if (!user_mode_vm(regs))
14673 + if (!user_mode(regs))
14674 report_bug(regs->ip, regs);
14675
14676 if (__die(str, regs, err))
14677 diff --git a/arch/x86/kernel/dumpstack_32.c b/arch/x86/kernel/dumpstack_32.c
14678 index e0b1d78..a8ade5e 100644
14679 --- a/arch/x86/kernel/dumpstack_32.c
14680 +++ b/arch/x86/kernel/dumpstack_32.c
14681 @@ -38,15 +38,13 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
14682 bp = stack_frame(task, regs);
14683
14684 for (;;) {
14685 - struct thread_info *context;
14686 + void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
14687
14688 - context = (struct thread_info *)
14689 - ((unsigned long)stack & (~(THREAD_SIZE - 1)));
14690 - bp = ops->walk_stack(context, stack, bp, ops, data, NULL, &graph);
14691 + bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
14692
14693 - stack = (unsigned long *)context->previous_esp;
14694 - if (!stack)
14695 + if (stack_start == task_stack_page(task))
14696 break;
14697 + stack = *(unsigned long **)stack_start;
14698 if (ops->stack(data, "IRQ") < 0)
14699 break;
14700 touch_nmi_watchdog();
14701 @@ -87,7 +85,7 @@ void show_regs(struct pt_regs *regs)
14702 int i;
14703
14704 print_modules();
14705 - __show_regs(regs, !user_mode_vm(regs));
14706 + __show_regs(regs, !user_mode(regs));
14707
14708 printk(KERN_EMERG "Process %.*s (pid: %d, ti=%p task=%p task.ti=%p)\n",
14709 TASK_COMM_LEN, current->comm, task_pid_nr(current),
14710 @@ -96,21 +94,22 @@ void show_regs(struct pt_regs *regs)
14711 * When in-kernel, we also print out the stack and code at the
14712 * time of the fault..
14713 */
14714 - if (!user_mode_vm(regs)) {
14715 + if (!user_mode(regs)) {
14716 unsigned int code_prologue = code_bytes * 43 / 64;
14717 unsigned int code_len = code_bytes;
14718 unsigned char c;
14719 u8 *ip;
14720 + unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
14721
14722 printk(KERN_EMERG "Stack:\n");
14723 show_stack_log_lvl(NULL, regs, &regs->sp, 0, KERN_EMERG);
14724
14725 printk(KERN_EMERG "Code: ");
14726
14727 - ip = (u8 *)regs->ip - code_prologue;
14728 + ip = (u8 *)regs->ip - code_prologue + cs_base;
14729 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
14730 /* try starting at IP */
14731 - ip = (u8 *)regs->ip;
14732 + ip = (u8 *)regs->ip + cs_base;
14733 code_len = code_len - code_prologue + 1;
14734 }
14735 for (i = 0; i < code_len; i++, ip++) {
14736 @@ -119,7 +118,7 @@ void show_regs(struct pt_regs *regs)
14737 printk(KERN_CONT " Bad EIP value.");
14738 break;
14739 }
14740 - if (ip == (u8 *)regs->ip)
14741 + if (ip == (u8 *)regs->ip + cs_base)
14742 printk(KERN_CONT "<%02x> ", c);
14743 else
14744 printk(KERN_CONT "%02x ", c);
14745 @@ -132,6 +131,7 @@ int is_valid_bugaddr(unsigned long ip)
14746 {
14747 unsigned short ud2;
14748
14749 + ip = ktla_ktva(ip);
14750 if (ip < PAGE_OFFSET)
14751 return 0;
14752 if (probe_kernel_address((unsigned short *)ip, ud2))
14753 @@ -139,3 +139,15 @@ int is_valid_bugaddr(unsigned long ip)
14754
14755 return ud2 == 0x0b0f;
14756 }
14757 +
14758 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14759 +void pax_check_alloca(unsigned long size)
14760 +{
14761 + unsigned long sp = (unsigned long)&sp, stack_left;
14762 +
14763 + /* all kernel stacks are of the same size */
14764 + stack_left = sp & (THREAD_SIZE - 1);
14765 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
14766 +}
14767 +EXPORT_SYMBOL(pax_check_alloca);
14768 +#endif
14769 diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
14770 index 791b761..2ab6e33 100644
14771 --- a/arch/x86/kernel/dumpstack_64.c
14772 +++ b/arch/x86/kernel/dumpstack_64.c
14773 @@ -119,9 +119,9 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
14774 unsigned long *irq_stack_end =
14775 (unsigned long *)per_cpu(irq_stack_ptr, cpu);
14776 unsigned used = 0;
14777 - struct thread_info *tinfo;
14778 int graph = 0;
14779 unsigned long dummy;
14780 + void *stack_start;
14781
14782 if (!task)
14783 task = current;
14784 @@ -142,10 +142,10 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
14785 * current stack address. If the stacks consist of nested
14786 * exceptions
14787 */
14788 - tinfo = task_thread_info(task);
14789 for (;;) {
14790 char *id;
14791 unsigned long *estack_end;
14792 +
14793 estack_end = in_exception_stack(cpu, (unsigned long)stack,
14794 &used, &id);
14795
14796 @@ -153,7 +153,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
14797 if (ops->stack(data, id) < 0)
14798 break;
14799
14800 - bp = ops->walk_stack(tinfo, stack, bp, ops,
14801 + bp = ops->walk_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
14802 data, estack_end, &graph);
14803 ops->stack(data, "<EOE>");
14804 /*
14805 @@ -161,6 +161,8 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
14806 * second-to-last pointer (index -2 to end) in the
14807 * exception stack:
14808 */
14809 + if ((u16)estack_end[-1] != __KERNEL_DS)
14810 + goto out;
14811 stack = (unsigned long *) estack_end[-2];
14812 continue;
14813 }
14814 @@ -172,7 +174,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
14815 if (in_irq_stack(stack, irq_stack, irq_stack_end)) {
14816 if (ops->stack(data, "IRQ") < 0)
14817 break;
14818 - bp = ops->walk_stack(tinfo, stack, bp,
14819 + bp = ops->walk_stack(task, irq_stack, stack, bp,
14820 ops, data, irq_stack_end, &graph);
14821 /*
14822 * We link to the next stack (which would be
14823 @@ -191,7 +193,9 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
14824 /*
14825 * This handles the process stack:
14826 */
14827 - bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph);
14828 + stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
14829 + bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
14830 +out:
14831 put_cpu();
14832 }
14833 EXPORT_SYMBOL(dump_trace);
14834 @@ -305,3 +309,50 @@ int is_valid_bugaddr(unsigned long ip)
14835
14836 return ud2 == 0x0b0f;
14837 }
14838 +
14839 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14840 +void pax_check_alloca(unsigned long size)
14841 +{
14842 + unsigned long sp = (unsigned long)&sp, stack_start, stack_end;
14843 + unsigned cpu, used;
14844 + char *id;
14845 +
14846 + /* check the process stack first */
14847 + stack_start = (unsigned long)task_stack_page(current);
14848 + stack_end = stack_start + THREAD_SIZE;
14849 + if (likely(stack_start <= sp && sp < stack_end)) {
14850 + unsigned long stack_left = sp & (THREAD_SIZE - 1);
14851 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
14852 + return;
14853 + }
14854 +
14855 + cpu = get_cpu();
14856 +
14857 + /* check the irq stacks */
14858 + stack_end = (unsigned long)per_cpu(irq_stack_ptr, cpu);
14859 + stack_start = stack_end - IRQ_STACK_SIZE;
14860 + if (stack_start <= sp && sp < stack_end) {
14861 + unsigned long stack_left = sp & (IRQ_STACK_SIZE - 1);
14862 + put_cpu();
14863 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
14864 + return;
14865 + }
14866 +
14867 + /* check the exception stacks */
14868 + used = 0;
14869 + stack_end = (unsigned long)in_exception_stack(cpu, sp, &used, &id);
14870 + stack_start = stack_end - EXCEPTION_STKSZ;
14871 + if (stack_end && stack_start <= sp && sp < stack_end) {
14872 + unsigned long stack_left = sp & (EXCEPTION_STKSZ - 1);
14873 + put_cpu();
14874 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
14875 + return;
14876 + }
14877 +
14878 + put_cpu();
14879 +
14880 + /* unknown stack */
14881 + BUG();
14882 +}
14883 +EXPORT_SYMBOL(pax_check_alloca);
14884 +#endif
14885 diff --git a/arch/x86/kernel/early_printk.c b/arch/x86/kernel/early_printk.c
14886 index 9b9f18b..9fcaa04 100644
14887 --- a/arch/x86/kernel/early_printk.c
14888 +++ b/arch/x86/kernel/early_printk.c
14889 @@ -7,6 +7,7 @@
14890 #include <linux/pci_regs.h>
14891 #include <linux/pci_ids.h>
14892 #include <linux/errno.h>
14893 +#include <linux/sched.h>
14894 #include <asm/io.h>
14895 #include <asm/processor.h>
14896 #include <asm/fcntl.h>
14897 diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
14898 index 623f288..8bdd78a 100644
14899 --- a/arch/x86/kernel/entry_32.S
14900 +++ b/arch/x86/kernel/entry_32.S
14901 @@ -176,13 +176,153 @@
14902 /*CFI_REL_OFFSET gs, PT_GS*/
14903 .endm
14904 .macro SET_KERNEL_GS reg
14905 +
14906 +#ifdef CONFIG_CC_STACKPROTECTOR
14907 movl $(__KERNEL_STACK_CANARY), \reg
14908 +#elif defined(CONFIG_PAX_MEMORY_UDEREF)
14909 + movl $(__USER_DS), \reg
14910 +#else
14911 + xorl \reg, \reg
14912 +#endif
14913 +
14914 movl \reg, %gs
14915 .endm
14916
14917 #endif /* CONFIG_X86_32_LAZY_GS */
14918
14919 -.macro SAVE_ALL
14920 +.macro pax_enter_kernel
14921 +#ifdef CONFIG_PAX_KERNEXEC
14922 + call pax_enter_kernel
14923 +#endif
14924 +.endm
14925 +
14926 +.macro pax_exit_kernel
14927 +#ifdef CONFIG_PAX_KERNEXEC
14928 + call pax_exit_kernel
14929 +#endif
14930 +.endm
14931 +
14932 +#ifdef CONFIG_PAX_KERNEXEC
14933 +ENTRY(pax_enter_kernel)
14934 +#ifdef CONFIG_PARAVIRT
14935 + pushl %eax
14936 + pushl %ecx
14937 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
14938 + mov %eax, %esi
14939 +#else
14940 + mov %cr0, %esi
14941 +#endif
14942 + bts $16, %esi
14943 + jnc 1f
14944 + mov %cs, %esi
14945 + cmp $__KERNEL_CS, %esi
14946 + jz 3f
14947 + ljmp $__KERNEL_CS, $3f
14948 +1: ljmp $__KERNEXEC_KERNEL_CS, $2f
14949 +2:
14950 +#ifdef CONFIG_PARAVIRT
14951 + mov %esi, %eax
14952 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
14953 +#else
14954 + mov %esi, %cr0
14955 +#endif
14956 +3:
14957 +#ifdef CONFIG_PARAVIRT
14958 + popl %ecx
14959 + popl %eax
14960 +#endif
14961 + ret
14962 +ENDPROC(pax_enter_kernel)
14963 +
14964 +ENTRY(pax_exit_kernel)
14965 +#ifdef CONFIG_PARAVIRT
14966 + pushl %eax
14967 + pushl %ecx
14968 +#endif
14969 + mov %cs, %esi
14970 + cmp $__KERNEXEC_KERNEL_CS, %esi
14971 + jnz 2f
14972 +#ifdef CONFIG_PARAVIRT
14973 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
14974 + mov %eax, %esi
14975 +#else
14976 + mov %cr0, %esi
14977 +#endif
14978 + btr $16, %esi
14979 + ljmp $__KERNEL_CS, $1f
14980 +1:
14981 +#ifdef CONFIG_PARAVIRT
14982 + mov %esi, %eax
14983 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
14984 +#else
14985 + mov %esi, %cr0
14986 +#endif
14987 +2:
14988 +#ifdef CONFIG_PARAVIRT
14989 + popl %ecx
14990 + popl %eax
14991 +#endif
14992 + ret
14993 +ENDPROC(pax_exit_kernel)
14994 +#endif
14995 +
14996 +.macro pax_erase_kstack
14997 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14998 + call pax_erase_kstack
14999 +#endif
15000 +.endm
15001 +
15002 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
15003 +/*
15004 + * ebp: thread_info
15005 + */
15006 +ENTRY(pax_erase_kstack)
15007 + pushl %edi
15008 + pushl %ecx
15009 + pushl %eax
15010 +
15011 + mov TI_lowest_stack(%ebp), %edi
15012 + mov $-0xBEEF, %eax
15013 + std
15014 +
15015 +1: mov %edi, %ecx
15016 + and $THREAD_SIZE_asm - 1, %ecx
15017 + shr $2, %ecx
15018 + repne scasl
15019 + jecxz 2f
15020 +
15021 + cmp $2*16, %ecx
15022 + jc 2f
15023 +
15024 + mov $2*16, %ecx
15025 + repe scasl
15026 + jecxz 2f
15027 + jne 1b
15028 +
15029 +2: cld
15030 + mov %esp, %ecx
15031 + sub %edi, %ecx
15032 +
15033 + cmp $THREAD_SIZE_asm, %ecx
15034 + jb 3f
15035 + ud2
15036 +3:
15037 +
15038 + shr $2, %ecx
15039 + rep stosl
15040 +
15041 + mov TI_task_thread_sp0(%ebp), %edi
15042 + sub $128, %edi
15043 + mov %edi, TI_lowest_stack(%ebp)
15044 +
15045 + popl %eax
15046 + popl %ecx
15047 + popl %edi
15048 + ret
15049 +ENDPROC(pax_erase_kstack)
15050 +#endif
15051 +
15052 +.macro __SAVE_ALL _DS
15053 cld
15054 PUSH_GS
15055 pushl_cfi %fs
15056 @@ -205,7 +345,7 @@
15057 CFI_REL_OFFSET ecx, 0
15058 pushl_cfi %ebx
15059 CFI_REL_OFFSET ebx, 0
15060 - movl $(__USER_DS), %edx
15061 + movl $\_DS, %edx
15062 movl %edx, %ds
15063 movl %edx, %es
15064 movl $(__KERNEL_PERCPU), %edx
15065 @@ -213,6 +353,15 @@
15066 SET_KERNEL_GS %edx
15067 .endm
15068
15069 +.macro SAVE_ALL
15070 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
15071 + __SAVE_ALL __KERNEL_DS
15072 + pax_enter_kernel
15073 +#else
15074 + __SAVE_ALL __USER_DS
15075 +#endif
15076 +.endm
15077 +
15078 .macro RESTORE_INT_REGS
15079 popl_cfi %ebx
15080 CFI_RESTORE ebx
15081 @@ -296,7 +445,7 @@ ENTRY(ret_from_fork)
15082 popfl_cfi
15083 jmp syscall_exit
15084 CFI_ENDPROC
15085 -END(ret_from_fork)
15086 +ENDPROC(ret_from_fork)
15087
15088 /*
15089 * Interrupt exit functions should be protected against kprobes
15090 @@ -329,7 +478,15 @@ ret_from_intr:
15091 andl $SEGMENT_RPL_MASK, %eax
15092 #endif
15093 cmpl $USER_RPL, %eax
15094 +
15095 +#ifdef CONFIG_PAX_KERNEXEC
15096 + jae resume_userspace
15097 +
15098 + pax_exit_kernel
15099 + jmp resume_kernel
15100 +#else
15101 jb resume_kernel # not returning to v8086 or userspace
15102 +#endif
15103
15104 ENTRY(resume_userspace)
15105 LOCKDEP_SYS_EXIT
15106 @@ -341,8 +498,8 @@ ENTRY(resume_userspace)
15107 andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
15108 # int/exception return?
15109 jne work_pending
15110 - jmp restore_all
15111 -END(ret_from_exception)
15112 + jmp restore_all_pax
15113 +ENDPROC(ret_from_exception)
15114
15115 #ifdef CONFIG_PREEMPT
15116 ENTRY(resume_kernel)
15117 @@ -357,7 +514,7 @@ need_resched:
15118 jz restore_all
15119 call preempt_schedule_irq
15120 jmp need_resched
15121 -END(resume_kernel)
15122 +ENDPROC(resume_kernel)
15123 #endif
15124 CFI_ENDPROC
15125 /*
15126 @@ -391,28 +548,43 @@ sysenter_past_esp:
15127 /*CFI_REL_OFFSET cs, 0*/
15128 /*
15129 * Push current_thread_info()->sysenter_return to the stack.
15130 - * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
15131 - * pushed above; +8 corresponds to copy_thread's esp0 setting.
15132 */
15133 - pushl_cfi ((TI_sysenter_return)-THREAD_SIZE+8+4*4)(%esp)
15134 + pushl_cfi $0
15135 CFI_REL_OFFSET eip, 0
15136
15137 pushl_cfi %eax
15138 SAVE_ALL
15139 + GET_THREAD_INFO(%ebp)
15140 + movl TI_sysenter_return(%ebp),%ebp
15141 + movl %ebp,PT_EIP(%esp)
15142 ENABLE_INTERRUPTS(CLBR_NONE)
15143
15144 /*
15145 * Load the potential sixth argument from user stack.
15146 * Careful about security.
15147 */
15148 + movl PT_OLDESP(%esp),%ebp
15149 +
15150 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15151 + mov PT_OLDSS(%esp),%ds
15152 +1: movl %ds:(%ebp),%ebp
15153 + push %ss
15154 + pop %ds
15155 +#else
15156 cmpl $__PAGE_OFFSET-3,%ebp
15157 jae syscall_fault
15158 1: movl (%ebp),%ebp
15159 +#endif
15160 +
15161 movl %ebp,PT_EBP(%esp)
15162 _ASM_EXTABLE(1b,syscall_fault)
15163
15164 GET_THREAD_INFO(%ebp)
15165
15166 +#ifdef CONFIG_PAX_RANDKSTACK
15167 + pax_erase_kstack
15168 +#endif
15169 +
15170 testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%ebp)
15171 jnz sysenter_audit
15172 sysenter_do_call:
15173 @@ -427,12 +599,24 @@ sysenter_do_call:
15174 testl $_TIF_ALLWORK_MASK, %ecx
15175 jne sysexit_audit
15176 sysenter_exit:
15177 +
15178 +#ifdef CONFIG_PAX_RANDKSTACK
15179 + pushl_cfi %eax
15180 + movl %esp, %eax
15181 + call pax_randomize_kstack
15182 + popl_cfi %eax
15183 +#endif
15184 +
15185 + pax_erase_kstack
15186 +
15187 /* if something modifies registers it must also disable sysexit */
15188 movl PT_EIP(%esp), %edx
15189 movl PT_OLDESP(%esp), %ecx
15190 xorl %ebp,%ebp
15191 TRACE_IRQS_ON
15192 1: mov PT_FS(%esp), %fs
15193 +2: mov PT_DS(%esp), %ds
15194 +3: mov PT_ES(%esp), %es
15195 PTGS_TO_GS
15196 ENABLE_INTERRUPTS_SYSEXIT
15197
15198 @@ -449,6 +633,9 @@ sysenter_audit:
15199 movl %eax,%edx /* 2nd arg: syscall number */
15200 movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
15201 call __audit_syscall_entry
15202 +
15203 + pax_erase_kstack
15204 +
15205 pushl_cfi %ebx
15206 movl PT_EAX(%esp),%eax /* reload syscall number */
15207 jmp sysenter_do_call
15208 @@ -474,10 +661,16 @@ sysexit_audit:
15209
15210 CFI_ENDPROC
15211 .pushsection .fixup,"ax"
15212 -2: movl $0,PT_FS(%esp)
15213 +4: movl $0,PT_FS(%esp)
15214 + jmp 1b
15215 +5: movl $0,PT_DS(%esp)
15216 + jmp 1b
15217 +6: movl $0,PT_ES(%esp)
15218 jmp 1b
15219 .popsection
15220 - _ASM_EXTABLE(1b,2b)
15221 + _ASM_EXTABLE(1b,4b)
15222 + _ASM_EXTABLE(2b,5b)
15223 + _ASM_EXTABLE(3b,6b)
15224 PTGS_TO_GS_EX
15225 ENDPROC(ia32_sysenter_target)
15226
15227 @@ -491,6 +684,11 @@ ENTRY(system_call)
15228 pushl_cfi %eax # save orig_eax
15229 SAVE_ALL
15230 GET_THREAD_INFO(%ebp)
15231 +
15232 +#ifdef CONFIG_PAX_RANDKSTACK
15233 + pax_erase_kstack
15234 +#endif
15235 +
15236 # system call tracing in operation / emulation
15237 testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%ebp)
15238 jnz syscall_trace_entry
15239 @@ -509,6 +707,15 @@ syscall_exit:
15240 testl $_TIF_ALLWORK_MASK, %ecx # current->work
15241 jne syscall_exit_work
15242
15243 +restore_all_pax:
15244 +
15245 +#ifdef CONFIG_PAX_RANDKSTACK
15246 + movl %esp, %eax
15247 + call pax_randomize_kstack
15248 +#endif
15249 +
15250 + pax_erase_kstack
15251 +
15252 restore_all:
15253 TRACE_IRQS_IRET
15254 restore_all_notrace:
15255 @@ -565,14 +772,34 @@ ldt_ss:
15256 * compensating for the offset by changing to the ESPFIX segment with
15257 * a base address that matches for the difference.
15258 */
15259 -#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS * 8)
15260 +#define GDT_ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)(%ebx)
15261 mov %esp, %edx /* load kernel esp */
15262 mov PT_OLDESP(%esp), %eax /* load userspace esp */
15263 mov %dx, %ax /* eax: new kernel esp */
15264 sub %eax, %edx /* offset (low word is 0) */
15265 +#ifdef CONFIG_SMP
15266 + movl PER_CPU_VAR(cpu_number), %ebx
15267 + shll $PAGE_SHIFT_asm, %ebx
15268 + addl $cpu_gdt_table, %ebx
15269 +#else
15270 + movl $cpu_gdt_table, %ebx
15271 +#endif
15272 shr $16, %edx
15273 - mov %dl, GDT_ESPFIX_SS + 4 /* bits 16..23 */
15274 - mov %dh, GDT_ESPFIX_SS + 7 /* bits 24..31 */
15275 +
15276 +#ifdef CONFIG_PAX_KERNEXEC
15277 + mov %cr0, %esi
15278 + btr $16, %esi
15279 + mov %esi, %cr0
15280 +#endif
15281 +
15282 + mov %dl, 4 + GDT_ESPFIX_SS /* bits 16..23 */
15283 + mov %dh, 7 + GDT_ESPFIX_SS /* bits 24..31 */
15284 +
15285 +#ifdef CONFIG_PAX_KERNEXEC
15286 + bts $16, %esi
15287 + mov %esi, %cr0
15288 +#endif
15289 +
15290 pushl_cfi $__ESPFIX_SS
15291 pushl_cfi %eax /* new kernel esp */
15292 /* Disable interrupts, but do not irqtrace this section: we
15293 @@ -601,35 +828,23 @@ work_resched:
15294 movl TI_flags(%ebp), %ecx
15295 andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
15296 # than syscall tracing?
15297 - jz restore_all
15298 + jz restore_all_pax
15299 testb $_TIF_NEED_RESCHED, %cl
15300 jnz work_resched
15301
15302 work_notifysig: # deal with pending signals and
15303 # notify-resume requests
15304 + movl %esp, %eax
15305 #ifdef CONFIG_VM86
15306 testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
15307 - movl %esp, %eax
15308 - jne work_notifysig_v86 # returning to kernel-space or
15309 + jz 1f # returning to kernel-space or
15310 # vm86-space
15311 - TRACE_IRQS_ON
15312 - ENABLE_INTERRUPTS(CLBR_NONE)
15313 - movb PT_CS(%esp), %bl
15314 - andb $SEGMENT_RPL_MASK, %bl
15315 - cmpb $USER_RPL, %bl
15316 - jb resume_kernel
15317 - xorl %edx, %edx
15318 - call do_notify_resume
15319 - jmp resume_userspace
15320
15321 - ALIGN
15322 -work_notifysig_v86:
15323 pushl_cfi %ecx # save ti_flags for do_notify_resume
15324 call save_v86_state # %eax contains pt_regs pointer
15325 popl_cfi %ecx
15326 movl %eax, %esp
15327 -#else
15328 - movl %esp, %eax
15329 +1:
15330 #endif
15331 TRACE_IRQS_ON
15332 ENABLE_INTERRUPTS(CLBR_NONE)
15333 @@ -640,7 +855,7 @@ work_notifysig_v86:
15334 xorl %edx, %edx
15335 call do_notify_resume
15336 jmp resume_userspace
15337 -END(work_pending)
15338 +ENDPROC(work_pending)
15339
15340 # perform syscall exit tracing
15341 ALIGN
15342 @@ -648,11 +863,14 @@ syscall_trace_entry:
15343 movl $-ENOSYS,PT_EAX(%esp)
15344 movl %esp, %eax
15345 call syscall_trace_enter
15346 +
15347 + pax_erase_kstack
15348 +
15349 /* What it returned is what we'll actually use. */
15350 cmpl $(NR_syscalls), %eax
15351 jnae syscall_call
15352 jmp syscall_exit
15353 -END(syscall_trace_entry)
15354 +ENDPROC(syscall_trace_entry)
15355
15356 # perform syscall exit tracing
15357 ALIGN
15358 @@ -665,20 +883,24 @@ syscall_exit_work:
15359 movl %esp, %eax
15360 call syscall_trace_leave
15361 jmp resume_userspace
15362 -END(syscall_exit_work)
15363 +ENDPROC(syscall_exit_work)
15364 CFI_ENDPROC
15365
15366 RING0_INT_FRAME # can't unwind into user space anyway
15367 syscall_fault:
15368 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15369 + push %ss
15370 + pop %ds
15371 +#endif
15372 GET_THREAD_INFO(%ebp)
15373 movl $-EFAULT,PT_EAX(%esp)
15374 jmp resume_userspace
15375 -END(syscall_fault)
15376 +ENDPROC(syscall_fault)
15377
15378 syscall_badsys:
15379 movl $-ENOSYS,PT_EAX(%esp)
15380 jmp resume_userspace
15381 -END(syscall_badsys)
15382 +ENDPROC(syscall_badsys)
15383 CFI_ENDPROC
15384 /*
15385 * End of kprobes section
15386 @@ -750,6 +972,36 @@ ENTRY(ptregs_clone)
15387 CFI_ENDPROC
15388 ENDPROC(ptregs_clone)
15389
15390 + ALIGN;
15391 +ENTRY(kernel_execve)
15392 + CFI_STARTPROC
15393 + pushl_cfi %ebp
15394 + sub $PT_OLDSS+4,%esp
15395 + pushl_cfi %edi
15396 + pushl_cfi %ecx
15397 + pushl_cfi %eax
15398 + lea 3*4(%esp),%edi
15399 + mov $PT_OLDSS/4+1,%ecx
15400 + xorl %eax,%eax
15401 + rep stosl
15402 + popl_cfi %eax
15403 + popl_cfi %ecx
15404 + popl_cfi %edi
15405 + movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
15406 + pushl_cfi %esp
15407 + call sys_execve
15408 + add $4,%esp
15409 + CFI_ADJUST_CFA_OFFSET -4
15410 + GET_THREAD_INFO(%ebp)
15411 + test %eax,%eax
15412 + jz syscall_exit
15413 + add $PT_OLDSS+4,%esp
15414 + CFI_ADJUST_CFA_OFFSET -PT_OLDSS-4
15415 + popl_cfi %ebp
15416 + ret
15417 + CFI_ENDPROC
15418 +ENDPROC(kernel_execve)
15419 +
15420 .macro FIXUP_ESPFIX_STACK
15421 /*
15422 * Switch back for ESPFIX stack to the normal zerobased stack
15423 @@ -759,8 +1011,15 @@ ENDPROC(ptregs_clone)
15424 * normal stack and adjusts ESP with the matching offset.
15425 */
15426 /* fixup the stack */
15427 - mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */
15428 - mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */
15429 +#ifdef CONFIG_SMP
15430 + movl PER_CPU_VAR(cpu_number), %ebx
15431 + shll $PAGE_SHIFT_asm, %ebx
15432 + addl $cpu_gdt_table, %ebx
15433 +#else
15434 + movl $cpu_gdt_table, %ebx
15435 +#endif
15436 + mov 4 + GDT_ESPFIX_SS, %al /* bits 16..23 */
15437 + mov 7 + GDT_ESPFIX_SS, %ah /* bits 24..31 */
15438 shl $16, %eax
15439 addl %esp, %eax /* the adjusted stack pointer */
15440 pushl_cfi $__KERNEL_DS
15441 @@ -813,7 +1072,7 @@ vector=vector+1
15442 .endr
15443 2: jmp common_interrupt
15444 .endr
15445 -END(irq_entries_start)
15446 +ENDPROC(irq_entries_start)
15447
15448 .previous
15449 END(interrupt)
15450 @@ -861,7 +1120,7 @@ ENTRY(coprocessor_error)
15451 pushl_cfi $do_coprocessor_error
15452 jmp error_code
15453 CFI_ENDPROC
15454 -END(coprocessor_error)
15455 +ENDPROC(coprocessor_error)
15456
15457 ENTRY(simd_coprocessor_error)
15458 RING0_INT_FRAME
15459 @@ -882,7 +1141,7 @@ ENTRY(simd_coprocessor_error)
15460 #endif
15461 jmp error_code
15462 CFI_ENDPROC
15463 -END(simd_coprocessor_error)
15464 +ENDPROC(simd_coprocessor_error)
15465
15466 ENTRY(device_not_available)
15467 RING0_INT_FRAME
15468 @@ -890,18 +1149,18 @@ ENTRY(device_not_available)
15469 pushl_cfi $do_device_not_available
15470 jmp error_code
15471 CFI_ENDPROC
15472 -END(device_not_available)
15473 +ENDPROC(device_not_available)
15474
15475 #ifdef CONFIG_PARAVIRT
15476 ENTRY(native_iret)
15477 iret
15478 _ASM_EXTABLE(native_iret, iret_exc)
15479 -END(native_iret)
15480 +ENDPROC(native_iret)
15481
15482 ENTRY(native_irq_enable_sysexit)
15483 sti
15484 sysexit
15485 -END(native_irq_enable_sysexit)
15486 +ENDPROC(native_irq_enable_sysexit)
15487 #endif
15488
15489 ENTRY(overflow)
15490 @@ -910,7 +1169,7 @@ ENTRY(overflow)
15491 pushl_cfi $do_overflow
15492 jmp error_code
15493 CFI_ENDPROC
15494 -END(overflow)
15495 +ENDPROC(overflow)
15496
15497 ENTRY(bounds)
15498 RING0_INT_FRAME
15499 @@ -918,7 +1177,7 @@ ENTRY(bounds)
15500 pushl_cfi $do_bounds
15501 jmp error_code
15502 CFI_ENDPROC
15503 -END(bounds)
15504 +ENDPROC(bounds)
15505
15506 ENTRY(invalid_op)
15507 RING0_INT_FRAME
15508 @@ -926,7 +1185,7 @@ ENTRY(invalid_op)
15509 pushl_cfi $do_invalid_op
15510 jmp error_code
15511 CFI_ENDPROC
15512 -END(invalid_op)
15513 +ENDPROC(invalid_op)
15514
15515 ENTRY(coprocessor_segment_overrun)
15516 RING0_INT_FRAME
15517 @@ -934,35 +1193,35 @@ ENTRY(coprocessor_segment_overrun)
15518 pushl_cfi $do_coprocessor_segment_overrun
15519 jmp error_code
15520 CFI_ENDPROC
15521 -END(coprocessor_segment_overrun)
15522 +ENDPROC(coprocessor_segment_overrun)
15523
15524 ENTRY(invalid_TSS)
15525 RING0_EC_FRAME
15526 pushl_cfi $do_invalid_TSS
15527 jmp error_code
15528 CFI_ENDPROC
15529 -END(invalid_TSS)
15530 +ENDPROC(invalid_TSS)
15531
15532 ENTRY(segment_not_present)
15533 RING0_EC_FRAME
15534 pushl_cfi $do_segment_not_present
15535 jmp error_code
15536 CFI_ENDPROC
15537 -END(segment_not_present)
15538 +ENDPROC(segment_not_present)
15539
15540 ENTRY(stack_segment)
15541 RING0_EC_FRAME
15542 pushl_cfi $do_stack_segment
15543 jmp error_code
15544 CFI_ENDPROC
15545 -END(stack_segment)
15546 +ENDPROC(stack_segment)
15547
15548 ENTRY(alignment_check)
15549 RING0_EC_FRAME
15550 pushl_cfi $do_alignment_check
15551 jmp error_code
15552 CFI_ENDPROC
15553 -END(alignment_check)
15554 +ENDPROC(alignment_check)
15555
15556 ENTRY(divide_error)
15557 RING0_INT_FRAME
15558 @@ -970,7 +1229,7 @@ ENTRY(divide_error)
15559 pushl_cfi $do_divide_error
15560 jmp error_code
15561 CFI_ENDPROC
15562 -END(divide_error)
15563 +ENDPROC(divide_error)
15564
15565 #ifdef CONFIG_X86_MCE
15566 ENTRY(machine_check)
15567 @@ -979,7 +1238,7 @@ ENTRY(machine_check)
15568 pushl_cfi machine_check_vector
15569 jmp error_code
15570 CFI_ENDPROC
15571 -END(machine_check)
15572 +ENDPROC(machine_check)
15573 #endif
15574
15575 ENTRY(spurious_interrupt_bug)
15576 @@ -988,7 +1247,7 @@ ENTRY(spurious_interrupt_bug)
15577 pushl_cfi $do_spurious_interrupt_bug
15578 jmp error_code
15579 CFI_ENDPROC
15580 -END(spurious_interrupt_bug)
15581 +ENDPROC(spurious_interrupt_bug)
15582 /*
15583 * End of kprobes section
15584 */
15585 @@ -1100,7 +1359,7 @@ BUILD_INTERRUPT3(xen_hvm_callback_vector, XEN_HVM_EVTCHN_CALLBACK,
15586
15587 ENTRY(mcount)
15588 ret
15589 -END(mcount)
15590 +ENDPROC(mcount)
15591
15592 ENTRY(ftrace_caller)
15593 cmpl $0, function_trace_stop
15594 @@ -1129,7 +1388,7 @@ ftrace_graph_call:
15595 .globl ftrace_stub
15596 ftrace_stub:
15597 ret
15598 -END(ftrace_caller)
15599 +ENDPROC(ftrace_caller)
15600
15601 #else /* ! CONFIG_DYNAMIC_FTRACE */
15602
15603 @@ -1165,7 +1424,7 @@ trace:
15604 popl %ecx
15605 popl %eax
15606 jmp ftrace_stub
15607 -END(mcount)
15608 +ENDPROC(mcount)
15609 #endif /* CONFIG_DYNAMIC_FTRACE */
15610 #endif /* CONFIG_FUNCTION_TRACER */
15611
15612 @@ -1186,7 +1445,7 @@ ENTRY(ftrace_graph_caller)
15613 popl %ecx
15614 popl %eax
15615 ret
15616 -END(ftrace_graph_caller)
15617 +ENDPROC(ftrace_graph_caller)
15618
15619 .globl return_to_handler
15620 return_to_handler:
15621 @@ -1241,15 +1500,18 @@ error_code:
15622 movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
15623 REG_TO_PTGS %ecx
15624 SET_KERNEL_GS %ecx
15625 - movl $(__USER_DS), %ecx
15626 + movl $(__KERNEL_DS), %ecx
15627 movl %ecx, %ds
15628 movl %ecx, %es
15629 +
15630 + pax_enter_kernel
15631 +
15632 TRACE_IRQS_OFF
15633 movl %esp,%eax # pt_regs pointer
15634 call *%edi
15635 jmp ret_from_exception
15636 CFI_ENDPROC
15637 -END(page_fault)
15638 +ENDPROC(page_fault)
15639
15640 /*
15641 * Debug traps and NMI can happen at the one SYSENTER instruction
15642 @@ -1291,7 +1553,7 @@ debug_stack_correct:
15643 call do_debug
15644 jmp ret_from_exception
15645 CFI_ENDPROC
15646 -END(debug)
15647 +ENDPROC(debug)
15648
15649 /*
15650 * NMI is doubly nasty. It can happen _while_ we're handling
15651 @@ -1328,6 +1590,9 @@ nmi_stack_correct:
15652 xorl %edx,%edx # zero error code
15653 movl %esp,%eax # pt_regs pointer
15654 call do_nmi
15655 +
15656 + pax_exit_kernel
15657 +
15658 jmp restore_all_notrace
15659 CFI_ENDPROC
15660
15661 @@ -1364,12 +1629,15 @@ nmi_espfix_stack:
15662 FIXUP_ESPFIX_STACK # %eax == %esp
15663 xorl %edx,%edx # zero error code
15664 call do_nmi
15665 +
15666 + pax_exit_kernel
15667 +
15668 RESTORE_REGS
15669 lss 12+4(%esp), %esp # back to espfix stack
15670 CFI_ADJUST_CFA_OFFSET -24
15671 jmp irq_return
15672 CFI_ENDPROC
15673 -END(nmi)
15674 +ENDPROC(nmi)
15675
15676 ENTRY(int3)
15677 RING0_INT_FRAME
15678 @@ -1381,14 +1649,14 @@ ENTRY(int3)
15679 call do_int3
15680 jmp ret_from_exception
15681 CFI_ENDPROC
15682 -END(int3)
15683 +ENDPROC(int3)
15684
15685 ENTRY(general_protection)
15686 RING0_EC_FRAME
15687 pushl_cfi $do_general_protection
15688 jmp error_code
15689 CFI_ENDPROC
15690 -END(general_protection)
15691 +ENDPROC(general_protection)
15692
15693 #ifdef CONFIG_KVM_GUEST
15694 ENTRY(async_page_fault)
15695 @@ -1396,7 +1664,7 @@ ENTRY(async_page_fault)
15696 pushl_cfi $do_async_page_fault
15697 jmp error_code
15698 CFI_ENDPROC
15699 -END(async_page_fault)
15700 +ENDPROC(async_page_fault)
15701 #endif
15702
15703 /*
15704 diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
15705 index 7d65133..c888d5f 100644
15706 --- a/arch/x86/kernel/entry_64.S
15707 +++ b/arch/x86/kernel/entry_64.S
15708 @@ -57,6 +57,8 @@
15709 #include <asm/percpu.h>
15710 #include <asm/asm.h>
15711 #include <linux/err.h>
15712 +#include <asm/pgtable.h>
15713 +#include <asm/alternative-asm.h>
15714
15715 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
15716 #include <linux/elf-em.h>
15717 @@ -70,8 +72,9 @@
15718 #ifdef CONFIG_FUNCTION_TRACER
15719 #ifdef CONFIG_DYNAMIC_FTRACE
15720 ENTRY(mcount)
15721 + pax_force_retaddr
15722 retq
15723 -END(mcount)
15724 +ENDPROC(mcount)
15725
15726 ENTRY(ftrace_caller)
15727 cmpl $0, function_trace_stop
15728 @@ -94,8 +97,9 @@ GLOBAL(ftrace_graph_call)
15729 #endif
15730
15731 GLOBAL(ftrace_stub)
15732 + pax_force_retaddr
15733 retq
15734 -END(ftrace_caller)
15735 +ENDPROC(ftrace_caller)
15736
15737 #else /* ! CONFIG_DYNAMIC_FTRACE */
15738 ENTRY(mcount)
15739 @@ -114,6 +118,7 @@ ENTRY(mcount)
15740 #endif
15741
15742 GLOBAL(ftrace_stub)
15743 + pax_force_retaddr
15744 retq
15745
15746 trace:
15747 @@ -123,12 +128,13 @@ trace:
15748 movq 8(%rbp), %rsi
15749 subq $MCOUNT_INSN_SIZE, %rdi
15750
15751 + pax_force_fptr ftrace_trace_function
15752 call *ftrace_trace_function
15753
15754 MCOUNT_RESTORE_FRAME
15755
15756 jmp ftrace_stub
15757 -END(mcount)
15758 +ENDPROC(mcount)
15759 #endif /* CONFIG_DYNAMIC_FTRACE */
15760 #endif /* CONFIG_FUNCTION_TRACER */
15761
15762 @@ -148,8 +154,9 @@ ENTRY(ftrace_graph_caller)
15763
15764 MCOUNT_RESTORE_FRAME
15765
15766 + pax_force_retaddr
15767 retq
15768 -END(ftrace_graph_caller)
15769 +ENDPROC(ftrace_graph_caller)
15770
15771 GLOBAL(return_to_handler)
15772 subq $24, %rsp
15773 @@ -165,6 +172,7 @@ GLOBAL(return_to_handler)
15774 movq 8(%rsp), %rdx
15775 movq (%rsp), %rax
15776 addq $24, %rsp
15777 + pax_force_fptr %rdi
15778 jmp *%rdi
15779 #endif
15780
15781 @@ -180,6 +188,280 @@ ENTRY(native_usergs_sysret64)
15782 ENDPROC(native_usergs_sysret64)
15783 #endif /* CONFIG_PARAVIRT */
15784
15785 + .macro ljmpq sel, off
15786 +#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
15787 + .byte 0x48; ljmp *1234f(%rip)
15788 + .pushsection .rodata
15789 + .align 16
15790 + 1234: .quad \off; .word \sel
15791 + .popsection
15792 +#else
15793 + pushq $\sel
15794 + pushq $\off
15795 + lretq
15796 +#endif
15797 + .endm
15798 +
15799 + .macro pax_enter_kernel
15800 + pax_set_fptr_mask
15801 +#ifdef CONFIG_PAX_KERNEXEC
15802 + call pax_enter_kernel
15803 +#endif
15804 + .endm
15805 +
15806 + .macro pax_exit_kernel
15807 +#ifdef CONFIG_PAX_KERNEXEC
15808 + call pax_exit_kernel
15809 +#endif
15810 + .endm
15811 +
15812 +#ifdef CONFIG_PAX_KERNEXEC
15813 +ENTRY(pax_enter_kernel)
15814 + pushq %rdi
15815 +
15816 +#ifdef CONFIG_PARAVIRT
15817 + PV_SAVE_REGS(CLBR_RDI)
15818 +#endif
15819 +
15820 + GET_CR0_INTO_RDI
15821 + bts $16,%rdi
15822 + jnc 3f
15823 + mov %cs,%edi
15824 + cmp $__KERNEL_CS,%edi
15825 + jnz 2f
15826 +1:
15827 +
15828 +#ifdef CONFIG_PARAVIRT
15829 + PV_RESTORE_REGS(CLBR_RDI)
15830 +#endif
15831 +
15832 + popq %rdi
15833 + pax_force_retaddr
15834 + retq
15835 +
15836 +2: ljmpq __KERNEL_CS,1f
15837 +3: ljmpq __KERNEXEC_KERNEL_CS,4f
15838 +4: SET_RDI_INTO_CR0
15839 + jmp 1b
15840 +ENDPROC(pax_enter_kernel)
15841 +
15842 +ENTRY(pax_exit_kernel)
15843 + pushq %rdi
15844 +
15845 +#ifdef CONFIG_PARAVIRT
15846 + PV_SAVE_REGS(CLBR_RDI)
15847 +#endif
15848 +
15849 + mov %cs,%rdi
15850 + cmp $__KERNEXEC_KERNEL_CS,%edi
15851 + jz 2f
15852 +1:
15853 +
15854 +#ifdef CONFIG_PARAVIRT
15855 + PV_RESTORE_REGS(CLBR_RDI);
15856 +#endif
15857 +
15858 + popq %rdi
15859 + pax_force_retaddr
15860 + retq
15861 +
15862 +2: GET_CR0_INTO_RDI
15863 + btr $16,%rdi
15864 + ljmpq __KERNEL_CS,3f
15865 +3: SET_RDI_INTO_CR0
15866 + jmp 1b
15867 +#ifdef CONFIG_PARAVIRT
15868 + PV_RESTORE_REGS(CLBR_RDI);
15869 +#endif
15870 +
15871 + popq %rdi
15872 + pax_force_retaddr
15873 + retq
15874 +ENDPROC(pax_exit_kernel)
15875 +#endif
15876 +
15877 + .macro pax_enter_kernel_user
15878 + pax_set_fptr_mask
15879 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15880 + call pax_enter_kernel_user
15881 +#endif
15882 + .endm
15883 +
15884 + .macro pax_exit_kernel_user
15885 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15886 + call pax_exit_kernel_user
15887 +#endif
15888 +#ifdef CONFIG_PAX_RANDKSTACK
15889 + pushq %rax
15890 + call pax_randomize_kstack
15891 + popq %rax
15892 +#endif
15893 + .endm
15894 +
15895 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15896 +ENTRY(pax_enter_kernel_user)
15897 + pushq %rdi
15898 + pushq %rbx
15899 +
15900 +#ifdef CONFIG_PARAVIRT
15901 + PV_SAVE_REGS(CLBR_RDI)
15902 +#endif
15903 +
15904 + GET_CR3_INTO_RDI
15905 + mov %rdi,%rbx
15906 + add $__START_KERNEL_map,%rbx
15907 + sub phys_base(%rip),%rbx
15908 +
15909 +#ifdef CONFIG_PARAVIRT
15910 + pushq %rdi
15911 + cmpl $0, pv_info+PARAVIRT_enabled
15912 + jz 1f
15913 + i = 0
15914 + .rept USER_PGD_PTRS
15915 + mov i*8(%rbx),%rsi
15916 + mov $0,%sil
15917 + lea i*8(%rbx),%rdi
15918 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
15919 + i = i + 1
15920 + .endr
15921 + jmp 2f
15922 +1:
15923 +#endif
15924 +
15925 + i = 0
15926 + .rept USER_PGD_PTRS
15927 + movb $0,i*8(%rbx)
15928 + i = i + 1
15929 + .endr
15930 +
15931 +#ifdef CONFIG_PARAVIRT
15932 +2: popq %rdi
15933 +#endif
15934 + SET_RDI_INTO_CR3
15935 +
15936 +#ifdef CONFIG_PAX_KERNEXEC
15937 + GET_CR0_INTO_RDI
15938 + bts $16,%rdi
15939 + SET_RDI_INTO_CR0
15940 +#endif
15941 +
15942 +#ifdef CONFIG_PARAVIRT
15943 + PV_RESTORE_REGS(CLBR_RDI)
15944 +#endif
15945 +
15946 + popq %rbx
15947 + popq %rdi
15948 + pax_force_retaddr
15949 + retq
15950 +ENDPROC(pax_enter_kernel_user)
15951 +
15952 +ENTRY(pax_exit_kernel_user)
15953 + push %rdi
15954 +
15955 +#ifdef CONFIG_PARAVIRT
15956 + pushq %rbx
15957 + PV_SAVE_REGS(CLBR_RDI)
15958 +#endif
15959 +
15960 +#ifdef CONFIG_PAX_KERNEXEC
15961 + GET_CR0_INTO_RDI
15962 + btr $16,%rdi
15963 + SET_RDI_INTO_CR0
15964 +#endif
15965 +
15966 + GET_CR3_INTO_RDI
15967 + add $__START_KERNEL_map,%rdi
15968 + sub phys_base(%rip),%rdi
15969 +
15970 +#ifdef CONFIG_PARAVIRT
15971 + cmpl $0, pv_info+PARAVIRT_enabled
15972 + jz 1f
15973 + mov %rdi,%rbx
15974 + i = 0
15975 + .rept USER_PGD_PTRS
15976 + mov i*8(%rbx),%rsi
15977 + mov $0x67,%sil
15978 + lea i*8(%rbx),%rdi
15979 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
15980 + i = i + 1
15981 + .endr
15982 + jmp 2f
15983 +1:
15984 +#endif
15985 +
15986 + i = 0
15987 + .rept USER_PGD_PTRS
15988 + movb $0x67,i*8(%rdi)
15989 + i = i + 1
15990 + .endr
15991 +
15992 +#ifdef CONFIG_PARAVIRT
15993 +2: PV_RESTORE_REGS(CLBR_RDI)
15994 + popq %rbx
15995 +#endif
15996 +
15997 + popq %rdi
15998 + pax_force_retaddr
15999 + retq
16000 +ENDPROC(pax_exit_kernel_user)
16001 +#endif
16002 +
16003 +.macro pax_erase_kstack
16004 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
16005 + call pax_erase_kstack
16006 +#endif
16007 +.endm
16008 +
16009 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
16010 +ENTRY(pax_erase_kstack)
16011 + pushq %rdi
16012 + pushq %rcx
16013 + pushq %rax
16014 + pushq %r11
16015 +
16016 + GET_THREAD_INFO(%r11)
16017 + mov TI_lowest_stack(%r11), %rdi
16018 + mov $-0xBEEF, %rax
16019 + std
16020 +
16021 +1: mov %edi, %ecx
16022 + and $THREAD_SIZE_asm - 1, %ecx
16023 + shr $3, %ecx
16024 + repne scasq
16025 + jecxz 2f
16026 +
16027 + cmp $2*8, %ecx
16028 + jc 2f
16029 +
16030 + mov $2*8, %ecx
16031 + repe scasq
16032 + jecxz 2f
16033 + jne 1b
16034 +
16035 +2: cld
16036 + mov %esp, %ecx
16037 + sub %edi, %ecx
16038 +
16039 + cmp $THREAD_SIZE_asm, %rcx
16040 + jb 3f
16041 + ud2
16042 +3:
16043 +
16044 + shr $3, %ecx
16045 + rep stosq
16046 +
16047 + mov TI_task_thread_sp0(%r11), %rdi
16048 + sub $256, %rdi
16049 + mov %rdi, TI_lowest_stack(%r11)
16050 +
16051 + popq %r11
16052 + popq %rax
16053 + popq %rcx
16054 + popq %rdi
16055 + pax_force_retaddr
16056 + ret
16057 +ENDPROC(pax_erase_kstack)
16058 +#endif
16059
16060 .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
16061 #ifdef CONFIG_TRACE_IRQFLAGS
16062 @@ -271,8 +553,8 @@ ENDPROC(native_usergs_sysret64)
16063 .endm
16064
16065 .macro UNFAKE_STACK_FRAME
16066 - addq $8*6, %rsp
16067 - CFI_ADJUST_CFA_OFFSET -(6*8)
16068 + addq $8*6 + ARG_SKIP, %rsp
16069 + CFI_ADJUST_CFA_OFFSET -(6*8 + ARG_SKIP)
16070 .endm
16071
16072 /*
16073 @@ -359,7 +641,7 @@ ENDPROC(native_usergs_sysret64)
16074 movq %rsp, %rsi
16075
16076 leaq -RBP(%rsp),%rdi /* arg1 for handler */
16077 - testl $3, CS-RBP(%rsi)
16078 + testb $3, CS-RBP(%rsi)
16079 je 1f
16080 SWAPGS
16081 /*
16082 @@ -394,9 +676,10 @@ ENTRY(save_rest)
16083 movq_cfi r15, R15+16
16084 movq %r11, 8(%rsp) /* return address */
16085 FIXUP_TOP_OF_STACK %r11, 16
16086 + pax_force_retaddr
16087 ret
16088 CFI_ENDPROC
16089 -END(save_rest)
16090 +ENDPROC(save_rest)
16091
16092 /* save complete stack frame */
16093 .pushsection .kprobes.text, "ax"
16094 @@ -425,9 +708,10 @@ ENTRY(save_paranoid)
16095 js 1f /* negative -> in kernel */
16096 SWAPGS
16097 xorl %ebx,%ebx
16098 -1: ret
16099 +1: pax_force_retaddr_bts
16100 + ret
16101 CFI_ENDPROC
16102 -END(save_paranoid)
16103 +ENDPROC(save_paranoid)
16104 .popsection
16105
16106 /*
16107 @@ -449,7 +733,7 @@ ENTRY(ret_from_fork)
16108
16109 RESTORE_REST
16110
16111 - testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
16112 + testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
16113 jz retint_restore_args
16114
16115 testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
16116 @@ -459,7 +743,7 @@ ENTRY(ret_from_fork)
16117 jmp ret_from_sys_call # go to the SYSRET fastpath
16118
16119 CFI_ENDPROC
16120 -END(ret_from_fork)
16121 +ENDPROC(ret_from_fork)
16122
16123 /*
16124 * System call entry. Up to 6 arguments in registers are supported.
16125 @@ -495,7 +779,7 @@ END(ret_from_fork)
16126 ENTRY(system_call)
16127 CFI_STARTPROC simple
16128 CFI_SIGNAL_FRAME
16129 - CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
16130 + CFI_DEF_CFA rsp,0
16131 CFI_REGISTER rip,rcx
16132 /*CFI_REGISTER rflags,r11*/
16133 SWAPGS_UNSAFE_STACK
16134 @@ -508,16 +792,23 @@ GLOBAL(system_call_after_swapgs)
16135
16136 movq %rsp,PER_CPU_VAR(old_rsp)
16137 movq PER_CPU_VAR(kernel_stack),%rsp
16138 + SAVE_ARGS 8*6,0
16139 + pax_enter_kernel_user
16140 +
16141 +#ifdef CONFIG_PAX_RANDKSTACK
16142 + pax_erase_kstack
16143 +#endif
16144 +
16145 /*
16146 * No need to follow this irqs off/on section - it's straight
16147 * and short:
16148 */
16149 ENABLE_INTERRUPTS(CLBR_NONE)
16150 - SAVE_ARGS 8,0
16151 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
16152 movq %rcx,RIP-ARGOFFSET(%rsp)
16153 CFI_REL_OFFSET rip,RIP-ARGOFFSET
16154 - testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
16155 + GET_THREAD_INFO(%rcx)
16156 + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%rcx)
16157 jnz tracesys
16158 system_call_fastpath:
16159 #if __SYSCALL_MASK == ~0
16160 @@ -527,7 +818,7 @@ system_call_fastpath:
16161 cmpl $__NR_syscall_max,%eax
16162 #endif
16163 ja badsys
16164 - movq %r10,%rcx
16165 + movq R10-ARGOFFSET(%rsp),%rcx
16166 call *sys_call_table(,%rax,8) # XXX: rip relative
16167 movq %rax,RAX-ARGOFFSET(%rsp)
16168 /*
16169 @@ -541,10 +832,13 @@ sysret_check:
16170 LOCKDEP_SYS_EXIT
16171 DISABLE_INTERRUPTS(CLBR_NONE)
16172 TRACE_IRQS_OFF
16173 - movl TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET),%edx
16174 + GET_THREAD_INFO(%rcx)
16175 + movl TI_flags(%rcx),%edx
16176 andl %edi,%edx
16177 jnz sysret_careful
16178 CFI_REMEMBER_STATE
16179 + pax_exit_kernel_user
16180 + pax_erase_kstack
16181 /*
16182 * sysretq will re-enable interrupts:
16183 */
16184 @@ -596,14 +890,18 @@ badsys:
16185 * jump back to the normal fast path.
16186 */
16187 auditsys:
16188 - movq %r10,%r9 /* 6th arg: 4th syscall arg */
16189 + movq R10-ARGOFFSET(%rsp),%r9 /* 6th arg: 4th syscall arg */
16190 movq %rdx,%r8 /* 5th arg: 3rd syscall arg */
16191 movq %rsi,%rcx /* 4th arg: 2nd syscall arg */
16192 movq %rdi,%rdx /* 3rd arg: 1st syscall arg */
16193 movq %rax,%rsi /* 2nd arg: syscall number */
16194 movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
16195 call __audit_syscall_entry
16196 +
16197 + pax_erase_kstack
16198 +
16199 LOAD_ARGS 0 /* reload call-clobbered registers */
16200 + pax_set_fptr_mask
16201 jmp system_call_fastpath
16202
16203 /*
16204 @@ -624,7 +922,7 @@ sysret_audit:
16205 /* Do syscall tracing */
16206 tracesys:
16207 #ifdef CONFIG_AUDITSYSCALL
16208 - testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
16209 + testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%rcx)
16210 jz auditsys
16211 #endif
16212 SAVE_REST
16213 @@ -632,12 +930,16 @@ tracesys:
16214 FIXUP_TOP_OF_STACK %rdi
16215 movq %rsp,%rdi
16216 call syscall_trace_enter
16217 +
16218 + pax_erase_kstack
16219 +
16220 /*
16221 * Reload arg registers from stack in case ptrace changed them.
16222 * We don't reload %rax because syscall_trace_enter() returned
16223 * the value it wants us to use in the table lookup.
16224 */
16225 LOAD_ARGS ARGOFFSET, 1
16226 + pax_set_fptr_mask
16227 RESTORE_REST
16228 #if __SYSCALL_MASK == ~0
16229 cmpq $__NR_syscall_max,%rax
16230 @@ -646,7 +948,7 @@ tracesys:
16231 cmpl $__NR_syscall_max,%eax
16232 #endif
16233 ja int_ret_from_sys_call /* RAX(%rsp) set to -ENOSYS above */
16234 - movq %r10,%rcx /* fixup for C */
16235 + movq R10-ARGOFFSET(%rsp),%rcx /* fixup for C */
16236 call *sys_call_table(,%rax,8)
16237 movq %rax,RAX-ARGOFFSET(%rsp)
16238 /* Use IRET because user could have changed frame */
16239 @@ -667,7 +969,9 @@ GLOBAL(int_with_check)
16240 andl %edi,%edx
16241 jnz int_careful
16242 andl $~TS_COMPAT,TI_status(%rcx)
16243 - jmp retint_swapgs
16244 + pax_exit_kernel_user
16245 + pax_erase_kstack
16246 + jmp retint_swapgs_pax
16247
16248 /* Either reschedule or signal or syscall exit tracking needed. */
16249 /* First do a reschedule test. */
16250 @@ -713,7 +1017,7 @@ int_restore_rest:
16251 TRACE_IRQS_OFF
16252 jmp int_with_check
16253 CFI_ENDPROC
16254 -END(system_call)
16255 +ENDPROC(system_call)
16256
16257 /*
16258 * Certain special system calls that need to save a complete full stack frame.
16259 @@ -729,7 +1033,7 @@ ENTRY(\label)
16260 call \func
16261 jmp ptregscall_common
16262 CFI_ENDPROC
16263 -END(\label)
16264 +ENDPROC(\label)
16265 .endm
16266
16267 PTREGSCALL stub_clone, sys_clone, %r8
16268 @@ -747,9 +1051,10 @@ ENTRY(ptregscall_common)
16269 movq_cfi_restore R12+8, r12
16270 movq_cfi_restore RBP+8, rbp
16271 movq_cfi_restore RBX+8, rbx
16272 + pax_force_retaddr
16273 ret $REST_SKIP /* pop extended registers */
16274 CFI_ENDPROC
16275 -END(ptregscall_common)
16276 +ENDPROC(ptregscall_common)
16277
16278 ENTRY(stub_execve)
16279 CFI_STARTPROC
16280 @@ -764,7 +1069,7 @@ ENTRY(stub_execve)
16281 RESTORE_REST
16282 jmp int_ret_from_sys_call
16283 CFI_ENDPROC
16284 -END(stub_execve)
16285 +ENDPROC(stub_execve)
16286
16287 /*
16288 * sigreturn is special because it needs to restore all registers on return.
16289 @@ -782,7 +1087,7 @@ ENTRY(stub_rt_sigreturn)
16290 RESTORE_REST
16291 jmp int_ret_from_sys_call
16292 CFI_ENDPROC
16293 -END(stub_rt_sigreturn)
16294 +ENDPROC(stub_rt_sigreturn)
16295
16296 #ifdef CONFIG_X86_X32_ABI
16297 PTREGSCALL stub_x32_sigaltstack, sys32_sigaltstack, %rdx
16298 @@ -851,7 +1156,7 @@ vector=vector+1
16299 2: jmp common_interrupt
16300 .endr
16301 CFI_ENDPROC
16302 -END(irq_entries_start)
16303 +ENDPROC(irq_entries_start)
16304
16305 .previous
16306 END(interrupt)
16307 @@ -871,6 +1176,16 @@ END(interrupt)
16308 subq $ORIG_RAX-RBP, %rsp
16309 CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP
16310 SAVE_ARGS_IRQ
16311 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16312 + testb $3, CS(%rdi)
16313 + jnz 1f
16314 + pax_enter_kernel
16315 + jmp 2f
16316 +1: pax_enter_kernel_user
16317 +2:
16318 +#else
16319 + pax_enter_kernel
16320 +#endif
16321 call \func
16322 .endm
16323
16324 @@ -902,7 +1217,7 @@ ret_from_intr:
16325
16326 exit_intr:
16327 GET_THREAD_INFO(%rcx)
16328 - testl $3,CS-ARGOFFSET(%rsp)
16329 + testb $3,CS-ARGOFFSET(%rsp)
16330 je retint_kernel
16331
16332 /* Interrupt came from user space */
16333 @@ -924,12 +1239,16 @@ retint_swapgs: /* return to user-space */
16334 * The iretq could re-enable interrupts:
16335 */
16336 DISABLE_INTERRUPTS(CLBR_ANY)
16337 + pax_exit_kernel_user
16338 +retint_swapgs_pax:
16339 TRACE_IRQS_IRETQ
16340 SWAPGS
16341 jmp restore_args
16342
16343 retint_restore_args: /* return to kernel space */
16344 DISABLE_INTERRUPTS(CLBR_ANY)
16345 + pax_exit_kernel
16346 + pax_force_retaddr RIP-ARGOFFSET
16347 /*
16348 * The iretq could re-enable interrupts:
16349 */
16350 @@ -1012,7 +1331,7 @@ ENTRY(retint_kernel)
16351 #endif
16352
16353 CFI_ENDPROC
16354 -END(common_interrupt)
16355 +ENDPROC(common_interrupt)
16356 /*
16357 * End of kprobes section
16358 */
16359 @@ -1029,7 +1348,7 @@ ENTRY(\sym)
16360 interrupt \do_sym
16361 jmp ret_from_intr
16362 CFI_ENDPROC
16363 -END(\sym)
16364 +ENDPROC(\sym)
16365 .endm
16366
16367 #ifdef CONFIG_SMP
16368 @@ -1102,12 +1421,22 @@ ENTRY(\sym)
16369 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
16370 call error_entry
16371 DEFAULT_FRAME 0
16372 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16373 + testb $3, CS(%rsp)
16374 + jnz 1f
16375 + pax_enter_kernel
16376 + jmp 2f
16377 +1: pax_enter_kernel_user
16378 +2:
16379 +#else
16380 + pax_enter_kernel
16381 +#endif
16382 movq %rsp,%rdi /* pt_regs pointer */
16383 xorl %esi,%esi /* no error code */
16384 call \do_sym
16385 jmp error_exit /* %ebx: no swapgs flag */
16386 CFI_ENDPROC
16387 -END(\sym)
16388 +ENDPROC(\sym)
16389 .endm
16390
16391 .macro paranoidzeroentry sym do_sym
16392 @@ -1119,15 +1448,25 @@ ENTRY(\sym)
16393 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
16394 call save_paranoid
16395 TRACE_IRQS_OFF
16396 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16397 + testb $3, CS(%rsp)
16398 + jnz 1f
16399 + pax_enter_kernel
16400 + jmp 2f
16401 +1: pax_enter_kernel_user
16402 +2:
16403 +#else
16404 + pax_enter_kernel
16405 +#endif
16406 movq %rsp,%rdi /* pt_regs pointer */
16407 xorl %esi,%esi /* no error code */
16408 call \do_sym
16409 jmp paranoid_exit /* %ebx: no swapgs flag */
16410 CFI_ENDPROC
16411 -END(\sym)
16412 +ENDPROC(\sym)
16413 .endm
16414
16415 -#define INIT_TSS_IST(x) PER_CPU_VAR(init_tss) + (TSS_ist + ((x) - 1) * 8)
16416 +#define INIT_TSS_IST(x) (TSS_ist + ((x) - 1) * 8)(%r12)
16417 .macro paranoidzeroentry_ist sym do_sym ist
16418 ENTRY(\sym)
16419 INTR_FRAME
16420 @@ -1137,14 +1476,30 @@ ENTRY(\sym)
16421 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
16422 call save_paranoid
16423 TRACE_IRQS_OFF_DEBUG
16424 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16425 + testb $3, CS(%rsp)
16426 + jnz 1f
16427 + pax_enter_kernel
16428 + jmp 2f
16429 +1: pax_enter_kernel_user
16430 +2:
16431 +#else
16432 + pax_enter_kernel
16433 +#endif
16434 movq %rsp,%rdi /* pt_regs pointer */
16435 xorl %esi,%esi /* no error code */
16436 +#ifdef CONFIG_SMP
16437 + imul $TSS_size, PER_CPU_VAR(cpu_number), %r12d
16438 + lea init_tss(%r12), %r12
16439 +#else
16440 + lea init_tss(%rip), %r12
16441 +#endif
16442 subq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
16443 call \do_sym
16444 addq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
16445 jmp paranoid_exit /* %ebx: no swapgs flag */
16446 CFI_ENDPROC
16447 -END(\sym)
16448 +ENDPROC(\sym)
16449 .endm
16450
16451 .macro errorentry sym do_sym
16452 @@ -1155,13 +1510,23 @@ ENTRY(\sym)
16453 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
16454 call error_entry
16455 DEFAULT_FRAME 0
16456 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16457 + testb $3, CS(%rsp)
16458 + jnz 1f
16459 + pax_enter_kernel
16460 + jmp 2f
16461 +1: pax_enter_kernel_user
16462 +2:
16463 +#else
16464 + pax_enter_kernel
16465 +#endif
16466 movq %rsp,%rdi /* pt_regs pointer */
16467 movq ORIG_RAX(%rsp),%rsi /* get error code */
16468 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
16469 call \do_sym
16470 jmp error_exit /* %ebx: no swapgs flag */
16471 CFI_ENDPROC
16472 -END(\sym)
16473 +ENDPROC(\sym)
16474 .endm
16475
16476 /* error code is on the stack already */
16477 @@ -1174,13 +1539,23 @@ ENTRY(\sym)
16478 call save_paranoid
16479 DEFAULT_FRAME 0
16480 TRACE_IRQS_OFF
16481 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16482 + testb $3, CS(%rsp)
16483 + jnz 1f
16484 + pax_enter_kernel
16485 + jmp 2f
16486 +1: pax_enter_kernel_user
16487 +2:
16488 +#else
16489 + pax_enter_kernel
16490 +#endif
16491 movq %rsp,%rdi /* pt_regs pointer */
16492 movq ORIG_RAX(%rsp),%rsi /* get error code */
16493 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
16494 call \do_sym
16495 jmp paranoid_exit /* %ebx: no swapgs flag */
16496 CFI_ENDPROC
16497 -END(\sym)
16498 +ENDPROC(\sym)
16499 .endm
16500
16501 zeroentry divide_error do_divide_error
16502 @@ -1210,9 +1585,10 @@ gs_change:
16503 2: mfence /* workaround */
16504 SWAPGS
16505 popfq_cfi
16506 + pax_force_retaddr
16507 ret
16508 CFI_ENDPROC
16509 -END(native_load_gs_index)
16510 +ENDPROC(native_load_gs_index)
16511
16512 _ASM_EXTABLE(gs_change,bad_gs)
16513 .section .fixup,"ax"
16514 @@ -1231,13 +1607,14 @@ ENTRY(kernel_thread_helper)
16515 * Here we are in the child and the registers are set as they were
16516 * at kernel_thread() invocation in the parent.
16517 */
16518 + pax_force_fptr %rsi
16519 call *%rsi
16520 # exit
16521 mov %eax, %edi
16522 call do_exit
16523 ud2 # padding for call trace
16524 CFI_ENDPROC
16525 -END(kernel_thread_helper)
16526 +ENDPROC(kernel_thread_helper)
16527
16528 /*
16529 * execve(). This function needs to use IRET, not SYSRET, to set up all state properly.
16530 @@ -1264,11 +1641,11 @@ ENTRY(kernel_execve)
16531 RESTORE_REST
16532 testq %rax,%rax
16533 je int_ret_from_sys_call
16534 - RESTORE_ARGS
16535 UNFAKE_STACK_FRAME
16536 + pax_force_retaddr
16537 ret
16538 CFI_ENDPROC
16539 -END(kernel_execve)
16540 +ENDPROC(kernel_execve)
16541
16542 /* Call softirq on interrupt stack. Interrupts are off. */
16543 ENTRY(call_softirq)
16544 @@ -1286,9 +1663,10 @@ ENTRY(call_softirq)
16545 CFI_DEF_CFA_REGISTER rsp
16546 CFI_ADJUST_CFA_OFFSET -8
16547 decl PER_CPU_VAR(irq_count)
16548 + pax_force_retaddr
16549 ret
16550 CFI_ENDPROC
16551 -END(call_softirq)
16552 +ENDPROC(call_softirq)
16553
16554 #ifdef CONFIG_XEN
16555 zeroentry xen_hypervisor_callback xen_do_hypervisor_callback
16556 @@ -1326,7 +1704,7 @@ ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
16557 decl PER_CPU_VAR(irq_count)
16558 jmp error_exit
16559 CFI_ENDPROC
16560 -END(xen_do_hypervisor_callback)
16561 +ENDPROC(xen_do_hypervisor_callback)
16562
16563 /*
16564 * Hypervisor uses this for application faults while it executes.
16565 @@ -1385,7 +1763,7 @@ ENTRY(xen_failsafe_callback)
16566 SAVE_ALL
16567 jmp error_exit
16568 CFI_ENDPROC
16569 -END(xen_failsafe_callback)
16570 +ENDPROC(xen_failsafe_callback)
16571
16572 apicinterrupt XEN_HVM_EVTCHN_CALLBACK \
16573 xen_hvm_callback_vector xen_evtchn_do_upcall
16574 @@ -1434,16 +1812,31 @@ ENTRY(paranoid_exit)
16575 TRACE_IRQS_OFF_DEBUG
16576 testl %ebx,%ebx /* swapgs needed? */
16577 jnz paranoid_restore
16578 - testl $3,CS(%rsp)
16579 + testb $3,CS(%rsp)
16580 jnz paranoid_userspace
16581 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16582 + pax_exit_kernel
16583 + TRACE_IRQS_IRETQ 0
16584 + SWAPGS_UNSAFE_STACK
16585 + RESTORE_ALL 8
16586 + pax_force_retaddr_bts
16587 + jmp irq_return
16588 +#endif
16589 paranoid_swapgs:
16590 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16591 + pax_exit_kernel_user
16592 +#else
16593 + pax_exit_kernel
16594 +#endif
16595 TRACE_IRQS_IRETQ 0
16596 SWAPGS_UNSAFE_STACK
16597 RESTORE_ALL 8
16598 jmp irq_return
16599 paranoid_restore:
16600 + pax_exit_kernel
16601 TRACE_IRQS_IRETQ_DEBUG 0
16602 RESTORE_ALL 8
16603 + pax_force_retaddr_bts
16604 jmp irq_return
16605 paranoid_userspace:
16606 GET_THREAD_INFO(%rcx)
16607 @@ -1472,7 +1865,7 @@ paranoid_schedule:
16608 TRACE_IRQS_OFF
16609 jmp paranoid_userspace
16610 CFI_ENDPROC
16611 -END(paranoid_exit)
16612 +ENDPROC(paranoid_exit)
16613
16614 /*
16615 * Exception entry point. This expects an error code/orig_rax on the stack.
16616 @@ -1499,12 +1892,13 @@ ENTRY(error_entry)
16617 movq_cfi r14, R14+8
16618 movq_cfi r15, R15+8
16619 xorl %ebx,%ebx
16620 - testl $3,CS+8(%rsp)
16621 + testb $3,CS+8(%rsp)
16622 je error_kernelspace
16623 error_swapgs:
16624 SWAPGS
16625 error_sti:
16626 TRACE_IRQS_OFF
16627 + pax_force_retaddr_bts
16628 ret
16629
16630 /*
16631 @@ -1531,7 +1925,7 @@ bstep_iret:
16632 movq %rcx,RIP+8(%rsp)
16633 jmp error_swapgs
16634 CFI_ENDPROC
16635 -END(error_entry)
16636 +ENDPROC(error_entry)
16637
16638
16639 /* ebx: no swapgs flag (1: don't need swapgs, 0: need it) */
16640 @@ -1551,7 +1945,7 @@ ENTRY(error_exit)
16641 jnz retint_careful
16642 jmp retint_swapgs
16643 CFI_ENDPROC
16644 -END(error_exit)
16645 +ENDPROC(error_exit)
16646
16647 /*
16648 * Test if a given stack is an NMI stack or not.
16649 @@ -1609,9 +2003,11 @@ ENTRY(nmi)
16650 * If %cs was not the kernel segment, then the NMI triggered in user
16651 * space, which means it is definitely not nested.
16652 */
16653 + cmpl $__KERNEXEC_KERNEL_CS, 16(%rsp)
16654 + je 1f
16655 cmpl $__KERNEL_CS, 16(%rsp)
16656 jne first_nmi
16657 -
16658 +1:
16659 /*
16660 * Check the special variable on the stack to see if NMIs are
16661 * executing.
16662 @@ -1758,6 +2154,16 @@ end_repeat_nmi:
16663 */
16664 call save_paranoid
16665 DEFAULT_FRAME 0
16666 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16667 + testb $3, CS(%rsp)
16668 + jnz 1f
16669 + pax_enter_kernel
16670 + jmp 2f
16671 +1: pax_enter_kernel_user
16672 +2:
16673 +#else
16674 + pax_enter_kernel
16675 +#endif
16676 /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
16677 movq %rsp,%rdi
16678 movq $-1,%rsi
16679 @@ -1765,21 +2171,32 @@ end_repeat_nmi:
16680 testl %ebx,%ebx /* swapgs needed? */
16681 jnz nmi_restore
16682 nmi_swapgs:
16683 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16684 + pax_exit_kernel_user
16685 +#else
16686 + pax_exit_kernel
16687 +#endif
16688 SWAPGS_UNSAFE_STACK
16689 + RESTORE_ALL 8
16690 + /* Clear the NMI executing stack variable */
16691 + movq $0, 10*8(%rsp)
16692 + jmp irq_return
16693 nmi_restore:
16694 + pax_exit_kernel
16695 RESTORE_ALL 8
16696 + pax_force_retaddr_bts
16697 /* Clear the NMI executing stack variable */
16698 movq $0, 10*8(%rsp)
16699 jmp irq_return
16700 CFI_ENDPROC
16701 -END(nmi)
16702 +ENDPROC(nmi)
16703
16704 ENTRY(ignore_sysret)
16705 CFI_STARTPROC
16706 mov $-ENOSYS,%eax
16707 sysret
16708 CFI_ENDPROC
16709 -END(ignore_sysret)
16710 +ENDPROC(ignore_sysret)
16711
16712 /*
16713 * End of kprobes section
16714 diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
16715 index c3a7cb4..3ad00dc 100644
16716 --- a/arch/x86/kernel/ftrace.c
16717 +++ b/arch/x86/kernel/ftrace.c
16718 @@ -105,6 +105,8 @@ ftrace_modify_code_direct(unsigned long ip, unsigned const char *old_code,
16719 {
16720 unsigned char replaced[MCOUNT_INSN_SIZE];
16721
16722 + ip = ktla_ktva(ip);
16723 +
16724 /*
16725 * Note: Due to modules and __init, code can
16726 * disappear and change, we need to protect against faulting
16727 @@ -212,7 +214,7 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
16728 unsigned char old[MCOUNT_INSN_SIZE], *new;
16729 int ret;
16730
16731 - memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
16732 + memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
16733 new = ftrace_call_replace(ip, (unsigned long)func);
16734
16735 /* See comment above by declaration of modifying_ftrace_code */
16736 @@ -605,6 +607,8 @@ static int ftrace_mod_jmp(unsigned long ip,
16737 {
16738 unsigned char code[MCOUNT_INSN_SIZE];
16739
16740 + ip = ktla_ktva(ip);
16741 +
16742 if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
16743 return -EFAULT;
16744
16745 diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
16746 index c18f59d..9c0c9f6 100644
16747 --- a/arch/x86/kernel/head32.c
16748 +++ b/arch/x86/kernel/head32.c
16749 @@ -18,6 +18,7 @@
16750 #include <asm/io_apic.h>
16751 #include <asm/bios_ebda.h>
16752 #include <asm/tlbflush.h>
16753 +#include <asm/boot.h>
16754
16755 static void __init i386_default_early_setup(void)
16756 {
16757 @@ -30,8 +31,7 @@ static void __init i386_default_early_setup(void)
16758
16759 void __init i386_start_kernel(void)
16760 {
16761 - memblock_reserve(__pa_symbol(&_text),
16762 - __pa_symbol(&__bss_stop) - __pa_symbol(&_text));
16763 + memblock_reserve(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop) - LOAD_PHYSICAL_ADDR);
16764
16765 #ifdef CONFIG_BLK_DEV_INITRD
16766 /* Reserve INITRD */
16767 diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
16768 index d42ab17..cb1b997 100644
16769 --- a/arch/x86/kernel/head_32.S
16770 +++ b/arch/x86/kernel/head_32.S
16771 @@ -26,6 +26,12 @@
16772 /* Physical address */
16773 #define pa(X) ((X) - __PAGE_OFFSET)
16774
16775 +#ifdef CONFIG_PAX_KERNEXEC
16776 +#define ta(X) (X)
16777 +#else
16778 +#define ta(X) ((X) - __PAGE_OFFSET)
16779 +#endif
16780 +
16781 /*
16782 * References to members of the new_cpu_data structure.
16783 */
16784 @@ -55,11 +61,7 @@
16785 * and small than max_low_pfn, otherwise will waste some page table entries
16786 */
16787
16788 -#if PTRS_PER_PMD > 1
16789 -#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
16790 -#else
16791 -#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
16792 -#endif
16793 +#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
16794
16795 /* Number of possible pages in the lowmem region */
16796 LOWMEM_PAGES = (((1<<32) - __PAGE_OFFSET) >> PAGE_SHIFT)
16797 @@ -78,6 +80,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_PAGES) * PAGE_SIZE
16798 RESERVE_BRK(pagetables, INIT_MAP_SIZE)
16799
16800 /*
16801 + * Real beginning of normal "text" segment
16802 + */
16803 +ENTRY(stext)
16804 +ENTRY(_stext)
16805 +
16806 +/*
16807 * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
16808 * %esi points to the real-mode code as a 32-bit pointer.
16809 * CS and DS must be 4 GB flat segments, but we don't depend on
16810 @@ -85,6 +93,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
16811 * can.
16812 */
16813 __HEAD
16814 +
16815 +#ifdef CONFIG_PAX_KERNEXEC
16816 + jmp startup_32
16817 +/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
16818 +.fill PAGE_SIZE-5,1,0xcc
16819 +#endif
16820 +
16821 ENTRY(startup_32)
16822 movl pa(stack_start),%ecx
16823
16824 @@ -106,6 +121,57 @@ ENTRY(startup_32)
16825 2:
16826 leal -__PAGE_OFFSET(%ecx),%esp
16827
16828 +#ifdef CONFIG_SMP
16829 + movl $pa(cpu_gdt_table),%edi
16830 + movl $__per_cpu_load,%eax
16831 + movw %ax,__KERNEL_PERCPU + 2(%edi)
16832 + rorl $16,%eax
16833 + movb %al,__KERNEL_PERCPU + 4(%edi)
16834 + movb %ah,__KERNEL_PERCPU + 7(%edi)
16835 + movl $__per_cpu_end - 1,%eax
16836 + subl $__per_cpu_start,%eax
16837 + movw %ax,__KERNEL_PERCPU + 0(%edi)
16838 +#endif
16839 +
16840 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16841 + movl $NR_CPUS,%ecx
16842 + movl $pa(cpu_gdt_table),%edi
16843 +1:
16844 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
16845 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
16846 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
16847 + addl $PAGE_SIZE_asm,%edi
16848 + loop 1b
16849 +#endif
16850 +
16851 +#ifdef CONFIG_PAX_KERNEXEC
16852 + movl $pa(boot_gdt),%edi
16853 + movl $__LOAD_PHYSICAL_ADDR,%eax
16854 + movw %ax,__BOOT_CS + 2(%edi)
16855 + rorl $16,%eax
16856 + movb %al,__BOOT_CS + 4(%edi)
16857 + movb %ah,__BOOT_CS + 7(%edi)
16858 + rorl $16,%eax
16859 +
16860 + ljmp $(__BOOT_CS),$1f
16861 +1:
16862 +
16863 + movl $NR_CPUS,%ecx
16864 + movl $pa(cpu_gdt_table),%edi
16865 + addl $__PAGE_OFFSET,%eax
16866 +1:
16867 + movw %ax,__KERNEL_CS + 2(%edi)
16868 + movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
16869 + rorl $16,%eax
16870 + movb %al,__KERNEL_CS + 4(%edi)
16871 + movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
16872 + movb %ah,__KERNEL_CS + 7(%edi)
16873 + movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
16874 + rorl $16,%eax
16875 + addl $PAGE_SIZE_asm,%edi
16876 + loop 1b
16877 +#endif
16878 +
16879 /*
16880 * Clear BSS first so that there are no surprises...
16881 */
16882 @@ -196,8 +262,11 @@ ENTRY(startup_32)
16883 movl %eax, pa(max_pfn_mapped)
16884
16885 /* Do early initialization of the fixmap area */
16886 - movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
16887 - movl %eax,pa(initial_pg_pmd+0x1000*KPMDS-8)
16888 +#ifdef CONFIG_COMPAT_VDSO
16889 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_pg_pmd+0x1000*KPMDS-8)
16890 +#else
16891 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_pg_pmd+0x1000*KPMDS-8)
16892 +#endif
16893 #else /* Not PAE */
16894
16895 page_pde_offset = (__PAGE_OFFSET >> 20);
16896 @@ -227,8 +296,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
16897 movl %eax, pa(max_pfn_mapped)
16898
16899 /* Do early initialization of the fixmap area */
16900 - movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
16901 - movl %eax,pa(initial_page_table+0xffc)
16902 +#ifdef CONFIG_COMPAT_VDSO
16903 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_page_table+0xffc)
16904 +#else
16905 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_page_table+0xffc)
16906 +#endif
16907 #endif
16908
16909 #ifdef CONFIG_PARAVIRT
16910 @@ -242,9 +314,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
16911 cmpl $num_subarch_entries, %eax
16912 jae bad_subarch
16913
16914 - movl pa(subarch_entries)(,%eax,4), %eax
16915 - subl $__PAGE_OFFSET, %eax
16916 - jmp *%eax
16917 + jmp *pa(subarch_entries)(,%eax,4)
16918
16919 bad_subarch:
16920 WEAK(lguest_entry)
16921 @@ -256,10 +326,10 @@ WEAK(xen_entry)
16922 __INITDATA
16923
16924 subarch_entries:
16925 - .long default_entry /* normal x86/PC */
16926 - .long lguest_entry /* lguest hypervisor */
16927 - .long xen_entry /* Xen hypervisor */
16928 - .long default_entry /* Moorestown MID */
16929 + .long ta(default_entry) /* normal x86/PC */
16930 + .long ta(lguest_entry) /* lguest hypervisor */
16931 + .long ta(xen_entry) /* Xen hypervisor */
16932 + .long ta(default_entry) /* Moorestown MID */
16933 num_subarch_entries = (. - subarch_entries) / 4
16934 .previous
16935 #else
16936 @@ -310,6 +380,7 @@ default_entry:
16937 orl %edx,%eax
16938 movl %eax,%cr4
16939
16940 +#ifdef CONFIG_X86_PAE
16941 testb $X86_CR4_PAE, %al # check if PAE is enabled
16942 jz 6f
16943
16944 @@ -338,6 +409,9 @@ default_entry:
16945 /* Make changes effective */
16946 wrmsr
16947
16948 + btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
16949 +#endif
16950 +
16951 6:
16952
16953 /*
16954 @@ -436,14 +510,20 @@ is386: movl $2,%ecx # set MP
16955 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
16956 movl %eax,%ss # after changing gdt.
16957
16958 - movl $(__USER_DS),%eax # DS/ES contains default USER segment
16959 +# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
16960 movl %eax,%ds
16961 movl %eax,%es
16962
16963 movl $(__KERNEL_PERCPU), %eax
16964 movl %eax,%fs # set this cpu's percpu
16965
16966 +#ifdef CONFIG_CC_STACKPROTECTOR
16967 movl $(__KERNEL_STACK_CANARY),%eax
16968 +#elif defined(CONFIG_PAX_MEMORY_UDEREF)
16969 + movl $(__USER_DS),%eax
16970 +#else
16971 + xorl %eax,%eax
16972 +#endif
16973 movl %eax,%gs
16974
16975 xorl %eax,%eax # Clear LDT
16976 @@ -520,8 +600,11 @@ setup_once:
16977 * relocation. Manually set base address in stack canary
16978 * segment descriptor.
16979 */
16980 - movl $gdt_page,%eax
16981 + movl $cpu_gdt_table,%eax
16982 movl $stack_canary,%ecx
16983 +#ifdef CONFIG_SMP
16984 + addl $__per_cpu_load,%ecx
16985 +#endif
16986 movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
16987 shrl $16, %ecx
16988 movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
16989 @@ -552,7 +635,7 @@ ENDPROC(early_idt_handlers)
16990 /* This is global to keep gas from relaxing the jumps */
16991 ENTRY(early_idt_handler)
16992 cld
16993 - cmpl $2,%ss:early_recursion_flag
16994 + cmpl $1,%ss:early_recursion_flag
16995 je hlt_loop
16996 incl %ss:early_recursion_flag
16997
16998 @@ -590,8 +673,8 @@ ENTRY(early_idt_handler)
16999 pushl (20+6*4)(%esp) /* trapno */
17000 pushl $fault_msg
17001 call printk
17002 -#endif
17003 call dump_stack
17004 +#endif
17005 hlt_loop:
17006 hlt
17007 jmp hlt_loop
17008 @@ -610,8 +693,11 @@ ENDPROC(early_idt_handler)
17009 /* This is the default interrupt "handler" :-) */
17010 ALIGN
17011 ignore_int:
17012 - cld
17013 #ifdef CONFIG_PRINTK
17014 + cmpl $2,%ss:early_recursion_flag
17015 + je hlt_loop
17016 + incl %ss:early_recursion_flag
17017 + cld
17018 pushl %eax
17019 pushl %ecx
17020 pushl %edx
17021 @@ -620,9 +706,6 @@ ignore_int:
17022 movl $(__KERNEL_DS),%eax
17023 movl %eax,%ds
17024 movl %eax,%es
17025 - cmpl $2,early_recursion_flag
17026 - je hlt_loop
17027 - incl early_recursion_flag
17028 pushl 16(%esp)
17029 pushl 24(%esp)
17030 pushl 32(%esp)
17031 @@ -656,29 +739,43 @@ ENTRY(setup_once_ref)
17032 /*
17033 * BSS section
17034 */
17035 -__PAGE_ALIGNED_BSS
17036 - .align PAGE_SIZE
17037 #ifdef CONFIG_X86_PAE
17038 +.section .initial_pg_pmd,"a",@progbits
17039 initial_pg_pmd:
17040 .fill 1024*KPMDS,4,0
17041 #else
17042 +.section .initial_page_table,"a",@progbits
17043 ENTRY(initial_page_table)
17044 .fill 1024,4,0
17045 #endif
17046 +.section .initial_pg_fixmap,"a",@progbits
17047 initial_pg_fixmap:
17048 .fill 1024,4,0
17049 +.section .empty_zero_page,"a",@progbits
17050 ENTRY(empty_zero_page)
17051 .fill 4096,1,0
17052 +.section .swapper_pg_dir,"a",@progbits
17053 ENTRY(swapper_pg_dir)
17054 +#ifdef CONFIG_X86_PAE
17055 + .fill 4,8,0
17056 +#else
17057 .fill 1024,4,0
17058 +#endif
17059 +
17060 +/*
17061 + * The IDT has to be page-aligned to simplify the Pentium
17062 + * F0 0F bug workaround.. We have a special link segment
17063 + * for this.
17064 + */
17065 +.section .idt,"a",@progbits
17066 +ENTRY(idt_table)
17067 + .fill 256,8,0
17068
17069 /*
17070 * This starts the data section.
17071 */
17072 #ifdef CONFIG_X86_PAE
17073 -__PAGE_ALIGNED_DATA
17074 - /* Page-aligned for the benefit of paravirt? */
17075 - .align PAGE_SIZE
17076 +.section .initial_page_table,"a",@progbits
17077 ENTRY(initial_page_table)
17078 .long pa(initial_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
17079 # if KPMDS == 3
17080 @@ -697,12 +794,20 @@ ENTRY(initial_page_table)
17081 # error "Kernel PMDs should be 1, 2 or 3"
17082 # endif
17083 .align PAGE_SIZE /* needs to be page-sized too */
17084 +
17085 +#ifdef CONFIG_PAX_PER_CPU_PGD
17086 +ENTRY(cpu_pgd)
17087 + .rept NR_CPUS
17088 + .fill 4,8,0
17089 + .endr
17090 +#endif
17091 +
17092 #endif
17093
17094 .data
17095 .balign 4
17096 ENTRY(stack_start)
17097 - .long init_thread_union+THREAD_SIZE
17098 + .long init_thread_union+THREAD_SIZE-8
17099
17100 __INITRODATA
17101 int_msg:
17102 @@ -730,7 +835,7 @@ fault_msg:
17103 * segment size, and 32-bit linear address value:
17104 */
17105
17106 - .data
17107 +.section .rodata,"a",@progbits
17108 .globl boot_gdt_descr
17109 .globl idt_descr
17110
17111 @@ -739,7 +844,7 @@ fault_msg:
17112 .word 0 # 32 bit align gdt_desc.address
17113 boot_gdt_descr:
17114 .word __BOOT_DS+7
17115 - .long boot_gdt - __PAGE_OFFSET
17116 + .long pa(boot_gdt)
17117
17118 .word 0 # 32-bit align idt_desc.address
17119 idt_descr:
17120 @@ -750,7 +855,7 @@ idt_descr:
17121 .word 0 # 32 bit align gdt_desc.address
17122 ENTRY(early_gdt_descr)
17123 .word GDT_ENTRIES*8-1
17124 - .long gdt_page /* Overwritten for secondary CPUs */
17125 + .long cpu_gdt_table /* Overwritten for secondary CPUs */
17126
17127 /*
17128 * The boot_gdt must mirror the equivalent in setup.S and is
17129 @@ -759,5 +864,65 @@ ENTRY(early_gdt_descr)
17130 .align L1_CACHE_BYTES
17131 ENTRY(boot_gdt)
17132 .fill GDT_ENTRY_BOOT_CS,8,0
17133 - .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
17134 - .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
17135 + .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
17136 + .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
17137 +
17138 + .align PAGE_SIZE_asm
17139 +ENTRY(cpu_gdt_table)
17140 + .rept NR_CPUS
17141 + .quad 0x0000000000000000 /* NULL descriptor */
17142 + .quad 0x0000000000000000 /* 0x0b reserved */
17143 + .quad 0x0000000000000000 /* 0x13 reserved */
17144 + .quad 0x0000000000000000 /* 0x1b reserved */
17145 +
17146 +#ifdef CONFIG_PAX_KERNEXEC
17147 + .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
17148 +#else
17149 + .quad 0x0000000000000000 /* 0x20 unused */
17150 +#endif
17151 +
17152 + .quad 0x0000000000000000 /* 0x28 unused */
17153 + .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
17154 + .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
17155 + .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
17156 + .quad 0x0000000000000000 /* 0x4b reserved */
17157 + .quad 0x0000000000000000 /* 0x53 reserved */
17158 + .quad 0x0000000000000000 /* 0x5b reserved */
17159 +
17160 + .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
17161 + .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
17162 + .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
17163 + .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
17164 +
17165 + .quad 0x0000000000000000 /* 0x80 TSS descriptor */
17166 + .quad 0x0000000000000000 /* 0x88 LDT descriptor */
17167 +
17168 + /*
17169 + * Segments used for calling PnP BIOS have byte granularity.
17170 + * The code segments and data segments have fixed 64k limits,
17171 + * the transfer segment sizes are set at run time.
17172 + */
17173 + .quad 0x00409b000000ffff /* 0x90 32-bit code */
17174 + .quad 0x00009b000000ffff /* 0x98 16-bit code */
17175 + .quad 0x000093000000ffff /* 0xa0 16-bit data */
17176 + .quad 0x0000930000000000 /* 0xa8 16-bit data */
17177 + .quad 0x0000930000000000 /* 0xb0 16-bit data */
17178 +
17179 + /*
17180 + * The APM segments have byte granularity and their bases
17181 + * are set at run time. All have 64k limits.
17182 + */
17183 + .quad 0x00409b000000ffff /* 0xb8 APM CS code */
17184 + .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
17185 + .quad 0x004093000000ffff /* 0xc8 APM DS data */
17186 +
17187 + .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
17188 + .quad 0x0040930000000000 /* 0xd8 - PERCPU */
17189 + .quad 0x0040910000000017 /* 0xe0 - STACK_CANARY */
17190 + .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
17191 + .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
17192 + .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
17193 +
17194 + /* Be sure this is zeroed to avoid false validations in Xen */
17195 + .fill PAGE_SIZE_asm - GDT_SIZE,1,0
17196 + .endr
17197 diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
17198 index 94bf9cc..400455a 100644
17199 --- a/arch/x86/kernel/head_64.S
17200 +++ b/arch/x86/kernel/head_64.S
17201 @@ -20,6 +20,8 @@
17202 #include <asm/processor-flags.h>
17203 #include <asm/percpu.h>
17204 #include <asm/nops.h>
17205 +#include <asm/cpufeature.h>
17206 +#include <asm/alternative-asm.h>
17207
17208 #ifdef CONFIG_PARAVIRT
17209 #include <asm/asm-offsets.h>
17210 @@ -41,6 +43,12 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET)
17211 L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
17212 L4_START_KERNEL = pgd_index(__START_KERNEL_map)
17213 L3_START_KERNEL = pud_index(__START_KERNEL_map)
17214 +L4_VMALLOC_START = pgd_index(VMALLOC_START)
17215 +L3_VMALLOC_START = pud_index(VMALLOC_START)
17216 +L4_VMALLOC_END = pgd_index(VMALLOC_END)
17217 +L3_VMALLOC_END = pud_index(VMALLOC_END)
17218 +L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
17219 +L3_VMEMMAP_START = pud_index(VMEMMAP_START)
17220
17221 .text
17222 __HEAD
17223 @@ -88,35 +96,23 @@ startup_64:
17224 */
17225 addq %rbp, init_level4_pgt + 0(%rip)
17226 addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
17227 + addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
17228 + addq %rbp, init_level4_pgt + (L4_VMALLOC_END*8)(%rip)
17229 + addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
17230 addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
17231
17232 addq %rbp, level3_ident_pgt + 0(%rip)
17233 +#ifndef CONFIG_XEN
17234 + addq %rbp, level3_ident_pgt + 8(%rip)
17235 +#endif
17236
17237 - addq %rbp, level3_kernel_pgt + (510*8)(%rip)
17238 - addq %rbp, level3_kernel_pgt + (511*8)(%rip)
17239 + addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
17240 +
17241 + addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
17242 + addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
17243
17244 addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
17245 -
17246 - /* Add an Identity mapping if I am above 1G */
17247 - leaq _text(%rip), %rdi
17248 - andq $PMD_PAGE_MASK, %rdi
17249 -
17250 - movq %rdi, %rax
17251 - shrq $PUD_SHIFT, %rax
17252 - andq $(PTRS_PER_PUD - 1), %rax
17253 - jz ident_complete
17254 -
17255 - leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
17256 - leaq level3_ident_pgt(%rip), %rbx
17257 - movq %rdx, 0(%rbx, %rax, 8)
17258 -
17259 - movq %rdi, %rax
17260 - shrq $PMD_SHIFT, %rax
17261 - andq $(PTRS_PER_PMD - 1), %rax
17262 - leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
17263 - leaq level2_spare_pgt(%rip), %rbx
17264 - movq %rdx, 0(%rbx, %rax, 8)
17265 -ident_complete:
17266 + addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
17267
17268 /*
17269 * Fixup the kernel text+data virtual addresses. Note that
17270 @@ -159,8 +155,8 @@ ENTRY(secondary_startup_64)
17271 * after the boot processor executes this code.
17272 */
17273
17274 - /* Enable PAE mode and PGE */
17275 - movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
17276 + /* Enable PAE mode and PSE/PGE */
17277 + movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
17278 movq %rax, %cr4
17279
17280 /* Setup early boot stage 4 level pagetables. */
17281 @@ -182,9 +178,17 @@ ENTRY(secondary_startup_64)
17282 movl $MSR_EFER, %ecx
17283 rdmsr
17284 btsl $_EFER_SCE, %eax /* Enable System Call */
17285 - btl $20,%edi /* No Execute supported? */
17286 + btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
17287 jnc 1f
17288 btsl $_EFER_NX, %eax
17289 + leaq init_level4_pgt(%rip), %rdi
17290 +#ifndef CONFIG_EFI
17291 + btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
17292 +#endif
17293 + btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
17294 + btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_END(%rdi)
17295 + btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
17296 + btsq $_PAGE_BIT_NX, __supported_pte_mask(%rip)
17297 1: wrmsr /* Make changes effective */
17298
17299 /* Setup cr0 */
17300 @@ -246,6 +250,7 @@ ENTRY(secondary_startup_64)
17301 * jump. In addition we need to ensure %cs is set so we make this
17302 * a far return.
17303 */
17304 + pax_set_fptr_mask
17305 movq initial_code(%rip),%rax
17306 pushq $0 # fake return address to stop unwinder
17307 pushq $__KERNEL_CS # set correct cs
17308 @@ -268,7 +273,7 @@ ENTRY(secondary_startup_64)
17309 bad_address:
17310 jmp bad_address
17311
17312 - .section ".init.text","ax"
17313 + __INIT
17314 .globl early_idt_handlers
17315 early_idt_handlers:
17316 # 104(%rsp) %rflags
17317 @@ -347,11 +352,15 @@ ENTRY(early_idt_handler)
17318 addq $16,%rsp # drop vector number and error code
17319 decl early_recursion_flag(%rip)
17320 INTERRUPT_RETURN
17321 + .previous
17322
17323 + __INITDATA
17324 .balign 4
17325 early_recursion_flag:
17326 .long 0
17327 + .previous
17328
17329 + .section .rodata,"a",@progbits
17330 #ifdef CONFIG_EARLY_PRINTK
17331 early_idt_msg:
17332 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
17333 @@ -360,6 +369,7 @@ early_idt_ripmsg:
17334 #endif /* CONFIG_EARLY_PRINTK */
17335 .previous
17336
17337 + .section .rodata,"a",@progbits
17338 #define NEXT_PAGE(name) \
17339 .balign PAGE_SIZE; \
17340 ENTRY(name)
17341 @@ -372,7 +382,6 @@ ENTRY(name)
17342 i = i + 1 ; \
17343 .endr
17344
17345 - .data
17346 /*
17347 * This default setting generates an ident mapping at address 0x100000
17348 * and a mapping for the kernel that precisely maps virtual address
17349 @@ -383,13 +392,41 @@ NEXT_PAGE(init_level4_pgt)
17350 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
17351 .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
17352 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
17353 + .org init_level4_pgt + L4_VMALLOC_START*8, 0
17354 + .quad level3_vmalloc_start_pgt - __START_KERNEL_map + _KERNPG_TABLE
17355 + .org init_level4_pgt + L4_VMALLOC_END*8, 0
17356 + .quad level3_vmalloc_end_pgt - __START_KERNEL_map + _KERNPG_TABLE
17357 + .org init_level4_pgt + L4_VMEMMAP_START*8, 0
17358 + .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
17359 .org init_level4_pgt + L4_START_KERNEL*8, 0
17360 /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
17361 .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
17362
17363 +#ifdef CONFIG_PAX_PER_CPU_PGD
17364 +NEXT_PAGE(cpu_pgd)
17365 + .rept NR_CPUS
17366 + .fill 512,8,0
17367 + .endr
17368 +#endif
17369 +
17370 NEXT_PAGE(level3_ident_pgt)
17371 .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
17372 +#ifdef CONFIG_XEN
17373 .fill 511,8,0
17374 +#else
17375 + .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
17376 + .fill 510,8,0
17377 +#endif
17378 +
17379 +NEXT_PAGE(level3_vmalloc_start_pgt)
17380 + .fill 512,8,0
17381 +
17382 +NEXT_PAGE(level3_vmalloc_end_pgt)
17383 + .fill 512,8,0
17384 +
17385 +NEXT_PAGE(level3_vmemmap_pgt)
17386 + .fill L3_VMEMMAP_START,8,0
17387 + .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
17388
17389 NEXT_PAGE(level3_kernel_pgt)
17390 .fill L3_START_KERNEL,8,0
17391 @@ -397,20 +434,23 @@ NEXT_PAGE(level3_kernel_pgt)
17392 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
17393 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
17394
17395 +NEXT_PAGE(level2_vmemmap_pgt)
17396 + .fill 512,8,0
17397 +
17398 NEXT_PAGE(level2_fixmap_pgt)
17399 - .fill 506,8,0
17400 - .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
17401 - /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
17402 - .fill 5,8,0
17403 + .fill 507,8,0
17404 + .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
17405 + /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
17406 + .fill 4,8,0
17407
17408 -NEXT_PAGE(level1_fixmap_pgt)
17409 +NEXT_PAGE(level1_vsyscall_pgt)
17410 .fill 512,8,0
17411
17412 -NEXT_PAGE(level2_ident_pgt)
17413 - /* Since I easily can, map the first 1G.
17414 + /* Since I easily can, map the first 2G.
17415 * Don't set NX because code runs from these pages.
17416 */
17417 - PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
17418 +NEXT_PAGE(level2_ident_pgt)
17419 + PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
17420
17421 NEXT_PAGE(level2_kernel_pgt)
17422 /*
17423 @@ -423,37 +463,59 @@ NEXT_PAGE(level2_kernel_pgt)
17424 * If you want to increase this then increase MODULES_VADDR
17425 * too.)
17426 */
17427 - PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
17428 - KERNEL_IMAGE_SIZE/PMD_SIZE)
17429 -
17430 -NEXT_PAGE(level2_spare_pgt)
17431 - .fill 512, 8, 0
17432 + PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
17433
17434 #undef PMDS
17435 #undef NEXT_PAGE
17436
17437 - .data
17438 + .align PAGE_SIZE
17439 +ENTRY(cpu_gdt_table)
17440 + .rept NR_CPUS
17441 + .quad 0x0000000000000000 /* NULL descriptor */
17442 + .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
17443 + .quad 0x00af9b000000ffff /* __KERNEL_CS */
17444 + .quad 0x00cf93000000ffff /* __KERNEL_DS */
17445 + .quad 0x00cffb000000ffff /* __USER32_CS */
17446 + .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
17447 + .quad 0x00affb000000ffff /* __USER_CS */
17448 +
17449 +#ifdef CONFIG_PAX_KERNEXEC
17450 + .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
17451 +#else
17452 + .quad 0x0 /* unused */
17453 +#endif
17454 +
17455 + .quad 0,0 /* TSS */
17456 + .quad 0,0 /* LDT */
17457 + .quad 0,0,0 /* three TLS descriptors */
17458 + .quad 0x0000f40000000000 /* node/CPU stored in limit */
17459 + /* asm/segment.h:GDT_ENTRIES must match this */
17460 +
17461 + /* zero the remaining page */
17462 + .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
17463 + .endr
17464 +
17465 .align 16
17466 .globl early_gdt_descr
17467 early_gdt_descr:
17468 .word GDT_ENTRIES*8-1
17469 early_gdt_descr_base:
17470 - .quad INIT_PER_CPU_VAR(gdt_page)
17471 + .quad cpu_gdt_table
17472
17473 ENTRY(phys_base)
17474 /* This must match the first entry in level2_kernel_pgt */
17475 .quad 0x0000000000000000
17476
17477 #include "../../x86/xen/xen-head.S"
17478 -
17479 - .section .bss, "aw", @nobits
17480 +
17481 + .section .rodata,"a",@progbits
17482 .align L1_CACHE_BYTES
17483 ENTRY(idt_table)
17484 - .skip IDT_ENTRIES * 16
17485 + .fill 512,8,0
17486
17487 .align L1_CACHE_BYTES
17488 ENTRY(nmi_idt_table)
17489 - .skip IDT_ENTRIES * 16
17490 + .fill 512,8,0
17491
17492 __PAGE_ALIGNED_BSS
17493 .align PAGE_SIZE
17494 diff --git a/arch/x86/kernel/i386_ksyms_32.c b/arch/x86/kernel/i386_ksyms_32.c
17495 index 9c3bd4a..e1d9b35 100644
17496 --- a/arch/x86/kernel/i386_ksyms_32.c
17497 +++ b/arch/x86/kernel/i386_ksyms_32.c
17498 @@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
17499 EXPORT_SYMBOL(cmpxchg8b_emu);
17500 #endif
17501
17502 +EXPORT_SYMBOL_GPL(cpu_gdt_table);
17503 +
17504 /* Networking helper routines. */
17505 EXPORT_SYMBOL(csum_partial_copy_generic);
17506 +EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
17507 +EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
17508
17509 EXPORT_SYMBOL(__get_user_1);
17510 EXPORT_SYMBOL(__get_user_2);
17511 @@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
17512
17513 EXPORT_SYMBOL(csum_partial);
17514 EXPORT_SYMBOL(empty_zero_page);
17515 +
17516 +#ifdef CONFIG_PAX_KERNEXEC
17517 +EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
17518 +#endif
17519 diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
17520 index f250431..54097e7 100644
17521 --- a/arch/x86/kernel/i387.c
17522 +++ b/arch/x86/kernel/i387.c
17523 @@ -59,7 +59,7 @@ static inline bool interrupted_kernel_fpu_idle(void)
17524 static inline bool interrupted_user_mode(void)
17525 {
17526 struct pt_regs *regs = get_irq_regs();
17527 - return regs && user_mode_vm(regs);
17528 + return regs && user_mode(regs);
17529 }
17530
17531 /*
17532 diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c
17533 index 36d1853..bf25736 100644
17534 --- a/arch/x86/kernel/i8259.c
17535 +++ b/arch/x86/kernel/i8259.c
17536 @@ -209,7 +209,7 @@ spurious_8259A_irq:
17537 "spurious 8259A interrupt: IRQ%d.\n", irq);
17538 spurious_irq_mask |= irqmask;
17539 }
17540 - atomic_inc(&irq_err_count);
17541 + atomic_inc_unchecked(&irq_err_count);
17542 /*
17543 * Theoretically we do not have to handle this IRQ,
17544 * but in Linux this does not cause problems and is
17545 diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
17546 index 8c96897..be66bfa 100644
17547 --- a/arch/x86/kernel/ioport.c
17548 +++ b/arch/x86/kernel/ioport.c
17549 @@ -6,6 +6,7 @@
17550 #include <linux/sched.h>
17551 #include <linux/kernel.h>
17552 #include <linux/capability.h>
17553 +#include <linux/security.h>
17554 #include <linux/errno.h>
17555 #include <linux/types.h>
17556 #include <linux/ioport.h>
17557 @@ -28,6 +29,12 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
17558
17559 if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
17560 return -EINVAL;
17561 +#ifdef CONFIG_GRKERNSEC_IO
17562 + if (turn_on && grsec_disable_privio) {
17563 + gr_handle_ioperm();
17564 + return -EPERM;
17565 + }
17566 +#endif
17567 if (turn_on && !capable(CAP_SYS_RAWIO))
17568 return -EPERM;
17569
17570 @@ -54,7 +61,7 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
17571 * because the ->io_bitmap_max value must match the bitmap
17572 * contents:
17573 */
17574 - tss = &per_cpu(init_tss, get_cpu());
17575 + tss = init_tss + get_cpu();
17576
17577 if (turn_on)
17578 bitmap_clear(t->io_bitmap_ptr, from, num);
17579 @@ -102,6 +109,12 @@ long sys_iopl(unsigned int level, struct pt_regs *regs)
17580 return -EINVAL;
17581 /* Trying to gain more privileges? */
17582 if (level > old) {
17583 +#ifdef CONFIG_GRKERNSEC_IO
17584 + if (grsec_disable_privio) {
17585 + gr_handle_iopl();
17586 + return -EPERM;
17587 + }
17588 +#endif
17589 if (!capable(CAP_SYS_RAWIO))
17590 return -EPERM;
17591 }
17592 diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
17593 index 3dafc60..aa8e9c4 100644
17594 --- a/arch/x86/kernel/irq.c
17595 +++ b/arch/x86/kernel/irq.c
17596 @@ -18,7 +18,7 @@
17597 #include <asm/mce.h>
17598 #include <asm/hw_irq.h>
17599
17600 -atomic_t irq_err_count;
17601 +atomic_unchecked_t irq_err_count;
17602
17603 /* Function pointer for generic interrupt vector handling */
17604 void (*x86_platform_ipi_callback)(void) = NULL;
17605 @@ -121,9 +121,9 @@ int arch_show_interrupts(struct seq_file *p, int prec)
17606 seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
17607 seq_printf(p, " Machine check polls\n");
17608 #endif
17609 - seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
17610 + seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
17611 #if defined(CONFIG_X86_IO_APIC)
17612 - seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
17613 + seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
17614 #endif
17615 return 0;
17616 }
17617 @@ -164,10 +164,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
17618
17619 u64 arch_irq_stat(void)
17620 {
17621 - u64 sum = atomic_read(&irq_err_count);
17622 + u64 sum = atomic_read_unchecked(&irq_err_count);
17623
17624 #ifdef CONFIG_X86_IO_APIC
17625 - sum += atomic_read(&irq_mis_count);
17626 + sum += atomic_read_unchecked(&irq_mis_count);
17627 #endif
17628 return sum;
17629 }
17630 diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
17631 index 344faf8..355f60d 100644
17632 --- a/arch/x86/kernel/irq_32.c
17633 +++ b/arch/x86/kernel/irq_32.c
17634 @@ -39,7 +39,7 @@ static int check_stack_overflow(void)
17635 __asm__ __volatile__("andl %%esp,%0" :
17636 "=r" (sp) : "0" (THREAD_SIZE - 1));
17637
17638 - return sp < (sizeof(struct thread_info) + STACK_WARN);
17639 + return sp < STACK_WARN;
17640 }
17641
17642 static void print_stack_overflow(void)
17643 @@ -59,8 +59,8 @@ static inline void print_stack_overflow(void) { }
17644 * per-CPU IRQ handling contexts (thread information and stack)
17645 */
17646 union irq_ctx {
17647 - struct thread_info tinfo;
17648 - u32 stack[THREAD_SIZE/sizeof(u32)];
17649 + unsigned long previous_esp;
17650 + u32 stack[THREAD_SIZE/sizeof(u32)];
17651 } __attribute__((aligned(THREAD_SIZE)));
17652
17653 static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
17654 @@ -80,10 +80,9 @@ static void call_on_stack(void *func, void *stack)
17655 static inline int
17656 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
17657 {
17658 - union irq_ctx *curctx, *irqctx;
17659 + union irq_ctx *irqctx;
17660 u32 *isp, arg1, arg2;
17661
17662 - curctx = (union irq_ctx *) current_thread_info();
17663 irqctx = __this_cpu_read(hardirq_ctx);
17664
17665 /*
17666 @@ -92,16 +91,16 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
17667 * handler) we can't do that and just have to keep using the
17668 * current stack (which is the irq stack already after all)
17669 */
17670 - if (unlikely(curctx == irqctx))
17671 + if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
17672 return 0;
17673
17674 /* build the stack frame on the IRQ stack */
17675 - isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
17676 - irqctx->tinfo.task = curctx->tinfo.task;
17677 - irqctx->tinfo.previous_esp = current_stack_pointer;
17678 + isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
17679 + irqctx->previous_esp = current_stack_pointer;
17680
17681 - /* Copy the preempt_count so that the [soft]irq checks work. */
17682 - irqctx->tinfo.preempt_count = curctx->tinfo.preempt_count;
17683 +#ifdef CONFIG_PAX_MEMORY_UDEREF
17684 + __set_fs(MAKE_MM_SEG(0));
17685 +#endif
17686
17687 if (unlikely(overflow))
17688 call_on_stack(print_stack_overflow, isp);
17689 @@ -113,6 +112,11 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
17690 : "0" (irq), "1" (desc), "2" (isp),
17691 "D" (desc->handle_irq)
17692 : "memory", "cc", "ecx");
17693 +
17694 +#ifdef CONFIG_PAX_MEMORY_UDEREF
17695 + __set_fs(current_thread_info()->addr_limit);
17696 +#endif
17697 +
17698 return 1;
17699 }
17700
17701 @@ -121,29 +125,14 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
17702 */
17703 void __cpuinit irq_ctx_init(int cpu)
17704 {
17705 - union irq_ctx *irqctx;
17706 -
17707 if (per_cpu(hardirq_ctx, cpu))
17708 return;
17709
17710 - irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
17711 - THREADINFO_GFP,
17712 - THREAD_SIZE_ORDER));
17713 - memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
17714 - irqctx->tinfo.cpu = cpu;
17715 - irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
17716 - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
17717 -
17718 - per_cpu(hardirq_ctx, cpu) = irqctx;
17719 -
17720 - irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
17721 - THREADINFO_GFP,
17722 - THREAD_SIZE_ORDER));
17723 - memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
17724 - irqctx->tinfo.cpu = cpu;
17725 - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
17726 -
17727 - per_cpu(softirq_ctx, cpu) = irqctx;
17728 + per_cpu(hardirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREADINFO_GFP, THREAD_SIZE_ORDER));
17729 + per_cpu(softirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREADINFO_GFP, THREAD_SIZE_ORDER));
17730 +
17731 + printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
17732 + cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
17733
17734 printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
17735 cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
17736 @@ -152,7 +141,6 @@ void __cpuinit irq_ctx_init(int cpu)
17737 asmlinkage void do_softirq(void)
17738 {
17739 unsigned long flags;
17740 - struct thread_info *curctx;
17741 union irq_ctx *irqctx;
17742 u32 *isp;
17743
17744 @@ -162,15 +150,22 @@ asmlinkage void do_softirq(void)
17745 local_irq_save(flags);
17746
17747 if (local_softirq_pending()) {
17748 - curctx = current_thread_info();
17749 irqctx = __this_cpu_read(softirq_ctx);
17750 - irqctx->tinfo.task = curctx->task;
17751 - irqctx->tinfo.previous_esp = current_stack_pointer;
17752 + irqctx->previous_esp = current_stack_pointer;
17753
17754 /* build the stack frame on the softirq stack */
17755 - isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
17756 + isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
17757 +
17758 +#ifdef CONFIG_PAX_MEMORY_UDEREF
17759 + __set_fs(MAKE_MM_SEG(0));
17760 +#endif
17761
17762 call_on_stack(__do_softirq, isp);
17763 +
17764 +#ifdef CONFIG_PAX_MEMORY_UDEREF
17765 + __set_fs(current_thread_info()->addr_limit);
17766 +#endif
17767 +
17768 /*
17769 * Shouldn't happen, we returned above if in_interrupt():
17770 */
17771 @@ -191,7 +186,7 @@ bool handle_irq(unsigned irq, struct pt_regs *regs)
17772 if (unlikely(!desc))
17773 return false;
17774
17775 - if (user_mode_vm(regs) || !execute_on_irq_stack(overflow, desc, irq)) {
17776 + if (user_mode(regs) || !execute_on_irq_stack(overflow, desc, irq)) {
17777 if (unlikely(overflow))
17778 print_stack_overflow();
17779 desc->handle_irq(irq, desc);
17780 diff --git a/arch/x86/kernel/irq_64.c b/arch/x86/kernel/irq_64.c
17781 index d04d3ec..ea4b374 100644
17782 --- a/arch/x86/kernel/irq_64.c
17783 +++ b/arch/x86/kernel/irq_64.c
17784 @@ -44,7 +44,7 @@ static inline void stack_overflow_check(struct pt_regs *regs)
17785 u64 estack_top, estack_bottom;
17786 u64 curbase = (u64)task_stack_page(current);
17787
17788 - if (user_mode_vm(regs))
17789 + if (user_mode(regs))
17790 return;
17791
17792 if (regs->sp >= curbase + sizeof(struct thread_info) +
17793 diff --git a/arch/x86/kernel/kdebugfs.c b/arch/x86/kernel/kdebugfs.c
17794 index 1d5d31e..72731d4 100644
17795 --- a/arch/x86/kernel/kdebugfs.c
17796 +++ b/arch/x86/kernel/kdebugfs.c
17797 @@ -27,7 +27,7 @@ struct setup_data_node {
17798 u32 len;
17799 };
17800
17801 -static ssize_t setup_data_read(struct file *file, char __user *user_buf,
17802 +static ssize_t __size_overflow(3) setup_data_read(struct file *file, char __user *user_buf,
17803 size_t count, loff_t *ppos)
17804 {
17805 struct setup_data_node *node = file->private_data;
17806 diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
17807 index 3f61904..873cea9 100644
17808 --- a/arch/x86/kernel/kgdb.c
17809 +++ b/arch/x86/kernel/kgdb.c
17810 @@ -127,11 +127,11 @@ char *dbg_get_reg(int regno, void *mem, struct pt_regs *regs)
17811 #ifdef CONFIG_X86_32
17812 switch (regno) {
17813 case GDB_SS:
17814 - if (!user_mode_vm(regs))
17815 + if (!user_mode(regs))
17816 *(unsigned long *)mem = __KERNEL_DS;
17817 break;
17818 case GDB_SP:
17819 - if (!user_mode_vm(regs))
17820 + if (!user_mode(regs))
17821 *(unsigned long *)mem = kernel_stack_pointer(regs);
17822 break;
17823 case GDB_GS:
17824 @@ -476,12 +476,12 @@ int kgdb_arch_handle_exception(int e_vector, int signo, int err_code,
17825 case 'k':
17826 /* clear the trace bit */
17827 linux_regs->flags &= ~X86_EFLAGS_TF;
17828 - atomic_set(&kgdb_cpu_doing_single_step, -1);
17829 + atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
17830
17831 /* set the trace bit if we're stepping */
17832 if (remcomInBuffer[0] == 's') {
17833 linux_regs->flags |= X86_EFLAGS_TF;
17834 - atomic_set(&kgdb_cpu_doing_single_step,
17835 + atomic_set_unchecked(&kgdb_cpu_doing_single_step,
17836 raw_smp_processor_id());
17837 }
17838
17839 @@ -546,7 +546,7 @@ static int __kgdb_notify(struct die_args *args, unsigned long cmd)
17840
17841 switch (cmd) {
17842 case DIE_DEBUG:
17843 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
17844 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
17845 if (user_mode(regs))
17846 return single_step_cont(regs, args);
17847 break;
17848 diff --git a/arch/x86/kernel/kprobes-opt.c b/arch/x86/kernel/kprobes-opt.c
17849 index c5e410e..da6aaf9 100644
17850 --- a/arch/x86/kernel/kprobes-opt.c
17851 +++ b/arch/x86/kernel/kprobes-opt.c
17852 @@ -338,7 +338,7 @@ int __kprobes arch_prepare_optimized_kprobe(struct optimized_kprobe *op)
17853 * Verify if the address gap is in 2GB range, because this uses
17854 * a relative jump.
17855 */
17856 - rel = (long)op->optinsn.insn - (long)op->kp.addr + RELATIVEJUMP_SIZE;
17857 + rel = (long)op->optinsn.insn - ktla_ktva((long)op->kp.addr) + RELATIVEJUMP_SIZE;
17858 if (abs(rel) > 0x7fffffff)
17859 return -ERANGE;
17860
17861 @@ -359,11 +359,11 @@ int __kprobes arch_prepare_optimized_kprobe(struct optimized_kprobe *op)
17862 synthesize_set_arg1(buf + TMPL_MOVE_IDX, (unsigned long)op);
17863
17864 /* Set probe function call */
17865 - synthesize_relcall(buf + TMPL_CALL_IDX, optimized_callback);
17866 + synthesize_relcall(buf + TMPL_CALL_IDX, ktla_ktva(optimized_callback));
17867
17868 /* Set returning jmp instruction at the tail of out-of-line buffer */
17869 synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size,
17870 - (u8 *)op->kp.addr + op->optinsn.size);
17871 + (u8 *)ktla_ktva(op->kp.addr) + op->optinsn.size);
17872
17873 flush_icache_range((unsigned long) buf,
17874 (unsigned long) buf + TMPL_END_IDX +
17875 @@ -385,7 +385,7 @@ static void __kprobes setup_optimize_kprobe(struct text_poke_param *tprm,
17876 ((long)op->kp.addr + RELATIVEJUMP_SIZE));
17877
17878 /* Backup instructions which will be replaced by jump address */
17879 - memcpy(op->optinsn.copied_insn, op->kp.addr + INT3_SIZE,
17880 + memcpy(op->optinsn.copied_insn, ktla_ktva(op->kp.addr) + INT3_SIZE,
17881 RELATIVE_ADDR_SIZE);
17882
17883 insn_buf[0] = RELATIVEJUMP_OPCODE;
17884 diff --git a/arch/x86/kernel/kprobes.c b/arch/x86/kernel/kprobes.c
17885 index e2f751e..dffa2a0 100644
17886 --- a/arch/x86/kernel/kprobes.c
17887 +++ b/arch/x86/kernel/kprobes.c
17888 @@ -120,8 +120,11 @@ static void __kprobes __synthesize_relative_insn(void *from, void *to, u8 op)
17889 } __attribute__((packed)) *insn;
17890
17891 insn = (struct __arch_relative_insn *)from;
17892 +
17893 + pax_open_kernel();
17894 insn->raddr = (s32)((long)(to) - ((long)(from) + 5));
17895 insn->op = op;
17896 + pax_close_kernel();
17897 }
17898
17899 /* Insert a jump instruction at address 'from', which jumps to address 'to'.*/
17900 @@ -164,7 +167,7 @@ int __kprobes can_boost(kprobe_opcode_t *opcodes)
17901 kprobe_opcode_t opcode;
17902 kprobe_opcode_t *orig_opcodes = opcodes;
17903
17904 - if (search_exception_tables((unsigned long)opcodes))
17905 + if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
17906 return 0; /* Page fault may occur on this address. */
17907
17908 retry:
17909 @@ -332,7 +335,9 @@ int __kprobes __copy_instruction(u8 *dest, u8 *src)
17910 /* Another subsystem puts a breakpoint, failed to recover */
17911 if (insn.opcode.bytes[0] == BREAKPOINT_INSTRUCTION)
17912 return 0;
17913 + pax_open_kernel();
17914 memcpy(dest, insn.kaddr, insn.length);
17915 + pax_close_kernel();
17916
17917 #ifdef CONFIG_X86_64
17918 if (insn_rip_relative(&insn)) {
17919 @@ -355,7 +360,9 @@ int __kprobes __copy_instruction(u8 *dest, u8 *src)
17920 newdisp = (u8 *) src + (s64) insn.displacement.value - (u8 *) dest;
17921 BUG_ON((s64) (s32) newdisp != newdisp); /* Sanity check. */
17922 disp = (u8 *) dest + insn_offset_displacement(&insn);
17923 + pax_open_kernel();
17924 *(s32 *) disp = (s32) newdisp;
17925 + pax_close_kernel();
17926 }
17927 #endif
17928 return insn.length;
17929 @@ -485,7 +492,7 @@ setup_singlestep(struct kprobe *p, struct pt_regs *regs, struct kprobe_ctlblk *k
17930 * nor set current_kprobe, because it doesn't use single
17931 * stepping.
17932 */
17933 - regs->ip = (unsigned long)p->ainsn.insn;
17934 + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
17935 preempt_enable_no_resched();
17936 return;
17937 }
17938 @@ -504,7 +511,7 @@ setup_singlestep(struct kprobe *p, struct pt_regs *regs, struct kprobe_ctlblk *k
17939 if (p->opcode == BREAKPOINT_INSTRUCTION)
17940 regs->ip = (unsigned long)p->addr;
17941 else
17942 - regs->ip = (unsigned long)p->ainsn.insn;
17943 + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
17944 }
17945
17946 /*
17947 @@ -583,7 +590,7 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
17948 setup_singlestep(p, regs, kcb, 0);
17949 return 1;
17950 }
17951 - } else if (*addr != BREAKPOINT_INSTRUCTION) {
17952 + } else if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
17953 /*
17954 * The breakpoint instruction was removed right
17955 * after we hit it. Another cpu has removed
17956 @@ -628,6 +635,9 @@ static void __used __kprobes kretprobe_trampoline_holder(void)
17957 " movq %rax, 152(%rsp)\n"
17958 RESTORE_REGS_STRING
17959 " popfq\n"
17960 +#ifdef KERNEXEC_PLUGIN
17961 + " btsq $63,(%rsp)\n"
17962 +#endif
17963 #else
17964 " pushf\n"
17965 SAVE_REGS_STRING
17966 @@ -765,7 +775,7 @@ static void __kprobes
17967 resume_execution(struct kprobe *p, struct pt_regs *regs, struct kprobe_ctlblk *kcb)
17968 {
17969 unsigned long *tos = stack_addr(regs);
17970 - unsigned long copy_ip = (unsigned long)p->ainsn.insn;
17971 + unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
17972 unsigned long orig_ip = (unsigned long)p->addr;
17973 kprobe_opcode_t *insn = p->ainsn.insn;
17974
17975 @@ -947,7 +957,7 @@ kprobe_exceptions_notify(struct notifier_block *self, unsigned long val, void *d
17976 struct die_args *args = data;
17977 int ret = NOTIFY_DONE;
17978
17979 - if (args->regs && user_mode_vm(args->regs))
17980 + if (args->regs && user_mode(args->regs))
17981 return ret;
17982
17983 switch (val) {
17984 diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
17985 index ebc9873..1b9724b 100644
17986 --- a/arch/x86/kernel/ldt.c
17987 +++ b/arch/x86/kernel/ldt.c
17988 @@ -66,13 +66,13 @@ static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
17989 if (reload) {
17990 #ifdef CONFIG_SMP
17991 preempt_disable();
17992 - load_LDT(pc);
17993 + load_LDT_nolock(pc);
17994 if (!cpumask_equal(mm_cpumask(current->mm),
17995 cpumask_of(smp_processor_id())))
17996 smp_call_function(flush_ldt, current->mm, 1);
17997 preempt_enable();
17998 #else
17999 - load_LDT(pc);
18000 + load_LDT_nolock(pc);
18001 #endif
18002 }
18003 if (oldsize) {
18004 @@ -94,7 +94,7 @@ static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
18005 return err;
18006
18007 for (i = 0; i < old->size; i++)
18008 - write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
18009 + write_ldt_entry(new->ldt, i, old->ldt + i);
18010 return 0;
18011 }
18012
18013 @@ -115,6 +115,24 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
18014 retval = copy_ldt(&mm->context, &old_mm->context);
18015 mutex_unlock(&old_mm->context.lock);
18016 }
18017 +
18018 + if (tsk == current) {
18019 + mm->context.vdso = 0;
18020 +
18021 +#ifdef CONFIG_X86_32
18022 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
18023 + mm->context.user_cs_base = 0UL;
18024 + mm->context.user_cs_limit = ~0UL;
18025 +
18026 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
18027 + cpus_clear(mm->context.cpu_user_cs_mask);
18028 +#endif
18029 +
18030 +#endif
18031 +#endif
18032 +
18033 + }
18034 +
18035 return retval;
18036 }
18037
18038 @@ -229,6 +247,13 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
18039 }
18040 }
18041
18042 +#ifdef CONFIG_PAX_SEGMEXEC
18043 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
18044 + error = -EINVAL;
18045 + goto out_unlock;
18046 + }
18047 +#endif
18048 +
18049 fill_ldt(&ldt, &ldt_info);
18050 if (oldmode)
18051 ldt.avl = 0;
18052 diff --git a/arch/x86/kernel/machine_kexec_32.c b/arch/x86/kernel/machine_kexec_32.c
18053 index 5b19e4d..6476a76 100644
18054 --- a/arch/x86/kernel/machine_kexec_32.c
18055 +++ b/arch/x86/kernel/machine_kexec_32.c
18056 @@ -26,7 +26,7 @@
18057 #include <asm/cacheflush.h>
18058 #include <asm/debugreg.h>
18059
18060 -static void set_idt(void *newidt, __u16 limit)
18061 +static void set_idt(struct desc_struct *newidt, __u16 limit)
18062 {
18063 struct desc_ptr curidt;
18064
18065 @@ -38,7 +38,7 @@ static void set_idt(void *newidt, __u16 limit)
18066 }
18067
18068
18069 -static void set_gdt(void *newgdt, __u16 limit)
18070 +static void set_gdt(struct desc_struct *newgdt, __u16 limit)
18071 {
18072 struct desc_ptr curgdt;
18073
18074 @@ -216,7 +216,7 @@ void machine_kexec(struct kimage *image)
18075 }
18076
18077 control_page = page_address(image->control_code_page);
18078 - memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
18079 + memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
18080
18081 relocate_kernel_ptr = control_page;
18082 page_list[PA_CONTROL_PAGE] = __pa(control_page);
18083 diff --git a/arch/x86/kernel/microcode_intel.c b/arch/x86/kernel/microcode_intel.c
18084 index 0327e2b..e43737b 100644
18085 --- a/arch/x86/kernel/microcode_intel.c
18086 +++ b/arch/x86/kernel/microcode_intel.c
18087 @@ -430,13 +430,13 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device)
18088
18089 static int get_ucode_user(void *to, const void *from, size_t n)
18090 {
18091 - return copy_from_user(to, from, n);
18092 + return copy_from_user(to, (const void __force_user *)from, n);
18093 }
18094
18095 static enum ucode_state
18096 request_microcode_user(int cpu, const void __user *buf, size_t size)
18097 {
18098 - return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
18099 + return generic_load_microcode(cpu, (__force_kernel void *)buf, size, &get_ucode_user);
18100 }
18101
18102 static void microcode_fini_cpu(int cpu)
18103 diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
18104 index f21fd94..61565cd 100644
18105 --- a/arch/x86/kernel/module.c
18106 +++ b/arch/x86/kernel/module.c
18107 @@ -35,15 +35,60 @@
18108 #define DEBUGP(fmt...)
18109 #endif
18110
18111 -void *module_alloc(unsigned long size)
18112 +static inline void *__module_alloc(unsigned long size, pgprot_t prot)
18113 {
18114 - if (PAGE_ALIGN(size) > MODULES_LEN)
18115 + if (size == 0 || PAGE_ALIGN(size) > MODULES_LEN)
18116 return NULL;
18117 return __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,
18118 - GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
18119 + GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot,
18120 -1, __builtin_return_address(0));
18121 }
18122
18123 +void *module_alloc(unsigned long size)
18124 +{
18125 +
18126 +#ifdef CONFIG_PAX_KERNEXEC
18127 + return __module_alloc(size, PAGE_KERNEL);
18128 +#else
18129 + return __module_alloc(size, PAGE_KERNEL_EXEC);
18130 +#endif
18131 +
18132 +}
18133 +
18134 +#ifdef CONFIG_PAX_KERNEXEC
18135 +#ifdef CONFIG_X86_32
18136 +void *module_alloc_exec(unsigned long size)
18137 +{
18138 + struct vm_struct *area;
18139 +
18140 + if (size == 0)
18141 + return NULL;
18142 +
18143 + area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
18144 + return area ? area->addr : NULL;
18145 +}
18146 +EXPORT_SYMBOL(module_alloc_exec);
18147 +
18148 +void module_free_exec(struct module *mod, void *module_region)
18149 +{
18150 + vunmap(module_region);
18151 +}
18152 +EXPORT_SYMBOL(module_free_exec);
18153 +#else
18154 +void module_free_exec(struct module *mod, void *module_region)
18155 +{
18156 + module_free(mod, module_region);
18157 +}
18158 +EXPORT_SYMBOL(module_free_exec);
18159 +
18160 +void *module_alloc_exec(unsigned long size)
18161 +{
18162 + return __module_alloc(size, PAGE_KERNEL_RX);
18163 +}
18164 +EXPORT_SYMBOL(module_alloc_exec);
18165 +#endif
18166 +#endif
18167 +
18168 #ifdef CONFIG_X86_32
18169 int apply_relocate(Elf32_Shdr *sechdrs,
18170 const char *strtab,
18171 @@ -54,14 +99,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
18172 unsigned int i;
18173 Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
18174 Elf32_Sym *sym;
18175 - uint32_t *location;
18176 + uint32_t *plocation, location;
18177
18178 DEBUGP("Applying relocate section %u to %u\n", relsec,
18179 sechdrs[relsec].sh_info);
18180 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
18181 /* This is where to make the change */
18182 - location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
18183 - + rel[i].r_offset;
18184 + plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
18185 + location = (uint32_t)plocation;
18186 + if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
18187 + plocation = ktla_ktva((void *)plocation);
18188 /* This is the symbol it is referring to. Note that all
18189 undefined symbols have been resolved. */
18190 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
18191 @@ -70,11 +117,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
18192 switch (ELF32_R_TYPE(rel[i].r_info)) {
18193 case R_386_32:
18194 /* We add the value into the location given */
18195 - *location += sym->st_value;
18196 + pax_open_kernel();
18197 + *plocation += sym->st_value;
18198 + pax_close_kernel();
18199 break;
18200 case R_386_PC32:
18201 /* Add the value, subtract its postition */
18202 - *location += sym->st_value - (uint32_t)location;
18203 + pax_open_kernel();
18204 + *plocation += sym->st_value - location;
18205 + pax_close_kernel();
18206 break;
18207 default:
18208 printk(KERN_ERR "module %s: Unknown relocation: %u\n",
18209 @@ -119,21 +170,30 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
18210 case R_X86_64_NONE:
18211 break;
18212 case R_X86_64_64:
18213 + pax_open_kernel();
18214 *(u64 *)loc = val;
18215 + pax_close_kernel();
18216 break;
18217 case R_X86_64_32:
18218 + pax_open_kernel();
18219 *(u32 *)loc = val;
18220 + pax_close_kernel();
18221 if (val != *(u32 *)loc)
18222 goto overflow;
18223 break;
18224 case R_X86_64_32S:
18225 + pax_open_kernel();
18226 *(s32 *)loc = val;
18227 + pax_close_kernel();
18228 if ((s64)val != *(s32 *)loc)
18229 goto overflow;
18230 break;
18231 case R_X86_64_PC32:
18232 val -= (u64)loc;
18233 + pax_open_kernel();
18234 *(u32 *)loc = val;
18235 + pax_close_kernel();
18236 +
18237 #if 0
18238 if ((s64)val != *(s32 *)loc)
18239 goto overflow;
18240 diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
18241 index a0b2f84..875ab81 100644
18242 --- a/arch/x86/kernel/nmi.c
18243 +++ b/arch/x86/kernel/nmi.c
18244 @@ -460,6 +460,17 @@ static inline void nmi_nesting_postprocess(void)
18245 dotraplinkage notrace __kprobes void
18246 do_nmi(struct pt_regs *regs, long error_code)
18247 {
18248 +
18249 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18250 + if (!user_mode(regs)) {
18251 + unsigned long cs = regs->cs & 0xFFFF;
18252 + unsigned long ip = ktva_ktla(regs->ip);
18253 +
18254 + if ((cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS) && ip <= (unsigned long)_etext)
18255 + regs->ip = ip;
18256 + }
18257 +#endif
18258 +
18259 nmi_nesting_preprocess(regs);
18260
18261 nmi_enter();
18262 diff --git a/arch/x86/kernel/paravirt-spinlocks.c b/arch/x86/kernel/paravirt-spinlocks.c
18263 index 676b8c7..870ba04 100644
18264 --- a/arch/x86/kernel/paravirt-spinlocks.c
18265 +++ b/arch/x86/kernel/paravirt-spinlocks.c
18266 @@ -13,7 +13,7 @@ default_spin_lock_flags(arch_spinlock_t *lock, unsigned long flags)
18267 arch_spin_lock(lock);
18268 }
18269
18270 -struct pv_lock_ops pv_lock_ops = {
18271 +struct pv_lock_ops pv_lock_ops __read_only = {
18272 #ifdef CONFIG_SMP
18273 .spin_is_locked = __ticket_spin_is_locked,
18274 .spin_is_contended = __ticket_spin_is_contended,
18275 diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
18276 index 9ce8859..b49bf51 100644
18277 --- a/arch/x86/kernel/paravirt.c
18278 +++ b/arch/x86/kernel/paravirt.c
18279 @@ -55,6 +55,9 @@ u64 _paravirt_ident_64(u64 x)
18280 {
18281 return x;
18282 }
18283 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
18284 +PV_CALLEE_SAVE_REGS_THUNK(_paravirt_ident_64);
18285 +#endif
18286
18287 void __init default_banner(void)
18288 {
18289 @@ -147,15 +150,19 @@ unsigned paravirt_patch_default(u8 type, u16 clobbers, void *insnbuf,
18290 if (opfunc == NULL)
18291 /* If there's no function, patch it with a ud2a (BUG) */
18292 ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
18293 - else if (opfunc == _paravirt_nop)
18294 + else if (opfunc == (void *)_paravirt_nop)
18295 /* If the operation is a nop, then nop the callsite */
18296 ret = paravirt_patch_nop();
18297
18298 /* identity functions just return their single argument */
18299 - else if (opfunc == _paravirt_ident_32)
18300 + else if (opfunc == (void *)_paravirt_ident_32)
18301 ret = paravirt_patch_ident_32(insnbuf, len);
18302 - else if (opfunc == _paravirt_ident_64)
18303 + else if (opfunc == (void *)_paravirt_ident_64)
18304 ret = paravirt_patch_ident_64(insnbuf, len);
18305 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
18306 + else if (opfunc == (void *)__raw_callee_save__paravirt_ident_64)
18307 + ret = paravirt_patch_ident_64(insnbuf, len);
18308 +#endif
18309
18310 else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
18311 type == PARAVIRT_PATCH(pv_cpu_ops.irq_enable_sysexit) ||
18312 @@ -180,7 +187,7 @@ unsigned paravirt_patch_insns(void *insnbuf, unsigned len,
18313 if (insn_len > len || start == NULL)
18314 insn_len = len;
18315 else
18316 - memcpy(insnbuf, start, insn_len);
18317 + memcpy(insnbuf, ktla_ktva(start), insn_len);
18318
18319 return insn_len;
18320 }
18321 @@ -304,7 +311,7 @@ void arch_flush_lazy_mmu_mode(void)
18322 preempt_enable();
18323 }
18324
18325 -struct pv_info pv_info = {
18326 +struct pv_info pv_info __read_only = {
18327 .name = "bare hardware",
18328 .paravirt_enabled = 0,
18329 .kernel_rpl = 0,
18330 @@ -315,16 +322,16 @@ struct pv_info pv_info = {
18331 #endif
18332 };
18333
18334 -struct pv_init_ops pv_init_ops = {
18335 +struct pv_init_ops pv_init_ops __read_only = {
18336 .patch = native_patch,
18337 };
18338
18339 -struct pv_time_ops pv_time_ops = {
18340 +struct pv_time_ops pv_time_ops __read_only = {
18341 .sched_clock = native_sched_clock,
18342 .steal_clock = native_steal_clock,
18343 };
18344
18345 -struct pv_irq_ops pv_irq_ops = {
18346 +struct pv_irq_ops pv_irq_ops __read_only = {
18347 .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
18348 .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
18349 .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
18350 @@ -336,7 +343,7 @@ struct pv_irq_ops pv_irq_ops = {
18351 #endif
18352 };
18353
18354 -struct pv_cpu_ops pv_cpu_ops = {
18355 +struct pv_cpu_ops pv_cpu_ops __read_only = {
18356 .cpuid = native_cpuid,
18357 .get_debugreg = native_get_debugreg,
18358 .set_debugreg = native_set_debugreg,
18359 @@ -397,21 +404,26 @@ struct pv_cpu_ops pv_cpu_ops = {
18360 .end_context_switch = paravirt_nop,
18361 };
18362
18363 -struct pv_apic_ops pv_apic_ops = {
18364 +struct pv_apic_ops pv_apic_ops __read_only = {
18365 #ifdef CONFIG_X86_LOCAL_APIC
18366 .startup_ipi_hook = paravirt_nop,
18367 #endif
18368 };
18369
18370 -#if defined(CONFIG_X86_32) && !defined(CONFIG_X86_PAE)
18371 +#ifdef CONFIG_X86_32
18372 +#ifdef CONFIG_X86_PAE
18373 +/* 64-bit pagetable entries */
18374 +#define PTE_IDENT PV_CALLEE_SAVE(_paravirt_ident_64)
18375 +#else
18376 /* 32-bit pagetable entries */
18377 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_32)
18378 +#endif
18379 #else
18380 /* 64-bit pagetable entries */
18381 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
18382 #endif
18383
18384 -struct pv_mmu_ops pv_mmu_ops = {
18385 +struct pv_mmu_ops pv_mmu_ops __read_only = {
18386
18387 .read_cr2 = native_read_cr2,
18388 .write_cr2 = native_write_cr2,
18389 @@ -461,6 +473,7 @@ struct pv_mmu_ops pv_mmu_ops = {
18390 .make_pud = PTE_IDENT,
18391
18392 .set_pgd = native_set_pgd,
18393 + .set_pgd_batched = native_set_pgd_batched,
18394 #endif
18395 #endif /* PAGETABLE_LEVELS >= 3 */
18396
18397 @@ -480,6 +493,12 @@ struct pv_mmu_ops pv_mmu_ops = {
18398 },
18399
18400 .set_fixmap = native_set_fixmap,
18401 +
18402 +#ifdef CONFIG_PAX_KERNEXEC
18403 + .pax_open_kernel = native_pax_open_kernel,
18404 + .pax_close_kernel = native_pax_close_kernel,
18405 +#endif
18406 +
18407 };
18408
18409 EXPORT_SYMBOL_GPL(pv_time_ops);
18410 diff --git a/arch/x86/kernel/pci-iommu_table.c b/arch/x86/kernel/pci-iommu_table.c
18411 index 35ccf75..7a15747 100644
18412 --- a/arch/x86/kernel/pci-iommu_table.c
18413 +++ b/arch/x86/kernel/pci-iommu_table.c
18414 @@ -2,7 +2,7 @@
18415 #include <asm/iommu_table.h>
18416 #include <linux/string.h>
18417 #include <linux/kallsyms.h>
18418 -
18419 +#include <linux/sched.h>
18420
18421 #define DEBUG 1
18422
18423 diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
18424 index 735279e..5008677 100644
18425 --- a/arch/x86/kernel/process.c
18426 +++ b/arch/x86/kernel/process.c
18427 @@ -34,7 +34,8 @@
18428 * section. Since TSS's are completely CPU-local, we want them
18429 * on exact cacheline boundaries, to eliminate cacheline ping-pong.
18430 */
18431 -DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
18432 +struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
18433 +EXPORT_SYMBOL(init_tss);
18434
18435 #ifdef CONFIG_X86_64
18436 static DEFINE_PER_CPU(unsigned char, is_idle);
18437 @@ -92,7 +93,7 @@ void arch_task_cache_init(void)
18438 task_xstate_cachep =
18439 kmem_cache_create("task_xstate", xstate_size,
18440 __alignof__(union thread_xstate),
18441 - SLAB_PANIC | SLAB_NOTRACK, NULL);
18442 + SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
18443 }
18444
18445 static inline void drop_fpu(struct task_struct *tsk)
18446 @@ -115,7 +116,7 @@ void exit_thread(void)
18447 unsigned long *bp = t->io_bitmap_ptr;
18448
18449 if (bp) {
18450 - struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
18451 + struct tss_struct *tss = init_tss + get_cpu();
18452
18453 t->io_bitmap_ptr = NULL;
18454 clear_thread_flag(TIF_IO_BITMAP);
18455 @@ -147,7 +148,7 @@ void show_regs_common(void)
18456
18457 printk(KERN_CONT "\n");
18458 printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s",
18459 - current->pid, current->comm, print_tainted(),
18460 + task_pid_nr(current), current->comm, print_tainted(),
18461 init_utsname()->release,
18462 (int)strcspn(init_utsname()->version, " "),
18463 init_utsname()->version);
18464 @@ -161,6 +162,9 @@ void flush_thread(void)
18465 {
18466 struct task_struct *tsk = current;
18467
18468 +#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
18469 + loadsegment(gs, 0);
18470 +#endif
18471 flush_ptrace_hw_breakpoint(tsk);
18472 memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
18473 drop_fpu(tsk);
18474 @@ -318,10 +322,10 @@ int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
18475 regs.di = (unsigned long) arg;
18476
18477 #ifdef CONFIG_X86_32
18478 - regs.ds = __USER_DS;
18479 - regs.es = __USER_DS;
18480 + regs.ds = __KERNEL_DS;
18481 + regs.es = __KERNEL_DS;
18482 regs.fs = __KERNEL_PERCPU;
18483 - regs.gs = __KERNEL_STACK_CANARY;
18484 + savesegment(gs, regs.gs);
18485 #else
18486 regs.ss = __KERNEL_DS;
18487 #endif
18488 @@ -407,7 +411,7 @@ static void __exit_idle(void)
18489 void exit_idle(void)
18490 {
18491 /* idle loop has pid 0 */
18492 - if (current->pid)
18493 + if (task_pid_nr(current))
18494 return;
18495 __exit_idle();
18496 }
18497 @@ -516,7 +520,7 @@ bool set_pm_idle_to_default(void)
18498
18499 return ret;
18500 }
18501 -void stop_this_cpu(void *dummy)
18502 +__noreturn void stop_this_cpu(void *dummy)
18503 {
18504 local_irq_disable();
18505 /*
18506 @@ -746,16 +750,37 @@ static int __init idle_setup(char *str)
18507 }
18508 early_param("idle", idle_setup);
18509
18510 -unsigned long arch_align_stack(unsigned long sp)
18511 +#ifdef CONFIG_PAX_RANDKSTACK
18512 +void pax_randomize_kstack(struct pt_regs *regs)
18513 {
18514 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
18515 - sp -= get_random_int() % 8192;
18516 - return sp & ~0xf;
18517 -}
18518 + struct thread_struct *thread = &current->thread;
18519 + unsigned long time;
18520
18521 -unsigned long arch_randomize_brk(struct mm_struct *mm)
18522 -{
18523 - unsigned long range_end = mm->brk + 0x02000000;
18524 - return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
18525 -}
18526 + if (!randomize_va_space)
18527 + return;
18528 +
18529 + if (v8086_mode(regs))
18530 + return;
18531
18532 + rdtscl(time);
18533 +
18534 + /* P4 seems to return a 0 LSB, ignore it */
18535 +#ifdef CONFIG_MPENTIUM4
18536 + time &= 0x3EUL;
18537 + time <<= 2;
18538 +#elif defined(CONFIG_X86_64)
18539 + time &= 0xFUL;
18540 + time <<= 4;
18541 +#else
18542 + time &= 0x1FUL;
18543 + time <<= 3;
18544 +#endif
18545 +
18546 + thread->sp0 ^= time;
18547 + load_sp0(init_tss + smp_processor_id(), thread);
18548 +
18549 +#ifdef CONFIG_X86_64
18550 + this_cpu_write(kernel_stack, thread->sp0);
18551 +#endif
18552 +}
18553 +#endif
18554 diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
18555 index 516fa18..80bd9e6 100644
18556 --- a/arch/x86/kernel/process_32.c
18557 +++ b/arch/x86/kernel/process_32.c
18558 @@ -64,6 +64,7 @@ asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
18559 unsigned long thread_saved_pc(struct task_struct *tsk)
18560 {
18561 return ((unsigned long *)tsk->thread.sp)[3];
18562 +//XXX return tsk->thread.eip;
18563 }
18564
18565 void __show_regs(struct pt_regs *regs, int all)
18566 @@ -73,15 +74,14 @@ void __show_regs(struct pt_regs *regs, int all)
18567 unsigned long sp;
18568 unsigned short ss, gs;
18569
18570 - if (user_mode_vm(regs)) {
18571 + if (user_mode(regs)) {
18572 sp = regs->sp;
18573 ss = regs->ss & 0xffff;
18574 - gs = get_user_gs(regs);
18575 } else {
18576 sp = kernel_stack_pointer(regs);
18577 savesegment(ss, ss);
18578 - savesegment(gs, gs);
18579 }
18580 + gs = get_user_gs(regs);
18581
18582 show_regs_common();
18583
18584 @@ -134,13 +134,14 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
18585 struct task_struct *tsk;
18586 int err;
18587
18588 - childregs = task_pt_regs(p);
18589 + childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
18590 *childregs = *regs;
18591 childregs->ax = 0;
18592 childregs->sp = sp;
18593
18594 p->thread.sp = (unsigned long) childregs;
18595 p->thread.sp0 = (unsigned long) (childregs+1);
18596 + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
18597
18598 p->thread.ip = (unsigned long) ret_from_fork;
18599
18600 @@ -231,7 +232,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
18601 struct thread_struct *prev = &prev_p->thread,
18602 *next = &next_p->thread;
18603 int cpu = smp_processor_id();
18604 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
18605 + struct tss_struct *tss = init_tss + cpu;
18606 fpu_switch_t fpu;
18607
18608 /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
18609 @@ -255,6 +256,10 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
18610 */
18611 lazy_save_gs(prev->gs);
18612
18613 +#ifdef CONFIG_PAX_MEMORY_UDEREF
18614 + __set_fs(task_thread_info(next_p)->addr_limit);
18615 +#endif
18616 +
18617 /*
18618 * Load the per-thread Thread-Local Storage descriptor.
18619 */
18620 @@ -285,6 +290,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
18621 */
18622 arch_end_context_switch(next_p);
18623
18624 + this_cpu_write(current_task, next_p);
18625 + this_cpu_write(current_tinfo, &next_p->tinfo);
18626 +
18627 /*
18628 * Restore %gs if needed (which is common)
18629 */
18630 @@ -293,8 +301,6 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
18631
18632 switch_fpu_finish(next_p, fpu);
18633
18634 - this_cpu_write(current_task, next_p);
18635 -
18636 return prev_p;
18637 }
18638
18639 @@ -324,4 +330,3 @@ unsigned long get_wchan(struct task_struct *p)
18640 } while (count++ < 16);
18641 return 0;
18642 }
18643 -
18644 diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
18645 index 61cdf7f..797f06a 100644
18646 --- a/arch/x86/kernel/process_64.c
18647 +++ b/arch/x86/kernel/process_64.c
18648 @@ -153,8 +153,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
18649 struct pt_regs *childregs;
18650 struct task_struct *me = current;
18651
18652 - childregs = ((struct pt_regs *)
18653 - (THREAD_SIZE + task_stack_page(p))) - 1;
18654 + childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
18655 *childregs = *regs;
18656
18657 childregs->ax = 0;
18658 @@ -166,6 +165,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
18659 p->thread.sp = (unsigned long) childregs;
18660 p->thread.sp0 = (unsigned long) (childregs+1);
18661 p->thread.usersp = me->thread.usersp;
18662 + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
18663
18664 set_tsk_thread_flag(p, TIF_FORK);
18665
18666 @@ -271,7 +271,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
18667 struct thread_struct *prev = &prev_p->thread;
18668 struct thread_struct *next = &next_p->thread;
18669 int cpu = smp_processor_id();
18670 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
18671 + struct tss_struct *tss = init_tss + cpu;
18672 unsigned fsindex, gsindex;
18673 fpu_switch_t fpu;
18674
18675 @@ -353,10 +353,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
18676 prev->usersp = this_cpu_read(old_rsp);
18677 this_cpu_write(old_rsp, next->usersp);
18678 this_cpu_write(current_task, next_p);
18679 + this_cpu_write(current_tinfo, &next_p->tinfo);
18680
18681 - this_cpu_write(kernel_stack,
18682 - (unsigned long)task_stack_page(next_p) +
18683 - THREAD_SIZE - KERNEL_STACK_OFFSET);
18684 + this_cpu_write(kernel_stack, next->sp0);
18685
18686 /*
18687 * Now maybe reload the debug registers and handle I/O bitmaps
18688 @@ -425,12 +424,11 @@ unsigned long get_wchan(struct task_struct *p)
18689 if (!p || p == current || p->state == TASK_RUNNING)
18690 return 0;
18691 stack = (unsigned long)task_stack_page(p);
18692 - if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
18693 + if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
18694 return 0;
18695 fp = *(u64 *)(p->thread.sp);
18696 do {
18697 - if (fp < (unsigned long)stack ||
18698 - fp >= (unsigned long)stack+THREAD_SIZE)
18699 + if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
18700 return 0;
18701 ip = *(u64 *)(fp+8);
18702 if (!in_sched_functions(ip))
18703 diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
18704 index c4c6a5c..905f440 100644
18705 --- a/arch/x86/kernel/ptrace.c
18706 +++ b/arch/x86/kernel/ptrace.c
18707 @@ -824,7 +824,7 @@ long arch_ptrace(struct task_struct *child, long request,
18708 unsigned long addr, unsigned long data)
18709 {
18710 int ret;
18711 - unsigned long __user *datap = (unsigned long __user *)data;
18712 + unsigned long __user *datap = (__force unsigned long __user *)data;
18713
18714 switch (request) {
18715 /* read the word at location addr in the USER area. */
18716 @@ -909,14 +909,14 @@ long arch_ptrace(struct task_struct *child, long request,
18717 if ((int) addr < 0)
18718 return -EIO;
18719 ret = do_get_thread_area(child, addr,
18720 - (struct user_desc __user *)data);
18721 + (__force struct user_desc __user *) data);
18722 break;
18723
18724 case PTRACE_SET_THREAD_AREA:
18725 if ((int) addr < 0)
18726 return -EIO;
18727 ret = do_set_thread_area(child, addr,
18728 - (struct user_desc __user *)data, 0);
18729 + (__force struct user_desc __user *) data, 0);
18730 break;
18731 #endif
18732
18733 @@ -1426,7 +1426,7 @@ static void fill_sigtrap_info(struct task_struct *tsk,
18734 memset(info, 0, sizeof(*info));
18735 info->si_signo = SIGTRAP;
18736 info->si_code = si_code;
18737 - info->si_addr = user_mode_vm(regs) ? (void __user *)regs->ip : NULL;
18738 + info->si_addr = user_mode(regs) ? (__force void __user *)regs->ip : NULL;
18739 }
18740
18741 void user_single_step_siginfo(struct task_struct *tsk,
18742 @@ -1455,6 +1455,10 @@ void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs,
18743 # define IS_IA32 0
18744 #endif
18745
18746 +#ifdef CONFIG_GRKERNSEC_SETXID
18747 +extern void gr_delayed_cred_worker(void);
18748 +#endif
18749 +
18750 /*
18751 * We must return the syscall number to actually look up in the table.
18752 * This can be -1L to skip running any syscall at all.
18753 @@ -1463,6 +1467,11 @@ long syscall_trace_enter(struct pt_regs *regs)
18754 {
18755 long ret = 0;
18756
18757 +#ifdef CONFIG_GRKERNSEC_SETXID
18758 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
18759 + gr_delayed_cred_worker();
18760 +#endif
18761 +
18762 /*
18763 * If we stepped into a sysenter/syscall insn, it trapped in
18764 * kernel mode; do_debug() cleared TF and set TIF_SINGLESTEP.
18765 @@ -1511,6 +1520,11 @@ void syscall_trace_leave(struct pt_regs *regs)
18766 {
18767 bool step;
18768
18769 +#ifdef CONFIG_GRKERNSEC_SETXID
18770 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
18771 + gr_delayed_cred_worker();
18772 +#endif
18773 +
18774 audit_syscall_exit(regs);
18775
18776 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
18777 diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
18778 index 42eb330..139955c 100644
18779 --- a/arch/x86/kernel/pvclock.c
18780 +++ b/arch/x86/kernel/pvclock.c
18781 @@ -81,11 +81,11 @@ unsigned long pvclock_tsc_khz(struct pvclock_vcpu_time_info *src)
18782 return pv_tsc_khz;
18783 }
18784
18785 -static atomic64_t last_value = ATOMIC64_INIT(0);
18786 +static atomic64_unchecked_t last_value = ATOMIC64_INIT(0);
18787
18788 void pvclock_resume(void)
18789 {
18790 - atomic64_set(&last_value, 0);
18791 + atomic64_set_unchecked(&last_value, 0);
18792 }
18793
18794 cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
18795 @@ -121,11 +121,11 @@ cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
18796 * updating at the same time, and one of them could be slightly behind,
18797 * making the assumption that last_value always go forward fail to hold.
18798 */
18799 - last = atomic64_read(&last_value);
18800 + last = atomic64_read_unchecked(&last_value);
18801 do {
18802 if (ret < last)
18803 return last;
18804 - last = atomic64_cmpxchg(&last_value, last, ret);
18805 + last = atomic64_cmpxchg_unchecked(&last_value, last, ret);
18806 } while (unlikely(last != ret));
18807
18808 return ret;
18809 diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
18810 index 5de92f1..776788d 100644
18811 --- a/arch/x86/kernel/reboot.c
18812 +++ b/arch/x86/kernel/reboot.c
18813 @@ -36,7 +36,7 @@ void (*pm_power_off)(void);
18814 EXPORT_SYMBOL(pm_power_off);
18815
18816 static const struct desc_ptr no_idt = {};
18817 -static int reboot_mode;
18818 +static unsigned short reboot_mode;
18819 enum reboot_type reboot_type = BOOT_ACPI;
18820 int reboot_force;
18821
18822 @@ -157,11 +157,15 @@ static int __init set_bios_reboot(const struct dmi_system_id *d)
18823 return 0;
18824 }
18825
18826 -void machine_real_restart(unsigned int type)
18827 +__noreturn void machine_real_restart(unsigned int type)
18828 {
18829 void (*restart_lowmem)(unsigned int) = (void (*)(unsigned int))
18830 real_mode_header->machine_real_restart_asm;
18831
18832 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
18833 + struct desc_struct *gdt;
18834 +#endif
18835 +
18836 local_irq_disable();
18837
18838 /*
18839 @@ -189,10 +193,38 @@ void machine_real_restart(unsigned int type)
18840 * boot)". This seems like a fairly standard thing that gets set by
18841 * REBOOT.COM programs, and the previous reset routine did this
18842 * too. */
18843 - *((unsigned short *)0x472) = reboot_mode;
18844 + *(unsigned short *)(__va(0x472)) = reboot_mode;
18845
18846 /* Jump to the identity-mapped low memory code */
18847 +
18848 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
18849 + gdt = get_cpu_gdt_table(smp_processor_id());
18850 + pax_open_kernel();
18851 +#ifdef CONFIG_PAX_MEMORY_UDEREF
18852 + gdt[GDT_ENTRY_KERNEL_DS].type = 3;
18853 + gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
18854 + loadsegment(ds, __KERNEL_DS);
18855 + loadsegment(es, __KERNEL_DS);
18856 + loadsegment(ss, __KERNEL_DS);
18857 +#endif
18858 +#ifdef CONFIG_PAX_KERNEXEC
18859 + gdt[GDT_ENTRY_KERNEL_CS].base0 = 0;
18860 + gdt[GDT_ENTRY_KERNEL_CS].base1 = 0;
18861 + gdt[GDT_ENTRY_KERNEL_CS].base2 = 0;
18862 + gdt[GDT_ENTRY_KERNEL_CS].limit0 = 0xffff;
18863 + gdt[GDT_ENTRY_KERNEL_CS].limit = 0xf;
18864 + gdt[GDT_ENTRY_KERNEL_CS].g = 1;
18865 +#endif
18866 + pax_close_kernel();
18867 +#endif
18868 +
18869 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18870 + asm volatile("push %0; push %1; lret\n" : : "i" (__KERNEL_CS), "rm" (restart_lowmem), "a" (type));
18871 + unreachable();
18872 +#else
18873 restart_lowmem(type);
18874 +#endif
18875 +
18876 }
18877 #ifdef CONFIG_APM_MODULE
18878 EXPORT_SYMBOL(machine_real_restart);
18879 @@ -543,7 +575,7 @@ void __attribute__((weak)) mach_reboot_fixups(void)
18880 * try to force a triple fault and then cycle between hitting the keyboard
18881 * controller and doing that
18882 */
18883 -static void native_machine_emergency_restart(void)
18884 +static void __noreturn native_machine_emergency_restart(void)
18885 {
18886 int i;
18887 int attempt = 0;
18888 @@ -670,13 +702,13 @@ void native_machine_shutdown(void)
18889 #endif
18890 }
18891
18892 -static void __machine_emergency_restart(int emergency)
18893 +static __noreturn void __machine_emergency_restart(int emergency)
18894 {
18895 reboot_emergency = emergency;
18896 machine_ops.emergency_restart();
18897 }
18898
18899 -static void native_machine_restart(char *__unused)
18900 +static void __noreturn native_machine_restart(char *__unused)
18901 {
18902 printk("machine restart\n");
18903
18904 @@ -685,7 +717,7 @@ static void native_machine_restart(char *__unused)
18905 __machine_emergency_restart(0);
18906 }
18907
18908 -static void native_machine_halt(void)
18909 +static void __noreturn native_machine_halt(void)
18910 {
18911 /* Stop other cpus and apics */
18912 machine_shutdown();
18913 @@ -695,7 +727,7 @@ static void native_machine_halt(void)
18914 stop_this_cpu(NULL);
18915 }
18916
18917 -static void native_machine_power_off(void)
18918 +static void __noreturn native_machine_power_off(void)
18919 {
18920 if (pm_power_off) {
18921 if (!reboot_force)
18922 @@ -704,6 +736,7 @@ static void native_machine_power_off(void)
18923 }
18924 /* A fallback in case there is no PM info available */
18925 tboot_shutdown(TB_SHUTDOWN_HALT);
18926 + unreachable();
18927 }
18928
18929 struct machine_ops machine_ops = {
18930 diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
18931 index 7a6f3b3..bed145d7 100644
18932 --- a/arch/x86/kernel/relocate_kernel_64.S
18933 +++ b/arch/x86/kernel/relocate_kernel_64.S
18934 @@ -11,6 +11,7 @@
18935 #include <asm/kexec.h>
18936 #include <asm/processor-flags.h>
18937 #include <asm/pgtable_types.h>
18938 +#include <asm/alternative-asm.h>
18939
18940 /*
18941 * Must be relocatable PIC code callable as a C function
18942 @@ -160,13 +161,14 @@ identity_mapped:
18943 xorq %rbp, %rbp
18944 xorq %r8, %r8
18945 xorq %r9, %r9
18946 - xorq %r10, %r9
18947 + xorq %r10, %r10
18948 xorq %r11, %r11
18949 xorq %r12, %r12
18950 xorq %r13, %r13
18951 xorq %r14, %r14
18952 xorq %r15, %r15
18953
18954 + pax_force_retaddr 0, 1
18955 ret
18956
18957 1:
18958 diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
18959 index 16be6dc..4686132 100644
18960 --- a/arch/x86/kernel/setup.c
18961 +++ b/arch/x86/kernel/setup.c
18962 @@ -440,7 +440,7 @@ static void __init parse_setup_data(void)
18963
18964 switch (data->type) {
18965 case SETUP_E820_EXT:
18966 - parse_e820_ext(data);
18967 + parse_e820_ext((struct setup_data __force_kernel *)data);
18968 break;
18969 case SETUP_DTB:
18970 add_dtb(pa_data);
18971 @@ -632,7 +632,7 @@ static void __init trim_bios_range(void)
18972 * area (640->1Mb) as ram even though it is not.
18973 * take them out.
18974 */
18975 - e820_remove_range(BIOS_BEGIN, BIOS_END - BIOS_BEGIN, E820_RAM, 1);
18976 + e820_remove_range(ISA_START_ADDRESS, ISA_END_ADDRESS - ISA_START_ADDRESS, E820_RAM, 1);
18977 sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
18978 }
18979
18980 @@ -755,14 +755,14 @@ void __init setup_arch(char **cmdline_p)
18981
18982 if (!boot_params.hdr.root_flags)
18983 root_mountflags &= ~MS_RDONLY;
18984 - init_mm.start_code = (unsigned long) _text;
18985 - init_mm.end_code = (unsigned long) _etext;
18986 + init_mm.start_code = ktla_ktva((unsigned long) _text);
18987 + init_mm.end_code = ktla_ktva((unsigned long) _etext);
18988 init_mm.end_data = (unsigned long) _edata;
18989 init_mm.brk = _brk_end;
18990
18991 - code_resource.start = virt_to_phys(_text);
18992 - code_resource.end = virt_to_phys(_etext)-1;
18993 - data_resource.start = virt_to_phys(_etext);
18994 + code_resource.start = virt_to_phys(ktla_ktva(_text));
18995 + code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
18996 + data_resource.start = virt_to_phys(_sdata);
18997 data_resource.end = virt_to_phys(_edata)-1;
18998 bss_resource.start = virt_to_phys(&__bss_start);
18999 bss_resource.end = virt_to_phys(&__bss_stop)-1;
19000 diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
19001 index 5a98aa2..2f9288d 100644
19002 --- a/arch/x86/kernel/setup_percpu.c
19003 +++ b/arch/x86/kernel/setup_percpu.c
19004 @@ -21,19 +21,17 @@
19005 #include <asm/cpu.h>
19006 #include <asm/stackprotector.h>
19007
19008 -DEFINE_PER_CPU(int, cpu_number);
19009 +#ifdef CONFIG_SMP
19010 +DEFINE_PER_CPU(unsigned int, cpu_number);
19011 EXPORT_PER_CPU_SYMBOL(cpu_number);
19012 +#endif
19013
19014 -#ifdef CONFIG_X86_64
19015 #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
19016 -#else
19017 -#define BOOT_PERCPU_OFFSET 0
19018 -#endif
19019
19020 DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
19021 EXPORT_PER_CPU_SYMBOL(this_cpu_off);
19022
19023 -unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
19024 +unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
19025 [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
19026 };
19027 EXPORT_SYMBOL(__per_cpu_offset);
19028 @@ -155,10 +153,10 @@ static inline void setup_percpu_segment(int cpu)
19029 {
19030 #ifdef CONFIG_X86_32
19031 struct desc_struct gdt;
19032 + unsigned long base = per_cpu_offset(cpu);
19033
19034 - pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
19035 - 0x2 | DESCTYPE_S, 0x8);
19036 - gdt.s = 1;
19037 + pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
19038 + 0x83 | DESCTYPE_S, 0xC);
19039 write_gdt_entry(get_cpu_gdt_table(cpu),
19040 GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
19041 #endif
19042 @@ -219,6 +217,11 @@ void __init setup_per_cpu_areas(void)
19043 /* alrighty, percpu areas up and running */
19044 delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
19045 for_each_possible_cpu(cpu) {
19046 +#ifdef CONFIG_CC_STACKPROTECTOR
19047 +#ifdef CONFIG_X86_32
19048 + unsigned long canary = per_cpu(stack_canary.canary, cpu);
19049 +#endif
19050 +#endif
19051 per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
19052 per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
19053 per_cpu(cpu_number, cpu) = cpu;
19054 @@ -259,6 +262,12 @@ void __init setup_per_cpu_areas(void)
19055 */
19056 set_cpu_numa_node(cpu, early_cpu_to_node(cpu));
19057 #endif
19058 +#ifdef CONFIG_CC_STACKPROTECTOR
19059 +#ifdef CONFIG_X86_32
19060 + if (!cpu)
19061 + per_cpu(stack_canary.canary, cpu) = canary;
19062 +#endif
19063 +#endif
19064 /*
19065 * Up to this point, the boot CPU has been using .init.data
19066 * area. Reload any changed state for the boot CPU.
19067 diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
19068 index 21af737..fb45e22 100644
19069 --- a/arch/x86/kernel/signal.c
19070 +++ b/arch/x86/kernel/signal.c
19071 @@ -191,7 +191,7 @@ static unsigned long align_sigframe(unsigned long sp)
19072 * Align the stack pointer according to the i386 ABI,
19073 * i.e. so that on function entry ((sp + 4) & 15) == 0.
19074 */
19075 - sp = ((sp + 4) & -16ul) - 4;
19076 + sp = ((sp - 12) & -16ul) - 4;
19077 #else /* !CONFIG_X86_32 */
19078 sp = round_down(sp, 16) - 8;
19079 #endif
19080 @@ -242,11 +242,11 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size,
19081 * Return an always-bogus address instead so we will die with SIGSEGV.
19082 */
19083 if (onsigstack && !likely(on_sig_stack(sp)))
19084 - return (void __user *)-1L;
19085 + return (__force void __user *)-1L;
19086
19087 /* save i387 state */
19088 if (used_math() && save_i387_xstate(*fpstate) < 0)
19089 - return (void __user *)-1L;
19090 + return (__force void __user *)-1L;
19091
19092 return (void __user *)sp;
19093 }
19094 @@ -301,9 +301,9 @@ __setup_frame(int sig, struct k_sigaction *ka, sigset_t *set,
19095 }
19096
19097 if (current->mm->context.vdso)
19098 - restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
19099 + restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
19100 else
19101 - restorer = &frame->retcode;
19102 + restorer = (void __user *)&frame->retcode;
19103 if (ka->sa.sa_flags & SA_RESTORER)
19104 restorer = ka->sa.sa_restorer;
19105
19106 @@ -317,7 +317,7 @@ __setup_frame(int sig, struct k_sigaction *ka, sigset_t *set,
19107 * reasons and because gdb uses it as a signature to notice
19108 * signal handler stack frames.
19109 */
19110 - err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
19111 + err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
19112
19113 if (err)
19114 return -EFAULT;
19115 @@ -371,7 +371,10 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
19116 err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
19117
19118 /* Set up to return from userspace. */
19119 - restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
19120 + if (current->mm->context.vdso)
19121 + restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
19122 + else
19123 + restorer = (void __user *)&frame->retcode;
19124 if (ka->sa.sa_flags & SA_RESTORER)
19125 restorer = ka->sa.sa_restorer;
19126 put_user_ex(restorer, &frame->pretcode);
19127 @@ -383,7 +386,7 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
19128 * reasons and because gdb uses it as a signature to notice
19129 * signal handler stack frames.
19130 */
19131 - put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
19132 + put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
19133 } put_user_catch(err);
19134
19135 if (err)
19136 diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
19137 index 7bd8a08..2659b5b 100644
19138 --- a/arch/x86/kernel/smpboot.c
19139 +++ b/arch/x86/kernel/smpboot.c
19140 @@ -679,6 +679,7 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
19141 idle->thread.sp = (unsigned long) (((struct pt_regs *)
19142 (THREAD_SIZE + task_stack_page(idle))) - 1);
19143 per_cpu(current_task, cpu) = idle;
19144 + per_cpu(current_tinfo, cpu) = &idle->tinfo;
19145
19146 #ifdef CONFIG_X86_32
19147 /* Stack for startup_32 can be just as for start_secondary onwards */
19148 @@ -686,11 +687,13 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
19149 #else
19150 clear_tsk_thread_flag(idle, TIF_FORK);
19151 initial_gs = per_cpu_offset(cpu);
19152 - per_cpu(kernel_stack, cpu) =
19153 - (unsigned long)task_stack_page(idle) -
19154 - KERNEL_STACK_OFFSET + THREAD_SIZE;
19155 + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
19156 #endif
19157 +
19158 + pax_open_kernel();
19159 early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
19160 + pax_close_kernel();
19161 +
19162 initial_code = (unsigned long)start_secondary;
19163 stack_start = idle->thread.sp;
19164
19165 @@ -826,6 +829,12 @@ int __cpuinit native_cpu_up(unsigned int cpu, struct task_struct *tidle)
19166
19167 per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
19168
19169 +#ifdef CONFIG_PAX_PER_CPU_PGD
19170 + clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
19171 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
19172 + KERNEL_PGD_PTRS);
19173 +#endif
19174 +
19175 err = do_boot_cpu(apicid, cpu, tidle);
19176 if (err) {
19177 pr_debug("do_boot_cpu failed %d\n", err);
19178 diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
19179 index c346d11..d43b163 100644
19180 --- a/arch/x86/kernel/step.c
19181 +++ b/arch/x86/kernel/step.c
19182 @@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
19183 struct desc_struct *desc;
19184 unsigned long base;
19185
19186 - seg &= ~7UL;
19187 + seg >>= 3;
19188
19189 mutex_lock(&child->mm->context.lock);
19190 - if (unlikely((seg >> 3) >= child->mm->context.size))
19191 + if (unlikely(seg >= child->mm->context.size))
19192 addr = -1L; /* bogus selector, access would fault */
19193 else {
19194 desc = child->mm->context.ldt + seg;
19195 @@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
19196 addr += base;
19197 }
19198 mutex_unlock(&child->mm->context.lock);
19199 - }
19200 + } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
19201 + addr = ktla_ktva(addr);
19202
19203 return addr;
19204 }
19205 @@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
19206 unsigned char opcode[15];
19207 unsigned long addr = convert_ip_to_linear(child, regs);
19208
19209 + if (addr == -EINVAL)
19210 + return 0;
19211 +
19212 copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
19213 for (i = 0; i < copied; i++) {
19214 switch (opcode[i]) {
19215 diff --git a/arch/x86/kernel/sys_i386_32.c b/arch/x86/kernel/sys_i386_32.c
19216 index 0b0cb5f..db6b9ed 100644
19217 --- a/arch/x86/kernel/sys_i386_32.c
19218 +++ b/arch/x86/kernel/sys_i386_32.c
19219 @@ -24,17 +24,224 @@
19220
19221 #include <asm/syscalls.h>
19222
19223 -/*
19224 - * Do a system call from kernel instead of calling sys_execve so we
19225 - * end up with proper pt_regs.
19226 - */
19227 -int kernel_execve(const char *filename,
19228 - const char *const argv[],
19229 - const char *const envp[])
19230 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
19231 {
19232 - long __res;
19233 - asm volatile ("int $0x80"
19234 - : "=a" (__res)
19235 - : "0" (__NR_execve), "b" (filename), "c" (argv), "d" (envp) : "memory");
19236 - return __res;
19237 + unsigned long pax_task_size = TASK_SIZE;
19238 +
19239 +#ifdef CONFIG_PAX_SEGMEXEC
19240 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
19241 + pax_task_size = SEGMEXEC_TASK_SIZE;
19242 +#endif
19243 +
19244 + if (len > pax_task_size || addr > pax_task_size - len)
19245 + return -EINVAL;
19246 +
19247 + return 0;
19248 +}
19249 +
19250 +unsigned long
19251 +arch_get_unmapped_area(struct file *filp, unsigned long addr,
19252 + unsigned long len, unsigned long pgoff, unsigned long flags)
19253 +{
19254 + struct mm_struct *mm = current->mm;
19255 + struct vm_area_struct *vma;
19256 + unsigned long start_addr, pax_task_size = TASK_SIZE;
19257 +
19258 +#ifdef CONFIG_PAX_SEGMEXEC
19259 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
19260 + pax_task_size = SEGMEXEC_TASK_SIZE;
19261 +#endif
19262 +
19263 + pax_task_size -= PAGE_SIZE;
19264 +
19265 + if (len > pax_task_size)
19266 + return -ENOMEM;
19267 +
19268 + if (flags & MAP_FIXED)
19269 + return addr;
19270 +
19271 +#ifdef CONFIG_PAX_RANDMMAP
19272 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
19273 +#endif
19274 +
19275 + if (addr) {
19276 + addr = PAGE_ALIGN(addr);
19277 + if (pax_task_size - len >= addr) {
19278 + vma = find_vma(mm, addr);
19279 + if (check_heap_stack_gap(vma, addr, len))
19280 + return addr;
19281 + }
19282 + }
19283 + if (len > mm->cached_hole_size) {
19284 + start_addr = addr = mm->free_area_cache;
19285 + } else {
19286 + start_addr = addr = mm->mmap_base;
19287 + mm->cached_hole_size = 0;
19288 + }
19289 +
19290 +#ifdef CONFIG_PAX_PAGEEXEC
19291 + if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
19292 + start_addr = 0x00110000UL;
19293 +
19294 +#ifdef CONFIG_PAX_RANDMMAP
19295 + if (mm->pax_flags & MF_PAX_RANDMMAP)
19296 + start_addr += mm->delta_mmap & 0x03FFF000UL;
19297 +#endif
19298 +
19299 + if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
19300 + start_addr = addr = mm->mmap_base;
19301 + else
19302 + addr = start_addr;
19303 + }
19304 +#endif
19305 +
19306 +full_search:
19307 + for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
19308 + /* At this point: (!vma || addr < vma->vm_end). */
19309 + if (pax_task_size - len < addr) {
19310 + /*
19311 + * Start a new search - just in case we missed
19312 + * some holes.
19313 + */
19314 + if (start_addr != mm->mmap_base) {
19315 + start_addr = addr = mm->mmap_base;
19316 + mm->cached_hole_size = 0;
19317 + goto full_search;
19318 + }
19319 + return -ENOMEM;
19320 + }
19321 + if (check_heap_stack_gap(vma, addr, len))
19322 + break;
19323 + if (addr + mm->cached_hole_size < vma->vm_start)
19324 + mm->cached_hole_size = vma->vm_start - addr;
19325 + addr = vma->vm_end;
19326 + if (mm->start_brk <= addr && addr < mm->mmap_base) {
19327 + start_addr = addr = mm->mmap_base;
19328 + mm->cached_hole_size = 0;
19329 + goto full_search;
19330 + }
19331 + }
19332 +
19333 + /*
19334 + * Remember the place where we stopped the search:
19335 + */
19336 + mm->free_area_cache = addr + len;
19337 + return addr;
19338 +}
19339 +
19340 +unsigned long
19341 +arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
19342 + const unsigned long len, const unsigned long pgoff,
19343 + const unsigned long flags)
19344 +{
19345 + struct vm_area_struct *vma;
19346 + struct mm_struct *mm = current->mm;
19347 + unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
19348 +
19349 +#ifdef CONFIG_PAX_SEGMEXEC
19350 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
19351 + pax_task_size = SEGMEXEC_TASK_SIZE;
19352 +#endif
19353 +
19354 + pax_task_size -= PAGE_SIZE;
19355 +
19356 + /* requested length too big for entire address space */
19357 + if (len > pax_task_size)
19358 + return -ENOMEM;
19359 +
19360 + if (flags & MAP_FIXED)
19361 + return addr;
19362 +
19363 +#ifdef CONFIG_PAX_PAGEEXEC
19364 + if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
19365 + goto bottomup;
19366 +#endif
19367 +
19368 +#ifdef CONFIG_PAX_RANDMMAP
19369 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
19370 +#endif
19371 +
19372 + /* requesting a specific address */
19373 + if (addr) {
19374 + addr = PAGE_ALIGN(addr);
19375 + if (pax_task_size - len >= addr) {
19376 + vma = find_vma(mm, addr);
19377 + if (check_heap_stack_gap(vma, addr, len))
19378 + return addr;
19379 + }
19380 + }
19381 +
19382 + /* check if free_area_cache is useful for us */
19383 + if (len <= mm->cached_hole_size) {
19384 + mm->cached_hole_size = 0;
19385 + mm->free_area_cache = mm->mmap_base;
19386 + }
19387 +
19388 + /* either no address requested or can't fit in requested address hole */
19389 + addr = mm->free_area_cache;
19390 +
19391 + /* make sure it can fit in the remaining address space */
19392 + if (addr > len) {
19393 + vma = find_vma(mm, addr-len);
19394 + if (check_heap_stack_gap(vma, addr - len, len))
19395 + /* remember the address as a hint for next time */
19396 + return (mm->free_area_cache = addr-len);
19397 + }
19398 +
19399 + if (mm->mmap_base < len)
19400 + goto bottomup;
19401 +
19402 + addr = mm->mmap_base-len;
19403 +
19404 + do {
19405 + /*
19406 + * Lookup failure means no vma is above this address,
19407 + * else if new region fits below vma->vm_start,
19408 + * return with success:
19409 + */
19410 + vma = find_vma(mm, addr);
19411 + if (check_heap_stack_gap(vma, addr, len))
19412 + /* remember the address as a hint for next time */
19413 + return (mm->free_area_cache = addr);
19414 +
19415 + /* remember the largest hole we saw so far */
19416 + if (addr + mm->cached_hole_size < vma->vm_start)
19417 + mm->cached_hole_size = vma->vm_start - addr;
19418 +
19419 + /* try just below the current vma->vm_start */
19420 + addr = skip_heap_stack_gap(vma, len);
19421 + } while (!IS_ERR_VALUE(addr));
19422 +
19423 +bottomup:
19424 + /*
19425 + * A failed mmap() very likely causes application failure,
19426 + * so fall back to the bottom-up function here. This scenario
19427 + * can happen with large stack limits and large mmap()
19428 + * allocations.
19429 + */
19430 +
19431 +#ifdef CONFIG_PAX_SEGMEXEC
19432 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
19433 + mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
19434 + else
19435 +#endif
19436 +
19437 + mm->mmap_base = TASK_UNMAPPED_BASE;
19438 +
19439 +#ifdef CONFIG_PAX_RANDMMAP
19440 + if (mm->pax_flags & MF_PAX_RANDMMAP)
19441 + mm->mmap_base += mm->delta_mmap;
19442 +#endif
19443 +
19444 + mm->free_area_cache = mm->mmap_base;
19445 + mm->cached_hole_size = ~0UL;
19446 + addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
19447 + /*
19448 + * Restore the topdown base:
19449 + */
19450 + mm->mmap_base = base;
19451 + mm->free_area_cache = base;
19452 + mm->cached_hole_size = ~0UL;
19453 +
19454 + return addr;
19455 }
19456 diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
19457 index b4d3c39..82bb73b 100644
19458 --- a/arch/x86/kernel/sys_x86_64.c
19459 +++ b/arch/x86/kernel/sys_x86_64.c
19460 @@ -95,8 +95,8 @@ out:
19461 return error;
19462 }
19463
19464 -static void find_start_end(unsigned long flags, unsigned long *begin,
19465 - unsigned long *end)
19466 +static void find_start_end(struct mm_struct *mm, unsigned long flags,
19467 + unsigned long *begin, unsigned long *end)
19468 {
19469 if (!test_thread_flag(TIF_ADDR32) && (flags & MAP_32BIT)) {
19470 unsigned long new_begin;
19471 @@ -115,7 +115,7 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
19472 *begin = new_begin;
19473 }
19474 } else {
19475 - *begin = TASK_UNMAPPED_BASE;
19476 + *begin = mm->mmap_base;
19477 *end = TASK_SIZE;
19478 }
19479 }
19480 @@ -132,16 +132,19 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
19481 if (flags & MAP_FIXED)
19482 return addr;
19483
19484 - find_start_end(flags, &begin, &end);
19485 + find_start_end(mm, flags, &begin, &end);
19486
19487 if (len > end)
19488 return -ENOMEM;
19489
19490 +#ifdef CONFIG_PAX_RANDMMAP
19491 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
19492 +#endif
19493 +
19494 if (addr) {
19495 addr = PAGE_ALIGN(addr);
19496 vma = find_vma(mm, addr);
19497 - if (end - len >= addr &&
19498 - (!vma || addr + len <= vma->vm_start))
19499 + if (end - len >= addr && check_heap_stack_gap(vma, addr, len))
19500 return addr;
19501 }
19502 if (((flags & MAP_32BIT) || test_thread_flag(TIF_ADDR32))
19503 @@ -172,7 +175,7 @@ full_search:
19504 }
19505 return -ENOMEM;
19506 }
19507 - if (!vma || addr + len <= vma->vm_start) {
19508 + if (check_heap_stack_gap(vma, addr, len)) {
19509 /*
19510 * Remember the place where we stopped the search:
19511 */
19512 @@ -195,7 +198,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
19513 {
19514 struct vm_area_struct *vma;
19515 struct mm_struct *mm = current->mm;
19516 - unsigned long addr = addr0, start_addr;
19517 + unsigned long base = mm->mmap_base, addr = addr0, start_addr;
19518
19519 /* requested length too big for entire address space */
19520 if (len > TASK_SIZE)
19521 @@ -208,13 +211,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
19522 if (!test_thread_flag(TIF_ADDR32) && (flags & MAP_32BIT))
19523 goto bottomup;
19524
19525 +#ifdef CONFIG_PAX_RANDMMAP
19526 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
19527 +#endif
19528 +
19529 /* requesting a specific address */
19530 if (addr) {
19531 addr = PAGE_ALIGN(addr);
19532 - vma = find_vma(mm, addr);
19533 - if (TASK_SIZE - len >= addr &&
19534 - (!vma || addr + len <= vma->vm_start))
19535 - return addr;
19536 + if (TASK_SIZE - len >= addr) {
19537 + vma = find_vma(mm, addr);
19538 + if (check_heap_stack_gap(vma, addr, len))
19539 + return addr;
19540 + }
19541 }
19542
19543 /* check if free_area_cache is useful for us */
19544 @@ -240,7 +248,7 @@ try_again:
19545 * return with success:
19546 */
19547 vma = find_vma(mm, addr);
19548 - if (!vma || addr+len <= vma->vm_start)
19549 + if (check_heap_stack_gap(vma, addr, len))
19550 /* remember the address as a hint for next time */
19551 return mm->free_area_cache = addr;
19552
19553 @@ -249,8 +257,8 @@ try_again:
19554 mm->cached_hole_size = vma->vm_start - addr;
19555
19556 /* try just below the current vma->vm_start */
19557 - addr = vma->vm_start-len;
19558 - } while (len < vma->vm_start);
19559 + addr = skip_heap_stack_gap(vma, len);
19560 + } while (!IS_ERR_VALUE(addr));
19561
19562 fail:
19563 /*
19564 @@ -270,13 +278,21 @@ bottomup:
19565 * can happen with large stack limits and large mmap()
19566 * allocations.
19567 */
19568 + mm->mmap_base = TASK_UNMAPPED_BASE;
19569 +
19570 +#ifdef CONFIG_PAX_RANDMMAP
19571 + if (mm->pax_flags & MF_PAX_RANDMMAP)
19572 + mm->mmap_base += mm->delta_mmap;
19573 +#endif
19574 +
19575 + mm->free_area_cache = mm->mmap_base;
19576 mm->cached_hole_size = ~0UL;
19577 - mm->free_area_cache = TASK_UNMAPPED_BASE;
19578 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
19579 /*
19580 * Restore the topdown base:
19581 */
19582 - mm->free_area_cache = mm->mmap_base;
19583 + mm->mmap_base = base;
19584 + mm->free_area_cache = base;
19585 mm->cached_hole_size = ~0UL;
19586
19587 return addr;
19588 diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
19589 index f84fe00..93fe08f 100644
19590 --- a/arch/x86/kernel/tboot.c
19591 +++ b/arch/x86/kernel/tboot.c
19592 @@ -220,7 +220,7 @@ static int tboot_setup_sleep(void)
19593
19594 void tboot_shutdown(u32 shutdown_type)
19595 {
19596 - void (*shutdown)(void);
19597 + void (* __noreturn shutdown)(void);
19598
19599 if (!tboot_enabled())
19600 return;
19601 @@ -242,7 +242,7 @@ void tboot_shutdown(u32 shutdown_type)
19602
19603 switch_to_tboot_pt();
19604
19605 - shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
19606 + shutdown = (void *)tboot->shutdown_entry;
19607 shutdown();
19608
19609 /* should not reach here */
19610 @@ -300,7 +300,7 @@ static int tboot_sleep(u8 sleep_state, u32 pm1a_control, u32 pm1b_control)
19611 return 0;
19612 }
19613
19614 -static atomic_t ap_wfs_count;
19615 +static atomic_unchecked_t ap_wfs_count;
19616
19617 static int tboot_wait_for_aps(int num_aps)
19618 {
19619 @@ -324,9 +324,9 @@ static int __cpuinit tboot_cpu_callback(struct notifier_block *nfb,
19620 {
19621 switch (action) {
19622 case CPU_DYING:
19623 - atomic_inc(&ap_wfs_count);
19624 + atomic_inc_unchecked(&ap_wfs_count);
19625 if (num_online_cpus() == 1)
19626 - if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
19627 + if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
19628 return NOTIFY_BAD;
19629 break;
19630 }
19631 @@ -345,7 +345,7 @@ static __init int tboot_late_init(void)
19632
19633 tboot_create_trampoline();
19634
19635 - atomic_set(&ap_wfs_count, 0);
19636 + atomic_set_unchecked(&ap_wfs_count, 0);
19637 register_hotcpu_notifier(&tboot_cpu_notifier);
19638
19639 acpi_os_set_prepare_sleep(&tboot_sleep);
19640 diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c
19641 index 24d3c91..d06b473 100644
19642 --- a/arch/x86/kernel/time.c
19643 +++ b/arch/x86/kernel/time.c
19644 @@ -30,9 +30,9 @@ unsigned long profile_pc(struct pt_regs *regs)
19645 {
19646 unsigned long pc = instruction_pointer(regs);
19647
19648 - if (!user_mode_vm(regs) && in_lock_functions(pc)) {
19649 + if (!user_mode(regs) && in_lock_functions(pc)) {
19650 #ifdef CONFIG_FRAME_POINTER
19651 - return *(unsigned long *)(regs->bp + sizeof(long));
19652 + return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
19653 #else
19654 unsigned long *sp =
19655 (unsigned long *)kernel_stack_pointer(regs);
19656 @@ -41,11 +41,17 @@ unsigned long profile_pc(struct pt_regs *regs)
19657 * or above a saved flags. Eflags has bits 22-31 zero,
19658 * kernel addresses don't.
19659 */
19660 +
19661 +#ifdef CONFIG_PAX_KERNEXEC
19662 + return ktla_ktva(sp[0]);
19663 +#else
19664 if (sp[0] >> 22)
19665 return sp[0];
19666 if (sp[1] >> 22)
19667 return sp[1];
19668 #endif
19669 +
19670 +#endif
19671 }
19672 return pc;
19673 }
19674 diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
19675 index 9d9d2f9..ed344e4 100644
19676 --- a/arch/x86/kernel/tls.c
19677 +++ b/arch/x86/kernel/tls.c
19678 @@ -84,6 +84,11 @@ int do_set_thread_area(struct task_struct *p, int idx,
19679 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
19680 return -EINVAL;
19681
19682 +#ifdef CONFIG_PAX_SEGMEXEC
19683 + if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
19684 + return -EINVAL;
19685 +#endif
19686 +
19687 set_tls_desc(p, idx, &info, 1);
19688
19689 return 0;
19690 diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
19691 index 05b31d9..501d3ba 100644
19692 --- a/arch/x86/kernel/traps.c
19693 +++ b/arch/x86/kernel/traps.c
19694 @@ -67,12 +67,6 @@ asmlinkage int system_call(void);
19695
19696 /* Do we ignore FPU interrupts ? */
19697 char ignore_fpu_irq;
19698 -
19699 -/*
19700 - * The IDT has to be page-aligned to simplify the Pentium
19701 - * F0 0F bug workaround.
19702 - */
19703 -gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
19704 #endif
19705
19706 DECLARE_BITMAP(used_vectors, NR_VECTORS);
19707 @@ -105,13 +99,13 @@ static inline void preempt_conditional_cli(struct pt_regs *regs)
19708 }
19709
19710 static void __kprobes
19711 -do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
19712 +do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
19713 long error_code, siginfo_t *info)
19714 {
19715 struct task_struct *tsk = current;
19716
19717 #ifdef CONFIG_X86_32
19718 - if (regs->flags & X86_VM_MASK) {
19719 + if (v8086_mode(regs)) {
19720 /*
19721 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
19722 * On nmi (interrupt 2), do_trap should not be called.
19723 @@ -122,7 +116,7 @@ do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
19724 }
19725 #endif
19726
19727 - if (!user_mode(regs))
19728 + if (!user_mode_novm(regs))
19729 goto kernel_trap;
19730
19731 #ifdef CONFIG_X86_32
19732 @@ -145,7 +139,7 @@ trap_signal:
19733 printk_ratelimit()) {
19734 printk(KERN_INFO
19735 "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
19736 - tsk->comm, tsk->pid, str,
19737 + tsk->comm, task_pid_nr(tsk), str,
19738 regs->ip, regs->sp, error_code);
19739 print_vma_addr(" in ", regs->ip);
19740 printk("\n");
19741 @@ -162,8 +156,20 @@ kernel_trap:
19742 if (!fixup_exception(regs)) {
19743 tsk->thread.error_code = error_code;
19744 tsk->thread.trap_nr = trapnr;
19745 +
19746 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
19747 + if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
19748 + str = "PAX: suspicious stack segment fault";
19749 +#endif
19750 +
19751 die(str, regs, error_code);
19752 }
19753 +
19754 +#ifdef CONFIG_PAX_REFCOUNT
19755 + if (trapnr == 4)
19756 + pax_report_refcount_overflow(regs);
19757 +#endif
19758 +
19759 return;
19760
19761 #ifdef CONFIG_X86_32
19762 @@ -256,14 +262,30 @@ do_general_protection(struct pt_regs *regs, long error_code)
19763 conditional_sti(regs);
19764
19765 #ifdef CONFIG_X86_32
19766 - if (regs->flags & X86_VM_MASK)
19767 + if (v8086_mode(regs))
19768 goto gp_in_vm86;
19769 #endif
19770
19771 tsk = current;
19772 - if (!user_mode(regs))
19773 + if (!user_mode_novm(regs))
19774 goto gp_in_kernel;
19775
19776 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
19777 + if (!(__supported_pte_mask & _PAGE_NX) && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
19778 + struct mm_struct *mm = tsk->mm;
19779 + unsigned long limit;
19780 +
19781 + down_write(&mm->mmap_sem);
19782 + limit = mm->context.user_cs_limit;
19783 + if (limit < TASK_SIZE) {
19784 + track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
19785 + up_write(&mm->mmap_sem);
19786 + return;
19787 + }
19788 + up_write(&mm->mmap_sem);
19789 + }
19790 +#endif
19791 +
19792 tsk->thread.error_code = error_code;
19793 tsk->thread.trap_nr = X86_TRAP_GP;
19794
19795 @@ -296,6 +318,13 @@ gp_in_kernel:
19796 if (notify_die(DIE_GPF, "general protection fault", regs, error_code,
19797 X86_TRAP_GP, SIGSEGV) == NOTIFY_STOP)
19798 return;
19799 +
19800 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
19801 + if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
19802 + die("PAX: suspicious general protection fault", regs, error_code);
19803 + else
19804 +#endif
19805 +
19806 die("general protection fault", regs, error_code);
19807 }
19808
19809 @@ -431,7 +460,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
19810 /* It's safe to allow irq's after DR6 has been saved */
19811 preempt_conditional_sti(regs);
19812
19813 - if (regs->flags & X86_VM_MASK) {
19814 + if (v8086_mode(regs)) {
19815 handle_vm86_trap((struct kernel_vm86_regs *) regs, error_code,
19816 X86_TRAP_DB);
19817 preempt_conditional_cli(regs);
19818 @@ -446,7 +475,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
19819 * We already checked v86 mode above, so we can check for kernel mode
19820 * by just checking the CPL of CS.
19821 */
19822 - if ((dr6 & DR_STEP) && !user_mode(regs)) {
19823 + if ((dr6 & DR_STEP) && !user_mode_novm(regs)) {
19824 tsk->thread.debugreg6 &= ~DR_STEP;
19825 set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
19826 regs->flags &= ~X86_EFLAGS_TF;
19827 @@ -477,7 +506,7 @@ void math_error(struct pt_regs *regs, int error_code, int trapnr)
19828 return;
19829 conditional_sti(regs);
19830
19831 - if (!user_mode_vm(regs))
19832 + if (!user_mode(regs))
19833 {
19834 if (!fixup_exception(regs)) {
19835 task->thread.error_code = error_code;
19836 diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
19837 index dc4e910..c9dedab 100644
19838 --- a/arch/x86/kernel/uprobes.c
19839 +++ b/arch/x86/kernel/uprobes.c
19840 @@ -606,7 +606,7 @@ int arch_uprobe_exception_notify(struct notifier_block *self, unsigned long val,
19841 int ret = NOTIFY_DONE;
19842
19843 /* We are only interested in userspace traps */
19844 - if (regs && !user_mode_vm(regs))
19845 + if (regs && !user_mode(regs))
19846 return NOTIFY_DONE;
19847
19848 switch (val) {
19849 diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S
19850 index b9242ba..50c5edd 100644
19851 --- a/arch/x86/kernel/verify_cpu.S
19852 +++ b/arch/x86/kernel/verify_cpu.S
19853 @@ -20,6 +20,7 @@
19854 * arch/x86/boot/compressed/head_64.S: Boot cpu verification
19855 * arch/x86/kernel/trampoline_64.S: secondary processor verification
19856 * arch/x86/kernel/head_32.S: processor startup
19857 + * arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume
19858 *
19859 * verify_cpu, returns the status of longmode and SSE in register %eax.
19860 * 0: Success 1: Failure
19861 diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
19862 index 255f58a..5e91150 100644
19863 --- a/arch/x86/kernel/vm86_32.c
19864 +++ b/arch/x86/kernel/vm86_32.c
19865 @@ -41,6 +41,7 @@
19866 #include <linux/ptrace.h>
19867 #include <linux/audit.h>
19868 #include <linux/stddef.h>
19869 +#include <linux/grsecurity.h>
19870
19871 #include <asm/uaccess.h>
19872 #include <asm/io.h>
19873 @@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct kernel_vm86_regs *regs)
19874 do_exit(SIGSEGV);
19875 }
19876
19877 - tss = &per_cpu(init_tss, get_cpu());
19878 + tss = init_tss + get_cpu();
19879 current->thread.sp0 = current->thread.saved_sp0;
19880 current->thread.sysenter_cs = __KERNEL_CS;
19881 load_sp0(tss, &current->thread);
19882 @@ -210,6 +211,13 @@ int sys_vm86old(struct vm86_struct __user *v86, struct pt_regs *regs)
19883 struct task_struct *tsk;
19884 int tmp, ret = -EPERM;
19885
19886 +#ifdef CONFIG_GRKERNSEC_VM86
19887 + if (!capable(CAP_SYS_RAWIO)) {
19888 + gr_handle_vm86();
19889 + goto out;
19890 + }
19891 +#endif
19892 +
19893 tsk = current;
19894 if (tsk->thread.saved_sp0)
19895 goto out;
19896 @@ -240,6 +248,14 @@ int sys_vm86(unsigned long cmd, unsigned long arg, struct pt_regs *regs)
19897 int tmp, ret;
19898 struct vm86plus_struct __user *v86;
19899
19900 +#ifdef CONFIG_GRKERNSEC_VM86
19901 + if (!capable(CAP_SYS_RAWIO)) {
19902 + gr_handle_vm86();
19903 + ret = -EPERM;
19904 + goto out;
19905 + }
19906 +#endif
19907 +
19908 tsk = current;
19909 switch (cmd) {
19910 case VM86_REQUEST_IRQ:
19911 @@ -326,7 +342,7 @@ static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk
19912 tsk->thread.saved_fs = info->regs32->fs;
19913 tsk->thread.saved_gs = get_user_gs(info->regs32);
19914
19915 - tss = &per_cpu(init_tss, get_cpu());
19916 + tss = init_tss + get_cpu();
19917 tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
19918 if (cpu_has_sep)
19919 tsk->thread.sysenter_cs = 0;
19920 @@ -533,7 +549,7 @@ static void do_int(struct kernel_vm86_regs *regs, int i,
19921 goto cannot_handle;
19922 if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
19923 goto cannot_handle;
19924 - intr_ptr = (unsigned long __user *) (i << 2);
19925 + intr_ptr = (__force unsigned long __user *) (i << 2);
19926 if (get_user(segoffs, intr_ptr))
19927 goto cannot_handle;
19928 if ((segoffs >> 16) == BIOSSEG)
19929 diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
19930 index 22a1530..8fbaaad 100644
19931 --- a/arch/x86/kernel/vmlinux.lds.S
19932 +++ b/arch/x86/kernel/vmlinux.lds.S
19933 @@ -26,6 +26,13 @@
19934 #include <asm/page_types.h>
19935 #include <asm/cache.h>
19936 #include <asm/boot.h>
19937 +#include <asm/segment.h>
19938 +
19939 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
19940 +#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
19941 +#else
19942 +#define __KERNEL_TEXT_OFFSET 0
19943 +#endif
19944
19945 #undef i386 /* in case the preprocessor is a 32bit one */
19946
19947 @@ -69,30 +76,43 @@ jiffies_64 = jiffies;
19948
19949 PHDRS {
19950 text PT_LOAD FLAGS(5); /* R_E */
19951 +#ifdef CONFIG_X86_32
19952 + module PT_LOAD FLAGS(5); /* R_E */
19953 +#endif
19954 +#ifdef CONFIG_XEN
19955 + rodata PT_LOAD FLAGS(5); /* R_E */
19956 +#else
19957 + rodata PT_LOAD FLAGS(4); /* R__ */
19958 +#endif
19959 data PT_LOAD FLAGS(6); /* RW_ */
19960 -#ifdef CONFIG_X86_64
19961 + init.begin PT_LOAD FLAGS(6); /* RW_ */
19962 #ifdef CONFIG_SMP
19963 percpu PT_LOAD FLAGS(6); /* RW_ */
19964 #endif
19965 + text.init PT_LOAD FLAGS(5); /* R_E */
19966 + text.exit PT_LOAD FLAGS(5); /* R_E */
19967 init PT_LOAD FLAGS(7); /* RWE */
19968 -#endif
19969 note PT_NOTE FLAGS(0); /* ___ */
19970 }
19971
19972 SECTIONS
19973 {
19974 #ifdef CONFIG_X86_32
19975 - . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
19976 - phys_startup_32 = startup_32 - LOAD_OFFSET;
19977 + . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
19978 #else
19979 - . = __START_KERNEL;
19980 - phys_startup_64 = startup_64 - LOAD_OFFSET;
19981 + . = __START_KERNEL;
19982 #endif
19983
19984 /* Text and read-only data */
19985 - .text : AT(ADDR(.text) - LOAD_OFFSET) {
19986 - _text = .;
19987 + .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
19988 /* bootstrapping code */
19989 +#ifdef CONFIG_X86_32
19990 + phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
19991 +#else
19992 + phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
19993 +#endif
19994 + __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
19995 + _text = .;
19996 HEAD_TEXT
19997 #ifdef CONFIG_X86_32
19998 . = ALIGN(PAGE_SIZE);
19999 @@ -108,13 +128,48 @@ SECTIONS
20000 IRQENTRY_TEXT
20001 *(.fixup)
20002 *(.gnu.warning)
20003 - /* End of text section */
20004 - _etext = .;
20005 } :text = 0x9090
20006
20007 - NOTES :text :note
20008 + . += __KERNEL_TEXT_OFFSET;
20009
20010 - EXCEPTION_TABLE(16) :text = 0x9090
20011 +#ifdef CONFIG_X86_32
20012 + . = ALIGN(PAGE_SIZE);
20013 + .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
20014 +
20015 +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
20016 + MODULES_EXEC_VADDR = .;
20017 + BYTE(0)
20018 + . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
20019 + . = ALIGN(HPAGE_SIZE) - 1;
20020 + MODULES_EXEC_END = .;
20021 +#endif
20022 +
20023 + } :module
20024 +#endif
20025 +
20026 + .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
20027 + /* End of text section */
20028 + BYTE(0)
20029 + _etext = . - __KERNEL_TEXT_OFFSET;
20030 + }
20031 +
20032 +#ifdef CONFIG_X86_32
20033 + . = ALIGN(PAGE_SIZE);
20034 + .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
20035 + *(.idt)
20036 + . = ALIGN(PAGE_SIZE);
20037 + *(.empty_zero_page)
20038 + *(.initial_pg_fixmap)
20039 + *(.initial_pg_pmd)
20040 + *(.initial_page_table)
20041 + *(.swapper_pg_dir)
20042 + } :rodata
20043 +#endif
20044 +
20045 + . = ALIGN(PAGE_SIZE);
20046 + NOTES :rodata :note
20047 +
20048 + EXCEPTION_TABLE(16) :rodata
20049
20050 #if defined(CONFIG_DEBUG_RODATA)
20051 /* .text should occupy whole number of pages */
20052 @@ -126,16 +181,20 @@ SECTIONS
20053
20054 /* Data */
20055 .data : AT(ADDR(.data) - LOAD_OFFSET) {
20056 +
20057 +#ifdef CONFIG_PAX_KERNEXEC
20058 + . = ALIGN(HPAGE_SIZE);
20059 +#else
20060 + . = ALIGN(PAGE_SIZE);
20061 +#endif
20062 +
20063 /* Start of data section */
20064 _sdata = .;
20065
20066 /* init_task */
20067 INIT_TASK_DATA(THREAD_SIZE)
20068
20069 -#ifdef CONFIG_X86_32
20070 - /* 32 bit has nosave before _edata */
20071 NOSAVE_DATA
20072 -#endif
20073
20074 PAGE_ALIGNED_DATA(PAGE_SIZE)
20075
20076 @@ -176,12 +235,19 @@ SECTIONS
20077 #endif /* CONFIG_X86_64 */
20078
20079 /* Init code and data - will be freed after init */
20080 - . = ALIGN(PAGE_SIZE);
20081 .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
20082 + BYTE(0)
20083 +
20084 +#ifdef CONFIG_PAX_KERNEXEC
20085 + . = ALIGN(HPAGE_SIZE);
20086 +#else
20087 + . = ALIGN(PAGE_SIZE);
20088 +#endif
20089 +
20090 __init_begin = .; /* paired with __init_end */
20091 - }
20092 + } :init.begin
20093
20094 -#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
20095 +#ifdef CONFIG_SMP
20096 /*
20097 * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
20098 * output PHDR, so the next output section - .init.text - should
20099 @@ -190,12 +256,27 @@ SECTIONS
20100 PERCPU_VADDR(INTERNODE_CACHE_BYTES, 0, :percpu)
20101 #endif
20102
20103 - INIT_TEXT_SECTION(PAGE_SIZE)
20104 -#ifdef CONFIG_X86_64
20105 - :init
20106 -#endif
20107 + . = ALIGN(PAGE_SIZE);
20108 + init_begin = .;
20109 + .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
20110 + VMLINUX_SYMBOL(_sinittext) = .;
20111 + INIT_TEXT
20112 + VMLINUX_SYMBOL(_einittext) = .;
20113 + . = ALIGN(PAGE_SIZE);
20114 + } :text.init
20115
20116 - INIT_DATA_SECTION(16)
20117 + /*
20118 + * .exit.text is discard at runtime, not link time, to deal with
20119 + * references from .altinstructions and .eh_frame
20120 + */
20121 + .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
20122 + EXIT_TEXT
20123 + . = ALIGN(16);
20124 + } :text.exit
20125 + . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
20126 +
20127 + . = ALIGN(PAGE_SIZE);
20128 + INIT_DATA_SECTION(16) :init
20129
20130 .x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
20131 __x86_cpu_dev_start = .;
20132 @@ -257,19 +338,12 @@ SECTIONS
20133 }
20134
20135 . = ALIGN(8);
20136 - /*
20137 - * .exit.text is discard at runtime, not link time, to deal with
20138 - * references from .altinstructions and .eh_frame
20139 - */
20140 - .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
20141 - EXIT_TEXT
20142 - }
20143
20144 .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
20145 EXIT_DATA
20146 }
20147
20148 -#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
20149 +#ifndef CONFIG_SMP
20150 PERCPU_SECTION(INTERNODE_CACHE_BYTES)
20151 #endif
20152
20153 @@ -288,16 +362,10 @@ SECTIONS
20154 .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
20155 __smp_locks = .;
20156 *(.smp_locks)
20157 - . = ALIGN(PAGE_SIZE);
20158 __smp_locks_end = .;
20159 + . = ALIGN(PAGE_SIZE);
20160 }
20161
20162 -#ifdef CONFIG_X86_64
20163 - .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
20164 - NOSAVE_DATA
20165 - }
20166 -#endif
20167 -
20168 /* BSS */
20169 . = ALIGN(PAGE_SIZE);
20170 .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
20171 @@ -313,6 +381,7 @@ SECTIONS
20172 __brk_base = .;
20173 . += 64 * 1024; /* 64k alignment slop space */
20174 *(.brk_reservation) /* areas brk users have reserved */
20175 + . = ALIGN(HPAGE_SIZE);
20176 __brk_limit = .;
20177 }
20178
20179 @@ -339,13 +408,12 @@ SECTIONS
20180 * for the boot processor.
20181 */
20182 #define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
20183 -INIT_PER_CPU(gdt_page);
20184 INIT_PER_CPU(irq_stack_union);
20185
20186 /*
20187 * Build-time check on the image size:
20188 */
20189 -. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
20190 +. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
20191 "kernel image bigger than KERNEL_IMAGE_SIZE");
20192
20193 #ifdef CONFIG_SMP
20194 diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c
20195 index 5db36ca..2938af9 100644
20196 --- a/arch/x86/kernel/vsyscall_64.c
20197 +++ b/arch/x86/kernel/vsyscall_64.c
20198 @@ -54,15 +54,13 @@
20199 DEFINE_VVAR(int, vgetcpu_mode);
20200 DEFINE_VVAR(struct vsyscall_gtod_data, vsyscall_gtod_data);
20201
20202 -static enum { EMULATE, NATIVE, NONE } vsyscall_mode = EMULATE;
20203 +static enum { EMULATE, NONE } vsyscall_mode = EMULATE;
20204
20205 static int __init vsyscall_setup(char *str)
20206 {
20207 if (str) {
20208 if (!strcmp("emulate", str))
20209 vsyscall_mode = EMULATE;
20210 - else if (!strcmp("native", str))
20211 - vsyscall_mode = NATIVE;
20212 else if (!strcmp("none", str))
20213 vsyscall_mode = NONE;
20214 else
20215 @@ -309,8 +307,7 @@ done:
20216 return true;
20217
20218 sigsegv:
20219 - force_sig(SIGSEGV, current);
20220 - return true;
20221 + do_group_exit(SIGKILL);
20222 }
20223
20224 /*
20225 @@ -363,10 +360,7 @@ void __init map_vsyscall(void)
20226 extern char __vvar_page;
20227 unsigned long physaddr_vvar_page = __pa_symbol(&__vvar_page);
20228
20229 - __set_fixmap(VSYSCALL_FIRST_PAGE, physaddr_vsyscall,
20230 - vsyscall_mode == NATIVE
20231 - ? PAGE_KERNEL_VSYSCALL
20232 - : PAGE_KERNEL_VVAR);
20233 + __set_fixmap(VSYSCALL_FIRST_PAGE, physaddr_vsyscall, PAGE_KERNEL_VVAR);
20234 BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_FIRST_PAGE) !=
20235 (unsigned long)VSYSCALL_START);
20236
20237 diff --git a/arch/x86/kernel/x8664_ksyms_64.c b/arch/x86/kernel/x8664_ksyms_64.c
20238 index 9796c2f..f686fbf 100644
20239 --- a/arch/x86/kernel/x8664_ksyms_64.c
20240 +++ b/arch/x86/kernel/x8664_ksyms_64.c
20241 @@ -29,8 +29,6 @@ EXPORT_SYMBOL(__put_user_8);
20242 EXPORT_SYMBOL(copy_user_generic_string);
20243 EXPORT_SYMBOL(copy_user_generic_unrolled);
20244 EXPORT_SYMBOL(__copy_user_nocache);
20245 -EXPORT_SYMBOL(_copy_from_user);
20246 -EXPORT_SYMBOL(_copy_to_user);
20247
20248 EXPORT_SYMBOL(copy_page);
20249 EXPORT_SYMBOL(clear_page);
20250 diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
20251 index bd18149..2ea0183 100644
20252 --- a/arch/x86/kernel/xsave.c
20253 +++ b/arch/x86/kernel/xsave.c
20254 @@ -129,7 +129,7 @@ int check_for_xstate(struct i387_fxsave_struct __user *buf,
20255 fx_sw_user->xstate_size > fx_sw_user->extended_size)
20256 return -EINVAL;
20257
20258 - err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
20259 + err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
20260 fx_sw_user->extended_size -
20261 FP_XSTATE_MAGIC2_SIZE));
20262 if (err)
20263 @@ -265,7 +265,7 @@ fx_only:
20264 * the other extended state.
20265 */
20266 xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
20267 - return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
20268 + return fxrstor_checking((struct i387_fxsave_struct __force_kernel *)buf);
20269 }
20270
20271 /*
20272 @@ -294,7 +294,7 @@ int restore_i387_xstate(void __user *buf)
20273 if (use_xsave())
20274 err = restore_user_xstate(buf);
20275 else
20276 - err = fxrstor_checking((__force struct i387_fxsave_struct *)
20277 + err = fxrstor_checking((struct i387_fxsave_struct __force_kernel *)
20278 buf);
20279 if (unlikely(err)) {
20280 /*
20281 diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
20282 index 7df1c6d..9ea7c79 100644
20283 --- a/arch/x86/kvm/cpuid.c
20284 +++ b/arch/x86/kvm/cpuid.c
20285 @@ -124,15 +124,20 @@ int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
20286 struct kvm_cpuid2 *cpuid,
20287 struct kvm_cpuid_entry2 __user *entries)
20288 {
20289 - int r;
20290 + int r, i;
20291
20292 r = -E2BIG;
20293 if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
20294 goto out;
20295 r = -EFAULT;
20296 - if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
20297 - cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
20298 + if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
20299 goto out;
20300 + for (i = 0; i < cpuid->nent; ++i) {
20301 + struct kvm_cpuid_entry2 cpuid_entry;
20302 + if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
20303 + goto out;
20304 + vcpu->arch.cpuid_entries[i] = cpuid_entry;
20305 + }
20306 vcpu->arch.cpuid_nent = cpuid->nent;
20307 kvm_apic_set_version(vcpu);
20308 kvm_x86_ops->cpuid_update(vcpu);
20309 @@ -147,15 +152,19 @@ int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
20310 struct kvm_cpuid2 *cpuid,
20311 struct kvm_cpuid_entry2 __user *entries)
20312 {
20313 - int r;
20314 + int r, i;
20315
20316 r = -E2BIG;
20317 if (cpuid->nent < vcpu->arch.cpuid_nent)
20318 goto out;
20319 r = -EFAULT;
20320 - if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
20321 - vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
20322 + if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
20323 goto out;
20324 + for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
20325 + struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
20326 + if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
20327 + goto out;
20328 + }
20329 return 0;
20330
20331 out:
20332 diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
20333 index 4837375..2cc9722 100644
20334 --- a/arch/x86/kvm/emulate.c
20335 +++ b/arch/x86/kvm/emulate.c
20336 @@ -256,6 +256,7 @@ struct gprefix {
20337
20338 #define ____emulate_2op(ctxt, _op, _x, _y, _suffix, _dsttype) \
20339 do { \
20340 + unsigned long _tmp; \
20341 __asm__ __volatile__ ( \
20342 _PRE_EFLAGS("0", "4", "2") \
20343 _op _suffix " %"_x"3,%1; " \
20344 @@ -270,8 +271,6 @@ struct gprefix {
20345 /* Raw emulation: instruction has two explicit operands. */
20346 #define __emulate_2op_nobyte(ctxt,_op,_wx,_wy,_lx,_ly,_qx,_qy) \
20347 do { \
20348 - unsigned long _tmp; \
20349 - \
20350 switch ((ctxt)->dst.bytes) { \
20351 case 2: \
20352 ____emulate_2op(ctxt,_op,_wx,_wy,"w",u16); \
20353 @@ -287,7 +286,6 @@ struct gprefix {
20354
20355 #define __emulate_2op(ctxt,_op,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
20356 do { \
20357 - unsigned long _tmp; \
20358 switch ((ctxt)->dst.bytes) { \
20359 case 1: \
20360 ____emulate_2op(ctxt,_op,_bx,_by,"b",u8); \
20361 diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
20362 index 93c1574..d6097dc 100644
20363 --- a/arch/x86/kvm/lapic.c
20364 +++ b/arch/x86/kvm/lapic.c
20365 @@ -54,7 +54,7 @@
20366 #define APIC_BUS_CYCLE_NS 1
20367
20368 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
20369 -#define apic_debug(fmt, arg...)
20370 +#define apic_debug(fmt, arg...) do {} while (0)
20371
20372 #define APIC_LVT_NUM 6
20373 /* 14 is the version for Xeon and Pentium 8.4.8*/
20374 diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
20375 index 34f9709..8eca2d5 100644
20376 --- a/arch/x86/kvm/paging_tmpl.h
20377 +++ b/arch/x86/kvm/paging_tmpl.h
20378 @@ -197,7 +197,7 @@ retry_walk:
20379 if (unlikely(kvm_is_error_hva(host_addr)))
20380 goto error;
20381
20382 - ptep_user = (pt_element_t __user *)((void *)host_addr + offset);
20383 + ptep_user = (pt_element_t __force_user *)((void *)host_addr + offset);
20384 if (unlikely(__copy_from_user(&pte, ptep_user, sizeof(pte))))
20385 goto error;
20386
20387 diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
20388 index f75af40..285b18f 100644
20389 --- a/arch/x86/kvm/svm.c
20390 +++ b/arch/x86/kvm/svm.c
20391 @@ -3516,7 +3516,11 @@ static void reload_tss(struct kvm_vcpu *vcpu)
20392 int cpu = raw_smp_processor_id();
20393
20394 struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
20395 +
20396 + pax_open_kernel();
20397 sd->tss_desc->type = 9; /* available 32/64-bit TSS */
20398 + pax_close_kernel();
20399 +
20400 load_TR_desc();
20401 }
20402
20403 @@ -3894,6 +3898,10 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
20404 #endif
20405 #endif
20406
20407 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
20408 + __set_fs(current_thread_info()->addr_limit);
20409 +#endif
20410 +
20411 reload_tss(vcpu);
20412
20413 local_irq_disable();
20414 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
20415 index 86c8704..e8ee2ac 100644
20416 --- a/arch/x86/kvm/vmx.c
20417 +++ b/arch/x86/kvm/vmx.c
20418 @@ -1317,7 +1317,11 @@ static void reload_tss(void)
20419 struct desc_struct *descs;
20420
20421 descs = (void *)gdt->address;
20422 +
20423 + pax_open_kernel();
20424 descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
20425 + pax_close_kernel();
20426 +
20427 load_TR_desc();
20428 }
20429
20430 @@ -2650,8 +2654,11 @@ static __init int hardware_setup(void)
20431 if (!cpu_has_vmx_flexpriority())
20432 flexpriority_enabled = 0;
20433
20434 - if (!cpu_has_vmx_tpr_shadow())
20435 - kvm_x86_ops->update_cr8_intercept = NULL;
20436 + if (!cpu_has_vmx_tpr_shadow()) {
20437 + pax_open_kernel();
20438 + *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
20439 + pax_close_kernel();
20440 + }
20441
20442 if (enable_ept && !cpu_has_vmx_ept_2m_page())
20443 kvm_disable_largepages();
20444 @@ -3719,7 +3726,7 @@ static void vmx_set_constant_host_state(void)
20445 vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
20446
20447 asm("mov $.Lkvm_vmx_return, %0" : "=r"(tmpl));
20448 - vmcs_writel(HOST_RIP, tmpl); /* 22.2.5 */
20449 + vmcs_writel(HOST_RIP, ktla_ktva(tmpl)); /* 22.2.5 */
20450
20451 rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
20452 vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
20453 @@ -6257,6 +6264,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
20454 "jmp .Lkvm_vmx_return \n\t"
20455 ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
20456 ".Lkvm_vmx_return: "
20457 +
20458 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
20459 + "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
20460 + ".Lkvm_vmx_return2: "
20461 +#endif
20462 +
20463 /* Save guest registers, load host registers, keep flags */
20464 "mov %0, %c[wordsize](%%"R"sp) \n\t"
20465 "pop %0 \n\t"
20466 @@ -6305,6 +6318,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
20467 #endif
20468 [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
20469 [wordsize]"i"(sizeof(ulong))
20470 +
20471 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
20472 + ,[cs]"i"(__KERNEL_CS)
20473 +#endif
20474 +
20475 : "cc", "memory"
20476 , R"ax", R"bx", R"di", R"si"
20477 #ifdef CONFIG_X86_64
20478 @@ -6312,7 +6330,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
20479 #endif
20480 );
20481
20482 -#ifndef CONFIG_X86_64
20483 +#ifdef CONFIG_X86_32
20484 /*
20485 * The sysexit path does not restore ds/es, so we must set them to
20486 * a reasonable value ourselves.
20487 @@ -6321,8 +6339,18 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
20488 * may be executed in interrupt context, which saves and restore segments
20489 * around it, nullifying its effect.
20490 */
20491 - loadsegment(ds, __USER_DS);
20492 - loadsegment(es, __USER_DS);
20493 + loadsegment(ds, __KERNEL_DS);
20494 + loadsegment(es, __KERNEL_DS);
20495 + loadsegment(ss, __KERNEL_DS);
20496 +
20497 +#ifdef CONFIG_PAX_KERNEXEC
20498 + loadsegment(fs, __KERNEL_PERCPU);
20499 +#endif
20500 +
20501 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20502 + __set_fs(current_thread_info()->addr_limit);
20503 +#endif
20504 +
20505 #endif
20506
20507 vcpu->arch.regs_avail = ~((1 << VCPU_REGS_RIP) | (1 << VCPU_REGS_RSP)
20508 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
20509 index 14c290d..0dae6e5 100644
20510 --- a/arch/x86/kvm/x86.c
20511 +++ b/arch/x86/kvm/x86.c
20512 @@ -1361,8 +1361,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
20513 {
20514 struct kvm *kvm = vcpu->kvm;
20515 int lm = is_long_mode(vcpu);
20516 - u8 *blob_addr = lm ? (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_64
20517 - : (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_32;
20518 + u8 __user *blob_addr = lm ? (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_64
20519 + : (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_32;
20520 u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
20521 : kvm->arch.xen_hvm_config.blob_size_32;
20522 u32 page_num = data & ~PAGE_MASK;
20523 @@ -2218,6 +2218,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
20524 if (n < msr_list.nmsrs)
20525 goto out;
20526 r = -EFAULT;
20527 + if (num_msrs_to_save > ARRAY_SIZE(msrs_to_save))
20528 + goto out;
20529 if (copy_to_user(user_msr_list->indices, &msrs_to_save,
20530 num_msrs_to_save * sizeof(u32)))
20531 goto out;
20532 @@ -2343,7 +2345,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
20533 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
20534 struct kvm_interrupt *irq)
20535 {
20536 - if (irq->irq < 0 || irq->irq >= 256)
20537 + if (irq->irq >= 256)
20538 return -EINVAL;
20539 if (irqchip_in_kernel(vcpu->kvm))
20540 return -ENXIO;
20541 @@ -4880,7 +4882,7 @@ static void kvm_set_mmio_spte_mask(void)
20542 kvm_mmu_set_mmio_spte_mask(mask);
20543 }
20544
20545 -int kvm_arch_init(void *opaque)
20546 +int kvm_arch_init(const void *opaque)
20547 {
20548 int r;
20549 struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
20550 diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
20551 index 642d880..44e0f3f 100644
20552 --- a/arch/x86/lguest/boot.c
20553 +++ b/arch/x86/lguest/boot.c
20554 @@ -1200,9 +1200,10 @@ static __init int early_put_chars(u32 vtermno, const char *buf, int count)
20555 * Rebooting also tells the Host we're finished, but the RESTART flag tells the
20556 * Launcher to reboot us.
20557 */
20558 -static void lguest_restart(char *reason)
20559 +static __noreturn void lguest_restart(char *reason)
20560 {
20561 hcall(LHCALL_SHUTDOWN, __pa(reason), LGUEST_SHUTDOWN_RESTART, 0, 0);
20562 + BUG();
20563 }
20564
20565 /*G:050
20566 diff --git a/arch/x86/lib/atomic64_386_32.S b/arch/x86/lib/atomic64_386_32.S
20567 index 00933d5..3a64af9 100644
20568 --- a/arch/x86/lib/atomic64_386_32.S
20569 +++ b/arch/x86/lib/atomic64_386_32.S
20570 @@ -48,6 +48,10 @@ BEGIN(read)
20571 movl (v), %eax
20572 movl 4(v), %edx
20573 RET_ENDP
20574 +BEGIN(read_unchecked)
20575 + movl (v), %eax
20576 + movl 4(v), %edx
20577 +RET_ENDP
20578 #undef v
20579
20580 #define v %esi
20581 @@ -55,6 +59,10 @@ BEGIN(set)
20582 movl %ebx, (v)
20583 movl %ecx, 4(v)
20584 RET_ENDP
20585 +BEGIN(set_unchecked)
20586 + movl %ebx, (v)
20587 + movl %ecx, 4(v)
20588 +RET_ENDP
20589 #undef v
20590
20591 #define v %esi
20592 @@ -70,6 +78,20 @@ RET_ENDP
20593 BEGIN(add)
20594 addl %eax, (v)
20595 adcl %edx, 4(v)
20596 +
20597 +#ifdef CONFIG_PAX_REFCOUNT
20598 + jno 0f
20599 + subl %eax, (v)
20600 + sbbl %edx, 4(v)
20601 + int $4
20602 +0:
20603 + _ASM_EXTABLE(0b, 0b)
20604 +#endif
20605 +
20606 +RET_ENDP
20607 +BEGIN(add_unchecked)
20608 + addl %eax, (v)
20609 + adcl %edx, 4(v)
20610 RET_ENDP
20611 #undef v
20612
20613 @@ -77,6 +99,24 @@ RET_ENDP
20614 BEGIN(add_return)
20615 addl (v), %eax
20616 adcl 4(v), %edx
20617 +
20618 +#ifdef CONFIG_PAX_REFCOUNT
20619 + into
20620 +1234:
20621 + _ASM_EXTABLE(1234b, 2f)
20622 +#endif
20623 +
20624 + movl %eax, (v)
20625 + movl %edx, 4(v)
20626 +
20627 +#ifdef CONFIG_PAX_REFCOUNT
20628 +2:
20629 +#endif
20630 +
20631 +RET_ENDP
20632 +BEGIN(add_return_unchecked)
20633 + addl (v), %eax
20634 + adcl 4(v), %edx
20635 movl %eax, (v)
20636 movl %edx, 4(v)
20637 RET_ENDP
20638 @@ -86,6 +126,20 @@ RET_ENDP
20639 BEGIN(sub)
20640 subl %eax, (v)
20641 sbbl %edx, 4(v)
20642 +
20643 +#ifdef CONFIG_PAX_REFCOUNT
20644 + jno 0f
20645 + addl %eax, (v)
20646 + adcl %edx, 4(v)
20647 + int $4
20648 +0:
20649 + _ASM_EXTABLE(0b, 0b)
20650 +#endif
20651 +
20652 +RET_ENDP
20653 +BEGIN(sub_unchecked)
20654 + subl %eax, (v)
20655 + sbbl %edx, 4(v)
20656 RET_ENDP
20657 #undef v
20658
20659 @@ -96,6 +150,27 @@ BEGIN(sub_return)
20660 sbbl $0, %edx
20661 addl (v), %eax
20662 adcl 4(v), %edx
20663 +
20664 +#ifdef CONFIG_PAX_REFCOUNT
20665 + into
20666 +1234:
20667 + _ASM_EXTABLE(1234b, 2f)
20668 +#endif
20669 +
20670 + movl %eax, (v)
20671 + movl %edx, 4(v)
20672 +
20673 +#ifdef CONFIG_PAX_REFCOUNT
20674 +2:
20675 +#endif
20676 +
20677 +RET_ENDP
20678 +BEGIN(sub_return_unchecked)
20679 + negl %edx
20680 + negl %eax
20681 + sbbl $0, %edx
20682 + addl (v), %eax
20683 + adcl 4(v), %edx
20684 movl %eax, (v)
20685 movl %edx, 4(v)
20686 RET_ENDP
20687 @@ -105,6 +180,20 @@ RET_ENDP
20688 BEGIN(inc)
20689 addl $1, (v)
20690 adcl $0, 4(v)
20691 +
20692 +#ifdef CONFIG_PAX_REFCOUNT
20693 + jno 0f
20694 + subl $1, (v)
20695 + sbbl $0, 4(v)
20696 + int $4
20697 +0:
20698 + _ASM_EXTABLE(0b, 0b)
20699 +#endif
20700 +
20701 +RET_ENDP
20702 +BEGIN(inc_unchecked)
20703 + addl $1, (v)
20704 + adcl $0, 4(v)
20705 RET_ENDP
20706 #undef v
20707
20708 @@ -114,6 +203,26 @@ BEGIN(inc_return)
20709 movl 4(v), %edx
20710 addl $1, %eax
20711 adcl $0, %edx
20712 +
20713 +#ifdef CONFIG_PAX_REFCOUNT
20714 + into
20715 +1234:
20716 + _ASM_EXTABLE(1234b, 2f)
20717 +#endif
20718 +
20719 + movl %eax, (v)
20720 + movl %edx, 4(v)
20721 +
20722 +#ifdef CONFIG_PAX_REFCOUNT
20723 +2:
20724 +#endif
20725 +
20726 +RET_ENDP
20727 +BEGIN(inc_return_unchecked)
20728 + movl (v), %eax
20729 + movl 4(v), %edx
20730 + addl $1, %eax
20731 + adcl $0, %edx
20732 movl %eax, (v)
20733 movl %edx, 4(v)
20734 RET_ENDP
20735 @@ -123,6 +232,20 @@ RET_ENDP
20736 BEGIN(dec)
20737 subl $1, (v)
20738 sbbl $0, 4(v)
20739 +
20740 +#ifdef CONFIG_PAX_REFCOUNT
20741 + jno 0f
20742 + addl $1, (v)
20743 + adcl $0, 4(v)
20744 + int $4
20745 +0:
20746 + _ASM_EXTABLE(0b, 0b)
20747 +#endif
20748 +
20749 +RET_ENDP
20750 +BEGIN(dec_unchecked)
20751 + subl $1, (v)
20752 + sbbl $0, 4(v)
20753 RET_ENDP
20754 #undef v
20755
20756 @@ -132,6 +255,26 @@ BEGIN(dec_return)
20757 movl 4(v), %edx
20758 subl $1, %eax
20759 sbbl $0, %edx
20760 +
20761 +#ifdef CONFIG_PAX_REFCOUNT
20762 + into
20763 +1234:
20764 + _ASM_EXTABLE(1234b, 2f)
20765 +#endif
20766 +
20767 + movl %eax, (v)
20768 + movl %edx, 4(v)
20769 +
20770 +#ifdef CONFIG_PAX_REFCOUNT
20771 +2:
20772 +#endif
20773 +
20774 +RET_ENDP
20775 +BEGIN(dec_return_unchecked)
20776 + movl (v), %eax
20777 + movl 4(v), %edx
20778 + subl $1, %eax
20779 + sbbl $0, %edx
20780 movl %eax, (v)
20781 movl %edx, 4(v)
20782 RET_ENDP
20783 @@ -143,6 +286,13 @@ BEGIN(add_unless)
20784 adcl %edx, %edi
20785 addl (v), %eax
20786 adcl 4(v), %edx
20787 +
20788 +#ifdef CONFIG_PAX_REFCOUNT
20789 + into
20790 +1234:
20791 + _ASM_EXTABLE(1234b, 2f)
20792 +#endif
20793 +
20794 cmpl %eax, %ecx
20795 je 3f
20796 1:
20797 @@ -168,6 +318,13 @@ BEGIN(inc_not_zero)
20798 1:
20799 addl $1, %eax
20800 adcl $0, %edx
20801 +
20802 +#ifdef CONFIG_PAX_REFCOUNT
20803 + into
20804 +1234:
20805 + _ASM_EXTABLE(1234b, 2f)
20806 +#endif
20807 +
20808 movl %eax, (v)
20809 movl %edx, 4(v)
20810 movl $1, %eax
20811 @@ -186,6 +343,13 @@ BEGIN(dec_if_positive)
20812 movl 4(v), %edx
20813 subl $1, %eax
20814 sbbl $0, %edx
20815 +
20816 +#ifdef CONFIG_PAX_REFCOUNT
20817 + into
20818 +1234:
20819 + _ASM_EXTABLE(1234b, 1f)
20820 +#endif
20821 +
20822 js 1f
20823 movl %eax, (v)
20824 movl %edx, 4(v)
20825 diff --git a/arch/x86/lib/atomic64_cx8_32.S b/arch/x86/lib/atomic64_cx8_32.S
20826 index f5cc9eb..51fa319 100644
20827 --- a/arch/x86/lib/atomic64_cx8_32.S
20828 +++ b/arch/x86/lib/atomic64_cx8_32.S
20829 @@ -35,10 +35,20 @@ ENTRY(atomic64_read_cx8)
20830 CFI_STARTPROC
20831
20832 read64 %ecx
20833 + pax_force_retaddr
20834 ret
20835 CFI_ENDPROC
20836 ENDPROC(atomic64_read_cx8)
20837
20838 +ENTRY(atomic64_read_unchecked_cx8)
20839 + CFI_STARTPROC
20840 +
20841 + read64 %ecx
20842 + pax_force_retaddr
20843 + ret
20844 + CFI_ENDPROC
20845 +ENDPROC(atomic64_read_unchecked_cx8)
20846 +
20847 ENTRY(atomic64_set_cx8)
20848 CFI_STARTPROC
20849
20850 @@ -48,10 +58,25 @@ ENTRY(atomic64_set_cx8)
20851 cmpxchg8b (%esi)
20852 jne 1b
20853
20854 + pax_force_retaddr
20855 ret
20856 CFI_ENDPROC
20857 ENDPROC(atomic64_set_cx8)
20858
20859 +ENTRY(atomic64_set_unchecked_cx8)
20860 + CFI_STARTPROC
20861 +
20862 +1:
20863 +/* we don't need LOCK_PREFIX since aligned 64-bit writes
20864 + * are atomic on 586 and newer */
20865 + cmpxchg8b (%esi)
20866 + jne 1b
20867 +
20868 + pax_force_retaddr
20869 + ret
20870 + CFI_ENDPROC
20871 +ENDPROC(atomic64_set_unchecked_cx8)
20872 +
20873 ENTRY(atomic64_xchg_cx8)
20874 CFI_STARTPROC
20875
20876 @@ -60,12 +85,13 @@ ENTRY(atomic64_xchg_cx8)
20877 cmpxchg8b (%esi)
20878 jne 1b
20879
20880 + pax_force_retaddr
20881 ret
20882 CFI_ENDPROC
20883 ENDPROC(atomic64_xchg_cx8)
20884
20885 -.macro addsub_return func ins insc
20886 -ENTRY(atomic64_\func\()_return_cx8)
20887 +.macro addsub_return func ins insc unchecked=""
20888 +ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
20889 CFI_STARTPROC
20890 SAVE ebp
20891 SAVE ebx
20892 @@ -82,27 +108,44 @@ ENTRY(atomic64_\func\()_return_cx8)
20893 movl %edx, %ecx
20894 \ins\()l %esi, %ebx
20895 \insc\()l %edi, %ecx
20896 +
20897 +.ifb \unchecked
20898 +#ifdef CONFIG_PAX_REFCOUNT
20899 + into
20900 +2:
20901 + _ASM_EXTABLE(2b, 3f)
20902 +#endif
20903 +.endif
20904 +
20905 LOCK_PREFIX
20906 cmpxchg8b (%ebp)
20907 jne 1b
20908 -
20909 -10:
20910 movl %ebx, %eax
20911 movl %ecx, %edx
20912 +
20913 +.ifb \unchecked
20914 +#ifdef CONFIG_PAX_REFCOUNT
20915 +3:
20916 +#endif
20917 +.endif
20918 +
20919 RESTORE edi
20920 RESTORE esi
20921 RESTORE ebx
20922 RESTORE ebp
20923 + pax_force_retaddr
20924 ret
20925 CFI_ENDPROC
20926 -ENDPROC(atomic64_\func\()_return_cx8)
20927 +ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
20928 .endm
20929
20930 addsub_return add add adc
20931 addsub_return sub sub sbb
20932 +addsub_return add add adc _unchecked
20933 +addsub_return sub sub sbb _unchecked
20934
20935 -.macro incdec_return func ins insc
20936 -ENTRY(atomic64_\func\()_return_cx8)
20937 +.macro incdec_return func ins insc unchecked=""
20938 +ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
20939 CFI_STARTPROC
20940 SAVE ebx
20941
20942 @@ -112,21 +155,39 @@ ENTRY(atomic64_\func\()_return_cx8)
20943 movl %edx, %ecx
20944 \ins\()l $1, %ebx
20945 \insc\()l $0, %ecx
20946 +
20947 +.ifb \unchecked
20948 +#ifdef CONFIG_PAX_REFCOUNT
20949 + into
20950 +2:
20951 + _ASM_EXTABLE(2b, 3f)
20952 +#endif
20953 +.endif
20954 +
20955 LOCK_PREFIX
20956 cmpxchg8b (%esi)
20957 jne 1b
20958
20959 -10:
20960 movl %ebx, %eax
20961 movl %ecx, %edx
20962 +
20963 +.ifb \unchecked
20964 +#ifdef CONFIG_PAX_REFCOUNT
20965 +3:
20966 +#endif
20967 +.endif
20968 +
20969 RESTORE ebx
20970 + pax_force_retaddr
20971 ret
20972 CFI_ENDPROC
20973 -ENDPROC(atomic64_\func\()_return_cx8)
20974 +ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
20975 .endm
20976
20977 incdec_return inc add adc
20978 incdec_return dec sub sbb
20979 +incdec_return inc add adc _unchecked
20980 +incdec_return dec sub sbb _unchecked
20981
20982 ENTRY(atomic64_dec_if_positive_cx8)
20983 CFI_STARTPROC
20984 @@ -138,6 +199,13 @@ ENTRY(atomic64_dec_if_positive_cx8)
20985 movl %edx, %ecx
20986 subl $1, %ebx
20987 sbb $0, %ecx
20988 +
20989 +#ifdef CONFIG_PAX_REFCOUNT
20990 + into
20991 +1234:
20992 + _ASM_EXTABLE(1234b, 2f)
20993 +#endif
20994 +
20995 js 2f
20996 LOCK_PREFIX
20997 cmpxchg8b (%esi)
20998 @@ -147,6 +215,7 @@ ENTRY(atomic64_dec_if_positive_cx8)
20999 movl %ebx, %eax
21000 movl %ecx, %edx
21001 RESTORE ebx
21002 + pax_force_retaddr
21003 ret
21004 CFI_ENDPROC
21005 ENDPROC(atomic64_dec_if_positive_cx8)
21006 @@ -171,6 +240,13 @@ ENTRY(atomic64_add_unless_cx8)
21007 movl %edx, %ecx
21008 addl %ebp, %ebx
21009 adcl %edi, %ecx
21010 +
21011 +#ifdef CONFIG_PAX_REFCOUNT
21012 + into
21013 +1234:
21014 + _ASM_EXTABLE(1234b, 3f)
21015 +#endif
21016 +
21017 LOCK_PREFIX
21018 cmpxchg8b (%esi)
21019 jne 1b
21020 @@ -181,6 +257,7 @@ ENTRY(atomic64_add_unless_cx8)
21021 CFI_ADJUST_CFA_OFFSET -8
21022 RESTORE ebx
21023 RESTORE ebp
21024 + pax_force_retaddr
21025 ret
21026 4:
21027 cmpl %edx, 4(%esp)
21028 @@ -203,6 +280,13 @@ ENTRY(atomic64_inc_not_zero_cx8)
21029 xorl %ecx, %ecx
21030 addl $1, %ebx
21031 adcl %edx, %ecx
21032 +
21033 +#ifdef CONFIG_PAX_REFCOUNT
21034 + into
21035 +1234:
21036 + _ASM_EXTABLE(1234b, 3f)
21037 +#endif
21038 +
21039 LOCK_PREFIX
21040 cmpxchg8b (%esi)
21041 jne 1b
21042 @@ -210,6 +294,7 @@ ENTRY(atomic64_inc_not_zero_cx8)
21043 movl $1, %eax
21044 3:
21045 RESTORE ebx
21046 + pax_force_retaddr
21047 ret
21048 CFI_ENDPROC
21049 ENDPROC(atomic64_inc_not_zero_cx8)
21050 diff --git a/arch/x86/lib/checksum_32.S b/arch/x86/lib/checksum_32.S
21051 index 2af5df3..62b1a5a 100644
21052 --- a/arch/x86/lib/checksum_32.S
21053 +++ b/arch/x86/lib/checksum_32.S
21054 @@ -29,7 +29,8 @@
21055 #include <asm/dwarf2.h>
21056 #include <asm/errno.h>
21057 #include <asm/asm.h>
21058 -
21059 +#include <asm/segment.h>
21060 +
21061 /*
21062 * computes a partial checksum, e.g. for TCP/UDP fragments
21063 */
21064 @@ -293,9 +294,24 @@ unsigned int csum_partial_copy_generic (const char *src, char *dst,
21065
21066 #define ARGBASE 16
21067 #define FP 12
21068 -
21069 -ENTRY(csum_partial_copy_generic)
21070 +
21071 +ENTRY(csum_partial_copy_generic_to_user)
21072 CFI_STARTPROC
21073 +
21074 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21075 + pushl_cfi %gs
21076 + popl_cfi %es
21077 + jmp csum_partial_copy_generic
21078 +#endif
21079 +
21080 +ENTRY(csum_partial_copy_generic_from_user)
21081 +
21082 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21083 + pushl_cfi %gs
21084 + popl_cfi %ds
21085 +#endif
21086 +
21087 +ENTRY(csum_partial_copy_generic)
21088 subl $4,%esp
21089 CFI_ADJUST_CFA_OFFSET 4
21090 pushl_cfi %edi
21091 @@ -317,7 +333,7 @@ ENTRY(csum_partial_copy_generic)
21092 jmp 4f
21093 SRC(1: movw (%esi), %bx )
21094 addl $2, %esi
21095 -DST( movw %bx, (%edi) )
21096 +DST( movw %bx, %es:(%edi) )
21097 addl $2, %edi
21098 addw %bx, %ax
21099 adcl $0, %eax
21100 @@ -329,30 +345,30 @@ DST( movw %bx, (%edi) )
21101 SRC(1: movl (%esi), %ebx )
21102 SRC( movl 4(%esi), %edx )
21103 adcl %ebx, %eax
21104 -DST( movl %ebx, (%edi) )
21105 +DST( movl %ebx, %es:(%edi) )
21106 adcl %edx, %eax
21107 -DST( movl %edx, 4(%edi) )
21108 +DST( movl %edx, %es:4(%edi) )
21109
21110 SRC( movl 8(%esi), %ebx )
21111 SRC( movl 12(%esi), %edx )
21112 adcl %ebx, %eax
21113 -DST( movl %ebx, 8(%edi) )
21114 +DST( movl %ebx, %es:8(%edi) )
21115 adcl %edx, %eax
21116 -DST( movl %edx, 12(%edi) )
21117 +DST( movl %edx, %es:12(%edi) )
21118
21119 SRC( movl 16(%esi), %ebx )
21120 SRC( movl 20(%esi), %edx )
21121 adcl %ebx, %eax
21122 -DST( movl %ebx, 16(%edi) )
21123 +DST( movl %ebx, %es:16(%edi) )
21124 adcl %edx, %eax
21125 -DST( movl %edx, 20(%edi) )
21126 +DST( movl %edx, %es:20(%edi) )
21127
21128 SRC( movl 24(%esi), %ebx )
21129 SRC( movl 28(%esi), %edx )
21130 adcl %ebx, %eax
21131 -DST( movl %ebx, 24(%edi) )
21132 +DST( movl %ebx, %es:24(%edi) )
21133 adcl %edx, %eax
21134 -DST( movl %edx, 28(%edi) )
21135 +DST( movl %edx, %es:28(%edi) )
21136
21137 lea 32(%esi), %esi
21138 lea 32(%edi), %edi
21139 @@ -366,7 +382,7 @@ DST( movl %edx, 28(%edi) )
21140 shrl $2, %edx # This clears CF
21141 SRC(3: movl (%esi), %ebx )
21142 adcl %ebx, %eax
21143 -DST( movl %ebx, (%edi) )
21144 +DST( movl %ebx, %es:(%edi) )
21145 lea 4(%esi), %esi
21146 lea 4(%edi), %edi
21147 dec %edx
21148 @@ -378,12 +394,12 @@ DST( movl %ebx, (%edi) )
21149 jb 5f
21150 SRC( movw (%esi), %cx )
21151 leal 2(%esi), %esi
21152 -DST( movw %cx, (%edi) )
21153 +DST( movw %cx, %es:(%edi) )
21154 leal 2(%edi), %edi
21155 je 6f
21156 shll $16,%ecx
21157 SRC(5: movb (%esi), %cl )
21158 -DST( movb %cl, (%edi) )
21159 +DST( movb %cl, %es:(%edi) )
21160 6: addl %ecx, %eax
21161 adcl $0, %eax
21162 7:
21163 @@ -394,7 +410,7 @@ DST( movb %cl, (%edi) )
21164
21165 6001:
21166 movl ARGBASE+20(%esp), %ebx # src_err_ptr
21167 - movl $-EFAULT, (%ebx)
21168 + movl $-EFAULT, %ss:(%ebx)
21169
21170 # zero the complete destination - computing the rest
21171 # is too much work
21172 @@ -407,11 +423,15 @@ DST( movb %cl, (%edi) )
21173
21174 6002:
21175 movl ARGBASE+24(%esp), %ebx # dst_err_ptr
21176 - movl $-EFAULT,(%ebx)
21177 + movl $-EFAULT,%ss:(%ebx)
21178 jmp 5000b
21179
21180 .previous
21181
21182 + pushl_cfi %ss
21183 + popl_cfi %ds
21184 + pushl_cfi %ss
21185 + popl_cfi %es
21186 popl_cfi %ebx
21187 CFI_RESTORE ebx
21188 popl_cfi %esi
21189 @@ -421,26 +441,43 @@ DST( movb %cl, (%edi) )
21190 popl_cfi %ecx # equivalent to addl $4,%esp
21191 ret
21192 CFI_ENDPROC
21193 -ENDPROC(csum_partial_copy_generic)
21194 +ENDPROC(csum_partial_copy_generic_to_user)
21195
21196 #else
21197
21198 /* Version for PentiumII/PPro */
21199
21200 #define ROUND1(x) \
21201 + nop; nop; nop; \
21202 SRC(movl x(%esi), %ebx ) ; \
21203 addl %ebx, %eax ; \
21204 - DST(movl %ebx, x(%edi) ) ;
21205 + DST(movl %ebx, %es:x(%edi)) ;
21206
21207 #define ROUND(x) \
21208 + nop; nop; nop; \
21209 SRC(movl x(%esi), %ebx ) ; \
21210 adcl %ebx, %eax ; \
21211 - DST(movl %ebx, x(%edi) ) ;
21212 + DST(movl %ebx, %es:x(%edi)) ;
21213
21214 #define ARGBASE 12
21215 -
21216 -ENTRY(csum_partial_copy_generic)
21217 +
21218 +ENTRY(csum_partial_copy_generic_to_user)
21219 CFI_STARTPROC
21220 +
21221 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21222 + pushl_cfi %gs
21223 + popl_cfi %es
21224 + jmp csum_partial_copy_generic
21225 +#endif
21226 +
21227 +ENTRY(csum_partial_copy_generic_from_user)
21228 +
21229 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21230 + pushl_cfi %gs
21231 + popl_cfi %ds
21232 +#endif
21233 +
21234 +ENTRY(csum_partial_copy_generic)
21235 pushl_cfi %ebx
21236 CFI_REL_OFFSET ebx, 0
21237 pushl_cfi %edi
21238 @@ -461,7 +498,7 @@ ENTRY(csum_partial_copy_generic)
21239 subl %ebx, %edi
21240 lea -1(%esi),%edx
21241 andl $-32,%edx
21242 - lea 3f(%ebx,%ebx), %ebx
21243 + lea 3f(%ebx,%ebx,2), %ebx
21244 testl %esi, %esi
21245 jmp *%ebx
21246 1: addl $64,%esi
21247 @@ -482,19 +519,19 @@ ENTRY(csum_partial_copy_generic)
21248 jb 5f
21249 SRC( movw (%esi), %dx )
21250 leal 2(%esi), %esi
21251 -DST( movw %dx, (%edi) )
21252 +DST( movw %dx, %es:(%edi) )
21253 leal 2(%edi), %edi
21254 je 6f
21255 shll $16,%edx
21256 5:
21257 SRC( movb (%esi), %dl )
21258 -DST( movb %dl, (%edi) )
21259 +DST( movb %dl, %es:(%edi) )
21260 6: addl %edx, %eax
21261 adcl $0, %eax
21262 7:
21263 .section .fixup, "ax"
21264 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
21265 - movl $-EFAULT, (%ebx)
21266 + movl $-EFAULT, %ss:(%ebx)
21267 # zero the complete destination (computing the rest is too much work)
21268 movl ARGBASE+8(%esp),%edi # dst
21269 movl ARGBASE+12(%esp),%ecx # len
21270 @@ -502,10 +539,17 @@ DST( movb %dl, (%edi) )
21271 rep; stosb
21272 jmp 7b
21273 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
21274 - movl $-EFAULT, (%ebx)
21275 + movl $-EFAULT, %ss:(%ebx)
21276 jmp 7b
21277 .previous
21278
21279 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21280 + pushl_cfi %ss
21281 + popl_cfi %ds
21282 + pushl_cfi %ss
21283 + popl_cfi %es
21284 +#endif
21285 +
21286 popl_cfi %esi
21287 CFI_RESTORE esi
21288 popl_cfi %edi
21289 @@ -514,7 +558,7 @@ DST( movb %dl, (%edi) )
21290 CFI_RESTORE ebx
21291 ret
21292 CFI_ENDPROC
21293 -ENDPROC(csum_partial_copy_generic)
21294 +ENDPROC(csum_partial_copy_generic_to_user)
21295
21296 #undef ROUND
21297 #undef ROUND1
21298 diff --git a/arch/x86/lib/clear_page_64.S b/arch/x86/lib/clear_page_64.S
21299 index f2145cf..cea889d 100644
21300 --- a/arch/x86/lib/clear_page_64.S
21301 +++ b/arch/x86/lib/clear_page_64.S
21302 @@ -11,6 +11,7 @@ ENTRY(clear_page_c)
21303 movl $4096/8,%ecx
21304 xorl %eax,%eax
21305 rep stosq
21306 + pax_force_retaddr
21307 ret
21308 CFI_ENDPROC
21309 ENDPROC(clear_page_c)
21310 @@ -20,6 +21,7 @@ ENTRY(clear_page_c_e)
21311 movl $4096,%ecx
21312 xorl %eax,%eax
21313 rep stosb
21314 + pax_force_retaddr
21315 ret
21316 CFI_ENDPROC
21317 ENDPROC(clear_page_c_e)
21318 @@ -43,6 +45,7 @@ ENTRY(clear_page)
21319 leaq 64(%rdi),%rdi
21320 jnz .Lloop
21321 nop
21322 + pax_force_retaddr
21323 ret
21324 CFI_ENDPROC
21325 .Lclear_page_end:
21326 @@ -58,7 +61,7 @@ ENDPROC(clear_page)
21327
21328 #include <asm/cpufeature.h>
21329
21330 - .section .altinstr_replacement,"ax"
21331 + .section .altinstr_replacement,"a"
21332 1: .byte 0xeb /* jmp <disp8> */
21333 .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
21334 2: .byte 0xeb /* jmp <disp8> */
21335 diff --git a/arch/x86/lib/cmpxchg16b_emu.S b/arch/x86/lib/cmpxchg16b_emu.S
21336 index 1e572c5..2a162cd 100644
21337 --- a/arch/x86/lib/cmpxchg16b_emu.S
21338 +++ b/arch/x86/lib/cmpxchg16b_emu.S
21339 @@ -53,11 +53,13 @@ this_cpu_cmpxchg16b_emu:
21340
21341 popf
21342 mov $1, %al
21343 + pax_force_retaddr
21344 ret
21345
21346 not_same:
21347 popf
21348 xor %al,%al
21349 + pax_force_retaddr
21350 ret
21351
21352 CFI_ENDPROC
21353 diff --git a/arch/x86/lib/copy_page_64.S b/arch/x86/lib/copy_page_64.S
21354 index 6b34d04..dccb07f 100644
21355 --- a/arch/x86/lib/copy_page_64.S
21356 +++ b/arch/x86/lib/copy_page_64.S
21357 @@ -9,6 +9,7 @@ copy_page_c:
21358 CFI_STARTPROC
21359 movl $4096/8,%ecx
21360 rep movsq
21361 + pax_force_retaddr
21362 ret
21363 CFI_ENDPROC
21364 ENDPROC(copy_page_c)
21365 @@ -20,12 +21,14 @@ ENDPROC(copy_page_c)
21366
21367 ENTRY(copy_page)
21368 CFI_STARTPROC
21369 - subq $2*8,%rsp
21370 - CFI_ADJUST_CFA_OFFSET 2*8
21371 + subq $3*8,%rsp
21372 + CFI_ADJUST_CFA_OFFSET 3*8
21373 movq %rbx,(%rsp)
21374 CFI_REL_OFFSET rbx, 0
21375 movq %r12,1*8(%rsp)
21376 CFI_REL_OFFSET r12, 1*8
21377 + movq %r13,2*8(%rsp)
21378 + CFI_REL_OFFSET r13, 2*8
21379
21380 movl $(4096/64)-5,%ecx
21381 .p2align 4
21382 @@ -37,7 +40,7 @@ ENTRY(copy_page)
21383 movq 16 (%rsi), %rdx
21384 movq 24 (%rsi), %r8
21385 movq 32 (%rsi), %r9
21386 - movq 40 (%rsi), %r10
21387 + movq 40 (%rsi), %r13
21388 movq 48 (%rsi), %r11
21389 movq 56 (%rsi), %r12
21390
21391 @@ -48,7 +51,7 @@ ENTRY(copy_page)
21392 movq %rdx, 16 (%rdi)
21393 movq %r8, 24 (%rdi)
21394 movq %r9, 32 (%rdi)
21395 - movq %r10, 40 (%rdi)
21396 + movq %r13, 40 (%rdi)
21397 movq %r11, 48 (%rdi)
21398 movq %r12, 56 (%rdi)
21399
21400 @@ -67,7 +70,7 @@ ENTRY(copy_page)
21401 movq 16 (%rsi), %rdx
21402 movq 24 (%rsi), %r8
21403 movq 32 (%rsi), %r9
21404 - movq 40 (%rsi), %r10
21405 + movq 40 (%rsi), %r13
21406 movq 48 (%rsi), %r11
21407 movq 56 (%rsi), %r12
21408
21409 @@ -76,7 +79,7 @@ ENTRY(copy_page)
21410 movq %rdx, 16 (%rdi)
21411 movq %r8, 24 (%rdi)
21412 movq %r9, 32 (%rdi)
21413 - movq %r10, 40 (%rdi)
21414 + movq %r13, 40 (%rdi)
21415 movq %r11, 48 (%rdi)
21416 movq %r12, 56 (%rdi)
21417
21418 @@ -89,8 +92,11 @@ ENTRY(copy_page)
21419 CFI_RESTORE rbx
21420 movq 1*8(%rsp),%r12
21421 CFI_RESTORE r12
21422 - addq $2*8,%rsp
21423 - CFI_ADJUST_CFA_OFFSET -2*8
21424 + movq 2*8(%rsp),%r13
21425 + CFI_RESTORE r13
21426 + addq $3*8,%rsp
21427 + CFI_ADJUST_CFA_OFFSET -3*8
21428 + pax_force_retaddr
21429 ret
21430 .Lcopy_page_end:
21431 CFI_ENDPROC
21432 @@ -101,7 +107,7 @@ ENDPROC(copy_page)
21433
21434 #include <asm/cpufeature.h>
21435
21436 - .section .altinstr_replacement,"ax"
21437 + .section .altinstr_replacement,"a"
21438 1: .byte 0xeb /* jmp <disp8> */
21439 .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
21440 2:
21441 diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
21442 index 5b2995f..78e7644 100644
21443 --- a/arch/x86/lib/copy_user_64.S
21444 +++ b/arch/x86/lib/copy_user_64.S
21445 @@ -17,6 +17,7 @@
21446 #include <asm/cpufeature.h>
21447 #include <asm/alternative-asm.h>
21448 #include <asm/asm.h>
21449 +#include <asm/pgtable.h>
21450
21451 /*
21452 * By placing feature2 after feature1 in altinstructions section, we logically
21453 @@ -30,7 +31,7 @@
21454 .byte 0xe9 /* 32bit jump */
21455 .long \orig-1f /* by default jump to orig */
21456 1:
21457 - .section .altinstr_replacement,"ax"
21458 + .section .altinstr_replacement,"a"
21459 2: .byte 0xe9 /* near jump with 32bit immediate */
21460 .long \alt1-1b /* offset */ /* or alternatively to alt1 */
21461 3: .byte 0xe9 /* near jump with 32bit immediate */
21462 @@ -69,47 +70,20 @@
21463 #endif
21464 .endm
21465
21466 -/* Standard copy_to_user with segment limit checking */
21467 -ENTRY(_copy_to_user)
21468 - CFI_STARTPROC
21469 - GET_THREAD_INFO(%rax)
21470 - movq %rdi,%rcx
21471 - addq %rdx,%rcx
21472 - jc bad_to_user
21473 - cmpq TI_addr_limit(%rax),%rcx
21474 - ja bad_to_user
21475 - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
21476 - copy_user_generic_unrolled,copy_user_generic_string, \
21477 - copy_user_enhanced_fast_string
21478 - CFI_ENDPROC
21479 -ENDPROC(_copy_to_user)
21480 -
21481 -/* Standard copy_from_user with segment limit checking */
21482 -ENTRY(_copy_from_user)
21483 - CFI_STARTPROC
21484 - GET_THREAD_INFO(%rax)
21485 - movq %rsi,%rcx
21486 - addq %rdx,%rcx
21487 - jc bad_from_user
21488 - cmpq TI_addr_limit(%rax),%rcx
21489 - ja bad_from_user
21490 - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
21491 - copy_user_generic_unrolled,copy_user_generic_string, \
21492 - copy_user_enhanced_fast_string
21493 - CFI_ENDPROC
21494 -ENDPROC(_copy_from_user)
21495 -
21496 .section .fixup,"ax"
21497 /* must zero dest */
21498 ENTRY(bad_from_user)
21499 bad_from_user:
21500 CFI_STARTPROC
21501 + testl %edx,%edx
21502 + js bad_to_user
21503 movl %edx,%ecx
21504 xorl %eax,%eax
21505 rep
21506 stosb
21507 bad_to_user:
21508 movl %edx,%eax
21509 + pax_force_retaddr
21510 ret
21511 CFI_ENDPROC
21512 ENDPROC(bad_from_user)
21513 @@ -139,19 +113,19 @@ ENTRY(copy_user_generic_unrolled)
21514 jz 17f
21515 1: movq (%rsi),%r8
21516 2: movq 1*8(%rsi),%r9
21517 -3: movq 2*8(%rsi),%r10
21518 +3: movq 2*8(%rsi),%rax
21519 4: movq 3*8(%rsi),%r11
21520 5: movq %r8,(%rdi)
21521 6: movq %r9,1*8(%rdi)
21522 -7: movq %r10,2*8(%rdi)
21523 +7: movq %rax,2*8(%rdi)
21524 8: movq %r11,3*8(%rdi)
21525 9: movq 4*8(%rsi),%r8
21526 10: movq 5*8(%rsi),%r9
21527 -11: movq 6*8(%rsi),%r10
21528 +11: movq 6*8(%rsi),%rax
21529 12: movq 7*8(%rsi),%r11
21530 13: movq %r8,4*8(%rdi)
21531 14: movq %r9,5*8(%rdi)
21532 -15: movq %r10,6*8(%rdi)
21533 +15: movq %rax,6*8(%rdi)
21534 16: movq %r11,7*8(%rdi)
21535 leaq 64(%rsi),%rsi
21536 leaq 64(%rdi),%rdi
21537 @@ -177,6 +151,7 @@ ENTRY(copy_user_generic_unrolled)
21538 decl %ecx
21539 jnz 21b
21540 23: xor %eax,%eax
21541 + pax_force_retaddr
21542 ret
21543
21544 .section .fixup,"ax"
21545 @@ -246,6 +221,7 @@ ENTRY(copy_user_generic_string)
21546 3: rep
21547 movsb
21548 4: xorl %eax,%eax
21549 + pax_force_retaddr
21550 ret
21551
21552 .section .fixup,"ax"
21553 @@ -279,6 +255,7 @@ ENTRY(copy_user_enhanced_fast_string)
21554 1: rep
21555 movsb
21556 2: xorl %eax,%eax
21557 + pax_force_retaddr
21558 ret
21559
21560 .section .fixup,"ax"
21561 diff --git a/arch/x86/lib/copy_user_nocache_64.S b/arch/x86/lib/copy_user_nocache_64.S
21562 index cacddc7..09d49e4 100644
21563 --- a/arch/x86/lib/copy_user_nocache_64.S
21564 +++ b/arch/x86/lib/copy_user_nocache_64.S
21565 @@ -8,6 +8,7 @@
21566
21567 #include <linux/linkage.h>
21568 #include <asm/dwarf2.h>
21569 +#include <asm/alternative-asm.h>
21570
21571 #define FIX_ALIGNMENT 1
21572
21573 @@ -15,6 +16,7 @@
21574 #include <asm/asm-offsets.h>
21575 #include <asm/thread_info.h>
21576 #include <asm/asm.h>
21577 +#include <asm/pgtable.h>
21578
21579 .macro ALIGN_DESTINATION
21580 #ifdef FIX_ALIGNMENT
21581 @@ -48,6 +50,15 @@
21582 */
21583 ENTRY(__copy_user_nocache)
21584 CFI_STARTPROC
21585 +
21586 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21587 + mov $PAX_USER_SHADOW_BASE,%rcx
21588 + cmp %rcx,%rsi
21589 + jae 1f
21590 + add %rcx,%rsi
21591 +1:
21592 +#endif
21593 +
21594 cmpl $8,%edx
21595 jb 20f /* less then 8 bytes, go to byte copy loop */
21596 ALIGN_DESTINATION
21597 @@ -57,19 +68,19 @@ ENTRY(__copy_user_nocache)
21598 jz 17f
21599 1: movq (%rsi),%r8
21600 2: movq 1*8(%rsi),%r9
21601 -3: movq 2*8(%rsi),%r10
21602 +3: movq 2*8(%rsi),%rax
21603 4: movq 3*8(%rsi),%r11
21604 5: movnti %r8,(%rdi)
21605 6: movnti %r9,1*8(%rdi)
21606 -7: movnti %r10,2*8(%rdi)
21607 +7: movnti %rax,2*8(%rdi)
21608 8: movnti %r11,3*8(%rdi)
21609 9: movq 4*8(%rsi),%r8
21610 10: movq 5*8(%rsi),%r9
21611 -11: movq 6*8(%rsi),%r10
21612 +11: movq 6*8(%rsi),%rax
21613 12: movq 7*8(%rsi),%r11
21614 13: movnti %r8,4*8(%rdi)
21615 14: movnti %r9,5*8(%rdi)
21616 -15: movnti %r10,6*8(%rdi)
21617 +15: movnti %rax,6*8(%rdi)
21618 16: movnti %r11,7*8(%rdi)
21619 leaq 64(%rsi),%rsi
21620 leaq 64(%rdi),%rdi
21621 @@ -96,6 +107,7 @@ ENTRY(__copy_user_nocache)
21622 jnz 21b
21623 23: xorl %eax,%eax
21624 sfence
21625 + pax_force_retaddr
21626 ret
21627
21628 .section .fixup,"ax"
21629 diff --git a/arch/x86/lib/csum-copy_64.S b/arch/x86/lib/csum-copy_64.S
21630 index 2419d5f..953ee51 100644
21631 --- a/arch/x86/lib/csum-copy_64.S
21632 +++ b/arch/x86/lib/csum-copy_64.S
21633 @@ -9,6 +9,7 @@
21634 #include <asm/dwarf2.h>
21635 #include <asm/errno.h>
21636 #include <asm/asm.h>
21637 +#include <asm/alternative-asm.h>
21638
21639 /*
21640 * Checksum copy with exception handling.
21641 @@ -220,6 +221,7 @@ ENTRY(csum_partial_copy_generic)
21642 CFI_RESTORE rbp
21643 addq $7*8, %rsp
21644 CFI_ADJUST_CFA_OFFSET -7*8
21645 + pax_force_retaddr 0, 1
21646 ret
21647 CFI_RESTORE_STATE
21648
21649 diff --git a/arch/x86/lib/csum-wrappers_64.c b/arch/x86/lib/csum-wrappers_64.c
21650 index 25b7ae8..3b52ccd 100644
21651 --- a/arch/x86/lib/csum-wrappers_64.c
21652 +++ b/arch/x86/lib/csum-wrappers_64.c
21653 @@ -52,7 +52,13 @@ csum_partial_copy_from_user(const void __user *src, void *dst,
21654 len -= 2;
21655 }
21656 }
21657 - isum = csum_partial_copy_generic((__force const void *)src,
21658 +
21659 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21660 + if ((unsigned long)src < PAX_USER_SHADOW_BASE)
21661 + src += PAX_USER_SHADOW_BASE;
21662 +#endif
21663 +
21664 + isum = csum_partial_copy_generic((const void __force_kernel *)src,
21665 dst, len, isum, errp, NULL);
21666 if (unlikely(*errp))
21667 goto out_err;
21668 @@ -105,7 +111,13 @@ csum_partial_copy_to_user(const void *src, void __user *dst,
21669 }
21670
21671 *errp = 0;
21672 - return csum_partial_copy_generic(src, (void __force *)dst,
21673 +
21674 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21675 + if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
21676 + dst += PAX_USER_SHADOW_BASE;
21677 +#endif
21678 +
21679 + return csum_partial_copy_generic(src, (void __force_kernel *)dst,
21680 len, isum, NULL, errp);
21681 }
21682 EXPORT_SYMBOL(csum_partial_copy_to_user);
21683 diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S
21684 index b33b1fb..219f389 100644
21685 --- a/arch/x86/lib/getuser.S
21686 +++ b/arch/x86/lib/getuser.S
21687 @@ -33,15 +33,38 @@
21688 #include <asm/asm-offsets.h>
21689 #include <asm/thread_info.h>
21690 #include <asm/asm.h>
21691 +#include <asm/segment.h>
21692 +#include <asm/pgtable.h>
21693 +#include <asm/alternative-asm.h>
21694 +
21695 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
21696 +#define __copyuser_seg gs;
21697 +#else
21698 +#define __copyuser_seg
21699 +#endif
21700
21701 .text
21702 ENTRY(__get_user_1)
21703 CFI_STARTPROC
21704 +
21705 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
21706 GET_THREAD_INFO(%_ASM_DX)
21707 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
21708 jae bad_get_user
21709 -1: movzb (%_ASM_AX),%edx
21710 +
21711 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21712 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
21713 + cmp %_ASM_DX,%_ASM_AX
21714 + jae 1234f
21715 + add %_ASM_DX,%_ASM_AX
21716 +1234:
21717 +#endif
21718 +
21719 +#endif
21720 +
21721 +1: __copyuser_seg movzb (%_ASM_AX),%edx
21722 xor %eax,%eax
21723 + pax_force_retaddr
21724 ret
21725 CFI_ENDPROC
21726 ENDPROC(__get_user_1)
21727 @@ -49,12 +72,26 @@ ENDPROC(__get_user_1)
21728 ENTRY(__get_user_2)
21729 CFI_STARTPROC
21730 add $1,%_ASM_AX
21731 +
21732 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
21733 jc bad_get_user
21734 GET_THREAD_INFO(%_ASM_DX)
21735 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
21736 jae bad_get_user
21737 -2: movzwl -1(%_ASM_AX),%edx
21738 +
21739 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21740 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
21741 + cmp %_ASM_DX,%_ASM_AX
21742 + jae 1234f
21743 + add %_ASM_DX,%_ASM_AX
21744 +1234:
21745 +#endif
21746 +
21747 +#endif
21748 +
21749 +2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
21750 xor %eax,%eax
21751 + pax_force_retaddr
21752 ret
21753 CFI_ENDPROC
21754 ENDPROC(__get_user_2)
21755 @@ -62,12 +99,26 @@ ENDPROC(__get_user_2)
21756 ENTRY(__get_user_4)
21757 CFI_STARTPROC
21758 add $3,%_ASM_AX
21759 +
21760 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
21761 jc bad_get_user
21762 GET_THREAD_INFO(%_ASM_DX)
21763 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
21764 jae bad_get_user
21765 -3: mov -3(%_ASM_AX),%edx
21766 +
21767 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21768 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
21769 + cmp %_ASM_DX,%_ASM_AX
21770 + jae 1234f
21771 + add %_ASM_DX,%_ASM_AX
21772 +1234:
21773 +#endif
21774 +
21775 +#endif
21776 +
21777 +3: __copyuser_seg mov -3(%_ASM_AX),%edx
21778 xor %eax,%eax
21779 + pax_force_retaddr
21780 ret
21781 CFI_ENDPROC
21782 ENDPROC(__get_user_4)
21783 @@ -80,8 +131,18 @@ ENTRY(__get_user_8)
21784 GET_THREAD_INFO(%_ASM_DX)
21785 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
21786 jae bad_get_user
21787 +
21788 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21789 + mov $PAX_USER_SHADOW_BASE,%_ASM_DX
21790 + cmp %_ASM_DX,%_ASM_AX
21791 + jae 1234f
21792 + add %_ASM_DX,%_ASM_AX
21793 +1234:
21794 +#endif
21795 +
21796 4: movq -7(%_ASM_AX),%_ASM_DX
21797 xor %eax,%eax
21798 + pax_force_retaddr
21799 ret
21800 CFI_ENDPROC
21801 ENDPROC(__get_user_8)
21802 @@ -91,6 +152,7 @@ bad_get_user:
21803 CFI_STARTPROC
21804 xor %edx,%edx
21805 mov $(-EFAULT),%_ASM_AX
21806 + pax_force_retaddr
21807 ret
21808 CFI_ENDPROC
21809 END(bad_get_user)
21810 diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c
21811 index b1e6c4b..21ae8fc 100644
21812 --- a/arch/x86/lib/insn.c
21813 +++ b/arch/x86/lib/insn.c
21814 @@ -21,6 +21,11 @@
21815 #include <linux/string.h>
21816 #include <asm/inat.h>
21817 #include <asm/insn.h>
21818 +#ifdef __KERNEL__
21819 +#include <asm/pgtable_types.h>
21820 +#else
21821 +#define ktla_ktva(addr) addr
21822 +#endif
21823
21824 /* Verify next sizeof(t) bytes can be on the same instruction */
21825 #define validate_next(t, insn, n) \
21826 @@ -49,8 +54,8 @@
21827 void insn_init(struct insn *insn, const void *kaddr, int x86_64)
21828 {
21829 memset(insn, 0, sizeof(*insn));
21830 - insn->kaddr = kaddr;
21831 - insn->next_byte = kaddr;
21832 + insn->kaddr = ktla_ktva(kaddr);
21833 + insn->next_byte = ktla_ktva(kaddr);
21834 insn->x86_64 = x86_64 ? 1 : 0;
21835 insn->opnd_bytes = 4;
21836 if (x86_64)
21837 diff --git a/arch/x86/lib/iomap_copy_64.S b/arch/x86/lib/iomap_copy_64.S
21838 index 05a95e7..326f2fa 100644
21839 --- a/arch/x86/lib/iomap_copy_64.S
21840 +++ b/arch/x86/lib/iomap_copy_64.S
21841 @@ -17,6 +17,7 @@
21842
21843 #include <linux/linkage.h>
21844 #include <asm/dwarf2.h>
21845 +#include <asm/alternative-asm.h>
21846
21847 /*
21848 * override generic version in lib/iomap_copy.c
21849 @@ -25,6 +26,7 @@ ENTRY(__iowrite32_copy)
21850 CFI_STARTPROC
21851 movl %edx,%ecx
21852 rep movsd
21853 + pax_force_retaddr
21854 ret
21855 CFI_ENDPROC
21856 ENDPROC(__iowrite32_copy)
21857 diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S
21858 index 1c273be..da9cc0e 100644
21859 --- a/arch/x86/lib/memcpy_64.S
21860 +++ b/arch/x86/lib/memcpy_64.S
21861 @@ -33,6 +33,7 @@
21862 rep movsq
21863 movl %edx, %ecx
21864 rep movsb
21865 + pax_force_retaddr
21866 ret
21867 .Lmemcpy_e:
21868 .previous
21869 @@ -49,6 +50,7 @@
21870 movq %rdi, %rax
21871 movq %rdx, %rcx
21872 rep movsb
21873 + pax_force_retaddr
21874 ret
21875 .Lmemcpy_e_e:
21876 .previous
21877 @@ -76,13 +78,13 @@ ENTRY(memcpy)
21878 */
21879 movq 0*8(%rsi), %r8
21880 movq 1*8(%rsi), %r9
21881 - movq 2*8(%rsi), %r10
21882 + movq 2*8(%rsi), %rcx
21883 movq 3*8(%rsi), %r11
21884 leaq 4*8(%rsi), %rsi
21885
21886 movq %r8, 0*8(%rdi)
21887 movq %r9, 1*8(%rdi)
21888 - movq %r10, 2*8(%rdi)
21889 + movq %rcx, 2*8(%rdi)
21890 movq %r11, 3*8(%rdi)
21891 leaq 4*8(%rdi), %rdi
21892 jae .Lcopy_forward_loop
21893 @@ -105,12 +107,12 @@ ENTRY(memcpy)
21894 subq $0x20, %rdx
21895 movq -1*8(%rsi), %r8
21896 movq -2*8(%rsi), %r9
21897 - movq -3*8(%rsi), %r10
21898 + movq -3*8(%rsi), %rcx
21899 movq -4*8(%rsi), %r11
21900 leaq -4*8(%rsi), %rsi
21901 movq %r8, -1*8(%rdi)
21902 movq %r9, -2*8(%rdi)
21903 - movq %r10, -3*8(%rdi)
21904 + movq %rcx, -3*8(%rdi)
21905 movq %r11, -4*8(%rdi)
21906 leaq -4*8(%rdi), %rdi
21907 jae .Lcopy_backward_loop
21908 @@ -130,12 +132,13 @@ ENTRY(memcpy)
21909 */
21910 movq 0*8(%rsi), %r8
21911 movq 1*8(%rsi), %r9
21912 - movq -2*8(%rsi, %rdx), %r10
21913 + movq -2*8(%rsi, %rdx), %rcx
21914 movq -1*8(%rsi, %rdx), %r11
21915 movq %r8, 0*8(%rdi)
21916 movq %r9, 1*8(%rdi)
21917 - movq %r10, -2*8(%rdi, %rdx)
21918 + movq %rcx, -2*8(%rdi, %rdx)
21919 movq %r11, -1*8(%rdi, %rdx)
21920 + pax_force_retaddr
21921 retq
21922 .p2align 4
21923 .Lless_16bytes:
21924 @@ -148,6 +151,7 @@ ENTRY(memcpy)
21925 movq -1*8(%rsi, %rdx), %r9
21926 movq %r8, 0*8(%rdi)
21927 movq %r9, -1*8(%rdi, %rdx)
21928 + pax_force_retaddr
21929 retq
21930 .p2align 4
21931 .Lless_8bytes:
21932 @@ -161,6 +165,7 @@ ENTRY(memcpy)
21933 movl -4(%rsi, %rdx), %r8d
21934 movl %ecx, (%rdi)
21935 movl %r8d, -4(%rdi, %rdx)
21936 + pax_force_retaddr
21937 retq
21938 .p2align 4
21939 .Lless_3bytes:
21940 @@ -179,6 +184,7 @@ ENTRY(memcpy)
21941 movb %cl, (%rdi)
21942
21943 .Lend:
21944 + pax_force_retaddr
21945 retq
21946 CFI_ENDPROC
21947 ENDPROC(memcpy)
21948 diff --git a/arch/x86/lib/memmove_64.S b/arch/x86/lib/memmove_64.S
21949 index ee16461..c39c199 100644
21950 --- a/arch/x86/lib/memmove_64.S
21951 +++ b/arch/x86/lib/memmove_64.S
21952 @@ -61,13 +61,13 @@ ENTRY(memmove)
21953 5:
21954 sub $0x20, %rdx
21955 movq 0*8(%rsi), %r11
21956 - movq 1*8(%rsi), %r10
21957 + movq 1*8(%rsi), %rcx
21958 movq 2*8(%rsi), %r9
21959 movq 3*8(%rsi), %r8
21960 leaq 4*8(%rsi), %rsi
21961
21962 movq %r11, 0*8(%rdi)
21963 - movq %r10, 1*8(%rdi)
21964 + movq %rcx, 1*8(%rdi)
21965 movq %r9, 2*8(%rdi)
21966 movq %r8, 3*8(%rdi)
21967 leaq 4*8(%rdi), %rdi
21968 @@ -81,10 +81,10 @@ ENTRY(memmove)
21969 4:
21970 movq %rdx, %rcx
21971 movq -8(%rsi, %rdx), %r11
21972 - lea -8(%rdi, %rdx), %r10
21973 + lea -8(%rdi, %rdx), %r9
21974 shrq $3, %rcx
21975 rep movsq
21976 - movq %r11, (%r10)
21977 + movq %r11, (%r9)
21978 jmp 13f
21979 .Lmemmove_end_forward:
21980
21981 @@ -95,14 +95,14 @@ ENTRY(memmove)
21982 7:
21983 movq %rdx, %rcx
21984 movq (%rsi), %r11
21985 - movq %rdi, %r10
21986 + movq %rdi, %r9
21987 leaq -8(%rsi, %rdx), %rsi
21988 leaq -8(%rdi, %rdx), %rdi
21989 shrq $3, %rcx
21990 std
21991 rep movsq
21992 cld
21993 - movq %r11, (%r10)
21994 + movq %r11, (%r9)
21995 jmp 13f
21996
21997 /*
21998 @@ -127,13 +127,13 @@ ENTRY(memmove)
21999 8:
22000 subq $0x20, %rdx
22001 movq -1*8(%rsi), %r11
22002 - movq -2*8(%rsi), %r10
22003 + movq -2*8(%rsi), %rcx
22004 movq -3*8(%rsi), %r9
22005 movq -4*8(%rsi), %r8
22006 leaq -4*8(%rsi), %rsi
22007
22008 movq %r11, -1*8(%rdi)
22009 - movq %r10, -2*8(%rdi)
22010 + movq %rcx, -2*8(%rdi)
22011 movq %r9, -3*8(%rdi)
22012 movq %r8, -4*8(%rdi)
22013 leaq -4*8(%rdi), %rdi
22014 @@ -151,11 +151,11 @@ ENTRY(memmove)
22015 * Move data from 16 bytes to 31 bytes.
22016 */
22017 movq 0*8(%rsi), %r11
22018 - movq 1*8(%rsi), %r10
22019 + movq 1*8(%rsi), %rcx
22020 movq -2*8(%rsi, %rdx), %r9
22021 movq -1*8(%rsi, %rdx), %r8
22022 movq %r11, 0*8(%rdi)
22023 - movq %r10, 1*8(%rdi)
22024 + movq %rcx, 1*8(%rdi)
22025 movq %r9, -2*8(%rdi, %rdx)
22026 movq %r8, -1*8(%rdi, %rdx)
22027 jmp 13f
22028 @@ -167,9 +167,9 @@ ENTRY(memmove)
22029 * Move data from 8 bytes to 15 bytes.
22030 */
22031 movq 0*8(%rsi), %r11
22032 - movq -1*8(%rsi, %rdx), %r10
22033 + movq -1*8(%rsi, %rdx), %r9
22034 movq %r11, 0*8(%rdi)
22035 - movq %r10, -1*8(%rdi, %rdx)
22036 + movq %r9, -1*8(%rdi, %rdx)
22037 jmp 13f
22038 10:
22039 cmpq $4, %rdx
22040 @@ -178,9 +178,9 @@ ENTRY(memmove)
22041 * Move data from 4 bytes to 7 bytes.
22042 */
22043 movl (%rsi), %r11d
22044 - movl -4(%rsi, %rdx), %r10d
22045 + movl -4(%rsi, %rdx), %r9d
22046 movl %r11d, (%rdi)
22047 - movl %r10d, -4(%rdi, %rdx)
22048 + movl %r9d, -4(%rdi, %rdx)
22049 jmp 13f
22050 11:
22051 cmp $2, %rdx
22052 @@ -189,9 +189,9 @@ ENTRY(memmove)
22053 * Move data from 2 bytes to 3 bytes.
22054 */
22055 movw (%rsi), %r11w
22056 - movw -2(%rsi, %rdx), %r10w
22057 + movw -2(%rsi, %rdx), %r9w
22058 movw %r11w, (%rdi)
22059 - movw %r10w, -2(%rdi, %rdx)
22060 + movw %r9w, -2(%rdi, %rdx)
22061 jmp 13f
22062 12:
22063 cmp $1, %rdx
22064 @@ -202,6 +202,7 @@ ENTRY(memmove)
22065 movb (%rsi), %r11b
22066 movb %r11b, (%rdi)
22067 13:
22068 + pax_force_retaddr
22069 retq
22070 CFI_ENDPROC
22071
22072 @@ -210,6 +211,7 @@ ENTRY(memmove)
22073 /* Forward moving data. */
22074 movq %rdx, %rcx
22075 rep movsb
22076 + pax_force_retaddr
22077 retq
22078 .Lmemmove_end_forward_efs:
22079 .previous
22080 diff --git a/arch/x86/lib/memset_64.S b/arch/x86/lib/memset_64.S
22081 index 2dcb380..963660a 100644
22082 --- a/arch/x86/lib/memset_64.S
22083 +++ b/arch/x86/lib/memset_64.S
22084 @@ -30,6 +30,7 @@
22085 movl %edx,%ecx
22086 rep stosb
22087 movq %r9,%rax
22088 + pax_force_retaddr
22089 ret
22090 .Lmemset_e:
22091 .previous
22092 @@ -52,6 +53,7 @@
22093 movq %rdx,%rcx
22094 rep stosb
22095 movq %r9,%rax
22096 + pax_force_retaddr
22097 ret
22098 .Lmemset_e_e:
22099 .previous
22100 @@ -59,7 +61,7 @@
22101 ENTRY(memset)
22102 ENTRY(__memset)
22103 CFI_STARTPROC
22104 - movq %rdi,%r10
22105 + movq %rdi,%r11
22106
22107 /* expand byte value */
22108 movzbl %sil,%ecx
22109 @@ -117,7 +119,8 @@ ENTRY(__memset)
22110 jnz .Lloop_1
22111
22112 .Lende:
22113 - movq %r10,%rax
22114 + movq %r11,%rax
22115 + pax_force_retaddr
22116 ret
22117
22118 CFI_RESTORE_STATE
22119 diff --git a/arch/x86/lib/mmx_32.c b/arch/x86/lib/mmx_32.c
22120 index c9f2d9b..e7fd2c0 100644
22121 --- a/arch/x86/lib/mmx_32.c
22122 +++ b/arch/x86/lib/mmx_32.c
22123 @@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
22124 {
22125 void *p;
22126 int i;
22127 + unsigned long cr0;
22128
22129 if (unlikely(in_interrupt()))
22130 return __memcpy(to, from, len);
22131 @@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
22132 kernel_fpu_begin();
22133
22134 __asm__ __volatile__ (
22135 - "1: prefetch (%0)\n" /* This set is 28 bytes */
22136 - " prefetch 64(%0)\n"
22137 - " prefetch 128(%0)\n"
22138 - " prefetch 192(%0)\n"
22139 - " prefetch 256(%0)\n"
22140 + "1: prefetch (%1)\n" /* This set is 28 bytes */
22141 + " prefetch 64(%1)\n"
22142 + " prefetch 128(%1)\n"
22143 + " prefetch 192(%1)\n"
22144 + " prefetch 256(%1)\n"
22145 "2: \n"
22146 ".section .fixup, \"ax\"\n"
22147 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
22148 + "3: \n"
22149 +
22150 +#ifdef CONFIG_PAX_KERNEXEC
22151 + " movl %%cr0, %0\n"
22152 + " movl %0, %%eax\n"
22153 + " andl $0xFFFEFFFF, %%eax\n"
22154 + " movl %%eax, %%cr0\n"
22155 +#endif
22156 +
22157 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
22158 +
22159 +#ifdef CONFIG_PAX_KERNEXEC
22160 + " movl %0, %%cr0\n"
22161 +#endif
22162 +
22163 " jmp 2b\n"
22164 ".previous\n"
22165 _ASM_EXTABLE(1b, 3b)
22166 - : : "r" (from));
22167 + : "=&r" (cr0) : "r" (from) : "ax");
22168
22169 for ( ; i > 5; i--) {
22170 __asm__ __volatile__ (
22171 - "1: prefetch 320(%0)\n"
22172 - "2: movq (%0), %%mm0\n"
22173 - " movq 8(%0), %%mm1\n"
22174 - " movq 16(%0), %%mm2\n"
22175 - " movq 24(%0), %%mm3\n"
22176 - " movq %%mm0, (%1)\n"
22177 - " movq %%mm1, 8(%1)\n"
22178 - " movq %%mm2, 16(%1)\n"
22179 - " movq %%mm3, 24(%1)\n"
22180 - " movq 32(%0), %%mm0\n"
22181 - " movq 40(%0), %%mm1\n"
22182 - " movq 48(%0), %%mm2\n"
22183 - " movq 56(%0), %%mm3\n"
22184 - " movq %%mm0, 32(%1)\n"
22185 - " movq %%mm1, 40(%1)\n"
22186 - " movq %%mm2, 48(%1)\n"
22187 - " movq %%mm3, 56(%1)\n"
22188 + "1: prefetch 320(%1)\n"
22189 + "2: movq (%1), %%mm0\n"
22190 + " movq 8(%1), %%mm1\n"
22191 + " movq 16(%1), %%mm2\n"
22192 + " movq 24(%1), %%mm3\n"
22193 + " movq %%mm0, (%2)\n"
22194 + " movq %%mm1, 8(%2)\n"
22195 + " movq %%mm2, 16(%2)\n"
22196 + " movq %%mm3, 24(%2)\n"
22197 + " movq 32(%1), %%mm0\n"
22198 + " movq 40(%1), %%mm1\n"
22199 + " movq 48(%1), %%mm2\n"
22200 + " movq 56(%1), %%mm3\n"
22201 + " movq %%mm0, 32(%2)\n"
22202 + " movq %%mm1, 40(%2)\n"
22203 + " movq %%mm2, 48(%2)\n"
22204 + " movq %%mm3, 56(%2)\n"
22205 ".section .fixup, \"ax\"\n"
22206 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
22207 + "3:\n"
22208 +
22209 +#ifdef CONFIG_PAX_KERNEXEC
22210 + " movl %%cr0, %0\n"
22211 + " movl %0, %%eax\n"
22212 + " andl $0xFFFEFFFF, %%eax\n"
22213 + " movl %%eax, %%cr0\n"
22214 +#endif
22215 +
22216 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
22217 +
22218 +#ifdef CONFIG_PAX_KERNEXEC
22219 + " movl %0, %%cr0\n"
22220 +#endif
22221 +
22222 " jmp 2b\n"
22223 ".previous\n"
22224 _ASM_EXTABLE(1b, 3b)
22225 - : : "r" (from), "r" (to) : "memory");
22226 + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
22227
22228 from += 64;
22229 to += 64;
22230 @@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
22231 static void fast_copy_page(void *to, void *from)
22232 {
22233 int i;
22234 + unsigned long cr0;
22235
22236 kernel_fpu_begin();
22237
22238 @@ -166,42 +196,70 @@ static void fast_copy_page(void *to, void *from)
22239 * but that is for later. -AV
22240 */
22241 __asm__ __volatile__(
22242 - "1: prefetch (%0)\n"
22243 - " prefetch 64(%0)\n"
22244 - " prefetch 128(%0)\n"
22245 - " prefetch 192(%0)\n"
22246 - " prefetch 256(%0)\n"
22247 + "1: prefetch (%1)\n"
22248 + " prefetch 64(%1)\n"
22249 + " prefetch 128(%1)\n"
22250 + " prefetch 192(%1)\n"
22251 + " prefetch 256(%1)\n"
22252 "2: \n"
22253 ".section .fixup, \"ax\"\n"
22254 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
22255 + "3: \n"
22256 +
22257 +#ifdef CONFIG_PAX_KERNEXEC
22258 + " movl %%cr0, %0\n"
22259 + " movl %0, %%eax\n"
22260 + " andl $0xFFFEFFFF, %%eax\n"
22261 + " movl %%eax, %%cr0\n"
22262 +#endif
22263 +
22264 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
22265 +
22266 +#ifdef CONFIG_PAX_KERNEXEC
22267 + " movl %0, %%cr0\n"
22268 +#endif
22269 +
22270 " jmp 2b\n"
22271 ".previous\n"
22272 - _ASM_EXTABLE(1b, 3b) : : "r" (from));
22273 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
22274
22275 for (i = 0; i < (4096-320)/64; i++) {
22276 __asm__ __volatile__ (
22277 - "1: prefetch 320(%0)\n"
22278 - "2: movq (%0), %%mm0\n"
22279 - " movntq %%mm0, (%1)\n"
22280 - " movq 8(%0), %%mm1\n"
22281 - " movntq %%mm1, 8(%1)\n"
22282 - " movq 16(%0), %%mm2\n"
22283 - " movntq %%mm2, 16(%1)\n"
22284 - " movq 24(%0), %%mm3\n"
22285 - " movntq %%mm3, 24(%1)\n"
22286 - " movq 32(%0), %%mm4\n"
22287 - " movntq %%mm4, 32(%1)\n"
22288 - " movq 40(%0), %%mm5\n"
22289 - " movntq %%mm5, 40(%1)\n"
22290 - " movq 48(%0), %%mm6\n"
22291 - " movntq %%mm6, 48(%1)\n"
22292 - " movq 56(%0), %%mm7\n"
22293 - " movntq %%mm7, 56(%1)\n"
22294 + "1: prefetch 320(%1)\n"
22295 + "2: movq (%1), %%mm0\n"
22296 + " movntq %%mm0, (%2)\n"
22297 + " movq 8(%1), %%mm1\n"
22298 + " movntq %%mm1, 8(%2)\n"
22299 + " movq 16(%1), %%mm2\n"
22300 + " movntq %%mm2, 16(%2)\n"
22301 + " movq 24(%1), %%mm3\n"
22302 + " movntq %%mm3, 24(%2)\n"
22303 + " movq 32(%1), %%mm4\n"
22304 + " movntq %%mm4, 32(%2)\n"
22305 + " movq 40(%1), %%mm5\n"
22306 + " movntq %%mm5, 40(%2)\n"
22307 + " movq 48(%1), %%mm6\n"
22308 + " movntq %%mm6, 48(%2)\n"
22309 + " movq 56(%1), %%mm7\n"
22310 + " movntq %%mm7, 56(%2)\n"
22311 ".section .fixup, \"ax\"\n"
22312 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
22313 + "3:\n"
22314 +
22315 +#ifdef CONFIG_PAX_KERNEXEC
22316 + " movl %%cr0, %0\n"
22317 + " movl %0, %%eax\n"
22318 + " andl $0xFFFEFFFF, %%eax\n"
22319 + " movl %%eax, %%cr0\n"
22320 +#endif
22321 +
22322 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
22323 +
22324 +#ifdef CONFIG_PAX_KERNEXEC
22325 + " movl %0, %%cr0\n"
22326 +#endif
22327 +
22328 " jmp 2b\n"
22329 ".previous\n"
22330 - _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
22331 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
22332
22333 from += 64;
22334 to += 64;
22335 @@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
22336 static void fast_copy_page(void *to, void *from)
22337 {
22338 int i;
22339 + unsigned long cr0;
22340
22341 kernel_fpu_begin();
22342
22343 __asm__ __volatile__ (
22344 - "1: prefetch (%0)\n"
22345 - " prefetch 64(%0)\n"
22346 - " prefetch 128(%0)\n"
22347 - " prefetch 192(%0)\n"
22348 - " prefetch 256(%0)\n"
22349 + "1: prefetch (%1)\n"
22350 + " prefetch 64(%1)\n"
22351 + " prefetch 128(%1)\n"
22352 + " prefetch 192(%1)\n"
22353 + " prefetch 256(%1)\n"
22354 "2: \n"
22355 ".section .fixup, \"ax\"\n"
22356 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
22357 + "3: \n"
22358 +
22359 +#ifdef CONFIG_PAX_KERNEXEC
22360 + " movl %%cr0, %0\n"
22361 + " movl %0, %%eax\n"
22362 + " andl $0xFFFEFFFF, %%eax\n"
22363 + " movl %%eax, %%cr0\n"
22364 +#endif
22365 +
22366 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
22367 +
22368 +#ifdef CONFIG_PAX_KERNEXEC
22369 + " movl %0, %%cr0\n"
22370 +#endif
22371 +
22372 " jmp 2b\n"
22373 ".previous\n"
22374 - _ASM_EXTABLE(1b, 3b) : : "r" (from));
22375 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
22376
22377 for (i = 0; i < 4096/64; i++) {
22378 __asm__ __volatile__ (
22379 - "1: prefetch 320(%0)\n"
22380 - "2: movq (%0), %%mm0\n"
22381 - " movq 8(%0), %%mm1\n"
22382 - " movq 16(%0), %%mm2\n"
22383 - " movq 24(%0), %%mm3\n"
22384 - " movq %%mm0, (%1)\n"
22385 - " movq %%mm1, 8(%1)\n"
22386 - " movq %%mm2, 16(%1)\n"
22387 - " movq %%mm3, 24(%1)\n"
22388 - " movq 32(%0), %%mm0\n"
22389 - " movq 40(%0), %%mm1\n"
22390 - " movq 48(%0), %%mm2\n"
22391 - " movq 56(%0), %%mm3\n"
22392 - " movq %%mm0, 32(%1)\n"
22393 - " movq %%mm1, 40(%1)\n"
22394 - " movq %%mm2, 48(%1)\n"
22395 - " movq %%mm3, 56(%1)\n"
22396 + "1: prefetch 320(%1)\n"
22397 + "2: movq (%1), %%mm0\n"
22398 + " movq 8(%1), %%mm1\n"
22399 + " movq 16(%1), %%mm2\n"
22400 + " movq 24(%1), %%mm3\n"
22401 + " movq %%mm0, (%2)\n"
22402 + " movq %%mm1, 8(%2)\n"
22403 + " movq %%mm2, 16(%2)\n"
22404 + " movq %%mm3, 24(%2)\n"
22405 + " movq 32(%1), %%mm0\n"
22406 + " movq 40(%1), %%mm1\n"
22407 + " movq 48(%1), %%mm2\n"
22408 + " movq 56(%1), %%mm3\n"
22409 + " movq %%mm0, 32(%2)\n"
22410 + " movq %%mm1, 40(%2)\n"
22411 + " movq %%mm2, 48(%2)\n"
22412 + " movq %%mm3, 56(%2)\n"
22413 ".section .fixup, \"ax\"\n"
22414 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
22415 + "3:\n"
22416 +
22417 +#ifdef CONFIG_PAX_KERNEXEC
22418 + " movl %%cr0, %0\n"
22419 + " movl %0, %%eax\n"
22420 + " andl $0xFFFEFFFF, %%eax\n"
22421 + " movl %%eax, %%cr0\n"
22422 +#endif
22423 +
22424 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
22425 +
22426 +#ifdef CONFIG_PAX_KERNEXEC
22427 + " movl %0, %%cr0\n"
22428 +#endif
22429 +
22430 " jmp 2b\n"
22431 ".previous\n"
22432 _ASM_EXTABLE(1b, 3b)
22433 - : : "r" (from), "r" (to) : "memory");
22434 + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
22435
22436 from += 64;
22437 to += 64;
22438 diff --git a/arch/x86/lib/msr-reg.S b/arch/x86/lib/msr-reg.S
22439 index 69fa106..adda88b 100644
22440 --- a/arch/x86/lib/msr-reg.S
22441 +++ b/arch/x86/lib/msr-reg.S
22442 @@ -3,6 +3,7 @@
22443 #include <asm/dwarf2.h>
22444 #include <asm/asm.h>
22445 #include <asm/msr.h>
22446 +#include <asm/alternative-asm.h>
22447
22448 #ifdef CONFIG_X86_64
22449 /*
22450 @@ -16,7 +17,7 @@ ENTRY(native_\op\()_safe_regs)
22451 CFI_STARTPROC
22452 pushq_cfi %rbx
22453 pushq_cfi %rbp
22454 - movq %rdi, %r10 /* Save pointer */
22455 + movq %rdi, %r9 /* Save pointer */
22456 xorl %r11d, %r11d /* Return value */
22457 movl (%rdi), %eax
22458 movl 4(%rdi), %ecx
22459 @@ -27,16 +28,17 @@ ENTRY(native_\op\()_safe_regs)
22460 movl 28(%rdi), %edi
22461 CFI_REMEMBER_STATE
22462 1: \op
22463 -2: movl %eax, (%r10)
22464 +2: movl %eax, (%r9)
22465 movl %r11d, %eax /* Return value */
22466 - movl %ecx, 4(%r10)
22467 - movl %edx, 8(%r10)
22468 - movl %ebx, 12(%r10)
22469 - movl %ebp, 20(%r10)
22470 - movl %esi, 24(%r10)
22471 - movl %edi, 28(%r10)
22472 + movl %ecx, 4(%r9)
22473 + movl %edx, 8(%r9)
22474 + movl %ebx, 12(%r9)
22475 + movl %ebp, 20(%r9)
22476 + movl %esi, 24(%r9)
22477 + movl %edi, 28(%r9)
22478 popq_cfi %rbp
22479 popq_cfi %rbx
22480 + pax_force_retaddr
22481 ret
22482 3:
22483 CFI_RESTORE_STATE
22484 diff --git a/arch/x86/lib/putuser.S b/arch/x86/lib/putuser.S
22485 index 7f951c8..ebd573a 100644
22486 --- a/arch/x86/lib/putuser.S
22487 +++ b/arch/x86/lib/putuser.S
22488 @@ -15,7 +15,9 @@
22489 #include <asm/thread_info.h>
22490 #include <asm/errno.h>
22491 #include <asm/asm.h>
22492 -
22493 +#include <asm/segment.h>
22494 +#include <asm/pgtable.h>
22495 +#include <asm/alternative-asm.h>
22496
22497 /*
22498 * __put_user_X
22499 @@ -29,52 +31,119 @@
22500 * as they get called from within inline assembly.
22501 */
22502
22503 -#define ENTER CFI_STARTPROC ; \
22504 - GET_THREAD_INFO(%_ASM_BX)
22505 -#define EXIT ret ; \
22506 +#define ENTER CFI_STARTPROC
22507 +#define EXIT pax_force_retaddr; ret ; \
22508 CFI_ENDPROC
22509
22510 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
22511 +#define _DEST %_ASM_CX,%_ASM_BX
22512 +#else
22513 +#define _DEST %_ASM_CX
22514 +#endif
22515 +
22516 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
22517 +#define __copyuser_seg gs;
22518 +#else
22519 +#define __copyuser_seg
22520 +#endif
22521 +
22522 .text
22523 ENTRY(__put_user_1)
22524 ENTER
22525 +
22526 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
22527 + GET_THREAD_INFO(%_ASM_BX)
22528 cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
22529 jae bad_put_user
22530 -1: movb %al,(%_ASM_CX)
22531 +
22532 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
22533 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
22534 + cmp %_ASM_BX,%_ASM_CX
22535 + jb 1234f
22536 + xor %ebx,%ebx
22537 +1234:
22538 +#endif
22539 +
22540 +#endif
22541 +
22542 +1: __copyuser_seg movb %al,(_DEST)
22543 xor %eax,%eax
22544 EXIT
22545 ENDPROC(__put_user_1)
22546
22547 ENTRY(__put_user_2)
22548 ENTER
22549 +
22550 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
22551 + GET_THREAD_INFO(%_ASM_BX)
22552 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
22553 sub $1,%_ASM_BX
22554 cmp %_ASM_BX,%_ASM_CX
22555 jae bad_put_user
22556 -2: movw %ax,(%_ASM_CX)
22557 +
22558 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
22559 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
22560 + cmp %_ASM_BX,%_ASM_CX
22561 + jb 1234f
22562 + xor %ebx,%ebx
22563 +1234:
22564 +#endif
22565 +
22566 +#endif
22567 +
22568 +2: __copyuser_seg movw %ax,(_DEST)
22569 xor %eax,%eax
22570 EXIT
22571 ENDPROC(__put_user_2)
22572
22573 ENTRY(__put_user_4)
22574 ENTER
22575 +
22576 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
22577 + GET_THREAD_INFO(%_ASM_BX)
22578 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
22579 sub $3,%_ASM_BX
22580 cmp %_ASM_BX,%_ASM_CX
22581 jae bad_put_user
22582 -3: movl %eax,(%_ASM_CX)
22583 +
22584 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
22585 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
22586 + cmp %_ASM_BX,%_ASM_CX
22587 + jb 1234f
22588 + xor %ebx,%ebx
22589 +1234:
22590 +#endif
22591 +
22592 +#endif
22593 +
22594 +3: __copyuser_seg movl %eax,(_DEST)
22595 xor %eax,%eax
22596 EXIT
22597 ENDPROC(__put_user_4)
22598
22599 ENTRY(__put_user_8)
22600 ENTER
22601 +
22602 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
22603 + GET_THREAD_INFO(%_ASM_BX)
22604 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
22605 sub $7,%_ASM_BX
22606 cmp %_ASM_BX,%_ASM_CX
22607 jae bad_put_user
22608 -4: mov %_ASM_AX,(%_ASM_CX)
22609 +
22610 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
22611 + mov $PAX_USER_SHADOW_BASE,%_ASM_BX
22612 + cmp %_ASM_BX,%_ASM_CX
22613 + jb 1234f
22614 + xor %ebx,%ebx
22615 +1234:
22616 +#endif
22617 +
22618 +#endif
22619 +
22620 +4: __copyuser_seg mov %_ASM_AX,(_DEST)
22621 #ifdef CONFIG_X86_32
22622 -5: movl %edx,4(%_ASM_CX)
22623 +5: __copyuser_seg movl %edx,4(_DEST)
22624 #endif
22625 xor %eax,%eax
22626 EXIT
22627 diff --git a/arch/x86/lib/rwlock.S b/arch/x86/lib/rwlock.S
22628 index 1cad221..de671ee 100644
22629 --- a/arch/x86/lib/rwlock.S
22630 +++ b/arch/x86/lib/rwlock.S
22631 @@ -16,13 +16,34 @@ ENTRY(__write_lock_failed)
22632 FRAME
22633 0: LOCK_PREFIX
22634 WRITE_LOCK_ADD($RW_LOCK_BIAS) (%__lock_ptr)
22635 +
22636 +#ifdef CONFIG_PAX_REFCOUNT
22637 + jno 1234f
22638 + LOCK_PREFIX
22639 + WRITE_LOCK_SUB($RW_LOCK_BIAS) (%__lock_ptr)
22640 + int $4
22641 +1234:
22642 + _ASM_EXTABLE(1234b, 1234b)
22643 +#endif
22644 +
22645 1: rep; nop
22646 cmpl $WRITE_LOCK_CMP, (%__lock_ptr)
22647 jne 1b
22648 LOCK_PREFIX
22649 WRITE_LOCK_SUB($RW_LOCK_BIAS) (%__lock_ptr)
22650 +
22651 +#ifdef CONFIG_PAX_REFCOUNT
22652 + jno 1234f
22653 + LOCK_PREFIX
22654 + WRITE_LOCK_ADD($RW_LOCK_BIAS) (%__lock_ptr)
22655 + int $4
22656 +1234:
22657 + _ASM_EXTABLE(1234b, 1234b)
22658 +#endif
22659 +
22660 jnz 0b
22661 ENDFRAME
22662 + pax_force_retaddr
22663 ret
22664 CFI_ENDPROC
22665 END(__write_lock_failed)
22666 @@ -32,13 +53,34 @@ ENTRY(__read_lock_failed)
22667 FRAME
22668 0: LOCK_PREFIX
22669 READ_LOCK_SIZE(inc) (%__lock_ptr)
22670 +
22671 +#ifdef CONFIG_PAX_REFCOUNT
22672 + jno 1234f
22673 + LOCK_PREFIX
22674 + READ_LOCK_SIZE(dec) (%__lock_ptr)
22675 + int $4
22676 +1234:
22677 + _ASM_EXTABLE(1234b, 1234b)
22678 +#endif
22679 +
22680 1: rep; nop
22681 READ_LOCK_SIZE(cmp) $1, (%__lock_ptr)
22682 js 1b
22683 LOCK_PREFIX
22684 READ_LOCK_SIZE(dec) (%__lock_ptr)
22685 +
22686 +#ifdef CONFIG_PAX_REFCOUNT
22687 + jno 1234f
22688 + LOCK_PREFIX
22689 + READ_LOCK_SIZE(inc) (%__lock_ptr)
22690 + int $4
22691 +1234:
22692 + _ASM_EXTABLE(1234b, 1234b)
22693 +#endif
22694 +
22695 js 0b
22696 ENDFRAME
22697 + pax_force_retaddr
22698 ret
22699 CFI_ENDPROC
22700 END(__read_lock_failed)
22701 diff --git a/arch/x86/lib/rwsem.S b/arch/x86/lib/rwsem.S
22702 index 5dff5f0..cadebf4 100644
22703 --- a/arch/x86/lib/rwsem.S
22704 +++ b/arch/x86/lib/rwsem.S
22705 @@ -94,6 +94,7 @@ ENTRY(call_rwsem_down_read_failed)
22706 __ASM_SIZE(pop,_cfi) %__ASM_REG(dx)
22707 CFI_RESTORE __ASM_REG(dx)
22708 restore_common_regs
22709 + pax_force_retaddr
22710 ret
22711 CFI_ENDPROC
22712 ENDPROC(call_rwsem_down_read_failed)
22713 @@ -104,6 +105,7 @@ ENTRY(call_rwsem_down_write_failed)
22714 movq %rax,%rdi
22715 call rwsem_down_write_failed
22716 restore_common_regs
22717 + pax_force_retaddr
22718 ret
22719 CFI_ENDPROC
22720 ENDPROC(call_rwsem_down_write_failed)
22721 @@ -117,7 +119,8 @@ ENTRY(call_rwsem_wake)
22722 movq %rax,%rdi
22723 call rwsem_wake
22724 restore_common_regs
22725 -1: ret
22726 +1: pax_force_retaddr
22727 + ret
22728 CFI_ENDPROC
22729 ENDPROC(call_rwsem_wake)
22730
22731 @@ -131,6 +134,7 @@ ENTRY(call_rwsem_downgrade_wake)
22732 __ASM_SIZE(pop,_cfi) %__ASM_REG(dx)
22733 CFI_RESTORE __ASM_REG(dx)
22734 restore_common_regs
22735 + pax_force_retaddr
22736 ret
22737 CFI_ENDPROC
22738 ENDPROC(call_rwsem_downgrade_wake)
22739 diff --git a/arch/x86/lib/thunk_64.S b/arch/x86/lib/thunk_64.S
22740 index a63efd6..ccecad8 100644
22741 --- a/arch/x86/lib/thunk_64.S
22742 +++ b/arch/x86/lib/thunk_64.S
22743 @@ -8,6 +8,7 @@
22744 #include <linux/linkage.h>
22745 #include <asm/dwarf2.h>
22746 #include <asm/calling.h>
22747 +#include <asm/alternative-asm.h>
22748
22749 /* rdi: arg1 ... normal C conventions. rax is saved/restored. */
22750 .macro THUNK name, func, put_ret_addr_in_rdi=0
22751 @@ -41,5 +42,6 @@
22752 SAVE_ARGS
22753 restore:
22754 RESTORE_ARGS
22755 + pax_force_retaddr
22756 ret
22757 CFI_ENDPROC
22758 diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c
22759 index 1781b2f..90368dd 100644
22760 --- a/arch/x86/lib/usercopy_32.c
22761 +++ b/arch/x86/lib/usercopy_32.c
22762 @@ -42,10 +42,12 @@ do { \
22763 int __d0; \
22764 might_fault(); \
22765 __asm__ __volatile__( \
22766 + __COPYUSER_SET_ES \
22767 "0: rep; stosl\n" \
22768 " movl %2,%0\n" \
22769 "1: rep; stosb\n" \
22770 "2:\n" \
22771 + __COPYUSER_RESTORE_ES \
22772 ".section .fixup,\"ax\"\n" \
22773 "3: lea 0(%2,%0,4),%0\n" \
22774 " jmp 2b\n" \
22775 @@ -97,7 +99,7 @@ EXPORT_SYMBOL(__clear_user);
22776
22777 #ifdef CONFIG_X86_INTEL_USERCOPY
22778 static unsigned long
22779 -__copy_user_intel(void __user *to, const void *from, unsigned long size)
22780 +__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
22781 {
22782 int d0, d1;
22783 __asm__ __volatile__(
22784 @@ -109,36 +111,36 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
22785 " .align 2,0x90\n"
22786 "3: movl 0(%4), %%eax\n"
22787 "4: movl 4(%4), %%edx\n"
22788 - "5: movl %%eax, 0(%3)\n"
22789 - "6: movl %%edx, 4(%3)\n"
22790 + "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
22791 + "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
22792 "7: movl 8(%4), %%eax\n"
22793 "8: movl 12(%4),%%edx\n"
22794 - "9: movl %%eax, 8(%3)\n"
22795 - "10: movl %%edx, 12(%3)\n"
22796 + "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
22797 + "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
22798 "11: movl 16(%4), %%eax\n"
22799 "12: movl 20(%4), %%edx\n"
22800 - "13: movl %%eax, 16(%3)\n"
22801 - "14: movl %%edx, 20(%3)\n"
22802 + "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
22803 + "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
22804 "15: movl 24(%4), %%eax\n"
22805 "16: movl 28(%4), %%edx\n"
22806 - "17: movl %%eax, 24(%3)\n"
22807 - "18: movl %%edx, 28(%3)\n"
22808 + "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
22809 + "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
22810 "19: movl 32(%4), %%eax\n"
22811 "20: movl 36(%4), %%edx\n"
22812 - "21: movl %%eax, 32(%3)\n"
22813 - "22: movl %%edx, 36(%3)\n"
22814 + "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
22815 + "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
22816 "23: movl 40(%4), %%eax\n"
22817 "24: movl 44(%4), %%edx\n"
22818 - "25: movl %%eax, 40(%3)\n"
22819 - "26: movl %%edx, 44(%3)\n"
22820 + "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
22821 + "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
22822 "27: movl 48(%4), %%eax\n"
22823 "28: movl 52(%4), %%edx\n"
22824 - "29: movl %%eax, 48(%3)\n"
22825 - "30: movl %%edx, 52(%3)\n"
22826 + "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
22827 + "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
22828 "31: movl 56(%4), %%eax\n"
22829 "32: movl 60(%4), %%edx\n"
22830 - "33: movl %%eax, 56(%3)\n"
22831 - "34: movl %%edx, 60(%3)\n"
22832 + "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
22833 + "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
22834 " addl $-64, %0\n"
22835 " addl $64, %4\n"
22836 " addl $64, %3\n"
22837 @@ -148,10 +150,12 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
22838 " shrl $2, %0\n"
22839 " andl $3, %%eax\n"
22840 " cld\n"
22841 + __COPYUSER_SET_ES
22842 "99: rep; movsl\n"
22843 "36: movl %%eax, %0\n"
22844 "37: rep; movsb\n"
22845 "100:\n"
22846 + __COPYUSER_RESTORE_ES
22847 ".section .fixup,\"ax\"\n"
22848 "101: lea 0(%%eax,%0,4),%0\n"
22849 " jmp 100b\n"
22850 @@ -201,46 +205,150 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
22851 }
22852
22853 static unsigned long
22854 +__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
22855 +{
22856 + int d0, d1;
22857 + __asm__ __volatile__(
22858 + " .align 2,0x90\n"
22859 + "1: "__copyuser_seg" movl 32(%4), %%eax\n"
22860 + " cmpl $67, %0\n"
22861 + " jbe 3f\n"
22862 + "2: "__copyuser_seg" movl 64(%4), %%eax\n"
22863 + " .align 2,0x90\n"
22864 + "3: "__copyuser_seg" movl 0(%4), %%eax\n"
22865 + "4: "__copyuser_seg" movl 4(%4), %%edx\n"
22866 + "5: movl %%eax, 0(%3)\n"
22867 + "6: movl %%edx, 4(%3)\n"
22868 + "7: "__copyuser_seg" movl 8(%4), %%eax\n"
22869 + "8: "__copyuser_seg" movl 12(%4),%%edx\n"
22870 + "9: movl %%eax, 8(%3)\n"
22871 + "10: movl %%edx, 12(%3)\n"
22872 + "11: "__copyuser_seg" movl 16(%4), %%eax\n"
22873 + "12: "__copyuser_seg" movl 20(%4), %%edx\n"
22874 + "13: movl %%eax, 16(%3)\n"
22875 + "14: movl %%edx, 20(%3)\n"
22876 + "15: "__copyuser_seg" movl 24(%4), %%eax\n"
22877 + "16: "__copyuser_seg" movl 28(%4), %%edx\n"
22878 + "17: movl %%eax, 24(%3)\n"
22879 + "18: movl %%edx, 28(%3)\n"
22880 + "19: "__copyuser_seg" movl 32(%4), %%eax\n"
22881 + "20: "__copyuser_seg" movl 36(%4), %%edx\n"
22882 + "21: movl %%eax, 32(%3)\n"
22883 + "22: movl %%edx, 36(%3)\n"
22884 + "23: "__copyuser_seg" movl 40(%4), %%eax\n"
22885 + "24: "__copyuser_seg" movl 44(%4), %%edx\n"
22886 + "25: movl %%eax, 40(%3)\n"
22887 + "26: movl %%edx, 44(%3)\n"
22888 + "27: "__copyuser_seg" movl 48(%4), %%eax\n"
22889 + "28: "__copyuser_seg" movl 52(%4), %%edx\n"
22890 + "29: movl %%eax, 48(%3)\n"
22891 + "30: movl %%edx, 52(%3)\n"
22892 + "31: "__copyuser_seg" movl 56(%4), %%eax\n"
22893 + "32: "__copyuser_seg" movl 60(%4), %%edx\n"
22894 + "33: movl %%eax, 56(%3)\n"
22895 + "34: movl %%edx, 60(%3)\n"
22896 + " addl $-64, %0\n"
22897 + " addl $64, %4\n"
22898 + " addl $64, %3\n"
22899 + " cmpl $63, %0\n"
22900 + " ja 1b\n"
22901 + "35: movl %0, %%eax\n"
22902 + " shrl $2, %0\n"
22903 + " andl $3, %%eax\n"
22904 + " cld\n"
22905 + "99: rep; "__copyuser_seg" movsl\n"
22906 + "36: movl %%eax, %0\n"
22907 + "37: rep; "__copyuser_seg" movsb\n"
22908 + "100:\n"
22909 + ".section .fixup,\"ax\"\n"
22910 + "101: lea 0(%%eax,%0,4),%0\n"
22911 + " jmp 100b\n"
22912 + ".previous\n"
22913 + _ASM_EXTABLE(1b,100b)
22914 + _ASM_EXTABLE(2b,100b)
22915 + _ASM_EXTABLE(3b,100b)
22916 + _ASM_EXTABLE(4b,100b)
22917 + _ASM_EXTABLE(5b,100b)
22918 + _ASM_EXTABLE(6b,100b)
22919 + _ASM_EXTABLE(7b,100b)
22920 + _ASM_EXTABLE(8b,100b)
22921 + _ASM_EXTABLE(9b,100b)
22922 + _ASM_EXTABLE(10b,100b)
22923 + _ASM_EXTABLE(11b,100b)
22924 + _ASM_EXTABLE(12b,100b)
22925 + _ASM_EXTABLE(13b,100b)
22926 + _ASM_EXTABLE(14b,100b)
22927 + _ASM_EXTABLE(15b,100b)
22928 + _ASM_EXTABLE(16b,100b)
22929 + _ASM_EXTABLE(17b,100b)
22930 + _ASM_EXTABLE(18b,100b)
22931 + _ASM_EXTABLE(19b,100b)
22932 + _ASM_EXTABLE(20b,100b)
22933 + _ASM_EXTABLE(21b,100b)
22934 + _ASM_EXTABLE(22b,100b)
22935 + _ASM_EXTABLE(23b,100b)
22936 + _ASM_EXTABLE(24b,100b)
22937 + _ASM_EXTABLE(25b,100b)
22938 + _ASM_EXTABLE(26b,100b)
22939 + _ASM_EXTABLE(27b,100b)
22940 + _ASM_EXTABLE(28b,100b)
22941 + _ASM_EXTABLE(29b,100b)
22942 + _ASM_EXTABLE(30b,100b)
22943 + _ASM_EXTABLE(31b,100b)
22944 + _ASM_EXTABLE(32b,100b)
22945 + _ASM_EXTABLE(33b,100b)
22946 + _ASM_EXTABLE(34b,100b)
22947 + _ASM_EXTABLE(35b,100b)
22948 + _ASM_EXTABLE(36b,100b)
22949 + _ASM_EXTABLE(37b,100b)
22950 + _ASM_EXTABLE(99b,101b)
22951 + : "=&c"(size), "=&D" (d0), "=&S" (d1)
22952 + : "1"(to), "2"(from), "0"(size)
22953 + : "eax", "edx", "memory");
22954 + return size;
22955 +}
22956 +
22957 +static unsigned long __size_overflow(3)
22958 __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
22959 {
22960 int d0, d1;
22961 __asm__ __volatile__(
22962 " .align 2,0x90\n"
22963 - "0: movl 32(%4), %%eax\n"
22964 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
22965 " cmpl $67, %0\n"
22966 " jbe 2f\n"
22967 - "1: movl 64(%4), %%eax\n"
22968 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
22969 " .align 2,0x90\n"
22970 - "2: movl 0(%4), %%eax\n"
22971 - "21: movl 4(%4), %%edx\n"
22972 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
22973 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
22974 " movl %%eax, 0(%3)\n"
22975 " movl %%edx, 4(%3)\n"
22976 - "3: movl 8(%4), %%eax\n"
22977 - "31: movl 12(%4),%%edx\n"
22978 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
22979 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
22980 " movl %%eax, 8(%3)\n"
22981 " movl %%edx, 12(%3)\n"
22982 - "4: movl 16(%4), %%eax\n"
22983 - "41: movl 20(%4), %%edx\n"
22984 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
22985 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
22986 " movl %%eax, 16(%3)\n"
22987 " movl %%edx, 20(%3)\n"
22988 - "10: movl 24(%4), %%eax\n"
22989 - "51: movl 28(%4), %%edx\n"
22990 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
22991 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
22992 " movl %%eax, 24(%3)\n"
22993 " movl %%edx, 28(%3)\n"
22994 - "11: movl 32(%4), %%eax\n"
22995 - "61: movl 36(%4), %%edx\n"
22996 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
22997 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
22998 " movl %%eax, 32(%3)\n"
22999 " movl %%edx, 36(%3)\n"
23000 - "12: movl 40(%4), %%eax\n"
23001 - "71: movl 44(%4), %%edx\n"
23002 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
23003 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
23004 " movl %%eax, 40(%3)\n"
23005 " movl %%edx, 44(%3)\n"
23006 - "13: movl 48(%4), %%eax\n"
23007 - "81: movl 52(%4), %%edx\n"
23008 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
23009 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
23010 " movl %%eax, 48(%3)\n"
23011 " movl %%edx, 52(%3)\n"
23012 - "14: movl 56(%4), %%eax\n"
23013 - "91: movl 60(%4), %%edx\n"
23014 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
23015 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
23016 " movl %%eax, 56(%3)\n"
23017 " movl %%edx, 60(%3)\n"
23018 " addl $-64, %0\n"
23019 @@ -252,9 +360,9 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
23020 " shrl $2, %0\n"
23021 " andl $3, %%eax\n"
23022 " cld\n"
23023 - "6: rep; movsl\n"
23024 + "6: rep; "__copyuser_seg" movsl\n"
23025 " movl %%eax,%0\n"
23026 - "7: rep; movsb\n"
23027 + "7: rep; "__copyuser_seg" movsb\n"
23028 "8:\n"
23029 ".section .fixup,\"ax\"\n"
23030 "9: lea 0(%%eax,%0,4),%0\n"
23031 @@ -297,48 +405,48 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
23032 * hyoshiok@miraclelinux.com
23033 */
23034
23035 -static unsigned long __copy_user_zeroing_intel_nocache(void *to,
23036 +static unsigned long __size_overflow(3) __copy_user_zeroing_intel_nocache(void *to,
23037 const void __user *from, unsigned long size)
23038 {
23039 int d0, d1;
23040
23041 __asm__ __volatile__(
23042 " .align 2,0x90\n"
23043 - "0: movl 32(%4), %%eax\n"
23044 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
23045 " cmpl $67, %0\n"
23046 " jbe 2f\n"
23047 - "1: movl 64(%4), %%eax\n"
23048 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
23049 " .align 2,0x90\n"
23050 - "2: movl 0(%4), %%eax\n"
23051 - "21: movl 4(%4), %%edx\n"
23052 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
23053 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
23054 " movnti %%eax, 0(%3)\n"
23055 " movnti %%edx, 4(%3)\n"
23056 - "3: movl 8(%4), %%eax\n"
23057 - "31: movl 12(%4),%%edx\n"
23058 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
23059 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
23060 " movnti %%eax, 8(%3)\n"
23061 " movnti %%edx, 12(%3)\n"
23062 - "4: movl 16(%4), %%eax\n"
23063 - "41: movl 20(%4), %%edx\n"
23064 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
23065 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
23066 " movnti %%eax, 16(%3)\n"
23067 " movnti %%edx, 20(%3)\n"
23068 - "10: movl 24(%4), %%eax\n"
23069 - "51: movl 28(%4), %%edx\n"
23070 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
23071 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
23072 " movnti %%eax, 24(%3)\n"
23073 " movnti %%edx, 28(%3)\n"
23074 - "11: movl 32(%4), %%eax\n"
23075 - "61: movl 36(%4), %%edx\n"
23076 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
23077 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
23078 " movnti %%eax, 32(%3)\n"
23079 " movnti %%edx, 36(%3)\n"
23080 - "12: movl 40(%4), %%eax\n"
23081 - "71: movl 44(%4), %%edx\n"
23082 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
23083 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
23084 " movnti %%eax, 40(%3)\n"
23085 " movnti %%edx, 44(%3)\n"
23086 - "13: movl 48(%4), %%eax\n"
23087 - "81: movl 52(%4), %%edx\n"
23088 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
23089 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
23090 " movnti %%eax, 48(%3)\n"
23091 " movnti %%edx, 52(%3)\n"
23092 - "14: movl 56(%4), %%eax\n"
23093 - "91: movl 60(%4), %%edx\n"
23094 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
23095 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
23096 " movnti %%eax, 56(%3)\n"
23097 " movnti %%edx, 60(%3)\n"
23098 " addl $-64, %0\n"
23099 @@ -351,9 +459,9 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
23100 " shrl $2, %0\n"
23101 " andl $3, %%eax\n"
23102 " cld\n"
23103 - "6: rep; movsl\n"
23104 + "6: rep; "__copyuser_seg" movsl\n"
23105 " movl %%eax,%0\n"
23106 - "7: rep; movsb\n"
23107 + "7: rep; "__copyuser_seg" movsb\n"
23108 "8:\n"
23109 ".section .fixup,\"ax\"\n"
23110 "9: lea 0(%%eax,%0,4),%0\n"
23111 @@ -391,48 +499,48 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
23112 return size;
23113 }
23114
23115 -static unsigned long __copy_user_intel_nocache(void *to,
23116 +static unsigned long __size_overflow(3) __copy_user_intel_nocache(void *to,
23117 const void __user *from, unsigned long size)
23118 {
23119 int d0, d1;
23120
23121 __asm__ __volatile__(
23122 " .align 2,0x90\n"
23123 - "0: movl 32(%4), %%eax\n"
23124 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
23125 " cmpl $67, %0\n"
23126 " jbe 2f\n"
23127 - "1: movl 64(%4), %%eax\n"
23128 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
23129 " .align 2,0x90\n"
23130 - "2: movl 0(%4), %%eax\n"
23131 - "21: movl 4(%4), %%edx\n"
23132 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
23133 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
23134 " movnti %%eax, 0(%3)\n"
23135 " movnti %%edx, 4(%3)\n"
23136 - "3: movl 8(%4), %%eax\n"
23137 - "31: movl 12(%4),%%edx\n"
23138 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
23139 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
23140 " movnti %%eax, 8(%3)\n"
23141 " movnti %%edx, 12(%3)\n"
23142 - "4: movl 16(%4), %%eax\n"
23143 - "41: movl 20(%4), %%edx\n"
23144 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
23145 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
23146 " movnti %%eax, 16(%3)\n"
23147 " movnti %%edx, 20(%3)\n"
23148 - "10: movl 24(%4), %%eax\n"
23149 - "51: movl 28(%4), %%edx\n"
23150 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
23151 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
23152 " movnti %%eax, 24(%3)\n"
23153 " movnti %%edx, 28(%3)\n"
23154 - "11: movl 32(%4), %%eax\n"
23155 - "61: movl 36(%4), %%edx\n"
23156 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
23157 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
23158 " movnti %%eax, 32(%3)\n"
23159 " movnti %%edx, 36(%3)\n"
23160 - "12: movl 40(%4), %%eax\n"
23161 - "71: movl 44(%4), %%edx\n"
23162 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
23163 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
23164 " movnti %%eax, 40(%3)\n"
23165 " movnti %%edx, 44(%3)\n"
23166 - "13: movl 48(%4), %%eax\n"
23167 - "81: movl 52(%4), %%edx\n"
23168 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
23169 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
23170 " movnti %%eax, 48(%3)\n"
23171 " movnti %%edx, 52(%3)\n"
23172 - "14: movl 56(%4), %%eax\n"
23173 - "91: movl 60(%4), %%edx\n"
23174 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
23175 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
23176 " movnti %%eax, 56(%3)\n"
23177 " movnti %%edx, 60(%3)\n"
23178 " addl $-64, %0\n"
23179 @@ -445,9 +553,9 @@ static unsigned long __copy_user_intel_nocache(void *to,
23180 " shrl $2, %0\n"
23181 " andl $3, %%eax\n"
23182 " cld\n"
23183 - "6: rep; movsl\n"
23184 + "6: rep; "__copyuser_seg" movsl\n"
23185 " movl %%eax,%0\n"
23186 - "7: rep; movsb\n"
23187 + "7: rep; "__copyuser_seg" movsb\n"
23188 "8:\n"
23189 ".section .fixup,\"ax\"\n"
23190 "9: lea 0(%%eax,%0,4),%0\n"
23191 @@ -487,32 +595,36 @@ static unsigned long __copy_user_intel_nocache(void *to,
23192 */
23193 unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
23194 unsigned long size);
23195 -unsigned long __copy_user_intel(void __user *to, const void *from,
23196 +unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
23197 + unsigned long size);
23198 +unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
23199 unsigned long size);
23200 unsigned long __copy_user_zeroing_intel_nocache(void *to,
23201 const void __user *from, unsigned long size);
23202 #endif /* CONFIG_X86_INTEL_USERCOPY */
23203
23204 /* Generic arbitrary sized copy. */
23205 -#define __copy_user(to, from, size) \
23206 +#define __copy_user(to, from, size, prefix, set, restore) \
23207 do { \
23208 int __d0, __d1, __d2; \
23209 __asm__ __volatile__( \
23210 + set \
23211 " cmp $7,%0\n" \
23212 " jbe 1f\n" \
23213 " movl %1,%0\n" \
23214 " negl %0\n" \
23215 " andl $7,%0\n" \
23216 " subl %0,%3\n" \
23217 - "4: rep; movsb\n" \
23218 + "4: rep; "prefix"movsb\n" \
23219 " movl %3,%0\n" \
23220 " shrl $2,%0\n" \
23221 " andl $3,%3\n" \
23222 " .align 2,0x90\n" \
23223 - "0: rep; movsl\n" \
23224 + "0: rep; "prefix"movsl\n" \
23225 " movl %3,%0\n" \
23226 - "1: rep; movsb\n" \
23227 + "1: rep; "prefix"movsb\n" \
23228 "2:\n" \
23229 + restore \
23230 ".section .fixup,\"ax\"\n" \
23231 "5: addl %3,%0\n" \
23232 " jmp 2b\n" \
23233 @@ -537,14 +649,14 @@ do { \
23234 " negl %0\n" \
23235 " andl $7,%0\n" \
23236 " subl %0,%3\n" \
23237 - "4: rep; movsb\n" \
23238 + "4: rep; "__copyuser_seg"movsb\n" \
23239 " movl %3,%0\n" \
23240 " shrl $2,%0\n" \
23241 " andl $3,%3\n" \
23242 " .align 2,0x90\n" \
23243 - "0: rep; movsl\n" \
23244 + "0: rep; "__copyuser_seg"movsl\n" \
23245 " movl %3,%0\n" \
23246 - "1: rep; movsb\n" \
23247 + "1: rep; "__copyuser_seg"movsb\n" \
23248 "2:\n" \
23249 ".section .fixup,\"ax\"\n" \
23250 "5: addl %3,%0\n" \
23251 @@ -627,9 +739,9 @@ survive:
23252 }
23253 #endif
23254 if (movsl_is_ok(to, from, n))
23255 - __copy_user(to, from, n);
23256 + __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
23257 else
23258 - n = __copy_user_intel(to, from, n);
23259 + n = __generic_copy_to_user_intel(to, from, n);
23260 return n;
23261 }
23262 EXPORT_SYMBOL(__copy_to_user_ll);
23263 @@ -649,10 +761,9 @@ unsigned long __copy_from_user_ll_nozero(void *to, const void __user *from,
23264 unsigned long n)
23265 {
23266 if (movsl_is_ok(to, from, n))
23267 - __copy_user(to, from, n);
23268 + __copy_user(to, from, n, __copyuser_seg, "", "");
23269 else
23270 - n = __copy_user_intel((void __user *)to,
23271 - (const void *)from, n);
23272 + n = __generic_copy_from_user_intel(to, from, n);
23273 return n;
23274 }
23275 EXPORT_SYMBOL(__copy_from_user_ll_nozero);
23276 @@ -679,65 +790,50 @@ unsigned long __copy_from_user_ll_nocache_nozero(void *to, const void __user *fr
23277 if (n > 64 && cpu_has_xmm2)
23278 n = __copy_user_intel_nocache(to, from, n);
23279 else
23280 - __copy_user(to, from, n);
23281 + __copy_user(to, from, n, __copyuser_seg, "", "");
23282 #else
23283 - __copy_user(to, from, n);
23284 + __copy_user(to, from, n, __copyuser_seg, "", "");
23285 #endif
23286 return n;
23287 }
23288 EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
23289
23290 -/**
23291 - * copy_to_user: - Copy a block of data into user space.
23292 - * @to: Destination address, in user space.
23293 - * @from: Source address, in kernel space.
23294 - * @n: Number of bytes to copy.
23295 - *
23296 - * Context: User context only. This function may sleep.
23297 - *
23298 - * Copy data from kernel space to user space.
23299 - *
23300 - * Returns number of bytes that could not be copied.
23301 - * On success, this will be zero.
23302 - */
23303 -unsigned long
23304 -copy_to_user(void __user *to, const void *from, unsigned long n)
23305 -{
23306 - if (access_ok(VERIFY_WRITE, to, n))
23307 - n = __copy_to_user(to, from, n);
23308 - return n;
23309 -}
23310 -EXPORT_SYMBOL(copy_to_user);
23311 -
23312 -/**
23313 - * copy_from_user: - Copy a block of data from user space.
23314 - * @to: Destination address, in kernel space.
23315 - * @from: Source address, in user space.
23316 - * @n: Number of bytes to copy.
23317 - *
23318 - * Context: User context only. This function may sleep.
23319 - *
23320 - * Copy data from user space to kernel space.
23321 - *
23322 - * Returns number of bytes that could not be copied.
23323 - * On success, this will be zero.
23324 - *
23325 - * If some data could not be copied, this function will pad the copied
23326 - * data to the requested size using zero bytes.
23327 - */
23328 -unsigned long
23329 -_copy_from_user(void *to, const void __user *from, unsigned long n)
23330 -{
23331 - if (access_ok(VERIFY_READ, from, n))
23332 - n = __copy_from_user(to, from, n);
23333 - else
23334 - memset(to, 0, n);
23335 - return n;
23336 -}
23337 -EXPORT_SYMBOL(_copy_from_user);
23338 -
23339 void copy_from_user_overflow(void)
23340 {
23341 WARN(1, "Buffer overflow detected!\n");
23342 }
23343 EXPORT_SYMBOL(copy_from_user_overflow);
23344 +
23345 +void copy_to_user_overflow(void)
23346 +{
23347 + WARN(1, "Buffer overflow detected!\n");
23348 +}
23349 +EXPORT_SYMBOL(copy_to_user_overflow);
23350 +
23351 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23352 +void __set_fs(mm_segment_t x)
23353 +{
23354 + switch (x.seg) {
23355 + case 0:
23356 + loadsegment(gs, 0);
23357 + break;
23358 + case TASK_SIZE_MAX:
23359 + loadsegment(gs, __USER_DS);
23360 + break;
23361 + case -1UL:
23362 + loadsegment(gs, __KERNEL_DS);
23363 + break;
23364 + default:
23365 + BUG();
23366 + }
23367 + return;
23368 +}
23369 +EXPORT_SYMBOL(__set_fs);
23370 +
23371 +void set_fs(mm_segment_t x)
23372 +{
23373 + current_thread_info()->addr_limit = x;
23374 + __set_fs(x);
23375 +}
23376 +EXPORT_SYMBOL(set_fs);
23377 +#endif
23378 diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
23379 index e5b130b..6690d31 100644
23380 --- a/arch/x86/lib/usercopy_64.c
23381 +++ b/arch/x86/lib/usercopy_64.c
23382 @@ -16,6 +16,12 @@ unsigned long __clear_user(void __user *addr, unsigned long size)
23383 {
23384 long __d0;
23385 might_fault();
23386 +
23387 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23388 + if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
23389 + addr += PAX_USER_SHADOW_BASE;
23390 +#endif
23391 +
23392 /* no memory constraint because it doesn't change any memory gcc knows
23393 about */
23394 asm volatile(
23395 @@ -52,12 +58,20 @@ unsigned long clear_user(void __user *to, unsigned long n)
23396 }
23397 EXPORT_SYMBOL(clear_user);
23398
23399 -unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
23400 +unsigned long copy_in_user(void __user *to, const void __user *from, unsigned long len)
23401 {
23402 - if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
23403 - return copy_user_generic((__force void *)to, (__force void *)from, len);
23404 - }
23405 - return len;
23406 + if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
23407 +
23408 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23409 + if ((unsigned long)to < PAX_USER_SHADOW_BASE)
23410 + to += PAX_USER_SHADOW_BASE;
23411 + if ((unsigned long)from < PAX_USER_SHADOW_BASE)
23412 + from += PAX_USER_SHADOW_BASE;
23413 +#endif
23414 +
23415 + return copy_user_generic((void __force_kernel *)to, (void __force_kernel *)from, len);
23416 + }
23417 + return len;
23418 }
23419 EXPORT_SYMBOL(copy_in_user);
23420
23421 @@ -67,7 +81,7 @@ EXPORT_SYMBOL(copy_in_user);
23422 * it is not necessary to optimize tail handling.
23423 */
23424 unsigned long
23425 -copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
23426 +copy_user_handle_tail(char __user *to, char __user *from, unsigned long len, unsigned zerorest)
23427 {
23428 char c;
23429 unsigned zero_len;
23430 @@ -84,3 +98,15 @@ copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
23431 break;
23432 return len;
23433 }
23434 +
23435 +void copy_from_user_overflow(void)
23436 +{
23437 + WARN(1, "Buffer overflow detected!\n");
23438 +}
23439 +EXPORT_SYMBOL(copy_from_user_overflow);
23440 +
23441 +void copy_to_user_overflow(void)
23442 +{
23443 + WARN(1, "Buffer overflow detected!\n");
23444 +}
23445 +EXPORT_SYMBOL(copy_to_user_overflow);
23446 diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
23447 index 903ec1e..c4166b2 100644
23448 --- a/arch/x86/mm/extable.c
23449 +++ b/arch/x86/mm/extable.c
23450 @@ -6,12 +6,24 @@
23451 static inline unsigned long
23452 ex_insn_addr(const struct exception_table_entry *x)
23453 {
23454 - return (unsigned long)&x->insn + x->insn;
23455 + unsigned long reloc = 0;
23456 +
23457 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
23458 + reloc = ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
23459 +#endif
23460 +
23461 + return (unsigned long)&x->insn + x->insn + reloc;
23462 }
23463 static inline unsigned long
23464 ex_fixup_addr(const struct exception_table_entry *x)
23465 {
23466 - return (unsigned long)&x->fixup + x->fixup;
23467 + unsigned long reloc = 0;
23468 +
23469 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
23470 + reloc = ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
23471 +#endif
23472 +
23473 + return (unsigned long)&x->fixup + x->fixup + reloc;
23474 }
23475
23476 int fixup_exception(struct pt_regs *regs)
23477 @@ -20,7 +32,7 @@ int fixup_exception(struct pt_regs *regs)
23478 unsigned long new_ip;
23479
23480 #ifdef CONFIG_PNPBIOS
23481 - if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
23482 + if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
23483 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
23484 extern u32 pnp_bios_is_utter_crap;
23485 pnp_bios_is_utter_crap = 1;
23486 @@ -145,6 +157,13 @@ void sort_extable(struct exception_table_entry *start,
23487 i += 4;
23488 p->fixup -= i;
23489 i += 4;
23490 +
23491 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
23492 + BUILD_BUG_ON(!IS_ENABLED(CONFIG_BUILDTIME_EXTABLE_SORT));
23493 + p->insn -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
23494 + p->fixup -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
23495 +#endif
23496 +
23497 }
23498 }
23499
23500 diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
23501 index 76dcd9d..e9dffde 100644
23502 --- a/arch/x86/mm/fault.c
23503 +++ b/arch/x86/mm/fault.c
23504 @@ -13,11 +13,18 @@
23505 #include <linux/perf_event.h> /* perf_sw_event */
23506 #include <linux/hugetlb.h> /* hstate_index_to_shift */
23507 #include <linux/prefetch.h> /* prefetchw */
23508 +#include <linux/unistd.h>
23509 +#include <linux/compiler.h>
23510
23511 #include <asm/traps.h> /* dotraplinkage, ... */
23512 #include <asm/pgalloc.h> /* pgd_*(), ... */
23513 #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
23514 #include <asm/fixmap.h> /* VSYSCALL_START */
23515 +#include <asm/tlbflush.h>
23516 +
23517 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
23518 +#include <asm/stacktrace.h>
23519 +#endif
23520
23521 /*
23522 * Page fault error code bits:
23523 @@ -55,7 +62,7 @@ static inline int __kprobes notify_page_fault(struct pt_regs *regs)
23524 int ret = 0;
23525
23526 /* kprobe_running() needs smp_processor_id() */
23527 - if (kprobes_built_in() && !user_mode_vm(regs)) {
23528 + if (kprobes_built_in() && !user_mode(regs)) {
23529 preempt_disable();
23530 if (kprobe_running() && kprobe_fault_handler(regs, 14))
23531 ret = 1;
23532 @@ -116,7 +123,10 @@ check_prefetch_opcode(struct pt_regs *regs, unsigned char *instr,
23533 return !instr_lo || (instr_lo>>1) == 1;
23534 case 0x00:
23535 /* Prefetch instruction is 0x0F0D or 0x0F18 */
23536 - if (probe_kernel_address(instr, opcode))
23537 + if (user_mode(regs)) {
23538 + if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
23539 + return 0;
23540 + } else if (probe_kernel_address(instr, opcode))
23541 return 0;
23542
23543 *prefetch = (instr_lo == 0xF) &&
23544 @@ -150,7 +160,10 @@ is_prefetch(struct pt_regs *regs, unsigned long error_code, unsigned long addr)
23545 while (instr < max_instr) {
23546 unsigned char opcode;
23547
23548 - if (probe_kernel_address(instr, opcode))
23549 + if (user_mode(regs)) {
23550 + if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
23551 + break;
23552 + } else if (probe_kernel_address(instr, opcode))
23553 break;
23554
23555 instr++;
23556 @@ -181,6 +194,34 @@ force_sig_info_fault(int si_signo, int si_code, unsigned long address,
23557 force_sig_info(si_signo, &info, tsk);
23558 }
23559
23560 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
23561 +static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address);
23562 +#endif
23563 +
23564 +#ifdef CONFIG_PAX_EMUTRAMP
23565 +static int pax_handle_fetch_fault(struct pt_regs *regs);
23566 +#endif
23567 +
23568 +#ifdef CONFIG_PAX_PAGEEXEC
23569 +static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
23570 +{
23571 + pgd_t *pgd;
23572 + pud_t *pud;
23573 + pmd_t *pmd;
23574 +
23575 + pgd = pgd_offset(mm, address);
23576 + if (!pgd_present(*pgd))
23577 + return NULL;
23578 + pud = pud_offset(pgd, address);
23579 + if (!pud_present(*pud))
23580 + return NULL;
23581 + pmd = pmd_offset(pud, address);
23582 + if (!pmd_present(*pmd))
23583 + return NULL;
23584 + return pmd;
23585 +}
23586 +#endif
23587 +
23588 DEFINE_SPINLOCK(pgd_lock);
23589 LIST_HEAD(pgd_list);
23590
23591 @@ -231,10 +272,22 @@ void vmalloc_sync_all(void)
23592 for (address = VMALLOC_START & PMD_MASK;
23593 address >= TASK_SIZE && address < FIXADDR_TOP;
23594 address += PMD_SIZE) {
23595 +
23596 +#ifdef CONFIG_PAX_PER_CPU_PGD
23597 + unsigned long cpu;
23598 +#else
23599 struct page *page;
23600 +#endif
23601
23602 spin_lock(&pgd_lock);
23603 +
23604 +#ifdef CONFIG_PAX_PER_CPU_PGD
23605 + for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
23606 + pgd_t *pgd = get_cpu_pgd(cpu);
23607 + pmd_t *ret;
23608 +#else
23609 list_for_each_entry(page, &pgd_list, lru) {
23610 + pgd_t *pgd = page_address(page);
23611 spinlock_t *pgt_lock;
23612 pmd_t *ret;
23613
23614 @@ -242,8 +295,13 @@ void vmalloc_sync_all(void)
23615 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
23616
23617 spin_lock(pgt_lock);
23618 - ret = vmalloc_sync_one(page_address(page), address);
23619 +#endif
23620 +
23621 + ret = vmalloc_sync_one(pgd, address);
23622 +
23623 +#ifndef CONFIG_PAX_PER_CPU_PGD
23624 spin_unlock(pgt_lock);
23625 +#endif
23626
23627 if (!ret)
23628 break;
23629 @@ -277,6 +335,11 @@ static noinline __kprobes int vmalloc_fault(unsigned long address)
23630 * an interrupt in the middle of a task switch..
23631 */
23632 pgd_paddr = read_cr3();
23633 +
23634 +#ifdef CONFIG_PAX_PER_CPU_PGD
23635 + BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
23636 +#endif
23637 +
23638 pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
23639 if (!pmd_k)
23640 return -1;
23641 @@ -372,7 +435,14 @@ static noinline __kprobes int vmalloc_fault(unsigned long address)
23642 * happen within a race in page table update. In the later
23643 * case just flush:
23644 */
23645 +
23646 +#ifdef CONFIG_PAX_PER_CPU_PGD
23647 + BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
23648 + pgd = pgd_offset_cpu(smp_processor_id(), address);
23649 +#else
23650 pgd = pgd_offset(current->active_mm, address);
23651 +#endif
23652 +
23653 pgd_ref = pgd_offset_k(address);
23654 if (pgd_none(*pgd_ref))
23655 return -1;
23656 @@ -540,7 +610,7 @@ static int is_errata93(struct pt_regs *regs, unsigned long address)
23657 static int is_errata100(struct pt_regs *regs, unsigned long address)
23658 {
23659 #ifdef CONFIG_X86_64
23660 - if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
23661 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
23662 return 1;
23663 #endif
23664 return 0;
23665 @@ -567,7 +637,7 @@ static int is_f00f_bug(struct pt_regs *regs, unsigned long address)
23666 }
23667
23668 static const char nx_warning[] = KERN_CRIT
23669 -"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
23670 +"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
23671
23672 static void
23673 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
23674 @@ -576,15 +646,26 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
23675 if (!oops_may_print())
23676 return;
23677
23678 - if (error_code & PF_INSTR) {
23679 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) {
23680 unsigned int level;
23681
23682 pte_t *pte = lookup_address(address, &level);
23683
23684 if (pte && pte_present(*pte) && !pte_exec(*pte))
23685 - printk(nx_warning, from_kuid(&init_user_ns, current_uid()));
23686 + printk(nx_warning, from_kuid(&init_user_ns, current_uid()), current->comm, task_pid_nr(current));
23687 }
23688
23689 +#ifdef CONFIG_PAX_KERNEXEC
23690 + if (init_mm.start_code <= address && address < init_mm.end_code) {
23691 + if (current->signal->curr_ip)
23692 + printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
23693 + &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
23694 + else
23695 + printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
23696 + current->comm, task_pid_nr(current), current_uid(), current_euid());
23697 + }
23698 +#endif
23699 +
23700 printk(KERN_ALERT "BUG: unable to handle kernel ");
23701 if (address < PAGE_SIZE)
23702 printk(KERN_CONT "NULL pointer dereference");
23703 @@ -748,6 +829,21 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
23704 }
23705 #endif
23706
23707 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
23708 + if (pax_is_fetch_fault(regs, error_code, address)) {
23709 +
23710 +#ifdef CONFIG_PAX_EMUTRAMP
23711 + switch (pax_handle_fetch_fault(regs)) {
23712 + case 2:
23713 + return;
23714 + }
23715 +#endif
23716 +
23717 + pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
23718 + do_group_exit(SIGKILL);
23719 + }
23720 +#endif
23721 +
23722 if (unlikely(show_unhandled_signals))
23723 show_signal_msg(regs, error_code, address, tsk);
23724
23725 @@ -844,7 +940,7 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
23726 if (fault & (VM_FAULT_HWPOISON|VM_FAULT_HWPOISON_LARGE)) {
23727 printk(KERN_ERR
23728 "MCE: Killing %s:%d due to hardware memory corruption fault at %lx\n",
23729 - tsk->comm, tsk->pid, address);
23730 + tsk->comm, task_pid_nr(tsk), address);
23731 code = BUS_MCEERR_AR;
23732 }
23733 #endif
23734 @@ -900,6 +996,99 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
23735 return 1;
23736 }
23737
23738 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
23739 +static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
23740 +{
23741 + pte_t *pte;
23742 + pmd_t *pmd;
23743 + spinlock_t *ptl;
23744 + unsigned char pte_mask;
23745 +
23746 + if ((__supported_pte_mask & _PAGE_NX) || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
23747 + !(mm->pax_flags & MF_PAX_PAGEEXEC))
23748 + return 0;
23749 +
23750 + /* PaX: it's our fault, let's handle it if we can */
23751 +
23752 + /* PaX: take a look at read faults before acquiring any locks */
23753 + if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
23754 + /* instruction fetch attempt from a protected page in user mode */
23755 + up_read(&mm->mmap_sem);
23756 +
23757 +#ifdef CONFIG_PAX_EMUTRAMP
23758 + switch (pax_handle_fetch_fault(regs)) {
23759 + case 2:
23760 + return 1;
23761 + }
23762 +#endif
23763 +
23764 + pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
23765 + do_group_exit(SIGKILL);
23766 + }
23767 +
23768 + pmd = pax_get_pmd(mm, address);
23769 + if (unlikely(!pmd))
23770 + return 0;
23771 +
23772 + pte = pte_offset_map_lock(mm, pmd, address, &ptl);
23773 + if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
23774 + pte_unmap_unlock(pte, ptl);
23775 + return 0;
23776 + }
23777 +
23778 + if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
23779 + /* write attempt to a protected page in user mode */
23780 + pte_unmap_unlock(pte, ptl);
23781 + return 0;
23782 + }
23783 +
23784 +#ifdef CONFIG_SMP
23785 + if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
23786 +#else
23787 + if (likely(address > get_limit(regs->cs)))
23788 +#endif
23789 + {
23790 + set_pte(pte, pte_mkread(*pte));
23791 + __flush_tlb_one(address);
23792 + pte_unmap_unlock(pte, ptl);
23793 + up_read(&mm->mmap_sem);
23794 + return 1;
23795 + }
23796 +
23797 + pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
23798 +
23799 + /*
23800 + * PaX: fill DTLB with user rights and retry
23801 + */
23802 + __asm__ __volatile__ (
23803 + "orb %2,(%1)\n"
23804 +#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
23805 +/*
23806 + * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
23807 + * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
23808 + * page fault when examined during a TLB load attempt. this is true not only
23809 + * for PTEs holding a non-present entry but also present entries that will
23810 + * raise a page fault (such as those set up by PaX, or the copy-on-write
23811 + * mechanism). in effect it means that we do *not* need to flush the TLBs
23812 + * for our target pages since their PTEs are simply not in the TLBs at all.
23813 +
23814 + * the best thing in omitting it is that we gain around 15-20% speed in the
23815 + * fast path of the page fault handler and can get rid of tracing since we
23816 + * can no longer flush unintended entries.
23817 + */
23818 + "invlpg (%0)\n"
23819 +#endif
23820 + __copyuser_seg"testb $0,(%0)\n"
23821 + "xorb %3,(%1)\n"
23822 + :
23823 + : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
23824 + : "memory", "cc");
23825 + pte_unmap_unlock(pte, ptl);
23826 + up_read(&mm->mmap_sem);
23827 + return 1;
23828 +}
23829 +#endif
23830 +
23831 /*
23832 * Handle a spurious fault caused by a stale TLB entry.
23833 *
23834 @@ -972,6 +1161,9 @@ int show_unhandled_signals = 1;
23835 static inline int
23836 access_error(unsigned long error_code, struct vm_area_struct *vma)
23837 {
23838 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
23839 + return 1;
23840 +
23841 if (error_code & PF_WRITE) {
23842 /* write, present and write, not present: */
23843 if (unlikely(!(vma->vm_flags & VM_WRITE)))
23844 @@ -1005,18 +1197,33 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
23845 {
23846 struct vm_area_struct *vma;
23847 struct task_struct *tsk;
23848 - unsigned long address;
23849 struct mm_struct *mm;
23850 int fault;
23851 int write = error_code & PF_WRITE;
23852 unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
23853 (write ? FAULT_FLAG_WRITE : 0);
23854
23855 - tsk = current;
23856 - mm = tsk->mm;
23857 -
23858 /* Get the faulting address: */
23859 - address = read_cr2();
23860 + unsigned long address = read_cr2();
23861 +
23862 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
23863 + if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
23864 + if (!search_exception_tables(regs->ip)) {
23865 + printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
23866 + bad_area_nosemaphore(regs, error_code, address);
23867 + return;
23868 + }
23869 + if (address < PAX_USER_SHADOW_BASE) {
23870 + printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
23871 + printk(KERN_ERR "PAX: faulting IP: %pS\n", (void *)regs->ip);
23872 + show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
23873 + } else
23874 + address -= PAX_USER_SHADOW_BASE;
23875 + }
23876 +#endif
23877 +
23878 + tsk = current;
23879 + mm = tsk->mm;
23880
23881 /*
23882 * Detect and handle instructions that would cause a page fault for
23883 @@ -1077,7 +1284,7 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
23884 * User-mode registers count as a user access even for any
23885 * potential system fault or CPU buglet:
23886 */
23887 - if (user_mode_vm(regs)) {
23888 + if (user_mode(regs)) {
23889 local_irq_enable();
23890 error_code |= PF_USER;
23891 } else {
23892 @@ -1132,6 +1339,11 @@ retry:
23893 might_sleep();
23894 }
23895
23896 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
23897 + if (pax_handle_pageexec_fault(regs, mm, address, error_code))
23898 + return;
23899 +#endif
23900 +
23901 vma = find_vma(mm, address);
23902 if (unlikely(!vma)) {
23903 bad_area(regs, error_code, address);
23904 @@ -1143,18 +1355,24 @@ retry:
23905 bad_area(regs, error_code, address);
23906 return;
23907 }
23908 - if (error_code & PF_USER) {
23909 - /*
23910 - * Accessing the stack below %sp is always a bug.
23911 - * The large cushion allows instructions like enter
23912 - * and pusha to work. ("enter $65535, $31" pushes
23913 - * 32 pointers and then decrements %sp by 65535.)
23914 - */
23915 - if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
23916 - bad_area(regs, error_code, address);
23917 - return;
23918 - }
23919 + /*
23920 + * Accessing the stack below %sp is always a bug.
23921 + * The large cushion allows instructions like enter
23922 + * and pusha to work. ("enter $65535, $31" pushes
23923 + * 32 pointers and then decrements %sp by 65535.)
23924 + */
23925 + if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
23926 + bad_area(regs, error_code, address);
23927 + return;
23928 }
23929 +
23930 +#ifdef CONFIG_PAX_SEGMEXEC
23931 + if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
23932 + bad_area(regs, error_code, address);
23933 + return;
23934 + }
23935 +#endif
23936 +
23937 if (unlikely(expand_stack(vma, address))) {
23938 bad_area(regs, error_code, address);
23939 return;
23940 @@ -1209,3 +1427,292 @@ good_area:
23941
23942 up_read(&mm->mmap_sem);
23943 }
23944 +
23945 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
23946 +static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address)
23947 +{
23948 + struct mm_struct *mm = current->mm;
23949 + unsigned long ip = regs->ip;
23950 +
23951 + if (v8086_mode(regs))
23952 + ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
23953 +
23954 +#ifdef CONFIG_PAX_PAGEEXEC
23955 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
23956 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR))
23957 + return true;
23958 + if (!(error_code & (PF_PROT | PF_WRITE)) && ip == address)
23959 + return true;
23960 + return false;
23961 + }
23962 +#endif
23963 +
23964 +#ifdef CONFIG_PAX_SEGMEXEC
23965 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
23966 + if (!(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address))
23967 + return true;
23968 + return false;
23969 + }
23970 +#endif
23971 +
23972 + return false;
23973 +}
23974 +#endif
23975 +
23976 +#ifdef CONFIG_PAX_EMUTRAMP
23977 +static int pax_handle_fetch_fault_32(struct pt_regs *regs)
23978 +{
23979 + int err;
23980 +
23981 + do { /* PaX: libffi trampoline emulation */
23982 + unsigned char mov, jmp;
23983 + unsigned int addr1, addr2;
23984 +
23985 +#ifdef CONFIG_X86_64
23986 + if ((regs->ip + 9) >> 32)
23987 + break;
23988 +#endif
23989 +
23990 + err = get_user(mov, (unsigned char __user *)regs->ip);
23991 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
23992 + err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
23993 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
23994 +
23995 + if (err)
23996 + break;
23997 +
23998 + if (mov == 0xB8 && jmp == 0xE9) {
23999 + regs->ax = addr1;
24000 + regs->ip = (unsigned int)(regs->ip + addr2 + 10);
24001 + return 2;
24002 + }
24003 + } while (0);
24004 +
24005 + do { /* PaX: gcc trampoline emulation #1 */
24006 + unsigned char mov1, mov2;
24007 + unsigned short jmp;
24008 + unsigned int addr1, addr2;
24009 +
24010 +#ifdef CONFIG_X86_64
24011 + if ((regs->ip + 11) >> 32)
24012 + break;
24013 +#endif
24014 +
24015 + err = get_user(mov1, (unsigned char __user *)regs->ip);
24016 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
24017 + err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
24018 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
24019 + err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
24020 +
24021 + if (err)
24022 + break;
24023 +
24024 + if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
24025 + regs->cx = addr1;
24026 + regs->ax = addr2;
24027 + regs->ip = addr2;
24028 + return 2;
24029 + }
24030 + } while (0);
24031 +
24032 + do { /* PaX: gcc trampoline emulation #2 */
24033 + unsigned char mov, jmp;
24034 + unsigned int addr1, addr2;
24035 +
24036 +#ifdef CONFIG_X86_64
24037 + if ((regs->ip + 9) >> 32)
24038 + break;
24039 +#endif
24040 +
24041 + err = get_user(mov, (unsigned char __user *)regs->ip);
24042 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
24043 + err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
24044 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
24045 +
24046 + if (err)
24047 + break;
24048 +
24049 + if (mov == 0xB9 && jmp == 0xE9) {
24050 + regs->cx = addr1;
24051 + regs->ip = (unsigned int)(regs->ip + addr2 + 10);
24052 + return 2;
24053 + }
24054 + } while (0);
24055 +
24056 + return 1; /* PaX in action */
24057 +}
24058 +
24059 +#ifdef CONFIG_X86_64
24060 +static int pax_handle_fetch_fault_64(struct pt_regs *regs)
24061 +{
24062 + int err;
24063 +
24064 + do { /* PaX: libffi trampoline emulation */
24065 + unsigned short mov1, mov2, jmp1;
24066 + unsigned char stcclc, jmp2;
24067 + unsigned long addr1, addr2;
24068 +
24069 + err = get_user(mov1, (unsigned short __user *)regs->ip);
24070 + err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
24071 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
24072 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
24073 + err |= get_user(stcclc, (unsigned char __user *)(regs->ip + 20));
24074 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 21));
24075 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 23));
24076 +
24077 + if (err)
24078 + break;
24079 +
24080 + if (mov1 == 0xBB49 && mov2 == 0xBA49 && (stcclc == 0xF8 || stcclc == 0xF9) && jmp1 == 0xFF49 && jmp2 == 0xE3) {
24081 + regs->r11 = addr1;
24082 + regs->r10 = addr2;
24083 + if (stcclc == 0xF8)
24084 + regs->flags &= ~X86_EFLAGS_CF;
24085 + else
24086 + regs->flags |= X86_EFLAGS_CF;
24087 + regs->ip = addr1;
24088 + return 2;
24089 + }
24090 + } while (0);
24091 +
24092 + do { /* PaX: gcc trampoline emulation #1 */
24093 + unsigned short mov1, mov2, jmp1;
24094 + unsigned char jmp2;
24095 + unsigned int addr1;
24096 + unsigned long addr2;
24097 +
24098 + err = get_user(mov1, (unsigned short __user *)regs->ip);
24099 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
24100 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
24101 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
24102 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
24103 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
24104 +
24105 + if (err)
24106 + break;
24107 +
24108 + if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
24109 + regs->r11 = addr1;
24110 + regs->r10 = addr2;
24111 + regs->ip = addr1;
24112 + return 2;
24113 + }
24114 + } while (0);
24115 +
24116 + do { /* PaX: gcc trampoline emulation #2 */
24117 + unsigned short mov1, mov2, jmp1;
24118 + unsigned char jmp2;
24119 + unsigned long addr1, addr2;
24120 +
24121 + err = get_user(mov1, (unsigned short __user *)regs->ip);
24122 + err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
24123 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
24124 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
24125 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
24126 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
24127 +
24128 + if (err)
24129 + break;
24130 +
24131 + if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
24132 + regs->r11 = addr1;
24133 + regs->r10 = addr2;
24134 + regs->ip = addr1;
24135 + return 2;
24136 + }
24137 + } while (0);
24138 +
24139 + return 1; /* PaX in action */
24140 +}
24141 +#endif
24142 +
24143 +/*
24144 + * PaX: decide what to do with offenders (regs->ip = fault address)
24145 + *
24146 + * returns 1 when task should be killed
24147 + * 2 when gcc trampoline was detected
24148 + */
24149 +static int pax_handle_fetch_fault(struct pt_regs *regs)
24150 +{
24151 + if (v8086_mode(regs))
24152 + return 1;
24153 +
24154 + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
24155 + return 1;
24156 +
24157 +#ifdef CONFIG_X86_32
24158 + return pax_handle_fetch_fault_32(regs);
24159 +#else
24160 + if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
24161 + return pax_handle_fetch_fault_32(regs);
24162 + else
24163 + return pax_handle_fetch_fault_64(regs);
24164 +#endif
24165 +}
24166 +#endif
24167 +
24168 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
24169 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
24170 +{
24171 + long i;
24172 +
24173 + printk(KERN_ERR "PAX: bytes at PC: ");
24174 + for (i = 0; i < 20; i++) {
24175 + unsigned char c;
24176 + if (get_user(c, (unsigned char __force_user *)pc+i))
24177 + printk(KERN_CONT "?? ");
24178 + else
24179 + printk(KERN_CONT "%02x ", c);
24180 + }
24181 + printk("\n");
24182 +
24183 + printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
24184 + for (i = -1; i < 80 / (long)sizeof(long); i++) {
24185 + unsigned long c;
24186 + if (get_user(c, (unsigned long __force_user *)sp+i)) {
24187 +#ifdef CONFIG_X86_32
24188 + printk(KERN_CONT "???????? ");
24189 +#else
24190 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)))
24191 + printk(KERN_CONT "???????? ???????? ");
24192 + else
24193 + printk(KERN_CONT "???????????????? ");
24194 +#endif
24195 + } else {
24196 +#ifdef CONFIG_X86_64
24197 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))) {
24198 + printk(KERN_CONT "%08x ", (unsigned int)c);
24199 + printk(KERN_CONT "%08x ", (unsigned int)(c >> 32));
24200 + } else
24201 +#endif
24202 + printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
24203 + }
24204 + }
24205 + printk("\n");
24206 +}
24207 +#endif
24208 +
24209 +/**
24210 + * probe_kernel_write(): safely attempt to write to a location
24211 + * @dst: address to write to
24212 + * @src: pointer to the data that shall be written
24213 + * @size: size of the data chunk
24214 + *
24215 + * Safely write to address @dst from the buffer at @src. If a kernel fault
24216 + * happens, handle that and return -EFAULT.
24217 + */
24218 +long notrace probe_kernel_write(void *dst, const void *src, size_t size)
24219 +{
24220 + long ret;
24221 + mm_segment_t old_fs = get_fs();
24222 +
24223 + set_fs(KERNEL_DS);
24224 + pagefault_disable();
24225 + pax_open_kernel();
24226 + ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
24227 + pax_close_kernel();
24228 + pagefault_enable();
24229 + set_fs(old_fs);
24230 +
24231 + return ret ? -EFAULT : 0;
24232 +}
24233 diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
24234 index dd74e46..7d26398 100644
24235 --- a/arch/x86/mm/gup.c
24236 +++ b/arch/x86/mm/gup.c
24237 @@ -255,7 +255,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
24238 addr = start;
24239 len = (unsigned long) nr_pages << PAGE_SHIFT;
24240 end = start + len;
24241 - if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
24242 + if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
24243 (void __user *)start, len)))
24244 return 0;
24245
24246 diff --git a/arch/x86/mm/highmem_32.c b/arch/x86/mm/highmem_32.c
24247 index 6f31ee5..8ee4164 100644
24248 --- a/arch/x86/mm/highmem_32.c
24249 +++ b/arch/x86/mm/highmem_32.c
24250 @@ -44,7 +44,11 @@ void *kmap_atomic_prot(struct page *page, pgprot_t prot)
24251 idx = type + KM_TYPE_NR*smp_processor_id();
24252 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
24253 BUG_ON(!pte_none(*(kmap_pte-idx)));
24254 +
24255 + pax_open_kernel();
24256 set_pte(kmap_pte-idx, mk_pte(page, prot));
24257 + pax_close_kernel();
24258 +
24259 arch_flush_lazy_mmu_mode();
24260
24261 return (void *)vaddr;
24262 diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
24263 index b91e485..d00e7c9 100644
24264 --- a/arch/x86/mm/hugetlbpage.c
24265 +++ b/arch/x86/mm/hugetlbpage.c
24266 @@ -277,13 +277,20 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
24267 struct hstate *h = hstate_file(file);
24268 struct mm_struct *mm = current->mm;
24269 struct vm_area_struct *vma;
24270 - unsigned long start_addr;
24271 + unsigned long start_addr, pax_task_size = TASK_SIZE;
24272 +
24273 +#ifdef CONFIG_PAX_SEGMEXEC
24274 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
24275 + pax_task_size = SEGMEXEC_TASK_SIZE;
24276 +#endif
24277 +
24278 + pax_task_size -= PAGE_SIZE;
24279
24280 if (len > mm->cached_hole_size) {
24281 - start_addr = mm->free_area_cache;
24282 + start_addr = mm->free_area_cache;
24283 } else {
24284 - start_addr = TASK_UNMAPPED_BASE;
24285 - mm->cached_hole_size = 0;
24286 + start_addr = mm->mmap_base;
24287 + mm->cached_hole_size = 0;
24288 }
24289
24290 full_search:
24291 @@ -291,26 +298,27 @@ full_search:
24292
24293 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
24294 /* At this point: (!vma || addr < vma->vm_end). */
24295 - if (TASK_SIZE - len < addr) {
24296 + if (pax_task_size - len < addr) {
24297 /*
24298 * Start a new search - just in case we missed
24299 * some holes.
24300 */
24301 - if (start_addr != TASK_UNMAPPED_BASE) {
24302 - start_addr = TASK_UNMAPPED_BASE;
24303 + if (start_addr != mm->mmap_base) {
24304 + start_addr = mm->mmap_base;
24305 mm->cached_hole_size = 0;
24306 goto full_search;
24307 }
24308 return -ENOMEM;
24309 }
24310 - if (!vma || addr + len <= vma->vm_start) {
24311 - mm->free_area_cache = addr + len;
24312 - return addr;
24313 - }
24314 + if (check_heap_stack_gap(vma, addr, len))
24315 + break;
24316 if (addr + mm->cached_hole_size < vma->vm_start)
24317 mm->cached_hole_size = vma->vm_start - addr;
24318 addr = ALIGN(vma->vm_end, huge_page_size(h));
24319 }
24320 +
24321 + mm->free_area_cache = addr + len;
24322 + return addr;
24323 }
24324
24325 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
24326 @@ -321,9 +329,8 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
24327 struct mm_struct *mm = current->mm;
24328 struct vm_area_struct *vma;
24329 unsigned long base = mm->mmap_base;
24330 - unsigned long addr = addr0;
24331 + unsigned long addr;
24332 unsigned long largest_hole = mm->cached_hole_size;
24333 - unsigned long start_addr;
24334
24335 /* don't allow allocations above current base */
24336 if (mm->free_area_cache > base)
24337 @@ -333,16 +340,15 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
24338 largest_hole = 0;
24339 mm->free_area_cache = base;
24340 }
24341 -try_again:
24342 - start_addr = mm->free_area_cache;
24343
24344 /* make sure it can fit in the remaining address space */
24345 if (mm->free_area_cache < len)
24346 goto fail;
24347
24348 /* either no address requested or can't fit in requested address hole */
24349 - addr = (mm->free_area_cache - len) & huge_page_mask(h);
24350 + addr = mm->free_area_cache - len;
24351 do {
24352 + addr &= huge_page_mask(h);
24353 /*
24354 * Lookup failure means no vma is above this address,
24355 * i.e. return with success:
24356 @@ -351,10 +357,10 @@ try_again:
24357 if (!vma)
24358 return addr;
24359
24360 - if (addr + len <= vma->vm_start) {
24361 + if (check_heap_stack_gap(vma, addr, len)) {
24362 /* remember the address as a hint for next time */
24363 - mm->cached_hole_size = largest_hole;
24364 - return (mm->free_area_cache = addr);
24365 + mm->cached_hole_size = largest_hole;
24366 + return (mm->free_area_cache = addr);
24367 } else if (mm->free_area_cache == vma->vm_end) {
24368 /* pull free_area_cache down to the first hole */
24369 mm->free_area_cache = vma->vm_start;
24370 @@ -363,29 +369,34 @@ try_again:
24371
24372 /* remember the largest hole we saw so far */
24373 if (addr + largest_hole < vma->vm_start)
24374 - largest_hole = vma->vm_start - addr;
24375 + largest_hole = vma->vm_start - addr;
24376
24377 /* try just below the current vma->vm_start */
24378 - addr = (vma->vm_start - len) & huge_page_mask(h);
24379 - } while (len <= vma->vm_start);
24380 + addr = skip_heap_stack_gap(vma, len);
24381 + } while (!IS_ERR_VALUE(addr));
24382
24383 fail:
24384 /*
24385 - * if hint left us with no space for the requested
24386 - * mapping then try again:
24387 - */
24388 - if (start_addr != base) {
24389 - mm->free_area_cache = base;
24390 - largest_hole = 0;
24391 - goto try_again;
24392 - }
24393 - /*
24394 * A failed mmap() very likely causes application failure,
24395 * so fall back to the bottom-up function here. This scenario
24396 * can happen with large stack limits and large mmap()
24397 * allocations.
24398 */
24399 - mm->free_area_cache = TASK_UNMAPPED_BASE;
24400 +
24401 +#ifdef CONFIG_PAX_SEGMEXEC
24402 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
24403 + mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
24404 + else
24405 +#endif
24406 +
24407 + mm->mmap_base = TASK_UNMAPPED_BASE;
24408 +
24409 +#ifdef CONFIG_PAX_RANDMMAP
24410 + if (mm->pax_flags & MF_PAX_RANDMMAP)
24411 + mm->mmap_base += mm->delta_mmap;
24412 +#endif
24413 +
24414 + mm->free_area_cache = mm->mmap_base;
24415 mm->cached_hole_size = ~0UL;
24416 addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
24417 len, pgoff, flags);
24418 @@ -393,6 +404,7 @@ fail:
24419 /*
24420 * Restore the topdown base:
24421 */
24422 + mm->mmap_base = base;
24423 mm->free_area_cache = base;
24424 mm->cached_hole_size = ~0UL;
24425
24426 @@ -406,10 +418,19 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
24427 struct hstate *h = hstate_file(file);
24428 struct mm_struct *mm = current->mm;
24429 struct vm_area_struct *vma;
24430 + unsigned long pax_task_size = TASK_SIZE;
24431
24432 if (len & ~huge_page_mask(h))
24433 return -EINVAL;
24434 - if (len > TASK_SIZE)
24435 +
24436 +#ifdef CONFIG_PAX_SEGMEXEC
24437 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
24438 + pax_task_size = SEGMEXEC_TASK_SIZE;
24439 +#endif
24440 +
24441 + pax_task_size -= PAGE_SIZE;
24442 +
24443 + if (len > pax_task_size)
24444 return -ENOMEM;
24445
24446 if (flags & MAP_FIXED) {
24447 @@ -421,8 +442,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
24448 if (addr) {
24449 addr = ALIGN(addr, huge_page_size(h));
24450 vma = find_vma(mm, addr);
24451 - if (TASK_SIZE - len >= addr &&
24452 - (!vma || addr + len <= vma->vm_start))
24453 + if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
24454 return addr;
24455 }
24456 if (mm->get_unmapped_area == arch_get_unmapped_area)
24457 diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
24458 index bc4e9d8..ca4c14b 100644
24459 --- a/arch/x86/mm/init.c
24460 +++ b/arch/x86/mm/init.c
24461 @@ -16,6 +16,8 @@
24462 #include <asm/tlb.h>
24463 #include <asm/proto.h>
24464 #include <asm/dma.h> /* for MAX_DMA_PFN */
24465 +#include <asm/desc.h>
24466 +#include <asm/bios_ebda.h>
24467
24468 unsigned long __initdata pgt_buf_start;
24469 unsigned long __meminitdata pgt_buf_end;
24470 @@ -38,7 +40,7 @@ struct map_range {
24471 static void __init find_early_table_space(struct map_range *mr, unsigned long end,
24472 int use_pse, int use_gbpages)
24473 {
24474 - unsigned long puds, pmds, ptes, tables, start = 0, good_end = end;
24475 + unsigned long puds, pmds, ptes, tables, start = 0x100000, good_end = end;
24476 phys_addr_t base;
24477
24478 puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
24479 @@ -317,10 +319,37 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
24480 * Access has to be given to non-kernel-ram areas as well, these contain the PCI
24481 * mmio resources as well as potential bios/acpi data regions.
24482 */
24483 +
24484 +#ifdef CONFIG_GRKERNSEC_KMEM
24485 +static unsigned int ebda_start __read_only;
24486 +static unsigned int ebda_end __read_only;
24487 +#endif
24488 +
24489 int devmem_is_allowed(unsigned long pagenr)
24490 {
24491 +#ifdef CONFIG_GRKERNSEC_KMEM
24492 + /* allow BDA */
24493 + if (!pagenr)
24494 + return 1;
24495 + /* allow EBDA */
24496 + if (pagenr >= ebda_start && pagenr < ebda_end)
24497 + return 1;
24498 +#else
24499 + if (!pagenr)
24500 + return 1;
24501 +#ifdef CONFIG_VM86
24502 + if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
24503 + return 1;
24504 +#endif
24505 +#endif
24506 +
24507 + if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
24508 + return 1;
24509 +#ifdef CONFIG_GRKERNSEC_KMEM
24510 + /* throw out everything else below 1MB */
24511 if (pagenr <= 256)
24512 - return 1;
24513 + return 0;
24514 +#endif
24515 if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
24516 return 0;
24517 if (!page_is_ram(pagenr))
24518 @@ -377,8 +406,116 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
24519 #endif
24520 }
24521
24522 +#ifdef CONFIG_GRKERNSEC_KMEM
24523 +static inline void gr_init_ebda(void)
24524 +{
24525 + unsigned int ebda_addr;
24526 + unsigned int ebda_size = 0;
24527 +
24528 + ebda_addr = get_bios_ebda();
24529 + if (ebda_addr) {
24530 + ebda_size = *(unsigned char *)phys_to_virt(ebda_addr);
24531 + ebda_size <<= 10;
24532 + }
24533 + if (ebda_addr && ebda_size) {
24534 + ebda_start = ebda_addr >> PAGE_SHIFT;
24535 + ebda_end = min((unsigned int)PAGE_ALIGN(ebda_addr + ebda_size), (unsigned int)0xa0000) >> PAGE_SHIFT;
24536 + } else {
24537 + ebda_start = 0x9f000 >> PAGE_SHIFT;
24538 + ebda_end = 0xa0000 >> PAGE_SHIFT;
24539 + }
24540 +}
24541 +#else
24542 +static inline void gr_init_ebda(void) { }
24543 +#endif
24544 +
24545 void free_initmem(void)
24546 {
24547 +#ifdef CONFIG_PAX_KERNEXEC
24548 +#ifdef CONFIG_X86_32
24549 + /* PaX: limit KERNEL_CS to actual size */
24550 + unsigned long addr, limit;
24551 + struct desc_struct d;
24552 + int cpu;
24553 +#else
24554 + pgd_t *pgd;
24555 + pud_t *pud;
24556 + pmd_t *pmd;
24557 + unsigned long addr, end;
24558 +#endif
24559 +#endif
24560 +
24561 + gr_init_ebda();
24562 +
24563 +#ifdef CONFIG_PAX_KERNEXEC
24564 +#ifdef CONFIG_X86_32
24565 + limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
24566 + limit = (limit - 1UL) >> PAGE_SHIFT;
24567 +
24568 + memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
24569 + for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
24570 + pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
24571 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
24572 + }
24573 +
24574 + /* PaX: make KERNEL_CS read-only */
24575 + addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
24576 + if (!paravirt_enabled())
24577 + set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
24578 +/*
24579 + for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
24580 + pgd = pgd_offset_k(addr);
24581 + pud = pud_offset(pgd, addr);
24582 + pmd = pmd_offset(pud, addr);
24583 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
24584 + }
24585 +*/
24586 +#ifdef CONFIG_X86_PAE
24587 + set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
24588 +/*
24589 + for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
24590 + pgd = pgd_offset_k(addr);
24591 + pud = pud_offset(pgd, addr);
24592 + pmd = pmd_offset(pud, addr);
24593 + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
24594 + }
24595 +*/
24596 +#endif
24597 +
24598 +#ifdef CONFIG_MODULES
24599 + set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
24600 +#endif
24601 +
24602 +#else
24603 + /* PaX: make kernel code/rodata read-only, rest non-executable */
24604 + for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
24605 + pgd = pgd_offset_k(addr);
24606 + pud = pud_offset(pgd, addr);
24607 + pmd = pmd_offset(pud, addr);
24608 + if (!pmd_present(*pmd))
24609 + continue;
24610 + if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
24611 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
24612 + else
24613 + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
24614 + }
24615 +
24616 + addr = (unsigned long)__va(__pa(__START_KERNEL_map));
24617 + end = addr + KERNEL_IMAGE_SIZE;
24618 + for (; addr < end; addr += PMD_SIZE) {
24619 + pgd = pgd_offset_k(addr);
24620 + pud = pud_offset(pgd, addr);
24621 + pmd = pmd_offset(pud, addr);
24622 + if (!pmd_present(*pmd))
24623 + continue;
24624 + if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
24625 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
24626 + }
24627 +#endif
24628 +
24629 + flush_tlb_all();
24630 +#endif
24631 +
24632 free_init_pages("unused kernel memory",
24633 (unsigned long)(&__init_begin),
24634 (unsigned long)(&__init_end));
24635 diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
24636 index 575d86f..4987469 100644
24637 --- a/arch/x86/mm/init_32.c
24638 +++ b/arch/x86/mm/init_32.c
24639 @@ -73,36 +73,6 @@ static __init void *alloc_low_page(void)
24640 }
24641
24642 /*
24643 - * Creates a middle page table and puts a pointer to it in the
24644 - * given global directory entry. This only returns the gd entry
24645 - * in non-PAE compilation mode, since the middle layer is folded.
24646 - */
24647 -static pmd_t * __init one_md_table_init(pgd_t *pgd)
24648 -{
24649 - pud_t *pud;
24650 - pmd_t *pmd_table;
24651 -
24652 -#ifdef CONFIG_X86_PAE
24653 - if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
24654 - if (after_bootmem)
24655 - pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
24656 - else
24657 - pmd_table = (pmd_t *)alloc_low_page();
24658 - paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
24659 - set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
24660 - pud = pud_offset(pgd, 0);
24661 - BUG_ON(pmd_table != pmd_offset(pud, 0));
24662 -
24663 - return pmd_table;
24664 - }
24665 -#endif
24666 - pud = pud_offset(pgd, 0);
24667 - pmd_table = pmd_offset(pud, 0);
24668 -
24669 - return pmd_table;
24670 -}
24671 -
24672 -/*
24673 * Create a page table and place a pointer to it in a middle page
24674 * directory entry:
24675 */
24676 @@ -122,13 +92,28 @@ static pte_t * __init one_page_table_init(pmd_t *pmd)
24677 page_table = (pte_t *)alloc_low_page();
24678
24679 paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
24680 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
24681 + set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
24682 +#else
24683 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
24684 +#endif
24685 BUG_ON(page_table != pte_offset_kernel(pmd, 0));
24686 }
24687
24688 return pte_offset_kernel(pmd, 0);
24689 }
24690
24691 +static pmd_t * __init one_md_table_init(pgd_t *pgd)
24692 +{
24693 + pud_t *pud;
24694 + pmd_t *pmd_table;
24695 +
24696 + pud = pud_offset(pgd, 0);
24697 + pmd_table = pmd_offset(pud, 0);
24698 +
24699 + return pmd_table;
24700 +}
24701 +
24702 pmd_t * __init populate_extra_pmd(unsigned long vaddr)
24703 {
24704 int pgd_idx = pgd_index(vaddr);
24705 @@ -202,6 +187,7 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
24706 int pgd_idx, pmd_idx;
24707 unsigned long vaddr;
24708 pgd_t *pgd;
24709 + pud_t *pud;
24710 pmd_t *pmd;
24711 pte_t *pte = NULL;
24712
24713 @@ -211,8 +197,13 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
24714 pgd = pgd_base + pgd_idx;
24715
24716 for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
24717 - pmd = one_md_table_init(pgd);
24718 - pmd = pmd + pmd_index(vaddr);
24719 + pud = pud_offset(pgd, vaddr);
24720 + pmd = pmd_offset(pud, vaddr);
24721 +
24722 +#ifdef CONFIG_X86_PAE
24723 + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
24724 +#endif
24725 +
24726 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
24727 pmd++, pmd_idx++) {
24728 pte = page_table_kmap_check(one_page_table_init(pmd),
24729 @@ -224,11 +215,20 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
24730 }
24731 }
24732
24733 -static inline int is_kernel_text(unsigned long addr)
24734 +static inline int is_kernel_text(unsigned long start, unsigned long end)
24735 {
24736 - if (addr >= (unsigned long)_text && addr <= (unsigned long)__init_end)
24737 - return 1;
24738 - return 0;
24739 + if ((start > ktla_ktva((unsigned long)_etext) ||
24740 + end <= ktla_ktva((unsigned long)_stext)) &&
24741 + (start > ktla_ktva((unsigned long)_einittext) ||
24742 + end <= ktla_ktva((unsigned long)_sinittext)) &&
24743 +
24744 +#ifdef CONFIG_ACPI_SLEEP
24745 + (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
24746 +#endif
24747 +
24748 + (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
24749 + return 0;
24750 + return 1;
24751 }
24752
24753 /*
24754 @@ -245,9 +245,10 @@ kernel_physical_mapping_init(unsigned long start,
24755 unsigned long last_map_addr = end;
24756 unsigned long start_pfn, end_pfn;
24757 pgd_t *pgd_base = swapper_pg_dir;
24758 - int pgd_idx, pmd_idx, pte_ofs;
24759 + unsigned int pgd_idx, pmd_idx, pte_ofs;
24760 unsigned long pfn;
24761 pgd_t *pgd;
24762 + pud_t *pud;
24763 pmd_t *pmd;
24764 pte_t *pte;
24765 unsigned pages_2m, pages_4k;
24766 @@ -280,8 +281,13 @@ repeat:
24767 pfn = start_pfn;
24768 pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
24769 pgd = pgd_base + pgd_idx;
24770 - for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
24771 - pmd = one_md_table_init(pgd);
24772 + for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
24773 + pud = pud_offset(pgd, 0);
24774 + pmd = pmd_offset(pud, 0);
24775 +
24776 +#ifdef CONFIG_X86_PAE
24777 + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
24778 +#endif
24779
24780 if (pfn >= end_pfn)
24781 continue;
24782 @@ -293,14 +299,13 @@ repeat:
24783 #endif
24784 for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
24785 pmd++, pmd_idx++) {
24786 - unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
24787 + unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
24788
24789 /*
24790 * Map with big pages if possible, otherwise
24791 * create normal page tables:
24792 */
24793 if (use_pse) {
24794 - unsigned int addr2;
24795 pgprot_t prot = PAGE_KERNEL_LARGE;
24796 /*
24797 * first pass will use the same initial
24798 @@ -310,11 +315,7 @@ repeat:
24799 __pgprot(PTE_IDENT_ATTR |
24800 _PAGE_PSE);
24801
24802 - addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
24803 - PAGE_OFFSET + PAGE_SIZE-1;
24804 -
24805 - if (is_kernel_text(addr) ||
24806 - is_kernel_text(addr2))
24807 + if (is_kernel_text(address, address + PMD_SIZE))
24808 prot = PAGE_KERNEL_LARGE_EXEC;
24809
24810 pages_2m++;
24811 @@ -331,7 +332,7 @@ repeat:
24812 pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
24813 pte += pte_ofs;
24814 for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
24815 - pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
24816 + pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
24817 pgprot_t prot = PAGE_KERNEL;
24818 /*
24819 * first pass will use the same initial
24820 @@ -339,7 +340,7 @@ repeat:
24821 */
24822 pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
24823
24824 - if (is_kernel_text(addr))
24825 + if (is_kernel_text(address, address + PAGE_SIZE))
24826 prot = PAGE_KERNEL_EXEC;
24827
24828 pages_4k++;
24829 @@ -465,7 +466,7 @@ void __init native_pagetable_setup_start(pgd_t *base)
24830
24831 pud = pud_offset(pgd, va);
24832 pmd = pmd_offset(pud, va);
24833 - if (!pmd_present(*pmd))
24834 + if (!pmd_present(*pmd) || pmd_huge(*pmd))
24835 break;
24836
24837 pte = pte_offset_kernel(pmd, va);
24838 @@ -517,12 +518,10 @@ void __init early_ioremap_page_table_range_init(void)
24839
24840 static void __init pagetable_init(void)
24841 {
24842 - pgd_t *pgd_base = swapper_pg_dir;
24843 -
24844 - permanent_kmaps_init(pgd_base);
24845 + permanent_kmaps_init(swapper_pg_dir);
24846 }
24847
24848 -pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
24849 +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
24850 EXPORT_SYMBOL_GPL(__supported_pte_mask);
24851
24852 /* user-defined highmem size */
24853 @@ -734,6 +733,12 @@ void __init mem_init(void)
24854
24855 pci_iommu_alloc();
24856
24857 +#ifdef CONFIG_PAX_PER_CPU_PGD
24858 + clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
24859 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
24860 + KERNEL_PGD_PTRS);
24861 +#endif
24862 +
24863 #ifdef CONFIG_FLATMEM
24864 BUG_ON(!mem_map);
24865 #endif
24866 @@ -760,7 +765,7 @@ void __init mem_init(void)
24867 reservedpages++;
24868
24869 codesize = (unsigned long) &_etext - (unsigned long) &_text;
24870 - datasize = (unsigned long) &_edata - (unsigned long) &_etext;
24871 + datasize = (unsigned long) &_edata - (unsigned long) &_sdata;
24872 initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
24873
24874 printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
24875 @@ -801,10 +806,10 @@ void __init mem_init(void)
24876 ((unsigned long)&__init_end -
24877 (unsigned long)&__init_begin) >> 10,
24878
24879 - (unsigned long)&_etext, (unsigned long)&_edata,
24880 - ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
24881 + (unsigned long)&_sdata, (unsigned long)&_edata,
24882 + ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
24883
24884 - (unsigned long)&_text, (unsigned long)&_etext,
24885 + ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
24886 ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
24887
24888 /*
24889 @@ -882,6 +887,7 @@ void set_kernel_text_rw(void)
24890 if (!kernel_set_to_readonly)
24891 return;
24892
24893 + start = ktla_ktva(start);
24894 pr_debug("Set kernel text: %lx - %lx for read write\n",
24895 start, start+size);
24896
24897 @@ -896,6 +902,7 @@ void set_kernel_text_ro(void)
24898 if (!kernel_set_to_readonly)
24899 return;
24900
24901 + start = ktla_ktva(start);
24902 pr_debug("Set kernel text: %lx - %lx for read only\n",
24903 start, start+size);
24904
24905 @@ -924,6 +931,7 @@ void mark_rodata_ro(void)
24906 unsigned long start = PFN_ALIGN(_text);
24907 unsigned long size = PFN_ALIGN(_etext) - start;
24908
24909 + start = ktla_ktva(start);
24910 set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
24911 printk(KERN_INFO "Write protecting the kernel text: %luk\n",
24912 size >> 10);
24913 diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
24914 index 2b6b4a3..c17210d 100644
24915 --- a/arch/x86/mm/init_64.c
24916 +++ b/arch/x86/mm/init_64.c
24917 @@ -74,7 +74,7 @@ early_param("gbpages", parse_direct_gbpages_on);
24918 * around without checking the pgd every time.
24919 */
24920
24921 -pteval_t __supported_pte_mask __read_mostly = ~_PAGE_IOMAP;
24922 +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_IOMAP);
24923 EXPORT_SYMBOL_GPL(__supported_pte_mask);
24924
24925 int force_personality32;
24926 @@ -107,12 +107,22 @@ void sync_global_pgds(unsigned long start, unsigned long end)
24927
24928 for (address = start; address <= end; address += PGDIR_SIZE) {
24929 const pgd_t *pgd_ref = pgd_offset_k(address);
24930 +
24931 +#ifdef CONFIG_PAX_PER_CPU_PGD
24932 + unsigned long cpu;
24933 +#else
24934 struct page *page;
24935 +#endif
24936
24937 if (pgd_none(*pgd_ref))
24938 continue;
24939
24940 spin_lock(&pgd_lock);
24941 +
24942 +#ifdef CONFIG_PAX_PER_CPU_PGD
24943 + for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
24944 + pgd_t *pgd = pgd_offset_cpu(cpu, address);
24945 +#else
24946 list_for_each_entry(page, &pgd_list, lru) {
24947 pgd_t *pgd;
24948 spinlock_t *pgt_lock;
24949 @@ -121,6 +131,7 @@ void sync_global_pgds(unsigned long start, unsigned long end)
24950 /* the pgt_lock only for Xen */
24951 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
24952 spin_lock(pgt_lock);
24953 +#endif
24954
24955 if (pgd_none(*pgd))
24956 set_pgd(pgd, *pgd_ref);
24957 @@ -128,7 +139,10 @@ void sync_global_pgds(unsigned long start, unsigned long end)
24958 BUG_ON(pgd_page_vaddr(*pgd)
24959 != pgd_page_vaddr(*pgd_ref));
24960
24961 +#ifndef CONFIG_PAX_PER_CPU_PGD
24962 spin_unlock(pgt_lock);
24963 +#endif
24964 +
24965 }
24966 spin_unlock(&pgd_lock);
24967 }
24968 @@ -161,7 +175,7 @@ static pud_t *fill_pud(pgd_t *pgd, unsigned long vaddr)
24969 {
24970 if (pgd_none(*pgd)) {
24971 pud_t *pud = (pud_t *)spp_getpage();
24972 - pgd_populate(&init_mm, pgd, pud);
24973 + pgd_populate_kernel(&init_mm, pgd, pud);
24974 if (pud != pud_offset(pgd, 0))
24975 printk(KERN_ERR "PAGETABLE BUG #00! %p <-> %p\n",
24976 pud, pud_offset(pgd, 0));
24977 @@ -173,7 +187,7 @@ static pmd_t *fill_pmd(pud_t *pud, unsigned long vaddr)
24978 {
24979 if (pud_none(*pud)) {
24980 pmd_t *pmd = (pmd_t *) spp_getpage();
24981 - pud_populate(&init_mm, pud, pmd);
24982 + pud_populate_kernel(&init_mm, pud, pmd);
24983 if (pmd != pmd_offset(pud, 0))
24984 printk(KERN_ERR "PAGETABLE BUG #01! %p <-> %p\n",
24985 pmd, pmd_offset(pud, 0));
24986 @@ -202,7 +216,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, unsigned long vaddr, pte_t new_pte)
24987 pmd = fill_pmd(pud, vaddr);
24988 pte = fill_pte(pmd, vaddr);
24989
24990 + pax_open_kernel();
24991 set_pte(pte, new_pte);
24992 + pax_close_kernel();
24993
24994 /*
24995 * It's enough to flush this one mapping.
24996 @@ -261,14 +277,12 @@ static void __init __init_extra_mapping(unsigned long phys, unsigned long size,
24997 pgd = pgd_offset_k((unsigned long)__va(phys));
24998 if (pgd_none(*pgd)) {
24999 pud = (pud_t *) spp_getpage();
25000 - set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
25001 - _PAGE_USER));
25002 + set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
25003 }
25004 pud = pud_offset(pgd, (unsigned long)__va(phys));
25005 if (pud_none(*pud)) {
25006 pmd = (pmd_t *) spp_getpage();
25007 - set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
25008 - _PAGE_USER));
25009 + set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
25010 }
25011 pmd = pmd_offset(pud, phys);
25012 BUG_ON(!pmd_none(*pmd));
25013 @@ -329,7 +343,7 @@ static __ref void *alloc_low_page(unsigned long *phys)
25014 if (pfn >= pgt_buf_top)
25015 panic("alloc_low_page: ran out of memory");
25016
25017 - adr = early_memremap(pfn * PAGE_SIZE, PAGE_SIZE);
25018 + adr = (void __force_kernel *)early_memremap(pfn * PAGE_SIZE, PAGE_SIZE);
25019 clear_page(adr);
25020 *phys = pfn * PAGE_SIZE;
25021 return adr;
25022 @@ -345,7 +359,7 @@ static __ref void *map_low_page(void *virt)
25023
25024 phys = __pa(virt);
25025 left = phys & (PAGE_SIZE - 1);
25026 - adr = early_memremap(phys & PAGE_MASK, PAGE_SIZE);
25027 + adr = (void __force_kernel *)early_memremap(phys & PAGE_MASK, PAGE_SIZE);
25028 adr = (void *)(((unsigned long)adr) | left);
25029
25030 return adr;
25031 @@ -548,7 +562,7 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end,
25032 unmap_low_page(pmd);
25033
25034 spin_lock(&init_mm.page_table_lock);
25035 - pud_populate(&init_mm, pud, __va(pmd_phys));
25036 + pud_populate_kernel(&init_mm, pud, __va(pmd_phys));
25037 spin_unlock(&init_mm.page_table_lock);
25038 }
25039 __flush_tlb_all();
25040 @@ -594,7 +608,7 @@ kernel_physical_mapping_init(unsigned long start,
25041 unmap_low_page(pud);
25042
25043 spin_lock(&init_mm.page_table_lock);
25044 - pgd_populate(&init_mm, pgd, __va(pud_phys));
25045 + pgd_populate_kernel(&init_mm, pgd, __va(pud_phys));
25046 spin_unlock(&init_mm.page_table_lock);
25047 pgd_changed = true;
25048 }
25049 @@ -686,6 +700,12 @@ void __init mem_init(void)
25050
25051 pci_iommu_alloc();
25052
25053 +#ifdef CONFIG_PAX_PER_CPU_PGD
25054 + clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
25055 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
25056 + KERNEL_PGD_PTRS);
25057 +#endif
25058 +
25059 /* clear_bss() already clear the empty_zero_page */
25060
25061 reservedpages = 0;
25062 @@ -846,8 +866,8 @@ int kern_addr_valid(unsigned long addr)
25063 static struct vm_area_struct gate_vma = {
25064 .vm_start = VSYSCALL_START,
25065 .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
25066 - .vm_page_prot = PAGE_READONLY_EXEC,
25067 - .vm_flags = VM_READ | VM_EXEC
25068 + .vm_page_prot = PAGE_READONLY,
25069 + .vm_flags = VM_READ
25070 };
25071
25072 struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
25073 @@ -881,7 +901,7 @@ int in_gate_area_no_mm(unsigned long addr)
25074
25075 const char *arch_vma_name(struct vm_area_struct *vma)
25076 {
25077 - if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
25078 + if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
25079 return "[vdso]";
25080 if (vma == &gate_vma)
25081 return "[vsyscall]";
25082 diff --git a/arch/x86/mm/iomap_32.c b/arch/x86/mm/iomap_32.c
25083 index 7b179b4..6bd1777 100644
25084 --- a/arch/x86/mm/iomap_32.c
25085 +++ b/arch/x86/mm/iomap_32.c
25086 @@ -64,7 +64,11 @@ void *kmap_atomic_prot_pfn(unsigned long pfn, pgprot_t prot)
25087 type = kmap_atomic_idx_push();
25088 idx = type + KM_TYPE_NR * smp_processor_id();
25089 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
25090 +
25091 + pax_open_kernel();
25092 set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
25093 + pax_close_kernel();
25094 +
25095 arch_flush_lazy_mmu_mode();
25096
25097 return (void *)vaddr;
25098 diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
25099 index 78fe3f1..8293b6f 100644
25100 --- a/arch/x86/mm/ioremap.c
25101 +++ b/arch/x86/mm/ioremap.c
25102 @@ -97,7 +97,7 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
25103 for (pfn = phys_addr >> PAGE_SHIFT; pfn <= last_pfn; pfn++) {
25104 int is_ram = page_is_ram(pfn);
25105
25106 - if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
25107 + if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
25108 return NULL;
25109 WARN_ON_ONCE(is_ram);
25110 }
25111 @@ -315,6 +315,9 @@ void *xlate_dev_mem_ptr(unsigned long phys)
25112
25113 /* If page is RAM, we can use __va. Otherwise ioremap and unmap. */
25114 if (page_is_ram(start >> PAGE_SHIFT))
25115 +#ifdef CONFIG_HIGHMEM
25116 + if ((start >> PAGE_SHIFT) < max_low_pfn)
25117 +#endif
25118 return __va(phys);
25119
25120 addr = (void __force *)ioremap_cache(start, PAGE_SIZE);
25121 @@ -344,7 +347,7 @@ static int __init early_ioremap_debug_setup(char *str)
25122 early_param("early_ioremap_debug", early_ioremap_debug_setup);
25123
25124 static __initdata int after_paging_init;
25125 -static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
25126 +static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
25127
25128 static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
25129 {
25130 @@ -381,8 +384,7 @@ void __init early_ioremap_init(void)
25131 slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
25132
25133 pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
25134 - memset(bm_pte, 0, sizeof(bm_pte));
25135 - pmd_populate_kernel(&init_mm, pmd, bm_pte);
25136 + pmd_populate_user(&init_mm, pmd, bm_pte);
25137
25138 /*
25139 * The boot-ioremap range spans multiple pmds, for which
25140 diff --git a/arch/x86/mm/kmemcheck/kmemcheck.c b/arch/x86/mm/kmemcheck/kmemcheck.c
25141 index d87dd6d..bf3fa66 100644
25142 --- a/arch/x86/mm/kmemcheck/kmemcheck.c
25143 +++ b/arch/x86/mm/kmemcheck/kmemcheck.c
25144 @@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *regs, unsigned long address,
25145 * memory (e.g. tracked pages)? For now, we need this to avoid
25146 * invoking kmemcheck for PnP BIOS calls.
25147 */
25148 - if (regs->flags & X86_VM_MASK)
25149 + if (v8086_mode(regs))
25150 return false;
25151 - if (regs->cs != __KERNEL_CS)
25152 + if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
25153 return false;
25154
25155 pte = kmemcheck_pte_lookup(address);
25156 diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
25157 index 845df68..1d8d29f 100644
25158 --- a/arch/x86/mm/mmap.c
25159 +++ b/arch/x86/mm/mmap.c
25160 @@ -52,7 +52,7 @@ static unsigned int stack_maxrandom_size(void)
25161 * Leave an at least ~128 MB hole with possible stack randomization.
25162 */
25163 #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
25164 -#define MAX_GAP (TASK_SIZE/6*5)
25165 +#define MAX_GAP (pax_task_size/6*5)
25166
25167 static int mmap_is_legacy(void)
25168 {
25169 @@ -82,27 +82,40 @@ static unsigned long mmap_rnd(void)
25170 return rnd << PAGE_SHIFT;
25171 }
25172
25173 -static unsigned long mmap_base(void)
25174 +static unsigned long mmap_base(struct mm_struct *mm)
25175 {
25176 unsigned long gap = rlimit(RLIMIT_STACK);
25177 + unsigned long pax_task_size = TASK_SIZE;
25178 +
25179 +#ifdef CONFIG_PAX_SEGMEXEC
25180 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
25181 + pax_task_size = SEGMEXEC_TASK_SIZE;
25182 +#endif
25183
25184 if (gap < MIN_GAP)
25185 gap = MIN_GAP;
25186 else if (gap > MAX_GAP)
25187 gap = MAX_GAP;
25188
25189 - return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
25190 + return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
25191 }
25192
25193 /*
25194 * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
25195 * does, but not when emulating X86_32
25196 */
25197 -static unsigned long mmap_legacy_base(void)
25198 +static unsigned long mmap_legacy_base(struct mm_struct *mm)
25199 {
25200 - if (mmap_is_ia32())
25201 + if (mmap_is_ia32()) {
25202 +
25203 +#ifdef CONFIG_PAX_SEGMEXEC
25204 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
25205 + return SEGMEXEC_TASK_UNMAPPED_BASE;
25206 + else
25207 +#endif
25208 +
25209 return TASK_UNMAPPED_BASE;
25210 - else
25211 + } else
25212 return TASK_UNMAPPED_BASE + mmap_rnd();
25213 }
25214
25215 @@ -113,11 +126,23 @@ static unsigned long mmap_legacy_base(void)
25216 void arch_pick_mmap_layout(struct mm_struct *mm)
25217 {
25218 if (mmap_is_legacy()) {
25219 - mm->mmap_base = mmap_legacy_base();
25220 + mm->mmap_base = mmap_legacy_base(mm);
25221 +
25222 +#ifdef CONFIG_PAX_RANDMMAP
25223 + if (mm->pax_flags & MF_PAX_RANDMMAP)
25224 + mm->mmap_base += mm->delta_mmap;
25225 +#endif
25226 +
25227 mm->get_unmapped_area = arch_get_unmapped_area;
25228 mm->unmap_area = arch_unmap_area;
25229 } else {
25230 - mm->mmap_base = mmap_base();
25231 + mm->mmap_base = mmap_base(mm);
25232 +
25233 +#ifdef CONFIG_PAX_RANDMMAP
25234 + if (mm->pax_flags & MF_PAX_RANDMMAP)
25235 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
25236 +#endif
25237 +
25238 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
25239 mm->unmap_area = arch_unmap_area_topdown;
25240 }
25241 diff --git a/arch/x86/mm/mmio-mod.c b/arch/x86/mm/mmio-mod.c
25242 index dc0b727..dc9d71a 100644
25243 --- a/arch/x86/mm/mmio-mod.c
25244 +++ b/arch/x86/mm/mmio-mod.c
25245 @@ -194,7 +194,7 @@ static void pre(struct kmmio_probe *p, struct pt_regs *regs,
25246 break;
25247 default:
25248 {
25249 - unsigned char *ip = (unsigned char *)instptr;
25250 + unsigned char *ip = (unsigned char *)ktla_ktva(instptr);
25251 my_trace->opcode = MMIO_UNKNOWN_OP;
25252 my_trace->width = 0;
25253 my_trace->value = (*ip) << 16 | *(ip + 1) << 8 |
25254 @@ -234,7 +234,7 @@ static void post(struct kmmio_probe *p, unsigned long condition,
25255 static void ioremap_trace_core(resource_size_t offset, unsigned long size,
25256 void __iomem *addr)
25257 {
25258 - static atomic_t next_id;
25259 + static atomic_unchecked_t next_id;
25260 struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
25261 /* These are page-unaligned. */
25262 struct mmiotrace_map map = {
25263 @@ -258,7 +258,7 @@ static void ioremap_trace_core(resource_size_t offset, unsigned long size,
25264 .private = trace
25265 },
25266 .phys = offset,
25267 - .id = atomic_inc_return(&next_id)
25268 + .id = atomic_inc_return_unchecked(&next_id)
25269 };
25270 map.map_id = trace->id;
25271
25272 diff --git a/arch/x86/mm/pageattr-test.c b/arch/x86/mm/pageattr-test.c
25273 index b008656..773eac2 100644
25274 --- a/arch/x86/mm/pageattr-test.c
25275 +++ b/arch/x86/mm/pageattr-test.c
25276 @@ -36,7 +36,7 @@ enum {
25277
25278 static int pte_testbit(pte_t pte)
25279 {
25280 - return pte_flags(pte) & _PAGE_UNUSED1;
25281 + return pte_flags(pte) & _PAGE_CPA_TEST;
25282 }
25283
25284 struct split_state {
25285 diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
25286 index a718e0d..45efc32 100644
25287 --- a/arch/x86/mm/pageattr.c
25288 +++ b/arch/x86/mm/pageattr.c
25289 @@ -261,7 +261,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
25290 */
25291 #ifdef CONFIG_PCI_BIOS
25292 if (pcibios_enabled && within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
25293 - pgprot_val(forbidden) |= _PAGE_NX;
25294 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
25295 #endif
25296
25297 /*
25298 @@ -269,9 +269,10 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
25299 * Does not cover __inittext since that is gone later on. On
25300 * 64bit we do not enforce !NX on the low mapping
25301 */
25302 - if (within(address, (unsigned long)_text, (unsigned long)_etext))
25303 - pgprot_val(forbidden) |= _PAGE_NX;
25304 + if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
25305 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
25306
25307 +#ifdef CONFIG_DEBUG_RODATA
25308 /*
25309 * The .rodata section needs to be read-only. Using the pfn
25310 * catches all aliases.
25311 @@ -279,6 +280,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
25312 if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
25313 __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
25314 pgprot_val(forbidden) |= _PAGE_RW;
25315 +#endif
25316
25317 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
25318 /*
25319 @@ -317,6 +319,13 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
25320 }
25321 #endif
25322
25323 +#ifdef CONFIG_PAX_KERNEXEC
25324 + if (within(pfn, __pa((unsigned long)&_text), __pa((unsigned long)&_sdata))) {
25325 + pgprot_val(forbidden) |= _PAGE_RW;
25326 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
25327 + }
25328 +#endif
25329 +
25330 prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
25331
25332 return prot;
25333 @@ -369,23 +378,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
25334 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
25335 {
25336 /* change init_mm */
25337 + pax_open_kernel();
25338 set_pte_atomic(kpte, pte);
25339 +
25340 #ifdef CONFIG_X86_32
25341 if (!SHARED_KERNEL_PMD) {
25342 +
25343 +#ifdef CONFIG_PAX_PER_CPU_PGD
25344 + unsigned long cpu;
25345 +#else
25346 struct page *page;
25347 +#endif
25348
25349 +#ifdef CONFIG_PAX_PER_CPU_PGD
25350 + for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
25351 + pgd_t *pgd = get_cpu_pgd(cpu);
25352 +#else
25353 list_for_each_entry(page, &pgd_list, lru) {
25354 - pgd_t *pgd;
25355 + pgd_t *pgd = (pgd_t *)page_address(page);
25356 +#endif
25357 +
25358 pud_t *pud;
25359 pmd_t *pmd;
25360
25361 - pgd = (pgd_t *)page_address(page) + pgd_index(address);
25362 + pgd += pgd_index(address);
25363 pud = pud_offset(pgd, address);
25364 pmd = pmd_offset(pud, address);
25365 set_pte_atomic((pte_t *)pmd, pte);
25366 }
25367 }
25368 #endif
25369 + pax_close_kernel();
25370 }
25371
25372 static int
25373 diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
25374 index 3d68ef6..7f69136 100644
25375 --- a/arch/x86/mm/pat.c
25376 +++ b/arch/x86/mm/pat.c
25377 @@ -376,7 +376,7 @@ int free_memtype(u64 start, u64 end)
25378
25379 if (!entry) {
25380 printk(KERN_INFO "%s:%d freeing invalid memtype [mem %#010Lx-%#010Lx]\n",
25381 - current->comm, current->pid, start, end - 1);
25382 + current->comm, task_pid_nr(current), start, end - 1);
25383 return -EINVAL;
25384 }
25385
25386 @@ -506,8 +506,8 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
25387
25388 while (cursor < to) {
25389 if (!devmem_is_allowed(pfn)) {
25390 - printk(KERN_INFO "Program %s tried to access /dev/mem between [mem %#010Lx-%#010Lx]\n",
25391 - current->comm, from, to - 1);
25392 + printk(KERN_INFO "Program %s tried to access /dev/mem between [mem %#010Lx-%#010Lx] (%#010Lx)\n",
25393 + current->comm, from, to - 1, cursor);
25394 return 0;
25395 }
25396 cursor += PAGE_SIZE;
25397 @@ -570,7 +570,7 @@ int kernel_map_sync_memtype(u64 base, unsigned long size, unsigned long flags)
25398 if (ioremap_change_attr((unsigned long)__va(base), id_sz, flags) < 0) {
25399 printk(KERN_INFO "%s:%d ioremap_change_attr failed %s "
25400 "for [mem %#010Lx-%#010Lx]\n",
25401 - current->comm, current->pid,
25402 + current->comm, task_pid_nr(current),
25403 cattr_name(flags),
25404 base, (unsigned long long)(base + size-1));
25405 return -EINVAL;
25406 @@ -605,7 +605,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
25407 flags = lookup_memtype(paddr);
25408 if (want_flags != flags) {
25409 printk(KERN_WARNING "%s:%d map pfn RAM range req %s for [mem %#010Lx-%#010Lx], got %s\n",
25410 - current->comm, current->pid,
25411 + current->comm, task_pid_nr(current),
25412 cattr_name(want_flags),
25413 (unsigned long long)paddr,
25414 (unsigned long long)(paddr + size - 1),
25415 @@ -627,7 +627,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
25416 free_memtype(paddr, paddr + size);
25417 printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
25418 " for [mem %#010Lx-%#010Lx], got %s\n",
25419 - current->comm, current->pid,
25420 + current->comm, task_pid_nr(current),
25421 cattr_name(want_flags),
25422 (unsigned long long)paddr,
25423 (unsigned long long)(paddr + size - 1),
25424 diff --git a/arch/x86/mm/pf_in.c b/arch/x86/mm/pf_in.c
25425 index 9f0614d..92ae64a 100644
25426 --- a/arch/x86/mm/pf_in.c
25427 +++ b/arch/x86/mm/pf_in.c
25428 @@ -148,7 +148,7 @@ enum reason_type get_ins_type(unsigned long ins_addr)
25429 int i;
25430 enum reason_type rv = OTHERS;
25431
25432 - p = (unsigned char *)ins_addr;
25433 + p = (unsigned char *)ktla_ktva(ins_addr);
25434 p += skip_prefix(p, &prf);
25435 p += get_opcode(p, &opcode);
25436
25437 @@ -168,7 +168,7 @@ static unsigned int get_ins_reg_width(unsigned long ins_addr)
25438 struct prefix_bits prf;
25439 int i;
25440
25441 - p = (unsigned char *)ins_addr;
25442 + p = (unsigned char *)ktla_ktva(ins_addr);
25443 p += skip_prefix(p, &prf);
25444 p += get_opcode(p, &opcode);
25445
25446 @@ -191,7 +191,7 @@ unsigned int get_ins_mem_width(unsigned long ins_addr)
25447 struct prefix_bits prf;
25448 int i;
25449
25450 - p = (unsigned char *)ins_addr;
25451 + p = (unsigned char *)ktla_ktva(ins_addr);
25452 p += skip_prefix(p, &prf);
25453 p += get_opcode(p, &opcode);
25454
25455 @@ -415,7 +415,7 @@ unsigned long get_ins_reg_val(unsigned long ins_addr, struct pt_regs *regs)
25456 struct prefix_bits prf;
25457 int i;
25458
25459 - p = (unsigned char *)ins_addr;
25460 + p = (unsigned char *)ktla_ktva(ins_addr);
25461 p += skip_prefix(p, &prf);
25462 p += get_opcode(p, &opcode);
25463 for (i = 0; i < ARRAY_SIZE(reg_rop); i++)
25464 @@ -470,7 +470,7 @@ unsigned long get_ins_imm_val(unsigned long ins_addr)
25465 struct prefix_bits prf;
25466 int i;
25467
25468 - p = (unsigned char *)ins_addr;
25469 + p = (unsigned char *)ktla_ktva(ins_addr);
25470 p += skip_prefix(p, &prf);
25471 p += get_opcode(p, &opcode);
25472 for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
25473 diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
25474 index 8573b83..4f3ed7e 100644
25475 --- a/arch/x86/mm/pgtable.c
25476 +++ b/arch/x86/mm/pgtable.c
25477 @@ -84,10 +84,64 @@ static inline void pgd_list_del(pgd_t *pgd)
25478 list_del(&page->lru);
25479 }
25480
25481 -#define UNSHARED_PTRS_PER_PGD \
25482 - (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
25483 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
25484 +pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
25485
25486 +void __shadow_user_pgds(pgd_t *dst, const pgd_t *src)
25487 +{
25488 + unsigned int count = USER_PGD_PTRS;
25489
25490 + while (count--)
25491 + *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
25492 +}
25493 +#endif
25494 +
25495 +#ifdef CONFIG_PAX_PER_CPU_PGD
25496 +void __clone_user_pgds(pgd_t *dst, const pgd_t *src)
25497 +{
25498 + unsigned int count = USER_PGD_PTRS;
25499 +
25500 + while (count--) {
25501 + pgd_t pgd;
25502 +
25503 +#ifdef CONFIG_X86_64
25504 + pgd = __pgd(pgd_val(*src++) | _PAGE_USER);
25505 +#else
25506 + pgd = *src++;
25507 +#endif
25508 +
25509 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
25510 + pgd = __pgd(pgd_val(pgd) & clone_pgd_mask);
25511 +#endif
25512 +
25513 + *dst++ = pgd;
25514 + }
25515 +
25516 +}
25517 +#endif
25518 +
25519 +#ifdef CONFIG_X86_64
25520 +#define pxd_t pud_t
25521 +#define pyd_t pgd_t
25522 +#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
25523 +#define pxd_free(mm, pud) pud_free((mm), (pud))
25524 +#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
25525 +#define pyd_offset(mm, address) pgd_offset((mm), (address))
25526 +#define PYD_SIZE PGDIR_SIZE
25527 +#else
25528 +#define pxd_t pmd_t
25529 +#define pyd_t pud_t
25530 +#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
25531 +#define pxd_free(mm, pud) pmd_free((mm), (pud))
25532 +#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
25533 +#define pyd_offset(mm, address) pud_offset((mm), (address))
25534 +#define PYD_SIZE PUD_SIZE
25535 +#endif
25536 +
25537 +#ifdef CONFIG_PAX_PER_CPU_PGD
25538 +static inline void pgd_ctor(struct mm_struct *mm, pgd_t *pgd) {}
25539 +static inline void pgd_dtor(pgd_t *pgd) {}
25540 +#else
25541 static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
25542 {
25543 BUILD_BUG_ON(sizeof(virt_to_page(pgd)->index) < sizeof(mm));
25544 @@ -128,6 +182,7 @@ static void pgd_dtor(pgd_t *pgd)
25545 pgd_list_del(pgd);
25546 spin_unlock(&pgd_lock);
25547 }
25548 +#endif
25549
25550 /*
25551 * List of all pgd's needed for non-PAE so it can invalidate entries
25552 @@ -140,7 +195,7 @@ static void pgd_dtor(pgd_t *pgd)
25553 * -- wli
25554 */
25555
25556 -#ifdef CONFIG_X86_PAE
25557 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
25558 /*
25559 * In PAE mode, we need to do a cr3 reload (=tlb flush) when
25560 * updating the top-level pagetable entries to guarantee the
25561 @@ -152,7 +207,7 @@ static void pgd_dtor(pgd_t *pgd)
25562 * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
25563 * and initialize the kernel pmds here.
25564 */
25565 -#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
25566 +#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
25567
25568 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
25569 {
25570 @@ -170,36 +225,38 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
25571 */
25572 flush_tlb_mm(mm);
25573 }
25574 +#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
25575 +#define PREALLOCATED_PXDS USER_PGD_PTRS
25576 #else /* !CONFIG_X86_PAE */
25577
25578 /* No need to prepopulate any pagetable entries in non-PAE modes. */
25579 -#define PREALLOCATED_PMDS 0
25580 +#define PREALLOCATED_PXDS 0
25581
25582 #endif /* CONFIG_X86_PAE */
25583
25584 -static void free_pmds(pmd_t *pmds[])
25585 +static void free_pxds(pxd_t *pxds[])
25586 {
25587 int i;
25588
25589 - for(i = 0; i < PREALLOCATED_PMDS; i++)
25590 - if (pmds[i])
25591 - free_page((unsigned long)pmds[i]);
25592 + for(i = 0; i < PREALLOCATED_PXDS; i++)
25593 + if (pxds[i])
25594 + free_page((unsigned long)pxds[i]);
25595 }
25596
25597 -static int preallocate_pmds(pmd_t *pmds[])
25598 +static int preallocate_pxds(pxd_t *pxds[])
25599 {
25600 int i;
25601 bool failed = false;
25602
25603 - for(i = 0; i < PREALLOCATED_PMDS; i++) {
25604 - pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
25605 - if (pmd == NULL)
25606 + for(i = 0; i < PREALLOCATED_PXDS; i++) {
25607 + pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
25608 + if (pxd == NULL)
25609 failed = true;
25610 - pmds[i] = pmd;
25611 + pxds[i] = pxd;
25612 }
25613
25614 if (failed) {
25615 - free_pmds(pmds);
25616 + free_pxds(pxds);
25617 return -ENOMEM;
25618 }
25619
25620 @@ -212,51 +269,55 @@ static int preallocate_pmds(pmd_t *pmds[])
25621 * preallocate which never got a corresponding vma will need to be
25622 * freed manually.
25623 */
25624 -static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
25625 +static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
25626 {
25627 int i;
25628
25629 - for(i = 0; i < PREALLOCATED_PMDS; i++) {
25630 + for(i = 0; i < PREALLOCATED_PXDS; i++) {
25631 pgd_t pgd = pgdp[i];
25632
25633 if (pgd_val(pgd) != 0) {
25634 - pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
25635 + pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
25636
25637 - pgdp[i] = native_make_pgd(0);
25638 + set_pgd(pgdp + i, native_make_pgd(0));
25639
25640 - paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
25641 - pmd_free(mm, pmd);
25642 + paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
25643 + pxd_free(mm, pxd);
25644 }
25645 }
25646 }
25647
25648 -static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
25649 +static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
25650 {
25651 - pud_t *pud;
25652 + pyd_t *pyd;
25653 unsigned long addr;
25654 int i;
25655
25656 - if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
25657 + if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
25658 return;
25659
25660 - pud = pud_offset(pgd, 0);
25661 +#ifdef CONFIG_X86_64
25662 + pyd = pyd_offset(mm, 0L);
25663 +#else
25664 + pyd = pyd_offset(pgd, 0L);
25665 +#endif
25666
25667 - for (addr = i = 0; i < PREALLOCATED_PMDS;
25668 - i++, pud++, addr += PUD_SIZE) {
25669 - pmd_t *pmd = pmds[i];
25670 + for (addr = i = 0; i < PREALLOCATED_PXDS;
25671 + i++, pyd++, addr += PYD_SIZE) {
25672 + pxd_t *pxd = pxds[i];
25673
25674 if (i >= KERNEL_PGD_BOUNDARY)
25675 - memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
25676 - sizeof(pmd_t) * PTRS_PER_PMD);
25677 + memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
25678 + sizeof(pxd_t) * PTRS_PER_PMD);
25679
25680 - pud_populate(mm, pud, pmd);
25681 + pyd_populate(mm, pyd, pxd);
25682 }
25683 }
25684
25685 pgd_t *pgd_alloc(struct mm_struct *mm)
25686 {
25687 pgd_t *pgd;
25688 - pmd_t *pmds[PREALLOCATED_PMDS];
25689 + pxd_t *pxds[PREALLOCATED_PXDS];
25690
25691 pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
25692
25693 @@ -265,11 +326,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
25694
25695 mm->pgd = pgd;
25696
25697 - if (preallocate_pmds(pmds) != 0)
25698 + if (preallocate_pxds(pxds) != 0)
25699 goto out_free_pgd;
25700
25701 if (paravirt_pgd_alloc(mm) != 0)
25702 - goto out_free_pmds;
25703 + goto out_free_pxds;
25704
25705 /*
25706 * Make sure that pre-populating the pmds is atomic with
25707 @@ -279,14 +340,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
25708 spin_lock(&pgd_lock);
25709
25710 pgd_ctor(mm, pgd);
25711 - pgd_prepopulate_pmd(mm, pgd, pmds);
25712 + pgd_prepopulate_pxd(mm, pgd, pxds);
25713
25714 spin_unlock(&pgd_lock);
25715
25716 return pgd;
25717
25718 -out_free_pmds:
25719 - free_pmds(pmds);
25720 +out_free_pxds:
25721 + free_pxds(pxds);
25722 out_free_pgd:
25723 free_page((unsigned long)pgd);
25724 out:
25725 @@ -295,7 +356,7 @@ out:
25726
25727 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
25728 {
25729 - pgd_mop_up_pmds(mm, pgd);
25730 + pgd_mop_up_pxds(mm, pgd);
25731 pgd_dtor(pgd);
25732 paravirt_pgd_free(mm, pgd);
25733 free_page((unsigned long)pgd);
25734 diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
25735 index a69bcb8..19068ab 100644
25736 --- a/arch/x86/mm/pgtable_32.c
25737 +++ b/arch/x86/mm/pgtable_32.c
25738 @@ -47,10 +47,13 @@ void set_pte_vaddr(unsigned long vaddr, pte_t pteval)
25739 return;
25740 }
25741 pte = pte_offset_kernel(pmd, vaddr);
25742 +
25743 + pax_open_kernel();
25744 if (pte_val(pteval))
25745 set_pte_at(&init_mm, vaddr, pte, pteval);
25746 else
25747 pte_clear(&init_mm, vaddr, pte);
25748 + pax_close_kernel();
25749
25750 /*
25751 * It's enough to flush this one mapping.
25752 diff --git a/arch/x86/mm/setup_nx.c b/arch/x86/mm/setup_nx.c
25753 index 410531d..0f16030 100644
25754 --- a/arch/x86/mm/setup_nx.c
25755 +++ b/arch/x86/mm/setup_nx.c
25756 @@ -5,8 +5,10 @@
25757 #include <asm/pgtable.h>
25758 #include <asm/proto.h>
25759
25760 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
25761 static int disable_nx __cpuinitdata;
25762
25763 +#ifndef CONFIG_PAX_PAGEEXEC
25764 /*
25765 * noexec = on|off
25766 *
25767 @@ -28,12 +30,17 @@ static int __init noexec_setup(char *str)
25768 return 0;
25769 }
25770 early_param("noexec", noexec_setup);
25771 +#endif
25772 +
25773 +#endif
25774
25775 void __cpuinit x86_configure_nx(void)
25776 {
25777 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
25778 if (cpu_has_nx && !disable_nx)
25779 __supported_pte_mask |= _PAGE_NX;
25780 else
25781 +#endif
25782 __supported_pte_mask &= ~_PAGE_NX;
25783 }
25784
25785 diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
25786 index 5e57e11..64874249 100644
25787 --- a/arch/x86/mm/tlb.c
25788 +++ b/arch/x86/mm/tlb.c
25789 @@ -66,7 +66,11 @@ void leave_mm(int cpu)
25790 BUG();
25791 if (cpumask_test_cpu(cpu, mm_cpumask(active_mm))) {
25792 cpumask_clear_cpu(cpu, mm_cpumask(active_mm));
25793 +
25794 +#ifndef CONFIG_PAX_PER_CPU_PGD
25795 load_cr3(swapper_pg_dir);
25796 +#endif
25797 +
25798 }
25799 }
25800 EXPORT_SYMBOL_GPL(leave_mm);
25801 diff --git a/arch/x86/net/bpf_jit.S b/arch/x86/net/bpf_jit.S
25802 index 877b9a1..a8ecf42 100644
25803 --- a/arch/x86/net/bpf_jit.S
25804 +++ b/arch/x86/net/bpf_jit.S
25805 @@ -9,6 +9,7 @@
25806 */
25807 #include <linux/linkage.h>
25808 #include <asm/dwarf2.h>
25809 +#include <asm/alternative-asm.h>
25810
25811 /*
25812 * Calling convention :
25813 @@ -35,6 +36,7 @@ sk_load_word_positive_offset:
25814 jle bpf_slow_path_word
25815 mov (SKBDATA,%rsi),%eax
25816 bswap %eax /* ntohl() */
25817 + pax_force_retaddr
25818 ret
25819
25820 sk_load_half:
25821 @@ -52,6 +54,7 @@ sk_load_half_positive_offset:
25822 jle bpf_slow_path_half
25823 movzwl (SKBDATA,%rsi),%eax
25824 rol $8,%ax # ntohs()
25825 + pax_force_retaddr
25826 ret
25827
25828 sk_load_byte:
25829 @@ -66,6 +69,7 @@ sk_load_byte_positive_offset:
25830 cmp %esi,%r9d /* if (offset >= hlen) goto bpf_slow_path_byte */
25831 jle bpf_slow_path_byte
25832 movzbl (SKBDATA,%rsi),%eax
25833 + pax_force_retaddr
25834 ret
25835
25836 /**
25837 @@ -87,6 +91,7 @@ sk_load_byte_msh_positive_offset:
25838 movzbl (SKBDATA,%rsi),%ebx
25839 and $15,%bl
25840 shl $2,%bl
25841 + pax_force_retaddr
25842 ret
25843
25844 /* rsi contains offset and can be scratched */
25845 @@ -109,6 +114,7 @@ bpf_slow_path_word:
25846 js bpf_error
25847 mov -12(%rbp),%eax
25848 bswap %eax
25849 + pax_force_retaddr
25850 ret
25851
25852 bpf_slow_path_half:
25853 @@ -117,12 +123,14 @@ bpf_slow_path_half:
25854 mov -12(%rbp),%ax
25855 rol $8,%ax
25856 movzwl %ax,%eax
25857 + pax_force_retaddr
25858 ret
25859
25860 bpf_slow_path_byte:
25861 bpf_slow_path_common(1)
25862 js bpf_error
25863 movzbl -12(%rbp),%eax
25864 + pax_force_retaddr
25865 ret
25866
25867 bpf_slow_path_byte_msh:
25868 @@ -133,6 +141,7 @@ bpf_slow_path_byte_msh:
25869 and $15,%al
25870 shl $2,%al
25871 xchg %eax,%ebx
25872 + pax_force_retaddr
25873 ret
25874
25875 #define sk_negative_common(SIZE) \
25876 @@ -157,6 +166,7 @@ sk_load_word_negative_offset:
25877 sk_negative_common(4)
25878 mov (%rax), %eax
25879 bswap %eax
25880 + pax_force_retaddr
25881 ret
25882
25883 bpf_slow_path_half_neg:
25884 @@ -168,6 +178,7 @@ sk_load_half_negative_offset:
25885 mov (%rax),%ax
25886 rol $8,%ax
25887 movzwl %ax,%eax
25888 + pax_force_retaddr
25889 ret
25890
25891 bpf_slow_path_byte_neg:
25892 @@ -177,6 +188,7 @@ sk_load_byte_negative_offset:
25893 .globl sk_load_byte_negative_offset
25894 sk_negative_common(1)
25895 movzbl (%rax), %eax
25896 + pax_force_retaddr
25897 ret
25898
25899 bpf_slow_path_byte_msh_neg:
25900 @@ -190,6 +202,7 @@ sk_load_byte_msh_negative_offset:
25901 and $15,%al
25902 shl $2,%al
25903 xchg %eax,%ebx
25904 + pax_force_retaddr
25905 ret
25906
25907 bpf_error:
25908 @@ -197,4 +210,5 @@ bpf_error:
25909 xor %eax,%eax
25910 mov -8(%rbp),%rbx
25911 leaveq
25912 + pax_force_retaddr
25913 ret
25914 diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
25915 index 0597f95..a12c36e 100644
25916 --- a/arch/x86/net/bpf_jit_comp.c
25917 +++ b/arch/x86/net/bpf_jit_comp.c
25918 @@ -120,6 +120,11 @@ static inline void bpf_flush_icache(void *start, void *end)
25919 set_fs(old_fs);
25920 }
25921
25922 +struct bpf_jit_work {
25923 + struct work_struct work;
25924 + void *image;
25925 +};
25926 +
25927 #define CHOOSE_LOAD_FUNC(K, func) \
25928 ((int)K < 0 ? ((int)K >= SKF_LL_OFF ? func##_negative_offset : func) : func##_positive_offset)
25929
25930 @@ -146,6 +151,10 @@ void bpf_jit_compile(struct sk_filter *fp)
25931 if (addrs == NULL)
25932 return;
25933
25934 + fp->work = kmalloc(sizeof(*fp->work), GFP_KERNEL);
25935 + if (!fp->work)
25936 + goto out;
25937 +
25938 /* Before first pass, make a rough estimation of addrs[]
25939 * each bpf instruction is translated to less than 64 bytes
25940 */
25941 @@ -589,17 +598,18 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
25942 break;
25943 default:
25944 /* hmm, too complex filter, give up with jit compiler */
25945 - goto out;
25946 + goto error;
25947 }
25948 ilen = prog - temp;
25949 if (image) {
25950 if (unlikely(proglen + ilen > oldproglen)) {
25951 pr_err("bpb_jit_compile fatal error\n");
25952 - kfree(addrs);
25953 - module_free(NULL, image);
25954 - return;
25955 + module_free_exec(NULL, image);
25956 + goto error;
25957 }
25958 + pax_open_kernel();
25959 memcpy(image + proglen, temp, ilen);
25960 + pax_close_kernel();
25961 }
25962 proglen += ilen;
25963 addrs[i] = proglen;
25964 @@ -620,11 +630,9 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
25965 break;
25966 }
25967 if (proglen == oldproglen) {
25968 - image = module_alloc(max_t(unsigned int,
25969 - proglen,
25970 - sizeof(struct work_struct)));
25971 + image = module_alloc_exec(proglen);
25972 if (!image)
25973 - goto out;
25974 + goto error;
25975 }
25976 oldproglen = proglen;
25977 }
25978 @@ -640,7 +648,10 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
25979 bpf_flush_icache(image, image + proglen);
25980
25981 fp->bpf_func = (void *)image;
25982 - }
25983 + } else
25984 +error:
25985 + kfree(fp->work);
25986 +
25987 out:
25988 kfree(addrs);
25989 return;
25990 @@ -648,18 +659,20 @@ out:
25991
25992 static void jit_free_defer(struct work_struct *arg)
25993 {
25994 - module_free(NULL, arg);
25995 + module_free_exec(NULL, ((struct bpf_jit_work *)arg)->image);
25996 + kfree(arg);
25997 }
25998
25999 /* run from softirq, we must use a work_struct to call
26000 - * module_free() from process context
26001 + * module_free_exec() from process context
26002 */
26003 void bpf_jit_free(struct sk_filter *fp)
26004 {
26005 if (fp->bpf_func != sk_run_filter) {
26006 - struct work_struct *work = (struct work_struct *)fp->bpf_func;
26007 + struct work_struct *work = &fp->work->work;
26008
26009 INIT_WORK(work, jit_free_defer);
26010 + fp->work->image = fp->bpf_func;
26011 schedule_work(work);
26012 }
26013 }
26014 diff --git a/arch/x86/oprofile/backtrace.c b/arch/x86/oprofile/backtrace.c
26015 index d6aa6e8..266395a 100644
26016 --- a/arch/x86/oprofile/backtrace.c
26017 +++ b/arch/x86/oprofile/backtrace.c
26018 @@ -46,11 +46,11 @@ dump_user_backtrace_32(struct stack_frame_ia32 *head)
26019 struct stack_frame_ia32 *fp;
26020 unsigned long bytes;
26021
26022 - bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
26023 + bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead));
26024 if (bytes != sizeof(bufhead))
26025 return NULL;
26026
26027 - fp = (struct stack_frame_ia32 *) compat_ptr(bufhead[0].next_frame);
26028 + fp = (struct stack_frame_ia32 __force_kernel *) compat_ptr(bufhead[0].next_frame);
26029
26030 oprofile_add_trace(bufhead[0].return_address);
26031
26032 @@ -92,7 +92,7 @@ static struct stack_frame *dump_user_backtrace(struct stack_frame *head)
26033 struct stack_frame bufhead[2];
26034 unsigned long bytes;
26035
26036 - bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
26037 + bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead));
26038 if (bytes != sizeof(bufhead))
26039 return NULL;
26040
26041 @@ -111,7 +111,7 @@ x86_backtrace(struct pt_regs * const regs, unsigned int depth)
26042 {
26043 struct stack_frame *head = (struct stack_frame *)frame_pointer(regs);
26044
26045 - if (!user_mode_vm(regs)) {
26046 + if (!user_mode(regs)) {
26047 unsigned long stack = kernel_stack_pointer(regs);
26048 if (depth)
26049 dump_trace(NULL, regs, (unsigned long *)stack, 0,
26050 diff --git a/arch/x86/pci/mrst.c b/arch/x86/pci/mrst.c
26051 index 140942f..8a5cc55 100644
26052 --- a/arch/x86/pci/mrst.c
26053 +++ b/arch/x86/pci/mrst.c
26054 @@ -238,7 +238,9 @@ int __init pci_mrst_init(void)
26055 printk(KERN_INFO "Intel MID platform detected, using MID PCI ops\n");
26056 pci_mmcfg_late_init();
26057 pcibios_enable_irq = mrst_pci_irq_enable;
26058 - pci_root_ops = pci_mrst_ops;
26059 + pax_open_kernel();
26060 + memcpy((void *)&pci_root_ops, &pci_mrst_ops, sizeof(pci_mrst_ops));
26061 + pax_close_kernel();
26062 pci_soc_mode = 1;
26063 /* Continue with standard init */
26064 return 1;
26065 diff --git a/arch/x86/pci/pcbios.c b/arch/x86/pci/pcbios.c
26066 index da8fe05..7ee6704 100644
26067 --- a/arch/x86/pci/pcbios.c
26068 +++ b/arch/x86/pci/pcbios.c
26069 @@ -79,50 +79,93 @@ union bios32 {
26070 static struct {
26071 unsigned long address;
26072 unsigned short segment;
26073 -} bios32_indirect = { 0, __KERNEL_CS };
26074 +} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
26075
26076 /*
26077 * Returns the entry point for the given service, NULL on error
26078 */
26079
26080 -static unsigned long bios32_service(unsigned long service)
26081 +static unsigned long __devinit bios32_service(unsigned long service)
26082 {
26083 unsigned char return_code; /* %al */
26084 unsigned long address; /* %ebx */
26085 unsigned long length; /* %ecx */
26086 unsigned long entry; /* %edx */
26087 unsigned long flags;
26088 + struct desc_struct d, *gdt;
26089
26090 local_irq_save(flags);
26091 - __asm__("lcall *(%%edi); cld"
26092 +
26093 + gdt = get_cpu_gdt_table(smp_processor_id());
26094 +
26095 + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
26096 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
26097 + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
26098 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
26099 +
26100 + __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
26101 : "=a" (return_code),
26102 "=b" (address),
26103 "=c" (length),
26104 "=d" (entry)
26105 : "0" (service),
26106 "1" (0),
26107 - "D" (&bios32_indirect));
26108 + "D" (&bios32_indirect),
26109 + "r"(__PCIBIOS_DS)
26110 + : "memory");
26111 +
26112 + pax_open_kernel();
26113 + gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
26114 + gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
26115 + gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
26116 + gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
26117 + pax_close_kernel();
26118 +
26119 local_irq_restore(flags);
26120
26121 switch (return_code) {
26122 - case 0:
26123 - return address + entry;
26124 - case 0x80: /* Not present */
26125 - printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
26126 - return 0;
26127 - default: /* Shouldn't happen */
26128 - printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
26129 - service, return_code);
26130 + case 0: {
26131 + int cpu;
26132 + unsigned char flags;
26133 +
26134 + printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
26135 + if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
26136 + printk(KERN_WARNING "bios32_service: not valid\n");
26137 return 0;
26138 + }
26139 + address = address + PAGE_OFFSET;
26140 + length += 16UL; /* some BIOSs underreport this... */
26141 + flags = 4;
26142 + if (length >= 64*1024*1024) {
26143 + length >>= PAGE_SHIFT;
26144 + flags |= 8;
26145 + }
26146 +
26147 + for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
26148 + gdt = get_cpu_gdt_table(cpu);
26149 + pack_descriptor(&d, address, length, 0x9b, flags);
26150 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
26151 + pack_descriptor(&d, address, length, 0x93, flags);
26152 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
26153 + }
26154 + return entry;
26155 + }
26156 + case 0x80: /* Not present */
26157 + printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
26158 + return 0;
26159 + default: /* Shouldn't happen */
26160 + printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
26161 + service, return_code);
26162 + return 0;
26163 }
26164 }
26165
26166 static struct {
26167 unsigned long address;
26168 unsigned short segment;
26169 -} pci_indirect = { 0, __KERNEL_CS };
26170 +} pci_indirect __read_only = { 0, __PCIBIOS_CS };
26171
26172 -static int pci_bios_present;
26173 +static int pci_bios_present __read_only;
26174
26175 static int __devinit check_pcibios(void)
26176 {
26177 @@ -131,11 +174,13 @@ static int __devinit check_pcibios(void)
26178 unsigned long flags, pcibios_entry;
26179
26180 if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
26181 - pci_indirect.address = pcibios_entry + PAGE_OFFSET;
26182 + pci_indirect.address = pcibios_entry;
26183
26184 local_irq_save(flags);
26185 - __asm__(
26186 - "lcall *(%%edi); cld\n\t"
26187 + __asm__("movw %w6, %%ds\n\t"
26188 + "lcall *%%ss:(%%edi); cld\n\t"
26189 + "push %%ss\n\t"
26190 + "pop %%ds\n\t"
26191 "jc 1f\n\t"
26192 "xor %%ah, %%ah\n"
26193 "1:"
26194 @@ -144,7 +189,8 @@ static int __devinit check_pcibios(void)
26195 "=b" (ebx),
26196 "=c" (ecx)
26197 : "1" (PCIBIOS_PCI_BIOS_PRESENT),
26198 - "D" (&pci_indirect)
26199 + "D" (&pci_indirect),
26200 + "r" (__PCIBIOS_DS)
26201 : "memory");
26202 local_irq_restore(flags);
26203
26204 @@ -189,7 +235,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
26205
26206 switch (len) {
26207 case 1:
26208 - __asm__("lcall *(%%esi); cld\n\t"
26209 + __asm__("movw %w6, %%ds\n\t"
26210 + "lcall *%%ss:(%%esi); cld\n\t"
26211 + "push %%ss\n\t"
26212 + "pop %%ds\n\t"
26213 "jc 1f\n\t"
26214 "xor %%ah, %%ah\n"
26215 "1:"
26216 @@ -198,7 +247,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
26217 : "1" (PCIBIOS_READ_CONFIG_BYTE),
26218 "b" (bx),
26219 "D" ((long)reg),
26220 - "S" (&pci_indirect));
26221 + "S" (&pci_indirect),
26222 + "r" (__PCIBIOS_DS));
26223 /*
26224 * Zero-extend the result beyond 8 bits, do not trust the
26225 * BIOS having done it:
26226 @@ -206,7 +256,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
26227 *value &= 0xff;
26228 break;
26229 case 2:
26230 - __asm__("lcall *(%%esi); cld\n\t"
26231 + __asm__("movw %w6, %%ds\n\t"
26232 + "lcall *%%ss:(%%esi); cld\n\t"
26233 + "push %%ss\n\t"
26234 + "pop %%ds\n\t"
26235 "jc 1f\n\t"
26236 "xor %%ah, %%ah\n"
26237 "1:"
26238 @@ -215,7 +268,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
26239 : "1" (PCIBIOS_READ_CONFIG_WORD),
26240 "b" (bx),
26241 "D" ((long)reg),
26242 - "S" (&pci_indirect));
26243 + "S" (&pci_indirect),
26244 + "r" (__PCIBIOS_DS));
26245 /*
26246 * Zero-extend the result beyond 16 bits, do not trust the
26247 * BIOS having done it:
26248 @@ -223,7 +277,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
26249 *value &= 0xffff;
26250 break;
26251 case 4:
26252 - __asm__("lcall *(%%esi); cld\n\t"
26253 + __asm__("movw %w6, %%ds\n\t"
26254 + "lcall *%%ss:(%%esi); cld\n\t"
26255 + "push %%ss\n\t"
26256 + "pop %%ds\n\t"
26257 "jc 1f\n\t"
26258 "xor %%ah, %%ah\n"
26259 "1:"
26260 @@ -232,7 +289,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
26261 : "1" (PCIBIOS_READ_CONFIG_DWORD),
26262 "b" (bx),
26263 "D" ((long)reg),
26264 - "S" (&pci_indirect));
26265 + "S" (&pci_indirect),
26266 + "r" (__PCIBIOS_DS));
26267 break;
26268 }
26269
26270 @@ -256,7 +314,10 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
26271
26272 switch (len) {
26273 case 1:
26274 - __asm__("lcall *(%%esi); cld\n\t"
26275 + __asm__("movw %w6, %%ds\n\t"
26276 + "lcall *%%ss:(%%esi); cld\n\t"
26277 + "push %%ss\n\t"
26278 + "pop %%ds\n\t"
26279 "jc 1f\n\t"
26280 "xor %%ah, %%ah\n"
26281 "1:"
26282 @@ -265,10 +326,14 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
26283 "c" (value),
26284 "b" (bx),
26285 "D" ((long)reg),
26286 - "S" (&pci_indirect));
26287 + "S" (&pci_indirect),
26288 + "r" (__PCIBIOS_DS));
26289 break;
26290 case 2:
26291 - __asm__("lcall *(%%esi); cld\n\t"
26292 + __asm__("movw %w6, %%ds\n\t"
26293 + "lcall *%%ss:(%%esi); cld\n\t"
26294 + "push %%ss\n\t"
26295 + "pop %%ds\n\t"
26296 "jc 1f\n\t"
26297 "xor %%ah, %%ah\n"
26298 "1:"
26299 @@ -277,10 +342,14 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
26300 "c" (value),
26301 "b" (bx),
26302 "D" ((long)reg),
26303 - "S" (&pci_indirect));
26304 + "S" (&pci_indirect),
26305 + "r" (__PCIBIOS_DS));
26306 break;
26307 case 4:
26308 - __asm__("lcall *(%%esi); cld\n\t"
26309 + __asm__("movw %w6, %%ds\n\t"
26310 + "lcall *%%ss:(%%esi); cld\n\t"
26311 + "push %%ss\n\t"
26312 + "pop %%ds\n\t"
26313 "jc 1f\n\t"
26314 "xor %%ah, %%ah\n"
26315 "1:"
26316 @@ -289,7 +358,8 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
26317 "c" (value),
26318 "b" (bx),
26319 "D" ((long)reg),
26320 - "S" (&pci_indirect));
26321 + "S" (&pci_indirect),
26322 + "r" (__PCIBIOS_DS));
26323 break;
26324 }
26325
26326 @@ -394,10 +464,13 @@ struct irq_routing_table * pcibios_get_irq_routing_table(void)
26327
26328 DBG("PCI: Fetching IRQ routing table... ");
26329 __asm__("push %%es\n\t"
26330 + "movw %w8, %%ds\n\t"
26331 "push %%ds\n\t"
26332 "pop %%es\n\t"
26333 - "lcall *(%%esi); cld\n\t"
26334 + "lcall *%%ss:(%%esi); cld\n\t"
26335 "pop %%es\n\t"
26336 + "push %%ss\n\t"
26337 + "pop %%ds\n"
26338 "jc 1f\n\t"
26339 "xor %%ah, %%ah\n"
26340 "1:"
26341 @@ -408,7 +481,8 @@ struct irq_routing_table * pcibios_get_irq_routing_table(void)
26342 "1" (0),
26343 "D" ((long) &opt),
26344 "S" (&pci_indirect),
26345 - "m" (opt)
26346 + "m" (opt),
26347 + "r" (__PCIBIOS_DS)
26348 : "memory");
26349 DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
26350 if (ret & 0xff00)
26351 @@ -432,7 +506,10 @@ int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq)
26352 {
26353 int ret;
26354
26355 - __asm__("lcall *(%%esi); cld\n\t"
26356 + __asm__("movw %w5, %%ds\n\t"
26357 + "lcall *%%ss:(%%esi); cld\n\t"
26358 + "push %%ss\n\t"
26359 + "pop %%ds\n"
26360 "jc 1f\n\t"
26361 "xor %%ah, %%ah\n"
26362 "1:"
26363 @@ -440,7 +517,8 @@ int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq)
26364 : "0" (PCIBIOS_SET_PCI_HW_INT),
26365 "b" ((dev->bus->number << 8) | dev->devfn),
26366 "c" ((irq << 8) | (pin + 10)),
26367 - "S" (&pci_indirect));
26368 + "S" (&pci_indirect),
26369 + "r" (__PCIBIOS_DS));
26370 return !(ret & 0xff00);
26371 }
26372 EXPORT_SYMBOL(pcibios_set_irq_routing);
26373 diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
26374 index 40e4469..1ab536e 100644
26375 --- a/arch/x86/platform/efi/efi_32.c
26376 +++ b/arch/x86/platform/efi/efi_32.c
26377 @@ -44,11 +44,22 @@ void efi_call_phys_prelog(void)
26378 {
26379 struct desc_ptr gdt_descr;
26380
26381 +#ifdef CONFIG_PAX_KERNEXEC
26382 + struct desc_struct d;
26383 +#endif
26384 +
26385 local_irq_save(efi_rt_eflags);
26386
26387 load_cr3(initial_page_table);
26388 __flush_tlb_all();
26389
26390 +#ifdef CONFIG_PAX_KERNEXEC
26391 + pack_descriptor(&d, 0, 0xFFFFF, 0x9B, 0xC);
26392 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
26393 + pack_descriptor(&d, 0, 0xFFFFF, 0x93, 0xC);
26394 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
26395 +#endif
26396 +
26397 gdt_descr.address = __pa(get_cpu_gdt_table(0));
26398 gdt_descr.size = GDT_SIZE - 1;
26399 load_gdt(&gdt_descr);
26400 @@ -58,6 +69,14 @@ void efi_call_phys_epilog(void)
26401 {
26402 struct desc_ptr gdt_descr;
26403
26404 +#ifdef CONFIG_PAX_KERNEXEC
26405 + struct desc_struct d;
26406 +
26407 + memset(&d, 0, sizeof d);
26408 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
26409 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
26410 +#endif
26411 +
26412 gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
26413 gdt_descr.size = GDT_SIZE - 1;
26414 load_gdt(&gdt_descr);
26415 diff --git a/arch/x86/platform/efi/efi_stub_32.S b/arch/x86/platform/efi/efi_stub_32.S
26416 index fbe66e6..eae5e38 100644
26417 --- a/arch/x86/platform/efi/efi_stub_32.S
26418 +++ b/arch/x86/platform/efi/efi_stub_32.S
26419 @@ -6,7 +6,9 @@
26420 */
26421
26422 #include <linux/linkage.h>
26423 +#include <linux/init.h>
26424 #include <asm/page_types.h>
26425 +#include <asm/segment.h>
26426
26427 /*
26428 * efi_call_phys(void *, ...) is a function with variable parameters.
26429 @@ -20,7 +22,7 @@
26430 * service functions will comply with gcc calling convention, too.
26431 */
26432
26433 -.text
26434 +__INIT
26435 ENTRY(efi_call_phys)
26436 /*
26437 * 0. The function can only be called in Linux kernel. So CS has been
26438 @@ -36,10 +38,24 @@ ENTRY(efi_call_phys)
26439 * The mapping of lower virtual memory has been created in prelog and
26440 * epilog.
26441 */
26442 - movl $1f, %edx
26443 - subl $__PAGE_OFFSET, %edx
26444 - jmp *%edx
26445 +#ifdef CONFIG_PAX_KERNEXEC
26446 + movl $(__KERNEXEC_EFI_DS), %edx
26447 + mov %edx, %ds
26448 + mov %edx, %es
26449 + mov %edx, %ss
26450 + addl $2f,(1f)
26451 + ljmp *(1f)
26452 +
26453 +__INITDATA
26454 +1: .long __LOAD_PHYSICAL_ADDR, __KERNEXEC_EFI_CS
26455 +.previous
26456 +
26457 +2:
26458 + subl $2b,(1b)
26459 +#else
26460 + jmp 1f-__PAGE_OFFSET
26461 1:
26462 +#endif
26463
26464 /*
26465 * 2. Now on the top of stack is the return
26466 @@ -47,14 +63,8 @@ ENTRY(efi_call_phys)
26467 * parameter 2, ..., param n. To make things easy, we save the return
26468 * address of efi_call_phys in a global variable.
26469 */
26470 - popl %edx
26471 - movl %edx, saved_return_addr
26472 - /* get the function pointer into ECX*/
26473 - popl %ecx
26474 - movl %ecx, efi_rt_function_ptr
26475 - movl $2f, %edx
26476 - subl $__PAGE_OFFSET, %edx
26477 - pushl %edx
26478 + popl (saved_return_addr)
26479 + popl (efi_rt_function_ptr)
26480
26481 /*
26482 * 3. Clear PG bit in %CR0.
26483 @@ -73,9 +83,8 @@ ENTRY(efi_call_phys)
26484 /*
26485 * 5. Call the physical function.
26486 */
26487 - jmp *%ecx
26488 + call *(efi_rt_function_ptr-__PAGE_OFFSET)
26489
26490 -2:
26491 /*
26492 * 6. After EFI runtime service returns, control will return to
26493 * following instruction. We'd better readjust stack pointer first.
26494 @@ -88,35 +97,36 @@ ENTRY(efi_call_phys)
26495 movl %cr0, %edx
26496 orl $0x80000000, %edx
26497 movl %edx, %cr0
26498 - jmp 1f
26499 -1:
26500 +
26501 /*
26502 * 8. Now restore the virtual mode from flat mode by
26503 * adding EIP with PAGE_OFFSET.
26504 */
26505 - movl $1f, %edx
26506 - jmp *%edx
26507 +#ifdef CONFIG_PAX_KERNEXEC
26508 + movl $(__KERNEL_DS), %edx
26509 + mov %edx, %ds
26510 + mov %edx, %es
26511 + mov %edx, %ss
26512 + ljmp $(__KERNEL_CS),$1f
26513 +#else
26514 + jmp 1f+__PAGE_OFFSET
26515 +#endif
26516 1:
26517
26518 /*
26519 * 9. Balance the stack. And because EAX contain the return value,
26520 * we'd better not clobber it.
26521 */
26522 - leal efi_rt_function_ptr, %edx
26523 - movl (%edx), %ecx
26524 - pushl %ecx
26525 + pushl (efi_rt_function_ptr)
26526
26527 /*
26528 - * 10. Push the saved return address onto the stack and return.
26529 + * 10. Return to the saved return address.
26530 */
26531 - leal saved_return_addr, %edx
26532 - movl (%edx), %ecx
26533 - pushl %ecx
26534 - ret
26535 + jmpl *(saved_return_addr)
26536 ENDPROC(efi_call_phys)
26537 .previous
26538
26539 -.data
26540 +__INITDATA
26541 saved_return_addr:
26542 .long 0
26543 efi_rt_function_ptr:
26544 diff --git a/arch/x86/platform/efi/efi_stub_64.S b/arch/x86/platform/efi/efi_stub_64.S
26545 index 4c07cca..2c8427d 100644
26546 --- a/arch/x86/platform/efi/efi_stub_64.S
26547 +++ b/arch/x86/platform/efi/efi_stub_64.S
26548 @@ -7,6 +7,7 @@
26549 */
26550
26551 #include <linux/linkage.h>
26552 +#include <asm/alternative-asm.h>
26553
26554 #define SAVE_XMM \
26555 mov %rsp, %rax; \
26556 @@ -40,6 +41,7 @@ ENTRY(efi_call0)
26557 call *%rdi
26558 addq $32, %rsp
26559 RESTORE_XMM
26560 + pax_force_retaddr 0, 1
26561 ret
26562 ENDPROC(efi_call0)
26563
26564 @@ -50,6 +52,7 @@ ENTRY(efi_call1)
26565 call *%rdi
26566 addq $32, %rsp
26567 RESTORE_XMM
26568 + pax_force_retaddr 0, 1
26569 ret
26570 ENDPROC(efi_call1)
26571
26572 @@ -60,6 +63,7 @@ ENTRY(efi_call2)
26573 call *%rdi
26574 addq $32, %rsp
26575 RESTORE_XMM
26576 + pax_force_retaddr 0, 1
26577 ret
26578 ENDPROC(efi_call2)
26579
26580 @@ -71,6 +75,7 @@ ENTRY(efi_call3)
26581 call *%rdi
26582 addq $32, %rsp
26583 RESTORE_XMM
26584 + pax_force_retaddr 0, 1
26585 ret
26586 ENDPROC(efi_call3)
26587
26588 @@ -83,6 +88,7 @@ ENTRY(efi_call4)
26589 call *%rdi
26590 addq $32, %rsp
26591 RESTORE_XMM
26592 + pax_force_retaddr 0, 1
26593 ret
26594 ENDPROC(efi_call4)
26595
26596 @@ -96,6 +102,7 @@ ENTRY(efi_call5)
26597 call *%rdi
26598 addq $48, %rsp
26599 RESTORE_XMM
26600 + pax_force_retaddr 0, 1
26601 ret
26602 ENDPROC(efi_call5)
26603
26604 @@ -112,5 +119,6 @@ ENTRY(efi_call6)
26605 call *%rdi
26606 addq $48, %rsp
26607 RESTORE_XMM
26608 + pax_force_retaddr 0, 1
26609 ret
26610 ENDPROC(efi_call6)
26611 diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c
26612 index fd41a92..9c33628 100644
26613 --- a/arch/x86/platform/mrst/mrst.c
26614 +++ b/arch/x86/platform/mrst/mrst.c
26615 @@ -78,13 +78,15 @@ struct sfi_rtc_table_entry sfi_mrtc_array[SFI_MRTC_MAX];
26616 EXPORT_SYMBOL_GPL(sfi_mrtc_array);
26617 int sfi_mrtc_num;
26618
26619 -static void mrst_power_off(void)
26620 +static __noreturn void mrst_power_off(void)
26621 {
26622 + BUG();
26623 }
26624
26625 -static void mrst_reboot(void)
26626 +static __noreturn void mrst_reboot(void)
26627 {
26628 intel_scu_ipc_simple_command(IPCMSG_COLD_BOOT, 0);
26629 + BUG();
26630 }
26631
26632 /* parse all the mtimer info to a static mtimer array */
26633 diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
26634 index 218cdb1..fd55c08 100644
26635 --- a/arch/x86/power/cpu.c
26636 +++ b/arch/x86/power/cpu.c
26637 @@ -132,7 +132,7 @@ static void do_fpu_end(void)
26638 static void fix_processor_context(void)
26639 {
26640 int cpu = smp_processor_id();
26641 - struct tss_struct *t = &per_cpu(init_tss, cpu);
26642 + struct tss_struct *t = init_tss + cpu;
26643
26644 set_tss_desc(cpu, t); /*
26645 * This just modifies memory; should not be
26646 @@ -142,7 +142,9 @@ static void fix_processor_context(void)
26647 */
26648
26649 #ifdef CONFIG_X86_64
26650 + pax_open_kernel();
26651 get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
26652 + pax_close_kernel();
26653
26654 syscall_init(); /* This sets MSR_*STAR and related */
26655 #endif
26656 diff --git a/arch/x86/realmode/init.c b/arch/x86/realmode/init.c
26657 index cbca565..bae7133 100644
26658 --- a/arch/x86/realmode/init.c
26659 +++ b/arch/x86/realmode/init.c
26660 @@ -62,7 +62,13 @@ void __init setup_real_mode(void)
26661 __va(real_mode_header->trampoline_header);
26662
26663 #ifdef CONFIG_X86_32
26664 - trampoline_header->start = __pa(startup_32_smp);
26665 + trampoline_header->start = __pa(ktla_ktva(startup_32_smp));
26666 +
26667 +#ifdef CONFIG_PAX_KERNEXEC
26668 + trampoline_header->start -= LOAD_PHYSICAL_ADDR;
26669 +#endif
26670 +
26671 + trampoline_header->boot_cs = __BOOT_CS;
26672 trampoline_header->gdt_limit = __BOOT_DS + 7;
26673 trampoline_header->gdt_base = __pa(boot_gdt);
26674 #else
26675 diff --git a/arch/x86/realmode/rm/Makefile b/arch/x86/realmode/rm/Makefile
26676 index 5b84a2d..a004393 100644
26677 --- a/arch/x86/realmode/rm/Makefile
26678 +++ b/arch/x86/realmode/rm/Makefile
26679 @@ -78,5 +78,8 @@ KBUILD_CFLAGS := $(LINUXINCLUDE) -m32 -g -Os -D_SETUP -D__KERNEL__ -D_WAKEUP \
26680 $(call cc-option, -fno-unit-at-a-time)) \
26681 $(call cc-option, -fno-stack-protector) \
26682 $(call cc-option, -mpreferred-stack-boundary=2)
26683 +ifdef CONSTIFY_PLUGIN
26684 +KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) -fplugin-arg-constify_plugin-no-constify
26685 +endif
26686 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
26687 GCOV_PROFILE := n
26688 diff --git a/arch/x86/realmode/rm/trampoline_32.S b/arch/x86/realmode/rm/trampoline_32.S
26689 index c1b2791..f9e31c7 100644
26690 --- a/arch/x86/realmode/rm/trampoline_32.S
26691 +++ b/arch/x86/realmode/rm/trampoline_32.S
26692 @@ -25,6 +25,12 @@
26693 #include <asm/page_types.h>
26694 #include "realmode.h"
26695
26696 +#ifdef CONFIG_PAX_KERNEXEC
26697 +#define ta(X) (X)
26698 +#else
26699 +#define ta(X) (pa_ ## X)
26700 +#endif
26701 +
26702 .text
26703 .code16
26704
26705 @@ -39,8 +45,6 @@ ENTRY(trampoline_start)
26706
26707 cli # We should be safe anyway
26708
26709 - movl tr_start, %eax # where we need to go
26710 -
26711 movl $0xA5A5A5A5, trampoline_status
26712 # write marker for master knows we're running
26713
26714 @@ -56,7 +60,7 @@ ENTRY(trampoline_start)
26715 movw $1, %dx # protected mode (PE) bit
26716 lmsw %dx # into protected mode
26717
26718 - ljmpl $__BOOT_CS, $pa_startup_32
26719 + ljmpl *(trampoline_header)
26720
26721 .section ".text32","ax"
26722 .code32
26723 @@ -67,7 +71,7 @@ ENTRY(startup_32) # note: also used from wakeup_asm.S
26724 .balign 8
26725 GLOBAL(trampoline_header)
26726 tr_start: .space 4
26727 - tr_gdt_pad: .space 2
26728 + tr_boot_cs: .space 2
26729 tr_gdt: .space 6
26730 END(trampoline_header)
26731
26732 diff --git a/arch/x86/realmode/rm/trampoline_64.S b/arch/x86/realmode/rm/trampoline_64.S
26733 index bb360dc..3e5945f 100644
26734 --- a/arch/x86/realmode/rm/trampoline_64.S
26735 +++ b/arch/x86/realmode/rm/trampoline_64.S
26736 @@ -107,7 +107,7 @@ ENTRY(startup_32)
26737 wrmsr
26738
26739 # Enable paging and in turn activate Long Mode
26740 - movl $(X86_CR0_PG | X86_CR0_WP | X86_CR0_PE), %eax
26741 + movl $(X86_CR0_PG | X86_CR0_PE), %eax
26742 movl %eax, %cr0
26743
26744 /*
26745 diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
26746 index 5a1847d..deccb30 100644
26747 --- a/arch/x86/tools/relocs.c
26748 +++ b/arch/x86/tools/relocs.c
26749 @@ -12,10 +12,13 @@
26750 #include <regex.h>
26751 #include <tools/le_byteshift.h>
26752
26753 +#include "../../../include/generated/autoconf.h"
26754 +
26755 static void die(char *fmt, ...);
26756
26757 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
26758 static Elf32_Ehdr ehdr;
26759 +static Elf32_Phdr *phdr;
26760 static unsigned long reloc_count, reloc_idx;
26761 static unsigned long *relocs;
26762 static unsigned long reloc16_count, reloc16_idx;
26763 @@ -330,9 +333,39 @@ static void read_ehdr(FILE *fp)
26764 }
26765 }
26766
26767 +static void read_phdrs(FILE *fp)
26768 +{
26769 + unsigned int i;
26770 +
26771 + phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
26772 + if (!phdr) {
26773 + die("Unable to allocate %d program headers\n",
26774 + ehdr.e_phnum);
26775 + }
26776 + if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
26777 + die("Seek to %d failed: %s\n",
26778 + ehdr.e_phoff, strerror(errno));
26779 + }
26780 + if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
26781 + die("Cannot read ELF program headers: %s\n",
26782 + strerror(errno));
26783 + }
26784 + for(i = 0; i < ehdr.e_phnum; i++) {
26785 + phdr[i].p_type = elf32_to_cpu(phdr[i].p_type);
26786 + phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset);
26787 + phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr);
26788 + phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr);
26789 + phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz);
26790 + phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz);
26791 + phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags);
26792 + phdr[i].p_align = elf32_to_cpu(phdr[i].p_align);
26793 + }
26794 +
26795 +}
26796 +
26797 static void read_shdrs(FILE *fp)
26798 {
26799 - int i;
26800 + unsigned int i;
26801 Elf32_Shdr shdr;
26802
26803 secs = calloc(ehdr.e_shnum, sizeof(struct section));
26804 @@ -367,7 +400,7 @@ static void read_shdrs(FILE *fp)
26805
26806 static void read_strtabs(FILE *fp)
26807 {
26808 - int i;
26809 + unsigned int i;
26810 for (i = 0; i < ehdr.e_shnum; i++) {
26811 struct section *sec = &secs[i];
26812 if (sec->shdr.sh_type != SHT_STRTAB) {
26813 @@ -392,7 +425,7 @@ static void read_strtabs(FILE *fp)
26814
26815 static void read_symtabs(FILE *fp)
26816 {
26817 - int i,j;
26818 + unsigned int i,j;
26819 for (i = 0; i < ehdr.e_shnum; i++) {
26820 struct section *sec = &secs[i];
26821 if (sec->shdr.sh_type != SHT_SYMTAB) {
26822 @@ -423,9 +456,11 @@ static void read_symtabs(FILE *fp)
26823 }
26824
26825
26826 -static void read_relocs(FILE *fp)
26827 +static void read_relocs(FILE *fp, int use_real_mode)
26828 {
26829 - int i,j;
26830 + unsigned int i,j;
26831 + uint32_t base;
26832 +
26833 for (i = 0; i < ehdr.e_shnum; i++) {
26834 struct section *sec = &secs[i];
26835 if (sec->shdr.sh_type != SHT_REL) {
26836 @@ -445,9 +480,22 @@ static void read_relocs(FILE *fp)
26837 die("Cannot read symbol table: %s\n",
26838 strerror(errno));
26839 }
26840 + base = 0;
26841 +
26842 +#ifdef CONFIG_X86_32
26843 + for (j = 0; !use_real_mode && j < ehdr.e_phnum; j++) {
26844 + if (phdr[j].p_type != PT_LOAD )
26845 + continue;
26846 + if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
26847 + continue;
26848 + base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
26849 + break;
26850 + }
26851 +#endif
26852 +
26853 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
26854 Elf32_Rel *rel = &sec->reltab[j];
26855 - rel->r_offset = elf32_to_cpu(rel->r_offset);
26856 + rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
26857 rel->r_info = elf32_to_cpu(rel->r_info);
26858 }
26859 }
26860 @@ -456,13 +504,13 @@ static void read_relocs(FILE *fp)
26861
26862 static void print_absolute_symbols(void)
26863 {
26864 - int i;
26865 + unsigned int i;
26866 printf("Absolute symbols\n");
26867 printf(" Num: Value Size Type Bind Visibility Name\n");
26868 for (i = 0; i < ehdr.e_shnum; i++) {
26869 struct section *sec = &secs[i];
26870 char *sym_strtab;
26871 - int j;
26872 + unsigned int j;
26873
26874 if (sec->shdr.sh_type != SHT_SYMTAB) {
26875 continue;
26876 @@ -489,14 +537,14 @@ static void print_absolute_symbols(void)
26877
26878 static void print_absolute_relocs(void)
26879 {
26880 - int i, printed = 0;
26881 + unsigned int i, printed = 0;
26882
26883 for (i = 0; i < ehdr.e_shnum; i++) {
26884 struct section *sec = &secs[i];
26885 struct section *sec_applies, *sec_symtab;
26886 char *sym_strtab;
26887 Elf32_Sym *sh_symtab;
26888 - int j;
26889 + unsigned int j;
26890 if (sec->shdr.sh_type != SHT_REL) {
26891 continue;
26892 }
26893 @@ -558,13 +606,13 @@ static void print_absolute_relocs(void)
26894 static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym),
26895 int use_real_mode)
26896 {
26897 - int i;
26898 + unsigned int i;
26899 /* Walk through the relocations */
26900 for (i = 0; i < ehdr.e_shnum; i++) {
26901 char *sym_strtab;
26902 Elf32_Sym *sh_symtab;
26903 struct section *sec_applies, *sec_symtab;
26904 - int j;
26905 + unsigned int j;
26906 struct section *sec = &secs[i];
26907
26908 if (sec->shdr.sh_type != SHT_REL) {
26909 @@ -588,6 +636,24 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym),
26910 sym = &sh_symtab[ELF32_R_SYM(rel->r_info)];
26911 r_type = ELF32_R_TYPE(rel->r_info);
26912
26913 + if (!use_real_mode) {
26914 + /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
26915 + if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
26916 + continue;
26917 +
26918 +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
26919 + /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
26920 + if (!strcmp(sec_name(sym->st_shndx), ".text.end") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
26921 + continue;
26922 + if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
26923 + continue;
26924 + if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
26925 + continue;
26926 + if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
26927 + continue;
26928 +#endif
26929 + }
26930 +
26931 shn_abs = sym->st_shndx == SHN_ABS;
26932
26933 switch (r_type) {
26934 @@ -681,7 +747,7 @@ static int write32(unsigned int v, FILE *f)
26935
26936 static void emit_relocs(int as_text, int use_real_mode)
26937 {
26938 - int i;
26939 + unsigned int i;
26940 /* Count how many relocations I have and allocate space for them. */
26941 reloc_count = 0;
26942 walk_relocs(count_reloc, use_real_mode);
26943 @@ -808,10 +874,11 @@ int main(int argc, char **argv)
26944 fname, strerror(errno));
26945 }
26946 read_ehdr(fp);
26947 + read_phdrs(fp);
26948 read_shdrs(fp);
26949 read_strtabs(fp);
26950 read_symtabs(fp);
26951 - read_relocs(fp);
26952 + read_relocs(fp, use_real_mode);
26953 if (show_absolute_syms) {
26954 print_absolute_symbols();
26955 return 0;
26956 diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
26957 index fd14be1..e3c79c0 100644
26958 --- a/arch/x86/vdso/Makefile
26959 +++ b/arch/x86/vdso/Makefile
26960 @@ -181,7 +181,7 @@ quiet_cmd_vdso = VDSO $@
26961 -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
26962 sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
26963
26964 -VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
26965 +VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
26966 GCOV_PROFILE := n
26967
26968 #
26969 diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
26970 index 66e6d93..587f435 100644
26971 --- a/arch/x86/vdso/vdso32-setup.c
26972 +++ b/arch/x86/vdso/vdso32-setup.c
26973 @@ -25,6 +25,7 @@
26974 #include <asm/tlbflush.h>
26975 #include <asm/vdso.h>
26976 #include <asm/proto.h>
26977 +#include <asm/mman.h>
26978
26979 enum {
26980 VDSO_DISABLED = 0,
26981 @@ -226,7 +227,7 @@ static inline void map_compat_vdso(int map)
26982 void enable_sep_cpu(void)
26983 {
26984 int cpu = get_cpu();
26985 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
26986 + struct tss_struct *tss = init_tss + cpu;
26987
26988 if (!boot_cpu_has(X86_FEATURE_SEP)) {
26989 put_cpu();
26990 @@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
26991 gate_vma.vm_start = FIXADDR_USER_START;
26992 gate_vma.vm_end = FIXADDR_USER_END;
26993 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
26994 - gate_vma.vm_page_prot = __P101;
26995 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
26996
26997 return 0;
26998 }
26999 @@ -330,14 +331,14 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
27000 if (compat)
27001 addr = VDSO_HIGH_BASE;
27002 else {
27003 - addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
27004 + addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
27005 if (IS_ERR_VALUE(addr)) {
27006 ret = addr;
27007 goto up_fail;
27008 }
27009 }
27010
27011 - current->mm->context.vdso = (void *)addr;
27012 + current->mm->context.vdso = addr;
27013
27014 if (compat_uses_vma || !compat) {
27015 /*
27016 @@ -353,11 +354,11 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
27017 }
27018
27019 current_thread_info()->sysenter_return =
27020 - VDSO32_SYMBOL(addr, SYSENTER_RETURN);
27021 + (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
27022
27023 up_fail:
27024 if (ret)
27025 - current->mm->context.vdso = NULL;
27026 + current->mm->context.vdso = 0;
27027
27028 up_write(&mm->mmap_sem);
27029
27030 @@ -404,8 +405,14 @@ __initcall(ia32_binfmt_init);
27031
27032 const char *arch_vma_name(struct vm_area_struct *vma)
27033 {
27034 - if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
27035 + if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
27036 return "[vdso]";
27037 +
27038 +#ifdef CONFIG_PAX_SEGMEXEC
27039 + if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
27040 + return "[vdso]";
27041 +#endif
27042 +
27043 return NULL;
27044 }
27045
27046 @@ -415,7 +422,7 @@ struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
27047 * Check to see if the corresponding task was created in compat vdso
27048 * mode.
27049 */
27050 - if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
27051 + if (mm && mm->context.vdso == VDSO_HIGH_BASE)
27052 return &gate_vma;
27053 return NULL;
27054 }
27055 diff --git a/arch/x86/vdso/vma.c b/arch/x86/vdso/vma.c
27056 index 00aaf04..4a26505 100644
27057 --- a/arch/x86/vdso/vma.c
27058 +++ b/arch/x86/vdso/vma.c
27059 @@ -16,8 +16,6 @@
27060 #include <asm/vdso.h>
27061 #include <asm/page.h>
27062
27063 -unsigned int __read_mostly vdso_enabled = 1;
27064 -
27065 extern char vdso_start[], vdso_end[];
27066 extern unsigned short vdso_sync_cpuid;
27067
27068 @@ -141,7 +139,6 @@ static unsigned long vdso_addr(unsigned long start, unsigned len)
27069 * unaligned here as a result of stack start randomization.
27070 */
27071 addr = PAGE_ALIGN(addr);
27072 - addr = align_addr(addr, NULL, ALIGN_VDSO);
27073
27074 return addr;
27075 }
27076 @@ -154,30 +151,31 @@ static int setup_additional_pages(struct linux_binprm *bprm,
27077 unsigned size)
27078 {
27079 struct mm_struct *mm = current->mm;
27080 - unsigned long addr;
27081 + unsigned long addr = 0;
27082 int ret;
27083
27084 - if (!vdso_enabled)
27085 - return 0;
27086 -
27087 down_write(&mm->mmap_sem);
27088 +
27089 +#ifdef CONFIG_PAX_RANDMMAP
27090 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
27091 +#endif
27092 +
27093 addr = vdso_addr(mm->start_stack, size);
27094 + addr = align_addr(addr, NULL, ALIGN_VDSO);
27095 addr = get_unmapped_area(NULL, addr, size, 0, 0);
27096 if (IS_ERR_VALUE(addr)) {
27097 ret = addr;
27098 goto up_fail;
27099 }
27100
27101 - current->mm->context.vdso = (void *)addr;
27102 + mm->context.vdso = addr;
27103
27104 ret = install_special_mapping(mm, addr, size,
27105 VM_READ|VM_EXEC|
27106 VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC,
27107 pages);
27108 - if (ret) {
27109 - current->mm->context.vdso = NULL;
27110 - goto up_fail;
27111 - }
27112 + if (ret)
27113 + mm->context.vdso = 0;
27114
27115 up_fail:
27116 up_write(&mm->mmap_sem);
27117 @@ -197,10 +195,3 @@ int x32_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
27118 vdsox32_size);
27119 }
27120 #endif
27121 -
27122 -static __init int vdso_setup(char *s)
27123 -{
27124 - vdso_enabled = simple_strtoul(s, NULL, 0);
27125 - return 0;
27126 -}
27127 -__setup("vdso=", vdso_setup);
27128 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
27129 index ff962d4..2bb5e83 100644
27130 --- a/arch/x86/xen/enlighten.c
27131 +++ b/arch/x86/xen/enlighten.c
27132 @@ -97,8 +97,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
27133
27134 struct shared_info xen_dummy_shared_info;
27135
27136 -void *xen_initial_gdt;
27137 -
27138 RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
27139 __read_mostly int xen_have_vector_callback;
27140 EXPORT_SYMBOL_GPL(xen_have_vector_callback);
27141 @@ -1175,30 +1173,30 @@ static const struct pv_apic_ops xen_apic_ops __initconst = {
27142 #endif
27143 };
27144
27145 -static void xen_reboot(int reason)
27146 +static __noreturn void xen_reboot(int reason)
27147 {
27148 struct sched_shutdown r = { .reason = reason };
27149
27150 - if (HYPERVISOR_sched_op(SCHEDOP_shutdown, &r))
27151 - BUG();
27152 + HYPERVISOR_sched_op(SCHEDOP_shutdown, &r);
27153 + BUG();
27154 }
27155
27156 -static void xen_restart(char *msg)
27157 +static __noreturn void xen_restart(char *msg)
27158 {
27159 xen_reboot(SHUTDOWN_reboot);
27160 }
27161
27162 -static void xen_emergency_restart(void)
27163 +static __noreturn void xen_emergency_restart(void)
27164 {
27165 xen_reboot(SHUTDOWN_reboot);
27166 }
27167
27168 -static void xen_machine_halt(void)
27169 +static __noreturn void xen_machine_halt(void)
27170 {
27171 xen_reboot(SHUTDOWN_poweroff);
27172 }
27173
27174 -static void xen_machine_power_off(void)
27175 +static __noreturn void xen_machine_power_off(void)
27176 {
27177 if (pm_power_off)
27178 pm_power_off();
27179 @@ -1301,7 +1299,17 @@ asmlinkage void __init xen_start_kernel(void)
27180 __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
27181
27182 /* Work out if we support NX */
27183 - x86_configure_nx();
27184 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
27185 + if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
27186 + (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
27187 + unsigned l, h;
27188 +
27189 + __supported_pte_mask |= _PAGE_NX;
27190 + rdmsr(MSR_EFER, l, h);
27191 + l |= EFER_NX;
27192 + wrmsr(MSR_EFER, l, h);
27193 + }
27194 +#endif
27195
27196 xen_setup_features();
27197
27198 @@ -1332,13 +1340,6 @@ asmlinkage void __init xen_start_kernel(void)
27199
27200 machine_ops = xen_machine_ops;
27201
27202 - /*
27203 - * The only reliable way to retain the initial address of the
27204 - * percpu gdt_page is to remember it here, so we can go and
27205 - * mark it RW later, when the initial percpu area is freed.
27206 - */
27207 - xen_initial_gdt = &per_cpu(gdt_page, 0);
27208 -
27209 xen_smp_init();
27210
27211 #ifdef CONFIG_ACPI_NUMA
27212 diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
27213 index 3a73785..0d30df2 100644
27214 --- a/arch/x86/xen/mmu.c
27215 +++ b/arch/x86/xen/mmu.c
27216 @@ -1738,6 +1738,9 @@ pgd_t * __init xen_setup_kernel_pagetable(pgd_t *pgd,
27217 convert_pfn_mfn(init_level4_pgt);
27218 convert_pfn_mfn(level3_ident_pgt);
27219 convert_pfn_mfn(level3_kernel_pgt);
27220 + convert_pfn_mfn(level3_vmalloc_start_pgt);
27221 + convert_pfn_mfn(level3_vmalloc_end_pgt);
27222 + convert_pfn_mfn(level3_vmemmap_pgt);
27223
27224 l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
27225 l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
27226 @@ -1756,7 +1759,11 @@ pgd_t * __init xen_setup_kernel_pagetable(pgd_t *pgd,
27227 set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
27228 set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
27229 set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
27230 + set_page_prot(level3_vmalloc_start_pgt, PAGE_KERNEL_RO);
27231 + set_page_prot(level3_vmalloc_end_pgt, PAGE_KERNEL_RO);
27232 + set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
27233 set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
27234 + set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
27235 set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
27236 set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
27237
27238 @@ -1940,6 +1947,7 @@ static void __init xen_post_allocator_init(void)
27239 pv_mmu_ops.set_pud = xen_set_pud;
27240 #if PAGETABLE_LEVELS == 4
27241 pv_mmu_ops.set_pgd = xen_set_pgd;
27242 + pv_mmu_ops.set_pgd_batched = xen_set_pgd;
27243 #endif
27244
27245 /* This will work as long as patching hasn't happened yet
27246 @@ -2021,6 +2029,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
27247 .pud_val = PV_CALLEE_SAVE(xen_pud_val),
27248 .make_pud = PV_CALLEE_SAVE(xen_make_pud),
27249 .set_pgd = xen_set_pgd_hyper,
27250 + .set_pgd_batched = xen_set_pgd_hyper,
27251
27252 .alloc_pud = xen_alloc_pmd_init,
27253 .release_pud = xen_release_pmd_init,
27254 diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
27255 index afb250d..627075f 100644
27256 --- a/arch/x86/xen/smp.c
27257 +++ b/arch/x86/xen/smp.c
27258 @@ -231,11 +231,6 @@ static void __init xen_smp_prepare_boot_cpu(void)
27259 {
27260 BUG_ON(smp_processor_id() != 0);
27261 native_smp_prepare_boot_cpu();
27262 -
27263 - /* We've switched to the "real" per-cpu gdt, so make sure the
27264 - old memory can be recycled */
27265 - make_lowmem_page_readwrite(xen_initial_gdt);
27266 -
27267 xen_filter_cpu_maps();
27268 xen_setup_vcpu_info_placement();
27269 }
27270 @@ -302,12 +297,12 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
27271 gdt = get_cpu_gdt_table(cpu);
27272
27273 ctxt->flags = VGCF_IN_KERNEL;
27274 - ctxt->user_regs.ds = __USER_DS;
27275 - ctxt->user_regs.es = __USER_DS;
27276 + ctxt->user_regs.ds = __KERNEL_DS;
27277 + ctxt->user_regs.es = __KERNEL_DS;
27278 ctxt->user_regs.ss = __KERNEL_DS;
27279 #ifdef CONFIG_X86_32
27280 ctxt->user_regs.fs = __KERNEL_PERCPU;
27281 - ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
27282 + savesegment(gs, ctxt->user_regs.gs);
27283 #else
27284 ctxt->gs_base_kernel = per_cpu_offset(cpu);
27285 #endif
27286 @@ -357,13 +352,12 @@ static int __cpuinit xen_cpu_up(unsigned int cpu, struct task_struct *idle)
27287 int rc;
27288
27289 per_cpu(current_task, cpu) = idle;
27290 + per_cpu(current_tinfo, cpu) = &idle->tinfo;
27291 #ifdef CONFIG_X86_32
27292 irq_ctx_init(cpu);
27293 #else
27294 clear_tsk_thread_flag(idle, TIF_FORK);
27295 - per_cpu(kernel_stack, cpu) =
27296 - (unsigned long)task_stack_page(idle) -
27297 - KERNEL_STACK_OFFSET + THREAD_SIZE;
27298 + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
27299 #endif
27300 xen_setup_runstate_info(cpu);
27301 xen_setup_timer(cpu);
27302 diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S
27303 index f9643fc..602e8af 100644
27304 --- a/arch/x86/xen/xen-asm_32.S
27305 +++ b/arch/x86/xen/xen-asm_32.S
27306 @@ -84,14 +84,14 @@ ENTRY(xen_iret)
27307 ESP_OFFSET=4 # bytes pushed onto stack
27308
27309 /*
27310 - * Store vcpu_info pointer for easy access. Do it this way to
27311 - * avoid having to reload %fs
27312 + * Store vcpu_info pointer for easy access.
27313 */
27314 #ifdef CONFIG_SMP
27315 - GET_THREAD_INFO(%eax)
27316 - movl TI_cpu(%eax), %eax
27317 - movl __per_cpu_offset(,%eax,4), %eax
27318 - mov xen_vcpu(%eax), %eax
27319 + push %fs
27320 + mov $(__KERNEL_PERCPU), %eax
27321 + mov %eax, %fs
27322 + mov PER_CPU_VAR(xen_vcpu), %eax
27323 + pop %fs
27324 #else
27325 movl xen_vcpu, %eax
27326 #endif
27327 diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S
27328 index aaa7291..3f77960 100644
27329 --- a/arch/x86/xen/xen-head.S
27330 +++ b/arch/x86/xen/xen-head.S
27331 @@ -19,6 +19,17 @@ ENTRY(startup_xen)
27332 #ifdef CONFIG_X86_32
27333 mov %esi,xen_start_info
27334 mov $init_thread_union+THREAD_SIZE,%esp
27335 +#ifdef CONFIG_SMP
27336 + movl $cpu_gdt_table,%edi
27337 + movl $__per_cpu_load,%eax
27338 + movw %ax,__KERNEL_PERCPU + 2(%edi)
27339 + rorl $16,%eax
27340 + movb %al,__KERNEL_PERCPU + 4(%edi)
27341 + movb %ah,__KERNEL_PERCPU + 7(%edi)
27342 + movl $__per_cpu_end - 1,%eax
27343 + subl $__per_cpu_start,%eax
27344 + movw %ax,__KERNEL_PERCPU + 0(%edi)
27345 +#endif
27346 #else
27347 mov %rsi,xen_start_info
27348 mov $init_thread_union+THREAD_SIZE,%rsp
27349 diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
27350 index 202d4c1..99b072a 100644
27351 --- a/arch/x86/xen/xen-ops.h
27352 +++ b/arch/x86/xen/xen-ops.h
27353 @@ -10,8 +10,6 @@
27354 extern const char xen_hypervisor_callback[];
27355 extern const char xen_failsafe_callback[];
27356
27357 -extern void *xen_initial_gdt;
27358 -
27359 struct trap_info;
27360 void xen_copy_trap_info(struct trap_info *traps);
27361
27362 diff --git a/arch/xtensa/variants/dc232b/include/variant/core.h b/arch/xtensa/variants/dc232b/include/variant/core.h
27363 index 525bd3d..ef888b1 100644
27364 --- a/arch/xtensa/variants/dc232b/include/variant/core.h
27365 +++ b/arch/xtensa/variants/dc232b/include/variant/core.h
27366 @@ -119,9 +119,9 @@
27367 ----------------------------------------------------------------------*/
27368
27369 #define XCHAL_ICACHE_LINESIZE 32 /* I-cache line size in bytes */
27370 -#define XCHAL_DCACHE_LINESIZE 32 /* D-cache line size in bytes */
27371 #define XCHAL_ICACHE_LINEWIDTH 5 /* log2(I line size in bytes) */
27372 #define XCHAL_DCACHE_LINEWIDTH 5 /* log2(D line size in bytes) */
27373 +#define XCHAL_DCACHE_LINESIZE (_AC(1,UL) << XCHAL_DCACHE_LINEWIDTH) /* D-cache line size in bytes */
27374
27375 #define XCHAL_ICACHE_SIZE 16384 /* I-cache size in bytes or 0 */
27376 #define XCHAL_DCACHE_SIZE 16384 /* D-cache size in bytes or 0 */
27377 diff --git a/arch/xtensa/variants/fsf/include/variant/core.h b/arch/xtensa/variants/fsf/include/variant/core.h
27378 index 2f33760..835e50a 100644
27379 --- a/arch/xtensa/variants/fsf/include/variant/core.h
27380 +++ b/arch/xtensa/variants/fsf/include/variant/core.h
27381 @@ -11,6 +11,7 @@
27382 #ifndef _XTENSA_CORE_H
27383 #define _XTENSA_CORE_H
27384
27385 +#include <linux/const.h>
27386
27387 /****************************************************************************
27388 Parameters Useful for Any Code, USER or PRIVILEGED
27389 @@ -112,9 +113,9 @@
27390 ----------------------------------------------------------------------*/
27391
27392 #define XCHAL_ICACHE_LINESIZE 16 /* I-cache line size in bytes */
27393 -#define XCHAL_DCACHE_LINESIZE 16 /* D-cache line size in bytes */
27394 #define XCHAL_ICACHE_LINEWIDTH 4 /* log2(I line size in bytes) */
27395 #define XCHAL_DCACHE_LINEWIDTH 4 /* log2(D line size in bytes) */
27396 +#define XCHAL_DCACHE_LINESIZE (_AC(1,UL) << XCHAL_DCACHE_LINEWIDTH) /* D-cache line size in bytes */
27397
27398 #define XCHAL_ICACHE_SIZE 8192 /* I-cache size in bytes or 0 */
27399 #define XCHAL_DCACHE_SIZE 8192 /* D-cache size in bytes or 0 */
27400 diff --git a/arch/xtensa/variants/s6000/include/variant/core.h b/arch/xtensa/variants/s6000/include/variant/core.h
27401 index af00795..2bb8105 100644
27402 --- a/arch/xtensa/variants/s6000/include/variant/core.h
27403 +++ b/arch/xtensa/variants/s6000/include/variant/core.h
27404 @@ -11,6 +11,7 @@
27405 #ifndef _XTENSA_CORE_CONFIGURATION_H
27406 #define _XTENSA_CORE_CONFIGURATION_H
27407
27408 +#include <linux/const.h>
27409
27410 /****************************************************************************
27411 Parameters Useful for Any Code, USER or PRIVILEGED
27412 @@ -118,9 +119,9 @@
27413 ----------------------------------------------------------------------*/
27414
27415 #define XCHAL_ICACHE_LINESIZE 16 /* I-cache line size in bytes */
27416 -#define XCHAL_DCACHE_LINESIZE 16 /* D-cache line size in bytes */
27417 #define XCHAL_ICACHE_LINEWIDTH 4 /* log2(I line size in bytes) */
27418 #define XCHAL_DCACHE_LINEWIDTH 4 /* log2(D line size in bytes) */
27419 +#define XCHAL_DCACHE_LINESIZE (_AC(1,UL) << XCHAL_DCACHE_LINEWIDTH) /* D-cache line size in bytes */
27420
27421 #define XCHAL_ICACHE_SIZE 32768 /* I-cache size in bytes or 0 */
27422 #define XCHAL_DCACHE_SIZE 32768 /* D-cache size in bytes or 0 */
27423 diff --git a/block/blk-iopoll.c b/block/blk-iopoll.c
27424 index 58916af..9cb880b 100644
27425 --- a/block/blk-iopoll.c
27426 +++ b/block/blk-iopoll.c
27427 @@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopoll *iopoll)
27428 }
27429 EXPORT_SYMBOL(blk_iopoll_complete);
27430
27431 -static void blk_iopoll_softirq(struct softirq_action *h)
27432 +static void blk_iopoll_softirq(void)
27433 {
27434 struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
27435 int rearm = 0, budget = blk_iopoll_budget;
27436 diff --git a/block/blk-map.c b/block/blk-map.c
27437 index 623e1cd..ca1e109 100644
27438 --- a/block/blk-map.c
27439 +++ b/block/blk-map.c
27440 @@ -302,7 +302,7 @@ int blk_rq_map_kern(struct request_queue *q, struct request *rq, void *kbuf,
27441 if (!len || !kbuf)
27442 return -EINVAL;
27443
27444 - do_copy = !blk_rq_aligned(q, addr, len) || object_is_on_stack(kbuf);
27445 + do_copy = !blk_rq_aligned(q, addr, len) || object_starts_on_stack(kbuf);
27446 if (do_copy)
27447 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
27448 else
27449 diff --git a/block/blk-softirq.c b/block/blk-softirq.c
27450 index 467c8de..4bddc6d 100644
27451 --- a/block/blk-softirq.c
27452 +++ b/block/blk-softirq.c
27453 @@ -18,7 +18,7 @@ static DEFINE_PER_CPU(struct list_head, blk_cpu_done);
27454 * Softirq action handler - move entries to local list and loop over them
27455 * while passing them to the queue registered handler.
27456 */
27457 -static void blk_done_softirq(struct softirq_action *h)
27458 +static void blk_done_softirq(void)
27459 {
27460 struct list_head *cpu_list, local_list;
27461
27462 diff --git a/block/bsg.c b/block/bsg.c
27463 index ff64ae3..593560c 100644
27464 --- a/block/bsg.c
27465 +++ b/block/bsg.c
27466 @@ -176,16 +176,24 @@ static int blk_fill_sgv4_hdr_rq(struct request_queue *q, struct request *rq,
27467 struct sg_io_v4 *hdr, struct bsg_device *bd,
27468 fmode_t has_write_perm)
27469 {
27470 + unsigned char tmpcmd[sizeof(rq->__cmd)];
27471 + unsigned char *cmdptr;
27472 +
27473 if (hdr->request_len > BLK_MAX_CDB) {
27474 rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
27475 if (!rq->cmd)
27476 return -ENOMEM;
27477 - }
27478 + cmdptr = rq->cmd;
27479 + } else
27480 + cmdptr = tmpcmd;
27481
27482 - if (copy_from_user(rq->cmd, (void __user *)(unsigned long)hdr->request,
27483 + if (copy_from_user(cmdptr, (void __user *)(unsigned long)hdr->request,
27484 hdr->request_len))
27485 return -EFAULT;
27486
27487 + if (cmdptr != rq->cmd)
27488 + memcpy(rq->cmd, cmdptr, hdr->request_len);
27489 +
27490 if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
27491 if (blk_verify_command(rq->cmd, has_write_perm))
27492 return -EPERM;
27493 diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c
27494 index 7c668c8..db3521c 100644
27495 --- a/block/compat_ioctl.c
27496 +++ b/block/compat_ioctl.c
27497 @@ -340,7 +340,7 @@ static int compat_fd_ioctl(struct block_device *bdev, fmode_t mode,
27498 err |= __get_user(f->spec1, &uf->spec1);
27499 err |= __get_user(f->fmt_gap, &uf->fmt_gap);
27500 err |= __get_user(name, &uf->name);
27501 - f->name = compat_ptr(name);
27502 + f->name = (void __force_kernel *)compat_ptr(name);
27503 if (err) {
27504 err = -EFAULT;
27505 goto out;
27506 diff --git a/block/partitions/efi.c b/block/partitions/efi.c
27507 index 6296b40..417c00f 100644
27508 --- a/block/partitions/efi.c
27509 +++ b/block/partitions/efi.c
27510 @@ -234,14 +234,14 @@ static gpt_entry *alloc_read_gpt_entries(struct parsed_partitions *state,
27511 if (!gpt)
27512 return NULL;
27513
27514 + if (!le32_to_cpu(gpt->num_partition_entries))
27515 + return NULL;
27516 + pte = kcalloc(le32_to_cpu(gpt->num_partition_entries), le32_to_cpu(gpt->sizeof_partition_entry), GFP_KERNEL);
27517 + if (!pte)
27518 + return NULL;
27519 +
27520 count = le32_to_cpu(gpt->num_partition_entries) *
27521 le32_to_cpu(gpt->sizeof_partition_entry);
27522 - if (!count)
27523 - return NULL;
27524 - pte = kzalloc(count, GFP_KERNEL);
27525 - if (!pte)
27526 - return NULL;
27527 -
27528 if (read_lba(state, le64_to_cpu(gpt->partition_entry_lba),
27529 (u8 *) pte,
27530 count) < count) {
27531 diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
27532 index 9a87daa..fb17486 100644
27533 --- a/block/scsi_ioctl.c
27534 +++ b/block/scsi_ioctl.c
27535 @@ -223,8 +223,20 @@ EXPORT_SYMBOL(blk_verify_command);
27536 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
27537 struct sg_io_hdr *hdr, fmode_t mode)
27538 {
27539 - if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
27540 + unsigned char tmpcmd[sizeof(rq->__cmd)];
27541 + unsigned char *cmdptr;
27542 +
27543 + if (rq->cmd != rq->__cmd)
27544 + cmdptr = rq->cmd;
27545 + else
27546 + cmdptr = tmpcmd;
27547 +
27548 + if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
27549 return -EFAULT;
27550 +
27551 + if (cmdptr != rq->cmd)
27552 + memcpy(rq->cmd, cmdptr, hdr->cmd_len);
27553 +
27554 if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
27555 return -EPERM;
27556
27557 @@ -433,6 +445,8 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
27558 int err;
27559 unsigned int in_len, out_len, bytes, opcode, cmdlen;
27560 char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
27561 + unsigned char tmpcmd[sizeof(rq->__cmd)];
27562 + unsigned char *cmdptr;
27563
27564 if (!sic)
27565 return -EINVAL;
27566 @@ -466,9 +480,18 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
27567 */
27568 err = -EFAULT;
27569 rq->cmd_len = cmdlen;
27570 - if (copy_from_user(rq->cmd, sic->data, cmdlen))
27571 +
27572 + if (rq->cmd != rq->__cmd)
27573 + cmdptr = rq->cmd;
27574 + else
27575 + cmdptr = tmpcmd;
27576 +
27577 + if (copy_from_user(cmdptr, sic->data, cmdlen))
27578 goto error;
27579
27580 + if (rq->cmd != cmdptr)
27581 + memcpy(rq->cmd, cmdptr, cmdlen);
27582 +
27583 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
27584 goto error;
27585
27586 diff --git a/crypto/cryptd.c b/crypto/cryptd.c
27587 index 671d4d6..5f24030 100644
27588 --- a/crypto/cryptd.c
27589 +++ b/crypto/cryptd.c
27590 @@ -63,7 +63,7 @@ struct cryptd_blkcipher_ctx {
27591
27592 struct cryptd_blkcipher_request_ctx {
27593 crypto_completion_t complete;
27594 -};
27595 +} __no_const;
27596
27597 struct cryptd_hash_ctx {
27598 struct crypto_shash *child;
27599 @@ -80,7 +80,7 @@ struct cryptd_aead_ctx {
27600
27601 struct cryptd_aead_request_ctx {
27602 crypto_completion_t complete;
27603 -};
27604 +} __no_const;
27605
27606 static void cryptd_queue_worker(struct work_struct *work);
27607
27608 diff --git a/drivers/acpi/apei/cper.c b/drivers/acpi/apei/cper.c
27609 index e6defd8..c26a225 100644
27610 --- a/drivers/acpi/apei/cper.c
27611 +++ b/drivers/acpi/apei/cper.c
27612 @@ -38,12 +38,12 @@
27613 */
27614 u64 cper_next_record_id(void)
27615 {
27616 - static atomic64_t seq;
27617 + static atomic64_unchecked_t seq;
27618
27619 - if (!atomic64_read(&seq))
27620 - atomic64_set(&seq, ((u64)get_seconds()) << 32);
27621 + if (!atomic64_read_unchecked(&seq))
27622 + atomic64_set_unchecked(&seq, ((u64)get_seconds()) << 32);
27623
27624 - return atomic64_inc_return(&seq);
27625 + return atomic64_inc_return_unchecked(&seq);
27626 }
27627 EXPORT_SYMBOL_GPL(cper_next_record_id);
27628
27629 diff --git a/drivers/acpi/ec_sys.c b/drivers/acpi/ec_sys.c
27630 index 7586544..636a2f0 100644
27631 --- a/drivers/acpi/ec_sys.c
27632 +++ b/drivers/acpi/ec_sys.c
27633 @@ -12,6 +12,7 @@
27634 #include <linux/acpi.h>
27635 #include <linux/debugfs.h>
27636 #include <linux/module.h>
27637 +#include <linux/uaccess.h>
27638 #include "internal.h"
27639
27640 MODULE_AUTHOR("Thomas Renninger <trenn@suse.de>");
27641 @@ -34,7 +35,7 @@ static ssize_t acpi_ec_read_io(struct file *f, char __user *buf,
27642 * struct acpi_ec *ec = ((struct seq_file *)f->private_data)->private;
27643 */
27644 unsigned int size = EC_SPACE_SIZE;
27645 - u8 *data = (u8 *) buf;
27646 + u8 data;
27647 loff_t init_off = *off;
27648 int err = 0;
27649
27650 @@ -47,9 +48,11 @@ static ssize_t acpi_ec_read_io(struct file *f, char __user *buf,
27651 size = count;
27652
27653 while (size) {
27654 - err = ec_read(*off, &data[*off - init_off]);
27655 + err = ec_read(*off, &data);
27656 if (err)
27657 return err;
27658 + if (put_user(data, &buf[*off - init_off]))
27659 + return -EFAULT;
27660 *off += 1;
27661 size--;
27662 }
27663 @@ -65,7 +68,6 @@ static ssize_t acpi_ec_write_io(struct file *f, const char __user *buf,
27664
27665 unsigned int size = count;
27666 loff_t init_off = *off;
27667 - u8 *data = (u8 *) buf;
27668 int err = 0;
27669
27670 if (*off >= EC_SPACE_SIZE)
27671 @@ -76,7 +78,9 @@ static ssize_t acpi_ec_write_io(struct file *f, const char __user *buf,
27672 }
27673
27674 while (size) {
27675 - u8 byte_write = data[*off - init_off];
27676 + u8 byte_write;
27677 + if (get_user(byte_write, &buf[*off - init_off]))
27678 + return -EFAULT;
27679 err = ec_write(*off, byte_write);
27680 if (err)
27681 return err;
27682 diff --git a/drivers/acpi/proc.c b/drivers/acpi/proc.c
27683 index 251c7b62..000462d 100644
27684 --- a/drivers/acpi/proc.c
27685 +++ b/drivers/acpi/proc.c
27686 @@ -343,19 +343,13 @@ acpi_system_write_wakeup_device(struct file *file,
27687 size_t count, loff_t * ppos)
27688 {
27689 struct list_head *node, *next;
27690 - char strbuf[5];
27691 - char str[5] = "";
27692 - unsigned int len = count;
27693 + char strbuf[5] = {0};
27694
27695 - if (len > 4)
27696 - len = 4;
27697 - if (len < 0)
27698 + if (count > 4)
27699 + count = 4;
27700 + if (copy_from_user(strbuf, buffer, count))
27701 return -EFAULT;
27702 -
27703 - if (copy_from_user(strbuf, buffer, len))
27704 - return -EFAULT;
27705 - strbuf[len] = '\0';
27706 - sscanf(strbuf, "%s", str);
27707 + strbuf[count] = '\0';
27708
27709 mutex_lock(&acpi_device_lock);
27710 list_for_each_safe(node, next, &acpi_wakeup_device_list) {
27711 @@ -364,7 +358,7 @@ acpi_system_write_wakeup_device(struct file *file,
27712 if (!dev->wakeup.flags.valid)
27713 continue;
27714
27715 - if (!strncmp(dev->pnp.bus_id, str, 4)) {
27716 + if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
27717 if (device_can_wakeup(&dev->dev)) {
27718 bool enable = !device_may_wakeup(&dev->dev);
27719 device_set_wakeup_enable(&dev->dev, enable);
27720 diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
27721 index bbac51e..4c094f9 100644
27722 --- a/drivers/acpi/processor_driver.c
27723 +++ b/drivers/acpi/processor_driver.c
27724 @@ -556,7 +556,7 @@ static int __cpuinit acpi_processor_add(struct acpi_device *device)
27725 return 0;
27726 #endif
27727
27728 - BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
27729 + BUG_ON(pr->id >= nr_cpu_ids);
27730
27731 /*
27732 * Buggy BIOS check
27733 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
27734 index cece3a4..0845256 100644
27735 --- a/drivers/ata/libata-core.c
27736 +++ b/drivers/ata/libata-core.c
27737 @@ -4743,7 +4743,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
27738 struct ata_port *ap;
27739 unsigned int tag;
27740
27741 - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
27742 + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
27743 ap = qc->ap;
27744
27745 qc->flags = 0;
27746 @@ -4759,7 +4759,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
27747 struct ata_port *ap;
27748 struct ata_link *link;
27749
27750 - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
27751 + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
27752 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
27753 ap = qc->ap;
27754 link = qc->dev->link;
27755 @@ -5823,6 +5823,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
27756 return;
27757
27758 spin_lock(&lock);
27759 + pax_open_kernel();
27760
27761 for (cur = ops->inherits; cur; cur = cur->inherits) {
27762 void **inherit = (void **)cur;
27763 @@ -5836,8 +5837,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
27764 if (IS_ERR(*pp))
27765 *pp = NULL;
27766
27767 - ops->inherits = NULL;
27768 + *(struct ata_port_operations **)&ops->inherits = NULL;
27769
27770 + pax_close_kernel();
27771 spin_unlock(&lock);
27772 }
27773
27774 diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
27775 index ac6a5be..c7176b1 100644
27776 --- a/drivers/ata/pata_arasan_cf.c
27777 +++ b/drivers/ata/pata_arasan_cf.c
27778 @@ -862,7 +862,9 @@ static int __devinit arasan_cf_probe(struct platform_device *pdev)
27779 /* Handle platform specific quirks */
27780 if (pdata->quirk) {
27781 if (pdata->quirk & CF_BROKEN_PIO) {
27782 - ap->ops->set_piomode = NULL;
27783 + pax_open_kernel();
27784 + *(void **)&ap->ops->set_piomode = NULL;
27785 + pax_close_kernel();
27786 ap->pio_mask = 0;
27787 }
27788 if (pdata->quirk & CF_BROKEN_MWDMA)
27789 diff --git a/drivers/atm/adummy.c b/drivers/atm/adummy.c
27790 index f9b983a..887b9d8 100644
27791 --- a/drivers/atm/adummy.c
27792 +++ b/drivers/atm/adummy.c
27793 @@ -114,7 +114,7 @@ adummy_send(struct atm_vcc *vcc, struct sk_buff *skb)
27794 vcc->pop(vcc, skb);
27795 else
27796 dev_kfree_skb_any(skb);
27797 - atomic_inc(&vcc->stats->tx);
27798 + atomic_inc_unchecked(&vcc->stats->tx);
27799
27800 return 0;
27801 }
27802 diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
27803 index 89b30f3..7964211 100644
27804 --- a/drivers/atm/ambassador.c
27805 +++ b/drivers/atm/ambassador.c
27806 @@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev, tx_out * tx) {
27807 PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
27808
27809 // VC layer stats
27810 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
27811 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
27812
27813 // free the descriptor
27814 kfree (tx_descr);
27815 @@ -495,7 +495,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
27816 dump_skb ("<<<", vc, skb);
27817
27818 // VC layer stats
27819 - atomic_inc(&atm_vcc->stats->rx);
27820 + atomic_inc_unchecked(&atm_vcc->stats->rx);
27821 __net_timestamp(skb);
27822 // end of our responsibility
27823 atm_vcc->push (atm_vcc, skb);
27824 @@ -510,7 +510,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
27825 } else {
27826 PRINTK (KERN_INFO, "dropped over-size frame");
27827 // should we count this?
27828 - atomic_inc(&atm_vcc->stats->rx_drop);
27829 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
27830 }
27831
27832 } else {
27833 @@ -1338,7 +1338,7 @@ static int amb_send (struct atm_vcc * atm_vcc, struct sk_buff * skb) {
27834 }
27835
27836 if (check_area (skb->data, skb->len)) {
27837 - atomic_inc(&atm_vcc->stats->tx_err);
27838 + atomic_inc_unchecked(&atm_vcc->stats->tx_err);
27839 return -ENOMEM; // ?
27840 }
27841
27842 diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c
27843 index b22d71c..d6e1049 100644
27844 --- a/drivers/atm/atmtcp.c
27845 +++ b/drivers/atm/atmtcp.c
27846 @@ -207,7 +207,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
27847 if (vcc->pop) vcc->pop(vcc,skb);
27848 else dev_kfree_skb(skb);
27849 if (dev_data) return 0;
27850 - atomic_inc(&vcc->stats->tx_err);
27851 + atomic_inc_unchecked(&vcc->stats->tx_err);
27852 return -ENOLINK;
27853 }
27854 size = skb->len+sizeof(struct atmtcp_hdr);
27855 @@ -215,7 +215,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
27856 if (!new_skb) {
27857 if (vcc->pop) vcc->pop(vcc,skb);
27858 else dev_kfree_skb(skb);
27859 - atomic_inc(&vcc->stats->tx_err);
27860 + atomic_inc_unchecked(&vcc->stats->tx_err);
27861 return -ENOBUFS;
27862 }
27863 hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
27864 @@ -226,8 +226,8 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
27865 if (vcc->pop) vcc->pop(vcc,skb);
27866 else dev_kfree_skb(skb);
27867 out_vcc->push(out_vcc,new_skb);
27868 - atomic_inc(&vcc->stats->tx);
27869 - atomic_inc(&out_vcc->stats->rx);
27870 + atomic_inc_unchecked(&vcc->stats->tx);
27871 + atomic_inc_unchecked(&out_vcc->stats->rx);
27872 return 0;
27873 }
27874
27875 @@ -301,7 +301,7 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
27876 out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
27877 read_unlock(&vcc_sklist_lock);
27878 if (!out_vcc) {
27879 - atomic_inc(&vcc->stats->tx_err);
27880 + atomic_inc_unchecked(&vcc->stats->tx_err);
27881 goto done;
27882 }
27883 skb_pull(skb,sizeof(struct atmtcp_hdr));
27884 @@ -313,8 +313,8 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
27885 __net_timestamp(new_skb);
27886 skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
27887 out_vcc->push(out_vcc,new_skb);
27888 - atomic_inc(&vcc->stats->tx);
27889 - atomic_inc(&out_vcc->stats->rx);
27890 + atomic_inc_unchecked(&vcc->stats->tx);
27891 + atomic_inc_unchecked(&out_vcc->stats->rx);
27892 done:
27893 if (vcc->pop) vcc->pop(vcc,skb);
27894 else dev_kfree_skb(skb);
27895 diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
27896 index 2059ee4..faf51c7 100644
27897 --- a/drivers/atm/eni.c
27898 +++ b/drivers/atm/eni.c
27899 @@ -522,7 +522,7 @@ static int rx_aal0(struct atm_vcc *vcc)
27900 DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
27901 vcc->dev->number);
27902 length = 0;
27903 - atomic_inc(&vcc->stats->rx_err);
27904 + atomic_inc_unchecked(&vcc->stats->rx_err);
27905 }
27906 else {
27907 length = ATM_CELL_SIZE-1; /* no HEC */
27908 @@ -577,7 +577,7 @@ static int rx_aal5(struct atm_vcc *vcc)
27909 size);
27910 }
27911 eff = length = 0;
27912 - atomic_inc(&vcc->stats->rx_err);
27913 + atomic_inc_unchecked(&vcc->stats->rx_err);
27914 }
27915 else {
27916 size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
27917 @@ -594,7 +594,7 @@ static int rx_aal5(struct atm_vcc *vcc)
27918 "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
27919 vcc->dev->number,vcc->vci,length,size << 2,descr);
27920 length = eff = 0;
27921 - atomic_inc(&vcc->stats->rx_err);
27922 + atomic_inc_unchecked(&vcc->stats->rx_err);
27923 }
27924 }
27925 skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
27926 @@ -767,7 +767,7 @@ rx_dequeued++;
27927 vcc->push(vcc,skb);
27928 pushed++;
27929 }
27930 - atomic_inc(&vcc->stats->rx);
27931 + atomic_inc_unchecked(&vcc->stats->rx);
27932 }
27933 wake_up(&eni_dev->rx_wait);
27934 }
27935 @@ -1227,7 +1227,7 @@ static void dequeue_tx(struct atm_dev *dev)
27936 PCI_DMA_TODEVICE);
27937 if (vcc->pop) vcc->pop(vcc,skb);
27938 else dev_kfree_skb_irq(skb);
27939 - atomic_inc(&vcc->stats->tx);
27940 + atomic_inc_unchecked(&vcc->stats->tx);
27941 wake_up(&eni_dev->tx_wait);
27942 dma_complete++;
27943 }
27944 @@ -1567,7 +1567,7 @@ tx_complete++;
27945 /*--------------------------------- entries ---------------------------------*/
27946
27947
27948 -static const char *media_name[] __devinitdata = {
27949 +static const char *media_name[] __devinitconst = {
27950 "MMF", "SMF", "MMF", "03?", /* 0- 3 */
27951 "UTP", "05?", "06?", "07?", /* 4- 7 */
27952 "TAXI","09?", "10?", "11?", /* 8-11 */
27953 diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
27954 index 86fed1b..6dc4721 100644
27955 --- a/drivers/atm/firestream.c
27956 +++ b/drivers/atm/firestream.c
27957 @@ -749,7 +749,7 @@ static void process_txdone_queue (struct fs_dev *dev, struct queue *q)
27958 }
27959 }
27960
27961 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
27962 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
27963
27964 fs_dprintk (FS_DEBUG_TXMEM, "i");
27965 fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
27966 @@ -816,7 +816,7 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
27967 #endif
27968 skb_put (skb, qe->p1 & 0xffff);
27969 ATM_SKB(skb)->vcc = atm_vcc;
27970 - atomic_inc(&atm_vcc->stats->rx);
27971 + atomic_inc_unchecked(&atm_vcc->stats->rx);
27972 __net_timestamp(skb);
27973 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
27974 atm_vcc->push (atm_vcc, skb);
27975 @@ -837,12 +837,12 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
27976 kfree (pe);
27977 }
27978 if (atm_vcc)
27979 - atomic_inc(&atm_vcc->stats->rx_drop);
27980 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
27981 break;
27982 case 0x1f: /* Reassembly abort: no buffers. */
27983 /* Silently increment error counter. */
27984 if (atm_vcc)
27985 - atomic_inc(&atm_vcc->stats->rx_drop);
27986 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
27987 break;
27988 default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
27989 printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
27990 diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
27991 index 361f5ae..7fc552d 100644
27992 --- a/drivers/atm/fore200e.c
27993 +++ b/drivers/atm/fore200e.c
27994 @@ -933,9 +933,9 @@ fore200e_tx_irq(struct fore200e* fore200e)
27995 #endif
27996 /* check error condition */
27997 if (*entry->status & STATUS_ERROR)
27998 - atomic_inc(&vcc->stats->tx_err);
27999 + atomic_inc_unchecked(&vcc->stats->tx_err);
28000 else
28001 - atomic_inc(&vcc->stats->tx);
28002 + atomic_inc_unchecked(&vcc->stats->tx);
28003 }
28004 }
28005
28006 @@ -1084,7 +1084,7 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
28007 if (skb == NULL) {
28008 DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
28009
28010 - atomic_inc(&vcc->stats->rx_drop);
28011 + atomic_inc_unchecked(&vcc->stats->rx_drop);
28012 return -ENOMEM;
28013 }
28014
28015 @@ -1127,14 +1127,14 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
28016
28017 dev_kfree_skb_any(skb);
28018
28019 - atomic_inc(&vcc->stats->rx_drop);
28020 + atomic_inc_unchecked(&vcc->stats->rx_drop);
28021 return -ENOMEM;
28022 }
28023
28024 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
28025
28026 vcc->push(vcc, skb);
28027 - atomic_inc(&vcc->stats->rx);
28028 + atomic_inc_unchecked(&vcc->stats->rx);
28029
28030 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
28031
28032 @@ -1212,7 +1212,7 @@ fore200e_rx_irq(struct fore200e* fore200e)
28033 DPRINTK(2, "damaged PDU on %d.%d.%d\n",
28034 fore200e->atm_dev->number,
28035 entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
28036 - atomic_inc(&vcc->stats->rx_err);
28037 + atomic_inc_unchecked(&vcc->stats->rx_err);
28038 }
28039 }
28040
28041 @@ -1657,7 +1657,7 @@ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
28042 goto retry_here;
28043 }
28044
28045 - atomic_inc(&vcc->stats->tx_err);
28046 + atomic_inc_unchecked(&vcc->stats->tx_err);
28047
28048 fore200e->tx_sat++;
28049 DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
28050 diff --git a/drivers/atm/he.c b/drivers/atm/he.c
28051 index b182c2f..1c6fa8a 100644
28052 --- a/drivers/atm/he.c
28053 +++ b/drivers/atm/he.c
28054 @@ -1709,7 +1709,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
28055
28056 if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
28057 hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
28058 - atomic_inc(&vcc->stats->rx_drop);
28059 + atomic_inc_unchecked(&vcc->stats->rx_drop);
28060 goto return_host_buffers;
28061 }
28062
28063 @@ -1736,7 +1736,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
28064 RBRQ_LEN_ERR(he_dev->rbrq_head)
28065 ? "LEN_ERR" : "",
28066 vcc->vpi, vcc->vci);
28067 - atomic_inc(&vcc->stats->rx_err);
28068 + atomic_inc_unchecked(&vcc->stats->rx_err);
28069 goto return_host_buffers;
28070 }
28071
28072 @@ -1788,7 +1788,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
28073 vcc->push(vcc, skb);
28074 spin_lock(&he_dev->global_lock);
28075
28076 - atomic_inc(&vcc->stats->rx);
28077 + atomic_inc_unchecked(&vcc->stats->rx);
28078
28079 return_host_buffers:
28080 ++pdus_assembled;
28081 @@ -2114,7 +2114,7 @@ __enqueue_tpd(struct he_dev *he_dev, struct he_tpd *tpd, unsigned cid)
28082 tpd->vcc->pop(tpd->vcc, tpd->skb);
28083 else
28084 dev_kfree_skb_any(tpd->skb);
28085 - atomic_inc(&tpd->vcc->stats->tx_err);
28086 + atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
28087 }
28088 pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
28089 return;
28090 @@ -2526,7 +2526,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
28091 vcc->pop(vcc, skb);
28092 else
28093 dev_kfree_skb_any(skb);
28094 - atomic_inc(&vcc->stats->tx_err);
28095 + atomic_inc_unchecked(&vcc->stats->tx_err);
28096 return -EINVAL;
28097 }
28098
28099 @@ -2537,7 +2537,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
28100 vcc->pop(vcc, skb);
28101 else
28102 dev_kfree_skb_any(skb);
28103 - atomic_inc(&vcc->stats->tx_err);
28104 + atomic_inc_unchecked(&vcc->stats->tx_err);
28105 return -EINVAL;
28106 }
28107 #endif
28108 @@ -2549,7 +2549,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
28109 vcc->pop(vcc, skb);
28110 else
28111 dev_kfree_skb_any(skb);
28112 - atomic_inc(&vcc->stats->tx_err);
28113 + atomic_inc_unchecked(&vcc->stats->tx_err);
28114 spin_unlock_irqrestore(&he_dev->global_lock, flags);
28115 return -ENOMEM;
28116 }
28117 @@ -2591,7 +2591,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
28118 vcc->pop(vcc, skb);
28119 else
28120 dev_kfree_skb_any(skb);
28121 - atomic_inc(&vcc->stats->tx_err);
28122 + atomic_inc_unchecked(&vcc->stats->tx_err);
28123 spin_unlock_irqrestore(&he_dev->global_lock, flags);
28124 return -ENOMEM;
28125 }
28126 @@ -2622,7 +2622,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
28127 __enqueue_tpd(he_dev, tpd, cid);
28128 spin_unlock_irqrestore(&he_dev->global_lock, flags);
28129
28130 - atomic_inc(&vcc->stats->tx);
28131 + atomic_inc_unchecked(&vcc->stats->tx);
28132
28133 return 0;
28134 }
28135 diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
28136 index 7d01c2a..4e3ac01 100644
28137 --- a/drivers/atm/horizon.c
28138 +++ b/drivers/atm/horizon.c
28139 @@ -1034,7 +1034,7 @@ static void rx_schedule (hrz_dev * dev, int irq) {
28140 {
28141 struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
28142 // VC layer stats
28143 - atomic_inc(&vcc->stats->rx);
28144 + atomic_inc_unchecked(&vcc->stats->rx);
28145 __net_timestamp(skb);
28146 // end of our responsibility
28147 vcc->push (vcc, skb);
28148 @@ -1186,7 +1186,7 @@ static void tx_schedule (hrz_dev * const dev, int irq) {
28149 dev->tx_iovec = NULL;
28150
28151 // VC layer stats
28152 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
28153 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
28154
28155 // free the skb
28156 hrz_kfree_skb (skb);
28157 diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
28158 index 8974bd2..b856f85 100644
28159 --- a/drivers/atm/idt77252.c
28160 +++ b/drivers/atm/idt77252.c
28161 @@ -812,7 +812,7 @@ drain_scq(struct idt77252_dev *card, struct vc_map *vc)
28162 else
28163 dev_kfree_skb(skb);
28164
28165 - atomic_inc(&vcc->stats->tx);
28166 + atomic_inc_unchecked(&vcc->stats->tx);
28167 }
28168
28169 atomic_dec(&scq->used);
28170 @@ -1075,13 +1075,13 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
28171 if ((sb = dev_alloc_skb(64)) == NULL) {
28172 printk("%s: Can't allocate buffers for aal0.\n",
28173 card->name);
28174 - atomic_add(i, &vcc->stats->rx_drop);
28175 + atomic_add_unchecked(i, &vcc->stats->rx_drop);
28176 break;
28177 }
28178 if (!atm_charge(vcc, sb->truesize)) {
28179 RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
28180 card->name);
28181 - atomic_add(i - 1, &vcc->stats->rx_drop);
28182 + atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
28183 dev_kfree_skb(sb);
28184 break;
28185 }
28186 @@ -1098,7 +1098,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
28187 ATM_SKB(sb)->vcc = vcc;
28188 __net_timestamp(sb);
28189 vcc->push(vcc, sb);
28190 - atomic_inc(&vcc->stats->rx);
28191 + atomic_inc_unchecked(&vcc->stats->rx);
28192
28193 cell += ATM_CELL_PAYLOAD;
28194 }
28195 @@ -1135,13 +1135,13 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
28196 "(CDC: %08x)\n",
28197 card->name, len, rpp->len, readl(SAR_REG_CDC));
28198 recycle_rx_pool_skb(card, rpp);
28199 - atomic_inc(&vcc->stats->rx_err);
28200 + atomic_inc_unchecked(&vcc->stats->rx_err);
28201 return;
28202 }
28203 if (stat & SAR_RSQE_CRC) {
28204 RXPRINTK("%s: AAL5 CRC error.\n", card->name);
28205 recycle_rx_pool_skb(card, rpp);
28206 - atomic_inc(&vcc->stats->rx_err);
28207 + atomic_inc_unchecked(&vcc->stats->rx_err);
28208 return;
28209 }
28210 if (skb_queue_len(&rpp->queue) > 1) {
28211 @@ -1152,7 +1152,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
28212 RXPRINTK("%s: Can't alloc RX skb.\n",
28213 card->name);
28214 recycle_rx_pool_skb(card, rpp);
28215 - atomic_inc(&vcc->stats->rx_err);
28216 + atomic_inc_unchecked(&vcc->stats->rx_err);
28217 return;
28218 }
28219 if (!atm_charge(vcc, skb->truesize)) {
28220 @@ -1171,7 +1171,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
28221 __net_timestamp(skb);
28222
28223 vcc->push(vcc, skb);
28224 - atomic_inc(&vcc->stats->rx);
28225 + atomic_inc_unchecked(&vcc->stats->rx);
28226
28227 return;
28228 }
28229 @@ -1193,7 +1193,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
28230 __net_timestamp(skb);
28231
28232 vcc->push(vcc, skb);
28233 - atomic_inc(&vcc->stats->rx);
28234 + atomic_inc_unchecked(&vcc->stats->rx);
28235
28236 if (skb->truesize > SAR_FB_SIZE_3)
28237 add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
28238 @@ -1304,14 +1304,14 @@ idt77252_rx_raw(struct idt77252_dev *card)
28239 if (vcc->qos.aal != ATM_AAL0) {
28240 RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
28241 card->name, vpi, vci);
28242 - atomic_inc(&vcc->stats->rx_drop);
28243 + atomic_inc_unchecked(&vcc->stats->rx_drop);
28244 goto drop;
28245 }
28246
28247 if ((sb = dev_alloc_skb(64)) == NULL) {
28248 printk("%s: Can't allocate buffers for AAL0.\n",
28249 card->name);
28250 - atomic_inc(&vcc->stats->rx_err);
28251 + atomic_inc_unchecked(&vcc->stats->rx_err);
28252 goto drop;
28253 }
28254
28255 @@ -1330,7 +1330,7 @@ idt77252_rx_raw(struct idt77252_dev *card)
28256 ATM_SKB(sb)->vcc = vcc;
28257 __net_timestamp(sb);
28258 vcc->push(vcc, sb);
28259 - atomic_inc(&vcc->stats->rx);
28260 + atomic_inc_unchecked(&vcc->stats->rx);
28261
28262 drop:
28263 skb_pull(queue, 64);
28264 @@ -1955,13 +1955,13 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
28265
28266 if (vc == NULL) {
28267 printk("%s: NULL connection in send().\n", card->name);
28268 - atomic_inc(&vcc->stats->tx_err);
28269 + atomic_inc_unchecked(&vcc->stats->tx_err);
28270 dev_kfree_skb(skb);
28271 return -EINVAL;
28272 }
28273 if (!test_bit(VCF_TX, &vc->flags)) {
28274 printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
28275 - atomic_inc(&vcc->stats->tx_err);
28276 + atomic_inc_unchecked(&vcc->stats->tx_err);
28277 dev_kfree_skb(skb);
28278 return -EINVAL;
28279 }
28280 @@ -1973,14 +1973,14 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
28281 break;
28282 default:
28283 printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
28284 - atomic_inc(&vcc->stats->tx_err);
28285 + atomic_inc_unchecked(&vcc->stats->tx_err);
28286 dev_kfree_skb(skb);
28287 return -EINVAL;
28288 }
28289
28290 if (skb_shinfo(skb)->nr_frags != 0) {
28291 printk("%s: No scatter-gather yet.\n", card->name);
28292 - atomic_inc(&vcc->stats->tx_err);
28293 + atomic_inc_unchecked(&vcc->stats->tx_err);
28294 dev_kfree_skb(skb);
28295 return -EINVAL;
28296 }
28297 @@ -1988,7 +1988,7 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
28298
28299 err = queue_skb(card, vc, skb, oam);
28300 if (err) {
28301 - atomic_inc(&vcc->stats->tx_err);
28302 + atomic_inc_unchecked(&vcc->stats->tx_err);
28303 dev_kfree_skb(skb);
28304 return err;
28305 }
28306 @@ -2011,7 +2011,7 @@ idt77252_send_oam(struct atm_vcc *vcc, void *cell, int flags)
28307 skb = dev_alloc_skb(64);
28308 if (!skb) {
28309 printk("%s: Out of memory in send_oam().\n", card->name);
28310 - atomic_inc(&vcc->stats->tx_err);
28311 + atomic_inc_unchecked(&vcc->stats->tx_err);
28312 return -ENOMEM;
28313 }
28314 atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
28315 diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
28316 index d438601..8b98495 100644
28317 --- a/drivers/atm/iphase.c
28318 +++ b/drivers/atm/iphase.c
28319 @@ -1145,7 +1145,7 @@ static int rx_pkt(struct atm_dev *dev)
28320 status = (u_short) (buf_desc_ptr->desc_mode);
28321 if (status & (RX_CER | RX_PTE | RX_OFL))
28322 {
28323 - atomic_inc(&vcc->stats->rx_err);
28324 + atomic_inc_unchecked(&vcc->stats->rx_err);
28325 IF_ERR(printk("IA: bad packet, dropping it");)
28326 if (status & RX_CER) {
28327 IF_ERR(printk(" cause: packet CRC error\n");)
28328 @@ -1168,7 +1168,7 @@ static int rx_pkt(struct atm_dev *dev)
28329 len = dma_addr - buf_addr;
28330 if (len > iadev->rx_buf_sz) {
28331 printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
28332 - atomic_inc(&vcc->stats->rx_err);
28333 + atomic_inc_unchecked(&vcc->stats->rx_err);
28334 goto out_free_desc;
28335 }
28336
28337 @@ -1318,7 +1318,7 @@ static void rx_dle_intr(struct atm_dev *dev)
28338 ia_vcc = INPH_IA_VCC(vcc);
28339 if (ia_vcc == NULL)
28340 {
28341 - atomic_inc(&vcc->stats->rx_err);
28342 + atomic_inc_unchecked(&vcc->stats->rx_err);
28343 atm_return(vcc, skb->truesize);
28344 dev_kfree_skb_any(skb);
28345 goto INCR_DLE;
28346 @@ -1330,7 +1330,7 @@ static void rx_dle_intr(struct atm_dev *dev)
28347 if ((length > iadev->rx_buf_sz) || (length >
28348 (skb->len - sizeof(struct cpcs_trailer))))
28349 {
28350 - atomic_inc(&vcc->stats->rx_err);
28351 + atomic_inc_unchecked(&vcc->stats->rx_err);
28352 IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
28353 length, skb->len);)
28354 atm_return(vcc, skb->truesize);
28355 @@ -1346,7 +1346,7 @@ static void rx_dle_intr(struct atm_dev *dev)
28356
28357 IF_RX(printk("rx_dle_intr: skb push");)
28358 vcc->push(vcc,skb);
28359 - atomic_inc(&vcc->stats->rx);
28360 + atomic_inc_unchecked(&vcc->stats->rx);
28361 iadev->rx_pkt_cnt++;
28362 }
28363 INCR_DLE:
28364 @@ -2826,15 +2826,15 @@ static int ia_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
28365 {
28366 struct k_sonet_stats *stats;
28367 stats = &PRIV(_ia_dev[board])->sonet_stats;
28368 - printk("section_bip: %d\n", atomic_read(&stats->section_bip));
28369 - printk("line_bip : %d\n", atomic_read(&stats->line_bip));
28370 - printk("path_bip : %d\n", atomic_read(&stats->path_bip));
28371 - printk("line_febe : %d\n", atomic_read(&stats->line_febe));
28372 - printk("path_febe : %d\n", atomic_read(&stats->path_febe));
28373 - printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
28374 - printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
28375 - printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
28376 - printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
28377 + printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
28378 + printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
28379 + printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
28380 + printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
28381 + printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
28382 + printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
28383 + printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
28384 + printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
28385 + printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
28386 }
28387 ia_cmds.status = 0;
28388 break;
28389 @@ -2939,7 +2939,7 @@ static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
28390 if ((desc == 0) || (desc > iadev->num_tx_desc))
28391 {
28392 IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
28393 - atomic_inc(&vcc->stats->tx);
28394 + atomic_inc_unchecked(&vcc->stats->tx);
28395 if (vcc->pop)
28396 vcc->pop(vcc, skb);
28397 else
28398 @@ -3044,14 +3044,14 @@ static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
28399 ATM_DESC(skb) = vcc->vci;
28400 skb_queue_tail(&iadev->tx_dma_q, skb);
28401
28402 - atomic_inc(&vcc->stats->tx);
28403 + atomic_inc_unchecked(&vcc->stats->tx);
28404 iadev->tx_pkt_cnt++;
28405 /* Increment transaction counter */
28406 writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
28407
28408 #if 0
28409 /* add flow control logic */
28410 - if (atomic_read(&vcc->stats->tx) % 20 == 0) {
28411 + if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
28412 if (iavcc->vc_desc_cnt > 10) {
28413 vcc->tx_quota = vcc->tx_quota * 3 / 4;
28414 printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
28415 diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
28416 index 68c7588..7036683 100644
28417 --- a/drivers/atm/lanai.c
28418 +++ b/drivers/atm/lanai.c
28419 @@ -1303,7 +1303,7 @@ static void lanai_send_one_aal5(struct lanai_dev *lanai,
28420 vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
28421 lanai_endtx(lanai, lvcc);
28422 lanai_free_skb(lvcc->tx.atmvcc, skb);
28423 - atomic_inc(&lvcc->tx.atmvcc->stats->tx);
28424 + atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
28425 }
28426
28427 /* Try to fill the buffer - don't call unless there is backlog */
28428 @@ -1426,7 +1426,7 @@ static void vcc_rx_aal5(struct lanai_vcc *lvcc, int endptr)
28429 ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
28430 __net_timestamp(skb);
28431 lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
28432 - atomic_inc(&lvcc->rx.atmvcc->stats->rx);
28433 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
28434 out:
28435 lvcc->rx.buf.ptr = end;
28436 cardvcc_write(lvcc, endptr, vcc_rxreadptr);
28437 @@ -1667,7 +1667,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
28438 DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
28439 "vcc %d\n", lanai->number, (unsigned int) s, vci);
28440 lanai->stats.service_rxnotaal5++;
28441 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
28442 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
28443 return 0;
28444 }
28445 if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
28446 @@ -1679,7 +1679,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
28447 int bytes;
28448 read_unlock(&vcc_sklist_lock);
28449 DPRINTK("got trashed rx pdu on vci %d\n", vci);
28450 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
28451 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
28452 lvcc->stats.x.aal5.service_trash++;
28453 bytes = (SERVICE_GET_END(s) * 16) -
28454 (((unsigned long) lvcc->rx.buf.ptr) -
28455 @@ -1691,7 +1691,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
28456 }
28457 if (s & SERVICE_STREAM) {
28458 read_unlock(&vcc_sklist_lock);
28459 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
28460 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
28461 lvcc->stats.x.aal5.service_stream++;
28462 printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
28463 "PDU on VCI %d!\n", lanai->number, vci);
28464 @@ -1699,7 +1699,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
28465 return 0;
28466 }
28467 DPRINTK("got rx crc error on vci %d\n", vci);
28468 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
28469 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
28470 lvcc->stats.x.aal5.service_rxcrc++;
28471 lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
28472 cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
28473 diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
28474 index 1c70c45..300718d 100644
28475 --- a/drivers/atm/nicstar.c
28476 +++ b/drivers/atm/nicstar.c
28477 @@ -1654,7 +1654,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
28478 if ((vc = (vc_map *) vcc->dev_data) == NULL) {
28479 printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n",
28480 card->index);
28481 - atomic_inc(&vcc->stats->tx_err);
28482 + atomic_inc_unchecked(&vcc->stats->tx_err);
28483 dev_kfree_skb_any(skb);
28484 return -EINVAL;
28485 }
28486 @@ -1662,7 +1662,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
28487 if (!vc->tx) {
28488 printk("nicstar%d: Trying to transmit on a non-tx VC.\n",
28489 card->index);
28490 - atomic_inc(&vcc->stats->tx_err);
28491 + atomic_inc_unchecked(&vcc->stats->tx_err);
28492 dev_kfree_skb_any(skb);
28493 return -EINVAL;
28494 }
28495 @@ -1670,14 +1670,14 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
28496 if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0) {
28497 printk("nicstar%d: Only AAL0 and AAL5 are supported.\n",
28498 card->index);
28499 - atomic_inc(&vcc->stats->tx_err);
28500 + atomic_inc_unchecked(&vcc->stats->tx_err);
28501 dev_kfree_skb_any(skb);
28502 return -EINVAL;
28503 }
28504
28505 if (skb_shinfo(skb)->nr_frags != 0) {
28506 printk("nicstar%d: No scatter-gather yet.\n", card->index);
28507 - atomic_inc(&vcc->stats->tx_err);
28508 + atomic_inc_unchecked(&vcc->stats->tx_err);
28509 dev_kfree_skb_any(skb);
28510 return -EINVAL;
28511 }
28512 @@ -1725,11 +1725,11 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
28513 }
28514
28515 if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
28516 - atomic_inc(&vcc->stats->tx_err);
28517 + atomic_inc_unchecked(&vcc->stats->tx_err);
28518 dev_kfree_skb_any(skb);
28519 return -EIO;
28520 }
28521 - atomic_inc(&vcc->stats->tx);
28522 + atomic_inc_unchecked(&vcc->stats->tx);
28523
28524 return 0;
28525 }
28526 @@ -2046,14 +2046,14 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
28527 printk
28528 ("nicstar%d: Can't allocate buffers for aal0.\n",
28529 card->index);
28530 - atomic_add(i, &vcc->stats->rx_drop);
28531 + atomic_add_unchecked(i, &vcc->stats->rx_drop);
28532 break;
28533 }
28534 if (!atm_charge(vcc, sb->truesize)) {
28535 RXPRINTK
28536 ("nicstar%d: atm_charge() dropped aal0 packets.\n",
28537 card->index);
28538 - atomic_add(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
28539 + atomic_add_unchecked(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
28540 dev_kfree_skb_any(sb);
28541 break;
28542 }
28543 @@ -2068,7 +2068,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
28544 ATM_SKB(sb)->vcc = vcc;
28545 __net_timestamp(sb);
28546 vcc->push(vcc, sb);
28547 - atomic_inc(&vcc->stats->rx);
28548 + atomic_inc_unchecked(&vcc->stats->rx);
28549 cell += ATM_CELL_PAYLOAD;
28550 }
28551
28552 @@ -2085,7 +2085,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
28553 if (iovb == NULL) {
28554 printk("nicstar%d: Out of iovec buffers.\n",
28555 card->index);
28556 - atomic_inc(&vcc->stats->rx_drop);
28557 + atomic_inc_unchecked(&vcc->stats->rx_drop);
28558 recycle_rx_buf(card, skb);
28559 return;
28560 }
28561 @@ -2109,7 +2109,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
28562 small or large buffer itself. */
28563 } else if (NS_PRV_IOVCNT(iovb) >= NS_MAX_IOVECS) {
28564 printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
28565 - atomic_inc(&vcc->stats->rx_err);
28566 + atomic_inc_unchecked(&vcc->stats->rx_err);
28567 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
28568 NS_MAX_IOVECS);
28569 NS_PRV_IOVCNT(iovb) = 0;
28570 @@ -2129,7 +2129,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
28571 ("nicstar%d: Expected a small buffer, and this is not one.\n",
28572 card->index);
28573 which_list(card, skb);
28574 - atomic_inc(&vcc->stats->rx_err);
28575 + atomic_inc_unchecked(&vcc->stats->rx_err);
28576 recycle_rx_buf(card, skb);
28577 vc->rx_iov = NULL;
28578 recycle_iov_buf(card, iovb);
28579 @@ -2142,7 +2142,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
28580 ("nicstar%d: Expected a large buffer, and this is not one.\n",
28581 card->index);
28582 which_list(card, skb);
28583 - atomic_inc(&vcc->stats->rx_err);
28584 + atomic_inc_unchecked(&vcc->stats->rx_err);
28585 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
28586 NS_PRV_IOVCNT(iovb));
28587 vc->rx_iov = NULL;
28588 @@ -2165,7 +2165,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
28589 printk(" - PDU size mismatch.\n");
28590 else
28591 printk(".\n");
28592 - atomic_inc(&vcc->stats->rx_err);
28593 + atomic_inc_unchecked(&vcc->stats->rx_err);
28594 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
28595 NS_PRV_IOVCNT(iovb));
28596 vc->rx_iov = NULL;
28597 @@ -2179,7 +2179,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
28598 /* skb points to a small buffer */
28599 if (!atm_charge(vcc, skb->truesize)) {
28600 push_rxbufs(card, skb);
28601 - atomic_inc(&vcc->stats->rx_drop);
28602 + atomic_inc_unchecked(&vcc->stats->rx_drop);
28603 } else {
28604 skb_put(skb, len);
28605 dequeue_sm_buf(card, skb);
28606 @@ -2189,7 +2189,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
28607 ATM_SKB(skb)->vcc = vcc;
28608 __net_timestamp(skb);
28609 vcc->push(vcc, skb);
28610 - atomic_inc(&vcc->stats->rx);
28611 + atomic_inc_unchecked(&vcc->stats->rx);
28612 }
28613 } else if (NS_PRV_IOVCNT(iovb) == 2) { /* One small plus one large buffer */
28614 struct sk_buff *sb;
28615 @@ -2200,7 +2200,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
28616 if (len <= NS_SMBUFSIZE) {
28617 if (!atm_charge(vcc, sb->truesize)) {
28618 push_rxbufs(card, sb);
28619 - atomic_inc(&vcc->stats->rx_drop);
28620 + atomic_inc_unchecked(&vcc->stats->rx_drop);
28621 } else {
28622 skb_put(sb, len);
28623 dequeue_sm_buf(card, sb);
28624 @@ -2210,7 +2210,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
28625 ATM_SKB(sb)->vcc = vcc;
28626 __net_timestamp(sb);
28627 vcc->push(vcc, sb);
28628 - atomic_inc(&vcc->stats->rx);
28629 + atomic_inc_unchecked(&vcc->stats->rx);
28630 }
28631
28632 push_rxbufs(card, skb);
28633 @@ -2219,7 +2219,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
28634
28635 if (!atm_charge(vcc, skb->truesize)) {
28636 push_rxbufs(card, skb);
28637 - atomic_inc(&vcc->stats->rx_drop);
28638 + atomic_inc_unchecked(&vcc->stats->rx_drop);
28639 } else {
28640 dequeue_lg_buf(card, skb);
28641 #ifdef NS_USE_DESTRUCTORS
28642 @@ -2232,7 +2232,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
28643 ATM_SKB(skb)->vcc = vcc;
28644 __net_timestamp(skb);
28645 vcc->push(vcc, skb);
28646 - atomic_inc(&vcc->stats->rx);
28647 + atomic_inc_unchecked(&vcc->stats->rx);
28648 }
28649
28650 push_rxbufs(card, sb);
28651 @@ -2253,7 +2253,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
28652 printk
28653 ("nicstar%d: Out of huge buffers.\n",
28654 card->index);
28655 - atomic_inc(&vcc->stats->rx_drop);
28656 + atomic_inc_unchecked(&vcc->stats->rx_drop);
28657 recycle_iovec_rx_bufs(card,
28658 (struct iovec *)
28659 iovb->data,
28660 @@ -2304,7 +2304,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
28661 card->hbpool.count++;
28662 } else
28663 dev_kfree_skb_any(hb);
28664 - atomic_inc(&vcc->stats->rx_drop);
28665 + atomic_inc_unchecked(&vcc->stats->rx_drop);
28666 } else {
28667 /* Copy the small buffer to the huge buffer */
28668 sb = (struct sk_buff *)iov->iov_base;
28669 @@ -2341,7 +2341,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
28670 #endif /* NS_USE_DESTRUCTORS */
28671 __net_timestamp(hb);
28672 vcc->push(vcc, hb);
28673 - atomic_inc(&vcc->stats->rx);
28674 + atomic_inc_unchecked(&vcc->stats->rx);
28675 }
28676 }
28677
28678 diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
28679 index 9851093..adb2b1e 100644
28680 --- a/drivers/atm/solos-pci.c
28681 +++ b/drivers/atm/solos-pci.c
28682 @@ -714,7 +714,7 @@ void solos_bh(unsigned long card_arg)
28683 }
28684 atm_charge(vcc, skb->truesize);
28685 vcc->push(vcc, skb);
28686 - atomic_inc(&vcc->stats->rx);
28687 + atomic_inc_unchecked(&vcc->stats->rx);
28688 break;
28689
28690 case PKT_STATUS:
28691 @@ -1009,7 +1009,7 @@ static uint32_t fpga_tx(struct solos_card *card)
28692 vcc = SKB_CB(oldskb)->vcc;
28693
28694 if (vcc) {
28695 - atomic_inc(&vcc->stats->tx);
28696 + atomic_inc_unchecked(&vcc->stats->tx);
28697 solos_pop(vcc, oldskb);
28698 } else
28699 dev_kfree_skb_irq(oldskb);
28700 diff --git a/drivers/atm/suni.c b/drivers/atm/suni.c
28701 index 0215934..ce9f5b1 100644
28702 --- a/drivers/atm/suni.c
28703 +++ b/drivers/atm/suni.c
28704 @@ -49,8 +49,8 @@ static DEFINE_SPINLOCK(sunis_lock);
28705
28706
28707 #define ADD_LIMITED(s,v) \
28708 - atomic_add((v),&stats->s); \
28709 - if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
28710 + atomic_add_unchecked((v),&stats->s); \
28711 + if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
28712
28713
28714 static void suni_hz(unsigned long from_timer)
28715 diff --git a/drivers/atm/uPD98402.c b/drivers/atm/uPD98402.c
28716 index 5120a96..e2572bd 100644
28717 --- a/drivers/atm/uPD98402.c
28718 +++ b/drivers/atm/uPD98402.c
28719 @@ -42,7 +42,7 @@ static int fetch_stats(struct atm_dev *dev,struct sonet_stats __user *arg,int ze
28720 struct sonet_stats tmp;
28721 int error = 0;
28722
28723 - atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
28724 + atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
28725 sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
28726 if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
28727 if (zero && !error) {
28728 @@ -161,9 +161,9 @@ static int uPD98402_ioctl(struct atm_dev *dev,unsigned int cmd,void __user *arg)
28729
28730
28731 #define ADD_LIMITED(s,v) \
28732 - { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
28733 - if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
28734 - atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
28735 + { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
28736 + if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
28737 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
28738
28739
28740 static void stat_event(struct atm_dev *dev)
28741 @@ -194,7 +194,7 @@ static void uPD98402_int(struct atm_dev *dev)
28742 if (reason & uPD98402_INT_PFM) stat_event(dev);
28743 if (reason & uPD98402_INT_PCO) {
28744 (void) GET(PCOCR); /* clear interrupt cause */
28745 - atomic_add(GET(HECCT),
28746 + atomic_add_unchecked(GET(HECCT),
28747 &PRIV(dev)->sonet_stats.uncorr_hcs);
28748 }
28749 if ((reason & uPD98402_INT_RFO) &&
28750 @@ -222,9 +222,9 @@ static int uPD98402_start(struct atm_dev *dev)
28751 PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
28752 uPD98402_INT_LOS),PIMR); /* enable them */
28753 (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
28754 - atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
28755 - atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
28756 - atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
28757 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
28758 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
28759 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
28760 return 0;
28761 }
28762
28763 diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
28764 index abe4e20..83c4727 100644
28765 --- a/drivers/atm/zatm.c
28766 +++ b/drivers/atm/zatm.c
28767 @@ -459,7 +459,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
28768 }
28769 if (!size) {
28770 dev_kfree_skb_irq(skb);
28771 - if (vcc) atomic_inc(&vcc->stats->rx_err);
28772 + if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
28773 continue;
28774 }
28775 if (!atm_charge(vcc,skb->truesize)) {
28776 @@ -469,7 +469,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
28777 skb->len = size;
28778 ATM_SKB(skb)->vcc = vcc;
28779 vcc->push(vcc,skb);
28780 - atomic_inc(&vcc->stats->rx);
28781 + atomic_inc_unchecked(&vcc->stats->rx);
28782 }
28783 zout(pos & 0xffff,MTA(mbx));
28784 #if 0 /* probably a stupid idea */
28785 @@ -733,7 +733,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD_V | uPD98401_TXPD_DP |
28786 skb_queue_head(&zatm_vcc->backlog,skb);
28787 break;
28788 }
28789 - atomic_inc(&vcc->stats->tx);
28790 + atomic_inc_unchecked(&vcc->stats->tx);
28791 wake_up(&zatm_vcc->tx_wait);
28792 }
28793
28794 diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c
28795 index 765c3a2..771ace6 100644
28796 --- a/drivers/base/devtmpfs.c
28797 +++ b/drivers/base/devtmpfs.c
28798 @@ -368,7 +368,7 @@ int devtmpfs_mount(const char *mntdir)
28799 if (!thread)
28800 return 0;
28801
28802 - err = sys_mount("devtmpfs", (char *)mntdir, "devtmpfs", MS_SILENT, NULL);
28803 + err = sys_mount((char __force_user *)"devtmpfs", (char __force_user *)mntdir, (char __force_user *)"devtmpfs", MS_SILENT, NULL);
28804 if (err)
28805 printk(KERN_INFO "devtmpfs: error mounting %i\n", err);
28806 else
28807 diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
28808 index cbb463b..babe2cf 100644
28809 --- a/drivers/base/power/wakeup.c
28810 +++ b/drivers/base/power/wakeup.c
28811 @@ -29,14 +29,14 @@ bool events_check_enabled __read_mostly;
28812 * They need to be modified together atomically, so it's better to use one
28813 * atomic variable to hold them both.
28814 */
28815 -static atomic_t combined_event_count = ATOMIC_INIT(0);
28816 +static atomic_unchecked_t combined_event_count = ATOMIC_INIT(0);
28817
28818 #define IN_PROGRESS_BITS (sizeof(int) * 4)
28819 #define MAX_IN_PROGRESS ((1 << IN_PROGRESS_BITS) - 1)
28820
28821 static void split_counters(unsigned int *cnt, unsigned int *inpr)
28822 {
28823 - unsigned int comb = atomic_read(&combined_event_count);
28824 + unsigned int comb = atomic_read_unchecked(&combined_event_count);
28825
28826 *cnt = (comb >> IN_PROGRESS_BITS);
28827 *inpr = comb & MAX_IN_PROGRESS;
28828 @@ -385,7 +385,7 @@ static void wakeup_source_activate(struct wakeup_source *ws)
28829 ws->start_prevent_time = ws->last_time;
28830
28831 /* Increment the counter of events in progress. */
28832 - cec = atomic_inc_return(&combined_event_count);
28833 + cec = atomic_inc_return_unchecked(&combined_event_count);
28834
28835 trace_wakeup_source_activate(ws->name, cec);
28836 }
28837 @@ -511,7 +511,7 @@ static void wakeup_source_deactivate(struct wakeup_source *ws)
28838 * Increment the counter of registered wakeup events and decrement the
28839 * couter of wakeup events in progress simultaneously.
28840 */
28841 - cec = atomic_add_return(MAX_IN_PROGRESS, &combined_event_count);
28842 + cec = atomic_add_return_unchecked(MAX_IN_PROGRESS, &combined_event_count);
28843 trace_wakeup_source_deactivate(ws->name, cec);
28844
28845 split_counters(&cnt, &inpr);
28846 diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
28847 index b0f553b..77b928b 100644
28848 --- a/drivers/block/cciss.c
28849 +++ b/drivers/block/cciss.c
28850 @@ -1198,6 +1198,8 @@ static int cciss_ioctl32_passthru(struct block_device *bdev, fmode_t mode,
28851 int err;
28852 u32 cp;
28853
28854 + memset(&arg64, 0, sizeof(arg64));
28855 +
28856 err = 0;
28857 err |=
28858 copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
28859 @@ -3007,7 +3009,7 @@ static void start_io(ctlr_info_t *h)
28860 while (!list_empty(&h->reqQ)) {
28861 c = list_entry(h->reqQ.next, CommandList_struct, list);
28862 /* can't do anything if fifo is full */
28863 - if ((h->access.fifo_full(h))) {
28864 + if ((h->access->fifo_full(h))) {
28865 dev_warn(&h->pdev->dev, "fifo full\n");
28866 break;
28867 }
28868 @@ -3017,7 +3019,7 @@ static void start_io(ctlr_info_t *h)
28869 h->Qdepth--;
28870
28871 /* Tell the controller execute command */
28872 - h->access.submit_command(h, c);
28873 + h->access->submit_command(h, c);
28874
28875 /* Put job onto the completed Q */
28876 addQ(&h->cmpQ, c);
28877 @@ -3443,17 +3445,17 @@ startio:
28878
28879 static inline unsigned long get_next_completion(ctlr_info_t *h)
28880 {
28881 - return h->access.command_completed(h);
28882 + return h->access->command_completed(h);
28883 }
28884
28885 static inline int interrupt_pending(ctlr_info_t *h)
28886 {
28887 - return h->access.intr_pending(h);
28888 + return h->access->intr_pending(h);
28889 }
28890
28891 static inline long interrupt_not_for_us(ctlr_info_t *h)
28892 {
28893 - return ((h->access.intr_pending(h) == 0) ||
28894 + return ((h->access->intr_pending(h) == 0) ||
28895 (h->interrupts_enabled == 0));
28896 }
28897
28898 @@ -3486,7 +3488,7 @@ static inline u32 next_command(ctlr_info_t *h)
28899 u32 a;
28900
28901 if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
28902 - return h->access.command_completed(h);
28903 + return h->access->command_completed(h);
28904
28905 if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
28906 a = *(h->reply_pool_head); /* Next cmd in ring buffer */
28907 @@ -4044,7 +4046,7 @@ static void __devinit cciss_put_controller_into_performant_mode(ctlr_info_t *h)
28908 trans_support & CFGTBL_Trans_use_short_tags);
28909
28910 /* Change the access methods to the performant access methods */
28911 - h->access = SA5_performant_access;
28912 + h->access = &SA5_performant_access;
28913 h->transMethod = CFGTBL_Trans_Performant;
28914
28915 return;
28916 @@ -4316,7 +4318,7 @@ static int __devinit cciss_pci_init(ctlr_info_t *h)
28917 if (prod_index < 0)
28918 return -ENODEV;
28919 h->product_name = products[prod_index].product_name;
28920 - h->access = *(products[prod_index].access);
28921 + h->access = products[prod_index].access;
28922
28923 if (cciss_board_disabled(h)) {
28924 dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
28925 @@ -5041,7 +5043,7 @@ reinit_after_soft_reset:
28926 }
28927
28928 /* make sure the board interrupts are off */
28929 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
28930 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
28931 rc = cciss_request_irq(h, do_cciss_msix_intr, do_cciss_intx);
28932 if (rc)
28933 goto clean2;
28934 @@ -5093,7 +5095,7 @@ reinit_after_soft_reset:
28935 * fake ones to scoop up any residual completions.
28936 */
28937 spin_lock_irqsave(&h->lock, flags);
28938 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
28939 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
28940 spin_unlock_irqrestore(&h->lock, flags);
28941 free_irq(h->intr[h->intr_mode], h);
28942 rc = cciss_request_irq(h, cciss_msix_discard_completions,
28943 @@ -5113,9 +5115,9 @@ reinit_after_soft_reset:
28944 dev_info(&h->pdev->dev, "Board READY.\n");
28945 dev_info(&h->pdev->dev,
28946 "Waiting for stale completions to drain.\n");
28947 - h->access.set_intr_mask(h, CCISS_INTR_ON);
28948 + h->access->set_intr_mask(h, CCISS_INTR_ON);
28949 msleep(10000);
28950 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
28951 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
28952
28953 rc = controller_reset_failed(h->cfgtable);
28954 if (rc)
28955 @@ -5138,7 +5140,7 @@ reinit_after_soft_reset:
28956 cciss_scsi_setup(h);
28957
28958 /* Turn the interrupts on so we can service requests */
28959 - h->access.set_intr_mask(h, CCISS_INTR_ON);
28960 + h->access->set_intr_mask(h, CCISS_INTR_ON);
28961
28962 /* Get the firmware version */
28963 inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
28964 @@ -5211,7 +5213,7 @@ static void cciss_shutdown(struct pci_dev *pdev)
28965 kfree(flush_buf);
28966 if (return_code != IO_OK)
28967 dev_warn(&h->pdev->dev, "Error flushing cache\n");
28968 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
28969 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
28970 free_irq(h->intr[h->intr_mode], h);
28971 }
28972
28973 diff --git a/drivers/block/cciss.h b/drivers/block/cciss.h
28974 index 7fda30e..eb5dfe0 100644
28975 --- a/drivers/block/cciss.h
28976 +++ b/drivers/block/cciss.h
28977 @@ -101,7 +101,7 @@ struct ctlr_info
28978 /* information about each logical volume */
28979 drive_info_struct *drv[CISS_MAX_LUN];
28980
28981 - struct access_method access;
28982 + struct access_method *access;
28983
28984 /* queue and queue Info */
28985 struct list_head reqQ;
28986 diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
28987 index 9125bbe..eede5c8 100644
28988 --- a/drivers/block/cpqarray.c
28989 +++ b/drivers/block/cpqarray.c
28990 @@ -404,7 +404,7 @@ static int __devinit cpqarray_register_ctlr( int i, struct pci_dev *pdev)
28991 if (register_blkdev(COMPAQ_SMART2_MAJOR+i, hba[i]->devname)) {
28992 goto Enomem4;
28993 }
28994 - hba[i]->access.set_intr_mask(hba[i], 0);
28995 + hba[i]->access->set_intr_mask(hba[i], 0);
28996 if (request_irq(hba[i]->intr, do_ida_intr,
28997 IRQF_DISABLED|IRQF_SHARED, hba[i]->devname, hba[i]))
28998 {
28999 @@ -459,7 +459,7 @@ static int __devinit cpqarray_register_ctlr( int i, struct pci_dev *pdev)
29000 add_timer(&hba[i]->timer);
29001
29002 /* Enable IRQ now that spinlock and rate limit timer are set up */
29003 - hba[i]->access.set_intr_mask(hba[i], FIFO_NOT_EMPTY);
29004 + hba[i]->access->set_intr_mask(hba[i], FIFO_NOT_EMPTY);
29005
29006 for(j=0; j<NWD; j++) {
29007 struct gendisk *disk = ida_gendisk[i][j];
29008 @@ -694,7 +694,7 @@ DBGINFO(
29009 for(i=0; i<NR_PRODUCTS; i++) {
29010 if (board_id == products[i].board_id) {
29011 c->product_name = products[i].product_name;
29012 - c->access = *(products[i].access);
29013 + c->access = products[i].access;
29014 break;
29015 }
29016 }
29017 @@ -792,7 +792,7 @@ static int __devinit cpqarray_eisa_detect(void)
29018 hba[ctlr]->intr = intr;
29019 sprintf(hba[ctlr]->devname, "ida%d", nr_ctlr);
29020 hba[ctlr]->product_name = products[j].product_name;
29021 - hba[ctlr]->access = *(products[j].access);
29022 + hba[ctlr]->access = products[j].access;
29023 hba[ctlr]->ctlr = ctlr;
29024 hba[ctlr]->board_id = board_id;
29025 hba[ctlr]->pci_dev = NULL; /* not PCI */
29026 @@ -980,7 +980,7 @@ static void start_io(ctlr_info_t *h)
29027
29028 while((c = h->reqQ) != NULL) {
29029 /* Can't do anything if we're busy */
29030 - if (h->access.fifo_full(h) == 0)
29031 + if (h->access->fifo_full(h) == 0)
29032 return;
29033
29034 /* Get the first entry from the request Q */
29035 @@ -988,7 +988,7 @@ static void start_io(ctlr_info_t *h)
29036 h->Qdepth--;
29037
29038 /* Tell the controller to do our bidding */
29039 - h->access.submit_command(h, c);
29040 + h->access->submit_command(h, c);
29041
29042 /* Get onto the completion Q */
29043 addQ(&h->cmpQ, c);
29044 @@ -1050,7 +1050,7 @@ static irqreturn_t do_ida_intr(int irq, void *dev_id)
29045 unsigned long flags;
29046 __u32 a,a1;
29047
29048 - istat = h->access.intr_pending(h);
29049 + istat = h->access->intr_pending(h);
29050 /* Is this interrupt for us? */
29051 if (istat == 0)
29052 return IRQ_NONE;
29053 @@ -1061,7 +1061,7 @@ static irqreturn_t do_ida_intr(int irq, void *dev_id)
29054 */
29055 spin_lock_irqsave(IDA_LOCK(h->ctlr), flags);
29056 if (istat & FIFO_NOT_EMPTY) {
29057 - while((a = h->access.command_completed(h))) {
29058 + while((a = h->access->command_completed(h))) {
29059 a1 = a; a &= ~3;
29060 if ((c = h->cmpQ) == NULL)
29061 {
29062 @@ -1449,11 +1449,11 @@ static int sendcmd(
29063 /*
29064 * Disable interrupt
29065 */
29066 - info_p->access.set_intr_mask(info_p, 0);
29067 + info_p->access->set_intr_mask(info_p, 0);
29068 /* Make sure there is room in the command FIFO */
29069 /* Actually it should be completely empty at this time. */
29070 for (i = 200000; i > 0; i--) {
29071 - temp = info_p->access.fifo_full(info_p);
29072 + temp = info_p->access->fifo_full(info_p);
29073 if (temp != 0) {
29074 break;
29075 }
29076 @@ -1466,7 +1466,7 @@ DBG(
29077 /*
29078 * Send the cmd
29079 */
29080 - info_p->access.submit_command(info_p, c);
29081 + info_p->access->submit_command(info_p, c);
29082 complete = pollcomplete(ctlr);
29083
29084 pci_unmap_single(info_p->pci_dev, (dma_addr_t) c->req.sg[0].addr,
29085 @@ -1549,9 +1549,9 @@ static int revalidate_allvol(ctlr_info_t *host)
29086 * we check the new geometry. Then turn interrupts back on when
29087 * we're done.
29088 */
29089 - host->access.set_intr_mask(host, 0);
29090 + host->access->set_intr_mask(host, 0);
29091 getgeometry(ctlr);
29092 - host->access.set_intr_mask(host, FIFO_NOT_EMPTY);
29093 + host->access->set_intr_mask(host, FIFO_NOT_EMPTY);
29094
29095 for(i=0; i<NWD; i++) {
29096 struct gendisk *disk = ida_gendisk[ctlr][i];
29097 @@ -1591,7 +1591,7 @@ static int pollcomplete(int ctlr)
29098 /* Wait (up to 2 seconds) for a command to complete */
29099
29100 for (i = 200000; i > 0; i--) {
29101 - done = hba[ctlr]->access.command_completed(hba[ctlr]);
29102 + done = hba[ctlr]->access->command_completed(hba[ctlr]);
29103 if (done == 0) {
29104 udelay(10); /* a short fixed delay */
29105 } else
29106 diff --git a/drivers/block/cpqarray.h b/drivers/block/cpqarray.h
29107 index be73e9d..7fbf140 100644
29108 --- a/drivers/block/cpqarray.h
29109 +++ b/drivers/block/cpqarray.h
29110 @@ -99,7 +99,7 @@ struct ctlr_info {
29111 drv_info_t drv[NWD];
29112 struct proc_dir_entry *proc;
29113
29114 - struct access_method access;
29115 + struct access_method *access;
29116
29117 cmdlist_t *reqQ;
29118 cmdlist_t *cmpQ;
29119 diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h
29120 index 02f013a..afeba24 100644
29121 --- a/drivers/block/drbd/drbd_int.h
29122 +++ b/drivers/block/drbd/drbd_int.h
29123 @@ -735,7 +735,7 @@ struct drbd_request;
29124 struct drbd_epoch {
29125 struct list_head list;
29126 unsigned int barrier_nr;
29127 - atomic_t epoch_size; /* increased on every request added. */
29128 + atomic_unchecked_t epoch_size; /* increased on every request added. */
29129 atomic_t active; /* increased on every req. added, and dec on every finished. */
29130 unsigned long flags;
29131 };
29132 @@ -1110,7 +1110,7 @@ struct drbd_conf {
29133 void *int_dig_in;
29134 void *int_dig_vv;
29135 wait_queue_head_t seq_wait;
29136 - atomic_t packet_seq;
29137 + atomic_unchecked_t packet_seq;
29138 unsigned int peer_seq;
29139 spinlock_t peer_seq_lock;
29140 unsigned int minor;
29141 @@ -1651,30 +1651,30 @@ static inline int drbd_setsockopt(struct socket *sock, int level, int optname,
29142
29143 static inline void drbd_tcp_cork(struct socket *sock)
29144 {
29145 - int __user val = 1;
29146 + int val = 1;
29147 (void) drbd_setsockopt(sock, SOL_TCP, TCP_CORK,
29148 - (char __user *)&val, sizeof(val));
29149 + (char __force_user *)&val, sizeof(val));
29150 }
29151
29152 static inline void drbd_tcp_uncork(struct socket *sock)
29153 {
29154 - int __user val = 0;
29155 + int val = 0;
29156 (void) drbd_setsockopt(sock, SOL_TCP, TCP_CORK,
29157 - (char __user *)&val, sizeof(val));
29158 + (char __force_user *)&val, sizeof(val));
29159 }
29160
29161 static inline void drbd_tcp_nodelay(struct socket *sock)
29162 {
29163 - int __user val = 1;
29164 + int val = 1;
29165 (void) drbd_setsockopt(sock, SOL_TCP, TCP_NODELAY,
29166 - (char __user *)&val, sizeof(val));
29167 + (char __force_user *)&val, sizeof(val));
29168 }
29169
29170 static inline void drbd_tcp_quickack(struct socket *sock)
29171 {
29172 - int __user val = 2;
29173 + int val = 2;
29174 (void) drbd_setsockopt(sock, SOL_TCP, TCP_QUICKACK,
29175 - (char __user *)&val, sizeof(val));
29176 + (char __force_user *)&val, sizeof(val));
29177 }
29178
29179 void drbd_bump_write_ordering(struct drbd_conf *mdev, enum write_ordering_e wo);
29180 diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
29181 index 920ede2..cb827ba 100644
29182 --- a/drivers/block/drbd/drbd_main.c
29183 +++ b/drivers/block/drbd/drbd_main.c
29184 @@ -2555,7 +2555,7 @@ static int _drbd_send_ack(struct drbd_conf *mdev, enum drbd_packets cmd,
29185 p.sector = sector;
29186 p.block_id = block_id;
29187 p.blksize = blksize;
29188 - p.seq_num = cpu_to_be32(atomic_add_return(1, &mdev->packet_seq));
29189 + p.seq_num = cpu_to_be32(atomic_add_return_unchecked(1, &mdev->packet_seq));
29190
29191 if (!mdev->meta.socket || mdev->state.conn < C_CONNECTED)
29192 return false;
29193 @@ -2853,7 +2853,7 @@ int drbd_send_dblock(struct drbd_conf *mdev, struct drbd_request *req)
29194
29195 p.sector = cpu_to_be64(req->sector);
29196 p.block_id = (unsigned long)req;
29197 - p.seq_num = cpu_to_be32(atomic_add_return(1, &mdev->packet_seq));
29198 + p.seq_num = cpu_to_be32(atomic_add_return_unchecked(1, &mdev->packet_seq));
29199
29200 dp_flags = bio_flags_to_wire(mdev, req->master_bio->bi_rw);
29201
29202 @@ -3138,7 +3138,7 @@ void drbd_init_set_defaults(struct drbd_conf *mdev)
29203 atomic_set(&mdev->unacked_cnt, 0);
29204 atomic_set(&mdev->local_cnt, 0);
29205 atomic_set(&mdev->net_cnt, 0);
29206 - atomic_set(&mdev->packet_seq, 0);
29207 + atomic_set_unchecked(&mdev->packet_seq, 0);
29208 atomic_set(&mdev->pp_in_use, 0);
29209 atomic_set(&mdev->pp_in_use_by_net, 0);
29210 atomic_set(&mdev->rs_sect_in, 0);
29211 @@ -3220,8 +3220,8 @@ void drbd_mdev_cleanup(struct drbd_conf *mdev)
29212 mdev->receiver.t_state);
29213
29214 /* no need to lock it, I'm the only thread alive */
29215 - if (atomic_read(&mdev->current_epoch->epoch_size) != 0)
29216 - dev_err(DEV, "epoch_size:%d\n", atomic_read(&mdev->current_epoch->epoch_size));
29217 + if (atomic_read_unchecked(&mdev->current_epoch->epoch_size) != 0)
29218 + dev_err(DEV, "epoch_size:%d\n", atomic_read_unchecked(&mdev->current_epoch->epoch_size));
29219 mdev->al_writ_cnt =
29220 mdev->bm_writ_cnt =
29221 mdev->read_cnt =
29222 diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
29223 index 6d4de6a..7b7ad4b 100644
29224 --- a/drivers/block/drbd/drbd_nl.c
29225 +++ b/drivers/block/drbd/drbd_nl.c
29226 @@ -2387,7 +2387,7 @@ static void drbd_connector_callback(struct cn_msg *req, struct netlink_skb_parms
29227 module_put(THIS_MODULE);
29228 }
29229
29230 -static atomic_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
29231 +static atomic_unchecked_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
29232
29233 static unsigned short *
29234 __tl_add_blob(unsigned short *tl, enum drbd_tags tag, const void *data,
29235 @@ -2458,7 +2458,7 @@ void drbd_bcast_state(struct drbd_conf *mdev, union drbd_state state)
29236 cn_reply->id.idx = CN_IDX_DRBD;
29237 cn_reply->id.val = CN_VAL_DRBD;
29238
29239 - cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
29240 + cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
29241 cn_reply->ack = 0; /* not used here. */
29242 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
29243 (int)((char *)tl - (char *)reply->tag_list);
29244 @@ -2490,7 +2490,7 @@ void drbd_bcast_ev_helper(struct drbd_conf *mdev, char *helper_name)
29245 cn_reply->id.idx = CN_IDX_DRBD;
29246 cn_reply->id.val = CN_VAL_DRBD;
29247
29248 - cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
29249 + cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
29250 cn_reply->ack = 0; /* not used here. */
29251 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
29252 (int)((char *)tl - (char *)reply->tag_list);
29253 @@ -2568,7 +2568,7 @@ void drbd_bcast_ee(struct drbd_conf *mdev,
29254 cn_reply->id.idx = CN_IDX_DRBD;
29255 cn_reply->id.val = CN_VAL_DRBD;
29256
29257 - cn_reply->seq = atomic_add_return(1,&drbd_nl_seq);
29258 + cn_reply->seq = atomic_add_return_unchecked(1,&drbd_nl_seq);
29259 cn_reply->ack = 0; // not used here.
29260 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
29261 (int)((char*)tl - (char*)reply->tag_list);
29262 @@ -2607,7 +2607,7 @@ void drbd_bcast_sync_progress(struct drbd_conf *mdev)
29263 cn_reply->id.idx = CN_IDX_DRBD;
29264 cn_reply->id.val = CN_VAL_DRBD;
29265
29266 - cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
29267 + cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
29268 cn_reply->ack = 0; /* not used here. */
29269 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
29270 (int)((char *)tl - (char *)reply->tag_list);
29271 diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
29272 index ea4836e..272d72a 100644
29273 --- a/drivers/block/drbd/drbd_receiver.c
29274 +++ b/drivers/block/drbd/drbd_receiver.c
29275 @@ -893,7 +893,7 @@ retry:
29276 sock->sk->sk_sndtimeo = mdev->net_conf->timeout*HZ/10;
29277 sock->sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
29278
29279 - atomic_set(&mdev->packet_seq, 0);
29280 + atomic_set_unchecked(&mdev->packet_seq, 0);
29281 mdev->peer_seq = 0;
29282
29283 if (drbd_send_protocol(mdev) == -1)
29284 @@ -994,7 +994,7 @@ static enum finish_epoch drbd_may_finish_epoch(struct drbd_conf *mdev,
29285 do {
29286 next_epoch = NULL;
29287
29288 - epoch_size = atomic_read(&epoch->epoch_size);
29289 + epoch_size = atomic_read_unchecked(&epoch->epoch_size);
29290
29291 switch (ev & ~EV_CLEANUP) {
29292 case EV_PUT:
29293 @@ -1030,7 +1030,7 @@ static enum finish_epoch drbd_may_finish_epoch(struct drbd_conf *mdev,
29294 rv = FE_DESTROYED;
29295 } else {
29296 epoch->flags = 0;
29297 - atomic_set(&epoch->epoch_size, 0);
29298 + atomic_set_unchecked(&epoch->epoch_size, 0);
29299 /* atomic_set(&epoch->active, 0); is already zero */
29300 if (rv == FE_STILL_LIVE)
29301 rv = FE_RECYCLED;
29302 @@ -1205,14 +1205,14 @@ static int receive_Barrier(struct drbd_conf *mdev, enum drbd_packets cmd, unsign
29303 drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
29304 drbd_flush(mdev);
29305
29306 - if (atomic_read(&mdev->current_epoch->epoch_size)) {
29307 + if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
29308 epoch = kmalloc(sizeof(struct drbd_epoch), GFP_NOIO);
29309 if (epoch)
29310 break;
29311 }
29312
29313 epoch = mdev->current_epoch;
29314 - wait_event(mdev->ee_wait, atomic_read(&epoch->epoch_size) == 0);
29315 + wait_event(mdev->ee_wait, atomic_read_unchecked(&epoch->epoch_size) == 0);
29316
29317 D_ASSERT(atomic_read(&epoch->active) == 0);
29318 D_ASSERT(epoch->flags == 0);
29319 @@ -1224,11 +1224,11 @@ static int receive_Barrier(struct drbd_conf *mdev, enum drbd_packets cmd, unsign
29320 }
29321
29322 epoch->flags = 0;
29323 - atomic_set(&epoch->epoch_size, 0);
29324 + atomic_set_unchecked(&epoch->epoch_size, 0);
29325 atomic_set(&epoch->active, 0);
29326
29327 spin_lock(&mdev->epoch_lock);
29328 - if (atomic_read(&mdev->current_epoch->epoch_size)) {
29329 + if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
29330 list_add(&epoch->list, &mdev->current_epoch->list);
29331 mdev->current_epoch = epoch;
29332 mdev->epochs++;
29333 @@ -1695,7 +1695,7 @@ static int receive_Data(struct drbd_conf *mdev, enum drbd_packets cmd, unsigned
29334 spin_unlock(&mdev->peer_seq_lock);
29335
29336 drbd_send_ack_dp(mdev, P_NEG_ACK, p, data_size);
29337 - atomic_inc(&mdev->current_epoch->epoch_size);
29338 + atomic_inc_unchecked(&mdev->current_epoch->epoch_size);
29339 return drbd_drain_block(mdev, data_size);
29340 }
29341
29342 @@ -1721,7 +1721,7 @@ static int receive_Data(struct drbd_conf *mdev, enum drbd_packets cmd, unsigned
29343
29344 spin_lock(&mdev->epoch_lock);
29345 e->epoch = mdev->current_epoch;
29346 - atomic_inc(&e->epoch->epoch_size);
29347 + atomic_inc_unchecked(&e->epoch->epoch_size);
29348 atomic_inc(&e->epoch->active);
29349 spin_unlock(&mdev->epoch_lock);
29350
29351 @@ -3936,7 +3936,7 @@ static void drbd_disconnect(struct drbd_conf *mdev)
29352 D_ASSERT(list_empty(&mdev->done_ee));
29353
29354 /* ok, no more ee's on the fly, it is safe to reset the epoch_size */
29355 - atomic_set(&mdev->current_epoch->epoch_size, 0);
29356 + atomic_set_unchecked(&mdev->current_epoch->epoch_size, 0);
29357 D_ASSERT(list_empty(&mdev->current_epoch->list));
29358 }
29359
29360 diff --git a/drivers/block/loop.c b/drivers/block/loop.c
29361 index 3bba655..6151b66 100644
29362 --- a/drivers/block/loop.c
29363 +++ b/drivers/block/loop.c
29364 @@ -226,7 +226,7 @@ static int __do_lo_send_write(struct file *file,
29365 mm_segment_t old_fs = get_fs();
29366
29367 set_fs(get_ds());
29368 - bw = file->f_op->write(file, buf, len, &pos);
29369 + bw = file->f_op->write(file, (const char __force_user *)buf, len, &pos);
29370 set_fs(old_fs);
29371 if (likely(bw == len))
29372 return 0;
29373 diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
29374 index ea6f632..eafb192 100644
29375 --- a/drivers/char/Kconfig
29376 +++ b/drivers/char/Kconfig
29377 @@ -8,7 +8,8 @@ source "drivers/tty/Kconfig"
29378
29379 config DEVKMEM
29380 bool "/dev/kmem virtual device support"
29381 - default y
29382 + default n
29383 + depends on !GRKERNSEC_KMEM
29384 help
29385 Say Y here if you want to support the /dev/kmem device. The
29386 /dev/kmem device is rarely used, but can be used for certain
29387 @@ -581,6 +582,7 @@ config DEVPORT
29388 bool
29389 depends on !M68K
29390 depends on ISA || PCI
29391 + depends on !GRKERNSEC_KMEM
29392 default y
29393
29394 source "drivers/s390/char/Kconfig"
29395 diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
29396 index 2e04433..22afc64 100644
29397 --- a/drivers/char/agp/frontend.c
29398 +++ b/drivers/char/agp/frontend.c
29399 @@ -817,7 +817,7 @@ static int agpioc_reserve_wrap(struct agp_file_private *priv, void __user *arg)
29400 if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
29401 return -EFAULT;
29402
29403 - if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
29404 + if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
29405 return -EFAULT;
29406
29407 client = agp_find_client_by_pid(reserve.pid);
29408 diff --git a/drivers/char/genrtc.c b/drivers/char/genrtc.c
29409 index 21cb980..f15107c 100644
29410 --- a/drivers/char/genrtc.c
29411 +++ b/drivers/char/genrtc.c
29412 @@ -272,6 +272,7 @@ static int gen_rtc_ioctl(struct file *file,
29413 switch (cmd) {
29414
29415 case RTC_PLL_GET:
29416 + memset(&pll, 0, sizeof(pll));
29417 if (get_rtc_pll(&pll))
29418 return -EINVAL;
29419 else
29420 diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
29421 index dfd7876..c0b0885 100644
29422 --- a/drivers/char/hpet.c
29423 +++ b/drivers/char/hpet.c
29424 @@ -571,7 +571,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
29425 }
29426
29427 static int
29428 -hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
29429 +hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg,
29430 struct hpet_info *info)
29431 {
29432 struct hpet_timer __iomem *timer;
29433 diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
29434 index 2c29942..604c5ba 100644
29435 --- a/drivers/char/ipmi/ipmi_msghandler.c
29436 +++ b/drivers/char/ipmi/ipmi_msghandler.c
29437 @@ -420,7 +420,7 @@ struct ipmi_smi {
29438 struct proc_dir_entry *proc_dir;
29439 char proc_dir_name[10];
29440
29441 - atomic_t stats[IPMI_NUM_STATS];
29442 + atomic_unchecked_t stats[IPMI_NUM_STATS];
29443
29444 /*
29445 * run_to_completion duplicate of smb_info, smi_info
29446 @@ -453,9 +453,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
29447
29448
29449 #define ipmi_inc_stat(intf, stat) \
29450 - atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
29451 + atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
29452 #define ipmi_get_stat(intf, stat) \
29453 - ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
29454 + ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
29455
29456 static int is_lan_addr(struct ipmi_addr *addr)
29457 {
29458 @@ -2884,7 +2884,7 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
29459 INIT_LIST_HEAD(&intf->cmd_rcvrs);
29460 init_waitqueue_head(&intf->waitq);
29461 for (i = 0; i < IPMI_NUM_STATS; i++)
29462 - atomic_set(&intf->stats[i], 0);
29463 + atomic_set_unchecked(&intf->stats[i], 0);
29464
29465 intf->proc_dir = NULL;
29466
29467 diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
29468 index 1e638ff..a869ef5 100644
29469 --- a/drivers/char/ipmi/ipmi_si_intf.c
29470 +++ b/drivers/char/ipmi/ipmi_si_intf.c
29471 @@ -275,7 +275,7 @@ struct smi_info {
29472 unsigned char slave_addr;
29473
29474 /* Counters and things for the proc filesystem. */
29475 - atomic_t stats[SI_NUM_STATS];
29476 + atomic_unchecked_t stats[SI_NUM_STATS];
29477
29478 struct task_struct *thread;
29479
29480 @@ -284,9 +284,9 @@ struct smi_info {
29481 };
29482
29483 #define smi_inc_stat(smi, stat) \
29484 - atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
29485 + atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
29486 #define smi_get_stat(smi, stat) \
29487 - ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
29488 + ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
29489
29490 #define SI_MAX_PARMS 4
29491
29492 @@ -3209,7 +3209,7 @@ static int try_smi_init(struct smi_info *new_smi)
29493 atomic_set(&new_smi->req_events, 0);
29494 new_smi->run_to_completion = 0;
29495 for (i = 0; i < SI_NUM_STATS; i++)
29496 - atomic_set(&new_smi->stats[i], 0);
29497 + atomic_set_unchecked(&new_smi->stats[i], 0);
29498
29499 new_smi->interrupt_disabled = 1;
29500 atomic_set(&new_smi->stop_operation, 0);
29501 diff --git a/drivers/char/mbcs.c b/drivers/char/mbcs.c
29502 index 47ff7e4..0c7d340 100644
29503 --- a/drivers/char/mbcs.c
29504 +++ b/drivers/char/mbcs.c
29505 @@ -799,7 +799,7 @@ static int mbcs_remove(struct cx_dev *dev)
29506 return 0;
29507 }
29508
29509 -static const struct cx_device_id __devinitdata mbcs_id_table[] = {
29510 +static const struct cx_device_id __devinitconst mbcs_id_table[] = {
29511 {
29512 .part_num = MBCS_PART_NUM,
29513 .mfg_num = MBCS_MFG_NUM,
29514 diff --git a/drivers/char/mem.c b/drivers/char/mem.c
29515 index 67c3371..ba8429d 100644
29516 --- a/drivers/char/mem.c
29517 +++ b/drivers/char/mem.c
29518 @@ -18,6 +18,7 @@
29519 #include <linux/raw.h>
29520 #include <linux/tty.h>
29521 #include <linux/capability.h>
29522 +#include <linux/security.h>
29523 #include <linux/ptrace.h>
29524 #include <linux/device.h>
29525 #include <linux/highmem.h>
29526 @@ -35,6 +36,10 @@
29527 # include <linux/efi.h>
29528 #endif
29529
29530 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
29531 +extern const struct file_operations grsec_fops;
29532 +#endif
29533 +
29534 static inline unsigned long size_inside_page(unsigned long start,
29535 unsigned long size)
29536 {
29537 @@ -66,9 +71,13 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
29538
29539 while (cursor < to) {
29540 if (!devmem_is_allowed(pfn)) {
29541 +#ifdef CONFIG_GRKERNSEC_KMEM
29542 + gr_handle_mem_readwrite(from, to);
29543 +#else
29544 printk(KERN_INFO
29545 "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
29546 current->comm, from, to);
29547 +#endif
29548 return 0;
29549 }
29550 cursor += PAGE_SIZE;
29551 @@ -76,6 +85,11 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
29552 }
29553 return 1;
29554 }
29555 +#elif defined(CONFIG_GRKERNSEC_KMEM)
29556 +static inline int range_is_allowed(unsigned long pfn, unsigned long size)
29557 +{
29558 + return 0;
29559 +}
29560 #else
29561 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
29562 {
29563 @@ -118,6 +132,7 @@ static ssize_t read_mem(struct file *file, char __user *buf,
29564
29565 while (count > 0) {
29566 unsigned long remaining;
29567 + char *temp;
29568
29569 sz = size_inside_page(p, count);
29570
29571 @@ -133,7 +148,23 @@ static ssize_t read_mem(struct file *file, char __user *buf,
29572 if (!ptr)
29573 return -EFAULT;
29574
29575 - remaining = copy_to_user(buf, ptr, sz);
29576 +#ifdef CONFIG_PAX_USERCOPY
29577 + temp = kmalloc(sz, GFP_KERNEL|GFP_USERCOPY);
29578 + if (!temp) {
29579 + unxlate_dev_mem_ptr(p, ptr);
29580 + return -ENOMEM;
29581 + }
29582 + memcpy(temp, ptr, sz);
29583 +#else
29584 + temp = ptr;
29585 +#endif
29586 +
29587 + remaining = copy_to_user(buf, temp, sz);
29588 +
29589 +#ifdef CONFIG_PAX_USERCOPY
29590 + kfree(temp);
29591 +#endif
29592 +
29593 unxlate_dev_mem_ptr(p, ptr);
29594 if (remaining)
29595 return -EFAULT;
29596 @@ -396,9 +427,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
29597 size_t count, loff_t *ppos)
29598 {
29599 unsigned long p = *ppos;
29600 - ssize_t low_count, read, sz;
29601 + ssize_t low_count, read, sz, err = 0;
29602 char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
29603 - int err = 0;
29604
29605 read = 0;
29606 if (p < (unsigned long) high_memory) {
29607 @@ -420,6 +450,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
29608 }
29609 #endif
29610 while (low_count > 0) {
29611 + char *temp;
29612 +
29613 sz = size_inside_page(p, low_count);
29614
29615 /*
29616 @@ -429,7 +461,22 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
29617 */
29618 kbuf = xlate_dev_kmem_ptr((char *)p);
29619
29620 - if (copy_to_user(buf, kbuf, sz))
29621 +#ifdef CONFIG_PAX_USERCOPY
29622 + temp = kmalloc(sz, GFP_KERNEL|GFP_USERCOPY);
29623 + if (!temp)
29624 + return -ENOMEM;
29625 + memcpy(temp, kbuf, sz);
29626 +#else
29627 + temp = kbuf;
29628 +#endif
29629 +
29630 + err = copy_to_user(buf, temp, sz);
29631 +
29632 +#ifdef CONFIG_PAX_USERCOPY
29633 + kfree(temp);
29634 +#endif
29635 +
29636 + if (err)
29637 return -EFAULT;
29638 buf += sz;
29639 p += sz;
29640 @@ -831,6 +878,9 @@ static const struct memdev {
29641 #ifdef CONFIG_CRASH_DUMP
29642 [12] = { "oldmem", 0, &oldmem_fops, NULL },
29643 #endif
29644 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
29645 + [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
29646 +#endif
29647 };
29648
29649 static int memory_open(struct inode *inode, struct file *filp)
29650 diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c
29651 index 9df78e2..01ba9ae 100644
29652 --- a/drivers/char/nvram.c
29653 +++ b/drivers/char/nvram.c
29654 @@ -247,7 +247,7 @@ static ssize_t nvram_read(struct file *file, char __user *buf,
29655
29656 spin_unlock_irq(&rtc_lock);
29657
29658 - if (copy_to_user(buf, contents, tmp - contents))
29659 + if (tmp - contents > sizeof(contents) || copy_to_user(buf, contents, tmp - contents))
29660 return -EFAULT;
29661
29662 *ppos = i;
29663 diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
29664 index 0a484b4..f48ccd1 100644
29665 --- a/drivers/char/pcmcia/synclink_cs.c
29666 +++ b/drivers/char/pcmcia/synclink_cs.c
29667 @@ -2340,9 +2340,9 @@ static void mgslpc_close(struct tty_struct *tty, struct file * filp)
29668
29669 if (debug_level >= DEBUG_LEVEL_INFO)
29670 printk("%s(%d):mgslpc_close(%s) entry, count=%d\n",
29671 - __FILE__,__LINE__, info->device_name, port->count);
29672 + __FILE__,__LINE__, info->device_name, atomic_read(&port->count));
29673
29674 - WARN_ON(!port->count);
29675 + WARN_ON(!atomic_read(&port->count));
29676
29677 if (tty_port_close_start(port, tty, filp) == 0)
29678 goto cleanup;
29679 @@ -2360,7 +2360,7 @@ static void mgslpc_close(struct tty_struct *tty, struct file * filp)
29680 cleanup:
29681 if (debug_level >= DEBUG_LEVEL_INFO)
29682 printk("%s(%d):mgslpc_close(%s) exit, count=%d\n", __FILE__,__LINE__,
29683 - tty->driver->name, port->count);
29684 + tty->driver->name, atomic_read(&port->count));
29685 }
29686
29687 /* Wait until the transmitter is empty.
29688 @@ -2502,7 +2502,7 @@ static int mgslpc_open(struct tty_struct *tty, struct file * filp)
29689
29690 if (debug_level >= DEBUG_LEVEL_INFO)
29691 printk("%s(%d):mgslpc_open(%s), old ref count = %d\n",
29692 - __FILE__,__LINE__,tty->driver->name, port->count);
29693 + __FILE__,__LINE__,tty->driver->name, atomic_read(&port->count));
29694
29695 /* If port is closing, signal caller to try again */
29696 if (tty_hung_up_p(filp) || port->flags & ASYNC_CLOSING){
29697 @@ -2522,11 +2522,11 @@ static int mgslpc_open(struct tty_struct *tty, struct file * filp)
29698 goto cleanup;
29699 }
29700 spin_lock(&port->lock);
29701 - port->count++;
29702 + atomic_inc(&port->count);
29703 spin_unlock(&port->lock);
29704 spin_unlock_irqrestore(&info->netlock, flags);
29705
29706 - if (port->count == 1) {
29707 + if (atomic_read(&port->count) == 1) {
29708 /* 1st open on this device, init hardware */
29709 retval = startup(info, tty);
29710 if (retval < 0)
29711 @@ -3891,7 +3891,7 @@ static int hdlcdev_attach(struct net_device *dev, unsigned short encoding,
29712 unsigned short new_crctype;
29713
29714 /* return error if TTY interface open */
29715 - if (info->port.count)
29716 + if (atomic_read(&info->port.count))
29717 return -EBUSY;
29718
29719 switch (encoding)
29720 @@ -3994,7 +3994,7 @@ static int hdlcdev_open(struct net_device *dev)
29721
29722 /* arbitrate between network and tty opens */
29723 spin_lock_irqsave(&info->netlock, flags);
29724 - if (info->port.count != 0 || info->netcount != 0) {
29725 + if (atomic_read(&info->port.count) != 0 || info->netcount != 0) {
29726 printk(KERN_WARNING "%s: hdlc_open returning busy\n", dev->name);
29727 spin_unlock_irqrestore(&info->netlock, flags);
29728 return -EBUSY;
29729 @@ -4083,7 +4083,7 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
29730 printk("%s:hdlcdev_ioctl(%s)\n",__FILE__,dev->name);
29731
29732 /* return error if TTY interface open */
29733 - if (info->port.count)
29734 + if (atomic_read(&info->port.count))
29735 return -EBUSY;
29736
29737 if (cmd != SIOCWANDEV)
29738 diff --git a/drivers/char/random.c b/drivers/char/random.c
29739 index d98b2a6..f0ceb97 100644
29740 --- a/drivers/char/random.c
29741 +++ b/drivers/char/random.c
29742 @@ -272,8 +272,13 @@
29743 /*
29744 * Configuration information
29745 */
29746 +#ifdef CONFIG_GRKERNSEC_RANDNET
29747 +#define INPUT_POOL_WORDS 512
29748 +#define OUTPUT_POOL_WORDS 128
29749 +#else
29750 #define INPUT_POOL_WORDS 128
29751 #define OUTPUT_POOL_WORDS 32
29752 +#endif
29753 #define SEC_XFER_SIZE 512
29754 #define EXTRACT_SIZE 10
29755
29756 @@ -313,10 +318,17 @@ static struct poolinfo {
29757 int poolwords;
29758 int tap1, tap2, tap3, tap4, tap5;
29759 } poolinfo_table[] = {
29760 +#ifdef CONFIG_GRKERNSEC_RANDNET
29761 + /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
29762 + { 512, 411, 308, 208, 104, 1 },
29763 + /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
29764 + { 128, 103, 76, 51, 25, 1 },
29765 +#else
29766 /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
29767 { 128, 103, 76, 51, 25, 1 },
29768 /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
29769 { 32, 26, 20, 14, 7, 1 },
29770 +#endif
29771 #if 0
29772 /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
29773 { 2048, 1638, 1231, 819, 411, 1 },
29774 @@ -527,8 +539,8 @@ static void _mix_pool_bytes(struct entropy_store *r, const void *in,
29775 input_rotate += i ? 7 : 14;
29776 }
29777
29778 - ACCESS_ONCE(r->input_rotate) = input_rotate;
29779 - ACCESS_ONCE(r->add_ptr) = i;
29780 + ACCESS_ONCE_RW(r->input_rotate) = input_rotate;
29781 + ACCESS_ONCE_RW(r->add_ptr) = i;
29782 smp_wmb();
29783
29784 if (out)
29785 @@ -799,6 +811,17 @@ void add_disk_randomness(struct gendisk *disk)
29786 }
29787 #endif
29788
29789 +#ifdef CONFIG_PAX_LATENT_ENTROPY
29790 +u64 latent_entropy;
29791 +
29792 +__init void transfer_latent_entropy(void)
29793 +{
29794 + mix_pool_bytes(&input_pool, &latent_entropy, sizeof(latent_entropy), NULL);
29795 + mix_pool_bytes(&nonblocking_pool, &latent_entropy, sizeof(latent_entropy), NULL);
29796 +// printk(KERN_INFO "PAX: transferring latent entropy: %16llx\n", latent_entropy);
29797 +}
29798 +#endif
29799 +
29800 /*********************************************************************
29801 *
29802 * Entropy extraction routines
29803 @@ -1008,7 +1031,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
29804
29805 extract_buf(r, tmp);
29806 i = min_t(int, nbytes, EXTRACT_SIZE);
29807 - if (copy_to_user(buf, tmp, i)) {
29808 + if (i > sizeof(tmp) || copy_to_user(buf, tmp, i)) {
29809 ret = -EFAULT;
29810 break;
29811 }
29812 @@ -1342,7 +1365,7 @@ EXPORT_SYMBOL(generate_random_uuid);
29813 #include <linux/sysctl.h>
29814
29815 static int min_read_thresh = 8, min_write_thresh;
29816 -static int max_read_thresh = INPUT_POOL_WORDS * 32;
29817 +static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
29818 static int max_write_thresh = INPUT_POOL_WORDS * 32;
29819 static char sysctl_bootid[16];
29820
29821 diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
29822 index 45713f0..8286d21 100644
29823 --- a/drivers/char/sonypi.c
29824 +++ b/drivers/char/sonypi.c
29825 @@ -54,6 +54,7 @@
29826
29827 #include <asm/uaccess.h>
29828 #include <asm/io.h>
29829 +#include <asm/local.h>
29830
29831 #include <linux/sonypi.h>
29832
29833 @@ -490,7 +491,7 @@ static struct sonypi_device {
29834 spinlock_t fifo_lock;
29835 wait_queue_head_t fifo_proc_list;
29836 struct fasync_struct *fifo_async;
29837 - int open_count;
29838 + local_t open_count;
29839 int model;
29840 struct input_dev *input_jog_dev;
29841 struct input_dev *input_key_dev;
29842 @@ -897,7 +898,7 @@ static int sonypi_misc_fasync(int fd, struct file *filp, int on)
29843 static int sonypi_misc_release(struct inode *inode, struct file *file)
29844 {
29845 mutex_lock(&sonypi_device.lock);
29846 - sonypi_device.open_count--;
29847 + local_dec(&sonypi_device.open_count);
29848 mutex_unlock(&sonypi_device.lock);
29849 return 0;
29850 }
29851 @@ -906,9 +907,9 @@ static int sonypi_misc_open(struct inode *inode, struct file *file)
29852 {
29853 mutex_lock(&sonypi_device.lock);
29854 /* Flush input queue on first open */
29855 - if (!sonypi_device.open_count)
29856 + if (!local_read(&sonypi_device.open_count))
29857 kfifo_reset(&sonypi_device.fifo);
29858 - sonypi_device.open_count++;
29859 + local_inc(&sonypi_device.open_count);
29860 mutex_unlock(&sonypi_device.lock);
29861
29862 return 0;
29863 diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
29864 index 08427ab..1ab10b7 100644
29865 --- a/drivers/char/tpm/tpm.c
29866 +++ b/drivers/char/tpm/tpm.c
29867 @@ -415,7 +415,7 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
29868 chip->vendor.req_complete_val)
29869 goto out_recv;
29870
29871 - if ((status == chip->vendor.req_canceled)) {
29872 + if (status == chip->vendor.req_canceled) {
29873 dev_err(chip->dev, "Operation Canceled\n");
29874 rc = -ECANCELED;
29875 goto out;
29876 diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
29877 index 0636520..169c1d0 100644
29878 --- a/drivers/char/tpm/tpm_bios.c
29879 +++ b/drivers/char/tpm/tpm_bios.c
29880 @@ -173,7 +173,7 @@ static void *tpm_bios_measurements_start(struct seq_file *m, loff_t *pos)
29881 event = addr;
29882
29883 if ((event->event_type == 0 && event->event_size == 0) ||
29884 - ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
29885 + (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
29886 return NULL;
29887
29888 return addr;
29889 @@ -198,7 +198,7 @@ static void *tpm_bios_measurements_next(struct seq_file *m, void *v,
29890 return NULL;
29891
29892 if ((event->event_type == 0 && event->event_size == 0) ||
29893 - ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
29894 + (event->event_size >= limit - v - sizeof(struct tcpa_event)))
29895 return NULL;
29896
29897 (*pos)++;
29898 @@ -291,7 +291,8 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
29899 int i;
29900
29901 for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
29902 - seq_putc(m, data[i]);
29903 + if (!seq_putc(m, data[i]))
29904 + return -EFAULT;
29905
29906 return 0;
29907 }
29908 @@ -410,8 +411,13 @@ static int read_log(struct tpm_bios_log *log)
29909 log->bios_event_log_end = log->bios_event_log + len;
29910
29911 virt = acpi_os_map_memory(start, len);
29912 + if (!virt) {
29913 + kfree(log->bios_event_log);
29914 + log->bios_event_log = NULL;
29915 + return -EFAULT;
29916 + }
29917
29918 - memcpy(log->bios_event_log, virt, len);
29919 + memcpy(log->bios_event_log, (const char __force_kernel *)virt, len);
29920
29921 acpi_os_unmap_memory(virt, len);
29922 return 0;
29923 diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
29924 index cdf2f54..e55c197 100644
29925 --- a/drivers/char/virtio_console.c
29926 +++ b/drivers/char/virtio_console.c
29927 @@ -563,7 +563,7 @@ static ssize_t fill_readbuf(struct port *port, char *out_buf, size_t out_count,
29928 if (to_user) {
29929 ssize_t ret;
29930
29931 - ret = copy_to_user(out_buf, buf->buf + buf->offset, out_count);
29932 + ret = copy_to_user((char __force_user *)out_buf, buf->buf + buf->offset, out_count);
29933 if (ret)
29934 return -EFAULT;
29935 } else {
29936 @@ -662,7 +662,7 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
29937 if (!port_has_data(port) && !port->host_connected)
29938 return 0;
29939
29940 - return fill_readbuf(port, ubuf, count, true);
29941 + return fill_readbuf(port, (char __force_kernel *)ubuf, count, true);
29942 }
29943
29944 static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
29945 diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
29946 index 97f5064..202b6e6 100644
29947 --- a/drivers/edac/edac_pci_sysfs.c
29948 +++ b/drivers/edac/edac_pci_sysfs.c
29949 @@ -26,8 +26,8 @@ static int edac_pci_log_pe = 1; /* log PCI parity errors */
29950 static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
29951 static int edac_pci_poll_msec = 1000; /* one second workq period */
29952
29953 -static atomic_t pci_parity_count = ATOMIC_INIT(0);
29954 -static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
29955 +static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
29956 +static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
29957
29958 static struct kobject *edac_pci_top_main_kobj;
29959 static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
29960 @@ -582,7 +582,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
29961 edac_printk(KERN_CRIT, EDAC_PCI,
29962 "Signaled System Error on %s\n",
29963 pci_name(dev));
29964 - atomic_inc(&pci_nonparity_count);
29965 + atomic_inc_unchecked(&pci_nonparity_count);
29966 }
29967
29968 if (status & (PCI_STATUS_PARITY)) {
29969 @@ -590,7 +590,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
29970 "Master Data Parity Error on %s\n",
29971 pci_name(dev));
29972
29973 - atomic_inc(&pci_parity_count);
29974 + atomic_inc_unchecked(&pci_parity_count);
29975 }
29976
29977 if (status & (PCI_STATUS_DETECTED_PARITY)) {
29978 @@ -598,7 +598,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
29979 "Detected Parity Error on %s\n",
29980 pci_name(dev));
29981
29982 - atomic_inc(&pci_parity_count);
29983 + atomic_inc_unchecked(&pci_parity_count);
29984 }
29985 }
29986
29987 @@ -619,7 +619,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
29988 edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
29989 "Signaled System Error on %s\n",
29990 pci_name(dev));
29991 - atomic_inc(&pci_nonparity_count);
29992 + atomic_inc_unchecked(&pci_nonparity_count);
29993 }
29994
29995 if (status & (PCI_STATUS_PARITY)) {
29996 @@ -627,7 +627,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
29997 "Master Data Parity Error on "
29998 "%s\n", pci_name(dev));
29999
30000 - atomic_inc(&pci_parity_count);
30001 + atomic_inc_unchecked(&pci_parity_count);
30002 }
30003
30004 if (status & (PCI_STATUS_DETECTED_PARITY)) {
30005 @@ -635,7 +635,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
30006 "Detected Parity Error on %s\n",
30007 pci_name(dev));
30008
30009 - atomic_inc(&pci_parity_count);
30010 + atomic_inc_unchecked(&pci_parity_count);
30011 }
30012 }
30013 }
30014 @@ -677,7 +677,7 @@ void edac_pci_do_parity_check(void)
30015 if (!check_pci_errors)
30016 return;
30017
30018 - before_count = atomic_read(&pci_parity_count);
30019 + before_count = atomic_read_unchecked(&pci_parity_count);
30020
30021 /* scan all PCI devices looking for a Parity Error on devices and
30022 * bridges.
30023 @@ -689,7 +689,7 @@ void edac_pci_do_parity_check(void)
30024 /* Only if operator has selected panic on PCI Error */
30025 if (edac_pci_get_panic_on_pe()) {
30026 /* If the count is different 'after' from 'before' */
30027 - if (before_count != atomic_read(&pci_parity_count))
30028 + if (before_count != atomic_read_unchecked(&pci_parity_count))
30029 panic("EDAC: PCI Parity Error");
30030 }
30031 }
30032 diff --git a/drivers/edac/mce_amd.h b/drivers/edac/mce_amd.h
30033 index 8c87a5e..a19cbd7 100644
30034 --- a/drivers/edac/mce_amd.h
30035 +++ b/drivers/edac/mce_amd.h
30036 @@ -80,7 +80,7 @@ extern const char * const ii_msgs[];
30037 struct amd_decoder_ops {
30038 bool (*dc_mce)(u16, u8);
30039 bool (*ic_mce)(u16, u8);
30040 -};
30041 +} __no_const;
30042
30043 void amd_report_gart_errors(bool);
30044 void amd_register_ecc_decoder(void (*f)(int, struct mce *));
30045 diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
30046 index 57ea7f4..789e3c3 100644
30047 --- a/drivers/firewire/core-card.c
30048 +++ b/drivers/firewire/core-card.c
30049 @@ -680,7 +680,7 @@ EXPORT_SYMBOL_GPL(fw_card_release);
30050
30051 void fw_core_remove_card(struct fw_card *card)
30052 {
30053 - struct fw_card_driver dummy_driver = dummy_driver_template;
30054 + fw_card_driver_no_const dummy_driver = dummy_driver_template;
30055
30056 card->driver->update_phy_reg(card, 4,
30057 PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
30058 diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
30059 index 2783f69..9f4b0cc 100644
30060 --- a/drivers/firewire/core-cdev.c
30061 +++ b/drivers/firewire/core-cdev.c
30062 @@ -1365,8 +1365,7 @@ static int init_iso_resource(struct client *client,
30063 int ret;
30064
30065 if ((request->channels == 0 && request->bandwidth == 0) ||
30066 - request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
30067 - request->bandwidth < 0)
30068 + request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
30069 return -EINVAL;
30070
30071 r = kmalloc(sizeof(*r), GFP_KERNEL);
30072 diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c
30073 index 780708d..ad60a66 100644
30074 --- a/drivers/firewire/core-transaction.c
30075 +++ b/drivers/firewire/core-transaction.c
30076 @@ -37,6 +37,7 @@
30077 #include <linux/timer.h>
30078 #include <linux/types.h>
30079 #include <linux/workqueue.h>
30080 +#include <linux/sched.h>
30081
30082 #include <asm/byteorder.h>
30083
30084 diff --git a/drivers/firewire/core.h b/drivers/firewire/core.h
30085 index 515a42c..5ecf3ba 100644
30086 --- a/drivers/firewire/core.h
30087 +++ b/drivers/firewire/core.h
30088 @@ -111,6 +111,7 @@ struct fw_card_driver {
30089
30090 int (*stop_iso)(struct fw_iso_context *ctx);
30091 };
30092 +typedef struct fw_card_driver __no_const fw_card_driver_no_const;
30093
30094 void fw_card_initialize(struct fw_card *card,
30095 const struct fw_card_driver *driver, struct device *device);
30096 diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
30097 index b298158..7ed8432 100644
30098 --- a/drivers/firmware/dmi_scan.c
30099 +++ b/drivers/firmware/dmi_scan.c
30100 @@ -452,11 +452,6 @@ void __init dmi_scan_machine(void)
30101 }
30102 }
30103 else {
30104 - /*
30105 - * no iounmap() for that ioremap(); it would be a no-op, but
30106 - * it's so early in setup that sucker gets confused into doing
30107 - * what it shouldn't if we actually call it.
30108 - */
30109 p = dmi_ioremap(0xF0000, 0x10000);
30110 if (p == NULL)
30111 goto error;
30112 @@ -726,7 +721,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
30113 if (buf == NULL)
30114 return -1;
30115
30116 - dmi_table(buf, dmi_len, dmi_num, decode, private_data);
30117 + dmi_table((char __force_kernel *)buf, dmi_len, dmi_num, decode, private_data);
30118
30119 iounmap(buf);
30120 return 0;
30121 diff --git a/drivers/gpio/gpio-vr41xx.c b/drivers/gpio/gpio-vr41xx.c
30122 index 82d5c20..44a7177 100644
30123 --- a/drivers/gpio/gpio-vr41xx.c
30124 +++ b/drivers/gpio/gpio-vr41xx.c
30125 @@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
30126 printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
30127 maskl, pendl, maskh, pendh);
30128
30129 - atomic_inc(&irq_err_count);
30130 + atomic_inc_unchecked(&irq_err_count);
30131
30132 return -EINVAL;
30133 }
30134 diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
30135 index 3252e70..b5314ace 100644
30136 --- a/drivers/gpu/drm/drm_crtc_helper.c
30137 +++ b/drivers/gpu/drm/drm_crtc_helper.c
30138 @@ -286,7 +286,7 @@ static bool drm_encoder_crtc_ok(struct drm_encoder *encoder,
30139 struct drm_crtc *tmp;
30140 int crtc_mask = 1;
30141
30142 - WARN(!crtc, "checking null crtc?\n");
30143 + BUG_ON(!crtc);
30144
30145 dev = crtc->dev;
30146
30147 diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
30148 index 8a9d079..606cdd5 100644
30149 --- a/drivers/gpu/drm/drm_drv.c
30150 +++ b/drivers/gpu/drm/drm_drv.c
30151 @@ -318,7 +318,7 @@ module_exit(drm_core_exit);
30152 /**
30153 * Copy and IOCTL return string to user space
30154 */
30155 -static int drm_copy_field(char *buf, size_t *buf_len, const char *value)
30156 +static int drm_copy_field(char __user *buf, size_t *buf_len, const char *value)
30157 {
30158 int len;
30159
30160 @@ -401,7 +401,7 @@ long drm_ioctl(struct file *filp,
30161 return -ENODEV;
30162
30163 atomic_inc(&dev->ioctl_count);
30164 - atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
30165 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
30166 ++file_priv->ioctl_count;
30167
30168 DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
30169 diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
30170 index 123de28..43a0897 100644
30171 --- a/drivers/gpu/drm/drm_fops.c
30172 +++ b/drivers/gpu/drm/drm_fops.c
30173 @@ -71,7 +71,7 @@ static int drm_setup(struct drm_device * dev)
30174 }
30175
30176 for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
30177 - atomic_set(&dev->counts[i], 0);
30178 + atomic_set_unchecked(&dev->counts[i], 0);
30179
30180 dev->sigdata.lock = NULL;
30181
30182 @@ -138,8 +138,8 @@ int drm_open(struct inode *inode, struct file *filp)
30183
30184 retcode = drm_open_helper(inode, filp, dev);
30185 if (!retcode) {
30186 - atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
30187 - if (!dev->open_count++)
30188 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
30189 + if (local_inc_return(&dev->open_count) == 1)
30190 retcode = drm_setup(dev);
30191 }
30192 if (!retcode) {
30193 @@ -482,7 +482,7 @@ int drm_release(struct inode *inode, struct file *filp)
30194
30195 mutex_lock(&drm_global_mutex);
30196
30197 - DRM_DEBUG("open_count = %d\n", dev->open_count);
30198 + DRM_DEBUG("open_count = %ld\n", local_read(&dev->open_count));
30199
30200 if (dev->driver->preclose)
30201 dev->driver->preclose(dev, file_priv);
30202 @@ -491,10 +491,10 @@ int drm_release(struct inode *inode, struct file *filp)
30203 * Begin inline drm_release
30204 */
30205
30206 - DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
30207 + DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %ld\n",
30208 task_pid_nr(current),
30209 (long)old_encode_dev(file_priv->minor->device),
30210 - dev->open_count);
30211 + local_read(&dev->open_count));
30212
30213 /* Release any auth tokens that might point to this file_priv,
30214 (do that under the drm_global_mutex) */
30215 @@ -584,8 +584,8 @@ int drm_release(struct inode *inode, struct file *filp)
30216 * End inline drm_release
30217 */
30218
30219 - atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
30220 - if (!--dev->open_count) {
30221 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
30222 + if (local_dec_and_test(&dev->open_count)) {
30223 if (atomic_read(&dev->ioctl_count)) {
30224 DRM_ERROR("Device busy: %d\n",
30225 atomic_read(&dev->ioctl_count));
30226 diff --git a/drivers/gpu/drm/drm_global.c b/drivers/gpu/drm/drm_global.c
30227 index c87dc96..326055d 100644
30228 --- a/drivers/gpu/drm/drm_global.c
30229 +++ b/drivers/gpu/drm/drm_global.c
30230 @@ -36,7 +36,7 @@
30231 struct drm_global_item {
30232 struct mutex mutex;
30233 void *object;
30234 - int refcount;
30235 + atomic_t refcount;
30236 };
30237
30238 static struct drm_global_item glob[DRM_GLOBAL_NUM];
30239 @@ -49,7 +49,7 @@ void drm_global_init(void)
30240 struct drm_global_item *item = &glob[i];
30241 mutex_init(&item->mutex);
30242 item->object = NULL;
30243 - item->refcount = 0;
30244 + atomic_set(&item->refcount, 0);
30245 }
30246 }
30247
30248 @@ -59,7 +59,7 @@ void drm_global_release(void)
30249 for (i = 0; i < DRM_GLOBAL_NUM; ++i) {
30250 struct drm_global_item *item = &glob[i];
30251 BUG_ON(item->object != NULL);
30252 - BUG_ON(item->refcount != 0);
30253 + BUG_ON(atomic_read(&item->refcount) != 0);
30254 }
30255 }
30256
30257 @@ -70,7 +70,7 @@ int drm_global_item_ref(struct drm_global_reference *ref)
30258 void *object;
30259
30260 mutex_lock(&item->mutex);
30261 - if (item->refcount == 0) {
30262 + if (atomic_read(&item->refcount) == 0) {
30263 item->object = kzalloc(ref->size, GFP_KERNEL);
30264 if (unlikely(item->object == NULL)) {
30265 ret = -ENOMEM;
30266 @@ -83,7 +83,7 @@ int drm_global_item_ref(struct drm_global_reference *ref)
30267 goto out_err;
30268
30269 }
30270 - ++item->refcount;
30271 + atomic_inc(&item->refcount);
30272 ref->object = item->object;
30273 object = item->object;
30274 mutex_unlock(&item->mutex);
30275 @@ -100,9 +100,9 @@ void drm_global_item_unref(struct drm_global_reference *ref)
30276 struct drm_global_item *item = &glob[ref->global_type];
30277
30278 mutex_lock(&item->mutex);
30279 - BUG_ON(item->refcount == 0);
30280 + BUG_ON(atomic_read(&item->refcount) == 0);
30281 BUG_ON(ref->object != item->object);
30282 - if (--item->refcount == 0) {
30283 + if (atomic_dec_and_test(&item->refcount)) {
30284 ref->release(ref);
30285 item->object = NULL;
30286 }
30287 diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
30288 index ab1162d..42587b2 100644
30289 --- a/drivers/gpu/drm/drm_info.c
30290 +++ b/drivers/gpu/drm/drm_info.c
30291 @@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void *data)
30292 struct drm_local_map *map;
30293 struct drm_map_list *r_list;
30294
30295 - /* Hardcoded from _DRM_FRAME_BUFFER,
30296 - _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
30297 - _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
30298 - const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
30299 + static const char * const types[] = {
30300 + [_DRM_FRAME_BUFFER] = "FB",
30301 + [_DRM_REGISTERS] = "REG",
30302 + [_DRM_SHM] = "SHM",
30303 + [_DRM_AGP] = "AGP",
30304 + [_DRM_SCATTER_GATHER] = "SG",
30305 + [_DRM_CONSISTENT] = "PCI",
30306 + [_DRM_GEM] = "GEM" };
30307 const char *type;
30308 int i;
30309
30310 @@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void *data)
30311 map = r_list->map;
30312 if (!map)
30313 continue;
30314 - if (map->type < 0 || map->type > 5)
30315 + if (map->type >= ARRAY_SIZE(types))
30316 type = "??";
30317 else
30318 type = types[map->type];
30319 @@ -290,7 +294,11 @@ int drm_vma_info(struct seq_file *m, void *data)
30320 vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
30321 vma->vm_flags & VM_LOCKED ? 'l' : '-',
30322 vma->vm_flags & VM_IO ? 'i' : '-',
30323 +#ifdef CONFIG_GRKERNSEC_HIDESYM
30324 + 0);
30325 +#else
30326 vma->vm_pgoff);
30327 +#endif
30328
30329 #if defined(__i386__)
30330 pgprot = pgprot_val(vma->vm_page_prot);
30331 diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
30332 index 637fcc3..e890b33 100644
30333 --- a/drivers/gpu/drm/drm_ioc32.c
30334 +++ b/drivers/gpu/drm/drm_ioc32.c
30335 @@ -457,7 +457,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd,
30336 request = compat_alloc_user_space(nbytes);
30337 if (!access_ok(VERIFY_WRITE, request, nbytes))
30338 return -EFAULT;
30339 - list = (struct drm_buf_desc *) (request + 1);
30340 + list = (struct drm_buf_desc __user *) (request + 1);
30341
30342 if (__put_user(count, &request->count)
30343 || __put_user(list, &request->list))
30344 @@ -518,7 +518,7 @@ static int compat_drm_mapbufs(struct file *file, unsigned int cmd,
30345 request = compat_alloc_user_space(nbytes);
30346 if (!access_ok(VERIFY_WRITE, request, nbytes))
30347 return -EFAULT;
30348 - list = (struct drm_buf_pub *) (request + 1);
30349 + list = (struct drm_buf_pub __user *) (request + 1);
30350
30351 if (__put_user(count, &request->count)
30352 || __put_user(list, &request->list))
30353 diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
30354 index 64a62c6..ceab35e 100644
30355 --- a/drivers/gpu/drm/drm_ioctl.c
30356 +++ b/drivers/gpu/drm/drm_ioctl.c
30357 @@ -252,7 +252,7 @@ int drm_getstats(struct drm_device *dev, void *data,
30358 stats->data[i].value =
30359 (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
30360 else
30361 - stats->data[i].value = atomic_read(&dev->counts[i]);
30362 + stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
30363 stats->data[i].type = dev->types[i];
30364 }
30365
30366 diff --git a/drivers/gpu/drm/drm_lock.c b/drivers/gpu/drm/drm_lock.c
30367 index 5211520..c744d85 100644
30368 --- a/drivers/gpu/drm/drm_lock.c
30369 +++ b/drivers/gpu/drm/drm_lock.c
30370 @@ -90,7 +90,7 @@ int drm_lock(struct drm_device *dev, void *data, struct drm_file *file_priv)
30371 if (drm_lock_take(&master->lock, lock->context)) {
30372 master->lock.file_priv = file_priv;
30373 master->lock.lock_time = jiffies;
30374 - atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
30375 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
30376 break; /* Got lock */
30377 }
30378
30379 @@ -161,7 +161,7 @@ int drm_unlock(struct drm_device *dev, void *data, struct drm_file *file_priv)
30380 return -EINVAL;
30381 }
30382
30383 - atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
30384 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
30385
30386 if (drm_lock_free(&master->lock, lock->context)) {
30387 /* FIXME: Should really bail out here. */
30388 diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
30389 index 21bcd4a..8e074e0 100644
30390 --- a/drivers/gpu/drm/drm_stub.c
30391 +++ b/drivers/gpu/drm/drm_stub.c
30392 @@ -511,7 +511,7 @@ void drm_unplug_dev(struct drm_device *dev)
30393
30394 drm_device_set_unplugged(dev);
30395
30396 - if (dev->open_count == 0) {
30397 + if (local_read(&dev->open_count) == 0) {
30398 drm_put_dev(dev);
30399 }
30400 mutex_unlock(&drm_global_mutex);
30401 diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
30402 index fa94391..ed26ec8 100644
30403 --- a/drivers/gpu/drm/i810/i810_dma.c
30404 +++ b/drivers/gpu/drm/i810/i810_dma.c
30405 @@ -943,8 +943,8 @@ static int i810_dma_vertex(struct drm_device *dev, void *data,
30406 dma->buflist[vertex->idx],
30407 vertex->discard, vertex->used);
30408
30409 - atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
30410 - atomic_inc(&dev->counts[_DRM_STAT_DMA]);
30411 + atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
30412 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
30413 sarea_priv->last_enqueue = dev_priv->counter - 1;
30414 sarea_priv->last_dispatch = (int)hw_status[5];
30415
30416 @@ -1104,8 +1104,8 @@ static int i810_dma_mc(struct drm_device *dev, void *data,
30417 i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
30418 mc->last_render);
30419
30420 - atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
30421 - atomic_inc(&dev->counts[_DRM_STAT_DMA]);
30422 + atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
30423 + atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
30424 sarea_priv->last_enqueue = dev_priv->counter - 1;
30425 sarea_priv->last_dispatch = (int)hw_status[5];
30426
30427 diff --git a/drivers/gpu/drm/i810/i810_drv.h b/drivers/gpu/drm/i810/i810_drv.h
30428 index c9339f4..f5e1b9d 100644
30429 --- a/drivers/gpu/drm/i810/i810_drv.h
30430 +++ b/drivers/gpu/drm/i810/i810_drv.h
30431 @@ -108,8 +108,8 @@ typedef struct drm_i810_private {
30432 int page_flipping;
30433
30434 wait_queue_head_t irq_queue;
30435 - atomic_t irq_received;
30436 - atomic_t irq_emitted;
30437 + atomic_unchecked_t irq_received;
30438 + atomic_unchecked_t irq_emitted;
30439
30440 int front_offset;
30441 } drm_i810_private_t;
30442 diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
30443 index 5363e9c..59360d1 100644
30444 --- a/drivers/gpu/drm/i915/i915_debugfs.c
30445 +++ b/drivers/gpu/drm/i915/i915_debugfs.c
30446 @@ -518,7 +518,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
30447 I915_READ(GTIMR));
30448 }
30449 seq_printf(m, "Interrupts received: %d\n",
30450 - atomic_read(&dev_priv->irq_received));
30451 + atomic_read_unchecked(&dev_priv->irq_received));
30452 for (i = 0; i < I915_NUM_RINGS; i++) {
30453 if (IS_GEN6(dev) || IS_GEN7(dev)) {
30454 seq_printf(m, "Graphics Interrupt mask (%s): %08x\n",
30455 diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
30456 index 36822b9..b725e1b 100644
30457 --- a/drivers/gpu/drm/i915/i915_dma.c
30458 +++ b/drivers/gpu/drm/i915/i915_dma.c
30459 @@ -1266,7 +1266,7 @@ static bool i915_switcheroo_can_switch(struct pci_dev *pdev)
30460 bool can_switch;
30461
30462 spin_lock(&dev->count_lock);
30463 - can_switch = (dev->open_count == 0);
30464 + can_switch = (local_read(&dev->open_count) == 0);
30465 spin_unlock(&dev->count_lock);
30466 return can_switch;
30467 }
30468 diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
30469 index b0b676a..d107105 100644
30470 --- a/drivers/gpu/drm/i915/i915_drv.h
30471 +++ b/drivers/gpu/drm/i915/i915_drv.h
30472 @@ -268,7 +268,7 @@ struct drm_i915_display_funcs {
30473 /* render clock increase/decrease */
30474 /* display clock increase/decrease */
30475 /* pll clock increase/decrease */
30476 -};
30477 +} __no_const;
30478
30479 struct intel_device_info {
30480 u8 gen;
30481 @@ -386,7 +386,7 @@ typedef struct drm_i915_private {
30482 int current_page;
30483 int page_flipping;
30484
30485 - atomic_t irq_received;
30486 + atomic_unchecked_t irq_received;
30487
30488 /* protects the irq masks */
30489 spinlock_t irq_lock;
30490 @@ -985,7 +985,7 @@ struct drm_i915_gem_object {
30491 * will be page flipped away on the next vblank. When it
30492 * reaches 0, dev_priv->pending_flip_queue will be woken up.
30493 */
30494 - atomic_t pending_flip;
30495 + atomic_unchecked_t pending_flip;
30496 };
30497
30498 #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
30499 @@ -1434,7 +1434,7 @@ extern struct i2c_adapter *intel_gmbus_get_adapter(
30500 struct drm_i915_private *dev_priv, unsigned port);
30501 extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed);
30502 extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit);
30503 -extern inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
30504 +static inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
30505 {
30506 return container_of(adapter, struct intel_gmbus, adapter)->force_bit;
30507 }
30508 diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
30509 index 974a9f1..b3ebd45 100644
30510 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
30511 +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
30512 @@ -189,7 +189,7 @@ i915_gem_object_set_to_gpu_domain(struct drm_i915_gem_object *obj,
30513 i915_gem_clflush_object(obj);
30514
30515 if (obj->base.pending_write_domain)
30516 - cd->flips |= atomic_read(&obj->pending_flip);
30517 + cd->flips |= atomic_read_unchecked(&obj->pending_flip);
30518
30519 /* The actual obj->write_domain will be updated with
30520 * pending_write_domain after we emit the accumulated flush for all
30521 @@ -916,9 +916,9 @@ i915_gem_check_execbuffer(struct drm_i915_gem_execbuffer2 *exec)
30522
30523 static int
30524 validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
30525 - int count)
30526 + unsigned int count)
30527 {
30528 - int i;
30529 + unsigned int i;
30530
30531 for (i = 0; i < count; i++) {
30532 char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
30533 diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
30534 index ed3224c..6618589 100644
30535 --- a/drivers/gpu/drm/i915/i915_irq.c
30536 +++ b/drivers/gpu/drm/i915/i915_irq.c
30537 @@ -433,7 +433,7 @@ static irqreturn_t valleyview_irq_handler(DRM_IRQ_ARGS)
30538 int vblank = 0;
30539 bool blc_event;
30540
30541 - atomic_inc(&dev_priv->irq_received);
30542 + atomic_inc_unchecked(&dev_priv->irq_received);
30543
30544 vblank_status = PIPE_START_VBLANK_INTERRUPT_STATUS |
30545 PIPE_VBLANK_INTERRUPT_STATUS;
30546 @@ -586,7 +586,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
30547 irqreturn_t ret = IRQ_NONE;
30548 int i;
30549
30550 - atomic_inc(&dev_priv->irq_received);
30551 + atomic_inc_unchecked(&dev_priv->irq_received);
30552
30553 /* disable master interrupt before clearing iir */
30554 de_ier = I915_READ(DEIER);
30555 @@ -661,7 +661,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS)
30556 u32 de_iir, gt_iir, de_ier, pch_iir, pm_iir;
30557 u32 hotplug_mask;
30558
30559 - atomic_inc(&dev_priv->irq_received);
30560 + atomic_inc_unchecked(&dev_priv->irq_received);
30561
30562 /* disable master interrupt before clearing iir */
30563 de_ier = I915_READ(DEIER);
30564 @@ -1646,7 +1646,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
30565 {
30566 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
30567
30568 - atomic_set(&dev_priv->irq_received, 0);
30569 + atomic_set_unchecked(&dev_priv->irq_received, 0);
30570
30571
30572 I915_WRITE(HWSTAM, 0xeffe);
30573 @@ -1673,7 +1673,7 @@ static void valleyview_irq_preinstall(struct drm_device *dev)
30574 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
30575 int pipe;
30576
30577 - atomic_set(&dev_priv->irq_received, 0);
30578 + atomic_set_unchecked(&dev_priv->irq_received, 0);
30579
30580 /* VLV magic */
30581 I915_WRITE(VLV_IMR, 0);
30582 @@ -1969,7 +1969,7 @@ static void i8xx_irq_preinstall(struct drm_device * dev)
30583 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
30584 int pipe;
30585
30586 - atomic_set(&dev_priv->irq_received, 0);
30587 + atomic_set_unchecked(&dev_priv->irq_received, 0);
30588
30589 for_each_pipe(pipe)
30590 I915_WRITE(PIPESTAT(pipe), 0);
30591 @@ -2020,7 +2020,7 @@ static irqreturn_t i8xx_irq_handler(DRM_IRQ_ARGS)
30592 I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |
30593 I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
30594
30595 - atomic_inc(&dev_priv->irq_received);
30596 + atomic_inc_unchecked(&dev_priv->irq_received);
30597
30598 iir = I915_READ16(IIR);
30599 if (iir == 0)
30600 @@ -2105,7 +2105,7 @@ static void i915_irq_preinstall(struct drm_device * dev)
30601 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
30602 int pipe;
30603
30604 - atomic_set(&dev_priv->irq_received, 0);
30605 + atomic_set_unchecked(&dev_priv->irq_received, 0);
30606
30607 if (I915_HAS_HOTPLUG(dev)) {
30608 I915_WRITE(PORT_HOTPLUG_EN, 0);
30609 @@ -2200,7 +2200,7 @@ static irqreturn_t i915_irq_handler(DRM_IRQ_ARGS)
30610 };
30611 int pipe, ret = IRQ_NONE;
30612
30613 - atomic_inc(&dev_priv->irq_received);
30614 + atomic_inc_unchecked(&dev_priv->irq_received);
30615
30616 iir = I915_READ(IIR);
30617 do {
30618 @@ -2326,7 +2326,7 @@ static void i965_irq_preinstall(struct drm_device * dev)
30619 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
30620 int pipe;
30621
30622 - atomic_set(&dev_priv->irq_received, 0);
30623 + atomic_set_unchecked(&dev_priv->irq_received, 0);
30624
30625 if (I915_HAS_HOTPLUG(dev)) {
30626 I915_WRITE(PORT_HOTPLUG_EN, 0);
30627 @@ -2436,7 +2436,7 @@ static irqreturn_t i965_irq_handler(DRM_IRQ_ARGS)
30628 int irq_received;
30629 int ret = IRQ_NONE, pipe;
30630
30631 - atomic_inc(&dev_priv->irq_received);
30632 + atomic_inc_unchecked(&dev_priv->irq_received);
30633
30634 iir = I915_READ(IIR);
30635
30636 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
30637 index 8a11131..46eeeaa 100644
30638 --- a/drivers/gpu/drm/i915/intel_display.c
30639 +++ b/drivers/gpu/drm/i915/intel_display.c
30640 @@ -2000,7 +2000,7 @@ intel_finish_fb(struct drm_framebuffer *old_fb)
30641
30642 wait_event(dev_priv->pending_flip_queue,
30643 atomic_read(&dev_priv->mm.wedged) ||
30644 - atomic_read(&obj->pending_flip) == 0);
30645 + atomic_read_unchecked(&obj->pending_flip) == 0);
30646
30647 /* Big Hammer, we also need to ensure that any pending
30648 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
30649 @@ -5914,9 +5914,8 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
30650
30651 obj = work->old_fb_obj;
30652
30653 - atomic_clear_mask(1 << intel_crtc->plane,
30654 - &obj->pending_flip.counter);
30655 - if (atomic_read(&obj->pending_flip) == 0)
30656 + atomic_clear_mask_unchecked(1 << intel_crtc->plane, &obj->pending_flip);
30657 + if (atomic_read_unchecked(&obj->pending_flip) == 0)
30658 wake_up(&dev_priv->pending_flip_queue);
30659
30660 schedule_work(&work->work);
30661 @@ -6253,7 +6252,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
30662 /* Block clients from rendering to the new back buffer until
30663 * the flip occurs and the object is no longer visible.
30664 */
30665 - atomic_add(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
30666 + atomic_add_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
30667
30668 ret = dev_priv->display.queue_flip(dev, crtc, fb, obj);
30669 if (ret)
30670 @@ -6268,7 +6267,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
30671 return 0;
30672
30673 cleanup_pending:
30674 - atomic_sub(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
30675 + atomic_sub_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
30676 drm_gem_object_unreference(&work->old_fb_obj->base);
30677 drm_gem_object_unreference(&obj->base);
30678 mutex_unlock(&dev->struct_mutex);
30679 diff --git a/drivers/gpu/drm/mga/mga_drv.h b/drivers/gpu/drm/mga/mga_drv.h
30680 index 54558a0..2d97005 100644
30681 --- a/drivers/gpu/drm/mga/mga_drv.h
30682 +++ b/drivers/gpu/drm/mga/mga_drv.h
30683 @@ -120,9 +120,9 @@ typedef struct drm_mga_private {
30684 u32 clear_cmd;
30685 u32 maccess;
30686
30687 - atomic_t vbl_received; /**< Number of vblanks received. */
30688 + atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
30689 wait_queue_head_t fence_queue;
30690 - atomic_t last_fence_retired;
30691 + atomic_unchecked_t last_fence_retired;
30692 u32 next_fence_to_post;
30693
30694 unsigned int fb_cpp;
30695 diff --git a/drivers/gpu/drm/mga/mga_irq.c b/drivers/gpu/drm/mga/mga_irq.c
30696 index 2581202..f230a8d9 100644
30697 --- a/drivers/gpu/drm/mga/mga_irq.c
30698 +++ b/drivers/gpu/drm/mga/mga_irq.c
30699 @@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_device *dev, int crtc)
30700 if (crtc != 0)
30701 return 0;
30702
30703 - return atomic_read(&dev_priv->vbl_received);
30704 + return atomic_read_unchecked(&dev_priv->vbl_received);
30705 }
30706
30707
30708 @@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_IRQ_ARGS)
30709 /* VBLANK interrupt */
30710 if (status & MGA_VLINEPEN) {
30711 MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
30712 - atomic_inc(&dev_priv->vbl_received);
30713 + atomic_inc_unchecked(&dev_priv->vbl_received);
30714 drm_handle_vblank(dev, 0);
30715 handled = 1;
30716 }
30717 @@ -79,7 +79,7 @@ irqreturn_t mga_driver_irq_handler(DRM_IRQ_ARGS)
30718 if ((prim_start & ~0x03) != (prim_end & ~0x03))
30719 MGA_WRITE(MGA_PRIMEND, prim_end);
30720
30721 - atomic_inc(&dev_priv->last_fence_retired);
30722 + atomic_inc_unchecked(&dev_priv->last_fence_retired);
30723 DRM_WAKEUP(&dev_priv->fence_queue);
30724 handled = 1;
30725 }
30726 @@ -130,7 +130,7 @@ int mga_driver_fence_wait(struct drm_device *dev, unsigned int *sequence)
30727 * using fences.
30728 */
30729 DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
30730 - (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
30731 + (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
30732 - *sequence) <= (1 << 23)));
30733
30734 *sequence = cur_fence;
30735 diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
30736 index 2f11e16..191267e 100644
30737 --- a/drivers/gpu/drm/nouveau/nouveau_bios.c
30738 +++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
30739 @@ -5340,7 +5340,7 @@ parse_bit_U_tbl_entry(struct drm_device *dev, struct nvbios *bios,
30740 struct bit_table {
30741 const char id;
30742 int (* const parse_fn)(struct drm_device *, struct nvbios *, struct bit_entry *);
30743 -};
30744 +} __no_const;
30745
30746 #define BIT_TABLE(id, funcid) ((struct bit_table){ id, parse_bit_##funcid##_tbl_entry })
30747
30748 diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
30749 index b863a3a..c55e0dc 100644
30750 --- a/drivers/gpu/drm/nouveau/nouveau_drv.h
30751 +++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
30752 @@ -302,7 +302,7 @@ struct nouveau_exec_engine {
30753 u32 handle, u16 class);
30754 void (*set_tile_region)(struct drm_device *dev, int i);
30755 void (*tlb_flush)(struct drm_device *, int engine);
30756 -};
30757 +} __no_const;
30758
30759 struct nouveau_instmem_engine {
30760 void *priv;
30761 @@ -324,13 +324,13 @@ struct nouveau_instmem_engine {
30762 struct nouveau_mc_engine {
30763 int (*init)(struct drm_device *dev);
30764 void (*takedown)(struct drm_device *dev);
30765 -};
30766 +} __no_const;
30767
30768 struct nouveau_timer_engine {
30769 int (*init)(struct drm_device *dev);
30770 void (*takedown)(struct drm_device *dev);
30771 uint64_t (*read)(struct drm_device *dev);
30772 -};
30773 +} __no_const;
30774
30775 struct nouveau_fb_engine {
30776 int num_tiles;
30777 @@ -547,7 +547,7 @@ struct nouveau_vram_engine {
30778 void (*put)(struct drm_device *, struct nouveau_mem **);
30779
30780 bool (*flags_valid)(struct drm_device *, u32 tile_flags);
30781 -};
30782 +} __no_const;
30783
30784 struct nouveau_engine {
30785 struct nouveau_instmem_engine instmem;
30786 @@ -693,7 +693,7 @@ struct drm_nouveau_private {
30787 struct drm_global_reference mem_global_ref;
30788 struct ttm_bo_global_ref bo_global_ref;
30789 struct ttm_bo_device bdev;
30790 - atomic_t validate_sequence;
30791 + atomic_unchecked_t validate_sequence;
30792 int (*move)(struct nouveau_channel *,
30793 struct ttm_buffer_object *,
30794 struct ttm_mem_reg *, struct ttm_mem_reg *);
30795 diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
30796 index 30f5423..abca136 100644
30797 --- a/drivers/gpu/drm/nouveau/nouveau_gem.c
30798 +++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
30799 @@ -319,7 +319,7 @@ validate_init(struct nouveau_channel *chan, struct drm_file *file_priv,
30800 int trycnt = 0;
30801 int ret, i;
30802
30803 - sequence = atomic_add_return(1, &dev_priv->ttm.validate_sequence);
30804 + sequence = atomic_add_return_unchecked(1, &dev_priv->ttm.validate_sequence);
30805 retry:
30806 if (++trycnt > 100000) {
30807 NV_ERROR(dev, "%s failed and gave up.\n", __func__);
30808 diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
30809 index 19706f0..f257368 100644
30810 --- a/drivers/gpu/drm/nouveau/nouveau_state.c
30811 +++ b/drivers/gpu/drm/nouveau/nouveau_state.c
30812 @@ -490,7 +490,7 @@ static bool nouveau_switcheroo_can_switch(struct pci_dev *pdev)
30813 bool can_switch;
30814
30815 spin_lock(&dev->count_lock);
30816 - can_switch = (dev->open_count == 0);
30817 + can_switch = (local_read(&dev->open_count) == 0);
30818 spin_unlock(&dev->count_lock);
30819 return can_switch;
30820 }
30821 diff --git a/drivers/gpu/drm/nouveau/nv50_sor.c b/drivers/gpu/drm/nouveau/nv50_sor.c
30822 index a9514ea..369d511 100644
30823 --- a/drivers/gpu/drm/nouveau/nv50_sor.c
30824 +++ b/drivers/gpu/drm/nouveau/nv50_sor.c
30825 @@ -304,7 +304,7 @@ nv50_sor_dpms(struct drm_encoder *encoder, int mode)
30826 }
30827
30828 if (nv_encoder->dcb->type == OUTPUT_DP) {
30829 - struct dp_train_func func = {
30830 + static struct dp_train_func func = {
30831 .link_set = nv50_sor_dp_link_set,
30832 .train_set = nv50_sor_dp_train_set,
30833 .train_adj = nv50_sor_dp_train_adj
30834 diff --git a/drivers/gpu/drm/nouveau/nvd0_display.c b/drivers/gpu/drm/nouveau/nvd0_display.c
30835 index c50b075..6b07dfc 100644
30836 --- a/drivers/gpu/drm/nouveau/nvd0_display.c
30837 +++ b/drivers/gpu/drm/nouveau/nvd0_display.c
30838 @@ -1366,7 +1366,7 @@ nvd0_sor_dpms(struct drm_encoder *encoder, int mode)
30839 nv_wait(dev, 0x61c030 + (or * 0x0800), 0x10000000, 0x00000000);
30840
30841 if (nv_encoder->dcb->type == OUTPUT_DP) {
30842 - struct dp_train_func func = {
30843 + static struct dp_train_func func = {
30844 .link_set = nvd0_sor_dp_link_set,
30845 .train_set = nvd0_sor_dp_train_set,
30846 .train_adj = nvd0_sor_dp_train_adj
30847 diff --git a/drivers/gpu/drm/r128/r128_cce.c b/drivers/gpu/drm/r128/r128_cce.c
30848 index bcac90b..53bfc76 100644
30849 --- a/drivers/gpu/drm/r128/r128_cce.c
30850 +++ b/drivers/gpu/drm/r128/r128_cce.c
30851 @@ -378,7 +378,7 @@ static int r128_do_init_cce(struct drm_device *dev, drm_r128_init_t *init)
30852
30853 /* GH: Simple idle check.
30854 */
30855 - atomic_set(&dev_priv->idle_count, 0);
30856 + atomic_set_unchecked(&dev_priv->idle_count, 0);
30857
30858 /* We don't support anything other than bus-mastering ring mode,
30859 * but the ring can be in either AGP or PCI space for the ring
30860 diff --git a/drivers/gpu/drm/r128/r128_drv.h b/drivers/gpu/drm/r128/r128_drv.h
30861 index 930c71b..499aded 100644
30862 --- a/drivers/gpu/drm/r128/r128_drv.h
30863 +++ b/drivers/gpu/drm/r128/r128_drv.h
30864 @@ -90,14 +90,14 @@ typedef struct drm_r128_private {
30865 int is_pci;
30866 unsigned long cce_buffers_offset;
30867
30868 - atomic_t idle_count;
30869 + atomic_unchecked_t idle_count;
30870
30871 int page_flipping;
30872 int current_page;
30873 u32 crtc_offset;
30874 u32 crtc_offset_cntl;
30875
30876 - atomic_t vbl_received;
30877 + atomic_unchecked_t vbl_received;
30878
30879 u32 color_fmt;
30880 unsigned int front_offset;
30881 diff --git a/drivers/gpu/drm/r128/r128_irq.c b/drivers/gpu/drm/r128/r128_irq.c
30882 index 429d5a0..7e899ed 100644
30883 --- a/drivers/gpu/drm/r128/r128_irq.c
30884 +++ b/drivers/gpu/drm/r128/r128_irq.c
30885 @@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_device *dev, int crtc)
30886 if (crtc != 0)
30887 return 0;
30888
30889 - return atomic_read(&dev_priv->vbl_received);
30890 + return atomic_read_unchecked(&dev_priv->vbl_received);
30891 }
30892
30893 irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
30894 @@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
30895 /* VBLANK interrupt */
30896 if (status & R128_CRTC_VBLANK_INT) {
30897 R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
30898 - atomic_inc(&dev_priv->vbl_received);
30899 + atomic_inc_unchecked(&dev_priv->vbl_received);
30900 drm_handle_vblank(dev, 0);
30901 return IRQ_HANDLED;
30902 }
30903 diff --git a/drivers/gpu/drm/r128/r128_state.c b/drivers/gpu/drm/r128/r128_state.c
30904 index a9e33ce..09edd4b 100644
30905 --- a/drivers/gpu/drm/r128/r128_state.c
30906 +++ b/drivers/gpu/drm/r128/r128_state.c
30907 @@ -321,10 +321,10 @@ static void r128_clear_box(drm_r128_private_t *dev_priv,
30908
30909 static void r128_cce_performance_boxes(drm_r128_private_t *dev_priv)
30910 {
30911 - if (atomic_read(&dev_priv->idle_count) == 0)
30912 + if (atomic_read_unchecked(&dev_priv->idle_count) == 0)
30913 r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
30914 else
30915 - atomic_set(&dev_priv->idle_count, 0);
30916 + atomic_set_unchecked(&dev_priv->idle_count, 0);
30917 }
30918
30919 #endif
30920 diff --git a/drivers/gpu/drm/radeon/mkregtable.c b/drivers/gpu/drm/radeon/mkregtable.c
30921 index 5a82b6b..9e69c73 100644
30922 --- a/drivers/gpu/drm/radeon/mkregtable.c
30923 +++ b/drivers/gpu/drm/radeon/mkregtable.c
30924 @@ -637,14 +637,14 @@ static int parser_auth(struct table *t, const char *filename)
30925 regex_t mask_rex;
30926 regmatch_t match[4];
30927 char buf[1024];
30928 - size_t end;
30929 + long end;
30930 int len;
30931 int done = 0;
30932 int r;
30933 unsigned o;
30934 struct offset *offset;
30935 char last_reg_s[10];
30936 - int last_reg;
30937 + unsigned long last_reg;
30938
30939 if (regcomp
30940 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
30941 diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
30942 index fefcca5..20a5b90 100644
30943 --- a/drivers/gpu/drm/radeon/radeon.h
30944 +++ b/drivers/gpu/drm/radeon/radeon.h
30945 @@ -743,7 +743,7 @@ struct r600_blit_cp_primitives {
30946 int x2, int y2);
30947 void (*draw_auto)(struct radeon_device *rdev);
30948 void (*set_default_state)(struct radeon_device *rdev);
30949 -};
30950 +} __no_const;
30951
30952 struct r600_blit {
30953 struct radeon_bo *shader_obj;
30954 @@ -1244,7 +1244,7 @@ struct radeon_asic {
30955 u32 (*page_flip)(struct radeon_device *rdev, int crtc, u64 crtc_base);
30956 void (*post_page_flip)(struct radeon_device *rdev, int crtc);
30957 } pflip;
30958 -};
30959 +} __no_const;
30960
30961 /*
30962 * Asic structures
30963 diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
30964 index 066c98b..96ab858 100644
30965 --- a/drivers/gpu/drm/radeon/radeon_device.c
30966 +++ b/drivers/gpu/drm/radeon/radeon_device.c
30967 @@ -692,7 +692,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev)
30968 bool can_switch;
30969
30970 spin_lock(&dev->count_lock);
30971 - can_switch = (dev->open_count == 0);
30972 + can_switch = (local_read(&dev->open_count) == 0);
30973 spin_unlock(&dev->count_lock);
30974 return can_switch;
30975 }
30976 diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
30977 index a1b59ca..86f2d44 100644
30978 --- a/drivers/gpu/drm/radeon/radeon_drv.h
30979 +++ b/drivers/gpu/drm/radeon/radeon_drv.h
30980 @@ -255,7 +255,7 @@ typedef struct drm_radeon_private {
30981
30982 /* SW interrupt */
30983 wait_queue_head_t swi_queue;
30984 - atomic_t swi_emitted;
30985 + atomic_unchecked_t swi_emitted;
30986 int vblank_crtc;
30987 uint32_t irq_enable_reg;
30988 uint32_t r500_disp_irq_reg;
30989 diff --git a/drivers/gpu/drm/radeon/radeon_ioc32.c b/drivers/gpu/drm/radeon/radeon_ioc32.c
30990 index 48b7cea..342236f 100644
30991 --- a/drivers/gpu/drm/radeon/radeon_ioc32.c
30992 +++ b/drivers/gpu/drm/radeon/radeon_ioc32.c
30993 @@ -359,7 +359,7 @@ static int compat_radeon_cp_setparam(struct file *file, unsigned int cmd,
30994 request = compat_alloc_user_space(sizeof(*request));
30995 if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
30996 || __put_user(req32.param, &request->param)
30997 - || __put_user((void __user *)(unsigned long)req32.value,
30998 + || __put_user((unsigned long)req32.value,
30999 &request->value))
31000 return -EFAULT;
31001
31002 diff --git a/drivers/gpu/drm/radeon/radeon_irq.c b/drivers/gpu/drm/radeon/radeon_irq.c
31003 index 00da384..32f972d 100644
31004 --- a/drivers/gpu/drm/radeon/radeon_irq.c
31005 +++ b/drivers/gpu/drm/radeon/radeon_irq.c
31006 @@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_device * dev)
31007 unsigned int ret;
31008 RING_LOCALS;
31009
31010 - atomic_inc(&dev_priv->swi_emitted);
31011 - ret = atomic_read(&dev_priv->swi_emitted);
31012 + atomic_inc_unchecked(&dev_priv->swi_emitted);
31013 + ret = atomic_read_unchecked(&dev_priv->swi_emitted);
31014
31015 BEGIN_RING(4);
31016 OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
31017 @@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct drm_device *dev)
31018 drm_radeon_private_t *dev_priv =
31019 (drm_radeon_private_t *) dev->dev_private;
31020
31021 - atomic_set(&dev_priv->swi_emitted, 0);
31022 + atomic_set_unchecked(&dev_priv->swi_emitted, 0);
31023 DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
31024
31025 dev->max_vblank_count = 0x001fffff;
31026 diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
31027 index e8422ae..d22d4a8 100644
31028 --- a/drivers/gpu/drm/radeon/radeon_state.c
31029 +++ b/drivers/gpu/drm/radeon/radeon_state.c
31030 @@ -2168,7 +2168,7 @@ static int radeon_cp_clear(struct drm_device *dev, void *data, struct drm_file *
31031 if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS)
31032 sarea_priv->nbox = RADEON_NR_SAREA_CLIPRECTS;
31033
31034 - if (DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
31035 + if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS || DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
31036 sarea_priv->nbox * sizeof(depth_boxes[0])))
31037 return -EFAULT;
31038
31039 @@ -3031,7 +3031,7 @@ static int radeon_cp_getparam(struct drm_device *dev, void *data, struct drm_fil
31040 {
31041 drm_radeon_private_t *dev_priv = dev->dev_private;
31042 drm_radeon_getparam_t *param = data;
31043 - int value;
31044 + int value = 0;
31045
31046 DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
31047
31048 diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
31049 index c94a225..5795d34 100644
31050 --- a/drivers/gpu/drm/radeon/radeon_ttm.c
31051 +++ b/drivers/gpu/drm/radeon/radeon_ttm.c
31052 @@ -852,8 +852,10 @@ int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
31053 }
31054 if (unlikely(ttm_vm_ops == NULL)) {
31055 ttm_vm_ops = vma->vm_ops;
31056 - radeon_ttm_vm_ops = *ttm_vm_ops;
31057 - radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
31058 + pax_open_kernel();
31059 + memcpy((void *)&radeon_ttm_vm_ops, ttm_vm_ops, sizeof(radeon_ttm_vm_ops));
31060 + *(void **)&radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
31061 + pax_close_kernel();
31062 }
31063 vma->vm_ops = &radeon_ttm_vm_ops;
31064 return 0;
31065 diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
31066 index 159b6a4..fa82487 100644
31067 --- a/drivers/gpu/drm/radeon/rs690.c
31068 +++ b/drivers/gpu/drm/radeon/rs690.c
31069 @@ -304,9 +304,11 @@ void rs690_crtc_bandwidth_compute(struct radeon_device *rdev,
31070 if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
31071 rdev->pm.sideport_bandwidth.full)
31072 rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
31073 - read_delay_latency.full = dfixed_const(370 * 800 * 1000);
31074 + read_delay_latency.full = dfixed_const(800 * 1000);
31075 read_delay_latency.full = dfixed_div(read_delay_latency,
31076 rdev->pm.igp_sideport_mclk);
31077 + a.full = dfixed_const(370);
31078 + read_delay_latency.full = dfixed_mul(read_delay_latency, a);
31079 } else {
31080 if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
31081 rdev->pm.k8_bandwidth.full)
31082 diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
31083 index ebc6fac..a8313ed 100644
31084 --- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
31085 +++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
31086 @@ -394,9 +394,9 @@ static int ttm_pool_get_num_unused_pages(void)
31087 static int ttm_pool_mm_shrink(struct shrinker *shrink,
31088 struct shrink_control *sc)
31089 {
31090 - static atomic_t start_pool = ATOMIC_INIT(0);
31091 + static atomic_unchecked_t start_pool = ATOMIC_INIT(0);
31092 unsigned i;
31093 - unsigned pool_offset = atomic_add_return(1, &start_pool);
31094 + unsigned pool_offset = atomic_add_return_unchecked(1, &start_pool);
31095 struct ttm_page_pool *pool;
31096 int shrink_pages = sc->nr_to_scan;
31097
31098 diff --git a/drivers/gpu/drm/via/via_drv.h b/drivers/gpu/drm/via/via_drv.h
31099 index 88edacc..1e5412b 100644
31100 --- a/drivers/gpu/drm/via/via_drv.h
31101 +++ b/drivers/gpu/drm/via/via_drv.h
31102 @@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
31103 typedef uint32_t maskarray_t[5];
31104
31105 typedef struct drm_via_irq {
31106 - atomic_t irq_received;
31107 + atomic_unchecked_t irq_received;
31108 uint32_t pending_mask;
31109 uint32_t enable_mask;
31110 wait_queue_head_t irq_queue;
31111 @@ -75,7 +75,7 @@ typedef struct drm_via_private {
31112 struct timeval last_vblank;
31113 int last_vblank_valid;
31114 unsigned usec_per_vblank;
31115 - atomic_t vbl_received;
31116 + atomic_unchecked_t vbl_received;
31117 drm_via_state_t hc_state;
31118 char pci_buf[VIA_PCI_BUF_SIZE];
31119 const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
31120 diff --git a/drivers/gpu/drm/via/via_irq.c b/drivers/gpu/drm/via/via_irq.c
31121 index d391f48..10c8ca3 100644
31122 --- a/drivers/gpu/drm/via/via_irq.c
31123 +++ b/drivers/gpu/drm/via/via_irq.c
31124 @@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_device *dev, int crtc)
31125 if (crtc != 0)
31126 return 0;
31127
31128 - return atomic_read(&dev_priv->vbl_received);
31129 + return atomic_read_unchecked(&dev_priv->vbl_received);
31130 }
31131
31132 irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
31133 @@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
31134
31135 status = VIA_READ(VIA_REG_INTERRUPT);
31136 if (status & VIA_IRQ_VBLANK_PENDING) {
31137 - atomic_inc(&dev_priv->vbl_received);
31138 - if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
31139 + atomic_inc_unchecked(&dev_priv->vbl_received);
31140 + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
31141 do_gettimeofday(&cur_vblank);
31142 if (dev_priv->last_vblank_valid) {
31143 dev_priv->usec_per_vblank =
31144 @@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
31145 dev_priv->last_vblank = cur_vblank;
31146 dev_priv->last_vblank_valid = 1;
31147 }
31148 - if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
31149 + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
31150 DRM_DEBUG("US per vblank is: %u\n",
31151 dev_priv->usec_per_vblank);
31152 }
31153 @@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
31154
31155 for (i = 0; i < dev_priv->num_irqs; ++i) {
31156 if (status & cur_irq->pending_mask) {
31157 - atomic_inc(&cur_irq->irq_received);
31158 + atomic_inc_unchecked(&cur_irq->irq_received);
31159 DRM_WAKEUP(&cur_irq->irq_queue);
31160 handled = 1;
31161 if (dev_priv->irq_map[drm_via_irq_dma0_td] == i)
31162 @@ -243,11 +243,11 @@ via_driver_irq_wait(struct drm_device *dev, unsigned int irq, int force_sequence
31163 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
31164 ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
31165 masks[irq][4]));
31166 - cur_irq_sequence = atomic_read(&cur_irq->irq_received);
31167 + cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
31168 } else {
31169 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
31170 (((cur_irq_sequence =
31171 - atomic_read(&cur_irq->irq_received)) -
31172 + atomic_read_unchecked(&cur_irq->irq_received)) -
31173 *sequence) <= (1 << 23)));
31174 }
31175 *sequence = cur_irq_sequence;
31176 @@ -285,7 +285,7 @@ void via_driver_irq_preinstall(struct drm_device *dev)
31177 }
31178
31179 for (i = 0; i < dev_priv->num_irqs; ++i) {
31180 - atomic_set(&cur_irq->irq_received, 0);
31181 + atomic_set_unchecked(&cur_irq->irq_received, 0);
31182 cur_irq->enable_mask = dev_priv->irq_masks[i][0];
31183 cur_irq->pending_mask = dev_priv->irq_masks[i][1];
31184 DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
31185 @@ -367,7 +367,7 @@ int via_wait_irq(struct drm_device *dev, void *data, struct drm_file *file_priv)
31186 switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
31187 case VIA_IRQ_RELATIVE:
31188 irqwait->request.sequence +=
31189 - atomic_read(&cur_irq->irq_received);
31190 + atomic_read_unchecked(&cur_irq->irq_received);
31191 irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
31192 case VIA_IRQ_ABSOLUTE:
31193 break;
31194 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
31195 index d0f2c07..9ebd9c3 100644
31196 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
31197 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
31198 @@ -263,7 +263,7 @@ struct vmw_private {
31199 * Fencing and IRQs.
31200 */
31201
31202 - atomic_t marker_seq;
31203 + atomic_unchecked_t marker_seq;
31204 wait_queue_head_t fence_queue;
31205 wait_queue_head_t fifo_queue;
31206 int fence_queue_waiters; /* Protected by hw_mutex */
31207 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
31208 index a0c2f12..68ae6cb 100644
31209 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
31210 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
31211 @@ -137,7 +137,7 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
31212 (unsigned int) min,
31213 (unsigned int) fifo->capabilities);
31214
31215 - atomic_set(&dev_priv->marker_seq, dev_priv->last_read_seqno);
31216 + atomic_set_unchecked(&dev_priv->marker_seq, dev_priv->last_read_seqno);
31217 iowrite32(dev_priv->last_read_seqno, fifo_mem + SVGA_FIFO_FENCE);
31218 vmw_marker_queue_init(&fifo->marker_queue);
31219 return vmw_fifo_send_fence(dev_priv, &dummy);
31220 @@ -355,7 +355,7 @@ void *vmw_fifo_reserve(struct vmw_private *dev_priv, uint32_t bytes)
31221 if (reserveable)
31222 iowrite32(bytes, fifo_mem +
31223 SVGA_FIFO_RESERVED);
31224 - return fifo_mem + (next_cmd >> 2);
31225 + return (__le32 __force_kernel *)fifo_mem + (next_cmd >> 2);
31226 } else {
31227 need_bounce = true;
31228 }
31229 @@ -475,7 +475,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *seqno)
31230
31231 fm = vmw_fifo_reserve(dev_priv, bytes);
31232 if (unlikely(fm == NULL)) {
31233 - *seqno = atomic_read(&dev_priv->marker_seq);
31234 + *seqno = atomic_read_unchecked(&dev_priv->marker_seq);
31235 ret = -ENOMEM;
31236 (void)vmw_fallback_wait(dev_priv, false, true, *seqno,
31237 false, 3*HZ);
31238 @@ -483,7 +483,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *seqno)
31239 }
31240
31241 do {
31242 - *seqno = atomic_add_return(1, &dev_priv->marker_seq);
31243 + *seqno = atomic_add_return_unchecked(1, &dev_priv->marker_seq);
31244 } while (*seqno == 0);
31245
31246 if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
31247 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
31248 index cabc95f..14b3d77 100644
31249 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
31250 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
31251 @@ -107,7 +107,7 @@ bool vmw_seqno_passed(struct vmw_private *dev_priv,
31252 * emitted. Then the fence is stale and signaled.
31253 */
31254
31255 - ret = ((atomic_read(&dev_priv->marker_seq) - seqno)
31256 + ret = ((atomic_read_unchecked(&dev_priv->marker_seq) - seqno)
31257 > VMW_FENCE_WRAP);
31258
31259 return ret;
31260 @@ -138,7 +138,7 @@ int vmw_fallback_wait(struct vmw_private *dev_priv,
31261
31262 if (fifo_idle)
31263 down_read(&fifo_state->rwsem);
31264 - signal_seq = atomic_read(&dev_priv->marker_seq);
31265 + signal_seq = atomic_read_unchecked(&dev_priv->marker_seq);
31266 ret = 0;
31267
31268 for (;;) {
31269 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_marker.c b/drivers/gpu/drm/vmwgfx/vmwgfx_marker.c
31270 index 8a8725c..afed796 100644
31271 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_marker.c
31272 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_marker.c
31273 @@ -151,7 +151,7 @@ int vmw_wait_lag(struct vmw_private *dev_priv,
31274 while (!vmw_lag_lt(queue, us)) {
31275 spin_lock(&queue->lock);
31276 if (list_empty(&queue->head))
31277 - seqno = atomic_read(&dev_priv->marker_seq);
31278 + seqno = atomic_read_unchecked(&dev_priv->marker_seq);
31279 else {
31280 marker = list_first_entry(&queue->head,
31281 struct vmw_marker, head);
31282 diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
31283 index 1f6957c..b579481 100644
31284 --- a/drivers/hid/hid-core.c
31285 +++ b/drivers/hid/hid-core.c
31286 @@ -2153,7 +2153,7 @@ static bool hid_ignore(struct hid_device *hdev)
31287
31288 int hid_add_device(struct hid_device *hdev)
31289 {
31290 - static atomic_t id = ATOMIC_INIT(0);
31291 + static atomic_unchecked_t id = ATOMIC_INIT(0);
31292 int ret;
31293
31294 if (WARN_ON(hdev->status & HID_STAT_ADDED))
31295 @@ -2188,7 +2188,7 @@ int hid_add_device(struct hid_device *hdev)
31296 /* XXX hack, any other cleaner solution after the driver core
31297 * is converted to allow more than 20 bytes as the device name? */
31298 dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
31299 - hdev->vendor, hdev->product, atomic_inc_return(&id));
31300 + hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
31301
31302 hid_debug_register(hdev, dev_name(&hdev->dev));
31303 ret = device_add(&hdev->dev);
31304 diff --git a/drivers/hid/hid-wiimote-debug.c b/drivers/hid/hid-wiimote-debug.c
31305 index eec3291..8ed706b 100644
31306 --- a/drivers/hid/hid-wiimote-debug.c
31307 +++ b/drivers/hid/hid-wiimote-debug.c
31308 @@ -66,7 +66,7 @@ static ssize_t wiidebug_eeprom_read(struct file *f, char __user *u, size_t s,
31309 else if (size == 0)
31310 return -EIO;
31311
31312 - if (copy_to_user(u, buf, size))
31313 + if (size > sizeof(buf) || copy_to_user(u, buf, size))
31314 return -EFAULT;
31315
31316 *off += size;
31317 diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
31318 index 14599e2..711c965 100644
31319 --- a/drivers/hid/usbhid/hiddev.c
31320 +++ b/drivers/hid/usbhid/hiddev.c
31321 @@ -625,7 +625,7 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
31322 break;
31323
31324 case HIDIOCAPPLICATION:
31325 - if (arg < 0 || arg >= hid->maxapplication)
31326 + if (arg >= hid->maxapplication)
31327 break;
31328
31329 for (i = 0; i < hid->maxcollection; i++)
31330 diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
31331 index 4065374..10ed7dc 100644
31332 --- a/drivers/hv/channel.c
31333 +++ b/drivers/hv/channel.c
31334 @@ -400,8 +400,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
31335 int ret = 0;
31336 int t;
31337
31338 - next_gpadl_handle = atomic_read(&vmbus_connection.next_gpadl_handle);
31339 - atomic_inc(&vmbus_connection.next_gpadl_handle);
31340 + next_gpadl_handle = atomic_read_unchecked(&vmbus_connection.next_gpadl_handle);
31341 + atomic_inc_unchecked(&vmbus_connection.next_gpadl_handle);
31342
31343 ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount);
31344 if (ret)
31345 diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
31346 index 86f8885..ab9cb2b 100644
31347 --- a/drivers/hv/hv.c
31348 +++ b/drivers/hv/hv.c
31349 @@ -132,7 +132,7 @@ static u64 do_hypercall(u64 control, void *input, void *output)
31350 u64 output_address = (output) ? virt_to_phys(output) : 0;
31351 u32 output_address_hi = output_address >> 32;
31352 u32 output_address_lo = output_address & 0xFFFFFFFF;
31353 - void *hypercall_page = hv_context.hypercall_page;
31354 + void *hypercall_page = ktva_ktla(hv_context.hypercall_page);
31355
31356 __asm__ __volatile__ ("call *%8" : "=d"(hv_status_hi),
31357 "=a"(hv_status_lo) : "d" (control_hi),
31358 diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
31359 index b9426a6..677ce34 100644
31360 --- a/drivers/hv/hyperv_vmbus.h
31361 +++ b/drivers/hv/hyperv_vmbus.h
31362 @@ -555,7 +555,7 @@ enum vmbus_connect_state {
31363 struct vmbus_connection {
31364 enum vmbus_connect_state conn_state;
31365
31366 - atomic_t next_gpadl_handle;
31367 + atomic_unchecked_t next_gpadl_handle;
31368
31369 /*
31370 * Represents channel interrupts. Each bit position represents a
31371 diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
31372 index a220e57..428f54d 100644
31373 --- a/drivers/hv/vmbus_drv.c
31374 +++ b/drivers/hv/vmbus_drv.c
31375 @@ -663,10 +663,10 @@ int vmbus_device_register(struct hv_device *child_device_obj)
31376 {
31377 int ret = 0;
31378
31379 - static atomic_t device_num = ATOMIC_INIT(0);
31380 + static atomic_unchecked_t device_num = ATOMIC_INIT(0);
31381
31382 dev_set_name(&child_device_obj->device, "vmbus_0_%d",
31383 - atomic_inc_return(&device_num));
31384 + atomic_inc_return_unchecked(&device_num));
31385
31386 child_device_obj->device.bus = &hv_bus;
31387 child_device_obj->device.parent = &hv_acpi_dev->dev;
31388 diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
31389 index 34ad5a2..e2b0ae8 100644
31390 --- a/drivers/hwmon/acpi_power_meter.c
31391 +++ b/drivers/hwmon/acpi_power_meter.c
31392 @@ -308,8 +308,6 @@ static ssize_t set_trip(struct device *dev, struct device_attribute *devattr,
31393 return res;
31394
31395 temp /= 1000;
31396 - if (temp < 0)
31397 - return -EINVAL;
31398
31399 mutex_lock(&resource->lock);
31400 resource->trip[attr->index - 7] = temp;
31401 diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
31402 index 8b011d0..3de24a1 100644
31403 --- a/drivers/hwmon/sht15.c
31404 +++ b/drivers/hwmon/sht15.c
31405 @@ -166,7 +166,7 @@ struct sht15_data {
31406 int supply_uV;
31407 bool supply_uV_valid;
31408 struct work_struct update_supply_work;
31409 - atomic_t interrupt_handled;
31410 + atomic_unchecked_t interrupt_handled;
31411 };
31412
31413 /**
31414 @@ -509,13 +509,13 @@ static int sht15_measurement(struct sht15_data *data,
31415 return ret;
31416
31417 gpio_direction_input(data->pdata->gpio_data);
31418 - atomic_set(&data->interrupt_handled, 0);
31419 + atomic_set_unchecked(&data->interrupt_handled, 0);
31420
31421 enable_irq(gpio_to_irq(data->pdata->gpio_data));
31422 if (gpio_get_value(data->pdata->gpio_data) == 0) {
31423 disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
31424 /* Only relevant if the interrupt hasn't occurred. */
31425 - if (!atomic_read(&data->interrupt_handled))
31426 + if (!atomic_read_unchecked(&data->interrupt_handled))
31427 schedule_work(&data->read_work);
31428 }
31429 ret = wait_event_timeout(data->wait_queue,
31430 @@ -782,7 +782,7 @@ static irqreturn_t sht15_interrupt_fired(int irq, void *d)
31431
31432 /* First disable the interrupt */
31433 disable_irq_nosync(irq);
31434 - atomic_inc(&data->interrupt_handled);
31435 + atomic_inc_unchecked(&data->interrupt_handled);
31436 /* Then schedule a reading work struct */
31437 if (data->state != SHT15_READING_NOTHING)
31438 schedule_work(&data->read_work);
31439 @@ -804,11 +804,11 @@ static void sht15_bh_read_data(struct work_struct *work_s)
31440 * If not, then start the interrupt again - care here as could
31441 * have gone low in meantime so verify it hasn't!
31442 */
31443 - atomic_set(&data->interrupt_handled, 0);
31444 + atomic_set_unchecked(&data->interrupt_handled, 0);
31445 enable_irq(gpio_to_irq(data->pdata->gpio_data));
31446 /* If still not occurred or another handler was scheduled */
31447 if (gpio_get_value(data->pdata->gpio_data)
31448 - || atomic_read(&data->interrupt_handled))
31449 + || atomic_read_unchecked(&data->interrupt_handled))
31450 return;
31451 }
31452
31453 diff --git a/drivers/i2c/busses/i2c-amd756-s4882.c b/drivers/i2c/busses/i2c-amd756-s4882.c
31454 index 378fcb5..5e91fa8 100644
31455 --- a/drivers/i2c/busses/i2c-amd756-s4882.c
31456 +++ b/drivers/i2c/busses/i2c-amd756-s4882.c
31457 @@ -43,7 +43,7 @@
31458 extern struct i2c_adapter amd756_smbus;
31459
31460 static struct i2c_adapter *s4882_adapter;
31461 -static struct i2c_algorithm *s4882_algo;
31462 +static i2c_algorithm_no_const *s4882_algo;
31463
31464 /* Wrapper access functions for multiplexed SMBus */
31465 static DEFINE_MUTEX(amd756_lock);
31466 diff --git a/drivers/i2c/busses/i2c-nforce2-s4985.c b/drivers/i2c/busses/i2c-nforce2-s4985.c
31467 index 29015eb..af2d8e9 100644
31468 --- a/drivers/i2c/busses/i2c-nforce2-s4985.c
31469 +++ b/drivers/i2c/busses/i2c-nforce2-s4985.c
31470 @@ -41,7 +41,7 @@
31471 extern struct i2c_adapter *nforce2_smbus;
31472
31473 static struct i2c_adapter *s4985_adapter;
31474 -static struct i2c_algorithm *s4985_algo;
31475 +static i2c_algorithm_no_const *s4985_algo;
31476
31477 /* Wrapper access functions for multiplexed SMBus */
31478 static DEFINE_MUTEX(nforce2_lock);
31479 diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
31480 index 1038c38..eb92f51 100644
31481 --- a/drivers/i2c/i2c-mux.c
31482 +++ b/drivers/i2c/i2c-mux.c
31483 @@ -30,7 +30,7 @@
31484 /* multiplexer per channel data */
31485 struct i2c_mux_priv {
31486 struct i2c_adapter adap;
31487 - struct i2c_algorithm algo;
31488 + i2c_algorithm_no_const algo;
31489
31490 struct i2c_adapter *parent;
31491 void *mux_priv; /* the mux chip/device */
31492 diff --git a/drivers/ide/aec62xx.c b/drivers/ide/aec62xx.c
31493 index 57d00ca..0145194 100644
31494 --- a/drivers/ide/aec62xx.c
31495 +++ b/drivers/ide/aec62xx.c
31496 @@ -181,7 +181,7 @@ static const struct ide_port_ops atp86x_port_ops = {
31497 .cable_detect = atp86x_cable_detect,
31498 };
31499
31500 -static const struct ide_port_info aec62xx_chipsets[] __devinitdata = {
31501 +static const struct ide_port_info aec62xx_chipsets[] __devinitconst = {
31502 { /* 0: AEC6210 */
31503 .name = DRV_NAME,
31504 .init_chipset = init_chipset_aec62xx,
31505 diff --git a/drivers/ide/alim15x3.c b/drivers/ide/alim15x3.c
31506 index 2c8016a..911a27c 100644
31507 --- a/drivers/ide/alim15x3.c
31508 +++ b/drivers/ide/alim15x3.c
31509 @@ -512,7 +512,7 @@ static const struct ide_dma_ops ali_dma_ops = {
31510 .dma_sff_read_status = ide_dma_sff_read_status,
31511 };
31512
31513 -static const struct ide_port_info ali15x3_chipset __devinitdata = {
31514 +static const struct ide_port_info ali15x3_chipset __devinitconst = {
31515 .name = DRV_NAME,
31516 .init_chipset = init_chipset_ali15x3,
31517 .init_hwif = init_hwif_ali15x3,
31518 diff --git a/drivers/ide/amd74xx.c b/drivers/ide/amd74xx.c
31519 index 3747b25..56fc995 100644
31520 --- a/drivers/ide/amd74xx.c
31521 +++ b/drivers/ide/amd74xx.c
31522 @@ -223,7 +223,7 @@ static const struct ide_port_ops amd_port_ops = {
31523 .udma_mask = udma, \
31524 }
31525
31526 -static const struct ide_port_info amd74xx_chipsets[] __devinitdata = {
31527 +static const struct ide_port_info amd74xx_chipsets[] __devinitconst = {
31528 /* 0: AMD7401 */ DECLARE_AMD_DEV(0x00, ATA_UDMA2),
31529 /* 1: AMD7409 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA4),
31530 /* 2: AMD7411/7441 */ DECLARE_AMD_DEV(ATA_SWDMA2, ATA_UDMA5),
31531 diff --git a/drivers/ide/atiixp.c b/drivers/ide/atiixp.c
31532 index 15f0ead..cb43480 100644
31533 --- a/drivers/ide/atiixp.c
31534 +++ b/drivers/ide/atiixp.c
31535 @@ -139,7 +139,7 @@ static const struct ide_port_ops atiixp_port_ops = {
31536 .cable_detect = atiixp_cable_detect,
31537 };
31538
31539 -static const struct ide_port_info atiixp_pci_info[] __devinitdata = {
31540 +static const struct ide_port_info atiixp_pci_info[] __devinitconst = {
31541 { /* 0: IXP200/300/400/700 */
31542 .name = DRV_NAME,
31543 .enablebits = {{0x48,0x01,0x00}, {0x48,0x08,0x00}},
31544 diff --git a/drivers/ide/cmd64x.c b/drivers/ide/cmd64x.c
31545 index 5f80312..d1fc438 100644
31546 --- a/drivers/ide/cmd64x.c
31547 +++ b/drivers/ide/cmd64x.c
31548 @@ -327,7 +327,7 @@ static const struct ide_dma_ops cmd646_rev1_dma_ops = {
31549 .dma_sff_read_status = ide_dma_sff_read_status,
31550 };
31551
31552 -static const struct ide_port_info cmd64x_chipsets[] __devinitdata = {
31553 +static const struct ide_port_info cmd64x_chipsets[] __devinitconst = {
31554 { /* 0: CMD643 */
31555 .name = DRV_NAME,
31556 .init_chipset = init_chipset_cmd64x,
31557 diff --git a/drivers/ide/cs5520.c b/drivers/ide/cs5520.c
31558 index 2c1e5f7..1444762 100644
31559 --- a/drivers/ide/cs5520.c
31560 +++ b/drivers/ide/cs5520.c
31561 @@ -94,7 +94,7 @@ static const struct ide_port_ops cs5520_port_ops = {
31562 .set_dma_mode = cs5520_set_dma_mode,
31563 };
31564
31565 -static const struct ide_port_info cyrix_chipset __devinitdata = {
31566 +static const struct ide_port_info cyrix_chipset __devinitconst = {
31567 .name = DRV_NAME,
31568 .enablebits = { { 0x60, 0x01, 0x01 }, { 0x60, 0x02, 0x02 } },
31569 .port_ops = &cs5520_port_ops,
31570 diff --git a/drivers/ide/cs5530.c b/drivers/ide/cs5530.c
31571 index 4dc4eb9..49b40ad 100644
31572 --- a/drivers/ide/cs5530.c
31573 +++ b/drivers/ide/cs5530.c
31574 @@ -245,7 +245,7 @@ static const struct ide_port_ops cs5530_port_ops = {
31575 .udma_filter = cs5530_udma_filter,
31576 };
31577
31578 -static const struct ide_port_info cs5530_chipset __devinitdata = {
31579 +static const struct ide_port_info cs5530_chipset __devinitconst = {
31580 .name = DRV_NAME,
31581 .init_chipset = init_chipset_cs5530,
31582 .init_hwif = init_hwif_cs5530,
31583 diff --git a/drivers/ide/cs5535.c b/drivers/ide/cs5535.c
31584 index 5059faf..18d4c85 100644
31585 --- a/drivers/ide/cs5535.c
31586 +++ b/drivers/ide/cs5535.c
31587 @@ -170,7 +170,7 @@ static const struct ide_port_ops cs5535_port_ops = {
31588 .cable_detect = cs5535_cable_detect,
31589 };
31590
31591 -static const struct ide_port_info cs5535_chipset __devinitdata = {
31592 +static const struct ide_port_info cs5535_chipset __devinitconst = {
31593 .name = DRV_NAME,
31594 .port_ops = &cs5535_port_ops,
31595 .host_flags = IDE_HFLAG_SINGLE | IDE_HFLAG_POST_SET_MODE,
31596 diff --git a/drivers/ide/cy82c693.c b/drivers/ide/cy82c693.c
31597 index 847553f..3ffb49d 100644
31598 --- a/drivers/ide/cy82c693.c
31599 +++ b/drivers/ide/cy82c693.c
31600 @@ -163,7 +163,7 @@ static const struct ide_port_ops cy82c693_port_ops = {
31601 .set_dma_mode = cy82c693_set_dma_mode,
31602 };
31603
31604 -static const struct ide_port_info cy82c693_chipset __devinitdata = {
31605 +static const struct ide_port_info cy82c693_chipset __devinitconst = {
31606 .name = DRV_NAME,
31607 .init_iops = init_iops_cy82c693,
31608 .port_ops = &cy82c693_port_ops,
31609 diff --git a/drivers/ide/hpt366.c b/drivers/ide/hpt366.c
31610 index 58c51cd..4aec3b8 100644
31611 --- a/drivers/ide/hpt366.c
31612 +++ b/drivers/ide/hpt366.c
31613 @@ -443,7 +443,7 @@ static struct hpt_timings hpt37x_timings = {
31614 }
31615 };
31616
31617 -static const struct hpt_info hpt36x __devinitdata = {
31618 +static const struct hpt_info hpt36x __devinitconst = {
31619 .chip_name = "HPT36x",
31620 .chip_type = HPT36x,
31621 .udma_mask = HPT366_ALLOW_ATA66_3 ? (HPT366_ALLOW_ATA66_4 ? ATA_UDMA4 : ATA_UDMA3) : ATA_UDMA2,
31622 @@ -451,7 +451,7 @@ static const struct hpt_info hpt36x __devinitdata = {
31623 .timings = &hpt36x_timings
31624 };
31625
31626 -static const struct hpt_info hpt370 __devinitdata = {
31627 +static const struct hpt_info hpt370 __devinitconst = {
31628 .chip_name = "HPT370",
31629 .chip_type = HPT370,
31630 .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
31631 @@ -459,7 +459,7 @@ static const struct hpt_info hpt370 __devinitdata = {
31632 .timings = &hpt37x_timings
31633 };
31634
31635 -static const struct hpt_info hpt370a __devinitdata = {
31636 +static const struct hpt_info hpt370a __devinitconst = {
31637 .chip_name = "HPT370A",
31638 .chip_type = HPT370A,
31639 .udma_mask = HPT370_ALLOW_ATA100_5 ? ATA_UDMA5 : ATA_UDMA4,
31640 @@ -467,7 +467,7 @@ static const struct hpt_info hpt370a __devinitdata = {
31641 .timings = &hpt37x_timings
31642 };
31643
31644 -static const struct hpt_info hpt374 __devinitdata = {
31645 +static const struct hpt_info hpt374 __devinitconst = {
31646 .chip_name = "HPT374",
31647 .chip_type = HPT374,
31648 .udma_mask = ATA_UDMA5,
31649 @@ -475,7 +475,7 @@ static const struct hpt_info hpt374 __devinitdata = {
31650 .timings = &hpt37x_timings
31651 };
31652
31653 -static const struct hpt_info hpt372 __devinitdata = {
31654 +static const struct hpt_info hpt372 __devinitconst = {
31655 .chip_name = "HPT372",
31656 .chip_type = HPT372,
31657 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
31658 @@ -483,7 +483,7 @@ static const struct hpt_info hpt372 __devinitdata = {
31659 .timings = &hpt37x_timings
31660 };
31661
31662 -static const struct hpt_info hpt372a __devinitdata = {
31663 +static const struct hpt_info hpt372a __devinitconst = {
31664 .chip_name = "HPT372A",
31665 .chip_type = HPT372A,
31666 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
31667 @@ -491,7 +491,7 @@ static const struct hpt_info hpt372a __devinitdata = {
31668 .timings = &hpt37x_timings
31669 };
31670
31671 -static const struct hpt_info hpt302 __devinitdata = {
31672 +static const struct hpt_info hpt302 __devinitconst = {
31673 .chip_name = "HPT302",
31674 .chip_type = HPT302,
31675 .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
31676 @@ -499,7 +499,7 @@ static const struct hpt_info hpt302 __devinitdata = {
31677 .timings = &hpt37x_timings
31678 };
31679
31680 -static const struct hpt_info hpt371 __devinitdata = {
31681 +static const struct hpt_info hpt371 __devinitconst = {
31682 .chip_name = "HPT371",
31683 .chip_type = HPT371,
31684 .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
31685 @@ -507,7 +507,7 @@ static const struct hpt_info hpt371 __devinitdata = {
31686 .timings = &hpt37x_timings
31687 };
31688
31689 -static const struct hpt_info hpt372n __devinitdata = {
31690 +static const struct hpt_info hpt372n __devinitconst = {
31691 .chip_name = "HPT372N",
31692 .chip_type = HPT372N,
31693 .udma_mask = HPT372_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
31694 @@ -515,7 +515,7 @@ static const struct hpt_info hpt372n __devinitdata = {
31695 .timings = &hpt37x_timings
31696 };
31697
31698 -static const struct hpt_info hpt302n __devinitdata = {
31699 +static const struct hpt_info hpt302n __devinitconst = {
31700 .chip_name = "HPT302N",
31701 .chip_type = HPT302N,
31702 .udma_mask = HPT302_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
31703 @@ -523,7 +523,7 @@ static const struct hpt_info hpt302n __devinitdata = {
31704 .timings = &hpt37x_timings
31705 };
31706
31707 -static const struct hpt_info hpt371n __devinitdata = {
31708 +static const struct hpt_info hpt371n __devinitconst = {
31709 .chip_name = "HPT371N",
31710 .chip_type = HPT371N,
31711 .udma_mask = HPT371_ALLOW_ATA133_6 ? ATA_UDMA6 : ATA_UDMA5,
31712 @@ -1361,7 +1361,7 @@ static const struct ide_dma_ops hpt36x_dma_ops = {
31713 .dma_sff_read_status = ide_dma_sff_read_status,
31714 };
31715
31716 -static const struct ide_port_info hpt366_chipsets[] __devinitdata = {
31717 +static const struct ide_port_info hpt366_chipsets[] __devinitconst = {
31718 { /* 0: HPT36x */
31719 .name = DRV_NAME,
31720 .init_chipset = init_chipset_hpt366,
31721 diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
31722 index 8126824..55a2798 100644
31723 --- a/drivers/ide/ide-cd.c
31724 +++ b/drivers/ide/ide-cd.c
31725 @@ -768,7 +768,7 @@ static void cdrom_do_block_pc(ide_drive_t *drive, struct request *rq)
31726 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
31727 if ((unsigned long)buf & alignment
31728 || blk_rq_bytes(rq) & q->dma_pad_mask
31729 - || object_is_on_stack(buf))
31730 + || object_starts_on_stack(buf))
31731 drive->dma = 0;
31732 }
31733 }
31734 diff --git a/drivers/ide/ide-pci-generic.c b/drivers/ide/ide-pci-generic.c
31735 index 7f56b73..dab5b67 100644
31736 --- a/drivers/ide/ide-pci-generic.c
31737 +++ b/drivers/ide/ide-pci-generic.c
31738 @@ -53,7 +53,7 @@ static const struct ide_port_ops netcell_port_ops = {
31739 .udma_mask = ATA_UDMA6, \
31740 }
31741
31742 -static const struct ide_port_info generic_chipsets[] __devinitdata = {
31743 +static const struct ide_port_info generic_chipsets[] __devinitconst = {
31744 /* 0: Unknown */
31745 DECLARE_GENERIC_PCI_DEV(0),
31746
31747 diff --git a/drivers/ide/it8172.c b/drivers/ide/it8172.c
31748 index 560e66d..d5dd180 100644
31749 --- a/drivers/ide/it8172.c
31750 +++ b/drivers/ide/it8172.c
31751 @@ -115,7 +115,7 @@ static const struct ide_port_ops it8172_port_ops = {
31752 .set_dma_mode = it8172_set_dma_mode,
31753 };
31754
31755 -static const struct ide_port_info it8172_port_info __devinitdata = {
31756 +static const struct ide_port_info it8172_port_info __devinitconst = {
31757 .name = DRV_NAME,
31758 .port_ops = &it8172_port_ops,
31759 .enablebits = { {0x41, 0x80, 0x80}, {0x00, 0x00, 0x00} },
31760 diff --git a/drivers/ide/it8213.c b/drivers/ide/it8213.c
31761 index 46816ba..1847aeb 100644
31762 --- a/drivers/ide/it8213.c
31763 +++ b/drivers/ide/it8213.c
31764 @@ -156,7 +156,7 @@ static const struct ide_port_ops it8213_port_ops = {
31765 .cable_detect = it8213_cable_detect,
31766 };
31767
31768 -static const struct ide_port_info it8213_chipset __devinitdata = {
31769 +static const struct ide_port_info it8213_chipset __devinitconst = {
31770 .name = DRV_NAME,
31771 .enablebits = { {0x41, 0x80, 0x80} },
31772 .port_ops = &it8213_port_ops,
31773 diff --git a/drivers/ide/it821x.c b/drivers/ide/it821x.c
31774 index 2e3169f..c5611db 100644
31775 --- a/drivers/ide/it821x.c
31776 +++ b/drivers/ide/it821x.c
31777 @@ -630,7 +630,7 @@ static const struct ide_port_ops it821x_port_ops = {
31778 .cable_detect = it821x_cable_detect,
31779 };
31780
31781 -static const struct ide_port_info it821x_chipset __devinitdata = {
31782 +static const struct ide_port_info it821x_chipset __devinitconst = {
31783 .name = DRV_NAME,
31784 .init_chipset = init_chipset_it821x,
31785 .init_hwif = init_hwif_it821x,
31786 diff --git a/drivers/ide/jmicron.c b/drivers/ide/jmicron.c
31787 index 74c2c4a..efddd7d 100644
31788 --- a/drivers/ide/jmicron.c
31789 +++ b/drivers/ide/jmicron.c
31790 @@ -102,7 +102,7 @@ static const struct ide_port_ops jmicron_port_ops = {
31791 .cable_detect = jmicron_cable_detect,
31792 };
31793
31794 -static const struct ide_port_info jmicron_chipset __devinitdata = {
31795 +static const struct ide_port_info jmicron_chipset __devinitconst = {
31796 .name = DRV_NAME,
31797 .enablebits = { { 0x40, 0x01, 0x01 }, { 0x40, 0x10, 0x10 } },
31798 .port_ops = &jmicron_port_ops,
31799 diff --git a/drivers/ide/ns87415.c b/drivers/ide/ns87415.c
31800 index 95327a2..73f78d8 100644
31801 --- a/drivers/ide/ns87415.c
31802 +++ b/drivers/ide/ns87415.c
31803 @@ -293,7 +293,7 @@ static const struct ide_dma_ops ns87415_dma_ops = {
31804 .dma_sff_read_status = superio_dma_sff_read_status,
31805 };
31806
31807 -static const struct ide_port_info ns87415_chipset __devinitdata = {
31808 +static const struct ide_port_info ns87415_chipset __devinitconst = {
31809 .name = DRV_NAME,
31810 .init_hwif = init_hwif_ns87415,
31811 .tp_ops = &ns87415_tp_ops,
31812 diff --git a/drivers/ide/opti621.c b/drivers/ide/opti621.c
31813 index 1a53a4c..39edc66 100644
31814 --- a/drivers/ide/opti621.c
31815 +++ b/drivers/ide/opti621.c
31816 @@ -131,7 +131,7 @@ static const struct ide_port_ops opti621_port_ops = {
31817 .set_pio_mode = opti621_set_pio_mode,
31818 };
31819
31820 -static const struct ide_port_info opti621_chipset __devinitdata = {
31821 +static const struct ide_port_info opti621_chipset __devinitconst = {
31822 .name = DRV_NAME,
31823 .enablebits = { {0x45, 0x80, 0x00}, {0x40, 0x08, 0x00} },
31824 .port_ops = &opti621_port_ops,
31825 diff --git a/drivers/ide/pdc202xx_new.c b/drivers/ide/pdc202xx_new.c
31826 index 9546fe2..2e5ceb6 100644
31827 --- a/drivers/ide/pdc202xx_new.c
31828 +++ b/drivers/ide/pdc202xx_new.c
31829 @@ -465,7 +465,7 @@ static const struct ide_port_ops pdcnew_port_ops = {
31830 .udma_mask = udma, \
31831 }
31832
31833 -static const struct ide_port_info pdcnew_chipsets[] __devinitdata = {
31834 +static const struct ide_port_info pdcnew_chipsets[] __devinitconst = {
31835 /* 0: PDC202{68,70} */ DECLARE_PDCNEW_DEV(ATA_UDMA5),
31836 /* 1: PDC202{69,71,75,76,77} */ DECLARE_PDCNEW_DEV(ATA_UDMA6),
31837 };
31838 diff --git a/drivers/ide/pdc202xx_old.c b/drivers/ide/pdc202xx_old.c
31839 index 3a35ec6..5634510 100644
31840 --- a/drivers/ide/pdc202xx_old.c
31841 +++ b/drivers/ide/pdc202xx_old.c
31842 @@ -270,7 +270,7 @@ static const struct ide_dma_ops pdc2026x_dma_ops = {
31843 .max_sectors = sectors, \
31844 }
31845
31846 -static const struct ide_port_info pdc202xx_chipsets[] __devinitdata = {
31847 +static const struct ide_port_info pdc202xx_chipsets[] __devinitconst = {
31848 { /* 0: PDC20246 */
31849 .name = DRV_NAME,
31850 .init_chipset = init_chipset_pdc202xx,
31851 diff --git a/drivers/ide/piix.c b/drivers/ide/piix.c
31852 index 1892e81..fe0fd60 100644
31853 --- a/drivers/ide/piix.c
31854 +++ b/drivers/ide/piix.c
31855 @@ -344,7 +344,7 @@ static const struct ide_port_ops ich_port_ops = {
31856 .udma_mask = udma, \
31857 }
31858
31859 -static const struct ide_port_info piix_pci_info[] __devinitdata = {
31860 +static const struct ide_port_info piix_pci_info[] __devinitconst = {
31861 /* 0: MPIIX */
31862 { /*
31863 * MPIIX actually has only a single IDE channel mapped to
31864 diff --git a/drivers/ide/rz1000.c b/drivers/ide/rz1000.c
31865 index a6414a8..c04173e 100644
31866 --- a/drivers/ide/rz1000.c
31867 +++ b/drivers/ide/rz1000.c
31868 @@ -38,7 +38,7 @@ static int __devinit rz1000_disable_readahead(struct pci_dev *dev)
31869 }
31870 }
31871
31872 -static const struct ide_port_info rz1000_chipset __devinitdata = {
31873 +static const struct ide_port_info rz1000_chipset __devinitconst = {
31874 .name = DRV_NAME,
31875 .host_flags = IDE_HFLAG_NO_DMA,
31876 };
31877 diff --git a/drivers/ide/sc1200.c b/drivers/ide/sc1200.c
31878 index 356b9b5..d4758eb 100644
31879 --- a/drivers/ide/sc1200.c
31880 +++ b/drivers/ide/sc1200.c
31881 @@ -291,7 +291,7 @@ static const struct ide_dma_ops sc1200_dma_ops = {
31882 .dma_sff_read_status = ide_dma_sff_read_status,
31883 };
31884
31885 -static const struct ide_port_info sc1200_chipset __devinitdata = {
31886 +static const struct ide_port_info sc1200_chipset __devinitconst = {
31887 .name = DRV_NAME,
31888 .port_ops = &sc1200_port_ops,
31889 .dma_ops = &sc1200_dma_ops,
31890 diff --git a/drivers/ide/scc_pata.c b/drivers/ide/scc_pata.c
31891 index b7f5b0c..9701038 100644
31892 --- a/drivers/ide/scc_pata.c
31893 +++ b/drivers/ide/scc_pata.c
31894 @@ -811,7 +811,7 @@ static const struct ide_dma_ops scc_dma_ops = {
31895 .dma_sff_read_status = scc_dma_sff_read_status,
31896 };
31897
31898 -static const struct ide_port_info scc_chipset __devinitdata = {
31899 +static const struct ide_port_info scc_chipset __devinitconst = {
31900 .name = "sccIDE",
31901 .init_iops = init_iops_scc,
31902 .init_dma = scc_init_dma,
31903 diff --git a/drivers/ide/serverworks.c b/drivers/ide/serverworks.c
31904 index 35fb8da..24d72ef 100644
31905 --- a/drivers/ide/serverworks.c
31906 +++ b/drivers/ide/serverworks.c
31907 @@ -337,7 +337,7 @@ static const struct ide_port_ops svwks_port_ops = {
31908 .cable_detect = svwks_cable_detect,
31909 };
31910
31911 -static const struct ide_port_info serverworks_chipsets[] __devinitdata = {
31912 +static const struct ide_port_info serverworks_chipsets[] __devinitconst = {
31913 { /* 0: OSB4 */
31914 .name = DRV_NAME,
31915 .init_chipset = init_chipset_svwks,
31916 diff --git a/drivers/ide/siimage.c b/drivers/ide/siimage.c
31917 index ddeda44..46f7e30 100644
31918 --- a/drivers/ide/siimage.c
31919 +++ b/drivers/ide/siimage.c
31920 @@ -719,7 +719,7 @@ static const struct ide_dma_ops sil_dma_ops = {
31921 .udma_mask = ATA_UDMA6, \
31922 }
31923
31924 -static const struct ide_port_info siimage_chipsets[] __devinitdata = {
31925 +static const struct ide_port_info siimage_chipsets[] __devinitconst = {
31926 /* 0: SiI680 */ DECLARE_SII_DEV(&sil_pata_port_ops),
31927 /* 1: SiI3112 */ DECLARE_SII_DEV(&sil_sata_port_ops)
31928 };
31929 diff --git a/drivers/ide/sis5513.c b/drivers/ide/sis5513.c
31930 index 4a00225..09e61b4 100644
31931 --- a/drivers/ide/sis5513.c
31932 +++ b/drivers/ide/sis5513.c
31933 @@ -563,7 +563,7 @@ static const struct ide_port_ops sis_ata133_port_ops = {
31934 .cable_detect = sis_cable_detect,
31935 };
31936
31937 -static const struct ide_port_info sis5513_chipset __devinitdata = {
31938 +static const struct ide_port_info sis5513_chipset __devinitconst = {
31939 .name = DRV_NAME,
31940 .init_chipset = init_chipset_sis5513,
31941 .enablebits = { {0x4a, 0x02, 0x02}, {0x4a, 0x04, 0x04} },
31942 diff --git a/drivers/ide/sl82c105.c b/drivers/ide/sl82c105.c
31943 index f21dc2a..d051cd2 100644
31944 --- a/drivers/ide/sl82c105.c
31945 +++ b/drivers/ide/sl82c105.c
31946 @@ -299,7 +299,7 @@ static const struct ide_dma_ops sl82c105_dma_ops = {
31947 .dma_sff_read_status = ide_dma_sff_read_status,
31948 };
31949
31950 -static const struct ide_port_info sl82c105_chipset __devinitdata = {
31951 +static const struct ide_port_info sl82c105_chipset __devinitconst = {
31952 .name = DRV_NAME,
31953 .init_chipset = init_chipset_sl82c105,
31954 .enablebits = {{0x40,0x01,0x01}, {0x40,0x10,0x10}},
31955 diff --git a/drivers/ide/slc90e66.c b/drivers/ide/slc90e66.c
31956 index 864ffe0..863a5e9 100644
31957 --- a/drivers/ide/slc90e66.c
31958 +++ b/drivers/ide/slc90e66.c
31959 @@ -132,7 +132,7 @@ static const struct ide_port_ops slc90e66_port_ops = {
31960 .cable_detect = slc90e66_cable_detect,
31961 };
31962
31963 -static const struct ide_port_info slc90e66_chipset __devinitdata = {
31964 +static const struct ide_port_info slc90e66_chipset __devinitconst = {
31965 .name = DRV_NAME,
31966 .enablebits = { {0x41, 0x80, 0x80}, {0x43, 0x80, 0x80} },
31967 .port_ops = &slc90e66_port_ops,
31968 diff --git a/drivers/ide/tc86c001.c b/drivers/ide/tc86c001.c
31969 index 4799d5c..1794678 100644
31970 --- a/drivers/ide/tc86c001.c
31971 +++ b/drivers/ide/tc86c001.c
31972 @@ -192,7 +192,7 @@ static const struct ide_dma_ops tc86c001_dma_ops = {
31973 .dma_sff_read_status = ide_dma_sff_read_status,
31974 };
31975
31976 -static const struct ide_port_info tc86c001_chipset __devinitdata = {
31977 +static const struct ide_port_info tc86c001_chipset __devinitconst = {
31978 .name = DRV_NAME,
31979 .init_hwif = init_hwif_tc86c001,
31980 .port_ops = &tc86c001_port_ops,
31981 diff --git a/drivers/ide/triflex.c b/drivers/ide/triflex.c
31982 index 281c914..55ce1b8 100644
31983 --- a/drivers/ide/triflex.c
31984 +++ b/drivers/ide/triflex.c
31985 @@ -92,7 +92,7 @@ static const struct ide_port_ops triflex_port_ops = {
31986 .set_dma_mode = triflex_set_mode,
31987 };
31988
31989 -static const struct ide_port_info triflex_device __devinitdata = {
31990 +static const struct ide_port_info triflex_device __devinitconst = {
31991 .name = DRV_NAME,
31992 .enablebits = {{0x80, 0x01, 0x01}, {0x80, 0x02, 0x02}},
31993 .port_ops = &triflex_port_ops,
31994 diff --git a/drivers/ide/trm290.c b/drivers/ide/trm290.c
31995 index 4b42ca0..e494a98 100644
31996 --- a/drivers/ide/trm290.c
31997 +++ b/drivers/ide/trm290.c
31998 @@ -324,7 +324,7 @@ static struct ide_dma_ops trm290_dma_ops = {
31999 .dma_check = trm290_dma_check,
32000 };
32001
32002 -static const struct ide_port_info trm290_chipset __devinitdata = {
32003 +static const struct ide_port_info trm290_chipset __devinitconst = {
32004 .name = DRV_NAME,
32005 .init_hwif = init_hwif_trm290,
32006 .tp_ops = &trm290_tp_ops,
32007 diff --git a/drivers/ide/via82cxxx.c b/drivers/ide/via82cxxx.c
32008 index f46f49c..eb77678 100644
32009 --- a/drivers/ide/via82cxxx.c
32010 +++ b/drivers/ide/via82cxxx.c
32011 @@ -403,7 +403,7 @@ static const struct ide_port_ops via_port_ops = {
32012 .cable_detect = via82cxxx_cable_detect,
32013 };
32014
32015 -static const struct ide_port_info via82cxxx_chipset __devinitdata = {
32016 +static const struct ide_port_info via82cxxx_chipset __devinitconst = {
32017 .name = DRV_NAME,
32018 .init_chipset = init_chipset_via82cxxx,
32019 .enablebits = { { 0x40, 0x02, 0x02 }, { 0x40, 0x01, 0x01 } },
32020 diff --git a/drivers/ieee802154/fakehard.c b/drivers/ieee802154/fakehard.c
32021 index 73d4531..c90cd2d 100644
32022 --- a/drivers/ieee802154/fakehard.c
32023 +++ b/drivers/ieee802154/fakehard.c
32024 @@ -386,7 +386,7 @@ static int __devinit ieee802154fake_probe(struct platform_device *pdev)
32025 phy->transmit_power = 0xbf;
32026
32027 dev->netdev_ops = &fake_ops;
32028 - dev->ml_priv = &fake_mlme;
32029 + dev->ml_priv = (void *)&fake_mlme;
32030
32031 priv = netdev_priv(dev);
32032 priv->phy = phy;
32033 diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
32034 index c889aae..6cf5aa7 100644
32035 --- a/drivers/infiniband/core/cm.c
32036 +++ b/drivers/infiniband/core/cm.c
32037 @@ -114,7 +114,7 @@ static char const counter_group_names[CM_COUNTER_GROUPS]
32038
32039 struct cm_counter_group {
32040 struct kobject obj;
32041 - atomic_long_t counter[CM_ATTR_COUNT];
32042 + atomic_long_unchecked_t counter[CM_ATTR_COUNT];
32043 };
32044
32045 struct cm_counter_attribute {
32046 @@ -1394,7 +1394,7 @@ static void cm_dup_req_handler(struct cm_work *work,
32047 struct ib_mad_send_buf *msg = NULL;
32048 int ret;
32049
32050 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
32051 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
32052 counter[CM_REQ_COUNTER]);
32053
32054 /* Quick state check to discard duplicate REQs. */
32055 @@ -1778,7 +1778,7 @@ static void cm_dup_rep_handler(struct cm_work *work)
32056 if (!cm_id_priv)
32057 return;
32058
32059 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
32060 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
32061 counter[CM_REP_COUNTER]);
32062 ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
32063 if (ret)
32064 @@ -1945,7 +1945,7 @@ static int cm_rtu_handler(struct cm_work *work)
32065 if (cm_id_priv->id.state != IB_CM_REP_SENT &&
32066 cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
32067 spin_unlock_irq(&cm_id_priv->lock);
32068 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
32069 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
32070 counter[CM_RTU_COUNTER]);
32071 goto out;
32072 }
32073 @@ -2128,7 +2128,7 @@ static int cm_dreq_handler(struct cm_work *work)
32074 cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
32075 dreq_msg->local_comm_id);
32076 if (!cm_id_priv) {
32077 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
32078 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
32079 counter[CM_DREQ_COUNTER]);
32080 cm_issue_drep(work->port, work->mad_recv_wc);
32081 return -EINVAL;
32082 @@ -2153,7 +2153,7 @@ static int cm_dreq_handler(struct cm_work *work)
32083 case IB_CM_MRA_REP_RCVD:
32084 break;
32085 case IB_CM_TIMEWAIT:
32086 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
32087 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
32088 counter[CM_DREQ_COUNTER]);
32089 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
32090 goto unlock;
32091 @@ -2167,7 +2167,7 @@ static int cm_dreq_handler(struct cm_work *work)
32092 cm_free_msg(msg);
32093 goto deref;
32094 case IB_CM_DREQ_RCVD:
32095 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
32096 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
32097 counter[CM_DREQ_COUNTER]);
32098 goto unlock;
32099 default:
32100 @@ -2534,7 +2534,7 @@ static int cm_mra_handler(struct cm_work *work)
32101 ib_modify_mad(cm_id_priv->av.port->mad_agent,
32102 cm_id_priv->msg, timeout)) {
32103 if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
32104 - atomic_long_inc(&work->port->
32105 + atomic_long_inc_unchecked(&work->port->
32106 counter_group[CM_RECV_DUPLICATES].
32107 counter[CM_MRA_COUNTER]);
32108 goto out;
32109 @@ -2543,7 +2543,7 @@ static int cm_mra_handler(struct cm_work *work)
32110 break;
32111 case IB_CM_MRA_REQ_RCVD:
32112 case IB_CM_MRA_REP_RCVD:
32113 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
32114 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
32115 counter[CM_MRA_COUNTER]);
32116 /* fall through */
32117 default:
32118 @@ -2705,7 +2705,7 @@ static int cm_lap_handler(struct cm_work *work)
32119 case IB_CM_LAP_IDLE:
32120 break;
32121 case IB_CM_MRA_LAP_SENT:
32122 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
32123 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
32124 counter[CM_LAP_COUNTER]);
32125 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
32126 goto unlock;
32127 @@ -2721,7 +2721,7 @@ static int cm_lap_handler(struct cm_work *work)
32128 cm_free_msg(msg);
32129 goto deref;
32130 case IB_CM_LAP_RCVD:
32131 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
32132 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
32133 counter[CM_LAP_COUNTER]);
32134 goto unlock;
32135 default:
32136 @@ -3005,7 +3005,7 @@ static int cm_sidr_req_handler(struct cm_work *work)
32137 cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
32138 if (cur_cm_id_priv) {
32139 spin_unlock_irq(&cm.lock);
32140 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
32141 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
32142 counter[CM_SIDR_REQ_COUNTER]);
32143 goto out; /* Duplicate message. */
32144 }
32145 @@ -3217,10 +3217,10 @@ static void cm_send_handler(struct ib_mad_agent *mad_agent,
32146 if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
32147 msg->retries = 1;
32148
32149 - atomic_long_add(1 + msg->retries,
32150 + atomic_long_add_unchecked(1 + msg->retries,
32151 &port->counter_group[CM_XMIT].counter[attr_index]);
32152 if (msg->retries)
32153 - atomic_long_add(msg->retries,
32154 + atomic_long_add_unchecked(msg->retries,
32155 &port->counter_group[CM_XMIT_RETRIES].
32156 counter[attr_index]);
32157
32158 @@ -3430,7 +3430,7 @@ static void cm_recv_handler(struct ib_mad_agent *mad_agent,
32159 }
32160
32161 attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
32162 - atomic_long_inc(&port->counter_group[CM_RECV].
32163 + atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
32164 counter[attr_id - CM_ATTR_ID_OFFSET]);
32165
32166 work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
32167 @@ -3635,7 +3635,7 @@ static ssize_t cm_show_counter(struct kobject *obj, struct attribute *attr,
32168 cm_attr = container_of(attr, struct cm_counter_attribute, attr);
32169
32170 return sprintf(buf, "%ld\n",
32171 - atomic_long_read(&group->counter[cm_attr->index]));
32172 + atomic_long_read_unchecked(&group->counter[cm_attr->index]));
32173 }
32174
32175 static const struct sysfs_ops cm_counter_ops = {
32176 diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
32177 index 176c8f9..2627b62 100644
32178 --- a/drivers/infiniband/core/fmr_pool.c
32179 +++ b/drivers/infiniband/core/fmr_pool.c
32180 @@ -98,8 +98,8 @@ struct ib_fmr_pool {
32181
32182 struct task_struct *thread;
32183
32184 - atomic_t req_ser;
32185 - atomic_t flush_ser;
32186 + atomic_unchecked_t req_ser;
32187 + atomic_unchecked_t flush_ser;
32188
32189 wait_queue_head_t force_wait;
32190 };
32191 @@ -180,10 +180,10 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
32192 struct ib_fmr_pool *pool = pool_ptr;
32193
32194 do {
32195 - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
32196 + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
32197 ib_fmr_batch_release(pool);
32198
32199 - atomic_inc(&pool->flush_ser);
32200 + atomic_inc_unchecked(&pool->flush_ser);
32201 wake_up_interruptible(&pool->force_wait);
32202
32203 if (pool->flush_function)
32204 @@ -191,7 +191,7 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
32205 }
32206
32207 set_current_state(TASK_INTERRUPTIBLE);
32208 - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
32209 + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
32210 !kthread_should_stop())
32211 schedule();
32212 __set_current_state(TASK_RUNNING);
32213 @@ -283,8 +283,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(struct ib_pd *pd,
32214 pool->dirty_watermark = params->dirty_watermark;
32215 pool->dirty_len = 0;
32216 spin_lock_init(&pool->pool_lock);
32217 - atomic_set(&pool->req_ser, 0);
32218 - atomic_set(&pool->flush_ser, 0);
32219 + atomic_set_unchecked(&pool->req_ser, 0);
32220 + atomic_set_unchecked(&pool->flush_ser, 0);
32221 init_waitqueue_head(&pool->force_wait);
32222
32223 pool->thread = kthread_run(ib_fmr_cleanup_thread,
32224 @@ -412,11 +412,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool *pool)
32225 }
32226 spin_unlock_irq(&pool->pool_lock);
32227
32228 - serial = atomic_inc_return(&pool->req_ser);
32229 + serial = atomic_inc_return_unchecked(&pool->req_ser);
32230 wake_up_process(pool->thread);
32231
32232 if (wait_event_interruptible(pool->force_wait,
32233 - atomic_read(&pool->flush_ser) - serial >= 0))
32234 + atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
32235 return -EINTR;
32236
32237 return 0;
32238 @@ -526,7 +526,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr *fmr)
32239 } else {
32240 list_add_tail(&fmr->list, &pool->dirty_list);
32241 if (++pool->dirty_len >= pool->dirty_watermark) {
32242 - atomic_inc(&pool->req_ser);
32243 + atomic_inc_unchecked(&pool->req_ser);
32244 wake_up_process(pool->thread);
32245 }
32246 }
32247 diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
32248 index 57e07c6..56d09d4 100644
32249 --- a/drivers/infiniband/hw/cxgb4/mem.c
32250 +++ b/drivers/infiniband/hw/cxgb4/mem.c
32251 @@ -122,7 +122,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
32252 int err;
32253 struct fw_ri_tpte tpt;
32254 u32 stag_idx;
32255 - static atomic_t key;
32256 + static atomic_unchecked_t key;
32257
32258 if (c4iw_fatal_error(rdev))
32259 return -EIO;
32260 @@ -139,7 +139,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
32261 if (rdev->stats.stag.cur > rdev->stats.stag.max)
32262 rdev->stats.stag.max = rdev->stats.stag.cur;
32263 mutex_unlock(&rdev->stats.lock);
32264 - *stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff);
32265 + *stag = (stag_idx << 8) | (atomic_inc_return_unchecked(&key) & 0xff);
32266 }
32267 PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
32268 __func__, stag_state, type, pdid, stag_idx);
32269 diff --git a/drivers/infiniband/hw/ipath/ipath_rc.c b/drivers/infiniband/hw/ipath/ipath_rc.c
32270 index 79b3dbc..96e5fcc 100644
32271 --- a/drivers/infiniband/hw/ipath/ipath_rc.c
32272 +++ b/drivers/infiniband/hw/ipath/ipath_rc.c
32273 @@ -1868,7 +1868,7 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
32274 struct ib_atomic_eth *ateth;
32275 struct ipath_ack_entry *e;
32276 u64 vaddr;
32277 - atomic64_t *maddr;
32278 + atomic64_unchecked_t *maddr;
32279 u64 sdata;
32280 u32 rkey;
32281 u8 next;
32282 @@ -1903,11 +1903,11 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
32283 IB_ACCESS_REMOTE_ATOMIC)))
32284 goto nack_acc_unlck;
32285 /* Perform atomic OP and save result. */
32286 - maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
32287 + maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
32288 sdata = be64_to_cpu(ateth->swap_data);
32289 e = &qp->s_ack_queue[qp->r_head_ack_queue];
32290 e->atomic_data = (opcode == OP(FETCH_ADD)) ?
32291 - (u64) atomic64_add_return(sdata, maddr) - sdata :
32292 + (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
32293 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
32294 be64_to_cpu(ateth->compare_data),
32295 sdata);
32296 diff --git a/drivers/infiniband/hw/ipath/ipath_ruc.c b/drivers/infiniband/hw/ipath/ipath_ruc.c
32297 index 1f95bba..9530f87 100644
32298 --- a/drivers/infiniband/hw/ipath/ipath_ruc.c
32299 +++ b/drivers/infiniband/hw/ipath/ipath_ruc.c
32300 @@ -266,7 +266,7 @@ static void ipath_ruc_loopback(struct ipath_qp *sqp)
32301 unsigned long flags;
32302 struct ib_wc wc;
32303 u64 sdata;
32304 - atomic64_t *maddr;
32305 + atomic64_unchecked_t *maddr;
32306 enum ib_wc_status send_status;
32307
32308 /*
32309 @@ -382,11 +382,11 @@ again:
32310 IB_ACCESS_REMOTE_ATOMIC)))
32311 goto acc_err;
32312 /* Perform atomic OP and save result. */
32313 - maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
32314 + maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
32315 sdata = wqe->wr.wr.atomic.compare_add;
32316 *(u64 *) sqp->s_sge.sge.vaddr =
32317 (wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD) ?
32318 - (u64) atomic64_add_return(sdata, maddr) - sdata :
32319 + (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
32320 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
32321 sdata, wqe->wr.wr.atomic.swap);
32322 goto send_comp;
32323 diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
32324 index 7140199..da60063 100644
32325 --- a/drivers/infiniband/hw/nes/nes.c
32326 +++ b/drivers/infiniband/hw/nes/nes.c
32327 @@ -103,7 +103,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limit max read request size to 256 Bytes");
32328 LIST_HEAD(nes_adapter_list);
32329 static LIST_HEAD(nes_dev_list);
32330
32331 -atomic_t qps_destroyed;
32332 +atomic_unchecked_t qps_destroyed;
32333
32334 static unsigned int ee_flsh_adapter;
32335 static unsigned int sysfs_nonidx_addr;
32336 @@ -272,7 +272,7 @@ static void nes_cqp_rem_ref_callback(struct nes_device *nesdev, struct nes_cqp_r
32337 struct nes_qp *nesqp = cqp_request->cqp_callback_pointer;
32338 struct nes_adapter *nesadapter = nesdev->nesadapter;
32339
32340 - atomic_inc(&qps_destroyed);
32341 + atomic_inc_unchecked(&qps_destroyed);
32342
32343 /* Free the control structures */
32344
32345 diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
32346 index c438e46..ca30356 100644
32347 --- a/drivers/infiniband/hw/nes/nes.h
32348 +++ b/drivers/infiniband/hw/nes/nes.h
32349 @@ -178,17 +178,17 @@ extern unsigned int nes_debug_level;
32350 extern unsigned int wqm_quanta;
32351 extern struct list_head nes_adapter_list;
32352
32353 -extern atomic_t cm_connects;
32354 -extern atomic_t cm_accepts;
32355 -extern atomic_t cm_disconnects;
32356 -extern atomic_t cm_closes;
32357 -extern atomic_t cm_connecteds;
32358 -extern atomic_t cm_connect_reqs;
32359 -extern atomic_t cm_rejects;
32360 -extern atomic_t mod_qp_timouts;
32361 -extern atomic_t qps_created;
32362 -extern atomic_t qps_destroyed;
32363 -extern atomic_t sw_qps_destroyed;
32364 +extern atomic_unchecked_t cm_connects;
32365 +extern atomic_unchecked_t cm_accepts;
32366 +extern atomic_unchecked_t cm_disconnects;
32367 +extern atomic_unchecked_t cm_closes;
32368 +extern atomic_unchecked_t cm_connecteds;
32369 +extern atomic_unchecked_t cm_connect_reqs;
32370 +extern atomic_unchecked_t cm_rejects;
32371 +extern atomic_unchecked_t mod_qp_timouts;
32372 +extern atomic_unchecked_t qps_created;
32373 +extern atomic_unchecked_t qps_destroyed;
32374 +extern atomic_unchecked_t sw_qps_destroyed;
32375 extern u32 mh_detected;
32376 extern u32 mh_pauses_sent;
32377 extern u32 cm_packets_sent;
32378 @@ -197,16 +197,16 @@ extern u32 cm_packets_created;
32379 extern u32 cm_packets_received;
32380 extern u32 cm_packets_dropped;
32381 extern u32 cm_packets_retrans;
32382 -extern atomic_t cm_listens_created;
32383 -extern atomic_t cm_listens_destroyed;
32384 +extern atomic_unchecked_t cm_listens_created;
32385 +extern atomic_unchecked_t cm_listens_destroyed;
32386 extern u32 cm_backlog_drops;
32387 -extern atomic_t cm_loopbacks;
32388 -extern atomic_t cm_nodes_created;
32389 -extern atomic_t cm_nodes_destroyed;
32390 -extern atomic_t cm_accel_dropped_pkts;
32391 -extern atomic_t cm_resets_recvd;
32392 -extern atomic_t pau_qps_created;
32393 -extern atomic_t pau_qps_destroyed;
32394 +extern atomic_unchecked_t cm_loopbacks;
32395 +extern atomic_unchecked_t cm_nodes_created;
32396 +extern atomic_unchecked_t cm_nodes_destroyed;
32397 +extern atomic_unchecked_t cm_accel_dropped_pkts;
32398 +extern atomic_unchecked_t cm_resets_recvd;
32399 +extern atomic_unchecked_t pau_qps_created;
32400 +extern atomic_unchecked_t pau_qps_destroyed;
32401
32402 extern u32 int_mod_timer_init;
32403 extern u32 int_mod_cq_depth_256;
32404 diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
32405 index 020e95c..fbb3450 100644
32406 --- a/drivers/infiniband/hw/nes/nes_cm.c
32407 +++ b/drivers/infiniband/hw/nes/nes_cm.c
32408 @@ -68,14 +68,14 @@ u32 cm_packets_dropped;
32409 u32 cm_packets_retrans;
32410 u32 cm_packets_created;
32411 u32 cm_packets_received;
32412 -atomic_t cm_listens_created;
32413 -atomic_t cm_listens_destroyed;
32414 +atomic_unchecked_t cm_listens_created;
32415 +atomic_unchecked_t cm_listens_destroyed;
32416 u32 cm_backlog_drops;
32417 -atomic_t cm_loopbacks;
32418 -atomic_t cm_nodes_created;
32419 -atomic_t cm_nodes_destroyed;
32420 -atomic_t cm_accel_dropped_pkts;
32421 -atomic_t cm_resets_recvd;
32422 +atomic_unchecked_t cm_loopbacks;
32423 +atomic_unchecked_t cm_nodes_created;
32424 +atomic_unchecked_t cm_nodes_destroyed;
32425 +atomic_unchecked_t cm_accel_dropped_pkts;
32426 +atomic_unchecked_t cm_resets_recvd;
32427
32428 static inline int mini_cm_accelerated(struct nes_cm_core *, struct nes_cm_node *);
32429 static struct nes_cm_listener *mini_cm_listen(struct nes_cm_core *, struct nes_vnic *, struct nes_cm_info *);
32430 @@ -148,13 +148,13 @@ static struct nes_cm_ops nes_cm_api = {
32431
32432 static struct nes_cm_core *g_cm_core;
32433
32434 -atomic_t cm_connects;
32435 -atomic_t cm_accepts;
32436 -atomic_t cm_disconnects;
32437 -atomic_t cm_closes;
32438 -atomic_t cm_connecteds;
32439 -atomic_t cm_connect_reqs;
32440 -atomic_t cm_rejects;
32441 +atomic_unchecked_t cm_connects;
32442 +atomic_unchecked_t cm_accepts;
32443 +atomic_unchecked_t cm_disconnects;
32444 +atomic_unchecked_t cm_closes;
32445 +atomic_unchecked_t cm_connecteds;
32446 +atomic_unchecked_t cm_connect_reqs;
32447 +atomic_unchecked_t cm_rejects;
32448
32449 int nes_add_ref_cm_node(struct nes_cm_node *cm_node)
32450 {
32451 @@ -1279,7 +1279,7 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
32452 kfree(listener);
32453 listener = NULL;
32454 ret = 0;
32455 - atomic_inc(&cm_listens_destroyed);
32456 + atomic_inc_unchecked(&cm_listens_destroyed);
32457 } else {
32458 spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
32459 }
32460 @@ -1482,7 +1482,7 @@ static struct nes_cm_node *make_cm_node(struct nes_cm_core *cm_core,
32461 cm_node->rem_mac);
32462
32463 add_hte_node(cm_core, cm_node);
32464 - atomic_inc(&cm_nodes_created);
32465 + atomic_inc_unchecked(&cm_nodes_created);
32466
32467 return cm_node;
32468 }
32469 @@ -1540,7 +1540,7 @@ static int rem_ref_cm_node(struct nes_cm_core *cm_core,
32470 }
32471
32472 atomic_dec(&cm_core->node_cnt);
32473 - atomic_inc(&cm_nodes_destroyed);
32474 + atomic_inc_unchecked(&cm_nodes_destroyed);
32475 nesqp = cm_node->nesqp;
32476 if (nesqp) {
32477 nesqp->cm_node = NULL;
32478 @@ -1604,7 +1604,7 @@ static int process_options(struct nes_cm_node *cm_node, u8 *optionsloc,
32479
32480 static void drop_packet(struct sk_buff *skb)
32481 {
32482 - atomic_inc(&cm_accel_dropped_pkts);
32483 + atomic_inc_unchecked(&cm_accel_dropped_pkts);
32484 dev_kfree_skb_any(skb);
32485 }
32486
32487 @@ -1667,7 +1667,7 @@ static void handle_rst_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
32488 {
32489
32490 int reset = 0; /* whether to send reset in case of err.. */
32491 - atomic_inc(&cm_resets_recvd);
32492 + atomic_inc_unchecked(&cm_resets_recvd);
32493 nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
32494 " refcnt=%d\n", cm_node, cm_node->state,
32495 atomic_read(&cm_node->ref_count));
32496 @@ -2308,7 +2308,7 @@ static struct nes_cm_node *mini_cm_connect(struct nes_cm_core *cm_core,
32497 rem_ref_cm_node(cm_node->cm_core, cm_node);
32498 return NULL;
32499 }
32500 - atomic_inc(&cm_loopbacks);
32501 + atomic_inc_unchecked(&cm_loopbacks);
32502 loopbackremotenode->loopbackpartner = cm_node;
32503 loopbackremotenode->tcp_cntxt.rcv_wscale =
32504 NES_CM_DEFAULT_RCV_WND_SCALE;
32505 @@ -2583,7 +2583,7 @@ static int mini_cm_recv_pkt(struct nes_cm_core *cm_core,
32506 nes_queue_mgt_skbs(skb, nesvnic, cm_node->nesqp);
32507 else {
32508 rem_ref_cm_node(cm_core, cm_node);
32509 - atomic_inc(&cm_accel_dropped_pkts);
32510 + atomic_inc_unchecked(&cm_accel_dropped_pkts);
32511 dev_kfree_skb_any(skb);
32512 }
32513 break;
32514 @@ -2891,7 +2891,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
32515
32516 if ((cm_id) && (cm_id->event_handler)) {
32517 if (issue_disconn) {
32518 - atomic_inc(&cm_disconnects);
32519 + atomic_inc_unchecked(&cm_disconnects);
32520 cm_event.event = IW_CM_EVENT_DISCONNECT;
32521 cm_event.status = disconn_status;
32522 cm_event.local_addr = cm_id->local_addr;
32523 @@ -2913,7 +2913,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
32524 }
32525
32526 if (issue_close) {
32527 - atomic_inc(&cm_closes);
32528 + atomic_inc_unchecked(&cm_closes);
32529 nes_disconnect(nesqp, 1);
32530
32531 cm_id->provider_data = nesqp;
32532 @@ -3049,7 +3049,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
32533
32534 nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
32535 nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
32536 - atomic_inc(&cm_accepts);
32537 + atomic_inc_unchecked(&cm_accepts);
32538
32539 nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
32540 netdev_refcnt_read(nesvnic->netdev));
32541 @@ -3251,7 +3251,7 @@ int nes_reject(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len)
32542 struct nes_cm_core *cm_core;
32543 u8 *start_buff;
32544
32545 - atomic_inc(&cm_rejects);
32546 + atomic_inc_unchecked(&cm_rejects);
32547 cm_node = (struct nes_cm_node *)cm_id->provider_data;
32548 loopback = cm_node->loopbackpartner;
32549 cm_core = cm_node->cm_core;
32550 @@ -3311,7 +3311,7 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
32551 ntohl(cm_id->local_addr.sin_addr.s_addr),
32552 ntohs(cm_id->local_addr.sin_port));
32553
32554 - atomic_inc(&cm_connects);
32555 + atomic_inc_unchecked(&cm_connects);
32556 nesqp->active_conn = 1;
32557
32558 /* cache the cm_id in the qp */
32559 @@ -3421,7 +3421,7 @@ int nes_create_listen(struct iw_cm_id *cm_id, int backlog)
32560 g_cm_core->api->stop_listener(g_cm_core, (void *)cm_node);
32561 return err;
32562 }
32563 - atomic_inc(&cm_listens_created);
32564 + atomic_inc_unchecked(&cm_listens_created);
32565 }
32566
32567 cm_id->add_ref(cm_id);
32568 @@ -3522,7 +3522,7 @@ static void cm_event_connected(struct nes_cm_event *event)
32569
32570 if (nesqp->destroyed)
32571 return;
32572 - atomic_inc(&cm_connecteds);
32573 + atomic_inc_unchecked(&cm_connecteds);
32574 nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
32575 " local port 0x%04X. jiffies = %lu.\n",
32576 nesqp->hwqp.qp_id,
32577 @@ -3709,7 +3709,7 @@ static void cm_event_reset(struct nes_cm_event *event)
32578
32579 cm_id->add_ref(cm_id);
32580 ret = cm_id->event_handler(cm_id, &cm_event);
32581 - atomic_inc(&cm_closes);
32582 + atomic_inc_unchecked(&cm_closes);
32583 cm_event.event = IW_CM_EVENT_CLOSE;
32584 cm_event.status = 0;
32585 cm_event.provider_data = cm_id->provider_data;
32586 @@ -3745,7 +3745,7 @@ static void cm_event_mpa_req(struct nes_cm_event *event)
32587 return;
32588 cm_id = cm_node->cm_id;
32589
32590 - atomic_inc(&cm_connect_reqs);
32591 + atomic_inc_unchecked(&cm_connect_reqs);
32592 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
32593 cm_node, cm_id, jiffies);
32594
32595 @@ -3785,7 +3785,7 @@ static void cm_event_mpa_reject(struct nes_cm_event *event)
32596 return;
32597 cm_id = cm_node->cm_id;
32598
32599 - atomic_inc(&cm_connect_reqs);
32600 + atomic_inc_unchecked(&cm_connect_reqs);
32601 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
32602 cm_node, cm_id, jiffies);
32603
32604 diff --git a/drivers/infiniband/hw/nes/nes_mgt.c b/drivers/infiniband/hw/nes/nes_mgt.c
32605 index 3ba7be3..c81f6ff 100644
32606 --- a/drivers/infiniband/hw/nes/nes_mgt.c
32607 +++ b/drivers/infiniband/hw/nes/nes_mgt.c
32608 @@ -40,8 +40,8 @@
32609 #include "nes.h"
32610 #include "nes_mgt.h"
32611
32612 -atomic_t pau_qps_created;
32613 -atomic_t pau_qps_destroyed;
32614 +atomic_unchecked_t pau_qps_created;
32615 +atomic_unchecked_t pau_qps_destroyed;
32616
32617 static void nes_replenish_mgt_rq(struct nes_vnic_mgt *mgtvnic)
32618 {
32619 @@ -621,7 +621,7 @@ void nes_destroy_pau_qp(struct nes_device *nesdev, struct nes_qp *nesqp)
32620 {
32621 struct sk_buff *skb;
32622 unsigned long flags;
32623 - atomic_inc(&pau_qps_destroyed);
32624 + atomic_inc_unchecked(&pau_qps_destroyed);
32625
32626 /* Free packets that have not yet been forwarded */
32627 /* Lock is acquired by skb_dequeue when removing the skb */
32628 @@ -812,7 +812,7 @@ static void nes_mgt_ce_handler(struct nes_device *nesdev, struct nes_hw_nic_cq *
32629 cq->cq_vbase[head].cqe_words[NES_NIC_CQE_HASH_RCVNXT]);
32630 skb_queue_head_init(&nesqp->pau_list);
32631 spin_lock_init(&nesqp->pau_lock);
32632 - atomic_inc(&pau_qps_created);
32633 + atomic_inc_unchecked(&pau_qps_created);
32634 nes_change_quad_hash(nesdev, mgtvnic->nesvnic, nesqp);
32635 }
32636
32637 diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
32638 index f3a3ecf..57d311d 100644
32639 --- a/drivers/infiniband/hw/nes/nes_nic.c
32640 +++ b/drivers/infiniband/hw/nes/nes_nic.c
32641 @@ -1277,39 +1277,39 @@ static void nes_netdev_get_ethtool_stats(struct net_device *netdev,
32642 target_stat_values[++index] = mh_detected;
32643 target_stat_values[++index] = mh_pauses_sent;
32644 target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
32645 - target_stat_values[++index] = atomic_read(&cm_connects);
32646 - target_stat_values[++index] = atomic_read(&cm_accepts);
32647 - target_stat_values[++index] = atomic_read(&cm_disconnects);
32648 - target_stat_values[++index] = atomic_read(&cm_connecteds);
32649 - target_stat_values[++index] = atomic_read(&cm_connect_reqs);
32650 - target_stat_values[++index] = atomic_read(&cm_rejects);
32651 - target_stat_values[++index] = atomic_read(&mod_qp_timouts);
32652 - target_stat_values[++index] = atomic_read(&qps_created);
32653 - target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
32654 - target_stat_values[++index] = atomic_read(&qps_destroyed);
32655 - target_stat_values[++index] = atomic_read(&cm_closes);
32656 + target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
32657 + target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
32658 + target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
32659 + target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
32660 + target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
32661 + target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
32662 + target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
32663 + target_stat_values[++index] = atomic_read_unchecked(&qps_created);
32664 + target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
32665 + target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
32666 + target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
32667 target_stat_values[++index] = cm_packets_sent;
32668 target_stat_values[++index] = cm_packets_bounced;
32669 target_stat_values[++index] = cm_packets_created;
32670 target_stat_values[++index] = cm_packets_received;
32671 target_stat_values[++index] = cm_packets_dropped;
32672 target_stat_values[++index] = cm_packets_retrans;
32673 - target_stat_values[++index] = atomic_read(&cm_listens_created);
32674 - target_stat_values[++index] = atomic_read(&cm_listens_destroyed);
32675 + target_stat_values[++index] = atomic_read_unchecked(&cm_listens_created);
32676 + target_stat_values[++index] = atomic_read_unchecked(&cm_listens_destroyed);
32677 target_stat_values[++index] = cm_backlog_drops;
32678 - target_stat_values[++index] = atomic_read(&cm_loopbacks);
32679 - target_stat_values[++index] = atomic_read(&cm_nodes_created);
32680 - target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
32681 - target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
32682 - target_stat_values[++index] = atomic_read(&cm_resets_recvd);
32683 + target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
32684 + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
32685 + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
32686 + target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
32687 + target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
32688 target_stat_values[++index] = nesadapter->free_4kpbl;
32689 target_stat_values[++index] = nesadapter->free_256pbl;
32690 target_stat_values[++index] = int_mod_timer_init;
32691 target_stat_values[++index] = nesvnic->lro_mgr.stats.aggregated;
32692 target_stat_values[++index] = nesvnic->lro_mgr.stats.flushed;
32693 target_stat_values[++index] = nesvnic->lro_mgr.stats.no_desc;
32694 - target_stat_values[++index] = atomic_read(&pau_qps_created);
32695 - target_stat_values[++index] = atomic_read(&pau_qps_destroyed);
32696 + target_stat_values[++index] = atomic_read_unchecked(&pau_qps_created);
32697 + target_stat_values[++index] = atomic_read_unchecked(&pau_qps_destroyed);
32698 }
32699
32700 /**
32701 diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
32702 index 8b8812d..a5e1133 100644
32703 --- a/drivers/infiniband/hw/nes/nes_verbs.c
32704 +++ b/drivers/infiniband/hw/nes/nes_verbs.c
32705 @@ -46,9 +46,9 @@
32706
32707 #include <rdma/ib_umem.h>
32708
32709 -atomic_t mod_qp_timouts;
32710 -atomic_t qps_created;
32711 -atomic_t sw_qps_destroyed;
32712 +atomic_unchecked_t mod_qp_timouts;
32713 +atomic_unchecked_t qps_created;
32714 +atomic_unchecked_t sw_qps_destroyed;
32715
32716 static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
32717
32718 @@ -1131,7 +1131,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
32719 if (init_attr->create_flags)
32720 return ERR_PTR(-EINVAL);
32721
32722 - atomic_inc(&qps_created);
32723 + atomic_inc_unchecked(&qps_created);
32724 switch (init_attr->qp_type) {
32725 case IB_QPT_RC:
32726 if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
32727 @@ -1460,7 +1460,7 @@ static int nes_destroy_qp(struct ib_qp *ibqp)
32728 struct iw_cm_event cm_event;
32729 int ret = 0;
32730
32731 - atomic_inc(&sw_qps_destroyed);
32732 + atomic_inc_unchecked(&sw_qps_destroyed);
32733 nesqp->destroyed = 1;
32734
32735 /* Blow away the connection if it exists. */
32736 diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h
32737 index 7e62f41..4c2b8e2 100644
32738 --- a/drivers/infiniband/hw/qib/qib.h
32739 +++ b/drivers/infiniband/hw/qib/qib.h
32740 @@ -51,6 +51,7 @@
32741 #include <linux/completion.h>
32742 #include <linux/kref.h>
32743 #include <linux/sched.h>
32744 +#include <linux/slab.h>
32745
32746 #include "qib_common.h"
32747 #include "qib_verbs.h"
32748 diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
32749 index da739d9..da1c7f4 100644
32750 --- a/drivers/input/gameport/gameport.c
32751 +++ b/drivers/input/gameport/gameport.c
32752 @@ -487,14 +487,14 @@ EXPORT_SYMBOL(gameport_set_phys);
32753 */
32754 static void gameport_init_port(struct gameport *gameport)
32755 {
32756 - static atomic_t gameport_no = ATOMIC_INIT(0);
32757 + static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
32758
32759 __module_get(THIS_MODULE);
32760
32761 mutex_init(&gameport->drv_mutex);
32762 device_initialize(&gameport->dev);
32763 dev_set_name(&gameport->dev, "gameport%lu",
32764 - (unsigned long)atomic_inc_return(&gameport_no) - 1);
32765 + (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
32766 gameport->dev.bus = &gameport_bus;
32767 gameport->dev.release = gameport_release_port;
32768 if (gameport->parent)
32769 diff --git a/drivers/input/input.c b/drivers/input/input.c
32770 index 8921c61..f5cd63d 100644
32771 --- a/drivers/input/input.c
32772 +++ b/drivers/input/input.c
32773 @@ -1814,7 +1814,7 @@ static void input_cleanse_bitmasks(struct input_dev *dev)
32774 */
32775 int input_register_device(struct input_dev *dev)
32776 {
32777 - static atomic_t input_no = ATOMIC_INIT(0);
32778 + static atomic_unchecked_t input_no = ATOMIC_INIT(0);
32779 struct input_handler *handler;
32780 const char *path;
32781 int error;
32782 @@ -1851,7 +1851,7 @@ int input_register_device(struct input_dev *dev)
32783 dev->setkeycode = input_default_setkeycode;
32784
32785 dev_set_name(&dev->dev, "input%ld",
32786 - (unsigned long) atomic_inc_return(&input_no) - 1);
32787 + (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
32788
32789 error = device_add(&dev->dev);
32790 if (error)
32791 diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
32792 index 04c69af..5f92d00 100644
32793 --- a/drivers/input/joystick/sidewinder.c
32794 +++ b/drivers/input/joystick/sidewinder.c
32795 @@ -30,6 +30,7 @@
32796 #include <linux/kernel.h>
32797 #include <linux/module.h>
32798 #include <linux/slab.h>
32799 +#include <linux/sched.h>
32800 #include <linux/init.h>
32801 #include <linux/input.h>
32802 #include <linux/gameport.h>
32803 diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
32804 index 83811e4..0822b90 100644
32805 --- a/drivers/input/joystick/xpad.c
32806 +++ b/drivers/input/joystick/xpad.c
32807 @@ -726,7 +726,7 @@ static void xpad_led_set(struct led_classdev *led_cdev,
32808
32809 static int xpad_led_probe(struct usb_xpad *xpad)
32810 {
32811 - static atomic_t led_seq = ATOMIC_INIT(0);
32812 + static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
32813 long led_no;
32814 struct xpad_led *led;
32815 struct led_classdev *led_cdev;
32816 @@ -739,7 +739,7 @@ static int xpad_led_probe(struct usb_xpad *xpad)
32817 if (!led)
32818 return -ENOMEM;
32819
32820 - led_no = (long)atomic_inc_return(&led_seq) - 1;
32821 + led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
32822
32823 snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
32824 led->xpad = xpad;
32825 diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
32826 index 0110b5a..d3ad144 100644
32827 --- a/drivers/input/mousedev.c
32828 +++ b/drivers/input/mousedev.c
32829 @@ -763,7 +763,7 @@ static ssize_t mousedev_read(struct file *file, char __user *buffer,
32830
32831 spin_unlock_irq(&client->packet_lock);
32832
32833 - if (copy_to_user(buffer, data, count))
32834 + if (count > sizeof(data) || copy_to_user(buffer, data, count))
32835 return -EFAULT;
32836
32837 return count;
32838 diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
32839 index d0f7533..fb8215b 100644
32840 --- a/drivers/input/serio/serio.c
32841 +++ b/drivers/input/serio/serio.c
32842 @@ -496,7 +496,7 @@ static void serio_release_port(struct device *dev)
32843 */
32844 static void serio_init_port(struct serio *serio)
32845 {
32846 - static atomic_t serio_no = ATOMIC_INIT(0);
32847 + static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
32848
32849 __module_get(THIS_MODULE);
32850
32851 @@ -507,7 +507,7 @@ static void serio_init_port(struct serio *serio)
32852 mutex_init(&serio->drv_mutex);
32853 device_initialize(&serio->dev);
32854 dev_set_name(&serio->dev, "serio%ld",
32855 - (long)atomic_inc_return(&serio_no) - 1);
32856 + (long)atomic_inc_return_unchecked(&serio_no) - 1);
32857 serio->dev.bus = &serio_bus;
32858 serio->dev.release = serio_release_port;
32859 serio->dev.groups = serio_device_attr_groups;
32860 diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
32861 index 38c4bd8..58965d9 100644
32862 --- a/drivers/isdn/capi/capi.c
32863 +++ b/drivers/isdn/capi/capi.c
32864 @@ -83,8 +83,8 @@ struct capiminor {
32865
32866 struct capi20_appl *ap;
32867 u32 ncci;
32868 - atomic_t datahandle;
32869 - atomic_t msgid;
32870 + atomic_unchecked_t datahandle;
32871 + atomic_unchecked_t msgid;
32872
32873 struct tty_port port;
32874 int ttyinstop;
32875 @@ -392,7 +392,7 @@ gen_data_b3_resp_for(struct capiminor *mp, struct sk_buff *skb)
32876 capimsg_setu16(s, 2, mp->ap->applid);
32877 capimsg_setu8 (s, 4, CAPI_DATA_B3);
32878 capimsg_setu8 (s, 5, CAPI_RESP);
32879 - capimsg_setu16(s, 6, atomic_inc_return(&mp->msgid));
32880 + capimsg_setu16(s, 6, atomic_inc_return_unchecked(&mp->msgid));
32881 capimsg_setu32(s, 8, mp->ncci);
32882 capimsg_setu16(s, 12, datahandle);
32883 }
32884 @@ -513,14 +513,14 @@ static void handle_minor_send(struct capiminor *mp)
32885 mp->outbytes -= len;
32886 spin_unlock_bh(&mp->outlock);
32887
32888 - datahandle = atomic_inc_return(&mp->datahandle);
32889 + datahandle = atomic_inc_return_unchecked(&mp->datahandle);
32890 skb_push(skb, CAPI_DATA_B3_REQ_LEN);
32891 memset(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
32892 capimsg_setu16(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
32893 capimsg_setu16(skb->data, 2, mp->ap->applid);
32894 capimsg_setu8 (skb->data, 4, CAPI_DATA_B3);
32895 capimsg_setu8 (skb->data, 5, CAPI_REQ);
32896 - capimsg_setu16(skb->data, 6, atomic_inc_return(&mp->msgid));
32897 + capimsg_setu16(skb->data, 6, atomic_inc_return_unchecked(&mp->msgid));
32898 capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */
32899 capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */
32900 capimsg_setu16(skb->data, 16, len); /* Data length */
32901 diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
32902 index a6d9fd2..afdb8a3 100644
32903 --- a/drivers/isdn/gigaset/interface.c
32904 +++ b/drivers/isdn/gigaset/interface.c
32905 @@ -160,9 +160,9 @@ static int if_open(struct tty_struct *tty, struct file *filp)
32906 }
32907 tty->driver_data = cs;
32908
32909 - ++cs->port.count;
32910 + atomic_inc(&cs->port.count);
32911
32912 - if (cs->port.count == 1) {
32913 + if (atomic_read(&cs->port.count) == 1) {
32914 tty_port_tty_set(&cs->port, tty);
32915 tty->low_latency = 1;
32916 }
32917 @@ -186,9 +186,9 @@ static void if_close(struct tty_struct *tty, struct file *filp)
32918
32919 if (!cs->connected)
32920 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
32921 - else if (!cs->port.count)
32922 + else if (!atomic_read(&cs->port.count))
32923 dev_warn(cs->dev, "%s: device not opened\n", __func__);
32924 - else if (!--cs->port.count)
32925 + else if (!atomic_dec_return(&cs->port.count))
32926 tty_port_tty_set(&cs->port, NULL);
32927
32928 mutex_unlock(&cs->mutex);
32929 diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
32930 index 821f7ac..28d4030 100644
32931 --- a/drivers/isdn/hardware/avm/b1.c
32932 +++ b/drivers/isdn/hardware/avm/b1.c
32933 @@ -176,7 +176,7 @@ int b1_load_t4file(avmcard *card, capiloaddatapart *t4file)
32934 }
32935 if (left) {
32936 if (t4file->user) {
32937 - if (copy_from_user(buf, dp, left))
32938 + if (left > sizeof buf || copy_from_user(buf, dp, left))
32939 return -EFAULT;
32940 } else {
32941 memcpy(buf, dp, left);
32942 @@ -224,7 +224,7 @@ int b1_load_config(avmcard *card, capiloaddatapart *config)
32943 }
32944 if (left) {
32945 if (config->user) {
32946 - if (copy_from_user(buf, dp, left))
32947 + if (left > sizeof buf || copy_from_user(buf, dp, left))
32948 return -EFAULT;
32949 } else {
32950 memcpy(buf, dp, left);
32951 diff --git a/drivers/isdn/hardware/eicon/divasync.h b/drivers/isdn/hardware/eicon/divasync.h
32952 index dd6b53a..19d9ee6 100644
32953 --- a/drivers/isdn/hardware/eicon/divasync.h
32954 +++ b/drivers/isdn/hardware/eicon/divasync.h
32955 @@ -146,7 +146,7 @@ typedef struct _diva_didd_add_adapter {
32956 } diva_didd_add_adapter_t;
32957 typedef struct _diva_didd_remove_adapter {
32958 IDI_CALL p_request;
32959 -} diva_didd_remove_adapter_t;
32960 +} __no_const diva_didd_remove_adapter_t;
32961 typedef struct _diva_didd_read_adapter_array {
32962 void *buffer;
32963 dword length;
32964 diff --git a/drivers/isdn/hardware/eicon/xdi_adapter.h b/drivers/isdn/hardware/eicon/xdi_adapter.h
32965 index d303e65..28bcb7b 100644
32966 --- a/drivers/isdn/hardware/eicon/xdi_adapter.h
32967 +++ b/drivers/isdn/hardware/eicon/xdi_adapter.h
32968 @@ -44,7 +44,7 @@ typedef struct _xdi_mbox_t {
32969 typedef struct _diva_os_idi_adapter_interface {
32970 diva_init_card_proc_t cleanup_adapter_proc;
32971 diva_cmd_card_proc_t cmd_proc;
32972 -} diva_os_idi_adapter_interface_t;
32973 +} __no_const diva_os_idi_adapter_interface_t;
32974
32975 typedef struct _diva_os_xdi_adapter {
32976 struct list_head link;
32977 diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
32978 index 7bc5067..fd36232 100644
32979 --- a/drivers/isdn/i4l/isdn_tty.c
32980 +++ b/drivers/isdn/i4l/isdn_tty.c
32981 @@ -1505,9 +1505,9 @@ isdn_tty_open(struct tty_struct *tty, struct file *filp)
32982 port = &info->port;
32983 #ifdef ISDN_DEBUG_MODEM_OPEN
32984 printk(KERN_DEBUG "isdn_tty_open %s, count = %d\n", tty->name,
32985 - port->count);
32986 + atomic_read(&port->count))
32987 #endif
32988 - port->count++;
32989 + atomic_inc(&port->count);
32990 tty->driver_data = info;
32991 port->tty = tty;
32992 tty->port = port;
32993 @@ -1553,7 +1553,7 @@ isdn_tty_close(struct tty_struct *tty, struct file *filp)
32994 #endif
32995 return;
32996 }
32997 - if ((tty->count == 1) && (port->count != 1)) {
32998 + if ((tty->count == 1) && (atomic_read(&port->count) != 1)) {
32999 /*
33000 * Uh, oh. tty->count is 1, which means that the tty
33001 * structure will be freed. Info->count should always
33002 @@ -1562,15 +1562,15 @@ isdn_tty_close(struct tty_struct *tty, struct file *filp)
33003 * serial port won't be shutdown.
33004 */
33005 printk(KERN_ERR "isdn_tty_close: bad port count; tty->count is 1, "
33006 - "info->count is %d\n", port->count);
33007 - port->count = 1;
33008 + "info->count is %d\n", atomic_read(&port->count));
33009 + atomic_set(&port->count, 1);
33010 }
33011 - if (--port->count < 0) {
33012 + if (atomic_dec_return(&port->count) < 0) {
33013 printk(KERN_ERR "isdn_tty_close: bad port count for ttyi%d: %d\n",
33014 - info->line, port->count);
33015 - port->count = 0;
33016 + info->line, atomic_read(&port->count));
33017 + atomic_set(&port->count, 0);
33018 }
33019 - if (port->count) {
33020 + if (atomic_read(&port->count)) {
33021 #ifdef ISDN_DEBUG_MODEM_OPEN
33022 printk(KERN_DEBUG "isdn_tty_close after info->count != 0\n");
33023 #endif
33024 @@ -1624,7 +1624,7 @@ isdn_tty_hangup(struct tty_struct *tty)
33025 if (isdn_tty_paranoia_check(info, tty->name, "isdn_tty_hangup"))
33026 return;
33027 isdn_tty_shutdown(info);
33028 - port->count = 0;
33029 + atomic_set(&port->count, 0);
33030 port->flags &= ~ASYNC_NORMAL_ACTIVE;
33031 port->tty = NULL;
33032 wake_up_interruptible(&port->open_wait);
33033 @@ -1964,7 +1964,7 @@ isdn_tty_find_icall(int di, int ch, setup_parm *setup)
33034 for (i = 0; i < ISDN_MAX_CHANNELS; i++) {
33035 modem_info *info = &dev->mdm.info[i];
33036
33037 - if (info->port.count == 0)
33038 + if (atomic_read(&info->port.count) == 0)
33039 continue;
33040 if ((info->emu.mdmreg[REG_SI1] & si2bit[si1]) && /* SI1 is matching */
33041 (info->emu.mdmreg[REG_SI2] == si2)) { /* SI2 is matching */
33042 diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
33043 index e74df7c..03a03ba 100644
33044 --- a/drivers/isdn/icn/icn.c
33045 +++ b/drivers/isdn/icn/icn.c
33046 @@ -1045,7 +1045,7 @@ icn_writecmd(const u_char *buf, int len, int user, icn_card *card)
33047 if (count > len)
33048 count = len;
33049 if (user) {
33050 - if (copy_from_user(msg, buf, count))
33051 + if (count > sizeof msg || copy_from_user(msg, buf, count))
33052 return -EFAULT;
33053 } else
33054 memcpy(msg, buf, count);
33055 diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
33056 index b5fdcb7..5b6c59f 100644
33057 --- a/drivers/lguest/core.c
33058 +++ b/drivers/lguest/core.c
33059 @@ -92,9 +92,17 @@ static __init int map_switcher(void)
33060 * it's worked so far. The end address needs +1 because __get_vm_area
33061 * allocates an extra guard page, so we need space for that.
33062 */
33063 +
33064 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
33065 + switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
33066 + VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
33067 + + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
33068 +#else
33069 switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
33070 VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
33071 + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
33072 +#endif
33073 +
33074 if (!switcher_vma) {
33075 err = -ENOMEM;
33076 printk("lguest: could not map switcher pages high\n");
33077 @@ -119,7 +127,7 @@ static __init int map_switcher(void)
33078 * Now the Switcher is mapped at the right address, we can't fail!
33079 * Copy in the compiled-in Switcher code (from x86/switcher_32.S).
33080 */
33081 - memcpy(switcher_vma->addr, start_switcher_text,
33082 + memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
33083 end_switcher_text - start_switcher_text);
33084
33085 printk(KERN_INFO "lguest: mapped switcher at %p\n",
33086 diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
33087 index 39809035..ce25c5e 100644
33088 --- a/drivers/lguest/x86/core.c
33089 +++ b/drivers/lguest/x86/core.c
33090 @@ -59,7 +59,7 @@ static struct {
33091 /* Offset from where switcher.S was compiled to where we've copied it */
33092 static unsigned long switcher_offset(void)
33093 {
33094 - return SWITCHER_ADDR - (unsigned long)start_switcher_text;
33095 + return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
33096 }
33097
33098 /* This cpu's struct lguest_pages. */
33099 @@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg_cpu *cpu, struct lguest_pages *pages)
33100 * These copies are pretty cheap, so we do them unconditionally: */
33101 /* Save the current Host top-level page directory.
33102 */
33103 +
33104 +#ifdef CONFIG_PAX_PER_CPU_PGD
33105 + pages->state.host_cr3 = read_cr3();
33106 +#else
33107 pages->state.host_cr3 = __pa(current->mm->pgd);
33108 +#endif
33109 +
33110 /*
33111 * Set up the Guest's page tables to see this CPU's pages (and no
33112 * other CPU's pages).
33113 @@ -472,7 +478,7 @@ void __init lguest_arch_host_init(void)
33114 * compiled-in switcher code and the high-mapped copy we just made.
33115 */
33116 for (i = 0; i < IDT_ENTRIES; i++)
33117 - default_idt_entries[i] += switcher_offset();
33118 + default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
33119
33120 /*
33121 * Set up the Switcher's per-cpu areas.
33122 @@ -555,7 +561,7 @@ void __init lguest_arch_host_init(void)
33123 * it will be undisturbed when we switch. To change %cs and jump we
33124 * need this structure to feed to Intel's "lcall" instruction.
33125 */
33126 - lguest_entry.offset = (long)switch_to_guest + switcher_offset();
33127 + lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
33128 lguest_entry.segment = LGUEST_CS;
33129
33130 /*
33131 diff --git a/drivers/lguest/x86/switcher_32.S b/drivers/lguest/x86/switcher_32.S
33132 index 40634b0..4f5855e 100644
33133 --- a/drivers/lguest/x86/switcher_32.S
33134 +++ b/drivers/lguest/x86/switcher_32.S
33135 @@ -87,6 +87,7 @@
33136 #include <asm/page.h>
33137 #include <asm/segment.h>
33138 #include <asm/lguest.h>
33139 +#include <asm/processor-flags.h>
33140
33141 // We mark the start of the code to copy
33142 // It's placed in .text tho it's never run here
33143 @@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
33144 // Changes type when we load it: damn Intel!
33145 // For after we switch over our page tables
33146 // That entry will be read-only: we'd crash.
33147 +
33148 +#ifdef CONFIG_PAX_KERNEXEC
33149 + mov %cr0, %edx
33150 + xor $X86_CR0_WP, %edx
33151 + mov %edx, %cr0
33152 +#endif
33153 +
33154 movl $(GDT_ENTRY_TSS*8), %edx
33155 ltr %dx
33156
33157 @@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
33158 // Let's clear it again for our return.
33159 // The GDT descriptor of the Host
33160 // Points to the table after two "size" bytes
33161 - movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
33162 + movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
33163 // Clear "used" from type field (byte 5, bit 2)
33164 - andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
33165 + andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
33166 +
33167 +#ifdef CONFIG_PAX_KERNEXEC
33168 + mov %cr0, %eax
33169 + xor $X86_CR0_WP, %eax
33170 + mov %eax, %cr0
33171 +#endif
33172
33173 // Once our page table's switched, the Guest is live!
33174 // The Host fades as we run this final step.
33175 @@ -295,13 +309,12 @@ deliver_to_host:
33176 // I consulted gcc, and it gave
33177 // These instructions, which I gladly credit:
33178 leal (%edx,%ebx,8), %eax
33179 - movzwl (%eax),%edx
33180 - movl 4(%eax), %eax
33181 - xorw %ax, %ax
33182 - orl %eax, %edx
33183 + movl 4(%eax), %edx
33184 + movw (%eax), %dx
33185 // Now the address of the handler's in %edx
33186 // We call it now: its "iret" drops us home.
33187 - jmp *%edx
33188 + ljmp $__KERNEL_CS, $1f
33189 +1: jmp *%edx
33190
33191 // Every interrupt can come to us here
33192 // But we must truly tell each apart.
33193 diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c
33194 index 20e5c2c..9e849a9 100644
33195 --- a/drivers/macintosh/macio_asic.c
33196 +++ b/drivers/macintosh/macio_asic.c
33197 @@ -748,7 +748,7 @@ static void __devexit macio_pci_remove(struct pci_dev* pdev)
33198 * MacIO is matched against any Apple ID, it's probe() function
33199 * will then decide wether it applies or not
33200 */
33201 -static const struct pci_device_id __devinitdata pci_ids [] = { {
33202 +static const struct pci_device_id __devinitconst pci_ids [] = { {
33203 .vendor = PCI_VENDOR_ID_APPLE,
33204 .device = PCI_ANY_ID,
33205 .subvendor = PCI_ANY_ID,
33206 diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
33207 index 15dbe03..743fc65 100644
33208 --- a/drivers/md/bitmap.c
33209 +++ b/drivers/md/bitmap.c
33210 @@ -1786,7 +1786,7 @@ void bitmap_status(struct seq_file *seq, struct bitmap *bitmap)
33211 chunk_kb ? "KB" : "B");
33212 if (bitmap->storage.file) {
33213 seq_printf(seq, ", file: ");
33214 - seq_path(seq, &bitmap->storage.file->f_path, " \t\n");
33215 + seq_path(seq, &bitmap->storage.file->f_path, " \t\n\\");
33216 }
33217
33218 seq_printf(seq, "\n");
33219 diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
33220 index a1a3e6d..1918bfc 100644
33221 --- a/drivers/md/dm-ioctl.c
33222 +++ b/drivers/md/dm-ioctl.c
33223 @@ -1590,7 +1590,7 @@ static int validate_params(uint cmd, struct dm_ioctl *param)
33224 cmd == DM_LIST_VERSIONS_CMD)
33225 return 0;
33226
33227 - if ((cmd == DM_DEV_CREATE_CMD)) {
33228 + if (cmd == DM_DEV_CREATE_CMD) {
33229 if (!*param->name) {
33230 DMWARN("name not supplied when creating device");
33231 return -EINVAL;
33232 diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
33233 index b58b7a3..8018b19 100644
33234 --- a/drivers/md/dm-raid1.c
33235 +++ b/drivers/md/dm-raid1.c
33236 @@ -40,7 +40,7 @@ enum dm_raid1_error {
33237
33238 struct mirror {
33239 struct mirror_set *ms;
33240 - atomic_t error_count;
33241 + atomic_unchecked_t error_count;
33242 unsigned long error_type;
33243 struct dm_dev *dev;
33244 sector_t offset;
33245 @@ -185,7 +185,7 @@ static struct mirror *get_valid_mirror(struct mirror_set *ms)
33246 struct mirror *m;
33247
33248 for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++)
33249 - if (!atomic_read(&m->error_count))
33250 + if (!atomic_read_unchecked(&m->error_count))
33251 return m;
33252
33253 return NULL;
33254 @@ -217,7 +217,7 @@ static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
33255 * simple way to tell if a device has encountered
33256 * errors.
33257 */
33258 - atomic_inc(&m->error_count);
33259 + atomic_inc_unchecked(&m->error_count);
33260
33261 if (test_and_set_bit(error_type, &m->error_type))
33262 return;
33263 @@ -408,7 +408,7 @@ static struct mirror *choose_mirror(struct mirror_set *ms, sector_t sector)
33264 struct mirror *m = get_default_mirror(ms);
33265
33266 do {
33267 - if (likely(!atomic_read(&m->error_count)))
33268 + if (likely(!atomic_read_unchecked(&m->error_count)))
33269 return m;
33270
33271 if (m-- == ms->mirror)
33272 @@ -422,7 +422,7 @@ static int default_ok(struct mirror *m)
33273 {
33274 struct mirror *default_mirror = get_default_mirror(m->ms);
33275
33276 - return !atomic_read(&default_mirror->error_count);
33277 + return !atomic_read_unchecked(&default_mirror->error_count);
33278 }
33279
33280 static int mirror_available(struct mirror_set *ms, struct bio *bio)
33281 @@ -559,7 +559,7 @@ static void do_reads(struct mirror_set *ms, struct bio_list *reads)
33282 */
33283 if (likely(region_in_sync(ms, region, 1)))
33284 m = choose_mirror(ms, bio->bi_sector);
33285 - else if (m && atomic_read(&m->error_count))
33286 + else if (m && atomic_read_unchecked(&m->error_count))
33287 m = NULL;
33288
33289 if (likely(m))
33290 @@ -938,7 +938,7 @@ static int get_mirror(struct mirror_set *ms, struct dm_target *ti,
33291 }
33292
33293 ms->mirror[mirror].ms = ms;
33294 - atomic_set(&(ms->mirror[mirror].error_count), 0);
33295 + atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
33296 ms->mirror[mirror].error_type = 0;
33297 ms->mirror[mirror].offset = offset;
33298
33299 @@ -1352,7 +1352,7 @@ static void mirror_resume(struct dm_target *ti)
33300 */
33301 static char device_status_char(struct mirror *m)
33302 {
33303 - if (!atomic_read(&(m->error_count)))
33304 + if (!atomic_read_unchecked(&(m->error_count)))
33305 return 'A';
33306
33307 return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' :
33308 diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
33309 index 35c94ff..20d4c17 100644
33310 --- a/drivers/md/dm-stripe.c
33311 +++ b/drivers/md/dm-stripe.c
33312 @@ -20,7 +20,7 @@ struct stripe {
33313 struct dm_dev *dev;
33314 sector_t physical_start;
33315
33316 - atomic_t error_count;
33317 + atomic_unchecked_t error_count;
33318 };
33319
33320 struct stripe_c {
33321 @@ -193,7 +193,7 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
33322 kfree(sc);
33323 return r;
33324 }
33325 - atomic_set(&(sc->stripe[i].error_count), 0);
33326 + atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
33327 }
33328
33329 ti->private = sc;
33330 @@ -315,7 +315,7 @@ static int stripe_status(struct dm_target *ti,
33331 DMEMIT("%d ", sc->stripes);
33332 for (i = 0; i < sc->stripes; i++) {
33333 DMEMIT("%s ", sc->stripe[i].dev->name);
33334 - buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
33335 + buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
33336 'D' : 'A';
33337 }
33338 buffer[i] = '\0';
33339 @@ -362,8 +362,8 @@ static int stripe_end_io(struct dm_target *ti, struct bio *bio,
33340 */
33341 for (i = 0; i < sc->stripes; i++)
33342 if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
33343 - atomic_inc(&(sc->stripe[i].error_count));
33344 - if (atomic_read(&(sc->stripe[i].error_count)) <
33345 + atomic_inc_unchecked(&(sc->stripe[i].error_count));
33346 + if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
33347 DM_IO_ERROR_THRESHOLD)
33348 schedule_work(&sc->trigger_event);
33349 }
33350 diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
33351 index 2e227fb..44ead1f 100644
33352 --- a/drivers/md/dm-table.c
33353 +++ b/drivers/md/dm-table.c
33354 @@ -390,7 +390,7 @@ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
33355 if (!dev_size)
33356 return 0;
33357
33358 - if ((start >= dev_size) || (start + len > dev_size)) {
33359 + if ((start >= dev_size) || (len > dev_size - start)) {
33360 DMWARN("%s: %s too small for target: "
33361 "start=%llu, len=%llu, dev_size=%llu",
33362 dm_device_name(ti->table->md), bdevname(bdev, b),
33363 diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
33364 index 3e2907f..c28851a 100644
33365 --- a/drivers/md/dm-thin-metadata.c
33366 +++ b/drivers/md/dm-thin-metadata.c
33367 @@ -432,7 +432,7 @@ static int init_pmd(struct dm_pool_metadata *pmd,
33368
33369 pmd->info.tm = tm;
33370 pmd->info.levels = 2;
33371 - pmd->info.value_type.context = pmd->data_sm;
33372 + pmd->info.value_type.context = (dm_space_map_no_const *)pmd->data_sm;
33373 pmd->info.value_type.size = sizeof(__le64);
33374 pmd->info.value_type.inc = data_block_inc;
33375 pmd->info.value_type.dec = data_block_dec;
33376 @@ -451,7 +451,7 @@ static int init_pmd(struct dm_pool_metadata *pmd,
33377
33378 pmd->bl_info.tm = tm;
33379 pmd->bl_info.levels = 1;
33380 - pmd->bl_info.value_type.context = pmd->data_sm;
33381 + pmd->bl_info.value_type.context = (dm_space_map_no_const *)pmd->data_sm;
33382 pmd->bl_info.value_type.size = sizeof(__le64);
33383 pmd->bl_info.value_type.inc = data_block_inc;
33384 pmd->bl_info.value_type.dec = data_block_dec;
33385 diff --git a/drivers/md/dm.c b/drivers/md/dm.c
33386 index e24143c..ce2f21a1 100644
33387 --- a/drivers/md/dm.c
33388 +++ b/drivers/md/dm.c
33389 @@ -176,9 +176,9 @@ struct mapped_device {
33390 /*
33391 * Event handling.
33392 */
33393 - atomic_t event_nr;
33394 + atomic_unchecked_t event_nr;
33395 wait_queue_head_t eventq;
33396 - atomic_t uevent_seq;
33397 + atomic_unchecked_t uevent_seq;
33398 struct list_head uevent_list;
33399 spinlock_t uevent_lock; /* Protect access to uevent_list */
33400
33401 @@ -1845,8 +1845,8 @@ static struct mapped_device *alloc_dev(int minor)
33402 rwlock_init(&md->map_lock);
33403 atomic_set(&md->holders, 1);
33404 atomic_set(&md->open_count, 0);
33405 - atomic_set(&md->event_nr, 0);
33406 - atomic_set(&md->uevent_seq, 0);
33407 + atomic_set_unchecked(&md->event_nr, 0);
33408 + atomic_set_unchecked(&md->uevent_seq, 0);
33409 INIT_LIST_HEAD(&md->uevent_list);
33410 spin_lock_init(&md->uevent_lock);
33411
33412 @@ -1980,7 +1980,7 @@ static void event_callback(void *context)
33413
33414 dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
33415
33416 - atomic_inc(&md->event_nr);
33417 + atomic_inc_unchecked(&md->event_nr);
33418 wake_up(&md->eventq);
33419 }
33420
33421 @@ -2622,18 +2622,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
33422
33423 uint32_t dm_next_uevent_seq(struct mapped_device *md)
33424 {
33425 - return atomic_add_return(1, &md->uevent_seq);
33426 + return atomic_add_return_unchecked(1, &md->uevent_seq);
33427 }
33428
33429 uint32_t dm_get_event_nr(struct mapped_device *md)
33430 {
33431 - return atomic_read(&md->event_nr);
33432 + return atomic_read_unchecked(&md->event_nr);
33433 }
33434
33435 int dm_wait_event(struct mapped_device *md, int event_nr)
33436 {
33437 return wait_event_interruptible(md->eventq,
33438 - (event_nr != atomic_read(&md->event_nr)));
33439 + (event_nr != atomic_read_unchecked(&md->event_nr)));
33440 }
33441
33442 void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
33443 diff --git a/drivers/md/md.c b/drivers/md/md.c
33444 index d5ab449..7e9ed7b 100644
33445 --- a/drivers/md/md.c
33446 +++ b/drivers/md/md.c
33447 @@ -277,10 +277,10 @@ EXPORT_SYMBOL_GPL(md_trim_bio);
33448 * start build, activate spare
33449 */
33450 static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
33451 -static atomic_t md_event_count;
33452 +static atomic_unchecked_t md_event_count;
33453 void md_new_event(struct mddev *mddev)
33454 {
33455 - atomic_inc(&md_event_count);
33456 + atomic_inc_unchecked(&md_event_count);
33457 wake_up(&md_event_waiters);
33458 }
33459 EXPORT_SYMBOL_GPL(md_new_event);
33460 @@ -290,7 +290,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
33461 */
33462 static void md_new_event_inintr(struct mddev *mddev)
33463 {
33464 - atomic_inc(&md_event_count);
33465 + atomic_inc_unchecked(&md_event_count);
33466 wake_up(&md_event_waiters);
33467 }
33468
33469 @@ -1565,7 +1565,7 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_
33470 if ((le32_to_cpu(sb->feature_map) & MD_FEATURE_RESHAPE_ACTIVE) &&
33471 (le32_to_cpu(sb->feature_map) & MD_FEATURE_NEW_OFFSET))
33472 rdev->new_data_offset += (s32)le32_to_cpu(sb->new_offset);
33473 - atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
33474 + atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
33475
33476 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
33477 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
33478 @@ -1809,7 +1809,7 @@ static void super_1_sync(struct mddev *mddev, struct md_rdev *rdev)
33479 else
33480 sb->resync_offset = cpu_to_le64(0);
33481
33482 - sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
33483 + sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
33484
33485 sb->raid_disks = cpu_to_le32(mddev->raid_disks);
33486 sb->size = cpu_to_le64(mddev->dev_sectors);
33487 @@ -2803,7 +2803,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_show, state_store);
33488 static ssize_t
33489 errors_show(struct md_rdev *rdev, char *page)
33490 {
33491 - return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
33492 + return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
33493 }
33494
33495 static ssize_t
33496 @@ -2812,7 +2812,7 @@ errors_store(struct md_rdev *rdev, const char *buf, size_t len)
33497 char *e;
33498 unsigned long n = simple_strtoul(buf, &e, 10);
33499 if (*buf && (*e == 0 || *e == '\n')) {
33500 - atomic_set(&rdev->corrected_errors, n);
33501 + atomic_set_unchecked(&rdev->corrected_errors, n);
33502 return len;
33503 }
33504 return -EINVAL;
33505 @@ -3259,8 +3259,8 @@ int md_rdev_init(struct md_rdev *rdev)
33506 rdev->sb_loaded = 0;
33507 rdev->bb_page = NULL;
33508 atomic_set(&rdev->nr_pending, 0);
33509 - atomic_set(&rdev->read_errors, 0);
33510 - atomic_set(&rdev->corrected_errors, 0);
33511 + atomic_set_unchecked(&rdev->read_errors, 0);
33512 + atomic_set_unchecked(&rdev->corrected_errors, 0);
33513
33514 INIT_LIST_HEAD(&rdev->same_set);
33515 init_waitqueue_head(&rdev->blocked_wait);
33516 @@ -6997,7 +6997,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
33517
33518 spin_unlock(&pers_lock);
33519 seq_printf(seq, "\n");
33520 - seq->poll_event = atomic_read(&md_event_count);
33521 + seq->poll_event = atomic_read_unchecked(&md_event_count);
33522 return 0;
33523 }
33524 if (v == (void*)2) {
33525 @@ -7100,7 +7100,7 @@ static int md_seq_open(struct inode *inode, struct file *file)
33526 return error;
33527
33528 seq = file->private_data;
33529 - seq->poll_event = atomic_read(&md_event_count);
33530 + seq->poll_event = atomic_read_unchecked(&md_event_count);
33531 return error;
33532 }
33533
33534 @@ -7114,7 +7114,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
33535 /* always allow read */
33536 mask = POLLIN | POLLRDNORM;
33537
33538 - if (seq->poll_event != atomic_read(&md_event_count))
33539 + if (seq->poll_event != atomic_read_unchecked(&md_event_count))
33540 mask |= POLLERR | POLLPRI;
33541 return mask;
33542 }
33543 @@ -7158,7 +7158,7 @@ static int is_mddev_idle(struct mddev *mddev, int init)
33544 struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
33545 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
33546 (int)part_stat_read(&disk->part0, sectors[1]) -
33547 - atomic_read(&disk->sync_io);
33548 + atomic_read_unchecked(&disk->sync_io);
33549 /* sync IO will cause sync_io to increase before the disk_stats
33550 * as sync_io is counted when a request starts, and
33551 * disk_stats is counted when it completes.
33552 diff --git a/drivers/md/md.h b/drivers/md/md.h
33553 index 7b4a3c3..994ad4f 100644
33554 --- a/drivers/md/md.h
33555 +++ b/drivers/md/md.h
33556 @@ -94,13 +94,13 @@ struct md_rdev {
33557 * only maintained for arrays that
33558 * support hot removal
33559 */
33560 - atomic_t read_errors; /* number of consecutive read errors that
33561 + atomic_unchecked_t read_errors; /* number of consecutive read errors that
33562 * we have tried to ignore.
33563 */
33564 struct timespec last_read_error; /* monotonic time since our
33565 * last read error
33566 */
33567 - atomic_t corrected_errors; /* number of corrected read errors,
33568 + atomic_unchecked_t corrected_errors; /* number of corrected read errors,
33569 * for reporting to userspace and storing
33570 * in superblock.
33571 */
33572 @@ -435,7 +435,7 @@ static inline void rdev_dec_pending(struct md_rdev *rdev, struct mddev *mddev)
33573
33574 static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
33575 {
33576 - atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
33577 + atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
33578 }
33579
33580 struct md_personality
33581 diff --git a/drivers/md/persistent-data/dm-space-map-checker.c b/drivers/md/persistent-data/dm-space-map-checker.c
33582 index fc90c11..c8cd9a9 100644
33583 --- a/drivers/md/persistent-data/dm-space-map-checker.c
33584 +++ b/drivers/md/persistent-data/dm-space-map-checker.c
33585 @@ -167,7 +167,7 @@ static int ca_commit(struct count_array *old, struct count_array *new)
33586 /*----------------------------------------------------------------*/
33587
33588 struct sm_checker {
33589 - struct dm_space_map sm;
33590 + dm_space_map_no_const sm;
33591
33592 struct count_array old_counts;
33593 struct count_array counts;
33594 diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c
33595 index 3d0ed53..35dc592 100644
33596 --- a/drivers/md/persistent-data/dm-space-map-disk.c
33597 +++ b/drivers/md/persistent-data/dm-space-map-disk.c
33598 @@ -23,7 +23,7 @@
33599 * Space map interface.
33600 */
33601 struct sm_disk {
33602 - struct dm_space_map sm;
33603 + dm_space_map_no_const sm;
33604
33605 struct ll_disk ll;
33606 struct ll_disk old_ll;
33607 diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
33608 index e89ae5e..062e4c2 100644
33609 --- a/drivers/md/persistent-data/dm-space-map-metadata.c
33610 +++ b/drivers/md/persistent-data/dm-space-map-metadata.c
33611 @@ -43,7 +43,7 @@ struct block_op {
33612 };
33613
33614 struct sm_metadata {
33615 - struct dm_space_map sm;
33616 + dm_space_map_no_const sm;
33617
33618 struct ll_disk ll;
33619 struct ll_disk old_ll;
33620 diff --git a/drivers/md/persistent-data/dm-space-map.h b/drivers/md/persistent-data/dm-space-map.h
33621 index 1cbfc6b..56e1dbb 100644
33622 --- a/drivers/md/persistent-data/dm-space-map.h
33623 +++ b/drivers/md/persistent-data/dm-space-map.h
33624 @@ -60,6 +60,7 @@ struct dm_space_map {
33625 int (*root_size)(struct dm_space_map *sm, size_t *result);
33626 int (*copy_root)(struct dm_space_map *sm, void *copy_to_here_le, size_t len);
33627 };
33628 +typedef struct dm_space_map __no_const dm_space_map_no_const;
33629
33630 /*----------------------------------------------------------------*/
33631
33632 diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
33633 index 53aec45..250851c 100644
33634 --- a/drivers/md/raid1.c
33635 +++ b/drivers/md/raid1.c
33636 @@ -1685,7 +1685,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
33637 if (r1_sync_page_io(rdev, sect, s,
33638 bio->bi_io_vec[idx].bv_page,
33639 READ) != 0)
33640 - atomic_add(s, &rdev->corrected_errors);
33641 + atomic_add_unchecked(s, &rdev->corrected_errors);
33642 }
33643 sectors -= s;
33644 sect += s;
33645 @@ -1907,7 +1907,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk,
33646 test_bit(In_sync, &rdev->flags)) {
33647 if (r1_sync_page_io(rdev, sect, s,
33648 conf->tmppage, READ)) {
33649 - atomic_add(s, &rdev->corrected_errors);
33650 + atomic_add_unchecked(s, &rdev->corrected_errors);
33651 printk(KERN_INFO
33652 "md/raid1:%s: read error corrected "
33653 "(%d sectors at %llu on %s)\n",
33654 diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
33655 index 8da6282..8ec7103 100644
33656 --- a/drivers/md/raid10.c
33657 +++ b/drivers/md/raid10.c
33658 @@ -1784,7 +1784,7 @@ static void end_sync_read(struct bio *bio, int error)
33659 /* The write handler will notice the lack of
33660 * R10BIO_Uptodate and record any errors etc
33661 */
33662 - atomic_add(r10_bio->sectors,
33663 + atomic_add_unchecked(r10_bio->sectors,
33664 &conf->mirrors[d].rdev->corrected_errors);
33665
33666 /* for reconstruct, we always reschedule after a read.
33667 @@ -2133,7 +2133,7 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev)
33668 {
33669 struct timespec cur_time_mon;
33670 unsigned long hours_since_last;
33671 - unsigned int read_errors = atomic_read(&rdev->read_errors);
33672 + unsigned int read_errors = atomic_read_unchecked(&rdev->read_errors);
33673
33674 ktime_get_ts(&cur_time_mon);
33675
33676 @@ -2155,9 +2155,9 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev)
33677 * overflowing the shift of read_errors by hours_since_last.
33678 */
33679 if (hours_since_last >= 8 * sizeof(read_errors))
33680 - atomic_set(&rdev->read_errors, 0);
33681 + atomic_set_unchecked(&rdev->read_errors, 0);
33682 else
33683 - atomic_set(&rdev->read_errors, read_errors >> hours_since_last);
33684 + atomic_set_unchecked(&rdev->read_errors, read_errors >> hours_since_last);
33685 }
33686
33687 static int r10_sync_page_io(struct md_rdev *rdev, sector_t sector,
33688 @@ -2211,8 +2211,8 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
33689 return;
33690
33691 check_decay_read_errors(mddev, rdev);
33692 - atomic_inc(&rdev->read_errors);
33693 - if (atomic_read(&rdev->read_errors) > max_read_errors) {
33694 + atomic_inc_unchecked(&rdev->read_errors);
33695 + if (atomic_read_unchecked(&rdev->read_errors) > max_read_errors) {
33696 char b[BDEVNAME_SIZE];
33697 bdevname(rdev->bdev, b);
33698
33699 @@ -2220,7 +2220,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
33700 "md/raid10:%s: %s: Raid device exceeded "
33701 "read_error threshold [cur %d:max %d]\n",
33702 mdname(mddev), b,
33703 - atomic_read(&rdev->read_errors), max_read_errors);
33704 + atomic_read_unchecked(&rdev->read_errors), max_read_errors);
33705 printk(KERN_NOTICE
33706 "md/raid10:%s: %s: Failing raid device\n",
33707 mdname(mddev), b);
33708 @@ -2375,7 +2375,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
33709 sect +
33710 choose_data_offset(r10_bio, rdev)),
33711 bdevname(rdev->bdev, b));
33712 - atomic_add(s, &rdev->corrected_errors);
33713 + atomic_add_unchecked(s, &rdev->corrected_errors);
33714 }
33715
33716 rdev_dec_pending(rdev, mddev);
33717 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
33718 index 04348d7..62a4b9b 100644
33719 --- a/drivers/md/raid5.c
33720 +++ b/drivers/md/raid5.c
33721 @@ -1736,19 +1736,19 @@ static void raid5_end_read_request(struct bio * bi, int error)
33722 mdname(conf->mddev), STRIPE_SECTORS,
33723 (unsigned long long)s,
33724 bdevname(rdev->bdev, b));
33725 - atomic_add(STRIPE_SECTORS, &rdev->corrected_errors);
33726 + atomic_add_unchecked(STRIPE_SECTORS, &rdev->corrected_errors);
33727 clear_bit(R5_ReadError, &sh->dev[i].flags);
33728 clear_bit(R5_ReWrite, &sh->dev[i].flags);
33729 }
33730 - if (atomic_read(&rdev->read_errors))
33731 - atomic_set(&rdev->read_errors, 0);
33732 + if (atomic_read_unchecked(&rdev->read_errors))
33733 + atomic_set_unchecked(&rdev->read_errors, 0);
33734 } else {
33735 const char *bdn = bdevname(rdev->bdev, b);
33736 int retry = 0;
33737 int set_bad = 0;
33738
33739 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
33740 - atomic_inc(&rdev->read_errors);
33741 + atomic_inc_unchecked(&rdev->read_errors);
33742 if (test_bit(R5_ReadRepl, &sh->dev[i].flags))
33743 printk_ratelimited(
33744 KERN_WARNING
33745 @@ -1776,7 +1776,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
33746 mdname(conf->mddev),
33747 (unsigned long long)s,
33748 bdn);
33749 - } else if (atomic_read(&rdev->read_errors)
33750 + } else if (atomic_read_unchecked(&rdev->read_errors)
33751 > conf->max_nr_stripes)
33752 printk(KERN_WARNING
33753 "md/raid:%s: Too many read errors, failing device %s.\n",
33754 diff --git a/drivers/media/dvb/ddbridge/ddbridge-core.c b/drivers/media/dvb/ddbridge/ddbridge-core.c
33755 index 131b938..8572ed1 100644
33756 --- a/drivers/media/dvb/ddbridge/ddbridge-core.c
33757 +++ b/drivers/media/dvb/ddbridge/ddbridge-core.c
33758 @@ -1678,7 +1678,7 @@ static struct ddb_info ddb_v6 = {
33759 .subvendor = _subvend, .subdevice = _subdev, \
33760 .driver_data = (unsigned long)&_driverdata }
33761
33762 -static const struct pci_device_id ddb_id_tbl[] __devinitdata = {
33763 +static const struct pci_device_id ddb_id_tbl[] __devinitconst = {
33764 DDB_ID(DDVID, 0x0002, DDVID, 0x0001, ddb_octopus),
33765 DDB_ID(DDVID, 0x0003, DDVID, 0x0001, ddb_octopus),
33766 DDB_ID(DDVID, 0x0003, DDVID, 0x0002, ddb_octopus_le),
33767 diff --git a/drivers/media/dvb/dvb-core/dvb_demux.h b/drivers/media/dvb/dvb-core/dvb_demux.h
33768 index fa7188a..04a045e 100644
33769 --- a/drivers/media/dvb/dvb-core/dvb_demux.h
33770 +++ b/drivers/media/dvb/dvb-core/dvb_demux.h
33771 @@ -73,7 +73,7 @@ struct dvb_demux_feed {
33772 union {
33773 dmx_ts_cb ts;
33774 dmx_section_cb sec;
33775 - } cb;
33776 + } __no_const cb;
33777
33778 struct dvb_demux *demux;
33779 void *priv;
33780 diff --git a/drivers/media/dvb/dvb-core/dvbdev.c b/drivers/media/dvb/dvb-core/dvbdev.c
33781 index 39eab73..60033e7 100644
33782 --- a/drivers/media/dvb/dvb-core/dvbdev.c
33783 +++ b/drivers/media/dvb/dvb-core/dvbdev.c
33784 @@ -192,7 +192,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
33785 const struct dvb_device *template, void *priv, int type)
33786 {
33787 struct dvb_device *dvbdev;
33788 - struct file_operations *dvbdevfops;
33789 + file_operations_no_const *dvbdevfops;
33790 struct device *clsdev;
33791 int minor;
33792 int id;
33793 diff --git a/drivers/media/dvb/dvb-usb/az6007.c b/drivers/media/dvb/dvb-usb/az6007.c
33794 index 4008b9c..ce714f5 100644
33795 --- a/drivers/media/dvb/dvb-usb/az6007.c
33796 +++ b/drivers/media/dvb/dvb-usb/az6007.c
33797 @@ -590,7 +590,7 @@ static int az6007_read_mac_addr(struct dvb_usb_device *d, u8 mac[6])
33798 int ret;
33799
33800 ret = az6007_read(d, AZ6007_READ_DATA, 6, 0, st->data, 6);
33801 - memcpy(mac, st->data, sizeof(mac));
33802 + memcpy(mac, st->data, 6);
33803
33804 if (ret > 0)
33805 deb_info("%s: mac is %02x:%02x:%02x:%02x:%02x:%02x\n",
33806 diff --git a/drivers/media/dvb/dvb-usb/cxusb.c b/drivers/media/dvb/dvb-usb/cxusb.c
33807 index 3940bb0..fb3952a 100644
33808 --- a/drivers/media/dvb/dvb-usb/cxusb.c
33809 +++ b/drivers/media/dvb/dvb-usb/cxusb.c
33810 @@ -1068,7 +1068,7 @@ static struct dib0070_config dib7070p_dib0070_config = {
33811
33812 struct dib0700_adapter_state {
33813 int (*set_param_save) (struct dvb_frontend *);
33814 -};
33815 +} __no_const;
33816
33817 static int dib7070_set_param_override(struct dvb_frontend *fe)
33818 {
33819 diff --git a/drivers/media/dvb/dvb-usb/dw2102.c b/drivers/media/dvb/dvb-usb/dw2102.c
33820 index 9382895..ac8093c 100644
33821 --- a/drivers/media/dvb/dvb-usb/dw2102.c
33822 +++ b/drivers/media/dvb/dvb-usb/dw2102.c
33823 @@ -95,7 +95,7 @@ struct su3000_state {
33824
33825 struct s6x0_state {
33826 int (*old_set_voltage)(struct dvb_frontend *f, fe_sec_voltage_t v);
33827 -};
33828 +} __no_const;
33829
33830 /* debug */
33831 static int dvb_usb_dw2102_debug;
33832 diff --git a/drivers/media/dvb/frontends/dib3000.h b/drivers/media/dvb/frontends/dib3000.h
33833 index 404f63a..4796533 100644
33834 --- a/drivers/media/dvb/frontends/dib3000.h
33835 +++ b/drivers/media/dvb/frontends/dib3000.h
33836 @@ -39,7 +39,7 @@ struct dib_fe_xfer_ops
33837 int (*fifo_ctrl)(struct dvb_frontend *fe, int onoff);
33838 int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff);
33839 int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl);
33840 -};
33841 +} __no_const;
33842
33843 #if defined(CONFIG_DVB_DIB3000MB) || (defined(CONFIG_DVB_DIB3000MB_MODULE) && defined(MODULE))
33844 extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
33845 diff --git a/drivers/media/dvb/ngene/ngene-cards.c b/drivers/media/dvb/ngene/ngene-cards.c
33846 index 7539a5d..06531a6 100644
33847 --- a/drivers/media/dvb/ngene/ngene-cards.c
33848 +++ b/drivers/media/dvb/ngene/ngene-cards.c
33849 @@ -478,7 +478,7 @@ static struct ngene_info ngene_info_m780 = {
33850
33851 /****************************************************************************/
33852
33853 -static const struct pci_device_id ngene_id_tbl[] __devinitdata = {
33854 +static const struct pci_device_id ngene_id_tbl[] __devinitconst = {
33855 NGENE_ID(0x18c3, 0xabc3, ngene_info_cineS2),
33856 NGENE_ID(0x18c3, 0xabc4, ngene_info_cineS2),
33857 NGENE_ID(0x18c3, 0xdb01, ngene_info_satixS2),
33858 diff --git a/drivers/media/radio/radio-cadet.c b/drivers/media/radio/radio-cadet.c
33859 index 16a089f..1661b11 100644
33860 --- a/drivers/media/radio/radio-cadet.c
33861 +++ b/drivers/media/radio/radio-cadet.c
33862 @@ -326,6 +326,8 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
33863 unsigned char readbuf[RDS_BUFFER];
33864 int i = 0;
33865
33866 + if (count > RDS_BUFFER)
33867 + return -EFAULT;
33868 mutex_lock(&dev->lock);
33869 if (dev->rdsstat == 0) {
33870 dev->rdsstat = 1;
33871 @@ -347,7 +349,7 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
33872 readbuf[i++] = dev->rdsbuf[dev->rdsout++];
33873 mutex_unlock(&dev->lock);
33874
33875 - if (copy_to_user(data, readbuf, i))
33876 + if (i > sizeof(readbuf) || copy_to_user(data, readbuf, i))
33877 return -EFAULT;
33878 return i;
33879 }
33880 diff --git a/drivers/media/video/au0828/au0828.h b/drivers/media/video/au0828/au0828.h
33881 index 9cde353..8c6a1c3 100644
33882 --- a/drivers/media/video/au0828/au0828.h
33883 +++ b/drivers/media/video/au0828/au0828.h
33884 @@ -191,7 +191,7 @@ struct au0828_dev {
33885
33886 /* I2C */
33887 struct i2c_adapter i2c_adap;
33888 - struct i2c_algorithm i2c_algo;
33889 + i2c_algorithm_no_const i2c_algo;
33890 struct i2c_client i2c_client;
33891 u32 i2c_rc;
33892
33893 diff --git a/drivers/media/video/cx88/cx88-alsa.c b/drivers/media/video/cx88/cx88-alsa.c
33894 index 04bf662..e0ac026 100644
33895 --- a/drivers/media/video/cx88/cx88-alsa.c
33896 +++ b/drivers/media/video/cx88/cx88-alsa.c
33897 @@ -766,7 +766,7 @@ static struct snd_kcontrol_new snd_cx88_alc_switch = {
33898 * Only boards with eeprom and byte 1 at eeprom=1 have it
33899 */
33900
33901 -static const struct pci_device_id const cx88_audio_pci_tbl[] __devinitdata = {
33902 +static const struct pci_device_id const cx88_audio_pci_tbl[] __devinitconst = {
33903 {0x14f1,0x8801,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
33904 {0x14f1,0x8811,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
33905 {0, }
33906 diff --git a/drivers/media/video/omap/omap_vout.c b/drivers/media/video/omap/omap_vout.c
33907 index 88cf9d9..bbc4b2c 100644
33908 --- a/drivers/media/video/omap/omap_vout.c
33909 +++ b/drivers/media/video/omap/omap_vout.c
33910 @@ -64,7 +64,6 @@ enum omap_vout_channels {
33911 OMAP_VIDEO2,
33912 };
33913
33914 -static struct videobuf_queue_ops video_vbq_ops;
33915 /* Variables configurable through module params*/
33916 static u32 video1_numbuffers = 3;
33917 static u32 video2_numbuffers = 3;
33918 @@ -1000,6 +999,12 @@ static int omap_vout_open(struct file *file)
33919 {
33920 struct videobuf_queue *q;
33921 struct omap_vout_device *vout = NULL;
33922 + static struct videobuf_queue_ops video_vbq_ops = {
33923 + .buf_setup = omap_vout_buffer_setup,
33924 + .buf_prepare = omap_vout_buffer_prepare,
33925 + .buf_release = omap_vout_buffer_release,
33926 + .buf_queue = omap_vout_buffer_queue,
33927 + };
33928
33929 vout = video_drvdata(file);
33930 v4l2_dbg(1, debug, &vout->vid_dev->v4l2_dev, "Entering %s\n", __func__);
33931 @@ -1017,10 +1022,6 @@ static int omap_vout_open(struct file *file)
33932 vout->type = V4L2_BUF_TYPE_VIDEO_OUTPUT;
33933
33934 q = &vout->vbq;
33935 - video_vbq_ops.buf_setup = omap_vout_buffer_setup;
33936 - video_vbq_ops.buf_prepare = omap_vout_buffer_prepare;
33937 - video_vbq_ops.buf_release = omap_vout_buffer_release;
33938 - video_vbq_ops.buf_queue = omap_vout_buffer_queue;
33939 spin_lock_init(&vout->vbq_lock);
33940
33941 videobuf_queue_dma_contig_init(q, &video_vbq_ops, q->dev,
33942 diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
33943 index 036952f..80d356d 100644
33944 --- a/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
33945 +++ b/drivers/media/video/pvrusb2/pvrusb2-hdw-internal.h
33946 @@ -196,7 +196,7 @@ struct pvr2_hdw {
33947
33948 /* I2C stuff */
33949 struct i2c_adapter i2c_adap;
33950 - struct i2c_algorithm i2c_algo;
33951 + i2c_algorithm_no_const i2c_algo;
33952 pvr2_i2c_func i2c_func[PVR2_I2C_FUNC_CNT];
33953 int i2c_cx25840_hack_state;
33954 int i2c_linked;
33955 diff --git a/drivers/media/video/timblogiw.c b/drivers/media/video/timblogiw.c
33956 index 02194c0..091733b 100644
33957 --- a/drivers/media/video/timblogiw.c
33958 +++ b/drivers/media/video/timblogiw.c
33959 @@ -745,7 +745,7 @@ static int timblogiw_mmap(struct file *file, struct vm_area_struct *vma)
33960
33961 /* Platform device functions */
33962
33963 -static __devinitconst struct v4l2_ioctl_ops timblogiw_ioctl_ops = {
33964 +static __devinitconst v4l2_ioctl_ops_no_const timblogiw_ioctl_ops = {
33965 .vidioc_querycap = timblogiw_querycap,
33966 .vidioc_enum_fmt_vid_cap = timblogiw_enum_fmt,
33967 .vidioc_g_fmt_vid_cap = timblogiw_g_fmt,
33968 @@ -767,7 +767,7 @@ static __devinitconst struct v4l2_ioctl_ops timblogiw_ioctl_ops = {
33969 .vidioc_enum_framesizes = timblogiw_enum_framesizes,
33970 };
33971
33972 -static __devinitconst struct v4l2_file_operations timblogiw_fops = {
33973 +static __devinitconst v4l2_file_operations_no_const timblogiw_fops = {
33974 .owner = THIS_MODULE,
33975 .open = timblogiw_open,
33976 .release = timblogiw_close,
33977 diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
33978 index d99db56..a16b959 100644
33979 --- a/drivers/message/fusion/mptbase.c
33980 +++ b/drivers/message/fusion/mptbase.c
33981 @@ -6751,8 +6751,13 @@ static int mpt_iocinfo_proc_show(struct seq_file *m, void *v)
33982 seq_printf(m, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
33983 seq_printf(m, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
33984
33985 +#ifdef CONFIG_GRKERNSEC_HIDESYM
33986 + seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n", NULL, NULL);
33987 +#else
33988 seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
33989 (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
33990 +#endif
33991 +
33992 /*
33993 * Rounding UP to nearest 4-kB boundary here...
33994 */
33995 diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
33996 index 551262e..7551198 100644
33997 --- a/drivers/message/fusion/mptsas.c
33998 +++ b/drivers/message/fusion/mptsas.c
33999 @@ -446,6 +446,23 @@ mptsas_is_end_device(struct mptsas_devinfo * attached)
34000 return 0;
34001 }
34002
34003 +static inline void
34004 +mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
34005 +{
34006 + if (phy_info->port_details) {
34007 + phy_info->port_details->rphy = rphy;
34008 + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
34009 + ioc->name, rphy));
34010 + }
34011 +
34012 + if (rphy) {
34013 + dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
34014 + &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
34015 + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
34016 + ioc->name, rphy, rphy->dev.release));
34017 + }
34018 +}
34019 +
34020 /* no mutex */
34021 static void
34022 mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
34023 @@ -484,23 +501,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *phy_info)
34024 return NULL;
34025 }
34026
34027 -static inline void
34028 -mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
34029 -{
34030 - if (phy_info->port_details) {
34031 - phy_info->port_details->rphy = rphy;
34032 - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
34033 - ioc->name, rphy));
34034 - }
34035 -
34036 - if (rphy) {
34037 - dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
34038 - &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
34039 - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
34040 - ioc->name, rphy, rphy->dev.release));
34041 - }
34042 -}
34043 -
34044 static inline struct sas_port *
34045 mptsas_get_port(struct mptsas_phyinfo *phy_info)
34046 {
34047 diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
34048 index 0c3ced7..1fe34ec 100644
34049 --- a/drivers/message/fusion/mptscsih.c
34050 +++ b/drivers/message/fusion/mptscsih.c
34051 @@ -1270,15 +1270,16 @@ mptscsih_info(struct Scsi_Host *SChost)
34052
34053 h = shost_priv(SChost);
34054
34055 - if (h) {
34056 - if (h->info_kbuf == NULL)
34057 - if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
34058 - return h->info_kbuf;
34059 - h->info_kbuf[0] = '\0';
34060 + if (!h)
34061 + return NULL;
34062
34063 - mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
34064 - h->info_kbuf[size-1] = '\0';
34065 - }
34066 + if (h->info_kbuf == NULL)
34067 + if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
34068 + return h->info_kbuf;
34069 + h->info_kbuf[0] = '\0';
34070 +
34071 + mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
34072 + h->info_kbuf[size-1] = '\0';
34073
34074 return h->info_kbuf;
34075 }
34076 diff --git a/drivers/message/i2o/i2o_proc.c b/drivers/message/i2o/i2o_proc.c
34077 index 506c36f..b137580 100644
34078 --- a/drivers/message/i2o/i2o_proc.c
34079 +++ b/drivers/message/i2o/i2o_proc.c
34080 @@ -255,13 +255,6 @@ static char *scsi_devices[] = {
34081 "Array Controller Device"
34082 };
34083
34084 -static char *chtostr(u8 * chars, int n)
34085 -{
34086 - char tmp[256];
34087 - tmp[0] = 0;
34088 - return strncat(tmp, (char *)chars, n);
34089 -}
34090 -
34091 static int i2o_report_query_status(struct seq_file *seq, int block_status,
34092 char *group)
34093 {
34094 @@ -825,8 +818,7 @@ static int i2o_seq_show_ddm_table(struct seq_file *seq, void *v)
34095
34096 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
34097 seq_printf(seq, "%-#8x", ddm_table.module_id);
34098 - seq_printf(seq, "%-29s",
34099 - chtostr(ddm_table.module_name_version, 28));
34100 + seq_printf(seq, "%-.28s", ddm_table.module_name_version);
34101 seq_printf(seq, "%9d ", ddm_table.data_size);
34102 seq_printf(seq, "%8d", ddm_table.code_size);
34103
34104 @@ -927,8 +919,8 @@ static int i2o_seq_show_drivers_stored(struct seq_file *seq, void *v)
34105
34106 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
34107 seq_printf(seq, "%-#8x", dst->module_id);
34108 - seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
34109 - seq_printf(seq, "%-9s", chtostr(dst->date, 8));
34110 + seq_printf(seq, "%-.28s", dst->module_name_version);
34111 + seq_printf(seq, "%-.8s", dst->date);
34112 seq_printf(seq, "%8d ", dst->module_size);
34113 seq_printf(seq, "%8d ", dst->mpb_size);
34114 seq_printf(seq, "0x%04x", dst->module_flags);
34115 @@ -1259,14 +1251,10 @@ static int i2o_seq_show_dev_identity(struct seq_file *seq, void *v)
34116 seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
34117 seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
34118 seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
34119 - seq_printf(seq, "Vendor info : %s\n",
34120 - chtostr((u8 *) (work32 + 2), 16));
34121 - seq_printf(seq, "Product info : %s\n",
34122 - chtostr((u8 *) (work32 + 6), 16));
34123 - seq_printf(seq, "Description : %s\n",
34124 - chtostr((u8 *) (work32 + 10), 16));
34125 - seq_printf(seq, "Product rev. : %s\n",
34126 - chtostr((u8 *) (work32 + 14), 8));
34127 + seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
34128 + seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
34129 + seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
34130 + seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
34131
34132 seq_printf(seq, "Serial number : ");
34133 print_serial_number(seq, (u8 *) (work32 + 16),
34134 @@ -1311,10 +1299,8 @@ static int i2o_seq_show_ddm_identity(struct seq_file *seq, void *v)
34135 }
34136
34137 seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
34138 - seq_printf(seq, "Module name : %s\n",
34139 - chtostr(result.module_name, 24));
34140 - seq_printf(seq, "Module revision : %s\n",
34141 - chtostr(result.module_rev, 8));
34142 + seq_printf(seq, "Module name : %.24s\n", result.module_name);
34143 + seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
34144
34145 seq_printf(seq, "Serial number : ");
34146 print_serial_number(seq, result.serial_number, sizeof(result) - 36);
34147 @@ -1345,14 +1331,10 @@ static int i2o_seq_show_uinfo(struct seq_file *seq, void *v)
34148 return 0;
34149 }
34150
34151 - seq_printf(seq, "Device name : %s\n",
34152 - chtostr(result.device_name, 64));
34153 - seq_printf(seq, "Service name : %s\n",
34154 - chtostr(result.service_name, 64));
34155 - seq_printf(seq, "Physical name : %s\n",
34156 - chtostr(result.physical_location, 64));
34157 - seq_printf(seq, "Instance number : %s\n",
34158 - chtostr(result.instance_number, 4));
34159 + seq_printf(seq, "Device name : %.64s\n", result.device_name);
34160 + seq_printf(seq, "Service name : %.64s\n", result.service_name);
34161 + seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
34162 + seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
34163
34164 return 0;
34165 }
34166 diff --git a/drivers/message/i2o/iop.c b/drivers/message/i2o/iop.c
34167 index a8c08f3..155fe3d 100644
34168 --- a/drivers/message/i2o/iop.c
34169 +++ b/drivers/message/i2o/iop.c
34170 @@ -111,10 +111,10 @@ u32 i2o_cntxt_list_add(struct i2o_controller * c, void *ptr)
34171
34172 spin_lock_irqsave(&c->context_list_lock, flags);
34173
34174 - if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
34175 - atomic_inc(&c->context_list_counter);
34176 + if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
34177 + atomic_inc_unchecked(&c->context_list_counter);
34178
34179 - entry->context = atomic_read(&c->context_list_counter);
34180 + entry->context = atomic_read_unchecked(&c->context_list_counter);
34181
34182 list_add(&entry->list, &c->context_list);
34183
34184 @@ -1077,7 +1077,7 @@ struct i2o_controller *i2o_iop_alloc(void)
34185
34186 #if BITS_PER_LONG == 64
34187 spin_lock_init(&c->context_list_lock);
34188 - atomic_set(&c->context_list_counter, 0);
34189 + atomic_set_unchecked(&c->context_list_counter, 0);
34190 INIT_LIST_HEAD(&c->context_list);
34191 #endif
34192
34193 diff --git a/drivers/mfd/abx500-core.c b/drivers/mfd/abx500-core.c
34194 index 7ce65f4..e66e9bc 100644
34195 --- a/drivers/mfd/abx500-core.c
34196 +++ b/drivers/mfd/abx500-core.c
34197 @@ -15,7 +15,7 @@ static LIST_HEAD(abx500_list);
34198
34199 struct abx500_device_entry {
34200 struct list_head list;
34201 - struct abx500_ops ops;
34202 + abx500_ops_no_const ops;
34203 struct device *dev;
34204 };
34205
34206 diff --git a/drivers/mfd/janz-cmodio.c b/drivers/mfd/janz-cmodio.c
34207 index 2ea9998..51dabee 100644
34208 --- a/drivers/mfd/janz-cmodio.c
34209 +++ b/drivers/mfd/janz-cmodio.c
34210 @@ -13,6 +13,7 @@
34211
34212 #include <linux/kernel.h>
34213 #include <linux/module.h>
34214 +#include <linux/slab.h>
34215 #include <linux/init.h>
34216 #include <linux/pci.h>
34217 #include <linux/interrupt.h>
34218 diff --git a/drivers/misc/lis3lv02d/lis3lv02d.c b/drivers/misc/lis3lv02d/lis3lv02d.c
34219 index a981e2a..5ca0c8b 100644
34220 --- a/drivers/misc/lis3lv02d/lis3lv02d.c
34221 +++ b/drivers/misc/lis3lv02d/lis3lv02d.c
34222 @@ -466,7 +466,7 @@ static irqreturn_t lis302dl_interrupt(int irq, void *data)
34223 * the lid is closed. This leads to interrupts as soon as a little move
34224 * is done.
34225 */
34226 - atomic_inc(&lis3->count);
34227 + atomic_inc_unchecked(&lis3->count);
34228
34229 wake_up_interruptible(&lis3->misc_wait);
34230 kill_fasync(&lis3->async_queue, SIGIO, POLL_IN);
34231 @@ -552,7 +552,7 @@ static int lis3lv02d_misc_open(struct inode *inode, struct file *file)
34232 if (lis3->pm_dev)
34233 pm_runtime_get_sync(lis3->pm_dev);
34234
34235 - atomic_set(&lis3->count, 0);
34236 + atomic_set_unchecked(&lis3->count, 0);
34237 return 0;
34238 }
34239
34240 @@ -585,7 +585,7 @@ static ssize_t lis3lv02d_misc_read(struct file *file, char __user *buf,
34241 add_wait_queue(&lis3->misc_wait, &wait);
34242 while (true) {
34243 set_current_state(TASK_INTERRUPTIBLE);
34244 - data = atomic_xchg(&lis3->count, 0);
34245 + data = atomic_xchg_unchecked(&lis3->count, 0);
34246 if (data)
34247 break;
34248
34249 @@ -626,7 +626,7 @@ static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
34250 struct lis3lv02d, miscdev);
34251
34252 poll_wait(file, &lis3->misc_wait, wait);
34253 - if (atomic_read(&lis3->count))
34254 + if (atomic_read_unchecked(&lis3->count))
34255 return POLLIN | POLLRDNORM;
34256 return 0;
34257 }
34258 diff --git a/drivers/misc/lis3lv02d/lis3lv02d.h b/drivers/misc/lis3lv02d/lis3lv02d.h
34259 index 2b1482a..5d33616 100644
34260 --- a/drivers/misc/lis3lv02d/lis3lv02d.h
34261 +++ b/drivers/misc/lis3lv02d/lis3lv02d.h
34262 @@ -266,7 +266,7 @@ struct lis3lv02d {
34263 struct input_polled_dev *idev; /* input device */
34264 struct platform_device *pdev; /* platform device */
34265 struct regulator_bulk_data regulators[2];
34266 - atomic_t count; /* interrupt count after last read */
34267 + atomic_unchecked_t count; /* interrupt count after last read */
34268 union axis_conversion ac; /* hw -> logical axis */
34269 int mapped_btns[3];
34270
34271 diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
34272 index 28adefe..08aad69 100644
34273 --- a/drivers/misc/lkdtm.c
34274 +++ b/drivers/misc/lkdtm.c
34275 @@ -477,6 +477,8 @@ static ssize_t lkdtm_debugfs_read(struct file *f, char __user *user_buf,
34276 int i, n, out;
34277
34278 buf = (char *)__get_free_page(GFP_KERNEL);
34279 + if (buf == NULL)
34280 + return -ENOMEM;
34281
34282 n = snprintf(buf, PAGE_SIZE, "Available crash types:\n");
34283 for (i = 0; i < ARRAY_SIZE(cp_type); i++)
34284 diff --git a/drivers/misc/sgi-gru/gruhandles.c b/drivers/misc/sgi-gru/gruhandles.c
34285 index 2f30bad..c4c13d0 100644
34286 --- a/drivers/misc/sgi-gru/gruhandles.c
34287 +++ b/drivers/misc/sgi-gru/gruhandles.c
34288 @@ -44,8 +44,8 @@ static void update_mcs_stats(enum mcs_op op, unsigned long clks)
34289 unsigned long nsec;
34290
34291 nsec = CLKS2NSEC(clks);
34292 - atomic_long_inc(&mcs_op_statistics[op].count);
34293 - atomic_long_add(nsec, &mcs_op_statistics[op].total);
34294 + atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
34295 + atomic_long_add_unchecked(nsec, &mcs_op_statistics[op].total);
34296 if (mcs_op_statistics[op].max < nsec)
34297 mcs_op_statistics[op].max = nsec;
34298 }
34299 diff --git a/drivers/misc/sgi-gru/gruprocfs.c b/drivers/misc/sgi-gru/gruprocfs.c
34300 index 950dbe9..eeef0f8 100644
34301 --- a/drivers/misc/sgi-gru/gruprocfs.c
34302 +++ b/drivers/misc/sgi-gru/gruprocfs.c
34303 @@ -32,9 +32,9 @@
34304
34305 #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
34306
34307 -static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
34308 +static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
34309 {
34310 - unsigned long val = atomic_long_read(v);
34311 + unsigned long val = atomic_long_read_unchecked(v);
34312
34313 seq_printf(s, "%16lu %s\n", val, id);
34314 }
34315 @@ -134,8 +134,8 @@ static int mcs_statistics_show(struct seq_file *s, void *p)
34316
34317 seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks");
34318 for (op = 0; op < mcsop_last; op++) {
34319 - count = atomic_long_read(&mcs_op_statistics[op].count);
34320 - total = atomic_long_read(&mcs_op_statistics[op].total);
34321 + count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
34322 + total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
34323 max = mcs_op_statistics[op].max;
34324 seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
34325 count ? total / count : 0, max);
34326 diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
34327 index 5c3ce24..4915ccb 100644
34328 --- a/drivers/misc/sgi-gru/grutables.h
34329 +++ b/drivers/misc/sgi-gru/grutables.h
34330 @@ -167,82 +167,82 @@ extern unsigned int gru_max_gids;
34331 * GRU statistics.
34332 */
34333 struct gru_stats_s {
34334 - atomic_long_t vdata_alloc;
34335 - atomic_long_t vdata_free;
34336 - atomic_long_t gts_alloc;
34337 - atomic_long_t gts_free;
34338 - atomic_long_t gms_alloc;
34339 - atomic_long_t gms_free;
34340 - atomic_long_t gts_double_allocate;
34341 - atomic_long_t assign_context;
34342 - atomic_long_t assign_context_failed;
34343 - atomic_long_t free_context;
34344 - atomic_long_t load_user_context;
34345 - atomic_long_t load_kernel_context;
34346 - atomic_long_t lock_kernel_context;
34347 - atomic_long_t unlock_kernel_context;
34348 - atomic_long_t steal_user_context;
34349 - atomic_long_t steal_kernel_context;
34350 - atomic_long_t steal_context_failed;
34351 - atomic_long_t nopfn;
34352 - atomic_long_t asid_new;
34353 - atomic_long_t asid_next;
34354 - atomic_long_t asid_wrap;
34355 - atomic_long_t asid_reuse;
34356 - atomic_long_t intr;
34357 - atomic_long_t intr_cbr;
34358 - atomic_long_t intr_tfh;
34359 - atomic_long_t intr_spurious;
34360 - atomic_long_t intr_mm_lock_failed;
34361 - atomic_long_t call_os;
34362 - atomic_long_t call_os_wait_queue;
34363 - atomic_long_t user_flush_tlb;
34364 - atomic_long_t user_unload_context;
34365 - atomic_long_t user_exception;
34366 - atomic_long_t set_context_option;
34367 - atomic_long_t check_context_retarget_intr;
34368 - atomic_long_t check_context_unload;
34369 - atomic_long_t tlb_dropin;
34370 - atomic_long_t tlb_preload_page;
34371 - atomic_long_t tlb_dropin_fail_no_asid;
34372 - atomic_long_t tlb_dropin_fail_upm;
34373 - atomic_long_t tlb_dropin_fail_invalid;
34374 - atomic_long_t tlb_dropin_fail_range_active;
34375 - atomic_long_t tlb_dropin_fail_idle;
34376 - atomic_long_t tlb_dropin_fail_fmm;
34377 - atomic_long_t tlb_dropin_fail_no_exception;
34378 - atomic_long_t tfh_stale_on_fault;
34379 - atomic_long_t mmu_invalidate_range;
34380 - atomic_long_t mmu_invalidate_page;
34381 - atomic_long_t flush_tlb;
34382 - atomic_long_t flush_tlb_gru;
34383 - atomic_long_t flush_tlb_gru_tgh;
34384 - atomic_long_t flush_tlb_gru_zero_asid;
34385 + atomic_long_unchecked_t vdata_alloc;
34386 + atomic_long_unchecked_t vdata_free;
34387 + atomic_long_unchecked_t gts_alloc;
34388 + atomic_long_unchecked_t gts_free;
34389 + atomic_long_unchecked_t gms_alloc;
34390 + atomic_long_unchecked_t gms_free;
34391 + atomic_long_unchecked_t gts_double_allocate;
34392 + atomic_long_unchecked_t assign_context;
34393 + atomic_long_unchecked_t assign_context_failed;
34394 + atomic_long_unchecked_t free_context;
34395 + atomic_long_unchecked_t load_user_context;
34396 + atomic_long_unchecked_t load_kernel_context;
34397 + atomic_long_unchecked_t lock_kernel_context;
34398 + atomic_long_unchecked_t unlock_kernel_context;
34399 + atomic_long_unchecked_t steal_user_context;
34400 + atomic_long_unchecked_t steal_kernel_context;
34401 + atomic_long_unchecked_t steal_context_failed;
34402 + atomic_long_unchecked_t nopfn;
34403 + atomic_long_unchecked_t asid_new;
34404 + atomic_long_unchecked_t asid_next;
34405 + atomic_long_unchecked_t asid_wrap;
34406 + atomic_long_unchecked_t asid_reuse;
34407 + atomic_long_unchecked_t intr;
34408 + atomic_long_unchecked_t intr_cbr;
34409 + atomic_long_unchecked_t intr_tfh;
34410 + atomic_long_unchecked_t intr_spurious;
34411 + atomic_long_unchecked_t intr_mm_lock_failed;
34412 + atomic_long_unchecked_t call_os;
34413 + atomic_long_unchecked_t call_os_wait_queue;
34414 + atomic_long_unchecked_t user_flush_tlb;
34415 + atomic_long_unchecked_t user_unload_context;
34416 + atomic_long_unchecked_t user_exception;
34417 + atomic_long_unchecked_t set_context_option;
34418 + atomic_long_unchecked_t check_context_retarget_intr;
34419 + atomic_long_unchecked_t check_context_unload;
34420 + atomic_long_unchecked_t tlb_dropin;
34421 + atomic_long_unchecked_t tlb_preload_page;
34422 + atomic_long_unchecked_t tlb_dropin_fail_no_asid;
34423 + atomic_long_unchecked_t tlb_dropin_fail_upm;
34424 + atomic_long_unchecked_t tlb_dropin_fail_invalid;
34425 + atomic_long_unchecked_t tlb_dropin_fail_range_active;
34426 + atomic_long_unchecked_t tlb_dropin_fail_idle;
34427 + atomic_long_unchecked_t tlb_dropin_fail_fmm;
34428 + atomic_long_unchecked_t tlb_dropin_fail_no_exception;
34429 + atomic_long_unchecked_t tfh_stale_on_fault;
34430 + atomic_long_unchecked_t mmu_invalidate_range;
34431 + atomic_long_unchecked_t mmu_invalidate_page;
34432 + atomic_long_unchecked_t flush_tlb;
34433 + atomic_long_unchecked_t flush_tlb_gru;
34434 + atomic_long_unchecked_t flush_tlb_gru_tgh;
34435 + atomic_long_unchecked_t flush_tlb_gru_zero_asid;
34436
34437 - atomic_long_t copy_gpa;
34438 - atomic_long_t read_gpa;
34439 + atomic_long_unchecked_t copy_gpa;
34440 + atomic_long_unchecked_t read_gpa;
34441
34442 - atomic_long_t mesq_receive;
34443 - atomic_long_t mesq_receive_none;
34444 - atomic_long_t mesq_send;
34445 - atomic_long_t mesq_send_failed;
34446 - atomic_long_t mesq_noop;
34447 - atomic_long_t mesq_send_unexpected_error;
34448 - atomic_long_t mesq_send_lb_overflow;
34449 - atomic_long_t mesq_send_qlimit_reached;
34450 - atomic_long_t mesq_send_amo_nacked;
34451 - atomic_long_t mesq_send_put_nacked;
34452 - atomic_long_t mesq_page_overflow;
34453 - atomic_long_t mesq_qf_locked;
34454 - atomic_long_t mesq_qf_noop_not_full;
34455 - atomic_long_t mesq_qf_switch_head_failed;
34456 - atomic_long_t mesq_qf_unexpected_error;
34457 - atomic_long_t mesq_noop_unexpected_error;
34458 - atomic_long_t mesq_noop_lb_overflow;
34459 - atomic_long_t mesq_noop_qlimit_reached;
34460 - atomic_long_t mesq_noop_amo_nacked;
34461 - atomic_long_t mesq_noop_put_nacked;
34462 - atomic_long_t mesq_noop_page_overflow;
34463 + atomic_long_unchecked_t mesq_receive;
34464 + atomic_long_unchecked_t mesq_receive_none;
34465 + atomic_long_unchecked_t mesq_send;
34466 + atomic_long_unchecked_t mesq_send_failed;
34467 + atomic_long_unchecked_t mesq_noop;
34468 + atomic_long_unchecked_t mesq_send_unexpected_error;
34469 + atomic_long_unchecked_t mesq_send_lb_overflow;
34470 + atomic_long_unchecked_t mesq_send_qlimit_reached;
34471 + atomic_long_unchecked_t mesq_send_amo_nacked;
34472 + atomic_long_unchecked_t mesq_send_put_nacked;
34473 + atomic_long_unchecked_t mesq_page_overflow;
34474 + atomic_long_unchecked_t mesq_qf_locked;
34475 + atomic_long_unchecked_t mesq_qf_noop_not_full;
34476 + atomic_long_unchecked_t mesq_qf_switch_head_failed;
34477 + atomic_long_unchecked_t mesq_qf_unexpected_error;
34478 + atomic_long_unchecked_t mesq_noop_unexpected_error;
34479 + atomic_long_unchecked_t mesq_noop_lb_overflow;
34480 + atomic_long_unchecked_t mesq_noop_qlimit_reached;
34481 + atomic_long_unchecked_t mesq_noop_amo_nacked;
34482 + atomic_long_unchecked_t mesq_noop_put_nacked;
34483 + atomic_long_unchecked_t mesq_noop_page_overflow;
34484
34485 };
34486
34487 @@ -251,8 +251,8 @@ enum mcs_op {cchop_allocate, cchop_start, cchop_interrupt, cchop_interrupt_sync,
34488 tghop_invalidate, mcsop_last};
34489
34490 struct mcs_op_statistic {
34491 - atomic_long_t count;
34492 - atomic_long_t total;
34493 + atomic_long_unchecked_t count;
34494 + atomic_long_unchecked_t total;
34495 unsigned long max;
34496 };
34497
34498 @@ -275,7 +275,7 @@ extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
34499
34500 #define STAT(id) do { \
34501 if (gru_options & OPT_STATS) \
34502 - atomic_long_inc(&gru_stats.id); \
34503 + atomic_long_inc_unchecked(&gru_stats.id); \
34504 } while (0)
34505
34506 #ifdef CONFIG_SGI_GRU_DEBUG
34507 diff --git a/drivers/misc/sgi-xp/xp.h b/drivers/misc/sgi-xp/xp.h
34508 index c862cd4..0d176fe 100644
34509 --- a/drivers/misc/sgi-xp/xp.h
34510 +++ b/drivers/misc/sgi-xp/xp.h
34511 @@ -288,7 +288,7 @@ struct xpc_interface {
34512 xpc_notify_func, void *);
34513 void (*received) (short, int, void *);
34514 enum xp_retval (*partid_to_nasids) (short, void *);
34515 -};
34516 +} __no_const;
34517
34518 extern struct xpc_interface xpc_interface;
34519
34520 diff --git a/drivers/misc/sgi-xp/xpc.h b/drivers/misc/sgi-xp/xpc.h
34521 index b94d5f7..7f494c5 100644
34522 --- a/drivers/misc/sgi-xp/xpc.h
34523 +++ b/drivers/misc/sgi-xp/xpc.h
34524 @@ -835,6 +835,7 @@ struct xpc_arch_operations {
34525 void (*received_payload) (struct xpc_channel *, void *);
34526 void (*notify_senders_of_disconnect) (struct xpc_channel *);
34527 };
34528 +typedef struct xpc_arch_operations __no_const xpc_arch_operations_no_const;
34529
34530 /* struct xpc_partition act_state values (for XPC HB) */
34531
34532 @@ -876,7 +877,7 @@ extern struct xpc_registration xpc_registrations[];
34533 /* found in xpc_main.c */
34534 extern struct device *xpc_part;
34535 extern struct device *xpc_chan;
34536 -extern struct xpc_arch_operations xpc_arch_ops;
34537 +extern xpc_arch_operations_no_const xpc_arch_ops;
34538 extern int xpc_disengage_timelimit;
34539 extern int xpc_disengage_timedout;
34540 extern int xpc_activate_IRQ_rcvd;
34541 diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
34542 index 8d082b4..aa749ae 100644
34543 --- a/drivers/misc/sgi-xp/xpc_main.c
34544 +++ b/drivers/misc/sgi-xp/xpc_main.c
34545 @@ -162,7 +162,7 @@ static struct notifier_block xpc_die_notifier = {
34546 .notifier_call = xpc_system_die,
34547 };
34548
34549 -struct xpc_arch_operations xpc_arch_ops;
34550 +xpc_arch_operations_no_const xpc_arch_ops;
34551
34552 /*
34553 * Timer function to enforce the timelimit on the partition disengage.
34554 diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c
34555 index 2b62232..acfaeeb 100644
34556 --- a/drivers/misc/ti-st/st_core.c
34557 +++ b/drivers/misc/ti-st/st_core.c
34558 @@ -349,6 +349,11 @@ void st_int_recv(void *disc_data,
34559 st_gdata->rx_skb = alloc_skb(
34560 st_gdata->list[type]->max_frame_size,
34561 GFP_ATOMIC);
34562 + if (st_gdata->rx_skb == NULL) {
34563 + pr_err("out of memory: dropping\n");
34564 + goto done;
34565 + }
34566 +
34567 skb_reserve(st_gdata->rx_skb,
34568 st_gdata->list[type]->reserve);
34569 /* next 2 required for BT only */
34570 diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
34571 index 504da71..9722d43 100644
34572 --- a/drivers/mmc/host/sdhci-pci.c
34573 +++ b/drivers/mmc/host/sdhci-pci.c
34574 @@ -653,7 +653,7 @@ static const struct sdhci_pci_fixes sdhci_via = {
34575 .probe = via_probe,
34576 };
34577
34578 -static const struct pci_device_id pci_ids[] __devinitdata = {
34579 +static const struct pci_device_id pci_ids[] __devinitconst = {
34580 {
34581 .vendor = PCI_VENDOR_ID_RICOH,
34582 .device = PCI_DEVICE_ID_RICOH_R5C822,
34583 diff --git a/drivers/mtd/devices/doc2000.c b/drivers/mtd/devices/doc2000.c
34584 index a4eb8b5..8c0628f 100644
34585 --- a/drivers/mtd/devices/doc2000.c
34586 +++ b/drivers/mtd/devices/doc2000.c
34587 @@ -753,7 +753,7 @@ static int doc_write(struct mtd_info *mtd, loff_t to, size_t len,
34588
34589 /* The ECC will not be calculated correctly if less than 512 is written */
34590 /* DBB-
34591 - if (len != 0x200 && eccbuf)
34592 + if (len != 0x200)
34593 printk(KERN_WARNING
34594 "ECC needs a full sector write (adr: %lx size %lx)\n",
34595 (long) to, (long) len);
34596 diff --git a/drivers/mtd/nand/denali.c b/drivers/mtd/nand/denali.c
34597 index 0650aaf..7718762 100644
34598 --- a/drivers/mtd/nand/denali.c
34599 +++ b/drivers/mtd/nand/denali.c
34600 @@ -26,6 +26,7 @@
34601 #include <linux/pci.h>
34602 #include <linux/mtd/mtd.h>
34603 #include <linux/module.h>
34604 +#include <linux/slab.h>
34605
34606 #include "denali.h"
34607
34608 diff --git a/drivers/mtd/nftlmount.c b/drivers/mtd/nftlmount.c
34609 index 51b9d6a..52af9a7 100644
34610 --- a/drivers/mtd/nftlmount.c
34611 +++ b/drivers/mtd/nftlmount.c
34612 @@ -24,6 +24,7 @@
34613 #include <asm/errno.h>
34614 #include <linux/delay.h>
34615 #include <linux/slab.h>
34616 +#include <linux/sched.h>
34617 #include <linux/mtd/mtd.h>
34618 #include <linux/mtd/nand.h>
34619 #include <linux/mtd/nftl.h>
34620 diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c
34621 index 6762dc4..9956862 100644
34622 --- a/drivers/net/ethernet/atheros/atlx/atl2.c
34623 +++ b/drivers/net/ethernet/atheros/atlx/atl2.c
34624 @@ -2859,7 +2859,7 @@ static void atl2_force_ps(struct atl2_hw *hw)
34625 */
34626
34627 #define ATL2_PARAM(X, desc) \
34628 - static const int __devinitdata X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
34629 + static const int __devinitconst X[ATL2_MAX_NIC + 1] = ATL2_PARAM_INIT; \
34630 MODULE_PARM(X, "1-" __MODULE_STRING(ATL2_MAX_NIC) "i"); \
34631 MODULE_PARM_DESC(X, desc);
34632 #else
34633 diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
34634 index efd80bd..21fcff0 100644
34635 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
34636 +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
34637 @@ -487,7 +487,7 @@ struct bnx2x_rx_mode_obj {
34638
34639 int (*wait_comp)(struct bnx2x *bp,
34640 struct bnx2x_rx_mode_ramrod_params *p);
34641 -};
34642 +} __no_const;
34643
34644 /********************** Set multicast group ***********************************/
34645
34646 diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
34647 index 93865f8..5448741 100644
34648 --- a/drivers/net/ethernet/broadcom/tg3.h
34649 +++ b/drivers/net/ethernet/broadcom/tg3.h
34650 @@ -140,6 +140,7 @@
34651 #define CHIPREV_ID_5750_A0 0x4000
34652 #define CHIPREV_ID_5750_A1 0x4001
34653 #define CHIPREV_ID_5750_A3 0x4003
34654 +#define CHIPREV_ID_5750_C1 0x4201
34655 #define CHIPREV_ID_5750_C2 0x4202
34656 #define CHIPREV_ID_5752_A0_HW 0x5000
34657 #define CHIPREV_ID_5752_A0 0x6000
34658 diff --git a/drivers/net/ethernet/chelsio/cxgb3/l2t.h b/drivers/net/ethernet/chelsio/cxgb3/l2t.h
34659 index c4e8643..0979484 100644
34660 --- a/drivers/net/ethernet/chelsio/cxgb3/l2t.h
34661 +++ b/drivers/net/ethernet/chelsio/cxgb3/l2t.h
34662 @@ -87,7 +87,7 @@ typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
34663 */
34664 struct l2t_skb_cb {
34665 arp_failure_handler_func arp_failure_handler;
34666 -};
34667 +} __no_const;
34668
34669 #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb)
34670
34671 diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c
34672 index d3cd489..0fd52dd 100644
34673 --- a/drivers/net/ethernet/dec/tulip/de4x5.c
34674 +++ b/drivers/net/ethernet/dec/tulip/de4x5.c
34675 @@ -5388,7 +5388,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
34676 for (i=0; i<ETH_ALEN; i++) {
34677 tmp.addr[i] = dev->dev_addr[i];
34678 }
34679 - if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
34680 + if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
34681 break;
34682
34683 case DE4X5_SET_HWADDR: /* Set the hardware address */
34684 @@ -5428,7 +5428,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
34685 spin_lock_irqsave(&lp->lock, flags);
34686 memcpy(&statbuf, &lp->pktStats, ioc->len);
34687 spin_unlock_irqrestore(&lp->lock, flags);
34688 - if (copy_to_user(ioc->data, &statbuf, ioc->len))
34689 + if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
34690 return -EFAULT;
34691 break;
34692 }
34693 diff --git a/drivers/net/ethernet/dec/tulip/eeprom.c b/drivers/net/ethernet/dec/tulip/eeprom.c
34694 index ed7d1dc..d426748 100644
34695 --- a/drivers/net/ethernet/dec/tulip/eeprom.c
34696 +++ b/drivers/net/ethernet/dec/tulip/eeprom.c
34697 @@ -79,7 +79,7 @@ static struct eeprom_fixup eeprom_fixups[] __devinitdata = {
34698 {NULL}};
34699
34700
34701 -static const char *block_name[] __devinitdata = {
34702 +static const char *block_name[] __devinitconst = {
34703 "21140 non-MII",
34704 "21140 MII PHY",
34705 "21142 Serial PHY",
34706 diff --git a/drivers/net/ethernet/dec/tulip/uli526x.c b/drivers/net/ethernet/dec/tulip/uli526x.c
34707 index 75d45f8..3d9c55b 100644
34708 --- a/drivers/net/ethernet/dec/tulip/uli526x.c
34709 +++ b/drivers/net/ethernet/dec/tulip/uli526x.c
34710 @@ -129,7 +129,7 @@ struct uli526x_board_info {
34711 struct uli_phy_ops {
34712 void (*write)(struct uli526x_board_info *, u8, u8, u16);
34713 u16 (*read)(struct uli526x_board_info *, u8, u8);
34714 - } phy;
34715 + } __no_const phy;
34716 struct net_device *next_dev; /* next device */
34717 struct pci_dev *pdev; /* PCI device */
34718 spinlock_t lock;
34719 diff --git a/drivers/net/ethernet/dec/tulip/winbond-840.c b/drivers/net/ethernet/dec/tulip/winbond-840.c
34720 index 4d1ffca..7c1ec4d 100644
34721 --- a/drivers/net/ethernet/dec/tulip/winbond-840.c
34722 +++ b/drivers/net/ethernet/dec/tulip/winbond-840.c
34723 @@ -236,7 +236,7 @@ struct pci_id_info {
34724 int drv_flags; /* Driver use, intended as capability flags. */
34725 };
34726
34727 -static const struct pci_id_info pci_id_tbl[] __devinitdata = {
34728 +static const struct pci_id_info pci_id_tbl[] __devinitconst = {
34729 { /* Sometime a Level-One switch card. */
34730 "Winbond W89c840", CanHaveMII | HasBrokenTx | FDXOnNoMII},
34731 { "Winbond W89c840", CanHaveMII | HasBrokenTx},
34732 diff --git a/drivers/net/ethernet/dlink/sundance.c b/drivers/net/ethernet/dlink/sundance.c
34733 index d7bb52a..3b83588 100644
34734 --- a/drivers/net/ethernet/dlink/sundance.c
34735 +++ b/drivers/net/ethernet/dlink/sundance.c
34736 @@ -218,7 +218,7 @@ enum {
34737 struct pci_id_info {
34738 const char *name;
34739 };
34740 -static const struct pci_id_info pci_id_tbl[] __devinitdata = {
34741 +static const struct pci_id_info pci_id_tbl[] __devinitconst = {
34742 {"D-Link DFE-550TX FAST Ethernet Adapter"},
34743 {"D-Link DFE-550FX 100Mbps Fiber-optics Adapter"},
34744 {"D-Link DFE-580TX 4 port Server Adapter"},
34745 diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
34746 index bd5cf7e..c165651 100644
34747 --- a/drivers/net/ethernet/emulex/benet/be_main.c
34748 +++ b/drivers/net/ethernet/emulex/benet/be_main.c
34749 @@ -403,7 +403,7 @@ static void accumulate_16bit_val(u32 *acc, u16 val)
34750
34751 if (wrapped)
34752 newacc += 65536;
34753 - ACCESS_ONCE(*acc) = newacc;
34754 + ACCESS_ONCE_RW(*acc) = newacc;
34755 }
34756
34757 void be_parse_stats(struct be_adapter *adapter)
34758 diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
34759 index 16b0704..d2c07d7 100644
34760 --- a/drivers/net/ethernet/faraday/ftgmac100.c
34761 +++ b/drivers/net/ethernet/faraday/ftgmac100.c
34762 @@ -31,6 +31,8 @@
34763 #include <linux/netdevice.h>
34764 #include <linux/phy.h>
34765 #include <linux/platform_device.h>
34766 +#include <linux/interrupt.h>
34767 +#include <linux/irqreturn.h>
34768 #include <net/ip.h>
34769
34770 #include "ftgmac100.h"
34771 diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c
34772 index 829b109..4ae5f6a 100644
34773 --- a/drivers/net/ethernet/faraday/ftmac100.c
34774 +++ b/drivers/net/ethernet/faraday/ftmac100.c
34775 @@ -31,6 +31,8 @@
34776 #include <linux/module.h>
34777 #include <linux/netdevice.h>
34778 #include <linux/platform_device.h>
34779 +#include <linux/interrupt.h>
34780 +#include <linux/irqreturn.h>
34781
34782 #include "ftmac100.h"
34783
34784 diff --git a/drivers/net/ethernet/fealnx.c b/drivers/net/ethernet/fealnx.c
34785 index 9d71c9c..0e4a0ac 100644
34786 --- a/drivers/net/ethernet/fealnx.c
34787 +++ b/drivers/net/ethernet/fealnx.c
34788 @@ -150,7 +150,7 @@ struct chip_info {
34789 int flags;
34790 };
34791
34792 -static const struct chip_info skel_netdrv_tbl[] __devinitdata = {
34793 +static const struct chip_info skel_netdrv_tbl[] __devinitconst = {
34794 { "100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
34795 { "100/10M Ethernet PCI Adapter", HAS_CHIP_XCVR },
34796 { "1000/100/10M Ethernet PCI Adapter", HAS_MII_XCVR },
34797 diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h b/drivers/net/ethernet/intel/e1000e/e1000.h
34798 index fa47b85..246edeb 100644
34799 --- a/drivers/net/ethernet/intel/e1000e/e1000.h
34800 +++ b/drivers/net/ethernet/intel/e1000e/e1000.h
34801 @@ -181,7 +181,7 @@ struct e1000_info;
34802 #define E1000_TXDCTL_DMA_BURST_ENABLE \
34803 (E1000_TXDCTL_GRAN | /* set descriptor granularity */ \
34804 E1000_TXDCTL_COUNT_DESC | \
34805 - (5 << 16) | /* wthresh must be +1 more than desired */\
34806 + (1 << 16) | /* wthresh must be +1 more than desired */\
34807 (1 << 8) | /* hthresh */ \
34808 0x1f) /* pthresh */
34809
34810 diff --git a/drivers/net/ethernet/intel/e1000e/hw.h b/drivers/net/ethernet/intel/e1000e/hw.h
34811 index ed5b409..ec37828 100644
34812 --- a/drivers/net/ethernet/intel/e1000e/hw.h
34813 +++ b/drivers/net/ethernet/intel/e1000e/hw.h
34814 @@ -797,6 +797,7 @@ struct e1000_mac_operations {
34815 void (*rar_set)(struct e1000_hw *, u8 *, u32);
34816 s32 (*read_mac_addr)(struct e1000_hw *);
34817 };
34818 +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
34819
34820 /*
34821 * When to use various PHY register access functions:
34822 @@ -837,6 +838,7 @@ struct e1000_phy_operations {
34823 void (*power_up)(struct e1000_hw *);
34824 void (*power_down)(struct e1000_hw *);
34825 };
34826 +typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
34827
34828 /* Function pointers for the NVM. */
34829 struct e1000_nvm_operations {
34830 @@ -849,9 +851,10 @@ struct e1000_nvm_operations {
34831 s32 (*validate)(struct e1000_hw *);
34832 s32 (*write)(struct e1000_hw *, u16, u16, u16 *);
34833 };
34834 +typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
34835
34836 struct e1000_mac_info {
34837 - struct e1000_mac_operations ops;
34838 + e1000_mac_operations_no_const ops;
34839 u8 addr[ETH_ALEN];
34840 u8 perm_addr[ETH_ALEN];
34841
34842 @@ -892,7 +895,7 @@ struct e1000_mac_info {
34843 };
34844
34845 struct e1000_phy_info {
34846 - struct e1000_phy_operations ops;
34847 + e1000_phy_operations_no_const ops;
34848
34849 enum e1000_phy_type type;
34850
34851 @@ -926,7 +929,7 @@ struct e1000_phy_info {
34852 };
34853
34854 struct e1000_nvm_info {
34855 - struct e1000_nvm_operations ops;
34856 + e1000_nvm_operations_no_const ops;
34857
34858 enum e1000_nvm_type type;
34859 enum e1000_nvm_override override;
34860 diff --git a/drivers/net/ethernet/intel/igb/e1000_hw.h b/drivers/net/ethernet/intel/igb/e1000_hw.h
34861 index c2a51dc..c2bd262 100644
34862 --- a/drivers/net/ethernet/intel/igb/e1000_hw.h
34863 +++ b/drivers/net/ethernet/intel/igb/e1000_hw.h
34864 @@ -327,6 +327,7 @@ struct e1000_mac_operations {
34865 void (*release_swfw_sync)(struct e1000_hw *, u16);
34866
34867 };
34868 +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
34869
34870 struct e1000_phy_operations {
34871 s32 (*acquire)(struct e1000_hw *);
34872 @@ -343,6 +344,7 @@ struct e1000_phy_operations {
34873 s32 (*set_d3_lplu_state)(struct e1000_hw *, bool);
34874 s32 (*write_reg)(struct e1000_hw *, u32, u16);
34875 };
34876 +typedef struct e1000_phy_operations __no_const e1000_phy_operations_no_const;
34877
34878 struct e1000_nvm_operations {
34879 s32 (*acquire)(struct e1000_hw *);
34880 @@ -353,6 +355,7 @@ struct e1000_nvm_operations {
34881 s32 (*validate)(struct e1000_hw *);
34882 s32 (*valid_led_default)(struct e1000_hw *, u16 *);
34883 };
34884 +typedef struct e1000_nvm_operations __no_const e1000_nvm_operations_no_const;
34885
34886 struct e1000_info {
34887 s32 (*get_invariants)(struct e1000_hw *);
34888 @@ -364,7 +367,7 @@ struct e1000_info {
34889 extern const struct e1000_info e1000_82575_info;
34890
34891 struct e1000_mac_info {
34892 - struct e1000_mac_operations ops;
34893 + e1000_mac_operations_no_const ops;
34894
34895 u8 addr[6];
34896 u8 perm_addr[6];
34897 @@ -402,7 +405,7 @@ struct e1000_mac_info {
34898 };
34899
34900 struct e1000_phy_info {
34901 - struct e1000_phy_operations ops;
34902 + e1000_phy_operations_no_const ops;
34903
34904 enum e1000_phy_type type;
34905
34906 @@ -437,7 +440,7 @@ struct e1000_phy_info {
34907 };
34908
34909 struct e1000_nvm_info {
34910 - struct e1000_nvm_operations ops;
34911 + e1000_nvm_operations_no_const ops;
34912 enum e1000_nvm_type type;
34913 enum e1000_nvm_override override;
34914
34915 @@ -482,6 +485,7 @@ struct e1000_mbx_operations {
34916 s32 (*check_for_ack)(struct e1000_hw *, u16);
34917 s32 (*check_for_rst)(struct e1000_hw *, u16);
34918 };
34919 +typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
34920
34921 struct e1000_mbx_stats {
34922 u32 msgs_tx;
34923 @@ -493,7 +497,7 @@ struct e1000_mbx_stats {
34924 };
34925
34926 struct e1000_mbx_info {
34927 - struct e1000_mbx_operations ops;
34928 + e1000_mbx_operations_no_const ops;
34929 struct e1000_mbx_stats stats;
34930 u32 timeout;
34931 u32 usec_delay;
34932 diff --git a/drivers/net/ethernet/intel/igbvf/vf.h b/drivers/net/ethernet/intel/igbvf/vf.h
34933 index 57db3c6..aa825fc 100644
34934 --- a/drivers/net/ethernet/intel/igbvf/vf.h
34935 +++ b/drivers/net/ethernet/intel/igbvf/vf.h
34936 @@ -189,9 +189,10 @@ struct e1000_mac_operations {
34937 s32 (*read_mac_addr)(struct e1000_hw *);
34938 s32 (*set_vfta)(struct e1000_hw *, u16, bool);
34939 };
34940 +typedef struct e1000_mac_operations __no_const e1000_mac_operations_no_const;
34941
34942 struct e1000_mac_info {
34943 - struct e1000_mac_operations ops;
34944 + e1000_mac_operations_no_const ops;
34945 u8 addr[6];
34946 u8 perm_addr[6];
34947
34948 @@ -213,6 +214,7 @@ struct e1000_mbx_operations {
34949 s32 (*check_for_ack)(struct e1000_hw *);
34950 s32 (*check_for_rst)(struct e1000_hw *);
34951 };
34952 +typedef struct e1000_mbx_operations __no_const e1000_mbx_operations_no_const;
34953
34954 struct e1000_mbx_stats {
34955 u32 msgs_tx;
34956 @@ -224,7 +226,7 @@ struct e1000_mbx_stats {
34957 };
34958
34959 struct e1000_mbx_info {
34960 - struct e1000_mbx_operations ops;
34961 + e1000_mbx_operations_no_const ops;
34962 struct e1000_mbx_stats stats;
34963 u32 timeout;
34964 u32 usec_delay;
34965 diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
34966 index dcebd12..c1fe8be 100644
34967 --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
34968 +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
34969 @@ -805,7 +805,7 @@ void ixgbe_ptp_start_cyclecounter(struct ixgbe_adapter *adapter)
34970 /* store the new cycle speed */
34971 adapter->cycle_speed = cycle_speed;
34972
34973 - ACCESS_ONCE(adapter->base_incval) = incval;
34974 + ACCESS_ONCE_RW(adapter->base_incval) = incval;
34975 smp_mb();
34976
34977 /* grab the ptp lock */
34978 diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
34979 index 204848d..d8aeaec 100644
34980 --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
34981 +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
34982 @@ -2791,6 +2791,7 @@ struct ixgbe_eeprom_operations {
34983 s32 (*update_checksum)(struct ixgbe_hw *);
34984 u16 (*calc_checksum)(struct ixgbe_hw *);
34985 };
34986 +typedef struct ixgbe_eeprom_operations __no_const ixgbe_eeprom_operations_no_const;
34987
34988 struct ixgbe_mac_operations {
34989 s32 (*init_hw)(struct ixgbe_hw *);
34990 @@ -2856,6 +2857,7 @@ struct ixgbe_mac_operations {
34991 s32 (*get_thermal_sensor_data)(struct ixgbe_hw *);
34992 s32 (*init_thermal_sensor_thresh)(struct ixgbe_hw *hw);
34993 };
34994 +typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
34995
34996 struct ixgbe_phy_operations {
34997 s32 (*identify)(struct ixgbe_hw *);
34998 @@ -2875,9 +2877,10 @@ struct ixgbe_phy_operations {
34999 s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8);
35000 s32 (*check_overtemp)(struct ixgbe_hw *);
35001 };
35002 +typedef struct ixgbe_phy_operations __no_const ixgbe_phy_operations_no_const;
35003
35004 struct ixgbe_eeprom_info {
35005 - struct ixgbe_eeprom_operations ops;
35006 + ixgbe_eeprom_operations_no_const ops;
35007 enum ixgbe_eeprom_type type;
35008 u32 semaphore_delay;
35009 u16 word_size;
35010 @@ -2887,7 +2890,7 @@ struct ixgbe_eeprom_info {
35011
35012 #define IXGBE_FLAGS_DOUBLE_RESET_REQUIRED 0x01
35013 struct ixgbe_mac_info {
35014 - struct ixgbe_mac_operations ops;
35015 + ixgbe_mac_operations_no_const ops;
35016 enum ixgbe_mac_type type;
35017 u8 addr[ETH_ALEN];
35018 u8 perm_addr[ETH_ALEN];
35019 @@ -2916,7 +2919,7 @@ struct ixgbe_mac_info {
35020 };
35021
35022 struct ixgbe_phy_info {
35023 - struct ixgbe_phy_operations ops;
35024 + ixgbe_phy_operations_no_const ops;
35025 struct mdio_if_info mdio;
35026 enum ixgbe_phy_type type;
35027 u32 id;
35028 @@ -2944,6 +2947,7 @@ struct ixgbe_mbx_operations {
35029 s32 (*check_for_ack)(struct ixgbe_hw *, u16);
35030 s32 (*check_for_rst)(struct ixgbe_hw *, u16);
35031 };
35032 +typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const;
35033
35034 struct ixgbe_mbx_stats {
35035 u32 msgs_tx;
35036 @@ -2955,7 +2959,7 @@ struct ixgbe_mbx_stats {
35037 };
35038
35039 struct ixgbe_mbx_info {
35040 - struct ixgbe_mbx_operations ops;
35041 + ixgbe_mbx_operations_no_const ops;
35042 struct ixgbe_mbx_stats stats;
35043 u32 timeout;
35044 u32 usec_delay;
35045 diff --git a/drivers/net/ethernet/intel/ixgbevf/vf.h b/drivers/net/ethernet/intel/ixgbevf/vf.h
35046 index 25c951d..cc7cf33 100644
35047 --- a/drivers/net/ethernet/intel/ixgbevf/vf.h
35048 +++ b/drivers/net/ethernet/intel/ixgbevf/vf.h
35049 @@ -70,6 +70,7 @@ struct ixgbe_mac_operations {
35050 s32 (*clear_vfta)(struct ixgbe_hw *);
35051 s32 (*set_vfta)(struct ixgbe_hw *, u32, u32, bool);
35052 };
35053 +typedef struct ixgbe_mac_operations __no_const ixgbe_mac_operations_no_const;
35054
35055 enum ixgbe_mac_type {
35056 ixgbe_mac_unknown = 0,
35057 @@ -79,7 +80,7 @@ enum ixgbe_mac_type {
35058 };
35059
35060 struct ixgbe_mac_info {
35061 - struct ixgbe_mac_operations ops;
35062 + ixgbe_mac_operations_no_const ops;
35063 u8 addr[6];
35064 u8 perm_addr[6];
35065
35066 @@ -103,6 +104,7 @@ struct ixgbe_mbx_operations {
35067 s32 (*check_for_ack)(struct ixgbe_hw *);
35068 s32 (*check_for_rst)(struct ixgbe_hw *);
35069 };
35070 +typedef struct ixgbe_mbx_operations __no_const ixgbe_mbx_operations_no_const;
35071
35072 struct ixgbe_mbx_stats {
35073 u32 msgs_tx;
35074 @@ -114,7 +116,7 @@ struct ixgbe_mbx_stats {
35075 };
35076
35077 struct ixgbe_mbx_info {
35078 - struct ixgbe_mbx_operations ops;
35079 + ixgbe_mbx_operations_no_const ops;
35080 struct ixgbe_mbx_stats stats;
35081 u32 timeout;
35082 u32 udelay;
35083 diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
35084 index a0313de..e83a572 100644
35085 --- a/drivers/net/ethernet/mellanox/mlx4/main.c
35086 +++ b/drivers/net/ethernet/mellanox/mlx4/main.c
35087 @@ -41,6 +41,7 @@
35088 #include <linux/slab.h>
35089 #include <linux/io-mapping.h>
35090 #include <linux/delay.h>
35091 +#include <linux/sched.h>
35092
35093 #include <linux/mlx4/device.h>
35094 #include <linux/mlx4/doorbell.h>
35095 diff --git a/drivers/net/ethernet/neterion/vxge/vxge-config.h b/drivers/net/ethernet/neterion/vxge/vxge-config.h
35096 index 5046a64..71ca936 100644
35097 --- a/drivers/net/ethernet/neterion/vxge/vxge-config.h
35098 +++ b/drivers/net/ethernet/neterion/vxge/vxge-config.h
35099 @@ -514,7 +514,7 @@ struct vxge_hw_uld_cbs {
35100 void (*link_down)(struct __vxge_hw_device *devh);
35101 void (*crit_err)(struct __vxge_hw_device *devh,
35102 enum vxge_hw_event type, u64 ext_data);
35103 -};
35104 +} __no_const;
35105
35106 /*
35107 * struct __vxge_hw_blockpool_entry - Block private data structure
35108 diff --git a/drivers/net/ethernet/neterion/vxge/vxge-traffic.h b/drivers/net/ethernet/neterion/vxge/vxge-traffic.h
35109 index 4a518a3..936b334 100644
35110 --- a/drivers/net/ethernet/neterion/vxge/vxge-traffic.h
35111 +++ b/drivers/net/ethernet/neterion/vxge/vxge-traffic.h
35112 @@ -2088,7 +2088,7 @@ struct vxge_hw_mempool_cbs {
35113 struct vxge_hw_mempool_dma *dma_object,
35114 u32 index,
35115 u32 is_last);
35116 -};
35117 +} __no_const;
35118
35119 #define VXGE_HW_VIRTUAL_PATH_HANDLE(vpath) \
35120 ((struct __vxge_hw_vpath_handle *)(vpath)->vpath_handles.next)
35121 diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
35122 index eb81da4..1592b62 100644
35123 --- a/drivers/net/ethernet/realtek/r8169.c
35124 +++ b/drivers/net/ethernet/realtek/r8169.c
35125 @@ -723,22 +723,22 @@ struct rtl8169_private {
35126 struct mdio_ops {
35127 void (*write)(void __iomem *, int, int);
35128 int (*read)(void __iomem *, int);
35129 - } mdio_ops;
35130 + } __no_const mdio_ops;
35131
35132 struct pll_power_ops {
35133 void (*down)(struct rtl8169_private *);
35134 void (*up)(struct rtl8169_private *);
35135 - } pll_power_ops;
35136 + } __no_const pll_power_ops;
35137
35138 struct jumbo_ops {
35139 void (*enable)(struct rtl8169_private *);
35140 void (*disable)(struct rtl8169_private *);
35141 - } jumbo_ops;
35142 + } __no_const jumbo_ops;
35143
35144 struct csi_ops {
35145 void (*write)(void __iomem *, int, int);
35146 u32 (*read)(void __iomem *, int);
35147 - } csi_ops;
35148 + } __no_const csi_ops;
35149
35150 int (*set_speed)(struct net_device *, u8 aneg, u16 sp, u8 dpx, u32 adv);
35151 int (*get_settings)(struct net_device *, struct ethtool_cmd *);
35152 diff --git a/drivers/net/ethernet/sis/sis190.c b/drivers/net/ethernet/sis/sis190.c
35153 index 4613591..d816601 100644
35154 --- a/drivers/net/ethernet/sis/sis190.c
35155 +++ b/drivers/net/ethernet/sis/sis190.c
35156 @@ -1618,7 +1618,7 @@ static int __devinit sis190_get_mac_addr_from_eeprom(struct pci_dev *pdev,
35157 static int __devinit sis190_get_mac_addr_from_apc(struct pci_dev *pdev,
35158 struct net_device *dev)
35159 {
35160 - static const u16 __devinitdata ids[] = { 0x0965, 0x0966, 0x0968 };
35161 + static const u16 __devinitconst ids[] = { 0x0965, 0x0966, 0x0968 };
35162 struct sis190_private *tp = netdev_priv(dev);
35163 struct pci_dev *isa_bridge;
35164 u8 reg, tmp8;
35165 diff --git a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
35166 index c07cfe9..81cbf7e 100644
35167 --- a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
35168 +++ b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
35169 @@ -140,8 +140,8 @@ void dwmac_mmc_ctrl(void __iomem *ioaddr, unsigned int mode)
35170
35171 writel(value, ioaddr + MMC_CNTRL);
35172
35173 - pr_debug("stmmac: MMC ctrl register (offset 0x%x): 0x%08x\n",
35174 - MMC_CNTRL, value);
35175 +// pr_debug("stmmac: MMC ctrl register (offset 0x%x): 0x%08x\n",
35176 +// MMC_CNTRL, value);
35177 }
35178
35179 /* To mask all all interrupts.*/
35180 diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
35181 index 2857ab0..9a1f9b0 100644
35182 --- a/drivers/net/hyperv/hyperv_net.h
35183 +++ b/drivers/net/hyperv/hyperv_net.h
35184 @@ -99,7 +99,7 @@ struct rndis_device {
35185
35186 enum rndis_device_state state;
35187 bool link_state;
35188 - atomic_t new_req_id;
35189 + atomic_unchecked_t new_req_id;
35190
35191 spinlock_t request_lock;
35192 struct list_head req_list;
35193 diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
35194 index 981ebb1..b34959b 100644
35195 --- a/drivers/net/hyperv/rndis_filter.c
35196 +++ b/drivers/net/hyperv/rndis_filter.c
35197 @@ -97,7 +97,7 @@ static struct rndis_request *get_rndis_request(struct rndis_device *dev,
35198 * template
35199 */
35200 set = &rndis_msg->msg.set_req;
35201 - set->req_id = atomic_inc_return(&dev->new_req_id);
35202 + set->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
35203
35204 /* Add to the request list */
35205 spin_lock_irqsave(&dev->request_lock, flags);
35206 @@ -648,7 +648,7 @@ static void rndis_filter_halt_device(struct rndis_device *dev)
35207
35208 /* Setup the rndis set */
35209 halt = &request->request_msg.msg.halt_req;
35210 - halt->req_id = atomic_inc_return(&dev->new_req_id);
35211 + halt->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
35212
35213 /* Ignore return since this msg is optional. */
35214 rndis_filter_send_request(dev, request);
35215 diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
35216 index 5c05572..389610b 100644
35217 --- a/drivers/net/ppp/ppp_generic.c
35218 +++ b/drivers/net/ppp/ppp_generic.c
35219 @@ -986,7 +986,6 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
35220 void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
35221 struct ppp_stats stats;
35222 struct ppp_comp_stats cstats;
35223 - char *vers;
35224
35225 switch (cmd) {
35226 case SIOCGPPPSTATS:
35227 @@ -1008,8 +1007,7 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
35228 break;
35229
35230 case SIOCGPPPVER:
35231 - vers = PPP_VERSION;
35232 - if (copy_to_user(addr, vers, strlen(vers) + 1))
35233 + if (copy_to_user(addr, PPP_VERSION, sizeof(PPP_VERSION)))
35234 break;
35235 err = 0;
35236 break;
35237 diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
35238 index 62f30b4..ff99dfd 100644
35239 --- a/drivers/net/usb/hso.c
35240 +++ b/drivers/net/usb/hso.c
35241 @@ -71,7 +71,7 @@
35242 #include <asm/byteorder.h>
35243 #include <linux/serial_core.h>
35244 #include <linux/serial.h>
35245 -
35246 +#include <asm/local.h>
35247
35248 #define MOD_AUTHOR "Option Wireless"
35249 #define MOD_DESCRIPTION "USB High Speed Option driver"
35250 @@ -1182,7 +1182,7 @@ static void put_rxbuf_data_and_resubmit_ctrl_urb(struct hso_serial *serial)
35251 struct urb *urb;
35252
35253 urb = serial->rx_urb[0];
35254 - if (serial->port.count > 0) {
35255 + if (atomic_read(&serial->port.count) > 0) {
35256 count = put_rxbuf_data(urb, serial);
35257 if (count == -1)
35258 return;
35259 @@ -1218,7 +1218,7 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
35260 DUMP1(urb->transfer_buffer, urb->actual_length);
35261
35262 /* Anyone listening? */
35263 - if (serial->port.count == 0)
35264 + if (atomic_read(&serial->port.count) == 0)
35265 return;
35266
35267 if (status == 0) {
35268 @@ -1300,8 +1300,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
35269 tty_port_tty_set(&serial->port, tty);
35270
35271 /* check for port already opened, if not set the termios */
35272 - serial->port.count++;
35273 - if (serial->port.count == 1) {
35274 + if (atomic_inc_return(&serial->port.count) == 1) {
35275 serial->rx_state = RX_IDLE;
35276 /* Force default termio settings */
35277 _hso_serial_set_termios(tty, NULL);
35278 @@ -1313,7 +1312,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
35279 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
35280 if (result) {
35281 hso_stop_serial_device(serial->parent);
35282 - serial->port.count--;
35283 + atomic_dec(&serial->port.count);
35284 kref_put(&serial->parent->ref, hso_serial_ref_free);
35285 }
35286 } else {
35287 @@ -1350,10 +1349,10 @@ static void hso_serial_close(struct tty_struct *tty, struct file *filp)
35288
35289 /* reset the rts and dtr */
35290 /* do the actual close */
35291 - serial->port.count--;
35292 + atomic_dec(&serial->port.count);
35293
35294 - if (serial->port.count <= 0) {
35295 - serial->port.count = 0;
35296 + if (atomic_read(&serial->port.count) <= 0) {
35297 + atomic_set(&serial->port.count, 0);
35298 tty_port_tty_set(&serial->port, NULL);
35299 if (!usb_gone)
35300 hso_stop_serial_device(serial->parent);
35301 @@ -1429,7 +1428,7 @@ static void hso_serial_set_termios(struct tty_struct *tty, struct ktermios *old)
35302
35303 /* the actual setup */
35304 spin_lock_irqsave(&serial->serial_lock, flags);
35305 - if (serial->port.count)
35306 + if (atomic_read(&serial->port.count))
35307 _hso_serial_set_termios(tty, old);
35308 else
35309 tty->termios = old;
35310 @@ -1888,7 +1887,7 @@ static void intr_callback(struct urb *urb)
35311 D1("Pending read interrupt on port %d\n", i);
35312 spin_lock(&serial->serial_lock);
35313 if (serial->rx_state == RX_IDLE &&
35314 - serial->port.count > 0) {
35315 + atomic_read(&serial->port.count) > 0) {
35316 /* Setup and send a ctrl req read on
35317 * port i */
35318 if (!serial->rx_urb_filled[0]) {
35319 @@ -3079,7 +3078,7 @@ static int hso_resume(struct usb_interface *iface)
35320 /* Start all serial ports */
35321 for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
35322 if (serial_table[i] && (serial_table[i]->interface == iface)) {
35323 - if (dev2ser(serial_table[i])->port.count) {
35324 + if (atomic_read(&dev2ser(serial_table[i])->port.count)) {
35325 result =
35326 hso_start_serial_device(serial_table[i], GFP_NOIO);
35327 hso_kick_transmit(dev2ser(serial_table[i]));
35328 diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
35329 index 420d69b..74f90a2 100644
35330 --- a/drivers/net/wireless/ath/ath.h
35331 +++ b/drivers/net/wireless/ath/ath.h
35332 @@ -119,6 +119,7 @@ struct ath_ops {
35333 void (*write_flush) (void *);
35334 u32 (*rmw)(void *, u32 reg_offset, u32 set, u32 clr);
35335 };
35336 +typedef struct ath_ops __no_const ath_ops_no_const;
35337
35338 struct ath_common;
35339 struct ath_bus_ops;
35340 diff --git a/drivers/net/wireless/ath/ath9k/ar9002_mac.c b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
35341 index 8d78253..bebbb68 100644
35342 --- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
35343 +++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
35344 @@ -184,8 +184,8 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
35345 ads->ds_txstatus6 = ads->ds_txstatus7 = 0;
35346 ads->ds_txstatus8 = ads->ds_txstatus9 = 0;
35347
35348 - ACCESS_ONCE(ads->ds_link) = i->link;
35349 - ACCESS_ONCE(ads->ds_data) = i->buf_addr[0];
35350 + ACCESS_ONCE_RW(ads->ds_link) = i->link;
35351 + ACCESS_ONCE_RW(ads->ds_data) = i->buf_addr[0];
35352
35353 ctl1 = i->buf_len[0] | (i->is_last ? 0 : AR_TxMore);
35354 ctl6 = SM(i->keytype, AR_EncrType);
35355 @@ -199,26 +199,26 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
35356
35357 if ((i->is_first || i->is_last) &&
35358 i->aggr != AGGR_BUF_MIDDLE && i->aggr != AGGR_BUF_LAST) {
35359 - ACCESS_ONCE(ads->ds_ctl2) = set11nTries(i->rates, 0)
35360 + ACCESS_ONCE_RW(ads->ds_ctl2) = set11nTries(i->rates, 0)
35361 | set11nTries(i->rates, 1)
35362 | set11nTries(i->rates, 2)
35363 | set11nTries(i->rates, 3)
35364 | (i->dur_update ? AR_DurUpdateEna : 0)
35365 | SM(0, AR_BurstDur);
35366
35367 - ACCESS_ONCE(ads->ds_ctl3) = set11nRate(i->rates, 0)
35368 + ACCESS_ONCE_RW(ads->ds_ctl3) = set11nRate(i->rates, 0)
35369 | set11nRate(i->rates, 1)
35370 | set11nRate(i->rates, 2)
35371 | set11nRate(i->rates, 3);
35372 } else {
35373 - ACCESS_ONCE(ads->ds_ctl2) = 0;
35374 - ACCESS_ONCE(ads->ds_ctl3) = 0;
35375 + ACCESS_ONCE_RW(ads->ds_ctl2) = 0;
35376 + ACCESS_ONCE_RW(ads->ds_ctl3) = 0;
35377 }
35378
35379 if (!i->is_first) {
35380 - ACCESS_ONCE(ads->ds_ctl0) = 0;
35381 - ACCESS_ONCE(ads->ds_ctl1) = ctl1;
35382 - ACCESS_ONCE(ads->ds_ctl6) = ctl6;
35383 + ACCESS_ONCE_RW(ads->ds_ctl0) = 0;
35384 + ACCESS_ONCE_RW(ads->ds_ctl1) = ctl1;
35385 + ACCESS_ONCE_RW(ads->ds_ctl6) = ctl6;
35386 return;
35387 }
35388
35389 @@ -243,7 +243,7 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
35390 break;
35391 }
35392
35393 - ACCESS_ONCE(ads->ds_ctl0) = (i->pkt_len & AR_FrameLen)
35394 + ACCESS_ONCE_RW(ads->ds_ctl0) = (i->pkt_len & AR_FrameLen)
35395 | (i->flags & ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0)
35396 | SM(i->txpower, AR_XmitPower)
35397 | (i->flags & ATH9K_TXDESC_VEOL ? AR_VEOL : 0)
35398 @@ -253,19 +253,19 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
35399 | (i->flags & ATH9K_TXDESC_RTSENA ? AR_RTSEnable :
35400 (i->flags & ATH9K_TXDESC_CTSENA ? AR_CTSEnable : 0));
35401
35402 - ACCESS_ONCE(ads->ds_ctl1) = ctl1;
35403 - ACCESS_ONCE(ads->ds_ctl6) = ctl6;
35404 + ACCESS_ONCE_RW(ads->ds_ctl1) = ctl1;
35405 + ACCESS_ONCE_RW(ads->ds_ctl6) = ctl6;
35406
35407 if (i->aggr == AGGR_BUF_MIDDLE || i->aggr == AGGR_BUF_LAST)
35408 return;
35409
35410 - ACCESS_ONCE(ads->ds_ctl4) = set11nPktDurRTSCTS(i->rates, 0)
35411 + ACCESS_ONCE_RW(ads->ds_ctl4) = set11nPktDurRTSCTS(i->rates, 0)
35412 | set11nPktDurRTSCTS(i->rates, 1);
35413
35414 - ACCESS_ONCE(ads->ds_ctl5) = set11nPktDurRTSCTS(i->rates, 2)
35415 + ACCESS_ONCE_RW(ads->ds_ctl5) = set11nPktDurRTSCTS(i->rates, 2)
35416 | set11nPktDurRTSCTS(i->rates, 3);
35417
35418 - ACCESS_ONCE(ads->ds_ctl7) = set11nRateFlags(i->rates, 0)
35419 + ACCESS_ONCE_RW(ads->ds_ctl7) = set11nRateFlags(i->rates, 0)
35420 | set11nRateFlags(i->rates, 1)
35421 | set11nRateFlags(i->rates, 2)
35422 | set11nRateFlags(i->rates, 3)
35423 diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
35424 index d9e0824..1a874e7 100644
35425 --- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
35426 +++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
35427 @@ -39,47 +39,47 @@ ar9003_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
35428 (i->qcu << AR_TxQcuNum_S) | desc_len;
35429
35430 checksum += val;
35431 - ACCESS_ONCE(ads->info) = val;
35432 + ACCESS_ONCE_RW(ads->info) = val;
35433
35434 checksum += i->link;
35435 - ACCESS_ONCE(ads->link) = i->link;
35436 + ACCESS_ONCE_RW(ads->link) = i->link;
35437
35438 checksum += i->buf_addr[0];
35439 - ACCESS_ONCE(ads->data0) = i->buf_addr[0];
35440 + ACCESS_ONCE_RW(ads->data0) = i->buf_addr[0];
35441 checksum += i->buf_addr[1];
35442 - ACCESS_ONCE(ads->data1) = i->buf_addr[1];
35443 + ACCESS_ONCE_RW(ads->data1) = i->buf_addr[1];
35444 checksum += i->buf_addr[2];
35445 - ACCESS_ONCE(ads->data2) = i->buf_addr[2];
35446 + ACCESS_ONCE_RW(ads->data2) = i->buf_addr[2];
35447 checksum += i->buf_addr[3];
35448 - ACCESS_ONCE(ads->data3) = i->buf_addr[3];
35449 + ACCESS_ONCE_RW(ads->data3) = i->buf_addr[3];
35450
35451 checksum += (val = (i->buf_len[0] << AR_BufLen_S) & AR_BufLen);
35452 - ACCESS_ONCE(ads->ctl3) = val;
35453 + ACCESS_ONCE_RW(ads->ctl3) = val;
35454 checksum += (val = (i->buf_len[1] << AR_BufLen_S) & AR_BufLen);
35455 - ACCESS_ONCE(ads->ctl5) = val;
35456 + ACCESS_ONCE_RW(ads->ctl5) = val;
35457 checksum += (val = (i->buf_len[2] << AR_BufLen_S) & AR_BufLen);
35458 - ACCESS_ONCE(ads->ctl7) = val;
35459 + ACCESS_ONCE_RW(ads->ctl7) = val;
35460 checksum += (val = (i->buf_len[3] << AR_BufLen_S) & AR_BufLen);
35461 - ACCESS_ONCE(ads->ctl9) = val;
35462 + ACCESS_ONCE_RW(ads->ctl9) = val;
35463
35464 checksum = (u16) (((checksum & 0xffff) + (checksum >> 16)) & 0xffff);
35465 - ACCESS_ONCE(ads->ctl10) = checksum;
35466 + ACCESS_ONCE_RW(ads->ctl10) = checksum;
35467
35468 if (i->is_first || i->is_last) {
35469 - ACCESS_ONCE(ads->ctl13) = set11nTries(i->rates, 0)
35470 + ACCESS_ONCE_RW(ads->ctl13) = set11nTries(i->rates, 0)
35471 | set11nTries(i->rates, 1)
35472 | set11nTries(i->rates, 2)
35473 | set11nTries(i->rates, 3)
35474 | (i->dur_update ? AR_DurUpdateEna : 0)
35475 | SM(0, AR_BurstDur);
35476
35477 - ACCESS_ONCE(ads->ctl14) = set11nRate(i->rates, 0)
35478 + ACCESS_ONCE_RW(ads->ctl14) = set11nRate(i->rates, 0)
35479 | set11nRate(i->rates, 1)
35480 | set11nRate(i->rates, 2)
35481 | set11nRate(i->rates, 3);
35482 } else {
35483 - ACCESS_ONCE(ads->ctl13) = 0;
35484 - ACCESS_ONCE(ads->ctl14) = 0;
35485 + ACCESS_ONCE_RW(ads->ctl13) = 0;
35486 + ACCESS_ONCE_RW(ads->ctl14) = 0;
35487 }
35488
35489 ads->ctl20 = 0;
35490 @@ -89,17 +89,17 @@ ar9003_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
35491
35492 ctl17 = SM(i->keytype, AR_EncrType);
35493 if (!i->is_first) {
35494 - ACCESS_ONCE(ads->ctl11) = 0;
35495 - ACCESS_ONCE(ads->ctl12) = i->is_last ? 0 : AR_TxMore;
35496 - ACCESS_ONCE(ads->ctl15) = 0;
35497 - ACCESS_ONCE(ads->ctl16) = 0;
35498 - ACCESS_ONCE(ads->ctl17) = ctl17;
35499 - ACCESS_ONCE(ads->ctl18) = 0;
35500 - ACCESS_ONCE(ads->ctl19) = 0;
35501 + ACCESS_ONCE_RW(ads->ctl11) = 0;
35502 + ACCESS_ONCE_RW(ads->ctl12) = i->is_last ? 0 : AR_TxMore;
35503 + ACCESS_ONCE_RW(ads->ctl15) = 0;
35504 + ACCESS_ONCE_RW(ads->ctl16) = 0;
35505 + ACCESS_ONCE_RW(ads->ctl17) = ctl17;
35506 + ACCESS_ONCE_RW(ads->ctl18) = 0;
35507 + ACCESS_ONCE_RW(ads->ctl19) = 0;
35508 return;
35509 }
35510
35511 - ACCESS_ONCE(ads->ctl11) = (i->pkt_len & AR_FrameLen)
35512 + ACCESS_ONCE_RW(ads->ctl11) = (i->pkt_len & AR_FrameLen)
35513 | (i->flags & ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0)
35514 | SM(i->txpower, AR_XmitPower)
35515 | (i->flags & ATH9K_TXDESC_VEOL ? AR_VEOL : 0)
35516 @@ -135,22 +135,22 @@ ar9003_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
35517 val = (i->flags & ATH9K_TXDESC_PAPRD) >> ATH9K_TXDESC_PAPRD_S;
35518 ctl12 |= SM(val, AR_PAPRDChainMask);
35519
35520 - ACCESS_ONCE(ads->ctl12) = ctl12;
35521 - ACCESS_ONCE(ads->ctl17) = ctl17;
35522 + ACCESS_ONCE_RW(ads->ctl12) = ctl12;
35523 + ACCESS_ONCE_RW(ads->ctl17) = ctl17;
35524
35525 - ACCESS_ONCE(ads->ctl15) = set11nPktDurRTSCTS(i->rates, 0)
35526 + ACCESS_ONCE_RW(ads->ctl15) = set11nPktDurRTSCTS(i->rates, 0)
35527 | set11nPktDurRTSCTS(i->rates, 1);
35528
35529 - ACCESS_ONCE(ads->ctl16) = set11nPktDurRTSCTS(i->rates, 2)
35530 + ACCESS_ONCE_RW(ads->ctl16) = set11nPktDurRTSCTS(i->rates, 2)
35531 | set11nPktDurRTSCTS(i->rates, 3);
35532
35533 - ACCESS_ONCE(ads->ctl18) = set11nRateFlags(i->rates, 0)
35534 + ACCESS_ONCE_RW(ads->ctl18) = set11nRateFlags(i->rates, 0)
35535 | set11nRateFlags(i->rates, 1)
35536 | set11nRateFlags(i->rates, 2)
35537 | set11nRateFlags(i->rates, 3)
35538 | SM(i->rtscts_rate, AR_RTSCTSRate);
35539
35540 - ACCESS_ONCE(ads->ctl19) = AR_Not_Sounding;
35541 + ACCESS_ONCE_RW(ads->ctl19) = AR_Not_Sounding;
35542 }
35543
35544 static u16 ar9003_calc_ptr_chksum(struct ar9003_txc *ads)
35545 diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
35546 index 02f5007..bd0bd8f 100644
35547 --- a/drivers/net/wireless/ath/ath9k/hw.h
35548 +++ b/drivers/net/wireless/ath/ath9k/hw.h
35549 @@ -610,7 +610,7 @@ struct ath_hw_private_ops {
35550
35551 /* ANI */
35552 void (*ani_cache_ini_regs)(struct ath_hw *ah);
35553 -};
35554 +} __no_const;
35555
35556 /**
35557 * struct ath_hw_ops - callbacks used by hardware code and driver code
35558 @@ -640,7 +640,7 @@ struct ath_hw_ops {
35559 void (*antdiv_comb_conf_set)(struct ath_hw *ah,
35560 struct ath_hw_antcomb_conf *antconf);
35561
35562 -};
35563 +} __no_const;
35564
35565 struct ath_nf_limits {
35566 s16 max;
35567 @@ -660,7 +660,7 @@ enum ath_cal_list {
35568 #define AH_FASTCC 0x4
35569
35570 struct ath_hw {
35571 - struct ath_ops reg_ops;
35572 + ath_ops_no_const reg_ops;
35573
35574 struct ieee80211_hw *hw;
35575 struct ath_common common;
35576 diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h
35577 index af00e2c..ab04d34 100644
35578 --- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h
35579 +++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_int.h
35580 @@ -545,7 +545,7 @@ struct phy_func_ptr {
35581 void (*carrsuppr)(struct brcms_phy *);
35582 s32 (*rxsigpwr)(struct brcms_phy *, s32);
35583 void (*detach)(struct brcms_phy *);
35584 -};
35585 +} __no_const;
35586
35587 struct brcms_phy {
35588 struct brcms_phy_pub pubpi_ro;
35589 diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
35590 index faec404..a5277f1 100644
35591 --- a/drivers/net/wireless/iwlegacy/3945-mac.c
35592 +++ b/drivers/net/wireless/iwlegacy/3945-mac.c
35593 @@ -3611,7 +3611,9 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
35594 */
35595 if (il3945_mod_params.disable_hw_scan) {
35596 D_INFO("Disabling hw_scan\n");
35597 - il3945_mac_ops.hw_scan = NULL;
35598 + pax_open_kernel();
35599 + *(void **)&il3945_mac_ops.hw_scan = NULL;
35600 + pax_close_kernel();
35601 }
35602
35603 D_INFO("*** LOAD DRIVER ***\n");
35604 diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
35605 index a0b7cfd..20b49f7 100644
35606 --- a/drivers/net/wireless/mac80211_hwsim.c
35607 +++ b/drivers/net/wireless/mac80211_hwsim.c
35608 @@ -1752,9 +1752,11 @@ static int __init init_mac80211_hwsim(void)
35609 return -EINVAL;
35610
35611 if (fake_hw_scan) {
35612 - mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan;
35613 - mac80211_hwsim_ops.sw_scan_start = NULL;
35614 - mac80211_hwsim_ops.sw_scan_complete = NULL;
35615 + pax_open_kernel();
35616 + *(void **)&mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan;
35617 + *(void **)&mac80211_hwsim_ops.sw_scan_start = NULL;
35618 + *(void **)&mac80211_hwsim_ops.sw_scan_complete = NULL;
35619 + pax_close_kernel();
35620 }
35621
35622 spin_lock_init(&hwsim_radio_lock);
35623 diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
35624 index bd3b0bf..f9db92a 100644
35625 --- a/drivers/net/wireless/mwifiex/main.h
35626 +++ b/drivers/net/wireless/mwifiex/main.h
35627 @@ -567,7 +567,7 @@ struct mwifiex_if_ops {
35628 int (*event_complete) (struct mwifiex_adapter *, struct sk_buff *);
35629 int (*data_complete) (struct mwifiex_adapter *, struct sk_buff *);
35630 int (*dnld_fw) (struct mwifiex_adapter *, struct mwifiex_fw_image *);
35631 -};
35632 +} __no_const;
35633
35634 struct mwifiex_adapter {
35635 u8 iface_type;
35636 diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
35637 index dfcd02a..a42a59d 100644
35638 --- a/drivers/net/wireless/rndis_wlan.c
35639 +++ b/drivers/net/wireless/rndis_wlan.c
35640 @@ -1235,7 +1235,7 @@ static int set_rts_threshold(struct usbnet *usbdev, u32 rts_threshold)
35641
35642 netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold);
35643
35644 - if (rts_threshold < 0 || rts_threshold > 2347)
35645 + if (rts_threshold > 2347)
35646 rts_threshold = 2347;
35647
35648 tmp = cpu_to_le32(rts_threshold);
35649 diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
35650 index 8f75402..eed109d 100644
35651 --- a/drivers/net/wireless/rt2x00/rt2x00.h
35652 +++ b/drivers/net/wireless/rt2x00/rt2x00.h
35653 @@ -396,7 +396,7 @@ struct rt2x00_intf {
35654 * for hardware which doesn't support hardware
35655 * sequence counting.
35656 */
35657 - atomic_t seqno;
35658 + atomic_unchecked_t seqno;
35659 };
35660
35661 static inline struct rt2x00_intf* vif_to_intf(struct ieee80211_vif *vif)
35662 diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
35663 index 2fd8301..9767e8c 100644
35664 --- a/drivers/net/wireless/rt2x00/rt2x00queue.c
35665 +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
35666 @@ -240,9 +240,9 @@ static void rt2x00queue_create_tx_descriptor_seq(struct rt2x00_dev *rt2x00dev,
35667 * sequence counter given by mac80211.
35668 */
35669 if (test_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags))
35670 - seqno = atomic_add_return(0x10, &intf->seqno);
35671 + seqno = atomic_add_return_unchecked(0x10, &intf->seqno);
35672 else
35673 - seqno = atomic_read(&intf->seqno);
35674 + seqno = atomic_read_unchecked(&intf->seqno);
35675
35676 hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
35677 hdr->seq_ctrl |= cpu_to_le16(seqno);
35678 diff --git a/drivers/net/wireless/ti/wl1251/wl1251.h b/drivers/net/wireless/ti/wl1251/wl1251.h
35679 index 9d8f581..0f6589e 100644
35680 --- a/drivers/net/wireless/ti/wl1251/wl1251.h
35681 +++ b/drivers/net/wireless/ti/wl1251/wl1251.h
35682 @@ -266,7 +266,7 @@ struct wl1251_if_operations {
35683 void (*reset)(struct wl1251 *wl);
35684 void (*enable_irq)(struct wl1251 *wl);
35685 void (*disable_irq)(struct wl1251 *wl);
35686 -};
35687 +} __no_const;
35688
35689 struct wl1251 {
35690 struct ieee80211_hw *hw;
35691 diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
35692 index 0b3f0b5..62f68bd 100644
35693 --- a/drivers/net/wireless/ti/wlcore/wlcore.h
35694 +++ b/drivers/net/wireless/ti/wlcore/wlcore.h
35695 @@ -61,7 +61,7 @@ struct wlcore_ops {
35696 struct wl12xx_vif *wlvif);
35697 s8 (*get_pg_ver)(struct wl1271 *wl);
35698 void (*get_mac)(struct wl1271 *wl);
35699 -};
35700 +} __no_const;
35701
35702 enum wlcore_partitions {
35703 PART_DOWN,
35704 diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
35705 index f34b5b2..b5abb9f 100644
35706 --- a/drivers/oprofile/buffer_sync.c
35707 +++ b/drivers/oprofile/buffer_sync.c
35708 @@ -343,7 +343,7 @@ static void add_data(struct op_entry *entry, struct mm_struct *mm)
35709 if (cookie == NO_COOKIE)
35710 offset = pc;
35711 if (cookie == INVALID_COOKIE) {
35712 - atomic_inc(&oprofile_stats.sample_lost_no_mapping);
35713 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
35714 offset = pc;
35715 }
35716 if (cookie != last_cookie) {
35717 @@ -387,14 +387,14 @@ add_sample(struct mm_struct *mm, struct op_sample *s, int in_kernel)
35718 /* add userspace sample */
35719
35720 if (!mm) {
35721 - atomic_inc(&oprofile_stats.sample_lost_no_mm);
35722 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
35723 return 0;
35724 }
35725
35726 cookie = lookup_dcookie(mm, s->eip, &offset);
35727
35728 if (cookie == INVALID_COOKIE) {
35729 - atomic_inc(&oprofile_stats.sample_lost_no_mapping);
35730 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
35731 return 0;
35732 }
35733
35734 @@ -563,7 +563,7 @@ void sync_buffer(int cpu)
35735 /* ignore backtraces if failed to add a sample */
35736 if (state == sb_bt_start) {
35737 state = sb_bt_ignore;
35738 - atomic_inc(&oprofile_stats.bt_lost_no_mapping);
35739 + atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
35740 }
35741 }
35742 release_mm(mm);
35743 diff --git a/drivers/oprofile/event_buffer.c b/drivers/oprofile/event_buffer.c
35744 index c0cc4e7..44d4e54 100644
35745 --- a/drivers/oprofile/event_buffer.c
35746 +++ b/drivers/oprofile/event_buffer.c
35747 @@ -53,7 +53,7 @@ void add_event_entry(unsigned long value)
35748 }
35749
35750 if (buffer_pos == buffer_size) {
35751 - atomic_inc(&oprofile_stats.event_lost_overflow);
35752 + atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
35753 return;
35754 }
35755
35756 diff --git a/drivers/oprofile/oprof.c b/drivers/oprofile/oprof.c
35757 index ed2c3ec..deda85a 100644
35758 --- a/drivers/oprofile/oprof.c
35759 +++ b/drivers/oprofile/oprof.c
35760 @@ -110,7 +110,7 @@ static void switch_worker(struct work_struct *work)
35761 if (oprofile_ops.switch_events())
35762 return;
35763
35764 - atomic_inc(&oprofile_stats.multiplex_counter);
35765 + atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
35766 start_switch_worker();
35767 }
35768
35769 diff --git a/drivers/oprofile/oprofile_stats.c b/drivers/oprofile/oprofile_stats.c
35770 index 917d28e..d62d981 100644
35771 --- a/drivers/oprofile/oprofile_stats.c
35772 +++ b/drivers/oprofile/oprofile_stats.c
35773 @@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
35774 cpu_buf->sample_invalid_eip = 0;
35775 }
35776
35777 - atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
35778 - atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
35779 - atomic_set(&oprofile_stats.event_lost_overflow, 0);
35780 - atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
35781 - atomic_set(&oprofile_stats.multiplex_counter, 0);
35782 + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
35783 + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
35784 + atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
35785 + atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
35786 + atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
35787 }
35788
35789
35790 diff --git a/drivers/oprofile/oprofile_stats.h b/drivers/oprofile/oprofile_stats.h
35791 index 38b6fc0..b5cbfce 100644
35792 --- a/drivers/oprofile/oprofile_stats.h
35793 +++ b/drivers/oprofile/oprofile_stats.h
35794 @@ -13,11 +13,11 @@
35795 #include <linux/atomic.h>
35796
35797 struct oprofile_stat_struct {
35798 - atomic_t sample_lost_no_mm;
35799 - atomic_t sample_lost_no_mapping;
35800 - atomic_t bt_lost_no_mapping;
35801 - atomic_t event_lost_overflow;
35802 - atomic_t multiplex_counter;
35803 + atomic_unchecked_t sample_lost_no_mm;
35804 + atomic_unchecked_t sample_lost_no_mapping;
35805 + atomic_unchecked_t bt_lost_no_mapping;
35806 + atomic_unchecked_t event_lost_overflow;
35807 + atomic_unchecked_t multiplex_counter;
35808 };
35809
35810 extern struct oprofile_stat_struct oprofile_stats;
35811 diff --git a/drivers/oprofile/oprofilefs.c b/drivers/oprofile/oprofilefs.c
35812 index 849357c..b83c1e0 100644
35813 --- a/drivers/oprofile/oprofilefs.c
35814 +++ b/drivers/oprofile/oprofilefs.c
35815 @@ -185,7 +185,7 @@ static const struct file_operations atomic_ro_fops = {
35816
35817
35818 int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
35819 - char const *name, atomic_t *val)
35820 + char const *name, atomic_unchecked_t *val)
35821 {
35822 return __oprofilefs_create_file(sb, root, name,
35823 &atomic_ro_fops, 0444, val);
35824 diff --git a/drivers/parport/procfs.c b/drivers/parport/procfs.c
35825 index 3f56bc0..707d642 100644
35826 --- a/drivers/parport/procfs.c
35827 +++ b/drivers/parport/procfs.c
35828 @@ -64,7 +64,7 @@ static int do_active_device(ctl_table *table, int write,
35829
35830 *ppos += len;
35831
35832 - return copy_to_user(result, buffer, len) ? -EFAULT : 0;
35833 + return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
35834 }
35835
35836 #ifdef CONFIG_PARPORT_1284
35837 @@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table, int write,
35838
35839 *ppos += len;
35840
35841 - return copy_to_user (result, buffer, len) ? -EFAULT : 0;
35842 + return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
35843 }
35844 #endif /* IEEE1284.3 support. */
35845
35846 diff --git a/drivers/pci/hotplug/cpci_hotplug.h b/drivers/pci/hotplug/cpci_hotplug.h
35847 index 9fff878..ad0ad53 100644
35848 --- a/drivers/pci/hotplug/cpci_hotplug.h
35849 +++ b/drivers/pci/hotplug/cpci_hotplug.h
35850 @@ -59,7 +59,7 @@ struct cpci_hp_controller_ops {
35851 int (*hardware_test) (struct slot* slot, u32 value);
35852 u8 (*get_power) (struct slot* slot);
35853 int (*set_power) (struct slot* slot, int value);
35854 -};
35855 +} __no_const;
35856
35857 struct cpci_hp_controller {
35858 unsigned int irq;
35859 diff --git a/drivers/pci/hotplug/cpqphp_nvram.c b/drivers/pci/hotplug/cpqphp_nvram.c
35860 index 76ba8a1..20ca857 100644
35861 --- a/drivers/pci/hotplug/cpqphp_nvram.c
35862 +++ b/drivers/pci/hotplug/cpqphp_nvram.c
35863 @@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_start)
35864
35865 void compaq_nvram_init (void __iomem *rom_start)
35866 {
35867 +
35868 +#ifndef CONFIG_PAX_KERNEXEC
35869 if (rom_start) {
35870 compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
35871 }
35872 +#endif
35873 +
35874 dbg("int15 entry = %p\n", compaq_int15_entry_point);
35875
35876 /* initialize our int15 lock */
35877 diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
35878 index b500840..d7159d3 100644
35879 --- a/drivers/pci/pcie/aspm.c
35880 +++ b/drivers/pci/pcie/aspm.c
35881 @@ -27,9 +27,9 @@
35882 #define MODULE_PARAM_PREFIX "pcie_aspm."
35883
35884 /* Note: those are not register definitions */
35885 -#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
35886 -#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
35887 -#define ASPM_STATE_L1 (4) /* L1 state */
35888 +#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
35889 +#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
35890 +#define ASPM_STATE_L1 (4U) /* L1 state */
35891 #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
35892 #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
35893
35894 diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
35895 index 658ac97..05e1b90 100644
35896 --- a/drivers/pci/probe.c
35897 +++ b/drivers/pci/probe.c
35898 @@ -137,7 +137,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
35899 u16 orig_cmd;
35900 struct pci_bus_region region;
35901
35902 - mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
35903 + mask = type ? (u32)PCI_ROM_ADDRESS_MASK : ~0;
35904
35905 if (!dev->mmio_always_on) {
35906 pci_read_config_word(dev, PCI_COMMAND, &orig_cmd);
35907 diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
35908 index 27911b5..5b6db88 100644
35909 --- a/drivers/pci/proc.c
35910 +++ b/drivers/pci/proc.c
35911 @@ -476,7 +476,16 @@ static const struct file_operations proc_bus_pci_dev_operations = {
35912 static int __init pci_proc_init(void)
35913 {
35914 struct pci_dev *dev = NULL;
35915 +
35916 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
35917 +#ifdef CONFIG_GRKERNSEC_PROC_USER
35918 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
35919 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
35920 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
35921 +#endif
35922 +#else
35923 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
35924 +#endif
35925 proc_create("devices", 0, proc_bus_pci_dir,
35926 &proc_bus_pci_dev_operations);
35927 proc_initialized = 1;
35928 diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
35929 index 8b5610d..a4c22bb 100644
35930 --- a/drivers/platform/x86/thinkpad_acpi.c
35931 +++ b/drivers/platform/x86/thinkpad_acpi.c
35932 @@ -2094,7 +2094,7 @@ static int hotkey_mask_get(void)
35933 return 0;
35934 }
35935
35936 -void static hotkey_mask_warn_incomplete_mask(void)
35937 +static void hotkey_mask_warn_incomplete_mask(void)
35938 {
35939 /* log only what the user can fix... */
35940 const u32 wantedmask = hotkey_driver_mask &
35941 @@ -2325,11 +2325,6 @@ static void hotkey_read_nvram(struct tp_nvram_state *n, const u32 m)
35942 }
35943 }
35944
35945 -static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35946 - struct tp_nvram_state *newn,
35947 - const u32 event_mask)
35948 -{
35949 -
35950 #define TPACPI_COMPARE_KEY(__scancode, __member) \
35951 do { \
35952 if ((event_mask & (1 << __scancode)) && \
35953 @@ -2343,36 +2338,42 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
35954 tpacpi_hotkey_send_key(__scancode); \
35955 } while (0)
35956
35957 - void issue_volchange(const unsigned int oldvol,
35958 - const unsigned int newvol)
35959 - {
35960 - unsigned int i = oldvol;
35961 +static void issue_volchange(const unsigned int oldvol,
35962 + const unsigned int newvol,
35963 + const u32 event_mask)
35964 +{
35965 + unsigned int i = oldvol;
35966
35967 - while (i > newvol) {
35968 - TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEDOWN);
35969 - i--;
35970 - }
35971 - while (i < newvol) {
35972 - TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEUP);
35973 - i++;
35974 - }
35975 + while (i > newvol) {
35976 + TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEDOWN);
35977 + i--;
35978 }
35979 + while (i < newvol) {
35980 + TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEUP);
35981 + i++;
35982 + }
35983 +}
35984
35985 - void issue_brightnesschange(const unsigned int oldbrt,
35986 - const unsigned int newbrt)
35987 - {
35988 - unsigned int i = oldbrt;
35989 +static void issue_brightnesschange(const unsigned int oldbrt,
35990 + const unsigned int newbrt,
35991 + const u32 event_mask)
35992 +{
35993 + unsigned int i = oldbrt;
35994
35995 - while (i > newbrt) {
35996 - TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNEND);
35997 - i--;
35998 - }
35999 - while (i < newbrt) {
36000 - TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
36001 - i++;
36002 - }
36003 + while (i > newbrt) {
36004 + TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNEND);
36005 + i--;
36006 + }
36007 + while (i < newbrt) {
36008 + TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
36009 + i++;
36010 }
36011 +}
36012
36013 +static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
36014 + struct tp_nvram_state *newn,
36015 + const u32 event_mask)
36016 +{
36017 TPACPI_COMPARE_KEY(TP_ACPI_HOTKEYSCAN_THINKPAD, thinkpad_toggle);
36018 TPACPI_COMPARE_KEY(TP_ACPI_HOTKEYSCAN_FNSPACE, zoom_toggle);
36019 TPACPI_COMPARE_KEY(TP_ACPI_HOTKEYSCAN_FNF7, display_toggle);
36020 @@ -2406,7 +2407,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
36021 oldn->volume_level != newn->volume_level) {
36022 /* recently muted, or repeated mute keypress, or
36023 * multiple presses ending in mute */
36024 - issue_volchange(oldn->volume_level, newn->volume_level);
36025 + issue_volchange(oldn->volume_level, newn->volume_level, event_mask);
36026 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_MUTE);
36027 }
36028 } else {
36029 @@ -2416,7 +2417,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
36030 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEUP);
36031 }
36032 if (oldn->volume_level != newn->volume_level) {
36033 - issue_volchange(oldn->volume_level, newn->volume_level);
36034 + issue_volchange(oldn->volume_level, newn->volume_level, event_mask);
36035 } else if (oldn->volume_toggle != newn->volume_toggle) {
36036 /* repeated vol up/down keypress at end of scale ? */
36037 if (newn->volume_level == 0)
36038 @@ -2429,7 +2430,8 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
36039 /* handle brightness */
36040 if (oldn->brightness_level != newn->brightness_level) {
36041 issue_brightnesschange(oldn->brightness_level,
36042 - newn->brightness_level);
36043 + newn->brightness_level,
36044 + event_mask);
36045 } else if (oldn->brightness_toggle != newn->brightness_toggle) {
36046 /* repeated key presses that didn't change state */
36047 if (newn->brightness_level == 0)
36048 @@ -2438,10 +2440,10 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
36049 && !tp_features.bright_unkfw)
36050 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
36051 }
36052 +}
36053
36054 #undef TPACPI_COMPARE_KEY
36055 #undef TPACPI_MAY_SEND_KEY
36056 -}
36057
36058 /*
36059 * Polling driver
36060 diff --git a/drivers/pnp/pnpbios/bioscalls.c b/drivers/pnp/pnpbios/bioscalls.c
36061 index 769d265..a3a05ca 100644
36062 --- a/drivers/pnp/pnpbios/bioscalls.c
36063 +++ b/drivers/pnp/pnpbios/bioscalls.c
36064 @@ -58,7 +58,7 @@ do { \
36065 set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
36066 } while(0)
36067
36068 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
36069 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
36070 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
36071
36072 /*
36073 @@ -95,7 +95,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
36074
36075 cpu = get_cpu();
36076 save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
36077 +
36078 + pax_open_kernel();
36079 get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
36080 + pax_close_kernel();
36081
36082 /* On some boxes IRQ's during PnP BIOS calls are deadly. */
36083 spin_lock_irqsave(&pnp_bios_lock, flags);
36084 @@ -133,7 +136,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
36085 :"memory");
36086 spin_unlock_irqrestore(&pnp_bios_lock, flags);
36087
36088 + pax_open_kernel();
36089 get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
36090 + pax_close_kernel();
36091 +
36092 put_cpu();
36093
36094 /* If we get here and this is set then the PnP BIOS faulted on us. */
36095 @@ -467,7 +473,7 @@ int pnp_bios_read_escd(char *data, u32 nvram_base)
36096 return status;
36097 }
36098
36099 -void pnpbios_calls_init(union pnp_bios_install_struct *header)
36100 +void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
36101 {
36102 int i;
36103
36104 @@ -475,6 +481,8 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
36105 pnp_bios_callpoint.offset = header->fields.pm16offset;
36106 pnp_bios_callpoint.segment = PNP_CS16;
36107
36108 + pax_open_kernel();
36109 +
36110 for_each_possible_cpu(i) {
36111 struct desc_struct *gdt = get_cpu_gdt_table(i);
36112 if (!gdt)
36113 @@ -486,4 +494,6 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
36114 set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
36115 (unsigned long)__va(header->fields.pm16dseg));
36116 }
36117 +
36118 + pax_close_kernel();
36119 }
36120 diff --git a/drivers/pnp/resource.c b/drivers/pnp/resource.c
36121 index b0ecacb..7c9da2e 100644
36122 --- a/drivers/pnp/resource.c
36123 +++ b/drivers/pnp/resource.c
36124 @@ -360,7 +360,7 @@ int pnp_check_irq(struct pnp_dev *dev, struct resource *res)
36125 return 1;
36126
36127 /* check if the resource is valid */
36128 - if (*irq < 0 || *irq > 15)
36129 + if (*irq > 15)
36130 return 0;
36131
36132 /* check if the resource is reserved */
36133 @@ -424,7 +424,7 @@ int pnp_check_dma(struct pnp_dev *dev, struct resource *res)
36134 return 1;
36135
36136 /* check if the resource is valid */
36137 - if (*dma < 0 || *dma == 4 || *dma > 7)
36138 + if (*dma == 4 || *dma > 7)
36139 return 0;
36140
36141 /* check if the resource is reserved */
36142 diff --git a/drivers/power/bq27x00_battery.c b/drivers/power/bq27x00_battery.c
36143 index f5d6d37..739f6a9 100644
36144 --- a/drivers/power/bq27x00_battery.c
36145 +++ b/drivers/power/bq27x00_battery.c
36146 @@ -72,7 +72,7 @@
36147 struct bq27x00_device_info;
36148 struct bq27x00_access_methods {
36149 int (*read)(struct bq27x00_device_info *di, u8 reg, bool single);
36150 -};
36151 +} __no_const;
36152
36153 enum bq27x00_chip { BQ27000, BQ27500 };
36154
36155 diff --git a/drivers/regulator/max8660.c b/drivers/regulator/max8660.c
36156 index 8d53174..04c65de 100644
36157 --- a/drivers/regulator/max8660.c
36158 +++ b/drivers/regulator/max8660.c
36159 @@ -333,8 +333,10 @@ static int __devinit max8660_probe(struct i2c_client *client,
36160 max8660->shadow_regs[MAX8660_OVER1] = 5;
36161 } else {
36162 /* Otherwise devices can be toggled via software */
36163 - max8660_dcdc_ops.enable = max8660_dcdc_enable;
36164 - max8660_dcdc_ops.disable = max8660_dcdc_disable;
36165 + pax_open_kernel();
36166 + *(void **)&max8660_dcdc_ops.enable = max8660_dcdc_enable;
36167 + *(void **)&max8660_dcdc_ops.disable = max8660_dcdc_disable;
36168 + pax_close_kernel();
36169 }
36170
36171 /*
36172 diff --git a/drivers/regulator/mc13892-regulator.c b/drivers/regulator/mc13892-regulator.c
36173 index 970a233..ee1f241 100644
36174 --- a/drivers/regulator/mc13892-regulator.c
36175 +++ b/drivers/regulator/mc13892-regulator.c
36176 @@ -566,10 +566,12 @@ static int __devinit mc13892_regulator_probe(struct platform_device *pdev)
36177 }
36178 mc13xxx_unlock(mc13892);
36179
36180 - mc13892_regulators[MC13892_VCAM].desc.ops->set_mode
36181 + pax_open_kernel();
36182 + *(void **)&mc13892_regulators[MC13892_VCAM].desc.ops->set_mode
36183 = mc13892_vcam_set_mode;
36184 - mc13892_regulators[MC13892_VCAM].desc.ops->get_mode
36185 + *(void **)&mc13892_regulators[MC13892_VCAM].desc.ops->get_mode
36186 = mc13892_vcam_get_mode;
36187 + pax_close_kernel();
36188
36189 mc13xxx_data = mc13xxx_parse_regulators_dt(pdev, mc13892_regulators,
36190 ARRAY_SIZE(mc13892_regulators));
36191 diff --git a/drivers/rtc/rtc-dev.c b/drivers/rtc/rtc-dev.c
36192 index cace6d3..f623fda 100644
36193 --- a/drivers/rtc/rtc-dev.c
36194 +++ b/drivers/rtc/rtc-dev.c
36195 @@ -14,6 +14,7 @@
36196 #include <linux/module.h>
36197 #include <linux/rtc.h>
36198 #include <linux/sched.h>
36199 +#include <linux/grsecurity.h>
36200 #include "rtc-core.h"
36201
36202 static dev_t rtc_devt;
36203 @@ -345,6 +346,8 @@ static long rtc_dev_ioctl(struct file *file,
36204 if (copy_from_user(&tm, uarg, sizeof(tm)))
36205 return -EFAULT;
36206
36207 + gr_log_timechange();
36208 +
36209 return rtc_set_time(rtc, &tm);
36210
36211 case RTC_PIE_ON:
36212 diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
36213 index 3fcf627..f334910 100644
36214 --- a/drivers/scsi/aacraid/aacraid.h
36215 +++ b/drivers/scsi/aacraid/aacraid.h
36216 @@ -492,7 +492,7 @@ struct adapter_ops
36217 int (*adapter_scsi)(struct fib * fib, struct scsi_cmnd * cmd);
36218 /* Administrative operations */
36219 int (*adapter_comm)(struct aac_dev * dev, int comm);
36220 -};
36221 +} __no_const;
36222
36223 /*
36224 * Define which interrupt handler needs to be installed
36225 diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
36226 index 0d279c44..3d25a97 100644
36227 --- a/drivers/scsi/aacraid/linit.c
36228 +++ b/drivers/scsi/aacraid/linit.c
36229 @@ -93,7 +93,7 @@ static DECLARE_PCI_DEVICE_TABLE(aac_pci_tbl) = {
36230 #elif defined(__devinitconst)
36231 static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
36232 #else
36233 -static const struct pci_device_id aac_pci_tbl[] __devinitdata = {
36234 +static const struct pci_device_id aac_pci_tbl[] __devinitconst = {
36235 #endif
36236 { 0x1028, 0x0001, 0x1028, 0x0001, 0, 0, 0 }, /* PERC 2/Si (Iguana/PERC2Si) */
36237 { 0x1028, 0x0002, 0x1028, 0x0002, 0, 0, 1 }, /* PERC 3/Di (Opal/PERC3Di) */
36238 diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
36239 index ff80552..1c4120c 100644
36240 --- a/drivers/scsi/aic94xx/aic94xx_init.c
36241 +++ b/drivers/scsi/aic94xx/aic94xx_init.c
36242 @@ -1012,7 +1012,7 @@ static struct sas_domain_function_template aic94xx_transport_functions = {
36243 .lldd_ata_set_dmamode = asd_set_dmamode,
36244 };
36245
36246 -static const struct pci_device_id aic94xx_pci_table[] __devinitdata = {
36247 +static const struct pci_device_id aic94xx_pci_table[] __devinitconst = {
36248 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x410),0, 0, 1},
36249 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x412),0, 0, 1},
36250 {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, 0x416),0, 0, 1},
36251 diff --git a/drivers/scsi/bfa/bfa.h b/drivers/scsi/bfa/bfa.h
36252 index 4ad7e36..d004679 100644
36253 --- a/drivers/scsi/bfa/bfa.h
36254 +++ b/drivers/scsi/bfa/bfa.h
36255 @@ -196,7 +196,7 @@ struct bfa_hwif_s {
36256 u32 *end);
36257 int cpe_vec_q0;
36258 int rme_vec_q0;
36259 -};
36260 +} __no_const;
36261 typedef void (*bfa_cb_iocfc_t) (void *cbarg, enum bfa_status status);
36262
36263 struct bfa_faa_cbfn_s {
36264 diff --git a/drivers/scsi/bfa/bfa_fcpim.c b/drivers/scsi/bfa/bfa_fcpim.c
36265 index f0f80e2..8ec946b 100644
36266 --- a/drivers/scsi/bfa/bfa_fcpim.c
36267 +++ b/drivers/scsi/bfa/bfa_fcpim.c
36268 @@ -3715,7 +3715,7 @@ bfa_fcp_attach(struct bfa_s *bfa, void *bfad, struct bfa_iocfc_cfg_s *cfg,
36269
36270 bfa_iotag_attach(fcp);
36271
36272 - fcp->itn_arr = (struct bfa_itn_s *) bfa_mem_kva_curp(fcp);
36273 + fcp->itn_arr = (bfa_itn_s_no_const *) bfa_mem_kva_curp(fcp);
36274 bfa_mem_kva_curp(fcp) = (u8 *)fcp->itn_arr +
36275 (fcp->num_itns * sizeof(struct bfa_itn_s));
36276 memset(fcp->itn_arr, 0,
36277 @@ -3773,7 +3773,7 @@ bfa_itn_create(struct bfa_s *bfa, struct bfa_rport_s *rport,
36278 void (*isr)(struct bfa_s *bfa, struct bfi_msg_s *m))
36279 {
36280 struct bfa_fcp_mod_s *fcp = BFA_FCP_MOD(bfa);
36281 - struct bfa_itn_s *itn;
36282 + bfa_itn_s_no_const *itn;
36283
36284 itn = BFA_ITN_FROM_TAG(fcp, rport->rport_tag);
36285 itn->isr = isr;
36286 diff --git a/drivers/scsi/bfa/bfa_fcpim.h b/drivers/scsi/bfa/bfa_fcpim.h
36287 index 36f26da..38a34a8 100644
36288 --- a/drivers/scsi/bfa/bfa_fcpim.h
36289 +++ b/drivers/scsi/bfa/bfa_fcpim.h
36290 @@ -37,6 +37,7 @@ struct bfa_iotag_s {
36291 struct bfa_itn_s {
36292 bfa_isr_func_t isr;
36293 };
36294 +typedef struct bfa_itn_s __no_const bfa_itn_s_no_const;
36295
36296 void bfa_itn_create(struct bfa_s *bfa, struct bfa_rport_s *rport,
36297 void (*isr)(struct bfa_s *bfa, struct bfi_msg_s *m));
36298 @@ -147,7 +148,7 @@ struct bfa_fcp_mod_s {
36299 struct list_head iotag_tio_free_q; /* free IO resources */
36300 struct list_head iotag_unused_q; /* unused IO resources*/
36301 struct bfa_iotag_s *iotag_arr;
36302 - struct bfa_itn_s *itn_arr;
36303 + bfa_itn_s_no_const *itn_arr;
36304 int num_ioim_reqs;
36305 int num_fwtio_reqs;
36306 int num_itns;
36307 diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
36308 index 1a99d4b..e85d64b 100644
36309 --- a/drivers/scsi/bfa/bfa_ioc.h
36310 +++ b/drivers/scsi/bfa/bfa_ioc.h
36311 @@ -258,7 +258,7 @@ struct bfa_ioc_cbfn_s {
36312 bfa_ioc_disable_cbfn_t disable_cbfn;
36313 bfa_ioc_hbfail_cbfn_t hbfail_cbfn;
36314 bfa_ioc_reset_cbfn_t reset_cbfn;
36315 -};
36316 +} __no_const;
36317
36318 /*
36319 * IOC event notification mechanism.
36320 @@ -346,7 +346,7 @@ struct bfa_ioc_hwif_s {
36321 void (*ioc_sync_ack) (struct bfa_ioc_s *ioc);
36322 bfa_boolean_t (*ioc_sync_complete) (struct bfa_ioc_s *ioc);
36323 bfa_boolean_t (*ioc_lpu_read_stat) (struct bfa_ioc_s *ioc);
36324 -};
36325 +} __no_const;
36326
36327 /*
36328 * Queue element to wait for room in request queue. FIFO order is
36329 diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
36330 index b48c24f..dac0fbc 100644
36331 --- a/drivers/scsi/hosts.c
36332 +++ b/drivers/scsi/hosts.c
36333 @@ -42,7 +42,7 @@
36334 #include "scsi_logging.h"
36335
36336
36337 -static atomic_t scsi_host_next_hn; /* host_no for next new host */
36338 +static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
36339
36340
36341 static void scsi_host_cls_release(struct device *dev)
36342 @@ -361,7 +361,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
36343 * subtract one because we increment first then return, but we need to
36344 * know what the next host number was before increment
36345 */
36346 - shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
36347 + shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
36348 shost->dma_channel = 0xff;
36349
36350 /* These three are default values which can be overridden */
36351 diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
36352 index 796482b..d08435c 100644
36353 --- a/drivers/scsi/hpsa.c
36354 +++ b/drivers/scsi/hpsa.c
36355 @@ -536,7 +536,7 @@ static inline u32 next_command(struct ctlr_info *h, u8 q)
36356 unsigned long flags;
36357
36358 if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
36359 - return h->access.command_completed(h, q);
36360 + return h->access->command_completed(h, q);
36361
36362 if ((rq->head[rq->current_entry] & 1) == rq->wraparound) {
36363 a = rq->head[rq->current_entry];
36364 @@ -3354,7 +3354,7 @@ static void start_io(struct ctlr_info *h)
36365 while (!list_empty(&h->reqQ)) {
36366 c = list_entry(h->reqQ.next, struct CommandList, list);
36367 /* can't do anything if fifo is full */
36368 - if ((h->access.fifo_full(h))) {
36369 + if ((h->access->fifo_full(h))) {
36370 dev_warn(&h->pdev->dev, "fifo full\n");
36371 break;
36372 }
36373 @@ -3376,7 +3376,7 @@ static void start_io(struct ctlr_info *h)
36374
36375 /* Tell the controller execute command */
36376 spin_unlock_irqrestore(&h->lock, flags);
36377 - h->access.submit_command(h, c);
36378 + h->access->submit_command(h, c);
36379 spin_lock_irqsave(&h->lock, flags);
36380 }
36381 spin_unlock_irqrestore(&h->lock, flags);
36382 @@ -3384,17 +3384,17 @@ static void start_io(struct ctlr_info *h)
36383
36384 static inline unsigned long get_next_completion(struct ctlr_info *h, u8 q)
36385 {
36386 - return h->access.command_completed(h, q);
36387 + return h->access->command_completed(h, q);
36388 }
36389
36390 static inline bool interrupt_pending(struct ctlr_info *h)
36391 {
36392 - return h->access.intr_pending(h);
36393 + return h->access->intr_pending(h);
36394 }
36395
36396 static inline long interrupt_not_for_us(struct ctlr_info *h)
36397 {
36398 - return (h->access.intr_pending(h) == 0) ||
36399 + return (h->access->intr_pending(h) == 0) ||
36400 (h->interrupts_enabled == 0);
36401 }
36402
36403 @@ -4298,7 +4298,7 @@ static int __devinit hpsa_pci_init(struct ctlr_info *h)
36404 if (prod_index < 0)
36405 return -ENODEV;
36406 h->product_name = products[prod_index].product_name;
36407 - h->access = *(products[prod_index].access);
36408 + h->access = products[prod_index].access;
36409
36410 pci_disable_link_state(h->pdev, PCIE_LINK_STATE_L0S |
36411 PCIE_LINK_STATE_L1 | PCIE_LINK_STATE_CLKPM);
36412 @@ -4580,7 +4580,7 @@ static void controller_lockup_detected(struct ctlr_info *h)
36413
36414 assert_spin_locked(&lockup_detector_lock);
36415 remove_ctlr_from_lockup_detector_list(h);
36416 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
36417 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
36418 spin_lock_irqsave(&h->lock, flags);
36419 h->lockup_detected = readl(h->vaddr + SA5_SCRATCHPAD_OFFSET);
36420 spin_unlock_irqrestore(&h->lock, flags);
36421 @@ -4758,7 +4758,7 @@ reinit_after_soft_reset:
36422 }
36423
36424 /* make sure the board interrupts are off */
36425 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
36426 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
36427
36428 if (hpsa_request_irq(h, do_hpsa_intr_msi, do_hpsa_intr_intx))
36429 goto clean2;
36430 @@ -4792,7 +4792,7 @@ reinit_after_soft_reset:
36431 * fake ones to scoop up any residual completions.
36432 */
36433 spin_lock_irqsave(&h->lock, flags);
36434 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
36435 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
36436 spin_unlock_irqrestore(&h->lock, flags);
36437 free_irqs(h);
36438 rc = hpsa_request_irq(h, hpsa_msix_discard_completions,
36439 @@ -4811,9 +4811,9 @@ reinit_after_soft_reset:
36440 dev_info(&h->pdev->dev, "Board READY.\n");
36441 dev_info(&h->pdev->dev,
36442 "Waiting for stale completions to drain.\n");
36443 - h->access.set_intr_mask(h, HPSA_INTR_ON);
36444 + h->access->set_intr_mask(h, HPSA_INTR_ON);
36445 msleep(10000);
36446 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
36447 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
36448
36449 rc = controller_reset_failed(h->cfgtable);
36450 if (rc)
36451 @@ -4834,7 +4834,7 @@ reinit_after_soft_reset:
36452 }
36453
36454 /* Turn the interrupts on so we can service requests */
36455 - h->access.set_intr_mask(h, HPSA_INTR_ON);
36456 + h->access->set_intr_mask(h, HPSA_INTR_ON);
36457
36458 hpsa_hba_inquiry(h);
36459 hpsa_register_scsi(h); /* hook ourselves into SCSI subsystem */
36460 @@ -4886,7 +4886,7 @@ static void hpsa_shutdown(struct pci_dev *pdev)
36461 * To write all data in the battery backed cache to disks
36462 */
36463 hpsa_flush_cache(h);
36464 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
36465 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
36466 hpsa_free_irqs_and_disable_msix(h);
36467 }
36468
36469 @@ -5055,7 +5055,7 @@ static __devinit void hpsa_enter_performant_mode(struct ctlr_info *h,
36470 return;
36471 }
36472 /* Change the access methods to the performant access methods */
36473 - h->access = SA5_performant_access;
36474 + h->access = &SA5_performant_access;
36475 h->transMethod = CFGTBL_Trans_Performant;
36476 }
36477
36478 diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
36479 index 9816479..c5d4e97 100644
36480 --- a/drivers/scsi/hpsa.h
36481 +++ b/drivers/scsi/hpsa.h
36482 @@ -79,7 +79,7 @@ struct ctlr_info {
36483 unsigned int msix_vector;
36484 unsigned int msi_vector;
36485 int intr_mode; /* either PERF_MODE_INT or SIMPLE_MODE_INT */
36486 - struct access_method access;
36487 + struct access_method *access;
36488
36489 /* queue and queue Info */
36490 struct list_head reqQ;
36491 diff --git a/drivers/scsi/ips.h b/drivers/scsi/ips.h
36492 index f2df059..a3a9930 100644
36493 --- a/drivers/scsi/ips.h
36494 +++ b/drivers/scsi/ips.h
36495 @@ -1027,7 +1027,7 @@ typedef struct {
36496 int (*intr)(struct ips_ha *);
36497 void (*enableint)(struct ips_ha *);
36498 uint32_t (*statupd)(struct ips_ha *);
36499 -} ips_hw_func_t;
36500 +} __no_const ips_hw_func_t;
36501
36502 typedef struct ips_ha {
36503 uint8_t ha_id[IPS_MAX_CHANNELS+1];
36504 diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
36505 index aceffad..c35c08d 100644
36506 --- a/drivers/scsi/libfc/fc_exch.c
36507 +++ b/drivers/scsi/libfc/fc_exch.c
36508 @@ -105,12 +105,12 @@ struct fc_exch_mgr {
36509 * all together if not used XXX
36510 */
36511 struct {
36512 - atomic_t no_free_exch;
36513 - atomic_t no_free_exch_xid;
36514 - atomic_t xid_not_found;
36515 - atomic_t xid_busy;
36516 - atomic_t seq_not_found;
36517 - atomic_t non_bls_resp;
36518 + atomic_unchecked_t no_free_exch;
36519 + atomic_unchecked_t no_free_exch_xid;
36520 + atomic_unchecked_t xid_not_found;
36521 + atomic_unchecked_t xid_busy;
36522 + atomic_unchecked_t seq_not_found;
36523 + atomic_unchecked_t non_bls_resp;
36524 } stats;
36525 };
36526
36527 @@ -719,7 +719,7 @@ static struct fc_exch *fc_exch_em_alloc(struct fc_lport *lport,
36528 /* allocate memory for exchange */
36529 ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
36530 if (!ep) {
36531 - atomic_inc(&mp->stats.no_free_exch);
36532 + atomic_inc_unchecked(&mp->stats.no_free_exch);
36533 goto out;
36534 }
36535 memset(ep, 0, sizeof(*ep));
36536 @@ -780,7 +780,7 @@ out:
36537 return ep;
36538 err:
36539 spin_unlock_bh(&pool->lock);
36540 - atomic_inc(&mp->stats.no_free_exch_xid);
36541 + atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
36542 mempool_free(ep, mp->ep_pool);
36543 return NULL;
36544 }
36545 @@ -923,7 +923,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
36546 xid = ntohs(fh->fh_ox_id); /* we originated exch */
36547 ep = fc_exch_find(mp, xid);
36548 if (!ep) {
36549 - atomic_inc(&mp->stats.xid_not_found);
36550 + atomic_inc_unchecked(&mp->stats.xid_not_found);
36551 reject = FC_RJT_OX_ID;
36552 goto out;
36553 }
36554 @@ -953,7 +953,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
36555 ep = fc_exch_find(mp, xid);
36556 if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
36557 if (ep) {
36558 - atomic_inc(&mp->stats.xid_busy);
36559 + atomic_inc_unchecked(&mp->stats.xid_busy);
36560 reject = FC_RJT_RX_ID;
36561 goto rel;
36562 }
36563 @@ -964,7 +964,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
36564 }
36565 xid = ep->xid; /* get our XID */
36566 } else if (!ep) {
36567 - atomic_inc(&mp->stats.xid_not_found);
36568 + atomic_inc_unchecked(&mp->stats.xid_not_found);
36569 reject = FC_RJT_RX_ID; /* XID not found */
36570 goto out;
36571 }
36572 @@ -981,7 +981,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
36573 } else {
36574 sp = &ep->seq;
36575 if (sp->id != fh->fh_seq_id) {
36576 - atomic_inc(&mp->stats.seq_not_found);
36577 + atomic_inc_unchecked(&mp->stats.seq_not_found);
36578 if (f_ctl & FC_FC_END_SEQ) {
36579 /*
36580 * Update sequence_id based on incoming last
36581 @@ -1431,22 +1431,22 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
36582
36583 ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
36584 if (!ep) {
36585 - atomic_inc(&mp->stats.xid_not_found);
36586 + atomic_inc_unchecked(&mp->stats.xid_not_found);
36587 goto out;
36588 }
36589 if (ep->esb_stat & ESB_ST_COMPLETE) {
36590 - atomic_inc(&mp->stats.xid_not_found);
36591 + atomic_inc_unchecked(&mp->stats.xid_not_found);
36592 goto rel;
36593 }
36594 if (ep->rxid == FC_XID_UNKNOWN)
36595 ep->rxid = ntohs(fh->fh_rx_id);
36596 if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
36597 - atomic_inc(&mp->stats.xid_not_found);
36598 + atomic_inc_unchecked(&mp->stats.xid_not_found);
36599 goto rel;
36600 }
36601 if (ep->did != ntoh24(fh->fh_s_id) &&
36602 ep->did != FC_FID_FLOGI) {
36603 - atomic_inc(&mp->stats.xid_not_found);
36604 + atomic_inc_unchecked(&mp->stats.xid_not_found);
36605 goto rel;
36606 }
36607 sof = fr_sof(fp);
36608 @@ -1455,7 +1455,7 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
36609 sp->ssb_stat |= SSB_ST_RESP;
36610 sp->id = fh->fh_seq_id;
36611 } else if (sp->id != fh->fh_seq_id) {
36612 - atomic_inc(&mp->stats.seq_not_found);
36613 + atomic_inc_unchecked(&mp->stats.seq_not_found);
36614 goto rel;
36615 }
36616
36617 @@ -1519,9 +1519,9 @@ static void fc_exch_recv_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
36618 sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
36619
36620 if (!sp)
36621 - atomic_inc(&mp->stats.xid_not_found);
36622 + atomic_inc_unchecked(&mp->stats.xid_not_found);
36623 else
36624 - atomic_inc(&mp->stats.non_bls_resp);
36625 + atomic_inc_unchecked(&mp->stats.non_bls_resp);
36626
36627 fc_frame_free(fp);
36628 }
36629 diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
36630 index d109cc3..09f4e7d 100644
36631 --- a/drivers/scsi/libsas/sas_ata.c
36632 +++ b/drivers/scsi/libsas/sas_ata.c
36633 @@ -529,7 +529,7 @@ static struct ata_port_operations sas_sata_ops = {
36634 .postreset = ata_std_postreset,
36635 .error_handler = ata_std_error_handler,
36636 .post_internal_cmd = sas_ata_post_internal,
36637 - .qc_defer = ata_std_qc_defer,
36638 + .qc_defer = ata_std_qc_defer,
36639 .qc_prep = ata_noop_qc_prep,
36640 .qc_issue = sas_ata_qc_issue,
36641 .qc_fill_rtf = sas_ata_qc_fill_rtf,
36642 diff --git a/drivers/scsi/lpfc/Makefile b/drivers/scsi/lpfc/Makefile
36643 index fe5d396..e93d526 100644
36644 --- a/drivers/scsi/lpfc/Makefile
36645 +++ b/drivers/scsi/lpfc/Makefile
36646 @@ -22,7 +22,7 @@
36647 ccflags-$(GCOV) := -fprofile-arcs -ftest-coverage
36648 ccflags-$(GCOV) += -O0
36649
36650 -ccflags-y += -Werror
36651 +#ccflags-y += -Werror
36652
36653 obj-$(CONFIG_SCSI_LPFC) := lpfc.o
36654
36655 diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
36656 index e5da6da..c888d48 100644
36657 --- a/drivers/scsi/lpfc/lpfc.h
36658 +++ b/drivers/scsi/lpfc/lpfc.h
36659 @@ -416,7 +416,7 @@ struct lpfc_vport {
36660 struct dentry *debug_nodelist;
36661 struct dentry *vport_debugfs_root;
36662 struct lpfc_debugfs_trc *disc_trc;
36663 - atomic_t disc_trc_cnt;
36664 + atomic_unchecked_t disc_trc_cnt;
36665 #endif
36666 uint8_t stat_data_enabled;
36667 uint8_t stat_data_blocked;
36668 @@ -830,8 +830,8 @@ struct lpfc_hba {
36669 struct timer_list fabric_block_timer;
36670 unsigned long bit_flags;
36671 #define FABRIC_COMANDS_BLOCKED 0
36672 - atomic_t num_rsrc_err;
36673 - atomic_t num_cmd_success;
36674 + atomic_unchecked_t num_rsrc_err;
36675 + atomic_unchecked_t num_cmd_success;
36676 unsigned long last_rsrc_error_time;
36677 unsigned long last_ramp_down_time;
36678 unsigned long last_ramp_up_time;
36679 @@ -867,7 +867,7 @@ struct lpfc_hba {
36680
36681 struct dentry *debug_slow_ring_trc;
36682 struct lpfc_debugfs_trc *slow_ring_trc;
36683 - atomic_t slow_ring_trc_cnt;
36684 + atomic_unchecked_t slow_ring_trc_cnt;
36685 /* iDiag debugfs sub-directory */
36686 struct dentry *idiag_root;
36687 struct dentry *idiag_pci_cfg;
36688 diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
36689 index 3217d63..c417981 100644
36690 --- a/drivers/scsi/lpfc/lpfc_debugfs.c
36691 +++ b/drivers/scsi/lpfc/lpfc_debugfs.c
36692 @@ -106,7 +106,7 @@ MODULE_PARM_DESC(lpfc_debugfs_mask_disc_trc,
36693
36694 #include <linux/debugfs.h>
36695
36696 -static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
36697 +static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
36698 static unsigned long lpfc_debugfs_start_time = 0L;
36699
36700 /* iDiag */
36701 @@ -147,7 +147,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_vport *vport, char *buf, int size)
36702 lpfc_debugfs_enable = 0;
36703
36704 len = 0;
36705 - index = (atomic_read(&vport->disc_trc_cnt) + 1) &
36706 + index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
36707 (lpfc_debugfs_max_disc_trc - 1);
36708 for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
36709 dtp = vport->disc_trc + i;
36710 @@ -213,7 +213,7 @@ lpfc_debugfs_slow_ring_trc_data(struct lpfc_hba *phba, char *buf, int size)
36711 lpfc_debugfs_enable = 0;
36712
36713 len = 0;
36714 - index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
36715 + index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
36716 (lpfc_debugfs_max_slow_ring_trc - 1);
36717 for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
36718 dtp = phba->slow_ring_trc + i;
36719 @@ -636,14 +636,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport *vport, int mask, char *fmt,
36720 !vport || !vport->disc_trc)
36721 return;
36722
36723 - index = atomic_inc_return(&vport->disc_trc_cnt) &
36724 + index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
36725 (lpfc_debugfs_max_disc_trc - 1);
36726 dtp = vport->disc_trc + index;
36727 dtp->fmt = fmt;
36728 dtp->data1 = data1;
36729 dtp->data2 = data2;
36730 dtp->data3 = data3;
36731 - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
36732 + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
36733 dtp->jif = jiffies;
36734 #endif
36735 return;
36736 @@ -674,14 +674,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_hba *phba, char *fmt,
36737 !phba || !phba->slow_ring_trc)
36738 return;
36739
36740 - index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
36741 + index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
36742 (lpfc_debugfs_max_slow_ring_trc - 1);
36743 dtp = phba->slow_ring_trc + index;
36744 dtp->fmt = fmt;
36745 dtp->data1 = data1;
36746 dtp->data2 = data2;
36747 dtp->data3 = data3;
36748 - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
36749 + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
36750 dtp->jif = jiffies;
36751 #endif
36752 return;
36753 @@ -4090,7 +4090,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
36754 "slow_ring buffer\n");
36755 goto debug_failed;
36756 }
36757 - atomic_set(&phba->slow_ring_trc_cnt, 0);
36758 + atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
36759 memset(phba->slow_ring_trc, 0,
36760 (sizeof(struct lpfc_debugfs_trc) *
36761 lpfc_debugfs_max_slow_ring_trc));
36762 @@ -4136,7 +4136,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
36763 "buffer\n");
36764 goto debug_failed;
36765 }
36766 - atomic_set(&vport->disc_trc_cnt, 0);
36767 + atomic_set_unchecked(&vport->disc_trc_cnt, 0);
36768
36769 snprintf(name, sizeof(name), "discovery_trace");
36770 vport->debug_disc_trc =
36771 diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
36772 index 411ed48..967f553 100644
36773 --- a/drivers/scsi/lpfc/lpfc_init.c
36774 +++ b/drivers/scsi/lpfc/lpfc_init.c
36775 @@ -10341,8 +10341,10 @@ lpfc_init(void)
36776 "misc_register returned with status %d", error);
36777
36778 if (lpfc_enable_npiv) {
36779 - lpfc_transport_functions.vport_create = lpfc_vport_create;
36780 - lpfc_transport_functions.vport_delete = lpfc_vport_delete;
36781 + pax_open_kernel();
36782 + *(void **)&lpfc_transport_functions.vport_create = lpfc_vport_create;
36783 + *(void **)&lpfc_transport_functions.vport_delete = lpfc_vport_delete;
36784 + pax_close_kernel();
36785 }
36786 lpfc_transport_template =
36787 fc_attach_transport(&lpfc_transport_functions);
36788 diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
36789 index 66e0906..1620281 100644
36790 --- a/drivers/scsi/lpfc/lpfc_scsi.c
36791 +++ b/drivers/scsi/lpfc/lpfc_scsi.c
36792 @@ -311,7 +311,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hba *phba)
36793 uint32_t evt_posted;
36794
36795 spin_lock_irqsave(&phba->hbalock, flags);
36796 - atomic_inc(&phba->num_rsrc_err);
36797 + atomic_inc_unchecked(&phba->num_rsrc_err);
36798 phba->last_rsrc_error_time = jiffies;
36799
36800 if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
36801 @@ -352,7 +352,7 @@ lpfc_rampup_queue_depth(struct lpfc_vport *vport,
36802 unsigned long flags;
36803 struct lpfc_hba *phba = vport->phba;
36804 uint32_t evt_posted;
36805 - atomic_inc(&phba->num_cmd_success);
36806 + atomic_inc_unchecked(&phba->num_cmd_success);
36807
36808 if (vport->cfg_lun_queue_depth <= queue_depth)
36809 return;
36810 @@ -396,8 +396,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
36811 unsigned long num_rsrc_err, num_cmd_success;
36812 int i;
36813
36814 - num_rsrc_err = atomic_read(&phba->num_rsrc_err);
36815 - num_cmd_success = atomic_read(&phba->num_cmd_success);
36816 + num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
36817 + num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
36818
36819 /*
36820 * The error and success command counters are global per
36821 @@ -425,8 +425,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
36822 }
36823 }
36824 lpfc_destroy_vport_work_array(phba, vports);
36825 - atomic_set(&phba->num_rsrc_err, 0);
36826 - atomic_set(&phba->num_cmd_success, 0);
36827 + atomic_set_unchecked(&phba->num_rsrc_err, 0);
36828 + atomic_set_unchecked(&phba->num_cmd_success, 0);
36829 }
36830
36831 /**
36832 @@ -460,8 +460,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_hba *phba)
36833 }
36834 }
36835 lpfc_destroy_vport_work_array(phba, vports);
36836 - atomic_set(&phba->num_rsrc_err, 0);
36837 - atomic_set(&phba->num_cmd_success, 0);
36838 + atomic_set_unchecked(&phba->num_rsrc_err, 0);
36839 + atomic_set_unchecked(&phba->num_cmd_success, 0);
36840 }
36841
36842 /**
36843 diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
36844 index ea8a0b4..812a124 100644
36845 --- a/drivers/scsi/pmcraid.c
36846 +++ b/drivers/scsi/pmcraid.c
36847 @@ -200,8 +200,8 @@ static int pmcraid_slave_alloc(struct scsi_device *scsi_dev)
36848 res->scsi_dev = scsi_dev;
36849 scsi_dev->hostdata = res;
36850 res->change_detected = 0;
36851 - atomic_set(&res->read_failures, 0);
36852 - atomic_set(&res->write_failures, 0);
36853 + atomic_set_unchecked(&res->read_failures, 0);
36854 + atomic_set_unchecked(&res->write_failures, 0);
36855 rc = 0;
36856 }
36857 spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
36858 @@ -2676,9 +2676,9 @@ static int pmcraid_error_handler(struct pmcraid_cmd *cmd)
36859
36860 /* If this was a SCSI read/write command keep count of errors */
36861 if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
36862 - atomic_inc(&res->read_failures);
36863 + atomic_inc_unchecked(&res->read_failures);
36864 else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
36865 - atomic_inc(&res->write_failures);
36866 + atomic_inc_unchecked(&res->write_failures);
36867
36868 if (!RES_IS_GSCSI(res->cfg_entry) &&
36869 masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
36870 @@ -3534,7 +3534,7 @@ static int pmcraid_queuecommand_lck(
36871 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
36872 * hrrq_id assigned here in queuecommand
36873 */
36874 - ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
36875 + ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
36876 pinstance->num_hrrq;
36877 cmd->cmd_done = pmcraid_io_done;
36878
36879 @@ -3859,7 +3859,7 @@ static long pmcraid_ioctl_passthrough(
36880 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
36881 * hrrq_id assigned here in queuecommand
36882 */
36883 - ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
36884 + ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
36885 pinstance->num_hrrq;
36886
36887 if (request_size) {
36888 @@ -4497,7 +4497,7 @@ static void pmcraid_worker_function(struct work_struct *workp)
36889
36890 pinstance = container_of(workp, struct pmcraid_instance, worker_q);
36891 /* add resources only after host is added into system */
36892 - if (!atomic_read(&pinstance->expose_resources))
36893 + if (!atomic_read_unchecked(&pinstance->expose_resources))
36894 return;
36895
36896 fw_version = be16_to_cpu(pinstance->inq_data->fw_version);
36897 @@ -5331,8 +5331,8 @@ static int __devinit pmcraid_init_instance(
36898 init_waitqueue_head(&pinstance->reset_wait_q);
36899
36900 atomic_set(&pinstance->outstanding_cmds, 0);
36901 - atomic_set(&pinstance->last_message_id, 0);
36902 - atomic_set(&pinstance->expose_resources, 0);
36903 + atomic_set_unchecked(&pinstance->last_message_id, 0);
36904 + atomic_set_unchecked(&pinstance->expose_resources, 0);
36905
36906 INIT_LIST_HEAD(&pinstance->free_res_q);
36907 INIT_LIST_HEAD(&pinstance->used_res_q);
36908 @@ -6047,7 +6047,7 @@ static int __devinit pmcraid_probe(
36909 /* Schedule worker thread to handle CCN and take care of adding and
36910 * removing devices to OS
36911 */
36912 - atomic_set(&pinstance->expose_resources, 1);
36913 + atomic_set_unchecked(&pinstance->expose_resources, 1);
36914 schedule_work(&pinstance->worker_q);
36915 return rc;
36916
36917 diff --git a/drivers/scsi/pmcraid.h b/drivers/scsi/pmcraid.h
36918 index e1d150f..6c6df44 100644
36919 --- a/drivers/scsi/pmcraid.h
36920 +++ b/drivers/scsi/pmcraid.h
36921 @@ -748,7 +748,7 @@ struct pmcraid_instance {
36922 struct pmcraid_isr_param hrrq_vector[PMCRAID_NUM_MSIX_VECTORS];
36923
36924 /* Message id as filled in last fired IOARCB, used to identify HRRQ */
36925 - atomic_t last_message_id;
36926 + atomic_unchecked_t last_message_id;
36927
36928 /* configuration table */
36929 struct pmcraid_config_table *cfg_table;
36930 @@ -777,7 +777,7 @@ struct pmcraid_instance {
36931 atomic_t outstanding_cmds;
36932
36933 /* should add/delete resources to mid-layer now ?*/
36934 - atomic_t expose_resources;
36935 + atomic_unchecked_t expose_resources;
36936
36937
36938
36939 @@ -813,8 +813,8 @@ struct pmcraid_resource_entry {
36940 struct pmcraid_config_table_entry_ext cfg_entry_ext;
36941 };
36942 struct scsi_device *scsi_dev; /* Link scsi_device structure */
36943 - atomic_t read_failures; /* count of failed READ commands */
36944 - atomic_t write_failures; /* count of failed WRITE commands */
36945 + atomic_unchecked_t read_failures; /* count of failed READ commands */
36946 + atomic_unchecked_t write_failures; /* count of failed WRITE commands */
36947
36948 /* To indicate add/delete/modify during CCN */
36949 u8 change_detected;
36950 diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
36951 index 5ab9530..2dd80f7 100644
36952 --- a/drivers/scsi/qla2xxx/qla_attr.c
36953 +++ b/drivers/scsi/qla2xxx/qla_attr.c
36954 @@ -1855,7 +1855,7 @@ qla24xx_vport_disable(struct fc_vport *fc_vport, bool disable)
36955 return 0;
36956 }
36957
36958 -struct fc_function_template qla2xxx_transport_functions = {
36959 +fc_function_template_no_const qla2xxx_transport_functions = {
36960
36961 .show_host_node_name = 1,
36962 .show_host_port_name = 1,
36963 @@ -1902,7 +1902,7 @@ struct fc_function_template qla2xxx_transport_functions = {
36964 .bsg_timeout = qla24xx_bsg_timeout,
36965 };
36966
36967 -struct fc_function_template qla2xxx_transport_vport_functions = {
36968 +fc_function_template_no_const qla2xxx_transport_vport_functions = {
36969
36970 .show_host_node_name = 1,
36971 .show_host_port_name = 1,
36972 diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
36973 index 39007f5..7fafc64 100644
36974 --- a/drivers/scsi/qla2xxx/qla_def.h
36975 +++ b/drivers/scsi/qla2xxx/qla_def.h
36976 @@ -2284,7 +2284,7 @@ struct isp_operations {
36977 int (*start_scsi) (srb_t *);
36978 int (*abort_isp) (struct scsi_qla_host *);
36979 int (*iospace_config)(struct qla_hw_data*);
36980 -};
36981 +} __no_const;
36982
36983 /* MSI-X Support *************************************************************/
36984
36985 diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
36986 index 9eacd2d..d79629c 100644
36987 --- a/drivers/scsi/qla2xxx/qla_gbl.h
36988 +++ b/drivers/scsi/qla2xxx/qla_gbl.h
36989 @@ -484,8 +484,8 @@ extern void qla2x00_get_sym_node_name(scsi_qla_host_t *, uint8_t *);
36990 struct device_attribute;
36991 extern struct device_attribute *qla2x00_host_attrs[];
36992 struct fc_function_template;
36993 -extern struct fc_function_template qla2xxx_transport_functions;
36994 -extern struct fc_function_template qla2xxx_transport_vport_functions;
36995 +extern fc_function_template_no_const qla2xxx_transport_functions;
36996 +extern fc_function_template_no_const qla2xxx_transport_vport_functions;
36997 extern void qla2x00_alloc_sysfs_attr(scsi_qla_host_t *);
36998 extern void qla2x00_free_sysfs_attr(scsi_qla_host_t *);
36999 extern void qla2x00_init_host_attr(scsi_qla_host_t *);
37000 diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
37001 index 96a5616..eeb185a 100644
37002 --- a/drivers/scsi/qla4xxx/ql4_def.h
37003 +++ b/drivers/scsi/qla4xxx/ql4_def.h
37004 @@ -268,7 +268,7 @@ struct ddb_entry {
37005 * (4000 only) */
37006 atomic_t relogin_timer; /* Max Time to wait for
37007 * relogin to complete */
37008 - atomic_t relogin_retry_count; /* Num of times relogin has been
37009 + atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
37010 * retried */
37011 uint32_t default_time2wait; /* Default Min time between
37012 * relogins (+aens) */
37013 diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
37014 index cd15678..f7e6846 100644
37015 --- a/drivers/scsi/qla4xxx/ql4_os.c
37016 +++ b/drivers/scsi/qla4xxx/ql4_os.c
37017 @@ -2615,12 +2615,12 @@ static void qla4xxx_check_relogin_flash_ddb(struct iscsi_cls_session *cls_sess)
37018 */
37019 if (!iscsi_is_session_online(cls_sess)) {
37020 /* Reset retry relogin timer */
37021 - atomic_inc(&ddb_entry->relogin_retry_count);
37022 + atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
37023 DEBUG2(ql4_printk(KERN_INFO, ha,
37024 "%s: index[%d] relogin timed out-retrying"
37025 " relogin (%d), retry (%d)\n", __func__,
37026 ddb_entry->fw_ddb_index,
37027 - atomic_read(&ddb_entry->relogin_retry_count),
37028 + atomic_read_unchecked(&ddb_entry->relogin_retry_count),
37029 ddb_entry->default_time2wait + 4));
37030 set_bit(DPC_RELOGIN_DEVICE, &ha->dpc_flags);
37031 atomic_set(&ddb_entry->retry_relogin_timer,
37032 @@ -4517,7 +4517,7 @@ static void qla4xxx_setup_flash_ddb_entry(struct scsi_qla_host *ha,
37033
37034 atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
37035 atomic_set(&ddb_entry->relogin_timer, 0);
37036 - atomic_set(&ddb_entry->relogin_retry_count, 0);
37037 + atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
37038 def_timeout = le16_to_cpu(ddb_entry->fw_ddb_entry.def_timeout);
37039 ddb_entry->default_relogin_timeout =
37040 (def_timeout > LOGIN_TOV) && (def_timeout < LOGIN_TOV * 10) ?
37041 diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
37042 index bbbc9c9..ce22f77 100644
37043 --- a/drivers/scsi/scsi.c
37044 +++ b/drivers/scsi/scsi.c
37045 @@ -659,7 +659,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
37046 unsigned long timeout;
37047 int rtn = 0;
37048
37049 - atomic_inc(&cmd->device->iorequest_cnt);
37050 + atomic_inc_unchecked(&cmd->device->iorequest_cnt);
37051
37052 /* check if the device is still usable */
37053 if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
37054 diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
37055 index dae3873..bb4bee6 100644
37056 --- a/drivers/scsi/scsi_lib.c
37057 +++ b/drivers/scsi/scsi_lib.c
37058 @@ -1425,7 +1425,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
37059 shost = sdev->host;
37060 scsi_init_cmd_errh(cmd);
37061 cmd->result = DID_NO_CONNECT << 16;
37062 - atomic_inc(&cmd->device->iorequest_cnt);
37063 + atomic_inc_unchecked(&cmd->device->iorequest_cnt);
37064
37065 /*
37066 * SCSI request completion path will do scsi_device_unbusy(),
37067 @@ -1451,9 +1451,9 @@ static void scsi_softirq_done(struct request *rq)
37068
37069 INIT_LIST_HEAD(&cmd->eh_entry);
37070
37071 - atomic_inc(&cmd->device->iodone_cnt);
37072 + atomic_inc_unchecked(&cmd->device->iodone_cnt);
37073 if (cmd->result)
37074 - atomic_inc(&cmd->device->ioerr_cnt);
37075 + atomic_inc_unchecked(&cmd->device->ioerr_cnt);
37076
37077 disposition = scsi_decide_disposition(cmd);
37078 if (disposition != SUCCESS &&
37079 diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
37080 index bb7c482..7551a95 100644
37081 --- a/drivers/scsi/scsi_sysfs.c
37082 +++ b/drivers/scsi/scsi_sysfs.c
37083 @@ -660,7 +660,7 @@ show_iostat_##field(struct device *dev, struct device_attribute *attr, \
37084 char *buf) \
37085 { \
37086 struct scsi_device *sdev = to_scsi_device(dev); \
37087 - unsigned long long count = atomic_read(&sdev->field); \
37088 + unsigned long long count = atomic_read_unchecked(&sdev->field); \
37089 return snprintf(buf, 20, "0x%llx\n", count); \
37090 } \
37091 static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
37092 diff --git a/drivers/scsi/scsi_tgt_lib.c b/drivers/scsi/scsi_tgt_lib.c
37093 index 84a1fdf..693b0d6 100644
37094 --- a/drivers/scsi/scsi_tgt_lib.c
37095 +++ b/drivers/scsi/scsi_tgt_lib.c
37096 @@ -362,7 +362,7 @@ static int scsi_map_user_pages(struct scsi_tgt_cmd *tcmd, struct scsi_cmnd *cmd,
37097 int err;
37098
37099 dprintk("%lx %u\n", uaddr, len);
37100 - err = blk_rq_map_user(q, rq, NULL, (void *)uaddr, len, GFP_KERNEL);
37101 + err = blk_rq_map_user(q, rq, NULL, (void __user *)uaddr, len, GFP_KERNEL);
37102 if (err) {
37103 /*
37104 * TODO: need to fixup sg_tablesize, max_segment_size,
37105 diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
37106 index 5797604..289a5b5 100644
37107 --- a/drivers/scsi/scsi_transport_fc.c
37108 +++ b/drivers/scsi/scsi_transport_fc.c
37109 @@ -498,7 +498,7 @@ static DECLARE_TRANSPORT_CLASS(fc_vport_class,
37110 * Netlink Infrastructure
37111 */
37112
37113 -static atomic_t fc_event_seq;
37114 +static atomic_unchecked_t fc_event_seq;
37115
37116 /**
37117 * fc_get_event_number - Obtain the next sequential FC event number
37118 @@ -511,7 +511,7 @@ static atomic_t fc_event_seq;
37119 u32
37120 fc_get_event_number(void)
37121 {
37122 - return atomic_add_return(1, &fc_event_seq);
37123 + return atomic_add_return_unchecked(1, &fc_event_seq);
37124 }
37125 EXPORT_SYMBOL(fc_get_event_number);
37126
37127 @@ -659,7 +659,7 @@ static __init int fc_transport_init(void)
37128 {
37129 int error;
37130
37131 - atomic_set(&fc_event_seq, 0);
37132 + atomic_set_unchecked(&fc_event_seq, 0);
37133
37134 error = transport_class_register(&fc_host_class);
37135 if (error)
37136 @@ -849,7 +849,7 @@ static int fc_str_to_dev_loss(const char *buf, unsigned long *val)
37137 char *cp;
37138
37139 *val = simple_strtoul(buf, &cp, 0);
37140 - if ((*cp && (*cp != '\n')) || (*val < 0))
37141 + if (*cp && (*cp != '\n'))
37142 return -EINVAL;
37143 /*
37144 * Check for overflow; dev_loss_tmo is u32
37145 diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
37146 index 1cf640e..78e9014 100644
37147 --- a/drivers/scsi/scsi_transport_iscsi.c
37148 +++ b/drivers/scsi/scsi_transport_iscsi.c
37149 @@ -79,7 +79,7 @@ struct iscsi_internal {
37150 struct transport_container session_cont;
37151 };
37152
37153 -static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
37154 +static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
37155 static struct workqueue_struct *iscsi_eh_timer_workq;
37156
37157 static DEFINE_IDA(iscsi_sess_ida);
37158 @@ -1064,7 +1064,7 @@ int iscsi_add_session(struct iscsi_cls_session *session, unsigned int target_id)
37159 int err;
37160
37161 ihost = shost->shost_data;
37162 - session->sid = atomic_add_return(1, &iscsi_session_nr);
37163 + session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
37164
37165 if (target_id == ISCSI_MAX_TARGET) {
37166 id = ida_simple_get(&iscsi_sess_ida, 0, 0, GFP_KERNEL);
37167 @@ -2940,7 +2940,7 @@ static __init int iscsi_transport_init(void)
37168 printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
37169 ISCSI_TRANSPORT_VERSION);
37170
37171 - atomic_set(&iscsi_session_nr, 0);
37172 + atomic_set_unchecked(&iscsi_session_nr, 0);
37173
37174 err = class_register(&iscsi_transport_class);
37175 if (err)
37176 diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
37177 index 21a045e..ec89e03 100644
37178 --- a/drivers/scsi/scsi_transport_srp.c
37179 +++ b/drivers/scsi/scsi_transport_srp.c
37180 @@ -33,7 +33,7 @@
37181 #include "scsi_transport_srp_internal.h"
37182
37183 struct srp_host_attrs {
37184 - atomic_t next_port_id;
37185 + atomic_unchecked_t next_port_id;
37186 };
37187 #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
37188
37189 @@ -62,7 +62,7 @@ static int srp_host_setup(struct transport_container *tc, struct device *dev,
37190 struct Scsi_Host *shost = dev_to_shost(dev);
37191 struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
37192
37193 - atomic_set(&srp_host->next_port_id, 0);
37194 + atomic_set_unchecked(&srp_host->next_port_id, 0);
37195 return 0;
37196 }
37197
37198 @@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct Scsi_Host *shost,
37199 memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
37200 rport->roles = ids->roles;
37201
37202 - id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
37203 + id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
37204 dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
37205
37206 transport_setup_device(&rport->dev);
37207 diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
37208 index 9c5c5f2..8414557 100644
37209 --- a/drivers/scsi/sg.c
37210 +++ b/drivers/scsi/sg.c
37211 @@ -1101,7 +1101,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
37212 sdp->disk->disk_name,
37213 MKDEV(SCSI_GENERIC_MAJOR, sdp->index),
37214 NULL,
37215 - (char *)arg);
37216 + (char __user *)arg);
37217 case BLKTRACESTART:
37218 return blk_trace_startstop(sdp->device->request_queue, 1);
37219 case BLKTRACESTOP:
37220 diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
37221 index 1041cb8..4a946fa 100644
37222 --- a/drivers/spi/spi.c
37223 +++ b/drivers/spi/spi.c
37224 @@ -1453,7 +1453,7 @@ int spi_bus_unlock(struct spi_master *master)
37225 EXPORT_SYMBOL_GPL(spi_bus_unlock);
37226
37227 /* portable code must never pass more than 32 bytes */
37228 -#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
37229 +#define SPI_BUFSIZ max(32UL,SMP_CACHE_BYTES)
37230
37231 static u8 *buf;
37232
37233 diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
37234 index 34afc16..ffe44dd 100644
37235 --- a/drivers/staging/octeon/ethernet-rx.c
37236 +++ b/drivers/staging/octeon/ethernet-rx.c
37237 @@ -421,11 +421,11 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
37238 /* Increment RX stats for virtual ports */
37239 if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
37240 #ifdef CONFIG_64BIT
37241 - atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
37242 - atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
37243 + atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
37244 + atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
37245 #else
37246 - atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
37247 - atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
37248 + atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
37249 + atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
37250 #endif
37251 }
37252 netif_receive_skb(skb);
37253 @@ -437,9 +437,9 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
37254 dev->name);
37255 */
37256 #ifdef CONFIG_64BIT
37257 - atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
37258 + atomic64_unchecked_add(1, (atomic64_unchecked_t *)&priv->stats.rx_dropped);
37259 #else
37260 - atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
37261 + atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_dropped);
37262 #endif
37263 dev_kfree_skb_irq(skb);
37264 }
37265 diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
37266 index 18f7a79..cc3bc24 100644
37267 --- a/drivers/staging/octeon/ethernet.c
37268 +++ b/drivers/staging/octeon/ethernet.c
37269 @@ -259,11 +259,11 @@ static struct net_device_stats *cvm_oct_common_get_stats(struct net_device *dev)
37270 * since the RX tasklet also increments it.
37271 */
37272 #ifdef CONFIG_64BIT
37273 - atomic64_add(rx_status.dropped_packets,
37274 - (atomic64_t *)&priv->stats.rx_dropped);
37275 + atomic64_add_unchecked(rx_status.dropped_packets,
37276 + (atomic64_unchecked_t *)&priv->stats.rx_dropped);
37277 #else
37278 - atomic_add(rx_status.dropped_packets,
37279 - (atomic_t *)&priv->stats.rx_dropped);
37280 + atomic_add_unchecked(rx_status.dropped_packets,
37281 + (atomic_unchecked_t *)&priv->stats.rx_dropped);
37282 #endif
37283 }
37284
37285 diff --git a/drivers/staging/rtl8712/rtl871x_io.h b/drivers/staging/rtl8712/rtl871x_io.h
37286 index dc23395..cf7e9b1 100644
37287 --- a/drivers/staging/rtl8712/rtl871x_io.h
37288 +++ b/drivers/staging/rtl8712/rtl871x_io.h
37289 @@ -108,7 +108,7 @@ struct _io_ops {
37290 u8 *pmem);
37291 u32 (*_write_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt,
37292 u8 *pmem);
37293 -};
37294 +} __no_const;
37295
37296 struct io_req {
37297 struct list_head list;
37298 diff --git a/drivers/staging/sbe-2t3e3/netdev.c b/drivers/staging/sbe-2t3e3/netdev.c
37299 index c7b5e8b..783d6cb 100644
37300 --- a/drivers/staging/sbe-2t3e3/netdev.c
37301 +++ b/drivers/staging/sbe-2t3e3/netdev.c
37302 @@ -51,7 +51,7 @@ int t3e3_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
37303 t3e3_if_config(sc, cmd_2t3e3, (char *)&param, &resp, &rlen);
37304
37305 if (rlen)
37306 - if (copy_to_user(data, &resp, rlen))
37307 + if (rlen > sizeof resp || copy_to_user(data, &resp, rlen))
37308 return -EFAULT;
37309
37310 return 0;
37311 diff --git a/drivers/staging/speakup/speakup_soft.c b/drivers/staging/speakup/speakup_soft.c
37312 index 42cdafe..2769103 100644
37313 --- a/drivers/staging/speakup/speakup_soft.c
37314 +++ b/drivers/staging/speakup/speakup_soft.c
37315 @@ -241,11 +241,11 @@ static ssize_t softsynth_read(struct file *fp, char *buf, size_t count,
37316 break;
37317 } else if (!initialized) {
37318 if (*init) {
37319 - ch = *init;
37320 init++;
37321 } else {
37322 initialized = 1;
37323 }
37324 + ch = *init;
37325 } else {
37326 ch = synth_buffer_getc();
37327 }
37328 diff --git a/drivers/staging/usbip/usbip_common.h b/drivers/staging/usbip/usbip_common.h
37329 index 5d89c0f..9261317 100644
37330 --- a/drivers/staging/usbip/usbip_common.h
37331 +++ b/drivers/staging/usbip/usbip_common.h
37332 @@ -289,7 +289,7 @@ struct usbip_device {
37333 void (*shutdown)(struct usbip_device *);
37334 void (*reset)(struct usbip_device *);
37335 void (*unusable)(struct usbip_device *);
37336 - } eh_ops;
37337 + } __no_const eh_ops;
37338 };
37339
37340 #define kthread_get_run(threadfn, data, namefmt, ...) \
37341 diff --git a/drivers/staging/usbip/vhci.h b/drivers/staging/usbip/vhci.h
37342 index 88b3298..3783eee 100644
37343 --- a/drivers/staging/usbip/vhci.h
37344 +++ b/drivers/staging/usbip/vhci.h
37345 @@ -88,7 +88,7 @@ struct vhci_hcd {
37346 unsigned resuming:1;
37347 unsigned long re_timeout;
37348
37349 - atomic_t seqnum;
37350 + atomic_unchecked_t seqnum;
37351
37352 /*
37353 * NOTE:
37354 diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
37355 index f708cba..2de6d72 100644
37356 --- a/drivers/staging/usbip/vhci_hcd.c
37357 +++ b/drivers/staging/usbip/vhci_hcd.c
37358 @@ -488,7 +488,7 @@ static void vhci_tx_urb(struct urb *urb)
37359 return;
37360 }
37361
37362 - priv->seqnum = atomic_inc_return(&the_controller->seqnum);
37363 + priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
37364 if (priv->seqnum == 0xffff)
37365 dev_info(&urb->dev->dev, "seqnum max\n");
37366
37367 @@ -740,7 +740,7 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
37368 return -ENOMEM;
37369 }
37370
37371 - unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
37372 + unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
37373 if (unlink->seqnum == 0xffff)
37374 pr_info("seqnum max\n");
37375
37376 @@ -928,7 +928,7 @@ static int vhci_start(struct usb_hcd *hcd)
37377 vdev->rhport = rhport;
37378 }
37379
37380 - atomic_set(&vhci->seqnum, 0);
37381 + atomic_set_unchecked(&vhci->seqnum, 0);
37382 spin_lock_init(&vhci->lock);
37383
37384 hcd->power_budget = 0; /* no limit */
37385 diff --git a/drivers/staging/usbip/vhci_rx.c b/drivers/staging/usbip/vhci_rx.c
37386 index f0eaf04..5a82e06 100644
37387 --- a/drivers/staging/usbip/vhci_rx.c
37388 +++ b/drivers/staging/usbip/vhci_rx.c
37389 @@ -77,7 +77,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
37390 if (!urb) {
37391 pr_err("cannot find a urb of seqnum %u\n", pdu->base.seqnum);
37392 pr_info("max seqnum %d\n",
37393 - atomic_read(&the_controller->seqnum));
37394 + atomic_read_unchecked(&the_controller->seqnum));
37395 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
37396 return;
37397 }
37398 diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c
37399 index 7735027..30eed13 100644
37400 --- a/drivers/staging/vt6655/hostap.c
37401 +++ b/drivers/staging/vt6655/hostap.c
37402 @@ -79,14 +79,13 @@ static int msglevel =MSG_LEVEL_INFO;
37403 *
37404 */
37405
37406 +static net_device_ops_no_const apdev_netdev_ops;
37407 +
37408 static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37409 {
37410 PSDevice apdev_priv;
37411 struct net_device *dev = pDevice->dev;
37412 int ret;
37413 - const struct net_device_ops apdev_netdev_ops = {
37414 - .ndo_start_xmit = pDevice->tx_80211,
37415 - };
37416
37417 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Enabling hostapd mode\n", dev->name);
37418
37419 @@ -98,6 +97,8 @@ static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37420 *apdev_priv = *pDevice;
37421 memcpy(pDevice->apdev->dev_addr, dev->dev_addr, ETH_ALEN);
37422
37423 + /* only half broken now */
37424 + apdev_netdev_ops.ndo_start_xmit = pDevice->tx_80211;
37425 pDevice->apdev->netdev_ops = &apdev_netdev_ops;
37426
37427 pDevice->apdev->type = ARPHRD_IEEE80211;
37428 diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c
37429 index 51b5adf..098e320 100644
37430 --- a/drivers/staging/vt6656/hostap.c
37431 +++ b/drivers/staging/vt6656/hostap.c
37432 @@ -80,14 +80,13 @@ static int msglevel =MSG_LEVEL_INFO;
37433 *
37434 */
37435
37436 +static net_device_ops_no_const apdev_netdev_ops;
37437 +
37438 static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37439 {
37440 PSDevice apdev_priv;
37441 struct net_device *dev = pDevice->dev;
37442 int ret;
37443 - const struct net_device_ops apdev_netdev_ops = {
37444 - .ndo_start_xmit = pDevice->tx_80211,
37445 - };
37446
37447 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Enabling hostapd mode\n", dev->name);
37448
37449 @@ -99,6 +98,8 @@ static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
37450 *apdev_priv = *pDevice;
37451 memcpy(pDevice->apdev->dev_addr, dev->dev_addr, ETH_ALEN);
37452
37453 + /* only half broken now */
37454 + apdev_netdev_ops.ndo_start_xmit = pDevice->tx_80211;
37455 pDevice->apdev->netdev_ops = &apdev_netdev_ops;
37456
37457 pDevice->apdev->type = ARPHRD_IEEE80211;
37458 diff --git a/drivers/staging/wlan-ng/hfa384x_usb.c b/drivers/staging/wlan-ng/hfa384x_usb.c
37459 index 7843dfd..3db105f 100644
37460 --- a/drivers/staging/wlan-ng/hfa384x_usb.c
37461 +++ b/drivers/staging/wlan-ng/hfa384x_usb.c
37462 @@ -204,7 +204,7 @@ static void unlocked_usbctlx_complete(hfa384x_t *hw, hfa384x_usbctlx_t *ctlx);
37463
37464 struct usbctlx_completor {
37465 int (*complete) (struct usbctlx_completor *);
37466 -};
37467 +} __no_const;
37468
37469 static int
37470 hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
37471 diff --git a/drivers/staging/zcache/tmem.c b/drivers/staging/zcache/tmem.c
37472 index 1ca66ea..76f1343 100644
37473 --- a/drivers/staging/zcache/tmem.c
37474 +++ b/drivers/staging/zcache/tmem.c
37475 @@ -39,7 +39,7 @@
37476 * A tmem host implementation must use this function to register callbacks
37477 * for memory allocation.
37478 */
37479 -static struct tmem_hostops tmem_hostops;
37480 +static tmem_hostops_no_const tmem_hostops;
37481
37482 static void tmem_objnode_tree_init(void);
37483
37484 @@ -53,7 +53,7 @@ void tmem_register_hostops(struct tmem_hostops *m)
37485 * A tmem host implementation must use this function to register
37486 * callbacks for a page-accessible memory (PAM) implementation
37487 */
37488 -static struct tmem_pamops tmem_pamops;
37489 +static tmem_pamops_no_const tmem_pamops;
37490
37491 void tmem_register_pamops(struct tmem_pamops *m)
37492 {
37493 diff --git a/drivers/staging/zcache/tmem.h b/drivers/staging/zcache/tmem.h
37494 index 0d4aa82..f7832d4 100644
37495 --- a/drivers/staging/zcache/tmem.h
37496 +++ b/drivers/staging/zcache/tmem.h
37497 @@ -180,6 +180,7 @@ struct tmem_pamops {
37498 void (*new_obj)(struct tmem_obj *);
37499 int (*replace_in_obj)(void *, struct tmem_obj *);
37500 };
37501 +typedef struct tmem_pamops __no_const tmem_pamops_no_const;
37502 extern void tmem_register_pamops(struct tmem_pamops *m);
37503
37504 /* memory allocation methods provided by the host implementation */
37505 @@ -189,6 +190,7 @@ struct tmem_hostops {
37506 struct tmem_objnode *(*objnode_alloc)(struct tmem_pool *);
37507 void (*objnode_free)(struct tmem_objnode *, struct tmem_pool *);
37508 };
37509 +typedef struct tmem_hostops __no_const tmem_hostops_no_const;
37510 extern void tmem_register_hostops(struct tmem_hostops *m);
37511
37512 /* core tmem accessor functions */
37513 diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
37514 index df9824c..f699b8a 100644
37515 --- a/drivers/target/target_core_transport.c
37516 +++ b/drivers/target/target_core_transport.c
37517 @@ -1233,7 +1233,7 @@ struct se_device *transport_add_device_to_core_hba(
37518 spin_lock_init(&dev->se_port_lock);
37519 spin_lock_init(&dev->se_tmr_lock);
37520 spin_lock_init(&dev->qf_cmd_lock);
37521 - atomic_set(&dev->dev_ordered_id, 0);
37522 + atomic_set_unchecked(&dev->dev_ordered_id, 0);
37523
37524 se_dev_set_default_attribs(dev, dev_limits);
37525
37526 @@ -1402,7 +1402,7 @@ static int transport_check_alloc_task_attr(struct se_cmd *cmd)
37527 * Used to determine when ORDERED commands should go from
37528 * Dormant to Active status.
37529 */
37530 - cmd->se_ordered_id = atomic_inc_return(&cmd->se_dev->dev_ordered_id);
37531 + cmd->se_ordered_id = atomic_inc_return_unchecked(&cmd->se_dev->dev_ordered_id);
37532 smp_mb__after_atomic_inc();
37533 pr_debug("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
37534 cmd->se_ordered_id, cmd->sam_task_attr,
37535 diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c
37536 index e61cabd..7617d26 100644
37537 --- a/drivers/tty/cyclades.c
37538 +++ b/drivers/tty/cyclades.c
37539 @@ -1589,10 +1589,10 @@ static int cy_open(struct tty_struct *tty, struct file *filp)
37540 printk(KERN_DEBUG "cyc:cy_open ttyC%d, count = %d\n", info->line,
37541 info->port.count);
37542 #endif
37543 - info->port.count++;
37544 + atomic_inc(&info->port.count);
37545 #ifdef CY_DEBUG_COUNT
37546 printk(KERN_DEBUG "cyc:cy_open (%d): incrementing count to %d\n",
37547 - current->pid, info->port.count);
37548 + current->pid, atomic_read(&info->port.count));
37549 #endif
37550
37551 /*
37552 @@ -3987,7 +3987,7 @@ static int cyclades_proc_show(struct seq_file *m, void *v)
37553 for (j = 0; j < cy_card[i].nports; j++) {
37554 info = &cy_card[i].ports[j];
37555
37556 - if (info->port.count) {
37557 + if (atomic_read(&info->port.count)) {
37558 /* XXX is the ldisc num worth this? */
37559 struct tty_struct *tty;
37560 struct tty_ldisc *ld;
37561 diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
37562 index 2d691eb..be02ebd 100644
37563 --- a/drivers/tty/hvc/hvc_console.c
37564 +++ b/drivers/tty/hvc/hvc_console.c
37565 @@ -315,7 +315,7 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
37566
37567 spin_lock_irqsave(&hp->port.lock, flags);
37568 /* Check and then increment for fast path open. */
37569 - if (hp->port.count++ > 0) {
37570 + if (atomic_inc_return(&hp->port.count) > 1) {
37571 spin_unlock_irqrestore(&hp->port.lock, flags);
37572 hvc_kick();
37573 return 0;
37574 @@ -366,7 +366,7 @@ static void hvc_close(struct tty_struct *tty, struct file * filp)
37575
37576 spin_lock_irqsave(&hp->port.lock, flags);
37577
37578 - if (--hp->port.count == 0) {
37579 + if (atomic_dec_return(&hp->port.count) == 0) {
37580 spin_unlock_irqrestore(&hp->port.lock, flags);
37581 /* We are done with the tty pointer now. */
37582 tty_port_tty_set(&hp->port, NULL);
37583 @@ -384,9 +384,9 @@ static void hvc_close(struct tty_struct *tty, struct file * filp)
37584 */
37585 tty_wait_until_sent_from_close(tty, HVC_CLOSE_WAIT);
37586 } else {
37587 - if (hp->port.count < 0)
37588 + if (atomic_read(&hp->port.count) < 0)
37589 printk(KERN_ERR "hvc_close %X: oops, count is %d\n",
37590 - hp->vtermno, hp->port.count);
37591 + hp->vtermno, atomic_read(&hp->port.count));
37592 spin_unlock_irqrestore(&hp->port.lock, flags);
37593 }
37594
37595 @@ -412,13 +412,13 @@ static void hvc_hangup(struct tty_struct *tty)
37596 * open->hangup case this can be called after the final close so prevent
37597 * that from happening for now.
37598 */
37599 - if (hp->port.count <= 0) {
37600 + if (atomic_read(&hp->port.count) <= 0) {
37601 spin_unlock_irqrestore(&hp->port.lock, flags);
37602 return;
37603 }
37604
37605 - temp_open_count = hp->port.count;
37606 - hp->port.count = 0;
37607 + temp_open_count = atomic_read(&hp->port.count);
37608 + atomic_set(&hp->port.count, 0);
37609 spin_unlock_irqrestore(&hp->port.lock, flags);
37610 tty_port_tty_set(&hp->port, NULL);
37611
37612 @@ -471,7 +471,7 @@ static int hvc_write(struct tty_struct *tty, const unsigned char *buf, int count
37613 return -EPIPE;
37614
37615 /* FIXME what's this (unprotected) check for? */
37616 - if (hp->port.count <= 0)
37617 + if (atomic_read(&hp->port.count) <= 0)
37618 return -EIO;
37619
37620 spin_lock_irqsave(&hp->lock, flags);
37621 diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
37622 index d56788c..12d8f85 100644
37623 --- a/drivers/tty/hvc/hvcs.c
37624 +++ b/drivers/tty/hvc/hvcs.c
37625 @@ -83,6 +83,7 @@
37626 #include <asm/hvcserver.h>
37627 #include <asm/uaccess.h>
37628 #include <asm/vio.h>
37629 +#include <asm/local.h>
37630
37631 /*
37632 * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
37633 @@ -416,7 +417,7 @@ static ssize_t hvcs_vterm_state_store(struct device *dev, struct device_attribut
37634
37635 spin_lock_irqsave(&hvcsd->lock, flags);
37636
37637 - if (hvcsd->port.count > 0) {
37638 + if (atomic_read(&hvcsd->port.count) > 0) {
37639 spin_unlock_irqrestore(&hvcsd->lock, flags);
37640 printk(KERN_INFO "HVCS: vterm state unchanged. "
37641 "The hvcs device node is still in use.\n");
37642 @@ -1134,7 +1135,7 @@ static int hvcs_open(struct tty_struct *tty, struct file *filp)
37643 if ((retval = hvcs_partner_connect(hvcsd)))
37644 goto error_release;
37645
37646 - hvcsd->port.count = 1;
37647 + atomic_set(&hvcsd->port.count, 1);
37648 hvcsd->port.tty = tty;
37649 tty->driver_data = hvcsd;
37650
37651 @@ -1168,7 +1169,7 @@ fast_open:
37652
37653 spin_lock_irqsave(&hvcsd->lock, flags);
37654 tty_port_get(&hvcsd->port);
37655 - hvcsd->port.count++;
37656 + atomic_inc(&hvcsd->port.count);
37657 hvcsd->todo_mask |= HVCS_SCHED_READ;
37658 spin_unlock_irqrestore(&hvcsd->lock, flags);
37659
37660 @@ -1212,7 +1213,7 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
37661 hvcsd = tty->driver_data;
37662
37663 spin_lock_irqsave(&hvcsd->lock, flags);
37664 - if (--hvcsd->port.count == 0) {
37665 + if (atomic_dec_and_test(&hvcsd->port.count)) {
37666
37667 vio_disable_interrupts(hvcsd->vdev);
37668
37669 @@ -1238,10 +1239,10 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
37670 free_irq(irq, hvcsd);
37671 tty_port_put(&hvcsd->port);
37672 return;
37673 - } else if (hvcsd->port.count < 0) {
37674 + } else if (atomic_read(&hvcsd->port.count) < 0) {
37675 printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
37676 " is missmanaged.\n",
37677 - hvcsd->vdev->unit_address, hvcsd->port.count);
37678 + hvcsd->vdev->unit_address, atomic_read(&hvcsd->port.count));
37679 }
37680
37681 spin_unlock_irqrestore(&hvcsd->lock, flags);
37682 @@ -1257,7 +1258,7 @@ static void hvcs_hangup(struct tty_struct * tty)
37683
37684 spin_lock_irqsave(&hvcsd->lock, flags);
37685 /* Preserve this so that we know how many kref refs to put */
37686 - temp_open_count = hvcsd->port.count;
37687 + temp_open_count = atomic_read(&hvcsd->port.count);
37688
37689 /*
37690 * Don't kref put inside the spinlock because the destruction
37691 @@ -1272,7 +1273,7 @@ static void hvcs_hangup(struct tty_struct * tty)
37692 tty->driver_data = NULL;
37693 hvcsd->port.tty = NULL;
37694
37695 - hvcsd->port.count = 0;
37696 + atomic_set(&hvcsd->port.count, 0);
37697
37698 /* This will drop any buffered data on the floor which is OK in a hangup
37699 * scenario. */
37700 @@ -1343,7 +1344,7 @@ static int hvcs_write(struct tty_struct *tty,
37701 * the middle of a write operation? This is a crummy place to do this
37702 * but we want to keep it all in the spinlock.
37703 */
37704 - if (hvcsd->port.count <= 0) {
37705 + if (atomic_read(&hvcsd->port.count) <= 0) {
37706 spin_unlock_irqrestore(&hvcsd->lock, flags);
37707 return -ENODEV;
37708 }
37709 @@ -1417,7 +1418,7 @@ static int hvcs_write_room(struct tty_struct *tty)
37710 {
37711 struct hvcs_struct *hvcsd = tty->driver_data;
37712
37713 - if (!hvcsd || hvcsd->port.count <= 0)
37714 + if (!hvcsd || atomic_read(&hvcsd->port.count) <= 0)
37715 return 0;
37716
37717 return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
37718 diff --git a/drivers/tty/ipwireless/tty.c b/drivers/tty/ipwireless/tty.c
37719 index f8b5fa0..4ba9f89 100644
37720 --- a/drivers/tty/ipwireless/tty.c
37721 +++ b/drivers/tty/ipwireless/tty.c
37722 @@ -29,6 +29,7 @@
37723 #include <linux/tty_driver.h>
37724 #include <linux/tty_flip.h>
37725 #include <linux/uaccess.h>
37726 +#include <asm/local.h>
37727
37728 #include "tty.h"
37729 #include "network.h"
37730 @@ -99,10 +100,10 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
37731 mutex_unlock(&tty->ipw_tty_mutex);
37732 return -ENODEV;
37733 }
37734 - if (tty->port.count == 0)
37735 + if (atomic_read(&tty->port.count) == 0)
37736 tty->tx_bytes_queued = 0;
37737
37738 - tty->port.count++;
37739 + atomic_inc(&tty->port.count);
37740
37741 tty->port.tty = linux_tty;
37742 linux_tty->driver_data = tty;
37743 @@ -118,9 +119,7 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
37744
37745 static void do_ipw_close(struct ipw_tty *tty)
37746 {
37747 - tty->port.count--;
37748 -
37749 - if (tty->port.count == 0) {
37750 + if (atomic_dec_return(&tty->port.count) == 0) {
37751 struct tty_struct *linux_tty = tty->port.tty;
37752
37753 if (linux_tty != NULL) {
37754 @@ -141,7 +140,7 @@ static void ipw_hangup(struct tty_struct *linux_tty)
37755 return;
37756
37757 mutex_lock(&tty->ipw_tty_mutex);
37758 - if (tty->port.count == 0) {
37759 + if (atomic_read(&tty->port.count) == 0) {
37760 mutex_unlock(&tty->ipw_tty_mutex);
37761 return;
37762 }
37763 @@ -170,7 +169,7 @@ void ipwireless_tty_received(struct ipw_tty *tty, unsigned char *data,
37764 return;
37765 }
37766
37767 - if (!tty->port.count) {
37768 + if (!atomic_read(&tty->port.count)) {
37769 mutex_unlock(&tty->ipw_tty_mutex);
37770 return;
37771 }
37772 @@ -212,7 +211,7 @@ static int ipw_write(struct tty_struct *linux_tty,
37773 return -ENODEV;
37774
37775 mutex_lock(&tty->ipw_tty_mutex);
37776 - if (!tty->port.count) {
37777 + if (!atomic_read(&tty->port.count)) {
37778 mutex_unlock(&tty->ipw_tty_mutex);
37779 return -EINVAL;
37780 }
37781 @@ -252,7 +251,7 @@ static int ipw_write_room(struct tty_struct *linux_tty)
37782 if (!tty)
37783 return -ENODEV;
37784
37785 - if (!tty->port.count)
37786 + if (!atomic_read(&tty->port.count))
37787 return -EINVAL;
37788
37789 room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
37790 @@ -294,7 +293,7 @@ static int ipw_chars_in_buffer(struct tty_struct *linux_tty)
37791 if (!tty)
37792 return 0;
37793
37794 - if (!tty->port.count)
37795 + if (!atomic_read(&tty->port.count))
37796 return 0;
37797
37798 return tty->tx_bytes_queued;
37799 @@ -375,7 +374,7 @@ static int ipw_tiocmget(struct tty_struct *linux_tty)
37800 if (!tty)
37801 return -ENODEV;
37802
37803 - if (!tty->port.count)
37804 + if (!atomic_read(&tty->port.count))
37805 return -EINVAL;
37806
37807 return get_control_lines(tty);
37808 @@ -391,7 +390,7 @@ ipw_tiocmset(struct tty_struct *linux_tty,
37809 if (!tty)
37810 return -ENODEV;
37811
37812 - if (!tty->port.count)
37813 + if (!atomic_read(&tty->port.count))
37814 return -EINVAL;
37815
37816 return set_control_lines(tty, set, clear);
37817 @@ -405,7 +404,7 @@ static int ipw_ioctl(struct tty_struct *linux_tty,
37818 if (!tty)
37819 return -ENODEV;
37820
37821 - if (!tty->port.count)
37822 + if (!atomic_read(&tty->port.count))
37823 return -EINVAL;
37824
37825 /* FIXME: Exactly how is the tty object locked here .. */
37826 @@ -561,7 +560,7 @@ void ipwireless_tty_free(struct ipw_tty *tty)
37827 * are gone */
37828 mutex_lock(&ttyj->ipw_tty_mutex);
37829 }
37830 - while (ttyj->port.count)
37831 + while (atomic_read(&ttyj->port.count))
37832 do_ipw_close(ttyj);
37833 ipwireless_disassociate_network_ttys(network,
37834 ttyj->channel_idx);
37835 diff --git a/drivers/tty/moxa.c b/drivers/tty/moxa.c
37836 index 324467d..504cc25 100644
37837 --- a/drivers/tty/moxa.c
37838 +++ b/drivers/tty/moxa.c
37839 @@ -1172,7 +1172,7 @@ static int moxa_open(struct tty_struct *tty, struct file *filp)
37840 }
37841
37842 ch = &brd->ports[port % MAX_PORTS_PER_BOARD];
37843 - ch->port.count++;
37844 + atomic_inc(&ch->port.count);
37845 tty->driver_data = ch;
37846 tty_port_tty_set(&ch->port, tty);
37847 mutex_lock(&ch->port.mutex);
37848 diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
37849 index c43b683..4dab83e 100644
37850 --- a/drivers/tty/n_gsm.c
37851 +++ b/drivers/tty/n_gsm.c
37852 @@ -1629,7 +1629,7 @@ static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr)
37853 kref_init(&dlci->ref);
37854 mutex_init(&dlci->mutex);
37855 dlci->fifo = &dlci->_fifo;
37856 - if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL) < 0) {
37857 + if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL)) {
37858 kfree(dlci);
37859 return NULL;
37860 }
37861 @@ -2895,7 +2895,7 @@ static int gsmtty_open(struct tty_struct *tty, struct file *filp)
37862 if (dlci == NULL)
37863 return -ENOMEM;
37864 port = &dlci->port;
37865 - port->count++;
37866 + atomic_inc(&port->count);
37867 tty->driver_data = dlci;
37868 dlci_get(dlci);
37869 dlci_get(dlci->gsm->dlci[0]);
37870 diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
37871 index ee1c268..0e97caf 100644
37872 --- a/drivers/tty/n_tty.c
37873 +++ b/drivers/tty/n_tty.c
37874 @@ -2123,6 +2123,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
37875 {
37876 *ops = tty_ldisc_N_TTY;
37877 ops->owner = NULL;
37878 - ops->refcount = ops->flags = 0;
37879 + atomic_set(&ops->refcount, 0);
37880 + ops->flags = 0;
37881 }
37882 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
37883 diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
37884 index 5505ffc..7affff9 100644
37885 --- a/drivers/tty/pty.c
37886 +++ b/drivers/tty/pty.c
37887 @@ -718,8 +718,10 @@ static void __init unix98_pty_init(void)
37888 panic("Couldn't register Unix98 pts driver");
37889
37890 /* Now create the /dev/ptmx special device */
37891 + pax_open_kernel();
37892 tty_default_fops(&ptmx_fops);
37893 - ptmx_fops.open = ptmx_open;
37894 + *(void **)&ptmx_fops.open = ptmx_open;
37895 + pax_close_kernel();
37896
37897 cdev_init(&ptmx_cdev, &ptmx_fops);
37898 if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
37899 diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c
37900 index 777d5f9..56d67ca 100644
37901 --- a/drivers/tty/rocket.c
37902 +++ b/drivers/tty/rocket.c
37903 @@ -924,7 +924,7 @@ static int rp_open(struct tty_struct *tty, struct file *filp)
37904 tty->driver_data = info;
37905 tty_port_tty_set(port, tty);
37906
37907 - if (port->count++ == 0) {
37908 + if (atomic_inc_return(&port->count) == 1) {
37909 atomic_inc(&rp_num_ports_open);
37910
37911 #ifdef ROCKET_DEBUG_OPEN
37912 @@ -933,7 +933,7 @@ static int rp_open(struct tty_struct *tty, struct file *filp)
37913 #endif
37914 }
37915 #ifdef ROCKET_DEBUG_OPEN
37916 - printk(KERN_INFO "rp_open ttyR%d, count=%d\n", info->line, info->port.count);
37917 + printk(KERN_INFO "rp_open ttyR%d, count=%d\n", info->line, atomic-read(&info->port.count));
37918 #endif
37919
37920 /*
37921 @@ -1528,7 +1528,7 @@ static void rp_hangup(struct tty_struct *tty)
37922 spin_unlock_irqrestore(&info->port.lock, flags);
37923 return;
37924 }
37925 - if (info->port.count)
37926 + if (atomic_read(&info->port.count))
37927 atomic_dec(&rp_num_ports_open);
37928 clear_bit((info->aiop * 8) + info->chan, (void *) &xmit_flags[info->board]);
37929 spin_unlock_irqrestore(&info->port.lock, flags);
37930 diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
37931 index 2b42a01..32a2ed3 100644
37932 --- a/drivers/tty/serial/kgdboc.c
37933 +++ b/drivers/tty/serial/kgdboc.c
37934 @@ -24,8 +24,9 @@
37935 #define MAX_CONFIG_LEN 40
37936
37937 static struct kgdb_io kgdboc_io_ops;
37938 +static struct kgdb_io kgdboc_io_ops_console;
37939
37940 -/* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
37941 +/* -1 = init not run yet, 0 = unconfigured, 1/2 = configured. */
37942 static int configured = -1;
37943
37944 static char config[MAX_CONFIG_LEN];
37945 @@ -148,6 +149,8 @@ static void cleanup_kgdboc(void)
37946 kgdboc_unregister_kbd();
37947 if (configured == 1)
37948 kgdb_unregister_io_module(&kgdboc_io_ops);
37949 + else if (configured == 2)
37950 + kgdb_unregister_io_module(&kgdboc_io_ops_console);
37951 }
37952
37953 static int configure_kgdboc(void)
37954 @@ -157,13 +160,13 @@ static int configure_kgdboc(void)
37955 int err;
37956 char *cptr = config;
37957 struct console *cons;
37958 + int is_console = 0;
37959
37960 err = kgdboc_option_setup(config);
37961 if (err || !strlen(config) || isspace(config[0]))
37962 goto noconfig;
37963
37964 err = -ENODEV;
37965 - kgdboc_io_ops.is_console = 0;
37966 kgdb_tty_driver = NULL;
37967
37968 kgdboc_use_kms = 0;
37969 @@ -184,7 +187,7 @@ static int configure_kgdboc(void)
37970 int idx;
37971 if (cons->device && cons->device(cons, &idx) == p &&
37972 idx == tty_line) {
37973 - kgdboc_io_ops.is_console = 1;
37974 + is_console = 1;
37975 break;
37976 }
37977 cons = cons->next;
37978 @@ -194,12 +197,16 @@ static int configure_kgdboc(void)
37979 kgdb_tty_line = tty_line;
37980
37981 do_register:
37982 - err = kgdb_register_io_module(&kgdboc_io_ops);
37983 + if (is_console) {
37984 + err = kgdb_register_io_module(&kgdboc_io_ops_console);
37985 + configured = 2;
37986 + } else {
37987 + err = kgdb_register_io_module(&kgdboc_io_ops);
37988 + configured = 1;
37989 + }
37990 if (err)
37991 goto noconfig;
37992
37993 - configured = 1;
37994 -
37995 return 0;
37996
37997 noconfig:
37998 @@ -213,7 +220,7 @@ noconfig:
37999 static int __init init_kgdboc(void)
38000 {
38001 /* Already configured? */
38002 - if (configured == 1)
38003 + if (configured >= 1)
38004 return 0;
38005
38006 return configure_kgdboc();
38007 @@ -262,7 +269,7 @@ static int param_set_kgdboc_var(const char *kmessage, struct kernel_param *kp)
38008 if (config[len - 1] == '\n')
38009 config[len - 1] = '\0';
38010
38011 - if (configured == 1)
38012 + if (configured >= 1)
38013 cleanup_kgdboc();
38014
38015 /* Go and configure with the new params. */
38016 @@ -302,6 +309,15 @@ static struct kgdb_io kgdboc_io_ops = {
38017 .post_exception = kgdboc_post_exp_handler,
38018 };
38019
38020 +static struct kgdb_io kgdboc_io_ops_console = {
38021 + .name = "kgdboc",
38022 + .read_char = kgdboc_get_char,
38023 + .write_char = kgdboc_put_char,
38024 + .pre_exception = kgdboc_pre_exp_handler,
38025 + .post_exception = kgdboc_post_exp_handler,
38026 + .is_console = 1
38027 +};
38028 +
38029 #ifdef CONFIG_KGDB_SERIAL_CONSOLE
38030 /* This is only available if kgdboc is a built in for early debugging */
38031 static int __init kgdboc_early_init(char *opt)
38032 diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
38033 index 246b823..9e0db76 100644
38034 --- a/drivers/tty/serial/serial_core.c
38035 +++ b/drivers/tty/serial/serial_core.c
38036 @@ -1392,7 +1392,7 @@ static void uart_hangup(struct tty_struct *tty)
38037 uart_flush_buffer(tty);
38038 uart_shutdown(tty, state);
38039 spin_lock_irqsave(&port->lock, flags);
38040 - port->count = 0;
38041 + atomic_set(&port->count, 0);
38042 clear_bit(ASYNCB_NORMAL_ACTIVE, &port->flags);
38043 spin_unlock_irqrestore(&port->lock, flags);
38044 tty_port_tty_set(port, NULL);
38045 @@ -1488,7 +1488,7 @@ static int uart_open(struct tty_struct *tty, struct file *filp)
38046 goto end;
38047 }
38048
38049 - port->count++;
38050 + atomic_inc(&port->count);
38051 if (!state->uart_port || state->uart_port->flags & UPF_DEAD) {
38052 retval = -ENXIO;
38053 goto err_dec_count;
38054 @@ -1515,7 +1515,7 @@ static int uart_open(struct tty_struct *tty, struct file *filp)
38055 /*
38056 * Make sure the device is in D0 state.
38057 */
38058 - if (port->count == 1)
38059 + if (atomic_read(&port->count) == 1)
38060 uart_change_pm(state, 0);
38061
38062 /*
38063 @@ -1533,7 +1533,7 @@ static int uart_open(struct tty_struct *tty, struct file *filp)
38064 end:
38065 return retval;
38066 err_dec_count:
38067 - port->count--;
38068 + atomic_inc(&port->count);
38069 mutex_unlock(&port->mutex);
38070 goto end;
38071 }
38072 diff --git a/drivers/tty/synclink.c b/drivers/tty/synclink.c
38073 index 593d40a..bdc61f3 100644
38074 --- a/drivers/tty/synclink.c
38075 +++ b/drivers/tty/synclink.c
38076 @@ -3095,7 +3095,7 @@ static void mgsl_close(struct tty_struct *tty, struct file * filp)
38077
38078 if (debug_level >= DEBUG_LEVEL_INFO)
38079 printk("%s(%d):mgsl_close(%s) entry, count=%d\n",
38080 - __FILE__,__LINE__, info->device_name, info->port.count);
38081 + __FILE__,__LINE__, info->device_name, atomic_read(&info->port.count));
38082
38083 if (tty_port_close_start(&info->port, tty, filp) == 0)
38084 goto cleanup;
38085 @@ -3113,7 +3113,7 @@ static void mgsl_close(struct tty_struct *tty, struct file * filp)
38086 cleanup:
38087 if (debug_level >= DEBUG_LEVEL_INFO)
38088 printk("%s(%d):mgsl_close(%s) exit, count=%d\n", __FILE__,__LINE__,
38089 - tty->driver->name, info->port.count);
38090 + tty->driver->name, atomic_read(&info->port.count));
38091
38092 } /* end of mgsl_close() */
38093
38094 @@ -3212,8 +3212,8 @@ static void mgsl_hangup(struct tty_struct *tty)
38095
38096 mgsl_flush_buffer(tty);
38097 shutdown(info);
38098 -
38099 - info->port.count = 0;
38100 +
38101 + atomic_set(&info->port.count, 0);
38102 info->port.flags &= ~ASYNC_NORMAL_ACTIVE;
38103 info->port.tty = NULL;
38104
38105 @@ -3302,12 +3302,12 @@ static int block_til_ready(struct tty_struct *tty, struct file * filp,
38106
38107 if (debug_level >= DEBUG_LEVEL_INFO)
38108 printk("%s(%d):block_til_ready before block on %s count=%d\n",
38109 - __FILE__,__LINE__, tty->driver->name, port->count );
38110 + __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count));
38111
38112 spin_lock_irqsave(&info->irq_spinlock, flags);
38113 if (!tty_hung_up_p(filp)) {
38114 extra_count = true;
38115 - port->count--;
38116 + atomic_dec(&port->count);
38117 }
38118 spin_unlock_irqrestore(&info->irq_spinlock, flags);
38119 port->blocked_open++;
38120 @@ -3336,7 +3336,7 @@ static int block_til_ready(struct tty_struct *tty, struct file * filp,
38121
38122 if (debug_level >= DEBUG_LEVEL_INFO)
38123 printk("%s(%d):block_til_ready blocking on %s count=%d\n",
38124 - __FILE__,__LINE__, tty->driver->name, port->count );
38125 + __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count));
38126
38127 tty_unlock();
38128 schedule();
38129 @@ -3348,12 +3348,12 @@ static int block_til_ready(struct tty_struct *tty, struct file * filp,
38130
38131 /* FIXME: Racy on hangup during close wait */
38132 if (extra_count)
38133 - port->count++;
38134 + atomic_inc(&port->count);
38135 port->blocked_open--;
38136
38137 if (debug_level >= DEBUG_LEVEL_INFO)
38138 printk("%s(%d):block_til_ready after blocking on %s count=%d\n",
38139 - __FILE__,__LINE__, tty->driver->name, port->count );
38140 + __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count));
38141
38142 if (!retval)
38143 port->flags |= ASYNC_NORMAL_ACTIVE;
38144 @@ -3398,7 +3398,7 @@ static int mgsl_open(struct tty_struct *tty, struct file * filp)
38145
38146 if (debug_level >= DEBUG_LEVEL_INFO)
38147 printk("%s(%d):mgsl_open(%s), old ref count = %d\n",
38148 - __FILE__,__LINE__,tty->driver->name, info->port.count);
38149 + __FILE__,__LINE__,tty->driver->name, atomic_read(&info->port.count));
38150
38151 /* If port is closing, signal caller to try again */
38152 if (tty_hung_up_p(filp) || info->port.flags & ASYNC_CLOSING){
38153 @@ -3417,10 +3417,10 @@ static int mgsl_open(struct tty_struct *tty, struct file * filp)
38154 spin_unlock_irqrestore(&info->netlock, flags);
38155 goto cleanup;
38156 }
38157 - info->port.count++;
38158 + atomic_inc(&info->port.count);
38159 spin_unlock_irqrestore(&info->netlock, flags);
38160
38161 - if (info->port.count == 1) {
38162 + if (atomic_read(&info->port.count) == 1) {
38163 /* 1st open on this device, init hardware */
38164 retval = startup(info);
38165 if (retval < 0)
38166 @@ -3444,8 +3444,8 @@ cleanup:
38167 if (retval) {
38168 if (tty->count == 1)
38169 info->port.tty = NULL; /* tty layer will release tty struct */
38170 - if(info->port.count)
38171 - info->port.count--;
38172 + if (atomic_read(&info->port.count))
38173 + atomic_dec(&info->port.count);
38174 }
38175
38176 return retval;
38177 @@ -7653,7 +7653,7 @@ static int hdlcdev_attach(struct net_device *dev, unsigned short encoding,
38178 unsigned short new_crctype;
38179
38180 /* return error if TTY interface open */
38181 - if (info->port.count)
38182 + if (atomic_read(&info->port.count))
38183 return -EBUSY;
38184
38185 switch (encoding)
38186 @@ -7748,7 +7748,7 @@ static int hdlcdev_open(struct net_device *dev)
38187
38188 /* arbitrate between network and tty opens */
38189 spin_lock_irqsave(&info->netlock, flags);
38190 - if (info->port.count != 0 || info->netcount != 0) {
38191 + if (atomic_read(&info->port.count) != 0 || info->netcount != 0) {
38192 printk(KERN_WARNING "%s: hdlc_open returning busy\n", dev->name);
38193 spin_unlock_irqrestore(&info->netlock, flags);
38194 return -EBUSY;
38195 @@ -7834,7 +7834,7 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
38196 printk("%s:hdlcdev_ioctl(%s)\n",__FILE__,dev->name);
38197
38198 /* return error if TTY interface open */
38199 - if (info->port.count)
38200 + if (atomic_read(&info->port.count))
38201 return -EBUSY;
38202
38203 if (cmd != SIOCWANDEV)
38204 diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
38205 index aa1debf..9297a16 100644
38206 --- a/drivers/tty/synclink_gt.c
38207 +++ b/drivers/tty/synclink_gt.c
38208 @@ -671,7 +671,7 @@ static int open(struct tty_struct *tty, struct file *filp)
38209 tty->driver_data = info;
38210 info->port.tty = tty;
38211
38212 - DBGINFO(("%s open, old ref count = %d\n", info->device_name, info->port.count));
38213 + DBGINFO(("%s open, old ref count = %d\n", info->device_name, atomic_read(&info->port.count)));
38214
38215 /* If port is closing, signal caller to try again */
38216 if (tty_hung_up_p(filp) || info->port.flags & ASYNC_CLOSING){
38217 @@ -692,10 +692,10 @@ static int open(struct tty_struct *tty, struct file *filp)
38218 mutex_unlock(&info->port.mutex);
38219 goto cleanup;
38220 }
38221 - info->port.count++;
38222 + atomic_inc(&info->port.count);
38223 spin_unlock_irqrestore(&info->netlock, flags);
38224
38225 - if (info->port.count == 1) {
38226 + if (atomic_read(&info->port.count) == 1) {
38227 /* 1st open on this device, init hardware */
38228 retval = startup(info);
38229 if (retval < 0) {
38230 @@ -716,8 +716,8 @@ cleanup:
38231 if (retval) {
38232 if (tty->count == 1)
38233 info->port.tty = NULL; /* tty layer will release tty struct */
38234 - if(info->port.count)
38235 - info->port.count--;
38236 + if(atomic_read(&info->port.count))
38237 + atomic_dec(&info->port.count);
38238 }
38239
38240 DBGINFO(("%s open rc=%d\n", info->device_name, retval));
38241 @@ -730,7 +730,7 @@ static void close(struct tty_struct *tty, struct file *filp)
38242
38243 if (sanity_check(info, tty->name, "close"))
38244 return;
38245 - DBGINFO(("%s close entry, count=%d\n", info->device_name, info->port.count));
38246 + DBGINFO(("%s close entry, count=%d\n", info->device_name, atomic_read(&info->port.count)));
38247
38248 if (tty_port_close_start(&info->port, tty, filp) == 0)
38249 goto cleanup;
38250 @@ -747,7 +747,7 @@ static void close(struct tty_struct *tty, struct file *filp)
38251 tty_port_close_end(&info->port, tty);
38252 info->port.tty = NULL;
38253 cleanup:
38254 - DBGINFO(("%s close exit, count=%d\n", tty->driver->name, info->port.count));
38255 + DBGINFO(("%s close exit, count=%d\n", tty->driver->name, atomic_read(&info->port.count)));
38256 }
38257
38258 static void hangup(struct tty_struct *tty)
38259 @@ -765,7 +765,7 @@ static void hangup(struct tty_struct *tty)
38260 shutdown(info);
38261
38262 spin_lock_irqsave(&info->port.lock, flags);
38263 - info->port.count = 0;
38264 + atomic_set(&info->port.count, 0);
38265 info->port.flags &= ~ASYNC_NORMAL_ACTIVE;
38266 info->port.tty = NULL;
38267 spin_unlock_irqrestore(&info->port.lock, flags);
38268 @@ -1450,7 +1450,7 @@ static int hdlcdev_attach(struct net_device *dev, unsigned short encoding,
38269 unsigned short new_crctype;
38270
38271 /* return error if TTY interface open */
38272 - if (info->port.count)
38273 + if (atomic_read(&info->port.count))
38274 return -EBUSY;
38275
38276 DBGINFO(("%s hdlcdev_attach\n", info->device_name));
38277 @@ -1545,7 +1545,7 @@ static int hdlcdev_open(struct net_device *dev)
38278
38279 /* arbitrate between network and tty opens */
38280 spin_lock_irqsave(&info->netlock, flags);
38281 - if (info->port.count != 0 || info->netcount != 0) {
38282 + if (atomic_read(&info->port.count) != 0 || info->netcount != 0) {
38283 DBGINFO(("%s hdlc_open busy\n", dev->name));
38284 spin_unlock_irqrestore(&info->netlock, flags);
38285 return -EBUSY;
38286 @@ -1630,7 +1630,7 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
38287 DBGINFO(("%s hdlcdev_ioctl\n", dev->name));
38288
38289 /* return error if TTY interface open */
38290 - if (info->port.count)
38291 + if (atomic_read(&info->port.count))
38292 return -EBUSY;
38293
38294 if (cmd != SIOCWANDEV)
38295 @@ -2419,7 +2419,7 @@ static irqreturn_t slgt_interrupt(int dummy, void *dev_id)
38296 if (port == NULL)
38297 continue;
38298 spin_lock(&port->lock);
38299 - if ((port->port.count || port->netcount) &&
38300 + if ((atomic_read(&port->port.count) || port->netcount) &&
38301 port->pending_bh && !port->bh_running &&
38302 !port->bh_requested) {
38303 DBGISR(("%s bh queued\n", port->device_name));
38304 @@ -3308,7 +3308,7 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
38305 spin_lock_irqsave(&info->lock, flags);
38306 if (!tty_hung_up_p(filp)) {
38307 extra_count = true;
38308 - port->count--;
38309 + atomic_dec(&port->count);
38310 }
38311 spin_unlock_irqrestore(&info->lock, flags);
38312 port->blocked_open++;
38313 @@ -3345,7 +3345,7 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
38314 remove_wait_queue(&port->open_wait, &wait);
38315
38316 if (extra_count)
38317 - port->count++;
38318 + atomic_inc(&port->count);
38319 port->blocked_open--;
38320
38321 if (!retval)
38322 diff --git a/drivers/tty/synclinkmp.c b/drivers/tty/synclinkmp.c
38323 index a3dddc1..8905ab2 100644
38324 --- a/drivers/tty/synclinkmp.c
38325 +++ b/drivers/tty/synclinkmp.c
38326 @@ -742,7 +742,7 @@ static int open(struct tty_struct *tty, struct file *filp)
38327
38328 if (debug_level >= DEBUG_LEVEL_INFO)
38329 printk("%s(%d):%s open(), old ref count = %d\n",
38330 - __FILE__,__LINE__,tty->driver->name, info->port.count);
38331 + __FILE__,__LINE__,tty->driver->name, atomic_read(&info->port.count));
38332
38333 /* If port is closing, signal caller to try again */
38334 if (tty_hung_up_p(filp) || info->port.flags & ASYNC_CLOSING){
38335 @@ -761,10 +761,10 @@ static int open(struct tty_struct *tty, struct file *filp)
38336 spin_unlock_irqrestore(&info->netlock, flags);
38337 goto cleanup;
38338 }
38339 - info->port.count++;
38340 + atomic_inc(&info->port.count);
38341 spin_unlock_irqrestore(&info->netlock, flags);
38342
38343 - if (info->port.count == 1) {
38344 + if (atomic_read(&info->port.count) == 1) {
38345 /* 1st open on this device, init hardware */
38346 retval = startup(info);
38347 if (retval < 0)
38348 @@ -788,8 +788,8 @@ cleanup:
38349 if (retval) {
38350 if (tty->count == 1)
38351 info->port.tty = NULL; /* tty layer will release tty struct */
38352 - if(info->port.count)
38353 - info->port.count--;
38354 + if(atomic_read(&info->port.count))
38355 + atomic_dec(&info->port.count);
38356 }
38357
38358 return retval;
38359 @@ -807,7 +807,7 @@ static void close(struct tty_struct *tty, struct file *filp)
38360
38361 if (debug_level >= DEBUG_LEVEL_INFO)
38362 printk("%s(%d):%s close() entry, count=%d\n",
38363 - __FILE__,__LINE__, info->device_name, info->port.count);
38364 + __FILE__,__LINE__, info->device_name, atomic_read(&info->port.count));
38365
38366 if (tty_port_close_start(&info->port, tty, filp) == 0)
38367 goto cleanup;
38368 @@ -826,7 +826,7 @@ static void close(struct tty_struct *tty, struct file *filp)
38369 cleanup:
38370 if (debug_level >= DEBUG_LEVEL_INFO)
38371 printk("%s(%d):%s close() exit, count=%d\n", __FILE__,__LINE__,
38372 - tty->driver->name, info->port.count);
38373 + tty->driver->name, atomic_read(&info->port.count));
38374 }
38375
38376 /* Called by tty_hangup() when a hangup is signaled.
38377 @@ -849,7 +849,7 @@ static void hangup(struct tty_struct *tty)
38378 shutdown(info);
38379
38380 spin_lock_irqsave(&info->port.lock, flags);
38381 - info->port.count = 0;
38382 + atomic_set(&info->port.count, 0);
38383 info->port.flags &= ~ASYNC_NORMAL_ACTIVE;
38384 info->port.tty = NULL;
38385 spin_unlock_irqrestore(&info->port.lock, flags);
38386 @@ -1557,7 +1557,7 @@ static int hdlcdev_attach(struct net_device *dev, unsigned short encoding,
38387 unsigned short new_crctype;
38388
38389 /* return error if TTY interface open */
38390 - if (info->port.count)
38391 + if (atomic_read(&info->port.count))
38392 return -EBUSY;
38393
38394 switch (encoding)
38395 @@ -1652,7 +1652,7 @@ static int hdlcdev_open(struct net_device *dev)
38396
38397 /* arbitrate between network and tty opens */
38398 spin_lock_irqsave(&info->netlock, flags);
38399 - if (info->port.count != 0 || info->netcount != 0) {
38400 + if (atomic_read(&info->port.count) != 0 || info->netcount != 0) {
38401 printk(KERN_WARNING "%s: hdlc_open returning busy\n", dev->name);
38402 spin_unlock_irqrestore(&info->netlock, flags);
38403 return -EBUSY;
38404 @@ -1738,7 +1738,7 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
38405 printk("%s:hdlcdev_ioctl(%s)\n",__FILE__,dev->name);
38406
38407 /* return error if TTY interface open */
38408 - if (info->port.count)
38409 + if (atomic_read(&info->port.count))
38410 return -EBUSY;
38411
38412 if (cmd != SIOCWANDEV)
38413 @@ -2623,7 +2623,7 @@ static irqreturn_t synclinkmp_interrupt(int dummy, void *dev_id)
38414 * do not request bottom half processing if the
38415 * device is not open in a normal mode.
38416 */
38417 - if ( port && (port->port.count || port->netcount) &&
38418 + if ( port && (atomic_read(&port->port.count) || port->netcount) &&
38419 port->pending_bh && !port->bh_running &&
38420 !port->bh_requested ) {
38421 if ( debug_level >= DEBUG_LEVEL_ISR )
38422 @@ -3321,12 +3321,12 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
38423
38424 if (debug_level >= DEBUG_LEVEL_INFO)
38425 printk("%s(%d):%s block_til_ready() before block, count=%d\n",
38426 - __FILE__,__LINE__, tty->driver->name, port->count );
38427 + __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count));
38428
38429 spin_lock_irqsave(&info->lock, flags);
38430 if (!tty_hung_up_p(filp)) {
38431 extra_count = true;
38432 - port->count--;
38433 + atomic_dec(&port->count);
38434 }
38435 spin_unlock_irqrestore(&info->lock, flags);
38436 port->blocked_open++;
38437 @@ -3355,7 +3355,7 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
38438
38439 if (debug_level >= DEBUG_LEVEL_INFO)
38440 printk("%s(%d):%s block_til_ready() count=%d\n",
38441 - __FILE__,__LINE__, tty->driver->name, port->count );
38442 + __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count));
38443
38444 tty_unlock();
38445 schedule();
38446 @@ -3366,12 +3366,12 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
38447 remove_wait_queue(&port->open_wait, &wait);
38448
38449 if (extra_count)
38450 - port->count++;
38451 + atomic_inc(&port->count);
38452 port->blocked_open--;
38453
38454 if (debug_level >= DEBUG_LEVEL_INFO)
38455 printk("%s(%d):%s block_til_ready() after, count=%d\n",
38456 - __FILE__,__LINE__, tty->driver->name, port->count );
38457 + __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count));
38458
38459 if (!retval)
38460 port->flags |= ASYNC_NORMAL_ACTIVE;
38461 diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
38462 index 05728894..b9d44c6 100644
38463 --- a/drivers/tty/sysrq.c
38464 +++ b/drivers/tty/sysrq.c
38465 @@ -865,7 +865,7 @@ EXPORT_SYMBOL(unregister_sysrq_key);
38466 static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf,
38467 size_t count, loff_t *ppos)
38468 {
38469 - if (count) {
38470 + if (count && capable(CAP_SYS_ADMIN)) {
38471 char c;
38472
38473 if (get_user(c, buf))
38474 diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
38475 index b425c79..08a3f06 100644
38476 --- a/drivers/tty/tty_io.c
38477 +++ b/drivers/tty/tty_io.c
38478 @@ -3283,7 +3283,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
38479
38480 void tty_default_fops(struct file_operations *fops)
38481 {
38482 - *fops = tty_fops;
38483 + memcpy((void *)fops, &tty_fops, sizeof(tty_fops));
38484 }
38485
38486 /*
38487 diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
38488 index 9911eb6..5abe0e1 100644
38489 --- a/drivers/tty/tty_ldisc.c
38490 +++ b/drivers/tty/tty_ldisc.c
38491 @@ -56,7 +56,7 @@ static void put_ldisc(struct tty_ldisc *ld)
38492 if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
38493 struct tty_ldisc_ops *ldo = ld->ops;
38494
38495 - ldo->refcount--;
38496 + atomic_dec(&ldo->refcount);
38497 module_put(ldo->owner);
38498 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
38499
38500 @@ -91,7 +91,7 @@ int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc)
38501 spin_lock_irqsave(&tty_ldisc_lock, flags);
38502 tty_ldiscs[disc] = new_ldisc;
38503 new_ldisc->num = disc;
38504 - new_ldisc->refcount = 0;
38505 + atomic_set(&new_ldisc->refcount, 0);
38506 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
38507
38508 return ret;
38509 @@ -119,7 +119,7 @@ int tty_unregister_ldisc(int disc)
38510 return -EINVAL;
38511
38512 spin_lock_irqsave(&tty_ldisc_lock, flags);
38513 - if (tty_ldiscs[disc]->refcount)
38514 + if (atomic_read(&tty_ldiscs[disc]->refcount))
38515 ret = -EBUSY;
38516 else
38517 tty_ldiscs[disc] = NULL;
38518 @@ -140,7 +140,7 @@ static struct tty_ldisc_ops *get_ldops(int disc)
38519 if (ldops) {
38520 ret = ERR_PTR(-EAGAIN);
38521 if (try_module_get(ldops->owner)) {
38522 - ldops->refcount++;
38523 + atomic_inc(&ldops->refcount);
38524 ret = ldops;
38525 }
38526 }
38527 @@ -153,7 +153,7 @@ static void put_ldops(struct tty_ldisc_ops *ldops)
38528 unsigned long flags;
38529
38530 spin_lock_irqsave(&tty_ldisc_lock, flags);
38531 - ldops->refcount--;
38532 + atomic_dec(&ldops->refcount);
38533 module_put(ldops->owner);
38534 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
38535 }
38536 diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
38537 index bf6e238..d401c04 100644
38538 --- a/drivers/tty/tty_port.c
38539 +++ b/drivers/tty/tty_port.c
38540 @@ -138,7 +138,7 @@ void tty_port_hangup(struct tty_port *port)
38541 unsigned long flags;
38542
38543 spin_lock_irqsave(&port->lock, flags);
38544 - port->count = 0;
38545 + atomic_set(&port->count, 0);
38546 port->flags &= ~ASYNC_NORMAL_ACTIVE;
38547 if (port->tty) {
38548 set_bit(TTY_IO_ERROR, &port->tty->flags);
38549 @@ -264,7 +264,7 @@ int tty_port_block_til_ready(struct tty_port *port,
38550 /* The port lock protects the port counts */
38551 spin_lock_irqsave(&port->lock, flags);
38552 if (!tty_hung_up_p(filp))
38553 - port->count--;
38554 + atomic_dec(&port->count);
38555 port->blocked_open++;
38556 spin_unlock_irqrestore(&port->lock, flags);
38557
38558 @@ -306,7 +306,7 @@ int tty_port_block_til_ready(struct tty_port *port,
38559 we must not mess that up further */
38560 spin_lock_irqsave(&port->lock, flags);
38561 if (!tty_hung_up_p(filp))
38562 - port->count++;
38563 + atomic_inc(&port->count);
38564 port->blocked_open--;
38565 if (retval == 0)
38566 port->flags |= ASYNC_NORMAL_ACTIVE;
38567 @@ -326,19 +326,19 @@ int tty_port_close_start(struct tty_port *port,
38568 return 0;
38569 }
38570
38571 - if (tty->count == 1 && port->count != 1) {
38572 + if (tty->count == 1 && atomic_read(&port->count) != 1) {
38573 printk(KERN_WARNING
38574 "tty_port_close_start: tty->count = 1 port count = %d.\n",
38575 - port->count);
38576 - port->count = 1;
38577 + atomic_read(&port->count));
38578 + atomic_set(&port->count, 1);
38579 }
38580 - if (--port->count < 0) {
38581 + if (atomic_dec_return(&port->count) < 0) {
38582 printk(KERN_WARNING "tty_port_close_start: count = %d\n",
38583 - port->count);
38584 - port->count = 0;
38585 + atomic_read(&port->count));
38586 + atomic_set(&port->count, 0);
38587 }
38588
38589 - if (port->count) {
38590 + if (atomic_read(&port->count)) {
38591 spin_unlock_irqrestore(&port->lock, flags);
38592 if (port->ops->drop)
38593 port->ops->drop(port);
38594 @@ -418,7 +418,7 @@ int tty_port_open(struct tty_port *port, struct tty_struct *tty,
38595 {
38596 spin_lock_irq(&port->lock);
38597 if (!tty_hung_up_p(filp))
38598 - ++port->count;
38599 + atomic_inc(&port->count);
38600 spin_unlock_irq(&port->lock);
38601 tty_port_tty_set(port, tty);
38602
38603 diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
38604 index 48cc6f2..85584dd 100644
38605 --- a/drivers/tty/vt/keyboard.c
38606 +++ b/drivers/tty/vt/keyboard.c
38607 @@ -659,6 +659,16 @@ static void k_spec(struct vc_data *vc, unsigned char value, char up_flag)
38608 kbd->kbdmode == VC_OFF) &&
38609 value != KVAL(K_SAK))
38610 return; /* SAK is allowed even in raw mode */
38611 +
38612 +#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
38613 + {
38614 + void *func = fn_handler[value];
38615 + if (func == fn_show_state || func == fn_show_ptregs ||
38616 + func == fn_show_mem)
38617 + return;
38618 + }
38619 +#endif
38620 +
38621 fn_handler[value](vc);
38622 }
38623
38624 @@ -1808,9 +1818,6 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm,
38625 if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
38626 return -EFAULT;
38627
38628 - if (!capable(CAP_SYS_TTY_CONFIG))
38629 - perm = 0;
38630 -
38631 switch (cmd) {
38632 case KDGKBENT:
38633 /* Ensure another thread doesn't free it under us */
38634 @@ -1825,6 +1832,9 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm,
38635 spin_unlock_irqrestore(&kbd_event_lock, flags);
38636 return put_user(val, &user_kbe->kb_value);
38637 case KDSKBENT:
38638 + if (!capable(CAP_SYS_TTY_CONFIG))
38639 + perm = 0;
38640 +
38641 if (!perm)
38642 return -EPERM;
38643 if (!i && v == K_NOSUCHMAP) {
38644 @@ -1915,9 +1925,6 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
38645 int i, j, k;
38646 int ret;
38647
38648 - if (!capable(CAP_SYS_TTY_CONFIG))
38649 - perm = 0;
38650 -
38651 kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
38652 if (!kbs) {
38653 ret = -ENOMEM;
38654 @@ -1951,6 +1958,9 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
38655 kfree(kbs);
38656 return ((p && *p) ? -EOVERFLOW : 0);
38657 case KDSKBSENT:
38658 + if (!capable(CAP_SYS_TTY_CONFIG))
38659 + perm = 0;
38660 +
38661 if (!perm) {
38662 ret = -EPERM;
38663 goto reterr;
38664 diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
38665 index a783d53..cb30d94 100644
38666 --- a/drivers/uio/uio.c
38667 +++ b/drivers/uio/uio.c
38668 @@ -25,6 +25,7 @@
38669 #include <linux/kobject.h>
38670 #include <linux/cdev.h>
38671 #include <linux/uio_driver.h>
38672 +#include <asm/local.h>
38673
38674 #define UIO_MAX_DEVICES (1U << MINORBITS)
38675
38676 @@ -32,10 +33,10 @@ struct uio_device {
38677 struct module *owner;
38678 struct device *dev;
38679 int minor;
38680 - atomic_t event;
38681 + atomic_unchecked_t event;
38682 struct fasync_struct *async_queue;
38683 wait_queue_head_t wait;
38684 - int vma_count;
38685 + local_t vma_count;
38686 struct uio_info *info;
38687 struct kobject *map_dir;
38688 struct kobject *portio_dir;
38689 @@ -242,7 +243,7 @@ static ssize_t show_event(struct device *dev,
38690 struct device_attribute *attr, char *buf)
38691 {
38692 struct uio_device *idev = dev_get_drvdata(dev);
38693 - return sprintf(buf, "%u\n", (unsigned int)atomic_read(&idev->event));
38694 + return sprintf(buf, "%u\n", (unsigned int)atomic_read_unchecked(&idev->event));
38695 }
38696
38697 static struct device_attribute uio_class_attributes[] = {
38698 @@ -408,7 +409,7 @@ void uio_event_notify(struct uio_info *info)
38699 {
38700 struct uio_device *idev = info->uio_dev;
38701
38702 - atomic_inc(&idev->event);
38703 + atomic_inc_unchecked(&idev->event);
38704 wake_up_interruptible(&idev->wait);
38705 kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
38706 }
38707 @@ -461,7 +462,7 @@ static int uio_open(struct inode *inode, struct file *filep)
38708 }
38709
38710 listener->dev = idev;
38711 - listener->event_count = atomic_read(&idev->event);
38712 + listener->event_count = atomic_read_unchecked(&idev->event);
38713 filep->private_data = listener;
38714
38715 if (idev->info->open) {
38716 @@ -512,7 +513,7 @@ static unsigned int uio_poll(struct file *filep, poll_table *wait)
38717 return -EIO;
38718
38719 poll_wait(filep, &idev->wait, wait);
38720 - if (listener->event_count != atomic_read(&idev->event))
38721 + if (listener->event_count != atomic_read_unchecked(&idev->event))
38722 return POLLIN | POLLRDNORM;
38723 return 0;
38724 }
38725 @@ -537,7 +538,7 @@ static ssize_t uio_read(struct file *filep, char __user *buf,
38726 do {
38727 set_current_state(TASK_INTERRUPTIBLE);
38728
38729 - event_count = atomic_read(&idev->event);
38730 + event_count = atomic_read_unchecked(&idev->event);
38731 if (event_count != listener->event_count) {
38732 if (copy_to_user(buf, &event_count, count))
38733 retval = -EFAULT;
38734 @@ -606,13 +607,13 @@ static int uio_find_mem_index(struct vm_area_struct *vma)
38735 static void uio_vma_open(struct vm_area_struct *vma)
38736 {
38737 struct uio_device *idev = vma->vm_private_data;
38738 - idev->vma_count++;
38739 + local_inc(&idev->vma_count);
38740 }
38741
38742 static void uio_vma_close(struct vm_area_struct *vma)
38743 {
38744 struct uio_device *idev = vma->vm_private_data;
38745 - idev->vma_count--;
38746 + local_dec(&idev->vma_count);
38747 }
38748
38749 static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
38750 @@ -821,7 +822,7 @@ int __uio_register_device(struct module *owner,
38751 idev->owner = owner;
38752 idev->info = info;
38753 init_waitqueue_head(&idev->wait);
38754 - atomic_set(&idev->event, 0);
38755 + atomic_set_unchecked(&idev->event, 0);
38756
38757 ret = uio_get_minor(idev);
38758 if (ret)
38759 diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
38760 index b7eb86a..36d28af 100644
38761 --- a/drivers/usb/atm/cxacru.c
38762 +++ b/drivers/usb/atm/cxacru.c
38763 @@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_config(struct device *dev,
38764 ret = sscanf(buf + pos, "%x=%x%n", &index, &value, &tmp);
38765 if (ret < 2)
38766 return -EINVAL;
38767 - if (index < 0 || index > 0x7f)
38768 + if (index > 0x7f)
38769 return -EINVAL;
38770 pos += tmp;
38771
38772 diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
38773 index ee62b35..b663594 100644
38774 --- a/drivers/usb/atm/usbatm.c
38775 +++ b/drivers/usb/atm/usbatm.c
38776 @@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38777 if (printk_ratelimit())
38778 atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
38779 __func__, vpi, vci);
38780 - atomic_inc(&vcc->stats->rx_err);
38781 + atomic_inc_unchecked(&vcc->stats->rx_err);
38782 return;
38783 }
38784
38785 @@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38786 if (length > ATM_MAX_AAL5_PDU) {
38787 atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
38788 __func__, length, vcc);
38789 - atomic_inc(&vcc->stats->rx_err);
38790 + atomic_inc_unchecked(&vcc->stats->rx_err);
38791 goto out;
38792 }
38793
38794 @@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38795 if (sarb->len < pdu_length) {
38796 atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
38797 __func__, pdu_length, sarb->len, vcc);
38798 - atomic_inc(&vcc->stats->rx_err);
38799 + atomic_inc_unchecked(&vcc->stats->rx_err);
38800 goto out;
38801 }
38802
38803 if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
38804 atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
38805 __func__, vcc);
38806 - atomic_inc(&vcc->stats->rx_err);
38807 + atomic_inc_unchecked(&vcc->stats->rx_err);
38808 goto out;
38809 }
38810
38811 @@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38812 if (printk_ratelimit())
38813 atm_err(instance, "%s: no memory for skb (length: %u)!\n",
38814 __func__, length);
38815 - atomic_inc(&vcc->stats->rx_drop);
38816 + atomic_inc_unchecked(&vcc->stats->rx_drop);
38817 goto out;
38818 }
38819
38820 @@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
38821
38822 vcc->push(vcc, skb);
38823
38824 - atomic_inc(&vcc->stats->rx);
38825 + atomic_inc_unchecked(&vcc->stats->rx);
38826 out:
38827 skb_trim(sarb, 0);
38828 }
38829 @@ -615,7 +615,7 @@ static void usbatm_tx_process(unsigned long data)
38830 struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
38831
38832 usbatm_pop(vcc, skb);
38833 - atomic_inc(&vcc->stats->tx);
38834 + atomic_inc_unchecked(&vcc->stats->tx);
38835
38836 skb = skb_dequeue(&instance->sndqueue);
38837 }
38838 @@ -770,11 +770,11 @@ static int usbatm_atm_proc_read(struct atm_dev *atm_dev, loff_t * pos, char *pag
38839 if (!left--)
38840 return sprintf(page,
38841 "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
38842 - atomic_read(&atm_dev->stats.aal5.tx),
38843 - atomic_read(&atm_dev->stats.aal5.tx_err),
38844 - atomic_read(&atm_dev->stats.aal5.rx),
38845 - atomic_read(&atm_dev->stats.aal5.rx_err),
38846 - atomic_read(&atm_dev->stats.aal5.rx_drop));
38847 + atomic_read_unchecked(&atm_dev->stats.aal5.tx),
38848 + atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
38849 + atomic_read_unchecked(&atm_dev->stats.aal5.rx),
38850 + atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
38851 + atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
38852
38853 if (!left--) {
38854 if (instance->disconnected)
38855 diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
38856 index d956965..4179a77 100644
38857 --- a/drivers/usb/core/devices.c
38858 +++ b/drivers/usb/core/devices.c
38859 @@ -126,7 +126,7 @@ static const char format_endpt[] =
38860 * time it gets called.
38861 */
38862 static struct device_connect_event {
38863 - atomic_t count;
38864 + atomic_unchecked_t count;
38865 wait_queue_head_t wait;
38866 } device_event = {
38867 .count = ATOMIC_INIT(1),
38868 @@ -164,7 +164,7 @@ static const struct class_info clas_info[] = {
38869
38870 void usbfs_conn_disc_event(void)
38871 {
38872 - atomic_add(2, &device_event.count);
38873 + atomic_add_unchecked(2, &device_event.count);
38874 wake_up(&device_event.wait);
38875 }
38876
38877 @@ -648,7 +648,7 @@ static unsigned int usb_device_poll(struct file *file,
38878
38879 poll_wait(file, &device_event.wait, wait);
38880
38881 - event_count = atomic_read(&device_event.count);
38882 + event_count = atomic_read_unchecked(&device_event.count);
38883 if (file->f_version != event_count) {
38884 file->f_version = event_count;
38885 return POLLIN | POLLRDNORM;
38886 diff --git a/drivers/usb/early/ehci-dbgp.c b/drivers/usb/early/ehci-dbgp.c
38887 index 347bb05..63e1b73 100644
38888 --- a/drivers/usb/early/ehci-dbgp.c
38889 +++ b/drivers/usb/early/ehci-dbgp.c
38890 @@ -97,7 +97,8 @@ static inline u32 dbgp_len_update(u32 x, u32 len)
38891
38892 #ifdef CONFIG_KGDB
38893 static struct kgdb_io kgdbdbgp_io_ops;
38894 -#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops)
38895 +static struct kgdb_io kgdbdbgp_io_ops_console;
38896 +#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops || dbg_io_ops == &kgdbdbgp_io_ops_console)
38897 #else
38898 #define dbgp_kgdb_mode (0)
38899 #endif
38900 @@ -1035,6 +1036,13 @@ static struct kgdb_io kgdbdbgp_io_ops = {
38901 .write_char = kgdbdbgp_write_char,
38902 };
38903
38904 +static struct kgdb_io kgdbdbgp_io_ops_console = {
38905 + .name = "kgdbdbgp",
38906 + .read_char = kgdbdbgp_read_char,
38907 + .write_char = kgdbdbgp_write_char,
38908 + .is_console = 1
38909 +};
38910 +
38911 static int kgdbdbgp_wait_time;
38912
38913 static int __init kgdbdbgp_parse_config(char *str)
38914 @@ -1050,8 +1058,10 @@ static int __init kgdbdbgp_parse_config(char *str)
38915 ptr++;
38916 kgdbdbgp_wait_time = simple_strtoul(ptr, &ptr, 10);
38917 }
38918 - kgdb_register_io_module(&kgdbdbgp_io_ops);
38919 - kgdbdbgp_io_ops.is_console = early_dbgp_console.index != -1;
38920 + if (early_dbgp_console.index != -1)
38921 + kgdb_register_io_module(&kgdbdbgp_io_ops_console);
38922 + else
38923 + kgdb_register_io_module(&kgdbdbgp_io_ops);
38924
38925 return 0;
38926 }
38927 diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
38928 index 5b3f5ff..6e00893 100644
38929 --- a/drivers/usb/gadget/u_serial.c
38930 +++ b/drivers/usb/gadget/u_serial.c
38931 @@ -731,9 +731,9 @@ static int gs_open(struct tty_struct *tty, struct file *file)
38932 spin_lock_irq(&port->port_lock);
38933
38934 /* already open? Great. */
38935 - if (port->port.count) {
38936 + if (atomic_read(&port->port.count)) {
38937 status = 0;
38938 - port->port.count++;
38939 + atomic_inc(&port->port.count);
38940
38941 /* currently opening/closing? wait ... */
38942 } else if (port->openclose) {
38943 @@ -792,7 +792,7 @@ static int gs_open(struct tty_struct *tty, struct file *file)
38944 tty->driver_data = port;
38945 port->port.tty = tty;
38946
38947 - port->port.count = 1;
38948 + atomic_set(&port->port.count, 1);
38949 port->openclose = false;
38950
38951 /* if connected, start the I/O stream */
38952 @@ -834,11 +834,11 @@ static void gs_close(struct tty_struct *tty, struct file *file)
38953
38954 spin_lock_irq(&port->port_lock);
38955
38956 - if (port->port.count != 1) {
38957 - if (port->port.count == 0)
38958 + if (atomic_read(&port->port.count) != 1) {
38959 + if (atomic_read(&port->port.count) == 0)
38960 WARN_ON(1);
38961 else
38962 - --port->port.count;
38963 + atomic_dec(&port->port.count);
38964 goto exit;
38965 }
38966
38967 @@ -848,7 +848,7 @@ static void gs_close(struct tty_struct *tty, struct file *file)
38968 * and sleep if necessary
38969 */
38970 port->openclose = true;
38971 - port->port.count = 0;
38972 + atomic_set(&port->port.count, 0);
38973
38974 gser = port->port_usb;
38975 if (gser && gser->disconnect)
38976 @@ -1152,7 +1152,7 @@ static int gs_closed(struct gs_port *port)
38977 int cond;
38978
38979 spin_lock_irq(&port->port_lock);
38980 - cond = (port->port.count == 0) && !port->openclose;
38981 + cond = (atomic_read(&port->port.count) == 0) && !port->openclose;
38982 spin_unlock_irq(&port->port_lock);
38983 return cond;
38984 }
38985 @@ -1265,7 +1265,7 @@ int gserial_connect(struct gserial *gser, u8 port_num)
38986 /* if it's already open, start I/O ... and notify the serial
38987 * protocol about open/close status (connect/disconnect).
38988 */
38989 - if (port->port.count) {
38990 + if (atomic_read(&port->port.count)) {
38991 pr_debug("gserial_connect: start ttyGS%d\n", port->port_num);
38992 gs_start_io(port);
38993 if (gser->connect)
38994 @@ -1312,7 +1312,7 @@ void gserial_disconnect(struct gserial *gser)
38995
38996 port->port_usb = NULL;
38997 gser->ioport = NULL;
38998 - if (port->port.count > 0 || port->openclose) {
38999 + if (atomic_read(&port->port.count) > 0 || port->openclose) {
39000 wake_up_interruptible(&port->drain_wait);
39001 if (port->port.tty)
39002 tty_hangup(port->port.tty);
39003 @@ -1328,7 +1328,7 @@ void gserial_disconnect(struct gserial *gser)
39004
39005 /* finally, free any unused/unusable I/O buffers */
39006 spin_lock_irqsave(&port->port_lock, flags);
39007 - if (port->port.count == 0 && !port->openclose)
39008 + if (atomic_read(&port->port.count) == 0 && !port->openclose)
39009 gs_buf_free(&port->port_write_buf);
39010 gs_free_requests(gser->out, &port->read_pool, NULL);
39011 gs_free_requests(gser->out, &port->read_queue, NULL);
39012 diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
39013 index b9cca6d..75c75df 100644
39014 --- a/drivers/usb/serial/console.c
39015 +++ b/drivers/usb/serial/console.c
39016 @@ -127,7 +127,7 @@ static int usb_console_setup(struct console *co, char *options)
39017
39018 info->port = port;
39019
39020 - ++port->port.count;
39021 + atomic_inc(&port->port.count);
39022 if (!test_bit(ASYNCB_INITIALIZED, &port->port.flags)) {
39023 if (serial->type->set_termios) {
39024 /*
39025 @@ -177,7 +177,7 @@ static int usb_console_setup(struct console *co, char *options)
39026 }
39027 /* Now that any required fake tty operations are completed restore
39028 * the tty port count */
39029 - --port->port.count;
39030 + atomic_dec(&port->port.count);
39031 /* The console is special in terms of closing the device so
39032 * indicate this port is now acting as a system console. */
39033 port->port.console = 1;
39034 @@ -190,7 +190,7 @@ static int usb_console_setup(struct console *co, char *options)
39035 free_tty:
39036 kfree(tty);
39037 reset_open_count:
39038 - port->port.count = 0;
39039 + atomic_set(&port->port.count, 0);
39040 usb_autopm_put_interface(serial->interface);
39041 error_get_interface:
39042 usb_serial_put(serial);
39043 diff --git a/drivers/usb/wusbcore/wa-hc.h b/drivers/usb/wusbcore/wa-hc.h
39044 index d6bea3e..60b250e 100644
39045 --- a/drivers/usb/wusbcore/wa-hc.h
39046 +++ b/drivers/usb/wusbcore/wa-hc.h
39047 @@ -192,7 +192,7 @@ struct wahc {
39048 struct list_head xfer_delayed_list;
39049 spinlock_t xfer_list_lock;
39050 struct work_struct xfer_work;
39051 - atomic_t xfer_id_count;
39052 + atomic_unchecked_t xfer_id_count;
39053 };
39054
39055
39056 @@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *wa)
39057 INIT_LIST_HEAD(&wa->xfer_delayed_list);
39058 spin_lock_init(&wa->xfer_list_lock);
39059 INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
39060 - atomic_set(&wa->xfer_id_count, 1);
39061 + atomic_set_unchecked(&wa->xfer_id_count, 1);
39062 }
39063
39064 /**
39065 diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
39066 index 57c01ab..8a05959 100644
39067 --- a/drivers/usb/wusbcore/wa-xfer.c
39068 +++ b/drivers/usb/wusbcore/wa-xfer.c
39069 @@ -296,7 +296,7 @@ out:
39070 */
39071 static void wa_xfer_id_init(struct wa_xfer *xfer)
39072 {
39073 - xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
39074 + xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
39075 }
39076
39077 /*
39078 diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
39079 index 112156f..eb81154 100644
39080 --- a/drivers/vhost/vhost.c
39081 +++ b/drivers/vhost/vhost.c
39082 @@ -635,7 +635,7 @@ static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
39083 return 0;
39084 }
39085
39086 -static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
39087 +static long vhost_set_vring(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
39088 {
39089 struct file *eventfp, *filep = NULL,
39090 *pollstart = NULL, *pollstop = NULL;
39091 diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
39092 index b0b2ac3..89a4399 100644
39093 --- a/drivers/video/aty/aty128fb.c
39094 +++ b/drivers/video/aty/aty128fb.c
39095 @@ -148,7 +148,7 @@ enum {
39096 };
39097
39098 /* Must match above enum */
39099 -static const char *r128_family[] __devinitdata = {
39100 +static const char *r128_family[] __devinitconst = {
39101 "AGP",
39102 "PCI",
39103 "PRO AGP",
39104 diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
39105 index 2e471c2..f00eb3e 100644
39106 --- a/drivers/video/console/fbcon.c
39107 +++ b/drivers/video/console/fbcon.c
39108 @@ -442,7 +442,7 @@ static int __init fb_console_setup(char *this_opt)
39109
39110 while ((options = strsep(&this_opt, ",")) != NULL) {
39111 if (!strncmp(options, "font:", 5))
39112 - strcpy(fontname, options + 5);
39113 + strlcpy(fontname, options + 5, sizeof(fontname));
39114
39115 if (!strncmp(options, "scrollback:", 11)) {
39116 options += 11;
39117 diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c
39118 index 5c3960d..15cf8fc 100644
39119 --- a/drivers/video/fbcmap.c
39120 +++ b/drivers/video/fbcmap.c
39121 @@ -285,8 +285,7 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
39122 rc = -ENODEV;
39123 goto out;
39124 }
39125 - if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
39126 - !info->fbops->fb_setcmap)) {
39127 + if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
39128 rc = -EINVAL;
39129 goto out1;
39130 }
39131 diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
39132 index 0dff12a..2ef47b3 100644
39133 --- a/drivers/video/fbmem.c
39134 +++ b/drivers/video/fbmem.c
39135 @@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
39136 image->dx += image->width + 8;
39137 }
39138 } else if (rotate == FB_ROTATE_UD) {
39139 - for (x = 0; x < num && image->dx >= 0; x++) {
39140 + for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
39141 info->fbops->fb_imageblit(info, image);
39142 image->dx -= image->width + 8;
39143 }
39144 @@ -440,7 +440,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
39145 image->dy += image->height + 8;
39146 }
39147 } else if (rotate == FB_ROTATE_CCW) {
39148 - for (x = 0; x < num && image->dy >= 0; x++) {
39149 + for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
39150 info->fbops->fb_imageblit(info, image);
39151 image->dy -= image->height + 8;
39152 }
39153 @@ -1166,7 +1166,7 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
39154 return -EFAULT;
39155 if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
39156 return -EINVAL;
39157 - if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
39158 + if (con2fb.framebuffer >= FB_MAX)
39159 return -EINVAL;
39160 if (!registered_fb[con2fb.framebuffer])
39161 request_module("fb%d", con2fb.framebuffer);
39162 diff --git a/drivers/video/geode/gx1fb_core.c b/drivers/video/geode/gx1fb_core.c
39163 index 5a5d092..265c5ed 100644
39164 --- a/drivers/video/geode/gx1fb_core.c
39165 +++ b/drivers/video/geode/gx1fb_core.c
39166 @@ -29,7 +29,7 @@ static int crt_option = 1;
39167 static char panel_option[32] = "";
39168
39169 /* Modes relevant to the GX1 (taken from modedb.c) */
39170 -static const struct fb_videomode __devinitdata gx1_modedb[] = {
39171 +static const struct fb_videomode __devinitconst gx1_modedb[] = {
39172 /* 640x480-60 VESA */
39173 { NULL, 60, 640, 480, 39682, 48, 16, 33, 10, 96, 2,
39174 0, FB_VMODE_NONINTERLACED, FB_MODE_IS_VESA },
39175 diff --git a/drivers/video/gxt4500.c b/drivers/video/gxt4500.c
39176 index 0fad23f..0e9afa4 100644
39177 --- a/drivers/video/gxt4500.c
39178 +++ b/drivers/video/gxt4500.c
39179 @@ -156,7 +156,7 @@ struct gxt4500_par {
39180 static char *mode_option;
39181
39182 /* default mode: 1280x1024 @ 60 Hz, 8 bpp */
39183 -static const struct fb_videomode defaultmode __devinitdata = {
39184 +static const struct fb_videomode defaultmode __devinitconst = {
39185 .refresh = 60,
39186 .xres = 1280,
39187 .yres = 1024,
39188 @@ -581,7 +581,7 @@ static int gxt4500_blank(int blank, struct fb_info *info)
39189 return 0;
39190 }
39191
39192 -static const struct fb_fix_screeninfo gxt4500_fix __devinitdata = {
39193 +static const struct fb_fix_screeninfo gxt4500_fix __devinitconst = {
39194 .id = "IBM GXT4500P",
39195 .type = FB_TYPE_PACKED_PIXELS,
39196 .visual = FB_VISUAL_PSEUDOCOLOR,
39197 diff --git a/drivers/video/i810/i810_accel.c b/drivers/video/i810/i810_accel.c
39198 index 7672d2e..b56437f 100644
39199 --- a/drivers/video/i810/i810_accel.c
39200 +++ b/drivers/video/i810/i810_accel.c
39201 @@ -73,6 +73,7 @@ static inline int wait_for_space(struct fb_info *info, u32 space)
39202 }
39203 }
39204 printk("ringbuffer lockup!!!\n");
39205 + printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
39206 i810_report_error(mmio);
39207 par->dev_flags |= LOCKUP;
39208 info->pixmap.scan_align = 1;
39209 diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
39210 index b83f361..2b05a91 100644
39211 --- a/drivers/video/i810/i810_main.c
39212 +++ b/drivers/video/i810/i810_main.c
39213 @@ -97,7 +97,7 @@ static int i810fb_blank (int blank_mode, struct fb_info *info);
39214 static void i810fb_release_resource (struct fb_info *info, struct i810fb_par *par);
39215
39216 /* PCI */
39217 -static const char *i810_pci_list[] __devinitdata = {
39218 +static const char *i810_pci_list[] __devinitconst = {
39219 "Intel(R) 810 Framebuffer Device" ,
39220 "Intel(R) 810-DC100 Framebuffer Device" ,
39221 "Intel(R) 810E Framebuffer Device" ,
39222 diff --git a/drivers/video/jz4740_fb.c b/drivers/video/jz4740_fb.c
39223 index de36693..3c63fc2 100644
39224 --- a/drivers/video/jz4740_fb.c
39225 +++ b/drivers/video/jz4740_fb.c
39226 @@ -136,7 +136,7 @@ struct jzfb {
39227 uint32_t pseudo_palette[16];
39228 };
39229
39230 -static const struct fb_fix_screeninfo jzfb_fix __devinitdata = {
39231 +static const struct fb_fix_screeninfo jzfb_fix __devinitconst = {
39232 .id = "JZ4740 FB",
39233 .type = FB_TYPE_PACKED_PIXELS,
39234 .visual = FB_VISUAL_TRUECOLOR,
39235 diff --git a/drivers/video/logo/logo_linux_clut224.ppm b/drivers/video/logo/logo_linux_clut224.ppm
39236 index 3c14e43..eafa544 100644
39237 --- a/drivers/video/logo/logo_linux_clut224.ppm
39238 +++ b/drivers/video/logo/logo_linux_clut224.ppm
39239 @@ -1,1604 +1,1123 @@
39240 P3
39241 -# Standard 224-color Linux logo
39242 80 80
39243 255
39244 - 0 0 0 0 0 0 0 0 0 0 0 0
39245 - 0 0 0 0 0 0 0 0 0 0 0 0
39246 - 0 0 0 0 0 0 0 0 0 0 0 0
39247 - 0 0 0 0 0 0 0 0 0 0 0 0
39248 - 0 0 0 0 0 0 0 0 0 0 0 0
39249 - 0 0 0 0 0 0 0 0 0 0 0 0
39250 - 0 0 0 0 0 0 0 0 0 0 0 0
39251 - 0 0 0 0 0 0 0 0 0 0 0 0
39252 - 0 0 0 0 0 0 0 0 0 0 0 0
39253 - 6 6 6 6 6 6 10 10 10 10 10 10
39254 - 10 10 10 6 6 6 6 6 6 6 6 6
39255 - 0 0 0 0 0 0 0 0 0 0 0 0
39256 - 0 0 0 0 0 0 0 0 0 0 0 0
39257 - 0 0 0 0 0 0 0 0 0 0 0 0
39258 - 0 0 0 0 0 0 0 0 0 0 0 0
39259 - 0 0 0 0 0 0 0 0 0 0 0 0
39260 - 0 0 0 0 0 0 0 0 0 0 0 0
39261 - 0 0 0 0 0 0 0 0 0 0 0 0
39262 - 0 0 0 0 0 0 0 0 0 0 0 0
39263 - 0 0 0 0 0 0 0 0 0 0 0 0
39264 - 0 0 0 0 0 0 0 0 0 0 0 0
39265 - 0 0 0 0 0 0 0 0 0 0 0 0
39266 - 0 0 0 0 0 0 0 0 0 0 0 0
39267 - 0 0 0 0 0 0 0 0 0 0 0 0
39268 - 0 0 0 0 0 0 0 0 0 0 0 0
39269 - 0 0 0 0 0 0 0 0 0 0 0 0
39270 - 0 0 0 0 0 0 0 0 0 0 0 0
39271 - 0 0 0 0 0 0 0 0 0 0 0 0
39272 - 0 0 0 6 6 6 10 10 10 14 14 14
39273 - 22 22 22 26 26 26 30 30 30 34 34 34
39274 - 30 30 30 30 30 30 26 26 26 18 18 18
39275 - 14 14 14 10 10 10 6 6 6 0 0 0
39276 - 0 0 0 0 0 0 0 0 0 0 0 0
39277 - 0 0 0 0 0 0 0 0 0 0 0 0
39278 - 0 0 0 0 0 0 0 0 0 0 0 0
39279 - 0 0 0 0 0 0 0 0 0 0 0 0
39280 - 0 0 0 0 0 0 0 0 0 0 0 0
39281 - 0 0 0 0 0 0 0 0 0 0 0 0
39282 - 0 0 0 0 0 0 0 0 0 0 0 0
39283 - 0 0 0 0 0 0 0 0 0 0 0 0
39284 - 0 0 0 0 0 0 0 0 0 0 0 0
39285 - 0 0 0 0 0 1 0 0 1 0 0 0
39286 - 0 0 0 0 0 0 0 0 0 0 0 0
39287 - 0 0 0 0 0 0 0 0 0 0 0 0
39288 - 0 0 0 0 0 0 0 0 0 0 0 0
39289 - 0 0 0 0 0 0 0 0 0 0 0 0
39290 - 0 0 0 0 0 0 0 0 0 0 0 0
39291 - 0 0 0 0 0 0 0 0 0 0 0 0
39292 - 6 6 6 14 14 14 26 26 26 42 42 42
39293 - 54 54 54 66 66 66 78 78 78 78 78 78
39294 - 78 78 78 74 74 74 66 66 66 54 54 54
39295 - 42 42 42 26 26 26 18 18 18 10 10 10
39296 - 6 6 6 0 0 0 0 0 0 0 0 0
39297 - 0 0 0 0 0 0 0 0 0 0 0 0
39298 - 0 0 0 0 0 0 0 0 0 0 0 0
39299 - 0 0 0 0 0 0 0 0 0 0 0 0
39300 - 0 0 0 0 0 0 0 0 0 0 0 0
39301 - 0 0 0 0 0 0 0 0 0 0 0 0
39302 - 0 0 0 0 0 0 0 0 0 0 0 0
39303 - 0 0 0 0 0 0 0 0 0 0 0 0
39304 - 0 0 0 0 0 0 0 0 0 0 0 0
39305 - 0 0 1 0 0 0 0 0 0 0 0 0
39306 - 0 0 0 0 0 0 0 0 0 0 0 0
39307 - 0 0 0 0 0 0 0 0 0 0 0 0
39308 - 0 0 0 0 0 0 0 0 0 0 0 0
39309 - 0 0 0 0 0 0 0 0 0 0 0 0
39310 - 0 0 0 0 0 0 0 0 0 0 0 0
39311 - 0 0 0 0 0 0 0 0 0 10 10 10
39312 - 22 22 22 42 42 42 66 66 66 86 86 86
39313 - 66 66 66 38 38 38 38 38 38 22 22 22
39314 - 26 26 26 34 34 34 54 54 54 66 66 66
39315 - 86 86 86 70 70 70 46 46 46 26 26 26
39316 - 14 14 14 6 6 6 0 0 0 0 0 0
39317 - 0 0 0 0 0 0 0 0 0 0 0 0
39318 - 0 0 0 0 0 0 0 0 0 0 0 0
39319 - 0 0 0 0 0 0 0 0 0 0 0 0
39320 - 0 0 0 0 0 0 0 0 0 0 0 0
39321 - 0 0 0 0 0 0 0 0 0 0 0 0
39322 - 0 0 0 0 0 0 0 0 0 0 0 0
39323 - 0 0 0 0 0 0 0 0 0 0 0 0
39324 - 0 0 0 0 0 0 0 0 0 0 0 0
39325 - 0 0 1 0 0 1 0 0 1 0 0 0
39326 - 0 0 0 0 0 0 0 0 0 0 0 0
39327 - 0 0 0 0 0 0 0 0 0 0 0 0
39328 - 0 0 0 0 0 0 0 0 0 0 0 0
39329 - 0 0 0 0 0 0 0 0 0 0 0 0
39330 - 0 0 0 0 0 0 0 0 0 0 0 0
39331 - 0 0 0 0 0 0 10 10 10 26 26 26
39332 - 50 50 50 82 82 82 58 58 58 6 6 6
39333 - 2 2 6 2 2 6 2 2 6 2 2 6
39334 - 2 2 6 2 2 6 2 2 6 2 2 6
39335 - 6 6 6 54 54 54 86 86 86 66 66 66
39336 - 38 38 38 18 18 18 6 6 6 0 0 0
39337 - 0 0 0 0 0 0 0 0 0 0 0 0
39338 - 0 0 0 0 0 0 0 0 0 0 0 0
39339 - 0 0 0 0 0 0 0 0 0 0 0 0
39340 - 0 0 0 0 0 0 0 0 0 0 0 0
39341 - 0 0 0 0 0 0 0 0 0 0 0 0
39342 - 0 0 0 0 0 0 0 0 0 0 0 0
39343 - 0 0 0 0 0 0 0 0 0 0 0 0
39344 - 0 0 0 0 0 0 0 0 0 0 0 0
39345 - 0 0 0 0 0 0 0 0 0 0 0 0
39346 - 0 0 0 0 0 0 0 0 0 0 0 0
39347 - 0 0 0 0 0 0 0 0 0 0 0 0
39348 - 0 0 0 0 0 0 0 0 0 0 0 0
39349 - 0 0 0 0 0 0 0 0 0 0 0 0
39350 - 0 0 0 0 0 0 0 0 0 0 0 0
39351 - 0 0 0 6 6 6 22 22 22 50 50 50
39352 - 78 78 78 34 34 34 2 2 6 2 2 6
39353 - 2 2 6 2 2 6 2 2 6 2 2 6
39354 - 2 2 6 2 2 6 2 2 6 2 2 6
39355 - 2 2 6 2 2 6 6 6 6 70 70 70
39356 - 78 78 78 46 46 46 22 22 22 6 6 6
39357 - 0 0 0 0 0 0 0 0 0 0 0 0
39358 - 0 0 0 0 0 0 0 0 0 0 0 0
39359 - 0 0 0 0 0 0 0 0 0 0 0 0
39360 - 0 0 0 0 0 0 0 0 0 0 0 0
39361 - 0 0 0 0 0 0 0 0 0 0 0 0
39362 - 0 0 0 0 0 0 0 0 0 0 0 0
39363 - 0 0 0 0 0 0 0 0 0 0 0 0
39364 - 0 0 0 0 0 0 0 0 0 0 0 0
39365 - 0 0 1 0 0 1 0 0 1 0 0 0
39366 - 0 0 0 0 0 0 0 0 0 0 0 0
39367 - 0 0 0 0 0 0 0 0 0 0 0 0
39368 - 0 0 0 0 0 0 0 0 0 0 0 0
39369 - 0 0 0 0 0 0 0 0 0 0 0 0
39370 - 0 0 0 0 0 0 0 0 0 0 0 0
39371 - 6 6 6 18 18 18 42 42 42 82 82 82
39372 - 26 26 26 2 2 6 2 2 6 2 2 6
39373 - 2 2 6 2 2 6 2 2 6 2 2 6
39374 - 2 2 6 2 2 6 2 2 6 14 14 14
39375 - 46 46 46 34 34 34 6 6 6 2 2 6
39376 - 42 42 42 78 78 78 42 42 42 18 18 18
39377 - 6 6 6 0 0 0 0 0 0 0 0 0
39378 - 0 0 0 0 0 0 0 0 0 0 0 0
39379 - 0 0 0 0 0 0 0 0 0 0 0 0
39380 - 0 0 0 0 0 0 0 0 0 0 0 0
39381 - 0 0 0 0 0 0 0 0 0 0 0 0
39382 - 0 0 0 0 0 0 0 0 0 0 0 0
39383 - 0 0 0 0 0 0 0 0 0 0 0 0
39384 - 0 0 0 0 0 0 0 0 0 0 0 0
39385 - 0 0 1 0 0 0 0 0 1 0 0 0
39386 - 0 0 0 0 0 0 0 0 0 0 0 0
39387 - 0 0 0 0 0 0 0 0 0 0 0 0
39388 - 0 0 0 0 0 0 0 0 0 0 0 0
39389 - 0 0 0 0 0 0 0 0 0 0 0 0
39390 - 0 0 0 0 0 0 0 0 0 0 0 0
39391 - 10 10 10 30 30 30 66 66 66 58 58 58
39392 - 2 2 6 2 2 6 2 2 6 2 2 6
39393 - 2 2 6 2 2 6 2 2 6 2 2 6
39394 - 2 2 6 2 2 6 2 2 6 26 26 26
39395 - 86 86 86 101 101 101 46 46 46 10 10 10
39396 - 2 2 6 58 58 58 70 70 70 34 34 34
39397 - 10 10 10 0 0 0 0 0 0 0 0 0
39398 - 0 0 0 0 0 0 0 0 0 0 0 0
39399 - 0 0 0 0 0 0 0 0 0 0 0 0
39400 - 0 0 0 0 0 0 0 0 0 0 0 0
39401 - 0 0 0 0 0 0 0 0 0 0 0 0
39402 - 0 0 0 0 0 0 0 0 0 0 0 0
39403 - 0 0 0 0 0 0 0 0 0 0 0 0
39404 - 0 0 0 0 0 0 0 0 0 0 0 0
39405 - 0 0 1 0 0 1 0 0 1 0 0 0
39406 - 0 0 0 0 0 0 0 0 0 0 0 0
39407 - 0 0 0 0 0 0 0 0 0 0 0 0
39408 - 0 0 0 0 0 0 0 0 0 0 0 0
39409 - 0 0 0 0 0 0 0 0 0 0 0 0
39410 - 0 0 0 0 0 0 0 0 0 0 0 0
39411 - 14 14 14 42 42 42 86 86 86 10 10 10
39412 - 2 2 6 2 2 6 2 2 6 2 2 6
39413 - 2 2 6 2 2 6 2 2 6 2 2 6
39414 - 2 2 6 2 2 6 2 2 6 30 30 30
39415 - 94 94 94 94 94 94 58 58 58 26 26 26
39416 - 2 2 6 6 6 6 78 78 78 54 54 54
39417 - 22 22 22 6 6 6 0 0 0 0 0 0
39418 - 0 0 0 0 0 0 0 0 0 0 0 0
39419 - 0 0 0 0 0 0 0 0 0 0 0 0
39420 - 0 0 0 0 0 0 0 0 0 0 0 0
39421 - 0 0 0 0 0 0 0 0 0 0 0 0
39422 - 0 0 0 0 0 0 0 0 0 0 0 0
39423 - 0 0 0 0 0 0 0 0 0 0 0 0
39424 - 0 0 0 0 0 0 0 0 0 0 0 0
39425 - 0 0 0 0 0 0 0 0 0 0 0 0
39426 - 0 0 0 0 0 0 0 0 0 0 0 0
39427 - 0 0 0 0 0 0 0 0 0 0 0 0
39428 - 0 0 0 0 0 0 0 0 0 0 0 0
39429 - 0 0 0 0 0 0 0 0 0 0 0 0
39430 - 0 0 0 0 0 0 0 0 0 6 6 6
39431 - 22 22 22 62 62 62 62 62 62 2 2 6
39432 - 2 2 6 2 2 6 2 2 6 2 2 6
39433 - 2 2 6 2 2 6 2 2 6 2 2 6
39434 - 2 2 6 2 2 6 2 2 6 26 26 26
39435 - 54 54 54 38 38 38 18 18 18 10 10 10
39436 - 2 2 6 2 2 6 34 34 34 82 82 82
39437 - 38 38 38 14 14 14 0 0 0 0 0 0
39438 - 0 0 0 0 0 0 0 0 0 0 0 0
39439 - 0 0 0 0 0 0 0 0 0 0 0 0
39440 - 0 0 0 0 0 0 0 0 0 0 0 0
39441 - 0 0 0 0 0 0 0 0 0 0 0 0
39442 - 0 0 0 0 0 0 0 0 0 0 0 0
39443 - 0 0 0 0 0 0 0 0 0 0 0 0
39444 - 0 0 0 0 0 0 0 0 0 0 0 0
39445 - 0 0 0 0 0 1 0 0 1 0 0 0
39446 - 0 0 0 0 0 0 0 0 0 0 0 0
39447 - 0 0 0 0 0 0 0 0 0 0 0 0
39448 - 0 0 0 0 0 0 0 0 0 0 0 0
39449 - 0 0 0 0 0 0 0 0 0 0 0 0
39450 - 0 0 0 0 0 0 0 0 0 6 6 6
39451 - 30 30 30 78 78 78 30 30 30 2 2 6
39452 - 2 2 6 2 2 6 2 2 6 2 2 6
39453 - 2 2 6 2 2 6 2 2 6 2 2 6
39454 - 2 2 6 2 2 6 2 2 6 10 10 10
39455 - 10 10 10 2 2 6 2 2 6 2 2 6
39456 - 2 2 6 2 2 6 2 2 6 78 78 78
39457 - 50 50 50 18 18 18 6 6 6 0 0 0
39458 - 0 0 0 0 0 0 0 0 0 0 0 0
39459 - 0 0 0 0 0 0 0 0 0 0 0 0
39460 - 0 0 0 0 0 0 0 0 0 0 0 0
39461 - 0 0 0 0 0 0 0 0 0 0 0 0
39462 - 0 0 0 0 0 0 0 0 0 0 0 0
39463 - 0 0 0 0 0 0 0 0 0 0 0 0
39464 - 0 0 0 0 0 0 0 0 0 0 0 0
39465 - 0 0 1 0 0 0 0 0 0 0 0 0
39466 - 0 0 0 0 0 0 0 0 0 0 0 0
39467 - 0 0 0 0 0 0 0 0 0 0 0 0
39468 - 0 0 0 0 0 0 0 0 0 0 0 0
39469 - 0 0 0 0 0 0 0 0 0 0 0 0
39470 - 0 0 0 0 0 0 0 0 0 10 10 10
39471 - 38 38 38 86 86 86 14 14 14 2 2 6
39472 - 2 2 6 2 2 6 2 2 6 2 2 6
39473 - 2 2 6 2 2 6 2 2 6 2 2 6
39474 - 2 2 6 2 2 6 2 2 6 2 2 6
39475 - 2 2 6 2 2 6 2 2 6 2 2 6
39476 - 2 2 6 2 2 6 2 2 6 54 54 54
39477 - 66 66 66 26 26 26 6 6 6 0 0 0
39478 - 0 0 0 0 0 0 0 0 0 0 0 0
39479 - 0 0 0 0 0 0 0 0 0 0 0 0
39480 - 0 0 0 0 0 0 0 0 0 0 0 0
39481 - 0 0 0 0 0 0 0 0 0 0 0 0
39482 - 0 0 0 0 0 0 0 0 0 0 0 0
39483 - 0 0 0 0 0 0 0 0 0 0 0 0
39484 - 0 0 0 0 0 0 0 0 0 0 0 0
39485 - 0 0 0 0 0 1 0 0 1 0 0 0
39486 - 0 0 0 0 0 0 0 0 0 0 0 0
39487 - 0 0 0 0 0 0 0 0 0 0 0 0
39488 - 0 0 0 0 0 0 0 0 0 0 0 0
39489 - 0 0 0 0 0 0 0 0 0 0 0 0
39490 - 0 0 0 0 0 0 0 0 0 14 14 14
39491 - 42 42 42 82 82 82 2 2 6 2 2 6
39492 - 2 2 6 6 6 6 10 10 10 2 2 6
39493 - 2 2 6 2 2 6 2 2 6 2 2 6
39494 - 2 2 6 2 2 6 2 2 6 6 6 6
39495 - 14 14 14 10 10 10 2 2 6 2 2 6
39496 - 2 2 6 2 2 6 2 2 6 18 18 18
39497 - 82 82 82 34 34 34 10 10 10 0 0 0
39498 - 0 0 0 0 0 0 0 0 0 0 0 0
39499 - 0 0 0 0 0 0 0 0 0 0 0 0
39500 - 0 0 0 0 0 0 0 0 0 0 0 0
39501 - 0 0 0 0 0 0 0 0 0 0 0 0
39502 - 0 0 0 0 0 0 0 0 0 0 0 0
39503 - 0 0 0 0 0 0 0 0 0 0 0 0
39504 - 0 0 0 0 0 0 0 0 0 0 0 0
39505 - 0 0 1 0 0 0 0 0 0 0 0 0
39506 - 0 0 0 0 0 0 0 0 0 0 0 0
39507 - 0 0 0 0 0 0 0 0 0 0 0 0
39508 - 0 0 0 0 0 0 0 0 0 0 0 0
39509 - 0 0 0 0 0 0 0 0 0 0 0 0
39510 - 0 0 0 0 0 0 0 0 0 14 14 14
39511 - 46 46 46 86 86 86 2 2 6 2 2 6
39512 - 6 6 6 6 6 6 22 22 22 34 34 34
39513 - 6 6 6 2 2 6 2 2 6 2 2 6
39514 - 2 2 6 2 2 6 18 18 18 34 34 34
39515 - 10 10 10 50 50 50 22 22 22 2 2 6
39516 - 2 2 6 2 2 6 2 2 6 10 10 10
39517 - 86 86 86 42 42 42 14 14 14 0 0 0
39518 - 0 0 0 0 0 0 0 0 0 0 0 0
39519 - 0 0 0 0 0 0 0 0 0 0 0 0
39520 - 0 0 0 0 0 0 0 0 0 0 0 0
39521 - 0 0 0 0 0 0 0 0 0 0 0 0
39522 - 0 0 0 0 0 0 0 0 0 0 0 0
39523 - 0 0 0 0 0 0 0 0 0 0 0 0
39524 - 0 0 0 0 0 0 0 0 0 0 0 0
39525 - 0 0 1 0 0 1 0 0 1 0 0 0
39526 - 0 0 0 0 0 0 0 0 0 0 0 0
39527 - 0 0 0 0 0 0 0 0 0 0 0 0
39528 - 0 0 0 0 0 0 0 0 0 0 0 0
39529 - 0 0 0 0 0 0 0 0 0 0 0 0
39530 - 0 0 0 0 0 0 0 0 0 14 14 14
39531 - 46 46 46 86 86 86 2 2 6 2 2 6
39532 - 38 38 38 116 116 116 94 94 94 22 22 22
39533 - 22 22 22 2 2 6 2 2 6 2 2 6
39534 - 14 14 14 86 86 86 138 138 138 162 162 162
39535 -154 154 154 38 38 38 26 26 26 6 6 6
39536 - 2 2 6 2 2 6 2 2 6 2 2 6
39537 - 86 86 86 46 46 46 14 14 14 0 0 0
39538 - 0 0 0 0 0 0 0 0 0 0 0 0
39539 - 0 0 0 0 0 0 0 0 0 0 0 0
39540 - 0 0 0 0 0 0 0 0 0 0 0 0
39541 - 0 0 0 0 0 0 0 0 0 0 0 0
39542 - 0 0 0 0 0 0 0 0 0 0 0 0
39543 - 0 0 0 0 0 0 0 0 0 0 0 0
39544 - 0 0 0 0 0 0 0 0 0 0 0 0
39545 - 0 0 0 0 0 0 0 0 0 0 0 0
39546 - 0 0 0 0 0 0 0 0 0 0 0 0
39547 - 0 0 0 0 0 0 0 0 0 0 0 0
39548 - 0 0 0 0 0 0 0 0 0 0 0 0
39549 - 0 0 0 0 0 0 0 0 0 0 0 0
39550 - 0 0 0 0 0 0 0 0 0 14 14 14
39551 - 46 46 46 86 86 86 2 2 6 14 14 14
39552 -134 134 134 198 198 198 195 195 195 116 116 116
39553 - 10 10 10 2 2 6 2 2 6 6 6 6
39554 -101 98 89 187 187 187 210 210 210 218 218 218
39555 -214 214 214 134 134 134 14 14 14 6 6 6
39556 - 2 2 6 2 2 6 2 2 6 2 2 6
39557 - 86 86 86 50 50 50 18 18 18 6 6 6
39558 - 0 0 0 0 0 0 0 0 0 0 0 0
39559 - 0 0 0 0 0 0 0 0 0 0 0 0
39560 - 0 0 0 0 0 0 0 0 0 0 0 0
39561 - 0 0 0 0 0 0 0 0 0 0 0 0
39562 - 0 0 0 0 0 0 0 0 0 0 0 0
39563 - 0 0 0 0 0 0 0 0 0 0 0 0
39564 - 0 0 0 0 0 0 0 0 1 0 0 0
39565 - 0 0 1 0 0 1 0 0 1 0 0 0
39566 - 0 0 0 0 0 0 0 0 0 0 0 0
39567 - 0 0 0 0 0 0 0 0 0 0 0 0
39568 - 0 0 0 0 0 0 0 0 0 0 0 0
39569 - 0 0 0 0 0 0 0 0 0 0 0 0
39570 - 0 0 0 0 0 0 0 0 0 14 14 14
39571 - 46 46 46 86 86 86 2 2 6 54 54 54
39572 -218 218 218 195 195 195 226 226 226 246 246 246
39573 - 58 58 58 2 2 6 2 2 6 30 30 30
39574 -210 210 210 253 253 253 174 174 174 123 123 123
39575 -221 221 221 234 234 234 74 74 74 2 2 6
39576 - 2 2 6 2 2 6 2 2 6 2 2 6
39577 - 70 70 70 58 58 58 22 22 22 6 6 6
39578 - 0 0 0 0 0 0 0 0 0 0 0 0
39579 - 0 0 0 0 0 0 0 0 0 0 0 0
39580 - 0 0 0 0 0 0 0 0 0 0 0 0
39581 - 0 0 0 0 0 0 0 0 0 0 0 0
39582 - 0 0 0 0 0 0 0 0 0 0 0 0
39583 - 0 0 0 0 0 0 0 0 0 0 0 0
39584 - 0 0 0 0 0 0 0 0 0 0 0 0
39585 - 0 0 0 0 0 0 0 0 0 0 0 0
39586 - 0 0 0 0 0 0 0 0 0 0 0 0
39587 - 0 0 0 0 0 0 0 0 0 0 0 0
39588 - 0 0 0 0 0 0 0 0 0 0 0 0
39589 - 0 0 0 0 0 0 0 0 0 0 0 0
39590 - 0 0 0 0 0 0 0 0 0 14 14 14
39591 - 46 46 46 82 82 82 2 2 6 106 106 106
39592 -170 170 170 26 26 26 86 86 86 226 226 226
39593 -123 123 123 10 10 10 14 14 14 46 46 46
39594 -231 231 231 190 190 190 6 6 6 70 70 70
39595 - 90 90 90 238 238 238 158 158 158 2 2 6
39596 - 2 2 6 2 2 6 2 2 6 2 2 6
39597 - 70 70 70 58 58 58 22 22 22 6 6 6
39598 - 0 0 0 0 0 0 0 0 0 0 0 0
39599 - 0 0 0 0 0 0 0 0 0 0 0 0
39600 - 0 0 0 0 0 0 0 0 0 0 0 0
39601 - 0 0 0 0 0 0 0 0 0 0 0 0
39602 - 0 0 0 0 0 0 0 0 0 0 0 0
39603 - 0 0 0 0 0 0 0 0 0 0 0 0
39604 - 0 0 0 0 0 0 0 0 1 0 0 0
39605 - 0 0 1 0 0 1 0 0 1 0 0 0
39606 - 0 0 0 0 0 0 0 0 0 0 0 0
39607 - 0 0 0 0 0 0 0 0 0 0 0 0
39608 - 0 0 0 0 0 0 0 0 0 0 0 0
39609 - 0 0 0 0 0 0 0 0 0 0 0 0
39610 - 0 0 0 0 0 0 0 0 0 14 14 14
39611 - 42 42 42 86 86 86 6 6 6 116 116 116
39612 -106 106 106 6 6 6 70 70 70 149 149 149
39613 -128 128 128 18 18 18 38 38 38 54 54 54
39614 -221 221 221 106 106 106 2 2 6 14 14 14
39615 - 46 46 46 190 190 190 198 198 198 2 2 6
39616 - 2 2 6 2 2 6 2 2 6 2 2 6
39617 - 74 74 74 62 62 62 22 22 22 6 6 6
39618 - 0 0 0 0 0 0 0 0 0 0 0 0
39619 - 0 0 0 0 0 0 0 0 0 0 0 0
39620 - 0 0 0 0 0 0 0 0 0 0 0 0
39621 - 0 0 0 0 0 0 0 0 0 0 0 0
39622 - 0 0 0 0 0 0 0 0 0 0 0 0
39623 - 0 0 0 0 0 0 0 0 0 0 0 0
39624 - 0 0 0 0 0 0 0 0 1 0 0 0
39625 - 0 0 1 0 0 0 0 0 1 0 0 0
39626 - 0 0 0 0 0 0 0 0 0 0 0 0
39627 - 0 0 0 0 0 0 0 0 0 0 0 0
39628 - 0 0 0 0 0 0 0 0 0 0 0 0
39629 - 0 0 0 0 0 0 0 0 0 0 0 0
39630 - 0 0 0 0 0 0 0 0 0 14 14 14
39631 - 42 42 42 94 94 94 14 14 14 101 101 101
39632 -128 128 128 2 2 6 18 18 18 116 116 116
39633 -118 98 46 121 92 8 121 92 8 98 78 10
39634 -162 162 162 106 106 106 2 2 6 2 2 6
39635 - 2 2 6 195 195 195 195 195 195 6 6 6
39636 - 2 2 6 2 2 6 2 2 6 2 2 6
39637 - 74 74 74 62 62 62 22 22 22 6 6 6
39638 - 0 0 0 0 0 0 0 0 0 0 0 0
39639 - 0 0 0 0 0 0 0 0 0 0 0 0
39640 - 0 0 0 0 0 0 0 0 0 0 0 0
39641 - 0 0 0 0 0 0 0 0 0 0 0 0
39642 - 0 0 0 0 0 0 0 0 0 0 0 0
39643 - 0 0 0 0 0 0 0 0 0 0 0 0
39644 - 0 0 0 0 0 0 0 0 1 0 0 1
39645 - 0 0 1 0 0 0 0 0 1 0 0 0
39646 - 0 0 0 0 0 0 0 0 0 0 0 0
39647 - 0 0 0 0 0 0 0 0 0 0 0 0
39648 - 0 0 0 0 0 0 0 0 0 0 0 0
39649 - 0 0 0 0 0 0 0 0 0 0 0 0
39650 - 0 0 0 0 0 0 0 0 0 10 10 10
39651 - 38 38 38 90 90 90 14 14 14 58 58 58
39652 -210 210 210 26 26 26 54 38 6 154 114 10
39653 -226 170 11 236 186 11 225 175 15 184 144 12
39654 -215 174 15 175 146 61 37 26 9 2 2 6
39655 - 70 70 70 246 246 246 138 138 138 2 2 6
39656 - 2 2 6 2 2 6 2 2 6 2 2 6
39657 - 70 70 70 66 66 66 26 26 26 6 6 6
39658 - 0 0 0 0 0 0 0 0 0 0 0 0
39659 - 0 0 0 0 0 0 0 0 0 0 0 0
39660 - 0 0 0 0 0 0 0 0 0 0 0 0
39661 - 0 0 0 0 0 0 0 0 0 0 0 0
39662 - 0 0 0 0 0 0 0 0 0 0 0 0
39663 - 0 0 0 0 0 0 0 0 0 0 0 0
39664 - 0 0 0 0 0 0 0 0 0 0 0 0
39665 - 0 0 0 0 0 0 0 0 0 0 0 0
39666 - 0 0 0 0 0 0 0 0 0 0 0 0
39667 - 0 0 0 0 0 0 0 0 0 0 0 0
39668 - 0 0 0 0 0 0 0 0 0 0 0 0
39669 - 0 0 0 0 0 0 0 0 0 0 0 0
39670 - 0 0 0 0 0 0 0 0 0 10 10 10
39671 - 38 38 38 86 86 86 14 14 14 10 10 10
39672 -195 195 195 188 164 115 192 133 9 225 175 15
39673 -239 182 13 234 190 10 232 195 16 232 200 30
39674 -245 207 45 241 208 19 232 195 16 184 144 12
39675 -218 194 134 211 206 186 42 42 42 2 2 6
39676 - 2 2 6 2 2 6 2 2 6 2 2 6
39677 - 50 50 50 74 74 74 30 30 30 6 6 6
39678 - 0 0 0 0 0 0 0 0 0 0 0 0
39679 - 0 0 0 0 0 0 0 0 0 0 0 0
39680 - 0 0 0 0 0 0 0 0 0 0 0 0
39681 - 0 0 0 0 0 0 0 0 0 0 0 0
39682 - 0 0 0 0 0 0 0 0 0 0 0 0
39683 - 0 0 0 0 0 0 0 0 0 0 0 0
39684 - 0 0 0 0 0 0 0 0 0 0 0 0
39685 - 0 0 0 0 0 0 0 0 0 0 0 0
39686 - 0 0 0 0 0 0 0 0 0 0 0 0
39687 - 0 0 0 0 0 0 0 0 0 0 0 0
39688 - 0 0 0 0 0 0 0 0 0 0 0 0
39689 - 0 0 0 0 0 0 0 0 0 0 0 0
39690 - 0 0 0 0 0 0 0 0 0 10 10 10
39691 - 34 34 34 86 86 86 14 14 14 2 2 6
39692 -121 87 25 192 133 9 219 162 10 239 182 13
39693 -236 186 11 232 195 16 241 208 19 244 214 54
39694 -246 218 60 246 218 38 246 215 20 241 208 19
39695 -241 208 19 226 184 13 121 87 25 2 2 6
39696 - 2 2 6 2 2 6 2 2 6 2 2 6
39697 - 50 50 50 82 82 82 34 34 34 10 10 10
39698 - 0 0 0 0 0 0 0 0 0 0 0 0
39699 - 0 0 0 0 0 0 0 0 0 0 0 0
39700 - 0 0 0 0 0 0 0 0 0 0 0 0
39701 - 0 0 0 0 0 0 0 0 0 0 0 0
39702 - 0 0 0 0 0 0 0 0 0 0 0 0
39703 - 0 0 0 0 0 0 0 0 0 0 0 0
39704 - 0 0 0 0 0 0 0 0 0 0 0 0
39705 - 0 0 0 0 0 0 0 0 0 0 0 0
39706 - 0 0 0 0 0 0 0 0 0 0 0 0
39707 - 0 0 0 0 0 0 0 0 0 0 0 0
39708 - 0 0 0 0 0 0 0 0 0 0 0 0
39709 - 0 0 0 0 0 0 0 0 0 0 0 0
39710 - 0 0 0 0 0 0 0 0 0 10 10 10
39711 - 34 34 34 82 82 82 30 30 30 61 42 6
39712 -180 123 7 206 145 10 230 174 11 239 182 13
39713 -234 190 10 238 202 15 241 208 19 246 218 74
39714 -246 218 38 246 215 20 246 215 20 246 215 20
39715 -226 184 13 215 174 15 184 144 12 6 6 6
39716 - 2 2 6 2 2 6 2 2 6 2 2 6
39717 - 26 26 26 94 94 94 42 42 42 14 14 14
39718 - 0 0 0 0 0 0 0 0 0 0 0 0
39719 - 0 0 0 0 0 0 0 0 0 0 0 0
39720 - 0 0 0 0 0 0 0 0 0 0 0 0
39721 - 0 0 0 0 0 0 0 0 0 0 0 0
39722 - 0 0 0 0 0 0 0 0 0 0 0 0
39723 - 0 0 0 0 0 0 0 0 0 0 0 0
39724 - 0 0 0 0 0 0 0 0 0 0 0 0
39725 - 0 0 0 0 0 0 0 0 0 0 0 0
39726 - 0 0 0 0 0 0 0 0 0 0 0 0
39727 - 0 0 0 0 0 0 0 0 0 0 0 0
39728 - 0 0 0 0 0 0 0 0 0 0 0 0
39729 - 0 0 0 0 0 0 0 0 0 0 0 0
39730 - 0 0 0 0 0 0 0 0 0 10 10 10
39731 - 30 30 30 78 78 78 50 50 50 104 69 6
39732 -192 133 9 216 158 10 236 178 12 236 186 11
39733 -232 195 16 241 208 19 244 214 54 245 215 43
39734 -246 215 20 246 215 20 241 208 19 198 155 10
39735 -200 144 11 216 158 10 156 118 10 2 2 6
39736 - 2 2 6 2 2 6 2 2 6 2 2 6
39737 - 6 6 6 90 90 90 54 54 54 18 18 18
39738 - 6 6 6 0 0 0 0 0 0 0 0 0
39739 - 0 0 0 0 0 0 0 0 0 0 0 0
39740 - 0 0 0 0 0 0 0 0 0 0 0 0
39741 - 0 0 0 0 0 0 0 0 0 0 0 0
39742 - 0 0 0 0 0 0 0 0 0 0 0 0
39743 - 0 0 0 0 0 0 0 0 0 0 0 0
39744 - 0 0 0 0 0 0 0 0 0 0 0 0
39745 - 0 0 0 0 0 0 0 0 0 0 0 0
39746 - 0 0 0 0 0 0 0 0 0 0 0 0
39747 - 0 0 0 0 0 0 0 0 0 0 0 0
39748 - 0 0 0 0 0 0 0 0 0 0 0 0
39749 - 0 0 0 0 0 0 0 0 0 0 0 0
39750 - 0 0 0 0 0 0 0 0 0 10 10 10
39751 - 30 30 30 78 78 78 46 46 46 22 22 22
39752 -137 92 6 210 162 10 239 182 13 238 190 10
39753 -238 202 15 241 208 19 246 215 20 246 215 20
39754 -241 208 19 203 166 17 185 133 11 210 150 10
39755 -216 158 10 210 150 10 102 78 10 2 2 6
39756 - 6 6 6 54 54 54 14 14 14 2 2 6
39757 - 2 2 6 62 62 62 74 74 74 30 30 30
39758 - 10 10 10 0 0 0 0 0 0 0 0 0
39759 - 0 0 0 0 0 0 0 0 0 0 0 0
39760 - 0 0 0 0 0 0 0 0 0 0 0 0
39761 - 0 0 0 0 0 0 0 0 0 0 0 0
39762 - 0 0 0 0 0 0 0 0 0 0 0 0
39763 - 0 0 0 0 0 0 0 0 0 0 0 0
39764 - 0 0 0 0 0 0 0 0 0 0 0 0
39765 - 0 0 0 0 0 0 0 0 0 0 0 0
39766 - 0 0 0 0 0 0 0 0 0 0 0 0
39767 - 0 0 0 0 0 0 0 0 0 0 0 0
39768 - 0 0 0 0 0 0 0 0 0 0 0 0
39769 - 0 0 0 0 0 0 0 0 0 0 0 0
39770 - 0 0 0 0 0 0 0 0 0 10 10 10
39771 - 34 34 34 78 78 78 50 50 50 6 6 6
39772 - 94 70 30 139 102 15 190 146 13 226 184 13
39773 -232 200 30 232 195 16 215 174 15 190 146 13
39774 -168 122 10 192 133 9 210 150 10 213 154 11
39775 -202 150 34 182 157 106 101 98 89 2 2 6
39776 - 2 2 6 78 78 78 116 116 116 58 58 58
39777 - 2 2 6 22 22 22 90 90 90 46 46 46
39778 - 18 18 18 6 6 6 0 0 0 0 0 0
39779 - 0 0 0 0 0 0 0 0 0 0 0 0
39780 - 0 0 0 0 0 0 0 0 0 0 0 0
39781 - 0 0 0 0 0 0 0 0 0 0 0 0
39782 - 0 0 0 0 0 0 0 0 0 0 0 0
39783 - 0 0 0 0 0 0 0 0 0 0 0 0
39784 - 0 0 0 0 0 0 0 0 0 0 0 0
39785 - 0 0 0 0 0 0 0 0 0 0 0 0
39786 - 0 0 0 0 0 0 0 0 0 0 0 0
39787 - 0 0 0 0 0 0 0 0 0 0 0 0
39788 - 0 0 0 0 0 0 0 0 0 0 0 0
39789 - 0 0 0 0 0 0 0 0 0 0 0 0
39790 - 0 0 0 0 0 0 0 0 0 10 10 10
39791 - 38 38 38 86 86 86 50 50 50 6 6 6
39792 -128 128 128 174 154 114 156 107 11 168 122 10
39793 -198 155 10 184 144 12 197 138 11 200 144 11
39794 -206 145 10 206 145 10 197 138 11 188 164 115
39795 -195 195 195 198 198 198 174 174 174 14 14 14
39796 - 2 2 6 22 22 22 116 116 116 116 116 116
39797 - 22 22 22 2 2 6 74 74 74 70 70 70
39798 - 30 30 30 10 10 10 0 0 0 0 0 0
39799 - 0 0 0 0 0 0 0 0 0 0 0 0
39800 - 0 0 0 0 0 0 0 0 0 0 0 0
39801 - 0 0 0 0 0 0 0 0 0 0 0 0
39802 - 0 0 0 0 0 0 0 0 0 0 0 0
39803 - 0 0 0 0 0 0 0 0 0 0 0 0
39804 - 0 0 0 0 0 0 0 0 0 0 0 0
39805 - 0 0 0 0 0 0 0 0 0 0 0 0
39806 - 0 0 0 0 0 0 0 0 0 0 0 0
39807 - 0 0 0 0 0 0 0 0 0 0 0 0
39808 - 0 0 0 0 0 0 0 0 0 0 0 0
39809 - 0 0 0 0 0 0 0 0 0 0 0 0
39810 - 0 0 0 0 0 0 6 6 6 18 18 18
39811 - 50 50 50 101 101 101 26 26 26 10 10 10
39812 -138 138 138 190 190 190 174 154 114 156 107 11
39813 -197 138 11 200 144 11 197 138 11 192 133 9
39814 -180 123 7 190 142 34 190 178 144 187 187 187
39815 -202 202 202 221 221 221 214 214 214 66 66 66
39816 - 2 2 6 2 2 6 50 50 50 62 62 62
39817 - 6 6 6 2 2 6 10 10 10 90 90 90
39818 - 50 50 50 18 18 18 6 6 6 0 0 0
39819 - 0 0 0 0 0 0 0 0 0 0 0 0
39820 - 0 0 0 0 0 0 0 0 0 0 0 0
39821 - 0 0 0 0 0 0 0 0 0 0 0 0
39822 - 0 0 0 0 0 0 0 0 0 0 0 0
39823 - 0 0 0 0 0 0 0 0 0 0 0 0
39824 - 0 0 0 0 0 0 0 0 0 0 0 0
39825 - 0 0 0 0 0 0 0 0 0 0 0 0
39826 - 0 0 0 0 0 0 0 0 0 0 0 0
39827 - 0 0 0 0 0 0 0 0 0 0 0 0
39828 - 0 0 0 0 0 0 0 0 0 0 0 0
39829 - 0 0 0 0 0 0 0 0 0 0 0 0
39830 - 0 0 0 0 0 0 10 10 10 34 34 34
39831 - 74 74 74 74 74 74 2 2 6 6 6 6
39832 -144 144 144 198 198 198 190 190 190 178 166 146
39833 -154 121 60 156 107 11 156 107 11 168 124 44
39834 -174 154 114 187 187 187 190 190 190 210 210 210
39835 -246 246 246 253 253 253 253 253 253 182 182 182
39836 - 6 6 6 2 2 6 2 2 6 2 2 6
39837 - 2 2 6 2 2 6 2 2 6 62 62 62
39838 - 74 74 74 34 34 34 14 14 14 0 0 0
39839 - 0 0 0 0 0 0 0 0 0 0 0 0
39840 - 0 0 0 0 0 0 0 0 0 0 0 0
39841 - 0 0 0 0 0 0 0 0 0 0 0 0
39842 - 0 0 0 0 0 0 0 0 0 0 0 0
39843 - 0 0 0 0 0 0 0 0 0 0 0 0
39844 - 0 0 0 0 0 0 0 0 0 0 0 0
39845 - 0 0 0 0 0 0 0 0 0 0 0 0
39846 - 0 0 0 0 0 0 0 0 0 0 0 0
39847 - 0 0 0 0 0 0 0 0 0 0 0 0
39848 - 0 0 0 0 0 0 0 0 0 0 0 0
39849 - 0 0 0 0 0 0 0 0 0 0 0 0
39850 - 0 0 0 10 10 10 22 22 22 54 54 54
39851 - 94 94 94 18 18 18 2 2 6 46 46 46
39852 -234 234 234 221 221 221 190 190 190 190 190 190
39853 -190 190 190 187 187 187 187 187 187 190 190 190
39854 -190 190 190 195 195 195 214 214 214 242 242 242
39855 -253 253 253 253 253 253 253 253 253 253 253 253
39856 - 82 82 82 2 2 6 2 2 6 2 2 6
39857 - 2 2 6 2 2 6 2 2 6 14 14 14
39858 - 86 86 86 54 54 54 22 22 22 6 6 6
39859 - 0 0 0 0 0 0 0 0 0 0 0 0
39860 - 0 0 0 0 0 0 0 0 0 0 0 0
39861 - 0 0 0 0 0 0 0 0 0 0 0 0
39862 - 0 0 0 0 0 0 0 0 0 0 0 0
39863 - 0 0 0 0 0 0 0 0 0 0 0 0
39864 - 0 0 0 0 0 0 0 0 0 0 0 0
39865 - 0 0 0 0 0 0 0 0 0 0 0 0
39866 - 0 0 0 0 0 0 0 0 0 0 0 0
39867 - 0 0 0 0 0 0 0 0 0 0 0 0
39868 - 0 0 0 0 0 0 0 0 0 0 0 0
39869 - 0 0 0 0 0 0 0 0 0 0 0 0
39870 - 6 6 6 18 18 18 46 46 46 90 90 90
39871 - 46 46 46 18 18 18 6 6 6 182 182 182
39872 -253 253 253 246 246 246 206 206 206 190 190 190
39873 -190 190 190 190 190 190 190 190 190 190 190 190
39874 -206 206 206 231 231 231 250 250 250 253 253 253
39875 -253 253 253 253 253 253 253 253 253 253 253 253
39876 -202 202 202 14 14 14 2 2 6 2 2 6
39877 - 2 2 6 2 2 6 2 2 6 2 2 6
39878 - 42 42 42 86 86 86 42 42 42 18 18 18
39879 - 6 6 6 0 0 0 0 0 0 0 0 0
39880 - 0 0 0 0 0 0 0 0 0 0 0 0
39881 - 0 0 0 0 0 0 0 0 0 0 0 0
39882 - 0 0 0 0 0 0 0 0 0 0 0 0
39883 - 0 0 0 0 0 0 0 0 0 0 0 0
39884 - 0 0 0 0 0 0 0 0 0 0 0 0
39885 - 0 0 0 0 0 0 0 0 0 0 0 0
39886 - 0 0 0 0 0 0 0 0 0 0 0 0
39887 - 0 0 0 0 0 0 0 0 0 0 0 0
39888 - 0 0 0 0 0 0 0 0 0 0 0 0
39889 - 0 0 0 0 0 0 0 0 0 6 6 6
39890 - 14 14 14 38 38 38 74 74 74 66 66 66
39891 - 2 2 6 6 6 6 90 90 90 250 250 250
39892 -253 253 253 253 253 253 238 238 238 198 198 198
39893 -190 190 190 190 190 190 195 195 195 221 221 221
39894 -246 246 246 253 253 253 253 253 253 253 253 253
39895 -253 253 253 253 253 253 253 253 253 253 253 253
39896 -253 253 253 82 82 82 2 2 6 2 2 6
39897 - 2 2 6 2 2 6 2 2 6 2 2 6
39898 - 2 2 6 78 78 78 70 70 70 34 34 34
39899 - 14 14 14 6 6 6 0 0 0 0 0 0
39900 - 0 0 0 0 0 0 0 0 0 0 0 0
39901 - 0 0 0 0 0 0 0 0 0 0 0 0
39902 - 0 0 0 0 0 0 0 0 0 0 0 0
39903 - 0 0 0 0 0 0 0 0 0 0 0 0
39904 - 0 0 0 0 0 0 0 0 0 0 0 0
39905 - 0 0 0 0 0 0 0 0 0 0 0 0
39906 - 0 0 0 0 0 0 0 0 0 0 0 0
39907 - 0 0 0 0 0 0 0 0 0 0 0 0
39908 - 0 0 0 0 0 0 0 0 0 0 0 0
39909 - 0 0 0 0 0 0 0 0 0 14 14 14
39910 - 34 34 34 66 66 66 78 78 78 6 6 6
39911 - 2 2 6 18 18 18 218 218 218 253 253 253
39912 -253 253 253 253 253 253 253 253 253 246 246 246
39913 -226 226 226 231 231 231 246 246 246 253 253 253
39914 -253 253 253 253 253 253 253 253 253 253 253 253
39915 -253 253 253 253 253 253 253 253 253 253 253 253
39916 -253 253 253 178 178 178 2 2 6 2 2 6
39917 - 2 2 6 2 2 6 2 2 6 2 2 6
39918 - 2 2 6 18 18 18 90 90 90 62 62 62
39919 - 30 30 30 10 10 10 0 0 0 0 0 0
39920 - 0 0 0 0 0 0 0 0 0 0 0 0
39921 - 0 0 0 0 0 0 0 0 0 0 0 0
39922 - 0 0 0 0 0 0 0 0 0 0 0 0
39923 - 0 0 0 0 0 0 0 0 0 0 0 0
39924 - 0 0 0 0 0 0 0 0 0 0 0 0
39925 - 0 0 0 0 0 0 0 0 0 0 0 0
39926 - 0 0 0 0 0 0 0 0 0 0 0 0
39927 - 0 0 0 0 0 0 0 0 0 0 0 0
39928 - 0 0 0 0 0 0 0 0 0 0 0 0
39929 - 0 0 0 0 0 0 10 10 10 26 26 26
39930 - 58 58 58 90 90 90 18 18 18 2 2 6
39931 - 2 2 6 110 110 110 253 253 253 253 253 253
39932 -253 253 253 253 253 253 253 253 253 253 253 253
39933 -250 250 250 253 253 253 253 253 253 253 253 253
39934 -253 253 253 253 253 253 253 253 253 253 253 253
39935 -253 253 253 253 253 253 253 253 253 253 253 253
39936 -253 253 253 231 231 231 18 18 18 2 2 6
39937 - 2 2 6 2 2 6 2 2 6 2 2 6
39938 - 2 2 6 2 2 6 18 18 18 94 94 94
39939 - 54 54 54 26 26 26 10 10 10 0 0 0
39940 - 0 0 0 0 0 0 0 0 0 0 0 0
39941 - 0 0 0 0 0 0 0 0 0 0 0 0
39942 - 0 0 0 0 0 0 0 0 0 0 0 0
39943 - 0 0 0 0 0 0 0 0 0 0 0 0
39944 - 0 0 0 0 0 0 0 0 0 0 0 0
39945 - 0 0 0 0 0 0 0 0 0 0 0 0
39946 - 0 0 0 0 0 0 0 0 0 0 0 0
39947 - 0 0 0 0 0 0 0 0 0 0 0 0
39948 - 0 0 0 0 0 0 0 0 0 0 0 0
39949 - 0 0 0 6 6 6 22 22 22 50 50 50
39950 - 90 90 90 26 26 26 2 2 6 2 2 6
39951 - 14 14 14 195 195 195 250 250 250 253 253 253
39952 -253 253 253 253 253 253 253 253 253 253 253 253
39953 -253 253 253 253 253 253 253 253 253 253 253 253
39954 -253 253 253 253 253 253 253 253 253 253 253 253
39955 -253 253 253 253 253 253 253 253 253 253 253 253
39956 -250 250 250 242 242 242 54 54 54 2 2 6
39957 - 2 2 6 2 2 6 2 2 6 2 2 6
39958 - 2 2 6 2 2 6 2 2 6 38 38 38
39959 - 86 86 86 50 50 50 22 22 22 6 6 6
39960 - 0 0 0 0 0 0 0 0 0 0 0 0
39961 - 0 0 0 0 0 0 0 0 0 0 0 0
39962 - 0 0 0 0 0 0 0 0 0 0 0 0
39963 - 0 0 0 0 0 0 0 0 0 0 0 0
39964 - 0 0 0 0 0 0 0 0 0 0 0 0
39965 - 0 0 0 0 0 0 0 0 0 0 0 0
39966 - 0 0 0 0 0 0 0 0 0 0 0 0
39967 - 0 0 0 0 0 0 0 0 0 0 0 0
39968 - 0 0 0 0 0 0 0 0 0 0 0 0
39969 - 6 6 6 14 14 14 38 38 38 82 82 82
39970 - 34 34 34 2 2 6 2 2 6 2 2 6
39971 - 42 42 42 195 195 195 246 246 246 253 253 253
39972 -253 253 253 253 253 253 253 253 253 250 250 250
39973 -242 242 242 242 242 242 250 250 250 253 253 253
39974 -253 253 253 253 253 253 253 253 253 253 253 253
39975 -253 253 253 250 250 250 246 246 246 238 238 238
39976 -226 226 226 231 231 231 101 101 101 6 6 6
39977 - 2 2 6 2 2 6 2 2 6 2 2 6
39978 - 2 2 6 2 2 6 2 2 6 2 2 6
39979 - 38 38 38 82 82 82 42 42 42 14 14 14
39980 - 6 6 6 0 0 0 0 0 0 0 0 0
39981 - 0 0 0 0 0 0 0 0 0 0 0 0
39982 - 0 0 0 0 0 0 0 0 0 0 0 0
39983 - 0 0 0 0 0 0 0 0 0 0 0 0
39984 - 0 0 0 0 0 0 0 0 0 0 0 0
39985 - 0 0 0 0 0 0 0 0 0 0 0 0
39986 - 0 0 0 0 0 0 0 0 0 0 0 0
39987 - 0 0 0 0 0 0 0 0 0 0 0 0
39988 - 0 0 0 0 0 0 0 0 0 0 0 0
39989 - 10 10 10 26 26 26 62 62 62 66 66 66
39990 - 2 2 6 2 2 6 2 2 6 6 6 6
39991 - 70 70 70 170 170 170 206 206 206 234 234 234
39992 -246 246 246 250 250 250 250 250 250 238 238 238
39993 -226 226 226 231 231 231 238 238 238 250 250 250
39994 -250 250 250 250 250 250 246 246 246 231 231 231
39995 -214 214 214 206 206 206 202 202 202 202 202 202
39996 -198 198 198 202 202 202 182 182 182 18 18 18
39997 - 2 2 6 2 2 6 2 2 6 2 2 6
39998 - 2 2 6 2 2 6 2 2 6 2 2 6
39999 - 2 2 6 62 62 62 66 66 66 30 30 30
40000 - 10 10 10 0 0 0 0 0 0 0 0 0
40001 - 0 0 0 0 0 0 0 0 0 0 0 0
40002 - 0 0 0 0 0 0 0 0 0 0 0 0
40003 - 0 0 0 0 0 0 0 0 0 0 0 0
40004 - 0 0 0 0 0 0 0 0 0 0 0 0
40005 - 0 0 0 0 0 0 0 0 0 0 0 0
40006 - 0 0 0 0 0 0 0 0 0 0 0 0
40007 - 0 0 0 0 0 0 0 0 0 0 0 0
40008 - 0 0 0 0 0 0 0 0 0 0 0 0
40009 - 14 14 14 42 42 42 82 82 82 18 18 18
40010 - 2 2 6 2 2 6 2 2 6 10 10 10
40011 - 94 94 94 182 182 182 218 218 218 242 242 242
40012 -250 250 250 253 253 253 253 253 253 250 250 250
40013 -234 234 234 253 253 253 253 253 253 253 253 253
40014 -253 253 253 253 253 253 253 253 253 246 246 246
40015 -238 238 238 226 226 226 210 210 210 202 202 202
40016 -195 195 195 195 195 195 210 210 210 158 158 158
40017 - 6 6 6 14 14 14 50 50 50 14 14 14
40018 - 2 2 6 2 2 6 2 2 6 2 2 6
40019 - 2 2 6 6 6 6 86 86 86 46 46 46
40020 - 18 18 18 6 6 6 0 0 0 0 0 0
40021 - 0 0 0 0 0 0 0 0 0 0 0 0
40022 - 0 0 0 0 0 0 0 0 0 0 0 0
40023 - 0 0 0 0 0 0 0 0 0 0 0 0
40024 - 0 0 0 0 0 0 0 0 0 0 0 0
40025 - 0 0 0 0 0 0 0 0 0 0 0 0
40026 - 0 0 0 0 0 0 0 0 0 0 0 0
40027 - 0 0 0 0 0 0 0 0 0 0 0 0
40028 - 0 0 0 0 0 0 0 0 0 6 6 6
40029 - 22 22 22 54 54 54 70 70 70 2 2 6
40030 - 2 2 6 10 10 10 2 2 6 22 22 22
40031 -166 166 166 231 231 231 250 250 250 253 253 253
40032 -253 253 253 253 253 253 253 253 253 250 250 250
40033 -242 242 242 253 253 253 253 253 253 253 253 253
40034 -253 253 253 253 253 253 253 253 253 253 253 253
40035 -253 253 253 253 253 253 253 253 253 246 246 246
40036 -231 231 231 206 206 206 198 198 198 226 226 226
40037 - 94 94 94 2 2 6 6 6 6 38 38 38
40038 - 30 30 30 2 2 6 2 2 6 2 2 6
40039 - 2 2 6 2 2 6 62 62 62 66 66 66
40040 - 26 26 26 10 10 10 0 0 0 0 0 0
40041 - 0 0 0 0 0 0 0 0 0 0 0 0
40042 - 0 0 0 0 0 0 0 0 0 0 0 0
40043 - 0 0 0 0 0 0 0 0 0 0 0 0
40044 - 0 0 0 0 0 0 0 0 0 0 0 0
40045 - 0 0 0 0 0 0 0 0 0 0 0 0
40046 - 0 0 0 0 0 0 0 0 0 0 0 0
40047 - 0 0 0 0 0 0 0 0 0 0 0 0
40048 - 0 0 0 0 0 0 0 0 0 10 10 10
40049 - 30 30 30 74 74 74 50 50 50 2 2 6
40050 - 26 26 26 26 26 26 2 2 6 106 106 106
40051 -238 238 238 253 253 253 253 253 253 253 253 253
40052 -253 253 253 253 253 253 253 253 253 253 253 253
40053 -253 253 253 253 253 253 253 253 253 253 253 253
40054 -253 253 253 253 253 253 253 253 253 253 253 253
40055 -253 253 253 253 253 253 253 253 253 253 253 253
40056 -253 253 253 246 246 246 218 218 218 202 202 202
40057 -210 210 210 14 14 14 2 2 6 2 2 6
40058 - 30 30 30 22 22 22 2 2 6 2 2 6
40059 - 2 2 6 2 2 6 18 18 18 86 86 86
40060 - 42 42 42 14 14 14 0 0 0 0 0 0
40061 - 0 0 0 0 0 0 0 0 0 0 0 0
40062 - 0 0 0 0 0 0 0 0 0 0 0 0
40063 - 0 0 0 0 0 0 0 0 0 0 0 0
40064 - 0 0 0 0 0 0 0 0 0 0 0 0
40065 - 0 0 0 0 0 0 0 0 0 0 0 0
40066 - 0 0 0 0 0 0 0 0 0 0 0 0
40067 - 0 0 0 0 0 0 0 0 0 0 0 0
40068 - 0 0 0 0 0 0 0 0 0 14 14 14
40069 - 42 42 42 90 90 90 22 22 22 2 2 6
40070 - 42 42 42 2 2 6 18 18 18 218 218 218
40071 -253 253 253 253 253 253 253 253 253 253 253 253
40072 -253 253 253 253 253 253 253 253 253 253 253 253
40073 -253 253 253 253 253 253 253 253 253 253 253 253
40074 -253 253 253 253 253 253 253 253 253 253 253 253
40075 -253 253 253 253 253 253 253 253 253 253 253 253
40076 -253 253 253 253 253 253 250 250 250 221 221 221
40077 -218 218 218 101 101 101 2 2 6 14 14 14
40078 - 18 18 18 38 38 38 10 10 10 2 2 6
40079 - 2 2 6 2 2 6 2 2 6 78 78 78
40080 - 58 58 58 22 22 22 6 6 6 0 0 0
40081 - 0 0 0 0 0 0 0 0 0 0 0 0
40082 - 0 0 0 0 0 0 0 0 0 0 0 0
40083 - 0 0 0 0 0 0 0 0 0 0 0 0
40084 - 0 0 0 0 0 0 0 0 0 0 0 0
40085 - 0 0 0 0 0 0 0 0 0 0 0 0
40086 - 0 0 0 0 0 0 0 0 0 0 0 0
40087 - 0 0 0 0 0 0 0 0 0 0 0 0
40088 - 0 0 0 0 0 0 6 6 6 18 18 18
40089 - 54 54 54 82 82 82 2 2 6 26 26 26
40090 - 22 22 22 2 2 6 123 123 123 253 253 253
40091 -253 253 253 253 253 253 253 253 253 253 253 253
40092 -253 253 253 253 253 253 253 253 253 253 253 253
40093 -253 253 253 253 253 253 253 253 253 253 253 253
40094 -253 253 253 253 253 253 253 253 253 253 253 253
40095 -253 253 253 253 253 253 253 253 253 253 253 253
40096 -253 253 253 253 253 253 253 253 253 250 250 250
40097 -238 238 238 198 198 198 6 6 6 38 38 38
40098 - 58 58 58 26 26 26 38 38 38 2 2 6
40099 - 2 2 6 2 2 6 2 2 6 46 46 46
40100 - 78 78 78 30 30 30 10 10 10 0 0 0
40101 - 0 0 0 0 0 0 0 0 0 0 0 0
40102 - 0 0 0 0 0 0 0 0 0 0 0 0
40103 - 0 0 0 0 0 0 0 0 0 0 0 0
40104 - 0 0 0 0 0 0 0 0 0 0 0 0
40105 - 0 0 0 0 0 0 0 0 0 0 0 0
40106 - 0 0 0 0 0 0 0 0 0 0 0 0
40107 - 0 0 0 0 0 0 0 0 0 0 0 0
40108 - 0 0 0 0 0 0 10 10 10 30 30 30
40109 - 74 74 74 58 58 58 2 2 6 42 42 42
40110 - 2 2 6 22 22 22 231 231 231 253 253 253
40111 -253 253 253 253 253 253 253 253 253 253 253 253
40112 -253 253 253 253 253 253 253 253 253 250 250 250
40113 -253 253 253 253 253 253 253 253 253 253 253 253
40114 -253 253 253 253 253 253 253 253 253 253 253 253
40115 -253 253 253 253 253 253 253 253 253 253 253 253
40116 -253 253 253 253 253 253 253 253 253 253 253 253
40117 -253 253 253 246 246 246 46 46 46 38 38 38
40118 - 42 42 42 14 14 14 38 38 38 14 14 14
40119 - 2 2 6 2 2 6 2 2 6 6 6 6
40120 - 86 86 86 46 46 46 14 14 14 0 0 0
40121 - 0 0 0 0 0 0 0 0 0 0 0 0
40122 - 0 0 0 0 0 0 0 0 0 0 0 0
40123 - 0 0 0 0 0 0 0 0 0 0 0 0
40124 - 0 0 0 0 0 0 0 0 0 0 0 0
40125 - 0 0 0 0 0 0 0 0 0 0 0 0
40126 - 0 0 0 0 0 0 0 0 0 0 0 0
40127 - 0 0 0 0 0 0 0 0 0 0 0 0
40128 - 0 0 0 6 6 6 14 14 14 42 42 42
40129 - 90 90 90 18 18 18 18 18 18 26 26 26
40130 - 2 2 6 116 116 116 253 253 253 253 253 253
40131 -253 253 253 253 253 253 253 253 253 253 253 253
40132 -253 253 253 253 253 253 250 250 250 238 238 238
40133 -253 253 253 253 253 253 253 253 253 253 253 253
40134 -253 253 253 253 253 253 253 253 253 253 253 253
40135 -253 253 253 253 253 253 253 253 253 253 253 253
40136 -253 253 253 253 253 253 253 253 253 253 253 253
40137 -253 253 253 253 253 253 94 94 94 6 6 6
40138 - 2 2 6 2 2 6 10 10 10 34 34 34
40139 - 2 2 6 2 2 6 2 2 6 2 2 6
40140 - 74 74 74 58 58 58 22 22 22 6 6 6
40141 - 0 0 0 0 0 0 0 0 0 0 0 0
40142 - 0 0 0 0 0 0 0 0 0 0 0 0
40143 - 0 0 0 0 0 0 0 0 0 0 0 0
40144 - 0 0 0 0 0 0 0 0 0 0 0 0
40145 - 0 0 0 0 0 0 0 0 0 0 0 0
40146 - 0 0 0 0 0 0 0 0 0 0 0 0
40147 - 0 0 0 0 0 0 0 0 0 0 0 0
40148 - 0 0 0 10 10 10 26 26 26 66 66 66
40149 - 82 82 82 2 2 6 38 38 38 6 6 6
40150 - 14 14 14 210 210 210 253 253 253 253 253 253
40151 -253 253 253 253 253 253 253 253 253 253 253 253
40152 -253 253 253 253 253 253 246 246 246 242 242 242
40153 -253 253 253 253 253 253 253 253 253 253 253 253
40154 -253 253 253 253 253 253 253 253 253 253 253 253
40155 -253 253 253 253 253 253 253 253 253 253 253 253
40156 -253 253 253 253 253 253 253 253 253 253 253 253
40157 -253 253 253 253 253 253 144 144 144 2 2 6
40158 - 2 2 6 2 2 6 2 2 6 46 46 46
40159 - 2 2 6 2 2 6 2 2 6 2 2 6
40160 - 42 42 42 74 74 74 30 30 30 10 10 10
40161 - 0 0 0 0 0 0 0 0 0 0 0 0
40162 - 0 0 0 0 0 0 0 0 0 0 0 0
40163 - 0 0 0 0 0 0 0 0 0 0 0 0
40164 - 0 0 0 0 0 0 0 0 0 0 0 0
40165 - 0 0 0 0 0 0 0 0 0 0 0 0
40166 - 0 0 0 0 0 0 0 0 0 0 0 0
40167 - 0 0 0 0 0 0 0 0 0 0 0 0
40168 - 6 6 6 14 14 14 42 42 42 90 90 90
40169 - 26 26 26 6 6 6 42 42 42 2 2 6
40170 - 74 74 74 250 250 250 253 253 253 253 253 253
40171 -253 253 253 253 253 253 253 253 253 253 253 253
40172 -253 253 253 253 253 253 242 242 242 242 242 242
40173 -253 253 253 253 253 253 253 253 253 253 253 253
40174 -253 253 253 253 253 253 253 253 253 253 253 253
40175 -253 253 253 253 253 253 253 253 253 253 253 253
40176 -253 253 253 253 253 253 253 253 253 253 253 253
40177 -253 253 253 253 253 253 182 182 182 2 2 6
40178 - 2 2 6 2 2 6 2 2 6 46 46 46
40179 - 2 2 6 2 2 6 2 2 6 2 2 6
40180 - 10 10 10 86 86 86 38 38 38 10 10 10
40181 - 0 0 0 0 0 0 0 0 0 0 0 0
40182 - 0 0 0 0 0 0 0 0 0 0 0 0
40183 - 0 0 0 0 0 0 0 0 0 0 0 0
40184 - 0 0 0 0 0 0 0 0 0 0 0 0
40185 - 0 0 0 0 0 0 0 0 0 0 0 0
40186 - 0 0 0 0 0 0 0 0 0 0 0 0
40187 - 0 0 0 0 0 0 0 0 0 0 0 0
40188 - 10 10 10 26 26 26 66 66 66 82 82 82
40189 - 2 2 6 22 22 22 18 18 18 2 2 6
40190 -149 149 149 253 253 253 253 253 253 253 253 253
40191 -253 253 253 253 253 253 253 253 253 253 253 253
40192 -253 253 253 253 253 253 234 234 234 242 242 242
40193 -253 253 253 253 253 253 253 253 253 253 253 253
40194 -253 253 253 253 253 253 253 253 253 253 253 253
40195 -253 253 253 253 253 253 253 253 253 253 253 253
40196 -253 253 253 253 253 253 253 253 253 253 253 253
40197 -253 253 253 253 253 253 206 206 206 2 2 6
40198 - 2 2 6 2 2 6 2 2 6 38 38 38
40199 - 2 2 6 2 2 6 2 2 6 2 2 6
40200 - 6 6 6 86 86 86 46 46 46 14 14 14
40201 - 0 0 0 0 0 0 0 0 0 0 0 0
40202 - 0 0 0 0 0 0 0 0 0 0 0 0
40203 - 0 0 0 0 0 0 0 0 0 0 0 0
40204 - 0 0 0 0 0 0 0 0 0 0 0 0
40205 - 0 0 0 0 0 0 0 0 0 0 0 0
40206 - 0 0 0 0 0 0 0 0 0 0 0 0
40207 - 0 0 0 0 0 0 0 0 0 6 6 6
40208 - 18 18 18 46 46 46 86 86 86 18 18 18
40209 - 2 2 6 34 34 34 10 10 10 6 6 6
40210 -210 210 210 253 253 253 253 253 253 253 253 253
40211 -253 253 253 253 253 253 253 253 253 253 253 253
40212 -253 253 253 253 253 253 234 234 234 242 242 242
40213 -253 253 253 253 253 253 253 253 253 253 253 253
40214 -253 253 253 253 253 253 253 253 253 253 253 253
40215 -253 253 253 253 253 253 253 253 253 253 253 253
40216 -253 253 253 253 253 253 253 253 253 253 253 253
40217 -253 253 253 253 253 253 221 221 221 6 6 6
40218 - 2 2 6 2 2 6 6 6 6 30 30 30
40219 - 2 2 6 2 2 6 2 2 6 2 2 6
40220 - 2 2 6 82 82 82 54 54 54 18 18 18
40221 - 6 6 6 0 0 0 0 0 0 0 0 0
40222 - 0 0 0 0 0 0 0 0 0 0 0 0
40223 - 0 0 0 0 0 0 0 0 0 0 0 0
40224 - 0 0 0 0 0 0 0 0 0 0 0 0
40225 - 0 0 0 0 0 0 0 0 0 0 0 0
40226 - 0 0 0 0 0 0 0 0 0 0 0 0
40227 - 0 0 0 0 0 0 0 0 0 10 10 10
40228 - 26 26 26 66 66 66 62 62 62 2 2 6
40229 - 2 2 6 38 38 38 10 10 10 26 26 26
40230 -238 238 238 253 253 253 253 253 253 253 253 253
40231 -253 253 253 253 253 253 253 253 253 253 253 253
40232 -253 253 253 253 253 253 231 231 231 238 238 238
40233 -253 253 253 253 253 253 253 253 253 253 253 253
40234 -253 253 253 253 253 253 253 253 253 253 253 253
40235 -253 253 253 253 253 253 253 253 253 253 253 253
40236 -253 253 253 253 253 253 253 253 253 253 253 253
40237 -253 253 253 253 253 253 231 231 231 6 6 6
40238 - 2 2 6 2 2 6 10 10 10 30 30 30
40239 - 2 2 6 2 2 6 2 2 6 2 2 6
40240 - 2 2 6 66 66 66 58 58 58 22 22 22
40241 - 6 6 6 0 0 0 0 0 0 0 0 0
40242 - 0 0 0 0 0 0 0 0 0 0 0 0
40243 - 0 0 0 0 0 0 0 0 0 0 0 0
40244 - 0 0 0 0 0 0 0 0 0 0 0 0
40245 - 0 0 0 0 0 0 0 0 0 0 0 0
40246 - 0 0 0 0 0 0 0 0 0 0 0 0
40247 - 0 0 0 0 0 0 0 0 0 10 10 10
40248 - 38 38 38 78 78 78 6 6 6 2 2 6
40249 - 2 2 6 46 46 46 14 14 14 42 42 42
40250 -246 246 246 253 253 253 253 253 253 253 253 253
40251 -253 253 253 253 253 253 253 253 253 253 253 253
40252 -253 253 253 253 253 253 231 231 231 242 242 242
40253 -253 253 253 253 253 253 253 253 253 253 253 253
40254 -253 253 253 253 253 253 253 253 253 253 253 253
40255 -253 253 253 253 253 253 253 253 253 253 253 253
40256 -253 253 253 253 253 253 253 253 253 253 253 253
40257 -253 253 253 253 253 253 234 234 234 10 10 10
40258 - 2 2 6 2 2 6 22 22 22 14 14 14
40259 - 2 2 6 2 2 6 2 2 6 2 2 6
40260 - 2 2 6 66 66 66 62 62 62 22 22 22
40261 - 6 6 6 0 0 0 0 0 0 0 0 0
40262 - 0 0 0 0 0 0 0 0 0 0 0 0
40263 - 0 0 0 0 0 0 0 0 0 0 0 0
40264 - 0 0 0 0 0 0 0 0 0 0 0 0
40265 - 0 0 0 0 0 0 0 0 0 0 0 0
40266 - 0 0 0 0 0 0 0 0 0 0 0 0
40267 - 0 0 0 0 0 0 6 6 6 18 18 18
40268 - 50 50 50 74 74 74 2 2 6 2 2 6
40269 - 14 14 14 70 70 70 34 34 34 62 62 62
40270 -250 250 250 253 253 253 253 253 253 253 253 253
40271 -253 253 253 253 253 253 253 253 253 253 253 253
40272 -253 253 253 253 253 253 231 231 231 246 246 246
40273 -253 253 253 253 253 253 253 253 253 253 253 253
40274 -253 253 253 253 253 253 253 253 253 253 253 253
40275 -253 253 253 253 253 253 253 253 253 253 253 253
40276 -253 253 253 253 253 253 253 253 253 253 253 253
40277 -253 253 253 253 253 253 234 234 234 14 14 14
40278 - 2 2 6 2 2 6 30 30 30 2 2 6
40279 - 2 2 6 2 2 6 2 2 6 2 2 6
40280 - 2 2 6 66 66 66 62 62 62 22 22 22
40281 - 6 6 6 0 0 0 0 0 0 0 0 0
40282 - 0 0 0 0 0 0 0 0 0 0 0 0
40283 - 0 0 0 0 0 0 0 0 0 0 0 0
40284 - 0 0 0 0 0 0 0 0 0 0 0 0
40285 - 0 0 0 0 0 0 0 0 0 0 0 0
40286 - 0 0 0 0 0 0 0 0 0 0 0 0
40287 - 0 0 0 0 0 0 6 6 6 18 18 18
40288 - 54 54 54 62 62 62 2 2 6 2 2 6
40289 - 2 2 6 30 30 30 46 46 46 70 70 70
40290 -250 250 250 253 253 253 253 253 253 253 253 253
40291 -253 253 253 253 253 253 253 253 253 253 253 253
40292 -253 253 253 253 253 253 231 231 231 246 246 246
40293 -253 253 253 253 253 253 253 253 253 253 253 253
40294 -253 253 253 253 253 253 253 253 253 253 253 253
40295 -253 253 253 253 253 253 253 253 253 253 253 253
40296 -253 253 253 253 253 253 253 253 253 253 253 253
40297 -253 253 253 253 253 253 226 226 226 10 10 10
40298 - 2 2 6 6 6 6 30 30 30 2 2 6
40299 - 2 2 6 2 2 6 2 2 6 2 2 6
40300 - 2 2 6 66 66 66 58 58 58 22 22 22
40301 - 6 6 6 0 0 0 0 0 0 0 0 0
40302 - 0 0 0 0 0 0 0 0 0 0 0 0
40303 - 0 0 0 0 0 0 0 0 0 0 0 0
40304 - 0 0 0 0 0 0 0 0 0 0 0 0
40305 - 0 0 0 0 0 0 0 0 0 0 0 0
40306 - 0 0 0 0 0 0 0 0 0 0 0 0
40307 - 0 0 0 0 0 0 6 6 6 22 22 22
40308 - 58 58 58 62 62 62 2 2 6 2 2 6
40309 - 2 2 6 2 2 6 30 30 30 78 78 78
40310 -250 250 250 253 253 253 253 253 253 253 253 253
40311 -253 253 253 253 253 253 253 253 253 253 253 253
40312 -253 253 253 253 253 253 231 231 231 246 246 246
40313 -253 253 253 253 253 253 253 253 253 253 253 253
40314 -253 253 253 253 253 253 253 253 253 253 253 253
40315 -253 253 253 253 253 253 253 253 253 253 253 253
40316 -253 253 253 253 253 253 253 253 253 253 253 253
40317 -253 253 253 253 253 253 206 206 206 2 2 6
40318 - 22 22 22 34 34 34 18 14 6 22 22 22
40319 - 26 26 26 18 18 18 6 6 6 2 2 6
40320 - 2 2 6 82 82 82 54 54 54 18 18 18
40321 - 6 6 6 0 0 0 0 0 0 0 0 0
40322 - 0 0 0 0 0 0 0 0 0 0 0 0
40323 - 0 0 0 0 0 0 0 0 0 0 0 0
40324 - 0 0 0 0 0 0 0 0 0 0 0 0
40325 - 0 0 0 0 0 0 0 0 0 0 0 0
40326 - 0 0 0 0 0 0 0 0 0 0 0 0
40327 - 0 0 0 0 0 0 6 6 6 26 26 26
40328 - 62 62 62 106 106 106 74 54 14 185 133 11
40329 -210 162 10 121 92 8 6 6 6 62 62 62
40330 -238 238 238 253 253 253 253 253 253 253 253 253
40331 -253 253 253 253 253 253 253 253 253 253 253 253
40332 -253 253 253 253 253 253 231 231 231 246 246 246
40333 -253 253 253 253 253 253 253 253 253 253 253 253
40334 -253 253 253 253 253 253 253 253 253 253 253 253
40335 -253 253 253 253 253 253 253 253 253 253 253 253
40336 -253 253 253 253 253 253 253 253 253 253 253 253
40337 -253 253 253 253 253 253 158 158 158 18 18 18
40338 - 14 14 14 2 2 6 2 2 6 2 2 6
40339 - 6 6 6 18 18 18 66 66 66 38 38 38
40340 - 6 6 6 94 94 94 50 50 50 18 18 18
40341 - 6 6 6 0 0 0 0 0 0 0 0 0
40342 - 0 0 0 0 0 0 0 0 0 0 0 0
40343 - 0 0 0 0 0 0 0 0 0 0 0 0
40344 - 0 0 0 0 0 0 0 0 0 0 0 0
40345 - 0 0 0 0 0 0 0 0 0 0 0 0
40346 - 0 0 0 0 0 0 0 0 0 6 6 6
40347 - 10 10 10 10 10 10 18 18 18 38 38 38
40348 - 78 78 78 142 134 106 216 158 10 242 186 14
40349 -246 190 14 246 190 14 156 118 10 10 10 10
40350 - 90 90 90 238 238 238 253 253 253 253 253 253
40351 -253 253 253 253 253 253 253 253 253 253 253 253
40352 -253 253 253 253 253 253 231 231 231 250 250 250
40353 -253 253 253 253 253 253 253 253 253 253 253 253
40354 -253 253 253 253 253 253 253 253 253 253 253 253
40355 -253 253 253 253 253 253 253 253 253 253 253 253
40356 -253 253 253 253 253 253 253 253 253 246 230 190
40357 -238 204 91 238 204 91 181 142 44 37 26 9
40358 - 2 2 6 2 2 6 2 2 6 2 2 6
40359 - 2 2 6 2 2 6 38 38 38 46 46 46
40360 - 26 26 26 106 106 106 54 54 54 18 18 18
40361 - 6 6 6 0 0 0 0 0 0 0 0 0
40362 - 0 0 0 0 0 0 0 0 0 0 0 0
40363 - 0 0 0 0 0 0 0 0 0 0 0 0
40364 - 0 0 0 0 0 0 0 0 0 0 0 0
40365 - 0 0 0 0 0 0 0 0 0 0 0 0
40366 - 0 0 0 6 6 6 14 14 14 22 22 22
40367 - 30 30 30 38 38 38 50 50 50 70 70 70
40368 -106 106 106 190 142 34 226 170 11 242 186 14
40369 -246 190 14 246 190 14 246 190 14 154 114 10
40370 - 6 6 6 74 74 74 226 226 226 253 253 253
40371 -253 253 253 253 253 253 253 253 253 253 253 253
40372 -253 253 253 253 253 253 231 231 231 250 250 250
40373 -253 253 253 253 253 253 253 253 253 253 253 253
40374 -253 253 253 253 253 253 253 253 253 253 253 253
40375 -253 253 253 253 253 253 253 253 253 253 253 253
40376 -253 253 253 253 253 253 253 253 253 228 184 62
40377 -241 196 14 241 208 19 232 195 16 38 30 10
40378 - 2 2 6 2 2 6 2 2 6 2 2 6
40379 - 2 2 6 6 6 6 30 30 30 26 26 26
40380 -203 166 17 154 142 90 66 66 66 26 26 26
40381 - 6 6 6 0 0 0 0 0 0 0 0 0
40382 - 0 0 0 0 0 0 0 0 0 0 0 0
40383 - 0 0 0 0 0 0 0 0 0 0 0 0
40384 - 0 0 0 0 0 0 0 0 0 0 0 0
40385 - 0 0 0 0 0 0 0 0 0 0 0 0
40386 - 6 6 6 18 18 18 38 38 38 58 58 58
40387 - 78 78 78 86 86 86 101 101 101 123 123 123
40388 -175 146 61 210 150 10 234 174 13 246 186 14
40389 -246 190 14 246 190 14 246 190 14 238 190 10
40390 -102 78 10 2 2 6 46 46 46 198 198 198
40391 -253 253 253 253 253 253 253 253 253 253 253 253
40392 -253 253 253 253 253 253 234 234 234 242 242 242
40393 -253 253 253 253 253 253 253 253 253 253 253 253
40394 -253 253 253 253 253 253 253 253 253 253 253 253
40395 -253 253 253 253 253 253 253 253 253 253 253 253
40396 -253 253 253 253 253 253 253 253 253 224 178 62
40397 -242 186 14 241 196 14 210 166 10 22 18 6
40398 - 2 2 6 2 2 6 2 2 6 2 2 6
40399 - 2 2 6 2 2 6 6 6 6 121 92 8
40400 -238 202 15 232 195 16 82 82 82 34 34 34
40401 - 10 10 10 0 0 0 0 0 0 0 0 0
40402 - 0 0 0 0 0 0 0 0 0 0 0 0
40403 - 0 0 0 0 0 0 0 0 0 0 0 0
40404 - 0 0 0 0 0 0 0 0 0 0 0 0
40405 - 0 0 0 0 0 0 0 0 0 0 0 0
40406 - 14 14 14 38 38 38 70 70 70 154 122 46
40407 -190 142 34 200 144 11 197 138 11 197 138 11
40408 -213 154 11 226 170 11 242 186 14 246 190 14
40409 -246 190 14 246 190 14 246 190 14 246 190 14
40410 -225 175 15 46 32 6 2 2 6 22 22 22
40411 -158 158 158 250 250 250 253 253 253 253 253 253
40412 -253 253 253 253 253 253 253 253 253 253 253 253
40413 -253 253 253 253 253 253 253 253 253 253 253 253
40414 -253 253 253 253 253 253 253 253 253 253 253 253
40415 -253 253 253 253 253 253 253 253 253 253 253 253
40416 -253 253 253 250 250 250 242 242 242 224 178 62
40417 -239 182 13 236 186 11 213 154 11 46 32 6
40418 - 2 2 6 2 2 6 2 2 6 2 2 6
40419 - 2 2 6 2 2 6 61 42 6 225 175 15
40420 -238 190 10 236 186 11 112 100 78 42 42 42
40421 - 14 14 14 0 0 0 0 0 0 0 0 0
40422 - 0 0 0 0 0 0 0 0 0 0 0 0
40423 - 0 0 0 0 0 0 0 0 0 0 0 0
40424 - 0 0 0 0 0 0 0 0 0 0 0 0
40425 - 0 0 0 0 0 0 0 0 0 6 6 6
40426 - 22 22 22 54 54 54 154 122 46 213 154 11
40427 -226 170 11 230 174 11 226 170 11 226 170 11
40428 -236 178 12 242 186 14 246 190 14 246 190 14
40429 -246 190 14 246 190 14 246 190 14 246 190 14
40430 -241 196 14 184 144 12 10 10 10 2 2 6
40431 - 6 6 6 116 116 116 242 242 242 253 253 253
40432 -253 253 253 253 253 253 253 253 253 253 253 253
40433 -253 253 253 253 253 253 253 253 253 253 253 253
40434 -253 253 253 253 253 253 253 253 253 253 253 253
40435 -253 253 253 253 253 253 253 253 253 253 253 253
40436 -253 253 253 231 231 231 198 198 198 214 170 54
40437 -236 178 12 236 178 12 210 150 10 137 92 6
40438 - 18 14 6 2 2 6 2 2 6 2 2 6
40439 - 6 6 6 70 47 6 200 144 11 236 178 12
40440 -239 182 13 239 182 13 124 112 88 58 58 58
40441 - 22 22 22 6 6 6 0 0 0 0 0 0
40442 - 0 0 0 0 0 0 0 0 0 0 0 0
40443 - 0 0 0 0 0 0 0 0 0 0 0 0
40444 - 0 0 0 0 0 0 0 0 0 0 0 0
40445 - 0 0 0 0 0 0 0 0 0 10 10 10
40446 - 30 30 30 70 70 70 180 133 36 226 170 11
40447 -239 182 13 242 186 14 242 186 14 246 186 14
40448 -246 190 14 246 190 14 246 190 14 246 190 14
40449 -246 190 14 246 190 14 246 190 14 246 190 14
40450 -246 190 14 232 195 16 98 70 6 2 2 6
40451 - 2 2 6 2 2 6 66 66 66 221 221 221
40452 -253 253 253 253 253 253 253 253 253 253 253 253
40453 -253 253 253 253 253 253 253 253 253 253 253 253
40454 -253 253 253 253 253 253 253 253 253 253 253 253
40455 -253 253 253 253 253 253 253 253 253 253 253 253
40456 -253 253 253 206 206 206 198 198 198 214 166 58
40457 -230 174 11 230 174 11 216 158 10 192 133 9
40458 -163 110 8 116 81 8 102 78 10 116 81 8
40459 -167 114 7 197 138 11 226 170 11 239 182 13
40460 -242 186 14 242 186 14 162 146 94 78 78 78
40461 - 34 34 34 14 14 14 6 6 6 0 0 0
40462 - 0 0 0 0 0 0 0 0 0 0 0 0
40463 - 0 0 0 0 0 0 0 0 0 0 0 0
40464 - 0 0 0 0 0 0 0 0 0 0 0 0
40465 - 0 0 0 0 0 0 0 0 0 6 6 6
40466 - 30 30 30 78 78 78 190 142 34 226 170 11
40467 -239 182 13 246 190 14 246 190 14 246 190 14
40468 -246 190 14 246 190 14 246 190 14 246 190 14
40469 -246 190 14 246 190 14 246 190 14 246 190 14
40470 -246 190 14 241 196 14 203 166 17 22 18 6
40471 - 2 2 6 2 2 6 2 2 6 38 38 38
40472 -218 218 218 253 253 253 253 253 253 253 253 253
40473 -253 253 253 253 253 253 253 253 253 253 253 253
40474 -253 253 253 253 253 253 253 253 253 253 253 253
40475 -253 253 253 253 253 253 253 253 253 253 253 253
40476 -250 250 250 206 206 206 198 198 198 202 162 69
40477 -226 170 11 236 178 12 224 166 10 210 150 10
40478 -200 144 11 197 138 11 192 133 9 197 138 11
40479 -210 150 10 226 170 11 242 186 14 246 190 14
40480 -246 190 14 246 186 14 225 175 15 124 112 88
40481 - 62 62 62 30 30 30 14 14 14 6 6 6
40482 - 0 0 0 0 0 0 0 0 0 0 0 0
40483 - 0 0 0 0 0 0 0 0 0 0 0 0
40484 - 0 0 0 0 0 0 0 0 0 0 0 0
40485 - 0 0 0 0 0 0 0 0 0 10 10 10
40486 - 30 30 30 78 78 78 174 135 50 224 166 10
40487 -239 182 13 246 190 14 246 190 14 246 190 14
40488 -246 190 14 246 190 14 246 190 14 246 190 14
40489 -246 190 14 246 190 14 246 190 14 246 190 14
40490 -246 190 14 246 190 14 241 196 14 139 102 15
40491 - 2 2 6 2 2 6 2 2 6 2 2 6
40492 - 78 78 78 250 250 250 253 253 253 253 253 253
40493 -253 253 253 253 253 253 253 253 253 253 253 253
40494 -253 253 253 253 253 253 253 253 253 253 253 253
40495 -253 253 253 253 253 253 253 253 253 253 253 253
40496 -250 250 250 214 214 214 198 198 198 190 150 46
40497 -219 162 10 236 178 12 234 174 13 224 166 10
40498 -216 158 10 213 154 11 213 154 11 216 158 10
40499 -226 170 11 239 182 13 246 190 14 246 190 14
40500 -246 190 14 246 190 14 242 186 14 206 162 42
40501 -101 101 101 58 58 58 30 30 30 14 14 14
40502 - 6 6 6 0 0 0 0 0 0 0 0 0
40503 - 0 0 0 0 0 0 0 0 0 0 0 0
40504 - 0 0 0 0 0 0 0 0 0 0 0 0
40505 - 0 0 0 0 0 0 0 0 0 10 10 10
40506 - 30 30 30 74 74 74 174 135 50 216 158 10
40507 -236 178 12 246 190 14 246 190 14 246 190 14
40508 -246 190 14 246 190 14 246 190 14 246 190 14
40509 -246 190 14 246 190 14 246 190 14 246 190 14
40510 -246 190 14 246 190 14 241 196 14 226 184 13
40511 - 61 42 6 2 2 6 2 2 6 2 2 6
40512 - 22 22 22 238 238 238 253 253 253 253 253 253
40513 -253 253 253 253 253 253 253 253 253 253 253 253
40514 -253 253 253 253 253 253 253 253 253 253 253 253
40515 -253 253 253 253 253 253 253 253 253 253 253 253
40516 -253 253 253 226 226 226 187 187 187 180 133 36
40517 -216 158 10 236 178 12 239 182 13 236 178 12
40518 -230 174 11 226 170 11 226 170 11 230 174 11
40519 -236 178 12 242 186 14 246 190 14 246 190 14
40520 -246 190 14 246 190 14 246 186 14 239 182 13
40521 -206 162 42 106 106 106 66 66 66 34 34 34
40522 - 14 14 14 6 6 6 0 0 0 0 0 0
40523 - 0 0 0 0 0 0 0 0 0 0 0 0
40524 - 0 0 0 0 0 0 0 0 0 0 0 0
40525 - 0 0 0 0 0 0 0 0 0 6 6 6
40526 - 26 26 26 70 70 70 163 133 67 213 154 11
40527 -236 178 12 246 190 14 246 190 14 246 190 14
40528 -246 190 14 246 190 14 246 190 14 246 190 14
40529 -246 190 14 246 190 14 246 190 14 246 190 14
40530 -246 190 14 246 190 14 246 190 14 241 196 14
40531 -190 146 13 18 14 6 2 2 6 2 2 6
40532 - 46 46 46 246 246 246 253 253 253 253 253 253
40533 -253 253 253 253 253 253 253 253 253 253 253 253
40534 -253 253 253 253 253 253 253 253 253 253 253 253
40535 -253 253 253 253 253 253 253 253 253 253 253 253
40536 -253 253 253 221 221 221 86 86 86 156 107 11
40537 -216 158 10 236 178 12 242 186 14 246 186 14
40538 -242 186 14 239 182 13 239 182 13 242 186 14
40539 -242 186 14 246 186 14 246 190 14 246 190 14
40540 -246 190 14 246 190 14 246 190 14 246 190 14
40541 -242 186 14 225 175 15 142 122 72 66 66 66
40542 - 30 30 30 10 10 10 0 0 0 0 0 0
40543 - 0 0 0 0 0 0 0 0 0 0 0 0
40544 - 0 0 0 0 0 0 0 0 0 0 0 0
40545 - 0 0 0 0 0 0 0 0 0 6 6 6
40546 - 26 26 26 70 70 70 163 133 67 210 150 10
40547 -236 178 12 246 190 14 246 190 14 246 190 14
40548 -246 190 14 246 190 14 246 190 14 246 190 14
40549 -246 190 14 246 190 14 246 190 14 246 190 14
40550 -246 190 14 246 190 14 246 190 14 246 190 14
40551 -232 195 16 121 92 8 34 34 34 106 106 106
40552 -221 221 221 253 253 253 253 253 253 253 253 253
40553 -253 253 253 253 253 253 253 253 253 253 253 253
40554 -253 253 253 253 253 253 253 253 253 253 253 253
40555 -253 253 253 253 253 253 253 253 253 253 253 253
40556 -242 242 242 82 82 82 18 14 6 163 110 8
40557 -216 158 10 236 178 12 242 186 14 246 190 14
40558 -246 190 14 246 190 14 246 190 14 246 190 14
40559 -246 190 14 246 190 14 246 190 14 246 190 14
40560 -246 190 14 246 190 14 246 190 14 246 190 14
40561 -246 190 14 246 190 14 242 186 14 163 133 67
40562 - 46 46 46 18 18 18 6 6 6 0 0 0
40563 - 0 0 0 0 0 0 0 0 0 0 0 0
40564 - 0 0 0 0 0 0 0 0 0 0 0 0
40565 - 0 0 0 0 0 0 0 0 0 10 10 10
40566 - 30 30 30 78 78 78 163 133 67 210 150 10
40567 -236 178 12 246 186 14 246 190 14 246 190 14
40568 -246 190 14 246 190 14 246 190 14 246 190 14
40569 -246 190 14 246 190 14 246 190 14 246 190 14
40570 -246 190 14 246 190 14 246 190 14 246 190 14
40571 -241 196 14 215 174 15 190 178 144 253 253 253
40572 -253 253 253 253 253 253 253 253 253 253 253 253
40573 -253 253 253 253 253 253 253 253 253 253 253 253
40574 -253 253 253 253 253 253 253 253 253 253 253 253
40575 -253 253 253 253 253 253 253 253 253 218 218 218
40576 - 58 58 58 2 2 6 22 18 6 167 114 7
40577 -216 158 10 236 178 12 246 186 14 246 190 14
40578 -246 190 14 246 190 14 246 190 14 246 190 14
40579 -246 190 14 246 190 14 246 190 14 246 190 14
40580 -246 190 14 246 190 14 246 190 14 246 190 14
40581 -246 190 14 246 186 14 242 186 14 190 150 46
40582 - 54 54 54 22 22 22 6 6 6 0 0 0
40583 - 0 0 0 0 0 0 0 0 0 0 0 0
40584 - 0 0 0 0 0 0 0 0 0 0 0 0
40585 - 0 0 0 0 0 0 0 0 0 14 14 14
40586 - 38 38 38 86 86 86 180 133 36 213 154 11
40587 -236 178 12 246 186 14 246 190 14 246 190 14
40588 -246 190 14 246 190 14 246 190 14 246 190 14
40589 -246 190 14 246 190 14 246 190 14 246 190 14
40590 -246 190 14 246 190 14 246 190 14 246 190 14
40591 -246 190 14 232 195 16 190 146 13 214 214 214
40592 -253 253 253 253 253 253 253 253 253 253 253 253
40593 -253 253 253 253 253 253 253 253 253 253 253 253
40594 -253 253 253 253 253 253 253 253 253 253 253 253
40595 -253 253 253 250 250 250 170 170 170 26 26 26
40596 - 2 2 6 2 2 6 37 26 9 163 110 8
40597 -219 162 10 239 182 13 246 186 14 246 190 14
40598 -246 190 14 246 190 14 246 190 14 246 190 14
40599 -246 190 14 246 190 14 246 190 14 246 190 14
40600 -246 190 14 246 190 14 246 190 14 246 190 14
40601 -246 186 14 236 178 12 224 166 10 142 122 72
40602 - 46 46 46 18 18 18 6 6 6 0 0 0
40603 - 0 0 0 0 0 0 0 0 0 0 0 0
40604 - 0 0 0 0 0 0 0 0 0 0 0 0
40605 - 0 0 0 0 0 0 6 6 6 18 18 18
40606 - 50 50 50 109 106 95 192 133 9 224 166 10
40607 -242 186 14 246 190 14 246 190 14 246 190 14
40608 -246 190 14 246 190 14 246 190 14 246 190 14
40609 -246 190 14 246 190 14 246 190 14 246 190 14
40610 -246 190 14 246 190 14 246 190 14 246 190 14
40611 -242 186 14 226 184 13 210 162 10 142 110 46
40612 -226 226 226 253 253 253 253 253 253 253 253 253
40613 -253 253 253 253 253 253 253 253 253 253 253 253
40614 -253 253 253 253 253 253 253 253 253 253 253 253
40615 -198 198 198 66 66 66 2 2 6 2 2 6
40616 - 2 2 6 2 2 6 50 34 6 156 107 11
40617 -219 162 10 239 182 13 246 186 14 246 190 14
40618 -246 190 14 246 190 14 246 190 14 246 190 14
40619 -246 190 14 246 190 14 246 190 14 246 190 14
40620 -246 190 14 246 190 14 246 190 14 242 186 14
40621 -234 174 13 213 154 11 154 122 46 66 66 66
40622 - 30 30 30 10 10 10 0 0 0 0 0 0
40623 - 0 0 0 0 0 0 0 0 0 0 0 0
40624 - 0 0 0 0 0 0 0 0 0 0 0 0
40625 - 0 0 0 0 0 0 6 6 6 22 22 22
40626 - 58 58 58 154 121 60 206 145 10 234 174 13
40627 -242 186 14 246 186 14 246 190 14 246 190 14
40628 -246 190 14 246 190 14 246 190 14 246 190 14
40629 -246 190 14 246 190 14 246 190 14 246 190 14
40630 -246 190 14 246 190 14 246 190 14 246 190 14
40631 -246 186 14 236 178 12 210 162 10 163 110 8
40632 - 61 42 6 138 138 138 218 218 218 250 250 250
40633 -253 253 253 253 253 253 253 253 253 250 250 250
40634 -242 242 242 210 210 210 144 144 144 66 66 66
40635 - 6 6 6 2 2 6 2 2 6 2 2 6
40636 - 2 2 6 2 2 6 61 42 6 163 110 8
40637 -216 158 10 236 178 12 246 190 14 246 190 14
40638 -246 190 14 246 190 14 246 190 14 246 190 14
40639 -246 190 14 246 190 14 246 190 14 246 190 14
40640 -246 190 14 239 182 13 230 174 11 216 158 10
40641 -190 142 34 124 112 88 70 70 70 38 38 38
40642 - 18 18 18 6 6 6 0 0 0 0 0 0
40643 - 0 0 0 0 0 0 0 0 0 0 0 0
40644 - 0 0 0 0 0 0 0 0 0 0 0 0
40645 - 0 0 0 0 0 0 6 6 6 22 22 22
40646 - 62 62 62 168 124 44 206 145 10 224 166 10
40647 -236 178 12 239 182 13 242 186 14 242 186 14
40648 -246 186 14 246 190 14 246 190 14 246 190 14
40649 -246 190 14 246 190 14 246 190 14 246 190 14
40650 -246 190 14 246 190 14 246 190 14 246 190 14
40651 -246 190 14 236 178 12 216 158 10 175 118 6
40652 - 80 54 7 2 2 6 6 6 6 30 30 30
40653 - 54 54 54 62 62 62 50 50 50 38 38 38
40654 - 14 14 14 2 2 6 2 2 6 2 2 6
40655 - 2 2 6 2 2 6 2 2 6 2 2 6
40656 - 2 2 6 6 6 6 80 54 7 167 114 7
40657 -213 154 11 236 178 12 246 190 14 246 190 14
40658 -246 190 14 246 190 14 246 190 14 246 190 14
40659 -246 190 14 242 186 14 239 182 13 239 182 13
40660 -230 174 11 210 150 10 174 135 50 124 112 88
40661 - 82 82 82 54 54 54 34 34 34 18 18 18
40662 - 6 6 6 0 0 0 0 0 0 0 0 0
40663 - 0 0 0 0 0 0 0 0 0 0 0 0
40664 - 0 0 0 0 0 0 0 0 0 0 0 0
40665 - 0 0 0 0 0 0 6 6 6 18 18 18
40666 - 50 50 50 158 118 36 192 133 9 200 144 11
40667 -216 158 10 219 162 10 224 166 10 226 170 11
40668 -230 174 11 236 178 12 239 182 13 239 182 13
40669 -242 186 14 246 186 14 246 190 14 246 190 14
40670 -246 190 14 246 190 14 246 190 14 246 190 14
40671 -246 186 14 230 174 11 210 150 10 163 110 8
40672 -104 69 6 10 10 10 2 2 6 2 2 6
40673 - 2 2 6 2 2 6 2 2 6 2 2 6
40674 - 2 2 6 2 2 6 2 2 6 2 2 6
40675 - 2 2 6 2 2 6 2 2 6 2 2 6
40676 - 2 2 6 6 6 6 91 60 6 167 114 7
40677 -206 145 10 230 174 11 242 186 14 246 190 14
40678 -246 190 14 246 190 14 246 186 14 242 186 14
40679 -239 182 13 230 174 11 224 166 10 213 154 11
40680 -180 133 36 124 112 88 86 86 86 58 58 58
40681 - 38 38 38 22 22 22 10 10 10 6 6 6
40682 - 0 0 0 0 0 0 0 0 0 0 0 0
40683 - 0 0 0 0 0 0 0 0 0 0 0 0
40684 - 0 0 0 0 0 0 0 0 0 0 0 0
40685 - 0 0 0 0 0 0 0 0 0 14 14 14
40686 - 34 34 34 70 70 70 138 110 50 158 118 36
40687 -167 114 7 180 123 7 192 133 9 197 138 11
40688 -200 144 11 206 145 10 213 154 11 219 162 10
40689 -224 166 10 230 174 11 239 182 13 242 186 14
40690 -246 186 14 246 186 14 246 186 14 246 186 14
40691 -239 182 13 216 158 10 185 133 11 152 99 6
40692 -104 69 6 18 14 6 2 2 6 2 2 6
40693 - 2 2 6 2 2 6 2 2 6 2 2 6
40694 - 2 2 6 2 2 6 2 2 6 2 2 6
40695 - 2 2 6 2 2 6 2 2 6 2 2 6
40696 - 2 2 6 6 6 6 80 54 7 152 99 6
40697 -192 133 9 219 162 10 236 178 12 239 182 13
40698 -246 186 14 242 186 14 239 182 13 236 178 12
40699 -224 166 10 206 145 10 192 133 9 154 121 60
40700 - 94 94 94 62 62 62 42 42 42 22 22 22
40701 - 14 14 14 6 6 6 0 0 0 0 0 0
40702 - 0 0 0 0 0 0 0 0 0 0 0 0
40703 - 0 0 0 0 0 0 0 0 0 0 0 0
40704 - 0 0 0 0 0 0 0 0 0 0 0 0
40705 - 0 0 0 0 0 0 0 0 0 6 6 6
40706 - 18 18 18 34 34 34 58 58 58 78 78 78
40707 -101 98 89 124 112 88 142 110 46 156 107 11
40708 -163 110 8 167 114 7 175 118 6 180 123 7
40709 -185 133 11 197 138 11 210 150 10 219 162 10
40710 -226 170 11 236 178 12 236 178 12 234 174 13
40711 -219 162 10 197 138 11 163 110 8 130 83 6
40712 - 91 60 6 10 10 10 2 2 6 2 2 6
40713 - 18 18 18 38 38 38 38 38 38 38 38 38
40714 - 38 38 38 38 38 38 38 38 38 38 38 38
40715 - 38 38 38 38 38 38 26 26 26 2 2 6
40716 - 2 2 6 6 6 6 70 47 6 137 92 6
40717 -175 118 6 200 144 11 219 162 10 230 174 11
40718 -234 174 13 230 174 11 219 162 10 210 150 10
40719 -192 133 9 163 110 8 124 112 88 82 82 82
40720 - 50 50 50 30 30 30 14 14 14 6 6 6
40721 - 0 0 0 0 0 0 0 0 0 0 0 0
40722 - 0 0 0 0 0 0 0 0 0 0 0 0
40723 - 0 0 0 0 0 0 0 0 0 0 0 0
40724 - 0 0 0 0 0 0 0 0 0 0 0 0
40725 - 0 0 0 0 0 0 0 0 0 0 0 0
40726 - 6 6 6 14 14 14 22 22 22 34 34 34
40727 - 42 42 42 58 58 58 74 74 74 86 86 86
40728 -101 98 89 122 102 70 130 98 46 121 87 25
40729 -137 92 6 152 99 6 163 110 8 180 123 7
40730 -185 133 11 197 138 11 206 145 10 200 144 11
40731 -180 123 7 156 107 11 130 83 6 104 69 6
40732 - 50 34 6 54 54 54 110 110 110 101 98 89
40733 - 86 86 86 82 82 82 78 78 78 78 78 78
40734 - 78 78 78 78 78 78 78 78 78 78 78 78
40735 - 78 78 78 82 82 82 86 86 86 94 94 94
40736 -106 106 106 101 101 101 86 66 34 124 80 6
40737 -156 107 11 180 123 7 192 133 9 200 144 11
40738 -206 145 10 200 144 11 192 133 9 175 118 6
40739 -139 102 15 109 106 95 70 70 70 42 42 42
40740 - 22 22 22 10 10 10 0 0 0 0 0 0
40741 - 0 0 0 0 0 0 0 0 0 0 0 0
40742 - 0 0 0 0 0 0 0 0 0 0 0 0
40743 - 0 0 0 0 0 0 0 0 0 0 0 0
40744 - 0 0 0 0 0 0 0 0 0 0 0 0
40745 - 0 0 0 0 0 0 0 0 0 0 0 0
40746 - 0 0 0 0 0 0 6 6 6 10 10 10
40747 - 14 14 14 22 22 22 30 30 30 38 38 38
40748 - 50 50 50 62 62 62 74 74 74 90 90 90
40749 -101 98 89 112 100 78 121 87 25 124 80 6
40750 -137 92 6 152 99 6 152 99 6 152 99 6
40751 -138 86 6 124 80 6 98 70 6 86 66 30
40752 -101 98 89 82 82 82 58 58 58 46 46 46
40753 - 38 38 38 34 34 34 34 34 34 34 34 34
40754 - 34 34 34 34 34 34 34 34 34 34 34 34
40755 - 34 34 34 34 34 34 38 38 38 42 42 42
40756 - 54 54 54 82 82 82 94 86 76 91 60 6
40757 -134 86 6 156 107 11 167 114 7 175 118 6
40758 -175 118 6 167 114 7 152 99 6 121 87 25
40759 -101 98 89 62 62 62 34 34 34 18 18 18
40760 - 6 6 6 0 0 0 0 0 0 0 0 0
40761 - 0 0 0 0 0 0 0 0 0 0 0 0
40762 - 0 0 0 0 0 0 0 0 0 0 0 0
40763 - 0 0 0 0 0 0 0 0 0 0 0 0
40764 - 0 0 0 0 0 0 0 0 0 0 0 0
40765 - 0 0 0 0 0 0 0 0 0 0 0 0
40766 - 0 0 0 0 0 0 0 0 0 0 0 0
40767 - 0 0 0 6 6 6 6 6 6 10 10 10
40768 - 18 18 18 22 22 22 30 30 30 42 42 42
40769 - 50 50 50 66 66 66 86 86 86 101 98 89
40770 -106 86 58 98 70 6 104 69 6 104 69 6
40771 -104 69 6 91 60 6 82 62 34 90 90 90
40772 - 62 62 62 38 38 38 22 22 22 14 14 14
40773 - 10 10 10 10 10 10 10 10 10 10 10 10
40774 - 10 10 10 10 10 10 6 6 6 10 10 10
40775 - 10 10 10 10 10 10 10 10 10 14 14 14
40776 - 22 22 22 42 42 42 70 70 70 89 81 66
40777 - 80 54 7 104 69 6 124 80 6 137 92 6
40778 -134 86 6 116 81 8 100 82 52 86 86 86
40779 - 58 58 58 30 30 30 14 14 14 6 6 6
40780 - 0 0 0 0 0 0 0 0 0 0 0 0
40781 - 0 0 0 0 0 0 0 0 0 0 0 0
40782 - 0 0 0 0 0 0 0 0 0 0 0 0
40783 - 0 0 0 0 0 0 0 0 0 0 0 0
40784 - 0 0 0 0 0 0 0 0 0 0 0 0
40785 - 0 0 0 0 0 0 0 0 0 0 0 0
40786 - 0 0 0 0 0 0 0 0 0 0 0 0
40787 - 0 0 0 0 0 0 0 0 0 0 0 0
40788 - 0 0 0 6 6 6 10 10 10 14 14 14
40789 - 18 18 18 26 26 26 38 38 38 54 54 54
40790 - 70 70 70 86 86 86 94 86 76 89 81 66
40791 - 89 81 66 86 86 86 74 74 74 50 50 50
40792 - 30 30 30 14 14 14 6 6 6 0 0 0
40793 - 0 0 0 0 0 0 0 0 0 0 0 0
40794 - 0 0 0 0 0 0 0 0 0 0 0 0
40795 - 0 0 0 0 0 0 0 0 0 0 0 0
40796 - 6 6 6 18 18 18 34 34 34 58 58 58
40797 - 82 82 82 89 81 66 89 81 66 89 81 66
40798 - 94 86 66 94 86 76 74 74 74 50 50 50
40799 - 26 26 26 14 14 14 6 6 6 0 0 0
40800 - 0 0 0 0 0 0 0 0 0 0 0 0
40801 - 0 0 0 0 0 0 0 0 0 0 0 0
40802 - 0 0 0 0 0 0 0 0 0 0 0 0
40803 - 0 0 0 0 0 0 0 0 0 0 0 0
40804 - 0 0 0 0 0 0 0 0 0 0 0 0
40805 - 0 0 0 0 0 0 0 0 0 0 0 0
40806 - 0 0 0 0 0 0 0 0 0 0 0 0
40807 - 0 0 0 0 0 0 0 0 0 0 0 0
40808 - 0 0 0 0 0 0 0 0 0 0 0 0
40809 - 6 6 6 6 6 6 14 14 14 18 18 18
40810 - 30 30 30 38 38 38 46 46 46 54 54 54
40811 - 50 50 50 42 42 42 30 30 30 18 18 18
40812 - 10 10 10 0 0 0 0 0 0 0 0 0
40813 - 0 0 0 0 0 0 0 0 0 0 0 0
40814 - 0 0 0 0 0 0 0 0 0 0 0 0
40815 - 0 0 0 0 0 0 0 0 0 0 0 0
40816 - 0 0 0 6 6 6 14 14 14 26 26 26
40817 - 38 38 38 50 50 50 58 58 58 58 58 58
40818 - 54 54 54 42 42 42 30 30 30 18 18 18
40819 - 10 10 10 0 0 0 0 0 0 0 0 0
40820 - 0 0 0 0 0 0 0 0 0 0 0 0
40821 - 0 0 0 0 0 0 0 0 0 0 0 0
40822 - 0 0 0 0 0 0 0 0 0 0 0 0
40823 - 0 0 0 0 0 0 0 0 0 0 0 0
40824 - 0 0 0 0 0 0 0 0 0 0 0 0
40825 - 0 0 0 0 0 0 0 0 0 0 0 0
40826 - 0 0 0 0 0 0 0 0 0 0 0 0
40827 - 0 0 0 0 0 0 0 0 0 0 0 0
40828 - 0 0 0 0 0 0 0 0 0 0 0 0
40829 - 0 0 0 0 0 0 0 0 0 6 6 6
40830 - 6 6 6 10 10 10 14 14 14 18 18 18
40831 - 18 18 18 14 14 14 10 10 10 6 6 6
40832 - 0 0 0 0 0 0 0 0 0 0 0 0
40833 - 0 0 0 0 0 0 0 0 0 0 0 0
40834 - 0 0 0 0 0 0 0 0 0 0 0 0
40835 - 0 0 0 0 0 0 0 0 0 0 0 0
40836 - 0 0 0 0 0 0 0 0 0 6 6 6
40837 - 14 14 14 18 18 18 22 22 22 22 22 22
40838 - 18 18 18 14 14 14 10 10 10 6 6 6
40839 - 0 0 0 0 0 0 0 0 0 0 0 0
40840 - 0 0 0 0 0 0 0 0 0 0 0 0
40841 - 0 0 0 0 0 0 0 0 0 0 0 0
40842 - 0 0 0 0 0 0 0 0 0 0 0 0
40843 - 0 0 0 0 0 0 0 0 0 0 0 0
40844 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40845 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40846 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40847 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40848 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40849 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40850 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40851 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40852 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40853 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40854 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40855 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40856 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40857 +4 4 4 4 4 4
40858 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40859 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40860 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40861 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40862 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40863 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40864 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40865 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40866 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40867 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40868 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40869 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40870 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40871 +4 4 4 4 4 4
40872 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40873 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40874 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40875 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40876 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40877 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40878 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40879 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40880 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40881 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40882 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40883 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40884 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40885 +4 4 4 4 4 4
40886 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40887 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40888 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40889 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40890 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40891 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40892 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40893 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40894 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40895 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40896 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40897 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40898 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40899 +4 4 4 4 4 4
40900 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40901 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40902 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40903 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40904 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40905 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40906 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40907 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40908 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40909 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40910 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40911 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40912 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40913 +4 4 4 4 4 4
40914 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40915 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40916 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40917 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40918 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40919 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40920 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40921 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40922 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40923 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40924 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40925 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40926 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40927 +4 4 4 4 4 4
40928 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40929 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40930 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40931 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40932 +4 4 4 4 4 4 4 4 4 3 3 3 0 0 0 0 0 0
40933 +0 0 0 0 0 0 0 0 0 0 0 0 3 3 3 4 4 4
40934 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40935 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40936 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40937 +4 4 4 4 4 4 4 4 4 4 4 4 1 1 1 0 0 0
40938 +0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
40939 +4 4 4 4 4 4 4 4 4 2 1 0 2 1 0 3 2 2
40940 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40941 +4 4 4 4 4 4
40942 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40943 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40944 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40945 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40946 +4 4 4 4 4 4 2 2 2 0 0 0 3 4 3 26 28 28
40947 +37 38 37 37 38 37 14 17 19 2 2 2 0 0 0 2 2 2
40948 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40949 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40950 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40951 +4 4 4 4 4 4 3 3 3 0 0 0 1 1 1 6 6 6
40952 +2 2 2 0 0 0 3 3 3 4 4 4 4 4 4 4 4 4
40953 +4 4 5 3 3 3 1 0 0 0 0 0 1 0 0 0 0 0
40954 +1 1 1 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40955 +4 4 4 4 4 4
40956 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40957 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40958 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40959 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40960 +2 2 2 0 0 0 0 0 0 14 17 19 60 74 84 137 136 137
40961 +153 152 153 137 136 137 125 124 125 60 73 81 6 6 6 3 1 0
40962 +0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
40963 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40964 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40965 +4 4 4 4 4 4 0 0 0 4 4 4 41 54 63 125 124 125
40966 +60 73 81 6 6 6 4 0 0 3 3 3 4 4 4 4 4 4
40967 +4 4 4 0 0 0 6 9 11 41 54 63 41 65 82 22 30 35
40968 +2 2 2 2 1 0 4 4 4 4 4 4 4 4 4 4 4 4
40969 +4 4 4 4 4 4
40970 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40971 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40972 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40973 +4 4 4 4 4 4 5 5 5 5 5 5 2 2 2 0 0 0
40974 +4 0 0 6 6 6 41 54 63 137 136 137 174 174 174 167 166 167
40975 +165 164 165 165 164 165 163 162 163 163 162 163 125 124 125 41 54 63
40976 +1 1 1 0 0 0 0 0 0 3 3 3 5 5 5 4 4 4
40977 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40978 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
40979 +3 3 3 2 0 0 4 0 0 60 73 81 156 155 156 167 166 167
40980 +163 162 163 85 115 134 5 7 8 0 0 0 4 4 4 5 5 5
40981 +0 0 0 2 5 5 55 98 126 90 154 193 90 154 193 72 125 159
40982 +37 51 59 2 0 0 1 1 1 4 5 5 4 4 4 4 4 4
40983 +4 4 4 4 4 4
40984 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40985 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40986 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40987 +4 4 4 5 5 5 4 4 4 1 1 1 0 0 0 3 3 3
40988 +37 38 37 125 124 125 163 162 163 174 174 174 158 157 158 158 157 158
40989 +156 155 156 156 155 156 158 157 158 165 164 165 174 174 174 166 165 166
40990 +125 124 125 16 19 21 1 0 0 0 0 0 0 0 0 4 4 4
40991 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
40992 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 1 1 1
40993 +0 0 0 0 0 0 37 38 37 153 152 153 174 174 174 158 157 158
40994 +174 174 174 163 162 163 37 38 37 4 3 3 4 0 0 1 1 1
40995 +0 0 0 22 40 52 101 161 196 101 161 196 90 154 193 101 161 196
40996 +64 123 161 14 17 19 0 0 0 4 4 4 4 4 4 4 4 4
40997 +4 4 4 4 4 4
40998 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
40999 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41000 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41001 +5 5 5 2 2 2 0 0 0 4 0 0 24 26 27 85 115 134
41002 +156 155 156 174 174 174 167 166 167 156 155 156 154 153 154 157 156 157
41003 +156 155 156 156 155 156 155 154 155 153 152 153 158 157 158 167 166 167
41004 +174 174 174 156 155 156 60 74 84 16 19 21 0 0 0 0 0 0
41005 +1 1 1 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
41006 +4 4 4 5 5 5 6 6 6 3 3 3 0 0 0 4 0 0
41007 +13 16 17 60 73 81 137 136 137 165 164 165 156 155 156 153 152 153
41008 +174 174 174 177 184 187 60 73 81 3 1 0 0 0 0 1 1 2
41009 +22 30 35 64 123 161 136 185 209 90 154 193 90 154 193 90 154 193
41010 +90 154 193 21 29 34 0 0 0 3 2 2 4 4 5 4 4 4
41011 +4 4 4 4 4 4
41012 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41013 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41014 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 3 3 3
41015 +0 0 0 0 0 0 10 13 16 60 74 84 157 156 157 174 174 174
41016 +174 174 174 158 157 158 153 152 153 154 153 154 156 155 156 155 154 155
41017 +156 155 156 155 154 155 154 153 154 157 156 157 154 153 154 153 152 153
41018 +163 162 163 174 174 174 177 184 187 137 136 137 60 73 81 13 16 17
41019 +4 0 0 0 0 0 3 3 3 5 5 5 4 4 4 4 4 4
41020 +5 5 5 4 4 4 1 1 1 0 0 0 3 3 3 41 54 63
41021 +131 129 131 174 174 174 174 174 174 174 174 174 167 166 167 174 174 174
41022 +190 197 201 137 136 137 24 26 27 4 0 0 16 21 25 50 82 103
41023 +90 154 193 136 185 209 90 154 193 101 161 196 101 161 196 101 161 196
41024 +31 91 132 3 6 7 0 0 0 4 4 4 4 4 4 4 4 4
41025 +4 4 4 4 4 4
41026 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41027 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41028 +4 4 4 4 4 4 4 4 4 2 2 2 0 0 0 4 0 0
41029 +4 0 0 43 57 68 137 136 137 177 184 187 174 174 174 163 162 163
41030 +155 154 155 155 154 155 156 155 156 155 154 155 158 157 158 165 164 165
41031 +167 166 167 166 165 166 163 162 163 157 156 157 155 154 155 155 154 155
41032 +153 152 153 156 155 156 167 166 167 174 174 174 174 174 174 131 129 131
41033 +41 54 63 5 5 5 0 0 0 0 0 0 3 3 3 4 4 4
41034 +1 1 1 0 0 0 1 0 0 26 28 28 125 124 125 174 174 174
41035 +177 184 187 174 174 174 174 174 174 156 155 156 131 129 131 137 136 137
41036 +125 124 125 24 26 27 4 0 0 41 65 82 90 154 193 136 185 209
41037 +136 185 209 101 161 196 53 118 160 37 112 160 90 154 193 34 86 122
41038 +7 12 15 0 0 0 4 4 4 4 4 4 4 4 4 4 4 4
41039 +4 4 4 4 4 4
41040 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41041 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41042 +4 4 4 3 3 3 0 0 0 0 0 0 5 5 5 37 38 37
41043 +125 124 125 167 166 167 174 174 174 167 166 167 158 157 158 155 154 155
41044 +156 155 156 156 155 156 156 155 156 163 162 163 167 166 167 155 154 155
41045 +137 136 137 153 152 153 156 155 156 165 164 165 163 162 163 156 155 156
41046 +156 155 156 156 155 156 155 154 155 158 157 158 166 165 166 174 174 174
41047 +167 166 167 125 124 125 37 38 37 1 0 0 0 0 0 0 0 0
41048 +0 0 0 24 26 27 60 74 84 158 157 158 174 174 174 174 174 174
41049 +166 165 166 158 157 158 125 124 125 41 54 63 13 16 17 6 6 6
41050 +6 6 6 37 38 37 80 127 157 136 185 209 101 161 196 101 161 196
41051 +90 154 193 28 67 93 6 10 14 13 20 25 13 20 25 6 10 14
41052 +1 1 2 4 3 3 4 4 4 4 4 4 4 4 4 4 4 4
41053 +4 4 4 4 4 4
41054 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41055 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41056 +1 1 1 1 0 0 4 3 3 37 38 37 60 74 84 153 152 153
41057 +167 166 167 167 166 167 158 157 158 154 153 154 155 154 155 156 155 156
41058 +157 156 157 158 157 158 167 166 167 167 166 167 131 129 131 43 57 68
41059 +26 28 28 37 38 37 60 73 81 131 129 131 165 164 165 166 165 166
41060 +158 157 158 155 154 155 156 155 156 156 155 156 156 155 156 158 157 158
41061 +165 164 165 174 174 174 163 162 163 60 74 84 16 19 21 13 16 17
41062 +60 73 81 131 129 131 174 174 174 174 174 174 167 166 167 165 164 165
41063 +137 136 137 60 73 81 24 26 27 4 0 0 4 0 0 16 19 21
41064 +52 104 138 101 161 196 136 185 209 136 185 209 90 154 193 27 99 146
41065 +13 20 25 4 5 7 2 5 5 4 5 7 1 1 2 0 0 0
41066 +4 4 4 4 4 4 3 3 3 2 2 2 2 2 2 4 4 4
41067 +4 4 4 4 4 4
41068 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41069 +4 4 4 4 4 4 4 4 4 4 4 4 3 3 3 0 0 0
41070 +0 0 0 13 16 17 60 73 81 137 136 137 174 174 174 166 165 166
41071 +158 157 158 156 155 156 157 156 157 156 155 156 155 154 155 158 157 158
41072 +167 166 167 174 174 174 153 152 153 60 73 81 16 19 21 4 0 0
41073 +4 0 0 4 0 0 6 6 6 26 28 28 60 74 84 158 157 158
41074 +174 174 174 166 165 166 157 156 157 155 154 155 156 155 156 156 155 156
41075 +155 154 155 158 157 158 167 166 167 167 166 167 131 129 131 125 124 125
41076 +137 136 137 167 166 167 167 166 167 174 174 174 158 157 158 125 124 125
41077 +16 19 21 4 0 0 4 0 0 10 13 16 49 76 92 107 159 188
41078 +136 185 209 136 185 209 90 154 193 26 108 161 22 40 52 6 10 14
41079 +2 3 3 1 1 2 1 1 2 4 4 5 4 4 5 4 4 5
41080 +4 4 5 2 2 1 0 0 0 0 0 0 0 0 0 2 2 2
41081 +4 4 4 4 4 4
41082 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41083 +4 4 4 5 5 5 3 3 3 0 0 0 1 0 0 4 0 0
41084 +37 51 59 131 129 131 167 166 167 167 166 167 163 162 163 157 156 157
41085 +157 156 157 155 154 155 153 152 153 157 156 157 167 166 167 174 174 174
41086 +153 152 153 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
41087 +4 3 3 4 3 3 4 0 0 6 6 6 4 0 0 37 38 37
41088 +125 124 125 174 174 174 174 174 174 165 164 165 156 155 156 154 153 154
41089 +156 155 156 156 155 156 155 154 155 163 162 163 158 157 158 163 162 163
41090 +174 174 174 174 174 174 174 174 174 125 124 125 37 38 37 0 0 0
41091 +4 0 0 6 9 11 41 54 63 90 154 193 136 185 209 146 190 211
41092 +136 185 209 37 112 160 22 40 52 6 10 14 3 6 7 1 1 2
41093 +1 1 2 3 3 3 1 1 2 3 3 3 4 4 4 4 4 4
41094 +2 2 2 2 0 0 16 19 21 37 38 37 24 26 27 0 0 0
41095 +0 0 0 4 4 4
41096 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
41097 +4 4 4 0 0 0 0 0 0 0 0 0 26 28 28 120 125 127
41098 +158 157 158 174 174 174 165 164 165 157 156 157 155 154 155 156 155 156
41099 +153 152 153 153 152 153 167 166 167 174 174 174 174 174 174 125 124 125
41100 +37 38 37 4 0 0 0 0 0 4 0 0 4 3 3 4 4 4
41101 +4 4 4 4 4 4 5 5 5 4 0 0 4 0 0 4 0 0
41102 +4 3 3 43 57 68 137 136 137 174 174 174 174 174 174 165 164 165
41103 +154 153 154 153 152 153 153 152 153 153 152 153 163 162 163 174 174 174
41104 +174 174 174 153 152 153 60 73 81 6 6 6 4 0 0 4 3 3
41105 +32 43 50 80 127 157 136 185 209 146 190 211 146 190 211 90 154 193
41106 +28 67 93 28 67 93 40 71 93 3 6 7 1 1 2 2 5 5
41107 +50 82 103 79 117 143 26 37 45 0 0 0 3 3 3 1 1 1
41108 +0 0 0 41 54 63 137 136 137 174 174 174 153 152 153 60 73 81
41109 +2 0 0 0 0 0
41110 +4 4 4 4 4 4 4 4 4 4 4 4 6 6 6 2 2 2
41111 +0 0 0 2 0 0 24 26 27 60 74 84 153 152 153 174 174 174
41112 +174 174 174 157 156 157 154 153 154 156 155 156 154 153 154 153 152 153
41113 +165 164 165 174 174 174 177 184 187 137 136 137 43 57 68 6 6 6
41114 +4 0 0 2 0 0 3 3 3 5 5 5 5 5 5 4 4 4
41115 +4 4 4 4 4 4 4 4 4 5 5 5 6 6 6 4 3 3
41116 +4 0 0 4 0 0 24 26 27 60 73 81 153 152 153 174 174 174
41117 +174 174 174 158 157 158 158 157 158 174 174 174 174 174 174 158 157 158
41118 +60 74 84 24 26 27 4 0 0 4 0 0 17 23 27 59 113 148
41119 +136 185 209 191 222 234 146 190 211 136 185 209 31 91 132 7 11 13
41120 +22 40 52 101 161 196 90 154 193 6 9 11 3 4 4 43 95 132
41121 +136 185 209 172 205 220 55 98 126 0 0 0 0 0 0 2 0 0
41122 +26 28 28 153 152 153 177 184 187 167 166 167 177 184 187 165 164 165
41123 +37 38 37 0 0 0
41124 +4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
41125 +13 16 17 60 73 81 137 136 137 174 174 174 174 174 174 165 164 165
41126 +153 152 153 153 152 153 155 154 155 154 153 154 158 157 158 174 174 174
41127 +177 184 187 163 162 163 60 73 81 16 19 21 4 0 0 4 0 0
41128 +4 3 3 4 4 4 5 5 5 5 5 5 4 4 4 5 5 5
41129 +5 5 5 5 5 5 5 5 5 4 4 4 4 4 4 5 5 5
41130 +6 6 6 4 0 0 4 0 0 4 0 0 24 26 27 60 74 84
41131 +166 165 166 174 174 174 177 184 187 165 164 165 125 124 125 24 26 27
41132 +4 0 0 4 0 0 5 5 5 50 82 103 136 185 209 172 205 220
41133 +146 190 211 136 185 209 26 108 161 22 40 52 7 12 15 44 81 103
41134 +71 116 144 28 67 93 37 51 59 41 65 82 100 139 164 101 161 196
41135 +90 154 193 90 154 193 28 67 93 0 0 0 0 0 0 26 28 28
41136 +125 124 125 167 166 167 163 162 163 153 152 153 163 162 163 174 174 174
41137 +85 115 134 4 0 0
41138 +4 4 4 5 5 5 4 4 4 1 0 0 4 0 0 34 47 55
41139 +125 124 125 174 174 174 174 174 174 167 166 167 157 156 157 153 152 153
41140 +155 154 155 155 154 155 158 157 158 166 165 166 167 166 167 154 153 154
41141 +125 124 125 26 28 28 4 0 0 4 0 0 4 0 0 5 5 5
41142 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 1 1 1
41143 +0 0 0 0 0 0 1 1 1 4 4 4 4 4 4 4 4 4
41144 +5 5 5 5 5 5 4 3 3 4 0 0 4 0 0 6 6 6
41145 +37 38 37 131 129 131 137 136 137 37 38 37 0 0 0 4 0 0
41146 +4 5 5 43 61 72 90 154 193 172 205 220 146 190 211 136 185 209
41147 +90 154 193 28 67 93 13 20 25 43 61 72 71 116 144 44 81 103
41148 +2 5 5 7 11 13 59 113 148 101 161 196 90 154 193 28 67 93
41149 +13 20 25 6 10 14 0 0 0 13 16 17 60 73 81 137 136 137
41150 +166 165 166 158 157 158 156 155 156 154 153 154 167 166 167 174 174 174
41151 +60 73 81 4 0 0
41152 +4 4 4 4 4 4 0 0 0 3 3 3 60 74 84 174 174 174
41153 +174 174 174 167 166 167 163 162 163 155 154 155 157 156 157 155 154 155
41154 +156 155 156 163 162 163 167 166 167 158 157 158 125 124 125 37 38 37
41155 +4 3 3 4 0 0 4 0 0 6 6 6 6 6 6 5 5 5
41156 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 2 3 3
41157 +10 13 16 7 11 13 1 0 0 0 0 0 2 2 1 4 4 4
41158 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 4 0 0
41159 +4 0 0 7 11 13 13 16 17 4 0 0 3 3 3 34 47 55
41160 +80 127 157 146 190 211 172 205 220 136 185 209 136 185 209 136 185 209
41161 +28 67 93 22 40 52 55 98 126 55 98 126 21 29 34 7 11 13
41162 +50 82 103 101 161 196 101 161 196 35 83 115 13 20 25 2 2 1
41163 +1 1 2 1 1 2 37 51 59 131 129 131 174 174 174 174 174 174
41164 +167 166 167 163 162 163 163 162 163 167 166 167 174 174 174 125 124 125
41165 +16 19 21 4 0 0
41166 +4 4 4 4 0 0 4 0 0 60 74 84 174 174 174 174 174 174
41167 +158 157 158 155 154 155 155 154 155 156 155 156 155 154 155 158 157 158
41168 +167 166 167 165 164 165 131 129 131 60 73 81 13 16 17 4 0 0
41169 +4 0 0 4 3 3 6 6 6 4 3 3 5 5 5 4 4 4
41170 +4 4 4 3 2 2 0 0 0 0 0 0 7 11 13 45 69 86
41171 +80 127 157 71 116 144 43 61 72 7 11 13 0 0 0 1 1 1
41172 +4 3 3 4 4 4 4 4 4 4 4 4 6 6 6 5 5 5
41173 +3 2 2 4 0 0 1 0 0 21 29 34 59 113 148 136 185 209
41174 +146 190 211 136 185 209 136 185 209 136 185 209 136 185 209 136 185 209
41175 +68 124 159 44 81 103 22 40 52 13 16 17 43 61 72 90 154 193
41176 +136 185 209 59 113 148 21 29 34 3 4 3 1 1 1 0 0 0
41177 +24 26 27 125 124 125 163 162 163 174 174 174 166 165 166 165 164 165
41178 +163 162 163 125 124 125 125 124 125 125 124 125 125 124 125 26 28 28
41179 +4 0 0 4 3 3
41180 +3 3 3 0 0 0 24 26 27 153 152 153 177 184 187 158 157 158
41181 +156 155 156 156 155 156 155 154 155 155 154 155 165 164 165 174 174 174
41182 +155 154 155 60 74 84 26 28 28 4 0 0 4 0 0 3 1 0
41183 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 3 3
41184 +2 0 0 0 0 0 0 0 0 32 43 50 72 125 159 101 161 196
41185 +136 185 209 101 161 196 101 161 196 79 117 143 32 43 50 0 0 0
41186 +0 0 0 2 2 2 4 4 4 4 4 4 3 3 3 1 0 0
41187 +0 0 0 4 5 5 49 76 92 101 161 196 146 190 211 146 190 211
41188 +136 185 209 136 185 209 136 185 209 136 185 209 136 185 209 90 154 193
41189 +28 67 93 13 16 17 37 51 59 80 127 157 136 185 209 90 154 193
41190 +22 40 52 6 9 11 3 4 3 2 2 1 16 19 21 60 73 81
41191 +137 136 137 163 162 163 158 157 158 166 165 166 167 166 167 153 152 153
41192 +60 74 84 37 38 37 6 6 6 13 16 17 4 0 0 1 0 0
41193 +3 2 2 4 4 4
41194 +3 2 2 4 0 0 37 38 37 137 136 137 167 166 167 158 157 158
41195 +157 156 157 154 153 154 157 156 157 167 166 167 174 174 174 125 124 125
41196 +37 38 37 4 0 0 4 0 0 4 0 0 4 3 3 4 4 4
41197 +4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
41198 +0 0 0 16 21 25 55 98 126 90 154 193 136 185 209 101 161 196
41199 +101 161 196 101 161 196 136 185 209 136 185 209 101 161 196 55 98 126
41200 +14 17 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
41201 +22 40 52 90 154 193 146 190 211 146 190 211 136 185 209 136 185 209
41202 +136 185 209 136 185 209 136 185 209 101 161 196 35 83 115 7 11 13
41203 +17 23 27 59 113 148 136 185 209 101 161 196 34 86 122 7 12 15
41204 +2 5 5 3 4 3 6 6 6 60 73 81 131 129 131 163 162 163
41205 +166 165 166 174 174 174 174 174 174 163 162 163 125 124 125 41 54 63
41206 +13 16 17 4 0 0 4 0 0 4 0 0 1 0 0 2 2 2
41207 +4 4 4 4 4 4
41208 +1 1 1 2 1 0 43 57 68 137 136 137 153 152 153 153 152 153
41209 +163 162 163 156 155 156 165 164 165 167 166 167 60 74 84 6 6 6
41210 +4 0 0 4 0 0 5 5 5 4 4 4 4 4 4 4 4 4
41211 +4 5 5 6 6 6 4 3 3 0 0 0 0 0 0 11 15 18
41212 +40 71 93 100 139 164 101 161 196 101 161 196 101 161 196 101 161 196
41213 +101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 136 185 209
41214 +101 161 196 45 69 86 6 6 6 0 0 0 17 23 27 55 98 126
41215 +136 185 209 146 190 211 136 185 209 136 185 209 136 185 209 136 185 209
41216 +136 185 209 136 185 209 90 154 193 22 40 52 7 11 13 50 82 103
41217 +136 185 209 136 185 209 53 118 160 22 40 52 7 11 13 2 5 5
41218 +3 4 3 37 38 37 125 124 125 157 156 157 166 165 166 167 166 167
41219 +174 174 174 174 174 174 137 136 137 60 73 81 4 0 0 4 0 0
41220 +4 0 0 4 0 0 5 5 5 3 3 3 3 3 3 4 4 4
41221 +4 4 4 4 4 4
41222 +4 0 0 4 0 0 41 54 63 137 136 137 125 124 125 131 129 131
41223 +155 154 155 167 166 167 174 174 174 60 74 84 6 6 6 4 0 0
41224 +4 3 3 6 6 6 4 4 4 4 4 4 4 4 4 5 5 5
41225 +4 4 4 1 1 1 0 0 0 3 6 7 41 65 82 72 125 159
41226 +101 161 196 101 161 196 101 161 196 90 154 193 90 154 193 101 161 196
41227 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
41228 +136 185 209 136 185 209 80 127 157 55 98 126 101 161 196 146 190 211
41229 +136 185 209 136 185 209 136 185 209 101 161 196 136 185 209 101 161 196
41230 +136 185 209 101 161 196 35 83 115 22 30 35 101 161 196 172 205 220
41231 +90 154 193 28 67 93 7 11 13 2 5 5 3 4 3 13 16 17
41232 +85 115 134 167 166 167 174 174 174 174 174 174 174 174 174 174 174 174
41233 +167 166 167 60 74 84 13 16 17 4 0 0 4 0 0 4 3 3
41234 +6 6 6 5 5 5 4 4 4 5 5 5 4 4 4 5 5 5
41235 +5 5 5 5 5 5
41236 +1 1 1 4 0 0 41 54 63 137 136 137 137 136 137 125 124 125
41237 +131 129 131 167 166 167 157 156 157 37 38 37 6 6 6 4 0 0
41238 +6 6 6 5 5 5 4 4 4 4 4 4 4 5 5 2 2 1
41239 +0 0 0 0 0 0 26 37 45 58 111 146 101 161 196 101 161 196
41240 +101 161 196 90 154 193 90 154 193 90 154 193 101 161 196 101 161 196
41241 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
41242 +101 161 196 136 185 209 136 185 209 136 185 209 146 190 211 136 185 209
41243 +136 185 209 101 161 196 136 185 209 136 185 209 101 161 196 136 185 209
41244 +101 161 196 136 185 209 136 185 209 136 185 209 136 185 209 16 89 141
41245 +7 11 13 2 5 5 2 5 5 13 16 17 60 73 81 154 154 154
41246 +174 174 174 174 174 174 174 174 174 174 174 174 163 162 163 125 124 125
41247 +24 26 27 4 0 0 4 0 0 4 0 0 5 5 5 5 5 5
41248 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
41249 +5 5 5 4 4 4
41250 +4 0 0 6 6 6 37 38 37 137 136 137 137 136 137 131 129 131
41251 +131 129 131 153 152 153 131 129 131 26 28 28 4 0 0 4 3 3
41252 +6 6 6 4 4 4 4 4 4 4 4 4 0 0 0 0 0 0
41253 +13 20 25 51 88 114 90 154 193 101 161 196 101 161 196 90 154 193
41254 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
41255 +101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 101 161 196
41256 +101 161 196 136 185 209 101 161 196 136 185 209 136 185 209 101 161 196
41257 +136 185 209 101 161 196 136 185 209 101 161 196 101 161 196 101 161 196
41258 +136 185 209 136 185 209 136 185 209 37 112 160 21 29 34 5 7 8
41259 +2 5 5 13 16 17 43 57 68 131 129 131 174 174 174 174 174 174
41260 +174 174 174 167 166 167 157 156 157 125 124 125 37 38 37 4 0 0
41261 +4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
41262 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41263 +4 4 4 4 4 4
41264 +1 1 1 4 0 0 41 54 63 153 152 153 137 136 137 137 136 137
41265 +137 136 137 153 152 153 125 124 125 24 26 27 4 0 0 3 2 2
41266 +4 4 4 4 4 4 4 3 3 4 0 0 3 6 7 43 61 72
41267 +64 123 161 101 161 196 90 154 193 90 154 193 90 154 193 90 154 193
41268 +90 154 193 90 154 193 90 154 193 90 154 193 101 161 196 90 154 193
41269 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
41270 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
41271 +136 185 209 101 161 196 101 161 196 136 185 209 136 185 209 101 161 196
41272 +101 161 196 90 154 193 28 67 93 13 16 17 7 11 13 3 6 7
41273 +37 51 59 125 124 125 163 162 163 174 174 174 167 166 167 166 165 166
41274 +167 166 167 131 129 131 60 73 81 4 0 0 4 0 0 4 0 0
41275 +3 3 3 5 5 5 6 6 6 4 4 4 4 4 4 4 4 4
41276 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41277 +4 4 4 4 4 4
41278 +4 0 0 4 0 0 41 54 63 137 136 137 153 152 153 137 136 137
41279 +153 152 153 157 156 157 125 124 125 24 26 27 0 0 0 2 2 2
41280 +4 4 4 4 4 4 2 0 0 0 0 0 28 67 93 90 154 193
41281 +90 154 193 90 154 193 90 154 193 90 154 193 64 123 161 90 154 193
41282 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
41283 +90 154 193 101 161 196 101 161 196 101 161 196 90 154 193 136 185 209
41284 +101 161 196 101 161 196 136 185 209 101 161 196 136 185 209 101 161 196
41285 +101 161 196 101 161 196 136 185 209 101 161 196 101 161 196 90 154 193
41286 +35 83 115 13 16 17 3 6 7 2 5 5 13 16 17 60 74 84
41287 +154 154 154 166 165 166 165 164 165 158 157 158 163 162 163 157 156 157
41288 +60 74 84 13 16 17 4 0 0 4 0 0 3 2 2 4 4 4
41289 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41290 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41291 +4 4 4 4 4 4
41292 +1 1 1 4 0 0 41 54 63 157 156 157 155 154 155 137 136 137
41293 +153 152 153 158 157 158 137 136 137 26 28 28 2 0 0 2 2 2
41294 +4 4 4 4 4 4 1 0 0 6 10 14 34 86 122 90 154 193
41295 +64 123 161 90 154 193 64 123 161 90 154 193 90 154 193 90 154 193
41296 +64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
41297 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
41298 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
41299 +136 185 209 101 161 196 136 185 209 90 154 193 26 108 161 22 40 52
41300 +13 16 17 5 7 8 2 5 5 2 5 5 37 38 37 165 164 165
41301 +174 174 174 163 162 163 154 154 154 165 164 165 167 166 167 60 73 81
41302 +6 6 6 4 0 0 4 0 0 4 4 4 4 4 4 4 4 4
41303 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41304 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41305 +4 4 4 4 4 4
41306 +4 0 0 6 6 6 41 54 63 156 155 156 158 157 158 153 152 153
41307 +156 155 156 165 164 165 137 136 137 26 28 28 0 0 0 2 2 2
41308 +4 4 5 4 4 4 2 0 0 7 12 15 31 96 139 64 123 161
41309 +90 154 193 64 123 161 90 154 193 90 154 193 64 123 161 90 154 193
41310 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
41311 +90 154 193 90 154 193 90 154 193 101 161 196 101 161 196 101 161 196
41312 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
41313 +101 161 196 136 185 209 26 108 161 22 40 52 7 11 13 5 7 8
41314 +2 5 5 2 5 5 2 5 5 2 2 1 37 38 37 158 157 158
41315 +174 174 174 154 154 154 156 155 156 167 166 167 165 164 165 37 38 37
41316 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41317 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41318 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41319 +4 4 4 4 4 4
41320 +3 1 0 4 0 0 60 73 81 157 156 157 163 162 163 153 152 153
41321 +158 157 158 167 166 167 137 136 137 26 28 28 2 0 0 2 2 2
41322 +4 5 5 4 4 4 4 0 0 7 12 15 24 86 132 26 108 161
41323 +37 112 160 64 123 161 90 154 193 64 123 161 90 154 193 90 154 193
41324 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
41325 +90 154 193 101 161 196 90 154 193 101 161 196 101 161 196 101 161 196
41326 +101 161 196 101 161 196 101 161 196 136 185 209 101 161 196 136 185 209
41327 +90 154 193 35 83 115 13 16 17 13 16 17 7 11 13 3 6 7
41328 +5 7 8 6 6 6 3 4 3 2 2 1 30 32 34 154 154 154
41329 +167 166 167 154 154 154 154 154 154 174 174 174 165 164 165 37 38 37
41330 +6 6 6 4 0 0 6 6 6 4 4 4 4 4 4 4 4 4
41331 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41332 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41333 +4 4 4 4 4 4
41334 +4 0 0 4 0 0 41 54 63 163 162 163 166 165 166 154 154 154
41335 +163 162 163 174 174 174 137 136 137 26 28 28 0 0 0 2 2 2
41336 +4 5 5 4 4 5 1 1 2 6 10 14 28 67 93 18 97 151
41337 +18 97 151 18 97 151 26 108 161 37 112 160 37 112 160 90 154 193
41338 +64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
41339 +90 154 193 101 161 196 101 161 196 90 154 193 101 161 196 101 161 196
41340 +101 161 196 101 161 196 101 161 196 136 185 209 90 154 193 16 89 141
41341 +13 20 25 7 11 13 5 7 8 5 7 8 2 5 5 4 5 5
41342 +3 4 3 4 5 5 3 4 3 0 0 0 37 38 37 158 157 158
41343 +174 174 174 158 157 158 158 157 158 167 166 167 174 174 174 41 54 63
41344 +4 0 0 3 2 2 5 5 5 4 4 4 4 4 4 4 4 4
41345 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41346 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41347 +4 4 4 4 4 4
41348 +1 1 1 4 0 0 60 73 81 165 164 165 174 174 174 158 157 158
41349 +167 166 167 174 174 174 153 152 153 26 28 28 2 0 0 2 2 2
41350 +4 5 5 4 4 4 4 0 0 7 12 15 10 87 144 10 87 144
41351 +18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
41352 +26 108 161 37 112 160 53 118 160 90 154 193 90 154 193 90 154 193
41353 +90 154 193 90 154 193 101 161 196 101 161 196 101 161 196 101 161 196
41354 +101 161 196 136 185 209 90 154 193 26 108 161 22 40 52 13 16 17
41355 +7 11 13 3 6 7 5 7 8 5 7 8 2 5 5 4 5 5
41356 +4 5 5 6 6 6 3 4 3 0 0 0 30 32 34 158 157 158
41357 +174 174 174 156 155 156 155 154 155 165 164 165 154 153 154 37 38 37
41358 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41359 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41360 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41361 +4 4 4 4 4 4
41362 +4 0 0 4 0 0 60 73 81 167 166 167 174 174 174 163 162 163
41363 +174 174 174 174 174 174 153 152 153 26 28 28 0 0 0 3 3 3
41364 +5 5 5 4 4 4 1 1 2 7 12 15 28 67 93 18 97 151
41365 +18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
41366 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
41367 +90 154 193 26 108 161 90 154 193 90 154 193 90 154 193 101 161 196
41368 +101 161 196 26 108 161 22 40 52 13 16 17 7 11 13 2 5 5
41369 +2 5 5 6 6 6 2 5 5 4 5 5 4 5 5 4 5 5
41370 +3 4 3 5 5 5 3 4 3 2 0 0 30 32 34 137 136 137
41371 +153 152 153 137 136 137 131 129 131 137 136 137 131 129 131 37 38 37
41372 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41373 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41374 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41375 +4 4 4 4 4 4
41376 +1 1 1 4 0 0 60 73 81 167 166 167 174 174 174 166 165 166
41377 +174 174 174 177 184 187 153 152 153 30 32 34 1 0 0 3 3 3
41378 +5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
41379 +18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
41380 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
41381 +26 108 161 26 108 161 26 108 161 90 154 193 90 154 193 26 108 161
41382 +35 83 115 13 16 17 7 11 13 5 7 8 3 6 7 5 7 8
41383 +2 5 5 6 6 6 4 5 5 4 5 5 3 4 3 4 5 5
41384 +3 4 3 6 6 6 3 4 3 0 0 0 26 28 28 125 124 125
41385 +131 129 131 125 124 125 125 124 125 131 129 131 131 129 131 37 38 37
41386 +4 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41387 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41388 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41389 +4 4 4 4 4 4
41390 +3 1 0 4 0 0 60 73 81 174 174 174 177 184 187 167 166 167
41391 +174 174 174 177 184 187 153 152 153 30 32 34 0 0 0 3 3 3
41392 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
41393 +18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
41394 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
41395 +26 108 161 90 154 193 26 108 161 26 108 161 24 86 132 13 20 25
41396 +7 11 13 13 20 25 22 40 52 5 7 8 3 4 3 3 4 3
41397 +4 5 5 3 4 3 4 5 5 3 4 3 4 5 5 3 4 3
41398 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
41399 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41400 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41401 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41402 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41403 +4 4 4 4 4 4
41404 +1 1 1 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
41405 +174 174 174 190 197 201 157 156 157 30 32 34 1 0 0 3 3 3
41406 +5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
41407 +18 97 151 19 95 150 19 95 150 18 97 151 18 97 151 26 108 161
41408 +18 97 151 26 108 161 26 108 161 26 108 161 26 108 161 90 154 193
41409 +26 108 161 26 108 161 26 108 161 22 40 52 2 5 5 3 4 3
41410 +28 67 93 37 112 160 34 86 122 2 5 5 3 4 3 3 4 3
41411 +3 4 3 3 4 3 3 4 3 2 2 1 3 4 3 4 4 4
41412 +4 5 5 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
41413 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41414 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41415 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41416 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41417 +4 4 4 4 4 4
41418 +4 0 0 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
41419 +174 174 174 190 197 201 158 157 158 30 32 34 0 0 0 2 2 2
41420 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
41421 +10 87 144 19 95 150 19 95 150 18 97 151 18 97 151 18 97 151
41422 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
41423 +18 97 151 22 40 52 2 5 5 2 2 1 22 40 52 26 108 161
41424 +90 154 193 37 112 160 22 40 52 3 4 3 13 20 25 22 30 35
41425 +3 6 7 1 1 1 2 2 2 6 9 11 5 5 5 4 3 3
41426 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
41427 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41428 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41429 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41430 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41431 +4 4 4 4 4 4
41432 +1 1 1 4 0 0 60 73 81 177 184 187 193 200 203 174 174 174
41433 +177 184 187 193 200 203 163 162 163 30 32 34 4 0 0 2 2 2
41434 +5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
41435 +10 87 144 10 87 144 19 95 150 19 95 150 19 95 150 18 97 151
41436 +26 108 161 26 108 161 26 108 161 90 154 193 26 108 161 28 67 93
41437 +6 10 14 2 5 5 13 20 25 24 86 132 37 112 160 90 154 193
41438 +10 87 144 7 12 15 2 5 5 28 67 93 37 112 160 28 67 93
41439 +2 2 1 7 12 15 35 83 115 28 67 93 3 6 7 1 0 0
41440 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
41441 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41442 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41443 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41444 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41445 +4 4 4 4 4 4
41446 +4 0 0 4 0 0 60 73 81 174 174 174 190 197 201 174 174 174
41447 +177 184 187 193 200 203 163 162 163 30 32 34 0 0 0 2 2 2
41448 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
41449 +10 87 144 16 89 141 19 95 150 10 87 144 26 108 161 26 108 161
41450 +26 108 161 26 108 161 26 108 161 28 67 93 6 10 14 1 1 2
41451 +7 12 15 28 67 93 26 108 161 16 89 141 24 86 132 21 29 34
41452 +3 4 3 21 29 34 37 112 160 37 112 160 27 99 146 21 29 34
41453 +21 29 34 26 108 161 90 154 193 35 83 115 1 1 2 2 0 0
41454 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
41455 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41456 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41457 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41458 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41459 +4 4 4 4 4 4
41460 +3 1 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
41461 +190 197 201 193 200 203 165 164 165 37 38 37 4 0 0 2 2 2
41462 +5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
41463 +10 87 144 10 87 144 16 89 141 18 97 151 18 97 151 10 87 144
41464 +24 86 132 24 86 132 13 20 25 4 5 7 4 5 7 22 40 52
41465 +18 97 151 37 112 160 26 108 161 7 12 15 1 1 1 0 0 0
41466 +28 67 93 37 112 160 26 108 161 28 67 93 22 40 52 28 67 93
41467 +26 108 161 90 154 193 26 108 161 10 87 144 0 0 0 2 0 0
41468 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
41469 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41470 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41471 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41472 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41473 +4 4 4 4 4 4
41474 +4 0 0 6 6 6 60 73 81 174 174 174 193 200 203 174 174 174
41475 +190 197 201 193 200 203 165 164 165 30 32 34 0 0 0 2 2 2
41476 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
41477 +10 87 144 10 87 144 10 87 144 18 97 151 28 67 93 6 10 14
41478 +0 0 0 1 1 2 4 5 7 13 20 25 16 89 141 26 108 161
41479 +26 108 161 26 108 161 24 86 132 6 9 11 2 3 3 22 40 52
41480 +37 112 160 16 89 141 22 40 52 28 67 93 26 108 161 26 108 161
41481 +90 154 193 26 108 161 26 108 161 28 67 93 1 1 1 4 0 0
41482 +4 4 4 5 5 5 3 3 3 4 0 0 26 28 28 124 126 130
41483 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41484 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41485 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41486 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41487 +4 4 4 4 4 4
41488 +4 0 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
41489 +193 200 203 193 200 203 167 166 167 37 38 37 4 0 0 2 2 2
41490 +5 5 5 4 4 4 4 0 0 6 10 14 28 67 93 10 87 144
41491 +10 87 144 10 87 144 18 97 151 10 87 144 13 20 25 4 5 7
41492 +1 1 2 1 1 1 22 40 52 26 108 161 26 108 161 26 108 161
41493 +26 108 161 26 108 161 26 108 161 24 86 132 22 40 52 22 40 52
41494 +22 40 52 22 40 52 10 87 144 26 108 161 26 108 161 26 108 161
41495 +26 108 161 26 108 161 90 154 193 10 87 144 0 0 0 4 0 0
41496 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
41497 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41498 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41499 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41500 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41501 +4 4 4 4 4 4
41502 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
41503 +190 197 201 205 212 215 167 166 167 30 32 34 0 0 0 2 2 2
41504 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
41505 +10 87 144 10 87 144 10 87 144 10 87 144 22 40 52 1 1 2
41506 +2 0 0 1 1 2 24 86 132 26 108 161 26 108 161 26 108 161
41507 +26 108 161 19 95 150 16 89 141 10 87 144 22 40 52 22 40 52
41508 +10 87 144 26 108 161 37 112 160 26 108 161 26 108 161 26 108 161
41509 +26 108 161 26 108 161 26 108 161 28 67 93 2 0 0 3 1 0
41510 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
41511 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41512 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41513 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41514 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41515 +4 4 4 4 4 4
41516 +4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
41517 +193 200 203 193 200 203 174 174 174 37 38 37 4 0 0 2 2 2
41518 +5 5 5 4 4 4 3 2 2 1 1 2 13 20 25 10 87 144
41519 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 13 20 25
41520 +13 20 25 22 40 52 10 87 144 18 97 151 18 97 151 26 108 161
41521 +10 87 144 13 20 25 6 10 14 21 29 34 24 86 132 18 97 151
41522 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
41523 +26 108 161 90 154 193 18 97 151 13 20 25 0 0 0 4 3 3
41524 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
41525 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41526 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41527 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41528 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41529 +4 4 4 4 4 4
41530 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
41531 +190 197 201 220 221 221 167 166 167 30 32 34 1 0 0 2 2 2
41532 +5 5 5 4 4 4 4 4 5 2 5 5 4 5 7 13 20 25
41533 +28 67 93 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
41534 +10 87 144 10 87 144 18 97 151 10 87 144 18 97 151 18 97 151
41535 +28 67 93 2 3 3 0 0 0 28 67 93 26 108 161 26 108 161
41536 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
41537 +26 108 161 10 87 144 13 20 25 1 1 2 3 2 2 4 4 4
41538 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
41539 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41540 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41541 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41542 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41543 +4 4 4 4 4 4
41544 +4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
41545 +193 200 203 193 200 203 174 174 174 26 28 28 4 0 0 4 3 3
41546 +5 5 5 4 4 4 4 4 4 4 4 5 1 1 2 2 5 5
41547 +4 5 7 22 40 52 10 87 144 10 87 144 18 97 151 10 87 144
41548 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 18 97 151
41549 +10 87 144 28 67 93 22 40 52 10 87 144 26 108 161 18 97 151
41550 +18 97 151 18 97 151 26 108 161 26 108 161 26 108 161 26 108 161
41551 +22 40 52 1 1 2 0 0 0 2 3 3 4 4 4 4 4 4
41552 +4 4 4 5 5 5 4 4 4 0 0 0 26 28 28 131 129 131
41553 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41554 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41555 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41556 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41557 +4 4 4 4 4 4
41558 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
41559 +190 197 201 220 221 221 190 197 201 41 54 63 4 0 0 2 2 2
41560 +6 6 6 4 4 4 4 4 4 4 4 5 4 4 5 3 3 3
41561 +1 1 2 1 1 2 6 10 14 22 40 52 10 87 144 18 97 151
41562 +18 97 151 10 87 144 10 87 144 10 87 144 18 97 151 10 87 144
41563 +10 87 144 18 97 151 26 108 161 18 97 151 18 97 151 10 87 144
41564 +26 108 161 26 108 161 26 108 161 10 87 144 28 67 93 6 10 14
41565 +1 1 2 1 1 2 4 3 3 4 4 5 4 4 4 4 4 4
41566 +5 5 5 5 5 5 1 1 1 4 0 0 37 51 59 137 136 137
41567 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41568 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41569 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41570 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41571 +4 4 4 4 4 4
41572 +4 0 0 4 0 0 60 73 81 220 221 221 193 200 203 174 174 174
41573 +193 200 203 193 200 203 220 221 221 137 136 137 13 16 17 4 0 0
41574 +2 2 2 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5
41575 +4 4 5 4 3 3 1 1 2 4 5 7 13 20 25 28 67 93
41576 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
41577 +10 87 144 18 97 151 18 97 151 10 87 144 18 97 151 26 108 161
41578 +26 108 161 18 97 151 28 67 93 6 10 14 0 0 0 0 0 0
41579 +2 3 3 4 5 5 4 4 5 4 4 4 4 4 4 5 5 5
41580 +3 3 3 1 1 1 0 0 0 16 19 21 125 124 125 137 136 137
41581 +131 129 131 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41582 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41583 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41584 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41585 +4 4 4 4 4 4
41586 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
41587 +193 200 203 190 197 201 220 221 221 220 221 221 153 152 153 30 32 34
41588 +0 0 0 0 0 0 2 2 2 4 4 4 4 4 4 4 4 4
41589 +4 4 4 4 5 5 4 5 7 1 1 2 1 1 2 4 5 7
41590 +13 20 25 28 67 93 10 87 144 18 97 151 10 87 144 10 87 144
41591 +10 87 144 10 87 144 10 87 144 18 97 151 26 108 161 18 97 151
41592 +28 67 93 7 12 15 0 0 0 0 0 0 2 2 1 4 4 4
41593 +4 5 5 4 5 5 4 4 4 4 4 4 3 3 3 0 0 0
41594 +0 0 0 0 0 0 37 38 37 125 124 125 158 157 158 131 129 131
41595 +125 124 125 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
41596 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41597 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41598 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41599 +4 4 4 4 4 4
41600 +4 3 3 4 0 0 41 54 63 193 200 203 220 221 221 174 174 174
41601 +193 200 203 193 200 203 193 200 203 220 221 221 244 246 246 193 200 203
41602 +120 125 127 5 5 5 1 0 0 0 0 0 1 1 1 4 4 4
41603 +4 4 4 4 4 4 4 5 5 4 5 5 4 4 5 1 1 2
41604 +4 5 7 4 5 7 22 40 52 10 87 144 10 87 144 10 87 144
41605 +10 87 144 10 87 144 18 97 151 10 87 144 10 87 144 13 20 25
41606 +4 5 7 2 3 3 1 1 2 4 4 4 4 5 5 4 4 4
41607 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 1 2
41608 +24 26 27 60 74 84 153 152 153 163 162 163 137 136 137 125 124 125
41609 +125 124 125 125 124 125 125 124 125 137 136 137 125 124 125 26 28 28
41610 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41611 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41612 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41613 +4 4 4 4 4 4
41614 +4 0 0 6 6 6 26 28 28 156 155 156 220 221 221 220 221 221
41615 +174 174 174 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
41616 +220 221 221 167 166 167 60 73 81 7 11 13 0 0 0 0 0 0
41617 +3 3 3 4 4 4 4 4 4 4 4 4 4 4 5 4 4 5
41618 +4 4 5 1 1 2 1 1 2 4 5 7 22 40 52 10 87 144
41619 +10 87 144 10 87 144 10 87 144 22 40 52 4 5 7 1 1 2
41620 +1 1 2 4 4 5 4 4 4 4 4 4 4 4 4 4 4 4
41621 +5 5 5 2 2 2 0 0 0 4 0 0 16 19 21 60 73 81
41622 +137 136 137 167 166 167 158 157 158 137 136 137 131 129 131 131 129 131
41623 +125 124 125 125 124 125 131 129 131 155 154 155 60 74 84 5 7 8
41624 +0 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41625 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41626 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41627 +4 4 4 4 4 4
41628 +5 5 5 4 0 0 4 0 0 60 73 81 193 200 203 220 221 221
41629 +193 200 203 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
41630 +220 221 221 220 221 221 220 221 221 137 136 137 43 57 68 6 6 6
41631 +4 0 0 1 1 1 4 4 4 4 4 4 4 4 4 4 4 4
41632 +4 4 5 4 4 5 3 2 2 1 1 2 2 5 5 13 20 25
41633 +22 40 52 22 40 52 13 20 25 2 3 3 1 1 2 3 3 3
41634 +4 5 7 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41635 +1 1 1 0 0 0 2 3 3 41 54 63 131 129 131 166 165 166
41636 +166 165 166 155 154 155 153 152 153 137 136 137 137 136 137 125 124 125
41637 +125 124 125 137 136 137 137 136 137 125 124 125 37 38 37 4 3 3
41638 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41639 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41640 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41641 +4 4 4 4 4 4
41642 +4 3 3 6 6 6 6 6 6 13 16 17 60 73 81 167 166 167
41643 +220 221 221 220 221 221 220 221 221 193 200 203 193 200 203 193 200 203
41644 +205 212 215 220 221 221 220 221 221 244 246 246 205 212 215 125 124 125
41645 +24 26 27 0 0 0 0 0 0 2 2 2 5 5 5 5 5 5
41646 +4 4 4 4 4 4 4 4 4 4 4 5 1 1 2 4 5 7
41647 +4 5 7 4 5 7 1 1 2 3 2 2 4 4 5 4 4 4
41648 +4 4 4 4 4 4 5 5 5 4 4 4 0 0 0 0 0 0
41649 +2 0 0 26 28 28 125 124 125 174 174 174 174 174 174 166 165 166
41650 +156 155 156 153 152 153 137 136 137 137 136 137 131 129 131 137 136 137
41651 +137 136 137 137 136 137 60 74 84 30 32 34 4 0 0 4 0 0
41652 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41653 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41654 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41655 +4 4 4 4 4 4
41656 +5 5 5 6 6 6 4 0 0 4 0 0 6 6 6 26 28 28
41657 +125 124 125 174 174 174 220 221 221 220 221 221 220 221 221 193 200 203
41658 +205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
41659 +193 200 203 60 74 84 13 16 17 4 0 0 0 0 0 3 3 3
41660 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 5 3 3 3
41661 +1 1 2 3 3 3 4 4 5 4 4 5 4 4 4 4 4 4
41662 +5 5 5 5 5 5 2 2 2 0 0 0 0 0 0 13 16 17
41663 +60 74 84 174 174 174 193 200 203 174 174 174 167 166 167 163 162 163
41664 +153 152 153 153 152 153 137 136 137 137 136 137 153 152 153 137 136 137
41665 +125 124 125 41 54 63 24 26 27 4 0 0 4 0 0 5 5 5
41666 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41667 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41668 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41669 +4 4 4 4 4 4
41670 +4 3 3 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
41671 +6 6 6 37 38 37 131 129 131 220 221 221 220 221 221 220 221 221
41672 +193 200 203 193 200 203 220 221 221 205 212 215 220 221 221 244 246 246
41673 +244 246 246 244 246 246 174 174 174 41 54 63 0 0 0 0 0 0
41674 +0 0 0 4 4 4 5 5 5 5 5 5 4 4 4 4 4 5
41675 +4 4 5 4 4 5 4 4 4 4 4 4 6 6 6 6 6 6
41676 +3 3 3 0 0 0 2 0 0 13 16 17 60 73 81 156 155 156
41677 +220 221 221 193 200 203 174 174 174 165 164 165 163 162 163 154 153 154
41678 +153 152 153 153 152 153 158 157 158 163 162 163 137 136 137 60 73 81
41679 +13 16 17 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
41680 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41681 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41682 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41683 +4 4 4 4 4 4
41684 +5 5 5 4 3 3 4 3 3 6 6 6 6 6 6 6 6 6
41685 +6 6 6 6 6 6 6 6 6 37 38 37 167 166 167 244 246 246
41686 +244 246 246 220 221 221 205 212 215 205 212 215 220 221 221 193 200 203
41687 +220 221 221 244 246 246 244 246 246 244 246 246 137 136 137 37 38 37
41688 +3 2 2 0 0 0 1 1 1 5 5 5 5 5 5 4 4 4
41689 +4 4 4 4 4 4 4 4 4 5 5 5 4 4 4 1 1 1
41690 +0 0 0 5 5 5 43 57 68 153 152 153 193 200 203 220 221 221
41691 +177 184 187 174 174 174 167 166 167 166 165 166 158 157 158 157 156 157
41692 +158 157 158 166 165 166 156 155 156 85 115 134 13 16 17 4 0 0
41693 +4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
41694 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41695 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41696 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41697 +4 4 4 4 4 4
41698 +5 5 5 4 3 3 6 6 6 6 6 6 4 0 0 6 6 6
41699 +6 6 6 6 6 6 6 6 6 6 6 6 13 16 17 60 73 81
41700 +177 184 187 220 221 221 220 221 221 220 221 221 205 212 215 220 221 221
41701 +220 221 221 205 212 215 220 221 221 244 246 246 244 246 246 205 212 215
41702 +125 124 125 30 32 34 0 0 0 0 0 0 2 2 2 5 5 5
41703 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 0 0
41704 +37 38 37 131 129 131 205 212 215 220 221 221 193 200 203 174 174 174
41705 +174 174 174 174 174 174 167 166 167 165 164 165 166 165 166 167 166 167
41706 +158 157 158 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
41707 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41708 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41709 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41710 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41711 +4 4 4 4 4 4
41712 +4 4 4 5 5 5 4 3 3 4 3 3 6 6 6 6 6 6
41713 +4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
41714 +26 28 28 125 124 125 205 212 215 220 221 221 220 221 221 220 221 221
41715 +205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
41716 +244 246 246 190 197 201 60 74 84 16 19 21 4 0 0 0 0 0
41717 +0 0 0 0 0 0 0 0 0 0 0 0 16 19 21 120 125 127
41718 +177 184 187 220 221 221 205 212 215 177 184 187 174 174 174 177 184 187
41719 +174 174 174 174 174 174 167 166 167 174 174 174 166 165 166 137 136 137
41720 +60 73 81 13 16 17 4 0 0 4 0 0 4 3 3 6 6 6
41721 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41722 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41723 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41724 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41725 +4 4 4 4 4 4
41726 +5 5 5 4 3 3 5 5 5 4 3 3 6 6 6 4 0 0
41727 +6 6 6 6 6 6 4 0 0 6 6 6 4 0 0 6 6 6
41728 +6 6 6 6 6 6 37 38 37 137 136 137 193 200 203 220 221 221
41729 +220 221 221 205 212 215 220 221 221 205 212 215 205 212 215 220 221 221
41730 +220 221 221 220 221 221 244 246 246 166 165 166 43 57 68 2 2 2
41731 +0 0 0 4 0 0 16 19 21 60 73 81 157 156 157 202 210 214
41732 +220 221 221 193 200 203 177 184 187 177 184 187 177 184 187 174 174 174
41733 +174 174 174 174 174 174 174 174 174 157 156 157 60 74 84 24 26 27
41734 +4 0 0 4 0 0 4 0 0 6 6 6 4 4 4 4 4 4
41735 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41736 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41737 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41738 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41739 +4 4 4 4 4 4
41740 +4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
41741 +6 6 6 4 0 0 6 6 6 6 6 6 6 6 6 4 0 0
41742 +4 0 0 4 0 0 6 6 6 24 26 27 60 73 81 167 166 167
41743 +220 221 221 220 221 221 220 221 221 205 212 215 205 212 215 205 212 215
41744 +205 212 215 220 221 221 220 221 221 220 221 221 205 212 215 137 136 137
41745 +60 74 84 125 124 125 137 136 137 190 197 201 220 221 221 193 200 203
41746 +177 184 187 177 184 187 177 184 187 174 174 174 174 174 174 177 184 187
41747 +190 197 201 174 174 174 125 124 125 37 38 37 6 6 6 4 0 0
41748 +4 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41749 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41750 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41751 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41752 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41753 +4 4 4 4 4 4
41754 +4 4 4 4 4 4 5 5 5 5 5 5 4 3 3 6 6 6
41755 +4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 6 6 6
41756 +6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
41757 +125 124 125 193 200 203 244 246 246 220 221 221 205 212 215 205 212 215
41758 +205 212 215 193 200 203 205 212 215 205 212 215 220 221 221 220 221 221
41759 +193 200 203 193 200 203 205 212 215 193 200 203 193 200 203 177 184 187
41760 +190 197 201 190 197 201 174 174 174 190 197 201 193 200 203 190 197 201
41761 +153 152 153 60 73 81 4 0 0 4 0 0 4 0 0 3 2 2
41762 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41763 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41764 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41765 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41766 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41767 +4 4 4 4 4 4
41768 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
41769 +6 6 6 4 3 3 4 3 3 4 3 3 6 6 6 6 6 6
41770 +4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 4 0 0
41771 +4 0 0 26 28 28 131 129 131 220 221 221 244 246 246 220 221 221
41772 +205 212 215 193 200 203 205 212 215 193 200 203 193 200 203 205 212 215
41773 +220 221 221 193 200 203 193 200 203 193 200 203 190 197 201 174 174 174
41774 +174 174 174 190 197 201 193 200 203 193 200 203 167 166 167 125 124 125
41775 +6 6 6 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
41776 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41777 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41778 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41779 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41780 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41781 +4 4 4 4 4 4
41782 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41783 +5 5 5 4 3 3 5 5 5 6 6 6 4 3 3 5 5 5
41784 +6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
41785 +4 0 0 4 0 0 6 6 6 41 54 63 158 157 158 220 221 221
41786 +220 221 221 220 221 221 193 200 203 193 200 203 193 200 203 190 197 201
41787 +190 197 201 190 197 201 190 197 201 190 197 201 174 174 174 193 200 203
41788 +193 200 203 220 221 221 174 174 174 125 124 125 37 38 37 4 0 0
41789 +4 0 0 4 3 3 6 6 6 4 4 4 4 4 4 4 4 4
41790 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41791 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41792 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41793 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41794 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41795 +4 4 4 4 4 4
41796 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41797 +4 4 4 5 5 5 4 3 3 4 3 3 4 3 3 5 5 5
41798 +4 3 3 6 6 6 5 5 5 4 3 3 6 6 6 6 6 6
41799 +6 6 6 6 6 6 4 0 0 4 0 0 13 16 17 60 73 81
41800 +174 174 174 220 221 221 220 221 221 205 212 215 190 197 201 174 174 174
41801 +193 200 203 174 174 174 190 197 201 174 174 174 193 200 203 220 221 221
41802 +193 200 203 131 129 131 37 38 37 6 6 6 4 0 0 4 0 0
41803 +6 6 6 6 6 6 4 3 3 5 5 5 4 4 4 4 4 4
41804 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41805 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41806 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41807 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41808 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41809 +4 4 4 4 4 4
41810 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41811 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
41812 +5 5 5 4 3 3 4 3 3 5 5 5 4 3 3 4 3 3
41813 +5 5 5 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
41814 +6 6 6 125 124 125 174 174 174 220 221 221 220 221 221 193 200 203
41815 +193 200 203 193 200 203 193 200 203 193 200 203 220 221 221 158 157 158
41816 +60 73 81 6 6 6 4 0 0 4 0 0 5 5 5 6 6 6
41817 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41818 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41819 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41820 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41821 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41822 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41823 +4 4 4 4 4 4
41824 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41825 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41826 +4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
41827 +5 5 5 5 5 5 6 6 6 6 6 6 4 0 0 4 0 0
41828 +4 0 0 4 0 0 26 28 28 125 124 125 174 174 174 193 200 203
41829 +193 200 203 174 174 174 193 200 203 167 166 167 125 124 125 6 6 6
41830 +6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 5 5 5
41831 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
41832 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41833 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41834 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41835 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41836 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41837 +4 4 4 4 4 4
41838 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41839 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41840 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41841 +4 3 3 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
41842 +6 6 6 4 0 0 4 0 0 6 6 6 37 38 37 125 124 125
41843 +153 152 153 131 129 131 125 124 125 37 38 37 6 6 6 6 6 6
41844 +6 6 6 4 0 0 6 6 6 6 6 6 4 3 3 5 5 5
41845 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41846 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41847 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41848 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41849 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41850 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41851 +4 4 4 4 4 4
41852 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41853 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41854 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41855 +4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
41856 +6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
41857 +24 26 27 24 26 27 6 6 6 6 6 6 6 6 6 4 0 0
41858 +6 6 6 6 6 6 4 0 0 6 6 6 5 5 5 4 3 3
41859 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41860 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41861 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41862 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41863 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41864 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41865 +4 4 4 4 4 4
41866 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41867 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41868 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41869 +4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
41870 +4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
41871 +6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
41872 +4 0 0 6 6 6 6 6 6 4 3 3 5 5 5 4 4 4
41873 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41874 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41875 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41876 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41877 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41878 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41879 +4 4 4 4 4 4
41880 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41881 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41882 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41883 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 5 5 5
41884 +5 5 5 5 5 5 4 0 0 6 6 6 4 0 0 6 6 6
41885 +6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 4 0 0
41886 +6 6 6 4 3 3 5 5 5 4 3 3 5 5 5 4 4 4
41887 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41888 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41889 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41890 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41891 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41892 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41893 +4 4 4 4 4 4
41894 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41895 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41896 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41897 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
41898 +4 3 3 6 6 6 4 3 3 6 6 6 6 6 6 6 6 6
41899 +4 0 0 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
41900 +6 6 6 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
41901 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41902 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41903 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41904 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41905 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41906 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41907 +4 4 4 4 4 4
41908 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41909 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41910 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41911 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41912 +4 4 4 5 5 5 4 3 3 5 5 5 4 0 0 6 6 6
41913 +6 6 6 4 0 0 6 6 6 6 6 6 4 0 0 6 6 6
41914 +4 3 3 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
41915 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41916 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41917 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41918 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41919 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41920 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41921 +4 4 4 4 4 4
41922 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41923 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41924 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41925 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41926 +4 4 4 5 5 5 4 3 3 5 5 5 6 6 6 4 3 3
41927 +4 3 3 6 6 6 6 6 6 4 3 3 6 6 6 4 3 3
41928 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41929 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41930 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41931 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41932 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41933 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41934 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41935 +4 4 4 4 4 4
41936 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41937 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41938 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41939 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41940 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 6 6 6
41941 +5 5 5 4 3 3 4 3 3 4 3 3 5 5 5 5 5 5
41942 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41943 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41944 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41945 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41946 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41947 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41948 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41949 +4 4 4 4 4 4
41950 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41951 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41952 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41953 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41954 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
41955 +5 5 5 4 3 3 5 5 5 5 5 5 4 4 4 4 4 4
41956 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41957 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41958 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41959 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41960 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41961 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41962 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
41963 +4 4 4 4 4 4
41964 diff --git a/drivers/video/udlfb.c b/drivers/video/udlfb.c
41965 index 8af6414..658c030 100644
41966 --- a/drivers/video/udlfb.c
41967 +++ b/drivers/video/udlfb.c
41968 @@ -620,11 +620,11 @@ int dlfb_handle_damage(struct dlfb_data *dev, int x, int y,
41969 dlfb_urb_completion(urb);
41970
41971 error:
41972 - atomic_add(bytes_sent, &dev->bytes_sent);
41973 - atomic_add(bytes_identical, &dev->bytes_identical);
41974 - atomic_add(width*height*2, &dev->bytes_rendered);
41975 + atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
41976 + atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
41977 + atomic_add_unchecked(width*height*2, &dev->bytes_rendered);
41978 end_cycles = get_cycles();
41979 - atomic_add(((unsigned int) ((end_cycles - start_cycles)
41980 + atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
41981 >> 10)), /* Kcycles */
41982 &dev->cpu_kcycles_used);
41983
41984 @@ -745,11 +745,11 @@ static void dlfb_dpy_deferred_io(struct fb_info *info,
41985 dlfb_urb_completion(urb);
41986
41987 error:
41988 - atomic_add(bytes_sent, &dev->bytes_sent);
41989 - atomic_add(bytes_identical, &dev->bytes_identical);
41990 - atomic_add(bytes_rendered, &dev->bytes_rendered);
41991 + atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
41992 + atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
41993 + atomic_add_unchecked(bytes_rendered, &dev->bytes_rendered);
41994 end_cycles = get_cycles();
41995 - atomic_add(((unsigned int) ((end_cycles - start_cycles)
41996 + atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
41997 >> 10)), /* Kcycles */
41998 &dev->cpu_kcycles_used);
41999 }
42000 @@ -1373,7 +1373,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev,
42001 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42002 struct dlfb_data *dev = fb_info->par;
42003 return snprintf(buf, PAGE_SIZE, "%u\n",
42004 - atomic_read(&dev->bytes_rendered));
42005 + atomic_read_unchecked(&dev->bytes_rendered));
42006 }
42007
42008 static ssize_t metrics_bytes_identical_show(struct device *fbdev,
42009 @@ -1381,7 +1381,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev,
42010 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42011 struct dlfb_data *dev = fb_info->par;
42012 return snprintf(buf, PAGE_SIZE, "%u\n",
42013 - atomic_read(&dev->bytes_identical));
42014 + atomic_read_unchecked(&dev->bytes_identical));
42015 }
42016
42017 static ssize_t metrics_bytes_sent_show(struct device *fbdev,
42018 @@ -1389,7 +1389,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev,
42019 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42020 struct dlfb_data *dev = fb_info->par;
42021 return snprintf(buf, PAGE_SIZE, "%u\n",
42022 - atomic_read(&dev->bytes_sent));
42023 + atomic_read_unchecked(&dev->bytes_sent));
42024 }
42025
42026 static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
42027 @@ -1397,7 +1397,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
42028 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42029 struct dlfb_data *dev = fb_info->par;
42030 return snprintf(buf, PAGE_SIZE, "%u\n",
42031 - atomic_read(&dev->cpu_kcycles_used));
42032 + atomic_read_unchecked(&dev->cpu_kcycles_used));
42033 }
42034
42035 static ssize_t edid_show(
42036 @@ -1457,10 +1457,10 @@ static ssize_t metrics_reset_store(struct device *fbdev,
42037 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42038 struct dlfb_data *dev = fb_info->par;
42039
42040 - atomic_set(&dev->bytes_rendered, 0);
42041 - atomic_set(&dev->bytes_identical, 0);
42042 - atomic_set(&dev->bytes_sent, 0);
42043 - atomic_set(&dev->cpu_kcycles_used, 0);
42044 + atomic_set_unchecked(&dev->bytes_rendered, 0);
42045 + atomic_set_unchecked(&dev->bytes_identical, 0);
42046 + atomic_set_unchecked(&dev->bytes_sent, 0);
42047 + atomic_set_unchecked(&dev->cpu_kcycles_used, 0);
42048
42049 return count;
42050 }
42051 diff --git a/drivers/video/uvesafb.c b/drivers/video/uvesafb.c
42052 index b0e2a42..e2df3ad 100644
42053 --- a/drivers/video/uvesafb.c
42054 +++ b/drivers/video/uvesafb.c
42055 @@ -19,6 +19,7 @@
42056 #include <linux/io.h>
42057 #include <linux/mutex.h>
42058 #include <linux/slab.h>
42059 +#include <linux/moduleloader.h>
42060 #include <video/edid.h>
42061 #include <video/uvesafb.h>
42062 #ifdef CONFIG_X86
42063 @@ -569,10 +570,32 @@ static int __devinit uvesafb_vbe_getpmi(struct uvesafb_ktask *task,
42064 if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
42065 par->pmi_setpal = par->ypan = 0;
42066 } else {
42067 +
42068 +#ifdef CONFIG_PAX_KERNEXEC
42069 +#ifdef CONFIG_MODULES
42070 + par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
42071 +#endif
42072 + if (!par->pmi_code) {
42073 + par->pmi_setpal = par->ypan = 0;
42074 + return 0;
42075 + }
42076 +#endif
42077 +
42078 par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
42079 + task->t.regs.edi);
42080 +
42081 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
42082 + pax_open_kernel();
42083 + memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
42084 + pax_close_kernel();
42085 +
42086 + par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
42087 + par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
42088 +#else
42089 par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
42090 par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
42091 +#endif
42092 +
42093 printk(KERN_INFO "uvesafb: protected mode interface info at "
42094 "%04x:%04x\n",
42095 (u16)task->t.regs.es, (u16)task->t.regs.edi);
42096 @@ -816,13 +839,14 @@ static int __devinit uvesafb_vbe_init(struct fb_info *info)
42097 par->ypan = ypan;
42098
42099 if (par->pmi_setpal || par->ypan) {
42100 +#if !defined(CONFIG_MODULES) || !defined(CONFIG_PAX_KERNEXEC)
42101 if (__supported_pte_mask & _PAGE_NX) {
42102 par->pmi_setpal = par->ypan = 0;
42103 printk(KERN_WARNING "uvesafb: NX protection is actively."
42104 "We have better not to use the PMI.\n");
42105 - } else {
42106 + } else
42107 +#endif
42108 uvesafb_vbe_getpmi(task, par);
42109 - }
42110 }
42111 #else
42112 /* The protected mode interface is not available on non-x86. */
42113 @@ -1836,6 +1860,11 @@ out:
42114 if (par->vbe_modes)
42115 kfree(par->vbe_modes);
42116
42117 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
42118 + if (par->pmi_code)
42119 + module_free_exec(NULL, par->pmi_code);
42120 +#endif
42121 +
42122 framebuffer_release(info);
42123 return err;
42124 }
42125 @@ -1862,6 +1891,12 @@ static int uvesafb_remove(struct platform_device *dev)
42126 kfree(par->vbe_state_orig);
42127 if (par->vbe_state_saved)
42128 kfree(par->vbe_state_saved);
42129 +
42130 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
42131 + if (par->pmi_code)
42132 + module_free_exec(NULL, par->pmi_code);
42133 +#endif
42134 +
42135 }
42136
42137 framebuffer_release(info);
42138 diff --git a/drivers/video/vesafb.c b/drivers/video/vesafb.c
42139 index 501b340..86bd4cf 100644
42140 --- a/drivers/video/vesafb.c
42141 +++ b/drivers/video/vesafb.c
42142 @@ -9,6 +9,7 @@
42143 */
42144
42145 #include <linux/module.h>
42146 +#include <linux/moduleloader.h>
42147 #include <linux/kernel.h>
42148 #include <linux/errno.h>
42149 #include <linux/string.h>
42150 @@ -52,8 +53,8 @@ static int vram_remap __initdata; /* Set amount of memory to be used */
42151 static int vram_total __initdata; /* Set total amount of memory */
42152 static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
42153 static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
42154 -static void (*pmi_start)(void) __read_mostly;
42155 -static void (*pmi_pal) (void) __read_mostly;
42156 +static void (*pmi_start)(void) __read_only;
42157 +static void (*pmi_pal) (void) __read_only;
42158 static int depth __read_mostly;
42159 static int vga_compat __read_mostly;
42160 /* --------------------------------------------------------------------- */
42161 @@ -233,6 +234,7 @@ static int __init vesafb_probe(struct platform_device *dev)
42162 unsigned int size_vmode;
42163 unsigned int size_remap;
42164 unsigned int size_total;
42165 + void *pmi_code = NULL;
42166
42167 if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
42168 return -ENODEV;
42169 @@ -275,10 +277,6 @@ static int __init vesafb_probe(struct platform_device *dev)
42170 size_remap = size_total;
42171 vesafb_fix.smem_len = size_remap;
42172
42173 -#ifndef __i386__
42174 - screen_info.vesapm_seg = 0;
42175 -#endif
42176 -
42177 if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
42178 printk(KERN_WARNING
42179 "vesafb: cannot reserve video memory at 0x%lx\n",
42180 @@ -307,9 +305,21 @@ static int __init vesafb_probe(struct platform_device *dev)
42181 printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
42182 vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
42183
42184 +#ifdef __i386__
42185 +
42186 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
42187 + pmi_code = module_alloc_exec(screen_info.vesapm_size);
42188 + if (!pmi_code)
42189 +#elif !defined(CONFIG_PAX_KERNEXEC)
42190 + if (0)
42191 +#endif
42192 +
42193 +#endif
42194 + screen_info.vesapm_seg = 0;
42195 +
42196 if (screen_info.vesapm_seg) {
42197 - printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
42198 - screen_info.vesapm_seg,screen_info.vesapm_off);
42199 + printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
42200 + screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
42201 }
42202
42203 if (screen_info.vesapm_seg < 0xc000)
42204 @@ -317,9 +327,25 @@ static int __init vesafb_probe(struct platform_device *dev)
42205
42206 if (ypan || pmi_setpal) {
42207 unsigned short *pmi_base;
42208 +
42209 pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
42210 - pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
42211 - pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
42212 +
42213 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
42214 + pax_open_kernel();
42215 + memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
42216 +#else
42217 + pmi_code = pmi_base;
42218 +#endif
42219 +
42220 + pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
42221 + pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
42222 +
42223 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
42224 + pmi_start = ktva_ktla(pmi_start);
42225 + pmi_pal = ktva_ktla(pmi_pal);
42226 + pax_close_kernel();
42227 +#endif
42228 +
42229 printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
42230 if (pmi_base[3]) {
42231 printk(KERN_INFO "vesafb: pmi: ports = ");
42232 @@ -488,6 +514,11 @@ static int __init vesafb_probe(struct platform_device *dev)
42233 info->node, info->fix.id);
42234 return 0;
42235 err:
42236 +
42237 +#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
42238 + module_free_exec(NULL, pmi_code);
42239 +#endif
42240 +
42241 if (info->screen_base)
42242 iounmap(info->screen_base);
42243 framebuffer_release(info);
42244 diff --git a/drivers/video/via/via_clock.h b/drivers/video/via/via_clock.h
42245 index 88714ae..16c2e11 100644
42246 --- a/drivers/video/via/via_clock.h
42247 +++ b/drivers/video/via/via_clock.h
42248 @@ -56,7 +56,7 @@ struct via_clock {
42249
42250 void (*set_engine_pll_state)(u8 state);
42251 void (*set_engine_pll)(struct via_pll_config config);
42252 -};
42253 +} __no_const;
42254
42255
42256 static inline u32 get_pll_internal_frequency(u32 ref_freq,
42257 diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
42258 index e56c934..fc22f4b 100644
42259 --- a/drivers/xen/xen-pciback/conf_space.h
42260 +++ b/drivers/xen/xen-pciback/conf_space.h
42261 @@ -44,15 +44,15 @@ struct config_field {
42262 struct {
42263 conf_dword_write write;
42264 conf_dword_read read;
42265 - } dw;
42266 + } __no_const dw;
42267 struct {
42268 conf_word_write write;
42269 conf_word_read read;
42270 - } w;
42271 + } __no_const w;
42272 struct {
42273 conf_byte_write write;
42274 conf_byte_read read;
42275 - } b;
42276 + } __no_const b;
42277 } u;
42278 struct list_head list;
42279 };
42280 diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
42281 index 57ccb75..f6d05f8 100644
42282 --- a/fs/9p/vfs_inode.c
42283 +++ b/fs/9p/vfs_inode.c
42284 @@ -1303,7 +1303,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd)
42285 void
42286 v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
42287 {
42288 - char *s = nd_get_link(nd);
42289 + const char *s = nd_get_link(nd);
42290
42291 p9_debug(P9_DEBUG_VFS, " %s %s\n",
42292 dentry->d_name.name, IS_ERR(s) ? "<error>" : s);
42293 diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
42294 index 0225742..1cd4732 100644
42295 --- a/fs/Kconfig.binfmt
42296 +++ b/fs/Kconfig.binfmt
42297 @@ -89,7 +89,7 @@ config HAVE_AOUT
42298
42299 config BINFMT_AOUT
42300 tristate "Kernel support for a.out and ECOFF binaries"
42301 - depends on HAVE_AOUT
42302 + depends on HAVE_AOUT && BROKEN
42303 ---help---
42304 A.out (Assembler.OUTput) is a set of formats for libraries and
42305 executables used in the earliest versions of UNIX. Linux used
42306 diff --git a/fs/aio.c b/fs/aio.c
42307 index 55c4c76..11aee6f 100644
42308 --- a/fs/aio.c
42309 +++ b/fs/aio.c
42310 @@ -118,7 +118,7 @@ static int aio_setup_ring(struct kioctx *ctx)
42311 size += sizeof(struct io_event) * nr_events;
42312 nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
42313
42314 - if (nr_pages < 0)
42315 + if (nr_pages <= 0)
42316 return -EINVAL;
42317
42318 nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
42319 @@ -1440,18 +1440,19 @@ static ssize_t aio_fsync(struct kiocb *iocb)
42320 static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
42321 {
42322 ssize_t ret;
42323 + struct iovec iovstack;
42324
42325 #ifdef CONFIG_COMPAT
42326 if (compat)
42327 ret = compat_rw_copy_check_uvector(type,
42328 (struct compat_iovec __user *)kiocb->ki_buf,
42329 - kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
42330 + kiocb->ki_nbytes, 1, &iovstack,
42331 &kiocb->ki_iovec);
42332 else
42333 #endif
42334 ret = rw_copy_check_uvector(type,
42335 (struct iovec __user *)kiocb->ki_buf,
42336 - kiocb->ki_nbytes, 1, &kiocb->ki_inline_vec,
42337 + kiocb->ki_nbytes, 1, &iovstack,
42338 &kiocb->ki_iovec);
42339 if (ret < 0)
42340 goto out;
42341 @@ -1460,6 +1461,10 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
42342 if (ret < 0)
42343 goto out;
42344
42345 + if (kiocb->ki_iovec == &iovstack) {
42346 + kiocb->ki_inline_vec = iovstack;
42347 + kiocb->ki_iovec = &kiocb->ki_inline_vec;
42348 + }
42349 kiocb->ki_nr_segs = kiocb->ki_nbytes;
42350 kiocb->ki_cur_seg = 0;
42351 /* ki_nbytes/left now reflect bytes instead of segs */
42352 diff --git a/fs/attr.c b/fs/attr.c
42353 index 0da9095..1386693 100644
42354 --- a/fs/attr.c
42355 +++ b/fs/attr.c
42356 @@ -99,6 +99,7 @@ int inode_newsize_ok(const struct inode *inode, loff_t offset)
42357 unsigned long limit;
42358
42359 limit = rlimit(RLIMIT_FSIZE);
42360 + gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
42361 if (limit != RLIM_INFINITY && offset > limit)
42362 goto out_sig;
42363 if (offset > inode->i_sb->s_maxbytes)
42364 diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
42365 index da8876d..4456166 100644
42366 --- a/fs/autofs4/waitq.c
42367 +++ b/fs/autofs4/waitq.c
42368 @@ -61,7 +61,7 @@ static int autofs4_write(struct autofs_sb_info *sbi,
42369 {
42370 unsigned long sigpipe, flags;
42371 mm_segment_t fs;
42372 - const char *data = (const char *)addr;
42373 + const char __user *data = (const char __force_user *)addr;
42374 ssize_t wr = 0;
42375
42376 sigpipe = sigismember(&current->pending.signal, SIGPIPE);
42377 @@ -348,6 +348,10 @@ static int validate_request(struct autofs_wait_queue **wait,
42378 return 1;
42379 }
42380
42381 +#ifdef CONFIG_GRKERNSEC_HIDESYM
42382 +static atomic_unchecked_t autofs_dummy_name_id = ATOMIC_INIT(0);
42383 +#endif
42384 +
42385 int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
42386 enum autofs_notify notify)
42387 {
42388 @@ -381,7 +385,12 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
42389
42390 /* If this is a direct mount request create a dummy name */
42391 if (IS_ROOT(dentry) && autofs_type_trigger(sbi->type))
42392 +#ifdef CONFIG_GRKERNSEC_HIDESYM
42393 + /* this name does get written to userland via autofs4_write() */
42394 + qstr.len = sprintf(name, "%08lx", atomic_inc_return_unchecked(&autofs_dummy_name_id));
42395 +#else
42396 qstr.len = sprintf(name, "%p", dentry);
42397 +#endif
42398 else {
42399 qstr.len = autofs4_getpath(sbi, dentry, &name);
42400 if (!qstr.len) {
42401 diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
42402 index e18da23..affc30e 100644
42403 --- a/fs/befs/linuxvfs.c
42404 +++ b/fs/befs/linuxvfs.c
42405 @@ -502,7 +502,7 @@ static void befs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
42406 {
42407 befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
42408 if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
42409 - char *link = nd_get_link(nd);
42410 + const char *link = nd_get_link(nd);
42411 if (!IS_ERR(link))
42412 kfree(link);
42413 }
42414 diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
42415 index d146e18..12d1bd1 100644
42416 --- a/fs/binfmt_aout.c
42417 +++ b/fs/binfmt_aout.c
42418 @@ -16,6 +16,7 @@
42419 #include <linux/string.h>
42420 #include <linux/fs.h>
42421 #include <linux/file.h>
42422 +#include <linux/security.h>
42423 #include <linux/stat.h>
42424 #include <linux/fcntl.h>
42425 #include <linux/ptrace.h>
42426 @@ -83,6 +84,8 @@ static int aout_core_dump(struct coredump_params *cprm)
42427 #endif
42428 # define START_STACK(u) ((void __user *)u.start_stack)
42429
42430 + memset(&dump, 0, sizeof(dump));
42431 +
42432 fs = get_fs();
42433 set_fs(KERNEL_DS);
42434 has_dumped = 1;
42435 @@ -94,10 +97,12 @@ static int aout_core_dump(struct coredump_params *cprm)
42436
42437 /* If the size of the dump file exceeds the rlimit, then see what would happen
42438 if we wrote the stack, but not the data area. */
42439 + gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
42440 if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > cprm->limit)
42441 dump.u_dsize = 0;
42442
42443 /* Make sure we have enough room to write the stack and data areas. */
42444 + gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
42445 if ((dump.u_ssize + 1) * PAGE_SIZE > cprm->limit)
42446 dump.u_ssize = 0;
42447
42448 @@ -231,6 +236,8 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
42449 rlim = rlimit(RLIMIT_DATA);
42450 if (rlim >= RLIM_INFINITY)
42451 rlim = ~0;
42452 +
42453 + gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
42454 if (ex.a_data + ex.a_bss > rlim)
42455 return -ENOMEM;
42456
42457 @@ -265,6 +272,27 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
42458
42459 install_exec_creds(bprm);
42460
42461 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
42462 + current->mm->pax_flags = 0UL;
42463 +#endif
42464 +
42465 +#ifdef CONFIG_PAX_PAGEEXEC
42466 + if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
42467 + current->mm->pax_flags |= MF_PAX_PAGEEXEC;
42468 +
42469 +#ifdef CONFIG_PAX_EMUTRAMP
42470 + if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
42471 + current->mm->pax_flags |= MF_PAX_EMUTRAMP;
42472 +#endif
42473 +
42474 +#ifdef CONFIG_PAX_MPROTECT
42475 + if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
42476 + current->mm->pax_flags |= MF_PAX_MPROTECT;
42477 +#endif
42478 +
42479 + }
42480 +#endif
42481 +
42482 if (N_MAGIC(ex) == OMAGIC) {
42483 unsigned long text_addr, map_size;
42484 loff_t pos;
42485 @@ -330,7 +358,7 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
42486 }
42487
42488 error = vm_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
42489 - PROT_READ | PROT_WRITE | PROT_EXEC,
42490 + PROT_READ | PROT_WRITE,
42491 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
42492 fd_offset + ex.a_text);
42493 if (error != N_DATADDR(ex)) {
42494 diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
42495 index 1b52956..271266e 100644
42496 --- a/fs/binfmt_elf.c
42497 +++ b/fs/binfmt_elf.c
42498 @@ -32,6 +32,7 @@
42499 #include <linux/elf.h>
42500 #include <linux/utsname.h>
42501 #include <linux/coredump.h>
42502 +#include <linux/xattr.h>
42503 #include <asm/uaccess.h>
42504 #include <asm/param.h>
42505 #include <asm/page.h>
42506 @@ -52,6 +53,10 @@ static int elf_core_dump(struct coredump_params *cprm);
42507 #define elf_core_dump NULL
42508 #endif
42509
42510 +#ifdef CONFIG_PAX_MPROTECT
42511 +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
42512 +#endif
42513 +
42514 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
42515 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
42516 #else
42517 @@ -71,6 +76,11 @@ static struct linux_binfmt elf_format = {
42518 .load_binary = load_elf_binary,
42519 .load_shlib = load_elf_library,
42520 .core_dump = elf_core_dump,
42521 +
42522 +#ifdef CONFIG_PAX_MPROTECT
42523 + .handle_mprotect= elf_handle_mprotect,
42524 +#endif
42525 +
42526 .min_coredump = ELF_EXEC_PAGESIZE,
42527 };
42528
42529 @@ -78,6 +88,8 @@ static struct linux_binfmt elf_format = {
42530
42531 static int set_brk(unsigned long start, unsigned long end)
42532 {
42533 + unsigned long e = end;
42534 +
42535 start = ELF_PAGEALIGN(start);
42536 end = ELF_PAGEALIGN(end);
42537 if (end > start) {
42538 @@ -86,7 +98,7 @@ static int set_brk(unsigned long start, unsigned long end)
42539 if (BAD_ADDR(addr))
42540 return addr;
42541 }
42542 - current->mm->start_brk = current->mm->brk = end;
42543 + current->mm->start_brk = current->mm->brk = e;
42544 return 0;
42545 }
42546
42547 @@ -147,12 +159,13 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
42548 elf_addr_t __user *u_rand_bytes;
42549 const char *k_platform = ELF_PLATFORM;
42550 const char *k_base_platform = ELF_BASE_PLATFORM;
42551 - unsigned char k_rand_bytes[16];
42552 + u32 k_rand_bytes[4];
42553 int items;
42554 elf_addr_t *elf_info;
42555 int ei_index = 0;
42556 const struct cred *cred = current_cred();
42557 struct vm_area_struct *vma;
42558 + unsigned long saved_auxv[AT_VECTOR_SIZE];
42559
42560 /*
42561 * In some cases (e.g. Hyper-Threading), we want to avoid L1
42562 @@ -194,8 +207,12 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
42563 * Generate 16 random bytes for userspace PRNG seeding.
42564 */
42565 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
42566 - u_rand_bytes = (elf_addr_t __user *)
42567 - STACK_ALLOC(p, sizeof(k_rand_bytes));
42568 + srandom32(k_rand_bytes[0] ^ random32());
42569 + srandom32(k_rand_bytes[1] ^ random32());
42570 + srandom32(k_rand_bytes[2] ^ random32());
42571 + srandom32(k_rand_bytes[3] ^ random32());
42572 + p = STACK_ROUND(p, sizeof(k_rand_bytes));
42573 + u_rand_bytes = (elf_addr_t __user *) p;
42574 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
42575 return -EFAULT;
42576
42577 @@ -307,9 +324,11 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
42578 return -EFAULT;
42579 current->mm->env_end = p;
42580
42581 + memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
42582 +
42583 /* Put the elf_info on the stack in the right place. */
42584 sp = (elf_addr_t __user *)envp + 1;
42585 - if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
42586 + if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
42587 return -EFAULT;
42588 return 0;
42589 }
42590 @@ -378,10 +397,10 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
42591 {
42592 struct elf_phdr *elf_phdata;
42593 struct elf_phdr *eppnt;
42594 - unsigned long load_addr = 0;
42595 + unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
42596 int load_addr_set = 0;
42597 unsigned long last_bss = 0, elf_bss = 0;
42598 - unsigned long error = ~0UL;
42599 + unsigned long error = -EINVAL;
42600 unsigned long total_size;
42601 int retval, i, size;
42602
42603 @@ -427,6 +446,11 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
42604 goto out_close;
42605 }
42606
42607 +#ifdef CONFIG_PAX_SEGMEXEC
42608 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
42609 + pax_task_size = SEGMEXEC_TASK_SIZE;
42610 +#endif
42611 +
42612 eppnt = elf_phdata;
42613 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
42614 if (eppnt->p_type == PT_LOAD) {
42615 @@ -470,8 +494,8 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
42616 k = load_addr + eppnt->p_vaddr;
42617 if (BAD_ADDR(k) ||
42618 eppnt->p_filesz > eppnt->p_memsz ||
42619 - eppnt->p_memsz > TASK_SIZE ||
42620 - TASK_SIZE - eppnt->p_memsz < k) {
42621 + eppnt->p_memsz > pax_task_size ||
42622 + pax_task_size - eppnt->p_memsz < k) {
42623 error = -ENOMEM;
42624 goto out_close;
42625 }
42626 @@ -523,6 +547,311 @@ out:
42627 return error;
42628 }
42629
42630 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
42631 +#ifdef CONFIG_PAX_SOFTMODE
42632 +static unsigned long pax_parse_pt_pax_softmode(const struct elf_phdr * const elf_phdata)
42633 +{
42634 + unsigned long pax_flags = 0UL;
42635 +
42636 +#ifdef CONFIG_PAX_PAGEEXEC
42637 + if (elf_phdata->p_flags & PF_PAGEEXEC)
42638 + pax_flags |= MF_PAX_PAGEEXEC;
42639 +#endif
42640 +
42641 +#ifdef CONFIG_PAX_SEGMEXEC
42642 + if (elf_phdata->p_flags & PF_SEGMEXEC)
42643 + pax_flags |= MF_PAX_SEGMEXEC;
42644 +#endif
42645 +
42646 +#ifdef CONFIG_PAX_EMUTRAMP
42647 + if (elf_phdata->p_flags & PF_EMUTRAMP)
42648 + pax_flags |= MF_PAX_EMUTRAMP;
42649 +#endif
42650 +
42651 +#ifdef CONFIG_PAX_MPROTECT
42652 + if (elf_phdata->p_flags & PF_MPROTECT)
42653 + pax_flags |= MF_PAX_MPROTECT;
42654 +#endif
42655 +
42656 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
42657 + if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
42658 + pax_flags |= MF_PAX_RANDMMAP;
42659 +#endif
42660 +
42661 + return pax_flags;
42662 +}
42663 +#endif
42664 +
42665 +static unsigned long pax_parse_pt_pax_hardmode(const struct elf_phdr * const elf_phdata)
42666 +{
42667 + unsigned long pax_flags = 0UL;
42668 +
42669 +#ifdef CONFIG_PAX_PAGEEXEC
42670 + if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
42671 + pax_flags |= MF_PAX_PAGEEXEC;
42672 +#endif
42673 +
42674 +#ifdef CONFIG_PAX_SEGMEXEC
42675 + if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
42676 + pax_flags |= MF_PAX_SEGMEXEC;
42677 +#endif
42678 +
42679 +#ifdef CONFIG_PAX_EMUTRAMP
42680 + if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
42681 + pax_flags |= MF_PAX_EMUTRAMP;
42682 +#endif
42683 +
42684 +#ifdef CONFIG_PAX_MPROTECT
42685 + if (!(elf_phdata->p_flags & PF_NOMPROTECT))
42686 + pax_flags |= MF_PAX_MPROTECT;
42687 +#endif
42688 +
42689 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
42690 + if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
42691 + pax_flags |= MF_PAX_RANDMMAP;
42692 +#endif
42693 +
42694 + return pax_flags;
42695 +}
42696 +#endif
42697 +
42698 +#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
42699 +#ifdef CONFIG_PAX_SOFTMODE
42700 +static unsigned long pax_parse_xattr_pax_softmode(unsigned long pax_flags_softmode)
42701 +{
42702 + unsigned long pax_flags = 0UL;
42703 +
42704 +#ifdef CONFIG_PAX_PAGEEXEC
42705 + if (pax_flags_softmode & MF_PAX_PAGEEXEC)
42706 + pax_flags |= MF_PAX_PAGEEXEC;
42707 +#endif
42708 +
42709 +#ifdef CONFIG_PAX_SEGMEXEC
42710 + if (pax_flags_softmode & MF_PAX_SEGMEXEC)
42711 + pax_flags |= MF_PAX_SEGMEXEC;
42712 +#endif
42713 +
42714 +#ifdef CONFIG_PAX_EMUTRAMP
42715 + if (pax_flags_softmode & MF_PAX_EMUTRAMP)
42716 + pax_flags |= MF_PAX_EMUTRAMP;
42717 +#endif
42718 +
42719 +#ifdef CONFIG_PAX_MPROTECT
42720 + if (pax_flags_softmode & MF_PAX_MPROTECT)
42721 + pax_flags |= MF_PAX_MPROTECT;
42722 +#endif
42723 +
42724 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
42725 + if (randomize_va_space && (pax_flags_softmode & MF_PAX_RANDMMAP))
42726 + pax_flags |= MF_PAX_RANDMMAP;
42727 +#endif
42728 +
42729 + return pax_flags;
42730 +}
42731 +#endif
42732 +
42733 +static unsigned long pax_parse_xattr_pax_hardmode(unsigned long pax_flags_hardmode)
42734 +{
42735 + unsigned long pax_flags = 0UL;
42736 +
42737 +#ifdef CONFIG_PAX_PAGEEXEC
42738 + if (!(pax_flags_hardmode & MF_PAX_PAGEEXEC))
42739 + pax_flags |= MF_PAX_PAGEEXEC;
42740 +#endif
42741 +
42742 +#ifdef CONFIG_PAX_SEGMEXEC
42743 + if (!(pax_flags_hardmode & MF_PAX_SEGMEXEC))
42744 + pax_flags |= MF_PAX_SEGMEXEC;
42745 +#endif
42746 +
42747 +#ifdef CONFIG_PAX_EMUTRAMP
42748 + if (!(pax_flags_hardmode & MF_PAX_EMUTRAMP))
42749 + pax_flags |= MF_PAX_EMUTRAMP;
42750 +#endif
42751 +
42752 +#ifdef CONFIG_PAX_MPROTECT
42753 + if (!(pax_flags_hardmode & MF_PAX_MPROTECT))
42754 + pax_flags |= MF_PAX_MPROTECT;
42755 +#endif
42756 +
42757 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
42758 + if (randomize_va_space && !(pax_flags_hardmode & MF_PAX_RANDMMAP))
42759 + pax_flags |= MF_PAX_RANDMMAP;
42760 +#endif
42761 +
42762 + return pax_flags;
42763 +}
42764 +#endif
42765 +
42766 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
42767 +static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
42768 +{
42769 + unsigned long pax_flags = 0UL;
42770 +
42771 +#ifdef CONFIG_PAX_EI_PAX
42772 +
42773 +#ifdef CONFIG_PAX_PAGEEXEC
42774 + if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
42775 + pax_flags |= MF_PAX_PAGEEXEC;
42776 +#endif
42777 +
42778 +#ifdef CONFIG_PAX_SEGMEXEC
42779 + if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
42780 + pax_flags |= MF_PAX_SEGMEXEC;
42781 +#endif
42782 +
42783 +#ifdef CONFIG_PAX_EMUTRAMP
42784 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
42785 + pax_flags |= MF_PAX_EMUTRAMP;
42786 +#endif
42787 +
42788 +#ifdef CONFIG_PAX_MPROTECT
42789 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
42790 + pax_flags |= MF_PAX_MPROTECT;
42791 +#endif
42792 +
42793 +#ifdef CONFIG_PAX_ASLR
42794 + if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
42795 + pax_flags |= MF_PAX_RANDMMAP;
42796 +#endif
42797 +
42798 +#else
42799 +
42800 +#ifdef CONFIG_PAX_PAGEEXEC
42801 + pax_flags |= MF_PAX_PAGEEXEC;
42802 +#endif
42803 +
42804 +#ifdef CONFIG_PAX_SEGMEXEC
42805 + pax_flags |= MF_PAX_SEGMEXEC;
42806 +#endif
42807 +
42808 +#ifdef CONFIG_PAX_MPROTECT
42809 + pax_flags |= MF_PAX_MPROTECT;
42810 +#endif
42811 +
42812 +#ifdef CONFIG_PAX_RANDMMAP
42813 + if (randomize_va_space)
42814 + pax_flags |= MF_PAX_RANDMMAP;
42815 +#endif
42816 +
42817 +#endif
42818 +
42819 + return pax_flags;
42820 +}
42821 +
42822 +static unsigned long pax_parse_pt_pax(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
42823 +{
42824 +
42825 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
42826 + unsigned long i;
42827 +
42828 + for (i = 0UL; i < elf_ex->e_phnum; i++)
42829 + if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
42830 + if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
42831 + ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
42832 + ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
42833 + ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
42834 + ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
42835 + return ~0UL;
42836 +
42837 +#ifdef CONFIG_PAX_SOFTMODE
42838 + if (pax_softmode)
42839 + return pax_parse_pt_pax_softmode(&elf_phdata[i]);
42840 + else
42841 +#endif
42842 +
42843 + return pax_parse_pt_pax_hardmode(&elf_phdata[i]);
42844 + break;
42845 + }
42846 +#endif
42847 +
42848 + return ~0UL;
42849 +}
42850 +
42851 +static unsigned long pax_parse_xattr_pax(struct file * const file)
42852 +{
42853 +
42854 +#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
42855 + ssize_t xattr_size, i;
42856 + unsigned char xattr_value[5];
42857 + unsigned long pax_flags_hardmode = 0UL, pax_flags_softmode = 0UL;
42858 +
42859 + xattr_size = vfs_getxattr(file->f_path.dentry, XATTR_NAME_PAX_FLAGS, xattr_value, sizeof xattr_value);
42860 + if (xattr_size <= 0)
42861 + return ~0UL;
42862 +
42863 + for (i = 0; i < xattr_size; i++)
42864 + switch (xattr_value[i]) {
42865 + default:
42866 + return ~0UL;
42867 +
42868 +#define parse_flag(option1, option2, flag) \
42869 + case option1: \
42870 + pax_flags_hardmode |= MF_PAX_##flag; \
42871 + break; \
42872 + case option2: \
42873 + pax_flags_softmode |= MF_PAX_##flag; \
42874 + break;
42875 +
42876 + parse_flag('p', 'P', PAGEEXEC);
42877 + parse_flag('e', 'E', EMUTRAMP);
42878 + parse_flag('m', 'M', MPROTECT);
42879 + parse_flag('r', 'R', RANDMMAP);
42880 + parse_flag('s', 'S', SEGMEXEC);
42881 +
42882 +#undef parse_flag
42883 + }
42884 +
42885 + if (pax_flags_hardmode & pax_flags_softmode)
42886 + return ~0UL;
42887 +
42888 +#ifdef CONFIG_PAX_SOFTMODE
42889 + if (pax_softmode)
42890 + return pax_parse_xattr_pax_softmode(pax_flags_softmode);
42891 + else
42892 +#endif
42893 +
42894 + return pax_parse_xattr_pax_hardmode(pax_flags_hardmode);
42895 +#else
42896 + return ~0UL;
42897 +#endif
42898 +
42899 +}
42900 +
42901 +static long pax_parse_pax_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata, struct file * const file)
42902 +{
42903 + unsigned long pax_flags, pt_pax_flags, xattr_pax_flags;
42904 +
42905 + pax_flags = pax_parse_ei_pax(elf_ex);
42906 + pt_pax_flags = pax_parse_pt_pax(elf_ex, elf_phdata);
42907 + xattr_pax_flags = pax_parse_xattr_pax(file);
42908 +
42909 + if (pt_pax_flags == ~0UL)
42910 + pt_pax_flags = xattr_pax_flags;
42911 + else if (xattr_pax_flags == ~0UL)
42912 + xattr_pax_flags = pt_pax_flags;
42913 + if (pt_pax_flags != xattr_pax_flags)
42914 + return -EINVAL;
42915 + if (pt_pax_flags != ~0UL)
42916 + pax_flags = pt_pax_flags;
42917 +
42918 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
42919 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
42920 + if ((__supported_pte_mask & _PAGE_NX))
42921 + pax_flags &= ~MF_PAX_SEGMEXEC;
42922 + else
42923 + pax_flags &= ~MF_PAX_PAGEEXEC;
42924 + }
42925 +#endif
42926 +
42927 + if (0 > pax_check_flags(&pax_flags))
42928 + return -EINVAL;
42929 +
42930 + current->mm->pax_flags = pax_flags;
42931 + return 0;
42932 +}
42933 +#endif
42934 +
42935 /*
42936 * These are the functions used to load ELF style executables and shared
42937 * libraries. There is no binary dependent code anywhere else.
42938 @@ -539,6 +868,11 @@ static unsigned long randomize_stack_top(unsigned long stack_top)
42939 {
42940 unsigned int random_variable = 0;
42941
42942 +#ifdef CONFIG_PAX_RANDUSTACK
42943 + if (randomize_va_space)
42944 + return stack_top - current->mm->delta_stack;
42945 +#endif
42946 +
42947 if ((current->flags & PF_RANDOMIZE) &&
42948 !(current->personality & ADDR_NO_RANDOMIZE)) {
42949 random_variable = get_random_int() & STACK_RND_MASK;
42950 @@ -557,7 +891,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42951 unsigned long load_addr = 0, load_bias = 0;
42952 int load_addr_set = 0;
42953 char * elf_interpreter = NULL;
42954 - unsigned long error;
42955 + unsigned long error = 0;
42956 struct elf_phdr *elf_ppnt, *elf_phdata;
42957 unsigned long elf_bss, elf_brk;
42958 int retval, i;
42959 @@ -567,11 +901,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42960 unsigned long start_code, end_code, start_data, end_data;
42961 unsigned long reloc_func_desc __maybe_unused = 0;
42962 int executable_stack = EXSTACK_DEFAULT;
42963 - unsigned long def_flags = 0;
42964 struct {
42965 struct elfhdr elf_ex;
42966 struct elfhdr interp_elf_ex;
42967 } *loc;
42968 + unsigned long pax_task_size = TASK_SIZE;
42969
42970 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
42971 if (!loc) {
42972 @@ -707,11 +1041,81 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
42973 goto out_free_dentry;
42974
42975 /* OK, This is the point of no return */
42976 - current->mm->def_flags = def_flags;
42977 +
42978 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
42979 + current->mm->pax_flags = 0UL;
42980 +#endif
42981 +
42982 +#ifdef CONFIG_PAX_DLRESOLVE
42983 + current->mm->call_dl_resolve = 0UL;
42984 +#endif
42985 +
42986 +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
42987 + current->mm->call_syscall = 0UL;
42988 +#endif
42989 +
42990 +#ifdef CONFIG_PAX_ASLR
42991 + current->mm->delta_mmap = 0UL;
42992 + current->mm->delta_stack = 0UL;
42993 +#endif
42994 +
42995 + current->mm->def_flags = 0;
42996 +
42997 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
42998 + if (0 > pax_parse_pax_flags(&loc->elf_ex, elf_phdata, bprm->file)) {
42999 + send_sig(SIGKILL, current, 0);
43000 + goto out_free_dentry;
43001 + }
43002 +#endif
43003 +
43004 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
43005 + pax_set_initial_flags(bprm);
43006 +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
43007 + if (pax_set_initial_flags_func)
43008 + (pax_set_initial_flags_func)(bprm);
43009 +#endif
43010 +
43011 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
43012 + if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !(__supported_pte_mask & _PAGE_NX)) {
43013 + current->mm->context.user_cs_limit = PAGE_SIZE;
43014 + current->mm->def_flags |= VM_PAGEEXEC;
43015 + }
43016 +#endif
43017 +
43018 +#ifdef CONFIG_PAX_SEGMEXEC
43019 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
43020 + current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
43021 + current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
43022 + pax_task_size = SEGMEXEC_TASK_SIZE;
43023 + current->mm->def_flags |= VM_NOHUGEPAGE;
43024 + }
43025 +#endif
43026 +
43027 +#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
43028 + if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43029 + set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
43030 + put_cpu();
43031 + }
43032 +#endif
43033
43034 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
43035 may depend on the personality. */
43036 SET_PERSONALITY(loc->elf_ex);
43037 +
43038 +#ifdef CONFIG_PAX_ASLR
43039 + if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
43040 + current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
43041 + current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
43042 + }
43043 +#endif
43044 +
43045 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
43046 + if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43047 + executable_stack = EXSTACK_DISABLE_X;
43048 + current->personality &= ~READ_IMPLIES_EXEC;
43049 + } else
43050 +#endif
43051 +
43052 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
43053 current->personality |= READ_IMPLIES_EXEC;
43054
43055 @@ -802,6 +1206,20 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
43056 #else
43057 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
43058 #endif
43059 +
43060 +#ifdef CONFIG_PAX_RANDMMAP
43061 + /* PaX: randomize base address at the default exe base if requested */
43062 + if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
43063 +#ifdef CONFIG_SPARC64
43064 + load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
43065 +#else
43066 + load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
43067 +#endif
43068 + load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
43069 + elf_flags |= MAP_FIXED;
43070 + }
43071 +#endif
43072 +
43073 }
43074
43075 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
43076 @@ -834,9 +1252,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
43077 * allowed task size. Note that p_filesz must always be
43078 * <= p_memsz so it is only necessary to check p_memsz.
43079 */
43080 - if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
43081 - elf_ppnt->p_memsz > TASK_SIZE ||
43082 - TASK_SIZE - elf_ppnt->p_memsz < k) {
43083 + if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
43084 + elf_ppnt->p_memsz > pax_task_size ||
43085 + pax_task_size - elf_ppnt->p_memsz < k) {
43086 /* set_brk can never work. Avoid overflows. */
43087 send_sig(SIGKILL, current, 0);
43088 retval = -EINVAL;
43089 @@ -875,11 +1293,41 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
43090 goto out_free_dentry;
43091 }
43092 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
43093 - send_sig(SIGSEGV, current, 0);
43094 - retval = -EFAULT; /* Nobody gets to see this, but.. */
43095 - goto out_free_dentry;
43096 + /*
43097 + * This bss-zeroing can fail if the ELF
43098 + * file specifies odd protections. So
43099 + * we don't check the return value
43100 + */
43101 }
43102
43103 +#ifdef CONFIG_PAX_RANDMMAP
43104 + if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
43105 + unsigned long start, size;
43106 +
43107 + start = ELF_PAGEALIGN(elf_brk);
43108 + size = PAGE_SIZE + ((pax_get_random_long() & ((1UL << 22) - 1UL)) << 4);
43109 + down_read(&current->mm->mmap_sem);
43110 + retval = -ENOMEM;
43111 + if (!find_vma_intersection(current->mm, start, start + size + PAGE_SIZE)) {
43112 + unsigned long prot = PROT_NONE;
43113 +
43114 + up_read(&current->mm->mmap_sem);
43115 + current->mm->brk_gap = PAGE_ALIGN(size) >> PAGE_SHIFT;
43116 +// if (current->personality & ADDR_NO_RANDOMIZE)
43117 +// prot = PROT_READ;
43118 + start = vm_mmap(NULL, start, size, prot, MAP_ANONYMOUS | MAP_FIXED | MAP_PRIVATE, 0);
43119 + retval = IS_ERR_VALUE(start) ? start : 0;
43120 + } else
43121 + up_read(&current->mm->mmap_sem);
43122 + if (retval == 0)
43123 + retval = set_brk(start + size, start + size + PAGE_SIZE);
43124 + if (retval < 0) {
43125 + send_sig(SIGKILL, current, 0);
43126 + goto out_free_dentry;
43127 + }
43128 + }
43129 +#endif
43130 +
43131 if (elf_interpreter) {
43132 unsigned long uninitialized_var(interp_map_addr);
43133
43134 @@ -1107,7 +1555,7 @@ static bool always_dump_vma(struct vm_area_struct *vma)
43135 * Decide what to dump of a segment, part, all or none.
43136 */
43137 static unsigned long vma_dump_size(struct vm_area_struct *vma,
43138 - unsigned long mm_flags)
43139 + unsigned long mm_flags, long signr)
43140 {
43141 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
43142
43143 @@ -1144,7 +1592,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
43144 if (vma->vm_file == NULL)
43145 return 0;
43146
43147 - if (FILTER(MAPPED_PRIVATE))
43148 + if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
43149 goto whole;
43150
43151 /*
43152 @@ -1366,9 +1814,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
43153 {
43154 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
43155 int i = 0;
43156 - do
43157 + do {
43158 i += 2;
43159 - while (auxv[i - 2] != AT_NULL);
43160 + } while (auxv[i - 2] != AT_NULL);
43161 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
43162 }
43163
43164 @@ -1890,14 +2338,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
43165 }
43166
43167 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
43168 - unsigned long mm_flags)
43169 + struct coredump_params *cprm)
43170 {
43171 struct vm_area_struct *vma;
43172 size_t size = 0;
43173
43174 for (vma = first_vma(current, gate_vma); vma != NULL;
43175 vma = next_vma(vma, gate_vma))
43176 - size += vma_dump_size(vma, mm_flags);
43177 + size += vma_dump_size(vma, cprm->mm_flags, cprm->signr);
43178 return size;
43179 }
43180
43181 @@ -1991,7 +2439,7 @@ static int elf_core_dump(struct coredump_params *cprm)
43182
43183 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
43184
43185 - offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
43186 + offset += elf_core_vma_data_size(gate_vma, cprm);
43187 offset += elf_core_extra_data_size();
43188 e_shoff = offset;
43189
43190 @@ -2005,10 +2453,12 @@ static int elf_core_dump(struct coredump_params *cprm)
43191 offset = dataoff;
43192
43193 size += sizeof(*elf);
43194 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
43195 if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
43196 goto end_coredump;
43197
43198 size += sizeof(*phdr4note);
43199 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
43200 if (size > cprm->limit
43201 || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
43202 goto end_coredump;
43203 @@ -2022,7 +2472,7 @@ static int elf_core_dump(struct coredump_params *cprm)
43204 phdr.p_offset = offset;
43205 phdr.p_vaddr = vma->vm_start;
43206 phdr.p_paddr = 0;
43207 - phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
43208 + phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags, cprm->signr);
43209 phdr.p_memsz = vma->vm_end - vma->vm_start;
43210 offset += phdr.p_filesz;
43211 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
43212 @@ -2033,6 +2483,7 @@ static int elf_core_dump(struct coredump_params *cprm)
43213 phdr.p_align = ELF_EXEC_PAGESIZE;
43214
43215 size += sizeof(phdr);
43216 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
43217 if (size > cprm->limit
43218 || !dump_write(cprm->file, &phdr, sizeof(phdr)))
43219 goto end_coredump;
43220 @@ -2057,7 +2508,7 @@ static int elf_core_dump(struct coredump_params *cprm)
43221 unsigned long addr;
43222 unsigned long end;
43223
43224 - end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
43225 + end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags, cprm->signr);
43226
43227 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
43228 struct page *page;
43229 @@ -2066,6 +2517,7 @@ static int elf_core_dump(struct coredump_params *cprm)
43230 page = get_dump_page(addr);
43231 if (page) {
43232 void *kaddr = kmap(page);
43233 + gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
43234 stop = ((size += PAGE_SIZE) > cprm->limit) ||
43235 !dump_write(cprm->file, kaddr,
43236 PAGE_SIZE);
43237 @@ -2083,6 +2535,7 @@ static int elf_core_dump(struct coredump_params *cprm)
43238
43239 if (e_phnum == PN_XNUM) {
43240 size += sizeof(*shdr4extnum);
43241 + gr_learn_resource(current, RLIMIT_CORE, size, 1);
43242 if (size > cprm->limit
43243 || !dump_write(cprm->file, shdr4extnum,
43244 sizeof(*shdr4extnum)))
43245 @@ -2103,6 +2556,97 @@ out:
43246
43247 #endif /* CONFIG_ELF_CORE */
43248
43249 +#ifdef CONFIG_PAX_MPROTECT
43250 +/* PaX: non-PIC ELF libraries need relocations on their executable segments
43251 + * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
43252 + * we'll remove VM_MAYWRITE for good on RELRO segments.
43253 + *
43254 + * The checks favour ld-linux.so behaviour which operates on a per ELF segment
43255 + * basis because we want to allow the common case and not the special ones.
43256 + */
43257 +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
43258 +{
43259 + struct elfhdr elf_h;
43260 + struct elf_phdr elf_p;
43261 + unsigned long i;
43262 + unsigned long oldflags;
43263 + bool is_textrel_rw, is_textrel_rx, is_relro;
43264 +
43265 + if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
43266 + return;
43267 +
43268 + oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
43269 + newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
43270 +
43271 +#ifdef CONFIG_PAX_ELFRELOCS
43272 + /* possible TEXTREL */
43273 + is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
43274 + is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
43275 +#else
43276 + is_textrel_rw = false;
43277 + is_textrel_rx = false;
43278 +#endif
43279 +
43280 + /* possible RELRO */
43281 + is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
43282 +
43283 + if (!is_textrel_rw && !is_textrel_rx && !is_relro)
43284 + return;
43285 +
43286 + if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
43287 + memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
43288 +
43289 +#ifdef CONFIG_PAX_ETEXECRELOCS
43290 + ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
43291 +#else
43292 + ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
43293 +#endif
43294 +
43295 + (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
43296 + !elf_check_arch(&elf_h) ||
43297 + elf_h.e_phentsize != sizeof(struct elf_phdr) ||
43298 + elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
43299 + return;
43300 +
43301 + for (i = 0UL; i < elf_h.e_phnum; i++) {
43302 + if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
43303 + return;
43304 + switch (elf_p.p_type) {
43305 + case PT_DYNAMIC:
43306 + if (!is_textrel_rw && !is_textrel_rx)
43307 + continue;
43308 + i = 0UL;
43309 + while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
43310 + elf_dyn dyn;
43311 +
43312 + if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
43313 + return;
43314 + if (dyn.d_tag == DT_NULL)
43315 + return;
43316 + if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
43317 + gr_log_textrel(vma);
43318 + if (is_textrel_rw)
43319 + vma->vm_flags |= VM_MAYWRITE;
43320 + else
43321 + /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
43322 + vma->vm_flags &= ~VM_MAYWRITE;
43323 + return;
43324 + }
43325 + i++;
43326 + }
43327 + return;
43328 +
43329 + case PT_GNU_RELRO:
43330 + if (!is_relro)
43331 + continue;
43332 + if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
43333 + vma->vm_flags &= ~VM_MAYWRITE;
43334 + return;
43335 + }
43336 + }
43337 +}
43338 +#endif
43339 +
43340 static int __init init_elf_binfmt(void)
43341 {
43342 register_binfmt(&elf_format);
43343 diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
43344 index 178cb70..8972997 100644
43345 --- a/fs/binfmt_flat.c
43346 +++ b/fs/binfmt_flat.c
43347 @@ -562,7 +562,9 @@ static int load_flat_file(struct linux_binprm * bprm,
43348 realdatastart = (unsigned long) -ENOMEM;
43349 printk("Unable to allocate RAM for process data, errno %d\n",
43350 (int)-realdatastart);
43351 + down_write(&current->mm->mmap_sem);
43352 vm_munmap(textpos, text_len);
43353 + up_write(&current->mm->mmap_sem);
43354 ret = realdatastart;
43355 goto err;
43356 }
43357 @@ -586,8 +588,10 @@ static int load_flat_file(struct linux_binprm * bprm,
43358 }
43359 if (IS_ERR_VALUE(result)) {
43360 printk("Unable to read data+bss, errno %d\n", (int)-result);
43361 + down_write(&current->mm->mmap_sem);
43362 vm_munmap(textpos, text_len);
43363 vm_munmap(realdatastart, len);
43364 + up_write(&current->mm->mmap_sem);
43365 ret = result;
43366 goto err;
43367 }
43368 @@ -654,8 +658,10 @@ static int load_flat_file(struct linux_binprm * bprm,
43369 }
43370 if (IS_ERR_VALUE(result)) {
43371 printk("Unable to read code+data+bss, errno %d\n",(int)-result);
43372 + down_write(&current->mm->mmap_sem);
43373 vm_munmap(textpos, text_len + data_len + extra +
43374 MAX_SHARED_LIBS * sizeof(unsigned long));
43375 + up_write(&current->mm->mmap_sem);
43376 ret = result;
43377 goto err;
43378 }
43379 diff --git a/fs/bio.c b/fs/bio.c
43380 index 73922ab..16642dd 100644
43381 --- a/fs/bio.c
43382 +++ b/fs/bio.c
43383 @@ -841,7 +841,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
43384 /*
43385 * Overflow, abort
43386 */
43387 - if (end < start)
43388 + if (end < start || end - start > INT_MAX - nr_pages)
43389 return ERR_PTR(-EINVAL);
43390
43391 nr_pages += end - start;
43392 @@ -975,7 +975,7 @@ static struct bio *__bio_map_user_iov(struct request_queue *q,
43393 /*
43394 * Overflow, abort
43395 */
43396 - if (end < start)
43397 + if (end < start || end - start > INT_MAX - nr_pages)
43398 return ERR_PTR(-EINVAL);
43399
43400 nr_pages += end - start;
43401 @@ -1237,7 +1237,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
43402 const int read = bio_data_dir(bio) == READ;
43403 struct bio_map_data *bmd = bio->bi_private;
43404 int i;
43405 - char *p = bmd->sgvecs[0].iov_base;
43406 + char *p = (char __force_kernel *)bmd->sgvecs[0].iov_base;
43407
43408 __bio_for_each_segment(bvec, bio, i, 0) {
43409 char *addr = page_address(bvec->bv_page);
43410 diff --git a/fs/block_dev.c b/fs/block_dev.c
43411 index c2bbe1f..9dfbc23 100644
43412 --- a/fs/block_dev.c
43413 +++ b/fs/block_dev.c
43414 @@ -704,7 +704,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole,
43415 else if (bdev->bd_contains == bdev)
43416 return true; /* is a whole device which isn't held */
43417
43418 - else if (whole->bd_holder == bd_may_claim)
43419 + else if (whole->bd_holder == (void *)bd_may_claim)
43420 return true; /* is a partition of a device that is being partitioned */
43421 else if (whole->bd_holder != NULL)
43422 return false; /* is a partition of a held device */
43423 diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
43424 index da6e936..1598dd0 100644
43425 --- a/fs/btrfs/check-integrity.c
43426 +++ b/fs/btrfs/check-integrity.c
43427 @@ -155,7 +155,7 @@ struct btrfsic_block {
43428 union {
43429 bio_end_io_t *bio;
43430 bh_end_io_t *bh;
43431 - } orig_bio_bh_end_io;
43432 + } __no_const orig_bio_bh_end_io;
43433 int submit_bio_bh_rw;
43434 u64 flush_gen; /* only valid if !never_written */
43435 };
43436 diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
43437 index 8206b39..06d5654 100644
43438 --- a/fs/btrfs/ctree.c
43439 +++ b/fs/btrfs/ctree.c
43440 @@ -973,9 +973,12 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
43441 free_extent_buffer(buf);
43442 add_root_to_dirty_list(root);
43443 } else {
43444 - if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
43445 - parent_start = parent->start;
43446 - else
43447 + if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
43448 + if (parent)
43449 + parent_start = parent->start;
43450 + else
43451 + parent_start = 0;
43452 + } else
43453 parent_start = 0;
43454
43455 WARN_ON(trans->transid != btrfs_header_generation(parent));
43456 diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
43457 index a7d1921..a32dba2 100644
43458 --- a/fs/btrfs/inode.c
43459 +++ b/fs/btrfs/inode.c
43460 @@ -7111,7 +7111,7 @@ fail:
43461 return -ENOMEM;
43462 }
43463
43464 -static int btrfs_getattr(struct vfsmount *mnt,
43465 +int btrfs_getattr(struct vfsmount *mnt,
43466 struct dentry *dentry, struct kstat *stat)
43467 {
43468 struct inode *inode = dentry->d_inode;
43469 @@ -7125,6 +7125,14 @@ static int btrfs_getattr(struct vfsmount *mnt,
43470 return 0;
43471 }
43472
43473 +EXPORT_SYMBOL(btrfs_getattr);
43474 +
43475 +dev_t get_btrfs_dev_from_inode(struct inode *inode)
43476 +{
43477 + return BTRFS_I(inode)->root->anon_dev;
43478 +}
43479 +EXPORT_SYMBOL(get_btrfs_dev_from_inode);
43480 +
43481 /*
43482 * If a file is moved, it will inherit the cow and compression flags of the new
43483 * directory.
43484 diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
43485 index 0e92e57..8b560de 100644
43486 --- a/fs/btrfs/ioctl.c
43487 +++ b/fs/btrfs/ioctl.c
43488 @@ -2902,9 +2902,12 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
43489 for (i = 0; i < num_types; i++) {
43490 struct btrfs_space_info *tmp;
43491
43492 + /* Don't copy in more than we allocated */
43493 if (!slot_count)
43494 break;
43495
43496 + slot_count--;
43497 +
43498 info = NULL;
43499 rcu_read_lock();
43500 list_for_each_entry_rcu(tmp, &root->fs_info->space_info,
43501 @@ -2926,10 +2929,7 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
43502 memcpy(dest, &space, sizeof(space));
43503 dest++;
43504 space_args.total_spaces++;
43505 - slot_count--;
43506 }
43507 - if (!slot_count)
43508 - break;
43509 }
43510 up_read(&info->groups_sem);
43511 }
43512 diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
43513 index 646ee21..f020f87 100644
43514 --- a/fs/btrfs/relocation.c
43515 +++ b/fs/btrfs/relocation.c
43516 @@ -1268,7 +1268,7 @@ static int __update_reloc_root(struct btrfs_root *root, int del)
43517 }
43518 spin_unlock(&rc->reloc_root_tree.lock);
43519
43520 - BUG_ON((struct btrfs_root *)node->data != root);
43521 + BUG_ON(!node || (struct btrfs_root *)node->data != root);
43522
43523 if (!del) {
43524 spin_lock(&rc->reloc_root_tree.lock);
43525 diff --git a/fs/cachefiles/bind.c b/fs/cachefiles/bind.c
43526 index 622f469..e8d2d55 100644
43527 --- a/fs/cachefiles/bind.c
43528 +++ b/fs/cachefiles/bind.c
43529 @@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachefiles_cache *cache, char *args)
43530 args);
43531
43532 /* start by checking things over */
43533 - ASSERT(cache->fstop_percent >= 0 &&
43534 - cache->fstop_percent < cache->fcull_percent &&
43535 + ASSERT(cache->fstop_percent < cache->fcull_percent &&
43536 cache->fcull_percent < cache->frun_percent &&
43537 cache->frun_percent < 100);
43538
43539 - ASSERT(cache->bstop_percent >= 0 &&
43540 - cache->bstop_percent < cache->bcull_percent &&
43541 + ASSERT(cache->bstop_percent < cache->bcull_percent &&
43542 cache->bcull_percent < cache->brun_percent &&
43543 cache->brun_percent < 100);
43544
43545 diff --git a/fs/cachefiles/daemon.c b/fs/cachefiles/daemon.c
43546 index 0a1467b..6a53245 100644
43547 --- a/fs/cachefiles/daemon.c
43548 +++ b/fs/cachefiles/daemon.c
43549 @@ -196,7 +196,7 @@ static ssize_t cachefiles_daemon_read(struct file *file, char __user *_buffer,
43550 if (n > buflen)
43551 return -EMSGSIZE;
43552
43553 - if (copy_to_user(_buffer, buffer, n) != 0)
43554 + if (n > sizeof(buffer) || copy_to_user(_buffer, buffer, n) != 0)
43555 return -EFAULT;
43556
43557 return n;
43558 @@ -222,7 +222,7 @@ static ssize_t cachefiles_daemon_write(struct file *file,
43559 if (test_bit(CACHEFILES_DEAD, &cache->flags))
43560 return -EIO;
43561
43562 - if (datalen < 0 || datalen > PAGE_SIZE - 1)
43563 + if (datalen > PAGE_SIZE - 1)
43564 return -EOPNOTSUPP;
43565
43566 /* drag the command string into the kernel so we can parse it */
43567 @@ -386,7 +386,7 @@ static int cachefiles_daemon_fstop(struct cachefiles_cache *cache, char *args)
43568 if (args[0] != '%' || args[1] != '\0')
43569 return -EINVAL;
43570
43571 - if (fstop < 0 || fstop >= cache->fcull_percent)
43572 + if (fstop >= cache->fcull_percent)
43573 return cachefiles_daemon_range_error(cache, args);
43574
43575 cache->fstop_percent = fstop;
43576 @@ -458,7 +458,7 @@ static int cachefiles_daemon_bstop(struct cachefiles_cache *cache, char *args)
43577 if (args[0] != '%' || args[1] != '\0')
43578 return -EINVAL;
43579
43580 - if (bstop < 0 || bstop >= cache->bcull_percent)
43581 + if (bstop >= cache->bcull_percent)
43582 return cachefiles_daemon_range_error(cache, args);
43583
43584 cache->bstop_percent = bstop;
43585 diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h
43586 index bd6bc1b..b627b53 100644
43587 --- a/fs/cachefiles/internal.h
43588 +++ b/fs/cachefiles/internal.h
43589 @@ -57,7 +57,7 @@ struct cachefiles_cache {
43590 wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
43591 struct rb_root active_nodes; /* active nodes (can't be culled) */
43592 rwlock_t active_lock; /* lock for active_nodes */
43593 - atomic_t gravecounter; /* graveyard uniquifier */
43594 + atomic_unchecked_t gravecounter; /* graveyard uniquifier */
43595 unsigned frun_percent; /* when to stop culling (% files) */
43596 unsigned fcull_percent; /* when to start culling (% files) */
43597 unsigned fstop_percent; /* when to stop allocating (% files) */
43598 @@ -169,19 +169,19 @@ extern int cachefiles_check_in_use(struct cachefiles_cache *cache,
43599 * proc.c
43600 */
43601 #ifdef CONFIG_CACHEFILES_HISTOGRAM
43602 -extern atomic_t cachefiles_lookup_histogram[HZ];
43603 -extern atomic_t cachefiles_mkdir_histogram[HZ];
43604 -extern atomic_t cachefiles_create_histogram[HZ];
43605 +extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
43606 +extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
43607 +extern atomic_unchecked_t cachefiles_create_histogram[HZ];
43608
43609 extern int __init cachefiles_proc_init(void);
43610 extern void cachefiles_proc_cleanup(void);
43611 static inline
43612 -void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
43613 +void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
43614 {
43615 unsigned long jif = jiffies - start_jif;
43616 if (jif >= HZ)
43617 jif = HZ - 1;
43618 - atomic_inc(&histogram[jif]);
43619 + atomic_inc_unchecked(&histogram[jif]);
43620 }
43621
43622 #else
43623 diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
43624 index 7f0771d..87d4f36 100644
43625 --- a/fs/cachefiles/namei.c
43626 +++ b/fs/cachefiles/namei.c
43627 @@ -318,7 +318,7 @@ try_again:
43628 /* first step is to make up a grave dentry in the graveyard */
43629 sprintf(nbuffer, "%08x%08x",
43630 (uint32_t) get_seconds(),
43631 - (uint32_t) atomic_inc_return(&cache->gravecounter));
43632 + (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
43633
43634 /* do the multiway lock magic */
43635 trap = lock_rename(cache->graveyard, dir);
43636 diff --git a/fs/cachefiles/proc.c b/fs/cachefiles/proc.c
43637 index eccd339..4c1d995 100644
43638 --- a/fs/cachefiles/proc.c
43639 +++ b/fs/cachefiles/proc.c
43640 @@ -14,9 +14,9 @@
43641 #include <linux/seq_file.h>
43642 #include "internal.h"
43643
43644 -atomic_t cachefiles_lookup_histogram[HZ];
43645 -atomic_t cachefiles_mkdir_histogram[HZ];
43646 -atomic_t cachefiles_create_histogram[HZ];
43647 +atomic_unchecked_t cachefiles_lookup_histogram[HZ];
43648 +atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
43649 +atomic_unchecked_t cachefiles_create_histogram[HZ];
43650
43651 /*
43652 * display the latency histogram
43653 @@ -35,9 +35,9 @@ static int cachefiles_histogram_show(struct seq_file *m, void *v)
43654 return 0;
43655 default:
43656 index = (unsigned long) v - 3;
43657 - x = atomic_read(&cachefiles_lookup_histogram[index]);
43658 - y = atomic_read(&cachefiles_mkdir_histogram[index]);
43659 - z = atomic_read(&cachefiles_create_histogram[index]);
43660 + x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
43661 + y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
43662 + z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
43663 if (x == 0 && y == 0 && z == 0)
43664 return 0;
43665
43666 diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
43667 index 0e3c092..818480e 100644
43668 --- a/fs/cachefiles/rdwr.c
43669 +++ b/fs/cachefiles/rdwr.c
43670 @@ -945,7 +945,7 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
43671 old_fs = get_fs();
43672 set_fs(KERNEL_DS);
43673 ret = file->f_op->write(
43674 - file, (const void __user *) data, len, &pos);
43675 + file, (const void __force_user *) data, len, &pos);
43676 set_fs(old_fs);
43677 kunmap(page);
43678 if (ret != len)
43679 diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
43680 index 3e8094b..cb3ff3d 100644
43681 --- a/fs/ceph/dir.c
43682 +++ b/fs/ceph/dir.c
43683 @@ -244,7 +244,7 @@ static int ceph_readdir(struct file *filp, void *dirent, filldir_t filldir)
43684 struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
43685 struct ceph_mds_client *mdsc = fsc->mdsc;
43686 unsigned frag = fpos_frag(filp->f_pos);
43687 - int off = fpos_off(filp->f_pos);
43688 + unsigned int off = fpos_off(filp->f_pos);
43689 int err;
43690 u32 ftype;
43691 struct ceph_mds_reply_info_parsed *rinfo;
43692 @@ -598,7 +598,7 @@ static struct dentry *ceph_lookup(struct inode *dir, struct dentry *dentry,
43693 if (nd &&
43694 (nd->flags & LOOKUP_OPEN) &&
43695 !(nd->intent.open.flags & O_CREAT)) {
43696 - int mode = nd->intent.open.create_mode & ~current->fs->umask;
43697 + int mode = nd->intent.open.create_mode & ~current_umask();
43698 return ceph_lookup_open(dir, dentry, nd, mode, 1);
43699 }
43700
43701 diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
43702 index e814052..28dcdf7 100644
43703 --- a/fs/cifs/cifs_debug.c
43704 +++ b/fs/cifs/cifs_debug.c
43705 @@ -267,8 +267,8 @@ static ssize_t cifs_stats_proc_write(struct file *file,
43706
43707 if (c == '1' || c == 'y' || c == 'Y' || c == '0') {
43708 #ifdef CONFIG_CIFS_STATS2
43709 - atomic_set(&totBufAllocCount, 0);
43710 - atomic_set(&totSmBufAllocCount, 0);
43711 + atomic_set_unchecked(&totBufAllocCount, 0);
43712 + atomic_set_unchecked(&totSmBufAllocCount, 0);
43713 #endif /* CONFIG_CIFS_STATS2 */
43714 spin_lock(&cifs_tcp_ses_lock);
43715 list_for_each(tmp1, &cifs_tcp_ses_list) {
43716 @@ -281,25 +281,25 @@ static ssize_t cifs_stats_proc_write(struct file *file,
43717 tcon = list_entry(tmp3,
43718 struct cifs_tcon,
43719 tcon_list);
43720 - atomic_set(&tcon->num_smbs_sent, 0);
43721 - atomic_set(&tcon->num_writes, 0);
43722 - atomic_set(&tcon->num_reads, 0);
43723 - atomic_set(&tcon->num_oplock_brks, 0);
43724 - atomic_set(&tcon->num_opens, 0);
43725 - atomic_set(&tcon->num_posixopens, 0);
43726 - atomic_set(&tcon->num_posixmkdirs, 0);
43727 - atomic_set(&tcon->num_closes, 0);
43728 - atomic_set(&tcon->num_deletes, 0);
43729 - atomic_set(&tcon->num_mkdirs, 0);
43730 - atomic_set(&tcon->num_rmdirs, 0);
43731 - atomic_set(&tcon->num_renames, 0);
43732 - atomic_set(&tcon->num_t2renames, 0);
43733 - atomic_set(&tcon->num_ffirst, 0);
43734 - atomic_set(&tcon->num_fnext, 0);
43735 - atomic_set(&tcon->num_fclose, 0);
43736 - atomic_set(&tcon->num_hardlinks, 0);
43737 - atomic_set(&tcon->num_symlinks, 0);
43738 - atomic_set(&tcon->num_locks, 0);
43739 + atomic_set_unchecked(&tcon->num_smbs_sent, 0);
43740 + atomic_set_unchecked(&tcon->num_writes, 0);
43741 + atomic_set_unchecked(&tcon->num_reads, 0);
43742 + atomic_set_unchecked(&tcon->num_oplock_brks, 0);
43743 + atomic_set_unchecked(&tcon->num_opens, 0);
43744 + atomic_set_unchecked(&tcon->num_posixopens, 0);
43745 + atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
43746 + atomic_set_unchecked(&tcon->num_closes, 0);
43747 + atomic_set_unchecked(&tcon->num_deletes, 0);
43748 + atomic_set_unchecked(&tcon->num_mkdirs, 0);
43749 + atomic_set_unchecked(&tcon->num_rmdirs, 0);
43750 + atomic_set_unchecked(&tcon->num_renames, 0);
43751 + atomic_set_unchecked(&tcon->num_t2renames, 0);
43752 + atomic_set_unchecked(&tcon->num_ffirst, 0);
43753 + atomic_set_unchecked(&tcon->num_fnext, 0);
43754 + atomic_set_unchecked(&tcon->num_fclose, 0);
43755 + atomic_set_unchecked(&tcon->num_hardlinks, 0);
43756 + atomic_set_unchecked(&tcon->num_symlinks, 0);
43757 + atomic_set_unchecked(&tcon->num_locks, 0);
43758 }
43759 }
43760 }
43761 @@ -329,8 +329,8 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
43762 smBufAllocCount.counter, cifs_min_small);
43763 #ifdef CONFIG_CIFS_STATS2
43764 seq_printf(m, "Total Large %d Small %d Allocations\n",
43765 - atomic_read(&totBufAllocCount),
43766 - atomic_read(&totSmBufAllocCount));
43767 + atomic_read_unchecked(&totBufAllocCount),
43768 + atomic_read_unchecked(&totSmBufAllocCount));
43769 #endif /* CONFIG_CIFS_STATS2 */
43770
43771 seq_printf(m, "Operations (MIDs): %d\n", atomic_read(&midCount));
43772 @@ -359,41 +359,41 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
43773 if (tcon->need_reconnect)
43774 seq_puts(m, "\tDISCONNECTED ");
43775 seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
43776 - atomic_read(&tcon->num_smbs_sent),
43777 - atomic_read(&tcon->num_oplock_brks));
43778 + atomic_read_unchecked(&tcon->num_smbs_sent),
43779 + atomic_read_unchecked(&tcon->num_oplock_brks));
43780 seq_printf(m, "\nReads: %d Bytes: %lld",
43781 - atomic_read(&tcon->num_reads),
43782 + atomic_read_unchecked(&tcon->num_reads),
43783 (long long)(tcon->bytes_read));
43784 seq_printf(m, "\nWrites: %d Bytes: %lld",
43785 - atomic_read(&tcon->num_writes),
43786 + atomic_read_unchecked(&tcon->num_writes),
43787 (long long)(tcon->bytes_written));
43788 seq_printf(m, "\nFlushes: %d",
43789 - atomic_read(&tcon->num_flushes));
43790 + atomic_read_unchecked(&tcon->num_flushes));
43791 seq_printf(m, "\nLocks: %d HardLinks: %d "
43792 "Symlinks: %d",
43793 - atomic_read(&tcon->num_locks),
43794 - atomic_read(&tcon->num_hardlinks),
43795 - atomic_read(&tcon->num_symlinks));
43796 + atomic_read_unchecked(&tcon->num_locks),
43797 + atomic_read_unchecked(&tcon->num_hardlinks),
43798 + atomic_read_unchecked(&tcon->num_symlinks));
43799 seq_printf(m, "\nOpens: %d Closes: %d "
43800 "Deletes: %d",
43801 - atomic_read(&tcon->num_opens),
43802 - atomic_read(&tcon->num_closes),
43803 - atomic_read(&tcon->num_deletes));
43804 + atomic_read_unchecked(&tcon->num_opens),
43805 + atomic_read_unchecked(&tcon->num_closes),
43806 + atomic_read_unchecked(&tcon->num_deletes));
43807 seq_printf(m, "\nPosix Opens: %d "
43808 "Posix Mkdirs: %d",
43809 - atomic_read(&tcon->num_posixopens),
43810 - atomic_read(&tcon->num_posixmkdirs));
43811 + atomic_read_unchecked(&tcon->num_posixopens),
43812 + atomic_read_unchecked(&tcon->num_posixmkdirs));
43813 seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
43814 - atomic_read(&tcon->num_mkdirs),
43815 - atomic_read(&tcon->num_rmdirs));
43816 + atomic_read_unchecked(&tcon->num_mkdirs),
43817 + atomic_read_unchecked(&tcon->num_rmdirs));
43818 seq_printf(m, "\nRenames: %d T2 Renames %d",
43819 - atomic_read(&tcon->num_renames),
43820 - atomic_read(&tcon->num_t2renames));
43821 + atomic_read_unchecked(&tcon->num_renames),
43822 + atomic_read_unchecked(&tcon->num_t2renames));
43823 seq_printf(m, "\nFindFirst: %d FNext %d "
43824 "FClose %d",
43825 - atomic_read(&tcon->num_ffirst),
43826 - atomic_read(&tcon->num_fnext),
43827 - atomic_read(&tcon->num_fclose));
43828 + atomic_read_unchecked(&tcon->num_ffirst),
43829 + atomic_read_unchecked(&tcon->num_fnext),
43830 + atomic_read_unchecked(&tcon->num_fclose));
43831 }
43832 }
43833 }
43834 diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
43835 index 8b6e344..303a662 100644
43836 --- a/fs/cifs/cifsfs.c
43837 +++ b/fs/cifs/cifsfs.c
43838 @@ -994,7 +994,7 @@ cifs_init_request_bufs(void)
43839 cifs_req_cachep = kmem_cache_create("cifs_request",
43840 CIFSMaxBufSize +
43841 MAX_CIFS_HDR_SIZE, 0,
43842 - SLAB_HWCACHE_ALIGN, NULL);
43843 + SLAB_HWCACHE_ALIGN | SLAB_USERCOPY, NULL);
43844 if (cifs_req_cachep == NULL)
43845 return -ENOMEM;
43846
43847 @@ -1021,7 +1021,7 @@ cifs_init_request_bufs(void)
43848 efficient to alloc 1 per page off the slab compared to 17K (5page)
43849 alloc of large cifs buffers even when page debugging is on */
43850 cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq",
43851 - MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN,
43852 + MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN | SLAB_USERCOPY,
43853 NULL);
43854 if (cifs_sm_req_cachep == NULL) {
43855 mempool_destroy(cifs_req_poolp);
43856 @@ -1106,8 +1106,8 @@ init_cifs(void)
43857 atomic_set(&bufAllocCount, 0);
43858 atomic_set(&smBufAllocCount, 0);
43859 #ifdef CONFIG_CIFS_STATS2
43860 - atomic_set(&totBufAllocCount, 0);
43861 - atomic_set(&totSmBufAllocCount, 0);
43862 + atomic_set_unchecked(&totBufAllocCount, 0);
43863 + atomic_set_unchecked(&totSmBufAllocCount, 0);
43864 #endif /* CONFIG_CIFS_STATS2 */
43865
43866 atomic_set(&midCount, 0);
43867 diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
43868 index d86ba9f..e80049d 100644
43869 --- a/fs/cifs/cifsglob.h
43870 +++ b/fs/cifs/cifsglob.h
43871 @@ -491,28 +491,28 @@ struct cifs_tcon {
43872 __u16 Flags; /* optional support bits */
43873 enum statusEnum tidStatus;
43874 #ifdef CONFIG_CIFS_STATS
43875 - atomic_t num_smbs_sent;
43876 - atomic_t num_writes;
43877 - atomic_t num_reads;
43878 - atomic_t num_flushes;
43879 - atomic_t num_oplock_brks;
43880 - atomic_t num_opens;
43881 - atomic_t num_closes;
43882 - atomic_t num_deletes;
43883 - atomic_t num_mkdirs;
43884 - atomic_t num_posixopens;
43885 - atomic_t num_posixmkdirs;
43886 - atomic_t num_rmdirs;
43887 - atomic_t num_renames;
43888 - atomic_t num_t2renames;
43889 - atomic_t num_ffirst;
43890 - atomic_t num_fnext;
43891 - atomic_t num_fclose;
43892 - atomic_t num_hardlinks;
43893 - atomic_t num_symlinks;
43894 - atomic_t num_locks;
43895 - atomic_t num_acl_get;
43896 - atomic_t num_acl_set;
43897 + atomic_unchecked_t num_smbs_sent;
43898 + atomic_unchecked_t num_writes;
43899 + atomic_unchecked_t num_reads;
43900 + atomic_unchecked_t num_flushes;
43901 + atomic_unchecked_t num_oplock_brks;
43902 + atomic_unchecked_t num_opens;
43903 + atomic_unchecked_t num_closes;
43904 + atomic_unchecked_t num_deletes;
43905 + atomic_unchecked_t num_mkdirs;
43906 + atomic_unchecked_t num_posixopens;
43907 + atomic_unchecked_t num_posixmkdirs;
43908 + atomic_unchecked_t num_rmdirs;
43909 + atomic_unchecked_t num_renames;
43910 + atomic_unchecked_t num_t2renames;
43911 + atomic_unchecked_t num_ffirst;
43912 + atomic_unchecked_t num_fnext;
43913 + atomic_unchecked_t num_fclose;
43914 + atomic_unchecked_t num_hardlinks;
43915 + atomic_unchecked_t num_symlinks;
43916 + atomic_unchecked_t num_locks;
43917 + atomic_unchecked_t num_acl_get;
43918 + atomic_unchecked_t num_acl_set;
43919 #ifdef CONFIG_CIFS_STATS2
43920 unsigned long long time_writes;
43921 unsigned long long time_reads;
43922 @@ -735,7 +735,7 @@ convert_delimiter(char *path, char delim)
43923 }
43924
43925 #ifdef CONFIG_CIFS_STATS
43926 -#define cifs_stats_inc atomic_inc
43927 +#define cifs_stats_inc atomic_inc_unchecked
43928
43929 static inline void cifs_stats_bytes_written(struct cifs_tcon *tcon,
43930 unsigned int bytes)
43931 @@ -1093,8 +1093,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnectCount;
43932 /* Various Debug counters */
43933 GLOBAL_EXTERN atomic_t bufAllocCount; /* current number allocated */
43934 #ifdef CONFIG_CIFS_STATS2
43935 -GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */
43936 -GLOBAL_EXTERN atomic_t totSmBufAllocCount;
43937 +GLOBAL_EXTERN atomic_unchecked_t totBufAllocCount; /* total allocated over all time */
43938 +GLOBAL_EXTERN atomic_unchecked_t totSmBufAllocCount;
43939 #endif
43940 GLOBAL_EXTERN atomic_t smBufAllocCount;
43941 GLOBAL_EXTERN atomic_t midCount;
43942 diff --git a/fs/cifs/link.c b/fs/cifs/link.c
43943 index 6b0e064..94e6c3c 100644
43944 --- a/fs/cifs/link.c
43945 +++ b/fs/cifs/link.c
43946 @@ -600,7 +600,7 @@ symlink_exit:
43947
43948 void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
43949 {
43950 - char *p = nd_get_link(nd);
43951 + const char *p = nd_get_link(nd);
43952 if (!IS_ERR(p))
43953 kfree(p);
43954 }
43955 diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
43956 index 557506a..2fd3816 100644
43957 --- a/fs/cifs/misc.c
43958 +++ b/fs/cifs/misc.c
43959 @@ -156,7 +156,7 @@ cifs_buf_get(void)
43960 memset(ret_buf, 0, sizeof(struct smb_hdr) + 3);
43961 atomic_inc(&bufAllocCount);
43962 #ifdef CONFIG_CIFS_STATS2
43963 - atomic_inc(&totBufAllocCount);
43964 + atomic_inc_unchecked(&totBufAllocCount);
43965 #endif /* CONFIG_CIFS_STATS2 */
43966 }
43967
43968 @@ -191,7 +191,7 @@ cifs_small_buf_get(void)
43969 /* memset(ret_buf, 0, sizeof(struct smb_hdr) + 27);*/
43970 atomic_inc(&smBufAllocCount);
43971 #ifdef CONFIG_CIFS_STATS2
43972 - atomic_inc(&totSmBufAllocCount);
43973 + atomic_inc_unchecked(&totSmBufAllocCount);
43974 #endif /* CONFIG_CIFS_STATS2 */
43975
43976 }
43977 diff --git a/fs/coda/cache.c b/fs/coda/cache.c
43978 index 6901578..d402eb5 100644
43979 --- a/fs/coda/cache.c
43980 +++ b/fs/coda/cache.c
43981 @@ -24,7 +24,7 @@
43982 #include "coda_linux.h"
43983 #include "coda_cache.h"
43984
43985 -static atomic_t permission_epoch = ATOMIC_INIT(0);
43986 +static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
43987
43988 /* replace or extend an acl cache hit */
43989 void coda_cache_enter(struct inode *inode, int mask)
43990 @@ -32,7 +32,7 @@ void coda_cache_enter(struct inode *inode, int mask)
43991 struct coda_inode_info *cii = ITOC(inode);
43992
43993 spin_lock(&cii->c_lock);
43994 - cii->c_cached_epoch = atomic_read(&permission_epoch);
43995 + cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
43996 if (cii->c_uid != current_fsuid()) {
43997 cii->c_uid = current_fsuid();
43998 cii->c_cached_perm = mask;
43999 @@ -46,14 +46,14 @@ void coda_cache_clear_inode(struct inode *inode)
44000 {
44001 struct coda_inode_info *cii = ITOC(inode);
44002 spin_lock(&cii->c_lock);
44003 - cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
44004 + cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
44005 spin_unlock(&cii->c_lock);
44006 }
44007
44008 /* remove all acl caches */
44009 void coda_cache_clear_all(struct super_block *sb)
44010 {
44011 - atomic_inc(&permission_epoch);
44012 + atomic_inc_unchecked(&permission_epoch);
44013 }
44014
44015
44016 @@ -66,7 +66,7 @@ int coda_cache_check(struct inode *inode, int mask)
44017 spin_lock(&cii->c_lock);
44018 hit = (mask & cii->c_cached_perm) == mask &&
44019 cii->c_uid == current_fsuid() &&
44020 - cii->c_cached_epoch == atomic_read(&permission_epoch);
44021 + cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
44022 spin_unlock(&cii->c_lock);
44023
44024 return hit;
44025 diff --git a/fs/compat.c b/fs/compat.c
44026 index 1bdb350..9f28287 100644
44027 --- a/fs/compat.c
44028 +++ b/fs/compat.c
44029 @@ -490,7 +490,7 @@ compat_sys_io_setup(unsigned nr_reqs, u32 __user *ctx32p)
44030
44031 set_fs(KERNEL_DS);
44032 /* The __user pointer cast is valid because of the set_fs() */
44033 - ret = sys_io_setup(nr_reqs, (aio_context_t __user *) &ctx64);
44034 + ret = sys_io_setup(nr_reqs, (aio_context_t __force_user *) &ctx64);
44035 set_fs(oldfs);
44036 /* truncating is ok because it's a user address */
44037 if (!ret)
44038 @@ -548,7 +548,7 @@ ssize_t compat_rw_copy_check_uvector(int type,
44039 goto out;
44040
44041 ret = -EINVAL;
44042 - if (nr_segs > UIO_MAXIOV || nr_segs < 0)
44043 + if (nr_segs > UIO_MAXIOV)
44044 goto out;
44045 if (nr_segs > fast_segs) {
44046 ret = -ENOMEM;
44047 @@ -831,6 +831,7 @@ struct compat_old_linux_dirent {
44048
44049 struct compat_readdir_callback {
44050 struct compat_old_linux_dirent __user *dirent;
44051 + struct file * file;
44052 int result;
44053 };
44054
44055 @@ -848,6 +849,10 @@ static int compat_fillonedir(void *__buf, const char *name, int namlen,
44056 buf->result = -EOVERFLOW;
44057 return -EOVERFLOW;
44058 }
44059 +
44060 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
44061 + return 0;
44062 +
44063 buf->result++;
44064 dirent = buf->dirent;
44065 if (!access_ok(VERIFY_WRITE, dirent,
44066 @@ -880,6 +885,7 @@ asmlinkage long compat_sys_old_readdir(unsigned int fd,
44067
44068 buf.result = 0;
44069 buf.dirent = dirent;
44070 + buf.file = file;
44071
44072 error = vfs_readdir(file, compat_fillonedir, &buf);
44073 if (buf.result)
44074 @@ -899,6 +905,7 @@ struct compat_linux_dirent {
44075 struct compat_getdents_callback {
44076 struct compat_linux_dirent __user *current_dir;
44077 struct compat_linux_dirent __user *previous;
44078 + struct file * file;
44079 int count;
44080 int error;
44081 };
44082 @@ -920,6 +927,10 @@ static int compat_filldir(void *__buf, const char *name, int namlen,
44083 buf->error = -EOVERFLOW;
44084 return -EOVERFLOW;
44085 }
44086 +
44087 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
44088 + return 0;
44089 +
44090 dirent = buf->previous;
44091 if (dirent) {
44092 if (__put_user(offset, &dirent->d_off))
44093 @@ -966,6 +977,7 @@ asmlinkage long compat_sys_getdents(unsigned int fd,
44094 buf.previous = NULL;
44095 buf.count = count;
44096 buf.error = 0;
44097 + buf.file = file;
44098
44099 error = vfs_readdir(file, compat_filldir, &buf);
44100 if (error >= 0)
44101 @@ -986,6 +998,7 @@ asmlinkage long compat_sys_getdents(unsigned int fd,
44102 struct compat_getdents_callback64 {
44103 struct linux_dirent64 __user *current_dir;
44104 struct linux_dirent64 __user *previous;
44105 + struct file * file;
44106 int count;
44107 int error;
44108 };
44109 @@ -1002,6 +1015,10 @@ static int compat_filldir64(void * __buf, const char * name, int namlen, loff_t
44110 buf->error = -EINVAL; /* only used if we fail.. */
44111 if (reclen > buf->count)
44112 return -EINVAL;
44113 +
44114 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
44115 + return 0;
44116 +
44117 dirent = buf->previous;
44118
44119 if (dirent) {
44120 @@ -1052,13 +1069,14 @@ asmlinkage long compat_sys_getdents64(unsigned int fd,
44121 buf.previous = NULL;
44122 buf.count = count;
44123 buf.error = 0;
44124 + buf.file = file;
44125
44126 error = vfs_readdir(file, compat_filldir64, &buf);
44127 if (error >= 0)
44128 error = buf.error;
44129 lastdirent = buf.previous;
44130 if (lastdirent) {
44131 - typeof(lastdirent->d_off) d_off = file->f_pos;
44132 + typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
44133 if (__put_user_unaligned(d_off, &lastdirent->d_off))
44134 error = -EFAULT;
44135 else
44136 diff --git a/fs/compat_binfmt_elf.c b/fs/compat_binfmt_elf.c
44137 index 112e45a..b59845b 100644
44138 --- a/fs/compat_binfmt_elf.c
44139 +++ b/fs/compat_binfmt_elf.c
44140 @@ -30,11 +30,13 @@
44141 #undef elf_phdr
44142 #undef elf_shdr
44143 #undef elf_note
44144 +#undef elf_dyn
44145 #undef elf_addr_t
44146 #define elfhdr elf32_hdr
44147 #define elf_phdr elf32_phdr
44148 #define elf_shdr elf32_shdr
44149 #define elf_note elf32_note
44150 +#define elf_dyn Elf32_Dyn
44151 #define elf_addr_t Elf32_Addr
44152
44153 /*
44154 diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
44155 index debdfe0..75d31d4 100644
44156 --- a/fs/compat_ioctl.c
44157 +++ b/fs/compat_ioctl.c
44158 @@ -210,6 +210,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd,
44159
44160 err = get_user(palp, &up->palette);
44161 err |= get_user(length, &up->length);
44162 + if (err)
44163 + return -EFAULT;
44164
44165 up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
44166 err = put_user(compat_ptr(palp), &up_native->palette);
44167 @@ -621,7 +623,7 @@ static int serial_struct_ioctl(unsigned fd, unsigned cmd,
44168 return -EFAULT;
44169 if (__get_user(udata, &ss32->iomem_base))
44170 return -EFAULT;
44171 - ss.iomem_base = compat_ptr(udata);
44172 + ss.iomem_base = (unsigned char __force_kernel *)compat_ptr(udata);
44173 if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) ||
44174 __get_user(ss.port_high, &ss32->port_high))
44175 return -EFAULT;
44176 @@ -796,7 +798,7 @@ static int compat_ioctl_preallocate(struct file *file,
44177 copy_in_user(&p->l_len, &p32->l_len, sizeof(s64)) ||
44178 copy_in_user(&p->l_sysid, &p32->l_sysid, sizeof(s32)) ||
44179 copy_in_user(&p->l_pid, &p32->l_pid, sizeof(u32)) ||
44180 - copy_in_user(&p->l_pad, &p32->l_pad, 4*sizeof(u32)))
44181 + copy_in_user(p->l_pad, &p32->l_pad, 4*sizeof(u32)))
44182 return -EFAULT;
44183
44184 return ioctl_preallocate(file, p);
44185 @@ -1610,8 +1612,8 @@ asmlinkage long compat_sys_ioctl(unsigned int fd, unsigned int cmd,
44186 static int __init init_sys32_ioctl_cmp(const void *p, const void *q)
44187 {
44188 unsigned int a, b;
44189 - a = *(unsigned int *)p;
44190 - b = *(unsigned int *)q;
44191 + a = *(const unsigned int *)p;
44192 + b = *(const unsigned int *)q;
44193 if (a > b)
44194 return 1;
44195 if (a < b)
44196 diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
44197 index 7e6c52d..94bc756 100644
44198 --- a/fs/configfs/dir.c
44199 +++ b/fs/configfs/dir.c
44200 @@ -1564,7 +1564,8 @@ static int configfs_readdir(struct file * filp, void * dirent, filldir_t filldir
44201 }
44202 for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
44203 struct configfs_dirent *next;
44204 - const char * name;
44205 + const unsigned char * name;
44206 + char d_name[sizeof(next->s_dentry->d_iname)];
44207 int len;
44208 struct inode *inode = NULL;
44209
44210 @@ -1574,7 +1575,12 @@ static int configfs_readdir(struct file * filp, void * dirent, filldir_t filldir
44211 continue;
44212
44213 name = configfs_get_name(next);
44214 - len = strlen(name);
44215 + if (next->s_dentry && name == next->s_dentry->d_iname) {
44216 + len = next->s_dentry->d_name.len;
44217 + memcpy(d_name, name, len);
44218 + name = d_name;
44219 + } else
44220 + len = strlen(name);
44221
44222 /*
44223 * We'll have a dentry and an inode for
44224 diff --git a/fs/dcache.c b/fs/dcache.c
44225 index 4046904..5e31505 100644
44226 --- a/fs/dcache.c
44227 +++ b/fs/dcache.c
44228 @@ -3154,7 +3154,7 @@ void __init vfs_caches_init(unsigned long mempages)
44229 mempages -= reserve;
44230
44231 names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
44232 - SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
44233 + SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
44234
44235 dcache_init();
44236 inode_init();
44237 diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
44238 index b80bc84..0d46d1a 100644
44239 --- a/fs/debugfs/inode.c
44240 +++ b/fs/debugfs/inode.c
44241 @@ -408,7 +408,11 @@ EXPORT_SYMBOL_GPL(debugfs_create_file);
44242 struct dentry *debugfs_create_dir(const char *name, struct dentry *parent)
44243 {
44244 return debugfs_create_file(name,
44245 +#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
44246 + S_IFDIR | S_IRWXU,
44247 +#else
44248 S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
44249 +#endif
44250 parent, NULL, NULL);
44251 }
44252 EXPORT_SYMBOL_GPL(debugfs_create_dir);
44253 diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
44254 index a07441a..046fc0d 100644
44255 --- a/fs/ecryptfs/inode.c
44256 +++ b/fs/ecryptfs/inode.c
44257 @@ -671,7 +671,7 @@ static int ecryptfs_readlink_lower(struct dentry *dentry, char **buf,
44258 old_fs = get_fs();
44259 set_fs(get_ds());
44260 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
44261 - (char __user *)lower_buf,
44262 + (char __force_user *)lower_buf,
44263 PATH_MAX);
44264 set_fs(old_fs);
44265 if (rc < 0)
44266 @@ -703,7 +703,7 @@ out:
44267 static void
44268 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
44269 {
44270 - char *buf = nd_get_link(nd);
44271 + const char *buf = nd_get_link(nd);
44272 if (!IS_ERR(buf)) {
44273 /* Free the char* */
44274 kfree(buf);
44275 diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
44276 index c0038f6..47ab347 100644
44277 --- a/fs/ecryptfs/miscdev.c
44278 +++ b/fs/ecryptfs/miscdev.c
44279 @@ -355,7 +355,7 @@ check_list:
44280 goto out_unlock_msg_ctx;
44281 i = PKT_TYPE_SIZE + PKT_CTR_SIZE;
44282 if (msg_ctx->msg) {
44283 - if (copy_to_user(&buf[i], packet_length, packet_length_size))
44284 + if (packet_length_size > sizeof(packet_length) || copy_to_user(&buf[i], packet_length, packet_length_size))
44285 goto out_unlock_msg_ctx;
44286 i += packet_length_size;
44287 if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
44288 diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
44289 index b2a34a1..162fa69 100644
44290 --- a/fs/ecryptfs/read_write.c
44291 +++ b/fs/ecryptfs/read_write.c
44292 @@ -48,7 +48,7 @@ int ecryptfs_write_lower(struct inode *ecryptfs_inode, char *data,
44293 return -EIO;
44294 fs_save = get_fs();
44295 set_fs(get_ds());
44296 - rc = vfs_write(lower_file, data, size, &offset);
44297 + rc = vfs_write(lower_file, (const char __force_user *)data, size, &offset);
44298 set_fs(fs_save);
44299 mark_inode_dirty_sync(ecryptfs_inode);
44300 return rc;
44301 @@ -244,7 +244,7 @@ int ecryptfs_read_lower(char *data, loff_t offset, size_t size,
44302 return -EIO;
44303 fs_save = get_fs();
44304 set_fs(get_ds());
44305 - rc = vfs_read(lower_file, data, size, &offset);
44306 + rc = vfs_read(lower_file, (char __force_user *)data, size, &offset);
44307 set_fs(fs_save);
44308 return rc;
44309 }
44310 diff --git a/fs/eventpoll.c b/fs/eventpoll.c
44311 index 1c8b556..eedec84 100644
44312 --- a/fs/eventpoll.c
44313 +++ b/fs/eventpoll.c
44314 @@ -1654,8 +1654,8 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
44315 error = PTR_ERR(file);
44316 goto out_free_fd;
44317 }
44318 - fd_install(fd, file);
44319 ep->file = file;
44320 + fd_install(fd, file);
44321 return fd;
44322
44323 out_free_fd:
44324 diff --git a/fs/exec.c b/fs/exec.c
44325 index e95aeed..a943469 100644
44326 --- a/fs/exec.c
44327 +++ b/fs/exec.c
44328 @@ -55,6 +55,15 @@
44329 #include <linux/pipe_fs_i.h>
44330 #include <linux/oom.h>
44331 #include <linux/compat.h>
44332 +#include <linux/random.h>
44333 +#include <linux/seq_file.h>
44334 +
44335 +#ifdef CONFIG_PAX_REFCOUNT
44336 +#include <linux/kallsyms.h>
44337 +#include <linux/kdebug.h>
44338 +#endif
44339 +
44340 +#include <trace/events/fs.h>
44341
44342 #include <asm/uaccess.h>
44343 #include <asm/mmu_context.h>
44344 @@ -66,6 +75,18 @@
44345
44346 #include <trace/events/sched.h>
44347
44348 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
44349 +void __weak pax_set_initial_flags(struct linux_binprm *bprm)
44350 +{
44351 + WARN_ONCE(1, "PAX: PAX_HAVE_ACL_FLAGS was enabled without providing the pax_set_initial_flags callback, this is probably not what you wanted.\n");
44352 +}
44353 +#endif
44354 +
44355 +#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
44356 +void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
44357 +EXPORT_SYMBOL(pax_set_initial_flags_func);
44358 +#endif
44359 +
44360 int core_uses_pid;
44361 char core_pattern[CORENAME_MAX_SIZE] = "core";
44362 unsigned int core_pipe_limit;
44363 @@ -75,7 +96,7 @@ struct core_name {
44364 char *corename;
44365 int used, size;
44366 };
44367 -static atomic_t call_count = ATOMIC_INIT(1);
44368 +static atomic_unchecked_t call_count = ATOMIC_INIT(1);
44369
44370 /* The maximal length of core_pattern is also specified in sysctl.c */
44371
44372 @@ -191,18 +212,10 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
44373 int write)
44374 {
44375 struct page *page;
44376 - int ret;
44377
44378 -#ifdef CONFIG_STACK_GROWSUP
44379 - if (write) {
44380 - ret = expand_downwards(bprm->vma, pos);
44381 - if (ret < 0)
44382 - return NULL;
44383 - }
44384 -#endif
44385 - ret = get_user_pages(current, bprm->mm, pos,
44386 - 1, write, 1, &page, NULL);
44387 - if (ret <= 0)
44388 + if (0 > expand_downwards(bprm->vma, pos))
44389 + return NULL;
44390 + if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
44391 return NULL;
44392
44393 if (write) {
44394 @@ -218,6 +231,17 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
44395 if (size <= ARG_MAX)
44396 return page;
44397
44398 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
44399 + // only allow 512KB for argv+env on suid/sgid binaries
44400 + // to prevent easy ASLR exhaustion
44401 + if (((bprm->cred->euid != current_euid()) ||
44402 + (bprm->cred->egid != current_egid())) &&
44403 + (size > (512 * 1024))) {
44404 + put_page(page);
44405 + return NULL;
44406 + }
44407 +#endif
44408 +
44409 /*
44410 * Limit to 1/4-th the stack size for the argv+env strings.
44411 * This ensures that:
44412 @@ -277,6 +301,11 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
44413 vma->vm_end = STACK_TOP_MAX;
44414 vma->vm_start = vma->vm_end - PAGE_SIZE;
44415 vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
44416 +
44417 +#ifdef CONFIG_PAX_SEGMEXEC
44418 + vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
44419 +#endif
44420 +
44421 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
44422 INIT_LIST_HEAD(&vma->anon_vma_chain);
44423
44424 @@ -287,6 +316,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
44425 mm->stack_vm = mm->total_vm = 1;
44426 up_write(&mm->mmap_sem);
44427 bprm->p = vma->vm_end - sizeof(void *);
44428 +
44429 +#ifdef CONFIG_PAX_RANDUSTACK
44430 + if (randomize_va_space)
44431 + bprm->p ^= random32() & ~PAGE_MASK;
44432 +#endif
44433 +
44434 return 0;
44435 err:
44436 up_write(&mm->mmap_sem);
44437 @@ -395,19 +430,7 @@ err:
44438 return err;
44439 }
44440
44441 -struct user_arg_ptr {
44442 -#ifdef CONFIG_COMPAT
44443 - bool is_compat;
44444 -#endif
44445 - union {
44446 - const char __user *const __user *native;
44447 -#ifdef CONFIG_COMPAT
44448 - compat_uptr_t __user *compat;
44449 -#endif
44450 - } ptr;
44451 -};
44452 -
44453 -static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
44454 +const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
44455 {
44456 const char __user *native;
44457
44458 @@ -416,14 +439,14 @@ static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
44459 compat_uptr_t compat;
44460
44461 if (get_user(compat, argv.ptr.compat + nr))
44462 - return ERR_PTR(-EFAULT);
44463 + return (const char __force_user *)ERR_PTR(-EFAULT);
44464
44465 return compat_ptr(compat);
44466 }
44467 #endif
44468
44469 if (get_user(native, argv.ptr.native + nr))
44470 - return ERR_PTR(-EFAULT);
44471 + return (const char __force_user *)ERR_PTR(-EFAULT);
44472
44473 return native;
44474 }
44475 @@ -442,7 +465,7 @@ static int count(struct user_arg_ptr argv, int max)
44476 if (!p)
44477 break;
44478
44479 - if (IS_ERR(p))
44480 + if (IS_ERR((const char __force_kernel *)p))
44481 return -EFAULT;
44482
44483 if (i++ >= max)
44484 @@ -476,7 +499,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv,
44485
44486 ret = -EFAULT;
44487 str = get_user_arg_ptr(argv, argc);
44488 - if (IS_ERR(str))
44489 + if (IS_ERR((const char __force_kernel *)str))
44490 goto out;
44491
44492 len = strnlen_user(str, MAX_ARG_STRLEN);
44493 @@ -558,7 +581,7 @@ int copy_strings_kernel(int argc, const char *const *__argv,
44494 int r;
44495 mm_segment_t oldfs = get_fs();
44496 struct user_arg_ptr argv = {
44497 - .ptr.native = (const char __user *const __user *)__argv,
44498 + .ptr.native = (const char __force_user *const __force_user *)__argv,
44499 };
44500
44501 set_fs(KERNEL_DS);
44502 @@ -593,7 +616,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
44503 unsigned long new_end = old_end - shift;
44504 struct mmu_gather tlb;
44505
44506 - BUG_ON(new_start > new_end);
44507 + if (new_start >= new_end || new_start < mmap_min_addr)
44508 + return -ENOMEM;
44509
44510 /*
44511 * ensure there are no vmas between where we want to go
44512 @@ -602,6 +626,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
44513 if (vma != find_vma(mm, new_start))
44514 return -EFAULT;
44515
44516 +#ifdef CONFIG_PAX_SEGMEXEC
44517 + BUG_ON(pax_find_mirror_vma(vma));
44518 +#endif
44519 +
44520 /*
44521 * cover the whole range: [new_start, old_end)
44522 */
44523 @@ -682,10 +710,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
44524 stack_top = arch_align_stack(stack_top);
44525 stack_top = PAGE_ALIGN(stack_top);
44526
44527 - if (unlikely(stack_top < mmap_min_addr) ||
44528 - unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
44529 - return -ENOMEM;
44530 -
44531 stack_shift = vma->vm_end - stack_top;
44532
44533 bprm->p -= stack_shift;
44534 @@ -697,8 +721,28 @@ int setup_arg_pages(struct linux_binprm *bprm,
44535 bprm->exec -= stack_shift;
44536
44537 down_write(&mm->mmap_sem);
44538 +
44539 + /* Move stack pages down in memory. */
44540 + if (stack_shift) {
44541 + ret = shift_arg_pages(vma, stack_shift);
44542 + if (ret)
44543 + goto out_unlock;
44544 + }
44545 +
44546 vm_flags = VM_STACK_FLAGS;
44547
44548 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
44549 + if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
44550 + vm_flags &= ~VM_EXEC;
44551 +
44552 +#ifdef CONFIG_PAX_MPROTECT
44553 + if (mm->pax_flags & MF_PAX_MPROTECT)
44554 + vm_flags &= ~VM_MAYEXEC;
44555 +#endif
44556 +
44557 + }
44558 +#endif
44559 +
44560 /*
44561 * Adjust stack execute permissions; explicitly enable for
44562 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
44563 @@ -717,13 +761,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
44564 goto out_unlock;
44565 BUG_ON(prev != vma);
44566
44567 - /* Move stack pages down in memory. */
44568 - if (stack_shift) {
44569 - ret = shift_arg_pages(vma, stack_shift);
44570 - if (ret)
44571 - goto out_unlock;
44572 - }
44573 -
44574 /* mprotect_fixup is overkill to remove the temporary stack flags */
44575 vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
44576
44577 @@ -781,6 +818,8 @@ struct file *open_exec(const char *name)
44578
44579 fsnotify_open(file);
44580
44581 + trace_open_exec(name);
44582 +
44583 err = deny_write_access(file);
44584 if (err)
44585 goto exit;
44586 @@ -804,7 +843,7 @@ int kernel_read(struct file *file, loff_t offset,
44587 old_fs = get_fs();
44588 set_fs(get_ds());
44589 /* The cast to a user pointer is valid due to the set_fs() */
44590 - result = vfs_read(file, (void __user *)addr, count, &pos);
44591 + result = vfs_read(file, (void __force_user *)addr, count, &pos);
44592 set_fs(old_fs);
44593 return result;
44594 }
44595 @@ -1257,7 +1296,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm)
44596 }
44597 rcu_read_unlock();
44598
44599 - if (p->fs->users > n_fs) {
44600 + if (atomic_read(&p->fs->users) > n_fs) {
44601 bprm->unsafe |= LSM_UNSAFE_SHARE;
44602 } else {
44603 res = -EAGAIN;
44604 @@ -1460,6 +1499,28 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
44605
44606 EXPORT_SYMBOL(search_binary_handler);
44607
44608 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
44609 +static DEFINE_PER_CPU(u64, exec_counter);
44610 +static int __init init_exec_counters(void)
44611 +{
44612 + unsigned int cpu;
44613 +
44614 + for_each_possible_cpu(cpu) {
44615 + per_cpu(exec_counter, cpu) = (u64)cpu;
44616 + }
44617 +
44618 + return 0;
44619 +}
44620 +early_initcall(init_exec_counters);
44621 +static inline void increment_exec_counter(void)
44622 +{
44623 + BUILD_BUG_ON(NR_CPUS > (1 << 16));
44624 + current->exec_id = this_cpu_add_return(exec_counter, 1 << 16);
44625 +}
44626 +#else
44627 +static inline void increment_exec_counter(void) {}
44628 +#endif
44629 +
44630 /*
44631 * sys_execve() executes a new program.
44632 */
44633 @@ -1468,6 +1529,11 @@ static int do_execve_common(const char *filename,
44634 struct user_arg_ptr envp,
44635 struct pt_regs *regs)
44636 {
44637 +#ifdef CONFIG_GRKERNSEC
44638 + struct file *old_exec_file;
44639 + struct acl_subject_label *old_acl;
44640 + struct rlimit old_rlim[RLIM_NLIMITS];
44641 +#endif
44642 struct linux_binprm *bprm;
44643 struct file *file;
44644 struct files_struct *displaced;
44645 @@ -1475,6 +1541,8 @@ static int do_execve_common(const char *filename,
44646 int retval;
44647 const struct cred *cred = current_cred();
44648
44649 + gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
44650 +
44651 /*
44652 * We move the actual failure in case of RLIMIT_NPROC excess from
44653 * set*uid() to execve() because too many poorly written programs
44654 @@ -1515,12 +1583,27 @@ static int do_execve_common(const char *filename,
44655 if (IS_ERR(file))
44656 goto out_unmark;
44657
44658 + if (gr_ptrace_readexec(file, bprm->unsafe)) {
44659 + retval = -EPERM;
44660 + goto out_file;
44661 + }
44662 +
44663 sched_exec();
44664
44665 bprm->file = file;
44666 bprm->filename = filename;
44667 bprm->interp = filename;
44668
44669 + if (gr_process_user_ban()) {
44670 + retval = -EPERM;
44671 + goto out_file;
44672 + }
44673 +
44674 + if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
44675 + retval = -EACCES;
44676 + goto out_file;
44677 + }
44678 +
44679 retval = bprm_mm_init(bprm);
44680 if (retval)
44681 goto out_file;
44682 @@ -1537,24 +1620,65 @@ static int do_execve_common(const char *filename,
44683 if (retval < 0)
44684 goto out;
44685
44686 +#ifdef CONFIG_GRKERNSEC
44687 + old_acl = current->acl;
44688 + memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
44689 + old_exec_file = current->exec_file;
44690 + get_file(file);
44691 + current->exec_file = file;
44692 +#endif
44693 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
44694 + /* limit suid stack to 8MB
44695 + we saved the old limits above and will restore them if this exec fails
44696 + */
44697 + if (((bprm->cred->euid != current_euid()) || (bprm->cred->egid != current_egid())) &&
44698 + (old_rlim[RLIMIT_STACK].rlim_cur > (8 * 1024 * 1024)))
44699 + current->signal->rlim[RLIMIT_STACK].rlim_cur = 8 * 1024 * 1024;
44700 +#endif
44701 +
44702 + if (!gr_tpe_allow(file)) {
44703 + retval = -EACCES;
44704 + goto out_fail;
44705 + }
44706 +
44707 + if (gr_check_crash_exec(file)) {
44708 + retval = -EACCES;
44709 + goto out_fail;
44710 + }
44711 +
44712 + retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
44713 + bprm->unsafe);
44714 + if (retval < 0)
44715 + goto out_fail;
44716 +
44717 retval = copy_strings_kernel(1, &bprm->filename, bprm);
44718 if (retval < 0)
44719 - goto out;
44720 + goto out_fail;
44721
44722 bprm->exec = bprm->p;
44723 retval = copy_strings(bprm->envc, envp, bprm);
44724 if (retval < 0)
44725 - goto out;
44726 + goto out_fail;
44727
44728 retval = copy_strings(bprm->argc, argv, bprm);
44729 if (retval < 0)
44730 - goto out;
44731 + goto out_fail;
44732 +
44733 + gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
44734 +
44735 + gr_handle_exec_args(bprm, argv);
44736
44737 retval = search_binary_handler(bprm,regs);
44738 if (retval < 0)
44739 - goto out;
44740 + goto out_fail;
44741 +#ifdef CONFIG_GRKERNSEC
44742 + if (old_exec_file)
44743 + fput(old_exec_file);
44744 +#endif
44745
44746 /* execve succeeded */
44747 +
44748 + increment_exec_counter();
44749 current->fs->in_exec = 0;
44750 current->in_execve = 0;
44751 acct_update_integrals(current);
44752 @@ -1563,6 +1687,14 @@ static int do_execve_common(const char *filename,
44753 put_files_struct(displaced);
44754 return retval;
44755
44756 +out_fail:
44757 +#ifdef CONFIG_GRKERNSEC
44758 + current->acl = old_acl;
44759 + memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
44760 + fput(current->exec_file);
44761 + current->exec_file = old_exec_file;
44762 +#endif
44763 +
44764 out:
44765 if (bprm->mm) {
44766 acct_arg_size(bprm, 0);
44767 @@ -1636,7 +1768,7 @@ static int expand_corename(struct core_name *cn)
44768 {
44769 char *old_corename = cn->corename;
44770
44771 - cn->size = CORENAME_MAX_SIZE * atomic_inc_return(&call_count);
44772 + cn->size = CORENAME_MAX_SIZE * atomic_inc_return_unchecked(&call_count);
44773 cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
44774
44775 if (!cn->corename) {
44776 @@ -1733,7 +1865,7 @@ static int format_corename(struct core_name *cn, long signr)
44777 int pid_in_pattern = 0;
44778 int err = 0;
44779
44780 - cn->size = CORENAME_MAX_SIZE * atomic_read(&call_count);
44781 + cn->size = CORENAME_MAX_SIZE * atomic_read_unchecked(&call_count);
44782 cn->corename = kmalloc(cn->size, GFP_KERNEL);
44783 cn->used = 0;
44784
44785 @@ -1830,6 +1962,250 @@ out:
44786 return ispipe;
44787 }
44788
44789 +int pax_check_flags(unsigned long *flags)
44790 +{
44791 + int retval = 0;
44792 +
44793 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
44794 + if (*flags & MF_PAX_SEGMEXEC)
44795 + {
44796 + *flags &= ~MF_PAX_SEGMEXEC;
44797 + retval = -EINVAL;
44798 + }
44799 +#endif
44800 +
44801 + if ((*flags & MF_PAX_PAGEEXEC)
44802 +
44803 +#ifdef CONFIG_PAX_PAGEEXEC
44804 + && (*flags & MF_PAX_SEGMEXEC)
44805 +#endif
44806 +
44807 + )
44808 + {
44809 + *flags &= ~MF_PAX_PAGEEXEC;
44810 + retval = -EINVAL;
44811 + }
44812 +
44813 + if ((*flags & MF_PAX_MPROTECT)
44814 +
44815 +#ifdef CONFIG_PAX_MPROTECT
44816 + && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
44817 +#endif
44818 +
44819 + )
44820 + {
44821 + *flags &= ~MF_PAX_MPROTECT;
44822 + retval = -EINVAL;
44823 + }
44824 +
44825 + if ((*flags & MF_PAX_EMUTRAMP)
44826 +
44827 +#ifdef CONFIG_PAX_EMUTRAMP
44828 + && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
44829 +#endif
44830 +
44831 + )
44832 + {
44833 + *flags &= ~MF_PAX_EMUTRAMP;
44834 + retval = -EINVAL;
44835 + }
44836 +
44837 + return retval;
44838 +}
44839 +
44840 +EXPORT_SYMBOL(pax_check_flags);
44841 +
44842 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
44843 +void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
44844 +{
44845 + struct task_struct *tsk = current;
44846 + struct mm_struct *mm = current->mm;
44847 + char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
44848 + char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
44849 + char *path_exec = NULL;
44850 + char *path_fault = NULL;
44851 + unsigned long start = 0UL, end = 0UL, offset = 0UL;
44852 +
44853 + if (buffer_exec && buffer_fault) {
44854 + struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
44855 +
44856 + down_read(&mm->mmap_sem);
44857 + vma = mm->mmap;
44858 + while (vma && (!vma_exec || !vma_fault)) {
44859 + if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
44860 + vma_exec = vma;
44861 + if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
44862 + vma_fault = vma;
44863 + vma = vma->vm_next;
44864 + }
44865 + if (vma_exec) {
44866 + path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
44867 + if (IS_ERR(path_exec))
44868 + path_exec = "<path too long>";
44869 + else {
44870 + path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
44871 + if (path_exec) {
44872 + *path_exec = 0;
44873 + path_exec = buffer_exec;
44874 + } else
44875 + path_exec = "<path too long>";
44876 + }
44877 + }
44878 + if (vma_fault) {
44879 + start = vma_fault->vm_start;
44880 + end = vma_fault->vm_end;
44881 + offset = vma_fault->vm_pgoff << PAGE_SHIFT;
44882 + if (vma_fault->vm_file) {
44883 + path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
44884 + if (IS_ERR(path_fault))
44885 + path_fault = "<path too long>";
44886 + else {
44887 + path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
44888 + if (path_fault) {
44889 + *path_fault = 0;
44890 + path_fault = buffer_fault;
44891 + } else
44892 + path_fault = "<path too long>";
44893 + }
44894 + } else
44895 + path_fault = "<anonymous mapping>";
44896 + }
44897 + up_read(&mm->mmap_sem);
44898 + }
44899 + if (tsk->signal->curr_ip)
44900 + printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
44901 + else
44902 + printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
44903 + printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
44904 + "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
44905 + task_uid(tsk), task_euid(tsk), pc, sp);
44906 + free_page((unsigned long)buffer_exec);
44907 + free_page((unsigned long)buffer_fault);
44908 + pax_report_insns(regs, pc, sp);
44909 + do_coredump(SIGKILL, SIGKILL, regs);
44910 +}
44911 +#endif
44912 +
44913 +#ifdef CONFIG_PAX_REFCOUNT
44914 +void pax_report_refcount_overflow(struct pt_regs *regs)
44915 +{
44916 + if (current->signal->curr_ip)
44917 + printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
44918 + &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
44919 + else
44920 + printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
44921 + current->comm, task_pid_nr(current), current_uid(), current_euid());
44922 + print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
44923 + show_regs(regs);
44924 + force_sig_info(SIGKILL, SEND_SIG_FORCED, current);
44925 +}
44926 +#endif
44927 +
44928 +#ifdef CONFIG_PAX_USERCOPY
44929 +/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
44930 +static noinline int check_stack_object(const void *obj, unsigned long len)
44931 +{
44932 + const void * const stack = task_stack_page(current);
44933 + const void * const stackend = stack + THREAD_SIZE;
44934 +
44935 +#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
44936 + const void *frame = NULL;
44937 + const void *oldframe;
44938 +#endif
44939 +
44940 + if (obj + len < obj)
44941 + return -1;
44942 +
44943 + if (obj + len <= stack || stackend <= obj)
44944 + return 0;
44945 +
44946 + if (obj < stack || stackend < obj + len)
44947 + return -1;
44948 +
44949 +#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
44950 + oldframe = __builtin_frame_address(1);
44951 + if (oldframe)
44952 + frame = __builtin_frame_address(2);
44953 + /*
44954 + low ----------------------------------------------> high
44955 + [saved bp][saved ip][args][local vars][saved bp][saved ip]
44956 + ^----------------^
44957 + allow copies only within here
44958 + */
44959 + while (stack <= frame && frame < stackend) {
44960 + /* if obj + len extends past the last frame, this
44961 + check won't pass and the next frame will be 0,
44962 + causing us to bail out and correctly report
44963 + the copy as invalid
44964 + */
44965 + if (obj + len <= frame)
44966 + return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
44967 + oldframe = frame;
44968 + frame = *(const void * const *)frame;
44969 + }
44970 + return -1;
44971 +#else
44972 + return 1;
44973 +#endif
44974 +}
44975 +
44976 +static __noreturn void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
44977 +{
44978 + if (current->signal->curr_ip)
44979 + printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
44980 + &current->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
44981 + else
44982 + printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
44983 + to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
44984 + dump_stack();
44985 + gr_handle_kernel_exploit();
44986 + do_group_exit(SIGKILL);
44987 +}
44988 +#endif
44989 +
44990 +void check_object_size(const void *ptr, unsigned long n, bool to)
44991 +{
44992 +
44993 +#ifdef CONFIG_PAX_USERCOPY
44994 + const char *type;
44995 +
44996 + if (!n)
44997 + return;
44998 +
44999 + type = check_heap_object(ptr, n, to);
45000 + if (!type) {
45001 + if (check_stack_object(ptr, n) != -1)
45002 + return;
45003 + type = "<process stack>";
45004 + }
45005 +
45006 + pax_report_usercopy(ptr, n, to, type);
45007 +#endif
45008 +
45009 +}
45010 +EXPORT_SYMBOL(check_object_size);
45011 +
45012 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
45013 +void pax_track_stack(void)
45014 +{
45015 + unsigned long sp = (unsigned long)&sp;
45016 + if (sp < current_thread_info()->lowest_stack &&
45017 + sp > (unsigned long)task_stack_page(current))
45018 + current_thread_info()->lowest_stack = sp;
45019 +}
45020 +EXPORT_SYMBOL(pax_track_stack);
45021 +#endif
45022 +
45023 +#ifdef CONFIG_PAX_SIZE_OVERFLOW
45024 +void report_size_overflow(const char *file, unsigned int line, const char *func, const char *ssa_name)
45025 +{
45026 + printk(KERN_ERR "PAX: size overflow detected in function %s %s:%u %s", func, file, line, ssa_name);
45027 + dump_stack();
45028 + do_group_exit(SIGKILL);
45029 +}
45030 +EXPORT_SYMBOL(report_size_overflow);
45031 +#endif
45032 +
45033 static int zap_process(struct task_struct *start, int exit_code)
45034 {
45035 struct task_struct *t;
45036 @@ -2002,17 +2378,17 @@ static void coredump_finish(struct mm_struct *mm)
45037 void set_dumpable(struct mm_struct *mm, int value)
45038 {
45039 switch (value) {
45040 - case 0:
45041 + case SUID_DUMPABLE_DISABLED:
45042 clear_bit(MMF_DUMPABLE, &mm->flags);
45043 smp_wmb();
45044 clear_bit(MMF_DUMP_SECURELY, &mm->flags);
45045 break;
45046 - case 1:
45047 + case SUID_DUMPABLE_ENABLED:
45048 set_bit(MMF_DUMPABLE, &mm->flags);
45049 smp_wmb();
45050 clear_bit(MMF_DUMP_SECURELY, &mm->flags);
45051 break;
45052 - case 2:
45053 + case SUID_DUMPABLE_SAFE:
45054 set_bit(MMF_DUMP_SECURELY, &mm->flags);
45055 smp_wmb();
45056 set_bit(MMF_DUMPABLE, &mm->flags);
45057 @@ -2025,7 +2401,7 @@ static int __get_dumpable(unsigned long mm_flags)
45058 int ret;
45059
45060 ret = mm_flags & MMF_DUMPABLE_MASK;
45061 - return (ret >= 2) ? 2 : ret;
45062 + return (ret > SUID_DUMPABLE_ENABLED) ? SUID_DUMPABLE_SAFE : ret;
45063 }
45064
45065 int get_dumpable(struct mm_struct *mm)
45066 @@ -2040,17 +2416,17 @@ static void wait_for_dump_helpers(struct file *file)
45067 pipe = file->f_path.dentry->d_inode->i_pipe;
45068
45069 pipe_lock(pipe);
45070 - pipe->readers++;
45071 - pipe->writers--;
45072 + atomic_inc(&pipe->readers);
45073 + atomic_dec(&pipe->writers);
45074
45075 - while ((pipe->readers > 1) && (!signal_pending(current))) {
45076 + while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
45077 wake_up_interruptible_sync(&pipe->wait);
45078 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
45079 pipe_wait(pipe);
45080 }
45081
45082 - pipe->readers--;
45083 - pipe->writers++;
45084 + atomic_dec(&pipe->readers);
45085 + atomic_inc(&pipe->writers);
45086 pipe_unlock(pipe);
45087
45088 }
45089 @@ -2111,7 +2487,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
45090 int retval = 0;
45091 int flag = 0;
45092 int ispipe;
45093 - static atomic_t core_dump_count = ATOMIC_INIT(0);
45094 + bool need_nonrelative = false;
45095 + static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
45096 struct coredump_params cprm = {
45097 .signr = signr,
45098 .regs = regs,
45099 @@ -2126,6 +2503,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
45100
45101 audit_core_dumps(signr);
45102
45103 + if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
45104 + gr_handle_brute_attach(current, cprm.mm_flags);
45105 +
45106 binfmt = mm->binfmt;
45107 if (!binfmt || !binfmt->core_dump)
45108 goto fail;
45109 @@ -2136,14 +2516,16 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
45110 if (!cred)
45111 goto fail;
45112 /*
45113 - * We cannot trust fsuid as being the "true" uid of the
45114 - * process nor do we know its entire history. We only know it
45115 - * was tainted so we dump it as root in mode 2.
45116 + * We cannot trust fsuid as being the "true" uid of the process
45117 + * nor do we know its entire history. We only know it was tainted
45118 + * so we dump it as root in mode 2, and only into a controlled
45119 + * environment (pipe handler or fully qualified path).
45120 */
45121 - if (__get_dumpable(cprm.mm_flags) == 2) {
45122 + if (__get_dumpable(cprm.mm_flags) == SUID_DUMPABLE_SAFE) {
45123 /* Setuid core dump mode */
45124 flag = O_EXCL; /* Stop rewrite attacks */
45125 cred->fsuid = GLOBAL_ROOT_UID; /* Dump root private */
45126 + need_nonrelative = true;
45127 }
45128
45129 retval = coredump_wait(exit_code, &core_state);
45130 @@ -2193,7 +2575,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
45131 }
45132 cprm.limit = RLIM_INFINITY;
45133
45134 - dump_count = atomic_inc_return(&core_dump_count);
45135 + dump_count = atomic_inc_return_unchecked(&core_dump_count);
45136 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
45137 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
45138 task_tgid_vnr(current), current->comm);
45139 @@ -2220,9 +2602,19 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
45140 } else {
45141 struct inode *inode;
45142
45143 + gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
45144 +
45145 if (cprm.limit < binfmt->min_coredump)
45146 goto fail_unlock;
45147
45148 + if (need_nonrelative && cn.corename[0] != '/') {
45149 + printk(KERN_WARNING "Pid %d(%s) can only dump core "\
45150 + "to fully qualified path!\n",
45151 + task_tgid_vnr(current), current->comm);
45152 + printk(KERN_WARNING "Skipping core dump\n");
45153 + goto fail_unlock;
45154 + }
45155 +
45156 cprm.file = filp_open(cn.corename,
45157 O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
45158 0600);
45159 @@ -2263,7 +2655,7 @@ close_fail:
45160 filp_close(cprm.file, NULL);
45161 fail_dropcount:
45162 if (ispipe)
45163 - atomic_dec(&core_dump_count);
45164 + atomic_dec_unchecked(&core_dump_count);
45165 fail_unlock:
45166 kfree(cn.corename);
45167 fail_corename:
45168 @@ -2282,7 +2674,7 @@ fail:
45169 */
45170 int dump_write(struct file *file, const void *addr, int nr)
45171 {
45172 - return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, addr, nr, &file->f_pos) == nr;
45173 + return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, (const char __force_user *)addr, nr, &file->f_pos) == nr;
45174 }
45175 EXPORT_SYMBOL(dump_write);
45176
45177 diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
45178 index 1c36139..cf6b350 100644
45179 --- a/fs/ext2/balloc.c
45180 +++ b/fs/ext2/balloc.c
45181 @@ -1190,10 +1190,10 @@ static int ext2_has_free_blocks(struct ext2_sb_info *sbi)
45182
45183 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
45184 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
45185 - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
45186 + if (free_blocks < root_blocks + 1 &&
45187 !uid_eq(sbi->s_resuid, current_fsuid()) &&
45188 (gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) ||
45189 - !in_group_p (sbi->s_resgid))) {
45190 + !in_group_p (sbi->s_resgid)) && !capable_nolog(CAP_SYS_RESOURCE)) {
45191 return 0;
45192 }
45193 return 1;
45194 diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
45195 index 25cd608..9ed5294 100644
45196 --- a/fs/ext3/balloc.c
45197 +++ b/fs/ext3/balloc.c
45198 @@ -1438,10 +1438,10 @@ static int ext3_has_free_blocks(struct ext3_sb_info *sbi, int use_reservation)
45199
45200 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
45201 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
45202 - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
45203 + if (free_blocks < root_blocks + 1 &&
45204 !use_reservation && !uid_eq(sbi->s_resuid, current_fsuid()) &&
45205 (gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) ||
45206 - !in_group_p (sbi->s_resgid))) {
45207 + !in_group_p (sbi->s_resgid)) && !capable_nolog(CAP_SYS_RESOURCE)) {
45208 return 0;
45209 }
45210 return 1;
45211 diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
45212 index 1b50890..e56c5ad 100644
45213 --- a/fs/ext4/balloc.c
45214 +++ b/fs/ext4/balloc.c
45215 @@ -500,8 +500,8 @@ static int ext4_has_free_clusters(struct ext4_sb_info *sbi,
45216 /* Hm, nope. Are (enough) root reserved clusters available? */
45217 if (uid_eq(sbi->s_resuid, current_fsuid()) ||
45218 (!gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) && in_group_p(sbi->s_resgid)) ||
45219 - capable(CAP_SYS_RESOURCE) ||
45220 - (flags & EXT4_MB_USE_ROOT_BLOCKS)) {
45221 + (flags & EXT4_MB_USE_ROOT_BLOCKS) ||
45222 + capable_nolog(CAP_SYS_RESOURCE)) {
45223
45224 if (free_clusters >= (nclusters + dirty_clusters))
45225 return 1;
45226 diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
45227 index 01434f2..bd995b4 100644
45228 --- a/fs/ext4/ext4.h
45229 +++ b/fs/ext4/ext4.h
45230 @@ -1246,19 +1246,19 @@ struct ext4_sb_info {
45231 unsigned long s_mb_last_start;
45232
45233 /* stats for buddy allocator */
45234 - atomic_t s_bal_reqs; /* number of reqs with len > 1 */
45235 - atomic_t s_bal_success; /* we found long enough chunks */
45236 - atomic_t s_bal_allocated; /* in blocks */
45237 - atomic_t s_bal_ex_scanned; /* total extents scanned */
45238 - atomic_t s_bal_goals; /* goal hits */
45239 - atomic_t s_bal_breaks; /* too long searches */
45240 - atomic_t s_bal_2orders; /* 2^order hits */
45241 + atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
45242 + atomic_unchecked_t s_bal_success; /* we found long enough chunks */
45243 + atomic_unchecked_t s_bal_allocated; /* in blocks */
45244 + atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
45245 + atomic_unchecked_t s_bal_goals; /* goal hits */
45246 + atomic_unchecked_t s_bal_breaks; /* too long searches */
45247 + atomic_unchecked_t s_bal_2orders; /* 2^order hits */
45248 spinlock_t s_bal_lock;
45249 unsigned long s_mb_buddies_generated;
45250 unsigned long long s_mb_generation_time;
45251 - atomic_t s_mb_lost_chunks;
45252 - atomic_t s_mb_preallocated;
45253 - atomic_t s_mb_discarded;
45254 + atomic_unchecked_t s_mb_lost_chunks;
45255 + atomic_unchecked_t s_mb_preallocated;
45256 + atomic_unchecked_t s_mb_discarded;
45257 atomic_t s_lock_busy;
45258
45259 /* locality groups */
45260 diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
45261 index 1cd6994..5799d45 100644
45262 --- a/fs/ext4/mballoc.c
45263 +++ b/fs/ext4/mballoc.c
45264 @@ -1747,7 +1747,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
45265 BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
45266
45267 if (EXT4_SB(sb)->s_mb_stats)
45268 - atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
45269 + atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
45270
45271 break;
45272 }
45273 @@ -2041,7 +2041,7 @@ repeat:
45274 ac->ac_status = AC_STATUS_CONTINUE;
45275 ac->ac_flags |= EXT4_MB_HINT_FIRST;
45276 cr = 3;
45277 - atomic_inc(&sbi->s_mb_lost_chunks);
45278 + atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
45279 goto repeat;
45280 }
45281 }
45282 @@ -2545,25 +2545,25 @@ int ext4_mb_release(struct super_block *sb)
45283 if (sbi->s_mb_stats) {
45284 ext4_msg(sb, KERN_INFO,
45285 "mballoc: %u blocks %u reqs (%u success)",
45286 - atomic_read(&sbi->s_bal_allocated),
45287 - atomic_read(&sbi->s_bal_reqs),
45288 - atomic_read(&sbi->s_bal_success));
45289 + atomic_read_unchecked(&sbi->s_bal_allocated),
45290 + atomic_read_unchecked(&sbi->s_bal_reqs),
45291 + atomic_read_unchecked(&sbi->s_bal_success));
45292 ext4_msg(sb, KERN_INFO,
45293 "mballoc: %u extents scanned, %u goal hits, "
45294 "%u 2^N hits, %u breaks, %u lost",
45295 - atomic_read(&sbi->s_bal_ex_scanned),
45296 - atomic_read(&sbi->s_bal_goals),
45297 - atomic_read(&sbi->s_bal_2orders),
45298 - atomic_read(&sbi->s_bal_breaks),
45299 - atomic_read(&sbi->s_mb_lost_chunks));
45300 + atomic_read_unchecked(&sbi->s_bal_ex_scanned),
45301 + atomic_read_unchecked(&sbi->s_bal_goals),
45302 + atomic_read_unchecked(&sbi->s_bal_2orders),
45303 + atomic_read_unchecked(&sbi->s_bal_breaks),
45304 + atomic_read_unchecked(&sbi->s_mb_lost_chunks));
45305 ext4_msg(sb, KERN_INFO,
45306 "mballoc: %lu generated and it took %Lu",
45307 sbi->s_mb_buddies_generated,
45308 sbi->s_mb_generation_time);
45309 ext4_msg(sb, KERN_INFO,
45310 "mballoc: %u preallocated, %u discarded",
45311 - atomic_read(&sbi->s_mb_preallocated),
45312 - atomic_read(&sbi->s_mb_discarded));
45313 + atomic_read_unchecked(&sbi->s_mb_preallocated),
45314 + atomic_read_unchecked(&sbi->s_mb_discarded));
45315 }
45316
45317 free_percpu(sbi->s_locality_groups);
45318 @@ -3047,16 +3047,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
45319 struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
45320
45321 if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
45322 - atomic_inc(&sbi->s_bal_reqs);
45323 - atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
45324 + atomic_inc_unchecked(&sbi->s_bal_reqs);
45325 + atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
45326 if (ac->ac_b_ex.fe_len >= ac->ac_o_ex.fe_len)
45327 - atomic_inc(&sbi->s_bal_success);
45328 - atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
45329 + atomic_inc_unchecked(&sbi->s_bal_success);
45330 + atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
45331 if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
45332 ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
45333 - atomic_inc(&sbi->s_bal_goals);
45334 + atomic_inc_unchecked(&sbi->s_bal_goals);
45335 if (ac->ac_found > sbi->s_mb_max_to_scan)
45336 - atomic_inc(&sbi->s_bal_breaks);
45337 + atomic_inc_unchecked(&sbi->s_bal_breaks);
45338 }
45339
45340 if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
45341 @@ -3456,7 +3456,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
45342 trace_ext4_mb_new_inode_pa(ac, pa);
45343
45344 ext4_mb_use_inode_pa(ac, pa);
45345 - atomic_add(pa->pa_free, &sbi->s_mb_preallocated);
45346 + atomic_add_unchecked(pa->pa_free, &sbi->s_mb_preallocated);
45347
45348 ei = EXT4_I(ac->ac_inode);
45349 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
45350 @@ -3516,7 +3516,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
45351 trace_ext4_mb_new_group_pa(ac, pa);
45352
45353 ext4_mb_use_group_pa(ac, pa);
45354 - atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
45355 + atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
45356
45357 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
45358 lg = ac->ac_lg;
45359 @@ -3605,7 +3605,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
45360 * from the bitmap and continue.
45361 */
45362 }
45363 - atomic_add(free, &sbi->s_mb_discarded);
45364 + atomic_add_unchecked(free, &sbi->s_mb_discarded);
45365
45366 return err;
45367 }
45368 @@ -3623,7 +3623,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
45369 ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
45370 BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
45371 mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
45372 - atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
45373 + atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
45374 trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
45375
45376 return 0;
45377 diff --git a/fs/fcntl.c b/fs/fcntl.c
45378 index 81b70e6..d9ae6cf 100644
45379 --- a/fs/fcntl.c
45380 +++ b/fs/fcntl.c
45381 @@ -224,6 +224,11 @@ int __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
45382 if (err)
45383 return err;
45384
45385 + if (gr_handle_chroot_fowner(pid, type))
45386 + return -ENOENT;
45387 + if (gr_check_protected_task_fowner(pid, type))
45388 + return -EACCES;
45389 +
45390 f_modown(filp, pid, type, force);
45391 return 0;
45392 }
45393 @@ -266,7 +271,7 @@ pid_t f_getown(struct file *filp)
45394
45395 static int f_setown_ex(struct file *filp, unsigned long arg)
45396 {
45397 - struct f_owner_ex * __user owner_p = (void * __user)arg;
45398 + struct f_owner_ex __user *owner_p = (void __user *)arg;
45399 struct f_owner_ex owner;
45400 struct pid *pid;
45401 int type;
45402 @@ -306,7 +311,7 @@ static int f_setown_ex(struct file *filp, unsigned long arg)
45403
45404 static int f_getown_ex(struct file *filp, unsigned long arg)
45405 {
45406 - struct f_owner_ex * __user owner_p = (void * __user)arg;
45407 + struct f_owner_ex __user *owner_p = (void __user *)arg;
45408 struct f_owner_ex owner;
45409 int ret = 0;
45410
45411 @@ -348,6 +353,7 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
45412 switch (cmd) {
45413 case F_DUPFD:
45414 case F_DUPFD_CLOEXEC:
45415 + gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
45416 if (arg >= rlimit(RLIMIT_NOFILE))
45417 break;
45418 err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
45419 diff --git a/fs/fifo.c b/fs/fifo.c
45420 index cf6f434..3d7942c 100644
45421 --- a/fs/fifo.c
45422 +++ b/fs/fifo.c
45423 @@ -59,10 +59,10 @@ static int fifo_open(struct inode *inode, struct file *filp)
45424 */
45425 filp->f_op = &read_pipefifo_fops;
45426 pipe->r_counter++;
45427 - if (pipe->readers++ == 0)
45428 + if (atomic_inc_return(&pipe->readers) == 1)
45429 wake_up_partner(inode);
45430
45431 - if (!pipe->writers) {
45432 + if (!atomic_read(&pipe->writers)) {
45433 if ((filp->f_flags & O_NONBLOCK)) {
45434 /* suppress POLLHUP until we have
45435 * seen a writer */
45436 @@ -81,15 +81,15 @@ static int fifo_open(struct inode *inode, struct file *filp)
45437 * errno=ENXIO when there is no process reading the FIFO.
45438 */
45439 ret = -ENXIO;
45440 - if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
45441 + if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
45442 goto err;
45443
45444 filp->f_op = &write_pipefifo_fops;
45445 pipe->w_counter++;
45446 - if (!pipe->writers++)
45447 + if (atomic_inc_return(&pipe->writers) == 1)
45448 wake_up_partner(inode);
45449
45450 - if (!pipe->readers) {
45451 + if (!atomic_read(&pipe->readers)) {
45452 if (wait_for_partner(inode, &pipe->r_counter))
45453 goto err_wr;
45454 }
45455 @@ -104,11 +104,11 @@ static int fifo_open(struct inode *inode, struct file *filp)
45456 */
45457 filp->f_op = &rdwr_pipefifo_fops;
45458
45459 - pipe->readers++;
45460 - pipe->writers++;
45461 + atomic_inc(&pipe->readers);
45462 + atomic_inc(&pipe->writers);
45463 pipe->r_counter++;
45464 pipe->w_counter++;
45465 - if (pipe->readers == 1 || pipe->writers == 1)
45466 + if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
45467 wake_up_partner(inode);
45468 break;
45469
45470 @@ -122,19 +122,19 @@ static int fifo_open(struct inode *inode, struct file *filp)
45471 return 0;
45472
45473 err_rd:
45474 - if (!--pipe->readers)
45475 + if (atomic_dec_and_test(&pipe->readers))
45476 wake_up_interruptible(&pipe->wait);
45477 ret = -ERESTARTSYS;
45478 goto err;
45479
45480 err_wr:
45481 - if (!--pipe->writers)
45482 + if (atomic_dec_and_test(&pipe->writers))
45483 wake_up_interruptible(&pipe->wait);
45484 ret = -ERESTARTSYS;
45485 goto err;
45486
45487 err:
45488 - if (!pipe->readers && !pipe->writers)
45489 + if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
45490 free_pipe_info(inode);
45491
45492 err_nocleanup:
45493 diff --git a/fs/file.c b/fs/file.c
45494 index ba3f605..fade102 100644
45495 --- a/fs/file.c
45496 +++ b/fs/file.c
45497 @@ -15,6 +15,7 @@
45498 #include <linux/slab.h>
45499 #include <linux/vmalloc.h>
45500 #include <linux/file.h>
45501 +#include <linux/security.h>
45502 #include <linux/fdtable.h>
45503 #include <linux/bitops.h>
45504 #include <linux/interrupt.h>
45505 @@ -255,6 +256,7 @@ int expand_files(struct files_struct *files, int nr)
45506 * N.B. For clone tasks sharing a files structure, this test
45507 * will limit the total number of files that can be opened.
45508 */
45509 + gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
45510 if (nr >= rlimit(RLIMIT_NOFILE))
45511 return -EMFILE;
45512
45513 diff --git a/fs/filesystems.c b/fs/filesystems.c
45514 index 96f2428..f5eeb8e 100644
45515 --- a/fs/filesystems.c
45516 +++ b/fs/filesystems.c
45517 @@ -273,7 +273,12 @@ struct file_system_type *get_fs_type(const char *name)
45518 int len = dot ? dot - name : strlen(name);
45519
45520 fs = __get_fs_type(name, len);
45521 +
45522 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
45523 + if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
45524 +#else
45525 if (!fs && (request_module("%.*s", len, name) == 0))
45526 +#endif
45527 fs = __get_fs_type(name, len);
45528
45529 if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
45530 diff --git a/fs/fs_struct.c b/fs/fs_struct.c
45531 index e159e68..e7d2a6f 100644
45532 --- a/fs/fs_struct.c
45533 +++ b/fs/fs_struct.c
45534 @@ -4,6 +4,7 @@
45535 #include <linux/path.h>
45536 #include <linux/slab.h>
45537 #include <linux/fs_struct.h>
45538 +#include <linux/grsecurity.h>
45539 #include "internal.h"
45540
45541 static inline void path_get_longterm(struct path *path)
45542 @@ -31,6 +32,7 @@ void set_fs_root(struct fs_struct *fs, struct path *path)
45543 write_seqcount_begin(&fs->seq);
45544 old_root = fs->root;
45545 fs->root = *path;
45546 + gr_set_chroot_entries(current, path);
45547 write_seqcount_end(&fs->seq);
45548 spin_unlock(&fs->lock);
45549 if (old_root.dentry)
45550 @@ -65,6 +67,17 @@ static inline int replace_path(struct path *p, const struct path *old, const str
45551 return 1;
45552 }
45553
45554 +static inline int replace_root_path(struct task_struct *task, struct path *p, const struct path *old, struct path *new)
45555 +{
45556 + if (likely(p->dentry != old->dentry || p->mnt != old->mnt))
45557 + return 0;
45558 + *p = *new;
45559 +
45560 + gr_set_chroot_entries(task, new);
45561 +
45562 + return 1;
45563 +}
45564 +
45565 void chroot_fs_refs(struct path *old_root, struct path *new_root)
45566 {
45567 struct task_struct *g, *p;
45568 @@ -79,7 +92,7 @@ void chroot_fs_refs(struct path *old_root, struct path *new_root)
45569 int hits = 0;
45570 spin_lock(&fs->lock);
45571 write_seqcount_begin(&fs->seq);
45572 - hits += replace_path(&fs->root, old_root, new_root);
45573 + hits += replace_root_path(p, &fs->root, old_root, new_root);
45574 hits += replace_path(&fs->pwd, old_root, new_root);
45575 write_seqcount_end(&fs->seq);
45576 while (hits--) {
45577 @@ -111,7 +124,8 @@ void exit_fs(struct task_struct *tsk)
45578 task_lock(tsk);
45579 spin_lock(&fs->lock);
45580 tsk->fs = NULL;
45581 - kill = !--fs->users;
45582 + gr_clear_chroot_entries(tsk);
45583 + kill = !atomic_dec_return(&fs->users);
45584 spin_unlock(&fs->lock);
45585 task_unlock(tsk);
45586 if (kill)
45587 @@ -124,7 +138,7 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
45588 struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
45589 /* We don't need to lock fs - think why ;-) */
45590 if (fs) {
45591 - fs->users = 1;
45592 + atomic_set(&fs->users, 1);
45593 fs->in_exec = 0;
45594 spin_lock_init(&fs->lock);
45595 seqcount_init(&fs->seq);
45596 @@ -133,6 +147,9 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
45597 spin_lock(&old->lock);
45598 fs->root = old->root;
45599 path_get_longterm(&fs->root);
45600 + /* instead of calling gr_set_chroot_entries here,
45601 + we call it from every caller of this function
45602 + */
45603 fs->pwd = old->pwd;
45604 path_get_longterm(&fs->pwd);
45605 spin_unlock(&old->lock);
45606 @@ -151,8 +168,9 @@ int unshare_fs_struct(void)
45607
45608 task_lock(current);
45609 spin_lock(&fs->lock);
45610 - kill = !--fs->users;
45611 + kill = !atomic_dec_return(&fs->users);
45612 current->fs = new_fs;
45613 + gr_set_chroot_entries(current, &new_fs->root);
45614 spin_unlock(&fs->lock);
45615 task_unlock(current);
45616
45617 @@ -165,13 +183,13 @@ EXPORT_SYMBOL_GPL(unshare_fs_struct);
45618
45619 int current_umask(void)
45620 {
45621 - return current->fs->umask;
45622 + return current->fs->umask | gr_acl_umask();
45623 }
45624 EXPORT_SYMBOL(current_umask);
45625
45626 /* to be mentioned only in INIT_TASK */
45627 struct fs_struct init_fs = {
45628 - .users = 1,
45629 + .users = ATOMIC_INIT(1),
45630 .lock = __SPIN_LOCK_UNLOCKED(init_fs.lock),
45631 .seq = SEQCNT_ZERO,
45632 .umask = 0022,
45633 @@ -187,12 +205,13 @@ void daemonize_fs_struct(void)
45634 task_lock(current);
45635
45636 spin_lock(&init_fs.lock);
45637 - init_fs.users++;
45638 + atomic_inc(&init_fs.users);
45639 spin_unlock(&init_fs.lock);
45640
45641 spin_lock(&fs->lock);
45642 current->fs = &init_fs;
45643 - kill = !--fs->users;
45644 + gr_set_chroot_entries(current, &current->fs->root);
45645 + kill = !atomic_dec_return(&fs->users);
45646 spin_unlock(&fs->lock);
45647
45648 task_unlock(current);
45649 diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
45650 index 9905350..02eaec4 100644
45651 --- a/fs/fscache/cookie.c
45652 +++ b/fs/fscache/cookie.c
45653 @@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire_cookie(
45654 parent ? (char *) parent->def->name : "<no-parent>",
45655 def->name, netfs_data);
45656
45657 - fscache_stat(&fscache_n_acquires);
45658 + fscache_stat_unchecked(&fscache_n_acquires);
45659
45660 /* if there's no parent cookie, then we don't create one here either */
45661 if (!parent) {
45662 - fscache_stat(&fscache_n_acquires_null);
45663 + fscache_stat_unchecked(&fscache_n_acquires_null);
45664 _leave(" [no parent]");
45665 return NULL;
45666 }
45667 @@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire_cookie(
45668 /* allocate and initialise a cookie */
45669 cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
45670 if (!cookie) {
45671 - fscache_stat(&fscache_n_acquires_oom);
45672 + fscache_stat_unchecked(&fscache_n_acquires_oom);
45673 _leave(" [ENOMEM]");
45674 return NULL;
45675 }
45676 @@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire_cookie(
45677
45678 switch (cookie->def->type) {
45679 case FSCACHE_COOKIE_TYPE_INDEX:
45680 - fscache_stat(&fscache_n_cookie_index);
45681 + fscache_stat_unchecked(&fscache_n_cookie_index);
45682 break;
45683 case FSCACHE_COOKIE_TYPE_DATAFILE:
45684 - fscache_stat(&fscache_n_cookie_data);
45685 + fscache_stat_unchecked(&fscache_n_cookie_data);
45686 break;
45687 default:
45688 - fscache_stat(&fscache_n_cookie_special);
45689 + fscache_stat_unchecked(&fscache_n_cookie_special);
45690 break;
45691 }
45692
45693 @@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire_cookie(
45694 if (fscache_acquire_non_index_cookie(cookie) < 0) {
45695 atomic_dec(&parent->n_children);
45696 __fscache_cookie_put(cookie);
45697 - fscache_stat(&fscache_n_acquires_nobufs);
45698 + fscache_stat_unchecked(&fscache_n_acquires_nobufs);
45699 _leave(" = NULL");
45700 return NULL;
45701 }
45702 }
45703
45704 - fscache_stat(&fscache_n_acquires_ok);
45705 + fscache_stat_unchecked(&fscache_n_acquires_ok);
45706 _leave(" = %p", cookie);
45707 return cookie;
45708 }
45709 @@ -168,7 +168,7 @@ static int fscache_acquire_non_index_cookie(struct fscache_cookie *cookie)
45710 cache = fscache_select_cache_for_object(cookie->parent);
45711 if (!cache) {
45712 up_read(&fscache_addremove_sem);
45713 - fscache_stat(&fscache_n_acquires_no_cache);
45714 + fscache_stat_unchecked(&fscache_n_acquires_no_cache);
45715 _leave(" = -ENOMEDIUM [no cache]");
45716 return -ENOMEDIUM;
45717 }
45718 @@ -256,12 +256,12 @@ static int fscache_alloc_object(struct fscache_cache *cache,
45719 object = cache->ops->alloc_object(cache, cookie);
45720 fscache_stat_d(&fscache_n_cop_alloc_object);
45721 if (IS_ERR(object)) {
45722 - fscache_stat(&fscache_n_object_no_alloc);
45723 + fscache_stat_unchecked(&fscache_n_object_no_alloc);
45724 ret = PTR_ERR(object);
45725 goto error;
45726 }
45727
45728 - fscache_stat(&fscache_n_object_alloc);
45729 + fscache_stat_unchecked(&fscache_n_object_alloc);
45730
45731 object->debug_id = atomic_inc_return(&fscache_object_debug_id);
45732
45733 @@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fscache_cookie *cookie)
45734 struct fscache_object *object;
45735 struct hlist_node *_p;
45736
45737 - fscache_stat(&fscache_n_updates);
45738 + fscache_stat_unchecked(&fscache_n_updates);
45739
45740 if (!cookie) {
45741 - fscache_stat(&fscache_n_updates_null);
45742 + fscache_stat_unchecked(&fscache_n_updates_null);
45743 _leave(" [no cookie]");
45744 return;
45745 }
45746 @@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
45747 struct fscache_object *object;
45748 unsigned long event;
45749
45750 - fscache_stat(&fscache_n_relinquishes);
45751 + fscache_stat_unchecked(&fscache_n_relinquishes);
45752 if (retire)
45753 - fscache_stat(&fscache_n_relinquishes_retire);
45754 + fscache_stat_unchecked(&fscache_n_relinquishes_retire);
45755
45756 if (!cookie) {
45757 - fscache_stat(&fscache_n_relinquishes_null);
45758 + fscache_stat_unchecked(&fscache_n_relinquishes_null);
45759 _leave(" [no cookie]");
45760 return;
45761 }
45762 @@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct fscache_cookie *cookie, int retire)
45763
45764 /* wait for the cookie to finish being instantiated (or to fail) */
45765 if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
45766 - fscache_stat(&fscache_n_relinquishes_waitcrt);
45767 + fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
45768 wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
45769 fscache_wait_bit, TASK_UNINTERRUPTIBLE);
45770 }
45771 diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
45772 index f6aad48..88dcf26 100644
45773 --- a/fs/fscache/internal.h
45774 +++ b/fs/fscache/internal.h
45775 @@ -144,94 +144,94 @@ extern void fscache_proc_cleanup(void);
45776 extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
45777 extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
45778
45779 -extern atomic_t fscache_n_op_pend;
45780 -extern atomic_t fscache_n_op_run;
45781 -extern atomic_t fscache_n_op_enqueue;
45782 -extern atomic_t fscache_n_op_deferred_release;
45783 -extern atomic_t fscache_n_op_release;
45784 -extern atomic_t fscache_n_op_gc;
45785 -extern atomic_t fscache_n_op_cancelled;
45786 -extern atomic_t fscache_n_op_rejected;
45787 +extern atomic_unchecked_t fscache_n_op_pend;
45788 +extern atomic_unchecked_t fscache_n_op_run;
45789 +extern atomic_unchecked_t fscache_n_op_enqueue;
45790 +extern atomic_unchecked_t fscache_n_op_deferred_release;
45791 +extern atomic_unchecked_t fscache_n_op_release;
45792 +extern atomic_unchecked_t fscache_n_op_gc;
45793 +extern atomic_unchecked_t fscache_n_op_cancelled;
45794 +extern atomic_unchecked_t fscache_n_op_rejected;
45795
45796 -extern atomic_t fscache_n_attr_changed;
45797 -extern atomic_t fscache_n_attr_changed_ok;
45798 -extern atomic_t fscache_n_attr_changed_nobufs;
45799 -extern atomic_t fscache_n_attr_changed_nomem;
45800 -extern atomic_t fscache_n_attr_changed_calls;
45801 +extern atomic_unchecked_t fscache_n_attr_changed;
45802 +extern atomic_unchecked_t fscache_n_attr_changed_ok;
45803 +extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
45804 +extern atomic_unchecked_t fscache_n_attr_changed_nomem;
45805 +extern atomic_unchecked_t fscache_n_attr_changed_calls;
45806
45807 -extern atomic_t fscache_n_allocs;
45808 -extern atomic_t fscache_n_allocs_ok;
45809 -extern atomic_t fscache_n_allocs_wait;
45810 -extern atomic_t fscache_n_allocs_nobufs;
45811 -extern atomic_t fscache_n_allocs_intr;
45812 -extern atomic_t fscache_n_allocs_object_dead;
45813 -extern atomic_t fscache_n_alloc_ops;
45814 -extern atomic_t fscache_n_alloc_op_waits;
45815 +extern atomic_unchecked_t fscache_n_allocs;
45816 +extern atomic_unchecked_t fscache_n_allocs_ok;
45817 +extern atomic_unchecked_t fscache_n_allocs_wait;
45818 +extern atomic_unchecked_t fscache_n_allocs_nobufs;
45819 +extern atomic_unchecked_t fscache_n_allocs_intr;
45820 +extern atomic_unchecked_t fscache_n_allocs_object_dead;
45821 +extern atomic_unchecked_t fscache_n_alloc_ops;
45822 +extern atomic_unchecked_t fscache_n_alloc_op_waits;
45823
45824 -extern atomic_t fscache_n_retrievals;
45825 -extern atomic_t fscache_n_retrievals_ok;
45826 -extern atomic_t fscache_n_retrievals_wait;
45827 -extern atomic_t fscache_n_retrievals_nodata;
45828 -extern atomic_t fscache_n_retrievals_nobufs;
45829 -extern atomic_t fscache_n_retrievals_intr;
45830 -extern atomic_t fscache_n_retrievals_nomem;
45831 -extern atomic_t fscache_n_retrievals_object_dead;
45832 -extern atomic_t fscache_n_retrieval_ops;
45833 -extern atomic_t fscache_n_retrieval_op_waits;
45834 +extern atomic_unchecked_t fscache_n_retrievals;
45835 +extern atomic_unchecked_t fscache_n_retrievals_ok;
45836 +extern atomic_unchecked_t fscache_n_retrievals_wait;
45837 +extern atomic_unchecked_t fscache_n_retrievals_nodata;
45838 +extern atomic_unchecked_t fscache_n_retrievals_nobufs;
45839 +extern atomic_unchecked_t fscache_n_retrievals_intr;
45840 +extern atomic_unchecked_t fscache_n_retrievals_nomem;
45841 +extern atomic_unchecked_t fscache_n_retrievals_object_dead;
45842 +extern atomic_unchecked_t fscache_n_retrieval_ops;
45843 +extern atomic_unchecked_t fscache_n_retrieval_op_waits;
45844
45845 -extern atomic_t fscache_n_stores;
45846 -extern atomic_t fscache_n_stores_ok;
45847 -extern atomic_t fscache_n_stores_again;
45848 -extern atomic_t fscache_n_stores_nobufs;
45849 -extern atomic_t fscache_n_stores_oom;
45850 -extern atomic_t fscache_n_store_ops;
45851 -extern atomic_t fscache_n_store_calls;
45852 -extern atomic_t fscache_n_store_pages;
45853 -extern atomic_t fscache_n_store_radix_deletes;
45854 -extern atomic_t fscache_n_store_pages_over_limit;
45855 +extern atomic_unchecked_t fscache_n_stores;
45856 +extern atomic_unchecked_t fscache_n_stores_ok;
45857 +extern atomic_unchecked_t fscache_n_stores_again;
45858 +extern atomic_unchecked_t fscache_n_stores_nobufs;
45859 +extern atomic_unchecked_t fscache_n_stores_oom;
45860 +extern atomic_unchecked_t fscache_n_store_ops;
45861 +extern atomic_unchecked_t fscache_n_store_calls;
45862 +extern atomic_unchecked_t fscache_n_store_pages;
45863 +extern atomic_unchecked_t fscache_n_store_radix_deletes;
45864 +extern atomic_unchecked_t fscache_n_store_pages_over_limit;
45865
45866 -extern atomic_t fscache_n_store_vmscan_not_storing;
45867 -extern atomic_t fscache_n_store_vmscan_gone;
45868 -extern atomic_t fscache_n_store_vmscan_busy;
45869 -extern atomic_t fscache_n_store_vmscan_cancelled;
45870 +extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
45871 +extern atomic_unchecked_t fscache_n_store_vmscan_gone;
45872 +extern atomic_unchecked_t fscache_n_store_vmscan_busy;
45873 +extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
45874
45875 -extern atomic_t fscache_n_marks;
45876 -extern atomic_t fscache_n_uncaches;
45877 +extern atomic_unchecked_t fscache_n_marks;
45878 +extern atomic_unchecked_t fscache_n_uncaches;
45879
45880 -extern atomic_t fscache_n_acquires;
45881 -extern atomic_t fscache_n_acquires_null;
45882 -extern atomic_t fscache_n_acquires_no_cache;
45883 -extern atomic_t fscache_n_acquires_ok;
45884 -extern atomic_t fscache_n_acquires_nobufs;
45885 -extern atomic_t fscache_n_acquires_oom;
45886 +extern atomic_unchecked_t fscache_n_acquires;
45887 +extern atomic_unchecked_t fscache_n_acquires_null;
45888 +extern atomic_unchecked_t fscache_n_acquires_no_cache;
45889 +extern atomic_unchecked_t fscache_n_acquires_ok;
45890 +extern atomic_unchecked_t fscache_n_acquires_nobufs;
45891 +extern atomic_unchecked_t fscache_n_acquires_oom;
45892
45893 -extern atomic_t fscache_n_updates;
45894 -extern atomic_t fscache_n_updates_null;
45895 -extern atomic_t fscache_n_updates_run;
45896 +extern atomic_unchecked_t fscache_n_updates;
45897 +extern atomic_unchecked_t fscache_n_updates_null;
45898 +extern atomic_unchecked_t fscache_n_updates_run;
45899
45900 -extern atomic_t fscache_n_relinquishes;
45901 -extern atomic_t fscache_n_relinquishes_null;
45902 -extern atomic_t fscache_n_relinquishes_waitcrt;
45903 -extern atomic_t fscache_n_relinquishes_retire;
45904 +extern atomic_unchecked_t fscache_n_relinquishes;
45905 +extern atomic_unchecked_t fscache_n_relinquishes_null;
45906 +extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
45907 +extern atomic_unchecked_t fscache_n_relinquishes_retire;
45908
45909 -extern atomic_t fscache_n_cookie_index;
45910 -extern atomic_t fscache_n_cookie_data;
45911 -extern atomic_t fscache_n_cookie_special;
45912 +extern atomic_unchecked_t fscache_n_cookie_index;
45913 +extern atomic_unchecked_t fscache_n_cookie_data;
45914 +extern atomic_unchecked_t fscache_n_cookie_special;
45915
45916 -extern atomic_t fscache_n_object_alloc;
45917 -extern atomic_t fscache_n_object_no_alloc;
45918 -extern atomic_t fscache_n_object_lookups;
45919 -extern atomic_t fscache_n_object_lookups_negative;
45920 -extern atomic_t fscache_n_object_lookups_positive;
45921 -extern atomic_t fscache_n_object_lookups_timed_out;
45922 -extern atomic_t fscache_n_object_created;
45923 -extern atomic_t fscache_n_object_avail;
45924 -extern atomic_t fscache_n_object_dead;
45925 +extern atomic_unchecked_t fscache_n_object_alloc;
45926 +extern atomic_unchecked_t fscache_n_object_no_alloc;
45927 +extern atomic_unchecked_t fscache_n_object_lookups;
45928 +extern atomic_unchecked_t fscache_n_object_lookups_negative;
45929 +extern atomic_unchecked_t fscache_n_object_lookups_positive;
45930 +extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
45931 +extern atomic_unchecked_t fscache_n_object_created;
45932 +extern atomic_unchecked_t fscache_n_object_avail;
45933 +extern atomic_unchecked_t fscache_n_object_dead;
45934
45935 -extern atomic_t fscache_n_checkaux_none;
45936 -extern atomic_t fscache_n_checkaux_okay;
45937 -extern atomic_t fscache_n_checkaux_update;
45938 -extern atomic_t fscache_n_checkaux_obsolete;
45939 +extern atomic_unchecked_t fscache_n_checkaux_none;
45940 +extern atomic_unchecked_t fscache_n_checkaux_okay;
45941 +extern atomic_unchecked_t fscache_n_checkaux_update;
45942 +extern atomic_unchecked_t fscache_n_checkaux_obsolete;
45943
45944 extern atomic_t fscache_n_cop_alloc_object;
45945 extern atomic_t fscache_n_cop_lookup_object;
45946 @@ -255,6 +255,11 @@ static inline void fscache_stat(atomic_t *stat)
45947 atomic_inc(stat);
45948 }
45949
45950 +static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
45951 +{
45952 + atomic_inc_unchecked(stat);
45953 +}
45954 +
45955 static inline void fscache_stat_d(atomic_t *stat)
45956 {
45957 atomic_dec(stat);
45958 @@ -267,6 +272,7 @@ extern const struct file_operations fscache_stats_fops;
45959
45960 #define __fscache_stat(stat) (NULL)
45961 #define fscache_stat(stat) do {} while (0)
45962 +#define fscache_stat_unchecked(stat) do {} while (0)
45963 #define fscache_stat_d(stat) do {} while (0)
45964 #endif
45965
45966 diff --git a/fs/fscache/object.c b/fs/fscache/object.c
45967 index b6b897c..0ffff9c 100644
45968 --- a/fs/fscache/object.c
45969 +++ b/fs/fscache/object.c
45970 @@ -128,7 +128,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
45971 /* update the object metadata on disk */
45972 case FSCACHE_OBJECT_UPDATING:
45973 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
45974 - fscache_stat(&fscache_n_updates_run);
45975 + fscache_stat_unchecked(&fscache_n_updates_run);
45976 fscache_stat(&fscache_n_cop_update_object);
45977 object->cache->ops->update_object(object);
45978 fscache_stat_d(&fscache_n_cop_update_object);
45979 @@ -217,7 +217,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
45980 spin_lock(&object->lock);
45981 object->state = FSCACHE_OBJECT_DEAD;
45982 spin_unlock(&object->lock);
45983 - fscache_stat(&fscache_n_object_dead);
45984 + fscache_stat_unchecked(&fscache_n_object_dead);
45985 goto terminal_transit;
45986
45987 /* handle the parent cache of this object being withdrawn from
45988 @@ -232,7 +232,7 @@ static void fscache_object_state_machine(struct fscache_object *object)
45989 spin_lock(&object->lock);
45990 object->state = FSCACHE_OBJECT_DEAD;
45991 spin_unlock(&object->lock);
45992 - fscache_stat(&fscache_n_object_dead);
45993 + fscache_stat_unchecked(&fscache_n_object_dead);
45994 goto terminal_transit;
45995
45996 /* complain about the object being woken up once it is
45997 @@ -461,7 +461,7 @@ static void fscache_lookup_object(struct fscache_object *object)
45998 parent->cookie->def->name, cookie->def->name,
45999 object->cache->tag->name);
46000
46001 - fscache_stat(&fscache_n_object_lookups);
46002 + fscache_stat_unchecked(&fscache_n_object_lookups);
46003 fscache_stat(&fscache_n_cop_lookup_object);
46004 ret = object->cache->ops->lookup_object(object);
46005 fscache_stat_d(&fscache_n_cop_lookup_object);
46006 @@ -472,7 +472,7 @@ static void fscache_lookup_object(struct fscache_object *object)
46007 if (ret == -ETIMEDOUT) {
46008 /* probably stuck behind another object, so move this one to
46009 * the back of the queue */
46010 - fscache_stat(&fscache_n_object_lookups_timed_out);
46011 + fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
46012 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
46013 }
46014
46015 @@ -495,7 +495,7 @@ void fscache_object_lookup_negative(struct fscache_object *object)
46016
46017 spin_lock(&object->lock);
46018 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
46019 - fscache_stat(&fscache_n_object_lookups_negative);
46020 + fscache_stat_unchecked(&fscache_n_object_lookups_negative);
46021
46022 /* transit here to allow write requests to begin stacking up
46023 * and read requests to begin returning ENODATA */
46024 @@ -541,7 +541,7 @@ void fscache_obtained_object(struct fscache_object *object)
46025 * result, in which case there may be data available */
46026 spin_lock(&object->lock);
46027 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
46028 - fscache_stat(&fscache_n_object_lookups_positive);
46029 + fscache_stat_unchecked(&fscache_n_object_lookups_positive);
46030
46031 clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
46032
46033 @@ -555,7 +555,7 @@ void fscache_obtained_object(struct fscache_object *object)
46034 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
46035 } else {
46036 ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
46037 - fscache_stat(&fscache_n_object_created);
46038 + fscache_stat_unchecked(&fscache_n_object_created);
46039
46040 object->state = FSCACHE_OBJECT_AVAILABLE;
46041 spin_unlock(&object->lock);
46042 @@ -602,7 +602,7 @@ static void fscache_object_available(struct fscache_object *object)
46043 fscache_enqueue_dependents(object);
46044
46045 fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
46046 - fscache_stat(&fscache_n_object_avail);
46047 + fscache_stat_unchecked(&fscache_n_object_avail);
46048
46049 _leave("");
46050 }
46051 @@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(struct fscache_object *object,
46052 enum fscache_checkaux result;
46053
46054 if (!object->cookie->def->check_aux) {
46055 - fscache_stat(&fscache_n_checkaux_none);
46056 + fscache_stat_unchecked(&fscache_n_checkaux_none);
46057 return FSCACHE_CHECKAUX_OKAY;
46058 }
46059
46060 @@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(struct fscache_object *object,
46061 switch (result) {
46062 /* entry okay as is */
46063 case FSCACHE_CHECKAUX_OKAY:
46064 - fscache_stat(&fscache_n_checkaux_okay);
46065 + fscache_stat_unchecked(&fscache_n_checkaux_okay);
46066 break;
46067
46068 /* entry requires update */
46069 case FSCACHE_CHECKAUX_NEEDS_UPDATE:
46070 - fscache_stat(&fscache_n_checkaux_update);
46071 + fscache_stat_unchecked(&fscache_n_checkaux_update);
46072 break;
46073
46074 /* entry requires deletion */
46075 case FSCACHE_CHECKAUX_OBSOLETE:
46076 - fscache_stat(&fscache_n_checkaux_obsolete);
46077 + fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
46078 break;
46079
46080 default:
46081 diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c
46082 index 30afdfa..2256596 100644
46083 --- a/fs/fscache/operation.c
46084 +++ b/fs/fscache/operation.c
46085 @@ -17,7 +17,7 @@
46086 #include <linux/slab.h>
46087 #include "internal.h"
46088
46089 -atomic_t fscache_op_debug_id;
46090 +atomic_unchecked_t fscache_op_debug_id;
46091 EXPORT_SYMBOL(fscache_op_debug_id);
46092
46093 /**
46094 @@ -38,7 +38,7 @@ void fscache_enqueue_operation(struct fscache_operation *op)
46095 ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
46096 ASSERTCMP(atomic_read(&op->usage), >, 0);
46097
46098 - fscache_stat(&fscache_n_op_enqueue);
46099 + fscache_stat_unchecked(&fscache_n_op_enqueue);
46100 switch (op->flags & FSCACHE_OP_TYPE) {
46101 case FSCACHE_OP_ASYNC:
46102 _debug("queue async");
46103 @@ -69,7 +69,7 @@ static void fscache_run_op(struct fscache_object *object,
46104 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
46105 if (op->processor)
46106 fscache_enqueue_operation(op);
46107 - fscache_stat(&fscache_n_op_run);
46108 + fscache_stat_unchecked(&fscache_n_op_run);
46109 }
46110
46111 /*
46112 @@ -98,11 +98,11 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
46113 if (object->n_ops > 1) {
46114 atomic_inc(&op->usage);
46115 list_add_tail(&op->pend_link, &object->pending_ops);
46116 - fscache_stat(&fscache_n_op_pend);
46117 + fscache_stat_unchecked(&fscache_n_op_pend);
46118 } else if (!list_empty(&object->pending_ops)) {
46119 atomic_inc(&op->usage);
46120 list_add_tail(&op->pend_link, &object->pending_ops);
46121 - fscache_stat(&fscache_n_op_pend);
46122 + fscache_stat_unchecked(&fscache_n_op_pend);
46123 fscache_start_operations(object);
46124 } else {
46125 ASSERTCMP(object->n_in_progress, ==, 0);
46126 @@ -118,7 +118,7 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
46127 object->n_exclusive++; /* reads and writes must wait */
46128 atomic_inc(&op->usage);
46129 list_add_tail(&op->pend_link, &object->pending_ops);
46130 - fscache_stat(&fscache_n_op_pend);
46131 + fscache_stat_unchecked(&fscache_n_op_pend);
46132 ret = 0;
46133 } else {
46134 /* not allowed to submit ops in any other state */
46135 @@ -203,11 +203,11 @@ int fscache_submit_op(struct fscache_object *object,
46136 if (object->n_exclusive > 0) {
46137 atomic_inc(&op->usage);
46138 list_add_tail(&op->pend_link, &object->pending_ops);
46139 - fscache_stat(&fscache_n_op_pend);
46140 + fscache_stat_unchecked(&fscache_n_op_pend);
46141 } else if (!list_empty(&object->pending_ops)) {
46142 atomic_inc(&op->usage);
46143 list_add_tail(&op->pend_link, &object->pending_ops);
46144 - fscache_stat(&fscache_n_op_pend);
46145 + fscache_stat_unchecked(&fscache_n_op_pend);
46146 fscache_start_operations(object);
46147 } else {
46148 ASSERTCMP(object->n_exclusive, ==, 0);
46149 @@ -219,12 +219,12 @@ int fscache_submit_op(struct fscache_object *object,
46150 object->n_ops++;
46151 atomic_inc(&op->usage);
46152 list_add_tail(&op->pend_link, &object->pending_ops);
46153 - fscache_stat(&fscache_n_op_pend);
46154 + fscache_stat_unchecked(&fscache_n_op_pend);
46155 ret = 0;
46156 } else if (object->state == FSCACHE_OBJECT_DYING ||
46157 object->state == FSCACHE_OBJECT_LC_DYING ||
46158 object->state == FSCACHE_OBJECT_WITHDRAWING) {
46159 - fscache_stat(&fscache_n_op_rejected);
46160 + fscache_stat_unchecked(&fscache_n_op_rejected);
46161 ret = -ENOBUFS;
46162 } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
46163 fscache_report_unexpected_submission(object, op, ostate);
46164 @@ -294,7 +294,7 @@ int fscache_cancel_op(struct fscache_operation *op)
46165
46166 ret = -EBUSY;
46167 if (!list_empty(&op->pend_link)) {
46168 - fscache_stat(&fscache_n_op_cancelled);
46169 + fscache_stat_unchecked(&fscache_n_op_cancelled);
46170 list_del_init(&op->pend_link);
46171 object->n_ops--;
46172 if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
46173 @@ -331,7 +331,7 @@ void fscache_put_operation(struct fscache_operation *op)
46174 if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
46175 BUG();
46176
46177 - fscache_stat(&fscache_n_op_release);
46178 + fscache_stat_unchecked(&fscache_n_op_release);
46179
46180 if (op->release) {
46181 op->release(op);
46182 @@ -348,7 +348,7 @@ void fscache_put_operation(struct fscache_operation *op)
46183 * lock, and defer it otherwise */
46184 if (!spin_trylock(&object->lock)) {
46185 _debug("defer put");
46186 - fscache_stat(&fscache_n_op_deferred_release);
46187 + fscache_stat_unchecked(&fscache_n_op_deferred_release);
46188
46189 cache = object->cache;
46190 spin_lock(&cache->op_gc_list_lock);
46191 @@ -410,7 +410,7 @@ void fscache_operation_gc(struct work_struct *work)
46192
46193 _debug("GC DEFERRED REL OBJ%x OP%x",
46194 object->debug_id, op->debug_id);
46195 - fscache_stat(&fscache_n_op_gc);
46196 + fscache_stat_unchecked(&fscache_n_op_gc);
46197
46198 ASSERTCMP(atomic_read(&op->usage), ==, 0);
46199
46200 diff --git a/fs/fscache/page.c b/fs/fscache/page.c
46201 index 3f7a59b..cf196cc 100644
46202 --- a/fs/fscache/page.c
46203 +++ b/fs/fscache/page.c
46204 @@ -60,7 +60,7 @@ bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
46205 val = radix_tree_lookup(&cookie->stores, page->index);
46206 if (!val) {
46207 rcu_read_unlock();
46208 - fscache_stat(&fscache_n_store_vmscan_not_storing);
46209 + fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
46210 __fscache_uncache_page(cookie, page);
46211 return true;
46212 }
46213 @@ -90,11 +90,11 @@ bool __fscache_maybe_release_page(struct fscache_cookie *cookie,
46214 spin_unlock(&cookie->stores_lock);
46215
46216 if (xpage) {
46217 - fscache_stat(&fscache_n_store_vmscan_cancelled);
46218 - fscache_stat(&fscache_n_store_radix_deletes);
46219 + fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
46220 + fscache_stat_unchecked(&fscache_n_store_radix_deletes);
46221 ASSERTCMP(xpage, ==, page);
46222 } else {
46223 - fscache_stat(&fscache_n_store_vmscan_gone);
46224 + fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
46225 }
46226
46227 wake_up_bit(&cookie->flags, 0);
46228 @@ -107,7 +107,7 @@ page_busy:
46229 /* we might want to wait here, but that could deadlock the allocator as
46230 * the work threads writing to the cache may all end up sleeping
46231 * on memory allocation */
46232 - fscache_stat(&fscache_n_store_vmscan_busy);
46233 + fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
46234 return false;
46235 }
46236 EXPORT_SYMBOL(__fscache_maybe_release_page);
46237 @@ -131,7 +131,7 @@ static void fscache_end_page_write(struct fscache_object *object,
46238 FSCACHE_COOKIE_STORING_TAG);
46239 if (!radix_tree_tag_get(&cookie->stores, page->index,
46240 FSCACHE_COOKIE_PENDING_TAG)) {
46241 - fscache_stat(&fscache_n_store_radix_deletes);
46242 + fscache_stat_unchecked(&fscache_n_store_radix_deletes);
46243 xpage = radix_tree_delete(&cookie->stores, page->index);
46244 }
46245 spin_unlock(&cookie->stores_lock);
46246 @@ -152,7 +152,7 @@ static void fscache_attr_changed_op(struct fscache_operation *op)
46247
46248 _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
46249
46250 - fscache_stat(&fscache_n_attr_changed_calls);
46251 + fscache_stat_unchecked(&fscache_n_attr_changed_calls);
46252
46253 if (fscache_object_is_active(object)) {
46254 fscache_stat(&fscache_n_cop_attr_changed);
46255 @@ -177,11 +177,11 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
46256
46257 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
46258
46259 - fscache_stat(&fscache_n_attr_changed);
46260 + fscache_stat_unchecked(&fscache_n_attr_changed);
46261
46262 op = kzalloc(sizeof(*op), GFP_KERNEL);
46263 if (!op) {
46264 - fscache_stat(&fscache_n_attr_changed_nomem);
46265 + fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
46266 _leave(" = -ENOMEM");
46267 return -ENOMEM;
46268 }
46269 @@ -199,7 +199,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
46270 if (fscache_submit_exclusive_op(object, op) < 0)
46271 goto nobufs;
46272 spin_unlock(&cookie->lock);
46273 - fscache_stat(&fscache_n_attr_changed_ok);
46274 + fscache_stat_unchecked(&fscache_n_attr_changed_ok);
46275 fscache_put_operation(op);
46276 _leave(" = 0");
46277 return 0;
46278 @@ -207,7 +207,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
46279 nobufs:
46280 spin_unlock(&cookie->lock);
46281 kfree(op);
46282 - fscache_stat(&fscache_n_attr_changed_nobufs);
46283 + fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
46284 _leave(" = %d", -ENOBUFS);
46285 return -ENOBUFS;
46286 }
46287 @@ -243,7 +243,7 @@ static struct fscache_retrieval *fscache_alloc_retrieval(
46288 /* allocate a retrieval operation and attempt to submit it */
46289 op = kzalloc(sizeof(*op), GFP_NOIO);
46290 if (!op) {
46291 - fscache_stat(&fscache_n_retrievals_nomem);
46292 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
46293 return NULL;
46294 }
46295
46296 @@ -271,13 +271,13 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
46297 return 0;
46298 }
46299
46300 - fscache_stat(&fscache_n_retrievals_wait);
46301 + fscache_stat_unchecked(&fscache_n_retrievals_wait);
46302
46303 jif = jiffies;
46304 if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
46305 fscache_wait_bit_interruptible,
46306 TASK_INTERRUPTIBLE) != 0) {
46307 - fscache_stat(&fscache_n_retrievals_intr);
46308 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
46309 _leave(" = -ERESTARTSYS");
46310 return -ERESTARTSYS;
46311 }
46312 @@ -295,8 +295,8 @@ static int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
46313 */
46314 static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
46315 struct fscache_retrieval *op,
46316 - atomic_t *stat_op_waits,
46317 - atomic_t *stat_object_dead)
46318 + atomic_unchecked_t *stat_op_waits,
46319 + atomic_unchecked_t *stat_object_dead)
46320 {
46321 int ret;
46322
46323 @@ -304,7 +304,7 @@ static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
46324 goto check_if_dead;
46325
46326 _debug(">>> WT");
46327 - fscache_stat(stat_op_waits);
46328 + fscache_stat_unchecked(stat_op_waits);
46329 if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
46330 fscache_wait_bit_interruptible,
46331 TASK_INTERRUPTIBLE) < 0) {
46332 @@ -321,7 +321,7 @@ static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
46333
46334 check_if_dead:
46335 if (unlikely(fscache_object_is_dead(object))) {
46336 - fscache_stat(stat_object_dead);
46337 + fscache_stat_unchecked(stat_object_dead);
46338 return -ENOBUFS;
46339 }
46340 return 0;
46341 @@ -348,7 +348,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
46342
46343 _enter("%p,%p,,,", cookie, page);
46344
46345 - fscache_stat(&fscache_n_retrievals);
46346 + fscache_stat_unchecked(&fscache_n_retrievals);
46347
46348 if (hlist_empty(&cookie->backing_objects))
46349 goto nobufs;
46350 @@ -381,7 +381,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
46351 goto nobufs_unlock;
46352 spin_unlock(&cookie->lock);
46353
46354 - fscache_stat(&fscache_n_retrieval_ops);
46355 + fscache_stat_unchecked(&fscache_n_retrieval_ops);
46356
46357 /* pin the netfs read context in case we need to do the actual netfs
46358 * read because we've encountered a cache read failure */
46359 @@ -411,15 +411,15 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
46360
46361 error:
46362 if (ret == -ENOMEM)
46363 - fscache_stat(&fscache_n_retrievals_nomem);
46364 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
46365 else if (ret == -ERESTARTSYS)
46366 - fscache_stat(&fscache_n_retrievals_intr);
46367 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
46368 else if (ret == -ENODATA)
46369 - fscache_stat(&fscache_n_retrievals_nodata);
46370 + fscache_stat_unchecked(&fscache_n_retrievals_nodata);
46371 else if (ret < 0)
46372 - fscache_stat(&fscache_n_retrievals_nobufs);
46373 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46374 else
46375 - fscache_stat(&fscache_n_retrievals_ok);
46376 + fscache_stat_unchecked(&fscache_n_retrievals_ok);
46377
46378 fscache_put_retrieval(op);
46379 _leave(" = %d", ret);
46380 @@ -429,7 +429,7 @@ nobufs_unlock:
46381 spin_unlock(&cookie->lock);
46382 kfree(op);
46383 nobufs:
46384 - fscache_stat(&fscache_n_retrievals_nobufs);
46385 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46386 _leave(" = -ENOBUFS");
46387 return -ENOBUFS;
46388 }
46389 @@ -467,7 +467,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
46390
46391 _enter("%p,,%d,,,", cookie, *nr_pages);
46392
46393 - fscache_stat(&fscache_n_retrievals);
46394 + fscache_stat_unchecked(&fscache_n_retrievals);
46395
46396 if (hlist_empty(&cookie->backing_objects))
46397 goto nobufs;
46398 @@ -497,7 +497,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
46399 goto nobufs_unlock;
46400 spin_unlock(&cookie->lock);
46401
46402 - fscache_stat(&fscache_n_retrieval_ops);
46403 + fscache_stat_unchecked(&fscache_n_retrieval_ops);
46404
46405 /* pin the netfs read context in case we need to do the actual netfs
46406 * read because we've encountered a cache read failure */
46407 @@ -527,15 +527,15 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
46408
46409 error:
46410 if (ret == -ENOMEM)
46411 - fscache_stat(&fscache_n_retrievals_nomem);
46412 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
46413 else if (ret == -ERESTARTSYS)
46414 - fscache_stat(&fscache_n_retrievals_intr);
46415 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
46416 else if (ret == -ENODATA)
46417 - fscache_stat(&fscache_n_retrievals_nodata);
46418 + fscache_stat_unchecked(&fscache_n_retrievals_nodata);
46419 else if (ret < 0)
46420 - fscache_stat(&fscache_n_retrievals_nobufs);
46421 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46422 else
46423 - fscache_stat(&fscache_n_retrievals_ok);
46424 + fscache_stat_unchecked(&fscache_n_retrievals_ok);
46425
46426 fscache_put_retrieval(op);
46427 _leave(" = %d", ret);
46428 @@ -545,7 +545,7 @@ nobufs_unlock:
46429 spin_unlock(&cookie->lock);
46430 kfree(op);
46431 nobufs:
46432 - fscache_stat(&fscache_n_retrievals_nobufs);
46433 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46434 _leave(" = -ENOBUFS");
46435 return -ENOBUFS;
46436 }
46437 @@ -569,7 +569,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
46438
46439 _enter("%p,%p,,,", cookie, page);
46440
46441 - fscache_stat(&fscache_n_allocs);
46442 + fscache_stat_unchecked(&fscache_n_allocs);
46443
46444 if (hlist_empty(&cookie->backing_objects))
46445 goto nobufs;
46446 @@ -595,7 +595,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
46447 goto nobufs_unlock;
46448 spin_unlock(&cookie->lock);
46449
46450 - fscache_stat(&fscache_n_alloc_ops);
46451 + fscache_stat_unchecked(&fscache_n_alloc_ops);
46452
46453 ret = fscache_wait_for_retrieval_activation(
46454 object, op,
46455 @@ -611,11 +611,11 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
46456
46457 error:
46458 if (ret == -ERESTARTSYS)
46459 - fscache_stat(&fscache_n_allocs_intr);
46460 + fscache_stat_unchecked(&fscache_n_allocs_intr);
46461 else if (ret < 0)
46462 - fscache_stat(&fscache_n_allocs_nobufs);
46463 + fscache_stat_unchecked(&fscache_n_allocs_nobufs);
46464 else
46465 - fscache_stat(&fscache_n_allocs_ok);
46466 + fscache_stat_unchecked(&fscache_n_allocs_ok);
46467
46468 fscache_put_retrieval(op);
46469 _leave(" = %d", ret);
46470 @@ -625,7 +625,7 @@ nobufs_unlock:
46471 spin_unlock(&cookie->lock);
46472 kfree(op);
46473 nobufs:
46474 - fscache_stat(&fscache_n_allocs_nobufs);
46475 + fscache_stat_unchecked(&fscache_n_allocs_nobufs);
46476 _leave(" = -ENOBUFS");
46477 return -ENOBUFS;
46478 }
46479 @@ -666,7 +666,7 @@ static void fscache_write_op(struct fscache_operation *_op)
46480
46481 spin_lock(&cookie->stores_lock);
46482
46483 - fscache_stat(&fscache_n_store_calls);
46484 + fscache_stat_unchecked(&fscache_n_store_calls);
46485
46486 /* find a page to store */
46487 page = NULL;
46488 @@ -677,7 +677,7 @@ static void fscache_write_op(struct fscache_operation *_op)
46489 page = results[0];
46490 _debug("gang %d [%lx]", n, page->index);
46491 if (page->index > op->store_limit) {
46492 - fscache_stat(&fscache_n_store_pages_over_limit);
46493 + fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
46494 goto superseded;
46495 }
46496
46497 @@ -689,7 +689,7 @@ static void fscache_write_op(struct fscache_operation *_op)
46498 spin_unlock(&cookie->stores_lock);
46499 spin_unlock(&object->lock);
46500
46501 - fscache_stat(&fscache_n_store_pages);
46502 + fscache_stat_unchecked(&fscache_n_store_pages);
46503 fscache_stat(&fscache_n_cop_write_page);
46504 ret = object->cache->ops->write_page(op, page);
46505 fscache_stat_d(&fscache_n_cop_write_page);
46506 @@ -757,7 +757,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
46507 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
46508 ASSERT(PageFsCache(page));
46509
46510 - fscache_stat(&fscache_n_stores);
46511 + fscache_stat_unchecked(&fscache_n_stores);
46512
46513 op = kzalloc(sizeof(*op), GFP_NOIO);
46514 if (!op)
46515 @@ -808,7 +808,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
46516 spin_unlock(&cookie->stores_lock);
46517 spin_unlock(&object->lock);
46518
46519 - op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
46520 + op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
46521 op->store_limit = object->store_limit;
46522
46523 if (fscache_submit_op(object, &op->op) < 0)
46524 @@ -816,8 +816,8 @@ int __fscache_write_page(struct fscache_cookie *cookie,
46525
46526 spin_unlock(&cookie->lock);
46527 radix_tree_preload_end();
46528 - fscache_stat(&fscache_n_store_ops);
46529 - fscache_stat(&fscache_n_stores_ok);
46530 + fscache_stat_unchecked(&fscache_n_store_ops);
46531 + fscache_stat_unchecked(&fscache_n_stores_ok);
46532
46533 /* the work queue now carries its own ref on the object */
46534 fscache_put_operation(&op->op);
46535 @@ -825,14 +825,14 @@ int __fscache_write_page(struct fscache_cookie *cookie,
46536 return 0;
46537
46538 already_queued:
46539 - fscache_stat(&fscache_n_stores_again);
46540 + fscache_stat_unchecked(&fscache_n_stores_again);
46541 already_pending:
46542 spin_unlock(&cookie->stores_lock);
46543 spin_unlock(&object->lock);
46544 spin_unlock(&cookie->lock);
46545 radix_tree_preload_end();
46546 kfree(op);
46547 - fscache_stat(&fscache_n_stores_ok);
46548 + fscache_stat_unchecked(&fscache_n_stores_ok);
46549 _leave(" = 0");
46550 return 0;
46551
46552 @@ -851,14 +851,14 @@ nobufs:
46553 spin_unlock(&cookie->lock);
46554 radix_tree_preload_end();
46555 kfree(op);
46556 - fscache_stat(&fscache_n_stores_nobufs);
46557 + fscache_stat_unchecked(&fscache_n_stores_nobufs);
46558 _leave(" = -ENOBUFS");
46559 return -ENOBUFS;
46560
46561 nomem_free:
46562 kfree(op);
46563 nomem:
46564 - fscache_stat(&fscache_n_stores_oom);
46565 + fscache_stat_unchecked(&fscache_n_stores_oom);
46566 _leave(" = -ENOMEM");
46567 return -ENOMEM;
46568 }
46569 @@ -876,7 +876,7 @@ void __fscache_uncache_page(struct fscache_cookie *cookie, struct page *page)
46570 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
46571 ASSERTCMP(page, !=, NULL);
46572
46573 - fscache_stat(&fscache_n_uncaches);
46574 + fscache_stat_unchecked(&fscache_n_uncaches);
46575
46576 /* cache withdrawal may beat us to it */
46577 if (!PageFsCache(page))
46578 @@ -929,7 +929,7 @@ void fscache_mark_pages_cached(struct fscache_retrieval *op,
46579 unsigned long loop;
46580
46581 #ifdef CONFIG_FSCACHE_STATS
46582 - atomic_add(pagevec->nr, &fscache_n_marks);
46583 + atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
46584 #endif
46585
46586 for (loop = 0; loop < pagevec->nr; loop++) {
46587 diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
46588 index 4765190..2a067f2 100644
46589 --- a/fs/fscache/stats.c
46590 +++ b/fs/fscache/stats.c
46591 @@ -18,95 +18,95 @@
46592 /*
46593 * operation counters
46594 */
46595 -atomic_t fscache_n_op_pend;
46596 -atomic_t fscache_n_op_run;
46597 -atomic_t fscache_n_op_enqueue;
46598 -atomic_t fscache_n_op_requeue;
46599 -atomic_t fscache_n_op_deferred_release;
46600 -atomic_t fscache_n_op_release;
46601 -atomic_t fscache_n_op_gc;
46602 -atomic_t fscache_n_op_cancelled;
46603 -atomic_t fscache_n_op_rejected;
46604 +atomic_unchecked_t fscache_n_op_pend;
46605 +atomic_unchecked_t fscache_n_op_run;
46606 +atomic_unchecked_t fscache_n_op_enqueue;
46607 +atomic_unchecked_t fscache_n_op_requeue;
46608 +atomic_unchecked_t fscache_n_op_deferred_release;
46609 +atomic_unchecked_t fscache_n_op_release;
46610 +atomic_unchecked_t fscache_n_op_gc;
46611 +atomic_unchecked_t fscache_n_op_cancelled;
46612 +atomic_unchecked_t fscache_n_op_rejected;
46613
46614 -atomic_t fscache_n_attr_changed;
46615 -atomic_t fscache_n_attr_changed_ok;
46616 -atomic_t fscache_n_attr_changed_nobufs;
46617 -atomic_t fscache_n_attr_changed_nomem;
46618 -atomic_t fscache_n_attr_changed_calls;
46619 +atomic_unchecked_t fscache_n_attr_changed;
46620 +atomic_unchecked_t fscache_n_attr_changed_ok;
46621 +atomic_unchecked_t fscache_n_attr_changed_nobufs;
46622 +atomic_unchecked_t fscache_n_attr_changed_nomem;
46623 +atomic_unchecked_t fscache_n_attr_changed_calls;
46624
46625 -atomic_t fscache_n_allocs;
46626 -atomic_t fscache_n_allocs_ok;
46627 -atomic_t fscache_n_allocs_wait;
46628 -atomic_t fscache_n_allocs_nobufs;
46629 -atomic_t fscache_n_allocs_intr;
46630 -atomic_t fscache_n_allocs_object_dead;
46631 -atomic_t fscache_n_alloc_ops;
46632 -atomic_t fscache_n_alloc_op_waits;
46633 +atomic_unchecked_t fscache_n_allocs;
46634 +atomic_unchecked_t fscache_n_allocs_ok;
46635 +atomic_unchecked_t fscache_n_allocs_wait;
46636 +atomic_unchecked_t fscache_n_allocs_nobufs;
46637 +atomic_unchecked_t fscache_n_allocs_intr;
46638 +atomic_unchecked_t fscache_n_allocs_object_dead;
46639 +atomic_unchecked_t fscache_n_alloc_ops;
46640 +atomic_unchecked_t fscache_n_alloc_op_waits;
46641
46642 -atomic_t fscache_n_retrievals;
46643 -atomic_t fscache_n_retrievals_ok;
46644 -atomic_t fscache_n_retrievals_wait;
46645 -atomic_t fscache_n_retrievals_nodata;
46646 -atomic_t fscache_n_retrievals_nobufs;
46647 -atomic_t fscache_n_retrievals_intr;
46648 -atomic_t fscache_n_retrievals_nomem;
46649 -atomic_t fscache_n_retrievals_object_dead;
46650 -atomic_t fscache_n_retrieval_ops;
46651 -atomic_t fscache_n_retrieval_op_waits;
46652 +atomic_unchecked_t fscache_n_retrievals;
46653 +atomic_unchecked_t fscache_n_retrievals_ok;
46654 +atomic_unchecked_t fscache_n_retrievals_wait;
46655 +atomic_unchecked_t fscache_n_retrievals_nodata;
46656 +atomic_unchecked_t fscache_n_retrievals_nobufs;
46657 +atomic_unchecked_t fscache_n_retrievals_intr;
46658 +atomic_unchecked_t fscache_n_retrievals_nomem;
46659 +atomic_unchecked_t fscache_n_retrievals_object_dead;
46660 +atomic_unchecked_t fscache_n_retrieval_ops;
46661 +atomic_unchecked_t fscache_n_retrieval_op_waits;
46662
46663 -atomic_t fscache_n_stores;
46664 -atomic_t fscache_n_stores_ok;
46665 -atomic_t fscache_n_stores_again;
46666 -atomic_t fscache_n_stores_nobufs;
46667 -atomic_t fscache_n_stores_oom;
46668 -atomic_t fscache_n_store_ops;
46669 -atomic_t fscache_n_store_calls;
46670 -atomic_t fscache_n_store_pages;
46671 -atomic_t fscache_n_store_radix_deletes;
46672 -atomic_t fscache_n_store_pages_over_limit;
46673 +atomic_unchecked_t fscache_n_stores;
46674 +atomic_unchecked_t fscache_n_stores_ok;
46675 +atomic_unchecked_t fscache_n_stores_again;
46676 +atomic_unchecked_t fscache_n_stores_nobufs;
46677 +atomic_unchecked_t fscache_n_stores_oom;
46678 +atomic_unchecked_t fscache_n_store_ops;
46679 +atomic_unchecked_t fscache_n_store_calls;
46680 +atomic_unchecked_t fscache_n_store_pages;
46681 +atomic_unchecked_t fscache_n_store_radix_deletes;
46682 +atomic_unchecked_t fscache_n_store_pages_over_limit;
46683
46684 -atomic_t fscache_n_store_vmscan_not_storing;
46685 -atomic_t fscache_n_store_vmscan_gone;
46686 -atomic_t fscache_n_store_vmscan_busy;
46687 -atomic_t fscache_n_store_vmscan_cancelled;
46688 +atomic_unchecked_t fscache_n_store_vmscan_not_storing;
46689 +atomic_unchecked_t fscache_n_store_vmscan_gone;
46690 +atomic_unchecked_t fscache_n_store_vmscan_busy;
46691 +atomic_unchecked_t fscache_n_store_vmscan_cancelled;
46692
46693 -atomic_t fscache_n_marks;
46694 -atomic_t fscache_n_uncaches;
46695 +atomic_unchecked_t fscache_n_marks;
46696 +atomic_unchecked_t fscache_n_uncaches;
46697
46698 -atomic_t fscache_n_acquires;
46699 -atomic_t fscache_n_acquires_null;
46700 -atomic_t fscache_n_acquires_no_cache;
46701 -atomic_t fscache_n_acquires_ok;
46702 -atomic_t fscache_n_acquires_nobufs;
46703 -atomic_t fscache_n_acquires_oom;
46704 +atomic_unchecked_t fscache_n_acquires;
46705 +atomic_unchecked_t fscache_n_acquires_null;
46706 +atomic_unchecked_t fscache_n_acquires_no_cache;
46707 +atomic_unchecked_t fscache_n_acquires_ok;
46708 +atomic_unchecked_t fscache_n_acquires_nobufs;
46709 +atomic_unchecked_t fscache_n_acquires_oom;
46710
46711 -atomic_t fscache_n_updates;
46712 -atomic_t fscache_n_updates_null;
46713 -atomic_t fscache_n_updates_run;
46714 +atomic_unchecked_t fscache_n_updates;
46715 +atomic_unchecked_t fscache_n_updates_null;
46716 +atomic_unchecked_t fscache_n_updates_run;
46717
46718 -atomic_t fscache_n_relinquishes;
46719 -atomic_t fscache_n_relinquishes_null;
46720 -atomic_t fscache_n_relinquishes_waitcrt;
46721 -atomic_t fscache_n_relinquishes_retire;
46722 +atomic_unchecked_t fscache_n_relinquishes;
46723 +atomic_unchecked_t fscache_n_relinquishes_null;
46724 +atomic_unchecked_t fscache_n_relinquishes_waitcrt;
46725 +atomic_unchecked_t fscache_n_relinquishes_retire;
46726
46727 -atomic_t fscache_n_cookie_index;
46728 -atomic_t fscache_n_cookie_data;
46729 -atomic_t fscache_n_cookie_special;
46730 +atomic_unchecked_t fscache_n_cookie_index;
46731 +atomic_unchecked_t fscache_n_cookie_data;
46732 +atomic_unchecked_t fscache_n_cookie_special;
46733
46734 -atomic_t fscache_n_object_alloc;
46735 -atomic_t fscache_n_object_no_alloc;
46736 -atomic_t fscache_n_object_lookups;
46737 -atomic_t fscache_n_object_lookups_negative;
46738 -atomic_t fscache_n_object_lookups_positive;
46739 -atomic_t fscache_n_object_lookups_timed_out;
46740 -atomic_t fscache_n_object_created;
46741 -atomic_t fscache_n_object_avail;
46742 -atomic_t fscache_n_object_dead;
46743 +atomic_unchecked_t fscache_n_object_alloc;
46744 +atomic_unchecked_t fscache_n_object_no_alloc;
46745 +atomic_unchecked_t fscache_n_object_lookups;
46746 +atomic_unchecked_t fscache_n_object_lookups_negative;
46747 +atomic_unchecked_t fscache_n_object_lookups_positive;
46748 +atomic_unchecked_t fscache_n_object_lookups_timed_out;
46749 +atomic_unchecked_t fscache_n_object_created;
46750 +atomic_unchecked_t fscache_n_object_avail;
46751 +atomic_unchecked_t fscache_n_object_dead;
46752
46753 -atomic_t fscache_n_checkaux_none;
46754 -atomic_t fscache_n_checkaux_okay;
46755 -atomic_t fscache_n_checkaux_update;
46756 -atomic_t fscache_n_checkaux_obsolete;
46757 +atomic_unchecked_t fscache_n_checkaux_none;
46758 +atomic_unchecked_t fscache_n_checkaux_okay;
46759 +atomic_unchecked_t fscache_n_checkaux_update;
46760 +atomic_unchecked_t fscache_n_checkaux_obsolete;
46761
46762 atomic_t fscache_n_cop_alloc_object;
46763 atomic_t fscache_n_cop_lookup_object;
46764 @@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq_file *m, void *v)
46765 seq_puts(m, "FS-Cache statistics\n");
46766
46767 seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
46768 - atomic_read(&fscache_n_cookie_index),
46769 - atomic_read(&fscache_n_cookie_data),
46770 - atomic_read(&fscache_n_cookie_special));
46771 + atomic_read_unchecked(&fscache_n_cookie_index),
46772 + atomic_read_unchecked(&fscache_n_cookie_data),
46773 + atomic_read_unchecked(&fscache_n_cookie_special));
46774
46775 seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
46776 - atomic_read(&fscache_n_object_alloc),
46777 - atomic_read(&fscache_n_object_no_alloc),
46778 - atomic_read(&fscache_n_object_avail),
46779 - atomic_read(&fscache_n_object_dead));
46780 + atomic_read_unchecked(&fscache_n_object_alloc),
46781 + atomic_read_unchecked(&fscache_n_object_no_alloc),
46782 + atomic_read_unchecked(&fscache_n_object_avail),
46783 + atomic_read_unchecked(&fscache_n_object_dead));
46784 seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
46785 - atomic_read(&fscache_n_checkaux_none),
46786 - atomic_read(&fscache_n_checkaux_okay),
46787 - atomic_read(&fscache_n_checkaux_update),
46788 - atomic_read(&fscache_n_checkaux_obsolete));
46789 + atomic_read_unchecked(&fscache_n_checkaux_none),
46790 + atomic_read_unchecked(&fscache_n_checkaux_okay),
46791 + atomic_read_unchecked(&fscache_n_checkaux_update),
46792 + atomic_read_unchecked(&fscache_n_checkaux_obsolete));
46793
46794 seq_printf(m, "Pages : mrk=%u unc=%u\n",
46795 - atomic_read(&fscache_n_marks),
46796 - atomic_read(&fscache_n_uncaches));
46797 + atomic_read_unchecked(&fscache_n_marks),
46798 + atomic_read_unchecked(&fscache_n_uncaches));
46799
46800 seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
46801 " oom=%u\n",
46802 - atomic_read(&fscache_n_acquires),
46803 - atomic_read(&fscache_n_acquires_null),
46804 - atomic_read(&fscache_n_acquires_no_cache),
46805 - atomic_read(&fscache_n_acquires_ok),
46806 - atomic_read(&fscache_n_acquires_nobufs),
46807 - atomic_read(&fscache_n_acquires_oom));
46808 + atomic_read_unchecked(&fscache_n_acquires),
46809 + atomic_read_unchecked(&fscache_n_acquires_null),
46810 + atomic_read_unchecked(&fscache_n_acquires_no_cache),
46811 + atomic_read_unchecked(&fscache_n_acquires_ok),
46812 + atomic_read_unchecked(&fscache_n_acquires_nobufs),
46813 + atomic_read_unchecked(&fscache_n_acquires_oom));
46814
46815 seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
46816 - atomic_read(&fscache_n_object_lookups),
46817 - atomic_read(&fscache_n_object_lookups_negative),
46818 - atomic_read(&fscache_n_object_lookups_positive),
46819 - atomic_read(&fscache_n_object_created),
46820 - atomic_read(&fscache_n_object_lookups_timed_out));
46821 + atomic_read_unchecked(&fscache_n_object_lookups),
46822 + atomic_read_unchecked(&fscache_n_object_lookups_negative),
46823 + atomic_read_unchecked(&fscache_n_object_lookups_positive),
46824 + atomic_read_unchecked(&fscache_n_object_created),
46825 + atomic_read_unchecked(&fscache_n_object_lookups_timed_out));
46826
46827 seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
46828 - atomic_read(&fscache_n_updates),
46829 - atomic_read(&fscache_n_updates_null),
46830 - atomic_read(&fscache_n_updates_run));
46831 + atomic_read_unchecked(&fscache_n_updates),
46832 + atomic_read_unchecked(&fscache_n_updates_null),
46833 + atomic_read_unchecked(&fscache_n_updates_run));
46834
46835 seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
46836 - atomic_read(&fscache_n_relinquishes),
46837 - atomic_read(&fscache_n_relinquishes_null),
46838 - atomic_read(&fscache_n_relinquishes_waitcrt),
46839 - atomic_read(&fscache_n_relinquishes_retire));
46840 + atomic_read_unchecked(&fscache_n_relinquishes),
46841 + atomic_read_unchecked(&fscache_n_relinquishes_null),
46842 + atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
46843 + atomic_read_unchecked(&fscache_n_relinquishes_retire));
46844
46845 seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
46846 - atomic_read(&fscache_n_attr_changed),
46847 - atomic_read(&fscache_n_attr_changed_ok),
46848 - atomic_read(&fscache_n_attr_changed_nobufs),
46849 - atomic_read(&fscache_n_attr_changed_nomem),
46850 - atomic_read(&fscache_n_attr_changed_calls));
46851 + atomic_read_unchecked(&fscache_n_attr_changed),
46852 + atomic_read_unchecked(&fscache_n_attr_changed_ok),
46853 + atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
46854 + atomic_read_unchecked(&fscache_n_attr_changed_nomem),
46855 + atomic_read_unchecked(&fscache_n_attr_changed_calls));
46856
46857 seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
46858 - atomic_read(&fscache_n_allocs),
46859 - atomic_read(&fscache_n_allocs_ok),
46860 - atomic_read(&fscache_n_allocs_wait),
46861 - atomic_read(&fscache_n_allocs_nobufs),
46862 - atomic_read(&fscache_n_allocs_intr));
46863 + atomic_read_unchecked(&fscache_n_allocs),
46864 + atomic_read_unchecked(&fscache_n_allocs_ok),
46865 + atomic_read_unchecked(&fscache_n_allocs_wait),
46866 + atomic_read_unchecked(&fscache_n_allocs_nobufs),
46867 + atomic_read_unchecked(&fscache_n_allocs_intr));
46868 seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
46869 - atomic_read(&fscache_n_alloc_ops),
46870 - atomic_read(&fscache_n_alloc_op_waits),
46871 - atomic_read(&fscache_n_allocs_object_dead));
46872 + atomic_read_unchecked(&fscache_n_alloc_ops),
46873 + atomic_read_unchecked(&fscache_n_alloc_op_waits),
46874 + atomic_read_unchecked(&fscache_n_allocs_object_dead));
46875
46876 seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
46877 " int=%u oom=%u\n",
46878 - atomic_read(&fscache_n_retrievals),
46879 - atomic_read(&fscache_n_retrievals_ok),
46880 - atomic_read(&fscache_n_retrievals_wait),
46881 - atomic_read(&fscache_n_retrievals_nodata),
46882 - atomic_read(&fscache_n_retrievals_nobufs),
46883 - atomic_read(&fscache_n_retrievals_intr),
46884 - atomic_read(&fscache_n_retrievals_nomem));
46885 + atomic_read_unchecked(&fscache_n_retrievals),
46886 + atomic_read_unchecked(&fscache_n_retrievals_ok),
46887 + atomic_read_unchecked(&fscache_n_retrievals_wait),
46888 + atomic_read_unchecked(&fscache_n_retrievals_nodata),
46889 + atomic_read_unchecked(&fscache_n_retrievals_nobufs),
46890 + atomic_read_unchecked(&fscache_n_retrievals_intr),
46891 + atomic_read_unchecked(&fscache_n_retrievals_nomem));
46892 seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
46893 - atomic_read(&fscache_n_retrieval_ops),
46894 - atomic_read(&fscache_n_retrieval_op_waits),
46895 - atomic_read(&fscache_n_retrievals_object_dead));
46896 + atomic_read_unchecked(&fscache_n_retrieval_ops),
46897 + atomic_read_unchecked(&fscache_n_retrieval_op_waits),
46898 + atomic_read_unchecked(&fscache_n_retrievals_object_dead));
46899
46900 seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
46901 - atomic_read(&fscache_n_stores),
46902 - atomic_read(&fscache_n_stores_ok),
46903 - atomic_read(&fscache_n_stores_again),
46904 - atomic_read(&fscache_n_stores_nobufs),
46905 - atomic_read(&fscache_n_stores_oom));
46906 + atomic_read_unchecked(&fscache_n_stores),
46907 + atomic_read_unchecked(&fscache_n_stores_ok),
46908 + atomic_read_unchecked(&fscache_n_stores_again),
46909 + atomic_read_unchecked(&fscache_n_stores_nobufs),
46910 + atomic_read_unchecked(&fscache_n_stores_oom));
46911 seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
46912 - atomic_read(&fscache_n_store_ops),
46913 - atomic_read(&fscache_n_store_calls),
46914 - atomic_read(&fscache_n_store_pages),
46915 - atomic_read(&fscache_n_store_radix_deletes),
46916 - atomic_read(&fscache_n_store_pages_over_limit));
46917 + atomic_read_unchecked(&fscache_n_store_ops),
46918 + atomic_read_unchecked(&fscache_n_store_calls),
46919 + atomic_read_unchecked(&fscache_n_store_pages),
46920 + atomic_read_unchecked(&fscache_n_store_radix_deletes),
46921 + atomic_read_unchecked(&fscache_n_store_pages_over_limit));
46922
46923 seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
46924 - atomic_read(&fscache_n_store_vmscan_not_storing),
46925 - atomic_read(&fscache_n_store_vmscan_gone),
46926 - atomic_read(&fscache_n_store_vmscan_busy),
46927 - atomic_read(&fscache_n_store_vmscan_cancelled));
46928 + atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
46929 + atomic_read_unchecked(&fscache_n_store_vmscan_gone),
46930 + atomic_read_unchecked(&fscache_n_store_vmscan_busy),
46931 + atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
46932
46933 seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
46934 - atomic_read(&fscache_n_op_pend),
46935 - atomic_read(&fscache_n_op_run),
46936 - atomic_read(&fscache_n_op_enqueue),
46937 - atomic_read(&fscache_n_op_cancelled),
46938 - atomic_read(&fscache_n_op_rejected));
46939 + atomic_read_unchecked(&fscache_n_op_pend),
46940 + atomic_read_unchecked(&fscache_n_op_run),
46941 + atomic_read_unchecked(&fscache_n_op_enqueue),
46942 + atomic_read_unchecked(&fscache_n_op_cancelled),
46943 + atomic_read_unchecked(&fscache_n_op_rejected));
46944 seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
46945 - atomic_read(&fscache_n_op_deferred_release),
46946 - atomic_read(&fscache_n_op_release),
46947 - atomic_read(&fscache_n_op_gc));
46948 + atomic_read_unchecked(&fscache_n_op_deferred_release),
46949 + atomic_read_unchecked(&fscache_n_op_release),
46950 + atomic_read_unchecked(&fscache_n_op_gc));
46951
46952 seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
46953 atomic_read(&fscache_n_cop_alloc_object),
46954 diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
46955 index 3426521..3b75162 100644
46956 --- a/fs/fuse/cuse.c
46957 +++ b/fs/fuse/cuse.c
46958 @@ -587,10 +587,12 @@ static int __init cuse_init(void)
46959 INIT_LIST_HEAD(&cuse_conntbl[i]);
46960
46961 /* inherit and extend fuse_dev_operations */
46962 - cuse_channel_fops = fuse_dev_operations;
46963 - cuse_channel_fops.owner = THIS_MODULE;
46964 - cuse_channel_fops.open = cuse_channel_open;
46965 - cuse_channel_fops.release = cuse_channel_release;
46966 + pax_open_kernel();
46967 + memcpy((void *)&cuse_channel_fops, &fuse_dev_operations, sizeof(fuse_dev_operations));
46968 + *(void **)&cuse_channel_fops.owner = THIS_MODULE;
46969 + *(void **)&cuse_channel_fops.open = cuse_channel_open;
46970 + *(void **)&cuse_channel_fops.release = cuse_channel_release;
46971 + pax_close_kernel();
46972
46973 cuse_class = class_create(THIS_MODULE, "cuse");
46974 if (IS_ERR(cuse_class))
46975 diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
46976 index f4246cf..b4aed1d 100644
46977 --- a/fs/fuse/dev.c
46978 +++ b/fs/fuse/dev.c
46979 @@ -1242,7 +1242,7 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
46980 ret = 0;
46981 pipe_lock(pipe);
46982
46983 - if (!pipe->readers) {
46984 + if (!atomic_read(&pipe->readers)) {
46985 send_sig(SIGPIPE, current, 0);
46986 if (!ret)
46987 ret = -EPIPE;
46988 diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
46989 index 334e0b1..fc571e8 100644
46990 --- a/fs/fuse/dir.c
46991 +++ b/fs/fuse/dir.c
46992 @@ -1189,7 +1189,7 @@ static char *read_link(struct dentry *dentry)
46993 return link;
46994 }
46995
46996 -static void free_link(char *link)
46997 +static void free_link(const char *link)
46998 {
46999 if (!IS_ERR(link))
47000 free_page((unsigned long) link);
47001 diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
47002 index a9ba244..d9df391 100644
47003 --- a/fs/gfs2/inode.c
47004 +++ b/fs/gfs2/inode.c
47005 @@ -1496,7 +1496,7 @@ out:
47006
47007 static void gfs2_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
47008 {
47009 - char *s = nd_get_link(nd);
47010 + const char *s = nd_get_link(nd);
47011 if (!IS_ERR(s))
47012 kfree(s);
47013 }
47014 diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
47015 index cc9281b..58996fb 100644
47016 --- a/fs/hugetlbfs/inode.c
47017 +++ b/fs/hugetlbfs/inode.c
47018 @@ -920,7 +920,7 @@ static struct file_system_type hugetlbfs_fs_type = {
47019 .kill_sb = kill_litter_super,
47020 };
47021
47022 -static struct vfsmount *hugetlbfs_vfsmount;
47023 +struct vfsmount *hugetlbfs_vfsmount;
47024
47025 static int can_do_hugetlb_shm(void)
47026 {
47027 diff --git a/fs/inode.c b/fs/inode.c
47028 index c99163b..a11ad40 100644
47029 --- a/fs/inode.c
47030 +++ b/fs/inode.c
47031 @@ -867,8 +867,8 @@ unsigned int get_next_ino(void)
47032
47033 #ifdef CONFIG_SMP
47034 if (unlikely((res & (LAST_INO_BATCH-1)) == 0)) {
47035 - static atomic_t shared_last_ino;
47036 - int next = atomic_add_return(LAST_INO_BATCH, &shared_last_ino);
47037 + static atomic_unchecked_t shared_last_ino;
47038 + int next = atomic_add_return_unchecked(LAST_INO_BATCH, &shared_last_ino);
47039
47040 res = next - LAST_INO_BATCH;
47041 }
47042 diff --git a/fs/isofs/export.c b/fs/isofs/export.c
47043 index aa4356d..1d38044 100644
47044 --- a/fs/isofs/export.c
47045 +++ b/fs/isofs/export.c
47046 @@ -134,6 +134,7 @@ isofs_export_encode_fh(struct inode *inode,
47047 len = 3;
47048 fh32[0] = ei->i_iget5_block;
47049 fh16[2] = (__u16)ei->i_iget5_offset; /* fh16 [sic] */
47050 + fh16[3] = 0; /* avoid leaking uninitialized data */
47051 fh32[2] = inode->i_generation;
47052 if (parent) {
47053 struct iso_inode_info *eparent;
47054 diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
47055 index 4a6cf28..d3a29d3 100644
47056 --- a/fs/jffs2/erase.c
47057 +++ b/fs/jffs2/erase.c
47058 @@ -452,7 +452,8 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
47059 struct jffs2_unknown_node marker = {
47060 .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
47061 .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
47062 - .totlen = cpu_to_je32(c->cleanmarker_size)
47063 + .totlen = cpu_to_je32(c->cleanmarker_size),
47064 + .hdr_crc = cpu_to_je32(0)
47065 };
47066
47067 jffs2_prealloc_raw_node_refs(c, jeb, 1);
47068 diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
47069 index 6f4529d..bf12806 100644
47070 --- a/fs/jffs2/wbuf.c
47071 +++ b/fs/jffs2/wbuf.c
47072 @@ -1023,7 +1023,8 @@ static const struct jffs2_unknown_node oob_cleanmarker =
47073 {
47074 .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
47075 .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
47076 - .totlen = constant_cpu_to_je32(8)
47077 + .totlen = constant_cpu_to_je32(8),
47078 + .hdr_crc = constant_cpu_to_je32(0)
47079 };
47080
47081 /*
47082 diff --git a/fs/jfs/super.c b/fs/jfs/super.c
47083 index 4a82950..bcaa0cb 100644
47084 --- a/fs/jfs/super.c
47085 +++ b/fs/jfs/super.c
47086 @@ -801,7 +801,7 @@ static int __init init_jfs_fs(void)
47087
47088 jfs_inode_cachep =
47089 kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
47090 - SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
47091 + SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY,
47092 init_once);
47093 if (jfs_inode_cachep == NULL)
47094 return -ENOMEM;
47095 diff --git a/fs/libfs.c b/fs/libfs.c
47096 index f86ec27..4734776 100644
47097 --- a/fs/libfs.c
47098 +++ b/fs/libfs.c
47099 @@ -165,6 +165,9 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir)
47100
47101 for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
47102 struct dentry *next;
47103 + char d_name[sizeof(next->d_iname)];
47104 + const unsigned char *name;
47105 +
47106 next = list_entry(p, struct dentry, d_u.d_child);
47107 spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
47108 if (!simple_positive(next)) {
47109 @@ -174,7 +177,12 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir)
47110
47111 spin_unlock(&next->d_lock);
47112 spin_unlock(&dentry->d_lock);
47113 - if (filldir(dirent, next->d_name.name,
47114 + name = next->d_name.name;
47115 + if (name == next->d_iname) {
47116 + memcpy(d_name, name, next->d_name.len);
47117 + name = d_name;
47118 + }
47119 + if (filldir(dirent, name,
47120 next->d_name.len, filp->f_pos,
47121 next->d_inode->i_ino,
47122 dt_type(next->d_inode)) < 0)
47123 diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
47124 index 8392cb8..80d6193 100644
47125 --- a/fs/lockd/clntproc.c
47126 +++ b/fs/lockd/clntproc.c
47127 @@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt_cancel_ops;
47128 /*
47129 * Cookie counter for NLM requests
47130 */
47131 -static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
47132 +static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
47133
47134 void nlmclnt_next_cookie(struct nlm_cookie *c)
47135 {
47136 - u32 cookie = atomic_inc_return(&nlm_cookie);
47137 + u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
47138
47139 memcpy(c->data, &cookie, 4);
47140 c->len=4;
47141 diff --git a/fs/locks.c b/fs/locks.c
47142 index 82c3533..34e929c 100644
47143 --- a/fs/locks.c
47144 +++ b/fs/locks.c
47145 @@ -2076,16 +2076,16 @@ void locks_remove_flock(struct file *filp)
47146 return;
47147
47148 if (filp->f_op && filp->f_op->flock) {
47149 - struct file_lock fl = {
47150 + struct file_lock flock = {
47151 .fl_pid = current->tgid,
47152 .fl_file = filp,
47153 .fl_flags = FL_FLOCK,
47154 .fl_type = F_UNLCK,
47155 .fl_end = OFFSET_MAX,
47156 };
47157 - filp->f_op->flock(filp, F_SETLKW, &fl);
47158 - if (fl.fl_ops && fl.fl_ops->fl_release_private)
47159 - fl.fl_ops->fl_release_private(&fl);
47160 + filp->f_op->flock(filp, F_SETLKW, &flock);
47161 + if (flock.fl_ops && flock.fl_ops->fl_release_private)
47162 + flock.fl_ops->fl_release_private(&flock);
47163 }
47164
47165 lock_flocks();
47166 diff --git a/fs/namei.c b/fs/namei.c
47167 index 7d69419..c7a09f0 100644
47168 --- a/fs/namei.c
47169 +++ b/fs/namei.c
47170 @@ -265,16 +265,32 @@ int generic_permission(struct inode *inode, int mask)
47171 if (ret != -EACCES)
47172 return ret;
47173
47174 +#ifdef CONFIG_GRKERNSEC
47175 + /* we'll block if we have to log due to a denied capability use */
47176 + if (mask & MAY_NOT_BLOCK)
47177 + return -ECHILD;
47178 +#endif
47179 +
47180 if (S_ISDIR(inode->i_mode)) {
47181 /* DACs are overridable for directories */
47182 - if (inode_capable(inode, CAP_DAC_OVERRIDE))
47183 - return 0;
47184 if (!(mask & MAY_WRITE))
47185 - if (inode_capable(inode, CAP_DAC_READ_SEARCH))
47186 + if (inode_capable_nolog(inode, CAP_DAC_OVERRIDE) ||
47187 + inode_capable(inode, CAP_DAC_READ_SEARCH))
47188 return 0;
47189 + if (inode_capable(inode, CAP_DAC_OVERRIDE))
47190 + return 0;
47191 return -EACCES;
47192 }
47193 /*
47194 + * Searching includes executable on directories, else just read.
47195 + */
47196 + mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
47197 + if (mask == MAY_READ)
47198 + if (inode_capable_nolog(inode, CAP_DAC_OVERRIDE) ||
47199 + inode_capable(inode, CAP_DAC_READ_SEARCH))
47200 + return 0;
47201 +
47202 + /*
47203 * Read/write DACs are always overridable.
47204 * Executable DACs are overridable when there is
47205 * at least one exec bit set.
47206 @@ -283,14 +299,6 @@ int generic_permission(struct inode *inode, int mask)
47207 if (inode_capable(inode, CAP_DAC_OVERRIDE))
47208 return 0;
47209
47210 - /*
47211 - * Searching includes executable on directories, else just read.
47212 - */
47213 - mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
47214 - if (mask == MAY_READ)
47215 - if (inode_capable(inode, CAP_DAC_READ_SEARCH))
47216 - return 0;
47217 -
47218 return -EACCES;
47219 }
47220
47221 @@ -639,11 +647,19 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
47222 return error;
47223 }
47224
47225 + if (gr_handle_follow_link(dentry->d_parent->d_inode,
47226 + dentry->d_inode, dentry, nd->path.mnt)) {
47227 + error = -EACCES;
47228 + *p = ERR_PTR(error); /* no ->put_link(), please */
47229 + path_put(&nd->path);
47230 + return error;
47231 + }
47232 +
47233 nd->last_type = LAST_BIND;
47234 *p = dentry->d_inode->i_op->follow_link(dentry, nd);
47235 error = PTR_ERR(*p);
47236 if (!IS_ERR(*p)) {
47237 - char *s = nd_get_link(nd);
47238 + const char *s = nd_get_link(nd);
47239 error = 0;
47240 if (s)
47241 error = __vfs_follow_link(nd, s);
47242 @@ -1386,6 +1402,8 @@ static inline int nested_symlink(struct path *path, struct nameidata *nd)
47243 if (!res)
47244 res = walk_component(nd, path, &nd->last,
47245 nd->last_type, LOOKUP_FOLLOW);
47246 + if (res >= 0 && gr_handle_symlink_owner(&link, nd->inode))
47247 + res = -EACCES;
47248 put_link(nd, &link, cookie);
47249 } while (res > 0);
47250
47251 @@ -1779,6 +1797,8 @@ static int path_lookupat(int dfd, const char *name,
47252 err = follow_link(&link, nd, &cookie);
47253 if (!err)
47254 err = lookup_last(nd, &path);
47255 + if (!err && gr_handle_symlink_owner(&link, nd->inode))
47256 + err = -EACCES;
47257 put_link(nd, &link, cookie);
47258 }
47259 }
47260 @@ -1786,6 +1806,21 @@ static int path_lookupat(int dfd, const char *name,
47261 if (!err)
47262 err = complete_walk(nd);
47263
47264 + if (!(nd->flags & LOOKUP_PARENT)) {
47265 +#ifdef CONFIG_GRKERNSEC
47266 + if (flags & LOOKUP_RCU) {
47267 + if (!err)
47268 + path_put(&nd->path);
47269 + err = -ECHILD;
47270 + } else
47271 +#endif
47272 + if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
47273 + if (!err)
47274 + path_put(&nd->path);
47275 + err = -ENOENT;
47276 + }
47277 + }
47278 +
47279 if (!err && nd->flags & LOOKUP_DIRECTORY) {
47280 if (!nd->inode->i_op->lookup) {
47281 path_put(&nd->path);
47282 @@ -1813,6 +1848,15 @@ static int do_path_lookup(int dfd, const char *name,
47283 retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd);
47284
47285 if (likely(!retval)) {
47286 + if (*name != '/' && nd->path.dentry && nd->inode) {
47287 +#ifdef CONFIG_GRKERNSEC
47288 + if (flags & LOOKUP_RCU)
47289 + return -ECHILD;
47290 +#endif
47291 + if (!gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
47292 + return -ENOENT;
47293 + }
47294 +
47295 if (unlikely(!audit_dummy_context())) {
47296 if (nd->path.dentry && nd->inode)
47297 audit_inode(name, nd->path.dentry);
47298 @@ -2155,6 +2199,13 @@ static int may_open(struct path *path, int acc_mode, int flag)
47299 if (flag & O_NOATIME && !inode_owner_or_capable(inode))
47300 return -EPERM;
47301
47302 + if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode))
47303 + return -EPERM;
47304 + if (gr_handle_rawio(inode))
47305 + return -EPERM;
47306 + if (!gr_acl_handle_open(dentry, path->mnt, acc_mode))
47307 + return -EACCES;
47308 +
47309 return 0;
47310 }
47311
47312 @@ -2190,7 +2241,7 @@ static inline int open_to_namei_flags(int flag)
47313 /*
47314 * Handle the last step of open()
47315 */
47316 -static struct file *do_last(struct nameidata *nd, struct path *path,
47317 +static struct file *do_last(struct nameidata *nd, struct path *path, struct path *link,
47318 const struct open_flags *op, const char *pathname)
47319 {
47320 struct dentry *dir = nd->path.dentry;
47321 @@ -2220,16 +2271,44 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
47322 error = complete_walk(nd);
47323 if (error)
47324 return ERR_PTR(error);
47325 +#ifdef CONFIG_GRKERNSEC
47326 + if (nd->flags & LOOKUP_RCU) {
47327 + error = -ECHILD;
47328 + goto exit;
47329 + }
47330 +#endif
47331 + if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
47332 + error = -ENOENT;
47333 + goto exit;
47334 + }
47335 audit_inode(pathname, nd->path.dentry);
47336 if (open_flag & O_CREAT) {
47337 error = -EISDIR;
47338 goto exit;
47339 }
47340 + if (link && gr_handle_symlink_owner(link, nd->inode)) {
47341 + error = -EACCES;
47342 + goto exit;
47343 + }
47344 goto ok;
47345 case LAST_BIND:
47346 error = complete_walk(nd);
47347 if (error)
47348 return ERR_PTR(error);
47349 +#ifdef CONFIG_GRKERNSEC
47350 + if (nd->flags & LOOKUP_RCU) {
47351 + error = -ECHILD;
47352 + goto exit;
47353 + }
47354 +#endif
47355 + if (!gr_acl_handle_hidden_file(dir, nd->path.mnt)) {
47356 + error = -ENOENT;
47357 + goto exit;
47358 + }
47359 + if (link && gr_handle_symlink_owner(link, nd->inode)) {
47360 + error = -EACCES;
47361 + goto exit;
47362 + }
47363 audit_inode(pathname, dir);
47364 goto ok;
47365 }
47366 @@ -2285,6 +2364,17 @@ retry_lookup:
47367 /* Negative dentry, just create the file */
47368 if (!dentry->d_inode) {
47369 umode_t mode = op->mode;
47370 +
47371 + if (link && gr_handle_symlink_owner(link, dir->d_inode)) {
47372 + error = -EACCES;
47373 + goto exit_mutex_unlock;
47374 + }
47375 +
47376 + if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, path->mnt, open_flag, acc_mode, mode)) {
47377 + error = -EACCES;
47378 + goto exit_mutex_unlock;
47379 + }
47380 +
47381 if (!IS_POSIXACL(dir->d_inode))
47382 mode &= ~current_umask();
47383 /*
47384 @@ -2308,6 +2398,8 @@ retry_lookup:
47385 error = vfs_create(dir->d_inode, dentry, mode, nd);
47386 if (error)
47387 goto exit_mutex_unlock;
47388 + else
47389 + gr_handle_create(path->dentry, path->mnt);
47390 mutex_unlock(&dir->d_inode->i_mutex);
47391 dput(nd->path.dentry);
47392 nd->path.dentry = dentry;
47393 @@ -2317,6 +2409,23 @@ retry_lookup:
47394 /*
47395 * It already exists.
47396 */
47397 +
47398 + if (!gr_acl_handle_hidden_file(dentry, nd->path.mnt)) {
47399 + error = -ENOENT;
47400 + goto exit_mutex_unlock;
47401 + }
47402 + if (link && gr_handle_symlink_owner(link, dentry->d_inode)) {
47403 + error = -EACCES;
47404 + goto exit_mutex_unlock;
47405 + }
47406 +
47407 + /* only check if O_CREAT is specified, all other checks need to go
47408 + into may_open */
47409 + if (gr_handle_fifo(path->dentry, path->mnt, dir, open_flag, acc_mode)) {
47410 + error = -EACCES;
47411 + goto exit_mutex_unlock;
47412 + }
47413 +
47414 mutex_unlock(&dir->d_inode->i_mutex);
47415 audit_inode(pathname, path->dentry);
47416
47417 @@ -2349,6 +2458,11 @@ finish_lookup:
47418 }
47419 }
47420 BUG_ON(inode != path->dentry->d_inode);
47421 + /* if we're resolving a symlink to another symlink */
47422 + if (link && gr_handle_symlink_owner(link, inode)) {
47423 + error = -EACCES;
47424 + goto exit;
47425 + }
47426 return NULL;
47427 }
47428
47429 @@ -2358,7 +2472,6 @@ finish_lookup:
47430 save_parent.dentry = nd->path.dentry;
47431 save_parent.mnt = mntget(path->mnt);
47432 nd->path.dentry = path->dentry;
47433 -
47434 }
47435 nd->inode = inode;
47436 /* Why this, you ask? _Now_ we might have grown LOOKUP_JUMPED... */
47437 @@ -2367,6 +2480,21 @@ finish_lookup:
47438 path_put(&save_parent);
47439 return ERR_PTR(error);
47440 }
47441 +#ifdef CONFIG_GRKERNSEC
47442 + if (nd->flags & LOOKUP_RCU) {
47443 + error = -ECHILD;
47444 + goto exit;
47445 + }
47446 +#endif
47447 + if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
47448 + error = -ENOENT;
47449 + goto exit;
47450 + }
47451 + if (link && gr_handle_symlink_owner(link, nd->inode)) {
47452 + error = -EACCES;
47453 + goto exit;
47454 + }
47455 +
47456 error = -EISDIR;
47457 if ((open_flag & O_CREAT) && S_ISDIR(nd->inode->i_mode))
47458 goto exit;
47459 @@ -2461,7 +2589,7 @@ static struct file *path_openat(int dfd, const char *pathname,
47460 if (unlikely(error))
47461 goto out_filp;
47462
47463 - filp = do_last(nd, &path, op, pathname);
47464 + filp = do_last(nd, &path, NULL, op, pathname);
47465 while (unlikely(!filp)) { /* trailing symlink */
47466 struct path link = path;
47467 void *cookie;
47468 @@ -2476,8 +2604,9 @@ static struct file *path_openat(int dfd, const char *pathname,
47469 error = follow_link(&link, nd, &cookie);
47470 if (unlikely(error))
47471 filp = ERR_PTR(error);
47472 - else
47473 - filp = do_last(nd, &path, op, pathname);
47474 + else {
47475 + filp = do_last(nd, &path, &link, op, pathname);
47476 + }
47477 put_link(nd, &link, cookie);
47478 }
47479 out:
47480 @@ -2577,6 +2706,11 @@ struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path
47481 *path = nd.path;
47482 return dentry;
47483 eexist:
47484 + if (!gr_acl_handle_hidden_file(dentry, nd.path.mnt)) {
47485 + dput(dentry);
47486 + dentry = ERR_PTR(-ENOENT);
47487 + goto fail;
47488 + }
47489 dput(dentry);
47490 dentry = ERR_PTR(-EEXIST);
47491 fail:
47492 @@ -2599,6 +2733,20 @@ struct dentry *user_path_create(int dfd, const char __user *pathname, struct pat
47493 }
47494 EXPORT_SYMBOL(user_path_create);
47495
47496 +static struct dentry *user_path_create_with_name(int dfd, const char __user *pathname, struct path *path, char **to, int is_dir)
47497 +{
47498 + char *tmp = getname(pathname);
47499 + struct dentry *res;
47500 + if (IS_ERR(tmp))
47501 + return ERR_CAST(tmp);
47502 + res = kern_path_create(dfd, tmp, path, is_dir);
47503 + if (IS_ERR(res))
47504 + putname(tmp);
47505 + else
47506 + *to = tmp;
47507 + return res;
47508 +}
47509 +
47510 int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
47511 {
47512 int error = may_create(dir, dentry);
47513 @@ -2665,6 +2813,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
47514 error = mnt_want_write(path.mnt);
47515 if (error)
47516 goto out_dput;
47517 +
47518 + if (gr_handle_chroot_mknod(dentry, path.mnt, mode)) {
47519 + error = -EPERM;
47520 + goto out_drop_write;
47521 + }
47522 +
47523 + if (!gr_acl_handle_mknod(dentry, path.dentry, path.mnt, mode)) {
47524 + error = -EACCES;
47525 + goto out_drop_write;
47526 + }
47527 +
47528 error = security_path_mknod(&path, dentry, mode, dev);
47529 if (error)
47530 goto out_drop_write;
47531 @@ -2682,6 +2841,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode,
47532 }
47533 out_drop_write:
47534 mnt_drop_write(path.mnt);
47535 +
47536 + if (!error)
47537 + gr_handle_create(dentry, path.mnt);
47538 out_dput:
47539 dput(dentry);
47540 mutex_unlock(&path.dentry->d_inode->i_mutex);
47541 @@ -2735,12 +2897,21 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode)
47542 error = mnt_want_write(path.mnt);
47543 if (error)
47544 goto out_dput;
47545 +
47546 + if (!gr_acl_handle_mkdir(dentry, path.dentry, path.mnt)) {
47547 + error = -EACCES;
47548 + goto out_drop_write;
47549 + }
47550 +
47551 error = security_path_mkdir(&path, dentry, mode);
47552 if (error)
47553 goto out_drop_write;
47554 error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
47555 out_drop_write:
47556 mnt_drop_write(path.mnt);
47557 +
47558 + if (!error)
47559 + gr_handle_create(dentry, path.mnt);
47560 out_dput:
47561 dput(dentry);
47562 mutex_unlock(&path.dentry->d_inode->i_mutex);
47563 @@ -2820,6 +2991,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
47564 char * name;
47565 struct dentry *dentry;
47566 struct nameidata nd;
47567 + ino_t saved_ino = 0;
47568 + dev_t saved_dev = 0;
47569
47570 error = user_path_parent(dfd, pathname, &nd, &name);
47571 if (error)
47572 @@ -2848,6 +3021,15 @@ static long do_rmdir(int dfd, const char __user *pathname)
47573 error = -ENOENT;
47574 goto exit3;
47575 }
47576 +
47577 + saved_ino = dentry->d_inode->i_ino;
47578 + saved_dev = gr_get_dev_from_dentry(dentry);
47579 +
47580 + if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
47581 + error = -EACCES;
47582 + goto exit3;
47583 + }
47584 +
47585 error = mnt_want_write(nd.path.mnt);
47586 if (error)
47587 goto exit3;
47588 @@ -2855,6 +3037,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
47589 if (error)
47590 goto exit4;
47591 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
47592 + if (!error && (saved_dev || saved_ino))
47593 + gr_handle_delete(saved_ino, saved_dev);
47594 exit4:
47595 mnt_drop_write(nd.path.mnt);
47596 exit3:
47597 @@ -2917,6 +3101,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
47598 struct dentry *dentry;
47599 struct nameidata nd;
47600 struct inode *inode = NULL;
47601 + ino_t saved_ino = 0;
47602 + dev_t saved_dev = 0;
47603
47604 error = user_path_parent(dfd, pathname, &nd, &name);
47605 if (error)
47606 @@ -2939,6 +3125,16 @@ static long do_unlinkat(int dfd, const char __user *pathname)
47607 if (!inode)
47608 goto slashes;
47609 ihold(inode);
47610 +
47611 + if (inode->i_nlink <= 1) {
47612 + saved_ino = inode->i_ino;
47613 + saved_dev = gr_get_dev_from_dentry(dentry);
47614 + }
47615 + if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
47616 + error = -EACCES;
47617 + goto exit2;
47618 + }
47619 +
47620 error = mnt_want_write(nd.path.mnt);
47621 if (error)
47622 goto exit2;
47623 @@ -2946,6 +3142,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
47624 if (error)
47625 goto exit3;
47626 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
47627 + if (!error && (saved_ino || saved_dev))
47628 + gr_handle_delete(saved_ino, saved_dev);
47629 exit3:
47630 mnt_drop_write(nd.path.mnt);
47631 exit2:
47632 @@ -3021,10 +3219,18 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
47633 error = mnt_want_write(path.mnt);
47634 if (error)
47635 goto out_dput;
47636 +
47637 + if (!gr_acl_handle_symlink(dentry, path.dentry, path.mnt, from)) {
47638 + error = -EACCES;
47639 + goto out_drop_write;
47640 + }
47641 +
47642 error = security_path_symlink(&path, dentry, from);
47643 if (error)
47644 goto out_drop_write;
47645 error = vfs_symlink(path.dentry->d_inode, dentry, from);
47646 + if (!error)
47647 + gr_handle_create(dentry, path.mnt);
47648 out_drop_write:
47649 mnt_drop_write(path.mnt);
47650 out_dput:
47651 @@ -3099,6 +3305,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
47652 {
47653 struct dentry *new_dentry;
47654 struct path old_path, new_path;
47655 + char *to = NULL;
47656 int how = 0;
47657 int error;
47658
47659 @@ -3122,7 +3329,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
47660 if (error)
47661 return error;
47662
47663 - new_dentry = user_path_create(newdfd, newname, &new_path, 0);
47664 + new_dentry = user_path_create_with_name(newdfd, newname, &new_path, &to, 0);
47665 error = PTR_ERR(new_dentry);
47666 if (IS_ERR(new_dentry))
47667 goto out;
47668 @@ -3133,13 +3340,30 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
47669 error = mnt_want_write(new_path.mnt);
47670 if (error)
47671 goto out_dput;
47672 +
47673 + if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
47674 + old_path.dentry->d_inode,
47675 + old_path.dentry->d_inode->i_mode, to)) {
47676 + error = -EACCES;
47677 + goto out_drop_write;
47678 + }
47679 +
47680 + if (!gr_acl_handle_link(new_dentry, new_path.dentry, new_path.mnt,
47681 + old_path.dentry, old_path.mnt, to)) {
47682 + error = -EACCES;
47683 + goto out_drop_write;
47684 + }
47685 +
47686 error = security_path_link(old_path.dentry, &new_path, new_dentry);
47687 if (error)
47688 goto out_drop_write;
47689 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry);
47690 + if (!error)
47691 + gr_handle_create(new_dentry, new_path.mnt);
47692 out_drop_write:
47693 mnt_drop_write(new_path.mnt);
47694 out_dput:
47695 + putname(to);
47696 dput(new_dentry);
47697 mutex_unlock(&new_path.dentry->d_inode->i_mutex);
47698 path_put(&new_path);
47699 @@ -3373,6 +3597,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
47700 if (new_dentry == trap)
47701 goto exit5;
47702
47703 + error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
47704 + old_dentry, old_dir->d_inode, oldnd.path.mnt,
47705 + to);
47706 + if (error)
47707 + goto exit5;
47708 +
47709 error = mnt_want_write(oldnd.path.mnt);
47710 if (error)
47711 goto exit5;
47712 @@ -3382,6 +3612,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
47713 goto exit6;
47714 error = vfs_rename(old_dir->d_inode, old_dentry,
47715 new_dir->d_inode, new_dentry);
47716 + if (!error)
47717 + gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
47718 + new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
47719 exit6:
47720 mnt_drop_write(oldnd.path.mnt);
47721 exit5:
47722 @@ -3407,6 +3640,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
47723
47724 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
47725 {
47726 + char tmpbuf[64];
47727 + const char *newlink;
47728 int len;
47729
47730 len = PTR_ERR(link);
47731 @@ -3416,7 +3651,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
47732 len = strlen(link);
47733 if (len > (unsigned) buflen)
47734 len = buflen;
47735 - if (copy_to_user(buffer, link, len))
47736 +
47737 + if (len < sizeof(tmpbuf)) {
47738 + memcpy(tmpbuf, link, len);
47739 + newlink = tmpbuf;
47740 + } else
47741 + newlink = link;
47742 +
47743 + if (copy_to_user(buffer, newlink, len))
47744 len = -EFAULT;
47745 out:
47746 return len;
47747 diff --git a/fs/namespace.c b/fs/namespace.c
47748 index 1e4a5fe..a5ce747 100644
47749 --- a/fs/namespace.c
47750 +++ b/fs/namespace.c
47751 @@ -1157,6 +1157,9 @@ static int do_umount(struct mount *mnt, int flags)
47752 if (!(sb->s_flags & MS_RDONLY))
47753 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
47754 up_write(&sb->s_umount);
47755 +
47756 + gr_log_remount(mnt->mnt_devname, retval);
47757 +
47758 return retval;
47759 }
47760
47761 @@ -1176,6 +1179,9 @@ static int do_umount(struct mount *mnt, int flags)
47762 br_write_unlock(&vfsmount_lock);
47763 up_write(&namespace_sem);
47764 release_mounts(&umount_list);
47765 +
47766 + gr_log_unmount(mnt->mnt_devname, retval);
47767 +
47768 return retval;
47769 }
47770
47771 @@ -2177,6 +2183,16 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
47772 MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
47773 MS_STRICTATIME);
47774
47775 + if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
47776 + retval = -EPERM;
47777 + goto dput_out;
47778 + }
47779 +
47780 + if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
47781 + retval = -EPERM;
47782 + goto dput_out;
47783 + }
47784 +
47785 if (flags & MS_REMOUNT)
47786 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
47787 data_page);
47788 @@ -2191,6 +2207,9 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
47789 dev_name, data_page);
47790 dput_out:
47791 path_put(&path);
47792 +
47793 + gr_log_mount(dev_name, dir_name, retval);
47794 +
47795 return retval;
47796 }
47797
47798 @@ -2472,6 +2491,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
47799 if (error)
47800 goto out2;
47801
47802 + if (gr_handle_chroot_pivot()) {
47803 + error = -EPERM;
47804 + goto out2;
47805 + }
47806 +
47807 get_fs_root(current->fs, &root);
47808 error = lock_mount(&old);
47809 if (error)
47810 diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
47811 index f729698..2bac081 100644
47812 --- a/fs/nfs/inode.c
47813 +++ b/fs/nfs/inode.c
47814 @@ -152,7 +152,7 @@ static void nfs_zap_caches_locked(struct inode *inode)
47815 nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
47816 nfsi->attrtimeo_timestamp = jiffies;
47817
47818 - memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
47819 + memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_I(inode)->cookieverf));
47820 if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
47821 nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
47822 else
47823 @@ -1008,16 +1008,16 @@ static int nfs_size_need_update(const struct inode *inode, const struct nfs_fatt
47824 return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
47825 }
47826
47827 -static atomic_long_t nfs_attr_generation_counter;
47828 +static atomic_long_unchecked_t nfs_attr_generation_counter;
47829
47830 static unsigned long nfs_read_attr_generation_counter(void)
47831 {
47832 - return atomic_long_read(&nfs_attr_generation_counter);
47833 + return atomic_long_read_unchecked(&nfs_attr_generation_counter);
47834 }
47835
47836 unsigned long nfs_inc_attr_generation_counter(void)
47837 {
47838 - return atomic_long_inc_return(&nfs_attr_generation_counter);
47839 + return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
47840 }
47841
47842 void nfs_fattr_init(struct nfs_fattr *fattr)
47843 diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
47844 index c8bd9c3..4f83416 100644
47845 --- a/fs/nfsd/vfs.c
47846 +++ b/fs/nfsd/vfs.c
47847 @@ -933,7 +933,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
47848 } else {
47849 oldfs = get_fs();
47850 set_fs(KERNEL_DS);
47851 - host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
47852 + host_err = vfs_readv(file, (struct iovec __force_user *)vec, vlen, &offset);
47853 set_fs(oldfs);
47854 }
47855
47856 @@ -1037,7 +1037,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
47857
47858 /* Write the data. */
47859 oldfs = get_fs(); set_fs(KERNEL_DS);
47860 - host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
47861 + host_err = vfs_writev(file, (struct iovec __force_user *)vec, vlen, &offset);
47862 set_fs(oldfs);
47863 if (host_err < 0)
47864 goto out_nfserr;
47865 @@ -1573,7 +1573,7 @@ nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
47866 */
47867
47868 oldfs = get_fs(); set_fs(KERNEL_DS);
47869 - host_err = inode->i_op->readlink(path.dentry, buf, *lenp);
47870 + host_err = inode->i_op->readlink(path.dentry, (char __force_user *)buf, *lenp);
47871 set_fs(oldfs);
47872
47873 if (host_err < 0)
47874 diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
47875 index 3568c8a..e0240d8 100644
47876 --- a/fs/notify/fanotify/fanotify_user.c
47877 +++ b/fs/notify/fanotify/fanotify_user.c
47878 @@ -278,7 +278,8 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
47879 goto out_close_fd;
47880
47881 ret = -EFAULT;
47882 - if (copy_to_user(buf, &fanotify_event_metadata,
47883 + if (fanotify_event_metadata.event_len > sizeof fanotify_event_metadata ||
47884 + copy_to_user(buf, &fanotify_event_metadata,
47885 fanotify_event_metadata.event_len))
47886 goto out_kill_access_response;
47887
47888 diff --git a/fs/notify/notification.c b/fs/notify/notification.c
47889 index c887b13..0fdf472 100644
47890 --- a/fs/notify/notification.c
47891 +++ b/fs/notify/notification.c
47892 @@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event_holder_cachep;
47893 * get set to 0 so it will never get 'freed'
47894 */
47895 static struct fsnotify_event *q_overflow_event;
47896 -static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
47897 +static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
47898
47899 /**
47900 * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
47901 @@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
47902 */
47903 u32 fsnotify_get_cookie(void)
47904 {
47905 - return atomic_inc_return(&fsnotify_sync_cookie);
47906 + return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
47907 }
47908 EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
47909
47910 diff --git a/fs/ntfs/dir.c b/fs/ntfs/dir.c
47911 index 99e3610..02c1068 100644
47912 --- a/fs/ntfs/dir.c
47913 +++ b/fs/ntfs/dir.c
47914 @@ -1329,7 +1329,7 @@ find_next_index_buffer:
47915 ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
47916 ~(s64)(ndir->itype.index.block_size - 1)));
47917 /* Bounds checks. */
47918 - if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
47919 + if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
47920 ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
47921 "inode 0x%lx or driver bug.", vdir->i_ino);
47922 goto err_out;
47923 diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
47924 index 7389d2d..dfd5dbe 100644
47925 --- a/fs/ntfs/file.c
47926 +++ b/fs/ntfs/file.c
47927 @@ -2231,6 +2231,6 @@ const struct inode_operations ntfs_file_inode_ops = {
47928 #endif /* NTFS_RW */
47929 };
47930
47931 -const struct file_operations ntfs_empty_file_ops = {};
47932 +const struct file_operations ntfs_empty_file_ops __read_only;
47933
47934 -const struct inode_operations ntfs_empty_inode_ops = {};
47935 +const struct inode_operations ntfs_empty_inode_ops __read_only;
47936 diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
47937 index 210c352..a174f83 100644
47938 --- a/fs/ocfs2/localalloc.c
47939 +++ b/fs/ocfs2/localalloc.c
47940 @@ -1283,7 +1283,7 @@ static int ocfs2_local_alloc_slide_window(struct ocfs2_super *osb,
47941 goto bail;
47942 }
47943
47944 - atomic_inc(&osb->alloc_stats.moves);
47945 + atomic_inc_unchecked(&osb->alloc_stats.moves);
47946
47947 bail:
47948 if (handle)
47949 diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
47950 index d355e6e..578d905 100644
47951 --- a/fs/ocfs2/ocfs2.h
47952 +++ b/fs/ocfs2/ocfs2.h
47953 @@ -235,11 +235,11 @@ enum ocfs2_vol_state
47954
47955 struct ocfs2_alloc_stats
47956 {
47957 - atomic_t moves;
47958 - atomic_t local_data;
47959 - atomic_t bitmap_data;
47960 - atomic_t bg_allocs;
47961 - atomic_t bg_extends;
47962 + atomic_unchecked_t moves;
47963 + atomic_unchecked_t local_data;
47964 + atomic_unchecked_t bitmap_data;
47965 + atomic_unchecked_t bg_allocs;
47966 + atomic_unchecked_t bg_extends;
47967 };
47968
47969 enum ocfs2_local_alloc_state
47970 diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
47971 index f169da4..9112253 100644
47972 --- a/fs/ocfs2/suballoc.c
47973 +++ b/fs/ocfs2/suballoc.c
47974 @@ -872,7 +872,7 @@ static int ocfs2_reserve_suballoc_bits(struct ocfs2_super *osb,
47975 mlog_errno(status);
47976 goto bail;
47977 }
47978 - atomic_inc(&osb->alloc_stats.bg_extends);
47979 + atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
47980
47981 /* You should never ask for this much metadata */
47982 BUG_ON(bits_wanted >
47983 @@ -2008,7 +2008,7 @@ int ocfs2_claim_metadata(handle_t *handle,
47984 mlog_errno(status);
47985 goto bail;
47986 }
47987 - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47988 + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47989
47990 *suballoc_loc = res.sr_bg_blkno;
47991 *suballoc_bit_start = res.sr_bit_offset;
47992 @@ -2172,7 +2172,7 @@ int ocfs2_claim_new_inode_at_loc(handle_t *handle,
47993 trace_ocfs2_claim_new_inode_at_loc((unsigned long long)di_blkno,
47994 res->sr_bits);
47995
47996 - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47997 + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
47998
47999 BUG_ON(res->sr_bits != 1);
48000
48001 @@ -2214,7 +2214,7 @@ int ocfs2_claim_new_inode(handle_t *handle,
48002 mlog_errno(status);
48003 goto bail;
48004 }
48005 - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
48006 + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
48007
48008 BUG_ON(res.sr_bits != 1);
48009
48010 @@ -2318,7 +2318,7 @@ int __ocfs2_claim_clusters(handle_t *handle,
48011 cluster_start,
48012 num_clusters);
48013 if (!status)
48014 - atomic_inc(&osb->alloc_stats.local_data);
48015 + atomic_inc_unchecked(&osb->alloc_stats.local_data);
48016 } else {
48017 if (min_clusters > (osb->bitmap_cpg - 1)) {
48018 /* The only paths asking for contiguousness
48019 @@ -2344,7 +2344,7 @@ int __ocfs2_claim_clusters(handle_t *handle,
48020 ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
48021 res.sr_bg_blkno,
48022 res.sr_bit_offset);
48023 - atomic_inc(&osb->alloc_stats.bitmap_data);
48024 + atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
48025 *num_clusters = res.sr_bits;
48026 }
48027 }
48028 diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
48029 index 68f4541..89cfe6a 100644
48030 --- a/fs/ocfs2/super.c
48031 +++ b/fs/ocfs2/super.c
48032 @@ -301,11 +301,11 @@ static int ocfs2_osb_dump(struct ocfs2_super *osb, char *buf, int len)
48033 "%10s => GlobalAllocs: %d LocalAllocs: %d "
48034 "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
48035 "Stats",
48036 - atomic_read(&osb->alloc_stats.bitmap_data),
48037 - atomic_read(&osb->alloc_stats.local_data),
48038 - atomic_read(&osb->alloc_stats.bg_allocs),
48039 - atomic_read(&osb->alloc_stats.moves),
48040 - atomic_read(&osb->alloc_stats.bg_extends));
48041 + atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
48042 + atomic_read_unchecked(&osb->alloc_stats.local_data),
48043 + atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
48044 + atomic_read_unchecked(&osb->alloc_stats.moves),
48045 + atomic_read_unchecked(&osb->alloc_stats.bg_extends));
48046
48047 out += snprintf(buf + out, len - out,
48048 "%10s => State: %u Descriptor: %llu Size: %u bits "
48049 @@ -2116,11 +2116,11 @@ static int ocfs2_initialize_super(struct super_block *sb,
48050 spin_lock_init(&osb->osb_xattr_lock);
48051 ocfs2_init_steal_slots(osb);
48052
48053 - atomic_set(&osb->alloc_stats.moves, 0);
48054 - atomic_set(&osb->alloc_stats.local_data, 0);
48055 - atomic_set(&osb->alloc_stats.bitmap_data, 0);
48056 - atomic_set(&osb->alloc_stats.bg_allocs, 0);
48057 - atomic_set(&osb->alloc_stats.bg_extends, 0);
48058 + atomic_set_unchecked(&osb->alloc_stats.moves, 0);
48059 + atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
48060 + atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
48061 + atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
48062 + atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
48063
48064 /* Copy the blockcheck stats from the superblock probe */
48065 osb->osb_ecc_stats = *stats;
48066 diff --git a/fs/open.c b/fs/open.c
48067 index 5d9c71b..adb5b19 100644
48068 --- a/fs/open.c
48069 +++ b/fs/open.c
48070 @@ -31,6 +31,8 @@
48071 #include <linux/ima.h>
48072 #include <linux/dnotify.h>
48073
48074 +#define CREATE_TRACE_POINTS
48075 +#include <trace/events/fs.h>
48076 #include "internal.h"
48077
48078 int do_truncate(struct dentry *dentry, loff_t length, unsigned int time_attrs,
48079 @@ -112,6 +114,10 @@ static long do_sys_truncate(const char __user *pathname, loff_t length)
48080 error = locks_verify_truncate(inode, NULL, length);
48081 if (!error)
48082 error = security_path_truncate(&path);
48083 +
48084 + if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
48085 + error = -EACCES;
48086 +
48087 if (!error)
48088 error = do_truncate(path.dentry, length, 0, NULL);
48089
48090 @@ -359,6 +365,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
48091 if (__mnt_is_readonly(path.mnt))
48092 res = -EROFS;
48093
48094 + if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
48095 + res = -EACCES;
48096 +
48097 out_path_release:
48098 path_put(&path);
48099 out:
48100 @@ -385,6 +394,8 @@ SYSCALL_DEFINE1(chdir, const char __user *, filename)
48101 if (error)
48102 goto dput_and_out;
48103
48104 + gr_log_chdir(path.dentry, path.mnt);
48105 +
48106 set_fs_pwd(current->fs, &path);
48107
48108 dput_and_out:
48109 @@ -411,6 +422,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd)
48110 goto out_putf;
48111
48112 error = inode_permission(inode, MAY_EXEC | MAY_CHDIR);
48113 +
48114 + if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
48115 + error = -EPERM;
48116 +
48117 + if (!error)
48118 + gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
48119 +
48120 if (!error)
48121 set_fs_pwd(current->fs, &file->f_path);
48122 out_putf:
48123 @@ -439,7 +457,13 @@ SYSCALL_DEFINE1(chroot, const char __user *, filename)
48124 if (error)
48125 goto dput_and_out;
48126
48127 + if (gr_handle_chroot_chroot(path.dentry, path.mnt))
48128 + goto dput_and_out;
48129 +
48130 set_fs_root(current->fs, &path);
48131 +
48132 + gr_handle_chroot_chdir(&path);
48133 +
48134 error = 0;
48135 dput_and_out:
48136 path_put(&path);
48137 @@ -457,6 +481,16 @@ static int chmod_common(struct path *path, umode_t mode)
48138 if (error)
48139 return error;
48140 mutex_lock(&inode->i_mutex);
48141 +
48142 + if (!gr_acl_handle_chmod(path->dentry, path->mnt, &mode)) {
48143 + error = -EACCES;
48144 + goto out_unlock;
48145 + }
48146 + if (gr_handle_chroot_chmod(path->dentry, path->mnt, mode)) {
48147 + error = -EACCES;
48148 + goto out_unlock;
48149 + }
48150 +
48151 error = security_path_chmod(path, mode);
48152 if (error)
48153 goto out_unlock;
48154 @@ -512,6 +546,9 @@ static int chown_common(struct path *path, uid_t user, gid_t group)
48155 uid = make_kuid(current_user_ns(), user);
48156 gid = make_kgid(current_user_ns(), group);
48157
48158 + if (!gr_acl_handle_chown(path->dentry, path->mnt))
48159 + return -EACCES;
48160 +
48161 newattrs.ia_valid = ATTR_CTIME;
48162 if (user != (uid_t) -1) {
48163 if (!uid_valid(uid))
48164 @@ -1036,6 +1073,7 @@ long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode)
48165 } else {
48166 fsnotify_open(f);
48167 fd_install(fd, f);
48168 + trace_do_sys_open(tmp, flags, mode);
48169 }
48170 }
48171 putname(tmp);
48172 diff --git a/fs/pipe.c b/fs/pipe.c
48173 index 49c1065..13b9e12 100644
48174 --- a/fs/pipe.c
48175 +++ b/fs/pipe.c
48176 @@ -438,9 +438,9 @@ redo:
48177 }
48178 if (bufs) /* More to do? */
48179 continue;
48180 - if (!pipe->writers)
48181 + if (!atomic_read(&pipe->writers))
48182 break;
48183 - if (!pipe->waiting_writers) {
48184 + if (!atomic_read(&pipe->waiting_writers)) {
48185 /* syscall merging: Usually we must not sleep
48186 * if O_NONBLOCK is set, or if we got some data.
48187 * But if a writer sleeps in kernel space, then
48188 @@ -504,7 +504,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
48189 mutex_lock(&inode->i_mutex);
48190 pipe = inode->i_pipe;
48191
48192 - if (!pipe->readers) {
48193 + if (!atomic_read(&pipe->readers)) {
48194 send_sig(SIGPIPE, current, 0);
48195 ret = -EPIPE;
48196 goto out;
48197 @@ -553,7 +553,7 @@ redo1:
48198 for (;;) {
48199 int bufs;
48200
48201 - if (!pipe->readers) {
48202 + if (!atomic_read(&pipe->readers)) {
48203 send_sig(SIGPIPE, current, 0);
48204 if (!ret)
48205 ret = -EPIPE;
48206 @@ -644,9 +644,9 @@ redo2:
48207 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
48208 do_wakeup = 0;
48209 }
48210 - pipe->waiting_writers++;
48211 + atomic_inc(&pipe->waiting_writers);
48212 pipe_wait(pipe);
48213 - pipe->waiting_writers--;
48214 + atomic_dec(&pipe->waiting_writers);
48215 }
48216 out:
48217 mutex_unlock(&inode->i_mutex);
48218 @@ -716,7 +716,7 @@ pipe_poll(struct file *filp, poll_table *wait)
48219 mask = 0;
48220 if (filp->f_mode & FMODE_READ) {
48221 mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
48222 - if (!pipe->writers && filp->f_version != pipe->w_counter)
48223 + if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
48224 mask |= POLLHUP;
48225 }
48226
48227 @@ -726,7 +726,7 @@ pipe_poll(struct file *filp, poll_table *wait)
48228 * Most Unices do not set POLLERR for FIFOs but on Linux they
48229 * behave exactly like pipes for poll().
48230 */
48231 - if (!pipe->readers)
48232 + if (!atomic_read(&pipe->readers))
48233 mask |= POLLERR;
48234 }
48235
48236 @@ -740,10 +740,10 @@ pipe_release(struct inode *inode, int decr, int decw)
48237
48238 mutex_lock(&inode->i_mutex);
48239 pipe = inode->i_pipe;
48240 - pipe->readers -= decr;
48241 - pipe->writers -= decw;
48242 + atomic_sub(decr, &pipe->readers);
48243 + atomic_sub(decw, &pipe->writers);
48244
48245 - if (!pipe->readers && !pipe->writers) {
48246 + if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
48247 free_pipe_info(inode);
48248 } else {
48249 wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
48250 @@ -833,7 +833,7 @@ pipe_read_open(struct inode *inode, struct file *filp)
48251
48252 if (inode->i_pipe) {
48253 ret = 0;
48254 - inode->i_pipe->readers++;
48255 + atomic_inc(&inode->i_pipe->readers);
48256 }
48257
48258 mutex_unlock(&inode->i_mutex);
48259 @@ -850,7 +850,7 @@ pipe_write_open(struct inode *inode, struct file *filp)
48260
48261 if (inode->i_pipe) {
48262 ret = 0;
48263 - inode->i_pipe->writers++;
48264 + atomic_inc(&inode->i_pipe->writers);
48265 }
48266
48267 mutex_unlock(&inode->i_mutex);
48268 @@ -868,9 +868,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
48269 if (inode->i_pipe) {
48270 ret = 0;
48271 if (filp->f_mode & FMODE_READ)
48272 - inode->i_pipe->readers++;
48273 + atomic_inc(&inode->i_pipe->readers);
48274 if (filp->f_mode & FMODE_WRITE)
48275 - inode->i_pipe->writers++;
48276 + atomic_inc(&inode->i_pipe->writers);
48277 }
48278
48279 mutex_unlock(&inode->i_mutex);
48280 @@ -962,7 +962,7 @@ void free_pipe_info(struct inode *inode)
48281 inode->i_pipe = NULL;
48282 }
48283
48284 -static struct vfsmount *pipe_mnt __read_mostly;
48285 +struct vfsmount *pipe_mnt __read_mostly;
48286
48287 /*
48288 * pipefs_dname() is called from d_path().
48289 @@ -992,7 +992,8 @@ static struct inode * get_pipe_inode(void)
48290 goto fail_iput;
48291 inode->i_pipe = pipe;
48292
48293 - pipe->readers = pipe->writers = 1;
48294 + atomic_set(&pipe->readers, 1);
48295 + atomic_set(&pipe->writers, 1);
48296 inode->i_fop = &rdwr_pipefifo_fops;
48297
48298 /*
48299 diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig
48300 index 15af622..0e9f4467 100644
48301 --- a/fs/proc/Kconfig
48302 +++ b/fs/proc/Kconfig
48303 @@ -30,12 +30,12 @@ config PROC_FS
48304
48305 config PROC_KCORE
48306 bool "/proc/kcore support" if !ARM
48307 - depends on PROC_FS && MMU
48308 + depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
48309
48310 config PROC_VMCORE
48311 bool "/proc/vmcore support"
48312 - depends on PROC_FS && CRASH_DUMP
48313 - default y
48314 + depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
48315 + default n
48316 help
48317 Exports the dump image of crashed kernel in ELF format.
48318
48319 @@ -59,8 +59,8 @@ config PROC_SYSCTL
48320 limited in memory.
48321
48322 config PROC_PAGE_MONITOR
48323 - default y
48324 - depends on PROC_FS && MMU
48325 + default n
48326 + depends on PROC_FS && MMU && !GRKERNSEC
48327 bool "Enable /proc page monitoring" if EXPERT
48328 help
48329 Various /proc files exist to monitor process memory utilization:
48330 diff --git a/fs/proc/array.c b/fs/proc/array.c
48331 index c1c207c..5179411 100644
48332 --- a/fs/proc/array.c
48333 +++ b/fs/proc/array.c
48334 @@ -60,6 +60,7 @@
48335 #include <linux/tty.h>
48336 #include <linux/string.h>
48337 #include <linux/mman.h>
48338 +#include <linux/grsecurity.h>
48339 #include <linux/proc_fs.h>
48340 #include <linux/ioport.h>
48341 #include <linux/uaccess.h>
48342 @@ -346,6 +347,21 @@ static void task_cpus_allowed(struct seq_file *m, struct task_struct *task)
48343 seq_putc(m, '\n');
48344 }
48345
48346 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
48347 +static inline void task_pax(struct seq_file *m, struct task_struct *p)
48348 +{
48349 + if (p->mm)
48350 + seq_printf(m, "PaX:\t%c%c%c%c%c\n",
48351 + p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
48352 + p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
48353 + p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
48354 + p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
48355 + p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
48356 + else
48357 + seq_printf(m, "PaX:\t-----\n");
48358 +}
48359 +#endif
48360 +
48361 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
48362 struct pid *pid, struct task_struct *task)
48363 {
48364 @@ -363,9 +379,24 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
48365 task_cpus_allowed(m, task);
48366 cpuset_task_status_allowed(m, task);
48367 task_context_switch_counts(m, task);
48368 +
48369 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
48370 + task_pax(m, task);
48371 +#endif
48372 +
48373 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
48374 + task_grsec_rbac(m, task);
48375 +#endif
48376 +
48377 return 0;
48378 }
48379
48380 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48381 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
48382 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
48383 + _mm->pax_flags & MF_PAX_SEGMEXEC))
48384 +#endif
48385 +
48386 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
48387 struct pid *pid, struct task_struct *task, int whole)
48388 {
48389 @@ -387,6 +418,13 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
48390 char tcomm[sizeof(task->comm)];
48391 unsigned long flags;
48392
48393 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48394 + if (current->exec_id != m->exec_id) {
48395 + gr_log_badprocpid("stat");
48396 + return 0;
48397 + }
48398 +#endif
48399 +
48400 state = *get_task_state(task);
48401 vsize = eip = esp = 0;
48402 permitted = ptrace_may_access(task, PTRACE_MODE_READ | PTRACE_MODE_NOAUDIT);
48403 @@ -458,6 +496,19 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
48404 gtime = task->gtime;
48405 }
48406
48407 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48408 + if (PAX_RAND_FLAGS(mm)) {
48409 + eip = 0;
48410 + esp = 0;
48411 + wchan = 0;
48412 + }
48413 +#endif
48414 +#ifdef CONFIG_GRKERNSEC_HIDESYM
48415 + wchan = 0;
48416 + eip =0;
48417 + esp =0;
48418 +#endif
48419 +
48420 /* scale priority and nice values from timeslices to -20..20 */
48421 /* to make it look like a "normal" Unix priority/nice value */
48422 priority = task_prio(task);
48423 @@ -494,9 +545,15 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
48424 seq_put_decimal_ull(m, ' ', vsize);
48425 seq_put_decimal_ull(m, ' ', mm ? get_mm_rss(mm) : 0);
48426 seq_put_decimal_ull(m, ' ', rsslim);
48427 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48428 + seq_put_decimal_ull(m, ' ', PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0));
48429 + seq_put_decimal_ull(m, ' ', PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0));
48430 + seq_put_decimal_ull(m, ' ', PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0));
48431 +#else
48432 seq_put_decimal_ull(m, ' ', mm ? (permitted ? mm->start_code : 1) : 0);
48433 seq_put_decimal_ull(m, ' ', mm ? (permitted ? mm->end_code : 1) : 0);
48434 seq_put_decimal_ull(m, ' ', (permitted && mm) ? mm->start_stack : 0);
48435 +#endif
48436 seq_put_decimal_ull(m, ' ', esp);
48437 seq_put_decimal_ull(m, ' ', eip);
48438 /* The signal information here is obsolete.
48439 @@ -518,7 +575,11 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
48440 seq_put_decimal_ull(m, ' ', cputime_to_clock_t(gtime));
48441 seq_put_decimal_ll(m, ' ', cputime_to_clock_t(cgtime));
48442
48443 - if (mm && permitted) {
48444 + if (mm && permitted
48445 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48446 + && !PAX_RAND_FLAGS(mm)
48447 +#endif
48448 + ) {
48449 seq_put_decimal_ull(m, ' ', mm->start_data);
48450 seq_put_decimal_ull(m, ' ', mm->end_data);
48451 seq_put_decimal_ull(m, ' ', mm->start_brk);
48452 @@ -556,8 +617,15 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
48453 struct pid *pid, struct task_struct *task)
48454 {
48455 unsigned long size = 0, resident = 0, shared = 0, text = 0, data = 0;
48456 - struct mm_struct *mm = get_task_mm(task);
48457 + struct mm_struct *mm;
48458
48459 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48460 + if (current->exec_id != m->exec_id) {
48461 + gr_log_badprocpid("statm");
48462 + return 0;
48463 + }
48464 +#endif
48465 + mm = get_task_mm(task);
48466 if (mm) {
48467 size = task_statm(mm, &shared, &text, &data, &resident);
48468 mmput(mm);
48469 @@ -580,6 +648,21 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
48470 return 0;
48471 }
48472
48473 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
48474 +int proc_pid_ipaddr(struct task_struct *task, char *buffer)
48475 +{
48476 + u32 curr_ip = 0;
48477 + unsigned long flags;
48478 +
48479 + if (lock_task_sighand(task, &flags)) {
48480 + curr_ip = task->signal->curr_ip;
48481 + unlock_task_sighand(task, &flags);
48482 + }
48483 +
48484 + return sprintf(buffer, "%pI4\n", &curr_ip);
48485 +}
48486 +#endif
48487 +
48488 #ifdef CONFIG_CHECKPOINT_RESTORE
48489 static struct pid *
48490 get_children_pid(struct inode *inode, struct pid *pid_prev, loff_t pos)
48491 diff --git a/fs/proc/base.c b/fs/proc/base.c
48492 index 437195f..cd2210d 100644
48493 --- a/fs/proc/base.c
48494 +++ b/fs/proc/base.c
48495 @@ -110,6 +110,14 @@ struct pid_entry {
48496 union proc_op op;
48497 };
48498
48499 +struct getdents_callback {
48500 + struct linux_dirent __user * current_dir;
48501 + struct linux_dirent __user * previous;
48502 + struct file * file;
48503 + int count;
48504 + int error;
48505 +};
48506 +
48507 #define NOD(NAME, MODE, IOP, FOP, OP) { \
48508 .name = (NAME), \
48509 .len = sizeof(NAME) - 1, \
48510 @@ -209,6 +217,9 @@ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
48511 if (!mm->arg_end)
48512 goto out_mm; /* Shh! No looking before we're done */
48513
48514 + if (gr_acl_handle_procpidmem(task))
48515 + goto out_mm;
48516 +
48517 len = mm->arg_end - mm->arg_start;
48518
48519 if (len > PAGE_SIZE)
48520 @@ -236,12 +247,28 @@ out:
48521 return res;
48522 }
48523
48524 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48525 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
48526 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
48527 + _mm->pax_flags & MF_PAX_SEGMEXEC))
48528 +#endif
48529 +
48530 static int proc_pid_auxv(struct task_struct *task, char *buffer)
48531 {
48532 struct mm_struct *mm = mm_access(task, PTRACE_MODE_READ);
48533 int res = PTR_ERR(mm);
48534 if (mm && !IS_ERR(mm)) {
48535 unsigned int nwords = 0;
48536 +
48537 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48538 + /* allow if we're currently ptracing this task */
48539 + if (PAX_RAND_FLAGS(mm) &&
48540 + (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
48541 + mmput(mm);
48542 + return 0;
48543 + }
48544 +#endif
48545 +
48546 do {
48547 nwords += 2;
48548 } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
48549 @@ -255,7 +282,7 @@ static int proc_pid_auxv(struct task_struct *task, char *buffer)
48550 }
48551
48552
48553 -#ifdef CONFIG_KALLSYMS
48554 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48555 /*
48556 * Provides a wchan file via kallsyms in a proper one-value-per-file format.
48557 * Returns the resolved symbol. If that fails, simply return the address.
48558 @@ -294,7 +321,7 @@ static void unlock_trace(struct task_struct *task)
48559 mutex_unlock(&task->signal->cred_guard_mutex);
48560 }
48561
48562 -#ifdef CONFIG_STACKTRACE
48563 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48564
48565 #define MAX_STACK_TRACE_DEPTH 64
48566
48567 @@ -486,7 +513,7 @@ static int proc_pid_limits(struct task_struct *task, char *buffer)
48568 return count;
48569 }
48570
48571 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
48572 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
48573 static int proc_pid_syscall(struct task_struct *task, char *buffer)
48574 {
48575 long nr;
48576 @@ -515,7 +542,7 @@ static int proc_pid_syscall(struct task_struct *task, char *buffer)
48577 /************************************************************************/
48578
48579 /* permission checks */
48580 -static int proc_fd_access_allowed(struct inode *inode)
48581 +static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
48582 {
48583 struct task_struct *task;
48584 int allowed = 0;
48585 @@ -525,7 +552,10 @@ static int proc_fd_access_allowed(struct inode *inode)
48586 */
48587 task = get_proc_task(inode);
48588 if (task) {
48589 - allowed = ptrace_may_access(task, PTRACE_MODE_READ);
48590 + if (log)
48591 + allowed = ptrace_may_access(task, PTRACE_MODE_READ);
48592 + else
48593 + allowed = ptrace_may_access(task, PTRACE_MODE_READ | PTRACE_MODE_NOAUDIT);
48594 put_task_struct(task);
48595 }
48596 return allowed;
48597 @@ -563,10 +593,35 @@ static bool has_pid_permissions(struct pid_namespace *pid,
48598 struct task_struct *task,
48599 int hide_pid_min)
48600 {
48601 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
48602 + return false;
48603 +
48604 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48605 + rcu_read_lock();
48606 + {
48607 + const struct cred *tmpcred = current_cred();
48608 + const struct cred *cred = __task_cred(task);
48609 +
48610 + if (!tmpcred->uid || (tmpcred->uid == cred->uid)
48611 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48612 + || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
48613 +#endif
48614 + ) {
48615 + rcu_read_unlock();
48616 + return true;
48617 + }
48618 + }
48619 + rcu_read_unlock();
48620 +
48621 + if (!pid->hide_pid)
48622 + return false;
48623 +#endif
48624 +
48625 if (pid->hide_pid < hide_pid_min)
48626 return true;
48627 if (in_group_p(pid->pid_gid))
48628 return true;
48629 +
48630 return ptrace_may_access(task, PTRACE_MODE_READ);
48631 }
48632
48633 @@ -584,7 +639,11 @@ static int proc_pid_permission(struct inode *inode, int mask)
48634 put_task_struct(task);
48635
48636 if (!has_perms) {
48637 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48638 + {
48639 +#else
48640 if (pid->hide_pid == 2) {
48641 +#endif
48642 /*
48643 * Let's make getdents(), stat(), and open()
48644 * consistent with each other. If a process
48645 @@ -682,6 +741,11 @@ static int __mem_open(struct inode *inode, struct file *file, unsigned int mode)
48646 if (!task)
48647 return -ESRCH;
48648
48649 + if (gr_acl_handle_procpidmem(task)) {
48650 + put_task_struct(task);
48651 + return -EPERM;
48652 + }
48653 +
48654 mm = mm_access(task, mode);
48655 put_task_struct(task);
48656
48657 @@ -695,16 +759,24 @@ static int __mem_open(struct inode *inode, struct file *file, unsigned int mode)
48658 mmput(mm);
48659 }
48660
48661 - /* OK to pass negative loff_t, we can catch out-of-range */
48662 - file->f_mode |= FMODE_UNSIGNED_OFFSET;
48663 file->private_data = mm;
48664
48665 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48666 + file->f_version = current->exec_id;
48667 +#endif
48668 +
48669 return 0;
48670 }
48671
48672 static int mem_open(struct inode *inode, struct file *file)
48673 {
48674 - return __mem_open(inode, file, PTRACE_MODE_ATTACH);
48675 + int ret;
48676 + ret = __mem_open(inode, file, PTRACE_MODE_ATTACH);
48677 +
48678 + /* OK to pass negative loff_t, we can catch out-of-range */
48679 + file->f_mode |= FMODE_UNSIGNED_OFFSET;
48680 +
48681 + return ret;
48682 }
48683
48684 static ssize_t mem_rw(struct file *file, char __user *buf,
48685 @@ -715,6 +787,17 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
48686 ssize_t copied;
48687 char *page;
48688
48689 +#ifdef CONFIG_GRKERNSEC
48690 + if (write)
48691 + return -EPERM;
48692 +#endif
48693 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48694 + if (file->f_version != current->exec_id) {
48695 + gr_log_badprocpid("mem");
48696 + return 0;
48697 + }
48698 +#endif
48699 +
48700 if (!mm)
48701 return 0;
48702
48703 @@ -819,6 +902,13 @@ static ssize_t environ_read(struct file *file, char __user *buf,
48704 if (!mm)
48705 return 0;
48706
48707 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48708 + if (file->f_version != current->exec_id) {
48709 + gr_log_badprocpid("environ");
48710 + return 0;
48711 + }
48712 +#endif
48713 +
48714 page = (char *)__get_free_page(GFP_TEMPORARY);
48715 if (!page)
48716 return -ENOMEM;
48717 @@ -827,15 +917,17 @@ static ssize_t environ_read(struct file *file, char __user *buf,
48718 if (!atomic_inc_not_zero(&mm->mm_users))
48719 goto free;
48720 while (count > 0) {
48721 - int this_len, retval, max_len;
48722 + size_t this_len, max_len;
48723 + int retval;
48724 +
48725 + if (src >= (mm->env_end - mm->env_start))
48726 + break;
48727
48728 this_len = mm->env_end - (mm->env_start + src);
48729
48730 - if (this_len <= 0)
48731 - break;
48732
48733 - max_len = (count > PAGE_SIZE) ? PAGE_SIZE : count;
48734 - this_len = (this_len > max_len) ? max_len : this_len;
48735 + max_len = min_t(size_t, PAGE_SIZE, count);
48736 + this_len = min(max_len, this_len);
48737
48738 retval = access_remote_vm(mm, (mm->env_start + src),
48739 page, this_len, 0);
48740 @@ -1433,7 +1525,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
48741 path_put(&nd->path);
48742
48743 /* Are we allowed to snoop on the tasks file descriptors? */
48744 - if (!proc_fd_access_allowed(inode))
48745 + if (!proc_fd_access_allowed(inode, 0))
48746 goto out;
48747
48748 error = PROC_I(inode)->op.proc_get_link(dentry, &nd->path);
48749 @@ -1472,8 +1564,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
48750 struct path path;
48751
48752 /* Are we allowed to snoop on the tasks file descriptors? */
48753 - if (!proc_fd_access_allowed(inode))
48754 - goto out;
48755 + /* logging this is needed for learning on chromium to work properly,
48756 + but we don't want to flood the logs from 'ps' which does a readlink
48757 + on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
48758 + CAP_SYS_PTRACE as it's not necessary for its basic functionality
48759 + */
48760 + if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
48761 + if (!proc_fd_access_allowed(inode,0))
48762 + goto out;
48763 + } else {
48764 + if (!proc_fd_access_allowed(inode,1))
48765 + goto out;
48766 + }
48767
48768 error = PROC_I(inode)->op.proc_get_link(dentry, &path);
48769 if (error)
48770 @@ -1538,7 +1640,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t
48771 rcu_read_lock();
48772 cred = __task_cred(task);
48773 inode->i_uid = cred->euid;
48774 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48775 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48776 +#else
48777 inode->i_gid = cred->egid;
48778 +#endif
48779 rcu_read_unlock();
48780 }
48781 security_task_to_inode(task, inode);
48782 @@ -1574,10 +1680,19 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
48783 return -ENOENT;
48784 }
48785 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
48786 +#ifdef CONFIG_GRKERNSEC_PROC_USER
48787 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
48788 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48789 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
48790 +#endif
48791 task_dumpable(task)) {
48792 cred = __task_cred(task);
48793 stat->uid = cred->euid;
48794 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48795 + stat->gid = CONFIG_GRKERNSEC_PROC_GID;
48796 +#else
48797 stat->gid = cred->egid;
48798 +#endif
48799 }
48800 }
48801 rcu_read_unlock();
48802 @@ -1615,11 +1730,20 @@ int pid_revalidate(struct dentry *dentry, struct nameidata *nd)
48803
48804 if (task) {
48805 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
48806 +#ifdef CONFIG_GRKERNSEC_PROC_USER
48807 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
48808 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48809 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
48810 +#endif
48811 task_dumpable(task)) {
48812 rcu_read_lock();
48813 cred = __task_cred(task);
48814 inode->i_uid = cred->euid;
48815 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
48816 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48817 +#else
48818 inode->i_gid = cred->egid;
48819 +#endif
48820 rcu_read_unlock();
48821 } else {
48822 inode->i_uid = GLOBAL_ROOT_UID;
48823 @@ -1737,7 +1861,8 @@ static int proc_fd_info(struct inode *inode, struct path *path, char *info)
48824 int fd = proc_fd(inode);
48825
48826 if (task) {
48827 - files = get_files_struct(task);
48828 + if (!gr_acl_handle_procpidmem(task))
48829 + files = get_files_struct(task);
48830 put_task_struct(task);
48831 }
48832 if (files) {
48833 @@ -2336,11 +2461,21 @@ static const struct file_operations proc_map_files_operations = {
48834 */
48835 static int proc_fd_permission(struct inode *inode, int mask)
48836 {
48837 + struct task_struct *task;
48838 int rv = generic_permission(inode, mask);
48839 - if (rv == 0)
48840 - return 0;
48841 +
48842 if (task_pid(current) == proc_pid(inode))
48843 rv = 0;
48844 +
48845 + task = get_proc_task(inode);
48846 + if (task == NULL)
48847 + return rv;
48848 +
48849 + if (gr_acl_handle_procpidmem(task))
48850 + rv = -EACCES;
48851 +
48852 + put_task_struct(task);
48853 +
48854 return rv;
48855 }
48856
48857 @@ -2450,6 +2585,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
48858 if (!task)
48859 goto out_no_task;
48860
48861 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
48862 + goto out;
48863 +
48864 /*
48865 * Yes, it does not scale. And it should not. Don't add
48866 * new entries into /proc/<tgid>/ without very good reasons.
48867 @@ -2494,6 +2632,9 @@ static int proc_pident_readdir(struct file *filp,
48868 if (!task)
48869 goto out_no_task;
48870
48871 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
48872 + goto out;
48873 +
48874 ret = 0;
48875 i = filp->f_pos;
48876 switch (i) {
48877 @@ -2764,7 +2905,7 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
48878 static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
48879 void *cookie)
48880 {
48881 - char *s = nd_get_link(nd);
48882 + const char *s = nd_get_link(nd);
48883 if (!IS_ERR(s))
48884 __putname(s);
48885 }
48886 @@ -3033,7 +3174,7 @@ static const struct pid_entry tgid_base_stuff[] = {
48887 REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
48888 #endif
48889 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
48890 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
48891 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
48892 INF("syscall", S_IRUGO, proc_pid_syscall),
48893 #endif
48894 INF("cmdline", S_IRUGO, proc_pid_cmdline),
48895 @@ -3058,10 +3199,10 @@ static const struct pid_entry tgid_base_stuff[] = {
48896 #ifdef CONFIG_SECURITY
48897 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
48898 #endif
48899 -#ifdef CONFIG_KALLSYMS
48900 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48901 INF("wchan", S_IRUGO, proc_pid_wchan),
48902 #endif
48903 -#ifdef CONFIG_STACKTRACE
48904 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48905 ONE("stack", S_IRUGO, proc_pid_stack),
48906 #endif
48907 #ifdef CONFIG_SCHEDSTATS
48908 @@ -3095,6 +3236,9 @@ static const struct pid_entry tgid_base_stuff[] = {
48909 #ifdef CONFIG_HARDWALL
48910 INF("hardwall", S_IRUGO, proc_pid_hardwall),
48911 #endif
48912 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
48913 + INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
48914 +#endif
48915 #ifdef CONFIG_USER_NS
48916 REG("uid_map", S_IRUGO|S_IWUSR, proc_uid_map_operations),
48917 REG("gid_map", S_IRUGO|S_IWUSR, proc_gid_map_operations),
48918 @@ -3225,7 +3369,14 @@ static struct dentry *proc_pid_instantiate(struct inode *dir,
48919 if (!inode)
48920 goto out;
48921
48922 +#ifdef CONFIG_GRKERNSEC_PROC_USER
48923 + inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
48924 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48925 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
48926 + inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
48927 +#else
48928 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
48929 +#endif
48930 inode->i_op = &proc_tgid_base_inode_operations;
48931 inode->i_fop = &proc_tgid_base_operations;
48932 inode->i_flags|=S_IMMUTABLE;
48933 @@ -3267,7 +3418,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
48934 if (!task)
48935 goto out;
48936
48937 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
48938 + goto out_put_task;
48939 +
48940 result = proc_pid_instantiate(dir, dentry, task, NULL);
48941 +out_put_task:
48942 put_task_struct(task);
48943 out:
48944 return result;
48945 @@ -3330,6 +3485,8 @@ static int proc_pid_fill_cache(struct file *filp, void *dirent, filldir_t filldi
48946 static int fake_filldir(void *buf, const char *name, int namelen,
48947 loff_t offset, u64 ino, unsigned d_type)
48948 {
48949 + struct getdents_callback * __buf = (struct getdents_callback *) buf;
48950 + __buf->error = -EINVAL;
48951 return 0;
48952 }
48953
48954 @@ -3396,7 +3553,7 @@ static const struct pid_entry tid_base_stuff[] = {
48955 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
48956 #endif
48957 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
48958 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
48959 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
48960 INF("syscall", S_IRUGO, proc_pid_syscall),
48961 #endif
48962 INF("cmdline", S_IRUGO, proc_pid_cmdline),
48963 @@ -3423,10 +3580,10 @@ static const struct pid_entry tid_base_stuff[] = {
48964 #ifdef CONFIG_SECURITY
48965 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
48966 #endif
48967 -#ifdef CONFIG_KALLSYMS
48968 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48969 INF("wchan", S_IRUGO, proc_pid_wchan),
48970 #endif
48971 -#ifdef CONFIG_STACKTRACE
48972 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
48973 ONE("stack", S_IRUGO, proc_pid_stack),
48974 #endif
48975 #ifdef CONFIG_SCHEDSTATS
48976 diff --git a/fs/proc/cmdline.c b/fs/proc/cmdline.c
48977 index 82676e3..5f8518a 100644
48978 --- a/fs/proc/cmdline.c
48979 +++ b/fs/proc/cmdline.c
48980 @@ -23,7 +23,11 @@ static const struct file_operations cmdline_proc_fops = {
48981
48982 static int __init proc_cmdline_init(void)
48983 {
48984 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
48985 + proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
48986 +#else
48987 proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
48988 +#endif
48989 return 0;
48990 }
48991 module_init(proc_cmdline_init);
48992 diff --git a/fs/proc/devices.c b/fs/proc/devices.c
48993 index b143471..bb105e5 100644
48994 --- a/fs/proc/devices.c
48995 +++ b/fs/proc/devices.c
48996 @@ -64,7 +64,11 @@ static const struct file_operations proc_devinfo_operations = {
48997
48998 static int __init proc_devices_init(void)
48999 {
49000 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
49001 + proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
49002 +#else
49003 proc_create("devices", 0, NULL, &proc_devinfo_operations);
49004 +#endif
49005 return 0;
49006 }
49007 module_init(proc_devices_init);
49008 diff --git a/fs/proc/inode.c b/fs/proc/inode.c
49009 index 7ac817b..abab1a5 100644
49010 --- a/fs/proc/inode.c
49011 +++ b/fs/proc/inode.c
49012 @@ -21,11 +21,17 @@
49013 #include <linux/seq_file.h>
49014 #include <linux/slab.h>
49015 #include <linux/mount.h>
49016 +#include <linux/grsecurity.h>
49017
49018 #include <asm/uaccess.h>
49019
49020 #include "internal.h"
49021
49022 +#ifdef CONFIG_PROC_SYSCTL
49023 +extern const struct inode_operations proc_sys_inode_operations;
49024 +extern const struct inode_operations proc_sys_dir_operations;
49025 +#endif
49026 +
49027 static void proc_evict_inode(struct inode *inode)
49028 {
49029 struct proc_dir_entry *de;
49030 @@ -51,6 +57,13 @@ static void proc_evict_inode(struct inode *inode)
49031 ns_ops = PROC_I(inode)->ns_ops;
49032 if (ns_ops && ns_ops->put)
49033 ns_ops->put(PROC_I(inode)->ns);
49034 +
49035 +#ifdef CONFIG_PROC_SYSCTL
49036 + if (inode->i_op == &proc_sys_inode_operations ||
49037 + inode->i_op == &proc_sys_dir_operations)
49038 + gr_handle_delete(inode->i_ino, inode->i_sb->s_dev);
49039 +#endif
49040 +
49041 }
49042
49043 static struct kmem_cache * proc_inode_cachep;
49044 @@ -456,7 +469,11 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
49045 if (de->mode) {
49046 inode->i_mode = de->mode;
49047 inode->i_uid = de->uid;
49048 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49049 + inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49050 +#else
49051 inode->i_gid = de->gid;
49052 +#endif
49053 }
49054 if (de->size)
49055 inode->i_size = de->size;
49056 diff --git a/fs/proc/internal.h b/fs/proc/internal.h
49057 index eca4aca..19166b2 100644
49058 --- a/fs/proc/internal.h
49059 +++ b/fs/proc/internal.h
49060 @@ -52,6 +52,9 @@ extern int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
49061 struct pid *pid, struct task_struct *task);
49062 extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
49063 struct pid *pid, struct task_struct *task);
49064 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
49065 +extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
49066 +#endif
49067 extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
49068
49069 extern const struct file_operations proc_tid_children_operations;
49070 diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
49071 index 86c67ee..cdca321 100644
49072 --- a/fs/proc/kcore.c
49073 +++ b/fs/proc/kcore.c
49074 @@ -480,9 +480,10 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
49075 * the addresses in the elf_phdr on our list.
49076 */
49077 start = kc_offset_to_vaddr(*fpos - elf_buflen);
49078 - if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
49079 + tsz = PAGE_SIZE - (start & ~PAGE_MASK);
49080 + if (tsz > buflen)
49081 tsz = buflen;
49082 -
49083 +
49084 while (buflen) {
49085 struct kcore_list *m;
49086
49087 @@ -511,20 +512,23 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
49088 kfree(elf_buf);
49089 } else {
49090 if (kern_addr_valid(start)) {
49091 - unsigned long n;
49092 + char *elf_buf;
49093 + mm_segment_t oldfs;
49094
49095 - n = copy_to_user(buffer, (char *)start, tsz);
49096 - /*
49097 - * We cannot distinguish between fault on source
49098 - * and fault on destination. When this happens
49099 - * we clear too and hope it will trigger the
49100 - * EFAULT again.
49101 - */
49102 - if (n) {
49103 - if (clear_user(buffer + tsz - n,
49104 - n))
49105 + elf_buf = kmalloc(tsz, GFP_KERNEL);
49106 + if (!elf_buf)
49107 + return -ENOMEM;
49108 + oldfs = get_fs();
49109 + set_fs(KERNEL_DS);
49110 + if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
49111 + set_fs(oldfs);
49112 + if (copy_to_user(buffer, elf_buf, tsz)) {
49113 + kfree(elf_buf);
49114 return -EFAULT;
49115 + }
49116 }
49117 + set_fs(oldfs);
49118 + kfree(elf_buf);
49119 } else {
49120 if (clear_user(buffer, tsz))
49121 return -EFAULT;
49122 @@ -544,6 +548,9 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
49123
49124 static int open_kcore(struct inode *inode, struct file *filp)
49125 {
49126 +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
49127 + return -EPERM;
49128 +#endif
49129 if (!capable(CAP_SYS_RAWIO))
49130 return -EPERM;
49131 if (kcore_need_update)
49132 diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
49133 index 80e4645..53e5fcf 100644
49134 --- a/fs/proc/meminfo.c
49135 +++ b/fs/proc/meminfo.c
49136 @@ -158,7 +158,7 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
49137 vmi.used >> 10,
49138 vmi.largest_chunk >> 10
49139 #ifdef CONFIG_MEMORY_FAILURE
49140 - ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
49141 + ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
49142 #endif
49143 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
49144 ,K(global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) *
49145 diff --git a/fs/proc/nommu.c b/fs/proc/nommu.c
49146 index b1822dd..df622cb 100644
49147 --- a/fs/proc/nommu.c
49148 +++ b/fs/proc/nommu.c
49149 @@ -66,7 +66,7 @@ static int nommu_region_show(struct seq_file *m, struct vm_region *region)
49150 if (len < 1)
49151 len = 1;
49152 seq_printf(m, "%*c", len, ' ');
49153 - seq_path(m, &file->f_path, "");
49154 + seq_path(m, &file->f_path, "\n\\");
49155 }
49156
49157 seq_putc(m, '\n');
49158 diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
49159 index 06e1cc1..177cd98 100644
49160 --- a/fs/proc/proc_net.c
49161 +++ b/fs/proc/proc_net.c
49162 @@ -105,6 +105,17 @@ static struct net *get_proc_task_net(struct inode *dir)
49163 struct task_struct *task;
49164 struct nsproxy *ns;
49165 struct net *net = NULL;
49166 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49167 + const struct cred *cred = current_cred();
49168 +#endif
49169 +
49170 +#ifdef CONFIG_GRKERNSEC_PROC_USER
49171 + if (cred->fsuid)
49172 + return net;
49173 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49174 + if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
49175 + return net;
49176 +#endif
49177
49178 rcu_read_lock();
49179 task = pid_task(proc_pid(dir), PIDTYPE_PID);
49180 diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
49181 index 3476bca..cb6d86a 100644
49182 --- a/fs/proc/proc_sysctl.c
49183 +++ b/fs/proc/proc_sysctl.c
49184 @@ -12,11 +12,15 @@
49185 #include <linux/module.h>
49186 #include "internal.h"
49187
49188 +extern int gr_handle_chroot_sysctl(const int op);
49189 +extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
49190 + const int op);
49191 +
49192 static const struct dentry_operations proc_sys_dentry_operations;
49193 static const struct file_operations proc_sys_file_operations;
49194 -static const struct inode_operations proc_sys_inode_operations;
49195 +const struct inode_operations proc_sys_inode_operations;
49196 static const struct file_operations proc_sys_dir_file_operations;
49197 -static const struct inode_operations proc_sys_dir_operations;
49198 +const struct inode_operations proc_sys_dir_operations;
49199
49200 void proc_sys_poll_notify(struct ctl_table_poll *poll)
49201 {
49202 @@ -470,8 +474,14 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
49203
49204 err = NULL;
49205 d_set_d_op(dentry, &proc_sys_dentry_operations);
49206 +
49207 + gr_handle_proc_create(dentry, inode);
49208 +
49209 d_add(dentry, inode);
49210
49211 + if (!gr_acl_handle_hidden_file(dentry, nd->path.mnt))
49212 + err = ERR_PTR(-ENOENT);
49213 +
49214 out:
49215 sysctl_head_finish(head);
49216 return err;
49217 @@ -483,18 +493,20 @@ static ssize_t proc_sys_call_handler(struct file *filp, void __user *buf,
49218 struct inode *inode = filp->f_path.dentry->d_inode;
49219 struct ctl_table_header *head = grab_header(inode);
49220 struct ctl_table *table = PROC_I(inode)->sysctl_entry;
49221 + int op = write ? MAY_WRITE : MAY_READ;
49222 ssize_t error;
49223 size_t res;
49224
49225 if (IS_ERR(head))
49226 return PTR_ERR(head);
49227
49228 +
49229 /*
49230 * At this point we know that the sysctl was not unregistered
49231 * and won't be until we finish.
49232 */
49233 error = -EPERM;
49234 - if (sysctl_perm(head->root, table, write ? MAY_WRITE : MAY_READ))
49235 + if (sysctl_perm(head->root, table, op))
49236 goto out;
49237
49238 /* if that can happen at all, it should be -EINVAL, not -EISDIR */
49239 @@ -502,6 +514,22 @@ static ssize_t proc_sys_call_handler(struct file *filp, void __user *buf,
49240 if (!table->proc_handler)
49241 goto out;
49242
49243 +#ifdef CONFIG_GRKERNSEC
49244 + error = -EPERM;
49245 + if (gr_handle_chroot_sysctl(op))
49246 + goto out;
49247 + dget(filp->f_path.dentry);
49248 + if (gr_handle_sysctl_mod(filp->f_path.dentry->d_parent->d_name.name, table->procname, op)) {
49249 + dput(filp->f_path.dentry);
49250 + goto out;
49251 + }
49252 + dput(filp->f_path.dentry);
49253 + if (!gr_acl_handle_open(filp->f_path.dentry, filp->f_path.mnt, op))
49254 + goto out;
49255 + if (write && !capable(CAP_SYS_ADMIN))
49256 + goto out;
49257 +#endif
49258 +
49259 /* careful: calling conventions are nasty here */
49260 res = count;
49261 error = table->proc_handler(table, write, buf, &res, ppos);
49262 @@ -599,6 +627,9 @@ static int proc_sys_fill_cache(struct file *filp, void *dirent,
49263 return -ENOMEM;
49264 } else {
49265 d_set_d_op(child, &proc_sys_dentry_operations);
49266 +
49267 + gr_handle_proc_create(child, inode);
49268 +
49269 d_add(child, inode);
49270 }
49271 } else {
49272 @@ -642,6 +673,9 @@ static int scan(struct ctl_table_header *head, ctl_table *table,
49273 if ((*pos)++ < file->f_pos)
49274 return 0;
49275
49276 + if (!gr_acl_handle_hidden_file(file->f_path.dentry, file->f_path.mnt))
49277 + return 0;
49278 +
49279 if (unlikely(S_ISLNK(table->mode)))
49280 res = proc_sys_link_fill_cache(file, dirent, filldir, head, table);
49281 else
49282 @@ -759,6 +793,9 @@ static int proc_sys_getattr(struct vfsmount *mnt, struct dentry *dentry, struct
49283 if (IS_ERR(head))
49284 return PTR_ERR(head);
49285
49286 + if (table && !gr_acl_handle_hidden_file(dentry, mnt))
49287 + return -ENOENT;
49288 +
49289 generic_fillattr(inode, stat);
49290 if (table)
49291 stat->mode = (stat->mode & S_IFMT) | table->mode;
49292 @@ -781,13 +818,13 @@ static const struct file_operations proc_sys_dir_file_operations = {
49293 .llseek = generic_file_llseek,
49294 };
49295
49296 -static const struct inode_operations proc_sys_inode_operations = {
49297 +const struct inode_operations proc_sys_inode_operations = {
49298 .permission = proc_sys_permission,
49299 .setattr = proc_sys_setattr,
49300 .getattr = proc_sys_getattr,
49301 };
49302
49303 -static const struct inode_operations proc_sys_dir_operations = {
49304 +const struct inode_operations proc_sys_dir_operations = {
49305 .lookup = proc_sys_lookup,
49306 .permission = proc_sys_permission,
49307 .setattr = proc_sys_setattr,
49308 diff --git a/fs/proc/root.c b/fs/proc/root.c
49309 index 7c30fce..b3d3aa2 100644
49310 --- a/fs/proc/root.c
49311 +++ b/fs/proc/root.c
49312 @@ -188,7 +188,15 @@ void __init proc_root_init(void)
49313 #ifdef CONFIG_PROC_DEVICETREE
49314 proc_device_tree_init();
49315 #endif
49316 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
49317 +#ifdef CONFIG_GRKERNSEC_PROC_USER
49318 + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
49319 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49320 + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
49321 +#endif
49322 +#else
49323 proc_mkdir("bus", NULL);
49324 +#endif
49325 proc_sys_init();
49326 }
49327
49328 diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
49329 index 4540b8f..1b9772f 100644
49330 --- a/fs/proc/task_mmu.c
49331 +++ b/fs/proc/task_mmu.c
49332 @@ -11,12 +11,19 @@
49333 #include <linux/rmap.h>
49334 #include <linux/swap.h>
49335 #include <linux/swapops.h>
49336 +#include <linux/grsecurity.h>
49337
49338 #include <asm/elf.h>
49339 #include <asm/uaccess.h>
49340 #include <asm/tlbflush.h>
49341 #include "internal.h"
49342
49343 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49344 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
49345 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
49346 + _mm->pax_flags & MF_PAX_SEGMEXEC))
49347 +#endif
49348 +
49349 void task_mem(struct seq_file *m, struct mm_struct *mm)
49350 {
49351 unsigned long data, text, lib, swap;
49352 @@ -52,8 +59,13 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
49353 "VmExe:\t%8lu kB\n"
49354 "VmLib:\t%8lu kB\n"
49355 "VmPTE:\t%8lu kB\n"
49356 - "VmSwap:\t%8lu kB\n",
49357 - hiwater_vm << (PAGE_SHIFT-10),
49358 + "VmSwap:\t%8lu kB\n"
49359 +
49360 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
49361 + "CsBase:\t%8lx\nCsLim:\t%8lx\n"
49362 +#endif
49363 +
49364 + ,hiwater_vm << (PAGE_SHIFT-10),
49365 (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
49366 mm->locked_vm << (PAGE_SHIFT-10),
49367 mm->pinned_vm << (PAGE_SHIFT-10),
49368 @@ -62,7 +74,19 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
49369 data << (PAGE_SHIFT-10),
49370 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
49371 (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10,
49372 - swap << (PAGE_SHIFT-10));
49373 + swap << (PAGE_SHIFT-10)
49374 +
49375 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
49376 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49377 + , PAX_RAND_FLAGS(mm) ? 0 : mm->context.user_cs_base
49378 + , PAX_RAND_FLAGS(mm) ? 0 : mm->context.user_cs_limit
49379 +#else
49380 + , mm->context.user_cs_base
49381 + , mm->context.user_cs_limit
49382 +#endif
49383 +#endif
49384 +
49385 + );
49386 }
49387
49388 unsigned long task_vsize(struct mm_struct *mm)
49389 @@ -231,13 +255,13 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
49390 pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
49391 }
49392
49393 - /* We don't show the stack guard page in /proc/maps */
49394 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49395 + start = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start;
49396 + end = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end;
49397 +#else
49398 start = vma->vm_start;
49399 - if (stack_guard_page_start(vma, start))
49400 - start += PAGE_SIZE;
49401 end = vma->vm_end;
49402 - if (stack_guard_page_end(vma, end))
49403 - end -= PAGE_SIZE;
49404 +#endif
49405
49406 seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
49407 start,
49408 @@ -246,7 +270,11 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
49409 flags & VM_WRITE ? 'w' : '-',
49410 flags & VM_EXEC ? 'x' : '-',
49411 flags & VM_MAYSHARE ? 's' : 'p',
49412 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49413 + PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
49414 +#else
49415 pgoff,
49416 +#endif
49417 MAJOR(dev), MINOR(dev), ino, &len);
49418
49419 /*
49420 @@ -255,7 +283,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
49421 */
49422 if (file) {
49423 pad_len_spaces(m, len);
49424 - seq_path(m, &file->f_path, "\n");
49425 + seq_path(m, &file->f_path, "\n\\");
49426 goto done;
49427 }
49428
49429 @@ -281,8 +309,9 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
49430 * Thread stack in /proc/PID/task/TID/maps or
49431 * the main process stack.
49432 */
49433 - if (!is_pid || (vma->vm_start <= mm->start_stack &&
49434 - vma->vm_end >= mm->start_stack)) {
49435 + if (!is_pid || (vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
49436 + (vma->vm_start <= mm->start_stack &&
49437 + vma->vm_end >= mm->start_stack)) {
49438 name = "[stack]";
49439 } else {
49440 /* Thread stack in /proc/PID/maps */
49441 @@ -306,6 +335,13 @@ static int show_map(struct seq_file *m, void *v, int is_pid)
49442 struct proc_maps_private *priv = m->private;
49443 struct task_struct *task = priv->task;
49444
49445 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49446 + if (current->exec_id != m->exec_id) {
49447 + gr_log_badprocpid("maps");
49448 + return 0;
49449 + }
49450 +#endif
49451 +
49452 show_map_vma(m, vma, is_pid);
49453
49454 if (m->count < m->size) /* vma is copied successfully */
49455 @@ -492,12 +528,23 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
49456 .private = &mss,
49457 };
49458
49459 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49460 + if (current->exec_id != m->exec_id) {
49461 + gr_log_badprocpid("smaps");
49462 + return 0;
49463 + }
49464 +#endif
49465 memset(&mss, 0, sizeof mss);
49466 - mss.vma = vma;
49467 - /* mmap_sem is held in m_start */
49468 - if (vma->vm_mm && !is_vm_hugetlb_page(vma))
49469 - walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
49470 -
49471 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49472 + if (!PAX_RAND_FLAGS(vma->vm_mm)) {
49473 +#endif
49474 + mss.vma = vma;
49475 + /* mmap_sem is held in m_start */
49476 + if (vma->vm_mm && !is_vm_hugetlb_page(vma))
49477 + walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
49478 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49479 + }
49480 +#endif
49481 show_map_vma(m, vma, is_pid);
49482
49483 seq_printf(m,
49484 @@ -515,7 +562,11 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
49485 "KernelPageSize: %8lu kB\n"
49486 "MMUPageSize: %8lu kB\n"
49487 "Locked: %8lu kB\n",
49488 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49489 + PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
49490 +#else
49491 (vma->vm_end - vma->vm_start) >> 10,
49492 +#endif
49493 mss.resident >> 10,
49494 (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
49495 mss.shared_clean >> 10,
49496 @@ -1164,6 +1215,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
49497 int n;
49498 char buffer[50];
49499
49500 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49501 + if (current->exec_id != m->exec_id) {
49502 + gr_log_badprocpid("numa_maps");
49503 + return 0;
49504 + }
49505 +#endif
49506 +
49507 if (!mm)
49508 return 0;
49509
49510 @@ -1181,11 +1239,15 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
49511 mpol_to_str(buffer, sizeof(buffer), pol, 0);
49512 mpol_cond_put(pol);
49513
49514 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49515 + seq_printf(m, "%08lx %s", PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : vma->vm_start, buffer);
49516 +#else
49517 seq_printf(m, "%08lx %s", vma->vm_start, buffer);
49518 +#endif
49519
49520 if (file) {
49521 seq_printf(m, " file=");
49522 - seq_path(m, &file->f_path, "\n\t= ");
49523 + seq_path(m, &file->f_path, "\n\t\\= ");
49524 } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
49525 seq_printf(m, " heap");
49526 } else {
49527 diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
49528 index 1ccfa53..0848f95 100644
49529 --- a/fs/proc/task_nommu.c
49530 +++ b/fs/proc/task_nommu.c
49531 @@ -51,7 +51,7 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
49532 else
49533 bytes += kobjsize(mm);
49534
49535 - if (current->fs && current->fs->users > 1)
49536 + if (current->fs && atomic_read(&current->fs->users) > 1)
49537 sbytes += kobjsize(current->fs);
49538 else
49539 bytes += kobjsize(current->fs);
49540 @@ -168,7 +168,7 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma,
49541
49542 if (file) {
49543 pad_len_spaces(m, len);
49544 - seq_path(m, &file->f_path, "");
49545 + seq_path(m, &file->f_path, "\n\\");
49546 } else if (mm) {
49547 pid_t tid = vm_is_stack(priv->task, vma, is_pid);
49548
49549 diff --git a/fs/quota/netlink.c b/fs/quota/netlink.c
49550 index d67908b..d13f6a6 100644
49551 --- a/fs/quota/netlink.c
49552 +++ b/fs/quota/netlink.c
49553 @@ -33,7 +33,7 @@ static struct genl_family quota_genl_family = {
49554 void quota_send_warning(short type, unsigned int id, dev_t dev,
49555 const char warntype)
49556 {
49557 - static atomic_t seq;
49558 + static atomic_unchecked_t seq;
49559 struct sk_buff *skb;
49560 void *msg_head;
49561 int ret;
49562 @@ -49,7 +49,7 @@ void quota_send_warning(short type, unsigned int id, dev_t dev,
49563 "VFS: Not enough memory to send quota warning.\n");
49564 return;
49565 }
49566 - msg_head = genlmsg_put(skb, 0, atomic_add_return(1, &seq),
49567 + msg_head = genlmsg_put(skb, 0, atomic_add_return_unchecked(1, &seq),
49568 &quota_genl_family, 0, QUOTA_NL_C_WARNING);
49569 if (!msg_head) {
49570 printk(KERN_ERR
49571 diff --git a/fs/readdir.c b/fs/readdir.c
49572 index 39e3370..20d446d 100644
49573 --- a/fs/readdir.c
49574 +++ b/fs/readdir.c
49575 @@ -17,6 +17,7 @@
49576 #include <linux/security.h>
49577 #include <linux/syscalls.h>
49578 #include <linux/unistd.h>
49579 +#include <linux/namei.h>
49580
49581 #include <asm/uaccess.h>
49582
49583 @@ -67,6 +68,7 @@ struct old_linux_dirent {
49584
49585 struct readdir_callback {
49586 struct old_linux_dirent __user * dirent;
49587 + struct file * file;
49588 int result;
49589 };
49590
49591 @@ -84,6 +86,10 @@ static int fillonedir(void * __buf, const char * name, int namlen, loff_t offset
49592 buf->result = -EOVERFLOW;
49593 return -EOVERFLOW;
49594 }
49595 +
49596 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
49597 + return 0;
49598 +
49599 buf->result++;
49600 dirent = buf->dirent;
49601 if (!access_ok(VERIFY_WRITE, dirent,
49602 @@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned int, fd,
49603
49604 buf.result = 0;
49605 buf.dirent = dirent;
49606 + buf.file = file;
49607
49608 error = vfs_readdir(file, fillonedir, &buf);
49609 if (buf.result)
49610 @@ -141,6 +148,7 @@ struct linux_dirent {
49611 struct getdents_callback {
49612 struct linux_dirent __user * current_dir;
49613 struct linux_dirent __user * previous;
49614 + struct file * file;
49615 int count;
49616 int error;
49617 };
49618 @@ -162,6 +170,10 @@ static int filldir(void * __buf, const char * name, int namlen, loff_t offset,
49619 buf->error = -EOVERFLOW;
49620 return -EOVERFLOW;
49621 }
49622 +
49623 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
49624 + return 0;
49625 +
49626 dirent = buf->previous;
49627 if (dirent) {
49628 if (__put_user(offset, &dirent->d_off))
49629 @@ -208,6 +220,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, fd,
49630 buf.previous = NULL;
49631 buf.count = count;
49632 buf.error = 0;
49633 + buf.file = file;
49634
49635 error = vfs_readdir(file, filldir, &buf);
49636 if (error >= 0)
49637 @@ -226,6 +239,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, fd,
49638 struct getdents_callback64 {
49639 struct linux_dirent64 __user * current_dir;
49640 struct linux_dirent64 __user * previous;
49641 + struct file *file;
49642 int count;
49643 int error;
49644 };
49645 @@ -241,6 +255,10 @@ static int filldir64(void * __buf, const char * name, int namlen, loff_t offset,
49646 buf->error = -EINVAL; /* only used if we fail.. */
49647 if (reclen > buf->count)
49648 return -EINVAL;
49649 +
49650 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
49651 + return 0;
49652 +
49653 dirent = buf->previous;
49654 if (dirent) {
49655 if (__put_user(offset, &dirent->d_off))
49656 @@ -287,6 +305,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd,
49657
49658 buf.current_dir = dirent;
49659 buf.previous = NULL;
49660 + buf.file = file;
49661 buf.count = count;
49662 buf.error = 0;
49663
49664 @@ -295,7 +314,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd,
49665 error = buf.error;
49666 lastdirent = buf.previous;
49667 if (lastdirent) {
49668 - typeof(lastdirent->d_off) d_off = file->f_pos;
49669 + typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos;
49670 if (__put_user(d_off, &lastdirent->d_off))
49671 error = -EFAULT;
49672 else
49673 diff --git a/fs/reiserfs/do_balan.c b/fs/reiserfs/do_balan.c
49674 index 2b7882b..1c5ef48 100644
49675 --- a/fs/reiserfs/do_balan.c
49676 +++ b/fs/reiserfs/do_balan.c
49677 @@ -2051,7 +2051,7 @@ void do_balance(struct tree_balance *tb, /* tree_balance structure */
49678 return;
49679 }
49680
49681 - atomic_inc(&(fs_generation(tb->tb_sb)));
49682 + atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
49683 do_balance_starts(tb);
49684
49685 /* balance leaf returns 0 except if combining L R and S into
49686 diff --git a/fs/reiserfs/procfs.c b/fs/reiserfs/procfs.c
49687 index 2c1ade6..8c59d8d 100644
49688 --- a/fs/reiserfs/procfs.c
49689 +++ b/fs/reiserfs/procfs.c
49690 @@ -112,7 +112,7 @@ static int show_super(struct seq_file *m, struct super_block *sb)
49691 "SMALL_TAILS " : "NO_TAILS ",
49692 replay_only(sb) ? "REPLAY_ONLY " : "",
49693 convert_reiserfs(sb) ? "CONV " : "",
49694 - atomic_read(&r->s_generation_counter),
49695 + atomic_read_unchecked(&r->s_generation_counter),
49696 SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
49697 SF(s_do_balance), SF(s_unneeded_left_neighbor),
49698 SF(s_good_search_by_key_reada), SF(s_bmaps),
49699 diff --git a/fs/reiserfs/reiserfs.h b/fs/reiserfs/reiserfs.h
49700 index 33215f5..c5d427a 100644
49701 --- a/fs/reiserfs/reiserfs.h
49702 +++ b/fs/reiserfs/reiserfs.h
49703 @@ -453,7 +453,7 @@ struct reiserfs_sb_info {
49704 /* Comment? -Hans */
49705 wait_queue_head_t s_wait;
49706 /* To be obsoleted soon by per buffer seals.. -Hans */
49707 - atomic_t s_generation_counter; // increased by one every time the
49708 + atomic_unchecked_t s_generation_counter; // increased by one every time the
49709 // tree gets re-balanced
49710 unsigned long s_properties; /* File system properties. Currently holds
49711 on-disk FS format */
49712 @@ -1978,7 +1978,7 @@ static inline loff_t max_reiserfs_offset(struct inode *inode)
49713 #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
49714
49715 #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
49716 -#define get_generation(s) atomic_read (&fs_generation(s))
49717 +#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
49718 #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
49719 #define __fs_changed(gen,s) (gen != get_generation (s))
49720 #define fs_changed(gen,s) \
49721 diff --git a/fs/select.c b/fs/select.c
49722 index db14c78..3aae1bd 100644
49723 --- a/fs/select.c
49724 +++ b/fs/select.c
49725 @@ -20,6 +20,7 @@
49726 #include <linux/export.h>
49727 #include <linux/slab.h>
49728 #include <linux/poll.h>
49729 +#include <linux/security.h>
49730 #include <linux/personality.h> /* for STICKY_TIMEOUTS */
49731 #include <linux/file.h>
49732 #include <linux/fdtable.h>
49733 @@ -831,6 +832,7 @@ int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
49734 struct poll_list *walk = head;
49735 unsigned long todo = nfds;
49736
49737 + gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
49738 if (nfds > rlimit(RLIMIT_NOFILE))
49739 return -EINVAL;
49740
49741 diff --git a/fs/seq_file.c b/fs/seq_file.c
49742 index 0cbd049..64e705c 100644
49743 --- a/fs/seq_file.c
49744 +++ b/fs/seq_file.c
49745 @@ -9,6 +9,7 @@
49746 #include <linux/export.h>
49747 #include <linux/seq_file.h>
49748 #include <linux/slab.h>
49749 +#include <linux/sched.h>
49750
49751 #include <asm/uaccess.h>
49752 #include <asm/page.h>
49753 @@ -56,6 +57,9 @@ int seq_open(struct file *file, const struct seq_operations *op)
49754 memset(p, 0, sizeof(*p));
49755 mutex_init(&p->lock);
49756 p->op = op;
49757 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49758 + p->exec_id = current->exec_id;
49759 +#endif
49760
49761 /*
49762 * Wrappers around seq_open(e.g. swaps_open) need to be
49763 @@ -92,7 +96,7 @@ static int traverse(struct seq_file *m, loff_t offset)
49764 return 0;
49765 }
49766 if (!m->buf) {
49767 - m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
49768 + m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL | GFP_USERCOPY);
49769 if (!m->buf)
49770 return -ENOMEM;
49771 }
49772 @@ -132,7 +136,7 @@ static int traverse(struct seq_file *m, loff_t offset)
49773 Eoverflow:
49774 m->op->stop(m, p);
49775 kfree(m->buf);
49776 - m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
49777 + m->buf = kmalloc(m->size <<= 1, GFP_KERNEL | GFP_USERCOPY);
49778 return !m->buf ? -ENOMEM : -EAGAIN;
49779 }
49780
49781 @@ -187,7 +191,7 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
49782
49783 /* grab buffer if we didn't have one */
49784 if (!m->buf) {
49785 - m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
49786 + m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL | GFP_USERCOPY);
49787 if (!m->buf)
49788 goto Enomem;
49789 }
49790 @@ -228,7 +232,7 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
49791 goto Fill;
49792 m->op->stop(m, p);
49793 kfree(m->buf);
49794 - m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
49795 + m->buf = kmalloc(m->size <<= 1, GFP_KERNEL | GFP_USERCOPY);
49796 if (!m->buf)
49797 goto Enomem;
49798 m->count = 0;
49799 @@ -567,7 +571,7 @@ static void single_stop(struct seq_file *p, void *v)
49800 int single_open(struct file *file, int (*show)(struct seq_file *, void *),
49801 void *data)
49802 {
49803 - struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL);
49804 + seq_operations_no_const *op = kmalloc(sizeof(*op), GFP_KERNEL);
49805 int res = -ENOMEM;
49806
49807 if (op) {
49808 diff --git a/fs/splice.c b/fs/splice.c
49809 index 7bf08fa..eb35c2f 100644
49810 --- a/fs/splice.c
49811 +++ b/fs/splice.c
49812 @@ -194,7 +194,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
49813 pipe_lock(pipe);
49814
49815 for (;;) {
49816 - if (!pipe->readers) {
49817 + if (!atomic_read(&pipe->readers)) {
49818 send_sig(SIGPIPE, current, 0);
49819 if (!ret)
49820 ret = -EPIPE;
49821 @@ -248,9 +248,9 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
49822 do_wakeup = 0;
49823 }
49824
49825 - pipe->waiting_writers++;
49826 + atomic_inc(&pipe->waiting_writers);
49827 pipe_wait(pipe);
49828 - pipe->waiting_writers--;
49829 + atomic_dec(&pipe->waiting_writers);
49830 }
49831
49832 pipe_unlock(pipe);
49833 @@ -563,7 +563,7 @@ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
49834 old_fs = get_fs();
49835 set_fs(get_ds());
49836 /* The cast to a user pointer is valid due to the set_fs() */
49837 - res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
49838 + res = vfs_readv(file, (const struct iovec __force_user *)vec, vlen, &pos);
49839 set_fs(old_fs);
49840
49841 return res;
49842 @@ -578,7 +578,7 @@ static ssize_t kernel_write(struct file *file, const char *buf, size_t count,
49843 old_fs = get_fs();
49844 set_fs(get_ds());
49845 /* The cast to a user pointer is valid due to the set_fs() */
49846 - res = vfs_write(file, (const char __user *)buf, count, &pos);
49847 + res = vfs_write(file, (const char __force_user *)buf, count, &pos);
49848 set_fs(old_fs);
49849
49850 return res;
49851 @@ -630,7 +630,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
49852 goto err;
49853
49854 this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
49855 - vec[i].iov_base = (void __user *) page_address(page);
49856 + vec[i].iov_base = (void __force_user *) page_address(page);
49857 vec[i].iov_len = this_len;
49858 spd.pages[i] = page;
49859 spd.nr_pages++;
49860 @@ -849,10 +849,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
49861 int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
49862 {
49863 while (!pipe->nrbufs) {
49864 - if (!pipe->writers)
49865 + if (!atomic_read(&pipe->writers))
49866 return 0;
49867
49868 - if (!pipe->waiting_writers && sd->num_spliced)
49869 + if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
49870 return 0;
49871
49872 if (sd->flags & SPLICE_F_NONBLOCK)
49873 @@ -1187,7 +1187,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
49874 * out of the pipe right after the splice_to_pipe(). So set
49875 * PIPE_READERS appropriately.
49876 */
49877 - pipe->readers = 1;
49878 + atomic_set(&pipe->readers, 1);
49879
49880 current->splice_pipe = pipe;
49881 }
49882 @@ -1740,9 +1740,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
49883 ret = -ERESTARTSYS;
49884 break;
49885 }
49886 - if (!pipe->writers)
49887 + if (!atomic_read(&pipe->writers))
49888 break;
49889 - if (!pipe->waiting_writers) {
49890 + if (!atomic_read(&pipe->waiting_writers)) {
49891 if (flags & SPLICE_F_NONBLOCK) {
49892 ret = -EAGAIN;
49893 break;
49894 @@ -1774,7 +1774,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
49895 pipe_lock(pipe);
49896
49897 while (pipe->nrbufs >= pipe->buffers) {
49898 - if (!pipe->readers) {
49899 + if (!atomic_read(&pipe->readers)) {
49900 send_sig(SIGPIPE, current, 0);
49901 ret = -EPIPE;
49902 break;
49903 @@ -1787,9 +1787,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
49904 ret = -ERESTARTSYS;
49905 break;
49906 }
49907 - pipe->waiting_writers++;
49908 + atomic_inc(&pipe->waiting_writers);
49909 pipe_wait(pipe);
49910 - pipe->waiting_writers--;
49911 + atomic_dec(&pipe->waiting_writers);
49912 }
49913
49914 pipe_unlock(pipe);
49915 @@ -1825,14 +1825,14 @@ retry:
49916 pipe_double_lock(ipipe, opipe);
49917
49918 do {
49919 - if (!opipe->readers) {
49920 + if (!atomic_read(&opipe->readers)) {
49921 send_sig(SIGPIPE, current, 0);
49922 if (!ret)
49923 ret = -EPIPE;
49924 break;
49925 }
49926
49927 - if (!ipipe->nrbufs && !ipipe->writers)
49928 + if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
49929 break;
49930
49931 /*
49932 @@ -1929,7 +1929,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
49933 pipe_double_lock(ipipe, opipe);
49934
49935 do {
49936 - if (!opipe->readers) {
49937 + if (!atomic_read(&opipe->readers)) {
49938 send_sig(SIGPIPE, current, 0);
49939 if (!ret)
49940 ret = -EPIPE;
49941 @@ -1974,7 +1974,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
49942 * return EAGAIN if we have the potential of some data in the
49943 * future, otherwise just return 0
49944 */
49945 - if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
49946 + if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
49947 ret = -EAGAIN;
49948
49949 pipe_unlock(ipipe);
49950 diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
49951 index e6bb9b2..d8e3951 100644
49952 --- a/fs/sysfs/dir.c
49953 +++ b/fs/sysfs/dir.c
49954 @@ -678,6 +678,18 @@ static int create_dir(struct kobject *kobj, struct sysfs_dirent *parent_sd,
49955 struct sysfs_dirent *sd;
49956 int rc;
49957
49958 +#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
49959 + const char *parent_name = parent_sd->s_name;
49960 +
49961 + mode = S_IFDIR | S_IRWXU;
49962 +
49963 + if ((!strcmp(parent_name, "") && (!strcmp(name, "devices") || !strcmp(name, "fs"))) ||
49964 + (!strcmp(parent_name, "devices") && !strcmp(name, "system")) ||
49965 + (!strcmp(parent_name, "fs") && (!strcmp(name, "selinux") || !strcmp(name, "fuse"))) ||
49966 + (!strcmp(parent_name, "system") && !strcmp(name, "cpu")))
49967 + mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
49968 +#endif
49969 +
49970 /* allocate */
49971 sd = sysfs_new_dirent(name, mode, SYSFS_DIR);
49972 if (!sd)
49973 diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
49974 index 00012e3..8392349 100644
49975 --- a/fs/sysfs/file.c
49976 +++ b/fs/sysfs/file.c
49977 @@ -37,7 +37,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent_lock);
49978
49979 struct sysfs_open_dirent {
49980 atomic_t refcnt;
49981 - atomic_t event;
49982 + atomic_unchecked_t event;
49983 wait_queue_head_t poll;
49984 struct list_head buffers; /* goes through sysfs_buffer.list */
49985 };
49986 @@ -81,7 +81,7 @@ static int fill_read_buffer(struct dentry * dentry, struct sysfs_buffer * buffer
49987 if (!sysfs_get_active(attr_sd))
49988 return -ENODEV;
49989
49990 - buffer->event = atomic_read(&attr_sd->s_attr.open->event);
49991 + buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
49992 count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
49993
49994 sysfs_put_active(attr_sd);
49995 @@ -287,7 +287,7 @@ static int sysfs_get_open_dirent(struct sysfs_dirent *sd,
49996 return -ENOMEM;
49997
49998 atomic_set(&new_od->refcnt, 0);
49999 - atomic_set(&new_od->event, 1);
50000 + atomic_set_unchecked(&new_od->event, 1);
50001 init_waitqueue_head(&new_od->poll);
50002 INIT_LIST_HEAD(&new_od->buffers);
50003 goto retry;
50004 @@ -432,7 +432,7 @@ static unsigned int sysfs_poll(struct file *filp, poll_table *wait)
50005
50006 sysfs_put_active(attr_sd);
50007
50008 - if (buffer->event != atomic_read(&od->event))
50009 + if (buffer->event != atomic_read_unchecked(&od->event))
50010 goto trigger;
50011
50012 return DEFAULT_POLLMASK;
50013 @@ -451,7 +451,7 @@ void sysfs_notify_dirent(struct sysfs_dirent *sd)
50014
50015 od = sd->s_attr.open;
50016 if (od) {
50017 - atomic_inc(&od->event);
50018 + atomic_inc_unchecked(&od->event);
50019 wake_up_interruptible(&od->poll);
50020 }
50021
50022 diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c
50023 index a7ac78f..02158e1 100644
50024 --- a/fs/sysfs/symlink.c
50025 +++ b/fs/sysfs/symlink.c
50026 @@ -286,7 +286,7 @@ static void *sysfs_follow_link(struct dentry *dentry, struct nameidata *nd)
50027
50028 static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
50029 {
50030 - char *page = nd_get_link(nd);
50031 + const char *page = nd_get_link(nd);
50032 if (!IS_ERR(page))
50033 free_page((unsigned long)page);
50034 }
50035 diff --git a/fs/udf/misc.c b/fs/udf/misc.c
50036 index c175b4d..8f36a16 100644
50037 --- a/fs/udf/misc.c
50038 +++ b/fs/udf/misc.c
50039 @@ -289,7 +289,7 @@ void udf_new_tag(char *data, uint16_t ident, uint16_t version, uint16_t snum,
50040
50041 u8 udf_tag_checksum(const struct tag *t)
50042 {
50043 - u8 *data = (u8 *)t;
50044 + const u8 *data = (const u8 *)t;
50045 u8 checksum = 0;
50046 int i;
50047 for (i = 0; i < sizeof(struct tag); ++i)
50048 diff --git a/fs/udf/namei.c b/fs/udf/namei.c
50049 index 1802417..c31deb3 100644
50050 --- a/fs/udf/namei.c
50051 +++ b/fs/udf/namei.c
50052 @@ -1279,6 +1279,7 @@ static int udf_encode_fh(struct inode *inode, __u32 *fh, int *lenp,
50053 *lenp = 3;
50054 fid->udf.block = location.logicalBlockNum;
50055 fid->udf.partref = location.partitionReferenceNum;
50056 + fid->udf.parent_partref = 0;
50057 fid->udf.generation = inode->i_generation;
50058
50059 if (parent) {
50060 diff --git a/fs/utimes.c b/fs/utimes.c
50061 index fa4dbe4..e12d1b9 100644
50062 --- a/fs/utimes.c
50063 +++ b/fs/utimes.c
50064 @@ -1,6 +1,7 @@
50065 #include <linux/compiler.h>
50066 #include <linux/file.h>
50067 #include <linux/fs.h>
50068 +#include <linux/security.h>
50069 #include <linux/linkage.h>
50070 #include <linux/mount.h>
50071 #include <linux/namei.h>
50072 @@ -101,6 +102,12 @@ static int utimes_common(struct path *path, struct timespec *times)
50073 goto mnt_drop_write_and_out;
50074 }
50075 }
50076 +
50077 + if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
50078 + error = -EACCES;
50079 + goto mnt_drop_write_and_out;
50080 + }
50081 +
50082 mutex_lock(&inode->i_mutex);
50083 error = notify_change(path->dentry, &newattrs);
50084 mutex_unlock(&inode->i_mutex);
50085 diff --git a/fs/xattr.c b/fs/xattr.c
50086 index 1d7ac37..23cb9ec 100644
50087 --- a/fs/xattr.c
50088 +++ b/fs/xattr.c
50089 @@ -316,7 +316,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
50090 * Extended attribute SET operations
50091 */
50092 static long
50093 -setxattr(struct dentry *d, const char __user *name, const void __user *value,
50094 +setxattr(struct path *path, const char __user *name, const void __user *value,
50095 size_t size, int flags)
50096 {
50097 int error;
50098 @@ -349,7 +349,12 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value,
50099 }
50100 }
50101
50102 - error = vfs_setxattr(d, kname, kvalue, size, flags);
50103 + if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
50104 + error = -EACCES;
50105 + goto out;
50106 + }
50107 +
50108 + error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
50109 out:
50110 if (vvalue)
50111 vfree(vvalue);
50112 @@ -370,7 +375,7 @@ SYSCALL_DEFINE5(setxattr, const char __user *, pathname,
50113 return error;
50114 error = mnt_want_write(path.mnt);
50115 if (!error) {
50116 - error = setxattr(path.dentry, name, value, size, flags);
50117 + error = setxattr(&path, name, value, size, flags);
50118 mnt_drop_write(path.mnt);
50119 }
50120 path_put(&path);
50121 @@ -389,7 +394,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __user *, pathname,
50122 return error;
50123 error = mnt_want_write(path.mnt);
50124 if (!error) {
50125 - error = setxattr(path.dentry, name, value, size, flags);
50126 + error = setxattr(&path, name, value, size, flags);
50127 mnt_drop_write(path.mnt);
50128 }
50129 path_put(&path);
50130 @@ -401,17 +406,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name,
50131 {
50132 int fput_needed;
50133 struct file *f;
50134 - struct dentry *dentry;
50135 int error = -EBADF;
50136
50137 f = fget_light(fd, &fput_needed);
50138 if (!f)
50139 return error;
50140 - dentry = f->f_path.dentry;
50141 - audit_inode(NULL, dentry);
50142 + audit_inode(NULL, f->f_path.dentry);
50143 error = mnt_want_write_file(f);
50144 if (!error) {
50145 - error = setxattr(dentry, name, value, size, flags);
50146 + error = setxattr(&f->f_path, name, value, size, flags);
50147 mnt_drop_write_file(f);
50148 }
50149 fput_light(f, fput_needed);
50150 diff --git a/fs/xattr_acl.c b/fs/xattr_acl.c
50151 index 69d06b0..c0996e5 100644
50152 --- a/fs/xattr_acl.c
50153 +++ b/fs/xattr_acl.c
50154 @@ -17,8 +17,8 @@
50155 struct posix_acl *
50156 posix_acl_from_xattr(const void *value, size_t size)
50157 {
50158 - posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
50159 - posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
50160 + const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
50161 + const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
50162 int count;
50163 struct posix_acl *acl;
50164 struct posix_acl_entry *acl_e;
50165 diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
50166 index 58b815e..595ddee 100644
50167 --- a/fs/xfs/xfs_bmap.c
50168 +++ b/fs/xfs/xfs_bmap.c
50169 @@ -189,7 +189,7 @@ xfs_bmap_validate_ret(
50170 int nmap,
50171 int ret_nmap);
50172 #else
50173 -#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
50174 +#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
50175 #endif /* DEBUG */
50176
50177 STATIC int
50178 diff --git a/fs/xfs/xfs_dir2_sf.c b/fs/xfs/xfs_dir2_sf.c
50179 index 19bf0c5..9f26b02 100644
50180 --- a/fs/xfs/xfs_dir2_sf.c
50181 +++ b/fs/xfs/xfs_dir2_sf.c
50182 @@ -851,7 +851,15 @@ xfs_dir2_sf_getdents(
50183 }
50184
50185 ino = xfs_dir2_sfe_get_ino(sfp, sfep);
50186 - if (filldir(dirent, (char *)sfep->name, sfep->namelen,
50187 + if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
50188 + char name[sfep->namelen];
50189 + memcpy(name, sfep->name, sfep->namelen);
50190 + if (filldir(dirent, name, sfep->namelen,
50191 + off & 0x7fffffff, ino, DT_UNKNOWN)) {
50192 + *offset = off & 0x7fffffff;
50193 + return 0;
50194 + }
50195 + } else if (filldir(dirent, (char *)sfep->name, sfep->namelen,
50196 off & 0x7fffffff, ino, DT_UNKNOWN)) {
50197 *offset = off & 0x7fffffff;
50198 return 0;
50199 diff --git a/fs/xfs/xfs_discard.c b/fs/xfs/xfs_discard.c
50200 index f9c3fe3..69cf4fc 100644
50201 --- a/fs/xfs/xfs_discard.c
50202 +++ b/fs/xfs/xfs_discard.c
50203 @@ -179,12 +179,14 @@ xfs_ioc_trim(
50204 * used by the fstrim application. In the end it really doesn't
50205 * matter as trimming blocks is an advisory interface.
50206 */
50207 + if (range.start >= XFS_FSB_TO_B(mp, mp->m_sb.sb_dblocks) ||
50208 + range.minlen > XFS_FSB_TO_B(mp, XFS_ALLOC_AG_MAX_USABLE(mp)))
50209 + return -XFS_ERROR(EINVAL);
50210 +
50211 start = BTOBB(range.start);
50212 end = start + BTOBBT(range.len) - 1;
50213 minlen = BTOBB(max_t(u64, granularity, range.minlen));
50214
50215 - if (XFS_BB_TO_FSB(mp, start) >= mp->m_sb.sb_dblocks)
50216 - return -XFS_ERROR(EINVAL);
50217 if (end > XFS_FSB_TO_BB(mp, mp->m_sb.sb_dblocks) - 1)
50218 end = XFS_FSB_TO_BB(mp, mp->m_sb.sb_dblocks)- 1;
50219
50220 diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
50221 index 3a05a41..320bec6 100644
50222 --- a/fs/xfs/xfs_ioctl.c
50223 +++ b/fs/xfs/xfs_ioctl.c
50224 @@ -126,7 +126,7 @@ xfs_find_handle(
50225 }
50226
50227 error = -EFAULT;
50228 - if (copy_to_user(hreq->ohandle, &handle, hsize) ||
50229 + if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
50230 copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
50231 goto out_put;
50232
50233 diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
50234 index 1a25fd8..e935581 100644
50235 --- a/fs/xfs/xfs_iops.c
50236 +++ b/fs/xfs/xfs_iops.c
50237 @@ -394,7 +394,7 @@ xfs_vn_put_link(
50238 struct nameidata *nd,
50239 void *p)
50240 {
50241 - char *s = nd_get_link(nd);
50242 + const char *s = nd_get_link(nd);
50243
50244 if (!IS_ERR(s))
50245 kfree(s);
50246 diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
50247 index 92d4331..ca28a4b 100644
50248 --- a/fs/xfs/xfs_rtalloc.c
50249 +++ b/fs/xfs/xfs_rtalloc.c
50250 @@ -857,7 +857,7 @@ xfs_rtbuf_get(
50251 xfs_buf_t *bp; /* block buffer, result */
50252 xfs_inode_t *ip; /* bitmap or summary inode */
50253 xfs_bmbt_irec_t map;
50254 - int nmap;
50255 + int nmap = 1;
50256 int error; /* error value */
50257
50258 ip = issum ? mp->m_rsumip : mp->m_rbmip;
50259 diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
50260 new file mode 100644
50261 index 0000000..4d533f1
50262 --- /dev/null
50263 +++ b/grsecurity/Kconfig
50264 @@ -0,0 +1,941 @@
50265 +#
50266 +# grecurity configuration
50267 +#
50268 +menu "Memory Protections"
50269 +depends on GRKERNSEC
50270 +
50271 +config GRKERNSEC_KMEM
50272 + bool "Deny reading/writing to /dev/kmem, /dev/mem, and /dev/port"
50273 + default y if GRKERNSEC_CONFIG_AUTO
50274 + select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
50275 + help
50276 + If you say Y here, /dev/kmem and /dev/mem won't be allowed to
50277 + be written to or read from to modify or leak the contents of the running
50278 + kernel. /dev/port will also not be allowed to be opened. If you have module
50279 + support disabled, enabling this will close up four ways that are
50280 + currently used to insert malicious code into the running kernel.
50281 + Even with all these features enabled, we still highly recommend that
50282 + you use the RBAC system, as it is still possible for an attacker to
50283 + modify the running kernel through privileged I/O granted by ioperm/iopl.
50284 + If you are not using XFree86, you may be able to stop this additional
50285 + case by enabling the 'Disable privileged I/O' option. Though nothing
50286 + legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
50287 + but only to video memory, which is the only writing we allow in this
50288 + case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
50289 + not be allowed to mprotect it with PROT_WRITE later.
50290 + It is highly recommended that you say Y here if you meet all the
50291 + conditions above.
50292 +
50293 +config GRKERNSEC_VM86
50294 + bool "Restrict VM86 mode"
50295 + default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER)
50296 + depends on X86_32
50297 +
50298 + help
50299 + If you say Y here, only processes with CAP_SYS_RAWIO will be able to
50300 + make use of a special execution mode on 32bit x86 processors called
50301 + Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
50302 + video cards and will still work with this option enabled. The purpose
50303 + of the option is to prevent exploitation of emulation errors in
50304 + virtualization of vm86 mode like the one discovered in VMWare in 2009.
50305 + Nearly all users should be able to enable this option.
50306 +
50307 +config GRKERNSEC_IO
50308 + bool "Disable privileged I/O"
50309 + default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER)
50310 + depends on X86
50311 + select RTC_CLASS
50312 + select RTC_INTF_DEV
50313 + select RTC_DRV_CMOS
50314 +
50315 + help
50316 + If you say Y here, all ioperm and iopl calls will return an error.
50317 + Ioperm and iopl can be used to modify the running kernel.
50318 + Unfortunately, some programs need this access to operate properly,
50319 + the most notable of which are XFree86 and hwclock. hwclock can be
50320 + remedied by having RTC support in the kernel, so real-time
50321 + clock support is enabled if this option is enabled, to ensure
50322 + that hwclock operates correctly. XFree86 still will not
50323 + operate correctly with this option enabled, so DO NOT CHOOSE Y
50324 + IF YOU USE XFree86. If you use XFree86 and you still want to
50325 + protect your kernel against modification, use the RBAC system.
50326 +
50327 +config GRKERNSEC_PROC_MEMMAP
50328 + bool "Harden ASLR against information leaks and entropy reduction"
50329 + default y if (GRKERNSEC_CONFIG_AUTO || PAX_NOEXEC || PAX_ASLR)
50330 + depends on PAX_NOEXEC || PAX_ASLR
50331 + help
50332 + If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
50333 + give no information about the addresses of its mappings if
50334 + PaX features that rely on random addresses are enabled on the task.
50335 + In addition to sanitizing this information and disabling other
50336 + dangerous sources of information, this option causes reads of sensitive
50337 + /proc/<pid> entries where the file descriptor was opened in a different
50338 + task than the one performing the read. Such attempts are logged.
50339 + This option also limits argv/env strings for suid/sgid binaries
50340 + to 512KB to prevent a complete exhaustion of the stack entropy provided
50341 + by ASLR. Finally, it places an 8MB stack resource limit on suid/sgid
50342 + binaries to prevent alternative mmap layouts from being abused.
50343 +
50344 + If you use PaX it is essential that you say Y here as it closes up
50345 + several holes that make full ASLR useless locally.
50346 +
50347 +config GRKERNSEC_BRUTE
50348 + bool "Deter exploit bruteforcing"
50349 + default y if GRKERNSEC_CONFIG_AUTO
50350 + help
50351 + If you say Y here, attempts to bruteforce exploits against forking
50352 + daemons such as apache or sshd, as well as against suid/sgid binaries
50353 + will be deterred. When a child of a forking daemon is killed by PaX
50354 + or crashes due to an illegal instruction or other suspicious signal,
50355 + the parent process will be delayed 30 seconds upon every subsequent
50356 + fork until the administrator is able to assess the situation and
50357 + restart the daemon.
50358 + In the suid/sgid case, the attempt is logged, the user has all their
50359 + processes terminated, and they are prevented from executing any further
50360 + processes for 15 minutes.
50361 + It is recommended that you also enable signal logging in the auditing
50362 + section so that logs are generated when a process triggers a suspicious
50363 + signal.
50364 + If the sysctl option is enabled, a sysctl option with name
50365 + "deter_bruteforce" is created.
50366 +
50367 +
50368 +config GRKERNSEC_MODHARDEN
50369 + bool "Harden module auto-loading"
50370 + default y if GRKERNSEC_CONFIG_AUTO
50371 + depends on MODULES
50372 + help
50373 + If you say Y here, module auto-loading in response to use of some
50374 + feature implemented by an unloaded module will be restricted to
50375 + root users. Enabling this option helps defend against attacks
50376 + by unprivileged users who abuse the auto-loading behavior to
50377 + cause a vulnerable module to load that is then exploited.
50378 +
50379 + If this option prevents a legitimate use of auto-loading for a
50380 + non-root user, the administrator can execute modprobe manually
50381 + with the exact name of the module mentioned in the alert log.
50382 + Alternatively, the administrator can add the module to the list
50383 + of modules loaded at boot by modifying init scripts.
50384 +
50385 + Modification of init scripts will most likely be needed on
50386 + Ubuntu servers with encrypted home directory support enabled,
50387 + as the first non-root user logging in will cause the ecb(aes),
50388 + ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
50389 +
50390 +config GRKERNSEC_HIDESYM
50391 + bool "Hide kernel symbols"
50392 + default y if GRKERNSEC_CONFIG_AUTO
50393 + select PAX_USERCOPY_SLABS
50394 + help
50395 + If you say Y here, getting information on loaded modules, and
50396 + displaying all kernel symbols through a syscall will be restricted
50397 + to users with CAP_SYS_MODULE. For software compatibility reasons,
50398 + /proc/kallsyms will be restricted to the root user. The RBAC
50399 + system can hide that entry even from root.
50400 +
50401 + This option also prevents leaking of kernel addresses through
50402 + several /proc entries.
50403 +
50404 + Note that this option is only effective provided the following
50405 + conditions are met:
50406 + 1) The kernel using grsecurity is not precompiled by some distribution
50407 + 2) You have also enabled GRKERNSEC_DMESG
50408 + 3) You are using the RBAC system and hiding other files such as your
50409 + kernel image and System.map. Alternatively, enabling this option
50410 + causes the permissions on /boot, /lib/modules, and the kernel
50411 + source directory to change at compile time to prevent
50412 + reading by non-root users.
50413 + If the above conditions are met, this option will aid in providing a
50414 + useful protection against local kernel exploitation of overflows
50415 + and arbitrary read/write vulnerabilities.
50416 +
50417 +config GRKERNSEC_KERN_LOCKOUT
50418 + bool "Active kernel exploit response"
50419 + default y if GRKERNSEC_CONFIG_AUTO
50420 + depends on X86 || ARM || PPC || SPARC
50421 + help
50422 + If you say Y here, when a PaX alert is triggered due to suspicious
50423 + activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
50424 + or an OOPS occurs due to bad memory accesses, instead of just
50425 + terminating the offending process (and potentially allowing
50426 + a subsequent exploit from the same user), we will take one of two
50427 + actions:
50428 + If the user was root, we will panic the system
50429 + If the user was non-root, we will log the attempt, terminate
50430 + all processes owned by the user, then prevent them from creating
50431 + any new processes until the system is restarted
50432 + This deters repeated kernel exploitation/bruteforcing attempts
50433 + and is useful for later forensics.
50434 +
50435 +endmenu
50436 +menu "Role Based Access Control Options"
50437 +depends on GRKERNSEC
50438 +
50439 +config GRKERNSEC_RBAC_DEBUG
50440 + bool
50441 +
50442 +config GRKERNSEC_NO_RBAC
50443 + bool "Disable RBAC system"
50444 + help
50445 + If you say Y here, the /dev/grsec device will be removed from the kernel,
50446 + preventing the RBAC system from being enabled. You should only say Y
50447 + here if you have no intention of using the RBAC system, so as to prevent
50448 + an attacker with root access from misusing the RBAC system to hide files
50449 + and processes when loadable module support and /dev/[k]mem have been
50450 + locked down.
50451 +
50452 +config GRKERNSEC_ACL_HIDEKERN
50453 + bool "Hide kernel processes"
50454 + help
50455 + If you say Y here, all kernel threads will be hidden to all
50456 + processes but those whose subject has the "view hidden processes"
50457 + flag.
50458 +
50459 +config GRKERNSEC_ACL_MAXTRIES
50460 + int "Maximum tries before password lockout"
50461 + default 3
50462 + help
50463 + This option enforces the maximum number of times a user can attempt
50464 + to authorize themselves with the grsecurity RBAC system before being
50465 + denied the ability to attempt authorization again for a specified time.
50466 + The lower the number, the harder it will be to brute-force a password.
50467 +
50468 +config GRKERNSEC_ACL_TIMEOUT
50469 + int "Time to wait after max password tries, in seconds"
50470 + default 30
50471 + help
50472 + This option specifies the time the user must wait after attempting to
50473 + authorize to the RBAC system with the maximum number of invalid
50474 + passwords. The higher the number, the harder it will be to brute-force
50475 + a password.
50476 +
50477 +endmenu
50478 +menu "Filesystem Protections"
50479 +depends on GRKERNSEC
50480 +
50481 +config GRKERNSEC_PROC
50482 + bool "Proc restrictions"
50483 + default y if GRKERNSEC_CONFIG_AUTO
50484 + help
50485 + If you say Y here, the permissions of the /proc filesystem
50486 + will be altered to enhance system security and privacy. You MUST
50487 + choose either a user only restriction or a user and group restriction.
50488 + Depending upon the option you choose, you can either restrict users to
50489 + see only the processes they themselves run, or choose a group that can
50490 + view all processes and files normally restricted to root if you choose
50491 + the "restrict to user only" option. NOTE: If you're running identd or
50492 + ntpd as a non-root user, you will have to run it as the group you
50493 + specify here.
50494 +
50495 +config GRKERNSEC_PROC_USER
50496 + bool "Restrict /proc to user only"
50497 + depends on GRKERNSEC_PROC
50498 + help
50499 + If you say Y here, non-root users will only be able to view their own
50500 + processes, and restricts them from viewing network-related information,
50501 + and viewing kernel symbol and module information.
50502 +
50503 +config GRKERNSEC_PROC_USERGROUP
50504 + bool "Allow special group"
50505 + default y if GRKERNSEC_CONFIG_AUTO
50506 + depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
50507 + help
50508 + If you say Y here, you will be able to select a group that will be
50509 + able to view all processes and network-related information. If you've
50510 + enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
50511 + remain hidden. This option is useful if you want to run identd as
50512 + a non-root user.
50513 +
50514 +config GRKERNSEC_PROC_GID
50515 + int "GID for special group"
50516 + depends on GRKERNSEC_PROC_USERGROUP
50517 + default 1001
50518 +
50519 +config GRKERNSEC_PROC_ADD
50520 + bool "Additional restrictions"
50521 + default y if GRKERNSEC_CONFIG_AUTO
50522 + depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
50523 + help
50524 + If you say Y here, additional restrictions will be placed on
50525 + /proc that keep normal users from viewing device information and
50526 + slabinfo information that could be useful for exploits.
50527 +
50528 +config GRKERNSEC_LINK
50529 + bool "Linking restrictions"
50530 + default y if GRKERNSEC_CONFIG_AUTO
50531 + help
50532 + If you say Y here, /tmp race exploits will be prevented, since users
50533 + will no longer be able to follow symlinks owned by other users in
50534 + world-writable +t directories (e.g. /tmp), unless the owner of the
50535 + symlink is the owner of the directory. users will also not be
50536 + able to hardlink to files they do not own. If the sysctl option is
50537 + enabled, a sysctl option with name "linking_restrictions" is created.
50538 +
50539 +config GRKERNSEC_SYMLINKOWN
50540 + bool "Kernel-enforced SymlinksIfOwnerMatch"
50541 + default y if GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER
50542 + help
50543 + Apache's SymlinksIfOwnerMatch option has an inherent race condition
50544 + that prevents it from being used as a security feature. As Apache
50545 + verifies the symlink by performing a stat() against the target of
50546 + the symlink before it is followed, an attacker can setup a symlink
50547 + to point to a same-owned file, then replace the symlink with one
50548 + that targets another user's file just after Apache "validates" the
50549 + symlink -- a classic TOCTOU race. If you say Y here, a complete,
50550 + race-free replacement for Apache's "SymlinksIfOwnerMatch" option
50551 + will be in place for the group you specify. If the sysctl option
50552 + is enabled, a sysctl option with name "enforce_symlinksifowner" is
50553 + created.
50554 +
50555 +config GRKERNSEC_SYMLINKOWN_GID
50556 + int "GID for users with kernel-enforced SymlinksIfOwnerMatch"
50557 + depends on GRKERNSEC_SYMLINKOWN
50558 + default 1006
50559 + help
50560 + Setting this GID determines what group kernel-enforced
50561 + SymlinksIfOwnerMatch will be enabled for. If the sysctl option
50562 + is enabled, a sysctl option with name "symlinkown_gid" is created.
50563 +
50564 +config GRKERNSEC_FIFO
50565 + bool "FIFO restrictions"
50566 + default y if GRKERNSEC_CONFIG_AUTO
50567 + help
50568 + If you say Y here, users will not be able to write to FIFOs they don't
50569 + own in world-writable +t directories (e.g. /tmp), unless the owner of
50570 + the FIFO is the same owner of the directory it's held in. If the sysctl
50571 + option is enabled, a sysctl option with name "fifo_restrictions" is
50572 + created.
50573 +
50574 +config GRKERNSEC_SYSFS_RESTRICT
50575 + bool "Sysfs/debugfs restriction"
50576 + default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER)
50577 + depends on SYSFS
50578 + help
50579 + If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
50580 + any filesystem normally mounted under it (e.g. debugfs) will be
50581 + mostly accessible only by root. These filesystems generally provide access
50582 + to hardware and debug information that isn't appropriate for unprivileged
50583 + users of the system. Sysfs and debugfs have also become a large source
50584 + of new vulnerabilities, ranging from infoleaks to local compromise.
50585 + There has been very little oversight with an eye toward security involved
50586 + in adding new exporters of information to these filesystems, so their
50587 + use is discouraged.
50588 + For reasons of compatibility, a few directories have been whitelisted
50589 + for access by non-root users:
50590 + /sys/fs/selinux
50591 + /sys/fs/fuse
50592 + /sys/devices/system/cpu
50593 +
50594 +config GRKERNSEC_ROFS
50595 + bool "Runtime read-only mount protection"
50596 + help
50597 + If you say Y here, a sysctl option with name "romount_protect" will
50598 + be created. By setting this option to 1 at runtime, filesystems
50599 + will be protected in the following ways:
50600 + * No new writable mounts will be allowed
50601 + * Existing read-only mounts won't be able to be remounted read/write
50602 + * Write operations will be denied on all block devices
50603 + This option acts independently of grsec_lock: once it is set to 1,
50604 + it cannot be turned off. Therefore, please be mindful of the resulting
50605 + behavior if this option is enabled in an init script on a read-only
50606 + filesystem. This feature is mainly intended for secure embedded systems.
50607 +
50608 +config GRKERNSEC_CHROOT
50609 + bool "Chroot jail restrictions"
50610 + default y if GRKERNSEC_CONFIG_AUTO
50611 + help
50612 + If you say Y here, you will be able to choose several options that will
50613 + make breaking out of a chrooted jail much more difficult. If you
50614 + encounter no software incompatibilities with the following options, it
50615 + is recommended that you enable each one.
50616 +
50617 +config GRKERNSEC_CHROOT_MOUNT
50618 + bool "Deny mounts"
50619 + default y if GRKERNSEC_CONFIG_AUTO
50620 + depends on GRKERNSEC_CHROOT
50621 + help
50622 + If you say Y here, processes inside a chroot will not be able to
50623 + mount or remount filesystems. If the sysctl option is enabled, a
50624 + sysctl option with name "chroot_deny_mount" is created.
50625 +
50626 +config GRKERNSEC_CHROOT_DOUBLE
50627 + bool "Deny double-chroots"
50628 + default y if GRKERNSEC_CONFIG_AUTO
50629 + depends on GRKERNSEC_CHROOT
50630 + help
50631 + If you say Y here, processes inside a chroot will not be able to chroot
50632 + again outside the chroot. This is a widely used method of breaking
50633 + out of a chroot jail and should not be allowed. If the sysctl
50634 + option is enabled, a sysctl option with name
50635 + "chroot_deny_chroot" is created.
50636 +
50637 +config GRKERNSEC_CHROOT_PIVOT
50638 + bool "Deny pivot_root in chroot"
50639 + default y if GRKERNSEC_CONFIG_AUTO
50640 + depends on GRKERNSEC_CHROOT
50641 + help
50642 + If you say Y here, processes inside a chroot will not be able to use
50643 + a function called pivot_root() that was introduced in Linux 2.3.41. It
50644 + works similar to chroot in that it changes the root filesystem. This
50645 + function could be misused in a chrooted process to attempt to break out
50646 + of the chroot, and therefore should not be allowed. If the sysctl
50647 + option is enabled, a sysctl option with name "chroot_deny_pivot" is
50648 + created.
50649 +
50650 +config GRKERNSEC_CHROOT_CHDIR
50651 + bool "Enforce chdir(\"/\") on all chroots"
50652 + default y if GRKERNSEC_CONFIG_AUTO
50653 + depends on GRKERNSEC_CHROOT
50654 + help
50655 + If you say Y here, the current working directory of all newly-chrooted
50656 + applications will be set to the the root directory of the chroot.
50657 + The man page on chroot(2) states:
50658 + Note that this call does not change the current working
50659 + directory, so that `.' can be outside the tree rooted at
50660 + `/'. In particular, the super-user can escape from a
50661 + `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
50662 +
50663 + It is recommended that you say Y here, since it's not known to break
50664 + any software. If the sysctl option is enabled, a sysctl option with
50665 + name "chroot_enforce_chdir" is created.
50666 +
50667 +config GRKERNSEC_CHROOT_CHMOD
50668 + bool "Deny (f)chmod +s"
50669 + default y if GRKERNSEC_CONFIG_AUTO
50670 + depends on GRKERNSEC_CHROOT
50671 + help
50672 + If you say Y here, processes inside a chroot will not be able to chmod
50673 + or fchmod files to make them have suid or sgid bits. This protects
50674 + against another published method of breaking a chroot. If the sysctl
50675 + option is enabled, a sysctl option with name "chroot_deny_chmod" is
50676 + created.
50677 +
50678 +config GRKERNSEC_CHROOT_FCHDIR
50679 + bool "Deny fchdir out of chroot"
50680 + default y if GRKERNSEC_CONFIG_AUTO
50681 + depends on GRKERNSEC_CHROOT
50682 + help
50683 + If you say Y here, a well-known method of breaking chroots by fchdir'ing
50684 + to a file descriptor of the chrooting process that points to a directory
50685 + outside the filesystem will be stopped. If the sysctl option
50686 + is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
50687 +
50688 +config GRKERNSEC_CHROOT_MKNOD
50689 + bool "Deny mknod"
50690 + default y if GRKERNSEC_CONFIG_AUTO
50691 + depends on GRKERNSEC_CHROOT
50692 + help
50693 + If you say Y here, processes inside a chroot will not be allowed to
50694 + mknod. The problem with using mknod inside a chroot is that it
50695 + would allow an attacker to create a device entry that is the same
50696 + as one on the physical root of your system, which could range from
50697 + anything from the console device to a device for your harddrive (which
50698 + they could then use to wipe the drive or steal data). It is recommended
50699 + that you say Y here, unless you run into software incompatibilities.
50700 + If the sysctl option is enabled, a sysctl option with name
50701 + "chroot_deny_mknod" is created.
50702 +
50703 +config GRKERNSEC_CHROOT_SHMAT
50704 + bool "Deny shmat() out of chroot"
50705 + default y if GRKERNSEC_CONFIG_AUTO
50706 + depends on GRKERNSEC_CHROOT
50707 + help
50708 + If you say Y here, processes inside a chroot will not be able to attach
50709 + to shared memory segments that were created outside of the chroot jail.
50710 + It is recommended that you say Y here. If the sysctl option is enabled,
50711 + a sysctl option with name "chroot_deny_shmat" is created.
50712 +
50713 +config GRKERNSEC_CHROOT_UNIX
50714 + bool "Deny access to abstract AF_UNIX sockets out of chroot"
50715 + default y if GRKERNSEC_CONFIG_AUTO
50716 + depends on GRKERNSEC_CHROOT
50717 + help
50718 + If you say Y here, processes inside a chroot will not be able to
50719 + connect to abstract (meaning not belonging to a filesystem) Unix
50720 + domain sockets that were bound outside of a chroot. It is recommended
50721 + that you say Y here. If the sysctl option is enabled, a sysctl option
50722 + with name "chroot_deny_unix" is created.
50723 +
50724 +config GRKERNSEC_CHROOT_FINDTASK
50725 + bool "Protect outside processes"
50726 + default y if GRKERNSEC_CONFIG_AUTO
50727 + depends on GRKERNSEC_CHROOT
50728 + help
50729 + If you say Y here, processes inside a chroot will not be able to
50730 + kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
50731 + getsid, or view any process outside of the chroot. If the sysctl
50732 + option is enabled, a sysctl option with name "chroot_findtask" is
50733 + created.
50734 +
50735 +config GRKERNSEC_CHROOT_NICE
50736 + bool "Restrict priority changes"
50737 + default y if GRKERNSEC_CONFIG_AUTO
50738 + depends on GRKERNSEC_CHROOT
50739 + help
50740 + If you say Y here, processes inside a chroot will not be able to raise
50741 + the priority of processes in the chroot, or alter the priority of
50742 + processes outside the chroot. This provides more security than simply
50743 + removing CAP_SYS_NICE from the process' capability set. If the
50744 + sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
50745 + is created.
50746 +
50747 +config GRKERNSEC_CHROOT_SYSCTL
50748 + bool "Deny sysctl writes"
50749 + default y if GRKERNSEC_CONFIG_AUTO
50750 + depends on GRKERNSEC_CHROOT
50751 + help
50752 + If you say Y here, an attacker in a chroot will not be able to
50753 + write to sysctl entries, either by sysctl(2) or through a /proc
50754 + interface. It is strongly recommended that you say Y here. If the
50755 + sysctl option is enabled, a sysctl option with name
50756 + "chroot_deny_sysctl" is created.
50757 +
50758 +config GRKERNSEC_CHROOT_CAPS
50759 + bool "Capability restrictions"
50760 + default y if GRKERNSEC_CONFIG_AUTO
50761 + depends on GRKERNSEC_CHROOT
50762 + help
50763 + If you say Y here, the capabilities on all processes within a
50764 + chroot jail will be lowered to stop module insertion, raw i/o,
50765 + system and net admin tasks, rebooting the system, modifying immutable
50766 + files, modifying IPC owned by another, and changing the system time.
50767 + This is left an option because it can break some apps. Disable this
50768 + if your chrooted apps are having problems performing those kinds of
50769 + tasks. If the sysctl option is enabled, a sysctl option with
50770 + name "chroot_caps" is created.
50771 +
50772 +endmenu
50773 +menu "Kernel Auditing"
50774 +depends on GRKERNSEC
50775 +
50776 +config GRKERNSEC_AUDIT_GROUP
50777 + bool "Single group for auditing"
50778 + help
50779 + If you say Y here, the exec, chdir, and (un)mount logging features
50780 + will only operate on a group you specify. This option is recommended
50781 + if you only want to watch certain users instead of having a large
50782 + amount of logs from the entire system. If the sysctl option is enabled,
50783 + a sysctl option with name "audit_group" is created.
50784 +
50785 +config GRKERNSEC_AUDIT_GID
50786 + int "GID for auditing"
50787 + depends on GRKERNSEC_AUDIT_GROUP
50788 + default 1007
50789 +
50790 +config GRKERNSEC_EXECLOG
50791 + bool "Exec logging"
50792 + help
50793 + If you say Y here, all execve() calls will be logged (since the
50794 + other exec*() calls are frontends to execve(), all execution
50795 + will be logged). Useful for shell-servers that like to keep track
50796 + of their users. If the sysctl option is enabled, a sysctl option with
50797 + name "exec_logging" is created.
50798 + WARNING: This option when enabled will produce a LOT of logs, especially
50799 + on an active system.
50800 +
50801 +config GRKERNSEC_RESLOG
50802 + bool "Resource logging"
50803 + default y if GRKERNSEC_CONFIG_AUTO
50804 + help
50805 + If you say Y here, all attempts to overstep resource limits will
50806 + be logged with the resource name, the requested size, and the current
50807 + limit. It is highly recommended that you say Y here. If the sysctl
50808 + option is enabled, a sysctl option with name "resource_logging" is
50809 + created. If the RBAC system is enabled, the sysctl value is ignored.
50810 +
50811 +config GRKERNSEC_CHROOT_EXECLOG
50812 + bool "Log execs within chroot"
50813 + help
50814 + If you say Y here, all executions inside a chroot jail will be logged
50815 + to syslog. This can cause a large amount of logs if certain
50816 + applications (eg. djb's daemontools) are installed on the system, and
50817 + is therefore left as an option. If the sysctl option is enabled, a
50818 + sysctl option with name "chroot_execlog" is created.
50819 +
50820 +config GRKERNSEC_AUDIT_PTRACE
50821 + bool "Ptrace logging"
50822 + help
50823 + If you say Y here, all attempts to attach to a process via ptrace
50824 + will be logged. If the sysctl option is enabled, a sysctl option
50825 + with name "audit_ptrace" is created.
50826 +
50827 +config GRKERNSEC_AUDIT_CHDIR
50828 + bool "Chdir logging"
50829 + help
50830 + If you say Y here, all chdir() calls will be logged. If the sysctl
50831 + option is enabled, a sysctl option with name "audit_chdir" is created.
50832 +
50833 +config GRKERNSEC_AUDIT_MOUNT
50834 + bool "(Un)Mount logging"
50835 + help
50836 + If you say Y here, all mounts and unmounts will be logged. If the
50837 + sysctl option is enabled, a sysctl option with name "audit_mount" is
50838 + created.
50839 +
50840 +config GRKERNSEC_SIGNAL
50841 + bool "Signal logging"
50842 + default y if GRKERNSEC_CONFIG_AUTO
50843 + help
50844 + If you say Y here, certain important signals will be logged, such as
50845 + SIGSEGV, which will as a result inform you of when a error in a program
50846 + occurred, which in some cases could mean a possible exploit attempt.
50847 + If the sysctl option is enabled, a sysctl option with name
50848 + "signal_logging" is created.
50849 +
50850 +config GRKERNSEC_FORKFAIL
50851 + bool "Fork failure logging"
50852 + help
50853 + If you say Y here, all failed fork() attempts will be logged.
50854 + This could suggest a fork bomb, or someone attempting to overstep
50855 + their process limit. If the sysctl option is enabled, a sysctl option
50856 + with name "forkfail_logging" is created.
50857 +
50858 +config GRKERNSEC_TIME
50859 + bool "Time change logging"
50860 + default y if GRKERNSEC_CONFIG_AUTO
50861 + help
50862 + If you say Y here, any changes of the system clock will be logged.
50863 + If the sysctl option is enabled, a sysctl option with name
50864 + "timechange_logging" is created.
50865 +
50866 +config GRKERNSEC_PROC_IPADDR
50867 + bool "/proc/<pid>/ipaddr support"
50868 + default y if GRKERNSEC_CONFIG_AUTO
50869 + help
50870 + If you say Y here, a new entry will be added to each /proc/<pid>
50871 + directory that contains the IP address of the person using the task.
50872 + The IP is carried across local TCP and AF_UNIX stream sockets.
50873 + This information can be useful for IDS/IPSes to perform remote response
50874 + to a local attack. The entry is readable by only the owner of the
50875 + process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
50876 + the RBAC system), and thus does not create privacy concerns.
50877 +
50878 +config GRKERNSEC_RWXMAP_LOG
50879 + bool 'Denied RWX mmap/mprotect logging'
50880 + default y if GRKERNSEC_CONFIG_AUTO
50881 + depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
50882 + help
50883 + If you say Y here, calls to mmap() and mprotect() with explicit
50884 + usage of PROT_WRITE and PROT_EXEC together will be logged when
50885 + denied by the PAX_MPROTECT feature. If the sysctl option is
50886 + enabled, a sysctl option with name "rwxmap_logging" is created.
50887 +
50888 +config GRKERNSEC_AUDIT_TEXTREL
50889 + bool 'ELF text relocations logging (READ HELP)'
50890 + depends on PAX_MPROTECT
50891 + help
50892 + If you say Y here, text relocations will be logged with the filename
50893 + of the offending library or binary. The purpose of the feature is
50894 + to help Linux distribution developers get rid of libraries and
50895 + binaries that need text relocations which hinder the future progress
50896 + of PaX. Only Linux distribution developers should say Y here, and
50897 + never on a production machine, as this option creates an information
50898 + leak that could aid an attacker in defeating the randomization of
50899 + a single memory region. If the sysctl option is enabled, a sysctl
50900 + option with name "audit_textrel" is created.
50901 +
50902 +endmenu
50903 +
50904 +menu "Executable Protections"
50905 +depends on GRKERNSEC
50906 +
50907 +config GRKERNSEC_DMESG
50908 + bool "Dmesg(8) restriction"
50909 + default y if GRKERNSEC_CONFIG_AUTO
50910 + help
50911 + If you say Y here, non-root users will not be able to use dmesg(8)
50912 + to view up to the last 4kb of messages in the kernel's log buffer.
50913 + The kernel's log buffer often contains kernel addresses and other
50914 + identifying information useful to an attacker in fingerprinting a
50915 + system for a targeted exploit.
50916 + If the sysctl option is enabled, a sysctl option with name "dmesg" is
50917 + created.
50918 +
50919 +config GRKERNSEC_HARDEN_PTRACE
50920 + bool "Deter ptrace-based process snooping"
50921 + default y if GRKERNSEC_CONFIG_AUTO
50922 + help
50923 + If you say Y here, TTY sniffers and other malicious monitoring
50924 + programs implemented through ptrace will be defeated. If you
50925 + have been using the RBAC system, this option has already been
50926 + enabled for several years for all users, with the ability to make
50927 + fine-grained exceptions.
50928 +
50929 + This option only affects the ability of non-root users to ptrace
50930 + processes that are not a descendent of the ptracing process.
50931 + This means that strace ./binary and gdb ./binary will still work,
50932 + but attaching to arbitrary processes will not. If the sysctl
50933 + option is enabled, a sysctl option with name "harden_ptrace" is
50934 + created.
50935 +
50936 +config GRKERNSEC_PTRACE_READEXEC
50937 + bool "Require read access to ptrace sensitive binaries"
50938 + default y if GRKERNSEC_CONFIG_AUTO
50939 + help
50940 + If you say Y here, unprivileged users will not be able to ptrace unreadable
50941 + binaries. This option is useful in environments that
50942 + remove the read bits (e.g. file mode 4711) from suid binaries to
50943 + prevent infoleaking of their contents. This option adds
50944 + consistency to the use of that file mode, as the binary could normally
50945 + be read out when run without privileges while ptracing.
50946 +
50947 + If the sysctl option is enabled, a sysctl option with name "ptrace_readexec"
50948 + is created.
50949 +
50950 +config GRKERNSEC_SETXID
50951 + bool "Enforce consistent multithreaded privileges"
50952 + default y if GRKERNSEC_CONFIG_AUTO
50953 + depends on (X86 || SPARC64 || PPC || ARM || MIPS)
50954 + help
50955 + If you say Y here, a change from a root uid to a non-root uid
50956 + in a multithreaded application will cause the resulting uids,
50957 + gids, supplementary groups, and capabilities in that thread
50958 + to be propagated to the other threads of the process. In most
50959 + cases this is unnecessary, as glibc will emulate this behavior
50960 + on behalf of the application. Other libcs do not act in the
50961 + same way, allowing the other threads of the process to continue
50962 + running with root privileges. If the sysctl option is enabled,
50963 + a sysctl option with name "consistent_setxid" is created.
50964 +
50965 +config GRKERNSEC_TPE
50966 + bool "Trusted Path Execution (TPE)"
50967 + default y if GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER
50968 + help
50969 + If you say Y here, you will be able to choose a gid to add to the
50970 + supplementary groups of users you want to mark as "untrusted."
50971 + These users will not be able to execute any files that are not in
50972 + root-owned directories writable only by root. If the sysctl option
50973 + is enabled, a sysctl option with name "tpe" is created.
50974 +
50975 +config GRKERNSEC_TPE_ALL
50976 + bool "Partially restrict all non-root users"
50977 + depends on GRKERNSEC_TPE
50978 + help
50979 + If you say Y here, all non-root users will be covered under
50980 + a weaker TPE restriction. This is separate from, and in addition to,
50981 + the main TPE options that you have selected elsewhere. Thus, if a
50982 + "trusted" GID is chosen, this restriction applies to even that GID.
50983 + Under this restriction, all non-root users will only be allowed to
50984 + execute files in directories they own that are not group or
50985 + world-writable, or in directories owned by root and writable only by
50986 + root. If the sysctl option is enabled, a sysctl option with name
50987 + "tpe_restrict_all" is created.
50988 +
50989 +config GRKERNSEC_TPE_INVERT
50990 + bool "Invert GID option"
50991 + depends on GRKERNSEC_TPE
50992 + help
50993 + If you say Y here, the group you specify in the TPE configuration will
50994 + decide what group TPE restrictions will be *disabled* for. This
50995 + option is useful if you want TPE restrictions to be applied to most
50996 + users on the system. If the sysctl option is enabled, a sysctl option
50997 + with name "tpe_invert" is created. Unlike other sysctl options, this
50998 + entry will default to on for backward-compatibility.
50999 +
51000 +config GRKERNSEC_TPE_GID
51001 + int "GID for untrusted users"
51002 + depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
51003 + default 1005
51004 + help
51005 + Setting this GID determines what group TPE restrictions will be
51006 + *enabled* for. If the sysctl option is enabled, a sysctl option
51007 + with name "tpe_gid" is created.
51008 +
51009 +config GRKERNSEC_TPE_GID
51010 + int "GID for trusted users"
51011 + depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
51012 + default 1005
51013 + help
51014 + Setting this GID determines what group TPE restrictions will be
51015 + *disabled* for. If the sysctl option is enabled, a sysctl option
51016 + with name "tpe_gid" is created.
51017 +
51018 +endmenu
51019 +menu "Network Protections"
51020 +depends on GRKERNSEC
51021 +
51022 +config GRKERNSEC_RANDNET
51023 + bool "Larger entropy pools"
51024 + default y if GRKERNSEC_CONFIG_AUTO
51025 + help
51026 + If you say Y here, the entropy pools used for many features of Linux
51027 + and grsecurity will be doubled in size. Since several grsecurity
51028 + features use additional randomness, it is recommended that you say Y
51029 + here. Saying Y here has a similar effect as modifying
51030 + /proc/sys/kernel/random/poolsize.
51031 +
51032 +config GRKERNSEC_BLACKHOLE
51033 + bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
51034 + default y if GRKERNSEC_CONFIG_AUTO
51035 + depends on NET
51036 + help
51037 + If you say Y here, neither TCP resets nor ICMP
51038 + destination-unreachable packets will be sent in response to packets
51039 + sent to ports for which no associated listening process exists.
51040 + This feature supports both IPV4 and IPV6 and exempts the
51041 + loopback interface from blackholing. Enabling this feature
51042 + makes a host more resilient to DoS attacks and reduces network
51043 + visibility against scanners.
51044 +
51045 + The blackhole feature as-implemented is equivalent to the FreeBSD
51046 + blackhole feature, as it prevents RST responses to all packets, not
51047 + just SYNs. Under most application behavior this causes no
51048 + problems, but applications (like haproxy) may not close certain
51049 + connections in a way that cleanly terminates them on the remote
51050 + end, leaving the remote host in LAST_ACK state. Because of this
51051 + side-effect and to prevent intentional LAST_ACK DoSes, this
51052 + feature also adds automatic mitigation against such attacks.
51053 + The mitigation drastically reduces the amount of time a socket
51054 + can spend in LAST_ACK state. If you're using haproxy and not
51055 + all servers it connects to have this option enabled, consider
51056 + disabling this feature on the haproxy host.
51057 +
51058 + If the sysctl option is enabled, two sysctl options with names
51059 + "ip_blackhole" and "lastack_retries" will be created.
51060 + While "ip_blackhole" takes the standard zero/non-zero on/off
51061 + toggle, "lastack_retries" uses the same kinds of values as
51062 + "tcp_retries1" and "tcp_retries2". The default value of 4
51063 + prevents a socket from lasting more than 45 seconds in LAST_ACK
51064 + state.
51065 +
51066 +config GRKERNSEC_SOCKET
51067 + bool "Socket restrictions"
51068 + depends on NET
51069 + help
51070 + If you say Y here, you will be able to choose from several options.
51071 + If you assign a GID on your system and add it to the supplementary
51072 + groups of users you want to restrict socket access to, this patch
51073 + will perform up to three things, based on the option(s) you choose.
51074 +
51075 +config GRKERNSEC_SOCKET_ALL
51076 + bool "Deny any sockets to group"
51077 + depends on GRKERNSEC_SOCKET
51078 + help
51079 + If you say Y here, you will be able to choose a GID of whose users will
51080 + be unable to connect to other hosts from your machine or run server
51081 + applications from your machine. If the sysctl option is enabled, a
51082 + sysctl option with name "socket_all" is created.
51083 +
51084 +config GRKERNSEC_SOCKET_ALL_GID
51085 + int "GID to deny all sockets for"
51086 + depends on GRKERNSEC_SOCKET_ALL
51087 + default 1004
51088 + help
51089 + Here you can choose the GID to disable socket access for. Remember to
51090 + add the users you want socket access disabled for to the GID
51091 + specified here. If the sysctl option is enabled, a sysctl option
51092 + with name "socket_all_gid" is created.
51093 +
51094 +config GRKERNSEC_SOCKET_CLIENT
51095 + bool "Deny client sockets to group"
51096 + depends on GRKERNSEC_SOCKET
51097 + help
51098 + If you say Y here, you will be able to choose a GID of whose users will
51099 + be unable to connect to other hosts from your machine, but will be
51100 + able to run servers. If this option is enabled, all users in the group
51101 + you specify will have to use passive mode when initiating ftp transfers
51102 + from the shell on your machine. If the sysctl option is enabled, a
51103 + sysctl option with name "socket_client" is created.
51104 +
51105 +config GRKERNSEC_SOCKET_CLIENT_GID
51106 + int "GID to deny client sockets for"
51107 + depends on GRKERNSEC_SOCKET_CLIENT
51108 + default 1003
51109 + help
51110 + Here you can choose the GID to disable client socket access for.
51111 + Remember to add the users you want client socket access disabled for to
51112 + the GID specified here. If the sysctl option is enabled, a sysctl
51113 + option with name "socket_client_gid" is created.
51114 +
51115 +config GRKERNSEC_SOCKET_SERVER
51116 + bool "Deny server sockets to group"
51117 + depends on GRKERNSEC_SOCKET
51118 + help
51119 + If you say Y here, you will be able to choose a GID of whose users will
51120 + be unable to run server applications from your machine. If the sysctl
51121 + option is enabled, a sysctl option with name "socket_server" is created.
51122 +
51123 +config GRKERNSEC_SOCKET_SERVER_GID
51124 + int "GID to deny server sockets for"
51125 + depends on GRKERNSEC_SOCKET_SERVER
51126 + default 1002
51127 + help
51128 + Here you can choose the GID to disable server socket access for.
51129 + Remember to add the users you want server socket access disabled for to
51130 + the GID specified here. If the sysctl option is enabled, a sysctl
51131 + option with name "socket_server_gid" is created.
51132 +
51133 +endmenu
51134 +menu "Sysctl Support"
51135 +depends on GRKERNSEC && SYSCTL
51136 +
51137 +config GRKERNSEC_SYSCTL
51138 + bool "Sysctl support"
51139 + default y if GRKERNSEC_CONFIG_AUTO
51140 + help
51141 + If you say Y here, you will be able to change the options that
51142 + grsecurity runs with at bootup, without having to recompile your
51143 + kernel. You can echo values to files in /proc/sys/kernel/grsecurity
51144 + to enable (1) or disable (0) various features. All the sysctl entries
51145 + are mutable until the "grsec_lock" entry is set to a non-zero value.
51146 + All features enabled in the kernel configuration are disabled at boot
51147 + if you do not say Y to the "Turn on features by default" option.
51148 + All options should be set at startup, and the grsec_lock entry should
51149 + be set to a non-zero value after all the options are set.
51150 + *THIS IS EXTREMELY IMPORTANT*
51151 +
51152 +config GRKERNSEC_SYSCTL_DISTRO
51153 + bool "Extra sysctl support for distro makers (READ HELP)"
51154 + depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
51155 + help
51156 + If you say Y here, additional sysctl options will be created
51157 + for features that affect processes running as root. Therefore,
51158 + it is critical when using this option that the grsec_lock entry be
51159 + enabled after boot. Only distros with prebuilt kernel packages
51160 + with this option enabled that can ensure grsec_lock is enabled
51161 + after boot should use this option.
51162 + *Failure to set grsec_lock after boot makes all grsec features
51163 + this option covers useless*
51164 +
51165 + Currently this option creates the following sysctl entries:
51166 + "Disable Privileged I/O": "disable_priv_io"
51167 +
51168 +config GRKERNSEC_SYSCTL_ON
51169 + bool "Turn on features by default"
51170 + default y if GRKERNSEC_CONFIG_AUTO
51171 + depends on GRKERNSEC_SYSCTL
51172 + help
51173 + If you say Y here, instead of having all features enabled in the
51174 + kernel configuration disabled at boot time, the features will be
51175 + enabled at boot time. It is recommended you say Y here unless
51176 + there is some reason you would want all sysctl-tunable features to
51177 + be disabled by default. As mentioned elsewhere, it is important
51178 + to enable the grsec_lock entry once you have finished modifying
51179 + the sysctl entries.
51180 +
51181 +endmenu
51182 +menu "Logging Options"
51183 +depends on GRKERNSEC
51184 +
51185 +config GRKERNSEC_FLOODTIME
51186 + int "Seconds in between log messages (minimum)"
51187 + default 10
51188 + help
51189 + This option allows you to enforce the number of seconds between
51190 + grsecurity log messages. The default should be suitable for most
51191 + people, however, if you choose to change it, choose a value small enough
51192 + to allow informative logs to be produced, but large enough to
51193 + prevent flooding.
51194 +
51195 +config GRKERNSEC_FLOODBURST
51196 + int "Number of messages in a burst (maximum)"
51197 + default 6
51198 + help
51199 + This option allows you to choose the maximum number of messages allowed
51200 + within the flood time interval you chose in a separate option. The
51201 + default should be suitable for most people, however if you find that
51202 + many of your logs are being interpreted as flooding, you may want to
51203 + raise this value.
51204 +
51205 +endmenu
51206 diff --git a/grsecurity/Makefile b/grsecurity/Makefile
51207 new file mode 100644
51208 index 0000000..1b9afa9
51209 --- /dev/null
51210 +++ b/grsecurity/Makefile
51211 @@ -0,0 +1,38 @@
51212 +# grsecurity's ACL system was originally written in 2001 by Michael Dalton
51213 +# during 2001-2009 it has been completely redesigned by Brad Spengler
51214 +# into an RBAC system
51215 +#
51216 +# All code in this directory and various hooks inserted throughout the kernel
51217 +# are copyright Brad Spengler - Open Source Security, Inc., and released
51218 +# under the GPL v2 or higher
51219 +
51220 +KBUILD_CFLAGS += -Werror
51221 +
51222 +obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
51223 + grsec_mount.o grsec_sig.o grsec_sysctl.o \
51224 + grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
51225 +
51226 +obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
51227 + gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
51228 + gracl_learn.o grsec_log.o
51229 +obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
51230 +
51231 +ifdef CONFIG_NET
51232 +obj-y += grsec_sock.o
51233 +obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
51234 +endif
51235 +
51236 +ifndef CONFIG_GRKERNSEC
51237 +obj-y += grsec_disabled.o
51238 +endif
51239 +
51240 +ifdef CONFIG_GRKERNSEC_HIDESYM
51241 +extra-y := grsec_hidesym.o
51242 +$(obj)/grsec_hidesym.o:
51243 + @-chmod -f 500 /boot
51244 + @-chmod -f 500 /lib/modules
51245 + @-chmod -f 500 /lib64/modules
51246 + @-chmod -f 500 /lib32/modules
51247 + @-chmod -f 700 .
51248 + @echo ' grsec: protected kernel image paths'
51249 +endif
51250 diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
51251 new file mode 100644
51252 index 0000000..1561617
51253 --- /dev/null
51254 +++ b/grsecurity/gracl.c
51255 @@ -0,0 +1,4017 @@
51256 +#include <linux/kernel.h>
51257 +#include <linux/module.h>
51258 +#include <linux/sched.h>
51259 +#include <linux/mm.h>
51260 +#include <linux/file.h>
51261 +#include <linux/fs.h>
51262 +#include <linux/namei.h>
51263 +#include <linux/mount.h>
51264 +#include <linux/tty.h>
51265 +#include <linux/proc_fs.h>
51266 +#include <linux/lglock.h>
51267 +#include <linux/slab.h>
51268 +#include <linux/vmalloc.h>
51269 +#include <linux/types.h>
51270 +#include <linux/sysctl.h>
51271 +#include <linux/netdevice.h>
51272 +#include <linux/ptrace.h>
51273 +#include <linux/gracl.h>
51274 +#include <linux/gralloc.h>
51275 +#include <linux/security.h>
51276 +#include <linux/grinternal.h>
51277 +#include <linux/pid_namespace.h>
51278 +#include <linux/stop_machine.h>
51279 +#include <linux/fdtable.h>
51280 +#include <linux/percpu.h>
51281 +#include <linux/lglock.h>
51282 +#include "../fs/mount.h"
51283 +
51284 +#include <asm/uaccess.h>
51285 +#include <asm/errno.h>
51286 +#include <asm/mman.h>
51287 +
51288 +extern struct lglock vfsmount_lock;
51289 +
51290 +static struct acl_role_db acl_role_set;
51291 +static struct name_db name_set;
51292 +static struct inodev_db inodev_set;
51293 +
51294 +/* for keeping track of userspace pointers used for subjects, so we
51295 + can share references in the kernel as well
51296 +*/
51297 +
51298 +static struct path real_root;
51299 +
51300 +static struct acl_subj_map_db subj_map_set;
51301 +
51302 +static struct acl_role_label *default_role;
51303 +
51304 +static struct acl_role_label *role_list;
51305 +
51306 +static u16 acl_sp_role_value;
51307 +
51308 +extern char *gr_shared_page[4];
51309 +static DEFINE_MUTEX(gr_dev_mutex);
51310 +DEFINE_RWLOCK(gr_inode_lock);
51311 +
51312 +struct gr_arg *gr_usermode;
51313 +
51314 +static unsigned int gr_status __read_only = GR_STATUS_INIT;
51315 +
51316 +extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
51317 +extern void gr_clear_learn_entries(void);
51318 +
51319 +#ifdef CONFIG_GRKERNSEC_RESLOG
51320 +extern void gr_log_resource(const struct task_struct *task,
51321 + const int res, const unsigned long wanted, const int gt);
51322 +#endif
51323 +
51324 +unsigned char *gr_system_salt;
51325 +unsigned char *gr_system_sum;
51326 +
51327 +static struct sprole_pw **acl_special_roles = NULL;
51328 +static __u16 num_sprole_pws = 0;
51329 +
51330 +static struct acl_role_label *kernel_role = NULL;
51331 +
51332 +static unsigned int gr_auth_attempts = 0;
51333 +static unsigned long gr_auth_expires = 0UL;
51334 +
51335 +#ifdef CONFIG_NET
51336 +extern struct vfsmount *sock_mnt;
51337 +#endif
51338 +
51339 +extern struct vfsmount *pipe_mnt;
51340 +extern struct vfsmount *shm_mnt;
51341 +#ifdef CONFIG_HUGETLBFS
51342 +extern struct vfsmount *hugetlbfs_vfsmount;
51343 +#endif
51344 +
51345 +static struct acl_object_label *fakefs_obj_rw;
51346 +static struct acl_object_label *fakefs_obj_rwx;
51347 +
51348 +extern int gr_init_uidset(void);
51349 +extern void gr_free_uidset(void);
51350 +extern void gr_remove_uid(uid_t uid);
51351 +extern int gr_find_uid(uid_t uid);
51352 +
51353 +__inline__ int
51354 +gr_acl_is_enabled(void)
51355 +{
51356 + return (gr_status & GR_READY);
51357 +}
51358 +
51359 +#ifdef CONFIG_BTRFS_FS
51360 +extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
51361 +extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
51362 +#endif
51363 +
51364 +static inline dev_t __get_dev(const struct dentry *dentry)
51365 +{
51366 +#ifdef CONFIG_BTRFS_FS
51367 + if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
51368 + return get_btrfs_dev_from_inode(dentry->d_inode);
51369 + else
51370 +#endif
51371 + return dentry->d_inode->i_sb->s_dev;
51372 +}
51373 +
51374 +dev_t gr_get_dev_from_dentry(struct dentry *dentry)
51375 +{
51376 + return __get_dev(dentry);
51377 +}
51378 +
51379 +static char gr_task_roletype_to_char(struct task_struct *task)
51380 +{
51381 + switch (task->role->roletype &
51382 + (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
51383 + GR_ROLE_SPECIAL)) {
51384 + case GR_ROLE_DEFAULT:
51385 + return 'D';
51386 + case GR_ROLE_USER:
51387 + return 'U';
51388 + case GR_ROLE_GROUP:
51389 + return 'G';
51390 + case GR_ROLE_SPECIAL:
51391 + return 'S';
51392 + }
51393 +
51394 + return 'X';
51395 +}
51396 +
51397 +char gr_roletype_to_char(void)
51398 +{
51399 + return gr_task_roletype_to_char(current);
51400 +}
51401 +
51402 +__inline__ int
51403 +gr_acl_tpe_check(void)
51404 +{
51405 + if (unlikely(!(gr_status & GR_READY)))
51406 + return 0;
51407 + if (current->role->roletype & GR_ROLE_TPE)
51408 + return 1;
51409 + else
51410 + return 0;
51411 +}
51412 +
51413 +int
51414 +gr_handle_rawio(const struct inode *inode)
51415 +{
51416 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
51417 + if (inode && S_ISBLK(inode->i_mode) &&
51418 + grsec_enable_chroot_caps && proc_is_chrooted(current) &&
51419 + !capable(CAP_SYS_RAWIO))
51420 + return 1;
51421 +#endif
51422 + return 0;
51423 +}
51424 +
51425 +static int
51426 +gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
51427 +{
51428 + if (likely(lena != lenb))
51429 + return 0;
51430 +
51431 + return !memcmp(a, b, lena);
51432 +}
51433 +
51434 +static int prepend(char **buffer, int *buflen, const char *str, int namelen)
51435 +{
51436 + *buflen -= namelen;
51437 + if (*buflen < 0)
51438 + return -ENAMETOOLONG;
51439 + *buffer -= namelen;
51440 + memcpy(*buffer, str, namelen);
51441 + return 0;
51442 +}
51443 +
51444 +static int prepend_name(char **buffer, int *buflen, struct qstr *name)
51445 +{
51446 + return prepend(buffer, buflen, name->name, name->len);
51447 +}
51448 +
51449 +static int prepend_path(const struct path *path, struct path *root,
51450 + char **buffer, int *buflen)
51451 +{
51452 + struct dentry *dentry = path->dentry;
51453 + struct vfsmount *vfsmnt = path->mnt;
51454 + struct mount *mnt = real_mount(vfsmnt);
51455 + bool slash = false;
51456 + int error = 0;
51457 +
51458 + while (dentry != root->dentry || vfsmnt != root->mnt) {
51459 + struct dentry * parent;
51460 +
51461 + if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
51462 + /* Global root? */
51463 + if (!mnt_has_parent(mnt)) {
51464 + goto out;
51465 + }
51466 + dentry = mnt->mnt_mountpoint;
51467 + mnt = mnt->mnt_parent;
51468 + vfsmnt = &mnt->mnt;
51469 + continue;
51470 + }
51471 + parent = dentry->d_parent;
51472 + prefetch(parent);
51473 + spin_lock(&dentry->d_lock);
51474 + error = prepend_name(buffer, buflen, &dentry->d_name);
51475 + spin_unlock(&dentry->d_lock);
51476 + if (!error)
51477 + error = prepend(buffer, buflen, "/", 1);
51478 + if (error)
51479 + break;
51480 +
51481 + slash = true;
51482 + dentry = parent;
51483 + }
51484 +
51485 +out:
51486 + if (!error && !slash)
51487 + error = prepend(buffer, buflen, "/", 1);
51488 +
51489 + return error;
51490 +}
51491 +
51492 +/* this must be called with vfsmount_lock and rename_lock held */
51493 +
51494 +static char *__our_d_path(const struct path *path, struct path *root,
51495 + char *buf, int buflen)
51496 +{
51497 + char *res = buf + buflen;
51498 + int error;
51499 +
51500 + prepend(&res, &buflen, "\0", 1);
51501 + error = prepend_path(path, root, &res, &buflen);
51502 + if (error)
51503 + return ERR_PTR(error);
51504 +
51505 + return res;
51506 +}
51507 +
51508 +static char *
51509 +gen_full_path(struct path *path, struct path *root, char *buf, int buflen)
51510 +{
51511 + char *retval;
51512 +
51513 + retval = __our_d_path(path, root, buf, buflen);
51514 + if (unlikely(IS_ERR(retval)))
51515 + retval = strcpy(buf, "<path too long>");
51516 + else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
51517 + retval[1] = '\0';
51518 +
51519 + return retval;
51520 +}
51521 +
51522 +static char *
51523 +__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
51524 + char *buf, int buflen)
51525 +{
51526 + struct path path;
51527 + char *res;
51528 +
51529 + path.dentry = (struct dentry *)dentry;
51530 + path.mnt = (struct vfsmount *)vfsmnt;
51531 +
51532 + /* we can use real_root.dentry, real_root.mnt, because this is only called
51533 + by the RBAC system */
51534 + res = gen_full_path(&path, &real_root, buf, buflen);
51535 +
51536 + return res;
51537 +}
51538 +
51539 +static char *
51540 +d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
51541 + char *buf, int buflen)
51542 +{
51543 + char *res;
51544 + struct path path;
51545 + struct path root;
51546 + struct task_struct *reaper = init_pid_ns.child_reaper;
51547 +
51548 + path.dentry = (struct dentry *)dentry;
51549 + path.mnt = (struct vfsmount *)vfsmnt;
51550 +
51551 + /* we can't use real_root.dentry, real_root.mnt, because they belong only to the RBAC system */
51552 + get_fs_root(reaper->fs, &root);
51553 +
51554 + write_seqlock(&rename_lock);
51555 + br_read_lock(&vfsmount_lock);
51556 + res = gen_full_path(&path, &root, buf, buflen);
51557 + br_read_unlock(&vfsmount_lock);
51558 + write_sequnlock(&rename_lock);
51559 +
51560 + path_put(&root);
51561 + return res;
51562 +}
51563 +
51564 +static char *
51565 +gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
51566 +{
51567 + char *ret;
51568 + write_seqlock(&rename_lock);
51569 + br_read_lock(&vfsmount_lock);
51570 + ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51571 + PAGE_SIZE);
51572 + br_read_unlock(&vfsmount_lock);
51573 + write_sequnlock(&rename_lock);
51574 + return ret;
51575 +}
51576 +
51577 +static char *
51578 +gr_to_proc_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
51579 +{
51580 + char *ret;
51581 + char *buf;
51582 + int buflen;
51583 +
51584 + write_seqlock(&rename_lock);
51585 + br_read_lock(&vfsmount_lock);
51586 + buf = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
51587 + ret = __d_real_path(dentry, mnt, buf, PAGE_SIZE - 6);
51588 + buflen = (int)(ret - buf);
51589 + if (buflen >= 5)
51590 + prepend(&ret, &buflen, "/proc", 5);
51591 + else
51592 + ret = strcpy(buf, "<path too long>");
51593 + br_read_unlock(&vfsmount_lock);
51594 + write_sequnlock(&rename_lock);
51595 + return ret;
51596 +}
51597 +
51598 +char *
51599 +gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
51600 +{
51601 + return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51602 + PAGE_SIZE);
51603 +}
51604 +
51605 +char *
51606 +gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
51607 +{
51608 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
51609 + PAGE_SIZE);
51610 +}
51611 +
51612 +char *
51613 +gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
51614 +{
51615 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
51616 + PAGE_SIZE);
51617 +}
51618 +
51619 +char *
51620 +gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
51621 +{
51622 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
51623 + PAGE_SIZE);
51624 +}
51625 +
51626 +char *
51627 +gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
51628 +{
51629 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
51630 + PAGE_SIZE);
51631 +}
51632 +
51633 +__inline__ __u32
51634 +to_gr_audit(const __u32 reqmode)
51635 +{
51636 + /* masks off auditable permission flags, then shifts them to create
51637 + auditing flags, and adds the special case of append auditing if
51638 + we're requesting write */
51639 + return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
51640 +}
51641 +
51642 +struct acl_subject_label *
51643 +lookup_subject_map(const struct acl_subject_label *userp)
51644 +{
51645 + unsigned int index = shash(userp, subj_map_set.s_size);
51646 + struct subject_map *match;
51647 +
51648 + match = subj_map_set.s_hash[index];
51649 +
51650 + while (match && match->user != userp)
51651 + match = match->next;
51652 +
51653 + if (match != NULL)
51654 + return match->kernel;
51655 + else
51656 + return NULL;
51657 +}
51658 +
51659 +static void
51660 +insert_subj_map_entry(struct subject_map *subjmap)
51661 +{
51662 + unsigned int index = shash(subjmap->user, subj_map_set.s_size);
51663 + struct subject_map **curr;
51664 +
51665 + subjmap->prev = NULL;
51666 +
51667 + curr = &subj_map_set.s_hash[index];
51668 + if (*curr != NULL)
51669 + (*curr)->prev = subjmap;
51670 +
51671 + subjmap->next = *curr;
51672 + *curr = subjmap;
51673 +
51674 + return;
51675 +}
51676 +
51677 +static struct acl_role_label *
51678 +lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
51679 + const gid_t gid)
51680 +{
51681 + unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
51682 + struct acl_role_label *match;
51683 + struct role_allowed_ip *ipp;
51684 + unsigned int x;
51685 + u32 curr_ip = task->signal->curr_ip;
51686 +
51687 + task->signal->saved_ip = curr_ip;
51688 +
51689 + match = acl_role_set.r_hash[index];
51690 +
51691 + while (match) {
51692 + if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
51693 + for (x = 0; x < match->domain_child_num; x++) {
51694 + if (match->domain_children[x] == uid)
51695 + goto found;
51696 + }
51697 + } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
51698 + break;
51699 + match = match->next;
51700 + }
51701 +found:
51702 + if (match == NULL) {
51703 + try_group:
51704 + index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
51705 + match = acl_role_set.r_hash[index];
51706 +
51707 + while (match) {
51708 + if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
51709 + for (x = 0; x < match->domain_child_num; x++) {
51710 + if (match->domain_children[x] == gid)
51711 + goto found2;
51712 + }
51713 + } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
51714 + break;
51715 + match = match->next;
51716 + }
51717 +found2:
51718 + if (match == NULL)
51719 + match = default_role;
51720 + if (match->allowed_ips == NULL)
51721 + return match;
51722 + else {
51723 + for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51724 + if (likely
51725 + ((ntohl(curr_ip) & ipp->netmask) ==
51726 + (ntohl(ipp->addr) & ipp->netmask)))
51727 + return match;
51728 + }
51729 + match = default_role;
51730 + }
51731 + } else if (match->allowed_ips == NULL) {
51732 + return match;
51733 + } else {
51734 + for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51735 + if (likely
51736 + ((ntohl(curr_ip) & ipp->netmask) ==
51737 + (ntohl(ipp->addr) & ipp->netmask)))
51738 + return match;
51739 + }
51740 + goto try_group;
51741 + }
51742 +
51743 + return match;
51744 +}
51745 +
51746 +struct acl_subject_label *
51747 +lookup_acl_subj_label(const ino_t ino, const dev_t dev,
51748 + const struct acl_role_label *role)
51749 +{
51750 + unsigned int index = fhash(ino, dev, role->subj_hash_size);
51751 + struct acl_subject_label *match;
51752 +
51753 + match = role->subj_hash[index];
51754 +
51755 + while (match && (match->inode != ino || match->device != dev ||
51756 + (match->mode & GR_DELETED))) {
51757 + match = match->next;
51758 + }
51759 +
51760 + if (match && !(match->mode & GR_DELETED))
51761 + return match;
51762 + else
51763 + return NULL;
51764 +}
51765 +
51766 +struct acl_subject_label *
51767 +lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
51768 + const struct acl_role_label *role)
51769 +{
51770 + unsigned int index = fhash(ino, dev, role->subj_hash_size);
51771 + struct acl_subject_label *match;
51772 +
51773 + match = role->subj_hash[index];
51774 +
51775 + while (match && (match->inode != ino || match->device != dev ||
51776 + !(match->mode & GR_DELETED))) {
51777 + match = match->next;
51778 + }
51779 +
51780 + if (match && (match->mode & GR_DELETED))
51781 + return match;
51782 + else
51783 + return NULL;
51784 +}
51785 +
51786 +static struct acl_object_label *
51787 +lookup_acl_obj_label(const ino_t ino, const dev_t dev,
51788 + const struct acl_subject_label *subj)
51789 +{
51790 + unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51791 + struct acl_object_label *match;
51792 +
51793 + match = subj->obj_hash[index];
51794 +
51795 + while (match && (match->inode != ino || match->device != dev ||
51796 + (match->mode & GR_DELETED))) {
51797 + match = match->next;
51798 + }
51799 +
51800 + if (match && !(match->mode & GR_DELETED))
51801 + return match;
51802 + else
51803 + return NULL;
51804 +}
51805 +
51806 +static struct acl_object_label *
51807 +lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
51808 + const struct acl_subject_label *subj)
51809 +{
51810 + unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51811 + struct acl_object_label *match;
51812 +
51813 + match = subj->obj_hash[index];
51814 +
51815 + while (match && (match->inode != ino || match->device != dev ||
51816 + !(match->mode & GR_DELETED))) {
51817 + match = match->next;
51818 + }
51819 +
51820 + if (match && (match->mode & GR_DELETED))
51821 + return match;
51822 +
51823 + match = subj->obj_hash[index];
51824 +
51825 + while (match && (match->inode != ino || match->device != dev ||
51826 + (match->mode & GR_DELETED))) {
51827 + match = match->next;
51828 + }
51829 +
51830 + if (match && !(match->mode & GR_DELETED))
51831 + return match;
51832 + else
51833 + return NULL;
51834 +}
51835 +
51836 +static struct name_entry *
51837 +lookup_name_entry(const char *name)
51838 +{
51839 + unsigned int len = strlen(name);
51840 + unsigned int key = full_name_hash(name, len);
51841 + unsigned int index = key % name_set.n_size;
51842 + struct name_entry *match;
51843 +
51844 + match = name_set.n_hash[index];
51845 +
51846 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
51847 + match = match->next;
51848 +
51849 + return match;
51850 +}
51851 +
51852 +static struct name_entry *
51853 +lookup_name_entry_create(const char *name)
51854 +{
51855 + unsigned int len = strlen(name);
51856 + unsigned int key = full_name_hash(name, len);
51857 + unsigned int index = key % name_set.n_size;
51858 + struct name_entry *match;
51859 +
51860 + match = name_set.n_hash[index];
51861 +
51862 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
51863 + !match->deleted))
51864 + match = match->next;
51865 +
51866 + if (match && match->deleted)
51867 + return match;
51868 +
51869 + match = name_set.n_hash[index];
51870 +
51871 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
51872 + match->deleted))
51873 + match = match->next;
51874 +
51875 + if (match && !match->deleted)
51876 + return match;
51877 + else
51878 + return NULL;
51879 +}
51880 +
51881 +static struct inodev_entry *
51882 +lookup_inodev_entry(const ino_t ino, const dev_t dev)
51883 +{
51884 + unsigned int index = fhash(ino, dev, inodev_set.i_size);
51885 + struct inodev_entry *match;
51886 +
51887 + match = inodev_set.i_hash[index];
51888 +
51889 + while (match && (match->nentry->inode != ino || match->nentry->device != dev))
51890 + match = match->next;
51891 +
51892 + return match;
51893 +}
51894 +
51895 +static void
51896 +insert_inodev_entry(struct inodev_entry *entry)
51897 +{
51898 + unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
51899 + inodev_set.i_size);
51900 + struct inodev_entry **curr;
51901 +
51902 + entry->prev = NULL;
51903 +
51904 + curr = &inodev_set.i_hash[index];
51905 + if (*curr != NULL)
51906 + (*curr)->prev = entry;
51907 +
51908 + entry->next = *curr;
51909 + *curr = entry;
51910 +
51911 + return;
51912 +}
51913 +
51914 +static void
51915 +__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
51916 +{
51917 + unsigned int index =
51918 + rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
51919 + struct acl_role_label **curr;
51920 + struct acl_role_label *tmp, *tmp2;
51921 +
51922 + curr = &acl_role_set.r_hash[index];
51923 +
51924 + /* simple case, slot is empty, just set it to our role */
51925 + if (*curr == NULL) {
51926 + *curr = role;
51927 + } else {
51928 + /* example:
51929 + 1 -> 2 -> 3 (adding 2 -> 3 to here)
51930 + 2 -> 3
51931 + */
51932 + /* first check to see if we can already be reached via this slot */
51933 + tmp = *curr;
51934 + while (tmp && tmp != role)
51935 + tmp = tmp->next;
51936 + if (tmp == role) {
51937 + /* we don't need to add ourselves to this slot's chain */
51938 + return;
51939 + }
51940 + /* we need to add ourselves to this chain, two cases */
51941 + if (role->next == NULL) {
51942 + /* simple case, append the current chain to our role */
51943 + role->next = *curr;
51944 + *curr = role;
51945 + } else {
51946 + /* 1 -> 2 -> 3 -> 4
51947 + 2 -> 3 -> 4
51948 + 3 -> 4 (adding 1 -> 2 -> 3 -> 4 to here)
51949 + */
51950 + /* trickier case: walk our role's chain until we find
51951 + the role for the start of the current slot's chain */
51952 + tmp = role;
51953 + tmp2 = *curr;
51954 + while (tmp->next && tmp->next != tmp2)
51955 + tmp = tmp->next;
51956 + if (tmp->next == tmp2) {
51957 + /* from example above, we found 3, so just
51958 + replace this slot's chain with ours */
51959 + *curr = role;
51960 + } else {
51961 + /* we didn't find a subset of our role's chain
51962 + in the current slot's chain, so append their
51963 + chain to ours, and set us as the first role in
51964 + the slot's chain
51965 +
51966 + we could fold this case with the case above,
51967 + but making it explicit for clarity
51968 + */
51969 + tmp->next = tmp2;
51970 + *curr = role;
51971 + }
51972 + }
51973 + }
51974 +
51975 + return;
51976 +}
51977 +
51978 +static void
51979 +insert_acl_role_label(struct acl_role_label *role)
51980 +{
51981 + int i;
51982 +
51983 + if (role_list == NULL) {
51984 + role_list = role;
51985 + role->prev = NULL;
51986 + } else {
51987 + role->prev = role_list;
51988 + role_list = role;
51989 + }
51990 +
51991 + /* used for hash chains */
51992 + role->next = NULL;
51993 +
51994 + if (role->roletype & GR_ROLE_DOMAIN) {
51995 + for (i = 0; i < role->domain_child_num; i++)
51996 + __insert_acl_role_label(role, role->domain_children[i]);
51997 + } else
51998 + __insert_acl_role_label(role, role->uidgid);
51999 +}
52000 +
52001 +static int
52002 +insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
52003 +{
52004 + struct name_entry **curr, *nentry;
52005 + struct inodev_entry *ientry;
52006 + unsigned int len = strlen(name);
52007 + unsigned int key = full_name_hash(name, len);
52008 + unsigned int index = key % name_set.n_size;
52009 +
52010 + curr = &name_set.n_hash[index];
52011 +
52012 + while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
52013 + curr = &((*curr)->next);
52014 +
52015 + if (*curr != NULL)
52016 + return 1;
52017 +
52018 + nentry = acl_alloc(sizeof (struct name_entry));
52019 + if (nentry == NULL)
52020 + return 0;
52021 + ientry = acl_alloc(sizeof (struct inodev_entry));
52022 + if (ientry == NULL)
52023 + return 0;
52024 + ientry->nentry = nentry;
52025 +
52026 + nentry->key = key;
52027 + nentry->name = name;
52028 + nentry->inode = inode;
52029 + nentry->device = device;
52030 + nentry->len = len;
52031 + nentry->deleted = deleted;
52032 +
52033 + nentry->prev = NULL;
52034 + curr = &name_set.n_hash[index];
52035 + if (*curr != NULL)
52036 + (*curr)->prev = nentry;
52037 + nentry->next = *curr;
52038 + *curr = nentry;
52039 +
52040 + /* insert us into the table searchable by inode/dev */
52041 + insert_inodev_entry(ientry);
52042 +
52043 + return 1;
52044 +}
52045 +
52046 +static void
52047 +insert_acl_obj_label(struct acl_object_label *obj,
52048 + struct acl_subject_label *subj)
52049 +{
52050 + unsigned int index =
52051 + fhash(obj->inode, obj->device, subj->obj_hash_size);
52052 + struct acl_object_label **curr;
52053 +
52054 +
52055 + obj->prev = NULL;
52056 +
52057 + curr = &subj->obj_hash[index];
52058 + if (*curr != NULL)
52059 + (*curr)->prev = obj;
52060 +
52061 + obj->next = *curr;
52062 + *curr = obj;
52063 +
52064 + return;
52065 +}
52066 +
52067 +static void
52068 +insert_acl_subj_label(struct acl_subject_label *obj,
52069 + struct acl_role_label *role)
52070 +{
52071 + unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
52072 + struct acl_subject_label **curr;
52073 +
52074 + obj->prev = NULL;
52075 +
52076 + curr = &role->subj_hash[index];
52077 + if (*curr != NULL)
52078 + (*curr)->prev = obj;
52079 +
52080 + obj->next = *curr;
52081 + *curr = obj;
52082 +
52083 + return;
52084 +}
52085 +
52086 +/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
52087 +
52088 +static void *
52089 +create_table(__u32 * len, int elementsize)
52090 +{
52091 + unsigned int table_sizes[] = {
52092 + 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
52093 + 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
52094 + 4194301, 8388593, 16777213, 33554393, 67108859
52095 + };
52096 + void *newtable = NULL;
52097 + unsigned int pwr = 0;
52098 +
52099 + while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
52100 + table_sizes[pwr] <= *len)
52101 + pwr++;
52102 +
52103 + if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
52104 + return newtable;
52105 +
52106 + if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
52107 + newtable =
52108 + kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
52109 + else
52110 + newtable = vmalloc(table_sizes[pwr] * elementsize);
52111 +
52112 + *len = table_sizes[pwr];
52113 +
52114 + return newtable;
52115 +}
52116 +
52117 +static int
52118 +init_variables(const struct gr_arg *arg)
52119 +{
52120 + struct task_struct *reaper = init_pid_ns.child_reaper;
52121 + unsigned int stacksize;
52122 +
52123 + subj_map_set.s_size = arg->role_db.num_subjects;
52124 + acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
52125 + name_set.n_size = arg->role_db.num_objects;
52126 + inodev_set.i_size = arg->role_db.num_objects;
52127 +
52128 + if (!subj_map_set.s_size || !acl_role_set.r_size ||
52129 + !name_set.n_size || !inodev_set.i_size)
52130 + return 1;
52131 +
52132 + if (!gr_init_uidset())
52133 + return 1;
52134 +
52135 + /* set up the stack that holds allocation info */
52136 +
52137 + stacksize = arg->role_db.num_pointers + 5;
52138 +
52139 + if (!acl_alloc_stack_init(stacksize))
52140 + return 1;
52141 +
52142 + /* grab reference for the real root dentry and vfsmount */
52143 + get_fs_root(reaper->fs, &real_root);
52144 +
52145 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
52146 + printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root.dentry), real_root.dentry->d_inode->i_ino);
52147 +#endif
52148 +
52149 + fakefs_obj_rw = acl_alloc(sizeof(struct acl_object_label));
52150 + if (fakefs_obj_rw == NULL)
52151 + return 1;
52152 + fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE;
52153 +
52154 + fakefs_obj_rwx = acl_alloc(sizeof(struct acl_object_label));
52155 + if (fakefs_obj_rwx == NULL)
52156 + return 1;
52157 + fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
52158 +
52159 + subj_map_set.s_hash =
52160 + (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
52161 + acl_role_set.r_hash =
52162 + (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
52163 + name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
52164 + inodev_set.i_hash =
52165 + (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
52166 +
52167 + if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
52168 + !name_set.n_hash || !inodev_set.i_hash)
52169 + return 1;
52170 +
52171 + memset(subj_map_set.s_hash, 0,
52172 + sizeof(struct subject_map *) * subj_map_set.s_size);
52173 + memset(acl_role_set.r_hash, 0,
52174 + sizeof (struct acl_role_label *) * acl_role_set.r_size);
52175 + memset(name_set.n_hash, 0,
52176 + sizeof (struct name_entry *) * name_set.n_size);
52177 + memset(inodev_set.i_hash, 0,
52178 + sizeof (struct inodev_entry *) * inodev_set.i_size);
52179 +
52180 + return 0;
52181 +}
52182 +
52183 +/* free information not needed after startup
52184 + currently contains user->kernel pointer mappings for subjects
52185 +*/
52186 +
52187 +static void
52188 +free_init_variables(void)
52189 +{
52190 + __u32 i;
52191 +
52192 + if (subj_map_set.s_hash) {
52193 + for (i = 0; i < subj_map_set.s_size; i++) {
52194 + if (subj_map_set.s_hash[i]) {
52195 + kfree(subj_map_set.s_hash[i]);
52196 + subj_map_set.s_hash[i] = NULL;
52197 + }
52198 + }
52199 +
52200 + if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
52201 + PAGE_SIZE)
52202 + kfree(subj_map_set.s_hash);
52203 + else
52204 + vfree(subj_map_set.s_hash);
52205 + }
52206 +
52207 + return;
52208 +}
52209 +
52210 +static void
52211 +free_variables(void)
52212 +{
52213 + struct acl_subject_label *s;
52214 + struct acl_role_label *r;
52215 + struct task_struct *task, *task2;
52216 + unsigned int x;
52217 +
52218 + gr_clear_learn_entries();
52219 +
52220 + read_lock(&tasklist_lock);
52221 + do_each_thread(task2, task) {
52222 + task->acl_sp_role = 0;
52223 + task->acl_role_id = 0;
52224 + task->acl = NULL;
52225 + task->role = NULL;
52226 + } while_each_thread(task2, task);
52227 + read_unlock(&tasklist_lock);
52228 +
52229 + /* release the reference to the real root dentry and vfsmount */
52230 + path_put(&real_root);
52231 + memset(&real_root, 0, sizeof(real_root));
52232 +
52233 + /* free all object hash tables */
52234 +
52235 + FOR_EACH_ROLE_START(r)
52236 + if (r->subj_hash == NULL)
52237 + goto next_role;
52238 + FOR_EACH_SUBJECT_START(r, s, x)
52239 + if (s->obj_hash == NULL)
52240 + break;
52241 + if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
52242 + kfree(s->obj_hash);
52243 + else
52244 + vfree(s->obj_hash);
52245 + FOR_EACH_SUBJECT_END(s, x)
52246 + FOR_EACH_NESTED_SUBJECT_START(r, s)
52247 + if (s->obj_hash == NULL)
52248 + break;
52249 + if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
52250 + kfree(s->obj_hash);
52251 + else
52252 + vfree(s->obj_hash);
52253 + FOR_EACH_NESTED_SUBJECT_END(s)
52254 + if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
52255 + kfree(r->subj_hash);
52256 + else
52257 + vfree(r->subj_hash);
52258 + r->subj_hash = NULL;
52259 +next_role:
52260 + FOR_EACH_ROLE_END(r)
52261 +
52262 + acl_free_all();
52263 +
52264 + if (acl_role_set.r_hash) {
52265 + if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
52266 + PAGE_SIZE)
52267 + kfree(acl_role_set.r_hash);
52268 + else
52269 + vfree(acl_role_set.r_hash);
52270 + }
52271 + if (name_set.n_hash) {
52272 + if ((name_set.n_size * sizeof (struct name_entry *)) <=
52273 + PAGE_SIZE)
52274 + kfree(name_set.n_hash);
52275 + else
52276 + vfree(name_set.n_hash);
52277 + }
52278 +
52279 + if (inodev_set.i_hash) {
52280 + if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
52281 + PAGE_SIZE)
52282 + kfree(inodev_set.i_hash);
52283 + else
52284 + vfree(inodev_set.i_hash);
52285 + }
52286 +
52287 + gr_free_uidset();
52288 +
52289 + memset(&name_set, 0, sizeof (struct name_db));
52290 + memset(&inodev_set, 0, sizeof (struct inodev_db));
52291 + memset(&acl_role_set, 0, sizeof (struct acl_role_db));
52292 + memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
52293 +
52294 + default_role = NULL;
52295 + kernel_role = NULL;
52296 + role_list = NULL;
52297 +
52298 + return;
52299 +}
52300 +
52301 +static __u32
52302 +count_user_objs(struct acl_object_label *userp)
52303 +{
52304 + struct acl_object_label o_tmp;
52305 + __u32 num = 0;
52306 +
52307 + while (userp) {
52308 + if (copy_from_user(&o_tmp, userp,
52309 + sizeof (struct acl_object_label)))
52310 + break;
52311 +
52312 + userp = o_tmp.prev;
52313 + num++;
52314 + }
52315 +
52316 + return num;
52317 +}
52318 +
52319 +static struct acl_subject_label *
52320 +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
52321 +
52322 +static int
52323 +copy_user_glob(struct acl_object_label *obj)
52324 +{
52325 + struct acl_object_label *g_tmp, **guser;
52326 + unsigned int len;
52327 + char *tmp;
52328 +
52329 + if (obj->globbed == NULL)
52330 + return 0;
52331 +
52332 + guser = &obj->globbed;
52333 + while (*guser) {
52334 + g_tmp = (struct acl_object_label *)
52335 + acl_alloc(sizeof (struct acl_object_label));
52336 + if (g_tmp == NULL)
52337 + return -ENOMEM;
52338 +
52339 + if (copy_from_user(g_tmp, *guser,
52340 + sizeof (struct acl_object_label)))
52341 + return -EFAULT;
52342 +
52343 + len = strnlen_user(g_tmp->filename, PATH_MAX);
52344 +
52345 + if (!len || len >= PATH_MAX)
52346 + return -EINVAL;
52347 +
52348 + if ((tmp = (char *) acl_alloc(len)) == NULL)
52349 + return -ENOMEM;
52350 +
52351 + if (copy_from_user(tmp, g_tmp->filename, len))
52352 + return -EFAULT;
52353 + tmp[len-1] = '\0';
52354 + g_tmp->filename = tmp;
52355 +
52356 + *guser = g_tmp;
52357 + guser = &(g_tmp->next);
52358 + }
52359 +
52360 + return 0;
52361 +}
52362 +
52363 +static int
52364 +copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
52365 + struct acl_role_label *role)
52366 +{
52367 + struct acl_object_label *o_tmp;
52368 + unsigned int len;
52369 + int ret;
52370 + char *tmp;
52371 +
52372 + while (userp) {
52373 + if ((o_tmp = (struct acl_object_label *)
52374 + acl_alloc(sizeof (struct acl_object_label))) == NULL)
52375 + return -ENOMEM;
52376 +
52377 + if (copy_from_user(o_tmp, userp,
52378 + sizeof (struct acl_object_label)))
52379 + return -EFAULT;
52380 +
52381 + userp = o_tmp->prev;
52382 +
52383 + len = strnlen_user(o_tmp->filename, PATH_MAX);
52384 +
52385 + if (!len || len >= PATH_MAX)
52386 + return -EINVAL;
52387 +
52388 + if ((tmp = (char *) acl_alloc(len)) == NULL)
52389 + return -ENOMEM;
52390 +
52391 + if (copy_from_user(tmp, o_tmp->filename, len))
52392 + return -EFAULT;
52393 + tmp[len-1] = '\0';
52394 + o_tmp->filename = tmp;
52395 +
52396 + insert_acl_obj_label(o_tmp, subj);
52397 + if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
52398 + o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
52399 + return -ENOMEM;
52400 +
52401 + ret = copy_user_glob(o_tmp);
52402 + if (ret)
52403 + return ret;
52404 +
52405 + if (o_tmp->nested) {
52406 + o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
52407 + if (IS_ERR(o_tmp->nested))
52408 + return PTR_ERR(o_tmp->nested);
52409 +
52410 + /* insert into nested subject list */
52411 + o_tmp->nested->next = role->hash->first;
52412 + role->hash->first = o_tmp->nested;
52413 + }
52414 + }
52415 +
52416 + return 0;
52417 +}
52418 +
52419 +static __u32
52420 +count_user_subjs(struct acl_subject_label *userp)
52421 +{
52422 + struct acl_subject_label s_tmp;
52423 + __u32 num = 0;
52424 +
52425 + while (userp) {
52426 + if (copy_from_user(&s_tmp, userp,
52427 + sizeof (struct acl_subject_label)))
52428 + break;
52429 +
52430 + userp = s_tmp.prev;
52431 + /* do not count nested subjects against this count, since
52432 + they are not included in the hash table, but are
52433 + attached to objects. We have already counted
52434 + the subjects in userspace for the allocation
52435 + stack
52436 + */
52437 + if (!(s_tmp.mode & GR_NESTED))
52438 + num++;
52439 + }
52440 +
52441 + return num;
52442 +}
52443 +
52444 +static int
52445 +copy_user_allowedips(struct acl_role_label *rolep)
52446 +{
52447 + struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
52448 +
52449 + ruserip = rolep->allowed_ips;
52450 +
52451 + while (ruserip) {
52452 + rlast = rtmp;
52453 +
52454 + if ((rtmp = (struct role_allowed_ip *)
52455 + acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
52456 + return -ENOMEM;
52457 +
52458 + if (copy_from_user(rtmp, ruserip,
52459 + sizeof (struct role_allowed_ip)))
52460 + return -EFAULT;
52461 +
52462 + ruserip = rtmp->prev;
52463 +
52464 + if (!rlast) {
52465 + rtmp->prev = NULL;
52466 + rolep->allowed_ips = rtmp;
52467 + } else {
52468 + rlast->next = rtmp;
52469 + rtmp->prev = rlast;
52470 + }
52471 +
52472 + if (!ruserip)
52473 + rtmp->next = NULL;
52474 + }
52475 +
52476 + return 0;
52477 +}
52478 +
52479 +static int
52480 +copy_user_transitions(struct acl_role_label *rolep)
52481 +{
52482 + struct role_transition *rusertp, *rtmp = NULL, *rlast;
52483 +
52484 + unsigned int len;
52485 + char *tmp;
52486 +
52487 + rusertp = rolep->transitions;
52488 +
52489 + while (rusertp) {
52490 + rlast = rtmp;
52491 +
52492 + if ((rtmp = (struct role_transition *)
52493 + acl_alloc(sizeof (struct role_transition))) == NULL)
52494 + return -ENOMEM;
52495 +
52496 + if (copy_from_user(rtmp, rusertp,
52497 + sizeof (struct role_transition)))
52498 + return -EFAULT;
52499 +
52500 + rusertp = rtmp->prev;
52501 +
52502 + len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
52503 +
52504 + if (!len || len >= GR_SPROLE_LEN)
52505 + return -EINVAL;
52506 +
52507 + if ((tmp = (char *) acl_alloc(len)) == NULL)
52508 + return -ENOMEM;
52509 +
52510 + if (copy_from_user(tmp, rtmp->rolename, len))
52511 + return -EFAULT;
52512 + tmp[len-1] = '\0';
52513 + rtmp->rolename = tmp;
52514 +
52515 + if (!rlast) {
52516 + rtmp->prev = NULL;
52517 + rolep->transitions = rtmp;
52518 + } else {
52519 + rlast->next = rtmp;
52520 + rtmp->prev = rlast;
52521 + }
52522 +
52523 + if (!rusertp)
52524 + rtmp->next = NULL;
52525 + }
52526 +
52527 + return 0;
52528 +}
52529 +
52530 +static struct acl_subject_label *
52531 +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
52532 +{
52533 + struct acl_subject_label *s_tmp = NULL, *s_tmp2;
52534 + unsigned int len;
52535 + char *tmp;
52536 + __u32 num_objs;
52537 + struct acl_ip_label **i_tmp, *i_utmp2;
52538 + struct gr_hash_struct ghash;
52539 + struct subject_map *subjmap;
52540 + unsigned int i_num;
52541 + int err;
52542 +
52543 + s_tmp = lookup_subject_map(userp);
52544 +
52545 + /* we've already copied this subject into the kernel, just return
52546 + the reference to it, and don't copy it over again
52547 + */
52548 + if (s_tmp)
52549 + return(s_tmp);
52550 +
52551 + if ((s_tmp = (struct acl_subject_label *)
52552 + acl_alloc(sizeof (struct acl_subject_label))) == NULL)
52553 + return ERR_PTR(-ENOMEM);
52554 +
52555 + subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
52556 + if (subjmap == NULL)
52557 + return ERR_PTR(-ENOMEM);
52558 +
52559 + subjmap->user = userp;
52560 + subjmap->kernel = s_tmp;
52561 + insert_subj_map_entry(subjmap);
52562 +
52563 + if (copy_from_user(s_tmp, userp,
52564 + sizeof (struct acl_subject_label)))
52565 + return ERR_PTR(-EFAULT);
52566 +
52567 + len = strnlen_user(s_tmp->filename, PATH_MAX);
52568 +
52569 + if (!len || len >= PATH_MAX)
52570 + return ERR_PTR(-EINVAL);
52571 +
52572 + if ((tmp = (char *) acl_alloc(len)) == NULL)
52573 + return ERR_PTR(-ENOMEM);
52574 +
52575 + if (copy_from_user(tmp, s_tmp->filename, len))
52576 + return ERR_PTR(-EFAULT);
52577 + tmp[len-1] = '\0';
52578 + s_tmp->filename = tmp;
52579 +
52580 + if (!strcmp(s_tmp->filename, "/"))
52581 + role->root_label = s_tmp;
52582 +
52583 + if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
52584 + return ERR_PTR(-EFAULT);
52585 +
52586 + /* copy user and group transition tables */
52587 +
52588 + if (s_tmp->user_trans_num) {
52589 + uid_t *uidlist;
52590 +
52591 + uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
52592 + if (uidlist == NULL)
52593 + return ERR_PTR(-ENOMEM);
52594 + if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
52595 + return ERR_PTR(-EFAULT);
52596 +
52597 + s_tmp->user_transitions = uidlist;
52598 + }
52599 +
52600 + if (s_tmp->group_trans_num) {
52601 + gid_t *gidlist;
52602 +
52603 + gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
52604 + if (gidlist == NULL)
52605 + return ERR_PTR(-ENOMEM);
52606 + if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
52607 + return ERR_PTR(-EFAULT);
52608 +
52609 + s_tmp->group_transitions = gidlist;
52610 + }
52611 +
52612 + /* set up object hash table */
52613 + num_objs = count_user_objs(ghash.first);
52614 +
52615 + s_tmp->obj_hash_size = num_objs;
52616 + s_tmp->obj_hash =
52617 + (struct acl_object_label **)
52618 + create_table(&(s_tmp->obj_hash_size), sizeof(void *));
52619 +
52620 + if (!s_tmp->obj_hash)
52621 + return ERR_PTR(-ENOMEM);
52622 +
52623 + memset(s_tmp->obj_hash, 0,
52624 + s_tmp->obj_hash_size *
52625 + sizeof (struct acl_object_label *));
52626 +
52627 + /* add in objects */
52628 + err = copy_user_objs(ghash.first, s_tmp, role);
52629 +
52630 + if (err)
52631 + return ERR_PTR(err);
52632 +
52633 + /* set pointer for parent subject */
52634 + if (s_tmp->parent_subject) {
52635 + s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
52636 +
52637 + if (IS_ERR(s_tmp2))
52638 + return s_tmp2;
52639 +
52640 + s_tmp->parent_subject = s_tmp2;
52641 + }
52642 +
52643 + /* add in ip acls */
52644 +
52645 + if (!s_tmp->ip_num) {
52646 + s_tmp->ips = NULL;
52647 + goto insert;
52648 + }
52649 +
52650 + i_tmp =
52651 + (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
52652 + sizeof (struct acl_ip_label *));
52653 +
52654 + if (!i_tmp)
52655 + return ERR_PTR(-ENOMEM);
52656 +
52657 + for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
52658 + *(i_tmp + i_num) =
52659 + (struct acl_ip_label *)
52660 + acl_alloc(sizeof (struct acl_ip_label));
52661 + if (!*(i_tmp + i_num))
52662 + return ERR_PTR(-ENOMEM);
52663 +
52664 + if (copy_from_user
52665 + (&i_utmp2, s_tmp->ips + i_num,
52666 + sizeof (struct acl_ip_label *)))
52667 + return ERR_PTR(-EFAULT);
52668 +
52669 + if (copy_from_user
52670 + (*(i_tmp + i_num), i_utmp2,
52671 + sizeof (struct acl_ip_label)))
52672 + return ERR_PTR(-EFAULT);
52673 +
52674 + if ((*(i_tmp + i_num))->iface == NULL)
52675 + continue;
52676 +
52677 + len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
52678 + if (!len || len >= IFNAMSIZ)
52679 + return ERR_PTR(-EINVAL);
52680 + tmp = acl_alloc(len);
52681 + if (tmp == NULL)
52682 + return ERR_PTR(-ENOMEM);
52683 + if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
52684 + return ERR_PTR(-EFAULT);
52685 + (*(i_tmp + i_num))->iface = tmp;
52686 + }
52687 +
52688 + s_tmp->ips = i_tmp;
52689 +
52690 +insert:
52691 + if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
52692 + s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
52693 + return ERR_PTR(-ENOMEM);
52694 +
52695 + return s_tmp;
52696 +}
52697 +
52698 +static int
52699 +copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
52700 +{
52701 + struct acl_subject_label s_pre;
52702 + struct acl_subject_label * ret;
52703 + int err;
52704 +
52705 + while (userp) {
52706 + if (copy_from_user(&s_pre, userp,
52707 + sizeof (struct acl_subject_label)))
52708 + return -EFAULT;
52709 +
52710 + /* do not add nested subjects here, add
52711 + while parsing objects
52712 + */
52713 +
52714 + if (s_pre.mode & GR_NESTED) {
52715 + userp = s_pre.prev;
52716 + continue;
52717 + }
52718 +
52719 + ret = do_copy_user_subj(userp, role);
52720 +
52721 + err = PTR_ERR(ret);
52722 + if (IS_ERR(ret))
52723 + return err;
52724 +
52725 + insert_acl_subj_label(ret, role);
52726 +
52727 + userp = s_pre.prev;
52728 + }
52729 +
52730 + return 0;
52731 +}
52732 +
52733 +static int
52734 +copy_user_acl(struct gr_arg *arg)
52735 +{
52736 + struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
52737 + struct sprole_pw *sptmp;
52738 + struct gr_hash_struct *ghash;
52739 + uid_t *domainlist;
52740 + unsigned int r_num;
52741 + unsigned int len;
52742 + char *tmp;
52743 + int err = 0;
52744 + __u16 i;
52745 + __u32 num_subjs;
52746 +
52747 + /* we need a default and kernel role */
52748 + if (arg->role_db.num_roles < 2)
52749 + return -EINVAL;
52750 +
52751 + /* copy special role authentication info from userspace */
52752 +
52753 + num_sprole_pws = arg->num_sprole_pws;
52754 + acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
52755 +
52756 + if (!acl_special_roles && num_sprole_pws)
52757 + return -ENOMEM;
52758 +
52759 + for (i = 0; i < num_sprole_pws; i++) {
52760 + sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
52761 + if (!sptmp)
52762 + return -ENOMEM;
52763 + if (copy_from_user(sptmp, arg->sprole_pws + i,
52764 + sizeof (struct sprole_pw)))
52765 + return -EFAULT;
52766 +
52767 + len = strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
52768 +
52769 + if (!len || len >= GR_SPROLE_LEN)
52770 + return -EINVAL;
52771 +
52772 + if ((tmp = (char *) acl_alloc(len)) == NULL)
52773 + return -ENOMEM;
52774 +
52775 + if (copy_from_user(tmp, sptmp->rolename, len))
52776 + return -EFAULT;
52777 +
52778 + tmp[len-1] = '\0';
52779 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
52780 + printk(KERN_ALERT "Copying special role %s\n", tmp);
52781 +#endif
52782 + sptmp->rolename = tmp;
52783 + acl_special_roles[i] = sptmp;
52784 + }
52785 +
52786 + r_utmp = (struct acl_role_label **) arg->role_db.r_table;
52787 +
52788 + for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
52789 + r_tmp = acl_alloc(sizeof (struct acl_role_label));
52790 +
52791 + if (!r_tmp)
52792 + return -ENOMEM;
52793 +
52794 + if (copy_from_user(&r_utmp2, r_utmp + r_num,
52795 + sizeof (struct acl_role_label *)))
52796 + return -EFAULT;
52797 +
52798 + if (copy_from_user(r_tmp, r_utmp2,
52799 + sizeof (struct acl_role_label)))
52800 + return -EFAULT;
52801 +
52802 + len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
52803 +
52804 + if (!len || len >= PATH_MAX)
52805 + return -EINVAL;
52806 +
52807 + if ((tmp = (char *) acl_alloc(len)) == NULL)
52808 + return -ENOMEM;
52809 +
52810 + if (copy_from_user(tmp, r_tmp->rolename, len))
52811 + return -EFAULT;
52812 +
52813 + tmp[len-1] = '\0';
52814 + r_tmp->rolename = tmp;
52815 +
52816 + if (!strcmp(r_tmp->rolename, "default")
52817 + && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
52818 + default_role = r_tmp;
52819 + } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
52820 + kernel_role = r_tmp;
52821 + }
52822 +
52823 + if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL)
52824 + return -ENOMEM;
52825 +
52826 + if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct)))
52827 + return -EFAULT;
52828 +
52829 + r_tmp->hash = ghash;
52830 +
52831 + num_subjs = count_user_subjs(r_tmp->hash->first);
52832 +
52833 + r_tmp->subj_hash_size = num_subjs;
52834 + r_tmp->subj_hash =
52835 + (struct acl_subject_label **)
52836 + create_table(&(r_tmp->subj_hash_size), sizeof(void *));
52837 +
52838 + if (!r_tmp->subj_hash)
52839 + return -ENOMEM;
52840 +
52841 + err = copy_user_allowedips(r_tmp);
52842 + if (err)
52843 + return err;
52844 +
52845 + /* copy domain info */
52846 + if (r_tmp->domain_children != NULL) {
52847 + domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
52848 + if (domainlist == NULL)
52849 + return -ENOMEM;
52850 +
52851 + if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t)))
52852 + return -EFAULT;
52853 +
52854 + r_tmp->domain_children = domainlist;
52855 + }
52856 +
52857 + err = copy_user_transitions(r_tmp);
52858 + if (err)
52859 + return err;
52860 +
52861 + memset(r_tmp->subj_hash, 0,
52862 + r_tmp->subj_hash_size *
52863 + sizeof (struct acl_subject_label *));
52864 +
52865 + err = copy_user_subjs(r_tmp->hash->first, r_tmp);
52866 +
52867 + if (err)
52868 + return err;
52869 +
52870 + /* set nested subject list to null */
52871 + r_tmp->hash->first = NULL;
52872 +
52873 + insert_acl_role_label(r_tmp);
52874 + }
52875 +
52876 + if (default_role == NULL || kernel_role == NULL)
52877 + return -EINVAL;
52878 +
52879 + return err;
52880 +}
52881 +
52882 +static int
52883 +gracl_init(struct gr_arg *args)
52884 +{
52885 + int error = 0;
52886 +
52887 + memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
52888 + memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
52889 +
52890 + if (init_variables(args)) {
52891 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
52892 + error = -ENOMEM;
52893 + free_variables();
52894 + goto out;
52895 + }
52896 +
52897 + error = copy_user_acl(args);
52898 + free_init_variables();
52899 + if (error) {
52900 + free_variables();
52901 + goto out;
52902 + }
52903 +
52904 + if ((error = gr_set_acls(0))) {
52905 + free_variables();
52906 + goto out;
52907 + }
52908 +
52909 + pax_open_kernel();
52910 + gr_status |= GR_READY;
52911 + pax_close_kernel();
52912 +
52913 + out:
52914 + return error;
52915 +}
52916 +
52917 +/* derived from glibc fnmatch() 0: match, 1: no match*/
52918 +
52919 +static int
52920 +glob_match(const char *p, const char *n)
52921 +{
52922 + char c;
52923 +
52924 + while ((c = *p++) != '\0') {
52925 + switch (c) {
52926 + case '?':
52927 + if (*n == '\0')
52928 + return 1;
52929 + else if (*n == '/')
52930 + return 1;
52931 + break;
52932 + case '\\':
52933 + if (*n != c)
52934 + return 1;
52935 + break;
52936 + case '*':
52937 + for (c = *p++; c == '?' || c == '*'; c = *p++) {
52938 + if (*n == '/')
52939 + return 1;
52940 + else if (c == '?') {
52941 + if (*n == '\0')
52942 + return 1;
52943 + else
52944 + ++n;
52945 + }
52946 + }
52947 + if (c == '\0') {
52948 + return 0;
52949 + } else {
52950 + const char *endp;
52951 +
52952 + if ((endp = strchr(n, '/')) == NULL)
52953 + endp = n + strlen(n);
52954 +
52955 + if (c == '[') {
52956 + for (--p; n < endp; ++n)
52957 + if (!glob_match(p, n))
52958 + return 0;
52959 + } else if (c == '/') {
52960 + while (*n != '\0' && *n != '/')
52961 + ++n;
52962 + if (*n == '/' && !glob_match(p, n + 1))
52963 + return 0;
52964 + } else {
52965 + for (--p; n < endp; ++n)
52966 + if (*n == c && !glob_match(p, n))
52967 + return 0;
52968 + }
52969 +
52970 + return 1;
52971 + }
52972 + case '[':
52973 + {
52974 + int not;
52975 + char cold;
52976 +
52977 + if (*n == '\0' || *n == '/')
52978 + return 1;
52979 +
52980 + not = (*p == '!' || *p == '^');
52981 + if (not)
52982 + ++p;
52983 +
52984 + c = *p++;
52985 + for (;;) {
52986 + unsigned char fn = (unsigned char)*n;
52987 +
52988 + if (c == '\0')
52989 + return 1;
52990 + else {
52991 + if (c == fn)
52992 + goto matched;
52993 + cold = c;
52994 + c = *p++;
52995 +
52996 + if (c == '-' && *p != ']') {
52997 + unsigned char cend = *p++;
52998 +
52999 + if (cend == '\0')
53000 + return 1;
53001 +
53002 + if (cold <= fn && fn <= cend)
53003 + goto matched;
53004 +
53005 + c = *p++;
53006 + }
53007 + }
53008 +
53009 + if (c == ']')
53010 + break;
53011 + }
53012 + if (!not)
53013 + return 1;
53014 + break;
53015 + matched:
53016 + while (c != ']') {
53017 + if (c == '\0')
53018 + return 1;
53019 +
53020 + c = *p++;
53021 + }
53022 + if (not)
53023 + return 1;
53024 + }
53025 + break;
53026 + default:
53027 + if (c != *n)
53028 + return 1;
53029 + }
53030 +
53031 + ++n;
53032 + }
53033 +
53034 + if (*n == '\0')
53035 + return 0;
53036 +
53037 + if (*n == '/')
53038 + return 0;
53039 +
53040 + return 1;
53041 +}
53042 +
53043 +static struct acl_object_label *
53044 +chk_glob_label(struct acl_object_label *globbed,
53045 + const struct dentry *dentry, const struct vfsmount *mnt, char **path)
53046 +{
53047 + struct acl_object_label *tmp;
53048 +
53049 + if (*path == NULL)
53050 + *path = gr_to_filename_nolock(dentry, mnt);
53051 +
53052 + tmp = globbed;
53053 +
53054 + while (tmp) {
53055 + if (!glob_match(tmp->filename, *path))
53056 + return tmp;
53057 + tmp = tmp->next;
53058 + }
53059 +
53060 + return NULL;
53061 +}
53062 +
53063 +static struct acl_object_label *
53064 +__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
53065 + const ino_t curr_ino, const dev_t curr_dev,
53066 + const struct acl_subject_label *subj, char **path, const int checkglob)
53067 +{
53068 + struct acl_subject_label *tmpsubj;
53069 + struct acl_object_label *retval;
53070 + struct acl_object_label *retval2;
53071 +
53072 + tmpsubj = (struct acl_subject_label *) subj;
53073 + read_lock(&gr_inode_lock);
53074 + do {
53075 + retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
53076 + if (retval) {
53077 + if (checkglob && retval->globbed) {
53078 + retval2 = chk_glob_label(retval->globbed, orig_dentry, orig_mnt, path);
53079 + if (retval2)
53080 + retval = retval2;
53081 + }
53082 + break;
53083 + }
53084 + } while ((tmpsubj = tmpsubj->parent_subject));
53085 + read_unlock(&gr_inode_lock);
53086 +
53087 + return retval;
53088 +}
53089 +
53090 +static __inline__ struct acl_object_label *
53091 +full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
53092 + struct dentry *curr_dentry,
53093 + const struct acl_subject_label *subj, char **path, const int checkglob)
53094 +{
53095 + int newglob = checkglob;
53096 + ino_t inode;
53097 + dev_t device;
53098 +
53099 + /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
53100 + as we don't want a / * rule to match instead of the / object
53101 + don't do this for create lookups that call this function though, since they're looking up
53102 + on the parent and thus need globbing checks on all paths
53103 + */
53104 + if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
53105 + newglob = GR_NO_GLOB;
53106 +
53107 + spin_lock(&curr_dentry->d_lock);
53108 + inode = curr_dentry->d_inode->i_ino;
53109 + device = __get_dev(curr_dentry);
53110 + spin_unlock(&curr_dentry->d_lock);
53111 +
53112 + return __full_lookup(orig_dentry, orig_mnt, inode, device, subj, path, newglob);
53113 +}
53114 +
53115 +static struct acl_object_label *
53116 +__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53117 + const struct acl_subject_label *subj, char *path, const int checkglob)
53118 +{
53119 + struct dentry *dentry = (struct dentry *) l_dentry;
53120 + struct vfsmount *mnt = (struct vfsmount *) l_mnt;
53121 + struct mount *real_mnt = real_mount(mnt);
53122 + struct acl_object_label *retval;
53123 + struct dentry *parent;
53124 +
53125 + write_seqlock(&rename_lock);
53126 + br_read_lock(&vfsmount_lock);
53127 +
53128 + if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
53129 +#ifdef CONFIG_NET
53130 + mnt == sock_mnt ||
53131 +#endif
53132 +#ifdef CONFIG_HUGETLBFS
53133 + (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
53134 +#endif
53135 + /* ignore Eric Biederman */
53136 + IS_PRIVATE(l_dentry->d_inode))) {
53137 + retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw;
53138 + goto out;
53139 + }
53140 +
53141 + for (;;) {
53142 + if (dentry == real_root.dentry && mnt == real_root.mnt)
53143 + break;
53144 +
53145 + if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
53146 + if (!mnt_has_parent(real_mnt))
53147 + break;
53148 +
53149 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53150 + if (retval != NULL)
53151 + goto out;
53152 +
53153 + dentry = real_mnt->mnt_mountpoint;
53154 + real_mnt = real_mnt->mnt_parent;
53155 + mnt = &real_mnt->mnt;
53156 + continue;
53157 + }
53158 +
53159 + parent = dentry->d_parent;
53160 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53161 + if (retval != NULL)
53162 + goto out;
53163 +
53164 + dentry = parent;
53165 + }
53166 +
53167 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53168 +
53169 + /* real_root is pinned so we don't have to hold a reference */
53170 + if (retval == NULL)
53171 + retval = full_lookup(l_dentry, l_mnt, real_root.dentry, subj, &path, checkglob);
53172 +out:
53173 + br_read_unlock(&vfsmount_lock);
53174 + write_sequnlock(&rename_lock);
53175 +
53176 + BUG_ON(retval == NULL);
53177 +
53178 + return retval;
53179 +}
53180 +
53181 +static __inline__ struct acl_object_label *
53182 +chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53183 + const struct acl_subject_label *subj)
53184 +{
53185 + char *path = NULL;
53186 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
53187 +}
53188 +
53189 +static __inline__ struct acl_object_label *
53190 +chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53191 + const struct acl_subject_label *subj)
53192 +{
53193 + char *path = NULL;
53194 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
53195 +}
53196 +
53197 +static __inline__ struct acl_object_label *
53198 +chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53199 + const struct acl_subject_label *subj, char *path)
53200 +{
53201 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
53202 +}
53203 +
53204 +static struct acl_subject_label *
53205 +chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53206 + const struct acl_role_label *role)
53207 +{
53208 + struct dentry *dentry = (struct dentry *) l_dentry;
53209 + struct vfsmount *mnt = (struct vfsmount *) l_mnt;
53210 + struct mount *real_mnt = real_mount(mnt);
53211 + struct acl_subject_label *retval;
53212 + struct dentry *parent;
53213 +
53214 + write_seqlock(&rename_lock);
53215 + br_read_lock(&vfsmount_lock);
53216 +
53217 + for (;;) {
53218 + if (dentry == real_root.dentry && mnt == real_root.mnt)
53219 + break;
53220 + if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
53221 + if (!mnt_has_parent(real_mnt))
53222 + break;
53223 +
53224 + spin_lock(&dentry->d_lock);
53225 + read_lock(&gr_inode_lock);
53226 + retval =
53227 + lookup_acl_subj_label(dentry->d_inode->i_ino,
53228 + __get_dev(dentry), role);
53229 + read_unlock(&gr_inode_lock);
53230 + spin_unlock(&dentry->d_lock);
53231 + if (retval != NULL)
53232 + goto out;
53233 +
53234 + dentry = real_mnt->mnt_mountpoint;
53235 + real_mnt = real_mnt->mnt_parent;
53236 + mnt = &real_mnt->mnt;
53237 + continue;
53238 + }
53239 +
53240 + spin_lock(&dentry->d_lock);
53241 + read_lock(&gr_inode_lock);
53242 + retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
53243 + __get_dev(dentry), role);
53244 + read_unlock(&gr_inode_lock);
53245 + parent = dentry->d_parent;
53246 + spin_unlock(&dentry->d_lock);
53247 +
53248 + if (retval != NULL)
53249 + goto out;
53250 +
53251 + dentry = parent;
53252 + }
53253 +
53254 + spin_lock(&dentry->d_lock);
53255 + read_lock(&gr_inode_lock);
53256 + retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
53257 + __get_dev(dentry), role);
53258 + read_unlock(&gr_inode_lock);
53259 + spin_unlock(&dentry->d_lock);
53260 +
53261 + if (unlikely(retval == NULL)) {
53262 + /* real_root is pinned, we don't need to hold a reference */
53263 + read_lock(&gr_inode_lock);
53264 + retval = lookup_acl_subj_label(real_root.dentry->d_inode->i_ino,
53265 + __get_dev(real_root.dentry), role);
53266 + read_unlock(&gr_inode_lock);
53267 + }
53268 +out:
53269 + br_read_unlock(&vfsmount_lock);
53270 + write_sequnlock(&rename_lock);
53271 +
53272 + BUG_ON(retval == NULL);
53273 +
53274 + return retval;
53275 +}
53276 +
53277 +static void
53278 +gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
53279 +{
53280 + struct task_struct *task = current;
53281 + const struct cred *cred = current_cred();
53282 +
53283 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
53284 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53285 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
53286 + 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
53287 +
53288 + return;
53289 +}
53290 +
53291 +static void
53292 +gr_log_learn_id_change(const char type, const unsigned int real,
53293 + const unsigned int effective, const unsigned int fs)
53294 +{
53295 + struct task_struct *task = current;
53296 + const struct cred *cred = current_cred();
53297 +
53298 + security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
53299 + cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53300 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
53301 + type, real, effective, fs, &task->signal->saved_ip);
53302 +
53303 + return;
53304 +}
53305 +
53306 +__u32
53307 +gr_search_file(const struct dentry * dentry, const __u32 mode,
53308 + const struct vfsmount * mnt)
53309 +{
53310 + __u32 retval = mode;
53311 + struct acl_subject_label *curracl;
53312 + struct acl_object_label *currobj;
53313 +
53314 + if (unlikely(!(gr_status & GR_READY)))
53315 + return (mode & ~GR_AUDITS);
53316 +
53317 + curracl = current->acl;
53318 +
53319 + currobj = chk_obj_label(dentry, mnt, curracl);
53320 + retval = currobj->mode & mode;
53321 +
53322 + /* if we're opening a specified transfer file for writing
53323 + (e.g. /dev/initctl), then transfer our role to init
53324 + */
53325 + if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
53326 + current->role->roletype & GR_ROLE_PERSIST)) {
53327 + struct task_struct *task = init_pid_ns.child_reaper;
53328 +
53329 + if (task->role != current->role) {
53330 + task->acl_sp_role = 0;
53331 + task->acl_role_id = current->acl_role_id;
53332 + task->role = current->role;
53333 + rcu_read_lock();
53334 + read_lock(&grsec_exec_file_lock);
53335 + gr_apply_subject_to_task(task);
53336 + read_unlock(&grsec_exec_file_lock);
53337 + rcu_read_unlock();
53338 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
53339 + }
53340 + }
53341 +
53342 + if (unlikely
53343 + ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
53344 + && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
53345 + __u32 new_mode = mode;
53346 +
53347 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53348 +
53349 + retval = new_mode;
53350 +
53351 + if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
53352 + new_mode |= GR_INHERIT;
53353 +
53354 + if (!(mode & GR_NOLEARN))
53355 + gr_log_learn(dentry, mnt, new_mode);
53356 + }
53357 +
53358 + return retval;
53359 +}
53360 +
53361 +struct acl_object_label *gr_get_create_object(const struct dentry *new_dentry,
53362 + const struct dentry *parent,
53363 + const struct vfsmount *mnt)
53364 +{
53365 + struct name_entry *match;
53366 + struct acl_object_label *matchpo;
53367 + struct acl_subject_label *curracl;
53368 + char *path;
53369 +
53370 + if (unlikely(!(gr_status & GR_READY)))
53371 + return NULL;
53372 +
53373 + preempt_disable();
53374 + path = gr_to_filename_rbac(new_dentry, mnt);
53375 + match = lookup_name_entry_create(path);
53376 +
53377 + curracl = current->acl;
53378 +
53379 + if (match) {
53380 + read_lock(&gr_inode_lock);
53381 + matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
53382 + read_unlock(&gr_inode_lock);
53383 +
53384 + if (matchpo) {
53385 + preempt_enable();
53386 + return matchpo;
53387 + }
53388 + }
53389 +
53390 + // lookup parent
53391 +
53392 + matchpo = chk_obj_create_label(parent, mnt, curracl, path);
53393 +
53394 + preempt_enable();
53395 + return matchpo;
53396 +}
53397 +
53398 +__u32
53399 +gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
53400 + const struct vfsmount * mnt, const __u32 mode)
53401 +{
53402 + struct acl_object_label *matchpo;
53403 + __u32 retval;
53404 +
53405 + if (unlikely(!(gr_status & GR_READY)))
53406 + return (mode & ~GR_AUDITS);
53407 +
53408 + matchpo = gr_get_create_object(new_dentry, parent, mnt);
53409 +
53410 + retval = matchpo->mode & mode;
53411 +
53412 + if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
53413 + && (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))) {
53414 + __u32 new_mode = mode;
53415 +
53416 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53417 +
53418 + gr_log_learn(new_dentry, mnt, new_mode);
53419 + return new_mode;
53420 + }
53421 +
53422 + return retval;
53423 +}
53424 +
53425 +__u32
53426 +gr_check_link(const struct dentry * new_dentry,
53427 + const struct dentry * parent_dentry,
53428 + const struct vfsmount * parent_mnt,
53429 + const struct dentry * old_dentry, const struct vfsmount * old_mnt)
53430 +{
53431 + struct acl_object_label *obj;
53432 + __u32 oldmode, newmode;
53433 + __u32 needmode;
53434 + __u32 checkmodes = GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC | GR_SETID | GR_READ |
53435 + GR_DELETE | GR_INHERIT;
53436 +
53437 + if (unlikely(!(gr_status & GR_READY)))
53438 + return (GR_CREATE | GR_LINK);
53439 +
53440 + obj = chk_obj_label(old_dentry, old_mnt, current->acl);
53441 + oldmode = obj->mode;
53442 +
53443 + obj = gr_get_create_object(new_dentry, parent_dentry, parent_mnt);
53444 + newmode = obj->mode;
53445 +
53446 + needmode = newmode & checkmodes;
53447 +
53448 + // old name for hardlink must have at least the permissions of the new name
53449 + if ((oldmode & needmode) != needmode)
53450 + goto bad;
53451 +
53452 + // if old name had restrictions/auditing, make sure the new name does as well
53453 + needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
53454 +
53455 + // don't allow hardlinking of suid/sgid/fcapped files without permission
53456 + if (is_privileged_binary(old_dentry))
53457 + needmode |= GR_SETID;
53458 +
53459 + if ((newmode & needmode) != needmode)
53460 + goto bad;
53461 +
53462 + // enforce minimum permissions
53463 + if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
53464 + return newmode;
53465 +bad:
53466 + needmode = oldmode;
53467 + if (is_privileged_binary(old_dentry))
53468 + needmode |= GR_SETID;
53469 +
53470 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
53471 + gr_log_learn(old_dentry, old_mnt, needmode | GR_CREATE | GR_LINK);
53472 + return (GR_CREATE | GR_LINK);
53473 + } else if (newmode & GR_SUPPRESS)
53474 + return GR_SUPPRESS;
53475 + else
53476 + return 0;
53477 +}
53478 +
53479 +int
53480 +gr_check_hidden_task(const struct task_struct *task)
53481 +{
53482 + if (unlikely(!(gr_status & GR_READY)))
53483 + return 0;
53484 +
53485 + if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
53486 + return 1;
53487 +
53488 + return 0;
53489 +}
53490 +
53491 +int
53492 +gr_check_protected_task(const struct task_struct *task)
53493 +{
53494 + if (unlikely(!(gr_status & GR_READY) || !task))
53495 + return 0;
53496 +
53497 + if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
53498 + task->acl != current->acl)
53499 + return 1;
53500 +
53501 + return 0;
53502 +}
53503 +
53504 +int
53505 +gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
53506 +{
53507 + struct task_struct *p;
53508 + int ret = 0;
53509 +
53510 + if (unlikely(!(gr_status & GR_READY) || !pid))
53511 + return ret;
53512 +
53513 + read_lock(&tasklist_lock);
53514 + do_each_pid_task(pid, type, p) {
53515 + if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
53516 + p->acl != current->acl) {
53517 + ret = 1;
53518 + goto out;
53519 + }
53520 + } while_each_pid_task(pid, type, p);
53521 +out:
53522 + read_unlock(&tasklist_lock);
53523 +
53524 + return ret;
53525 +}
53526 +
53527 +void
53528 +gr_copy_label(struct task_struct *tsk)
53529 +{
53530 + tsk->signal->used_accept = 0;
53531 + tsk->acl_sp_role = 0;
53532 + tsk->acl_role_id = current->acl_role_id;
53533 + tsk->acl = current->acl;
53534 + tsk->role = current->role;
53535 + tsk->signal->curr_ip = current->signal->curr_ip;
53536 + tsk->signal->saved_ip = current->signal->saved_ip;
53537 + if (current->exec_file)
53538 + get_file(current->exec_file);
53539 + tsk->exec_file = current->exec_file;
53540 + tsk->is_writable = current->is_writable;
53541 + if (unlikely(current->signal->used_accept)) {
53542 + current->signal->curr_ip = 0;
53543 + current->signal->saved_ip = 0;
53544 + }
53545 +
53546 + return;
53547 +}
53548 +
53549 +static void
53550 +gr_set_proc_res(struct task_struct *task)
53551 +{
53552 + struct acl_subject_label *proc;
53553 + unsigned short i;
53554 +
53555 + proc = task->acl;
53556 +
53557 + if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
53558 + return;
53559 +
53560 + for (i = 0; i < RLIM_NLIMITS; i++) {
53561 + if (!(proc->resmask & (1 << i)))
53562 + continue;
53563 +
53564 + task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
53565 + task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
53566 + }
53567 +
53568 + return;
53569 +}
53570 +
53571 +extern int __gr_process_user_ban(struct user_struct *user);
53572 +
53573 +int
53574 +gr_check_user_change(int real, int effective, int fs)
53575 +{
53576 + unsigned int i;
53577 + __u16 num;
53578 + uid_t *uidlist;
53579 + int curuid;
53580 + int realok = 0;
53581 + int effectiveok = 0;
53582 + int fsok = 0;
53583 +
53584 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
53585 + struct user_struct *user;
53586 +
53587 + if (real == -1)
53588 + goto skipit;
53589 +
53590 + user = find_user(real);
53591 + if (user == NULL)
53592 + goto skipit;
53593 +
53594 + if (__gr_process_user_ban(user)) {
53595 + /* for find_user */
53596 + free_uid(user);
53597 + return 1;
53598 + }
53599 +
53600 + /* for find_user */
53601 + free_uid(user);
53602 +
53603 +skipit:
53604 +#endif
53605 +
53606 + if (unlikely(!(gr_status & GR_READY)))
53607 + return 0;
53608 +
53609 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53610 + gr_log_learn_id_change('u', real, effective, fs);
53611 +
53612 + num = current->acl->user_trans_num;
53613 + uidlist = current->acl->user_transitions;
53614 +
53615 + if (uidlist == NULL)
53616 + return 0;
53617 +
53618 + if (real == -1)
53619 + realok = 1;
53620 + if (effective == -1)
53621 + effectiveok = 1;
53622 + if (fs == -1)
53623 + fsok = 1;
53624 +
53625 + if (current->acl->user_trans_type & GR_ID_ALLOW) {
53626 + for (i = 0; i < num; i++) {
53627 + curuid = (int)uidlist[i];
53628 + if (real == curuid)
53629 + realok = 1;
53630 + if (effective == curuid)
53631 + effectiveok = 1;
53632 + if (fs == curuid)
53633 + fsok = 1;
53634 + }
53635 + } else if (current->acl->user_trans_type & GR_ID_DENY) {
53636 + for (i = 0; i < num; i++) {
53637 + curuid = (int)uidlist[i];
53638 + if (real == curuid)
53639 + break;
53640 + if (effective == curuid)
53641 + break;
53642 + if (fs == curuid)
53643 + break;
53644 + }
53645 + /* not in deny list */
53646 + if (i == num) {
53647 + realok = 1;
53648 + effectiveok = 1;
53649 + fsok = 1;
53650 + }
53651 + }
53652 +
53653 + if (realok && effectiveok && fsok)
53654 + return 0;
53655 + else {
53656 + gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53657 + return 1;
53658 + }
53659 +}
53660 +
53661 +int
53662 +gr_check_group_change(int real, int effective, int fs)
53663 +{
53664 + unsigned int i;
53665 + __u16 num;
53666 + gid_t *gidlist;
53667 + int curgid;
53668 + int realok = 0;
53669 + int effectiveok = 0;
53670 + int fsok = 0;
53671 +
53672 + if (unlikely(!(gr_status & GR_READY)))
53673 + return 0;
53674 +
53675 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53676 + gr_log_learn_id_change('g', real, effective, fs);
53677 +
53678 + num = current->acl->group_trans_num;
53679 + gidlist = current->acl->group_transitions;
53680 +
53681 + if (gidlist == NULL)
53682 + return 0;
53683 +
53684 + if (real == -1)
53685 + realok = 1;
53686 + if (effective == -1)
53687 + effectiveok = 1;
53688 + if (fs == -1)
53689 + fsok = 1;
53690 +
53691 + if (current->acl->group_trans_type & GR_ID_ALLOW) {
53692 + for (i = 0; i < num; i++) {
53693 + curgid = (int)gidlist[i];
53694 + if (real == curgid)
53695 + realok = 1;
53696 + if (effective == curgid)
53697 + effectiveok = 1;
53698 + if (fs == curgid)
53699 + fsok = 1;
53700 + }
53701 + } else if (current->acl->group_trans_type & GR_ID_DENY) {
53702 + for (i = 0; i < num; i++) {
53703 + curgid = (int)gidlist[i];
53704 + if (real == curgid)
53705 + break;
53706 + if (effective == curgid)
53707 + break;
53708 + if (fs == curgid)
53709 + break;
53710 + }
53711 + /* not in deny list */
53712 + if (i == num) {
53713 + realok = 1;
53714 + effectiveok = 1;
53715 + fsok = 1;
53716 + }
53717 + }
53718 +
53719 + if (realok && effectiveok && fsok)
53720 + return 0;
53721 + else {
53722 + gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53723 + return 1;
53724 + }
53725 +}
53726 +
53727 +extern int gr_acl_is_capable(const int cap);
53728 +
53729 +void
53730 +gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
53731 +{
53732 + struct acl_role_label *role = task->role;
53733 + struct acl_subject_label *subj = NULL;
53734 + struct acl_object_label *obj;
53735 + struct file *filp;
53736 +
53737 + if (unlikely(!(gr_status & GR_READY)))
53738 + return;
53739 +
53740 + filp = task->exec_file;
53741 +
53742 + /* kernel process, we'll give them the kernel role */
53743 + if (unlikely(!filp)) {
53744 + task->role = kernel_role;
53745 + task->acl = kernel_role->root_label;
53746 + return;
53747 + } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
53748 + role = lookup_acl_role_label(task, uid, gid);
53749 +
53750 + /* don't change the role if we're not a privileged process */
53751 + if (role && task->role != role &&
53752 + (((role->roletype & GR_ROLE_USER) && !gr_acl_is_capable(CAP_SETUID)) ||
53753 + ((role->roletype & GR_ROLE_GROUP) && !gr_acl_is_capable(CAP_SETGID))))
53754 + return;
53755 +
53756 + /* perform subject lookup in possibly new role
53757 + we can use this result below in the case where role == task->role
53758 + */
53759 + subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
53760 +
53761 + /* if we changed uid/gid, but result in the same role
53762 + and are using inheritance, don't lose the inherited subject
53763 + if current subject is other than what normal lookup
53764 + would result in, we arrived via inheritance, don't
53765 + lose subject
53766 + */
53767 + if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
53768 + (subj == task->acl)))
53769 + task->acl = subj;
53770 +
53771 + task->role = role;
53772 +
53773 + task->is_writable = 0;
53774 +
53775 + /* ignore additional mmap checks for processes that are writable
53776 + by the default ACL */
53777 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
53778 + if (unlikely(obj->mode & GR_WRITE))
53779 + task->is_writable = 1;
53780 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
53781 + if (unlikely(obj->mode & GR_WRITE))
53782 + task->is_writable = 1;
53783 +
53784 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53785 + printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
53786 +#endif
53787 +
53788 + gr_set_proc_res(task);
53789 +
53790 + return;
53791 +}
53792 +
53793 +int
53794 +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
53795 + const int unsafe_flags)
53796 +{
53797 + struct task_struct *task = current;
53798 + struct acl_subject_label *newacl;
53799 + struct acl_object_label *obj;
53800 + __u32 retmode;
53801 +
53802 + if (unlikely(!(gr_status & GR_READY)))
53803 + return 0;
53804 +
53805 + newacl = chk_subj_label(dentry, mnt, task->role);
53806 +
53807 + /* special handling for if we did an strace -f -p <pid> from an admin role, where pid then
53808 + did an exec
53809 + */
53810 + rcu_read_lock();
53811 + read_lock(&tasklist_lock);
53812 + if (task->ptrace && task->parent && ((task->parent->role->roletype & GR_ROLE_GOD) ||
53813 + (task->parent->acl->mode & GR_POVERRIDE))) {
53814 + read_unlock(&tasklist_lock);
53815 + rcu_read_unlock();
53816 + goto skip_check;
53817 + }
53818 + read_unlock(&tasklist_lock);
53819 + rcu_read_unlock();
53820 +
53821 + if (unsafe_flags && !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
53822 + !(task->role->roletype & GR_ROLE_GOD) &&
53823 + !gr_search_file(dentry, GR_PTRACERD, mnt) &&
53824 + !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN))) {
53825 + if (unsafe_flags & LSM_UNSAFE_SHARE)
53826 + gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
53827 + else
53828 + gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
53829 + return -EACCES;
53830 + }
53831 +
53832 +skip_check:
53833 +
53834 + obj = chk_obj_label(dentry, mnt, task->acl);
53835 + retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
53836 +
53837 + if (!(task->acl->mode & GR_INHERITLEARN) &&
53838 + ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
53839 + if (obj->nested)
53840 + task->acl = obj->nested;
53841 + else
53842 + task->acl = newacl;
53843 + } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
53844 + gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
53845 +
53846 + task->is_writable = 0;
53847 +
53848 + /* ignore additional mmap checks for processes that are writable
53849 + by the default ACL */
53850 + obj = chk_obj_label(dentry, mnt, default_role->root_label);
53851 + if (unlikely(obj->mode & GR_WRITE))
53852 + task->is_writable = 1;
53853 + obj = chk_obj_label(dentry, mnt, task->role->root_label);
53854 + if (unlikely(obj->mode & GR_WRITE))
53855 + task->is_writable = 1;
53856 +
53857 + gr_set_proc_res(task);
53858 +
53859 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53860 + printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
53861 +#endif
53862 + return 0;
53863 +}
53864 +
53865 +/* always called with valid inodev ptr */
53866 +static void
53867 +do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
53868 +{
53869 + struct acl_object_label *matchpo;
53870 + struct acl_subject_label *matchps;
53871 + struct acl_subject_label *subj;
53872 + struct acl_role_label *role;
53873 + unsigned int x;
53874 +
53875 + FOR_EACH_ROLE_START(role)
53876 + FOR_EACH_SUBJECT_START(role, subj, x)
53877 + if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
53878 + matchpo->mode |= GR_DELETED;
53879 + FOR_EACH_SUBJECT_END(subj,x)
53880 + FOR_EACH_NESTED_SUBJECT_START(role, subj)
53881 + if (subj->inode == ino && subj->device == dev)
53882 + subj->mode |= GR_DELETED;
53883 + FOR_EACH_NESTED_SUBJECT_END(subj)
53884 + if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
53885 + matchps->mode |= GR_DELETED;
53886 + FOR_EACH_ROLE_END(role)
53887 +
53888 + inodev->nentry->deleted = 1;
53889 +
53890 + return;
53891 +}
53892 +
53893 +void
53894 +gr_handle_delete(const ino_t ino, const dev_t dev)
53895 +{
53896 + struct inodev_entry *inodev;
53897 +
53898 + if (unlikely(!(gr_status & GR_READY)))
53899 + return;
53900 +
53901 + write_lock(&gr_inode_lock);
53902 + inodev = lookup_inodev_entry(ino, dev);
53903 + if (inodev != NULL)
53904 + do_handle_delete(inodev, ino, dev);
53905 + write_unlock(&gr_inode_lock);
53906 +
53907 + return;
53908 +}
53909 +
53910 +static void
53911 +update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
53912 + const ino_t newinode, const dev_t newdevice,
53913 + struct acl_subject_label *subj)
53914 +{
53915 + unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
53916 + struct acl_object_label *match;
53917 +
53918 + match = subj->obj_hash[index];
53919 +
53920 + while (match && (match->inode != oldinode ||
53921 + match->device != olddevice ||
53922 + !(match->mode & GR_DELETED)))
53923 + match = match->next;
53924 +
53925 + if (match && (match->inode == oldinode)
53926 + && (match->device == olddevice)
53927 + && (match->mode & GR_DELETED)) {
53928 + if (match->prev == NULL) {
53929 + subj->obj_hash[index] = match->next;
53930 + if (match->next != NULL)
53931 + match->next->prev = NULL;
53932 + } else {
53933 + match->prev->next = match->next;
53934 + if (match->next != NULL)
53935 + match->next->prev = match->prev;
53936 + }
53937 + match->prev = NULL;
53938 + match->next = NULL;
53939 + match->inode = newinode;
53940 + match->device = newdevice;
53941 + match->mode &= ~GR_DELETED;
53942 +
53943 + insert_acl_obj_label(match, subj);
53944 + }
53945 +
53946 + return;
53947 +}
53948 +
53949 +static void
53950 +update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
53951 + const ino_t newinode, const dev_t newdevice,
53952 + struct acl_role_label *role)
53953 +{
53954 + unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
53955 + struct acl_subject_label *match;
53956 +
53957 + match = role->subj_hash[index];
53958 +
53959 + while (match && (match->inode != oldinode ||
53960 + match->device != olddevice ||
53961 + !(match->mode & GR_DELETED)))
53962 + match = match->next;
53963 +
53964 + if (match && (match->inode == oldinode)
53965 + && (match->device == olddevice)
53966 + && (match->mode & GR_DELETED)) {
53967 + if (match->prev == NULL) {
53968 + role->subj_hash[index] = match->next;
53969 + if (match->next != NULL)
53970 + match->next->prev = NULL;
53971 + } else {
53972 + match->prev->next = match->next;
53973 + if (match->next != NULL)
53974 + match->next->prev = match->prev;
53975 + }
53976 + match->prev = NULL;
53977 + match->next = NULL;
53978 + match->inode = newinode;
53979 + match->device = newdevice;
53980 + match->mode &= ~GR_DELETED;
53981 +
53982 + insert_acl_subj_label(match, role);
53983 + }
53984 +
53985 + return;
53986 +}
53987 +
53988 +static void
53989 +update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
53990 + const ino_t newinode, const dev_t newdevice)
53991 +{
53992 + unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
53993 + struct inodev_entry *match;
53994 +
53995 + match = inodev_set.i_hash[index];
53996 +
53997 + while (match && (match->nentry->inode != oldinode ||
53998 + match->nentry->device != olddevice || !match->nentry->deleted))
53999 + match = match->next;
54000 +
54001 + if (match && (match->nentry->inode == oldinode)
54002 + && (match->nentry->device == olddevice) &&
54003 + match->nentry->deleted) {
54004 + if (match->prev == NULL) {
54005 + inodev_set.i_hash[index] = match->next;
54006 + if (match->next != NULL)
54007 + match->next->prev = NULL;
54008 + } else {
54009 + match->prev->next = match->next;
54010 + if (match->next != NULL)
54011 + match->next->prev = match->prev;
54012 + }
54013 + match->prev = NULL;
54014 + match->next = NULL;
54015 + match->nentry->inode = newinode;
54016 + match->nentry->device = newdevice;
54017 + match->nentry->deleted = 0;
54018 +
54019 + insert_inodev_entry(match);
54020 + }
54021 +
54022 + return;
54023 +}
54024 +
54025 +static void
54026 +__do_handle_create(const struct name_entry *matchn, ino_t ino, dev_t dev)
54027 +{
54028 + struct acl_subject_label *subj;
54029 + struct acl_role_label *role;
54030 + unsigned int x;
54031 +
54032 + FOR_EACH_ROLE_START(role)
54033 + update_acl_subj_label(matchn->inode, matchn->device, ino, dev, role);
54034 +
54035 + FOR_EACH_NESTED_SUBJECT_START(role, subj)
54036 + if ((subj->inode == ino) && (subj->device == dev)) {
54037 + subj->inode = ino;
54038 + subj->device = dev;
54039 + }
54040 + FOR_EACH_NESTED_SUBJECT_END(subj)
54041 + FOR_EACH_SUBJECT_START(role, subj, x)
54042 + update_acl_obj_label(matchn->inode, matchn->device,
54043 + ino, dev, subj);
54044 + FOR_EACH_SUBJECT_END(subj,x)
54045 + FOR_EACH_ROLE_END(role)
54046 +
54047 + update_inodev_entry(matchn->inode, matchn->device, ino, dev);
54048 +
54049 + return;
54050 +}
54051 +
54052 +static void
54053 +do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
54054 + const struct vfsmount *mnt)
54055 +{
54056 + ino_t ino = dentry->d_inode->i_ino;
54057 + dev_t dev = __get_dev(dentry);
54058 +
54059 + __do_handle_create(matchn, ino, dev);
54060 +
54061 + return;
54062 +}
54063 +
54064 +void
54065 +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
54066 +{
54067 + struct name_entry *matchn;
54068 +
54069 + if (unlikely(!(gr_status & GR_READY)))
54070 + return;
54071 +
54072 + preempt_disable();
54073 + matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
54074 +
54075 + if (unlikely((unsigned long)matchn)) {
54076 + write_lock(&gr_inode_lock);
54077 + do_handle_create(matchn, dentry, mnt);
54078 + write_unlock(&gr_inode_lock);
54079 + }
54080 + preempt_enable();
54081 +
54082 + return;
54083 +}
54084 +
54085 +void
54086 +gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
54087 +{
54088 + struct name_entry *matchn;
54089 +
54090 + if (unlikely(!(gr_status & GR_READY)))
54091 + return;
54092 +
54093 + preempt_disable();
54094 + matchn = lookup_name_entry(gr_to_proc_filename_rbac(dentry, init_pid_ns.proc_mnt));
54095 +
54096 + if (unlikely((unsigned long)matchn)) {
54097 + write_lock(&gr_inode_lock);
54098 + __do_handle_create(matchn, inode->i_ino, inode->i_sb->s_dev);
54099 + write_unlock(&gr_inode_lock);
54100 + }
54101 + preempt_enable();
54102 +
54103 + return;
54104 +}
54105 +
54106 +void
54107 +gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
54108 + struct dentry *old_dentry,
54109 + struct dentry *new_dentry,
54110 + struct vfsmount *mnt, const __u8 replace)
54111 +{
54112 + struct name_entry *matchn;
54113 + struct inodev_entry *inodev;
54114 + struct inode *inode = new_dentry->d_inode;
54115 + ino_t old_ino = old_dentry->d_inode->i_ino;
54116 + dev_t old_dev = __get_dev(old_dentry);
54117 +
54118 + /* vfs_rename swaps the name and parent link for old_dentry and
54119 + new_dentry
54120 + at this point, old_dentry has the new name, parent link, and inode
54121 + for the renamed file
54122 + if a file is being replaced by a rename, new_dentry has the inode
54123 + and name for the replaced file
54124 + */
54125 +
54126 + if (unlikely(!(gr_status & GR_READY)))
54127 + return;
54128 +
54129 + preempt_disable();
54130 + matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
54131 +
54132 + /* we wouldn't have to check d_inode if it weren't for
54133 + NFS silly-renaming
54134 + */
54135 +
54136 + write_lock(&gr_inode_lock);
54137 + if (unlikely(replace && inode)) {
54138 + ino_t new_ino = inode->i_ino;
54139 + dev_t new_dev = __get_dev(new_dentry);
54140 +
54141 + inodev = lookup_inodev_entry(new_ino, new_dev);
54142 + if (inodev != NULL && ((inode->i_nlink <= 1) || S_ISDIR(inode->i_mode)))
54143 + do_handle_delete(inodev, new_ino, new_dev);
54144 + }
54145 +
54146 + inodev = lookup_inodev_entry(old_ino, old_dev);
54147 + if (inodev != NULL && ((old_dentry->d_inode->i_nlink <= 1) || S_ISDIR(old_dentry->d_inode->i_mode)))
54148 + do_handle_delete(inodev, old_ino, old_dev);
54149 +
54150 + if (unlikely((unsigned long)matchn))
54151 + do_handle_create(matchn, old_dentry, mnt);
54152 +
54153 + write_unlock(&gr_inode_lock);
54154 + preempt_enable();
54155 +
54156 + return;
54157 +}
54158 +
54159 +static int
54160 +lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
54161 + unsigned char **sum)
54162 +{
54163 + struct acl_role_label *r;
54164 + struct role_allowed_ip *ipp;
54165 + struct role_transition *trans;
54166 + unsigned int i;
54167 + int found = 0;
54168 + u32 curr_ip = current->signal->curr_ip;
54169 +
54170 + current->signal->saved_ip = curr_ip;
54171 +
54172 + /* check transition table */
54173 +
54174 + for (trans = current->role->transitions; trans; trans = trans->next) {
54175 + if (!strcmp(rolename, trans->rolename)) {
54176 + found = 1;
54177 + break;
54178 + }
54179 + }
54180 +
54181 + if (!found)
54182 + return 0;
54183 +
54184 + /* handle special roles that do not require authentication
54185 + and check ip */
54186 +
54187 + FOR_EACH_ROLE_START(r)
54188 + if (!strcmp(rolename, r->rolename) &&
54189 + (r->roletype & GR_ROLE_SPECIAL)) {
54190 + found = 0;
54191 + if (r->allowed_ips != NULL) {
54192 + for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
54193 + if ((ntohl(curr_ip) & ipp->netmask) ==
54194 + (ntohl(ipp->addr) & ipp->netmask))
54195 + found = 1;
54196 + }
54197 + } else
54198 + found = 2;
54199 + if (!found)
54200 + return 0;
54201 +
54202 + if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
54203 + ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
54204 + *salt = NULL;
54205 + *sum = NULL;
54206 + return 1;
54207 + }
54208 + }
54209 + FOR_EACH_ROLE_END(r)
54210 +
54211 + for (i = 0; i < num_sprole_pws; i++) {
54212 + if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
54213 + *salt = acl_special_roles[i]->salt;
54214 + *sum = acl_special_roles[i]->sum;
54215 + return 1;
54216 + }
54217 + }
54218 +
54219 + return 0;
54220 +}
54221 +
54222 +static void
54223 +assign_special_role(char *rolename)
54224 +{
54225 + struct acl_object_label *obj;
54226 + struct acl_role_label *r;
54227 + struct acl_role_label *assigned = NULL;
54228 + struct task_struct *tsk;
54229 + struct file *filp;
54230 +
54231 + FOR_EACH_ROLE_START(r)
54232 + if (!strcmp(rolename, r->rolename) &&
54233 + (r->roletype & GR_ROLE_SPECIAL)) {
54234 + assigned = r;
54235 + break;
54236 + }
54237 + FOR_EACH_ROLE_END(r)
54238 +
54239 + if (!assigned)
54240 + return;
54241 +
54242 + read_lock(&tasklist_lock);
54243 + read_lock(&grsec_exec_file_lock);
54244 +
54245 + tsk = current->real_parent;
54246 + if (tsk == NULL)
54247 + goto out_unlock;
54248 +
54249 + filp = tsk->exec_file;
54250 + if (filp == NULL)
54251 + goto out_unlock;
54252 +
54253 + tsk->is_writable = 0;
54254 +
54255 + tsk->acl_sp_role = 1;
54256 + tsk->acl_role_id = ++acl_sp_role_value;
54257 + tsk->role = assigned;
54258 + tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
54259 +
54260 + /* ignore additional mmap checks for processes that are writable
54261 + by the default ACL */
54262 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54263 + if (unlikely(obj->mode & GR_WRITE))
54264 + tsk->is_writable = 1;
54265 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
54266 + if (unlikely(obj->mode & GR_WRITE))
54267 + tsk->is_writable = 1;
54268 +
54269 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54270 + printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
54271 +#endif
54272 +
54273 +out_unlock:
54274 + read_unlock(&grsec_exec_file_lock);
54275 + read_unlock(&tasklist_lock);
54276 + return;
54277 +}
54278 +
54279 +int gr_check_secure_terminal(struct task_struct *task)
54280 +{
54281 + struct task_struct *p, *p2, *p3;
54282 + struct files_struct *files;
54283 + struct fdtable *fdt;
54284 + struct file *our_file = NULL, *file;
54285 + int i;
54286 +
54287 + if (task->signal->tty == NULL)
54288 + return 1;
54289 +
54290 + files = get_files_struct(task);
54291 + if (files != NULL) {
54292 + rcu_read_lock();
54293 + fdt = files_fdtable(files);
54294 + for (i=0; i < fdt->max_fds; i++) {
54295 + file = fcheck_files(files, i);
54296 + if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
54297 + get_file(file);
54298 + our_file = file;
54299 + }
54300 + }
54301 + rcu_read_unlock();
54302 + put_files_struct(files);
54303 + }
54304 +
54305 + if (our_file == NULL)
54306 + return 1;
54307 +
54308 + read_lock(&tasklist_lock);
54309 + do_each_thread(p2, p) {
54310 + files = get_files_struct(p);
54311 + if (files == NULL ||
54312 + (p->signal && p->signal->tty == task->signal->tty)) {
54313 + if (files != NULL)
54314 + put_files_struct(files);
54315 + continue;
54316 + }
54317 + rcu_read_lock();
54318 + fdt = files_fdtable(files);
54319 + for (i=0; i < fdt->max_fds; i++) {
54320 + file = fcheck_files(files, i);
54321 + if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
54322 + file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
54323 + p3 = task;
54324 + while (p3->pid > 0) {
54325 + if (p3 == p)
54326 + break;
54327 + p3 = p3->real_parent;
54328 + }
54329 + if (p3 == p)
54330 + break;
54331 + gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
54332 + gr_handle_alertkill(p);
54333 + rcu_read_unlock();
54334 + put_files_struct(files);
54335 + read_unlock(&tasklist_lock);
54336 + fput(our_file);
54337 + return 0;
54338 + }
54339 + }
54340 + rcu_read_unlock();
54341 + put_files_struct(files);
54342 + } while_each_thread(p2, p);
54343 + read_unlock(&tasklist_lock);
54344 +
54345 + fput(our_file);
54346 + return 1;
54347 +}
54348 +
54349 +static int gr_rbac_disable(void *unused)
54350 +{
54351 + pax_open_kernel();
54352 + gr_status &= ~GR_READY;
54353 + pax_close_kernel();
54354 +
54355 + return 0;
54356 +}
54357 +
54358 +ssize_t
54359 +write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
54360 +{
54361 + struct gr_arg_wrapper uwrap;
54362 + unsigned char *sprole_salt = NULL;
54363 + unsigned char *sprole_sum = NULL;
54364 + int error = sizeof (struct gr_arg_wrapper);
54365 + int error2 = 0;
54366 +
54367 + mutex_lock(&gr_dev_mutex);
54368 +
54369 + if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
54370 + error = -EPERM;
54371 + goto out;
54372 + }
54373 +
54374 + if (count != sizeof (struct gr_arg_wrapper)) {
54375 + gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
54376 + error = -EINVAL;
54377 + goto out;
54378 + }
54379 +
54380 +
54381 + if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
54382 + gr_auth_expires = 0;
54383 + gr_auth_attempts = 0;
54384 + }
54385 +
54386 + if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
54387 + error = -EFAULT;
54388 + goto out;
54389 + }
54390 +
54391 + if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
54392 + error = -EINVAL;
54393 + goto out;
54394 + }
54395 +
54396 + if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
54397 + error = -EFAULT;
54398 + goto out;
54399 + }
54400 +
54401 + if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
54402 + gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
54403 + time_after(gr_auth_expires, get_seconds())) {
54404 + error = -EBUSY;
54405 + goto out;
54406 + }
54407 +
54408 + /* if non-root trying to do anything other than use a special role,
54409 + do not attempt authentication, do not count towards authentication
54410 + locking
54411 + */
54412 +
54413 + if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
54414 + gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
54415 + !uid_eq(current_uid(), GLOBAL_ROOT_UID)) {
54416 + error = -EPERM;
54417 + goto out;
54418 + }
54419 +
54420 + /* ensure pw and special role name are null terminated */
54421 +
54422 + gr_usermode->pw[GR_PW_LEN - 1] = '\0';
54423 + gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
54424 +
54425 + /* Okay.
54426 + * We have our enough of the argument structure..(we have yet
54427 + * to copy_from_user the tables themselves) . Copy the tables
54428 + * only if we need them, i.e. for loading operations. */
54429 +
54430 + switch (gr_usermode->mode) {
54431 + case GR_STATUS:
54432 + if (gr_status & GR_READY) {
54433 + error = 1;
54434 + if (!gr_check_secure_terminal(current))
54435 + error = 3;
54436 + } else
54437 + error = 2;
54438 + goto out;
54439 + case GR_SHUTDOWN:
54440 + if ((gr_status & GR_READY)
54441 + && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54442 + stop_machine(gr_rbac_disable, NULL, NULL);
54443 + free_variables();
54444 + memset(gr_usermode, 0, sizeof (struct gr_arg));
54445 + memset(gr_system_salt, 0, GR_SALT_LEN);
54446 + memset(gr_system_sum, 0, GR_SHA_LEN);
54447 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
54448 + } else if (gr_status & GR_READY) {
54449 + gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
54450 + error = -EPERM;
54451 + } else {
54452 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
54453 + error = -EAGAIN;
54454 + }
54455 + break;
54456 + case GR_ENABLE:
54457 + if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
54458 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
54459 + else {
54460 + if (gr_status & GR_READY)
54461 + error = -EAGAIN;
54462 + else
54463 + error = error2;
54464 + gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
54465 + }
54466 + break;
54467 + case GR_RELOAD:
54468 + if (!(gr_status & GR_READY)) {
54469 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
54470 + error = -EAGAIN;
54471 + } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54472 + stop_machine(gr_rbac_disable, NULL, NULL);
54473 + free_variables();
54474 + error2 = gracl_init(gr_usermode);
54475 + if (!error2)
54476 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
54477 + else {
54478 + gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
54479 + error = error2;
54480 + }
54481 + } else {
54482 + gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
54483 + error = -EPERM;
54484 + }
54485 + break;
54486 + case GR_SEGVMOD:
54487 + if (unlikely(!(gr_status & GR_READY))) {
54488 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
54489 + error = -EAGAIN;
54490 + break;
54491 + }
54492 +
54493 + if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54494 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
54495 + if (gr_usermode->segv_device && gr_usermode->segv_inode) {
54496 + struct acl_subject_label *segvacl;
54497 + segvacl =
54498 + lookup_acl_subj_label(gr_usermode->segv_inode,
54499 + gr_usermode->segv_device,
54500 + current->role);
54501 + if (segvacl) {
54502 + segvacl->crashes = 0;
54503 + segvacl->expires = 0;
54504 + }
54505 + } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
54506 + gr_remove_uid(gr_usermode->segv_uid);
54507 + }
54508 + } else {
54509 + gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
54510 + error = -EPERM;
54511 + }
54512 + break;
54513 + case GR_SPROLE:
54514 + case GR_SPROLEPAM:
54515 + if (unlikely(!(gr_status & GR_READY))) {
54516 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
54517 + error = -EAGAIN;
54518 + break;
54519 + }
54520 +
54521 + if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
54522 + current->role->expires = 0;
54523 + current->role->auth_attempts = 0;
54524 + }
54525 +
54526 + if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
54527 + time_after(current->role->expires, get_seconds())) {
54528 + error = -EBUSY;
54529 + goto out;
54530 + }
54531 +
54532 + if (lookup_special_role_auth
54533 + (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
54534 + && ((!sprole_salt && !sprole_sum)
54535 + || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
54536 + char *p = "";
54537 + assign_special_role(gr_usermode->sp_role);
54538 + read_lock(&tasklist_lock);
54539 + if (current->real_parent)
54540 + p = current->real_parent->role->rolename;
54541 + read_unlock(&tasklist_lock);
54542 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
54543 + p, acl_sp_role_value);
54544 + } else {
54545 + gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
54546 + error = -EPERM;
54547 + if(!(current->role->auth_attempts++))
54548 + current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
54549 +
54550 + goto out;
54551 + }
54552 + break;
54553 + case GR_UNSPROLE:
54554 + if (unlikely(!(gr_status & GR_READY))) {
54555 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
54556 + error = -EAGAIN;
54557 + break;
54558 + }
54559 +
54560 + if (current->role->roletype & GR_ROLE_SPECIAL) {
54561 + char *p = "";
54562 + int i = 0;
54563 +
54564 + read_lock(&tasklist_lock);
54565 + if (current->real_parent) {
54566 + p = current->real_parent->role->rolename;
54567 + i = current->real_parent->acl_role_id;
54568 + }
54569 + read_unlock(&tasklist_lock);
54570 +
54571 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
54572 + gr_set_acls(1);
54573 + } else {
54574 + error = -EPERM;
54575 + goto out;
54576 + }
54577 + break;
54578 + default:
54579 + gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
54580 + error = -EINVAL;
54581 + break;
54582 + }
54583 +
54584 + if (error != -EPERM)
54585 + goto out;
54586 +
54587 + if(!(gr_auth_attempts++))
54588 + gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
54589 +
54590 + out:
54591 + mutex_unlock(&gr_dev_mutex);
54592 + return error;
54593 +}
54594 +
54595 +/* must be called with
54596 + rcu_read_lock();
54597 + read_lock(&tasklist_lock);
54598 + read_lock(&grsec_exec_file_lock);
54599 +*/
54600 +int gr_apply_subject_to_task(struct task_struct *task)
54601 +{
54602 + struct acl_object_label *obj;
54603 + char *tmpname;
54604 + struct acl_subject_label *tmpsubj;
54605 + struct file *filp;
54606 + struct name_entry *nmatch;
54607 +
54608 + filp = task->exec_file;
54609 + if (filp == NULL)
54610 + return 0;
54611 +
54612 + /* the following is to apply the correct subject
54613 + on binaries running when the RBAC system
54614 + is enabled, when the binaries have been
54615 + replaced or deleted since their execution
54616 + -----
54617 + when the RBAC system starts, the inode/dev
54618 + from exec_file will be one the RBAC system
54619 + is unaware of. It only knows the inode/dev
54620 + of the present file on disk, or the absence
54621 + of it.
54622 + */
54623 + preempt_disable();
54624 + tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
54625 +
54626 + nmatch = lookup_name_entry(tmpname);
54627 + preempt_enable();
54628 + tmpsubj = NULL;
54629 + if (nmatch) {
54630 + if (nmatch->deleted)
54631 + tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
54632 + else
54633 + tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
54634 + if (tmpsubj != NULL)
54635 + task->acl = tmpsubj;
54636 + }
54637 + if (tmpsubj == NULL)
54638 + task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
54639 + task->role);
54640 + if (task->acl) {
54641 + task->is_writable = 0;
54642 + /* ignore additional mmap checks for processes that are writable
54643 + by the default ACL */
54644 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54645 + if (unlikely(obj->mode & GR_WRITE))
54646 + task->is_writable = 1;
54647 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
54648 + if (unlikely(obj->mode & GR_WRITE))
54649 + task->is_writable = 1;
54650 +
54651 + gr_set_proc_res(task);
54652 +
54653 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54654 + printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
54655 +#endif
54656 + } else {
54657 + return 1;
54658 + }
54659 +
54660 + return 0;
54661 +}
54662 +
54663 +int
54664 +gr_set_acls(const int type)
54665 +{
54666 + struct task_struct *task, *task2;
54667 + struct acl_role_label *role = current->role;
54668 + __u16 acl_role_id = current->acl_role_id;
54669 + const struct cred *cred;
54670 + int ret;
54671 +
54672 + rcu_read_lock();
54673 + read_lock(&tasklist_lock);
54674 + read_lock(&grsec_exec_file_lock);
54675 + do_each_thread(task2, task) {
54676 + /* check to see if we're called from the exit handler,
54677 + if so, only replace ACLs that have inherited the admin
54678 + ACL */
54679 +
54680 + if (type && (task->role != role ||
54681 + task->acl_role_id != acl_role_id))
54682 + continue;
54683 +
54684 + task->acl_role_id = 0;
54685 + task->acl_sp_role = 0;
54686 +
54687 + if (task->exec_file) {
54688 + cred = __task_cred(task);
54689 + task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
54690 + ret = gr_apply_subject_to_task(task);
54691 + if (ret) {
54692 + read_unlock(&grsec_exec_file_lock);
54693 + read_unlock(&tasklist_lock);
54694 + rcu_read_unlock();
54695 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
54696 + return ret;
54697 + }
54698 + } else {
54699 + // it's a kernel process
54700 + task->role = kernel_role;
54701 + task->acl = kernel_role->root_label;
54702 +#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
54703 + task->acl->mode &= ~GR_PROCFIND;
54704 +#endif
54705 + }
54706 + } while_each_thread(task2, task);
54707 + read_unlock(&grsec_exec_file_lock);
54708 + read_unlock(&tasklist_lock);
54709 + rcu_read_unlock();
54710 +
54711 + return 0;
54712 +}
54713 +
54714 +void
54715 +gr_learn_resource(const struct task_struct *task,
54716 + const int res, const unsigned long wanted, const int gt)
54717 +{
54718 + struct acl_subject_label *acl;
54719 + const struct cred *cred;
54720 +
54721 + if (unlikely((gr_status & GR_READY) &&
54722 + task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
54723 + goto skip_reslog;
54724 +
54725 +#ifdef CONFIG_GRKERNSEC_RESLOG
54726 + gr_log_resource(task, res, wanted, gt);
54727 +#endif
54728 + skip_reslog:
54729 +
54730 + if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
54731 + return;
54732 +
54733 + acl = task->acl;
54734 +
54735 + if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
54736 + !(acl->resmask & (1 << (unsigned short) res))))
54737 + return;
54738 +
54739 + if (wanted >= acl->res[res].rlim_cur) {
54740 + unsigned long res_add;
54741 +
54742 + res_add = wanted;
54743 + switch (res) {
54744 + case RLIMIT_CPU:
54745 + res_add += GR_RLIM_CPU_BUMP;
54746 + break;
54747 + case RLIMIT_FSIZE:
54748 + res_add += GR_RLIM_FSIZE_BUMP;
54749 + break;
54750 + case RLIMIT_DATA:
54751 + res_add += GR_RLIM_DATA_BUMP;
54752 + break;
54753 + case RLIMIT_STACK:
54754 + res_add += GR_RLIM_STACK_BUMP;
54755 + break;
54756 + case RLIMIT_CORE:
54757 + res_add += GR_RLIM_CORE_BUMP;
54758 + break;
54759 + case RLIMIT_RSS:
54760 + res_add += GR_RLIM_RSS_BUMP;
54761 + break;
54762 + case RLIMIT_NPROC:
54763 + res_add += GR_RLIM_NPROC_BUMP;
54764 + break;
54765 + case RLIMIT_NOFILE:
54766 + res_add += GR_RLIM_NOFILE_BUMP;
54767 + break;
54768 + case RLIMIT_MEMLOCK:
54769 + res_add += GR_RLIM_MEMLOCK_BUMP;
54770 + break;
54771 + case RLIMIT_AS:
54772 + res_add += GR_RLIM_AS_BUMP;
54773 + break;
54774 + case RLIMIT_LOCKS:
54775 + res_add += GR_RLIM_LOCKS_BUMP;
54776 + break;
54777 + case RLIMIT_SIGPENDING:
54778 + res_add += GR_RLIM_SIGPENDING_BUMP;
54779 + break;
54780 + case RLIMIT_MSGQUEUE:
54781 + res_add += GR_RLIM_MSGQUEUE_BUMP;
54782 + break;
54783 + case RLIMIT_NICE:
54784 + res_add += GR_RLIM_NICE_BUMP;
54785 + break;
54786 + case RLIMIT_RTPRIO:
54787 + res_add += GR_RLIM_RTPRIO_BUMP;
54788 + break;
54789 + case RLIMIT_RTTIME:
54790 + res_add += GR_RLIM_RTTIME_BUMP;
54791 + break;
54792 + }
54793 +
54794 + acl->res[res].rlim_cur = res_add;
54795 +
54796 + if (wanted > acl->res[res].rlim_max)
54797 + acl->res[res].rlim_max = res_add;
54798 +
54799 + /* only log the subject filename, since resource logging is supported for
54800 + single-subject learning only */
54801 + rcu_read_lock();
54802 + cred = __task_cred(task);
54803 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
54804 + task->role->roletype, cred->uid, cred->gid, acl->filename,
54805 + acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
54806 + "", (unsigned long) res, &task->signal->saved_ip);
54807 + rcu_read_unlock();
54808 + }
54809 +
54810 + return;
54811 +}
54812 +
54813 +#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
54814 +void
54815 +pax_set_initial_flags(struct linux_binprm *bprm)
54816 +{
54817 + struct task_struct *task = current;
54818 + struct acl_subject_label *proc;
54819 + unsigned long flags;
54820 +
54821 + if (unlikely(!(gr_status & GR_READY)))
54822 + return;
54823 +
54824 + flags = pax_get_flags(task);
54825 +
54826 + proc = task->acl;
54827 +
54828 + if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
54829 + flags &= ~MF_PAX_PAGEEXEC;
54830 + if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
54831 + flags &= ~MF_PAX_SEGMEXEC;
54832 + if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
54833 + flags &= ~MF_PAX_RANDMMAP;
54834 + if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
54835 + flags &= ~MF_PAX_EMUTRAMP;
54836 + if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
54837 + flags &= ~MF_PAX_MPROTECT;
54838 +
54839 + if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
54840 + flags |= MF_PAX_PAGEEXEC;
54841 + if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
54842 + flags |= MF_PAX_SEGMEXEC;
54843 + if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
54844 + flags |= MF_PAX_RANDMMAP;
54845 + if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
54846 + flags |= MF_PAX_EMUTRAMP;
54847 + if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
54848 + flags |= MF_PAX_MPROTECT;
54849 +
54850 + pax_set_flags(task, flags);
54851 +
54852 + return;
54853 +}
54854 +#endif
54855 +
54856 +int
54857 +gr_handle_proc_ptrace(struct task_struct *task)
54858 +{
54859 + struct file *filp;
54860 + struct task_struct *tmp = task;
54861 + struct task_struct *curtemp = current;
54862 + __u32 retmode;
54863 +
54864 +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
54865 + if (unlikely(!(gr_status & GR_READY)))
54866 + return 0;
54867 +#endif
54868 +
54869 + read_lock(&tasklist_lock);
54870 + read_lock(&grsec_exec_file_lock);
54871 + filp = task->exec_file;
54872 +
54873 + while (tmp->pid > 0) {
54874 + if (tmp == curtemp)
54875 + break;
54876 + tmp = tmp->real_parent;
54877 + }
54878 +
54879 + if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && !uid_eq(current_uid(), GLOBAL_ROOT_UID) && !(gr_status & GR_READY)) ||
54880 + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
54881 + read_unlock(&grsec_exec_file_lock);
54882 + read_unlock(&tasklist_lock);
54883 + return 1;
54884 + }
54885 +
54886 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
54887 + if (!(gr_status & GR_READY)) {
54888 + read_unlock(&grsec_exec_file_lock);
54889 + read_unlock(&tasklist_lock);
54890 + return 0;
54891 + }
54892 +#endif
54893 +
54894 + retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
54895 + read_unlock(&grsec_exec_file_lock);
54896 + read_unlock(&tasklist_lock);
54897 +
54898 + if (retmode & GR_NOPTRACE)
54899 + return 1;
54900 +
54901 + if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
54902 + && (current->acl != task->acl || (current->acl != current->role->root_label
54903 + && current->pid != task->pid)))
54904 + return 1;
54905 +
54906 + return 0;
54907 +}
54908 +
54909 +void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
54910 +{
54911 + if (unlikely(!(gr_status & GR_READY)))
54912 + return;
54913 +
54914 + if (!(current->role->roletype & GR_ROLE_GOD))
54915 + return;
54916 +
54917 + seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
54918 + p->role->rolename, gr_task_roletype_to_char(p),
54919 + p->acl->filename);
54920 +}
54921 +
54922 +int
54923 +gr_handle_ptrace(struct task_struct *task, const long request)
54924 +{
54925 + struct task_struct *tmp = task;
54926 + struct task_struct *curtemp = current;
54927 + __u32 retmode;
54928 +
54929 +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
54930 + if (unlikely(!(gr_status & GR_READY)))
54931 + return 0;
54932 +#endif
54933 + if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
54934 + read_lock(&tasklist_lock);
54935 + while (tmp->pid > 0) {
54936 + if (tmp == curtemp)
54937 + break;
54938 + tmp = tmp->real_parent;
54939 + }
54940 +
54941 + if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && !uid_eq(current_uid(), GLOBAL_ROOT_UID) && !(gr_status & GR_READY)) ||
54942 + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
54943 + read_unlock(&tasklist_lock);
54944 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
54945 + return 1;
54946 + }
54947 + read_unlock(&tasklist_lock);
54948 + }
54949 +
54950 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
54951 + if (!(gr_status & GR_READY))
54952 + return 0;
54953 +#endif
54954 +
54955 + read_lock(&grsec_exec_file_lock);
54956 + if (unlikely(!task->exec_file)) {
54957 + read_unlock(&grsec_exec_file_lock);
54958 + return 0;
54959 + }
54960 +
54961 + retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
54962 + read_unlock(&grsec_exec_file_lock);
54963 +
54964 + if (retmode & GR_NOPTRACE) {
54965 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
54966 + return 1;
54967 + }
54968 +
54969 + if (retmode & GR_PTRACERD) {
54970 + switch (request) {
54971 + case PTRACE_SEIZE:
54972 + case PTRACE_POKETEXT:
54973 + case PTRACE_POKEDATA:
54974 + case PTRACE_POKEUSR:
54975 +#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
54976 + case PTRACE_SETREGS:
54977 + case PTRACE_SETFPREGS:
54978 +#endif
54979 +#ifdef CONFIG_X86
54980 + case PTRACE_SETFPXREGS:
54981 +#endif
54982 +#ifdef CONFIG_ALTIVEC
54983 + case PTRACE_SETVRREGS:
54984 +#endif
54985 + return 1;
54986 + default:
54987 + return 0;
54988 + }
54989 + } else if (!(current->acl->mode & GR_POVERRIDE) &&
54990 + !(current->role->roletype & GR_ROLE_GOD) &&
54991 + (current->acl != task->acl)) {
54992 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
54993 + return 1;
54994 + }
54995 +
54996 + return 0;
54997 +}
54998 +
54999 +static int is_writable_mmap(const struct file *filp)
55000 +{
55001 + struct task_struct *task = current;
55002 + struct acl_object_label *obj, *obj2;
55003 +
55004 + if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
55005 + !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
55006 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
55007 + obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
55008 + task->role->root_label);
55009 + if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
55010 + gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
55011 + return 1;
55012 + }
55013 + }
55014 + return 0;
55015 +}
55016 +
55017 +int
55018 +gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
55019 +{
55020 + __u32 mode;
55021 +
55022 + if (unlikely(!file || !(prot & PROT_EXEC)))
55023 + return 1;
55024 +
55025 + if (is_writable_mmap(file))
55026 + return 0;
55027 +
55028 + mode =
55029 + gr_search_file(file->f_path.dentry,
55030 + GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
55031 + file->f_path.mnt);
55032 +
55033 + if (!gr_tpe_allow(file))
55034 + return 0;
55035 +
55036 + if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
55037 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55038 + return 0;
55039 + } else if (unlikely(!(mode & GR_EXEC))) {
55040 + return 0;
55041 + } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
55042 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55043 + return 1;
55044 + }
55045 +
55046 + return 1;
55047 +}
55048 +
55049 +int
55050 +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
55051 +{
55052 + __u32 mode;
55053 +
55054 + if (unlikely(!file || !(prot & PROT_EXEC)))
55055 + return 1;
55056 +
55057 + if (is_writable_mmap(file))
55058 + return 0;
55059 +
55060 + mode =
55061 + gr_search_file(file->f_path.dentry,
55062 + GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
55063 + file->f_path.mnt);
55064 +
55065 + if (!gr_tpe_allow(file))
55066 + return 0;
55067 +
55068 + if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
55069 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55070 + return 0;
55071 + } else if (unlikely(!(mode & GR_EXEC))) {
55072 + return 0;
55073 + } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
55074 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55075 + return 1;
55076 + }
55077 +
55078 + return 1;
55079 +}
55080 +
55081 +void
55082 +gr_acl_handle_psacct(struct task_struct *task, const long code)
55083 +{
55084 + unsigned long runtime;
55085 + unsigned long cputime;
55086 + unsigned int wday, cday;
55087 + __u8 whr, chr;
55088 + __u8 wmin, cmin;
55089 + __u8 wsec, csec;
55090 + struct timespec timeval;
55091 +
55092 + if (unlikely(!(gr_status & GR_READY) || !task->acl ||
55093 + !(task->acl->mode & GR_PROCACCT)))
55094 + return;
55095 +
55096 + do_posix_clock_monotonic_gettime(&timeval);
55097 + runtime = timeval.tv_sec - task->start_time.tv_sec;
55098 + wday = runtime / (3600 * 24);
55099 + runtime -= wday * (3600 * 24);
55100 + whr = runtime / 3600;
55101 + runtime -= whr * 3600;
55102 + wmin = runtime / 60;
55103 + runtime -= wmin * 60;
55104 + wsec = runtime;
55105 +
55106 + cputime = (task->utime + task->stime) / HZ;
55107 + cday = cputime / (3600 * 24);
55108 + cputime -= cday * (3600 * 24);
55109 + chr = cputime / 3600;
55110 + cputime -= chr * 3600;
55111 + cmin = cputime / 60;
55112 + cputime -= cmin * 60;
55113 + csec = cputime;
55114 +
55115 + gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
55116 +
55117 + return;
55118 +}
55119 +
55120 +void gr_set_kernel_label(struct task_struct *task)
55121 +{
55122 + if (gr_status & GR_READY) {
55123 + task->role = kernel_role;
55124 + task->acl = kernel_role->root_label;
55125 + }
55126 + return;
55127 +}
55128 +
55129 +#ifdef CONFIG_TASKSTATS
55130 +int gr_is_taskstats_denied(int pid)
55131 +{
55132 + struct task_struct *task;
55133 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55134 + const struct cred *cred;
55135 +#endif
55136 + int ret = 0;
55137 +
55138 + /* restrict taskstats viewing to un-chrooted root users
55139 + who have the 'view' subject flag if the RBAC system is enabled
55140 + */
55141 +
55142 + rcu_read_lock();
55143 + read_lock(&tasklist_lock);
55144 + task = find_task_by_vpid(pid);
55145 + if (task) {
55146 +#ifdef CONFIG_GRKERNSEC_CHROOT
55147 + if (proc_is_chrooted(task))
55148 + ret = -EACCES;
55149 +#endif
55150 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55151 + cred = __task_cred(task);
55152 +#ifdef CONFIG_GRKERNSEC_PROC_USER
55153 + if (!uid_eq(cred->uid, GLOBAL_ROOT_UID))
55154 + ret = -EACCES;
55155 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55156 + if (!uid_eq(cred->uid, GLOBAL_ROOT_UID) && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
55157 + ret = -EACCES;
55158 +#endif
55159 +#endif
55160 + if (gr_status & GR_READY) {
55161 + if (!(task->acl->mode & GR_VIEW))
55162 + ret = -EACCES;
55163 + }
55164 + } else
55165 + ret = -ENOENT;
55166 +
55167 + read_unlock(&tasklist_lock);
55168 + rcu_read_unlock();
55169 +
55170 + return ret;
55171 +}
55172 +#endif
55173 +
55174 +/* AUXV entries are filled via a descendant of search_binary_handler
55175 + after we've already applied the subject for the target
55176 +*/
55177 +int gr_acl_enable_at_secure(void)
55178 +{
55179 + if (unlikely(!(gr_status & GR_READY)))
55180 + return 0;
55181 +
55182 + if (current->acl->mode & GR_ATSECURE)
55183 + return 1;
55184 +
55185 + return 0;
55186 +}
55187 +
55188 +int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
55189 +{
55190 + struct task_struct *task = current;
55191 + struct dentry *dentry = file->f_path.dentry;
55192 + struct vfsmount *mnt = file->f_path.mnt;
55193 + struct acl_object_label *obj, *tmp;
55194 + struct acl_subject_label *subj;
55195 + unsigned int bufsize;
55196 + int is_not_root;
55197 + char *path;
55198 + dev_t dev = __get_dev(dentry);
55199 +
55200 + if (unlikely(!(gr_status & GR_READY)))
55201 + return 1;
55202 +
55203 + if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
55204 + return 1;
55205 +
55206 + /* ignore Eric Biederman */
55207 + if (IS_PRIVATE(dentry->d_inode))
55208 + return 1;
55209 +
55210 + subj = task->acl;
55211 + read_lock(&gr_inode_lock);
55212 + do {
55213 + obj = lookup_acl_obj_label(ino, dev, subj);
55214 + if (obj != NULL) {
55215 + read_unlock(&gr_inode_lock);
55216 + return (obj->mode & GR_FIND) ? 1 : 0;
55217 + }
55218 + } while ((subj = subj->parent_subject));
55219 + read_unlock(&gr_inode_lock);
55220 +
55221 + /* this is purely an optimization since we're looking for an object
55222 + for the directory we're doing a readdir on
55223 + if it's possible for any globbed object to match the entry we're
55224 + filling into the directory, then the object we find here will be
55225 + an anchor point with attached globbed objects
55226 + */
55227 + obj = chk_obj_label_noglob(dentry, mnt, task->acl);
55228 + if (obj->globbed == NULL)
55229 + return (obj->mode & GR_FIND) ? 1 : 0;
55230 +
55231 + is_not_root = ((obj->filename[0] == '/') &&
55232 + (obj->filename[1] == '\0')) ? 0 : 1;
55233 + bufsize = PAGE_SIZE - namelen - is_not_root;
55234 +
55235 + /* check bufsize > PAGE_SIZE || bufsize == 0 */
55236 + if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
55237 + return 1;
55238 +
55239 + preempt_disable();
55240 + path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
55241 + bufsize);
55242 +
55243 + bufsize = strlen(path);
55244 +
55245 + /* if base is "/", don't append an additional slash */
55246 + if (is_not_root)
55247 + *(path + bufsize) = '/';
55248 + memcpy(path + bufsize + is_not_root, name, namelen);
55249 + *(path + bufsize + namelen + is_not_root) = '\0';
55250 +
55251 + tmp = obj->globbed;
55252 + while (tmp) {
55253 + if (!glob_match(tmp->filename, path)) {
55254 + preempt_enable();
55255 + return (tmp->mode & GR_FIND) ? 1 : 0;
55256 + }
55257 + tmp = tmp->next;
55258 + }
55259 + preempt_enable();
55260 + return (obj->mode & GR_FIND) ? 1 : 0;
55261 +}
55262 +
55263 +#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
55264 +EXPORT_SYMBOL(gr_acl_is_enabled);
55265 +#endif
55266 +EXPORT_SYMBOL(gr_learn_resource);
55267 +EXPORT_SYMBOL(gr_set_kernel_label);
55268 +#ifdef CONFIG_SECURITY
55269 +EXPORT_SYMBOL(gr_check_user_change);
55270 +EXPORT_SYMBOL(gr_check_group_change);
55271 +#endif
55272 +
55273 diff --git a/grsecurity/gracl_alloc.c b/grsecurity/gracl_alloc.c
55274 new file mode 100644
55275 index 0000000..34fefda
55276 --- /dev/null
55277 +++ b/grsecurity/gracl_alloc.c
55278 @@ -0,0 +1,105 @@
55279 +#include <linux/kernel.h>
55280 +#include <linux/mm.h>
55281 +#include <linux/slab.h>
55282 +#include <linux/vmalloc.h>
55283 +#include <linux/gracl.h>
55284 +#include <linux/grsecurity.h>
55285 +
55286 +static unsigned long alloc_stack_next = 1;
55287 +static unsigned long alloc_stack_size = 1;
55288 +static void **alloc_stack;
55289 +
55290 +static __inline__ int
55291 +alloc_pop(void)
55292 +{
55293 + if (alloc_stack_next == 1)
55294 + return 0;
55295 +
55296 + kfree(alloc_stack[alloc_stack_next - 2]);
55297 +
55298 + alloc_stack_next--;
55299 +
55300 + return 1;
55301 +}
55302 +
55303 +static __inline__ int
55304 +alloc_push(void *buf)
55305 +{
55306 + if (alloc_stack_next >= alloc_stack_size)
55307 + return 1;
55308 +
55309 + alloc_stack[alloc_stack_next - 1] = buf;
55310 +
55311 + alloc_stack_next++;
55312 +
55313 + return 0;
55314 +}
55315 +
55316 +void *
55317 +acl_alloc(unsigned long len)
55318 +{
55319 + void *ret = NULL;
55320 +
55321 + if (!len || len > PAGE_SIZE)
55322 + goto out;
55323 +
55324 + ret = kmalloc(len, GFP_KERNEL);
55325 +
55326 + if (ret) {
55327 + if (alloc_push(ret)) {
55328 + kfree(ret);
55329 + ret = NULL;
55330 + }
55331 + }
55332 +
55333 +out:
55334 + return ret;
55335 +}
55336 +
55337 +void *
55338 +acl_alloc_num(unsigned long num, unsigned long len)
55339 +{
55340 + if (!len || (num > (PAGE_SIZE / len)))
55341 + return NULL;
55342 +
55343 + return acl_alloc(num * len);
55344 +}
55345 +
55346 +void
55347 +acl_free_all(void)
55348 +{
55349 + if (gr_acl_is_enabled() || !alloc_stack)
55350 + return;
55351 +
55352 + while (alloc_pop()) ;
55353 +
55354 + if (alloc_stack) {
55355 + if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
55356 + kfree(alloc_stack);
55357 + else
55358 + vfree(alloc_stack);
55359 + }
55360 +
55361 + alloc_stack = NULL;
55362 + alloc_stack_size = 1;
55363 + alloc_stack_next = 1;
55364 +
55365 + return;
55366 +}
55367 +
55368 +int
55369 +acl_alloc_stack_init(unsigned long size)
55370 +{
55371 + if ((size * sizeof (void *)) <= PAGE_SIZE)
55372 + alloc_stack =
55373 + (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
55374 + else
55375 + alloc_stack = (void **) vmalloc(size * sizeof (void *));
55376 +
55377 + alloc_stack_size = size;
55378 +
55379 + if (!alloc_stack)
55380 + return 0;
55381 + else
55382 + return 1;
55383 +}
55384 diff --git a/grsecurity/gracl_cap.c b/grsecurity/gracl_cap.c
55385 new file mode 100644
55386 index 0000000..6d21049
55387 --- /dev/null
55388 +++ b/grsecurity/gracl_cap.c
55389 @@ -0,0 +1,110 @@
55390 +#include <linux/kernel.h>
55391 +#include <linux/module.h>
55392 +#include <linux/sched.h>
55393 +#include <linux/gracl.h>
55394 +#include <linux/grsecurity.h>
55395 +#include <linux/grinternal.h>
55396 +
55397 +extern const char *captab_log[];
55398 +extern int captab_log_entries;
55399 +
55400 +int gr_task_acl_is_capable(const struct task_struct *task, const struct cred *cred, const int cap)
55401 +{
55402 + struct acl_subject_label *curracl;
55403 + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
55404 + kernel_cap_t cap_audit = __cap_empty_set;
55405 +
55406 + if (!gr_acl_is_enabled())
55407 + return 1;
55408 +
55409 + curracl = task->acl;
55410 +
55411 + cap_drop = curracl->cap_lower;
55412 + cap_mask = curracl->cap_mask;
55413 + cap_audit = curracl->cap_invert_audit;
55414 +
55415 + while ((curracl = curracl->parent_subject)) {
55416 + /* if the cap isn't specified in the current computed mask but is specified in the
55417 + current level subject, and is lowered in the current level subject, then add
55418 + it to the set of dropped capabilities
55419 + otherwise, add the current level subject's mask to the current computed mask
55420 + */
55421 + if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55422 + cap_raise(cap_mask, cap);
55423 + if (cap_raised(curracl->cap_lower, cap))
55424 + cap_raise(cap_drop, cap);
55425 + if (cap_raised(curracl->cap_invert_audit, cap))
55426 + cap_raise(cap_audit, cap);
55427 + }
55428 + }
55429 +
55430 + if (!cap_raised(cap_drop, cap)) {
55431 + if (cap_raised(cap_audit, cap))
55432 + gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
55433 + return 1;
55434 + }
55435 +
55436 + curracl = task->acl;
55437 +
55438 + if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
55439 + && cap_raised(cred->cap_effective, cap)) {
55440 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
55441 + task->role->roletype, cred->uid,
55442 + cred->gid, task->exec_file ?
55443 + gr_to_filename(task->exec_file->f_path.dentry,
55444 + task->exec_file->f_path.mnt) : curracl->filename,
55445 + curracl->filename, 0UL,
55446 + 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
55447 + return 1;
55448 + }
55449 +
55450 + if ((cap >= 0) && (cap < captab_log_entries) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
55451 + gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
55452 +
55453 + return 0;
55454 +}
55455 +
55456 +int
55457 +gr_acl_is_capable(const int cap)
55458 +{
55459 + return gr_task_acl_is_capable(current, current_cred(), cap);
55460 +}
55461 +
55462 +int gr_task_acl_is_capable_nolog(const struct task_struct *task, const int cap)
55463 +{
55464 + struct acl_subject_label *curracl;
55465 + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
55466 +
55467 + if (!gr_acl_is_enabled())
55468 + return 1;
55469 +
55470 + curracl = task->acl;
55471 +
55472 + cap_drop = curracl->cap_lower;
55473 + cap_mask = curracl->cap_mask;
55474 +
55475 + while ((curracl = curracl->parent_subject)) {
55476 + /* if the cap isn't specified in the current computed mask but is specified in the
55477 + current level subject, and is lowered in the current level subject, then add
55478 + it to the set of dropped capabilities
55479 + otherwise, add the current level subject's mask to the current computed mask
55480 + */
55481 + if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55482 + cap_raise(cap_mask, cap);
55483 + if (cap_raised(curracl->cap_lower, cap))
55484 + cap_raise(cap_drop, cap);
55485 + }
55486 + }
55487 +
55488 + if (!cap_raised(cap_drop, cap))
55489 + return 1;
55490 +
55491 + return 0;
55492 +}
55493 +
55494 +int
55495 +gr_acl_is_capable_nolog(const int cap)
55496 +{
55497 + return gr_task_acl_is_capable_nolog(current, cap);
55498 +}
55499 +
55500 diff --git a/grsecurity/gracl_fs.c b/grsecurity/gracl_fs.c
55501 new file mode 100644
55502 index 0000000..d28e241
55503 --- /dev/null
55504 +++ b/grsecurity/gracl_fs.c
55505 @@ -0,0 +1,437 @@
55506 +#include <linux/kernel.h>
55507 +#include <linux/sched.h>
55508 +#include <linux/types.h>
55509 +#include <linux/fs.h>
55510 +#include <linux/file.h>
55511 +#include <linux/stat.h>
55512 +#include <linux/grsecurity.h>
55513 +#include <linux/grinternal.h>
55514 +#include <linux/gracl.h>
55515 +
55516 +umode_t
55517 +gr_acl_umask(void)
55518 +{
55519 + if (unlikely(!gr_acl_is_enabled()))
55520 + return 0;
55521 +
55522 + return current->role->umask;
55523 +}
55524 +
55525 +__u32
55526 +gr_acl_handle_hidden_file(const struct dentry * dentry,
55527 + const struct vfsmount * mnt)
55528 +{
55529 + __u32 mode;
55530 +
55531 + if (unlikely(!dentry->d_inode))
55532 + return GR_FIND;
55533 +
55534 + mode =
55535 + gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
55536 +
55537 + if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
55538 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55539 + return mode;
55540 + } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
55541 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55542 + return 0;
55543 + } else if (unlikely(!(mode & GR_FIND)))
55544 + return 0;
55545 +
55546 + return GR_FIND;
55547 +}
55548 +
55549 +__u32
55550 +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
55551 + int acc_mode)
55552 +{
55553 + __u32 reqmode = GR_FIND;
55554 + __u32 mode;
55555 +
55556 + if (unlikely(!dentry->d_inode))
55557 + return reqmode;
55558 +
55559 + if (acc_mode & MAY_APPEND)
55560 + reqmode |= GR_APPEND;
55561 + else if (acc_mode & MAY_WRITE)
55562 + reqmode |= GR_WRITE;
55563 + if ((acc_mode & MAY_READ) && !S_ISDIR(dentry->d_inode->i_mode))
55564 + reqmode |= GR_READ;
55565 +
55566 + mode =
55567 + gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55568 + mnt);
55569 +
55570 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55571 + gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55572 + reqmode & GR_READ ? " reading" : "",
55573 + reqmode & GR_WRITE ? " writing" : reqmode &
55574 + GR_APPEND ? " appending" : "");
55575 + return reqmode;
55576 + } else
55577 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55578 + {
55579 + gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55580 + reqmode & GR_READ ? " reading" : "",
55581 + reqmode & GR_WRITE ? " writing" : reqmode &
55582 + GR_APPEND ? " appending" : "");
55583 + return 0;
55584 + } else if (unlikely((mode & reqmode) != reqmode))
55585 + return 0;
55586 +
55587 + return reqmode;
55588 +}
55589 +
55590 +__u32
55591 +gr_acl_handle_creat(const struct dentry * dentry,
55592 + const struct dentry * p_dentry,
55593 + const struct vfsmount * p_mnt, int open_flags, int acc_mode,
55594 + const int imode)
55595 +{
55596 + __u32 reqmode = GR_WRITE | GR_CREATE;
55597 + __u32 mode;
55598 +
55599 + if (acc_mode & MAY_APPEND)
55600 + reqmode |= GR_APPEND;
55601 + // if a directory was required or the directory already exists, then
55602 + // don't count this open as a read
55603 + if ((acc_mode & MAY_READ) &&
55604 + !((open_flags & O_DIRECTORY) || (dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode))))
55605 + reqmode |= GR_READ;
55606 + if ((open_flags & O_CREAT) &&
55607 + ((imode & S_ISUID) || ((imode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))))
55608 + reqmode |= GR_SETID;
55609 +
55610 + mode =
55611 + gr_check_create(dentry, p_dentry, p_mnt,
55612 + reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55613 +
55614 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55615 + gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55616 + reqmode & GR_READ ? " reading" : "",
55617 + reqmode & GR_WRITE ? " writing" : reqmode &
55618 + GR_APPEND ? " appending" : "");
55619 + return reqmode;
55620 + } else
55621 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55622 + {
55623 + gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55624 + reqmode & GR_READ ? " reading" : "",
55625 + reqmode & GR_WRITE ? " writing" : reqmode &
55626 + GR_APPEND ? " appending" : "");
55627 + return 0;
55628 + } else if (unlikely((mode & reqmode) != reqmode))
55629 + return 0;
55630 +
55631 + return reqmode;
55632 +}
55633 +
55634 +__u32
55635 +gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
55636 + const int fmode)
55637 +{
55638 + __u32 mode, reqmode = GR_FIND;
55639 +
55640 + if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
55641 + reqmode |= GR_EXEC;
55642 + if (fmode & S_IWOTH)
55643 + reqmode |= GR_WRITE;
55644 + if (fmode & S_IROTH)
55645 + reqmode |= GR_READ;
55646 +
55647 + mode =
55648 + gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55649 + mnt);
55650 +
55651 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55652 + gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55653 + reqmode & GR_READ ? " reading" : "",
55654 + reqmode & GR_WRITE ? " writing" : "",
55655 + reqmode & GR_EXEC ? " executing" : "");
55656 + return reqmode;
55657 + } else
55658 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55659 + {
55660 + gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55661 + reqmode & GR_READ ? " reading" : "",
55662 + reqmode & GR_WRITE ? " writing" : "",
55663 + reqmode & GR_EXEC ? " executing" : "");
55664 + return 0;
55665 + } else if (unlikely((mode & reqmode) != reqmode))
55666 + return 0;
55667 +
55668 + return reqmode;
55669 +}
55670 +
55671 +static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
55672 +{
55673 + __u32 mode;
55674 +
55675 + mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
55676 +
55677 + if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
55678 + gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
55679 + return mode;
55680 + } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
55681 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
55682 + return 0;
55683 + } else if (unlikely((mode & (reqmode)) != (reqmode)))
55684 + return 0;
55685 +
55686 + return (reqmode);
55687 +}
55688 +
55689 +__u32
55690 +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
55691 +{
55692 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
55693 +}
55694 +
55695 +__u32
55696 +gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
55697 +{
55698 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
55699 +}
55700 +
55701 +__u32
55702 +gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
55703 +{
55704 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
55705 +}
55706 +
55707 +__u32
55708 +gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
55709 +{
55710 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
55711 +}
55712 +
55713 +__u32
55714 +gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
55715 + umode_t *modeptr)
55716 +{
55717 + umode_t mode;
55718 +
55719 + *modeptr &= ~gr_acl_umask();
55720 + mode = *modeptr;
55721 +
55722 + if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
55723 + return 1;
55724 +
55725 + if (unlikely(dentry->d_inode && !S_ISDIR(dentry->d_inode->i_mode) &&
55726 + ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))))) {
55727 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
55728 + GR_CHMOD_ACL_MSG);
55729 + } else {
55730 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
55731 + }
55732 +}
55733 +
55734 +__u32
55735 +gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
55736 +{
55737 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
55738 +}
55739 +
55740 +__u32
55741 +gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
55742 +{
55743 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
55744 +}
55745 +
55746 +__u32
55747 +gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
55748 +{
55749 + return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
55750 +}
55751 +
55752 +__u32
55753 +gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
55754 +{
55755 + return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
55756 + GR_UNIXCONNECT_ACL_MSG);
55757 +}
55758 +
55759 +/* hardlinks require at minimum create and link permission,
55760 + any additional privilege required is based on the
55761 + privilege of the file being linked to
55762 +*/
55763 +__u32
55764 +gr_acl_handle_link(const struct dentry * new_dentry,
55765 + const struct dentry * parent_dentry,
55766 + const struct vfsmount * parent_mnt,
55767 + const struct dentry * old_dentry,
55768 + const struct vfsmount * old_mnt, const char *to)
55769 +{
55770 + __u32 mode;
55771 + __u32 needmode = GR_CREATE | GR_LINK;
55772 + __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
55773 +
55774 + mode =
55775 + gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
55776 + old_mnt);
55777 +
55778 + if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
55779 + gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
55780 + return mode;
55781 + } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
55782 + gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
55783 + return 0;
55784 + } else if (unlikely((mode & needmode) != needmode))
55785 + return 0;
55786 +
55787 + return 1;
55788 +}
55789 +
55790 +__u32
55791 +gr_acl_handle_symlink(const struct dentry * new_dentry,
55792 + const struct dentry * parent_dentry,
55793 + const struct vfsmount * parent_mnt, const char *from)
55794 +{
55795 + __u32 needmode = GR_WRITE | GR_CREATE;
55796 + __u32 mode;
55797 +
55798 + mode =
55799 + gr_check_create(new_dentry, parent_dentry, parent_mnt,
55800 + GR_CREATE | GR_AUDIT_CREATE |
55801 + GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
55802 +
55803 + if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
55804 + gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
55805 + return mode;
55806 + } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
55807 + gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
55808 + return 0;
55809 + } else if (unlikely((mode & needmode) != needmode))
55810 + return 0;
55811 +
55812 + return (GR_WRITE | GR_CREATE);
55813 +}
55814 +
55815 +static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
55816 +{
55817 + __u32 mode;
55818 +
55819 + mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55820 +
55821 + if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
55822 + gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
55823 + return mode;
55824 + } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
55825 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
55826 + return 0;
55827 + } else if (unlikely((mode & (reqmode)) != (reqmode)))
55828 + return 0;
55829 +
55830 + return (reqmode);
55831 +}
55832 +
55833 +__u32
55834 +gr_acl_handle_mknod(const struct dentry * new_dentry,
55835 + const struct dentry * parent_dentry,
55836 + const struct vfsmount * parent_mnt,
55837 + const int mode)
55838 +{
55839 + __u32 reqmode = GR_WRITE | GR_CREATE;
55840 + if (unlikely((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))))
55841 + reqmode |= GR_SETID;
55842 +
55843 + return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
55844 + reqmode, GR_MKNOD_ACL_MSG);
55845 +}
55846 +
55847 +__u32
55848 +gr_acl_handle_mkdir(const struct dentry *new_dentry,
55849 + const struct dentry *parent_dentry,
55850 + const struct vfsmount *parent_mnt)
55851 +{
55852 + return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
55853 + GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
55854 +}
55855 +
55856 +#define RENAME_CHECK_SUCCESS(old, new) \
55857 + (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
55858 + ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
55859 +
55860 +int
55861 +gr_acl_handle_rename(struct dentry *new_dentry,
55862 + struct dentry *parent_dentry,
55863 + const struct vfsmount *parent_mnt,
55864 + struct dentry *old_dentry,
55865 + struct inode *old_parent_inode,
55866 + struct vfsmount *old_mnt, const char *newname)
55867 +{
55868 + __u32 comp1, comp2;
55869 + int error = 0;
55870 +
55871 + if (unlikely(!gr_acl_is_enabled()))
55872 + return 0;
55873 +
55874 + if (!new_dentry->d_inode) {
55875 + comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
55876 + GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
55877 + GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
55878 + comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
55879 + GR_DELETE | GR_AUDIT_DELETE |
55880 + GR_AUDIT_READ | GR_AUDIT_WRITE |
55881 + GR_SUPPRESS, old_mnt);
55882 + } else {
55883 + comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
55884 + GR_CREATE | GR_DELETE |
55885 + GR_AUDIT_CREATE | GR_AUDIT_DELETE |
55886 + GR_AUDIT_READ | GR_AUDIT_WRITE |
55887 + GR_SUPPRESS, parent_mnt);
55888 + comp2 =
55889 + gr_search_file(old_dentry,
55890 + GR_READ | GR_WRITE | GR_AUDIT_READ |
55891 + GR_DELETE | GR_AUDIT_DELETE |
55892 + GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
55893 + }
55894 +
55895 + if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
55896 + ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
55897 + gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
55898 + else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
55899 + && !(comp2 & GR_SUPPRESS)) {
55900 + gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
55901 + error = -EACCES;
55902 + } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
55903 + error = -EACCES;
55904 +
55905 + return error;
55906 +}
55907 +
55908 +void
55909 +gr_acl_handle_exit(void)
55910 +{
55911 + u16 id;
55912 + char *rolename;
55913 + struct file *exec_file;
55914 +
55915 + if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
55916 + !(current->role->roletype & GR_ROLE_PERSIST))) {
55917 + id = current->acl_role_id;
55918 + rolename = current->role->rolename;
55919 + gr_set_acls(1);
55920 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
55921 + }
55922 +
55923 + write_lock(&grsec_exec_file_lock);
55924 + exec_file = current->exec_file;
55925 + current->exec_file = NULL;
55926 + write_unlock(&grsec_exec_file_lock);
55927 +
55928 + if (exec_file)
55929 + fput(exec_file);
55930 +}
55931 +
55932 +int
55933 +gr_acl_handle_procpidmem(const struct task_struct *task)
55934 +{
55935 + if (unlikely(!gr_acl_is_enabled()))
55936 + return 0;
55937 +
55938 + if (task != current && task->acl->mode & GR_PROTPROCFD)
55939 + return -EACCES;
55940 +
55941 + return 0;
55942 +}
55943 diff --git a/grsecurity/gracl_ip.c b/grsecurity/gracl_ip.c
55944 new file mode 100644
55945 index 0000000..58800a7
55946 --- /dev/null
55947 +++ b/grsecurity/gracl_ip.c
55948 @@ -0,0 +1,384 @@
55949 +#include <linux/kernel.h>
55950 +#include <asm/uaccess.h>
55951 +#include <asm/errno.h>
55952 +#include <net/sock.h>
55953 +#include <linux/file.h>
55954 +#include <linux/fs.h>
55955 +#include <linux/net.h>
55956 +#include <linux/in.h>
55957 +#include <linux/skbuff.h>
55958 +#include <linux/ip.h>
55959 +#include <linux/udp.h>
55960 +#include <linux/types.h>
55961 +#include <linux/sched.h>
55962 +#include <linux/netdevice.h>
55963 +#include <linux/inetdevice.h>
55964 +#include <linux/gracl.h>
55965 +#include <linux/grsecurity.h>
55966 +#include <linux/grinternal.h>
55967 +
55968 +#define GR_BIND 0x01
55969 +#define GR_CONNECT 0x02
55970 +#define GR_INVERT 0x04
55971 +#define GR_BINDOVERRIDE 0x08
55972 +#define GR_CONNECTOVERRIDE 0x10
55973 +#define GR_SOCK_FAMILY 0x20
55974 +
55975 +static const char * gr_protocols[IPPROTO_MAX] = {
55976 + "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
55977 + "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
55978 + "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
55979 + "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
55980 + "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
55981 + "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
55982 + "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
55983 + "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
55984 + "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
55985 + "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
55986 + "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
55987 + "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
55988 + "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
55989 + "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
55990 + "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
55991 + "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
55992 + "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
55993 + "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
55994 + "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
55995 + "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
55996 + "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
55997 + "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
55998 + "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
55999 + "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
56000 + "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
56001 + "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
56002 + "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
56003 + "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
56004 + "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
56005 + "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
56006 + "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
56007 + "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
56008 + };
56009 +
56010 +static const char * gr_socktypes[SOCK_MAX] = {
56011 + "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
56012 + "unknown:7", "unknown:8", "unknown:9", "packet"
56013 + };
56014 +
56015 +static const char * gr_sockfamilies[AF_MAX+1] = {
56016 + "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
56017 + "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
56018 + "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
56019 + "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154", "ciaf"
56020 + };
56021 +
56022 +const char *
56023 +gr_proto_to_name(unsigned char proto)
56024 +{
56025 + return gr_protocols[proto];
56026 +}
56027 +
56028 +const char *
56029 +gr_socktype_to_name(unsigned char type)
56030 +{
56031 + return gr_socktypes[type];
56032 +}
56033 +
56034 +const char *
56035 +gr_sockfamily_to_name(unsigned char family)
56036 +{
56037 + return gr_sockfamilies[family];
56038 +}
56039 +
56040 +int
56041 +gr_search_socket(const int domain, const int type, const int protocol)
56042 +{
56043 + struct acl_subject_label *curr;
56044 + const struct cred *cred = current_cred();
56045 +
56046 + if (unlikely(!gr_acl_is_enabled()))
56047 + goto exit;
56048 +
56049 + if ((domain < 0) || (type < 0) || (protocol < 0) ||
56050 + (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
56051 + goto exit; // let the kernel handle it
56052 +
56053 + curr = current->acl;
56054 +
56055 + if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
56056 + /* the family is allowed, if this is PF_INET allow it only if
56057 + the extra sock type/protocol checks pass */
56058 + if (domain == PF_INET)
56059 + goto inet_check;
56060 + goto exit;
56061 + } else {
56062 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56063 + __u32 fakeip = 0;
56064 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56065 + current->role->roletype, cred->uid,
56066 + cred->gid, current->exec_file ?
56067 + gr_to_filename(current->exec_file->f_path.dentry,
56068 + current->exec_file->f_path.mnt) :
56069 + curr->filename, curr->filename,
56070 + &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
56071 + &current->signal->saved_ip);
56072 + goto exit;
56073 + }
56074 + goto exit_fail;
56075 + }
56076 +
56077 +inet_check:
56078 + /* the rest of this checking is for IPv4 only */
56079 + if (!curr->ips)
56080 + goto exit;
56081 +
56082 + if ((curr->ip_type & (1 << type)) &&
56083 + (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
56084 + goto exit;
56085 +
56086 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56087 + /* we don't place acls on raw sockets , and sometimes
56088 + dgram/ip sockets are opened for ioctl and not
56089 + bind/connect, so we'll fake a bind learn log */
56090 + if (type == SOCK_RAW || type == SOCK_PACKET) {
56091 + __u32 fakeip = 0;
56092 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56093 + current->role->roletype, cred->uid,
56094 + cred->gid, current->exec_file ?
56095 + gr_to_filename(current->exec_file->f_path.dentry,
56096 + current->exec_file->f_path.mnt) :
56097 + curr->filename, curr->filename,
56098 + &fakeip, 0, type,
56099 + protocol, GR_CONNECT, &current->signal->saved_ip);
56100 + } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
56101 + __u32 fakeip = 0;
56102 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56103 + current->role->roletype, cred->uid,
56104 + cred->gid, current->exec_file ?
56105 + gr_to_filename(current->exec_file->f_path.dentry,
56106 + current->exec_file->f_path.mnt) :
56107 + curr->filename, curr->filename,
56108 + &fakeip, 0, type,
56109 + protocol, GR_BIND, &current->signal->saved_ip);
56110 + }
56111 + /* we'll log when they use connect or bind */
56112 + goto exit;
56113 + }
56114 +
56115 +exit_fail:
56116 + if (domain == PF_INET)
56117 + gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
56118 + gr_socktype_to_name(type), gr_proto_to_name(protocol));
56119 + else
56120 + gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
56121 + gr_socktype_to_name(type), protocol);
56122 +
56123 + return 0;
56124 +exit:
56125 + return 1;
56126 +}
56127 +
56128 +int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
56129 +{
56130 + if ((ip->mode & mode) &&
56131 + (ip_port >= ip->low) &&
56132 + (ip_port <= ip->high) &&
56133 + ((ntohl(ip_addr) & our_netmask) ==
56134 + (ntohl(our_addr) & our_netmask))
56135 + && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
56136 + && (ip->type & (1 << type))) {
56137 + if (ip->mode & GR_INVERT)
56138 + return 2; // specifically denied
56139 + else
56140 + return 1; // allowed
56141 + }
56142 +
56143 + return 0; // not specifically allowed, may continue parsing
56144 +}
56145 +
56146 +static int
56147 +gr_search_connectbind(const int full_mode, struct sock *sk,
56148 + struct sockaddr_in *addr, const int type)
56149 +{
56150 + char iface[IFNAMSIZ] = {0};
56151 + struct acl_subject_label *curr;
56152 + struct acl_ip_label *ip;
56153 + struct inet_sock *isk;
56154 + struct net_device *dev;
56155 + struct in_device *idev;
56156 + unsigned long i;
56157 + int ret;
56158 + int mode = full_mode & (GR_BIND | GR_CONNECT);
56159 + __u32 ip_addr = 0;
56160 + __u32 our_addr;
56161 + __u32 our_netmask;
56162 + char *p;
56163 + __u16 ip_port = 0;
56164 + const struct cred *cred = current_cred();
56165 +
56166 + if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
56167 + return 0;
56168 +
56169 + curr = current->acl;
56170 + isk = inet_sk(sk);
56171 +
56172 + /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
56173 + if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
56174 + addr->sin_addr.s_addr = curr->inaddr_any_override;
56175 + if ((full_mode & GR_CONNECT) && isk->inet_saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
56176 + struct sockaddr_in saddr;
56177 + int err;
56178 +
56179 + saddr.sin_family = AF_INET;
56180 + saddr.sin_addr.s_addr = curr->inaddr_any_override;
56181 + saddr.sin_port = isk->inet_sport;
56182 +
56183 + err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
56184 + if (err)
56185 + return err;
56186 +
56187 + err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
56188 + if (err)
56189 + return err;
56190 + }
56191 +
56192 + if (!curr->ips)
56193 + return 0;
56194 +
56195 + ip_addr = addr->sin_addr.s_addr;
56196 + ip_port = ntohs(addr->sin_port);
56197 +
56198 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56199 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56200 + current->role->roletype, cred->uid,
56201 + cred->gid, current->exec_file ?
56202 + gr_to_filename(current->exec_file->f_path.dentry,
56203 + current->exec_file->f_path.mnt) :
56204 + curr->filename, curr->filename,
56205 + &ip_addr, ip_port, type,
56206 + sk->sk_protocol, mode, &current->signal->saved_ip);
56207 + return 0;
56208 + }
56209 +
56210 + for (i = 0; i < curr->ip_num; i++) {
56211 + ip = *(curr->ips + i);
56212 + if (ip->iface != NULL) {
56213 + strncpy(iface, ip->iface, IFNAMSIZ - 1);
56214 + p = strchr(iface, ':');
56215 + if (p != NULL)
56216 + *p = '\0';
56217 + dev = dev_get_by_name(sock_net(sk), iface);
56218 + if (dev == NULL)
56219 + continue;
56220 + idev = in_dev_get(dev);
56221 + if (idev == NULL) {
56222 + dev_put(dev);
56223 + continue;
56224 + }
56225 + rcu_read_lock();
56226 + for_ifa(idev) {
56227 + if (!strcmp(ip->iface, ifa->ifa_label)) {
56228 + our_addr = ifa->ifa_address;
56229 + our_netmask = 0xffffffff;
56230 + ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
56231 + if (ret == 1) {
56232 + rcu_read_unlock();
56233 + in_dev_put(idev);
56234 + dev_put(dev);
56235 + return 0;
56236 + } else if (ret == 2) {
56237 + rcu_read_unlock();
56238 + in_dev_put(idev);
56239 + dev_put(dev);
56240 + goto denied;
56241 + }
56242 + }
56243 + } endfor_ifa(idev);
56244 + rcu_read_unlock();
56245 + in_dev_put(idev);
56246 + dev_put(dev);
56247 + } else {
56248 + our_addr = ip->addr;
56249 + our_netmask = ip->netmask;
56250 + ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
56251 + if (ret == 1)
56252 + return 0;
56253 + else if (ret == 2)
56254 + goto denied;
56255 + }
56256 + }
56257 +
56258 +denied:
56259 + if (mode == GR_BIND)
56260 + gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
56261 + else if (mode == GR_CONNECT)
56262 + gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
56263 +
56264 + return -EACCES;
56265 +}
56266 +
56267 +int
56268 +gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
56269 +{
56270 + /* always allow disconnection of dgram sockets with connect */
56271 + if (addr->sin_family == AF_UNSPEC)
56272 + return 0;
56273 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
56274 +}
56275 +
56276 +int
56277 +gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
56278 +{
56279 + return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
56280 +}
56281 +
56282 +int gr_search_listen(struct socket *sock)
56283 +{
56284 + struct sock *sk = sock->sk;
56285 + struct sockaddr_in addr;
56286 +
56287 + addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
56288 + addr.sin_port = inet_sk(sk)->inet_sport;
56289 +
56290 + return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
56291 +}
56292 +
56293 +int gr_search_accept(struct socket *sock)
56294 +{
56295 + struct sock *sk = sock->sk;
56296 + struct sockaddr_in addr;
56297 +
56298 + addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
56299 + addr.sin_port = inet_sk(sk)->inet_sport;
56300 +
56301 + return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
56302 +}
56303 +
56304 +int
56305 +gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
56306 +{
56307 + if (addr)
56308 + return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
56309 + else {
56310 + struct sockaddr_in sin;
56311 + const struct inet_sock *inet = inet_sk(sk);
56312 +
56313 + sin.sin_addr.s_addr = inet->inet_daddr;
56314 + sin.sin_port = inet->inet_dport;
56315 +
56316 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
56317 + }
56318 +}
56319 +
56320 +int
56321 +gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
56322 +{
56323 + struct sockaddr_in sin;
56324 +
56325 + if (unlikely(skb->len < sizeof (struct udphdr)))
56326 + return 0; // skip this packet
56327 +
56328 + sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
56329 + sin.sin_port = udp_hdr(skb)->source;
56330 +
56331 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
56332 +}
56333 diff --git a/grsecurity/gracl_learn.c b/grsecurity/gracl_learn.c
56334 new file mode 100644
56335 index 0000000..25f54ef
56336 --- /dev/null
56337 +++ b/grsecurity/gracl_learn.c
56338 @@ -0,0 +1,207 @@
56339 +#include <linux/kernel.h>
56340 +#include <linux/mm.h>
56341 +#include <linux/sched.h>
56342 +#include <linux/poll.h>
56343 +#include <linux/string.h>
56344 +#include <linux/file.h>
56345 +#include <linux/types.h>
56346 +#include <linux/vmalloc.h>
56347 +#include <linux/grinternal.h>
56348 +
56349 +extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
56350 + size_t count, loff_t *ppos);
56351 +extern int gr_acl_is_enabled(void);
56352 +
56353 +static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
56354 +static int gr_learn_attached;
56355 +
56356 +/* use a 512k buffer */
56357 +#define LEARN_BUFFER_SIZE (512 * 1024)
56358 +
56359 +static DEFINE_SPINLOCK(gr_learn_lock);
56360 +static DEFINE_MUTEX(gr_learn_user_mutex);
56361 +
56362 +/* we need to maintain two buffers, so that the kernel context of grlearn
56363 + uses a semaphore around the userspace copying, and the other kernel contexts
56364 + use a spinlock when copying into the buffer, since they cannot sleep
56365 +*/
56366 +static char *learn_buffer;
56367 +static char *learn_buffer_user;
56368 +static int learn_buffer_len;
56369 +static int learn_buffer_user_len;
56370 +
56371 +static ssize_t
56372 +read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
56373 +{
56374 + DECLARE_WAITQUEUE(wait, current);
56375 + ssize_t retval = 0;
56376 +
56377 + add_wait_queue(&learn_wait, &wait);
56378 + set_current_state(TASK_INTERRUPTIBLE);
56379 + do {
56380 + mutex_lock(&gr_learn_user_mutex);
56381 + spin_lock(&gr_learn_lock);
56382 + if (learn_buffer_len)
56383 + break;
56384 + spin_unlock(&gr_learn_lock);
56385 + mutex_unlock(&gr_learn_user_mutex);
56386 + if (file->f_flags & O_NONBLOCK) {
56387 + retval = -EAGAIN;
56388 + goto out;
56389 + }
56390 + if (signal_pending(current)) {
56391 + retval = -ERESTARTSYS;
56392 + goto out;
56393 + }
56394 +
56395 + schedule();
56396 + } while (1);
56397 +
56398 + memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
56399 + learn_buffer_user_len = learn_buffer_len;
56400 + retval = learn_buffer_len;
56401 + learn_buffer_len = 0;
56402 +
56403 + spin_unlock(&gr_learn_lock);
56404 +
56405 + if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
56406 + retval = -EFAULT;
56407 +
56408 + mutex_unlock(&gr_learn_user_mutex);
56409 +out:
56410 + set_current_state(TASK_RUNNING);
56411 + remove_wait_queue(&learn_wait, &wait);
56412 + return retval;
56413 +}
56414 +
56415 +static unsigned int
56416 +poll_learn(struct file * file, poll_table * wait)
56417 +{
56418 + poll_wait(file, &learn_wait, wait);
56419 +
56420 + if (learn_buffer_len)
56421 + return (POLLIN | POLLRDNORM);
56422 +
56423 + return 0;
56424 +}
56425 +
56426 +void
56427 +gr_clear_learn_entries(void)
56428 +{
56429 + char *tmp;
56430 +
56431 + mutex_lock(&gr_learn_user_mutex);
56432 + spin_lock(&gr_learn_lock);
56433 + tmp = learn_buffer;
56434 + learn_buffer = NULL;
56435 + spin_unlock(&gr_learn_lock);
56436 + if (tmp)
56437 + vfree(tmp);
56438 + if (learn_buffer_user != NULL) {
56439 + vfree(learn_buffer_user);
56440 + learn_buffer_user = NULL;
56441 + }
56442 + learn_buffer_len = 0;
56443 + mutex_unlock(&gr_learn_user_mutex);
56444 +
56445 + return;
56446 +}
56447 +
56448 +void
56449 +gr_add_learn_entry(const char *fmt, ...)
56450 +{
56451 + va_list args;
56452 + unsigned int len;
56453 +
56454 + if (!gr_learn_attached)
56455 + return;
56456 +
56457 + spin_lock(&gr_learn_lock);
56458 +
56459 + /* leave a gap at the end so we know when it's "full" but don't have to
56460 + compute the exact length of the string we're trying to append
56461 + */
56462 + if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
56463 + spin_unlock(&gr_learn_lock);
56464 + wake_up_interruptible(&learn_wait);
56465 + return;
56466 + }
56467 + if (learn_buffer == NULL) {
56468 + spin_unlock(&gr_learn_lock);
56469 + return;
56470 + }
56471 +
56472 + va_start(args, fmt);
56473 + len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
56474 + va_end(args);
56475 +
56476 + learn_buffer_len += len + 1;
56477 +
56478 + spin_unlock(&gr_learn_lock);
56479 + wake_up_interruptible(&learn_wait);
56480 +
56481 + return;
56482 +}
56483 +
56484 +static int
56485 +open_learn(struct inode *inode, struct file *file)
56486 +{
56487 + if (file->f_mode & FMODE_READ && gr_learn_attached)
56488 + return -EBUSY;
56489 + if (file->f_mode & FMODE_READ) {
56490 + int retval = 0;
56491 + mutex_lock(&gr_learn_user_mutex);
56492 + if (learn_buffer == NULL)
56493 + learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
56494 + if (learn_buffer_user == NULL)
56495 + learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
56496 + if (learn_buffer == NULL) {
56497 + retval = -ENOMEM;
56498 + goto out_error;
56499 + }
56500 + if (learn_buffer_user == NULL) {
56501 + retval = -ENOMEM;
56502 + goto out_error;
56503 + }
56504 + learn_buffer_len = 0;
56505 + learn_buffer_user_len = 0;
56506 + gr_learn_attached = 1;
56507 +out_error:
56508 + mutex_unlock(&gr_learn_user_mutex);
56509 + return retval;
56510 + }
56511 + return 0;
56512 +}
56513 +
56514 +static int
56515 +close_learn(struct inode *inode, struct file *file)
56516 +{
56517 + if (file->f_mode & FMODE_READ) {
56518 + char *tmp = NULL;
56519 + mutex_lock(&gr_learn_user_mutex);
56520 + spin_lock(&gr_learn_lock);
56521 + tmp = learn_buffer;
56522 + learn_buffer = NULL;
56523 + spin_unlock(&gr_learn_lock);
56524 + if (tmp)
56525 + vfree(tmp);
56526 + if (learn_buffer_user != NULL) {
56527 + vfree(learn_buffer_user);
56528 + learn_buffer_user = NULL;
56529 + }
56530 + learn_buffer_len = 0;
56531 + learn_buffer_user_len = 0;
56532 + gr_learn_attached = 0;
56533 + mutex_unlock(&gr_learn_user_mutex);
56534 + }
56535 +
56536 + return 0;
56537 +}
56538 +
56539 +const struct file_operations grsec_fops = {
56540 + .read = read_learn,
56541 + .write = write_grsec_handler,
56542 + .open = open_learn,
56543 + .release = close_learn,
56544 + .poll = poll_learn,
56545 +};
56546 diff --git a/grsecurity/gracl_res.c b/grsecurity/gracl_res.c
56547 new file mode 100644
56548 index 0000000..39645c9
56549 --- /dev/null
56550 +++ b/grsecurity/gracl_res.c
56551 @@ -0,0 +1,68 @@
56552 +#include <linux/kernel.h>
56553 +#include <linux/sched.h>
56554 +#include <linux/gracl.h>
56555 +#include <linux/grinternal.h>
56556 +
56557 +static const char *restab_log[] = {
56558 + [RLIMIT_CPU] = "RLIMIT_CPU",
56559 + [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
56560 + [RLIMIT_DATA] = "RLIMIT_DATA",
56561 + [RLIMIT_STACK] = "RLIMIT_STACK",
56562 + [RLIMIT_CORE] = "RLIMIT_CORE",
56563 + [RLIMIT_RSS] = "RLIMIT_RSS",
56564 + [RLIMIT_NPROC] = "RLIMIT_NPROC",
56565 + [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
56566 + [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
56567 + [RLIMIT_AS] = "RLIMIT_AS",
56568 + [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
56569 + [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
56570 + [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
56571 + [RLIMIT_NICE] = "RLIMIT_NICE",
56572 + [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
56573 + [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
56574 + [GR_CRASH_RES] = "RLIMIT_CRASH"
56575 +};
56576 +
56577 +void
56578 +gr_log_resource(const struct task_struct *task,
56579 + const int res, const unsigned long wanted, const int gt)
56580 +{
56581 + const struct cred *cred;
56582 + unsigned long rlim;
56583 +
56584 + if (!gr_acl_is_enabled() && !grsec_resource_logging)
56585 + return;
56586 +
56587 + // not yet supported resource
56588 + if (unlikely(!restab_log[res]))
56589 + return;
56590 +
56591 + if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
56592 + rlim = task_rlimit_max(task, res);
56593 + else
56594 + rlim = task_rlimit(task, res);
56595 +
56596 + if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
56597 + return;
56598 +
56599 + rcu_read_lock();
56600 + cred = __task_cred(task);
56601 +
56602 + if (res == RLIMIT_NPROC &&
56603 + (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
56604 + cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
56605 + goto out_rcu_unlock;
56606 + else if (res == RLIMIT_MEMLOCK &&
56607 + cap_raised(cred->cap_effective, CAP_IPC_LOCK))
56608 + goto out_rcu_unlock;
56609 + else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
56610 + goto out_rcu_unlock;
56611 + rcu_read_unlock();
56612 +
56613 + gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
56614 +
56615 + return;
56616 +out_rcu_unlock:
56617 + rcu_read_unlock();
56618 + return;
56619 +}
56620 diff --git a/grsecurity/gracl_segv.c b/grsecurity/gracl_segv.c
56621 new file mode 100644
56622 index 0000000..25197e9
56623 --- /dev/null
56624 +++ b/grsecurity/gracl_segv.c
56625 @@ -0,0 +1,299 @@
56626 +#include <linux/kernel.h>
56627 +#include <linux/mm.h>
56628 +#include <asm/uaccess.h>
56629 +#include <asm/errno.h>
56630 +#include <asm/mman.h>
56631 +#include <net/sock.h>
56632 +#include <linux/file.h>
56633 +#include <linux/fs.h>
56634 +#include <linux/net.h>
56635 +#include <linux/in.h>
56636 +#include <linux/slab.h>
56637 +#include <linux/types.h>
56638 +#include <linux/sched.h>
56639 +#include <linux/timer.h>
56640 +#include <linux/gracl.h>
56641 +#include <linux/grsecurity.h>
56642 +#include <linux/grinternal.h>
56643 +
56644 +static struct crash_uid *uid_set;
56645 +static unsigned short uid_used;
56646 +static DEFINE_SPINLOCK(gr_uid_lock);
56647 +extern rwlock_t gr_inode_lock;
56648 +extern struct acl_subject_label *
56649 + lookup_acl_subj_label(const ino_t inode, const dev_t dev,
56650 + struct acl_role_label *role);
56651 +
56652 +#ifdef CONFIG_BTRFS_FS
56653 +extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
56654 +extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
56655 +#endif
56656 +
56657 +static inline dev_t __get_dev(const struct dentry *dentry)
56658 +{
56659 +#ifdef CONFIG_BTRFS_FS
56660 + if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
56661 + return get_btrfs_dev_from_inode(dentry->d_inode);
56662 + else
56663 +#endif
56664 + return dentry->d_inode->i_sb->s_dev;
56665 +}
56666 +
56667 +int
56668 +gr_init_uidset(void)
56669 +{
56670 + uid_set =
56671 + kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
56672 + uid_used = 0;
56673 +
56674 + return uid_set ? 1 : 0;
56675 +}
56676 +
56677 +void
56678 +gr_free_uidset(void)
56679 +{
56680 + if (uid_set)
56681 + kfree(uid_set);
56682 +
56683 + return;
56684 +}
56685 +
56686 +int
56687 +gr_find_uid(const uid_t uid)
56688 +{
56689 + struct crash_uid *tmp = uid_set;
56690 + uid_t buid;
56691 + int low = 0, high = uid_used - 1, mid;
56692 +
56693 + while (high >= low) {
56694 + mid = (low + high) >> 1;
56695 + buid = tmp[mid].uid;
56696 + if (buid == uid)
56697 + return mid;
56698 + if (buid > uid)
56699 + high = mid - 1;
56700 + if (buid < uid)
56701 + low = mid + 1;
56702 + }
56703 +
56704 + return -1;
56705 +}
56706 +
56707 +static __inline__ void
56708 +gr_insertsort(void)
56709 +{
56710 + unsigned short i, j;
56711 + struct crash_uid index;
56712 +
56713 + for (i = 1; i < uid_used; i++) {
56714 + index = uid_set[i];
56715 + j = i;
56716 + while ((j > 0) && uid_set[j - 1].uid > index.uid) {
56717 + uid_set[j] = uid_set[j - 1];
56718 + j--;
56719 + }
56720 + uid_set[j] = index;
56721 + }
56722 +
56723 + return;
56724 +}
56725 +
56726 +static __inline__ void
56727 +gr_insert_uid(const uid_t uid, const unsigned long expires)
56728 +{
56729 + int loc;
56730 +
56731 + if (uid_used == GR_UIDTABLE_MAX)
56732 + return;
56733 +
56734 + loc = gr_find_uid(uid);
56735 +
56736 + if (loc >= 0) {
56737 + uid_set[loc].expires = expires;
56738 + return;
56739 + }
56740 +
56741 + uid_set[uid_used].uid = uid;
56742 + uid_set[uid_used].expires = expires;
56743 + uid_used++;
56744 +
56745 + gr_insertsort();
56746 +
56747 + return;
56748 +}
56749 +
56750 +void
56751 +gr_remove_uid(const unsigned short loc)
56752 +{
56753 + unsigned short i;
56754 +
56755 + for (i = loc + 1; i < uid_used; i++)
56756 + uid_set[i - 1] = uid_set[i];
56757 +
56758 + uid_used--;
56759 +
56760 + return;
56761 +}
56762 +
56763 +int
56764 +gr_check_crash_uid(const uid_t uid)
56765 +{
56766 + int loc;
56767 + int ret = 0;
56768 +
56769 + if (unlikely(!gr_acl_is_enabled()))
56770 + return 0;
56771 +
56772 + spin_lock(&gr_uid_lock);
56773 + loc = gr_find_uid(uid);
56774 +
56775 + if (loc < 0)
56776 + goto out_unlock;
56777 +
56778 + if (time_before_eq(uid_set[loc].expires, get_seconds()))
56779 + gr_remove_uid(loc);
56780 + else
56781 + ret = 1;
56782 +
56783 +out_unlock:
56784 + spin_unlock(&gr_uid_lock);
56785 + return ret;
56786 +}
56787 +
56788 +static __inline__ int
56789 +proc_is_setxid(const struct cred *cred)
56790 +{
56791 + if (!uid_eq(cred->uid, cred->euid) || !uid_eq(cred->uid, cred->suid) ||
56792 + !uid_eq(cred->uid, cred->fsuid))
56793 + return 1;
56794 + if (!uid_eq(cred->gid, cred->egid) || !uid_eq(cred->gid, cred->sgid) ||
56795 + !uid_eq(cred->gid, cred->fsgid))
56796 + return 1;
56797 +
56798 + return 0;
56799 +}
56800 +
56801 +extern int gr_fake_force_sig(int sig, struct task_struct *t);
56802 +
56803 +void
56804 +gr_handle_crash(struct task_struct *task, const int sig)
56805 +{
56806 + struct acl_subject_label *curr;
56807 + struct task_struct *tsk, *tsk2;
56808 + const struct cred *cred;
56809 + const struct cred *cred2;
56810 +
56811 + if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
56812 + return;
56813 +
56814 + if (unlikely(!gr_acl_is_enabled()))
56815 + return;
56816 +
56817 + curr = task->acl;
56818 +
56819 + if (!(curr->resmask & (1 << GR_CRASH_RES)))
56820 + return;
56821 +
56822 + if (time_before_eq(curr->expires, get_seconds())) {
56823 + curr->expires = 0;
56824 + curr->crashes = 0;
56825 + }
56826 +
56827 + curr->crashes++;
56828 +
56829 + if (!curr->expires)
56830 + curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
56831 +
56832 + if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
56833 + time_after(curr->expires, get_seconds())) {
56834 + rcu_read_lock();
56835 + cred = __task_cred(task);
56836 + if (!uid_eq(cred->uid, GLOBAL_ROOT_UID) && proc_is_setxid(cred)) {
56837 + gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
56838 + spin_lock(&gr_uid_lock);
56839 + gr_insert_uid(cred->uid, curr->expires);
56840 + spin_unlock(&gr_uid_lock);
56841 + curr->expires = 0;
56842 + curr->crashes = 0;
56843 + read_lock(&tasklist_lock);
56844 + do_each_thread(tsk2, tsk) {
56845 + cred2 = __task_cred(tsk);
56846 + if (tsk != task && uid_eq(cred2->uid, cred->uid))
56847 + gr_fake_force_sig(SIGKILL, tsk);
56848 + } while_each_thread(tsk2, tsk);
56849 + read_unlock(&tasklist_lock);
56850 + } else {
56851 + gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
56852 + read_lock(&tasklist_lock);
56853 + read_lock(&grsec_exec_file_lock);
56854 + do_each_thread(tsk2, tsk) {
56855 + if (likely(tsk != task)) {
56856 + // if this thread has the same subject as the one that triggered
56857 + // RES_CRASH and it's the same binary, kill it
56858 + if (tsk->acl == task->acl && tsk->exec_file == task->exec_file)
56859 + gr_fake_force_sig(SIGKILL, tsk);
56860 + }
56861 + } while_each_thread(tsk2, tsk);
56862 + read_unlock(&grsec_exec_file_lock);
56863 + read_unlock(&tasklist_lock);
56864 + }
56865 + rcu_read_unlock();
56866 + }
56867 +
56868 + return;
56869 +}
56870 +
56871 +int
56872 +gr_check_crash_exec(const struct file *filp)
56873 +{
56874 + struct acl_subject_label *curr;
56875 +
56876 + if (unlikely(!gr_acl_is_enabled()))
56877 + return 0;
56878 +
56879 + read_lock(&gr_inode_lock);
56880 + curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
56881 + __get_dev(filp->f_path.dentry),
56882 + current->role);
56883 + read_unlock(&gr_inode_lock);
56884 +
56885 + if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
56886 + (!curr->crashes && !curr->expires))
56887 + return 0;
56888 +
56889 + if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
56890 + time_after(curr->expires, get_seconds()))
56891 + return 1;
56892 + else if (time_before_eq(curr->expires, get_seconds())) {
56893 + curr->crashes = 0;
56894 + curr->expires = 0;
56895 + }
56896 +
56897 + return 0;
56898 +}
56899 +
56900 +void
56901 +gr_handle_alertkill(struct task_struct *task)
56902 +{
56903 + struct acl_subject_label *curracl;
56904 + __u32 curr_ip;
56905 + struct task_struct *p, *p2;
56906 +
56907 + if (unlikely(!gr_acl_is_enabled()))
56908 + return;
56909 +
56910 + curracl = task->acl;
56911 + curr_ip = task->signal->curr_ip;
56912 +
56913 + if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
56914 + read_lock(&tasklist_lock);
56915 + do_each_thread(p2, p) {
56916 + if (p->signal->curr_ip == curr_ip)
56917 + gr_fake_force_sig(SIGKILL, p);
56918 + } while_each_thread(p2, p);
56919 + read_unlock(&tasklist_lock);
56920 + } else if (curracl->mode & GR_KILLPROC)
56921 + gr_fake_force_sig(SIGKILL, task);
56922 +
56923 + return;
56924 +}
56925 diff --git a/grsecurity/gracl_shm.c b/grsecurity/gracl_shm.c
56926 new file mode 100644
56927 index 0000000..9d83a69
56928 --- /dev/null
56929 +++ b/grsecurity/gracl_shm.c
56930 @@ -0,0 +1,40 @@
56931 +#include <linux/kernel.h>
56932 +#include <linux/mm.h>
56933 +#include <linux/sched.h>
56934 +#include <linux/file.h>
56935 +#include <linux/ipc.h>
56936 +#include <linux/gracl.h>
56937 +#include <linux/grsecurity.h>
56938 +#include <linux/grinternal.h>
56939 +
56940 +int
56941 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
56942 + const time_t shm_createtime, const uid_t cuid, const int shmid)
56943 +{
56944 + struct task_struct *task;
56945 +
56946 + if (!gr_acl_is_enabled())
56947 + return 1;
56948 +
56949 + rcu_read_lock();
56950 + read_lock(&tasklist_lock);
56951 +
56952 + task = find_task_by_vpid(shm_cprid);
56953 +
56954 + if (unlikely(!task))
56955 + task = find_task_by_vpid(shm_lapid);
56956 +
56957 + if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
56958 + (task->pid == shm_lapid)) &&
56959 + (task->acl->mode & GR_PROTSHM) &&
56960 + (task->acl != current->acl))) {
56961 + read_unlock(&tasklist_lock);
56962 + rcu_read_unlock();
56963 + gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
56964 + return 0;
56965 + }
56966 + read_unlock(&tasklist_lock);
56967 + rcu_read_unlock();
56968 +
56969 + return 1;
56970 +}
56971 diff --git a/grsecurity/grsec_chdir.c b/grsecurity/grsec_chdir.c
56972 new file mode 100644
56973 index 0000000..bc0be01
56974 --- /dev/null
56975 +++ b/grsecurity/grsec_chdir.c
56976 @@ -0,0 +1,19 @@
56977 +#include <linux/kernel.h>
56978 +#include <linux/sched.h>
56979 +#include <linux/fs.h>
56980 +#include <linux/file.h>
56981 +#include <linux/grsecurity.h>
56982 +#include <linux/grinternal.h>
56983 +
56984 +void
56985 +gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
56986 +{
56987 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
56988 + if ((grsec_enable_chdir && grsec_enable_group &&
56989 + in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
56990 + !grsec_enable_group)) {
56991 + gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
56992 + }
56993 +#endif
56994 + return;
56995 +}
56996 diff --git a/grsecurity/grsec_chroot.c b/grsecurity/grsec_chroot.c
56997 new file mode 100644
56998 index 0000000..9807ee2
56999 --- /dev/null
57000 +++ b/grsecurity/grsec_chroot.c
57001 @@ -0,0 +1,368 @@
57002 +#include <linux/kernel.h>
57003 +#include <linux/module.h>
57004 +#include <linux/sched.h>
57005 +#include <linux/file.h>
57006 +#include <linux/fs.h>
57007 +#include <linux/mount.h>
57008 +#include <linux/types.h>
57009 +#include "../fs/mount.h"
57010 +#include <linux/grsecurity.h>
57011 +#include <linux/grinternal.h>
57012 +
57013 +void gr_set_chroot_entries(struct task_struct *task, struct path *path)
57014 +{
57015 +#ifdef CONFIG_GRKERNSEC
57016 + if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
57017 + path->dentry != task->nsproxy->mnt_ns->root->mnt.mnt_root)
57018 + task->gr_is_chrooted = 1;
57019 + else
57020 + task->gr_is_chrooted = 0;
57021 +
57022 + task->gr_chroot_dentry = path->dentry;
57023 +#endif
57024 + return;
57025 +}
57026 +
57027 +void gr_clear_chroot_entries(struct task_struct *task)
57028 +{
57029 +#ifdef CONFIG_GRKERNSEC
57030 + task->gr_is_chrooted = 0;
57031 + task->gr_chroot_dentry = NULL;
57032 +#endif
57033 + return;
57034 +}
57035 +
57036 +int
57037 +gr_handle_chroot_unix(const pid_t pid)
57038 +{
57039 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
57040 + struct task_struct *p;
57041 +
57042 + if (unlikely(!grsec_enable_chroot_unix))
57043 + return 1;
57044 +
57045 + if (likely(!proc_is_chrooted(current)))
57046 + return 1;
57047 +
57048 + rcu_read_lock();
57049 + read_lock(&tasklist_lock);
57050 + p = find_task_by_vpid_unrestricted(pid);
57051 + if (unlikely(p && !have_same_root(current, p))) {
57052 + read_unlock(&tasklist_lock);
57053 + rcu_read_unlock();
57054 + gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
57055 + return 0;
57056 + }
57057 + read_unlock(&tasklist_lock);
57058 + rcu_read_unlock();
57059 +#endif
57060 + return 1;
57061 +}
57062 +
57063 +int
57064 +gr_handle_chroot_nice(void)
57065 +{
57066 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57067 + if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
57068 + gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
57069 + return -EPERM;
57070 + }
57071 +#endif
57072 + return 0;
57073 +}
57074 +
57075 +int
57076 +gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
57077 +{
57078 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57079 + if (grsec_enable_chroot_nice && (niceval < task_nice(p))
57080 + && proc_is_chrooted(current)) {
57081 + gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
57082 + return -EACCES;
57083 + }
57084 +#endif
57085 + return 0;
57086 +}
57087 +
57088 +int
57089 +gr_handle_chroot_rawio(const struct inode *inode)
57090 +{
57091 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57092 + if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
57093 + inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
57094 + return 1;
57095 +#endif
57096 + return 0;
57097 +}
57098 +
57099 +int
57100 +gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
57101 +{
57102 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57103 + struct task_struct *p;
57104 + int ret = 0;
57105 + if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
57106 + return ret;
57107 +
57108 + read_lock(&tasklist_lock);
57109 + do_each_pid_task(pid, type, p) {
57110 + if (!have_same_root(current, p)) {
57111 + ret = 1;
57112 + goto out;
57113 + }
57114 + } while_each_pid_task(pid, type, p);
57115 +out:
57116 + read_unlock(&tasklist_lock);
57117 + return ret;
57118 +#endif
57119 + return 0;
57120 +}
57121 +
57122 +int
57123 +gr_pid_is_chrooted(struct task_struct *p)
57124 +{
57125 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57126 + if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
57127 + return 0;
57128 +
57129 + if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
57130 + !have_same_root(current, p)) {
57131 + return 1;
57132 + }
57133 +#endif
57134 + return 0;
57135 +}
57136 +
57137 +EXPORT_SYMBOL(gr_pid_is_chrooted);
57138 +
57139 +#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
57140 +int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
57141 +{
57142 + struct path path, currentroot;
57143 + int ret = 0;
57144 +
57145 + path.dentry = (struct dentry *)u_dentry;
57146 + path.mnt = (struct vfsmount *)u_mnt;
57147 + get_fs_root(current->fs, &currentroot);
57148 + if (path_is_under(&path, &currentroot))
57149 + ret = 1;
57150 + path_put(&currentroot);
57151 +
57152 + return ret;
57153 +}
57154 +#endif
57155 +
57156 +int
57157 +gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
57158 +{
57159 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
57160 + if (!grsec_enable_chroot_fchdir)
57161 + return 1;
57162 +
57163 + if (!proc_is_chrooted(current))
57164 + return 1;
57165 + else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
57166 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
57167 + return 0;
57168 + }
57169 +#endif
57170 + return 1;
57171 +}
57172 +
57173 +int
57174 +gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57175 + const time_t shm_createtime)
57176 +{
57177 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
57178 + struct task_struct *p;
57179 + time_t starttime;
57180 +
57181 + if (unlikely(!grsec_enable_chroot_shmat))
57182 + return 1;
57183 +
57184 + if (likely(!proc_is_chrooted(current)))
57185 + return 1;
57186 +
57187 + rcu_read_lock();
57188 + read_lock(&tasklist_lock);
57189 +
57190 + if ((p = find_task_by_vpid_unrestricted(shm_cprid))) {
57191 + starttime = p->start_time.tv_sec;
57192 + if (time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime)) {
57193 + if (have_same_root(current, p)) {
57194 + goto allow;
57195 + } else {
57196 + read_unlock(&tasklist_lock);
57197 + rcu_read_unlock();
57198 + gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
57199 + return 0;
57200 + }
57201 + }
57202 + /* creator exited, pid reuse, fall through to next check */
57203 + }
57204 + if ((p = find_task_by_vpid_unrestricted(shm_lapid))) {
57205 + if (unlikely(!have_same_root(current, p))) {
57206 + read_unlock(&tasklist_lock);
57207 + rcu_read_unlock();
57208 + gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
57209 + return 0;
57210 + }
57211 + }
57212 +
57213 +allow:
57214 + read_unlock(&tasklist_lock);
57215 + rcu_read_unlock();
57216 +#endif
57217 + return 1;
57218 +}
57219 +
57220 +void
57221 +gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
57222 +{
57223 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
57224 + if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
57225 + gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
57226 +#endif
57227 + return;
57228 +}
57229 +
57230 +int
57231 +gr_handle_chroot_mknod(const struct dentry *dentry,
57232 + const struct vfsmount *mnt, const int mode)
57233 +{
57234 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
57235 + if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
57236 + proc_is_chrooted(current)) {
57237 + gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
57238 + return -EPERM;
57239 + }
57240 +#endif
57241 + return 0;
57242 +}
57243 +
57244 +int
57245 +gr_handle_chroot_mount(const struct dentry *dentry,
57246 + const struct vfsmount *mnt, const char *dev_name)
57247 +{
57248 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
57249 + if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
57250 + gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none", dentry, mnt);
57251 + return -EPERM;
57252 + }
57253 +#endif
57254 + return 0;
57255 +}
57256 +
57257 +int
57258 +gr_handle_chroot_pivot(void)
57259 +{
57260 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
57261 + if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
57262 + gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
57263 + return -EPERM;
57264 + }
57265 +#endif
57266 + return 0;
57267 +}
57268 +
57269 +int
57270 +gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
57271 +{
57272 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
57273 + if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
57274 + !gr_is_outside_chroot(dentry, mnt)) {
57275 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
57276 + return -EPERM;
57277 + }
57278 +#endif
57279 + return 0;
57280 +}
57281 +
57282 +extern const char *captab_log[];
57283 +extern int captab_log_entries;
57284 +
57285 +int
57286 +gr_task_chroot_is_capable(const struct task_struct *task, const struct cred *cred, const int cap)
57287 +{
57288 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57289 + if (grsec_enable_chroot_caps && proc_is_chrooted(task)) {
57290 + kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
57291 + if (cap_raised(chroot_caps, cap)) {
57292 + if (cap_raised(cred->cap_effective, cap) && cap < captab_log_entries) {
57293 + gr_log_cap(GR_DONT_AUDIT, GR_CAP_CHROOT_MSG, task, captab_log[cap]);
57294 + }
57295 + return 0;
57296 + }
57297 + }
57298 +#endif
57299 + return 1;
57300 +}
57301 +
57302 +int
57303 +gr_chroot_is_capable(const int cap)
57304 +{
57305 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57306 + return gr_task_chroot_is_capable(current, current_cred(), cap);
57307 +#endif
57308 + return 1;
57309 +}
57310 +
57311 +int
57312 +gr_task_chroot_is_capable_nolog(const struct task_struct *task, const int cap)
57313 +{
57314 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57315 + if (grsec_enable_chroot_caps && proc_is_chrooted(task)) {
57316 + kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
57317 + if (cap_raised(chroot_caps, cap)) {
57318 + return 0;
57319 + }
57320 + }
57321 +#endif
57322 + return 1;
57323 +}
57324 +
57325 +int
57326 +gr_chroot_is_capable_nolog(const int cap)
57327 +{
57328 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57329 + return gr_task_chroot_is_capable_nolog(current, cap);
57330 +#endif
57331 + return 1;
57332 +}
57333 +
57334 +int
57335 +gr_handle_chroot_sysctl(const int op)
57336 +{
57337 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
57338 + if (grsec_enable_chroot_sysctl && (op & MAY_WRITE) &&
57339 + proc_is_chrooted(current))
57340 + return -EACCES;
57341 +#endif
57342 + return 0;
57343 +}
57344 +
57345 +void
57346 +gr_handle_chroot_chdir(struct path *path)
57347 +{
57348 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
57349 + if (grsec_enable_chroot_chdir)
57350 + set_fs_pwd(current->fs, path);
57351 +#endif
57352 + return;
57353 +}
57354 +
57355 +int
57356 +gr_handle_chroot_chmod(const struct dentry *dentry,
57357 + const struct vfsmount *mnt, const int mode)
57358 +{
57359 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
57360 + /* allow chmod +s on directories, but not files */
57361 + if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
57362 + ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
57363 + proc_is_chrooted(current)) {
57364 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
57365 + return -EPERM;
57366 + }
57367 +#endif
57368 + return 0;
57369 +}
57370 diff --git a/grsecurity/grsec_disabled.c b/grsecurity/grsec_disabled.c
57371 new file mode 100644
57372 index 0000000..213ad8b
57373 --- /dev/null
57374 +++ b/grsecurity/grsec_disabled.c
57375 @@ -0,0 +1,437 @@
57376 +#include <linux/kernel.h>
57377 +#include <linux/module.h>
57378 +#include <linux/sched.h>
57379 +#include <linux/file.h>
57380 +#include <linux/fs.h>
57381 +#include <linux/kdev_t.h>
57382 +#include <linux/net.h>
57383 +#include <linux/in.h>
57384 +#include <linux/ip.h>
57385 +#include <linux/skbuff.h>
57386 +#include <linux/sysctl.h>
57387 +
57388 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
57389 +void
57390 +pax_set_initial_flags(struct linux_binprm *bprm)
57391 +{
57392 + return;
57393 +}
57394 +#endif
57395 +
57396 +#ifdef CONFIG_SYSCTL
57397 +__u32
57398 +gr_handle_sysctl(const struct ctl_table * table, const int op)
57399 +{
57400 + return 0;
57401 +}
57402 +#endif
57403 +
57404 +#ifdef CONFIG_TASKSTATS
57405 +int gr_is_taskstats_denied(int pid)
57406 +{
57407 + return 0;
57408 +}
57409 +#endif
57410 +
57411 +int
57412 +gr_acl_is_enabled(void)
57413 +{
57414 + return 0;
57415 +}
57416 +
57417 +void
57418 +gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
57419 +{
57420 + return;
57421 +}
57422 +
57423 +int
57424 +gr_handle_rawio(const struct inode *inode)
57425 +{
57426 + return 0;
57427 +}
57428 +
57429 +void
57430 +gr_acl_handle_psacct(struct task_struct *task, const long code)
57431 +{
57432 + return;
57433 +}
57434 +
57435 +int
57436 +gr_handle_ptrace(struct task_struct *task, const long request)
57437 +{
57438 + return 0;
57439 +}
57440 +
57441 +int
57442 +gr_handle_proc_ptrace(struct task_struct *task)
57443 +{
57444 + return 0;
57445 +}
57446 +
57447 +void
57448 +gr_learn_resource(const struct task_struct *task,
57449 + const int res, const unsigned long wanted, const int gt)
57450 +{
57451 + return;
57452 +}
57453 +
57454 +int
57455 +gr_set_acls(const int type)
57456 +{
57457 + return 0;
57458 +}
57459 +
57460 +int
57461 +gr_check_hidden_task(const struct task_struct *tsk)
57462 +{
57463 + return 0;
57464 +}
57465 +
57466 +int
57467 +gr_check_protected_task(const struct task_struct *task)
57468 +{
57469 + return 0;
57470 +}
57471 +
57472 +int
57473 +gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
57474 +{
57475 + return 0;
57476 +}
57477 +
57478 +void
57479 +gr_copy_label(struct task_struct *tsk)
57480 +{
57481 + return;
57482 +}
57483 +
57484 +void
57485 +gr_set_pax_flags(struct task_struct *task)
57486 +{
57487 + return;
57488 +}
57489 +
57490 +int
57491 +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
57492 + const int unsafe_share)
57493 +{
57494 + return 0;
57495 +}
57496 +
57497 +void
57498 +gr_handle_delete(const ino_t ino, const dev_t dev)
57499 +{
57500 + return;
57501 +}
57502 +
57503 +void
57504 +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
57505 +{
57506 + return;
57507 +}
57508 +
57509 +void
57510 +gr_handle_crash(struct task_struct *task, const int sig)
57511 +{
57512 + return;
57513 +}
57514 +
57515 +int
57516 +gr_check_crash_exec(const struct file *filp)
57517 +{
57518 + return 0;
57519 +}
57520 +
57521 +int
57522 +gr_check_crash_uid(const uid_t uid)
57523 +{
57524 + return 0;
57525 +}
57526 +
57527 +void
57528 +gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
57529 + struct dentry *old_dentry,
57530 + struct dentry *new_dentry,
57531 + struct vfsmount *mnt, const __u8 replace)
57532 +{
57533 + return;
57534 +}
57535 +
57536 +int
57537 +gr_search_socket(const int family, const int type, const int protocol)
57538 +{
57539 + return 1;
57540 +}
57541 +
57542 +int
57543 +gr_search_connectbind(const int mode, const struct socket *sock,
57544 + const struct sockaddr_in *addr)
57545 +{
57546 + return 0;
57547 +}
57548 +
57549 +void
57550 +gr_handle_alertkill(struct task_struct *task)
57551 +{
57552 + return;
57553 +}
57554 +
57555 +__u32
57556 +gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
57557 +{
57558 + return 1;
57559 +}
57560 +
57561 +__u32
57562 +gr_acl_handle_hidden_file(const struct dentry * dentry,
57563 + const struct vfsmount * mnt)
57564 +{
57565 + return 1;
57566 +}
57567 +
57568 +__u32
57569 +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
57570 + int acc_mode)
57571 +{
57572 + return 1;
57573 +}
57574 +
57575 +__u32
57576 +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
57577 +{
57578 + return 1;
57579 +}
57580 +
57581 +__u32
57582 +gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
57583 +{
57584 + return 1;
57585 +}
57586 +
57587 +int
57588 +gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
57589 + unsigned int *vm_flags)
57590 +{
57591 + return 1;
57592 +}
57593 +
57594 +__u32
57595 +gr_acl_handle_truncate(const struct dentry * dentry,
57596 + const struct vfsmount * mnt)
57597 +{
57598 + return 1;
57599 +}
57600 +
57601 +__u32
57602 +gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
57603 +{
57604 + return 1;
57605 +}
57606 +
57607 +__u32
57608 +gr_acl_handle_access(const struct dentry * dentry,
57609 + const struct vfsmount * mnt, const int fmode)
57610 +{
57611 + return 1;
57612 +}
57613 +
57614 +__u32
57615 +gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
57616 + umode_t *mode)
57617 +{
57618 + return 1;
57619 +}
57620 +
57621 +__u32
57622 +gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
57623 +{
57624 + return 1;
57625 +}
57626 +
57627 +__u32
57628 +gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
57629 +{
57630 + return 1;
57631 +}
57632 +
57633 +void
57634 +grsecurity_init(void)
57635 +{
57636 + return;
57637 +}
57638 +
57639 +umode_t gr_acl_umask(void)
57640 +{
57641 + return 0;
57642 +}
57643 +
57644 +__u32
57645 +gr_acl_handle_mknod(const struct dentry * new_dentry,
57646 + const struct dentry * parent_dentry,
57647 + const struct vfsmount * parent_mnt,
57648 + const int mode)
57649 +{
57650 + return 1;
57651 +}
57652 +
57653 +__u32
57654 +gr_acl_handle_mkdir(const struct dentry * new_dentry,
57655 + const struct dentry * parent_dentry,
57656 + const struct vfsmount * parent_mnt)
57657 +{
57658 + return 1;
57659 +}
57660 +
57661 +__u32
57662 +gr_acl_handle_symlink(const struct dentry * new_dentry,
57663 + const struct dentry * parent_dentry,
57664 + const struct vfsmount * parent_mnt, const char *from)
57665 +{
57666 + return 1;
57667 +}
57668 +
57669 +__u32
57670 +gr_acl_handle_link(const struct dentry * new_dentry,
57671 + const struct dentry * parent_dentry,
57672 + const struct vfsmount * parent_mnt,
57673 + const struct dentry * old_dentry,
57674 + const struct vfsmount * old_mnt, const char *to)
57675 +{
57676 + return 1;
57677 +}
57678 +
57679 +int
57680 +gr_acl_handle_rename(const struct dentry *new_dentry,
57681 + const struct dentry *parent_dentry,
57682 + const struct vfsmount *parent_mnt,
57683 + const struct dentry *old_dentry,
57684 + const struct inode *old_parent_inode,
57685 + const struct vfsmount *old_mnt, const char *newname)
57686 +{
57687 + return 0;
57688 +}
57689 +
57690 +int
57691 +gr_acl_handle_filldir(const struct file *file, const char *name,
57692 + const int namelen, const ino_t ino)
57693 +{
57694 + return 1;
57695 +}
57696 +
57697 +int
57698 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57699 + const time_t shm_createtime, const uid_t cuid, const int shmid)
57700 +{
57701 + return 1;
57702 +}
57703 +
57704 +int
57705 +gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
57706 +{
57707 + return 0;
57708 +}
57709 +
57710 +int
57711 +gr_search_accept(const struct socket *sock)
57712 +{
57713 + return 0;
57714 +}
57715 +
57716 +int
57717 +gr_search_listen(const struct socket *sock)
57718 +{
57719 + return 0;
57720 +}
57721 +
57722 +int
57723 +gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
57724 +{
57725 + return 0;
57726 +}
57727 +
57728 +__u32
57729 +gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
57730 +{
57731 + return 1;
57732 +}
57733 +
57734 +__u32
57735 +gr_acl_handle_creat(const struct dentry * dentry,
57736 + const struct dentry * p_dentry,
57737 + const struct vfsmount * p_mnt, int open_flags, int acc_mode,
57738 + const int imode)
57739 +{
57740 + return 1;
57741 +}
57742 +
57743 +void
57744 +gr_acl_handle_exit(void)
57745 +{
57746 + return;
57747 +}
57748 +
57749 +int
57750 +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
57751 +{
57752 + return 1;
57753 +}
57754 +
57755 +void
57756 +gr_set_role_label(const uid_t uid, const gid_t gid)
57757 +{
57758 + return;
57759 +}
57760 +
57761 +int
57762 +gr_acl_handle_procpidmem(const struct task_struct *task)
57763 +{
57764 + return 0;
57765 +}
57766 +
57767 +int
57768 +gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
57769 +{
57770 + return 0;
57771 +}
57772 +
57773 +int
57774 +gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
57775 +{
57776 + return 0;
57777 +}
57778 +
57779 +void
57780 +gr_set_kernel_label(struct task_struct *task)
57781 +{
57782 + return;
57783 +}
57784 +
57785 +int
57786 +gr_check_user_change(int real, int effective, int fs)
57787 +{
57788 + return 0;
57789 +}
57790 +
57791 +int
57792 +gr_check_group_change(int real, int effective, int fs)
57793 +{
57794 + return 0;
57795 +}
57796 +
57797 +int gr_acl_enable_at_secure(void)
57798 +{
57799 + return 0;
57800 +}
57801 +
57802 +dev_t gr_get_dev_from_dentry(struct dentry *dentry)
57803 +{
57804 + return dentry->d_inode->i_sb->s_dev;
57805 +}
57806 +
57807 +EXPORT_SYMBOL(gr_learn_resource);
57808 +EXPORT_SYMBOL(gr_set_kernel_label);
57809 +#ifdef CONFIG_SECURITY
57810 +EXPORT_SYMBOL(gr_check_user_change);
57811 +EXPORT_SYMBOL(gr_check_group_change);
57812 +#endif
57813 diff --git a/grsecurity/grsec_exec.c b/grsecurity/grsec_exec.c
57814 new file mode 100644
57815 index 0000000..abfa971
57816 --- /dev/null
57817 +++ b/grsecurity/grsec_exec.c
57818 @@ -0,0 +1,174 @@
57819 +#include <linux/kernel.h>
57820 +#include <linux/sched.h>
57821 +#include <linux/file.h>
57822 +#include <linux/binfmts.h>
57823 +#include <linux/fs.h>
57824 +#include <linux/types.h>
57825 +#include <linux/grdefs.h>
57826 +#include <linux/grsecurity.h>
57827 +#include <linux/grinternal.h>
57828 +#include <linux/capability.h>
57829 +#include <linux/module.h>
57830 +
57831 +#include <asm/uaccess.h>
57832 +
57833 +#ifdef CONFIG_GRKERNSEC_EXECLOG
57834 +static char gr_exec_arg_buf[132];
57835 +static DEFINE_MUTEX(gr_exec_arg_mutex);
57836 +#endif
57837 +
57838 +extern const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr);
57839 +
57840 +void
57841 +gr_handle_exec_args(struct linux_binprm *bprm, struct user_arg_ptr argv)
57842 +{
57843 +#ifdef CONFIG_GRKERNSEC_EXECLOG
57844 + char *grarg = gr_exec_arg_buf;
57845 + unsigned int i, x, execlen = 0;
57846 + char c;
57847 +
57848 + if (!((grsec_enable_execlog && grsec_enable_group &&
57849 + in_group_p(grsec_audit_gid))
57850 + || (grsec_enable_execlog && !grsec_enable_group)))
57851 + return;
57852 +
57853 + mutex_lock(&gr_exec_arg_mutex);
57854 + memset(grarg, 0, sizeof(gr_exec_arg_buf));
57855 +
57856 + for (i = 0; i < bprm->argc && execlen < 128; i++) {
57857 + const char __user *p;
57858 + unsigned int len;
57859 +
57860 + p = get_user_arg_ptr(argv, i);
57861 + if (IS_ERR(p))
57862 + goto log;
57863 +
57864 + len = strnlen_user(p, 128 - execlen);
57865 + if (len > 128 - execlen)
57866 + len = 128 - execlen;
57867 + else if (len > 0)
57868 + len--;
57869 + if (copy_from_user(grarg + execlen, p, len))
57870 + goto log;
57871 +
57872 + /* rewrite unprintable characters */
57873 + for (x = 0; x < len; x++) {
57874 + c = *(grarg + execlen + x);
57875 + if (c < 32 || c > 126)
57876 + *(grarg + execlen + x) = ' ';
57877 + }
57878 +
57879 + execlen += len;
57880 + *(grarg + execlen) = ' ';
57881 + *(grarg + execlen + 1) = '\0';
57882 + execlen++;
57883 + }
57884 +
57885 + log:
57886 + gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
57887 + bprm->file->f_path.mnt, grarg);
57888 + mutex_unlock(&gr_exec_arg_mutex);
57889 +#endif
57890 + return;
57891 +}
57892 +
57893 +#ifdef CONFIG_GRKERNSEC
57894 +extern int gr_acl_is_capable(const int cap);
57895 +extern int gr_acl_is_capable_nolog(const int cap);
57896 +extern int gr_task_acl_is_capable(const struct task_struct *task, const struct cred *cred, const int cap);
57897 +extern int gr_task_acl_is_capable_nolog(const struct task_struct *task, const int cap);
57898 +extern int gr_chroot_is_capable(const int cap);
57899 +extern int gr_chroot_is_capable_nolog(const int cap);
57900 +extern int gr_task_chroot_is_capable(const struct task_struct *task, const struct cred *cred, const int cap);
57901 +extern int gr_task_chroot_is_capable_nolog(const struct task_struct *task, const int cap);
57902 +#endif
57903 +
57904 +const char *captab_log[] = {
57905 + "CAP_CHOWN",
57906 + "CAP_DAC_OVERRIDE",
57907 + "CAP_DAC_READ_SEARCH",
57908 + "CAP_FOWNER",
57909 + "CAP_FSETID",
57910 + "CAP_KILL",
57911 + "CAP_SETGID",
57912 + "CAP_SETUID",
57913 + "CAP_SETPCAP",
57914 + "CAP_LINUX_IMMUTABLE",
57915 + "CAP_NET_BIND_SERVICE",
57916 + "CAP_NET_BROADCAST",
57917 + "CAP_NET_ADMIN",
57918 + "CAP_NET_RAW",
57919 + "CAP_IPC_LOCK",
57920 + "CAP_IPC_OWNER",
57921 + "CAP_SYS_MODULE",
57922 + "CAP_SYS_RAWIO",
57923 + "CAP_SYS_CHROOT",
57924 + "CAP_SYS_PTRACE",
57925 + "CAP_SYS_PACCT",
57926 + "CAP_SYS_ADMIN",
57927 + "CAP_SYS_BOOT",
57928 + "CAP_SYS_NICE",
57929 + "CAP_SYS_RESOURCE",
57930 + "CAP_SYS_TIME",
57931 + "CAP_SYS_TTY_CONFIG",
57932 + "CAP_MKNOD",
57933 + "CAP_LEASE",
57934 + "CAP_AUDIT_WRITE",
57935 + "CAP_AUDIT_CONTROL",
57936 + "CAP_SETFCAP",
57937 + "CAP_MAC_OVERRIDE",
57938 + "CAP_MAC_ADMIN",
57939 + "CAP_SYSLOG",
57940 + "CAP_WAKE_ALARM"
57941 +};
57942 +
57943 +int captab_log_entries = sizeof(captab_log)/sizeof(captab_log[0]);
57944 +
57945 +int gr_is_capable(const int cap)
57946 +{
57947 +#ifdef CONFIG_GRKERNSEC
57948 + if (gr_acl_is_capable(cap) && gr_chroot_is_capable(cap))
57949 + return 1;
57950 + return 0;
57951 +#else
57952 + return 1;
57953 +#endif
57954 +}
57955 +
57956 +int gr_task_is_capable(const struct task_struct *task, const struct cred *cred, const int cap)
57957 +{
57958 +#ifdef CONFIG_GRKERNSEC
57959 + if (gr_task_acl_is_capable(task, cred, cap) && gr_task_chroot_is_capable(task, cred, cap))
57960 + return 1;
57961 + return 0;
57962 +#else
57963 + return 1;
57964 +#endif
57965 +}
57966 +
57967 +int gr_is_capable_nolog(const int cap)
57968 +{
57969 +#ifdef CONFIG_GRKERNSEC
57970 + if (gr_acl_is_capable_nolog(cap) && gr_chroot_is_capable_nolog(cap))
57971 + return 1;
57972 + return 0;
57973 +#else
57974 + return 1;
57975 +#endif
57976 +}
57977 +
57978 +int gr_task_is_capable_nolog(const struct task_struct *task, const int cap)
57979 +{
57980 +#ifdef CONFIG_GRKERNSEC
57981 + if (gr_task_acl_is_capable_nolog(task, cap) && gr_task_chroot_is_capable_nolog(task, cap))
57982 + return 1;
57983 + return 0;
57984 +#else
57985 + return 1;
57986 +#endif
57987 +}
57988 +
57989 +EXPORT_SYMBOL(gr_is_capable);
57990 +EXPORT_SYMBOL(gr_is_capable_nolog);
57991 +EXPORT_SYMBOL(gr_task_is_capable);
57992 +EXPORT_SYMBOL(gr_task_is_capable_nolog);
57993 diff --git a/grsecurity/grsec_fifo.c b/grsecurity/grsec_fifo.c
57994 new file mode 100644
57995 index 0000000..d3ee748
57996 --- /dev/null
57997 +++ b/grsecurity/grsec_fifo.c
57998 @@ -0,0 +1,24 @@
57999 +#include <linux/kernel.h>
58000 +#include <linux/sched.h>
58001 +#include <linux/fs.h>
58002 +#include <linux/file.h>
58003 +#include <linux/grinternal.h>
58004 +
58005 +int
58006 +gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
58007 + const struct dentry *dir, const int flag, const int acc_mode)
58008 +{
58009 +#ifdef CONFIG_GRKERNSEC_FIFO
58010 + const struct cred *cred = current_cred();
58011 +
58012 + if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
58013 + !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
58014 + (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
58015 + (cred->fsuid != dentry->d_inode->i_uid)) {
58016 + if (!inode_permission(dentry->d_inode, acc_mode))
58017 + gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
58018 + return -EACCES;
58019 + }
58020 +#endif
58021 + return 0;
58022 +}
58023 diff --git a/grsecurity/grsec_fork.c b/grsecurity/grsec_fork.c
58024 new file mode 100644
58025 index 0000000..8ca18bf
58026 --- /dev/null
58027 +++ b/grsecurity/grsec_fork.c
58028 @@ -0,0 +1,23 @@
58029 +#include <linux/kernel.h>
58030 +#include <linux/sched.h>
58031 +#include <linux/grsecurity.h>
58032 +#include <linux/grinternal.h>
58033 +#include <linux/errno.h>
58034 +
58035 +void
58036 +gr_log_forkfail(const int retval)
58037 +{
58038 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
58039 + if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
58040 + switch (retval) {
58041 + case -EAGAIN:
58042 + gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
58043 + break;
58044 + case -ENOMEM:
58045 + gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
58046 + break;
58047 + }
58048 + }
58049 +#endif
58050 + return;
58051 +}
58052 diff --git a/grsecurity/grsec_init.c b/grsecurity/grsec_init.c
58053 new file mode 100644
58054 index 0000000..05a6015
58055 --- /dev/null
58056 +++ b/grsecurity/grsec_init.c
58057 @@ -0,0 +1,283 @@
58058 +#include <linux/kernel.h>
58059 +#include <linux/sched.h>
58060 +#include <linux/mm.h>
58061 +#include <linux/gracl.h>
58062 +#include <linux/slab.h>
58063 +#include <linux/vmalloc.h>
58064 +#include <linux/percpu.h>
58065 +#include <linux/module.h>
58066 +
58067 +int grsec_enable_ptrace_readexec;
58068 +int grsec_enable_setxid;
58069 +int grsec_enable_symlinkown;
58070 +int grsec_symlinkown_gid;
58071 +int grsec_enable_brute;
58072 +int grsec_enable_link;
58073 +int grsec_enable_dmesg;
58074 +int grsec_enable_harden_ptrace;
58075 +int grsec_enable_fifo;
58076 +int grsec_enable_execlog;
58077 +int grsec_enable_signal;
58078 +int grsec_enable_forkfail;
58079 +int grsec_enable_audit_ptrace;
58080 +int grsec_enable_time;
58081 +int grsec_enable_audit_textrel;
58082 +int grsec_enable_group;
58083 +int grsec_audit_gid;
58084 +int grsec_enable_chdir;
58085 +int grsec_enable_mount;
58086 +int grsec_enable_rofs;
58087 +int grsec_enable_chroot_findtask;
58088 +int grsec_enable_chroot_mount;
58089 +int grsec_enable_chroot_shmat;
58090 +int grsec_enable_chroot_fchdir;
58091 +int grsec_enable_chroot_double;
58092 +int grsec_enable_chroot_pivot;
58093 +int grsec_enable_chroot_chdir;
58094 +int grsec_enable_chroot_chmod;
58095 +int grsec_enable_chroot_mknod;
58096 +int grsec_enable_chroot_nice;
58097 +int grsec_enable_chroot_execlog;
58098 +int grsec_enable_chroot_caps;
58099 +int grsec_enable_chroot_sysctl;
58100 +int grsec_enable_chroot_unix;
58101 +int grsec_enable_tpe;
58102 +int grsec_tpe_gid;
58103 +int grsec_enable_blackhole;
58104 +#ifdef CONFIG_IPV6_MODULE
58105 +EXPORT_SYMBOL(grsec_enable_blackhole);
58106 +#endif
58107 +int grsec_lastack_retries;
58108 +int grsec_enable_tpe_all;
58109 +int grsec_enable_tpe_invert;
58110 +int grsec_enable_socket_all;
58111 +int grsec_socket_all_gid;
58112 +int grsec_enable_socket_client;
58113 +int grsec_socket_client_gid;
58114 +int grsec_enable_socket_server;
58115 +int grsec_socket_server_gid;
58116 +int grsec_resource_logging;
58117 +int grsec_disable_privio;
58118 +int grsec_enable_log_rwxmaps;
58119 +int grsec_lock;
58120 +
58121 +DEFINE_SPINLOCK(grsec_alert_lock);
58122 +unsigned long grsec_alert_wtime = 0;
58123 +unsigned long grsec_alert_fyet = 0;
58124 +
58125 +DEFINE_SPINLOCK(grsec_audit_lock);
58126 +
58127 +DEFINE_RWLOCK(grsec_exec_file_lock);
58128 +
58129 +char *gr_shared_page[4];
58130 +
58131 +char *gr_alert_log_fmt;
58132 +char *gr_audit_log_fmt;
58133 +char *gr_alert_log_buf;
58134 +char *gr_audit_log_buf;
58135 +
58136 +extern struct gr_arg *gr_usermode;
58137 +extern unsigned char *gr_system_salt;
58138 +extern unsigned char *gr_system_sum;
58139 +
58140 +void __init
58141 +grsecurity_init(void)
58142 +{
58143 + int j;
58144 + /* create the per-cpu shared pages */
58145 +
58146 +#ifdef CONFIG_X86
58147 + memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
58148 +#endif
58149 +
58150 + for (j = 0; j < 4; j++) {
58151 + gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
58152 + if (gr_shared_page[j] == NULL) {
58153 + panic("Unable to allocate grsecurity shared page");
58154 + return;
58155 + }
58156 + }
58157 +
58158 + /* allocate log buffers */
58159 + gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
58160 + if (!gr_alert_log_fmt) {
58161 + panic("Unable to allocate grsecurity alert log format buffer");
58162 + return;
58163 + }
58164 + gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
58165 + if (!gr_audit_log_fmt) {
58166 + panic("Unable to allocate grsecurity audit log format buffer");
58167 + return;
58168 + }
58169 + gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
58170 + if (!gr_alert_log_buf) {
58171 + panic("Unable to allocate grsecurity alert log buffer");
58172 + return;
58173 + }
58174 + gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
58175 + if (!gr_audit_log_buf) {
58176 + panic("Unable to allocate grsecurity audit log buffer");
58177 + return;
58178 + }
58179 +
58180 + /* allocate memory for authentication structure */
58181 + gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
58182 + gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
58183 + gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
58184 +
58185 + if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
58186 + panic("Unable to allocate grsecurity authentication structure");
58187 + return;
58188 + }
58189 +
58190 +
58191 +#ifdef CONFIG_GRKERNSEC_IO
58192 +#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
58193 + grsec_disable_privio = 1;
58194 +#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
58195 + grsec_disable_privio = 1;
58196 +#else
58197 + grsec_disable_privio = 0;
58198 +#endif
58199 +#endif
58200 +
58201 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
58202 + /* for backward compatibility, tpe_invert always defaults to on if
58203 + enabled in the kernel
58204 + */
58205 + grsec_enable_tpe_invert = 1;
58206 +#endif
58207 +
58208 +#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
58209 +#ifndef CONFIG_GRKERNSEC_SYSCTL
58210 + grsec_lock = 1;
58211 +#endif
58212 +
58213 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
58214 + grsec_enable_audit_textrel = 1;
58215 +#endif
58216 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58217 + grsec_enable_log_rwxmaps = 1;
58218 +#endif
58219 +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
58220 + grsec_enable_group = 1;
58221 + grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
58222 +#endif
58223 +#ifdef CONFIG_GRKERNSEC_PTRACE_READEXEC
58224 + grsec_enable_ptrace_readexec = 1;
58225 +#endif
58226 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
58227 + grsec_enable_chdir = 1;
58228 +#endif
58229 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
58230 + grsec_enable_harden_ptrace = 1;
58231 +#endif
58232 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58233 + grsec_enable_mount = 1;
58234 +#endif
58235 +#ifdef CONFIG_GRKERNSEC_LINK
58236 + grsec_enable_link = 1;
58237 +#endif
58238 +#ifdef CONFIG_GRKERNSEC_BRUTE
58239 + grsec_enable_brute = 1;
58240 +#endif
58241 +#ifdef CONFIG_GRKERNSEC_DMESG
58242 + grsec_enable_dmesg = 1;
58243 +#endif
58244 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
58245 + grsec_enable_blackhole = 1;
58246 + grsec_lastack_retries = 4;
58247 +#endif
58248 +#ifdef CONFIG_GRKERNSEC_FIFO
58249 + grsec_enable_fifo = 1;
58250 +#endif
58251 +#ifdef CONFIG_GRKERNSEC_EXECLOG
58252 + grsec_enable_execlog = 1;
58253 +#endif
58254 +#ifdef CONFIG_GRKERNSEC_SETXID
58255 + grsec_enable_setxid = 1;
58256 +#endif
58257 +#ifdef CONFIG_GRKERNSEC_SIGNAL
58258 + grsec_enable_signal = 1;
58259 +#endif
58260 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
58261 + grsec_enable_forkfail = 1;
58262 +#endif
58263 +#ifdef CONFIG_GRKERNSEC_TIME
58264 + grsec_enable_time = 1;
58265 +#endif
58266 +#ifdef CONFIG_GRKERNSEC_RESLOG
58267 + grsec_resource_logging = 1;
58268 +#endif
58269 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
58270 + grsec_enable_chroot_findtask = 1;
58271 +#endif
58272 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
58273 + grsec_enable_chroot_unix = 1;
58274 +#endif
58275 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
58276 + grsec_enable_chroot_mount = 1;
58277 +#endif
58278 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
58279 + grsec_enable_chroot_fchdir = 1;
58280 +#endif
58281 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
58282 + grsec_enable_chroot_shmat = 1;
58283 +#endif
58284 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
58285 + grsec_enable_audit_ptrace = 1;
58286 +#endif
58287 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
58288 + grsec_enable_chroot_double = 1;
58289 +#endif
58290 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
58291 + grsec_enable_chroot_pivot = 1;
58292 +#endif
58293 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
58294 + grsec_enable_chroot_chdir = 1;
58295 +#endif
58296 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
58297 + grsec_enable_chroot_chmod = 1;
58298 +#endif
58299 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
58300 + grsec_enable_chroot_mknod = 1;
58301 +#endif
58302 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
58303 + grsec_enable_chroot_nice = 1;
58304 +#endif
58305 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
58306 + grsec_enable_chroot_execlog = 1;
58307 +#endif
58308 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
58309 + grsec_enable_chroot_caps = 1;
58310 +#endif
58311 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
58312 + grsec_enable_chroot_sysctl = 1;
58313 +#endif
58314 +#ifdef CONFIG_GRKERNSEC_SYMLINKOWN
58315 + grsec_enable_symlinkown = 1;
58316 + grsec_symlinkown_gid = CONFIG_GRKERNSEC_SYMLINKOWN_GID;
58317 +#endif
58318 +#ifdef CONFIG_GRKERNSEC_TPE
58319 + grsec_enable_tpe = 1;
58320 + grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
58321 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
58322 + grsec_enable_tpe_all = 1;
58323 +#endif
58324 +#endif
58325 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
58326 + grsec_enable_socket_all = 1;
58327 + grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
58328 +#endif
58329 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
58330 + grsec_enable_socket_client = 1;
58331 + grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
58332 +#endif
58333 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
58334 + grsec_enable_socket_server = 1;
58335 + grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
58336 +#endif
58337 +#endif
58338 +
58339 + return;
58340 +}
58341 diff --git a/grsecurity/grsec_link.c b/grsecurity/grsec_link.c
58342 new file mode 100644
58343 index 0000000..589481f
58344 --- /dev/null
58345 +++ b/grsecurity/grsec_link.c
58346 @@ -0,0 +1,58 @@
58347 +#include <linux/kernel.h>
58348 +#include <linux/sched.h>
58349 +#include <linux/fs.h>
58350 +#include <linux/file.h>
58351 +#include <linux/grinternal.h>
58352 +
58353 +int gr_handle_symlink_owner(const struct path *link, const struct inode *target)
58354 +{
58355 +#ifdef CONFIG_GRKERNSEC_SYMLINKOWN
58356 + const struct inode *link_inode = link->dentry->d_inode;
58357 +
58358 + if (grsec_enable_symlinkown && in_group_p(grsec_symlinkown_gid) &&
58359 + /* ignore root-owned links, e.g. /proc/self */
58360 + !uid_eq(link_inode->i_uid, GLOBAL_ROOT_UID) && target &&
58361 + !uid_eq(link_inode->i_uid, target->i_uid)) {
58362 + gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINKOWNER_MSG, link->dentry, link->mnt, link_inode->i_uid, target->i_uid);
58363 + return 1;
58364 + }
58365 +#endif
58366 + return 0;
58367 +}
58368 +
58369 +int
58370 +gr_handle_follow_link(const struct inode *parent,
58371 + const struct inode *inode,
58372 + const struct dentry *dentry, const struct vfsmount *mnt)
58373 +{
58374 +#ifdef CONFIG_GRKERNSEC_LINK
58375 + const struct cred *cred = current_cred();
58376 +
58377 + if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
58378 + (parent->i_mode & S_ISVTX) && !uid_eq(parent->i_uid, inode->i_uid) &&
58379 + (parent->i_mode & S_IWOTH) && !uid_eq(cred->fsuid, inode->i_uid)) {
58380 + gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
58381 + return -EACCES;
58382 + }
58383 +#endif
58384 + return 0;
58385 +}
58386 +
58387 +int
58388 +gr_handle_hardlink(const struct dentry *dentry,
58389 + const struct vfsmount *mnt,
58390 + struct inode *inode, const int mode, const char *to)
58391 +{
58392 +#ifdef CONFIG_GRKERNSEC_LINK
58393 + const struct cred *cred = current_cred();
58394 +
58395 + if (grsec_enable_link && !uid_eq(cred->fsuid, inode->i_uid) &&
58396 + (!S_ISREG(mode) || is_privileged_binary(dentry) ||
58397 + (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
58398 + !capable(CAP_FOWNER) && !uid_eq(cred->uid, GLOBAL_ROOT_UID)) {
58399 + gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
58400 + return -EPERM;
58401 + }
58402 +#endif
58403 + return 0;
58404 +}
58405 diff --git a/grsecurity/grsec_log.c b/grsecurity/grsec_log.c
58406 new file mode 100644
58407 index 0000000..a45d2e9
58408 --- /dev/null
58409 +++ b/grsecurity/grsec_log.c
58410 @@ -0,0 +1,322 @@
58411 +#include <linux/kernel.h>
58412 +#include <linux/sched.h>
58413 +#include <linux/file.h>
58414 +#include <linux/tty.h>
58415 +#include <linux/fs.h>
58416 +#include <linux/grinternal.h>
58417 +
58418 +#ifdef CONFIG_TREE_PREEMPT_RCU
58419 +#define DISABLE_PREEMPT() preempt_disable()
58420 +#define ENABLE_PREEMPT() preempt_enable()
58421 +#else
58422 +#define DISABLE_PREEMPT()
58423 +#define ENABLE_PREEMPT()
58424 +#endif
58425 +
58426 +#define BEGIN_LOCKS(x) \
58427 + DISABLE_PREEMPT(); \
58428 + rcu_read_lock(); \
58429 + read_lock(&tasklist_lock); \
58430 + read_lock(&grsec_exec_file_lock); \
58431 + if (x != GR_DO_AUDIT) \
58432 + spin_lock(&grsec_alert_lock); \
58433 + else \
58434 + spin_lock(&grsec_audit_lock)
58435 +
58436 +#define END_LOCKS(x) \
58437 + if (x != GR_DO_AUDIT) \
58438 + spin_unlock(&grsec_alert_lock); \
58439 + else \
58440 + spin_unlock(&grsec_audit_lock); \
58441 + read_unlock(&grsec_exec_file_lock); \
58442 + read_unlock(&tasklist_lock); \
58443 + rcu_read_unlock(); \
58444 + ENABLE_PREEMPT(); \
58445 + if (x == GR_DONT_AUDIT) \
58446 + gr_handle_alertkill(current)
58447 +
58448 +enum {
58449 + FLOODING,
58450 + NO_FLOODING
58451 +};
58452 +
58453 +extern char *gr_alert_log_fmt;
58454 +extern char *gr_audit_log_fmt;
58455 +extern char *gr_alert_log_buf;
58456 +extern char *gr_audit_log_buf;
58457 +
58458 +static int gr_log_start(int audit)
58459 +{
58460 + char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
58461 + char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
58462 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58463 +#if (CONFIG_GRKERNSEC_FLOODTIME > 0 && CONFIG_GRKERNSEC_FLOODBURST > 0)
58464 + unsigned long curr_secs = get_seconds();
58465 +
58466 + if (audit == GR_DO_AUDIT)
58467 + goto set_fmt;
58468 +
58469 + if (!grsec_alert_wtime || time_after(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)) {
58470 + grsec_alert_wtime = curr_secs;
58471 + grsec_alert_fyet = 0;
58472 + } else if (time_before_eq(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)
58473 + && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
58474 + grsec_alert_fyet++;
58475 + } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
58476 + grsec_alert_wtime = curr_secs;
58477 + grsec_alert_fyet++;
58478 + printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
58479 + return FLOODING;
58480 + }
58481 + else return FLOODING;
58482 +
58483 +set_fmt:
58484 +#endif
58485 + memset(buf, 0, PAGE_SIZE);
58486 + if (current->signal->curr_ip && gr_acl_is_enabled()) {
58487 + sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
58488 + snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
58489 + } else if (current->signal->curr_ip) {
58490 + sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
58491 + snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
58492 + } else if (gr_acl_is_enabled()) {
58493 + sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
58494 + snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
58495 + } else {
58496 + sprintf(fmt, "%s%s", loglevel, "grsec: ");
58497 + strcpy(buf, fmt);
58498 + }
58499 +
58500 + return NO_FLOODING;
58501 +}
58502 +
58503 +static void gr_log_middle(int audit, const char *msg, va_list ap)
58504 + __attribute__ ((format (printf, 2, 0)));
58505 +
58506 +static void gr_log_middle(int audit, const char *msg, va_list ap)
58507 +{
58508 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58509 + unsigned int len = strlen(buf);
58510 +
58511 + vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
58512 +
58513 + return;
58514 +}
58515 +
58516 +static void gr_log_middle_varargs(int audit, const char *msg, ...)
58517 + __attribute__ ((format (printf, 2, 3)));
58518 +
58519 +static void gr_log_middle_varargs(int audit, const char *msg, ...)
58520 +{
58521 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58522 + unsigned int len = strlen(buf);
58523 + va_list ap;
58524 +
58525 + va_start(ap, msg);
58526 + vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
58527 + va_end(ap);
58528 +
58529 + return;
58530 +}
58531 +
58532 +static void gr_log_end(int audit, int append_default)
58533 +{
58534 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58535 +
58536 + if (append_default) {
58537 + unsigned int len = strlen(buf);
58538 + snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
58539 + }
58540 +
58541 + printk("%s\n", buf);
58542 +
58543 + return;
58544 +}
58545 +
58546 +void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
58547 +{
58548 + int logtype;
58549 + char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
58550 + char *str1 = NULL, *str2 = NULL, *str3 = NULL;
58551 + void *voidptr = NULL;
58552 + int num1 = 0, num2 = 0;
58553 + unsigned long ulong1 = 0, ulong2 = 0;
58554 + struct dentry *dentry = NULL;
58555 + struct vfsmount *mnt = NULL;
58556 + struct file *file = NULL;
58557 + struct task_struct *task = NULL;
58558 + const struct cred *cred, *pcred;
58559 + va_list ap;
58560 +
58561 + BEGIN_LOCKS(audit);
58562 + logtype = gr_log_start(audit);
58563 + if (logtype == FLOODING) {
58564 + END_LOCKS(audit);
58565 + return;
58566 + }
58567 + va_start(ap, argtypes);
58568 + switch (argtypes) {
58569 + case GR_TTYSNIFF:
58570 + task = va_arg(ap, struct task_struct *);
58571 + gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
58572 + break;
58573 + case GR_SYSCTL_HIDDEN:
58574 + str1 = va_arg(ap, char *);
58575 + gr_log_middle_varargs(audit, msg, result, str1);
58576 + break;
58577 + case GR_RBAC:
58578 + dentry = va_arg(ap, struct dentry *);
58579 + mnt = va_arg(ap, struct vfsmount *);
58580 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
58581 + break;
58582 + case GR_RBAC_STR:
58583 + dentry = va_arg(ap, struct dentry *);
58584 + mnt = va_arg(ap, struct vfsmount *);
58585 + str1 = va_arg(ap, char *);
58586 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
58587 + break;
58588 + case GR_STR_RBAC:
58589 + str1 = va_arg(ap, char *);
58590 + dentry = va_arg(ap, struct dentry *);
58591 + mnt = va_arg(ap, struct vfsmount *);
58592 + gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
58593 + break;
58594 + case GR_RBAC_MODE2:
58595 + dentry = va_arg(ap, struct dentry *);
58596 + mnt = va_arg(ap, struct vfsmount *);
58597 + str1 = va_arg(ap, char *);
58598 + str2 = va_arg(ap, char *);
58599 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
58600 + break;
58601 + case GR_RBAC_MODE3:
58602 + dentry = va_arg(ap, struct dentry *);
58603 + mnt = va_arg(ap, struct vfsmount *);
58604 + str1 = va_arg(ap, char *);
58605 + str2 = va_arg(ap, char *);
58606 + str3 = va_arg(ap, char *);
58607 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
58608 + break;
58609 + case GR_FILENAME:
58610 + dentry = va_arg(ap, struct dentry *);
58611 + mnt = va_arg(ap, struct vfsmount *);
58612 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
58613 + break;
58614 + case GR_STR_FILENAME:
58615 + str1 = va_arg(ap, char *);
58616 + dentry = va_arg(ap, struct dentry *);
58617 + mnt = va_arg(ap, struct vfsmount *);
58618 + gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
58619 + break;
58620 + case GR_FILENAME_STR:
58621 + dentry = va_arg(ap, struct dentry *);
58622 + mnt = va_arg(ap, struct vfsmount *);
58623 + str1 = va_arg(ap, char *);
58624 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
58625 + break;
58626 + case GR_FILENAME_TWO_INT:
58627 + dentry = va_arg(ap, struct dentry *);
58628 + mnt = va_arg(ap, struct vfsmount *);
58629 + num1 = va_arg(ap, int);
58630 + num2 = va_arg(ap, int);
58631 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
58632 + break;
58633 + case GR_FILENAME_TWO_INT_STR:
58634 + dentry = va_arg(ap, struct dentry *);
58635 + mnt = va_arg(ap, struct vfsmount *);
58636 + num1 = va_arg(ap, int);
58637 + num2 = va_arg(ap, int);
58638 + str1 = va_arg(ap, char *);
58639 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
58640 + break;
58641 + case GR_TEXTREL:
58642 + file = va_arg(ap, struct file *);
58643 + ulong1 = va_arg(ap, unsigned long);
58644 + ulong2 = va_arg(ap, unsigned long);
58645 + gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
58646 + break;
58647 + case GR_PTRACE:
58648 + task = va_arg(ap, struct task_struct *);
58649 + gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
58650 + break;
58651 + case GR_RESOURCE:
58652 + task = va_arg(ap, struct task_struct *);
58653 + cred = __task_cred(task);
58654 + pcred = __task_cred(task->real_parent);
58655 + ulong1 = va_arg(ap, unsigned long);
58656 + str1 = va_arg(ap, char *);
58657 + ulong2 = va_arg(ap, unsigned long);
58658 + gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58659 + break;
58660 + case GR_CAP:
58661 + task = va_arg(ap, struct task_struct *);
58662 + cred = __task_cred(task);
58663 + pcred = __task_cred(task->real_parent);
58664 + str1 = va_arg(ap, char *);
58665 + gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58666 + break;
58667 + case GR_SIG:
58668 + str1 = va_arg(ap, char *);
58669 + voidptr = va_arg(ap, void *);
58670 + gr_log_middle_varargs(audit, msg, str1, voidptr);
58671 + break;
58672 + case GR_SIG2:
58673 + task = va_arg(ap, struct task_struct *);
58674 + cred = __task_cred(task);
58675 + pcred = __task_cred(task->real_parent);
58676 + num1 = va_arg(ap, int);
58677 + gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58678 + break;
58679 + case GR_CRASH1:
58680 + task = va_arg(ap, struct task_struct *);
58681 + cred = __task_cred(task);
58682 + pcred = __task_cred(task->real_parent);
58683 + ulong1 = va_arg(ap, unsigned long);
58684 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
58685 + break;
58686 + case GR_CRASH2:
58687 + task = va_arg(ap, struct task_struct *);
58688 + cred = __task_cred(task);
58689 + pcred = __task_cred(task->real_parent);
58690 + ulong1 = va_arg(ap, unsigned long);
58691 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
58692 + break;
58693 + case GR_RWXMAP:
58694 + file = va_arg(ap, struct file *);
58695 + gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
58696 + break;
58697 + case GR_PSACCT:
58698 + {
58699 + unsigned int wday, cday;
58700 + __u8 whr, chr;
58701 + __u8 wmin, cmin;
58702 + __u8 wsec, csec;
58703 + char cur_tty[64] = { 0 };
58704 + char parent_tty[64] = { 0 };
58705 +
58706 + task = va_arg(ap, struct task_struct *);
58707 + wday = va_arg(ap, unsigned int);
58708 + cday = va_arg(ap, unsigned int);
58709 + whr = va_arg(ap, int);
58710 + chr = va_arg(ap, int);
58711 + wmin = va_arg(ap, int);
58712 + cmin = va_arg(ap, int);
58713 + wsec = va_arg(ap, int);
58714 + csec = va_arg(ap, int);
58715 + ulong1 = va_arg(ap, unsigned long);
58716 + cred = __task_cred(task);
58717 + pcred = __task_cred(task->real_parent);
58718 +
58719 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58720 + }
58721 + break;
58722 + default:
58723 + gr_log_middle(audit, msg, ap);
58724 + }
58725 + va_end(ap);
58726 + // these don't need DEFAULTSECARGS printed on the end
58727 + if (argtypes == GR_CRASH1 || argtypes == GR_CRASH2)
58728 + gr_log_end(audit, 0);
58729 + else
58730 + gr_log_end(audit, 1);
58731 + END_LOCKS(audit);
58732 +}
58733 diff --git a/grsecurity/grsec_mem.c b/grsecurity/grsec_mem.c
58734 new file mode 100644
58735 index 0000000..f536303
58736 --- /dev/null
58737 +++ b/grsecurity/grsec_mem.c
58738 @@ -0,0 +1,40 @@
58739 +#include <linux/kernel.h>
58740 +#include <linux/sched.h>
58741 +#include <linux/mm.h>
58742 +#include <linux/mman.h>
58743 +#include <linux/grinternal.h>
58744 +
58745 +void
58746 +gr_handle_ioperm(void)
58747 +{
58748 + gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
58749 + return;
58750 +}
58751 +
58752 +void
58753 +gr_handle_iopl(void)
58754 +{
58755 + gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
58756 + return;
58757 +}
58758 +
58759 +void
58760 +gr_handle_mem_readwrite(u64 from, u64 to)
58761 +{
58762 + gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
58763 + return;
58764 +}
58765 +
58766 +void
58767 +gr_handle_vm86(void)
58768 +{
58769 + gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
58770 + return;
58771 +}
58772 +
58773 +void
58774 +gr_log_badprocpid(const char *entry)
58775 +{
58776 + gr_log_str(GR_DONT_AUDIT, GR_BADPROCPID_MSG, entry);
58777 + return;
58778 +}
58779 diff --git a/grsecurity/grsec_mount.c b/grsecurity/grsec_mount.c
58780 new file mode 100644
58781 index 0000000..2131422
58782 --- /dev/null
58783 +++ b/grsecurity/grsec_mount.c
58784 @@ -0,0 +1,62 @@
58785 +#include <linux/kernel.h>
58786 +#include <linux/sched.h>
58787 +#include <linux/mount.h>
58788 +#include <linux/grsecurity.h>
58789 +#include <linux/grinternal.h>
58790 +
58791 +void
58792 +gr_log_remount(const char *devname, const int retval)
58793 +{
58794 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58795 + if (grsec_enable_mount && (retval >= 0))
58796 + gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
58797 +#endif
58798 + return;
58799 +}
58800 +
58801 +void
58802 +gr_log_unmount(const char *devname, const int retval)
58803 +{
58804 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58805 + if (grsec_enable_mount && (retval >= 0))
58806 + gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
58807 +#endif
58808 + return;
58809 +}
58810 +
58811 +void
58812 +gr_log_mount(const char *from, const char *to, const int retval)
58813 +{
58814 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58815 + if (grsec_enable_mount && (retval >= 0))
58816 + gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to);
58817 +#endif
58818 + return;
58819 +}
58820 +
58821 +int
58822 +gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
58823 +{
58824 +#ifdef CONFIG_GRKERNSEC_ROFS
58825 + if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
58826 + gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
58827 + return -EPERM;
58828 + } else
58829 + return 0;
58830 +#endif
58831 + return 0;
58832 +}
58833 +
58834 +int
58835 +gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
58836 +{
58837 +#ifdef CONFIG_GRKERNSEC_ROFS
58838 + if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
58839 + dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
58840 + gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
58841 + return -EPERM;
58842 + } else
58843 + return 0;
58844 +#endif
58845 + return 0;
58846 +}
58847 diff --git a/grsecurity/grsec_pax.c b/grsecurity/grsec_pax.c
58848 new file mode 100644
58849 index 0000000..a3b12a0
58850 --- /dev/null
58851 +++ b/grsecurity/grsec_pax.c
58852 @@ -0,0 +1,36 @@
58853 +#include <linux/kernel.h>
58854 +#include <linux/sched.h>
58855 +#include <linux/mm.h>
58856 +#include <linux/file.h>
58857 +#include <linux/grinternal.h>
58858 +#include <linux/grsecurity.h>
58859 +
58860 +void
58861 +gr_log_textrel(struct vm_area_struct * vma)
58862 +{
58863 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
58864 + if (grsec_enable_audit_textrel)
58865 + gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
58866 +#endif
58867 + return;
58868 +}
58869 +
58870 +void
58871 +gr_log_rwxmmap(struct file *file)
58872 +{
58873 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58874 + if (grsec_enable_log_rwxmaps)
58875 + gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
58876 +#endif
58877 + return;
58878 +}
58879 +
58880 +void
58881 +gr_log_rwxmprotect(struct file *file)
58882 +{
58883 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58884 + if (grsec_enable_log_rwxmaps)
58885 + gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
58886 +#endif
58887 + return;
58888 +}
58889 diff --git a/grsecurity/grsec_ptrace.c b/grsecurity/grsec_ptrace.c
58890 new file mode 100644
58891 index 0000000..f7f29aa
58892 --- /dev/null
58893 +++ b/grsecurity/grsec_ptrace.c
58894 @@ -0,0 +1,30 @@
58895 +#include <linux/kernel.h>
58896 +#include <linux/sched.h>
58897 +#include <linux/grinternal.h>
58898 +#include <linux/security.h>
58899 +
58900 +void
58901 +gr_audit_ptrace(struct task_struct *task)
58902 +{
58903 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
58904 + if (grsec_enable_audit_ptrace)
58905 + gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
58906 +#endif
58907 + return;
58908 +}
58909 +
58910 +int
58911 +gr_ptrace_readexec(struct file *file, int unsafe_flags)
58912 +{
58913 +#ifdef CONFIG_GRKERNSEC_PTRACE_READEXEC
58914 + const struct dentry *dentry = file->f_path.dentry;
58915 + const struct vfsmount *mnt = file->f_path.mnt;
58916 +
58917 + if (grsec_enable_ptrace_readexec && (unsafe_flags & LSM_UNSAFE_PTRACE) &&
58918 + (inode_permission(dentry->d_inode, MAY_READ) || !gr_acl_handle_open(dentry, mnt, MAY_READ))) {
58919 + gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_READEXEC_MSG, dentry, mnt);
58920 + return -EACCES;
58921 + }
58922 +#endif
58923 + return 0;
58924 +}
58925 diff --git a/grsecurity/grsec_sig.c b/grsecurity/grsec_sig.c
58926 new file mode 100644
58927 index 0000000..b4ac94c
58928 --- /dev/null
58929 +++ b/grsecurity/grsec_sig.c
58930 @@ -0,0 +1,209 @@
58931 +#include <linux/kernel.h>
58932 +#include <linux/sched.h>
58933 +#include <linux/delay.h>
58934 +#include <linux/grsecurity.h>
58935 +#include <linux/grinternal.h>
58936 +#include <linux/hardirq.h>
58937 +
58938 +char *signames[] = {
58939 + [SIGSEGV] = "Segmentation fault",
58940 + [SIGILL] = "Illegal instruction",
58941 + [SIGABRT] = "Abort",
58942 + [SIGBUS] = "Invalid alignment/Bus error"
58943 +};
58944 +
58945 +void
58946 +gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
58947 +{
58948 +#ifdef CONFIG_GRKERNSEC_SIGNAL
58949 + if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
58950 + (sig == SIGABRT) || (sig == SIGBUS))) {
58951 + if (t->pid == current->pid) {
58952 + gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
58953 + } else {
58954 + gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
58955 + }
58956 + }
58957 +#endif
58958 + return;
58959 +}
58960 +
58961 +int
58962 +gr_handle_signal(const struct task_struct *p, const int sig)
58963 +{
58964 +#ifdef CONFIG_GRKERNSEC
58965 + /* ignore the 0 signal for protected task checks */
58966 + if (current->pid > 1 && sig && gr_check_protected_task(p)) {
58967 + gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
58968 + return -EPERM;
58969 + } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
58970 + return -EPERM;
58971 + }
58972 +#endif
58973 + return 0;
58974 +}
58975 +
58976 +#ifdef CONFIG_GRKERNSEC
58977 +extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
58978 +
58979 +int gr_fake_force_sig(int sig, struct task_struct *t)
58980 +{
58981 + unsigned long int flags;
58982 + int ret, blocked, ignored;
58983 + struct k_sigaction *action;
58984 +
58985 + spin_lock_irqsave(&t->sighand->siglock, flags);
58986 + action = &t->sighand->action[sig-1];
58987 + ignored = action->sa.sa_handler == SIG_IGN;
58988 + blocked = sigismember(&t->blocked, sig);
58989 + if (blocked || ignored) {
58990 + action->sa.sa_handler = SIG_DFL;
58991 + if (blocked) {
58992 + sigdelset(&t->blocked, sig);
58993 + recalc_sigpending_and_wake(t);
58994 + }
58995 + }
58996 + if (action->sa.sa_handler == SIG_DFL)
58997 + t->signal->flags &= ~SIGNAL_UNKILLABLE;
58998 + ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
58999 +
59000 + spin_unlock_irqrestore(&t->sighand->siglock, flags);
59001 +
59002 + return ret;
59003 +}
59004 +#endif
59005 +
59006 +#ifdef CONFIG_GRKERNSEC_BRUTE
59007 +#define GR_USER_BAN_TIME (15 * 60)
59008 +
59009 +static int __get_dumpable(unsigned long mm_flags)
59010 +{
59011 + int ret;
59012 +
59013 + ret = mm_flags & MMF_DUMPABLE_MASK;
59014 + return (ret >= 2) ? 2 : ret;
59015 +}
59016 +#endif
59017 +
59018 +void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
59019 +{
59020 +#ifdef CONFIG_GRKERNSEC_BRUTE
59021 + kuid_t uid = GLOBAL_ROOT_UID;
59022 +
59023 + if (!grsec_enable_brute)
59024 + return;
59025 +
59026 + rcu_read_lock();
59027 + read_lock(&tasklist_lock);
59028 + read_lock(&grsec_exec_file_lock);
59029 + if (p->real_parent && p->real_parent->exec_file == p->exec_file)
59030 + p->real_parent->brute = 1;
59031 + else {
59032 + const struct cred *cred = __task_cred(p), *cred2;
59033 + struct task_struct *tsk, *tsk2;
59034 +
59035 + if (!__get_dumpable(mm_flags) && !uid_eq(cred->uid, GLOBAL_ROOT_UID)) {
59036 + struct user_struct *user;
59037 +
59038 + uid = cred->uid;
59039 +
59040 + /* this is put upon execution past expiration */
59041 + user = find_user(uid);
59042 + if (user == NULL)
59043 + goto unlock;
59044 + user->banned = 1;
59045 + user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
59046 + if (user->ban_expires == ~0UL)
59047 + user->ban_expires--;
59048 +
59049 + do_each_thread(tsk2, tsk) {
59050 + cred2 = __task_cred(tsk);
59051 + if (tsk != p && uid_eq(cred2->uid, uid))
59052 + gr_fake_force_sig(SIGKILL, tsk);
59053 + } while_each_thread(tsk2, tsk);
59054 + }
59055 + }
59056 +unlock:
59057 + read_unlock(&grsec_exec_file_lock);
59058 + read_unlock(&tasklist_lock);
59059 + rcu_read_unlock();
59060 +
59061 + if (!uid_eq(uid, GLOBAL_ROOT_UID))
59062 + printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n",
59063 + from_kuid_munged(&init_user_ns, uid), GR_USER_BAN_TIME / 60);
59064 +
59065 +#endif
59066 + return;
59067 +}
59068 +
59069 +void gr_handle_brute_check(void)
59070 +{
59071 +#ifdef CONFIG_GRKERNSEC_BRUTE
59072 + if (current->brute)
59073 + msleep(30 * 1000);
59074 +#endif
59075 + return;
59076 +}
59077 +
59078 +void gr_handle_kernel_exploit(void)
59079 +{
59080 +#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
59081 + const struct cred *cred;
59082 + struct task_struct *tsk, *tsk2;
59083 + struct user_struct *user;
59084 + kuid_t uid;
59085 +
59086 + if (in_irq() || in_serving_softirq() || in_nmi())
59087 + panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
59088 +
59089 + uid = current_uid();
59090 +
59091 + if (uid_eq(uid, GLOBAL_ROOT_UID))
59092 + panic("grsec: halting the system due to suspicious kernel crash caused by root");
59093 + else {
59094 + /* kill all the processes of this user, hold a reference
59095 + to their creds struct, and prevent them from creating
59096 + another process until system reset
59097 + */
59098 + printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n",
59099 + from_kuid_munged(&init_user_ns, uid));
59100 + /* we intentionally leak this ref */
59101 + user = get_uid(current->cred->user);
59102 + if (user) {
59103 + user->banned = 1;
59104 + user->ban_expires = ~0UL;
59105 + }
59106 +
59107 + read_lock(&tasklist_lock);
59108 + do_each_thread(tsk2, tsk) {
59109 + cred = __task_cred(tsk);
59110 + if (uid_eq(cred->uid, uid))
59111 + gr_fake_force_sig(SIGKILL, tsk);
59112 + } while_each_thread(tsk2, tsk);
59113 + read_unlock(&tasklist_lock);
59114 + }
59115 +#endif
59116 +}
59117 +
59118 +int __gr_process_user_ban(struct user_struct *user)
59119 +{
59120 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
59121 + if (unlikely(user->banned)) {
59122 + if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
59123 + user->banned = 0;
59124 + user->ban_expires = 0;
59125 + free_uid(user);
59126 + } else
59127 + return -EPERM;
59128 + }
59129 +#endif
59130 + return 0;
59131 +}
59132 +
59133 +int gr_process_user_ban(void)
59134 +{
59135 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
59136 + return __gr_process_user_ban(current->cred->user);
59137 +#endif
59138 + return 0;
59139 +}
59140 diff --git a/grsecurity/grsec_sock.c b/grsecurity/grsec_sock.c
59141 new file mode 100644
59142 index 0000000..4030d57
59143 --- /dev/null
59144 +++ b/grsecurity/grsec_sock.c
59145 @@ -0,0 +1,244 @@
59146 +#include <linux/kernel.h>
59147 +#include <linux/module.h>
59148 +#include <linux/sched.h>
59149 +#include <linux/file.h>
59150 +#include <linux/net.h>
59151 +#include <linux/in.h>
59152 +#include <linux/ip.h>
59153 +#include <net/sock.h>
59154 +#include <net/inet_sock.h>
59155 +#include <linux/grsecurity.h>
59156 +#include <linux/grinternal.h>
59157 +#include <linux/gracl.h>
59158 +
59159 +extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
59160 +extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
59161 +
59162 +EXPORT_SYMBOL(gr_search_udp_recvmsg);
59163 +EXPORT_SYMBOL(gr_search_udp_sendmsg);
59164 +
59165 +#ifdef CONFIG_UNIX_MODULE
59166 +EXPORT_SYMBOL(gr_acl_handle_unix);
59167 +EXPORT_SYMBOL(gr_acl_handle_mknod);
59168 +EXPORT_SYMBOL(gr_handle_chroot_unix);
59169 +EXPORT_SYMBOL(gr_handle_create);
59170 +#endif
59171 +
59172 +#ifdef CONFIG_GRKERNSEC
59173 +#define gr_conn_table_size 32749
59174 +struct conn_table_entry {
59175 + struct conn_table_entry *next;
59176 + struct signal_struct *sig;
59177 +};
59178 +
59179 +struct conn_table_entry *gr_conn_table[gr_conn_table_size];
59180 +DEFINE_SPINLOCK(gr_conn_table_lock);
59181 +
59182 +extern const char * gr_socktype_to_name(unsigned char type);
59183 +extern const char * gr_proto_to_name(unsigned char proto);
59184 +extern const char * gr_sockfamily_to_name(unsigned char family);
59185 +
59186 +static __inline__ int
59187 +conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
59188 +{
59189 + return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
59190 +}
59191 +
59192 +static __inline__ int
59193 +conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
59194 + __u16 sport, __u16 dport)
59195 +{
59196 + if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
59197 + sig->gr_sport == sport && sig->gr_dport == dport))
59198 + return 1;
59199 + else
59200 + return 0;
59201 +}
59202 +
59203 +static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
59204 +{
59205 + struct conn_table_entry **match;
59206 + unsigned int index;
59207 +
59208 + index = conn_hash(sig->gr_saddr, sig->gr_daddr,
59209 + sig->gr_sport, sig->gr_dport,
59210 + gr_conn_table_size);
59211 +
59212 + newent->sig = sig;
59213 +
59214 + match = &gr_conn_table[index];
59215 + newent->next = *match;
59216 + *match = newent;
59217 +
59218 + return;
59219 +}
59220 +
59221 +static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
59222 +{
59223 + struct conn_table_entry *match, *last = NULL;
59224 + unsigned int index;
59225 +
59226 + index = conn_hash(sig->gr_saddr, sig->gr_daddr,
59227 + sig->gr_sport, sig->gr_dport,
59228 + gr_conn_table_size);
59229 +
59230 + match = gr_conn_table[index];
59231 + while (match && !conn_match(match->sig,
59232 + sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
59233 + sig->gr_dport)) {
59234 + last = match;
59235 + match = match->next;
59236 + }
59237 +
59238 + if (match) {
59239 + if (last)
59240 + last->next = match->next;
59241 + else
59242 + gr_conn_table[index] = NULL;
59243 + kfree(match);
59244 + }
59245 +
59246 + return;
59247 +}
59248 +
59249 +static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
59250 + __u16 sport, __u16 dport)
59251 +{
59252 + struct conn_table_entry *match;
59253 + unsigned int index;
59254 +
59255 + index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
59256 +
59257 + match = gr_conn_table[index];
59258 + while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
59259 + match = match->next;
59260 +
59261 + if (match)
59262 + return match->sig;
59263 + else
59264 + return NULL;
59265 +}
59266 +
59267 +#endif
59268 +
59269 +void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
59270 +{
59271 +#ifdef CONFIG_GRKERNSEC
59272 + struct signal_struct *sig = task->signal;
59273 + struct conn_table_entry *newent;
59274 +
59275 + newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
59276 + if (newent == NULL)
59277 + return;
59278 + /* no bh lock needed since we are called with bh disabled */
59279 + spin_lock(&gr_conn_table_lock);
59280 + gr_del_task_from_ip_table_nolock(sig);
59281 + sig->gr_saddr = inet->inet_rcv_saddr;
59282 + sig->gr_daddr = inet->inet_daddr;
59283 + sig->gr_sport = inet->inet_sport;
59284 + sig->gr_dport = inet->inet_dport;
59285 + gr_add_to_task_ip_table_nolock(sig, newent);
59286 + spin_unlock(&gr_conn_table_lock);
59287 +#endif
59288 + return;
59289 +}
59290 +
59291 +void gr_del_task_from_ip_table(struct task_struct *task)
59292 +{
59293 +#ifdef CONFIG_GRKERNSEC
59294 + spin_lock_bh(&gr_conn_table_lock);
59295 + gr_del_task_from_ip_table_nolock(task->signal);
59296 + spin_unlock_bh(&gr_conn_table_lock);
59297 +#endif
59298 + return;
59299 +}
59300 +
59301 +void
59302 +gr_attach_curr_ip(const struct sock *sk)
59303 +{
59304 +#ifdef CONFIG_GRKERNSEC
59305 + struct signal_struct *p, *set;
59306 + const struct inet_sock *inet = inet_sk(sk);
59307 +
59308 + if (unlikely(sk->sk_protocol != IPPROTO_TCP))
59309 + return;
59310 +
59311 + set = current->signal;
59312 +
59313 + spin_lock_bh(&gr_conn_table_lock);
59314 + p = gr_lookup_task_ip_table(inet->inet_daddr, inet->inet_rcv_saddr,
59315 + inet->inet_dport, inet->inet_sport);
59316 + if (unlikely(p != NULL)) {
59317 + set->curr_ip = p->curr_ip;
59318 + set->used_accept = 1;
59319 + gr_del_task_from_ip_table_nolock(p);
59320 + spin_unlock_bh(&gr_conn_table_lock);
59321 + return;
59322 + }
59323 + spin_unlock_bh(&gr_conn_table_lock);
59324 +
59325 + set->curr_ip = inet->inet_daddr;
59326 + set->used_accept = 1;
59327 +#endif
59328 + return;
59329 +}
59330 +
59331 +int
59332 +gr_handle_sock_all(const int family, const int type, const int protocol)
59333 +{
59334 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59335 + if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
59336 + (family != AF_UNIX)) {
59337 + if (family == AF_INET)
59338 + gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
59339 + else
59340 + gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
59341 + return -EACCES;
59342 + }
59343 +#endif
59344 + return 0;
59345 +}
59346 +
59347 +int
59348 +gr_handle_sock_server(const struct sockaddr *sck)
59349 +{
59350 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59351 + if (grsec_enable_socket_server &&
59352 + in_group_p(grsec_socket_server_gid) &&
59353 + sck && (sck->sa_family != AF_UNIX) &&
59354 + (sck->sa_family != AF_LOCAL)) {
59355 + gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
59356 + return -EACCES;
59357 + }
59358 +#endif
59359 + return 0;
59360 +}
59361 +
59362 +int
59363 +gr_handle_sock_server_other(const struct sock *sck)
59364 +{
59365 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59366 + if (grsec_enable_socket_server &&
59367 + in_group_p(grsec_socket_server_gid) &&
59368 + sck && (sck->sk_family != AF_UNIX) &&
59369 + (sck->sk_family != AF_LOCAL)) {
59370 + gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
59371 + return -EACCES;
59372 + }
59373 +#endif
59374 + return 0;
59375 +}
59376 +
59377 +int
59378 +gr_handle_sock_client(const struct sockaddr *sck)
59379 +{
59380 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59381 + if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
59382 + sck && (sck->sa_family != AF_UNIX) &&
59383 + (sck->sa_family != AF_LOCAL)) {
59384 + gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
59385 + return -EACCES;
59386 + }
59387 +#endif
59388 + return 0;
59389 +}
59390 diff --git a/grsecurity/grsec_sysctl.c b/grsecurity/grsec_sysctl.c
59391 new file mode 100644
59392 index 0000000..f55ef0f
59393 --- /dev/null
59394 +++ b/grsecurity/grsec_sysctl.c
59395 @@ -0,0 +1,469 @@
59396 +#include <linux/kernel.h>
59397 +#include <linux/sched.h>
59398 +#include <linux/sysctl.h>
59399 +#include <linux/grsecurity.h>
59400 +#include <linux/grinternal.h>
59401 +
59402 +int
59403 +gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
59404 +{
59405 +#ifdef CONFIG_GRKERNSEC_SYSCTL
59406 + if (dirname == NULL || name == NULL)
59407 + return 0;
59408 + if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
59409 + gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
59410 + return -EACCES;
59411 + }
59412 +#endif
59413 + return 0;
59414 +}
59415 +
59416 +#ifdef CONFIG_GRKERNSEC_ROFS
59417 +static int __maybe_unused one = 1;
59418 +#endif
59419 +
59420 +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
59421 +struct ctl_table grsecurity_table[] = {
59422 +#ifdef CONFIG_GRKERNSEC_SYSCTL
59423 +#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
59424 +#ifdef CONFIG_GRKERNSEC_IO
59425 + {
59426 + .procname = "disable_priv_io",
59427 + .data = &grsec_disable_privio,
59428 + .maxlen = sizeof(int),
59429 + .mode = 0600,
59430 + .proc_handler = &proc_dointvec,
59431 + },
59432 +#endif
59433 +#endif
59434 +#ifdef CONFIG_GRKERNSEC_LINK
59435 + {
59436 + .procname = "linking_restrictions",
59437 + .data = &grsec_enable_link,
59438 + .maxlen = sizeof(int),
59439 + .mode = 0600,
59440 + .proc_handler = &proc_dointvec,
59441 + },
59442 +#endif
59443 +#ifdef CONFIG_GRKERNSEC_SYMLINKOWN
59444 + {
59445 + .procname = "enforce_symlinksifowner",
59446 + .data = &grsec_enable_symlinkown,
59447 + .maxlen = sizeof(int),
59448 + .mode = 0600,
59449 + .proc_handler = &proc_dointvec,
59450 + },
59451 + {
59452 + .procname = "symlinkown_gid",
59453 + .data = &grsec_symlinkown_gid,
59454 + .maxlen = sizeof(int),
59455 + .mode = 0600,
59456 + .proc_handler = &proc_dointvec,
59457 + },
59458 +#endif
59459 +#ifdef CONFIG_GRKERNSEC_BRUTE
59460 + {
59461 + .procname = "deter_bruteforce",
59462 + .data = &grsec_enable_brute,
59463 + .maxlen = sizeof(int),
59464 + .mode = 0600,
59465 + .proc_handler = &proc_dointvec,
59466 + },
59467 +#endif
59468 +#ifdef CONFIG_GRKERNSEC_FIFO
59469 + {
59470 + .procname = "fifo_restrictions",
59471 + .data = &grsec_enable_fifo,
59472 + .maxlen = sizeof(int),
59473 + .mode = 0600,
59474 + .proc_handler = &proc_dointvec,
59475 + },
59476 +#endif
59477 +#ifdef CONFIG_GRKERNSEC_PTRACE_READEXEC
59478 + {
59479 + .procname = "ptrace_readexec",
59480 + .data = &grsec_enable_ptrace_readexec,
59481 + .maxlen = sizeof(int),
59482 + .mode = 0600,
59483 + .proc_handler = &proc_dointvec,
59484 + },
59485 +#endif
59486 +#ifdef CONFIG_GRKERNSEC_SETXID
59487 + {
59488 + .procname = "consistent_setxid",
59489 + .data = &grsec_enable_setxid,
59490 + .maxlen = sizeof(int),
59491 + .mode = 0600,
59492 + .proc_handler = &proc_dointvec,
59493 + },
59494 +#endif
59495 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
59496 + {
59497 + .procname = "ip_blackhole",
59498 + .data = &grsec_enable_blackhole,
59499 + .maxlen = sizeof(int),
59500 + .mode = 0600,
59501 + .proc_handler = &proc_dointvec,
59502 + },
59503 + {
59504 + .procname = "lastack_retries",
59505 + .data = &grsec_lastack_retries,
59506 + .maxlen = sizeof(int),
59507 + .mode = 0600,
59508 + .proc_handler = &proc_dointvec,
59509 + },
59510 +#endif
59511 +#ifdef CONFIG_GRKERNSEC_EXECLOG
59512 + {
59513 + .procname = "exec_logging",
59514 + .data = &grsec_enable_execlog,
59515 + .maxlen = sizeof(int),
59516 + .mode = 0600,
59517 + .proc_handler = &proc_dointvec,
59518 + },
59519 +#endif
59520 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
59521 + {
59522 + .procname = "rwxmap_logging",
59523 + .data = &grsec_enable_log_rwxmaps,
59524 + .maxlen = sizeof(int),
59525 + .mode = 0600,
59526 + .proc_handler = &proc_dointvec,
59527 + },
59528 +#endif
59529 +#ifdef CONFIG_GRKERNSEC_SIGNAL
59530 + {
59531 + .procname = "signal_logging",
59532 + .data = &grsec_enable_signal,
59533 + .maxlen = sizeof(int),
59534 + .mode = 0600,
59535 + .proc_handler = &proc_dointvec,
59536 + },
59537 +#endif
59538 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
59539 + {
59540 + .procname = "forkfail_logging",
59541 + .data = &grsec_enable_forkfail,
59542 + .maxlen = sizeof(int),
59543 + .mode = 0600,
59544 + .proc_handler = &proc_dointvec,
59545 + },
59546 +#endif
59547 +#ifdef CONFIG_GRKERNSEC_TIME
59548 + {
59549 + .procname = "timechange_logging",
59550 + .data = &grsec_enable_time,
59551 + .maxlen = sizeof(int),
59552 + .mode = 0600,
59553 + .proc_handler = &proc_dointvec,
59554 + },
59555 +#endif
59556 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
59557 + {
59558 + .procname = "chroot_deny_shmat",
59559 + .data = &grsec_enable_chroot_shmat,
59560 + .maxlen = sizeof(int),
59561 + .mode = 0600,
59562 + .proc_handler = &proc_dointvec,
59563 + },
59564 +#endif
59565 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
59566 + {
59567 + .procname = "chroot_deny_unix",
59568 + .data = &grsec_enable_chroot_unix,
59569 + .maxlen = sizeof(int),
59570 + .mode = 0600,
59571 + .proc_handler = &proc_dointvec,
59572 + },
59573 +#endif
59574 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
59575 + {
59576 + .procname = "chroot_deny_mount",
59577 + .data = &grsec_enable_chroot_mount,
59578 + .maxlen = sizeof(int),
59579 + .mode = 0600,
59580 + .proc_handler = &proc_dointvec,
59581 + },
59582 +#endif
59583 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
59584 + {
59585 + .procname = "chroot_deny_fchdir",
59586 + .data = &grsec_enable_chroot_fchdir,
59587 + .maxlen = sizeof(int),
59588 + .mode = 0600,
59589 + .proc_handler = &proc_dointvec,
59590 + },
59591 +#endif
59592 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
59593 + {
59594 + .procname = "chroot_deny_chroot",
59595 + .data = &grsec_enable_chroot_double,
59596 + .maxlen = sizeof(int),
59597 + .mode = 0600,
59598 + .proc_handler = &proc_dointvec,
59599 + },
59600 +#endif
59601 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
59602 + {
59603 + .procname = "chroot_deny_pivot",
59604 + .data = &grsec_enable_chroot_pivot,
59605 + .maxlen = sizeof(int),
59606 + .mode = 0600,
59607 + .proc_handler = &proc_dointvec,
59608 + },
59609 +#endif
59610 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
59611 + {
59612 + .procname = "chroot_enforce_chdir",
59613 + .data = &grsec_enable_chroot_chdir,
59614 + .maxlen = sizeof(int),
59615 + .mode = 0600,
59616 + .proc_handler = &proc_dointvec,
59617 + },
59618 +#endif
59619 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
59620 + {
59621 + .procname = "chroot_deny_chmod",
59622 + .data = &grsec_enable_chroot_chmod,
59623 + .maxlen = sizeof(int),
59624 + .mode = 0600,
59625 + .proc_handler = &proc_dointvec,
59626 + },
59627 +#endif
59628 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
59629 + {
59630 + .procname = "chroot_deny_mknod",
59631 + .data = &grsec_enable_chroot_mknod,
59632 + .maxlen = sizeof(int),
59633 + .mode = 0600,
59634 + .proc_handler = &proc_dointvec,
59635 + },
59636 +#endif
59637 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
59638 + {
59639 + .procname = "chroot_restrict_nice",
59640 + .data = &grsec_enable_chroot_nice,
59641 + .maxlen = sizeof(int),
59642 + .mode = 0600,
59643 + .proc_handler = &proc_dointvec,
59644 + },
59645 +#endif
59646 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
59647 + {
59648 + .procname = "chroot_execlog",
59649 + .data = &grsec_enable_chroot_execlog,
59650 + .maxlen = sizeof(int),
59651 + .mode = 0600,
59652 + .proc_handler = &proc_dointvec,
59653 + },
59654 +#endif
59655 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
59656 + {
59657 + .procname = "chroot_caps",
59658 + .data = &grsec_enable_chroot_caps,
59659 + .maxlen = sizeof(int),
59660 + .mode = 0600,
59661 + .proc_handler = &proc_dointvec,
59662 + },
59663 +#endif
59664 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
59665 + {
59666 + .procname = "chroot_deny_sysctl",
59667 + .data = &grsec_enable_chroot_sysctl,
59668 + .maxlen = sizeof(int),
59669 + .mode = 0600,
59670 + .proc_handler = &proc_dointvec,
59671 + },
59672 +#endif
59673 +#ifdef CONFIG_GRKERNSEC_TPE
59674 + {
59675 + .procname = "tpe",
59676 + .data = &grsec_enable_tpe,
59677 + .maxlen = sizeof(int),
59678 + .mode = 0600,
59679 + .proc_handler = &proc_dointvec,
59680 + },
59681 + {
59682 + .procname = "tpe_gid",
59683 + .data = &grsec_tpe_gid,
59684 + .maxlen = sizeof(int),
59685 + .mode = 0600,
59686 + .proc_handler = &proc_dointvec,
59687 + },
59688 +#endif
59689 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59690 + {
59691 + .procname = "tpe_invert",
59692 + .data = &grsec_enable_tpe_invert,
59693 + .maxlen = sizeof(int),
59694 + .mode = 0600,
59695 + .proc_handler = &proc_dointvec,
59696 + },
59697 +#endif
59698 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
59699 + {
59700 + .procname = "tpe_restrict_all",
59701 + .data = &grsec_enable_tpe_all,
59702 + .maxlen = sizeof(int),
59703 + .mode = 0600,
59704 + .proc_handler = &proc_dointvec,
59705 + },
59706 +#endif
59707 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59708 + {
59709 + .procname = "socket_all",
59710 + .data = &grsec_enable_socket_all,
59711 + .maxlen = sizeof(int),
59712 + .mode = 0600,
59713 + .proc_handler = &proc_dointvec,
59714 + },
59715 + {
59716 + .procname = "socket_all_gid",
59717 + .data = &grsec_socket_all_gid,
59718 + .maxlen = sizeof(int),
59719 + .mode = 0600,
59720 + .proc_handler = &proc_dointvec,
59721 + },
59722 +#endif
59723 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59724 + {
59725 + .procname = "socket_client",
59726 + .data = &grsec_enable_socket_client,
59727 + .maxlen = sizeof(int),
59728 + .mode = 0600,
59729 + .proc_handler = &proc_dointvec,
59730 + },
59731 + {
59732 + .procname = "socket_client_gid",
59733 + .data = &grsec_socket_client_gid,
59734 + .maxlen = sizeof(int),
59735 + .mode = 0600,
59736 + .proc_handler = &proc_dointvec,
59737 + },
59738 +#endif
59739 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59740 + {
59741 + .procname = "socket_server",
59742 + .data = &grsec_enable_socket_server,
59743 + .maxlen = sizeof(int),
59744 + .mode = 0600,
59745 + .proc_handler = &proc_dointvec,
59746 + },
59747 + {
59748 + .procname = "socket_server_gid",
59749 + .data = &grsec_socket_server_gid,
59750 + .maxlen = sizeof(int),
59751 + .mode = 0600,
59752 + .proc_handler = &proc_dointvec,
59753 + },
59754 +#endif
59755 +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
59756 + {
59757 + .procname = "audit_group",
59758 + .data = &grsec_enable_group,
59759 + .maxlen = sizeof(int),
59760 + .mode = 0600,
59761 + .proc_handler = &proc_dointvec,
59762 + },
59763 + {
59764 + .procname = "audit_gid",
59765 + .data = &grsec_audit_gid,
59766 + .maxlen = sizeof(int),
59767 + .mode = 0600,
59768 + .proc_handler = &proc_dointvec,
59769 + },
59770 +#endif
59771 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
59772 + {
59773 + .procname = "audit_chdir",
59774 + .data = &grsec_enable_chdir,
59775 + .maxlen = sizeof(int),
59776 + .mode = 0600,
59777 + .proc_handler = &proc_dointvec,
59778 + },
59779 +#endif
59780 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59781 + {
59782 + .procname = "audit_mount",
59783 + .data = &grsec_enable_mount,
59784 + .maxlen = sizeof(int),
59785 + .mode = 0600,
59786 + .proc_handler = &proc_dointvec,
59787 + },
59788 +#endif
59789 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
59790 + {
59791 + .procname = "audit_textrel",
59792 + .data = &grsec_enable_audit_textrel,
59793 + .maxlen = sizeof(int),
59794 + .mode = 0600,
59795 + .proc_handler = &proc_dointvec,
59796 + },
59797 +#endif
59798 +#ifdef CONFIG_GRKERNSEC_DMESG
59799 + {
59800 + .procname = "dmesg",
59801 + .data = &grsec_enable_dmesg,
59802 + .maxlen = sizeof(int),
59803 + .mode = 0600,
59804 + .proc_handler = &proc_dointvec,
59805 + },
59806 +#endif
59807 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
59808 + {
59809 + .procname = "chroot_findtask",
59810 + .data = &grsec_enable_chroot_findtask,
59811 + .maxlen = sizeof(int),
59812 + .mode = 0600,
59813 + .proc_handler = &proc_dointvec,
59814 + },
59815 +#endif
59816 +#ifdef CONFIG_GRKERNSEC_RESLOG
59817 + {
59818 + .procname = "resource_logging",
59819 + .data = &grsec_resource_logging,
59820 + .maxlen = sizeof(int),
59821 + .mode = 0600,
59822 + .proc_handler = &proc_dointvec,
59823 + },
59824 +#endif
59825 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
59826 + {
59827 + .procname = "audit_ptrace",
59828 + .data = &grsec_enable_audit_ptrace,
59829 + .maxlen = sizeof(int),
59830 + .mode = 0600,
59831 + .proc_handler = &proc_dointvec,
59832 + },
59833 +#endif
59834 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
59835 + {
59836 + .procname = "harden_ptrace",
59837 + .data = &grsec_enable_harden_ptrace,
59838 + .maxlen = sizeof(int),
59839 + .mode = 0600,
59840 + .proc_handler = &proc_dointvec,
59841 + },
59842 +#endif
59843 + {
59844 + .procname = "grsec_lock",
59845 + .data = &grsec_lock,
59846 + .maxlen = sizeof(int),
59847 + .mode = 0600,
59848 + .proc_handler = &proc_dointvec,
59849 + },
59850 +#endif
59851 +#ifdef CONFIG_GRKERNSEC_ROFS
59852 + {
59853 + .procname = "romount_protect",
59854 + .data = &grsec_enable_rofs,
59855 + .maxlen = sizeof(int),
59856 + .mode = 0600,
59857 + .proc_handler = &proc_dointvec_minmax,
59858 + .extra1 = &one,
59859 + .extra2 = &one,
59860 + },
59861 +#endif
59862 + { }
59863 +};
59864 +#endif
59865 diff --git a/grsecurity/grsec_time.c b/grsecurity/grsec_time.c
59866 new file mode 100644
59867 index 0000000..0dc13c3
59868 --- /dev/null
59869 +++ b/grsecurity/grsec_time.c
59870 @@ -0,0 +1,16 @@
59871 +#include <linux/kernel.h>
59872 +#include <linux/sched.h>
59873 +#include <linux/grinternal.h>
59874 +#include <linux/module.h>
59875 +
59876 +void
59877 +gr_log_timechange(void)
59878 +{
59879 +#ifdef CONFIG_GRKERNSEC_TIME
59880 + if (grsec_enable_time)
59881 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
59882 +#endif
59883 + return;
59884 +}
59885 +
59886 +EXPORT_SYMBOL(gr_log_timechange);
59887 diff --git a/grsecurity/grsec_tpe.c b/grsecurity/grsec_tpe.c
59888 new file mode 100644
59889 index 0000000..07e0dc0
59890 --- /dev/null
59891 +++ b/grsecurity/grsec_tpe.c
59892 @@ -0,0 +1,73 @@
59893 +#include <linux/kernel.h>
59894 +#include <linux/sched.h>
59895 +#include <linux/file.h>
59896 +#include <linux/fs.h>
59897 +#include <linux/grinternal.h>
59898 +
59899 +extern int gr_acl_tpe_check(void);
59900 +
59901 +int
59902 +gr_tpe_allow(const struct file *file)
59903 +{
59904 +#ifdef CONFIG_GRKERNSEC
59905 + struct inode *inode = file->f_path.dentry->d_parent->d_inode;
59906 + const struct cred *cred = current_cred();
59907 + char *msg = NULL;
59908 + char *msg2 = NULL;
59909 +
59910 + // never restrict root
59911 + if (!cred->uid)
59912 + return 1;
59913 +
59914 + if (grsec_enable_tpe) {
59915 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59916 + if (grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid))
59917 + msg = "not being in trusted group";
59918 + else if (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid))
59919 + msg = "being in untrusted group";
59920 +#else
59921 + if (in_group_p(grsec_tpe_gid))
59922 + msg = "being in untrusted group";
59923 +#endif
59924 + }
59925 + if (!msg && gr_acl_tpe_check())
59926 + msg = "being in untrusted role";
59927 +
59928 + // not in any affected group/role
59929 + if (!msg)
59930 + goto next_check;
59931 +
59932 + if (inode->i_uid)
59933 + msg2 = "file in non-root-owned directory";
59934 + else if (inode->i_mode & S_IWOTH)
59935 + msg2 = "file in world-writable directory";
59936 + else if (inode->i_mode & S_IWGRP)
59937 + msg2 = "file in group-writable directory";
59938 +
59939 + if (msg && msg2) {
59940 + char fullmsg[70] = {0};
59941 + snprintf(fullmsg, sizeof(fullmsg)-1, "%s and %s", msg, msg2);
59942 + gr_log_str_fs(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, fullmsg, file->f_path.dentry, file->f_path.mnt);
59943 + return 0;
59944 + }
59945 + msg = NULL;
59946 +next_check:
59947 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
59948 + if (!grsec_enable_tpe || !grsec_enable_tpe_all)
59949 + return 1;
59950 +
59951 + if (inode->i_uid && (inode->i_uid != cred->uid))
59952 + msg = "directory not owned by user";
59953 + else if (inode->i_mode & S_IWOTH)
59954 + msg = "file in world-writable directory";
59955 + else if (inode->i_mode & S_IWGRP)
59956 + msg = "file in group-writable directory";
59957 +
59958 + if (msg) {
59959 + gr_log_str_fs(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, msg, file->f_path.dentry, file->f_path.mnt);
59960 + return 0;
59961 + }
59962 +#endif
59963 +#endif
59964 + return 1;
59965 +}
59966 diff --git a/grsecurity/grsum.c b/grsecurity/grsum.c
59967 new file mode 100644
59968 index 0000000..9f7b1ac
59969 --- /dev/null
59970 +++ b/grsecurity/grsum.c
59971 @@ -0,0 +1,61 @@
59972 +#include <linux/err.h>
59973 +#include <linux/kernel.h>
59974 +#include <linux/sched.h>
59975 +#include <linux/mm.h>
59976 +#include <linux/scatterlist.h>
59977 +#include <linux/crypto.h>
59978 +#include <linux/gracl.h>
59979 +
59980 +
59981 +#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
59982 +#error "crypto and sha256 must be built into the kernel"
59983 +#endif
59984 +
59985 +int
59986 +chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
59987 +{
59988 + char *p;
59989 + struct crypto_hash *tfm;
59990 + struct hash_desc desc;
59991 + struct scatterlist sg;
59992 + unsigned char temp_sum[GR_SHA_LEN];
59993 + volatile int retval = 0;
59994 + volatile int dummy = 0;
59995 + unsigned int i;
59996 +
59997 + sg_init_table(&sg, 1);
59998 +
59999 + tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
60000 + if (IS_ERR(tfm)) {
60001 + /* should never happen, since sha256 should be built in */
60002 + return 1;
60003 + }
60004 +
60005 + desc.tfm = tfm;
60006 + desc.flags = 0;
60007 +
60008 + crypto_hash_init(&desc);
60009 +
60010 + p = salt;
60011 + sg_set_buf(&sg, p, GR_SALT_LEN);
60012 + crypto_hash_update(&desc, &sg, sg.length);
60013 +
60014 + p = entry->pw;
60015 + sg_set_buf(&sg, p, strlen(p));
60016 +
60017 + crypto_hash_update(&desc, &sg, sg.length);
60018 +
60019 + crypto_hash_final(&desc, temp_sum);
60020 +
60021 + memset(entry->pw, 0, GR_PW_LEN);
60022 +
60023 + for (i = 0; i < GR_SHA_LEN; i++)
60024 + if (sum[i] != temp_sum[i])
60025 + retval = 1;
60026 + else
60027 + dummy = 1; // waste a cycle
60028 +
60029 + crypto_free_hash(tfm);
60030 +
60031 + return retval;
60032 +}
60033 diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
60034 index 9e6e1c6..d47b906 100644
60035 --- a/include/acpi/acpi_bus.h
60036 +++ b/include/acpi/acpi_bus.h
60037 @@ -138,7 +138,7 @@ struct acpi_device_ops {
60038 acpi_op_bind bind;
60039 acpi_op_unbind unbind;
60040 acpi_op_notify notify;
60041 -};
60042 +} __no_const;
60043
60044 #define ACPI_DRIVER_ALL_NOTIFY_EVENTS 0x1 /* system AND device events */
60045
60046 diff --git a/include/asm-generic/4level-fixup.h b/include/asm-generic/4level-fixup.h
60047 index 77ff547..181834f 100644
60048 --- a/include/asm-generic/4level-fixup.h
60049 +++ b/include/asm-generic/4level-fixup.h
60050 @@ -13,8 +13,10 @@
60051 #define pmd_alloc(mm, pud, address) \
60052 ((unlikely(pgd_none(*(pud))) && __pmd_alloc(mm, pud, address))? \
60053 NULL: pmd_offset(pud, address))
60054 +#define pmd_alloc_kernel(mm, pud, address) pmd_alloc((mm), (pud), (address))
60055
60056 #define pud_alloc(mm, pgd, address) (pgd)
60057 +#define pud_alloc_kernel(mm, pgd, address) pud_alloc((mm), (pgd), (address))
60058 #define pud_offset(pgd, start) (pgd)
60059 #define pud_none(pud) 0
60060 #define pud_bad(pud) 0
60061 diff --git a/include/asm-generic/atomic-long.h b/include/asm-generic/atomic-long.h
60062 index b7babf0..3ba8aee 100644
60063 --- a/include/asm-generic/atomic-long.h
60064 +++ b/include/asm-generic/atomic-long.h
60065 @@ -22,6 +22,12 @@
60066
60067 typedef atomic64_t atomic_long_t;
60068
60069 +#ifdef CONFIG_PAX_REFCOUNT
60070 +typedef atomic64_unchecked_t atomic_long_unchecked_t;
60071 +#else
60072 +typedef atomic64_t atomic_long_unchecked_t;
60073 +#endif
60074 +
60075 #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
60076
60077 static inline long atomic_long_read(atomic_long_t *l)
60078 @@ -31,6 +37,15 @@ static inline long atomic_long_read(atomic_long_t *l)
60079 return (long)atomic64_read(v);
60080 }
60081
60082 +#ifdef CONFIG_PAX_REFCOUNT
60083 +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
60084 +{
60085 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60086 +
60087 + return (long)atomic64_read_unchecked(v);
60088 +}
60089 +#endif
60090 +
60091 static inline void atomic_long_set(atomic_long_t *l, long i)
60092 {
60093 atomic64_t *v = (atomic64_t *)l;
60094 @@ -38,6 +53,15 @@ static inline void atomic_long_set(atomic_long_t *l, long i)
60095 atomic64_set(v, i);
60096 }
60097
60098 +#ifdef CONFIG_PAX_REFCOUNT
60099 +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
60100 +{
60101 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60102 +
60103 + atomic64_set_unchecked(v, i);
60104 +}
60105 +#endif
60106 +
60107 static inline void atomic_long_inc(atomic_long_t *l)
60108 {
60109 atomic64_t *v = (atomic64_t *)l;
60110 @@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomic_long_t *l)
60111 atomic64_inc(v);
60112 }
60113
60114 +#ifdef CONFIG_PAX_REFCOUNT
60115 +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
60116 +{
60117 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60118 +
60119 + atomic64_inc_unchecked(v);
60120 +}
60121 +#endif
60122 +
60123 static inline void atomic_long_dec(atomic_long_t *l)
60124 {
60125 atomic64_t *v = (atomic64_t *)l;
60126 @@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomic_long_t *l)
60127 atomic64_dec(v);
60128 }
60129
60130 +#ifdef CONFIG_PAX_REFCOUNT
60131 +static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
60132 +{
60133 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60134 +
60135 + atomic64_dec_unchecked(v);
60136 +}
60137 +#endif
60138 +
60139 static inline void atomic_long_add(long i, atomic_long_t *l)
60140 {
60141 atomic64_t *v = (atomic64_t *)l;
60142 @@ -59,6 +101,15 @@ static inline void atomic_long_add(long i, atomic_long_t *l)
60143 atomic64_add(i, v);
60144 }
60145
60146 +#ifdef CONFIG_PAX_REFCOUNT
60147 +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
60148 +{
60149 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60150 +
60151 + atomic64_add_unchecked(i, v);
60152 +}
60153 +#endif
60154 +
60155 static inline void atomic_long_sub(long i, atomic_long_t *l)
60156 {
60157 atomic64_t *v = (atomic64_t *)l;
60158 @@ -66,6 +117,15 @@ static inline void atomic_long_sub(long i, atomic_long_t *l)
60159 atomic64_sub(i, v);
60160 }
60161
60162 +#ifdef CONFIG_PAX_REFCOUNT
60163 +static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
60164 +{
60165 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60166 +
60167 + atomic64_sub_unchecked(i, v);
60168 +}
60169 +#endif
60170 +
60171 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
60172 {
60173 atomic64_t *v = (atomic64_t *)l;
60174 @@ -115,6 +175,15 @@ static inline long atomic_long_inc_return(atomic_long_t *l)
60175 return (long)atomic64_inc_return(v);
60176 }
60177
60178 +#ifdef CONFIG_PAX_REFCOUNT
60179 +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
60180 +{
60181 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60182 +
60183 + return (long)atomic64_inc_return_unchecked(v);
60184 +}
60185 +#endif
60186 +
60187 static inline long atomic_long_dec_return(atomic_long_t *l)
60188 {
60189 atomic64_t *v = (atomic64_t *)l;
60190 @@ -140,6 +209,12 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
60191
60192 typedef atomic_t atomic_long_t;
60193
60194 +#ifdef CONFIG_PAX_REFCOUNT
60195 +typedef atomic_unchecked_t atomic_long_unchecked_t;
60196 +#else
60197 +typedef atomic_t atomic_long_unchecked_t;
60198 +#endif
60199 +
60200 #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
60201 static inline long atomic_long_read(atomic_long_t *l)
60202 {
60203 @@ -148,6 +223,15 @@ static inline long atomic_long_read(atomic_long_t *l)
60204 return (long)atomic_read(v);
60205 }
60206
60207 +#ifdef CONFIG_PAX_REFCOUNT
60208 +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
60209 +{
60210 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60211 +
60212 + return (long)atomic_read_unchecked(v);
60213 +}
60214 +#endif
60215 +
60216 static inline void atomic_long_set(atomic_long_t *l, long i)
60217 {
60218 atomic_t *v = (atomic_t *)l;
60219 @@ -155,6 +239,15 @@ static inline void atomic_long_set(atomic_long_t *l, long i)
60220 atomic_set(v, i);
60221 }
60222
60223 +#ifdef CONFIG_PAX_REFCOUNT
60224 +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
60225 +{
60226 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60227 +
60228 + atomic_set_unchecked(v, i);
60229 +}
60230 +#endif
60231 +
60232 static inline void atomic_long_inc(atomic_long_t *l)
60233 {
60234 atomic_t *v = (atomic_t *)l;
60235 @@ -162,6 +255,15 @@ static inline void atomic_long_inc(atomic_long_t *l)
60236 atomic_inc(v);
60237 }
60238
60239 +#ifdef CONFIG_PAX_REFCOUNT
60240 +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
60241 +{
60242 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60243 +
60244 + atomic_inc_unchecked(v);
60245 +}
60246 +#endif
60247 +
60248 static inline void atomic_long_dec(atomic_long_t *l)
60249 {
60250 atomic_t *v = (atomic_t *)l;
60251 @@ -169,6 +271,15 @@ static inline void atomic_long_dec(atomic_long_t *l)
60252 atomic_dec(v);
60253 }
60254
60255 +#ifdef CONFIG_PAX_REFCOUNT
60256 +static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
60257 +{
60258 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60259 +
60260 + atomic_dec_unchecked(v);
60261 +}
60262 +#endif
60263 +
60264 static inline void atomic_long_add(long i, atomic_long_t *l)
60265 {
60266 atomic_t *v = (atomic_t *)l;
60267 @@ -176,6 +287,15 @@ static inline void atomic_long_add(long i, atomic_long_t *l)
60268 atomic_add(i, v);
60269 }
60270
60271 +#ifdef CONFIG_PAX_REFCOUNT
60272 +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
60273 +{
60274 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60275 +
60276 + atomic_add_unchecked(i, v);
60277 +}
60278 +#endif
60279 +
60280 static inline void atomic_long_sub(long i, atomic_long_t *l)
60281 {
60282 atomic_t *v = (atomic_t *)l;
60283 @@ -183,6 +303,15 @@ static inline void atomic_long_sub(long i, atomic_long_t *l)
60284 atomic_sub(i, v);
60285 }
60286
60287 +#ifdef CONFIG_PAX_REFCOUNT
60288 +static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
60289 +{
60290 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60291 +
60292 + atomic_sub_unchecked(i, v);
60293 +}
60294 +#endif
60295 +
60296 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
60297 {
60298 atomic_t *v = (atomic_t *)l;
60299 @@ -232,6 +361,15 @@ static inline long atomic_long_inc_return(atomic_long_t *l)
60300 return (long)atomic_inc_return(v);
60301 }
60302
60303 +#ifdef CONFIG_PAX_REFCOUNT
60304 +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
60305 +{
60306 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
60307 +
60308 + return (long)atomic_inc_return_unchecked(v);
60309 +}
60310 +#endif
60311 +
60312 static inline long atomic_long_dec_return(atomic_long_t *l)
60313 {
60314 atomic_t *v = (atomic_t *)l;
60315 @@ -255,4 +393,55 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
60316
60317 #endif /* BITS_PER_LONG == 64 */
60318
60319 +#ifdef CONFIG_PAX_REFCOUNT
60320 +static inline void pax_refcount_needs_these_functions(void)
60321 +{
60322 + atomic_read_unchecked((atomic_unchecked_t *)NULL);
60323 + atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
60324 + atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
60325 + atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
60326 + atomic_inc_unchecked((atomic_unchecked_t *)NULL);
60327 + (void)atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
60328 + atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
60329 + atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
60330 + atomic_dec_unchecked((atomic_unchecked_t *)NULL);
60331 + atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
60332 + (void)atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
60333 +#ifdef CONFIG_X86
60334 + atomic_clear_mask_unchecked(0, NULL);
60335 + atomic_set_mask_unchecked(0, NULL);
60336 +#endif
60337 +
60338 + atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
60339 + atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
60340 + atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
60341 + atomic_long_sub_unchecked(0, (atomic_long_unchecked_t *)NULL);
60342 + atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
60343 + atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
60344 + atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
60345 +}
60346 +#else
60347 +#define atomic_read_unchecked(v) atomic_read(v)
60348 +#define atomic_set_unchecked(v, i) atomic_set((v), (i))
60349 +#define atomic_add_unchecked(i, v) atomic_add((i), (v))
60350 +#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
60351 +#define atomic_inc_unchecked(v) atomic_inc(v)
60352 +#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
60353 +#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
60354 +#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
60355 +#define atomic_dec_unchecked(v) atomic_dec(v)
60356 +#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
60357 +#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
60358 +#define atomic_clear_mask_unchecked(mask, v) atomic_clear_mask((mask), (v))
60359 +#define atomic_set_mask_unchecked(mask, v) atomic_set_mask((mask), (v))
60360 +
60361 +#define atomic_long_read_unchecked(v) atomic_long_read(v)
60362 +#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
60363 +#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
60364 +#define atomic_long_sub_unchecked(i, v) atomic_long_sub((i), (v))
60365 +#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
60366 +#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
60367 +#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
60368 +#endif
60369 +
60370 #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
60371 diff --git a/include/asm-generic/atomic.h b/include/asm-generic/atomic.h
60372 index 1ced641..c896ee8 100644
60373 --- a/include/asm-generic/atomic.h
60374 +++ b/include/asm-generic/atomic.h
60375 @@ -159,7 +159,7 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
60376 * Atomically clears the bits set in @mask from @v
60377 */
60378 #ifndef atomic_clear_mask
60379 -static inline void atomic_clear_mask(unsigned long mask, atomic_t *v)
60380 +static inline void atomic_clear_mask(unsigned int mask, atomic_t *v)
60381 {
60382 unsigned long flags;
60383
60384 diff --git a/include/asm-generic/atomic64.h b/include/asm-generic/atomic64.h
60385 index b18ce4f..2ee2843 100644
60386 --- a/include/asm-generic/atomic64.h
60387 +++ b/include/asm-generic/atomic64.h
60388 @@ -16,6 +16,8 @@ typedef struct {
60389 long long counter;
60390 } atomic64_t;
60391
60392 +typedef atomic64_t atomic64_unchecked_t;
60393 +
60394 #define ATOMIC64_INIT(i) { (i) }
60395
60396 extern long long atomic64_read(const atomic64_t *v);
60397 @@ -39,4 +41,14 @@ extern int atomic64_add_unless(atomic64_t *v, long long a, long long u);
60398 #define atomic64_dec_and_test(v) (atomic64_dec_return((v)) == 0)
60399 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1LL, 0LL)
60400
60401 +#define atomic64_read_unchecked(v) atomic64_read(v)
60402 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
60403 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
60404 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
60405 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
60406 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
60407 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
60408 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
60409 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
60410 +
60411 #endif /* _ASM_GENERIC_ATOMIC64_H */
60412 diff --git a/include/asm-generic/cache.h b/include/asm-generic/cache.h
60413 index 1bfcfe5..e04c5c9 100644
60414 --- a/include/asm-generic/cache.h
60415 +++ b/include/asm-generic/cache.h
60416 @@ -6,7 +6,7 @@
60417 * cache lines need to provide their own cache.h.
60418 */
60419
60420 -#define L1_CACHE_SHIFT 5
60421 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
60422 +#define L1_CACHE_SHIFT 5UL
60423 +#define L1_CACHE_BYTES (1UL << L1_CACHE_SHIFT)
60424
60425 #endif /* __ASM_GENERIC_CACHE_H */
60426 diff --git a/include/asm-generic/emergency-restart.h b/include/asm-generic/emergency-restart.h
60427 index 0d68a1e..b74a761 100644
60428 --- a/include/asm-generic/emergency-restart.h
60429 +++ b/include/asm-generic/emergency-restart.h
60430 @@ -1,7 +1,7 @@
60431 #ifndef _ASM_GENERIC_EMERGENCY_RESTART_H
60432 #define _ASM_GENERIC_EMERGENCY_RESTART_H
60433
60434 -static inline void machine_emergency_restart(void)
60435 +static inline __noreturn void machine_emergency_restart(void)
60436 {
60437 machine_restart(NULL);
60438 }
60439 diff --git a/include/asm-generic/kmap_types.h b/include/asm-generic/kmap_types.h
60440 index 0232ccb..13d9165 100644
60441 --- a/include/asm-generic/kmap_types.h
60442 +++ b/include/asm-generic/kmap_types.h
60443 @@ -29,10 +29,11 @@ KMAP_D(16) KM_IRQ_PTE,
60444 KMAP_D(17) KM_NMI,
60445 KMAP_D(18) KM_NMI_PTE,
60446 KMAP_D(19) KM_KDB,
60447 +KMAP_D(20) KM_CLEARPAGE,
60448 /*
60449 * Remember to update debug_kmap_atomic() when adding new kmap types!
60450 */
60451 -KMAP_D(20) KM_TYPE_NR
60452 +KMAP_D(21) KM_TYPE_NR
60453 };
60454
60455 #undef KMAP_D
60456 diff --git a/include/asm-generic/local.h b/include/asm-generic/local.h
60457 index 9ceb03b..2efbcbd 100644
60458 --- a/include/asm-generic/local.h
60459 +++ b/include/asm-generic/local.h
60460 @@ -39,6 +39,7 @@ typedef struct
60461 #define local_add_return(i, l) atomic_long_add_return((i), (&(l)->a))
60462 #define local_sub_return(i, l) atomic_long_sub_return((i), (&(l)->a))
60463 #define local_inc_return(l) atomic_long_inc_return(&(l)->a)
60464 +#define local_dec_return(l) atomic_long_dec_return(&(l)->a)
60465
60466 #define local_cmpxchg(l, o, n) atomic_long_cmpxchg((&(l)->a), (o), (n))
60467 #define local_xchg(l, n) atomic_long_xchg((&(l)->a), (n))
60468 diff --git a/include/asm-generic/pgtable-nopmd.h b/include/asm-generic/pgtable-nopmd.h
60469 index 725612b..9cc513a 100644
60470 --- a/include/asm-generic/pgtable-nopmd.h
60471 +++ b/include/asm-generic/pgtable-nopmd.h
60472 @@ -1,14 +1,19 @@
60473 #ifndef _PGTABLE_NOPMD_H
60474 #define _PGTABLE_NOPMD_H
60475
60476 -#ifndef __ASSEMBLY__
60477 -
60478 #include <asm-generic/pgtable-nopud.h>
60479
60480 -struct mm_struct;
60481 -
60482 #define __PAGETABLE_PMD_FOLDED
60483
60484 +#define PMD_SHIFT PUD_SHIFT
60485 +#define PTRS_PER_PMD 1
60486 +#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
60487 +#define PMD_MASK (~(PMD_SIZE-1))
60488 +
60489 +#ifndef __ASSEMBLY__
60490 +
60491 +struct mm_struct;
60492 +
60493 /*
60494 * Having the pmd type consist of a pud gets the size right, and allows
60495 * us to conceptually access the pud entry that this pmd is folded into
60496 @@ -16,11 +21,6 @@ struct mm_struct;
60497 */
60498 typedef struct { pud_t pud; } pmd_t;
60499
60500 -#define PMD_SHIFT PUD_SHIFT
60501 -#define PTRS_PER_PMD 1
60502 -#define PMD_SIZE (1UL << PMD_SHIFT)
60503 -#define PMD_MASK (~(PMD_SIZE-1))
60504 -
60505 /*
60506 * The "pud_xxx()" functions here are trivial for a folded two-level
60507 * setup: the pmd is never bad, and a pmd always exists (as it's folded
60508 diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
60509 index 810431d..0ec4804f 100644
60510 --- a/include/asm-generic/pgtable-nopud.h
60511 +++ b/include/asm-generic/pgtable-nopud.h
60512 @@ -1,10 +1,15 @@
60513 #ifndef _PGTABLE_NOPUD_H
60514 #define _PGTABLE_NOPUD_H
60515
60516 -#ifndef __ASSEMBLY__
60517 -
60518 #define __PAGETABLE_PUD_FOLDED
60519
60520 +#define PUD_SHIFT PGDIR_SHIFT
60521 +#define PTRS_PER_PUD 1
60522 +#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
60523 +#define PUD_MASK (~(PUD_SIZE-1))
60524 +
60525 +#ifndef __ASSEMBLY__
60526 +
60527 /*
60528 * Having the pud type consist of a pgd gets the size right, and allows
60529 * us to conceptually access the pgd entry that this pud is folded into
60530 @@ -12,11 +17,6 @@
60531 */
60532 typedef struct { pgd_t pgd; } pud_t;
60533
60534 -#define PUD_SHIFT PGDIR_SHIFT
60535 -#define PTRS_PER_PUD 1
60536 -#define PUD_SIZE (1UL << PUD_SHIFT)
60537 -#define PUD_MASK (~(PUD_SIZE-1))
60538 -
60539 /*
60540 * The "pgd_xxx()" functions here are trivial for a folded two-level
60541 * setup: the pud is never bad, and a pud always exists (as it's folded
60542 @@ -29,6 +29,7 @@ static inline void pgd_clear(pgd_t *pgd) { }
60543 #define pud_ERROR(pud) (pgd_ERROR((pud).pgd))
60544
60545 #define pgd_populate(mm, pgd, pud) do { } while (0)
60546 +#define pgd_populate_kernel(mm, pgd, pud) do { } while (0)
60547 /*
60548 * (puds are folded into pgds so this doesn't get actually called,
60549 * but the define is needed for a generic inline function.)
60550 diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
60551 index ff4947b..f48183f 100644
60552 --- a/include/asm-generic/pgtable.h
60553 +++ b/include/asm-generic/pgtable.h
60554 @@ -530,6 +530,14 @@ static inline int pmd_trans_unstable(pmd_t *pmd)
60555 #endif
60556 }
60557
60558 +#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
60559 +static inline unsigned long pax_open_kernel(void) { return 0; }
60560 +#endif
60561 +
60562 +#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
60563 +static inline unsigned long pax_close_kernel(void) { return 0; }
60564 +#endif
60565 +
60566 #endif /* CONFIG_MMU */
60567
60568 #endif /* !__ASSEMBLY__ */
60569 diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
60570 index 4e2e1cc..12c266b 100644
60571 --- a/include/asm-generic/vmlinux.lds.h
60572 +++ b/include/asm-generic/vmlinux.lds.h
60573 @@ -218,6 +218,7 @@
60574 .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
60575 VMLINUX_SYMBOL(__start_rodata) = .; \
60576 *(.rodata) *(.rodata.*) \
60577 + *(.data..read_only) \
60578 *(__vermagic) /* Kernel version magic */ \
60579 . = ALIGN(8); \
60580 VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .; \
60581 @@ -716,17 +717,18 @@
60582 * section in the linker script will go there too. @phdr should have
60583 * a leading colon.
60584 *
60585 - * Note that this macros defines __per_cpu_load as an absolute symbol.
60586 + * Note that this macros defines per_cpu_load as an absolute symbol.
60587 * If there is no need to put the percpu section at a predetermined
60588 * address, use PERCPU_SECTION.
60589 */
60590 #define PERCPU_VADDR(cacheline, vaddr, phdr) \
60591 - VMLINUX_SYMBOL(__per_cpu_load) = .; \
60592 - .data..percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
60593 + per_cpu_load = .; \
60594 + .data..percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
60595 - LOAD_OFFSET) { \
60596 + VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
60597 PERCPU_INPUT(cacheline) \
60598 } phdr \
60599 - . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data..percpu);
60600 + . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data..percpu);
60601
60602 /**
60603 * PERCPU_SECTION - define output section for percpu area, simple version
60604 diff --git a/include/drm/drmP.h b/include/drm/drmP.h
60605 index 31ad880..4e79884 100644
60606 --- a/include/drm/drmP.h
60607 +++ b/include/drm/drmP.h
60608 @@ -72,6 +72,7 @@
60609 #include <linux/workqueue.h>
60610 #include <linux/poll.h>
60611 #include <asm/pgalloc.h>
60612 +#include <asm/local.h>
60613 #include "drm.h"
60614
60615 #include <linux/idr.h>
60616 @@ -1074,7 +1075,7 @@ struct drm_device {
60617
60618 /** \name Usage Counters */
60619 /*@{ */
60620 - int open_count; /**< Outstanding files open */
60621 + local_t open_count; /**< Outstanding files open */
60622 atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
60623 atomic_t vma_count; /**< Outstanding vma areas open */
60624 int buf_use; /**< Buffers in use -- cannot alloc */
60625 @@ -1085,7 +1086,7 @@ struct drm_device {
60626 /*@{ */
60627 unsigned long counters;
60628 enum drm_stat_type types[15];
60629 - atomic_t counts[15];
60630 + atomic_unchecked_t counts[15];
60631 /*@} */
60632
60633 struct list_head filelist;
60634 diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
60635 index 7988e55..ec974c9 100644
60636 --- a/include/drm/drm_crtc_helper.h
60637 +++ b/include/drm/drm_crtc_helper.h
60638 @@ -81,7 +81,7 @@ struct drm_crtc_helper_funcs {
60639
60640 /* disable crtc when not in use - more explicit than dpms off */
60641 void (*disable)(struct drm_crtc *crtc);
60642 -};
60643 +} __no_const;
60644
60645 /**
60646 * drm_encoder_helper_funcs - helper operations for encoders
60647 @@ -109,7 +109,7 @@ struct drm_encoder_helper_funcs {
60648 struct drm_connector *connector);
60649 /* disable encoder when not in use - more explicit than dpms off */
60650 void (*disable)(struct drm_encoder *encoder);
60651 -};
60652 +} __no_const;
60653
60654 /**
60655 * drm_connector_helper_funcs - helper operations for connectors
60656 diff --git a/include/drm/ttm/ttm_memory.h b/include/drm/ttm/ttm_memory.h
60657 index d6d1da4..fdd1ac5 100644
60658 --- a/include/drm/ttm/ttm_memory.h
60659 +++ b/include/drm/ttm/ttm_memory.h
60660 @@ -48,7 +48,7 @@
60661
60662 struct ttm_mem_shrink {
60663 int (*do_shrink) (struct ttm_mem_shrink *);
60664 -};
60665 +} __no_const;
60666
60667 /**
60668 * struct ttm_mem_global - Global memory accounting structure.
60669 diff --git a/include/linux/a.out.h b/include/linux/a.out.h
60670 index e86dfca..40cc55f 100644
60671 --- a/include/linux/a.out.h
60672 +++ b/include/linux/a.out.h
60673 @@ -39,6 +39,14 @@ enum machine_type {
60674 M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
60675 };
60676
60677 +/* Constants for the N_FLAGS field */
60678 +#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
60679 +#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
60680 +#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
60681 +#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
60682 +/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
60683 +#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
60684 +
60685 #if !defined (N_MAGIC)
60686 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
60687 #endif
60688 diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
60689 index 06fd4bb..1caec0d 100644
60690 --- a/include/linux/atmdev.h
60691 +++ b/include/linux/atmdev.h
60692 @@ -237,7 +237,7 @@ struct compat_atm_iobuf {
60693 #endif
60694
60695 struct k_atm_aal_stats {
60696 -#define __HANDLE_ITEM(i) atomic_t i
60697 +#define __HANDLE_ITEM(i) atomic_unchecked_t i
60698 __AAL_STAT_ITEMS
60699 #undef __HANDLE_ITEM
60700 };
60701 diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
60702 index 366422b..1fa7f84 100644
60703 --- a/include/linux/binfmts.h
60704 +++ b/include/linux/binfmts.h
60705 @@ -89,6 +89,7 @@ struct linux_binfmt {
60706 int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
60707 int (*load_shlib)(struct file *);
60708 int (*core_dump)(struct coredump_params *cprm);
60709 + void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
60710 unsigned long min_coredump; /* minimal dump size */
60711 };
60712
60713 diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
60714 index 07954b0..cb2ae71 100644
60715 --- a/include/linux/blkdev.h
60716 +++ b/include/linux/blkdev.h
60717 @@ -1393,7 +1393,7 @@ struct block_device_operations {
60718 /* this callback is with swap_lock and sometimes page table lock held */
60719 void (*swap_slot_free_notify) (struct block_device *, unsigned long);
60720 struct module *owner;
60721 -};
60722 +} __do_const;
60723
60724 extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
60725 unsigned long);
60726 diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
60727 index 4d1a074..88f929a 100644
60728 --- a/include/linux/blktrace_api.h
60729 +++ b/include/linux/blktrace_api.h
60730 @@ -162,7 +162,7 @@ struct blk_trace {
60731 struct dentry *dir;
60732 struct dentry *dropped_file;
60733 struct dentry *msg_file;
60734 - atomic_t dropped;
60735 + atomic_unchecked_t dropped;
60736 };
60737
60738 extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
60739 diff --git a/include/linux/byteorder/little_endian.h b/include/linux/byteorder/little_endian.h
60740 index 83195fb..0b0f77d 100644
60741 --- a/include/linux/byteorder/little_endian.h
60742 +++ b/include/linux/byteorder/little_endian.h
60743 @@ -42,51 +42,51 @@
60744
60745 static inline __le64 __cpu_to_le64p(const __u64 *p)
60746 {
60747 - return (__force __le64)*p;
60748 + return (__force const __le64)*p;
60749 }
60750 static inline __u64 __le64_to_cpup(const __le64 *p)
60751 {
60752 - return (__force __u64)*p;
60753 + return (__force const __u64)*p;
60754 }
60755 static inline __le32 __cpu_to_le32p(const __u32 *p)
60756 {
60757 - return (__force __le32)*p;
60758 + return (__force const __le32)*p;
60759 }
60760 static inline __u32 __le32_to_cpup(const __le32 *p)
60761 {
60762 - return (__force __u32)*p;
60763 + return (__force const __u32)*p;
60764 }
60765 static inline __le16 __cpu_to_le16p(const __u16 *p)
60766 {
60767 - return (__force __le16)*p;
60768 + return (__force const __le16)*p;
60769 }
60770 static inline __u16 __le16_to_cpup(const __le16 *p)
60771 {
60772 - return (__force __u16)*p;
60773 + return (__force const __u16)*p;
60774 }
60775 static inline __be64 __cpu_to_be64p(const __u64 *p)
60776 {
60777 - return (__force __be64)__swab64p(p);
60778 + return (__force const __be64)__swab64p(p);
60779 }
60780 static inline __u64 __be64_to_cpup(const __be64 *p)
60781 {
60782 - return __swab64p((__u64 *)p);
60783 + return __swab64p((const __u64 *)p);
60784 }
60785 static inline __be32 __cpu_to_be32p(const __u32 *p)
60786 {
60787 - return (__force __be32)__swab32p(p);
60788 + return (__force const __be32)__swab32p(p);
60789 }
60790 static inline __u32 __be32_to_cpup(const __be32 *p)
60791 {
60792 - return __swab32p((__u32 *)p);
60793 + return __swab32p((const __u32 *)p);
60794 }
60795 static inline __be16 __cpu_to_be16p(const __u16 *p)
60796 {
60797 - return (__force __be16)__swab16p(p);
60798 + return (__force const __be16)__swab16p(p);
60799 }
60800 static inline __u16 __be16_to_cpup(const __be16 *p)
60801 {
60802 - return __swab16p((__u16 *)p);
60803 + return __swab16p((const __u16 *)p);
60804 }
60805 #define __cpu_to_le64s(x) do { (void)(x); } while (0)
60806 #define __le64_to_cpus(x) do { (void)(x); } while (0)
60807 diff --git a/include/linux/cache.h b/include/linux/cache.h
60808 index 4c57065..4307975 100644
60809 --- a/include/linux/cache.h
60810 +++ b/include/linux/cache.h
60811 @@ -16,6 +16,10 @@
60812 #define __read_mostly
60813 #endif
60814
60815 +#ifndef __read_only
60816 +#define __read_only __read_mostly
60817 +#endif
60818 +
60819 #ifndef ____cacheline_aligned
60820 #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
60821 #endif
60822 diff --git a/include/linux/capability.h b/include/linux/capability.h
60823 index d10b7ed..0288b79 100644
60824 --- a/include/linux/capability.h
60825 +++ b/include/linux/capability.h
60826 @@ -553,10 +553,15 @@ extern bool capable(int cap);
60827 extern bool ns_capable(struct user_namespace *ns, int cap);
60828 extern bool nsown_capable(int cap);
60829 extern bool inode_capable(const struct inode *inode, int cap);
60830 +extern bool capable_nolog(int cap);
60831 +extern bool ns_capable_nolog(struct user_namespace *ns, int cap);
60832 +extern bool inode_capable_nolog(const struct inode *inode, int cap);
60833
60834 /* audit system wants to get cap info from files as well */
60835 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
60836
60837 +extern int is_privileged_binary(const struct dentry *dentry);
60838 +
60839 #endif /* __KERNEL__ */
60840
60841 #endif /* !_LINUX_CAPABILITY_H */
60842 diff --git a/include/linux/cleancache.h b/include/linux/cleancache.h
60843 index 42e55de..1cd0e66 100644
60844 --- a/include/linux/cleancache.h
60845 +++ b/include/linux/cleancache.h
60846 @@ -31,7 +31,7 @@ struct cleancache_ops {
60847 void (*invalidate_page)(int, struct cleancache_filekey, pgoff_t);
60848 void (*invalidate_inode)(int, struct cleancache_filekey);
60849 void (*invalidate_fs)(int);
60850 -};
60851 +} __no_const;
60852
60853 extern struct cleancache_ops
60854 cleancache_register_ops(struct cleancache_ops *ops);
60855 diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
60856 index 4a0b483..f1f70ba 100644
60857 --- a/include/linux/clk-provider.h
60858 +++ b/include/linux/clk-provider.h
60859 @@ -110,6 +110,7 @@ struct clk_ops {
60860 unsigned long);
60861 void (*init)(struct clk_hw *hw);
60862 };
60863 +typedef struct clk_ops __no_const clk_ops_no_const;
60864
60865 /**
60866 * struct clk_init_data - holds init data that's common to all clocks and is
60867 diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
60868 index 2f40791..938880e 100644
60869 --- a/include/linux/compiler-gcc4.h
60870 +++ b/include/linux/compiler-gcc4.h
60871 @@ -32,6 +32,21 @@
60872 #define __linktime_error(message) __attribute__((__error__(message)))
60873
60874 #if __GNUC_MINOR__ >= 5
60875 +
60876 +#ifdef CONSTIFY_PLUGIN
60877 +#define __no_const __attribute__((no_const))
60878 +#define __do_const __attribute__((do_const))
60879 +#endif
60880 +
60881 +#ifdef SIZE_OVERFLOW_PLUGIN
60882 +#define __size_overflow(...) __attribute__((size_overflow(__VA_ARGS__)))
60883 +#define __intentional_overflow(...) __attribute__((intentional_overflow(__VA_ARGS__)))
60884 +#endif
60885 +
60886 +#ifdef LATENT_ENTROPY_PLUGIN
60887 +#define __latent_entropy __attribute__((latent_entropy))
60888 +#endif
60889 +
60890 /*
60891 * Mark a position in code as unreachable. This can be used to
60892 * suppress control flow warnings after asm blocks that transfer
60893 @@ -47,6 +62,11 @@
60894 #define __noclone __attribute__((__noclone__))
60895
60896 #endif
60897 +
60898 +#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
60899 +#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
60900 +#define __bos0(ptr) __bos((ptr), 0)
60901 +#define __bos1(ptr) __bos((ptr), 1)
60902 #endif
60903
60904 #if __GNUC_MINOR__ > 0
60905 diff --git a/include/linux/compiler.h b/include/linux/compiler.h
60906 index 923d093..3625de1 100644
60907 --- a/include/linux/compiler.h
60908 +++ b/include/linux/compiler.h
60909 @@ -5,31 +5,62 @@
60910
60911 #ifdef __CHECKER__
60912 # define __user __attribute__((noderef, address_space(1)))
60913 +# define __force_user __force __user
60914 # define __kernel __attribute__((address_space(0)))
60915 +# define __force_kernel __force __kernel
60916 # define __safe __attribute__((safe))
60917 # define __force __attribute__((force))
60918 # define __nocast __attribute__((nocast))
60919 # define __iomem __attribute__((noderef, address_space(2)))
60920 +# define __force_iomem __force __iomem
60921 # define __acquires(x) __attribute__((context(x,0,1)))
60922 # define __releases(x) __attribute__((context(x,1,0)))
60923 # define __acquire(x) __context__(x,1)
60924 # define __release(x) __context__(x,-1)
60925 # define __cond_lock(x,c) ((c) ? ({ __acquire(x); 1; }) : 0)
60926 # define __percpu __attribute__((noderef, address_space(3)))
60927 +# define __force_percpu __force __percpu
60928 #ifdef CONFIG_SPARSE_RCU_POINTER
60929 # define __rcu __attribute__((noderef, address_space(4)))
60930 +# define __force_rcu __force __rcu
60931 #else
60932 # define __rcu
60933 +# define __force_rcu
60934 #endif
60935 extern void __chk_user_ptr(const volatile void __user *);
60936 extern void __chk_io_ptr(const volatile void __iomem *);
60937 +#elif defined(CHECKER_PLUGIN)
60938 +//# define __user
60939 +//# define __force_user
60940 +//# define __kernel
60941 +//# define __force_kernel
60942 +# define __safe
60943 +# define __force
60944 +# define __nocast
60945 +# define __iomem
60946 +# define __force_iomem
60947 +# define __chk_user_ptr(x) (void)0
60948 +# define __chk_io_ptr(x) (void)0
60949 +# define __builtin_warning(x, y...) (1)
60950 +# define __acquires(x)
60951 +# define __releases(x)
60952 +# define __acquire(x) (void)0
60953 +# define __release(x) (void)0
60954 +# define __cond_lock(x,c) (c)
60955 +# define __percpu
60956 +# define __force_percpu
60957 +# define __rcu
60958 +# define __force_rcu
60959 #else
60960 # define __user
60961 +# define __force_user
60962 # define __kernel
60963 +# define __force_kernel
60964 # define __safe
60965 # define __force
60966 # define __nocast
60967 # define __iomem
60968 +# define __force_iomem
60969 # define __chk_user_ptr(x) (void)0
60970 # define __chk_io_ptr(x) (void)0
60971 # define __builtin_warning(x, y...) (1)
60972 @@ -39,7 +70,9 @@ extern void __chk_io_ptr(const volatile void __iomem *);
60973 # define __release(x) (void)0
60974 # define __cond_lock(x,c) (c)
60975 # define __percpu
60976 +# define __force_percpu
60977 # define __rcu
60978 +# define __force_rcu
60979 #endif
60980
60981 #ifdef __KERNEL__
60982 @@ -264,6 +297,26 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
60983 # define __attribute_const__ /* unimplemented */
60984 #endif
60985
60986 +#ifndef __no_const
60987 +# define __no_const
60988 +#endif
60989 +
60990 +#ifndef __do_const
60991 +# define __do_const
60992 +#endif
60993 +
60994 +#ifndef __size_overflow
60995 +# define __size_overflow(...)
60996 +#endif
60997 +
60998 +#ifndef __latent_entropy
60999 +# define __latent_entropy
61000 +#endif
61001 +
61002 +#ifndef __intentional_overflow
61003 +# define __intentional_overflow(...)
61004 +#endif
61005 +
61006 /*
61007 * Tell gcc if a function is cold. The compiler will assume any path
61008 * directly leading to the call is unlikely.
61009 @@ -273,6 +326,22 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
61010 #define __cold
61011 #endif
61012
61013 +#ifndef __alloc_size
61014 +#define __alloc_size(...)
61015 +#endif
61016 +
61017 +#ifndef __bos
61018 +#define __bos(ptr, arg)
61019 +#endif
61020 +
61021 +#ifndef __bos0
61022 +#define __bos0(ptr)
61023 +#endif
61024 +
61025 +#ifndef __bos1
61026 +#define __bos1(ptr)
61027 +#endif
61028 +
61029 /* Simple shorthand for a section definition */
61030 #ifndef __section
61031 # define __section(S) __attribute__ ((__section__(#S)))
61032 @@ -308,6 +377,7 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
61033 * use is to mediate communication between process-level code and irq/NMI
61034 * handlers, all running on the same CPU.
61035 */
61036 -#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
61037 +#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
61038 +#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
61039
61040 #endif /* __LINUX_COMPILER_H */
61041 diff --git a/include/linux/cred.h b/include/linux/cred.h
61042 index ebbed2c..908cc2c 100644
61043 --- a/include/linux/cred.h
61044 +++ b/include/linux/cred.h
61045 @@ -208,6 +208,9 @@ static inline void validate_creds_for_do_exit(struct task_struct *tsk)
61046 static inline void validate_process_creds(void)
61047 {
61048 }
61049 +static inline void validate_task_creds(struct task_struct *task)
61050 +{
61051 +}
61052 #endif
61053
61054 /**
61055 diff --git a/include/linux/crypto.h b/include/linux/crypto.h
61056 index b92eadf..b4ecdc1 100644
61057 --- a/include/linux/crypto.h
61058 +++ b/include/linux/crypto.h
61059 @@ -373,7 +373,7 @@ struct cipher_tfm {
61060 const u8 *key, unsigned int keylen);
61061 void (*cit_encrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
61062 void (*cit_decrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
61063 -};
61064 +} __no_const;
61065
61066 struct hash_tfm {
61067 int (*init)(struct hash_desc *desc);
61068 @@ -394,13 +394,13 @@ struct compress_tfm {
61069 int (*cot_decompress)(struct crypto_tfm *tfm,
61070 const u8 *src, unsigned int slen,
61071 u8 *dst, unsigned int *dlen);
61072 -};
61073 +} __no_const;
61074
61075 struct rng_tfm {
61076 int (*rng_gen_random)(struct crypto_rng *tfm, u8 *rdata,
61077 unsigned int dlen);
61078 int (*rng_reset)(struct crypto_rng *tfm, u8 *seed, unsigned int slen);
61079 -};
61080 +} __no_const;
61081
61082 #define crt_ablkcipher crt_u.ablkcipher
61083 #define crt_aead crt_u.aead
61084 diff --git a/include/linux/decompress/mm.h b/include/linux/decompress/mm.h
61085 index 7925bf0..d5143d2 100644
61086 --- a/include/linux/decompress/mm.h
61087 +++ b/include/linux/decompress/mm.h
61088 @@ -77,7 +77,7 @@ static void free(void *where)
61089 * warnings when not needed (indeed large_malloc / large_free are not
61090 * needed by inflate */
61091
61092 -#define malloc(a) kmalloc(a, GFP_KERNEL)
61093 +#define malloc(a) kmalloc((a), GFP_KERNEL)
61094 #define free(a) kfree(a)
61095
61096 #define large_malloc(a) vmalloc(a)
61097 diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
61098 index dfc099e..e583e66 100644
61099 --- a/include/linux/dma-mapping.h
61100 +++ b/include/linux/dma-mapping.h
61101 @@ -51,7 +51,7 @@ struct dma_map_ops {
61102 u64 (*get_required_mask)(struct device *dev);
61103 #endif
61104 int is_phys;
61105 -};
61106 +} __do_const;
61107
61108 #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
61109
61110 diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
61111 index 56377df..4eb4990 100644
61112 --- a/include/linux/dmaengine.h
61113 +++ b/include/linux/dmaengine.h
61114 @@ -1007,9 +1007,9 @@ struct dma_pinned_list {
61115 struct dma_pinned_list *dma_pin_iovec_pages(struct iovec *iov, size_t len);
61116 void dma_unpin_iovec_pages(struct dma_pinned_list* pinned_list);
61117
61118 -dma_cookie_t dma_memcpy_to_iovec(struct dma_chan *chan, struct iovec *iov,
61119 +dma_cookie_t __intentional_overflow(0) dma_memcpy_to_iovec(struct dma_chan *chan, struct iovec *iov,
61120 struct dma_pinned_list *pinned_list, unsigned char *kdata, size_t len);
61121 -dma_cookie_t dma_memcpy_pg_to_iovec(struct dma_chan *chan, struct iovec *iov,
61122 +dma_cookie_t __intentional_overflow(0) dma_memcpy_pg_to_iovec(struct dma_chan *chan, struct iovec *iov,
61123 struct dma_pinned_list *pinned_list, struct page *page,
61124 unsigned int offset, size_t len);
61125
61126 diff --git a/include/linux/efi.h b/include/linux/efi.h
61127 index ec45ccd..9923c32 100644
61128 --- a/include/linux/efi.h
61129 +++ b/include/linux/efi.h
61130 @@ -635,7 +635,7 @@ struct efivar_operations {
61131 efi_get_variable_t *get_variable;
61132 efi_get_next_variable_t *get_next_variable;
61133 efi_set_variable_t *set_variable;
61134 -};
61135 +} __no_const;
61136
61137 struct efivars {
61138 /*
61139 diff --git a/include/linux/elf.h b/include/linux/elf.h
61140 index 999b4f5..57753b4 100644
61141 --- a/include/linux/elf.h
61142 +++ b/include/linux/elf.h
61143 @@ -40,6 +40,17 @@ typedef __s64 Elf64_Sxword;
61144 #define PT_GNU_EH_FRAME 0x6474e550
61145
61146 #define PT_GNU_STACK (PT_LOOS + 0x474e551)
61147 +#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
61148 +
61149 +#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
61150 +
61151 +/* Constants for the e_flags field */
61152 +#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
61153 +#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
61154 +#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
61155 +#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
61156 +/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
61157 +#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
61158
61159 /*
61160 * Extended Numbering
61161 @@ -97,6 +108,8 @@ typedef __s64 Elf64_Sxword;
61162 #define DT_DEBUG 21
61163 #define DT_TEXTREL 22
61164 #define DT_JMPREL 23
61165 +#define DT_FLAGS 30
61166 + #define DF_TEXTREL 0x00000004
61167 #define DT_ENCODING 32
61168 #define OLD_DT_LOOS 0x60000000
61169 #define DT_LOOS 0x6000000d
61170 @@ -243,6 +256,19 @@ typedef struct elf64_hdr {
61171 #define PF_W 0x2
61172 #define PF_X 0x1
61173
61174 +#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
61175 +#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
61176 +#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
61177 +#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
61178 +#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
61179 +#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
61180 +/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
61181 +/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
61182 +#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
61183 +#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
61184 +#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
61185 +#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
61186 +
61187 typedef struct elf32_phdr{
61188 Elf32_Word p_type;
61189 Elf32_Off p_offset;
61190 @@ -335,6 +361,8 @@ typedef struct elf64_shdr {
61191 #define EI_OSABI 7
61192 #define EI_PAD 8
61193
61194 +#define EI_PAX 14
61195 +
61196 #define ELFMAG0 0x7f /* EI_MAG */
61197 #define ELFMAG1 'E'
61198 #define ELFMAG2 'L'
61199 @@ -421,6 +449,7 @@ extern Elf32_Dyn _DYNAMIC [];
61200 #define elf_note elf32_note
61201 #define elf_addr_t Elf32_Off
61202 #define Elf_Half Elf32_Half
61203 +#define elf_dyn Elf32_Dyn
61204
61205 #else
61206
61207 @@ -431,6 +460,7 @@ extern Elf64_Dyn _DYNAMIC [];
61208 #define elf_note elf64_note
61209 #define elf_addr_t Elf64_Off
61210 #define Elf_Half Elf64_Half
61211 +#define elf_dyn Elf64_Dyn
61212
61213 #endif
61214
61215 diff --git a/include/linux/filter.h b/include/linux/filter.h
61216 index 82b0135..917914d 100644
61217 --- a/include/linux/filter.h
61218 +++ b/include/linux/filter.h
61219 @@ -146,6 +146,7 @@ struct compat_sock_fprog {
61220
61221 struct sk_buff;
61222 struct sock;
61223 +struct bpf_jit_work;
61224
61225 struct sk_filter
61226 {
61227 @@ -153,6 +154,9 @@ struct sk_filter
61228 unsigned int len; /* Number of filter blocks */
61229 unsigned int (*bpf_func)(const struct sk_buff *skb,
61230 const struct sock_filter *filter);
61231 +#ifdef CONFIG_BPF_JIT
61232 + struct bpf_jit_work *work;
61233 +#endif
61234 struct rcu_head rcu;
61235 struct sock_filter insns[0];
61236 };
61237 diff --git a/include/linux/firewire.h b/include/linux/firewire.h
61238 index 7edcf10..714d5e8 100644
61239 --- a/include/linux/firewire.h
61240 +++ b/include/linux/firewire.h
61241 @@ -430,7 +430,7 @@ struct fw_iso_context {
61242 union {
61243 fw_iso_callback_t sc;
61244 fw_iso_mc_callback_t mc;
61245 - } callback;
61246 + } __no_const callback;
61247 void *callback_data;
61248 };
61249
61250 diff --git a/include/linux/frontswap.h b/include/linux/frontswap.h
61251 index 0e4e2ee..4ff4312 100644
61252 --- a/include/linux/frontswap.h
61253 +++ b/include/linux/frontswap.h
61254 @@ -11,7 +11,7 @@ struct frontswap_ops {
61255 int (*load)(unsigned, pgoff_t, struct page *);
61256 void (*invalidate_page)(unsigned, pgoff_t);
61257 void (*invalidate_area)(unsigned);
61258 -};
61259 +} __no_const;
61260
61261 extern bool frontswap_enabled;
61262 extern struct frontswap_ops
61263 diff --git a/include/linux/fs.h b/include/linux/fs.h
61264 index 17fd887..8eebca0 100644
61265 --- a/include/linux/fs.h
61266 +++ b/include/linux/fs.h
61267 @@ -1663,7 +1663,8 @@ struct file_operations {
61268 int (*setlease)(struct file *, long, struct file_lock **);
61269 long (*fallocate)(struct file *file, int mode, loff_t offset,
61270 loff_t len);
61271 -};
61272 +} __do_const;
61273 +typedef struct file_operations __no_const file_operations_no_const;
61274
61275 struct inode_operations {
61276 struct dentry * (*lookup) (struct inode *,struct dentry *, struct nameidata *);
61277 diff --git a/include/linux/fs_struct.h b/include/linux/fs_struct.h
61278 index 003dc0f..3c4ea97 100644
61279 --- a/include/linux/fs_struct.h
61280 +++ b/include/linux/fs_struct.h
61281 @@ -6,7 +6,7 @@
61282 #include <linux/seqlock.h>
61283
61284 struct fs_struct {
61285 - int users;
61286 + atomic_t users;
61287 spinlock_t lock;
61288 seqcount_t seq;
61289 int umask;
61290 diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h
61291 index ce31408..b1ad003 100644
61292 --- a/include/linux/fscache-cache.h
61293 +++ b/include/linux/fscache-cache.h
61294 @@ -102,7 +102,7 @@ struct fscache_operation {
61295 fscache_operation_release_t release;
61296 };
61297
61298 -extern atomic_t fscache_op_debug_id;
61299 +extern atomic_unchecked_t fscache_op_debug_id;
61300 extern void fscache_op_work_func(struct work_struct *work);
61301
61302 extern void fscache_enqueue_operation(struct fscache_operation *);
61303 @@ -122,7 +122,7 @@ static inline void fscache_operation_init(struct fscache_operation *op,
61304 {
61305 INIT_WORK(&op->work, fscache_op_work_func);
61306 atomic_set(&op->usage, 1);
61307 - op->debug_id = atomic_inc_return(&fscache_op_debug_id);
61308 + op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
61309 op->processor = processor;
61310 op->release = release;
61311 INIT_LIST_HEAD(&op->pend_link);
61312 diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
61313 index a6dfe69..569586df 100644
61314 --- a/include/linux/fsnotify.h
61315 +++ b/include/linux/fsnotify.h
61316 @@ -315,7 +315,7 @@ static inline void fsnotify_change(struct dentry *dentry, unsigned int ia_valid)
61317 */
61318 static inline const unsigned char *fsnotify_oldname_init(const unsigned char *name)
61319 {
61320 - return kstrdup(name, GFP_KERNEL);
61321 + return (const unsigned char *)kstrdup((const char *)name, GFP_KERNEL);
61322 }
61323
61324 /*
61325 diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
61326 index 63d966d..cdcb717 100644
61327 --- a/include/linux/fsnotify_backend.h
61328 +++ b/include/linux/fsnotify_backend.h
61329 @@ -105,6 +105,7 @@ struct fsnotify_ops {
61330 void (*freeing_mark)(struct fsnotify_mark *mark, struct fsnotify_group *group);
61331 void (*free_event_priv)(struct fsnotify_event_private_data *priv);
61332 };
61333 +typedef struct fsnotify_ops __no_const fsnotify_ops_no_const;
61334
61335 /*
61336 * A group is a "thing" that wants to receive notification about filesystem
61337 diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
61338 index 176a939..1462211 100644
61339 --- a/include/linux/ftrace_event.h
61340 +++ b/include/linux/ftrace_event.h
61341 @@ -97,7 +97,7 @@ struct trace_event_functions {
61342 trace_print_func raw;
61343 trace_print_func hex;
61344 trace_print_func binary;
61345 -};
61346 +} __no_const;
61347
61348 struct trace_event {
61349 struct hlist_node node;
61350 @@ -263,7 +263,7 @@ extern int trace_define_field(struct ftrace_event_call *call, const char *type,
61351 extern int trace_add_event_call(struct ftrace_event_call *call);
61352 extern void trace_remove_event_call(struct ftrace_event_call *call);
61353
61354 -#define is_signed_type(type) (((type)(-1)) < 0)
61355 +#define is_signed_type(type) (((type)(-1)) < (type)1)
61356
61357 int trace_set_clr_event(const char *system, const char *event, int set);
61358
61359 diff --git a/include/linux/genhd.h b/include/linux/genhd.h
61360 index 017a7fb..33a8507 100644
61361 --- a/include/linux/genhd.h
61362 +++ b/include/linux/genhd.h
61363 @@ -185,7 +185,7 @@ struct gendisk {
61364 struct kobject *slave_dir;
61365
61366 struct timer_rand_state *random;
61367 - atomic_t sync_io; /* RAID */
61368 + atomic_unchecked_t sync_io; /* RAID */
61369 struct disk_events *ev;
61370 #ifdef CONFIG_BLK_DEV_INTEGRITY
61371 struct blk_integrity *integrity;
61372 diff --git a/include/linux/gfp.h b/include/linux/gfp.h
61373 index 1e49be4..b8a9305 100644
61374 --- a/include/linux/gfp.h
61375 +++ b/include/linux/gfp.h
61376 @@ -38,6 +38,12 @@ struct vm_area_struct;
61377 #define ___GFP_OTHER_NODE 0x800000u
61378 #define ___GFP_WRITE 0x1000000u
61379
61380 +#ifdef CONFIG_PAX_USERCOPY_SLABS
61381 +#define ___GFP_USERCOPY 0x2000000u
61382 +#else
61383 +#define ___GFP_USERCOPY 0
61384 +#endif
61385 +
61386 /*
61387 * GFP bitmasks..
61388 *
61389 @@ -87,6 +93,7 @@ struct vm_area_struct;
61390 #define __GFP_NO_KSWAPD ((__force gfp_t)___GFP_NO_KSWAPD)
61391 #define __GFP_OTHER_NODE ((__force gfp_t)___GFP_OTHER_NODE) /* On behalf of other node */
61392 #define __GFP_WRITE ((__force gfp_t)___GFP_WRITE) /* Allocator intends to dirty page */
61393 +#define __GFP_USERCOPY ((__force gfp_t)___GFP_USERCOPY)/* Allocator intends to copy page to/from userland */
61394
61395 /*
61396 * This may seem redundant, but it's a way of annotating false positives vs.
61397 @@ -94,7 +101,7 @@ struct vm_area_struct;
61398 */
61399 #define __GFP_NOTRACK_FALSE_POSITIVE (__GFP_NOTRACK)
61400
61401 -#define __GFP_BITS_SHIFT 25 /* Room for N __GFP_FOO bits */
61402 +#define __GFP_BITS_SHIFT 26 /* Room for N __GFP_FOO bits */
61403 #define __GFP_BITS_MASK ((__force gfp_t)((1 << __GFP_BITS_SHIFT) - 1))
61404
61405 /* This equals 0, but use constants in case they ever change */
61406 @@ -148,6 +155,8 @@ struct vm_area_struct;
61407 /* 4GB DMA on some platforms */
61408 #define GFP_DMA32 __GFP_DMA32
61409
61410 +#define GFP_USERCOPY __GFP_USERCOPY
61411 +
61412 /* Convert GFP flags to their corresponding migrate type */
61413 static inline int allocflags_to_migratetype(gfp_t gfp_flags)
61414 {
61415 diff --git a/include/linux/gracl.h b/include/linux/gracl.h
61416 new file mode 100644
61417 index 0000000..c938b1f
61418 --- /dev/null
61419 +++ b/include/linux/gracl.h
61420 @@ -0,0 +1,319 @@
61421 +#ifndef GR_ACL_H
61422 +#define GR_ACL_H
61423 +
61424 +#include <linux/grdefs.h>
61425 +#include <linux/resource.h>
61426 +#include <linux/capability.h>
61427 +#include <linux/dcache.h>
61428 +#include <asm/resource.h>
61429 +
61430 +/* Major status information */
61431 +
61432 +#define GR_VERSION "grsecurity 2.9.1"
61433 +#define GRSECURITY_VERSION 0x2901
61434 +
61435 +enum {
61436 + GR_SHUTDOWN = 0,
61437 + GR_ENABLE = 1,
61438 + GR_SPROLE = 2,
61439 + GR_RELOAD = 3,
61440 + GR_SEGVMOD = 4,
61441 + GR_STATUS = 5,
61442 + GR_UNSPROLE = 6,
61443 + GR_PASSSET = 7,
61444 + GR_SPROLEPAM = 8,
61445 +};
61446 +
61447 +/* Password setup definitions
61448 + * kernel/grhash.c */
61449 +enum {
61450 + GR_PW_LEN = 128,
61451 + GR_SALT_LEN = 16,
61452 + GR_SHA_LEN = 32,
61453 +};
61454 +
61455 +enum {
61456 + GR_SPROLE_LEN = 64,
61457 +};
61458 +
61459 +enum {
61460 + GR_NO_GLOB = 0,
61461 + GR_REG_GLOB,
61462 + GR_CREATE_GLOB
61463 +};
61464 +
61465 +#define GR_NLIMITS 32
61466 +
61467 +/* Begin Data Structures */
61468 +
61469 +struct sprole_pw {
61470 + unsigned char *rolename;
61471 + unsigned char salt[GR_SALT_LEN];
61472 + unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
61473 +};
61474 +
61475 +struct name_entry {
61476 + __u32 key;
61477 + ino_t inode;
61478 + dev_t device;
61479 + char *name;
61480 + __u16 len;
61481 + __u8 deleted;
61482 + struct name_entry *prev;
61483 + struct name_entry *next;
61484 +};
61485 +
61486 +struct inodev_entry {
61487 + struct name_entry *nentry;
61488 + struct inodev_entry *prev;
61489 + struct inodev_entry *next;
61490 +};
61491 +
61492 +struct acl_role_db {
61493 + struct acl_role_label **r_hash;
61494 + __u32 r_size;
61495 +};
61496 +
61497 +struct inodev_db {
61498 + struct inodev_entry **i_hash;
61499 + __u32 i_size;
61500 +};
61501 +
61502 +struct name_db {
61503 + struct name_entry **n_hash;
61504 + __u32 n_size;
61505 +};
61506 +
61507 +struct crash_uid {
61508 + uid_t uid;
61509 + unsigned long expires;
61510 +};
61511 +
61512 +struct gr_hash_struct {
61513 + void **table;
61514 + void **nametable;
61515 + void *first;
61516 + __u32 table_size;
61517 + __u32 used_size;
61518 + int type;
61519 +};
61520 +
61521 +/* Userspace Grsecurity ACL data structures */
61522 +
61523 +struct acl_subject_label {
61524 + char *filename;
61525 + ino_t inode;
61526 + dev_t device;
61527 + __u32 mode;
61528 + kernel_cap_t cap_mask;
61529 + kernel_cap_t cap_lower;
61530 + kernel_cap_t cap_invert_audit;
61531 +
61532 + struct rlimit res[GR_NLIMITS];
61533 + __u32 resmask;
61534 +
61535 + __u8 user_trans_type;
61536 + __u8 group_trans_type;
61537 + uid_t *user_transitions;
61538 + gid_t *group_transitions;
61539 + __u16 user_trans_num;
61540 + __u16 group_trans_num;
61541 +
61542 + __u32 sock_families[2];
61543 + __u32 ip_proto[8];
61544 + __u32 ip_type;
61545 + struct acl_ip_label **ips;
61546 + __u32 ip_num;
61547 + __u32 inaddr_any_override;
61548 +
61549 + __u32 crashes;
61550 + unsigned long expires;
61551 +
61552 + struct acl_subject_label *parent_subject;
61553 + struct gr_hash_struct *hash;
61554 + struct acl_subject_label *prev;
61555 + struct acl_subject_label *next;
61556 +
61557 + struct acl_object_label **obj_hash;
61558 + __u32 obj_hash_size;
61559 + __u16 pax_flags;
61560 +};
61561 +
61562 +struct role_allowed_ip {
61563 + __u32 addr;
61564 + __u32 netmask;
61565 +
61566 + struct role_allowed_ip *prev;
61567 + struct role_allowed_ip *next;
61568 +};
61569 +
61570 +struct role_transition {
61571 + char *rolename;
61572 +
61573 + struct role_transition *prev;
61574 + struct role_transition *next;
61575 +};
61576 +
61577 +struct acl_role_label {
61578 + char *rolename;
61579 + uid_t uidgid;
61580 + __u16 roletype;
61581 +
61582 + __u16 auth_attempts;
61583 + unsigned long expires;
61584 +
61585 + struct acl_subject_label *root_label;
61586 + struct gr_hash_struct *hash;
61587 +
61588 + struct acl_role_label *prev;
61589 + struct acl_role_label *next;
61590 +
61591 + struct role_transition *transitions;
61592 + struct role_allowed_ip *allowed_ips;
61593 + uid_t *domain_children;
61594 + __u16 domain_child_num;
61595 +
61596 + umode_t umask;
61597 +
61598 + struct acl_subject_label **subj_hash;
61599 + __u32 subj_hash_size;
61600 +};
61601 +
61602 +struct user_acl_role_db {
61603 + struct acl_role_label **r_table;
61604 + __u32 num_pointers; /* Number of allocations to track */
61605 + __u32 num_roles; /* Number of roles */
61606 + __u32 num_domain_children; /* Number of domain children */
61607 + __u32 num_subjects; /* Number of subjects */
61608 + __u32 num_objects; /* Number of objects */
61609 +};
61610 +
61611 +struct acl_object_label {
61612 + char *filename;
61613 + ino_t inode;
61614 + dev_t device;
61615 + __u32 mode;
61616 +
61617 + struct acl_subject_label *nested;
61618 + struct acl_object_label *globbed;
61619 +
61620 + /* next two structures not used */
61621 +
61622 + struct acl_object_label *prev;
61623 + struct acl_object_label *next;
61624 +};
61625 +
61626 +struct acl_ip_label {
61627 + char *iface;
61628 + __u32 addr;
61629 + __u32 netmask;
61630 + __u16 low, high;
61631 + __u8 mode;
61632 + __u32 type;
61633 + __u32 proto[8];
61634 +
61635 + /* next two structures not used */
61636 +
61637 + struct acl_ip_label *prev;
61638 + struct acl_ip_label *next;
61639 +};
61640 +
61641 +struct gr_arg {
61642 + struct user_acl_role_db role_db;
61643 + unsigned char pw[GR_PW_LEN];
61644 + unsigned char salt[GR_SALT_LEN];
61645 + unsigned char sum[GR_SHA_LEN];
61646 + unsigned char sp_role[GR_SPROLE_LEN];
61647 + struct sprole_pw *sprole_pws;
61648 + dev_t segv_device;
61649 + ino_t segv_inode;
61650 + uid_t segv_uid;
61651 + __u16 num_sprole_pws;
61652 + __u16 mode;
61653 +};
61654 +
61655 +struct gr_arg_wrapper {
61656 + struct gr_arg *arg;
61657 + __u32 version;
61658 + __u32 size;
61659 +};
61660 +
61661 +struct subject_map {
61662 + struct acl_subject_label *user;
61663 + struct acl_subject_label *kernel;
61664 + struct subject_map *prev;
61665 + struct subject_map *next;
61666 +};
61667 +
61668 +struct acl_subj_map_db {
61669 + struct subject_map **s_hash;
61670 + __u32 s_size;
61671 +};
61672 +
61673 +/* End Data Structures Section */
61674 +
61675 +/* Hash functions generated by empirical testing by Brad Spengler
61676 + Makes good use of the low bits of the inode. Generally 0-1 times
61677 + in loop for successful match. 0-3 for unsuccessful match.
61678 + Shift/add algorithm with modulus of table size and an XOR*/
61679 +
61680 +static __inline__ unsigned int
61681 +rhash(const uid_t uid, const __u16 type, const unsigned int sz)
61682 +{
61683 + return ((((uid + type) << (16 + type)) ^ uid) % sz);
61684 +}
61685 +
61686 + static __inline__ unsigned int
61687 +shash(const struct acl_subject_label *userp, const unsigned int sz)
61688 +{
61689 + return ((const unsigned long)userp % sz);
61690 +}
61691 +
61692 +static __inline__ unsigned int
61693 +fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
61694 +{
61695 + return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
61696 +}
61697 +
61698 +static __inline__ unsigned int
61699 +nhash(const char *name, const __u16 len, const unsigned int sz)
61700 +{
61701 + return full_name_hash((const unsigned char *)name, len) % sz;
61702 +}
61703 +
61704 +#define FOR_EACH_ROLE_START(role) \
61705 + role = role_list; \
61706 + while (role) {
61707 +
61708 +#define FOR_EACH_ROLE_END(role) \
61709 + role = role->prev; \
61710 + }
61711 +
61712 +#define FOR_EACH_SUBJECT_START(role,subj,iter) \
61713 + subj = NULL; \
61714 + iter = 0; \
61715 + while (iter < role->subj_hash_size) { \
61716 + if (subj == NULL) \
61717 + subj = role->subj_hash[iter]; \
61718 + if (subj == NULL) { \
61719 + iter++; \
61720 + continue; \
61721 + }
61722 +
61723 +#define FOR_EACH_SUBJECT_END(subj,iter) \
61724 + subj = subj->next; \
61725 + if (subj == NULL) \
61726 + iter++; \
61727 + }
61728 +
61729 +
61730 +#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
61731 + subj = role->hash->first; \
61732 + while (subj != NULL) {
61733 +
61734 +#define FOR_EACH_NESTED_SUBJECT_END(subj) \
61735 + subj = subj->next; \
61736 + }
61737 +
61738 +#endif
61739 +
61740 diff --git a/include/linux/gralloc.h b/include/linux/gralloc.h
61741 new file mode 100644
61742 index 0000000..323ecf2
61743 --- /dev/null
61744 +++ b/include/linux/gralloc.h
61745 @@ -0,0 +1,9 @@
61746 +#ifndef __GRALLOC_H
61747 +#define __GRALLOC_H
61748 +
61749 +void acl_free_all(void);
61750 +int acl_alloc_stack_init(unsigned long size);
61751 +void *acl_alloc(unsigned long len);
61752 +void *acl_alloc_num(unsigned long num, unsigned long len);
61753 +
61754 +#endif
61755 diff --git a/include/linux/grdefs.h b/include/linux/grdefs.h
61756 new file mode 100644
61757 index 0000000..b30e9bc
61758 --- /dev/null
61759 +++ b/include/linux/grdefs.h
61760 @@ -0,0 +1,140 @@
61761 +#ifndef GRDEFS_H
61762 +#define GRDEFS_H
61763 +
61764 +/* Begin grsecurity status declarations */
61765 +
61766 +enum {
61767 + GR_READY = 0x01,
61768 + GR_STATUS_INIT = 0x00 // disabled state
61769 +};
61770 +
61771 +/* Begin ACL declarations */
61772 +
61773 +/* Role flags */
61774 +
61775 +enum {
61776 + GR_ROLE_USER = 0x0001,
61777 + GR_ROLE_GROUP = 0x0002,
61778 + GR_ROLE_DEFAULT = 0x0004,
61779 + GR_ROLE_SPECIAL = 0x0008,
61780 + GR_ROLE_AUTH = 0x0010,
61781 + GR_ROLE_NOPW = 0x0020,
61782 + GR_ROLE_GOD = 0x0040,
61783 + GR_ROLE_LEARN = 0x0080,
61784 + GR_ROLE_TPE = 0x0100,
61785 + GR_ROLE_DOMAIN = 0x0200,
61786 + GR_ROLE_PAM = 0x0400,
61787 + GR_ROLE_PERSIST = 0x0800
61788 +};
61789 +
61790 +/* ACL Subject and Object mode flags */
61791 +enum {
61792 + GR_DELETED = 0x80000000
61793 +};
61794 +
61795 +/* ACL Object-only mode flags */
61796 +enum {
61797 + GR_READ = 0x00000001,
61798 + GR_APPEND = 0x00000002,
61799 + GR_WRITE = 0x00000004,
61800 + GR_EXEC = 0x00000008,
61801 + GR_FIND = 0x00000010,
61802 + GR_INHERIT = 0x00000020,
61803 + GR_SETID = 0x00000040,
61804 + GR_CREATE = 0x00000080,
61805 + GR_DELETE = 0x00000100,
61806 + GR_LINK = 0x00000200,
61807 + GR_AUDIT_READ = 0x00000400,
61808 + GR_AUDIT_APPEND = 0x00000800,
61809 + GR_AUDIT_WRITE = 0x00001000,
61810 + GR_AUDIT_EXEC = 0x00002000,
61811 + GR_AUDIT_FIND = 0x00004000,
61812 + GR_AUDIT_INHERIT= 0x00008000,
61813 + GR_AUDIT_SETID = 0x00010000,
61814 + GR_AUDIT_CREATE = 0x00020000,
61815 + GR_AUDIT_DELETE = 0x00040000,
61816 + GR_AUDIT_LINK = 0x00080000,
61817 + GR_PTRACERD = 0x00100000,
61818 + GR_NOPTRACE = 0x00200000,
61819 + GR_SUPPRESS = 0x00400000,
61820 + GR_NOLEARN = 0x00800000,
61821 + GR_INIT_TRANSFER= 0x01000000
61822 +};
61823 +
61824 +#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
61825 + GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
61826 + GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
61827 +
61828 +/* ACL subject-only mode flags */
61829 +enum {
61830 + GR_KILL = 0x00000001,
61831 + GR_VIEW = 0x00000002,
61832 + GR_PROTECTED = 0x00000004,
61833 + GR_LEARN = 0x00000008,
61834 + GR_OVERRIDE = 0x00000010,
61835 + /* just a placeholder, this mode is only used in userspace */
61836 + GR_DUMMY = 0x00000020,
61837 + GR_PROTSHM = 0x00000040,
61838 + GR_KILLPROC = 0x00000080,
61839 + GR_KILLIPPROC = 0x00000100,
61840 + /* just a placeholder, this mode is only used in userspace */
61841 + GR_NOTROJAN = 0x00000200,
61842 + GR_PROTPROCFD = 0x00000400,
61843 + GR_PROCACCT = 0x00000800,
61844 + GR_RELAXPTRACE = 0x00001000,
61845 + GR_NESTED = 0x00002000,
61846 + GR_INHERITLEARN = 0x00004000,
61847 + GR_PROCFIND = 0x00008000,
61848 + GR_POVERRIDE = 0x00010000,
61849 + GR_KERNELAUTH = 0x00020000,
61850 + GR_ATSECURE = 0x00040000,
61851 + GR_SHMEXEC = 0x00080000
61852 +};
61853 +
61854 +enum {
61855 + GR_PAX_ENABLE_SEGMEXEC = 0x0001,
61856 + GR_PAX_ENABLE_PAGEEXEC = 0x0002,
61857 + GR_PAX_ENABLE_MPROTECT = 0x0004,
61858 + GR_PAX_ENABLE_RANDMMAP = 0x0008,
61859 + GR_PAX_ENABLE_EMUTRAMP = 0x0010,
61860 + GR_PAX_DISABLE_SEGMEXEC = 0x0100,
61861 + GR_PAX_DISABLE_PAGEEXEC = 0x0200,
61862 + GR_PAX_DISABLE_MPROTECT = 0x0400,
61863 + GR_PAX_DISABLE_RANDMMAP = 0x0800,
61864 + GR_PAX_DISABLE_EMUTRAMP = 0x1000,
61865 +};
61866 +
61867 +enum {
61868 + GR_ID_USER = 0x01,
61869 + GR_ID_GROUP = 0x02,
61870 +};
61871 +
61872 +enum {
61873 + GR_ID_ALLOW = 0x01,
61874 + GR_ID_DENY = 0x02,
61875 +};
61876 +
61877 +#define GR_CRASH_RES 31
61878 +#define GR_UIDTABLE_MAX 500
61879 +
61880 +/* begin resource learning section */
61881 +enum {
61882 + GR_RLIM_CPU_BUMP = 60,
61883 + GR_RLIM_FSIZE_BUMP = 50000,
61884 + GR_RLIM_DATA_BUMP = 10000,
61885 + GR_RLIM_STACK_BUMP = 1000,
61886 + GR_RLIM_CORE_BUMP = 10000,
61887 + GR_RLIM_RSS_BUMP = 500000,
61888 + GR_RLIM_NPROC_BUMP = 1,
61889 + GR_RLIM_NOFILE_BUMP = 5,
61890 + GR_RLIM_MEMLOCK_BUMP = 50000,
61891 + GR_RLIM_AS_BUMP = 500000,
61892 + GR_RLIM_LOCKS_BUMP = 2,
61893 + GR_RLIM_SIGPENDING_BUMP = 5,
61894 + GR_RLIM_MSGQUEUE_BUMP = 10000,
61895 + GR_RLIM_NICE_BUMP = 1,
61896 + GR_RLIM_RTPRIO_BUMP = 1,
61897 + GR_RLIM_RTTIME_BUMP = 1000000
61898 +};
61899 +
61900 +#endif
61901 diff --git a/include/linux/grinternal.h b/include/linux/grinternal.h
61902 new file mode 100644
61903 index 0000000..c9292f7
61904 --- /dev/null
61905 +++ b/include/linux/grinternal.h
61906 @@ -0,0 +1,223 @@
61907 +#ifndef __GRINTERNAL_H
61908 +#define __GRINTERNAL_H
61909 +
61910 +#ifdef CONFIG_GRKERNSEC
61911 +
61912 +#include <linux/fs.h>
61913 +#include <linux/mnt_namespace.h>
61914 +#include <linux/nsproxy.h>
61915 +#include <linux/gracl.h>
61916 +#include <linux/grdefs.h>
61917 +#include <linux/grmsg.h>
61918 +
61919 +void gr_add_learn_entry(const char *fmt, ...)
61920 + __attribute__ ((format (printf, 1, 2)));
61921 +__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
61922 + const struct vfsmount *mnt);
61923 +__u32 gr_check_create(const struct dentry *new_dentry,
61924 + const struct dentry *parent,
61925 + const struct vfsmount *mnt, const __u32 mode);
61926 +int gr_check_protected_task(const struct task_struct *task);
61927 +__u32 to_gr_audit(const __u32 reqmode);
61928 +int gr_set_acls(const int type);
61929 +int gr_apply_subject_to_task(struct task_struct *task);
61930 +int gr_acl_is_enabled(void);
61931 +char gr_roletype_to_char(void);
61932 +
61933 +void gr_handle_alertkill(struct task_struct *task);
61934 +char *gr_to_filename(const struct dentry *dentry,
61935 + const struct vfsmount *mnt);
61936 +char *gr_to_filename1(const struct dentry *dentry,
61937 + const struct vfsmount *mnt);
61938 +char *gr_to_filename2(const struct dentry *dentry,
61939 + const struct vfsmount *mnt);
61940 +char *gr_to_filename3(const struct dentry *dentry,
61941 + const struct vfsmount *mnt);
61942 +
61943 +extern int grsec_enable_ptrace_readexec;
61944 +extern int grsec_enable_harden_ptrace;
61945 +extern int grsec_enable_link;
61946 +extern int grsec_enable_fifo;
61947 +extern int grsec_enable_execve;
61948 +extern int grsec_enable_shm;
61949 +extern int grsec_enable_execlog;
61950 +extern int grsec_enable_signal;
61951 +extern int grsec_enable_audit_ptrace;
61952 +extern int grsec_enable_forkfail;
61953 +extern int grsec_enable_time;
61954 +extern int grsec_enable_rofs;
61955 +extern int grsec_enable_chroot_shmat;
61956 +extern int grsec_enable_chroot_mount;
61957 +extern int grsec_enable_chroot_double;
61958 +extern int grsec_enable_chroot_pivot;
61959 +extern int grsec_enable_chroot_chdir;
61960 +extern int grsec_enable_chroot_chmod;
61961 +extern int grsec_enable_chroot_mknod;
61962 +extern int grsec_enable_chroot_fchdir;
61963 +extern int grsec_enable_chroot_nice;
61964 +extern int grsec_enable_chroot_execlog;
61965 +extern int grsec_enable_chroot_caps;
61966 +extern int grsec_enable_chroot_sysctl;
61967 +extern int grsec_enable_chroot_unix;
61968 +extern int grsec_enable_symlinkown;
61969 +extern int grsec_symlinkown_gid;
61970 +extern int grsec_enable_tpe;
61971 +extern int grsec_tpe_gid;
61972 +extern int grsec_enable_tpe_all;
61973 +extern int grsec_enable_tpe_invert;
61974 +extern int grsec_enable_socket_all;
61975 +extern int grsec_socket_all_gid;
61976 +extern int grsec_enable_socket_client;
61977 +extern int grsec_socket_client_gid;
61978 +extern int grsec_enable_socket_server;
61979 +extern int grsec_socket_server_gid;
61980 +extern int grsec_audit_gid;
61981 +extern int grsec_enable_group;
61982 +extern int grsec_enable_audit_textrel;
61983 +extern int grsec_enable_log_rwxmaps;
61984 +extern int grsec_enable_mount;
61985 +extern int grsec_enable_chdir;
61986 +extern int grsec_resource_logging;
61987 +extern int grsec_enable_blackhole;
61988 +extern int grsec_lastack_retries;
61989 +extern int grsec_enable_brute;
61990 +extern int grsec_lock;
61991 +
61992 +extern spinlock_t grsec_alert_lock;
61993 +extern unsigned long grsec_alert_wtime;
61994 +extern unsigned long grsec_alert_fyet;
61995 +
61996 +extern spinlock_t grsec_audit_lock;
61997 +
61998 +extern rwlock_t grsec_exec_file_lock;
61999 +
62000 +#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
62001 + gr_to_filename2((tsk)->exec_file->f_path.dentry, \
62002 + (tsk)->exec_file->f_vfsmnt) : "/")
62003 +
62004 +#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
62005 + gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
62006 + (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
62007 +
62008 +#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
62009 + gr_to_filename((tsk)->exec_file->f_path.dentry, \
62010 + (tsk)->exec_file->f_vfsmnt) : "/")
62011 +
62012 +#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
62013 + gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
62014 + (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
62015 +
62016 +#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
62017 +
62018 +#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
62019 +
62020 +#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
62021 + (task)->pid, (cred)->uid, \
62022 + (cred)->euid, (cred)->gid, (cred)->egid, \
62023 + gr_parent_task_fullpath(task), \
62024 + (task)->real_parent->comm, (task)->real_parent->pid, \
62025 + (pcred)->uid, (pcred)->euid, \
62026 + (pcred)->gid, (pcred)->egid
62027 +
62028 +#define GR_CHROOT_CAPS {{ \
62029 + CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
62030 + CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
62031 + CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
62032 + CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
62033 + CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
62034 + CAP_TO_MASK(CAP_IPC_OWNER) | CAP_TO_MASK(CAP_SETFCAP), \
62035 + CAP_TO_MASK(CAP_SYSLOG) | CAP_TO_MASK(CAP_MAC_ADMIN) }}
62036 +
62037 +#define security_learn(normal_msg,args...) \
62038 +({ \
62039 + read_lock(&grsec_exec_file_lock); \
62040 + gr_add_learn_entry(normal_msg "\n", ## args); \
62041 + read_unlock(&grsec_exec_file_lock); \
62042 +})
62043 +
62044 +enum {
62045 + GR_DO_AUDIT,
62046 + GR_DONT_AUDIT,
62047 + /* used for non-audit messages that we shouldn't kill the task on */
62048 + GR_DONT_AUDIT_GOOD
62049 +};
62050 +
62051 +enum {
62052 + GR_TTYSNIFF,
62053 + GR_RBAC,
62054 + GR_RBAC_STR,
62055 + GR_STR_RBAC,
62056 + GR_RBAC_MODE2,
62057 + GR_RBAC_MODE3,
62058 + GR_FILENAME,
62059 + GR_SYSCTL_HIDDEN,
62060 + GR_NOARGS,
62061 + GR_ONE_INT,
62062 + GR_ONE_INT_TWO_STR,
62063 + GR_ONE_STR,
62064 + GR_STR_INT,
62065 + GR_TWO_STR_INT,
62066 + GR_TWO_INT,
62067 + GR_TWO_U64,
62068 + GR_THREE_INT,
62069 + GR_FIVE_INT_TWO_STR,
62070 + GR_TWO_STR,
62071 + GR_THREE_STR,
62072 + GR_FOUR_STR,
62073 + GR_STR_FILENAME,
62074 + GR_FILENAME_STR,
62075 + GR_FILENAME_TWO_INT,
62076 + GR_FILENAME_TWO_INT_STR,
62077 + GR_TEXTREL,
62078 + GR_PTRACE,
62079 + GR_RESOURCE,
62080 + GR_CAP,
62081 + GR_SIG,
62082 + GR_SIG2,
62083 + GR_CRASH1,
62084 + GR_CRASH2,
62085 + GR_PSACCT,
62086 + GR_RWXMAP
62087 +};
62088 +
62089 +#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
62090 +#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
62091 +#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
62092 +#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
62093 +#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
62094 +#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
62095 +#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
62096 +#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
62097 +#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
62098 +#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
62099 +#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
62100 +#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
62101 +#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
62102 +#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
62103 +#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
62104 +#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
62105 +#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
62106 +#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
62107 +#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
62108 +#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
62109 +#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
62110 +#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
62111 +#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
62112 +#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
62113 +#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
62114 +#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
62115 +#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
62116 +#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
62117 +#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
62118 +#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
62119 +#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
62120 +#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
62121 +#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
62122 +#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
62123 +#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
62124 +
62125 +void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
62126 +
62127 +#endif
62128 +
62129 +#endif
62130 diff --git a/include/linux/grmsg.h b/include/linux/grmsg.h
62131 new file mode 100644
62132 index 0000000..54f4e85
62133 --- /dev/null
62134 +++ b/include/linux/grmsg.h
62135 @@ -0,0 +1,110 @@
62136 +#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
62137 +#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
62138 +#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
62139 +#define GR_STOPMOD_MSG "denied modification of module state by "
62140 +#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
62141 +#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
62142 +#define GR_IOPERM_MSG "denied use of ioperm() by "
62143 +#define GR_IOPL_MSG "denied use of iopl() by "
62144 +#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
62145 +#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
62146 +#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
62147 +#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
62148 +#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
62149 +#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
62150 +#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
62151 +#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
62152 +#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
62153 +#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
62154 +#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
62155 +#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
62156 +#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
62157 +#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
62158 +#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
62159 +#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
62160 +#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
62161 +#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
62162 +#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
62163 +#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
62164 +#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
62165 +#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
62166 +#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
62167 +#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
62168 +#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
62169 +#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
62170 +#define GR_EXEC_TPE_MSG "denied untrusted exec (due to %.70s) of %.950s by "
62171 +#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
62172 +#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
62173 +#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
62174 +#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
62175 +#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
62176 +#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
62177 +#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
62178 +#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
62179 +#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
62180 +#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
62181 +#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
62182 +#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
62183 +#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
62184 +#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
62185 +#define GR_INITF_ACL_MSG "init_variables() failed %s by "
62186 +#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
62187 +#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbage by "
62188 +#define GR_SHUTS_ACL_MSG "shutdown auth success for "
62189 +#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
62190 +#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
62191 +#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
62192 +#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
62193 +#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
62194 +#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
62195 +#define GR_ENABLEF_ACL_MSG "unable to load %s for "
62196 +#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
62197 +#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
62198 +#define GR_RELOADF_ACL_MSG "failed reload of %s for "
62199 +#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
62200 +#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
62201 +#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
62202 +#define GR_SPROLEF_ACL_MSG "special role %s failure for "
62203 +#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
62204 +#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
62205 +#define GR_INVMODE_ACL_MSG "invalid mode %d by "
62206 +#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
62207 +#define GR_FAILFORK_MSG "failed fork with errno %s by "
62208 +#define GR_NICE_CHROOT_MSG "denied priority change by "
62209 +#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
62210 +#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
62211 +#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
62212 +#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
62213 +#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
62214 +#define GR_TIME_MSG "time set by "
62215 +#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
62216 +#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
62217 +#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
62218 +#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
62219 +#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
62220 +#define GR_BIND_MSG "denied bind() by "
62221 +#define GR_CONNECT_MSG "denied connect() by "
62222 +#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
62223 +#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
62224 +#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
62225 +#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
62226 +#define GR_CAP_ACL_MSG "use of %s denied for "
62227 +#define GR_CAP_CHROOT_MSG "use of %s in chroot denied for "
62228 +#define GR_CAP_ACL_MSG2 "use of %s permitted for "
62229 +#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
62230 +#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
62231 +#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
62232 +#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
62233 +#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
62234 +#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
62235 +#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
62236 +#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
62237 +#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
62238 +#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
62239 +#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
62240 +#define GR_VM86_MSG "denied use of vm86 by "
62241 +#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
62242 +#define GR_PTRACE_READEXEC_MSG "denied ptrace of unreadable binary %.950s by "
62243 +#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
62244 +#define GR_BADPROCPID_MSG "denied read of sensitive /proc/pid/%s entry via fd passed across exec by "
62245 +#define GR_SYMLINKOWNER_MSG "denied following symlink %.950s since symlink owner %u does not match target owner %u, by "
62246 diff --git a/include/linux/grsecurity.h b/include/linux/grsecurity.h
62247 new file mode 100644
62248 index 0000000..38bfb04
62249 --- /dev/null
62250 +++ b/include/linux/grsecurity.h
62251 @@ -0,0 +1,233 @@
62252 +#ifndef GR_SECURITY_H
62253 +#define GR_SECURITY_H
62254 +#include <linux/fs.h>
62255 +#include <linux/fs_struct.h>
62256 +#include <linux/binfmts.h>
62257 +#include <linux/gracl.h>
62258 +
62259 +/* notify of brain-dead configs */
62260 +#if defined(CONFIG_GRKERNSEC_PROC_USER) && defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
62261 +#error "CONFIG_GRKERNSEC_PROC_USER and CONFIG_GRKERNSEC_PROC_USERGROUP cannot both be enabled."
62262 +#endif
62263 +#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
62264 +#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
62265 +#endif
62266 +#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
62267 +#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
62268 +#endif
62269 +#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
62270 +#error "CONFIG_PAX enabled, but no PaX options are enabled."
62271 +#endif
62272 +
62273 +#include <linux/compat.h>
62274 +
62275 +struct user_arg_ptr {
62276 +#ifdef CONFIG_COMPAT
62277 + bool is_compat;
62278 +#endif
62279 + union {
62280 + const char __user *const __user *native;
62281 +#ifdef CONFIG_COMPAT
62282 + compat_uptr_t __user *compat;
62283 +#endif
62284 + } ptr;
62285 +};
62286 +
62287 +void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
62288 +void gr_handle_brute_check(void);
62289 +void gr_handle_kernel_exploit(void);
62290 +int gr_process_user_ban(void);
62291 +
62292 +char gr_roletype_to_char(void);
62293 +
62294 +int gr_acl_enable_at_secure(void);
62295 +
62296 +int gr_check_user_change(int real, int effective, int fs);
62297 +int gr_check_group_change(int real, int effective, int fs);
62298 +
62299 +void gr_del_task_from_ip_table(struct task_struct *p);
62300 +
62301 +int gr_pid_is_chrooted(struct task_struct *p);
62302 +int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
62303 +int gr_handle_chroot_nice(void);
62304 +int gr_handle_chroot_sysctl(const int op);
62305 +int gr_handle_chroot_setpriority(struct task_struct *p,
62306 + const int niceval);
62307 +int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
62308 +int gr_handle_chroot_chroot(const struct dentry *dentry,
62309 + const struct vfsmount *mnt);
62310 +void gr_handle_chroot_chdir(struct path *path);
62311 +int gr_handle_chroot_chmod(const struct dentry *dentry,
62312 + const struct vfsmount *mnt, const int mode);
62313 +int gr_handle_chroot_mknod(const struct dentry *dentry,
62314 + const struct vfsmount *mnt, const int mode);
62315 +int gr_handle_chroot_mount(const struct dentry *dentry,
62316 + const struct vfsmount *mnt,
62317 + const char *dev_name);
62318 +int gr_handle_chroot_pivot(void);
62319 +int gr_handle_chroot_unix(const pid_t pid);
62320 +
62321 +int gr_handle_rawio(const struct inode *inode);
62322 +
62323 +void gr_handle_ioperm(void);
62324 +void gr_handle_iopl(void);
62325 +
62326 +umode_t gr_acl_umask(void);
62327 +
62328 +int gr_tpe_allow(const struct file *file);
62329 +
62330 +void gr_set_chroot_entries(struct task_struct *task, struct path *path);
62331 +void gr_clear_chroot_entries(struct task_struct *task);
62332 +
62333 +void gr_log_forkfail(const int retval);
62334 +void gr_log_timechange(void);
62335 +void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
62336 +void gr_log_chdir(const struct dentry *dentry,
62337 + const struct vfsmount *mnt);
62338 +void gr_log_chroot_exec(const struct dentry *dentry,
62339 + const struct vfsmount *mnt);
62340 +void gr_handle_exec_args(struct linux_binprm *bprm, struct user_arg_ptr argv);
62341 +void gr_log_remount(const char *devname, const int retval);
62342 +void gr_log_unmount(const char *devname, const int retval);
62343 +void gr_log_mount(const char *from, const char *to, const int retval);
62344 +void gr_log_textrel(struct vm_area_struct *vma);
62345 +void gr_log_rwxmmap(struct file *file);
62346 +void gr_log_rwxmprotect(struct file *file);
62347 +
62348 +int gr_handle_follow_link(const struct inode *parent,
62349 + const struct inode *inode,
62350 + const struct dentry *dentry,
62351 + const struct vfsmount *mnt);
62352 +int gr_handle_fifo(const struct dentry *dentry,
62353 + const struct vfsmount *mnt,
62354 + const struct dentry *dir, const int flag,
62355 + const int acc_mode);
62356 +int gr_handle_hardlink(const struct dentry *dentry,
62357 + const struct vfsmount *mnt,
62358 + struct inode *inode,
62359 + const int mode, const char *to);
62360 +
62361 +int gr_is_capable(const int cap);
62362 +int gr_is_capable_nolog(const int cap);
62363 +int gr_task_is_capable(const struct task_struct *task, const struct cred *cred, const int cap);
62364 +int gr_task_is_capable_nolog(const struct task_struct *task, const int cap);
62365 +
62366 +void gr_learn_resource(const struct task_struct *task, const int limit,
62367 + const unsigned long wanted, const int gt);
62368 +void gr_copy_label(struct task_struct *tsk);
62369 +void gr_handle_crash(struct task_struct *task, const int sig);
62370 +int gr_handle_signal(const struct task_struct *p, const int sig);
62371 +int gr_check_crash_uid(const uid_t uid);
62372 +int gr_check_protected_task(const struct task_struct *task);
62373 +int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
62374 +int gr_acl_handle_mmap(const struct file *file,
62375 + const unsigned long prot);
62376 +int gr_acl_handle_mprotect(const struct file *file,
62377 + const unsigned long prot);
62378 +int gr_check_hidden_task(const struct task_struct *tsk);
62379 +__u32 gr_acl_handle_truncate(const struct dentry *dentry,
62380 + const struct vfsmount *mnt);
62381 +__u32 gr_acl_handle_utime(const struct dentry *dentry,
62382 + const struct vfsmount *mnt);
62383 +__u32 gr_acl_handle_access(const struct dentry *dentry,
62384 + const struct vfsmount *mnt, const int fmode);
62385 +__u32 gr_acl_handle_chmod(const struct dentry *dentry,
62386 + const struct vfsmount *mnt, umode_t *mode);
62387 +__u32 gr_acl_handle_chown(const struct dentry *dentry,
62388 + const struct vfsmount *mnt);
62389 +__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
62390 + const struct vfsmount *mnt);
62391 +int gr_handle_ptrace(struct task_struct *task, const long request);
62392 +int gr_handle_proc_ptrace(struct task_struct *task);
62393 +__u32 gr_acl_handle_execve(const struct dentry *dentry,
62394 + const struct vfsmount *mnt);
62395 +int gr_check_crash_exec(const struct file *filp);
62396 +int gr_acl_is_enabled(void);
62397 +void gr_set_kernel_label(struct task_struct *task);
62398 +void gr_set_role_label(struct task_struct *task, const uid_t uid,
62399 + const gid_t gid);
62400 +int gr_set_proc_label(const struct dentry *dentry,
62401 + const struct vfsmount *mnt,
62402 + const int unsafe_flags);
62403 +__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
62404 + const struct vfsmount *mnt);
62405 +__u32 gr_acl_handle_open(const struct dentry *dentry,
62406 + const struct vfsmount *mnt, int acc_mode);
62407 +__u32 gr_acl_handle_creat(const struct dentry *dentry,
62408 + const struct dentry *p_dentry,
62409 + const struct vfsmount *p_mnt,
62410 + int open_flags, int acc_mode, const int imode);
62411 +void gr_handle_create(const struct dentry *dentry,
62412 + const struct vfsmount *mnt);
62413 +void gr_handle_proc_create(const struct dentry *dentry,
62414 + const struct inode *inode);
62415 +__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
62416 + const struct dentry *parent_dentry,
62417 + const struct vfsmount *parent_mnt,
62418 + const int mode);
62419 +__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
62420 + const struct dentry *parent_dentry,
62421 + const struct vfsmount *parent_mnt);
62422 +__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
62423 + const struct vfsmount *mnt);
62424 +void gr_handle_delete(const ino_t ino, const dev_t dev);
62425 +__u32 gr_acl_handle_unlink(const struct dentry *dentry,
62426 + const struct vfsmount *mnt);
62427 +__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
62428 + const struct dentry *parent_dentry,
62429 + const struct vfsmount *parent_mnt,
62430 + const char *from);
62431 +__u32 gr_acl_handle_link(const struct dentry *new_dentry,
62432 + const struct dentry *parent_dentry,
62433 + const struct vfsmount *parent_mnt,
62434 + const struct dentry *old_dentry,
62435 + const struct vfsmount *old_mnt, const char *to);
62436 +int gr_handle_symlink_owner(const struct path *link, const struct inode *target);
62437 +int gr_acl_handle_rename(struct dentry *new_dentry,
62438 + struct dentry *parent_dentry,
62439 + const struct vfsmount *parent_mnt,
62440 + struct dentry *old_dentry,
62441 + struct inode *old_parent_inode,
62442 + struct vfsmount *old_mnt, const char *newname);
62443 +void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
62444 + struct dentry *old_dentry,
62445 + struct dentry *new_dentry,
62446 + struct vfsmount *mnt, const __u8 replace);
62447 +__u32 gr_check_link(const struct dentry *new_dentry,
62448 + const struct dentry *parent_dentry,
62449 + const struct vfsmount *parent_mnt,
62450 + const struct dentry *old_dentry,
62451 + const struct vfsmount *old_mnt);
62452 +int gr_acl_handle_filldir(const struct file *file, const char *name,
62453 + const unsigned int namelen, const ino_t ino);
62454 +
62455 +__u32 gr_acl_handle_unix(const struct dentry *dentry,
62456 + const struct vfsmount *mnt);
62457 +void gr_acl_handle_exit(void);
62458 +void gr_acl_handle_psacct(struct task_struct *task, const long code);
62459 +int gr_acl_handle_procpidmem(const struct task_struct *task);
62460 +int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
62461 +int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
62462 +void gr_audit_ptrace(struct task_struct *task);
62463 +dev_t gr_get_dev_from_dentry(struct dentry *dentry);
62464 +
62465 +int gr_ptrace_readexec(struct file *file, int unsafe_flags);
62466 +
62467 +#ifdef CONFIG_GRKERNSEC
62468 +void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
62469 +void gr_handle_vm86(void);
62470 +void gr_handle_mem_readwrite(u64 from, u64 to);
62471 +
62472 +void gr_log_badprocpid(const char *entry);
62473 +
62474 +extern int grsec_enable_dmesg;
62475 +extern int grsec_disable_privio;
62476 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
62477 +extern int grsec_enable_chroot_findtask;
62478 +#endif
62479 +#ifdef CONFIG_GRKERNSEC_SETXID
62480 +extern int grsec_enable_setxid;
62481 +#endif
62482 +#endif
62483 +
62484 +#endif
62485 diff --git a/include/linux/grsock.h b/include/linux/grsock.h
62486 new file mode 100644
62487 index 0000000..e7ffaaf
62488 --- /dev/null
62489 +++ b/include/linux/grsock.h
62490 @@ -0,0 +1,19 @@
62491 +#ifndef __GRSOCK_H
62492 +#define __GRSOCK_H
62493 +
62494 +extern void gr_attach_curr_ip(const struct sock *sk);
62495 +extern int gr_handle_sock_all(const int family, const int type,
62496 + const int protocol);
62497 +extern int gr_handle_sock_server(const struct sockaddr *sck);
62498 +extern int gr_handle_sock_server_other(const struct sock *sck);
62499 +extern int gr_handle_sock_client(const struct sockaddr *sck);
62500 +extern int gr_search_connect(struct socket * sock,
62501 + struct sockaddr_in * addr);
62502 +extern int gr_search_bind(struct socket * sock,
62503 + struct sockaddr_in * addr);
62504 +extern int gr_search_listen(struct socket * sock);
62505 +extern int gr_search_accept(struct socket * sock);
62506 +extern int gr_search_socket(const int domain, const int type,
62507 + const int protocol);
62508 +
62509 +#endif
62510 diff --git a/include/linux/hid.h b/include/linux/hid.h
62511 index 449fa38..b37c8cc 100644
62512 --- a/include/linux/hid.h
62513 +++ b/include/linux/hid.h
62514 @@ -704,7 +704,7 @@ struct hid_ll_driver {
62515 unsigned int code, int value);
62516
62517 int (*parse)(struct hid_device *hdev);
62518 -};
62519 +} __no_const;
62520
62521 #define PM_HINT_FULLON 1<<5
62522 #define PM_HINT_NORMAL 1<<1
62523 diff --git a/include/linux/highmem.h b/include/linux/highmem.h
62524 index d3999b4..1304cb4 100644
62525 --- a/include/linux/highmem.h
62526 +++ b/include/linux/highmem.h
62527 @@ -221,6 +221,18 @@ static inline void clear_highpage(struct page *page)
62528 kunmap_atomic(kaddr);
62529 }
62530
62531 +static inline void sanitize_highpage(struct page *page)
62532 +{
62533 + void *kaddr;
62534 + unsigned long flags;
62535 +
62536 + local_irq_save(flags);
62537 + kaddr = kmap_atomic(page);
62538 + clear_page(kaddr);
62539 + kunmap_atomic(kaddr);
62540 + local_irq_restore(flags);
62541 +}
62542 +
62543 static inline void zero_user_segments(struct page *page,
62544 unsigned start1, unsigned end1,
62545 unsigned start2, unsigned end2)
62546 diff --git a/include/linux/i2c.h b/include/linux/i2c.h
62547 index ddfa041..a44cfff 100644
62548 --- a/include/linux/i2c.h
62549 +++ b/include/linux/i2c.h
62550 @@ -366,6 +366,7 @@ struct i2c_algorithm {
62551 /* To determine what the adapter supports */
62552 u32 (*functionality) (struct i2c_adapter *);
62553 };
62554 +typedef struct i2c_algorithm __no_const i2c_algorithm_no_const;
62555
62556 /*
62557 * i2c_adapter is the structure used to identify a physical i2c bus along
62558 diff --git a/include/linux/i2o.h b/include/linux/i2o.h
62559 index d23c3c2..eb63c81 100644
62560 --- a/include/linux/i2o.h
62561 +++ b/include/linux/i2o.h
62562 @@ -565,7 +565,7 @@ struct i2o_controller {
62563 struct i2o_device *exec; /* Executive */
62564 #if BITS_PER_LONG == 64
62565 spinlock_t context_list_lock; /* lock for context_list */
62566 - atomic_t context_list_counter; /* needed for unique contexts */
62567 + atomic_unchecked_t context_list_counter; /* needed for unique contexts */
62568 struct list_head context_list; /* list of context id's
62569 and pointers */
62570 #endif
62571 diff --git a/include/linux/if_team.h b/include/linux/if_team.h
62572 index 8185f57..7b2d222 100644
62573 --- a/include/linux/if_team.h
62574 +++ b/include/linux/if_team.h
62575 @@ -74,6 +74,7 @@ struct team_mode_ops {
62576 void (*port_leave)(struct team *team, struct team_port *port);
62577 void (*port_change_mac)(struct team *team, struct team_port *port);
62578 };
62579 +typedef struct team_mode_ops __no_const team_mode_ops_no_const;
62580
62581 enum team_option_type {
62582 TEAM_OPTION_TYPE_U32,
62583 @@ -136,7 +137,7 @@ struct team {
62584 struct list_head option_inst_list; /* list of option instances */
62585
62586 const struct team_mode *mode;
62587 - struct team_mode_ops ops;
62588 + team_mode_ops_no_const ops;
62589 long mode_priv[TEAM_MODE_PRIV_LONGS];
62590 };
62591
62592 diff --git a/include/linux/init.h b/include/linux/init.h
62593 index 6b95109..7616d09 100644
62594 --- a/include/linux/init.h
62595 +++ b/include/linux/init.h
62596 @@ -39,9 +39,15 @@
62597 * Also note, that this data cannot be "const".
62598 */
62599
62600 +#ifdef MODULE
62601 +#define add_latent_entropy
62602 +#else
62603 +#define add_latent_entropy __latent_entropy
62604 +#endif
62605 +
62606 /* These are for everybody (although not all archs will actually
62607 discard it in modules) */
62608 -#define __init __section(.init.text) __cold notrace
62609 +#define __init __section(.init.text) __cold notrace add_latent_entropy
62610 #define __initdata __section(.init.data)
62611 #define __initconst __section(.init.rodata)
62612 #define __exitdata __section(.exit.data)
62613 @@ -83,7 +89,7 @@
62614 #define __exit __section(.exit.text) __exitused __cold notrace
62615
62616 /* Used for HOTPLUG */
62617 -#define __devinit __section(.devinit.text) __cold notrace
62618 +#define __devinit __section(.devinit.text) __cold notrace add_latent_entropy
62619 #define __devinitdata __section(.devinit.data)
62620 #define __devinitconst __section(.devinit.rodata)
62621 #define __devexit __section(.devexit.text) __exitused __cold notrace
62622 @@ -91,7 +97,7 @@
62623 #define __devexitconst __section(.devexit.rodata)
62624
62625 /* Used for HOTPLUG_CPU */
62626 -#define __cpuinit __section(.cpuinit.text) __cold notrace
62627 +#define __cpuinit __section(.cpuinit.text) __cold notrace add_latent_entropy
62628 #define __cpuinitdata __section(.cpuinit.data)
62629 #define __cpuinitconst __section(.cpuinit.rodata)
62630 #define __cpuexit __section(.cpuexit.text) __exitused __cold notrace
62631 @@ -99,7 +105,7 @@
62632 #define __cpuexitconst __section(.cpuexit.rodata)
62633
62634 /* Used for MEMORY_HOTPLUG */
62635 -#define __meminit __section(.meminit.text) __cold notrace
62636 +#define __meminit __section(.meminit.text) __cold notrace add_latent_entropy
62637 #define __meminitdata __section(.meminit.data)
62638 #define __meminitconst __section(.meminit.rodata)
62639 #define __memexit __section(.memexit.text) __exitused __cold notrace
62640 diff --git a/include/linux/init_task.h b/include/linux/init_task.h
62641 index 9e65eff..b131e8b 100644
62642 --- a/include/linux/init_task.h
62643 +++ b/include/linux/init_task.h
62644 @@ -134,6 +134,12 @@ extern struct cred init_cred;
62645
62646 #define INIT_TASK_COMM "swapper"
62647
62648 +#ifdef CONFIG_X86
62649 +#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
62650 +#else
62651 +#define INIT_TASK_THREAD_INFO
62652 +#endif
62653 +
62654 /*
62655 * INIT_TASK is used to set up the first task table, touch at
62656 * your own risk!. Base=0, limit=0x1fffff (=2MB)
62657 @@ -172,6 +178,7 @@ extern struct cred init_cred;
62658 RCU_INIT_POINTER(.cred, &init_cred), \
62659 .comm = INIT_TASK_COMM, \
62660 .thread = INIT_THREAD, \
62661 + INIT_TASK_THREAD_INFO \
62662 .fs = &init_fs, \
62663 .files = &init_files, \
62664 .signal = &init_signals, \
62665 diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
62666 index e6ca56d..8583707 100644
62667 --- a/include/linux/intel-iommu.h
62668 +++ b/include/linux/intel-iommu.h
62669 @@ -296,7 +296,7 @@ struct iommu_flush {
62670 u8 fm, u64 type);
62671 void (*flush_iotlb)(struct intel_iommu *iommu, u16 did, u64 addr,
62672 unsigned int size_order, u64 type);
62673 -};
62674 +} __no_const;
62675
62676 enum {
62677 SR_DMAR_FECTL_REG,
62678 diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
62679 index e68a8e5..811b9af 100644
62680 --- a/include/linux/interrupt.h
62681 +++ b/include/linux/interrupt.h
62682 @@ -435,7 +435,7 @@ enum
62683 /* map softirq index to softirq name. update 'softirq_to_name' in
62684 * kernel/softirq.c when adding a new softirq.
62685 */
62686 -extern char *softirq_to_name[NR_SOFTIRQS];
62687 +extern const char * const softirq_to_name[NR_SOFTIRQS];
62688
62689 /* softirq mask and active fields moved to irq_cpustat_t in
62690 * asm/hardirq.h to get better cache usage. KAO
62691 @@ -443,12 +443,12 @@ extern char *softirq_to_name[NR_SOFTIRQS];
62692
62693 struct softirq_action
62694 {
62695 - void (*action)(struct softirq_action *);
62696 + void (*action)(void);
62697 };
62698
62699 asmlinkage void do_softirq(void);
62700 asmlinkage void __do_softirq(void);
62701 -extern void open_softirq(int nr, void (*action)(struct softirq_action *));
62702 +extern void open_softirq(int nr, void (*action)(void));
62703 extern void softirq_init(void);
62704 extern void __raise_softirq_irqoff(unsigned int nr);
62705
62706 diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h
62707 index 6883e19..06992b1 100644
62708 --- a/include/linux/kallsyms.h
62709 +++ b/include/linux/kallsyms.h
62710 @@ -15,7 +15,8 @@
62711
62712 struct module;
62713
62714 -#ifdef CONFIG_KALLSYMS
62715 +#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
62716 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
62717 /* Lookup the address for a symbol. Returns 0 if not found. */
62718 unsigned long kallsyms_lookup_name(const char *name);
62719
62720 @@ -106,6 +107,17 @@ static inline int lookup_symbol_attrs(unsigned long addr, unsigned long *size, u
62721 /* Stupid that this does nothing, but I didn't create this mess. */
62722 #define __print_symbol(fmt, addr)
62723 #endif /*CONFIG_KALLSYMS*/
62724 +#else /* when included by kallsyms.c, vsnprintf.c, or
62725 + arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
62726 +extern void __print_symbol(const char *fmt, unsigned long address);
62727 +extern int sprint_backtrace(char *buffer, unsigned long address);
62728 +extern int sprint_symbol(char *buffer, unsigned long address);
62729 +extern int sprint_symbol_no_offset(char *buffer, unsigned long address);
62730 +const char *kallsyms_lookup(unsigned long addr,
62731 + unsigned long *symbolsize,
62732 + unsigned long *offset,
62733 + char **modname, char *namebuf);
62734 +#endif
62735
62736 /* This macro allows us to keep printk typechecking */
62737 static __printf(1, 2)
62738 diff --git a/include/linux/kgdb.h b/include/linux/kgdb.h
62739 index c4d2fc1..5df9c19 100644
62740 --- a/include/linux/kgdb.h
62741 +++ b/include/linux/kgdb.h
62742 @@ -53,7 +53,7 @@ extern int kgdb_connected;
62743 extern int kgdb_io_module_registered;
62744
62745 extern atomic_t kgdb_setting_breakpoint;
62746 -extern atomic_t kgdb_cpu_doing_single_step;
62747 +extern atomic_unchecked_t kgdb_cpu_doing_single_step;
62748
62749 extern struct task_struct *kgdb_usethread;
62750 extern struct task_struct *kgdb_contthread;
62751 @@ -252,7 +252,7 @@ struct kgdb_arch {
62752 void (*disable_hw_break)(struct pt_regs *regs);
62753 void (*remove_all_hw_break)(void);
62754 void (*correct_hw_break)(void);
62755 -};
62756 +} __do_const;
62757
62758 /**
62759 * struct kgdb_io - Describe the interface for an I/O driver to talk with KGDB.
62760 @@ -277,7 +277,7 @@ struct kgdb_io {
62761 void (*pre_exception) (void);
62762 void (*post_exception) (void);
62763 int is_console;
62764 -};
62765 +} __do_const;
62766
62767 extern struct kgdb_arch arch_kgdb_ops;
62768
62769 diff --git a/include/linux/kmod.h b/include/linux/kmod.h
62770 index 5398d58..5883a34 100644
62771 --- a/include/linux/kmod.h
62772 +++ b/include/linux/kmod.h
62773 @@ -34,6 +34,8 @@ extern char modprobe_path[]; /* for sysctl */
62774 * usually useless though. */
62775 extern __printf(2, 3)
62776 int __request_module(bool wait, const char *name, ...);
62777 +extern __printf(3, 4)
62778 +int ___request_module(bool wait, char *param_name, const char *name, ...);
62779 #define request_module(mod...) __request_module(true, mod)
62780 #define request_module_nowait(mod...) __request_module(false, mod)
62781 #define try_then_request_module(x, mod...) \
62782 diff --git a/include/linux/kref.h b/include/linux/kref.h
62783 index 9c07dce..a92fa71 100644
62784 --- a/include/linux/kref.h
62785 +++ b/include/linux/kref.h
62786 @@ -63,7 +63,7 @@ static inline void kref_get(struct kref *kref)
62787 static inline int kref_sub(struct kref *kref, unsigned int count,
62788 void (*release)(struct kref *kref))
62789 {
62790 - WARN_ON(release == NULL);
62791 + BUG_ON(release == NULL);
62792
62793 if (atomic_sub_and_test((int) count, &kref->refcount)) {
62794 release(kref);
62795 diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
62796 index 96c158a..1864db5 100644
62797 --- a/include/linux/kvm_host.h
62798 +++ b/include/linux/kvm_host.h
62799 @@ -345,7 +345,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vcpu);
62800 void vcpu_load(struct kvm_vcpu *vcpu);
62801 void vcpu_put(struct kvm_vcpu *vcpu);
62802
62803 -int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
62804 +int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
62805 struct module *module);
62806 void kvm_exit(void);
62807
62808 @@ -511,7 +511,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu,
62809 struct kvm_guest_debug *dbg);
62810 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
62811
62812 -int kvm_arch_init(void *opaque);
62813 +int kvm_arch_init(const void *opaque);
62814 void kvm_arch_exit(void);
62815
62816 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
62817 diff --git a/include/linux/libata.h b/include/linux/libata.h
62818 index 6e887c7..4539601 100644
62819 --- a/include/linux/libata.h
62820 +++ b/include/linux/libata.h
62821 @@ -910,7 +910,7 @@ struct ata_port_operations {
62822 * fields must be pointers.
62823 */
62824 const struct ata_port_operations *inherits;
62825 -};
62826 +} __do_const;
62827
62828 struct ata_port_info {
62829 unsigned long flags;
62830 diff --git a/include/linux/memory.h b/include/linux/memory.h
62831 index 1ac7f6e..a5794d0 100644
62832 --- a/include/linux/memory.h
62833 +++ b/include/linux/memory.h
62834 @@ -143,7 +143,7 @@ struct memory_accessor {
62835 size_t count);
62836 ssize_t (*write)(struct memory_accessor *, const char *buf,
62837 off_t offset, size_t count);
62838 -};
62839 +} __no_const;
62840
62841 /*
62842 * Kernel text modification mutex, used for code patching. Users of this lock
62843 diff --git a/include/linux/mfd/abx500.h b/include/linux/mfd/abx500.h
62844 index 1318ca6..7521340 100644
62845 --- a/include/linux/mfd/abx500.h
62846 +++ b/include/linux/mfd/abx500.h
62847 @@ -452,6 +452,7 @@ struct abx500_ops {
62848 int (*event_registers_startup_state_get) (struct device *, u8 *);
62849 int (*startup_irq_enabled) (struct device *, unsigned int);
62850 };
62851 +typedef struct abx500_ops __no_const abx500_ops_no_const;
62852
62853 int abx500_register_ops(struct device *core_dev, struct abx500_ops *ops);
62854 void abx500_remove_ops(struct device *dev);
62855 diff --git a/include/linux/mfd/abx500/ux500_chargalg.h b/include/linux/mfd/abx500/ux500_chargalg.h
62856 index 9b07725..3d55001 100644
62857 --- a/include/linux/mfd/abx500/ux500_chargalg.h
62858 +++ b/include/linux/mfd/abx500/ux500_chargalg.h
62859 @@ -19,7 +19,7 @@ struct ux500_charger_ops {
62860 int (*enable) (struct ux500_charger *, int, int, int);
62861 int (*kick_wd) (struct ux500_charger *);
62862 int (*update_curr) (struct ux500_charger *, int);
62863 -};
62864 +} __no_const;
62865
62866 /**
62867 * struct ux500_charger - power supply ux500 charger sub class
62868 diff --git a/include/linux/mm.h b/include/linux/mm.h
62869 index f9f279c..198da78 100644
62870 --- a/include/linux/mm.h
62871 +++ b/include/linux/mm.h
62872 @@ -116,7 +116,14 @@ extern unsigned int kobjsize(const void *objp);
62873
62874 #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
62875 #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
62876 +
62877 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
62878 +#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
62879 +#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
62880 +#else
62881 #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
62882 +#endif
62883 +
62884 #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
62885 #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
62886
62887 @@ -1009,34 +1016,6 @@ int set_page_dirty(struct page *page);
62888 int set_page_dirty_lock(struct page *page);
62889 int clear_page_dirty_for_io(struct page *page);
62890
62891 -/* Is the vma a continuation of the stack vma above it? */
62892 -static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
62893 -{
62894 - return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
62895 -}
62896 -
62897 -static inline int stack_guard_page_start(struct vm_area_struct *vma,
62898 - unsigned long addr)
62899 -{
62900 - return (vma->vm_flags & VM_GROWSDOWN) &&
62901 - (vma->vm_start == addr) &&
62902 - !vma_growsdown(vma->vm_prev, addr);
62903 -}
62904 -
62905 -/* Is the vma a continuation of the stack vma below it? */
62906 -static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
62907 -{
62908 - return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
62909 -}
62910 -
62911 -static inline int stack_guard_page_end(struct vm_area_struct *vma,
62912 - unsigned long addr)
62913 -{
62914 - return (vma->vm_flags & VM_GROWSUP) &&
62915 - (vma->vm_end == addr) &&
62916 - !vma_growsup(vma->vm_next, addr);
62917 -}
62918 -
62919 extern pid_t
62920 vm_is_stack(struct task_struct *task, struct vm_area_struct *vma, int in_group);
62921
62922 @@ -1135,6 +1114,15 @@ static inline void sync_mm_rss(struct mm_struct *mm)
62923 }
62924 #endif
62925
62926 +#ifdef CONFIG_MMU
62927 +pgprot_t vm_get_page_prot(vm_flags_t vm_flags);
62928 +#else
62929 +static inline pgprot_t vm_get_page_prot(vm_flags_t vm_flags)
62930 +{
62931 + return __pgprot(0);
62932 +}
62933 +#endif
62934 +
62935 int vma_wants_writenotify(struct vm_area_struct *vma);
62936
62937 extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
62938 @@ -1153,8 +1141,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd,
62939 {
62940 return 0;
62941 }
62942 +
62943 +static inline int __pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd,
62944 + unsigned long address)
62945 +{
62946 + return 0;
62947 +}
62948 #else
62949 int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address);
62950 +int __pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd, unsigned long address);
62951 #endif
62952
62953 #ifdef __PAGETABLE_PMD_FOLDED
62954 @@ -1163,8 +1158,15 @@ static inline int __pmd_alloc(struct mm_struct *mm, pud_t *pud,
62955 {
62956 return 0;
62957 }
62958 +
62959 +static inline int __pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud,
62960 + unsigned long address)
62961 +{
62962 + return 0;
62963 +}
62964 #else
62965 int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address);
62966 +int __pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud, unsigned long address);
62967 #endif
62968
62969 int __pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
62970 @@ -1182,11 +1184,23 @@ static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long a
62971 NULL: pud_offset(pgd, address);
62972 }
62973
62974 +static inline pud_t *pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
62975 +{
62976 + return (unlikely(pgd_none(*pgd)) && __pud_alloc_kernel(mm, pgd, address))?
62977 + NULL: pud_offset(pgd, address);
62978 +}
62979 +
62980 static inline pmd_t *pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
62981 {
62982 return (unlikely(pud_none(*pud)) && __pmd_alloc(mm, pud, address))?
62983 NULL: pmd_offset(pud, address);
62984 }
62985 +
62986 +static inline pmd_t *pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud, unsigned long address)
62987 +{
62988 + return (unlikely(pud_none(*pud)) && __pmd_alloc_kernel(mm, pud, address))?
62989 + NULL: pmd_offset(pud, address);
62990 +}
62991 #endif /* CONFIG_MMU && !__ARCH_HAS_4LEVEL_HACK */
62992
62993 #if USE_SPLIT_PTLOCKS
62994 @@ -1396,6 +1410,7 @@ extern unsigned long do_mmap_pgoff(struct file *, unsigned long,
62995 unsigned long, unsigned long,
62996 unsigned long, unsigned long);
62997 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
62998 +extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
62999
63000 /* These take the mm semaphore themselves */
63001 extern unsigned long vm_brk(unsigned long, unsigned long);
63002 @@ -1458,6 +1473,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
63003 extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
63004 struct vm_area_struct **pprev);
63005
63006 +extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
63007 +extern __must_check long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
63008 +extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
63009 +
63010 /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
63011 NULL if none. Assume start_addr < end_addr. */
63012 static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
63013 @@ -1486,15 +1505,6 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
63014 return vma;
63015 }
63016
63017 -#ifdef CONFIG_MMU
63018 -pgprot_t vm_get_page_prot(unsigned long vm_flags);
63019 -#else
63020 -static inline pgprot_t vm_get_page_prot(unsigned long vm_flags)
63021 -{
63022 - return __pgprot(0);
63023 -}
63024 -#endif
63025 -
63026 struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
63027 int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
63028 unsigned long pfn, unsigned long size, pgprot_t);
63029 @@ -1599,7 +1609,7 @@ extern int unpoison_memory(unsigned long pfn);
63030 extern int sysctl_memory_failure_early_kill;
63031 extern int sysctl_memory_failure_recovery;
63032 extern void shake_page(struct page *p, int access);
63033 -extern atomic_long_t mce_bad_pages;
63034 +extern atomic_long_unchecked_t mce_bad_pages;
63035 extern int soft_offline_page(struct page *page, int flags);
63036
63037 extern void dump_page(struct page *page);
63038 @@ -1630,5 +1640,11 @@ static inline unsigned int debug_guardpage_minorder(void) { return 0; }
63039 static inline bool page_is_guard(struct page *page) { return false; }
63040 #endif /* CONFIG_DEBUG_PAGEALLOC */
63041
63042 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
63043 +extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
63044 +#else
63045 +static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
63046 +#endif
63047 +
63048 #endif /* __KERNEL__ */
63049 #endif /* _LINUX_MM_H */
63050 diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
63051 index 704a626..bb0705a 100644
63052 --- a/include/linux/mm_types.h
63053 +++ b/include/linux/mm_types.h
63054 @@ -263,6 +263,8 @@ struct vm_area_struct {
63055 #ifdef CONFIG_NUMA
63056 struct mempolicy *vm_policy; /* NUMA policy for the VMA */
63057 #endif
63058 +
63059 + struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
63060 };
63061
63062 struct core_thread {
63063 @@ -337,7 +339,7 @@ struct mm_struct {
63064 unsigned long def_flags;
63065 unsigned long nr_ptes; /* Page table pages */
63066 unsigned long start_code, end_code, start_data, end_data;
63067 - unsigned long start_brk, brk, start_stack;
63068 + unsigned long brk_gap, start_brk, brk, start_stack;
63069 unsigned long arg_start, arg_end, env_start, env_end;
63070
63071 unsigned long saved_auxv[AT_VECTOR_SIZE]; /* for /proc/PID/auxv */
63072 @@ -389,6 +391,24 @@ struct mm_struct {
63073 struct cpumask cpumask_allocation;
63074 #endif
63075 struct uprobes_state uprobes_state;
63076 +
63077 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
63078 + unsigned long pax_flags;
63079 +#endif
63080 +
63081 +#ifdef CONFIG_PAX_DLRESOLVE
63082 + unsigned long call_dl_resolve;
63083 +#endif
63084 +
63085 +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
63086 + unsigned long call_syscall;
63087 +#endif
63088 +
63089 +#ifdef CONFIG_PAX_ASLR
63090 + unsigned long delta_mmap; /* randomized offset */
63091 + unsigned long delta_stack; /* randomized offset */
63092 +#endif
63093 +
63094 };
63095
63096 static inline void mm_init_cpumask(struct mm_struct *mm)
63097 diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h
63098 index 1d1b1e1..2a13c78 100644
63099 --- a/include/linux/mmu_notifier.h
63100 +++ b/include/linux/mmu_notifier.h
63101 @@ -255,12 +255,12 @@ static inline void mmu_notifier_mm_destroy(struct mm_struct *mm)
63102 */
63103 #define ptep_clear_flush_notify(__vma, __address, __ptep) \
63104 ({ \
63105 - pte_t __pte; \
63106 + pte_t ___pte; \
63107 struct vm_area_struct *___vma = __vma; \
63108 unsigned long ___address = __address; \
63109 - __pte = ptep_clear_flush(___vma, ___address, __ptep); \
63110 + ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
63111 mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
63112 - __pte; \
63113 + ___pte; \
63114 })
63115
63116 #define pmdp_clear_flush_notify(__vma, __address, __pmdp) \
63117 diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
63118 index 68c569f..5f43753 100644
63119 --- a/include/linux/mmzone.h
63120 +++ b/include/linux/mmzone.h
63121 @@ -411,7 +411,7 @@ struct zone {
63122 unsigned long flags; /* zone flags, see below */
63123
63124 /* Zone statistics */
63125 - atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63126 + atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63127
63128 /*
63129 * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on
63130 diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
63131 index 5db9382..50e801d 100644
63132 --- a/include/linux/mod_devicetable.h
63133 +++ b/include/linux/mod_devicetable.h
63134 @@ -12,7 +12,7 @@
63135 typedef unsigned long kernel_ulong_t;
63136 #endif
63137
63138 -#define PCI_ANY_ID (~0)
63139 +#define PCI_ANY_ID ((__u16)~0)
63140
63141 struct pci_device_id {
63142 __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
63143 @@ -131,7 +131,7 @@ struct usb_device_id {
63144 #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
63145 #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
63146
63147 -#define HID_ANY_ID (~0)
63148 +#define HID_ANY_ID (~0U)
63149 #define HID_BUS_ANY 0xffff
63150 #define HID_GROUP_ANY 0x0000
63151
63152 diff --git a/include/linux/module.h b/include/linux/module.h
63153 index fbcafe2..e5d9587 100644
63154 --- a/include/linux/module.h
63155 +++ b/include/linux/module.h
63156 @@ -17,6 +17,7 @@
63157 #include <linux/moduleparam.h>
63158 #include <linux/tracepoint.h>
63159 #include <linux/export.h>
63160 +#include <linux/fs.h>
63161
63162 #include <linux/percpu.h>
63163 #include <asm/module.h>
63164 @@ -273,19 +274,16 @@ struct module
63165 int (*init)(void);
63166
63167 /* If this is non-NULL, vfree after init() returns */
63168 - void *module_init;
63169 + void *module_init_rx, *module_init_rw;
63170
63171 /* Here is the actual code + data, vfree'd on unload. */
63172 - void *module_core;
63173 + void *module_core_rx, *module_core_rw;
63174
63175 /* Here are the sizes of the init and core sections */
63176 - unsigned int init_size, core_size;
63177 + unsigned int init_size_rw, core_size_rw;
63178
63179 /* The size of the executable code in each section. */
63180 - unsigned int init_text_size, core_text_size;
63181 -
63182 - /* Size of RO sections of the module (text+rodata) */
63183 - unsigned int init_ro_size, core_ro_size;
63184 + unsigned int init_size_rx, core_size_rx;
63185
63186 /* Arch-specific module values */
63187 struct mod_arch_specific arch;
63188 @@ -341,6 +339,10 @@ struct module
63189 #ifdef CONFIG_EVENT_TRACING
63190 struct ftrace_event_call **trace_events;
63191 unsigned int num_trace_events;
63192 + struct file_operations trace_id;
63193 + struct file_operations trace_enable;
63194 + struct file_operations trace_format;
63195 + struct file_operations trace_filter;
63196 #endif
63197 #ifdef CONFIG_FTRACE_MCOUNT_RECORD
63198 unsigned int num_ftrace_callsites;
63199 @@ -388,16 +390,46 @@ bool is_module_address(unsigned long addr);
63200 bool is_module_percpu_address(unsigned long addr);
63201 bool is_module_text_address(unsigned long addr);
63202
63203 +static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
63204 +{
63205 +
63206 +#ifdef CONFIG_PAX_KERNEXEC
63207 + if (ktla_ktva(addr) >= (unsigned long)start &&
63208 + ktla_ktva(addr) < (unsigned long)start + size)
63209 + return 1;
63210 +#endif
63211 +
63212 + return ((void *)addr >= start && (void *)addr < start + size);
63213 +}
63214 +
63215 +static inline int within_module_core_rx(unsigned long addr, struct module *mod)
63216 +{
63217 + return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
63218 +}
63219 +
63220 +static inline int within_module_core_rw(unsigned long addr, struct module *mod)
63221 +{
63222 + return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
63223 +}
63224 +
63225 +static inline int within_module_init_rx(unsigned long addr, struct module *mod)
63226 +{
63227 + return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
63228 +}
63229 +
63230 +static inline int within_module_init_rw(unsigned long addr, struct module *mod)
63231 +{
63232 + return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
63233 +}
63234 +
63235 static inline int within_module_core(unsigned long addr, struct module *mod)
63236 {
63237 - return (unsigned long)mod->module_core <= addr &&
63238 - addr < (unsigned long)mod->module_core + mod->core_size;
63239 + return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
63240 }
63241
63242 static inline int within_module_init(unsigned long addr, struct module *mod)
63243 {
63244 - return (unsigned long)mod->module_init <= addr &&
63245 - addr < (unsigned long)mod->module_init + mod->init_size;
63246 + return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
63247 }
63248
63249 /* Search for module by name: must hold module_mutex. */
63250 diff --git a/include/linux/moduleloader.h b/include/linux/moduleloader.h
63251 index b2be02e..72d2f78 100644
63252 --- a/include/linux/moduleloader.h
63253 +++ b/include/linux/moduleloader.h
63254 @@ -23,11 +23,23 @@ unsigned int arch_mod_section_prepend(struct module *mod, unsigned int section);
63255
63256 /* Allocator used for allocating struct module, core sections and init
63257 sections. Returns NULL on failure. */
63258 -void *module_alloc(unsigned long size);
63259 +void *module_alloc(unsigned long size) __size_overflow(1);
63260 +
63261 +#ifdef CONFIG_PAX_KERNEXEC
63262 +void *module_alloc_exec(unsigned long size) __size_overflow(1);
63263 +#else
63264 +#define module_alloc_exec(x) module_alloc(x)
63265 +#endif
63266
63267 /* Free memory returned from module_alloc. */
63268 void module_free(struct module *mod, void *module_region);
63269
63270 +#ifdef CONFIG_PAX_KERNEXEC
63271 +void module_free_exec(struct module *mod, void *module_region);
63272 +#else
63273 +#define module_free_exec(x, y) module_free((x), (y))
63274 +#endif
63275 +
63276 /* Apply the given relocation to the (simplified) ELF. Return -error
63277 or 0. */
63278 int apply_relocate(Elf_Shdr *sechdrs,
63279 diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h
63280 index d6a5806..7c13347 100644
63281 --- a/include/linux/moduleparam.h
63282 +++ b/include/linux/moduleparam.h
63283 @@ -286,7 +286,7 @@ static inline void __kernel_param_unlock(void)
63284 * @len is usually just sizeof(string).
63285 */
63286 #define module_param_string(name, string, len, perm) \
63287 - static const struct kparam_string __param_string_##name \
63288 + static const struct kparam_string __param_string_##name __used \
63289 = { len, string }; \
63290 __module_param_call(MODULE_PARAM_PREFIX, name, \
63291 &param_ops_string, \
63292 @@ -425,7 +425,7 @@ extern int param_set_bint(const char *val, const struct kernel_param *kp);
63293 */
63294 #define module_param_array_named(name, array, type, nump, perm) \
63295 param_check_##type(name, &(array)[0]); \
63296 - static const struct kparam_array __param_arr_##name \
63297 + static const struct kparam_array __param_arr_##name __used \
63298 = { .max = ARRAY_SIZE(array), .num = nump, \
63299 .ops = &param_ops_##type, \
63300 .elemsize = sizeof(array[0]), .elem = array }; \
63301 diff --git a/include/linux/namei.h b/include/linux/namei.h
63302 index ffc0213..2c1f2cb 100644
63303 --- a/include/linux/namei.h
63304 +++ b/include/linux/namei.h
63305 @@ -24,7 +24,7 @@ struct nameidata {
63306 unsigned seq;
63307 int last_type;
63308 unsigned depth;
63309 - char *saved_names[MAX_NESTED_LINKS + 1];
63310 + const char *saved_names[MAX_NESTED_LINKS + 1];
63311
63312 /* Intent data */
63313 union {
63314 @@ -94,12 +94,12 @@ extern int follow_up(struct path *);
63315 extern struct dentry *lock_rename(struct dentry *, struct dentry *);
63316 extern void unlock_rename(struct dentry *, struct dentry *);
63317
63318 -static inline void nd_set_link(struct nameidata *nd, char *path)
63319 +static inline void nd_set_link(struct nameidata *nd, const char *path)
63320 {
63321 nd->saved_names[nd->depth] = path;
63322 }
63323
63324 -static inline char *nd_get_link(struct nameidata *nd)
63325 +static inline const char *nd_get_link(const struct nameidata *nd)
63326 {
63327 return nd->saved_names[nd->depth];
63328 }
63329 diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
63330 index d94cb14..e64c951 100644
63331 --- a/include/linux/netdevice.h
63332 +++ b/include/linux/netdevice.h
63333 @@ -1026,6 +1026,7 @@ struct net_device_ops {
63334 struct net_device *dev,
63335 int idx);
63336 };
63337 +typedef struct net_device_ops __no_const net_device_ops_no_const;
63338
63339 /*
63340 * The DEVICE structure.
63341 @@ -1087,7 +1088,7 @@ struct net_device {
63342 int iflink;
63343
63344 struct net_device_stats stats;
63345 - atomic_long_t rx_dropped; /* dropped packets by core network
63346 + atomic_long_unchecked_t rx_dropped; /* dropped packets by core network
63347 * Do not use this in drivers.
63348 */
63349
63350 diff --git a/include/linux/netfilter/xt_gradm.h b/include/linux/netfilter/xt_gradm.h
63351 new file mode 100644
63352 index 0000000..33f4af8
63353 --- /dev/null
63354 +++ b/include/linux/netfilter/xt_gradm.h
63355 @@ -0,0 +1,9 @@
63356 +#ifndef _LINUX_NETFILTER_XT_GRADM_H
63357 +#define _LINUX_NETFILTER_XT_GRADM_H 1
63358 +
63359 +struct xt_gradm_mtinfo {
63360 + __u16 flags;
63361 + __u16 invflags;
63362 +};
63363 +
63364 +#endif
63365 diff --git a/include/linux/of_pdt.h b/include/linux/of_pdt.h
63366 index c65a18a..0c05f3a 100644
63367 --- a/include/linux/of_pdt.h
63368 +++ b/include/linux/of_pdt.h
63369 @@ -32,7 +32,7 @@ struct of_pdt_ops {
63370
63371 /* return 0 on success; fill in 'len' with number of bytes in path */
63372 int (*pkg2path)(phandle node, char *buf, const int buflen, int *len);
63373 -};
63374 +} __no_const;
63375
63376 extern void *prom_early_alloc(unsigned long size);
63377
63378 diff --git a/include/linux/oprofile.h b/include/linux/oprofile.h
63379 index a4c5624..79d6d88 100644
63380 --- a/include/linux/oprofile.h
63381 +++ b/include/linux/oprofile.h
63382 @@ -139,9 +139,9 @@ int oprofilefs_create_ulong(struct super_block * sb, struct dentry * root,
63383 int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
63384 char const * name, ulong * val);
63385
63386 -/** Create a file for read-only access to an atomic_t. */
63387 +/** Create a file for read-only access to an atomic_unchecked_t. */
63388 int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
63389 - char const * name, atomic_t * val);
63390 + char const * name, atomic_unchecked_t * val);
63391
63392 /** create a directory */
63393 struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
63394 diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
63395 index 45db49f..386788e 100644
63396 --- a/include/linux/perf_event.h
63397 +++ b/include/linux/perf_event.h
63398 @@ -879,8 +879,8 @@ struct perf_event {
63399
63400 enum perf_event_active_state state;
63401 unsigned int attach_state;
63402 - local64_t count;
63403 - atomic64_t child_count;
63404 + local64_t count; /* PaX: fix it one day */
63405 + atomic64_unchecked_t child_count;
63406
63407 /*
63408 * These are the total time in nanoseconds that the event
63409 @@ -931,8 +931,8 @@ struct perf_event {
63410 * These accumulate total time (in nanoseconds) that children
63411 * events have been enabled and running, respectively.
63412 */
63413 - atomic64_t child_total_time_enabled;
63414 - atomic64_t child_total_time_running;
63415 + atomic64_unchecked_t child_total_time_enabled;
63416 + atomic64_unchecked_t child_total_time_running;
63417
63418 /*
63419 * Protect attach/detach and child_list:
63420 diff --git a/include/linux/personality.h b/include/linux/personality.h
63421 index 8fc7dd1a..c19d89e 100644
63422 --- a/include/linux/personality.h
63423 +++ b/include/linux/personality.h
63424 @@ -44,6 +44,7 @@ enum {
63425 #define PER_CLEAR_ON_SETID (READ_IMPLIES_EXEC | \
63426 ADDR_NO_RANDOMIZE | \
63427 ADDR_COMPAT_LAYOUT | \
63428 + ADDR_LIMIT_3GB | \
63429 MMAP_PAGE_ZERO)
63430
63431 /*
63432 diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
63433 index e1ac1ce..0675fed 100644
63434 --- a/include/linux/pipe_fs_i.h
63435 +++ b/include/linux/pipe_fs_i.h
63436 @@ -45,9 +45,9 @@ struct pipe_buffer {
63437 struct pipe_inode_info {
63438 wait_queue_head_t wait;
63439 unsigned int nrbufs, curbuf, buffers;
63440 - unsigned int readers;
63441 - unsigned int writers;
63442 - unsigned int waiting_writers;
63443 + atomic_t readers;
63444 + atomic_t writers;
63445 + atomic_t waiting_writers;
63446 unsigned int r_counter;
63447 unsigned int w_counter;
63448 struct page *tmp_page;
63449 diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
63450 index f271860..6b3bec5 100644
63451 --- a/include/linux/pm_runtime.h
63452 +++ b/include/linux/pm_runtime.h
63453 @@ -97,7 +97,7 @@ static inline bool pm_runtime_callbacks_present(struct device *dev)
63454
63455 static inline void pm_runtime_mark_last_busy(struct device *dev)
63456 {
63457 - ACCESS_ONCE(dev->power.last_busy) = jiffies;
63458 + ACCESS_ONCE_RW(dev->power.last_busy) = jiffies;
63459 }
63460
63461 #else /* !CONFIG_PM_RUNTIME */
63462 diff --git a/include/linux/poison.h b/include/linux/poison.h
63463 index 2110a81..13a11bb 100644
63464 --- a/include/linux/poison.h
63465 +++ b/include/linux/poison.h
63466 @@ -19,8 +19,8 @@
63467 * under normal circumstances, used to verify that nobody uses
63468 * non-initialized list entries.
63469 */
63470 -#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
63471 -#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
63472 +#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
63473 +#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
63474
63475 /********** include/linux/timer.h **********/
63476 /*
63477 diff --git a/include/linux/preempt.h b/include/linux/preempt.h
63478 index 5a710b9..0b0dab9 100644
63479 --- a/include/linux/preempt.h
63480 +++ b/include/linux/preempt.h
63481 @@ -126,7 +126,7 @@ struct preempt_ops {
63482 void (*sched_in)(struct preempt_notifier *notifier, int cpu);
63483 void (*sched_out)(struct preempt_notifier *notifier,
63484 struct task_struct *next);
63485 -};
63486 +} __no_const;
63487
63488 /**
63489 * preempt_notifier - key for installing preemption notifiers
63490 diff --git a/include/linux/printk.h b/include/linux/printk.h
63491 index 1bec2f7..b66e833 100644
63492 --- a/include/linux/printk.h
63493 +++ b/include/linux/printk.h
63494 @@ -94,6 +94,8 @@ void early_printk(const char *fmt, ...);
63495 extern int printk_needs_cpu(int cpu);
63496 extern void printk_tick(void);
63497
63498 +extern int kptr_restrict;
63499 +
63500 #ifdef CONFIG_PRINTK
63501 asmlinkage __printf(5, 0)
63502 int vprintk_emit(int facility, int level,
63503 @@ -128,7 +130,6 @@ extern bool printk_timed_ratelimit(unsigned long *caller_jiffies,
63504
63505 extern int printk_delay_msec;
63506 extern int dmesg_restrict;
63507 -extern int kptr_restrict;
63508
63509 void log_buf_kexec_setup(void);
63510 void __init setup_log_buf(int early);
63511 diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
63512 index 3fd2e87..d93a721 100644
63513 --- a/include/linux/proc_fs.h
63514 +++ b/include/linux/proc_fs.h
63515 @@ -155,6 +155,18 @@ static inline struct proc_dir_entry *proc_create(const char *name, umode_t mode,
63516 return proc_create_data(name, mode, parent, proc_fops, NULL);
63517 }
63518
63519 +static inline struct proc_dir_entry *proc_create_grsec(const char *name, umode_t mode,
63520 + struct proc_dir_entry *parent, const struct file_operations *proc_fops)
63521 +{
63522 +#ifdef CONFIG_GRKERNSEC_PROC_USER
63523 + return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
63524 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
63525 + return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
63526 +#else
63527 + return proc_create_data(name, mode, parent, proc_fops, NULL);
63528 +#endif
63529 +}
63530 +
63531 static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
63532 umode_t mode, struct proc_dir_entry *base,
63533 read_proc_t *read_proc, void * data)
63534 @@ -258,7 +270,7 @@ union proc_op {
63535 int (*proc_show)(struct seq_file *m,
63536 struct pid_namespace *ns, struct pid *pid,
63537 struct task_struct *task);
63538 -};
63539 +} __no_const;
63540
63541 struct ctl_table_header;
63542 struct ctl_table;
63543 diff --git a/include/linux/random.h b/include/linux/random.h
63544 index ac621ce..c1215f3 100644
63545 --- a/include/linux/random.h
63546 +++ b/include/linux/random.h
63547 @@ -53,6 +53,10 @@ extern void add_input_randomness(unsigned int type, unsigned int code,
63548 unsigned int value);
63549 extern void add_interrupt_randomness(int irq, int irq_flags);
63550
63551 +#ifdef CONFIG_PAX_LATENT_ENTROPY
63552 +extern void transfer_latent_entropy(void);
63553 +#endif
63554 +
63555 extern void get_random_bytes(void *buf, int nbytes);
63556 extern void get_random_bytes_arch(void *buf, int nbytes);
63557 void generate_random_uuid(unsigned char uuid_out[16]);
63558 @@ -69,12 +73,17 @@ void srandom32(u32 seed);
63559
63560 u32 prandom32(struct rnd_state *);
63561
63562 +static inline unsigned long pax_get_random_long(void)
63563 +{
63564 + return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
63565 +}
63566 +
63567 /*
63568 * Handle minimum values for seeds
63569 */
63570 static inline u32 __seed(u32 x, u32 m)
63571 {
63572 - return (x < m) ? x + m : x;
63573 + return (x <= m) ? x + m + 1 : x;
63574 }
63575
63576 /**
63577 diff --git a/include/linux/reboot.h b/include/linux/reboot.h
63578 index e0879a7..a12f962 100644
63579 --- a/include/linux/reboot.h
63580 +++ b/include/linux/reboot.h
63581 @@ -52,9 +52,9 @@ extern int unregister_reboot_notifier(struct notifier_block *);
63582 * Architecture-specific implementations of sys_reboot commands.
63583 */
63584
63585 -extern void machine_restart(char *cmd);
63586 -extern void machine_halt(void);
63587 -extern void machine_power_off(void);
63588 +extern void machine_restart(char *cmd) __noreturn;
63589 +extern void machine_halt(void) __noreturn;
63590 +extern void machine_power_off(void) __noreturn;
63591
63592 extern void machine_shutdown(void);
63593 struct pt_regs;
63594 @@ -65,9 +65,9 @@ extern void machine_crash_shutdown(struct pt_regs *);
63595 */
63596
63597 extern void kernel_restart_prepare(char *cmd);
63598 -extern void kernel_restart(char *cmd);
63599 -extern void kernel_halt(void);
63600 -extern void kernel_power_off(void);
63601 +extern void kernel_restart(char *cmd) __noreturn;
63602 +extern void kernel_halt(void) __noreturn;
63603 +extern void kernel_power_off(void) __noreturn;
63604
63605 extern int C_A_D; /* for sysctl */
63606 void ctrl_alt_del(void);
63607 @@ -81,7 +81,7 @@ extern int orderly_poweroff(bool force);
63608 * Emergency restart, callable from an interrupt handler.
63609 */
63610
63611 -extern void emergency_restart(void);
63612 +extern void emergency_restart(void) __noreturn;
63613 #include <asm/emergency-restart.h>
63614
63615 #endif
63616 diff --git a/include/linux/relay.h b/include/linux/relay.h
63617 index 91cacc3..b55ff74 100644
63618 --- a/include/linux/relay.h
63619 +++ b/include/linux/relay.h
63620 @@ -160,7 +160,7 @@ struct rchan_callbacks
63621 * The callback should return 0 if successful, negative if not.
63622 */
63623 int (*remove_buf_file)(struct dentry *dentry);
63624 -};
63625 +} __no_const;
63626
63627 /*
63628 * CONFIG_RELAY kernel API, kernel/relay.c
63629 diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
63630 index 6fdf027..ff72610 100644
63631 --- a/include/linux/rfkill.h
63632 +++ b/include/linux/rfkill.h
63633 @@ -147,6 +147,7 @@ struct rfkill_ops {
63634 void (*query)(struct rfkill *rfkill, void *data);
63635 int (*set_block)(void *data, bool blocked);
63636 };
63637 +typedef struct rfkill_ops __no_const rfkill_ops_no_const;
63638
63639 #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
63640 /**
63641 diff --git a/include/linux/rio.h b/include/linux/rio.h
63642 index a90ebad..fd87b5d 100644
63643 --- a/include/linux/rio.h
63644 +++ b/include/linux/rio.h
63645 @@ -321,7 +321,7 @@ struct rio_ops {
63646 int mbox, void *buffer, size_t len);
63647 int (*add_inb_buffer)(struct rio_mport *mport, int mbox, void *buf);
63648 void *(*get_inb_message)(struct rio_mport *mport, int mbox);
63649 -};
63650 +} __no_const;
63651
63652 #define RIO_RESOURCE_MEM 0x00000100
63653 #define RIO_RESOURCE_DOORBELL 0x00000200
63654 diff --git a/include/linux/rmap.h b/include/linux/rmap.h
63655 index 3fce545..b4fed6e 100644
63656 --- a/include/linux/rmap.h
63657 +++ b/include/linux/rmap.h
63658 @@ -119,9 +119,9 @@ static inline void anon_vma_unlock(struct anon_vma *anon_vma)
63659 void anon_vma_init(void); /* create anon_vma_cachep */
63660 int anon_vma_prepare(struct vm_area_struct *);
63661 void unlink_anon_vmas(struct vm_area_struct *);
63662 -int anon_vma_clone(struct vm_area_struct *, struct vm_area_struct *);
63663 +int anon_vma_clone(struct vm_area_struct *, const struct vm_area_struct *);
63664 void anon_vma_moveto_tail(struct vm_area_struct *);
63665 -int anon_vma_fork(struct vm_area_struct *, struct vm_area_struct *);
63666 +int anon_vma_fork(struct vm_area_struct *, const struct vm_area_struct *);
63667
63668 static inline void anon_vma_merge(struct vm_area_struct *vma,
63669 struct vm_area_struct *next)
63670 diff --git a/include/linux/sched.h b/include/linux/sched.h
63671 index 4a1f493..5812aeb 100644
63672 --- a/include/linux/sched.h
63673 +++ b/include/linux/sched.h
63674 @@ -101,6 +101,7 @@ struct bio_list;
63675 struct fs_struct;
63676 struct perf_event_context;
63677 struct blk_plug;
63678 +struct linux_binprm;
63679
63680 /*
63681 * List of flags we want to share for kernel threads,
63682 @@ -384,10 +385,13 @@ struct user_namespace;
63683 #define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
63684
63685 extern int sysctl_max_map_count;
63686 +extern unsigned long sysctl_heap_stack_gap;
63687
63688 #include <linux/aio.h>
63689
63690 #ifdef CONFIG_MMU
63691 +extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len);
63692 +extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len);
63693 extern void arch_pick_mmap_layout(struct mm_struct *mm);
63694 extern unsigned long
63695 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
63696 @@ -406,6 +410,11 @@ static inline void arch_pick_mmap_layout(struct mm_struct *mm) {}
63697 extern void set_dumpable(struct mm_struct *mm, int value);
63698 extern int get_dumpable(struct mm_struct *mm);
63699
63700 +/* get/set_dumpable() values */
63701 +#define SUID_DUMPABLE_DISABLED 0
63702 +#define SUID_DUMPABLE_ENABLED 1
63703 +#define SUID_DUMPABLE_SAFE 2
63704 +
63705 /* mm flags */
63706 /* dumpable bits */
63707 #define MMF_DUMPABLE 0 /* core dump is permitted */
63708 @@ -646,6 +655,17 @@ struct signal_struct {
63709 #ifdef CONFIG_TASKSTATS
63710 struct taskstats *stats;
63711 #endif
63712 +
63713 +#ifdef CONFIG_GRKERNSEC
63714 + u32 curr_ip;
63715 + u32 saved_ip;
63716 + u32 gr_saddr;
63717 + u32 gr_daddr;
63718 + u16 gr_sport;
63719 + u16 gr_dport;
63720 + u8 used_accept:1;
63721 +#endif
63722 +
63723 #ifdef CONFIG_AUDIT
63724 unsigned audit_tty;
63725 struct tty_audit_buf *tty_audit_buf;
63726 @@ -729,6 +749,11 @@ struct user_struct {
63727 struct key *session_keyring; /* UID's default session keyring */
63728 #endif
63729
63730 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
63731 + unsigned int banned;
63732 + unsigned long ban_expires;
63733 +#endif
63734 +
63735 /* Hash table maintenance information */
63736 struct hlist_node uidhash_node;
63737 kuid_t uid;
63738 @@ -1348,8 +1373,8 @@ struct task_struct {
63739 struct list_head thread_group;
63740
63741 struct completion *vfork_done; /* for vfork() */
63742 - int __user *set_child_tid; /* CLONE_CHILD_SETTID */
63743 - int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
63744 + pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
63745 + pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
63746
63747 cputime_t utime, stime, utimescaled, stimescaled;
63748 cputime_t gtime;
63749 @@ -1365,11 +1390,6 @@ struct task_struct {
63750 struct task_cputime cputime_expires;
63751 struct list_head cpu_timers[3];
63752
63753 -/* process credentials */
63754 - const struct cred __rcu *real_cred; /* objective and real subjective task
63755 - * credentials (COW) */
63756 - const struct cred __rcu *cred; /* effective (overridable) subjective task
63757 - * credentials (COW) */
63758 char comm[TASK_COMM_LEN]; /* executable name excluding path
63759 - access with [gs]et_task_comm (which lock
63760 it with task_lock())
63761 @@ -1386,8 +1406,16 @@ struct task_struct {
63762 #endif
63763 /* CPU-specific state of this task */
63764 struct thread_struct thread;
63765 +/* thread_info moved to task_struct */
63766 +#ifdef CONFIG_X86
63767 + struct thread_info tinfo;
63768 +#endif
63769 /* filesystem information */
63770 struct fs_struct *fs;
63771 +
63772 + const struct cred __rcu *cred; /* effective (overridable) subjective task
63773 + * credentials (COW) */
63774 +
63775 /* open file information */
63776 struct files_struct *files;
63777 /* namespaces */
63778 @@ -1431,6 +1459,11 @@ struct task_struct {
63779 struct rt_mutex_waiter *pi_blocked_on;
63780 #endif
63781
63782 +/* process credentials */
63783 + const struct cred __rcu *real_cred; /* objective and real subjective task
63784 + * credentials (COW) */
63785 + struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
63786 +
63787 #ifdef CONFIG_DEBUG_MUTEXES
63788 /* mutex deadlock detection */
63789 struct mutex_waiter *blocked_on;
63790 @@ -1547,6 +1580,27 @@ struct task_struct {
63791 unsigned long default_timer_slack_ns;
63792
63793 struct list_head *scm_work_list;
63794 +
63795 +#ifdef CONFIG_GRKERNSEC
63796 + /* grsecurity */
63797 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
63798 + u64 exec_id;
63799 +#endif
63800 +#ifdef CONFIG_GRKERNSEC_SETXID
63801 + const struct cred *delayed_cred;
63802 +#endif
63803 + struct dentry *gr_chroot_dentry;
63804 + struct acl_subject_label *acl;
63805 + struct acl_role_label *role;
63806 + struct file *exec_file;
63807 + u16 acl_role_id;
63808 + /* is this the task that authenticated to the special role */
63809 + u8 acl_sp_role;
63810 + u8 is_writable;
63811 + u8 brute;
63812 + u8 gr_is_chrooted;
63813 +#endif
63814 +
63815 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
63816 /* Index of current stored address in ret_stack */
63817 int curr_ret_stack;
63818 @@ -1585,6 +1639,51 @@ struct task_struct {
63819 #endif
63820 };
63821
63822 +#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
63823 +#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
63824 +#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
63825 +#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
63826 +/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
63827 +#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
63828 +
63829 +#ifdef CONFIG_PAX_SOFTMODE
63830 +extern int pax_softmode;
63831 +#endif
63832 +
63833 +extern int pax_check_flags(unsigned long *);
63834 +
63835 +/* if tsk != current then task_lock must be held on it */
63836 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
63837 +static inline unsigned long pax_get_flags(struct task_struct *tsk)
63838 +{
63839 + if (likely(tsk->mm))
63840 + return tsk->mm->pax_flags;
63841 + else
63842 + return 0UL;
63843 +}
63844 +
63845 +/* if tsk != current then task_lock must be held on it */
63846 +static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
63847 +{
63848 + if (likely(tsk->mm)) {
63849 + tsk->mm->pax_flags = flags;
63850 + return 0;
63851 + }
63852 + return -EINVAL;
63853 +}
63854 +#endif
63855 +
63856 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
63857 +extern void pax_set_initial_flags(struct linux_binprm *bprm);
63858 +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
63859 +extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
63860 +#endif
63861 +
63862 +extern void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
63863 +extern void pax_report_insns(struct pt_regs *regs, void *pc, void *sp);
63864 +extern void pax_report_refcount_overflow(struct pt_regs *regs);
63865 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
63866 +
63867 /* Future-safe accessor for struct task_struct's cpus_allowed. */
63868 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
63869
63870 @@ -2112,7 +2211,9 @@ void yield(void);
63871 extern struct exec_domain default_exec_domain;
63872
63873 union thread_union {
63874 +#ifndef CONFIG_X86
63875 struct thread_info thread_info;
63876 +#endif
63877 unsigned long stack[THREAD_SIZE/sizeof(long)];
63878 };
63879
63880 @@ -2145,6 +2246,7 @@ extern struct pid_namespace init_pid_ns;
63881 */
63882
63883 extern struct task_struct *find_task_by_vpid(pid_t nr);
63884 +extern struct task_struct *find_task_by_vpid_unrestricted(pid_t nr);
63885 extern struct task_struct *find_task_by_pid_ns(pid_t nr,
63886 struct pid_namespace *ns);
63887
63888 @@ -2301,7 +2403,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
63889 extern void exit_itimers(struct signal_struct *);
63890 extern void flush_itimer_signals(void);
63891
63892 -extern void do_group_exit(int);
63893 +extern __noreturn void do_group_exit(int);
63894
63895 extern void daemonize(const char *, ...);
63896 extern int allow_signal(int);
63897 @@ -2502,9 +2604,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
63898
63899 #endif
63900
63901 -static inline int object_is_on_stack(void *obj)
63902 +static inline int object_starts_on_stack(void *obj)
63903 {
63904 - void *stack = task_stack_page(current);
63905 + const void *stack = task_stack_page(current);
63906
63907 return (obj >= stack) && (obj < (stack + THREAD_SIZE));
63908 }
63909 diff --git a/include/linux/screen_info.h b/include/linux/screen_info.h
63910 index 899fbb4..1cb4138 100644
63911 --- a/include/linux/screen_info.h
63912 +++ b/include/linux/screen_info.h
63913 @@ -43,7 +43,8 @@ struct screen_info {
63914 __u16 pages; /* 0x32 */
63915 __u16 vesa_attributes; /* 0x34 */
63916 __u32 capabilities; /* 0x36 */
63917 - __u8 _reserved[6]; /* 0x3a */
63918 + __u16 vesapm_size; /* 0x3a */
63919 + __u8 _reserved[4]; /* 0x3c */
63920 } __attribute__((packed));
63921
63922 #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
63923 diff --git a/include/linux/security.h b/include/linux/security.h
63924 index 3dea6a9..81fd81f 100644
63925 --- a/include/linux/security.h
63926 +++ b/include/linux/security.h
63927 @@ -26,6 +26,7 @@
63928 #include <linux/capability.h>
63929 #include <linux/slab.h>
63930 #include <linux/err.h>
63931 +#include <linux/grsecurity.h>
63932
63933 struct linux_binprm;
63934 struct cred;
63935 diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
63936 index fc61854..d7c490b 100644
63937 --- a/include/linux/seq_file.h
63938 +++ b/include/linux/seq_file.h
63939 @@ -25,6 +25,9 @@ struct seq_file {
63940 struct mutex lock;
63941 const struct seq_operations *op;
63942 int poll_event;
63943 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
63944 + u64 exec_id;
63945 +#endif
63946 void *private;
63947 };
63948
63949 @@ -34,6 +37,7 @@ struct seq_operations {
63950 void * (*next) (struct seq_file *m, void *v, loff_t *pos);
63951 int (*show) (struct seq_file *m, void *v);
63952 };
63953 +typedef struct seq_operations __no_const seq_operations_no_const;
63954
63955 #define SEQ_SKIP 1
63956
63957 diff --git a/include/linux/shm.h b/include/linux/shm.h
63958 index 92808b8..c28cac4 100644
63959 --- a/include/linux/shm.h
63960 +++ b/include/linux/shm.h
63961 @@ -98,6 +98,10 @@ struct shmid_kernel /* private to the kernel */
63962
63963 /* The task created the shm object. NULL if the task is dead. */
63964 struct task_struct *shm_creator;
63965 +#ifdef CONFIG_GRKERNSEC
63966 + time_t shm_createtime;
63967 + pid_t shm_lapid;
63968 +#endif
63969 };
63970
63971 /* shm_mode upper byte flags */
63972 diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
63973 index 642cb73..2efdb98 100644
63974 --- a/include/linux/skbuff.h
63975 +++ b/include/linux/skbuff.h
63976 @@ -567,7 +567,7 @@ extern bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
63977 extern struct sk_buff *__alloc_skb(unsigned int size,
63978 gfp_t priority, int fclone, int node);
63979 extern struct sk_buff *build_skb(void *data, unsigned int frag_size);
63980 -static inline struct sk_buff *alloc_skb(unsigned int size,
63981 +static inline struct sk_buff * __intentional_overflow(0) alloc_skb(unsigned int size,
63982 gfp_t priority)
63983 {
63984 return __alloc_skb(size, priority, 0, NUMA_NO_NODE);
63985 @@ -680,7 +680,7 @@ static inline struct skb_shared_hwtstamps *skb_hwtstamps(struct sk_buff *skb)
63986 */
63987 static inline int skb_queue_empty(const struct sk_buff_head *list)
63988 {
63989 - return list->next == (struct sk_buff *)list;
63990 + return list->next == (const struct sk_buff *)list;
63991 }
63992
63993 /**
63994 @@ -693,7 +693,7 @@ static inline int skb_queue_empty(const struct sk_buff_head *list)
63995 static inline bool skb_queue_is_last(const struct sk_buff_head *list,
63996 const struct sk_buff *skb)
63997 {
63998 - return skb->next == (struct sk_buff *)list;
63999 + return skb->next == (const struct sk_buff *)list;
64000 }
64001
64002 /**
64003 @@ -706,7 +706,7 @@ static inline bool skb_queue_is_last(const struct sk_buff_head *list,
64004 static inline bool skb_queue_is_first(const struct sk_buff_head *list,
64005 const struct sk_buff *skb)
64006 {
64007 - return skb->prev == (struct sk_buff *)list;
64008 + return skb->prev == (const struct sk_buff *)list;
64009 }
64010
64011 /**
64012 @@ -1605,7 +1605,7 @@ static inline int pskb_network_may_pull(struct sk_buff *skb, unsigned int len)
64013 * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
64014 */
64015 #ifndef NET_SKB_PAD
64016 -#define NET_SKB_PAD max(32, L1_CACHE_BYTES)
64017 +#define NET_SKB_PAD max(_AC(32,UL), L1_CACHE_BYTES)
64018 #endif
64019
64020 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
64021 @@ -2112,7 +2112,7 @@ extern struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags,
64022 int noblock, int *err);
64023 extern unsigned int datagram_poll(struct file *file, struct socket *sock,
64024 struct poll_table_struct *wait);
64025 -extern int skb_copy_datagram_iovec(const struct sk_buff *from,
64026 +extern int __intentional_overflow(0) skb_copy_datagram_iovec(const struct sk_buff *from,
64027 int offset, struct iovec *to,
64028 int size);
64029 extern int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,
64030 diff --git a/include/linux/slab.h b/include/linux/slab.h
64031 index 67d5d94..bbd740b 100644
64032 --- a/include/linux/slab.h
64033 +++ b/include/linux/slab.h
64034 @@ -11,12 +11,20 @@
64035
64036 #include <linux/gfp.h>
64037 #include <linux/types.h>
64038 +#include <linux/err.h>
64039
64040 /*
64041 * Flags to pass to kmem_cache_create().
64042 * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
64043 */
64044 #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
64045 +
64046 +#ifdef CONFIG_PAX_USERCOPY_SLABS
64047 +#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
64048 +#else
64049 +#define SLAB_USERCOPY 0x00000000UL
64050 +#endif
64051 +
64052 #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
64053 #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
64054 #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
64055 @@ -87,10 +95,13 @@
64056 * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
64057 * Both make kfree a no-op.
64058 */
64059 -#define ZERO_SIZE_PTR ((void *)16)
64060 +#define ZERO_SIZE_PTR \
64061 +({ \
64062 + BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
64063 + (void *)(-MAX_ERRNO-1L); \
64064 +})
64065
64066 -#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
64067 - (unsigned long)ZERO_SIZE_PTR)
64068 +#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
64069
64070 /*
64071 * struct kmem_cache related prototypes
64072 @@ -161,6 +172,8 @@ void * __must_check krealloc(const void *, size_t, gfp_t);
64073 void kfree(const void *);
64074 void kzfree(const void *);
64075 size_t ksize(const void *);
64076 +const char *check_heap_object(const void *ptr, unsigned long n, bool to);
64077 +bool is_usercopy_object(const void *ptr);
64078
64079 /*
64080 * Allocator specific definitions. These are mainly used to establish optimized
64081 @@ -298,7 +311,7 @@ static inline void *kmem_cache_alloc_node(struct kmem_cache *cachep,
64082 */
64083 #if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_SLUB) || \
64084 (defined(CONFIG_SLAB) && defined(CONFIG_TRACING))
64085 -extern void *__kmalloc_track_caller(size_t, gfp_t, unsigned long);
64086 +extern void *__kmalloc_track_caller(size_t, gfp_t, unsigned long) __size_overflow(1);
64087 #define kmalloc_track_caller(size, flags) \
64088 __kmalloc_track_caller(size, flags, _RET_IP_)
64089 #else
64090 @@ -317,7 +330,7 @@ extern void *__kmalloc_track_caller(size_t, gfp_t, unsigned long);
64091 */
64092 #if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_SLUB) || \
64093 (defined(CONFIG_SLAB) && defined(CONFIG_TRACING))
64094 -extern void *__kmalloc_node_track_caller(size_t, gfp_t, int, unsigned long);
64095 +extern void *__kmalloc_node_track_caller(size_t, gfp_t, int, unsigned long) __size_overflow(1);
64096 #define kmalloc_node_track_caller(size, flags, node) \
64097 __kmalloc_node_track_caller(size, flags, node, \
64098 _RET_IP_)
64099 diff --git a/include/linux/slab_def.h b/include/linux/slab_def.h
64100 index fbd1117..0a3d314 100644
64101 --- a/include/linux/slab_def.h
64102 +++ b/include/linux/slab_def.h
64103 @@ -66,10 +66,10 @@ struct kmem_cache {
64104 unsigned long node_allocs;
64105 unsigned long node_frees;
64106 unsigned long node_overflow;
64107 - atomic_t allochit;
64108 - atomic_t allocmiss;
64109 - atomic_t freehit;
64110 - atomic_t freemiss;
64111 + atomic_unchecked_t allochit;
64112 + atomic_unchecked_t allocmiss;
64113 + atomic_unchecked_t freehit;
64114 + atomic_unchecked_t freemiss;
64115
64116 /*
64117 * If debugging is enabled, then the allocator can add additional
64118 @@ -103,11 +103,16 @@ struct cache_sizes {
64119 #ifdef CONFIG_ZONE_DMA
64120 struct kmem_cache *cs_dmacachep;
64121 #endif
64122 +
64123 +#ifdef CONFIG_PAX_USERCOPY_SLABS
64124 + struct kmem_cache *cs_usercopycachep;
64125 +#endif
64126 +
64127 };
64128 extern struct cache_sizes malloc_sizes[];
64129
64130 void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
64131 -void *__kmalloc(size_t size, gfp_t flags);
64132 +void *__kmalloc(size_t size, gfp_t flags) __size_overflow(1);
64133
64134 #ifdef CONFIG_TRACING
64135 extern void *kmem_cache_alloc_trace(size_t size,
64136 @@ -150,6 +155,13 @@ found:
64137 cachep = malloc_sizes[i].cs_dmacachep;
64138 else
64139 #endif
64140 +
64141 +#ifdef CONFIG_PAX_USERCOPY_SLABS
64142 + if (flags & GFP_USERCOPY)
64143 + cachep = malloc_sizes[i].cs_usercopycachep;
64144 + else
64145 +#endif
64146 +
64147 cachep = malloc_sizes[i].cs_cachep;
64148
64149 ret = kmem_cache_alloc_trace(size, cachep, flags);
64150 @@ -160,7 +172,7 @@ found:
64151 }
64152
64153 #ifdef CONFIG_NUMA
64154 -extern void *__kmalloc_node(size_t size, gfp_t flags, int node);
64155 +extern void *__kmalloc_node(size_t size, gfp_t flags, int node) __size_overflow(1);
64156 extern void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node);
64157
64158 #ifdef CONFIG_TRACING
64159 @@ -203,6 +215,13 @@ found:
64160 cachep = malloc_sizes[i].cs_dmacachep;
64161 else
64162 #endif
64163 +
64164 +#ifdef CONFIG_PAX_USERCOPY_SLABS
64165 + if (flags & GFP_USERCOPY)
64166 + cachep = malloc_sizes[i].cs_usercopycachep;
64167 + else
64168 +#endif
64169 +
64170 cachep = malloc_sizes[i].cs_cachep;
64171
64172 return kmem_cache_alloc_node_trace(size, cachep, flags, node);
64173 diff --git a/include/linux/slob_def.h b/include/linux/slob_def.h
64174 index 0ec00b3..22b4715 100644
64175 --- a/include/linux/slob_def.h
64176 +++ b/include/linux/slob_def.h
64177 @@ -9,7 +9,7 @@ static __always_inline void *kmem_cache_alloc(struct kmem_cache *cachep,
64178 return kmem_cache_alloc_node(cachep, flags, -1);
64179 }
64180
64181 -void *__kmalloc_node(size_t size, gfp_t flags, int node);
64182 +void *__kmalloc_node(size_t size, gfp_t flags, int node) __size_overflow(1);
64183
64184 static __always_inline void *kmalloc_node(size_t size, gfp_t flags, int node)
64185 {
64186 @@ -29,7 +29,7 @@ static __always_inline void *kmalloc(size_t size, gfp_t flags)
64187 return __kmalloc_node(size, flags, -1);
64188 }
64189
64190 -static __always_inline void *__kmalloc(size_t size, gfp_t flags)
64191 +static __always_inline __size_overflow(1) void *__kmalloc(size_t size, gfp_t flags)
64192 {
64193 return kmalloc(size, flags);
64194 }
64195 diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
64196 index c2f8c8b..d992a41 100644
64197 --- a/include/linux/slub_def.h
64198 +++ b/include/linux/slub_def.h
64199 @@ -92,7 +92,7 @@ struct kmem_cache {
64200 struct kmem_cache_order_objects max;
64201 struct kmem_cache_order_objects min;
64202 gfp_t allocflags; /* gfp flags to use on each alloc */
64203 - int refcount; /* Refcount for slab cache destroy */
64204 + atomic_t refcount; /* Refcount for slab cache destroy */
64205 void (*ctor)(void *);
64206 int inuse; /* Offset to metadata */
64207 int align; /* Alignment */
64208 @@ -153,7 +153,7 @@ extern struct kmem_cache *kmalloc_caches[SLUB_PAGE_SHIFT];
64209 * Sorry that the following has to be that ugly but some versions of GCC
64210 * have trouble with constant propagation and loops.
64211 */
64212 -static __always_inline int kmalloc_index(size_t size)
64213 +static __always_inline __size_overflow(1) int kmalloc_index(size_t size)
64214 {
64215 if (!size)
64216 return 0;
64217 @@ -218,7 +218,7 @@ static __always_inline struct kmem_cache *kmalloc_slab(size_t size)
64218 }
64219
64220 void *kmem_cache_alloc(struct kmem_cache *, gfp_t);
64221 -void *__kmalloc(size_t size, gfp_t flags);
64222 +void *__kmalloc(size_t size, gfp_t flags) __alloc_size(1) __size_overflow(1);
64223
64224 static __always_inline void *
64225 kmalloc_order(size_t size, gfp_t flags, unsigned int order)
64226 @@ -259,7 +259,7 @@ kmalloc_order_trace(size_t size, gfp_t flags, unsigned int order)
64227 }
64228 #endif
64229
64230 -static __always_inline void *kmalloc_large(size_t size, gfp_t flags)
64231 +static __always_inline __size_overflow(1) void *kmalloc_large(size_t size, gfp_t flags)
64232 {
64233 unsigned int order = get_order(size);
64234 return kmalloc_order_trace(size, flags, order);
64235 @@ -284,7 +284,7 @@ static __always_inline void *kmalloc(size_t size, gfp_t flags)
64236 }
64237
64238 #ifdef CONFIG_NUMA
64239 -void *__kmalloc_node(size_t size, gfp_t flags, int node);
64240 +void *__kmalloc_node(size_t size, gfp_t flags, int node) __size_overflow(1);
64241 void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node);
64242
64243 #ifdef CONFIG_TRACING
64244 diff --git a/include/linux/sonet.h b/include/linux/sonet.h
64245 index de8832d..0147b46 100644
64246 --- a/include/linux/sonet.h
64247 +++ b/include/linux/sonet.h
64248 @@ -61,7 +61,7 @@ struct sonet_stats {
64249 #include <linux/atomic.h>
64250
64251 struct k_sonet_stats {
64252 -#define __HANDLE_ITEM(i) atomic_t i
64253 +#define __HANDLE_ITEM(i) atomic_unchecked_t i
64254 __SONET_ITEMS
64255 #undef __HANDLE_ITEM
64256 };
64257 diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
64258 index 523547e..2cb7140 100644
64259 --- a/include/linux/sunrpc/clnt.h
64260 +++ b/include/linux/sunrpc/clnt.h
64261 @@ -174,9 +174,9 @@ static inline unsigned short rpc_get_port(const struct sockaddr *sap)
64262 {
64263 switch (sap->sa_family) {
64264 case AF_INET:
64265 - return ntohs(((struct sockaddr_in *)sap)->sin_port);
64266 + return ntohs(((const struct sockaddr_in *)sap)->sin_port);
64267 case AF_INET6:
64268 - return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
64269 + return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
64270 }
64271 return 0;
64272 }
64273 @@ -209,7 +209,7 @@ static inline bool __rpc_cmp_addr4(const struct sockaddr *sap1,
64274 static inline bool __rpc_copy_addr4(struct sockaddr *dst,
64275 const struct sockaddr *src)
64276 {
64277 - const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
64278 + const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
64279 struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
64280
64281 dsin->sin_family = ssin->sin_family;
64282 @@ -312,7 +312,7 @@ static inline u32 rpc_get_scope_id(const struct sockaddr *sa)
64283 if (sa->sa_family != AF_INET6)
64284 return 0;
64285
64286 - return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
64287 + return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
64288 }
64289
64290 #endif /* __KERNEL__ */
64291 diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
64292 index dc0c3cc..8503fb6 100644
64293 --- a/include/linux/sunrpc/sched.h
64294 +++ b/include/linux/sunrpc/sched.h
64295 @@ -106,6 +106,7 @@ struct rpc_call_ops {
64296 void (*rpc_count_stats)(struct rpc_task *, void *);
64297 void (*rpc_release)(void *);
64298 };
64299 +typedef struct rpc_call_ops __no_const rpc_call_ops_no_const;
64300
64301 struct rpc_task_setup {
64302 struct rpc_task *task;
64303 diff --git a/include/linux/sunrpc/svc_rdma.h b/include/linux/sunrpc/svc_rdma.h
64304 index 0b8e3e6..33e0a01 100644
64305 --- a/include/linux/sunrpc/svc_rdma.h
64306 +++ b/include/linux/sunrpc/svc_rdma.h
64307 @@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
64308 extern unsigned int svcrdma_max_requests;
64309 extern unsigned int svcrdma_max_req_size;
64310
64311 -extern atomic_t rdma_stat_recv;
64312 -extern atomic_t rdma_stat_read;
64313 -extern atomic_t rdma_stat_write;
64314 -extern atomic_t rdma_stat_sq_starve;
64315 -extern atomic_t rdma_stat_rq_starve;
64316 -extern atomic_t rdma_stat_rq_poll;
64317 -extern atomic_t rdma_stat_rq_prod;
64318 -extern atomic_t rdma_stat_sq_poll;
64319 -extern atomic_t rdma_stat_sq_prod;
64320 +extern atomic_unchecked_t rdma_stat_recv;
64321 +extern atomic_unchecked_t rdma_stat_read;
64322 +extern atomic_unchecked_t rdma_stat_write;
64323 +extern atomic_unchecked_t rdma_stat_sq_starve;
64324 +extern atomic_unchecked_t rdma_stat_rq_starve;
64325 +extern atomic_unchecked_t rdma_stat_rq_poll;
64326 +extern atomic_unchecked_t rdma_stat_rq_prod;
64327 +extern atomic_unchecked_t rdma_stat_sq_poll;
64328 +extern atomic_unchecked_t rdma_stat_sq_prod;
64329
64330 #define RPCRDMA_VERSION 1
64331
64332 diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
64333 index c34b4c8..a65b67d 100644
64334 --- a/include/linux/sysctl.h
64335 +++ b/include/linux/sysctl.h
64336 @@ -155,7 +155,11 @@ enum
64337 KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
64338 };
64339
64340 -
64341 +#ifdef CONFIG_PAX_SOFTMODE
64342 +enum {
64343 + PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
64344 +};
64345 +#endif
64346
64347 /* CTL_VM names: */
64348 enum
64349 @@ -948,6 +952,8 @@ typedef int proc_handler (struct ctl_table *ctl, int write,
64350
64351 extern int proc_dostring(struct ctl_table *, int,
64352 void __user *, size_t *, loff_t *);
64353 +extern int proc_dostring_modpriv(struct ctl_table *, int,
64354 + void __user *, size_t *, loff_t *);
64355 extern int proc_dointvec(struct ctl_table *, int,
64356 void __user *, size_t *, loff_t *);
64357 extern int proc_dointvec_minmax(struct ctl_table *, int,
64358 diff --git a/include/linux/tty.h b/include/linux/tty.h
64359 index 9f47ab5..73da944 100644
64360 --- a/include/linux/tty.h
64361 +++ b/include/linux/tty.h
64362 @@ -225,7 +225,7 @@ struct tty_port {
64363 const struct tty_port_operations *ops; /* Port operations */
64364 spinlock_t lock; /* Lock protecting tty field */
64365 int blocked_open; /* Waiting to open */
64366 - int count; /* Usage count */
64367 + atomic_t count; /* Usage count */
64368 wait_queue_head_t open_wait; /* Open waiters */
64369 wait_queue_head_t close_wait; /* Close waiters */
64370 wait_queue_head_t delta_msr_wait; /* Modem status change */
64371 @@ -525,7 +525,7 @@ extern int tty_port_open(struct tty_port *port,
64372 struct tty_struct *tty, struct file *filp);
64373 static inline int tty_port_users(struct tty_port *port)
64374 {
64375 - return port->count + port->blocked_open;
64376 + return atomic_read(&port->count) + port->blocked_open;
64377 }
64378
64379 extern int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc);
64380 diff --git a/include/linux/tty_ldisc.h b/include/linux/tty_ldisc.h
64381 index fb79dd8d..07d4773 100644
64382 --- a/include/linux/tty_ldisc.h
64383 +++ b/include/linux/tty_ldisc.h
64384 @@ -149,7 +149,7 @@ struct tty_ldisc_ops {
64385
64386 struct module *owner;
64387
64388 - int refcount;
64389 + atomic_t refcount;
64390 };
64391
64392 struct tty_ldisc {
64393 diff --git a/include/linux/types.h b/include/linux/types.h
64394 index 9c1bd53..c2370f6 100644
64395 --- a/include/linux/types.h
64396 +++ b/include/linux/types.h
64397 @@ -220,10 +220,26 @@ typedef struct {
64398 int counter;
64399 } atomic_t;
64400
64401 +#ifdef CONFIG_PAX_REFCOUNT
64402 +typedef struct {
64403 + int counter;
64404 +} atomic_unchecked_t;
64405 +#else
64406 +typedef atomic_t atomic_unchecked_t;
64407 +#endif
64408 +
64409 #ifdef CONFIG_64BIT
64410 typedef struct {
64411 long counter;
64412 } atomic64_t;
64413 +
64414 +#ifdef CONFIG_PAX_REFCOUNT
64415 +typedef struct {
64416 + long counter;
64417 +} atomic64_unchecked_t;
64418 +#else
64419 +typedef atomic64_t atomic64_unchecked_t;
64420 +#endif
64421 #endif
64422
64423 struct list_head {
64424 diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
64425 index 5ca0951..ab496a5 100644
64426 --- a/include/linux/uaccess.h
64427 +++ b/include/linux/uaccess.h
64428 @@ -76,11 +76,11 @@ static inline unsigned long __copy_from_user_nocache(void *to,
64429 long ret; \
64430 mm_segment_t old_fs = get_fs(); \
64431 \
64432 - set_fs(KERNEL_DS); \
64433 pagefault_disable(); \
64434 - ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
64435 - pagefault_enable(); \
64436 + set_fs(KERNEL_DS); \
64437 + ret = __copy_from_user_inatomic(&(retval), (typeof(retval) __force_user *)(addr), sizeof(retval)); \
64438 set_fs(old_fs); \
64439 + pagefault_enable(); \
64440 ret; \
64441 })
64442
64443 diff --git a/include/linux/unaligned/access_ok.h b/include/linux/unaligned/access_ok.h
64444 index 99c1b4d..bb94261 100644
64445 --- a/include/linux/unaligned/access_ok.h
64446 +++ b/include/linux/unaligned/access_ok.h
64447 @@ -6,32 +6,32 @@
64448
64449 static inline u16 get_unaligned_le16(const void *p)
64450 {
64451 - return le16_to_cpup((__le16 *)p);
64452 + return le16_to_cpup((const __le16 *)p);
64453 }
64454
64455 static inline u32 get_unaligned_le32(const void *p)
64456 {
64457 - return le32_to_cpup((__le32 *)p);
64458 + return le32_to_cpup((const __le32 *)p);
64459 }
64460
64461 static inline u64 get_unaligned_le64(const void *p)
64462 {
64463 - return le64_to_cpup((__le64 *)p);
64464 + return le64_to_cpup((const __le64 *)p);
64465 }
64466
64467 static inline u16 get_unaligned_be16(const void *p)
64468 {
64469 - return be16_to_cpup((__be16 *)p);
64470 + return be16_to_cpup((const __be16 *)p);
64471 }
64472
64473 static inline u32 get_unaligned_be32(const void *p)
64474 {
64475 - return be32_to_cpup((__be32 *)p);
64476 + return be32_to_cpup((const __be32 *)p);
64477 }
64478
64479 static inline u64 get_unaligned_be64(const void *p)
64480 {
64481 - return be64_to_cpup((__be64 *)p);
64482 + return be64_to_cpup((const __be64 *)p);
64483 }
64484
64485 static inline void put_unaligned_le16(u16 val, void *p)
64486 diff --git a/include/linux/usb/renesas_usbhs.h b/include/linux/usb/renesas_usbhs.h
64487 index 547e59c..db6ad19 100644
64488 --- a/include/linux/usb/renesas_usbhs.h
64489 +++ b/include/linux/usb/renesas_usbhs.h
64490 @@ -39,7 +39,7 @@ enum {
64491 */
64492 struct renesas_usbhs_driver_callback {
64493 int (*notify_hotplug)(struct platform_device *pdev);
64494 -};
64495 +} __no_const;
64496
64497 /*
64498 * callback functions for platform
64499 @@ -97,7 +97,7 @@ struct renesas_usbhs_platform_callback {
64500 * VBUS control is needed for Host
64501 */
64502 int (*set_vbus)(struct platform_device *pdev, int enable);
64503 -};
64504 +} __no_const;
64505
64506 /*
64507 * parameters for renesas usbhs
64508 diff --git a/include/linux/vermagic.h b/include/linux/vermagic.h
64509 index 6f8fbcf..8259001 100644
64510 --- a/include/linux/vermagic.h
64511 +++ b/include/linux/vermagic.h
64512 @@ -25,9 +25,35 @@
64513 #define MODULE_ARCH_VERMAGIC ""
64514 #endif
64515
64516 +#ifdef CONFIG_PAX_REFCOUNT
64517 +#define MODULE_PAX_REFCOUNT "REFCOUNT "
64518 +#else
64519 +#define MODULE_PAX_REFCOUNT ""
64520 +#endif
64521 +
64522 +#ifdef CONSTIFY_PLUGIN
64523 +#define MODULE_CONSTIFY_PLUGIN "CONSTIFY_PLUGIN "
64524 +#else
64525 +#define MODULE_CONSTIFY_PLUGIN ""
64526 +#endif
64527 +
64528 +#ifdef STACKLEAK_PLUGIN
64529 +#define MODULE_STACKLEAK_PLUGIN "STACKLEAK_PLUGIN "
64530 +#else
64531 +#define MODULE_STACKLEAK_PLUGIN ""
64532 +#endif
64533 +
64534 +#ifdef CONFIG_GRKERNSEC
64535 +#define MODULE_GRSEC "GRSEC "
64536 +#else
64537 +#define MODULE_GRSEC ""
64538 +#endif
64539 +
64540 #define VERMAGIC_STRING \
64541 UTS_RELEASE " " \
64542 MODULE_VERMAGIC_SMP MODULE_VERMAGIC_PREEMPT \
64543 MODULE_VERMAGIC_MODULE_UNLOAD MODULE_VERMAGIC_MODVERSIONS \
64544 - MODULE_ARCH_VERMAGIC
64545 + MODULE_ARCH_VERMAGIC \
64546 + MODULE_PAX_REFCOUNT MODULE_CONSTIFY_PLUGIN MODULE_STACKLEAK_PLUGIN \
64547 + MODULE_GRSEC
64548
64549 diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
64550 index dcdfc2b..ec79ab5 100644
64551 --- a/include/linux/vmalloc.h
64552 +++ b/include/linux/vmalloc.h
64553 @@ -14,6 +14,11 @@ struct vm_area_struct; /* vma defining user mapping in mm_types.h */
64554 #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
64555 #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
64556 #define VM_UNLIST 0x00000020 /* vm_struct is not listed in vmlist */
64557 +
64558 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
64559 +#define VM_KERNEXEC 0x00000040 /* allocate from executable kernel memory range */
64560 +#endif
64561 +
64562 /* bits [20..32] reserved for arch specific ioremap internals */
64563
64564 /*
64565 @@ -62,7 +67,7 @@ extern void *vmalloc_32_user(unsigned long size);
64566 extern void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot);
64567 extern void *__vmalloc_node_range(unsigned long size, unsigned long align,
64568 unsigned long start, unsigned long end, gfp_t gfp_mask,
64569 - pgprot_t prot, int node, void *caller);
64570 + pgprot_t prot, int node, void *caller) __size_overflow(1);
64571 extern void vfree(const void *addr);
64572
64573 extern void *vmap(struct page **pages, unsigned int count,
64574 @@ -123,8 +128,8 @@ extern struct vm_struct *alloc_vm_area(size_t size, pte_t **ptes);
64575 extern void free_vm_area(struct vm_struct *area);
64576
64577 /* for /dev/kmem */
64578 -extern long vread(char *buf, char *addr, unsigned long count);
64579 -extern long vwrite(char *buf, char *addr, unsigned long count);
64580 +extern long vread(char *buf, char *addr, unsigned long count) __size_overflow(3);
64581 +extern long vwrite(char *buf, char *addr, unsigned long count) __size_overflow(3);
64582
64583 /*
64584 * Internals. Dont't use..
64585 diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
64586 index 65efb92..137adbb 100644
64587 --- a/include/linux/vmstat.h
64588 +++ b/include/linux/vmstat.h
64589 @@ -87,18 +87,18 @@ static inline void vm_events_fold_cpu(int cpu)
64590 /*
64591 * Zone based page accounting with per cpu differentials.
64592 */
64593 -extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
64594 +extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
64595
64596 static inline void zone_page_state_add(long x, struct zone *zone,
64597 enum zone_stat_item item)
64598 {
64599 - atomic_long_add(x, &zone->vm_stat[item]);
64600 - atomic_long_add(x, &vm_stat[item]);
64601 + atomic_long_add_unchecked(x, &zone->vm_stat[item]);
64602 + atomic_long_add_unchecked(x, &vm_stat[item]);
64603 }
64604
64605 static inline unsigned long global_page_state(enum zone_stat_item item)
64606 {
64607 - long x = atomic_long_read(&vm_stat[item]);
64608 + long x = atomic_long_read_unchecked(&vm_stat[item]);
64609 #ifdef CONFIG_SMP
64610 if (x < 0)
64611 x = 0;
64612 @@ -109,7 +109,7 @@ static inline unsigned long global_page_state(enum zone_stat_item item)
64613 static inline unsigned long zone_page_state(struct zone *zone,
64614 enum zone_stat_item item)
64615 {
64616 - long x = atomic_long_read(&zone->vm_stat[item]);
64617 + long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
64618 #ifdef CONFIG_SMP
64619 if (x < 0)
64620 x = 0;
64621 @@ -126,7 +126,7 @@ static inline unsigned long zone_page_state(struct zone *zone,
64622 static inline unsigned long zone_page_state_snapshot(struct zone *zone,
64623 enum zone_stat_item item)
64624 {
64625 - long x = atomic_long_read(&zone->vm_stat[item]);
64626 + long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
64627
64628 #ifdef CONFIG_SMP
64629 int cpu;
64630 @@ -221,8 +221,8 @@ static inline void __mod_zone_page_state(struct zone *zone,
64631
64632 static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
64633 {
64634 - atomic_long_inc(&zone->vm_stat[item]);
64635 - atomic_long_inc(&vm_stat[item]);
64636 + atomic_long_inc_unchecked(&zone->vm_stat[item]);
64637 + atomic_long_inc_unchecked(&vm_stat[item]);
64638 }
64639
64640 static inline void __inc_zone_page_state(struct page *page,
64641 @@ -233,8 +233,8 @@ static inline void __inc_zone_page_state(struct page *page,
64642
64643 static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
64644 {
64645 - atomic_long_dec(&zone->vm_stat[item]);
64646 - atomic_long_dec(&vm_stat[item]);
64647 + atomic_long_dec_unchecked(&zone->vm_stat[item]);
64648 + atomic_long_dec_unchecked(&vm_stat[item]);
64649 }
64650
64651 static inline void __dec_zone_page_state(struct page *page,
64652 diff --git a/include/linux/xattr.h b/include/linux/xattr.h
64653 index e5d1220..ef6e406 100644
64654 --- a/include/linux/xattr.h
64655 +++ b/include/linux/xattr.h
64656 @@ -57,6 +57,11 @@
64657 #define XATTR_POSIX_ACL_DEFAULT "posix_acl_default"
64658 #define XATTR_NAME_POSIX_ACL_DEFAULT XATTR_SYSTEM_PREFIX XATTR_POSIX_ACL_DEFAULT
64659
64660 +/* User namespace */
64661 +#define XATTR_PAX_PREFIX XATTR_USER_PREFIX "pax."
64662 +#define XATTR_PAX_FLAGS_SUFFIX "flags"
64663 +#define XATTR_NAME_PAX_FLAGS XATTR_PAX_PREFIX XATTR_PAX_FLAGS_SUFFIX
64664 +
64665 #ifdef __KERNEL__
64666
64667 #include <linux/types.h>
64668 diff --git a/include/media/saa7146_vv.h b/include/media/saa7146_vv.h
64669 index 944ecdf..a3994fc 100644
64670 --- a/include/media/saa7146_vv.h
64671 +++ b/include/media/saa7146_vv.h
64672 @@ -161,8 +161,8 @@ struct saa7146_ext_vv
64673 int (*std_callback)(struct saa7146_dev*, struct saa7146_standard *);
64674
64675 /* the extension can override this */
64676 - struct v4l2_ioctl_ops vid_ops;
64677 - struct v4l2_ioctl_ops vbi_ops;
64678 + v4l2_ioctl_ops_no_const vid_ops;
64679 + v4l2_ioctl_ops_no_const vbi_ops;
64680 /* pointer to the saa7146 core ops */
64681 const struct v4l2_ioctl_ops *core_ops;
64682
64683 diff --git a/include/media/v4l2-dev.h b/include/media/v4l2-dev.h
64684 index a056e6e..31023a5 100644
64685 --- a/include/media/v4l2-dev.h
64686 +++ b/include/media/v4l2-dev.h
64687 @@ -73,7 +73,8 @@ struct v4l2_file_operations {
64688 int (*mmap) (struct file *, struct vm_area_struct *);
64689 int (*open) (struct file *);
64690 int (*release) (struct file *);
64691 -};
64692 +} __do_const;
64693 +typedef struct v4l2_file_operations __no_const v4l2_file_operations_no_const;
64694
64695 /*
64696 * Newer version of video_device, handled by videodev2.c
64697 diff --git a/include/media/v4l2-ioctl.h b/include/media/v4l2-ioctl.h
64698 index d8b76f7..7d5aa18 100644
64699 --- a/include/media/v4l2-ioctl.h
64700 +++ b/include/media/v4l2-ioctl.h
64701 @@ -287,7 +287,7 @@ struct v4l2_ioctl_ops {
64702 long (*vidioc_default) (struct file *file, void *fh,
64703 bool valid_prio, int cmd, void *arg);
64704 };
64705 -
64706 +typedef struct v4l2_ioctl_ops __no_const v4l2_ioctl_ops_no_const;
64707
64708 /* v4l debugging and diagnostics */
64709
64710 diff --git a/include/net/caif/caif_hsi.h b/include/net/caif/caif_hsi.h
64711 index 439dadc..1c67e3f 100644
64712 --- a/include/net/caif/caif_hsi.h
64713 +++ b/include/net/caif/caif_hsi.h
64714 @@ -98,7 +98,7 @@ struct cfhsi_drv {
64715 void (*rx_done_cb) (struct cfhsi_drv *drv);
64716 void (*wake_up_cb) (struct cfhsi_drv *drv);
64717 void (*wake_down_cb) (struct cfhsi_drv *drv);
64718 -};
64719 +} __no_const;
64720
64721 /* Structure implemented by HSI device. */
64722 struct cfhsi_dev {
64723 diff --git a/include/net/caif/cfctrl.h b/include/net/caif/cfctrl.h
64724 index 9e5425b..8136ffc 100644
64725 --- a/include/net/caif/cfctrl.h
64726 +++ b/include/net/caif/cfctrl.h
64727 @@ -52,7 +52,7 @@ struct cfctrl_rsp {
64728 void (*radioset_rsp)(void);
64729 void (*reject_rsp)(struct cflayer *layer, u8 linkid,
64730 struct cflayer *client_layer);
64731 -};
64732 +} __no_const;
64733
64734 /* Link Setup Parameters for CAIF-Links. */
64735 struct cfctrl_link_param {
64736 @@ -101,8 +101,8 @@ struct cfctrl_request_info {
64737 struct cfctrl {
64738 struct cfsrvl serv;
64739 struct cfctrl_rsp res;
64740 - atomic_t req_seq_no;
64741 - atomic_t rsp_seq_no;
64742 + atomic_unchecked_t req_seq_no;
64743 + atomic_unchecked_t rsp_seq_no;
64744 struct list_head list;
64745 /* Protects from simultaneous access to first_req list */
64746 spinlock_t info_list_lock;
64747 diff --git a/include/net/flow.h b/include/net/flow.h
64748 index 6c469db..7743b8e 100644
64749 --- a/include/net/flow.h
64750 +++ b/include/net/flow.h
64751 @@ -221,6 +221,6 @@ extern struct flow_cache_object *flow_cache_lookup(
64752
64753 extern void flow_cache_flush(void);
64754 extern void flow_cache_flush_deferred(void);
64755 -extern atomic_t flow_cache_genid;
64756 +extern atomic_unchecked_t flow_cache_genid;
64757
64758 #endif
64759 diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
64760 index 2040bff..f4c0733 100644
64761 --- a/include/net/inetpeer.h
64762 +++ b/include/net/inetpeer.h
64763 @@ -51,8 +51,8 @@ struct inet_peer {
64764 */
64765 union {
64766 struct {
64767 - atomic_t rid; /* Frag reception counter */
64768 - atomic_t ip_id_count; /* IP ID for the next packet */
64769 + atomic_unchecked_t rid; /* Frag reception counter */
64770 + atomic_unchecked_t ip_id_count; /* IP ID for the next packet */
64771 __u32 tcp_ts;
64772 __u32 tcp_ts_stamp;
64773 };
64774 @@ -118,11 +118,11 @@ static inline int inet_getid(struct inet_peer *p, int more)
64775 more++;
64776 inet_peer_refcheck(p);
64777 do {
64778 - old = atomic_read(&p->ip_id_count);
64779 + old = atomic_read_unchecked(&p->ip_id_count);
64780 new = old + more;
64781 if (!new)
64782 new = 1;
64783 - } while (atomic_cmpxchg(&p->ip_id_count, old, new) != old);
64784 + } while (atomic_cmpxchg_unchecked(&p->ip_id_count, old, new) != old);
64785 return new;
64786 }
64787
64788 diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
64789 index 78df0866..00e5c9b 100644
64790 --- a/include/net/ip_fib.h
64791 +++ b/include/net/ip_fib.h
64792 @@ -146,7 +146,7 @@ extern __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh);
64793
64794 #define FIB_RES_SADDR(net, res) \
64795 ((FIB_RES_NH(res).nh_saddr_genid == \
64796 - atomic_read(&(net)->ipv4.dev_addr_genid)) ? \
64797 + atomic_read_unchecked(&(net)->ipv4.dev_addr_genid)) ? \
64798 FIB_RES_NH(res).nh_saddr : \
64799 fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
64800 #define FIB_RES_GW(res) (FIB_RES_NH(res).nh_gw)
64801 diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
64802 index 95374d1..2300e36 100644
64803 --- a/include/net/ip_vs.h
64804 +++ b/include/net/ip_vs.h
64805 @@ -510,7 +510,7 @@ struct ip_vs_conn {
64806 struct ip_vs_conn *control; /* Master control connection */
64807 atomic_t n_control; /* Number of controlled ones */
64808 struct ip_vs_dest *dest; /* real server */
64809 - atomic_t in_pkts; /* incoming packet counter */
64810 + atomic_unchecked_t in_pkts; /* incoming packet counter */
64811
64812 /* packet transmitter for different forwarding methods. If it
64813 mangles the packet, it must return NF_DROP or better NF_STOLEN,
64814 @@ -648,7 +648,7 @@ struct ip_vs_dest {
64815 __be16 port; /* port number of the server */
64816 union nf_inet_addr addr; /* IP address of the server */
64817 volatile unsigned int flags; /* dest status flags */
64818 - atomic_t conn_flags; /* flags to copy to conn */
64819 + atomic_unchecked_t conn_flags; /* flags to copy to conn */
64820 atomic_t weight; /* server weight */
64821
64822 atomic_t refcnt; /* reference counter */
64823 diff --git a/include/net/irda/ircomm_core.h b/include/net/irda/ircomm_core.h
64824 index 69b610a..fe3962c 100644
64825 --- a/include/net/irda/ircomm_core.h
64826 +++ b/include/net/irda/ircomm_core.h
64827 @@ -51,7 +51,7 @@ typedef struct {
64828 int (*connect_response)(struct ircomm_cb *, struct sk_buff *);
64829 int (*disconnect_request)(struct ircomm_cb *, struct sk_buff *,
64830 struct ircomm_info *);
64831 -} call_t;
64832 +} __no_const call_t;
64833
64834 struct ircomm_cb {
64835 irda_queue_t queue;
64836 diff --git a/include/net/irda/ircomm_tty.h b/include/net/irda/ircomm_tty.h
64837 index 59ba38bc..d515662 100644
64838 --- a/include/net/irda/ircomm_tty.h
64839 +++ b/include/net/irda/ircomm_tty.h
64840 @@ -35,6 +35,7 @@
64841 #include <linux/termios.h>
64842 #include <linux/timer.h>
64843 #include <linux/tty.h> /* struct tty_struct */
64844 +#include <asm/local.h>
64845
64846 #include <net/irda/irias_object.h>
64847 #include <net/irda/ircomm_core.h>
64848 @@ -105,8 +106,8 @@ struct ircomm_tty_cb {
64849 unsigned short close_delay;
64850 unsigned short closing_wait; /* time to wait before closing */
64851
64852 - int open_count;
64853 - int blocked_open; /* # of blocked opens */
64854 + local_t open_count;
64855 + local_t blocked_open; /* # of blocked opens */
64856
64857 /* Protect concurent access to :
64858 * o self->open_count
64859 diff --git a/include/net/iucv/af_iucv.h b/include/net/iucv/af_iucv.h
64860 index cc7c197..9f2da2a 100644
64861 --- a/include/net/iucv/af_iucv.h
64862 +++ b/include/net/iucv/af_iucv.h
64863 @@ -141,7 +141,7 @@ struct iucv_sock {
64864 struct iucv_sock_list {
64865 struct hlist_head head;
64866 rwlock_t lock;
64867 - atomic_t autobind_name;
64868 + atomic_unchecked_t autobind_name;
64869 };
64870
64871 unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
64872 diff --git a/include/net/neighbour.h b/include/net/neighbour.h
64873 index 6cdfeed..55a0256 100644
64874 --- a/include/net/neighbour.h
64875 +++ b/include/net/neighbour.h
64876 @@ -123,7 +123,7 @@ struct neigh_ops {
64877 void (*error_report)(struct neighbour *, struct sk_buff *);
64878 int (*output)(struct neighbour *, struct sk_buff *);
64879 int (*connected_output)(struct neighbour *, struct sk_buff *);
64880 -};
64881 +} __do_const;
64882
64883 struct pneigh_entry {
64884 struct pneigh_entry *next;
64885 diff --git a/include/net/netdma.h b/include/net/netdma.h
64886 index 8ba8ce2..99b7fff 100644
64887 --- a/include/net/netdma.h
64888 +++ b/include/net/netdma.h
64889 @@ -24,7 +24,7 @@
64890 #include <linux/dmaengine.h>
64891 #include <linux/skbuff.h>
64892
64893 -int dma_skb_copy_datagram_iovec(struct dma_chan* chan,
64894 +int __intentional_overflow(3,5) dma_skb_copy_datagram_iovec(struct dma_chan* chan,
64895 struct sk_buff *skb, int offset, struct iovec *to,
64896 size_t len, struct dma_pinned_list *pinned_list);
64897
64898 diff --git a/include/net/netlink.h b/include/net/netlink.h
64899 index 785f37a..c81dc0c 100644
64900 --- a/include/net/netlink.h
64901 +++ b/include/net/netlink.h
64902 @@ -520,7 +520,7 @@ static inline void *nlmsg_get_pos(struct sk_buff *skb)
64903 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
64904 {
64905 if (mark)
64906 - skb_trim(skb, (unsigned char *) mark - skb->data);
64907 + skb_trim(skb, (const unsigned char *) mark - skb->data);
64908 }
64909
64910 /**
64911 diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
64912 index bbd023a..97c6d0d 100644
64913 --- a/include/net/netns/ipv4.h
64914 +++ b/include/net/netns/ipv4.h
64915 @@ -57,8 +57,8 @@ struct netns_ipv4 {
64916 unsigned int sysctl_ping_group_range[2];
64917 long sysctl_tcp_mem[3];
64918
64919 - atomic_t rt_genid;
64920 - atomic_t dev_addr_genid;
64921 + atomic_unchecked_t rt_genid;
64922 + atomic_unchecked_t dev_addr_genid;
64923
64924 #ifdef CONFIG_IP_MROUTE
64925 #ifndef CONFIG_IP_MROUTE_MULTIPLE_TABLES
64926 diff --git a/include/net/scm.h b/include/net/scm.h
64927 index d456f4c..0c0017c 100644
64928 --- a/include/net/scm.h
64929 +++ b/include/net/scm.h
64930 @@ -71,9 +71,11 @@ static __inline__ void scm_destroy(struct scm_cookie *scm)
64931 }
64932
64933 static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
64934 - struct scm_cookie *scm)
64935 + struct scm_cookie *scm, bool forcecreds)
64936 {
64937 memset(scm, 0, sizeof(*scm));
64938 + if (forcecreds)
64939 + scm_set_cred(scm, task_tgid(current), current_cred());
64940 unix_get_peersec_dgram(sock, scm);
64941 if (msg->msg_controllen <= 0)
64942 return 0;
64943 diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
64944 index a2ef814..31a8e3f 100644
64945 --- a/include/net/sctp/sctp.h
64946 +++ b/include/net/sctp/sctp.h
64947 @@ -318,9 +318,9 @@ do { \
64948
64949 #else /* SCTP_DEBUG */
64950
64951 -#define SCTP_DEBUG_PRINTK(whatever...)
64952 -#define SCTP_DEBUG_PRINTK_CONT(fmt, args...)
64953 -#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
64954 +#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
64955 +#define SCTP_DEBUG_PRINTK_CONT(fmt, args...) do {} while (0)
64956 +#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
64957 #define SCTP_ENABLE_DEBUG
64958 #define SCTP_DISABLE_DEBUG
64959 #define SCTP_ASSERT(expr, str, func)
64960 diff --git a/include/net/sock.h b/include/net/sock.h
64961 index 4a45216..2ae7cd8 100644
64962 --- a/include/net/sock.h
64963 +++ b/include/net/sock.h
64964 @@ -303,7 +303,7 @@ struct sock {
64965 #ifdef CONFIG_RPS
64966 __u32 sk_rxhash;
64967 #endif
64968 - atomic_t sk_drops;
64969 + atomic_unchecked_t sk_drops;
64970 int sk_rcvbuf;
64971
64972 struct sk_filter __rcu *sk_filter;
64973 @@ -1726,7 +1726,7 @@ static inline void sk_nocaps_add(struct sock *sk, netdev_features_t flags)
64974 }
64975
64976 static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb,
64977 - char __user *from, char *to,
64978 + char __user *from, unsigned char *to,
64979 int copy, int offset)
64980 {
64981 if (skb->ip_summed == CHECKSUM_NONE) {
64982 @@ -1985,7 +1985,7 @@ static inline void sk_stream_moderate_sndbuf(struct sock *sk)
64983 }
64984 }
64985
64986 -struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp);
64987 +struct sk_buff * __intentional_overflow(0) sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp);
64988
64989 static inline struct page *sk_stream_alloc_page(struct sock *sk)
64990 {
64991 diff --git a/include/net/tcp.h b/include/net/tcp.h
64992 index e79aa48..05e52de 100644
64993 --- a/include/net/tcp.h
64994 +++ b/include/net/tcp.h
64995 @@ -476,7 +476,7 @@ extern void tcp_retransmit_timer(struct sock *sk);
64996 extern void tcp_xmit_retransmit_queue(struct sock *);
64997 extern void tcp_simple_retransmit(struct sock *);
64998 extern int tcp_trim_head(struct sock *, struct sk_buff *, u32);
64999 -extern int tcp_fragment(struct sock *, struct sk_buff *, u32, unsigned int);
65000 +extern int __intentional_overflow(3) tcp_fragment(struct sock *, struct sk_buff *, u32, unsigned int);
65001
65002 extern void tcp_send_probe0(struct sock *);
65003 extern void tcp_send_partial(struct sock *);
65004 @@ -643,8 +643,8 @@ struct tcp_skb_cb {
65005 struct inet6_skb_parm h6;
65006 #endif
65007 } header; /* For incoming frames */
65008 - __u32 seq; /* Starting sequence number */
65009 - __u32 end_seq; /* SEQ + FIN + SYN + datalen */
65010 + __u32 seq __intentional_overflow(0); /* Starting sequence number */
65011 + __u32 end_seq __intentional_overflow(0); /* SEQ + FIN + SYN + datalen */
65012 __u32 when; /* used to compute rtt's */
65013 __u8 tcp_flags; /* TCP header flags. (tcp[13]) */
65014
65015 @@ -658,7 +658,7 @@ struct tcp_skb_cb {
65016
65017 __u8 ip_dsfield; /* IPv4 tos or IPv6 dsfield */
65018 /* 1 byte hole */
65019 - __u32 ack_seq; /* Sequence number ACK'd */
65020 + __u32 ack_seq __intentional_overflow(0); /* Sequence number ACK'd */
65021 };
65022
65023 #define TCP_SKB_CB(__skb) ((struct tcp_skb_cb *)&((__skb)->cb[0]))
65024 @@ -1459,7 +1459,7 @@ struct tcp_seq_afinfo {
65025 char *name;
65026 sa_family_t family;
65027 const struct file_operations *seq_fops;
65028 - struct seq_operations seq_ops;
65029 + seq_operations_no_const seq_ops;
65030 };
65031
65032 struct tcp_iter_state {
65033 diff --git a/include/net/udp.h b/include/net/udp.h
65034 index 065f379..b661b40 100644
65035 --- a/include/net/udp.h
65036 +++ b/include/net/udp.h
65037 @@ -244,7 +244,7 @@ struct udp_seq_afinfo {
65038 sa_family_t family;
65039 struct udp_table *udp_table;
65040 const struct file_operations *seq_fops;
65041 - struct seq_operations seq_ops;
65042 + seq_operations_no_const seq_ops;
65043 };
65044
65045 struct udp_iter_state {
65046 diff --git a/include/net/xfrm.h b/include/net/xfrm.h
65047 index e0a55df..5890bca07 100644
65048 --- a/include/net/xfrm.h
65049 +++ b/include/net/xfrm.h
65050 @@ -505,7 +505,7 @@ struct xfrm_policy {
65051 struct timer_list timer;
65052
65053 struct flow_cache_object flo;
65054 - atomic_t genid;
65055 + atomic_unchecked_t genid;
65056 u32 priority;
65057 u32 index;
65058 struct xfrm_mark mark;
65059 diff --git a/include/rdma/iw_cm.h b/include/rdma/iw_cm.h
65060 index 1a046b1..ee0bef0 100644
65061 --- a/include/rdma/iw_cm.h
65062 +++ b/include/rdma/iw_cm.h
65063 @@ -122,7 +122,7 @@ struct iw_cm_verbs {
65064 int backlog);
65065
65066 int (*destroy_listen)(struct iw_cm_id *cm_id);
65067 -};
65068 +} __no_const;
65069
65070 /**
65071 * iw_create_cm_id - Create an IW CM identifier.
65072 diff --git a/include/scsi/libfc.h b/include/scsi/libfc.h
65073 index 8f9dfba..610ab6c 100644
65074 --- a/include/scsi/libfc.h
65075 +++ b/include/scsi/libfc.h
65076 @@ -756,6 +756,7 @@ struct libfc_function_template {
65077 */
65078 void (*disc_stop_final) (struct fc_lport *);
65079 };
65080 +typedef struct libfc_function_template __no_const libfc_function_template_no_const;
65081
65082 /**
65083 * struct fc_disc - Discovery context
65084 @@ -861,7 +862,7 @@ struct fc_lport {
65085 struct fc_vport *vport;
65086
65087 /* Operational Information */
65088 - struct libfc_function_template tt;
65089 + libfc_function_template_no_const tt;
65090 u8 link_up;
65091 u8 qfull;
65092 enum fc_lport_state state;
65093 diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
65094 index ba96988..ecf2eb9 100644
65095 --- a/include/scsi/scsi_device.h
65096 +++ b/include/scsi/scsi_device.h
65097 @@ -163,9 +163,9 @@ struct scsi_device {
65098 unsigned int max_device_blocked; /* what device_blocked counts down from */
65099 #define SCSI_DEFAULT_DEVICE_BLOCKED 3
65100
65101 - atomic_t iorequest_cnt;
65102 - atomic_t iodone_cnt;
65103 - atomic_t ioerr_cnt;
65104 + atomic_unchecked_t iorequest_cnt;
65105 + atomic_unchecked_t iodone_cnt;
65106 + atomic_unchecked_t ioerr_cnt;
65107
65108 struct device sdev_gendev,
65109 sdev_dev;
65110 diff --git a/include/scsi/scsi_transport_fc.h b/include/scsi/scsi_transport_fc.h
65111 index 719faf1..07b6728 100644
65112 --- a/include/scsi/scsi_transport_fc.h
65113 +++ b/include/scsi/scsi_transport_fc.h
65114 @@ -739,7 +739,8 @@ struct fc_function_template {
65115 unsigned long show_host_system_hostname:1;
65116
65117 unsigned long disable_target_scan:1;
65118 -};
65119 +} __do_const;
65120 +typedef struct fc_function_template __no_const fc_function_template_no_const;
65121
65122
65123 /**
65124 diff --git a/include/sound/ak4xxx-adda.h b/include/sound/ak4xxx-adda.h
65125 index 030b87c..98a6954 100644
65126 --- a/include/sound/ak4xxx-adda.h
65127 +++ b/include/sound/ak4xxx-adda.h
65128 @@ -35,7 +35,7 @@ struct snd_ak4xxx_ops {
65129 void (*write)(struct snd_akm4xxx *ak, int chip, unsigned char reg,
65130 unsigned char val);
65131 void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
65132 -};
65133 +} __no_const;
65134
65135 #define AK4XXX_IMAGE_SIZE (AK4XXX_MAX_CHIPS * 16) /* 64 bytes */
65136
65137 diff --git a/include/sound/hwdep.h b/include/sound/hwdep.h
65138 index 8c05e47..2b5df97 100644
65139 --- a/include/sound/hwdep.h
65140 +++ b/include/sound/hwdep.h
65141 @@ -49,7 +49,7 @@ struct snd_hwdep_ops {
65142 struct snd_hwdep_dsp_status *status);
65143 int (*dsp_load)(struct snd_hwdep *hw,
65144 struct snd_hwdep_dsp_image *image);
65145 -};
65146 +} __no_const;
65147
65148 struct snd_hwdep {
65149 struct snd_card *card;
65150 diff --git a/include/sound/info.h b/include/sound/info.h
65151 index 9ca1a49..aba1728 100644
65152 --- a/include/sound/info.h
65153 +++ b/include/sound/info.h
65154 @@ -44,7 +44,7 @@ struct snd_info_entry_text {
65155 struct snd_info_buffer *buffer);
65156 void (*write)(struct snd_info_entry *entry,
65157 struct snd_info_buffer *buffer);
65158 -};
65159 +} __no_const;
65160
65161 struct snd_info_entry_ops {
65162 int (*open)(struct snd_info_entry *entry,
65163 diff --git a/include/sound/pcm.h b/include/sound/pcm.h
65164 index 0d11128..814178e 100644
65165 --- a/include/sound/pcm.h
65166 +++ b/include/sound/pcm.h
65167 @@ -81,6 +81,7 @@ struct snd_pcm_ops {
65168 int (*mmap)(struct snd_pcm_substream *substream, struct vm_area_struct *vma);
65169 int (*ack)(struct snd_pcm_substream *substream);
65170 };
65171 +typedef struct snd_pcm_ops __no_const snd_pcm_ops_no_const;
65172
65173 /*
65174 *
65175 diff --git a/include/sound/sb16_csp.h b/include/sound/sb16_csp.h
65176 index af1b49e..a5d55a5 100644
65177 --- a/include/sound/sb16_csp.h
65178 +++ b/include/sound/sb16_csp.h
65179 @@ -146,7 +146,7 @@ struct snd_sb_csp_ops {
65180 int (*csp_start) (struct snd_sb_csp * p, int sample_width, int channels);
65181 int (*csp_stop) (struct snd_sb_csp * p);
65182 int (*csp_qsound_transfer) (struct snd_sb_csp * p);
65183 -};
65184 +} __no_const;
65185
65186 /*
65187 * CSP private data
65188 diff --git a/include/sound/soc.h b/include/sound/soc.h
65189 index c703871..f7fbbbd 100644
65190 --- a/include/sound/soc.h
65191 +++ b/include/sound/soc.h
65192 @@ -757,7 +757,7 @@ struct snd_soc_platform_driver {
65193 unsigned int (*read)(struct snd_soc_platform *, unsigned int);
65194 int (*write)(struct snd_soc_platform *, unsigned int, unsigned int);
65195 int (*bespoke_trigger)(struct snd_pcm_substream *, int);
65196 -};
65197 +} __do_const;
65198
65199 struct snd_soc_platform {
65200 const char *name;
65201 @@ -949,7 +949,7 @@ struct snd_soc_pcm_runtime {
65202 struct snd_soc_dai_link *dai_link;
65203 struct mutex pcm_mutex;
65204 enum snd_soc_pcm_subclass pcm_subclass;
65205 - struct snd_pcm_ops ops;
65206 + snd_pcm_ops_no_const ops;
65207
65208 unsigned int dev_registered:1;
65209
65210 diff --git a/include/sound/tea575x-tuner.h b/include/sound/tea575x-tuner.h
65211 index 0c3c2fb..d9d9990 100644
65212 --- a/include/sound/tea575x-tuner.h
65213 +++ b/include/sound/tea575x-tuner.h
65214 @@ -44,7 +44,7 @@ struct snd_tea575x_ops {
65215
65216 struct snd_tea575x {
65217 struct v4l2_device *v4l2_dev;
65218 - struct v4l2_file_operations fops;
65219 + v4l2_file_operations_no_const fops;
65220 struct video_device vd; /* video device */
65221 int radio_nr; /* radio_nr */
65222 bool tea5759; /* 5759 chip is present */
65223 diff --git a/include/sound/ymfpci.h b/include/sound/ymfpci.h
65224 index 4119966..1a4671c 100644
65225 --- a/include/sound/ymfpci.h
65226 +++ b/include/sound/ymfpci.h
65227 @@ -358,7 +358,7 @@ struct snd_ymfpci {
65228 spinlock_t reg_lock;
65229 spinlock_t voice_lock;
65230 wait_queue_head_t interrupt_sleep;
65231 - atomic_t interrupt_sleep_count;
65232 + atomic_unchecked_t interrupt_sleep_count;
65233 struct snd_info_entry *proc_entry;
65234 const struct firmware *dsp_microcode;
65235 const struct firmware *controller_microcode;
65236 diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
65237 index 362e0d9..36b9a83 100644
65238 --- a/include/target/target_core_base.h
65239 +++ b/include/target/target_core_base.h
65240 @@ -441,7 +441,7 @@ struct t10_reservation_ops {
65241 int (*t10_seq_non_holder)(struct se_cmd *, unsigned char *, u32);
65242 int (*t10_pr_register)(struct se_cmd *);
65243 int (*t10_pr_clear)(struct se_cmd *);
65244 -};
65245 +} __no_const;
65246
65247 struct t10_reservation {
65248 /* Reservation effects all target ports */
65249 @@ -780,7 +780,7 @@ struct se_device {
65250 spinlock_t stats_lock;
65251 /* Active commands on this virtual SE device */
65252 atomic_t simple_cmds;
65253 - atomic_t dev_ordered_id;
65254 + atomic_unchecked_t dev_ordered_id;
65255 atomic_t execute_tasks;
65256 atomic_t dev_ordered_sync;
65257 atomic_t dev_qf_count;
65258 diff --git a/include/trace/events/fs.h b/include/trace/events/fs.h
65259 new file mode 100644
65260 index 0000000..2efe49d
65261 --- /dev/null
65262 +++ b/include/trace/events/fs.h
65263 @@ -0,0 +1,53 @@
65264 +#undef TRACE_SYSTEM
65265 +#define TRACE_SYSTEM fs
65266 +
65267 +#if !defined(_TRACE_FS_H) || defined(TRACE_HEADER_MULTI_READ)
65268 +#define _TRACE_FS_H
65269 +
65270 +#include <linux/fs.h>
65271 +#include <linux/tracepoint.h>
65272 +
65273 +TRACE_EVENT(do_sys_open,
65274 +
65275 + TP_PROTO(char *filename, int flags, int mode),
65276 +
65277 + TP_ARGS(filename, flags, mode),
65278 +
65279 + TP_STRUCT__entry(
65280 + __string( filename, filename )
65281 + __field( int, flags )
65282 + __field( int, mode )
65283 + ),
65284 +
65285 + TP_fast_assign(
65286 + __assign_str(filename, filename);
65287 + __entry->flags = flags;
65288 + __entry->mode = mode;
65289 + ),
65290 +
65291 + TP_printk("\"%s\" %x %o",
65292 + __get_str(filename), __entry->flags, __entry->mode)
65293 +);
65294 +
65295 +TRACE_EVENT(open_exec,
65296 +
65297 + TP_PROTO(const char *filename),
65298 +
65299 + TP_ARGS(filename),
65300 +
65301 + TP_STRUCT__entry(
65302 + __string( filename, filename )
65303 + ),
65304 +
65305 + TP_fast_assign(
65306 + __assign_str(filename, filename);
65307 + ),
65308 +
65309 + TP_printk("\"%s\"",
65310 + __get_str(filename))
65311 +);
65312 +
65313 +#endif /* _TRACE_FS_H */
65314 +
65315 +/* This part must be outside protection */
65316 +#include <trace/define_trace.h>
65317 diff --git a/include/trace/events/irq.h b/include/trace/events/irq.h
65318 index 1c09820..7f5ec79 100644
65319 --- a/include/trace/events/irq.h
65320 +++ b/include/trace/events/irq.h
65321 @@ -36,7 +36,7 @@ struct softirq_action;
65322 */
65323 TRACE_EVENT(irq_handler_entry,
65324
65325 - TP_PROTO(int irq, struct irqaction *action),
65326 + TP_PROTO(int irq, const struct irqaction *action),
65327
65328 TP_ARGS(irq, action),
65329
65330 @@ -66,7 +66,7 @@ TRACE_EVENT(irq_handler_entry,
65331 */
65332 TRACE_EVENT(irq_handler_exit,
65333
65334 - TP_PROTO(int irq, struct irqaction *action, int ret),
65335 + TP_PROTO(int irq, const struct irqaction *action, int ret),
65336
65337 TP_ARGS(irq, action, ret),
65338
65339 diff --git a/include/video/udlfb.h b/include/video/udlfb.h
65340 index f9466fa..f4e2b81 100644
65341 --- a/include/video/udlfb.h
65342 +++ b/include/video/udlfb.h
65343 @@ -53,10 +53,10 @@ struct dlfb_data {
65344 u32 pseudo_palette[256];
65345 int blank_mode; /*one of FB_BLANK_ */
65346 /* blit-only rendering path metrics, exposed through sysfs */
65347 - atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
65348 - atomic_t bytes_identical; /* saved effort with backbuffer comparison */
65349 - atomic_t bytes_sent; /* to usb, after compression including overhead */
65350 - atomic_t cpu_kcycles_used; /* transpired during pixel processing */
65351 + atomic_unchecked_t bytes_rendered; /* raw pixel-bytes driver asked to render */
65352 + atomic_unchecked_t bytes_identical; /* saved effort with backbuffer comparison */
65353 + atomic_unchecked_t bytes_sent; /* to usb, after compression including overhead */
65354 + atomic_unchecked_t cpu_kcycles_used; /* transpired during pixel processing */
65355 };
65356
65357 #define NR_USB_REQUEST_I2C_SUB_IO 0x02
65358 diff --git a/include/video/uvesafb.h b/include/video/uvesafb.h
65359 index 0993a22..32ba2fe 100644
65360 --- a/include/video/uvesafb.h
65361 +++ b/include/video/uvesafb.h
65362 @@ -177,6 +177,7 @@ struct uvesafb_par {
65363 u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
65364 u8 pmi_setpal; /* PMI for palette changes */
65365 u16 *pmi_base; /* protected mode interface location */
65366 + u8 *pmi_code; /* protected mode code location */
65367 void *pmi_start;
65368 void *pmi_pal;
65369 u8 *vbe_state_orig; /*
65370 diff --git a/init/Kconfig b/init/Kconfig
65371 index d07dcf9..fa47d0e 100644
65372 --- a/init/Kconfig
65373 +++ b/init/Kconfig
65374 @@ -835,6 +835,7 @@ endif # CGROUPS
65375
65376 config CHECKPOINT_RESTORE
65377 bool "Checkpoint/restore support" if EXPERT
65378 + depends on !GRKERNSEC
65379 default n
65380 help
65381 Enables additional kernel features in a sake of checkpoint/restore.
65382 @@ -1014,6 +1015,7 @@ config UIDGID_CONVERTED
65383 # Security modules
65384 depends on SECURITY_TOMOYO = n
65385 depends on SECURITY_APPARMOR = n
65386 + depends on GRKERNSEC = n
65387
65388 config UIDGID_STRICT_TYPE_CHECKS
65389 bool "Require conversions between uid/gids and their internal representation"
65390 @@ -1401,7 +1403,7 @@ config SLUB_DEBUG
65391
65392 config COMPAT_BRK
65393 bool "Disable heap randomization"
65394 - default y
65395 + default n
65396 help
65397 Randomizing heap placement makes heap exploits harder, but it
65398 also breaks ancient binaries (including anything libc5 based).
65399 @@ -1584,7 +1586,7 @@ config INIT_ALL_POSSIBLE
65400 config STOP_MACHINE
65401 bool
65402 default y
65403 - depends on (SMP && MODULE_UNLOAD) || HOTPLUG_CPU
65404 + depends on (SMP && MODULE_UNLOAD) || HOTPLUG_CPU || GRKERNSEC
65405 help
65406 Need stop_machine() primitive.
65407
65408 diff --git a/init/Makefile b/init/Makefile
65409 index 7bc47ee..6da2dc7 100644
65410 --- a/init/Makefile
65411 +++ b/init/Makefile
65412 @@ -2,6 +2,9 @@
65413 # Makefile for the linux kernel.
65414 #
65415
65416 +ccflags-y := $(GCC_PLUGINS_CFLAGS)
65417 +asflags-y := $(GCC_PLUGINS_AFLAGS)
65418 +
65419 obj-y := main.o version.o mounts.o
65420 ifneq ($(CONFIG_BLK_DEV_INITRD),y)
65421 obj-y += noinitramfs.o
65422 diff --git a/init/do_mounts.c b/init/do_mounts.c
65423 index d3f0aee..c9322f5 100644
65424 --- a/init/do_mounts.c
65425 +++ b/init/do_mounts.c
65426 @@ -336,11 +336,11 @@ static void __init get_fs_names(char *page)
65427 static int __init do_mount_root(char *name, char *fs, int flags, void *data)
65428 {
65429 struct super_block *s;
65430 - int err = sys_mount(name, "/root", fs, flags, data);
65431 + int err = sys_mount((char __force_user *)name, (char __force_user *)"/root", (char __force_user *)fs, flags, (void __force_user *)data);
65432 if (err)
65433 return err;
65434
65435 - sys_chdir("/root");
65436 + sys_chdir((const char __force_user *)"/root");
65437 s = current->fs->pwd.dentry->d_sb;
65438 ROOT_DEV = s->s_dev;
65439 printk(KERN_INFO
65440 @@ -460,18 +460,18 @@ void __init change_floppy(char *fmt, ...)
65441 va_start(args, fmt);
65442 vsprintf(buf, fmt, args);
65443 va_end(args);
65444 - fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
65445 + fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
65446 if (fd >= 0) {
65447 sys_ioctl(fd, FDEJECT, 0);
65448 sys_close(fd);
65449 }
65450 printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
65451 - fd = sys_open("/dev/console", O_RDWR, 0);
65452 + fd = sys_open((__force const char __user *)"/dev/console", O_RDWR, 0);
65453 if (fd >= 0) {
65454 sys_ioctl(fd, TCGETS, (long)&termios);
65455 termios.c_lflag &= ~ICANON;
65456 sys_ioctl(fd, TCSETSF, (long)&termios);
65457 - sys_read(fd, &c, 1);
65458 + sys_read(fd, (char __user *)&c, 1);
65459 termios.c_lflag |= ICANON;
65460 sys_ioctl(fd, TCSETSF, (long)&termios);
65461 sys_close(fd);
65462 @@ -565,6 +565,6 @@ void __init prepare_namespace(void)
65463 mount_root();
65464 out:
65465 devtmpfs_mount("dev");
65466 - sys_mount(".", "/", NULL, MS_MOVE, NULL);
65467 - sys_chroot(".");
65468 + sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
65469 + sys_chroot((const char __force_user *)".");
65470 }
65471 diff --git a/init/do_mounts.h b/init/do_mounts.h
65472 index f5b978a..69dbfe8 100644
65473 --- a/init/do_mounts.h
65474 +++ b/init/do_mounts.h
65475 @@ -15,15 +15,15 @@ extern int root_mountflags;
65476
65477 static inline int create_dev(char *name, dev_t dev)
65478 {
65479 - sys_unlink(name);
65480 - return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
65481 + sys_unlink((char __force_user *)name);
65482 + return sys_mknod((char __force_user *)name, S_IFBLK|0600, new_encode_dev(dev));
65483 }
65484
65485 #if BITS_PER_LONG == 32
65486 static inline u32 bstat(char *name)
65487 {
65488 struct stat64 stat;
65489 - if (sys_stat64(name, &stat) != 0)
65490 + if (sys_stat64((char __force_user *)name, (struct stat64 __force_user *)&stat) != 0)
65491 return 0;
65492 if (!S_ISBLK(stat.st_mode))
65493 return 0;
65494 @@ -35,7 +35,7 @@ static inline u32 bstat(char *name)
65495 static inline u32 bstat(char *name)
65496 {
65497 struct stat stat;
65498 - if (sys_newstat(name, &stat) != 0)
65499 + if (sys_newstat((const char __force_user *)name, (struct stat __force_user *)&stat) != 0)
65500 return 0;
65501 if (!S_ISBLK(stat.st_mode))
65502 return 0;
65503 diff --git a/init/do_mounts_initrd.c b/init/do_mounts_initrd.c
65504 index 135959a2..28a3f43 100644
65505 --- a/init/do_mounts_initrd.c
65506 +++ b/init/do_mounts_initrd.c
65507 @@ -53,13 +53,13 @@ static void __init handle_initrd(void)
65508 create_dev("/dev/root.old", Root_RAM0);
65509 /* mount initrd on rootfs' /root */
65510 mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
65511 - sys_mkdir("/old", 0700);
65512 - root_fd = sys_open("/", 0, 0);
65513 - old_fd = sys_open("/old", 0, 0);
65514 + sys_mkdir((const char __force_user *)"/old", 0700);
65515 + root_fd = sys_open((const char __force_user *)"/", 0, 0);
65516 + old_fd = sys_open((const char __force_user *)"/old", 0, 0);
65517 /* move initrd over / and chdir/chroot in initrd root */
65518 - sys_chdir("/root");
65519 - sys_mount(".", "/", NULL, MS_MOVE, NULL);
65520 - sys_chroot(".");
65521 + sys_chdir((const char __force_user *)"/root");
65522 + sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
65523 + sys_chroot((const char __force_user *)".");
65524
65525 /*
65526 * In case that a resume from disk is carried out by linuxrc or one of
65527 @@ -76,15 +76,15 @@ static void __init handle_initrd(void)
65528
65529 /* move initrd to rootfs' /old */
65530 sys_fchdir(old_fd);
65531 - sys_mount("/", ".", NULL, MS_MOVE, NULL);
65532 + sys_mount((char __force_user *)"/", (char __force_user *)".", NULL, MS_MOVE, NULL);
65533 /* switch root and cwd back to / of rootfs */
65534 sys_fchdir(root_fd);
65535 - sys_chroot(".");
65536 + sys_chroot((const char __force_user *)".");
65537 sys_close(old_fd);
65538 sys_close(root_fd);
65539
65540 if (new_decode_dev(real_root_dev) == Root_RAM0) {
65541 - sys_chdir("/old");
65542 + sys_chdir((const char __force_user *)"/old");
65543 return;
65544 }
65545
65546 @@ -92,17 +92,17 @@ static void __init handle_initrd(void)
65547 mount_root();
65548
65549 printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
65550 - error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
65551 + error = sys_mount((char __force_user *)"/old", (char __force_user *)"/root/initrd", NULL, MS_MOVE, NULL);
65552 if (!error)
65553 printk("okay\n");
65554 else {
65555 - int fd = sys_open("/dev/root.old", O_RDWR, 0);
65556 + int fd = sys_open((const char __force_user *)"/dev/root.old", O_RDWR, 0);
65557 if (error == -ENOENT)
65558 printk("/initrd does not exist. Ignored.\n");
65559 else
65560 printk("failed\n");
65561 printk(KERN_NOTICE "Unmounting old root\n");
65562 - sys_umount("/old", MNT_DETACH);
65563 + sys_umount((char __force_user *)"/old", MNT_DETACH);
65564 printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
65565 if (fd < 0) {
65566 error = fd;
65567 @@ -125,11 +125,11 @@ int __init initrd_load(void)
65568 * mounted in the normal path.
65569 */
65570 if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
65571 - sys_unlink("/initrd.image");
65572 + sys_unlink((const char __force_user *)"/initrd.image");
65573 handle_initrd();
65574 return 1;
65575 }
65576 }
65577 - sys_unlink("/initrd.image");
65578 + sys_unlink((const char __force_user *)"/initrd.image");
65579 return 0;
65580 }
65581 diff --git a/init/do_mounts_md.c b/init/do_mounts_md.c
65582 index 8cb6db5..d729f50 100644
65583 --- a/init/do_mounts_md.c
65584 +++ b/init/do_mounts_md.c
65585 @@ -180,7 +180,7 @@ static void __init md_setup_drive(void)
65586 partitioned ? "_d" : "", minor,
65587 md_setup_args[ent].device_names);
65588
65589 - fd = sys_open(name, 0, 0);
65590 + fd = sys_open((char __force_user *)name, 0, 0);
65591 if (fd < 0) {
65592 printk(KERN_ERR "md: open failed - cannot start "
65593 "array %s\n", name);
65594 @@ -243,7 +243,7 @@ static void __init md_setup_drive(void)
65595 * array without it
65596 */
65597 sys_close(fd);
65598 - fd = sys_open(name, 0, 0);
65599 + fd = sys_open((char __force_user *)name, 0, 0);
65600 sys_ioctl(fd, BLKRRPART, 0);
65601 }
65602 sys_close(fd);
65603 @@ -293,7 +293,7 @@ static void __init autodetect_raid(void)
65604
65605 wait_for_device_probe();
65606
65607 - fd = sys_open("/dev/md0", 0, 0);
65608 + fd = sys_open((const char __force_user *) "/dev/md0", 0, 0);
65609 if (fd >= 0) {
65610 sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
65611 sys_close(fd);
65612 diff --git a/init/init_task.c b/init/init_task.c
65613 index 8b2f399..f0797c9 100644
65614 --- a/init/init_task.c
65615 +++ b/init/init_task.c
65616 @@ -20,5 +20,9 @@ EXPORT_SYMBOL(init_task);
65617 * Initial thread structure. Alignment of this is handled by a special
65618 * linker map entry.
65619 */
65620 +#ifdef CONFIG_X86
65621 +union thread_union init_thread_union __init_task_data;
65622 +#else
65623 union thread_union init_thread_union __init_task_data =
65624 { INIT_THREAD_INFO(init_task) };
65625 +#endif
65626 diff --git a/init/initramfs.c b/init/initramfs.c
65627 index 84c6bf1..8899338 100644
65628 --- a/init/initramfs.c
65629 +++ b/init/initramfs.c
65630 @@ -84,7 +84,7 @@ static void __init free_hash(void)
65631 }
65632 }
65633
65634 -static long __init do_utime(char *filename, time_t mtime)
65635 +static long __init do_utime(char __force_user *filename, time_t mtime)
65636 {
65637 struct timespec t[2];
65638
65639 @@ -119,7 +119,7 @@ static void __init dir_utime(void)
65640 struct dir_entry *de, *tmp;
65641 list_for_each_entry_safe(de, tmp, &dir_list, list) {
65642 list_del(&de->list);
65643 - do_utime(de->name, de->mtime);
65644 + do_utime((char __force_user *)de->name, de->mtime);
65645 kfree(de->name);
65646 kfree(de);
65647 }
65648 @@ -281,7 +281,7 @@ static int __init maybe_link(void)
65649 if (nlink >= 2) {
65650 char *old = find_link(major, minor, ino, mode, collected);
65651 if (old)
65652 - return (sys_link(old, collected) < 0) ? -1 : 1;
65653 + return (sys_link((char __force_user *)old, (char __force_user *)collected) < 0) ? -1 : 1;
65654 }
65655 return 0;
65656 }
65657 @@ -290,11 +290,11 @@ static void __init clean_path(char *path, umode_t mode)
65658 {
65659 struct stat st;
65660
65661 - if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
65662 + if (!sys_newlstat((char __force_user *)path, (struct stat __force_user *)&st) && (st.st_mode^mode) & S_IFMT) {
65663 if (S_ISDIR(st.st_mode))
65664 - sys_rmdir(path);
65665 + sys_rmdir((char __force_user *)path);
65666 else
65667 - sys_unlink(path);
65668 + sys_unlink((char __force_user *)path);
65669 }
65670 }
65671
65672 @@ -315,7 +315,7 @@ static int __init do_name(void)
65673 int openflags = O_WRONLY|O_CREAT;
65674 if (ml != 1)
65675 openflags |= O_TRUNC;
65676 - wfd = sys_open(collected, openflags, mode);
65677 + wfd = sys_open((char __force_user *)collected, openflags, mode);
65678
65679 if (wfd >= 0) {
65680 sys_fchown(wfd, uid, gid);
65681 @@ -327,17 +327,17 @@ static int __init do_name(void)
65682 }
65683 }
65684 } else if (S_ISDIR(mode)) {
65685 - sys_mkdir(collected, mode);
65686 - sys_chown(collected, uid, gid);
65687 - sys_chmod(collected, mode);
65688 + sys_mkdir((char __force_user *)collected, mode);
65689 + sys_chown((char __force_user *)collected, uid, gid);
65690 + sys_chmod((char __force_user *)collected, mode);
65691 dir_add(collected, mtime);
65692 } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
65693 S_ISFIFO(mode) || S_ISSOCK(mode)) {
65694 if (maybe_link() == 0) {
65695 - sys_mknod(collected, mode, rdev);
65696 - sys_chown(collected, uid, gid);
65697 - sys_chmod(collected, mode);
65698 - do_utime(collected, mtime);
65699 + sys_mknod((char __force_user *)collected, mode, rdev);
65700 + sys_chown((char __force_user *)collected, uid, gid);
65701 + sys_chmod((char __force_user *)collected, mode);
65702 + do_utime((char __force_user *)collected, mtime);
65703 }
65704 }
65705 return 0;
65706 @@ -346,15 +346,15 @@ static int __init do_name(void)
65707 static int __init do_copy(void)
65708 {
65709 if (count >= body_len) {
65710 - sys_write(wfd, victim, body_len);
65711 + sys_write(wfd, (char __force_user *)victim, body_len);
65712 sys_close(wfd);
65713 - do_utime(vcollected, mtime);
65714 + do_utime((char __force_user *)vcollected, mtime);
65715 kfree(vcollected);
65716 eat(body_len);
65717 state = SkipIt;
65718 return 0;
65719 } else {
65720 - sys_write(wfd, victim, count);
65721 + sys_write(wfd, (char __force_user *)victim, count);
65722 body_len -= count;
65723 eat(count);
65724 return 1;
65725 @@ -365,9 +365,9 @@ static int __init do_symlink(void)
65726 {
65727 collected[N_ALIGN(name_len) + body_len] = '\0';
65728 clean_path(collected, 0);
65729 - sys_symlink(collected + N_ALIGN(name_len), collected);
65730 - sys_lchown(collected, uid, gid);
65731 - do_utime(collected, mtime);
65732 + sys_symlink((char __force_user *)collected + N_ALIGN(name_len), (char __force_user *)collected);
65733 + sys_lchown((char __force_user *)collected, uid, gid);
65734 + do_utime((char __force_user *)collected, mtime);
65735 state = SkipIt;
65736 next_state = Reset;
65737 return 0;
65738 diff --git a/init/main.c b/init/main.c
65739 index b5cc0a7..8e67244 100644
65740 --- a/init/main.c
65741 +++ b/init/main.c
65742 @@ -95,6 +95,8 @@ static inline void mark_rodata_ro(void) { }
65743 extern void tc_init(void);
65744 #endif
65745
65746 +extern void grsecurity_init(void);
65747 +
65748 /*
65749 * Debug helper: via this flag we know that we are in 'early bootup code'
65750 * where only the boot processor is running with IRQ disabled. This means
65751 @@ -148,6 +150,51 @@ static int __init set_reset_devices(char *str)
65752
65753 __setup("reset_devices", set_reset_devices);
65754
65755 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
65756 +extern char pax_enter_kernel_user[];
65757 +extern char pax_exit_kernel_user[];
65758 +extern pgdval_t clone_pgd_mask;
65759 +#endif
65760 +
65761 +#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
65762 +static int __init setup_pax_nouderef(char *str)
65763 +{
65764 +#ifdef CONFIG_X86_32
65765 + unsigned int cpu;
65766 + struct desc_struct *gdt;
65767 +
65768 + for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
65769 + gdt = get_cpu_gdt_table(cpu);
65770 + gdt[GDT_ENTRY_KERNEL_DS].type = 3;
65771 + gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
65772 + gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
65773 + gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
65774 + }
65775 + loadsegment(ds, __KERNEL_DS);
65776 + loadsegment(es, __KERNEL_DS);
65777 + loadsegment(ss, __KERNEL_DS);
65778 +#else
65779 + memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
65780 + memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
65781 + clone_pgd_mask = ~(pgdval_t)0UL;
65782 +#endif
65783 +
65784 + return 0;
65785 +}
65786 +early_param("pax_nouderef", setup_pax_nouderef);
65787 +#endif
65788 +
65789 +#ifdef CONFIG_PAX_SOFTMODE
65790 +int pax_softmode;
65791 +
65792 +static int __init setup_pax_softmode(char *str)
65793 +{
65794 + get_option(&str, &pax_softmode);
65795 + return 1;
65796 +}
65797 +__setup("pax_softmode=", setup_pax_softmode);
65798 +#endif
65799 +
65800 static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
65801 const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
65802 static const char *panic_later, *panic_param;
65803 @@ -674,6 +721,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
65804 {
65805 int count = preempt_count();
65806 int ret;
65807 + const char *msg1 = "", *msg2 = "";
65808
65809 if (initcall_debug)
65810 ret = do_one_initcall_debug(fn);
65811 @@ -686,15 +734,15 @@ int __init_or_module do_one_initcall(initcall_t fn)
65812 sprintf(msgbuf, "error code %d ", ret);
65813
65814 if (preempt_count() != count) {
65815 - strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
65816 + msg1 = " preemption imbalance";
65817 preempt_count() = count;
65818 }
65819 if (irqs_disabled()) {
65820 - strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
65821 + msg2 = " disabled interrupts";
65822 local_irq_enable();
65823 }
65824 - if (msgbuf[0]) {
65825 - printk("initcall %pF returned with %s\n", fn, msgbuf);
65826 + if (msgbuf[0] || *msg1 || *msg2) {
65827 + printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
65828 }
65829
65830 return ret;
65831 @@ -747,8 +795,14 @@ static void __init do_initcall_level(int level)
65832 level, level,
65833 &repair_env_string);
65834
65835 - for (fn = initcall_levels[level]; fn < initcall_levels[level+1]; fn++)
65836 + for (fn = initcall_levels[level]; fn < initcall_levels[level+1]; fn++) {
65837 do_one_initcall(*fn);
65838 +
65839 +#ifdef CONFIG_PAX_LATENT_ENTROPY
65840 + transfer_latent_entropy();
65841 +#endif
65842 +
65843 + }
65844 }
65845
65846 static void __init do_initcalls(void)
65847 @@ -782,8 +836,14 @@ static void __init do_pre_smp_initcalls(void)
65848 {
65849 initcall_t *fn;
65850
65851 - for (fn = __initcall_start; fn < __initcall0_start; fn++)
65852 + for (fn = __initcall_start; fn < __initcall0_start; fn++) {
65853 do_one_initcall(*fn);
65854 +
65855 +#ifdef CONFIG_PAX_LATENT_ENTROPY
65856 + transfer_latent_entropy();
65857 +#endif
65858 +
65859 + }
65860 }
65861
65862 static void run_init_process(const char *init_filename)
65863 @@ -865,7 +925,7 @@ static int __init kernel_init(void * unused)
65864 do_basic_setup();
65865
65866 /* Open the /dev/console on the rootfs, this should never fail */
65867 - if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0)
65868 + if (sys_open((const char __force_user *) "/dev/console", O_RDWR, 0) < 0)
65869 printk(KERN_WARNING "Warning: unable to open an initial console.\n");
65870
65871 (void) sys_dup(0);
65872 @@ -878,11 +938,13 @@ static int __init kernel_init(void * unused)
65873 if (!ramdisk_execute_command)
65874 ramdisk_execute_command = "/init";
65875
65876 - if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
65877 + if (sys_access((const char __force_user *) ramdisk_execute_command, 0) != 0) {
65878 ramdisk_execute_command = NULL;
65879 prepare_namespace();
65880 }
65881
65882 + grsecurity_init();
65883 +
65884 /*
65885 * Ok, we have completed the initial bootup, and
65886 * we're essentially up and running. Get rid of the
65887 diff --git a/ipc/mqueue.c b/ipc/mqueue.c
65888 index 8ce5769..4666884 100644
65889 --- a/ipc/mqueue.c
65890 +++ b/ipc/mqueue.c
65891 @@ -279,6 +279,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
65892 mq_bytes = mq_treesize + (info->attr.mq_maxmsg *
65893 info->attr.mq_msgsize);
65894
65895 + gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
65896 spin_lock(&mq_lock);
65897 if (u->mq_bytes + mq_bytes < u->mq_bytes ||
65898 u->mq_bytes + mq_bytes > rlimit(RLIMIT_MSGQUEUE)) {
65899 diff --git a/ipc/msg.c b/ipc/msg.c
65900 index 7385de2..a8180e08 100644
65901 --- a/ipc/msg.c
65902 +++ b/ipc/msg.c
65903 @@ -309,18 +309,19 @@ static inline int msg_security(struct kern_ipc_perm *ipcp, int msgflg)
65904 return security_msg_queue_associate(msq, msgflg);
65905 }
65906
65907 +static struct ipc_ops msg_ops = {
65908 + .getnew = newque,
65909 + .associate = msg_security,
65910 + .more_checks = NULL
65911 +};
65912 +
65913 SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
65914 {
65915 struct ipc_namespace *ns;
65916 - struct ipc_ops msg_ops;
65917 struct ipc_params msg_params;
65918
65919 ns = current->nsproxy->ipc_ns;
65920
65921 - msg_ops.getnew = newque;
65922 - msg_ops.associate = msg_security;
65923 - msg_ops.more_checks = NULL;
65924 -
65925 msg_params.key = key;
65926 msg_params.flg = msgflg;
65927
65928 diff --git a/ipc/sem.c b/ipc/sem.c
65929 index 5215a81..cfc0cac 100644
65930 --- a/ipc/sem.c
65931 +++ b/ipc/sem.c
65932 @@ -364,10 +364,15 @@ static inline int sem_more_checks(struct kern_ipc_perm *ipcp,
65933 return 0;
65934 }
65935
65936 +static struct ipc_ops sem_ops = {
65937 + .getnew = newary,
65938 + .associate = sem_security,
65939 + .more_checks = sem_more_checks
65940 +};
65941 +
65942 SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
65943 {
65944 struct ipc_namespace *ns;
65945 - struct ipc_ops sem_ops;
65946 struct ipc_params sem_params;
65947
65948 ns = current->nsproxy->ipc_ns;
65949 @@ -375,10 +380,6 @@ SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
65950 if (nsems < 0 || nsems > ns->sc_semmsl)
65951 return -EINVAL;
65952
65953 - sem_ops.getnew = newary;
65954 - sem_ops.associate = sem_security;
65955 - sem_ops.more_checks = sem_more_checks;
65956 -
65957 sem_params.key = key;
65958 sem_params.flg = semflg;
65959 sem_params.u.nsems = nsems;
65960 diff --git a/ipc/shm.c b/ipc/shm.c
65961 index 41c1285..cf6404c 100644
65962 --- a/ipc/shm.c
65963 +++ b/ipc/shm.c
65964 @@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp);
65965 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
65966 #endif
65967
65968 +#ifdef CONFIG_GRKERNSEC
65969 +extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
65970 + const time_t shm_createtime, const uid_t cuid,
65971 + const int shmid);
65972 +extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
65973 + const time_t shm_createtime);
65974 +#endif
65975 +
65976 void shm_init_ns(struct ipc_namespace *ns)
65977 {
65978 ns->shm_ctlmax = SHMMAX;
65979 @@ -520,6 +528,14 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
65980 shp->shm_lprid = 0;
65981 shp->shm_atim = shp->shm_dtim = 0;
65982 shp->shm_ctim = get_seconds();
65983 +#ifdef CONFIG_GRKERNSEC
65984 + {
65985 + struct timespec timeval;
65986 + do_posix_clock_monotonic_gettime(&timeval);
65987 +
65988 + shp->shm_createtime = timeval.tv_sec;
65989 + }
65990 +#endif
65991 shp->shm_segsz = size;
65992 shp->shm_nattch = 0;
65993 shp->shm_file = file;
65994 @@ -571,18 +587,19 @@ static inline int shm_more_checks(struct kern_ipc_perm *ipcp,
65995 return 0;
65996 }
65997
65998 +static struct ipc_ops shm_ops = {
65999 + .getnew = newseg,
66000 + .associate = shm_security,
66001 + .more_checks = shm_more_checks
66002 +};
66003 +
66004 SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
66005 {
66006 struct ipc_namespace *ns;
66007 - struct ipc_ops shm_ops;
66008 struct ipc_params shm_params;
66009
66010 ns = current->nsproxy->ipc_ns;
66011
66012 - shm_ops.getnew = newseg;
66013 - shm_ops.associate = shm_security;
66014 - shm_ops.more_checks = shm_more_checks;
66015 -
66016 shm_params.key = key;
66017 shm_params.flg = shmflg;
66018 shm_params.u.size = size;
66019 @@ -1000,6 +1017,12 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
66020 f_mode = FMODE_READ | FMODE_WRITE;
66021 }
66022 if (shmflg & SHM_EXEC) {
66023 +
66024 +#ifdef CONFIG_PAX_MPROTECT
66025 + if (current->mm->pax_flags & MF_PAX_MPROTECT)
66026 + goto out;
66027 +#endif
66028 +
66029 prot |= PROT_EXEC;
66030 acc_mode |= S_IXUGO;
66031 }
66032 @@ -1023,9 +1046,21 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
66033 if (err)
66034 goto out_unlock;
66035
66036 +#ifdef CONFIG_GRKERNSEC
66037 + if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
66038 + shp->shm_perm.cuid, shmid) ||
66039 + !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
66040 + err = -EACCES;
66041 + goto out_unlock;
66042 + }
66043 +#endif
66044 +
66045 path = shp->shm_file->f_path;
66046 path_get(&path);
66047 shp->shm_nattch++;
66048 +#ifdef CONFIG_GRKERNSEC
66049 + shp->shm_lapid = current->pid;
66050 +#endif
66051 size = i_size_read(path.dentry->d_inode);
66052 shm_unlock(shp);
66053
66054 diff --git a/kernel/acct.c b/kernel/acct.c
66055 index 02e6167..54824f7 100644
66056 --- a/kernel/acct.c
66057 +++ b/kernel/acct.c
66058 @@ -550,7 +550,7 @@ static void do_acct_process(struct bsd_acct_struct *acct,
66059 */
66060 flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
66061 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
66062 - file->f_op->write(file, (char *)&ac,
66063 + file->f_op->write(file, (char __force_user *)&ac,
66064 sizeof(acct_t), &file->f_pos);
66065 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
66066 set_fs(fs);
66067 diff --git a/kernel/audit.c b/kernel/audit.c
66068 index 1c7f2c6..9ba5359 100644
66069 --- a/kernel/audit.c
66070 +++ b/kernel/audit.c
66071 @@ -115,7 +115,7 @@ u32 audit_sig_sid = 0;
66072 3) suppressed due to audit_rate_limit
66073 4) suppressed due to audit_backlog_limit
66074 */
66075 -static atomic_t audit_lost = ATOMIC_INIT(0);
66076 +static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
66077
66078 /* The netlink socket. */
66079 static struct sock *audit_sock;
66080 @@ -237,7 +237,7 @@ void audit_log_lost(const char *message)
66081 unsigned long now;
66082 int print;
66083
66084 - atomic_inc(&audit_lost);
66085 + atomic_inc_unchecked(&audit_lost);
66086
66087 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
66088
66089 @@ -256,7 +256,7 @@ void audit_log_lost(const char *message)
66090 printk(KERN_WARNING
66091 "audit: audit_lost=%d audit_rate_limit=%d "
66092 "audit_backlog_limit=%d\n",
66093 - atomic_read(&audit_lost),
66094 + atomic_read_unchecked(&audit_lost),
66095 audit_rate_limit,
66096 audit_backlog_limit);
66097 audit_panic(message);
66098 @@ -689,7 +689,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
66099 status_set.pid = audit_pid;
66100 status_set.rate_limit = audit_rate_limit;
66101 status_set.backlog_limit = audit_backlog_limit;
66102 - status_set.lost = atomic_read(&audit_lost);
66103 + status_set.lost = atomic_read_unchecked(&audit_lost);
66104 status_set.backlog = skb_queue_len(&audit_skb_queue);
66105 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
66106 &status_set, sizeof(status_set));
66107 diff --git a/kernel/auditsc.c b/kernel/auditsc.c
66108 index 4b96415..d8c16ee 100644
66109 --- a/kernel/auditsc.c
66110 +++ b/kernel/auditsc.c
66111 @@ -2289,7 +2289,7 @@ int auditsc_get_stamp(struct audit_context *ctx,
66112 }
66113
66114 /* global counter which is incremented every time something logs in */
66115 -static atomic_t session_id = ATOMIC_INIT(0);
66116 +static atomic_unchecked_t session_id = ATOMIC_INIT(0);
66117
66118 /**
66119 * audit_set_loginuid - set current task's audit_context loginuid
66120 @@ -2313,7 +2313,7 @@ int audit_set_loginuid(uid_t loginuid)
66121 return -EPERM;
66122 #endif /* CONFIG_AUDIT_LOGINUID_IMMUTABLE */
66123
66124 - sessionid = atomic_inc_return(&session_id);
66125 + sessionid = atomic_inc_return_unchecked(&session_id);
66126 if (context && context->in_syscall) {
66127 struct audit_buffer *ab;
66128
66129 diff --git a/kernel/capability.c b/kernel/capability.c
66130 index 493d972..ea17248 100644
66131 --- a/kernel/capability.c
66132 +++ b/kernel/capability.c
66133 @@ -202,6 +202,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr)
66134 * before modification is attempted and the application
66135 * fails.
66136 */
66137 + if (tocopy > ARRAY_SIZE(kdata))
66138 + return -EFAULT;
66139 +
66140 if (copy_to_user(dataptr, kdata, tocopy
66141 * sizeof(struct __user_cap_data_struct))) {
66142 return -EFAULT;
66143 @@ -303,10 +306,11 @@ bool has_ns_capability(struct task_struct *t,
66144 int ret;
66145
66146 rcu_read_lock();
66147 - ret = security_capable(__task_cred(t), ns, cap);
66148 + ret = security_capable(__task_cred(t), ns, cap) == 0 &&
66149 + gr_task_is_capable(t, __task_cred(t), cap);
66150 rcu_read_unlock();
66151
66152 - return (ret == 0);
66153 + return ret;
66154 }
66155
66156 /**
66157 @@ -343,10 +347,10 @@ bool has_ns_capability_noaudit(struct task_struct *t,
66158 int ret;
66159
66160 rcu_read_lock();
66161 - ret = security_capable_noaudit(__task_cred(t), ns, cap);
66162 + ret = security_capable_noaudit(__task_cred(t), ns, cap) == 0 && gr_task_is_capable_nolog(t, cap);
66163 rcu_read_unlock();
66164
66165 - return (ret == 0);
66166 + return ret;
66167 }
66168
66169 /**
66170 @@ -384,7 +388,7 @@ bool ns_capable(struct user_namespace *ns, int cap)
66171 BUG();
66172 }
66173
66174 - if (security_capable(current_cred(), ns, cap) == 0) {
66175 + if (security_capable(current_cred(), ns, cap) == 0 && gr_is_capable(cap)) {
66176 current->flags |= PF_SUPERPRIV;
66177 return true;
66178 }
66179 @@ -392,6 +396,21 @@ bool ns_capable(struct user_namespace *ns, int cap)
66180 }
66181 EXPORT_SYMBOL(ns_capable);
66182
66183 +bool ns_capable_nolog(struct user_namespace *ns, int cap)
66184 +{
66185 + if (unlikely(!cap_valid(cap))) {
66186 + printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
66187 + BUG();
66188 + }
66189 +
66190 + if (security_capable(current_cred(), ns, cap) == 0 && gr_is_capable_nolog(cap)) {
66191 + current->flags |= PF_SUPERPRIV;
66192 + return true;
66193 + }
66194 + return false;
66195 +}
66196 +EXPORT_SYMBOL(ns_capable_nolog);
66197 +
66198 /**
66199 * capable - Determine if the current task has a superior capability in effect
66200 * @cap: The capability to be tested for
66201 @@ -408,6 +427,12 @@ bool capable(int cap)
66202 }
66203 EXPORT_SYMBOL(capable);
66204
66205 +bool capable_nolog(int cap)
66206 +{
66207 + return ns_capable_nolog(&init_user_ns, cap);
66208 +}
66209 +EXPORT_SYMBOL(capable_nolog);
66210 +
66211 /**
66212 * nsown_capable - Check superior capability to one's own user_ns
66213 * @cap: The capability in question
66214 @@ -440,3 +465,10 @@ bool inode_capable(const struct inode *inode, int cap)
66215
66216 return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid);
66217 }
66218 +
66219 +bool inode_capable_nolog(const struct inode *inode, int cap)
66220 +{
66221 + struct user_namespace *ns = current_user_ns();
66222 +
66223 + return ns_capable_nolog(ns, cap) && kuid_has_mapping(ns, inode->i_uid);
66224 +}
66225 diff --git a/kernel/compat.c b/kernel/compat.c
66226 index c28a306..b4d0cf3 100644
66227 --- a/kernel/compat.c
66228 +++ b/kernel/compat.c
66229 @@ -13,6 +13,7 @@
66230
66231 #include <linux/linkage.h>
66232 #include <linux/compat.h>
66233 +#include <linux/module.h>
66234 #include <linux/errno.h>
66235 #include <linux/time.h>
66236 #include <linux/signal.h>
66237 @@ -220,7 +221,7 @@ static long compat_nanosleep_restart(struct restart_block *restart)
66238 mm_segment_t oldfs;
66239 long ret;
66240
66241 - restart->nanosleep.rmtp = (struct timespec __user *) &rmt;
66242 + restart->nanosleep.rmtp = (struct timespec __force_user *) &rmt;
66243 oldfs = get_fs();
66244 set_fs(KERNEL_DS);
66245 ret = hrtimer_nanosleep_restart(restart);
66246 @@ -252,7 +253,7 @@ asmlinkage long compat_sys_nanosleep(struct compat_timespec __user *rqtp,
66247 oldfs = get_fs();
66248 set_fs(KERNEL_DS);
66249 ret = hrtimer_nanosleep(&tu,
66250 - rmtp ? (struct timespec __user *)&rmt : NULL,
66251 + rmtp ? (struct timespec __force_user *)&rmt : NULL,
66252 HRTIMER_MODE_REL, CLOCK_MONOTONIC);
66253 set_fs(oldfs);
66254
66255 @@ -361,7 +362,7 @@ asmlinkage long compat_sys_sigpending(compat_old_sigset_t __user *set)
66256 mm_segment_t old_fs = get_fs();
66257
66258 set_fs(KERNEL_DS);
66259 - ret = sys_sigpending((old_sigset_t __user *) &s);
66260 + ret = sys_sigpending((old_sigset_t __force_user *) &s);
66261 set_fs(old_fs);
66262 if (ret == 0)
66263 ret = put_user(s, set);
66264 @@ -451,7 +452,7 @@ asmlinkage long compat_sys_old_getrlimit(unsigned int resource,
66265 mm_segment_t old_fs = get_fs();
66266
66267 set_fs(KERNEL_DS);
66268 - ret = sys_old_getrlimit(resource, &r);
66269 + ret = sys_old_getrlimit(resource, (struct rlimit __force_user *)&r);
66270 set_fs(old_fs);
66271
66272 if (!ret) {
66273 @@ -523,7 +524,7 @@ asmlinkage long compat_sys_getrusage(int who, struct compat_rusage __user *ru)
66274 mm_segment_t old_fs = get_fs();
66275
66276 set_fs(KERNEL_DS);
66277 - ret = sys_getrusage(who, (struct rusage __user *) &r);
66278 + ret = sys_getrusage(who, (struct rusage __force_user *) &r);
66279 set_fs(old_fs);
66280
66281 if (ret)
66282 @@ -550,8 +551,8 @@ compat_sys_wait4(compat_pid_t pid, compat_uint_t __user *stat_addr, int options,
66283 set_fs (KERNEL_DS);
66284 ret = sys_wait4(pid,
66285 (stat_addr ?
66286 - (unsigned int __user *) &status : NULL),
66287 - options, (struct rusage __user *) &r);
66288 + (unsigned int __force_user *) &status : NULL),
66289 + options, (struct rusage __force_user *) &r);
66290 set_fs (old_fs);
66291
66292 if (ret > 0) {
66293 @@ -576,8 +577,8 @@ asmlinkage long compat_sys_waitid(int which, compat_pid_t pid,
66294 memset(&info, 0, sizeof(info));
66295
66296 set_fs(KERNEL_DS);
66297 - ret = sys_waitid(which, pid, (siginfo_t __user *)&info, options,
66298 - uru ? (struct rusage __user *)&ru : NULL);
66299 + ret = sys_waitid(which, pid, (siginfo_t __force_user *)&info, options,
66300 + uru ? (struct rusage __force_user *)&ru : NULL);
66301 set_fs(old_fs);
66302
66303 if ((ret < 0) || (info.si_signo == 0))
66304 @@ -707,8 +708,8 @@ long compat_sys_timer_settime(timer_t timer_id, int flags,
66305 oldfs = get_fs();
66306 set_fs(KERNEL_DS);
66307 err = sys_timer_settime(timer_id, flags,
66308 - (struct itimerspec __user *) &newts,
66309 - (struct itimerspec __user *) &oldts);
66310 + (struct itimerspec __force_user *) &newts,
66311 + (struct itimerspec __force_user *) &oldts);
66312 set_fs(oldfs);
66313 if (!err && old && put_compat_itimerspec(old, &oldts))
66314 return -EFAULT;
66315 @@ -725,7 +726,7 @@ long compat_sys_timer_gettime(timer_t timer_id,
66316 oldfs = get_fs();
66317 set_fs(KERNEL_DS);
66318 err = sys_timer_gettime(timer_id,
66319 - (struct itimerspec __user *) &ts);
66320 + (struct itimerspec __force_user *) &ts);
66321 set_fs(oldfs);
66322 if (!err && put_compat_itimerspec(setting, &ts))
66323 return -EFAULT;
66324 @@ -744,7 +745,7 @@ long compat_sys_clock_settime(clockid_t which_clock,
66325 oldfs = get_fs();
66326 set_fs(KERNEL_DS);
66327 err = sys_clock_settime(which_clock,
66328 - (struct timespec __user *) &ts);
66329 + (struct timespec __force_user *) &ts);
66330 set_fs(oldfs);
66331 return err;
66332 }
66333 @@ -759,7 +760,7 @@ long compat_sys_clock_gettime(clockid_t which_clock,
66334 oldfs = get_fs();
66335 set_fs(KERNEL_DS);
66336 err = sys_clock_gettime(which_clock,
66337 - (struct timespec __user *) &ts);
66338 + (struct timespec __force_user *) &ts);
66339 set_fs(oldfs);
66340 if (!err && put_compat_timespec(&ts, tp))
66341 return -EFAULT;
66342 @@ -779,7 +780,7 @@ long compat_sys_clock_adjtime(clockid_t which_clock,
66343
66344 oldfs = get_fs();
66345 set_fs(KERNEL_DS);
66346 - ret = sys_clock_adjtime(which_clock, (struct timex __user *) &txc);
66347 + ret = sys_clock_adjtime(which_clock, (struct timex __force_user *) &txc);
66348 set_fs(oldfs);
66349
66350 err = compat_put_timex(utp, &txc);
66351 @@ -799,7 +800,7 @@ long compat_sys_clock_getres(clockid_t which_clock,
66352 oldfs = get_fs();
66353 set_fs(KERNEL_DS);
66354 err = sys_clock_getres(which_clock,
66355 - (struct timespec __user *) &ts);
66356 + (struct timespec __force_user *) &ts);
66357 set_fs(oldfs);
66358 if (!err && tp && put_compat_timespec(&ts, tp))
66359 return -EFAULT;
66360 @@ -811,9 +812,9 @@ static long compat_clock_nanosleep_restart(struct restart_block *restart)
66361 long err;
66362 mm_segment_t oldfs;
66363 struct timespec tu;
66364 - struct compat_timespec *rmtp = restart->nanosleep.compat_rmtp;
66365 + struct compat_timespec __user *rmtp = restart->nanosleep.compat_rmtp;
66366
66367 - restart->nanosleep.rmtp = (struct timespec __user *) &tu;
66368 + restart->nanosleep.rmtp = (struct timespec __force_user *) &tu;
66369 oldfs = get_fs();
66370 set_fs(KERNEL_DS);
66371 err = clock_nanosleep_restart(restart);
66372 @@ -845,8 +846,8 @@ long compat_sys_clock_nanosleep(clockid_t which_clock, int flags,
66373 oldfs = get_fs();
66374 set_fs(KERNEL_DS);
66375 err = sys_clock_nanosleep(which_clock, flags,
66376 - (struct timespec __user *) &in,
66377 - (struct timespec __user *) &out);
66378 + (struct timespec __force_user *) &in,
66379 + (struct timespec __force_user *) &out);
66380 set_fs(oldfs);
66381
66382 if ((err == -ERESTART_RESTARTBLOCK) && rmtp &&
66383 diff --git a/kernel/configs.c b/kernel/configs.c
66384 index 42e8fa0..9e7406b 100644
66385 --- a/kernel/configs.c
66386 +++ b/kernel/configs.c
66387 @@ -74,8 +74,19 @@ static int __init ikconfig_init(void)
66388 struct proc_dir_entry *entry;
66389
66390 /* create the current config file */
66391 +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
66392 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
66393 + entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
66394 + &ikconfig_file_ops);
66395 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
66396 + entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
66397 + &ikconfig_file_ops);
66398 +#endif
66399 +#else
66400 entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
66401 &ikconfig_file_ops);
66402 +#endif
66403 +
66404 if (!entry)
66405 return -ENOMEM;
66406
66407 diff --git a/kernel/cred.c b/kernel/cred.c
66408 index de728ac..e3c267c 100644
66409 --- a/kernel/cred.c
66410 +++ b/kernel/cred.c
66411 @@ -207,6 +207,16 @@ void exit_creds(struct task_struct *tsk)
66412 validate_creds(cred);
66413 alter_cred_subscribers(cred, -1);
66414 put_cred(cred);
66415 +
66416 +#ifdef CONFIG_GRKERNSEC_SETXID
66417 + cred = (struct cred *) tsk->delayed_cred;
66418 + if (cred != NULL) {
66419 + tsk->delayed_cred = NULL;
66420 + validate_creds(cred);
66421 + alter_cred_subscribers(cred, -1);
66422 + put_cred(cred);
66423 + }
66424 +#endif
66425 }
66426
66427 /**
66428 @@ -469,7 +479,7 @@ error_put:
66429 * Always returns 0 thus allowing this function to be tail-called at the end
66430 * of, say, sys_setgid().
66431 */
66432 -int commit_creds(struct cred *new)
66433 +static int __commit_creds(struct cred *new)
66434 {
66435 struct task_struct *task = current;
66436 const struct cred *old = task->real_cred;
66437 @@ -488,6 +498,8 @@ int commit_creds(struct cred *new)
66438
66439 get_cred(new); /* we will require a ref for the subj creds too */
66440
66441 + gr_set_role_label(task, new->uid, new->gid);
66442 +
66443 /* dumpability changes */
66444 if (!uid_eq(old->euid, new->euid) ||
66445 !gid_eq(old->egid, new->egid) ||
66446 @@ -537,6 +549,101 @@ int commit_creds(struct cred *new)
66447 put_cred(old);
66448 return 0;
66449 }
66450 +#ifdef CONFIG_GRKERNSEC_SETXID
66451 +extern int set_user(struct cred *new);
66452 +
66453 +void gr_delayed_cred_worker(void)
66454 +{
66455 + const struct cred *new = current->delayed_cred;
66456 + struct cred *ncred;
66457 +
66458 + current->delayed_cred = NULL;
66459 +
66460 + if (current_uid() && new != NULL) {
66461 + // from doing get_cred on it when queueing this
66462 + put_cred(new);
66463 + return;
66464 + } else if (new == NULL)
66465 + return;
66466 +
66467 + ncred = prepare_creds();
66468 + if (!ncred)
66469 + goto die;
66470 + // uids
66471 + ncred->uid = new->uid;
66472 + ncred->euid = new->euid;
66473 + ncred->suid = new->suid;
66474 + ncred->fsuid = new->fsuid;
66475 + // gids
66476 + ncred->gid = new->gid;
66477 + ncred->egid = new->egid;
66478 + ncred->sgid = new->sgid;
66479 + ncred->fsgid = new->fsgid;
66480 + // groups
66481 + if (set_groups(ncred, new->group_info) < 0) {
66482 + abort_creds(ncred);
66483 + goto die;
66484 + }
66485 + // caps
66486 + ncred->securebits = new->securebits;
66487 + ncred->cap_inheritable = new->cap_inheritable;
66488 + ncred->cap_permitted = new->cap_permitted;
66489 + ncred->cap_effective = new->cap_effective;
66490 + ncred->cap_bset = new->cap_bset;
66491 +
66492 + if (set_user(ncred)) {
66493 + abort_creds(ncred);
66494 + goto die;
66495 + }
66496 +
66497 + // from doing get_cred on it when queueing this
66498 + put_cred(new);
66499 +
66500 + __commit_creds(ncred);
66501 + return;
66502 +die:
66503 + // from doing get_cred on it when queueing this
66504 + put_cred(new);
66505 + do_group_exit(SIGKILL);
66506 +}
66507 +#endif
66508 +
66509 +int commit_creds(struct cred *new)
66510 +{
66511 +#ifdef CONFIG_GRKERNSEC_SETXID
66512 + int ret;
66513 + int schedule_it = 0;
66514 + struct task_struct *t;
66515 +
66516 + /* we won't get called with tasklist_lock held for writing
66517 + and interrupts disabled as the cred struct in that case is
66518 + init_cred
66519 + */
66520 + if (grsec_enable_setxid && !current_is_single_threaded() &&
66521 + !current_uid() && new->uid) {
66522 + schedule_it = 1;
66523 + }
66524 + ret = __commit_creds(new);
66525 + if (schedule_it) {
66526 + rcu_read_lock();
66527 + read_lock(&tasklist_lock);
66528 + for (t = next_thread(current); t != current;
66529 + t = next_thread(t)) {
66530 + if (t->delayed_cred == NULL) {
66531 + t->delayed_cred = get_cred(new);
66532 + set_tsk_thread_flag(t, TIF_GRSEC_SETXID);
66533 + set_tsk_need_resched(t);
66534 + }
66535 + }
66536 + read_unlock(&tasklist_lock);
66537 + rcu_read_unlock();
66538 + }
66539 + return ret;
66540 +#else
66541 + return __commit_creds(new);
66542 +#endif
66543 +}
66544 +
66545 EXPORT_SYMBOL(commit_creds);
66546
66547 /**
66548 diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
66549 index 0557f24..1a00d9a 100644
66550 --- a/kernel/debug/debug_core.c
66551 +++ b/kernel/debug/debug_core.c
66552 @@ -122,7 +122,7 @@ static DEFINE_RAW_SPINLOCK(dbg_slave_lock);
66553 */
66554 static atomic_t masters_in_kgdb;
66555 static atomic_t slaves_in_kgdb;
66556 -static atomic_t kgdb_break_tasklet_var;
66557 +static atomic_unchecked_t kgdb_break_tasklet_var;
66558 atomic_t kgdb_setting_breakpoint;
66559
66560 struct task_struct *kgdb_usethread;
66561 @@ -132,7 +132,7 @@ int kgdb_single_step;
66562 static pid_t kgdb_sstep_pid;
66563
66564 /* to keep track of the CPU which is doing the single stepping*/
66565 -atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
66566 +atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
66567
66568 /*
66569 * If you are debugging a problem where roundup (the collection of
66570 @@ -540,7 +540,7 @@ return_normal:
66571 * kernel will only try for the value of sstep_tries before
66572 * giving up and continuing on.
66573 */
66574 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
66575 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
66576 (kgdb_info[cpu].task &&
66577 kgdb_info[cpu].task->pid != kgdb_sstep_pid) && --sstep_tries) {
66578 atomic_set(&kgdb_active, -1);
66579 @@ -634,8 +634,8 @@ cpu_master_loop:
66580 }
66581
66582 kgdb_restore:
66583 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
66584 - int sstep_cpu = atomic_read(&kgdb_cpu_doing_single_step);
66585 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
66586 + int sstep_cpu = atomic_read_unchecked(&kgdb_cpu_doing_single_step);
66587 if (kgdb_info[sstep_cpu].task)
66588 kgdb_sstep_pid = kgdb_info[sstep_cpu].task->pid;
66589 else
66590 @@ -861,18 +861,18 @@ static void kgdb_unregister_callbacks(void)
66591 static void kgdb_tasklet_bpt(unsigned long ing)
66592 {
66593 kgdb_breakpoint();
66594 - atomic_set(&kgdb_break_tasklet_var, 0);
66595 + atomic_set_unchecked(&kgdb_break_tasklet_var, 0);
66596 }
66597
66598 static DECLARE_TASKLET(kgdb_tasklet_breakpoint, kgdb_tasklet_bpt, 0);
66599
66600 void kgdb_schedule_breakpoint(void)
66601 {
66602 - if (atomic_read(&kgdb_break_tasklet_var) ||
66603 + if (atomic_read_unchecked(&kgdb_break_tasklet_var) ||
66604 atomic_read(&kgdb_active) != -1 ||
66605 atomic_read(&kgdb_setting_breakpoint))
66606 return;
66607 - atomic_inc(&kgdb_break_tasklet_var);
66608 + atomic_inc_unchecked(&kgdb_break_tasklet_var);
66609 tasklet_schedule(&kgdb_tasklet_breakpoint);
66610 }
66611 EXPORT_SYMBOL_GPL(kgdb_schedule_breakpoint);
66612 diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
66613 index 1f91413..362a0a1 100644
66614 --- a/kernel/debug/kdb/kdb_main.c
66615 +++ b/kernel/debug/kdb/kdb_main.c
66616 @@ -1984,7 +1984,7 @@ static int kdb_lsmod(int argc, const char **argv)
66617 list_for_each_entry(mod, kdb_modules, list) {
66618
66619 kdb_printf("%-20s%8u 0x%p ", mod->name,
66620 - mod->core_size, (void *)mod);
66621 + mod->core_size_rx + mod->core_size_rw, (void *)mod);
66622 #ifdef CONFIG_MODULE_UNLOAD
66623 kdb_printf("%4ld ", module_refcount(mod));
66624 #endif
66625 @@ -1994,7 +1994,7 @@ static int kdb_lsmod(int argc, const char **argv)
66626 kdb_printf(" (Loading)");
66627 else
66628 kdb_printf(" (Live)");
66629 - kdb_printf(" 0x%p", mod->module_core);
66630 + kdb_printf(" 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
66631
66632 #ifdef CONFIG_MODULE_UNLOAD
66633 {
66634 diff --git a/kernel/events/core.c b/kernel/events/core.c
66635 index d7d71d6..f54b76f 100644
66636 --- a/kernel/events/core.c
66637 +++ b/kernel/events/core.c
66638 @@ -181,7 +181,7 @@ int perf_proc_update_handler(struct ctl_table *table, int write,
66639 return 0;
66640 }
66641
66642 -static atomic64_t perf_event_id;
66643 +static atomic64_unchecked_t perf_event_id;
66644
66645 static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
66646 enum event_type_t event_type);
66647 @@ -2663,7 +2663,7 @@ static void __perf_event_read(void *info)
66648
66649 static inline u64 perf_event_count(struct perf_event *event)
66650 {
66651 - return local64_read(&event->count) + atomic64_read(&event->child_count);
66652 + return local64_read(&event->count) + atomic64_read_unchecked(&event->child_count);
66653 }
66654
66655 static u64 perf_event_read(struct perf_event *event)
66656 @@ -2987,9 +2987,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
66657 mutex_lock(&event->child_mutex);
66658 total += perf_event_read(event);
66659 *enabled += event->total_time_enabled +
66660 - atomic64_read(&event->child_total_time_enabled);
66661 + atomic64_read_unchecked(&event->child_total_time_enabled);
66662 *running += event->total_time_running +
66663 - atomic64_read(&event->child_total_time_running);
66664 + atomic64_read_unchecked(&event->child_total_time_running);
66665
66666 list_for_each_entry(child, &event->child_list, child_list) {
66667 total += perf_event_read(child);
66668 @@ -3396,10 +3396,10 @@ void perf_event_update_userpage(struct perf_event *event)
66669 userpg->offset -= local64_read(&event->hw.prev_count);
66670
66671 userpg->time_enabled = enabled +
66672 - atomic64_read(&event->child_total_time_enabled);
66673 + atomic64_read_unchecked(&event->child_total_time_enabled);
66674
66675 userpg->time_running = running +
66676 - atomic64_read(&event->child_total_time_running);
66677 + atomic64_read_unchecked(&event->child_total_time_running);
66678
66679 arch_perf_update_userpage(userpg, now);
66680
66681 @@ -3832,11 +3832,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
66682 values[n++] = perf_event_count(event);
66683 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
66684 values[n++] = enabled +
66685 - atomic64_read(&event->child_total_time_enabled);
66686 + atomic64_read_unchecked(&event->child_total_time_enabled);
66687 }
66688 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
66689 values[n++] = running +
66690 - atomic64_read(&event->child_total_time_running);
66691 + atomic64_read_unchecked(&event->child_total_time_running);
66692 }
66693 if (read_format & PERF_FORMAT_ID)
66694 values[n++] = primary_event_id(event);
66695 @@ -4514,12 +4514,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
66696 * need to add enough zero bytes after the string to handle
66697 * the 64bit alignment we do later.
66698 */
66699 - buf = kzalloc(PATH_MAX + sizeof(u64), GFP_KERNEL);
66700 + buf = kzalloc(PATH_MAX, GFP_KERNEL);
66701 if (!buf) {
66702 name = strncpy(tmp, "//enomem", sizeof(tmp));
66703 goto got_name;
66704 }
66705 - name = d_path(&file->f_path, buf, PATH_MAX);
66706 + name = d_path(&file->f_path, buf, PATH_MAX - sizeof(u64));
66707 if (IS_ERR(name)) {
66708 name = strncpy(tmp, "//toolong", sizeof(tmp));
66709 goto got_name;
66710 @@ -5931,7 +5931,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
66711 event->parent = parent_event;
66712
66713 event->ns = get_pid_ns(current->nsproxy->pid_ns);
66714 - event->id = atomic64_inc_return(&perf_event_id);
66715 + event->id = atomic64_inc_return_unchecked(&perf_event_id);
66716
66717 event->state = PERF_EVENT_STATE_INACTIVE;
66718
66719 @@ -6493,10 +6493,10 @@ static void sync_child_event(struct perf_event *child_event,
66720 /*
66721 * Add back the child's count to the parent's count:
66722 */
66723 - atomic64_add(child_val, &parent_event->child_count);
66724 - atomic64_add(child_event->total_time_enabled,
66725 + atomic64_add_unchecked(child_val, &parent_event->child_count);
66726 + atomic64_add_unchecked(child_event->total_time_enabled,
66727 &parent_event->child_total_time_enabled);
66728 - atomic64_add(child_event->total_time_running,
66729 + atomic64_add_unchecked(child_event->total_time_running,
66730 &parent_event->child_total_time_running);
66731
66732 /*
66733 diff --git a/kernel/exit.c b/kernel/exit.c
66734 index 46ce8da..c648f3a 100644
66735 --- a/kernel/exit.c
66736 +++ b/kernel/exit.c
66737 @@ -59,6 +59,10 @@
66738 #include <asm/pgtable.h>
66739 #include <asm/mmu_context.h>
66740
66741 +#ifdef CONFIG_GRKERNSEC
66742 +extern rwlock_t grsec_exec_file_lock;
66743 +#endif
66744 +
66745 static void exit_mm(struct task_struct * tsk);
66746
66747 static void __unhash_process(struct task_struct *p, bool group_dead)
66748 @@ -182,6 +186,10 @@ void release_task(struct task_struct * p)
66749 struct task_struct *leader;
66750 int zap_leader;
66751 repeat:
66752 +#ifdef CONFIG_NET
66753 + gr_del_task_from_ip_table(p);
66754 +#endif
66755 +
66756 /* don't need to get the RCU readlock here - the process is dead and
66757 * can't be modifying its own credentials. But shut RCU-lockdep up */
66758 rcu_read_lock();
66759 @@ -394,7 +402,7 @@ int allow_signal(int sig)
66760 * know it'll be handled, so that they don't get converted to
66761 * SIGKILL or just silently dropped.
66762 */
66763 - current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
66764 + current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
66765 recalc_sigpending();
66766 spin_unlock_irq(&current->sighand->siglock);
66767 return 0;
66768 @@ -430,6 +438,17 @@ void daemonize(const char *name, ...)
66769 vsnprintf(current->comm, sizeof(current->comm), name, args);
66770 va_end(args);
66771
66772 +#ifdef CONFIG_GRKERNSEC
66773 + write_lock(&grsec_exec_file_lock);
66774 + if (current->exec_file) {
66775 + fput(current->exec_file);
66776 + current->exec_file = NULL;
66777 + }
66778 + write_unlock(&grsec_exec_file_lock);
66779 +#endif
66780 +
66781 + gr_set_kernel_label(current);
66782 +
66783 /*
66784 * If we were started as result of loading a module, close all of the
66785 * user space pages. We don't need them, and if we didn't close them
66786 @@ -907,6 +926,8 @@ void do_exit(long code)
66787 struct task_struct *tsk = current;
66788 int group_dead;
66789
66790 + set_fs(USER_DS);
66791 +
66792 profile_task_exit(tsk);
66793
66794 WARN_ON(blk_needs_flush_plug(tsk));
66795 @@ -923,7 +944,6 @@ void do_exit(long code)
66796 * mm_release()->clear_child_tid() from writing to a user-controlled
66797 * kernel address.
66798 */
66799 - set_fs(USER_DS);
66800
66801 ptrace_event(PTRACE_EVENT_EXIT, code);
66802
66803 @@ -985,6 +1005,9 @@ void do_exit(long code)
66804 tsk->exit_code = code;
66805 taskstats_exit(tsk, group_dead);
66806
66807 + gr_acl_handle_psacct(tsk, code);
66808 + gr_acl_handle_exit();
66809 +
66810 exit_mm(tsk);
66811
66812 if (group_dead)
66813 @@ -1101,7 +1124,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
66814 * Take down every thread in the group. This is called by fatal signals
66815 * as well as by sys_exit_group (below).
66816 */
66817 -void
66818 +__noreturn void
66819 do_group_exit(int exit_code)
66820 {
66821 struct signal_struct *sig = current->signal;
66822 diff --git a/kernel/fork.c b/kernel/fork.c
66823 index f9d0499..e4f8f44 100644
66824 --- a/kernel/fork.c
66825 +++ b/kernel/fork.c
66826 @@ -321,7 +321,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
66827 *stackend = STACK_END_MAGIC; /* for overflow detection */
66828
66829 #ifdef CONFIG_CC_STACKPROTECTOR
66830 - tsk->stack_canary = get_random_int();
66831 + tsk->stack_canary = pax_get_random_long();
66832 #endif
66833
66834 /*
66835 @@ -345,13 +345,78 @@ out:
66836 }
66837
66838 #ifdef CONFIG_MMU
66839 +static struct vm_area_struct *dup_vma(struct mm_struct *mm, struct mm_struct *oldmm, struct vm_area_struct *mpnt)
66840 +{
66841 + struct vm_area_struct *tmp;
66842 + unsigned long charge;
66843 + struct mempolicy *pol;
66844 + struct file *file;
66845 +
66846 + charge = 0;
66847 + if (mpnt->vm_flags & VM_ACCOUNT) {
66848 + unsigned long len;
66849 + len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
66850 + if (security_vm_enough_memory_mm(oldmm, len)) /* sic */
66851 + goto fail_nomem;
66852 + charge = len;
66853 + }
66854 + tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
66855 + if (!tmp)
66856 + goto fail_nomem;
66857 + *tmp = *mpnt;
66858 + tmp->vm_mm = mm;
66859 + INIT_LIST_HEAD(&tmp->anon_vma_chain);
66860 + pol = mpol_dup(vma_policy(mpnt));
66861 + if (IS_ERR(pol))
66862 + goto fail_nomem_policy;
66863 + vma_set_policy(tmp, pol);
66864 + if (anon_vma_fork(tmp, mpnt))
66865 + goto fail_nomem_anon_vma_fork;
66866 + tmp->vm_flags &= ~VM_LOCKED;
66867 + tmp->vm_next = tmp->vm_prev = NULL;
66868 + tmp->vm_mirror = NULL;
66869 + file = tmp->vm_file;
66870 + if (file) {
66871 + struct inode *inode = file->f_path.dentry->d_inode;
66872 + struct address_space *mapping = file->f_mapping;
66873 +
66874 + get_file(file);
66875 + if (tmp->vm_flags & VM_DENYWRITE)
66876 + atomic_dec(&inode->i_writecount);
66877 + mutex_lock(&mapping->i_mmap_mutex);
66878 + if (tmp->vm_flags & VM_SHARED)
66879 + mapping->i_mmap_writable++;
66880 + flush_dcache_mmap_lock(mapping);
66881 + /* insert tmp into the share list, just after mpnt */
66882 + vma_prio_tree_add(tmp, mpnt);
66883 + flush_dcache_mmap_unlock(mapping);
66884 + mutex_unlock(&mapping->i_mmap_mutex);
66885 + }
66886 +
66887 + /*
66888 + * Clear hugetlb-related page reserves for children. This only
66889 + * affects MAP_PRIVATE mappings. Faults generated by the child
66890 + * are not guaranteed to succeed, even if read-only
66891 + */
66892 + if (is_vm_hugetlb_page(tmp))
66893 + reset_vma_resv_huge_pages(tmp);
66894 +
66895 + return tmp;
66896 +
66897 +fail_nomem_anon_vma_fork:
66898 + mpol_put(pol);
66899 +fail_nomem_policy:
66900 + kmem_cache_free(vm_area_cachep, tmp);
66901 +fail_nomem:
66902 + vm_unacct_memory(charge);
66903 + return NULL;
66904 +}
66905 +
66906 static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
66907 {
66908 struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
66909 struct rb_node **rb_link, *rb_parent;
66910 int retval;
66911 - unsigned long charge;
66912 - struct mempolicy *pol;
66913
66914 down_write(&oldmm->mmap_sem);
66915 flush_cache_dup_mm(oldmm);
66916 @@ -363,8 +428,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
66917 mm->locked_vm = 0;
66918 mm->mmap = NULL;
66919 mm->mmap_cache = NULL;
66920 - mm->free_area_cache = oldmm->mmap_base;
66921 - mm->cached_hole_size = ~0UL;
66922 + mm->free_area_cache = oldmm->free_area_cache;
66923 + mm->cached_hole_size = oldmm->cached_hole_size;
66924 mm->map_count = 0;
66925 cpumask_clear(mm_cpumask(mm));
66926 mm->mm_rb = RB_ROOT;
66927 @@ -380,8 +445,6 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
66928
66929 prev = NULL;
66930 for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
66931 - struct file *file;
66932 -
66933 if (mpnt->vm_flags & VM_DONTCOPY) {
66934 long pages = vma_pages(mpnt);
66935 mm->total_vm -= pages;
66936 @@ -389,54 +452,11 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
66937 -pages);
66938 continue;
66939 }
66940 - charge = 0;
66941 - if (mpnt->vm_flags & VM_ACCOUNT) {
66942 - unsigned long len;
66943 - len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
66944 - if (security_vm_enough_memory_mm(oldmm, len)) /* sic */
66945 - goto fail_nomem;
66946 - charge = len;
66947 + tmp = dup_vma(mm, oldmm, mpnt);
66948 + if (!tmp) {
66949 + retval = -ENOMEM;
66950 + goto out;
66951 }
66952 - tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
66953 - if (!tmp)
66954 - goto fail_nomem;
66955 - *tmp = *mpnt;
66956 - INIT_LIST_HEAD(&tmp->anon_vma_chain);
66957 - pol = mpol_dup(vma_policy(mpnt));
66958 - retval = PTR_ERR(pol);
66959 - if (IS_ERR(pol))
66960 - goto fail_nomem_policy;
66961 - vma_set_policy(tmp, pol);
66962 - tmp->vm_mm = mm;
66963 - if (anon_vma_fork(tmp, mpnt))
66964 - goto fail_nomem_anon_vma_fork;
66965 - tmp->vm_flags &= ~VM_LOCKED;
66966 - tmp->vm_next = tmp->vm_prev = NULL;
66967 - file = tmp->vm_file;
66968 - if (file) {
66969 - struct inode *inode = file->f_path.dentry->d_inode;
66970 - struct address_space *mapping = file->f_mapping;
66971 -
66972 - get_file(file);
66973 - if (tmp->vm_flags & VM_DENYWRITE)
66974 - atomic_dec(&inode->i_writecount);
66975 - mutex_lock(&mapping->i_mmap_mutex);
66976 - if (tmp->vm_flags & VM_SHARED)
66977 - mapping->i_mmap_writable++;
66978 - flush_dcache_mmap_lock(mapping);
66979 - /* insert tmp into the share list, just after mpnt */
66980 - vma_prio_tree_add(tmp, mpnt);
66981 - flush_dcache_mmap_unlock(mapping);
66982 - mutex_unlock(&mapping->i_mmap_mutex);
66983 - }
66984 -
66985 - /*
66986 - * Clear hugetlb-related page reserves for children. This only
66987 - * affects MAP_PRIVATE mappings. Faults generated by the child
66988 - * are not guaranteed to succeed, even if read-only
66989 - */
66990 - if (is_vm_hugetlb_page(tmp))
66991 - reset_vma_resv_huge_pages(tmp);
66992
66993 /*
66994 * Link in the new vma and copy the page table entries.
66995 @@ -459,9 +479,34 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
66996 if (retval)
66997 goto out;
66998
66999 - if (file)
67000 + if (tmp->vm_file)
67001 uprobe_mmap(tmp);
67002 }
67003 +
67004 +#ifdef CONFIG_PAX_SEGMEXEC
67005 + if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
67006 + struct vm_area_struct *mpnt_m;
67007 +
67008 + for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
67009 + BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
67010 +
67011 + if (!mpnt->vm_mirror)
67012 + continue;
67013 +
67014 + if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
67015 + BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
67016 + mpnt->vm_mirror = mpnt_m;
67017 + } else {
67018 + BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
67019 + mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
67020 + mpnt_m->vm_mirror->vm_mirror = mpnt_m;
67021 + mpnt->vm_mirror->vm_mirror = mpnt;
67022 + }
67023 + }
67024 + BUG_ON(mpnt_m);
67025 + }
67026 +#endif
67027 +
67028 /* a new mm has just been created */
67029 arch_dup_mmap(oldmm, mm);
67030 retval = 0;
67031 @@ -470,14 +515,6 @@ out:
67032 flush_tlb_mm(oldmm);
67033 up_write(&oldmm->mmap_sem);
67034 return retval;
67035 -fail_nomem_anon_vma_fork:
67036 - mpol_put(pol);
67037 -fail_nomem_policy:
67038 - kmem_cache_free(vm_area_cachep, tmp);
67039 -fail_nomem:
67040 - retval = -ENOMEM;
67041 - vm_unacct_memory(charge);
67042 - goto out;
67043 }
67044
67045 static inline int mm_alloc_pgd(struct mm_struct *mm)
67046 @@ -714,8 +751,8 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
67047 return ERR_PTR(err);
67048
67049 mm = get_task_mm(task);
67050 - if (mm && mm != current->mm &&
67051 - !ptrace_may_access(task, mode)) {
67052 + if (mm && ((mm != current->mm && !ptrace_may_access(task, mode)) ||
67053 + (mode == PTRACE_MODE_ATTACH && (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))))) {
67054 mmput(mm);
67055 mm = ERR_PTR(-EACCES);
67056 }
67057 @@ -936,13 +973,14 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
67058 spin_unlock(&fs->lock);
67059 return -EAGAIN;
67060 }
67061 - fs->users++;
67062 + atomic_inc(&fs->users);
67063 spin_unlock(&fs->lock);
67064 return 0;
67065 }
67066 tsk->fs = copy_fs_struct(fs);
67067 if (!tsk->fs)
67068 return -ENOMEM;
67069 + gr_set_chroot_entries(tsk, &tsk->fs->root);
67070 return 0;
67071 }
67072
67073 @@ -1209,6 +1247,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
67074 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
67075 #endif
67076 retval = -EAGAIN;
67077 +
67078 + gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
67079 +
67080 if (atomic_read(&p->real_cred->user->processes) >=
67081 task_rlimit(p, RLIMIT_NPROC)) {
67082 if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
67083 @@ -1431,6 +1472,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
67084 /* Need tasklist lock for parent etc handling! */
67085 write_lock_irq(&tasklist_lock);
67086
67087 + /* synchronizes with gr_set_acls() */
67088 + gr_copy_label(p);
67089 +
67090 /* CLONE_PARENT re-uses the old parent */
67091 if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
67092 p->real_parent = current->real_parent;
67093 @@ -1541,6 +1585,8 @@ bad_fork_cleanup_count:
67094 bad_fork_free:
67095 free_task(p);
67096 fork_out:
67097 + gr_log_forkfail(retval);
67098 +
67099 return ERR_PTR(retval);
67100 }
67101
67102 @@ -1641,6 +1687,8 @@ long do_fork(unsigned long clone_flags,
67103 if (clone_flags & CLONE_PARENT_SETTID)
67104 put_user(nr, parent_tidptr);
67105
67106 + gr_handle_brute_check();
67107 +
67108 if (clone_flags & CLONE_VFORK) {
67109 p->vfork_done = &vfork;
67110 init_completion(&vfork);
67111 @@ -1739,7 +1787,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
67112 return 0;
67113
67114 /* don't need lock here; in the worst case we'll do useless copy */
67115 - if (fs->users == 1)
67116 + if (atomic_read(&fs->users) == 1)
67117 return 0;
67118
67119 *new_fsp = copy_fs_struct(fs);
67120 @@ -1828,7 +1876,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
67121 fs = current->fs;
67122 spin_lock(&fs->lock);
67123 current->fs = new_fs;
67124 - if (--fs->users)
67125 + gr_set_chroot_entries(current, &current->fs->root);
67126 + if (atomic_dec_return(&fs->users))
67127 new_fs = NULL;
67128 else
67129 new_fs = fs;
67130 diff --git a/kernel/futex.c b/kernel/futex.c
67131 index 3717e7b..473c750 100644
67132 --- a/kernel/futex.c
67133 +++ b/kernel/futex.c
67134 @@ -54,6 +54,7 @@
67135 #include <linux/mount.h>
67136 #include <linux/pagemap.h>
67137 #include <linux/syscalls.h>
67138 +#include <linux/ptrace.h>
67139 #include <linux/signal.h>
67140 #include <linux/export.h>
67141 #include <linux/magic.h>
67142 @@ -239,6 +240,11 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
67143 struct page *page, *page_head;
67144 int err, ro = 0;
67145
67146 +#ifdef CONFIG_PAX_SEGMEXEC
67147 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
67148 + return -EFAULT;
67149 +#endif
67150 +
67151 /*
67152 * The futex address must be "naturally" aligned.
67153 */
67154 @@ -2714,6 +2720,7 @@ static int __init futex_init(void)
67155 {
67156 u32 curval;
67157 int i;
67158 + mm_segment_t oldfs;
67159
67160 /*
67161 * This will fail and we want it. Some arch implementations do
67162 @@ -2725,8 +2732,11 @@ static int __init futex_init(void)
67163 * implementation, the non-functional ones will return
67164 * -ENOSYS.
67165 */
67166 + oldfs = get_fs();
67167 + set_fs(USER_DS);
67168 if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT)
67169 futex_cmpxchg_enabled = 1;
67170 + set_fs(oldfs);
67171
67172 for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
67173 plist_head_init(&futex_queues[i].chain);
67174 diff --git a/kernel/gcov/base.c b/kernel/gcov/base.c
67175 index 9b22d03..6295b62 100644
67176 --- a/kernel/gcov/base.c
67177 +++ b/kernel/gcov/base.c
67178 @@ -102,11 +102,6 @@ void gcov_enable_events(void)
67179 }
67180
67181 #ifdef CONFIG_MODULES
67182 -static inline int within(void *addr, void *start, unsigned long size)
67183 -{
67184 - return ((addr >= start) && (addr < start + size));
67185 -}
67186 -
67187 /* Update list and generate events when modules are unloaded. */
67188 static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
67189 void *data)
67190 @@ -121,7 +116,7 @@ static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
67191 prev = NULL;
67192 /* Remove entries located in module from linked list. */
67193 for (info = gcov_info_head; info; info = info->next) {
67194 - if (within(info, mod->module_core, mod->core_size)) {
67195 + if (within_module_core_rw((unsigned long)info, mod)) {
67196 if (prev)
67197 prev->next = info->next;
67198 else
67199 diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
67200 index 6db7a5e..25b6648 100644
67201 --- a/kernel/hrtimer.c
67202 +++ b/kernel/hrtimer.c
67203 @@ -1407,7 +1407,7 @@ void hrtimer_peek_ahead_timers(void)
67204 local_irq_restore(flags);
67205 }
67206
67207 -static void run_hrtimer_softirq(struct softirq_action *h)
67208 +static void run_hrtimer_softirq(void)
67209 {
67210 struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
67211
67212 diff --git a/kernel/jump_label.c b/kernel/jump_label.c
67213 index 4304919..408c4c0 100644
67214 --- a/kernel/jump_label.c
67215 +++ b/kernel/jump_label.c
67216 @@ -13,6 +13,7 @@
67217 #include <linux/sort.h>
67218 #include <linux/err.h>
67219 #include <linux/static_key.h>
67220 +#include <linux/mm.h>
67221
67222 #ifdef HAVE_JUMP_LABEL
67223
67224 @@ -50,7 +51,9 @@ jump_label_sort_entries(struct jump_entry *start, struct jump_entry *stop)
67225
67226 size = (((unsigned long)stop - (unsigned long)start)
67227 / sizeof(struct jump_entry));
67228 + pax_open_kernel();
67229 sort(start, size, sizeof(struct jump_entry), jump_label_cmp, NULL);
67230 + pax_close_kernel();
67231 }
67232
67233 static void jump_label_update(struct static_key *key, int enable);
67234 @@ -356,10 +359,12 @@ static void jump_label_invalidate_module_init(struct module *mod)
67235 struct jump_entry *iter_stop = iter_start + mod->num_jump_entries;
67236 struct jump_entry *iter;
67237
67238 + pax_open_kernel();
67239 for (iter = iter_start; iter < iter_stop; iter++) {
67240 if (within_module_init(iter->code, mod))
67241 iter->code = 0;
67242 }
67243 + pax_close_kernel();
67244 }
67245
67246 static int
67247 diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
67248 index 2169fee..45c017a 100644
67249 --- a/kernel/kallsyms.c
67250 +++ b/kernel/kallsyms.c
67251 @@ -11,6 +11,9 @@
67252 * Changed the compression method from stem compression to "table lookup"
67253 * compression (see scripts/kallsyms.c for a more complete description)
67254 */
67255 +#ifdef CONFIG_GRKERNSEC_HIDESYM
67256 +#define __INCLUDED_BY_HIDESYM 1
67257 +#endif
67258 #include <linux/kallsyms.h>
67259 #include <linux/module.h>
67260 #include <linux/init.h>
67261 @@ -53,12 +56,33 @@ extern const unsigned long kallsyms_markers[] __attribute__((weak));
67262
67263 static inline int is_kernel_inittext(unsigned long addr)
67264 {
67265 + if (system_state != SYSTEM_BOOTING)
67266 + return 0;
67267 +
67268 if (addr >= (unsigned long)_sinittext
67269 && addr <= (unsigned long)_einittext)
67270 return 1;
67271 return 0;
67272 }
67273
67274 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67275 +#ifdef CONFIG_MODULES
67276 +static inline int is_module_text(unsigned long addr)
67277 +{
67278 + if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
67279 + return 1;
67280 +
67281 + addr = ktla_ktva(addr);
67282 + return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
67283 +}
67284 +#else
67285 +static inline int is_module_text(unsigned long addr)
67286 +{
67287 + return 0;
67288 +}
67289 +#endif
67290 +#endif
67291 +
67292 static inline int is_kernel_text(unsigned long addr)
67293 {
67294 if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
67295 @@ -69,13 +93,28 @@ static inline int is_kernel_text(unsigned long addr)
67296
67297 static inline int is_kernel(unsigned long addr)
67298 {
67299 +
67300 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67301 + if (is_kernel_text(addr) || is_kernel_inittext(addr))
67302 + return 1;
67303 +
67304 + if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
67305 +#else
67306 if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
67307 +#endif
67308 +
67309 return 1;
67310 return in_gate_area_no_mm(addr);
67311 }
67312
67313 static int is_ksym_addr(unsigned long addr)
67314 {
67315 +
67316 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67317 + if (is_module_text(addr))
67318 + return 0;
67319 +#endif
67320 +
67321 if (all_var)
67322 return is_kernel(addr);
67323
67324 @@ -470,7 +509,6 @@ static unsigned long get_ksymbol_core(struct kallsym_iter *iter)
67325
67326 static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
67327 {
67328 - iter->name[0] = '\0';
67329 iter->nameoff = get_symbol_offset(new_pos);
67330 iter->pos = new_pos;
67331 }
67332 @@ -518,6 +556,11 @@ static int s_show(struct seq_file *m, void *p)
67333 {
67334 struct kallsym_iter *iter = m->private;
67335
67336 +#ifdef CONFIG_GRKERNSEC_HIDESYM
67337 + if (current_uid())
67338 + return 0;
67339 +#endif
67340 +
67341 /* Some debugging symbols have no name. Ignore them. */
67342 if (!iter->name[0])
67343 return 0;
67344 @@ -531,6 +574,7 @@ static int s_show(struct seq_file *m, void *p)
67345 */
67346 type = iter->exported ? toupper(iter->type) :
67347 tolower(iter->type);
67348 +
67349 seq_printf(m, "%pK %c %s\t[%s]\n", (void *)iter->value,
67350 type, iter->name, iter->module_name);
67351 } else
67352 @@ -556,7 +600,7 @@ static int kallsyms_open(struct inode *inode, struct file *file)
67353 struct kallsym_iter *iter;
67354 int ret;
67355
67356 - iter = kmalloc(sizeof(*iter), GFP_KERNEL);
67357 + iter = kzalloc(sizeof(*iter), GFP_KERNEL);
67358 if (!iter)
67359 return -ENOMEM;
67360 reset_iter(iter, 0);
67361 diff --git a/kernel/kexec.c b/kernel/kexec.c
67362 index 4e2e472..cd0c7ae 100644
67363 --- a/kernel/kexec.c
67364 +++ b/kernel/kexec.c
67365 @@ -1046,7 +1046,8 @@ asmlinkage long compat_sys_kexec_load(unsigned long entry,
67366 unsigned long flags)
67367 {
67368 struct compat_kexec_segment in;
67369 - struct kexec_segment out, __user *ksegments;
67370 + struct kexec_segment out;
67371 + struct kexec_segment __user *ksegments;
67372 unsigned long i, result;
67373
67374 /* Don't allow clients that don't understand the native
67375 diff --git a/kernel/kmod.c b/kernel/kmod.c
67376 index ff2c7cb..085d7af 100644
67377 --- a/kernel/kmod.c
67378 +++ b/kernel/kmod.c
67379 @@ -66,7 +66,7 @@ static void free_modprobe_argv(struct subprocess_info *info)
67380 kfree(info->argv);
67381 }
67382
67383 -static int call_modprobe(char *module_name, int wait)
67384 +static int call_modprobe(char *module_name, char *module_param, int wait)
67385 {
67386 static char *envp[] = {
67387 "HOME=/",
67388 @@ -75,7 +75,7 @@ static int call_modprobe(char *module_name, int wait)
67389 NULL
67390 };
67391
67392 - char **argv = kmalloc(sizeof(char *[5]), GFP_KERNEL);
67393 + char **argv = kmalloc(sizeof(char *[6]), GFP_KERNEL);
67394 if (!argv)
67395 goto out;
67396
67397 @@ -87,7 +87,8 @@ static int call_modprobe(char *module_name, int wait)
67398 argv[1] = "-q";
67399 argv[2] = "--";
67400 argv[3] = module_name; /* check free_modprobe_argv() */
67401 - argv[4] = NULL;
67402 + argv[4] = module_param;
67403 + argv[5] = NULL;
67404
67405 return call_usermodehelper_fns(modprobe_path, argv, envp,
67406 wait | UMH_KILLABLE, NULL, free_modprobe_argv, NULL);
67407 @@ -112,9 +113,8 @@ out:
67408 * If module auto-loading support is disabled then this function
67409 * becomes a no-operation.
67410 */
67411 -int __request_module(bool wait, const char *fmt, ...)
67412 +static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
67413 {
67414 - va_list args;
67415 char module_name[MODULE_NAME_LEN];
67416 unsigned int max_modprobes;
67417 int ret;
67418 @@ -122,9 +122,7 @@ int __request_module(bool wait, const char *fmt, ...)
67419 #define MAX_KMOD_CONCURRENT 50 /* Completely arbitrary value - KAO */
67420 static int kmod_loop_msg;
67421
67422 - va_start(args, fmt);
67423 - ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
67424 - va_end(args);
67425 + ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
67426 if (ret >= MODULE_NAME_LEN)
67427 return -ENAMETOOLONG;
67428
67429 @@ -132,6 +130,20 @@ int __request_module(bool wait, const char *fmt, ...)
67430 if (ret)
67431 return ret;
67432
67433 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
67434 + if (!current_uid()) {
67435 + /* hack to workaround consolekit/udisks stupidity */
67436 + read_lock(&tasklist_lock);
67437 + if (!strcmp(current->comm, "mount") &&
67438 + current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
67439 + read_unlock(&tasklist_lock);
67440 + printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
67441 + return -EPERM;
67442 + }
67443 + read_unlock(&tasklist_lock);
67444 + }
67445 +#endif
67446 +
67447 /* If modprobe needs a service that is in a module, we get a recursive
67448 * loop. Limit the number of running kmod threads to max_threads/2 or
67449 * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
67450 @@ -160,11 +172,52 @@ int __request_module(bool wait, const char *fmt, ...)
67451
67452 trace_module_request(module_name, wait, _RET_IP_);
67453
67454 - ret = call_modprobe(module_name, wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC);
67455 + ret = call_modprobe(module_name, module_param, wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC);
67456
67457 atomic_dec(&kmod_concurrent);
67458 return ret;
67459 }
67460 +
67461 +int ___request_module(bool wait, char *module_param, const char *fmt, ...)
67462 +{
67463 + va_list args;
67464 + int ret;
67465 +
67466 + va_start(args, fmt);
67467 + ret = ____request_module(wait, module_param, fmt, args);
67468 + va_end(args);
67469 +
67470 + return ret;
67471 +}
67472 +
67473 +int __request_module(bool wait, const char *fmt, ...)
67474 +{
67475 + va_list args;
67476 + int ret;
67477 +
67478 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
67479 + if (current_uid()) {
67480 + char module_param[MODULE_NAME_LEN];
67481 +
67482 + memset(module_param, 0, sizeof(module_param));
67483 +
67484 + snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
67485 +
67486 + va_start(args, fmt);
67487 + ret = ____request_module(wait, module_param, fmt, args);
67488 + va_end(args);
67489 +
67490 + return ret;
67491 + }
67492 +#endif
67493 +
67494 + va_start(args, fmt);
67495 + ret = ____request_module(wait, NULL, fmt, args);
67496 + va_end(args);
67497 +
67498 + return ret;
67499 +}
67500 +
67501 EXPORT_SYMBOL(__request_module);
67502 #endif /* CONFIG_MODULES */
67503
67504 @@ -266,7 +319,7 @@ static int wait_for_helper(void *data)
67505 *
67506 * Thus the __user pointer cast is valid here.
67507 */
67508 - sys_wait4(pid, (int __user *)&ret, 0, NULL);
67509 + sys_wait4(pid, (int __force_user *)&ret, 0, NULL);
67510
67511 /*
67512 * If ret is 0, either ____call_usermodehelper failed and the
67513 diff --git a/kernel/kprobes.c b/kernel/kprobes.c
67514 index c62b854..cb67968 100644
67515 --- a/kernel/kprobes.c
67516 +++ b/kernel/kprobes.c
67517 @@ -185,7 +185,7 @@ static kprobe_opcode_t __kprobes *__get_insn_slot(struct kprobe_insn_cache *c)
67518 * kernel image and loaded module images reside. This is required
67519 * so x86_64 can correctly handle the %rip-relative fixups.
67520 */
67521 - kip->insns = module_alloc(PAGE_SIZE);
67522 + kip->insns = module_alloc_exec(PAGE_SIZE);
67523 if (!kip->insns) {
67524 kfree(kip);
67525 return NULL;
67526 @@ -225,7 +225,7 @@ static int __kprobes collect_one_slot(struct kprobe_insn_page *kip, int idx)
67527 */
67528 if (!list_is_singular(&kip->list)) {
67529 list_del(&kip->list);
67530 - module_free(NULL, kip->insns);
67531 + module_free_exec(NULL, kip->insns);
67532 kfree(kip);
67533 }
67534 return 1;
67535 @@ -1955,7 +1955,7 @@ static int __init init_kprobes(void)
67536 {
67537 int i, err = 0;
67538 unsigned long offset = 0, size = 0;
67539 - char *modname, namebuf[128];
67540 + char *modname, namebuf[KSYM_NAME_LEN];
67541 const char *symbol_name;
67542 void *addr;
67543 struct kprobe_blackpoint *kb;
67544 @@ -2081,7 +2081,7 @@ static int __kprobes show_kprobe_addr(struct seq_file *pi, void *v)
67545 const char *sym = NULL;
67546 unsigned int i = *(loff_t *) v;
67547 unsigned long offset = 0;
67548 - char *modname, namebuf[128];
67549 + char *modname, namebuf[KSYM_NAME_LEN];
67550
67551 head = &kprobe_table[i];
67552 preempt_disable();
67553 diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
67554 index 4e316e1..5501eef 100644
67555 --- a/kernel/ksysfs.c
67556 +++ b/kernel/ksysfs.c
67557 @@ -47,6 +47,8 @@ static ssize_t uevent_helper_store(struct kobject *kobj,
67558 {
67559 if (count+1 > UEVENT_HELPER_PATH_LEN)
67560 return -ENOENT;
67561 + if (!capable(CAP_SYS_ADMIN))
67562 + return -EPERM;
67563 memcpy(uevent_helper, buf, count);
67564 uevent_helper[count] = '\0';
67565 if (count && uevent_helper[count-1] == '\n')
67566 diff --git a/kernel/lockdep.c b/kernel/lockdep.c
67567 index ea9ee45..67ebc8f 100644
67568 --- a/kernel/lockdep.c
67569 +++ b/kernel/lockdep.c
67570 @@ -590,6 +590,10 @@ static int static_obj(void *obj)
67571 end = (unsigned long) &_end,
67572 addr = (unsigned long) obj;
67573
67574 +#ifdef CONFIG_PAX_KERNEXEC
67575 + start = ktla_ktva(start);
67576 +#endif
67577 +
67578 /*
67579 * static variable?
67580 */
67581 @@ -730,6 +734,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
67582 if (!static_obj(lock->key)) {
67583 debug_locks_off();
67584 printk("INFO: trying to register non-static key.\n");
67585 + printk("lock:%pS key:%pS.\n", lock, lock->key);
67586 printk("the code is fine but needs lockdep annotation.\n");
67587 printk("turning off the locking correctness validator.\n");
67588 dump_stack();
67589 @@ -3042,7 +3047,7 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
67590 if (!class)
67591 return 0;
67592 }
67593 - atomic_inc((atomic_t *)&class->ops);
67594 + atomic_inc_unchecked((atomic_unchecked_t *)&class->ops);
67595 if (very_verbose(class)) {
67596 printk("\nacquire class [%p] %s", class->key, class->name);
67597 if (class->name_version > 1)
67598 diff --git a/kernel/lockdep_proc.c b/kernel/lockdep_proc.c
67599 index 91c32a0..b2c71c5 100644
67600 --- a/kernel/lockdep_proc.c
67601 +++ b/kernel/lockdep_proc.c
67602 @@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, void *v)
67603
67604 static void print_name(struct seq_file *m, struct lock_class *class)
67605 {
67606 - char str[128];
67607 + char str[KSYM_NAME_LEN];
67608 const char *name = class->name;
67609
67610 if (!name) {
67611 diff --git a/kernel/module.c b/kernel/module.c
67612 index 4edbd9c..165e780 100644
67613 --- a/kernel/module.c
67614 +++ b/kernel/module.c
67615 @@ -58,6 +58,7 @@
67616 #include <linux/jump_label.h>
67617 #include <linux/pfn.h>
67618 #include <linux/bsearch.h>
67619 +#include <linux/grsecurity.h>
67620
67621 #define CREATE_TRACE_POINTS
67622 #include <trace/events/module.h>
67623 @@ -114,7 +115,8 @@ static BLOCKING_NOTIFIER_HEAD(module_notify_list);
67624
67625 /* Bounds of module allocation, for speeding __module_address.
67626 * Protected by module_mutex. */
67627 -static unsigned long module_addr_min = -1UL, module_addr_max = 0;
67628 +static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
67629 +static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
67630
67631 int register_module_notifier(struct notifier_block * nb)
67632 {
67633 @@ -278,7 +280,7 @@ bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
67634 return true;
67635
67636 list_for_each_entry_rcu(mod, &modules, list) {
67637 - struct symsearch arr[] = {
67638 + struct symsearch modarr[] = {
67639 { mod->syms, mod->syms + mod->num_syms, mod->crcs,
67640 NOT_GPL_ONLY, false },
67641 { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
67642 @@ -300,7 +302,7 @@ bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
67643 #endif
67644 };
67645
67646 - if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
67647 + if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
67648 return true;
67649 }
67650 return false;
67651 @@ -432,7 +434,7 @@ static inline void __percpu *mod_percpu(struct module *mod)
67652 static int percpu_modalloc(struct module *mod,
67653 unsigned long size, unsigned long align)
67654 {
67655 - if (align > PAGE_SIZE) {
67656 + if (align-1 >= PAGE_SIZE) {
67657 printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
67658 mod->name, align, PAGE_SIZE);
67659 align = PAGE_SIZE;
67660 @@ -1032,7 +1034,7 @@ struct module_attribute module_uevent =
67661 static ssize_t show_coresize(struct module_attribute *mattr,
67662 struct module_kobject *mk, char *buffer)
67663 {
67664 - return sprintf(buffer, "%u\n", mk->mod->core_size);
67665 + return sprintf(buffer, "%u\n", mk->mod->core_size_rx + mk->mod->core_size_rw);
67666 }
67667
67668 static struct module_attribute modinfo_coresize =
67669 @@ -1041,7 +1043,7 @@ static struct module_attribute modinfo_coresize =
67670 static ssize_t show_initsize(struct module_attribute *mattr,
67671 struct module_kobject *mk, char *buffer)
67672 {
67673 - return sprintf(buffer, "%u\n", mk->mod->init_size);
67674 + return sprintf(buffer, "%u\n", mk->mod->init_size_rx + mk->mod->init_size_rw);
67675 }
67676
67677 static struct module_attribute modinfo_initsize =
67678 @@ -1255,7 +1257,7 @@ resolve_symbol_wait(struct module *mod,
67679 */
67680 #ifdef CONFIG_SYSFS
67681
67682 -#ifdef CONFIG_KALLSYMS
67683 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
67684 static inline bool sect_empty(const Elf_Shdr *sect)
67685 {
67686 return !(sect->sh_flags & SHF_ALLOC) || sect->sh_size == 0;
67687 @@ -1721,21 +1723,21 @@ static void set_section_ro_nx(void *base,
67688
67689 static void unset_module_core_ro_nx(struct module *mod)
67690 {
67691 - set_page_attributes(mod->module_core + mod->core_text_size,
67692 - mod->module_core + mod->core_size,
67693 + set_page_attributes(mod->module_core_rw,
67694 + mod->module_core_rw + mod->core_size_rw,
67695 set_memory_x);
67696 - set_page_attributes(mod->module_core,
67697 - mod->module_core + mod->core_ro_size,
67698 + set_page_attributes(mod->module_core_rx,
67699 + mod->module_core_rx + mod->core_size_rx,
67700 set_memory_rw);
67701 }
67702
67703 static void unset_module_init_ro_nx(struct module *mod)
67704 {
67705 - set_page_attributes(mod->module_init + mod->init_text_size,
67706 - mod->module_init + mod->init_size,
67707 + set_page_attributes(mod->module_init_rw,
67708 + mod->module_init_rw + mod->init_size_rw,
67709 set_memory_x);
67710 - set_page_attributes(mod->module_init,
67711 - mod->module_init + mod->init_ro_size,
67712 + set_page_attributes(mod->module_init_rx,
67713 + mod->module_init_rx + mod->init_size_rx,
67714 set_memory_rw);
67715 }
67716
67717 @@ -1746,14 +1748,14 @@ void set_all_modules_text_rw(void)
67718
67719 mutex_lock(&module_mutex);
67720 list_for_each_entry_rcu(mod, &modules, list) {
67721 - if ((mod->module_core) && (mod->core_text_size)) {
67722 - set_page_attributes(mod->module_core,
67723 - mod->module_core + mod->core_text_size,
67724 + if ((mod->module_core_rx) && (mod->core_size_rx)) {
67725 + set_page_attributes(mod->module_core_rx,
67726 + mod->module_core_rx + mod->core_size_rx,
67727 set_memory_rw);
67728 }
67729 - if ((mod->module_init) && (mod->init_text_size)) {
67730 - set_page_attributes(mod->module_init,
67731 - mod->module_init + mod->init_text_size,
67732 + if ((mod->module_init_rx) && (mod->init_size_rx)) {
67733 + set_page_attributes(mod->module_init_rx,
67734 + mod->module_init_rx + mod->init_size_rx,
67735 set_memory_rw);
67736 }
67737 }
67738 @@ -1767,14 +1769,14 @@ void set_all_modules_text_ro(void)
67739
67740 mutex_lock(&module_mutex);
67741 list_for_each_entry_rcu(mod, &modules, list) {
67742 - if ((mod->module_core) && (mod->core_text_size)) {
67743 - set_page_attributes(mod->module_core,
67744 - mod->module_core + mod->core_text_size,
67745 + if ((mod->module_core_rx) && (mod->core_size_rx)) {
67746 + set_page_attributes(mod->module_core_rx,
67747 + mod->module_core_rx + mod->core_size_rx,
67748 set_memory_ro);
67749 }
67750 - if ((mod->module_init) && (mod->init_text_size)) {
67751 - set_page_attributes(mod->module_init,
67752 - mod->module_init + mod->init_text_size,
67753 + if ((mod->module_init_rx) && (mod->init_size_rx)) {
67754 + set_page_attributes(mod->module_init_rx,
67755 + mod->module_init_rx + mod->init_size_rx,
67756 set_memory_ro);
67757 }
67758 }
67759 @@ -1820,16 +1822,19 @@ static void free_module(struct module *mod)
67760
67761 /* This may be NULL, but that's OK */
67762 unset_module_init_ro_nx(mod);
67763 - module_free(mod, mod->module_init);
67764 + module_free(mod, mod->module_init_rw);
67765 + module_free_exec(mod, mod->module_init_rx);
67766 kfree(mod->args);
67767 percpu_modfree(mod);
67768
67769 /* Free lock-classes: */
67770 - lockdep_free_key_range(mod->module_core, mod->core_size);
67771 + lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
67772 + lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
67773
67774 /* Finally, free the core (containing the module structure) */
67775 unset_module_core_ro_nx(mod);
67776 - module_free(mod, mod->module_core);
67777 + module_free_exec(mod, mod->module_core_rx);
67778 + module_free(mod, mod->module_core_rw);
67779
67780 #ifdef CONFIG_MPU
67781 update_protections(current->mm);
67782 @@ -1899,9 +1904,31 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
67783 int ret = 0;
67784 const struct kernel_symbol *ksym;
67785
67786 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
67787 + int is_fs_load = 0;
67788 + int register_filesystem_found = 0;
67789 + char *p;
67790 +
67791 + p = strstr(mod->args, "grsec_modharden_fs");
67792 + if (p) {
67793 + char *endptr = p + strlen("grsec_modharden_fs");
67794 + /* copy \0 as well */
67795 + memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
67796 + is_fs_load = 1;
67797 + }
67798 +#endif
67799 +
67800 for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
67801 const char *name = info->strtab + sym[i].st_name;
67802
67803 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
67804 + /* it's a real shame this will never get ripped and copied
67805 + upstream! ;(
67806 + */
67807 + if (is_fs_load && !strcmp(name, "register_filesystem"))
67808 + register_filesystem_found = 1;
67809 +#endif
67810 +
67811 switch (sym[i].st_shndx) {
67812 case SHN_COMMON:
67813 /* We compiled with -fno-common. These are not
67814 @@ -1922,7 +1949,9 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
67815 ksym = resolve_symbol_wait(mod, info, name);
67816 /* Ok if resolved. */
67817 if (ksym && !IS_ERR(ksym)) {
67818 + pax_open_kernel();
67819 sym[i].st_value = ksym->value;
67820 + pax_close_kernel();
67821 break;
67822 }
67823
67824 @@ -1941,11 +1970,20 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
67825 secbase = (unsigned long)mod_percpu(mod);
67826 else
67827 secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
67828 + pax_open_kernel();
67829 sym[i].st_value += secbase;
67830 + pax_close_kernel();
67831 break;
67832 }
67833 }
67834
67835 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
67836 + if (is_fs_load && !register_filesystem_found) {
67837 + printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
67838 + ret = -EPERM;
67839 + }
67840 +#endif
67841 +
67842 return ret;
67843 }
67844
67845 @@ -2049,22 +2087,12 @@ static void layout_sections(struct module *mod, struct load_info *info)
67846 || s->sh_entsize != ~0UL
67847 || strstarts(sname, ".init"))
67848 continue;
67849 - s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
67850 + if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
67851 + s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
67852 + else
67853 + s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
67854 pr_debug("\t%s\n", sname);
67855 }
67856 - switch (m) {
67857 - case 0: /* executable */
67858 - mod->core_size = debug_align(mod->core_size);
67859 - mod->core_text_size = mod->core_size;
67860 - break;
67861 - case 1: /* RO: text and ro-data */
67862 - mod->core_size = debug_align(mod->core_size);
67863 - mod->core_ro_size = mod->core_size;
67864 - break;
67865 - case 3: /* whole core */
67866 - mod->core_size = debug_align(mod->core_size);
67867 - break;
67868 - }
67869 }
67870
67871 pr_debug("Init section allocation order:\n");
67872 @@ -2078,23 +2106,13 @@ static void layout_sections(struct module *mod, struct load_info *info)
67873 || s->sh_entsize != ~0UL
67874 || !strstarts(sname, ".init"))
67875 continue;
67876 - s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
67877 - | INIT_OFFSET_MASK);
67878 + if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
67879 + s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
67880 + else
67881 + s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
67882 + s->sh_entsize |= INIT_OFFSET_MASK;
67883 pr_debug("\t%s\n", sname);
67884 }
67885 - switch (m) {
67886 - case 0: /* executable */
67887 - mod->init_size = debug_align(mod->init_size);
67888 - mod->init_text_size = mod->init_size;
67889 - break;
67890 - case 1: /* RO: text and ro-data */
67891 - mod->init_size = debug_align(mod->init_size);
67892 - mod->init_ro_size = mod->init_size;
67893 - break;
67894 - case 3: /* whole init */
67895 - mod->init_size = debug_align(mod->init_size);
67896 - break;
67897 - }
67898 }
67899 }
67900
67901 @@ -2266,7 +2284,7 @@ static void layout_symtab(struct module *mod, struct load_info *info)
67902
67903 /* Put symbol section at end of init part of module. */
67904 symsect->sh_flags |= SHF_ALLOC;
67905 - symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
67906 + symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
67907 info->index.sym) | INIT_OFFSET_MASK;
67908 pr_debug("\t%s\n", info->secstrings + symsect->sh_name);
67909
67910 @@ -2281,13 +2299,13 @@ static void layout_symtab(struct module *mod, struct load_info *info)
67911 }
67912
67913 /* Append room for core symbols at end of core part. */
67914 - info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
67915 - info->stroffs = mod->core_size = info->symoffs + ndst * sizeof(Elf_Sym);
67916 - mod->core_size += strtab_size;
67917 + info->symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
67918 + info->stroffs = mod->core_size_rx = info->symoffs + ndst * sizeof(Elf_Sym);
67919 + mod->core_size_rx += strtab_size;
67920
67921 /* Put string table section at end of init part of module. */
67922 strsect->sh_flags |= SHF_ALLOC;
67923 - strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
67924 + strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
67925 info->index.str) | INIT_OFFSET_MASK;
67926 pr_debug("\t%s\n", info->secstrings + strsect->sh_name);
67927 }
67928 @@ -2305,12 +2323,14 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
67929 /* Make sure we get permanent strtab: don't use info->strtab. */
67930 mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
67931
67932 + pax_open_kernel();
67933 +
67934 /* Set types up while we still have access to sections. */
67935 for (i = 0; i < mod->num_symtab; i++)
67936 mod->symtab[i].st_info = elf_type(&mod->symtab[i], info);
67937
67938 - mod->core_symtab = dst = mod->module_core + info->symoffs;
67939 - mod->core_strtab = s = mod->module_core + info->stroffs;
67940 + mod->core_symtab = dst = mod->module_core_rx + info->symoffs;
67941 + mod->core_strtab = s = mod->module_core_rx + info->stroffs;
67942 src = mod->symtab;
67943 *dst = *src;
67944 *s++ = 0;
67945 @@ -2323,6 +2343,8 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
67946 s += strlcpy(s, &mod->strtab[src->st_name], KSYM_NAME_LEN) + 1;
67947 }
67948 mod->core_num_syms = ndst;
67949 +
67950 + pax_close_kernel();
67951 }
67952 #else
67953 static inline void layout_symtab(struct module *mod, struct load_info *info)
67954 @@ -2356,17 +2378,33 @@ void * __weak module_alloc(unsigned long size)
67955 return size == 0 ? NULL : vmalloc_exec(size);
67956 }
67957
67958 -static void *module_alloc_update_bounds(unsigned long size)
67959 +static void *module_alloc_update_bounds_rw(unsigned long size)
67960 {
67961 void *ret = module_alloc(size);
67962
67963 if (ret) {
67964 mutex_lock(&module_mutex);
67965 /* Update module bounds. */
67966 - if ((unsigned long)ret < module_addr_min)
67967 - module_addr_min = (unsigned long)ret;
67968 - if ((unsigned long)ret + size > module_addr_max)
67969 - module_addr_max = (unsigned long)ret + size;
67970 + if ((unsigned long)ret < module_addr_min_rw)
67971 + module_addr_min_rw = (unsigned long)ret;
67972 + if ((unsigned long)ret + size > module_addr_max_rw)
67973 + module_addr_max_rw = (unsigned long)ret + size;
67974 + mutex_unlock(&module_mutex);
67975 + }
67976 + return ret;
67977 +}
67978 +
67979 +static void *module_alloc_update_bounds_rx(unsigned long size)
67980 +{
67981 + void *ret = module_alloc_exec(size);
67982 +
67983 + if (ret) {
67984 + mutex_lock(&module_mutex);
67985 + /* Update module bounds. */
67986 + if ((unsigned long)ret < module_addr_min_rx)
67987 + module_addr_min_rx = (unsigned long)ret;
67988 + if ((unsigned long)ret + size > module_addr_max_rx)
67989 + module_addr_max_rx = (unsigned long)ret + size;
67990 mutex_unlock(&module_mutex);
67991 }
67992 return ret;
67993 @@ -2544,8 +2582,14 @@ static struct module *setup_load_info(struct load_info *info)
67994 static int check_modinfo(struct module *mod, struct load_info *info)
67995 {
67996 const char *modmagic = get_modinfo(info, "vermagic");
67997 + const char *license = get_modinfo(info, "license");
67998 int err;
67999
68000 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
68001 + if (!license || !license_is_gpl_compatible(license))
68002 + return -ENOEXEC;
68003 +#endif
68004 +
68005 /* This is allowed: modprobe --force will invalidate it. */
68006 if (!modmagic) {
68007 err = try_to_force_load(mod, "bad vermagic");
68008 @@ -2568,7 +2612,7 @@ static int check_modinfo(struct module *mod, struct load_info *info)
68009 }
68010
68011 /* Set up license info based on the info section */
68012 - set_license(mod, get_modinfo(info, "license"));
68013 + set_license(mod, license);
68014
68015 return 0;
68016 }
68017 @@ -2662,7 +2706,7 @@ static int move_module(struct module *mod, struct load_info *info)
68018 void *ptr;
68019
68020 /* Do the allocs. */
68021 - ptr = module_alloc_update_bounds(mod->core_size);
68022 + ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
68023 /*
68024 * The pointer to this block is stored in the module structure
68025 * which is inside the block. Just mark it as not being a
68026 @@ -2672,23 +2716,50 @@ static int move_module(struct module *mod, struct load_info *info)
68027 if (!ptr)
68028 return -ENOMEM;
68029
68030 - memset(ptr, 0, mod->core_size);
68031 - mod->module_core = ptr;
68032 + memset(ptr, 0, mod->core_size_rw);
68033 + mod->module_core_rw = ptr;
68034
68035 - ptr = module_alloc_update_bounds(mod->init_size);
68036 + ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
68037 /*
68038 * The pointer to this block is stored in the module structure
68039 * which is inside the block. This block doesn't need to be
68040 * scanned as it contains data and code that will be freed
68041 * after the module is initialized.
68042 */
68043 - kmemleak_ignore(ptr);
68044 - if (!ptr && mod->init_size) {
68045 - module_free(mod, mod->module_core);
68046 + kmemleak_not_leak(ptr);
68047 + if (!ptr && mod->init_size_rw) {
68048 + module_free(mod, mod->module_core_rw);
68049 return -ENOMEM;
68050 }
68051 - memset(ptr, 0, mod->init_size);
68052 - mod->module_init = ptr;
68053 + memset(ptr, 0, mod->init_size_rw);
68054 + mod->module_init_rw = ptr;
68055 +
68056 + ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
68057 + kmemleak_not_leak(ptr);
68058 + if (!ptr) {
68059 + module_free(mod, mod->module_init_rw);
68060 + module_free(mod, mod->module_core_rw);
68061 + return -ENOMEM;
68062 + }
68063 +
68064 + pax_open_kernel();
68065 + memset(ptr, 0, mod->core_size_rx);
68066 + pax_close_kernel();
68067 + mod->module_core_rx = ptr;
68068 +
68069 + ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
68070 + kmemleak_not_leak(ptr);
68071 + if (!ptr && mod->init_size_rx) {
68072 + module_free_exec(mod, mod->module_core_rx);
68073 + module_free(mod, mod->module_init_rw);
68074 + module_free(mod, mod->module_core_rw);
68075 + return -ENOMEM;
68076 + }
68077 +
68078 + pax_open_kernel();
68079 + memset(ptr, 0, mod->init_size_rx);
68080 + pax_close_kernel();
68081 + mod->module_init_rx = ptr;
68082
68083 /* Transfer each section which specifies SHF_ALLOC */
68084 pr_debug("final section addresses:\n");
68085 @@ -2699,16 +2770,45 @@ static int move_module(struct module *mod, struct load_info *info)
68086 if (!(shdr->sh_flags & SHF_ALLOC))
68087 continue;
68088
68089 - if (shdr->sh_entsize & INIT_OFFSET_MASK)
68090 - dest = mod->module_init
68091 - + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
68092 - else
68093 - dest = mod->module_core + shdr->sh_entsize;
68094 + if (shdr->sh_entsize & INIT_OFFSET_MASK) {
68095 + if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
68096 + dest = mod->module_init_rw
68097 + + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
68098 + else
68099 + dest = mod->module_init_rx
68100 + + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
68101 + } else {
68102 + if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
68103 + dest = mod->module_core_rw + shdr->sh_entsize;
68104 + else
68105 + dest = mod->module_core_rx + shdr->sh_entsize;
68106 + }
68107 +
68108 + if (shdr->sh_type != SHT_NOBITS) {
68109 +
68110 +#ifdef CONFIG_PAX_KERNEXEC
68111 +#ifdef CONFIG_X86_64
68112 + if ((shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_EXECINSTR))
68113 + set_memory_x((unsigned long)dest, (shdr->sh_size + PAGE_SIZE) >> PAGE_SHIFT);
68114 +#endif
68115 + if (!(shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_ALLOC)) {
68116 + pax_open_kernel();
68117 + memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
68118 + pax_close_kernel();
68119 + } else
68120 +#endif
68121
68122 - if (shdr->sh_type != SHT_NOBITS)
68123 memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
68124 + }
68125 /* Update sh_addr to point to copy in image. */
68126 - shdr->sh_addr = (unsigned long)dest;
68127 +
68128 +#ifdef CONFIG_PAX_KERNEXEC
68129 + if (shdr->sh_flags & SHF_EXECINSTR)
68130 + shdr->sh_addr = ktva_ktla((unsigned long)dest);
68131 + else
68132 +#endif
68133 +
68134 + shdr->sh_addr = (unsigned long)dest;
68135 pr_debug("\t0x%lx %s\n",
68136 (long)shdr->sh_addr, info->secstrings + shdr->sh_name);
68137 }
68138 @@ -2759,12 +2859,12 @@ static void flush_module_icache(const struct module *mod)
68139 * Do it before processing of module parameters, so the module
68140 * can provide parameter accessor functions of its own.
68141 */
68142 - if (mod->module_init)
68143 - flush_icache_range((unsigned long)mod->module_init,
68144 - (unsigned long)mod->module_init
68145 - + mod->init_size);
68146 - flush_icache_range((unsigned long)mod->module_core,
68147 - (unsigned long)mod->module_core + mod->core_size);
68148 + if (mod->module_init_rx)
68149 + flush_icache_range((unsigned long)mod->module_init_rx,
68150 + (unsigned long)mod->module_init_rx
68151 + + mod->init_size_rx);
68152 + flush_icache_range((unsigned long)mod->module_core_rx,
68153 + (unsigned long)mod->module_core_rx + mod->core_size_rx);
68154
68155 set_fs(old_fs);
68156 }
68157 @@ -2834,8 +2934,10 @@ out:
68158 static void module_deallocate(struct module *mod, struct load_info *info)
68159 {
68160 percpu_modfree(mod);
68161 - module_free(mod, mod->module_init);
68162 - module_free(mod, mod->module_core);
68163 + module_free_exec(mod, mod->module_init_rx);
68164 + module_free_exec(mod, mod->module_core_rx);
68165 + module_free(mod, mod->module_init_rw);
68166 + module_free(mod, mod->module_core_rw);
68167 }
68168
68169 int __weak module_finalize(const Elf_Ehdr *hdr,
68170 @@ -2848,7 +2950,9 @@ int __weak module_finalize(const Elf_Ehdr *hdr,
68171 static int post_relocation(struct module *mod, const struct load_info *info)
68172 {
68173 /* Sort exception table now relocations are done. */
68174 + pax_open_kernel();
68175 sort_extable(mod->extable, mod->extable + mod->num_exentries);
68176 + pax_close_kernel();
68177
68178 /* Copy relocated percpu area over. */
68179 percpu_modcopy(mod, (void *)info->sechdrs[info->index.pcpu].sh_addr,
68180 @@ -2899,9 +3003,38 @@ static struct module *load_module(void __user *umod,
68181 if (err)
68182 goto free_unload;
68183
68184 + /* Now copy in args */
68185 + mod->args = strndup_user(uargs, ~0UL >> 1);
68186 + if (IS_ERR(mod->args)) {
68187 + err = PTR_ERR(mod->args);
68188 + goto free_unload;
68189 + }
68190 +
68191 /* Set up MODINFO_ATTR fields */
68192 setup_modinfo(mod, &info);
68193
68194 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
68195 + {
68196 + char *p, *p2;
68197 +
68198 + if (strstr(mod->args, "grsec_modharden_netdev")) {
68199 + printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
68200 + err = -EPERM;
68201 + goto free_modinfo;
68202 + } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
68203 + p += strlen("grsec_modharden_normal");
68204 + p2 = strstr(p, "_");
68205 + if (p2) {
68206 + *p2 = '\0';
68207 + printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
68208 + *p2 = '_';
68209 + }
68210 + err = -EPERM;
68211 + goto free_modinfo;
68212 + }
68213 + }
68214 +#endif
68215 +
68216 /* Fix up syms, so that st_value is a pointer to location. */
68217 err = simplify_symbols(mod, &info);
68218 if (err < 0)
68219 @@ -2917,13 +3050,6 @@ static struct module *load_module(void __user *umod,
68220
68221 flush_module_icache(mod);
68222
68223 - /* Now copy in args */
68224 - mod->args = strndup_user(uargs, ~0UL >> 1);
68225 - if (IS_ERR(mod->args)) {
68226 - err = PTR_ERR(mod->args);
68227 - goto free_arch_cleanup;
68228 - }
68229 -
68230 /* Mark state as coming so strong_try_module_get() ignores us. */
68231 mod->state = MODULE_STATE_COMING;
68232
68233 @@ -2981,11 +3107,10 @@ static struct module *load_module(void __user *umod,
68234 unlock:
68235 mutex_unlock(&module_mutex);
68236 synchronize_sched();
68237 - kfree(mod->args);
68238 - free_arch_cleanup:
68239 module_arch_cleanup(mod);
68240 free_modinfo:
68241 free_modinfo(mod);
68242 + kfree(mod->args);
68243 free_unload:
68244 module_unload_free(mod);
68245 free_module:
68246 @@ -3026,16 +3151,16 @@ SYSCALL_DEFINE3(init_module, void __user *, umod,
68247 MODULE_STATE_COMING, mod);
68248
68249 /* Set RO and NX regions for core */
68250 - set_section_ro_nx(mod->module_core,
68251 - mod->core_text_size,
68252 - mod->core_ro_size,
68253 - mod->core_size);
68254 + set_section_ro_nx(mod->module_core_rx,
68255 + mod->core_size_rx,
68256 + mod->core_size_rx,
68257 + mod->core_size_rx);
68258
68259 /* Set RO and NX regions for init */
68260 - set_section_ro_nx(mod->module_init,
68261 - mod->init_text_size,
68262 - mod->init_ro_size,
68263 - mod->init_size);
68264 + set_section_ro_nx(mod->module_init_rx,
68265 + mod->init_size_rx,
68266 + mod->init_size_rx,
68267 + mod->init_size_rx);
68268
68269 do_mod_ctors(mod);
68270 /* Start the module */
68271 @@ -3081,11 +3206,12 @@ SYSCALL_DEFINE3(init_module, void __user *, umod,
68272 mod->strtab = mod->core_strtab;
68273 #endif
68274 unset_module_init_ro_nx(mod);
68275 - module_free(mod, mod->module_init);
68276 - mod->module_init = NULL;
68277 - mod->init_size = 0;
68278 - mod->init_ro_size = 0;
68279 - mod->init_text_size = 0;
68280 + module_free(mod, mod->module_init_rw);
68281 + module_free_exec(mod, mod->module_init_rx);
68282 + mod->module_init_rw = NULL;
68283 + mod->module_init_rx = NULL;
68284 + mod->init_size_rw = 0;
68285 + mod->init_size_rx = 0;
68286 mutex_unlock(&module_mutex);
68287
68288 return 0;
68289 @@ -3116,10 +3242,16 @@ static const char *get_ksymbol(struct module *mod,
68290 unsigned long nextval;
68291
68292 /* At worse, next value is at end of module */
68293 - if (within_module_init(addr, mod))
68294 - nextval = (unsigned long)mod->module_init+mod->init_text_size;
68295 + if (within_module_init_rx(addr, mod))
68296 + nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
68297 + else if (within_module_init_rw(addr, mod))
68298 + nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
68299 + else if (within_module_core_rx(addr, mod))
68300 + nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
68301 + else if (within_module_core_rw(addr, mod))
68302 + nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
68303 else
68304 - nextval = (unsigned long)mod->module_core+mod->core_text_size;
68305 + return NULL;
68306
68307 /* Scan for closest preceding symbol, and next symbol. (ELF
68308 starts real symbols at 1). */
68309 @@ -3354,7 +3486,7 @@ static int m_show(struct seq_file *m, void *p)
68310 char buf[8];
68311
68312 seq_printf(m, "%s %u",
68313 - mod->name, mod->init_size + mod->core_size);
68314 + mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
68315 print_unload_info(m, mod);
68316
68317 /* Informative for users. */
68318 @@ -3363,7 +3495,7 @@ static int m_show(struct seq_file *m, void *p)
68319 mod->state == MODULE_STATE_COMING ? "Loading":
68320 "Live");
68321 /* Used by oprofile and other similar tools. */
68322 - seq_printf(m, " 0x%pK", mod->module_core);
68323 + seq_printf(m, " 0x%pK 0x%pK", mod->module_core_rx, mod->module_core_rw);
68324
68325 /* Taints info */
68326 if (mod->taints)
68327 @@ -3399,7 +3531,17 @@ static const struct file_operations proc_modules_operations = {
68328
68329 static int __init proc_modules_init(void)
68330 {
68331 +#ifndef CONFIG_GRKERNSEC_HIDESYM
68332 +#ifdef CONFIG_GRKERNSEC_PROC_USER
68333 + proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
68334 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
68335 + proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
68336 +#else
68337 proc_create("modules", 0, NULL, &proc_modules_operations);
68338 +#endif
68339 +#else
68340 + proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
68341 +#endif
68342 return 0;
68343 }
68344 module_init(proc_modules_init);
68345 @@ -3458,12 +3600,12 @@ struct module *__module_address(unsigned long addr)
68346 {
68347 struct module *mod;
68348
68349 - if (addr < module_addr_min || addr > module_addr_max)
68350 + if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
68351 + (addr < module_addr_min_rw || addr > module_addr_max_rw))
68352 return NULL;
68353
68354 list_for_each_entry_rcu(mod, &modules, list)
68355 - if (within_module_core(addr, mod)
68356 - || within_module_init(addr, mod))
68357 + if (within_module_init(addr, mod) || within_module_core(addr, mod))
68358 return mod;
68359 return NULL;
68360 }
68361 @@ -3497,11 +3639,20 @@ bool is_module_text_address(unsigned long addr)
68362 */
68363 struct module *__module_text_address(unsigned long addr)
68364 {
68365 - struct module *mod = __module_address(addr);
68366 + struct module *mod;
68367 +
68368 +#ifdef CONFIG_X86_32
68369 + addr = ktla_ktva(addr);
68370 +#endif
68371 +
68372 + if (addr < module_addr_min_rx || addr > module_addr_max_rx)
68373 + return NULL;
68374 +
68375 + mod = __module_address(addr);
68376 +
68377 if (mod) {
68378 /* Make sure it's within the text section. */
68379 - if (!within(addr, mod->module_init, mod->init_text_size)
68380 - && !within(addr, mod->module_core, mod->core_text_size))
68381 + if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
68382 mod = NULL;
68383 }
68384 return mod;
68385 diff --git a/kernel/mutex-debug.c b/kernel/mutex-debug.c
68386 index 7e3443f..b2a1e6b 100644
68387 --- a/kernel/mutex-debug.c
68388 +++ b/kernel/mutex-debug.c
68389 @@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mutex_waiter *waiter)
68390 }
68391
68392 void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68393 - struct thread_info *ti)
68394 + struct task_struct *task)
68395 {
68396 SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
68397
68398 /* Mark the current thread as blocked on the lock: */
68399 - ti->task->blocked_on = waiter;
68400 + task->blocked_on = waiter;
68401 }
68402
68403 void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68404 - struct thread_info *ti)
68405 + struct task_struct *task)
68406 {
68407 DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
68408 - DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
68409 - DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
68410 - ti->task->blocked_on = NULL;
68411 + DEBUG_LOCKS_WARN_ON(waiter->task != task);
68412 + DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
68413 + task->blocked_on = NULL;
68414
68415 list_del_init(&waiter->list);
68416 waiter->task = NULL;
68417 diff --git a/kernel/mutex-debug.h b/kernel/mutex-debug.h
68418 index 0799fd3..d06ae3b 100644
68419 --- a/kernel/mutex-debug.h
68420 +++ b/kernel/mutex-debug.h
68421 @@ -20,9 +20,9 @@ extern void debug_mutex_wake_waiter(struct mutex *lock,
68422 extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
68423 extern void debug_mutex_add_waiter(struct mutex *lock,
68424 struct mutex_waiter *waiter,
68425 - struct thread_info *ti);
68426 + struct task_struct *task);
68427 extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68428 - struct thread_info *ti);
68429 + struct task_struct *task);
68430 extern void debug_mutex_unlock(struct mutex *lock);
68431 extern void debug_mutex_init(struct mutex *lock, const char *name,
68432 struct lock_class_key *key);
68433 diff --git a/kernel/mutex.c b/kernel/mutex.c
68434 index a307cc9..27fd2e9 100644
68435 --- a/kernel/mutex.c
68436 +++ b/kernel/mutex.c
68437 @@ -198,7 +198,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
68438 spin_lock_mutex(&lock->wait_lock, flags);
68439
68440 debug_mutex_lock_common(lock, &waiter);
68441 - debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
68442 + debug_mutex_add_waiter(lock, &waiter, task);
68443
68444 /* add waiting tasks to the end of the waitqueue (FIFO): */
68445 list_add_tail(&waiter.list, &lock->wait_list);
68446 @@ -227,8 +227,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
68447 * TASK_UNINTERRUPTIBLE case.)
68448 */
68449 if (unlikely(signal_pending_state(state, task))) {
68450 - mutex_remove_waiter(lock, &waiter,
68451 - task_thread_info(task));
68452 + mutex_remove_waiter(lock, &waiter, task);
68453 mutex_release(&lock->dep_map, 1, ip);
68454 spin_unlock_mutex(&lock->wait_lock, flags);
68455
68456 @@ -247,7 +246,7 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
68457 done:
68458 lock_acquired(&lock->dep_map, ip);
68459 /* got the lock - rejoice! */
68460 - mutex_remove_waiter(lock, &waiter, current_thread_info());
68461 + mutex_remove_waiter(lock, &waiter, task);
68462 mutex_set_owner(lock);
68463
68464 /* set it to 0 if there are no waiters left: */
68465 diff --git a/kernel/panic.c b/kernel/panic.c
68466 index d2a5f4e..5edc1d9 100644
68467 --- a/kernel/panic.c
68468 +++ b/kernel/panic.c
68469 @@ -75,6 +75,14 @@ void panic(const char *fmt, ...)
68470 int state = 0;
68471
68472 /*
68473 + * Disable local interrupts. This will prevent panic_smp_self_stop
68474 + * from deadlocking the first cpu that invokes the panic, since
68475 + * there is nothing to prevent an interrupt handler (that runs
68476 + * after the panic_lock is acquired) from invoking panic again.
68477 + */
68478 + local_irq_disable();
68479 +
68480 + /*
68481 * It's possible to come here directly from a panic-assertion and
68482 * not have preempt disabled. Some functions called from here want
68483 * preempt to be disabled. No point enabling it later though...
68484 @@ -402,7 +410,7 @@ static void warn_slowpath_common(const char *file, int line, void *caller,
68485 const char *board;
68486
68487 printk(KERN_WARNING "------------[ cut here ]------------\n");
68488 - printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
68489 + printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
68490 board = dmi_get_system_info(DMI_PRODUCT_NAME);
68491 if (board)
68492 printk(KERN_WARNING "Hardware name: %s\n", board);
68493 @@ -457,7 +465,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
68494 */
68495 void __stack_chk_fail(void)
68496 {
68497 - panic("stack-protector: Kernel stack is corrupted in: %p\n",
68498 + dump_stack();
68499 + panic("stack-protector: Kernel stack is corrupted in: %pA\n",
68500 __builtin_return_address(0));
68501 }
68502 EXPORT_SYMBOL(__stack_chk_fail);
68503 diff --git a/kernel/pid.c b/kernel/pid.c
68504 index e86b291a..e8b0fb5 100644
68505 --- a/kernel/pid.c
68506 +++ b/kernel/pid.c
68507 @@ -33,6 +33,7 @@
68508 #include <linux/rculist.h>
68509 #include <linux/bootmem.h>
68510 #include <linux/hash.h>
68511 +#include <linux/security.h>
68512 #include <linux/pid_namespace.h>
68513 #include <linux/init_task.h>
68514 #include <linux/syscalls.h>
68515 @@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT_PID;
68516
68517 int pid_max = PID_MAX_DEFAULT;
68518
68519 -#define RESERVED_PIDS 300
68520 +#define RESERVED_PIDS 500
68521
68522 int pid_max_min = RESERVED_PIDS + 1;
68523 int pid_max_max = PID_MAX_LIMIT;
68524 @@ -420,10 +421,18 @@ EXPORT_SYMBOL(pid_task);
68525 */
68526 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
68527 {
68528 + struct task_struct *task;
68529 +
68530 rcu_lockdep_assert(rcu_read_lock_held(),
68531 "find_task_by_pid_ns() needs rcu_read_lock()"
68532 " protection");
68533 - return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
68534 +
68535 + task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
68536 +
68537 + if (gr_pid_is_chrooted(task))
68538 + return NULL;
68539 +
68540 + return task;
68541 }
68542
68543 struct task_struct *find_task_by_vpid(pid_t vnr)
68544 @@ -431,6 +440,14 @@ struct task_struct *find_task_by_vpid(pid_t vnr)
68545 return find_task_by_pid_ns(vnr, current->nsproxy->pid_ns);
68546 }
68547
68548 +struct task_struct *find_task_by_vpid_unrestricted(pid_t vnr)
68549 +{
68550 + rcu_lockdep_assert(rcu_read_lock_held(),
68551 + "find_task_by_pid_ns() needs rcu_read_lock()"
68552 + " protection");
68553 + return pid_task(find_pid_ns(vnr, current->nsproxy->pid_ns), PIDTYPE_PID);
68554 +}
68555 +
68556 struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
68557 {
68558 struct pid *pid;
68559 diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
68560 index 125cb67..a4d1c30 100644
68561 --- a/kernel/posix-cpu-timers.c
68562 +++ b/kernel/posix-cpu-timers.c
68563 @@ -6,6 +6,7 @@
68564 #include <linux/posix-timers.h>
68565 #include <linux/errno.h>
68566 #include <linux/math64.h>
68567 +#include <linux/security.h>
68568 #include <asm/uaccess.h>
68569 #include <linux/kernel_stat.h>
68570 #include <trace/events/timer.h>
68571 @@ -1578,14 +1579,14 @@ struct k_clock clock_posix_cpu = {
68572
68573 static __init int init_posix_cpu_timers(void)
68574 {
68575 - struct k_clock process = {
68576 + static struct k_clock process = {
68577 .clock_getres = process_cpu_clock_getres,
68578 .clock_get = process_cpu_clock_get,
68579 .timer_create = process_cpu_timer_create,
68580 .nsleep = process_cpu_nsleep,
68581 .nsleep_restart = process_cpu_nsleep_restart,
68582 };
68583 - struct k_clock thread = {
68584 + static struct k_clock thread = {
68585 .clock_getres = thread_cpu_clock_getres,
68586 .clock_get = thread_cpu_clock_get,
68587 .timer_create = thread_cpu_timer_create,
68588 diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
68589 index 69185ae..cc2847a 100644
68590 --- a/kernel/posix-timers.c
68591 +++ b/kernel/posix-timers.c
68592 @@ -43,6 +43,7 @@
68593 #include <linux/idr.h>
68594 #include <linux/posix-clock.h>
68595 #include <linux/posix-timers.h>
68596 +#include <linux/grsecurity.h>
68597 #include <linux/syscalls.h>
68598 #include <linux/wait.h>
68599 #include <linux/workqueue.h>
68600 @@ -129,7 +130,7 @@ static DEFINE_SPINLOCK(idr_lock);
68601 * which we beg off on and pass to do_sys_settimeofday().
68602 */
68603
68604 -static struct k_clock posix_clocks[MAX_CLOCKS];
68605 +static struct k_clock *posix_clocks[MAX_CLOCKS];
68606
68607 /*
68608 * These ones are defined below.
68609 @@ -227,7 +228,7 @@ static int posix_get_boottime(const clockid_t which_clock, struct timespec *tp)
68610 */
68611 static __init int init_posix_timers(void)
68612 {
68613 - struct k_clock clock_realtime = {
68614 + static struct k_clock clock_realtime = {
68615 .clock_getres = hrtimer_get_res,
68616 .clock_get = posix_clock_realtime_get,
68617 .clock_set = posix_clock_realtime_set,
68618 @@ -239,7 +240,7 @@ static __init int init_posix_timers(void)
68619 .timer_get = common_timer_get,
68620 .timer_del = common_timer_del,
68621 };
68622 - struct k_clock clock_monotonic = {
68623 + static struct k_clock clock_monotonic = {
68624 .clock_getres = hrtimer_get_res,
68625 .clock_get = posix_ktime_get_ts,
68626 .nsleep = common_nsleep,
68627 @@ -249,19 +250,19 @@ static __init int init_posix_timers(void)
68628 .timer_get = common_timer_get,
68629 .timer_del = common_timer_del,
68630 };
68631 - struct k_clock clock_monotonic_raw = {
68632 + static struct k_clock clock_monotonic_raw = {
68633 .clock_getres = hrtimer_get_res,
68634 .clock_get = posix_get_monotonic_raw,
68635 };
68636 - struct k_clock clock_realtime_coarse = {
68637 + static struct k_clock clock_realtime_coarse = {
68638 .clock_getres = posix_get_coarse_res,
68639 .clock_get = posix_get_realtime_coarse,
68640 };
68641 - struct k_clock clock_monotonic_coarse = {
68642 + static struct k_clock clock_monotonic_coarse = {
68643 .clock_getres = posix_get_coarse_res,
68644 .clock_get = posix_get_monotonic_coarse,
68645 };
68646 - struct k_clock clock_boottime = {
68647 + static struct k_clock clock_boottime = {
68648 .clock_getres = hrtimer_get_res,
68649 .clock_get = posix_get_boottime,
68650 .nsleep = common_nsleep,
68651 @@ -473,7 +474,7 @@ void posix_timers_register_clock(const clockid_t clock_id,
68652 return;
68653 }
68654
68655 - posix_clocks[clock_id] = *new_clock;
68656 + posix_clocks[clock_id] = new_clock;
68657 }
68658 EXPORT_SYMBOL_GPL(posix_timers_register_clock);
68659
68660 @@ -519,9 +520,9 @@ static struct k_clock *clockid_to_kclock(const clockid_t id)
68661 return (id & CLOCKFD_MASK) == CLOCKFD ?
68662 &clock_posix_dynamic : &clock_posix_cpu;
68663
68664 - if (id >= MAX_CLOCKS || !posix_clocks[id].clock_getres)
68665 + if (id >= MAX_CLOCKS || !posix_clocks[id] || !posix_clocks[id]->clock_getres)
68666 return NULL;
68667 - return &posix_clocks[id];
68668 + return posix_clocks[id];
68669 }
68670
68671 static int common_timer_create(struct k_itimer *new_timer)
68672 @@ -959,6 +960,13 @@ SYSCALL_DEFINE2(clock_settime, const clockid_t, which_clock,
68673 if (copy_from_user(&new_tp, tp, sizeof (*tp)))
68674 return -EFAULT;
68675
68676 + /* only the CLOCK_REALTIME clock can be set, all other clocks
68677 + have their clock_set fptr set to a nosettime dummy function
68678 + CLOCK_REALTIME has a NULL clock_set fptr which causes it to
68679 + call common_clock_set, which calls do_sys_settimeofday, which
68680 + we hook
68681 + */
68682 +
68683 return kc->clock_set(which_clock, &new_tp);
68684 }
68685
68686 diff --git a/kernel/power/poweroff.c b/kernel/power/poweroff.c
68687 index d523593..68197a4 100644
68688 --- a/kernel/power/poweroff.c
68689 +++ b/kernel/power/poweroff.c
68690 @@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_poweroff_op = {
68691 .enable_mask = SYSRQ_ENABLE_BOOT,
68692 };
68693
68694 -static int pm_sysrq_init(void)
68695 +static int __init pm_sysrq_init(void)
68696 {
68697 register_sysrq_key('o', &sysrq_poweroff_op);
68698 return 0;
68699 diff --git a/kernel/power/process.c b/kernel/power/process.c
68700 index 19db29f..33b52b6 100644
68701 --- a/kernel/power/process.c
68702 +++ b/kernel/power/process.c
68703 @@ -33,6 +33,7 @@ static int try_to_freeze_tasks(bool user_only)
68704 u64 elapsed_csecs64;
68705 unsigned int elapsed_csecs;
68706 bool wakeup = false;
68707 + bool timedout = false;
68708
68709 do_gettimeofday(&start);
68710
68711 @@ -43,6 +44,8 @@ static int try_to_freeze_tasks(bool user_only)
68712
68713 while (true) {
68714 todo = 0;
68715 + if (time_after(jiffies, end_time))
68716 + timedout = true;
68717 read_lock(&tasklist_lock);
68718 do_each_thread(g, p) {
68719 if (p == current || !freeze_task(p))
68720 @@ -58,9 +61,13 @@ static int try_to_freeze_tasks(bool user_only)
68721 * guaranteed that TASK_STOPPED/TRACED -> TASK_RUNNING
68722 * transition can't race with task state testing here.
68723 */
68724 - if (!task_is_stopped_or_traced(p) &&
68725 - !freezer_should_skip(p))
68726 + if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
68727 todo++;
68728 + if (timedout) {
68729 + printk(KERN_ERR "Task refusing to freeze:\n");
68730 + sched_show_task(p);
68731 + }
68732 + }
68733 } while_each_thread(g, p);
68734 read_unlock(&tasklist_lock);
68735
68736 @@ -69,7 +76,7 @@ static int try_to_freeze_tasks(bool user_only)
68737 todo += wq_busy;
68738 }
68739
68740 - if (!todo || time_after(jiffies, end_time))
68741 + if (!todo || timedout)
68742 break;
68743
68744 if (pm_wakeup_pending()) {
68745 diff --git a/kernel/printk.c b/kernel/printk.c
68746 index 146827f..a501fec 100644
68747 --- a/kernel/printk.c
68748 +++ b/kernel/printk.c
68749 @@ -782,6 +782,11 @@ static int check_syslog_permissions(int type, bool from_file)
68750 if (from_file && type != SYSLOG_ACTION_OPEN)
68751 return 0;
68752
68753 +#ifdef CONFIG_GRKERNSEC_DMESG
68754 + if (grsec_enable_dmesg && !capable(CAP_SYSLOG) && !capable_nolog(CAP_SYS_ADMIN))
68755 + return -EPERM;
68756 +#endif
68757 +
68758 if (syslog_action_restricted(type)) {
68759 if (capable(CAP_SYSLOG))
68760 return 0;
68761 diff --git a/kernel/profile.c b/kernel/profile.c
68762 index 76b8e77..a2930e8 100644
68763 --- a/kernel/profile.c
68764 +++ b/kernel/profile.c
68765 @@ -39,7 +39,7 @@ struct profile_hit {
68766 /* Oprofile timer tick hook */
68767 static int (*timer_hook)(struct pt_regs *) __read_mostly;
68768
68769 -static atomic_t *prof_buffer;
68770 +static atomic_unchecked_t *prof_buffer;
68771 static unsigned long prof_len, prof_shift;
68772
68773 int prof_on __read_mostly;
68774 @@ -281,7 +281,7 @@ static void profile_flip_buffers(void)
68775 hits[i].pc = 0;
68776 continue;
68777 }
68778 - atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
68779 + atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
68780 hits[i].hits = hits[i].pc = 0;
68781 }
68782 }
68783 @@ -342,9 +342,9 @@ static void do_profile_hits(int type, void *__pc, unsigned int nr_hits)
68784 * Add the current hit(s) and flush the write-queue out
68785 * to the global buffer:
68786 */
68787 - atomic_add(nr_hits, &prof_buffer[pc]);
68788 + atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
68789 for (i = 0; i < NR_PROFILE_HIT; ++i) {
68790 - atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
68791 + atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
68792 hits[i].pc = hits[i].hits = 0;
68793 }
68794 out:
68795 @@ -419,7 +419,7 @@ static void do_profile_hits(int type, void *__pc, unsigned int nr_hits)
68796 {
68797 unsigned long pc;
68798 pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
68799 - atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
68800 + atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
68801 }
68802 #endif /* !CONFIG_SMP */
68803
68804 @@ -517,7 +517,7 @@ read_profile(struct file *file, char __user *buf, size_t count, loff_t *ppos)
68805 return -EFAULT;
68806 buf++; p++; count--; read++;
68807 }
68808 - pnt = (char *)prof_buffer + p - sizeof(atomic_t);
68809 + pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
68810 if (copy_to_user(buf, (void *)pnt, count))
68811 return -EFAULT;
68812 read += count;
68813 @@ -548,7 +548,7 @@ static ssize_t write_profile(struct file *file, const char __user *buf,
68814 }
68815 #endif
68816 profile_discard_flip_buffers();
68817 - memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
68818 + memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
68819 return count;
68820 }
68821
68822 diff --git a/kernel/ptrace.c b/kernel/ptrace.c
68823 index a232bb5..2a65ef9 100644
68824 --- a/kernel/ptrace.c
68825 +++ b/kernel/ptrace.c
68826 @@ -279,7 +279,7 @@ static int ptrace_attach(struct task_struct *task, long request,
68827
68828 if (seize)
68829 flags |= PT_SEIZED;
68830 - if (ns_capable(task_user_ns(task), CAP_SYS_PTRACE))
68831 + if (ns_capable_nolog(task_user_ns(task), CAP_SYS_PTRACE))
68832 flags |= PT_PTRACE_CAP;
68833 task->ptrace = flags;
68834
68835 @@ -486,7 +486,7 @@ int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst
68836 break;
68837 return -EIO;
68838 }
68839 - if (copy_to_user(dst, buf, retval))
68840 + if (retval > sizeof(buf) || copy_to_user(dst, buf, retval))
68841 return -EFAULT;
68842 copied += retval;
68843 src += retval;
68844 @@ -671,7 +671,7 @@ int ptrace_request(struct task_struct *child, long request,
68845 bool seized = child->ptrace & PT_SEIZED;
68846 int ret = -EIO;
68847 siginfo_t siginfo, *si;
68848 - void __user *datavp = (void __user *) data;
68849 + void __user *datavp = (__force void __user *) data;
68850 unsigned long __user *datalp = datavp;
68851 unsigned long flags;
68852
68853 @@ -873,14 +873,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
68854 goto out;
68855 }
68856
68857 + if (gr_handle_ptrace(child, request)) {
68858 + ret = -EPERM;
68859 + goto out_put_task_struct;
68860 + }
68861 +
68862 if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
68863 ret = ptrace_attach(child, request, addr, data);
68864 /*
68865 * Some architectures need to do book-keeping after
68866 * a ptrace attach.
68867 */
68868 - if (!ret)
68869 + if (!ret) {
68870 arch_ptrace_attach(child);
68871 + gr_audit_ptrace(child);
68872 + }
68873 goto out_put_task_struct;
68874 }
68875
68876 @@ -906,7 +913,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
68877 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
68878 if (copied != sizeof(tmp))
68879 return -EIO;
68880 - return put_user(tmp, (unsigned long __user *)data);
68881 + return put_user(tmp, (__force unsigned long __user *)data);
68882 }
68883
68884 int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
68885 @@ -1016,14 +1023,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
68886 goto out;
68887 }
68888
68889 + if (gr_handle_ptrace(child, request)) {
68890 + ret = -EPERM;
68891 + goto out_put_task_struct;
68892 + }
68893 +
68894 if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
68895 ret = ptrace_attach(child, request, addr, data);
68896 /*
68897 * Some architectures need to do book-keeping after
68898 * a ptrace attach.
68899 */
68900 - if (!ret)
68901 + if (!ret) {
68902 arch_ptrace_attach(child);
68903 + gr_audit_ptrace(child);
68904 + }
68905 goto out_put_task_struct;
68906 }
68907
68908 diff --git a/kernel/rcutiny.c b/kernel/rcutiny.c
68909 index 37a5444..eec170a 100644
68910 --- a/kernel/rcutiny.c
68911 +++ b/kernel/rcutiny.c
68912 @@ -46,7 +46,7 @@
68913 struct rcu_ctrlblk;
68914 static void invoke_rcu_callbacks(void);
68915 static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp);
68916 -static void rcu_process_callbacks(struct softirq_action *unused);
68917 +static void rcu_process_callbacks(void);
68918 static void __call_rcu(struct rcu_head *head,
68919 void (*func)(struct rcu_head *rcu),
68920 struct rcu_ctrlblk *rcp);
68921 @@ -307,7 +307,7 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp)
68922 rcu_is_callbacks_kthread()));
68923 }
68924
68925 -static void rcu_process_callbacks(struct softirq_action *unused)
68926 +static void rcu_process_callbacks(void)
68927 {
68928 __rcu_process_callbacks(&rcu_sched_ctrlblk);
68929 __rcu_process_callbacks(&rcu_bh_ctrlblk);
68930 diff --git a/kernel/rcutiny_plugin.h b/kernel/rcutiny_plugin.h
68931 index fc31a2d..be2ec04 100644
68932 --- a/kernel/rcutiny_plugin.h
68933 +++ b/kernel/rcutiny_plugin.h
68934 @@ -939,7 +939,7 @@ static int rcu_kthread(void *arg)
68935 have_rcu_kthread_work = morework;
68936 local_irq_restore(flags);
68937 if (work)
68938 - rcu_process_callbacks(NULL);
68939 + rcu_process_callbacks();
68940 schedule_timeout_interruptible(1); /* Leave CPU for others. */
68941 }
68942
68943 diff --git a/kernel/rcutorture.c b/kernel/rcutorture.c
68944 index e66b34a..4b8b626 100644
68945 --- a/kernel/rcutorture.c
68946 +++ b/kernel/rcutorture.c
68947 @@ -163,12 +163,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_count) =
68948 { 0 };
68949 static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
68950 { 0 };
68951 -static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
68952 -static atomic_t n_rcu_torture_alloc;
68953 -static atomic_t n_rcu_torture_alloc_fail;
68954 -static atomic_t n_rcu_torture_free;
68955 -static atomic_t n_rcu_torture_mberror;
68956 -static atomic_t n_rcu_torture_error;
68957 +static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
68958 +static atomic_unchecked_t n_rcu_torture_alloc;
68959 +static atomic_unchecked_t n_rcu_torture_alloc_fail;
68960 +static atomic_unchecked_t n_rcu_torture_free;
68961 +static atomic_unchecked_t n_rcu_torture_mberror;
68962 +static atomic_unchecked_t n_rcu_torture_error;
68963 static long n_rcu_torture_barrier_error;
68964 static long n_rcu_torture_boost_ktrerror;
68965 static long n_rcu_torture_boost_rterror;
68966 @@ -265,11 +265,11 @@ rcu_torture_alloc(void)
68967
68968 spin_lock_bh(&rcu_torture_lock);
68969 if (list_empty(&rcu_torture_freelist)) {
68970 - atomic_inc(&n_rcu_torture_alloc_fail);
68971 + atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
68972 spin_unlock_bh(&rcu_torture_lock);
68973 return NULL;
68974 }
68975 - atomic_inc(&n_rcu_torture_alloc);
68976 + atomic_inc_unchecked(&n_rcu_torture_alloc);
68977 p = rcu_torture_freelist.next;
68978 list_del_init(p);
68979 spin_unlock_bh(&rcu_torture_lock);
68980 @@ -282,7 +282,7 @@ rcu_torture_alloc(void)
68981 static void
68982 rcu_torture_free(struct rcu_torture *p)
68983 {
68984 - atomic_inc(&n_rcu_torture_free);
68985 + atomic_inc_unchecked(&n_rcu_torture_free);
68986 spin_lock_bh(&rcu_torture_lock);
68987 list_add_tail(&p->rtort_free, &rcu_torture_freelist);
68988 spin_unlock_bh(&rcu_torture_lock);
68989 @@ -403,7 +403,7 @@ rcu_torture_cb(struct rcu_head *p)
68990 i = rp->rtort_pipe_count;
68991 if (i > RCU_TORTURE_PIPE_LEN)
68992 i = RCU_TORTURE_PIPE_LEN;
68993 - atomic_inc(&rcu_torture_wcount[i]);
68994 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
68995 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
68996 rp->rtort_mbtest = 0;
68997 rcu_torture_free(rp);
68998 @@ -451,7 +451,7 @@ static void rcu_sync_torture_deferred_free(struct rcu_torture *p)
68999 i = rp->rtort_pipe_count;
69000 if (i > RCU_TORTURE_PIPE_LEN)
69001 i = RCU_TORTURE_PIPE_LEN;
69002 - atomic_inc(&rcu_torture_wcount[i]);
69003 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
69004 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
69005 rp->rtort_mbtest = 0;
69006 list_del(&rp->rtort_free);
69007 @@ -983,7 +983,7 @@ rcu_torture_writer(void *arg)
69008 i = old_rp->rtort_pipe_count;
69009 if (i > RCU_TORTURE_PIPE_LEN)
69010 i = RCU_TORTURE_PIPE_LEN;
69011 - atomic_inc(&rcu_torture_wcount[i]);
69012 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
69013 old_rp->rtort_pipe_count++;
69014 cur_ops->deferred_free(old_rp);
69015 }
69016 @@ -1064,7 +1064,7 @@ static void rcu_torture_timer(unsigned long unused)
69017 }
69018 do_trace_rcu_torture_read(cur_ops->name, &p->rtort_rcu);
69019 if (p->rtort_mbtest == 0)
69020 - atomic_inc(&n_rcu_torture_mberror);
69021 + atomic_inc_unchecked(&n_rcu_torture_mberror);
69022 spin_lock(&rand_lock);
69023 cur_ops->read_delay(&rand);
69024 n_rcu_torture_timers++;
69025 @@ -1128,7 +1128,7 @@ rcu_torture_reader(void *arg)
69026 }
69027 do_trace_rcu_torture_read(cur_ops->name, &p->rtort_rcu);
69028 if (p->rtort_mbtest == 0)
69029 - atomic_inc(&n_rcu_torture_mberror);
69030 + atomic_inc_unchecked(&n_rcu_torture_mberror);
69031 cur_ops->read_delay(&rand);
69032 preempt_disable();
69033 pipe_count = p->rtort_pipe_count;
69034 @@ -1191,10 +1191,10 @@ rcu_torture_printk(char *page)
69035 rcu_torture_current,
69036 rcu_torture_current_version,
69037 list_empty(&rcu_torture_freelist),
69038 - atomic_read(&n_rcu_torture_alloc),
69039 - atomic_read(&n_rcu_torture_alloc_fail),
69040 - atomic_read(&n_rcu_torture_free),
69041 - atomic_read(&n_rcu_torture_mberror),
69042 + atomic_read_unchecked(&n_rcu_torture_alloc),
69043 + atomic_read_unchecked(&n_rcu_torture_alloc_fail),
69044 + atomic_read_unchecked(&n_rcu_torture_free),
69045 + atomic_read_unchecked(&n_rcu_torture_mberror),
69046 n_rcu_torture_boost_ktrerror,
69047 n_rcu_torture_boost_rterror,
69048 n_rcu_torture_boost_failure,
69049 @@ -1208,14 +1208,14 @@ rcu_torture_printk(char *page)
69050 n_barrier_attempts,
69051 n_rcu_torture_barrier_error);
69052 cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
69053 - if (atomic_read(&n_rcu_torture_mberror) != 0 ||
69054 + if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0 ||
69055 n_rcu_torture_barrier_error != 0 ||
69056 n_rcu_torture_boost_ktrerror != 0 ||
69057 n_rcu_torture_boost_rterror != 0 ||
69058 n_rcu_torture_boost_failure != 0 ||
69059 i > 1) {
69060 cnt += sprintf(&page[cnt], "!!! ");
69061 - atomic_inc(&n_rcu_torture_error);
69062 + atomic_inc_unchecked(&n_rcu_torture_error);
69063 WARN_ON_ONCE(1);
69064 }
69065 cnt += sprintf(&page[cnt], "Reader Pipe: ");
69066 @@ -1229,7 +1229,7 @@ rcu_torture_printk(char *page)
69067 cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
69068 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
69069 cnt += sprintf(&page[cnt], " %d",
69070 - atomic_read(&rcu_torture_wcount[i]));
69071 + atomic_read_unchecked(&rcu_torture_wcount[i]));
69072 }
69073 cnt += sprintf(&page[cnt], "\n");
69074 if (cur_ops->stats)
69075 @@ -1888,7 +1888,7 @@ rcu_torture_cleanup(void)
69076
69077 if (cur_ops->cleanup)
69078 cur_ops->cleanup();
69079 - if (atomic_read(&n_rcu_torture_error) || n_rcu_torture_barrier_error)
69080 + if (atomic_read_unchecked(&n_rcu_torture_error) || n_rcu_torture_barrier_error)
69081 rcu_torture_print_module_parms(cur_ops, "End of test: FAILURE");
69082 else if (n_online_successes != n_online_attempts ||
69083 n_offline_successes != n_offline_attempts)
69084 @@ -1958,18 +1958,18 @@ rcu_torture_init(void)
69085
69086 rcu_torture_current = NULL;
69087 rcu_torture_current_version = 0;
69088 - atomic_set(&n_rcu_torture_alloc, 0);
69089 - atomic_set(&n_rcu_torture_alloc_fail, 0);
69090 - atomic_set(&n_rcu_torture_free, 0);
69091 - atomic_set(&n_rcu_torture_mberror, 0);
69092 - atomic_set(&n_rcu_torture_error, 0);
69093 + atomic_set_unchecked(&n_rcu_torture_alloc, 0);
69094 + atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
69095 + atomic_set_unchecked(&n_rcu_torture_free, 0);
69096 + atomic_set_unchecked(&n_rcu_torture_mberror, 0);
69097 + atomic_set_unchecked(&n_rcu_torture_error, 0);
69098 n_rcu_torture_barrier_error = 0;
69099 n_rcu_torture_boost_ktrerror = 0;
69100 n_rcu_torture_boost_rterror = 0;
69101 n_rcu_torture_boost_failure = 0;
69102 n_rcu_torture_boosts = 0;
69103 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
69104 - atomic_set(&rcu_torture_wcount[i], 0);
69105 + atomic_set_unchecked(&rcu_torture_wcount[i], 0);
69106 for_each_possible_cpu(cpu) {
69107 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
69108 per_cpu(rcu_torture_count, cpu)[i] = 0;
69109 diff --git a/kernel/rcutree.c b/kernel/rcutree.c
69110 index 4b97bba..b92c9d2 100644
69111 --- a/kernel/rcutree.c
69112 +++ b/kernel/rcutree.c
69113 @@ -366,9 +366,9 @@ static void rcu_idle_enter_common(struct rcu_dynticks *rdtp, long long oldval)
69114 rcu_prepare_for_idle(smp_processor_id());
69115 /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */
69116 smp_mb__before_atomic_inc(); /* See above. */
69117 - atomic_inc(&rdtp->dynticks);
69118 + atomic_inc_unchecked(&rdtp->dynticks);
69119 smp_mb__after_atomic_inc(); /* Force ordering with next sojourn. */
69120 - WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1);
69121 + WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks) & 0x1);
69122
69123 /*
69124 * The idle task is not permitted to enter the idle loop while
69125 @@ -457,10 +457,10 @@ void rcu_irq_exit(void)
69126 static void rcu_idle_exit_common(struct rcu_dynticks *rdtp, long long oldval)
69127 {
69128 smp_mb__before_atomic_inc(); /* Force ordering w/previous sojourn. */
69129 - atomic_inc(&rdtp->dynticks);
69130 + atomic_inc_unchecked(&rdtp->dynticks);
69131 /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */
69132 smp_mb__after_atomic_inc(); /* See above. */
69133 - WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
69134 + WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks) & 0x1));
69135 rcu_cleanup_after_idle(smp_processor_id());
69136 trace_rcu_dyntick("End", oldval, rdtp->dynticks_nesting);
69137 if (!is_idle_task(current)) {
69138 @@ -554,14 +554,14 @@ void rcu_nmi_enter(void)
69139 struct rcu_dynticks *rdtp = &__get_cpu_var(rcu_dynticks);
69140
69141 if (rdtp->dynticks_nmi_nesting == 0 &&
69142 - (atomic_read(&rdtp->dynticks) & 0x1))
69143 + (atomic_read_unchecked(&rdtp->dynticks) & 0x1))
69144 return;
69145 rdtp->dynticks_nmi_nesting++;
69146 smp_mb__before_atomic_inc(); /* Force delay from prior write. */
69147 - atomic_inc(&rdtp->dynticks);
69148 + atomic_inc_unchecked(&rdtp->dynticks);
69149 /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */
69150 smp_mb__after_atomic_inc(); /* See above. */
69151 - WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
69152 + WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks) & 0x1));
69153 }
69154
69155 /**
69156 @@ -580,9 +580,9 @@ void rcu_nmi_exit(void)
69157 return;
69158 /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */
69159 smp_mb__before_atomic_inc(); /* See above. */
69160 - atomic_inc(&rdtp->dynticks);
69161 + atomic_inc_unchecked(&rdtp->dynticks);
69162 smp_mb__after_atomic_inc(); /* Force delay to next write. */
69163 - WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1);
69164 + WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks) & 0x1);
69165 }
69166
69167 #ifdef CONFIG_PROVE_RCU
69168 @@ -598,7 +598,7 @@ int rcu_is_cpu_idle(void)
69169 int ret;
69170
69171 preempt_disable();
69172 - ret = (atomic_read(&__get_cpu_var(rcu_dynticks).dynticks) & 0x1) == 0;
69173 + ret = (atomic_read_unchecked(&__get_cpu_var(rcu_dynticks).dynticks) & 0x1) == 0;
69174 preempt_enable();
69175 return ret;
69176 }
69177 @@ -668,7 +668,7 @@ int rcu_is_cpu_rrupt_from_idle(void)
69178 */
69179 static int dyntick_save_progress_counter(struct rcu_data *rdp)
69180 {
69181 - rdp->dynticks_snap = atomic_add_return(0, &rdp->dynticks->dynticks);
69182 + rdp->dynticks_snap = atomic_add_return_unchecked(0, &rdp->dynticks->dynticks);
69183 return (rdp->dynticks_snap & 0x1) == 0;
69184 }
69185
69186 @@ -683,7 +683,7 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp)
69187 unsigned int curr;
69188 unsigned int snap;
69189
69190 - curr = (unsigned int)atomic_add_return(0, &rdp->dynticks->dynticks);
69191 + curr = (unsigned int)atomic_add_return_unchecked(0, &rdp->dynticks->dynticks);
69192 snap = (unsigned int)rdp->dynticks_snap;
69193
69194 /*
69195 @@ -713,10 +713,10 @@ static int jiffies_till_stall_check(void)
69196 * for CONFIG_RCU_CPU_STALL_TIMEOUT.
69197 */
69198 if (till_stall_check < 3) {
69199 - ACCESS_ONCE(rcu_cpu_stall_timeout) = 3;
69200 + ACCESS_ONCE_RW(rcu_cpu_stall_timeout) = 3;
69201 till_stall_check = 3;
69202 } else if (till_stall_check > 300) {
69203 - ACCESS_ONCE(rcu_cpu_stall_timeout) = 300;
69204 + ACCESS_ONCE_RW(rcu_cpu_stall_timeout) = 300;
69205 till_stall_check = 300;
69206 }
69207 return till_stall_check * HZ + RCU_STALL_DELAY_DELTA;
69208 @@ -1824,7 +1824,7 @@ __rcu_process_callbacks(struct rcu_state *rsp, struct rcu_data *rdp)
69209 /*
69210 * Do RCU core processing for the current CPU.
69211 */
69212 -static void rcu_process_callbacks(struct softirq_action *unused)
69213 +static void rcu_process_callbacks(void)
69214 {
69215 trace_rcu_utilization("Start RCU core");
69216 __rcu_process_callbacks(&rcu_sched_state,
69217 @@ -2042,8 +2042,8 @@ void synchronize_rcu_bh(void)
69218 }
69219 EXPORT_SYMBOL_GPL(synchronize_rcu_bh);
69220
69221 -static atomic_t sync_sched_expedited_started = ATOMIC_INIT(0);
69222 -static atomic_t sync_sched_expedited_done = ATOMIC_INIT(0);
69223 +static atomic_unchecked_t sync_sched_expedited_started = ATOMIC_INIT(0);
69224 +static atomic_unchecked_t sync_sched_expedited_done = ATOMIC_INIT(0);
69225
69226 static int synchronize_sched_expedited_cpu_stop(void *data)
69227 {
69228 @@ -2104,7 +2104,7 @@ void synchronize_sched_expedited(void)
69229 int firstsnap, s, snap, trycount = 0;
69230
69231 /* Note that atomic_inc_return() implies full memory barrier. */
69232 - firstsnap = snap = atomic_inc_return(&sync_sched_expedited_started);
69233 + firstsnap = snap = atomic_inc_return_unchecked(&sync_sched_expedited_started);
69234 get_online_cpus();
69235 WARN_ON_ONCE(cpu_is_offline(raw_smp_processor_id()));
69236
69237 @@ -2126,7 +2126,7 @@ void synchronize_sched_expedited(void)
69238 }
69239
69240 /* Check to see if someone else did our work for us. */
69241 - s = atomic_read(&sync_sched_expedited_done);
69242 + s = atomic_read_unchecked(&sync_sched_expedited_done);
69243 if (UINT_CMP_GE((unsigned)s, (unsigned)firstsnap)) {
69244 smp_mb(); /* ensure test happens before caller kfree */
69245 return;
69246 @@ -2141,7 +2141,7 @@ void synchronize_sched_expedited(void)
69247 * grace period works for us.
69248 */
69249 get_online_cpus();
69250 - snap = atomic_read(&sync_sched_expedited_started);
69251 + snap = atomic_read_unchecked(&sync_sched_expedited_started);
69252 smp_mb(); /* ensure read is before try_stop_cpus(). */
69253 }
69254
69255 @@ -2152,12 +2152,12 @@ void synchronize_sched_expedited(void)
69256 * than we did beat us to the punch.
69257 */
69258 do {
69259 - s = atomic_read(&sync_sched_expedited_done);
69260 + s = atomic_read_unchecked(&sync_sched_expedited_done);
69261 if (UINT_CMP_GE((unsigned)s, (unsigned)snap)) {
69262 smp_mb(); /* ensure test happens before caller kfree */
69263 break;
69264 }
69265 - } while (atomic_cmpxchg(&sync_sched_expedited_done, s, snap) != s);
69266 + } while (atomic_cmpxchg_unchecked(&sync_sched_expedited_done, s, snap) != s);
69267
69268 put_online_cpus();
69269 }
69270 @@ -2421,7 +2421,7 @@ rcu_boot_init_percpu_data(int cpu, struct rcu_state *rsp)
69271 rdp->qlen = 0;
69272 rdp->dynticks = &per_cpu(rcu_dynticks, cpu);
69273 WARN_ON_ONCE(rdp->dynticks->dynticks_nesting != DYNTICK_TASK_EXIT_IDLE);
69274 - WARN_ON_ONCE(atomic_read(&rdp->dynticks->dynticks) != 1);
69275 + WARN_ON_ONCE(atomic_read_unchecked(&rdp->dynticks->dynticks) != 1);
69276 rdp->cpu = cpu;
69277 rdp->rsp = rsp;
69278 raw_spin_unlock_irqrestore(&rnp->lock, flags);
69279 @@ -2449,8 +2449,8 @@ rcu_init_percpu_data(int cpu, struct rcu_state *rsp, int preemptible)
69280 rdp->n_force_qs_snap = rsp->n_force_qs;
69281 rdp->blimit = blimit;
69282 rdp->dynticks->dynticks_nesting = DYNTICK_TASK_EXIT_IDLE;
69283 - atomic_set(&rdp->dynticks->dynticks,
69284 - (atomic_read(&rdp->dynticks->dynticks) & ~0x1) + 1);
69285 + atomic_set_unchecked(&rdp->dynticks->dynticks,
69286 + (atomic_read_unchecked(&rdp->dynticks->dynticks) & ~0x1) + 1);
69287 rcu_prepare_for_idle_init(cpu);
69288 raw_spin_unlock(&rnp->lock); /* irqs remain disabled. */
69289
69290 diff --git a/kernel/rcutree.h b/kernel/rcutree.h
69291 index 19b61ac..5c60a94 100644
69292 --- a/kernel/rcutree.h
69293 +++ b/kernel/rcutree.h
69294 @@ -83,7 +83,7 @@ struct rcu_dynticks {
69295 long long dynticks_nesting; /* Track irq/process nesting level. */
69296 /* Process level is worth LLONG_MAX/2. */
69297 int dynticks_nmi_nesting; /* Track NMI nesting level. */
69298 - atomic_t dynticks; /* Even value for idle, else odd. */
69299 + atomic_unchecked_t dynticks;/* Even value for idle, else odd. */
69300 #ifdef CONFIG_RCU_FAST_NO_HZ
69301 int dyntick_drain; /* Prepare-for-idle state variable. */
69302 unsigned long dyntick_holdoff;
69303 diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
69304 index 3e48994..d94f03a 100644
69305 --- a/kernel/rcutree_plugin.h
69306 +++ b/kernel/rcutree_plugin.h
69307 @@ -909,7 +909,7 @@ void synchronize_rcu_expedited(void)
69308
69309 /* Clean up and exit. */
69310 smp_mb(); /* ensure expedited GP seen before counter increment. */
69311 - ACCESS_ONCE(sync_rcu_preempt_exp_count)++;
69312 + ACCESS_ONCE_RW(sync_rcu_preempt_exp_count)++;
69313 unlock_mb_ret:
69314 mutex_unlock(&sync_rcu_preempt_exp_mutex);
69315 mb_ret:
69316 diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c
69317 index d4bc16d..c234a5c 100644
69318 --- a/kernel/rcutree_trace.c
69319 +++ b/kernel/rcutree_trace.c
69320 @@ -68,7 +68,7 @@ static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp)
69321 rdp->passed_quiesce, rdp->passed_quiesce_gpnum,
69322 rdp->qs_pending);
69323 seq_printf(m, " dt=%d/%llx/%d df=%lu",
69324 - atomic_read(&rdp->dynticks->dynticks),
69325 + atomic_read_unchecked(&rdp->dynticks->dynticks),
69326 rdp->dynticks->dynticks_nesting,
69327 rdp->dynticks->dynticks_nmi_nesting,
69328 rdp->dynticks_fqs);
69329 @@ -140,7 +140,7 @@ static void print_one_rcu_data_csv(struct seq_file *m, struct rcu_data *rdp)
69330 rdp->passed_quiesce, rdp->passed_quiesce_gpnum,
69331 rdp->qs_pending);
69332 seq_printf(m, ",%d,%llx,%d,%lu",
69333 - atomic_read(&rdp->dynticks->dynticks),
69334 + atomic_read_unchecked(&rdp->dynticks->dynticks),
69335 rdp->dynticks->dynticks_nesting,
69336 rdp->dynticks->dynticks_nmi_nesting,
69337 rdp->dynticks_fqs);
69338 diff --git a/kernel/resource.c b/kernel/resource.c
69339 index e1d2b8e..24820bb 100644
69340 --- a/kernel/resource.c
69341 +++ b/kernel/resource.c
69342 @@ -141,8 +141,18 @@ static const struct file_operations proc_iomem_operations = {
69343
69344 static int __init ioresources_init(void)
69345 {
69346 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
69347 +#ifdef CONFIG_GRKERNSEC_PROC_USER
69348 + proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
69349 + proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
69350 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
69351 + proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
69352 + proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
69353 +#endif
69354 +#else
69355 proc_create("ioports", 0, NULL, &proc_ioports_operations);
69356 proc_create("iomem", 0, NULL, &proc_iomem_operations);
69357 +#endif
69358 return 0;
69359 }
69360 __initcall(ioresources_init);
69361 diff --git a/kernel/rtmutex-tester.c b/kernel/rtmutex-tester.c
69362 index 98ec494..4241d6d 100644
69363 --- a/kernel/rtmutex-tester.c
69364 +++ b/kernel/rtmutex-tester.c
69365 @@ -20,7 +20,7 @@
69366 #define MAX_RT_TEST_MUTEXES 8
69367
69368 static spinlock_t rttest_lock;
69369 -static atomic_t rttest_event;
69370 +static atomic_unchecked_t rttest_event;
69371
69372 struct test_thread_data {
69373 int opcode;
69374 @@ -61,7 +61,7 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
69375
69376 case RTTEST_LOCKCONT:
69377 td->mutexes[td->opdata] = 1;
69378 - td->event = atomic_add_return(1, &rttest_event);
69379 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69380 return 0;
69381
69382 case RTTEST_RESET:
69383 @@ -74,7 +74,7 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
69384 return 0;
69385
69386 case RTTEST_RESETEVENT:
69387 - atomic_set(&rttest_event, 0);
69388 + atomic_set_unchecked(&rttest_event, 0);
69389 return 0;
69390
69391 default:
69392 @@ -91,9 +91,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
69393 return ret;
69394
69395 td->mutexes[id] = 1;
69396 - td->event = atomic_add_return(1, &rttest_event);
69397 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69398 rt_mutex_lock(&mutexes[id]);
69399 - td->event = atomic_add_return(1, &rttest_event);
69400 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69401 td->mutexes[id] = 4;
69402 return 0;
69403
69404 @@ -104,9 +104,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
69405 return ret;
69406
69407 td->mutexes[id] = 1;
69408 - td->event = atomic_add_return(1, &rttest_event);
69409 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69410 ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
69411 - td->event = atomic_add_return(1, &rttest_event);
69412 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69413 td->mutexes[id] = ret ? 0 : 4;
69414 return ret ? -EINTR : 0;
69415
69416 @@ -115,9 +115,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
69417 if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
69418 return ret;
69419
69420 - td->event = atomic_add_return(1, &rttest_event);
69421 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69422 rt_mutex_unlock(&mutexes[id]);
69423 - td->event = atomic_add_return(1, &rttest_event);
69424 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69425 td->mutexes[id] = 0;
69426 return 0;
69427
69428 @@ -164,7 +164,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
69429 break;
69430
69431 td->mutexes[dat] = 2;
69432 - td->event = atomic_add_return(1, &rttest_event);
69433 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69434 break;
69435
69436 default:
69437 @@ -184,7 +184,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
69438 return;
69439
69440 td->mutexes[dat] = 3;
69441 - td->event = atomic_add_return(1, &rttest_event);
69442 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69443 break;
69444
69445 case RTTEST_LOCKNOWAIT:
69446 @@ -196,7 +196,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
69447 return;
69448
69449 td->mutexes[dat] = 1;
69450 - td->event = atomic_add_return(1, &rttest_event);
69451 + td->event = atomic_add_return_unchecked(1, &rttest_event);
69452 return;
69453
69454 default:
69455 diff --git a/kernel/sched/auto_group.c b/kernel/sched/auto_group.c
69456 index 0984a21..939f183 100644
69457 --- a/kernel/sched/auto_group.c
69458 +++ b/kernel/sched/auto_group.c
69459 @@ -11,7 +11,7 @@
69460
69461 unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1;
69462 static struct autogroup autogroup_default;
69463 -static atomic_t autogroup_seq_nr;
69464 +static atomic_unchecked_t autogroup_seq_nr;
69465
69466 void __init autogroup_init(struct task_struct *init_task)
69467 {
69468 @@ -78,7 +78,7 @@ static inline struct autogroup *autogroup_create(void)
69469
69470 kref_init(&ag->kref);
69471 init_rwsem(&ag->lock);
69472 - ag->id = atomic_inc_return(&autogroup_seq_nr);
69473 + ag->id = atomic_inc_return_unchecked(&autogroup_seq_nr);
69474 ag->tg = tg;
69475 #ifdef CONFIG_RT_GROUP_SCHED
69476 /*
69477 diff --git a/kernel/sched/core.c b/kernel/sched/core.c
69478 index 39c44fa..70edb8b 100644
69479 --- a/kernel/sched/core.c
69480 +++ b/kernel/sched/core.c
69481 @@ -4103,6 +4103,8 @@ int can_nice(const struct task_struct *p, const int nice)
69482 /* convert nice value [19,-20] to rlimit style value [1,40] */
69483 int nice_rlim = 20 - nice;
69484
69485 + gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
69486 +
69487 return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
69488 capable(CAP_SYS_NICE));
69489 }
69490 @@ -4136,7 +4138,8 @@ SYSCALL_DEFINE1(nice, int, increment)
69491 if (nice > 19)
69492 nice = 19;
69493
69494 - if (increment < 0 && !can_nice(current, nice))
69495 + if (increment < 0 && (!can_nice(current, nice) ||
69496 + gr_handle_chroot_nice()))
69497 return -EPERM;
69498
69499 retval = security_task_setnice(current, nice);
69500 @@ -4290,6 +4293,7 @@ recheck:
69501 unsigned long rlim_rtprio =
69502 task_rlimit(p, RLIMIT_RTPRIO);
69503
69504 + gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
69505 /* can't set/change the rt policy */
69506 if (policy != p->policy && !rlim_rtprio)
69507 return -EPERM;
69508 diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
69509 index c099cc6..06aec4f 100644
69510 --- a/kernel/sched/fair.c
69511 +++ b/kernel/sched/fair.c
69512 @@ -4846,7 +4846,7 @@ static void nohz_idle_balance(int this_cpu, enum cpu_idle_type idle) { }
69513 * run_rebalance_domains is triggered when needed from the scheduler tick.
69514 * Also triggered for nohz idle balancing (with nohz_balancing_kick set).
69515 */
69516 -static void run_rebalance_domains(struct softirq_action *h)
69517 +static void run_rebalance_domains(void)
69518 {
69519 int this_cpu = smp_processor_id();
69520 struct rq *this_rq = cpu_rq(this_cpu);
69521 diff --git a/kernel/signal.c b/kernel/signal.c
69522 index 6771027..763e51e 100644
69523 --- a/kernel/signal.c
69524 +++ b/kernel/signal.c
69525 @@ -48,12 +48,12 @@ static struct kmem_cache *sigqueue_cachep;
69526
69527 int print_fatal_signals __read_mostly;
69528
69529 -static void __user *sig_handler(struct task_struct *t, int sig)
69530 +static __sighandler_t sig_handler(struct task_struct *t, int sig)
69531 {
69532 return t->sighand->action[sig - 1].sa.sa_handler;
69533 }
69534
69535 -static int sig_handler_ignored(void __user *handler, int sig)
69536 +static int sig_handler_ignored(__sighandler_t handler, int sig)
69537 {
69538 /* Is it explicitly or implicitly ignored? */
69539 return handler == SIG_IGN ||
69540 @@ -62,7 +62,7 @@ static int sig_handler_ignored(void __user *handler, int sig)
69541
69542 static int sig_task_ignored(struct task_struct *t, int sig, bool force)
69543 {
69544 - void __user *handler;
69545 + __sighandler_t handler;
69546
69547 handler = sig_handler(t, sig);
69548
69549 @@ -366,6 +366,9 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t flags, int override_rlimi
69550 atomic_inc(&user->sigpending);
69551 rcu_read_unlock();
69552
69553 + if (!override_rlimit)
69554 + gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
69555 +
69556 if (override_rlimit ||
69557 atomic_read(&user->sigpending) <=
69558 task_rlimit(t, RLIMIT_SIGPENDING)) {
69559 @@ -490,7 +493,7 @@ flush_signal_handlers(struct task_struct *t, int force_default)
69560
69561 int unhandled_signal(struct task_struct *tsk, int sig)
69562 {
69563 - void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
69564 + __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
69565 if (is_global_init(tsk))
69566 return 1;
69567 if (handler != SIG_IGN && handler != SIG_DFL)
69568 @@ -816,6 +819,13 @@ static int check_kill_permission(int sig, struct siginfo *info,
69569 }
69570 }
69571
69572 + /* allow glibc communication via tgkill to other threads in our
69573 + thread group */
69574 + if ((info == SEND_SIG_NOINFO || info->si_code != SI_TKILL ||
69575 + sig != (SIGRTMIN+1) || task_tgid_vnr(t) != info->si_pid)
69576 + && gr_handle_signal(t, sig))
69577 + return -EPERM;
69578 +
69579 return security_task_kill(t, info, sig, 0);
69580 }
69581
69582 @@ -1197,7 +1207,7 @@ __group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
69583 return send_signal(sig, info, p, 1);
69584 }
69585
69586 -static int
69587 +int
69588 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
69589 {
69590 return send_signal(sig, info, t, 0);
69591 @@ -1234,6 +1244,7 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
69592 unsigned long int flags;
69593 int ret, blocked, ignored;
69594 struct k_sigaction *action;
69595 + int is_unhandled = 0;
69596
69597 spin_lock_irqsave(&t->sighand->siglock, flags);
69598 action = &t->sighand->action[sig-1];
69599 @@ -1248,9 +1259,18 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
69600 }
69601 if (action->sa.sa_handler == SIG_DFL)
69602 t->signal->flags &= ~SIGNAL_UNKILLABLE;
69603 + if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
69604 + is_unhandled = 1;
69605 ret = specific_send_sig_info(sig, info, t);
69606 spin_unlock_irqrestore(&t->sighand->siglock, flags);
69607
69608 + /* only deal with unhandled signals, java etc trigger SIGSEGV during
69609 + normal operation */
69610 + if (is_unhandled) {
69611 + gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
69612 + gr_handle_crash(t, sig);
69613 + }
69614 +
69615 return ret;
69616 }
69617
69618 @@ -1317,8 +1337,11 @@ int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
69619 ret = check_kill_permission(sig, info, p);
69620 rcu_read_unlock();
69621
69622 - if (!ret && sig)
69623 + if (!ret && sig) {
69624 ret = do_send_sig_info(sig, info, p, true);
69625 + if (!ret)
69626 + gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
69627 + }
69628
69629 return ret;
69630 }
69631 @@ -2858,7 +2881,15 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
69632 int error = -ESRCH;
69633
69634 rcu_read_lock();
69635 - p = find_task_by_vpid(pid);
69636 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
69637 + /* allow glibc communication via tgkill to other threads in our
69638 + thread group */
69639 + if (grsec_enable_chroot_findtask && info->si_code == SI_TKILL &&
69640 + sig == (SIGRTMIN+1) && tgid == info->si_pid)
69641 + p = find_task_by_vpid_unrestricted(pid);
69642 + else
69643 +#endif
69644 + p = find_task_by_vpid(pid);
69645 if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
69646 error = check_kill_permission(sig, info, p);
69647 /*
69648 diff --git a/kernel/smp.c b/kernel/smp.c
69649 index d0ae5b2..b87c5a8 100644
69650 --- a/kernel/smp.c
69651 +++ b/kernel/smp.c
69652 @@ -582,22 +582,22 @@ int smp_call_function(smp_call_func_t func, void *info, int wait)
69653 }
69654 EXPORT_SYMBOL(smp_call_function);
69655
69656 -void ipi_call_lock(void)
69657 +void ipi_call_lock(void) __acquires(call_function.lock)
69658 {
69659 raw_spin_lock(&call_function.lock);
69660 }
69661
69662 -void ipi_call_unlock(void)
69663 +void ipi_call_unlock(void) __releases(call_function.lock)
69664 {
69665 raw_spin_unlock(&call_function.lock);
69666 }
69667
69668 -void ipi_call_lock_irq(void)
69669 +void ipi_call_lock_irq(void) __acquires(call_function.lock)
69670 {
69671 raw_spin_lock_irq(&call_function.lock);
69672 }
69673
69674 -void ipi_call_unlock_irq(void)
69675 +void ipi_call_unlock_irq(void) __releases(call_function.lock)
69676 {
69677 raw_spin_unlock_irq(&call_function.lock);
69678 }
69679 diff --git a/kernel/softirq.c b/kernel/softirq.c
69680 index 671f959..91c51cb 100644
69681 --- a/kernel/softirq.c
69682 +++ b/kernel/softirq.c
69683 @@ -56,7 +56,7 @@ static struct softirq_action softirq_vec[NR_SOFTIRQS] __cacheline_aligned_in_smp
69684
69685 DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
69686
69687 -char *softirq_to_name[NR_SOFTIRQS] = {
69688 +const char * const softirq_to_name[NR_SOFTIRQS] = {
69689 "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
69690 "TASKLET", "SCHED", "HRTIMER", "RCU"
69691 };
69692 @@ -235,7 +235,7 @@ restart:
69693 kstat_incr_softirqs_this_cpu(vec_nr);
69694
69695 trace_softirq_entry(vec_nr);
69696 - h->action(h);
69697 + h->action();
69698 trace_softirq_exit(vec_nr);
69699 if (unlikely(prev_count != preempt_count())) {
69700 printk(KERN_ERR "huh, entered softirq %u %s %p"
69701 @@ -381,9 +381,11 @@ void __raise_softirq_irqoff(unsigned int nr)
69702 or_softirq_pending(1UL << nr);
69703 }
69704
69705 -void open_softirq(int nr, void (*action)(struct softirq_action *))
69706 +void open_softirq(int nr, void (*action)(void))
69707 {
69708 - softirq_vec[nr].action = action;
69709 + pax_open_kernel();
69710 + *(void **)&softirq_vec[nr].action = action;
69711 + pax_close_kernel();
69712 }
69713
69714 /*
69715 @@ -437,7 +439,7 @@ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
69716
69717 EXPORT_SYMBOL(__tasklet_hi_schedule_first);
69718
69719 -static void tasklet_action(struct softirq_action *a)
69720 +static void tasklet_action(void)
69721 {
69722 struct tasklet_struct *list;
69723
69724 @@ -472,7 +474,7 @@ static void tasklet_action(struct softirq_action *a)
69725 }
69726 }
69727
69728 -static void tasklet_hi_action(struct softirq_action *a)
69729 +static void tasklet_hi_action(void)
69730 {
69731 struct tasklet_struct *list;
69732
69733 diff --git a/kernel/srcu.c b/kernel/srcu.c
69734 index 2095be3..9a5b89d 100644
69735 --- a/kernel/srcu.c
69736 +++ b/kernel/srcu.c
69737 @@ -302,9 +302,9 @@ int __srcu_read_lock(struct srcu_struct *sp)
69738 preempt_disable();
69739 idx = rcu_dereference_index_check(sp->completed,
69740 rcu_read_lock_sched_held()) & 0x1;
69741 - ACCESS_ONCE(this_cpu_ptr(sp->per_cpu_ref)->c[idx]) += 1;
69742 + ACCESS_ONCE_RW(this_cpu_ptr(sp->per_cpu_ref)->c[idx]) += 1;
69743 smp_mb(); /* B */ /* Avoid leaking the critical section. */
69744 - ACCESS_ONCE(this_cpu_ptr(sp->per_cpu_ref)->seq[idx]) += 1;
69745 + ACCESS_ONCE_RW(this_cpu_ptr(sp->per_cpu_ref)->seq[idx]) += 1;
69746 preempt_enable();
69747 return idx;
69748 }
69749 @@ -320,7 +320,7 @@ void __srcu_read_unlock(struct srcu_struct *sp, int idx)
69750 {
69751 preempt_disable();
69752 smp_mb(); /* C */ /* Avoid leaking the critical section. */
69753 - ACCESS_ONCE(this_cpu_ptr(sp->per_cpu_ref)->c[idx]) -= 1;
69754 + ACCESS_ONCE_RW(this_cpu_ptr(sp->per_cpu_ref)->c[idx]) -= 1;
69755 preempt_enable();
69756 }
69757 EXPORT_SYMBOL_GPL(__srcu_read_unlock);
69758 diff --git a/kernel/sys.c b/kernel/sys.c
69759 index 2d39a84..f778b49 100644
69760 --- a/kernel/sys.c
69761 +++ b/kernel/sys.c
69762 @@ -157,6 +157,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error)
69763 error = -EACCES;
69764 goto out;
69765 }
69766 +
69767 + if (gr_handle_chroot_setpriority(p, niceval)) {
69768 + error = -EACCES;
69769 + goto out;
69770 + }
69771 +
69772 no_nice = security_task_setnice(p, niceval);
69773 if (no_nice) {
69774 error = no_nice;
69775 @@ -594,6 +600,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
69776 goto error;
69777 }
69778
69779 + if (gr_check_group_change(new->gid, new->egid, -1))
69780 + goto error;
69781 +
69782 if (rgid != (gid_t) -1 ||
69783 (egid != (gid_t) -1 && !gid_eq(kegid, old->gid)))
69784 new->sgid = new->egid;
69785 @@ -629,6 +638,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
69786 old = current_cred();
69787
69788 retval = -EPERM;
69789 +
69790 + if (gr_check_group_change(kgid, kgid, kgid))
69791 + goto error;
69792 +
69793 if (nsown_capable(CAP_SETGID))
69794 new->gid = new->egid = new->sgid = new->fsgid = kgid;
69795 else if (gid_eq(kgid, old->gid) || gid_eq(kgid, old->sgid))
69796 @@ -646,7 +659,7 @@ error:
69797 /*
69798 * change the user struct in a credentials set to match the new UID
69799 */
69800 -static int set_user(struct cred *new)
69801 +int set_user(struct cred *new)
69802 {
69803 struct user_struct *new_user;
69804
69805 @@ -726,6 +739,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
69806 goto error;
69807 }
69808
69809 + if (gr_check_user_change(new->uid, new->euid, -1))
69810 + goto error;
69811 +
69812 if (!uid_eq(new->uid, old->uid)) {
69813 retval = set_user(new);
69814 if (retval < 0)
69815 @@ -776,6 +792,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
69816 old = current_cred();
69817
69818 retval = -EPERM;
69819 +
69820 + if (gr_check_crash_uid(kuid))
69821 + goto error;
69822 + if (gr_check_user_change(kuid, kuid, kuid))
69823 + goto error;
69824 +
69825 if (nsown_capable(CAP_SETUID)) {
69826 new->suid = new->uid = kuid;
69827 if (!uid_eq(kuid, old->uid)) {
69828 @@ -845,6 +867,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
69829 goto error;
69830 }
69831
69832 + if (gr_check_user_change(kruid, keuid, -1))
69833 + goto error;
69834 +
69835 if (ruid != (uid_t) -1) {
69836 new->uid = kruid;
69837 if (!uid_eq(kruid, old->uid)) {
69838 @@ -927,6 +952,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
69839 goto error;
69840 }
69841
69842 + if (gr_check_group_change(krgid, kegid, -1))
69843 + goto error;
69844 +
69845 if (rgid != (gid_t) -1)
69846 new->gid = krgid;
69847 if (egid != (gid_t) -1)
69848 @@ -980,6 +1008,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
69849 if (!uid_valid(kuid))
69850 return old_fsuid;
69851
69852 + if (gr_check_user_change(-1, -1, kuid))
69853 + goto error;
69854 +
69855 new = prepare_creds();
69856 if (!new)
69857 return old_fsuid;
69858 @@ -994,6 +1025,7 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
69859 }
69860 }
69861
69862 +error:
69863 abort_creds(new);
69864 return old_fsuid;
69865
69866 @@ -1026,12 +1058,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
69867 if (gid_eq(kgid, old->gid) || gid_eq(kgid, old->egid) ||
69868 gid_eq(kgid, old->sgid) || gid_eq(kgid, old->fsgid) ||
69869 nsown_capable(CAP_SETGID)) {
69870 + if (gr_check_group_change(-1, -1, kgid))
69871 + goto error;
69872 +
69873 if (!gid_eq(kgid, old->fsgid)) {
69874 new->fsgid = kgid;
69875 goto change_okay;
69876 }
69877 }
69878
69879 +error:
69880 abort_creds(new);
69881 return old_fsgid;
69882
69883 @@ -1283,7 +1319,10 @@ static int override_release(char __user *release, int len)
69884 }
69885 v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 40;
69886 snprintf(buf, len, "2.6.%u%s", v, rest);
69887 - ret = copy_to_user(release, buf, len);
69888 + if (len > sizeof(buf))
69889 + ret = -EFAULT;
69890 + else
69891 + ret = copy_to_user(release, buf, len);
69892 }
69893 return ret;
69894 }
69895 @@ -1337,19 +1376,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
69896 return -EFAULT;
69897
69898 down_read(&uts_sem);
69899 - error = __copy_to_user(&name->sysname, &utsname()->sysname,
69900 + error = __copy_to_user(name->sysname, &utsname()->sysname,
69901 __OLD_UTS_LEN);
69902 error |= __put_user(0, name->sysname + __OLD_UTS_LEN);
69903 - error |= __copy_to_user(&name->nodename, &utsname()->nodename,
69904 + error |= __copy_to_user(name->nodename, &utsname()->nodename,
69905 __OLD_UTS_LEN);
69906 error |= __put_user(0, name->nodename + __OLD_UTS_LEN);
69907 - error |= __copy_to_user(&name->release, &utsname()->release,
69908 + error |= __copy_to_user(name->release, &utsname()->release,
69909 __OLD_UTS_LEN);
69910 error |= __put_user(0, name->release + __OLD_UTS_LEN);
69911 - error |= __copy_to_user(&name->version, &utsname()->version,
69912 + error |= __copy_to_user(name->version, &utsname()->version,
69913 __OLD_UTS_LEN);
69914 error |= __put_user(0, name->version + __OLD_UTS_LEN);
69915 - error |= __copy_to_user(&name->machine, &utsname()->machine,
69916 + error |= __copy_to_user(name->machine, &utsname()->machine,
69917 __OLD_UTS_LEN);
69918 error |= __put_user(0, name->machine + __OLD_UTS_LEN);
69919 up_read(&uts_sem);
69920 @@ -2024,7 +2063,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
69921 error = get_dumpable(me->mm);
69922 break;
69923 case PR_SET_DUMPABLE:
69924 - if (arg2 < 0 || arg2 > 1) {
69925 + if (arg2 > 1) {
69926 error = -EINVAL;
69927 break;
69928 }
69929 diff --git a/kernel/sysctl.c b/kernel/sysctl.c
69930 index 4ab1187..33f4f2b 100644
69931 --- a/kernel/sysctl.c
69932 +++ b/kernel/sysctl.c
69933 @@ -91,7 +91,6 @@
69934
69935
69936 #if defined(CONFIG_SYSCTL)
69937 -
69938 /* External variables not in a header file. */
69939 extern int sysctl_overcommit_memory;
69940 extern int sysctl_overcommit_ratio;
69941 @@ -169,10 +168,13 @@ static int proc_taint(struct ctl_table *table, int write,
69942 void __user *buffer, size_t *lenp, loff_t *ppos);
69943 #endif
69944
69945 -#ifdef CONFIG_PRINTK
69946 static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
69947 void __user *buffer, size_t *lenp, loff_t *ppos);
69948 -#endif
69949 +
69950 +static int proc_dointvec_minmax_coredump(struct ctl_table *table, int write,
69951 + void __user *buffer, size_t *lenp, loff_t *ppos);
69952 +static int proc_dostring_coredump(struct ctl_table *table, int write,
69953 + void __user *buffer, size_t *lenp, loff_t *ppos);
69954
69955 #ifdef CONFIG_MAGIC_SYSRQ
69956 /* Note: sysrq code uses it's own private copy */
69957 @@ -196,6 +198,8 @@ static int sysrq_sysctl_handler(ctl_table *table, int write,
69958
69959 #endif
69960
69961 +extern struct ctl_table grsecurity_table[];
69962 +
69963 static struct ctl_table kern_table[];
69964 static struct ctl_table vm_table[];
69965 static struct ctl_table fs_table[];
69966 @@ -210,6 +214,20 @@ extern struct ctl_table epoll_table[];
69967 int sysctl_legacy_va_layout;
69968 #endif
69969
69970 +#ifdef CONFIG_PAX_SOFTMODE
69971 +static ctl_table pax_table[] = {
69972 + {
69973 + .procname = "softmode",
69974 + .data = &pax_softmode,
69975 + .maxlen = sizeof(unsigned int),
69976 + .mode = 0600,
69977 + .proc_handler = &proc_dointvec,
69978 + },
69979 +
69980 + { }
69981 +};
69982 +#endif
69983 +
69984 /* The default sysctl tables: */
69985
69986 static struct ctl_table sysctl_base_table[] = {
69987 @@ -256,6 +274,22 @@ static int max_extfrag_threshold = 1000;
69988 #endif
69989
69990 static struct ctl_table kern_table[] = {
69991 +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
69992 + {
69993 + .procname = "grsecurity",
69994 + .mode = 0500,
69995 + .child = grsecurity_table,
69996 + },
69997 +#endif
69998 +
69999 +#ifdef CONFIG_PAX_SOFTMODE
70000 + {
70001 + .procname = "pax",
70002 + .mode = 0500,
70003 + .child = pax_table,
70004 + },
70005 +#endif
70006 +
70007 {
70008 .procname = "sched_child_runs_first",
70009 .data = &sysctl_sched_child_runs_first,
70010 @@ -410,7 +444,7 @@ static struct ctl_table kern_table[] = {
70011 .data = core_pattern,
70012 .maxlen = CORENAME_MAX_SIZE,
70013 .mode = 0644,
70014 - .proc_handler = proc_dostring,
70015 + .proc_handler = proc_dostring_coredump,
70016 },
70017 {
70018 .procname = "core_pipe_limit",
70019 @@ -540,7 +574,7 @@ static struct ctl_table kern_table[] = {
70020 .data = &modprobe_path,
70021 .maxlen = KMOD_PATH_LEN,
70022 .mode = 0644,
70023 - .proc_handler = proc_dostring,
70024 + .proc_handler = proc_dostring_modpriv,
70025 },
70026 {
70027 .procname = "modules_disabled",
70028 @@ -707,16 +741,20 @@ static struct ctl_table kern_table[] = {
70029 .extra1 = &zero,
70030 .extra2 = &one,
70031 },
70032 +#endif
70033 {
70034 .procname = "kptr_restrict",
70035 .data = &kptr_restrict,
70036 .maxlen = sizeof(int),
70037 .mode = 0644,
70038 .proc_handler = proc_dointvec_minmax_sysadmin,
70039 +#ifdef CONFIG_GRKERNSEC_HIDESYM
70040 + .extra1 = &two,
70041 +#else
70042 .extra1 = &zero,
70043 +#endif
70044 .extra2 = &two,
70045 },
70046 -#endif
70047 {
70048 .procname = "ngroups_max",
70049 .data = &ngroups_max,
70050 @@ -1215,6 +1253,13 @@ static struct ctl_table vm_table[] = {
70051 .proc_handler = proc_dointvec_minmax,
70052 .extra1 = &zero,
70053 },
70054 + {
70055 + .procname = "heap_stack_gap",
70056 + .data = &sysctl_heap_stack_gap,
70057 + .maxlen = sizeof(sysctl_heap_stack_gap),
70058 + .mode = 0644,
70059 + .proc_handler = proc_doulongvec_minmax,
70060 + },
70061 #else
70062 {
70063 .procname = "nr_trim_pages",
70064 @@ -1498,7 +1543,7 @@ static struct ctl_table fs_table[] = {
70065 .data = &suid_dumpable,
70066 .maxlen = sizeof(int),
70067 .mode = 0644,
70068 - .proc_handler = proc_dointvec_minmax,
70069 + .proc_handler = proc_dointvec_minmax_coredump,
70070 .extra1 = &zero,
70071 .extra2 = &two,
70072 },
70073 @@ -1645,6 +1690,16 @@ int proc_dostring(struct ctl_table *table, int write,
70074 buffer, lenp, ppos);
70075 }
70076
70077 +int proc_dostring_modpriv(struct ctl_table *table, int write,
70078 + void __user *buffer, size_t *lenp, loff_t *ppos)
70079 +{
70080 + if (write && !capable(CAP_SYS_MODULE))
70081 + return -EPERM;
70082 +
70083 + return _proc_do_string(table->data, table->maxlen, write,
70084 + buffer, lenp, ppos);
70085 +}
70086 +
70087 static size_t proc_skip_spaces(char **buf)
70088 {
70089 size_t ret;
70090 @@ -1750,6 +1805,8 @@ static int proc_put_long(void __user **buf, size_t *size, unsigned long val,
70091 len = strlen(tmp);
70092 if (len > *size)
70093 len = *size;
70094 + if (len > sizeof(tmp))
70095 + len = sizeof(tmp);
70096 if (copy_to_user(*buf, tmp, len))
70097 return -EFAULT;
70098 *size -= len;
70099 @@ -1942,7 +1999,6 @@ static int proc_taint(struct ctl_table *table, int write,
70100 return err;
70101 }
70102
70103 -#ifdef CONFIG_PRINTK
70104 static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
70105 void __user *buffer, size_t *lenp, loff_t *ppos)
70106 {
70107 @@ -1951,7 +2007,6 @@ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
70108
70109 return proc_dointvec_minmax(table, write, buffer, lenp, ppos);
70110 }
70111 -#endif
70112
70113 struct do_proc_dointvec_minmax_conv_param {
70114 int *min;
70115 @@ -2009,6 +2064,34 @@ int proc_dointvec_minmax(struct ctl_table *table, int write,
70116 do_proc_dointvec_minmax_conv, &param);
70117 }
70118
70119 +static void validate_coredump_safety(void)
70120 +{
70121 + if (suid_dumpable == SUID_DUMPABLE_SAFE &&
70122 + core_pattern[0] != '/' && core_pattern[0] != '|') {
70123 + printk(KERN_WARNING "Unsafe core_pattern used with "\
70124 + "suid_dumpable=2. Pipe handler or fully qualified "\
70125 + "core dump path required.\n");
70126 + }
70127 +}
70128 +
70129 +static int proc_dointvec_minmax_coredump(struct ctl_table *table, int write,
70130 + void __user *buffer, size_t *lenp, loff_t *ppos)
70131 +{
70132 + int error = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
70133 + if (!error)
70134 + validate_coredump_safety();
70135 + return error;
70136 +}
70137 +
70138 +static int proc_dostring_coredump(struct ctl_table *table, int write,
70139 + void __user *buffer, size_t *lenp, loff_t *ppos)
70140 +{
70141 + int error = proc_dostring(table, write, buffer, lenp, ppos);
70142 + if (!error)
70143 + validate_coredump_safety();
70144 + return error;
70145 +}
70146 +
70147 static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int write,
70148 void __user *buffer,
70149 size_t *lenp, loff_t *ppos,
70150 @@ -2066,8 +2149,11 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
70151 *i = val;
70152 } else {
70153 val = convdiv * (*i) / convmul;
70154 - if (!first)
70155 + if (!first) {
70156 err = proc_put_char(&buffer, &left, '\t');
70157 + if (err)
70158 + break;
70159 + }
70160 err = proc_put_long(&buffer, &left, val, false);
70161 if (err)
70162 break;
70163 @@ -2459,6 +2545,12 @@ int proc_dostring(struct ctl_table *table, int write,
70164 return -ENOSYS;
70165 }
70166
70167 +int proc_dostring_modpriv(struct ctl_table *table, int write,
70168 + void __user *buffer, size_t *lenp, loff_t *ppos)
70169 +{
70170 + return -ENOSYS;
70171 +}
70172 +
70173 int proc_dointvec(struct ctl_table *table, int write,
70174 void __user *buffer, size_t *lenp, loff_t *ppos)
70175 {
70176 @@ -2515,5 +2607,6 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
70177 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
70178 EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
70179 EXPORT_SYMBOL(proc_dostring);
70180 +EXPORT_SYMBOL(proc_dostring_modpriv);
70181 EXPORT_SYMBOL(proc_doulongvec_minmax);
70182 EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
70183 diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
70184 index a650694..aaeeb20 100644
70185 --- a/kernel/sysctl_binary.c
70186 +++ b/kernel/sysctl_binary.c
70187 @@ -989,7 +989,7 @@ static ssize_t bin_intvec(struct file *file,
70188 int i;
70189
70190 set_fs(KERNEL_DS);
70191 - result = vfs_read(file, buffer, BUFSZ - 1, &pos);
70192 + result = vfs_read(file, (char __force_user *)buffer, BUFSZ - 1, &pos);
70193 set_fs(old_fs);
70194 if (result < 0)
70195 goto out_kfree;
70196 @@ -1034,7 +1034,7 @@ static ssize_t bin_intvec(struct file *file,
70197 }
70198
70199 set_fs(KERNEL_DS);
70200 - result = vfs_write(file, buffer, str - buffer, &pos);
70201 + result = vfs_write(file, (const char __force_user *)buffer, str - buffer, &pos);
70202 set_fs(old_fs);
70203 if (result < 0)
70204 goto out_kfree;
70205 @@ -1067,7 +1067,7 @@ static ssize_t bin_ulongvec(struct file *file,
70206 int i;
70207
70208 set_fs(KERNEL_DS);
70209 - result = vfs_read(file, buffer, BUFSZ - 1, &pos);
70210 + result = vfs_read(file, (char __force_user *)buffer, BUFSZ - 1, &pos);
70211 set_fs(old_fs);
70212 if (result < 0)
70213 goto out_kfree;
70214 @@ -1112,7 +1112,7 @@ static ssize_t bin_ulongvec(struct file *file,
70215 }
70216
70217 set_fs(KERNEL_DS);
70218 - result = vfs_write(file, buffer, str - buffer, &pos);
70219 + result = vfs_write(file, (const char __force_user *)buffer, str - buffer, &pos);
70220 set_fs(old_fs);
70221 if (result < 0)
70222 goto out_kfree;
70223 @@ -1138,7 +1138,7 @@ static ssize_t bin_uuid(struct file *file,
70224 int i;
70225
70226 set_fs(KERNEL_DS);
70227 - result = vfs_read(file, buf, sizeof(buf) - 1, &pos);
70228 + result = vfs_read(file, (char __force_user *)buf, sizeof(buf) - 1, &pos);
70229 set_fs(old_fs);
70230 if (result < 0)
70231 goto out;
70232 @@ -1185,7 +1185,7 @@ static ssize_t bin_dn_node_address(struct file *file,
70233 __le16 dnaddr;
70234
70235 set_fs(KERNEL_DS);
70236 - result = vfs_read(file, buf, sizeof(buf) - 1, &pos);
70237 + result = vfs_read(file, (char __force_user *)buf, sizeof(buf) - 1, &pos);
70238 set_fs(old_fs);
70239 if (result < 0)
70240 goto out;
70241 @@ -1233,7 +1233,7 @@ static ssize_t bin_dn_node_address(struct file *file,
70242 le16_to_cpu(dnaddr) & 0x3ff);
70243
70244 set_fs(KERNEL_DS);
70245 - result = vfs_write(file, buf, len, &pos);
70246 + result = vfs_write(file, (const char __force_user *)buf, len, &pos);
70247 set_fs(old_fs);
70248 if (result < 0)
70249 goto out;
70250 diff --git a/kernel/taskstats.c b/kernel/taskstats.c
70251 index e660464..c8b9e67 100644
70252 --- a/kernel/taskstats.c
70253 +++ b/kernel/taskstats.c
70254 @@ -27,9 +27,12 @@
70255 #include <linux/cgroup.h>
70256 #include <linux/fs.h>
70257 #include <linux/file.h>
70258 +#include <linux/grsecurity.h>
70259 #include <net/genetlink.h>
70260 #include <linux/atomic.h>
70261
70262 +extern int gr_is_taskstats_denied(int pid);
70263 +
70264 /*
70265 * Maximum length of a cpumask that can be specified in
70266 * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
70267 @@ -556,6 +559,9 @@ err:
70268
70269 static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
70270 {
70271 + if (gr_is_taskstats_denied(current->pid))
70272 + return -EACCES;
70273 +
70274 if (info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK])
70275 return cmd_attr_register_cpumask(info);
70276 else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK])
70277 diff --git a/kernel/time.c b/kernel/time.c
70278 index ba744cf..267b7c5 100644
70279 --- a/kernel/time.c
70280 +++ b/kernel/time.c
70281 @@ -163,6 +163,11 @@ int do_sys_settimeofday(const struct timespec *tv, const struct timezone *tz)
70282 return error;
70283
70284 if (tz) {
70285 + /* we log in do_settimeofday called below, so don't log twice
70286 + */
70287 + if (!tv)
70288 + gr_log_timechange();
70289 +
70290 sys_tz = *tz;
70291 update_vsyscall_tz();
70292 if (firsttime) {
70293 diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
70294 index aa27d39..34d221c 100644
70295 --- a/kernel/time/alarmtimer.c
70296 +++ b/kernel/time/alarmtimer.c
70297 @@ -779,7 +779,7 @@ static int __init alarmtimer_init(void)
70298 struct platform_device *pdev;
70299 int error = 0;
70300 int i;
70301 - struct k_clock alarm_clock = {
70302 + static struct k_clock alarm_clock = {
70303 .clock_getres = alarm_clock_getres,
70304 .clock_get = alarm_clock_get,
70305 .timer_create = alarm_timer_create,
70306 diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
70307 index f113755..ec24223 100644
70308 --- a/kernel/time/tick-broadcast.c
70309 +++ b/kernel/time/tick-broadcast.c
70310 @@ -115,7 +115,7 @@ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu)
70311 * then clear the broadcast bit.
70312 */
70313 if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
70314 - int cpu = smp_processor_id();
70315 + cpu = smp_processor_id();
70316
70317 cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
70318 tick_broadcast_clear_oneshot(cpu);
70319 diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
70320 index 3447cfa..291806b 100644
70321 --- a/kernel/time/timekeeping.c
70322 +++ b/kernel/time/timekeeping.c
70323 @@ -14,6 +14,7 @@
70324 #include <linux/init.h>
70325 #include <linux/mm.h>
70326 #include <linux/sched.h>
70327 +#include <linux/grsecurity.h>
70328 #include <linux/syscore_ops.h>
70329 #include <linux/clocksource.h>
70330 #include <linux/jiffies.h>
70331 @@ -387,6 +388,8 @@ int do_settimeofday(const struct timespec *tv)
70332 if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
70333 return -EINVAL;
70334
70335 + gr_log_timechange();
70336 +
70337 write_seqlock_irqsave(&timekeeper.lock, flags);
70338
70339 timekeeping_forward_now();
70340 diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
70341 index 3258455..f35227d 100644
70342 --- a/kernel/time/timer_list.c
70343 +++ b/kernel/time/timer_list.c
70344 @@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases);
70345
70346 static void print_name_offset(struct seq_file *m, void *sym)
70347 {
70348 +#ifdef CONFIG_GRKERNSEC_HIDESYM
70349 + SEQ_printf(m, "<%p>", NULL);
70350 +#else
70351 char symname[KSYM_NAME_LEN];
70352
70353 if (lookup_symbol_name((unsigned long)sym, symname) < 0)
70354 SEQ_printf(m, "<%pK>", sym);
70355 else
70356 SEQ_printf(m, "%s", symname);
70357 +#endif
70358 }
70359
70360 static void
70361 @@ -112,7 +116,11 @@ next_one:
70362 static void
70363 print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
70364 {
70365 +#ifdef CONFIG_GRKERNSEC_HIDESYM
70366 + SEQ_printf(m, " .base: %p\n", NULL);
70367 +#else
70368 SEQ_printf(m, " .base: %pK\n", base);
70369 +#endif
70370 SEQ_printf(m, " .index: %d\n",
70371 base->index);
70372 SEQ_printf(m, " .resolution: %Lu nsecs\n",
70373 @@ -293,7 +301,11 @@ static int __init init_timer_list_procfs(void)
70374 {
70375 struct proc_dir_entry *pe;
70376
70377 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
70378 + pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
70379 +#else
70380 pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
70381 +#endif
70382 if (!pe)
70383 return -ENOMEM;
70384 return 0;
70385 diff --git a/kernel/time/timer_stats.c b/kernel/time/timer_stats.c
70386 index 0b537f2..9e71eca 100644
70387 --- a/kernel/time/timer_stats.c
70388 +++ b/kernel/time/timer_stats.c
70389 @@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
70390 static unsigned long nr_entries;
70391 static struct entry entries[MAX_ENTRIES];
70392
70393 -static atomic_t overflow_count;
70394 +static atomic_unchecked_t overflow_count;
70395
70396 /*
70397 * The entries are in a hash-table, for fast lookup:
70398 @@ -140,7 +140,7 @@ static void reset_entries(void)
70399 nr_entries = 0;
70400 memset(entries, 0, sizeof(entries));
70401 memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
70402 - atomic_set(&overflow_count, 0);
70403 + atomic_set_unchecked(&overflow_count, 0);
70404 }
70405
70406 static struct entry *alloc_entry(void)
70407 @@ -261,7 +261,7 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
70408 if (likely(entry))
70409 entry->count++;
70410 else
70411 - atomic_inc(&overflow_count);
70412 + atomic_inc_unchecked(&overflow_count);
70413
70414 out_unlock:
70415 raw_spin_unlock_irqrestore(lock, flags);
70416 @@ -269,12 +269,16 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
70417
70418 static void print_name_offset(struct seq_file *m, unsigned long addr)
70419 {
70420 +#ifdef CONFIG_GRKERNSEC_HIDESYM
70421 + seq_printf(m, "<%p>", NULL);
70422 +#else
70423 char symname[KSYM_NAME_LEN];
70424
70425 if (lookup_symbol_name(addr, symname) < 0)
70426 seq_printf(m, "<%p>", (void *)addr);
70427 else
70428 seq_printf(m, "%s", symname);
70429 +#endif
70430 }
70431
70432 static int tstats_show(struct seq_file *m, void *v)
70433 @@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *m, void *v)
70434
70435 seq_puts(m, "Timer Stats Version: v0.2\n");
70436 seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
70437 - if (atomic_read(&overflow_count))
70438 + if (atomic_read_unchecked(&overflow_count))
70439 seq_printf(m, "Overflow: %d entries\n",
70440 - atomic_read(&overflow_count));
70441 + atomic_read_unchecked(&overflow_count));
70442
70443 for (i = 0; i < nr_entries; i++) {
70444 entry = entries + i;
70445 @@ -417,7 +421,11 @@ static int __init init_tstats_procfs(void)
70446 {
70447 struct proc_dir_entry *pe;
70448
70449 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
70450 + pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
70451 +#else
70452 pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
70453 +#endif
70454 if (!pe)
70455 return -ENOMEM;
70456 return 0;
70457 diff --git a/kernel/timer.c b/kernel/timer.c
70458 index 6ec7e7e..cbc448b 100644
70459 --- a/kernel/timer.c
70460 +++ b/kernel/timer.c
70461 @@ -1362,7 +1362,7 @@ void update_process_times(int user_tick)
70462 /*
70463 * This function runs timers and the timer-tq in bottom half context.
70464 */
70465 -static void run_timer_softirq(struct softirq_action *h)
70466 +static void run_timer_softirq(void)
70467 {
70468 struct tvec_base *base = __this_cpu_read(tvec_bases);
70469
70470 diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
70471 index c0bd030..62a1927 100644
70472 --- a/kernel/trace/blktrace.c
70473 +++ b/kernel/trace/blktrace.c
70474 @@ -317,7 +317,7 @@ static ssize_t blk_dropped_read(struct file *filp, char __user *buffer,
70475 struct blk_trace *bt = filp->private_data;
70476 char buf[16];
70477
70478 - snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
70479 + snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
70480
70481 return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
70482 }
70483 @@ -375,7 +375,7 @@ static int blk_subbuf_start_callback(struct rchan_buf *buf, void *subbuf,
70484 return 1;
70485
70486 bt = buf->chan->private_data;
70487 - atomic_inc(&bt->dropped);
70488 + atomic_inc_unchecked(&bt->dropped);
70489 return 0;
70490 }
70491
70492 @@ -476,7 +476,7 @@ int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
70493
70494 bt->dir = dir;
70495 bt->dev = dev;
70496 - atomic_set(&bt->dropped, 0);
70497 + atomic_set_unchecked(&bt->dropped, 0);
70498
70499 ret = -EIO;
70500 bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
70501 diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
70502 index a008663..30d7429 100644
70503 --- a/kernel/trace/ftrace.c
70504 +++ b/kernel/trace/ftrace.c
70505 @@ -1785,12 +1785,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
70506 if (unlikely(ftrace_disabled))
70507 return 0;
70508
70509 + ret = ftrace_arch_code_modify_prepare();
70510 + FTRACE_WARN_ON(ret);
70511 + if (ret)
70512 + return 0;
70513 +
70514 ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
70515 + FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
70516 if (ret) {
70517 ftrace_bug(ret, ip);
70518 - return 0;
70519 }
70520 - return 1;
70521 + return ret ? 0 : 1;
70522 }
70523
70524 /*
70525 @@ -2885,7 +2890,7 @@ static void ftrace_free_entry_rcu(struct rcu_head *rhp)
70526
70527 int
70528 register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
70529 - void *data)
70530 + void *data)
70531 {
70532 struct ftrace_func_probe *entry;
70533 struct ftrace_page *pg;
70534 @@ -3697,8 +3702,10 @@ static int ftrace_process_locs(struct module *mod,
70535 if (!count)
70536 return 0;
70537
70538 + pax_open_kernel();
70539 sort(start, count, sizeof(*start),
70540 ftrace_cmp_ips, ftrace_swap_ips);
70541 + pax_close_kernel();
70542
70543 start_pg = ftrace_allocate_pages(count);
70544 if (!start_pg)
70545 diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
70546 index a7fa070..403bc8d 100644
70547 --- a/kernel/trace/trace.c
70548 +++ b/kernel/trace/trace.c
70549 @@ -4421,10 +4421,9 @@ static const struct file_operations tracing_dyn_info_fops = {
70550 };
70551 #endif
70552
70553 -static struct dentry *d_tracer;
70554 -
70555 struct dentry *tracing_init_dentry(void)
70556 {
70557 + static struct dentry *d_tracer;
70558 static int once;
70559
70560 if (d_tracer)
70561 @@ -4444,10 +4443,9 @@ struct dentry *tracing_init_dentry(void)
70562 return d_tracer;
70563 }
70564
70565 -static struct dentry *d_percpu;
70566 -
70567 struct dentry *tracing_dentry_percpu(void)
70568 {
70569 + static struct dentry *d_percpu;
70570 static int once;
70571 struct dentry *d_tracer;
70572
70573 diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
70574 index 29111da..d190fe2 100644
70575 --- a/kernel/trace/trace_events.c
70576 +++ b/kernel/trace/trace_events.c
70577 @@ -1308,10 +1308,6 @@ static LIST_HEAD(ftrace_module_file_list);
70578 struct ftrace_module_file_ops {
70579 struct list_head list;
70580 struct module *mod;
70581 - struct file_operations id;
70582 - struct file_operations enable;
70583 - struct file_operations format;
70584 - struct file_operations filter;
70585 };
70586
70587 static struct ftrace_module_file_ops *
70588 @@ -1332,17 +1328,12 @@ trace_create_file_ops(struct module *mod)
70589
70590 file_ops->mod = mod;
70591
70592 - file_ops->id = ftrace_event_id_fops;
70593 - file_ops->id.owner = mod;
70594 -
70595 - file_ops->enable = ftrace_enable_fops;
70596 - file_ops->enable.owner = mod;
70597 -
70598 - file_ops->filter = ftrace_event_filter_fops;
70599 - file_ops->filter.owner = mod;
70600 -
70601 - file_ops->format = ftrace_event_format_fops;
70602 - file_ops->format.owner = mod;
70603 + pax_open_kernel();
70604 + *(void **)&mod->trace_id.owner = mod;
70605 + *(void **)&mod->trace_enable.owner = mod;
70606 + *(void **)&mod->trace_filter.owner = mod;
70607 + *(void **)&mod->trace_format.owner = mod;
70608 + pax_close_kernel();
70609
70610 list_add(&file_ops->list, &ftrace_module_file_list);
70611
70612 @@ -1366,8 +1357,8 @@ static void trace_module_add_events(struct module *mod)
70613
70614 for_each_event(call, start, end) {
70615 __trace_add_event_call(*call, mod,
70616 - &file_ops->id, &file_ops->enable,
70617 - &file_ops->filter, &file_ops->format);
70618 + &mod->trace_id, &mod->trace_enable,
70619 + &mod->trace_filter, &mod->trace_format);
70620 }
70621 }
70622
70623 diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c
70624 index fd3c8aa..5f324a6 100644
70625 --- a/kernel/trace/trace_mmiotrace.c
70626 +++ b/kernel/trace/trace_mmiotrace.c
70627 @@ -24,7 +24,7 @@ struct header_iter {
70628 static struct trace_array *mmio_trace_array;
70629 static bool overrun_detected;
70630 static unsigned long prev_overruns;
70631 -static atomic_t dropped_count;
70632 +static atomic_unchecked_t dropped_count;
70633
70634 static void mmio_reset_data(struct trace_array *tr)
70635 {
70636 @@ -127,7 +127,7 @@ static void mmio_close(struct trace_iterator *iter)
70637
70638 static unsigned long count_overruns(struct trace_iterator *iter)
70639 {
70640 - unsigned long cnt = atomic_xchg(&dropped_count, 0);
70641 + unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
70642 unsigned long over = ring_buffer_overruns(iter->tr->buffer);
70643
70644 if (over > prev_overruns)
70645 @@ -317,7 +317,7 @@ static void __trace_mmiotrace_rw(struct trace_array *tr,
70646 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
70647 sizeof(*entry), 0, pc);
70648 if (!event) {
70649 - atomic_inc(&dropped_count);
70650 + atomic_inc_unchecked(&dropped_count);
70651 return;
70652 }
70653 entry = ring_buffer_event_data(event);
70654 @@ -347,7 +347,7 @@ static void __trace_mmiotrace_map(struct trace_array *tr,
70655 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
70656 sizeof(*entry), 0, pc);
70657 if (!event) {
70658 - atomic_inc(&dropped_count);
70659 + atomic_inc_unchecked(&dropped_count);
70660 return;
70661 }
70662 entry = ring_buffer_event_data(event);
70663 diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
70664 index df611a0..10d8b32 100644
70665 --- a/kernel/trace/trace_output.c
70666 +++ b/kernel/trace/trace_output.c
70667 @@ -278,7 +278,7 @@ int trace_seq_path(struct trace_seq *s, const struct path *path)
70668
70669 p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
70670 if (!IS_ERR(p)) {
70671 - p = mangle_path(s->buffer + s->len, p, "\n");
70672 + p = mangle_path(s->buffer + s->len, p, "\n\\");
70673 if (p) {
70674 s->len = p - s->buffer;
70675 return 1;
70676 diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
70677 index d4545f4..a9010a1 100644
70678 --- a/kernel/trace/trace_stack.c
70679 +++ b/kernel/trace/trace_stack.c
70680 @@ -53,7 +53,7 @@ static inline void check_stack(void)
70681 return;
70682
70683 /* we do not handle interrupt stacks yet */
70684 - if (!object_is_on_stack(&this_size))
70685 + if (!object_starts_on_stack(&this_size))
70686 return;
70687
70688 local_irq_save(flags);
70689 diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
70690 index ff5bdee..3eaeba6 100644
70691 --- a/lib/Kconfig.debug
70692 +++ b/lib/Kconfig.debug
70693 @@ -1165,6 +1165,7 @@ config LATENCYTOP
70694 depends on DEBUG_KERNEL
70695 depends on STACKTRACE_SUPPORT
70696 depends on PROC_FS
70697 + depends on !GRKERNSEC_HIDESYM
70698 select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE && !ARM_UNWIND
70699 select KALLSYMS
70700 select KALLSYMS_ALL
70701 diff --git a/lib/bitmap.c b/lib/bitmap.c
70702 index 06fdfa1..97c5c7d 100644
70703 --- a/lib/bitmap.c
70704 +++ b/lib/bitmap.c
70705 @@ -422,7 +422,7 @@ int __bitmap_parse(const char *buf, unsigned int buflen,
70706 {
70707 int c, old_c, totaldigits, ndigits, nchunks, nbits;
70708 u32 chunk;
70709 - const char __user __force *ubuf = (const char __user __force *)buf;
70710 + const char __user *ubuf = (const char __force_user *)buf;
70711
70712 bitmap_zero(maskp, nmaskbits);
70713
70714 @@ -507,7 +507,7 @@ int bitmap_parse_user(const char __user *ubuf,
70715 {
70716 if (!access_ok(VERIFY_READ, ubuf, ulen))
70717 return -EFAULT;
70718 - return __bitmap_parse((const char __force *)ubuf,
70719 + return __bitmap_parse((const char __force_kernel *)ubuf,
70720 ulen, 1, maskp, nmaskbits);
70721
70722 }
70723 @@ -598,7 +598,7 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
70724 {
70725 unsigned a, b;
70726 int c, old_c, totaldigits;
70727 - const char __user __force *ubuf = (const char __user __force *)buf;
70728 + const char __user *ubuf = (const char __force_user *)buf;
70729 int exp_digit, in_range;
70730
70731 totaldigits = c = 0;
70732 @@ -698,7 +698,7 @@ int bitmap_parselist_user(const char __user *ubuf,
70733 {
70734 if (!access_ok(VERIFY_READ, ubuf, ulen))
70735 return -EFAULT;
70736 - return __bitmap_parselist((const char __force *)ubuf,
70737 + return __bitmap_parselist((const char __force_kernel *)ubuf,
70738 ulen, 1, maskp, nmaskbits);
70739 }
70740 EXPORT_SYMBOL(bitmap_parselist_user);
70741 diff --git a/lib/bug.c b/lib/bug.c
70742 index a28c141..2bd3d95 100644
70743 --- a/lib/bug.c
70744 +++ b/lib/bug.c
70745 @@ -133,6 +133,8 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
70746 return BUG_TRAP_TYPE_NONE;
70747
70748 bug = find_bug(bugaddr);
70749 + if (!bug)
70750 + return BUG_TRAP_TYPE_NONE;
70751
70752 file = NULL;
70753 line = 0;
70754 diff --git a/lib/debugobjects.c b/lib/debugobjects.c
70755 index d11808c..dc2d6f8 100644
70756 --- a/lib/debugobjects.c
70757 +++ b/lib/debugobjects.c
70758 @@ -287,7 +287,7 @@ static void debug_object_is_on_stack(void *addr, int onstack)
70759 if (limit > 4)
70760 return;
70761
70762 - is_on_stack = object_is_on_stack(addr);
70763 + is_on_stack = object_starts_on_stack(addr);
70764 if (is_on_stack == onstack)
70765 return;
70766
70767 diff --git a/lib/devres.c b/lib/devres.c
70768 index 80b9c76..9e32279 100644
70769 --- a/lib/devres.c
70770 +++ b/lib/devres.c
70771 @@ -80,7 +80,7 @@ EXPORT_SYMBOL(devm_ioremap_nocache);
70772 void devm_iounmap(struct device *dev, void __iomem *addr)
70773 {
70774 WARN_ON(devres_destroy(dev, devm_ioremap_release, devm_ioremap_match,
70775 - (void *)addr));
70776 + (void __force *)addr));
70777 iounmap(addr);
70778 }
70779 EXPORT_SYMBOL(devm_iounmap);
70780 @@ -192,7 +192,7 @@ void devm_ioport_unmap(struct device *dev, void __iomem *addr)
70781 {
70782 ioport_unmap(addr);
70783 WARN_ON(devres_destroy(dev, devm_ioport_map_release,
70784 - devm_ioport_map_match, (void *)addr));
70785 + devm_ioport_map_match, (void __force *)addr));
70786 }
70787 EXPORT_SYMBOL(devm_ioport_unmap);
70788
70789 diff --git a/lib/dma-debug.c b/lib/dma-debug.c
70790 index 66ce414..6f0a0dd 100644
70791 --- a/lib/dma-debug.c
70792 +++ b/lib/dma-debug.c
70793 @@ -924,7 +924,7 @@ out:
70794
70795 static void check_for_stack(struct device *dev, void *addr)
70796 {
70797 - if (object_is_on_stack(addr))
70798 + if (object_starts_on_stack(addr))
70799 err_printk(dev, NULL, "DMA-API: device driver maps memory from"
70800 "stack [addr=%p]\n", addr);
70801 }
70802 diff --git a/lib/inflate.c b/lib/inflate.c
70803 index 013a761..c28f3fc 100644
70804 --- a/lib/inflate.c
70805 +++ b/lib/inflate.c
70806 @@ -269,7 +269,7 @@ static void free(void *where)
70807 malloc_ptr = free_mem_ptr;
70808 }
70809 #else
70810 -#define malloc(a) kmalloc(a, GFP_KERNEL)
70811 +#define malloc(a) kmalloc((a), GFP_KERNEL)
70812 #define free(a) kfree(a)
70813 #endif
70814
70815 diff --git a/lib/ioremap.c b/lib/ioremap.c
70816 index 0c9216c..863bd89 100644
70817 --- a/lib/ioremap.c
70818 +++ b/lib/ioremap.c
70819 @@ -38,7 +38,7 @@ static inline int ioremap_pmd_range(pud_t *pud, unsigned long addr,
70820 unsigned long next;
70821
70822 phys_addr -= addr;
70823 - pmd = pmd_alloc(&init_mm, pud, addr);
70824 + pmd = pmd_alloc_kernel(&init_mm, pud, addr);
70825 if (!pmd)
70826 return -ENOMEM;
70827 do {
70828 @@ -56,7 +56,7 @@ static inline int ioremap_pud_range(pgd_t *pgd, unsigned long addr,
70829 unsigned long next;
70830
70831 phys_addr -= addr;
70832 - pud = pud_alloc(&init_mm, pgd, addr);
70833 + pud = pud_alloc_kernel(&init_mm, pgd, addr);
70834 if (!pud)
70835 return -ENOMEM;
70836 do {
70837 diff --git a/lib/is_single_threaded.c b/lib/is_single_threaded.c
70838 index bd2bea9..6b3c95e 100644
70839 --- a/lib/is_single_threaded.c
70840 +++ b/lib/is_single_threaded.c
70841 @@ -22,6 +22,9 @@ bool current_is_single_threaded(void)
70842 struct task_struct *p, *t;
70843 bool ret;
70844
70845 + if (!mm)
70846 + return true;
70847 +
70848 if (atomic_read(&task->signal->live) != 1)
70849 return false;
70850
70851 diff --git a/lib/radix-tree.c b/lib/radix-tree.c
70852 index e796429..6e38f9f 100644
70853 --- a/lib/radix-tree.c
70854 +++ b/lib/radix-tree.c
70855 @@ -92,7 +92,7 @@ struct radix_tree_preload {
70856 int nr;
70857 struct radix_tree_node *nodes[RADIX_TREE_PRELOAD_SIZE];
70858 };
70859 -static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
70860 +static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
70861
70862 static inline void *ptr_to_indirect(void *ptr)
70863 {
70864 diff --git a/lib/vsprintf.c b/lib/vsprintf.c
70865 index 598a73e..5c5aeb5 100644
70866 --- a/lib/vsprintf.c
70867 +++ b/lib/vsprintf.c
70868 @@ -16,6 +16,9 @@
70869 * - scnprintf and vscnprintf
70870 */
70871
70872 +#ifdef CONFIG_GRKERNSEC_HIDESYM
70873 +#define __INCLUDED_BY_HIDESYM 1
70874 +#endif
70875 #include <stdarg.h>
70876 #include <linux/module.h> /* for KSYM_SYMBOL_LEN */
70877 #include <linux/types.h>
70878 @@ -536,7 +539,7 @@ char *symbol_string(char *buf, char *end, void *ptr,
70879 char sym[KSYM_SYMBOL_LEN];
70880 if (ext == 'B')
70881 sprint_backtrace(sym, value);
70882 - else if (ext != 'f' && ext != 's')
70883 + else if (ext != 'f' && ext != 's' && ext != 'a')
70884 sprint_symbol(sym, value);
70885 else
70886 sprint_symbol_no_offset(sym, value);
70887 @@ -912,7 +915,11 @@ char *netdev_feature_string(char *buf, char *end, const u8 *addr,
70888 return number(buf, end, *(const netdev_features_t *)addr, spec);
70889 }
70890
70891 +#ifdef CONFIG_GRKERNSEC_HIDESYM
70892 +int kptr_restrict __read_mostly = 2;
70893 +#else
70894 int kptr_restrict __read_mostly;
70895 +#endif
70896
70897 /*
70898 * Show a '%p' thing. A kernel extension is that the '%p' is followed
70899 @@ -926,6 +933,8 @@ int kptr_restrict __read_mostly;
70900 * - 'S' For symbolic direct pointers with offset
70901 * - 's' For symbolic direct pointers without offset
70902 * - 'B' For backtraced symbolic direct pointers with offset
70903 + * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
70904 + * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
70905 * - 'R' For decoded struct resource, e.g., [mem 0x0-0x1f 64bit pref]
70906 * - 'r' For raw struct resource, e.g., [mem 0x0-0x1f flags 0x201]
70907 * - 'M' For a 6-byte MAC address, it prints the address in the
70908 @@ -973,12 +982,12 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
70909
70910 if (!ptr && *fmt != 'K') {
70911 /*
70912 - * Print (null) with the same width as a pointer so it makes
70913 + * Print (nil) with the same width as a pointer so it makes
70914 * tabular output look nice.
70915 */
70916 if (spec.field_width == -1)
70917 spec.field_width = default_width;
70918 - return string(buf, end, "(null)", spec);
70919 + return string(buf, end, "(nil)", spec);
70920 }
70921
70922 switch (*fmt) {
70923 @@ -988,6 +997,13 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
70924 /* Fallthrough */
70925 case 'S':
70926 case 's':
70927 +#ifdef CONFIG_GRKERNSEC_HIDESYM
70928 + break;
70929 +#else
70930 + return symbol_string(buf, end, ptr, spec, *fmt);
70931 +#endif
70932 + case 'A':
70933 + case 'a':
70934 case 'B':
70935 return symbol_string(buf, end, ptr, spec, *fmt);
70936 case 'R':
70937 @@ -1025,6 +1041,8 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
70938 va_end(va);
70939 return buf;
70940 }
70941 + case 'P':
70942 + break;
70943 case 'K':
70944 /*
70945 * %pK cannot be used in IRQ context because its test
70946 @@ -1048,6 +1066,21 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
70947 }
70948 break;
70949 }
70950 +
70951 +#ifdef CONFIG_GRKERNSEC_HIDESYM
70952 + /* 'P' = approved pointers to copy to userland,
70953 + as in the /proc/kallsyms case, as we make it display nothing
70954 + for non-root users, and the real contents for root users
70955 + Also ignore 'K' pointers, since we force their NULLing for non-root users
70956 + above
70957 + */
70958 + if (ptr > TASK_SIZE && *fmt != 'P' && *fmt != 'K' && is_usercopy_object(buf)) {
70959 + printk(KERN_ALERT "grsec: kernel infoleak detected! Please report this log to spender@grsecurity.net.\n");
70960 + dump_stack();
70961 + ptr = NULL;
70962 + }
70963 +#endif
70964 +
70965 spec.flags |= SMALL;
70966 if (spec.field_width == -1) {
70967 spec.field_width = default_width;
70968 @@ -1759,11 +1792,11 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
70969 typeof(type) value; \
70970 if (sizeof(type) == 8) { \
70971 args = PTR_ALIGN(args, sizeof(u32)); \
70972 - *(u32 *)&value = *(u32 *)args; \
70973 - *((u32 *)&value + 1) = *(u32 *)(args + 4); \
70974 + *(u32 *)&value = *(const u32 *)args; \
70975 + *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
70976 } else { \
70977 args = PTR_ALIGN(args, sizeof(type)); \
70978 - value = *(typeof(type) *)args; \
70979 + value = *(const typeof(type) *)args; \
70980 } \
70981 args += sizeof(type); \
70982 value; \
70983 @@ -1826,7 +1859,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
70984 case FORMAT_TYPE_STR: {
70985 const char *str_arg = args;
70986 args += strlen(str_arg) + 1;
70987 - str = string(str, end, (char *)str_arg, spec);
70988 + str = string(str, end, str_arg, spec);
70989 break;
70990 }
70991
70992 diff --git a/localversion-grsec b/localversion-grsec
70993 new file mode 100644
70994 index 0000000..7cd6065
70995 --- /dev/null
70996 +++ b/localversion-grsec
70997 @@ -0,0 +1 @@
70998 +-grsec
70999 diff --git a/mm/Kconfig b/mm/Kconfig
71000 index 82fed4e..979e814 100644
71001 --- a/mm/Kconfig
71002 +++ b/mm/Kconfig
71003 @@ -247,10 +247,10 @@ config KSM
71004 root has set /sys/kernel/mm/ksm/run to 1 (if CONFIG_SYSFS is set).
71005
71006 config DEFAULT_MMAP_MIN_ADDR
71007 - int "Low address space to protect from user allocation"
71008 + int "Low address space to protect from user allocation"
71009 depends on MMU
71010 - default 4096
71011 - help
71012 + default 65536
71013 + help
71014 This is the portion of low virtual memory which should be protected
71015 from userspace allocation. Keeping a user from writing to low pages
71016 can help reduce the impact of kernel NULL pointer bugs.
71017 @@ -280,7 +280,7 @@ config MEMORY_FAILURE
71018
71019 config HWPOISON_INJECT
71020 tristate "HWPoison pages injector"
71021 - depends on MEMORY_FAILURE && DEBUG_KERNEL && PROC_FS
71022 + depends on MEMORY_FAILURE && DEBUG_KERNEL && PROC_FS && !GRKERNSEC
71023 select PROC_PAGE_MONITOR
71024
71025 config NOMMU_INITIAL_TRIM_EXCESS
71026 diff --git a/mm/filemap.c b/mm/filemap.c
71027 index a4a5260..6151dc5 100644
71028 --- a/mm/filemap.c
71029 +++ b/mm/filemap.c
71030 @@ -1723,7 +1723,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
71031 struct address_space *mapping = file->f_mapping;
71032
71033 if (!mapping->a_ops->readpage)
71034 - return -ENOEXEC;
71035 + return -ENODEV;
71036 file_accessed(file);
71037 vma->vm_ops = &generic_file_vm_ops;
71038 vma->vm_flags |= VM_CAN_NONLINEAR;
71039 @@ -2064,6 +2064,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i
71040 *pos = i_size_read(inode);
71041
71042 if (limit != RLIM_INFINITY) {
71043 + gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
71044 if (*pos >= limit) {
71045 send_sig(SIGXFSZ, current, 0);
71046 return -EFBIG;
71047 diff --git a/mm/fremap.c b/mm/fremap.c
71048 index 9ed4fd4..c42648d 100644
71049 --- a/mm/fremap.c
71050 +++ b/mm/fremap.c
71051 @@ -155,6 +155,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
71052 retry:
71053 vma = find_vma(mm, start);
71054
71055 +#ifdef CONFIG_PAX_SEGMEXEC
71056 + if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
71057 + goto out;
71058 +#endif
71059 +
71060 /*
71061 * Make sure the vma is shared, that it supports prefaulting,
71062 * and that the remapped range is valid and fully within
71063 diff --git a/mm/highmem.c b/mm/highmem.c
71064 index 57d82c6..e9e0552 100644
71065 --- a/mm/highmem.c
71066 +++ b/mm/highmem.c
71067 @@ -125,9 +125,10 @@ static void flush_all_zero_pkmaps(void)
71068 * So no dangers, even with speculative execution.
71069 */
71070 page = pte_page(pkmap_page_table[i]);
71071 + pax_open_kernel();
71072 pte_clear(&init_mm, (unsigned long)page_address(page),
71073 &pkmap_page_table[i]);
71074 -
71075 + pax_close_kernel();
71076 set_page_address(page, NULL);
71077 need_flush = 1;
71078 }
71079 @@ -186,9 +187,11 @@ start:
71080 }
71081 }
71082 vaddr = PKMAP_ADDR(last_pkmap_nr);
71083 +
71084 + pax_open_kernel();
71085 set_pte_at(&init_mm, vaddr,
71086 &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
71087 -
71088 + pax_close_kernel();
71089 pkmap_count[last_pkmap_nr] = 1;
71090 set_page_address(page, (void *)vaddr);
71091
71092 diff --git a/mm/huge_memory.c b/mm/huge_memory.c
71093 index 57c4b93..24b8f59 100644
71094 --- a/mm/huge_memory.c
71095 +++ b/mm/huge_memory.c
71096 @@ -735,7 +735,7 @@ out:
71097 * run pte_offset_map on the pmd, if an huge pmd could
71098 * materialize from under us from a different thread.
71099 */
71100 - if (unlikely(__pte_alloc(mm, vma, pmd, address)))
71101 + if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
71102 return VM_FAULT_OOM;
71103 /* if an huge pmd materialized from under us just retry later */
71104 if (unlikely(pmd_trans_huge(*pmd)))
71105 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
71106 index 19558df..f7743b3 100644
71107 --- a/mm/hugetlb.c
71108 +++ b/mm/hugetlb.c
71109 @@ -2463,6 +2463,27 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
71110 return 1;
71111 }
71112
71113 +#ifdef CONFIG_PAX_SEGMEXEC
71114 +static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
71115 +{
71116 + struct mm_struct *mm = vma->vm_mm;
71117 + struct vm_area_struct *vma_m;
71118 + unsigned long address_m;
71119 + pte_t *ptep_m;
71120 +
71121 + vma_m = pax_find_mirror_vma(vma);
71122 + if (!vma_m)
71123 + return;
71124 +
71125 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71126 + address_m = address + SEGMEXEC_TASK_SIZE;
71127 + ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
71128 + get_page(page_m);
71129 + hugepage_add_anon_rmap(page_m, vma_m, address_m);
71130 + set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
71131 +}
71132 +#endif
71133 +
71134 /*
71135 * Hugetlb_cow() should be called with page lock of the original hugepage held.
71136 * Called with hugetlb_instantiation_mutex held and pte_page locked so we
71137 @@ -2575,6 +2596,11 @@ retry_avoidcopy:
71138 make_huge_pte(vma, new_page, 1));
71139 page_remove_rmap(old_page);
71140 hugepage_add_new_anon_rmap(new_page, vma, address);
71141 +
71142 +#ifdef CONFIG_PAX_SEGMEXEC
71143 + pax_mirror_huge_pte(vma, address, new_page);
71144 +#endif
71145 +
71146 /* Make the old page be freed below */
71147 new_page = old_page;
71148 mmu_notifier_invalidate_range_end(mm,
71149 @@ -2729,6 +2755,10 @@ retry:
71150 && (vma->vm_flags & VM_SHARED)));
71151 set_huge_pte_at(mm, address, ptep, new_pte);
71152
71153 +#ifdef CONFIG_PAX_SEGMEXEC
71154 + pax_mirror_huge_pte(vma, address, page);
71155 +#endif
71156 +
71157 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
71158 /* Optimization, do the COW without a second fault */
71159 ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
71160 @@ -2758,6 +2788,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
71161 static DEFINE_MUTEX(hugetlb_instantiation_mutex);
71162 struct hstate *h = hstate_vma(vma);
71163
71164 +#ifdef CONFIG_PAX_SEGMEXEC
71165 + struct vm_area_struct *vma_m;
71166 +#endif
71167 +
71168 address &= huge_page_mask(h);
71169
71170 ptep = huge_pte_offset(mm, address);
71171 @@ -2771,6 +2805,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
71172 VM_FAULT_SET_HINDEX(h - hstates);
71173 }
71174
71175 +#ifdef CONFIG_PAX_SEGMEXEC
71176 + vma_m = pax_find_mirror_vma(vma);
71177 + if (vma_m) {
71178 + unsigned long address_m;
71179 +
71180 + if (vma->vm_start > vma_m->vm_start) {
71181 + address_m = address;
71182 + address -= SEGMEXEC_TASK_SIZE;
71183 + vma = vma_m;
71184 + h = hstate_vma(vma);
71185 + } else
71186 + address_m = address + SEGMEXEC_TASK_SIZE;
71187 +
71188 + if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
71189 + return VM_FAULT_OOM;
71190 + address_m &= HPAGE_MASK;
71191 + unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
71192 + }
71193 +#endif
71194 +
71195 ptep = huge_pte_alloc(mm, address, huge_page_size(h));
71196 if (!ptep)
71197 return VM_FAULT_OOM;
71198 diff --git a/mm/internal.h b/mm/internal.h
71199 index 8052379..47029d1 100644
71200 --- a/mm/internal.h
71201 +++ b/mm/internal.h
71202 @@ -95,6 +95,7 @@ extern void putback_lru_page(struct page *page);
71203 * in mm/page_alloc.c
71204 */
71205 extern void __free_pages_bootmem(struct page *page, unsigned int order);
71206 +extern void free_compound_page(struct page *page);
71207 extern void prep_compound_page(struct page *page, unsigned long order);
71208 #ifdef CONFIG_MEMORY_FAILURE
71209 extern bool is_free_buddy_page(struct page *page);
71210 diff --git a/mm/kmemleak.c b/mm/kmemleak.c
71211 index 45eb621..6ccd8ea 100644
71212 --- a/mm/kmemleak.c
71213 +++ b/mm/kmemleak.c
71214 @@ -363,7 +363,7 @@ static void print_unreferenced(struct seq_file *seq,
71215
71216 for (i = 0; i < object->trace_len; i++) {
71217 void *ptr = (void *)object->trace[i];
71218 - seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
71219 + seq_printf(seq, " [<%p>] %pA\n", ptr, ptr);
71220 }
71221 }
71222
71223 diff --git a/mm/maccess.c b/mm/maccess.c
71224 index d53adf9..03a24bf 100644
71225 --- a/mm/maccess.c
71226 +++ b/mm/maccess.c
71227 @@ -26,7 +26,7 @@ long __probe_kernel_read(void *dst, const void *src, size_t size)
71228 set_fs(KERNEL_DS);
71229 pagefault_disable();
71230 ret = __copy_from_user_inatomic(dst,
71231 - (__force const void __user *)src, size);
71232 + (const void __force_user *)src, size);
71233 pagefault_enable();
71234 set_fs(old_fs);
71235
71236 @@ -53,7 +53,7 @@ long __probe_kernel_write(void *dst, const void *src, size_t size)
71237
71238 set_fs(KERNEL_DS);
71239 pagefault_disable();
71240 - ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
71241 + ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
71242 pagefault_enable();
71243 set_fs(old_fs);
71244
71245 diff --git a/mm/madvise.c b/mm/madvise.c
71246 index 14d260f..b2a80fd 100644
71247 --- a/mm/madvise.c
71248 +++ b/mm/madvise.c
71249 @@ -48,6 +48,10 @@ static long madvise_behavior(struct vm_area_struct * vma,
71250 pgoff_t pgoff;
71251 unsigned long new_flags = vma->vm_flags;
71252
71253 +#ifdef CONFIG_PAX_SEGMEXEC
71254 + struct vm_area_struct *vma_m;
71255 +#endif
71256 +
71257 switch (behavior) {
71258 case MADV_NORMAL:
71259 new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
71260 @@ -119,6 +123,13 @@ success:
71261 /*
71262 * vm_flags is protected by the mmap_sem held in write mode.
71263 */
71264 +
71265 +#ifdef CONFIG_PAX_SEGMEXEC
71266 + vma_m = pax_find_mirror_vma(vma);
71267 + if (vma_m)
71268 + vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
71269 +#endif
71270 +
71271 vma->vm_flags = new_flags;
71272
71273 out:
71274 @@ -177,6 +188,11 @@ static long madvise_dontneed(struct vm_area_struct * vma,
71275 struct vm_area_struct ** prev,
71276 unsigned long start, unsigned long end)
71277 {
71278 +
71279 +#ifdef CONFIG_PAX_SEGMEXEC
71280 + struct vm_area_struct *vma_m;
71281 +#endif
71282 +
71283 *prev = vma;
71284 if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
71285 return -EINVAL;
71286 @@ -189,6 +205,21 @@ static long madvise_dontneed(struct vm_area_struct * vma,
71287 zap_page_range(vma, start, end - start, &details);
71288 } else
71289 zap_page_range(vma, start, end - start, NULL);
71290 +
71291 +#ifdef CONFIG_PAX_SEGMEXEC
71292 + vma_m = pax_find_mirror_vma(vma);
71293 + if (vma_m) {
71294 + if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
71295 + struct zap_details details = {
71296 + .nonlinear_vma = vma_m,
71297 + .last_index = ULONG_MAX,
71298 + };
71299 + zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
71300 + } else
71301 + zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
71302 + }
71303 +#endif
71304 +
71305 return 0;
71306 }
71307
71308 @@ -393,6 +424,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
71309 if (end < start)
71310 goto out;
71311
71312 +#ifdef CONFIG_PAX_SEGMEXEC
71313 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
71314 + if (end > SEGMEXEC_TASK_SIZE)
71315 + goto out;
71316 + } else
71317 +#endif
71318 +
71319 + if (end > TASK_SIZE)
71320 + goto out;
71321 +
71322 error = 0;
71323 if (end == start)
71324 goto out;
71325 diff --git a/mm/memory-failure.c b/mm/memory-failure.c
71326 index 6de0d61..da836cf 100644
71327 --- a/mm/memory-failure.c
71328 +++ b/mm/memory-failure.c
71329 @@ -61,7 +61,7 @@ int sysctl_memory_failure_early_kill __read_mostly = 0;
71330
71331 int sysctl_memory_failure_recovery __read_mostly = 1;
71332
71333 -atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
71334 +atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
71335
71336 #if defined(CONFIG_HWPOISON_INJECT) || defined(CONFIG_HWPOISON_INJECT_MODULE)
71337
71338 @@ -202,7 +202,7 @@ static int kill_proc(struct task_struct *t, unsigned long addr, int trapno,
71339 pfn, t->comm, t->pid);
71340 si.si_signo = SIGBUS;
71341 si.si_errno = 0;
71342 - si.si_addr = (void *)addr;
71343 + si.si_addr = (void __user *)addr;
71344 #ifdef __ARCH_SI_TRAPNO
71345 si.si_trapno = trapno;
71346 #endif
71347 @@ -1038,7 +1038,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
71348 }
71349
71350 nr_pages = 1 << compound_trans_order(hpage);
71351 - atomic_long_add(nr_pages, &mce_bad_pages);
71352 + atomic_long_add_unchecked(nr_pages, &mce_bad_pages);
71353
71354 /*
71355 * We need/can do nothing about count=0 pages.
71356 @@ -1068,7 +1068,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
71357 if (!PageHWPoison(hpage)
71358 || (hwpoison_filter(p) && TestClearPageHWPoison(p))
71359 || (p != hpage && TestSetPageHWPoison(hpage))) {
71360 - atomic_long_sub(nr_pages, &mce_bad_pages);
71361 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
71362 return 0;
71363 }
71364 set_page_hwpoison_huge_page(hpage);
71365 @@ -1126,7 +1126,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
71366 }
71367 if (hwpoison_filter(p)) {
71368 if (TestClearPageHWPoison(p))
71369 - atomic_long_sub(nr_pages, &mce_bad_pages);
71370 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
71371 unlock_page(hpage);
71372 put_page(hpage);
71373 return 0;
71374 @@ -1321,7 +1321,7 @@ int unpoison_memory(unsigned long pfn)
71375 return 0;
71376 }
71377 if (TestClearPageHWPoison(p))
71378 - atomic_long_sub(nr_pages, &mce_bad_pages);
71379 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
71380 pr_info("MCE: Software-unpoisoned free page %#lx\n", pfn);
71381 return 0;
71382 }
71383 @@ -1335,7 +1335,7 @@ int unpoison_memory(unsigned long pfn)
71384 */
71385 if (TestClearPageHWPoison(page)) {
71386 pr_info("MCE: Software-unpoisoned page %#lx\n", pfn);
71387 - atomic_long_sub(nr_pages, &mce_bad_pages);
71388 + atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
71389 freeit = 1;
71390 if (PageHuge(page))
71391 clear_page_hwpoison_huge_page(page);
71392 @@ -1448,7 +1448,7 @@ static int soft_offline_huge_page(struct page *page, int flags)
71393 }
71394 done:
71395 if (!PageHWPoison(hpage))
71396 - atomic_long_add(1 << compound_trans_order(hpage), &mce_bad_pages);
71397 + atomic_long_add_unchecked(1 << compound_trans_order(hpage), &mce_bad_pages);
71398 set_page_hwpoison_huge_page(hpage);
71399 dequeue_hwpoisoned_huge_page(hpage);
71400 /* keep elevated page count for bad page */
71401 @@ -1579,7 +1579,7 @@ int soft_offline_page(struct page *page, int flags)
71402 return ret;
71403
71404 done:
71405 - atomic_long_add(1, &mce_bad_pages);
71406 + atomic_long_add_unchecked(1, &mce_bad_pages);
71407 SetPageHWPoison(page);
71408 /* keep elevated page count for bad page */
71409 return ret;
71410 diff --git a/mm/memory.c b/mm/memory.c
71411 index 2466d12..08be4f6 100644
71412 --- a/mm/memory.c
71413 +++ b/mm/memory.c
71414 @@ -434,8 +434,12 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
71415 return;
71416
71417 pmd = pmd_offset(pud, start);
71418 +
71419 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
71420 pud_clear(pud);
71421 pmd_free_tlb(tlb, pmd, start);
71422 +#endif
71423 +
71424 }
71425
71426 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
71427 @@ -466,9 +470,12 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
71428 if (end - 1 > ceiling - 1)
71429 return;
71430
71431 +#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
71432 pud = pud_offset(pgd, start);
71433 pgd_clear(pgd);
71434 pud_free_tlb(tlb, pud, start);
71435 +#endif
71436 +
71437 }
71438
71439 /*
71440 @@ -1602,12 +1609,6 @@ no_page_table:
71441 return page;
71442 }
71443
71444 -static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
71445 -{
71446 - return stack_guard_page_start(vma, addr) ||
71447 - stack_guard_page_end(vma, addr+PAGE_SIZE);
71448 -}
71449 -
71450 /**
71451 * __get_user_pages() - pin user pages in memory
71452 * @tsk: task_struct of target task
71453 @@ -1680,10 +1681,10 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
71454 (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
71455 i = 0;
71456
71457 - do {
71458 + while (nr_pages) {
71459 struct vm_area_struct *vma;
71460
71461 - vma = find_extend_vma(mm, start);
71462 + vma = find_vma(mm, start);
71463 if (!vma && in_gate_area(mm, start)) {
71464 unsigned long pg = start & PAGE_MASK;
71465 pgd_t *pgd;
71466 @@ -1731,7 +1732,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
71467 goto next_page;
71468 }
71469
71470 - if (!vma ||
71471 + if (!vma || start < vma->vm_start ||
71472 (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
71473 !(vm_flags & vma->vm_flags))
71474 return i ? : -EFAULT;
71475 @@ -1758,11 +1759,6 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
71476 int ret;
71477 unsigned int fault_flags = 0;
71478
71479 - /* For mlock, just skip the stack guard page. */
71480 - if (foll_flags & FOLL_MLOCK) {
71481 - if (stack_guard_page(vma, start))
71482 - goto next_page;
71483 - }
71484 if (foll_flags & FOLL_WRITE)
71485 fault_flags |= FAULT_FLAG_WRITE;
71486 if (nonblocking)
71487 @@ -1836,7 +1832,7 @@ next_page:
71488 start += PAGE_SIZE;
71489 nr_pages--;
71490 } while (nr_pages && start < vma->vm_end);
71491 - } while (nr_pages);
71492 + }
71493 return i;
71494 }
71495 EXPORT_SYMBOL(__get_user_pages);
71496 @@ -2043,6 +2039,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
71497 page_add_file_rmap(page);
71498 set_pte_at(mm, addr, pte, mk_pte(page, prot));
71499
71500 +#ifdef CONFIG_PAX_SEGMEXEC
71501 + pax_mirror_file_pte(vma, addr, page, ptl);
71502 +#endif
71503 +
71504 retval = 0;
71505 pte_unmap_unlock(pte, ptl);
71506 return retval;
71507 @@ -2077,10 +2077,22 @@ out:
71508 int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
71509 struct page *page)
71510 {
71511 +
71512 +#ifdef CONFIG_PAX_SEGMEXEC
71513 + struct vm_area_struct *vma_m;
71514 +#endif
71515 +
71516 if (addr < vma->vm_start || addr >= vma->vm_end)
71517 return -EFAULT;
71518 if (!page_count(page))
71519 return -EINVAL;
71520 +
71521 +#ifdef CONFIG_PAX_SEGMEXEC
71522 + vma_m = pax_find_mirror_vma(vma);
71523 + if (vma_m)
71524 + vma_m->vm_flags |= VM_INSERTPAGE;
71525 +#endif
71526 +
71527 vma->vm_flags |= VM_INSERTPAGE;
71528 return insert_page(vma, addr, page, vma->vm_page_prot);
71529 }
71530 @@ -2166,6 +2178,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
71531 unsigned long pfn)
71532 {
71533 BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
71534 + BUG_ON(vma->vm_mirror);
71535
71536 if (addr < vma->vm_start || addr >= vma->vm_end)
71537 return -EFAULT;
71538 @@ -2373,7 +2386,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
71539
71540 BUG_ON(pud_huge(*pud));
71541
71542 - pmd = pmd_alloc(mm, pud, addr);
71543 + pmd = (mm == &init_mm) ?
71544 + pmd_alloc_kernel(mm, pud, addr) :
71545 + pmd_alloc(mm, pud, addr);
71546 if (!pmd)
71547 return -ENOMEM;
71548 do {
71549 @@ -2393,7 +2408,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
71550 unsigned long next;
71551 int err;
71552
71553 - pud = pud_alloc(mm, pgd, addr);
71554 + pud = (mm == &init_mm) ?
71555 + pud_alloc_kernel(mm, pgd, addr) :
71556 + pud_alloc(mm, pgd, addr);
71557 if (!pud)
71558 return -ENOMEM;
71559 do {
71560 @@ -2481,6 +2498,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
71561 copy_user_highpage(dst, src, va, vma);
71562 }
71563
71564 +#ifdef CONFIG_PAX_SEGMEXEC
71565 +static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
71566 +{
71567 + struct mm_struct *mm = vma->vm_mm;
71568 + spinlock_t *ptl;
71569 + pte_t *pte, entry;
71570 +
71571 + pte = pte_offset_map_lock(mm, pmd, address, &ptl);
71572 + entry = *pte;
71573 + if (!pte_present(entry)) {
71574 + if (!pte_none(entry)) {
71575 + BUG_ON(pte_file(entry));
71576 + free_swap_and_cache(pte_to_swp_entry(entry));
71577 + pte_clear_not_present_full(mm, address, pte, 0);
71578 + }
71579 + } else {
71580 + struct page *page;
71581 +
71582 + flush_cache_page(vma, address, pte_pfn(entry));
71583 + entry = ptep_clear_flush(vma, address, pte);
71584 + BUG_ON(pte_dirty(entry));
71585 + page = vm_normal_page(vma, address, entry);
71586 + if (page) {
71587 + update_hiwater_rss(mm);
71588 + if (PageAnon(page))
71589 + dec_mm_counter_fast(mm, MM_ANONPAGES);
71590 + else
71591 + dec_mm_counter_fast(mm, MM_FILEPAGES);
71592 + page_remove_rmap(page);
71593 + page_cache_release(page);
71594 + }
71595 + }
71596 + pte_unmap_unlock(pte, ptl);
71597 +}
71598 +
71599 +/* PaX: if vma is mirrored, synchronize the mirror's PTE
71600 + *
71601 + * the ptl of the lower mapped page is held on entry and is not released on exit
71602 + * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
71603 + */
71604 +static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
71605 +{
71606 + struct mm_struct *mm = vma->vm_mm;
71607 + unsigned long address_m;
71608 + spinlock_t *ptl_m;
71609 + struct vm_area_struct *vma_m;
71610 + pmd_t *pmd_m;
71611 + pte_t *pte_m, entry_m;
71612 +
71613 + BUG_ON(!page_m || !PageAnon(page_m));
71614 +
71615 + vma_m = pax_find_mirror_vma(vma);
71616 + if (!vma_m)
71617 + return;
71618 +
71619 + BUG_ON(!PageLocked(page_m));
71620 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71621 + address_m = address + SEGMEXEC_TASK_SIZE;
71622 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
71623 + pte_m = pte_offset_map(pmd_m, address_m);
71624 + ptl_m = pte_lockptr(mm, pmd_m);
71625 + if (ptl != ptl_m) {
71626 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
71627 + if (!pte_none(*pte_m))
71628 + goto out;
71629 + }
71630 +
71631 + entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
71632 + page_cache_get(page_m);
71633 + page_add_anon_rmap(page_m, vma_m, address_m);
71634 + inc_mm_counter_fast(mm, MM_ANONPAGES);
71635 + set_pte_at(mm, address_m, pte_m, entry_m);
71636 + update_mmu_cache(vma_m, address_m, entry_m);
71637 +out:
71638 + if (ptl != ptl_m)
71639 + spin_unlock(ptl_m);
71640 + pte_unmap(pte_m);
71641 + unlock_page(page_m);
71642 +}
71643 +
71644 +void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
71645 +{
71646 + struct mm_struct *mm = vma->vm_mm;
71647 + unsigned long address_m;
71648 + spinlock_t *ptl_m;
71649 + struct vm_area_struct *vma_m;
71650 + pmd_t *pmd_m;
71651 + pte_t *pte_m, entry_m;
71652 +
71653 + BUG_ON(!page_m || PageAnon(page_m));
71654 +
71655 + vma_m = pax_find_mirror_vma(vma);
71656 + if (!vma_m)
71657 + return;
71658 +
71659 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71660 + address_m = address + SEGMEXEC_TASK_SIZE;
71661 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
71662 + pte_m = pte_offset_map(pmd_m, address_m);
71663 + ptl_m = pte_lockptr(mm, pmd_m);
71664 + if (ptl != ptl_m) {
71665 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
71666 + if (!pte_none(*pte_m))
71667 + goto out;
71668 + }
71669 +
71670 + entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
71671 + page_cache_get(page_m);
71672 + page_add_file_rmap(page_m);
71673 + inc_mm_counter_fast(mm, MM_FILEPAGES);
71674 + set_pte_at(mm, address_m, pte_m, entry_m);
71675 + update_mmu_cache(vma_m, address_m, entry_m);
71676 +out:
71677 + if (ptl != ptl_m)
71678 + spin_unlock(ptl_m);
71679 + pte_unmap(pte_m);
71680 +}
71681 +
71682 +static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
71683 +{
71684 + struct mm_struct *mm = vma->vm_mm;
71685 + unsigned long address_m;
71686 + spinlock_t *ptl_m;
71687 + struct vm_area_struct *vma_m;
71688 + pmd_t *pmd_m;
71689 + pte_t *pte_m, entry_m;
71690 +
71691 + vma_m = pax_find_mirror_vma(vma);
71692 + if (!vma_m)
71693 + return;
71694 +
71695 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71696 + address_m = address + SEGMEXEC_TASK_SIZE;
71697 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
71698 + pte_m = pte_offset_map(pmd_m, address_m);
71699 + ptl_m = pte_lockptr(mm, pmd_m);
71700 + if (ptl != ptl_m) {
71701 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
71702 + if (!pte_none(*pte_m))
71703 + goto out;
71704 + }
71705 +
71706 + entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
71707 + set_pte_at(mm, address_m, pte_m, entry_m);
71708 +out:
71709 + if (ptl != ptl_m)
71710 + spin_unlock(ptl_m);
71711 + pte_unmap(pte_m);
71712 +}
71713 +
71714 +static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
71715 +{
71716 + struct page *page_m;
71717 + pte_t entry;
71718 +
71719 + if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
71720 + goto out;
71721 +
71722 + entry = *pte;
71723 + page_m = vm_normal_page(vma, address, entry);
71724 + if (!page_m)
71725 + pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
71726 + else if (PageAnon(page_m)) {
71727 + if (pax_find_mirror_vma(vma)) {
71728 + pte_unmap_unlock(pte, ptl);
71729 + lock_page(page_m);
71730 + pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
71731 + if (pte_same(entry, *pte))
71732 + pax_mirror_anon_pte(vma, address, page_m, ptl);
71733 + else
71734 + unlock_page(page_m);
71735 + }
71736 + } else
71737 + pax_mirror_file_pte(vma, address, page_m, ptl);
71738 +
71739 +out:
71740 + pte_unmap_unlock(pte, ptl);
71741 +}
71742 +#endif
71743 +
71744 /*
71745 * This routine handles present pages, when users try to write
71746 * to a shared page. It is done by copying the page to a new address
71747 @@ -2692,6 +2889,12 @@ gotten:
71748 */
71749 page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
71750 if (likely(pte_same(*page_table, orig_pte))) {
71751 +
71752 +#ifdef CONFIG_PAX_SEGMEXEC
71753 + if (pax_find_mirror_vma(vma))
71754 + BUG_ON(!trylock_page(new_page));
71755 +#endif
71756 +
71757 if (old_page) {
71758 if (!PageAnon(old_page)) {
71759 dec_mm_counter_fast(mm, MM_FILEPAGES);
71760 @@ -2743,6 +2946,10 @@ gotten:
71761 page_remove_rmap(old_page);
71762 }
71763
71764 +#ifdef CONFIG_PAX_SEGMEXEC
71765 + pax_mirror_anon_pte(vma, address, new_page, ptl);
71766 +#endif
71767 +
71768 /* Free the old page.. */
71769 new_page = old_page;
71770 ret |= VM_FAULT_WRITE;
71771 @@ -3022,6 +3229,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
71772 swap_free(entry);
71773 if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
71774 try_to_free_swap(page);
71775 +
71776 +#ifdef CONFIG_PAX_SEGMEXEC
71777 + if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
71778 +#endif
71779 +
71780 unlock_page(page);
71781 if (swapcache) {
71782 /*
71783 @@ -3045,6 +3257,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
71784
71785 /* No need to invalidate - it was non-present before */
71786 update_mmu_cache(vma, address, page_table);
71787 +
71788 +#ifdef CONFIG_PAX_SEGMEXEC
71789 + pax_mirror_anon_pte(vma, address, page, ptl);
71790 +#endif
71791 +
71792 unlock:
71793 pte_unmap_unlock(page_table, ptl);
71794 out:
71795 @@ -3064,40 +3281,6 @@ out_release:
71796 }
71797
71798 /*
71799 - * This is like a special single-page "expand_{down|up}wards()",
71800 - * except we must first make sure that 'address{-|+}PAGE_SIZE'
71801 - * doesn't hit another vma.
71802 - */
71803 -static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
71804 -{
71805 - address &= PAGE_MASK;
71806 - if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
71807 - struct vm_area_struct *prev = vma->vm_prev;
71808 -
71809 - /*
71810 - * Is there a mapping abutting this one below?
71811 - *
71812 - * That's only ok if it's the same stack mapping
71813 - * that has gotten split..
71814 - */
71815 - if (prev && prev->vm_end == address)
71816 - return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
71817 -
71818 - expand_downwards(vma, address - PAGE_SIZE);
71819 - }
71820 - if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
71821 - struct vm_area_struct *next = vma->vm_next;
71822 -
71823 - /* As VM_GROWSDOWN but s/below/above/ */
71824 - if (next && next->vm_start == address + PAGE_SIZE)
71825 - return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
71826 -
71827 - expand_upwards(vma, address + PAGE_SIZE);
71828 - }
71829 - return 0;
71830 -}
71831 -
71832 -/*
71833 * We enter with non-exclusive mmap_sem (to exclude vma changes,
71834 * but allow concurrent faults), and pte mapped but not yet locked.
71835 * We return with mmap_sem still held, but pte unmapped and unlocked.
71836 @@ -3106,27 +3289,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
71837 unsigned long address, pte_t *page_table, pmd_t *pmd,
71838 unsigned int flags)
71839 {
71840 - struct page *page;
71841 + struct page *page = NULL;
71842 spinlock_t *ptl;
71843 pte_t entry;
71844
71845 - pte_unmap(page_table);
71846 -
71847 - /* Check if we need to add a guard page to the stack */
71848 - if (check_stack_guard_page(vma, address) < 0)
71849 - return VM_FAULT_SIGBUS;
71850 -
71851 - /* Use the zero-page for reads */
71852 if (!(flags & FAULT_FLAG_WRITE)) {
71853 entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
71854 vma->vm_page_prot));
71855 - page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
71856 + ptl = pte_lockptr(mm, pmd);
71857 + spin_lock(ptl);
71858 if (!pte_none(*page_table))
71859 goto unlock;
71860 goto setpte;
71861 }
71862
71863 /* Allocate our own private page. */
71864 + pte_unmap(page_table);
71865 +
71866 if (unlikely(anon_vma_prepare(vma)))
71867 goto oom;
71868 page = alloc_zeroed_user_highpage_movable(vma, address);
71869 @@ -3145,6 +3324,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
71870 if (!pte_none(*page_table))
71871 goto release;
71872
71873 +#ifdef CONFIG_PAX_SEGMEXEC
71874 + if (pax_find_mirror_vma(vma))
71875 + BUG_ON(!trylock_page(page));
71876 +#endif
71877 +
71878 inc_mm_counter_fast(mm, MM_ANONPAGES);
71879 page_add_new_anon_rmap(page, vma, address);
71880 setpte:
71881 @@ -3152,6 +3336,12 @@ setpte:
71882
71883 /* No need to invalidate - it was non-present before */
71884 update_mmu_cache(vma, address, page_table);
71885 +
71886 +#ifdef CONFIG_PAX_SEGMEXEC
71887 + if (page)
71888 + pax_mirror_anon_pte(vma, address, page, ptl);
71889 +#endif
71890 +
71891 unlock:
71892 pte_unmap_unlock(page_table, ptl);
71893 return 0;
71894 @@ -3295,6 +3485,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
71895 */
71896 /* Only go through if we didn't race with anybody else... */
71897 if (likely(pte_same(*page_table, orig_pte))) {
71898 +
71899 +#ifdef CONFIG_PAX_SEGMEXEC
71900 + if (anon && pax_find_mirror_vma(vma))
71901 + BUG_ON(!trylock_page(page));
71902 +#endif
71903 +
71904 flush_icache_page(vma, page);
71905 entry = mk_pte(page, vma->vm_page_prot);
71906 if (flags & FAULT_FLAG_WRITE)
71907 @@ -3314,6 +3510,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
71908
71909 /* no need to invalidate: a not-present page won't be cached */
71910 update_mmu_cache(vma, address, page_table);
71911 +
71912 +#ifdef CONFIG_PAX_SEGMEXEC
71913 + if (anon)
71914 + pax_mirror_anon_pte(vma, address, page, ptl);
71915 + else
71916 + pax_mirror_file_pte(vma, address, page, ptl);
71917 +#endif
71918 +
71919 } else {
71920 if (cow_page)
71921 mem_cgroup_uncharge_page(cow_page);
71922 @@ -3467,6 +3671,12 @@ int handle_pte_fault(struct mm_struct *mm,
71923 if (flags & FAULT_FLAG_WRITE)
71924 flush_tlb_fix_spurious_fault(vma, address);
71925 }
71926 +
71927 +#ifdef CONFIG_PAX_SEGMEXEC
71928 + pax_mirror_pte(vma, address, pte, pmd, ptl);
71929 + return 0;
71930 +#endif
71931 +
71932 unlock:
71933 pte_unmap_unlock(pte, ptl);
71934 return 0;
71935 @@ -3483,6 +3693,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
71936 pmd_t *pmd;
71937 pte_t *pte;
71938
71939 +#ifdef CONFIG_PAX_SEGMEXEC
71940 + struct vm_area_struct *vma_m;
71941 +#endif
71942 +
71943 __set_current_state(TASK_RUNNING);
71944
71945 count_vm_event(PGFAULT);
71946 @@ -3494,6 +3708,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
71947 if (unlikely(is_vm_hugetlb_page(vma)))
71948 return hugetlb_fault(mm, vma, address, flags);
71949
71950 +#ifdef CONFIG_PAX_SEGMEXEC
71951 + vma_m = pax_find_mirror_vma(vma);
71952 + if (vma_m) {
71953 + unsigned long address_m;
71954 + pgd_t *pgd_m;
71955 + pud_t *pud_m;
71956 + pmd_t *pmd_m;
71957 +
71958 + if (vma->vm_start > vma_m->vm_start) {
71959 + address_m = address;
71960 + address -= SEGMEXEC_TASK_SIZE;
71961 + vma = vma_m;
71962 + } else
71963 + address_m = address + SEGMEXEC_TASK_SIZE;
71964 +
71965 + pgd_m = pgd_offset(mm, address_m);
71966 + pud_m = pud_alloc(mm, pgd_m, address_m);
71967 + if (!pud_m)
71968 + return VM_FAULT_OOM;
71969 + pmd_m = pmd_alloc(mm, pud_m, address_m);
71970 + if (!pmd_m)
71971 + return VM_FAULT_OOM;
71972 + if (!pmd_present(*pmd_m) && __pte_alloc(mm, vma_m, pmd_m, address_m))
71973 + return VM_FAULT_OOM;
71974 + pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
71975 + }
71976 +#endif
71977 +
71978 retry:
71979 pgd = pgd_offset(mm, address);
71980 pud = pud_alloc(mm, pgd, address);
71981 @@ -3535,7 +3777,7 @@ retry:
71982 * run pte_offset_map on the pmd, if an huge pmd could
71983 * materialize from under us from a different thread.
71984 */
71985 - if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
71986 + if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
71987 return VM_FAULT_OOM;
71988 /* if an huge pmd materialized from under us just retry later */
71989 if (unlikely(pmd_trans_huge(*pmd)))
71990 @@ -3572,6 +3814,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
71991 spin_unlock(&mm->page_table_lock);
71992 return 0;
71993 }
71994 +
71995 +int __pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
71996 +{
71997 + pud_t *new = pud_alloc_one(mm, address);
71998 + if (!new)
71999 + return -ENOMEM;
72000 +
72001 + smp_wmb(); /* See comment in __pte_alloc */
72002 +
72003 + spin_lock(&mm->page_table_lock);
72004 + if (pgd_present(*pgd)) /* Another has populated it */
72005 + pud_free(mm, new);
72006 + else
72007 + pgd_populate_kernel(mm, pgd, new);
72008 + spin_unlock(&mm->page_table_lock);
72009 + return 0;
72010 +}
72011 #endif /* __PAGETABLE_PUD_FOLDED */
72012
72013 #ifndef __PAGETABLE_PMD_FOLDED
72014 @@ -3602,6 +3861,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
72015 spin_unlock(&mm->page_table_lock);
72016 return 0;
72017 }
72018 +
72019 +int __pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud, unsigned long address)
72020 +{
72021 + pmd_t *new = pmd_alloc_one(mm, address);
72022 + if (!new)
72023 + return -ENOMEM;
72024 +
72025 + smp_wmb(); /* See comment in __pte_alloc */
72026 +
72027 + spin_lock(&mm->page_table_lock);
72028 +#ifndef __ARCH_HAS_4LEVEL_HACK
72029 + if (pud_present(*pud)) /* Another has populated it */
72030 + pmd_free(mm, new);
72031 + else
72032 + pud_populate_kernel(mm, pud, new);
72033 +#else
72034 + if (pgd_present(*pud)) /* Another has populated it */
72035 + pmd_free(mm, new);
72036 + else
72037 + pgd_populate_kernel(mm, pud, new);
72038 +#endif /* __ARCH_HAS_4LEVEL_HACK */
72039 + spin_unlock(&mm->page_table_lock);
72040 + return 0;
72041 +}
72042 #endif /* __PAGETABLE_PMD_FOLDED */
72043
72044 int make_pages_present(unsigned long addr, unsigned long end)
72045 @@ -3639,7 +3922,7 @@ static int __init gate_vma_init(void)
72046 gate_vma.vm_start = FIXADDR_USER_START;
72047 gate_vma.vm_end = FIXADDR_USER_END;
72048 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
72049 - gate_vma.vm_page_prot = __P101;
72050 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
72051
72052 return 0;
72053 }
72054 diff --git a/mm/mempolicy.c b/mm/mempolicy.c
72055 index b12b28a..64b57d0 100644
72056 --- a/mm/mempolicy.c
72057 +++ b/mm/mempolicy.c
72058 @@ -619,6 +619,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
72059 unsigned long vmstart;
72060 unsigned long vmend;
72061
72062 +#ifdef CONFIG_PAX_SEGMEXEC
72063 + struct vm_area_struct *vma_m;
72064 +#endif
72065 +
72066 vma = find_vma(mm, start);
72067 if (!vma || vma->vm_start > start)
72068 return -EFAULT;
72069 @@ -672,6 +676,16 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
72070 if (err)
72071 goto out;
72072 }
72073 +
72074 +#ifdef CONFIG_PAX_SEGMEXEC
72075 + vma_m = pax_find_mirror_vma(vma);
72076 + if (vma_m && vma_m->vm_ops && vma_m->vm_ops->set_policy) {
72077 + err = vma_m->vm_ops->set_policy(vma_m, new_pol);
72078 + if (err)
72079 + goto out;
72080 + }
72081 +#endif
72082 +
72083 }
72084
72085 out:
72086 @@ -1125,6 +1139,17 @@ static long do_mbind(unsigned long start, unsigned long len,
72087
72088 if (end < start)
72089 return -EINVAL;
72090 +
72091 +#ifdef CONFIG_PAX_SEGMEXEC
72092 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
72093 + if (end > SEGMEXEC_TASK_SIZE)
72094 + return -EINVAL;
72095 + } else
72096 +#endif
72097 +
72098 + if (end > TASK_SIZE)
72099 + return -EINVAL;
72100 +
72101 if (end == start)
72102 return 0;
72103
72104 @@ -1348,8 +1373,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
72105 */
72106 tcred = __task_cred(task);
72107 if (!uid_eq(cred->euid, tcred->suid) && !uid_eq(cred->euid, tcred->uid) &&
72108 - !uid_eq(cred->uid, tcred->suid) && !uid_eq(cred->uid, tcred->uid) &&
72109 - !capable(CAP_SYS_NICE)) {
72110 + !uid_eq(cred->uid, tcred->suid) && !capable(CAP_SYS_NICE)) {
72111 rcu_read_unlock();
72112 err = -EPERM;
72113 goto out_put;
72114 @@ -1380,6 +1404,15 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
72115 goto out;
72116 }
72117
72118 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
72119 + if (mm != current->mm &&
72120 + (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
72121 + mmput(mm);
72122 + err = -EPERM;
72123 + goto out;
72124 + }
72125 +#endif
72126 +
72127 err = do_migrate_pages(mm, old, new,
72128 capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE);
72129
72130 diff --git a/mm/mlock.c b/mm/mlock.c
72131 index ef726e8..cd7f1ec 100644
72132 --- a/mm/mlock.c
72133 +++ b/mm/mlock.c
72134 @@ -13,6 +13,7 @@
72135 #include <linux/pagemap.h>
72136 #include <linux/mempolicy.h>
72137 #include <linux/syscalls.h>
72138 +#include <linux/security.h>
72139 #include <linux/sched.h>
72140 #include <linux/export.h>
72141 #include <linux/rmap.h>
72142 @@ -376,7 +377,7 @@ static int do_mlock(unsigned long start, size_t len, int on)
72143 {
72144 unsigned long nstart, end, tmp;
72145 struct vm_area_struct * vma, * prev;
72146 - int error;
72147 + int error = 0;
72148
72149 VM_BUG_ON(start & ~PAGE_MASK);
72150 VM_BUG_ON(len != PAGE_ALIGN(len));
72151 @@ -385,6 +386,9 @@ static int do_mlock(unsigned long start, size_t len, int on)
72152 return -EINVAL;
72153 if (end == start)
72154 return 0;
72155 + if (end > TASK_SIZE)
72156 + return -EINVAL;
72157 +
72158 vma = find_vma(current->mm, start);
72159 if (!vma || vma->vm_start > start)
72160 return -ENOMEM;
72161 @@ -396,6 +400,11 @@ static int do_mlock(unsigned long start, size_t len, int on)
72162 for (nstart = start ; ; ) {
72163 vm_flags_t newflags;
72164
72165 +#ifdef CONFIG_PAX_SEGMEXEC
72166 + if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
72167 + break;
72168 +#endif
72169 +
72170 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
72171
72172 newflags = vma->vm_flags | VM_LOCKED;
72173 @@ -501,6 +510,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, start, size_t, len)
72174 lock_limit >>= PAGE_SHIFT;
72175
72176 /* check against resource limits */
72177 + gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
72178 if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
72179 error = do_mlock(start, len, 1);
72180 up_write(&current->mm->mmap_sem);
72181 @@ -524,17 +534,23 @@ SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len)
72182 static int do_mlockall(int flags)
72183 {
72184 struct vm_area_struct * vma, * prev = NULL;
72185 - unsigned int def_flags = 0;
72186
72187 if (flags & MCL_FUTURE)
72188 - def_flags = VM_LOCKED;
72189 - current->mm->def_flags = def_flags;
72190 + current->mm->def_flags |= VM_LOCKED;
72191 + else
72192 + current->mm->def_flags &= ~VM_LOCKED;
72193 if (flags == MCL_FUTURE)
72194 goto out;
72195
72196 for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
72197 vm_flags_t newflags;
72198
72199 +#ifdef CONFIG_PAX_SEGMEXEC
72200 + if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
72201 + break;
72202 +#endif
72203 +
72204 + BUG_ON(vma->vm_end > TASK_SIZE);
72205 newflags = vma->vm_flags | VM_LOCKED;
72206 if (!(flags & MCL_CURRENT))
72207 newflags &= ~VM_LOCKED;
72208 @@ -567,6 +583,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
72209 lock_limit >>= PAGE_SHIFT;
72210
72211 ret = -ENOMEM;
72212 + gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
72213 if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
72214 capable(CAP_IPC_LOCK))
72215 ret = do_mlockall(flags);
72216 diff --git a/mm/mmap.c b/mm/mmap.c
72217 index fa1f274..86de476 100644
72218 --- a/mm/mmap.c
72219 +++ b/mm/mmap.c
72220 @@ -47,6 +47,16 @@
72221 #define arch_rebalance_pgtables(addr, len) (addr)
72222 #endif
72223
72224 +static inline void verify_mm_writelocked(struct mm_struct *mm)
72225 +{
72226 +#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
72227 + if (unlikely(down_read_trylock(&mm->mmap_sem))) {
72228 + up_read(&mm->mmap_sem);
72229 + BUG();
72230 + }
72231 +#endif
72232 +}
72233 +
72234 static void unmap_region(struct mm_struct *mm,
72235 struct vm_area_struct *vma, struct vm_area_struct *prev,
72236 unsigned long start, unsigned long end);
72237 @@ -72,22 +82,32 @@ static void unmap_region(struct mm_struct *mm,
72238 * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
72239 *
72240 */
72241 -pgprot_t protection_map[16] = {
72242 +pgprot_t protection_map[16] __read_only = {
72243 __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
72244 __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
72245 };
72246
72247 -pgprot_t vm_get_page_prot(unsigned long vm_flags)
72248 +pgprot_t vm_get_page_prot(vm_flags_t vm_flags)
72249 {
72250 - return __pgprot(pgprot_val(protection_map[vm_flags &
72251 + pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
72252 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
72253 pgprot_val(arch_vm_get_page_prot(vm_flags)));
72254 +
72255 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72256 + if (!(__supported_pte_mask & _PAGE_NX) &&
72257 + (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
72258 + (vm_flags & (VM_READ | VM_WRITE)))
72259 + prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
72260 +#endif
72261 +
72262 + return prot;
72263 }
72264 EXPORT_SYMBOL(vm_get_page_prot);
72265
72266 int sysctl_overcommit_memory __read_mostly = OVERCOMMIT_GUESS; /* heuristic overcommit */
72267 int sysctl_overcommit_ratio __read_mostly = 50; /* default is 50% */
72268 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
72269 +unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
72270 /*
72271 * Make sure vm_committed_as in one cacheline and not cacheline shared with
72272 * other variables. It can be updated by several CPUs frequently.
72273 @@ -229,6 +249,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma)
72274 struct vm_area_struct *next = vma->vm_next;
72275
72276 might_sleep();
72277 + BUG_ON(vma->vm_mirror);
72278 if (vma->vm_ops && vma->vm_ops->close)
72279 vma->vm_ops->close(vma);
72280 if (vma->vm_file) {
72281 @@ -275,6 +296,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
72282 * not page aligned -Ram Gupta
72283 */
72284 rlim = rlimit(RLIMIT_DATA);
72285 + gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
72286 if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
72287 (mm->end_data - mm->start_data) > rlim)
72288 goto out;
72289 @@ -708,6 +730,12 @@ static int
72290 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
72291 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
72292 {
72293 +
72294 +#ifdef CONFIG_PAX_SEGMEXEC
72295 + if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
72296 + return 0;
72297 +#endif
72298 +
72299 if (is_mergeable_vma(vma, file, vm_flags) &&
72300 is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
72301 if (vma->vm_pgoff == vm_pgoff)
72302 @@ -727,6 +755,12 @@ static int
72303 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
72304 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
72305 {
72306 +
72307 +#ifdef CONFIG_PAX_SEGMEXEC
72308 + if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
72309 + return 0;
72310 +#endif
72311 +
72312 if (is_mergeable_vma(vma, file, vm_flags) &&
72313 is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
72314 pgoff_t vm_pglen;
72315 @@ -769,13 +803,20 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
72316 struct vm_area_struct *vma_merge(struct mm_struct *mm,
72317 struct vm_area_struct *prev, unsigned long addr,
72318 unsigned long end, unsigned long vm_flags,
72319 - struct anon_vma *anon_vma, struct file *file,
72320 + struct anon_vma *anon_vma, struct file *file,
72321 pgoff_t pgoff, struct mempolicy *policy)
72322 {
72323 pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
72324 struct vm_area_struct *area, *next;
72325 int err;
72326
72327 +#ifdef CONFIG_PAX_SEGMEXEC
72328 + unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
72329 + struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
72330 +
72331 + BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
72332 +#endif
72333 +
72334 /*
72335 * We later require that vma->vm_flags == vm_flags,
72336 * so this tests vma->vm_flags & VM_SPECIAL, too.
72337 @@ -791,6 +832,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
72338 if (next && next->vm_end == end) /* cases 6, 7, 8 */
72339 next = next->vm_next;
72340
72341 +#ifdef CONFIG_PAX_SEGMEXEC
72342 + if (prev)
72343 + prev_m = pax_find_mirror_vma(prev);
72344 + if (area)
72345 + area_m = pax_find_mirror_vma(area);
72346 + if (next)
72347 + next_m = pax_find_mirror_vma(next);
72348 +#endif
72349 +
72350 /*
72351 * Can it merge with the predecessor?
72352 */
72353 @@ -810,9 +860,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
72354 /* cases 1, 6 */
72355 err = vma_adjust(prev, prev->vm_start,
72356 next->vm_end, prev->vm_pgoff, NULL);
72357 - } else /* cases 2, 5, 7 */
72358 +
72359 +#ifdef CONFIG_PAX_SEGMEXEC
72360 + if (!err && prev_m)
72361 + err = vma_adjust(prev_m, prev_m->vm_start,
72362 + next_m->vm_end, prev_m->vm_pgoff, NULL);
72363 +#endif
72364 +
72365 + } else { /* cases 2, 5, 7 */
72366 err = vma_adjust(prev, prev->vm_start,
72367 end, prev->vm_pgoff, NULL);
72368 +
72369 +#ifdef CONFIG_PAX_SEGMEXEC
72370 + if (!err && prev_m)
72371 + err = vma_adjust(prev_m, prev_m->vm_start,
72372 + end_m, prev_m->vm_pgoff, NULL);
72373 +#endif
72374 +
72375 + }
72376 if (err)
72377 return NULL;
72378 khugepaged_enter_vma_merge(prev);
72379 @@ -826,12 +891,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
72380 mpol_equal(policy, vma_policy(next)) &&
72381 can_vma_merge_before(next, vm_flags,
72382 anon_vma, file, pgoff+pglen)) {
72383 - if (prev && addr < prev->vm_end) /* case 4 */
72384 + if (prev && addr < prev->vm_end) { /* case 4 */
72385 err = vma_adjust(prev, prev->vm_start,
72386 addr, prev->vm_pgoff, NULL);
72387 - else /* cases 3, 8 */
72388 +
72389 +#ifdef CONFIG_PAX_SEGMEXEC
72390 + if (!err && prev_m)
72391 + err = vma_adjust(prev_m, prev_m->vm_start,
72392 + addr_m, prev_m->vm_pgoff, NULL);
72393 +#endif
72394 +
72395 + } else { /* cases 3, 8 */
72396 err = vma_adjust(area, addr, next->vm_end,
72397 next->vm_pgoff - pglen, NULL);
72398 +
72399 +#ifdef CONFIG_PAX_SEGMEXEC
72400 + if (!err && area_m)
72401 + err = vma_adjust(area_m, addr_m, next_m->vm_end,
72402 + next_m->vm_pgoff - pglen, NULL);
72403 +#endif
72404 +
72405 + }
72406 if (err)
72407 return NULL;
72408 khugepaged_enter_vma_merge(area);
72409 @@ -940,14 +1020,11 @@ none:
72410 void vm_stat_account(struct mm_struct *mm, unsigned long flags,
72411 struct file *file, long pages)
72412 {
72413 - const unsigned long stack_flags
72414 - = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
72415 -
72416 if (file) {
72417 mm->shared_vm += pages;
72418 if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
72419 mm->exec_vm += pages;
72420 - } else if (flags & stack_flags)
72421 + } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
72422 mm->stack_vm += pages;
72423 if (flags & (VM_RESERVED|VM_IO))
72424 mm->reserved_vm += pages;
72425 @@ -985,7 +1062,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
72426 * (the exception is when the underlying filesystem is noexec
72427 * mounted, in which case we dont add PROT_EXEC.)
72428 */
72429 - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
72430 + if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
72431 if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
72432 prot |= PROT_EXEC;
72433
72434 @@ -1011,7 +1088,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
72435 /* Obtain the address to map to. we verify (or select) it and ensure
72436 * that it represents a valid section of the address space.
72437 */
72438 - addr = get_unmapped_area(file, addr, len, pgoff, flags);
72439 + addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
72440 if (addr & ~PAGE_MASK)
72441 return addr;
72442
72443 @@ -1022,6 +1099,36 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
72444 vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
72445 mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
72446
72447 +#ifdef CONFIG_PAX_MPROTECT
72448 + if (mm->pax_flags & MF_PAX_MPROTECT) {
72449 +#ifndef CONFIG_PAX_MPROTECT_COMPAT
72450 + if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
72451 + gr_log_rwxmmap(file);
72452 +
72453 +#ifdef CONFIG_PAX_EMUPLT
72454 + vm_flags &= ~VM_EXEC;
72455 +#else
72456 + return -EPERM;
72457 +#endif
72458 +
72459 + }
72460 +
72461 + if (!(vm_flags & VM_EXEC))
72462 + vm_flags &= ~VM_MAYEXEC;
72463 +#else
72464 + if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
72465 + vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
72466 +#endif
72467 + else
72468 + vm_flags &= ~VM_MAYWRITE;
72469 + }
72470 +#endif
72471 +
72472 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72473 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
72474 + vm_flags &= ~VM_PAGEEXEC;
72475 +#endif
72476 +
72477 if (flags & MAP_LOCKED)
72478 if (!can_do_mlock())
72479 return -EPERM;
72480 @@ -1033,6 +1140,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
72481 locked += mm->locked_vm;
72482 lock_limit = rlimit(RLIMIT_MEMLOCK);
72483 lock_limit >>= PAGE_SHIFT;
72484 + gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
72485 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
72486 return -EAGAIN;
72487 }
72488 @@ -1099,6 +1207,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
72489 }
72490 }
72491
72492 + if (!gr_acl_handle_mmap(file, prot))
72493 + return -EACCES;
72494 +
72495 return mmap_region(file, addr, len, flags, vm_flags, pgoff);
72496 }
72497
72498 @@ -1175,7 +1286,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
72499 vm_flags_t vm_flags = vma->vm_flags;
72500
72501 /* If it was private or non-writable, the write bit is already clear */
72502 - if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
72503 + if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
72504 return 0;
72505
72506 /* The backer wishes to know when pages are first written to? */
72507 @@ -1224,14 +1335,24 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
72508 unsigned long charged = 0;
72509 struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
72510
72511 +#ifdef CONFIG_PAX_SEGMEXEC
72512 + struct vm_area_struct *vma_m = NULL;
72513 +#endif
72514 +
72515 + /*
72516 + * mm->mmap_sem is required to protect against another thread
72517 + * changing the mappings in case we sleep.
72518 + */
72519 + verify_mm_writelocked(mm);
72520 +
72521 /* Clear old maps */
72522 error = -ENOMEM;
72523 -munmap_back:
72524 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72525 if (vma && vma->vm_start < addr + len) {
72526 if (do_munmap(mm, addr, len))
72527 return -ENOMEM;
72528 - goto munmap_back;
72529 + vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72530 + BUG_ON(vma && vma->vm_start < addr + len);
72531 }
72532
72533 /* Check against address space limit. */
72534 @@ -1280,6 +1401,16 @@ munmap_back:
72535 goto unacct_error;
72536 }
72537
72538 +#ifdef CONFIG_PAX_SEGMEXEC
72539 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
72540 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
72541 + if (!vma_m) {
72542 + error = -ENOMEM;
72543 + goto free_vma;
72544 + }
72545 + }
72546 +#endif
72547 +
72548 vma->vm_mm = mm;
72549 vma->vm_start = addr;
72550 vma->vm_end = addr + len;
72551 @@ -1304,6 +1435,19 @@ munmap_back:
72552 error = file->f_op->mmap(file, vma);
72553 if (error)
72554 goto unmap_and_free_vma;
72555 +
72556 +#ifdef CONFIG_PAX_SEGMEXEC
72557 + if (vma_m && (vm_flags & VM_EXECUTABLE))
72558 + added_exe_file_vma(mm);
72559 +#endif
72560 +
72561 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72562 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
72563 + vma->vm_flags |= VM_PAGEEXEC;
72564 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
72565 + }
72566 +#endif
72567 +
72568 if (vm_flags & VM_EXECUTABLE)
72569 added_exe_file_vma(mm);
72570
72571 @@ -1341,6 +1485,11 @@ munmap_back:
72572 vma_link(mm, vma, prev, rb_link, rb_parent);
72573 file = vma->vm_file;
72574
72575 +#ifdef CONFIG_PAX_SEGMEXEC
72576 + if (vma_m)
72577 + BUG_ON(pax_mirror_vma(vma_m, vma));
72578 +#endif
72579 +
72580 /* Once vma denies write, undo our temporary denial count */
72581 if (correct_wcount)
72582 atomic_inc(&inode->i_writecount);
72583 @@ -1349,6 +1498,7 @@ out:
72584
72585 mm->total_vm += len >> PAGE_SHIFT;
72586 vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
72587 + track_exec_limit(mm, addr, addr + len, vm_flags);
72588 if (vm_flags & VM_LOCKED) {
72589 if (!mlock_vma_pages_range(vma, addr, addr + len))
72590 mm->locked_vm += (len >> PAGE_SHIFT);
72591 @@ -1370,6 +1520,12 @@ unmap_and_free_vma:
72592 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
72593 charged = 0;
72594 free_vma:
72595 +
72596 +#ifdef CONFIG_PAX_SEGMEXEC
72597 + if (vma_m)
72598 + kmem_cache_free(vm_area_cachep, vma_m);
72599 +#endif
72600 +
72601 kmem_cache_free(vm_area_cachep, vma);
72602 unacct_error:
72603 if (charged)
72604 @@ -1377,6 +1533,44 @@ unacct_error:
72605 return error;
72606 }
72607
72608 +bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len)
72609 +{
72610 + if (!vma) {
72611 +#ifdef CONFIG_STACK_GROWSUP
72612 + if (addr > sysctl_heap_stack_gap)
72613 + vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
72614 + else
72615 + vma = find_vma(current->mm, 0);
72616 + if (vma && (vma->vm_flags & VM_GROWSUP))
72617 + return false;
72618 +#endif
72619 + return true;
72620 + }
72621 +
72622 + if (addr + len > vma->vm_start)
72623 + return false;
72624 +
72625 + if (vma->vm_flags & VM_GROWSDOWN)
72626 + return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
72627 +#ifdef CONFIG_STACK_GROWSUP
72628 + else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
72629 + return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
72630 +#endif
72631 +
72632 + return true;
72633 +}
72634 +
72635 +unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len)
72636 +{
72637 + if (vma->vm_start < len)
72638 + return -ENOMEM;
72639 + if (!(vma->vm_flags & VM_GROWSDOWN))
72640 + return vma->vm_start - len;
72641 + if (sysctl_heap_stack_gap <= vma->vm_start - len)
72642 + return vma->vm_start - len - sysctl_heap_stack_gap;
72643 + return -ENOMEM;
72644 +}
72645 +
72646 /* Get an address range which is currently unmapped.
72647 * For shmat() with addr=0.
72648 *
72649 @@ -1403,18 +1597,23 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
72650 if (flags & MAP_FIXED)
72651 return addr;
72652
72653 +#ifdef CONFIG_PAX_RANDMMAP
72654 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
72655 +#endif
72656 +
72657 if (addr) {
72658 addr = PAGE_ALIGN(addr);
72659 - vma = find_vma(mm, addr);
72660 - if (TASK_SIZE - len >= addr &&
72661 - (!vma || addr + len <= vma->vm_start))
72662 - return addr;
72663 + if (TASK_SIZE - len >= addr) {
72664 + vma = find_vma(mm, addr);
72665 + if (check_heap_stack_gap(vma, addr, len))
72666 + return addr;
72667 + }
72668 }
72669 if (len > mm->cached_hole_size) {
72670 - start_addr = addr = mm->free_area_cache;
72671 + start_addr = addr = mm->free_area_cache;
72672 } else {
72673 - start_addr = addr = TASK_UNMAPPED_BASE;
72674 - mm->cached_hole_size = 0;
72675 + start_addr = addr = mm->mmap_base;
72676 + mm->cached_hole_size = 0;
72677 }
72678
72679 full_search:
72680 @@ -1425,34 +1624,40 @@ full_search:
72681 * Start a new search - just in case we missed
72682 * some holes.
72683 */
72684 - if (start_addr != TASK_UNMAPPED_BASE) {
72685 - addr = TASK_UNMAPPED_BASE;
72686 - start_addr = addr;
72687 + if (start_addr != mm->mmap_base) {
72688 + start_addr = addr = mm->mmap_base;
72689 mm->cached_hole_size = 0;
72690 goto full_search;
72691 }
72692 return -ENOMEM;
72693 }
72694 - if (!vma || addr + len <= vma->vm_start) {
72695 - /*
72696 - * Remember the place where we stopped the search:
72697 - */
72698 - mm->free_area_cache = addr + len;
72699 - return addr;
72700 - }
72701 + if (check_heap_stack_gap(vma, addr, len))
72702 + break;
72703 if (addr + mm->cached_hole_size < vma->vm_start)
72704 mm->cached_hole_size = vma->vm_start - addr;
72705 addr = vma->vm_end;
72706 }
72707 +
72708 + /*
72709 + * Remember the place where we stopped the search:
72710 + */
72711 + mm->free_area_cache = addr + len;
72712 + return addr;
72713 }
72714 #endif
72715
72716 void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
72717 {
72718 +
72719 +#ifdef CONFIG_PAX_SEGMEXEC
72720 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
72721 + return;
72722 +#endif
72723 +
72724 /*
72725 * Is this a new hole at the lowest possible address?
72726 */
72727 - if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache)
72728 + if (addr >= mm->mmap_base && addr < mm->free_area_cache)
72729 mm->free_area_cache = addr;
72730 }
72731
72732 @@ -1468,7 +1673,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
72733 {
72734 struct vm_area_struct *vma;
72735 struct mm_struct *mm = current->mm;
72736 - unsigned long addr = addr0, start_addr;
72737 + unsigned long base = mm->mmap_base, addr = addr0, start_addr;
72738
72739 /* requested length too big for entire address space */
72740 if (len > TASK_SIZE)
72741 @@ -1477,13 +1682,18 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
72742 if (flags & MAP_FIXED)
72743 return addr;
72744
72745 +#ifdef CONFIG_PAX_RANDMMAP
72746 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
72747 +#endif
72748 +
72749 /* requesting a specific address */
72750 if (addr) {
72751 addr = PAGE_ALIGN(addr);
72752 - vma = find_vma(mm, addr);
72753 - if (TASK_SIZE - len >= addr &&
72754 - (!vma || addr + len <= vma->vm_start))
72755 - return addr;
72756 + if (TASK_SIZE - len >= addr) {
72757 + vma = find_vma(mm, addr);
72758 + if (check_heap_stack_gap(vma, addr, len))
72759 + return addr;
72760 + }
72761 }
72762
72763 /* check if free_area_cache is useful for us */
72764 @@ -1507,7 +1717,7 @@ try_again:
72765 * return with success:
72766 */
72767 vma = find_vma(mm, addr);
72768 - if (!vma || addr+len <= vma->vm_start)
72769 + if (check_heap_stack_gap(vma, addr, len))
72770 /* remember the address as a hint for next time */
72771 return (mm->free_area_cache = addr);
72772
72773 @@ -1516,8 +1726,8 @@ try_again:
72774 mm->cached_hole_size = vma->vm_start - addr;
72775
72776 /* try just below the current vma->vm_start */
72777 - addr = vma->vm_start-len;
72778 - } while (len < vma->vm_start);
72779 + addr = skip_heap_stack_gap(vma, len);
72780 + } while (!IS_ERR_VALUE(addr));
72781
72782 fail:
72783 /*
72784 @@ -1540,13 +1750,21 @@ fail:
72785 * can happen with large stack limits and large mmap()
72786 * allocations.
72787 */
72788 + mm->mmap_base = TASK_UNMAPPED_BASE;
72789 +
72790 +#ifdef CONFIG_PAX_RANDMMAP
72791 + if (mm->pax_flags & MF_PAX_RANDMMAP)
72792 + mm->mmap_base += mm->delta_mmap;
72793 +#endif
72794 +
72795 + mm->free_area_cache = mm->mmap_base;
72796 mm->cached_hole_size = ~0UL;
72797 - mm->free_area_cache = TASK_UNMAPPED_BASE;
72798 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
72799 /*
72800 * Restore the topdown base:
72801 */
72802 - mm->free_area_cache = mm->mmap_base;
72803 + mm->mmap_base = base;
72804 + mm->free_area_cache = base;
72805 mm->cached_hole_size = ~0UL;
72806
72807 return addr;
72808 @@ -1555,6 +1773,12 @@ fail:
72809
72810 void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
72811 {
72812 +
72813 +#ifdef CONFIG_PAX_SEGMEXEC
72814 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
72815 + return;
72816 +#endif
72817 +
72818 /*
72819 * Is this a new hole at the highest possible address?
72820 */
72821 @@ -1562,8 +1786,10 @@ void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
72822 mm->free_area_cache = addr;
72823
72824 /* dont allow allocations above current base */
72825 - if (mm->free_area_cache > mm->mmap_base)
72826 + if (mm->free_area_cache > mm->mmap_base) {
72827 mm->free_area_cache = mm->mmap_base;
72828 + mm->cached_hole_size = ~0UL;
72829 + }
72830 }
72831
72832 unsigned long
72833 @@ -1662,6 +1888,28 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
72834 return vma;
72835 }
72836
72837 +#ifdef CONFIG_PAX_SEGMEXEC
72838 +struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
72839 +{
72840 + struct vm_area_struct *vma_m;
72841 +
72842 + BUG_ON(!vma || vma->vm_start >= vma->vm_end);
72843 + if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
72844 + BUG_ON(vma->vm_mirror);
72845 + return NULL;
72846 + }
72847 + BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
72848 + vma_m = vma->vm_mirror;
72849 + BUG_ON(!vma_m || vma_m->vm_mirror != vma);
72850 + BUG_ON(vma->vm_file != vma_m->vm_file);
72851 + BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
72852 + BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff);
72853 + BUG_ON(vma->anon_vma != vma_m->anon_vma && vma->anon_vma->root != vma_m->anon_vma->root);
72854 + BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
72855 + return vma_m;
72856 +}
72857 +#endif
72858 +
72859 /*
72860 * Verify that the stack growth is acceptable and
72861 * update accounting. This is shared with both the
72862 @@ -1678,6 +1926,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
72863 return -ENOMEM;
72864
72865 /* Stack limit test */
72866 + gr_learn_resource(current, RLIMIT_STACK, size, 1);
72867 if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
72868 return -ENOMEM;
72869
72870 @@ -1688,6 +1937,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
72871 locked = mm->locked_vm + grow;
72872 limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
72873 limit >>= PAGE_SHIFT;
72874 + gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
72875 if (locked > limit && !capable(CAP_IPC_LOCK))
72876 return -ENOMEM;
72877 }
72878 @@ -1718,37 +1968,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
72879 * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
72880 * vma is the last one with address > vma->vm_end. Have to extend vma.
72881 */
72882 +#ifndef CONFIG_IA64
72883 +static
72884 +#endif
72885 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
72886 {
72887 int error;
72888 + bool locknext;
72889
72890 if (!(vma->vm_flags & VM_GROWSUP))
72891 return -EFAULT;
72892
72893 + /* Also guard against wrapping around to address 0. */
72894 + if (address < PAGE_ALIGN(address+1))
72895 + address = PAGE_ALIGN(address+1);
72896 + else
72897 + return -ENOMEM;
72898 +
72899 /*
72900 * We must make sure the anon_vma is allocated
72901 * so that the anon_vma locking is not a noop.
72902 */
72903 if (unlikely(anon_vma_prepare(vma)))
72904 return -ENOMEM;
72905 + locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
72906 + if (locknext && anon_vma_prepare(vma->vm_next))
72907 + return -ENOMEM;
72908 vma_lock_anon_vma(vma);
72909 + if (locknext)
72910 + vma_lock_anon_vma(vma->vm_next);
72911
72912 /*
72913 * vma->vm_start/vm_end cannot change under us because the caller
72914 * is required to hold the mmap_sem in read mode. We need the
72915 - * anon_vma lock to serialize against concurrent expand_stacks.
72916 - * Also guard against wrapping around to address 0.
72917 + * anon_vma locks to serialize against concurrent expand_stacks
72918 + * and expand_upwards.
72919 */
72920 - if (address < PAGE_ALIGN(address+4))
72921 - address = PAGE_ALIGN(address+4);
72922 - else {
72923 - vma_unlock_anon_vma(vma);
72924 - return -ENOMEM;
72925 - }
72926 error = 0;
72927
72928 /* Somebody else might have raced and expanded it already */
72929 - if (address > vma->vm_end) {
72930 + if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
72931 + error = -ENOMEM;
72932 + else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
72933 unsigned long size, grow;
72934
72935 size = address - vma->vm_start;
72936 @@ -1763,6 +2024,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
72937 }
72938 }
72939 }
72940 + if (locknext)
72941 + vma_unlock_anon_vma(vma->vm_next);
72942 vma_unlock_anon_vma(vma);
72943 khugepaged_enter_vma_merge(vma);
72944 return error;
72945 @@ -1776,6 +2039,8 @@ int expand_downwards(struct vm_area_struct *vma,
72946 unsigned long address)
72947 {
72948 int error;
72949 + bool lockprev = false;
72950 + struct vm_area_struct *prev;
72951
72952 /*
72953 * We must make sure the anon_vma is allocated
72954 @@ -1789,6 +2054,15 @@ int expand_downwards(struct vm_area_struct *vma,
72955 if (error)
72956 return error;
72957
72958 + prev = vma->vm_prev;
72959 +#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
72960 + lockprev = prev && (prev->vm_flags & VM_GROWSUP);
72961 +#endif
72962 + if (lockprev && anon_vma_prepare(prev))
72963 + return -ENOMEM;
72964 + if (lockprev)
72965 + vma_lock_anon_vma(prev);
72966 +
72967 vma_lock_anon_vma(vma);
72968
72969 /*
72970 @@ -1798,9 +2072,17 @@ int expand_downwards(struct vm_area_struct *vma,
72971 */
72972
72973 /* Somebody else might have raced and expanded it already */
72974 - if (address < vma->vm_start) {
72975 + if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
72976 + error = -ENOMEM;
72977 + else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
72978 unsigned long size, grow;
72979
72980 +#ifdef CONFIG_PAX_SEGMEXEC
72981 + struct vm_area_struct *vma_m;
72982 +
72983 + vma_m = pax_find_mirror_vma(vma);
72984 +#endif
72985 +
72986 size = vma->vm_end - address;
72987 grow = (vma->vm_start - address) >> PAGE_SHIFT;
72988
72989 @@ -1810,11 +2092,22 @@ int expand_downwards(struct vm_area_struct *vma,
72990 if (!error) {
72991 vma->vm_start = address;
72992 vma->vm_pgoff -= grow;
72993 + track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
72994 +
72995 +#ifdef CONFIG_PAX_SEGMEXEC
72996 + if (vma_m) {
72997 + vma_m->vm_start -= grow << PAGE_SHIFT;
72998 + vma_m->vm_pgoff -= grow;
72999 + }
73000 +#endif
73001 +
73002 perf_event_mmap(vma);
73003 }
73004 }
73005 }
73006 vma_unlock_anon_vma(vma);
73007 + if (lockprev)
73008 + vma_unlock_anon_vma(prev);
73009 khugepaged_enter_vma_merge(vma);
73010 return error;
73011 }
73012 @@ -1886,6 +2179,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
73013 do {
73014 long nrpages = vma_pages(vma);
73015
73016 +#ifdef CONFIG_PAX_SEGMEXEC
73017 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
73018 + vma = remove_vma(vma);
73019 + continue;
73020 + }
73021 +#endif
73022 +
73023 if (vma->vm_flags & VM_ACCOUNT)
73024 nr_accounted += nrpages;
73025 mm->total_vm -= nrpages;
73026 @@ -1932,6 +2232,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
73027 insertion_point = (prev ? &prev->vm_next : &mm->mmap);
73028 vma->vm_prev = NULL;
73029 do {
73030 +
73031 +#ifdef CONFIG_PAX_SEGMEXEC
73032 + if (vma->vm_mirror) {
73033 + BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
73034 + vma->vm_mirror->vm_mirror = NULL;
73035 + vma->vm_mirror->vm_flags &= ~VM_EXEC;
73036 + vma->vm_mirror = NULL;
73037 + }
73038 +#endif
73039 +
73040 rb_erase(&vma->vm_rb, &mm->mm_rb);
73041 mm->map_count--;
73042 tail_vma = vma;
73043 @@ -1960,14 +2270,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
73044 struct vm_area_struct *new;
73045 int err = -ENOMEM;
73046
73047 +#ifdef CONFIG_PAX_SEGMEXEC
73048 + struct vm_area_struct *vma_m, *new_m = NULL;
73049 + unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
73050 +#endif
73051 +
73052 if (is_vm_hugetlb_page(vma) && (addr &
73053 ~(huge_page_mask(hstate_vma(vma)))))
73054 return -EINVAL;
73055
73056 +#ifdef CONFIG_PAX_SEGMEXEC
73057 + vma_m = pax_find_mirror_vma(vma);
73058 +#endif
73059 +
73060 new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
73061 if (!new)
73062 goto out_err;
73063
73064 +#ifdef CONFIG_PAX_SEGMEXEC
73065 + if (vma_m) {
73066 + new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
73067 + if (!new_m) {
73068 + kmem_cache_free(vm_area_cachep, new);
73069 + goto out_err;
73070 + }
73071 + }
73072 +#endif
73073 +
73074 /* most fields are the same, copy all, and then fixup */
73075 *new = *vma;
73076
73077 @@ -1980,6 +2309,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
73078 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
73079 }
73080
73081 +#ifdef CONFIG_PAX_SEGMEXEC
73082 + if (vma_m) {
73083 + *new_m = *vma_m;
73084 + INIT_LIST_HEAD(&new_m->anon_vma_chain);
73085 + new_m->vm_mirror = new;
73086 + new->vm_mirror = new_m;
73087 +
73088 + if (new_below)
73089 + new_m->vm_end = addr_m;
73090 + else {
73091 + new_m->vm_start = addr_m;
73092 + new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
73093 + }
73094 + }
73095 +#endif
73096 +
73097 pol = mpol_dup(vma_policy(vma));
73098 if (IS_ERR(pol)) {
73099 err = PTR_ERR(pol);
73100 @@ -2005,6 +2350,42 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
73101 else
73102 err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
73103
73104 +#ifdef CONFIG_PAX_SEGMEXEC
73105 + if (!err && vma_m) {
73106 + if (anon_vma_clone(new_m, vma_m))
73107 + goto out_free_mpol;
73108 +
73109 + mpol_get(pol);
73110 + vma_set_policy(new_m, pol);
73111 +
73112 + if (new_m->vm_file) {
73113 + get_file(new_m->vm_file);
73114 + if (vma_m->vm_flags & VM_EXECUTABLE)
73115 + added_exe_file_vma(mm);
73116 + }
73117 +
73118 + if (new_m->vm_ops && new_m->vm_ops->open)
73119 + new_m->vm_ops->open(new_m);
73120 +
73121 + if (new_below)
73122 + err = vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
73123 + ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
73124 + else
73125 + err = vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
73126 +
73127 + if (err) {
73128 + if (new_m->vm_ops && new_m->vm_ops->close)
73129 + new_m->vm_ops->close(new_m);
73130 + if (new_m->vm_file) {
73131 + if (vma_m->vm_flags & VM_EXECUTABLE)
73132 + removed_exe_file_vma(mm);
73133 + fput(new_m->vm_file);
73134 + }
73135 + mpol_put(pol);
73136 + }
73137 + }
73138 +#endif
73139 +
73140 /* Success. */
73141 if (!err)
73142 return 0;
73143 @@ -2017,10 +2398,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
73144 removed_exe_file_vma(mm);
73145 fput(new->vm_file);
73146 }
73147 - unlink_anon_vmas(new);
73148 out_free_mpol:
73149 mpol_put(pol);
73150 out_free_vma:
73151 +
73152 +#ifdef CONFIG_PAX_SEGMEXEC
73153 + if (new_m) {
73154 + unlink_anon_vmas(new_m);
73155 + kmem_cache_free(vm_area_cachep, new_m);
73156 + }
73157 +#endif
73158 +
73159 + unlink_anon_vmas(new);
73160 kmem_cache_free(vm_area_cachep, new);
73161 out_err:
73162 return err;
73163 @@ -2033,6 +2422,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
73164 int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
73165 unsigned long addr, int new_below)
73166 {
73167 +
73168 +#ifdef CONFIG_PAX_SEGMEXEC
73169 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
73170 + BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
73171 + if (mm->map_count >= sysctl_max_map_count-1)
73172 + return -ENOMEM;
73173 + } else
73174 +#endif
73175 +
73176 if (mm->map_count >= sysctl_max_map_count)
73177 return -ENOMEM;
73178
73179 @@ -2044,11 +2442,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
73180 * work. This now handles partial unmappings.
73181 * Jeremy Fitzhardinge <jeremy@goop.org>
73182 */
73183 +#ifdef CONFIG_PAX_SEGMEXEC
73184 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73185 {
73186 + int ret = __do_munmap(mm, start, len);
73187 + if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
73188 + return ret;
73189 +
73190 + return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
73191 +}
73192 +
73193 +int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73194 +#else
73195 +int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73196 +#endif
73197 +{
73198 unsigned long end;
73199 struct vm_area_struct *vma, *prev, *last;
73200
73201 + /*
73202 + * mm->mmap_sem is required to protect against another thread
73203 + * changing the mappings in case we sleep.
73204 + */
73205 + verify_mm_writelocked(mm);
73206 +
73207 if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
73208 return -EINVAL;
73209
73210 @@ -2123,6 +2540,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73211 /* Fix up all other VM information */
73212 remove_vma_list(mm, vma);
73213
73214 + track_exec_limit(mm, start, end, 0UL);
73215 +
73216 return 0;
73217 }
73218
73219 @@ -2131,6 +2550,13 @@ int vm_munmap(unsigned long start, size_t len)
73220 int ret;
73221 struct mm_struct *mm = current->mm;
73222
73223 +
73224 +#ifdef CONFIG_PAX_SEGMEXEC
73225 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
73226 + (len > SEGMEXEC_TASK_SIZE || start > SEGMEXEC_TASK_SIZE-len))
73227 + return -EINVAL;
73228 +#endif
73229 +
73230 down_write(&mm->mmap_sem);
73231 ret = do_munmap(mm, start, len);
73232 up_write(&mm->mmap_sem);
73233 @@ -2144,16 +2570,6 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
73234 return vm_munmap(addr, len);
73235 }
73236
73237 -static inline void verify_mm_writelocked(struct mm_struct *mm)
73238 -{
73239 -#ifdef CONFIG_DEBUG_VM
73240 - if (unlikely(down_read_trylock(&mm->mmap_sem))) {
73241 - WARN_ON(1);
73242 - up_read(&mm->mmap_sem);
73243 - }
73244 -#endif
73245 -}
73246 -
73247 /*
73248 * this is really a simplified "do_mmap". it only handles
73249 * anonymous maps. eventually we may be able to do some
73250 @@ -2167,6 +2583,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
73251 struct rb_node ** rb_link, * rb_parent;
73252 pgoff_t pgoff = addr >> PAGE_SHIFT;
73253 int error;
73254 + unsigned long charged;
73255
73256 len = PAGE_ALIGN(len);
73257 if (!len)
73258 @@ -2174,16 +2591,30 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
73259
73260 flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
73261
73262 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
73263 + if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
73264 + flags &= ~VM_EXEC;
73265 +
73266 +#ifdef CONFIG_PAX_MPROTECT
73267 + if (mm->pax_flags & MF_PAX_MPROTECT)
73268 + flags &= ~VM_MAYEXEC;
73269 +#endif
73270 +
73271 + }
73272 +#endif
73273 +
73274 error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
73275 if (error & ~PAGE_MASK)
73276 return error;
73277
73278 + charged = len >> PAGE_SHIFT;
73279 +
73280 /*
73281 * mlock MCL_FUTURE?
73282 */
73283 if (mm->def_flags & VM_LOCKED) {
73284 unsigned long locked, lock_limit;
73285 - locked = len >> PAGE_SHIFT;
73286 + locked = charged;
73287 locked += mm->locked_vm;
73288 lock_limit = rlimit(RLIMIT_MEMLOCK);
73289 lock_limit >>= PAGE_SHIFT;
73290 @@ -2200,22 +2631,22 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
73291 /*
73292 * Clear old maps. this also does some error checking for us
73293 */
73294 - munmap_back:
73295 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
73296 if (vma && vma->vm_start < addr + len) {
73297 if (do_munmap(mm, addr, len))
73298 return -ENOMEM;
73299 - goto munmap_back;
73300 - }
73301 + vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
73302 + BUG_ON(vma && vma->vm_start < addr + len);
73303 + }
73304
73305 /* Check against address space limits *after* clearing old maps... */
73306 - if (!may_expand_vm(mm, len >> PAGE_SHIFT))
73307 + if (!may_expand_vm(mm, charged))
73308 return -ENOMEM;
73309
73310 if (mm->map_count > sysctl_max_map_count)
73311 return -ENOMEM;
73312
73313 - if (security_vm_enough_memory_mm(mm, len >> PAGE_SHIFT))
73314 + if (security_vm_enough_memory_mm(mm, charged))
73315 return -ENOMEM;
73316
73317 /* Can we just expand an old private anonymous mapping? */
73318 @@ -2229,7 +2660,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
73319 */
73320 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73321 if (!vma) {
73322 - vm_unacct_memory(len >> PAGE_SHIFT);
73323 + vm_unacct_memory(charged);
73324 return -ENOMEM;
73325 }
73326
73327 @@ -2243,11 +2674,12 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
73328 vma_link(mm, vma, prev, rb_link, rb_parent);
73329 out:
73330 perf_event_mmap(vma);
73331 - mm->total_vm += len >> PAGE_SHIFT;
73332 + mm->total_vm += charged;
73333 if (flags & VM_LOCKED) {
73334 if (!mlock_vma_pages_range(vma, addr, addr + len))
73335 - mm->locked_vm += (len >> PAGE_SHIFT);
73336 + mm->locked_vm += charged;
73337 }
73338 + track_exec_limit(mm, addr, addr + len, flags);
73339 return addr;
73340 }
73341
73342 @@ -2305,6 +2737,7 @@ void exit_mmap(struct mm_struct *mm)
73343 while (vma) {
73344 if (vma->vm_flags & VM_ACCOUNT)
73345 nr_accounted += vma_pages(vma);
73346 + vma->vm_mirror = NULL;
73347 vma = remove_vma(vma);
73348 }
73349 vm_unacct_memory(nr_accounted);
73350 @@ -2321,6 +2754,13 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
73351 struct vm_area_struct * __vma, * prev;
73352 struct rb_node ** rb_link, * rb_parent;
73353
73354 +#ifdef CONFIG_PAX_SEGMEXEC
73355 + struct vm_area_struct *vma_m = NULL;
73356 +#endif
73357 +
73358 + if (security_mmap_addr(vma->vm_start))
73359 + return -EPERM;
73360 +
73361 /*
73362 * The vm_pgoff of a purely anonymous vma should be irrelevant
73363 * until its first write fault, when page's anon_vma and index
73364 @@ -2347,7 +2787,21 @@ int insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
73365 if (vma->vm_file && uprobe_mmap(vma))
73366 return -EINVAL;
73367
73368 +#ifdef CONFIG_PAX_SEGMEXEC
73369 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
73370 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73371 + if (!vma_m)
73372 + return -ENOMEM;
73373 + }
73374 +#endif
73375 +
73376 vma_link(mm, vma, prev, rb_link, rb_parent);
73377 +
73378 +#ifdef CONFIG_PAX_SEGMEXEC
73379 + if (vma_m)
73380 + BUG_ON(pax_mirror_vma(vma_m, vma));
73381 +#endif
73382 +
73383 return 0;
73384 }
73385
73386 @@ -2366,6 +2820,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
73387 struct mempolicy *pol;
73388 bool faulted_in_anon_vma = true;
73389
73390 + BUG_ON(vma->vm_mirror);
73391 +
73392 /*
73393 * If anonymous vma has not yet been faulted, update new pgoff
73394 * to match new location, to increase its chance of merging.
73395 @@ -2437,6 +2893,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
73396 return NULL;
73397 }
73398
73399 +#ifdef CONFIG_PAX_SEGMEXEC
73400 +long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
73401 +{
73402 + struct vm_area_struct *prev_m;
73403 + struct rb_node **rb_link_m, *rb_parent_m;
73404 + struct mempolicy *pol_m;
73405 +
73406 + BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
73407 + BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
73408 + BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
73409 + *vma_m = *vma;
73410 + INIT_LIST_HEAD(&vma_m->anon_vma_chain);
73411 + if (anon_vma_clone(vma_m, vma))
73412 + return -ENOMEM;
73413 + pol_m = vma_policy(vma_m);
73414 + mpol_get(pol_m);
73415 + vma_set_policy(vma_m, pol_m);
73416 + vma_m->vm_start += SEGMEXEC_TASK_SIZE;
73417 + vma_m->vm_end += SEGMEXEC_TASK_SIZE;
73418 + vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
73419 + vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
73420 + if (vma_m->vm_file)
73421 + get_file(vma_m->vm_file);
73422 + if (vma_m->vm_ops && vma_m->vm_ops->open)
73423 + vma_m->vm_ops->open(vma_m);
73424 + find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
73425 + vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
73426 + vma_m->vm_mirror = vma;
73427 + vma->vm_mirror = vma_m;
73428 + return 0;
73429 +}
73430 +#endif
73431 +
73432 /*
73433 * Return true if the calling process may expand its vm space by the passed
73434 * number of pages
73435 @@ -2448,6 +2937,12 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
73436
73437 lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
73438
73439 +#ifdef CONFIG_PAX_RANDMMAP
73440 + if (mm->pax_flags & MF_PAX_RANDMMAP)
73441 + cur -= mm->brk_gap;
73442 +#endif
73443 +
73444 + gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
73445 if (cur + npages > lim)
73446 return 0;
73447 return 1;
73448 @@ -2518,6 +3013,22 @@ int install_special_mapping(struct mm_struct *mm,
73449 vma->vm_start = addr;
73450 vma->vm_end = addr + len;
73451
73452 +#ifdef CONFIG_PAX_MPROTECT
73453 + if (mm->pax_flags & MF_PAX_MPROTECT) {
73454 +#ifndef CONFIG_PAX_MPROTECT_COMPAT
73455 + if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
73456 + return -EPERM;
73457 + if (!(vm_flags & VM_EXEC))
73458 + vm_flags &= ~VM_MAYEXEC;
73459 +#else
73460 + if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
73461 + vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
73462 +#endif
73463 + else
73464 + vm_flags &= ~VM_MAYWRITE;
73465 + }
73466 +#endif
73467 +
73468 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
73469 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
73470
73471 diff --git a/mm/mprotect.c b/mm/mprotect.c
73472 index a409926..8b32e6d 100644
73473 --- a/mm/mprotect.c
73474 +++ b/mm/mprotect.c
73475 @@ -23,10 +23,17 @@
73476 #include <linux/mmu_notifier.h>
73477 #include <linux/migrate.h>
73478 #include <linux/perf_event.h>
73479 +
73480 +#ifdef CONFIG_PAX_MPROTECT
73481 +#include <linux/elf.h>
73482 +#include <linux/binfmts.h>
73483 +#endif
73484 +
73485 #include <asm/uaccess.h>
73486 #include <asm/pgtable.h>
73487 #include <asm/cacheflush.h>
73488 #include <asm/tlbflush.h>
73489 +#include <asm/mmu_context.h>
73490
73491 #ifndef pgprot_modify
73492 static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
73493 @@ -141,6 +148,48 @@ static void change_protection(struct vm_area_struct *vma,
73494 flush_tlb_range(vma, start, end);
73495 }
73496
73497 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
73498 +/* called while holding the mmap semaphor for writing except stack expansion */
73499 +void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
73500 +{
73501 + unsigned long oldlimit, newlimit = 0UL;
73502 +
73503 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || (__supported_pte_mask & _PAGE_NX))
73504 + return;
73505 +
73506 + spin_lock(&mm->page_table_lock);
73507 + oldlimit = mm->context.user_cs_limit;
73508 + if ((prot & VM_EXEC) && oldlimit < end)
73509 + /* USER_CS limit moved up */
73510 + newlimit = end;
73511 + else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
73512 + /* USER_CS limit moved down */
73513 + newlimit = start;
73514 +
73515 + if (newlimit) {
73516 + mm->context.user_cs_limit = newlimit;
73517 +
73518 +#ifdef CONFIG_SMP
73519 + wmb();
73520 + cpus_clear(mm->context.cpu_user_cs_mask);
73521 + cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
73522 +#endif
73523 +
73524 + set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
73525 + }
73526 + spin_unlock(&mm->page_table_lock);
73527 + if (newlimit == end) {
73528 + struct vm_area_struct *vma = find_vma(mm, oldlimit);
73529 +
73530 + for (; vma && vma->vm_start < end; vma = vma->vm_next)
73531 + if (is_vm_hugetlb_page(vma))
73532 + hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
73533 + else
73534 + change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
73535 + }
73536 +}
73537 +#endif
73538 +
73539 int
73540 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
73541 unsigned long start, unsigned long end, unsigned long newflags)
73542 @@ -153,11 +202,29 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
73543 int error;
73544 int dirty_accountable = 0;
73545
73546 +#ifdef CONFIG_PAX_SEGMEXEC
73547 + struct vm_area_struct *vma_m = NULL;
73548 + unsigned long start_m, end_m;
73549 +
73550 + start_m = start + SEGMEXEC_TASK_SIZE;
73551 + end_m = end + SEGMEXEC_TASK_SIZE;
73552 +#endif
73553 +
73554 if (newflags == oldflags) {
73555 *pprev = vma;
73556 return 0;
73557 }
73558
73559 + if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
73560 + struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
73561 +
73562 + if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
73563 + return -ENOMEM;
73564 +
73565 + if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
73566 + return -ENOMEM;
73567 + }
73568 +
73569 /*
73570 * If we make a private mapping writable we increase our commit;
73571 * but (without finer accounting) cannot reduce our commit if we
73572 @@ -174,6 +241,42 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
73573 }
73574 }
73575
73576 +#ifdef CONFIG_PAX_SEGMEXEC
73577 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
73578 + if (start != vma->vm_start) {
73579 + error = split_vma(mm, vma, start, 1);
73580 + if (error)
73581 + goto fail;
73582 + BUG_ON(!*pprev || (*pprev)->vm_next == vma);
73583 + *pprev = (*pprev)->vm_next;
73584 + }
73585 +
73586 + if (end != vma->vm_end) {
73587 + error = split_vma(mm, vma, end, 0);
73588 + if (error)
73589 + goto fail;
73590 + }
73591 +
73592 + if (pax_find_mirror_vma(vma)) {
73593 + error = __do_munmap(mm, start_m, end_m - start_m);
73594 + if (error)
73595 + goto fail;
73596 + } else {
73597 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73598 + if (!vma_m) {
73599 + error = -ENOMEM;
73600 + goto fail;
73601 + }
73602 + vma->vm_flags = newflags;
73603 + error = pax_mirror_vma(vma_m, vma);
73604 + if (error) {
73605 + vma->vm_flags = oldflags;
73606 + goto fail;
73607 + }
73608 + }
73609 + }
73610 +#endif
73611 +
73612 /*
73613 * First try to merge with previous and/or next vma.
73614 */
73615 @@ -204,9 +307,21 @@ success:
73616 * vm_flags and vm_page_prot are protected by the mmap_sem
73617 * held in write mode.
73618 */
73619 +
73620 +#ifdef CONFIG_PAX_SEGMEXEC
73621 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
73622 + pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
73623 +#endif
73624 +
73625 vma->vm_flags = newflags;
73626 +
73627 +#ifdef CONFIG_PAX_MPROTECT
73628 + if (mm->binfmt && mm->binfmt->handle_mprotect)
73629 + mm->binfmt->handle_mprotect(vma, newflags);
73630 +#endif
73631 +
73632 vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
73633 - vm_get_page_prot(newflags));
73634 + vm_get_page_prot(vma->vm_flags));
73635
73636 if (vma_wants_writenotify(vma)) {
73637 vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
73638 @@ -248,6 +363,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
73639 end = start + len;
73640 if (end <= start)
73641 return -ENOMEM;
73642 +
73643 +#ifdef CONFIG_PAX_SEGMEXEC
73644 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
73645 + if (end > SEGMEXEC_TASK_SIZE)
73646 + return -EINVAL;
73647 + } else
73648 +#endif
73649 +
73650 + if (end > TASK_SIZE)
73651 + return -EINVAL;
73652 +
73653 if (!arch_validate_prot(prot))
73654 return -EINVAL;
73655
73656 @@ -255,7 +381,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
73657 /*
73658 * Does the application expect PROT_READ to imply PROT_EXEC:
73659 */
73660 - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
73661 + if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
73662 prot |= PROT_EXEC;
73663
73664 vm_flags = calc_vm_prot_bits(prot);
73665 @@ -288,6 +414,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
73666 if (start > vma->vm_start)
73667 prev = vma;
73668
73669 +#ifdef CONFIG_PAX_MPROTECT
73670 + if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
73671 + current->mm->binfmt->handle_mprotect(vma, vm_flags);
73672 +#endif
73673 +
73674 for (nstart = start ; ; ) {
73675 unsigned long newflags;
73676
73677 @@ -297,6 +428,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
73678
73679 /* newflags >> 4 shift VM_MAY% in place of VM_% */
73680 if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
73681 + if (prot & (PROT_WRITE | PROT_EXEC))
73682 + gr_log_rwxmprotect(vma->vm_file);
73683 +
73684 + error = -EACCES;
73685 + goto out;
73686 + }
73687 +
73688 + if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
73689 error = -EACCES;
73690 goto out;
73691 }
73692 @@ -311,6 +450,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
73693 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
73694 if (error)
73695 goto out;
73696 +
73697 + track_exec_limit(current->mm, nstart, tmp, vm_flags);
73698 +
73699 nstart = tmp;
73700
73701 if (nstart < prev->vm_end)
73702 diff --git a/mm/mremap.c b/mm/mremap.c
73703 index 21fed20..6822658 100644
73704 --- a/mm/mremap.c
73705 +++ b/mm/mremap.c
73706 @@ -106,6 +106,12 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
73707 continue;
73708 pte = ptep_get_and_clear(mm, old_addr, old_pte);
73709 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
73710 +
73711 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
73712 + if (!(__supported_pte_mask & _PAGE_NX) && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
73713 + pte = pte_exprotect(pte);
73714 +#endif
73715 +
73716 set_pte_at(mm, new_addr, new_pte, pte);
73717 }
73718
73719 @@ -299,6 +305,11 @@ static struct vm_area_struct *vma_to_resize(unsigned long addr,
73720 if (is_vm_hugetlb_page(vma))
73721 goto Einval;
73722
73723 +#ifdef CONFIG_PAX_SEGMEXEC
73724 + if (pax_find_mirror_vma(vma))
73725 + goto Einval;
73726 +#endif
73727 +
73728 /* We can't remap across vm area boundaries */
73729 if (old_len > vma->vm_end - addr)
73730 goto Efault;
73731 @@ -355,20 +366,25 @@ static unsigned long mremap_to(unsigned long addr,
73732 unsigned long ret = -EINVAL;
73733 unsigned long charged = 0;
73734 unsigned long map_flags;
73735 + unsigned long pax_task_size = TASK_SIZE;
73736
73737 if (new_addr & ~PAGE_MASK)
73738 goto out;
73739
73740 - if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
73741 +#ifdef CONFIG_PAX_SEGMEXEC
73742 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
73743 + pax_task_size = SEGMEXEC_TASK_SIZE;
73744 +#endif
73745 +
73746 + pax_task_size -= PAGE_SIZE;
73747 +
73748 + if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
73749 goto out;
73750
73751 /* Check if the location we're moving into overlaps the
73752 * old location at all, and fail if it does.
73753 */
73754 - if ((new_addr <= addr) && (new_addr+new_len) > addr)
73755 - goto out;
73756 -
73757 - if ((addr <= new_addr) && (addr+old_len) > new_addr)
73758 + if (addr + old_len > new_addr && new_addr + new_len > addr)
73759 goto out;
73760
73761 ret = do_munmap(mm, new_addr, new_len);
73762 @@ -436,6 +452,7 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
73763 struct vm_area_struct *vma;
73764 unsigned long ret = -EINVAL;
73765 unsigned long charged = 0;
73766 + unsigned long pax_task_size = TASK_SIZE;
73767
73768 down_write(&current->mm->mmap_sem);
73769
73770 @@ -456,6 +473,17 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
73771 if (!new_len)
73772 goto out;
73773
73774 +#ifdef CONFIG_PAX_SEGMEXEC
73775 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
73776 + pax_task_size = SEGMEXEC_TASK_SIZE;
73777 +#endif
73778 +
73779 + pax_task_size -= PAGE_SIZE;
73780 +
73781 + if (new_len > pax_task_size || addr > pax_task_size-new_len ||
73782 + old_len > pax_task_size || addr > pax_task_size-old_len)
73783 + goto out;
73784 +
73785 if (flags & MREMAP_FIXED) {
73786 if (flags & MREMAP_MAYMOVE)
73787 ret = mremap_to(addr, old_len, new_addr, new_len);
73788 @@ -505,6 +533,7 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
73789 addr + new_len);
73790 }
73791 ret = addr;
73792 + track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
73793 goto out;
73794 }
73795 }
73796 @@ -528,7 +557,12 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
73797 goto out;
73798 }
73799
73800 + map_flags = vma->vm_flags;
73801 ret = move_vma(vma, addr, old_len, new_len, new_addr);
73802 + if (!(ret & ~PAGE_MASK)) {
73803 + track_exec_limit(current->mm, addr, addr + old_len, 0UL);
73804 + track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
73805 + }
73806 }
73807 out:
73808 if (ret & ~PAGE_MASK)
73809 diff --git a/mm/nommu.c b/mm/nommu.c
73810 index d4b0c10..ed421b5 100644
73811 --- a/mm/nommu.c
73812 +++ b/mm/nommu.c
73813 @@ -62,7 +62,6 @@ int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
73814 int sysctl_overcommit_ratio = 50; /* default is 50% */
73815 int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
73816 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
73817 -int heap_stack_gap = 0;
73818
73819 atomic_long_t mmap_pages_allocated;
73820
73821 @@ -827,15 +826,6 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
73822 EXPORT_SYMBOL(find_vma);
73823
73824 /*
73825 - * find a VMA
73826 - * - we don't extend stack VMAs under NOMMU conditions
73827 - */
73828 -struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
73829 -{
73830 - return find_vma(mm, addr);
73831 -}
73832 -
73833 -/*
73834 * expand a stack to a given address
73835 * - not supported under NOMMU conditions
73836 */
73837 @@ -1551,6 +1541,7 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
73838
73839 /* most fields are the same, copy all, and then fixup */
73840 *new = *vma;
73841 + INIT_LIST_HEAD(&new->anon_vma_chain);
73842 *region = *vma->vm_region;
73843 new->vm_region = region;
73844
73845 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
73846 index 201b508..1fb51ca 100644
73847 --- a/mm/page_alloc.c
73848 +++ b/mm/page_alloc.c
73849 @@ -336,7 +336,7 @@ out:
73850 * This usage means that zero-order pages may not be compound.
73851 */
73852
73853 -static void free_compound_page(struct page *page)
73854 +void free_compound_page(struct page *page)
73855 {
73856 __free_pages_ok(page, compound_order(page));
73857 }
73858 @@ -693,6 +693,10 @@ static bool free_pages_prepare(struct page *page, unsigned int order)
73859 int i;
73860 int bad = 0;
73861
73862 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
73863 + unsigned long index = 1UL << order;
73864 +#endif
73865 +
73866 trace_mm_page_free(page, order);
73867 kmemcheck_free_shadow(page, order);
73868
73869 @@ -708,6 +712,12 @@ static bool free_pages_prepare(struct page *page, unsigned int order)
73870 debug_check_no_obj_freed(page_address(page),
73871 PAGE_SIZE << order);
73872 }
73873 +
73874 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
73875 + for (; index; --index)
73876 + sanitize_highpage(page + index - 1);
73877 +#endif
73878 +
73879 arch_free_page(page, order);
73880 kernel_map_pages(page, 1 << order, 0);
73881
73882 @@ -849,8 +859,10 @@ static int prep_new_page(struct page *page, int order, gfp_t gfp_flags)
73883 arch_alloc_page(page, order);
73884 kernel_map_pages(page, 1 << order, 1);
73885
73886 +#ifndef CONFIG_PAX_MEMORY_SANITIZE
73887 if (gfp_flags & __GFP_ZERO)
73888 prep_zero_page(page, order, gfp_flags);
73889 +#endif
73890
73891 if (order && (gfp_flags & __GFP_COMP))
73892 prep_compound_page(page, order);
73893 @@ -3579,7 +3591,13 @@ static int pageblock_is_reserved(unsigned long start_pfn, unsigned long end_pfn)
73894 unsigned long pfn;
73895
73896 for (pfn = start_pfn; pfn < end_pfn; pfn++) {
73897 +#ifdef CONFIG_X86_32
73898 + /* boot failures in VMware 8 on 32bit vanilla since
73899 + this change */
73900 + if (!pfn_valid(pfn) || PageReserved(pfn_to_page(pfn)))
73901 +#else
73902 if (!pfn_valid_within(pfn) || PageReserved(pfn_to_page(pfn)))
73903 +#endif
73904 return 1;
73905 }
73906 return 0;
73907 diff --git a/mm/percpu.c b/mm/percpu.c
73908 index bb4be74..a43ea85 100644
73909 --- a/mm/percpu.c
73910 +++ b/mm/percpu.c
73911 @@ -122,7 +122,7 @@ static unsigned int pcpu_low_unit_cpu __read_mostly;
73912 static unsigned int pcpu_high_unit_cpu __read_mostly;
73913
73914 /* the address of the first chunk which starts with the kernel static area */
73915 -void *pcpu_base_addr __read_mostly;
73916 +void *pcpu_base_addr __read_only;
73917 EXPORT_SYMBOL_GPL(pcpu_base_addr);
73918
73919 static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
73920 diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c
73921 index 926b466..b23df53 100644
73922 --- a/mm/process_vm_access.c
73923 +++ b/mm/process_vm_access.c
73924 @@ -13,6 +13,7 @@
73925 #include <linux/uio.h>
73926 #include <linux/sched.h>
73927 #include <linux/highmem.h>
73928 +#include <linux/security.h>
73929 #include <linux/ptrace.h>
73930 #include <linux/slab.h>
73931 #include <linux/syscalls.h>
73932 @@ -258,19 +259,19 @@ static ssize_t process_vm_rw_core(pid_t pid, const struct iovec *lvec,
73933 size_t iov_l_curr_offset = 0;
73934 ssize_t iov_len;
73935
73936 + return -ENOSYS; // PaX: until properly audited
73937 +
73938 /*
73939 * Work out how many pages of struct pages we're going to need
73940 * when eventually calling get_user_pages
73941 */
73942 for (i = 0; i < riovcnt; i++) {
73943 iov_len = rvec[i].iov_len;
73944 - if (iov_len > 0) {
73945 - nr_pages_iov = ((unsigned long)rvec[i].iov_base
73946 - + iov_len)
73947 - / PAGE_SIZE - (unsigned long)rvec[i].iov_base
73948 - / PAGE_SIZE + 1;
73949 - nr_pages = max(nr_pages, nr_pages_iov);
73950 - }
73951 + if (iov_len <= 0)
73952 + continue;
73953 + nr_pages_iov = ((unsigned long)rvec[i].iov_base + iov_len) / PAGE_SIZE -
73954 + (unsigned long)rvec[i].iov_base / PAGE_SIZE + 1;
73955 + nr_pages = max(nr_pages, nr_pages_iov);
73956 }
73957
73958 if (nr_pages == 0)
73959 @@ -298,6 +299,11 @@ static ssize_t process_vm_rw_core(pid_t pid, const struct iovec *lvec,
73960 goto free_proc_pages;
73961 }
73962
73963 + if (gr_handle_ptrace(task, vm_write ? PTRACE_POKETEXT : PTRACE_ATTACH)) {
73964 + rc = -EPERM;
73965 + goto put_task_struct;
73966 + }
73967 +
73968 mm = mm_access(task, PTRACE_MODE_ATTACH);
73969 if (!mm || IS_ERR(mm)) {
73970 rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
73971 diff --git a/mm/rmap.c b/mm/rmap.c
73972 index 0f3b7cd..c5652b6 100644
73973 --- a/mm/rmap.c
73974 +++ b/mm/rmap.c
73975 @@ -167,6 +167,10 @@ int anon_vma_prepare(struct vm_area_struct *vma)
73976 struct anon_vma *anon_vma = vma->anon_vma;
73977 struct anon_vma_chain *avc;
73978
73979 +#ifdef CONFIG_PAX_SEGMEXEC
73980 + struct anon_vma_chain *avc_m = NULL;
73981 +#endif
73982 +
73983 might_sleep();
73984 if (unlikely(!anon_vma)) {
73985 struct mm_struct *mm = vma->vm_mm;
73986 @@ -176,6 +180,12 @@ int anon_vma_prepare(struct vm_area_struct *vma)
73987 if (!avc)
73988 goto out_enomem;
73989
73990 +#ifdef CONFIG_PAX_SEGMEXEC
73991 + avc_m = anon_vma_chain_alloc(GFP_KERNEL);
73992 + if (!avc_m)
73993 + goto out_enomem_free_avc;
73994 +#endif
73995 +
73996 anon_vma = find_mergeable_anon_vma(vma);
73997 allocated = NULL;
73998 if (!anon_vma) {
73999 @@ -189,6 +199,18 @@ int anon_vma_prepare(struct vm_area_struct *vma)
74000 /* page_table_lock to protect against threads */
74001 spin_lock(&mm->page_table_lock);
74002 if (likely(!vma->anon_vma)) {
74003 +
74004 +#ifdef CONFIG_PAX_SEGMEXEC
74005 + struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
74006 +
74007 + if (vma_m) {
74008 + BUG_ON(vma_m->anon_vma);
74009 + vma_m->anon_vma = anon_vma;
74010 + anon_vma_chain_link(vma_m, avc_m, anon_vma);
74011 + avc_m = NULL;
74012 + }
74013 +#endif
74014 +
74015 vma->anon_vma = anon_vma;
74016 anon_vma_chain_link(vma, avc, anon_vma);
74017 allocated = NULL;
74018 @@ -199,12 +221,24 @@ int anon_vma_prepare(struct vm_area_struct *vma)
74019
74020 if (unlikely(allocated))
74021 put_anon_vma(allocated);
74022 +
74023 +#ifdef CONFIG_PAX_SEGMEXEC
74024 + if (unlikely(avc_m))
74025 + anon_vma_chain_free(avc_m);
74026 +#endif
74027 +
74028 if (unlikely(avc))
74029 anon_vma_chain_free(avc);
74030 }
74031 return 0;
74032
74033 out_enomem_free_avc:
74034 +
74035 +#ifdef CONFIG_PAX_SEGMEXEC
74036 + if (avc_m)
74037 + anon_vma_chain_free(avc_m);
74038 +#endif
74039 +
74040 anon_vma_chain_free(avc);
74041 out_enomem:
74042 return -ENOMEM;
74043 @@ -240,7 +274,7 @@ static inline void unlock_anon_vma_root(struct anon_vma *root)
74044 * Attach the anon_vmas from src to dst.
74045 * Returns 0 on success, -ENOMEM on failure.
74046 */
74047 -int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
74048 +int anon_vma_clone(struct vm_area_struct *dst, const struct vm_area_struct *src)
74049 {
74050 struct anon_vma_chain *avc, *pavc;
74051 struct anon_vma *root = NULL;
74052 @@ -318,7 +352,7 @@ void anon_vma_moveto_tail(struct vm_area_struct *dst)
74053 * the corresponding VMA in the parent process is attached to.
74054 * Returns 0 on success, non-zero on failure.
74055 */
74056 -int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
74057 +int anon_vma_fork(struct vm_area_struct *vma, const struct vm_area_struct *pvma)
74058 {
74059 struct anon_vma_chain *avc;
74060 struct anon_vma *anon_vma;
74061 diff --git a/mm/shmem.c b/mm/shmem.c
74062 index bd10636..5c16d49 100644
74063 --- a/mm/shmem.c
74064 +++ b/mm/shmem.c
74065 @@ -31,7 +31,7 @@
74066 #include <linux/export.h>
74067 #include <linux/swap.h>
74068
74069 -static struct vfsmount *shm_mnt;
74070 +struct vfsmount *shm_mnt;
74071
74072 #ifdef CONFIG_SHMEM
74073 /*
74074 @@ -75,7 +75,7 @@ static struct vfsmount *shm_mnt;
74075 #define BOGO_DIRENT_SIZE 20
74076
74077 /* Symlink up to this size is kmalloc'ed instead of using a swappable page */
74078 -#define SHORT_SYMLINK_LEN 128
74079 +#define SHORT_SYMLINK_LEN 64
74080
74081 struct shmem_xattr {
74082 struct list_head list; /* anchored by shmem_inode_info->xattr_list */
74083 @@ -2590,8 +2590,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
74084 int err = -ENOMEM;
74085
74086 /* Round up to L1_CACHE_BYTES to resist false sharing */
74087 - sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
74088 - L1_CACHE_BYTES), GFP_KERNEL);
74089 + sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
74090 if (!sbinfo)
74091 return -ENOMEM;
74092
74093 diff --git a/mm/slab.c b/mm/slab.c
74094 index e901a36..9ff3f90 100644
74095 --- a/mm/slab.c
74096 +++ b/mm/slab.c
74097 @@ -153,7 +153,7 @@
74098
74099 /* Legal flag mask for kmem_cache_create(). */
74100 #if DEBUG
74101 -# define CREATE_MASK (SLAB_RED_ZONE | \
74102 +# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
74103 SLAB_POISON | SLAB_HWCACHE_ALIGN | \
74104 SLAB_CACHE_DMA | \
74105 SLAB_STORE_USER | \
74106 @@ -161,7 +161,7 @@
74107 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
74108 SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
74109 #else
74110 -# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
74111 +# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
74112 SLAB_CACHE_DMA | \
74113 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
74114 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
74115 @@ -290,7 +290,7 @@ struct kmem_list3 {
74116 * Need this for bootstrapping a per node allocator.
74117 */
74118 #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
74119 -static struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
74120 +static struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
74121 #define CACHE_CACHE 0
74122 #define SIZE_AC MAX_NUMNODES
74123 #define SIZE_L3 (2 * MAX_NUMNODES)
74124 @@ -391,10 +391,10 @@ static void kmem_list3_init(struct kmem_list3 *parent)
74125 if ((x)->max_freeable < i) \
74126 (x)->max_freeable = i; \
74127 } while (0)
74128 -#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
74129 -#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
74130 -#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
74131 -#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
74132 +#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
74133 +#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
74134 +#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
74135 +#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
74136 #else
74137 #define STATS_INC_ACTIVE(x) do { } while (0)
74138 #define STATS_DEC_ACTIVE(x) do { } while (0)
74139 @@ -542,7 +542,7 @@ static inline void *index_to_obj(struct kmem_cache *cache, struct slab *slab,
74140 * reciprocal_divide(offset, cache->reciprocal_buffer_size)
74141 */
74142 static inline unsigned int obj_to_index(const struct kmem_cache *cache,
74143 - const struct slab *slab, void *obj)
74144 + const struct slab *slab, const void *obj)
74145 {
74146 u32 offset = (obj - slab->s_mem);
74147 return reciprocal_divide(offset, cache->reciprocal_buffer_size);
74148 @@ -563,12 +563,13 @@ EXPORT_SYMBOL(malloc_sizes);
74149 struct cache_names {
74150 char *name;
74151 char *name_dma;
74152 + char *name_usercopy;
74153 };
74154
74155 static struct cache_names __initdata cache_names[] = {
74156 -#define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
74157 +#define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)", .name_usercopy = "size-" #x "(USERCOPY)" },
74158 #include <linux/kmalloc_sizes.h>
74159 - {NULL,}
74160 + {NULL}
74161 #undef CACHE
74162 };
74163
74164 @@ -756,6 +757,12 @@ static inline struct kmem_cache *__find_general_cachep(size_t size,
74165 if (unlikely(gfpflags & GFP_DMA))
74166 return csizep->cs_dmacachep;
74167 #endif
74168 +
74169 +#ifdef CONFIG_PAX_USERCOPY_SLABS
74170 + if (unlikely(gfpflags & GFP_USERCOPY))
74171 + return csizep->cs_usercopycachep;
74172 +#endif
74173 +
74174 return csizep->cs_cachep;
74175 }
74176
74177 @@ -1588,7 +1595,7 @@ void __init kmem_cache_init(void)
74178 sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
74179 sizes[INDEX_AC].cs_size,
74180 ARCH_KMALLOC_MINALIGN,
74181 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74182 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74183 NULL);
74184
74185 if (INDEX_AC != INDEX_L3) {
74186 @@ -1596,7 +1603,7 @@ void __init kmem_cache_init(void)
74187 kmem_cache_create(names[INDEX_L3].name,
74188 sizes[INDEX_L3].cs_size,
74189 ARCH_KMALLOC_MINALIGN,
74190 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74191 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74192 NULL);
74193 }
74194
74195 @@ -1614,7 +1621,7 @@ void __init kmem_cache_init(void)
74196 sizes->cs_cachep = kmem_cache_create(names->name,
74197 sizes->cs_size,
74198 ARCH_KMALLOC_MINALIGN,
74199 - ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74200 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74201 NULL);
74202 }
74203 #ifdef CONFIG_ZONE_DMA
74204 @@ -1626,6 +1633,16 @@ void __init kmem_cache_init(void)
74205 SLAB_PANIC,
74206 NULL);
74207 #endif
74208 +
74209 +#ifdef CONFIG_PAX_USERCOPY_SLABS
74210 + sizes->cs_usercopycachep = kmem_cache_create(
74211 + names->name_usercopy,
74212 + sizes->cs_size,
74213 + ARCH_KMALLOC_MINALIGN,
74214 + ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74215 + NULL);
74216 +#endif
74217 +
74218 sizes++;
74219 names++;
74220 }
74221 @@ -4390,10 +4407,10 @@ static int s_show(struct seq_file *m, void *p)
74222 }
74223 /* cpu stats */
74224 {
74225 - unsigned long allochit = atomic_read(&cachep->allochit);
74226 - unsigned long allocmiss = atomic_read(&cachep->allocmiss);
74227 - unsigned long freehit = atomic_read(&cachep->freehit);
74228 - unsigned long freemiss = atomic_read(&cachep->freemiss);
74229 + unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
74230 + unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
74231 + unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
74232 + unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
74233
74234 seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
74235 allochit, allocmiss, freehit, freemiss);
74236 @@ -4652,13 +4669,71 @@ static int __init slab_proc_init(void)
74237 {
74238 proc_create("slabinfo",S_IWUSR|S_IRUSR,NULL,&proc_slabinfo_operations);
74239 #ifdef CONFIG_DEBUG_SLAB_LEAK
74240 - proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
74241 + proc_create("slab_allocators", S_IRUSR, NULL, &proc_slabstats_operations);
74242 #endif
74243 return 0;
74244 }
74245 module_init(slab_proc_init);
74246 #endif
74247
74248 +bool is_usercopy_object(const void *ptr)
74249 +{
74250 + struct page *page;
74251 + struct kmem_cache *cachep;
74252 +
74253 + if (ZERO_OR_NULL_PTR(ptr))
74254 + return false;
74255 +
74256 + if (!slab_is_available())
74257 + return false;
74258 +
74259 + if (!virt_addr_valid(ptr))
74260 + return false;
74261 +
74262 + page = virt_to_head_page(ptr);
74263 +
74264 + if (!PageSlab(page))
74265 + return false;
74266 +
74267 + cachep = page_get_cache(page);
74268 + return cachep->flags & SLAB_USERCOPY;
74269 +}
74270 +
74271 +#ifdef CONFIG_PAX_USERCOPY
74272 +const char *check_heap_object(const void *ptr, unsigned long n, bool to)
74273 +{
74274 + struct page *page;
74275 + struct kmem_cache *cachep;
74276 + struct slab *slabp;
74277 + unsigned int objnr;
74278 + unsigned long offset;
74279 +
74280 + if (ZERO_OR_NULL_PTR(ptr))
74281 + return "<null>";
74282 +
74283 + if (!virt_addr_valid(ptr))
74284 + return NULL;
74285 +
74286 + page = virt_to_head_page(ptr);
74287 +
74288 + if (!PageSlab(page))
74289 + return NULL;
74290 +
74291 + cachep = page_get_cache(page);
74292 + if (!(cachep->flags & SLAB_USERCOPY))
74293 + return cachep->name;
74294 +
74295 + slabp = page_get_slab(page);
74296 + objnr = obj_to_index(cachep, slabp, ptr);
74297 + BUG_ON(objnr >= cachep->num);
74298 + offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
74299 + if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
74300 + return NULL;
74301 +
74302 + return cachep->name;
74303 +}
74304 +#endif
74305 +
74306 /**
74307 * ksize - get the actual amount of memory allocated for a given object
74308 * @objp: Pointer to the object
74309 diff --git a/mm/slob.c b/mm/slob.c
74310 index 8105be4..33e52d7 100644
74311 --- a/mm/slob.c
74312 +++ b/mm/slob.c
74313 @@ -29,7 +29,7 @@
74314 * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
74315 * alloc_pages() directly, allocating compound pages so the page order
74316 * does not have to be separately tracked, and also stores the exact
74317 - * allocation size in page->private so that it can be used to accurately
74318 + * allocation size in slob_page->size so that it can be used to accurately
74319 * provide ksize(). These objects are detected in kfree() because slob_page()
74320 * is false for them.
74321 *
74322 @@ -58,6 +58,7 @@
74323 */
74324
74325 #include <linux/kernel.h>
74326 +#include <linux/sched.h>
74327 #include <linux/slab.h>
74328 #include <linux/mm.h>
74329 #include <linux/swap.h> /* struct reclaim_state */
74330 @@ -100,9 +101,8 @@ struct slob_page {
74331 union {
74332 struct {
74333 unsigned long flags; /* mandatory */
74334 - atomic_t _count; /* mandatory */
74335 slobidx_t units; /* free units left in page */
74336 - unsigned long pad[2];
74337 + unsigned long size; /* size when >=PAGE_SIZE */
74338 slob_t *free; /* first free slob_t in page */
74339 struct list_head list; /* linked list of free pages */
74340 };
74341 @@ -135,7 +135,7 @@ static LIST_HEAD(free_slob_large);
74342 */
74343 static inline int is_slob_page(struct slob_page *sp)
74344 {
74345 - return PageSlab((struct page *)sp);
74346 + return PageSlab((struct page *)sp) && !sp->size;
74347 }
74348
74349 static inline void set_slob_page(struct slob_page *sp)
74350 @@ -150,7 +150,7 @@ static inline void clear_slob_page(struct slob_page *sp)
74351
74352 static inline struct slob_page *slob_page(const void *addr)
74353 {
74354 - return (struct slob_page *)virt_to_page(addr);
74355 + return (struct slob_page *)virt_to_head_page(addr);
74356 }
74357
74358 /*
74359 @@ -210,7 +210,7 @@ static void set_slob(slob_t *s, slobidx_t size, slob_t *next)
74360 /*
74361 * Return the size of a slob block.
74362 */
74363 -static slobidx_t slob_units(slob_t *s)
74364 +static slobidx_t slob_units(const slob_t *s)
74365 {
74366 if (s->units > 0)
74367 return s->units;
74368 @@ -220,7 +220,7 @@ static slobidx_t slob_units(slob_t *s)
74369 /*
74370 * Return the next free slob block pointer after this one.
74371 */
74372 -static slob_t *slob_next(slob_t *s)
74373 +static slob_t *slob_next(const slob_t *s)
74374 {
74375 slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
74376 slobidx_t next;
74377 @@ -235,7 +235,7 @@ static slob_t *slob_next(slob_t *s)
74378 /*
74379 * Returns true if s is the last free block in its page.
74380 */
74381 -static int slob_last(slob_t *s)
74382 +static int slob_last(const slob_t *s)
74383 {
74384 return !((unsigned long)slob_next(s) & ~PAGE_MASK);
74385 }
74386 @@ -254,6 +254,7 @@ static void *slob_new_pages(gfp_t gfp, int order, int node)
74387 if (!page)
74388 return NULL;
74389
74390 + set_slob_page(page);
74391 return page_address(page);
74392 }
74393
74394 @@ -370,11 +371,11 @@ static void *slob_alloc(size_t size, gfp_t gfp, int align, int node)
74395 if (!b)
74396 return NULL;
74397 sp = slob_page(b);
74398 - set_slob_page(sp);
74399
74400 spin_lock_irqsave(&slob_lock, flags);
74401 sp->units = SLOB_UNITS(PAGE_SIZE);
74402 sp->free = b;
74403 + sp->size = 0;
74404 INIT_LIST_HEAD(&sp->list);
74405 set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
74406 set_slob_page_free(sp, slob_list);
74407 @@ -476,10 +477,9 @@ out:
74408 * End of slob allocator proper. Begin kmem_cache_alloc and kmalloc frontend.
74409 */
74410
74411 -void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74412 +static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
74413 {
74414 - unsigned int *m;
74415 - int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74416 + slob_t *m;
74417 void *ret;
74418
74419 gfp &= gfp_allowed_mask;
74420 @@ -494,7 +494,10 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74421
74422 if (!m)
74423 return NULL;
74424 - *m = size;
74425 + BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
74426 + BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
74427 + m[0].units = size;
74428 + m[1].units = align;
74429 ret = (void *)m + align;
74430
74431 trace_kmalloc_node(_RET_IP_, ret,
74432 @@ -506,16 +509,25 @@ void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74433 gfp |= __GFP_COMP;
74434 ret = slob_new_pages(gfp, order, node);
74435 if (ret) {
74436 - struct page *page;
74437 - page = virt_to_page(ret);
74438 - page->private = size;
74439 + struct slob_page *sp;
74440 + sp = slob_page(ret);
74441 + sp->size = size;
74442 }
74443
74444 trace_kmalloc_node(_RET_IP_, ret,
74445 size, PAGE_SIZE << order, gfp, node);
74446 }
74447
74448 - kmemleak_alloc(ret, size, 1, gfp);
74449 + return ret;
74450 +}
74451 +
74452 +void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74453 +{
74454 + int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74455 + void *ret = __kmalloc_node_align(size, gfp, node, align);
74456 +
74457 + if (!ZERO_OR_NULL_PTR(ret))
74458 + kmemleak_alloc(ret, size, 1, gfp);
74459 return ret;
74460 }
74461 EXPORT_SYMBOL(__kmalloc_node);
74462 @@ -533,13 +545,88 @@ void kfree(const void *block)
74463 sp = slob_page(block);
74464 if (is_slob_page(sp)) {
74465 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74466 - unsigned int *m = (unsigned int *)(block - align);
74467 - slob_free(m, *m + align);
74468 - } else
74469 + slob_t *m = (slob_t *)(block - align);
74470 + slob_free(m, m[0].units + align);
74471 + } else {
74472 + clear_slob_page(sp);
74473 + free_slob_page(sp);
74474 + sp->size = 0;
74475 put_page(&sp->page);
74476 + }
74477 }
74478 EXPORT_SYMBOL(kfree);
74479
74480 +bool is_usercopy_object(const void *ptr)
74481 +{
74482 + if (!slab_is_available())
74483 + return false;
74484 +
74485 + // PAX: TODO
74486 +
74487 + return false;
74488 +}
74489 +
74490 +#ifdef CONFIG_PAX_USERCOPY
74491 +const char *check_heap_object(const void *ptr, unsigned long n, bool to)
74492 +{
74493 + struct slob_page *sp;
74494 + const slob_t *free;
74495 + const void *base;
74496 + unsigned long flags;
74497 +
74498 + if (ZERO_OR_NULL_PTR(ptr))
74499 + return "<null>";
74500 +
74501 + if (!virt_addr_valid(ptr))
74502 + return NULL;
74503 +
74504 + sp = slob_page(ptr);
74505 + if (!PageSlab((struct page *)sp))
74506 + return NULL;
74507 +
74508 + if (sp->size) {
74509 + base = page_address(&sp->page);
74510 + if (base <= ptr && n <= sp->size - (ptr - base))
74511 + return NULL;
74512 + return "<slob>";
74513 + }
74514 +
74515 + /* some tricky double walking to find the chunk */
74516 + spin_lock_irqsave(&slob_lock, flags);
74517 + base = (void *)((unsigned long)ptr & PAGE_MASK);
74518 + free = sp->free;
74519 +
74520 + while ((void *)free <= ptr) {
74521 + base = free + slob_units(free);
74522 + free = slob_next(free);
74523 + }
74524 +
74525 + while (base < (void *)free) {
74526 + slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
74527 + int size = SLOB_UNIT * SLOB_UNITS(m + align);
74528 + int offset;
74529 +
74530 + if (ptr < base + align)
74531 + break;
74532 +
74533 + offset = ptr - base - align;
74534 + if (offset >= m) {
74535 + base += size;
74536 + continue;
74537 + }
74538 +
74539 + if (n > m - offset)
74540 + break;
74541 +
74542 + spin_unlock_irqrestore(&slob_lock, flags);
74543 + return NULL;
74544 + }
74545 +
74546 + spin_unlock_irqrestore(&slob_lock, flags);
74547 + return "<slob>";
74548 +}
74549 +#endif
74550 +
74551 /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
74552 size_t ksize(const void *block)
74553 {
74554 @@ -552,10 +639,10 @@ size_t ksize(const void *block)
74555 sp = slob_page(block);
74556 if (is_slob_page(sp)) {
74557 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74558 - unsigned int *m = (unsigned int *)(block - align);
74559 - return SLOB_UNITS(*m) * SLOB_UNIT;
74560 + slob_t *m = (slob_t *)(block - align);
74561 + return SLOB_UNITS(m[0].units) * SLOB_UNIT;
74562 } else
74563 - return sp->page.private;
74564 + return sp->size;
74565 }
74566 EXPORT_SYMBOL(ksize);
74567
74568 @@ -571,8 +658,13 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
74569 {
74570 struct kmem_cache *c;
74571
74572 +#ifdef CONFIG_PAX_USERCOPY_SLABS
74573 + c = __kmalloc_node_align(sizeof(struct kmem_cache),
74574 + GFP_KERNEL, -1, ARCH_KMALLOC_MINALIGN);
74575 +#else
74576 c = slob_alloc(sizeof(struct kmem_cache),
74577 GFP_KERNEL, ARCH_KMALLOC_MINALIGN, -1);
74578 +#endif
74579
74580 if (c) {
74581 c->name = name;
74582 @@ -614,17 +706,25 @@ void *kmem_cache_alloc_node(struct kmem_cache *c, gfp_t flags, int node)
74583
74584 lockdep_trace_alloc(flags);
74585
74586 +#ifdef CONFIG_PAX_USERCOPY_SLABS
74587 + b = __kmalloc_node_align(c->size, flags, node, c->align);
74588 +#else
74589 if (c->size < PAGE_SIZE) {
74590 b = slob_alloc(c->size, flags, c->align, node);
74591 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
74592 SLOB_UNITS(c->size) * SLOB_UNIT,
74593 flags, node);
74594 } else {
74595 + struct slob_page *sp;
74596 +
74597 b = slob_new_pages(flags, get_order(c->size), node);
74598 + sp = slob_page(b);
74599 + sp->size = c->size;
74600 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
74601 PAGE_SIZE << get_order(c->size),
74602 flags, node);
74603 }
74604 +#endif
74605
74606 if (c->ctor)
74607 c->ctor(b);
74608 @@ -636,10 +736,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
74609
74610 static void __kmem_cache_free(void *b, int size)
74611 {
74612 - if (size < PAGE_SIZE)
74613 + struct slob_page *sp = slob_page(b);
74614 +
74615 + if (is_slob_page(sp))
74616 slob_free(b, size);
74617 - else
74618 + else {
74619 + clear_slob_page(sp);
74620 + free_slob_page(sp);
74621 + sp->size = 0;
74622 slob_free_pages(b, get_order(size));
74623 + }
74624 }
74625
74626 static void kmem_rcu_free(struct rcu_head *head)
74627 @@ -652,17 +758,31 @@ static void kmem_rcu_free(struct rcu_head *head)
74628
74629 void kmem_cache_free(struct kmem_cache *c, void *b)
74630 {
74631 + int size = c->size;
74632 +
74633 +#ifdef CONFIG_PAX_USERCOPY_SLABS
74634 + if (size + c->align < PAGE_SIZE) {
74635 + size += c->align;
74636 + b -= c->align;
74637 + }
74638 +#endif
74639 +
74640 kmemleak_free_recursive(b, c->flags);
74641 if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
74642 struct slob_rcu *slob_rcu;
74643 - slob_rcu = b + (c->size - sizeof(struct slob_rcu));
74644 - slob_rcu->size = c->size;
74645 + slob_rcu = b + (size - sizeof(struct slob_rcu));
74646 + slob_rcu->size = size;
74647 call_rcu(&slob_rcu->head, kmem_rcu_free);
74648 } else {
74649 - __kmem_cache_free(b, c->size);
74650 + __kmem_cache_free(b, size);
74651 }
74652
74653 +#ifdef CONFIG_PAX_USERCOPY_SLABS
74654 + trace_kfree(_RET_IP_, b);
74655 +#else
74656 trace_kmem_cache_free(_RET_IP_, b);
74657 +#endif
74658 +
74659 }
74660 EXPORT_SYMBOL(kmem_cache_free);
74661
74662 diff --git a/mm/slub.c b/mm/slub.c
74663 index 8c691fa..2993c2b 100644
74664 --- a/mm/slub.c
74665 +++ b/mm/slub.c
74666 @@ -209,7 +209,7 @@ struct track {
74667
74668 enum track_item { TRACK_ALLOC, TRACK_FREE };
74669
74670 -#ifdef CONFIG_SYSFS
74671 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
74672 static int sysfs_slab_add(struct kmem_cache *);
74673 static int sysfs_slab_alias(struct kmem_cache *, const char *);
74674 static void sysfs_slab_remove(struct kmem_cache *);
74675 @@ -538,7 +538,7 @@ static void print_track(const char *s, struct track *t)
74676 if (!t->addr)
74677 return;
74678
74679 - printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
74680 + printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
74681 s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
74682 #ifdef CONFIG_STACKTRACE
74683 {
74684 @@ -2603,6 +2603,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
74685
74686 page = virt_to_head_page(x);
74687
74688 + BUG_ON(!PageSlab(page));
74689 +
74690 slab_free(s, page, x, _RET_IP_);
74691
74692 trace_kmem_cache_free(_RET_IP_, x);
74693 @@ -2636,7 +2638,7 @@ static int slub_min_objects;
74694 * Merge control. If this is set then no merging of slab caches will occur.
74695 * (Could be removed. This was introduced to pacify the merge skeptics.)
74696 */
74697 -static int slub_nomerge;
74698 +static int slub_nomerge = 1;
74699
74700 /*
74701 * Calculate the order of allocation given an slab object size.
74702 @@ -3089,7 +3091,7 @@ static int kmem_cache_open(struct kmem_cache *s,
74703 else
74704 s->cpu_partial = 30;
74705
74706 - s->refcount = 1;
74707 + atomic_set(&s->refcount, 1);
74708 #ifdef CONFIG_NUMA
74709 s->remote_node_defrag_ratio = 1000;
74710 #endif
74711 @@ -3193,8 +3195,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
74712 void kmem_cache_destroy(struct kmem_cache *s)
74713 {
74714 down_write(&slub_lock);
74715 - s->refcount--;
74716 - if (!s->refcount) {
74717 + if (atomic_dec_and_test(&s->refcount)) {
74718 list_del(&s->list);
74719 up_write(&slub_lock);
74720 if (kmem_cache_close(s)) {
74721 @@ -3223,6 +3224,10 @@ static struct kmem_cache *kmem_cache;
74722 static struct kmem_cache *kmalloc_dma_caches[SLUB_PAGE_SHIFT];
74723 #endif
74724
74725 +#ifdef CONFIG_PAX_USERCOPY_SLABS
74726 +static struct kmem_cache *kmalloc_usercopy_caches[SLUB_PAGE_SHIFT];
74727 +#endif
74728 +
74729 static int __init setup_slub_min_order(char *str)
74730 {
74731 get_option(&str, &slub_min_order);
74732 @@ -3337,6 +3342,13 @@ static struct kmem_cache *get_slab(size_t size, gfp_t flags)
74733 return kmalloc_dma_caches[index];
74734
74735 #endif
74736 +
74737 +#ifdef CONFIG_PAX_USERCOPY_SLABS
74738 + if (flags & SLAB_USERCOPY)
74739 + return kmalloc_usercopy_caches[index];
74740 +
74741 +#endif
74742 +
74743 return kmalloc_caches[index];
74744 }
74745
74746 @@ -3405,6 +3417,59 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
74747 EXPORT_SYMBOL(__kmalloc_node);
74748 #endif
74749
74750 +bool is_usercopy_object(const void *ptr)
74751 +{
74752 + struct page *page;
74753 + struct kmem_cache *s;
74754 +
74755 + if (ZERO_OR_NULL_PTR(ptr))
74756 + return false;
74757 +
74758 + if (!slab_is_available())
74759 + return false;
74760 +
74761 + if (!virt_addr_valid(ptr))
74762 + return false;
74763 +
74764 + page = virt_to_head_page(ptr);
74765 +
74766 + if (!PageSlab(page))
74767 + return false;
74768 +
74769 + s = page->slab;
74770 + return s->flags & SLAB_USERCOPY;
74771 +}
74772 +
74773 +#ifdef CONFIG_PAX_USERCOPY
74774 +const char *check_heap_object(const void *ptr, unsigned long n, bool to)
74775 +{
74776 + struct page *page;
74777 + struct kmem_cache *s;
74778 + unsigned long offset;
74779 +
74780 + if (ZERO_OR_NULL_PTR(ptr))
74781 + return "<null>";
74782 +
74783 + if (!virt_addr_valid(ptr))
74784 + return NULL;
74785 +
74786 + page = virt_to_head_page(ptr);
74787 +
74788 + if (!PageSlab(page))
74789 + return NULL;
74790 +
74791 + s = page->slab;
74792 + if (!(s->flags & SLAB_USERCOPY))
74793 + return s->name;
74794 +
74795 + offset = (ptr - page_address(page)) % s->size;
74796 + if (offset <= s->objsize && n <= s->objsize - offset)
74797 + return NULL;
74798 +
74799 + return s->name;
74800 +}
74801 +#endif
74802 +
74803 size_t ksize(const void *object)
74804 {
74805 struct page *page;
74806 @@ -3679,7 +3744,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s)
74807 int node;
74808
74809 list_add(&s->list, &slab_caches);
74810 - s->refcount = -1;
74811 + atomic_set(&s->refcount, -1);
74812
74813 for_each_node_state(node, N_NORMAL_MEMORY) {
74814 struct kmem_cache_node *n = get_node(s, node);
74815 @@ -3799,17 +3864,17 @@ void __init kmem_cache_init(void)
74816
74817 /* Caches that are not of the two-to-the-power-of size */
74818 if (KMALLOC_MIN_SIZE <= 32) {
74819 - kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, 0);
74820 + kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, SLAB_USERCOPY);
74821 caches++;
74822 }
74823
74824 if (KMALLOC_MIN_SIZE <= 64) {
74825 - kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, 0);
74826 + kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, SLAB_USERCOPY);
74827 caches++;
74828 }
74829
74830 for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
74831 - kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, 0);
74832 + kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, SLAB_USERCOPY);
74833 caches++;
74834 }
74835
74836 @@ -3851,6 +3916,22 @@ void __init kmem_cache_init(void)
74837 }
74838 }
74839 #endif
74840 +
74841 +#ifdef CONFIG_PAX_USERCOPY_SLABS
74842 + for (i = 0; i < SLUB_PAGE_SHIFT; i++) {
74843 + struct kmem_cache *s = kmalloc_caches[i];
74844 +
74845 + if (s && s->size) {
74846 + char *name = kasprintf(GFP_NOWAIT,
74847 + "usercopy-kmalloc-%d", s->objsize);
74848 +
74849 + BUG_ON(!name);
74850 + kmalloc_usercopy_caches[i] = create_kmalloc_cache(name,
74851 + s->objsize, SLAB_USERCOPY);
74852 + }
74853 + }
74854 +#endif
74855 +
74856 printk(KERN_INFO
74857 "SLUB: Genslabs=%d, HWalign=%d, Order=%d-%d, MinObjects=%d,"
74858 " CPUs=%d, Nodes=%d\n",
74859 @@ -3877,7 +3958,7 @@ static int slab_unmergeable(struct kmem_cache *s)
74860 /*
74861 * We may have set a slab to be unmergeable during bootstrap.
74862 */
74863 - if (s->refcount < 0)
74864 + if (atomic_read(&s->refcount) < 0)
74865 return 1;
74866
74867 return 0;
74868 @@ -3936,7 +4017,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
74869 down_write(&slub_lock);
74870 s = find_mergeable(size, align, flags, name, ctor);
74871 if (s) {
74872 - s->refcount++;
74873 + atomic_inc(&s->refcount);
74874 /*
74875 * Adjust the object sizes so that we clear
74876 * the complete object on kzalloc.
74877 @@ -3945,7 +4026,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
74878 s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
74879
74880 if (sysfs_slab_alias(s, name)) {
74881 - s->refcount--;
74882 + atomic_dec(&s->refcount);
74883 goto err;
74884 }
74885 up_write(&slub_lock);
74886 @@ -4074,7 +4155,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
74887 }
74888 #endif
74889
74890 -#ifdef CONFIG_SYSFS
74891 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
74892 static int count_inuse(struct page *page)
74893 {
74894 return page->inuse;
74895 @@ -4461,12 +4542,12 @@ static void resiliency_test(void)
74896 validate_slab_cache(kmalloc_caches[9]);
74897 }
74898 #else
74899 -#ifdef CONFIG_SYSFS
74900 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
74901 static void resiliency_test(void) {};
74902 #endif
74903 #endif
74904
74905 -#ifdef CONFIG_SYSFS
74906 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
74907 enum slab_stat_type {
74908 SL_ALL, /* All slabs */
74909 SL_PARTIAL, /* Only partially allocated slabs */
74910 @@ -4709,7 +4790,7 @@ SLAB_ATTR_RO(ctor);
74911
74912 static ssize_t aliases_show(struct kmem_cache *s, char *buf)
74913 {
74914 - return sprintf(buf, "%d\n", s->refcount - 1);
74915 + return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
74916 }
74917 SLAB_ATTR_RO(aliases);
74918
74919 @@ -5280,6 +5361,7 @@ static char *create_unique_id(struct kmem_cache *s)
74920 return name;
74921 }
74922
74923 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
74924 static int sysfs_slab_add(struct kmem_cache *s)
74925 {
74926 int err;
74927 @@ -5342,6 +5424,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
74928 kobject_del(&s->kobj);
74929 kobject_put(&s->kobj);
74930 }
74931 +#endif
74932
74933 /*
74934 * Need to buffer aliases during bootup until sysfs becomes
74935 @@ -5355,6 +5438,7 @@ struct saved_alias {
74936
74937 static struct saved_alias *alias_list;
74938
74939 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
74940 static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
74941 {
74942 struct saved_alias *al;
74943 @@ -5377,6 +5461,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
74944 alias_list = al;
74945 return 0;
74946 }
74947 +#endif
74948
74949 static int __init slab_sysfs_init(void)
74950 {
74951 diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c
74952 index 1b7e22a..3fcd4f3 100644
74953 --- a/mm/sparse-vmemmap.c
74954 +++ b/mm/sparse-vmemmap.c
74955 @@ -128,7 +128,7 @@ pud_t * __meminit vmemmap_pud_populate(pgd_t *pgd, unsigned long addr, int node)
74956 void *p = vmemmap_alloc_block(PAGE_SIZE, node);
74957 if (!p)
74958 return NULL;
74959 - pud_populate(&init_mm, pud, p);
74960 + pud_populate_kernel(&init_mm, pud, p);
74961 }
74962 return pud;
74963 }
74964 @@ -140,7 +140,7 @@ pgd_t * __meminit vmemmap_pgd_populate(unsigned long addr, int node)
74965 void *p = vmemmap_alloc_block(PAGE_SIZE, node);
74966 if (!p)
74967 return NULL;
74968 - pgd_populate(&init_mm, pgd, p);
74969 + pgd_populate_kernel(&init_mm, pgd, p);
74970 }
74971 return pgd;
74972 }
74973 diff --git a/mm/swap.c b/mm/swap.c
74974 index 4e7e2ec..0c57830 100644
74975 --- a/mm/swap.c
74976 +++ b/mm/swap.c
74977 @@ -30,6 +30,7 @@
74978 #include <linux/backing-dev.h>
74979 #include <linux/memcontrol.h>
74980 #include <linux/gfp.h>
74981 +#include <linux/hugetlb.h>
74982
74983 #include "internal.h"
74984
74985 @@ -72,6 +73,8 @@ static void __put_compound_page(struct page *page)
74986
74987 __page_cache_release(page);
74988 dtor = get_compound_page_dtor(page);
74989 + if (!PageHuge(page))
74990 + BUG_ON(dtor != free_compound_page);
74991 (*dtor)(page);
74992 }
74993
74994 diff --git a/mm/swapfile.c b/mm/swapfile.c
74995 index 71373d0..11fa7d9 100644
74996 --- a/mm/swapfile.c
74997 +++ b/mm/swapfile.c
74998 @@ -63,7 +63,7 @@ static DEFINE_MUTEX(swapon_mutex);
74999
75000 static DECLARE_WAIT_QUEUE_HEAD(proc_poll_wait);
75001 /* Activity counter to indicate that a swapon or swapoff has occurred */
75002 -static atomic_t proc_poll_event = ATOMIC_INIT(0);
75003 +static atomic_unchecked_t proc_poll_event = ATOMIC_INIT(0);
75004
75005 static inline unsigned char swap_count(unsigned char ent)
75006 {
75007 @@ -1663,7 +1663,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
75008 }
75009 filp_close(swap_file, NULL);
75010 err = 0;
75011 - atomic_inc(&proc_poll_event);
75012 + atomic_inc_unchecked(&proc_poll_event);
75013 wake_up_interruptible(&proc_poll_wait);
75014
75015 out_dput:
75016 @@ -1679,8 +1679,8 @@ static unsigned swaps_poll(struct file *file, poll_table *wait)
75017
75018 poll_wait(file, &proc_poll_wait, wait);
75019
75020 - if (seq->poll_event != atomic_read(&proc_poll_event)) {
75021 - seq->poll_event = atomic_read(&proc_poll_event);
75022 + if (seq->poll_event != atomic_read_unchecked(&proc_poll_event)) {
75023 + seq->poll_event = atomic_read_unchecked(&proc_poll_event);
75024 return POLLIN | POLLRDNORM | POLLERR | POLLPRI;
75025 }
75026
75027 @@ -1778,7 +1778,7 @@ static int swaps_open(struct inode *inode, struct file *file)
75028 return ret;
75029
75030 seq = file->private_data;
75031 - seq->poll_event = atomic_read(&proc_poll_event);
75032 + seq->poll_event = atomic_read_unchecked(&proc_poll_event);
75033 return 0;
75034 }
75035
75036 @@ -2120,7 +2120,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
75037 (frontswap_map) ? "FS" : "");
75038
75039 mutex_unlock(&swapon_mutex);
75040 - atomic_inc(&proc_poll_event);
75041 + atomic_inc_unchecked(&proc_poll_event);
75042 wake_up_interruptible(&proc_poll_wait);
75043
75044 if (S_ISREG(inode->i_mode))
75045 diff --git a/mm/util.c b/mm/util.c
75046 index 8c7265a..c96d884 100644
75047 --- a/mm/util.c
75048 +++ b/mm/util.c
75049 @@ -285,6 +285,12 @@ done:
75050 void arch_pick_mmap_layout(struct mm_struct *mm)
75051 {
75052 mm->mmap_base = TASK_UNMAPPED_BASE;
75053 +
75054 +#ifdef CONFIG_PAX_RANDMMAP
75055 + if (mm->pax_flags & MF_PAX_RANDMMAP)
75056 + mm->mmap_base += mm->delta_mmap;
75057 +#endif
75058 +
75059 mm->get_unmapped_area = arch_get_unmapped_area;
75060 mm->unmap_area = arch_unmap_area;
75061 }
75062 diff --git a/mm/vmalloc.c b/mm/vmalloc.c
75063 index 2aad499..4006a74 100644
75064 --- a/mm/vmalloc.c
75065 +++ b/mm/vmalloc.c
75066 @@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end)
75067
75068 pte = pte_offset_kernel(pmd, addr);
75069 do {
75070 - pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
75071 - WARN_ON(!pte_none(ptent) && !pte_present(ptent));
75072 +
75073 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75074 + if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
75075 + BUG_ON(!pte_exec(*pte));
75076 + set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
75077 + continue;
75078 + }
75079 +#endif
75080 +
75081 + {
75082 + pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
75083 + WARN_ON(!pte_none(ptent) && !pte_present(ptent));
75084 + }
75085 } while (pte++, addr += PAGE_SIZE, addr != end);
75086 }
75087
75088 @@ -91,6 +102,7 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr,
75089 unsigned long end, pgprot_t prot, struct page **pages, int *nr)
75090 {
75091 pte_t *pte;
75092 + int ret = -ENOMEM;
75093
75094 /*
75095 * nr is a running index into the array which helps higher level
75096 @@ -100,17 +112,30 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr,
75097 pte = pte_alloc_kernel(pmd, addr);
75098 if (!pte)
75099 return -ENOMEM;
75100 +
75101 + pax_open_kernel();
75102 do {
75103 struct page *page = pages[*nr];
75104
75105 - if (WARN_ON(!pte_none(*pte)))
75106 - return -EBUSY;
75107 - if (WARN_ON(!page))
75108 - return -ENOMEM;
75109 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75110 + if (pgprot_val(prot) & _PAGE_NX)
75111 +#endif
75112 +
75113 + if (WARN_ON(!pte_none(*pte))) {
75114 + ret = -EBUSY;
75115 + goto out;
75116 + }
75117 + if (WARN_ON(!page)) {
75118 + ret = -ENOMEM;
75119 + goto out;
75120 + }
75121 set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
75122 (*nr)++;
75123 } while (pte++, addr += PAGE_SIZE, addr != end);
75124 - return 0;
75125 + ret = 0;
75126 +out:
75127 + pax_close_kernel();
75128 + return ret;
75129 }
75130
75131 static int vmap_pmd_range(pud_t *pud, unsigned long addr,
75132 @@ -119,7 +144,7 @@ static int vmap_pmd_range(pud_t *pud, unsigned long addr,
75133 pmd_t *pmd;
75134 unsigned long next;
75135
75136 - pmd = pmd_alloc(&init_mm, pud, addr);
75137 + pmd = pmd_alloc_kernel(&init_mm, pud, addr);
75138 if (!pmd)
75139 return -ENOMEM;
75140 do {
75141 @@ -136,7 +161,7 @@ static int vmap_pud_range(pgd_t *pgd, unsigned long addr,
75142 pud_t *pud;
75143 unsigned long next;
75144
75145 - pud = pud_alloc(&init_mm, pgd, addr);
75146 + pud = pud_alloc_kernel(&init_mm, pgd, addr);
75147 if (!pud)
75148 return -ENOMEM;
75149 do {
75150 @@ -191,11 +216,20 @@ int is_vmalloc_or_module_addr(const void *x)
75151 * and fall back on vmalloc() if that fails. Others
75152 * just put it in the vmalloc space.
75153 */
75154 -#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
75155 +#ifdef CONFIG_MODULES
75156 +#ifdef MODULES_VADDR
75157 unsigned long addr = (unsigned long)x;
75158 if (addr >= MODULES_VADDR && addr < MODULES_END)
75159 return 1;
75160 #endif
75161 +
75162 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75163 + if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
75164 + return 1;
75165 +#endif
75166 +
75167 +#endif
75168 +
75169 return is_vmalloc_addr(x);
75170 }
75171
75172 @@ -216,8 +250,14 @@ struct page *vmalloc_to_page(const void *vmalloc_addr)
75173
75174 if (!pgd_none(*pgd)) {
75175 pud_t *pud = pud_offset(pgd, addr);
75176 +#ifdef CONFIG_X86
75177 + if (!pud_large(*pud))
75178 +#endif
75179 if (!pud_none(*pud)) {
75180 pmd_t *pmd = pmd_offset(pud, addr);
75181 +#ifdef CONFIG_X86
75182 + if (!pmd_large(*pmd))
75183 +#endif
75184 if (!pmd_none(*pmd)) {
75185 pte_t *ptep, pte;
75186
75187 @@ -329,7 +369,7 @@ static void purge_vmap_area_lazy(void);
75188 * Allocate a region of KVA of the specified size and alignment, within the
75189 * vstart and vend.
75190 */
75191 -static struct vmap_area *alloc_vmap_area(unsigned long size,
75192 +static __size_overflow(1) struct vmap_area *alloc_vmap_area(unsigned long size,
75193 unsigned long align,
75194 unsigned long vstart, unsigned long vend,
75195 int node, gfp_t gfp_mask)
75196 @@ -1320,6 +1360,16 @@ static struct vm_struct *__get_vm_area_node(unsigned long size,
75197 struct vm_struct *area;
75198
75199 BUG_ON(in_interrupt());
75200 +
75201 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
75202 + if (flags & VM_KERNEXEC) {
75203 + if (start != VMALLOC_START || end != VMALLOC_END)
75204 + return NULL;
75205 + start = (unsigned long)MODULES_EXEC_VADDR;
75206 + end = (unsigned long)MODULES_EXEC_END;
75207 + }
75208 +#endif
75209 +
75210 if (flags & VM_IOREMAP) {
75211 int bit = fls(size);
75212
75213 @@ -1552,6 +1602,11 @@ void *vmap(struct page **pages, unsigned int count,
75214 if (count > totalram_pages)
75215 return NULL;
75216
75217 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
75218 + if (!(pgprot_val(prot) & _PAGE_NX))
75219 + flags |= VM_KERNEXEC;
75220 +#endif
75221 +
75222 area = get_vm_area_caller((count << PAGE_SHIFT), flags,
75223 __builtin_return_address(0));
75224 if (!area)
75225 @@ -1653,6 +1708,13 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
75226 if (!size || (size >> PAGE_SHIFT) > totalram_pages)
75227 goto fail;
75228
75229 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
75230 + if (!(pgprot_val(prot) & _PAGE_NX))
75231 + area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST | VM_KERNEXEC,
75232 + VMALLOC_START, VMALLOC_END, node, gfp_mask, caller);
75233 + else
75234 +#endif
75235 +
75236 area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNLIST,
75237 start, end, node, gfp_mask, caller);
75238 if (!area)
75239 @@ -1826,10 +1888,9 @@ EXPORT_SYMBOL(vzalloc_node);
75240 * For tight control over page level allocator and protection flags
75241 * use __vmalloc() instead.
75242 */
75243 -
75244 void *vmalloc_exec(unsigned long size)
75245 {
75246 - return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
75247 + return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
75248 -1, __builtin_return_address(0));
75249 }
75250
75251 @@ -2124,6 +2185,8 @@ int remap_vmalloc_range(struct vm_area_struct *vma, void *addr,
75252 unsigned long uaddr = vma->vm_start;
75253 unsigned long usize = vma->vm_end - vma->vm_start;
75254
75255 + BUG_ON(vma->vm_mirror);
75256 +
75257 if ((PAGE_SIZE-1) & (unsigned long)addr)
75258 return -EINVAL;
75259
75260 diff --git a/mm/vmstat.c b/mm/vmstat.c
75261 index 1bbbbd9..ff35669 100644
75262 --- a/mm/vmstat.c
75263 +++ b/mm/vmstat.c
75264 @@ -78,7 +78,7 @@ void vm_events_fold_cpu(int cpu)
75265 *
75266 * vm_stat contains the global counters
75267 */
75268 -atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS] __cacheline_aligned_in_smp;
75269 +atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS] __cacheline_aligned_in_smp;
75270 EXPORT_SYMBOL(vm_stat);
75271
75272 #ifdef CONFIG_SMP
75273 @@ -454,7 +454,7 @@ void refresh_cpu_vm_stats(int cpu)
75274 v = p->vm_stat_diff[i];
75275 p->vm_stat_diff[i] = 0;
75276 local_irq_restore(flags);
75277 - atomic_long_add(v, &zone->vm_stat[i]);
75278 + atomic_long_add_unchecked(v, &zone->vm_stat[i]);
75279 global_diff[i] += v;
75280 #ifdef CONFIG_NUMA
75281 /* 3 seconds idle till flush */
75282 @@ -492,7 +492,7 @@ void refresh_cpu_vm_stats(int cpu)
75283
75284 for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
75285 if (global_diff[i])
75286 - atomic_long_add(global_diff[i], &vm_stat[i]);
75287 + atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
75288 }
75289
75290 #endif
75291 @@ -1211,10 +1211,20 @@ static int __init setup_vmstat(void)
75292 start_cpu_timer(cpu);
75293 #endif
75294 #ifdef CONFIG_PROC_FS
75295 - proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
75296 - proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
75297 - proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
75298 - proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
75299 + {
75300 + mode_t gr_mode = S_IRUGO;
75301 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
75302 + gr_mode = S_IRUSR;
75303 +#endif
75304 + proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
75305 + proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
75306 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
75307 + proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
75308 +#else
75309 + proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
75310 +#endif
75311 + proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
75312 + }
75313 #endif
75314 return 0;
75315 }
75316 diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
75317 index 9096bcb..43ed7bb 100644
75318 --- a/net/8021q/vlan.c
75319 +++ b/net/8021q/vlan.c
75320 @@ -557,8 +557,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg)
75321 err = -EPERM;
75322 if (!capable(CAP_NET_ADMIN))
75323 break;
75324 - if ((args.u.name_type >= 0) &&
75325 - (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
75326 + if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
75327 struct vlan_net *vn;
75328
75329 vn = net_generic(net, vlan_net_id);
75330 diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
75331 index 6449bae..8c1f454 100644
75332 --- a/net/9p/trans_fd.c
75333 +++ b/net/9p/trans_fd.c
75334 @@ -425,7 +425,7 @@ static int p9_fd_write(struct p9_client *client, void *v, int len)
75335 oldfs = get_fs();
75336 set_fs(get_ds());
75337 /* The cast to a user pointer is valid due to the set_fs() */
75338 - ret = vfs_write(ts->wr, (__force void __user *)v, len, &ts->wr->f_pos);
75339 + ret = vfs_write(ts->wr, (void __force_user *)v, len, &ts->wr->f_pos);
75340 set_fs(oldfs);
75341
75342 if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN)
75343 diff --git a/net/atm/atm_misc.c b/net/atm/atm_misc.c
75344 index 876fbe8..8bbea9f 100644
75345 --- a/net/atm/atm_misc.c
75346 +++ b/net/atm/atm_misc.c
75347 @@ -17,7 +17,7 @@ int atm_charge(struct atm_vcc *vcc, int truesize)
75348 if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
75349 return 1;
75350 atm_return(vcc, truesize);
75351 - atomic_inc(&vcc->stats->rx_drop);
75352 + atomic_inc_unchecked(&vcc->stats->rx_drop);
75353 return 0;
75354 }
75355 EXPORT_SYMBOL(atm_charge);
75356 @@ -39,7 +39,7 @@ struct sk_buff *atm_alloc_charge(struct atm_vcc *vcc, int pdu_size,
75357 }
75358 }
75359 atm_return(vcc, guess);
75360 - atomic_inc(&vcc->stats->rx_drop);
75361 + atomic_inc_unchecked(&vcc->stats->rx_drop);
75362 return NULL;
75363 }
75364 EXPORT_SYMBOL(atm_alloc_charge);
75365 @@ -86,7 +86,7 @@ EXPORT_SYMBOL(atm_pcr_goal);
75366
75367 void sonet_copy_stats(struct k_sonet_stats *from, struct sonet_stats *to)
75368 {
75369 -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
75370 +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
75371 __SONET_ITEMS
75372 #undef __HANDLE_ITEM
75373 }
75374 @@ -94,7 +94,7 @@ EXPORT_SYMBOL(sonet_copy_stats);
75375
75376 void sonet_subtract_stats(struct k_sonet_stats *from, struct sonet_stats *to)
75377 {
75378 -#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
75379 +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
75380 __SONET_ITEMS
75381 #undef __HANDLE_ITEM
75382 }
75383 diff --git a/net/atm/common.c b/net/atm/common.c
75384 index b4b44db..0c0ad93 100644
75385 --- a/net/atm/common.c
75386 +++ b/net/atm/common.c
75387 @@ -812,6 +812,7 @@ int vcc_getsockopt(struct socket *sock, int level, int optname,
75388
75389 if (!vcc->dev || !test_bit(ATM_VF_ADDR, &vcc->flags))
75390 return -ENOTCONN;
75391 + memset(&pvc, 0, sizeof(pvc));
75392 pvc.sap_family = AF_ATMPVC;
75393 pvc.sap_addr.itf = vcc->dev->number;
75394 pvc.sap_addr.vpi = vcc->vpi;
75395 diff --git a/net/atm/lec.h b/net/atm/lec.h
75396 index a86aff9..3a0d6f6 100644
75397 --- a/net/atm/lec.h
75398 +++ b/net/atm/lec.h
75399 @@ -48,7 +48,7 @@ struct lane2_ops {
75400 const u8 *tlvs, u32 sizeoftlvs);
75401 void (*associate_indicator) (struct net_device *dev, const u8 *mac_addr,
75402 const u8 *tlvs, u32 sizeoftlvs);
75403 -};
75404 +} __no_const;
75405
75406 /*
75407 * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
75408 diff --git a/net/atm/mpc.h b/net/atm/mpc.h
75409 index 0919a88..a23d54e 100644
75410 --- a/net/atm/mpc.h
75411 +++ b/net/atm/mpc.h
75412 @@ -33,7 +33,7 @@ struct mpoa_client {
75413 struct mpc_parameters parameters; /* parameters for this client */
75414
75415 const struct net_device_ops *old_ops;
75416 - struct net_device_ops new_ops;
75417 + net_device_ops_no_const new_ops;
75418 };
75419
75420
75421 diff --git a/net/atm/proc.c b/net/atm/proc.c
75422 index 0d020de..011c7bb 100644
75423 --- a/net/atm/proc.c
75424 +++ b/net/atm/proc.c
75425 @@ -45,9 +45,9 @@ static void add_stats(struct seq_file *seq, const char *aal,
75426 const struct k_atm_aal_stats *stats)
75427 {
75428 seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
75429 - atomic_read(&stats->tx), atomic_read(&stats->tx_err),
75430 - atomic_read(&stats->rx), atomic_read(&stats->rx_err),
75431 - atomic_read(&stats->rx_drop));
75432 + atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
75433 + atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
75434 + atomic_read_unchecked(&stats->rx_drop));
75435 }
75436
75437 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
75438 diff --git a/net/atm/pvc.c b/net/atm/pvc.c
75439 index 3a73491..ae03240 100644
75440 --- a/net/atm/pvc.c
75441 +++ b/net/atm/pvc.c
75442 @@ -95,6 +95,7 @@ static int pvc_getname(struct socket *sock, struct sockaddr *sockaddr,
75443 return -ENOTCONN;
75444 *sockaddr_len = sizeof(struct sockaddr_atmpvc);
75445 addr = (struct sockaddr_atmpvc *)sockaddr;
75446 + memset(addr, 0, sizeof(*addr));
75447 addr->sap_family = AF_ATMPVC;
75448 addr->sap_addr.itf = vcc->dev->number;
75449 addr->sap_addr.vpi = vcc->vpi;
75450 diff --git a/net/atm/resources.c b/net/atm/resources.c
75451 index 23f45ce..c748f1a 100644
75452 --- a/net/atm/resources.c
75453 +++ b/net/atm/resources.c
75454 @@ -160,7 +160,7 @@ EXPORT_SYMBOL(atm_dev_deregister);
75455 static void copy_aal_stats(struct k_atm_aal_stats *from,
75456 struct atm_aal_stats *to)
75457 {
75458 -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
75459 +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
75460 __AAL_STAT_ITEMS
75461 #undef __HANDLE_ITEM
75462 }
75463 @@ -168,7 +168,7 @@ static void copy_aal_stats(struct k_atm_aal_stats *from,
75464 static void subtract_aal_stats(struct k_atm_aal_stats *from,
75465 struct atm_aal_stats *to)
75466 {
75467 -#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
75468 +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
75469 __AAL_STAT_ITEMS
75470 #undef __HANDLE_ITEM
75471 }
75472 diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
75473 index dc53798..dc66333 100644
75474 --- a/net/batman-adv/bat_iv_ogm.c
75475 +++ b/net/batman-adv/bat_iv_ogm.c
75476 @@ -63,7 +63,7 @@ static int bat_iv_ogm_iface_enable(struct hard_iface *hard_iface)
75477
75478 /* randomize initial seqno to avoid collision */
75479 get_random_bytes(&random_seqno, sizeof(random_seqno));
75480 - atomic_set(&hard_iface->seqno, random_seqno);
75481 + atomic_set_unchecked(&hard_iface->seqno, random_seqno);
75482
75483 hard_iface->packet_len = BATMAN_OGM_HLEN;
75484 hard_iface->packet_buff = kmalloc(hard_iface->packet_len, GFP_ATOMIC);
75485 @@ -572,7 +572,7 @@ static void bat_iv_ogm_schedule(struct hard_iface *hard_iface,
75486
75487 /* change sequence number to network order */
75488 batman_ogm_packet->seqno =
75489 - htonl((uint32_t)atomic_read(&hard_iface->seqno));
75490 + htonl((uint32_t)atomic_read_unchecked(&hard_iface->seqno));
75491
75492 batman_ogm_packet->ttvn = atomic_read(&bat_priv->ttvn);
75493 batman_ogm_packet->tt_crc = htons((uint16_t)
75494 @@ -592,7 +592,7 @@ static void bat_iv_ogm_schedule(struct hard_iface *hard_iface,
75495 else
75496 batman_ogm_packet->gw_flags = NO_FLAGS;
75497
75498 - atomic_inc(&hard_iface->seqno);
75499 + atomic_inc_unchecked(&hard_iface->seqno);
75500
75501 slide_own_bcast_window(hard_iface);
75502 bat_iv_ogm_queue_add(bat_priv, hard_iface->packet_buff,
75503 @@ -956,7 +956,7 @@ static void bat_iv_ogm_process(const struct ethhdr *ethhdr,
75504 return;
75505
75506 /* could be changed by schedule_own_packet() */
75507 - if_incoming_seqno = atomic_read(&if_incoming->seqno);
75508 + if_incoming_seqno = atomic_read_unchecked(&if_incoming->seqno);
75509
75510 has_directlink_flag = (batman_ogm_packet->flags & DIRECTLINK ? 1 : 0);
75511
75512 diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
75513 index dc334fa..766a01a 100644
75514 --- a/net/batman-adv/hard-interface.c
75515 +++ b/net/batman-adv/hard-interface.c
75516 @@ -321,7 +321,7 @@ int hardif_enable_interface(struct hard_iface *hard_iface,
75517 hard_iface->batman_adv_ptype.dev = hard_iface->net_dev;
75518 dev_add_pack(&hard_iface->batman_adv_ptype);
75519
75520 - atomic_set(&hard_iface->frag_seqno, 1);
75521 + atomic_set_unchecked(&hard_iface->frag_seqno, 1);
75522 bat_info(hard_iface->soft_iface, "Adding interface: %s\n",
75523 hard_iface->net_dev->name);
75524
75525 @@ -444,7 +444,7 @@ static struct hard_iface *hardif_add_interface(struct net_device *net_dev)
75526 * This can't be called via a bat_priv callback because
75527 * we have no bat_priv yet.
75528 */
75529 - atomic_set(&hard_iface->seqno, 1);
75530 + atomic_set_unchecked(&hard_iface->seqno, 1);
75531 hard_iface->packet_buff = NULL;
75532
75533 return hard_iface;
75534 diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
75535 index a0ec0e4..7beb587 100644
75536 --- a/net/batman-adv/soft-interface.c
75537 +++ b/net/batman-adv/soft-interface.c
75538 @@ -214,7 +214,7 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
75539
75540 /* set broadcast sequence number */
75541 bcast_packet->seqno =
75542 - htonl(atomic_inc_return(&bat_priv->bcast_seqno));
75543 + htonl(atomic_inc_return_unchecked(&bat_priv->bcast_seqno));
75544
75545 add_bcast_packet_to_list(bat_priv, skb, 1);
75546
75547 @@ -390,7 +390,7 @@ struct net_device *softif_create(const char *name)
75548 atomic_set(&bat_priv->batman_queue_left, BATMAN_QUEUE_LEN);
75549
75550 atomic_set(&bat_priv->mesh_state, MESH_INACTIVE);
75551 - atomic_set(&bat_priv->bcast_seqno, 1);
75552 + atomic_set_unchecked(&bat_priv->bcast_seqno, 1);
75553 atomic_set(&bat_priv->ttvn, 0);
75554 atomic_set(&bat_priv->tt_local_changes, 0);
75555 atomic_set(&bat_priv->tt_ogm_append_cnt, 0);
75556 diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
75557 index 61308e8..2e142b2 100644
75558 --- a/net/batman-adv/types.h
75559 +++ b/net/batman-adv/types.h
75560 @@ -38,8 +38,8 @@ struct hard_iface {
75561 int16_t if_num;
75562 char if_status;
75563 struct net_device *net_dev;
75564 - atomic_t seqno;
75565 - atomic_t frag_seqno;
75566 + atomic_unchecked_t seqno;
75567 + atomic_unchecked_t frag_seqno;
75568 unsigned char *packet_buff;
75569 int packet_len;
75570 struct kobject *hardif_obj;
75571 @@ -163,7 +163,7 @@ struct bat_priv {
75572 atomic_t orig_interval; /* uint */
75573 atomic_t hop_penalty; /* uint */
75574 atomic_t log_level; /* uint */
75575 - atomic_t bcast_seqno;
75576 + atomic_unchecked_t bcast_seqno;
75577 atomic_t bcast_queue_left;
75578 atomic_t batman_queue_left;
75579 atomic_t ttvn; /* translation table version number */
75580 diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c
75581 index 74175c2..32f8901 100644
75582 --- a/net/batman-adv/unicast.c
75583 +++ b/net/batman-adv/unicast.c
75584 @@ -264,7 +264,7 @@ int frag_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv,
75585 frag1->flags = UNI_FRAG_HEAD | large_tail;
75586 frag2->flags = large_tail;
75587
75588 - seqno = atomic_add_return(2, &hard_iface->frag_seqno);
75589 + seqno = atomic_add_return_unchecked(2, &hard_iface->frag_seqno);
75590 frag1->seqno = htons(seqno - 1);
75591 frag2->seqno = htons(seqno);
75592
75593 diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
75594 index 5914623..bedc768 100644
75595 --- a/net/bluetooth/hci_sock.c
75596 +++ b/net/bluetooth/hci_sock.c
75597 @@ -706,6 +706,7 @@ static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, int *add
75598 *addr_len = sizeof(*haddr);
75599 haddr->hci_family = AF_BLUETOOTH;
75600 haddr->hci_dev = hdev->id;
75601 + haddr->hci_channel= 0;
75602
75603 release_sock(sk);
75604 return 0;
75605 @@ -1016,6 +1017,7 @@ static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char
75606 {
75607 struct hci_filter *f = &hci_pi(sk)->filter;
75608
75609 + memset(&uf, 0, sizeof(uf));
75610 uf.type_mask = f->type_mask;
75611 uf.opcode = f->opcode;
75612 uf.event_mask[0] = *((u32 *) f->event_mask + 0);
75613 diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
75614 index 7568a6f..ea3097b 100644
75615 --- a/net/bluetooth/l2cap_core.c
75616 +++ b/net/bluetooth/l2cap_core.c
75617 @@ -2799,8 +2799,10 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, voi
75618 break;
75619
75620 case L2CAP_CONF_RFC:
75621 - if (olen == sizeof(rfc))
75622 - memcpy(&rfc, (void *)val, olen);
75623 + if (olen != sizeof(rfc))
75624 + break;
75625 +
75626 + memcpy(&rfc, (void *)val, olen);
75627
75628 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
75629 rfc.mode != chan->mode)
75630 diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
75631 index 3bb1611..fcf656b 100644
75632 --- a/net/bluetooth/l2cap_sock.c
75633 +++ b/net/bluetooth/l2cap_sock.c
75634 @@ -246,6 +246,7 @@ static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *l
75635
75636 BT_DBG("sock %p, sk %p", sock, sk);
75637
75638 + memset(la, 0, sizeof(struct sockaddr_l2));
75639 addr->sa_family = AF_BLUETOOTH;
75640 *len = sizeof(struct sockaddr_l2);
75641
75642 diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
75643 index e8707de..2df6956 100644
75644 --- a/net/bluetooth/rfcomm/sock.c
75645 +++ b/net/bluetooth/rfcomm/sock.c
75646 @@ -547,6 +547,7 @@ static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *
75647
75648 BT_DBG("sock %p, sk %p", sock, sk);
75649
75650 + memset(sa, 0, sizeof(*sa));
75651 sa->rc_family = AF_BLUETOOTH;
75652 sa->rc_channel = rfcomm_pi(sk)->channel;
75653 if (peer)
75654 @@ -841,6 +842,7 @@ static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, c
75655 }
75656
75657 sec.level = rfcomm_pi(sk)->sec_level;
75658 + sec.key_size = 0;
75659
75660 len = min_t(unsigned int, len, sizeof(sec));
75661 if (copy_to_user(optval, (char *) &sec, len))
75662 diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
75663 index d1820ff..4f8c8f6 100644
75664 --- a/net/bluetooth/rfcomm/tty.c
75665 +++ b/net/bluetooth/rfcomm/tty.c
75666 @@ -314,7 +314,7 @@ static void rfcomm_dev_del(struct rfcomm_dev *dev)
75667 BUG_ON(test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags));
75668
75669 spin_lock_irqsave(&dev->port.lock, flags);
75670 - if (dev->port.count > 0) {
75671 + if (atomic_read(&dev->port.count) > 0) {
75672 spin_unlock_irqrestore(&dev->port.lock, flags);
75673 return;
75674 }
75675 @@ -461,7 +461,7 @@ static int rfcomm_get_dev_list(void __user *arg)
75676
75677 size = sizeof(*dl) + dev_num * sizeof(*di);
75678
75679 - dl = kmalloc(size, GFP_KERNEL);
75680 + dl = kzalloc(size, GFP_KERNEL);
75681 if (!dl)
75682 return -ENOMEM;
75683
75684 @@ -669,10 +669,10 @@ static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
75685 return -ENODEV;
75686
75687 BT_DBG("dev %p dst %s channel %d opened %d", dev, batostr(&dev->dst),
75688 - dev->channel, dev->port.count);
75689 + dev->channel, atomic_read(&dev->port.count));
75690
75691 spin_lock_irqsave(&dev->port.lock, flags);
75692 - if (++dev->port.count > 1) {
75693 + if (atomic_inc_return(&dev->port.count) > 1) {
75694 spin_unlock_irqrestore(&dev->port.lock, flags);
75695 return 0;
75696 }
75697 @@ -737,10 +737,10 @@ static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
75698 return;
75699
75700 BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc,
75701 - dev->port.count);
75702 + atomic_read(&dev->port.count));
75703
75704 spin_lock_irqsave(&dev->port.lock, flags);
75705 - if (!--dev->port.count) {
75706 + if (!atomic_dec_return(&dev->port.count)) {
75707 spin_unlock_irqrestore(&dev->port.lock, flags);
75708 if (dev->tty_dev->parent)
75709 device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
75710 diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
75711 index 5fe2ff3..10968b5 100644
75712 --- a/net/bridge/netfilter/ebtables.c
75713 +++ b/net/bridge/netfilter/ebtables.c
75714 @@ -1523,7 +1523,7 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
75715 tmp.valid_hooks = t->table->valid_hooks;
75716 }
75717 mutex_unlock(&ebt_mutex);
75718 - if (copy_to_user(user, &tmp, *len) != 0){
75719 + if (*len > sizeof(tmp) || copy_to_user(user, &tmp, *len) != 0){
75720 BUGPRINT("c2u Didn't work\n");
75721 ret = -EFAULT;
75722 break;
75723 diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c
75724 index 047cd0e..461fd28 100644
75725 --- a/net/caif/cfctrl.c
75726 +++ b/net/caif/cfctrl.c
75727 @@ -10,6 +10,7 @@
75728 #include <linux/spinlock.h>
75729 #include <linux/slab.h>
75730 #include <linux/pkt_sched.h>
75731 +#include <linux/sched.h>
75732 #include <net/caif/caif_layer.h>
75733 #include <net/caif/cfpkt.h>
75734 #include <net/caif/cfctrl.h>
75735 @@ -43,8 +44,8 @@ struct cflayer *cfctrl_create(void)
75736 memset(&dev_info, 0, sizeof(dev_info));
75737 dev_info.id = 0xff;
75738 cfsrvl_init(&this->serv, 0, &dev_info, false);
75739 - atomic_set(&this->req_seq_no, 1);
75740 - atomic_set(&this->rsp_seq_no, 1);
75741 + atomic_set_unchecked(&this->req_seq_no, 1);
75742 + atomic_set_unchecked(&this->rsp_seq_no, 1);
75743 this->serv.layer.receive = cfctrl_recv;
75744 sprintf(this->serv.layer.name, "ctrl");
75745 this->serv.layer.ctrlcmd = cfctrl_ctrlcmd;
75746 @@ -130,8 +131,8 @@ static void cfctrl_insert_req(struct cfctrl *ctrl,
75747 struct cfctrl_request_info *req)
75748 {
75749 spin_lock_bh(&ctrl->info_list_lock);
75750 - atomic_inc(&ctrl->req_seq_no);
75751 - req->sequence_no = atomic_read(&ctrl->req_seq_no);
75752 + atomic_inc_unchecked(&ctrl->req_seq_no);
75753 + req->sequence_no = atomic_read_unchecked(&ctrl->req_seq_no);
75754 list_add_tail(&req->list, &ctrl->list);
75755 spin_unlock_bh(&ctrl->info_list_lock);
75756 }
75757 @@ -149,7 +150,7 @@ static struct cfctrl_request_info *cfctrl_remove_req(struct cfctrl *ctrl,
75758 if (p != first)
75759 pr_warn("Requests are not received in order\n");
75760
75761 - atomic_set(&ctrl->rsp_seq_no,
75762 + atomic_set_unchecked(&ctrl->rsp_seq_no,
75763 p->sequence_no);
75764 list_del(&p->list);
75765 goto out;
75766 diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
75767 index 69771c0..e597733 100644
75768 --- a/net/caif/chnl_net.c
75769 +++ b/net/caif/chnl_net.c
75770 @@ -94,6 +94,10 @@ static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt)
75771
75772 /* check the version of IP */
75773 ip_version = skb_header_pointer(skb, 0, 1, &buf);
75774 + if (!ip_version) {
75775 + kfree_skb(skb);
75776 + return -EINVAL;
75777 + }
75778
75779 switch (*ip_version >> 4) {
75780 case 4:
75781 diff --git a/net/can/gw.c b/net/can/gw.c
75782 index b41acf2..3affb3a 100644
75783 --- a/net/can/gw.c
75784 +++ b/net/can/gw.c
75785 @@ -96,7 +96,7 @@ struct cf_mod {
75786 struct {
75787 void (*xor)(struct can_frame *cf, struct cgw_csum_xor *xor);
75788 void (*crc8)(struct can_frame *cf, struct cgw_csum_crc8 *crc8);
75789 - } csumfunc;
75790 + } __no_const csumfunc;
75791 };
75792
75793
75794 diff --git a/net/compat.c b/net/compat.c
75795 index 74ed1d7..62f7ea6 100644
75796 --- a/net/compat.c
75797 +++ b/net/compat.c
75798 @@ -71,9 +71,9 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
75799 __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
75800 __get_user(kmsg->msg_flags, &umsg->msg_flags))
75801 return -EFAULT;
75802 - kmsg->msg_name = compat_ptr(tmp1);
75803 - kmsg->msg_iov = compat_ptr(tmp2);
75804 - kmsg->msg_control = compat_ptr(tmp3);
75805 + kmsg->msg_name = (void __force_kernel *)compat_ptr(tmp1);
75806 + kmsg->msg_iov = (void __force_kernel *)compat_ptr(tmp2);
75807 + kmsg->msg_control = (void __force_kernel *)compat_ptr(tmp3);
75808 return 0;
75809 }
75810
75811 @@ -85,7 +85,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
75812
75813 if (kern_msg->msg_namelen) {
75814 if (mode == VERIFY_READ) {
75815 - int err = move_addr_to_kernel(kern_msg->msg_name,
75816 + int err = move_addr_to_kernel((void __force_user *)kern_msg->msg_name,
75817 kern_msg->msg_namelen,
75818 kern_address);
75819 if (err < 0)
75820 @@ -96,7 +96,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
75821 kern_msg->msg_name = NULL;
75822
75823 tot_len = iov_from_user_compat_to_kern(kern_iov,
75824 - (struct compat_iovec __user *)kern_msg->msg_iov,
75825 + (struct compat_iovec __force_user *)kern_msg->msg_iov,
75826 kern_msg->msg_iovlen);
75827 if (tot_len >= 0)
75828 kern_msg->msg_iov = kern_iov;
75829 @@ -116,20 +116,20 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
75830
75831 #define CMSG_COMPAT_FIRSTHDR(msg) \
75832 (((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ? \
75833 - (struct compat_cmsghdr __user *)((msg)->msg_control) : \
75834 + (struct compat_cmsghdr __force_user *)((msg)->msg_control) : \
75835 (struct compat_cmsghdr __user *)NULL)
75836
75837 #define CMSG_COMPAT_OK(ucmlen, ucmsg, mhdr) \
75838 ((ucmlen) >= sizeof(struct compat_cmsghdr) && \
75839 (ucmlen) <= (unsigned long) \
75840 ((mhdr)->msg_controllen - \
75841 - ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
75842 + ((char __force_kernel *)(ucmsg) - (char *)(mhdr)->msg_control)))
75843
75844 static inline struct compat_cmsghdr __user *cmsg_compat_nxthdr(struct msghdr *msg,
75845 struct compat_cmsghdr __user *cmsg, int cmsg_len)
75846 {
75847 char __user *ptr = (char __user *)cmsg + CMSG_COMPAT_ALIGN(cmsg_len);
75848 - if ((unsigned long)(ptr + 1 - (char __user *)msg->msg_control) >
75849 + if ((unsigned long)(ptr + 1 - (char __force_user *)msg->msg_control) >
75850 msg->msg_controllen)
75851 return NULL;
75852 return (struct compat_cmsghdr __user *)ptr;
75853 @@ -219,7 +219,7 @@ Efault:
75854
75855 int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *data)
75856 {
75857 - struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
75858 + struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
75859 struct compat_cmsghdr cmhdr;
75860 struct compat_timeval ctv;
75861 struct compat_timespec cts[3];
75862 @@ -275,7 +275,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
75863
75864 void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
75865 {
75866 - struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
75867 + struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
75868 int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
75869 int fdnum = scm->fp->count;
75870 struct file **fp = scm->fp->fp;
75871 @@ -364,7 +364,7 @@ static int do_set_sock_timeout(struct socket *sock, int level,
75872 return -EFAULT;
75873 old_fs = get_fs();
75874 set_fs(KERNEL_DS);
75875 - err = sock_setsockopt(sock, level, optname, (char *)&ktime, sizeof(ktime));
75876 + err = sock_setsockopt(sock, level, optname, (char __force_user *)&ktime, sizeof(ktime));
75877 set_fs(old_fs);
75878
75879 return err;
75880 @@ -425,7 +425,7 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname,
75881 len = sizeof(ktime);
75882 old_fs = get_fs();
75883 set_fs(KERNEL_DS);
75884 - err = sock_getsockopt(sock, level, optname, (char *) &ktime, &len);
75885 + err = sock_getsockopt(sock, level, optname, (char __force_user *) &ktime, (int __force_user *)&len);
75886 set_fs(old_fs);
75887
75888 if (!err) {
75889 @@ -568,7 +568,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
75890 case MCAST_JOIN_GROUP:
75891 case MCAST_LEAVE_GROUP:
75892 {
75893 - struct compat_group_req __user *gr32 = (void *)optval;
75894 + struct compat_group_req __user *gr32 = (void __user *)optval;
75895 struct group_req __user *kgr =
75896 compat_alloc_user_space(sizeof(struct group_req));
75897 u32 interface;
75898 @@ -589,7 +589,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
75899 case MCAST_BLOCK_SOURCE:
75900 case MCAST_UNBLOCK_SOURCE:
75901 {
75902 - struct compat_group_source_req __user *gsr32 = (void *)optval;
75903 + struct compat_group_source_req __user *gsr32 = (void __user *)optval;
75904 struct group_source_req __user *kgsr = compat_alloc_user_space(
75905 sizeof(struct group_source_req));
75906 u32 interface;
75907 @@ -610,7 +610,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
75908 }
75909 case MCAST_MSFILTER:
75910 {
75911 - struct compat_group_filter __user *gf32 = (void *)optval;
75912 + struct compat_group_filter __user *gf32 = (void __user *)optval;
75913 struct group_filter __user *kgf;
75914 u32 interface, fmode, numsrc;
75915
75916 @@ -648,7 +648,7 @@ int compat_mc_getsockopt(struct sock *sock, int level, int optname,
75917 char __user *optval, int __user *optlen,
75918 int (*getsockopt)(struct sock *, int, int, char __user *, int __user *))
75919 {
75920 - struct compat_group_filter __user *gf32 = (void *)optval;
75921 + struct compat_group_filter __user *gf32 = (void __user *)optval;
75922 struct group_filter __user *kgf;
75923 int __user *koptlen;
75924 u32 interface, fmode, numsrc;
75925 diff --git a/net/core/datagram.c b/net/core/datagram.c
75926 index ae6acf6..d5c8f66 100644
75927 --- a/net/core/datagram.c
75928 +++ b/net/core/datagram.c
75929 @@ -290,7 +290,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
75930 }
75931
75932 kfree_skb(skb);
75933 - atomic_inc(&sk->sk_drops);
75934 + atomic_inc_unchecked(&sk->sk_drops);
75935 sk_mem_reclaim_partial(sk);
75936
75937 return err;
75938 diff --git a/net/core/dev.c b/net/core/dev.c
75939 index a000840..566cee1 100644
75940 --- a/net/core/dev.c
75941 +++ b/net/core/dev.c
75942 @@ -1135,9 +1135,13 @@ void dev_load(struct net *net, const char *name)
75943 if (no_module && capable(CAP_NET_ADMIN))
75944 no_module = request_module("netdev-%s", name);
75945 if (no_module && capable(CAP_SYS_MODULE)) {
75946 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
75947 + ___request_module(true, "grsec_modharden_netdev", "%s", name);
75948 +#else
75949 if (!request_module("%s", name))
75950 pr_warn("Loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s instead.\n",
75951 name);
75952 +#endif
75953 }
75954 }
75955 EXPORT_SYMBOL(dev_load);
75956 @@ -1602,7 +1606,7 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
75957 {
75958 if (skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY) {
75959 if (skb_copy_ubufs(skb, GFP_ATOMIC)) {
75960 - atomic_long_inc(&dev->rx_dropped);
75961 + atomic_long_inc_unchecked(&dev->rx_dropped);
75962 kfree_skb(skb);
75963 return NET_RX_DROP;
75964 }
75965 @@ -1612,7 +1616,7 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
75966 nf_reset(skb);
75967
75968 if (unlikely(!is_skb_forwardable(dev, skb))) {
75969 - atomic_long_inc(&dev->rx_dropped);
75970 + atomic_long_inc_unchecked(&dev->rx_dropped);
75971 kfree_skb(skb);
75972 return NET_RX_DROP;
75973 }
75974 @@ -2041,7 +2045,7 @@ static int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
75975
75976 struct dev_gso_cb {
75977 void (*destructor)(struct sk_buff *skb);
75978 -};
75979 +} __no_const;
75980
75981 #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
75982
75983 @@ -2876,7 +2880,7 @@ enqueue:
75984
75985 local_irq_restore(flags);
75986
75987 - atomic_long_inc(&skb->dev->rx_dropped);
75988 + atomic_long_inc_unchecked(&skb->dev->rx_dropped);
75989 kfree_skb(skb);
75990 return NET_RX_DROP;
75991 }
75992 @@ -2948,7 +2952,7 @@ int netif_rx_ni(struct sk_buff *skb)
75993 }
75994 EXPORT_SYMBOL(netif_rx_ni);
75995
75996 -static void net_tx_action(struct softirq_action *h)
75997 +static void net_tx_action(void)
75998 {
75999 struct softnet_data *sd = &__get_cpu_var(softnet_data);
76000
76001 @@ -3235,7 +3239,7 @@ ncls:
76002 if (pt_prev) {
76003 ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
76004 } else {
76005 - atomic_long_inc(&skb->dev->rx_dropped);
76006 + atomic_long_inc_unchecked(&skb->dev->rx_dropped);
76007 kfree_skb(skb);
76008 /* Jamal, now you will not able to escape explaining
76009 * me how you were going to use this. :-)
76010 @@ -3800,7 +3804,7 @@ void netif_napi_del(struct napi_struct *napi)
76011 }
76012 EXPORT_SYMBOL(netif_napi_del);
76013
76014 -static void net_rx_action(struct softirq_action *h)
76015 +static void net_rx_action(void)
76016 {
76017 struct softnet_data *sd = &__get_cpu_var(softnet_data);
76018 unsigned long time_limit = jiffies + 2;
76019 @@ -4270,8 +4274,13 @@ static int ptype_seq_show(struct seq_file *seq, void *v)
76020 else
76021 seq_printf(seq, "%04x", ntohs(pt->type));
76022
76023 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76024 + seq_printf(seq, " %-8s %p\n",
76025 + pt->dev ? pt->dev->name : "", NULL);
76026 +#else
76027 seq_printf(seq, " %-8s %pF\n",
76028 pt->dev ? pt->dev->name : "", pt->func);
76029 +#endif
76030 }
76031
76032 return 0;
76033 @@ -5823,7 +5832,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
76034 } else {
76035 netdev_stats_to_stats64(storage, &dev->stats);
76036 }
76037 - storage->rx_dropped += atomic_long_read(&dev->rx_dropped);
76038 + storage->rx_dropped += atomic_long_read_unchecked(&dev->rx_dropped);
76039 return storage;
76040 }
76041 EXPORT_SYMBOL(dev_get_stats);
76042 diff --git a/net/core/flow.c b/net/core/flow.c
76043 index e318c7e..168b1d0 100644
76044 --- a/net/core/flow.c
76045 +++ b/net/core/flow.c
76046 @@ -61,7 +61,7 @@ struct flow_cache {
76047 struct timer_list rnd_timer;
76048 };
76049
76050 -atomic_t flow_cache_genid = ATOMIC_INIT(0);
76051 +atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
76052 EXPORT_SYMBOL(flow_cache_genid);
76053 static struct flow_cache flow_cache_global;
76054 static struct kmem_cache *flow_cachep __read_mostly;
76055 @@ -86,7 +86,7 @@ static void flow_cache_new_hashrnd(unsigned long arg)
76056
76057 static int flow_entry_valid(struct flow_cache_entry *fle)
76058 {
76059 - if (atomic_read(&flow_cache_genid) != fle->genid)
76060 + if (atomic_read_unchecked(&flow_cache_genid) != fle->genid)
76061 return 0;
76062 if (fle->object && !fle->object->ops->check(fle->object))
76063 return 0;
76064 @@ -259,7 +259,7 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
76065 hlist_add_head(&fle->u.hlist, &fcp->hash_table[hash]);
76066 fcp->hash_count++;
76067 }
76068 - } else if (likely(fle->genid == atomic_read(&flow_cache_genid))) {
76069 + } else if (likely(fle->genid == atomic_read_unchecked(&flow_cache_genid))) {
76070 flo = fle->object;
76071 if (!flo)
76072 goto ret_object;
76073 @@ -280,7 +280,7 @@ nocache:
76074 }
76075 flo = resolver(net, key, family, dir, flo, ctx);
76076 if (fle) {
76077 - fle->genid = atomic_read(&flow_cache_genid);
76078 + fle->genid = atomic_read_unchecked(&flow_cache_genid);
76079 if (!IS_ERR(flo))
76080 fle->object = flo;
76081 else
76082 diff --git a/net/core/iovec.c b/net/core/iovec.c
76083 index 7e7aeb0..2a998cb 100644
76084 --- a/net/core/iovec.c
76085 +++ b/net/core/iovec.c
76086 @@ -42,7 +42,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
76087 if (m->msg_namelen) {
76088 if (mode == VERIFY_READ) {
76089 void __user *namep;
76090 - namep = (void __user __force *) m->msg_name;
76091 + namep = (void __force_user *) m->msg_name;
76092 err = move_addr_to_kernel(namep, m->msg_namelen,
76093 address);
76094 if (err < 0)
76095 @@ -54,7 +54,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
76096 }
76097
76098 size = m->msg_iovlen * sizeof(struct iovec);
76099 - if (copy_from_user(iov, (void __user __force *) m->msg_iov, size))
76100 + if (copy_from_user(iov, (void __force_user *) m->msg_iov, size))
76101 return -EFAULT;
76102
76103 m->msg_iov = iov;
76104 diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
76105 index 6c50ac0..6b4c038 100644
76106 --- a/net/core/rtnetlink.c
76107 +++ b/net/core/rtnetlink.c
76108 @@ -58,7 +58,7 @@ struct rtnl_link {
76109 rtnl_doit_func doit;
76110 rtnl_dumpit_func dumpit;
76111 rtnl_calcit_func calcit;
76112 -};
76113 +} __no_const;
76114
76115 static DEFINE_MUTEX(rtnl_mutex);
76116
76117 diff --git a/net/core/scm.c b/net/core/scm.c
76118 index 611c5ef..88f6d6d 100644
76119 --- a/net/core/scm.c
76120 +++ b/net/core/scm.c
76121 @@ -219,7 +219,7 @@ EXPORT_SYMBOL(__scm_send);
76122 int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
76123 {
76124 struct cmsghdr __user *cm
76125 - = (__force struct cmsghdr __user *)msg->msg_control;
76126 + = (struct cmsghdr __force_user *)msg->msg_control;
76127 struct cmsghdr cmhdr;
76128 int cmlen = CMSG_LEN(len);
76129 int err;
76130 @@ -242,7 +242,7 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
76131 err = -EFAULT;
76132 if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
76133 goto out;
76134 - if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
76135 + if (copy_to_user((void __force_user *)CMSG_DATA((void __force_kernel *)cm), data, cmlen - sizeof(struct cmsghdr)))
76136 goto out;
76137 cmlen = CMSG_SPACE(len);
76138 if (msg->msg_controllen < cmlen)
76139 @@ -258,7 +258,7 @@ EXPORT_SYMBOL(put_cmsg);
76140 void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
76141 {
76142 struct cmsghdr __user *cm
76143 - = (__force struct cmsghdr __user*)msg->msg_control;
76144 + = (struct cmsghdr __force_user *)msg->msg_control;
76145
76146 int fdmax = 0;
76147 int fdnum = scm->fp->count;
76148 @@ -278,7 +278,7 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
76149 if (fdnum < fdmax)
76150 fdmax = fdnum;
76151
76152 - for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
76153 + for (i=0, cmfptr=(int __force_user *)CMSG_DATA((void __force_kernel *)cm); i<fdmax;
76154 i++, cmfptr++)
76155 {
76156 int new_fd;
76157 diff --git a/net/core/sock.c b/net/core/sock.c
76158 index 9e5b71f..66dec30 100644
76159 --- a/net/core/sock.c
76160 +++ b/net/core/sock.c
76161 @@ -344,7 +344,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
76162 struct sk_buff_head *list = &sk->sk_receive_queue;
76163
76164 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) {
76165 - atomic_inc(&sk->sk_drops);
76166 + atomic_inc_unchecked(&sk->sk_drops);
76167 trace_sock_rcvqueue_full(sk, skb);
76168 return -ENOMEM;
76169 }
76170 @@ -354,7 +354,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
76171 return err;
76172
76173 if (!sk_rmem_schedule(sk, skb->truesize)) {
76174 - atomic_inc(&sk->sk_drops);
76175 + atomic_inc_unchecked(&sk->sk_drops);
76176 return -ENOBUFS;
76177 }
76178
76179 @@ -374,7 +374,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
76180 skb_dst_force(skb);
76181
76182 spin_lock_irqsave(&list->lock, flags);
76183 - skb->dropcount = atomic_read(&sk->sk_drops);
76184 + skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
76185 __skb_queue_tail(list, skb);
76186 spin_unlock_irqrestore(&list->lock, flags);
76187
76188 @@ -394,7 +394,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
76189 skb->dev = NULL;
76190
76191 if (sk_rcvqueues_full(sk, skb, sk->sk_rcvbuf)) {
76192 - atomic_inc(&sk->sk_drops);
76193 + atomic_inc_unchecked(&sk->sk_drops);
76194 goto discard_and_relse;
76195 }
76196 if (nested)
76197 @@ -412,7 +412,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
76198 mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
76199 } else if (sk_add_backlog(sk, skb, sk->sk_rcvbuf)) {
76200 bh_unlock_sock(sk);
76201 - atomic_inc(&sk->sk_drops);
76202 + atomic_inc_unchecked(&sk->sk_drops);
76203 goto discard_and_relse;
76204 }
76205
76206 @@ -976,7 +976,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
76207 if (len > sizeof(peercred))
76208 len = sizeof(peercred);
76209 cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred);
76210 - if (copy_to_user(optval, &peercred, len))
76211 + if (len > sizeof(peercred) || copy_to_user(optval, &peercred, len))
76212 return -EFAULT;
76213 goto lenout;
76214 }
76215 @@ -989,7 +989,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
76216 return -ENOTCONN;
76217 if (lv < len)
76218 return -EINVAL;
76219 - if (copy_to_user(optval, address, len))
76220 + if (len > sizeof(address) || copy_to_user(optval, address, len))
76221 return -EFAULT;
76222 goto lenout;
76223 }
76224 @@ -1035,7 +1035,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
76225
76226 if (len > lv)
76227 len = lv;
76228 - if (copy_to_user(optval, &v, len))
76229 + if (len > sizeof(v) || copy_to_user(optval, &v, len))
76230 return -EFAULT;
76231 lenout:
76232 if (put_user(len, optlen))
76233 @@ -2124,7 +2124,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
76234 */
76235 smp_wmb();
76236 atomic_set(&sk->sk_refcnt, 1);
76237 - atomic_set(&sk->sk_drops, 0);
76238 + atomic_set_unchecked(&sk->sk_drops, 0);
76239 }
76240 EXPORT_SYMBOL(sock_init_data);
76241
76242 diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
76243 index 5fd1467..8b70900 100644
76244 --- a/net/core/sock_diag.c
76245 +++ b/net/core/sock_diag.c
76246 @@ -16,20 +16,27 @@ static DEFINE_MUTEX(sock_diag_table_mutex);
76247
76248 int sock_diag_check_cookie(void *sk, __u32 *cookie)
76249 {
76250 +#ifndef CONFIG_GRKERNSEC_HIDESYM
76251 if ((cookie[0] != INET_DIAG_NOCOOKIE ||
76252 cookie[1] != INET_DIAG_NOCOOKIE) &&
76253 ((u32)(unsigned long)sk != cookie[0] ||
76254 (u32)((((unsigned long)sk) >> 31) >> 1) != cookie[1]))
76255 return -ESTALE;
76256 else
76257 +#endif
76258 return 0;
76259 }
76260 EXPORT_SYMBOL_GPL(sock_diag_check_cookie);
76261
76262 void sock_diag_save_cookie(void *sk, __u32 *cookie)
76263 {
76264 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76265 + cookie[0] = 0;
76266 + cookie[1] = 0;
76267 +#else
76268 cookie[0] = (u32)(unsigned long)sk;
76269 cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
76270 +#endif
76271 }
76272 EXPORT_SYMBOL_GPL(sock_diag_save_cookie);
76273
76274 diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
76275 index 8c67bed..ce0d140 100644
76276 --- a/net/dccp/ccids/ccid3.c
76277 +++ b/net/dccp/ccids/ccid3.c
76278 @@ -531,6 +531,7 @@ static int ccid3_hc_tx_getsockopt(struct sock *sk, const int optname, int len,
76279 case DCCP_SOCKOPT_CCID_TX_INFO:
76280 if (len < sizeof(tfrc))
76281 return -EINVAL;
76282 + memset(&tfrc, 0, sizeof(tfrc));
76283 tfrc.tfrctx_x = hc->tx_x;
76284 tfrc.tfrctx_x_recv = hc->tx_x_recv;
76285 tfrc.tfrctx_x_calc = hc->tx_x_calc;
76286 diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
76287 index a55eecc..dd8428c 100644
76288 --- a/net/decnet/sysctl_net_decnet.c
76289 +++ b/net/decnet/sysctl_net_decnet.c
76290 @@ -174,7 +174,7 @@ static int dn_node_address_handler(ctl_table *table, int write,
76291
76292 if (len > *lenp) len = *lenp;
76293
76294 - if (copy_to_user(buffer, addr, len))
76295 + if (len > sizeof addr || copy_to_user(buffer, addr, len))
76296 return -EFAULT;
76297
76298 *lenp = len;
76299 @@ -237,7 +237,7 @@ static int dn_def_dev_handler(ctl_table *table, int write,
76300
76301 if (len > *lenp) len = *lenp;
76302
76303 - if (copy_to_user(buffer, devname, len))
76304 + if (len > sizeof devname || copy_to_user(buffer, devname, len))
76305 return -EFAULT;
76306
76307 *lenp = len;
76308 diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
76309 index 3854411..2201a94 100644
76310 --- a/net/ipv4/fib_frontend.c
76311 +++ b/net/ipv4/fib_frontend.c
76312 @@ -969,12 +969,12 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
76313 #ifdef CONFIG_IP_ROUTE_MULTIPATH
76314 fib_sync_up(dev);
76315 #endif
76316 - atomic_inc(&net->ipv4.dev_addr_genid);
76317 + atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76318 rt_cache_flush(dev_net(dev), -1);
76319 break;
76320 case NETDEV_DOWN:
76321 fib_del_ifaddr(ifa, NULL);
76322 - atomic_inc(&net->ipv4.dev_addr_genid);
76323 + atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76324 if (ifa->ifa_dev->ifa_list == NULL) {
76325 /* Last address was deleted from this interface.
76326 * Disable IP.
76327 @@ -1010,7 +1010,7 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
76328 #ifdef CONFIG_IP_ROUTE_MULTIPATH
76329 fib_sync_up(dev);
76330 #endif
76331 - atomic_inc(&net->ipv4.dev_addr_genid);
76332 + atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76333 rt_cache_flush(dev_net(dev), -1);
76334 break;
76335 case NETDEV_DOWN:
76336 diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
76337 index e5b7182..570a90e 100644
76338 --- a/net/ipv4/fib_semantics.c
76339 +++ b/net/ipv4/fib_semantics.c
76340 @@ -698,7 +698,7 @@ __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh)
76341 nh->nh_saddr = inet_select_addr(nh->nh_dev,
76342 nh->nh_gw,
76343 nh->nh_parent->fib_scope);
76344 - nh->nh_saddr_genid = atomic_read(&net->ipv4.dev_addr_genid);
76345 + nh->nh_saddr_genid = atomic_read_unchecked(&net->ipv4.dev_addr_genid);
76346
76347 return nh->nh_saddr;
76348 }
76349 diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
76350 index 7880af9..70f92a3 100644
76351 --- a/net/ipv4/inet_hashtables.c
76352 +++ b/net/ipv4/inet_hashtables.c
76353 @@ -18,12 +18,15 @@
76354 #include <linux/sched.h>
76355 #include <linux/slab.h>
76356 #include <linux/wait.h>
76357 +#include <linux/security.h>
76358
76359 #include <net/inet_connection_sock.h>
76360 #include <net/inet_hashtables.h>
76361 #include <net/secure_seq.h>
76362 #include <net/ip.h>
76363
76364 +extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
76365 +
76366 /*
76367 * Allocate and initialize a new local port bind bucket.
76368 * The bindhash mutex for snum's hash chain must be held here.
76369 @@ -530,6 +533,8 @@ ok:
76370 twrefcnt += inet_twsk_bind_unhash(tw, hinfo);
76371 spin_unlock(&head->lock);
76372
76373 + gr_update_task_in_ip_table(current, inet_sk(sk));
76374 +
76375 if (tw) {
76376 inet_twsk_deschedule(tw, death_row);
76377 while (twrefcnt) {
76378 diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
76379 index dfba343..c827d50 100644
76380 --- a/net/ipv4/inetpeer.c
76381 +++ b/net/ipv4/inetpeer.c
76382 @@ -487,8 +487,8 @@ relookup:
76383 if (p) {
76384 p->daddr = *daddr;
76385 atomic_set(&p->refcnt, 1);
76386 - atomic_set(&p->rid, 0);
76387 - atomic_set(&p->ip_id_count,
76388 + atomic_set_unchecked(&p->rid, 0);
76389 + atomic_set_unchecked(&p->ip_id_count,
76390 (daddr->family == AF_INET) ?
76391 secure_ip_id(daddr->addr.a4) :
76392 secure_ipv6_id(daddr->addr.a6));
76393 diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
76394 index 9dbd3dd..0c59fb2 100644
76395 --- a/net/ipv4/ip_fragment.c
76396 +++ b/net/ipv4/ip_fragment.c
76397 @@ -318,7 +318,7 @@ static inline int ip_frag_too_far(struct ipq *qp)
76398 return 0;
76399
76400 start = qp->rid;
76401 - end = atomic_inc_return(&peer->rid);
76402 + end = atomic_inc_return_unchecked(&peer->rid);
76403 qp->rid = end;
76404
76405 rc = qp->q.fragments && (end - start) > max;
76406 diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
76407 index 0d11f23..2bb3f64 100644
76408 --- a/net/ipv4/ip_sockglue.c
76409 +++ b/net/ipv4/ip_sockglue.c
76410 @@ -1142,7 +1142,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
76411 len = min_t(unsigned int, len, opt->optlen);
76412 if (put_user(len, optlen))
76413 return -EFAULT;
76414 - if (copy_to_user(optval, opt->__data, len))
76415 + if ((len > (sizeof(optbuf) - sizeof(struct ip_options))) ||
76416 + copy_to_user(optval, opt->__data, len))
76417 return -EFAULT;
76418 return 0;
76419 }
76420 @@ -1273,7 +1274,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
76421 if (sk->sk_type != SOCK_STREAM)
76422 return -ENOPROTOOPT;
76423
76424 - msg.msg_control = optval;
76425 + msg.msg_control = (void __force_kernel *)optval;
76426 msg.msg_controllen = len;
76427 msg.msg_flags = flags;
76428
76429 diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
76430 index 67e8a6b..386764d 100644
76431 --- a/net/ipv4/ipconfig.c
76432 +++ b/net/ipv4/ipconfig.c
76433 @@ -321,7 +321,7 @@ static int __init ic_devinet_ioctl(unsigned int cmd, struct ifreq *arg)
76434
76435 mm_segment_t oldfs = get_fs();
76436 set_fs(get_ds());
76437 - res = devinet_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
76438 + res = devinet_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
76439 set_fs(oldfs);
76440 return res;
76441 }
76442 @@ -332,7 +332,7 @@ static int __init ic_dev_ioctl(unsigned int cmd, struct ifreq *arg)
76443
76444 mm_segment_t oldfs = get_fs();
76445 set_fs(get_ds());
76446 - res = dev_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
76447 + res = dev_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
76448 set_fs(oldfs);
76449 return res;
76450 }
76451 @@ -343,7 +343,7 @@ static int __init ic_route_ioctl(unsigned int cmd, struct rtentry *arg)
76452
76453 mm_segment_t oldfs = get_fs();
76454 set_fs(get_ds());
76455 - res = ip_rt_ioctl(&init_net, cmd, (void __user *) arg);
76456 + res = ip_rt_ioctl(&init_net, cmd, (void __force_user *) arg);
76457 set_fs(oldfs);
76458 return res;
76459 }
76460 diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
76461 index 2c00e8b..45b3bdd 100644
76462 --- a/net/ipv4/ping.c
76463 +++ b/net/ipv4/ping.c
76464 @@ -845,7 +845,7 @@ static void ping_format_sock(struct sock *sp, struct seq_file *f,
76465 sk_rmem_alloc_get(sp),
76466 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
76467 atomic_read(&sp->sk_refcnt), sp,
76468 - atomic_read(&sp->sk_drops), len);
76469 + atomic_read_unchecked(&sp->sk_drops), len);
76470 }
76471
76472 static int ping_seq_show(struct seq_file *seq, void *v)
76473 diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
76474 index 4032b81..625143c 100644
76475 --- a/net/ipv4/raw.c
76476 +++ b/net/ipv4/raw.c
76477 @@ -304,7 +304,7 @@ static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
76478 int raw_rcv(struct sock *sk, struct sk_buff *skb)
76479 {
76480 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
76481 - atomic_inc(&sk->sk_drops);
76482 + atomic_inc_unchecked(&sk->sk_drops);
76483 kfree_skb(skb);
76484 return NET_RX_DROP;
76485 }
76486 @@ -740,16 +740,20 @@ static int raw_init(struct sock *sk)
76487
76488 static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
76489 {
76490 + struct icmp_filter filter;
76491 +
76492 if (optlen > sizeof(struct icmp_filter))
76493 optlen = sizeof(struct icmp_filter);
76494 - if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
76495 + if (copy_from_user(&filter, optval, optlen))
76496 return -EFAULT;
76497 + raw_sk(sk)->filter = filter;
76498 return 0;
76499 }
76500
76501 static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
76502 {
76503 int len, ret = -EFAULT;
76504 + struct icmp_filter filter;
76505
76506 if (get_user(len, optlen))
76507 goto out;
76508 @@ -759,8 +763,8 @@ static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *o
76509 if (len > sizeof(struct icmp_filter))
76510 len = sizeof(struct icmp_filter);
76511 ret = -EFAULT;
76512 - if (put_user(len, optlen) ||
76513 - copy_to_user(optval, &raw_sk(sk)->filter, len))
76514 + filter = raw_sk(sk)->filter;
76515 + if (put_user(len, optlen) || len > sizeof filter || copy_to_user(optval, &filter, len))
76516 goto out;
76517 ret = 0;
76518 out: return ret;
76519 @@ -988,7 +992,13 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
76520 sk_wmem_alloc_get(sp),
76521 sk_rmem_alloc_get(sp),
76522 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
76523 - atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
76524 + atomic_read(&sp->sk_refcnt),
76525 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76526 + NULL,
76527 +#else
76528 + sp,
76529 +#endif
76530 + atomic_read_unchecked(&sp->sk_drops));
76531 }
76532
76533 static int raw_seq_show(struct seq_file *seq, void *v)
76534 diff --git a/net/ipv4/route.c b/net/ipv4/route.c
76535 index 98b30d0..cfa3cf7 100644
76536 --- a/net/ipv4/route.c
76537 +++ b/net/ipv4/route.c
76538 @@ -313,7 +313,7 @@ static inline unsigned int rt_hash(__be32 daddr, __be32 saddr, int idx,
76539
76540 static inline int rt_genid(struct net *net)
76541 {
76542 - return atomic_read(&net->ipv4.rt_genid);
76543 + return atomic_read_unchecked(&net->ipv4.rt_genid);
76544 }
76545
76546 #ifdef CONFIG_PROC_FS
76547 @@ -937,7 +937,7 @@ static void rt_cache_invalidate(struct net *net)
76548 unsigned char shuffle;
76549
76550 get_random_bytes(&shuffle, sizeof(shuffle));
76551 - atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
76552 + atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
76553 inetpeer_invalidate_tree(AF_INET);
76554 }
76555
76556 @@ -3011,7 +3011,7 @@ static int rt_fill_info(struct net *net,
76557 error = rt->dst.error;
76558 if (peer) {
76559 inet_peer_refcheck(rt->peer);
76560 - id = atomic_read(&peer->ip_id_count) & 0xffff;
76561 + id = atomic_read_unchecked(&peer->ip_id_count) & 0xffff;
76562 if (peer->tcp_ts_stamp) {
76563 ts = peer->tcp_ts;
76564 tsage = get_seconds() - peer->tcp_ts_stamp;
76565 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
76566 index 05fe1f4..cc273dd 100644
76567 --- a/net/ipv4/tcp_input.c
76568 +++ b/net/ipv4/tcp_input.c
76569 @@ -4886,7 +4886,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
76570 * simplifies code)
76571 */
76572 static void
76573 -tcp_collapse(struct sock *sk, struct sk_buff_head *list,
76574 +__intentional_overflow(5,6) tcp_collapse(struct sock *sk, struct sk_buff_head *list,
76575 struct sk_buff *head, struct sk_buff *tail,
76576 u32 start, u32 end)
76577 {
76578 diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
76579 index c8d28c4..e40f75a 100644
76580 --- a/net/ipv4/tcp_ipv4.c
76581 +++ b/net/ipv4/tcp_ipv4.c
76582 @@ -90,6 +90,10 @@ int sysctl_tcp_low_latency __read_mostly;
76583 EXPORT_SYMBOL(sysctl_tcp_low_latency);
76584
76585
76586 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76587 +extern int grsec_enable_blackhole;
76588 +#endif
76589 +
76590 #ifdef CONFIG_TCP_MD5SIG
76591 static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
76592 __be32 daddr, __be32 saddr, const struct tcphdr *th);
76593 @@ -1656,6 +1660,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
76594 return 0;
76595
76596 reset:
76597 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76598 + if (!grsec_enable_blackhole)
76599 +#endif
76600 tcp_v4_send_reset(rsk, skb);
76601 discard:
76602 kfree_skb(skb);
76603 @@ -1718,12 +1725,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
76604 TCP_SKB_CB(skb)->sacked = 0;
76605
76606 sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
76607 - if (!sk)
76608 + if (!sk) {
76609 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76610 + ret = 1;
76611 +#endif
76612 goto no_tcp_socket;
76613 -
76614 + }
76615 process:
76616 - if (sk->sk_state == TCP_TIME_WAIT)
76617 + if (sk->sk_state == TCP_TIME_WAIT) {
76618 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76619 + ret = 2;
76620 +#endif
76621 goto do_time_wait;
76622 + }
76623
76624 if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
76625 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
76626 @@ -1774,6 +1788,10 @@ no_tcp_socket:
76627 bad_packet:
76628 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
76629 } else {
76630 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76631 + if (!grsec_enable_blackhole || (ret == 1 &&
76632 + (skb->dev->flags & IFF_LOOPBACK)))
76633 +#endif
76634 tcp_v4_send_reset(NULL, skb);
76635 }
76636
76637 @@ -2386,7 +2404,11 @@ static void get_openreq4(const struct sock *sk, const struct request_sock *req,
76638 0, /* non standard timer */
76639 0, /* open_requests have no inode */
76640 atomic_read(&sk->sk_refcnt),
76641 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76642 + NULL,
76643 +#else
76644 req,
76645 +#endif
76646 len);
76647 }
76648
76649 @@ -2436,7 +2458,12 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
76650 sock_i_uid(sk),
76651 icsk->icsk_probes_out,
76652 sock_i_ino(sk),
76653 - atomic_read(&sk->sk_refcnt), sk,
76654 + atomic_read(&sk->sk_refcnt),
76655 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76656 + NULL,
76657 +#else
76658 + sk,
76659 +#endif
76660 jiffies_to_clock_t(icsk->icsk_rto),
76661 jiffies_to_clock_t(icsk->icsk_ack.ato),
76662 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
76663 @@ -2464,7 +2491,13 @@ static void get_timewait4_sock(const struct inet_timewait_sock *tw,
76664 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK%n",
76665 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
76666 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
76667 - atomic_read(&tw->tw_refcnt), tw, len);
76668 + atomic_read(&tw->tw_refcnt),
76669 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76670 + NULL,
76671 +#else
76672 + tw,
76673 +#endif
76674 + len);
76675 }
76676
76677 #define TMPSZ 150
76678 diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
76679 index b85d9fe..4b0eed9 100644
76680 --- a/net/ipv4/tcp_minisocks.c
76681 +++ b/net/ipv4/tcp_minisocks.c
76682 @@ -27,6 +27,10 @@
76683 #include <net/inet_common.h>
76684 #include <net/xfrm.h>
76685
76686 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76687 +extern int grsec_enable_blackhole;
76688 +#endif
76689 +
76690 int sysctl_tcp_syncookies __read_mostly = 1;
76691 EXPORT_SYMBOL(sysctl_tcp_syncookies);
76692
76693 @@ -754,6 +758,10 @@ listen_overflow:
76694
76695 embryonic_reset:
76696 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
76697 +
76698 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76699 + if (!grsec_enable_blackhole)
76700 +#endif
76701 if (!(flg & TCP_FLAG_RST))
76702 req->rsk_ops->send_reset(sk, skb);
76703
76704 diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
76705 index 4526fe6..1a34e43 100644
76706 --- a/net/ipv4/tcp_probe.c
76707 +++ b/net/ipv4/tcp_probe.c
76708 @@ -204,7 +204,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
76709 if (cnt + width >= len)
76710 break;
76711
76712 - if (copy_to_user(buf + cnt, tbuf, width))
76713 + if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
76714 return -EFAULT;
76715 cnt += width;
76716 }
76717 diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
76718 index e911e6c..d0a9356 100644
76719 --- a/net/ipv4/tcp_timer.c
76720 +++ b/net/ipv4/tcp_timer.c
76721 @@ -22,6 +22,10 @@
76722 #include <linux/gfp.h>
76723 #include <net/tcp.h>
76724
76725 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76726 +extern int grsec_lastack_retries;
76727 +#endif
76728 +
76729 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
76730 int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
76731 int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
76732 @@ -196,6 +200,13 @@ static int tcp_write_timeout(struct sock *sk)
76733 }
76734 }
76735
76736 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76737 + if ((sk->sk_state == TCP_LAST_ACK) &&
76738 + (grsec_lastack_retries > 0) &&
76739 + (grsec_lastack_retries < retry_until))
76740 + retry_until = grsec_lastack_retries;
76741 +#endif
76742 +
76743 if (retransmits_timed_out(sk, retry_until,
76744 syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
76745 /* Has it gone just too far? */
76746 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
76747 index eaca736..60488ae 100644
76748 --- a/net/ipv4/udp.c
76749 +++ b/net/ipv4/udp.c
76750 @@ -87,6 +87,7 @@
76751 #include <linux/types.h>
76752 #include <linux/fcntl.h>
76753 #include <linux/module.h>
76754 +#include <linux/security.h>
76755 #include <linux/socket.h>
76756 #include <linux/sockios.h>
76757 #include <linux/igmp.h>
76758 @@ -110,6 +111,10 @@
76759 #include <linux/static_key.h>
76760 #include "udp_impl.h"
76761
76762 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76763 +extern int grsec_enable_blackhole;
76764 +#endif
76765 +
76766 struct udp_table udp_table __read_mostly;
76767 EXPORT_SYMBOL(udp_table);
76768
76769 @@ -568,6 +573,9 @@ found:
76770 return s;
76771 }
76772
76773 +extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
76774 +extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
76775 +
76776 /*
76777 * This routine is called by the ICMP module when it gets some
76778 * sort of error condition. If err < 0 then the socket should
76779 @@ -859,9 +867,18 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
76780 dport = usin->sin_port;
76781 if (dport == 0)
76782 return -EINVAL;
76783 +
76784 + err = gr_search_udp_sendmsg(sk, usin);
76785 + if (err)
76786 + return err;
76787 } else {
76788 if (sk->sk_state != TCP_ESTABLISHED)
76789 return -EDESTADDRREQ;
76790 +
76791 + err = gr_search_udp_sendmsg(sk, NULL);
76792 + if (err)
76793 + return err;
76794 +
76795 daddr = inet->inet_daddr;
76796 dport = inet->inet_dport;
76797 /* Open fast path for connected socket.
76798 @@ -1103,7 +1120,7 @@ static unsigned int first_packet_length(struct sock *sk)
76799 udp_lib_checksum_complete(skb)) {
76800 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
76801 IS_UDPLITE(sk));
76802 - atomic_inc(&sk->sk_drops);
76803 + atomic_inc_unchecked(&sk->sk_drops);
76804 __skb_unlink(skb, rcvq);
76805 __skb_queue_tail(&list_kill, skb);
76806 }
76807 @@ -1189,6 +1206,10 @@ try_again:
76808 if (!skb)
76809 goto out;
76810
76811 + err = gr_search_udp_recvmsg(sk, skb);
76812 + if (err)
76813 + goto out_free;
76814 +
76815 ulen = skb->len - sizeof(struct udphdr);
76816 copied = len;
76817 if (copied > ulen)
76818 @@ -1498,7 +1519,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
76819
76820 drop:
76821 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
76822 - atomic_inc(&sk->sk_drops);
76823 + atomic_inc_unchecked(&sk->sk_drops);
76824 kfree_skb(skb);
76825 return -1;
76826 }
76827 @@ -1517,7 +1538,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
76828 skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
76829
76830 if (!skb1) {
76831 - atomic_inc(&sk->sk_drops);
76832 + atomic_inc_unchecked(&sk->sk_drops);
76833 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
76834 IS_UDPLITE(sk));
76835 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
76836 @@ -1686,6 +1707,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
76837 goto csum_error;
76838
76839 UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
76840 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76841 + if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
76842 +#endif
76843 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
76844
76845 /*
76846 @@ -2104,8 +2128,13 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
76847 sk_wmem_alloc_get(sp),
76848 sk_rmem_alloc_get(sp),
76849 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
76850 - atomic_read(&sp->sk_refcnt), sp,
76851 - atomic_read(&sp->sk_drops), len);
76852 + atomic_read(&sp->sk_refcnt),
76853 +#ifdef CONFIG_GRKERNSEC_HIDESYM
76854 + NULL,
76855 +#else
76856 + sp,
76857 +#endif
76858 + atomic_read_unchecked(&sp->sk_drops), len);
76859 }
76860
76861 int udp4_seq_show(struct seq_file *seq, void *v)
76862 diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
76863 index 8f6411c..5767579 100644
76864 --- a/net/ipv6/addrconf.c
76865 +++ b/net/ipv6/addrconf.c
76866 @@ -2145,7 +2145,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
76867 p.iph.ihl = 5;
76868 p.iph.protocol = IPPROTO_IPV6;
76869 p.iph.ttl = 64;
76870 - ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
76871 + ifr.ifr_ifru.ifru_data = (void __force_user *)&p;
76872
76873 if (ops->ndo_do_ioctl) {
76874 mm_segment_t oldfs = get_fs();
76875 diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
76876 index db1521f..ebb3314 100644
76877 --- a/net/ipv6/esp6.c
76878 +++ b/net/ipv6/esp6.c
76879 @@ -166,8 +166,6 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
76880 struct esp_data *esp = x->data;
76881
76882 /* skb is pure payload to encrypt */
76883 - err = -ENOMEM;
76884 -
76885 aead = esp->aead;
76886 alen = crypto_aead_authsize(aead);
76887
76888 @@ -202,8 +200,10 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
76889 }
76890
76891 tmp = esp_alloc_tmp(aead, nfrags + sglists, seqhilen);
76892 - if (!tmp)
76893 + if (!tmp) {
76894 + err = -ENOMEM;
76895 goto error;
76896 + }
76897
76898 seqhi = esp_tmp_seqhi(tmp);
76899 iv = esp_tmp_iv(aead, tmp, seqhilen);
76900 diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
76901 index e6cee52..cf47476 100644
76902 --- a/net/ipv6/inet6_connection_sock.c
76903 +++ b/net/ipv6/inet6_connection_sock.c
76904 @@ -178,7 +178,7 @@ void __inet6_csk_dst_store(struct sock *sk, struct dst_entry *dst,
76905 #ifdef CONFIG_XFRM
76906 {
76907 struct rt6_info *rt = (struct rt6_info *)dst;
76908 - rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
76909 + rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
76910 }
76911 #endif
76912 }
76913 @@ -193,7 +193,7 @@ struct dst_entry *__inet6_csk_dst_check(struct sock *sk, u32 cookie)
76914 #ifdef CONFIG_XFRM
76915 if (dst) {
76916 struct rt6_info *rt = (struct rt6_info *)dst;
76917 - if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
76918 + if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
76919 __sk_dst_reset(sk);
76920 dst = NULL;
76921 }
76922 diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
76923 index ba6d13d..6899122 100644
76924 --- a/net/ipv6/ipv6_sockglue.c
76925 +++ b/net/ipv6/ipv6_sockglue.c
76926 @@ -989,7 +989,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
76927 if (sk->sk_type != SOCK_STREAM)
76928 return -ENOPROTOOPT;
76929
76930 - msg.msg_control = optval;
76931 + msg.msg_control = (void __force_kernel *)optval;
76932 msg.msg_controllen = len;
76933 msg.msg_flags = flags;
76934
76935 diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
76936 index 93d6983..8e54c4d 100644
76937 --- a/net/ipv6/raw.c
76938 +++ b/net/ipv6/raw.c
76939 @@ -377,7 +377,7 @@ static inline int rawv6_rcv_skb(struct sock *sk, struct sk_buff *skb)
76940 {
76941 if ((raw6_sk(sk)->checksum || rcu_access_pointer(sk->sk_filter)) &&
76942 skb_checksum_complete(skb)) {
76943 - atomic_inc(&sk->sk_drops);
76944 + atomic_inc_unchecked(&sk->sk_drops);
76945 kfree_skb(skb);
76946 return NET_RX_DROP;
76947 }
76948 @@ -405,7 +405,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
76949 struct raw6_sock *rp = raw6_sk(sk);
76950
76951 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
76952 - atomic_inc(&sk->sk_drops);
76953 + atomic_inc_unchecked(&sk->sk_drops);
76954 kfree_skb(skb);
76955 return NET_RX_DROP;
76956 }
76957 @@ -429,7 +429,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
76958
76959 if (inet->hdrincl) {
76960 if (skb_checksum_complete(skb)) {
76961 - atomic_inc(&sk->sk_drops);
76962 + atomic_inc_unchecked(&sk->sk_drops);
76963 kfree_skb(skb);
76964 return NET_RX_DROP;
76965 }
76966 @@ -602,7 +602,7 @@ out:
76967 return err;
76968 }
76969
76970 -static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
76971 +static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
76972 struct flowi6 *fl6, struct dst_entry **dstp,
76973 unsigned int flags)
76974 {
76975 @@ -914,12 +914,15 @@ do_confirm:
76976 static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
76977 char __user *optval, int optlen)
76978 {
76979 + struct icmp6_filter filter;
76980 +
76981 switch (optname) {
76982 case ICMPV6_FILTER:
76983 if (optlen > sizeof(struct icmp6_filter))
76984 optlen = sizeof(struct icmp6_filter);
76985 - if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
76986 + if (copy_from_user(&filter, optval, optlen))
76987 return -EFAULT;
76988 + raw6_sk(sk)->filter = filter;
76989 return 0;
76990 default:
76991 return -ENOPROTOOPT;
76992 @@ -932,6 +935,7 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
76993 char __user *optval, int __user *optlen)
76994 {
76995 int len;
76996 + struct icmp6_filter filter;
76997
76998 switch (optname) {
76999 case ICMPV6_FILTER:
77000 @@ -943,7 +947,8 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
77001 len = sizeof(struct icmp6_filter);
77002 if (put_user(len, optlen))
77003 return -EFAULT;
77004 - if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
77005 + filter = raw6_sk(sk)->filter;
77006 + if (len > sizeof filter || copy_to_user(optval, &filter, len))
77007 return -EFAULT;
77008 return 0;
77009 default:
77010 @@ -1250,7 +1255,13 @@ static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
77011 0, 0L, 0,
77012 sock_i_uid(sp), 0,
77013 sock_i_ino(sp),
77014 - atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
77015 + atomic_read(&sp->sk_refcnt),
77016 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77017 + NULL,
77018 +#else
77019 + sp,
77020 +#endif
77021 + atomic_read_unchecked(&sp->sk_drops));
77022 }
77023
77024 static int raw6_seq_show(struct seq_file *seq, void *v)
77025 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
77026 index 9df64a5..39875da 100644
77027 --- a/net/ipv6/tcp_ipv6.c
77028 +++ b/net/ipv6/tcp_ipv6.c
77029 @@ -94,6 +94,10 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
77030 }
77031 #endif
77032
77033 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77034 +extern int grsec_enable_blackhole;
77035 +#endif
77036 +
77037 static void tcp_v6_hash(struct sock *sk)
77038 {
77039 if (sk->sk_state != TCP_CLOSE) {
77040 @@ -1544,6 +1548,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
77041 return 0;
77042
77043 reset:
77044 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77045 + if (!grsec_enable_blackhole)
77046 +#endif
77047 tcp_v6_send_reset(sk, skb);
77048 discard:
77049 if (opt_skb)
77050 @@ -1625,12 +1632,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
77051 TCP_SKB_CB(skb)->sacked = 0;
77052
77053 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
77054 - if (!sk)
77055 + if (!sk) {
77056 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77057 + ret = 1;
77058 +#endif
77059 goto no_tcp_socket;
77060 + }
77061
77062 process:
77063 - if (sk->sk_state == TCP_TIME_WAIT)
77064 + if (sk->sk_state == TCP_TIME_WAIT) {
77065 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77066 + ret = 2;
77067 +#endif
77068 goto do_time_wait;
77069 + }
77070
77071 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
77072 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
77073 @@ -1679,6 +1694,10 @@ no_tcp_socket:
77074 bad_packet:
77075 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
77076 } else {
77077 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77078 + if (!grsec_enable_blackhole || (ret == 1 &&
77079 + (skb->dev->flags & IFF_LOOPBACK)))
77080 +#endif
77081 tcp_v6_send_reset(NULL, skb);
77082 }
77083
77084 @@ -1885,7 +1904,13 @@ static void get_openreq6(struct seq_file *seq,
77085 uid,
77086 0, /* non standard timer */
77087 0, /* open_requests have no inode */
77088 - 0, req);
77089 + 0,
77090 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77091 + NULL
77092 +#else
77093 + req
77094 +#endif
77095 + );
77096 }
77097
77098 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
77099 @@ -1935,7 +1960,12 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
77100 sock_i_uid(sp),
77101 icsk->icsk_probes_out,
77102 sock_i_ino(sp),
77103 - atomic_read(&sp->sk_refcnt), sp,
77104 + atomic_read(&sp->sk_refcnt),
77105 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77106 + NULL,
77107 +#else
77108 + sp,
77109 +#endif
77110 jiffies_to_clock_t(icsk->icsk_rto),
77111 jiffies_to_clock_t(icsk->icsk_ack.ato),
77112 (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
77113 @@ -1970,7 +2000,13 @@ static void get_timewait6_sock(struct seq_file *seq,
77114 dest->s6_addr32[2], dest->s6_addr32[3], destp,
77115 tw->tw_substate, 0, 0,
77116 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
77117 - atomic_read(&tw->tw_refcnt), tw);
77118 + atomic_read(&tw->tw_refcnt),
77119 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77120 + NULL
77121 +#else
77122 + tw
77123 +#endif
77124 + );
77125 }
77126
77127 static int tcp6_seq_show(struct seq_file *seq, void *v)
77128 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
77129 index f05099f..ea613f0 100644
77130 --- a/net/ipv6/udp.c
77131 +++ b/net/ipv6/udp.c
77132 @@ -50,6 +50,10 @@
77133 #include <linux/seq_file.h>
77134 #include "udp_impl.h"
77135
77136 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77137 +extern int grsec_enable_blackhole;
77138 +#endif
77139 +
77140 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
77141 {
77142 const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
77143 @@ -615,7 +619,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
77144 return rc;
77145 drop:
77146 UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
77147 - atomic_inc(&sk->sk_drops);
77148 + atomic_inc_unchecked(&sk->sk_drops);
77149 kfree_skb(skb);
77150 return -1;
77151 }
77152 @@ -673,7 +677,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
77153 if (likely(skb1 == NULL))
77154 skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
77155 if (!skb1) {
77156 - atomic_inc(&sk->sk_drops);
77157 + atomic_inc_unchecked(&sk->sk_drops);
77158 UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
77159 IS_UDPLITE(sk));
77160 UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
77161 @@ -844,6 +848,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
77162 goto discard;
77163
77164 UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
77165 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
77166 + if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
77167 +#endif
77168 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
77169
77170 kfree_skb(skb);
77171 @@ -1453,8 +1460,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
77172 0, 0L, 0,
77173 sock_i_uid(sp), 0,
77174 sock_i_ino(sp),
77175 - atomic_read(&sp->sk_refcnt), sp,
77176 - atomic_read(&sp->sk_drops));
77177 + atomic_read(&sp->sk_refcnt),
77178 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77179 + NULL,
77180 +#else
77181 + sp,
77182 +#endif
77183 + atomic_read_unchecked(&sp->sk_drops));
77184 }
77185
77186 int udp6_seq_show(struct seq_file *seq, void *v)
77187 diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
77188 index 6b9d5a0..4dffaf1 100644
77189 --- a/net/irda/ircomm/ircomm_tty.c
77190 +++ b/net/irda/ircomm/ircomm_tty.c
77191 @@ -281,16 +281,16 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
77192 add_wait_queue(&self->open_wait, &wait);
77193
77194 IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
77195 - __FILE__,__LINE__, tty->driver->name, self->open_count );
77196 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
77197
77198 /* As far as I can see, we protect open_count - Jean II */
77199 spin_lock_irqsave(&self->spinlock, flags);
77200 if (!tty_hung_up_p(filp)) {
77201 extra_count = 1;
77202 - self->open_count--;
77203 + local_dec(&self->open_count);
77204 }
77205 spin_unlock_irqrestore(&self->spinlock, flags);
77206 - self->blocked_open++;
77207 + local_inc(&self->blocked_open);
77208
77209 while (1) {
77210 if (tty->termios->c_cflag & CBAUD) {
77211 @@ -330,7 +330,7 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
77212 }
77213
77214 IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
77215 - __FILE__,__LINE__, tty->driver->name, self->open_count );
77216 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
77217
77218 schedule();
77219 }
77220 @@ -341,13 +341,13 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
77221 if (extra_count) {
77222 /* ++ is not atomic, so this should be protected - Jean II */
77223 spin_lock_irqsave(&self->spinlock, flags);
77224 - self->open_count++;
77225 + local_inc(&self->open_count);
77226 spin_unlock_irqrestore(&self->spinlock, flags);
77227 }
77228 - self->blocked_open--;
77229 + local_dec(&self->blocked_open);
77230
77231 IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
77232 - __FILE__,__LINE__, tty->driver->name, self->open_count);
77233 + __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
77234
77235 if (!retval)
77236 self->flags |= ASYNC_NORMAL_ACTIVE;
77237 @@ -412,14 +412,14 @@ static int ircomm_tty_open(struct tty_struct *tty, struct file *filp)
77238 }
77239 /* ++ is not atomic, so this should be protected - Jean II */
77240 spin_lock_irqsave(&self->spinlock, flags);
77241 - self->open_count++;
77242 + local_inc(&self->open_count);
77243
77244 tty->driver_data = self;
77245 self->tty = tty;
77246 spin_unlock_irqrestore(&self->spinlock, flags);
77247
77248 IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
77249 - self->line, self->open_count);
77250 + self->line, local_read(&self->open_count));
77251
77252 /* Not really used by us, but lets do it anyway */
77253 self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
77254 @@ -505,7 +505,7 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
77255 return;
77256 }
77257
77258 - if ((tty->count == 1) && (self->open_count != 1)) {
77259 + if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
77260 /*
77261 * Uh, oh. tty->count is 1, which means that the tty
77262 * structure will be freed. state->count should always
77263 @@ -515,16 +515,16 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
77264 */
77265 IRDA_DEBUG(0, "%s(), bad serial port count; "
77266 "tty->count is 1, state->count is %d\n", __func__ ,
77267 - self->open_count);
77268 - self->open_count = 1;
77269 + local_read(&self->open_count));
77270 + local_set(&self->open_count, 1);
77271 }
77272
77273 - if (--self->open_count < 0) {
77274 + if (local_dec_return(&self->open_count) < 0) {
77275 IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
77276 - __func__, self->line, self->open_count);
77277 - self->open_count = 0;
77278 + __func__, self->line, local_read(&self->open_count));
77279 + local_set(&self->open_count, 0);
77280 }
77281 - if (self->open_count) {
77282 + if (local_read(&self->open_count)) {
77283 spin_unlock_irqrestore(&self->spinlock, flags);
77284
77285 IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
77286 @@ -556,7 +556,7 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
77287 tty->closing = 0;
77288 self->tty = NULL;
77289
77290 - if (self->blocked_open) {
77291 + if (local_read(&self->blocked_open)) {
77292 if (self->close_delay)
77293 schedule_timeout_interruptible(self->close_delay);
77294 wake_up_interruptible(&self->open_wait);
77295 @@ -1008,7 +1008,7 @@ static void ircomm_tty_hangup(struct tty_struct *tty)
77296 spin_lock_irqsave(&self->spinlock, flags);
77297 self->flags &= ~ASYNC_NORMAL_ACTIVE;
77298 self->tty = NULL;
77299 - self->open_count = 0;
77300 + local_set(&self->open_count, 0);
77301 spin_unlock_irqrestore(&self->spinlock, flags);
77302
77303 wake_up_interruptible(&self->open_wait);
77304 @@ -1355,7 +1355,7 @@ static void ircomm_tty_line_info(struct ircomm_tty_cb *self, struct seq_file *m)
77305 seq_putc(m, '\n');
77306
77307 seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
77308 - seq_printf(m, "Open count: %d\n", self->open_count);
77309 + seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
77310 seq_printf(m, "Max data size: %d\n", self->max_data_size);
77311 seq_printf(m, "Max header size: %d\n", self->max_header_size);
77312
77313 diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
77314 index cd6f7a9..e63fe89 100644
77315 --- a/net/iucv/af_iucv.c
77316 +++ b/net/iucv/af_iucv.c
77317 @@ -782,10 +782,10 @@ static int iucv_sock_autobind(struct sock *sk)
77318
77319 write_lock_bh(&iucv_sk_list.lock);
77320
77321 - sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
77322 + sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
77323 while (__iucv_get_sock_by_name(name)) {
77324 sprintf(name, "%08x",
77325 - atomic_inc_return(&iucv_sk_list.autobind_name));
77326 + atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
77327 }
77328
77329 write_unlock_bh(&iucv_sk_list.lock);
77330 diff --git a/net/key/af_key.c b/net/key/af_key.c
77331 index 34e4185..8823368 100644
77332 --- a/net/key/af_key.c
77333 +++ b/net/key/af_key.c
77334 @@ -3016,10 +3016,10 @@ static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, const struc
77335 static u32 get_acqseq(void)
77336 {
77337 u32 res;
77338 - static atomic_t acqseq;
77339 + static atomic_unchecked_t acqseq;
77340
77341 do {
77342 - res = atomic_inc_return(&acqseq);
77343 + res = atomic_inc_return_unchecked(&acqseq);
77344 } while (!res);
77345 return res;
77346 }
77347 diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
77348 index 35e1e4b..9275471 100644
77349 --- a/net/l2tp/l2tp_ip6.c
77350 +++ b/net/l2tp/l2tp_ip6.c
77351 @@ -410,6 +410,7 @@ static int l2tp_ip6_getname(struct socket *sock, struct sockaddr *uaddr,
77352 lsa->l2tp_family = AF_INET6;
77353 lsa->l2tp_flowinfo = 0;
77354 lsa->l2tp_scope_id = 0;
77355 + lsa->l2tp_unused = 0;
77356 if (peer) {
77357 if (!lsk->peer_conn_id)
77358 return -ENOTCONN;
77359 diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
77360 index fe5453c..a13c3e23 100644
77361 --- a/net/llc/af_llc.c
77362 +++ b/net/llc/af_llc.c
77363 @@ -969,14 +969,13 @@ static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
77364 struct sockaddr_llc sllc;
77365 struct sock *sk = sock->sk;
77366 struct llc_sock *llc = llc_sk(sk);
77367 - int rc = 0;
77368 + int rc = -EBADF;
77369
77370 memset(&sllc, 0, sizeof(sllc));
77371 lock_sock(sk);
77372 if (sock_flag(sk, SOCK_ZAPPED))
77373 goto out;
77374 *uaddrlen = sizeof(sllc);
77375 - memset(uaddr, 0, *uaddrlen);
77376 if (peer) {
77377 rc = -ENOTCONN;
77378 if (sk->sk_state != TCP_ESTABLISHED)
77379 diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
77380 index 3f3cd50..d2cf249 100644
77381 --- a/net/mac80211/ieee80211_i.h
77382 +++ b/net/mac80211/ieee80211_i.h
77383 @@ -28,6 +28,7 @@
77384 #include <net/ieee80211_radiotap.h>
77385 #include <net/cfg80211.h>
77386 #include <net/mac80211.h>
77387 +#include <asm/local.h>
77388 #include "key.h"
77389 #include "sta_info.h"
77390
77391 @@ -863,7 +864,7 @@ struct ieee80211_local {
77392 /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
77393 spinlock_t queue_stop_reason_lock;
77394
77395 - int open_count;
77396 + local_t open_count;
77397 int monitors, cooked_mntrs;
77398 /* number of interfaces with corresponding FIF_ flags */
77399 int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
77400 diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
77401 index 8664111..1d6a065 100644
77402 --- a/net/mac80211/iface.c
77403 +++ b/net/mac80211/iface.c
77404 @@ -328,7 +328,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
77405 break;
77406 }
77407
77408 - if (local->open_count == 0) {
77409 + if (local_read(&local->open_count) == 0) {
77410 res = drv_start(local);
77411 if (res)
77412 goto err_del_bss;
77413 @@ -371,7 +371,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
77414 break;
77415 }
77416
77417 - if (local->monitors == 0 && local->open_count == 0) {
77418 + if (local->monitors == 0 && local_read(&local->open_count) == 0) {
77419 res = ieee80211_add_virtual_monitor(local);
77420 if (res)
77421 goto err_stop;
77422 @@ -468,7 +468,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
77423 mutex_unlock(&local->mtx);
77424
77425 if (coming_up)
77426 - local->open_count++;
77427 + local_inc(&local->open_count);
77428
77429 if (hw_reconf_flags)
77430 ieee80211_hw_config(local, hw_reconf_flags);
77431 @@ -481,7 +481,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
77432 err_del_interface:
77433 drv_remove_interface(local, sdata);
77434 err_stop:
77435 - if (!local->open_count)
77436 + if (!local_read(&local->open_count))
77437 drv_stop(local);
77438 err_del_bss:
77439 sdata->bss = NULL;
77440 @@ -613,7 +613,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
77441 }
77442
77443 if (going_down)
77444 - local->open_count--;
77445 + local_dec(&local->open_count);
77446
77447 switch (sdata->vif.type) {
77448 case NL80211_IFTYPE_AP_VLAN:
77449 @@ -685,7 +685,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
77450
77451 ieee80211_recalc_ps(local, -1);
77452
77453 - if (local->open_count == 0) {
77454 + if (local_read(&local->open_count) == 0) {
77455 if (local->ops->napi_poll)
77456 napi_disable(&local->napi);
77457 ieee80211_clear_tx_pending(local);
77458 @@ -717,7 +717,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
77459 }
77460 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
77461
77462 - if (local->monitors == local->open_count && local->monitors > 0)
77463 + if (local->monitors == local_read(&local->open_count) && local->monitors > 0)
77464 ieee80211_add_virtual_monitor(local);
77465 }
77466
77467 diff --git a/net/mac80211/main.c b/net/mac80211/main.c
77468 index f5548e9..474a15f 100644
77469 --- a/net/mac80211/main.c
77470 +++ b/net/mac80211/main.c
77471 @@ -166,7 +166,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
77472 local->hw.conf.power_level = power;
77473 }
77474
77475 - if (changed && local->open_count) {
77476 + if (changed && local_read(&local->open_count)) {
77477 ret = drv_config(local, changed);
77478 /*
77479 * Goal:
77480 diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
77481 index af1c4e2..24dbbe3 100644
77482 --- a/net/mac80211/pm.c
77483 +++ b/net/mac80211/pm.c
77484 @@ -34,7 +34,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
77485 struct ieee80211_sub_if_data *sdata;
77486 struct sta_info *sta;
77487
77488 - if (!local->open_count)
77489 + if (!local_read(&local->open_count))
77490 goto suspend;
77491
77492 ieee80211_scan_cancel(local);
77493 @@ -72,7 +72,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
77494 cancel_work_sync(&local->dynamic_ps_enable_work);
77495 del_timer_sync(&local->dynamic_ps_timer);
77496
77497 - local->wowlan = wowlan && local->open_count;
77498 + local->wowlan = wowlan && local_read(&local->open_count);
77499 if (local->wowlan) {
77500 int err = drv_suspend(local, wowlan);
77501 if (err < 0) {
77502 @@ -132,7 +132,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
77503 drv_remove_interface(local, sdata);
77504
77505 /* stop hardware - this must stop RX */
77506 - if (local->open_count)
77507 + if (local_read(&local->open_count))
77508 ieee80211_stop_device(local);
77509
77510 suspend:
77511 diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
77512 index 3313c11..bec9f17 100644
77513 --- a/net/mac80211/rate.c
77514 +++ b/net/mac80211/rate.c
77515 @@ -494,7 +494,7 @@ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
77516
77517 ASSERT_RTNL();
77518
77519 - if (local->open_count)
77520 + if (local_read(&local->open_count))
77521 return -EBUSY;
77522
77523 if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
77524 diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
77525 index c97a065..ff61928 100644
77526 --- a/net/mac80211/rc80211_pid_debugfs.c
77527 +++ b/net/mac80211/rc80211_pid_debugfs.c
77528 @@ -193,7 +193,7 @@ static ssize_t rate_control_pid_events_read(struct file *file, char __user *buf,
77529
77530 spin_unlock_irqrestore(&events->lock, status);
77531
77532 - if (copy_to_user(buf, pb, p))
77533 + if (p > sizeof(pb) || copy_to_user(buf, pb, p))
77534 return -EFAULT;
77535
77536 return p;
77537 diff --git a/net/mac80211/util.c b/net/mac80211/util.c
77538 index f564b5e..22fee47 100644
77539 --- a/net/mac80211/util.c
77540 +++ b/net/mac80211/util.c
77541 @@ -1224,7 +1224,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
77542 }
77543 #endif
77544 /* everything else happens only if HW was up & running */
77545 - if (!local->open_count)
77546 + if (!local_read(&local->open_count))
77547 goto wake_up;
77548
77549 /*
77550 diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
77551 index 209c1ed..39484dc 100644
77552 --- a/net/netfilter/Kconfig
77553 +++ b/net/netfilter/Kconfig
77554 @@ -851,6 +851,16 @@ config NETFILTER_XT_MATCH_ESP
77555
77556 To compile it as a module, choose M here. If unsure, say N.
77557
77558 +config NETFILTER_XT_MATCH_GRADM
77559 + tristate '"gradm" match support'
77560 + depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
77561 + depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
77562 + ---help---
77563 + The gradm match allows to match on grsecurity RBAC being enabled.
77564 + It is useful when iptables rules are applied early on bootup to
77565 + prevent connections to the machine (except from a trusted host)
77566 + while the RBAC system is disabled.
77567 +
77568 config NETFILTER_XT_MATCH_HASHLIMIT
77569 tristate '"hashlimit" match support'
77570 depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
77571 diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
77572 index 4e7960c..89e48d4 100644
77573 --- a/net/netfilter/Makefile
77574 +++ b/net/netfilter/Makefile
77575 @@ -87,6 +87,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_DEVGROUP) += xt_devgroup.o
77576 obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
77577 obj-$(CONFIG_NETFILTER_XT_MATCH_ECN) += xt_ecn.o
77578 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
77579 +obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
77580 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
77581 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
77582 obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
77583 diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
77584 index 1548df9..98ad9b4 100644
77585 --- a/net/netfilter/ipvs/ip_vs_conn.c
77586 +++ b/net/netfilter/ipvs/ip_vs_conn.c
77587 @@ -557,7 +557,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
77588 /* Increase the refcnt counter of the dest */
77589 atomic_inc(&dest->refcnt);
77590
77591 - conn_flags = atomic_read(&dest->conn_flags);
77592 + conn_flags = atomic_read_unchecked(&dest->conn_flags);
77593 if (cp->protocol != IPPROTO_UDP)
77594 conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
77595 flags = cp->flags;
77596 @@ -902,7 +902,7 @@ ip_vs_conn_new(const struct ip_vs_conn_param *p,
77597 atomic_set(&cp->refcnt, 1);
77598
77599 atomic_set(&cp->n_control, 0);
77600 - atomic_set(&cp->in_pkts, 0);
77601 + atomic_set_unchecked(&cp->in_pkts, 0);
77602
77603 atomic_inc(&ipvs->conn_count);
77604 if (flags & IP_VS_CONN_F_NO_CPORT)
77605 @@ -1183,7 +1183,7 @@ static inline int todrop_entry(struct ip_vs_conn *cp)
77606
77607 /* Don't drop the entry if its number of incoming packets is not
77608 located in [0, 8] */
77609 - i = atomic_read(&cp->in_pkts);
77610 + i = atomic_read_unchecked(&cp->in_pkts);
77611 if (i > 8 || i < 0) return 0;
77612
77613 if (!todrop_rate[i]) return 0;
77614 diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
77615 index a54b018c..07e0120 100644
77616 --- a/net/netfilter/ipvs/ip_vs_core.c
77617 +++ b/net/netfilter/ipvs/ip_vs_core.c
77618 @@ -562,7 +562,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
77619 ret = cp->packet_xmit(skb, cp, pd->pp);
77620 /* do not touch skb anymore */
77621
77622 - atomic_inc(&cp->in_pkts);
77623 + atomic_inc_unchecked(&cp->in_pkts);
77624 ip_vs_conn_put(cp);
77625 return ret;
77626 }
77627 @@ -1611,7 +1611,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af)
77628 if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
77629 pkts = sysctl_sync_threshold(ipvs);
77630 else
77631 - pkts = atomic_add_return(1, &cp->in_pkts);
77632 + pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
77633
77634 if (ipvs->sync_state & IP_VS_STATE_MASTER)
77635 ip_vs_sync_conn(net, cp, pkts);
77636 diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
77637 index 84444dd..f91c066 100644
77638 --- a/net/netfilter/ipvs/ip_vs_ctl.c
77639 +++ b/net/netfilter/ipvs/ip_vs_ctl.c
77640 @@ -788,7 +788,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
77641 ip_vs_rs_hash(ipvs, dest);
77642 write_unlock_bh(&ipvs->rs_lock);
77643 }
77644 - atomic_set(&dest->conn_flags, conn_flags);
77645 + atomic_set_unchecked(&dest->conn_flags, conn_flags);
77646
77647 /* bind the service */
77648 if (!dest->svc) {
77649 @@ -2074,7 +2074,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
77650 " %-7s %-6d %-10d %-10d\n",
77651 &dest->addr.in6,
77652 ntohs(dest->port),
77653 - ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
77654 + ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
77655 atomic_read(&dest->weight),
77656 atomic_read(&dest->activeconns),
77657 atomic_read(&dest->inactconns));
77658 @@ -2085,7 +2085,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
77659 "%-7s %-6d %-10d %-10d\n",
77660 ntohl(dest->addr.ip),
77661 ntohs(dest->port),
77662 - ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
77663 + ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
77664 atomic_read(&dest->weight),
77665 atomic_read(&dest->activeconns),
77666 atomic_read(&dest->inactconns));
77667 @@ -2555,7 +2555,7 @@ __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
77668
77669 entry.addr = dest->addr.ip;
77670 entry.port = dest->port;
77671 - entry.conn_flags = atomic_read(&dest->conn_flags);
77672 + entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
77673 entry.weight = atomic_read(&dest->weight);
77674 entry.u_threshold = dest->u_threshold;
77675 entry.l_threshold = dest->l_threshold;
77676 @@ -2759,6 +2759,7 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
77677 {
77678 struct ip_vs_timeout_user t;
77679
77680 + memset(&t, 0, sizeof(t));
77681 __ip_vs_get_timeouts(net, &t);
77682 if (copy_to_user(user, &t, sizeof(t)) != 0)
77683 ret = -EFAULT;
77684 @@ -3089,7 +3090,7 @@ static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
77685 if (nla_put(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr) ||
77686 nla_put_u16(skb, IPVS_DEST_ATTR_PORT, dest->port) ||
77687 nla_put_u32(skb, IPVS_DEST_ATTR_FWD_METHOD,
77688 - (atomic_read(&dest->conn_flags) &
77689 + (atomic_read_unchecked(&dest->conn_flags) &
77690 IP_VS_CONN_F_FWD_MASK)) ||
77691 nla_put_u32(skb, IPVS_DEST_ATTR_WEIGHT,
77692 atomic_read(&dest->weight)) ||
77693 diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
77694 index effa10c..9058928 100644
77695 --- a/net/netfilter/ipvs/ip_vs_sync.c
77696 +++ b/net/netfilter/ipvs/ip_vs_sync.c
77697 @@ -596,7 +596,7 @@ static void ip_vs_sync_conn_v0(struct net *net, struct ip_vs_conn *cp,
77698 cp = cp->control;
77699 if (cp) {
77700 if (cp->flags & IP_VS_CONN_F_TEMPLATE)
77701 - pkts = atomic_add_return(1, &cp->in_pkts);
77702 + pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
77703 else
77704 pkts = sysctl_sync_threshold(ipvs);
77705 ip_vs_sync_conn(net, cp->control, pkts);
77706 @@ -758,7 +758,7 @@ control:
77707 if (!cp)
77708 return;
77709 if (cp->flags & IP_VS_CONN_F_TEMPLATE)
77710 - pkts = atomic_add_return(1, &cp->in_pkts);
77711 + pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
77712 else
77713 pkts = sysctl_sync_threshold(ipvs);
77714 goto sloop;
77715 @@ -885,7 +885,7 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
77716
77717 if (opt)
77718 memcpy(&cp->in_seq, opt, sizeof(*opt));
77719 - atomic_set(&cp->in_pkts, sysctl_sync_threshold(ipvs));
77720 + atomic_set_unchecked(&cp->in_pkts, sysctl_sync_threshold(ipvs));
77721 cp->state = state;
77722 cp->old_state = cp->state;
77723 /*
77724 diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
77725 index 7fd66de..e6fb361 100644
77726 --- a/net/netfilter/ipvs/ip_vs_xmit.c
77727 +++ b/net/netfilter/ipvs/ip_vs_xmit.c
77728 @@ -1151,7 +1151,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
77729 else
77730 rc = NF_ACCEPT;
77731 /* do not touch skb anymore */
77732 - atomic_inc(&cp->in_pkts);
77733 + atomic_inc_unchecked(&cp->in_pkts);
77734 goto out;
77735 }
77736
77737 @@ -1272,7 +1272,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
77738 else
77739 rc = NF_ACCEPT;
77740 /* do not touch skb anymore */
77741 - atomic_inc(&cp->in_pkts);
77742 + atomic_inc_unchecked(&cp->in_pkts);
77743 goto out;
77744 }
77745
77746 diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
77747 index ac3af97..c134c21 100644
77748 --- a/net/netfilter/nf_conntrack_core.c
77749 +++ b/net/netfilter/nf_conntrack_core.c
77750 @@ -1530,6 +1530,10 @@ err_proto:
77751 #define UNCONFIRMED_NULLS_VAL ((1<<30)+0)
77752 #define DYING_NULLS_VAL ((1<<30)+1)
77753
77754 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77755 +static atomic_unchecked_t conntrack_cache_id = ATOMIC_INIT(0);
77756 +#endif
77757 +
77758 static int nf_conntrack_init_net(struct net *net)
77759 {
77760 int ret;
77761 @@ -1543,7 +1547,11 @@ static int nf_conntrack_init_net(struct net *net)
77762 goto err_stat;
77763 }
77764
77765 +#ifdef CONFIG_GRKERNSEC_HIDESYM
77766 + net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%08lx", atomic_inc_return_unchecked(&conntrack_cache_id));
77767 +#else
77768 net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net);
77769 +#endif
77770 if (!net->ct.slabname) {
77771 ret = -ENOMEM;
77772 goto err_slabname;
77773 diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
77774 index 3c3cfc0..7a6ea1a 100644
77775 --- a/net/netfilter/nfnetlink_log.c
77776 +++ b/net/netfilter/nfnetlink_log.c
77777 @@ -70,7 +70,7 @@ struct nfulnl_instance {
77778 };
77779
77780 static DEFINE_SPINLOCK(instances_lock);
77781 -static atomic_t global_seq;
77782 +static atomic_unchecked_t global_seq;
77783
77784 #define INSTANCE_BUCKETS 16
77785 static struct hlist_head instance_table[INSTANCE_BUCKETS];
77786 @@ -517,7 +517,7 @@ __build_packet_message(struct nfulnl_instance *inst,
77787 /* global sequence number */
77788 if ((inst->flags & NFULNL_CFG_F_SEQ_GLOBAL) &&
77789 nla_put_be32(inst->skb, NFULA_SEQ_GLOBAL,
77790 - htonl(atomic_inc_return(&global_seq))))
77791 + htonl(atomic_inc_return_unchecked(&global_seq))))
77792 goto nla_put_failure;
77793
77794 if (data_len) {
77795 diff --git a/net/netfilter/xt_gradm.c b/net/netfilter/xt_gradm.c
77796 new file mode 100644
77797 index 0000000..6905327
77798 --- /dev/null
77799 +++ b/net/netfilter/xt_gradm.c
77800 @@ -0,0 +1,51 @@
77801 +/*
77802 + * gradm match for netfilter
77803 + * Copyright © Zbigniew Krzystolik, 2010
77804 + *
77805 + * This program is free software; you can redistribute it and/or modify
77806 + * it under the terms of the GNU General Public License; either version
77807 + * 2 or 3 as published by the Free Software Foundation.
77808 + */
77809 +#include <linux/module.h>
77810 +#include <linux/moduleparam.h>
77811 +#include <linux/skbuff.h>
77812 +#include <linux/netfilter/x_tables.h>
77813 +#include <linux/grsecurity.h>
77814 +#include <linux/netfilter/xt_gradm.h>
77815 +
77816 +static bool
77817 +gradm_mt(const struct sk_buff *skb, struct xt_action_param *par)
77818 +{
77819 + const struct xt_gradm_mtinfo *info = par->matchinfo;
77820 + bool retval = false;
77821 + if (gr_acl_is_enabled())
77822 + retval = true;
77823 + return retval ^ info->invflags;
77824 +}
77825 +
77826 +static struct xt_match gradm_mt_reg __read_mostly = {
77827 + .name = "gradm",
77828 + .revision = 0,
77829 + .family = NFPROTO_UNSPEC,
77830 + .match = gradm_mt,
77831 + .matchsize = XT_ALIGN(sizeof(struct xt_gradm_mtinfo)),
77832 + .me = THIS_MODULE,
77833 +};
77834 +
77835 +static int __init gradm_mt_init(void)
77836 +{
77837 + return xt_register_match(&gradm_mt_reg);
77838 +}
77839 +
77840 +static void __exit gradm_mt_exit(void)
77841 +{
77842 + xt_unregister_match(&gradm_mt_reg);
77843 +}
77844 +
77845 +module_init(gradm_mt_init);
77846 +module_exit(gradm_mt_exit);
77847 +MODULE_AUTHOR("Zbigniew Krzystolik <zbyniu@destrukcja.pl>");
77848 +MODULE_DESCRIPTION("Xtables: Grsecurity RBAC match");
77849 +MODULE_LICENSE("GPL");
77850 +MODULE_ALIAS("ipt_gradm");
77851 +MODULE_ALIAS("ip6t_gradm");
77852 diff --git a/net/netfilter/xt_statistic.c b/net/netfilter/xt_statistic.c
77853 index 4fe4fb4..87a89e5 100644
77854 --- a/net/netfilter/xt_statistic.c
77855 +++ b/net/netfilter/xt_statistic.c
77856 @@ -19,7 +19,7 @@
77857 #include <linux/module.h>
77858
77859 struct xt_statistic_priv {
77860 - atomic_t count;
77861 + atomic_unchecked_t count;
77862 } ____cacheline_aligned_in_smp;
77863
77864 MODULE_LICENSE("GPL");
77865 @@ -42,9 +42,9 @@ statistic_mt(const struct sk_buff *skb, struct xt_action_param *par)
77866 break;
77867 case XT_STATISTIC_MODE_NTH:
77868 do {
77869 - oval = atomic_read(&info->master->count);
77870 + oval = atomic_read_unchecked(&info->master->count);
77871 nval = (oval == info->u.nth.every) ? 0 : oval + 1;
77872 - } while (atomic_cmpxchg(&info->master->count, oval, nval) != oval);
77873 + } while (atomic_cmpxchg_unchecked(&info->master->count, oval, nval) != oval);
77874 if (nval == 0)
77875 ret = !ret;
77876 break;
77877 @@ -64,7 +64,7 @@ static int statistic_mt_check(const struct xt_mtchk_param *par)
77878 info->master = kzalloc(sizeof(*info->master), GFP_KERNEL);
77879 if (info->master == NULL)
77880 return -ENOMEM;
77881 - atomic_set(&info->master->count, info->u.nth.count);
77882 + atomic_set_unchecked(&info->master->count, info->u.nth.count);
77883
77884 return 0;
77885 }
77886 diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
77887 index b3025a6..e717db9 100644
77888 --- a/net/netlink/af_netlink.c
77889 +++ b/net/netlink/af_netlink.c
77890 @@ -753,7 +753,7 @@ static void netlink_overrun(struct sock *sk)
77891 sk->sk_error_report(sk);
77892 }
77893 }
77894 - atomic_inc(&sk->sk_drops);
77895 + atomic_inc_unchecked(&sk->sk_drops);
77896 }
77897
77898 static struct sock *netlink_getsockbypid(struct sock *ssk, u32 pid)
77899 @@ -1344,7 +1344,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
77900 if (NULL == siocb->scm)
77901 siocb->scm = &scm;
77902
77903 - err = scm_send(sock, msg, siocb->scm);
77904 + err = scm_send(sock, msg, siocb->scm, true);
77905 if (err < 0)
77906 return err;
77907
77908 @@ -1355,7 +1355,8 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
77909 dst_pid = addr->nl_pid;
77910 dst_group = ffs(addr->nl_groups);
77911 err = -EPERM;
77912 - if (dst_group && !netlink_capable(sock, NL_NONROOT_SEND))
77913 + if ((dst_group || dst_pid) &&
77914 + !netlink_capable(sock, NL_NONROOT_SEND))
77915 goto out;
77916 } else {
77917 dst_pid = nlk->dst_pid;
77918 @@ -2022,7 +2023,7 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
77919 sk_wmem_alloc_get(s),
77920 nlk->cb,
77921 atomic_read(&s->sk_refcnt),
77922 - atomic_read(&s->sk_drops),
77923 + atomic_read_unchecked(&s->sk_drops),
77924 sock_i_ino(s)
77925 );
77926
77927 @@ -2124,6 +2125,7 @@ static void __init netlink_add_usersock_entry(void)
77928 rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners);
77929 nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
77930 nl_table[NETLINK_USERSOCK].registered = 1;
77931 + nl_table[NETLINK_USERSOCK].nl_nonroot = NL_NONROOT_SEND;
77932
77933 netlink_table_ungrab();
77934 }
77935 diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
77936 index 06592d8..64860f6 100644
77937 --- a/net/netrom/af_netrom.c
77938 +++ b/net/netrom/af_netrom.c
77939 @@ -838,6 +838,7 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
77940 struct sock *sk = sock->sk;
77941 struct nr_sock *nr = nr_sk(sk);
77942
77943 + memset(sax, 0, sizeof(*sax));
77944 lock_sock(sk);
77945 if (peer != 0) {
77946 if (sk->sk_state != TCP_ESTABLISHED) {
77947 @@ -852,7 +853,6 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
77948 *uaddr_len = sizeof(struct full_sockaddr_ax25);
77949 } else {
77950 sax->fsa_ax25.sax25_family = AF_NETROM;
77951 - sax->fsa_ax25.sax25_ndigis = 0;
77952 sax->fsa_ax25.sax25_call = nr->source_addr;
77953 *uaddr_len = sizeof(struct sockaddr_ax25);
77954 }
77955 diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
77956 index 0f66174..e7cb04c 100644
77957 --- a/net/packet/af_packet.c
77958 +++ b/net/packet/af_packet.c
77959 @@ -1687,7 +1687,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
77960
77961 spin_lock(&sk->sk_receive_queue.lock);
77962 po->stats.tp_packets++;
77963 - skb->dropcount = atomic_read(&sk->sk_drops);
77964 + skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
77965 __skb_queue_tail(&sk->sk_receive_queue, skb);
77966 spin_unlock(&sk->sk_receive_queue.lock);
77967 sk->sk_data_ready(sk, skb->len);
77968 @@ -1696,7 +1696,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
77969 drop_n_acct:
77970 spin_lock(&sk->sk_receive_queue.lock);
77971 po->stats.tp_drops++;
77972 - atomic_inc(&sk->sk_drops);
77973 + atomic_inc_unchecked(&sk->sk_drops);
77974 spin_unlock(&sk->sk_receive_queue.lock);
77975
77976 drop_n_restore:
77977 @@ -2641,6 +2641,7 @@ out:
77978
77979 static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
77980 {
77981 + struct sock_extended_err ee;
77982 struct sock_exterr_skb *serr;
77983 struct sk_buff *skb, *skb2;
77984 int copied, err;
77985 @@ -2662,8 +2663,9 @@ static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
77986 sock_recv_timestamp(msg, sk, skb);
77987
77988 serr = SKB_EXT_ERR(skb);
77989 + ee = serr->ee;
77990 put_cmsg(msg, SOL_PACKET, PACKET_TX_TIMESTAMP,
77991 - sizeof(serr->ee), &serr->ee);
77992 + sizeof ee, &ee);
77993
77994 msg->msg_flags |= MSG_ERRQUEUE;
77995 err = copied;
77996 @@ -3275,7 +3277,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
77997 case PACKET_HDRLEN:
77998 if (len > sizeof(int))
77999 len = sizeof(int);
78000 - if (copy_from_user(&val, optval, len))
78001 + if (len > sizeof(val) || copy_from_user(&val, optval, len))
78002 return -EFAULT;
78003 switch (val) {
78004 case TPACKET_V1:
78005 @@ -3314,7 +3316,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
78006 len = lv;
78007 if (put_user(len, optlen))
78008 return -EFAULT;
78009 - if (copy_to_user(optval, data, len))
78010 + if (len > sizeof(st) || copy_to_user(optval, data, len))
78011 return -EFAULT;
78012 return 0;
78013 }
78014 diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
78015 index 5a940db..f0b9c12 100644
78016 --- a/net/phonet/af_phonet.c
78017 +++ b/net/phonet/af_phonet.c
78018 @@ -41,7 +41,7 @@ static struct phonet_protocol *phonet_proto_get(unsigned int protocol)
78019 {
78020 struct phonet_protocol *pp;
78021
78022 - if (protocol >= PHONET_NPROTO)
78023 + if (protocol < 0 || protocol >= PHONET_NPROTO)
78024 return NULL;
78025
78026 rcu_read_lock();
78027 @@ -469,7 +469,7 @@ int __init_or_module phonet_proto_register(unsigned int protocol,
78028 {
78029 int err = 0;
78030
78031 - if (protocol >= PHONET_NPROTO)
78032 + if (protocol < 0 || protocol >= PHONET_NPROTO)
78033 return -EINVAL;
78034
78035 err = proto_register(pp->prot, 1);
78036 diff --git a/net/phonet/pep.c b/net/phonet/pep.c
78037 index 576f22c..bc7a71b 100644
78038 --- a/net/phonet/pep.c
78039 +++ b/net/phonet/pep.c
78040 @@ -388,7 +388,7 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
78041
78042 case PNS_PEP_CTRL_REQ:
78043 if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) {
78044 - atomic_inc(&sk->sk_drops);
78045 + atomic_inc_unchecked(&sk->sk_drops);
78046 break;
78047 }
78048 __skb_pull(skb, 4);
78049 @@ -409,7 +409,7 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
78050 }
78051
78052 if (pn->rx_credits == 0) {
78053 - atomic_inc(&sk->sk_drops);
78054 + atomic_inc_unchecked(&sk->sk_drops);
78055 err = -ENOBUFS;
78056 break;
78057 }
78058 @@ -580,7 +580,7 @@ static int pipe_handler_do_rcv(struct sock *sk, struct sk_buff *skb)
78059 }
78060
78061 if (pn->rx_credits == 0) {
78062 - atomic_inc(&sk->sk_drops);
78063 + atomic_inc_unchecked(&sk->sk_drops);
78064 err = NET_RX_DROP;
78065 break;
78066 }
78067 diff --git a/net/phonet/socket.c b/net/phonet/socket.c
78068 index 0acc943..c727611 100644
78069 --- a/net/phonet/socket.c
78070 +++ b/net/phonet/socket.c
78071 @@ -613,8 +613,13 @@ static int pn_sock_seq_show(struct seq_file *seq, void *v)
78072 pn->resource, sk->sk_state,
78073 sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
78074 sock_i_uid(sk), sock_i_ino(sk),
78075 - atomic_read(&sk->sk_refcnt), sk,
78076 - atomic_read(&sk->sk_drops), &len);
78077 + atomic_read(&sk->sk_refcnt),
78078 +#ifdef CONFIG_GRKERNSEC_HIDESYM
78079 + NULL,
78080 +#else
78081 + sk,
78082 +#endif
78083 + atomic_read_unchecked(&sk->sk_drops), &len);
78084 }
78085 seq_printf(seq, "%*s\n", 127 - len, "");
78086 return 0;
78087 diff --git a/net/rds/cong.c b/net/rds/cong.c
78088 index e5b65ac..f3b6fb7 100644
78089 --- a/net/rds/cong.c
78090 +++ b/net/rds/cong.c
78091 @@ -78,7 +78,7 @@
78092 * finds that the saved generation number is smaller than the global generation
78093 * number, it wakes up the process.
78094 */
78095 -static atomic_t rds_cong_generation = ATOMIC_INIT(0);
78096 +static atomic_unchecked_t rds_cong_generation = ATOMIC_INIT(0);
78097
78098 /*
78099 * Congestion monitoring
78100 @@ -233,7 +233,7 @@ void rds_cong_map_updated(struct rds_cong_map *map, uint64_t portmask)
78101 rdsdebug("waking map %p for %pI4\n",
78102 map, &map->m_addr);
78103 rds_stats_inc(s_cong_update_received);
78104 - atomic_inc(&rds_cong_generation);
78105 + atomic_inc_unchecked(&rds_cong_generation);
78106 if (waitqueue_active(&map->m_waitq))
78107 wake_up(&map->m_waitq);
78108 if (waitqueue_active(&rds_poll_waitq))
78109 @@ -259,7 +259,7 @@ EXPORT_SYMBOL_GPL(rds_cong_map_updated);
78110
78111 int rds_cong_updated_since(unsigned long *recent)
78112 {
78113 - unsigned long gen = atomic_read(&rds_cong_generation);
78114 + unsigned long gen = atomic_read_unchecked(&rds_cong_generation);
78115
78116 if (likely(*recent == gen))
78117 return 0;
78118 diff --git a/net/rds/ib.h b/net/rds/ib.h
78119 index 8d2b3d5..227ec5b 100644
78120 --- a/net/rds/ib.h
78121 +++ b/net/rds/ib.h
78122 @@ -128,7 +128,7 @@ struct rds_ib_connection {
78123 /* sending acks */
78124 unsigned long i_ack_flags;
78125 #ifdef KERNEL_HAS_ATOMIC64
78126 - atomic64_t i_ack_next; /* next ACK to send */
78127 + atomic64_unchecked_t i_ack_next; /* next ACK to send */
78128 #else
78129 spinlock_t i_ack_lock; /* protect i_ack_next */
78130 u64 i_ack_next; /* next ACK to send */
78131 diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
78132 index a1e1162..265e129 100644
78133 --- a/net/rds/ib_cm.c
78134 +++ b/net/rds/ib_cm.c
78135 @@ -718,7 +718,7 @@ void rds_ib_conn_shutdown(struct rds_connection *conn)
78136 /* Clear the ACK state */
78137 clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
78138 #ifdef KERNEL_HAS_ATOMIC64
78139 - atomic64_set(&ic->i_ack_next, 0);
78140 + atomic64_set_unchecked(&ic->i_ack_next, 0);
78141 #else
78142 ic->i_ack_next = 0;
78143 #endif
78144 diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
78145 index 8d19491..05a3e65 100644
78146 --- a/net/rds/ib_recv.c
78147 +++ b/net/rds/ib_recv.c
78148 @@ -592,7 +592,7 @@ static u64 rds_ib_get_ack(struct rds_ib_connection *ic)
78149 static void rds_ib_set_ack(struct rds_ib_connection *ic, u64 seq,
78150 int ack_required)
78151 {
78152 - atomic64_set(&ic->i_ack_next, seq);
78153 + atomic64_set_unchecked(&ic->i_ack_next, seq);
78154 if (ack_required) {
78155 smp_mb__before_clear_bit();
78156 set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
78157 @@ -604,7 +604,7 @@ static u64 rds_ib_get_ack(struct rds_ib_connection *ic)
78158 clear_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
78159 smp_mb__after_clear_bit();
78160
78161 - return atomic64_read(&ic->i_ack_next);
78162 + return atomic64_read_unchecked(&ic->i_ack_next);
78163 }
78164 #endif
78165
78166 diff --git a/net/rds/iw.h b/net/rds/iw.h
78167 index 04ce3b1..48119a6 100644
78168 --- a/net/rds/iw.h
78169 +++ b/net/rds/iw.h
78170 @@ -134,7 +134,7 @@ struct rds_iw_connection {
78171 /* sending acks */
78172 unsigned long i_ack_flags;
78173 #ifdef KERNEL_HAS_ATOMIC64
78174 - atomic64_t i_ack_next; /* next ACK to send */
78175 + atomic64_unchecked_t i_ack_next; /* next ACK to send */
78176 #else
78177 spinlock_t i_ack_lock; /* protect i_ack_next */
78178 u64 i_ack_next; /* next ACK to send */
78179 diff --git a/net/rds/iw_cm.c b/net/rds/iw_cm.c
78180 index a91e1db..cf3053f 100644
78181 --- a/net/rds/iw_cm.c
78182 +++ b/net/rds/iw_cm.c
78183 @@ -663,7 +663,7 @@ void rds_iw_conn_shutdown(struct rds_connection *conn)
78184 /* Clear the ACK state */
78185 clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
78186 #ifdef KERNEL_HAS_ATOMIC64
78187 - atomic64_set(&ic->i_ack_next, 0);
78188 + atomic64_set_unchecked(&ic->i_ack_next, 0);
78189 #else
78190 ic->i_ack_next = 0;
78191 #endif
78192 diff --git a/net/rds/iw_recv.c b/net/rds/iw_recv.c
78193 index 4503335..db566b4 100644
78194 --- a/net/rds/iw_recv.c
78195 +++ b/net/rds/iw_recv.c
78196 @@ -427,7 +427,7 @@ static u64 rds_iw_get_ack(struct rds_iw_connection *ic)
78197 static void rds_iw_set_ack(struct rds_iw_connection *ic, u64 seq,
78198 int ack_required)
78199 {
78200 - atomic64_set(&ic->i_ack_next, seq);
78201 + atomic64_set_unchecked(&ic->i_ack_next, seq);
78202 if (ack_required) {
78203 smp_mb__before_clear_bit();
78204 set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
78205 @@ -439,7 +439,7 @@ static u64 rds_iw_get_ack(struct rds_iw_connection *ic)
78206 clear_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
78207 smp_mb__after_clear_bit();
78208
78209 - return atomic64_read(&ic->i_ack_next);
78210 + return atomic64_read_unchecked(&ic->i_ack_next);
78211 }
78212 #endif
78213
78214 diff --git a/net/rds/recv.c b/net/rds/recv.c
78215 index 5c6e9f1..9f0f17c 100644
78216 --- a/net/rds/recv.c
78217 +++ b/net/rds/recv.c
78218 @@ -410,6 +410,8 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
78219
78220 rdsdebug("size %zu flags 0x%x timeo %ld\n", size, msg_flags, timeo);
78221
78222 + msg->msg_namelen = 0;
78223 +
78224 if (msg_flags & MSG_OOB)
78225 goto out;
78226
78227 @@ -485,6 +487,7 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
78228 sin->sin_port = inc->i_hdr.h_sport;
78229 sin->sin_addr.s_addr = inc->i_saddr;
78230 memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
78231 + msg->msg_namelen = sizeof(*sin);
78232 }
78233 break;
78234 }
78235 diff --git a/net/rds/tcp.c b/net/rds/tcp.c
78236 index edac9ef..16bcb98 100644
78237 --- a/net/rds/tcp.c
78238 +++ b/net/rds/tcp.c
78239 @@ -59,7 +59,7 @@ void rds_tcp_nonagle(struct socket *sock)
78240 int val = 1;
78241
78242 set_fs(KERNEL_DS);
78243 - sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __user *)&val,
78244 + sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __force_user *)&val,
78245 sizeof(val));
78246 set_fs(oldfs);
78247 }
78248 diff --git a/net/rds/tcp_send.c b/net/rds/tcp_send.c
78249 index 1b4fd68..2234175 100644
78250 --- a/net/rds/tcp_send.c
78251 +++ b/net/rds/tcp_send.c
78252 @@ -43,7 +43,7 @@ static void rds_tcp_cork(struct socket *sock, int val)
78253
78254 oldfs = get_fs();
78255 set_fs(KERNEL_DS);
78256 - sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __user *)&val,
78257 + sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __force_user *)&val,
78258 sizeof(val));
78259 set_fs(oldfs);
78260 }
78261 diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
78262 index 05996d0..5a1dfe0 100644
78263 --- a/net/rxrpc/af_rxrpc.c
78264 +++ b/net/rxrpc/af_rxrpc.c
78265 @@ -39,7 +39,7 @@ static const struct proto_ops rxrpc_rpc_ops;
78266 __be32 rxrpc_epoch;
78267
78268 /* current debugging ID */
78269 -atomic_t rxrpc_debug_id;
78270 +atomic_unchecked_t rxrpc_debug_id;
78271
78272 /* count of skbs currently in use */
78273 atomic_t rxrpc_n_skbs;
78274 diff --git a/net/rxrpc/ar-ack.c b/net/rxrpc/ar-ack.c
78275 index e4d9cbc..b229649 100644
78276 --- a/net/rxrpc/ar-ack.c
78277 +++ b/net/rxrpc/ar-ack.c
78278 @@ -175,7 +175,7 @@ static void rxrpc_resend(struct rxrpc_call *call)
78279
78280 _enter("{%d,%d,%d,%d},",
78281 call->acks_hard, call->acks_unacked,
78282 - atomic_read(&call->sequence),
78283 + atomic_read_unchecked(&call->sequence),
78284 CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
78285
78286 stop = 0;
78287 @@ -199,7 +199,7 @@ static void rxrpc_resend(struct rxrpc_call *call)
78288
78289 /* each Tx packet has a new serial number */
78290 sp->hdr.serial =
78291 - htonl(atomic_inc_return(&call->conn->serial));
78292 + htonl(atomic_inc_return_unchecked(&call->conn->serial));
78293
78294 hdr = (struct rxrpc_header *) txb->head;
78295 hdr->serial = sp->hdr.serial;
78296 @@ -403,7 +403,7 @@ static void rxrpc_rotate_tx_window(struct rxrpc_call *call, u32 hard)
78297 */
78298 static void rxrpc_clear_tx_window(struct rxrpc_call *call)
78299 {
78300 - rxrpc_rotate_tx_window(call, atomic_read(&call->sequence));
78301 + rxrpc_rotate_tx_window(call, atomic_read_unchecked(&call->sequence));
78302 }
78303
78304 /*
78305 @@ -629,7 +629,7 @@ process_further:
78306
78307 latest = ntohl(sp->hdr.serial);
78308 hard = ntohl(ack.firstPacket);
78309 - tx = atomic_read(&call->sequence);
78310 + tx = atomic_read_unchecked(&call->sequence);
78311
78312 _proto("Rx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
78313 latest,
78314 @@ -1161,7 +1161,7 @@ void rxrpc_process_call(struct work_struct *work)
78315 goto maybe_reschedule;
78316
78317 send_ACK_with_skew:
78318 - ack.maxSkew = htons(atomic_read(&call->conn->hi_serial) -
78319 + ack.maxSkew = htons(atomic_read_unchecked(&call->conn->hi_serial) -
78320 ntohl(ack.serial));
78321 send_ACK:
78322 mtu = call->conn->trans->peer->if_mtu;
78323 @@ -1173,7 +1173,7 @@ send_ACK:
78324 ackinfo.rxMTU = htonl(5692);
78325 ackinfo.jumbo_max = htonl(4);
78326
78327 - hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
78328 + hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
78329 _proto("Tx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
78330 ntohl(hdr.serial),
78331 ntohs(ack.maxSkew),
78332 @@ -1191,7 +1191,7 @@ send_ACK:
78333 send_message:
78334 _debug("send message");
78335
78336 - hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
78337 + hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
78338 _proto("Tx %s %%%u", rxrpc_pkts[hdr.type], ntohl(hdr.serial));
78339 send_message_2:
78340
78341 diff --git a/net/rxrpc/ar-call.c b/net/rxrpc/ar-call.c
78342 index a3bbb36..3341fb9 100644
78343 --- a/net/rxrpc/ar-call.c
78344 +++ b/net/rxrpc/ar-call.c
78345 @@ -83,7 +83,7 @@ static struct rxrpc_call *rxrpc_alloc_call(gfp_t gfp)
78346 spin_lock_init(&call->lock);
78347 rwlock_init(&call->state_lock);
78348 atomic_set(&call->usage, 1);
78349 - call->debug_id = atomic_inc_return(&rxrpc_debug_id);
78350 + call->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
78351 call->state = RXRPC_CALL_CLIENT_SEND_REQUEST;
78352
78353 memset(&call->sock_node, 0xed, sizeof(call->sock_node));
78354 diff --git a/net/rxrpc/ar-connection.c b/net/rxrpc/ar-connection.c
78355 index 4106ca9..a338d7a 100644
78356 --- a/net/rxrpc/ar-connection.c
78357 +++ b/net/rxrpc/ar-connection.c
78358 @@ -206,7 +206,7 @@ static struct rxrpc_connection *rxrpc_alloc_connection(gfp_t gfp)
78359 rwlock_init(&conn->lock);
78360 spin_lock_init(&conn->state_lock);
78361 atomic_set(&conn->usage, 1);
78362 - conn->debug_id = atomic_inc_return(&rxrpc_debug_id);
78363 + conn->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
78364 conn->avail_calls = RXRPC_MAXCALLS;
78365 conn->size_align = 4;
78366 conn->header_size = sizeof(struct rxrpc_header);
78367 diff --git a/net/rxrpc/ar-connevent.c b/net/rxrpc/ar-connevent.c
78368 index e7ed43a..6afa140 100644
78369 --- a/net/rxrpc/ar-connevent.c
78370 +++ b/net/rxrpc/ar-connevent.c
78371 @@ -109,7 +109,7 @@ static int rxrpc_abort_connection(struct rxrpc_connection *conn,
78372
78373 len = iov[0].iov_len + iov[1].iov_len;
78374
78375 - hdr.serial = htonl(atomic_inc_return(&conn->serial));
78376 + hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
78377 _proto("Tx CONN ABORT %%%u { %d }", ntohl(hdr.serial), abort_code);
78378
78379 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
78380 diff --git a/net/rxrpc/ar-input.c b/net/rxrpc/ar-input.c
78381 index 529572f..c758ca7 100644
78382 --- a/net/rxrpc/ar-input.c
78383 +++ b/net/rxrpc/ar-input.c
78384 @@ -340,9 +340,9 @@ void rxrpc_fast_process_packet(struct rxrpc_call *call, struct sk_buff *skb)
78385 /* track the latest serial number on this connection for ACK packet
78386 * information */
78387 serial = ntohl(sp->hdr.serial);
78388 - hi_serial = atomic_read(&call->conn->hi_serial);
78389 + hi_serial = atomic_read_unchecked(&call->conn->hi_serial);
78390 while (serial > hi_serial)
78391 - hi_serial = atomic_cmpxchg(&call->conn->hi_serial, hi_serial,
78392 + hi_serial = atomic_cmpxchg_unchecked(&call->conn->hi_serial, hi_serial,
78393 serial);
78394
78395 /* request ACK generation for any ACK or DATA packet that requests
78396 diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
78397 index a693aca..81e7293 100644
78398 --- a/net/rxrpc/ar-internal.h
78399 +++ b/net/rxrpc/ar-internal.h
78400 @@ -272,8 +272,8 @@ struct rxrpc_connection {
78401 int error; /* error code for local abort */
78402 int debug_id; /* debug ID for printks */
78403 unsigned int call_counter; /* call ID counter */
78404 - atomic_t serial; /* packet serial number counter */
78405 - atomic_t hi_serial; /* highest serial number received */
78406 + atomic_unchecked_t serial; /* packet serial number counter */
78407 + atomic_unchecked_t hi_serial; /* highest serial number received */
78408 u8 avail_calls; /* number of calls available */
78409 u8 size_align; /* data size alignment (for security) */
78410 u8 header_size; /* rxrpc + security header size */
78411 @@ -346,7 +346,7 @@ struct rxrpc_call {
78412 spinlock_t lock;
78413 rwlock_t state_lock; /* lock for state transition */
78414 atomic_t usage;
78415 - atomic_t sequence; /* Tx data packet sequence counter */
78416 + atomic_unchecked_t sequence; /* Tx data packet sequence counter */
78417 u32 abort_code; /* local/remote abort code */
78418 enum { /* current state of call */
78419 RXRPC_CALL_CLIENT_SEND_REQUEST, /* - client sending request phase */
78420 @@ -420,7 +420,7 @@ static inline void rxrpc_abort_call(struct rxrpc_call *call, u32 abort_code)
78421 */
78422 extern atomic_t rxrpc_n_skbs;
78423 extern __be32 rxrpc_epoch;
78424 -extern atomic_t rxrpc_debug_id;
78425 +extern atomic_unchecked_t rxrpc_debug_id;
78426 extern struct workqueue_struct *rxrpc_workqueue;
78427
78428 /*
78429 diff --git a/net/rxrpc/ar-local.c b/net/rxrpc/ar-local.c
78430 index 87f7135..74d3703 100644
78431 --- a/net/rxrpc/ar-local.c
78432 +++ b/net/rxrpc/ar-local.c
78433 @@ -45,7 +45,7 @@ struct rxrpc_local *rxrpc_alloc_local(struct sockaddr_rxrpc *srx)
78434 spin_lock_init(&local->lock);
78435 rwlock_init(&local->services_lock);
78436 atomic_set(&local->usage, 1);
78437 - local->debug_id = atomic_inc_return(&rxrpc_debug_id);
78438 + local->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
78439 memcpy(&local->srx, srx, sizeof(*srx));
78440 }
78441
78442 diff --git a/net/rxrpc/ar-output.c b/net/rxrpc/ar-output.c
78443 index 16ae887..d24f12b 100644
78444 --- a/net/rxrpc/ar-output.c
78445 +++ b/net/rxrpc/ar-output.c
78446 @@ -682,9 +682,9 @@ static int rxrpc_send_data(struct kiocb *iocb,
78447 sp->hdr.cid = call->cid;
78448 sp->hdr.callNumber = call->call_id;
78449 sp->hdr.seq =
78450 - htonl(atomic_inc_return(&call->sequence));
78451 + htonl(atomic_inc_return_unchecked(&call->sequence));
78452 sp->hdr.serial =
78453 - htonl(atomic_inc_return(&conn->serial));
78454 + htonl(atomic_inc_return_unchecked(&conn->serial));
78455 sp->hdr.type = RXRPC_PACKET_TYPE_DATA;
78456 sp->hdr.userStatus = 0;
78457 sp->hdr.securityIndex = conn->security_ix;
78458 diff --git a/net/rxrpc/ar-peer.c b/net/rxrpc/ar-peer.c
78459 index bebaa43..2644591 100644
78460 --- a/net/rxrpc/ar-peer.c
78461 +++ b/net/rxrpc/ar-peer.c
78462 @@ -72,7 +72,7 @@ static struct rxrpc_peer *rxrpc_alloc_peer(struct sockaddr_rxrpc *srx,
78463 INIT_LIST_HEAD(&peer->error_targets);
78464 spin_lock_init(&peer->lock);
78465 atomic_set(&peer->usage, 1);
78466 - peer->debug_id = atomic_inc_return(&rxrpc_debug_id);
78467 + peer->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
78468 memcpy(&peer->srx, srx, sizeof(*srx));
78469
78470 rxrpc_assess_MTU_size(peer);
78471 diff --git a/net/rxrpc/ar-proc.c b/net/rxrpc/ar-proc.c
78472 index 38047f7..9f48511 100644
78473 --- a/net/rxrpc/ar-proc.c
78474 +++ b/net/rxrpc/ar-proc.c
78475 @@ -164,8 +164,8 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v)
78476 atomic_read(&conn->usage),
78477 rxrpc_conn_states[conn->state],
78478 key_serial(conn->key),
78479 - atomic_read(&conn->serial),
78480 - atomic_read(&conn->hi_serial));
78481 + atomic_read_unchecked(&conn->serial),
78482 + atomic_read_unchecked(&conn->hi_serial));
78483
78484 return 0;
78485 }
78486 diff --git a/net/rxrpc/ar-transport.c b/net/rxrpc/ar-transport.c
78487 index 92df566..87ec1bf 100644
78488 --- a/net/rxrpc/ar-transport.c
78489 +++ b/net/rxrpc/ar-transport.c
78490 @@ -47,7 +47,7 @@ static struct rxrpc_transport *rxrpc_alloc_transport(struct rxrpc_local *local,
78491 spin_lock_init(&trans->client_lock);
78492 rwlock_init(&trans->conn_lock);
78493 atomic_set(&trans->usage, 1);
78494 - trans->debug_id = atomic_inc_return(&rxrpc_debug_id);
78495 + trans->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
78496
78497 if (peer->srx.transport.family == AF_INET) {
78498 switch (peer->srx.transport_type) {
78499 diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
78500 index f226709..0e735a8 100644
78501 --- a/net/rxrpc/rxkad.c
78502 +++ b/net/rxrpc/rxkad.c
78503 @@ -610,7 +610,7 @@ static int rxkad_issue_challenge(struct rxrpc_connection *conn)
78504
78505 len = iov[0].iov_len + iov[1].iov_len;
78506
78507 - hdr.serial = htonl(atomic_inc_return(&conn->serial));
78508 + hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
78509 _proto("Tx CHALLENGE %%%u", ntohl(hdr.serial));
78510
78511 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
78512 @@ -660,7 +660,7 @@ static int rxkad_send_response(struct rxrpc_connection *conn,
78513
78514 len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len;
78515
78516 - hdr->serial = htonl(atomic_inc_return(&conn->serial));
78517 + hdr->serial = htonl(atomic_inc_return_unchecked(&conn->serial));
78518 _proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
78519
78520 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
78521 diff --git a/net/sctp/proc.c b/net/sctp/proc.c
78522 index 1e2eee8..ce3967e 100644
78523 --- a/net/sctp/proc.c
78524 +++ b/net/sctp/proc.c
78525 @@ -319,7 +319,8 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
78526 seq_printf(seq,
78527 "%8pK %8pK %-3d %-3d %-2d %-4d "
78528 "%4d %8d %8d %7d %5lu %-5d %5d ",
78529 - assoc, sk, sctp_sk(sk)->type, sk->sk_state,
78530 + assoc, sk,
78531 + sctp_sk(sk)->type, sk->sk_state,
78532 assoc->state, hash,
78533 assoc->assoc_id,
78534 assoc->sndbuf_used,
78535 diff --git a/net/sctp/socket.c b/net/sctp/socket.c
78536 index 31c7bfc..bc380ae 100644
78537 --- a/net/sctp/socket.c
78538 +++ b/net/sctp/socket.c
78539 @@ -4577,7 +4577,7 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
78540 addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
78541 if (space_left < addrlen)
78542 return -ENOMEM;
78543 - if (copy_to_user(to, &temp, addrlen))
78544 + if (addrlen > sizeof(temp) || copy_to_user(to, &temp, addrlen))
78545 return -EFAULT;
78546 to += addrlen;
78547 cnt++;
78548 diff --git a/net/socket.c b/net/socket.c
78549 index a990aa9..5af9802 100644
78550 --- a/net/socket.c
78551 +++ b/net/socket.c
78552 @@ -88,6 +88,7 @@
78553 #include <linux/nsproxy.h>
78554 #include <linux/magic.h>
78555 #include <linux/slab.h>
78556 +#include <linux/in.h>
78557
78558 #include <asm/uaccess.h>
78559 #include <asm/unistd.h>
78560 @@ -105,6 +106,8 @@
78561 #include <linux/sockios.h>
78562 #include <linux/atalk.h>
78563
78564 +#include <linux/grsock.h>
78565 +
78566 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
78567 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
78568 unsigned long nr_segs, loff_t pos);
78569 @@ -321,7 +324,7 @@ static struct dentry *sockfs_mount(struct file_system_type *fs_type,
78570 &sockfs_dentry_operations, SOCKFS_MAGIC);
78571 }
78572
78573 -static struct vfsmount *sock_mnt __read_mostly;
78574 +struct vfsmount *sock_mnt __read_mostly;
78575
78576 static struct file_system_type sock_fs_type = {
78577 .name = "sockfs",
78578 @@ -1210,6 +1213,8 @@ int __sock_create(struct net *net, int family, int type, int protocol,
78579 return -EAFNOSUPPORT;
78580 if (type < 0 || type >= SOCK_MAX)
78581 return -EINVAL;
78582 + if (protocol < 0)
78583 + return -EINVAL;
78584
78585 /* Compatibility.
78586
78587 @@ -1341,6 +1346,16 @@ SYSCALL_DEFINE3(socket, int, family, int, type, int, protocol)
78588 if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
78589 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
78590
78591 + if(!gr_search_socket(family, type, protocol)) {
78592 + retval = -EACCES;
78593 + goto out;
78594 + }
78595 +
78596 + if (gr_handle_sock_all(family, type, protocol)) {
78597 + retval = -EACCES;
78598 + goto out;
78599 + }
78600 +
78601 retval = sock_create(family, type, protocol, &sock);
78602 if (retval < 0)
78603 goto out;
78604 @@ -1453,6 +1468,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
78605 if (sock) {
78606 err = move_addr_to_kernel(umyaddr, addrlen, &address);
78607 if (err >= 0) {
78608 + if (gr_handle_sock_server((struct sockaddr *)&address)) {
78609 + err = -EACCES;
78610 + goto error;
78611 + }
78612 + err = gr_search_bind(sock, (struct sockaddr_in *)&address);
78613 + if (err)
78614 + goto error;
78615 +
78616 err = security_socket_bind(sock,
78617 (struct sockaddr *)&address,
78618 addrlen);
78619 @@ -1461,6 +1484,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
78620 (struct sockaddr *)
78621 &address, addrlen);
78622 }
78623 +error:
78624 fput_light(sock->file, fput_needed);
78625 }
78626 return err;
78627 @@ -1484,10 +1508,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, backlog)
78628 if ((unsigned int)backlog > somaxconn)
78629 backlog = somaxconn;
78630
78631 + if (gr_handle_sock_server_other(sock->sk)) {
78632 + err = -EPERM;
78633 + goto error;
78634 + }
78635 +
78636 + err = gr_search_listen(sock);
78637 + if (err)
78638 + goto error;
78639 +
78640 err = security_socket_listen(sock, backlog);
78641 if (!err)
78642 err = sock->ops->listen(sock, backlog);
78643
78644 +error:
78645 fput_light(sock->file, fput_needed);
78646 }
78647 return err;
78648 @@ -1531,6 +1565,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
78649 newsock->type = sock->type;
78650 newsock->ops = sock->ops;
78651
78652 + if (gr_handle_sock_server_other(sock->sk)) {
78653 + err = -EPERM;
78654 + sock_release(newsock);
78655 + goto out_put;
78656 + }
78657 +
78658 + err = gr_search_accept(sock);
78659 + if (err) {
78660 + sock_release(newsock);
78661 + goto out_put;
78662 + }
78663 +
78664 /*
78665 * We don't need try_module_get here, as the listening socket (sock)
78666 * has the protocol module (sock->ops->owner) held.
78667 @@ -1569,6 +1615,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
78668 fd_install(newfd, newfile);
78669 err = newfd;
78670
78671 + gr_attach_curr_ip(newsock->sk);
78672 +
78673 out_put:
78674 fput_light(sock->file, fput_needed);
78675 out:
78676 @@ -1601,6 +1649,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
78677 int, addrlen)
78678 {
78679 struct socket *sock;
78680 + struct sockaddr *sck;
78681 struct sockaddr_storage address;
78682 int err, fput_needed;
78683
78684 @@ -1611,6 +1660,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
78685 if (err < 0)
78686 goto out_put;
78687
78688 + sck = (struct sockaddr *)&address;
78689 +
78690 + if (gr_handle_sock_client(sck)) {
78691 + err = -EACCES;
78692 + goto out_put;
78693 + }
78694 +
78695 + err = gr_search_connect(sock, (struct sockaddr_in *)sck);
78696 + if (err)
78697 + goto out_put;
78698 +
78699 err =
78700 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
78701 if (err)
78702 @@ -1965,7 +2025,7 @@ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
78703 * checking falls down on this.
78704 */
78705 if (copy_from_user(ctl_buf,
78706 - (void __user __force *)msg_sys->msg_control,
78707 + (void __force_user *)msg_sys->msg_control,
78708 ctl_len))
78709 goto out_freectl;
78710 msg_sys->msg_control = ctl_buf;
78711 @@ -2133,7 +2193,7 @@ static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
78712 * kernel msghdr to use the kernel address space)
78713 */
78714
78715 - uaddr = (__force void __user *)msg_sys->msg_name;
78716 + uaddr = (void __force_user *)msg_sys->msg_name;
78717 uaddr_len = COMPAT_NAMELEN(msg);
78718 if (MSG_CMSG_COMPAT & flags) {
78719 err = verify_compat_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
78720 @@ -2658,6 +2718,7 @@ static int dev_ifconf(struct net *net, struct compat_ifconf __user *uifc32)
78721 if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
78722 return -EFAULT;
78723
78724 + memset(&ifc, 0, sizeof(ifc));
78725 if (ifc32.ifcbuf == 0) {
78726 ifc32.ifc_len = 0;
78727 ifc.ifc_len = 0;
78728 @@ -2761,7 +2822,7 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
78729 }
78730
78731 ifr = compat_alloc_user_space(buf_size);
78732 - rxnfc = (void *)ifr + ALIGN(sizeof(struct ifreq), 8);
78733 + rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
78734
78735 if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
78736 return -EFAULT;
78737 @@ -2785,12 +2846,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
78738 offsetof(struct ethtool_rxnfc, fs.ring_cookie));
78739
78740 if (copy_in_user(rxnfc, compat_rxnfc,
78741 - (void *)(&rxnfc->fs.m_ext + 1) -
78742 - (void *)rxnfc) ||
78743 + (void __user *)(&rxnfc->fs.m_ext + 1) -
78744 + (void __user *)rxnfc) ||
78745 copy_in_user(&rxnfc->fs.ring_cookie,
78746 &compat_rxnfc->fs.ring_cookie,
78747 - (void *)(&rxnfc->fs.location + 1) -
78748 - (void *)&rxnfc->fs.ring_cookie) ||
78749 + (void __user *)(&rxnfc->fs.location + 1) -
78750 + (void __user *)&rxnfc->fs.ring_cookie) ||
78751 copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
78752 sizeof(rxnfc->rule_cnt)))
78753 return -EFAULT;
78754 @@ -2802,12 +2863,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
78755
78756 if (convert_out) {
78757 if (copy_in_user(compat_rxnfc, rxnfc,
78758 - (const void *)(&rxnfc->fs.m_ext + 1) -
78759 - (const void *)rxnfc) ||
78760 + (const void __user *)(&rxnfc->fs.m_ext + 1) -
78761 + (const void __user *)rxnfc) ||
78762 copy_in_user(&compat_rxnfc->fs.ring_cookie,
78763 &rxnfc->fs.ring_cookie,
78764 - (const void *)(&rxnfc->fs.location + 1) -
78765 - (const void *)&rxnfc->fs.ring_cookie) ||
78766 + (const void __user *)(&rxnfc->fs.location + 1) -
78767 + (const void __user *)&rxnfc->fs.ring_cookie) ||
78768 copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
78769 sizeof(rxnfc->rule_cnt)))
78770 return -EFAULT;
78771 @@ -2877,7 +2938,7 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
78772 old_fs = get_fs();
78773 set_fs(KERNEL_DS);
78774 err = dev_ioctl(net, cmd,
78775 - (struct ifreq __user __force *) &kifr);
78776 + (struct ifreq __force_user *) &kifr);
78777 set_fs(old_fs);
78778
78779 return err;
78780 @@ -2986,7 +3047,7 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
78781
78782 old_fs = get_fs();
78783 set_fs(KERNEL_DS);
78784 - err = dev_ioctl(net, cmd, (void __user __force *)&ifr);
78785 + err = dev_ioctl(net, cmd, (void __force_user *)&ifr);
78786 set_fs(old_fs);
78787
78788 if (cmd == SIOCGIFMAP && !err) {
78789 @@ -3091,7 +3152,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
78790 ret |= __get_user(rtdev, &(ur4->rt_dev));
78791 if (rtdev) {
78792 ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
78793 - r4.rt_dev = (char __user __force *)devname;
78794 + r4.rt_dev = (char __force_user *)devname;
78795 devname[15] = 0;
78796 } else
78797 r4.rt_dev = NULL;
78798 @@ -3317,8 +3378,8 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
78799 int __user *uoptlen;
78800 int err;
78801
78802 - uoptval = (char __user __force *) optval;
78803 - uoptlen = (int __user __force *) optlen;
78804 + uoptval = (char __force_user *) optval;
78805 + uoptlen = (int __force_user *) optlen;
78806
78807 set_fs(KERNEL_DS);
78808 if (level == SOL_SOCKET)
78809 @@ -3338,7 +3399,7 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
78810 char __user *uoptval;
78811 int err;
78812
78813 - uoptval = (char __user __force *) optval;
78814 + uoptval = (char __force_user *) optval;
78815
78816 set_fs(KERNEL_DS);
78817 if (level == SOL_SOCKET)
78818 diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
78819 index eda32ae..1c9fa7c 100644
78820 --- a/net/sunrpc/sched.c
78821 +++ b/net/sunrpc/sched.c
78822 @@ -240,9 +240,9 @@ static int rpc_wait_bit_killable(void *word)
78823 #ifdef RPC_DEBUG
78824 static void rpc_task_set_debuginfo(struct rpc_task *task)
78825 {
78826 - static atomic_t rpc_pid;
78827 + static atomic_unchecked_t rpc_pid;
78828
78829 - task->tk_pid = atomic_inc_return(&rpc_pid);
78830 + task->tk_pid = atomic_inc_return_unchecked(&rpc_pid);
78831 }
78832 #else
78833 static inline void rpc_task_set_debuginfo(struct rpc_task *task)
78834 diff --git a/net/sunrpc/xprtrdma/svc_rdma.c b/net/sunrpc/xprtrdma/svc_rdma.c
78835 index 8343737..677025e 100644
78836 --- a/net/sunrpc/xprtrdma/svc_rdma.c
78837 +++ b/net/sunrpc/xprtrdma/svc_rdma.c
78838 @@ -62,15 +62,15 @@ unsigned int svcrdma_max_req_size = RPCRDMA_MAX_REQ_SIZE;
78839 static unsigned int min_max_inline = 4096;
78840 static unsigned int max_max_inline = 65536;
78841
78842 -atomic_t rdma_stat_recv;
78843 -atomic_t rdma_stat_read;
78844 -atomic_t rdma_stat_write;
78845 -atomic_t rdma_stat_sq_starve;
78846 -atomic_t rdma_stat_rq_starve;
78847 -atomic_t rdma_stat_rq_poll;
78848 -atomic_t rdma_stat_rq_prod;
78849 -atomic_t rdma_stat_sq_poll;
78850 -atomic_t rdma_stat_sq_prod;
78851 +atomic_unchecked_t rdma_stat_recv;
78852 +atomic_unchecked_t rdma_stat_read;
78853 +atomic_unchecked_t rdma_stat_write;
78854 +atomic_unchecked_t rdma_stat_sq_starve;
78855 +atomic_unchecked_t rdma_stat_rq_starve;
78856 +atomic_unchecked_t rdma_stat_rq_poll;
78857 +atomic_unchecked_t rdma_stat_rq_prod;
78858 +atomic_unchecked_t rdma_stat_sq_poll;
78859 +atomic_unchecked_t rdma_stat_sq_prod;
78860
78861 /* Temporary NFS request map and context caches */
78862 struct kmem_cache *svc_rdma_map_cachep;
78863 @@ -110,7 +110,7 @@ static int read_reset_stat(ctl_table *table, int write,
78864 len -= *ppos;
78865 if (len > *lenp)
78866 len = *lenp;
78867 - if (len && copy_to_user(buffer, str_buf, len))
78868 + if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
78869 return -EFAULT;
78870 *lenp = len;
78871 *ppos += len;
78872 @@ -151,63 +151,63 @@ static ctl_table svcrdma_parm_table[] = {
78873 {
78874 .procname = "rdma_stat_read",
78875 .data = &rdma_stat_read,
78876 - .maxlen = sizeof(atomic_t),
78877 + .maxlen = sizeof(atomic_unchecked_t),
78878 .mode = 0644,
78879 .proc_handler = read_reset_stat,
78880 },
78881 {
78882 .procname = "rdma_stat_recv",
78883 .data = &rdma_stat_recv,
78884 - .maxlen = sizeof(atomic_t),
78885 + .maxlen = sizeof(atomic_unchecked_t),
78886 .mode = 0644,
78887 .proc_handler = read_reset_stat,
78888 },
78889 {
78890 .procname = "rdma_stat_write",
78891 .data = &rdma_stat_write,
78892 - .maxlen = sizeof(atomic_t),
78893 + .maxlen = sizeof(atomic_unchecked_t),
78894 .mode = 0644,
78895 .proc_handler = read_reset_stat,
78896 },
78897 {
78898 .procname = "rdma_stat_sq_starve",
78899 .data = &rdma_stat_sq_starve,
78900 - .maxlen = sizeof(atomic_t),
78901 + .maxlen = sizeof(atomic_unchecked_t),
78902 .mode = 0644,
78903 .proc_handler = read_reset_stat,
78904 },
78905 {
78906 .procname = "rdma_stat_rq_starve",
78907 .data = &rdma_stat_rq_starve,
78908 - .maxlen = sizeof(atomic_t),
78909 + .maxlen = sizeof(atomic_unchecked_t),
78910 .mode = 0644,
78911 .proc_handler = read_reset_stat,
78912 },
78913 {
78914 .procname = "rdma_stat_rq_poll",
78915 .data = &rdma_stat_rq_poll,
78916 - .maxlen = sizeof(atomic_t),
78917 + .maxlen = sizeof(atomic_unchecked_t),
78918 .mode = 0644,
78919 .proc_handler = read_reset_stat,
78920 },
78921 {
78922 .procname = "rdma_stat_rq_prod",
78923 .data = &rdma_stat_rq_prod,
78924 - .maxlen = sizeof(atomic_t),
78925 + .maxlen = sizeof(atomic_unchecked_t),
78926 .mode = 0644,
78927 .proc_handler = read_reset_stat,
78928 },
78929 {
78930 .procname = "rdma_stat_sq_poll",
78931 .data = &rdma_stat_sq_poll,
78932 - .maxlen = sizeof(atomic_t),
78933 + .maxlen = sizeof(atomic_unchecked_t),
78934 .mode = 0644,
78935 .proc_handler = read_reset_stat,
78936 },
78937 {
78938 .procname = "rdma_stat_sq_prod",
78939 .data = &rdma_stat_sq_prod,
78940 - .maxlen = sizeof(atomic_t),
78941 + .maxlen = sizeof(atomic_unchecked_t),
78942 .mode = 0644,
78943 .proc_handler = read_reset_stat,
78944 },
78945 diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
78946 index 41cb63b..c4a1489 100644
78947 --- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
78948 +++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
78949 @@ -501,7 +501,7 @@ next_sge:
78950 svc_rdma_put_context(ctxt, 0);
78951 goto out;
78952 }
78953 - atomic_inc(&rdma_stat_read);
78954 + atomic_inc_unchecked(&rdma_stat_read);
78955
78956 if (read_wr.num_sge < chl_map->ch[ch_no].count) {
78957 chl_map->ch[ch_no].count -= read_wr.num_sge;
78958 @@ -611,7 +611,7 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
78959 dto_q);
78960 list_del_init(&ctxt->dto_q);
78961 } else {
78962 - atomic_inc(&rdma_stat_rq_starve);
78963 + atomic_inc_unchecked(&rdma_stat_rq_starve);
78964 clear_bit(XPT_DATA, &xprt->xpt_flags);
78965 ctxt = NULL;
78966 }
78967 @@ -631,7 +631,7 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
78968 dprintk("svcrdma: processing ctxt=%p on xprt=%p, rqstp=%p, status=%d\n",
78969 ctxt, rdma_xprt, rqstp, ctxt->wc_status);
78970 BUG_ON(ctxt->wc_status != IB_WC_SUCCESS);
78971 - atomic_inc(&rdma_stat_recv);
78972 + atomic_inc_unchecked(&rdma_stat_recv);
78973
78974 /* Build up the XDR from the receive buffers. */
78975 rdma_build_arg_xdr(rqstp, ctxt, ctxt->byte_len);
78976 diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
78977 index 42eb7ba..c887c45 100644
78978 --- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
78979 +++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
78980 @@ -362,7 +362,7 @@ static int send_write(struct svcxprt_rdma *xprt, struct svc_rqst *rqstp,
78981 write_wr.wr.rdma.remote_addr = to;
78982
78983 /* Post It */
78984 - atomic_inc(&rdma_stat_write);
78985 + atomic_inc_unchecked(&rdma_stat_write);
78986 if (svc_rdma_send(xprt, &write_wr))
78987 goto err;
78988 return 0;
78989 diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
78990 index 73b428b..5f3f8f3 100644
78991 --- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
78992 +++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
78993 @@ -292,7 +292,7 @@ static void rq_cq_reap(struct svcxprt_rdma *xprt)
78994 return;
78995
78996 ib_req_notify_cq(xprt->sc_rq_cq, IB_CQ_NEXT_COMP);
78997 - atomic_inc(&rdma_stat_rq_poll);
78998 + atomic_inc_unchecked(&rdma_stat_rq_poll);
78999
79000 while ((ret = ib_poll_cq(xprt->sc_rq_cq, 1, &wc)) > 0) {
79001 ctxt = (struct svc_rdma_op_ctxt *)(unsigned long)wc.wr_id;
79002 @@ -314,7 +314,7 @@ static void rq_cq_reap(struct svcxprt_rdma *xprt)
79003 }
79004
79005 if (ctxt)
79006 - atomic_inc(&rdma_stat_rq_prod);
79007 + atomic_inc_unchecked(&rdma_stat_rq_prod);
79008
79009 set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
79010 /*
79011 @@ -386,7 +386,7 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
79012 return;
79013
79014 ib_req_notify_cq(xprt->sc_sq_cq, IB_CQ_NEXT_COMP);
79015 - atomic_inc(&rdma_stat_sq_poll);
79016 + atomic_inc_unchecked(&rdma_stat_sq_poll);
79017 while ((ret = ib_poll_cq(cq, 1, &wc)) > 0) {
79018 if (wc.status != IB_WC_SUCCESS)
79019 /* Close the transport */
79020 @@ -404,7 +404,7 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
79021 }
79022
79023 if (ctxt)
79024 - atomic_inc(&rdma_stat_sq_prod);
79025 + atomic_inc_unchecked(&rdma_stat_sq_prod);
79026 }
79027
79028 static void sq_comp_handler(struct ib_cq *cq, void *cq_context)
79029 @@ -1266,7 +1266,7 @@ int svc_rdma_send(struct svcxprt_rdma *xprt, struct ib_send_wr *wr)
79030 spin_lock_bh(&xprt->sc_lock);
79031 if (xprt->sc_sq_depth < atomic_read(&xprt->sc_sq_count) + wr_count) {
79032 spin_unlock_bh(&xprt->sc_lock);
79033 - atomic_inc(&rdma_stat_sq_starve);
79034 + atomic_inc_unchecked(&rdma_stat_sq_starve);
79035
79036 /* See if we can opportunistically reap SQ WR to make room */
79037 sq_cq_reap(xprt);
79038 diff --git a/net/sysctl_net.c b/net/sysctl_net.c
79039 index e3a6e37..be2ea77 100644
79040 --- a/net/sysctl_net.c
79041 +++ b/net/sysctl_net.c
79042 @@ -43,7 +43,7 @@ static int net_ctl_permissions(struct ctl_table_root *root,
79043 struct ctl_table *table)
79044 {
79045 /* Allow network administrator to have same access as root. */
79046 - if (capable(CAP_NET_ADMIN)) {
79047 + if (capable_nolog(CAP_NET_ADMIN)) {
79048 int mode = (table->mode >> 6) & 7;
79049 return (mode << 6) | (mode << 3) | mode;
79050 }
79051 diff --git a/net/tipc/link.c b/net/tipc/link.c
79052 index 7a614f4..b14dbd2 100644
79053 --- a/net/tipc/link.c
79054 +++ b/net/tipc/link.c
79055 @@ -1164,7 +1164,7 @@ static int link_send_sections_long(struct tipc_port *sender,
79056 struct tipc_msg fragm_hdr;
79057 struct sk_buff *buf, *buf_chain, *prev;
79058 u32 fragm_crs, fragm_rest, hsz, sect_rest;
79059 - const unchar *sect_crs;
79060 + const unchar __user *sect_crs;
79061 int curr_sect;
79062 u32 fragm_no;
79063
79064 @@ -1205,7 +1205,7 @@ again:
79065
79066 if (!sect_rest) {
79067 sect_rest = msg_sect[++curr_sect].iov_len;
79068 - sect_crs = (const unchar *)msg_sect[curr_sect].iov_base;
79069 + sect_crs = (const unchar __user *)msg_sect[curr_sect].iov_base;
79070 }
79071
79072 if (sect_rest < fragm_rest)
79073 @@ -1224,7 +1224,7 @@ error:
79074 }
79075 } else
79076 skb_copy_to_linear_data_offset(buf, fragm_crs,
79077 - sect_crs, sz);
79078 + (const void __force_kernel *)sect_crs, sz);
79079 sect_crs += sz;
79080 sect_rest -= sz;
79081 fragm_crs += sz;
79082 diff --git a/net/tipc/msg.c b/net/tipc/msg.c
79083 index deea0d2..fa13bd7 100644
79084 --- a/net/tipc/msg.c
79085 +++ b/net/tipc/msg.c
79086 @@ -98,7 +98,7 @@ int tipc_msg_build(struct tipc_msg *hdr, struct iovec const *msg_sect,
79087 msg_sect[cnt].iov_len);
79088 else
79089 skb_copy_to_linear_data_offset(*buf, pos,
79090 - msg_sect[cnt].iov_base,
79091 + (const void __force_kernel *)msg_sect[cnt].iov_base,
79092 msg_sect[cnt].iov_len);
79093 pos += msg_sect[cnt].iov_len;
79094 }
79095 diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
79096 index f976e9cd..560d055 100644
79097 --- a/net/tipc/subscr.c
79098 +++ b/net/tipc/subscr.c
79099 @@ -96,7 +96,7 @@ static void subscr_send_event(struct tipc_subscription *sub,
79100 {
79101 struct iovec msg_sect;
79102
79103 - msg_sect.iov_base = (void *)&sub->evt;
79104 + msg_sect.iov_base = (void __force_user *)&sub->evt;
79105 msg_sect.iov_len = sizeof(struct tipc_event);
79106
79107 sub->evt.event = htohl(event, sub->swap);
79108 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
79109 index 641f2e4..590bb48 100644
79110 --- a/net/unix/af_unix.c
79111 +++ b/net/unix/af_unix.c
79112 @@ -780,6 +780,12 @@ static struct sock *unix_find_other(struct net *net,
79113 err = -ECONNREFUSED;
79114 if (!S_ISSOCK(inode->i_mode))
79115 goto put_fail;
79116 +
79117 + if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
79118 + err = -EACCES;
79119 + goto put_fail;
79120 + }
79121 +
79122 u = unix_find_socket_byinode(inode);
79123 if (!u)
79124 goto put_fail;
79125 @@ -800,6 +806,13 @@ static struct sock *unix_find_other(struct net *net,
79126 if (u) {
79127 struct dentry *dentry;
79128 dentry = unix_sk(u)->path.dentry;
79129 +
79130 + if (!gr_handle_chroot_unix(pid_vnr(u->sk_peer_pid))) {
79131 + err = -EPERM;
79132 + sock_put(u);
79133 + goto fail;
79134 + }
79135 +
79136 if (dentry)
79137 touch_atime(&unix_sk(u)->path);
79138 } else
79139 @@ -882,11 +895,18 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
79140 err = security_path_mknod(&path, dentry, mode, 0);
79141 if (err)
79142 goto out_mknod_drop_write;
79143 + if (!gr_acl_handle_mknod(dentry, path.dentry, path.mnt, mode)) {
79144 + err = -EACCES;
79145 + goto out_mknod_drop_write;
79146 + }
79147 err = vfs_mknod(path.dentry->d_inode, dentry, mode, 0);
79148 out_mknod_drop_write:
79149 mnt_drop_write(path.mnt);
79150 if (err)
79151 goto out_mknod_dput;
79152 +
79153 + gr_handle_create(dentry, path.mnt);
79154 +
79155 mutex_unlock(&path.dentry->d_inode->i_mutex);
79156 dput(path.dentry);
79157 path.dentry = dentry;
79158 @@ -1448,7 +1468,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
79159 if (NULL == siocb->scm)
79160 siocb->scm = &tmp_scm;
79161 wait_for_unix_gc();
79162 - err = scm_send(sock, msg, siocb->scm);
79163 + err = scm_send(sock, msg, siocb->scm, false);
79164 if (err < 0)
79165 return err;
79166
79167 @@ -1617,7 +1637,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
79168 if (NULL == siocb->scm)
79169 siocb->scm = &tmp_scm;
79170 wait_for_unix_gc();
79171 - err = scm_send(sock, msg, siocb->scm);
79172 + err = scm_send(sock, msg, siocb->scm, false);
79173 if (err < 0)
79174 return err;
79175
79176 diff --git a/net/wireless/core.h b/net/wireless/core.h
79177 index bc686ef..27845e6 100644
79178 --- a/net/wireless/core.h
79179 +++ b/net/wireless/core.h
79180 @@ -27,7 +27,7 @@ struct cfg80211_registered_device {
79181 struct mutex mtx;
79182
79183 /* rfkill support */
79184 - struct rfkill_ops rfkill_ops;
79185 + rfkill_ops_no_const rfkill_ops;
79186 struct rfkill *rfkill;
79187 struct work_struct rfkill_sync;
79188
79189 diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
79190 index b0eb7aa..7d73e82 100644
79191 --- a/net/wireless/wext-core.c
79192 +++ b/net/wireless/wext-core.c
79193 @@ -748,8 +748,7 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
79194 */
79195
79196 /* Support for very large requests */
79197 - if ((descr->flags & IW_DESCR_FLAG_NOMAX) &&
79198 - (user_length > descr->max_tokens)) {
79199 + if (user_length > descr->max_tokens) {
79200 /* Allow userspace to GET more than max so
79201 * we can support any size GET requests.
79202 * There is still a limit : -ENOMEM.
79203 @@ -788,22 +787,6 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
79204 }
79205 }
79206
79207 - if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) {
79208 - /*
79209 - * If this is a GET, but not NOMAX, it means that the extra
79210 - * data is not bounded by userspace, but by max_tokens. Thus
79211 - * set the length to max_tokens. This matches the extra data
79212 - * allocation.
79213 - * The driver should fill it with the number of tokens it
79214 - * provided, and it may check iwp->length rather than having
79215 - * knowledge of max_tokens. If the driver doesn't change the
79216 - * iwp->length, this ioctl just copies back max_token tokens
79217 - * filled with zeroes. Hopefully the driver isn't claiming
79218 - * them to be valid data.
79219 - */
79220 - iwp->length = descr->max_tokens;
79221 - }
79222 -
79223 err = handler(dev, info, (union iwreq_data *) iwp, extra);
79224
79225 iwp->length += essid_compat;
79226 diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
79227 index ccfbd32..9b61cf9f 100644
79228 --- a/net/xfrm/xfrm_policy.c
79229 +++ b/net/xfrm/xfrm_policy.c
79230 @@ -300,7 +300,7 @@ static void xfrm_policy_kill(struct xfrm_policy *policy)
79231 {
79232 policy->walk.dead = 1;
79233
79234 - atomic_inc(&policy->genid);
79235 + atomic_inc_unchecked(&policy->genid);
79236
79237 if (del_timer(&policy->timer))
79238 xfrm_pol_put(policy);
79239 @@ -584,7 +584,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
79240 hlist_add_head(&policy->bydst, chain);
79241 xfrm_pol_hold(policy);
79242 net->xfrm.policy_count[dir]++;
79243 - atomic_inc(&flow_cache_genid);
79244 + atomic_inc_unchecked(&flow_cache_genid);
79245 if (delpol)
79246 __xfrm_policy_unlink(delpol, dir);
79247 policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
79248 @@ -1532,7 +1532,7 @@ free_dst:
79249 goto out;
79250 }
79251
79252 -static int inline
79253 +static inline int
79254 xfrm_dst_alloc_copy(void **target, const void *src, int size)
79255 {
79256 if (!*target) {
79257 @@ -1544,7 +1544,7 @@ xfrm_dst_alloc_copy(void **target, const void *src, int size)
79258 return 0;
79259 }
79260
79261 -static int inline
79262 +static inline int
79263 xfrm_dst_update_parent(struct dst_entry *dst, const struct xfrm_selector *sel)
79264 {
79265 #ifdef CONFIG_XFRM_SUB_POLICY
79266 @@ -1556,7 +1556,7 @@ xfrm_dst_update_parent(struct dst_entry *dst, const struct xfrm_selector *sel)
79267 #endif
79268 }
79269
79270 -static int inline
79271 +static inline int
79272 xfrm_dst_update_origin(struct dst_entry *dst, const struct flowi *fl)
79273 {
79274 #ifdef CONFIG_XFRM_SUB_POLICY
79275 @@ -1650,7 +1650,7 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
79276
79277 xdst->num_pols = num_pols;
79278 memcpy(xdst->pols, pols, sizeof(struct xfrm_policy*) * num_pols);
79279 - xdst->policy_genid = atomic_read(&pols[0]->genid);
79280 + xdst->policy_genid = atomic_read_unchecked(&pols[0]->genid);
79281
79282 return xdst;
79283 }
79284 @@ -2350,7 +2350,7 @@ static int xfrm_bundle_ok(struct xfrm_dst *first)
79285 if (xdst->xfrm_genid != dst->xfrm->genid)
79286 return 0;
79287 if (xdst->num_pols > 0 &&
79288 - xdst->policy_genid != atomic_read(&xdst->pols[0]->genid))
79289 + xdst->policy_genid != atomic_read_unchecked(&xdst->pols[0]->genid))
79290 return 0;
79291
79292 mtu = dst_mtu(dst->child);
79293 @@ -2887,7 +2887,7 @@ static int xfrm_policy_migrate(struct xfrm_policy *pol,
79294 sizeof(pol->xfrm_vec[i].saddr));
79295 pol->xfrm_vec[i].encap_family = mp->new_family;
79296 /* flush bundles */
79297 - atomic_inc(&pol->genid);
79298 + atomic_inc_unchecked(&pol->genid);
79299 }
79300 }
79301
79302 diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
79303 index 5b228f9..6aca4e3 100644
79304 --- a/net/xfrm/xfrm_state.c
79305 +++ b/net/xfrm/xfrm_state.c
79306 @@ -1981,8 +1981,10 @@ int __xfrm_init_state(struct xfrm_state *x, bool init_replay)
79307 goto error;
79308
79309 x->outer_mode = xfrm_get_mode(x->props.mode, family);
79310 - if (x->outer_mode == NULL)
79311 + if (x->outer_mode == NULL) {
79312 + err = -EPROTONOSUPPORT;
79313 goto error;
79314 + }
79315
79316 if (init_replay) {
79317 err = xfrm_init_replay(x);
79318 diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
79319 index 44293b3..be1d3e58 100644
79320 --- a/net/xfrm/xfrm_user.c
79321 +++ b/net/xfrm/xfrm_user.c
79322 @@ -1413,6 +1413,7 @@ static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
79323 struct xfrm_user_tmpl *up = &vec[i];
79324 struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
79325
79326 + memset(up, 0, sizeof(*up));
79327 memcpy(&up->id, &kp->id, sizeof(up->id));
79328 up->family = kp->encap_family;
79329 memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
79330 diff --git a/scripts/Makefile.build b/scripts/Makefile.build
79331 index ff1720d..ed8475e 100644
79332 --- a/scripts/Makefile.build
79333 +++ b/scripts/Makefile.build
79334 @@ -111,7 +111,7 @@ endif
79335 endif
79336
79337 # Do not include host rules unless needed
79338 -ifneq ($(hostprogs-y)$(hostprogs-m),)
79339 +ifneq ($(hostprogs-y)$(hostprogs-m)$(hostlibs-y)$(hostlibs-m)$(hostcxxlibs-y)$(hostcxxlibs-m),)
79340 include scripts/Makefile.host
79341 endif
79342
79343 diff --git a/scripts/Makefile.clean b/scripts/Makefile.clean
79344 index 686cb0d..9d653bf 100644
79345 --- a/scripts/Makefile.clean
79346 +++ b/scripts/Makefile.clean
79347 @@ -43,7 +43,8 @@ subdir-ymn := $(addprefix $(obj)/,$(subdir-ymn))
79348 __clean-files := $(extra-y) $(always) \
79349 $(targets) $(clean-files) \
79350 $(host-progs) \
79351 - $(hostprogs-y) $(hostprogs-m) $(hostprogs-)
79352 + $(hostprogs-y) $(hostprogs-m) $(hostprogs-) \
79353 + $(hostlibs-y) $(hostlibs-m) $(hostlibs-)
79354
79355 __clean-files := $(filter-out $(no-clean-files), $(__clean-files))
79356
79357 diff --git a/scripts/Makefile.host b/scripts/Makefile.host
79358 index 1ac414f..38575f7 100644
79359 --- a/scripts/Makefile.host
79360 +++ b/scripts/Makefile.host
79361 @@ -31,6 +31,8 @@
79362 # Note: Shared libraries consisting of C++ files are not supported
79363
79364 __hostprogs := $(sort $(hostprogs-y) $(hostprogs-m))
79365 +__hostlibs := $(sort $(hostlibs-y) $(hostlibs-m))
79366 +__hostcxxlibs := $(sort $(hostcxxlibs-y) $(hostcxxlibs-m))
79367
79368 # C code
79369 # Executables compiled from a single .c file
79370 @@ -54,11 +56,15 @@ host-cxxobjs := $(sort $(foreach m,$(host-cxxmulti),$($(m)-cxxobjs)))
79371 # Shared libaries (only .c supported)
79372 # Shared libraries (.so) - all .so files referenced in "xxx-objs"
79373 host-cshlib := $(sort $(filter %.so, $(host-cobjs)))
79374 +host-cshlib += $(sort $(filter %.so, $(__hostlibs)))
79375 +host-cxxshlib := $(sort $(filter %.so, $(__hostcxxlibs)))
79376 # Remove .so files from "xxx-objs"
79377 host-cobjs := $(filter-out %.so,$(host-cobjs))
79378 +host-cxxobjs := $(filter-out %.so,$(host-cxxobjs))
79379
79380 -#Object (.o) files used by the shared libaries
79381 +# Object (.o) files used by the shared libaries
79382 host-cshobjs := $(sort $(foreach m,$(host-cshlib),$($(m:.so=-objs))))
79383 +host-cxxshobjs := $(sort $(foreach m,$(host-cxxshlib),$($(m:.so=-objs))))
79384
79385 # output directory for programs/.o files
79386 # hostprogs-y := tools/build may have been specified. Retrieve directory
79387 @@ -82,7 +88,9 @@ host-cobjs := $(addprefix $(obj)/,$(host-cobjs))
79388 host-cxxmulti := $(addprefix $(obj)/,$(host-cxxmulti))
79389 host-cxxobjs := $(addprefix $(obj)/,$(host-cxxobjs))
79390 host-cshlib := $(addprefix $(obj)/,$(host-cshlib))
79391 +host-cxxshlib := $(addprefix $(obj)/,$(host-cxxshlib))
79392 host-cshobjs := $(addprefix $(obj)/,$(host-cshobjs))
79393 +host-cxxshobjs := $(addprefix $(obj)/,$(host-cxxshobjs))
79394 host-objdirs := $(addprefix $(obj)/,$(host-objdirs))
79395
79396 obj-dirs += $(host-objdirs)
79397 @@ -156,6 +164,13 @@ quiet_cmd_host-cshobjs = HOSTCC -fPIC $@
79398 $(host-cshobjs): $(obj)/%.o: $(src)/%.c FORCE
79399 $(call if_changed_dep,host-cshobjs)
79400
79401 +# Compile .c file, create position independent .o file
79402 +# host-cxxshobjs -> .o
79403 +quiet_cmd_host-cxxshobjs = HOSTCXX -fPIC $@
79404 + cmd_host-cxxshobjs = $(HOSTCXX) $(hostcxx_flags) -fPIC -c -o $@ $<
79405 +$(host-cxxshobjs): $(obj)/%.o: $(src)/%.c FORCE
79406 + $(call if_changed_dep,host-cxxshobjs)
79407 +
79408 # Link a shared library, based on position independent .o files
79409 # *.o -> .so shared library (host-cshlib)
79410 quiet_cmd_host-cshlib = HOSTLLD -shared $@
79411 @@ -165,6 +180,15 @@ quiet_cmd_host-cshlib = HOSTLLD -shared $@
79412 $(host-cshlib): $(obj)/%: $(host-cshobjs) FORCE
79413 $(call if_changed,host-cshlib)
79414
79415 +# Link a shared library, based on position independent .o files
79416 +# *.o -> .so shared library (host-cxxshlib)
79417 +quiet_cmd_host-cxxshlib = HOSTLLD -shared $@
79418 + cmd_host-cxxshlib = $(HOSTCXX) $(HOSTLDFLAGS) -shared -o $@ \
79419 + $(addprefix $(obj)/,$($(@F:.so=-objs))) \
79420 + $(HOST_LOADLIBES) $(HOSTLOADLIBES_$(@F))
79421 +$(host-cxxshlib): $(obj)/%: $(host-cxxshobjs) FORCE
79422 + $(call if_changed,host-cxxshlib)
79423 +
79424 targets += $(host-csingle) $(host-cmulti) $(host-cobjs)\
79425 - $(host-cxxmulti) $(host-cxxobjs) $(host-cshlib) $(host-cshobjs)
79426 + $(host-cxxmulti) $(host-cxxobjs) $(host-cshlib) $(host-cshobjs) $(host-cxxshlib) $(host-cxxshobjs)
79427
79428 diff --git a/scripts/basic/fixdep.c b/scripts/basic/fixdep.c
79429 index cb1f50c..cef2a7c 100644
79430 --- a/scripts/basic/fixdep.c
79431 +++ b/scripts/basic/fixdep.c
79432 @@ -161,7 +161,7 @@ static unsigned int strhash(const char *str, unsigned int sz)
79433 /*
79434 * Lookup a value in the configuration string.
79435 */
79436 -static int is_defined_config(const char *name, int len, unsigned int hash)
79437 +static int is_defined_config(const char *name, unsigned int len, unsigned int hash)
79438 {
79439 struct item *aux;
79440
79441 @@ -211,10 +211,10 @@ static void clear_config(void)
79442 /*
79443 * Record the use of a CONFIG_* word.
79444 */
79445 -static void use_config(const char *m, int slen)
79446 +static void use_config(const char *m, unsigned int slen)
79447 {
79448 unsigned int hash = strhash(m, slen);
79449 - int c, i;
79450 + unsigned int c, i;
79451
79452 if (is_defined_config(m, slen, hash))
79453 return;
79454 @@ -235,9 +235,9 @@ static void use_config(const char *m, int slen)
79455
79456 static void parse_config_file(const char *map, size_t len)
79457 {
79458 - const int *end = (const int *) (map + len);
79459 + const unsigned int *end = (const unsigned int *) (map + len);
79460 /* start at +1, so that p can never be < map */
79461 - const int *m = (const int *) map + 1;
79462 + const unsigned int *m = (const unsigned int *) map + 1;
79463 const char *p, *q;
79464
79465 for (; m < end; m++) {
79466 @@ -406,7 +406,7 @@ static void print_deps(void)
79467 static void traps(void)
79468 {
79469 static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
79470 - int *p = (int *)test;
79471 + unsigned int *p = (unsigned int *)test;
79472
79473 if (*p != INT_CONF) {
79474 fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
79475 diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
79476 new file mode 100644
79477 index 0000000..008ac1a
79478 --- /dev/null
79479 +++ b/scripts/gcc-plugin.sh
79480 @@ -0,0 +1,17 @@
79481 +#!/bin/bash
79482 +plugincc=`$1 -x c -shared - -o /dev/null -I\`$3 -print-file-name=plugin\`/include 2>&1 <<EOF
79483 +#include "gcc-plugin.h"
79484 +#include "tree.h"
79485 +#include "tm.h"
79486 +#include "rtl.h"
79487 +#ifdef ENABLE_BUILD_WITH_CXX
79488 +#warning $2
79489 +#else
79490 +#warning $1
79491 +#endif
79492 +EOF`
79493 +if [ $? -eq 0 ]
79494 +then
79495 + [[ "$plugincc" =~ "$1" ]] && echo "$1"
79496 + [[ "$plugincc" =~ "$2" ]] && echo "$2"
79497 +fi
79498 diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
79499 index cd9c6c6..0c8f0fa 100644
79500 --- a/scripts/link-vmlinux.sh
79501 +++ b/scripts/link-vmlinux.sh
79502 @@ -147,7 +147,7 @@ else
79503 fi;
79504
79505 # final build of init/
79506 -${MAKE} -f "${srctree}/scripts/Makefile.build" obj=init
79507 +${MAKE} -f "${srctree}/scripts/Makefile.build" obj=init GCC_PLUGINS_CFLAGS="${GCC_PLUGINS_CFLAGS}" GCC_PLUGINS_AFLAGS="${GCC_PLUGINS_AFLAGS}"
79508
79509 kallsymso=""
79510 kallsyms_vmlinux=""
79511 diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
79512 index 5759751..b170367 100644
79513 --- a/scripts/mod/file2alias.c
79514 +++ b/scripts/mod/file2alias.c
79515 @@ -128,7 +128,7 @@ static void device_id_check(const char *modname, const char *device_id,
79516 unsigned long size, unsigned long id_size,
79517 void *symval)
79518 {
79519 - int i;
79520 + unsigned int i;
79521
79522 if (size % id_size || size < id_size) {
79523 if (cross_build != 0)
79524 @@ -158,7 +158,7 @@ static void device_id_check(const char *modname, const char *device_id,
79525 /* USB is special because the bcdDevice can be matched against a numeric range */
79526 /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
79527 static void do_usb_entry(struct usb_device_id *id,
79528 - unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
79529 + unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
79530 unsigned char range_lo, unsigned char range_hi,
79531 unsigned char max, struct module *mod)
79532 {
79533 @@ -259,7 +259,7 @@ static void do_usb_entry_multi(struct usb_device_id *id, struct module *mod)
79534 {
79535 unsigned int devlo, devhi;
79536 unsigned char chi, clo, max;
79537 - int ndigits;
79538 + unsigned int ndigits;
79539
79540 id->match_flags = TO_NATIVE(id->match_flags);
79541 id->idVendor = TO_NATIVE(id->idVendor);
79542 @@ -504,7 +504,7 @@ static void do_pnp_device_entry(void *symval, unsigned long size,
79543 for (i = 0; i < count; i++) {
79544 const char *id = (char *)devs[i].id;
79545 char acpi_id[sizeof(devs[0].id)];
79546 - int j;
79547 + unsigned int j;
79548
79549 buf_printf(&mod->dev_table_buf,
79550 "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
79551 @@ -534,7 +534,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size,
79552
79553 for (j = 0; j < PNP_MAX_DEVICES; j++) {
79554 const char *id = (char *)card->devs[j].id;
79555 - int i2, j2;
79556 + unsigned int i2, j2;
79557 int dup = 0;
79558
79559 if (!id[0])
79560 @@ -560,7 +560,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size,
79561 /* add an individual alias for every device entry */
79562 if (!dup) {
79563 char acpi_id[sizeof(card->devs[0].id)];
79564 - int k;
79565 + unsigned int k;
79566
79567 buf_printf(&mod->dev_table_buf,
79568 "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
79569 @@ -885,7 +885,7 @@ static void dmi_ascii_filter(char *d, const char *s)
79570 static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
79571 char *alias)
79572 {
79573 - int i, j;
79574 + unsigned int i, j;
79575
79576 sprintf(alias, "dmi*");
79577
79578 diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
79579 index 0f84bb3..2d42035 100644
79580 --- a/scripts/mod/modpost.c
79581 +++ b/scripts/mod/modpost.c
79582 @@ -925,6 +925,7 @@ enum mismatch {
79583 ANY_INIT_TO_ANY_EXIT,
79584 ANY_EXIT_TO_ANY_INIT,
79585 EXPORT_TO_INIT_EXIT,
79586 + DATA_TO_TEXT
79587 };
79588
79589 struct sectioncheck {
79590 @@ -1033,6 +1034,12 @@ const struct sectioncheck sectioncheck[] = {
79591 .tosec = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
79592 .mismatch = EXPORT_TO_INIT_EXIT,
79593 .symbol_white_list = { DEFAULT_SYMBOL_WHITE_LIST, NULL },
79594 +},
79595 +/* Do not reference code from writable data */
79596 +{
79597 + .fromsec = { DATA_SECTIONS, NULL },
79598 + .tosec = { TEXT_SECTIONS, NULL },
79599 + .mismatch = DATA_TO_TEXT
79600 }
79601 };
79602
79603 @@ -1155,10 +1162,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
79604 continue;
79605 if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
79606 continue;
79607 - if (sym->st_value == addr)
79608 - return sym;
79609 /* Find a symbol nearby - addr are maybe negative */
79610 d = sym->st_value - addr;
79611 + if (d == 0)
79612 + return sym;
79613 if (d < 0)
79614 d = addr - sym->st_value;
79615 if (d < distance) {
79616 @@ -1437,6 +1444,14 @@ static void report_sec_mismatch(const char *modname,
79617 tosym, prl_to, prl_to, tosym);
79618 free(prl_to);
79619 break;
79620 + case DATA_TO_TEXT:
79621 +#if 0
79622 + fprintf(stderr,
79623 + "The %s %s:%s references\n"
79624 + "the %s %s:%s%s\n",
79625 + from, fromsec, fromsym, to, tosec, tosym, to_p);
79626 +#endif
79627 + break;
79628 }
79629 fprintf(stderr, "\n");
79630 }
79631 @@ -1671,7 +1686,7 @@ static void section_rel(const char *modname, struct elf_info *elf,
79632 static void check_sec_ref(struct module *mod, const char *modname,
79633 struct elf_info *elf)
79634 {
79635 - int i;
79636 + unsigned int i;
79637 Elf_Shdr *sechdrs = elf->sechdrs;
79638
79639 /* Walk through all sections */
79640 @@ -1769,7 +1784,7 @@ void __attribute__((format(printf, 2, 3))) buf_printf(struct buffer *buf,
79641 va_end(ap);
79642 }
79643
79644 -void buf_write(struct buffer *buf, const char *s, int len)
79645 +void buf_write(struct buffer *buf, const char *s, unsigned int len)
79646 {
79647 if (buf->size - buf->pos < len) {
79648 buf->size += len + SZ;
79649 @@ -1987,7 +2002,7 @@ static void write_if_changed(struct buffer *b, const char *fname)
79650 if (fstat(fileno(file), &st) < 0)
79651 goto close_write;
79652
79653 - if (st.st_size != b->pos)
79654 + if (st.st_size != (off_t)b->pos)
79655 goto close_write;
79656
79657 tmp = NOFAIL(malloc(b->pos));
79658 diff --git a/scripts/mod/modpost.h b/scripts/mod/modpost.h
79659 index 51207e4..f7d603d 100644
79660 --- a/scripts/mod/modpost.h
79661 +++ b/scripts/mod/modpost.h
79662 @@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *expr);
79663
79664 struct buffer {
79665 char *p;
79666 - int pos;
79667 - int size;
79668 + unsigned int pos;
79669 + unsigned int size;
79670 };
79671
79672 void __attribute__((format(printf, 2, 3)))
79673 buf_printf(struct buffer *buf, const char *fmt, ...);
79674
79675 void
79676 -buf_write(struct buffer *buf, const char *s, int len);
79677 +buf_write(struct buffer *buf, const char *s, unsigned int len);
79678
79679 struct module {
79680 struct module *next;
79681 diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c
79682 index 9dfcd6d..099068e 100644
79683 --- a/scripts/mod/sumversion.c
79684 +++ b/scripts/mod/sumversion.c
79685 @@ -470,7 +470,7 @@ static void write_version(const char *filename, const char *sum,
79686 goto out;
79687 }
79688
79689 - if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
79690 + if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
79691 warn("writing sum in %s failed: %s\n",
79692 filename, strerror(errno));
79693 goto out;
79694 diff --git a/scripts/pnmtologo.c b/scripts/pnmtologo.c
79695 index 5c11312..72742b5 100644
79696 --- a/scripts/pnmtologo.c
79697 +++ b/scripts/pnmtologo.c
79698 @@ -237,14 +237,14 @@ static void write_header(void)
79699 fprintf(out, " * Linux logo %s\n", logoname);
79700 fputs(" */\n\n", out);
79701 fputs("#include <linux/linux_logo.h>\n\n", out);
79702 - fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
79703 + fprintf(out, "static unsigned char %s_data[] = {\n",
79704 logoname);
79705 }
79706
79707 static void write_footer(void)
79708 {
79709 fputs("\n};\n\n", out);
79710 - fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
79711 + fprintf(out, "const struct linux_logo %s = {\n", logoname);
79712 fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
79713 fprintf(out, "\t.width\t\t= %d,\n", logo_width);
79714 fprintf(out, "\t.height\t\t= %d,\n", logo_height);
79715 @@ -374,7 +374,7 @@ static void write_logo_clut224(void)
79716 fputs("\n};\n\n", out);
79717
79718 /* write logo clut */
79719 - fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
79720 + fprintf(out, "static unsigned char %s_clut[] = {\n",
79721 logoname);
79722 write_hex_cnt = 0;
79723 for (i = 0; i < logo_clutsize; i++) {
79724 diff --git a/security/Kconfig b/security/Kconfig
79725 index e9c6ac7..58348f4 100644
79726 --- a/security/Kconfig
79727 +++ b/security/Kconfig
79728 @@ -4,6 +4,888 @@
79729
79730 menu "Security options"
79731
79732 +menu "Grsecurity"
79733 +
79734 + config ARCH_TRACK_EXEC_LIMIT
79735 + bool
79736 +
79737 + config PAX_KERNEXEC_PLUGIN
79738 + bool
79739 +
79740 + config PAX_PER_CPU_PGD
79741 + bool
79742 +
79743 + config TASK_SIZE_MAX_SHIFT
79744 + int
79745 + depends on X86_64
79746 + default 47 if !PAX_PER_CPU_PGD
79747 + default 42 if PAX_PER_CPU_PGD
79748 +
79749 + config PAX_ENABLE_PAE
79750 + bool
79751 + default y if (X86_32 && (MPENTIUM4 || MK8 || MPSC || MCORE2 || MATOM))
79752 +
79753 + config PAX_USERCOPY_SLABS
79754 + bool
79755 +
79756 +config GRKERNSEC
79757 + bool "Grsecurity"
79758 + select CRYPTO
79759 + select CRYPTO_SHA256
79760 + select PROC_FS
79761 + select STOP_MACHINE
79762 + help
79763 + If you say Y here, you will be able to configure many features
79764 + that will enhance the security of your system. It is highly
79765 + recommended that you say Y here and read through the help
79766 + for each option so that you fully understand the features and
79767 + can evaluate their usefulness for your machine.
79768 +
79769 +choice
79770 + prompt "Configuration Method"
79771 + depends on GRKERNSEC
79772 + default GRKERNSEC_CONFIG_CUSTOM
79773 + help
79774 +
79775 +config GRKERNSEC_CONFIG_AUTO
79776 + bool "Automatic"
79777 + help
79778 + If you choose this configuration method, you'll be able to answer a small
79779 + number of simple questions about how you plan to use this kernel.
79780 + The settings of grsecurity and PaX will be automatically configured for
79781 + the highest commonly-used settings within the provided constraints.
79782 +
79783 + If you require additional configuration, custom changes can still be made
79784 + from the "custom configuration" menu.
79785 +
79786 +config GRKERNSEC_CONFIG_CUSTOM
79787 + bool "Custom"
79788 + help
79789 + If you choose this configuration method, you'll be able to configure all
79790 + grsecurity and PaX settings manually. Via this method, no options are
79791 + automatically enabled.
79792 +
79793 +endchoice
79794 +
79795 +choice
79796 + prompt "Usage Type"
79797 + depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO)
79798 + default GRKERNSEC_CONFIG_SERVER
79799 + help
79800 +
79801 +config GRKERNSEC_CONFIG_SERVER
79802 + bool "Server"
79803 + help
79804 + Choose this option if you plan to use this kernel on a server.
79805 +
79806 +config GRKERNSEC_CONFIG_DESKTOP
79807 + bool "Desktop"
79808 + help
79809 + Choose this option if you plan to use this kernel on a desktop.
79810 +
79811 +endchoice
79812 +
79813 +choice
79814 + prompt "Virtualization Type"
79815 + depends on (GRKERNSEC && X86 && GRKERNSEC_CONFIG_AUTO)
79816 + default GRKERNSEC_CONFIG_VIRT_NONE
79817 + help
79818 +
79819 +config GRKERNSEC_CONFIG_VIRT_NONE
79820 + bool "None"
79821 + help
79822 + Choose this option if this kernel will be run on bare metal.
79823 +
79824 +config GRKERNSEC_CONFIG_VIRT_GUEST
79825 + bool "Guest"
79826 + help
79827 + Choose this option if this kernel will be run as a VM guest.
79828 +
79829 +config GRKERNSEC_CONFIG_VIRT_HOST
79830 + bool "Host"
79831 + help
79832 + Choose this option if this kernel will be run as a VM host.
79833 +
79834 +endchoice
79835 +
79836 +choice
79837 + prompt "Virtualization Hardware"
79838 + depends on (GRKERNSEC && X86 && GRKERNSEC_CONFIG_AUTO && (GRKERNSEC_CONFIG_VIRT_GUEST || GRKERNSEC_CONFIG_VIRT_HOST))
79839 + help
79840 +
79841 +config GRKERNSEC_CONFIG_VIRT_EPT
79842 + bool "EPT/RVI Processor Support"
79843 + depends on X86
79844 + help
79845 + Choose this option if your CPU supports the EPT or RVI features of 2nd-gen
79846 + hardware virtualization. This allows for additional kernel hardening protections
79847 + to operate without additional performance impact.
79848 +
79849 + To see if your Intel processor supports EPT, see:
79850 + http://ark.intel.com/Products/VirtualizationTechnology
79851 + (Most Core i3/5/7 support EPT)
79852 +
79853 + To see if your AMD processor supports RVI, see:
79854 + http://support.amd.com/us/kbarticles/Pages/GPU120AMDRVICPUsHyperVWin8.aspx
79855 +
79856 +config GRKERNSEC_CONFIG_VIRT_SOFT
79857 + bool "First-gen/No Hardware Virtualization"
79858 + help
79859 + Choose this option if you use an Atom/Pentium/Core 2 processor that either doesn't
79860 + support hardware virtualization or doesn't support the EPT/RVI extensions.
79861 +
79862 +endchoice
79863 +
79864 +choice
79865 + prompt "Virtualization Software"
79866 + depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO && (GRKERNSEC_CONFIG_VIRT_GUEST || GRKERNSEC_CONFIG_VIRT_HOST))
79867 + help
79868 +
79869 +config GRKERNSEC_CONFIG_VIRT_XEN
79870 + bool "Xen"
79871 + help
79872 + Choose this option if this kernel is running as a Xen guest or host.
79873 +
79874 +config GRKERNSEC_CONFIG_VIRT_VMWARE
79875 + bool "VMWare"
79876 + help
79877 + Choose this option if this kernel is running as a VMWare guest or host.
79878 +
79879 +config GRKERNSEC_CONFIG_VIRT_KVM
79880 + bool "KVM"
79881 + help
79882 + Choose this option if this kernel is running as a KVM guest or host.
79883 +
79884 +config GRKERNSEC_CONFIG_VIRT_VIRTUALBOX
79885 + bool "VirtualBox"
79886 + help
79887 + Choose this option if this kernel is running as a VirtualBox guest or host.
79888 +
79889 +endchoice
79890 +
79891 +choice
79892 + prompt "Required Priorities"
79893 + depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO)
79894 + default GRKERNSEC_CONFIG_PRIORITY_PERF
79895 + help
79896 +
79897 +config GRKERNSEC_CONFIG_PRIORITY_PERF
79898 + bool "Performance"
79899 + help
79900 + Choose this option if performance is of highest priority for this deployment
79901 + of grsecurity. Features like UDEREF on a 64bit kernel, kernel stack clearing,
79902 + and freed memory sanitizing will be disabled.
79903 +
79904 +config GRKERNSEC_CONFIG_PRIORITY_SECURITY
79905 + bool "Security"
79906 + help
79907 + Choose this option if security is of highest priority for this deployment of
79908 + grsecurity. UDEREF, kernel stack clearing, and freed memory sanitizing will
79909 + be enabled for this kernel. In a worst-case scenario, these features can
79910 + introduce a 20% performance hit (UDEREF on x64 contributing half of this hit).
79911 +
79912 +endchoice
79913 +
79914 +menu "Default Special Groups"
79915 +depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO)
79916 +
79917 +config GRKERNSEC_PROC_GID
79918 + int "GID exempted from /proc restrictions"
79919 + default 1001
79920 + help
79921 + Setting this GID determines which group will be exempted from
79922 + grsecurity's /proc restrictions, allowing users of the specified
79923 + group to view network statistics and the existence of other users'
79924 + processes on the system.
79925 +
79926 +config GRKERNSEC_TPE_GID
79927 + int "GID for untrusted users"
79928 + depends on GRKERNSEC_CONFIG_SERVER
79929 + default 1005
79930 + help
79931 + Setting this GID determines which group untrusted users should
79932 + be added to. These users will be placed under grsecurity's Trusted Path
79933 + Execution mechanism, preventing them from executing their own binaries.
79934 + The users will only be able to execute binaries in directories owned and
79935 + writable only by the root user.
79936 +
79937 +config GRKERNSEC_SYMLINKOWN_GID
79938 + int "GID for users with kernel-enforced SymlinksIfOwnerMatch"
79939 + depends on GRKERNSEC_CONFIG_SERVER
79940 + default 1006
79941 + help
79942 + Setting this GID determines what group kernel-enforced
79943 + SymlinksIfOwnerMatch will be enabled for. If the sysctl option
79944 + is enabled, a sysctl option with name "symlinkown_gid" is created.
79945 +
79946 +
79947 +endmenu
79948 +
79949 +menu "Customize Configuration"
79950 +depends on GRKERNSEC
79951 +
79952 +menu "PaX"
79953 +
79954 +config PAX
79955 + bool "Enable various PaX features"
79956 + default y if GRKERNSEC_CONFIG_AUTO
79957 + depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS || PARISC || PPC || SPARC || X86)
79958 + help
79959 + This allows you to enable various PaX features. PaX adds
79960 + intrusion prevention mechanisms to the kernel that reduce
79961 + the risks posed by exploitable memory corruption bugs.
79962 +
79963 +menu "PaX Control"
79964 + depends on PAX
79965 +
79966 +config PAX_SOFTMODE
79967 + bool 'Support soft mode'
79968 + help
79969 + Enabling this option will allow you to run PaX in soft mode, that
79970 + is, PaX features will not be enforced by default, only on executables
79971 + marked explicitly. You must also enable PT_PAX_FLAGS or XATTR_PAX_FLAGS
79972 + support as they are the only way to mark executables for soft mode use.
79973 +
79974 + Soft mode can be activated by using the "pax_softmode=1" kernel command
79975 + line option on boot. Furthermore you can control various PaX features
79976 + at runtime via the entries in /proc/sys/kernel/pax.
79977 +
79978 +config PAX_EI_PAX
79979 + bool 'Use legacy ELF header marking'
79980 + default y if GRKERNSEC_CONFIG_AUTO
79981 + help
79982 + Enabling this option will allow you to control PaX features on
79983 + a per executable basis via the 'chpax' utility available at
79984 + http://pax.grsecurity.net/. The control flags will be read from
79985 + an otherwise reserved part of the ELF header. This marking has
79986 + numerous drawbacks (no support for soft-mode, toolchain does not
79987 + know about the non-standard use of the ELF header) therefore it
79988 + has been deprecated in favour of PT_PAX_FLAGS and XATTR_PAX_FLAGS
79989 + support.
79990 +
79991 + Note that if you enable PT_PAX_FLAGS or XATTR_PAX_FLAGS marking
79992 + support as well, they will override the legacy EI_PAX marks.
79993 +
79994 + If you enable none of the marking options then all applications
79995 + will run with PaX enabled on them by default.
79996 +
79997 +config PAX_PT_PAX_FLAGS
79998 + bool 'Use ELF program header marking'
79999 + default y if GRKERNSEC_CONFIG_AUTO
80000 + help
80001 + Enabling this option will allow you to control PaX features on
80002 + a per executable basis via the 'paxctl' utility available at
80003 + http://pax.grsecurity.net/. The control flags will be read from
80004 + a PaX specific ELF program header (PT_PAX_FLAGS). This marking
80005 + has the benefits of supporting both soft mode and being fully
80006 + integrated into the toolchain (the binutils patch is available
80007 + from http://pax.grsecurity.net).
80008 +
80009 + Note that if you enable the legacy EI_PAX marking support as well,
80010 + the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
80011 +
80012 + If you enable both PT_PAX_FLAGS and XATTR_PAX_FLAGS support then you
80013 + must make sure that the marks are the same if a binary has both marks.
80014 +
80015 + If you enable none of the marking options then all applications
80016 + will run with PaX enabled on them by default.
80017 +
80018 +config PAX_XATTR_PAX_FLAGS
80019 + bool 'Use filesystem extended attributes marking'
80020 + default y if GRKERNSEC_CONFIG_AUTO
80021 + select CIFS_XATTR if CIFS
80022 + select EXT2_FS_XATTR if EXT2_FS
80023 + select EXT3_FS_XATTR if EXT3_FS
80024 + select EXT4_FS_XATTR if EXT4_FS
80025 + select JFFS2_FS_XATTR if JFFS2_FS
80026 + select REISERFS_FS_XATTR if REISERFS_FS
80027 + select SQUASHFS_XATTR if SQUASHFS
80028 + select TMPFS_XATTR if TMPFS
80029 + select UBIFS_FS_XATTR if UBIFS_FS
80030 + help
80031 + Enabling this option will allow you to control PaX features on
80032 + a per executable basis via the 'setfattr' utility. The control
80033 + flags will be read from the user.pax.flags extended attribute of
80034 + the file. This marking has the benefit of supporting binary-only
80035 + applications that self-check themselves (e.g., skype) and would
80036 + not tolerate chpax/paxctl changes. The main drawback is that
80037 + extended attributes are not supported by some filesystems (e.g.,
80038 + isofs, udf, vfat) so copying files through such filesystems will
80039 + lose the extended attributes and these PaX markings.
80040 +
80041 + Note that if you enable the legacy EI_PAX marking support as well,
80042 + the EI_PAX marks will be overridden by the XATTR_PAX_FLAGS marks.
80043 +
80044 + If you enable both PT_PAX_FLAGS and XATTR_PAX_FLAGS support then you
80045 + must make sure that the marks are the same if a binary has both marks.
80046 +
80047 + If you enable none of the marking options then all applications
80048 + will run with PaX enabled on them by default.
80049 +
80050 +choice
80051 + prompt 'MAC system integration'
80052 + default PAX_HAVE_ACL_FLAGS
80053 + help
80054 + Mandatory Access Control systems have the option of controlling
80055 + PaX flags on a per executable basis, choose the method supported
80056 + by your particular system.
80057 +
80058 + - "none": if your MAC system does not interact with PaX,
80059 + - "direct": if your MAC system defines pax_set_initial_flags() itself,
80060 + - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
80061 +
80062 + NOTE: this option is for developers/integrators only.
80063 +
80064 + config PAX_NO_ACL_FLAGS
80065 + bool 'none'
80066 +
80067 + config PAX_HAVE_ACL_FLAGS
80068 + bool 'direct'
80069 +
80070 + config PAX_HOOK_ACL_FLAGS
80071 + bool 'hook'
80072 +endchoice
80073 +
80074 +endmenu
80075 +
80076 +menu "Non-executable pages"
80077 + depends on PAX
80078 +
80079 +config PAX_NOEXEC
80080 + bool "Enforce non-executable pages"
80081 + default y if GRKERNSEC_CONFIG_AUTO
80082 + depends on ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86
80083 + help
80084 + By design some architectures do not allow for protecting memory
80085 + pages against execution or even if they do, Linux does not make
80086 + use of this feature. In practice this means that if a page is
80087 + readable (such as the stack or heap) it is also executable.
80088 +
80089 + There is a well known exploit technique that makes use of this
80090 + fact and a common programming mistake where an attacker can
80091 + introduce code of his choice somewhere in the attacked program's
80092 + memory (typically the stack or the heap) and then execute it.
80093 +
80094 + If the attacked program was running with different (typically
80095 + higher) privileges than that of the attacker, then he can elevate
80096 + his own privilege level (e.g. get a root shell, write to files for
80097 + which he does not have write access to, etc).
80098 +
80099 + Enabling this option will let you choose from various features
80100 + that prevent the injection and execution of 'foreign' code in
80101 + a program.
80102 +
80103 + This will also break programs that rely on the old behaviour and
80104 + expect that dynamically allocated memory via the malloc() family
80105 + of functions is executable (which it is not). Notable examples
80106 + are the XFree86 4.x server, the java runtime and wine.
80107 +
80108 +config PAX_PAGEEXEC
80109 + bool "Paging based non-executable pages"
80110 + default y if GRKERNSEC_CONFIG_AUTO
80111 + depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MATOM || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
80112 + select S390_SWITCH_AMODE if S390
80113 + select S390_EXEC_PROTECT if S390
80114 + select ARCH_TRACK_EXEC_LIMIT if X86_32
80115 + help
80116 + This implementation is based on the paging feature of the CPU.
80117 + On i386 without hardware non-executable bit support there is a
80118 + variable but usually low performance impact, however on Intel's
80119 + P4 core based CPUs it is very high so you should not enable this
80120 + for kernels meant to be used on such CPUs.
80121 +
80122 + On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
80123 + with hardware non-executable bit support there is no performance
80124 + impact, on ppc the impact is negligible.
80125 +
80126 + Note that several architectures require various emulations due to
80127 + badly designed userland ABIs, this will cause a performance impact
80128 + but will disappear as soon as userland is fixed. For example, ppc
80129 + userland MUST have been built with secure-plt by a recent toolchain.
80130 +
80131 +config PAX_SEGMEXEC
80132 + bool "Segmentation based non-executable pages"
80133 + default y if GRKERNSEC_CONFIG_AUTO
80134 + depends on PAX_NOEXEC && X86_32
80135 + help
80136 + This implementation is based on the segmentation feature of the
80137 + CPU and has a very small performance impact, however applications
80138 + will be limited to a 1.5 GB address space instead of the normal
80139 + 3 GB.
80140 +
80141 +config PAX_EMUTRAMP
80142 + bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
80143 + default y if PARISC
80144 + help
80145 + There are some programs and libraries that for one reason or
80146 + another attempt to execute special small code snippets from
80147 + non-executable memory pages. Most notable examples are the
80148 + signal handler return code generated by the kernel itself and
80149 + the GCC trampolines.
80150 +
80151 + If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
80152 + such programs will no longer work under your kernel.
80153 +
80154 + As a remedy you can say Y here and use the 'chpax' or 'paxctl'
80155 + utilities to enable trampoline emulation for the affected programs
80156 + yet still have the protection provided by the non-executable pages.
80157 +
80158 + On parisc you MUST enable this option and EMUSIGRT as well, otherwise
80159 + your system will not even boot.
80160 +
80161 + Alternatively you can say N here and use the 'chpax' or 'paxctl'
80162 + utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
80163 + for the affected files.
80164 +
80165 + NOTE: enabling this feature *may* open up a loophole in the
80166 + protection provided by non-executable pages that an attacker
80167 + could abuse. Therefore the best solution is to not have any
80168 + files on your system that would require this option. This can
80169 + be achieved by not using libc5 (which relies on the kernel
80170 + signal handler return code) and not using or rewriting programs
80171 + that make use of the nested function implementation of GCC.
80172 + Skilled users can just fix GCC itself so that it implements
80173 + nested function calls in a way that does not interfere with PaX.
80174 +
80175 +config PAX_EMUSIGRT
80176 + bool "Automatically emulate sigreturn trampolines"
80177 + depends on PAX_EMUTRAMP && PARISC
80178 + default y
80179 + help
80180 + Enabling this option will have the kernel automatically detect
80181 + and emulate signal return trampolines executing on the stack
80182 + that would otherwise lead to task termination.
80183 +
80184 + This solution is intended as a temporary one for users with
80185 + legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
80186 + Modula-3 runtime, etc) or executables linked to such, basically
80187 + everything that does not specify its own SA_RESTORER function in
80188 + normal executable memory like glibc 2.1+ does.
80189 +
80190 + On parisc you MUST enable this option, otherwise your system will
80191 + not even boot.
80192 +
80193 + NOTE: this feature cannot be disabled on a per executable basis
80194 + and since it *does* open up a loophole in the protection provided
80195 + by non-executable pages, the best solution is to not have any
80196 + files on your system that would require this option.
80197 +
80198 +config PAX_MPROTECT
80199 + bool "Restrict mprotect()"
80200 + default y if GRKERNSEC_CONFIG_AUTO
80201 + depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
80202 + help
80203 + Enabling this option will prevent programs from
80204 + - changing the executable status of memory pages that were
80205 + not originally created as executable,
80206 + - making read-only executable pages writable again,
80207 + - creating executable pages from anonymous memory,
80208 + - making read-only-after-relocations (RELRO) data pages writable again.
80209 +
80210 + You should say Y here to complete the protection provided by
80211 + the enforcement of non-executable pages.
80212 +
80213 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control
80214 + this feature on a per file basis.
80215 +
80216 +config PAX_MPROTECT_COMPAT
80217 + bool "Use legacy/compat protection demoting (read help)"
80218 + default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_DESKTOP)
80219 + depends on PAX_MPROTECT
80220 + help
80221 + The current implementation of PAX_MPROTECT denies RWX allocations/mprotects
80222 + by sending the proper error code to the application. For some broken
80223 + userland, this can cause problems with Python or other applications. The
80224 + current implementation however allows for applications like clamav to
80225 + detect if JIT compilation/execution is allowed and to fall back gracefully
80226 + to an interpreter-based mode if it does not. While we encourage everyone
80227 + to use the current implementation as-is and push upstream to fix broken
80228 + userland (note that the RWX logging option can assist with this), in some
80229 + environments this may not be possible. Having to disable MPROTECT
80230 + completely on certain binaries reduces the security benefit of PaX,
80231 + so this option is provided for those environments to revert to the old
80232 + behavior.
80233 +
80234 +config PAX_ELFRELOCS
80235 + bool "Allow ELF text relocations (read help)"
80236 + depends on PAX_MPROTECT
80237 + default n
80238 + help
80239 + Non-executable pages and mprotect() restrictions are effective
80240 + in preventing the introduction of new executable code into an
80241 + attacked task's address space. There remain only two venues
80242 + for this kind of attack: if the attacker can execute already
80243 + existing code in the attacked task then he can either have it
80244 + create and mmap() a file containing his code or have it mmap()
80245 + an already existing ELF library that does not have position
80246 + independent code in it and use mprotect() on it to make it
80247 + writable and copy his code there. While protecting against
80248 + the former approach is beyond PaX, the latter can be prevented
80249 + by having only PIC ELF libraries on one's system (which do not
80250 + need to relocate their code). If you are sure this is your case,
80251 + as is the case with all modern Linux distributions, then leave
80252 + this option disabled. You should say 'n' here.
80253 +
80254 +config PAX_ETEXECRELOCS
80255 + bool "Allow ELF ET_EXEC text relocations"
80256 + depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
80257 + select PAX_ELFRELOCS
80258 + default y
80259 + help
80260 + On some architectures there are incorrectly created applications
80261 + that require text relocations and would not work without enabling
80262 + this option. If you are an alpha, ia64 or parisc user, you should
80263 + enable this option and disable it once you have made sure that
80264 + none of your applications need it.
80265 +
80266 +config PAX_EMUPLT
80267 + bool "Automatically emulate ELF PLT"
80268 + depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
80269 + default y
80270 + help
80271 + Enabling this option will have the kernel automatically detect
80272 + and emulate the Procedure Linkage Table entries in ELF files.
80273 + On some architectures such entries are in writable memory, and
80274 + become non-executable leading to task termination. Therefore
80275 + it is mandatory that you enable this option on alpha, parisc,
80276 + sparc and sparc64, otherwise your system would not even boot.
80277 +
80278 + NOTE: this feature *does* open up a loophole in the protection
80279 + provided by the non-executable pages, therefore the proper
80280 + solution is to modify the toolchain to produce a PLT that does
80281 + not need to be writable.
80282 +
80283 +config PAX_DLRESOLVE
80284 + bool 'Emulate old glibc resolver stub'
80285 + depends on PAX_EMUPLT && SPARC
80286 + default n
80287 + help
80288 + This option is needed if userland has an old glibc (before 2.4)
80289 + that puts a 'save' instruction into the runtime generated resolver
80290 + stub that needs special emulation.
80291 +
80292 +config PAX_KERNEXEC
80293 + bool "Enforce non-executable kernel pages"
80294 + default y if GRKERNSEC_CONFIG_AUTO && (GRKERNSEC_CONFIG_VIRT_NONE || (GRKERNSEC_CONFIG_VIRT_EPT && GRKERNSEC_CONFIG_VIRT_GUEST) || (GRKERNSEC_CONFIG_VIRT_EPT && GRKERNSEC_CONFIG_VIRT_KVM))
80295 + depends on (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN
80296 + select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
80297 + select PAX_KERNEXEC_PLUGIN if X86_64
80298 + help
80299 + This is the kernel land equivalent of PAGEEXEC and MPROTECT,
80300 + that is, enabling this option will make it harder to inject
80301 + and execute 'foreign' code in kernel memory itself.
80302 +
80303 + Note that on x86_64 kernels there is a known regression when
80304 + this feature and KVM/VMX are both enabled in the host kernel.
80305 +
80306 +choice
80307 + prompt "Return Address Instrumentation Method"
80308 + default PAX_KERNEXEC_PLUGIN_METHOD_BTS
80309 + depends on PAX_KERNEXEC_PLUGIN
80310 + help
80311 + Select the method used to instrument function pointer dereferences.
80312 + Note that binary modules cannot be instrumented by this approach.
80313 +
80314 + Note that the implementation requires a gcc with plugin support,
80315 + i.e., gcc 4.5 or newer. You may need to install the supporting
80316 + headers explicitly in addition to the normal gcc package.
80317 +
80318 + config PAX_KERNEXEC_PLUGIN_METHOD_BTS
80319 + bool "bts"
80320 + help
80321 + This method is compatible with binary only modules but has
80322 + a higher runtime overhead.
80323 +
80324 + config PAX_KERNEXEC_PLUGIN_METHOD_OR
80325 + bool "or"
80326 + depends on !PARAVIRT
80327 + help
80328 + This method is incompatible with binary only modules but has
80329 + a lower runtime overhead.
80330 +endchoice
80331 +
80332 +config PAX_KERNEXEC_PLUGIN_METHOD
80333 + string
80334 + default "bts" if PAX_KERNEXEC_PLUGIN_METHOD_BTS
80335 + default "or" if PAX_KERNEXEC_PLUGIN_METHOD_OR
80336 + default ""
80337 +
80338 +config PAX_KERNEXEC_MODULE_TEXT
80339 + int "Minimum amount of memory reserved for module code"
80340 + default "4" if (!GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_SERVER)
80341 + default "12" if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_DESKTOP)
80342 + depends on PAX_KERNEXEC && X86_32 && MODULES
80343 + help
80344 + Due to implementation details the kernel must reserve a fixed
80345 + amount of memory for module code at compile time that cannot be
80346 + changed at runtime. Here you can specify the minimum amount
80347 + in MB that will be reserved. Due to the same implementation
80348 + details this size will always be rounded up to the next 2/4 MB
80349 + boundary (depends on PAE) so the actually available memory for
80350 + module code will usually be more than this minimum.
80351 +
80352 + The default 4 MB should be enough for most users but if you have
80353 + an excessive number of modules (e.g., most distribution configs
80354 + compile many drivers as modules) or use huge modules such as
80355 + nvidia's kernel driver, you will need to adjust this amount.
80356 + A good rule of thumb is to look at your currently loaded kernel
80357 + modules and add up their sizes.
80358 +
80359 +endmenu
80360 +
80361 +menu "Address Space Layout Randomization"
80362 + depends on PAX
80363 +
80364 +config PAX_ASLR
80365 + bool "Address Space Layout Randomization"
80366 + default y if GRKERNSEC_CONFIG_AUTO
80367 + help
80368 + Many if not most exploit techniques rely on the knowledge of
80369 + certain addresses in the attacked program. The following options
80370 + will allow the kernel to apply a certain amount of randomization
80371 + to specific parts of the program thereby forcing an attacker to
80372 + guess them in most cases. Any failed guess will most likely crash
80373 + the attacked program which allows the kernel to detect such attempts
80374 + and react on them. PaX itself provides no reaction mechanisms,
80375 + instead it is strongly encouraged that you make use of Nergal's
80376 + segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
80377 + (http://www.grsecurity.net/) built-in crash detection features or
80378 + develop one yourself.
80379 +
80380 + By saying Y here you can choose to randomize the following areas:
80381 + - top of the task's kernel stack
80382 + - top of the task's userland stack
80383 + - base address for mmap() requests that do not specify one
80384 + (this includes all libraries)
80385 + - base address of the main executable
80386 +
80387 + It is strongly recommended to say Y here as address space layout
80388 + randomization has negligible impact on performance yet it provides
80389 + a very effective protection.
80390 +
80391 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control
80392 + this feature on a per file basis.
80393 +
80394 +config PAX_RANDKSTACK
80395 + bool "Randomize kernel stack base"
80396 + default y if GRKERNSEC_CONFIG_AUTO
80397 + depends on X86_TSC && X86
80398 + help
80399 + By saying Y here the kernel will randomize every task's kernel
80400 + stack on every system call. This will not only force an attacker
80401 + to guess it but also prevent him from making use of possible
80402 + leaked information about it.
80403 +
80404 + Since the kernel stack is a rather scarce resource, randomization
80405 + may cause unexpected stack overflows, therefore you should very
80406 + carefully test your system. Note that once enabled in the kernel
80407 + configuration, this feature cannot be disabled on a per file basis.
80408 +
80409 +config PAX_RANDUSTACK
80410 + bool "Randomize user stack base"
80411 + default y if GRKERNSEC_CONFIG_AUTO
80412 + depends on PAX_ASLR
80413 + help
80414 + By saying Y here the kernel will randomize every task's userland
80415 + stack. The randomization is done in two steps where the second
80416 + one may apply a big amount of shift to the top of the stack and
80417 + cause problems for programs that want to use lots of memory (more
80418 + than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
80419 + For this reason the second step can be controlled by 'chpax' or
80420 + 'paxctl' on a per file basis.
80421 +
80422 +config PAX_RANDMMAP
80423 + bool "Randomize mmap() base"
80424 + default y if GRKERNSEC_CONFIG_AUTO
80425 + depends on PAX_ASLR
80426 + help
80427 + By saying Y here the kernel will use a randomized base address for
80428 + mmap() requests that do not specify one themselves. As a result
80429 + all dynamically loaded libraries will appear at random addresses
80430 + and therefore be harder to exploit by a technique where an attacker
80431 + attempts to execute library code for his purposes (e.g. spawn a
80432 + shell from an exploited program that is running at an elevated
80433 + privilege level).
80434 +
80435 + Furthermore, if a program is relinked as a dynamic ELF file, its
80436 + base address will be randomized as well, completing the full
80437 + randomization of the address space layout. Attacking such programs
80438 + becomes a guess game. You can find an example of doing this at
80439 + http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
80440 + http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
80441 +
80442 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
80443 + feature on a per file basis.
80444 +
80445 +endmenu
80446 +
80447 +menu "Miscellaneous hardening features"
80448 +
80449 +config PAX_MEMORY_SANITIZE
80450 + bool "Sanitize all freed memory"
80451 + default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
80452 + depends on !HIBERNATION
80453 + help
80454 + By saying Y here the kernel will erase memory pages as soon as they
80455 + are freed. This in turn reduces the lifetime of data stored in the
80456 + pages, making it less likely that sensitive information such as
80457 + passwords, cryptographic secrets, etc stay in memory for too long.
80458 +
80459 + This is especially useful for programs whose runtime is short, long
80460 + lived processes and the kernel itself benefit from this as long as
80461 + they operate on whole memory pages and ensure timely freeing of pages
80462 + that may hold sensitive information.
80463 +
80464 + The tradeoff is performance impact, on a single CPU system kernel
80465 + compilation sees a 3% slowdown, other systems and workloads may vary
80466 + and you are advised to test this feature on your expected workload
80467 + before deploying it.
80468 +
80469 + Note that this feature does not protect data stored in live pages,
80470 + e.g., process memory swapped to disk may stay there for a long time.
80471 +
80472 +config PAX_MEMORY_STACKLEAK
80473 + bool "Sanitize kernel stack"
80474 + default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
80475 + depends on X86
80476 + help
80477 + By saying Y here the kernel will erase the kernel stack before it
80478 + returns from a system call. This in turn reduces the information
80479 + that a kernel stack leak bug can reveal.
80480 +
80481 + Note that such a bug can still leak information that was put on
80482 + the stack by the current system call (the one eventually triggering
80483 + the bug) but traces of earlier system calls on the kernel stack
80484 + cannot leak anymore.
80485 +
80486 + The tradeoff is performance impact: on a single CPU system kernel
80487 + compilation sees a 1% slowdown, other systems and workloads may vary
80488 + and you are advised to test this feature on your expected workload
80489 + before deploying it.
80490 +
80491 + Note that the full feature requires a gcc with plugin support,
80492 + i.e., gcc 4.5 or newer. You may need to install the supporting
80493 + headers explicitly in addition to the normal gcc package. Using
80494 + older gcc versions means that functions with large enough stack
80495 + frames may leave uninitialized memory behind that may be exposed
80496 + to a later syscall leaking the stack.
80497 +
80498 +config PAX_MEMORY_UDEREF
80499 + bool "Prevent invalid userland pointer dereference"
80500 + default y if GRKERNSEC_CONFIG_AUTO && (X86_32 || (X86_64 && GRKERNSEC_CONFIG_PRIORITY_SECURITY)) && (GRKERNSEC_CONFIG_VIRT_NONE || GRKERNSEC_CONFIG_VIRT_EPT)
80501 + depends on X86 && !UML_X86 && !XEN
80502 + select PAX_PER_CPU_PGD if X86_64
80503 + help
80504 + By saying Y here the kernel will be prevented from dereferencing
80505 + userland pointers in contexts where the kernel expects only kernel
80506 + pointers. This is both a useful runtime debugging feature and a
80507 + security measure that prevents exploiting a class of kernel bugs.
80508 +
80509 + The tradeoff is that some virtualization solutions may experience
80510 + a huge slowdown and therefore you should not enable this feature
80511 + for kernels meant to run in such environments. Whether a given VM
80512 + solution is affected or not is best determined by simply trying it
80513 + out, the performance impact will be obvious right on boot as this
80514 + mechanism engages from very early on. A good rule of thumb is that
80515 + VMs running on CPUs without hardware virtualization support (i.e.,
80516 + the majority of IA-32 CPUs) will likely experience the slowdown.
80517 +
80518 +config PAX_REFCOUNT
80519 + bool "Prevent various kernel object reference counter overflows"
80520 + default y if GRKERNSEC_CONFIG_AUTO
80521 + depends on GRKERNSEC && ((ARM && (CPU_32v6 || CPU_32v6K || CPU_32v7)) || SPARC64 || X86)
80522 + help
80523 + By saying Y here the kernel will detect and prevent overflowing
80524 + various (but not all) kinds of object reference counters. Such
80525 + overflows can normally occur due to bugs only and are often, if
80526 + not always, exploitable.
80527 +
80528 + The tradeoff is that data structures protected by an overflowed
80529 + refcount will never be freed and therefore will leak memory. Note
80530 + that this leak also happens even without this protection but in
80531 + that case the overflow can eventually trigger the freeing of the
80532 + data structure while it is still being used elsewhere, resulting
80533 + in the exploitable situation that this feature prevents.
80534 +
80535 + Since this has a negligible performance impact, you should enable
80536 + this feature.
80537 +
80538 +config PAX_USERCOPY
80539 + bool "Harden heap object copies between kernel and userland"
80540 + default y if GRKERNSEC_CONFIG_AUTO
80541 + depends on X86 || PPC || SPARC || ARM
80542 + depends on GRKERNSEC && (SLAB || SLUB || SLOB)
80543 + select PAX_USERCOPY_SLABS
80544 + help
80545 + By saying Y here the kernel will enforce the size of heap objects
80546 + when they are copied in either direction between the kernel and
80547 + userland, even if only a part of the heap object is copied.
80548 +
80549 + Specifically, this checking prevents information leaking from the
80550 + kernel heap during kernel to userland copies (if the kernel heap
80551 + object is otherwise fully initialized) and prevents kernel heap
80552 + overflows during userland to kernel copies.
80553 +
80554 + Note that the current implementation provides the strictest bounds
80555 + checks for the SLUB allocator.
80556 +
80557 + Enabling this option also enables per-slab cache protection against
80558 + data in a given cache being copied into/out of via userland
80559 + accessors. Though the whitelist of regions will be reduced over
80560 + time, it notably protects important data structures like task structs.
80561 +
80562 + If frame pointers are enabled on x86, this option will also restrict
80563 + copies into and out of the kernel stack to local variables within a
80564 + single frame.
80565 +
80566 + Since this has a negligible performance impact, you should enable
80567 + this feature.
80568 +
80569 +config PAX_SIZE_OVERFLOW
80570 + bool "Prevent various integer overflows in function size parameters"
80571 + default y if GRKERNSEC_CONFIG_AUTO
80572 + depends on X86
80573 + help
80574 + By saying Y here the kernel recomputes expressions of function
80575 + arguments marked by a size_overflow attribute with double integer
80576 + precision (DImode/TImode for 32/64 bit integer types).
80577 +
80578 + The recomputed argument is checked against TYPE_MAX and an event
80579 + is logged on overflow and the triggering process is killed.
80580 +
80581 + Homepage: http://www.grsecurity.net/~ephox/overflow_plugin/
80582 +
80583 + Note that the implementation requires a gcc with plugin support,
80584 + i.e., gcc 4.5 or newer. You may need to install the supporting
80585 + headers explicitly in addition to the normal gcc package.
80586 +
80587 +config PAX_LATENT_ENTROPY
80588 + bool "Generate some entropy during boot"
80589 + default y if GRKERNSEC_CONFIG_AUTO
80590 + help
80591 + By saying Y here the kernel will instrument early boot code to
80592 + extract some entropy from both original and artificially created
80593 + program state. This will help especially embedded systems where
80594 + there is little 'natural' source of entropy normally. The cost
80595 + is some slowdown of the boot process.
80596 +
80597 + Note that the implementation requires a gcc with plugin support,
80598 + i.e., gcc 4.5 or newer. You may need to install the supporting
80599 + headers explicitly in addition to the normal gcc package.
80600 +
80601 + Note that entropy extracted this way is not cryptographically
80602 + secure!
80603 +
80604 +endmenu
80605 +
80606 +endmenu
80607 +
80608 +source grsecurity/Kconfig
80609 +
80610 +endmenu
80611 +
80612 +endmenu
80613 +
80614 source security/keys/Kconfig
80615
80616 config SECURITY_DMESG_RESTRICT
80617 @@ -103,7 +985,7 @@ config INTEL_TXT
80618 config LSM_MMAP_MIN_ADDR
80619 int "Low address space for LSM to protect from user allocation"
80620 depends on SECURITY && SECURITY_SELINUX
80621 - default 32768 if ARM
80622 + default 32768 if ALPHA || ARM || PARISC || SPARC32
80623 default 65536
80624 help
80625 This is the portion of low virtual memory which should be protected
80626 diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
80627 index 8ea39aa..8569ac5 100644
80628 --- a/security/apparmor/lsm.c
80629 +++ b/security/apparmor/lsm.c
80630 @@ -614,7 +614,7 @@ static int apparmor_task_setrlimit(struct task_struct *task,
80631 return error;
80632 }
80633
80634 -static struct security_operations apparmor_ops = {
80635 +static struct security_operations apparmor_ops __read_only = {
80636 .name = "apparmor",
80637
80638 .ptrace_access_check = apparmor_ptrace_access_check,
80639 diff --git a/security/commoncap.c b/security/commoncap.c
80640 index 6dbae46..d5611fd 100644
80641 --- a/security/commoncap.c
80642 +++ b/security/commoncap.c
80643 @@ -415,6 +415,32 @@ int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data
80644 return 0;
80645 }
80646
80647 +/* returns:
80648 + 1 for suid privilege
80649 + 2 for sgid privilege
80650 + 3 for fscap privilege
80651 +*/
80652 +int is_privileged_binary(const struct dentry *dentry)
80653 +{
80654 + struct cpu_vfs_cap_data capdata;
80655 + struct inode *inode = dentry->d_inode;
80656 +
80657 + if (!inode || S_ISDIR(inode->i_mode))
80658 + return 0;
80659 +
80660 + if (inode->i_mode & S_ISUID)
80661 + return 1;
80662 + if ((inode->i_mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
80663 + return 2;
80664 +
80665 + if (!get_vfs_caps_from_disk(dentry, &capdata)) {
80666 + if (!cap_isclear(capdata.inheritable) || !cap_isclear(capdata.permitted))
80667 + return 3;
80668 + }
80669 +
80670 + return 0;
80671 +}
80672 +
80673 /*
80674 * Attempt to get the on-exec apply capability sets for an executable file from
80675 * its xattrs and, if present, apply them to the proposed credentials being
80676 @@ -583,6 +609,9 @@ int cap_bprm_secureexec(struct linux_binprm *bprm)
80677 const struct cred *cred = current_cred();
80678 kuid_t root_uid = make_kuid(cred->user_ns, 0);
80679
80680 + if (gr_acl_enable_at_secure())
80681 + return 1;
80682 +
80683 if (!uid_eq(cred->uid, root_uid)) {
80684 if (bprm->cap_effective)
80685 return 1;
80686 diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
80687 index 3ccf7ac..d73ad64 100644
80688 --- a/security/integrity/ima/ima.h
80689 +++ b/security/integrity/ima/ima.h
80690 @@ -86,8 +86,8 @@ void ima_add_violation(struct inode *inode, const unsigned char *filename,
80691 extern spinlock_t ima_queue_lock;
80692
80693 struct ima_h_table {
80694 - atomic_long_t len; /* number of stored measurements in the list */
80695 - atomic_long_t violations;
80696 + atomic_long_unchecked_t len; /* number of stored measurements in the list */
80697 + atomic_long_unchecked_t violations;
80698 struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
80699 };
80700 extern struct ima_h_table ima_htable;
80701 diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
80702 index 88a2788..581ab92 100644
80703 --- a/security/integrity/ima/ima_api.c
80704 +++ b/security/integrity/ima/ima_api.c
80705 @@ -75,7 +75,7 @@ void ima_add_violation(struct inode *inode, const unsigned char *filename,
80706 int result;
80707
80708 /* can overflow, only indicator */
80709 - atomic_long_inc(&ima_htable.violations);
80710 + atomic_long_inc_unchecked(&ima_htable.violations);
80711
80712 entry = kmalloc(sizeof(*entry), GFP_KERNEL);
80713 if (!entry) {
80714 diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
80715 index e1aa2b4..52027bf 100644
80716 --- a/security/integrity/ima/ima_fs.c
80717 +++ b/security/integrity/ima/ima_fs.c
80718 @@ -28,12 +28,12 @@
80719 static int valid_policy = 1;
80720 #define TMPBUFLEN 12
80721 static ssize_t ima_show_htable_value(char __user *buf, size_t count,
80722 - loff_t *ppos, atomic_long_t *val)
80723 + loff_t *ppos, atomic_long_unchecked_t *val)
80724 {
80725 char tmpbuf[TMPBUFLEN];
80726 ssize_t len;
80727
80728 - len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
80729 + len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
80730 return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
80731 }
80732
80733 diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
80734 index 55a6271..ad829c3 100644
80735 --- a/security/integrity/ima/ima_queue.c
80736 +++ b/security/integrity/ima/ima_queue.c
80737 @@ -81,7 +81,7 @@ static int ima_add_digest_entry(struct ima_template_entry *entry)
80738 INIT_LIST_HEAD(&qe->later);
80739 list_add_tail_rcu(&qe->later, &ima_measurements);
80740
80741 - atomic_long_inc(&ima_htable.len);
80742 + atomic_long_inc_unchecked(&ima_htable.len);
80743 key = ima_hash_key(entry->digest);
80744 hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
80745 return 0;
80746 diff --git a/security/keys/compat.c b/security/keys/compat.c
80747 index c92d42b..341e7ea 100644
80748 --- a/security/keys/compat.c
80749 +++ b/security/keys/compat.c
80750 @@ -44,7 +44,7 @@ long compat_keyctl_instantiate_key_iov(
80751 if (ret == 0)
80752 goto no_payload_free;
80753
80754 - ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
80755 + ret = keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, ioc, ret, ringid);
80756
80757 if (iov != iovstack)
80758 kfree(iov);
80759 diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
80760 index 0f5b3f0..b8d47c1 100644
80761 --- a/security/keys/keyctl.c
80762 +++ b/security/keys/keyctl.c
80763 @@ -966,7 +966,7 @@ static int keyctl_change_reqkey_auth(struct key *key)
80764 /*
80765 * Copy the iovec data from userspace
80766 */
80767 -static long copy_from_user_iovec(void *buffer, const struct iovec *iov,
80768 +static long copy_from_user_iovec(void *buffer, const struct iovec __user *iov,
80769 unsigned ioc)
80770 {
80771 for (; ioc > 0; ioc--) {
80772 @@ -988,7 +988,7 @@ static long copy_from_user_iovec(void *buffer, const struct iovec *iov,
80773 * If successful, 0 will be returned.
80774 */
80775 long keyctl_instantiate_key_common(key_serial_t id,
80776 - const struct iovec *payload_iov,
80777 + const struct iovec __user *payload_iov,
80778 unsigned ioc,
80779 size_t plen,
80780 key_serial_t ringid)
80781 @@ -1083,7 +1083,7 @@ long keyctl_instantiate_key(key_serial_t id,
80782 [0].iov_len = plen
80783 };
80784
80785 - return keyctl_instantiate_key_common(id, iov, 1, plen, ringid);
80786 + return keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, 1, plen, ringid);
80787 }
80788
80789 return keyctl_instantiate_key_common(id, NULL, 0, 0, ringid);
80790 @@ -1116,7 +1116,7 @@ long keyctl_instantiate_key_iov(key_serial_t id,
80791 if (ret == 0)
80792 goto no_payload_free;
80793
80794 - ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
80795 + ret = keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, ioc, ret, ringid);
80796
80797 if (iov != iovstack)
80798 kfree(iov);
80799 diff --git a/security/keys/keyring.c b/security/keys/keyring.c
80800 index 7445875..262834f 100644
80801 --- a/security/keys/keyring.c
80802 +++ b/security/keys/keyring.c
80803 @@ -227,16 +227,16 @@ static long keyring_read(const struct key *keyring,
80804 ret = -EFAULT;
80805
80806 for (loop = 0; loop < klist->nkeys; loop++) {
80807 + key_serial_t serial;
80808 key = rcu_deref_link_locked(klist, loop,
80809 keyring);
80810 + serial = key->serial;
80811
80812 tmp = sizeof(key_serial_t);
80813 if (tmp > buflen)
80814 tmp = buflen;
80815
80816 - if (copy_to_user(buffer,
80817 - &key->serial,
80818 - tmp) != 0)
80819 + if (copy_to_user(buffer, &serial, tmp))
80820 goto error;
80821
80822 buflen -= tmp;
80823 diff --git a/security/min_addr.c b/security/min_addr.c
80824 index f728728..6457a0c 100644
80825 --- a/security/min_addr.c
80826 +++ b/security/min_addr.c
80827 @@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
80828 */
80829 static void update_mmap_min_addr(void)
80830 {
80831 +#ifndef SPARC
80832 #ifdef CONFIG_LSM_MMAP_MIN_ADDR
80833 if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
80834 mmap_min_addr = dac_mmap_min_addr;
80835 @@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
80836 #else
80837 mmap_min_addr = dac_mmap_min_addr;
80838 #endif
80839 +#endif
80840 }
80841
80842 /*
80843 diff --git a/security/security.c b/security/security.c
80844 index 860aeb3..45765c0 100644
80845 --- a/security/security.c
80846 +++ b/security/security.c
80847 @@ -20,6 +20,7 @@
80848 #include <linux/ima.h>
80849 #include <linux/evm.h>
80850 #include <linux/fsnotify.h>
80851 +#include <linux/mm.h>
80852 #include <linux/mman.h>
80853 #include <linux/mount.h>
80854 #include <linux/personality.h>
80855 @@ -32,8 +33,8 @@
80856 static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] =
80857 CONFIG_DEFAULT_SECURITY;
80858
80859 -static struct security_operations *security_ops;
80860 -static struct security_operations default_security_ops = {
80861 +static struct security_operations *security_ops __read_only;
80862 +static struct security_operations default_security_ops __read_only = {
80863 .name = "default",
80864 };
80865
80866 @@ -74,7 +75,9 @@ int __init security_init(void)
80867
80868 void reset_security_ops(void)
80869 {
80870 + pax_open_kernel();
80871 security_ops = &default_security_ops;
80872 + pax_close_kernel();
80873 }
80874
80875 /* Save user chosen LSM */
80876 diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
80877 index db10db2..99a640f 100644
80878 --- a/security/selinux/hooks.c
80879 +++ b/security/selinux/hooks.c
80880 @@ -95,8 +95,6 @@
80881
80882 #define NUM_SEL_MNT_OPTS 5
80883
80884 -extern struct security_operations *security_ops;
80885 -
80886 /* SECMARK reference count */
80887 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
80888
80889 @@ -5511,7 +5509,7 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer)
80890
80891 #endif
80892
80893 -static struct security_operations selinux_ops = {
80894 +static struct security_operations selinux_ops __read_only = {
80895 .name = "selinux",
80896
80897 .ptrace_access_check = selinux_ptrace_access_check,
80898 diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
80899 index c220f31..89fab3f 100644
80900 --- a/security/selinux/include/xfrm.h
80901 +++ b/security/selinux/include/xfrm.h
80902 @@ -50,7 +50,7 @@ int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
80903
80904 static inline void selinux_xfrm_notify_policyload(void)
80905 {
80906 - atomic_inc(&flow_cache_genid);
80907 + atomic_inc_unchecked(&flow_cache_genid);
80908 }
80909 #else
80910 static inline int selinux_xfrm_enabled(void)
80911 diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
80912 index ee0bb57..57fcd43 100644
80913 --- a/security/smack/smack_lsm.c
80914 +++ b/security/smack/smack_lsm.c
80915 @@ -3432,7 +3432,7 @@ static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
80916 return 0;
80917 }
80918
80919 -struct security_operations smack_ops = {
80920 +struct security_operations smack_ops __read_only = {
80921 .name = "smack",
80922
80923 .ptrace_access_check = smack_ptrace_access_check,
80924 diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
80925 index c2d04a5..e6a1aeb 100644
80926 --- a/security/tomoyo/tomoyo.c
80927 +++ b/security/tomoyo/tomoyo.c
80928 @@ -501,7 +501,7 @@ static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg,
80929 * tomoyo_security_ops is a "struct security_operations" which is used for
80930 * registering TOMOYO.
80931 */
80932 -static struct security_operations tomoyo_security_ops = {
80933 +static struct security_operations tomoyo_security_ops __read_only = {
80934 .name = "tomoyo",
80935 .cred_alloc_blank = tomoyo_cred_alloc_blank,
80936 .cred_prepare = tomoyo_cred_prepare,
80937 diff --git a/security/yama/Kconfig b/security/yama/Kconfig
80938 index 51d6709..1f3dbe2 100644
80939 --- a/security/yama/Kconfig
80940 +++ b/security/yama/Kconfig
80941 @@ -1,6 +1,6 @@
80942 config SECURITY_YAMA
80943 bool "Yama support"
80944 - depends on SECURITY
80945 + depends on SECURITY && !GRKERNSEC
80946 select SECURITYFS
80947 select SECURITY_PATH
80948 default n
80949 diff --git a/sound/aoa/codecs/onyx.c b/sound/aoa/codecs/onyx.c
80950 index 270790d..c67dfcb 100644
80951 --- a/sound/aoa/codecs/onyx.c
80952 +++ b/sound/aoa/codecs/onyx.c
80953 @@ -54,7 +54,7 @@ struct onyx {
80954 spdif_locked:1,
80955 analog_locked:1,
80956 original_mute:2;
80957 - int open_count;
80958 + local_t open_count;
80959 struct codec_info *codec_info;
80960
80961 /* mutex serializes concurrent access to the device
80962 @@ -753,7 +753,7 @@ static int onyx_open(struct codec_info_item *cii,
80963 struct onyx *onyx = cii->codec_data;
80964
80965 mutex_lock(&onyx->mutex);
80966 - onyx->open_count++;
80967 + local_inc(&onyx->open_count);
80968 mutex_unlock(&onyx->mutex);
80969
80970 return 0;
80971 @@ -765,8 +765,7 @@ static int onyx_close(struct codec_info_item *cii,
80972 struct onyx *onyx = cii->codec_data;
80973
80974 mutex_lock(&onyx->mutex);
80975 - onyx->open_count--;
80976 - if (!onyx->open_count)
80977 + if (local_dec_and_test(&onyx->open_count))
80978 onyx->spdif_locked = onyx->analog_locked = 0;
80979 mutex_unlock(&onyx->mutex);
80980
80981 diff --git a/sound/aoa/codecs/onyx.h b/sound/aoa/codecs/onyx.h
80982 index ffd2025..df062c9 100644
80983 --- a/sound/aoa/codecs/onyx.h
80984 +++ b/sound/aoa/codecs/onyx.h
80985 @@ -11,6 +11,7 @@
80986 #include <linux/i2c.h>
80987 #include <asm/pmac_low_i2c.h>
80988 #include <asm/prom.h>
80989 +#include <asm/local.h>
80990
80991 /* PCM3052 register definitions */
80992
80993 diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
80994 index 08fde00..0bf641a 100644
80995 --- a/sound/core/oss/pcm_oss.c
80996 +++ b/sound/core/oss/pcm_oss.c
80997 @@ -1189,10 +1189,10 @@ snd_pcm_sframes_t snd_pcm_oss_write3(struct snd_pcm_substream *substream, const
80998 if (in_kernel) {
80999 mm_segment_t fs;
81000 fs = snd_enter_user();
81001 - ret = snd_pcm_lib_write(substream, (void __force __user *)ptr, frames);
81002 + ret = snd_pcm_lib_write(substream, (void __force_user *)ptr, frames);
81003 snd_leave_user(fs);
81004 } else {
81005 - ret = snd_pcm_lib_write(substream, (void __force __user *)ptr, frames);
81006 + ret = snd_pcm_lib_write(substream, (void __force_user *)ptr, frames);
81007 }
81008 if (ret != -EPIPE && ret != -ESTRPIPE)
81009 break;
81010 @@ -1234,10 +1234,10 @@ snd_pcm_sframes_t snd_pcm_oss_read3(struct snd_pcm_substream *substream, char *p
81011 if (in_kernel) {
81012 mm_segment_t fs;
81013 fs = snd_enter_user();
81014 - ret = snd_pcm_lib_read(substream, (void __force __user *)ptr, frames);
81015 + ret = snd_pcm_lib_read(substream, (void __force_user *)ptr, frames);
81016 snd_leave_user(fs);
81017 } else {
81018 - ret = snd_pcm_lib_read(substream, (void __force __user *)ptr, frames);
81019 + ret = snd_pcm_lib_read(substream, (void __force_user *)ptr, frames);
81020 }
81021 if (ret == -EPIPE) {
81022 if (runtime->status->state == SNDRV_PCM_STATE_DRAINING) {
81023 @@ -1337,7 +1337,7 @@ static ssize_t snd_pcm_oss_write2(struct snd_pcm_substream *substream, const cha
81024 struct snd_pcm_plugin_channel *channels;
81025 size_t oss_frame_bytes = (runtime->oss.plugin_first->src_width * runtime->oss.plugin_first->src_format.channels) / 8;
81026 if (!in_kernel) {
81027 - if (copy_from_user(runtime->oss.buffer, (const char __force __user *)buf, bytes))
81028 + if (copy_from_user(runtime->oss.buffer, (const char __force_user *)buf, bytes))
81029 return -EFAULT;
81030 buf = runtime->oss.buffer;
81031 }
81032 @@ -1407,7 +1407,7 @@ static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const cha
81033 }
81034 } else {
81035 tmp = snd_pcm_oss_write2(substream,
81036 - (const char __force *)buf,
81037 + (const char __force_kernel *)buf,
81038 runtime->oss.period_bytes, 0);
81039 if (tmp <= 0)
81040 goto err;
81041 @@ -1433,7 +1433,7 @@ static ssize_t snd_pcm_oss_read2(struct snd_pcm_substream *substream, char *buf,
81042 struct snd_pcm_runtime *runtime = substream->runtime;
81043 snd_pcm_sframes_t frames, frames1;
81044 #ifdef CONFIG_SND_PCM_OSS_PLUGINS
81045 - char __user *final_dst = (char __force __user *)buf;
81046 + char __user *final_dst = (char __force_user *)buf;
81047 if (runtime->oss.plugin_first) {
81048 struct snd_pcm_plugin_channel *channels;
81049 size_t oss_frame_bytes = (runtime->oss.plugin_last->dst_width * runtime->oss.plugin_last->dst_format.channels) / 8;
81050 @@ -1495,7 +1495,7 @@ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __use
81051 xfer += tmp;
81052 runtime->oss.buffer_used -= tmp;
81053 } else {
81054 - tmp = snd_pcm_oss_read2(substream, (char __force *)buf,
81055 + tmp = snd_pcm_oss_read2(substream, (char __force_kernel *)buf,
81056 runtime->oss.period_bytes, 0);
81057 if (tmp <= 0)
81058 goto err;
81059 @@ -1663,7 +1663,7 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file)
81060 size1);
81061 size1 /= runtime->channels; /* frames */
81062 fs = snd_enter_user();
81063 - snd_pcm_lib_write(substream, (void __force __user *)runtime->oss.buffer, size1);
81064 + snd_pcm_lib_write(substream, (void __force_user *)runtime->oss.buffer, size1);
81065 snd_leave_user(fs);
81066 }
81067 } else if (runtime->access == SNDRV_PCM_ACCESS_RW_NONINTERLEAVED) {
81068 diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
81069 index 91cdf94..4085161 100644
81070 --- a/sound/core/pcm_compat.c
81071 +++ b/sound/core/pcm_compat.c
81072 @@ -31,7 +31,7 @@ static int snd_pcm_ioctl_delay_compat(struct snd_pcm_substream *substream,
81073 int err;
81074
81075 fs = snd_enter_user();
81076 - err = snd_pcm_delay(substream, &delay);
81077 + err = snd_pcm_delay(substream, (snd_pcm_sframes_t __force_user *)&delay);
81078 snd_leave_user(fs);
81079 if (err < 0)
81080 return err;
81081 diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
81082 index 53b5ada..2db94c8 100644
81083 --- a/sound/core/pcm_native.c
81084 +++ b/sound/core/pcm_native.c
81085 @@ -2780,11 +2780,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream,
81086 switch (substream->stream) {
81087 case SNDRV_PCM_STREAM_PLAYBACK:
81088 result = snd_pcm_playback_ioctl1(NULL, substream, cmd,
81089 - (void __user *)arg);
81090 + (void __force_user *)arg);
81091 break;
81092 case SNDRV_PCM_STREAM_CAPTURE:
81093 result = snd_pcm_capture_ioctl1(NULL, substream, cmd,
81094 - (void __user *)arg);
81095 + (void __force_user *)arg);
81096 break;
81097 default:
81098 result = -EINVAL;
81099 diff --git a/sound/core/seq/seq_device.c b/sound/core/seq/seq_device.c
81100 index 5cf8d65..912a79c 100644
81101 --- a/sound/core/seq/seq_device.c
81102 +++ b/sound/core/seq/seq_device.c
81103 @@ -64,7 +64,7 @@ struct ops_list {
81104 int argsize; /* argument size */
81105
81106 /* operators */
81107 - struct snd_seq_dev_ops ops;
81108 + struct snd_seq_dev_ops *ops;
81109
81110 /* registred devices */
81111 struct list_head dev_list; /* list of devices */
81112 @@ -333,7 +333,7 @@ int snd_seq_device_register_driver(char *id, struct snd_seq_dev_ops *entry,
81113
81114 mutex_lock(&ops->reg_mutex);
81115 /* copy driver operators */
81116 - ops->ops = *entry;
81117 + ops->ops = entry;
81118 ops->driver |= DRIVER_LOADED;
81119 ops->argsize = argsize;
81120
81121 @@ -463,7 +463,7 @@ static int init_device(struct snd_seq_device *dev, struct ops_list *ops)
81122 dev->name, ops->id, ops->argsize, dev->argsize);
81123 return -EINVAL;
81124 }
81125 - if (ops->ops.init_device(dev) >= 0) {
81126 + if (ops->ops->init_device(dev) >= 0) {
81127 dev->status = SNDRV_SEQ_DEVICE_REGISTERED;
81128 ops->num_init_devices++;
81129 } else {
81130 @@ -490,7 +490,7 @@ static int free_device(struct snd_seq_device *dev, struct ops_list *ops)
81131 dev->name, ops->id, ops->argsize, dev->argsize);
81132 return -EINVAL;
81133 }
81134 - if ((result = ops->ops.free_device(dev)) >= 0 || result == -ENXIO) {
81135 + if ((result = ops->ops->free_device(dev)) >= 0 || result == -ENXIO) {
81136 dev->status = SNDRV_SEQ_DEVICE_FREE;
81137 dev->driver_data = NULL;
81138 ops->num_init_devices--;
81139 diff --git a/sound/drivers/mts64.c b/sound/drivers/mts64.c
81140 index 621e60e..f4543f5 100644
81141 --- a/sound/drivers/mts64.c
81142 +++ b/sound/drivers/mts64.c
81143 @@ -29,6 +29,7 @@
81144 #include <sound/initval.h>
81145 #include <sound/rawmidi.h>
81146 #include <sound/control.h>
81147 +#include <asm/local.h>
81148
81149 #define CARD_NAME "Miditerminal 4140"
81150 #define DRIVER_NAME "MTS64"
81151 @@ -67,7 +68,7 @@ struct mts64 {
81152 struct pardevice *pardev;
81153 int pardev_claimed;
81154
81155 - int open_count;
81156 + local_t open_count;
81157 int current_midi_output_port;
81158 int current_midi_input_port;
81159 u8 mode[MTS64_NUM_INPUT_PORTS];
81160 @@ -697,7 +698,7 @@ static int snd_mts64_rawmidi_open(struct snd_rawmidi_substream *substream)
81161 {
81162 struct mts64 *mts = substream->rmidi->private_data;
81163
81164 - if (mts->open_count == 0) {
81165 + if (local_read(&mts->open_count) == 0) {
81166 /* We don't need a spinlock here, because this is just called
81167 if the device has not been opened before.
81168 So there aren't any IRQs from the device */
81169 @@ -705,7 +706,7 @@ static int snd_mts64_rawmidi_open(struct snd_rawmidi_substream *substream)
81170
81171 msleep(50);
81172 }
81173 - ++(mts->open_count);
81174 + local_inc(&mts->open_count);
81175
81176 return 0;
81177 }
81178 @@ -715,8 +716,7 @@ static int snd_mts64_rawmidi_close(struct snd_rawmidi_substream *substream)
81179 struct mts64 *mts = substream->rmidi->private_data;
81180 unsigned long flags;
81181
81182 - --(mts->open_count);
81183 - if (mts->open_count == 0) {
81184 + if (local_dec_return(&mts->open_count) == 0) {
81185 /* We need the spinlock_irqsave here because we can still
81186 have IRQs at this point */
81187 spin_lock_irqsave(&mts->lock, flags);
81188 @@ -725,8 +725,8 @@ static int snd_mts64_rawmidi_close(struct snd_rawmidi_substream *substream)
81189
81190 msleep(500);
81191
81192 - } else if (mts->open_count < 0)
81193 - mts->open_count = 0;
81194 + } else if (local_read(&mts->open_count) < 0)
81195 + local_set(&mts->open_count, 0);
81196
81197 return 0;
81198 }
81199 diff --git a/sound/drivers/opl4/opl4_lib.c b/sound/drivers/opl4/opl4_lib.c
81200 index b953fb4..1999c01 100644
81201 --- a/sound/drivers/opl4/opl4_lib.c
81202 +++ b/sound/drivers/opl4/opl4_lib.c
81203 @@ -29,7 +29,7 @@ MODULE_AUTHOR("Clemens Ladisch <clemens@ladisch.de>");
81204 MODULE_DESCRIPTION("OPL4 driver");
81205 MODULE_LICENSE("GPL");
81206
81207 -static void inline snd_opl4_wait(struct snd_opl4 *opl4)
81208 +static inline void snd_opl4_wait(struct snd_opl4 *opl4)
81209 {
81210 int timeout = 10;
81211 while ((inb(opl4->fm_port) & OPL4_STATUS_BUSY) && --timeout > 0)
81212 diff --git a/sound/drivers/portman2x4.c b/sound/drivers/portman2x4.c
81213 index 3e32bd3..46fc152 100644
81214 --- a/sound/drivers/portman2x4.c
81215 +++ b/sound/drivers/portman2x4.c
81216 @@ -48,6 +48,7 @@
81217 #include <sound/initval.h>
81218 #include <sound/rawmidi.h>
81219 #include <sound/control.h>
81220 +#include <asm/local.h>
81221
81222 #define CARD_NAME "Portman 2x4"
81223 #define DRIVER_NAME "portman"
81224 @@ -85,7 +86,7 @@ struct portman {
81225 struct pardevice *pardev;
81226 int pardev_claimed;
81227
81228 - int open_count;
81229 + local_t open_count;
81230 int mode[PORTMAN_NUM_INPUT_PORTS];
81231 struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
81232 };
81233 diff --git a/sound/firewire/amdtp.c b/sound/firewire/amdtp.c
81234 index ea995af..f1bfa37 100644
81235 --- a/sound/firewire/amdtp.c
81236 +++ b/sound/firewire/amdtp.c
81237 @@ -389,7 +389,7 @@ static void queue_out_packet(struct amdtp_out_stream *s, unsigned int cycle)
81238 ptr = s->pcm_buffer_pointer + data_blocks;
81239 if (ptr >= pcm->runtime->buffer_size)
81240 ptr -= pcm->runtime->buffer_size;
81241 - ACCESS_ONCE(s->pcm_buffer_pointer) = ptr;
81242 + ACCESS_ONCE_RW(s->pcm_buffer_pointer) = ptr;
81243
81244 s->pcm_period_pointer += data_blocks;
81245 if (s->pcm_period_pointer >= pcm->runtime->period_size) {
81246 @@ -557,7 +557,7 @@ EXPORT_SYMBOL(amdtp_out_stream_pcm_pointer);
81247 */
81248 void amdtp_out_stream_update(struct amdtp_out_stream *s)
81249 {
81250 - ACCESS_ONCE(s->source_node_id_field) =
81251 + ACCESS_ONCE_RW(s->source_node_id_field) =
81252 (fw_parent_device(s->unit)->card->node_id & 0x3f) << 24;
81253 }
81254 EXPORT_SYMBOL(amdtp_out_stream_update);
81255 diff --git a/sound/firewire/amdtp.h b/sound/firewire/amdtp.h
81256 index b680c5e..061b7a0 100644
81257 --- a/sound/firewire/amdtp.h
81258 +++ b/sound/firewire/amdtp.h
81259 @@ -139,7 +139,7 @@ static inline bool amdtp_out_streaming_error(struct amdtp_out_stream *s)
81260 static inline void amdtp_out_stream_pcm_trigger(struct amdtp_out_stream *s,
81261 struct snd_pcm_substream *pcm)
81262 {
81263 - ACCESS_ONCE(s->pcm) = pcm;
81264 + ACCESS_ONCE_RW(s->pcm) = pcm;
81265 }
81266
81267 static inline bool cip_sfc_is_base_44100(enum cip_sfc sfc)
81268 diff --git a/sound/firewire/isight.c b/sound/firewire/isight.c
81269 index d428ffe..751ef78 100644
81270 --- a/sound/firewire/isight.c
81271 +++ b/sound/firewire/isight.c
81272 @@ -96,7 +96,7 @@ static void isight_update_pointers(struct isight *isight, unsigned int count)
81273 ptr += count;
81274 if (ptr >= runtime->buffer_size)
81275 ptr -= runtime->buffer_size;
81276 - ACCESS_ONCE(isight->buffer_pointer) = ptr;
81277 + ACCESS_ONCE_RW(isight->buffer_pointer) = ptr;
81278
81279 isight->period_counter += count;
81280 if (isight->period_counter >= runtime->period_size) {
81281 @@ -307,7 +307,7 @@ static int isight_hw_params(struct snd_pcm_substream *substream,
81282 if (err < 0)
81283 return err;
81284
81285 - ACCESS_ONCE(isight->pcm_active) = true;
81286 + ACCESS_ONCE_RW(isight->pcm_active) = true;
81287
81288 return 0;
81289 }
81290 @@ -340,7 +340,7 @@ static int isight_hw_free(struct snd_pcm_substream *substream)
81291 {
81292 struct isight *isight = substream->private_data;
81293
81294 - ACCESS_ONCE(isight->pcm_active) = false;
81295 + ACCESS_ONCE_RW(isight->pcm_active) = false;
81296
81297 mutex_lock(&isight->mutex);
81298 isight_stop_streaming(isight);
81299 @@ -433,10 +433,10 @@ static int isight_trigger(struct snd_pcm_substream *substream, int cmd)
81300
81301 switch (cmd) {
81302 case SNDRV_PCM_TRIGGER_START:
81303 - ACCESS_ONCE(isight->pcm_running) = true;
81304 + ACCESS_ONCE_RW(isight->pcm_running) = true;
81305 break;
81306 case SNDRV_PCM_TRIGGER_STOP:
81307 - ACCESS_ONCE(isight->pcm_running) = false;
81308 + ACCESS_ONCE_RW(isight->pcm_running) = false;
81309 break;
81310 default:
81311 return -EINVAL;
81312 diff --git a/sound/isa/cmi8330.c b/sound/isa/cmi8330.c
81313 index 7bd5e33..1fcab12 100644
81314 --- a/sound/isa/cmi8330.c
81315 +++ b/sound/isa/cmi8330.c
81316 @@ -172,7 +172,7 @@ struct snd_cmi8330 {
81317
81318 struct snd_pcm *pcm;
81319 struct snd_cmi8330_stream {
81320 - struct snd_pcm_ops ops;
81321 + snd_pcm_ops_no_const ops;
81322 snd_pcm_open_callback_t open;
81323 void *private_data; /* sb or wss */
81324 } streams[2];
81325 diff --git a/sound/oss/sb_audio.c b/sound/oss/sb_audio.c
81326 index 733b014..56ce96f 100644
81327 --- a/sound/oss/sb_audio.c
81328 +++ b/sound/oss/sb_audio.c
81329 @@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
81330 buf16 = (signed short *)(localbuf + localoffs);
81331 while (c)
81332 {
81333 - locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
81334 + locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
81335 if (copy_from_user(lbuf8,
81336 userbuf+useroffs + p,
81337 locallen))
81338 diff --git a/sound/oss/swarm_cs4297a.c b/sound/oss/swarm_cs4297a.c
81339 index 09d4648..cf234c7 100644
81340 --- a/sound/oss/swarm_cs4297a.c
81341 +++ b/sound/oss/swarm_cs4297a.c
81342 @@ -2606,7 +2606,6 @@ static int __init cs4297a_init(void)
81343 {
81344 struct cs4297a_state *s;
81345 u32 pwr, id;
81346 - mm_segment_t fs;
81347 int rval;
81348 #ifndef CONFIG_BCM_CS4297A_CSWARM
81349 u64 cfg;
81350 @@ -2696,22 +2695,23 @@ static int __init cs4297a_init(void)
81351 if (!rval) {
81352 char *sb1250_duart_present;
81353
81354 +#if 0
81355 + mm_segment_t fs;
81356 fs = get_fs();
81357 set_fs(KERNEL_DS);
81358 -#if 0
81359 val = SOUND_MASK_LINE;
81360 mixer_ioctl(s, SOUND_MIXER_WRITE_RECSRC, (unsigned long) &val);
81361 for (i = 0; i < ARRAY_SIZE(initvol); i++) {
81362 val = initvol[i].vol;
81363 mixer_ioctl(s, initvol[i].mixch, (unsigned long) &val);
81364 }
81365 + set_fs(fs);
81366 // cs4297a_write_ac97(s, 0x18, 0x0808);
81367 #else
81368 // cs4297a_write_ac97(s, 0x5e, 0x180);
81369 cs4297a_write_ac97(s, 0x02, 0x0808);
81370 cs4297a_write_ac97(s, 0x18, 0x0808);
81371 #endif
81372 - set_fs(fs);
81373
81374 list_add(&s->list, &cs4297a_devs);
81375
81376 diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
81377 index 2fdaadb..7df8fc6 100644
81378 --- a/sound/pci/hda/hda_codec.h
81379 +++ b/sound/pci/hda/hda_codec.h
81380 @@ -611,7 +611,7 @@ struct hda_bus_ops {
81381 /* notify power-up/down from codec to controller */
81382 void (*pm_notify)(struct hda_bus *bus);
81383 #endif
81384 -};
81385 +} __no_const;
81386
81387 /* template to pass to the bus constructor */
81388 struct hda_bus_template {
81389 @@ -711,6 +711,7 @@ struct hda_codec_ops {
81390 #endif
81391 void (*reboot_notify)(struct hda_codec *codec);
81392 };
81393 +typedef struct hda_codec_ops __no_const hda_codec_ops_no_const;
81394
81395 /* record for amp information cache */
81396 struct hda_cache_head {
81397 @@ -741,7 +742,7 @@ struct hda_pcm_ops {
81398 struct snd_pcm_substream *substream);
81399 int (*cleanup)(struct hda_pcm_stream *info, struct hda_codec *codec,
81400 struct snd_pcm_substream *substream);
81401 -};
81402 +} __no_const;
81403
81404 /* PCM information for each substream */
81405 struct hda_pcm_stream {
81406 @@ -799,7 +800,7 @@ struct hda_codec {
81407 const char *modelname; /* model name for preset */
81408
81409 /* set by patch */
81410 - struct hda_codec_ops patch_ops;
81411 + hda_codec_ops_no_const patch_ops;
81412
81413 /* PCM to create, set by patch_ops.build_pcms callback */
81414 unsigned int num_pcms;
81415 diff --git a/sound/pci/ice1712/ice1712.h b/sound/pci/ice1712/ice1712.h
81416 index 0da778a..bc38b84 100644
81417 --- a/sound/pci/ice1712/ice1712.h
81418 +++ b/sound/pci/ice1712/ice1712.h
81419 @@ -269,7 +269,7 @@ struct snd_ak4xxx_private {
81420 unsigned int mask_flags; /* total mask bits */
81421 struct snd_akm4xxx_ops {
81422 void (*set_rate_val)(struct snd_akm4xxx *ak, unsigned int rate);
81423 - } ops;
81424 + } __no_const ops;
81425 };
81426
81427 struct snd_ice1712_spdif {
81428 @@ -285,7 +285,7 @@ struct snd_ice1712_spdif {
81429 int (*default_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
81430 void (*stream_get)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
81431 int (*stream_put)(struct snd_ice1712 *, struct snd_ctl_elem_value *ucontrol);
81432 - } ops;
81433 + } __no_const ops;
81434 };
81435
81436
81437 diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
81438 index a8159b81..5f006a5 100644
81439 --- a/sound/pci/ymfpci/ymfpci_main.c
81440 +++ b/sound/pci/ymfpci/ymfpci_main.c
81441 @@ -203,8 +203,8 @@ static void snd_ymfpci_hw_stop(struct snd_ymfpci *chip)
81442 if ((snd_ymfpci_readl(chip, YDSXGR_STATUS) & 2) == 0)
81443 break;
81444 }
81445 - if (atomic_read(&chip->interrupt_sleep_count)) {
81446 - atomic_set(&chip->interrupt_sleep_count, 0);
81447 + if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
81448 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
81449 wake_up(&chip->interrupt_sleep);
81450 }
81451 __end:
81452 @@ -788,7 +788,7 @@ static void snd_ymfpci_irq_wait(struct snd_ymfpci *chip)
81453 continue;
81454 init_waitqueue_entry(&wait, current);
81455 add_wait_queue(&chip->interrupt_sleep, &wait);
81456 - atomic_inc(&chip->interrupt_sleep_count);
81457 + atomic_inc_unchecked(&chip->interrupt_sleep_count);
81458 schedule_timeout_uninterruptible(msecs_to_jiffies(50));
81459 remove_wait_queue(&chip->interrupt_sleep, &wait);
81460 }
81461 @@ -826,8 +826,8 @@ static irqreturn_t snd_ymfpci_interrupt(int irq, void *dev_id)
81462 snd_ymfpci_writel(chip, YDSXGR_MODE, mode);
81463 spin_unlock(&chip->reg_lock);
81464
81465 - if (atomic_read(&chip->interrupt_sleep_count)) {
81466 - atomic_set(&chip->interrupt_sleep_count, 0);
81467 + if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
81468 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
81469 wake_up(&chip->interrupt_sleep);
81470 }
81471 }
81472 @@ -2398,7 +2398,7 @@ int __devinit snd_ymfpci_create(struct snd_card *card,
81473 spin_lock_init(&chip->reg_lock);
81474 spin_lock_init(&chip->voice_lock);
81475 init_waitqueue_head(&chip->interrupt_sleep);
81476 - atomic_set(&chip->interrupt_sleep_count, 0);
81477 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
81478 chip->card = card;
81479 chip->pci = pci;
81480 chip->irq = -1;
81481 diff --git a/tools/gcc/.gitignore b/tools/gcc/.gitignore
81482 new file mode 100644
81483 index 0000000..50f2f2f
81484 --- /dev/null
81485 +++ b/tools/gcc/.gitignore
81486 @@ -0,0 +1 @@
81487 +size_overflow_hash.h
81488 diff --git a/tools/gcc/Makefile b/tools/gcc/Makefile
81489 new file mode 100644
81490 index 0000000..1d09b7e
81491 --- /dev/null
81492 +++ b/tools/gcc/Makefile
81493 @@ -0,0 +1,43 @@
81494 +#CC := gcc
81495 +#PLUGIN_SOURCE_FILES := pax_plugin.c
81496 +#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES))
81497 +GCCPLUGINS_DIR := $(shell $(CC) -print-file-name=plugin)
81498 +#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W -std=gnu99
81499 +
81500 +ifeq ($(PLUGINCC),$(HOSTCC))
81501 +HOSTLIBS := hostlibs
81502 +HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include -I$(GCCPLUGINS_DIR)/include/c-family -std=gnu99 -ggdb
81503 +else
81504 +HOSTLIBS := hostcxxlibs
81505 +HOST_EXTRACXXFLAGS += -I$(GCCPLUGINS_DIR)/include -I$(GCCPLUGINS_DIR)/include/c-family -std=gnu++98 -ggdb -Wno-unused-parameter
81506 +endif
81507 +
81508 +$(HOSTLIBS)-y := constify_plugin.so
81509 +$(HOSTLIBS)-$(CONFIG_PAX_MEMORY_STACKLEAK) += stackleak_plugin.so
81510 +$(HOSTLIBS)-$(CONFIG_KALLOCSTAT_PLUGIN) += kallocstat_plugin.so
81511 +$(HOSTLIBS)-$(CONFIG_PAX_KERNEXEC_PLUGIN) += kernexec_plugin.so
81512 +$(HOSTLIBS)-$(CONFIG_CHECKER_PLUGIN) += checker_plugin.so
81513 +$(HOSTLIBS)-y += colorize_plugin.so
81514 +$(HOSTLIBS)-$(CONFIG_PAX_SIZE_OVERFLOW) += size_overflow_plugin.so
81515 +$(HOSTLIBS)-$(CONFIG_PAX_LATENT_ENTROPY) += latent_entropy_plugin.so
81516 +
81517 +always := $($(HOSTLIBS)-y)
81518 +
81519 +constify_plugin-objs := constify_plugin.o
81520 +stackleak_plugin-objs := stackleak_plugin.o
81521 +kallocstat_plugin-objs := kallocstat_plugin.o
81522 +kernexec_plugin-objs := kernexec_plugin.o
81523 +checker_plugin-objs := checker_plugin.o
81524 +colorize_plugin-objs := colorize_plugin.o
81525 +size_overflow_plugin-objs := size_overflow_plugin.o
81526 +latent_entropy_plugin-objs := latent_entropy_plugin.o
81527 +
81528 +$(obj)/size_overflow_plugin.o: $(objtree)/$(obj)/size_overflow_hash.h
81529 +
81530 +quiet_cmd_build_size_overflow_hash = GENHASH $@
81531 + cmd_build_size_overflow_hash = \
81532 + $(CONFIG_SHELL) $(srctree)/$(src)/generate_size_overflow_hash.sh -d $< -o $@
81533 +$(objtree)/$(obj)/size_overflow_hash.h: $(src)/size_overflow_hash.data FORCE
81534 + $(call if_changed,build_size_overflow_hash)
81535 +
81536 +targets += size_overflow_hash.h
81537 diff --git a/tools/gcc/checker_plugin.c b/tools/gcc/checker_plugin.c
81538 new file mode 100644
81539 index 0000000..d41b5af
81540 --- /dev/null
81541 +++ b/tools/gcc/checker_plugin.c
81542 @@ -0,0 +1,171 @@
81543 +/*
81544 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
81545 + * Licensed under the GPL v2
81546 + *
81547 + * Note: the choice of the license means that the compilation process is
81548 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
81549 + * but for the kernel it doesn't matter since it doesn't link against
81550 + * any of the gcc libraries
81551 + *
81552 + * gcc plugin to implement various sparse (source code checker) features
81553 + *
81554 + * TODO:
81555 + * - define separate __iomem, __percpu and __rcu address spaces (lots of code to patch)
81556 + *
81557 + * BUGS:
81558 + * - none known
81559 + */
81560 +#include "gcc-plugin.h"
81561 +#include "config.h"
81562 +#include "system.h"
81563 +#include "coretypes.h"
81564 +#include "tree.h"
81565 +#include "tree-pass.h"
81566 +#include "flags.h"
81567 +#include "intl.h"
81568 +#include "toplev.h"
81569 +#include "plugin.h"
81570 +//#include "expr.h" where are you...
81571 +#include "diagnostic.h"
81572 +#include "plugin-version.h"
81573 +#include "tm.h"
81574 +#include "function.h"
81575 +#include "basic-block.h"
81576 +#include "gimple.h"
81577 +#include "rtl.h"
81578 +#include "emit-rtl.h"
81579 +#include "tree-flow.h"
81580 +#include "target.h"
81581 +
81582 +extern void c_register_addr_space (const char *str, addr_space_t as);
81583 +extern enum machine_mode default_addr_space_pointer_mode (addr_space_t);
81584 +extern enum machine_mode default_addr_space_address_mode (addr_space_t);
81585 +extern bool default_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as);
81586 +extern bool default_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as);
81587 +extern rtx default_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as);
81588 +
81589 +extern void print_gimple_stmt(FILE *, gimple, int, int);
81590 +extern rtx emit_move_insn(rtx x, rtx y);
81591 +
81592 +int plugin_is_GPL_compatible;
81593 +
81594 +static struct plugin_info checker_plugin_info = {
81595 + .version = "201111150100",
81596 +};
81597 +
81598 +#define ADDR_SPACE_KERNEL 0
81599 +#define ADDR_SPACE_FORCE_KERNEL 1
81600 +#define ADDR_SPACE_USER 2
81601 +#define ADDR_SPACE_FORCE_USER 3
81602 +#define ADDR_SPACE_IOMEM 0
81603 +#define ADDR_SPACE_FORCE_IOMEM 0
81604 +#define ADDR_SPACE_PERCPU 0
81605 +#define ADDR_SPACE_FORCE_PERCPU 0
81606 +#define ADDR_SPACE_RCU 0
81607 +#define ADDR_SPACE_FORCE_RCU 0
81608 +
81609 +static enum machine_mode checker_addr_space_pointer_mode(addr_space_t addrspace)
81610 +{
81611 + return default_addr_space_pointer_mode(ADDR_SPACE_GENERIC);
81612 +}
81613 +
81614 +static enum machine_mode checker_addr_space_address_mode(addr_space_t addrspace)
81615 +{
81616 + return default_addr_space_address_mode(ADDR_SPACE_GENERIC);
81617 +}
81618 +
81619 +static bool checker_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as)
81620 +{
81621 + return default_addr_space_valid_pointer_mode(mode, as);
81622 +}
81623 +
81624 +static bool checker_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as)
81625 +{
81626 + return default_addr_space_legitimate_address_p(mode, mem, strict, ADDR_SPACE_GENERIC);
81627 +}
81628 +
81629 +static rtx checker_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as)
81630 +{
81631 + return default_addr_space_legitimize_address(x, oldx, mode, as);
81632 +}
81633 +
81634 +static bool checker_addr_space_subset_p(addr_space_t subset, addr_space_t superset)
81635 +{
81636 + if (subset == ADDR_SPACE_FORCE_KERNEL && superset == ADDR_SPACE_KERNEL)
81637 + return true;
81638 +
81639 + if (subset == ADDR_SPACE_FORCE_USER && superset == ADDR_SPACE_USER)
81640 + return true;
81641 +
81642 + if (subset == ADDR_SPACE_FORCE_IOMEM && superset == ADDR_SPACE_IOMEM)
81643 + return true;
81644 +
81645 + if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_USER)
81646 + return true;
81647 +
81648 + if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_IOMEM)
81649 + return true;
81650 +
81651 + if (subset == ADDR_SPACE_USER && superset == ADDR_SPACE_FORCE_KERNEL)
81652 + return true;
81653 +
81654 + if (subset == ADDR_SPACE_IOMEM && superset == ADDR_SPACE_FORCE_KERNEL)
81655 + return true;
81656 +
81657 + return subset == superset;
81658 +}
81659 +
81660 +static rtx checker_addr_space_convert(rtx op, tree from_type, tree to_type)
81661 +{
81662 +// addr_space_t from_as = TYPE_ADDR_SPACE(TREE_TYPE(from_type));
81663 +// addr_space_t to_as = TYPE_ADDR_SPACE(TREE_TYPE(to_type));
81664 +
81665 + return op;
81666 +}
81667 +
81668 +static void register_checker_address_spaces(void *event_data, void *data)
81669 +{
81670 + c_register_addr_space("__kernel", ADDR_SPACE_KERNEL);
81671 + c_register_addr_space("__force_kernel", ADDR_SPACE_FORCE_KERNEL);
81672 + c_register_addr_space("__user", ADDR_SPACE_USER);
81673 + c_register_addr_space("__force_user", ADDR_SPACE_FORCE_USER);
81674 +// c_register_addr_space("__iomem", ADDR_SPACE_IOMEM);
81675 +// c_register_addr_space("__force_iomem", ADDR_SPACE_FORCE_IOMEM);
81676 +// c_register_addr_space("__percpu", ADDR_SPACE_PERCPU);
81677 +// c_register_addr_space("__force_percpu", ADDR_SPACE_FORCE_PERCPU);
81678 +// c_register_addr_space("__rcu", ADDR_SPACE_RCU);
81679 +// c_register_addr_space("__force_rcu", ADDR_SPACE_FORCE_RCU);
81680 +
81681 + targetm.addr_space.pointer_mode = checker_addr_space_pointer_mode;
81682 + targetm.addr_space.address_mode = checker_addr_space_address_mode;
81683 + targetm.addr_space.valid_pointer_mode = checker_addr_space_valid_pointer_mode;
81684 + targetm.addr_space.legitimate_address_p = checker_addr_space_legitimate_address_p;
81685 +// targetm.addr_space.legitimize_address = checker_addr_space_legitimize_address;
81686 + targetm.addr_space.subset_p = checker_addr_space_subset_p;
81687 + targetm.addr_space.convert = checker_addr_space_convert;
81688 +}
81689 +
81690 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
81691 +{
81692 + const char * const plugin_name = plugin_info->base_name;
81693 + const int argc = plugin_info->argc;
81694 + const struct plugin_argument * const argv = plugin_info->argv;
81695 + int i;
81696 +
81697 + if (!plugin_default_version_check(version, &gcc_version)) {
81698 + error(G_("incompatible gcc/plugin versions"));
81699 + return 1;
81700 + }
81701 +
81702 + register_callback(plugin_name, PLUGIN_INFO, NULL, &checker_plugin_info);
81703 +
81704 + for (i = 0; i < argc; ++i)
81705 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
81706 +
81707 + if (TARGET_64BIT == 0)
81708 + return 0;
81709 +
81710 + register_callback(plugin_name, PLUGIN_PRAGMAS, register_checker_address_spaces, NULL);
81711 +
81712 + return 0;
81713 +}
81714 diff --git a/tools/gcc/colorize_plugin.c b/tools/gcc/colorize_plugin.c
81715 new file mode 100644
81716 index 0000000..846aeb0
81717 --- /dev/null
81718 +++ b/tools/gcc/colorize_plugin.c
81719 @@ -0,0 +1,148 @@
81720 +/*
81721 + * Copyright 2012 by PaX Team <pageexec@freemail.hu>
81722 + * Licensed under the GPL v2
81723 + *
81724 + * Note: the choice of the license means that the compilation process is
81725 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
81726 + * but for the kernel it doesn't matter since it doesn't link against
81727 + * any of the gcc libraries
81728 + *
81729 + * gcc plugin to colorize diagnostic output
81730 + *
81731 + */
81732 +
81733 +#include "gcc-plugin.h"
81734 +#include "config.h"
81735 +#include "system.h"
81736 +#include "coretypes.h"
81737 +#include "tree.h"
81738 +#include "tree-pass.h"
81739 +#include "flags.h"
81740 +#include "intl.h"
81741 +#include "toplev.h"
81742 +#include "plugin.h"
81743 +#include "diagnostic.h"
81744 +#include "plugin-version.h"
81745 +#include "tm.h"
81746 +
81747 +int plugin_is_GPL_compatible;
81748 +
81749 +static struct plugin_info colorize_plugin_info = {
81750 + .version = "201203092200",
81751 + .help = NULL,
81752 +};
81753 +
81754 +#define GREEN "\033[32m\033[2m"
81755 +#define LIGHTGREEN "\033[32m\033[1m"
81756 +#define YELLOW "\033[33m\033[2m"
81757 +#define LIGHTYELLOW "\033[33m\033[1m"
81758 +#define RED "\033[31m\033[2m"
81759 +#define LIGHTRED "\033[31m\033[1m"
81760 +#define BLUE "\033[34m\033[2m"
81761 +#define LIGHTBLUE "\033[34m\033[1m"
81762 +#define BRIGHT "\033[m\033[1m"
81763 +#define NORMAL "\033[m"
81764 +
81765 +static diagnostic_starter_fn old_starter;
81766 +static diagnostic_finalizer_fn old_finalizer;
81767 +
81768 +static void start_colorize(diagnostic_context *context, diagnostic_info *diagnostic)
81769 +{
81770 + const char *color;
81771 + char *newprefix;
81772 +
81773 + switch (diagnostic->kind) {
81774 + case DK_NOTE:
81775 + color = LIGHTBLUE;
81776 + break;
81777 +
81778 + case DK_PEDWARN:
81779 + case DK_WARNING:
81780 + color = LIGHTYELLOW;
81781 + break;
81782 +
81783 + case DK_ERROR:
81784 + case DK_FATAL:
81785 + case DK_ICE:
81786 + case DK_PERMERROR:
81787 + case DK_SORRY:
81788 + color = LIGHTRED;
81789 + break;
81790 +
81791 + default:
81792 + color = NORMAL;
81793 + }
81794 +
81795 + old_starter(context, diagnostic);
81796 + if (-1 == asprintf(&newprefix, "%s%s" NORMAL, color, context->printer->prefix))
81797 + return;
81798 + pp_destroy_prefix(context->printer);
81799 + pp_set_prefix(context->printer, newprefix);
81800 +}
81801 +
81802 +static void finalize_colorize(diagnostic_context *context, diagnostic_info *diagnostic)
81803 +{
81804 + old_finalizer(context, diagnostic);
81805 +}
81806 +
81807 +static void colorize_arm(void)
81808 +{
81809 + old_starter = diagnostic_starter(global_dc);
81810 + old_finalizer = diagnostic_finalizer(global_dc);
81811 +
81812 + diagnostic_starter(global_dc) = start_colorize;
81813 + diagnostic_finalizer(global_dc) = finalize_colorize;
81814 +}
81815 +
81816 +static unsigned int execute_colorize_rearm(void)
81817 +{
81818 + if (diagnostic_starter(global_dc) == start_colorize)
81819 + return 0;
81820 +
81821 + colorize_arm();
81822 + return 0;
81823 +}
81824 +
81825 +struct simple_ipa_opt_pass pass_ipa_colorize_rearm = {
81826 + .pass = {
81827 + .type = SIMPLE_IPA_PASS,
81828 + .name = "colorize_rearm",
81829 + .gate = NULL,
81830 + .execute = execute_colorize_rearm,
81831 + .sub = NULL,
81832 + .next = NULL,
81833 + .static_pass_number = 0,
81834 + .tv_id = TV_NONE,
81835 + .properties_required = 0,
81836 + .properties_provided = 0,
81837 + .properties_destroyed = 0,
81838 + .todo_flags_start = 0,
81839 + .todo_flags_finish = 0
81840 + }
81841 +};
81842 +
81843 +static void colorize_start_unit(void *gcc_data, void *user_data)
81844 +{
81845 + colorize_arm();
81846 +}
81847 +
81848 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
81849 +{
81850 + const char * const plugin_name = plugin_info->base_name;
81851 + struct register_pass_info colorize_rearm_pass_info = {
81852 + .pass = &pass_ipa_colorize_rearm.pass,
81853 + .reference_pass_name = "*free_lang_data",
81854 + .ref_pass_instance_number = 1,
81855 + .pos_op = PASS_POS_INSERT_AFTER
81856 + };
81857 +
81858 + if (!plugin_default_version_check(version, &gcc_version)) {
81859 + error(G_("incompatible gcc/plugin versions"));
81860 + return 1;
81861 + }
81862 +
81863 + register_callback(plugin_name, PLUGIN_INFO, NULL, &colorize_plugin_info);
81864 + register_callback(plugin_name, PLUGIN_START_UNIT, &colorize_start_unit, NULL);
81865 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &colorize_rearm_pass_info);
81866 + return 0;
81867 +}
81868 diff --git a/tools/gcc/constify_plugin.c b/tools/gcc/constify_plugin.c
81869 new file mode 100644
81870 index 0000000..048d4ff
81871 --- /dev/null
81872 +++ b/tools/gcc/constify_plugin.c
81873 @@ -0,0 +1,328 @@
81874 +/*
81875 + * Copyright 2011 by Emese Revfy <re.emese@gmail.com>
81876 + * Copyright 2011 by PaX Team <pageexec@freemail.hu>
81877 + * Licensed under the GPL v2, or (at your option) v3
81878 + *
81879 + * This gcc plugin constifies all structures which contain only function pointers or are explicitly marked for constification.
81880 + *
81881 + * Homepage:
81882 + * http://www.grsecurity.net/~ephox/const_plugin/
81883 + *
81884 + * Usage:
81885 + * $ gcc -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -o constify_plugin.so constify_plugin.c
81886 + * $ gcc -fplugin=constify_plugin.so test.c -O2
81887 + */
81888 +
81889 +#include "gcc-plugin.h"
81890 +#include "config.h"
81891 +#include "system.h"
81892 +#include "coretypes.h"
81893 +#include "tree.h"
81894 +#include "tree-pass.h"
81895 +#include "flags.h"
81896 +#include "intl.h"
81897 +#include "toplev.h"
81898 +#include "plugin.h"
81899 +#include "diagnostic.h"
81900 +#include "plugin-version.h"
81901 +#include "tm.h"
81902 +#include "function.h"
81903 +#include "basic-block.h"
81904 +#include "gimple.h"
81905 +#include "rtl.h"
81906 +#include "emit-rtl.h"
81907 +#include "tree-flow.h"
81908 +
81909 +#define C_TYPE_FIELDS_READONLY(TYPE) TREE_LANG_FLAG_1(TYPE)
81910 +
81911 +int plugin_is_GPL_compatible;
81912 +
81913 +static struct plugin_info const_plugin_info = {
81914 + .version = "201205300030",
81915 + .help = "no-constify\tturn off constification\n",
81916 +};
81917 +
81918 +static void deconstify_tree(tree node);
81919 +
81920 +static void deconstify_type(tree type)
81921 +{
81922 + tree field;
81923 +
81924 + for (field = TYPE_FIELDS(type); field; field = TREE_CHAIN(field)) {
81925 + tree type = TREE_TYPE(field);
81926 +
81927 + if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
81928 + continue;
81929 + if (!TYPE_READONLY(type))
81930 + continue;
81931 +
81932 + deconstify_tree(field);
81933 + }
81934 + TYPE_READONLY(type) = 0;
81935 + C_TYPE_FIELDS_READONLY(type) = 0;
81936 +}
81937 +
81938 +static void deconstify_tree(tree node)
81939 +{
81940 + tree old_type, new_type, field;
81941 +
81942 + old_type = TREE_TYPE(node);
81943 +
81944 + gcc_assert(TYPE_READONLY(old_type) && (TYPE_QUALS(old_type) & TYPE_QUAL_CONST));
81945 +
81946 + new_type = build_qualified_type(old_type, TYPE_QUALS(old_type) & ~TYPE_QUAL_CONST);
81947 + TYPE_FIELDS(new_type) = copy_list(TYPE_FIELDS(new_type));
81948 + for (field = TYPE_FIELDS(new_type); field; field = TREE_CHAIN(field))
81949 + DECL_FIELD_CONTEXT(field) = new_type;
81950 +
81951 + deconstify_type(new_type);
81952 +
81953 + TREE_READONLY(node) = 0;
81954 + TREE_TYPE(node) = new_type;
81955 +}
81956 +
81957 +static tree handle_no_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
81958 +{
81959 + tree type;
81960 +
81961 + *no_add_attrs = true;
81962 + if (TREE_CODE(*node) == FUNCTION_DECL) {
81963 + error("%qE attribute does not apply to functions", name);
81964 + return NULL_TREE;
81965 + }
81966 +
81967 + if (TREE_CODE(*node) == VAR_DECL) {
81968 + error("%qE attribute does not apply to variables", name);
81969 + return NULL_TREE;
81970 + }
81971 +
81972 + if (TYPE_P(*node)) {
81973 + if (TREE_CODE(*node) == RECORD_TYPE || TREE_CODE(*node) == UNION_TYPE)
81974 + *no_add_attrs = false;
81975 + else
81976 + error("%qE attribute applies to struct and union types only", name);
81977 + return NULL_TREE;
81978 + }
81979 +
81980 + type = TREE_TYPE(*node);
81981 +
81982 + if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE) {
81983 + error("%qE attribute applies to struct and union types only", name);
81984 + return NULL_TREE;
81985 + }
81986 +
81987 + if (lookup_attribute(IDENTIFIER_POINTER(name), TYPE_ATTRIBUTES(type))) {
81988 + error("%qE attribute is already applied to the type", name);
81989 + return NULL_TREE;
81990 + }
81991 +
81992 + if (TREE_CODE(*node) == TYPE_DECL && !TYPE_READONLY(type)) {
81993 + error("%qE attribute used on type that is not constified", name);
81994 + return NULL_TREE;
81995 + }
81996 +
81997 + if (TREE_CODE(*node) == TYPE_DECL) {
81998 + deconstify_tree(*node);
81999 + return NULL_TREE;
82000 + }
82001 +
82002 + return NULL_TREE;
82003 +}
82004 +
82005 +static void constify_type(tree type)
82006 +{
82007 + TYPE_READONLY(type) = 1;
82008 + C_TYPE_FIELDS_READONLY(type) = 1;
82009 +}
82010 +
82011 +static tree handle_do_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
82012 +{
82013 + *no_add_attrs = true;
82014 + if (!TYPE_P(*node)) {
82015 + error("%qE attribute applies to types only", name);
82016 + return NULL_TREE;
82017 + }
82018 +
82019 + if (TREE_CODE(*node) != RECORD_TYPE && TREE_CODE(*node) != UNION_TYPE) {
82020 + error("%qE attribute applies to struct and union types only", name);
82021 + return NULL_TREE;
82022 + }
82023 +
82024 + *no_add_attrs = false;
82025 + constify_type(*node);
82026 + return NULL_TREE;
82027 +}
82028 +
82029 +static struct attribute_spec no_const_attr = {
82030 + .name = "no_const",
82031 + .min_length = 0,
82032 + .max_length = 0,
82033 + .decl_required = false,
82034 + .type_required = false,
82035 + .function_type_required = false,
82036 + .handler = handle_no_const_attribute,
82037 +#if BUILDING_GCC_VERSION >= 4007
82038 + .affects_type_identity = true
82039 +#endif
82040 +};
82041 +
82042 +static struct attribute_spec do_const_attr = {
82043 + .name = "do_const",
82044 + .min_length = 0,
82045 + .max_length = 0,
82046 + .decl_required = false,
82047 + .type_required = false,
82048 + .function_type_required = false,
82049 + .handler = handle_do_const_attribute,
82050 +#if BUILDING_GCC_VERSION >= 4007
82051 + .affects_type_identity = true
82052 +#endif
82053 +};
82054 +
82055 +static void register_attributes(void *event_data, void *data)
82056 +{
82057 + register_attribute(&no_const_attr);
82058 + register_attribute(&do_const_attr);
82059 +}
82060 +
82061 +static bool is_fptr(tree field)
82062 +{
82063 + tree ptr = TREE_TYPE(field);
82064 +
82065 + if (TREE_CODE(ptr) != POINTER_TYPE)
82066 + return false;
82067 +
82068 + return TREE_CODE(TREE_TYPE(ptr)) == FUNCTION_TYPE;
82069 +}
82070 +
82071 +static bool walk_struct(tree node)
82072 +{
82073 + tree field;
82074 +
82075 + if (TYPE_FIELDS(node) == NULL_TREE)
82076 + return false;
82077 +
82078 + if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node))) {
82079 + gcc_assert(!TYPE_READONLY(node));
82080 + deconstify_type(node);
82081 + return false;
82082 + }
82083 +
82084 + for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
82085 + tree type = TREE_TYPE(field);
82086 + enum tree_code code = TREE_CODE(type);
82087 + if (code == RECORD_TYPE || code == UNION_TYPE) {
82088 + if (!(walk_struct(type)))
82089 + return false;
82090 + } else if (!is_fptr(field) && !TREE_READONLY(field))
82091 + return false;
82092 + }
82093 + return true;
82094 +}
82095 +
82096 +static void finish_type(void *event_data, void *data)
82097 +{
82098 + tree type = (tree)event_data;
82099 +
82100 + if (type == NULL_TREE)
82101 + return;
82102 +
82103 + if (TYPE_READONLY(type))
82104 + return;
82105 +
82106 + if (walk_struct(type))
82107 + constify_type(type);
82108 +}
82109 +
82110 +static unsigned int check_local_variables(void);
82111 +
82112 +struct gimple_opt_pass pass_local_variable = {
82113 + {
82114 + .type = GIMPLE_PASS,
82115 + .name = "check_local_variables",
82116 + .gate = NULL,
82117 + .execute = check_local_variables,
82118 + .sub = NULL,
82119 + .next = NULL,
82120 + .static_pass_number = 0,
82121 + .tv_id = TV_NONE,
82122 + .properties_required = 0,
82123 + .properties_provided = 0,
82124 + .properties_destroyed = 0,
82125 + .todo_flags_start = 0,
82126 + .todo_flags_finish = 0
82127 + }
82128 +};
82129 +
82130 +static unsigned int check_local_variables(void)
82131 +{
82132 + tree var;
82133 + referenced_var_iterator rvi;
82134 +
82135 +#if BUILDING_GCC_VERSION == 4005
82136 + FOR_EACH_REFERENCED_VAR(var, rvi) {
82137 +#else
82138 + FOR_EACH_REFERENCED_VAR(cfun, var, rvi) {
82139 +#endif
82140 + tree type = TREE_TYPE(var);
82141 +
82142 + if (!DECL_P(var) || TREE_STATIC(var) || DECL_EXTERNAL(var))
82143 + continue;
82144 +
82145 + if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
82146 + continue;
82147 +
82148 + if (!TYPE_READONLY(type))
82149 + continue;
82150 +
82151 +// if (lookup_attribute("no_const", DECL_ATTRIBUTES(var)))
82152 +// continue;
82153 +
82154 +// if (lookup_attribute("no_const", TYPE_ATTRIBUTES(type)))
82155 +// continue;
82156 +
82157 + if (walk_struct(type)) {
82158 + error_at(DECL_SOURCE_LOCATION(var), "constified variable %qE cannot be local", var);
82159 + return 1;
82160 + }
82161 + }
82162 + return 0;
82163 +}
82164 +
82165 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
82166 +{
82167 + const char * const plugin_name = plugin_info->base_name;
82168 + const int argc = plugin_info->argc;
82169 + const struct plugin_argument * const argv = plugin_info->argv;
82170 + int i;
82171 + bool constify = true;
82172 +
82173 + struct register_pass_info local_variable_pass_info = {
82174 + .pass = &pass_local_variable.pass,
82175 + .reference_pass_name = "*referenced_vars",
82176 + .ref_pass_instance_number = 1,
82177 + .pos_op = PASS_POS_INSERT_AFTER
82178 + };
82179 +
82180 + if (!plugin_default_version_check(version, &gcc_version)) {
82181 + error(G_("incompatible gcc/plugin versions"));
82182 + return 1;
82183 + }
82184 +
82185 + for (i = 0; i < argc; ++i) {
82186 + if (!(strcmp(argv[i].key, "no-constify"))) {
82187 + constify = false;
82188 + continue;
82189 + }
82190 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
82191 + }
82192 +
82193 + register_callback(plugin_name, PLUGIN_INFO, NULL, &const_plugin_info);
82194 + if (constify) {
82195 + register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
82196 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &local_variable_pass_info);
82197 + }
82198 + register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
82199 +
82200 + return 0;
82201 +}
82202 diff --git a/tools/gcc/generate_size_overflow_hash.sh b/tools/gcc/generate_size_overflow_hash.sh
82203 new file mode 100644
82204 index 0000000..d272d4b
82205 --- /dev/null
82206 +++ b/tools/gcc/generate_size_overflow_hash.sh
82207 @@ -0,0 +1,96 @@
82208 +#!/bin/bash
82209 +
82210 +# This script generates the hash table (size_overflow_hash.h) for the size_overflow gcc plugin (size_overflow_plugin.c).
82211 +
82212 +header1="size_overflow_hash.h"
82213 +database="size_overflow_hash.data"
82214 +n=65536
82215 +
82216 +usage() {
82217 +cat <<EOF
82218 +usage: $0 options
82219 +OPTIONS:
82220 + -h|--help help
82221 + -o header file
82222 + -d database file
82223 + -n hash array size
82224 +EOF
82225 + return 0
82226 +}
82227 +
82228 +while true
82229 +do
82230 + case "$1" in
82231 + -h|--help) usage && exit 0;;
82232 + -n) n=$2; shift 2;;
82233 + -o) header1="$2"; shift 2;;
82234 + -d) database="$2"; shift 2;;
82235 + --) shift 1; break ;;
82236 + *) break ;;
82237 + esac
82238 +done
82239 +
82240 +create_defines() {
82241 + for i in `seq 1 10`
82242 + do
82243 + echo -e "#define PARAM"$i" (1U << "$i")" >> "$header1"
82244 + done
82245 + echo >> "$header1"
82246 +}
82247 +
82248 +create_structs () {
82249 + rm -f "$header1"
82250 +
82251 + create_defines
82252 +
82253 + cat "$database" | while read data
82254 + do
82255 + data_array=(${data// /?})
82256 + data_array=(${data_array[@]//+/ })
82257 + struct_hash_name="${data_array[0]}"
82258 + funcn="${data_array[1]//\?/ }"
82259 + params="${data_array[2]}"
82260 + next="${data_array[5]}"
82261 +
82262 + echo "const struct size_overflow_hash $struct_hash_name = {" >> "$header1"
82263 +
82264 + echo -e "\t.next\t= $next,\n\t.name\t= \"$funcn\"," >> "$header1"
82265 + echo -en "\t.param\t= " >> "$header1"
82266 + line=
82267 + for param_num in ${params//-/ };
82268 + do
82269 + line="${line}PARAM"$param_num"|"
82270 + done
82271 +
82272 + echo -e "${line%?},\n};\n" >> "$header1"
82273 + done
82274 +}
82275 +
82276 +create_headers () {
82277 + echo "const struct size_overflow_hash * const size_overflow_hash[$n] = {" >> "$header1"
82278 +}
82279 +
82280 +create_array_elements () {
82281 + index=0
82282 + grep -v "nohasharray" $database | sort -n -t '+' -k 4 | while read data
82283 + do
82284 + data_array=(${data// /?})
82285 + data_array=(${data_array//+/ })
82286 + i="${data_array[3]}"
82287 + hash="${data_array[4]}"
82288 + while [[ $index -lt $i ]]
82289 + do
82290 + echo -e "\t["$index"]\t= NULL," >> "$header1"
82291 + index=$(($index + 1))
82292 + done
82293 + index=$(($index + 1))
82294 + echo -e "\t["$i"]\t= &"$hash"," >> "$header1"
82295 + done
82296 + echo '};' >> $header1
82297 +}
82298 +
82299 +create_structs
82300 +create_headers
82301 +create_array_elements
82302 +
82303 +exit 0
82304 diff --git a/tools/gcc/kallocstat_plugin.c b/tools/gcc/kallocstat_plugin.c
82305 new file mode 100644
82306 index 0000000..a86e422
82307 --- /dev/null
82308 +++ b/tools/gcc/kallocstat_plugin.c
82309 @@ -0,0 +1,167 @@
82310 +/*
82311 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
82312 + * Licensed under the GPL v2
82313 + *
82314 + * Note: the choice of the license means that the compilation process is
82315 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
82316 + * but for the kernel it doesn't matter since it doesn't link against
82317 + * any of the gcc libraries
82318 + *
82319 + * gcc plugin to find the distribution of k*alloc sizes
82320 + *
82321 + * TODO:
82322 + *
82323 + * BUGS:
82324 + * - none known
82325 + */
82326 +#include "gcc-plugin.h"
82327 +#include "config.h"
82328 +#include "system.h"
82329 +#include "coretypes.h"
82330 +#include "tree.h"
82331 +#include "tree-pass.h"
82332 +#include "flags.h"
82333 +#include "intl.h"
82334 +#include "toplev.h"
82335 +#include "plugin.h"
82336 +//#include "expr.h" where are you...
82337 +#include "diagnostic.h"
82338 +#include "plugin-version.h"
82339 +#include "tm.h"
82340 +#include "function.h"
82341 +#include "basic-block.h"
82342 +#include "gimple.h"
82343 +#include "rtl.h"
82344 +#include "emit-rtl.h"
82345 +
82346 +extern void print_gimple_stmt(FILE *, gimple, int, int);
82347 +
82348 +int plugin_is_GPL_compatible;
82349 +
82350 +static const char * const kalloc_functions[] = {
82351 + "__kmalloc",
82352 + "kmalloc",
82353 + "kmalloc_large",
82354 + "kmalloc_node",
82355 + "kmalloc_order",
82356 + "kmalloc_order_trace",
82357 + "kmalloc_slab",
82358 + "kzalloc",
82359 + "kzalloc_node",
82360 +};
82361 +
82362 +static struct plugin_info kallocstat_plugin_info = {
82363 + .version = "201111150100",
82364 +};
82365 +
82366 +static unsigned int execute_kallocstat(void);
82367 +
82368 +static struct gimple_opt_pass kallocstat_pass = {
82369 + .pass = {
82370 + .type = GIMPLE_PASS,
82371 + .name = "kallocstat",
82372 + .gate = NULL,
82373 + .execute = execute_kallocstat,
82374 + .sub = NULL,
82375 + .next = NULL,
82376 + .static_pass_number = 0,
82377 + .tv_id = TV_NONE,
82378 + .properties_required = 0,
82379 + .properties_provided = 0,
82380 + .properties_destroyed = 0,
82381 + .todo_flags_start = 0,
82382 + .todo_flags_finish = 0
82383 + }
82384 +};
82385 +
82386 +static bool is_kalloc(const char *fnname)
82387 +{
82388 + size_t i;
82389 +
82390 + for (i = 0; i < ARRAY_SIZE(kalloc_functions); i++)
82391 + if (!strcmp(fnname, kalloc_functions[i]))
82392 + return true;
82393 + return false;
82394 +}
82395 +
82396 +static unsigned int execute_kallocstat(void)
82397 +{
82398 + basic_block bb;
82399 +
82400 + // 1. loop through BBs and GIMPLE statements
82401 + FOR_EACH_BB(bb) {
82402 + gimple_stmt_iterator gsi;
82403 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
82404 + // gimple match:
82405 + tree fndecl, size;
82406 + gimple call_stmt;
82407 + const char *fnname;
82408 +
82409 + // is it a call
82410 + call_stmt = gsi_stmt(gsi);
82411 + if (!is_gimple_call(call_stmt))
82412 + continue;
82413 + fndecl = gimple_call_fndecl(call_stmt);
82414 + if (fndecl == NULL_TREE)
82415 + continue;
82416 + if (TREE_CODE(fndecl) != FUNCTION_DECL)
82417 + continue;
82418 +
82419 + // is it a call to k*alloc
82420 + fnname = IDENTIFIER_POINTER(DECL_NAME(fndecl));
82421 + if (!is_kalloc(fnname))
82422 + continue;
82423 +
82424 + // is the size arg the result of a simple const assignment
82425 + size = gimple_call_arg(call_stmt, 0);
82426 + while (true) {
82427 + gimple def_stmt;
82428 + expanded_location xloc;
82429 + size_t size_val;
82430 +
82431 + if (TREE_CODE(size) != SSA_NAME)
82432 + break;
82433 + def_stmt = SSA_NAME_DEF_STMT(size);
82434 + if (!def_stmt || !is_gimple_assign(def_stmt))
82435 + break;
82436 + if (gimple_num_ops(def_stmt) != 2)
82437 + break;
82438 + size = gimple_assign_rhs1(def_stmt);
82439 + if (!TREE_CONSTANT(size))
82440 + continue;
82441 + xloc = expand_location(gimple_location(def_stmt));
82442 + if (!xloc.file)
82443 + xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl));
82444 + size_val = TREE_INT_CST_LOW(size);
82445 + fprintf(stderr, "kallocsize: %8zu %8zx %s %s:%u\n", size_val, size_val, fnname, xloc.file, xloc.line);
82446 + break;
82447 + }
82448 +//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
82449 +//debug_tree(gimple_call_fn(call_stmt));
82450 +//print_node(stderr, "pax", fndecl, 4);
82451 + }
82452 + }
82453 +
82454 + return 0;
82455 +}
82456 +
82457 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
82458 +{
82459 + const char * const plugin_name = plugin_info->base_name;
82460 + struct register_pass_info kallocstat_pass_info = {
82461 + .pass = &kallocstat_pass.pass,
82462 + .reference_pass_name = "ssa",
82463 + .ref_pass_instance_number = 1,
82464 + .pos_op = PASS_POS_INSERT_AFTER
82465 + };
82466 +
82467 + if (!plugin_default_version_check(version, &gcc_version)) {
82468 + error(G_("incompatible gcc/plugin versions"));
82469 + return 1;
82470 + }
82471 +
82472 + register_callback(plugin_name, PLUGIN_INFO, NULL, &kallocstat_plugin_info);
82473 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kallocstat_pass_info);
82474 +
82475 + return 0;
82476 +}
82477 diff --git a/tools/gcc/kernexec_plugin.c b/tools/gcc/kernexec_plugin.c
82478 new file mode 100644
82479 index 0000000..98011fa
82480 --- /dev/null
82481 +++ b/tools/gcc/kernexec_plugin.c
82482 @@ -0,0 +1,427 @@
82483 +/*
82484 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
82485 + * Licensed under the GPL v2
82486 + *
82487 + * Note: the choice of the license means that the compilation process is
82488 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
82489 + * but for the kernel it doesn't matter since it doesn't link against
82490 + * any of the gcc libraries
82491 + *
82492 + * gcc plugin to make KERNEXEC/amd64 almost as good as it is on i386
82493 + *
82494 + * TODO:
82495 + *
82496 + * BUGS:
82497 + * - none known
82498 + */
82499 +#include "gcc-plugin.h"
82500 +#include "config.h"
82501 +#include "system.h"
82502 +#include "coretypes.h"
82503 +#include "tree.h"
82504 +#include "tree-pass.h"
82505 +#include "flags.h"
82506 +#include "intl.h"
82507 +#include "toplev.h"
82508 +#include "plugin.h"
82509 +//#include "expr.h" where are you...
82510 +#include "diagnostic.h"
82511 +#include "plugin-version.h"
82512 +#include "tm.h"
82513 +#include "function.h"
82514 +#include "basic-block.h"
82515 +#include "gimple.h"
82516 +#include "rtl.h"
82517 +#include "emit-rtl.h"
82518 +#include "tree-flow.h"
82519 +
82520 +extern void print_gimple_stmt(FILE *, gimple, int, int);
82521 +extern rtx emit_move_insn(rtx x, rtx y);
82522 +
82523 +int plugin_is_GPL_compatible;
82524 +
82525 +static struct plugin_info kernexec_plugin_info = {
82526 + .version = "201111291120",
82527 + .help = "method=[bts|or]\tinstrumentation method\n"
82528 +};
82529 +
82530 +static unsigned int execute_kernexec_reload(void);
82531 +static unsigned int execute_kernexec_fptr(void);
82532 +static unsigned int execute_kernexec_retaddr(void);
82533 +static bool kernexec_cmodel_check(void);
82534 +
82535 +static void (*kernexec_instrument_fptr)(gimple_stmt_iterator *);
82536 +static void (*kernexec_instrument_retaddr)(rtx);
82537 +
82538 +static struct gimple_opt_pass kernexec_reload_pass = {
82539 + .pass = {
82540 + .type = GIMPLE_PASS,
82541 + .name = "kernexec_reload",
82542 + .gate = kernexec_cmodel_check,
82543 + .execute = execute_kernexec_reload,
82544 + .sub = NULL,
82545 + .next = NULL,
82546 + .static_pass_number = 0,
82547 + .tv_id = TV_NONE,
82548 + .properties_required = 0,
82549 + .properties_provided = 0,
82550 + .properties_destroyed = 0,
82551 + .todo_flags_start = 0,
82552 + .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi
82553 + }
82554 +};
82555 +
82556 +static struct gimple_opt_pass kernexec_fptr_pass = {
82557 + .pass = {
82558 + .type = GIMPLE_PASS,
82559 + .name = "kernexec_fptr",
82560 + .gate = kernexec_cmodel_check,
82561 + .execute = execute_kernexec_fptr,
82562 + .sub = NULL,
82563 + .next = NULL,
82564 + .static_pass_number = 0,
82565 + .tv_id = TV_NONE,
82566 + .properties_required = 0,
82567 + .properties_provided = 0,
82568 + .properties_destroyed = 0,
82569 + .todo_flags_start = 0,
82570 + .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi
82571 + }
82572 +};
82573 +
82574 +static struct rtl_opt_pass kernexec_retaddr_pass = {
82575 + .pass = {
82576 + .type = RTL_PASS,
82577 + .name = "kernexec_retaddr",
82578 + .gate = kernexec_cmodel_check,
82579 + .execute = execute_kernexec_retaddr,
82580 + .sub = NULL,
82581 + .next = NULL,
82582 + .static_pass_number = 0,
82583 + .tv_id = TV_NONE,
82584 + .properties_required = 0,
82585 + .properties_provided = 0,
82586 + .properties_destroyed = 0,
82587 + .todo_flags_start = 0,
82588 + .todo_flags_finish = TODO_dump_func | TODO_ggc_collect
82589 + }
82590 +};
82591 +
82592 +static bool kernexec_cmodel_check(void)
82593 +{
82594 + tree section;
82595 +
82596 + if (ix86_cmodel != CM_KERNEL)
82597 + return false;
82598 +
82599 + section = lookup_attribute("section", DECL_ATTRIBUTES(current_function_decl));
82600 + if (!section || !TREE_VALUE(section))
82601 + return true;
82602 +
82603 + section = TREE_VALUE(TREE_VALUE(section));
82604 + if (strncmp(TREE_STRING_POINTER(section), ".vsyscall_", 10))
82605 + return true;
82606 +
82607 + return false;
82608 +}
82609 +
82610 +/*
82611 + * add special KERNEXEC instrumentation: reload %r10 after it has been clobbered
82612 + */
82613 +static void kernexec_reload_fptr_mask(gimple_stmt_iterator *gsi)
82614 +{
82615 + gimple asm_movabs_stmt;
82616 +
82617 + // build asm volatile("movabs $0x8000000000000000, %%r10\n\t" : : : );
82618 + asm_movabs_stmt = gimple_build_asm_vec("movabs $0x8000000000000000, %%r10\n\t", NULL, NULL, NULL, NULL);
82619 + gimple_asm_set_volatile(asm_movabs_stmt, true);
82620 + gsi_insert_after(gsi, asm_movabs_stmt, GSI_CONTINUE_LINKING);
82621 + update_stmt(asm_movabs_stmt);
82622 +}
82623 +
82624 +/*
82625 + * find all asm() stmts that clobber r10 and add a reload of r10
82626 + */
82627 +static unsigned int execute_kernexec_reload(void)
82628 +{
82629 + basic_block bb;
82630 +
82631 + // 1. loop through BBs and GIMPLE statements
82632 + FOR_EACH_BB(bb) {
82633 + gimple_stmt_iterator gsi;
82634 +
82635 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
82636 + // gimple match: __asm__ ("" : : : "r10");
82637 + gimple asm_stmt;
82638 + size_t nclobbers;
82639 +
82640 + // is it an asm ...
82641 + asm_stmt = gsi_stmt(gsi);
82642 + if (gimple_code(asm_stmt) != GIMPLE_ASM)
82643 + continue;
82644 +
82645 + // ... clobbering r10
82646 + nclobbers = gimple_asm_nclobbers(asm_stmt);
82647 + while (nclobbers--) {
82648 + tree op = gimple_asm_clobber_op(asm_stmt, nclobbers);
82649 + if (strcmp(TREE_STRING_POINTER(TREE_VALUE(op)), "r10"))
82650 + continue;
82651 + kernexec_reload_fptr_mask(&gsi);
82652 +//print_gimple_stmt(stderr, asm_stmt, 0, TDF_LINENO);
82653 + break;
82654 + }
82655 + }
82656 + }
82657 +
82658 + return 0;
82659 +}
82660 +
82661 +/*
82662 + * add special KERNEXEC instrumentation: force MSB of fptr to 1, which will produce
82663 + * a non-canonical address from a userland ptr and will just trigger a GPF on dereference
82664 + */
82665 +static void kernexec_instrument_fptr_bts(gimple_stmt_iterator *gsi)
82666 +{
82667 + gimple assign_intptr, assign_new_fptr, call_stmt;
82668 + tree intptr, old_fptr, new_fptr, kernexec_mask;
82669 +
82670 + call_stmt = gsi_stmt(*gsi);
82671 + old_fptr = gimple_call_fn(call_stmt);
82672 +
82673 + // create temporary unsigned long variable used for bitops and cast fptr to it
82674 + intptr = create_tmp_var(long_unsigned_type_node, "kernexec_bts");
82675 + add_referenced_var(intptr);
82676 + mark_sym_for_renaming(intptr);
82677 + assign_intptr = gimple_build_assign(intptr, fold_convert(long_unsigned_type_node, old_fptr));
82678 + gsi_insert_before(gsi, assign_intptr, GSI_SAME_STMT);
82679 + update_stmt(assign_intptr);
82680 +
82681 + // apply logical or to temporary unsigned long and bitmask
82682 + kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0x8000000000000000LL);
82683 +// kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0xffffffff80000000LL);
82684 + assign_intptr = gimple_build_assign(intptr, fold_build2(BIT_IOR_EXPR, long_long_unsigned_type_node, intptr, kernexec_mask));
82685 + gsi_insert_before(gsi, assign_intptr, GSI_SAME_STMT);
82686 + update_stmt(assign_intptr);
82687 +
82688 + // cast temporary unsigned long back to a temporary fptr variable
82689 + new_fptr = create_tmp_var(TREE_TYPE(old_fptr), "kernexec_fptr");
82690 + add_referenced_var(new_fptr);
82691 + mark_sym_for_renaming(new_fptr);
82692 + assign_new_fptr = gimple_build_assign(new_fptr, fold_convert(TREE_TYPE(old_fptr), intptr));
82693 + gsi_insert_before(gsi, assign_new_fptr, GSI_SAME_STMT);
82694 + update_stmt(assign_new_fptr);
82695 +
82696 + // replace call stmt fn with the new fptr
82697 + gimple_call_set_fn(call_stmt, new_fptr);
82698 + update_stmt(call_stmt);
82699 +}
82700 +
82701 +static void kernexec_instrument_fptr_or(gimple_stmt_iterator *gsi)
82702 +{
82703 + gimple asm_or_stmt, call_stmt;
82704 + tree old_fptr, new_fptr, input, output;
82705 + VEC(tree, gc) *inputs = NULL;
82706 + VEC(tree, gc) *outputs = NULL;
82707 +
82708 + call_stmt = gsi_stmt(*gsi);
82709 + old_fptr = gimple_call_fn(call_stmt);
82710 +
82711 + // create temporary fptr variable
82712 + new_fptr = create_tmp_var(TREE_TYPE(old_fptr), "kernexec_or");
82713 + add_referenced_var(new_fptr);
82714 + mark_sym_for_renaming(new_fptr);
82715 +
82716 + // build asm volatile("orq %%r10, %0\n\t" : "=r"(new_fptr) : "0"(old_fptr));
82717 + input = build_tree_list(NULL_TREE, build_string(2, "0"));
82718 + input = chainon(NULL_TREE, build_tree_list(input, old_fptr));
82719 + output = build_tree_list(NULL_TREE, build_string(3, "=r"));
82720 + output = chainon(NULL_TREE, build_tree_list(output, new_fptr));
82721 + VEC_safe_push(tree, gc, inputs, input);
82722 + VEC_safe_push(tree, gc, outputs, output);
82723 + asm_or_stmt = gimple_build_asm_vec("orq %%r10, %0\n\t", inputs, outputs, NULL, NULL);
82724 + gimple_asm_set_volatile(asm_or_stmt, true);
82725 + gsi_insert_before(gsi, asm_or_stmt, GSI_SAME_STMT);
82726 + update_stmt(asm_or_stmt);
82727 +
82728 + // replace call stmt fn with the new fptr
82729 + gimple_call_set_fn(call_stmt, new_fptr);
82730 + update_stmt(call_stmt);
82731 +}
82732 +
82733 +/*
82734 + * find all C level function pointer dereferences and forcibly set the highest bit of the pointer
82735 + */
82736 +static unsigned int execute_kernexec_fptr(void)
82737 +{
82738 + basic_block bb;
82739 +
82740 + // 1. loop through BBs and GIMPLE statements
82741 + FOR_EACH_BB(bb) {
82742 + gimple_stmt_iterator gsi;
82743 +
82744 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
82745 + // gimple match: h_1 = get_fptr (); D.2709_3 = h_1 (x_2(D));
82746 + tree fn;
82747 + gimple call_stmt;
82748 +
82749 + // is it a call ...
82750 + call_stmt = gsi_stmt(gsi);
82751 + if (!is_gimple_call(call_stmt))
82752 + continue;
82753 + fn = gimple_call_fn(call_stmt);
82754 + if (TREE_CODE(fn) == ADDR_EXPR)
82755 + continue;
82756 + if (TREE_CODE(fn) != SSA_NAME)
82757 + gcc_unreachable();
82758 +
82759 + // ... through a function pointer
82760 + fn = SSA_NAME_VAR(fn);
82761 + if (TREE_CODE(fn) != VAR_DECL && TREE_CODE(fn) != PARM_DECL)
82762 + continue;
82763 + fn = TREE_TYPE(fn);
82764 + if (TREE_CODE(fn) != POINTER_TYPE)
82765 + continue;
82766 + fn = TREE_TYPE(fn);
82767 + if (TREE_CODE(fn) != FUNCTION_TYPE)
82768 + continue;
82769 +
82770 + kernexec_instrument_fptr(&gsi);
82771 +
82772 +//debug_tree(gimple_call_fn(call_stmt));
82773 +//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
82774 + }
82775 + }
82776 +
82777 + return 0;
82778 +}
82779 +
82780 +// add special KERNEXEC instrumentation: btsq $63,(%rsp) just before retn
82781 +static void kernexec_instrument_retaddr_bts(rtx insn)
82782 +{
82783 + rtx btsq;
82784 + rtvec argvec, constraintvec, labelvec;
82785 + int line;
82786 +
82787 + // create asm volatile("btsq $63,(%%rsp)":::)
82788 + argvec = rtvec_alloc(0);
82789 + constraintvec = rtvec_alloc(0);
82790 + labelvec = rtvec_alloc(0);
82791 + line = expand_location(RTL_LOCATION(insn)).line;
82792 + btsq = gen_rtx_ASM_OPERANDS(VOIDmode, "btsq $63,(%%rsp)", empty_string, 0, argvec, constraintvec, labelvec, line);
82793 + MEM_VOLATILE_P(btsq) = 1;
82794 +// RTX_FRAME_RELATED_P(btsq) = 1; // not for ASM_OPERANDS
82795 + emit_insn_before(btsq, insn);
82796 +}
82797 +
82798 +// add special KERNEXEC instrumentation: orq %r10,(%rsp) just before retn
82799 +static void kernexec_instrument_retaddr_or(rtx insn)
82800 +{
82801 + rtx orq;
82802 + rtvec argvec, constraintvec, labelvec;
82803 + int line;
82804 +
82805 + // create asm volatile("orq %%r10,(%%rsp)":::)
82806 + argvec = rtvec_alloc(0);
82807 + constraintvec = rtvec_alloc(0);
82808 + labelvec = rtvec_alloc(0);
82809 + line = expand_location(RTL_LOCATION(insn)).line;
82810 + orq = gen_rtx_ASM_OPERANDS(VOIDmode, "orq %%r10,(%%rsp)", empty_string, 0, argvec, constraintvec, labelvec, line);
82811 + MEM_VOLATILE_P(orq) = 1;
82812 +// RTX_FRAME_RELATED_P(orq) = 1; // not for ASM_OPERANDS
82813 + emit_insn_before(orq, insn);
82814 +}
82815 +
82816 +/*
82817 + * find all asm level function returns and forcibly set the highest bit of the return address
82818 + */
82819 +static unsigned int execute_kernexec_retaddr(void)
82820 +{
82821 + rtx insn;
82822 +
82823 + // 1. find function returns
82824 + for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
82825 + // rtl match: (jump_insn 41 40 42 2 (return) fptr.c:42 634 {return_internal} (nil))
82826 + // (jump_insn 12 9 11 2 (parallel [ (return) (unspec [ (0) ] UNSPEC_REP) ]) fptr.c:46 635 {return_internal_long} (nil))
82827 + rtx body;
82828 +
82829 + // is it a retn
82830 + if (!JUMP_P(insn))
82831 + continue;
82832 + body = PATTERN(insn);
82833 + if (GET_CODE(body) == PARALLEL)
82834 + body = XVECEXP(body, 0, 0);
82835 + if (GET_CODE(body) != RETURN)
82836 + continue;
82837 + kernexec_instrument_retaddr(insn);
82838 + }
82839 +
82840 +// print_simple_rtl(stderr, get_insns());
82841 +// print_rtl(stderr, get_insns());
82842 +
82843 + return 0;
82844 +}
82845 +
82846 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
82847 +{
82848 + const char * const plugin_name = plugin_info->base_name;
82849 + const int argc = plugin_info->argc;
82850 + const struct plugin_argument * const argv = plugin_info->argv;
82851 + int i;
82852 + struct register_pass_info kernexec_reload_pass_info = {
82853 + .pass = &kernexec_reload_pass.pass,
82854 + .reference_pass_name = "ssa",
82855 + .ref_pass_instance_number = 1,
82856 + .pos_op = PASS_POS_INSERT_AFTER
82857 + };
82858 + struct register_pass_info kernexec_fptr_pass_info = {
82859 + .pass = &kernexec_fptr_pass.pass,
82860 + .reference_pass_name = "ssa",
82861 + .ref_pass_instance_number = 1,
82862 + .pos_op = PASS_POS_INSERT_AFTER
82863 + };
82864 + struct register_pass_info kernexec_retaddr_pass_info = {
82865 + .pass = &kernexec_retaddr_pass.pass,
82866 + .reference_pass_name = "pro_and_epilogue",
82867 + .ref_pass_instance_number = 1,
82868 + .pos_op = PASS_POS_INSERT_AFTER
82869 + };
82870 +
82871 + if (!plugin_default_version_check(version, &gcc_version)) {
82872 + error(G_("incompatible gcc/plugin versions"));
82873 + return 1;
82874 + }
82875 +
82876 + register_callback(plugin_name, PLUGIN_INFO, NULL, &kernexec_plugin_info);
82877 +
82878 + if (TARGET_64BIT == 0)
82879 + return 0;
82880 +
82881 + for (i = 0; i < argc; ++i) {
82882 + if (!strcmp(argv[i].key, "method")) {
82883 + if (!argv[i].value) {
82884 + error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
82885 + continue;
82886 + }
82887 + if (!strcmp(argv[i].value, "bts")) {
82888 + kernexec_instrument_fptr = kernexec_instrument_fptr_bts;
82889 + kernexec_instrument_retaddr = kernexec_instrument_retaddr_bts;
82890 + } else if (!strcmp(argv[i].value, "or")) {
82891 + kernexec_instrument_fptr = kernexec_instrument_fptr_or;
82892 + kernexec_instrument_retaddr = kernexec_instrument_retaddr_or;
82893 + fix_register("r10", 1, 1);
82894 + } else
82895 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
82896 + continue;
82897 + }
82898 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
82899 + }
82900 + if (!kernexec_instrument_fptr || !kernexec_instrument_retaddr)
82901 + error(G_("no instrumentation method was selected via '-fplugin-arg-%s-method'"), plugin_name);
82902 +
82903 + if (kernexec_instrument_fptr == kernexec_instrument_fptr_or)
82904 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_reload_pass_info);
82905 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_fptr_pass_info);
82906 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_retaddr_pass_info);
82907 +
82908 + return 0;
82909 +}
82910 diff --git a/tools/gcc/latent_entropy_plugin.c b/tools/gcc/latent_entropy_plugin.c
82911 new file mode 100644
82912 index 0000000..b8008f7
82913 --- /dev/null
82914 +++ b/tools/gcc/latent_entropy_plugin.c
82915 @@ -0,0 +1,295 @@
82916 +/*
82917 + * Copyright 2012 by the PaX Team <pageexec@freemail.hu>
82918 + * Licensed under the GPL v2
82919 + *
82920 + * Note: the choice of the license means that the compilation process is
82921 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
82922 + * but for the kernel it doesn't matter since it doesn't link against
82923 + * any of the gcc libraries
82924 + *
82925 + * gcc plugin to help generate a little bit of entropy from program state,
82926 + * used during boot in the kernel
82927 + *
82928 + * TODO:
82929 + * - add ipa pass to identify not explicitly marked candidate functions
82930 + * - mix in more program state (function arguments/return values, loop variables, etc)
82931 + * - more instrumentation control via attribute parameters
82932 + *
82933 + * BUGS:
82934 + * - LTO needs -flto-partition=none for now
82935 + */
82936 +#include "gcc-plugin.h"
82937 +#include "config.h"
82938 +#include "system.h"
82939 +#include "coretypes.h"
82940 +#include "tree.h"
82941 +#include "tree-pass.h"
82942 +#include "flags.h"
82943 +#include "intl.h"
82944 +#include "toplev.h"
82945 +#include "plugin.h"
82946 +//#include "expr.h" where are you...
82947 +#include "diagnostic.h"
82948 +#include "plugin-version.h"
82949 +#include "tm.h"
82950 +#include "function.h"
82951 +#include "basic-block.h"
82952 +#include "gimple.h"
82953 +#include "rtl.h"
82954 +#include "emit-rtl.h"
82955 +#include "tree-flow.h"
82956 +
82957 +int plugin_is_GPL_compatible;
82958 +
82959 +static tree latent_entropy_decl;
82960 +
82961 +static struct plugin_info latent_entropy_plugin_info = {
82962 + .version = "201207271820",
82963 + .help = NULL
82964 +};
82965 +
82966 +static unsigned int execute_latent_entropy(void);
82967 +static bool gate_latent_entropy(void);
82968 +
82969 +static struct gimple_opt_pass latent_entropy_pass = {
82970 + .pass = {
82971 + .type = GIMPLE_PASS,
82972 + .name = "latent_entropy",
82973 + .gate = gate_latent_entropy,
82974 + .execute = execute_latent_entropy,
82975 + .sub = NULL,
82976 + .next = NULL,
82977 + .static_pass_number = 0,
82978 + .tv_id = TV_NONE,
82979 + .properties_required = PROP_gimple_leh | PROP_cfg,
82980 + .properties_provided = 0,
82981 + .properties_destroyed = 0,
82982 + .todo_flags_start = 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts,
82983 + .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_update_ssa
82984 + }
82985 +};
82986 +
82987 +static tree handle_latent_entropy_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
82988 +{
82989 + if (TREE_CODE(*node) != FUNCTION_DECL) {
82990 + *no_add_attrs = true;
82991 + error("%qE attribute only applies to functions", name);
82992 + }
82993 + return NULL_TREE;
82994 +}
82995 +
82996 +static struct attribute_spec latent_entropy_attr = {
82997 + .name = "latent_entropy",
82998 + .min_length = 0,
82999 + .max_length = 0,
83000 + .decl_required = true,
83001 + .type_required = false,
83002 + .function_type_required = false,
83003 + .handler = handle_latent_entropy_attribute,
83004 +#if BUILDING_GCC_VERSION >= 4007
83005 + .affects_type_identity = false
83006 +#endif
83007 +};
83008 +
83009 +static void register_attributes(void *event_data, void *data)
83010 +{
83011 + register_attribute(&latent_entropy_attr);
83012 +}
83013 +
83014 +static bool gate_latent_entropy(void)
83015 +{
83016 + tree latent_entropy_attr;
83017 +
83018 + latent_entropy_attr = lookup_attribute("latent_entropy", DECL_ATTRIBUTES(current_function_decl));
83019 + return latent_entropy_attr != NULL_TREE;
83020 +}
83021 +
83022 +static unsigned HOST_WIDE_INT seed;
83023 +static unsigned HOST_WIDE_INT get_random_const(void)
83024 +{
83025 + seed = (seed >> 1U) ^ (-(seed & 1ULL) & 0xD800000000000000ULL);
83026 + return seed;
83027 +}
83028 +
83029 +static enum tree_code get_op(tree *rhs)
83030 +{
83031 + static enum tree_code op;
83032 + unsigned HOST_WIDE_INT random_const;
83033 +
83034 + random_const = get_random_const();
83035 +
83036 + switch (op) {
83037 + case BIT_XOR_EXPR:
83038 + op = PLUS_EXPR;
83039 + break;
83040 +
83041 + case PLUS_EXPR:
83042 + if (rhs) {
83043 + op = LROTATE_EXPR;
83044 + random_const &= HOST_BITS_PER_WIDE_INT - 1;
83045 + break;
83046 + }
83047 +
83048 + case LROTATE_EXPR:
83049 + default:
83050 + op = BIT_XOR_EXPR;
83051 + break;
83052 + }
83053 + if (rhs)
83054 + *rhs = build_int_cstu(unsigned_intDI_type_node, random_const);
83055 + return op;
83056 +}
83057 +
83058 +static void perturb_local_entropy(basic_block bb, tree local_entropy)
83059 +{
83060 + gimple_stmt_iterator gsi;
83061 + gimple assign;
83062 + tree addxorrol, rhs;
83063 + enum tree_code op;
83064 +
83065 + op = get_op(&rhs);
83066 + addxorrol = fold_build2_loc(UNKNOWN_LOCATION, op, unsigned_intDI_type_node, local_entropy, rhs);
83067 + assign = gimple_build_assign(local_entropy, addxorrol);
83068 + find_referenced_vars_in(assign);
83069 +//debug_bb(bb);
83070 + gsi = gsi_after_labels(bb);
83071 + gsi_insert_before(&gsi, assign, GSI_NEW_STMT);
83072 + update_stmt(assign);
83073 +}
83074 +
83075 +static void perturb_latent_entropy(basic_block bb, tree rhs)
83076 +{
83077 + gimple_stmt_iterator gsi;
83078 + gimple assign;
83079 + tree addxorrol, temp;
83080 +
83081 + // 1. create temporary copy of latent_entropy
83082 + temp = create_tmp_var(unsigned_intDI_type_node, "temp_latent_entropy");
83083 + add_referenced_var(temp);
83084 + mark_sym_for_renaming(temp);
83085 +
83086 + // 2. read...
83087 + assign = gimple_build_assign(temp, latent_entropy_decl);
83088 + find_referenced_vars_in(assign);
83089 + gsi = gsi_after_labels(bb);
83090 + gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
83091 + update_stmt(assign);
83092 +
83093 + // 3. ...modify...
83094 + addxorrol = fold_build2_loc(UNKNOWN_LOCATION, get_op(NULL), unsigned_intDI_type_node, temp, rhs);
83095 + assign = gimple_build_assign(temp, addxorrol);
83096 + find_referenced_vars_in(assign);
83097 + gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
83098 + update_stmt(assign);
83099 +
83100 + // 4. ...write latent_entropy
83101 + assign = gimple_build_assign(latent_entropy_decl, temp);
83102 + find_referenced_vars_in(assign);
83103 + gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
83104 + update_stmt(assign);
83105 +}
83106 +
83107 +static unsigned int execute_latent_entropy(void)
83108 +{
83109 + basic_block bb;
83110 + gimple assign;
83111 + gimple_stmt_iterator gsi;
83112 + tree local_entropy;
83113 +
83114 + if (!latent_entropy_decl) {
83115 + struct varpool_node *node;
83116 +
83117 + for (node = varpool_nodes; node; node = node->next) {
83118 + tree var = node->decl;
83119 + if (strcmp(IDENTIFIER_POINTER(DECL_NAME(var)), "latent_entropy"))
83120 + continue;
83121 + latent_entropy_decl = var;
83122 +// debug_tree(var);
83123 + break;
83124 + }
83125 + if (!latent_entropy_decl) {
83126 +// debug_tree(current_function_decl);
83127 + return 0;
83128 + }
83129 + }
83130 +
83131 +//fprintf(stderr, "latent_entropy: %s\n", IDENTIFIER_POINTER(DECL_NAME(current_function_decl)));
83132 +
83133 + // 1. create local entropy variable
83134 + local_entropy = create_tmp_var(unsigned_intDI_type_node, "local_entropy");
83135 + add_referenced_var(local_entropy);
83136 + mark_sym_for_renaming(local_entropy);
83137 +
83138 + // 2. initialize local entropy variable
83139 + bb = split_block_after_labels(ENTRY_BLOCK_PTR)->dest;
83140 + if (dom_info_available_p(CDI_DOMINATORS))
83141 + set_immediate_dominator(CDI_DOMINATORS, bb, ENTRY_BLOCK_PTR);
83142 + gsi = gsi_start_bb(bb);
83143 +
83144 + assign = gimple_build_assign(local_entropy, build_int_cstu(unsigned_intDI_type_node, get_random_const()));
83145 +// gimple_set_location(assign, loc);
83146 + find_referenced_vars_in(assign);
83147 + gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
83148 + update_stmt(assign);
83149 + bb = bb->next_bb;
83150 +
83151 + // 3. instrument each BB with an operation on the local entropy variable
83152 + while (bb != EXIT_BLOCK_PTR) {
83153 + perturb_local_entropy(bb, local_entropy);
83154 + bb = bb->next_bb;
83155 + };
83156 +
83157 + // 4. mix local entropy into the global entropy variable
83158 + perturb_latent_entropy(EXIT_BLOCK_PTR->prev_bb, local_entropy);
83159 + return 0;
83160 +}
83161 +
83162 +static void start_unit_callback(void *gcc_data, void *user_data)
83163 +{
83164 +#if BUILDING_GCC_VERSION >= 4007
83165 + seed = get_random_seed(false);
83166 +#else
83167 + sscanf(get_random_seed(false), "%" HOST_WIDE_INT_PRINT "x", &seed);
83168 + seed *= seed;
83169 +#endif
83170 +
83171 + if (in_lto_p)
83172 + return;
83173 +
83174 + // extern u64 latent_entropy
83175 + latent_entropy_decl = build_decl(UNKNOWN_LOCATION, VAR_DECL, get_identifier("latent_entropy"), unsigned_intDI_type_node);
83176 +
83177 + TREE_STATIC(latent_entropy_decl) = 1;
83178 + TREE_PUBLIC(latent_entropy_decl) = 1;
83179 + TREE_USED(latent_entropy_decl) = 1;
83180 + TREE_THIS_VOLATILE(latent_entropy_decl) = 1;
83181 + DECL_EXTERNAL(latent_entropy_decl) = 1;
83182 + DECL_ARTIFICIAL(latent_entropy_decl) = 0;
83183 + DECL_INITIAL(latent_entropy_decl) = NULL;
83184 +// DECL_ASSEMBLER_NAME(latent_entropy_decl);
83185 +// varpool_finalize_decl(latent_entropy_decl);
83186 +// varpool_mark_needed_node(latent_entropy_decl);
83187 +}
83188 +
83189 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
83190 +{
83191 + const char * const plugin_name = plugin_info->base_name;
83192 + struct register_pass_info latent_entropy_pass_info = {
83193 + .pass = &latent_entropy_pass.pass,
83194 + .reference_pass_name = "optimized",
83195 + .ref_pass_instance_number = 1,
83196 + .pos_op = PASS_POS_INSERT_BEFORE
83197 + };
83198 +
83199 + if (!plugin_default_version_check(version, &gcc_version)) {
83200 + error(G_("incompatible gcc/plugin versions"));
83201 + return 1;
83202 + }
83203 +
83204 + register_callback(plugin_name, PLUGIN_INFO, NULL, &latent_entropy_plugin_info);
83205 + register_callback ("start_unit", PLUGIN_START_UNIT, &start_unit_callback, NULL);
83206 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &latent_entropy_pass_info);
83207 + register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
83208 +
83209 + return 0;
83210 +}
83211 diff --git a/tools/gcc/size_overflow_hash.data b/tools/gcc/size_overflow_hash.data
83212 new file mode 100644
83213 index 0000000..9a72d97
83214 --- /dev/null
83215 +++ b/tools/gcc/size_overflow_hash.data
83216 @@ -0,0 +1,3171 @@
83217 +_000001_hash+alloc_dr+2+65495+_000001_hash+NULL
83218 +_000002_hash+__copy_from_user+3+10918+_000002_hash+NULL
83219 +_000003_hash+copy_from_user+3+17559+_000003_hash+NULL
83220 +_000004_hash+__copy_from_user_inatomic+3+4365+_000004_hash+NULL
83221 +_000005_hash+__copy_from_user_nocache+3+39351+_000005_hash+NULL
83222 +_000006_hash+__copy_to_user_inatomic+3+19214+_000006_hash+NULL
83223 +_000007_hash+do_xip_mapping_read+5+60297+_000007_hash+NULL
83224 +_000008_hash+hugetlbfs_read+3+11268+_000008_hash+NULL
83225 +_000009_hash+kmalloc+1+60432+_002597_hash+NULL+nohasharray
83226 +_000010_hash+kmalloc_array+1-2+9444+_000010_hash+NULL
83227 +_000012_hash+kmalloc_slab+1+11917+_000012_hash+NULL
83228 +_000013_hash+kmemdup+2+64015+_000013_hash+NULL
83229 +_000014_hash+__krealloc+2+14857+_000331_hash+NULL+nohasharray
83230 +_000015_hash+memdup_user+2+59590+_000015_hash+NULL
83231 +_000016_hash+module_alloc+1+63630+_000016_hash+NULL
83232 +_000017_hash+read_default_ldt+2+14302+_000017_hash+NULL
83233 +_000018_hash+read_kcore+3+63488+_000018_hash+NULL
83234 +_000019_hash+read_ldt+2+47570+_000019_hash+NULL
83235 +_000020_hash+read_zero+3+19366+_000020_hash+NULL
83236 +_000021_hash+__vmalloc_node+1+39308+_000021_hash+NULL
83237 +_000022_hash+vm_map_ram+2+23078+_001054_hash+NULL+nohasharray
83238 +_000023_hash+aa_simple_write_to_buffer+4-3+49683+_000023_hash+NULL
83239 +_000024_hash+ablkcipher_copy_iv+3+64140+_000024_hash+NULL
83240 +_000025_hash+ablkcipher_next_slow+4+47274+_000025_hash+NULL
83241 +_000026_hash+acpi_battery_write_alarm+3+1240+_000026_hash+NULL
83242 +_000027_hash+acpi_os_allocate+1+14892+_000027_hash+NULL
83243 +_000028_hash+acpi_system_write_wakeup_device+3+34853+_000028_hash+NULL
83244 +_000029_hash+adu_write+3+30487+_000029_hash+NULL
83245 +_000030_hash+aer_inject_write+3+52399+_000030_hash+NULL
83246 +_000031_hash+afs_alloc_flat_call+2-3+36399+_000031_hash+NULL
83247 +_000033_hash+afs_proc_cells_write+3+61139+_000033_hash+NULL
83248 +_000034_hash+afs_proc_rootcell_write+3+15822+_000034_hash+NULL
83249 +_000035_hash+agp_3_5_isochronous_node_enable+3+49465+_000035_hash+NULL
83250 +_000036_hash+agp_alloc_page_array+1+22554+_000036_hash+NULL
83251 +_000037_hash+ah_alloc_tmp+2+54378+_000037_hash+NULL
83252 +_000038_hash+ahash_setkey_unaligned+3+33521+_000038_hash+NULL
83253 +_000039_hash+alg_setkey+3+31485+_000039_hash+NULL
83254 +_000040_hash+aligned_kmalloc+1+3628+_000040_hash+NULL
83255 +_000041_hash+alloc_context+1+3194+_000041_hash+NULL
83256 +_000042_hash+alloc_ep_req+2+54860+_000042_hash+NULL
83257 +_000043_hash+alloc_fdmem+1+27083+_000043_hash+NULL
83258 +_000044_hash+alloc_flex_gd+1+57259+_000044_hash+NULL
83259 +_000045_hash+alloc_sglist+1-3-2+22960+_000045_hash+NULL
83260 +_000046_hash+aoedev_flush+2+44398+_000046_hash+NULL
83261 +_000047_hash+append_to_buffer+3+63550+_000047_hash+NULL
83262 +_000048_hash+asix_read_cmd+5+13245+_000048_hash+NULL
83263 +_000049_hash+asix_write_cmd+5+58192+_000049_hash+NULL
83264 +_000050_hash+asn1_octets_decode+2+9991+_000050_hash+NULL
83265 +_000051_hash+asn1_oid_decode+2+4999+_000051_hash+NULL
83266 +_000052_hash+at76_set_card_command+4+4471+_000052_hash+NULL
83267 +_000053_hash+ath6kl_add_bss_if_needed+6+24317+_000053_hash+NULL
83268 +_000054_hash+ath6kl_debug_roam_tbl_event+3+5224+_000054_hash+NULL
83269 +_000055_hash+ath6kl_mgmt_powersave_ap+6+13791+_000055_hash+NULL
83270 +_000056_hash+ath6kl_send_go_probe_resp+3+21113+_000056_hash+NULL
83271 +_000057_hash+ath6kl_set_ap_probe_resp_ies+3+50539+_000057_hash+NULL
83272 +_000058_hash+ath6kl_set_assoc_req_ies+3+43185+_000058_hash+NULL
83273 +_000059_hash+ath6kl_wmi_bssinfo_event_rx+3+2275+_000059_hash+NULL
83274 +_000060_hash+ath6kl_wmi_send_action_cmd+7+58860+_000060_hash+NULL
83275 +_000061_hash+__ath6kl_wmi_send_mgmt_cmd+7+38971+_000061_hash+NULL
83276 +_000062_hash+attach_hdlc_protocol+3+19986+_000062_hash+NULL
83277 +_000063_hash+audio_write+4+54261+_001597_hash+NULL+nohasharray
83278 +_000064_hash+audit_unpack_string+3+13748+_000064_hash+NULL
83279 +_000065_hash+av7110_vbi_write+3+34384+_000065_hash+NULL
83280 +_000066_hash+ax25_setsockopt+5+42740+_000066_hash+NULL
83281 +_000067_hash+b43_debugfs_write+3+34838+_000067_hash+NULL
83282 +_000068_hash+b43legacy_debugfs_write+3+28556+_000068_hash+NULL
83283 +_000069_hash+bch_alloc+1+4593+_000069_hash+NULL
83284 +_000070_hash+befs_nls2utf+3+17163+_000070_hash+NULL
83285 +_000071_hash+befs_utf2nls+3+25628+_000071_hash+NULL
83286 +_000072_hash+bfad_debugfs_write_regrd+3+15218+_000072_hash+NULL
83287 +_000073_hash+bfad_debugfs_write_regwr+3+61841+_000073_hash+NULL
83288 +_000074_hash+bio_alloc_map_data+1-2+50782+_000074_hash+NULL
83289 +_000076_hash+bio_kmalloc+2+54672+_000076_hash+NULL
83290 +_000077_hash+blkcipher_copy_iv+3+24075+_000077_hash+NULL
83291 +_000078_hash+blkcipher_next_slow+4+52733+_000078_hash+NULL
83292 +_000079_hash+bl_pipe_downcall+3+34264+_000079_hash+NULL
83293 +_000080_hash+bnad_debugfs_write_regrd+3+6706+_000080_hash+NULL
83294 +_000081_hash+bnad_debugfs_write_regwr+3+57500+_000081_hash+NULL
83295 +_000082_hash+bnx2fc_cmd_mgr_alloc+2-3+24873+_000082_hash+NULL
83296 +_000084_hash+bnx2_nvram_write+4+7790+_000084_hash+NULL
83297 +_000085_hash+brcmf_sdbrcm_downloadvars+3+42064+_000085_hash+NULL
83298 +_000086_hash+btmrvl_gpiogap_write+3+35053+_000086_hash+NULL
83299 +_000087_hash+btmrvl_hscfgcmd_write+3+27143+_000087_hash+NULL
83300 +_000088_hash+btmrvl_hscmd_write+3+27089+_000088_hash+NULL
83301 +_000089_hash+btmrvl_hsmode_write+3+42252+_000089_hash+NULL
83302 +_000090_hash+btmrvl_pscmd_write+3+29504+_000090_hash+NULL
83303 +_000091_hash+btmrvl_psmode_write+3+3703+_000091_hash+NULL
83304 +_000092_hash+btrfs_alloc_delayed_item+1+11678+_000092_hash+NULL
83305 +_000093_hash+cache_do_downcall+3+6926+_000093_hash+NULL
83306 +_000094_hash+cachefiles_cook_key+2+33274+_000094_hash+NULL
83307 +_000095_hash+cachefiles_daemon_write+3+43535+_000095_hash+NULL
83308 +_000096_hash+capi_write+3+35104+_000096_hash+NULL
83309 +_000097_hash+carl9170_debugfs_write+3+50857+_000097_hash+NULL
83310 +_000098_hash+cciss_allocate_sg_chain_blocks+2-3+5368+_000098_hash+NULL
83311 +_000100_hash+cciss_proc_write+3+10259+_000100_hash+NULL
83312 +_000101_hash+cdrom_read_cdda_old+4+27664+_000101_hash+NULL
83313 +_000102_hash+ceph_alloc_page_vector+1+18710+_000102_hash+NULL
83314 +_000103_hash+ceph_buffer_new+1+35974+_000103_hash+NULL
83315 +_000104_hash+ceph_copy_user_to_page_vector+4+656+_000104_hash+NULL
83316 +_000105_hash+ceph_get_direct_page_vector+2+41917+_000105_hash+NULL
83317 +_000106_hash+ceph_msg_new+2+5846+_000106_hash+NULL
83318 +_000107_hash+ceph_setxattr+4+18913+_000107_hash+NULL
83319 +_000108_hash+cfi_read_pri+3+24366+_000108_hash+NULL
83320 +_000109_hash+cgroup_write_string+5+10900+_000109_hash+NULL
83321 +_000110_hash+cgroup_write_X64+5+54514+_000110_hash+NULL
83322 +_000111_hash+change_xattr+5+61390+_000111_hash+NULL
83323 +_000112_hash+check_load_and_stores+2+2143+_000112_hash+NULL
83324 +_000113_hash+cifs_idmap_key_instantiate+3+54503+_000113_hash+NULL
83325 +_000114_hash+cifs_security_flags_proc_write+3+5484+_000114_hash+NULL
83326 +_000115_hash+cifs_setxattr+4+23957+_000115_hash+NULL
83327 +_000116_hash+cifs_spnego_key_instantiate+3+23588+_000116_hash+NULL
83328 +_000117_hash+ci_ll_write+4+3740+_000117_hash+NULL
83329 +_000118_hash+cld_pipe_downcall+3+15058+_000118_hash+NULL
83330 +_000119_hash+clear_refs_write+3+61904+_000119_hash+NULL
83331 +_000120_hash+clusterip_proc_write+3+44729+_000120_hash+NULL
83332 +_000121_hash+cm4040_write+3+58079+_000121_hash+NULL
83333 +_000122_hash+cm_copy_private_data+2+3649+_000122_hash+NULL
83334 +_000123_hash+cmm_write+3+2896+_000123_hash+NULL
83335 +_000124_hash+cm_write+3+36858+_000124_hash+NULL
83336 +_000125_hash+coda_psdev_write+3+1711+_000125_hash+NULL
83337 +_000126_hash+codec_reg_read_file+3+36280+_000126_hash+NULL
83338 +_000127_hash+command_file_write+3+31318+_000127_hash+NULL
83339 +_000128_hash+command_write+3+58841+_000128_hash+NULL
83340 +_000129_hash+comm_write+3+44537+_001532_hash+NULL+nohasharray
83341 +_000130_hash+concat_writev+3+21451+_000130_hash+NULL
83342 +_000131_hash+copy_and_check+3+19089+_000131_hash+NULL
83343 +_000132_hash+copy_from_user_toio+3+31966+_000132_hash+NULL
83344 +_000133_hash+copy_items+6+50140+_000133_hash+NULL
83345 +_000134_hash+copy_macs+4+45534+_000134_hash+NULL
83346 +_000135_hash+__copy_to_user+3+17551+_000135_hash+NULL
83347 +_000136_hash+copy_vm86_regs_from_user+3+45340+_000136_hash+NULL
83348 +_000137_hash+cosa_write+3+1774+_000137_hash+NULL
83349 +_000138_hash+create_entry+2+33479+_000138_hash+NULL
83350 +_000139_hash+create_queues+2-3+9088+_000139_hash+NULL
83351 +_000141_hash+create_xattr+5+54106+_000141_hash+NULL
83352 +_000142_hash+create_xattr_datum+5+33356+_000142_hash+NULL
83353 +_000143_hash+csum_partial_copy_fromiovecend+3-4+9957+_000143_hash+NULL
83354 +_000145_hash+ctrl_out+3-5+8712+_000145_hash+NULL
83355 +_000147_hash+cx24116_writeregN+4+41975+_000147_hash+NULL
83356 +_000148_hash+cxacru_cm_get_array+4+4412+_000148_hash+NULL
83357 +_000149_hash+cxgbi_alloc_big_mem+1+4707+_000149_hash+NULL
83358 +_000150_hash+dac960_user_command_proc_write+3+3071+_000150_hash+NULL
83359 +_000151_hash+datablob_format+2+39571+_002156_hash+NULL+nohasharray
83360 +_000152_hash+dccp_feat_clone_sp_val+3+11942+_000152_hash+NULL
83361 +_000153_hash+dccp_setsockopt_ccid+4+30701+_000153_hash+NULL
83362 +_000154_hash+dccp_setsockopt_cscov+2+37766+_000154_hash+NULL
83363 +_000155_hash+dccp_setsockopt_service+4+65336+_000155_hash+NULL
83364 +_000156_hash+ddb_output_write+3+31902+_000156_hash+NULL
83365 +_000157_hash+ddebug_proc_write+3+18055+_000157_hash+NULL
83366 +_000158_hash+dev_config+3+8506+_000158_hash+NULL
83367 +_000159_hash+device_write+3+45156+_000159_hash+NULL
83368 +_000160_hash+devm_kzalloc+2+4966+_000160_hash+NULL
83369 +_000161_hash+devres_alloc+2+551+_000161_hash+NULL
83370 +_000162_hash+dfs_file_write+3+41196+_000162_hash+NULL
83371 +_000163_hash+direct_entry+3+38836+_000163_hash+NULL
83372 +_000164_hash+dispatch_proc_write+3+44320+_000164_hash+NULL
83373 +_000165_hash+diva_os_copy_from_user+4+7792+_000165_hash+NULL
83374 +_000166_hash+dlm_alloc_pagevec+1+54296+_000166_hash+NULL
83375 +_000167_hash+dlmfs_file_read+3+28385+_000167_hash+NULL
83376 +_000168_hash+dlmfs_file_write+3+6892+_000168_hash+NULL
83377 +_000169_hash+dm_read+3+15674+_000169_hash+NULL
83378 +_000170_hash+dm_write+3+2513+_000170_hash+NULL
83379 +_000171_hash+__dn_setsockopt+5+13060+_000171_hash+NULL
83380 +_000172_hash+dns_query+3+9676+_000172_hash+NULL
83381 +_000173_hash+dns_resolver_instantiate+3+63314+_000173_hash+NULL
83382 +_000174_hash+do_add_counters+3+3992+_000174_hash+NULL
83383 +_000175_hash+__do_config_autodelink+3+58763+_000175_hash+NULL
83384 +_000176_hash+do_ip_setsockopt+5+41852+_000176_hash+NULL
83385 +_000177_hash+do_ipv6_setsockopt+5+18215+_000177_hash+NULL
83386 +_000178_hash+do_ip_vs_set_ctl+4+48641+_000178_hash+NULL
83387 +_000179_hash+do_kimage_alloc+3+64827+_000179_hash+NULL
83388 +_000180_hash+do_register_entry+4+29478+_000180_hash+NULL
83389 +_000181_hash+do_tty_write+5+44896+_000181_hash+NULL
83390 +_000182_hash+do_update_counters+4+2259+_000182_hash+NULL
83391 +_000183_hash+dsp_write+2+46218+_000183_hash+NULL
83392 +_000184_hash+dup_to_netobj+3+26363+_000184_hash+NULL
83393 +_000185_hash+dvb_aplay+3+56296+_000185_hash+NULL
83394 +_000186_hash+dvb_ca_en50221_io_write+3+43533+_000186_hash+NULL
83395 +_000187_hash+dvbdmx_write+3+19423+_000187_hash+NULL
83396 +_000188_hash+dvb_play+3+50814+_000188_hash+NULL
83397 +_000189_hash+dw210x_op_rw+6+39915+_000189_hash+NULL
83398 +_000190_hash+dwc3_link_state_write+3+12641+_000190_hash+NULL
83399 +_000191_hash+dwc3_mode_write+3+51997+_000191_hash+NULL
83400 +_000192_hash+dwc3_testmode_write+3+30516+_000192_hash+NULL
83401 +_000193_hash+ecryptfs_copy_filename+4+11868+_000193_hash+NULL
83402 +_000194_hash+ecryptfs_miscdev_write+3+26847+_000194_hash+NULL
83403 +_000195_hash+ecryptfs_send_miscdev+2+64816+_000195_hash+NULL
83404 +_000196_hash+efx_tsoh_heap_alloc+2+58545+_000196_hash+NULL
83405 +_000197_hash+emi26_writememory+4+57908+_000197_hash+NULL
83406 +_000198_hash+emi62_writememory+4+29731+_000198_hash+NULL
83407 +_000199_hash+encrypted_instantiate+3+3168+_000199_hash+NULL
83408 +_000200_hash+encrypted_update+3+13414+_000200_hash+NULL
83409 +_000201_hash+ep0_write+3+14536+_001328_hash+NULL+nohasharray
83410 +_000202_hash+ep_read+3+58813+_000202_hash+NULL
83411 +_000203_hash+ep_write+3+59008+_000203_hash+NULL
83412 +_000204_hash+erst_dbg_write+3+46715+_000204_hash+NULL
83413 +_000205_hash+esp_alloc_tmp+2+40558+_000205_hash+NULL
83414 +_000206_hash+exofs_read_lookup_dev_table+3+17733+_000206_hash+NULL
83415 +_000207_hash+ext4_kvmalloc+1+14796+_000207_hash+NULL
83416 +_000208_hash+ezusb_writememory+4+45976+_000208_hash+NULL
83417 +_000209_hash+fanotify_write+3+64623+_000209_hash+NULL
83418 +_000210_hash+fd_copyin+3+56247+_000210_hash+NULL
83419 +_000211_hash+ffs_epfile_io+3+64886+_000211_hash+NULL
83420 +_000212_hash+ffs_prepare_buffer+2+59892+_000212_hash+NULL
83421 +_000213_hash+f_hidg_write+3+7932+_000213_hash+NULL
83422 +_000214_hash+file_read_actor+4+1401+_000214_hash+NULL
83423 +_000215_hash+fill_write_buffer+3+3142+_000215_hash+NULL
83424 +_000216_hash+fl_create+5+56435+_000216_hash+NULL
83425 +_000217_hash+ftdi_elan_write+3+57309+_000217_hash+NULL
83426 +_000218_hash+fuse_conn_limit_write+3+30777+_000218_hash+NULL
83427 +_000219_hash+fw_iso_buffer_init+3+54582+_000219_hash+NULL
83428 +_000220_hash+garmin_write_bulk+3+58191+_000220_hash+NULL
83429 +_000221_hash+garp_attr_create+3+3883+_000221_hash+NULL
83430 +_000222_hash+get_arg+3+5694+_000222_hash+NULL
83431 +_000223_hash+getdqbuf+1+62908+_000223_hash+NULL
83432 +_000224_hash+get_fdb_entries+3+41916+_000224_hash+NULL
83433 +_000225_hash+get_indirect_ea+4+51869+_000225_hash+NULL
83434 +_000226_hash+get_registers+3+26187+_000226_hash+NULL
83435 +_000227_hash+get_scq+2+10897+_000227_hash+NULL
83436 +_000228_hash+get_server_iovec+2+16804+_000228_hash+NULL
83437 +_000229_hash+get_ucode_user+3+38202+_000229_hash+NULL
83438 +_000230_hash+get_user_cpu_mask+2+14861+_000230_hash+NULL
83439 +_000231_hash+gfs2_alloc_sort_buffer+1+18275+_000231_hash+NULL
83440 +_000232_hash+gfs2_glock_nq_m+1+20347+_000232_hash+NULL
83441 +_000233_hash+gigaset_initcs+2+43753+_000233_hash+NULL
83442 +_000234_hash+gigaset_initdriver+2+1060+_000234_hash+NULL
83443 +_000235_hash+gs_alloc_req+2+58883+_000235_hash+NULL
83444 +_000236_hash+gs_buf_alloc+2+25067+_000236_hash+NULL
83445 +_000237_hash+gsm_data_alloc+3+42437+_000237_hash+NULL
83446 +_000238_hash+gss_pipe_downcall+3+23182+_000238_hash+NULL
83447 +_000239_hash+handle_request+9+10024+_000239_hash+NULL
83448 +_000240_hash+hash_new+1+62224+_000240_hash+NULL
83449 +_000241_hash+hashtab_create+3+33769+_000241_hash+NULL
83450 +_000242_hash+hcd_buffer_alloc+2+27495+_000242_hash+NULL
83451 +_000243_hash+hci_sock_setsockopt+5+28993+_000243_hash+NULL
83452 +_000244_hash+heap_init+2+49617+_000244_hash+NULL
83453 +_000245_hash+hest_ghes_dev_register+1+46766+_000245_hash+NULL
83454 +_000246_hash+hidraw_get_report+3+45609+_000246_hash+NULL
83455 +_000247_hash+hidraw_report_event+3+49578+_000509_hash+NULL+nohasharray
83456 +_000248_hash+hidraw_send_report+3+23449+_000248_hash+NULL
83457 +_000249_hash+hpfs_translate_name+3+41497+_000249_hash+NULL
83458 +_000250_hash+hysdn_conf_write+3+52145+_000250_hash+NULL
83459 +_000251_hash+hysdn_log_write+3+48694+_000251_hash+NULL
83460 +_000252_hash+__i2400mu_send_barker+3+23652+_000252_hash+NULL
83461 +_000253_hash+i2cdev_read+3+1206+_000253_hash+NULL
83462 +_000254_hash+i2cdev_write+3+23310+_000254_hash+NULL
83463 +_000255_hash+i2o_parm_field_get+5+34477+_000255_hash+NULL
83464 +_000256_hash+i2o_parm_table_get+6+61635+_000256_hash+NULL
83465 +_000257_hash+ib_copy_from_udata+3+59502+_000257_hash+NULL
83466 +_000258_hash+ib_ucm_alloc_data+3+36885+_000258_hash+NULL
83467 +_000259_hash+ib_umad_write+3+47993+_000259_hash+NULL
83468 +_000260_hash+ib_uverbs_unmarshall_recv+5+12251+_000260_hash+NULL
83469 +_000261_hash+icn_writecmd+2+38629+_000261_hash+NULL
83470 +_000262_hash+ide_driver_proc_write+3+32493+_000262_hash+NULL
83471 +_000263_hash+ide_settings_proc_write+3+35110+_000263_hash+NULL
83472 +_000264_hash+idetape_chrdev_write+3+53976+_000264_hash+NULL
83473 +_000265_hash+idmap_pipe_downcall+3+14591+_000265_hash+NULL
83474 +_000266_hash+ieee80211_build_probe_req+7-5+27660+_000266_hash+NULL
83475 +_000267_hash+ieee80211_if_write+3+34894+_000267_hash+NULL
83476 +_000268_hash+if_write+3+51756+_000268_hash+NULL
83477 +_000269_hash+ilo_write+3+64378+_000269_hash+NULL
83478 +_000270_hash+ima_write_policy+3+40548+_000270_hash+NULL
83479 +_000271_hash+init_data_container+1+60709+_000271_hash+NULL
83480 +_000272_hash+init_send_hfcd+1+34586+_000272_hash+NULL
83481 +_000273_hash+insert_dent+7+65034+_000273_hash+NULL
83482 +_000274_hash+interpret_user_input+2+19393+_000274_hash+NULL
83483 +_000275_hash+int_proc_write+3+39542+_000275_hash+NULL
83484 +_000276_hash+ioctl_private_iw_point+7+1273+_000276_hash+NULL
83485 +_000277_hash+iov_iter_copy_from_user+4+31942+_000277_hash+NULL
83486 +_000278_hash+iov_iter_copy_from_user_atomic+4+56368+_000278_hash+NULL
83487 +_000279_hash+iowarrior_write+3+18604+_000279_hash+NULL
83488 +_000280_hash+ipc_alloc+1+1192+_000280_hash+NULL
83489 +_000281_hash+ipc_rcu_alloc+1+21208+_000281_hash+NULL
83490 +_000282_hash+ip_options_get_from_user+4+64958+_000282_hash+NULL
83491 +_000283_hash+ipv6_renew_option+3+38813+_000283_hash+NULL
83492 +_000284_hash+ip_vs_conn_fill_param_sync+6+29771+_002404_hash+NULL+nohasharray
83493 +_000285_hash+ip_vs_create_timeout_table+2+64478+_000285_hash+NULL
83494 +_000286_hash+ipw_queue_tx_init+3+49161+_000286_hash+NULL
83495 +_000287_hash+irda_setsockopt+5+19824+_000287_hash+NULL
83496 +_000288_hash+irias_new_octseq_value+2+13596+_003296_hash+NULL+nohasharray
83497 +_000289_hash+ir_lirc_transmit_ir+3+64403+_000289_hash+NULL
83498 +_000290_hash+irnet_ctrl_write+3+24139+_000290_hash+NULL
83499 +_000291_hash+isdn_add_channels+3+40905+_000291_hash+NULL
83500 +_000292_hash+isdn_ppp_fill_rq+2+41428+_000292_hash+NULL
83501 +_000293_hash+isdn_ppp_write+4+29109+_000293_hash+NULL
83502 +_000294_hash+isdn_read+3+50021+_000294_hash+NULL
83503 +_000295_hash+isdn_v110_open+3+2418+_000295_hash+NULL
83504 +_000296_hash+isdn_writebuf_stub+4+52383+_000296_hash+NULL
83505 +_000297_hash+islpci_mgt_transmit+5+34133+_000297_hash+NULL
83506 +_000298_hash+iso_callback+3+43208+_000298_hash+NULL
83507 +_000299_hash+iso_packets_buffer_init+3+29061+_000299_hash+NULL
83508 +_000300_hash+it821x_firmware_command+3+8628+_000300_hash+NULL
83509 +_000301_hash+ivtv_buf_copy_from_user+4+25502+_000301_hash+NULL
83510 +_000302_hash+iwch_alloc_fastreg_pbl+2+40153+_000302_hash+NULL
83511 +_000303_hash+iwl_calib_set+3+34400+_002188_hash+NULL+nohasharray
83512 +_000304_hash+jbd2_journal_init_revoke_table+1+36336+_000304_hash+NULL
83513 +_000305_hash+jffs2_alloc_full_dirent+1+60179+_001111_hash+NULL+nohasharray
83514 +_000306_hash+journal_init_revoke_table+1+56331+_000306_hash+NULL
83515 +_000307_hash+kcalloc+1-2+27770+_000307_hash+NULL
83516 +_000309_hash+keyctl_instantiate_key_common+4+47889+_000309_hash+NULL
83517 +_000310_hash+keyctl_update_key+3+26061+_000310_hash+NULL
83518 +_000311_hash+__kfifo_alloc+2-3+22173+_000311_hash+NULL
83519 +_000313_hash+kfifo_copy_from_user+3+5091+_000313_hash+NULL
83520 +_000314_hash+kmalloc_node+1+50163+_003293_hash+NULL+nohasharray
83521 +_000315_hash+kmalloc_parameter+1+65279+_000315_hash+NULL
83522 +_000316_hash+kmem_alloc+1+31920+_000316_hash+NULL
83523 +_000317_hash+kobj_map+2-3+9566+_000317_hash+NULL
83524 +_000319_hash+kone_receive+4+4690+_000319_hash+NULL
83525 +_000320_hash+kone_send+4+63435+_000320_hash+NULL
83526 +_000321_hash+krealloc+2+14908+_000321_hash+NULL
83527 +_000322_hash+kvmalloc+1+32646+_000322_hash+NULL
83528 +_000323_hash+kvm_read_guest_atomic+4+10765+_000323_hash+NULL
83529 +_000324_hash+kvm_read_guest_cached+4+39666+_000324_hash+NULL
83530 +_000325_hash+kvm_read_guest_page+5+18074+_000325_hash+NULL
83531 +_000326_hash+kzalloc+1+54740+_000326_hash+NULL
83532 +_000327_hash+l2cap_sock_setsockopt+5+50207+_000327_hash+NULL
83533 +_000328_hash+l2cap_sock_setsockopt_old+4+29346+_000328_hash+NULL
83534 +_000329_hash+lane2_associate_req+4+45398+_000329_hash+NULL
83535 +_000330_hash+lbs_debugfs_write+3+48413+_000330_hash+NULL
83536 +_000331_hash+lcd_write+3+14857+_000331_hash+&_000014_hash
83537 +_000332_hash+ldm_frag_add+2+5611+_000332_hash+NULL
83538 +_000333_hash+__lgread+4+31668+_000333_hash+NULL
83539 +_000334_hash+libipw_alloc_txb+1-3-2+27579+_000334_hash+NULL
83540 +_000335_hash+link_send_sections_long+4+46556+_000335_hash+NULL
83541 +_000336_hash+listxattr+3+12769+_000336_hash+NULL
83542 +_000337_hash+LoadBitmap+2+19658+_000337_hash+NULL
83543 +_000338_hash+load_msg+2+95+_000338_hash+NULL
83544 +_000339_hash+lpfc_debugfs_dif_err_write+3+17424+_000339_hash+NULL
83545 +_000340_hash+lp_write+3+9511+_000340_hash+NULL
83546 +_000341_hash+mb_cache_create+2+17307+_000341_hash+NULL
83547 +_000342_hash+mce_write+3+26201+_000342_hash+NULL
83548 +_000343_hash+mcs7830_get_reg+3+33308+_000343_hash+NULL
83549 +_000344_hash+mcs7830_set_reg+3+31413+_000344_hash+NULL
83550 +_000345_hash+memcpy_fromiovec+3+55247+_000345_hash+NULL
83551 +_000346_hash+memcpy_fromiovecend+3-4+2707+_000346_hash+NULL
83552 +_000348_hash+mempool_kmalloc+2+53831+_000348_hash+NULL
83553 +_000349_hash+mempool_resize+2+47983+_001821_hash+NULL+nohasharray
83554 +_000350_hash+mem_rw+3+22085+_000350_hash+NULL
83555 +_000351_hash+mgmt_control+3+7349+_000351_hash+NULL
83556 +_000352_hash+mgmt_pending_add+5+46976+_000352_hash+NULL
83557 +_000353_hash+mlx4_ib_alloc_fast_reg_page_list+2+46119+_000353_hash+NULL
83558 +_000354_hash+mmc_alloc_sg+1+21504+_000354_hash+NULL
83559 +_000355_hash+mmc_send_bus_test+4+18285+_000355_hash+NULL
83560 +_000356_hash+mmc_send_cxd_data+5+38655+_000356_hash+NULL
83561 +_000357_hash+module_alloc_update_bounds+1+47205+_000357_hash+NULL
83562 +_000358_hash+move_addr_to_kernel+2+32673+_000358_hash+NULL
83563 +_000359_hash+mpi_alloc_limb_space+1+23190+_000359_hash+NULL
83564 +_000360_hash+mpi_resize+2+44674+_000360_hash+NULL
83565 +_000361_hash+mptctl_getiocinfo+2+28545+_000361_hash+NULL
83566 +_000362_hash+mtdchar_readoob+4+31200+_000362_hash+NULL
83567 +_000363_hash+mtdchar_write+3+56831+_002688_hash+NULL+nohasharray
83568 +_000364_hash+mtdchar_writeoob+4+3393+_000364_hash+NULL
83569 +_000365_hash+mtd_device_parse_register+5+5024+_000365_hash+NULL
83570 +_000366_hash+mtf_test_write+3+18844+_000366_hash+NULL
83571 +_000367_hash+mtrr_write+3+59622+_000367_hash+NULL
83572 +_000368_hash+musb_test_mode_write+3+33518+_000368_hash+NULL
83573 +_000369_hash+mwifiex_get_common_rates+3+17131+_000369_hash+NULL
83574 +_000370_hash+mwifiex_update_curr_bss_params+5+16908+_000370_hash+NULL
83575 +_000371_hash+nand_bch_init+2-3+16280+_001341_hash+NULL+nohasharray
83576 +_000373_hash+ncp_file_write+3+3813+_000373_hash+NULL
83577 +_000374_hash+ncp__vol2io+5+4804+_000374_hash+NULL
83578 +_000375_hash+nes_alloc_fast_reg_page_list+2+33523+_000375_hash+NULL
83579 +_000376_hash+nfc_targets_found+3+29886+_000376_hash+NULL
83580 +_000377_hash+nfs4_acl_new+1+49806+_000377_hash+NULL
83581 +_000378_hash+nfs4_write_cached_acl+4+15070+_000378_hash+NULL
83582 +_000379_hash+nfsd_cache_update+3+59574+_000379_hash+NULL
83583 +_000380_hash+nfsd_symlink+6+63442+_000380_hash+NULL
83584 +_000381_hash+nfs_idmap_get_desc+2-4+42990+_000381_hash+NULL
83585 +_000383_hash+nfs_readdir_make_qstr+3+12509+_000383_hash+NULL
83586 +_000384_hash+note_last_dentry+3+12285+_000384_hash+NULL
83587 +_000385_hash+ntfs_copy_from_user+3-5+15072+_000385_hash+NULL
83588 +_000387_hash+__ntfs_copy_from_user_iovec_inatomic+3-4+38153+_000387_hash+NULL
83589 +_000389_hash+ntfs_ucstonls+3+23097+_000389_hash+NULL
83590 +_000390_hash+nvme_alloc_iod+1+56027+_000390_hash+NULL
83591 +_000391_hash+nvram_write+3+3894+_000391_hash+NULL
83592 +_000392_hash+o2hb_debug_create+4+18744+_000392_hash+NULL
83593 +_000393_hash+o2net_send_message_vec+4+879+_001792_hash+NULL+nohasharray
83594 +_000394_hash+ocfs2_control_cfu+2+37750+_000394_hash+NULL
83595 +_000395_hash+oom_adjust_write+3+41116+_000395_hash+NULL
83596 +_000396_hash+oom_score_adj_write+3+42594+_000396_hash+NULL
83597 +_000397_hash+opera1_xilinx_rw+5+31453+_000397_hash+NULL
83598 +_000398_hash+oprofilefs_ulong_from_user+3+57251+_000398_hash+NULL
83599 +_000399_hash+opticon_write+4+60775+_000399_hash+NULL
83600 +_000400_hash+orig_node_add_if+2+32833+_000400_hash+NULL
83601 +_000401_hash+orig_node_del_if+2+28371+_000401_hash+NULL
83602 +_000402_hash+p9_check_zc_errors+4+15534+_000402_hash+NULL
83603 +_000403_hash+packet_buffer_init+2+1607+_000403_hash+NULL
83604 +_000404_hash+packet_setsockopt+5+17662+_000404_hash+NULL
83605 +_000405_hash+parse_command+2+37079+_000405_hash+NULL
83606 +_000406_hash+pcbit_writecmd+2+12332+_000406_hash+NULL
83607 +_000407_hash+pcmcia_replace_cis+3+57066+_000407_hash+NULL
83608 +_000408_hash+pgctrl_write+3+50453+_000408_hash+NULL
83609 +_000409_hash+pg_write+3+40766+_000409_hash+NULL
83610 +_000410_hash+pidlist_allocate+1+64404+_000410_hash+NULL
83611 +_000411_hash+pipe_iov_copy_from_user+3+23102+_000411_hash+NULL
83612 +_000412_hash+pipe_iov_copy_to_user+3+3447+_000412_hash+NULL
83613 +_000413_hash+pkt_add+3+39897+_000413_hash+NULL
83614 +_000414_hash+pktgen_if_write+3+55628+_000414_hash+NULL
83615 +_000415_hash+platform_device_add_data+3+310+_000415_hash+NULL
83616 +_000416_hash+platform_device_add_resources+3+13289+_000416_hash+NULL
83617 +_000417_hash+pm_qos_power_write+3+52513+_000417_hash+NULL
83618 +_000418_hash+pnpbios_proc_write+3+19758+_000418_hash+NULL
83619 +_000419_hash+pool_allocate+3+42012+_000419_hash+NULL
83620 +_000420_hash+posix_acl_alloc+1+48063+_000420_hash+NULL
83621 +_000421_hash+ppp_cp_parse_cr+4+5214+_000421_hash+NULL
83622 +_000422_hash+ppp_write+3+34034+_000422_hash+NULL
83623 +_000423_hash+pp_read+3+33210+_000423_hash+NULL
83624 +_000424_hash+pp_write+3+39554+_000424_hash+NULL
83625 +_000425_hash+printer_req_alloc+2+62687+_001807_hash+NULL+nohasharray
83626 +_000426_hash+printer_write+3+60276+_000426_hash+NULL
83627 +_000427_hash+prism2_set_genericelement+3+29277+_000427_hash+NULL
83628 +_000428_hash+__probe_kernel_read+3+61119+_000428_hash+NULL
83629 +_000429_hash+__probe_kernel_write+3+29842+_000429_hash+NULL
83630 +_000430_hash+proc_coredump_filter_write+3+25625+_000430_hash+NULL
83631 +_000431_hash+_proc_do_string+2+6376+_000431_hash+NULL
83632 +_000432_hash+process_vm_rw_pages+5-6+15954+_000432_hash+NULL
83633 +_000434_hash+proc_loginuid_write+3+63648+_000434_hash+NULL
83634 +_000435_hash+proc_pid_attr_write+3+63845+_000435_hash+NULL
83635 +_000436_hash+proc_scsi_devinfo_write+3+32064+_000436_hash+NULL
83636 +_000437_hash+proc_scsi_write+3+29142+_000437_hash+NULL
83637 +_000438_hash+proc_scsi_write_proc+3+267+_000438_hash+NULL
83638 +_000439_hash+pstore_mkfile+5+50830+_000439_hash+NULL
83639 +_000440_hash+pti_char_write+3+60960+_000440_hash+NULL
83640 +_000441_hash+ptrace_writedata+4+45021+_000441_hash+NULL
83641 +_000442_hash+pt_write+3+40159+_000442_hash+NULL
83642 +_000443_hash+pvr2_ioread_set_sync_key+3+59882+_000443_hash+NULL
83643 +_000444_hash+pvr2_stream_buffer_count+2+33719+_000444_hash+NULL
83644 +_000445_hash+qdisc_class_hash_alloc+1+18262+_000445_hash+NULL
83645 +_000446_hash+r3964_write+4+57662+_000446_hash+NULL
83646 +_000447_hash+raw_seticmpfilter+3+6888+_000447_hash+NULL
83647 +_000448_hash+raw_setsockopt+5+45800+_000448_hash+NULL
83648 +_000449_hash+rawv6_seticmpfilter+5+12137+_000449_hash+NULL
83649 +_000450_hash+ray_cs_essid_proc_write+3+17875+_000450_hash+NULL
83650 +_000451_hash+rbd_add+3+16366+_000451_hash+NULL
83651 +_000452_hash+rbd_snap_add+4+19678+_000452_hash+NULL
83652 +_000453_hash+rdma_set_ib_paths+3+45592+_000453_hash+NULL
83653 +_000454_hash+rds_page_copy_user+4+35691+_000454_hash+NULL
83654 +_000455_hash+read+3+9397+_000455_hash+NULL
83655 +_000456_hash+read_buf+2+20469+_000456_hash+NULL
83656 +_000457_hash+read_cis_cache+4+29735+_000457_hash+NULL
83657 +_000458_hash+realloc_buffer+2+25816+_000458_hash+NULL
83658 +_000459_hash+realloc_packet_buffer+2+25569+_000459_hash+NULL
83659 +_000460_hash+receive_DataRequest+3+9904+_000460_hash+NULL
83660 +_000461_hash+recent_mt_proc_write+3+8206+_000461_hash+NULL
83661 +_000462_hash+regmap_access_read_file+3+37223+_000462_hash+NULL
83662 +_000463_hash+regmap_bulk_write+4+59049+_000463_hash+NULL
83663 +_000464_hash+regmap_map_read_file+3+37685+_000464_hash+NULL
83664 +_000465_hash+regset_tls_set+4+18459+_000465_hash+NULL
83665 +_000466_hash+reg_w_buf+3+27724+_000466_hash+NULL
83666 +_000467_hash+reg_w_ixbuf+4+34736+_000467_hash+NULL
83667 +_000468_hash+remote_settings_file_write+3+22987+_000468_hash+NULL
83668 +_000469_hash+request_key_auth_new+3+38092+_000469_hash+NULL
83669 +_000470_hash+restore_i387_fxsave+2+17528+_000470_hash+NULL
83670 +_000471_hash+revalidate+2+19043+_000471_hash+NULL
83671 +_000472_hash+rfcomm_sock_setsockopt+5+18254+_000472_hash+NULL
83672 +_000473_hash+rndis_add_response+2+58544+_000473_hash+NULL
83673 +_000474_hash+rndis_set_oid+4+6547+_000474_hash+NULL
83674 +_000475_hash+rngapi_reset+3+34366+_002911_hash+NULL+nohasharray
83675 +_000476_hash+roccat_common_receive+4+53407+_000476_hash+NULL
83676 +_000477_hash+roccat_common_send+4+12284+_000477_hash+NULL
83677 +_000478_hash+rpc_malloc+2+43573+_000478_hash+NULL
83678 +_000479_hash+rt2x00debug_write_bbp+3+8212+_000479_hash+NULL
83679 +_000480_hash+rt2x00debug_write_csr+3+64753+_000480_hash+NULL
83680 +_000481_hash+rt2x00debug_write_eeprom+3+23091+_000481_hash+NULL
83681 +_000482_hash+rt2x00debug_write_rf+3+38195+_000482_hash+NULL
83682 +_000483_hash+rts51x_read_mem+4+26577+_000483_hash+NULL
83683 +_000484_hash+rts51x_read_status+4+11830+_000484_hash+NULL
83684 +_000485_hash+rts51x_write_mem+4+17598+_000485_hash+NULL
83685 +_000486_hash+rw_copy_check_uvector+3+34271+_000486_hash+NULL
83686 +_000487_hash+rxrpc_request_key+3+27235+_000487_hash+NULL
83687 +_000488_hash+rxrpc_server_keyring+3+16431+_000488_hash+NULL
83688 +_000489_hash+savemem+3+58129+_000489_hash+NULL
83689 +_000490_hash+sb16_copy_from_user+10-7-6+55836+_000490_hash+NULL
83690 +_000493_hash+sched_autogroup_write+3+10984+_000493_hash+NULL
83691 +_000494_hash+scsi_mode_select+6+37330+_000494_hash+NULL
83692 +_000495_hash+scsi_tgt_copy_sense+3+26933+_000495_hash+NULL
83693 +_000496_hash+sctp_auth_create_key+1+51641+_000496_hash+NULL
83694 +_000497_hash+sctp_getsockopt_delayed_ack+2+9232+_000497_hash+NULL
83695 +_000498_hash+sctp_getsockopt_local_addrs+2+25178+_000498_hash+NULL
83696 +_000499_hash+sctp_make_abort_user+3+29654+_000499_hash+NULL
83697 +_000500_hash+sctp_setsockopt_active_key+3+43755+_000500_hash+NULL
83698 +_000501_hash+sctp_setsockopt_adaptation_layer+3+26935+_001925_hash+NULL+nohasharray
83699 +_000502_hash+sctp_setsockopt_associnfo+3+51684+_000502_hash+NULL
83700 +_000503_hash+sctp_setsockopt_auth_chunk+3+30843+_000503_hash+NULL
83701 +_000504_hash+sctp_setsockopt_auth_key+3+3793+_000504_hash+NULL
83702 +_000505_hash+sctp_setsockopt_autoclose+3+5775+_000505_hash+NULL
83703 +_000506_hash+sctp_setsockopt_bindx+3+49870+_000506_hash+NULL
83704 +_000507_hash+__sctp_setsockopt_connectx+3+46949+_000507_hash+NULL
83705 +_000508_hash+sctp_setsockopt_context+3+31091+_000508_hash+NULL
83706 +_000509_hash+sctp_setsockopt_default_send_param+3+49578+_000509_hash+&_000247_hash
83707 +_000510_hash+sctp_setsockopt_delayed_ack+3+40129+_000510_hash+NULL
83708 +_000511_hash+sctp_setsockopt_del_key+3+42304+_002281_hash+NULL+nohasharray
83709 +_000512_hash+sctp_setsockopt_events+3+18862+_000512_hash+NULL
83710 +_000513_hash+sctp_setsockopt_hmac_ident+3+11687+_000513_hash+NULL
83711 +_000514_hash+sctp_setsockopt_initmsg+3+1383+_000514_hash+NULL
83712 +_000515_hash+sctp_setsockopt_maxburst+3+28041+_000515_hash+NULL
83713 +_000516_hash+sctp_setsockopt_maxseg+3+11829+_000516_hash+NULL
83714 +_000517_hash+sctp_setsockopt_peer_addr_params+3+734+_000517_hash+NULL
83715 +_000518_hash+sctp_setsockopt_peer_primary_addr+3+13440+_000518_hash+NULL
83716 +_000519_hash+sctp_setsockopt_rtoinfo+3+30941+_000519_hash+NULL
83717 +_000520_hash+security_context_to_sid_core+2+29248+_000520_hash+NULL
83718 +_000521_hash+sel_commit_bools_write+3+46077+_000521_hash+NULL
83719 +_000522_hash+sel_write_avc_cache_threshold+3+2256+_000522_hash+NULL
83720 +_000523_hash+sel_write_bool+3+46996+_000523_hash+NULL
83721 +_000524_hash+sel_write_checkreqprot+3+60774+_000524_hash+NULL
83722 +_000525_hash+sel_write_disable+3+10511+_000525_hash+NULL
83723 +_000526_hash+sel_write_enforce+3+48998+_000526_hash+NULL
83724 +_000527_hash+sel_write_load+3+63830+_000527_hash+NULL
83725 +_000528_hash+send_bulk_static_data+3+61932+_000528_hash+NULL
83726 +_000529_hash+send_control_msg+6+48498+_000529_hash+NULL
83727 +_000530_hash+set_aoe_iflist+2+42737+_000530_hash+NULL
83728 +_000531_hash+setkey_unaligned+3+39474+_000531_hash+NULL
83729 +_000532_hash+set_registers+3+53582+_000532_hash+NULL
83730 +_000533_hash+setsockopt+5+54539+_000533_hash+NULL
83731 +_000534_hash+setup_req+3+5848+_000534_hash+NULL
83732 +_000535_hash+setup_window+7+59178+_000535_hash+NULL
83733 +_000536_hash+setxattr+4+37006+_000536_hash+NULL
83734 +_000537_hash+sfq_alloc+1+2861+_000537_hash+NULL
83735 +_000538_hash+sg_kmalloc+1+50240+_000538_hash+NULL
83736 +_000539_hash+sgl_map_user_pages+2+30610+_000539_hash+NULL
83737 +_000540_hash+shash_setkey_unaligned+3+8620+_000540_hash+NULL
83738 +_000541_hash+shmem_xattr_alloc+2+61190+_000541_hash+NULL
83739 +_000542_hash+sierra_setup_urb+5+46029+_000542_hash+NULL
83740 +_000543_hash+simple_transaction_get+3+50633+_000543_hash+NULL
83741 +_000544_hash+simple_write_to_buffer+2-5+3122+_000544_hash+NULL
83742 +_000546_hash+sisusb_send_bulk_msg+3+17864+_000546_hash+NULL
83743 +_000547_hash+skb_add_data+3+48363+_000547_hash+NULL
83744 +_000548_hash+skb_do_copy_data_nocache+5+12465+_000548_hash+NULL
83745 +_000549_hash+sl_alloc_bufs+2+50380+_000549_hash+NULL
83746 +_000550_hash+sl_realloc_bufs+2+64086+_000550_hash+NULL
83747 +_000551_hash+smk_write_ambient+3+45691+_000551_hash+NULL
83748 +_000552_hash+smk_write_cipso+3+17989+_000552_hash+NULL
83749 +_000553_hash+smk_write_direct+3+46363+_000553_hash+NULL
83750 +_000554_hash+smk_write_doi+3+49621+_000554_hash+NULL
83751 +_000555_hash+smk_write_load_list+3+52280+_000555_hash+NULL
83752 +_000556_hash+smk_write_logging+3+2618+_000556_hash+NULL
83753 +_000557_hash+smk_write_netlbladdr+3+42525+_000557_hash+NULL
83754 +_000558_hash+smk_write_onlycap+3+14400+_000558_hash+NULL
83755 +_000559_hash+snd_ctl_elem_user_tlv+3+11695+_000559_hash+NULL
83756 +_000560_hash+snd_emu10k1_fx8010_read+5+9605+_000560_hash+NULL
83757 +_000561_hash+snd_emu10k1_synth_copy_from_user+3-5+9061+_000561_hash+NULL
83758 +_000563_hash+snd_gus_dram_poke+4+18525+_000563_hash+NULL
83759 +_000564_hash+snd_hdsp_playback_copy+5+20676+_000564_hash+NULL
83760 +_000565_hash+snd_info_entry_write+3+63474+_000565_hash+NULL
83761 +_000566_hash+snd_korg1212_copy_from+6+36169+_000566_hash+NULL
83762 +_000567_hash+snd_mem_proc_write+3+9786+_000567_hash+NULL
83763 +_000568_hash+snd_midi_channel_init_set+1+30092+_000568_hash+NULL
83764 +_000569_hash+snd_midi_event_new+1+9893+_000750_hash+NULL+nohasharray
83765 +_000570_hash+snd_opl4_mem_proc_write+5+9670+_000570_hash+NULL
83766 +_000571_hash+snd_pcm_aio_read+3+13900+_000571_hash+NULL
83767 +_000572_hash+snd_pcm_aio_write+3+28738+_000572_hash+NULL
83768 +_000573_hash+snd_pcm_oss_write1+3+10872+_000573_hash+NULL
83769 +_000574_hash+snd_pcm_oss_write2+3+27332+_000574_hash+NULL
83770 +_000575_hash+snd_rawmidi_kernel_write1+4+56847+_000575_hash+NULL
83771 +_000576_hash+snd_rme9652_playback_copy+5+20970+_000576_hash+NULL
83772 +_000577_hash+snd_sb_csp_load_user+3+45190+_000577_hash+NULL
83773 +_000578_hash+snd_usb_ctl_msg+8+8436+_000578_hash+NULL
83774 +_000579_hash+sock_bindtodevice+3+50942+_000579_hash+NULL
83775 +_000580_hash+sock_kmalloc+2+62205+_000580_hash+NULL
83776 +_000581_hash+spidev_write+3+44510+_000581_hash+NULL
83777 +_000582_hash+squashfs_read_table+3+16945+_000582_hash+NULL
83778 +_000583_hash+srpt_alloc_ioctx+2-3+51042+_000583_hash+NULL
83779 +_000585_hash+srpt_alloc_ioctx_ring+2+49330+_000585_hash+NULL
83780 +_000586_hash+st5481_setup_isocpipes+6-4+61340+_000586_hash+NULL
83781 +_000587_hash+sta_agg_status_write+3+45164+_000587_hash+NULL
83782 +_000588_hash+svc_setsockopt+5+36876+_000588_hash+NULL
83783 +_000589_hash+sys_add_key+4+61288+_000589_hash+NULL
83784 +_000590_hash+sys_modify_ldt+3+18824+_000590_hash+NULL
83785 +_000591_hash+sys_semtimedop+3+4486+_000591_hash+NULL
83786 +_000592_hash+sys_setdomainname+2+4373+_000592_hash+NULL
83787 +_000593_hash+sys_sethostname+2+42962+_000593_hash+NULL
83788 +_000594_hash+tda10048_writeregbulk+4+11050+_000594_hash+NULL
83789 +_000595_hash+tipc_log_resize+1+34803+_000595_hash+NULL
83790 +_000596_hash+tomoyo_write_self+3+45161+_000596_hash+NULL
83791 +_000597_hash+tower_write+3+8580+_000597_hash+NULL
83792 +_000598_hash+tpm_write+3+50798+_000598_hash+NULL
83793 +_000599_hash+trusted_instantiate+3+4710+_000599_hash+NULL
83794 +_000600_hash+trusted_update+3+12664+_000600_hash+NULL
83795 +_000601_hash+tt_changes_fill_buffer+3+62649+_000601_hash+NULL
83796 +_000602_hash+tty_buffer_alloc+2+45437+_000602_hash+NULL
83797 +_000603_hash+__tun_chr_ioctl+4+22300+_000603_hash+NULL
83798 +_000604_hash+ubi_more_leb_change_data+4+63534+_000604_hash+NULL
83799 +_000605_hash+ubi_more_update_data+4+39189+_000605_hash+NULL
83800 +_000606_hash+ubi_resize_volume+2+50172+_000606_hash+NULL
83801 +_000607_hash+udf_alloc_i_data+2+35786+_000607_hash+NULL
83802 +_000608_hash+uea_idma_write+3+64139+_000608_hash+NULL
83803 +_000609_hash+uea_request+4+47613+_000609_hash+NULL
83804 +_000610_hash+uea_send_modem_cmd+3+3888+_000610_hash+NULL
83805 +_000611_hash+uio_write+3+43202+_000611_hash+NULL
83806 +_000612_hash+um_idi_write+3+18293+_000612_hash+NULL
83807 +_000613_hash+us122l_ctl_msg+8+13330+_000613_hash+NULL
83808 +_000614_hash+usb_alloc_urb+1+43436+_000614_hash+NULL
83809 +_000615_hash+usblp_new_writeurb+2+22894+_000615_hash+NULL
83810 +_000616_hash+usblp_write+3+23178+_000616_hash+NULL
83811 +_000617_hash+usbtest_alloc_urb+3-5+34446+_000617_hash+NULL
83812 +_000619_hash+usbtmc_write+3+64340+_000619_hash+NULL
83813 +_000620_hash+user_instantiate+3+26131+_000620_hash+NULL
83814 +_000621_hash+user_update+3+41332+_000621_hash+NULL
83815 +_000622_hash+uvc_simplify_fraction+3+31303+_000622_hash+NULL
83816 +_000623_hash+uwb_rc_cmd_done+4+35892+_000623_hash+NULL
83817 +_000624_hash+uwb_rc_neh_grok_event+3+55799+_000624_hash+NULL
83818 +_000625_hash+v9fs_alloc_rdir_buf+2+42150+_000625_hash+NULL
83819 +_000626_hash+__vb2_perform_fileio+3+63033+_000626_hash+NULL
83820 +_000627_hash+vc_do_resize+3-4+48842+_000627_hash+NULL
83821 +_000629_hash+vcs_write+3+3910+_000629_hash+NULL
83822 +_000630_hash+vfd_write+3+14717+_000630_hash+NULL
83823 +_000631_hash+vga_arb_write+3+36112+_000631_hash+NULL
83824 +_000632_hash+vga_switcheroo_debugfs_write+3+33984+_000632_hash+NULL
83825 +_000633_hash+vhci_get_user+3+45039+_000633_hash+NULL
83826 +_000634_hash+video_proc_write+3+6724+_000634_hash+NULL
83827 +_000635_hash+vlsi_alloc_ring+3-4+57003+_000635_hash+NULL
83828 +_000637_hash+__vmalloc+1+61168+_000637_hash+NULL
83829 +_000638_hash+vmalloc_32+1+1135+_000638_hash+NULL
83830 +_000639_hash+vmalloc_32_user+1+37519+_000639_hash+NULL
83831 +_000640_hash+vmalloc_exec+1+36132+_000640_hash+NULL
83832 +_000641_hash+vmalloc_node+1+58700+_000641_hash+NULL
83833 +_000642_hash+__vmalloc_node_flags+1+30352+_000642_hash+NULL
83834 +_000643_hash+vmalloc_user+1+32308+_000643_hash+NULL
83835 +_000644_hash+vol_cdev_direct_write+3+20751+_000644_hash+NULL
83836 +_000645_hash+vp_request_msix_vectors+2+28849+_000645_hash+NULL
83837 +_000646_hash+vring_add_indirect+3-4+20737+_000646_hash+NULL
83838 +_000648_hash+vring_new_virtqueue+1+9671+_000648_hash+NULL
83839 +_000649_hash+vxge_os_dma_malloc+2+46184+_000649_hash+NULL
83840 +_000650_hash+vxge_os_dma_malloc_async+3+56348+_000650_hash+NULL
83841 +_000651_hash+wdm_write+3+53735+_000651_hash+NULL
83842 +_000652_hash+wiimote_hid_send+3+48528+_000652_hash+NULL
83843 +_000653_hash+wl1273_fm_fops_write+3+60621+_000653_hash+NULL
83844 +_000654_hash+wlc_phy_loadsampletable_nphy+3+64367+_000654_hash+NULL
83845 +_000655_hash+write+3+62671+_000655_hash+NULL
83846 +_000656_hash+write_flush+3+50803+_000656_hash+NULL
83847 +_000657_hash+write_rio+3+54837+_000657_hash+NULL
83848 +_000658_hash+x25_asy_change_mtu+2+26928+_000658_hash+NULL
83849 +_000659_hash+xdi_copy_from_user+4+8395+_000659_hash+NULL
83850 +_000660_hash+xfrm_dst_alloc_copy+3+3034+_000660_hash+NULL
83851 +_000661_hash+xfrm_user_policy+4+62573+_000661_hash+NULL
83852 +_000662_hash+xfs_attrmulti_attr_set+4+59346+_000662_hash+NULL
83853 +_000663_hash+xfs_handle_to_dentry+3+12135+_000663_hash+NULL
83854 +_000664_hash+__xip_file_write+3+2733+_000664_hash+NULL
83855 +_000665_hash+xprt_rdma_allocate+2+31372+_000665_hash+NULL
83856 +_000666_hash+zd_usb_iowrite16v_async+3+23984+_000666_hash+NULL
83857 +_000667_hash+zd_usb_read_fw+4+22049+_000667_hash+NULL
83858 +_000668_hash+zerocopy_sg_from_iovec+3+11828+_000668_hash+NULL
83859 +_000669_hash+zoran_write+3+22404+_000669_hash+NULL
83860 +_000671_hash+acpi_ex_allocate_name_string+2-1+7685+_002855_hash+NULL+nohasharray
83861 +_000672_hash+acpi_os_allocate_zeroed+1+37422+_000672_hash+NULL
83862 +_000673_hash+acpi_ut_initialize_buffer+2+47143+_002314_hash+NULL+nohasharray
83863 +_000674_hash+ad7879_spi_xfer+3+36311+_000674_hash+NULL
83864 +_000675_hash+add_new_gdb+3+27643+_000675_hash+NULL
83865 +_000676_hash+add_numbered_child+5+14273+_000676_hash+NULL
83866 +_000677_hash+add_res_range+4+21310+_000677_hash+NULL
83867 +_000678_hash+addtgt+3+54703+_000678_hash+NULL
83868 +_000679_hash+add_uuid+4+49831+_000679_hash+NULL
83869 +_000680_hash+afs_cell_alloc+2+24052+_000680_hash+NULL
83870 +_000681_hash+aggr_recv_addba_req_evt+4+38037+_000681_hash+NULL
83871 +_000682_hash+agp_create_memory+1+1075+_000682_hash+NULL
83872 +_000683_hash+agp_create_user_memory+1+62955+_000683_hash+NULL
83873 +_000684_hash+alg_setsockopt+5+20985+_000684_hash+NULL
83874 +_000685_hash+alloc_async+1+14208+_000685_hash+NULL
83875 +_000686_hash+___alloc_bootmem_nopanic+1+53626+_000686_hash+NULL
83876 +_000687_hash+alloc_buf+1+34532+_000687_hash+NULL
83877 +_000688_hash+alloc_chunk+1+49575+_000688_hash+NULL
83878 +_000689_hash+alloc_context+1+41283+_000689_hash+NULL
83879 +_000690_hash+alloc_ctrl_packet+1+44667+_000690_hash+NULL
83880 +_000691_hash+alloc_data_packet+1+46698+_000691_hash+NULL
83881 +_000692_hash+alloc_dca_provider+2+59670+_000692_hash+NULL
83882 +_000693_hash+__alloc_dev_table+2+54343+_000693_hash+NULL
83883 +_000694_hash+alloc_ep+1+17269+_000694_hash+NULL
83884 +_000695_hash+__alloc_extent_buffer+3+15093+_000695_hash+NULL
83885 +_000696_hash+alloc_group_attrs+2+9194+_000719_hash+NULL+nohasharray
83886 +_000697_hash+alloc_large_system_hash+2+64490+_000697_hash+NULL
83887 +_000698_hash+alloc_netdev_mqs+1+30030+_000698_hash+NULL
83888 +_000699_hash+__alloc_objio_seg+1+7203+_000699_hash+NULL
83889 +_000700_hash+alloc_ring+2-4+15345+_000700_hash+NULL
83890 +_000701_hash+alloc_ring+2-4+39151+_000701_hash+NULL
83891 +_000704_hash+alloc_session+1-2+64171+_000704_hash+NULL
83892 +_000708_hash+alloc_smp_req+1+51337+_000708_hash+NULL
83893 +_000709_hash+alloc_smp_resp+1+3566+_000709_hash+NULL
83894 +_000710_hash+alloc_ts_config+1+45775+_000710_hash+NULL
83895 +_000711_hash+alloc_upcall+2+62186+_000711_hash+NULL
83896 +_000712_hash+altera_drscan+2+48698+_000712_hash+NULL
83897 +_000713_hash+altera_irscan+2+62396+_000713_hash+NULL
83898 +_000714_hash+altera_set_dr_post+2+54291+_000714_hash+NULL
83899 +_000715_hash+altera_set_dr_pre+2+64862+_000715_hash+NULL
83900 +_000716_hash+altera_set_ir_post+2+20948+_000716_hash+NULL
83901 +_000717_hash+altera_set_ir_pre+2+54103+_000717_hash+NULL
83902 +_000718_hash+altera_swap_dr+2+50090+_000718_hash+NULL
83903 +_000719_hash+altera_swap_ir+2+9194+_000719_hash+&_000696_hash
83904 +_000720_hash+amd_create_gatt_pages+1+20537+_000720_hash+NULL
83905 +_000721_hash+aoechr_write+3+62883+_001352_hash+NULL+nohasharray
83906 +_000722_hash+applesmc_create_nodes+2+49392+_000722_hash+NULL
83907 +_000723_hash+array_zalloc+1-2+7519+_000723_hash+NULL
83908 +_000725_hash+arvo_sysfs_read+6+31617+_000725_hash+NULL
83909 +_000726_hash+arvo_sysfs_write+6+3311+_000726_hash+NULL
83910 +_000727_hash+asd_store_update_bios+4+10165+_000727_hash+NULL
83911 +_000728_hash+ata_host_alloc+2+46094+_000728_hash+NULL
83912 +_000729_hash+atalk_sendmsg+4+21677+_000729_hash+NULL
83913 +_000730_hash+ath6kl_cfg80211_connect_event+7-9-8+13443+_000730_hash+NULL
83914 +_000731_hash+ath6kl_mgmt_tx+9+21153+_000731_hash+NULL
83915 +_000732_hash+ath6kl_wmi_roam_tbl_event_rx+3+43440+_000732_hash+NULL
83916 +_000733_hash+ath6kl_wmi_send_mgmt_cmd+7+17347+_000733_hash+NULL
83917 +_000734_hash+ath_descdma_setup+5+12257+_000734_hash+NULL
83918 +_000735_hash+ath_rx_edma_init+2+65483+_000735_hash+NULL
83919 +_000736_hash+ati_create_gatt_pages+1+4722+_003185_hash+NULL+nohasharray
83920 +_000737_hash+au0828_init_isoc+2-3+61917+_000737_hash+NULL
83921 +_000739_hash+audit_init_entry+1+38644+_000739_hash+NULL
83922 +_000740_hash+ax25_sendmsg+4+62770+_000740_hash+NULL
83923 +_000741_hash+b1_alloc_card+1+36155+_000741_hash+NULL
83924 +_000742_hash+b43_nphy_load_samples+3+36481+_000742_hash+NULL
83925 +_000743_hash+bio_copy_user_iov+4+37660+_000743_hash+NULL
83926 +_000744_hash+__bio_map_kern+2-3+47379+_000744_hash+NULL
83927 +_000746_hash+blk_register_region+1-2+51424+_000746_hash+NULL
83928 +_000748_hash+bm_entry_write+3+28338+_000748_hash+NULL
83929 +_000749_hash+bm_realloc_pages+2+9431+_000749_hash+NULL
83930 +_000750_hash+bm_register_write+3+9893+_000750_hash+&_000569_hash
83931 +_000751_hash+bm_status_write+3+12964+_000751_hash+NULL
83932 +_000752_hash+br_mdb_rehash+2+42643+_000752_hash+NULL
83933 +_000753_hash+btrfs_copy_from_user+3+43806+_000753_hash+NULL
83934 +_000754_hash+btrfs_insert_delayed_dir_index+4+63720+_000754_hash+NULL
83935 +_000755_hash+__btrfs_map_block+3+49839+_000755_hash+NULL
83936 +_000756_hash+__c4iw_init_resource_fifo+3+8334+_000756_hash+NULL
83937 +_000757_hash+cache_downcall+3+13666+_000757_hash+NULL
83938 +_000758_hash+cache_slow_downcall+2+8570+_000758_hash+NULL
83939 +_000759_hash+ca_extend+2+64541+_000759_hash+NULL
83940 +_000760_hash+caif_seqpkt_sendmsg+4+22961+_000760_hash+NULL
83941 +_000761_hash+caif_stream_sendmsg+4+9110+_000761_hash+NULL
83942 +_000762_hash+carl9170_cmd_buf+3+950+_000762_hash+NULL
83943 +_000763_hash+cdev_add+2-3+38176+_000763_hash+NULL
83944 +_000765_hash+cdrom_read_cdda+4+50478+_000765_hash+NULL
83945 +_000766_hash+ceph_dns_resolve_name+1+62488+_000766_hash+NULL
83946 +_000767_hash+ceph_msgpool_get+2+54258+_000767_hash+NULL
83947 +_000768_hash+cfg80211_connect_result+4-6+56515+_000768_hash+NULL
83948 +_000770_hash+cfg80211_disconnected+4+57+_000770_hash+NULL
83949 +_000771_hash+cfg80211_inform_bss+8+19332+_000771_hash+NULL
83950 +_000772_hash+cfg80211_inform_bss_frame+4+41078+_000772_hash+NULL
83951 +_000773_hash+cfg80211_mlme_register_mgmt+5+19852+_000773_hash+NULL
83952 +_000774_hash+cfg80211_roamed_bss+4-6+50198+_000774_hash+NULL
83953 +_000776_hash+cifs_readdata_alloc+1+50318+_000776_hash+NULL
83954 +_000777_hash+cifs_readv_from_socket+3+19109+_000777_hash+NULL
83955 +_000778_hash+cifs_writedata_alloc+1+32880+_003119_hash+NULL+nohasharray
83956 +_000779_hash+cnic_alloc_dma+3+34641+_000779_hash+NULL
83957 +_000780_hash+configfs_write_file+3+61621+_000780_hash+NULL
83958 +_000781_hash+construct_key+3+11329+_000781_hash+NULL
83959 +_000782_hash+context_alloc+3+24645+_000782_hash+NULL
83960 +_000783_hash+copy_to_user+3+57835+_000783_hash+NULL
83961 +_000784_hash+create_attr_set+1+22861+_000784_hash+NULL
83962 +_000785_hash+create_bounce_buffer+3+39155+_000785_hash+NULL
83963 +_000786_hash+create_gpadl_header+2+19064+_000786_hash+NULL
83964 +_000787_hash+_create_sg_bios+4+31244+_000787_hash+NULL
83965 +_000788_hash+cryptd_alloc_instance+2-3+18048+_000788_hash+NULL
83966 +_000790_hash+crypto_ahash_setkey+3+55134+_000790_hash+NULL
83967 +_000791_hash+crypto_alloc_instance2+3+25277+_000791_hash+NULL
83968 +_000792_hash+crypto_shash_setkey+3+60483+_000792_hash+NULL
83969 +_000793_hash+cx231xx_init_bulk+3-2+47024+_000793_hash+NULL
83970 +_000794_hash+cx231xx_init_isoc+2-3+56453+_000794_hash+NULL
83971 +_000796_hash+cx231xx_init_vbi_isoc+2-3+28053+_000796_hash+NULL
83972 +_000798_hash+cxgb_alloc_mem+1+24007+_000798_hash+NULL
83973 +_000799_hash+cxgbi_device_portmap_create+3+25747+_000799_hash+NULL
83974 +_000800_hash+cxgbi_device_register+1-2+36746+_000800_hash+NULL
83975 +_000802_hash+__cxio_init_resource_fifo+3+23447+_000802_hash+NULL
83976 +_000803_hash+dccp_sendmsg+4+56058+_000803_hash+NULL
83977 +_000804_hash+ddp_make_gl+1+12179+_000804_hash+NULL
83978 +_000805_hash+depth_write+3+3021+_000805_hash+NULL
83979 +_000806_hash+dev_irnet_write+3+11398+_000806_hash+NULL
83980 +_000807_hash+dev_set_alias+3+50084+_000807_hash+NULL
83981 +_000808_hash+dev_write+3+7708+_000808_hash+NULL
83982 +_000809_hash+dfs_global_file_write+3+6112+_000809_hash+NULL
83983 +_000810_hash+dgram_sendmsg+4+45679+_000810_hash+NULL
83984 +_000811_hash+disconnect+4+32521+_000811_hash+NULL
83985 +_000812_hash+dma_attach+6-7+50831+_000812_hash+NULL
83986 +_000814_hash+dn_sendmsg+4+38390+_000814_hash+NULL
83987 +_000815_hash+do_dccp_setsockopt+5+54377+_003160_hash+NULL+nohasharray
83988 +_000816_hash+do_jffs2_setxattr+5+25910+_000816_hash+NULL
83989 +_000817_hash+do_msgsnd+4+1387+_000817_hash+NULL
83990 +_000818_hash+do_raw_setsockopt+5+55215+_000818_hash+NULL
83991 +_000819_hash+do_readv_writev+4+51849+_000819_hash+NULL
83992 +_000820_hash+do_sync+1+9604+_000820_hash+NULL
83993 +_000821_hash+dup_array+3+33551+_000821_hash+NULL
83994 +_000822_hash+dvb_audio_write+3+51275+_000822_hash+NULL
83995 +_000823_hash+dvb_ca_en50221_init+4+45718+_000823_hash+NULL
83996 +_000824_hash+dvb_video_write+3+754+_000824_hash+NULL
83997 +_000825_hash+econet_sendmsg+4+51430+_000825_hash+NULL
83998 +_000826_hash+ecryptfs_decode_and_decrypt_filename+5+10379+_000826_hash+NULL
83999 +_000827_hash+ecryptfs_encrypt_and_encode_filename+6+2109+_000827_hash+NULL
84000 +_000828_hash+ecryptfs_send_message_locked+2+31801+_000828_hash+NULL
84001 +_000829_hash+edac_device_alloc_ctl_info+1+5941+_000829_hash+NULL
84002 +_000830_hash+edac_mc_alloc+1+54846+_000830_hash+NULL
84003 +_000831_hash+edac_pci_alloc_ctl_info+1+63388+_000831_hash+NULL
84004 +_000832_hash+efivar_create_sysfs_entry+2+19485+_000832_hash+NULL
84005 +_000833_hash+em28xx_alloc_isoc+4+46892+_000833_hash+NULL
84006 +_000834_hash+enable_write+3+30456+_000834_hash+NULL
84007 +_000835_hash+enclosure_register+3+57412+_000835_hash+NULL
84008 +_000836_hash+ext4_kvzalloc+1+47605+_000836_hash+NULL
84009 +_000837_hash+extend_netdev_table+2+31680+_000837_hash+NULL
84010 +_000838_hash+__feat_register_sp+6+64712+_000838_hash+NULL
84011 +_000839_hash+__ffs_ep0_read_events+3+48868+_000839_hash+NULL
84012 +_000840_hash+ffs_ep0_write+3+9438+_000840_hash+NULL
84013 +_000841_hash+ffs_epfile_read+3+18775+_000841_hash+NULL
84014 +_000842_hash+ffs_epfile_write+3+48014+_000842_hash+NULL
84015 +_000843_hash+fib_info_hash_alloc+1+9075+_000843_hash+NULL
84016 +_000844_hash+fillonedir+3+41746+_000844_hash+NULL
84017 +_000845_hash+flexcop_device_kmalloc+1+54793+_000845_hash+NULL
84018 +_000846_hash+frame_alloc+4+15981+_000846_hash+NULL
84019 +_000847_hash+fw_node_create+2+9559+_000847_hash+NULL
84020 +_000848_hash+garmin_read_process+3+27509+_000848_hash+NULL
84021 +_000849_hash+garp_request_join+4+7471+_000849_hash+NULL
84022 +_000850_hash+get_derived_key+4+61100+_000850_hash+NULL
84023 +_000851_hash+get_entry+4+16003+_000851_hash+NULL
84024 +_000852_hash+get_free_de+2+33714+_000852_hash+NULL
84025 +_000853_hash+get_new_cssid+2+51665+_000853_hash+NULL
84026 +_000854_hash+getxattr+4+24398+_000854_hash+NULL
84027 +_000855_hash+gspca_dev_probe2+4+59833+_000855_hash+NULL
84028 +_000856_hash+hcd_alloc_coherent+5+55862+_000856_hash+NULL
84029 +_000857_hash+hci_sock_sendmsg+4+37420+_000857_hash+NULL
84030 +_000858_hash+hid_register_field+2-3+4874+_000858_hash+NULL
84031 +_000860_hash+hid_report_raw_event+4+7024+_000860_hash+NULL
84032 +_000861_hash+hpi_alloc_control_cache+1+35351+_000861_hash+NULL
84033 +_000862_hash+hugetlbfs_read_actor+2-5-4+34547+_000862_hash+NULL
84034 +_000865_hash+hvc_alloc+4+12579+_000865_hash+NULL
84035 +_000866_hash+__hwahc_dev_set_key+5+46328+_000866_hash+NULL
84036 +_000867_hash+i2400m_zrealloc_2x+3+54166+_001430_hash+NULL+nohasharray
84037 +_000868_hash+ib_alloc_device+1+26483+_000868_hash+NULL
84038 +_000869_hash+ib_create_send_mad+5+1196+_000869_hash+NULL
84039 +_000870_hash+ibmasm_new_command+2+25714+_000870_hash+NULL
84040 +_000871_hash+ib_send_cm_drep+3+50186+_000871_hash+NULL
84041 +_000872_hash+ib_send_cm_mra+4+60202+_000872_hash+NULL
84042 +_000873_hash+ib_send_cm_rtu+3+63138+_000873_hash+NULL
84043 +_000874_hash+ieee80211_key_alloc+3+19065+_000874_hash+NULL
84044 +_000875_hash+ieee80211_mgmt_tx+9+46860+_000875_hash+NULL
84045 +_000876_hash+ieee80211_send_probe_req+6-4+6924+_000876_hash+NULL
84046 +_000877_hash+if_writecmd+2+815+_000877_hash+NULL
84047 +_000878_hash+init_bch+1-2+64130+_000878_hash+NULL
84048 +_000880_hash+init_ipath+1+48187+_000880_hash+NULL
84049 +_000881_hash+init_list_set+2-3+39188+_000881_hash+NULL
84050 +_000883_hash+init_q+4+132+_000883_hash+NULL
84051 +_000884_hash+init_state+2+60165+_000884_hash+NULL
84052 +_000885_hash+init_tag_map+3+57515+_000885_hash+NULL
84053 +_000886_hash+input_ff_create+2+21240+_000886_hash+NULL
84054 +_000887_hash+input_mt_init_slots+2+31183+_000887_hash+NULL
84055 +_000888_hash+interfaces+2+38859+_000888_hash+NULL
84056 +_000889_hash+ioat2_alloc_ring+2+11172+_000889_hash+NULL
84057 +_000890_hash+ip_generic_getfrag+3-4+12187+_000890_hash+NULL
84058 +_000892_hash+ipr_alloc_ucode_buffer+1+40199+_000892_hash+NULL
84059 +_000893_hash+ip_set_alloc+1+57953+_000893_hash+NULL
84060 +_000894_hash+ipv6_flowlabel_opt+3+58135+_001125_hash+NULL+nohasharray
84061 +_000895_hash+ipv6_renew_options+5+28867+_000895_hash+NULL
84062 +_000896_hash+ipxrtr_route_packet+4+54036+_000896_hash+NULL
84063 +_000897_hash+irda_sendmsg+4+4388+_000897_hash+NULL
84064 +_000898_hash+irda_sendmsg_dgram+4+38563+_000898_hash+NULL
84065 +_000899_hash+irda_sendmsg_ultra+4+42047+_000899_hash+NULL
84066 +_000900_hash+irias_add_octseq_attrib+4+29983+_000900_hash+NULL
84067 +_000901_hash+irq_alloc_generic_chip+2+26650+_000901_hash+NULL
84068 +_000902_hash+irq_domain_add_linear+2+29236+_000902_hash+NULL
84069 +_000903_hash+iscsi_alloc_session+3+49390+_000903_hash+NULL
84070 +_000904_hash+iscsi_create_conn+2+50425+_000904_hash+NULL
84071 +_000905_hash+iscsi_create_endpoint+1+15193+_000905_hash+NULL
84072 +_000906_hash+iscsi_create_iface+5+38510+_000906_hash+NULL
84073 +_000907_hash+iscsi_decode_text_input+4+58292+_000907_hash+NULL
84074 +_000908_hash+iscsi_pool_init+2-4+54913+_000908_hash+NULL
84075 +_000910_hash+iscsit_dump_data_payload+2+38683+_000910_hash+NULL
84076 +_000911_hash+isdn_write+3+45863+_000911_hash+NULL
84077 +_000912_hash+isku_receive+4+54130+_000912_hash+NULL
84078 +_000913_hash+isku_send+4+41542+_000913_hash+NULL
84079 +_000914_hash+islpci_mgt_transaction+5+23610+_000914_hash+NULL
84080 +_000915_hash+iso_sched_alloc+1+13377+_002079_hash+NULL+nohasharray
84081 +_000916_hash+ivtv_v4l2_write+3+39226+_000916_hash+NULL
84082 +_000917_hash+iwl_trans_txq_alloc+3+36147+_000917_hash+NULL
84083 +_000918_hash+iwmct_fw_parser_init+4+37876+_000918_hash+NULL
84084 +_000919_hash+iwm_notif_send+6+12295+_000919_hash+NULL
84085 +_000920_hash+iwm_ntf_calib_res+3+11686+_000920_hash+NULL
84086 +_000921_hash+iwm_umac_set_config_var+4+17320+_000921_hash+NULL
84087 +_000922_hash+ixgbe_alloc_q_vector+3-5+45428+_000922_hash+NULL
84088 +_000924_hash+jbd2_journal_init_revoke+2+51088+_000924_hash+NULL
84089 +_000925_hash+jffs2_write_dirent+5+37311+_000925_hash+NULL
84090 +_000926_hash+journal_init_revoke+2+56933+_000926_hash+NULL
84091 +_000927_hash+keyctl_instantiate_key+3+41855+_000927_hash+NULL
84092 +_000928_hash+keyctl_instantiate_key_iov+3+16969+_000928_hash+NULL
84093 +_000929_hash+__kfifo_from_user+3+20399+_000929_hash+NULL
84094 +_000930_hash+kimage_crash_alloc+3+3233+_000930_hash+NULL
84095 +_000931_hash+kimage_normal_alloc+3+31140+_000931_hash+NULL
84096 +_000932_hash+kmem_realloc+2+37489+_000932_hash+NULL
84097 +_000933_hash+kmem_zalloc+1+11510+_000933_hash+NULL
84098 +_000934_hash+koneplus_send+4+18226+_000934_hash+NULL
84099 +_000935_hash+koneplus_sysfs_read+6+42792+_000935_hash+NULL
84100 +_000936_hash+kovaplus_send+4+10009+_000936_hash+NULL
84101 +_000937_hash+kvm_read_guest_page_mmu+6+37611+_000937_hash+NULL
84102 +_000938_hash+kvm_set_irq_routing+3+48704+_000938_hash+NULL
84103 +_000939_hash+kvm_write_guest_cached+4+11106+_000939_hash+NULL
84104 +_000940_hash+kvm_write_guest_page+5+63555+_002809_hash+NULL+nohasharray
84105 +_000941_hash+l2cap_skbuff_fromiovec+3-4+35003+_000941_hash+NULL
84106 +_000943_hash+l2tp_ip_sendmsg+4+50411+_000943_hash+NULL
84107 +_000944_hash+l2tp_session_create+1+25286+_000944_hash+NULL
84108 +_000945_hash+lc_create+3+48662+_000945_hash+NULL
84109 +_000946_hash+leaf_dealloc+3+29566+_000946_hash+NULL
84110 +_000947_hash+linear_conf+2+23485+_003314_hash+NULL+nohasharray
84111 +_000948_hash+lirc_buffer_init+2-3+53282+_000948_hash+NULL
84112 +_000950_hash+llc_ui_sendmsg+4+24987+_000950_hash+NULL
84113 +_000951_hash+lpfc_sli4_queue_alloc+3+62646+_000951_hash+NULL
84114 +_000952_hash+mce_request_packet+3+1073+_000952_hash+NULL
84115 +_000953_hash+mdiobus_alloc_size+1+52259+_000953_hash+NULL
84116 +_000954_hash+media_entity_init+2-4+15870+_001556_hash+NULL+nohasharray
84117 +_000956_hash+memstick_alloc_host+1+142+_000956_hash+NULL
84118 +_000957_hash+mesh_table_alloc+1+22305+_000957_hash+NULL
84119 +_000958_hash+mfd_add_devices+4+56753+_000958_hash+NULL
84120 +_000959_hash+mISDN_sock_sendmsg+4+41035+_000959_hash+NULL
84121 +_000960_hash+mmc_alloc_host+1+48097+_000960_hash+NULL
84122 +_000961_hash+mmc_test_alloc_mem+3+28102+_000961_hash+NULL
84123 +_000962_hash+mpi_alloc+1+18094+_000962_hash+NULL
84124 +_000963_hash+mpihelp_mul_karatsuba_case+5-3+23918+_000963_hash+NULL
84125 +_000964_hash+mpihelp_mul_n+4+16405+_000964_hash+NULL
84126 +_000965_hash+mpi_set_bit+2+15104+_000965_hash+NULL
84127 +_000966_hash+mpi_set_highbit+2+37327+_001420_hash+NULL+nohasharray
84128 +_000967_hash+mtd_concat_create+2+14416+_000967_hash+NULL
84129 +_000968_hash+mvumi_alloc_mem_resource+3+47750+_000968_hash+NULL
84130 +_000969_hash+mwifiex_11n_create_rx_reorder_tbl+4+63806+_000969_hash+NULL
84131 +_000970_hash+mwifiex_alloc_sdio_mpa_buffers+2-3+60961+_000970_hash+NULL
84132 +_000972_hash+mwl8k_cmd_set_beacon+4+23110+_000972_hash+NULL
84133 +_000973_hash+neigh_hash_alloc+1+17595+_000973_hash+NULL
84134 +_000974_hash+netlink_sendmsg+4+33708+_001172_hash+NULL+nohasharray
84135 +_000975_hash+netxen_alloc_sds_rings+2+13417+_000975_hash+NULL
84136 +_000976_hash+new_bind_ctl+2+35324+_000976_hash+NULL
84137 +_000977_hash+new_dir+3+31919+_000977_hash+NULL
84138 +_000978_hash+new_tape_buffer+2+32866+_000978_hash+NULL
84139 +_000979_hash+nfc_llcp_build_tlv+3+19536+_000979_hash+NULL
84140 +_000980_hash+nfc_llcp_send_i_frame+3+59130+_000980_hash+NULL
84141 +_000981_hash+nfs4_alloc_slots+1+2454+_000981_hash+NULL
84142 +_000982_hash+nfsctl_transaction_write+3+64800+_000982_hash+NULL
84143 +_000983_hash+nfs_idmap_request_key+3+30208+_000983_hash+NULL
84144 +_000984_hash+nfs_readdata_alloc+1+9990+_000984_hash+NULL
84145 +_000985_hash+nfs_writedata_alloc+1+62868+_000985_hash+NULL
84146 +_000986_hash+nl_pid_hash_zalloc+1+23314+_000986_hash+NULL
84147 +_000987_hash+nr_sendmsg+4+53656+_000987_hash+NULL
84148 +_000988_hash+nsm_create_handle+4+38060+_000988_hash+NULL
84149 +_000989_hash+ntfs_copy_from_user_iovec+3-6+49829+_000989_hash+NULL
84150 +_000991_hash+ntfs_file_buffered_write+4-6+41442+_000991_hash+NULL
84151 +_000993_hash+__ntfs_malloc+1+34022+_000993_hash+NULL
84152 +_000994_hash+nvme_alloc_queue+3+46865+_000994_hash+NULL
84153 +_000995_hash+ocfs2_acl_from_xattr+2+21604+_000995_hash+NULL
84154 +_000996_hash+ocfs2_control_message+3+19564+_000996_hash+NULL
84155 +_000997_hash+opera1_usb_i2c_msgxfer+4+64521+_000997_hash+NULL
84156 +_000998_hash+_ore_get_io_state+3+2166+_000998_hash+NULL
84157 +_000999_hash+orig_hash_add_if+2+53676+_000999_hash+NULL
84158 +_001000_hash+orig_hash_del_if+2+45080+_001000_hash+NULL
84159 +_001001_hash+orinoco_set_key+5-7+17878+_001001_hash+NULL
84160 +_001003_hash+osdmap_set_max_osd+2+57630+_001003_hash+NULL
84161 +_001004_hash+_osd_realloc_seg+3+54352+_001004_hash+NULL
84162 +_001005_hash+OSDSetBlock+2-4+38986+_001005_hash+NULL
84163 +_001007_hash+osst_execute+7-6+17607+_001007_hash+NULL
84164 +_001008_hash+osst_write+3+31581+_001008_hash+NULL
84165 +_001009_hash+otp_read+2-5-4+10594+_001009_hash+NULL
84166 +_001012_hash+ovs_vport_alloc+1+33475+_001012_hash+NULL
84167 +_001013_hash+packet_sendmsg_spkt+4+28885+_001013_hash+NULL
84168 +_001014_hash+pair_device+4+61175+_001708_hash+NULL+nohasharray
84169 +_001015_hash+pccard_store_cis+6+18176+_001015_hash+NULL
84170 +_001016_hash+pci_add_cap_save_buffer+3+3426+_001016_hash+NULL
84171 +_001017_hash+pcnet32_realloc_rx_ring+3+36598+_001017_hash+NULL
84172 +_001018_hash+pcnet32_realloc_tx_ring+3+38428+_001018_hash+NULL
84173 +_001019_hash+pcpu_mem_zalloc+1+22948+_001019_hash+NULL
84174 +_001020_hash+pep_sendmsg+4+62524+_001020_hash+NULL
84175 +_001021_hash+pfkey_sendmsg+4+47394+_001021_hash+NULL
84176 +_001022_hash+pidlist_resize+2+496+_001022_hash+NULL
84177 +_001023_hash+pin_code_reply+4+46510+_001023_hash+NULL
84178 +_001024_hash+ping_getfrag+3-4+8360+_001024_hash+NULL
84179 +_001026_hash+pipe_set_size+2+5204+_001026_hash+NULL
84180 +_001027_hash+pkt_bio_alloc+1+48284+_001027_hash+NULL
84181 +_001028_hash+platform_create_bundle+4-6+12785+_001028_hash+NULL
84182 +_001030_hash+play_iframe+3+8219+_001030_hash+NULL
84183 +_001031_hash+pm8001_store_update_fw+4+55716+_001031_hash+NULL
84184 +_001032_hash+pmcraid_alloc_sglist+1+9864+_001032_hash+NULL
84185 +_001033_hash+pn533_dep_link_up+5+7659+_001033_hash+NULL
84186 +_001034_hash+pnp_alloc+1+24869+_001419_hash+NULL+nohasharray
84187 +_001035_hash+pn_sendmsg+4+12640+_001035_hash+NULL
84188 +_001036_hash+pppoe_sendmsg+4+48039+_001036_hash+NULL
84189 +_001037_hash+pppol2tp_sendmsg+4+56420+_001037_hash+NULL
84190 +_001038_hash+process_vm_rw+3-5+47533+_001038_hash+NULL
84191 +_001040_hash+process_vm_rw_single_vec+1-2+26213+_001040_hash+NULL
84192 +_001042_hash+proc_write+3+51003+_001042_hash+NULL
84193 +_001043_hash+profile_load+3+58267+_001043_hash+NULL
84194 +_001044_hash+profile_remove+3+8556+_001044_hash+NULL
84195 +_001045_hash+profile_replace+3+14652+_001045_hash+NULL
84196 +_001046_hash+pscsi_get_bio+1+56103+_001046_hash+NULL
84197 +_001047_hash+pyra_send+4+12061+_001047_hash+NULL
84198 +_001048_hash+qc_capture+3+19298+_001048_hash+NULL
84199 +_001049_hash+qla4xxx_alloc_work+2+44813+_001049_hash+NULL
84200 +_001050_hash+qlcnic_alloc_msix_entries+2+46160+_001050_hash+NULL
84201 +_001051_hash+qlcnic_alloc_sds_rings+2+26795+_001051_hash+NULL
84202 +_001052_hash+queue_received_packet+5+9657+_001052_hash+NULL
84203 +_001053_hash+raw_send_hdrinc+4+58803+_001053_hash+NULL
84204 +_001054_hash+raw_sendmsg+4+23078+_001054_hash+&_000022_hash
84205 +_001055_hash+rawsock_sendmsg+4+60010+_001055_hash+NULL
84206 +_001056_hash+rawv6_send_hdrinc+3+35425+_001056_hash+NULL
84207 +_001057_hash+rb_alloc+1+3102+_001057_hash+NULL
84208 +_001058_hash+rbd_alloc_coll+1+33678+_001058_hash+NULL
84209 +_001059_hash+rbd_create_rw_ops+2+4605+_001059_hash+NULL
84210 +_001060_hash+rds_ib_inc_copy_to_user+3+55007+_001060_hash+NULL
84211 +_001061_hash+rds_iw_inc_copy_to_user+3+29214+_001061_hash+NULL
84212 +_001062_hash+rds_message_alloc+1+10517+_001062_hash+NULL
84213 +_001063_hash+rds_message_copy_from_user+3+45510+_001063_hash+NULL
84214 +_001064_hash+rds_message_inc_copy_to_user+3+26540+_001064_hash+NULL
84215 +_001065_hash+redrat3_transmit_ir+3+64244+_001065_hash+NULL
84216 +_001066_hash+regcache_rbtree_insert_to_block+5+58009+_001066_hash+NULL
84217 +_001067_hash+_regmap_raw_write+4+42652+_001067_hash+NULL
84218 +_001068_hash+regmap_register_patch+3+21681+_001068_hash+NULL
84219 +_001069_hash+relay_alloc_page_array+1+52735+_001069_hash+NULL
84220 +_001070_hash+remove_uuid+4+64505+_001070_hash+NULL
84221 +_001071_hash+reshape_ring+2+29147+_001071_hash+NULL
84222 +_001072_hash+RESIZE_IF_NEEDED+2+56286+_001072_hash+NULL
84223 +_001073_hash+resize_stripes+2+61650+_001073_hash+NULL
84224 +_001074_hash+rfcomm_sock_sendmsg+4+37661+_001074_hash+NULL
84225 +_001075_hash+rose_sendmsg+4+20249+_001075_hash+NULL
84226 +_001076_hash+rxrpc_send_data+5+21553+_001076_hash+NULL
84227 +_001077_hash+rxrpc_setsockopt+5+50286+_001077_hash+NULL
84228 +_001078_hash+saa7146_vmalloc_build_pgtable+2+19780+_001078_hash+NULL
84229 +_001079_hash+saa7164_buffer_alloc_user+2+9627+_001079_hash+NULL
84230 +_001081_hash+sco_send_frame+3+41815+_001081_hash+NULL
84231 +_001082_hash+scsi_host_alloc+2+63041+_001082_hash+NULL
84232 +_001083_hash+scsi_tgt_kspace_exec+8+9522+_001083_hash+NULL
84233 +_001084_hash+sctp_sendmsg+4+61919+_001084_hash+NULL
84234 +_001085_hash+sctp_setsockopt+5+44788+_001085_hash+NULL
84235 +_001086_hash+sctp_setsockopt_connectx+3+6073+_001086_hash+NULL
84236 +_001087_hash+sctp_setsockopt_connectx_old+3+22631+_001087_hash+NULL
84237 +_001088_hash+sctp_tsnmap_init+2+36446+_001088_hash+NULL
84238 +_001089_hash+sctp_user_addto_chunk+2-3+62047+_001089_hash+NULL
84239 +_001091_hash+security_context_to_sid+2+19839+_001091_hash+NULL
84240 +_001092_hash+security_context_to_sid_default+2+3492+_003366_hash+NULL+nohasharray
84241 +_001093_hash+security_context_to_sid_force+2+20724+_001093_hash+NULL
84242 +_001094_hash+selinux_transaction_write+3+59038+_001094_hash+NULL
84243 +_001095_hash+sel_write_access+3+51704+_001095_hash+NULL
84244 +_001096_hash+sel_write_create+3+11353+_001096_hash+NULL
84245 +_001097_hash+sel_write_member+3+28800+_001097_hash+NULL
84246 +_001098_hash+sel_write_relabel+3+55195+_001098_hash+NULL
84247 +_001099_hash+sel_write_user+3+45060+_001099_hash+NULL
84248 +_001100_hash+__seq_open_private+3+40715+_001100_hash+NULL
84249 +_001101_hash+serverworks_create_gatt_pages+1+46582+_001101_hash+NULL
84250 +_001102_hash+set_connectable+4+56458+_001102_hash+NULL
84251 +_001103_hash+set_dev_class+4+39645+_001697_hash+NULL+nohasharray
84252 +_001104_hash+set_discoverable+4+48141+_001104_hash+NULL
84253 +_001105_hash+setkey+3+14987+_001105_hash+NULL
84254 +_001106_hash+set_le+4+30581+_001106_hash+NULL
84255 +_001107_hash+set_link_security+4+4502+_001107_hash+NULL
84256 +_001108_hash+set_local_name+4+55757+_001108_hash+NULL
84257 +_001109_hash+set_powered+4+12129+_001109_hash+NULL
84258 +_001110_hash+set_ssp+4+62411+_001110_hash+NULL
84259 +_001111_hash+sg_build_sgat+3+60179+_001111_hash+&_000305_hash
84260 +_001112_hash+sg_read_oxfer+3+51724+_001112_hash+NULL
84261 +_001113_hash+shmem_xattr_set+4+11843+_001113_hash+NULL
84262 +_001114_hash+simple_alloc_urb+3+60420+_001114_hash+NULL
84263 +_001115_hash+sisusb_send_bridge_packet+2+11649+_001115_hash+NULL
84264 +_001116_hash+sisusb_send_packet+2+20891+_001116_hash+NULL
84265 +_001117_hash+skb_add_data_nocache+4+4682+_001117_hash+NULL
84266 +_001118_hash+skb_copy_datagram_from_iovec+2-5-4+52014+_001118_hash+NULL
84267 +_001121_hash+skb_copy_to_page_nocache+6+58624+_001121_hash+NULL
84268 +_001122_hash+sk_chk_filter+2+42095+_001122_hash+NULL
84269 +_001123_hash+skcipher_sendmsg+4+30290+_001123_hash+NULL
84270 +_001124_hash+sl_change_mtu+2+7396+_001124_hash+NULL
84271 +_001125_hash+slhc_init+1-2+58135+_001125_hash+&_000894_hash
84272 +_001127_hash+sm501_create_subdev+3-4+48668+_001127_hash+NULL
84273 +_001129_hash+smk_write_access+3+49561+_001129_hash+NULL
84274 +_001130_hash+snapshot_write+3+28351+_001130_hash+NULL
84275 +_001131_hash+snd_ac97_pcm_assign+2+30218+_001131_hash+NULL
84276 +_001132_hash+snd_card_create+4+64418+_001411_hash+NULL+nohasharray
84277 +_001133_hash+snd_emux_create_port+3+42533+_001133_hash+NULL
84278 +_001134_hash+snd_gus_dram_write+4+38784+_001134_hash+NULL
84279 +_001135_hash+snd_midi_channel_alloc_set+1+28153+_001135_hash+NULL
84280 +_001136_hash+_snd_pcm_lib_alloc_vmalloc_buffer+2+17820+_001136_hash+NULL
84281 +_001137_hash+snd_pcm_oss_sync1+2+45298+_001137_hash+NULL
84282 +_001138_hash+snd_pcm_oss_write+3+38108+_001138_hash+NULL
84283 +_001139_hash+snd_pcm_plugin_build+5+25505+_001139_hash+NULL
84284 +_001140_hash+snd_rawmidi_kernel_write+3+25106+_001140_hash+NULL
84285 +_001141_hash+snd_rawmidi_write+3+28008+_001141_hash+NULL
84286 +_001142_hash+snd_rme32_playback_copy+5+43732+_001142_hash+NULL
84287 +_001143_hash+snd_rme96_playback_copy+5+13111+_001143_hash+NULL
84288 +_001144_hash+snd_seq_device_new+4+31753+_001144_hash+NULL
84289 +_001145_hash+snd_seq_oss_readq_new+2+14283+_001145_hash+NULL
84290 +_001146_hash+snd_vx_create+4+40948+_001146_hash+NULL
84291 +_001147_hash+sock_setsockopt+5+50088+_001147_hash+NULL
84292 +_001148_hash+sound_write+3+5102+_001148_hash+NULL
84293 +_001149_hash+_sp2d_alloc+1+16944+_001149_hash+NULL
84294 +_001150_hash+spi_alloc_master+2+45223+_001150_hash+NULL
84295 +_001151_hash+spidev_message+3+5518+_001151_hash+NULL
84296 +_001152_hash+spi_register_board_info+2+35651+_001152_hash+NULL
84297 +_001153_hash+squashfs_cache_init+2+41656+_001153_hash+NULL
84298 +_001154_hash+squashfs_read_data+6+59440+_001154_hash+NULL
84299 +_001155_hash+srp_alloc_iu+2+44227+_001155_hash+NULL
84300 +_001156_hash+srp_iu_pool_alloc+2+17920+_001156_hash+NULL
84301 +_001157_hash+srp_ring_alloc+2+26760+_001157_hash+NULL
84302 +_001159_hash+start_isoc_chain+2+565+_001159_hash+NULL
84303 +_001160_hash+stk_prepare_sio_buffers+2+57168+_001160_hash+NULL
84304 +_001161_hash+store_iwmct_log_level+4+60209+_001161_hash+NULL
84305 +_001162_hash+store_iwmct_log_level_fw+4+1974+_001162_hash+NULL
84306 +_001163_hash+st_write+3+16874+_001163_hash+NULL
84307 +_001164_hash+svc_pool_map_alloc_arrays+2+47181+_001164_hash+NULL
84308 +_001165_hash+symtab_init+2+61050+_001165_hash+NULL
84309 +_001166_hash+sys_bind+3+10799+_001166_hash+NULL
84310 +_001167_hash+sys_connect+3+15291+_003291_hash+NULL+nohasharray
84311 +_001168_hash+sys_flistxattr+3+41407+_001168_hash+NULL
84312 +_001169_hash+sys_fsetxattr+4+49736+_001169_hash+NULL
84313 +_001170_hash+sysfs_write_file+3+57116+_001170_hash+NULL
84314 +_001171_hash+sys_ipc+3+4889+_001171_hash+NULL
84315 +_001172_hash+sys_keyctl+4+33708+_001172_hash+&_000974_hash
84316 +_001173_hash+sys_listxattr+3+27833+_001173_hash+NULL
84317 +_001174_hash+sys_llistxattr+3+4532+_001174_hash+NULL
84318 +_001175_hash+sys_lsetxattr+4+61177+_001175_hash+NULL
84319 +_001176_hash+sys_mq_timedsend+3+57661+_001176_hash+NULL
84320 +_001177_hash+sys_sched_setaffinity+2+32046+_001177_hash+NULL
84321 +_001178_hash+sys_semop+3+39457+_001178_hash+NULL
84322 +_001179_hash+sys_sendto+6+20809+_001179_hash+NULL
84323 +_001180_hash+sys_setxattr+4+37880+_001180_hash+NULL
84324 +_001181_hash+t4_alloc_mem+1+32342+_001181_hash+NULL
84325 +_001182_hash+tcf_hash_create+4+54360+_001182_hash+NULL
84326 +_001183_hash+__team_options_register+3+63941+_001183_hash+NULL
84327 +_001184_hash+test_unaligned_bulk+3+52333+_001184_hash+NULL
84328 +_001185_hash+tifm_alloc_adapter+1+10903+_001185_hash+NULL
84329 +_001186_hash+timeout_write+3+50991+_001186_hash+NULL
84330 +_001187_hash+tipc_link_send_sections_fast+4+37920+_001187_hash+NULL
84331 +_001188_hash+tipc_subseq_alloc+1+5957+_001188_hash+NULL
84332 +_001189_hash+tm6000_read_write_usb+7+50774+_002917_hash+NULL+nohasharray
84333 +_001190_hash+tnode_alloc+1+49407+_001190_hash+NULL
84334 +_001191_hash+tomoyo_commit_ok+2+20167+_001191_hash+NULL
84335 +_001192_hash+tomoyo_scan_bprm+2-4+15642+_001192_hash+NULL
84336 +_001194_hash+tps65910_i2c_write+3+39531+_001194_hash+NULL
84337 +_001195_hash+ts_write+3+64336+_001195_hash+NULL
84338 +_001196_hash+ttusb2_msg+4+3100+_001196_hash+NULL
84339 +_001197_hash+tty_write+3+5494+_001197_hash+NULL
84340 +_001198_hash+ubi_dbg_check_all_ff+4+59810+_001198_hash+NULL
84341 +_001199_hash+ubi_dbg_check_write+5+48525+_001199_hash+NULL
84342 +_001200_hash+ubifs_setxattr+4+59650+_001370_hash+NULL+nohasharray
84343 +_001201_hash+udf_sb_alloc_partition_maps+2+62313+_001201_hash+NULL
84344 +_001202_hash+udplite_getfrag+3-4+14479+_001202_hash+NULL
84345 +_001204_hash+ulong_write_file+3+26485+_001204_hash+NULL
84346 +_001205_hash+unix_dgram_sendmsg+4+45699+_001205_hash+NULL
84347 +_001206_hash+unix_stream_sendmsg+4+61455+_001206_hash+NULL
84348 +_001207_hash+unlink_queued+3-4+645+_001207_hash+NULL
84349 +_001208_hash+update_pmkid+4+2481+_001208_hash+NULL
84350 +_001209_hash+usb_alloc_coherent+2+65444+_001209_hash+NULL
84351 +_001210_hash+uvc_alloc_buffers+2+9656+_001210_hash+NULL
84352 +_001211_hash+uvc_alloc_entity+3-4+20836+_001211_hash+NULL
84353 +_001212_hash+v4l2_ctrl_new+7+38725+_001212_hash+NULL
84354 +_001213_hash+v4l2_event_subscribe+3+19510+_001213_hash+NULL
84355 +_001214_hash+vb2_read+3+42703+_001214_hash+NULL
84356 +_001215_hash+vb2_write+3+31948+_001215_hash+NULL
84357 +_001216_hash+vc_resize+2-3+3585+_001216_hash+NULL
84358 +_001218_hash+__vhost_add_used_n+3+26554+_001218_hash+NULL
84359 +_001219_hash+__videobuf_alloc_vb+1+27062+_001219_hash+NULL
84360 +_001220_hash+videobuf_dma_init_kernel+3+6963+_001220_hash+NULL
84361 +_001221_hash+virtqueue_add_buf+3-4+59470+_001221_hash+NULL
84362 +_001223_hash+vmalloc+1+15464+_001223_hash+NULL
84363 +_001224_hash+vmalloc_to_sg+2+58354+_001224_hash+NULL
84364 +_001225_hash+vol_cdev_write+3+40915+_001225_hash+NULL
84365 +_001226_hash+vxge_device_register+4+7752+_001226_hash+NULL
84366 +_001227_hash+__vxge_hw_channel_allocate+3+55462+_001227_hash+NULL
84367 +_001228_hash+vzalloc+1+47421+_001228_hash+NULL
84368 +_001229_hash+vzalloc_node+1+23424+_001229_hash+NULL
84369 +_001230_hash+wa_nep_queue+2+8858+_001230_hash+NULL
84370 +_001231_hash+__wa_xfer_setup_segs+2+56725+_001231_hash+NULL
84371 +_001232_hash+wiphy_new+2+2482+_001232_hash+NULL
84372 +_001233_hash+wpan_phy_alloc+1+48056+_001233_hash+NULL
84373 +_001234_hash+wusb_ccm_mac+7+32199+_001234_hash+NULL
84374 +_001235_hash+x25_sendmsg+4+12487+_001235_hash+NULL
84375 +_001236_hash+xfrm_hash_alloc+1+10997+_001236_hash+NULL
84376 +_001237_hash+_xfs_buf_get_pages+2+46811+_001237_hash+NULL
84377 +_001238_hash+xfs_da_buf_make+1+55845+_001238_hash+NULL
84378 +_001239_hash+xfs_da_grow_inode_int+3+21785+_001239_hash+NULL
84379 +_001240_hash+xfs_dir_cilookup_result+3+64288+_003139_hash+NULL+nohasharray
84380 +_001241_hash+xfs_iext_add_indirect_multi+3+32400+_001241_hash+NULL
84381 +_001242_hash+xfs_iext_inline_to_direct+2+12384+_001242_hash+NULL
84382 +_001243_hash+xfs_iroot_realloc+2+46826+_001243_hash+NULL
84383 +_001244_hash+xhci_alloc_stream_info+3+63902+_001244_hash+NULL
84384 +_001245_hash+xlog_recover_add_to_trans+4+62839+_001245_hash+NULL
84385 +_001246_hash+xprt_alloc+2+1475+_001246_hash+NULL
84386 +_001247_hash+xt_alloc_table_info+1+57903+_001247_hash+NULL
84387 +_001248_hash+_zd_iowrite32v_async_locked+3+39034+_001248_hash+NULL
84388 +_001249_hash+zd_usb_iowrite16v+3+49744+_001249_hash+NULL
84389 +_001250_hash+acpi_ds_build_internal_package_obj+3+58271+_001250_hash+NULL
84390 +_001251_hash+acpi_system_read_event+3+55362+_001251_hash+NULL
84391 +_001252_hash+acpi_ut_create_buffer_object+1+42030+_001252_hash+NULL
84392 +_001253_hash+acpi_ut_create_package_object+1+17594+_001253_hash+NULL
84393 +_001254_hash+acpi_ut_create_string_object+1+15360+_001254_hash+NULL
84394 +_001255_hash+ad7879_spi_multi_read+3+8218+_001255_hash+NULL
84395 +_001256_hash+add_child+4+45201+_001256_hash+NULL
84396 +_001257_hash+add_port+2+54941+_001257_hash+NULL
84397 +_001258_hash+adu_read+3+24177+_001258_hash+NULL
84398 +_001259_hash+afs_cell_create+2+27346+_001259_hash+NULL
84399 +_001260_hash+agp_generic_alloc_user+1+9470+_001260_hash+NULL
84400 +_001261_hash+alloc_agpphysmem_i8xx+1+39427+_001261_hash+NULL
84401 +_001262_hash+allocate_cnodes+1+5329+_001262_hash+NULL
84402 +_001263_hash+___alloc_bootmem+1+11410+_001263_hash+NULL
84403 +_001264_hash+__alloc_bootmem_nopanic+1+65397+_001264_hash+NULL
84404 +_001265_hash+alloc_bulk_urbs_generic+5+12127+_001265_hash+NULL
84405 +_001266_hash+alloc_candev+1-2+7776+_001266_hash+NULL
84406 +_001268_hash+____alloc_ei_netdev+1+51475+_001268_hash+NULL
84407 +_001269_hash+alloc_etherdev_mqs+1+36450+_001269_hash+NULL
84408 +_001270_hash+alloc_extent_buffer+3+52824+_001270_hash+NULL
84409 +_001271_hash+alloc_fcdev+1+18780+_001271_hash+NULL
84410 +_001272_hash+alloc_fddidev+1+15382+_001272_hash+NULL
84411 +_001273_hash+alloc_hippi_dev+1+51320+_001273_hash+NULL
84412 +_001274_hash+alloc_irdadev+1+19140+_001274_hash+NULL
84413 +_001275_hash+alloc_ltalkdev+1+38071+_001275_hash+NULL
84414 +_001276_hash+alloc_one_pg_vec_page+1+10747+_001276_hash+NULL
84415 +_001277_hash+alloc_orinocodev+1+21371+_001277_hash+NULL
84416 +_001279_hash+alloc_trdev+1+16399+_001279_hash+NULL
84417 +_001280_hash+async_setkey+3+35521+_001280_hash+NULL
84418 +_001281_hash+ata_host_alloc_pinfo+3+17325+_001281_hash+NULL
84419 +_001284_hash+ath6kl_connect_event+7-9-8+14267+_001284_hash+NULL
84420 +_001285_hash+ath6kl_fwlog_block_read+3+49836+_001285_hash+NULL
84421 +_001286_hash+ath6kl_fwlog_read+3+32101+_001286_hash+NULL
84422 +_001287_hash+ath_rx_init+2+43564+_001287_hash+NULL
84423 +_001288_hash+ath_tx_init+2+60515+_001288_hash+NULL
84424 +_001289_hash+atm_get_addr+3+31221+_001289_hash+NULL
84425 +_001290_hash+av7110_ipack_init+2+46655+_001290_hash+NULL
84426 +_001291_hash+bdx_rxdb_create+1+46525+_001291_hash+NULL
84427 +_001292_hash+bdx_tx_db_init+2+41719+_001292_hash+NULL
84428 +_001293_hash+bio_map_kern+3+64751+_001293_hash+NULL
84429 +_001294_hash+bits_to_user+3+47733+_001294_hash+NULL
84430 +_001295_hash+__blk_queue_init_tags+2+9778+_001295_hash+NULL
84431 +_001296_hash+blk_queue_resize_tags+2+28670+_001296_hash+NULL
84432 +_001297_hash+blk_rq_map_user_iov+5+16772+_001297_hash+NULL
84433 +_001298_hash+bm_init+2+13529+_001298_hash+NULL
84434 +_001299_hash+brcmf_alloc_wdev+1+60347+_001299_hash+NULL
84435 +_001300_hash+btrfs_insert_dir_item+4+59304+_001300_hash+NULL
84436 +_001301_hash+btrfs_map_block+3+64379+_001301_hash+NULL
84437 +_001302_hash+c4_add_card+3+54968+_001302_hash+NULL
84438 +_001303_hash+cache_read+3+24790+_001303_hash+NULL
84439 +_001304_hash+cache_write+3+13589+_001304_hash+NULL
84440 +_001305_hash+calc_hmac+3+32010+_001305_hash+NULL
84441 +_001306_hash+ccid_getsockopt_builtin_ccids+2+53634+_001306_hash+NULL
84442 +_001307_hash+ceph_copy_page_vector_to_user+4+31270+_001307_hash+NULL
84443 +_001308_hash+ceph_read_dir+3+17005+_001308_hash+NULL
84444 +_001309_hash+cfg80211_roamed+5-7+32632+_001309_hash+NULL
84445 +_001311_hash+ci_ll_init+3+12930+_001311_hash+NULL
84446 +_001312_hash+coda_psdev_read+3+35029+_001312_hash+NULL
84447 +_001313_hash+construct_key_and_link+4+8321+_001313_hash+NULL
84448 +_001314_hash+copy_counters_to_user+5+17027+_001824_hash+NULL+nohasharray
84449 +_001315_hash+copy_entries_to_user+1+52367+_001315_hash+NULL
84450 +_001316_hash+copy_from_buf+4+27308+_001316_hash+NULL
84451 +_001317_hash+copy_oldmem_page+3-1+26164+_001317_hash+NULL
84452 +_001318_hash+copy_to_user_fromio+3+57432+_001318_hash+NULL
84453 +_001319_hash+cryptd_hash_setkey+3+42781+_001319_hash+NULL
84454 +_001320_hash+crypto_authenc_esn_setkey+3+6985+_001320_hash+NULL
84455 +_001321_hash+crypto_authenc_setkey+3+80+_003311_hash+NULL+nohasharray
84456 +_001322_hash+cx18_copy_buf_to_user+4+22735+_001322_hash+NULL
84457 +_001324_hash+cxgbi_ddp_reserve+4+30091+_001324_hash+NULL
84458 +_001325_hash+datablob_hmac_append+3+40038+_001325_hash+NULL
84459 +_001326_hash+datablob_hmac_verify+4+24786+_001326_hash+NULL
84460 +_001327_hash+dataflash_read_fact_otp+3-2+33204+_001327_hash+NULL
84461 +_001328_hash+dataflash_read_user_otp+3-2+14536+_001328_hash+&_000201_hash
84462 +_001329_hash+dccp_feat_register_sp+5+17914+_001329_hash+NULL
84463 +_001330_hash+ddb_input_read+3+9743+_001330_hash+NULL
84464 +_001331_hash+dev_read+3+56369+_001331_hash+NULL
84465 +_001332_hash+diva_os_copy_to_user+4+48508+_001332_hash+NULL
84466 +_001333_hash+diva_os_malloc+2+16406+_001333_hash+NULL
84467 +_001334_hash+dlm_dir_lookup+4+56662+_001334_hash+NULL
84468 +_001335_hash+dm_vcalloc+1-2+16814+_001335_hash+NULL
84469 +_001337_hash+do_proc_readlink+3+14096+_001337_hash+NULL
84470 +_001338_hash+do_readlink+2+43518+_001338_hash+NULL
84471 +_001339_hash+__do_replace+5+37227+_001339_hash+NULL
84472 +_001340_hash+do_sigpending+2+9766+_001340_hash+NULL
84473 +_001341_hash+drbd_setsockopt+5+16280+_001341_hash+&_000371_hash
84474 +_001342_hash+dsp_buffer_alloc+2+11684+_001342_hash+NULL
84475 +_001343_hash+dump_midi+3+51040+_001343_hash+NULL
84476 +_001344_hash+dvb_dmxdev_set_buffer_size+2+55643+_001344_hash+NULL
84477 +_001345_hash+dvb_dvr_set_buffer_size+2+9840+_001345_hash+NULL
84478 +_001346_hash+dvb_ringbuffer_pkt_read_user+3-5-2+4303+_001346_hash+NULL
84479 +_001348_hash+dvb_ringbuffer_read_user+3+56702+_001348_hash+NULL
84480 +_001349_hash+ecryptfs_filldir+3+6622+_001349_hash+NULL
84481 +_001350_hash+ecryptfs_readlink+3+40775+_001350_hash+NULL
84482 +_001351_hash+ecryptfs_send_message+2+18322+_001351_hash+NULL
84483 +_001352_hash+em28xx_init_isoc+4+62883+_001352_hash+&_000721_hash
84484 +_001353_hash+et61x251_read+3+25420+_001353_hash+NULL
84485 +_001354_hash+ext4_add_new_descs+3+19509+_001354_hash+NULL
84486 +_001355_hash+fat_ioctl_filldir+3+36621+_001355_hash+NULL
84487 +_001356_hash+fd_copyout+3+59323+_001356_hash+NULL
84488 +_001357_hash+f_hidg_read+3+6238+_001357_hash+NULL
84489 +_001358_hash+filldir+3+55137+_001358_hash+NULL
84490 +_001359_hash+filldir64+3+46469+_001359_hash+NULL
84491 +_001360_hash+fops_read+3+40672+_001360_hash+NULL
84492 +_001361_hash+from_buffer+3+18625+_001361_hash+NULL
84493 +_001362_hash+fsm_init+2+16134+_001362_hash+NULL
84494 +_001363_hash+get_subdir+3+62581+_001363_hash+NULL
84495 +_001364_hash+gspca_dev_probe+4+2570+_001364_hash+NULL
84496 +_001365_hash+handle_received_packet+3+22457+_001365_hash+NULL
84497 +_001366_hash+hash_setkey+3+48310+_001366_hash+NULL
84498 +_001367_hash+hdlcdrv_register+2+6792+_001367_hash+NULL
84499 +_001368_hash+hdpvr_read+3+9273+_001368_hash+NULL
84500 +_001369_hash+hid_input_report+4+32458+_001369_hash+NULL
84501 +_001370_hash+hidraw_read+3+59650+_001370_hash+&_001200_hash
84502 +_001371_hash+HiSax_readstatus+2+15752+_001371_hash+NULL
84503 +_001373_hash+__hwahc_op_set_gtk+4+42038+_001373_hash+NULL
84504 +_001374_hash+__hwahc_op_set_ptk+5+36510+_001374_hash+NULL
84505 +_001375_hash+ib_copy_to_udata+3+27525+_001375_hash+NULL
84506 +_001376_hash+idetape_chrdev_read+3+2097+_001376_hash+NULL
84507 +_001377_hash+ieee80211_alloc_hw+1+43829+_001377_hash+NULL
84508 +_001378_hash+ieee80211_bss_info_update+4+13991+_001378_hash+NULL
84509 +_001379_hash+ilo_read+3+32531+_001379_hash+NULL
84510 +_001380_hash+init_map_ipmac+3-4+63896+_001380_hash+NULL
84511 +_001382_hash+init_tid_tabs+2-4-3+13252+_001382_hash+NULL
84512 +_001385_hash+iowarrior_read+3+53483+_001385_hash+NULL
84513 +_001386_hash+ipv6_getsockopt_sticky+5+56711+_001386_hash+NULL
84514 +_001387_hash+ipwireless_send_packet+4+8328+_001387_hash+NULL
84515 +_001388_hash+ipx_sendmsg+4+1362+_001388_hash+NULL
84516 +_001389_hash+iscsi_conn_setup+2+35159+_001389_hash+NULL
84517 +_001390_hash+iscsi_create_session+3+51647+_001390_hash+NULL
84518 +_001391_hash+iscsi_host_alloc+2+36671+_001391_hash+NULL
84519 +_001392_hash+iscsi_session_setup+4-5+196+_001392_hash+NULL
84520 +_001394_hash+iscsit_find_cmd_from_itt_or_dump+3+17194+_001701_hash+NULL+nohasharray
84521 +_001395_hash+isdn_ppp_read+4+50356+_001395_hash+NULL
84522 +_001396_hash+isku_sysfs_read+6+58806+_001396_hash+NULL
84523 +_001397_hash+isku_sysfs_write+6+49767+_001397_hash+NULL
84524 +_001398_hash+iso_alloc_urb+4-5+45206+_001398_hash+NULL
84525 +_001400_hash+ivtv_copy_buf_to_user+4+6159+_001400_hash+NULL
84526 +_001401_hash+iwm_rx_handle+3+24899+_001401_hash+NULL
84527 +_001402_hash+iwm_wdev_alloc+1+38415+_001402_hash+NULL
84528 +_001403_hash+jbd2_alloc+1+41359+_001403_hash+NULL
84529 +_001404_hash+jffs2_do_link+6+42048+_001404_hash+NULL
84530 +_001405_hash+jffs2_do_unlink+4+62020+_001405_hash+NULL
84531 +_001406_hash+jffs2_security_setxattr+4+62107+_001406_hash+NULL
84532 +_001407_hash+jffs2_trusted_setxattr+4+17048+_001407_hash+NULL
84533 +_001408_hash+jffs2_user_setxattr+4+10182+_001408_hash+NULL
84534 +_001409_hash+kernel_setsockopt+5+35913+_001409_hash+NULL
84535 +_001410_hash+keyctl_describe_key+3+36853+_001410_hash+NULL
84536 +_001411_hash+keyctl_get_security+3+64418+_001411_hash+&_001132_hash
84537 +_001412_hash+keyring_read+3+13438+_001412_hash+NULL
84538 +_001413_hash+kfifo_copy_to_user+3+20646+_001413_hash+NULL
84539 +_001414_hash+kmem_zalloc_large+1+56128+_001414_hash+NULL
84540 +_001415_hash+kmp_init+2+41373+_001415_hash+NULL
84541 +_001416_hash+koneplus_sysfs_write+6+35993+_001416_hash+NULL
84542 +_001417_hash+kvm_clear_guest_page+4+2308+_001417_hash+NULL
84543 +_001418_hash+kvm_read_nested_guest_page+5+13337+_001418_hash+NULL
84544 +_001419_hash+l2cap_create_basic_pdu+3+24869+_001419_hash+&_001034_hash
84545 +_001420_hash+l2cap_create_connless_pdu+3+37327+_001420_hash+&_000966_hash
84546 +_001421_hash+l2cap_create_iframe_pdu+3+51801+_001421_hash+NULL
84547 +_001422_hash+__lgwrite+4+57669+_001422_hash+NULL
84548 +_001423_hash+libfc_host_alloc+2+7917+_001423_hash+NULL
84549 +_001424_hash+llcp_sock_sendmsg+4+1092+_001424_hash+NULL
84550 +_001425_hash+macvtap_get_user+4+28185+_001425_hash+NULL
84551 +_001426_hash+mcam_v4l_read+3+36513+_001426_hash+NULL
84552 +_001427_hash+mce_async_out+3+58056+_001427_hash+NULL
84553 +_001428_hash+mce_flush_rx_buffer+2+14976+_001428_hash+NULL
84554 +_001429_hash+mdc800_device_read+3+22896+_001429_hash+NULL
84555 +_001430_hash+memcpy_toiovec+3+54166+_001430_hash+&_000867_hash
84556 +_001431_hash+memcpy_toiovecend+3-4+19736+_001431_hash+NULL
84557 +_001433_hash+mgt_set_varlen+4+60916+_001433_hash+NULL
84558 +_001434_hash+mlx4_en_create_rx_ring+3+62498+_001434_hash+NULL
84559 +_001435_hash+mlx4_en_create_tx_ring+4+48501+_001435_hash+NULL
84560 +_001436_hash+mon_bin_get_event+4+52863+_001436_hash+NULL
84561 +_001437_hash+mousedev_read+3+47123+_001437_hash+NULL
84562 +_001438_hash+move_addr_to_user+2+2868+_001438_hash+NULL
84563 +_001439_hash+mpihelp_mul+5-3+27805+_001439_hash+NULL
84564 +_001441_hash+mpi_lshift_limbs+2+9337+_001441_hash+NULL
84565 +_001442_hash+msnd_fifo_alloc+2+23179+_001442_hash+NULL
84566 +_001443_hash+mtdswap_init+2+55719+_001443_hash+NULL
84567 +_001444_hash+neigh_hash_grow+2+17283+_001444_hash+NULL
84568 +_001445_hash+nfs4_realloc_slot_table+2+22859+_001445_hash+NULL
84569 +_001446_hash+nfs_idmap_get_key+2+39616+_001446_hash+NULL
84570 +_001447_hash+nsm_get_handle+4+52089+_001447_hash+NULL
84571 +_001448_hash+ntfs_malloc_nofs+1+49572+_001448_hash+NULL
84572 +_001449_hash+ntfs_malloc_nofs_nofail+1+63631+_001449_hash+NULL
84573 +_001450_hash+nvme_create_queue+3+170+_001450_hash+NULL
84574 +_001451_hash+ocfs2_control_write+3+54737+_001451_hash+NULL
84575 +_001452_hash+orinoco_add_extscan_result+3+18207+_001452_hash+NULL
84576 +_001454_hash+override_release+2+52032+_001454_hash+NULL
84577 +_001455_hash+packet_snd+3+13634+_001455_hash+NULL
84578 +_001456_hash+pcbit_stat+2+27364+_001456_hash+NULL
84579 +_001457_hash+pcpu_extend_area_map+2+12589+_001457_hash+NULL
84580 +_001458_hash+pg_read+3+17276+_001458_hash+NULL
84581 +_001459_hash+picolcd_debug_eeprom_read+3+14549+_001459_hash+NULL
84582 +_001460_hash+pkt_alloc_packet_data+1+37928+_001460_hash+NULL
84583 +_001461_hash+pmcraid_build_passthrough_ioadls+2+62034+_001461_hash+NULL
84584 +_001462_hash+pms_capture+4+27142+_001462_hash+NULL
84585 +_001463_hash+posix_clock_register+2+5662+_001463_hash+NULL
84586 +_001464_hash+printer_read+3+54851+_001464_hash+NULL
84587 +_001465_hash+__proc_file_read+3+54978+_001465_hash+NULL
84588 +_001466_hash+pt_read+3+49136+_001466_hash+NULL
84589 +_001467_hash+put_cmsg+4+36589+_001467_hash+NULL
84590 +_001468_hash+pvr2_ioread_read+3+10720+_001505_hash+NULL+nohasharray
84591 +_001469_hash+pwc_video_read+3+51735+_001469_hash+NULL
84592 +_001470_hash+px_raw_event+4+49371+_001470_hash+NULL
84593 +_001471_hash+qcam_read+3+13977+_001471_hash+NULL
84594 +_001472_hash+rawv6_sendmsg+4+20080+_001472_hash+NULL
84595 +_001473_hash+rds_sendmsg+4+40976+_001473_hash+NULL
84596 +_001474_hash+read_flush+3+43851+_001474_hash+NULL
84597 +_001475_hash+read_profile+3+27859+_001475_hash+NULL
84598 +_001476_hash+read_vmcore+3+26501+_001476_hash+NULL
84599 +_001477_hash+redirected_tty_write+3+65297+_001477_hash+NULL
84600 +_001478_hash+__register_chrdev+2-3+54223+_001478_hash+NULL
84601 +_001480_hash+regmap_raw_write+4+53803+_001480_hash+NULL
84602 +_001481_hash+reiserfs_allocate_list_bitmaps+3+21732+_001481_hash+NULL
84603 +_001482_hash+reiserfs_resize+2+34377+_001482_hash+NULL
84604 +_001483_hash+request_key_auth_read+3+24109+_001483_hash+NULL
84605 +_001484_hash+rfkill_fop_read+3+54711+_001484_hash+NULL
84606 +_001485_hash+rng_dev_read+3+41581+_001485_hash+NULL
84607 +_001486_hash+roccat_read+3+41093+_001486_hash+NULL
84608 +_001487_hash+sco_sock_sendmsg+4+62542+_001487_hash+NULL
84609 +_001488_hash+scsi_register+2+49094+_001488_hash+NULL
84610 +_001489_hash+sctp_getsockopt_events+2+3607+_001489_hash+NULL
84611 +_001490_hash+sctp_getsockopt_maxburst+2+42941+_001490_hash+NULL
84612 +_001491_hash+sctp_getsockopt_maxseg+2+10737+_001491_hash+NULL
84613 +_001492_hash+sctpprobe_read+3+17741+_001492_hash+NULL
84614 +_001493_hash+sdhci_alloc_host+2+7509+_001493_hash+NULL
84615 +_001494_hash+selinux_inode_post_setxattr+4+26037+_001494_hash+NULL
84616 +_001495_hash+selinux_inode_setsecurity+4+18148+_001495_hash+NULL
84617 +_001496_hash+selinux_inode_setxattr+4+10708+_001496_hash+NULL
84618 +_001497_hash+selinux_secctx_to_secid+2+63744+_001497_hash+NULL
84619 +_001498_hash+selinux_setprocattr+4+55611+_001498_hash+NULL
84620 +_001499_hash+sel_write_context+3+25726+_002397_hash+NULL+nohasharray
84621 +_001500_hash+seq_copy_in_user+3+18543+_001500_hash+NULL
84622 +_001501_hash+seq_open_net+4+8968+_001594_hash+NULL+nohasharray
84623 +_001502_hash+seq_open_private+3+61589+_001502_hash+NULL
84624 +_001503_hash+set_arg+3+42824+_001503_hash+NULL
84625 +_001504_hash+sg_read+3+25799+_001504_hash+NULL
84626 +_001505_hash+shash_async_setkey+3+10720+_001505_hash+&_001468_hash
84627 +_001506_hash+shash_compat_setkey+3+12267+_001506_hash+NULL
84628 +_001507_hash+shmem_setxattr+4+55867+_001507_hash+NULL
84629 +_001508_hash+simple_read_from_buffer+2-5+55957+_001508_hash+NULL
84630 +_001511_hash+sm_checker_extend+2+23615+_001511_hash+NULL
84631 +_001512_hash+sn9c102_read+3+29305+_001512_hash+NULL
84632 +_001513_hash+snd_es1938_capture_copy+5+25930+_001513_hash+NULL
84633 +_001514_hash+snd_gus_dram_peek+4+9062+_001514_hash+NULL
84634 +_001515_hash+snd_hdsp_capture_copy+5+4011+_001515_hash+NULL
84635 +_001516_hash+snd_korg1212_copy_to+6+92+_001516_hash+NULL
84636 +_001517_hash+snd_opl4_mem_proc_read+5+63774+_001517_hash+NULL
84637 +_001518_hash+snd_pcm_alloc_vmalloc_buffer+2+44595+_001518_hash+NULL
84638 +_001519_hash+snd_pcm_oss_read1+3+63771+_001519_hash+NULL
84639 +_001520_hash+snd_rawmidi_kernel_read1+4+36740+_001520_hash+NULL
84640 +_001521_hash+snd_rme9652_capture_copy+5+10287+_001521_hash+NULL
84641 +_001522_hash+srp_target_alloc+3+37288+_001522_hash+NULL
84642 +_001523_hash+stk_allocate_buffers+2+16291+_001523_hash+NULL
84643 +_001524_hash+store_ifalias+4+35088+_001524_hash+NULL
84644 +_001525_hash+store_msg+3+56417+_001525_hash+NULL
84645 +_001526_hash+str_to_user+2+11411+_001526_hash+NULL
84646 +_001527_hash+subbuf_read_actor+3+2071+_001527_hash+NULL
84647 +_001528_hash+sys_fgetxattr+4+25166+_001528_hash+NULL
84648 +_001529_hash+sys_gethostname+2+49698+_001529_hash+NULL
84649 +_001530_hash+sys_getxattr+4+37418+_001530_hash+NULL
84650 +_001531_hash+sys_kexec_load+2+14222+_001531_hash+NULL
84651 +_001532_hash+sys_msgsnd+3+44537+_001532_hash+&_000129_hash
84652 +_001533_hash+sys_process_vm_readv+3-5+19090+_003125_hash+NULL+nohasharray
84653 +_001535_hash+sys_process_vm_writev+3-5+4928+_001535_hash+NULL
84654 +_001537_hash+sys_sched_getaffinity+2+60033+_001537_hash+NULL
84655 +_001538_hash+sys_setsockopt+5+35320+_001538_hash+NULL
84656 +_001539_hash+t3_init_l2t+1+8261+_001539_hash+NULL
84657 +_001540_hash+team_options_register+3+20091+_001540_hash+NULL
84658 +_001541_hash+tipc_send2name+6+16809+_001541_hash+NULL
84659 +_001542_hash+tipc_send2port+5+63935+_001542_hash+NULL
84660 +_001543_hash+tipc_send+4+51238+_001543_hash+NULL
84661 +_001544_hash+tm6000_i2c_recv_regs16+5+2949+_001544_hash+NULL
84662 +_001545_hash+tm6000_i2c_recv_regs+5+46215+_001545_hash+NULL
84663 +_001546_hash+tm6000_i2c_send_regs+5+20250+_001546_hash+NULL
84664 +_001547_hash+tnode_new+3+44757+_001547_hash+NULL
84665 +_001548_hash+tomoyo_read_self+3+33539+_001548_hash+NULL
84666 +_001549_hash+tomoyo_update_domain+2+5498+_001549_hash+NULL
84667 +_001550_hash+tomoyo_update_policy+2+40458+_001550_hash+NULL
84668 +_001551_hash+tpm_read+3+50344+_001551_hash+NULL
84669 +_001552_hash+TSS_rawhmac+3+17486+_001552_hash+NULL
84670 +_001553_hash+tt3650_ci_msg+4+57219+_001553_hash+NULL
84671 +_001554_hash+tun_get_user+3+33178+_001554_hash+NULL
84672 +_001555_hash+ubi_dbg_dump_flash+4+3870+_001555_hash+NULL
84673 +_001556_hash+ubi_io_write+4-5+15870+_001556_hash+&_000954_hash
84674 +_001558_hash+uio_read+3+49300+_001558_hash+NULL
84675 +_001559_hash+unix_seqpacket_sendmsg+4+27893+_001559_hash+NULL
84676 +_001560_hash+unlink1+3+63059+_001560_hash+NULL
84677 +_001562_hash+usb_allocate_stream_buffers+3+8964+_001562_hash+NULL
84678 +_001563_hash+usbdev_read+3+45114+_001563_hash+NULL
84679 +_001564_hash+usblp_read+3+57342+_003306_hash+NULL+nohasharray
84680 +_001565_hash+usbtmc_read+3+32377+_001565_hash+NULL
84681 +_001566_hash+usbvision_v4l2_read+3+34386+_001566_hash+NULL
84682 +_001567_hash+_usb_writeN_sync+4+31682+_001567_hash+NULL
84683 +_001568_hash+user_read+3+51881+_001568_hash+NULL
84684 +_001569_hash+v4l_stk_read+3+39672+_001569_hash+NULL
84685 +_001570_hash+vcs_read+3+8017+_001570_hash+NULL
84686 +_001571_hash+vdma_mem_alloc+1+6171+_001571_hash+NULL
84687 +_001572_hash+venus_create+4+20555+_001572_hash+NULL
84688 +_001573_hash+venus_link+5+32165+_001573_hash+NULL
84689 +_001574_hash+venus_lookup+4+8121+_001574_hash+NULL
84690 +_001575_hash+venus_mkdir+4+8967+_001575_hash+NULL
84691 +_001576_hash+venus_remove+4+59781+_001576_hash+NULL
84692 +_001577_hash+venus_rename+4-5+17707+_003279_hash+NULL+nohasharray
84693 +_001579_hash+venus_rmdir+4+45564+_001579_hash+NULL
84694 +_001580_hash+venus_symlink+4-6+23570+_001580_hash+NULL
84695 +_001582_hash+vfs_readlink+3+54368+_001582_hash+NULL
84696 +_001583_hash+vfs_readv+3+38011+_001583_hash+NULL
84697 +_001584_hash+vfs_writev+3+25278+_001584_hash+NULL
84698 +_001585_hash+vga_arb_read+3+4886+_001585_hash+NULL
84699 +_001586_hash+vhci_put_user+4+12604+_001586_hash+NULL
84700 +_001587_hash+vhost_add_used_n+3+10760+_001587_hash+NULL
84701 +_001588_hash+__videobuf_copy_to_user+4+15423+_001588_hash+NULL
84702 +_001589_hash+videobuf_pages_to_sg+2+3708+_001589_hash+NULL
84703 +_001590_hash+videobuf_vmalloc_to_sg+2+4548+_001590_hash+NULL
84704 +_001591_hash+virtnet_send_command+5-6+61993+_001591_hash+NULL
84705 +_001593_hash+vmbus_establish_gpadl+3+4495+_001593_hash+NULL
84706 +_001594_hash+vol_cdev_read+3+8968+_001594_hash+&_001501_hash
84707 +_001595_hash+w9966_v4l_read+3+31148+_001595_hash+NULL
84708 +_001596_hash+wdm_read+3+6549+_001596_hash+NULL
84709 +_001597_hash+wusb_prf+7+54261+_001597_hash+&_000063_hash
84710 +_001598_hash+xdi_copy_to_user+4+48900+_001598_hash+NULL
84711 +_001599_hash+xfs_buf_get_uncached+2+51477+_001599_hash+NULL
84712 +_001600_hash+xfs_efd_init+3+5463+_001600_hash+NULL
84713 +_001601_hash+xfs_efi_init+2+5476+_001601_hash+NULL
84714 +_001602_hash+xfs_iext_realloc_direct+2+20521+_001602_hash+NULL
84715 +_001603_hash+xfs_iext_realloc_indirect+2+59211+_001603_hash+NULL
84716 +_001604_hash+xfs_inumbers_fmt+3+12817+_001604_hash+NULL
84717 +_001605_hash+xlog_recover_add_to_cont_trans+4+44102+_001605_hash+NULL
84718 +_001606_hash+xz_dec_lzma2_create+2+36353+_002745_hash+NULL+nohasharray
84719 +_001607_hash+_zd_iowrite32v_locked+3+44725+_001607_hash+NULL
84720 +_001608_hash+aat2870_reg_read_file+3+12221+_001608_hash+NULL
84721 +_001609_hash+add_sctp_bind_addr+3+12269+_001609_hash+NULL
84722 +_001610_hash+aes_decrypt_fail_read+3+54815+_001610_hash+NULL
84723 +_001611_hash+aes_decrypt_interrupt_read+3+19910+_001611_hash+NULL
84724 +_001612_hash+aes_decrypt_packets_read+3+10155+_001612_hash+NULL
84725 +_001613_hash+aes_encrypt_fail_read+3+32562+_001613_hash+NULL
84726 +_001614_hash+aes_encrypt_interrupt_read+3+39919+_001614_hash+NULL
84727 +_001615_hash+aes_encrypt_packets_read+3+48666+_001615_hash+NULL
84728 +_001616_hash+afs_cell_lookup+2+8482+_001616_hash+NULL
84729 +_001617_hash+agp_allocate_memory+2+58761+_001617_hash+NULL
84730 +_001618_hash+__alloc_bootmem+1+31498+_001618_hash+NULL
84731 +_001619_hash+__alloc_bootmem_low+1+43423+_003150_hash+NULL+nohasharray
84732 +_001620_hash+__alloc_bootmem_node_nopanic+2+6432+_001620_hash+NULL
84733 +_001621_hash+alloc_cc770dev+1+48186+_001621_hash+NULL
84734 +_001622_hash+__alloc_ei_netdev+1+29338+_001622_hash+NULL
84735 +_001623_hash+__alloc_eip_netdev+1+51549+_001623_hash+NULL
84736 +_001624_hash+alloc_libipw+1+22708+_001624_hash+NULL
84737 +_001625_hash+alloc_pg_vec+2+8533+_001625_hash+NULL
84738 +_001626_hash+alloc_sja1000dev+1+17868+_001626_hash+NULL
84739 +_001627_hash+alloc_targets+2+8074+_001627_hash+NULL
84740 +_001630_hash+ath6kl_disconnect_timeout_read+3+3650+_001630_hash+NULL
84741 +_001631_hash+ath6kl_endpoint_stats_read+3+41554+_001631_hash+NULL
84742 +_001632_hash+ath6kl_fwlog_mask_read+3+2050+_001632_hash+NULL
84743 +_001633_hash+ath6kl_keepalive_read+3+44303+_001633_hash+NULL
84744 +_001634_hash+ath6kl_listen_int_read+3+10355+_001634_hash+NULL
84745 +_001635_hash+ath6kl_lrssi_roam_read+3+61022+_001635_hash+NULL
84746 +_001636_hash+ath6kl_regdump_read+3+14393+_001636_hash+NULL
84747 +_001637_hash+ath6kl_regread_read+3+25884+_001637_hash+NULL
84748 +_001638_hash+ath6kl_regwrite_read+3+48747+_001638_hash+NULL
84749 +_001639_hash+ath6kl_roam_table_read+3+26166+_001639_hash+NULL
84750 +_001640_hash+ath9k_debugfs_read_buf+3+25316+_001640_hash+NULL
84751 +_001641_hash+atk_debugfs_ggrp_read+3+29522+_001641_hash+NULL
84752 +_001642_hash+b43_debugfs_read+3+24425+_001642_hash+NULL
84753 +_001643_hash+b43legacy_debugfs_read+3+2473+_001643_hash+NULL
84754 +_001644_hash+bcm_recvmsg+4+43992+_001644_hash+NULL
84755 +_001645_hash+bfad_debugfs_read+3+13119+_001645_hash+NULL
84756 +_001646_hash+bfad_debugfs_read_regrd+3+57830+_001646_hash+NULL
84757 +_001647_hash+blk_init_tags+1+30592+_001647_hash+NULL
84758 +_001648_hash+blk_queue_init_tags+2+44355+_002686_hash+NULL+nohasharray
84759 +_001649_hash+blk_rq_map_kern+4+47004+_001649_hash+NULL
84760 +_001650_hash+bm_entry_read+3+10976+_001650_hash+NULL
84761 +_001651_hash+bm_status_read+3+19583+_001651_hash+NULL
84762 +_001652_hash+bnad_debugfs_read+3+50665+_001652_hash+NULL
84763 +_001653_hash+bnad_debugfs_read_regrd+3+51308+_001653_hash+NULL
84764 +_001654_hash+btmrvl_curpsmode_read+3+46939+_001654_hash+NULL
84765 +_001655_hash+btmrvl_gpiogap_read+3+4718+_001655_hash+NULL
84766 +_001656_hash+btmrvl_hscfgcmd_read+3+56303+_001656_hash+NULL
84767 +_001657_hash+btmrvl_hscmd_read+3+1614+_001657_hash+NULL
84768 +_001658_hash+btmrvl_hsmode_read+3+1647+_001658_hash+NULL
84769 +_001659_hash+btmrvl_hsstate_read+3+920+_001659_hash+NULL
84770 +_001660_hash+btmrvl_pscmd_read+3+24308+_001660_hash+NULL
84771 +_001661_hash+btmrvl_psmode_read+3+22395+_001661_hash+NULL
84772 +_001662_hash+btmrvl_psstate_read+3+50683+_001662_hash+NULL
84773 +_001663_hash+btmrvl_txdnldready_read+3+413+_001663_hash+NULL
84774 +_001664_hash+btrfs_add_link+5+9973+_001664_hash+NULL
84775 +_001665_hash+btrfs_discard_extent+2+38547+_001665_hash+NULL
84776 +_001666_hash+btrfs_find_create_tree_block+3+55812+_001666_hash+NULL
84777 +_001667_hash+btrfsic_map_block+2+56751+_001667_hash+NULL
84778 +_001668_hash+caif_stream_recvmsg+4+13173+_001668_hash+NULL
84779 +_001669_hash+carl9170_alloc+1+27+_001669_hash+NULL
84780 +_001670_hash+carl9170_debugfs_read+3+47738+_001670_hash+NULL
84781 +_001671_hash+cgroup_read_s64+5+19570+_001671_hash+NULL
84782 +_001672_hash+cgroup_read_u64+5+45532+_001672_hash+NULL
84783 +_001673_hash+channel_type_read+3+47308+_001673_hash+NULL
84784 +_001674_hash+codec_list_read_file+3+24910+_001674_hash+NULL
84785 +_001675_hash+configfs_read_file+3+1683+_001675_hash+NULL
84786 +_001676_hash+cpuset_common_file_read+5+8800+_001676_hash+NULL
84787 +_001677_hash+create_subvol+4+2347+_001677_hash+NULL
84788 +_001678_hash+cx18_copy_mdl_to_user+4+45549+_001678_hash+NULL
84789 +_001679_hash+dai_list_read_file+3+25421+_001679_hash+NULL
84790 +_001680_hash+dapm_bias_read_file+3+64715+_001680_hash+NULL
84791 +_001681_hash+dapm_widget_power_read_file+3+59950+_001754_hash+NULL+nohasharray
84792 +_001684_hash+dbgfs_frame+3+45917+_001684_hash+NULL
84793 +_001685_hash+dbgfs_state+3+38894+_001685_hash+NULL
84794 +_001686_hash+debugfs_read+3+62535+_001686_hash+NULL
84795 +_001687_hash+debug_output+3+18575+_001687_hash+NULL
84796 +_001688_hash+debug_read+3+19322+_001688_hash+NULL
84797 +_001689_hash+dfs_file_read+3+18116+_001689_hash+NULL
84798 +_001690_hash+dma_memcpy_pg_to_iovec+6+1725+_001690_hash+NULL
84799 +_001691_hash+dma_memcpy_to_iovec+5+12173+_001691_hash+NULL
84800 +_001692_hash+dma_rx_errors_read+3+52045+_001692_hash+NULL
84801 +_001693_hash+dma_rx_requested_read+3+65354+_001693_hash+NULL
84802 +_001694_hash+dma_show_regs+3+35266+_001694_hash+NULL
84803 +_001695_hash+dma_tx_errors_read+3+46060+_001695_hash+NULL
84804 +_001696_hash+dma_tx_requested_read+3+16110+_001775_hash+NULL+nohasharray
84805 +_001697_hash+dm_exception_table_init+2+39645+_001697_hash+&_001103_hash
84806 +_001698_hash+dn_recvmsg+4+17213+_001698_hash+NULL
84807 +_001699_hash+dns_resolver_read+3+54658+_001699_hash+NULL
84808 +_001700_hash+do_msgrcv+4+5590+_001700_hash+NULL
84809 +_001701_hash+driver_state_read+3+17194+_001701_hash+&_001394_hash
84810 +_001702_hash+dvb_demux_do_ioctl+3+34871+_001702_hash+NULL
84811 +_001703_hash+dvb_dmxdev_buffer_read+4+20682+_001703_hash+NULL
84812 +_001704_hash+dvb_dvr_do_ioctl+3+43355+_001704_hash+NULL
84813 +_001705_hash+econet_recvmsg+4+40978+_001705_hash+NULL
84814 +_001706_hash+event_calibration_read+3+21083+_001706_hash+NULL
84815 +_001707_hash+event_heart_beat_read+3+48961+_001707_hash+NULL
84816 +_001708_hash+event_oom_late_read+3+61175+_001708_hash+&_001014_hash
84817 +_001709_hash+event_phy_transmit_error_read+3+10471+_001709_hash+NULL
84818 +_001710_hash+event_rx_mem_empty_read+3+40363+_001710_hash+NULL
84819 +_001711_hash+event_rx_mismatch_read+3+38518+_001711_hash+NULL
84820 +_001712_hash+event_rx_pool_read+3+25792+_001712_hash+NULL
84821 +_001713_hash+event_tx_stuck_read+3+19305+_001713_hash+NULL
84822 +_001714_hash+excessive_retries_read+3+60425+_001714_hash+NULL
84823 +_001715_hash+fallback_on_nodma_alloc+2+35332+_001715_hash+NULL
84824 +_001716_hash+filter_read+3+61692+_001716_hash+NULL
84825 +_001717_hash+format_devstat_counter+3+32550+_001717_hash+NULL
84826 +_001718_hash+fragmentation_threshold_read+3+61718+_001718_hash+NULL
84827 +_001719_hash+fuse_conn_limit_read+3+20084+_001719_hash+NULL
84828 +_001720_hash+fuse_conn_waiting_read+3+49762+_001720_hash+NULL
84829 +_001721_hash+generic_readlink+3+32654+_001721_hash+NULL
84830 +_001722_hash+gpio_power_read+3+36059+_001722_hash+NULL
84831 +_001723_hash+hash_recvmsg+4+50924+_001723_hash+NULL
84832 +_001724_hash+ht40allow_map_read+3+55209+_002830_hash+NULL+nohasharray
84833 +_001725_hash+hwflags_read+3+52318+_001725_hash+NULL
84834 +_001726_hash+hysdn_conf_read+3+42324+_003205_hash+NULL+nohasharray
84835 +_001727_hash+i2400m_rx_stats_read+3+57706+_001727_hash+NULL
84836 +_001728_hash+i2400m_tx_stats_read+3+28527+_001728_hash+NULL
84837 +_001729_hash+idmouse_read+3+63374+_001729_hash+NULL
84838 +_001730_hash+ieee80211_if_read+3+6785+_001730_hash+NULL
84839 +_001731_hash+ieee80211_rx_bss_info+3+61630+_001731_hash+NULL
84840 +_001732_hash+ikconfig_read_current+3+1658+_001732_hash+NULL
84841 +_001733_hash+il3945_sta_dbgfs_stats_table_read+3+48802+_001733_hash+NULL
84842 +_001734_hash+il3945_ucode_general_stats_read+3+46111+_001734_hash+NULL
84843 +_001735_hash+il3945_ucode_rx_stats_read+3+3048+_001735_hash+NULL
84844 +_001736_hash+il3945_ucode_tx_stats_read+3+36016+_001736_hash+NULL
84845 +_001737_hash+il4965_rs_sta_dbgfs_rate_scale_data_read+3+37792+_001737_hash+NULL
84846 +_001738_hash+il4965_rs_sta_dbgfs_scale_table_read+3+38564+_001738_hash+NULL
84847 +_001739_hash+il4965_rs_sta_dbgfs_stats_table_read+3+49206+_001739_hash+NULL
84848 +_001740_hash+il4965_ucode_general_stats_read+3+56277+_001740_hash+NULL
84849 +_001741_hash+il4965_ucode_rx_stats_read+3+61948+_001741_hash+NULL
84850 +_001742_hash+il4965_ucode_tx_stats_read+3+12064+_001742_hash+NULL
84851 +_001743_hash+il_dbgfs_chain_noise_read+3+38044+_001743_hash+NULL
84852 +_001744_hash+il_dbgfs_channels_read+3+25005+_001744_hash+NULL
84853 +_001745_hash+il_dbgfs_disable_ht40_read+3+42386+_001745_hash+NULL
84854 +_001746_hash+il_dbgfs_fh_reg_read+3+40993+_001746_hash+NULL
84855 +_001747_hash+il_dbgfs_force_reset_read+3+57517+_001747_hash+NULL
84856 +_001748_hash+il_dbgfs_interrupt_read+3+3351+_001748_hash+NULL
84857 +_001749_hash+il_dbgfs_missed_beacon_read+3+59956+_001749_hash+NULL
84858 +_001750_hash+il_dbgfs_nvm_read+3+12288+_001750_hash+NULL
84859 +_001751_hash+il_dbgfs_power_save_status_read+3+43165+_001751_hash+NULL
84860 +_001752_hash+il_dbgfs_qos_read+3+33615+_001752_hash+NULL
84861 +_001753_hash+il_dbgfs_rxon_filter_flags_read+3+19281+_001753_hash+NULL
84862 +_001754_hash+il_dbgfs_rxon_flags_read+3+59950+_001754_hash+&_001681_hash
84863 +_001755_hash+il_dbgfs_rx_queue_read+3+11221+_001755_hash+NULL
84864 +_001756_hash+il_dbgfs_rx_stats_read+3+15243+_001756_hash+NULL
84865 +_001757_hash+il_dbgfs_sensitivity_read+3+2370+_001757_hash+NULL
84866 +_001758_hash+il_dbgfs_sram_read+3+62296+_001758_hash+NULL
84867 +_001759_hash+il_dbgfs_stations_read+3+21532+_001759_hash+NULL
84868 +_001760_hash+il_dbgfs_status_read+3+58388+_001760_hash+NULL
84869 +_001761_hash+il_dbgfs_tx_queue_read+3+55668+_001761_hash+NULL
84870 +_001762_hash+il_dbgfs_tx_stats_read+3+32913+_001762_hash+NULL
84871 +_001763_hash+ima_show_htable_value+2+57136+_001763_hash+NULL
84872 +_001765_hash+ipw_write+3+59807+_001765_hash+NULL
84873 +_001766_hash+irda_recvmsg_stream+4+35280+_001766_hash+NULL
84874 +_001767_hash+iscsi_tcp_conn_setup+2+16376+_001767_hash+NULL
84875 +_001768_hash+isr_cmd_cmplt_read+3+53439+_001768_hash+NULL
84876 +_001769_hash+isr_commands_read+3+41398+_001769_hash+NULL
84877 +_001770_hash+isr_decrypt_done_read+3+49490+_001770_hash+NULL
84878 +_001771_hash+isr_dma0_done_read+3+8574+_001771_hash+NULL
84879 +_001772_hash+isr_dma1_done_read+3+48159+_001772_hash+NULL
84880 +_001773_hash+isr_fiqs_read+3+34687+_001773_hash+NULL
84881 +_001774_hash+isr_host_acknowledges_read+3+54136+_001774_hash+NULL
84882 +_001775_hash+isr_hw_pm_mode_changes_read+3+16110+_001775_hash+&_001696_hash
84883 +_001776_hash+isr_irqs_read+3+9181+_001776_hash+NULL
84884 +_001777_hash+isr_low_rssi_read+3+64789+_001777_hash+NULL
84885 +_001778_hash+isr_pci_pm_read+3+30271+_001778_hash+NULL
84886 +_001779_hash+isr_rx_headers_read+3+38325+_001779_hash+NULL
84887 +_001780_hash+isr_rx_mem_overflow_read+3+43025+_001780_hash+NULL
84888 +_001781_hash+isr_rx_procs_read+3+31804+_001781_hash+NULL
84889 +_001782_hash+isr_rx_rdys_read+3+35283+_001782_hash+NULL
84890 +_001783_hash+isr_tx_exch_complete_read+3+16103+_001783_hash+NULL
84891 +_001784_hash+isr_tx_procs_read+3+23084+_001784_hash+NULL
84892 +_001785_hash+isr_wakeups_read+3+49607+_001785_hash+NULL
84893 +_001786_hash+ivtv_read+3+57796+_001786_hash+NULL
84894 +_001787_hash+iwl_dbgfs_bt_traffic_read+3+35534+_001787_hash+NULL
84895 +_001788_hash+iwl_dbgfs_chain_noise_read+3+46355+_001788_hash+NULL
84896 +_001789_hash+iwl_dbgfs_channels_read+3+6784+_001789_hash+NULL
84897 +_001790_hash+iwl_dbgfs_current_sleep_command_read+3+2081+_001790_hash+NULL
84898 +_001791_hash+iwl_dbgfs_disable_ht40_read+3+35761+_001791_hash+NULL
84899 +_001792_hash+iwl_dbgfs_fh_reg_read+3+879+_001792_hash+&_000393_hash
84900 +_001793_hash+iwl_dbgfs_force_reset_read+3+62628+_001793_hash+NULL
84901 +_001794_hash+iwl_dbgfs_interrupt_read+3+23574+_001794_hash+NULL
84902 +_001795_hash+iwl_dbgfs_log_event_read+3+2107+_001795_hash+NULL
84903 +_001796_hash+iwl_dbgfs_missed_beacon_read+3+50584+_001796_hash+NULL
84904 +_001797_hash+iwl_dbgfs_nvm_read+3+23845+_001797_hash+NULL
84905 +_001798_hash+iwl_dbgfs_plcp_delta_read+3+55407+_001798_hash+NULL
84906 +_001799_hash+iwl_dbgfs_power_save_status_read+3+54392+_001799_hash+NULL
84907 +_001800_hash+iwl_dbgfs_protection_mode_read+3+13943+_001800_hash+NULL
84908 +_001801_hash+iwl_dbgfs_qos_read+3+11753+_001801_hash+NULL
84909 +_001802_hash+iwl_dbgfs_reply_tx_error_read+3+19205+_001802_hash+NULL
84910 +_001803_hash+iwl_dbgfs_rx_handlers_read+3+18708+_001803_hash+NULL
84911 +_001804_hash+iwl_dbgfs_rxon_filter_flags_read+3+28832+_001804_hash+NULL
84912 +_001805_hash+iwl_dbgfs_rxon_flags_read+3+20795+_001805_hash+NULL
84913 +_001806_hash+iwl_dbgfs_rx_queue_read+3+19943+_001806_hash+NULL
84914 +_001807_hash+iwl_dbgfs_rx_statistics_read+3+62687+_001807_hash+&_000425_hash
84915 +_001808_hash+iwl_dbgfs_sensitivity_read+3+63116+_003026_hash+NULL+nohasharray
84916 +_001809_hash+iwl_dbgfs_sleep_level_override_read+3+3038+_001809_hash+NULL
84917 +_001810_hash+iwl_dbgfs_sram_read+3+44505+_001810_hash+NULL
84918 +_001811_hash+iwl_dbgfs_stations_read+3+9309+_001811_hash+NULL
84919 +_001812_hash+iwl_dbgfs_status_read+3+5171+_001812_hash+NULL
84920 +_001813_hash+iwl_dbgfs_temperature_read+3+29224+_001813_hash+NULL
84921 +_001814_hash+iwl_dbgfs_thermal_throttling_read+3+38779+_001814_hash+NULL
84922 +_001815_hash+iwl_dbgfs_traffic_log_read+3+58870+_001815_hash+NULL
84923 +_001816_hash+iwl_dbgfs_tx_queue_read+3+4635+_001816_hash+NULL
84924 +_001817_hash+iwl_dbgfs_tx_statistics_read+3+314+_001817_hash+NULL
84925 +_001818_hash+iwl_dbgfs_ucode_bt_stats_read+3+42820+_001818_hash+NULL
84926 +_001819_hash+iwl_dbgfs_ucode_general_stats_read+3+49199+_001819_hash+NULL
84927 +_001820_hash+iwl_dbgfs_ucode_rx_stats_read+3+58023+_001820_hash+NULL
84928 +_001821_hash+iwl_dbgfs_ucode_tracing_read+3+47983+_001821_hash+&_000349_hash
84929 +_001822_hash+iwl_dbgfs_ucode_tx_stats_read+3+31611+_001822_hash+NULL
84930 +_001823_hash+iwl_dbgfs_wowlan_sram_read+3+540+_001823_hash+NULL
84931 +_001824_hash+iwm_if_alloc+1+17027+_001824_hash+&_001314_hash
84932 +_001825_hash+kernel_readv+3+35617+_001825_hash+NULL
84933 +_001826_hash+key_algorithm_read+3+57946+_001826_hash+NULL
84934 +_001827_hash+key_icverrors_read+3+20895+_001827_hash+NULL
84935 +_001828_hash+key_key_read+3+3241+_001828_hash+NULL
84936 +_001829_hash+key_replays_read+3+62746+_001829_hash+NULL
84937 +_001830_hash+key_rx_spec_read+3+12736+_001830_hash+NULL
84938 +_001831_hash+key_tx_spec_read+3+4862+_001831_hash+NULL
84939 +_001832_hash+__kfifo_to_user+3+36555+_002199_hash+NULL+nohasharray
84940 +_001833_hash+__kfifo_to_user_r+3+39123+_001833_hash+NULL
84941 +_001834_hash+kmem_zalloc_greedy+2-3+65268+_001834_hash+NULL
84942 +_001836_hash+l2cap_chan_send+3+49995+_001836_hash+NULL
84943 +_001837_hash+l2cap_sar_segment_sdu+3+27701+_001837_hash+NULL
84944 +_001838_hash+lbs_debugfs_read+3+30721+_001838_hash+NULL
84945 +_001839_hash+lbs_dev_info+3+51023+_001839_hash+NULL
84946 +_001840_hash+lbs_host_sleep_read+3+31013+_001840_hash+NULL
84947 +_001841_hash+lbs_rdbbp_read+3+45805+_001841_hash+NULL
84948 +_001842_hash+lbs_rdmac_read+3+418+_001842_hash+NULL
84949 +_001843_hash+lbs_rdrf_read+3+41431+_001843_hash+NULL
84950 +_001844_hash+lbs_sleepparams_read+3+10840+_001844_hash+NULL
84951 +_001845_hash+lbs_threshold_read+5+21046+_001845_hash+NULL
84952 +_001846_hash+libfc_vport_create+2+4415+_001846_hash+NULL
84953 +_001847_hash+lkdtm_debugfs_read+3+45752+_001847_hash+NULL
84954 +_001848_hash+llcp_sock_recvmsg+4+13556+_001848_hash+NULL
84955 +_001849_hash+long_retry_limit_read+3+59766+_001849_hash+NULL
84956 +_001850_hash+lpfc_debugfs_dif_err_read+3+36303+_001850_hash+NULL
84957 +_001851_hash+lpfc_debugfs_read+3+16566+_001851_hash+NULL
84958 +_001852_hash+lpfc_idiag_baracc_read+3+58466+_002447_hash+NULL+nohasharray
84959 +_001853_hash+lpfc_idiag_ctlacc_read+3+33943+_001853_hash+NULL
84960 +_001854_hash+lpfc_idiag_drbacc_read+3+15948+_001854_hash+NULL
84961 +_001855_hash+lpfc_idiag_extacc_read+3+48301+_001855_hash+NULL
84962 +_001856_hash+lpfc_idiag_mbxacc_read+3+28061+_001856_hash+NULL
84963 +_001857_hash+lpfc_idiag_pcicfg_read+3+50334+_001857_hash+NULL
84964 +_001858_hash+lpfc_idiag_queacc_read+3+13950+_001858_hash+NULL
84965 +_001859_hash+lpfc_idiag_queinfo_read+3+55662+_001859_hash+NULL
84966 +_001860_hash+mac80211_format_buffer+2+41010+_001860_hash+NULL
84967 +_001861_hash+macvtap_put_user+4+55609+_001861_hash+NULL
84968 +_001862_hash+macvtap_sendmsg+4+30629+_001862_hash+NULL
84969 +_001863_hash+mic_calc_failure_read+3+59700+_001863_hash+NULL
84970 +_001864_hash+mic_rx_pkts_read+3+27972+_001864_hash+NULL
84971 +_001865_hash+minstrel_stats_read+3+17290+_001865_hash+NULL
84972 +_001866_hash+mmc_ext_csd_read+3+13205+_001866_hash+NULL
84973 +_001867_hash+mon_bin_read+3+6841+_001867_hash+NULL
84974 +_001868_hash+mon_stat_read+3+25238+_001868_hash+NULL
84975 +_001870_hash+mqueue_read_file+3+6228+_001870_hash+NULL
84976 +_001871_hash+mwifiex_debug_read+3+53074+_001871_hash+NULL
84977 +_001872_hash+mwifiex_getlog_read+3+54269+_001872_hash+NULL
84978 +_001873_hash+mwifiex_info_read+3+53447+_001873_hash+NULL
84979 +_001874_hash+mwifiex_rdeeprom_read+3+51429+_001874_hash+NULL
84980 +_001875_hash+mwifiex_regrdwr_read+3+34472+_001875_hash+NULL
84981 +_001876_hash+nfsd_vfs_read+6+62605+_003003_hash+NULL+nohasharray
84982 +_001877_hash+nfsd_vfs_write+6+54577+_001877_hash+NULL
84983 +_001878_hash+nfs_idmap_lookup_id+2+10660+_001878_hash+NULL
84984 +_001879_hash+o2hb_debug_read+3+37851+_001879_hash+NULL
84985 +_001880_hash+o2net_debug_read+3+52105+_001880_hash+NULL
84986 +_001881_hash+ocfs2_control_read+3+56405+_001881_hash+NULL
84987 +_001882_hash+ocfs2_debug_read+3+14507+_001882_hash+NULL
84988 +_001883_hash+ocfs2_readlink+3+50656+_001883_hash+NULL
84989 +_001884_hash+oom_adjust_read+3+25127+_001884_hash+NULL
84990 +_001885_hash+oom_score_adj_read+3+39921+_002116_hash+NULL+nohasharray
84991 +_001886_hash+oprofilefs_str_to_user+3+42182+_001886_hash+NULL
84992 +_001887_hash+oprofilefs_ulong_to_user+3+11582+_001887_hash+NULL
84993 +_001888_hash+_osd_req_list_objects+6+4204+_001888_hash+NULL
84994 +_001889_hash+osd_req_read_kern+5+59990+_001889_hash+NULL
84995 +_001890_hash+osd_req_write_kern+5+53486+_001890_hash+NULL
84996 +_001891_hash+p54_init_common+1+23850+_001891_hash+NULL
84997 +_001892_hash+packet_sendmsg+4+24954+_001892_hash+NULL
84998 +_001893_hash+page_readlink+3+23346+_001893_hash+NULL
84999 +_001894_hash+pcf50633_write_block+3+2124+_001894_hash+NULL
85000 +_001895_hash+platform_list_read_file+3+34734+_001895_hash+NULL
85001 +_001896_hash+pm860x_bulk_write+3+43875+_001896_hash+NULL
85002 +_001897_hash+pm_qos_power_read+3+55891+_001897_hash+NULL
85003 +_001898_hash+pms_read+3+53873+_001898_hash+NULL
85004 +_001899_hash+port_show_regs+3+5904+_001899_hash+NULL
85005 +_001900_hash+proc_coredump_filter_read+3+39153+_001900_hash+NULL
85006 +_001901_hash+proc_fdinfo_read+3+62043+_001901_hash+NULL
85007 +_001902_hash+proc_info_read+3+63344+_001902_hash+NULL
85008 +_001903_hash+proc_loginuid_read+3+15631+_001903_hash+NULL
85009 +_001904_hash+proc_pid_attr_read+3+10173+_001904_hash+NULL
85010 +_001905_hash+proc_pid_readlink+3+52186+_001905_hash+NULL
85011 +_001906_hash+proc_read+3+43614+_001906_hash+NULL
85012 +_001907_hash+proc_self_readlink+3+38094+_001907_hash+NULL
85013 +_001908_hash+proc_sessionid_read+3+6911+_002038_hash+NULL+nohasharray
85014 +_001909_hash+provide_user_output+3+41105+_001909_hash+NULL
85015 +_001910_hash+ps_pspoll_max_apturn_read+3+6699+_001910_hash+NULL
85016 +_001911_hash+ps_pspoll_timeouts_read+3+11776+_001911_hash+NULL
85017 +_001912_hash+ps_pspoll_utilization_read+3+5361+_001912_hash+NULL
85018 +_001913_hash+pstore_file_read+3+57288+_001913_hash+NULL
85019 +_001914_hash+ps_upsd_max_apturn_read+3+19918+_001914_hash+NULL
85020 +_001915_hash+ps_upsd_max_sptime_read+3+63362+_001915_hash+NULL
85021 +_001916_hash+ps_upsd_timeouts_read+3+28924+_001916_hash+NULL
85022 +_001917_hash+ps_upsd_utilization_read+3+51669+_001917_hash+NULL
85023 +_001918_hash+pvr2_v4l2_read+3+18006+_001918_hash+NULL
85024 +_001919_hash+pwr_disable_ps_read+3+13176+_001919_hash+NULL
85025 +_001920_hash+pwr_elp_enter_read+3+5324+_001920_hash+NULL
85026 +_001921_hash+pwr_enable_ps_read+3+17686+_001921_hash+NULL
85027 +_001922_hash+pwr_fix_tsf_ps_read+3+26627+_001922_hash+NULL
85028 +_001923_hash+pwr_missing_bcns_read+3+25824+_001923_hash+NULL
85029 +_001924_hash+pwr_power_save_off_read+3+18355+_001924_hash+NULL
85030 +_001925_hash+pwr_ps_enter_read+3+26935+_001925_hash+&_000501_hash
85031 +_001926_hash+pwr_rcvd_awake_beacons_read+3+50505+_001926_hash+NULL
85032 +_001927_hash+pwr_rcvd_beacons_read+3+52836+_001927_hash+NULL
85033 +_001928_hash+pwr_tx_without_ps_read+3+48423+_001928_hash+NULL
85034 +_001929_hash+pwr_tx_with_ps_read+3+60851+_001929_hash+NULL
85035 +_001930_hash+pwr_wake_on_host_read+3+26321+_001930_hash+NULL
85036 +_001931_hash+pwr_wake_on_timer_exp_read+3+22640+_001931_hash+NULL
85037 +_001932_hash+queues_read+3+24877+_001932_hash+NULL
85038 +_001933_hash+raw_recvmsg+4+17277+_001933_hash+NULL
85039 +_001934_hash+rcname_read+3+25919+_001934_hash+NULL
85040 +_001935_hash+read_4k_modal_eeprom+3+30212+_001935_hash+NULL
85041 +_001936_hash+read_9287_modal_eeprom+3+59327+_001936_hash+NULL
85042 +_001937_hash+reada_find_extent+2+63486+_001937_hash+NULL
85043 +_001938_hash+read_def_modal_eeprom+3+14041+_001938_hash+NULL
85044 +_001939_hash+read_enabled_file_bool+3+37744+_001939_hash+NULL
85045 +_001940_hash+read_file_ani+3+23161+_001940_hash+NULL
85046 +_001941_hash+read_file_antenna+3+13574+_001941_hash+NULL
85047 +_001942_hash+read_file_base_eeprom+3+42168+_001942_hash+NULL
85048 +_001943_hash+read_file_beacon+3+32595+_001943_hash+NULL
85049 +_001944_hash+read_file_blob+3+57406+_001944_hash+NULL
85050 +_001945_hash+read_file_bool+3+4180+_001945_hash+NULL
85051 +_001946_hash+read_file_credit_dist_stats+3+54367+_001946_hash+NULL
85052 +_001947_hash+read_file_debug+3+58256+_001947_hash+NULL
85053 +_001948_hash+read_file_disable_ani+3+6536+_001948_hash+NULL
85054 +_001949_hash+read_file_dma+3+9530+_001949_hash+NULL
85055 +_001950_hash+read_file_dump_nfcal+3+18766+_001950_hash+NULL
85056 +_001951_hash+read_file_frameerrors+3+64001+_001951_hash+NULL
85057 +_001952_hash+read_file_interrupt+3+61742+_001959_hash+NULL+nohasharray
85058 +_001953_hash+read_file_misc+3+9948+_001953_hash+NULL
85059 +_001954_hash+read_file_modal_eeprom+3+39909+_001954_hash+NULL
85060 +_001955_hash+read_file_queue+3+40895+_001955_hash+NULL
85061 +_001956_hash+read_file_rcstat+3+22854+_001956_hash+NULL
85062 +_001957_hash+read_file_recv+3+48232+_001957_hash+NULL
85063 +_001958_hash+read_file_regidx+3+33370+_001958_hash+NULL
85064 +_001959_hash+read_file_regval+3+61742+_001959_hash+&_001952_hash
85065 +_001960_hash+read_file_reset+3+52310+_001960_hash+NULL
85066 +_001961_hash+read_file_rx_chainmask+3+41605+_001961_hash+NULL
85067 +_001962_hash+read_file_slot+3+50111+_001962_hash+NULL
85068 +_001963_hash+read_file_stations+3+35795+_001963_hash+NULL
85069 +_001964_hash+read_file_tgt_int_stats+3+20697+_001964_hash+NULL
85070 +_001965_hash+read_file_tgt_rx_stats+3+33944+_001965_hash+NULL
85071 +_001966_hash+read_file_tgt_stats+3+8959+_001966_hash+NULL
85072 +_001967_hash+read_file_tgt_tx_stats+3+51847+_001967_hash+NULL
85073 +_001968_hash+read_file_tx_chainmask+3+3829+_001968_hash+NULL
85074 +_001969_hash+read_file_war_stats+3+292+_001969_hash+NULL
85075 +_001970_hash+read_file_xmit+3+21487+_001970_hash+NULL
85076 +_001971_hash+read_from_oldmem+2+3337+_001971_hash+NULL
85077 +_001972_hash+read_oldmem+3+55658+_001972_hash+NULL
85078 +_001973_hash+regmap_name_read_file+3+39379+_001973_hash+NULL
85079 +_001974_hash+repair_io_failure+4+4815+_001974_hash+NULL
85080 +_001975_hash+request_key_and_link+4+42693+_001975_hash+NULL
85081 +_001976_hash+res_counter_read+4+33499+_001976_hash+NULL
85082 +_001977_hash+retry_count_read+3+52129+_001977_hash+NULL
85083 +_001978_hash+rs_sta_dbgfs_rate_scale_data_read+3+47165+_001978_hash+NULL
85084 +_001979_hash+rs_sta_dbgfs_scale_table_read+3+40262+_001979_hash+NULL
85085 +_001980_hash+rs_sta_dbgfs_stats_table_read+3+56573+_001980_hash+NULL
85086 +_001981_hash+rts_threshold_read+3+44384+_001981_hash+NULL
85087 +_001982_hash+rx_dropped_read+3+44799+_001982_hash+NULL
85088 +_001983_hash+rx_fcs_err_read+3+62844+_001983_hash+NULL
85089 +_001984_hash+rx_hdr_overflow_read+3+64407+_001984_hash+NULL
85090 +_001985_hash+rx_hw_stuck_read+3+57179+_001985_hash+NULL
85091 +_001986_hash+rx_out_of_mem_read+3+10157+_001986_hash+NULL
85092 +_001987_hash+rx_path_reset_read+3+23801+_001987_hash+NULL
85093 +_001988_hash+rxpipe_beacon_buffer_thres_host_int_trig_rx_data_read+3+55106+_001988_hash+NULL
85094 +_001989_hash+rxpipe_descr_host_int_trig_rx_data_read+3+22001+_003089_hash+NULL+nohasharray
85095 +_001990_hash+rxpipe_missed_beacon_host_int_trig_rx_data_read+3+63405+_001990_hash+NULL
85096 +_001991_hash+rxpipe_rx_prep_beacon_drop_read+3+2403+_001991_hash+NULL
85097 +_001992_hash+rxpipe_tx_xfr_host_int_trig_rx_data_read+3+35538+_001992_hash+NULL
85098 +_001993_hash+rx_reset_counter_read+3+58001+_001993_hash+NULL
85099 +_001994_hash+rx_xfr_hint_trig_read+3+40283+_001994_hash+NULL
85100 +_001995_hash+s5m_bulk_write+3+4833+_001995_hash+NULL
85101 +_001996_hash+scrub_setup_recheck_block+3-4+56245+_001996_hash+NULL
85102 +_001998_hash+scsi_adjust_queue_depth+3+12802+_001998_hash+NULL
85103 +_001999_hash+selinux_inode_notifysecctx+3+36896+_001999_hash+NULL
85104 +_002000_hash+sel_read_avc_cache_threshold+3+33942+_002000_hash+NULL
85105 +_002001_hash+sel_read_avc_hash_stats+3+1984+_002001_hash+NULL
85106 +_002002_hash+sel_read_bool+3+24236+_002002_hash+NULL
85107 +_002003_hash+sel_read_checkreqprot+3+33068+_002003_hash+NULL
85108 +_002004_hash+sel_read_class+3+12669+_002541_hash+NULL+nohasharray
85109 +_002005_hash+sel_read_enforce+3+2828+_002005_hash+NULL
85110 +_002006_hash+sel_read_handle_status+3+56139+_002006_hash+NULL
85111 +_002007_hash+sel_read_handle_unknown+3+57933+_002007_hash+NULL
85112 +_002008_hash+sel_read_initcon+3+32362+_002008_hash+NULL
85113 +_002009_hash+sel_read_mls+3+25369+_002009_hash+NULL
85114 +_002010_hash+sel_read_perm+3+42302+_002010_hash+NULL
85115 +_002011_hash+sel_read_policy+3+55947+_002011_hash+NULL
85116 +_002012_hash+sel_read_policycap+3+28544+_002012_hash+NULL
85117 +_002013_hash+sel_read_policyvers+3+55+_003257_hash+NULL+nohasharray
85118 +_002014_hash+send_msg+4+37323+_002014_hash+NULL
85119 +_002015_hash+send_packet+4+52960+_002015_hash+NULL
85120 +_002016_hash+short_retry_limit_read+3+4687+_002016_hash+NULL
85121 +_002017_hash+simple_attr_read+3+24738+_002017_hash+NULL
85122 +_002018_hash+simple_transaction_read+3+17076+_002018_hash+NULL
85123 +_002019_hash+skb_copy_datagram_const_iovec+2-5-4+48102+_002019_hash+NULL
85124 +_002022_hash+skb_copy_datagram_iovec+2-4+5806+_002022_hash+NULL
85125 +_002024_hash+smk_read_ambient+3+61220+_002024_hash+NULL
85126 +_002025_hash+smk_read_direct+3+15803+_002025_hash+NULL
85127 +_002026_hash+smk_read_doi+3+30813+_002026_hash+NULL
85128 +_002027_hash+smk_read_logging+3+37804+_002027_hash+NULL
85129 +_002028_hash+smk_read_onlycap+3+3855+_002028_hash+NULL
85130 +_002029_hash+snapshot_read+3+22601+_002029_hash+NULL
85131 +_002030_hash+snd_cs4281_BA0_read+5+6847+_002030_hash+NULL
85132 +_002031_hash+snd_cs4281_BA1_read+5+20323+_002031_hash+NULL
85133 +_002032_hash+snd_cs46xx_io_read+5+45734+_002032_hash+NULL
85134 +_002033_hash+snd_gus_dram_read+4+56686+_002033_hash+NULL
85135 +_002034_hash+snd_pcm_oss_read+3+28317+_002034_hash+NULL
85136 +_002035_hash+snd_rme32_capture_copy+5+39653+_002035_hash+NULL
85137 +_002036_hash+snd_rme96_capture_copy+5+58484+_002036_hash+NULL
85138 +_002037_hash+snd_soc_hw_bulk_write_raw+4+14245+_002037_hash+NULL
85139 +_002038_hash+spi_show_regs+3+6911+_002038_hash+&_001908_hash
85140 +_002039_hash+sta_agg_status_read+3+14058+_002039_hash+NULL
85141 +_002040_hash+sta_connected_time_read+3+17435+_002040_hash+NULL
85142 +_002041_hash+sta_flags_read+3+56710+_002041_hash+NULL
85143 +_002042_hash+sta_ht_capa_read+3+10366+_002042_hash+NULL
85144 +_002043_hash+sta_last_seq_ctrl_read+3+19106+_002043_hash+NULL
85145 +_002044_hash+sta_num_ps_buf_frames_read+3+1488+_002044_hash+NULL
85146 +_002045_hash+st_read+3+51251+_002045_hash+NULL
85147 +_002046_hash+supply_map_read_file+3+10608+_002046_hash+NULL
85148 +_002047_hash+sysfs_read_file+3+42113+_002047_hash+NULL
85149 +_002048_hash+sys_lgetxattr+4+45531+_002048_hash+NULL
85150 +_002049_hash+sys_preadv+3+17100+_002049_hash+NULL
85151 +_002050_hash+sys_pwritev+3+41722+_002050_hash+NULL
85152 +_002051_hash+sys_readv+3+50664+_002051_hash+NULL
85153 +_002052_hash+sys_rt_sigpending+2+24961+_002052_hash+NULL
85154 +_002053_hash+sys_writev+3+28384+_002053_hash+NULL
85155 +_002054_hash+test_iso_queue+5+62534+_002054_hash+NULL
85156 +_002055_hash+ts_read+3+44687+_002055_hash+NULL
85157 +_002056_hash+TSS_authhmac+3+12839+_002056_hash+NULL
85158 +_002057_hash+TSS_checkhmac1+5+31429+_002057_hash+NULL
85159 +_002058_hash+TSS_checkhmac2+5-7+40520+_002058_hash+NULL
85160 +_002060_hash+tt3650_ci_msg_locked+4+8013+_002060_hash+NULL
85161 +_002061_hash+tun_sendmsg+4+10337+_002061_hash+NULL
85162 +_002062_hash+tx_internal_desc_overflow_read+3+47300+_002062_hash+NULL
85163 +_002063_hash+tx_queue_len_read+3+1463+_002063_hash+NULL
85164 +_002064_hash+tx_queue_status_read+3+44978+_002064_hash+NULL
85165 +_002065_hash+ubi_io_write_data+4-5+40305+_002065_hash+NULL
85166 +_002067_hash+uhci_debug_read+3+5911+_002067_hash+NULL
85167 +_002068_hash+unix_stream_recvmsg+4+35210+_002068_hash+NULL
85168 +_002069_hash+uvc_debugfs_stats_read+3+56651+_002069_hash+NULL
85169 +_002070_hash+vhost_add_used_and_signal_n+4+8038+_002070_hash+NULL
85170 +_002071_hash+vifs_state_read+3+33762+_002071_hash+NULL
85171 +_002072_hash+vmbus_open+2-3+12154+_002072_hash+NULL
85172 +_002074_hash+waiters_read+3+40902+_002074_hash+NULL
85173 +_002075_hash+wep_addr_key_count_read+3+20174+_002075_hash+NULL
85174 +_002076_hash+wep_decrypt_fail_read+3+58567+_002076_hash+NULL
85175 +_002077_hash+wep_default_key_count_read+3+43035+_002077_hash+NULL
85176 +_002078_hash+wep_interrupt_read+3+41492+_002078_hash+NULL
85177 +_002079_hash+wep_key_not_found_read+3+13377+_002079_hash+&_000915_hash
85178 +_002080_hash+wep_packets_read+3+18751+_002080_hash+NULL
85179 +_002081_hash+wl1271_format_buffer+2+20834+_002081_hash+NULL
85180 +_002082_hash+wm8994_bulk_write+3+13615+_002082_hash+NULL
85181 +_002083_hash+wusb_prf_256+7+29203+_002083_hash+NULL
85182 +_002084_hash+wusb_prf_64+7+51065+_002084_hash+NULL
85183 +_002085_hash+xfs_buf_read_uncached+4+27519+_002085_hash+NULL
85184 +_002086_hash+xfs_iext_add+3+41422+_002086_hash+NULL
85185 +_002087_hash+xfs_iext_remove_direct+3+40744+_002087_hash+NULL
85186 +_002088_hash+xfs_trans_get_efd+3+51148+_002088_hash+NULL
85187 +_002089_hash+xfs_trans_get_efi+2+7898+_002089_hash+NULL
85188 +_002090_hash+xlog_get_bp+2+23229+_002090_hash+NULL
85189 +_002091_hash+xz_dec_init+2+29029+_002091_hash+NULL
85190 +_002092_hash+aac_change_queue_depth+2+825+_002092_hash+NULL
85191 +_002093_hash+agp_allocate_memory_wrap+1+16576+_002093_hash+NULL
85192 +_002094_hash+arcmsr_adjust_disk_queue_depth+2+16756+_002094_hash+NULL
85193 +_002095_hash+atalk_recvmsg+4+22053+_002095_hash+NULL
85194 +_002097_hash+atomic_read_file+3+16227+_002097_hash+NULL
85195 +_002098_hash+ax25_recvmsg+4+64441+_002098_hash+NULL
85196 +_002099_hash+beacon_interval_read+3+7091+_002099_hash+NULL
85197 +_002100_hash+btrfs_init_new_buffer+4+55761+_002100_hash+NULL
85198 +_002101_hash+btrfs_mksubvol+3+39479+_002101_hash+NULL
85199 +_002102_hash+bt_sock_recvmsg+4+12316+_002102_hash+NULL
85200 +_002103_hash+bt_sock_stream_recvmsg+4+52518+_002103_hash+NULL
85201 +_002104_hash+caif_seqpkt_recvmsg+4+32241+_002104_hash+NULL
85202 +_002105_hash+cpu_type_read+3+36540+_002105_hash+NULL
85203 +_002106_hash+cx18_read+3+23699+_002106_hash+NULL
85204 +_002107_hash+dccp_recvmsg+4+16056+_002107_hash+NULL
85205 +_002108_hash+depth_read+3+31112+_002108_hash+NULL
85206 +_002109_hash+dfs_global_file_read+3+7787+_002109_hash+NULL
85207 +_002110_hash+dgram_recvmsg+4+23104+_002110_hash+NULL
85208 +_002111_hash+dma_skb_copy_datagram_iovec+3-5+21516+_002111_hash+NULL
85209 +_002113_hash+dtim_interval_read+3+654+_002113_hash+NULL
85210 +_002114_hash+dynamic_ps_timeout_read+3+10110+_002114_hash+NULL
85211 +_002115_hash+enable_read+3+2117+_002115_hash+NULL
85212 +_002116_hash+exofs_read_kern+6+39921+_002116_hash+&_001885_hash
85213 +_002117_hash+fc_change_queue_depth+2+36841+_002117_hash+NULL
85214 +_002118_hash+forced_ps_read+3+31685+_002118_hash+NULL
85215 +_002119_hash+frequency_read+3+64031+_003106_hash+NULL+nohasharray
85216 +_002120_hash+get_alua_req+3+4166+_002120_hash+NULL
85217 +_002121_hash+get_rdac_req+3+45882+_002121_hash+NULL
85218 +_002122_hash+hci_sock_recvmsg+4+7072+_002122_hash+NULL
85219 +_002123_hash+hpsa_change_queue_depth+2+15449+_002123_hash+NULL
85220 +_002124_hash+hptiop_adjust_disk_queue_depth+2+20122+_002124_hash+NULL
85221 +_002125_hash+ide_queue_pc_tail+5+11673+_002125_hash+NULL
85222 +_002126_hash+ide_raw_taskfile+4+42355+_002126_hash+NULL
85223 +_002127_hash+idetape_queue_rw_tail+3+29562+_002127_hash+NULL
85224 +_002128_hash+ieee80211_if_read_aid+3+9705+_002128_hash+NULL
85225 +_002129_hash+ieee80211_if_read_auto_open_plinks+3+38268+_002129_hash+NULL
85226 +_002130_hash+ieee80211_if_read_ave_beacon+3+64924+_002130_hash+NULL
85227 +_002131_hash+ieee80211_if_read_bssid+3+35161+_002131_hash+NULL
85228 +_002132_hash+ieee80211_if_read_channel_type+3+23884+_002132_hash+NULL
85229 +_002133_hash+ieee80211_if_read_dot11MeshConfirmTimeout+3+60670+_002133_hash+NULL
85230 +_002134_hash+ieee80211_if_read_dot11MeshGateAnnouncementProtocol+3+14486+_002134_hash+NULL
85231 +_002135_hash+ieee80211_if_read_dot11MeshHoldingTimeout+3+47356+_002135_hash+NULL
85232 +_002136_hash+ieee80211_if_read_dot11MeshHWMPactivePathTimeout+3+7368+_002136_hash+NULL
85233 +_002137_hash+ieee80211_if_read_dot11MeshHWMPmaxPREQretries+3+59829+_002137_hash+NULL
85234 +_002138_hash+ieee80211_if_read_dot11MeshHWMPnetDiameterTraversalTime+3+1589+_002138_hash+NULL
85235 +_002139_hash+ieee80211_if_read_dot11MeshHWMPperrMinInterval+3+17346+_002139_hash+NULL
85236 +_002140_hash+ieee80211_if_read_dot11MeshHWMPpreqMinInterval+3+24208+_002140_hash+NULL
85237 +_002141_hash+ieee80211_if_read_dot11MeshHWMPRannInterval+3+2249+_002141_hash+NULL
85238 +_002142_hash+ieee80211_if_read_dot11MeshHWMPRootMode+3+51441+_002142_hash+NULL
85239 +_002143_hash+ieee80211_if_read_dot11MeshMaxPeerLinks+3+23878+_002143_hash+NULL
85240 +_002144_hash+ieee80211_if_read_dot11MeshMaxRetries+3+12756+_002144_hash+NULL
85241 +_002145_hash+ieee80211_if_read_dot11MeshRetryTimeout+3+52168+_002145_hash+NULL
85242 +_002146_hash+ieee80211_if_read_dot11MeshTTL+3+58307+_002146_hash+NULL
85243 +_002147_hash+ieee80211_if_read_dropped_frames_congestion+3+32603+_002147_hash+NULL
85244 +_002148_hash+ieee80211_if_read_dropped_frames_no_route+3+33383+_002148_hash+NULL
85245 +_002149_hash+ieee80211_if_read_dropped_frames_ttl+3+44500+_002149_hash+NULL
85246 +_002150_hash+ieee80211_if_read_drop_unencrypted+3+37053+_002150_hash+NULL
85247 +_002151_hash+ieee80211_if_read_dtim_count+3+38419+_002151_hash+NULL
85248 +_002152_hash+ieee80211_if_read_element_ttl+3+18869+_002152_hash+NULL
85249 +_002153_hash+ieee80211_if_read_estab_plinks+3+32533+_002153_hash+NULL
85250 +_002154_hash+ieee80211_if_read_flags+3+57470+_002389_hash+NULL+nohasharray
85251 +_002155_hash+ieee80211_if_read_fwded_frames+3+36520+_002155_hash+NULL
85252 +_002156_hash+ieee80211_if_read_fwded_mcast+3+39571+_002156_hash+&_000151_hash
85253 +_002157_hash+ieee80211_if_read_fwded_unicast+3+59740+_002859_hash+NULL+nohasharray
85254 +_002158_hash+ieee80211_if_read_last_beacon+3+31257+_002158_hash+NULL
85255 +_002159_hash+ieee80211_if_read_min_discovery_timeout+3+13946+_002159_hash+NULL
85256 +_002160_hash+ieee80211_if_read_num_buffered_multicast+3+12716+_002160_hash+NULL
85257 +_002161_hash+ieee80211_if_read_num_sta_authorized+3+56177+_002161_hash+NULL
85258 +_002162_hash+ieee80211_if_read_num_sta_ps+3+34722+_002162_hash+NULL
85259 +_002163_hash+ieee80211_if_read_path_refresh_time+3+25545+_002163_hash+NULL
85260 +_002164_hash+ieee80211_if_read_peer+3+45233+_002164_hash+NULL
85261 +_002165_hash+ieee80211_if_read_rc_rateidx_mask_2ghz+3+61570+_002165_hash+NULL
85262 +_002166_hash+ieee80211_if_read_rc_rateidx_mask_5ghz+3+27183+_002166_hash+NULL
85263 +_002167_hash+ieee80211_if_read_rc_rateidx_mcs_mask_2ghz+3+37675+_002167_hash+NULL
85264 +_002168_hash+ieee80211_if_read_rc_rateidx_mcs_mask_5ghz+3+44423+_002168_hash+NULL
85265 +_002169_hash+ieee80211_if_read_rssi_threshold+3+49260+_002169_hash+NULL
85266 +_002170_hash+ieee80211_if_read_smps+3+27416+_002170_hash+NULL
85267 +_002171_hash+ieee80211_if_read_state+3+9813+_002280_hash+NULL+nohasharray
85268 +_002172_hash+ieee80211_if_read_tkip_mic_test+3+19565+_002172_hash+NULL
85269 +_002173_hash+ieee80211_if_read_tsf+3+16420+_002173_hash+NULL
85270 +_002174_hash+ieee80211_if_read_uapsd_max_sp_len+3+15067+_002174_hash+NULL
85271 +_002175_hash+ieee80211_if_read_uapsd_queues+3+55150+_002175_hash+NULL
85272 +_002176_hash+ieee80211_rx_mgmt_beacon+3+24430+_002176_hash+NULL
85273 +_002177_hash+ieee80211_rx_mgmt_probe_resp+3+6918+_002177_hash+NULL
85274 +_002178_hash+ima_show_htable_violations+3+10619+_002178_hash+NULL
85275 +_002179_hash+ima_show_measurements_count+3+23536+_002179_hash+NULL
85276 +_002180_hash+insert_one_name+7+61668+_002180_hash+NULL
85277 +_002181_hash+ipr_change_queue_depth+2+6431+_002181_hash+NULL
85278 +_002182_hash+ip_recv_error+3+23109+_002182_hash+NULL
85279 +_002183_hash+ipv6_recv_error+3+56347+_002183_hash+NULL
85280 +_002184_hash+ipv6_recv_rxpmtu+3+7142+_002184_hash+NULL
85281 +_002185_hash+ipx_recvmsg+4+44366+_002185_hash+NULL
85282 +_002186_hash+irda_recvmsg_dgram+4+32631+_002186_hash+NULL
85283 +_002187_hash+iscsi_change_queue_depth+2+23416+_002187_hash+NULL
85284 +_002188_hash+ivtv_read_pos+3+34400+_002188_hash+&_000303_hash
85285 +_002189_hash+key_conf_hw_key_idx_read+3+25003+_002189_hash+NULL
85286 +_002190_hash+key_conf_keyidx_read+3+42443+_002190_hash+NULL
85287 +_002191_hash+key_conf_keylen_read+3+49758+_002191_hash+NULL
85288 +_002192_hash+key_flags_read+3+25931+_002192_hash+NULL
85289 +_002193_hash+key_ifindex_read+3+31411+_002193_hash+NULL
85290 +_002194_hash+key_tx_rx_count_read+3+44742+_002194_hash+NULL
85291 +_002195_hash+l2cap_sock_sendmsg+4+63427+_002195_hash+NULL
85292 +_002196_hash+l2tp_ip_recvmsg+4+22681+_002196_hash+NULL
85293 +_002197_hash+llc_ui_recvmsg+4+3826+_002197_hash+NULL
85294 +_002198_hash+lpfc_change_queue_depth+2+25905+_002198_hash+NULL
85295 +_002199_hash+macvtap_do_read+4+36555+_002199_hash+&_001832_hash
85296 +_002200_hash+megaraid_change_queue_depth+2+64815+_002200_hash+NULL
85297 +_002201_hash+megasas_change_queue_depth+2+32747+_002201_hash+NULL
85298 +_002202_hash+mptscsih_change_queue_depth+2+26036+_002202_hash+NULL
85299 +_002203_hash+NCR_700_change_queue_depth+2+31742+_002203_hash+NULL
85300 +_002204_hash+netlink_recvmsg+4+61600+_002204_hash+NULL
85301 +_002205_hash+nfsctl_transaction_read+3+48250+_002205_hash+NULL
85302 +_002206_hash+nfs_map_group_to_gid+3+15892+_002206_hash+NULL
85303 +_002207_hash+nfs_map_name_to_uid+3+51132+_002207_hash+NULL
85304 +_002208_hash+nr_recvmsg+4+12649+_002208_hash+NULL
85305 +_002209_hash+osd_req_list_collection_objects+5+36664+_002209_hash+NULL
85306 +_002210_hash+osd_req_list_partition_objects+5+56464+_002210_hash+NULL
85307 +_002212_hash+packet_recv_error+3+16669+_002212_hash+NULL
85308 +_002213_hash+packet_recvmsg+4+47700+_002213_hash+NULL
85309 +_002214_hash+pep_recvmsg+4+19402+_002214_hash+NULL
85310 +_002215_hash+pfkey_recvmsg+4+53604+_002215_hash+NULL
85311 +_002216_hash+ping_recvmsg+4+25597+_002216_hash+NULL
85312 +_002217_hash+pmcraid_change_queue_depth+2+9116+_002217_hash+NULL
85313 +_002218_hash+pn_recvmsg+4+30887+_002218_hash+NULL
85314 +_002219_hash+pointer_size_read+3+51863+_002219_hash+NULL
85315 +_002220_hash+power_read+3+15939+_002220_hash+NULL
85316 +_002221_hash+pppoe_recvmsg+4+15073+_002221_hash+NULL
85317 +_002222_hash+pppol2tp_recvmsg+4+57742+_002222_hash+NULL
85318 +_002223_hash+qla2x00_adjust_sdev_qdepth_up+2+20097+_002223_hash+NULL
85319 +_002224_hash+qla2x00_change_queue_depth+2+24742+_002224_hash+NULL
85320 +_002225_hash+raw_recvmsg+4+52529+_002225_hash+NULL
85321 +_002226_hash+rawsock_recvmsg+4+12144+_002226_hash+NULL
85322 +_002227_hash+rawv6_recvmsg+4+30265+_002227_hash+NULL
85323 +_002228_hash+reada_add_block+2+54247+_002228_hash+NULL
85324 +_002229_hash+readahead_tree_block+3+36285+_002229_hash+NULL
85325 +_002230_hash+reada_tree_block_flagged+3+18402+_002230_hash+NULL
85326 +_002231_hash+read_tree_block+3+841+_002231_hash+NULL
85327 +_002232_hash+recover_peb+6-7+29238+_002232_hash+NULL
85328 +_002234_hash+recv_msg+4+48709+_002234_hash+NULL
85329 +_002235_hash+recv_stream+4+30138+_002235_hash+NULL
85330 +_002236_hash+_req_append_segment+2+41031+_002236_hash+NULL
85331 +_002237_hash+request_key_async+4+6990+_002237_hash+NULL
85332 +_002238_hash+request_key_async_with_auxdata+4+46624+_002238_hash+NULL
85333 +_002239_hash+request_key_with_auxdata+4+24515+_002239_hash+NULL
85334 +_002240_hash+rose_recvmsg+4+2368+_002240_hash+NULL
85335 +_002241_hash+rxrpc_recvmsg+4+26233+_002241_hash+NULL
85336 +_002242_hash+rx_streaming_always_read+3+49401+_002242_hash+NULL
85337 +_002243_hash+rx_streaming_interval_read+3+55291+_002243_hash+NULL
85338 +_002244_hash+sas_change_queue_depth+2+18555+_002244_hash+NULL
85339 +_002245_hash+scsi_activate_tcq+2+42640+_002245_hash+NULL
85340 +_002246_hash+scsi_deactivate_tcq+2+47086+_002246_hash+NULL
85341 +_002247_hash+scsi_execute+5+33596+_002247_hash+NULL
85342 +_002248_hash+_scsih_adjust_queue_depth+2+1083+_002248_hash+NULL
85343 +_002249_hash+scsi_init_shared_tag_map+2+59812+_002249_hash+NULL
85344 +_002250_hash+scsi_track_queue_full+2+44239+_002250_hash+NULL
85345 +_002251_hash+sctp_recvmsg+4+23265+_002251_hash+NULL
85346 +_002252_hash+send_stream+4+3397+_002252_hash+NULL
85347 +_002253_hash+skb_copy_and_csum_datagram_iovec+2+24466+_002253_hash+NULL
85348 +_002255_hash+snd_gf1_mem_proc_dump+5+16926+_002255_hash+NULL
85349 +_002256_hash+split_scan_timeout_read+3+20029+_002256_hash+NULL
85350 +_002257_hash+sta_dev_read+3+14782+_002257_hash+NULL
85351 +_002258_hash+sta_inactive_ms_read+3+25690+_002258_hash+NULL
85352 +_002259_hash+sta_last_signal_read+3+31818+_002259_hash+NULL
85353 +_002260_hash+stats_dot11ACKFailureCount_read+3+45558+_002260_hash+NULL
85354 +_002261_hash+stats_dot11FCSErrorCount_read+3+28154+_002261_hash+NULL
85355 +_002262_hash+stats_dot11RTSFailureCount_read+3+43948+_002262_hash+NULL
85356 +_002263_hash+stats_dot11RTSSuccessCount_read+3+33065+_002263_hash+NULL
85357 +_002264_hash+storvsc_connect_to_vsp+2+22+_002264_hash+NULL
85358 +_002265_hash+suspend_dtim_interval_read+3+64971+_002265_hash+NULL
85359 +_002266_hash+sys_msgrcv+3+959+_002266_hash+NULL
85360 +_002267_hash+tcm_loop_change_queue_depth+2+42454+_002267_hash+NULL
85361 +_002268_hash+tcp_copy_to_iovec+3+28344+_002268_hash+NULL
85362 +_002269_hash+tcp_recvmsg+4+31238+_002269_hash+NULL
85363 +_002270_hash+timeout_read+3+47915+_002270_hash+NULL
85364 +_002271_hash+total_ps_buffered_read+3+16365+_002271_hash+NULL
85365 +_002272_hash+tun_put_user+4+59849+_002272_hash+NULL
85366 +_002273_hash+twa_change_queue_depth+2+48808+_002273_hash+NULL
85367 +_002274_hash+tw_change_queue_depth+2+11116+_002274_hash+NULL
85368 +_002275_hash+twl_change_queue_depth+2+41342+_002275_hash+NULL
85369 +_002276_hash+ubi_eba_write_leb+5-6+19826+_002276_hash+NULL
85370 +_002278_hash+ubi_eba_write_leb_st+5+27896+_002278_hash+NULL
85371 +_002279_hash+udp_recvmsg+4+42558+_002279_hash+NULL
85372 +_002280_hash+udpv6_recvmsg+4+9813+_002280_hash+&_002171_hash
85373 +_002281_hash+ulong_read_file+3+42304+_002281_hash+&_000511_hash
85374 +_002282_hash+unix_dgram_recvmsg+4+14952+_002282_hash+NULL
85375 +_002283_hash+user_power_read+3+39414+_002283_hash+NULL
85376 +_002284_hash+vcc_recvmsg+4+37198+_002284_hash+NULL
85377 +_002285_hash+wep_iv_read+3+54744+_002285_hash+NULL
85378 +_002286_hash+x25_recvmsg+4+42777+_002286_hash+NULL
85379 +_002287_hash+xfs_iext_insert+3+18667+_002287_hash+NULL
85380 +_002288_hash+xfs_iext_remove+3+50909+_002288_hash+NULL
85381 +_002289_hash+xlog_find_verify_log_record+2+18870+_002289_hash+NULL
85382 +_002290_hash+btrfs_alloc_free_block+3+29982+_002290_hash+NULL
85383 +_002291_hash+cx18_read_pos+3+4683+_002291_hash+NULL
85384 +_002292_hash+l2cap_sock_recvmsg+4+59886+_002292_hash+NULL
85385 +_002293_hash+osd_req_list_dev_partitions+4+60027+_002293_hash+NULL
85386 +_002294_hash+osd_req_list_partition_collections+5+38223+_002294_hash+NULL
85387 +_002295_hash+osst_do_scsi+4+44410+_002295_hash+NULL
85388 +_002296_hash+qla2x00_handle_queue_full+2+24365+_002296_hash+NULL
85389 +_002297_hash+rfcomm_sock_recvmsg+4+22227+_002297_hash+NULL
85390 +_002298_hash+scsi_execute_req+5+42088+_002298_hash+NULL
85391 +_002299_hash+_scsih_change_queue_depth+2+26230+_002299_hash+NULL
85392 +_002300_hash+spi_execute+5+28736+_002300_hash+NULL
85393 +_002301_hash+submit_inquiry+3+42108+_002301_hash+NULL
85394 +_002302_hash+tcp_dma_try_early_copy+3+37651+_002302_hash+NULL
85395 +_002303_hash+tun_do_read+4+50800+_002303_hash+NULL
85396 +_002304_hash+ubi_eba_atomic_leb_change+5+13041+_002304_hash+NULL
85397 +_002305_hash+ubi_leb_write+4-5+41691+_002305_hash+NULL
85398 +_002307_hash+unix_seqpacket_recvmsg+4+23062+_002307_hash+NULL
85399 +_002308_hash+write_leb+5+36957+_002308_hash+NULL
85400 +_002309_hash+ch_do_scsi+4+31171+_002309_hash+NULL
85401 +_002310_hash+dbg_leb_write+4-5+20478+_002310_hash+NULL
85402 +_002312_hash+scsi_mode_sense+5+16835+_002312_hash+NULL
85403 +_002313_hash+scsi_vpd_inquiry+4+30040+_002313_hash+NULL
85404 +_002314_hash+ses_recv_diag+4+47143+_002314_hash+&_000673_hash
85405 +_002315_hash+ses_send_diag+4+64527+_002315_hash+NULL
85406 +_002316_hash+spi_dv_device_echo_buffer+2-3+39846+_002316_hash+NULL
85407 +_002318_hash+ubifs_leb_write+4-5+61226+_002318_hash+NULL
85408 +_002320_hash+ubi_leb_change+4+14899+_002320_hash+NULL
85409 +_002321_hash+ubi_write+4-5+30809+_002321_hash+NULL
85410 +_002322_hash+dbg_leb_change+4+19969+_002322_hash+NULL
85411 +_002323_hash+gluebi_write+3+27905+_002323_hash+NULL
85412 +_002324_hash+scsi_get_vpd_page+4+51951+_002324_hash+NULL
85413 +_002325_hash+sd_do_mode_sense+5+11507+_002325_hash+NULL
85414 +_002326_hash+ubifs_leb_change+4+22399+_002436_hash+NULL+nohasharray
85415 +_002327_hash+ubifs_write_node+5+15088+_002327_hash+NULL
85416 +_002328_hash+fixup_leb+3+43256+_002328_hash+NULL
85417 +_002329_hash+recover_head+3+17904+_002329_hash+NULL
85418 +_002330_hash+alloc_cpu_rmap+1+65363+_002330_hash+NULL
85419 +_002331_hash+alloc_ebda_hpc+1-2+50046+_002331_hash+NULL
85420 +_002333_hash+alloc_sched_domains+1+28972+_002333_hash+NULL
85421 +_002334_hash+amthi_read+4+45831+_002334_hash+NULL
85422 +_002335_hash+bcm_char_read+3+31750+_002335_hash+NULL
85423 +_002336_hash+BcmCopySection+5+2035+_002336_hash+NULL
85424 +_002337_hash+buffer_from_user+3+51826+_002337_hash+NULL
85425 +_002338_hash+buffer_to_user+3+35439+_002338_hash+NULL
85426 +_002339_hash+c4iw_init_resource_fifo+3+48090+_002339_hash+NULL
85427 +_002340_hash+c4iw_init_resource_fifo_random+3+25547+_002340_hash+NULL
85428 +_002341_hash+card_send_command+3+40757+_002341_hash+NULL
85429 +_002342_hash+chd_dec_fetch_cdata+3+50926+_002342_hash+NULL
85430 +_002343_hash+crystalhd_create_dio_pool+2+3427+_002343_hash+NULL
85431 +_002344_hash+crystalhd_user_data+3+18407+_002344_hash+NULL
85432 +_002345_hash+cxio_init_resource_fifo+3+28764+_002345_hash+NULL
85433 +_002346_hash+cxio_init_resource_fifo_random+3+47151+_002346_hash+NULL
85434 +_002347_hash+do_pages_stat+2+4437+_002347_hash+NULL
85435 +_002348_hash+do_read_log_to_user+4+3236+_002348_hash+NULL
85436 +_002349_hash+do_write_log_from_user+3+39362+_002349_hash+NULL
85437 +_002350_hash+dt3155_read+3+59226+_002350_hash+NULL
85438 +_002351_hash+easycap_alsa_vmalloc+2+14426+_002351_hash+NULL
85439 +_002352_hash+evm_read_key+3+54674+_002352_hash+NULL
85440 +_002353_hash+evm_write_key+3+27715+_002353_hash+NULL
85441 +_002354_hash+fir16_create+3+5574+_002354_hash+NULL
85442 +_002355_hash+iio_allocate_device+1+18821+_002355_hash+NULL
85443 +_002356_hash+__iio_allocate_kfifo+2-3+55738+_002356_hash+NULL
85444 +_002358_hash+__iio_allocate_sw_ring_buffer+3+4843+_002358_hash+NULL
85445 +_002359_hash+iio_debugfs_read_reg+3+60908+_002359_hash+NULL
85446 +_002360_hash+iio_debugfs_write_reg+3+22742+_002360_hash+NULL
85447 +_002361_hash+iio_event_chrdev_read+3+54757+_002361_hash+NULL
85448 +_002362_hash+iio_read_first_n_kfifo+2+57910+_002362_hash+NULL
85449 +_002363_hash+iio_read_first_n_sw_rb+2+51911+_002363_hash+NULL
85450 +_002364_hash+ioapic_setup_resources+1+35255+_002364_hash+NULL
85451 +_002365_hash+keymap_store+4+45406+_002365_hash+NULL
85452 +_002366_hash+kzalloc_node+1+24352+_002366_hash+NULL
85453 +_002367_hash+line6_alloc_sysex_buffer+4+28225+_002367_hash+NULL
85454 +_002368_hash+line6_dumpreq_initbuf+3+53123+_002368_hash+NULL
85455 +_002369_hash+line6_midibuf_init+2+52425+_002369_hash+NULL
85456 +_002370_hash+lirc_write+3+20604+_002370_hash+NULL
85457 +_002371_hash+_malloc+1+54077+_002371_hash+NULL
85458 +_002372_hash+mei_read+3+6507+_002372_hash+NULL
85459 +_002373_hash+mei_write+3+4005+_002373_hash+NULL
85460 +_002374_hash+mempool_create_node+1+44715+_002374_hash+NULL
85461 +_002375_hash+msg_set+3+51725+_002375_hash+NULL
85462 +_002376_hash+newpart+6+47485+_002376_hash+NULL
85463 +_002377_hash+OS_kmalloc+1+36909+_002377_hash+NULL
85464 +_002378_hash+pcpu_alloc_bootmem+2+62074+_002378_hash+NULL
85465 +_002379_hash+pcpu_get_vm_areas+3+50085+_002379_hash+NULL
85466 +_002380_hash+resource_from_user+3+30341+_002380_hash+NULL
85467 +_002381_hash+sca3000_read_data+4+57064+_002381_hash+NULL
85468 +_002382_hash+sca3000_read_first_n_hw_rb+2+11479+_002382_hash+NULL
85469 +_002383_hash+send_midi_async+3+57463+_002383_hash+NULL
85470 +_002384_hash+sep_create_dcb_dmatables_context+6+37551+_002384_hash+NULL
85471 +_002385_hash+sep_create_dcb_dmatables_context_kernel+6+49728+_002385_hash+NULL
85472 +_002386_hash+sep_create_msgarea_context+4+33829+_002386_hash+NULL
85473 +_002387_hash+sep_lli_table_secure_dma+2-3+64042+_002387_hash+NULL
85474 +_002389_hash+sep_lock_user_pages+2-3+57470+_002389_hash+&_002154_hash
85475 +_002391_hash+sep_prepare_input_output_dma_table_in_dcb+4-5+63087+_002391_hash+NULL
85476 +_002393_hash+sep_read+3+17161+_002393_hash+NULL
85477 +_002394_hash+TransmitTcb+4+12989+_002394_hash+NULL
85478 +_002395_hash+ValidateDSDParamsChecksum+3+63654+_002395_hash+NULL
85479 +_002396_hash+Wb35Reg_BurstWrite+4+62327+_002396_hash+NULL
85480 +_002397_hash+__alloc_bootmem_low_node+2+25726+_002397_hash+&_001499_hash
85481 +_002398_hash+__alloc_bootmem_node+2+1992+_002398_hash+NULL
85482 +_002399_hash+alloc_irq_cpu_rmap+1+28459+_002399_hash+NULL
85483 +_002400_hash+alloc_ring+2-4+18278+_002400_hash+NULL
85484 +_002402_hash+c4iw_init_resource+2-3+30393+_002402_hash+NULL
85485 +_002404_hash+cxio_hal_init_resource+2-7-6+29771+_002404_hash+&_000284_hash
85486 +_002407_hash+cxio_hal_init_rhdl_resource+1+25104+_002407_hash+NULL
85487 +_002408_hash+disk_expand_part_tbl+2+30561+_002408_hash+NULL
85488 +_002409_hash+InterfaceTransmitPacket+3+42058+_002409_hash+NULL
85489 +_002410_hash+line6_dumpreq_init+3+34473+_002410_hash+NULL
85490 +_002411_hash+mempool_create+1+29437+_002411_hash+NULL
85491 +_002412_hash+pcpu_fc_alloc+2+11818+_002412_hash+NULL
85492 +_002413_hash+pod_alloc_sysex_buffer+3+31651+_002413_hash+NULL
85493 +_002414_hash+r8712_usbctrl_vendorreq+6+48489+_002414_hash+NULL
85494 +_002415_hash+r871x_set_wpa_ie+3+7000+_002415_hash+NULL
85495 +_002416_hash+sys_move_pages+2+42626+_002416_hash+NULL
85496 +_002417_hash+variax_alloc_sysex_buffer+3+15237+_002417_hash+NULL
85497 +_002418_hash+vme_user_write+3+15587+_002418_hash+NULL
85498 +_002419_hash+add_partition+2+55588+_002419_hash+NULL
85499 +_002420_hash+__alloc_bootmem_node_high+2+65076+_002420_hash+NULL
85500 +_002421_hash+ceph_msgpool_init+3+33312+_002421_hash+NULL
85501 +_002423_hash+mempool_create_kmalloc_pool+1+41650+_002423_hash+NULL
85502 +_002424_hash+mempool_create_page_pool+1+30189+_002424_hash+NULL
85503 +_002425_hash+mempool_create_slab_pool+1+62907+_002425_hash+NULL
85504 +_002426_hash+variax_set_raw2+4+32374+_002426_hash+NULL
85505 +_002427_hash+bioset_create+1+5580+_002427_hash+NULL
85506 +_002428_hash+bioset_integrity_create+2+62708+_002428_hash+NULL
85507 +_002429_hash+biovec_create_pools+2+9575+_002429_hash+NULL
85508 +_002430_hash+i2o_pool_alloc+4+55485+_002430_hash+NULL
85509 +_002431_hash+prison_create+1+43623+_002431_hash+NULL
85510 +_002432_hash+unlink_simple+3+47506+_002432_hash+NULL
85511 +_002433_hash+alloc_ieee80211+1+20063+_002433_hash+NULL
85512 +_002434_hash+alloc_ieee80211_rsl+1+34564+_002434_hash+NULL
85513 +_002435_hash+alloc_page_cgroup+1+2919+_002435_hash+NULL
85514 +_002436_hash+alloc_private+2+22399+_002436_hash+&_002326_hash
85515 +_002437_hash+alloc_rtllib+1+51136+_002437_hash+NULL
85516 +_002438_hash+alloc_rx_desc_ring+2+18016+_002438_hash+NULL
85517 +_002439_hash+alloc_subdevices+2+43300+_002439_hash+NULL
85518 +_002440_hash+atomic_counters_read+3+48827+_002440_hash+NULL
85519 +_002441_hash+atomic_stats_read+3+36228+_002441_hash+NULL
85520 +_002442_hash+capabilities_read+3+58457+_002442_hash+NULL
85521 +_002443_hash+comedi_read+3+13199+_002443_hash+NULL
85522 +_002444_hash+comedi_write+3+47926+_002444_hash+NULL
85523 +_002445_hash+compat_do_arpt_set_ctl+4+12184+_002445_hash+NULL
85524 +_002446_hash+compat_do_ip6t_set_ctl+4+3184+_002446_hash+NULL
85525 +_002447_hash+compat_do_ipt_set_ctl+4+58466+_002447_hash+&_001852_hash
85526 +_002448_hash+compat_filldir+3+32999+_002448_hash+NULL
85527 +_002449_hash+compat_filldir64+3+35354+_002449_hash+NULL
85528 +_002450_hash+compat_fillonedir+3+15620+_002450_hash+NULL
85529 +_002451_hash+compat_rw_copy_check_uvector+3+25242+_002451_hash+NULL
85530 +_002452_hash+compat_sock_setsockopt+5+23+_002452_hash+NULL
85531 +_002453_hash+compat_sys_kexec_load+2+35674+_002453_hash+NULL
85532 +_002454_hash+compat_sys_keyctl+4+9639+_002454_hash+NULL
85533 +_002455_hash+compat_sys_move_pages+2+5861+_002455_hash+NULL
85534 +_002456_hash+compat_sys_mq_timedsend+3+31060+_002456_hash+NULL
85535 +_002457_hash+compat_sys_msgrcv+2+7482+_002457_hash+NULL
85536 +_002458_hash+compat_sys_msgsnd+2+10738+_002458_hash+NULL
85537 +_002459_hash+compat_sys_semtimedop+3+3606+_002459_hash+NULL
85538 +_002460_hash+__copy_in_user+3+34790+_002460_hash+NULL
85539 +_002461_hash+copy_in_user+3+57502+_002461_hash+NULL
85540 +_002462_hash+dev_counters_read+3+19216+_002462_hash+NULL
85541 +_002463_hash+dev_names_read+3+38509+_002463_hash+NULL
85542 +_002464_hash+do_arpt_set_ctl+4+51053+_002464_hash+NULL
85543 +_002465_hash+do_ip6t_set_ctl+4+60040+_002465_hash+NULL
85544 +_002466_hash+do_ipt_set_ctl+4+56238+_002466_hash+NULL
85545 +_002467_hash+drbd_bm_resize+2+20522+_002467_hash+NULL
85546 +_002468_hash+driver_names_read+3+60399+_002468_hash+NULL
85547 +_002469_hash+driver_stats_read+3+8944+_002469_hash+NULL
85548 +_002470_hash+__earlyonly_bootmem_alloc+2+23824+_002470_hash+NULL
85549 +_002471_hash+evtchn_read+3+3569+_002471_hash+NULL
85550 +_002472_hash+ext_sd_execute_read_data+9+48589+_002472_hash+NULL
85551 +_002473_hash+ext_sd_execute_write_data+9+8175+_002473_hash+NULL
85552 +_002474_hash+fat_compat_ioctl_filldir+3+36328+_002474_hash+NULL
85553 +_002475_hash+firmwareUpload+3+32794+_002475_hash+NULL
85554 +_002476_hash+flash_read+3+57843+_002476_hash+NULL
85555 +_002477_hash+flash_write+3+62354+_002477_hash+NULL
85556 +_002478_hash+gather_array+3+56641+_002478_hash+NULL
85557 +_002479_hash+ghash_async_setkey+3+60001+_002479_hash+NULL
85558 +_002480_hash+gntdev_alloc_map+2+35145+_002480_hash+NULL
85559 +_002481_hash+gnttab_map+2+56439+_002481_hash+NULL
85560 +_002482_hash+gru_alloc_gts+2-3+60056+_002482_hash+NULL
85561 +_002484_hash+handle_eviocgbit+3+44193+_002484_hash+NULL
85562 +_002485_hash+hid_parse_report+3+51737+_002485_hash+NULL
85563 +_002486_hash+ieee80211_alloc_txb+1-2+52477+_002486_hash+NULL
85564 +_002487_hash+ieee80211_wx_set_gen_ie+3+51399+_002487_hash+NULL
85565 +_002488_hash+ieee80211_wx_set_gen_ie_rsl+3+3521+_002488_hash+NULL
85566 +_002489_hash+init_cdev+1+8274+_002489_hash+NULL
85567 +_002490_hash+init_per_cpu+1+17880+_002490_hash+NULL
85568 +_002491_hash+ipath_create_cq+2+45586+_002491_hash+NULL
85569 +_002492_hash+ipath_get_base_info+3+7043+_002492_hash+NULL
85570 +_002493_hash+ipath_init_qp_table+2+25167+_002493_hash+NULL
85571 +_002494_hash+ipath_resize_cq+2+712+_002494_hash+NULL
85572 +_002495_hash+ni_gpct_device_construct+5+610+_002495_hash+NULL
85573 +_002496_hash+options_write+3+47243+_002496_hash+NULL
85574 +_002497_hash+portcntrs_1_read+3+47253+_002497_hash+NULL
85575 +_002498_hash+portcntrs_2_read+3+56586+_002498_hash+NULL
85576 +_002499_hash+portnames_read+3+41958+_002499_hash+NULL
85577 +_002500_hash+ptc_proc_write+3+12076+_002500_hash+NULL
85578 +_002501_hash+put_cmsg_compat+4+35937+_002501_hash+NULL
85579 +_002502_hash+qib_alloc_devdata+2+51819+_002502_hash+NULL
85580 +_002503_hash+qib_alloc_fast_reg_page_list+2+10507+_002503_hash+NULL
85581 +_002504_hash+qib_cdev_init+1+34778+_002504_hash+NULL
85582 +_002505_hash+qib_create_cq+2+27497+_002505_hash+NULL
85583 +_002506_hash+qib_diag_write+3+62133+_002506_hash+NULL
85584 +_002507_hash+qib_get_base_info+3+11369+_002507_hash+NULL
85585 +_002508_hash+qib_resize_cq+2+53090+_002508_hash+NULL
85586 +_002509_hash+qsfp_1_read+3+21915+_002509_hash+NULL
85587 +_002510_hash+qsfp_2_read+3+31491+_002510_hash+NULL
85588 +_002511_hash+queue_reply+3+22416+_002511_hash+NULL
85589 +_002512_hash+Realloc+2+34961+_002512_hash+NULL
85590 +_002513_hash+rfc4106_set_key+3+54519+_002513_hash+NULL
85591 +_002514_hash+rtllib_alloc_txb+1-2+21687+_002514_hash+NULL
85592 +_002515_hash+rtllib_wx_set_gen_ie+3+59808+_002515_hash+NULL
85593 +_002516_hash+rts51x_transfer_data_partial+6+5735+_002516_hash+NULL
85594 +_002517_hash+sparse_early_usemaps_alloc_node+4+9269+_002517_hash+NULL
85595 +_002518_hash+split+2+11691+_002518_hash+NULL
85596 +_002519_hash+stats_read_ul+3+32751+_002519_hash+NULL
85597 +_002520_hash+store_debug_level+3+35652+_002520_hash+NULL
85598 +_002521_hash+sys32_ipc+3+7238+_002521_hash+NULL
85599 +_002522_hash+sys32_rt_sigpending+2+25814+_002522_hash+NULL
85600 +_002523_hash+tunables_read+3+36385+_002523_hash+NULL
85601 +_002524_hash+tunables_write+3+59563+_002524_hash+NULL
85602 +_002525_hash+u32_array_read+3+2219+_002525_hash+NULL
85603 +_002526_hash+usb_buffer_alloc+2+36276+_002526_hash+NULL
85604 +_002527_hash+xenbus_file_write+3+6282+_002527_hash+NULL
85605 +_002528_hash+xpc_kmalloc_cacheline_aligned+1+42895+_002528_hash+NULL
85606 +_002529_hash+xpc_kzalloc_cacheline_aligned+1+65433+_002529_hash+NULL
85607 +_002530_hash+xsd_read+3+15653+_002530_hash+NULL
85608 +_002531_hash+compat_do_readv_writev+4+49102+_002531_hash+NULL
85609 +_002532_hash+compat_keyctl_instantiate_key_iov+3+57431+_003110_hash+NULL+nohasharray
85610 +_002533_hash+compat_process_vm_rw+3-5+22254+_002533_hash+NULL
85611 +_002535_hash+compat_sys_setsockopt+5+3326+_002535_hash+NULL
85612 +_002536_hash+ipath_cdev_init+1+37752+_002536_hash+NULL
85613 +_002537_hash+ms_read_multiple_pages+4-5+8052+_002537_hash+NULL
85614 +_002539_hash+ms_write_multiple_pages+5-6+10362+_002539_hash+NULL
85615 +_002541_hash+sparse_mem_maps_populate_node+4+12669+_002541_hash+&_002004_hash
85616 +_002542_hash+vmemmap_alloc_block+1+43245+_002542_hash+NULL
85617 +_002543_hash+xd_read_multiple_pages+4-5+11422+_002543_hash+NULL
85618 +_002545_hash+xd_write_multiple_pages+5-6+53633+_002545_hash+NULL
85619 +_002546_hash+compat_readv+3+30273+_002546_hash+NULL
85620 +_002547_hash+compat_sys_process_vm_readv+3-5+15374+_002547_hash+NULL
85621 +_002549_hash+compat_sys_process_vm_writev+3-5+41194+_002549_hash+NULL
85622 +_002551_hash+compat_writev+3+60063+_002551_hash+NULL
85623 +_002552_hash+ms_rw_multi_sector+4+7459+_002552_hash+NULL
85624 +_002553_hash+sparse_early_mem_maps_alloc_node+4+36971+_002553_hash+NULL
85625 +_002554_hash+vmemmap_alloc_block_buf+1+61126+_002554_hash+NULL
85626 +_002555_hash+xd_rw+4+49020+_002555_hash+NULL
85627 +_002556_hash+compat_sys_preadv64+3+24283+_002556_hash+NULL
85628 +_002557_hash+compat_sys_pwritev64+3+51151+_002557_hash+NULL
85629 +_002558_hash+compat_sys_readv+3+20911+_002558_hash+NULL
85630 +_002559_hash+compat_sys_writev+3+5784+_002559_hash+NULL
85631 +_002560_hash+ms_rw+4+17220+_002560_hash+NULL
85632 +_002561_hash+compat_sys_preadv+3+583+_002561_hash+NULL
85633 +_002562_hash+compat_sys_pwritev+3+17886+_002562_hash+NULL
85634 +_002563_hash+alloc_apertures+1+56561+_002563_hash+NULL
85635 +_002564_hash+bin_uuid+3+28999+_002564_hash+NULL
85636 +_002565_hash+__copy_from_user_inatomic_nocache+3+49921+_002565_hash+NULL
85637 +_002566_hash+do_dmabuf_dirty_sou+7+3017+_002566_hash+NULL
85638 +_002567_hash+do_surface_dirty_sou+7+39678+_002567_hash+NULL
85639 +_002568_hash+drm_agp_bind_pages+3+56748+_002568_hash+NULL
85640 +_002569_hash+drm_calloc_large+1-2+65421+_002569_hash+NULL
85641 +_002571_hash+drm_fb_helper_init+3-4+19044+_002571_hash+NULL
85642 +_002573_hash+drm_ht_create+2+18853+_002573_hash+NULL
85643 +_002574_hash+drm_malloc_ab+1-2+16831+_002574_hash+NULL
85644 +_002576_hash+drm_mode_crtc_set_gamma_size+2+31881+_002576_hash+NULL
85645 +_002577_hash+drm_plane_init+6+28731+_002577_hash+NULL
85646 +_002578_hash+drm_property_create+4+51239+_002578_hash+NULL
85647 +_002579_hash+drm_property_create_blob+2+7414+_002579_hash+NULL
85648 +_002580_hash+drm_vblank_init+2+11362+_002580_hash+NULL
85649 +_002581_hash+drm_vmalloc_dma+1+14550+_002581_hash+NULL
85650 +_002582_hash+fb_alloc_cmap_gfp+2+20792+_002582_hash+NULL
85651 +_002583_hash+fbcon_prepare_logo+5+6246+_002583_hash+NULL
85652 +_002584_hash+fb_read+3+33506+_002584_hash+NULL
85653 +_002585_hash+fb_write+3+46924+_002585_hash+NULL
85654 +_002586_hash+framebuffer_alloc+1+59145+_002586_hash+NULL
85655 +_002587_hash+i915_cache_sharing_read+3+24775+_002587_hash+NULL
85656 +_002588_hash+i915_cache_sharing_write+3+57961+_002588_hash+NULL
85657 +_002589_hash+i915_max_freq_read+3+20581+_002589_hash+NULL
85658 +_002590_hash+i915_max_freq_write+3+11350+_002590_hash+NULL
85659 +_002591_hash+i915_wedged_read+3+35474+_002591_hash+NULL
85660 +_002592_hash+i915_wedged_write+3+47771+_002592_hash+NULL
85661 +_002593_hash+p9_client_read+5+19750+_002593_hash+NULL
85662 +_002594_hash+probe_kernel_write+3+17481+_002594_hash+NULL
85663 +_002595_hash+sched_feat_write+3+55202+_002595_hash+NULL
85664 +_002596_hash+sd_alloc_ctl_entry+1+29708+_002596_hash+NULL
85665 +_002597_hash+tstats_write+3+60432+_002597_hash+&_000009_hash
85666 +_002598_hash+ttm_bo_fbdev_io+4+9805+_002598_hash+NULL
85667 +_002599_hash+ttm_bo_io+5+47000+_002599_hash+NULL
85668 +_002600_hash+ttm_dma_page_pool_free+2+34135+_002600_hash+NULL
85669 +_002601_hash+ttm_page_pool_free+2+61661+_002601_hash+NULL
85670 +_002602_hash+vmw_execbuf_process+5+22885+_002602_hash+NULL
85671 +_002603_hash+vmw_fifo_reserve+2+12141+_002603_hash+NULL
85672 +_002604_hash+vmw_kms_present+9+38130+_002604_hash+NULL
85673 +_002605_hash+vmw_kms_readback+6+5727+_002605_hash+NULL
85674 +_002606_hash+do_dmabuf_dirty_ldu+6+52241+_002606_hash+NULL
85675 +_002607_hash+drm_mode_create_tv_properties+2+23122+_002607_hash+NULL
85676 +_002608_hash+drm_property_create_enum+5+29201+_002608_hash+NULL
85677 +_002609_hash+fast_user_write+5+20494+_002609_hash+NULL
85678 +_002610_hash+fb_alloc_cmap+2+6554+_002610_hash+NULL
85679 +_002611_hash+i915_gem_execbuffer_relocate_slow+7+25355+_002611_hash+NULL
85680 +_002612_hash+kgdb_hex2mem+3+24755+_002612_hash+NULL
85681 +_002613_hash+ttm_object_device_init+2+10321+_002613_hash+NULL
85682 +_002614_hash+ttm_object_file_init+2+27804+_002614_hash+NULL
85683 +_002615_hash+vmw_cursor_update_image+3-4+16332+_002615_hash+NULL
85684 +_002617_hash+vmw_gmr2_bind+3+21305+_002617_hash+NULL
85685 +_002618_hash+vmw_cursor_update_dmabuf+3-4+32045+_002618_hash+NULL
85686 +_002620_hash+vmw_gmr_bind+3+44130+_002620_hash+NULL
85687 +_002621_hash+vmw_du_crtc_cursor_set+4-5+28479+_002621_hash+NULL
85688 +_002622_hash+__module_alloc+1+50004+_002622_hash+NULL
85689 +_002623_hash+module_alloc_update_bounds_rw+1+63233+_002623_hash+NULL
85690 +_002624_hash+module_alloc_update_bounds_rx+1+58634+_002624_hash+NULL
85691 +_002625_hash+acpi_system_write_alarm+3+40205+_002625_hash+NULL
85692 +_002626_hash+create_table+2+16213+_002626_hash+NULL
85693 +_002627_hash+mem_read+3+57631+_002627_hash+NULL
85694 +_002628_hash+mem_write+3+22232+_002628_hash+NULL
85695 +_002629_hash+proc_fault_inject_read+3+36802+_002629_hash+NULL
85696 +_002630_hash+proc_fault_inject_write+3+21058+_002630_hash+NULL
85697 +_002631_hash+v9fs_fid_readn+4+60544+_002631_hash+NULL
85698 +_002632_hash+v9fs_file_read+3+40858+_002632_hash+NULL
85699 +_002633_hash+__devres_alloc+2+25598+_002633_hash+NULL
85700 +_002634_hash+alloc_dummy_extent_buffer+2+56374+_002634_hash+NULL
85701 +_002635_hash+alloc_fdtable+1+17389+_002635_hash+NULL
85702 +_002636_hash+alloc_large_system_hash+2+22391+_002636_hash+NULL
85703 +_002637_hash+alloc_ldt+2+21972+_002637_hash+NULL
85704 +_002638_hash+__alloc_skb+1+23940+_002638_hash+NULL
85705 +_002639_hash+__ata_change_queue_depth+3+23484+_002639_hash+NULL
85706 +_002640_hash+btrfs_alloc_free_block+3+8986+_002640_hash+NULL
85707 +_002641_hash+btrfs_find_device_for_logical+2+44993+_002641_hash+NULL
85708 +_002642_hash+ccid3_hc_rx_getsockopt+3+62331+_002642_hash+NULL
85709 +_002643_hash+ccid3_hc_tx_getsockopt+3+16314+_002643_hash+NULL
85710 +_002644_hash+cifs_readdata_alloc+1+26360+_002644_hash+NULL
85711 +_002645_hash+cistpl_vers_1+4+15023+_002645_hash+NULL
85712 +_002646_hash+cmm_read+3+57520+_002646_hash+NULL
85713 +_002647_hash+cosa_read+3+25966+_002647_hash+NULL
85714 +_002648_hash+dm_table_create+3+35687+_002648_hash+NULL
85715 +_002649_hash+dpcm_state_read_file+3+65489+_002649_hash+NULL
85716 +_002651_hash+edac_mc_alloc+4+3611+_002651_hash+NULL
85717 +_002652_hash+ep0_read+3+38095+_002652_hash+NULL
85718 +_002653_hash+event_buffer_read+3+48772+_002765_hash+NULL+nohasharray
85719 +_002654_hash+extend_netdev_table+2+21453+_002654_hash+NULL
85720 +_002655_hash+extract_entropy_user+3+26952+_002655_hash+NULL
85721 +_002656_hash+fcoe_ctlr_device_add+3+1793+_002656_hash+NULL
85722 +_002657_hash+fd_do_readv+3+51297+_002657_hash+NULL
85723 +_002658_hash+fd_do_writev+3+29329+_002658_hash+NULL
85724 +_002659_hash+ffs_ep0_read+3+2672+_002659_hash+NULL
85725 +_002660_hash+fill_readbuf+3+32464+_002660_hash+NULL
85726 +_002661_hash+fw_iso_buffer_alloc+2+13704+_002661_hash+NULL
85727 +_002662_hash+get_fd_set+1+3866+_002662_hash+NULL
85728 +_002663_hash+hidraw_report_event+3+20503+_002663_hash+NULL
85729 +_002664_hash+ieee80211_if_read_ht_opmode+3+29044+_002664_hash+NULL
85730 +_002665_hash+ieee80211_if_read_num_mcast_sta+3+12419+_002665_hash+NULL
85731 +_002666_hash+iwl_dbgfs_calib_disabled_read+3+22649+_002666_hash+NULL
85732 +_002667_hash+iwl_dbgfs_rf_reset_read+3+26512+_002667_hash+NULL
85733 +_002668_hash+ixgbe_alloc_q_vector+4-6+24439+_002668_hash+NULL
85734 +_002670_hash+joydev_handle_JSIOCSAXMAP+3+48898+_002836_hash+NULL+nohasharray
85735 +_002671_hash+joydev_handle_JSIOCSBTNMAP+3+15643+_002671_hash+NULL
85736 +_002672_hash+__kfifo_from_user_r+3+60345+_002672_hash+NULL
85737 +_002673_hash+kstrtoint_from_user+2+8778+_002673_hash+NULL
85738 +_002674_hash+kstrtol_from_user+2+10168+_002674_hash+NULL
85739 +_002675_hash+kstrtoll_from_user+2+19500+_002675_hash+NULL
85740 +_002676_hash+kstrtos16_from_user+2+28300+_002676_hash+NULL
85741 +_002677_hash+kstrtos8_from_user+2+58268+_002677_hash+NULL
85742 +_002678_hash+kstrtou16_from_user+2+54274+_002678_hash+NULL
85743 +_002679_hash+kstrtou8_from_user+2+55599+_002679_hash+NULL
85744 +_002680_hash+kstrtouint_from_user+2+10536+_002680_hash+NULL
85745 +_002681_hash+kstrtoul_from_user+2+64569+_002681_hash+NULL
85746 +_002682_hash+kstrtoull_from_user+2+63026+_002682_hash+NULL
85747 +_002683_hash+l2cap_create_iframe_pdu+3+40055+_002683_hash+NULL
85748 +_002684_hash+l2tp_ip6_recvmsg+4+62874+_002684_hash+NULL
85749 +_002685_hash+mem_cgroup_read+5+22461+_002685_hash+NULL
85750 +_002686_hash+nfs_fscache_get_super_cookie+3+44355+_002686_hash+&_001648_hash
85751 +_002687_hash+nfs_pgarray_set+2+1085+_002687_hash+NULL
85752 +_002688_hash+ntfs_rl_realloc+3+56831+_002688_hash+&_000363_hash
85753 +_002689_hash+ntfs_rl_realloc_nofail+3+32173+_002689_hash+NULL
85754 +_002690_hash+pn533_dep_link_up+5+22154+_002690_hash+NULL
85755 +_002691_hash+port_fops_write+3+54627+_002691_hash+NULL
85756 +_002692_hash+ptp_read+4+63251+_002692_hash+NULL
85757 +_002693_hash+qla4xxx_change_queue_depth+2+1268+_002693_hash+NULL
85758 +_002694_hash+reqsk_queue_alloc+2+40272+_002694_hash+NULL
85759 +_002695_hash+resize_info_buffer+2+62889+_002695_hash+NULL
85760 +_002696_hash+rfkill_fop_write+3+64808+_002696_hash+NULL
85761 +_002697_hash+rt2x00debug_write_rfcsr+3+41473+_002697_hash+NULL
85762 +_002698_hash+rvmalloc+1+46873+_002698_hash+NULL
85763 +_002699_hash+rw_copy_check_uvector+3+45748+_003398_hash+NULL+nohasharray
85764 +_002700_hash+sctp_getsockopt_active_key+2+45483+_002700_hash+NULL
85765 +_002701_hash+sctp_getsockopt_adaptation_layer+2+45375+_002701_hash+NULL
85766 +_002702_hash+sctp_getsockopt_assoc_ids+2+9043+_002702_hash+NULL
85767 +_002703_hash+sctp_getsockopt_associnfo+2+58169+_002703_hash+NULL
85768 +_002704_hash+sctp_getsockopt_assoc_number+2+6384+_002704_hash+NULL
85769 +_002705_hash+sctp_getsockopt_auto_asconf+2+46584+_002705_hash+NULL
85770 +_002706_hash+sctp_getsockopt_context+2+52490+_002706_hash+NULL
85771 +_002707_hash+sctp_getsockopt_default_send_param+2+63056+_002707_hash+NULL
85772 +_002708_hash+sctp_getsockopt_disable_fragments+2+12330+_002708_hash+NULL
85773 +_002709_hash+sctp_getsockopt_fragment_interleave+2+51215+_002709_hash+NULL
85774 +_002710_hash+sctp_getsockopt_initmsg+2+26042+_002710_hash+NULL
85775 +_002711_hash+sctp_getsockopt_mappedv4+2+20044+_002711_hash+NULL
85776 +_002712_hash+sctp_getsockopt_nodelay+2+9560+_002712_hash+NULL
85777 +_002713_hash+sctp_getsockopt_partial_delivery_point+2+60952+_002713_hash+NULL
85778 +_002714_hash+sctp_getsockopt_peeloff+2+59190+_002714_hash+NULL
85779 +_002715_hash+sctp_getsockopt_peer_addr_info+2+6024+_002715_hash+NULL
85780 +_002716_hash+sctp_getsockopt_peer_addr_params+2+53645+_002716_hash+NULL
85781 +_002717_hash+sctp_getsockopt_primary_addr+2+24639+_002717_hash+NULL
85782 +_002718_hash+sctp_getsockopt_rtoinfo+2+62027+_002718_hash+NULL
85783 +_002719_hash+sctp_getsockopt_sctp_status+2+56540+_002719_hash+NULL
85784 +_002720_hash+self_check_write+5+50856+_002720_hash+NULL
85785 +_002721_hash+smk_read_mapped+3+7562+_002721_hash+NULL
85786 +_002722_hash+smk_set_cipso+3+20379+_002722_hash+NULL
85787 +_002723_hash+smk_user_access+3+24440+_002723_hash+NULL
85788 +_002724_hash+smk_write_mapped+3+13519+_002724_hash+NULL
85789 +_002725_hash+smk_write_rules_list+3+18565+_002725_hash+NULL
85790 +_002726_hash+snd_mixart_BA0_read+5+45069+_002726_hash+NULL
85791 +_002727_hash+snd_mixart_BA1_read+5+5082+_002727_hash+NULL
85792 +_002728_hash+snd_pcm_oss_read2+3+54387+_002728_hash+NULL
85793 +_002729_hash+syslog_print+2+307+_002729_hash+NULL
85794 +_002730_hash+tcp_dma_try_early_copy+3+4457+_002730_hash+NULL
85795 +_002731_hash+tcp_send_rcvq+3+11316+_002731_hash+NULL
85796 +_002732_hash+tomoyo_init_log+2+61526+_002732_hash+NULL
85797 +_002733_hash+ubi_dump_flash+4+46381+_002733_hash+NULL
85798 +_002734_hash+ubi_eba_atomic_leb_change+5+60379+_002734_hash+NULL
85799 +_002735_hash+ubi_eba_write_leb+5-6+36029+_002735_hash+NULL
85800 +_002737_hash+ubi_eba_write_leb_st+5+44343+_002737_hash+NULL
85801 +_002738_hash+ubi_self_check_all_ff+4+41959+_002738_hash+NULL
85802 +_002739_hash+unix_bind+3+15668+_002739_hash+NULL
85803 +_002740_hash+usbvision_rvmalloc+1+19655+_002740_hash+NULL
85804 +_002742_hash+v4l2_ctrl_new+7+24927+_002742_hash+NULL
85805 +_002743_hash+v4l2_event_subscribe+3+53687+_002743_hash+NULL
85806 +_002744_hash+v9fs_direct_read+3+45546+_002744_hash+NULL
85807 +_002745_hash+v9fs_file_readn+4+36353+_002745_hash+&_001606_hash
85808 +_002746_hash+__videobuf_alloc_vb+1+5665+_002746_hash+NULL
85809 +_002747_hash+wm8350_write+3+24480+_002747_hash+NULL
85810 +_002748_hash+xfs_buf_read_uncached+3+42844+_002748_hash+NULL
85811 +_002749_hash+yurex_write+3+8761+_002749_hash+NULL
85812 +_002750_hash+alloc_skb+1+55439+_002750_hash+NULL
85813 +_002751_hash+alloc_skb_fclone+1+3467+_002751_hash+NULL
85814 +_002752_hash+ata_scsi_change_queue_depth+2+23126+_002752_hash+NULL
85815 +_002753_hash+ath6kl_disconnect_timeout_write+3+794+_002753_hash+NULL
85816 +_002754_hash+ath6kl_keepalive_write+3+45600+_002754_hash+NULL
85817 +_002755_hash+ath6kl_lrssi_roam_write+3+8362+_002755_hash+NULL
85818 +_002756_hash+ath6kl_regread_write+3+14220+_002756_hash+NULL
85819 +_002757_hash+core_sys_select+1+47494+_002757_hash+NULL
85820 +_002758_hash+do_syslog+3+56807+_002758_hash+NULL
85821 +_002759_hash+expand_fdtable+2+39273+_002759_hash+NULL
85822 +_002760_hash+fd_execute_cmd+3+1132+_002760_hash+NULL
85823 +_002761_hash+get_chars+3+40373+_002761_hash+NULL
85824 +_002762_hash+hid_report_raw_event+4+2762+_002762_hash+NULL
85825 +_002763_hash+inet_csk_listen_start+2+38233+_002763_hash+NULL
85826 +_002764_hash+kstrtou32_from_user+2+30361+_002764_hash+NULL
85827 +_002765_hash+l2cap_segment_sdu+4+48772+_002765_hash+&_002653_hash
85828 +_002766_hash+__netdev_alloc_skb+2+18595+_002766_hash+NULL
85829 +_002767_hash+nfs_readdata_alloc+2+65015+_002767_hash+NULL
85830 +_002768_hash+nfs_writedata_alloc+2+12133+_002768_hash+NULL
85831 +_002769_hash+ntfs_rl_append+2-4+6037+_002769_hash+NULL
85832 +_002771_hash+ntfs_rl_insert+2-4+4931+_002771_hash+NULL
85833 +_002773_hash+ntfs_rl_replace+2-4+14136+_002773_hash+NULL
85834 +_002775_hash+ntfs_rl_split+2-4+52328+_002775_hash+NULL
85835 +_002777_hash+port_fops_read+3+49626+_002777_hash+NULL
85836 +_002778_hash+random_read+3+13815+_002778_hash+NULL
85837 +_002779_hash+sg_proc_write_adio+3+45704+_002779_hash+NULL
85838 +_002780_hash+sg_proc_write_dressz+3+46316+_002780_hash+NULL
85839 +_002781_hash+tcp_sendmsg+4+30296+_002781_hash+NULL
85840 +_002782_hash+tomoyo_write_log2+2+34318+_002782_hash+NULL
85841 +_002783_hash+ubi_leb_change+4+10289+_002783_hash+NULL
85842 +_002784_hash+ubi_leb_write+4-5+5478+_002784_hash+NULL
85843 +_002786_hash+urandom_read+3+30462+_002786_hash+NULL
85844 +_002787_hash+v9fs_cached_file_read+3+2514+_002787_hash+NULL
85845 +_002788_hash+__videobuf_alloc_cached+1+12740+_002788_hash+NULL
85846 +_002789_hash+__videobuf_alloc_uncached+1+55711+_002789_hash+NULL
85847 +_002790_hash+wm8350_block_write+3+19727+_002790_hash+NULL
85848 +_002791_hash+alloc_tx+2+32143+_002791_hash+NULL
85849 +_002792_hash+alloc_wr+1-2+24635+_002792_hash+NULL
85850 +_002794_hash+ath6kl_endpoint_stats_write+3+59621+_002794_hash+NULL
85851 +_002795_hash+ath6kl_fwlog_mask_write+3+24810+_002795_hash+NULL
85852 +_002796_hash+ath9k_wmi_cmd+4+327+_002796_hash+NULL
85853 +_002797_hash+atm_alloc_charge+2+19517+_002879_hash+NULL+nohasharray
85854 +_002798_hash+ax25_output+2+22736+_002798_hash+NULL
85855 +_002799_hash+bcsp_prepare_pkt+3+12961+_002799_hash+NULL
85856 +_002800_hash+bt_skb_alloc+1+6404+_002800_hash+NULL
85857 +_002801_hash+capinc_tty_write+3+28539+_002801_hash+NULL
85858 +_002802_hash+cfpkt_create_pfx+1-2+23594+_002802_hash+NULL
85859 +_002804_hash+cmd_complete+6+51629+_002804_hash+NULL
85860 +_002805_hash+cmtp_add_msgpart+4+9252+_002805_hash+NULL
85861 +_002806_hash+cmtp_send_interopmsg+7+376+_002806_hash+NULL
85862 +_002807_hash+cxgb3_get_cpl_reply_skb+2+10620+_002807_hash+NULL
85863 +_002808_hash+dbg_leb_change+4+23555+_002808_hash+NULL
85864 +_002809_hash+dbg_leb_write+4-5+63555+_002809_hash+&_000940_hash
85865 +_002811_hash+dccp_listen_start+2+35918+_002811_hash+NULL
85866 +_002812_hash+__dev_alloc_skb+1+28681+_002812_hash+NULL
85867 +_002813_hash+diva_os_alloc_message_buffer+1+64568+_002813_hash+NULL
85868 +_002814_hash+dn_alloc_skb+2+6631+_002814_hash+NULL
85869 +_002815_hash+do_pselect+1+62061+_002815_hash+NULL
85870 +_002816_hash+_fc_frame_alloc+1+43568+_002816_hash+NULL
85871 +_002817_hash+find_skb+2+20431+_002817_hash+NULL
85872 +_002818_hash+fm_send_cmd+5+39639+_002818_hash+NULL
85873 +_002819_hash+gem_alloc_skb+2+51715+_002819_hash+NULL
85874 +_002820_hash+get_packet+3+41914+_002820_hash+NULL
85875 +_002821_hash+get_packet+3+5747+_002821_hash+NULL
85876 +_002822_hash+get_packet_pg+4+28023+_002822_hash+NULL
85877 +_002823_hash+get_skb+2+63008+_002823_hash+NULL
85878 +_002824_hash+hidp_queue_report+3+1881+_002824_hash+NULL
85879 +_002825_hash+__hidp_send_ctrl_message+4+28303+_002825_hash+NULL
85880 +_002826_hash+hycapi_rx_capipkt+3+11602+_002826_hash+NULL
85881 +_002827_hash+i2400m_net_rx+5+27170+_002827_hash+NULL
85882 +_002828_hash+igmpv3_newpack+2+35912+_002828_hash+NULL
85883 +_002829_hash+inet_listen+2+14723+_002829_hash+NULL
85884 +_002830_hash+isdn_net_ciscohdlck_alloc_skb+2+55209+_002830_hash+&_001724_hash
85885 +_002831_hash+isdn_ppp_ccp_xmit_reset+6+63297+_002831_hash+NULL
85886 +_002832_hash+kmsg_read+3+46514+_002832_hash+NULL
85887 +_002833_hash+_l2_alloc_skb+1+11883+_002833_hash+NULL
85888 +_002834_hash+l3_alloc_skb+1+32289+_002834_hash+NULL
85889 +_002835_hash+llc_alloc_frame+4+64366+_002835_hash+NULL
85890 +_002836_hash+mac_drv_rx_init+2+48898+_002836_hash+&_002670_hash
85891 +_002837_hash+mgmt_event+4+12810+_002837_hash+NULL
85892 +_002838_hash+mI_alloc_skb+1+24770+_002838_hash+NULL
85893 +_002839_hash+nci_skb_alloc+2+49757+_002839_hash+NULL
85894 +_002840_hash+netdev_alloc_skb+2+62437+_002840_hash+NULL
85895 +_002841_hash+__netdev_alloc_skb_ip_align+2+55067+_002841_hash+NULL
85896 +_002842_hash+new_skb+1+21148+_002842_hash+NULL
85897 +_002843_hash+nfc_alloc_recv_skb+1+10244+_002843_hash+NULL
85898 +_002844_hash+nfcwilink_skb_alloc+1+16167+_002844_hash+NULL
85899 +_002845_hash+nfulnl_alloc_skb+2+65207+_002845_hash+NULL
85900 +_002846_hash+ni65_alloc_mem+3+10664+_002846_hash+NULL
85901 +_002847_hash+pep_alloc_skb+3+46303+_002847_hash+NULL
85902 +_002848_hash+pn_raw_send+2+54330+_002848_hash+NULL
85903 +_002849_hash+__pskb_copy+2+9038+_002849_hash+NULL
85904 +_002850_hash+refill_pool+2+19477+_002850_hash+NULL
85905 +_002851_hash+rfcomm_wmalloc+2+58090+_002851_hash+NULL
85906 +_002852_hash+rx+4+57944+_002852_hash+NULL
85907 +_002853_hash+sctp_ulpevent_new+1+33377+_002853_hash+NULL
85908 +_002854_hash+send_command+4+10832+_002854_hash+NULL
85909 +_002855_hash+skb_copy_expand+2-3+7685+_002855_hash+&_000671_hash
85910 +_002857_hash+sk_stream_alloc_skb+2+57622+_002857_hash+NULL
85911 +_002858_hash+sock_alloc_send_pskb+2+21246+_002858_hash+NULL
85912 +_002859_hash+sock_rmalloc+2+59740+_002859_hash+&_002157_hash
85913 +_002860_hash+sock_wmalloc+2+16472+_002860_hash+NULL
85914 +_002861_hash+solos_param_store+4+34755+_002861_hash+NULL
85915 +_002862_hash+sys_select+1+38827+_002862_hash+NULL
85916 +_002863_hash+sys_syslog+3+10746+_002863_hash+NULL
85917 +_002864_hash+t4vf_pktgl_to_skb+2+39005+_002864_hash+NULL
85918 +_002865_hash+tcp_collapse+5-6+63294+_002865_hash+NULL
85919 +_002867_hash+tipc_cfg_reply_alloc+1+27606+_002867_hash+NULL
85920 +_002868_hash+ubifs_leb_change+4+17789+_002868_hash+NULL
85921 +_002869_hash+ubifs_leb_write+4-5+22679+_002869_hash+NULL
85922 +_002871_hash+ulog_alloc_skb+1+23427+_002871_hash+NULL
85923 +_002872_hash+_alloc_mISDN_skb+3+52232+_002872_hash+NULL
85924 +_002873_hash+ath9k_multi_regread+4+65056+_002873_hash+NULL
85925 +_002874_hash+ath_rxbuf_alloc+2+24745+_002874_hash+NULL
85926 +_002875_hash+ax25_send_frame+2+19964+_002875_hash+NULL
85927 +_002876_hash+bchannel_get_rxbuf+2+37213+_002876_hash+NULL
85928 +_002877_hash+cfpkt_create+1+18197+_002877_hash+NULL
85929 +_002878_hash+console_store+4+36007+_002878_hash+NULL
85930 +_002879_hash+dev_alloc_skb+1+19517+_002879_hash+&_002797_hash
85931 +_002880_hash+dn_nsp_do_disc+2-6+49474+_002880_hash+NULL
85932 +_002882_hash+do_write_orph_node+2+64343+_002882_hash+NULL
85933 +_002883_hash+dsp_cmx_send_member+2+15625+_002883_hash+NULL
85934 +_002884_hash+fc_frame_alloc+2+1596+_002884_hash+NULL
85935 +_002885_hash+fc_frame_alloc_fill+2+59394+_002885_hash+NULL
85936 +_002886_hash+fmc_send_cmd+5+20435+_002886_hash+NULL
85937 +_002887_hash+hci_send_cmd+3+43810+_002887_hash+NULL
85938 +_002888_hash+hci_si_event+3+1404+_002888_hash+NULL
85939 +_002889_hash+hfcpci_empty_bfifo+4+62323+_002889_hash+NULL
85940 +_002890_hash+hidp_send_ctrl_message+4+43702+_002890_hash+NULL
85941 +_002891_hash+hysdn_sched_rx+3+60533+_002891_hash+NULL
85942 +_002892_hash+inet_dccp_listen+2+28565+_002892_hash+NULL
85943 +_002893_hash+ip6_append_data+4-5+36490+_002893_hash+NULL
85944 +_002894_hash+__ip_append_data+7-8+36191+_002894_hash+NULL
85945 +_002895_hash+l1oip_socket_recv+6+56537+_002895_hash+NULL
85946 +_002896_hash+l2cap_build_cmd+4+48676+_002896_hash+NULL
85947 +_002897_hash+l2down_create+4+21755+_002897_hash+NULL
85948 +_002898_hash+l2up_create+3+6430+_002898_hash+NULL
85949 +_002899_hash+ldisc_receive+4+41516+_002899_hash+NULL
85950 +_002902_hash+lro_gen_skb+6+2644+_002902_hash+NULL
85951 +_002903_hash+macvtap_alloc_skb+2-4-3+50629+_002903_hash+NULL
85952 +_002906_hash+mgmt_device_found+10+14146+_002906_hash+NULL
85953 +_002907_hash+nci_send_cmd+3+58206+_002907_hash+NULL
85954 +_002908_hash+netdev_alloc_skb_ip_align+2+40811+_002908_hash+NULL
85955 +_002909_hash+nfcwilink_send_bts_cmd+3+10802+_002909_hash+NULL
85956 +_002910_hash+nfqnl_mangle+2+14583+_002910_hash+NULL
85957 +_002911_hash+p54_alloc_skb+3+34366+_002911_hash+&_000475_hash
85958 +_002912_hash+packet_alloc_skb+2-5-4+62602+_002912_hash+NULL
85959 +_002915_hash+pep_indicate+5+38611+_002915_hash+NULL
85960 +_002916_hash+pep_reply+5+50582+_002916_hash+NULL
85961 +_002917_hash+pipe_handler_request+5+50774+_002917_hash+&_001189_hash
85962 +_002918_hash+ql_process_mac_rx_page+4+15543+_002918_hash+NULL
85963 +_002919_hash+ql_process_mac_rx_skb+4+6689+_002919_hash+NULL
85964 +_002920_hash+rfcomm_tty_write+3+51603+_002920_hash+NULL
85965 +_002921_hash+send_mpa_reject+3+7135+_002921_hash+NULL
85966 +_002922_hash+send_mpa_reply+3+32372+_002922_hash+NULL
85967 +_002923_hash+set_rxd_buffer_pointer+8+9950+_002923_hash+NULL
85968 +_002924_hash+sge_rx+3+50594+_002924_hash+NULL
85969 +_002925_hash+skb_cow_data+2+11565+_002925_hash+NULL
85970 +_002926_hash+smp_build_cmd+3+45853+_002926_hash+NULL
85971 +_002927_hash+sock_alloc_send_skb+2+23720+_002927_hash+NULL
85972 +_002928_hash+sys_pselect6+1+57449+_002928_hash+NULL
85973 +_002929_hash+tcp_fragment+3+20436+_002929_hash+NULL
85974 +_002930_hash+teiup_create+3+43201+_002930_hash+NULL
85975 +_002931_hash+tg3_run_loopback+2+30093+_002931_hash+NULL
85976 +_002932_hash+tun_alloc_skb+2-4-3+41216+_002932_hash+NULL
85977 +_002935_hash+ubifs_write_node+5+11258+_002935_hash+NULL
85978 +_002936_hash+use_pool+2+64607+_002936_hash+NULL
85979 +_002937_hash+vxge_rx_alloc+3+52024+_002937_hash+NULL
85980 +_002938_hash+add_packet+3+54433+_002938_hash+NULL
85981 +_002939_hash+add_rx_skb+3+8257+_002939_hash+NULL
85982 +_002940_hash+ath6kl_buf_alloc+1+57304+_002940_hash+NULL
85983 +_002941_hash+bat_iv_ogm_aggregate_new+2+2620+_002941_hash+NULL
85984 +_002942_hash+bnx2fc_process_l2_frame_compl+3+65072+_002942_hash+NULL
85985 +_002943_hash+brcmu_pkt_buf_get_skb+1+5556+_002943_hash+NULL
85986 +_002944_hash+br_send_bpdu+3+29669+_002944_hash+NULL
85987 +_002945_hash+bt_skb_send_alloc+2+6581+_002945_hash+NULL
85988 +_002946_hash+c4iw_reject_cr+3+28174+_002946_hash+NULL
85989 +_002947_hash+carl9170_rx_copy_data+2+21656+_002947_hash+NULL
85990 +_002948_hash+cfpkt_add_body+3+44630+_002948_hash+NULL
85991 +_002949_hash+cfpkt_append+3+61206+_002949_hash+NULL
85992 +_002950_hash+cosa_net_setup_rx+2+38594+_002950_hash+NULL
85993 +_002951_hash+cxgb4_pktgl_to_skb+2+61899+_002951_hash+NULL
85994 +_002952_hash+dn_alloc_send_pskb+2+4465+_002952_hash+NULL
85995 +_002953_hash+dn_nsp_return_disc+2+60296+_002953_hash+NULL
85996 +_002954_hash+dn_nsp_send_disc+2+23469+_002954_hash+NULL
85997 +_002955_hash+dsp_tone_hw_message+3+17678+_002955_hash+NULL
85998 +_002956_hash+dvb_net_sec+3+37884+_002956_hash+NULL
85999 +_002957_hash+e1000_check_copybreak+3+62448+_002957_hash+NULL
86000 +_002958_hash+fast_rx_path+3+59214+_002958_hash+NULL
86001 +_002959_hash+fc_fcp_frame_alloc+2+12624+_002959_hash+NULL
86002 +_002960_hash+fcoe_ctlr_send_keep_alive+3+15308+_002960_hash+NULL
86003 +_002961_hash+fwnet_incoming_packet+3+40380+_002961_hash+NULL
86004 +_002962_hash+fwnet_pd_new+4+39947+_002962_hash+NULL
86005 +_002963_hash+got_frame+2+16028+_002963_hash+NULL
86006 +_002964_hash+gsm_mux_rx_netchar+3+33336+_002964_hash+NULL
86007 +_002965_hash+hdlcdev_rx+3+997+_002965_hash+NULL
86008 +_002966_hash+hdlc_empty_fifo+2+18397+_002966_hash+NULL
86009 +_002967_hash+hfc_empty_fifo+2+57972+_002967_hash+NULL
86010 +_002968_hash+hfcpci_empty_fifo+4+2427+_002968_hash+NULL
86011 +_002969_hash+hfcsusb_rx_frame+3+52745+_002969_hash+NULL
86012 +_002970_hash+hidp_output_raw_report+3+5629+_002970_hash+NULL
86013 +_002971_hash+hscx_empty_fifo+2+13360+_002971_hash+NULL
86014 +_002972_hash+hysdn_rx_netpkt+3+16136+_002972_hash+NULL
86015 +_002973_hash+ieee80211_fragment+4+33112+_002973_hash+NULL
86016 +_002974_hash+ieee80211_probereq_get+4-6+29069+_002974_hash+NULL
86017 +_002976_hash+ieee80211_send_auth+5+24121+_002976_hash+NULL
86018 +_002977_hash+ieee80211_set_probe_resp+3+10077+_002977_hash+NULL
86019 +_002978_hash+ieee80211_tdls_mgmt+8+9581+_002978_hash+NULL
86020 +_002979_hash+ip6_ufo_append_data+5-7-6+4780+_002979_hash+NULL
86021 +_002982_hash+ip_ufo_append_data+6-8-7+12775+_002982_hash+NULL
86022 +_002985_hash+ipw_packet_received_skb+2+1230+_002985_hash+NULL
86023 +_002986_hash+iwch_reject_cr+3+23901+_002986_hash+NULL
86024 +_002987_hash+iwm_rx_packet_alloc+3+9898+_002987_hash+NULL
86025 +_002988_hash+ixgb_check_copybreak+3+5847+_002988_hash+NULL
86026 +_002989_hash+l1oip_socket_parse+4+4507+_002989_hash+NULL
86027 +_002990_hash+l2cap_send_cmd+4+14548+_002990_hash+NULL
86028 +_002991_hash+l2tp_ip6_sendmsg+4+7461+_002991_hash+NULL
86029 +_002993_hash+lowpan_fragment_xmit+3-4+22095+_002993_hash+NULL
86030 +_002996_hash+mcs_unwrap_fir+3+25733+_002996_hash+NULL
86031 +_002997_hash+mcs_unwrap_mir+3+9455+_002997_hash+NULL
86032 +_002998_hash+mld_newpack+2+50950+_002998_hash+NULL
86033 +_002999_hash+nfc_alloc_send_skb+4+3167+_002999_hash+NULL
86034 +_003000_hash+p54_download_eeprom+4+43842+_003000_hash+NULL
86035 +_003002_hash+ppp_tx_cp+5+62044+_003002_hash+NULL
86036 +_003003_hash+prism2_send_mgmt+4+62605+_003003_hash+&_001876_hash
86037 +_003004_hash+prism2_sta_send_mgmt+5+43916+_003004_hash+NULL
86038 +_003005_hash+_queue_data+4+54983+_003005_hash+NULL
86039 +_003006_hash+read_dma+3+55086+_003006_hash+NULL
86040 +_003007_hash+read_fifo+3+826+_003007_hash+NULL
86041 +_003008_hash+receive_copy+3+12216+_003008_hash+NULL
86042 +_003009_hash+rtl8169_try_rx_copy+3+705+_003009_hash+NULL
86043 +_003010_hash+_rtl92s_firmware_downloadcode+3+14021+_003010_hash+NULL
86044 +_003011_hash+rx_data+4+60442+_003011_hash+NULL
86045 +_003012_hash+sis190_try_rx_copy+3+57069+_003012_hash+NULL
86046 +_003013_hash+skge_rx_get+3+40598+_003013_hash+NULL
86047 +_003014_hash+tcp_mark_head_lost+2+35895+_003014_hash+NULL
86048 +_003015_hash+tcp_match_skb_to_sack+3-4+23568+_003015_hash+NULL
86049 +_003017_hash+tso_fragment+3+29050+_003017_hash+NULL
86050 +_003018_hash+tt_response_fill_table+1+57902+_003018_hash+NULL
86051 +_003020_hash+udpv6_sendmsg+4+22316+_003020_hash+NULL
86052 +_003021_hash+velocity_rx_copy+2+34583+_003021_hash+NULL
86053 +_003022_hash+W6692_empty_Bfifo+2+47804+_003022_hash+NULL
86054 +_003023_hash+zd_mac_rx+3+38296+_003023_hash+NULL
86055 +_003024_hash+ath6kl_wmi_get_new_buf+1+52304+_003024_hash+NULL
86056 +_003025_hash+bat_iv_ogm_queue_add+3+30870+_003025_hash+NULL
86057 +_003026_hash+brcmf_alloc_pkt_and_read+2+63116+_003026_hash+&_001808_hash
86058 +_003027_hash+brcmf_sdcard_recv_buf+6+38179+_003027_hash+NULL
86059 +_003028_hash+brcmf_sdcard_rwdata+5+65041+_003028_hash+NULL
86060 +_003029_hash+brcmf_sdcard_send_buf+6+7713+_003029_hash+NULL
86061 +_003030_hash+carl9170_handle_mpdu+3+11056+_003030_hash+NULL
86062 +_003031_hash+cfpkt_add_trail+3+27260+_003031_hash+NULL
86063 +_003032_hash+cfpkt_pad_trail+2+55511+_003032_hash+NULL
86064 +_003033_hash+dvb_net_sec_callback+2+28786+_003033_hash+NULL
86065 +_003034_hash+fwnet_receive_packet+9+50537+_003034_hash+NULL
86066 +_003035_hash+handle_rx_packet+3+58993+_003035_hash+NULL
86067 +_003036_hash+HDLC_irq+2+8709+_003036_hash+NULL
86068 +_003037_hash+hdlc_rpr_irq+2+10240+_003037_hash+NULL
86069 +_003043_hash+ipwireless_network_packet_received+4+51277+_003043_hash+NULL
86070 +_003044_hash+l2cap_bredr_sig_cmd+3+49065+_003044_hash+NULL
86071 +_003045_hash+l2cap_sock_alloc_skb_cb+2+33532+_003045_hash+NULL
86072 +_003046_hash+llcp_allocate_pdu+3+19866+_003046_hash+NULL
86073 +_003047_hash+ppp_cp_event+6+2965+_003047_hash+NULL
86074 +_003048_hash+receive_client_update_packet+3+49104+_003048_hash+NULL
86075 +_003049_hash+receive_server_sync_packet+3+59021+_003049_hash+NULL
86076 +_003050_hash+sky2_receive+2+13407+_003050_hash+NULL
86077 +_003051_hash+tcp_sacktag_walk+5-6+49703+_003051_hash+NULL
86078 +_003053_hash+tcp_write_xmit+2+64602+_003053_hash+NULL
86079 +_003054_hash+ath6kl_wmi_add_wow_pattern_cmd+4+12842+_003054_hash+NULL
86080 +_003055_hash+ath6kl_wmi_beginscan_cmd+8+25462+_003055_hash+NULL
86081 +_003056_hash+ath6kl_wmi_send_probe_response_cmd+6+31728+_003056_hash+NULL
86082 +_003057_hash+ath6kl_wmi_set_appie_cmd+5+39266+_003057_hash+NULL
86083 +_003058_hash+ath6kl_wmi_set_ie_cmd+6+37260+_003058_hash+NULL
86084 +_003059_hash+ath6kl_wmi_startscan_cmd+8+33674+_003059_hash+NULL
86085 +_003060_hash+ath6kl_wmi_test_cmd+3+27312+_003060_hash+NULL
86086 +_003061_hash+brcmf_sdbrcm_membytes+3-5+37324+_003061_hash+NULL
86087 +_003063_hash+brcmf_sdbrcm_read_control+3+22721+_003063_hash+NULL
86088 +_003064_hash+brcmf_tx_frame+3+20978+_003064_hash+NULL
86089 +_003065_hash+__carl9170_rx+3+56784+_003065_hash+NULL
86090 +_003066_hash+cfpkt_setlen+2+49343+_003066_hash+NULL
86091 +_003067_hash+hdlc_irq_one+2+3944+_003067_hash+NULL
86092 +_003069_hash+tcp_push_one+2+48816+_003069_hash+NULL
86093 +_003070_hash+__tcp_push_pending_frames+2+48148+_003070_hash+NULL
86094 +_003071_hash+brcmf_sdbrcm_bus_txctl+3+42492+_003071_hash+NULL
86095 +_003072_hash+carl9170_rx+3+13272+_003072_hash+NULL
86096 +_003073_hash+carl9170_rx_stream+3+1334+_003073_hash+NULL
86097 +_003074_hash+tcp_push+3+10680+_003074_hash+NULL
86098 +_003075_hash+create_log+2+8225+_003075_hash+NULL
86099 +_003076_hash+expand_files+2+17080+_003076_hash+NULL
86100 +_003077_hash+iio_device_alloc+1+41440+_003077_hash+NULL
86101 +_003078_hash+OS_mem_token_alloc+1+14276+_003078_hash+NULL
86102 +_003079_hash+packet_came+3+18072+_003079_hash+NULL
86103 +_003080_hash+softsynth_write+3+3455+_003080_hash+NULL
86104 +_003081_hash+alloc_fd+1+37637+_003081_hash+NULL
86105 +_003082_hash+sys_dup3+2+33421+_003082_hash+NULL
86106 +_003083_hash+do_fcntl+3+31468+_003083_hash+NULL
86107 +_003084_hash+sys_dup2+2+25284+_003084_hash+NULL
86108 +_003085_hash+sys_fcntl+3+19267+_003085_hash+NULL
86109 +_003086_hash+sys_fcntl64+3+29031+_003086_hash+NULL
86110 +_003087_hash+cmpk_message_handle_tx+4+54024+_003087_hash+NULL
86111 +_003088_hash+comedi_buf_alloc+3+24822+_003088_hash+NULL
86112 +_003089_hash+compat_rw_copy_check_uvector+3+22001+_003089_hash+&_001989_hash
86113 +_003090_hash+compat_sys_fcntl64+3+60256+_003090_hash+NULL
86114 +_003091_hash+evtchn_write+3+43278+_003091_hash+NULL
86115 +_003092_hash+fw_download_code+3+13249+_003092_hash+NULL
86116 +_003093_hash+fwSendNullPacket+2+54618+_003093_hash+NULL
86117 +_003095_hash+ieee80211_authentication_req+3+63973+_003095_hash+NULL
86118 +_003097_hash+rtllib_authentication_req+3+26713+_003097_hash+NULL
86119 +_003098_hash+SendTxCommandPacket+3+42901+_003098_hash+NULL
86120 +_003099_hash+snd_nm256_capture_copy+5+28622+_003099_hash+NULL
86121 +_003100_hash+snd_nm256_playback_copy+5+38567+_003100_hash+NULL
86122 +_003101_hash+tomoyo_init_log+2+14806+_003101_hash+NULL
86123 +_003102_hash+usbdux_attach_common+4+51764+_003271_hash+NULL+nohasharray
86124 +_003103_hash+compat_sys_fcntl+3+15654+_003103_hash+NULL
86125 +_003104_hash+ieee80211_auth_challenge+3+18810+_003104_hash+NULL
86126 +_003105_hash+ieee80211_rtl_auth_challenge+3+61897+_003105_hash+NULL
86127 +_003106_hash+resize_async_buffer+4+64031+_003106_hash+&_002119_hash
86128 +_003107_hash+rtllib_auth_challenge+3+12493+_003107_hash+NULL
86129 +_003108_hash+tomoyo_write_log2+2+11732+_003108_hash+NULL
86130 +_003109_hash+allocate_probes+1+40204+_003109_hash+NULL
86131 +_003110_hash+alloc_ftrace_hash+1+57431+_003110_hash+&_002532_hash
86132 +_003111_hash+__alloc_preds+2+9492+_003111_hash+NULL
86133 +_003112_hash+__alloc_pred_stack+2+26687+_003112_hash+NULL
86134 +_003113_hash+alloc_sched_domains+1+47756+_003113_hash+NULL
86135 +_003114_hash+alloc_trace_probe+6+38720+_003114_hash+NULL
86136 +_003115_hash+alloc_trace_uprobe+3+13870+_003115_hash+NULL
86137 +_003116_hash+arcfb_write+3+8702+_003116_hash+NULL
86138 +_003117_hash+ath6kl_sdio_alloc_prep_scat_req+2+51986+_003117_hash+NULL
86139 +_003118_hash+ath6kl_usb_post_recv_transfers+2+32892+_003118_hash+NULL
86140 +_003119_hash+ath6kl_usb_submit_ctrl_in+6+32880+_003119_hash+&_000778_hash
86141 +_003120_hash+ath6kl_usb_submit_ctrl_out+6+9978+_003120_hash+NULL
86142 +_003121_hash+auok190xfb_write+3+37001+_003121_hash+NULL
86143 +_003122_hash+beacon_interval_write+3+17952+_003122_hash+NULL
86144 +_003123_hash+blk_dropped_read+3+4168+_003123_hash+NULL
86145 +_003124_hash+blk_msg_write+3+13655+_003124_hash+NULL
86146 +_003125_hash+brcmf_usbdev_qinit+2+19090+_003125_hash+&_001533_hash
86147 +_003126_hash+brcmf_usb_dl_cmd+4+53130+_003126_hash+NULL
86148 +_003127_hash+broadsheetfb_write+3+39976+_003127_hash+NULL
86149 +_003128_hash+broadsheet_spiflash_rewrite_sector+2+54864+_003128_hash+NULL
86150 +_003129_hash+cyttsp_probe+4+1940+_003129_hash+NULL
86151 +_003130_hash+da9052_group_write+3+4534+_003130_hash+NULL
86152 +_003131_hash+dccpprobe_read+3+52549+_003131_hash+NULL
86153 +_003132_hash+drm_property_create_bitmask+5+30195+_003132_hash+NULL
86154 +_003133_hash+dtim_interval_write+3+30489+_003133_hash+NULL
86155 +_003134_hash+dynamic_ps_timeout_write+3+37713+_003134_hash+NULL
86156 +_003135_hash+event_enable_read+3+7074+_003135_hash+NULL
86157 +_003136_hash+event_enable_write+3+45238+_003136_hash+NULL
86158 +_003137_hash+event_filter_read+3+23494+_003137_hash+NULL
86159 +_003138_hash+event_filter_write+3+56609+_003138_hash+NULL
86160 +_003139_hash+event_id_read+3+64288+_003139_hash+&_001240_hash
86161 +_003140_hash+f_audio_buffer_alloc+1+41110+_003140_hash+NULL
86162 +_003141_hash+fb_sys_read+3+13778+_003141_hash+NULL
86163 +_003142_hash+fb_sys_write+3+33130+_003142_hash+NULL
86164 +_003143_hash+forced_ps_write+3+37209+_003143_hash+NULL
86165 +_003144_hash+__fprog_create+2+41263+_003144_hash+NULL
86166 +_003145_hash+fq_codel_zalloc+1+15378+_003145_hash+NULL
86167 +_003146_hash+ftrace_pid_write+3+39710+_003146_hash+NULL
86168 +_003147_hash+ftrace_profile_read+3+21327+_003147_hash+NULL
86169 +_003148_hash+ftrace_profile_write+3+53327+_003148_hash+NULL
86170 +_003149_hash+ftrace_write+3+29551+_003149_hash+NULL
86171 +_003150_hash+gdm_wimax_netif_rx+3+43423+_003150_hash+&_001619_hash
86172 +_003151_hash+gpio_power_write+3+1991+_003151_hash+NULL
86173 +_003152_hash+hecubafb_write+3+26942+_003152_hash+NULL
86174 +_003153_hash+hsc_msg_alloc+1+60990+_003153_hash+NULL
86175 +_003154_hash+hsc_write+3+55875+_003154_hash+NULL
86176 +_003155_hash+hsi_alloc_controller+1+41802+_003155_hash+NULL
86177 +_003156_hash+hsi_register_board_info+2+13820+_003156_hash+NULL
86178 +_003157_hash+i915_ring_stop_read+3+42549+_003157_hash+NULL
86179 +_003158_hash+i915_ring_stop_write+3+59010+_003158_hash+NULL
86180 +_003159_hash+ieee802154_alloc_device+1+13767+_003159_hash+NULL
86181 +_003160_hash+intel_sdvo_write_cmd+4+54377+_003160_hash+&_000815_hash
86182 +_003161_hash+ivtvfb_write+3+40023+_003161_hash+NULL
86183 +_003162_hash+metronomefb_write+3+8823+_003162_hash+NULL
86184 +_003163_hash+mwifiex_usb_submit_rx_urb+2+54558+_003163_hash+NULL
86185 +_003164_hash+nfc_hci_hcp_message_tx+6+14534+_003164_hash+NULL
86186 +_003165_hash+nfc_hci_set_param+5+40697+_003165_hash+NULL
86187 +_003166_hash+nfc_shdlc_alloc_skb+2+12741+_003166_hash+NULL
86188 +_003167_hash+odev_update+2+50169+_003167_hash+NULL
86189 +_003168_hash+oz_add_farewell+5+20652+_003168_hash+NULL
86190 +_003169_hash+oz_cdev_read+3+20659+_003169_hash+NULL
86191 +_003170_hash+oz_cdev_write+3+33852+_003170_hash+NULL
86192 +_003171_hash+oz_ep_alloc+2+5587+_003171_hash+NULL
86193 +_003172_hash+oz_events_read+3+47535+_003172_hash+NULL
86194 +_003173_hash+pmcraid_copy_sglist+3+38431+_003173_hash+NULL
86195 +_003174_hash+prctl_set_mm+3+64538+_003174_hash+NULL
86196 +_003175_hash+ptp_filter_init+2+36780+_003175_hash+NULL
86197 +_003176_hash+rb_simple_read+3+45972+_003176_hash+NULL
86198 +_003177_hash+rb_simple_write+3+20890+_003177_hash+NULL
86199 +_003178_hash+read_file_dfs+3+43145+_003178_hash+NULL
86200 +_003179_hash+rx_streaming_always_write+3+32357+_003179_hash+NULL
86201 +_003180_hash+rx_streaming_interval_write+3+50120+_003180_hash+NULL
86202 +_003181_hash+shmem_pread_fast+3+34147+_003181_hash+NULL
86203 +_003182_hash+shmem_pread_slow+3+3198+_003182_hash+NULL
86204 +_003183_hash+shmem_pwrite_fast+3+46842+_003183_hash+NULL
86205 +_003184_hash+shmem_pwrite_slow+3+31741+_003184_hash+NULL
86206 +_003185_hash+show_header+3+4722+_003185_hash+&_000736_hash
86207 +_003186_hash+split_scan_timeout_write+3+52128+_003186_hash+NULL
86208 +_003187_hash+stack_max_size_read+3+1445+_003187_hash+NULL
86209 +_003188_hash+stack_max_size_write+3+36068+_003188_hash+NULL
86210 +_003189_hash+subsystem_filter_read+3+62310+_003189_hash+NULL
86211 +_003190_hash+subsystem_filter_write+3+13022+_003190_hash+NULL
86212 +_003191_hash+suspend_dtim_interval_write+3+48854+_003191_hash+NULL
86213 +_003192_hash+system_enable_read+3+25815+_003192_hash+NULL
86214 +_003193_hash+system_enable_write+3+61396+_003193_hash+NULL
86215 +_003194_hash+trace_options_core_read+3+47390+_003194_hash+NULL
86216 +_003195_hash+trace_options_core_write+3+61551+_003195_hash+NULL
86217 +_003196_hash+trace_options_read+3+11419+_003196_hash+NULL
86218 +_003197_hash+trace_options_write+3+48275+_003197_hash+NULL
86219 +_003198_hash+trace_parser_get_init+2+31379+_003198_hash+NULL
86220 +_003199_hash+traceprobe_probes_write+3+64969+_003199_hash+NULL
86221 +_003200_hash+trace_seq_to_user+3+65398+_003200_hash+NULL
86222 +_003201_hash+tracing_buffers_read+3+11124+_003201_hash+NULL
86223 +_003202_hash+tracing_clock_write+3+27961+_003202_hash+NULL
86224 +_003203_hash+tracing_cpumask_read+3+7010+_003203_hash+NULL
86225 +_003204_hash+tracing_ctrl_read+3+46922+_003204_hash+NULL
86226 +_003205_hash+tracing_ctrl_write+3+42324+_003205_hash+&_001726_hash
86227 +_003206_hash+tracing_entries_read+3+8345+_003206_hash+NULL
86228 +_003207_hash+tracing_entries_write+3+60563+_003207_hash+NULL
86229 +_003208_hash+tracing_max_lat_read+3+8890+_003208_hash+NULL
86230 +_003209_hash+tracing_max_lat_write+3+8728+_003209_hash+NULL
86231 +_003210_hash+tracing_read_dyn_info+3+45468+_003210_hash+NULL
86232 +_003211_hash+tracing_readme_read+3+16493+_003211_hash+NULL
86233 +_003212_hash+tracing_saved_cmdlines_read+3+21434+_003212_hash+NULL
86234 +_003213_hash+tracing_set_trace_read+3+44122+_003213_hash+NULL
86235 +_003214_hash+tracing_set_trace_write+3+57096+_003214_hash+NULL
86236 +_003215_hash+tracing_stats_read+3+34537+_003215_hash+NULL
86237 +_003216_hash+tracing_total_entries_read+3+62817+_003216_hash+NULL
86238 +_003217_hash+tracing_trace_options_write+3+153+_003217_hash+NULL
86239 +_003218_hash+ttm_put_pages+2+9179+_003218_hash+NULL
86240 +_003219_hash+udl_prime_create+2+57159+_003219_hash+NULL
86241 +_003220_hash+ufx_alloc_urb_list+3+10349+_003220_hash+NULL
86242 +_003221_hash+u_memcpya+2-3+30139+_003221_hash+NULL
86243 +_003223_hash+viafb_dfph_proc_write+3+49288+_003223_hash+NULL
86244 +_003224_hash+viafb_dfpl_proc_write+3+627+_003224_hash+NULL
86245 +_003225_hash+viafb_dvp0_proc_write+3+23023+_003225_hash+NULL
86246 +_003226_hash+viafb_dvp1_proc_write+3+48864+_003226_hash+NULL
86247 +_003227_hash+viafb_vt1636_proc_write+3+16018+_003227_hash+NULL
86248 +_003228_hash+vivi_read+3+23073+_003228_hash+NULL
86249 +_003229_hash+wl1271_rx_filter_alloc_field+5+46721+_003229_hash+NULL
86250 +_003230_hash+wl12xx_cmd_build_probe_req+6-8+3098+_003230_hash+NULL
86251 +_003232_hash+wlcore_alloc_hw+1+7785+_003232_hash+NULL
86252 +_003233_hash+alloc_and_copy_ftrace_hash+1+29368+_003233_hash+NULL
86253 +_003234_hash+create_trace_probe+1+20175+_003234_hash+NULL
86254 +_003235_hash+create_trace_uprobe+1+13184+_003235_hash+NULL
86255 +_003236_hash+intel_sdvo_set_value+4+2311+_003236_hash+NULL
86256 +_003237_hash+mmio_read+4+40348+_003237_hash+NULL
86257 +_003238_hash+nfc_hci_execute_cmd+5+43882+_003238_hash+NULL
86258 +_003239_hash+nfc_hci_send_event+5+21452+_003239_hash+NULL
86259 +_003240_hash+nfc_hci_send_response+5+56462+_003240_hash+NULL
86260 +_003241_hash+picolcd_fb_write+3+2318+_003241_hash+NULL
86261 +_003242_hash+probes_write+3+29711+_003242_hash+NULL
86262 +_003243_hash+sys_prctl+4+8766+_003243_hash+NULL
86263 +_003244_hash+tracing_read_pipe+3+35312+_003244_hash+NULL
86264 +_003245_hash+brcmf_usb_attach+1-2+44656+_003245_hash+NULL
86265 +_003247_hash+dlfb_ops_write+3+64150+_003247_hash+NULL
86266 +_003248_hash+nfc_hci_send_cmd+5+55714+_003248_hash+NULL
86267 +_003249_hash+ufx_ops_write+3+54848+_003249_hash+NULL
86268 +_003250_hash+viafb_iga1_odev_proc_write+3+36241+_003250_hash+NULL
86269 +_003251_hash+viafb_iga2_odev_proc_write+3+2363+_003251_hash+NULL
86270 +_003252_hash+xenfb_write+3+43412+_003252_hash+NULL
86271 +_003253_hash+acl_alloc+1+35979+_003253_hash+NULL
86272 +_003254_hash+acl_alloc_stack_init+1+60630+_003254_hash+NULL
86273 +_003255_hash+acl_alloc_num+1-2+60778+_003255_hash+NULL
86274 +_003257_hash+padzero+1+55+_003257_hash+&_002013_hash
86275 +_003258_hash+__get_vm_area_node+1+55305+_003258_hash+NULL
86276 +_003259_hash+get_vm_area+1+18080+_003259_hash+NULL
86277 +_003260_hash+__get_vm_area+1+61599+_003260_hash+NULL
86278 +_003261_hash+get_vm_area_caller+1+10527+_003261_hash+NULL
86279 +_003262_hash+__get_vm_area_caller+1+56416+_003302_hash+NULL+nohasharray
86280 +_003263_hash+alloc_vm_area+1+36149+_003263_hash+NULL
86281 +_003264_hash+__ioremap_caller+1-2+21800+_003264_hash+NULL
86282 +_003266_hash+vmap+2+15025+_003266_hash+NULL
86283 +_003267_hash+ioremap_cache+1-2+47189+_003267_hash+NULL
86284 +_003269_hash+ioremap_nocache+1-2+2439+_003269_hash+NULL
86285 +_003271_hash+ioremap_prot+1-2+51764+_003271_hash+&_003102_hash
86286 +_003273_hash+ioremap_wc+1-2+62695+_003273_hash+NULL
86287 +_003274_hash+acpi_os_ioremap+1-2+49523+_003274_hash+NULL
86288 +_003276_hash+ca91cx42_alloc_resource+2+10502+_003276_hash+NULL
86289 +_003277_hash+devm_ioremap_nocache+2-3+2036+_003277_hash+NULL
86290 +_003279_hash+__einj_error_trigger+1+17707+_003279_hash+&_001577_hash
86291 +_003280_hash+io_mapping_map_wc+2+19284+_003280_hash+NULL
86292 +_003281_hash+ioremap+1-2+23172+_003281_hash+NULL
86293 +_003283_hash+lguest_map+1-2+42008+_003283_hash+NULL
86294 +_003285_hash+msix_map_region+3+3411+_003285_hash+NULL
86295 +_003286_hash+pci_iomap+3+47575+_003286_hash+NULL
86296 +_003287_hash+sfi_map_memory+1-2+5183+_003287_hash+NULL
86297 +_003289_hash+tsi148_alloc_resource+2+24563+_003289_hash+NULL
86298 +_003290_hash+vb2_vmalloc_get_userptr+3+31374+_003290_hash+NULL
86299 +_003291_hash+xlate_dev_mem_ptr+1+15291+_003291_hash+&_001167_hash
86300 +_003292_hash+a4t_cs_init+3+27734+_003292_hash+NULL
86301 +_003293_hash+aac_nark_ioremap+2+50163+_003293_hash+&_000314_hash
86302 +_003294_hash+aac_rkt_ioremap+2+3333+_003294_hash+NULL
86303 +_003295_hash+aac_rx_ioremap+2+52410+_003295_hash+NULL
86304 +_003296_hash+aac_sa_ioremap+2+13596+_003296_hash+&_000288_hash
86305 +_003297_hash+aac_src_ioremap+2+41688+_003297_hash+NULL
86306 +_003298_hash+aac_srcv_ioremap+2+6659+_003298_hash+NULL
86307 +_003299_hash+acpi_map+1-2+58725+_003299_hash+NULL
86308 +_003301_hash+acpi_os_read_memory+1-3+54186+_003301_hash+NULL
86309 +_003302_hash+acpi_os_write_memory+1-3+56416+_003302_hash+&_003262_hash
86310 +_003303_hash+c101_run+2+37279+_003303_hash+NULL
86311 +_003304_hash+ca91cx42_master_set+4+23146+_003304_hash+NULL
86312 +_003305_hash+check586+2+29914+_003305_hash+NULL
86313 +_003306_hash+check_mirror+1-2+57342+_003306_hash+&_001564_hash
86314 +_003308_hash+cru_detect+1+11272+_003308_hash+NULL
86315 +_003309_hash+cs553x_init_one+3+58886+_003309_hash+NULL
86316 +_003310_hash+cycx_setup+4+47562+_003310_hash+NULL
86317 +_003311_hash+DepcaSignature+2+80+_003311_hash+&_001321_hash
86318 +_003312_hash+devm_ioremap+2-3+29235+_003312_hash+NULL
86319 +_003314_hash+divasa_remap_pci_bar+3-4+23485+_003314_hash+&_000947_hash
86320 +_003316_hash+dma_declare_coherent_memory+2-4+14244+_003316_hash+NULL
86321 +_003318_hash+doc_probe+1+23285+_003318_hash+NULL
86322 +_003319_hash+DoC_Probe+1+57534+_003319_hash+NULL
86323 +_003320_hash+ems_pcmcia_add_card+2+62627+_003320_hash+NULL
86324 +_003321_hash+gdth_init_isa+1+28091+_003321_hash+NULL
86325 +_003322_hash+gdth_search_isa+1+58595+_003322_hash+NULL
86326 +_003323_hash+isp1760_register+1-2+628+_003323_hash+NULL
86327 +_003325_hash+mthca_map_reg+2-3+5664+_003325_hash+NULL
86328 +_003327_hash+n2_run+3+53459+_003327_hash+NULL
86329 +_003328_hash+pcim_iomap+3+58334+_003328_hash+NULL
86330 +_003329_hash+probe_bios+1+17467+_003329_hash+NULL
86331 +_003330_hash+register_device+2-3+60015+_003330_hash+NULL
86332 +_003332_hash+remap_pci_mem+1-2+15966+_003332_hash+NULL
86333 +_003334_hash+rtl_port_map+1-2+2385+_003334_hash+NULL
86334 +_003336_hash+sfi_map_table+1+5462+_003336_hash+NULL
86335 +_003337_hash+sriov_enable_migration+2+14889+_003337_hash+NULL
86336 +_003338_hash+ssb_bus_scan+2+36578+_003338_hash+NULL
86337 +_003339_hash+ssb_ioremap+2+5228+_003339_hash+NULL
86338 +_003340_hash+tpm_tis_init+2-3+15304+_003340_hash+NULL
86339 +_003342_hash+tsi148_master_set+4+14685+_003342_hash+NULL
86340 +_003343_hash+acpi_os_map_memory+1-2+11161+_003343_hash+NULL
86341 +_003345_hash+com90xx_found+3+13974+_003345_hash+NULL
86342 +_003346_hash+dmam_declare_coherent_memory+2-4+43679+_003346_hash+NULL
86343 +_003348_hash+gdth_isa_probe_one+1+48925+_003348_hash+NULL
86344 +_003349_hash+sfi_check_table+1+6772+_003349_hash+NULL
86345 +_003350_hash+sfi_sysfs_install_table+1+51688+_003350_hash+NULL
86346 +_003351_hash+sriov_enable+2+59689+_003351_hash+NULL
86347 +_003352_hash+ssb_bus_register+3+65183+_003352_hash+NULL
86348 +_003353_hash+acpi_ex_system_memory_space_handler+2+31192+_003353_hash+NULL
86349 +_003354_hash+acpi_tb_check_xsdt+1+21862+_003354_hash+NULL
86350 +_003355_hash+acpi_tb_install_table+1+12988+_003355_hash+NULL
86351 +_003356_hash+acpi_tb_parse_root_table+1+53455+_003356_hash+NULL
86352 +_003357_hash+check_vendor_extension+1+3254+_003357_hash+NULL
86353 +_003358_hash+pci_enable_sriov+2+35745+_003358_hash+NULL
86354 +_003359_hash+ssb_bus_pcmciabus_register+3+56020+_003359_hash+NULL
86355 +_003360_hash+ssb_bus_ssbbus_register+2+2217+_003360_hash+NULL
86356 +_003361_hash+lpfc_sli_probe_sriov_nr_virtfn+2+26004+_003361_hash+NULL
86357 +_003364_hash+alloc_vm_area+1+15989+_003364_hash+NULL
86358 +_003366_hash+efi_ioremap+1-2+3492+_003366_hash+&_001092_hash
86359 +_003368_hash+init_chip_wc_pat+2+62768+_003368_hash+NULL
86360 +_003369_hash+io_mapping_create_wc+1-2+1354+_003369_hash+NULL
86361 +_003371_hash+iommu_map_mmio_space+1+30919+_003371_hash+NULL
86362 +_003372_hash+arch_gnttab_map_shared+3+41306+_003372_hash+NULL
86363 +_003373_hash+arch_gnttab_map_status+3+49812+_003373_hash+NULL
86364 +_003374_hash+intel_render_ring_init_dri+2-3+45446+_003374_hash+NULL
86365 +_003376_hash+persistent_ram_iomap+1-2+47156+_003376_hash+NULL
86366 +_003378_hash+sparse_early_usemaps_alloc_pgdat_section+2+62304+_003378_hash+NULL
86367 +_003379_hash+ttm_bo_ioremap+2-3+31082+_003379_hash+NULL
86368 +_003381_hash+ttm_bo_kmap_ttm+3+5922+_003381_hash+NULL
86369 +_003382_hash+atyfb_setup_generic+3+49151+_003382_hash+NULL
86370 +_003383_hash+do_test+1+15766+_003383_hash+NULL
86371 +_003384_hash+mga_ioremap+1-2+8571+_003384_hash+NULL
86372 +_003386_hash+mid_get_vbt_data_r0+2+10876+_003386_hash+NULL
86373 +_003387_hash+mid_get_vbt_data_r10+2+6308+_003387_hash+NULL
86374 +_003388_hash+mid_get_vbt_data_r1+2+26170+_003388_hash+NULL
86375 +_003389_hash+persistent_ram_buffer_map+1-2+11332+_003389_hash+NULL
86376 +_003391_hash+read_vbt_r0+1+503+_003391_hash+NULL
86377 +_003392_hash+read_vbt_r10+1+60679+_003392_hash+NULL
86378 +_003393_hash+tpci200_slot_map_space+2+3848+_003393_hash+NULL
86379 +_003394_hash+ttm_bo_kmap+2-3+60118+_003394_hash+NULL
86380 +_003395_hash+persistent_ram_new+1-2+14588+_003395_hash+NULL
86381 +_003396_hash+mpt_lan_receive_post_turbo+2+13592+_003396_hash+NULL
86382 +_003397_hash+v4l2_ctrl_new_int_menu+4+41151+_003397_hash+NULL
86383 +_003398_hash+v4l2_ctrl_new_std+5+45748+_003398_hash+&_002699_hash
86384 +_003399_hash+v4l2_ctrl_new_std_menu+4+6221+_003399_hash+NULL
86385 +_003400_hash+xhci_alloc_streams+5+37586+_003400_hash+NULL
86386 +_003401_hash+cx2341x_ctrl_new_menu+3+49700+_003401_hash+NULL
86387 +_003402_hash+cx2341x_ctrl_new_std+4+57061+_003402_hash+NULL
86388 diff --git a/tools/gcc/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin.c
86389 new file mode 100644
86390 index 0000000..314cdac
86391 --- /dev/null
86392 +++ b/tools/gcc/size_overflow_plugin.c
86393 @@ -0,0 +1,1741 @@
86394 +/*
86395 + * Copyright 2011, 2012 by Emese Revfy <re.emese@gmail.com>
86396 + * Licensed under the GPL v2, or (at your option) v3
86397 + *
86398 + * Homepage:
86399 + * http://www.grsecurity.net/~ephox/overflow_plugin/
86400 + *
86401 + * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
86402 + * with double integer precision (DImode/TImode for 32/64 bit integer types).
86403 + * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
86404 + *
86405 + * Usage:
86406 + * $ gcc -I`gcc -print-file-name=plugin`/include/c-family -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -ggdb -Wall -W -Wno-missing-field-initializers -o size_overflow_plugin.so size_overflow_plugin.c
86407 + * $ gcc -fplugin=size_overflow_plugin.so test.c -O2
86408 + */
86409 +
86410 +#include "gcc-plugin.h"
86411 +#include "config.h"
86412 +#include "system.h"
86413 +#include "coretypes.h"
86414 +#include "tree.h"
86415 +#include "tree-pass.h"
86416 +#include "intl.h"
86417 +#include "plugin-version.h"
86418 +#include "tm.h"
86419 +#include "toplev.h"
86420 +#include "function.h"
86421 +#include "tree-flow.h"
86422 +#include "plugin.h"
86423 +#include "gimple.h"
86424 +#include "c-common.h"
86425 +#include "diagnostic.h"
86426 +#include "cfgloop.h"
86427 +
86428 +struct size_overflow_hash {
86429 + const struct size_overflow_hash * const next;
86430 + const char * const name;
86431 + const unsigned int param;
86432 +};
86433 +
86434 +#include "size_overflow_hash.h"
86435 +
86436 +enum marked {
86437 + MARKED_NO, MARKED_YES, MARKED_NOT_INTENTIONAL
86438 +};
86439 +
86440 +enum overflow_reason {
86441 + OVERFLOW_NONE, OVERFLOW_INTENTIONAL
86442 +};
86443 +
86444 +#define __unused __attribute__((__unused__))
86445 +#define NAME(node) IDENTIFIER_POINTER(DECL_NAME(node))
86446 +#define NAME_LEN(node) IDENTIFIER_LENGTH(DECL_NAME(node))
86447 +#define BEFORE_STMT true
86448 +#define AFTER_STMT false
86449 +#define CREATE_NEW_VAR NULL_TREE
86450 +#define CODES_LIMIT 32
86451 +#define MAX_PARAM 16
86452 +#define MY_STMT GF_PLF_1
86453 +#define NO_CAST_CHECK GF_PLF_2
86454 +
86455 +#if BUILDING_GCC_VERSION == 4005
86456 +#define DECL_CHAIN(NODE) (TREE_CHAIN(DECL_MINIMAL_CHECK(NODE)))
86457 +#endif
86458 +
86459 +int plugin_is_GPL_compatible;
86460 +void debug_gimple_stmt(gimple gs);
86461 +
86462 +static tree expand(struct pointer_set_t *visited, enum overflow_reason* overflowed, tree lhs);
86463 +static tree report_size_overflow_decl;
86464 +static const_tree const_char_ptr_type_node;
86465 +static unsigned int handle_function(void);
86466 +static void check_size_overflow(gimple stmt, tree size_overflow_type, tree cast_rhs, tree rhs, enum overflow_reason* overflowed, bool before);
86467 +static tree get_size_overflow_type(gimple stmt, const_tree node);
86468 +static tree dup_assign(struct pointer_set_t *visited, enum overflow_reason* overflowed, gimple oldstmt, tree size_overflow_type, tree rhs1, tree rhs2, tree __unused rhs3);
86469 +
86470 +static struct plugin_info size_overflow_plugin_info = {
86471 + .version = "20120910beta",
86472 + .help = "no-size-overflow\tturn off size overflow checking\n",
86473 +};
86474 +
86475 +static tree handle_size_overflow_attribute(tree *node, tree __unused name, tree args, int __unused flags, bool *no_add_attrs)
86476 +{
86477 + unsigned int arg_count;
86478 +
86479 + if (TREE_CODE(*node) == FUNCTION_DECL)
86480 + arg_count = type_num_arguments(TREE_TYPE(*node));
86481 + else if (TREE_CODE(*node) == FUNCTION_TYPE || TREE_CODE(*node) == METHOD_TYPE)
86482 + arg_count = type_num_arguments(*node);
86483 + else {
86484 + *no_add_attrs = true;
86485 + error("%qE attribute only applies to functions", name);
86486 + return NULL_TREE;
86487 + }
86488 +
86489 + for (; args; args = TREE_CHAIN(args)) {
86490 + tree position = TREE_VALUE(args);
86491 + if (TREE_CODE(position) != INTEGER_CST || TREE_INT_CST_HIGH(position) || TREE_INT_CST_LOW(position) < 1 || TREE_INT_CST_LOW(position) > arg_count ) {
86492 + error("handle_size_overflow_attribute: overflow parameter outside range.");
86493 + *no_add_attrs = true;
86494 + }
86495 + }
86496 + return NULL_TREE;
86497 +}
86498 +
86499 +static struct attribute_spec size_overflow_attr = {
86500 + .name = "size_overflow",
86501 + .min_length = 1,
86502 + .max_length = -1,
86503 + .decl_required = true,
86504 + .type_required = false,
86505 + .function_type_required = false,
86506 + .handler = handle_size_overflow_attribute,
86507 +#if BUILDING_GCC_VERSION >= 4007
86508 + .affects_type_identity = false
86509 +#endif
86510 +};
86511 +
86512 +static struct attribute_spec intentional_overflow_attr = {
86513 + .name = "intentional_overflow",
86514 + .min_length = 1,
86515 + .max_length = -1,
86516 + .decl_required = true,
86517 + .type_required = false,
86518 + .function_type_required = false,
86519 + .handler = NULL,
86520 +#if BUILDING_GCC_VERSION >= 4007
86521 + .affects_type_identity = false
86522 +#endif
86523 +};
86524 +
86525 +static void register_attributes(void __unused *event_data, void __unused *data)
86526 +{
86527 + register_attribute(&size_overflow_attr);
86528 + register_attribute(&intentional_overflow_attr);
86529 +}
86530 +
86531 +// http://www.team5150.com/~andrew/noncryptohashzoo2~/CrapWow.html
86532 +static unsigned int CrapWow(const char *key, unsigned int len, unsigned int seed)
86533 +{
86534 +#define cwfold( a, b, lo, hi ) { p = (unsigned int)(a) * (unsigned long long)(b); lo ^= (unsigned int)p; hi ^= (unsigned int)(p >> 32); }
86535 +#define cwmixa( in ) { cwfold( in, m, k, h ); }
86536 +#define cwmixb( in ) { cwfold( in, n, h, k ); }
86537 +
86538 + unsigned int m = 0x57559429;
86539 + unsigned int n = 0x5052acdb;
86540 + const unsigned int *key4 = (const unsigned int *)key;
86541 + unsigned int h = len;
86542 + unsigned int k = len + seed + n;
86543 + unsigned long long p;
86544 +
86545 + while (len >= 8) {
86546 + cwmixb(key4[0]) cwmixa(key4[1]) key4 += 2;
86547 + len -= 8;
86548 + }
86549 + if (len >= 4) {
86550 + cwmixb(key4[0]) key4 += 1;
86551 + len -= 4;
86552 + }
86553 + if (len)
86554 + cwmixa(key4[0] & ((1 << (len * 8)) - 1 ));
86555 + cwmixb(h ^ (k + n));
86556 + return k ^ h;
86557 +
86558 +#undef cwfold
86559 +#undef cwmixa
86560 +#undef cwmixb
86561 +}
86562 +
86563 +static inline unsigned int get_hash_num(const char *fndecl, const char *tree_codes, unsigned int len, unsigned int seed)
86564 +{
86565 + unsigned int fn = CrapWow(fndecl, strlen(fndecl), seed) & 0xffff;
86566 + unsigned int codes = CrapWow(tree_codes, len, seed) & 0xffff;
86567 + return fn ^ codes;
86568 +}
86569 +
86570 +static inline const_tree get_original_function_decl(const_tree fndecl)
86571 +{
86572 + if (DECL_ABSTRACT_ORIGIN(fndecl))
86573 + return DECL_ABSTRACT_ORIGIN(fndecl);
86574 + return fndecl;
86575 +}
86576 +
86577 +static inline gimple get_def_stmt(const_tree node)
86578 +{
86579 + gcc_assert(node != NULL_TREE);
86580 + gcc_assert(TREE_CODE(node) == SSA_NAME);
86581 + return SSA_NAME_DEF_STMT(node);
86582 +}
86583 +
86584 +static unsigned char get_tree_code(const_tree type)
86585 +{
86586 + switch (TREE_CODE(type)) {
86587 + case ARRAY_TYPE:
86588 + return 0;
86589 + case BOOLEAN_TYPE:
86590 + return 1;
86591 + case ENUMERAL_TYPE:
86592 + return 2;
86593 + case FUNCTION_TYPE:
86594 + return 3;
86595 + case INTEGER_TYPE:
86596 + return 4;
86597 + case POINTER_TYPE:
86598 + return 5;
86599 + case RECORD_TYPE:
86600 + return 6;
86601 + case UNION_TYPE:
86602 + return 7;
86603 + case VOID_TYPE:
86604 + return 8;
86605 + case REAL_TYPE:
86606 + return 9;
86607 + case VECTOR_TYPE:
86608 + return 10;
86609 + case REFERENCE_TYPE:
86610 + return 11;
86611 + case OFFSET_TYPE:
86612 + return 12;
86613 + case COMPLEX_TYPE:
86614 + return 13;
86615 + default:
86616 + debug_tree((tree)type);
86617 + gcc_unreachable();
86618 + }
86619 +}
86620 +
86621 +static size_t add_type_codes(const_tree type, unsigned char *tree_codes, size_t len)
86622 +{
86623 + gcc_assert(type != NULL_TREE);
86624 +
86625 + while (type && len < CODES_LIMIT) {
86626 + tree_codes[len] = get_tree_code(type);
86627 + len++;
86628 + type = TREE_TYPE(type);
86629 + }
86630 + return len;
86631 +}
86632 +
86633 +static unsigned int get_function_decl(const_tree fndecl, unsigned char *tree_codes)
86634 +{
86635 + const_tree arg, result, type = TREE_TYPE(fndecl);
86636 + enum tree_code code = TREE_CODE(type);
86637 + size_t len = 0;
86638 +
86639 + gcc_assert(code == FUNCTION_TYPE || code == METHOD_TYPE);
86640 +
86641 + arg = TYPE_ARG_TYPES(type);
86642 + // skip builtins __builtin_constant_p
86643 + if (!arg && DECL_BUILT_IN(fndecl))
86644 + return 0;
86645 + gcc_assert(arg != NULL_TREE);
86646 +
86647 + if (TREE_CODE_CLASS(code) == tcc_type)
86648 + result = type;
86649 + else
86650 + result = DECL_RESULT(fndecl);
86651 +
86652 + gcc_assert(result != NULL_TREE);
86653 + len = add_type_codes(TREE_TYPE(result), tree_codes, len);
86654 +
86655 + while (arg && len < CODES_LIMIT) {
86656 + len = add_type_codes(TREE_VALUE(arg), tree_codes, len);
86657 + arg = TREE_CHAIN(arg);
86658 + }
86659 +
86660 + gcc_assert(len != 0);
86661 + return len;
86662 +}
86663 +
86664 +static const struct size_overflow_hash *get_function_hash(const_tree fndecl)
86665 +{
86666 + unsigned int hash;
86667 + const struct size_overflow_hash *entry;
86668 + unsigned char tree_codes[CODES_LIMIT];
86669 + size_t len;
86670 + const char *func_name = NAME(fndecl);
86671 +
86672 + len = get_function_decl(fndecl, tree_codes);
86673 + if (len == 0)
86674 + return NULL;
86675 +
86676 + hash = get_hash_num(func_name, (const char*) tree_codes, len, 0);
86677 +
86678 + entry = size_overflow_hash[hash];
86679 + while (entry) {
86680 + if (!strcmp(entry->name, func_name))
86681 + return entry;
86682 + entry = entry->next;
86683 + }
86684 +
86685 + return NULL;
86686 +}
86687 +
86688 +static void check_arg_type(const_tree arg)
86689 +{
86690 + const_tree type = TREE_TYPE(arg);
86691 + enum tree_code code = TREE_CODE(type);
86692 +
86693 + gcc_assert(code == INTEGER_TYPE || code == ENUMERAL_TYPE ||
86694 + (code == POINTER_TYPE && TREE_CODE(TREE_TYPE(type)) == VOID_TYPE) ||
86695 + (code == POINTER_TYPE && TREE_CODE(TREE_TYPE(type)) == INTEGER_TYPE));
86696 +}
86697 +
86698 +static int find_arg_number(const_tree arg, const_tree func)
86699 +{
86700 + tree var;
86701 + bool match = false;
86702 + unsigned int argnum = 1;
86703 +
86704 + if (TREE_CODE(arg) == SSA_NAME)
86705 + arg = SSA_NAME_VAR(arg);
86706 +
86707 + for (var = DECL_ARGUMENTS(func); var; var = TREE_CHAIN(var)) {
86708 + if (strcmp(NAME(arg), NAME(var))) {
86709 + argnum++;
86710 + continue;
86711 + }
86712 + check_arg_type(var);
86713 +
86714 + match = true;
86715 + break;
86716 + }
86717 + if (!match) {
86718 + warning(0, "find_arg_number: cannot find the %s argument in %s", NAME(arg), NAME(func));
86719 + return 0;
86720 + }
86721 + return argnum;
86722 +}
86723 +
86724 +static void print_missing_msg(const_tree func, unsigned int argnum)
86725 +{
86726 + unsigned int new_hash;
86727 + size_t len;
86728 + unsigned char tree_codes[CODES_LIMIT];
86729 + location_t loc = DECL_SOURCE_LOCATION(func);
86730 + const char *curfunc = NAME(func);
86731 +
86732 + len = get_function_decl(func, tree_codes);
86733 + new_hash = get_hash_num(curfunc, (const char *) tree_codes, len, 0);
86734 + inform(loc, "Function %s is missing from the size_overflow hash table +%s+%u+%u+", curfunc, curfunc, argnum, new_hash);
86735 +}
86736 +
86737 +static unsigned int search_missing_attribute(const_tree arg)
86738 +{
86739 + const_tree type = TREE_TYPE(arg);
86740 + const_tree func = get_original_function_decl(current_function_decl);
86741 + unsigned int argnum;
86742 + const struct size_overflow_hash *hash;
86743 +
86744 + gcc_assert(TREE_CODE(arg) != COMPONENT_REF);
86745 +
86746 + if (TREE_CODE(type) == POINTER_TYPE)
86747 + return 0;
86748 +
86749 + argnum = find_arg_number(arg, func);
86750 + if (argnum == 0)
86751 + return 0;
86752 +
86753 + if (lookup_attribute("size_overflow", DECL_ATTRIBUTES(func)))
86754 + return argnum;
86755 +
86756 + hash = get_function_hash(func);
86757 + if (!hash || !(hash->param & (1U << argnum))) {
86758 + print_missing_msg(func, argnum);
86759 + return 0;
86760 + }
86761 + return argnum;
86762 +}
86763 +
86764 +static tree create_new_var(tree type)
86765 +{
86766 + tree new_var = create_tmp_var(type, "cicus");
86767 +
86768 + add_referenced_var(new_var);
86769 + mark_sym_for_renaming(new_var);
86770 + return new_var;
86771 +}
86772 +
86773 +static gimple create_binary_assign(enum tree_code code, gimple stmt, tree rhs1, tree rhs2)
86774 +{
86775 + gimple assign;
86776 + gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
86777 + tree type = TREE_TYPE(rhs1);
86778 + tree lhs = create_new_var(type);
86779 +
86780 + assign = gimple_build_assign_with_ops(code, lhs, rhs1, rhs2);
86781 + gimple_set_lhs(assign, make_ssa_name(lhs, assign));
86782 +
86783 + gsi_insert_before(&gsi, assign, GSI_NEW_STMT);
86784 + update_stmt(assign);
86785 + gimple_set_plf(assign, MY_STMT, true);
86786 + return assign;
86787 +}
86788 +
86789 +static bool is_bool(const_tree node)
86790 +{
86791 + const_tree type;
86792 +
86793 + if (node == NULL_TREE)
86794 + return false;
86795 +
86796 + type = TREE_TYPE(node);
86797 + if (!INTEGRAL_TYPE_P(type))
86798 + return false;
86799 + if (TREE_CODE(type) == BOOLEAN_TYPE)
86800 + return true;
86801 + if (TYPE_PRECISION(type) == 1)
86802 + return true;
86803 + return false;
86804 +}
86805 +
86806 +static tree cast_a_tree(tree type, tree var)
86807 +{
86808 + gcc_assert(type != NULL_TREE);
86809 + gcc_assert(var != NULL_TREE);
86810 + gcc_assert(fold_convertible_p(type, var));
86811 +
86812 + return fold_convert(type, var);
86813 +}
86814 +
86815 +static gimple build_cast_stmt(tree dst_type, tree rhs, tree lhs, gimple_stmt_iterator *gsi, bool before)
86816 +{
86817 + gimple assign;
86818 +
86819 + gcc_assert(dst_type != NULL_TREE && rhs != NULL_TREE);
86820 + if (gsi_end_p(*gsi) && before == BEFORE_STMT)
86821 + gcc_unreachable();
86822 +
86823 + if (lhs == CREATE_NEW_VAR)
86824 + lhs = create_new_var(dst_type);
86825 +
86826 + assign = gimple_build_assign(lhs, cast_a_tree(dst_type, rhs));
86827 +
86828 + if (!gsi_end_p(*gsi)) {
86829 + location_t loc = gimple_location(gsi_stmt(*gsi));
86830 + gimple_set_location(assign, loc);
86831 + }
86832 +
86833 + gimple_set_lhs(assign, make_ssa_name(lhs, assign));
86834 +
86835 + if (before)
86836 + gsi_insert_before(gsi, assign, GSI_NEW_STMT);
86837 + else
86838 + gsi_insert_after(gsi, assign, GSI_NEW_STMT);
86839 + update_stmt(assign);
86840 + gimple_set_plf(assign, MY_STMT, true);
86841 +
86842 + return assign;
86843 +}
86844 +
86845 +static tree cast_to_new_size_overflow_type(gimple stmt, tree new_rhs1, tree size_overflow_type, bool before)
86846 +{
86847 + const_gimple assign;
86848 + gimple_stmt_iterator gsi;
86849 +
86850 + if (new_rhs1 == NULL_TREE)
86851 + return NULL_TREE;
86852 +
86853 + if (!useless_type_conversion_p(TREE_TYPE(new_rhs1), size_overflow_type)) {
86854 + gsi = gsi_for_stmt(stmt);
86855 + assign = build_cast_stmt(size_overflow_type, new_rhs1, CREATE_NEW_VAR, &gsi, before);
86856 + return gimple_get_lhs(assign);
86857 + }
86858 + return new_rhs1;
86859 +}
86860 +
86861 +static tree follow_overflow_type_and_dup(struct pointer_set_t *visited, enum overflow_reason* overflowed, gimple stmt, const_tree node, tree new_rhs1, tree new_rhs2, tree new_rhs3)
86862 +{
86863 + tree size_overflow_type = get_size_overflow_type(stmt, node);
86864 +
86865 + new_rhs1 = cast_to_new_size_overflow_type(stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
86866 +
86867 + if (new_rhs2 != NULL_TREE)
86868 + new_rhs2 = cast_to_new_size_overflow_type(stmt, new_rhs2, size_overflow_type, BEFORE_STMT);
86869 +
86870 + if (new_rhs3 != NULL_TREE)
86871 + new_rhs3 = cast_to_new_size_overflow_type(stmt, new_rhs3, size_overflow_type, BEFORE_STMT);
86872 +
86873 + return dup_assign(visited, overflowed, stmt, size_overflow_type, new_rhs1, new_rhs2, new_rhs3);
86874 +}
86875 +
86876 +static enum marked is_already_marked(const_tree fndecl, unsigned int argnum)
86877 +{
86878 + const_tree attr, p;
86879 +
86880 + attr = lookup_attribute("intentional_overflow", DECL_ATTRIBUTES(fndecl));
86881 + if (!attr || !TREE_VALUE(attr))
86882 + return MARKED_NO;
86883 +
86884 + p = TREE_VALUE(attr);
86885 + if (!TREE_INT_CST_LOW(TREE_VALUE(p)))
86886 + return MARKED_NOT_INTENTIONAL;
86887 +
86888 + do {
86889 + if (argnum == TREE_INT_CST_LOW(TREE_VALUE(p)))
86890 + return MARKED_YES;
86891 + p = TREE_CHAIN(p);
86892 + } while (p);
86893 +
86894 + return MARKED_NO;
86895 +}
86896 +
86897 +static const_tree search_field_decl(const_tree comp_ref)
86898 +{
86899 + const_tree field = NULL_TREE;
86900 + unsigned int i, len = TREE_OPERAND_LENGTH(comp_ref);
86901 +
86902 + for (i = 0; i < len; i++) {
86903 + field = TREE_OPERAND(comp_ref, i);
86904 + if (TREE_CODE(field) == FIELD_DECL)
86905 + break;
86906 + }
86907 + gcc_assert(TREE_CODE(field) == FIELD_DECL);
86908 + return field;
86909 +}
86910 +
86911 +static void handle_component_ref(enum overflow_reason* overflowed, const_gimple stmt, const_tree binary_dup_rhs)
86912 +{
86913 + const_tree rhs, field, attr;
86914 +
86915 + if (gimple_code(stmt) != GIMPLE_ASSIGN)
86916 + return;
86917 +
86918 + gcc_assert(gimple_num_ops(stmt) == 2 || gimple_num_ops(stmt) == 3);
86919 +
86920 + if (gimple_num_ops(stmt) == 2)
86921 + rhs = gimple_assign_rhs1(stmt);
86922 + else
86923 + rhs = binary_dup_rhs;
86924 +
86925 + if (TREE_CODE(rhs) != COMPONENT_REF)
86926 + return;
86927 +
86928 + field = search_field_decl(rhs);
86929 + attr = lookup_attribute("intentional_overflow", DECL_ATTRIBUTES(field));
86930 + if (!attr || !TREE_VALUE(attr))
86931 + return;
86932 +
86933 + *overflowed = OVERFLOW_INTENTIONAL;
86934 +}
86935 +
86936 +static tree create_assign(struct pointer_set_t *visited, enum overflow_reason* overflowed, gimple oldstmt, tree rhs1, bool before)
86937 +{
86938 + unsigned int argnum;
86939 + const_tree oldstmt_rhs1;
86940 + tree size_overflow_type, lhs;
86941 + enum tree_code code;
86942 + gimple stmt;
86943 + gimple_stmt_iterator gsi;
86944 +
86945 + handle_component_ref(overflowed, oldstmt, rhs1);
86946 +
86947 + if (*overflowed == OVERFLOW_INTENTIONAL)
86948 + return NULL_TREE;
86949 +
86950 + if (rhs1 == NULL_TREE) {
86951 + debug_gimple_stmt(oldstmt);
86952 + error("create_assign: rhs1 is NULL_TREE");
86953 + gcc_unreachable();
86954 + }
86955 +
86956 + if (gimple_code(oldstmt) == GIMPLE_ASM)
86957 + lhs = rhs1;
86958 + else
86959 + lhs = gimple_get_lhs(oldstmt);
86960 +
86961 + oldstmt_rhs1 = gimple_assign_rhs1(oldstmt);
86962 + code = TREE_CODE(oldstmt_rhs1);
86963 + if (code == PARM_DECL || (code == SSA_NAME && gimple_code(get_def_stmt(oldstmt_rhs1)) == GIMPLE_NOP)) {
86964 + argnum = search_missing_attribute(oldstmt_rhs1);
86965 + if (argnum && is_already_marked(get_original_function_decl(current_function_decl), argnum) == MARKED_YES) {
86966 + *overflowed = OVERFLOW_INTENTIONAL;
86967 + return NULL_TREE;
86968 + }
86969 +
86970 + }
86971 +
86972 + gsi = gsi_for_stmt(oldstmt);
86973 + pointer_set_insert(visited, oldstmt);
86974 + if (lookup_stmt_eh_lp(oldstmt) != 0) {
86975 + basic_block next_bb, cur_bb;
86976 + const_edge e;
86977 +
86978 + gcc_assert(before == false);
86979 + gcc_assert(stmt_can_throw_internal(oldstmt));
86980 + gcc_assert(gimple_code(oldstmt) == GIMPLE_CALL);
86981 + gcc_assert(!gsi_end_p(gsi));
86982 +
86983 + cur_bb = gimple_bb(oldstmt);
86984 + next_bb = cur_bb->next_bb;
86985 + e = find_edge(cur_bb, next_bb);
86986 + gcc_assert(e != NULL);
86987 + gcc_assert(e->flags & EDGE_FALLTHRU);
86988 +
86989 + gsi = gsi_after_labels(next_bb);
86990 + gcc_assert(!gsi_end_p(gsi));
86991 +
86992 + before = true;
86993 + oldstmt = gsi_stmt(gsi);
86994 + pointer_set_insert(visited, oldstmt);
86995 + }
86996 +
86997 + size_overflow_type = get_size_overflow_type(oldstmt, lhs);
86998 +
86999 + stmt = build_cast_stmt(size_overflow_type, rhs1, CREATE_NEW_VAR, &gsi, before);
87000 + gimple_set_plf(stmt, MY_STMT, true);
87001 + return gimple_get_lhs(stmt);
87002 +}
87003 +
87004 +static tree dup_assign(struct pointer_set_t *visited, enum overflow_reason* overflowed, gimple oldstmt, tree size_overflow_type, tree rhs1, tree rhs2, tree __unused rhs3)
87005 +{
87006 + gimple stmt;
87007 + gimple_stmt_iterator gsi;
87008 + tree new_var, lhs = gimple_get_lhs(oldstmt);
87009 +
87010 + if (*overflowed == OVERFLOW_INTENTIONAL)
87011 + return NULL_TREE;
87012 +
87013 + if (gimple_plf(oldstmt, MY_STMT))
87014 + return lhs;
87015 +
87016 + if (gimple_num_ops(oldstmt) != 4 && rhs1 == NULL_TREE) {
87017 + rhs1 = gimple_assign_rhs1(oldstmt);
87018 + rhs1 = create_assign(visited, overflowed, oldstmt, rhs1, BEFORE_STMT);
87019 + }
87020 + if (gimple_num_ops(oldstmt) == 3 && rhs2 == NULL_TREE) {
87021 + rhs2 = gimple_assign_rhs2(oldstmt);
87022 + rhs2 = create_assign(visited, overflowed, oldstmt, rhs2, BEFORE_STMT);
87023 + }
87024 +
87025 + stmt = gimple_copy(oldstmt);
87026 + gimple_set_location(stmt, gimple_location(oldstmt));
87027 + gimple_set_plf(stmt, MY_STMT, true);
87028 +
87029 + if (gimple_assign_rhs_code(oldstmt) == WIDEN_MULT_EXPR)
87030 + gimple_assign_set_rhs_code(stmt, MULT_EXPR);
87031 +
87032 + if (is_bool(lhs))
87033 + new_var = SSA_NAME_VAR(lhs);
87034 + else
87035 + new_var = create_new_var(size_overflow_type);
87036 + new_var = make_ssa_name(new_var, stmt);
87037 + gimple_set_lhs(stmt, new_var);
87038 +
87039 + if (rhs1 != NULL_TREE) {
87040 + if (!gimple_assign_cast_p(oldstmt))
87041 + rhs1 = cast_a_tree(size_overflow_type, rhs1);
87042 + gimple_assign_set_rhs1(stmt, rhs1);
87043 + }
87044 +
87045 + if (rhs2 != NULL_TREE)
87046 + gimple_assign_set_rhs2(stmt, rhs2);
87047 +#if BUILDING_GCC_VERSION >= 4007
87048 + if (rhs3 != NULL_TREE)
87049 + gimple_assign_set_rhs3(stmt, rhs3);
87050 +#endif
87051 + gimple_set_vuse(stmt, gimple_vuse(oldstmt));
87052 + gimple_set_vdef(stmt, gimple_vdef(oldstmt));
87053 +
87054 + gsi = gsi_for_stmt(oldstmt);
87055 + gsi_insert_after(&gsi, stmt, GSI_SAME_STMT);
87056 + update_stmt(stmt);
87057 + pointer_set_insert(visited, oldstmt);
87058 + return gimple_get_lhs(stmt);
87059 +}
87060 +
87061 +static gimple overflow_create_phi_node(gimple oldstmt, tree result)
87062 +{
87063 + basic_block bb;
87064 + gimple phi;
87065 + gimple_stmt_iterator gsi = gsi_for_stmt(oldstmt);
87066 +
87067 + bb = gsi_bb(gsi);
87068 +
87069 + phi = create_phi_node(result, bb);
87070 + gsi = gsi_last(phi_nodes(bb));
87071 + gsi_remove(&gsi, false);
87072 +
87073 + gsi = gsi_for_stmt(oldstmt);
87074 + gsi_insert_after(&gsi, phi, GSI_NEW_STMT);
87075 + gimple_set_bb(phi, bb);
87076 + gimple_set_plf(phi, MY_STMT, true);
87077 + return phi;
87078 +}
87079 +
87080 +static basic_block create_a_first_bb(void)
87081 +{
87082 + basic_block first_bb;
87083 +
87084 + first_bb = split_block_after_labels(ENTRY_BLOCK_PTR)->dest;
87085 + if (dom_info_available_p(CDI_DOMINATORS))
87086 + set_immediate_dominator(CDI_DOMINATORS, first_bb, ENTRY_BLOCK_PTR);
87087 + return first_bb;
87088 +}
87089 +
87090 +static tree cast_old_phi_arg(gimple oldstmt, tree size_overflow_type, tree arg, tree new_var, unsigned int i)
87091 +{
87092 + basic_block bb;
87093 + const_gimple newstmt;
87094 + gimple_stmt_iterator gsi;
87095 + bool before = BEFORE_STMT;
87096 +
87097 + if (TREE_CODE(arg) == SSA_NAME && gimple_code(get_def_stmt(arg)) != GIMPLE_NOP) {
87098 + gsi = gsi_for_stmt(get_def_stmt(arg));
87099 + newstmt = build_cast_stmt(size_overflow_type, arg, new_var, &gsi, AFTER_STMT);
87100 + return gimple_get_lhs(newstmt);
87101 + }
87102 +
87103 + bb = gimple_phi_arg_edge(oldstmt, i)->src;
87104 + gsi = gsi_after_labels(bb);
87105 + if (bb->index == 0) {
87106 + bb = create_a_first_bb();
87107 + gsi = gsi_start_bb(bb);
87108 + }
87109 + if (gsi_end_p(gsi))
87110 + before = AFTER_STMT;
87111 + newstmt = build_cast_stmt(size_overflow_type, arg, new_var, &gsi, before);
87112 + return gimple_get_lhs(newstmt);
87113 +}
87114 +
87115 +static const_gimple handle_new_phi_arg(const_tree arg, tree new_var, tree new_rhs)
87116 +{
87117 + gimple newstmt;
87118 + gimple_stmt_iterator gsi;
87119 + void (*gsi_insert)(gimple_stmt_iterator *, gimple, enum gsi_iterator_update);
87120 + gimple def_newstmt = get_def_stmt(new_rhs);
87121 +
87122 + gsi_insert = gsi_insert_after;
87123 + gsi = gsi_for_stmt(def_newstmt);
87124 +
87125 + switch (gimple_code(get_def_stmt(arg))) {
87126 + case GIMPLE_PHI:
87127 + newstmt = gimple_build_assign(new_var, new_rhs);
87128 + gsi = gsi_after_labels(gimple_bb(def_newstmt));
87129 + gsi_insert = gsi_insert_before;
87130 + break;
87131 + case GIMPLE_ASM:
87132 + case GIMPLE_CALL:
87133 + newstmt = gimple_build_assign(new_var, new_rhs);
87134 + break;
87135 + case GIMPLE_ASSIGN:
87136 + newstmt = gimple_build_assign(new_var, gimple_get_lhs(def_newstmt));
87137 + break;
87138 + default:
87139 + /* unknown gimple_code (handle_build_new_phi_arg) */
87140 + gcc_unreachable();
87141 + }
87142 +
87143 + gimple_set_lhs(newstmt, make_ssa_name(new_var, newstmt));
87144 + gsi_insert(&gsi, newstmt, GSI_NEW_STMT);
87145 + gimple_set_plf(newstmt, MY_STMT, true);
87146 + update_stmt(newstmt);
87147 + return newstmt;
87148 +}
87149 +
87150 +static tree build_new_phi_arg(struct pointer_set_t *visited, enum overflow_reason* overflowed, tree size_overflow_type, tree arg, tree new_var)
87151 +{
87152 + const_gimple newstmt;
87153 + tree new_rhs;
87154 +
87155 + new_rhs = expand(visited, overflowed, arg);
87156 + if (new_rhs == NULL_TREE || *overflowed == OVERFLOW_INTENTIONAL)
87157 + return NULL_TREE;
87158 +
87159 + new_rhs = cast_to_new_size_overflow_type(get_def_stmt(new_rhs), new_rhs, size_overflow_type, AFTER_STMT);
87160 +
87161 + newstmt = handle_new_phi_arg(arg, new_var, new_rhs);
87162 + return gimple_get_lhs(newstmt);
87163 +}
87164 +
87165 +static tree build_new_phi(struct pointer_set_t *visited, enum overflow_reason* overflowed, tree orig_result)
87166 +{
87167 + gimple phi, oldstmt = get_def_stmt(orig_result);
87168 + tree new_result, size_overflow_type;
87169 + unsigned int i;
87170 + unsigned int n = gimple_phi_num_args(oldstmt);
87171 +
87172 + size_overflow_type = get_size_overflow_type(oldstmt, orig_result);
87173 +
87174 + new_result = create_new_var(size_overflow_type);
87175 +
87176 + pointer_set_insert(visited, oldstmt);
87177 + phi = overflow_create_phi_node(oldstmt, new_result);
87178 + for (i = 0; i < n; i++) {
87179 + tree arg, lhs;
87180 +
87181 + arg = gimple_phi_arg_def(oldstmt, i);
87182 + if (is_gimple_constant(arg))
87183 + arg = cast_a_tree(size_overflow_type, arg);
87184 + lhs = build_new_phi_arg(visited, overflowed, size_overflow_type, arg, new_result);
87185 + if (*overflowed == OVERFLOW_INTENTIONAL)
87186 + return NULL_TREE;
87187 + if (lhs == NULL_TREE)
87188 + lhs = cast_old_phi_arg(oldstmt, size_overflow_type, arg, new_result, i);
87189 + add_phi_arg(phi, lhs, gimple_phi_arg_edge(oldstmt, i), gimple_location(oldstmt));
87190 + }
87191 +
87192 + update_stmt(phi);
87193 + return gimple_phi_result(phi);
87194 +}
87195 +
87196 +static tree change_assign_rhs(gimple stmt, const_tree orig_rhs, tree new_rhs)
87197 +{
87198 + const_gimple assign;
87199 + gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
87200 + tree origtype = TREE_TYPE(orig_rhs);
87201 +
87202 + gcc_assert(gimple_code(stmt) == GIMPLE_ASSIGN);
87203 +
87204 + assign = build_cast_stmt(origtype, new_rhs, CREATE_NEW_VAR, &gsi, BEFORE_STMT);
87205 + return gimple_get_lhs(assign);
87206 +}
87207 +
87208 +static void change_rhs1(gimple stmt, tree new_rhs1)
87209 +{
87210 + tree assign_rhs;
87211 + const_tree rhs = gimple_assign_rhs1(stmt);
87212 +
87213 + assign_rhs = change_assign_rhs(stmt, rhs, new_rhs1);
87214 + gimple_assign_set_rhs1(stmt, assign_rhs);
87215 + update_stmt(stmt);
87216 +}
87217 +
87218 +static bool check_mode_type(const_gimple stmt)
87219 +{
87220 + const_tree lhs = gimple_get_lhs(stmt);
87221 + const_tree lhs_type = TREE_TYPE(lhs);
87222 + const_tree rhs_type = TREE_TYPE(gimple_assign_rhs1(stmt));
87223 + enum machine_mode lhs_mode = TYPE_MODE(lhs_type);
87224 + enum machine_mode rhs_mode = TYPE_MODE(rhs_type);
87225 +
87226 + if (rhs_mode == lhs_mode && TYPE_UNSIGNED(rhs_type) == TYPE_UNSIGNED(lhs_type))
87227 + return false;
87228 +
87229 + if (rhs_mode == SImode && lhs_mode == DImode && (TYPE_UNSIGNED(rhs_type) || !TYPE_UNSIGNED(lhs_type)))
87230 + return false;
87231 +
87232 + return true;
87233 +}
87234 +
87235 +static bool check_undefined_integer_operation(const_gimple stmt)
87236 +{
87237 + const_gimple def_stmt;
87238 + const_tree lhs = gimple_get_lhs(stmt);
87239 + const_tree rhs1 = gimple_assign_rhs1(stmt);
87240 + const_tree rhs1_type = TREE_TYPE(rhs1);
87241 + const_tree lhs_type = TREE_TYPE(lhs);
87242 +
87243 + if (TYPE_MODE(rhs1_type) != TYPE_MODE(lhs_type) || TYPE_UNSIGNED(rhs1_type) == TYPE_UNSIGNED(lhs_type))
87244 + return false;
87245 +
87246 + def_stmt = get_def_stmt(rhs1);
87247 + if (gimple_code(def_stmt) != GIMPLE_ASSIGN)
87248 + return false;
87249 +
87250 + if (gimple_assign_rhs_code(def_stmt) != MINUS_EXPR)
87251 + return false;
87252 + return true;
87253 +}
87254 +
87255 +static bool is_a_cast_and_const_overflow(const_tree no_const_rhs)
87256 +{
87257 + const_tree rhs1, lhs, rhs1_type, lhs_type;
87258 + enum machine_mode lhs_mode, rhs_mode;
87259 + gimple def_stmt = get_def_stmt(no_const_rhs);
87260 +
87261 + if (!gimple_assign_cast_p(def_stmt))
87262 + return false;
87263 +
87264 + rhs1 = gimple_assign_rhs1(def_stmt);
87265 + lhs = gimple_get_lhs(def_stmt);
87266 + rhs1_type = TREE_TYPE(rhs1);
87267 + lhs_type = TREE_TYPE(lhs);
87268 + rhs_mode = TYPE_MODE(rhs1_type);
87269 + lhs_mode = TYPE_MODE(lhs_type);
87270 + if (TYPE_UNSIGNED(lhs_type) == TYPE_UNSIGNED(rhs1_type) || lhs_mode != rhs_mode)
87271 + return false;
87272 +
87273 + return true;
87274 +}
87275 +
87276 +static tree handle_unary_rhs(struct pointer_set_t *visited, enum overflow_reason* overflowed, gimple stmt)
87277 +{
87278 + tree size_overflow_type, lhs = gimple_get_lhs(stmt);
87279 + tree new_rhs1, rhs1 = gimple_assign_rhs1(stmt);
87280 + const_tree rhs1_type = TREE_TYPE(rhs1);
87281 + const_tree lhs_type = TREE_TYPE(lhs);
87282 +
87283 + new_rhs1 = expand(visited, overflowed, rhs1);
87284 +
87285 + if (*overflowed == OVERFLOW_INTENTIONAL)
87286 + return NULL_TREE;
87287 +
87288 + if (new_rhs1 == NULL_TREE || TREE_CODE(rhs1_type) == POINTER_TYPE)
87289 + return create_assign(visited, overflowed, stmt, lhs, AFTER_STMT);
87290 +
87291 + if (gimple_plf(stmt, MY_STMT))
87292 + return lhs;
87293 +
87294 + if (gimple_plf(stmt, NO_CAST_CHECK))
87295 + return follow_overflow_type_and_dup(visited, overflowed, stmt, rhs1, new_rhs1, NULL_TREE, NULL_TREE);
87296 +
87297 + if (gimple_assign_rhs_code(stmt) == BIT_NOT_EXPR) {
87298 + size_overflow_type = get_size_overflow_type(stmt, rhs1);
87299 + new_rhs1 = cast_to_new_size_overflow_type(stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
87300 + check_size_overflow(stmt, size_overflow_type, new_rhs1, rhs1, overflowed, BEFORE_STMT);
87301 + return create_assign(visited, overflowed, stmt, lhs, AFTER_STMT);
87302 + }
87303 +
87304 + if (!gimple_assign_cast_p(stmt) || check_undefined_integer_operation(stmt))
87305 + return follow_overflow_type_and_dup(visited, overflowed, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
87306 +
87307 + size_overflow_type = get_size_overflow_type(stmt, rhs1);
87308 + new_rhs1 = cast_to_new_size_overflow_type(stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
87309 +
87310 + change_rhs1(stmt, new_rhs1);
87311 + check_size_overflow(stmt, size_overflow_type, new_rhs1, rhs1, overflowed, BEFORE_STMT);
87312 +
87313 + rhs1 = gimple_assign_rhs1(stmt);
87314 + rhs1_type = TREE_TYPE(rhs1);
87315 + if (TYPE_UNSIGNED(rhs1_type) != TYPE_UNSIGNED(lhs_type))
87316 + return create_assign(visited, overflowed, stmt, rhs1, AFTER_STMT);
87317 +
87318 + if (!check_mode_type(stmt))
87319 + return create_assign(visited, overflowed, stmt, lhs, AFTER_STMT);
87320 +
87321 + size_overflow_type = get_size_overflow_type(stmt, lhs);
87322 + new_rhs1 = cast_to_new_size_overflow_type(stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
87323 +
87324 + check_size_overflow(stmt, size_overflow_type, new_rhs1, lhs, overflowed, BEFORE_STMT);
87325 +
87326 + return create_assign(visited, overflowed, stmt, lhs, AFTER_STMT);
87327 +}
87328 +
87329 +static tree handle_unary_ops(struct pointer_set_t *visited, enum overflow_reason* overflowed, tree lhs)
87330 +{
87331 + gimple def_stmt = get_def_stmt(lhs);
87332 + tree rhs1 = gimple_assign_rhs1(def_stmt);
87333 +
87334 + if (is_gimple_constant(rhs1))
87335 + return create_assign(visited, overflowed, def_stmt, lhs, AFTER_STMT);
87336 +
87337 + gcc_assert(TREE_CODE(rhs1) != COND_EXPR);
87338 + switch (TREE_CODE(rhs1)) {
87339 + case SSA_NAME:
87340 + return handle_unary_rhs(visited, overflowed, def_stmt);
87341 + case ARRAY_REF:
87342 + case BIT_FIELD_REF:
87343 + case ADDR_EXPR:
87344 + case COMPONENT_REF:
87345 + case INDIRECT_REF:
87346 +#if BUILDING_GCC_VERSION >= 4006
87347 + case MEM_REF:
87348 +#endif
87349 + case PARM_DECL:
87350 + case TARGET_MEM_REF:
87351 + case VAR_DECL:
87352 + return create_assign(visited, overflowed, def_stmt, lhs, AFTER_STMT);
87353 +
87354 + default:
87355 + debug_gimple_stmt(def_stmt);
87356 + debug_tree(rhs1);
87357 + gcc_unreachable();
87358 + }
87359 +}
87360 +
87361 +static void insert_cond(basic_block cond_bb, tree arg, enum tree_code cond_code, tree type_value)
87362 +{
87363 + gimple cond_stmt;
87364 + gimple_stmt_iterator gsi = gsi_last_bb(cond_bb);
87365 +
87366 + cond_stmt = gimple_build_cond(cond_code, arg, type_value, NULL_TREE, NULL_TREE);
87367 + gsi_insert_after(&gsi, cond_stmt, GSI_CONTINUE_LINKING);
87368 + update_stmt(cond_stmt);
87369 +}
87370 +
87371 +static tree create_string_param(tree string)
87372 +{
87373 + tree i_type, a_type;
87374 + const int length = TREE_STRING_LENGTH(string);
87375 +
87376 + gcc_assert(length > 0);
87377 +
87378 + i_type = build_index_type(build_int_cst(NULL_TREE, length - 1));
87379 + a_type = build_array_type(char_type_node, i_type);
87380 +
87381 + TREE_TYPE(string) = a_type;
87382 + TREE_CONSTANT(string) = 1;
87383 + TREE_READONLY(string) = 1;
87384 +
87385 + return build1(ADDR_EXPR, ptr_type_node, string);
87386 +}
87387 +
87388 +static void insert_cond_result(basic_block bb_true, const_gimple stmt, const_tree arg, bool min)
87389 +{
87390 + gimple func_stmt;
87391 + const_gimple def_stmt;
87392 + const_tree loc_line;
87393 + tree loc_file, ssa_name, current_func;
87394 + expanded_location xloc;
87395 + char ssa_name_buf[256];
87396 + gimple_stmt_iterator gsi = gsi_start_bb(bb_true);
87397 +
87398 + def_stmt = get_def_stmt(arg);
87399 + xloc = expand_location(gimple_location(def_stmt));
87400 +
87401 + if (!gimple_has_location(def_stmt)) {
87402 + xloc = expand_location(gimple_location(stmt));
87403 + if (!gimple_has_location(stmt))
87404 + xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl));
87405 + }
87406 +
87407 + loc_line = build_int_cstu(unsigned_type_node, xloc.line);
87408 +
87409 + loc_file = build_string(strlen(xloc.file) + 1, xloc.file);
87410 + loc_file = create_string_param(loc_file);
87411 +
87412 + current_func = build_string(NAME_LEN(current_function_decl) + 1, NAME(current_function_decl));
87413 + current_func = create_string_param(current_func);
87414 +
87415 + snprintf(ssa_name_buf, 256, "%s_%u (%s)\n", NAME(SSA_NAME_VAR(arg)), SSA_NAME_VERSION(arg), min ? "min" : "max");
87416 + ssa_name = build_string(256, ssa_name_buf);
87417 + ssa_name = create_string_param(ssa_name);
87418 +
87419 + // void report_size_overflow(const char *file, unsigned int line, const char *func, const char *ssa_name)
87420 + func_stmt = gimple_build_call(report_size_overflow_decl, 4, loc_file, loc_line, current_func, ssa_name);
87421 +
87422 + gsi_insert_after(&gsi, func_stmt, GSI_CONTINUE_LINKING);
87423 +}
87424 +
87425 +static void __unused print_the_code_insertions(const_gimple stmt)
87426 +{
87427 + location_t loc = gimple_location(stmt);
87428 +
87429 + inform(loc, "Integer size_overflow check applied here.");
87430 +}
87431 +
87432 +static void insert_check_size_overflow(gimple stmt, enum tree_code cond_code, tree arg, tree type_value, bool before, bool min)
87433 +{
87434 + basic_block cond_bb, join_bb, bb_true;
87435 + edge e;
87436 + gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
87437 +
87438 + cond_bb = gimple_bb(stmt);
87439 + if (before)
87440 + gsi_prev(&gsi);
87441 + if (gsi_end_p(gsi))
87442 + e = split_block_after_labels(cond_bb);
87443 + else
87444 + e = split_block(cond_bb, gsi_stmt(gsi));
87445 + cond_bb = e->src;
87446 + join_bb = e->dest;
87447 + e->flags = EDGE_FALSE_VALUE;
87448 + e->probability = REG_BR_PROB_BASE;
87449 +
87450 + bb_true = create_empty_bb(cond_bb);
87451 + make_edge(cond_bb, bb_true, EDGE_TRUE_VALUE);
87452 + make_edge(cond_bb, join_bb, EDGE_FALSE_VALUE);
87453 + make_edge(bb_true, join_bb, EDGE_FALLTHRU);
87454 +
87455 + if (dom_info_available_p(CDI_DOMINATORS)) {
87456 + set_immediate_dominator(CDI_DOMINATORS, bb_true, cond_bb);
87457 + set_immediate_dominator(CDI_DOMINATORS, join_bb, cond_bb);
87458 + }
87459 +
87460 + if (current_loops != NULL) {
87461 + gcc_assert(cond_bb->loop_father == join_bb->loop_father);
87462 + add_bb_to_loop(bb_true, cond_bb->loop_father);
87463 + }
87464 +
87465 + insert_cond(cond_bb, arg, cond_code, type_value);
87466 + insert_cond_result(bb_true, stmt, arg, min);
87467 +
87468 +// print_the_code_insertions(stmt);
87469 +}
87470 +
87471 +static void check_size_overflow(gimple stmt, tree size_overflow_type, tree cast_rhs, tree rhs, enum overflow_reason* overflowed, bool before)
87472 +{
87473 + const_tree rhs_type = TREE_TYPE(rhs);
87474 + tree cast_rhs_type, type_max_type, type_min_type, type_max, type_min;
87475 +
87476 + gcc_assert(rhs_type != NULL_TREE);
87477 + if (TREE_CODE(rhs_type) == POINTER_TYPE)
87478 + return;
87479 +
87480 + if (*overflowed == OVERFLOW_INTENTIONAL)
87481 + return;
87482 +
87483 + gcc_assert(TREE_CODE(rhs_type) == INTEGER_TYPE || TREE_CODE(rhs_type) == BOOLEAN_TYPE || TREE_CODE(rhs_type) == ENUMERAL_TYPE);
87484 +
87485 + type_max = cast_a_tree(size_overflow_type, TYPE_MAX_VALUE(rhs_type));
87486 + type_min = cast_a_tree(size_overflow_type, TYPE_MIN_VALUE(rhs_type));
87487 +
87488 + gcc_assert(!TREE_OVERFLOW(type_max));
87489 +
87490 + cast_rhs_type = TREE_TYPE(cast_rhs);
87491 + type_max_type = TREE_TYPE(type_max);
87492 + type_min_type = TREE_TYPE(type_min);
87493 + gcc_assert(useless_type_conversion_p(cast_rhs_type, type_max_type));
87494 + gcc_assert(useless_type_conversion_p(type_max_type, type_min_type));
87495 +
87496 + insert_check_size_overflow(stmt, GT_EXPR, cast_rhs, type_max, before, false);
87497 + insert_check_size_overflow(stmt, LT_EXPR, cast_rhs, type_min, before, true);
87498 +}
87499 +
87500 +static tree get_size_overflow_type_for_intentional_overflow(gimple def_stmt, tree change_rhs)
87501 +{
87502 + gimple change_rhs_def_stmt;
87503 + tree lhs = gimple_get_lhs(def_stmt);
87504 + tree lhs_type = TREE_TYPE(lhs);
87505 + tree rhs1_type = TREE_TYPE(gimple_assign_rhs1(def_stmt));
87506 + tree rhs2_type = TREE_TYPE(gimple_assign_rhs2(def_stmt));
87507 +
87508 + if (change_rhs == NULL_TREE)
87509 + return get_size_overflow_type(def_stmt, lhs);
87510 +
87511 + change_rhs_def_stmt = get_def_stmt(change_rhs);
87512 +
87513 + if (TREE_CODE_CLASS(gimple_assign_rhs_code(def_stmt)) == tcc_comparison)
87514 + return get_size_overflow_type(change_rhs_def_stmt, change_rhs);
87515 +
87516 + if (gimple_assign_rhs_code(def_stmt) == LSHIFT_EXPR)
87517 + return get_size_overflow_type(change_rhs_def_stmt, change_rhs);
87518 +
87519 + if (gimple_assign_rhs_code(def_stmt) == RSHIFT_EXPR)
87520 + return get_size_overflow_type(change_rhs_def_stmt, change_rhs);
87521 +
87522 + if (!useless_type_conversion_p(lhs_type, rhs1_type) || !useless_type_conversion_p(rhs1_type, rhs2_type)) {
87523 + debug_gimple_stmt(def_stmt);
87524 + gcc_unreachable();
87525 + }
87526 +
87527 + return get_size_overflow_type(def_stmt, lhs);
87528 +}
87529 +
87530 +static bool is_a_constant_overflow(const_gimple stmt, const_tree rhs)
87531 +{
87532 + if (gimple_assign_rhs_code(stmt) == MIN_EXPR)
87533 + return false;
87534 + if (!is_gimple_constant(rhs))
87535 + return false;
87536 + return true;
87537 +}
87538 +
87539 +static tree get_cast_def_stmt_rhs(const_tree new_rhs)
87540 +{
87541 + gimple def_stmt;
87542 +
87543 + def_stmt = get_def_stmt(new_rhs);
87544 + // get_size_overflow_type
87545 + if (LONG_TYPE_SIZE != GET_MODE_BITSIZE(SImode))
87546 + gcc_assert(gimple_assign_cast_p(def_stmt));
87547 + return gimple_assign_rhs1(def_stmt);
87548 +}
87549 +
87550 +static tree cast_to_int_TI_type_and_check(enum overflow_reason* overflowed, gimple stmt, tree new_rhs)
87551 +{
87552 + gimple_stmt_iterator gsi;
87553 + const_gimple cast_stmt;
87554 + gimple def_stmt;
87555 + enum machine_mode mode = TYPE_MODE(TREE_TYPE(new_rhs));
87556 +
87557 + if (mode != TImode && mode != DImode) {
87558 + def_stmt = get_def_stmt(new_rhs);
87559 + gcc_assert(gimple_assign_cast_p(def_stmt));
87560 + new_rhs = gimple_assign_rhs1(def_stmt);
87561 + mode = TYPE_MODE(TREE_TYPE(new_rhs));
87562 + }
87563 +
87564 + gcc_assert(mode == TImode || mode == DImode);
87565 +
87566 + if (mode == TYPE_MODE(intTI_type_node) && useless_type_conversion_p(TREE_TYPE(new_rhs), intTI_type_node))
87567 + return new_rhs;
87568 +
87569 + gsi = gsi_for_stmt(stmt);
87570 + cast_stmt = build_cast_stmt(intTI_type_node, new_rhs, CREATE_NEW_VAR, &gsi, BEFORE_STMT);
87571 + new_rhs = gimple_get_lhs(cast_stmt);
87572 +
87573 + if (mode == DImode)
87574 + return new_rhs;
87575 +
87576 + check_size_overflow(stmt, intTI_type_node, new_rhs, new_rhs, overflowed, BEFORE_STMT);
87577 +
87578 + return new_rhs;
87579 +}
87580 +
87581 +static bool is_an_integer_trunction(const_gimple stmt)
87582 +{
87583 + gimple rhs1_def_stmt, rhs2_def_stmt;
87584 + const_tree rhs1_def_stmt_rhs1, rhs2_def_stmt_rhs1;
87585 + enum machine_mode rhs1_def_stmt_rhs1_mode, rhs2_def_stmt_rhs1_mode;
87586 + const_tree rhs1 = gimple_assign_rhs1(stmt);
87587 + const_tree rhs2 = gimple_assign_rhs2(stmt);
87588 + enum machine_mode rhs1_mode = TYPE_MODE(TREE_TYPE(rhs1));
87589 + enum machine_mode rhs2_mode = TYPE_MODE(TREE_TYPE(rhs2));
87590 +
87591 + if (is_gimple_constant(rhs1) || is_gimple_constant(rhs2))
87592 + return false;
87593 +
87594 + gcc_assert(TREE_CODE(rhs1) == SSA_NAME && TREE_CODE(rhs2) == SSA_NAME);
87595 +
87596 + if (gimple_assign_rhs_code(stmt) != MINUS_EXPR || rhs1_mode != SImode || rhs2_mode != SImode)
87597 + return false;
87598 +
87599 + rhs1_def_stmt = get_def_stmt(rhs1);
87600 + rhs2_def_stmt = get_def_stmt(rhs2);
87601 + if (!gimple_assign_cast_p(rhs1_def_stmt) || !gimple_assign_cast_p(rhs2_def_stmt))
87602 + return false;
87603 +
87604 + rhs1_def_stmt_rhs1 = gimple_assign_rhs1(rhs1_def_stmt);
87605 + rhs2_def_stmt_rhs1 = gimple_assign_rhs1(rhs2_def_stmt);
87606 + rhs1_def_stmt_rhs1_mode = TYPE_MODE(TREE_TYPE(rhs1_def_stmt_rhs1));
87607 + rhs2_def_stmt_rhs1_mode = TYPE_MODE(TREE_TYPE(rhs2_def_stmt_rhs1));
87608 + if (rhs1_def_stmt_rhs1_mode != DImode || rhs2_def_stmt_rhs1_mode != DImode)
87609 + return false;
87610 +
87611 + gimple_set_plf(rhs1_def_stmt, NO_CAST_CHECK, true);
87612 + gimple_set_plf(rhs2_def_stmt, NO_CAST_CHECK, true);
87613 + return true;
87614 +}
87615 +
87616 +static tree handle_integer_truncation(struct pointer_set_t *visited, enum overflow_reason* overflowed, const_tree lhs)
87617 +{
87618 + tree new_rhs1, new_rhs2;
87619 + tree new_rhs1_def_stmt_rhs1, new_rhs2_def_stmt_rhs1, new_lhs;
87620 + tree new_rhs1_def_stmt_rhs1_type, new_rhs2_def_stmt_rhs1_type;
87621 + gimple assign, stmt = get_def_stmt(lhs);
87622 + tree rhs1 = gimple_assign_rhs1(stmt);
87623 + tree rhs2 = gimple_assign_rhs2(stmt);
87624 +
87625 + if (!is_an_integer_trunction(stmt))
87626 + return NULL_TREE;
87627 +
87628 + new_rhs1 = expand(visited, overflowed, rhs1);
87629 + new_rhs2 = expand(visited, overflowed, rhs2);
87630 +
87631 + if (*overflowed == OVERFLOW_INTENTIONAL)
87632 + return NULL_TREE;
87633 +
87634 + new_rhs1_def_stmt_rhs1 = get_cast_def_stmt_rhs(new_rhs1);
87635 + new_rhs2_def_stmt_rhs1 = get_cast_def_stmt_rhs(new_rhs2);
87636 +
87637 + new_rhs1_def_stmt_rhs1_type = TREE_TYPE(new_rhs1_def_stmt_rhs1);
87638 + new_rhs2_def_stmt_rhs1_type = TREE_TYPE(new_rhs2_def_stmt_rhs1);
87639 +
87640 + if (!useless_type_conversion_p(new_rhs1_def_stmt_rhs1_type, new_rhs2_def_stmt_rhs1_type)) {
87641 + new_rhs1_def_stmt_rhs1 = cast_to_int_TI_type_and_check(overflowed, stmt, new_rhs1_def_stmt_rhs1);
87642 + new_rhs2_def_stmt_rhs1 = cast_to_int_TI_type_and_check(overflowed, stmt, new_rhs2_def_stmt_rhs1);
87643 + }
87644 +
87645 + assign = create_binary_assign(MINUS_EXPR, stmt, new_rhs1_def_stmt_rhs1, new_rhs2_def_stmt_rhs1);
87646 + new_lhs = gimple_get_lhs(assign);
87647 + check_size_overflow(assign, TREE_TYPE(new_lhs), new_lhs, rhs1, overflowed, AFTER_STMT);
87648 +
87649 + return follow_overflow_type_and_dup(visited, overflowed, stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
87650 +}
87651 +
87652 +static bool is_a_neg_overflow(const_gimple stmt, const_tree rhs)
87653 +{
87654 + const_gimple def_stmt;
87655 +
87656 + if (TREE_CODE(rhs) != SSA_NAME)
87657 + return false;
87658 +
87659 + if (gimple_assign_rhs_code(stmt) != PLUS_EXPR)
87660 + return false;
87661 +
87662 + def_stmt = get_def_stmt(rhs);
87663 + if (gimple_code(def_stmt) != GIMPLE_ASSIGN || gimple_assign_rhs_code(def_stmt) != BIT_NOT_EXPR)
87664 + return false;
87665 +
87666 + return true;
87667 +}
87668 +
87669 +static tree handle_intentional_overflow(struct pointer_set_t *visited, enum overflow_reason* overflowed, bool check_overflow, gimple stmt, tree change_rhs, tree new_rhs1, tree new_rhs2)
87670 +{
87671 + tree new_rhs, size_overflow_type, orig_rhs;
87672 + void (*gimple_assign_set_rhs)(gimple, tree);
87673 + tree rhs1 = gimple_assign_rhs1(stmt);
87674 + tree rhs2 = gimple_assign_rhs2(stmt);
87675 + tree lhs = gimple_get_lhs(stmt);
87676 +
87677 + if (change_rhs == NULL_TREE)
87678 + return create_assign(visited, overflowed, stmt, lhs, AFTER_STMT);
87679 +
87680 + if (new_rhs2 == NULL_TREE) {
87681 + size_overflow_type = get_size_overflow_type_for_intentional_overflow(stmt, new_rhs1);
87682 + new_rhs2 = cast_a_tree(size_overflow_type, rhs2);
87683 + orig_rhs = rhs1;
87684 + gimple_assign_set_rhs = &gimple_assign_set_rhs1;
87685 + } else {
87686 + size_overflow_type = get_size_overflow_type_for_intentional_overflow(stmt, new_rhs2);
87687 + new_rhs1 = cast_a_tree(size_overflow_type, rhs1);
87688 + orig_rhs = rhs2;
87689 + gimple_assign_set_rhs = &gimple_assign_set_rhs2;
87690 + }
87691 +
87692 + change_rhs = cast_to_new_size_overflow_type(stmt, change_rhs, size_overflow_type, BEFORE_STMT);
87693 +
87694 + if (check_overflow)
87695 + check_size_overflow(stmt, size_overflow_type, change_rhs, orig_rhs, overflowed, BEFORE_STMT);
87696 +
87697 + new_rhs = change_assign_rhs(stmt, orig_rhs, change_rhs);
87698 + gimple_assign_set_rhs(stmt, new_rhs);
87699 + update_stmt(stmt);
87700 +
87701 + return create_assign(visited, overflowed, stmt, lhs, AFTER_STMT);
87702 +}
87703 +
87704 +static tree handle_binary_ops(struct pointer_set_t *visited, enum overflow_reason* overflowed, tree lhs)
87705 +{
87706 + tree rhs1, rhs2, new_lhs;
87707 + gimple def_stmt = get_def_stmt(lhs);
87708 + tree new_rhs1 = NULL_TREE;
87709 + tree new_rhs2 = NULL_TREE;
87710 +
87711 + rhs1 = gimple_assign_rhs1(def_stmt);
87712 + rhs2 = gimple_assign_rhs2(def_stmt);
87713 +
87714 + /* no DImode/TImode division in the 32/64 bit kernel */
87715 + switch (gimple_assign_rhs_code(def_stmt)) {
87716 + case RDIV_EXPR:
87717 + case TRUNC_DIV_EXPR:
87718 + case CEIL_DIV_EXPR:
87719 + case FLOOR_DIV_EXPR:
87720 + case ROUND_DIV_EXPR:
87721 + case TRUNC_MOD_EXPR:
87722 + case CEIL_MOD_EXPR:
87723 + case FLOOR_MOD_EXPR:
87724 + case ROUND_MOD_EXPR:
87725 + case EXACT_DIV_EXPR:
87726 + case POINTER_PLUS_EXPR:
87727 + case BIT_AND_EXPR:
87728 + return create_assign(visited, overflowed, def_stmt, lhs, AFTER_STMT);
87729 + default:
87730 + break;
87731 + }
87732 +
87733 + new_lhs = handle_integer_truncation(visited, overflowed, lhs);
87734 + if (new_lhs != NULL_TREE)
87735 + return new_lhs;
87736 +
87737 + if (TREE_CODE(rhs1) == SSA_NAME)
87738 + new_rhs1 = expand(visited, overflowed, rhs1);
87739 + if (TREE_CODE(rhs2) == SSA_NAME)
87740 + new_rhs2 = expand(visited, overflowed, rhs2);
87741 +
87742 + if (*overflowed == OVERFLOW_INTENTIONAL)
87743 + return NULL_TREE;
87744 +
87745 + if (is_a_neg_overflow(def_stmt, rhs2))
87746 + return handle_intentional_overflow(visited, overflowed, true, def_stmt, new_rhs1, new_rhs1, NULL_TREE);
87747 + if (is_a_neg_overflow(def_stmt, rhs1))
87748 + return handle_intentional_overflow(visited, overflowed, true, def_stmt, new_rhs2, NULL_TREE, new_rhs2);
87749 +
87750 + if (is_a_constant_overflow(def_stmt, rhs2))
87751 + return handle_intentional_overflow(visited, overflowed, !is_a_cast_and_const_overflow(rhs1), def_stmt, new_rhs1, new_rhs1, NULL_TREE);
87752 + if (is_a_constant_overflow(def_stmt, rhs1))
87753 + return handle_intentional_overflow(visited, overflowed, !is_a_cast_and_const_overflow(rhs2), def_stmt, new_rhs2, NULL_TREE, new_rhs2);
87754 +
87755 + return follow_overflow_type_and_dup(visited, overflowed, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
87756 +}
87757 +
87758 +#if BUILDING_GCC_VERSION >= 4007
87759 +static tree get_new_rhs(struct pointer_set_t *visited, enum overflow_reason * overflowed, tree size_overflow_type, tree rhs)
87760 +{
87761 + if (is_gimple_constant(rhs))
87762 + return cast_a_tree(size_overflow_type, rhs);
87763 + if (TREE_CODE(rhs) != SSA_NAME)
87764 + return NULL_TREE;
87765 + return expand(visited, overflowed, rhs);
87766 +}
87767 +
87768 +static tree handle_ternary_ops(struct pointer_set_t *visited, enum overflow_reason* overflowed, tree lhs)
87769 +{
87770 + tree rhs1, rhs2, rhs3, new_rhs1, new_rhs2, new_rhs3, size_overflow_type;
87771 + gimple def_stmt = get_def_stmt(lhs);
87772 +
87773 + size_overflow_type = get_size_overflow_type(def_stmt, lhs);
87774 +
87775 + rhs1 = gimple_assign_rhs1(def_stmt);
87776 + rhs2 = gimple_assign_rhs2(def_stmt);
87777 + rhs3 = gimple_assign_rhs3(def_stmt);
87778 + new_rhs1 = get_new_rhs(visited, overflowed, size_overflow_type, rhs1);
87779 + new_rhs2 = get_new_rhs(visited, overflowed, size_overflow_type, rhs2);
87780 + new_rhs3 = get_new_rhs(visited, overflowed, size_overflow_type, rhs3);
87781 +
87782 + if (*overflowed == OVERFLOW_INTENTIONAL)
87783 + return NULL_TREE;
87784 +
87785 + return follow_overflow_type_and_dup(visited, overflowed, def_stmt, lhs, new_rhs1, new_rhs2, new_rhs3);
87786 +}
87787 +#endif
87788 +
87789 +static tree get_size_overflow_type(gimple stmt, const_tree node)
87790 +{
87791 + const_tree type;
87792 +
87793 + gcc_assert(node != NULL_TREE);
87794 +
87795 + type = TREE_TYPE(node);
87796 +
87797 + if (gimple_plf(stmt, MY_STMT))
87798 + return TREE_TYPE(node);
87799 +
87800 + switch (TYPE_MODE(type)) {
87801 + case QImode:
87802 + return (TYPE_UNSIGNED(type)) ? unsigned_intHI_type_node : intHI_type_node;
87803 + case HImode:
87804 + return (TYPE_UNSIGNED(type)) ? unsigned_intSI_type_node : intSI_type_node;
87805 + case SImode:
87806 + return (TYPE_UNSIGNED(type)) ? unsigned_intDI_type_node : intDI_type_node;
87807 + case DImode:
87808 + if (LONG_TYPE_SIZE == GET_MODE_BITSIZE(SImode))
87809 + return (TYPE_UNSIGNED(type)) ? unsigned_intDI_type_node : intDI_type_node;
87810 + return (TYPE_UNSIGNED(type)) ? unsigned_intTI_type_node : intTI_type_node;
87811 + default:
87812 + debug_tree((tree)node);
87813 + error("get_size_overflow_type: unsupported gcc configuration.");
87814 + gcc_unreachable();
87815 + }
87816 +}
87817 +
87818 +static tree expand_visited(gimple def_stmt)
87819 +{
87820 + const_gimple next_stmt;
87821 + gimple_stmt_iterator gsi = gsi_for_stmt(def_stmt);
87822 +
87823 + gsi_next(&gsi);
87824 + next_stmt = gsi_stmt(gsi);
87825 +
87826 + switch (gimple_code(next_stmt)) {
87827 + case GIMPLE_ASSIGN:
87828 + return gimple_get_lhs(next_stmt);
87829 + case GIMPLE_PHI:
87830 + return gimple_phi_result(next_stmt);
87831 + case GIMPLE_CALL:
87832 + return gimple_call_lhs(next_stmt);
87833 + default:
87834 + return NULL_TREE;
87835 + }
87836 +}
87837 +
87838 +static tree expand(struct pointer_set_t *visited, enum overflow_reason* overflowed, tree lhs)
87839 +{
87840 + gimple def_stmt;
87841 + unsigned int argnum;
87842 + enum tree_code code = TREE_CODE(TREE_TYPE(lhs));
87843 +
87844 + if (is_gimple_constant(lhs))
87845 + return NULL_TREE;
87846 +
87847 + if (TREE_CODE(lhs) == ADDR_EXPR)
87848 + return NULL_TREE;
87849 +
87850 + gcc_assert(code == INTEGER_TYPE || code == POINTER_TYPE || code == BOOLEAN_TYPE || code == ENUMERAL_TYPE);
87851 +
87852 + if (TREE_CODE(SSA_NAME_VAR(lhs)) == PARM_DECL) {
87853 + argnum = search_missing_attribute(lhs);
87854 + if (argnum && is_already_marked(get_original_function_decl(current_function_decl), argnum) == MARKED_YES) {
87855 + *overflowed = OVERFLOW_INTENTIONAL;
87856 + return NULL_TREE;
87857 + }
87858 + }
87859 +
87860 + def_stmt = get_def_stmt(lhs);
87861 +
87862 + if (!def_stmt)
87863 + return NULL_TREE;
87864 +
87865 + if (gimple_plf(def_stmt, MY_STMT))
87866 + return lhs;
87867 +
87868 + if (pointer_set_contains(visited, def_stmt))
87869 + return expand_visited(def_stmt);
87870 +
87871 + switch (gimple_code(def_stmt)) {
87872 + case GIMPLE_NOP:
87873 + argnum = search_missing_attribute(lhs);
87874 + if (!argnum)
87875 + return NULL_TREE;
87876 + if (is_already_marked(get_original_function_decl(current_function_decl), argnum) == MARKED_YES)
87877 + *overflowed = OVERFLOW_INTENTIONAL;
87878 + return NULL_TREE;
87879 + case GIMPLE_PHI:
87880 + return build_new_phi(visited, overflowed, lhs);
87881 + case GIMPLE_CALL:
87882 + case GIMPLE_ASM:
87883 + return create_assign(visited, overflowed, def_stmt, lhs, AFTER_STMT);
87884 + case GIMPLE_ASSIGN:
87885 + switch (gimple_num_ops(def_stmt)) {
87886 + case 2:
87887 + return handle_unary_ops(visited, overflowed, lhs);
87888 + case 3:
87889 + return handle_binary_ops(visited, overflowed, lhs);
87890 +#if BUILDING_GCC_VERSION >= 4007
87891 + case 4:
87892 + return handle_ternary_ops(visited, overflowed, lhs);
87893 +#endif
87894 + }
87895 + default:
87896 + debug_gimple_stmt(def_stmt);
87897 + error("expand: unknown gimple code");
87898 + gcc_unreachable();
87899 + }
87900 +}
87901 +
87902 +static void change_function_arg(gimple stmt, const_tree origarg, unsigned int argnum, tree newarg)
87903 +{
87904 + const_gimple assign;
87905 + gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
87906 + tree origtype = TREE_TYPE(origarg);
87907 +
87908 + gcc_assert(gimple_code(stmt) == GIMPLE_CALL);
87909 +
87910 + assign = build_cast_stmt(origtype, newarg, CREATE_NEW_VAR, &gsi, BEFORE_STMT);
87911 +
87912 + gimple_call_set_arg(stmt, argnum, gimple_get_lhs(assign));
87913 + update_stmt(stmt);
87914 +}
87915 +
87916 +static tree get_function_arg(unsigned int argnum, const_gimple stmt, const_tree fndecl)
87917 +{
87918 + const char *origid;
87919 + tree arg;
87920 + const_tree origarg;
87921 +
87922 + if (!DECL_ABSTRACT_ORIGIN(fndecl)) {
87923 + gcc_assert(gimple_call_num_args(stmt) > argnum);
87924 + return gimple_call_arg(stmt, argnum);
87925 + }
87926 +
87927 + origarg = DECL_ARGUMENTS(DECL_ABSTRACT_ORIGIN(fndecl));
87928 + while (origarg && argnum) {
87929 + argnum--;
87930 + origarg = TREE_CHAIN(origarg);
87931 + }
87932 +
87933 + gcc_assert(argnum == 0);
87934 +
87935 + gcc_assert(origarg != NULL_TREE);
87936 + origid = NAME(origarg);
87937 + for (arg = DECL_ARGUMENTS(fndecl); arg; arg = TREE_CHAIN(arg)) {
87938 + if (!strcmp(origid, NAME(arg)))
87939 + return arg;
87940 + }
87941 + return NULL_TREE;
87942 +}
87943 +
87944 +static void handle_function_arg(gimple stmt, const_tree fndecl, unsigned int argnum)
87945 +{
87946 + struct pointer_set_t *visited;
87947 + tree arg, newarg;
87948 + enum overflow_reason overflowed = OVERFLOW_NONE;
87949 + location_t loc;
87950 + enum marked is_marked;
87951 +
87952 + arg = get_function_arg(argnum, stmt, fndecl);
87953 + if (arg == NULL_TREE)
87954 + return;
87955 +
87956 + if (is_gimple_constant(arg))
87957 + return;
87958 + if (TREE_CODE(arg) != SSA_NAME)
87959 + return;
87960 +
87961 + check_arg_type(arg);
87962 +
87963 + visited = pointer_set_create();
87964 + newarg = expand(visited, &overflowed, arg);
87965 + pointer_set_destroy(visited);
87966 +
87967 + is_marked = is_already_marked(fndecl, argnum + 1);
87968 + if ((overflowed == OVERFLOW_INTENTIONAL && is_marked == MARKED_YES) || is_marked == MARKED_NOT_INTENTIONAL)
87969 + return;
87970 +
87971 + if (overflowed == OVERFLOW_INTENTIONAL) {
87972 + loc = DECL_SOURCE_LOCATION(fndecl);
87973 + inform(loc, "The intentional_overflow attribute is missing from +%s+%u+", NAME(fndecl), argnum + 1);
87974 + return;
87975 + }
87976 +
87977 + if (newarg == NULL_TREE)
87978 + return;
87979 +
87980 + change_function_arg(stmt, arg, argnum, newarg);
87981 +
87982 + check_size_overflow(stmt, TREE_TYPE(newarg), newarg, arg, &overflowed, BEFORE_STMT);
87983 +}
87984 +
87985 +static void handle_function_by_attribute(gimple stmt, const_tree attr, const_tree fndecl)
87986 +{
87987 + tree p = TREE_VALUE(attr);
87988 + do {
87989 + handle_function_arg(stmt, fndecl, TREE_INT_CST_LOW(TREE_VALUE(p))-1);
87990 + p = TREE_CHAIN(p);
87991 + } while (p);
87992 +}
87993 +
87994 +static void handle_function_by_hash(gimple stmt, const_tree fndecl)
87995 +{
87996 + const_tree orig_fndecl;
87997 + unsigned int num;
87998 + const struct size_overflow_hash *hash;
87999 +
88000 + orig_fndecl = get_original_function_decl(fndecl);
88001 + hash = get_function_hash(orig_fndecl);
88002 + if (!hash)
88003 + return;
88004 +
88005 + for (num = 1; num <= MAX_PARAM; num++)
88006 + if (hash->param & (1U << num))
88007 + handle_function_arg(stmt, fndecl, num - 1);
88008 +}
88009 +
88010 +static void set_plf_false(void)
88011 +{
88012 + basic_block bb;
88013 +
88014 + FOR_ALL_BB(bb) {
88015 + gimple_stmt_iterator si;
88016 +
88017 + for (si = gsi_start_bb(bb); !gsi_end_p(si); gsi_next(&si))
88018 + gimple_set_plf(gsi_stmt(si), MY_STMT, false);
88019 + for (si = gsi_start_phis(bb); !gsi_end_p(si); gsi_next(&si))
88020 + gimple_set_plf(gsi_stmt(si), MY_STMT, false);
88021 + }
88022 +}
88023 +
88024 +static unsigned int handle_function(void)
88025 +{
88026 + basic_block next, bb = ENTRY_BLOCK_PTR->next_bb;
88027 +
88028 + set_plf_false();
88029 +
88030 + do {
88031 + gimple_stmt_iterator gsi;
88032 + next = bb->next_bb;
88033 +
88034 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
88035 + const_tree fndecl, attr;
88036 + gimple stmt = gsi_stmt(gsi);
88037 +
88038 + if (!(is_gimple_call(stmt)))
88039 + continue;
88040 + fndecl = gimple_call_fndecl(stmt);
88041 + if (fndecl == NULL_TREE)
88042 + continue;
88043 + if (gimple_call_num_args(stmt) == 0)
88044 + continue;
88045 + attr = lookup_attribute("size_overflow", DECL_ATTRIBUTES(fndecl));
88046 + if (!attr || !TREE_VALUE(attr))
88047 + handle_function_by_hash(stmt, fndecl);
88048 + else
88049 + handle_function_by_attribute(stmt, attr, fndecl);
88050 + gsi = gsi_for_stmt(stmt);
88051 + next = gimple_bb(stmt)->next_bb;
88052 + }
88053 + bb = next;
88054 + } while (bb);
88055 + return 0;
88056 +}
88057 +
88058 +static struct gimple_opt_pass size_overflow_pass = {
88059 + .pass = {
88060 + .type = GIMPLE_PASS,
88061 + .name = "size_overflow",
88062 + .gate = NULL,
88063 + .execute = handle_function,
88064 + .sub = NULL,
88065 + .next = NULL,
88066 + .static_pass_number = 0,
88067 + .tv_id = TV_NONE,
88068 + .properties_required = PROP_cfg | PROP_referenced_vars,
88069 + .properties_provided = 0,
88070 + .properties_destroyed = 0,
88071 + .todo_flags_start = 0,
88072 + .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi | TODO_cleanup_cfg | TODO_ggc_collect | TODO_verify_flow
88073 + }
88074 +};
88075 +
88076 +static void start_unit_callback(void __unused *gcc_data, void __unused *user_data)
88077 +{
88078 + tree fntype;
88079 +
88080 + const_char_ptr_type_node = build_pointer_type(build_type_variant(char_type_node, 1, 0));
88081 +
88082 + // void report_size_overflow(const char *loc_file, unsigned int loc_line, const char *current_func, const char *ssa_var)
88083 + fntype = build_function_type_list(void_type_node,
88084 + const_char_ptr_type_node,
88085 + unsigned_type_node,
88086 + const_char_ptr_type_node,
88087 + const_char_ptr_type_node,
88088 + NULL_TREE);
88089 + report_size_overflow_decl = build_fn_decl("report_size_overflow", fntype);
88090 +
88091 + DECL_ASSEMBLER_NAME(report_size_overflow_decl);
88092 + TREE_PUBLIC(report_size_overflow_decl) = 1;
88093 + DECL_EXTERNAL(report_size_overflow_decl) = 1;
88094 + DECL_ARTIFICIAL(report_size_overflow_decl) = 1;
88095 + TREE_THIS_VOLATILE(report_size_overflow_decl) = 1;
88096 +}
88097 +
88098 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
88099 +{
88100 + int i;
88101 + const char * const plugin_name = plugin_info->base_name;
88102 + const int argc = plugin_info->argc;
88103 + const struct plugin_argument * const argv = plugin_info->argv;
88104 + bool enable = true;
88105 +
88106 + struct register_pass_info size_overflow_pass_info = {
88107 + .pass = &size_overflow_pass.pass,
88108 + .reference_pass_name = "ssa",
88109 + .ref_pass_instance_number = 1,
88110 + .pos_op = PASS_POS_INSERT_AFTER
88111 + };
88112 +
88113 + if (!plugin_default_version_check(version, &gcc_version)) {
88114 + error(G_("incompatible gcc/plugin versions"));
88115 + return 1;
88116 + }
88117 +
88118 + for (i = 0; i < argc; ++i) {
88119 + if (!strcmp(argv[i].key, "no-size-overflow")) {
88120 + enable = false;
88121 + continue;
88122 + }
88123 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
88124 + }
88125 +
88126 + register_callback(plugin_name, PLUGIN_INFO, NULL, &size_overflow_plugin_info);
88127 + if (enable) {
88128 + register_callback("start_unit", PLUGIN_START_UNIT, &start_unit_callback, NULL);
88129 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &size_overflow_pass_info);
88130 + }
88131 + register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
88132 +
88133 + return 0;
88134 +}
88135 diff --git a/tools/gcc/stackleak_plugin.c b/tools/gcc/stackleak_plugin.c
88136 new file mode 100644
88137 index 0000000..38d2014
88138 --- /dev/null
88139 +++ b/tools/gcc/stackleak_plugin.c
88140 @@ -0,0 +1,313 @@
88141 +/*
88142 + * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
88143 + * Licensed under the GPL v2
88144 + *
88145 + * Note: the choice of the license means that the compilation process is
88146 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
88147 + * but for the kernel it doesn't matter since it doesn't link against
88148 + * any of the gcc libraries
88149 + *
88150 + * gcc plugin to help implement various PaX features
88151 + *
88152 + * - track lowest stack pointer
88153 + *
88154 + * TODO:
88155 + * - initialize all local variables
88156 + *
88157 + * BUGS:
88158 + * - none known
88159 + */
88160 +#include "gcc-plugin.h"
88161 +#include "config.h"
88162 +#include "system.h"
88163 +#include "coretypes.h"
88164 +#include "tree.h"
88165 +#include "tree-pass.h"
88166 +#include "flags.h"
88167 +#include "intl.h"
88168 +#include "toplev.h"
88169 +#include "plugin.h"
88170 +//#include "expr.h" where are you...
88171 +#include "diagnostic.h"
88172 +#include "plugin-version.h"
88173 +#include "tm.h"
88174 +#include "function.h"
88175 +#include "basic-block.h"
88176 +#include "gimple.h"
88177 +#include "rtl.h"
88178 +#include "emit-rtl.h"
88179 +
88180 +extern void print_gimple_stmt(FILE *, gimple, int, int);
88181 +
88182 +int plugin_is_GPL_compatible;
88183 +
88184 +static int track_frame_size = -1;
88185 +static const char track_function[] = "pax_track_stack";
88186 +static const char check_function[] = "pax_check_alloca";
88187 +static bool init_locals;
88188 +
88189 +static struct plugin_info stackleak_plugin_info = {
88190 + .version = "201203140940",
88191 + .help = "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n"
88192 +// "initialize-locals\t\tforcibly initialize all stack frames\n"
88193 +};
88194 +
88195 +static bool gate_stackleak_track_stack(void);
88196 +static unsigned int execute_stackleak_tree_instrument(void);
88197 +static unsigned int execute_stackleak_final(void);
88198 +
88199 +static struct gimple_opt_pass stackleak_tree_instrument_pass = {
88200 + .pass = {
88201 + .type = GIMPLE_PASS,
88202 + .name = "stackleak_tree_instrument",
88203 + .gate = gate_stackleak_track_stack,
88204 + .execute = execute_stackleak_tree_instrument,
88205 + .sub = NULL,
88206 + .next = NULL,
88207 + .static_pass_number = 0,
88208 + .tv_id = TV_NONE,
88209 + .properties_required = PROP_gimple_leh | PROP_cfg,
88210 + .properties_provided = 0,
88211 + .properties_destroyed = 0,
88212 + .todo_flags_start = 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts,
88213 + .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_update_ssa
88214 + }
88215 +};
88216 +
88217 +static struct rtl_opt_pass stackleak_final_rtl_opt_pass = {
88218 + .pass = {
88219 + .type = RTL_PASS,
88220 + .name = "stackleak_final",
88221 + .gate = gate_stackleak_track_stack,
88222 + .execute = execute_stackleak_final,
88223 + .sub = NULL,
88224 + .next = NULL,
88225 + .static_pass_number = 0,
88226 + .tv_id = TV_NONE,
88227 + .properties_required = 0,
88228 + .properties_provided = 0,
88229 + .properties_destroyed = 0,
88230 + .todo_flags_start = 0,
88231 + .todo_flags_finish = TODO_dump_func
88232 + }
88233 +};
88234 +
88235 +static bool gate_stackleak_track_stack(void)
88236 +{
88237 + return track_frame_size >= 0;
88238 +}
88239 +
88240 +static void stackleak_check_alloca(gimple_stmt_iterator *gsi)
88241 +{
88242 + gimple check_alloca;
88243 + tree fntype, fndecl, alloca_size;
88244 +
88245 + fntype = build_function_type_list(void_type_node, long_unsigned_type_node, NULL_TREE);
88246 + fndecl = build_fn_decl(check_function, fntype);
88247 + DECL_ASSEMBLER_NAME(fndecl); // for LTO
88248 +
88249 + // insert call to void pax_check_alloca(unsigned long size)
88250 + alloca_size = gimple_call_arg(gsi_stmt(*gsi), 0);
88251 + check_alloca = gimple_build_call(fndecl, 1, alloca_size);
88252 + gsi_insert_before(gsi, check_alloca, GSI_SAME_STMT);
88253 +}
88254 +
88255 +static void stackleak_add_instrumentation(gimple_stmt_iterator *gsi)
88256 +{
88257 + gimple track_stack;
88258 + tree fntype, fndecl;
88259 +
88260 + fntype = build_function_type_list(void_type_node, NULL_TREE);
88261 + fndecl = build_fn_decl(track_function, fntype);
88262 + DECL_ASSEMBLER_NAME(fndecl); // for LTO
88263 +
88264 + // insert call to void pax_track_stack(void)
88265 + track_stack = gimple_build_call(fndecl, 0);
88266 + gsi_insert_after(gsi, track_stack, GSI_CONTINUE_LINKING);
88267 +}
88268 +
88269 +#if BUILDING_GCC_VERSION == 4005
88270 +static bool gimple_call_builtin_p(gimple stmt, enum built_in_function code)
88271 +{
88272 + tree fndecl;
88273 +
88274 + if (!is_gimple_call(stmt))
88275 + return false;
88276 + fndecl = gimple_call_fndecl(stmt);
88277 + if (!fndecl)
88278 + return false;
88279 + if (DECL_BUILT_IN_CLASS(fndecl) != BUILT_IN_NORMAL)
88280 + return false;
88281 +// print_node(stderr, "pax", fndecl, 4);
88282 + return DECL_FUNCTION_CODE(fndecl) == code;
88283 +}
88284 +#endif
88285 +
88286 +static bool is_alloca(gimple stmt)
88287 +{
88288 + if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA))
88289 + return true;
88290 +
88291 +#if BUILDING_GCC_VERSION >= 4007
88292 + if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA_WITH_ALIGN))
88293 + return true;
88294 +#endif
88295 +
88296 + return false;
88297 +}
88298 +
88299 +static unsigned int execute_stackleak_tree_instrument(void)
88300 +{
88301 + basic_block bb, entry_bb;
88302 + bool prologue_instrumented = false, is_leaf = true;
88303 +
88304 + entry_bb = ENTRY_BLOCK_PTR_FOR_FUNCTION(cfun)->next_bb;
88305 +
88306 + // 1. loop through BBs and GIMPLE statements
88307 + FOR_EACH_BB(bb) {
88308 + gimple_stmt_iterator gsi;
88309 +
88310 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
88311 + gimple stmt;
88312 +
88313 + stmt = gsi_stmt(gsi);
88314 +
88315 + if (is_gimple_call(stmt))
88316 + is_leaf = false;
88317 +
88318 + // gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes <tree_list 0xb7576450>
88319 + if (!is_alloca(stmt))
88320 + continue;
88321 +
88322 + // 2. insert stack overflow check before each __builtin_alloca call
88323 + stackleak_check_alloca(&gsi);
88324 +
88325 + // 3. insert track call after each __builtin_alloca call
88326 + stackleak_add_instrumentation(&gsi);
88327 + if (bb == entry_bb)
88328 + prologue_instrumented = true;
88329 + }
88330 + }
88331 +
88332 + // special cases for some bad linux code: taking the address of static inline functions will materialize them
88333 + // but we mustn't instrument some of them as the resulting stack alignment required by the function call ABI
88334 + // will break other assumptions regarding the expected (but not otherwise enforced) register clobbering ABI.
88335 + // case in point: native_save_fl on amd64 when optimized for size clobbers rdx if it were instrumented here.
88336 + if (is_leaf && !TREE_PUBLIC(current_function_decl) && DECL_DECLARED_INLINE_P(current_function_decl))
88337 + return 0;
88338 + if (is_leaf && !strncmp(IDENTIFIER_POINTER(DECL_NAME(current_function_decl)), "_paravirt_", 10))
88339 + return 0;
88340 +
88341 + // 4. insert track call at the beginning
88342 + if (!prologue_instrumented) {
88343 + gimple_stmt_iterator gsi;
88344 +
88345 + bb = split_block_after_labels(ENTRY_BLOCK_PTR)->dest;
88346 + if (dom_info_available_p(CDI_DOMINATORS))
88347 + set_immediate_dominator(CDI_DOMINATORS, bb, ENTRY_BLOCK_PTR);
88348 + gsi = gsi_start_bb(bb);
88349 + stackleak_add_instrumentation(&gsi);
88350 + }
88351 +
88352 + return 0;
88353 +}
88354 +
88355 +static unsigned int execute_stackleak_final(void)
88356 +{
88357 + rtx insn;
88358 +
88359 + if (cfun->calls_alloca)
88360 + return 0;
88361 +
88362 + // keep calls only if function frame is big enough
88363 + if (get_frame_size() >= track_frame_size)
88364 + return 0;
88365 +
88366 + // 1. find pax_track_stack calls
88367 + for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
88368 + // rtl match: (call_insn 8 7 9 3 (call (mem (symbol_ref ("pax_track_stack") [flags 0x41] <function_decl 0xb7470e80 pax_track_stack>) [0 S1 A8]) (4)) -1 (nil) (nil))
88369 + rtx body;
88370 +
88371 + if (!CALL_P(insn))
88372 + continue;
88373 + body = PATTERN(insn);
88374 + if (GET_CODE(body) != CALL)
88375 + continue;
88376 + body = XEXP(body, 0);
88377 + if (GET_CODE(body) != MEM)
88378 + continue;
88379 + body = XEXP(body, 0);
88380 + if (GET_CODE(body) != SYMBOL_REF)
88381 + continue;
88382 + if (strcmp(XSTR(body, 0), track_function))
88383 + continue;
88384 +// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
88385 + // 2. delete call
88386 + insn = delete_insn_and_edges(insn);
88387 +#if BUILDING_GCC_VERSION >= 4007
88388 + if (GET_CODE(insn) == NOTE && NOTE_KIND(insn) == NOTE_INSN_CALL_ARG_LOCATION)
88389 + insn = delete_insn_and_edges(insn);
88390 +#endif
88391 + }
88392 +
88393 +// print_simple_rtl(stderr, get_insns());
88394 +// print_rtl(stderr, get_insns());
88395 +// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
88396 +
88397 + return 0;
88398 +}
88399 +
88400 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
88401 +{
88402 + const char * const plugin_name = plugin_info->base_name;
88403 + const int argc = plugin_info->argc;
88404 + const struct plugin_argument * const argv = plugin_info->argv;
88405 + int i;
88406 + struct register_pass_info stackleak_tree_instrument_pass_info = {
88407 + .pass = &stackleak_tree_instrument_pass.pass,
88408 +// .reference_pass_name = "tree_profile",
88409 + .reference_pass_name = "optimized",
88410 + .ref_pass_instance_number = 1,
88411 + .pos_op = PASS_POS_INSERT_BEFORE
88412 + };
88413 + struct register_pass_info stackleak_final_pass_info = {
88414 + .pass = &stackleak_final_rtl_opt_pass.pass,
88415 + .reference_pass_name = "final",
88416 + .ref_pass_instance_number = 1,
88417 + .pos_op = PASS_POS_INSERT_BEFORE
88418 + };
88419 +
88420 + if (!plugin_default_version_check(version, &gcc_version)) {
88421 + error(G_("incompatible gcc/plugin versions"));
88422 + return 1;
88423 + }
88424 +
88425 + register_callback(plugin_name, PLUGIN_INFO, NULL, &stackleak_plugin_info);
88426 +
88427 + for (i = 0; i < argc; ++i) {
88428 + if (!strcmp(argv[i].key, "track-lowest-sp")) {
88429 + if (!argv[i].value) {
88430 + error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
88431 + continue;
88432 + }
88433 + track_frame_size = atoi(argv[i].value);
88434 + if (argv[i].value[0] < '0' || argv[i].value[0] > '9' || track_frame_size < 0)
88435 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
88436 + continue;
88437 + }
88438 + if (!strcmp(argv[i].key, "initialize-locals")) {
88439 + if (argv[i].value) {
88440 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
88441 + continue;
88442 + }
88443 + init_locals = true;
88444 + continue;
88445 + }
88446 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
88447 + }
88448 +
88449 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_tree_instrument_pass_info);
88450 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_final_pass_info);
88451 +
88452 + return 0;
88453 +}
88454 diff --git a/tools/perf/util/include/asm/alternative-asm.h b/tools/perf/util/include/asm/alternative-asm.h
88455 index 6789d78..4afd019e 100644
88456 --- a/tools/perf/util/include/asm/alternative-asm.h
88457 +++ b/tools/perf/util/include/asm/alternative-asm.h
88458 @@ -5,4 +5,7 @@
88459
88460 #define altinstruction_entry #
88461
88462 + .macro pax_force_retaddr rip=0, reload=0
88463 + .endm
88464 +
88465 #endif
88466 diff --git a/usr/gen_init_cpio.c b/usr/gen_init_cpio.c
88467 index af0f22f..9a7d479 100644
88468 --- a/usr/gen_init_cpio.c
88469 +++ b/usr/gen_init_cpio.c
88470 @@ -303,7 +303,7 @@ static int cpio_mkfile(const char *name, const char *location,
88471 int retval;
88472 int rc = -1;
88473 int namesize;
88474 - int i;
88475 + unsigned int i;
88476
88477 mode |= S_IFREG;
88478
88479 @@ -392,9 +392,10 @@ static char *cpio_replace_env(char *new_location)
88480 *env_var = *expanded = '\0';
88481 strncat(env_var, start + 2, end - start - 2);
88482 strncat(expanded, new_location, start - new_location);
88483 - strncat(expanded, getenv(env_var), PATH_MAX);
88484 - strncat(expanded, end + 1, PATH_MAX);
88485 + strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
88486 + strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
88487 strncpy(new_location, expanded, PATH_MAX);
88488 + new_location[PATH_MAX] = 0;
88489 } else
88490 break;
88491 }
88492 diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
88493 index 44ee712..7da730b 100644
88494 --- a/virt/kvm/kvm_main.c
88495 +++ b/virt/kvm/kvm_main.c
88496 @@ -75,7 +75,7 @@ LIST_HEAD(vm_list);
88497
88498 static cpumask_var_t cpus_hardware_enabled;
88499 static int kvm_usage_count = 0;
88500 -static atomic_t hardware_enable_failed;
88501 +static atomic_unchecked_t hardware_enable_failed;
88502
88503 struct kmem_cache *kvm_vcpu_cache;
88504 EXPORT_SYMBOL_GPL(kvm_vcpu_cache);
88505 @@ -2291,7 +2291,7 @@ static void hardware_enable_nolock(void *junk)
88506
88507 if (r) {
88508 cpumask_clear_cpu(cpu, cpus_hardware_enabled);
88509 - atomic_inc(&hardware_enable_failed);
88510 + atomic_inc_unchecked(&hardware_enable_failed);
88511 printk(KERN_INFO "kvm: enabling virtualization on "
88512 "CPU%d failed\n", cpu);
88513 }
88514 @@ -2345,10 +2345,10 @@ static int hardware_enable_all(void)
88515
88516 kvm_usage_count++;
88517 if (kvm_usage_count == 1) {
88518 - atomic_set(&hardware_enable_failed, 0);
88519 + atomic_set_unchecked(&hardware_enable_failed, 0);
88520 on_each_cpu(hardware_enable_nolock, NULL, 1);
88521
88522 - if (atomic_read(&hardware_enable_failed)) {
88523 + if (atomic_read_unchecked(&hardware_enable_failed)) {
88524 hardware_disable_all_nolock();
88525 r = -EBUSY;
88526 }
88527 @@ -2709,7 +2709,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
88528 kvm_arch_vcpu_put(vcpu);
88529 }
88530
88531 -int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
88532 +int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
88533 struct module *module)
88534 {
88535 int r;
88536 @@ -2772,7 +2772,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
88537 if (!vcpu_align)
88538 vcpu_align = __alignof__(struct kvm_vcpu);
88539 kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align,
88540 - 0, NULL);
88541 + SLAB_USERCOPY, NULL);
88542 if (!kvm_vcpu_cache) {
88543 r = -ENOMEM;
88544 goto out_free_3;
88545 @@ -2782,9 +2782,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
88546 if (r)
88547 goto out_free;
88548
88549 - kvm_chardev_ops.owner = module;
88550 - kvm_vm_fops.owner = module;
88551 - kvm_vcpu_fops.owner = module;
88552 + pax_open_kernel();
88553 + *(void **)&kvm_chardev_ops.owner = module;
88554 + *(void **)&kvm_vm_fops.owner = module;
88555 + *(void **)&kvm_vcpu_fops.owner = module;
88556 + pax_close_kernel();
88557
88558 r = misc_register(&kvm_dev);
88559 if (r) {
Unofficial grsecurity patch archive (https://github.com/slashbeast/grsecurity-scrape)